Get WebKit r44544.
diff --git a/Android.jsc.mk b/Android.jsc.mk
index 7ad565a..bfcd6b6 100644
--- a/Android.jsc.mk
+++ b/Android.jsc.mk
@@ -106,6 +106,7 @@
 	external/sqlite/dist \
 	frameworks/base/core/jni/android/graphics \
 	$(LOCAL_PATH)/WebCore \
+	$(LOCAL_PATH)/WebCore/accessibility \
 	$(LOCAL_PATH)/WebCore/bindings/js \
 	$(LOCAL_PATH)/WebCore/bridge \
 	$(LOCAL_PATH)/WebCore/bridge/c \
diff --git a/JavaScriptCore/API/APICast.h b/JavaScriptCore/API/APICast.h
index 1344a16..762a15e 100644
--- a/JavaScriptCore/API/APICast.h
+++ b/JavaScriptCore/API/APICast.h
@@ -26,14 +26,17 @@
 #ifndef APICast_h
 #define APICast_h
 
+#include "JSNumberCell.h"
 #include "JSValue.h"
+#include <wtf/Platform.h>
+#include <wtf/UnusedParam.h>
 
 namespace JSC {
     class ExecState;
     class PropertyNameArray;
     class JSGlobalData;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
 }
 
 typedef const struct OpaqueJSContextGroup* JSContextGroupRef;
@@ -55,9 +58,18 @@
     return reinterpret_cast<JSC::ExecState*>(c);
 }
 
-inline JSC::JSValuePtr toJS(JSValueRef v)
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSValueRef v)
 {
-    return JSC::JSValuePtr::decode(reinterpret_cast<JSC::JSValueEncodedAsPointer*>(const_cast<OpaqueJSValue*>(v)));
+    JSC::JSValue jsValue = JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
+#if USE(ALTERNATE_JSIMMEDIATE)
+    UNUSED_PARAM(exec);
+#else
+    if (jsValue && jsValue.isNumber()) {
+        ASSERT(jsValue.isAPIMangledNumber());
+        return JSC::jsNumber(exec, jsValue.uncheckedGetNumber());
+    }
+#endif
+    return jsValue;
 }
 
 inline JSC::JSObject* toJS(JSObjectRef o)
@@ -75,14 +87,17 @@
     return reinterpret_cast<JSC::JSGlobalData*>(const_cast<OpaqueJSContextGroup*>(g));
 }
 
-inline JSValueRef toRef(JSC::JSValuePtr v)
+inline JSValueRef toRef(JSC::ExecState* exec, JSC::JSValue v)
 {
-    return reinterpret_cast<JSValueRef>(JSC::JSValuePtr::encode(v));
-}
-
-inline JSValueRef* toRef(JSC::JSValuePtr* v)
-{
-    return reinterpret_cast<JSValueRef*>(v);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    UNUSED_PARAM(exec);
+#else
+    if (v && v.isNumber()) {
+        ASSERT(!v.isAPIMangledNumber());
+        return reinterpret_cast<JSValueRef>(JSC::JSValue::encode(JSC::jsAPIMangledNumber(exec, v.uncheckedGetNumber())));
+    }
+#endif
+    return reinterpret_cast<JSValueRef>(JSC::JSValue::encode(v));
 }
 
 inline JSObjectRef toRef(JSC::JSObject* o)
diff --git a/JavaScriptCore/API/JSBase.cpp b/JavaScriptCore/API/JSBase.cpp
index 422b296..fc3d0fe 100644
--- a/JavaScriptCore/API/JSBase.cpp
+++ b/JavaScriptCore/API/JSBase.cpp
@@ -55,15 +55,15 @@
 
     if (completion.complType() == Throw) {
         if (exception)
-            *exception = toRef(completion.value());
+            *exception = toRef(exec, completion.value());
         return 0;
     }
 
     if (completion.value())
-        return toRef(completion.value());
+        return toRef(exec, completion.value());
     
     // happens, for example, when the only statement is an empty (';') statement
-    return toRef(jsUndefined());
+    return toRef(exec, jsUndefined());
 }
 
 bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
@@ -76,7 +76,7 @@
     Completion completion = checkSyntax(exec->dynamicGlobalObject()->globalExec(), source);
     if (completion.complType() == Throw) {
         if (exception)
-            *exception = toRef(completion.value());
+            *exception = toRef(exec, completion.value());
         return false;
     }
     
diff --git a/JavaScriptCore/API/JSBase.h b/JavaScriptCore/API/JSBase.h
index f44d4ad..6f012ca 100644
--- a/JavaScriptCore/API/JSBase.h
+++ b/JavaScriptCore/API/JSBase.h
@@ -65,14 +65,20 @@
 /* JavaScript symbol exports */
 
 #undef JS_EXPORT
-#if defined(__GNUC__)
+#if defined(BUILDING_WX__)
+    #define JS_EXPORT
+#elif defined(__GNUC__)
     #define JS_EXPORT __attribute__((visibility("default")))
 #elif defined(WIN32) || defined(_WIN32)
     /*
      * TODO: Export symbols with JS_EXPORT when using MSVC.
      * See http://bugs.webkit.org/show_bug.cgi?id=16227
      */
-    #define JS_EXPORT
+    #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+    #define JS_EXPORT __declspec(dllexport)
+    #else
+    #define JS_EXPORT __declspec(dllimport)
+    #endif
 #else
     #define JS_EXPORT
 #endif
diff --git a/JavaScriptCore/API/JSCallbackConstructor.cpp b/JavaScriptCore/API/JSCallbackConstructor.cpp
index e10733e..64c83cb 100644
--- a/JavaScriptCore/API/JSCallbackConstructor.cpp
+++ b/JavaScriptCore/API/JSCallbackConstructor.cpp
@@ -61,10 +61,17 @@
         int argumentCount = static_cast<int>(args.size());
         Vector<JSValueRef, 16> arguments(argumentCount);
         for (int i = 0; i < argumentCount; i++)
-            arguments[i] = toRef(args.at(exec, i));
-            
-        JSLock::DropAllLocks dropAllLocks(exec);
-        return toJS(callback(ctx, constructorRef, argumentCount, arguments.data(), toRef(exec->exceptionSlot())));
+            arguments[i] = toRef(exec, args.at(i));
+
+        JSValueRef exception = 0;
+        JSObjectRef result;
+        {
+            JSLock::DropAllLocks dropAllLocks(exec);
+            result = callback(ctx, constructorRef, argumentCount, arguments.data(), &exception);
+        }
+        if (exception)
+            exec->setException(toJS(exec, exception));
+        return toJS(result);
     }
     
     return toJS(JSObjectMake(ctx, static_cast<JSCallbackConstructor*>(constructor)->classRef(), 0));
diff --git a/JavaScriptCore/API/JSCallbackConstructor.h b/JavaScriptCore/API/JSCallbackConstructor.h
index cb8307f..1f06249 100644
--- a/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/JavaScriptCore/API/JSCallbackConstructor.h
@@ -39,7 +39,7 @@
     JSObjectCallAsConstructorCallback callback() const { return m_callback; }
     static const ClassInfo info;
     
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot)); 
     }
diff --git a/JavaScriptCore/API/JSCallbackFunction.cpp b/JavaScriptCore/API/JSCallbackFunction.cpp
index 86a2ebc..1b3217b 100644
--- a/JavaScriptCore/API/JSCallbackFunction.cpp
+++ b/JavaScriptCore/API/JSCallbackFunction.cpp
@@ -46,7 +46,7 @@
 {
 }
 
-JSValuePtr JSCallbackFunction::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue JSCallbackFunction::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef functionRef = toRef(functionObject);
@@ -55,10 +55,18 @@
     int argumentCount = static_cast<int>(args.size());
     Vector<JSValueRef, 16> arguments(argumentCount);
     for (int i = 0; i < argumentCount; i++)
-        arguments[i] = toRef(args.at(exec, i));
+        arguments[i] = toRef(exec, args.at(i));
 
-    JSLock::DropAllLocks dropAllLocks(exec);
-    return toJS(static_cast<JSCallbackFunction*>(functionObject)->m_callback(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), toRef(exec->exceptionSlot())));
+    JSValueRef exception = 0;
+    JSValueRef result;
+    {
+        JSLock::DropAllLocks dropAllLocks(exec);
+        result = static_cast<JSCallbackFunction*>(functionObject)->m_callback(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception);
+    }
+    if (exception)
+        exec->setException(toJS(exec, exception));
+
+    return toJS(exec, result);
 }
 
 CallType JSCallbackFunction::getCallData(CallData& callData)
diff --git a/JavaScriptCore/API/JSCallbackFunction.h b/JavaScriptCore/API/JSCallbackFunction.h
index 46f6fcc..7dd87b5 100644
--- a/JavaScriptCore/API/JSCallbackFunction.h
+++ b/JavaScriptCore/API/JSCallbackFunction.h
@@ -39,7 +39,7 @@
     
     // InternalFunction mish-mashes constructor and function behavior -- we should 
     // refactor the code so this override isn't necessary
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot)); 
     }
@@ -48,7 +48,7 @@
     virtual CallType getCallData(CallData&);
     virtual const ClassInfo* classInfo() const { return &info; }
 
-    static JSValuePtr call(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    static JSValue JSC_HOST_CALL call(ExecState*, JSObject*, JSValue, const ArgList&);
 
     JSObjectCallAsFunctionCallback m_callback;
 };
diff --git a/JavaScriptCore/API/JSCallbackObject.h b/JavaScriptCore/API/JSCallbackObject.h
index 9001c43..9d22ad9 100644
--- a/JavaScriptCore/API/JSCallbackObject.h
+++ b/JavaScriptCore/API/JSCallbackObject.h
@@ -48,7 +48,7 @@
     JSClassRef classRef() const { return m_callbackObjectData->jsClass; }
     bool inherits(JSClassRef) const;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | OverridesHasInstance)); 
     }
@@ -59,12 +59,12 @@
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&);
     
-    virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
+    virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
     virtual bool deleteProperty(ExecState*, const Identifier&);
     virtual bool deleteProperty(ExecState*, unsigned);
 
-    virtual bool hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr proto);
+    virtual bool hasInstance(ExecState* exec, JSValue value, JSValue proto);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
@@ -77,14 +77,14 @@
 
     void init(ExecState*);
  
-    static JSCallbackObject* asCallbackObject(JSValuePtr);
+    static JSCallbackObject* asCallbackObject(JSValue);
  
-    static JSValuePtr call(ExecState*, JSObject* functionObject, JSValuePtr thisValue, const ArgList&);
+    static JSValue JSC_HOST_CALL call(ExecState*, JSObject* functionObject, JSValue thisValue, const ArgList&);
     static JSObject* construct(ExecState*, JSObject* constructor, const ArgList&);
    
-    static JSValuePtr staticValueGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr staticFunctionGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr callbackGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue staticValueGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue staticFunctionGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue callbackGetter(ExecState*, const Identifier&, const PropertySlot&);
 
     struct JSCallbackObjectData {
         JSCallbackObjectData(void* privateData, JSClassRef jsClass)
diff --git a/JavaScriptCore/API/JSCallbackObjectFunctions.h b/JavaScriptCore/API/JSCallbackObjectFunctions.h
index d6ae9bd..987c59f 100644
--- a/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -40,7 +40,7 @@
 namespace JSC {
 
 template <class Base>
-inline JSCallbackObject<Base>* JSCallbackObject<Base>::asCallbackObject(JSValuePtr value)
+inline JSCallbackObject<Base>* JSCallbackObject<Base>::asCallbackObject(JSValue value)
 {
     ASSERT(asObject(value)->inherits(&info));
     return static_cast<JSCallbackObject*>(asObject(value));
@@ -125,12 +125,15 @@
         } else if (JSObjectGetPropertyCallback getProperty = jsClass->getProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
             JSValueRef exception = 0;
-            JSValueRef value = getProperty(ctx, thisRef, propertyNameRef.get(), &exception);
-            exec->setException(toJS(exception));
+            JSValueRef value;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                value = getProperty(ctx, thisRef, propertyNameRef.get(), &exception);
+            }
+            exec->setException(toJS(exec, exception));
             if (value) {
-                slot.setValue(toJS(value));
+                slot.setValue(toJS(exec, value));
                 return true;
             }
             if (exception) {
@@ -164,21 +167,24 @@
 }
 
 template <class Base>
-void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSContextRef ctx = toRef(exec);
     JSObjectRef thisRef = toRef(this);
     RefPtr<OpaqueJSString> propertyNameRef;
-    JSValueRef valueRef = toRef(value);
+    JSValueRef valueRef = toRef(exec, value);
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectSetPropertyCallback setProperty = jsClass->setProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
             JSValueRef exception = 0;
-            bool result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
-            exec->setException(toJS(exception));
+            bool result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
+            }
+            exec->setException(toJS(exec, exception));
             if (result || exception)
                 return;
         }
@@ -190,10 +196,13 @@
                 if (JSObjectSetPropertyCallback setProperty = entry->setProperty) {
                     if (!propertyNameRef)
                         propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-                    JSLock::DropAllLocks dropAllLocks(exec);
                     JSValueRef exception = 0;
-                    bool result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
-                    exec->setException(toJS(exception));
+                    bool result;
+                    {
+                        JSLock::DropAllLocks dropAllLocks(exec);
+                        result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
+                    }
+                    exec->setException(toJS(exec, exception));
                     if (result || exception)
                         return;
                 } else
@@ -225,10 +234,13 @@
         if (JSObjectDeletePropertyCallback deleteProperty = jsClass->deleteProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
             JSValueRef exception = 0;
-            bool result = deleteProperty(ctx, thisRef, propertyNameRef.get(), &exception);
-            exec->setException(toJS(exception));
+            bool result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = deleteProperty(ctx, thisRef, propertyNameRef.get(), &exception);
+            }
+            exec->setException(toJS(exec, exception));
             if (result || exception)
                 return true;
         }
@@ -282,11 +294,14 @@
             int argumentCount = static_cast<int>(args.size());
             Vector<JSValueRef, 16> arguments(argumentCount);
             for (int i = 0; i < argumentCount; i++)
-                arguments[i] = toRef(args.at(exec, i));
-            JSLock::DropAllLocks dropAllLocks(exec);
+                arguments[i] = toRef(exec, args.at(i));
             JSValueRef exception = 0;
-            JSObject* result = toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), &exception));
-            exec->setException(toJS(exception));
+            JSObject* result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), &exception));
+            }
+            exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -296,17 +311,20 @@
 }
 
 template <class Base>
-bool JSCallbackObject<Base>::hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr)
+bool JSCallbackObject<Base>::hasInstance(ExecState* exec, JSValue value, JSValue)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef thisRef = toRef(this);
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectHasInstanceCallback hasInstance = jsClass->hasInstance) {
-            JSLock::DropAllLocks dropAllLocks(exec);
             JSValueRef exception = 0;
-            bool result = hasInstance(execRef, thisRef, toRef(value), &exception);
-            exec->setException(toJS(exception));
+            bool result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = hasInstance(execRef, thisRef, toRef(exec, value), &exception);
+            }
+            exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -326,7 +344,7 @@
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef functionRef = toRef(functionObject);
@@ -337,17 +355,20 @@
             int argumentCount = static_cast<int>(args.size());
             Vector<JSValueRef, 16> arguments(argumentCount);
             for (int i = 0; i < argumentCount; i++)
-                arguments[i] = toRef(args.at(exec, i));
-            JSLock::DropAllLocks dropAllLocks(exec);
+                arguments[i] = toRef(exec, args.at(i));
             JSValueRef exception = 0;
-            JSValuePtr result = toJS(callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception));
-            exec->setException(toJS(exception));
+            JSValue result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = toJS(exec, callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception));
+            }
+            exec->setException(toJS(exec, exception));
             return result;
         }
     }
     
     ASSERT_NOT_REACHED(); // getCallData should prevent us from reaching here
-    return noValue();
+    return JSValue();
 }
 
 template <class Base>
@@ -401,14 +422,16 @@
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass)
         if (JSObjectConvertToTypeCallback convertToType = jsClass->convertToType) {
-            JSLock::DropAllLocks dropAllLocks(exec);
-            
             JSValueRef exception = 0;
-            JSValueRef value = convertToType(ctx, thisRef, kJSTypeNumber, &exception);
-            exec->setException(toJS(exception));
+            JSValueRef value;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                value = convertToType(ctx, thisRef, kJSTypeNumber, &exception);
+            }
+            exec->setException(toJS(exec, exception));
             if (value) {
                 double dValue;
-                return toJS(value).getNumber(dValue) ? dValue : NaN;
+                return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
             }
         }
             
@@ -423,15 +446,15 @@
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass)
         if (JSObjectConvertToTypeCallback convertToType = jsClass->convertToType) {
-            JSValueRef value;
             JSValueRef exception = 0;
+            JSValueRef value;
             {
                 JSLock::DropAllLocks dropAllLocks(exec);
                 value = convertToType(ctx, thisRef, kJSTypeString, &exception);
-                exec->setException(toJS(exception));
             }
+            exec->setException(toJS(exec, exception));
             if (value)
-                return toJS(value).getString();
+                return toJS(exec, value).getString();
             if (exception)
                 return "";
         }
@@ -462,7 +485,7 @@
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
     
@@ -475,12 +498,15 @@
                 if (JSObjectGetPropertyCallback getProperty = entry->getProperty) {
                     if (!propertyNameRef)
                         propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-                    JSLock::DropAllLocks dropAllLocks(exec);
                     JSValueRef exception = 0;
-                    JSValueRef value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
-                    exec->setException(toJS(exception));
+                    JSValueRef value;
+                    {
+                        JSLock::DropAllLocks dropAllLocks(exec);
+                        value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
+                    }
+                    exec->setException(toJS(exec, exception));
                     if (value)
-                        return toJS(value);
+                        return toJS(exec, value);
                     if (exception)
                         return jsUndefined();
                 }
@@ -489,7 +515,7 @@
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
     
@@ -514,7 +540,7 @@
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
     
@@ -525,13 +551,15 @@
         if (JSObjectGetPropertyCallback getProperty = jsClass->getProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
-
             JSValueRef exception = 0;
-            JSValueRef value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
-            exec->setException(toJS(exception));
+            JSValueRef value;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
+            }
+            exec->setException(toJS(exec, exception));
             if (value)
-                return toJS(value);
+                return toJS(exec, value);
             if (exception)
                 return jsUndefined();
         }
diff --git a/JavaScriptCore/API/JSContextRef.cpp b/JavaScriptCore/API/JSContextRef.cpp
index c331179..a3bdc69 100644
--- a/JavaScriptCore/API/JSContextRef.cpp
+++ b/JavaScriptCore/API/JSContextRef.cpp
@@ -97,7 +97,7 @@
 
     JSGlobalObject* globalObject = new (globalData.get()) JSCallbackObject<JSGlobalObject>(globalObjectClass);
     ExecState* exec = globalObject->globalExec();
-    JSValuePtr prototype = globalObjectClass->prototype(exec);
+    JSValue prototype = globalObjectClass->prototype(exec);
     if (!prototype)
         prototype = jsNull();
     globalObject->resetPrototype(prototype);
diff --git a/JavaScriptCore/API/JSObjectRef.cpp b/JavaScriptCore/API/JSObjectRef.cpp
index e81e512..50ee635 100644
--- a/JavaScriptCore/API/JSObjectRef.cpp
+++ b/JavaScriptCore/API/JSObjectRef.cpp
@@ -105,10 +105,10 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsPrototype = jsClass 
-        ? jsClass->prototype(exec)
-        : exec->lexicalGlobalObject()->objectPrototype();
-    
+    JSValue jsPrototype = jsClass ? jsClass->prototype(exec) : 0;
+    if (!jsPrototype)
+        jsPrototype = exec->lexicalGlobalObject()->objectPrototype();
+
     JSCallbackConstructor* constructor = new (exec) JSCallbackConstructor(exec->lexicalGlobalObject()->callbackConstructorStructure(), jsClass, callAsConstructor);
     constructor->putDirect(exec->propertyNames().prototype, jsPrototype, DontEnum | DontDelete | ReadOnly);
     return toRef(constructor);
@@ -122,7 +122,7 @@
 
     Identifier nameID = name ? name->identifier(&exec->globalData()) : Identifier(exec, "anonymous");
     
-    ArgList args;
+    MarkedArgumentBuffer args;
     for (unsigned i = 0; i < parameterCount; i++)
         args.append(jsString(exec, parameterNames[i]->ustring()));
     args.append(jsString(exec, body->ustring()));
@@ -130,7 +130,7 @@
     JSObject* result = constructFunction(exec, args, nameID, sourceURL->ustring(), startingLineNumber);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -145,9 +145,9 @@
 
     JSObject* result;
     if (argumentCount) {
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         for (size_t i = 0; i < argumentCount; ++i)
-            argList.append(toJS(arguments[i]));
+            argList.append(toJS(exec, arguments[i]));
 
         result = constructArray(exec, argList);
     } else
@@ -155,7 +155,7 @@
 
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -169,14 +169,14 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     JSObject* result = constructDate(exec, argList);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -190,14 +190,14 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     JSObject* result = constructError(exec, argList);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -211,14 +211,14 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     JSObject* result = constructRegExp(exec, argList);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -226,16 +226,24 @@
     return toRef(result);
 }
 
-JSValueRef JSObjectGetPrototype(JSContextRef, JSObjectRef object)
+JSValueRef JSObjectGetPrototype(JSContextRef ctx, JSObjectRef object)
 {
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
     JSObject* jsObject = toJS(object);
-    return toRef(jsObject->prototype());
+    return toRef(exec, jsObject->prototype());
 }
 
-void JSObjectSetPrototype(JSContextRef, JSObjectRef object, JSValueRef value)
+void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value)
 {
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
     JSObject* jsObject = toJS(object);
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
 
     jsObject->setPrototype(jsValue.isObject() ? jsValue : jsNull());
 }
@@ -259,13 +267,13 @@
 
     JSObject* jsObject = toJS(object);
 
-    JSValuePtr jsValue = jsObject->get(exec, propertyName->identifier(&exec->globalData()));
+    JSValue jsValue = jsObject->get(exec, propertyName->identifier(&exec->globalData()));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
-    return toRef(jsValue);
+    return toRef(exec, jsValue);
 }
 
 void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSPropertyAttributes attributes, JSValueRef* exception)
@@ -276,7 +284,7 @@
 
     JSObject* jsObject = toJS(object);
     Identifier name(propertyName->identifier(&exec->globalData()));
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
 
     if (attributes && !jsObject->hasProperty(exec, name))
         jsObject->putWithAttributes(exec, name, jsValue, attributes);
@@ -287,7 +295,7 @@
 
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
 }
@@ -300,13 +308,13 @@
 
     JSObject* jsObject = toJS(object);
 
-    JSValuePtr jsValue = jsObject->get(exec, propertyIndex);
+    JSValue jsValue = jsObject->get(exec, propertyIndex);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
-    return toRef(jsValue);
+    return toRef(exec, jsValue);
 }
 
 
@@ -317,12 +325,12 @@
     JSLock lock(exec);
 
     JSObject* jsObject = toJS(object);
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     
     jsObject->put(exec, propertyIndex, jsValue);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
 }
@@ -338,7 +346,7 @@
     bool result = jsObject->deleteProperty(exec, propertyName->identifier(&exec->globalData()));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
     return result;
@@ -389,19 +397,19 @@
     if (!jsThisObject)
         jsThisObject = exec->globalThisValue();
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; i++)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     CallData callData;
     CallType callType = jsObject->getCallData(callData);
     if (callType == CallTypeNone)
         return 0;
 
-    JSValueRef result = toRef(call(exec, jsObject, callType, callData, jsThisObject, argList));
+    JSValueRef result = toRef(exec, call(exec, jsObject, callType, callData, jsThisObject, argList));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -428,13 +436,13 @@
     if (constructType == ConstructTypeNone)
         return 0;
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; i++)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
     JSObjectRef result = toRef(construct(exec, jsObject, constructType, constructData, argList));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
diff --git a/JavaScriptCore/API/JSStringRefCF.cpp b/JavaScriptCore/API/JSStringRefCF.cpp
index 2b8fd9e..d1f6fe3 100644
--- a/JavaScriptCore/API/JSStringRefCF.cpp
+++ b/JavaScriptCore/API/JSStringRefCF.cpp
@@ -37,7 +37,10 @@
 JSStringRef JSStringCreateWithCFString(CFStringRef string)
 {
     JSC::initializeThreading();
-    CFIndex length = CFStringGetLength(string);
+
+    // We cannot use CFIndex here since CFStringGetLength can return values larger than
+    // it can hold.  (<rdar://problem/6806478>)
+    size_t length = CFStringGetLength(string);
     if (length) {
         OwnArrayPtr<UniChar> buffer(new UniChar[length]);
         CFStringGetCharacters(string, CFRangeMake(0, length), buffer.get());
diff --git a/JavaScriptCore/API/JSValueRef.cpp b/JavaScriptCore/API/JSValueRef.cpp
index 7080952..2207181 100644
--- a/JavaScriptCore/API/JSValueRef.cpp
+++ b/JavaScriptCore/API/JSValueRef.cpp
@@ -41,9 +41,14 @@
 
 #include <algorithm> // for std::min
 
-JSType JSValueGetType(JSContextRef, JSValueRef value)
+JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
 {
-    JSC::JSValuePtr jsValue = toJS(value);
+    JSC::ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSC::JSLock lock(exec);
+
+    JSC::JSValue jsValue = toJS(exec, value);
+
     if (jsValue.isUndefined())
         return kJSTypeUndefined;
     if (jsValue.isNull())
@@ -60,45 +65,73 @@
 
 using namespace JSC; // placed here to avoid conflict between JSC::JSType and JSType, above.
 
-bool JSValueIsUndefined(JSContextRef, JSValueRef value)
+bool JSValueIsUndefined(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
     return jsValue.isUndefined();
 }
 
-bool JSValueIsNull(JSContextRef, JSValueRef value)
+bool JSValueIsNull(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
     return jsValue.isNull();
 }
 
-bool JSValueIsBoolean(JSContextRef, JSValueRef value)
+bool JSValueIsBoolean(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
     return jsValue.isBoolean();
 }
 
-bool JSValueIsNumber(JSContextRef, JSValueRef value)
+bool JSValueIsNumber(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
     return jsValue.isNumber();
 }
 
-bool JSValueIsString(JSContextRef, JSValueRef value)
+bool JSValueIsString(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
     return jsValue.isString();
 }
 
-bool JSValueIsObject(JSContextRef, JSValueRef value)
+bool JSValueIsObject(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
     return jsValue.isObject();
 }
 
-bool JSValueIsObjectOfClass(JSContextRef, JSValueRef value, JSClassRef jsClass)
+bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsClass)
 {
-    JSValuePtr jsValue = toJS(value);
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
     
     if (JSObject* o = jsValue.getObject()) {
         if (o->inherits(&JSCallbackObject<JSGlobalObject>::info))
@@ -115,25 +148,28 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsA = toJS(a);
-    JSValuePtr jsB = toJS(b);
+    JSValue jsA = toJS(exec, a);
+    JSValue jsB = toJS(exec, b);
 
-    bool result = JSValuePtr::equal(exec, jsA, jsB); // false if an exception is thrown
+    bool result = JSValue::equal(exec, jsA, jsB); // false if an exception is thrown
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
     return result;
 }
 
-bool JSValueIsStrictEqual(JSContextRef, JSValueRef a, JSValueRef b)
+bool JSValueIsStrictEqual(JSContextRef ctx, JSValueRef a, JSValueRef b)
 {
-    JSValuePtr jsA = toJS(a);
-    JSValuePtr jsB = toJS(b);
-    
-    bool result = JSValuePtr::strictEqual(jsA, jsB);
-    return result;
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsA = toJS(exec, a);
+    JSValue jsB = toJS(exec, b);
+
+    return JSValue::strictEqual(jsA, jsB);
 }
 
 bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObjectRef constructor, JSValueRef* exception)
@@ -142,32 +178,45 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
+
     JSObject* jsConstructor = toJS(constructor);
     if (!jsConstructor->structure()->typeInfo().implementsHasInstance())
         return false;
     bool result = jsConstructor->hasInstance(exec, jsValue, jsConstructor->get(exec, exec->propertyNames().prototype)); // false if an exception is thrown
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
     return result;
 }
 
-JSValueRef JSValueMakeUndefined(JSContextRef)
+JSValueRef JSValueMakeUndefined(JSContextRef ctx)
 {
-    return toRef(jsUndefined());
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toRef(exec, jsUndefined());
 }
 
-JSValueRef JSValueMakeNull(JSContextRef)
+JSValueRef JSValueMakeNull(JSContextRef ctx)
 {
-    return toRef(jsNull());
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toRef(exec, jsNull());
 }
 
-JSValueRef JSValueMakeBoolean(JSContextRef, bool value)
+JSValueRef JSValueMakeBoolean(JSContextRef ctx, bool value)
 {
-    return toRef(jsBoolean(value));
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toRef(exec, jsBoolean(value));
 }
 
 JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
@@ -176,7 +225,7 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    return toRef(jsNumber(exec, value));
+    return toRef(exec, jsNumber(exec, value));
 }
 
 JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string)
@@ -185,13 +234,16 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    return toRef(jsString(exec, string->ustring()));
+    return toRef(exec, jsString(exec, string->ustring()));
 }
 
 bool JSValueToBoolean(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    JSValuePtr jsValue = toJS(value);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
     return jsValue.toBoolean(exec);
 }
 
@@ -201,12 +253,12 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
 
     double number = jsValue.toNumber(exec);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         number = NaN;
     }
@@ -219,12 +271,12 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     
     RefPtr<OpaqueJSString> stringRef(OpaqueJSString::create(jsValue.toString(exec)));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         stringRef.clear();
     }
@@ -237,12 +289,12 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     
     JSObjectRef objectRef = toRef(jsValue.toObject(exec));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         objectRef = 0;
     }
@@ -255,7 +307,7 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     gcProtect(jsValue);
 }
 
@@ -265,6 +317,6 @@
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     gcUnprotect(jsValue);
 }
diff --git a/JavaScriptCore/API/tests/testapi.c b/JavaScriptCore/API/tests/testapi.c
index bbcf1e7..2fa2a84 100644
--- a/JavaScriptCore/API/tests/testapi.c
+++ b/JavaScriptCore/API/tests/testapi.c
@@ -118,6 +118,16 @@
     JSStringRelease(valueAsString);
 }
 
+static bool timeZoneIsPST()
+{
+    char timeZoneName[70];
+    struct tm gtm;
+    memset(&gtm, 0, sizeof(gtm));
+    strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
+
+    return 0 == strcmp("PST", timeZoneName);
+}
+
 static JSValueRef jsGlobalValue; // non-stack value for testing JSValueProtect()
 
 /* MyObject pseudo-class */
@@ -689,6 +699,17 @@
     return JSValueMakeNumber(ctx, 3);
 }
 
+static JSValueRef functionGC(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(function);
+    UNUSED_PARAM(thisObject);
+    UNUSED_PARAM(argumentCount);
+    UNUSED_PARAM(arguments);
+    UNUSED_PARAM(exception);
+    JSGarbageCollect(context);
+    return JSValueMakeUndefined(context);
+}
+
 static JSStaticValue globalObject_staticValues[] = {
     { "globalStaticValue", globalObject_get, globalObject_set, kJSPropertyAttributeNone },
     { 0, 0, 0, 0 }
@@ -696,6 +717,7 @@
 
 static JSStaticFunction globalObject_staticFunctions[] = {
     { "globalStaticFunction", globalObject_call, kJSPropertyAttributeNone },
+    { "gc", functionGC, kJSPropertyAttributeNone },
     { 0, 0, 0 }
 };
 
@@ -1058,7 +1080,8 @@
 
     JSValueRef argumentsDateValues[] = { JSValueMakeNumber(context, 0) };
     o = JSObjectMakeDate(context, 1, argumentsDateValues, NULL);
-    assertEqualsAsUTF8String(o, "Wed Dec 31 1969 16:00:00 GMT-0800 (PST)");
+    if (timeZoneIsPST())
+        assertEqualsAsUTF8String(o, "Wed Dec 31 1969 16:00:00 GMT-0800 (PST)");
 
     string = JSStringCreateWithUTF8CString("an error message");
     JSValueRef argumentsErrorValues[] = { JSValueMakeString(context, string) };
@@ -1113,6 +1136,13 @@
     ASSERT(JSValueIsEqual(context, v, o, NULL));
     JSStringRelease(script);
 
+    // Verify that creating a constructor for a class with no static functions does not trigger
+    // an assert inside putDirect or lead to a crash during GC. <https://bugs.webkit.org/show_bug.cgi?id=25785>
+    nullDefinition = kJSClassDefinitionEmpty;
+    nullClass = JSClassCreate(&nullDefinition);
+    myConstructor = JSObjectMakeConstructor(context, nullClass, 0);
+    JSClassRelease(nullClass);
+
     char* scriptUTF8 = createStringWithContentsOfFile(scriptPath);
     if (!scriptUTF8) {
         printf("FAIL: Test script could not be loaded.\n");
@@ -1140,6 +1170,7 @@
     v = NULL;
     o = NULL;
     globalObject = NULL;
+    myConstructor = NULL;
 
     JSStringRelease(jsEmptyIString);
     JSStringRelease(jsOneIString);
diff --git a/JavaScriptCore/API/tests/testapi.js b/JavaScriptCore/API/tests/testapi.js
index 6a1fab3..82756b5 100644
--- a/JavaScriptCore/API/tests/testapi.js
+++ b/JavaScriptCore/API/tests/testapi.js
@@ -22,6 +22,11 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
+
+function bludgeonArguments() { if (0) arguments; return function g() {} }
+h = bludgeonArguments();
+gc();
+
 var failed = false;
 function pass(msg)
 {
diff --git a/JavaScriptCore/AllInOneFile.cpp b/JavaScriptCore/AllInOneFile.cpp
index 904734f..4ccef08 100644
--- a/JavaScriptCore/AllInOneFile.cpp
+++ b/JavaScriptCore/AllInOneFile.cpp
@@ -47,7 +47,7 @@
 #include "runtime/Collector.cpp"
 #include "runtime/CommonIdentifiers.cpp"
 #include "runtime/DateConstructor.cpp"
-#include "runtime/DateMath.cpp"
+#include "runtime/DateConversion.cpp"
 #include "runtime/DatePrototype.cpp"
 #include "runtime/DateInstance.cpp"
 #include "wtf/dtoa.cpp"
diff --git a/JavaScriptCore/Android.mk b/JavaScriptCore/Android.mk
index fbad0f6..d7004da 100644
--- a/JavaScriptCore/Android.mk
+++ b/JavaScriptCore/Android.mk
@@ -71,6 +71,7 @@
 	parser/Lexer.cpp \
 	parser/Nodes.cpp \
 	parser/Parser.cpp \
+	parser/ParserArena.cpp \
 	\
 	pcre/pcre_compile.cpp \
 	pcre/pcre_exec.cpp \
@@ -98,8 +99,8 @@
 	runtime/Completion.cpp \
 	runtime/ConstructData.cpp \
 	runtime/DateConstructor.cpp \
+	runtime/DateConversion.cpp \
 	runtime/DateInstance.cpp \
-	runtime/DateMath.cpp \
 	runtime/DatePrototype.cpp \
 	runtime/Error.cpp \
 	runtime/ErrorConstructor.cpp \
@@ -132,6 +133,7 @@
 	runtime/JSValue.cpp \
 	runtime/JSVariableObject.cpp \
 	runtime/JSWrapperObject.cpp \
+	runtime/LiteralParser.cpp \
 	runtime/Lookup.cpp \
 	runtime/MathObject.cpp \
 	runtime/NativeErrorConstructor.cpp \
@@ -169,6 +171,7 @@
 	wtf/Assertions.cpp \
 	wtf/ByteArray.cpp \
 	wtf/CurrentTime.cpp \
+	wtf/DateMath.cpp \
 	wtf/FastMalloc.cpp \
 	wtf/HashTable.cpp \
 	wtf/MainThread.cpp \
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 2cecfd2..d06dfa0 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,8909 @@
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable JIT_OPTIMIZE_CALL & JIT_OPTIMIZE_METHOD_CALLS on ARMv7 platforms.
+
+        These optimizations function correctly with no further changes.
+
+        * wtf/Platform.h:
+            Change to enable JIT_OPTIMIZE_CALL & JIT_OPTIMIZE_METHOD_CALLS.
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Not Reviewed, build fix.
+
+        * assembler/MacroAssemblerARMv7.h:
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable JIT_OPTIMIZE_ARITHMETIC on ARMv7 platforms.
+
+        Temporarily split support for 'branchTruncateDoubleToInt32' onto its own switch
+        ('supportsFloatingPointTruncate').  See comment in MacroAssemblerARMv7, we need
+        to work out wherther we are going to be able to support the current interface on
+        all platforms, or whether this should be refactored.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsFloatingPoint):
+            Add implementation of supportsFloatingPointTruncate (returns true).
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointTruncate):
+            Add implementation of supportsFloatingPointTruncate (returns false).
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        (JSC::MacroAssemblerARMv7::addDouble):
+        (JSC::MacroAssemblerARMv7::subDouble):
+        (JSC::MacroAssemblerARMv7::mulDouble):
+        (JSC::MacroAssemblerARMv7::convertInt32ToDouble):
+        (JSC::MacroAssemblerARMv7::branchDouble):
+            Implement FP code genertion operations.
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::supportsFloatingPointTruncate):
+            Add implementation of supportsFloatingPointTruncate (returns true).
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointTruncate):
+            Add implementation of supportsFloatingPointTruncate (returns true).
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+            Changed to call supportsFloatingPointTruncate().
+        (JSC::JIT::emitSlow_op_rshift):
+            Changed to call supportsFloatingPointTruncate().
+        * wtf/Platform.h:
+            Change to enable JIT_OPTIMIZE_ARITHMETIC.
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe & Geoff Garen.
+
+        Enable JIT_OPTIMIZE_PROPERTY_ACCESS on ARMv7 platforms.
+
+        Firm up interface for planting load intructions that will be repatched by
+        repatchLoadPtrToLEA().  This method should now no longer be applied to just
+        any loadPtr instruction.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::loadPtrWithPatchToLEA):
+            Implement loadPtrWithPatchToLEA interface (plants a load with a fixed width address).
+        (JSC::MacroAssemblerARMv7::move):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::moveWithPatch):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+            Switch to use common method 'moveFixedWidthEncoding()' to perform fixed width (often patchable) loads.
+        (JSC::MacroAssemblerARMv7::moveFixedWidthEncoding):
+            Move an immediate to a register, always plants movT3/movt instruction pair.
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::loadPtrWithPatchToLEA):
+            Implement loadPtrWithPatchToLEA interface (just a regular 32-bit load on x86).
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::loadPtrWithPatchToLEA):
+            Implement loadPtrWithPatchToLEA interface (just a regular 64-bit load on x86_64).
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        * wtf/Platform.h:
+            Change to enable JIT_OPTIMIZE_PROPERTY_ACCESS.
+
+2009-06-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable JS language JIT for ARM thumb2 platforms.  Add ARMv7 specific
+        asm & constants, add appropriate configuration switches to Platform.h.
+
+        Landing this disabled until jump linking is completed (see YARR jit patch).
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32):
+            Fix: should load pointer with ImmPtr not Imm32.
+        (JSC::MacroAssemblerARMv7::store32):
+            Fix: should load pointer with ImmPtr not Imm32.
+        (JSC::MacroAssemblerARMv7::move):
+            Fix: When moving an Imm32 that is actually a pointer, should call movT3()
+            not mov(), to ensure code generation is repeatable (for exception handling).
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+            Disable JIT_OPTIMIZE_NATIVE_CALL specific code generation if the optimization is not enabled.
+        * jit/JIT.h:
+            Add ARMv7 specific values of constants & register names.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::preverveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+            Implement for ARMv7 (move value to/from lr).
+        * jit/JITStubs.cpp:
+            Add JIT entry/thow trampolines, add macro to add thunk wrapper around stub routines.
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+            Add ARMv7 stack frame object.
+        * wtf/Platform.h:
+            Add changes necessary to allow JIT to build on this platform, disabled.
+
+2009-06-08  Mark Rowe  <mrowe@apple.com>
+
+        Speculative GTK build fix.
+
+        * wtf/DateMath.cpp:
+
+2009-06-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Previous patch caused a regression.
+
+        Restructure so no new (empty, inline) function calls are added on x86.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::makeWritable):
+        (JSC::ExecutableAllocator::makeExecutable):
+        (JSC::ExecutableAllocator::reprotectRegion):
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, GTK build fix (thanks, bdash).
+
+        * GNUmakefile.am: Moved DateMath with all other wtf kin.
+
+2009-06-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add (incomplete) support to YARR for running with the jit enabled
+        on Arm thumb2 platforms.  Adds new Assembler/MacroAssembler classes,
+        along with cache flushing support, tweaks to MacroAssemblerCodePtr
+        to support decorated thumb code pointers, and new enter/exit code
+        to YARR jit for the platform.
+
+        Support for this platform is still under development - the assembler
+        currrently only supports planting and linking jumps with a 16Mb range.
+        As such, initially commiting in a disabled state.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            Add new assembler files.
+        * assembler/ARMv7Assembler.h: Added.
+            Add new Assembler.
+        * assembler/AbstractMacroAssembler.h:
+            Tweaks to ensure sizes of pointer values planted in JIT code do not change.
+        * assembler/MacroAssembler.h:
+            On ARMv7 platforms use MacroAssemblerARMv7.
+        * assembler/MacroAssemblerARMv7.h: Added.
+            Add new MacroAssembler.
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+            Add better ASSERT.
+        (JSC::ReturnAddressPtr::ReturnAddressPtr):
+            Add better ASSERT.
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+            On ARMv7, MacroAssemblerCodePtr's mush be 'decorated' with a low bit set,
+            to indicate to the processor that the code is thumb code, not traditional
+            32-bit ARM.
+        (JSC::MacroAssemblerCodePtr::dataLocation):
+            On ARMv7, decoration must be removed.
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::makeWritable):
+            Reformatted, no change.
+        (JSC::ExecutableAllocator::makeExecutable):
+            When marking code executable also cache flush it, where necessary.
+        (JSC::ExecutableAllocator::MakeWritable::MakeWritable):
+            Only use the null implementation of this class if both !ASSEMBLER_WX_EXCLUSIVE
+            and running on x86(_64) - on other platforms we may also need ensure that
+            makeExecutable is called at the end to flush caches.
+        (JSC::ExecutableAllocator::reprotectRegion):
+            Reformatted, no change.
+        (JSC::ExecutableAllocator::cacheFlush):
+            Cache flush a region of memory, or platforms where this is necessary.
+        * wtf/Platform.h:
+            Add changes necessary to allow YARR jit to build on this platform, disabled.
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+            Add support to these methods for ARMv7.
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, fix my previous fix.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::msToGregorianDateTime): Use WTF namespace qualifier to
+            disambiguate func signatures.
+
+2009-06-08  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the Tiger build.
+
+        * wtf/Platform.h: Only test the value of the macro once we know it is defined.
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, another Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, projectile-fixing Windows build.
+
+        * runtime/DateConversion.cpp: Added StringExtras include.
+        * wtf/DateMath.cpp: Replaced math with algorithm include (looking for std::min def for Windows).
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, Windows build fix.
+
+        * runtime/DateConstructor.cpp: Changed to use WTF namespace.
+        * runtime/DateConversion.cpp: Added UString include.
+        * runtime/DateInstance.cpp: Changed to use WTF namespace.
+        * wtf/DateMath.cpp: Added math include.
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26238
+        Move most of runtime/DateMath functions to wtf/DateMath, and split off conversion-related
+        helpers to DateConversion.
+
+        * AllInOneFile.cpp: Changed DateMath->DateConversion.
+        * GNUmakefile.am: Ditto and added DateMath.
+        * JavaScriptCore.exp: Ditto.
+        * JavaScriptCore.pri: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added DateMath.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * JavaScriptCoreSources.bkl: Ditto.
+        * pcre/pcre_exec.cpp: Changed to use DateMath.
+        * profiler/ProfileNode.cpp:
+        (JSC::getCount): Changed to use DateConversion.
+        * runtime/DateConstructor.cpp: Ditto.
+        * runtime/DateConversion.cpp: Copied from JavaScriptCore/runtime/DateMath.cpp.
+        (JSC::parseDate): Refactored to use null-terminated characters as input.
+        * runtime/DateConversion.h: Copied from JavaScriptCore/runtime/DateMath.h.
+        * runtime/DateInstance.cpp: Changed to use wtf/DateMath.
+        * runtime/DateInstance.h: Ditto.
+        * runtime/DateMath.cpp: Removed.
+        * runtime/DateMath.h: Removed.
+        * runtime/DatePrototype.cpp: Ditto.
+        * runtime/InitializeThreading.cpp: Ditto.
+        * wtf/DateMath.cpp: Copied from JavaScriptCore/runtime/DateMath.cpp.
+        * wtf/DateMath.h: Copied from JavaScriptCore/runtime/DateMath.h.
+
+2009-06-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2009-06-07  David Kilzer  <ddkilzer@apple.com>
+
+        Make JavaScriptCore compile for iPhone and iPhone Simulator
+
+        Reviewed by Gavin Barraclough.
+
+        * Configurations/Base.xcconfig: Split GCC_ENABLE_OBJC_GC on
+        $(REAL_PLATFORM_NAME).  Added $(ARCHS_UNIVERSAL_IPHONE_OS) to
+        VALID_ARCHS.  Added REAL_PLATFORM_NAME_iphoneos,
+        REAL_PLATFORM_NAME_iphonesimulator, HAVE_DTRACE_iphoneos and
+        HAVE_DTRACE_iphonesimulator variables.
+        * Configurations/DebugRelase.xcconfig: Split ARCHS definition on
+        $(REAL_PLATFORM_NAME).
+        * Configurations/JavaScriptCore.xcconfig: Added
+        EXPORTED_SYMBOLS_FILE_armv6 and EXPORTED_SYMBOLS_FILE_armv7
+        variables.  Split OTHER_LDFLAGS into OTHER_LDFLAGS_BASE and
+        OTHER_LDFLAGS_$(REAL_PLATFORM_NAME) since CoreServices.framework
+        is only linked to on Mac OS X.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed references
+        to CoreServices.framework since it's linked using OTHER_LDFLAGS
+        in JavaScriptCore.xcconfig.
+        * profiler/ProfilerServer.mm: Added #import for iPhone
+        Simulator.
+        (-[ProfilerServer init]): Conditionalize use of
+        NSDistributedNotificationCenter to non-iPhone or iPhone
+        Simulator.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::): Build fix for iPhone and iPhone
+        Simulator.
+        * wtf/Platform.h: Defined PLATFORM(IPHONE) and
+        PLATFORM(IPHONE_SIMULATOR).
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::setThreadNameInternal): Build fix for iPhone and iPhone
+        Simulator.
+
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $QMAKE_PATH_SEP instead of hardcoded / to fix Windows build
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2009-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        RS by Sam Weinig.
+
+        Remove bonus bogus \n from last commit.
+
+        * jit/JITStubs.cpp:
+        (JSC::):
+
+2009-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change the implementation of op_throw so the stub function always modifies its
+        return address - if it doesn't find a 'catch' it will switch to a trampoline
+        to force a return from JIT execution.  This saves memory, by avoiding the need
+        for a unique return for every op_throw.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+            JITStubs::cti_op_throw now always changes its return address,
+            remove return code generated after the stub call (this is now
+            handled by ctiOpThrowNotCaught).
+        * jit/JITStubs.cpp:
+        (JSC::):
+            Add ctiOpThrowNotCaught definitions.
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+            Change cti_op_throw to always change its return address.
+        * jit/JITStubs.h:
+            Add ctiOpThrowNotCaught declaration.
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rudder stamped by Sam Weinig.
+
+        Add missing ASSERT.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::getRelocatedAddress):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Switch storePtrWithPatch to take the initial immediate value as an argument.
+
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::storePtrWithPatch):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jsr):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove patchLength..tByIdExternalLoadPrefix magic numbers from JIT.h.
+
+        These aren't really suitable values to be tracking within common code
+        of the JIT, since they are not (and realistically cannot) be checked
+        by ASSERTs, as the other repatch offsets are.  Move this functionality
+        (skipping the REX prefix when patching load instructions to LEAs on
+        x86-64) into the X86Assembler.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadPtrToLEA):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::repatchLoadPtrToLEA):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+
+2009-06-05  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Bug 26160: Compile fails in MacOSX when GNU fileutils are installed
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26160>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use /bin/ln instead of ln for cases where this command is used with -h option.
+        As this option is not supported by GNU fileutils, this change helps users 
+        who have GNU fileutils in their PATH.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove DoubleNotEqual floating point comparison condition for now -
+        it is not used, and it is unclear the semantics are correct (I think
+        this comparison would actually give you not-equal-or-unordered, which
+        might be what is wanted... we can revisit this interface & get it
+        right when required).
+
+        Also, fix asserts in branchArith32 ops.  All adds & subs can check
+        for Signed, multiply only sets OF so can only check for overflow.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Minor tidy up in JITStubs.
+
+        * jit/JITStubs.cpp:
+        (JSC::StackHack::StackHack):
+        * jit/JITStubs.h:
+
+2009-06-05  Koen Kooi <koen@dominion.thruhere.net>
+
+        Reviewed by Xan Lopez.
+
+        Build fix for glib unicode backend.
+
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h:
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        3 tiny cleanups:
+
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+            store*() methods should take an ImplicitAddress, rather than an Address.
+        * assembler/X86Assembler.h:
+            Make patchPointer private.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_ret):
+            Remove empty line at end of function.
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Encapsulate many uses of void* in the assembler & jit with types that provide
+        more semantic information.  The new types are:
+        
+            * MacroAssemblerCodePtr - this wraps a pointer into JIT generated code.
+            * FunctionPtr - this wraps a pointer to a C/C++ function in JSC.
+            * ReturnAddressPtr - this wraps a return address resulting from a 'call' instruction.
+
+        Wrapping these types allows for stronger type-checking than is possible with everything
+        represented a void*.  For example, it is now enforced by the type system that near
+        calls can only be linked to JIT code and not to C functions in JSC (this was previously
+        required, but could not be enforced on the interface).
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::CodeLocationCommon):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::dataLocation):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::executableAddress):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadToLEA):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::CodeLocationInstruction):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForSwitch):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForExceptionHandler):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForJSR):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::operator!):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::CodeLocationLabel):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::getJumpDestination):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::CodeLocationJump):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::CodeLocationNearCall):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::addressForLookup):
+        (JSC::AbstractMacroAssembler::trampolineAt):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+        (JSC::::CodeLocationCommon::instructionAtOffset):
+        (JSC::::CodeLocationCommon::labelAtOffset):
+        (JSC::::CodeLocationCommon::jumpAtOffset):
+        (JSC::::CodeLocationCommon::callAtOffset):
+        (JSC::::CodeLocationCommon::nearCallAtOffset):
+        (JSC::::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::::CodeLocationCommon::dataLabel32AtOffset):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+        (JSC::FunctionPtr::value):
+        (JSC::FunctionPtr::executableAddress):
+        (JSC::ReturnAddressPtr::ReturnAddressPtr):
+        (JSC::ReturnAddressPtr::value):
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::executableAddress):
+        (JSC::MacroAssemblerCodePtr::dataLocation):
+        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchPointerForCall):
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::operator !):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::size):
+        (JSC::JITCode::HostFunction):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitNakedCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiArrayLengthTrampoline):
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITThunks::ctiVirtualCallPreLink):
+        (JSC::JITThunks::ctiVirtualCallLink):
+        (JSC::JITThunks::ctiVirtualCall):
+        (JSC::JITThunks::ctiNativeCallThunk):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::operator!):
+        (JSC::Yarr::RegexCodeBlock::execute):
+
+2009-06-05  Antti Koivisto  <antti@apple.com>
+
+        Try to unbreak Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-03  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=13128
+        Safari not obeying cache header
+        
+        Export JSC::parseDate()
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-06-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug in property caching of getters and setters.
+
+        Make sure that the transition logic accounts for getters and setters.
+        If we don't we end up screwing up the transition tables so that some
+        transitions will start incorrectly believing that they need to check
+        for getters and setters. 
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        * runtime/JSObject.h:
+        (JSC::):
+        * runtime/Structure.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Minor tweak to PatchBuffer, change it so it no longer holds a CodeRef, and instead
+        holds a separate code pointer and executable pool.  Since it now always holds its
+        own copy of the code size, and to simplify the construction sequence, it's neater
+        this way.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::finalizeCode):
+        (JSC::AbstractMacroAssembler::PatchBuffer::code):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove 'JIT_STUB_ARGUMENT_STACK' this is unused and untested.
+
+        This just leaves JIT_STUB_ARGUMENT_REGISTER and JIT_STUB_ARGUMENT_VA_LIST.
+        Since JIT_STUB_ARGUMENT_REGISTER is the sensible configuration on most platforms,
+        remove this define and make this the default behaviour.
+        Platforms must now define JIT_STUB_ARGUMENT_VA_LIST to get crazy va_list voodoo,
+        if they so desire.
+
+        (Refactoring of #ifdefs only, no functional change, no performance impact.)
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        * jit/JITArithmetic.cpp:
+            Remove some redundant typedefs, unused since arithmetic was added to the MacroAssembler interface.
+
+2009-06-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix due to header include problem.
+
+        * interpreter/Interpreter.h: Remove wtf from includes so that
+          compile can find the headers in expected places.
+
+2009-06-04  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        HashTable class (JavaScriptCore/wtf/HashTable.h) doesn't instantiated by 'new', so 
+        inheritance was removed. HashTable struct has been instantiated by operator new in
+        JSGlobalData.cpp:106.
+        HashTable couldn't inherited from FastAllocBase since struct with inheritance is 
+        no longer POD, so HashTable struct has been instantiated by fastNew, destroyed by
+        fastDelete.
+
+        * interpreter/Interpreter.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * wtf/HashTable.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Wrap the code that plants pushes/pops planted by JIT in explanatorily named
+        methods; move property storage reallocation into a standard stub function.
+
+        ~No performance impact (possible <1% progression on x86-64, likely just noise).
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+            Wrap calls to push/pop.
+        * jit/JIT.h:
+            Declare the new wrapper methods.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::preverveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+            Define the new wrapper methods.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_ret):
+            Wrap calls to push/pop.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+            Move property storage reallocation into a standard stub function.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::):
+
+2009-06-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Single-threaded QtWebKit configuration
+        <https://bugs.webkit.org/show_bug.cgi?id=26015>
+
+        * JavaScriptCore.pri: Use ThreadingNone.cpp instead of
+        ThreadingQt.cpp and make sure ENABLE_JSC_MULTIPLE_THREADS is turned off
+        when ENABLE_SINGLE_THREADED is tuned on
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadCondition::wait): Fix compilation warning.
+        (WTF::ThreadCondition::timedWait): Ditto.
+
+2009-06-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove workaround that was added to address <rdar://problem/5488678> as it no longer affects our Tiger builds.
+
+        * Configurations/Base.xcconfig:
+
+2009-06-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Sam Weinig.
+
+        Use C-style comments in Platform.h so it can be included from C
+        files.
+
+        * wtf/Platform.h:
+
+2009-06-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Use File::Spec->tmpdir instead of hardcoded paths for tempfile() dir
+        
+        This fixes the Windows-build if the user does not have a /tmp directory.
+
+        * pcre/dftables:
+
+2009-06-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver ">>" Hunt.
+
+        emitSlow_op_rshift is linking the wrong number of slow cases, if !supportsFloatingPoint().
+        Fixerate, and refactor/comment the code a little to make it clearer what is going on.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative windows build fix (errm, for the other patch!).
+
+        * jit/JITStubs.cpp:
+        (JSC::):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative windows build fix.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::::CodeLocationCall::CodeLocationCall):
+        (JSC::::CodeLocationNearCall::CodeLocationNearCall):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliej Hunt.
+
+        Change JITStub functions from being static members on the JITStub class to be
+        global extern "C" functions, and switch their the function signature declaration
+        in the definition of the functions to be C-macro generated.  This makes it easier
+        to work with the stub functions from assembler code (since the names no longer
+        require mangling), and by delaring the functions with a macro we can look at
+        also auto-generating asm thunks to wrap the JITStub functions to perform the
+        work currently in 'restoreArgumentReference' (as a memory saving).
+
+        Making this change also forces us to be a bit more realistic about what is private
+        on the Register and CallFrame objects.  Presently most everything on these classes
+        is private, and the classes have plenty of friends.  We could befriend all the
+        global functions to perpetuate the delusion of encapsulation, but using friends is
+        a bit of a sledgehammer solution here - since friends can poke around with all of
+        the class's privates, and since all the major classes taht operate on Regsiters are
+        currently friends, right there is currently in practice very little protection at
+        all.  Better to start removing friend delclarations, and exposing just the parts
+        that need to be exposed.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::returnPC):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::returnValueRegister):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::setCallee):
+        (JSC::ExecState::setCodeBlock):
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        (JSC::Register::i):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::classInfo):
+        * runtime/JSGlobalData.h:
+
+2009-06-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Tidy up the literal parser.
+
+        Make the number lexing in the LiteralParser exactly match the JSON spec, which
+        makes us cover more cases, but also more strict.  Also made string lexing only
+        allow double-quoted strings.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "WX" Weinig.
+
+        Allow the JIT to operate without relying on use of RWX memory, on platforms where this is supported.
+
+        This patch adds a switch to Platform.h (ENABLE_ASSEMBLER_WX_EXCLUSIVE) which enables this mode of operation.
+        When this flag is set, all executable memory will be allocated RX, and switched to RW only whilst being
+        modified.  Upon completion of code generation the protection is switched back to RX to allow execution.
+
+        Further optimization will be required before it is desirable to enable this mode of operation by default;
+        enabling this presently incurs a 5%-10% regression.
+
+        (Submitting disabled - no performance impact).
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadToLEA):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::fromFunctionPointer):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToFunction):
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::~PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+        (JSC::::CodeLocationCommon::nearCallAtOffset):
+        (JSC::::CodeLocationCall::CodeLocationCall):
+        (JSC::::CodeLocationNearCall::CodeLocationNearCall):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::CAN_SIGN_EXTEND_U32_64):
+        (JSC::X86Assembler::linkJump):
+        (JSC::X86Assembler::linkCall):
+        (JSC::X86Assembler::patchPointer):
+        (JSC::X86Assembler::relinkJump):
+        (JSC::X86Assembler::relinkCall):
+        (JSC::X86Assembler::repatchInt32):
+        (JSC::X86Assembler::repatchPointer):
+        (JSC::X86Assembler::repatchLoadToLEA):
+        (JSC::X86Assembler::patchInt32):
+        (JSC::X86Assembler::patchRel32):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::):
+        (JSC::ExecutableAllocator::makeWritable):
+        (JSC::ExecutableAllocator::makeExecutable):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::reprotectRegion):
+        * jit/ExecutableAllocatorWin.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        * wtf/Platform.h:
+
+2009-05-29 Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Inherits Interpreter class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSGlobalData.cpp. 
+
+        * interpreter/Interpreter.h:
+
+2009-06-01  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (windows build fix).
+
+        Add exports for windows (corresponding to the JavaScriptCore.exp modification
+        in the previous change).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Alder and Maciej Stachowiak.
+
+        Bug 26057: StringImpl should share buffers with UString.
+        https://bugs.webkit.org/show_bug.cgi?id=26057
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        (JSC::UString::Rep::create):
+        (JSC::UString::BaseString::sharedBuffer): Only do the sharing when
+        the buffer exceeds a certain size.  The size was tuned by running
+        various dom benchmarks with numbers ranging from 20 to 800 and finding
+        a place that seemed to do the best overall.
+        * runtime/UString.h:
+
+2009-05-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliej "you just need to change NativeFunctionWrapper.h" Hunt.
+
+        Add ENABLE_JIT_OPTIMIZE_NATIVE_CALL switch to allow JIT to operate without native call optimizations.
+
+        * runtime/NativeFunctionWrapper.h:
+        * wtf/Platform.h:
+
+2009-05-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6935193> REGRESSION (r42734): Celtic Kane JavaScript benchmark does not run:
+        "Maximum call stack size exceeded"
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString): Use the same recursion limit as the other recursion checks.
+        We need a limit of at least 100 to run the benchmark above.
+        (JSC::arrayProtoFuncToLocaleString): Ditto.
+        (JSC::arrayProtoFuncJoin): Ditto.
+
+2009-05-28  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Added new build flag --filters for Mac. More details in WebCore/ChangeLog.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-05-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6928025> Stack overflow in JSC::stringProtoFuncReplace() running jsFunFuzz
+
+        We should always check for exceptions after creating a CachedCall, this wasn't being done in
+        the string replace logic.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-05-27  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed (make distcheck) build fix; adding missing headers.
+
+        * GNUmakefile.am:
+
+2009-05-27  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben
+        
+        Fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gustavo Noronha.
+
+        When building on Windows, consider Windows specific files.
+
+        * GNUmakefile.am:
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        When building with MinGW, don't use the __declspec(dl{import,export})
+        decorations and rely on the linker to use its nifty auto-import feature.
+        It is extremely hard to get the decorations right with MinGW in general
+        and impossible in WebKit, where the resulting shared library is linking
+        together some static libraries.
+
+        * config.h:
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25613
+
+        Be able to use GOwnPtr for GHashTable as well. The assumption
+        is that the hash table has been created with g_hash_table_new_full
+        and has proper destruction functions.
+
+        * wtf/GOwnPtr.cpp:
+        (WTF::GHashTable):
+        * wtf/GOwnPtr.h:
+
+2009-05-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6924033> REGRESSION: Assertion failure due to forward references
+
+        Add a pattern type for forward references to ensure that we don't confuse the
+        quantifier alternatives assertion.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::ForwardReference):
+
+2009-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for: <rdar://problem/6918095> REGRESSION: jQuery load() issue (25981),
+        and also an ASSERT failure on http://ihasahotdog.com/.
+
+        When overwriting a property on a dictionary with a cached specific value,
+        clear the cache if new value being written is different.
+
+        * JavaScriptCore.exp:
+            Export the new symbols.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_id_method_check_second):
+            Close dictionary prototypes upon caching a method access, as would happen when caching
+            a regular get_by_id.
+        * runtime/JSObject.h:
+        (JSC::JSObject::propertyStorage):
+        (JSC::JSObject::locationForOffset):
+            Make these methods private.
+        (JSC::JSObject::putDirectInternal):
+            When overwriting a property on a dictionary with a cached specific value,
+            clear the cache if new value being written is different.
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+            Reset the specific value field for a given property in a dictionary.
+        (JSC::Structure::despecifyFunctionTransition):
+            Rename of 'changeFunctionTransition' (this was already internally refered to as a despecification).
+        * runtime/Structure.h:
+            Declare new method.
+
+2009-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "pieces of eight" Hunt.
+
+        When reseting RegexPattern class, should fully reset the class, not just bits of it.
+        In particular, we delete the cached character classes (for wordchars, etc), but do
+        not reset the set of pointers to the cached classes.  In the case of a repeated parse
+        due to an illegal back-reference we will continue to use the deleted character class.
+
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::RegexPattern::reset):
+
+2009-05-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix to correct r44161.
+
+        * wtf/FastAllocBase.h:
+
+2009-05-26  Zoltan Horvath  <horvath.zoltan.6@stud.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inherite HashTable from FastAllocBase, because it has been instantiated by
+        'new' in JavaScriptCore/runtime/JSGlobalData.cpp.
+
+        * wtf/HashTable.h:
+        * wtf/FastAllocBase.h: Remove 'wtf' path from TypeTraits.h to allow use outside of wtf.
+
+2009-05-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak and Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25126
+        Allow the buffer underlying UString to be shared.
+
+        In order to not grow the underlying size of any structure,
+        there is a union in the Rep string which holds
+         + m_sharedBuffer -- a pointer to the shared ref counted buffer
+           if the class is BaseString and the buffer is being shared OR
+         + m_baseString -- the BaseString if the class is only UString::Rep
+           but not a UString::BaseString
+
+        Ideally, m_sharedBuffer would be a RefPtr, but it cannot be because
+        it is in a union.
+
+        No change in sunspider perf.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/UString.cpp:
+        (JSC::UString::Rep::share):
+        (JSC::UString::Rep::destroy):
+        (JSC::UString::BaseString::sharedBuffer):
+        (JSC::UString::BaseString::setSharedBuffer):
+        (JSC::UString::BaseString::slowIsBufferReadOnly):
+        (JSC::expandCapacity):
+        (JSC::UString::Rep::reserveCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::concatenate):
+        (JSC::UString::append):
+        * runtime/UString.h:
+        (JSC::UString::Rep::Rep):
+        (JSC::UString::Rep::):
+        (JSC::UString::BaseString::isShared):
+        (JSC::UString::BaseString::isBufferReadOnly):
+        (JSC::UString::Rep::baseString):
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::isShared):
+        * wtf/OwnFastMallocPtr.h: Added.
+        (WTF::OwnFastMallocPtr::OwnFastMallocPtr):
+        (WTF::OwnFastMallocPtr::~OwnFastMallocPtr):
+        (WTF::OwnFastMallocPtr::get):
+        (WTF::OwnFastMallocPtr::release):
+
+2009-05-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Re-add interpreter logic to jit-enabled builds as GCC mysteriously regresses without it
+
+        * wtf/Platform.h:
+
+2009-05-25  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        The functions written in assembly need to have a leading
+        underscore on Windows too.
+
+        * jit/JITStubs.cpp:
+
+2009-05-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix for experimental PGO Windows target.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: Bug 25495: Implement PassOwnPtr and replace uses of std::auto_ptr
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25495>
+
+        Reviewed by Oliver Hunt.
+
+        * GNUmakefile.am: Added OwnPtrCommon.h and PassOwnPtr.h.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+        * wtf/OwnPtr.h:
+        (WTF::OwnPtr::OwnPtr): Added constructors that take a
+        PassOwnPtr.  Also added a copy constructor declaration that's
+        required when assigning a PassOwnPtr to a stack-based OwnPtr.
+        (WTF::operator=): Added assignment operator methods that take a
+        PassOwnPtr.
+        (WTF::swap): Reformatted.
+        (WTF::operator==): Whitespace changes.
+        (WTF::operator!=): Ditto.
+
+        * wtf/OwnPtrCommon.h: Added.
+        (WTF::deleteOwnedPtr):
+
+        * wtf/PassOwnPtr.h: Added.
+        (WTF::PassOwnPtr::PassOwnPtr):
+        (WTF::PassOwnPtr::~PassOwnPtr):
+        (WTF::PassOwnPtr::get):
+        (WTF::PassOwnPtr::clear):
+        (WTF::PassOwnPtr::release):
+        (WTF::PassOwnPtr::operator*):
+        (WTF::PassOwnPtr::operator->):
+        (WTF::PassOwnPtr::operator!):
+        (WTF::PassOwnPtr::operator UnspecifiedBoolType):
+        (WTF::::operator):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::static_pointer_cast):
+        (WTF::const_pointer_cast):
+        (WTF::getPtr):
+
+2009-05-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove interpreter specific logic from the JIT builds.
+
+        This saves ~100k in JSC release builds.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * wtf/Platform.h:
+
+2009-05-22  Mark Rowe  <mrowe@apple.com>
+
+        Part two of an attempted Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-22  Mark Rowe  <mrowe@apple.com>
+
+        Part one of an attempted Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        op_method_check
+
+        Optimize method calls, by caching specific function values within the Structure.
+        The new opcode is used almost like an x86 opcode prefix byte to optimize op_get_by_id,
+        where the property access is being used to read a function to be passed to op-call (i.e.
+        'foo.bar();').  This patch modifies the Structure class such that when a property is
+        put to an object for the first time we will check if the value is a function.  If it is,
+        we will cache the function value on the Structure.  A Structure in such a state guarantees
+        that not only does a property with the given identifier exist on the object, but also that
+        its value is unchanged.  Upon any further attempt to put a property with the same identifier
+        (but a different value) to the object, it will transition back to a normal Structure (where
+        it will guarantee the presence but not the value of the property).
+
+        op_method_check makes use of the new information made available by the Structure, by
+        augmenting the functionality of op_get_by_id.  Upon generating a FunctionCallDotNode a
+        check will be emitted prior to the property access reading the function value, and the JIT
+        will generate an extra (initially unlinked but patchable) set of checks prior to the regular
+        JIT code for get_by_id.  The new code will do inline structure and prototype structure check
+        (unlike a regular get_by_id, which can only handle 'self' accesses inline), and then performs
+        an immediate load of the function value, rather than using memory accesses to load the value
+        from the obejct's property storage array.  If the method check fails it will revert, or if
+        the access is polymorphic, the op_get_by_id will continue to operate - and optimize itself -
+        just as any other regular op_get_by_id would.
+
+        ~2.5% on v8-tests, due to a ~9% progression on richards.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        * JavaScriptCore.exp:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::moveWithPatch):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::getMethodCallLinkInfoReturnLocation):
+        (JSC::CodeBlock::getMethodCallLinkInfo):
+        (JSC::CodeBlock::addMethodCallLinkInfos):
+        (JSC::CodeBlock::methodCallLinkInfo):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitMethodCheck):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::MethodCallCompilationInfo::MethodCallCompilationInfo):
+        * jit/JITOpcodes.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::patchMethodCallProto):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_id_method_check):
+        (JSC::JITStubs::cti_op_get_by_id_method_check_second):
+        * jit/JITStubs.h:
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallDotNode::emitBytecode):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::put):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        (JSC::constructError):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::methodCallDummy):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::getPropertyAttributes):
+        (JSC::JSObject::getPropertySpecificFunction):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        * runtime/JSObject.h:
+        (JSC::getJSFunction):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parseObject):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::construct):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::):
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::setDespecifyFunctionProperty):
+        (JSC::PutPropertySlot::isCacheable):
+        (JSC::PutPropertySlot::cachedOffset):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changeFunctionTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::Structure::specificFunction):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHashTraits::emptyValue):
+        * wtf/Platform.h:
+
+2009-05-22  Brent Fulgham <bfulgham@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25950
+        JavaScriptCore Fails to build on Windows (Cairo) due to CoreFoundation
+        link requirement.
+
+        Modify project to add new Debug_CFLite and Release_CFLite targets.  These
+        use the new JavaScriptCoreCFLite.vsprops to link against CFLite.dll.
+        Existing projects are changed to use the new JavaScriptCoreCF.vsprops
+        to link against CoreFoundation.dll.
+
+        The JavaScriptCoreCommon.vsprops is modified to remove the link
+        against CoreFoundation.dll.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+
+2009-05-22  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Original patch by Jürg Billeter and Naiem Shaik.
+        Implementing WTF Unicode functionality based on GLib.
+
+        * GNUmakefile.am:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/glib: Added.
+        * wtf/unicode/glib/UnicodeGLib.cpp: Added.
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::umemcasecmp):
+        * wtf/unicode/glib/UnicodeGLib.h: Added.
+        (WTF::Unicode::):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::isArabicChar):
+        (WTF::Unicode::isFormatChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::category):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::digitValue):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::decompositionType):
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h: Added.
+
+2009-05-21  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add MacroAssemblerCodeRef.h to file list.
+
+        * GNUmakefile.am:
+
+2009-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+        Addition of MacroAssemblerCodeRef.h rubber stamped by Geoff Garen.
+
+        Refactor JIT code-handle objects.  The representation of generated code is currently
+        a bit of a mess.  We have a class JITCode which wraps the pointer to a block of
+        generated code, but this object does not reference the executable pool meaning that
+        external events (the pool being derefed) could make the pointer become invalid.
+        To overcome this both the JIT and Yarr implement further (and similar) objects to
+        wrap the code pointer with a RefPtr to the pool.  To add to the mire, as well as the
+        CodeBlock containing a handle onto the code the FunctionBodyNode also contains a
+        copy of the code pointer which is used almost (but not entirely) uniquely to access
+        the JIT code for a function.
+
+        Rationalization of all this:
+
+            * Add a new type 'MacroAssembler::CodeRef' as a handle for a block of JIT generated code.
+            * Change the JIT & Yarr to internally handle code using CodeRefs.
+            * Move the CodeRef (formerly anow defunct JITCodeRef) from CodeBlock to its owner node.
+            * Remove the (now) redundant code pointer from FunctionBodyNode.
+
+        While tidying this up I've made the PatchBuffer return code in new allocations using a CodeRef,
+        and have enforced an interface that the PatchBuffer will always be used, and 'finalizeCode()' or
+        'finalizeCodeAddendum()' will always be called exactly once on the PatchBuffer to complete code generation.
+
+        This gives us a potentially useful hook ('PatchBuffer::performFinalization()') at the end of generation,
+        which may have a number of uses.  It may be helpful should we wish to switch our generation
+        model to allow RW/RX exclusive memory, and it may be useful on non-cache-coherent platforms to
+        give us an oportunity to cache flush as necessary.
+
+        No performance impact.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::CodeRef::CodeRef):
+        (JSC::AbstractMacroAssembler::CodeRef::trampolineAt):
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::~PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::linkTailRecursive):
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        (JSC::AbstractMacroAssembler::PatchBuffer::complete):
+        (JSC::AbstractMacroAssembler::PatchBuffer::finalize):
+        (JSC::AbstractMacroAssembler::PatchBuffer::entry):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::setJITCode):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::executablePool):
+        * interpreter/CallFrameClosure.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::linkCall):
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::operator bool):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::size):
+        (JSC::JITCode::executablePool):
+        (JSC::JITCode::HostFunction):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::generateJITCode):
+        (JSC::EvalNode::generateJITCode):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateJITCode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::generatedJITCode):
+        (JSC::ScopeNode::getExecutablePool):
+        (JSC::ScopeNode::setJITCode):
+        (JSC::ProgramNode::jitCode):
+        (JSC::EvalNode::jitCode):
+        (JSC::FunctionBodyNode::jitCode):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::pcreFallback):
+        (JSC::Yarr::RegexCodeBlock::setFallback):
+        (JSC::Yarr::RegexCodeBlock::operator bool):
+        (JSC::Yarr::RegexCodeBlock::set):
+        (JSC::Yarr::RegexCodeBlock::execute):
+
+2009-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/6910264> REGRESSION: Cached DOM global object property access fails in browser (25921)
+        <https://bugs.webkit.org/show_bug.cgi?id=25921>
+
+        When caching properties on the global object we need to ensure that we're
+        not attempting to cache through a shell object.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_global):
+
+2009-05-21  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2009-05-21  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 25945: Add support for MADV_FREE to TCMalloc
+        <https://bugs.webkit.org/show_bug.cgi?id=25945>
+        <rdar://problem/6910754>
+
+        Add support for MADV_FREE to TCMalloc_SystemRelease for platforms that
+        don't also support MADV_FREE_REUSE. The code is identical to the MADV_DONTNEED
+        case except for the advice passed to madvise(), so combining the two cases
+        makes the most sense.
+
+        * wtf/Platform.h: Only define HAVE_MADV_FREE when not building on Tiger or
+        Leopard, because while it is defined on these platforms it actually does
+        nothing.
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease): use MADV_FREE if it is available; otherwise use
+        MADV_DONTNEED.
+
+2009-05-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25917> / <rdar://problem/6910066>.
+        Bug 25917: REGRESSION (r43559?): Javascript debugger crashes when pausing page
+
+        The debugger currently retrieves the arguments object from an activation rather than pulling
+        it from a call frame.  This is unreliable to due to the recent optimization to lazily create
+        the arguments object.  In the long-term it should stop doing that (<rdar://problem/6911886>),
+        but for now we force eager creation of the arguments object when debugging.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+
+2009-05-21  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 25912: Harden NumberPrototype.cpp by removing use of strcpy()
+        <https://bugs.webkit.org/show_bug.cgi?id=25912>
+
+        This causes no change on SunSpider.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp): replace strcpy() with memcpy(), ASSERT that the
+        temporary buffer has sufficient space to store the result, and move the
+        explicit null-termination closer to the memcpy() for easier visual inspection
+        of the code.
+        (JSC::fractionalPartToString): replace strcpy() with memcpy(), and ASSERT
+        that the temporary buffer has sufficient space to store the result. There
+        is no explicit null-termination because this is done by the caller. The
+        same is already true for exponentialPartToString().
+        (JSC::numberProtoFuncToExponential): replace strcpy() with memcpy(), explicitly
+        null-terminate the result, and ASSERT that the temporary buffer has sufficient
+        space to store the result.
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Cleanup the JSGlobalData when exiting early with the usage statement in jsc.
+
+        * jsc.cpp:
+        (printUsageStatement):
+        (parseArguments):
+        (jscmain):
+
+2009-05-20  Stephanie Lewis  <slewis@apple.com>
+
+        Update the order files.  <rdar://problem/6881750> Generate new order files.
+
+        * JavaScriptCore.order:
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Replace WREC with YARR + YARR_JIT for the Qt port. This is only
+        used when compiled with JIT support for now, so it is a drop-in
+        replacement for the WREC usage. Still including the wrec headers
+        as they are being referred from RegExp.h, though the contents of
+        that header it protected by "#if ENABLE(WREC)".
+
+        * JavaScriptCore.pri:
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix GTK debug build.
+
+        The function dumpDisjunction, compiled with debug enabled, uses
+        printf, which needs stdio.h to be included.
+
+        * yarr/RegexInterpreter.cpp:
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        BUG 25843: [Qt] Remove qt-port build flag
+        <https://bugs.webkit.org/show_bug.cgi?id=25843>
+
+        * JavaScriptCore.pro:
+
+
+2009-05-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity): Copy-paste typo.
+
+2009-05-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6885680> CrashTracer: [USER] 1 crash in Install
+        Mac OS X at <unknown binary> • 0x9274241c
+        
+        (Original patch by Joe Sokol and Ronnie Misra.)
+        
+        SunSpider says 1.004x faster.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity): Instead of doing complicated
+        math that sometimes used to overflow, just release the full range of the
+        register file.
+
+        * interpreter/RegisterFile.h:
+        (JSC::isPageAligned):
+        (JSC::RegisterFile::RegisterFile): Added ASSERTs to verify that it's
+        safe to release the full range of the register file.
+
+        (JSC::RegisterFile::shrink): No need to releaseExcessCapacity() if the
+        new end is not smaller than the old end. (Also, doing so used to cause
+        numeric overflow, unmapping basically the whole process from memory.)
+
+2009-05-19  Oliver Hunt  <oliver@apple.com>
+
+        RS=Mark Rowe.
+
+        <rdar://problem/6888393> REGRESSION: Start Debugging JavaScript crashes browser (nightly builds only?)
+        <https://bugs.webkit.org/show_bug.cgi?id=25717>
+
+        Remove JSC_FAST_CALL as it wasn't gaining us anything, and was
+        resulting in weird bugs in the nightly builds.
+
+        * parser/Nodes.cpp:
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isNumber):
+        (JSC::ExpressionNode::isString):
+        (JSC::ExpressionNode::isNull):
+        (JSC::ExpressionNode::isPure):
+        (JSC::ExpressionNode::isLocation):
+        (JSC::ExpressionNode::isResolveNode):
+        (JSC::ExpressionNode::isBracketAccessorNode):
+        (JSC::ExpressionNode::isDotAccessorNode):
+        (JSC::ExpressionNode::isFuncExprNode):
+        (JSC::ExpressionNode::isSimpleArray):
+        (JSC::ExpressionNode::isAdd):
+        (JSC::ExpressionNode::resultDescriptor):
+        (JSC::StatementNode::firstLine):
+        (JSC::StatementNode::lastLine):
+        (JSC::StatementNode::isEmptyStatement):
+        (JSC::StatementNode::isReturnNode):
+        (JSC::StatementNode::isExprStatement):
+        (JSC::StatementNode::isBlock):
+        (JSC::NullNode::isNull):
+        (JSC::BooleanNode::isPure):
+        (JSC::NumberNode::value):
+        (JSC::NumberNode::setValue):
+        (JSC::NumberNode::isNumber):
+        (JSC::NumberNode::isPure):
+        (JSC::StringNode::isPure):
+        (JSC::StringNode::isString):
+        (JSC::ResolveNode::identifier):
+        (JSC::ResolveNode::isLocation):
+        (JSC::ResolveNode::isResolveNode):
+        (JSC::BracketAccessorNode::isLocation):
+        (JSC::BracketAccessorNode::isBracketAccessorNode):
+        (JSC::DotAccessorNode::base):
+        (JSC::DotAccessorNode::identifier):
+        (JSC::DotAccessorNode::isLocation):
+        (JSC::DotAccessorNode::isDotAccessorNode):
+        (JSC::TypeOfResolveNode::identifier):
+        (JSC::AddNode::isAdd):
+        (JSC::BlockNode::isBlock):
+        (JSC::EmptyStatementNode::isEmptyStatement):
+        (JSC::ExprStatementNode::isExprStatement):
+        (JSC::ReturnNode::isReturnNode):
+        (JSC::ScopeNode::sourceURL):
+        (JSC::ProgramNode::bytecode):
+        (JSC::EvalNode::bytecode):
+        (JSC::FunctionBodyNode::parameters):
+        (JSC::FunctionBodyNode::toSourceString):
+        (JSC::FunctionBodyNode::bytecode):
+        (JSC::FuncExprNode::isFuncExprNode):
+
+2009-05-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        - speed up string comparison, especially for short strings
+        
+        ~1% on SunSpider
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        (JSC::operator==): Inline UString's operator==, since it is called from
+        hot places in the runtime. Also, specialize 2-char strings in a similar way to
+        1-char, since we're taking the hit of a switch anyway.
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        - for polymorphic prototype lookups, increase the number of slots from 4 to 8
+        
+        ~4% faster on v8 raytrace benchmark
+
+        * bytecode/Instruction.h:
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - tighten up the code for the load_varargs stub
+        
+        ~1-2% on v8-raytrace
+        
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs): Hoist some loop invariants that
+        the compiler didn't feel like hoisting for us. Remove unneeded exception check.
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - Improve code generation for access to prototype properties
+        
+        ~0.4% speedup on SunSpider.
+        
+        Based on a suggestion from Geoff Garen.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2009-05-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Gavin Barraclough.
+
+        Enable YARR, and disable WREC for GTK+.
+
+        * GNUmakefile.am:
+        * yarr/RegexParser.h:
+
+2009-05-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Add -no-install and -no-fast-install to programs and tests that we
+         don't install. Also remove -O2 since this is already handled at
+         configure time.
+
+         * GNUmakefile.am:
+
+2009-05-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Add JavaScriptCore/ to JSC include path only since it's not
+        required when building WebCore.
+
+        * GNUmakefile.am:
+
+2009-05-17  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Looking like MSVC doesn't like static variables in inline methods?
+        Make the state of the SSE2 check a static variable on the class
+        MacroAssemblerX86Common as a speculative build fix for Windows.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::isSSE2Present):
+        (JSC::MacroAssemblerX86Common::):
+        * jit/JIT.cpp:
+
+2009-05-15  Adam Roben  <aroben@apple.com>
+
+        Add some assembler headers to JavaScriptCore.vcproj
+
+        This is just a convenience for Windows developers.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add FP support to the MacroAssembler, port JITArithmetic over to make use of this. Also add
+        API to determine whether FP support is available 'MacroAssembler::supportsFloatingPoint()',
+        FP is presently only supported on SSE2 platforms, not x87.  On platforms where a suitable
+        hardware FPU is not available 'supportsFloatingPoint()' may simply return false, and all
+        other methods ASSERT_NOT_REACHED().
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::branch32):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86::supportsFloatingPoint):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::loadDouble):
+        (JSC::MacroAssemblerX86Common::storeDouble):
+        (JSC::MacroAssemblerX86Common::addDouble):
+        (JSC::MacroAssemblerX86Common::subDouble):
+        (JSC::MacroAssemblerX86Common::mulDouble):
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch16):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        (JSC::MacroAssemblerX86Common::set32):
+        (JSC::MacroAssemblerX86Common::setTest32):
+        (JSC::MacroAssemblerX86Common::x86Condition):
+        (JSC::MacroAssemblerX86Common::isSSE2Present):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::movePtrToDouble):
+        (JSC::MacroAssemblerX86_64::moveDoubleToPtr):
+        (JSC::MacroAssemblerX86_64::setPtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (JSC::MacroAssemblerX86_64::branchAddPtr):
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPoint):
+        * assembler/X86Assembler.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2009-05-15  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 25467: JavaScript debugger should use function.displayName as the function's name in the call stack
+        <https://bugs.webkit.org/show_bug.cgi?id=25467>
+        
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.exp: Added calculatedFunctionName
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Added calculatedFunctionName
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added calculatedFunctionName
+        * debugger/DebuggerCallFrame.cpp: Added calculatedFunctionName to match existing one in ProfileNode.
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * debugger/DebuggerCallFrame.h: Added calculatedFunctionName to match existing one in ProfileNode.
+
+2009-05-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix, not reviewed.
+
+        Quick fixes for JIT builds with OPTIMIZE flags disabled.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compilePutByIdHotPath):
+
+2009-05-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Back out incorrect Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-14  Adam Roben  <aroben@apple.com>
+
+        Windows jsc build fix
+
+        r43648 modified jsc.vcproj's post-build event not to try to copy files
+        that aren't present. Then r43661 mistakenly un-did that modification.
+        This patch restores the modification from r43648, but puts the code in
+        jscCommon.vsprops (where it should have been added in r43648).
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Restored empty
+        VCPostBuildEventTool tags.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Modified the post-build
+        event command line to match the one in jsc.vcproj from r43648.
+
+2009-05-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25325
+
+        Make sure pthread_self() is declared before it gets called in Collector.cpp
+
+        * runtime/Collector.cpp: Include pthread.h in most Unix-like platforms
+        (not just for OPENBSD)
+
+2009-05-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25785>.
+        Bug 25785: Segfault in mark when using JSObjectMakeConstructor
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor): OpaqueJSClass::prototype can return 0.  We need to use the default object prototype when it does.
+        * API/tests/testapi.c:
+        (main): Add a test case.
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect): Add a clearer assertion for a null value.  The assertion on the next line does catch this,
+        but the cause of the failure is not clear from the assertion itself.
+
+2009-05-14  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        <rdar://problem/6681868> When building with Xcode 3.1.3 should be using gcc 4.2
+
+        The meaning of XCODE_VERSION_ACTUAL is more sensible in newer versions of Xcode.
+        Update our logic to select the compiler version to use the more appropriate XCODE_VERSION_MINOR
+        if the version of Xcode supports it, and fall back to XCODE_VERSION_ACTUAL if not.
+
+        * Configurations/Base.xcconfig:
+
+2009-05-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Checking register file bounds should be a ptr comparison (m_end is a Register*).
+        Also, the compare should be unsigned, pointers don'ts go negative.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2009-05-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <rdar://problem/6882919> REGRESSION: page at Metroauto site crashes in cti_op_loop_if_less (25730)
+
+        op_loop_if_less (imm < op) was loading op into regT1, but in the slow path spills regT0.
+        This leads to bad happen.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+
+2009-05-13  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25746
+        Revert http://trac.webkit.org/changeset/43507 which caused crash in PPC nightlies with Safari 4.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        * bytecode/SamplingTool.h:
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::::ref):
+        (WTF::::deref):
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::clearPthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::clearThreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByGthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::threadForIdentifier):
+        (WTF::clearThreadForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByQthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::clearThreadForIdentifier):
+        (WTF::threadForIdentifier):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Revert the parser arena change. It was a slowdown, not a speedup.
+        Better luck next time (I'll break it up into pieces).
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Tiger build fix.
+
+        * parser/Grammar.y: Add back empty code blocks, needed by older
+        versions of bison on certain rules.
+
+2009-05-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2009-05-13  Adam Roben  <aroben@apple.com>
+
+        Windows build fixes after r43642
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Updated.
+
+        * debugger/Debugger.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/RegExp.cpp:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/StringPrototype.cpp:
+        Added missing #includes.
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Step 3: Add some actual arena allocation. About 1% SunSpider speedup.
+
+        * JavaScriptCore.exp: Updated.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Updated since VarStack
+        contains const Identifier* now.
+        (JSC::BytecodeGenerator::emitPushNewScope): Updated to take a const
+        Identifier&.
+        * bytecompiler/BytecodeGenerator.h: Ditto
+
+        * bytecompiler/SegmentedVector.h: Added isEmpty.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Moved this function here from
+        WebCore so WebCore doesn't need the details of FunctionBodyNode.
+        * debugger/Debugger.h: Ditto.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute): Updated since VarStack contains const
+        Identifier* now.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_vm_lazyLinkCall): Call isHostFunction on the body
+        rather than on the function object, since we can't easily have inlined
+        access to the FunctionBodyNode in JSFunction.h since WebCore needs
+        access to that header.
+        (JSC::JITStubs::cti_op_construct_JSConstruct): Ditto.
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier): Ditto.
+
+        * parser/Grammar.y: Use JSGlobalData* to pass the global data pointer
+        around whenever possible instead of using void*. Changed
+        SET_EXCEPTION_LOCATION from a macro to an inline function. Marked
+        the structure-creating functions inline. Changed the VarStack to use
+        identifier pointers instead of actual identifiers. This takes
+        advantage of the fact that all identifier pointers come from the
+        arena and avoids reference count churn. Changed Identifier* to
+        const Identifier* to make sure we don't modify any by accident.
+        Used identifiers for regular expression strings too, using the new
+        scanRegExp that has out parameters instead of the old one that relied
+        on side effects in the Lexer. Move the creation of numeric identifiers
+        out of this file and into the PropertyNode constructor.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Pass in ParserArena, used for identifiers.
+        (JSC::Lexer::makeIdentifier): Changed return type to const Identifier*
+        and changed to call ParserArena.
+        (JSC::Lexer::scanRegExp): Added out arguments that are const Identifier*
+        as well as a prefix character argument so we can handle the /= case
+        without a string append.
+        (JSC::Lexer::skipRegExp): Added. Skips a regular expression without
+        allocating Identifier objects.
+        (JSC::Lexer::clear): Removed the code to manage m_identifiers, m_pattern,
+        and m_flags, and added code to set m_arena to 0.
+        * parser/Lexer.h: Updated for changes above.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaFreeable::operator new): Added. Calls allocateFreeable
+        on the arena.
+        (JSC::ParserArenaDeletable::operator new): Changed to call the
+        allocateDeletable function on the arena instead of deleteWithArena.
+        (JSC::RegExpNode::RegExpNode): Changed arguments to Identifier instead
+        of UString since these come from the parser which makes identifiers.
+        (JSC::PropertyNode::PropertyNode): Added new constructor that makes
+        numeric identifiers. Some day we might want to optimize this for
+        integers so it doesn't create a string for each one.
+        (JSC::ContinueNode::ContinueNode): Initialize m_ident to nullIdentifier
+        since it's now a const Identifier& so it can't be left uninitialized.
+        (JSC::BreakNode::BreakNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Updated to use SourceElements*
+        to keep track of the statements rather than a separate statement vector.
+        (JSC::BlockNode::BlockNode): Ditto.
+        (JSC::ForInNode::ForInNode): Initialize m_ident to nullIdentifier.
+
+        * parser/Nodes.cpp: Moved the comment explaining emitBytecode in here.
+        It seemed strangely out of place in the header.
+        (JSC::ThrowableExpressionData::emitThrowError): Added an overload for
+        UString as well as Identifier.
+        (JSC::SourceElements::singleStatement): Added.
+        (JSC::SourceElements::lastStatement): Added.
+        (JSC::RegExpNode::emitBytecode): Updated since the pattern and flags
+        are now Identifier instead of UString. Also changed the throwError code
+        to use the substitution mechanism instead of doing a string append.
+        (JSC::SourceElements::emitBytecode): Added. Replaces the old
+        statementListEmitCode function, since we now keep the SourceElements
+        objects around.
+        (JSC::BlockNode::lastStatement): Added.
+        (JSC::BlockNode::emitBytecode): Changed to use emitBytecode instead of
+        statementListEmitCode.
+        (JSC::CaseClauseNode::emitBytecode): Added.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Changed to use emitBytecode
+        instead of statementListEmitCode.
+        (JSC::ScopeNodeData::ScopeNodeData): Changed to store the
+        SourceElements* instead of using releaseContentsIntoVector.
+        (JSC::ScopeNode::emitStatementsBytecode): Added.
+        (JSC::ScopeNode::singleStatement): Added.
+        (JSC::ProgramNode::emitBytecode): Call emitStatementsBytecode instead
+        of statementListEmitCode.
+        (JSC::EvalNode::emitBytecode): Ditto.
+        (JSC::EvalNode::generateBytecode): Removed code to clear the children
+        vector. This optimization is no longer possible since everything is in
+        a single arena.
+        (JSC::FunctionBodyNode::emitBytecode): Call emitStatementsBytecode
+        insetad of statementListEmitCode and check for the return node using
+        the new functions.
+
+        * parser/Nodes.h: Changed VarStack to store const Identifier* instead
+        of Identifier and rely on the arena to control lifetime. Added a new
+        ParserArenaFreeable class. Made ParserArenaDeletable inherit from
+        FastAllocBase instead of having its own operator new. Base the Node
+        class on ParserArenaFreeable. Changed the various Node classes
+        to use const Identifier& instead of Identifier to avoid the need to
+        call their destructors and allow them to function as "freeable" in the
+        arena. Removed extraneous JSC_FAST_CALL on definitions of inline functions.
+        Changed ElementNode, PropertyNode, ArgumentsNode, ParameterNode,
+        CaseClauseNode, ClauseListNode, and CaseBlockNode to use ParserArenaFreeable
+        as a base class since they do not descend from Node. Eliminated the
+        StatementVector type and instead have various classes use SourceElements*
+        instead of StatementVector. This prevents those classes from having th
+        use ParserArenaDeletable to make sure the vector destructor is called.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Pass the arena to the lexer.
+
+        * parser/Parser.h: Added an include of ParserArena.h, which is no longer
+        included by Nodes.h.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena): Added. Initializes the new members,
+        m_freeableMemory, m_freeablePoolEnd, and m_identifiers.
+        (JSC::ParserArena::freeablePool): Added. Computes the pool pointer,
+        since we store only the current pointer and the end of pool pointer.
+        (JSC::ParserArena::deallocateObjects): Added. Contains the common
+        memory-deallocation logic used by both the destructor and the
+        reset function.
+        (JSC::ParserArena::~ParserArena): Changed to call deallocateObjects.
+        (JSC::ParserArena::reset): Ditto. Also added code to zero out the
+        new structures, and switched to use clear() instead of shrink(0) since
+        we don't really reuse arenas.
+        (JSC::ParserArena::makeNumericIdentifier): Added.
+        (JSC::ParserArena::allocateFreeablePool): Added. Used when the pool
+        is empty.
+        (JSC::ParserArena::isEmpty): Added. No longer inline, which is fine
+        since this is used only for assertions at the moment.
+
+        * parser/ParserArena.h: Added an actual arena of "freeable" objects,
+        ones that don't need destructors to be called. Also added the segmented
+        vector of identifiers that used to be in the Lexer.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Use singleStatement function rather than
+        getting at a StatementVector.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Call isHostFunction on the body
+        rather than the function object.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction): Moved the structure version of this in
+        here from the header. It's not hot enough that it needs to be inlined.
+        (JSC::JSFunction::isHostFunction): Moved this in here from the header.
+        It's now a helper to be used only within the class.
+        (JSC::JSFunction::setBody): Moved this in here. It's not hot enough that
+        it needs to be inlined, and we want to be able to compile the header
+        without the definition of FunctionBodyNode.
+
+        * runtime/JSFunction.h: Eliminated the include of "Nodes.h". This was
+        exposing too much JavaScriptCore dependency to WebCore. Because of this
+        change and some changes made to WebCore, we could now export a lot fewer
+        headers from JavaScriptCore, but I have not done that yet in this check-in.
+        Made a couple functions non-inline. Removes some isHostFunction() assertions.
+        
+        * wtf/FastAllocBase.h: Added the conventional using statements we use in
+        WTF so we can use identifiers from the WTF namespace without explicit
+        namespace qualification or namespace directive. This is the usual WTF style,
+        although it's unconventional in the C++ world. We use the namespace primarily
+        for link-time disambiguation, not compile-time.
+
+        * wtf/FastMalloc.cpp: Fixed an incorrect comment.
+
+2009-05-13  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix: add JITStubCall.h to files list.
+
+        * GNUmakefile.am:
+
+2009-05-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed build fix, as suggested by Yael Aharon <yael.aharon@nokia.com>.
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion): renamed IsValid to isValid.
+
+2009-05-13  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Revert r43562 - [Gtk] WTF_USE_JSC is already defined in
+        WebCore/config.h.
+
+        * wtf/Platform.h:
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add SamplingCounter tool to provide a simple mechanism for counting events in JSC
+        (enabled using ENABLE(SAMPLING_COUNTERS)).  To count events within a single function
+        use the class 'SamplingCounter', where the counter may be incremented from multiple
+        functions 'GlobalSamplingCounter' may be convenient; all other counters (stack or
+        heap allocated, rather than statically declared) should use the DeletableSamplingCounter.
+        Further description of these classes is provided alongside their definition in 
+        SamplingTool.h.
+
+        Counters may be incremented from c++ by calling the 'count()' method on the counter,
+        or may be incremented by JIT code by using the 'emitCount()' method within the JIT.
+
+        This patch also fixes CODEBLOCK_SAMPLING, which was missing a null pointer check.
+
+        * JavaScriptCore.exp:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::addWithCarry32):
+        (JSC::MacroAssemblerX86::and32):
+        (JSC::MacroAssemblerX86::or32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::or32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::and32):
+        (JSC::MacroAssemblerX86_64::or32):
+        (JSC::MacroAssemblerX86_64::addPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::adcl_im):
+        (JSC::X86Assembler::addq_im):
+        (JSC::X86Assembler::andl_im):
+        (JSC::X86Assembler::orl_im):
+        * bytecode/SamplingTool.cpp:
+        (JSC::AbstractSamplingCounter::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::AbstractSamplingCounter::count):
+        (JSC::GlobalSamplingCounter::name):
+        (JSC::SamplingCounter::SamplingCounter):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+        (JSC::JIT::emitCount):
+        * jsc.cpp:
+        (runWithScripts):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        * wtf/Platform.h:
+
+2009-05-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6881457> Crash occurs at JSC::Interpreter::execute() when loading http://www.sears.com
+
+        We created the arguments objects before an op_push_scope but not
+        before op_push_new_scope, this meant a null arguments object could
+        be resolved inside catch blocks.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushNewScope):
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6879881> Crash occurs at JSC::JSActivation::mark() when loading http://www.monster.com; http://www.cnet.com
+        <https://bugs.webkit.org/show_bug.cgi?id=25736> Crash loading www.google.dk/ig (and other igoogle's as well)
+
+        Following on from the lazy arguments creation patch, it's now
+        possible for an activation to to have a null register in the callframe
+        so we can't just blindly mark the local registers in an activation,
+        and must null check first instead.
+
+        * API/tests/testapi.c:
+        (functionGC):
+        * API/tests/testapi.js:
+        (bludgeonArguments.return.g):
+        (bludgeonArguments):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::mark):
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        WTF_USE_CTI_REPATCH_PIC is no longer used, remove.
+
+        * jit/JIT.h:
+        * jit/JITStubCall.h:
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        We've run into some problems where changing the size of the class JIT leads to
+        performance fluctuations.  Try forcing alignment in an attempt to stabalize this.
+
+        * jit/JIT.h:
+
+2009-05-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add ParserArena.cpp to the build.
+
+        * JavaScriptCoreSources.bkl:
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Unsigned underflow on 64bit cannot be treated as a negative number
+
+        This code included some placeswhere we deliberately create negative offsets
+        from unsigned values, on 32bit this is "safe", but in 64bit builds much
+        badness occurs. Solution is to use signed types as nature intended.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs):
+
+2009-05-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Define WTF_USE_JSC for the Gtk port.
+
+        * wtf/Platform.h:
+
+2009-05-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - allow all of strictEqual to be inlined into cti_op_stricteq once again
+        
+        We had this optimization once but accidentally lost it at some point.
+
+        * runtime/Operations.h:
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        instanceof should throw if the constructor being tested does not implement
+        'HasInstance" (i.e. is a function).  Instead we were returning false.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::isInvalidParamForIn):
+        (JSC::isInvalidParamForInstanceOf):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_instanceof):
+        * tests/mozilla/ecma_2/instanceof/instanceof-003.js:
+            Fix broken test case.
+        * tests/mozilla/ecma_2/instanceof/regress-7635.js:
+            Remove broken test case (was an exact duplicate of a test in instanceof-003.js).
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve function call forwarding performance
+
+        Make creation of the Arguments object occur lazily, so it
+        is not necessarily created for every function that references
+        it.  Then add logic to Function.apply to allow it to avoid
+        allocating the Arguments object at all.  Helps a lot with
+        the function forwarding/binding logic in jQuery, Prototype,
+        and numerous other JS libraries.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::willResolveToArguments):
+        (JSC::BytecodeGenerator::uncheckedRegisterForArguments):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitPushScope):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_init_arguments):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_load_varargs):
+        * parser/Nodes.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2009-05-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Enable use of SamplingFlags directly from JIT code.
+
+        * bytecode/SamplingTool.h:
+        * jit/JIT.h:
+        (JSC::JIT::sampleCodeBlock):
+        (JSC::JIT::sampleInstruction):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+
+2009-05-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Implement JIT generation for instanceof for non-objects (always returns false).
+        Also fixes the sequencing of the prototype and value isObject checks, to no match the spec.
+
+        0.5% progression on v8 tests overall, due to 3.5% on early-boyer.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        * runtime/TypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more JIT refactoring.
+        
+        Rearranged code to more clearly indicate what's conditionally compiled
+        and why. Now, all shared code is at the top of our JIT files, and all
+        #if'd code is at the bottom. #if'd code is delineated by large comments.
+        
+        Moved functions that relate to the JIT but don't explicitly do codegen
+        into JIT.cpp. Refactored SSE2 check to store its result as a data member
+        in the JIT.
+
+        * jit/JIT.cpp:
+        (JSC::isSSE2Present):
+        (JSC::JIT::JIT):
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        * jit/JIT.h:
+        (JSC::JIT::isSSE2Present):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+
+2009-05-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix.
+
+        * JavaScriptCore.pri: Build the new JITOpcodes.cpp
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        More re-factoring of JIT code generation.  Use a macro to
+        forward the main switch-statement cases to the helper functions.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        More re-factoring of JIT code generation to move opcode generation
+        to helper functions outside the main switch-statement and gave those
+        helper functions standardized names. This patch covers the remaining
+        slow cases.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * GNUmakefile.am: Added JITOpcodes.cpp and JITStubCall.h to the project.
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added
+        JITOpcodes.cpp and JITStubCall.h to the project.
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Some JIT refactoring.
+        
+        Moved JITStubCall* into its own header.
+        
+        Modified JITStubCall to ASSERT that its return value is handled correctly.
+        Also, replaced function template with explicit instantiations to resolve
+        some confusion.
+        
+        Replaced all uses of emit{Get,Put}CTIArgument with explicit peeks, pokes,
+        and calls to killLastResultRegister().
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITStubCall.h: Copied from jit/JIT.h.
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::):
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Start re-factoring JIT code generation to move opcode generation
+        to helper functions outside the main switch-statement and gave those
+        helper functions standardized names.  This patch only covers the main
+        pass and all the arithmetic opcodes in the slow path.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITOpcodes.cpp: Copied from jit/JIT.cpp.
+        * jit/JITPropertyAccess.cpp:
+
+2009-05-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Re-add experimental PGO configs.
+        
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "1" Garen.
+
+        Rip out the !USE(CTI_REPATCH_PIC) code.  It was untested and unused.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+
+2009-05-11  Dmitry Titov  <dimich@chromium.org>
+
+        GTK build fix - the deprecated waitForThreadCompletion is not needed on GTK.
+
+        * wtf/ThreadingPthreads.cpp: used #ifdef PLATFORM(DARWIN) around waitForThreadCompletion().
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        Build fix for newer versions of GCC
+
+        * wtf/ThreadingPthreads.cpp: Added a declaration of
+        waitForThreadCompletion before its definition to silence a warning.
+
+2009-05-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        * wtf/Threading.h:
+        (WTF::ThreadIdentifier::ThreadIdentifier):
+        (WTF::ThreadIdentifier::isValid):
+        (WTF::ThreadIdentifier::invalidate):
+        (WTF::ThreadIdentifier::platformId):
+        ThreadIdentifier is now a class, containing a PlatformThreadIdentifier and
+        methods that are used across the code on thread ids: construction, comparisons,
+        check for 'valid' state etc. '0' is used as invalid id, which happens to just work
+        with all platform-specific thread id implementations.
+
+        All the following files repeatedly reflect the new ThreadIdentifier for each platform.
+        We remove ThreadMap and threadMapMutex from all of them, remove the functions that
+        populated/searched/cleared the map and add platform-specific comparison operators
+        for ThreadIdentifier.
+
+        There are specific temporary workarounds for Safari 4 beta on OSX and Win32 since the
+        public build uses WTF threading functions with old type of ThreadingIdentifier.
+        The next time Safari 4 is rebuilt, it will 'automatically' pick up the new type and new
+        functions so the deprecated ones can be removed.
+
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::waitForThreadCompletion): This is a workaround for Safari 4 beta on Mac.
+        Safari 4 is linked against old definition of ThreadIdentifier so it treats it as uint32_t.
+        This 'old' variant of waitForThreadCompletion takes uint32_t and has the old decorated name, so Safari can
+        load it from JavaScriptCore library. The other functions (CurrentThread() etc) happen to match their previous
+        decorated names and, while they return pthread_t now, it is a pointer which round-trips through a uint32_t.
+        This function will be removed as soon as Safari 4 will release next public build.
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal): All the platforms (except Windows) used a sequential
+        counter as a thread ID and mapped it into platform ID. Windows was using native thread
+        id and mapped it into thread handle. Since we can always obtain a thread handle
+        by thread id, createThread now closes the handle.
+        (WTF::waitForThreadCompletion): obtains another one using OpenThread(id) API. If can not obtain a handle,
+        it means the thread already exited.
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::detachThreadDeprecated): old function, renamed (for Win Safari 4 beta which uses it for now).
+        (WTF::waitForThreadCompletionDeprecated): same.
+        (WTF::currentThreadDeprecated): same.
+        (WTF::createThreadDeprecated): same.
+
+        * bytecode/SamplingTool.h:
+        * bytecode/SamplingTool.cpp: Use DEFINE_STATIC_LOCAL for a static ThreadIdentifier variable, to avoid static constructor.
+
+        * JavaScriptCore.exp: export lists - updated decorated names of the WTF threading functions
+        since they now take a different type as a parameter.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: ditto for Windows, plus added "deprecated" functions
+        that take old parameter type - turns out public beta of Safari 4 uses those, so they need to be kept along for a while.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: ditto.
+
+2009-05-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 25560: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
+        https://bugs.webkit.org/show_bug.cgi?id=25560
+        rdar://problem/6861069
+
+        I missed this case back a year ago when I sped up handling
+        of JavaScript wrappers. Easy to fix.
+
+        * runtime/JSObject.h:
+        (JSC::JSValue::get): Return the prototype itself if the property name
+        is __proto__.
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot): Ditto.
+
+2009-05-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Rename emitGetFromCallFrameHeader to emitGetFromCallFrameHeaderPtr
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+
+2009-05-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix. Build ParserAreana.cpp for Qt
+
+        * JavaScriptCore.pri:
+
+2009-05-11  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24536
+
+        Symbian compilers cannot resolve WTF::PassRefPtr<JSC::Profile>
+        unless Profile.h is included.
+
+        * profiler/ProfileGenerator.h:
+
+2009-05-11  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24284
+
+        * JavaScriptCore.pri: coding style modified
+        * jsc.pro: duplicated values removed from INCLUDEPATH, DEFINES
+
+2009-05-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by NOBODY (build fix).
+
+        Also add ParserArena, in addition to AllInOne, for release builds,
+        since adding it to AllInOne breaks Mac.
+
+        * GNUmakefile.am:
+
+2009-05-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Adding ParserArena to the autotools build.
+
+        * GNUmakefile.am:
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        More Windows build fixes after r43479
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Export ParserArena::reset.
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fixes after r43479
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added
+        ParserArena to the project.
+
+        * parser/NodeConstructors.h: Added a missing include.
+        (JSC::ParserArenaDeletable::operator new): Marked these as inline.
+
+2009-05-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        - fixed REGRESSION(r43432): Many JavaScriptCore tests crash in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=25680
+
+        Accound for the 64-bit instruction prefix when rewriting mov to lea on 64-bit.
+        
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Part two: Remove reference counting from most nodes.
+
+        * JavaScriptCore.exp: Updated.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added ParserArena.h and .cpp.
+
+        * parser/Grammar.y: Replaced uses of ParserRefCountedData with uses of
+        ParserArenaData. Took out now-nonfunctional code that tries to manually
+        release declaration list. Changed the new calls that create FuncDeclNode
+        and FuncExprNode so that they use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaDeletable::operator new): Added.
+        (JSC::ParserArenaRefCounted::ParserArenaRefCounted): Added.
+        (JSC::Node::Node): Removed ParserRefCounted initializer.
+        (JSC::ElementNode::ElementNode): Ditto.
+        (JSC::PropertyNode::PropertyNode): Ditto.
+        (JSC::ArgumentsNode::ArgumentsNode): Ditto.
+        (JSC::SourceElements::SourceElements): Ditto.
+        (JSC::ParameterNode::ParameterNode): Ditto.
+        (JSC::FuncExprNode::FuncExprNode): Added ParserArenaRefCounted initializer.
+        (JSC::FuncDeclNode::FuncDeclNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Removed ParserRefCounted initializer.
+        (JSC::ClauseListNode::ClauseListNode): Ditto.
+        (JSC::CaseBlockNode::CaseBlockNode): Ditto.
+
+        * parser/NodeInfo.h: Replaced uses of ParserRefCountedData with uses of
+        ParserArenaData.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode): Added ParserArenaRefCounted initializer.
+        (JSC::ProgramNode::create): Use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom. Use the arena
+        contains function instead of the vecctor find function.
+        (JSC::EvalNode::create): Use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom. Use the arena
+        reset function instead of the vector shrink function.
+        (JSC::FunctionBodyNode::createNativeThunk): Use the proper version
+        of operator new for the reference-counted idiom, not the deletion idiom.
+        (JSC::FunctionBodyNode::create): More of the same.
+
+        * parser/Nodes.h: Added ParserArenaDeletable and ParserArenaRefCounted
+        to replace ParserRefCounted. Fixed inheritance so only the classes that
+        need reference counting inherit from ParserArenaRefCounted.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Set m_sourceElements to 0 since it now starts
+        uninitialized. Just set it to 0 again in the failure case, since it's
+        now just a raw pointer, not an owning one.
+        (JSC::Parser::reparseInPlace): Removed now-unneeded get() function.
+        (JSC::Parser::didFinishParsing): Replaced uses of ParserRefCountedData
+        with uses of ParserArenaData.
+
+        * parser/Parser.h: Less RefPtr, more arena.
+
+        * parser/ParserArena.cpp: Added.
+        * parser/ParserArena.h: Added.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Removed arena-related code, since it's
+        now in the Parser.
+        (JSC::JSGlobalData::createLeaked): Removed unneeded #ifndef.
+        (JSC::JSGlobalData::createNativeThunk): Tweaked #if a bit.
+
+        * runtime/JSGlobalData.h: Removed parserArena, which is now in Parser.
+
+        * wtf/RefCounted.h: Added deletionHasBegun function, for use in
+        assertions to catch deletion not done by the deref function.
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2: Try to fix the Windows build by adding a symbol which is really just a re-mangling of a changed method signature
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Try to fix the Windows build by removing an unknown symbol
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Touch Nodes.cpp to try to fix Windows build
+
+        * parser/Nodes.cpp: Removed whitespace.
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Quick fix for failures seen on buildbot. Maciej plans a better fix later.
+
+        * wtf/dtoa.cpp: Change the hardcoded number of 32-bit words in a BigInt
+        from 32 to 64. Parsing "1e500", for example, requires more than 32 words.
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        Part one: Change lifetimes so we won't have to use reference
+        counting so much, but don't eliminate the reference counts
+        entirely yet.
+
+        * JavaScriptCore.exp: Updated.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Update for use of raw pointers
+        instead of RefPtr.
+        (JSC::BytecodeGenerator::emitCall): Ditto.
+        (JSC::BytecodeGenerator::emitConstruct): Ditto.
+
+        * parser/Grammar.y: Update node creating code to use new (JSGlobalData*)
+        instead of the plain new. At the moment this is just a hook for future
+        arena allocation; it's inline and JSGlobalData* is not used.
+
+        * parser/NodeConstructors.h: Updated for name change of parserObjects to
+        parserArena. Also added explicit initialization for raw pointers that used
+        to be RefPtr. Also removed some uses of get() that aren't needed now that
+        the pointers are raw pointers. Also eliminated m_parameter from FuncExprNode
+        and FuncDeclNode. Also changed node-creating code to use new (JSGlobalData*)
+        as above.
+
+        * parser/Nodes.cpp: Eliminated NodeReleaser and all use of it.
+        (JSC::ParserRefCounted::ParserRefCounted): Updated for name change of
+        parserObjects to parserArena.
+        (JSC::SourceElements::append): Use raw pointers.
+        (JSC::ArrayNode::emitBytecode): Ditto.
+        (JSC::ArrayNode::isSimpleArray): Ditto.
+        (JSC::ArrayNode::toArgumentList): Ditto.
+        (JSC::ObjectLiteralNode::emitBytecode): Ditto.
+        (JSC::PropertyListNode::emitBytecode): Ditto.
+        (JSC::BracketAccessorNode::emitBytecode): Ditto.
+        (JSC::DotAccessorNode::emitBytecode): Ditto.
+        (JSC::ArgumentListNode::emitBytecode): Ditto.
+        (JSC::NewExprNode::emitBytecode): Ditto.
+        (JSC::EvalFunctionCallNode::emitBytecode): Ditto.
+        (JSC::FunctionCallValueNode::emitBytecode): Ditto.
+        (JSC::FunctionCallResolveNode::emitBytecode): Ditto.
+        (JSC::FunctionCallBracketNode::emitBytecode): Ditto.
+        (JSC::FunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::CallFunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::ApplyFunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::PostfixBracketNode::emitBytecode): Ditto.
+        (JSC::PostfixDotNode::emitBytecode): Ditto.
+        (JSC::DeleteBracketNode::emitBytecode): Ditto.
+        (JSC::DeleteDotNode::emitBytecode): Ditto.
+        (JSC::DeleteValueNode::emitBytecode): Ditto.
+        (JSC::VoidNode::emitBytecode): Ditto.
+        (JSC::TypeOfValueNode::emitBytecode): Ditto.
+        (JSC::PrefixBracketNode::emitBytecode): Ditto.
+        (JSC::PrefixDotNode::emitBytecode): Ditto.
+        (JSC::UnaryOpNode::emitBytecode): Ditto.
+        (JSC::BinaryOpNode::emitStrcat): Ditto.
+        (JSC::BinaryOpNode::emitBytecode): Ditto.
+        (JSC::EqualNode::emitBytecode): Ditto.
+        (JSC::StrictEqualNode::emitBytecode): Ditto.
+        (JSC::ReverseBinaryOpNode::emitBytecode): Ditto.
+        (JSC::ThrowableBinaryOpNode::emitBytecode): Ditto.
+        (JSC::InstanceOfNode::emitBytecode): Ditto.
+        (JSC::LogicalOpNode::emitBytecode): Ditto.
+        (JSC::ConditionalNode::emitBytecode): Ditto.
+        (JSC::ReadModifyResolveNode::emitBytecode): Ditto.
+        (JSC::AssignResolveNode::emitBytecode): Ditto.
+        (JSC::AssignDotNode::emitBytecode): Ditto.
+        (JSC::ReadModifyDotNode::emitBytecode): Ditto.
+        (JSC::AssignBracketNode::emitBytecode): Ditto.
+        (JSC::ReadModifyBracketNode::emitBytecode): Ditto.
+        (JSC::CommaNode::emitBytecode): Ditto.
+        (JSC::ConstDeclNode::emitCodeSingle): Ditto.
+        (JSC::ConstDeclNode::emitBytecode): Ditto.
+        (JSC::ConstStatementNode::emitBytecode): Ditto.
+        (JSC::statementListEmitCode): Ditto.
+        (JSC::BlockNode::emitBytecode): Ditto.
+        (JSC::ExprStatementNode::emitBytecode): Ditto.
+        (JSC::VarStatementNode::emitBytecode): Ditto.
+        (JSC::IfNode::emitBytecode): Ditto.
+        (JSC::IfElseNode::emitBytecode): Ditto.
+        (JSC::DoWhileNode::emitBytecode): Ditto.
+        (JSC::WhileNode::emitBytecode): Ditto.
+        (JSC::ForNode::emitBytecode): Ditto.
+        (JSC::ForInNode::emitBytecode): Ditto.
+        (JSC::ReturnNode::emitBytecode): Ditto.
+        (JSC::WithNode::emitBytecode): Ditto.
+        (JSC::CaseBlockNode::tryOptimizedSwitch): Ditto.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Ditto.
+        (JSC::SwitchNode::emitBytecode): Ditto.
+        (JSC::LabelNode::emitBytecode): Ditto.
+        (JSC::ThrowNode::emitBytecode): Ditto.
+        (JSC::TryNode::emitBytecode): Ditto.
+        (JSC::ScopeNodeData::ScopeNodeData): Use swap to transfer ownership
+        of the arena, varStack and functionStack.
+        (JSC::ScopeNode::ScopeNode): Pass in the arena when creating the
+        ScopeNodeData.
+        (JSC::ProgramNode::ProgramNode): Made this inline since it's used
+        in only one place.
+        (JSC::ProgramNode::create): Changed this to return a PassRefPtr since
+        we plan to have the scope nodes be outside the arena, so they will need
+        some kind of ownership transfer (maybe auto_ptr instead of PassRefPtr
+        in the future, though). Remove the node from the newly-created arena to
+        avoid a circular reference. Later we'll keep the node out of the arena
+        by using a different operator new, but for now it's the ParserRefCounted
+        constructor that puts the node into the arena, and there's no way to
+        bypass that.
+        (JSC::EvalNode::EvalNode): Ditto.
+        (JSC::EvalNode::create): Ditto.
+        (JSC::FunctionBodyNode::FunctionBodyNode): Ditto.
+        (JSC::FunctionBodyNode::createNativeThunk): Moved the code that
+        reseets the arena here instead of the caller.
+        (JSC::FunctionBodyNode::create): Same change as the other create
+        functions above.
+        (JSC::FunctionBodyNode::emitBytecode): Use raw pointers.
+
+        * parser/Nodes.h: Removed NodeReleaser. Changed FunctionStack to
+        use raw pointers. Removed the releaseNodes function. Added an override
+        of operator new that takes a JSGlobalData* to prepare for future arena use.
+        Use raw pointers instead of RefPtr everywhere possible.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparseInPlace): Pass the arena in.
+
+        * parser/Parser.h:
+        (JSC::Parser::parse): Updated for name change of parserObjects to parserArena.
+        (JSC::Parser::reparse): Ditto.
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Ditto.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Ditto.
+        (JSC::JSGlobalData::createNativeThunk): Moved arena manipulation into the
+        FunctionBodyNode::createNativeThunk function.
+
+        * runtime/JSGlobalData.h: Tweaked formatting and renamed parserObjects to
+        parserArena.
+
+        * wtf/NotFound.h: Added the usual "using WTF" to this header to match the
+        rest of WTF.
+
+2009-05-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25670
+        Remove no longer valid chunk of code from dtoa.
+
+        * wtf/dtoa.cpp:
+        (WTF::dtoa): Removed invalid code.
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        "Class const *" is the same as "const Class*", use the latter syntax consistently.
+
+        See <http://www.parashift.com/c++-faq-lite/const-correctness.html#faq-18.9>.
+
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLength):
+        * runtime/JSObject.h:
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+
+2009-05-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        - speedup dtoa/strtod
+        
+        Added a bunch of inlining, and replaced malloc with stack allocation.
+        
+        0.5% SunSpider speedup (7% on string-tagcloud).
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToExponential):
+        * runtime/UString.cpp:
+        (JSC::concatenate):
+        (JSC::UString::from):
+        * wtf/dtoa.cpp:
+        (WTF::BigInt::BigInt):
+        (WTF::BigInt::operator=):
+        (WTF::Balloc):
+        (WTF::Bfree):
+        (WTF::multadd):
+        (WTF::s2b):
+        (WTF::i2b):
+        (WTF::mult):
+        (WTF::pow5mult):
+        (WTF::lshift):
+        (WTF::cmp):
+        (WTF::diff):
+        (WTF::b2d):
+        (WTF::d2b):
+        (WTF::ratio):
+        (WTF::strtod):
+        (WTF::quorem):
+        (WTF::freedtoa):
+        (WTF::dtoa):
+        * wtf/dtoa.h:
+
+2009-05-09  Mike Hommey  <glandium@debian.org>
+
+        Reviewed by Geoffrey Garen. Landed by Jan Alonzo.
+
+        Enable JIT on x86-64 gtk+
+        https://bugs.webkit.org/show_bug.cgi?id=24724
+
+        * GNUmakefile.am:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Removed the last non-call-related manually managed JIT stub call.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_rshift): Fully use the JITStubCall
+        abstraction, instead of emitPutJITStubArg.
+
+2009-05-09  Sebastian Andrzej Siewior  <sebastian@breakpoint.cc>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25653
+        PLATFORM(X86_64) inherits ia64
+
+        __ia64__ is defined by gcc in an IA64 arch and has completely
+        nothing in common with X86-64 exept both are from Intel and have
+        an 64bit address space. That's it. Since code seems to expect x86
+        here, ia64 has to go.
+
+        * wtf/Platform.h:
+
+2009-05-09  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Suggested by Geoffrey Garen.
+
+        Assume SSE2 is present on X86-64 and on MAC X86-32. This fixes a
+        build breakage on non-Mac X86-64 when JIT is enabled.
+
+        * jit/JITArithmetic.cpp:
+
+2009-05-09  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Build fix, adding missing files to make dist.
+
+        * GNUmakefile.am:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchLoadToLEA):
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchLoadToLEA):
+
+2009-05-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        Original patch by John McCall. Updated by Cameron Zwarich. Further refined by me.
+        
+        - Assorted speedups to property access
+        
+        ~.3%-1% speedup on SunSpider
+        
+        1) When we know from the structure ID that an object is using inline storage, plant direct
+        loads and stores against it; no need to indirect through storage pointer.
+        
+        2) Also because of the above, union the property storage pointer with the first inline property
+        slot and add an extra inline property slot.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::CodeLocationInstruction):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::patchLoadToLEA):
+        (JSC::::CodeLocationCommon::instructionAtOffset):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::storePtr):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::store32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movq_EAXm):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::patchLoadToLEA):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSC::JSObject::propertyStorage):
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getOffset):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSC::JSObject::):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::~JSObject):
+        (JSC::Structure::isUsingInlineStorage):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        * runtime/Structure.h:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Changed all our JIT stubs so that they return a maximum of 1 JS value or
+        two non-JS pointers, and do all other value returning through out
+        parameters, in preparation for 64bit JS values on a 32bit system.
+
+        Stubs that used to return two JSValues now return one JSValue and take
+        and out parameter specifying where in the register array the second
+        value should go.
+        
+        SunSpider reports no change.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_post_dec):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6634956> CrashTracer: [REGRESSION] >400 crashes
+        in Safari at com.apple.JavaScriptCore • JSC::BytecodeGenerator::emitComplexJumpScopes + 468
+        https://bugs.webkit.org/show_bug.cgi?id=25658
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitComplexJumpScopes): Guard the whole loop
+        with a bounds check. The old loop logic would decrement and read topScope
+        without a bounds check, which could cause crashes on page boundaries.
+
+2009-05-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by NOBODY (BuildFix).
+
+        Gtk fix: add LiteralParser to the build script per r43424.
+
+        Add LiteralParser to the Qt and Wx build scripts too.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCoreSources.bkl:
+
+2009-05-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough and Darin Adler.
+
+        Add a limited literal parser for eval to handle object and array literals fired at eval
+
+        This is a simplified parser and lexer that we can throw at strings passed to eval
+        in case a site is using eval to parse JSON (eg. json2.js).  The lexer is intentionally
+        limited (in effect it's whitelisting a limited "common" subset of the JSON grammar)
+        as this decreases the likelihood of us wating time attempting to parse any significant
+        amount of non-JSON content.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/LiteralParser.cpp: Added.
+        (JSC::isStringCharacter):
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parseStatement):
+        (JSC::LiteralParser::parseExpression):
+        (JSC::LiteralParser::parseArray):
+        (JSC::LiteralParser::parseObject):
+        (JSC::LiteralParser::StackGuard::StackGuard):
+        (JSC::LiteralParser::StackGuard::~StackGuard):
+        (JSC::LiteralParser::StackGuard::isSafe):
+        * runtime/LiteralParser.h: Added.
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::attemptJSONParse):
+        (JSC::LiteralParser::):
+        (JSC::LiteralParser::Lexer::Lexer):
+        (JSC::LiteralParser::Lexer::next):
+        (JSC::LiteralParser::Lexer::currentToken):
+        (JSC::LiteralParser::abortParse):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Restored a Mozilla JS test I accidentally gutted.
+
+        * tests/mozilla/ecma/Array/15.4.4.2.js:
+        (getTestCases):
+        (test):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        More abstraction for JITStub calls from JITed code.
+        
+        Added a JITStubCall class that automatically handles things like assigning
+        arguments to different stack slots and storing return values. Deployed
+        the class in about a billion places. A bunch more places remain to be
+        fixed up, but this is a good stopping point for now.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::JSRInfo::JSRInfo):
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::):
+        (JSC::CallEvalJITStub::CallEvalJITStub):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+
+2009-05-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a new opcode jnlesseq, and optimize its compilation in the JIT using
+        techniques similar to what were used to optimize jnless in r43363.
+
+        This gives a 0.7% speedup on SunSpider, particularly on the tests 3d-cube,
+        control-flow-recursive, date-format-xparb, and string-base64.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Add support for dumping op_jnlesseq.
+        * bytecode/Opcode.h: Add op_jnlesseq to the list of opcodes.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfFalse): Add a peephole optimization
+        for op_jnlesseq when emitting lesseq followed by a jump.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Add case for op_jnlesseq.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Add case for op_jnlesseq.
+        (JSC::JIT::privateCompileSlowCases): Add case for op_jnlesseq.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_jnlesseq): Added.
+        (JSC::JIT::compileFastArithSlow_op_jnlesseq): Added.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_jlesseq): Added.
+        * jit/JITStubs.h:
+
+2009-05-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix test failures on 64-bit
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless): Avoid accidentaly treating an
+        immediate int as an immediate float in the 64-bit value representation.
+
+2009-05-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Removing an empty constructor and an uncalled, empty function seems to be a
+        pretty solid 1% regeression on my machine, so I'm going to put them back.
+        Um.  Yeah, this this pretty pointles and makes no sense at all.  I officially
+        lose the will to live in 3... 2...
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::notifyOfScope):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::~SamplingTool):
+
+2009-05-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "I see lots of ifdefs" Hunt.
+
+        Fix (kinda) for sampling tool breakage.  The codeblock sampling tool has become
+        b0rked due to recent changes in native function calling.  The initialization of
+        a ScopeNode appears to now occur before the sampling tool (or possibly the
+        interpreter has been brought into existence, wihich leads to crashyness).
+
+        This patch doesn't fix the problem.  The crash occurs when tracking a Scope, but
+        we shouldn't need to track scopes when we're just sampling opcodes, not
+        codeblocks.  Not retaining Scopes when just opcode sampling will reduce sampling
+        overhead reducing any instrumentation skew, which is a good thing.  As a side
+        benefit this patch also gets the opcode sampling going again, albeit in a bit of
+        a lame way.  Will come back later with a proper fix from codeblock sampling. 
+
+        * JavaScriptCore.exp:
+        * bytecode/SamplingTool.cpp:
+        (JSC::compareLineCountInfoSampling):
+        (JSC::SamplingTool::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+
+2009-05-07  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25640>.
+        Bug 25640: Crash on quit in r43384 nightly build on Leopard w/ Safari 4 beta installed
+        
+        Roll out r43366 as it removed symbols that Safari 4 Beta uses.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        * bytecode/SamplingTool.h:
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::::ref):
+        (WTF::::deref):
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::clearPthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::clearThreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByGthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::threadForIdentifier):
+        (WTF::clearThreadForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByQthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::clearThreadForIdentifier):
+        (WTF::threadForIdentifier):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+2009-05-07  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Suggested by Oliver Hunt.
+
+        Also check for Linux for the special-cased calling convention.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * wtf/Platform.h:
+
+2009-05-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Previously, when appending to an existing string and growing the underlying buffer,
+        we would actually allocate 110% of the required size in order to give us some space
+        to expand into.  Now we treat strings differently based on their size:
+
+        Small Strings (up to 4 pages):
+        Expand the allocation size to 112.5% of the amount requested.  This is largely sicking
+        to our previous policy, however 112.5% is cheaper to calculate.
+
+        Medium Strings (up to 128 pages):
+        For pages covering multiple pages over-allocation is less of a concern - any unused
+        space will not be paged in if it is not used, so this is purely a VM overhead.  For
+        these strings allocate 2x the requested size.
+
+        Large Strings (to infinity and beyond!):
+        Revert to our 112.5% policy - probably best to limit the amount of unused VM we allow
+        any individual string be responsible for.
+
+        Additionally, round small allocations up to a multiple of 16 bytes, and medium and
+        large allocations up to a multiple of page size.
+
+        ~1.5% progression on Sunspider, due to 5% improvement on tagcloud & 15% on validate.
+
+        * runtime/UString.cpp:
+        (JSC::expandedSize):
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::createNativeThunk): Missed a spot in my last patch.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        * wtf/Platform.h: Reverted an accidental (and performance-catastrophic)
+        change.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparseInPlace): Missed a spot in my last patch.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        (JSC::Parser::reparse): Shrink the parsedObjects vector after allocating
+        the root node, to avoid leaving a stray node in the vector, since that's
+        a slight memory leak, and it causes problems during JSGlobalData teardown.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): ASSERT that we're not being torn
+        down while we think we're still parsing, since that would cause lots of
+        bad memory references during our destruction.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Replaced two more macros with references to the JITStackFrame structure.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+
+2009-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve native call performance
+
+        Fix the windows build by adding calling convention declarations everywhere,
+        chose fastcall as that seemed most sensible given we were having to declare
+        the convention explicitly.  In addition switched to fastcall on mac in the
+        deluded belief that documented fastcall behavior on windows would match 
+        actual its actual behavior.
+
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::argumentCount):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+        (functionReadline):
+        (functionQuit):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::setScopeChain):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NativeFunctionWrapper.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::callObjectConstructor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpObject.cpp:
+        (JSC::callRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * wtf/Platform.h:
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Rolled out a portion of r43352 because it broke 64bit.
+
+        * jit/JITStubs.h:
+
+2009-05-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for functions reaturning ThreadIdentifier.
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+
+2009-05-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John Honeycutt.
+        
+        - enable optimization case im the last patch that I accidentally had disabled.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Attempt to fix Win build.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        * wtf/Threading.h:
+        (WTF::ThreadIdentifier::ThreadIdentifier):
+        (WTF::ThreadIdentifier::isValid):
+        (WTF::ThreadIdentifier::invalidate):
+        (WTF::ThreadIdentifier::platformId):
+        ThreadIdentifier is now a class, containing a PlatformThreadIdentifier and
+        methods that are used across the code on thread ids: construction, comparisons,
+        check for 'valid' state etc. '0' is used as invalid id, which happens to just work
+        with all platform-specific thread id implementations.
+
+        All the following files repeatedly reflect the new ThreadIdentifier for each platform.
+        We remove ThreadMap and threadMapMutex from all of them, remove the functions that
+        populated/searched/cleared the map and add platform-specific comparison operators
+        for ThreadIdentifier.
+
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal): All the platforms (except Windows) used a sequential
+        counter as a thread ID and mapped it into platform ID. Windows was using native thread
+        id and mapped it into thread handle. Since we can always obtain a thread handle
+        by thread id, createThread now closes the handle.
+        (WTF::waitForThreadCompletion): obtains another one using OpenThread(id) API. If can not obtain a handle,
+        it means the thread already exited.
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::detachThreadDeprecated): old function, renamed (for Win Safari 4 beta which uses it for now).
+        (WTF::waitForThreadCompletionDeprecated): same.
+        (WTF::currentThreadDeprecated): same.
+        (WTF::createThreadDeprecated): same.
+
+        * bytecode/SamplingTool.h:
+        * bytecode/SamplingTool.cpp: Use DEFINE_STATIC_LOCAL for a static ThreadIdentifier variable, to avoid static constructor.
+
+        * JavaScriptCore.exp: export lists - updated the WTF threading functions decorated names
+        since they now take a different type as a parameter.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: ditto for Windows, plus added "deprecated" functions
+        that take old parameter type - turns out public beta of Safari 4 uses those, so they need to be kept along for a while.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: ditto.
+
+2009-05-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        - optimize various cases of branch-fused less
+        
+        1% speedup on SunSpider overall
+        13% speedup on math-cordic
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        op_loop_if_less: Optimize case of constant as first operand, just as case of constant as
+        second operand.
+        op_jnless: Factored out into compileFastArith_op_jnless.
+        (JSC::JIT::privateCompileSlowCases):
+        op_jnless: Factored out into compileFastArithSlow_op_jnless.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_jnless): Factored out from main compile loop.
+        - Generate inline code for comparison of constant immediate int as first operand to another
+        immediate int, as for loop_if_less
+
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+        - Generate inline code for comparing two floating point numbers.
+        - Generate code for both cases of comparing a floating point number to a constant immediate 
+        int.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Fix dumping of op_jnless (tangentially related bugfix).
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added the return address of a stub function to the JITStackFrame abstraction.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::StackHack::StackHack):
+        (JSC::StackHack::~StackHack):
+        (JSC::returnToThrowTrampoline):
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_end):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_timeout_check):
+        (JSC::JITStubs::cti_register_file_check):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_new_object):
+        (JSC::JITStubs::cti_op_put_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_put_by_id):
+        (JSC::JITStubs::cti_op_put_by_id_second):
+        (JSC::JITStubs::cti_op_put_by_id_fail):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_new_func):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_push_activation):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params):
+        (JSC::JITStubs::cti_op_tear_off_activation):
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_profile_will_call):
+        (JSC::JITStubs::cti_op_profile_did_call):
+        (JSC::JITStubs::cti_op_ret_scopeChain):
+        (JSC::JITStubs::cti_op_new_array):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_new_func_exp):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_new_regexp):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_get_pnames):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_push_scope):
+        (JSC::JITStubs::cti_op_pop_scope):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_push_new_scope):
+        (JSC::JITStubs::cti_op_jmp_scopes):
+        (JSC::JITStubs::cti_op_put_by_index):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_put_getter):
+        (JSC::JITStubs::cti_op_put_setter):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_op_debug):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex): Fix missing braces. This would make us always
+        take the slower case for string parsing and Visual Studio correctly
+        noticed unreachable code.
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25589: goto instead of state machine in lexer
+        https://bugs.webkit.org/show_bug.cgi?id=25589
+
+        SunSpider is 0.8% faster.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::currentCharacter): Added.
+        (JSC::Lexer::currentOffset): Changed to call currentCharacter for clarity.
+        (JSC::Lexer::setCode): Removed code to set now-obsolete m_skipLineEnd.
+        (JSC::Lexer::shiftLineTerminator): Added. Handles line numbers and the
+        two-character line terminators.
+        (JSC::Lexer::makeIdentifier): Changed to take characters and length rather
+        than a vector, since we now make these directly out of the source buffer
+        when possible.
+        (JSC::Lexer::lastTokenWasRestrKeyword): Added.
+        (JSC::isNonASCIIIdentStart): Broke out the non-inline part.
+        (JSC::isIdentStart): Moved here.
+        (JSC::isNonASCIIIdentPart): Broke out the non-inline part.
+        (JSC::isIdentPart): Moved here.
+        (JSC::singleEscape): Moved here, and removed some unneeded cases.
+        (JSC::Lexer::record8): Moved here.
+        (JSC::Lexer::record16): Moved here.
+        (JSC::Lexer::lex): Rewrote this whole function to use goto and not use
+        a state machine. Got rid of most of the local variables. Also rolled the
+        matchPunctuator function in here.
+        (JSC::Lexer::scanRegExp): Changed to use the new version of isLineTerminator.
+        Clear m_buffer16 after using it instead of before.
+
+        * parser/Lexer.h: Removed State enum, setDone function, nextLine function,
+        lookupKeywordFunction, one of the isLineTerminator functions, m_done data member,
+        m_skipLineEnd data member, and m_state data member. Added shiftLineTerminator
+        function, currentCharacter function, and changed the arguments to the makeIdentifier
+        function. Removed one branch from the isLineTerminator function.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Streamlined the case where we don't replace anything.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Removed a few more special constants, and replaced them with uses of
+        the JITStackFrame struct.
+
+        Removed one of the two possible definitions of VoidPtrPair. The Mac
+        definition was more elegant, but SunSpider doesn't think it's any
+        faster, and it's net less elegant to have two ways of doing things.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode): Tweak formatting.
+
+2009-05-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the build thread stack base determination build on Symbian,
+        by moving the code block before PLATFORM(UNIX), which is also
+        enabled on Symbian builds.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase):
+
+2009-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix crash due to incorrectly using an invalid scopechain 
+
+        stringProtoFuncReplace was checking for an exception on a CachedCall
+        by asking for the cached callframes exception.  Unfortunately this
+        could crash in certain circumstances as CachedCall does not guarantee
+        a valid callframe following a call.  Even more unfortunately the check
+        was entirely unnecessary as there is only a single exception slot per
+        global data, so it was already checked via the initial exec->hadException()
+        check.
+
+        To make bugs like this more obvious, i've added a debug only destructor
+        to ScopeChainNode that 0's all of its fields.  This exposed a crash in
+        the standard javascriptcore tests.
+
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChain::~ScopeChain):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-05-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable op_strcat across += assignments.  This patch allows the lhs of a read/modify node
+        to be included within the concatenation operation, and also modifies the implementation
+        of the concatenation to attempt to reuse and cat onto the leftmost string, rather than
+        always allocating a new empty output string to copy into (as was previously the behaviour).
+
+        ~0.5% progression, due to a 3%-3.5% progression on the string tests (particularly validate).
+
+        * parser/Nodes.cpp:
+        (JSC::BinaryOpNode::emitStrcat):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        * parser/Nodes.h:
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+        * runtime/UString.cpp:
+        (JSC::UString::reserveCapacity):
+        * runtime/UString.h:
+
+2009-05-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix the build on Windows without JIT: interpreter/RegisterFile.h needs
+        roundUpAllocationSize, which is protected by #if ENABLED(ASSEMBLER).
+        Moved the #ifdef down and always offer the function.
+
+        * jit/ExecutableAllocator.h:
+
+2009-05-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "++" Barraclough.
+        
+        Added some abstraction around the JIT stub calling convention by creating
+        a struct to represent the persistent stack frame JIT code shares with
+        JIT stubs.
+        
+        SunSpider reports no change.
+
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_end):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_timeout_check):
+        (JSC::JITStubs::cti_register_file_check):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_new_object):
+        (JSC::JITStubs::cti_op_put_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_put_by_id):
+        (JSC::JITStubs::cti_op_put_by_id_second):
+        (JSC::JITStubs::cti_op_put_by_id_fail):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_new_func):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_push_activation):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params):
+        (JSC::JITStubs::cti_op_tear_off_activation):
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_profile_will_call):
+        (JSC::JITStubs::cti_op_profile_did_call):
+        (JSC::JITStubs::cti_op_ret_scopeChain):
+        (JSC::JITStubs::cti_op_new_array):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_new_func_exp):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_new_regexp):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_get_pnames):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_push_scope):
+        (JSC::JITStubs::cti_op_pop_scope):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_push_new_scope):
+        (JSC::JITStubs::cti_op_jmp_scopes):
+        (JSC::JITStubs::cti_op_put_by_index):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_put_getter):
+        (JSC::JITStubs::cti_op_put_setter):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_op_debug):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak & Darin Adler.
+
+        Improve string concatenation (as coded in JS as a sequence of adds).
+
+        Detect patterns corresponding to string concatenation, and change the bytecode
+        generation to emit a new op_strcat instruction.  By handling the full set of
+        additions within a single function we do not need allocate JSString wrappers
+        for intermediate results, and we can calculate the size of the output string
+        prior to allocating storage, in order to prevent reallocation of the buffer.
+
+        1.5%-2% progression on Sunspider, largely due to a 30% progression on date-format-xparb.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+            Add new opcodes.
+        * bytecode/Opcode.h:
+            Add new opcodes.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitStrcat):
+        (JSC::BytecodeGenerator::emitToPrimitive):
+            Add generation of new opcodes.
+        * bytecompiler/BytecodeGenerator.h:
+            Add generation of new opcodes.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            Add implmentation of new opcodes.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+            Add implmentation of new opcodes.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+            Add implmentation of new opcodes.
+        * jit/JITStubs.h:
+            Add implmentation of new opcodes.
+        * parser/Nodes.cpp:
+        (JSC::BinaryOpNode::emitStrcat):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+            Add generation of new opcodes.
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::AddNode::):
+            Add methods to allow identification of add nodes.
+        * parser/ResultType.h:
+        (JSC::ResultType::definitelyIsString):
+        (JSC::ResultType::forAdd):
+            Fix error in detection of adds that will produce string results.
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+            Add implmentation of new opcodes.
+        * runtime/UString.cpp:
+        (JSC::UString::appendNumeric):
+            Add methods to append numbers to an existing string.
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        (JSC::UString::BaseString::BaseString):
+            Add support for creating an empty string with a non-zero capacity available in the BaseString.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Made RefCounted::m_refCount private.
+
+        * runtime/Structure.h: Removed addressOfCount.
+        * wtf/RefCounted.h: Made m_refCount private.
+        Added addressOfCount.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Fixed assertion seen a lot!
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::~FunctionBodyNode): Removed now-bogus assertion.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Working with Sam Weinig.
+
+        Redo parse tree constructor optimization without breaking the Windows
+        build the way I did yesterday. The previous try broke the build by adding
+        an include of Lexer.h and all its dependencies that had to work outside
+        the JavaScriptCore project.
+
+        * GNUmakefile.am: Added NodeConstructors.h.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        Removed byteocde directory -- we no longer are trying to include Lexer.h
+        outside JavaScriptCore.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Change SegmentedVector.h
+        and Lexer.h back to internal files. Added NodeConstructors.h.
+
+        * parser/Grammar.y: Added include of NodeConstructors.h.
+        Changed use of ConstDeclNode to use public functions.
+
+        * parser/NodeConstructors.h: Copied from parser/Nodes.h.
+        Just contains the inlined constructors now.
+
+        * parser/Nodes.cpp: Added include of NodeConstructors.h.
+        Moved node constructors into the header.
+        (JSC::FunctionBodyNode::FunctionBodyNode): Removed m_refCount
+        initialization.
+
+        * parser/Nodes.h: Removed all the constructor definitions, and also
+        removed the JSC_FAST_CALL from them since these are all inlined, so the
+        calling convention is irrelevant. Made more things private. Used a data
+        member for operator opcodes instead of a virtual function. Removed the
+        special FunctionBodyNode::ref/deref functions since the default functions
+        are now just as fast.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Fixed types here so we don't typecast until
+        after we do type checking.
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix the Qt build on Windows.
+
+        * JavaScriptCore.pri: Define BUILDING_JavaScriptCore/WTF to get the meaning
+        of the JS_EXPORTDATA macros correct
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Enable the JIT for the Qt build on Windows.
+
+        * JavaScriptCore.pri:
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Tweak JavaScriptCore.pri for being able to override the generated sources dir for the
+        generated_files target.
+
+        * JavaScriptCore.pri:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build QtWebKit as a framework on Mac
+
+        This implies both debug and release build by default, unless
+        one of the --debug or --release config options are passed to
+        the build-webkit script.
+
+        Frameworks can be disabled by passing CONFIG+=webkit_no_framework
+        to the build-webkit script.
+
+        To be able to build both debug and release targets in parallel
+        we have to use separate output directories for the generated
+        sources, which is not optimal, but required to avoid race conditions.
+
+        An optimization would be to only require this spit-up on Mac.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $$GENERATED_SOURCES_DIR as output when running bison
+
+        A couple of the generators left the bison output file in the source
+        tree, and then moved it into $$GENERATED_SOURCES_DIR, which did not
+        work well when building release and debug configurations in parallel.
+
+        * JavaScriptCore.pri:
+
+2009-05-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Simplified a bit of codegen.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-05-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Moved all the JIT stub related code into one place.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+
+2009-05-05  Sam Weinig  <sam@webkit.org>
+
+        Try to fix Windows build.
+
+        Move Node constructor to the .cpp file.
+
+        * parser/Nodes.cpp: 
+        * parser/Nodes.h:
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+        Try to fix Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made SegmentedVector.h private.
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Try to fix Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made Lexer.h private.
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25569: make ParserRefCounted use conventional reference counting
+        https://bugs.webkit.org/show_bug.cgi?id=25569
+
+        SunSpider speedup of about 1.6%.
+
+        * JavaScriptCore.exp: Updated.
+
+        * parser/Nodes.cpp:
+        (JSC::NodeReleaser::releaseAllNodes): ALWAYS_INLINE.
+        (JSC::NodeReleaser::adopt): Ditto.
+        (JSC::ParserRefCounted::ParserRefCounted): Removed most of the code.
+        Add the object to a Vector<RefPtr> that gets cleared after parsing.
+        (JSC::ParserRefCounted::~ParserRefCounted): Removed most of the code.
+
+        * parser/Nodes.h: Made ParserRefCounted inherit from RefCounted and
+        made inline versions of the constructor and destructor. Made the
+        Node constructor inline.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Call globalData->parserObjects.shrink(0) after
+        parsing, where it used to call ParserRefCounted::deleteNewObjects.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Eliminated code to manage the
+        newParserObjects and parserObjectExtraRefCounts.
+        (JSC::JSGlobalData::~JSGlobalData): Ditto.
+
+        * runtime/JSGlobalData.h: Replaced the HashSet and HashCountedSet
+        with a Vector.
+
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::~PassRefPtr): The most common thing to do with a
+        PassRefPtr in hot code is to pass it and then destroy it once it's
+        set to zero. Help the optimizer by telling it that's true.
+
+2009-05-05  Xan Lopez  <xlopez@igalia.com> and Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Disable the NativeFunctionWrapper for all non-Mac ports for now,
+        as it is also crashing on Linux/x86.
+
+        * runtime/NativeFunctionWrapper.h:
+
+2009-05-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Expose toThisObject for the DOM Window
+
+        * JavaScriptCore.exp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Make windows go again until i work out the
+        accursed calling convention).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * jit/JIT.cpp:
+        * runtime/NativeFunctionWrapper.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix windows debug builds).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Hopefully the last fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix the build fix caused by a different build fix).
+
+        * parser/Nodes.cpp:
+        * parser/Nodes.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (No idea how my changes could have broken these).
+
+        * runtime/DatePrototype.cpp:
+        * runtime/RegExpObject.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Why should i expect msvc to list all the errors in a file?).
+
+        * parser/Nodes.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix warning, and another missing include).
+
+        * jit/JIT.cpp:
+        * parser/Nodes.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixes).
+
+        * runtime/ErrorPrototype.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/StringConstructor.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Will the fixes never end?).
+
+        * runtime/FunctionPrototype.h:
+        * runtime/Lookup.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixes).
+
+        * jit/JIT.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixing).
+
+        * runtime/CallData.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        * runtime/ArrayConstructor.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/Error.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/RegExpPrototype.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Add missing file
+
+        * runtime/NativeFunctionWrapper.h: Copied from JavaScriptCore/jit/ExecutableAllocator.cpp.
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25559: Improve native function call performance
+        <https://bugs.webkit.org/show_bug.cgi?id=25559>
+
+        In order to cache calls to native functions we now make the standard
+        prototype functions use a small assembly thunk that converts the JS
+        calling convention into the native calling convention.  As this is
+        only beneficial in the JIT we use the NativeFunctionWrapper typedef
+        to alternate between PrototypeFunction and JSFunction to keep the
+        code sane.  This change from PrototypeFunction to NativeFunctionWrapper
+        is the bulk of this patch.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::call):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::addPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::leaq_mr):
+        (JSC::X86Assembler::call_m):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::linkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::operator bool):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeader):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::JITStubs):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::ctiNativeCallThunk):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateJITCode):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::):
+        (JSC::FunctionBodyNode::generatedJITCode):
+        (JSC::FunctionBodyNode::jitCode):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/ArgList.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        (JSC::functionProtoFuncToString):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::mark):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::setScope):
+        (JSC::JSFunction::scope):
+        (JSC::JSFunction::isHostFunction):
+        (JSC::JSFunction::scopeChain):
+        (JSC::JSFunction::clearScopeChain):
+        (JSC::JSFunction::setScopeChain):
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::setNativeFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData):
+        (JSC::JSGlobalData::createNativeThunk):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::nativeFunctionThunk):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+
+2009-05-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        For convenience, let the sampling flags tool clear multiple flags at once.
+
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+
+2009-05-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Gavin.
+
+        - inline Vector::resize for a ~1.5% speedup on string-tagcloud
+
+        * wtf/Vector.h:
+        (WTF::Vector::resize): Inline
+
+2009-05-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+
+2009-05-03  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 64-bit build.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsAPIMangledNumber):
+        * runtime/JSNumberCell.h:
+
+2009-05-02  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in one last time (I hope).
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back out. It still breaks windows.
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in.
+
+2009-05-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 25519: streamline lexer by handling BOMs differently
+        https://bugs.webkit.org/show_bug.cgi?id=25519
+
+        Roughly 1% faster SunSpider.
+
+        * parser/Grammar.y: Tweak formatting a bit.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer): Remove unnnecessary initialization of data members
+        that are set up by setCode.
+        (JSC::Lexer::currentOffset): Added. Used where the old code would look at
+        m_currentOffset.
+        (JSC::Lexer::shift1): Replaces the old shift function. No longer does anything
+        to handle BOM characters.
+        (JSC::Lexer::shift2): Ditto.
+        (JSC::Lexer::shift3): Ditto.
+        (JSC::Lexer::shift4): Ditto.
+        (JSC::Lexer::setCode): Updated for name change from yylineno to m_line.
+        Removed now-unused m_eatNextIdentifier, m_stackToken, and m_restrKeyword.
+        Replaced m_skipLF and m_skipCR with m_skipLineEnd. Replaced the old
+        m_length with m_codeEnd and m_currentOffset with m_codeStart. Added code
+        to scan for a BOM character and call copyCodeWithoutBOMs() if we find any.
+        (JSC::Lexer::copyCodeWithoutBOMs): Added.
+        (JSC::Lexer::nextLine): Updated for name change from yylineno to m_line.
+        (JSC::Lexer::makeIdentifier): Moved up higher in the file.
+        (JSC::Lexer::matchPunctuator): Moved up higher in the file and changed to
+        use a switch statement instead of just if statements.
+        (JSC::Lexer::isLineTerminator): Moved up higher in the file and changed to
+        have fewer branches.
+        (JSC::Lexer::lastTokenWasRestrKeyword): Added. This replaces the old
+        m_restrKeyword boolean.
+        (JSC::Lexer::isIdentStart): Moved up higher in the file. Changed to use
+        fewer branches in the ASCII but not identifier case.
+        (JSC::Lexer::isIdentPart): Ditto.
+        (JSC::Lexer::singleEscape): Moved up higher in the file.
+        (JSC::Lexer::convertOctal): Moved up higher in the file.
+        (JSC::Lexer::convertHex): Moved up higher in the file. Changed to use
+        toASCIIHexValue instead of rolling our own here.
+        (JSC::Lexer::convertUnicode): Ditto.
+        (JSC::Lexer::record8): Moved up higher in the file.
+        (JSC::Lexer::record16): Moved up higher in the file.
+        (JSC::Lexer::lex): Changed type of stringType to int. Replaced m_skipLF
+        and m_skipCR with m_skipLineEnd, which requires fewer branches in the
+        main lexer loop. Use currentOffset instead of m_currentOffset. Removed
+        unneeded m_stackToken. Use isASCIIDigit instead of isDecimalDigit.
+        Split out the two cases for InIdentifierOrKeyword and InIdentifier.
+        Added special case tight loops for identifiers and other simple states.
+        Removed a branch from the code that sets m_atLineStart to false using goto.
+        Streamlined the number-handling code so we don't check for the same types
+        twice for non-numeric cases and don't add a null to m_buffer8 when it's
+        not being used. Removed m_eatNextIdentifier, which wasn't working anyway,
+        and m_restrKeyword, which is redundant with m_lastToken. Set the
+        m_delimited flag without using a branch.
+        (JSC::Lexer::scanRegExp): Tweaked style a bit.
+        (JSC::Lexer::clear): Clear m_codeWithoutBOMs so we don't use memory after
+        parsing. Clear out UString objects in the more conventional way.
+        (JSC::Lexer::sourceCode): Made this no-longer inline since it has more
+        work to do in the case where we stripped BOMs.
+
+        * parser/Lexer.h: Renamed yylineno to m_lineNumber. Removed convertHex
+        function, which is the same as toASCIIHexValue. Removed isHexDigit
+        function, which is the same as isASCIIHedDigit. Replaced shift with four
+        separate shift functions. Removed isWhiteSpace function that passes
+        m_current, instead just passing m_current explicitly. Removed isOctalDigit,
+        which is the same as isASCIIOctalDigit. Eliminated unused arguments from
+        matchPunctuator. Added copyCoodeWithoutBOMs and currentOffset. Moved the
+        makeIdentifier function out of the header. Added lastTokenWasRestrKeyword
+        function. Added new constants for m_skipLineEnd. Removed unused yycolumn,
+        m_restrKeyword, m_skipLF, m_skipCR, m_eatNextIdentifier, m_stackToken,
+        m_position, m_length, m_currentOffset, m_nextOffset1, m_nextOffset2,
+        m_nextOffset3. Added m_skipLineEnd, m_codeStart, m_codeEnd, and
+        m_codeWithoutBOMs.
+
+        * parser/SourceProvider.h: Added hasBOMs function. In the future this can
+        be used to tell the lexer about strings known not to have BOMs.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncUnescape): Changed to use isASCIIHexDigit.
+
+        * wtf/ASCIICType.h: Added using statements to match the design of the
+        other WTF headers.
+
+2009-05-02  Ada Chan  <adachan@apple.com>
+
+        Fix windows build (when doing a clean build)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Simplified null-ish JSValues.
+        
+        Replaced calls to noValue() with calls to JSValue() (which is what
+        noValue() returned). Removed noValue().
+        
+        Replaced almost all uses of jsImpossibleValue() with uses of JSValue().
+        Its one remaining use is for construction of hash table deleted values.
+        For that specific task, I made a new, private constructor with a special
+        tag. Removed jsImpossibleValue().
+        
+        Removed "JSValue()" initialiazers, since default construction happens...
+        by default.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::call):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::clearException):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_vm_throw):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::Completion::Completion):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::getPrimitiveNumber):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getJSNumber):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getJSNumber):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
+        (JSC::JSImmediate::from):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsNumberCell):
+        * runtime/JSObject.cpp:
+        (JSC::callDefaultValueFunction):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::JSValueHashTraits::constructDeletedValue):
+        (JSC::JSValueHashTraits::isDeletedValue):
+        (JSC::JSValue::JSValue):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/Operations.h:
+        (JSC::resolveBase):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::clearBase):
+        (JSC::PropertySlot::clearValue):
+
+2009-05-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - speed up the lexer in various ways
+
+        ~2% command-line SunSpider speedup
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Moved below shift() so it can inline.
+        (JSC::Lexer::scanRegExp):  Use resize(0) instead of clear() on Vectors, since the intent
+        here is not to free the underlying buffer.
+        (JSC::Lexer::lex): ditto; also, change the loop logic a bit for the main lexing loop
+        to avoid branching on !m_done twice per iteration. Now we only check it once.
+        (JSC::Lexer::shift): Make this ALWAYS_INLINE and tag an unusual branch as UNLIKELY
+        * parser/Lexer.h:
+        (JSC::Lexer::makeIdentifier): force to be ALWAYS_INLINE
+        * wtf/Vector.h:
+        (WTF::::append): force to be ALWAYS_INLINE (may have helped in ways other than parsing but it wasn't
+        getting inlined in a hot code path in the lexer)
+
+2009-05-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix 64bit build.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::jsNumber):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Roll out JavaScriptCore API number marshaling.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSValue.h:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * JavaScriptCore.exp:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Too Far!" Garen.
+
+        Move JS number construction into JSValue.
+
+        * runtime/JSImmediate.h:
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::jsNumber):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff "The Minneapolis" Garen.
+
+        Add mechanism to vend heap allocated JS numbers to JavaScriptCore API clients with a
+        representation that is independent of the number representation in the VM.
+        - Numbers leaving the interpreter are converted to a tagged JSNumberCell.
+        - The numbers coming into the interpreter (asserted to be the tagged JSNumberCell) are
+          converted back to the VM's internal number representation.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsAPIMangledNumber):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::isAPIMangledNumber):
+        (JSC::JSNumberCell::):
+        (JSC::JSNumberCell::JSNumberCell):
+        (JSC::JSValue::isAPIMangledNumber):
+        * runtime/JSValue.h:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 6.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 5.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 4.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 3.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+        
+        Renamed JSValuePtr => JSValue.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::asCallbackObject):
+        (JSC::::put):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+        (JSC::CodeBlock::addUnexpectedConstant):
+        (JSC::CodeBlock::unexpectedConstant):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addUnexpectedConstant):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/Debugger.h:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::put):
+        (JSC::DebuggerActivation::putWithAttributes):
+        (JSC::DebuggerActivation::lookupGetter):
+        (JSC::DebuggerActivation::lookupSetter):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        (JSC::DebuggerCallFrame::exception):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        (JSC::CachedCall::setThis):
+        (JSC::CachedCall::setArgument):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::thisValue):
+        (JSC::CallFrame::dumpCaller):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setException):
+        (JSC::ExecState::exception):
+        (JSC::ExecState::exceptionSlot):
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::setArgument):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::isNotObject):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::jsValue):
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::):
+        (JSC::JITCode::execute):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::getConstantOperand):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitInitRegister):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionSetSamplingFlag):
+        (functionClearSamplingFlag):
+        (functionReadline):
+        (functionQuit):
+        * parser/Nodes.cpp:
+        (JSC::processClauseList):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        * profiler/Profiler.h:
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::at):
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::ArgList::ArgList):
+        (JSC::ArgList::at):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        (JSC::asArguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.h:
+        (JSC::asBooleanObject):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CallData.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        * runtime/Collector.h:
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::Completion::Completion):
+        (JSC::Completion::value):
+        (JSC::Completion::setValue):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DateInstance.h:
+        (JSC::asDateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInterruptedExecutionException):
+        (JSC::createError):
+        (JSC::createStackOverflowError):
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::toPrimitive):
+        (JSC::GetterSetter::getPrimitiveNumber):
+        * runtime/GetterSetter.h:
+        (JSC::asGetterSetter):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        (JSC::asInternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        (JSC::asActivation):
+        * runtime/JSArray.cpp:
+        (JSC::storageSize):
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::mark):
+        (JSC::compareNumbersForQSort):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::createStructure):
+        (JSC::asArray):
+        (JSC::isJSArray):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        (JSC::JSByteArray::put):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::getIndex):
+        (JSC::JSByteArray::setIndex):
+        (JSC::asByteArray):
+        (JSC::isJSByteArray):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+        (JSC::JSCell::getJSNumber):
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::isString):
+        (JSC::JSValue::isGetterSetter):
+        (JSC::JSValue::isObject):
+        (JSC::JSValue::getString):
+        (JSC::JSValue::getObject):
+        (JSC::JSValue::getCallData):
+        (JSC::JSValue::getConstructData):
+        (JSC::JSValue::getUInt32):
+        (JSC::JSValue::getTruncatedInt32):
+        (JSC::JSValue::getTruncatedUInt32):
+        (JSC::JSValue::mark):
+        (JSC::JSValue::marked):
+        (JSC::JSValue::toPrimitive):
+        (JSC::JSValue::getPrimitiveNumber):
+        (JSC::JSValue::toBoolean):
+        (JSC::JSValue::toNumber):
+        (JSC::JSValue::toString):
+        (JSC::JSValue::toObject):
+        (JSC::JSValue::toThisObject):
+        (JSC::JSValue::needsThisConversion):
+        (JSC::JSValue::toThisString):
+        (JSC::JSValue::getJSNumber):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        (JSC::asFunction):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::JSGlobalObject::GlobalPropertyInfo::GlobalPropertyInfo):
+        (JSC::asGlobalObject):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::Structure::prototypeChain):
+        (JSC::Structure::isValid):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::prototype):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::isImmediate):
+        (JSC::JSImmediate::isNumber):
+        (JSC::JSImmediate::isIntegerNumber):
+        (JSC::JSImmediate::isDoubleNumber):
+        (JSC::JSImmediate::isPositiveIntegerNumber):
+        (JSC::JSImmediate::isBoolean):
+        (JSC::JSImmediate::isUndefinedOrNull):
+        (JSC::JSImmediate::isEitherImmediate):
+        (JSC::JSImmediate::areBothImmediate):
+        (JSC::JSImmediate::areBothImmediateIntegerNumbers):
+        (JSC::JSImmediate::makeValue):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeDouble):
+        (JSC::JSImmediate::makeBool):
+        (JSC::JSImmediate::makeUndefined):
+        (JSC::JSImmediate::makeNull):
+        (JSC::JSImmediate::doubleValue):
+        (JSC::JSImmediate::intValue):
+        (JSC::JSImmediate::uintValue):
+        (JSC::JSImmediate::boolValue):
+        (JSC::JSImmediate::rawValue):
+        (JSC::JSImmediate::trueImmediate):
+        (JSC::JSImmediate::falseImmediate):
+        (JSC::JSImmediate::undefinedImmediate):
+        (JSC::JSImmediate::nullImmediate):
+        (JSC::JSImmediate::zeroImmediate):
+        (JSC::JSImmediate::oneImmediate):
+        (JSC::JSImmediate::impossibleValue):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::getTruncatedUInt32):
+        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::getTruncatedInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSImmediate::getUInt32):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32Fast):
+        (JSC::JSValue::getInt32Fast):
+        (JSC::JSValue::isUInt32Fast):
+        (JSC::JSValue::getUInt32Fast):
+        (JSC::JSValue::makeInt32Fast):
+        (JSC::JSValue::areBothInt32Fast):
+        (JSC::JSFastMath::canDoFastBitwiseOperations):
+        (JSC::JSFastMath::equal):
+        (JSC::JSFastMath::notEqual):
+        (JSC::JSFastMath::andImmediateNumbers):
+        (JSC::JSFastMath::xorImmediateNumbers):
+        (JSC::JSFastMath::orImmediateNumbers):
+        (JSC::JSFastMath::canDoFastRshift):
+        (JSC::JSFastMath::canDoFastUrshift):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+        (JSC::JSFastMath::addImmediateNumbers):
+        (JSC::JSFastMath::subImmediateNumbers):
+        (JSC::JSFastMath::incImmediateNumber):
+        (JSC::JSFastMath::decImmediateNumber):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toPrimitive):
+        (JSC::JSNotAnObject::getPrimitiveNumber):
+        (JSC::JSNotAnObject::put):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toPrimitive):
+        (JSC::JSNumberCell::getPrimitiveNumber):
+        (JSC::JSNumberCell::getJSNumber):
+        (JSC::jsNumberCell):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        (JSC::isNumberCell):
+        (JSC::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValue::isDoubleNumber):
+        (JSC::JSValue::getDoubleNumber):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::uncheckedGetNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::toJSNumber):
+        (JSC::JSValue::getNumber):
+        (JSC::JSValue::numberToInt32):
+        (JSC::JSValue::numberToUInt32):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::callDefaultValueFunction):
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::toNumber):
+        (JSC::JSObject::toString):
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::createStructure):
+        (JSC::asObject):
+        (JSC::JSObject::prototype):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSValue::isObject):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::get):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::toPrimitive):
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive):
+        (JSC::JSPropertyNameIterator::getPrimitiveNumber):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        (JSC::JSStaticScopeObject::putWithAttributes):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.cpp:
+        (JSC::JSString::toPrimitive):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        (JSC::asString):
+        (JSC::isJSString):
+        (JSC::JSValue::toThisJSString):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toInteger):
+        (JSC::JSValue::toIntegerPreserveNaN):
+        * runtime/JSValue.h:
+        (JSC::JSValue::makeImmediate):
+        (JSC::JSValue::asValue):
+        (JSC::noValue):
+        (JSC::jsImpossibleValue):
+        (JSC::jsNull):
+        (JSC::jsUndefined):
+        (JSC::jsBoolean):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        (JSC::callNumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::getJSNumber):
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::callObjectConstructor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/Operations.cpp:
+        (JSC::JSValue::equalSlowCase):
+        (JSC::JSValue::strictEqualSlowCase):
+        (JSC::throwOutOfMemoryError):
+        (JSC::jsAddSlowCase):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        * runtime/Operations.h:
+        (JSC::JSValue::equal):
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::resolveBase):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::putValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCustomIndex):
+        (JSC::PropertySlot::slotBase):
+        (JSC::PropertySlot::setBase):
+        (JSC::PropertySlot::):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        (JSC::ProtectedPtr::operator JSValue):
+        (JSC::ProtectedJSValue::ProtectedJSValue):
+        (JSC::ProtectedJSValue::get):
+        (JSC::ProtectedJSValue::operator JSValue):
+        (JSC::ProtectedJSValue::operator->):
+        (JSC::ProtectedJSValue::~ProtectedJSValue):
+        (JSC::ProtectedJSValue::operator=):
+        (JSC::operator==):
+        (JSC::operator!=):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getBackref):
+        (JSC::RegExpConstructor::getLastParen):
+        (JSC::RegExpConstructor::getLeftContext):
+        (JSC::RegExpConstructor::getRightContext):
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        (JSC::RegExpConstructor::put):
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        (JSC::constructRegExp):
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        (JSC::asRegExpConstructor):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::put):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+        (JSC::RegExpObject::put):
+        (JSC::setRegExpObjectLastIndex):
+        (JSC::RegExpObject::test):
+        (JSC::RegExpObject::exec):
+        (JSC::callRegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        (JSC::asRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        (JSC::asStringObject):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::changePrototypeTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::setPrototypeWithoutTransition):
+        (JSC::Structure::storedPrototype):
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "That doesn't look like what I thought it looks like" Weinig.
+        
+        Beefed up the JSValuePtr class and removed some non-JSValuePtr dependencies
+        on JSImmediate, in prepapration for making JSImmediate an implementation
+        detail of JSValuePtr.
+        
+        SunSpider reports no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_mod):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt): Updated for interface changes.
+
+        * runtime/JSImmediate.h:
+        (JSC::JSValuePtr::JSValuePtr):
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::):
+        (JSC::jsImpossibleValue):
+        (JSC::jsNull):
+        (JSC::jsUndefined):
+        (JSC::jsBoolean):
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+        (JSC::JSValuePtr::JSValuePtr):
+        (JSC::JSValuePtr::operator bool):
+        (JSC::JSValuePtr::operator==):
+        (JSC::JSValuePtr::operator!=):
+        (JSC::JSValuePtr::isUndefined):
+        (JSC::JSValuePtr::isNull): Changed jsImpossibleValue(), jsNull(),
+        jsUndefined(), and jsBoolean() to operate in terms of JSValuePtr instead
+        of JSImmediate.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitwise_cast): Fixed up for clarity.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug fix for rdar:/6845379.  If a case-insensitive regex contains
+        a character class containing a range with an upper bound of \uFFFF
+        the parser will infinite-loop whist adding other-case characters
+        for characters in the range that do have another case.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        OPCODE_SAMPLING without CODEBLOCK_SAMPLING is currently broken,
+        since SamplingTool::Sample::isNull() checks the m_codeBlock
+        member (which is always null without CODEBLOCK_SAMPLING).
+
+        Restructure the checks so make this work again.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::Sample::isNull):
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        - Concatenate final three strings in simple replace case at one go
+
+        ~0.2% SunSpider speedup
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Use new replaceRange helper instead of
+        taking substrings and concatenating three strings.
+        * runtime/UString.cpp:
+        (JSC::UString::replaceRange): New helper function.
+        * runtime/UString.h:
+
+2009-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Gavin Barraclough.
+        
+        Changed JSValueEncodedAsPtr* => EncodedJSValuePtr to support a non-pointer
+        encoding for JSValuePtrs.
+
+        * API/APICast.h:
+        (toJS):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        * jit/JIT.cpp:
+        (JSC::):
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        (JSC::):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Abandon Ship!" Hunt.
+
+        Fix a leak in Yarr.
+
+        All Disjunctions should be recorded in RegexPattern::m_disjunctions,
+        so that they can be freed at the end of compilation - copyDisjunction
+        is failing to do so.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::copyDisjunction):
+
+2009-04-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add function to CallFrame for dumping the current JS caller
+
+        Added debug only method CallFrame::dumpCaller() that provide the call location
+        of the deepest currently executing JS function.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::dumpCaller):
+        * interpreter/CallFrame.h:
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - make BaseStrings have themselves as a base, instead of nothing, to remove common branches
+
+        ~0.7% SunSpider speedup
+
+        * runtime/UString.h:
+        (JSC::UString::Rep::Rep): For the constructor without a base, set self as base instead of null.
+        (JSC::UString::Rep::baseString): Just read m_baseString - no more branching.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Two quick improvements to SamplingFlags mechanism.
+
+        SamplingFlags::ScopedFlag class to provide support for automagically
+        clearing a flag as it goes out of scope, and add a little more detail
+        to the output generated by the tool.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::stop):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingFlags::ScopedFlag::ScopedFlag):
+        (JSC::SamplingFlags::ScopedFlag::~ScopedFlag):
+
+2009-04-30  Adam Roben  <aroben@apple.com>
+
+        Restore build event steps that were truncated in r43082
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+        Re-copied the command lines for the build events from the pre-r43082
+        .vcproj files.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Removed an unnecessary
+        attribute.
+
+2009-04-30  Adam Roben  <aroben@apple.com>
+
+        Move settings from .vcproj files to .vsprops files within the
+        JavaScriptCore directory
+
+        Moving the settings to a .vsprops file means that we will only have to
+        change a single setting to affect all configurations, instead of one
+        setting per configuration.
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        Moved settings from these files to the new .vsprops files. Note that
+        testapi.vcproj had a lot of overrides of default settings that were
+        the same as the defaults, which I've removed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Added.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * Configurations/FeatureDefines.xcconfig: Added ENABLE_JAVASCRIPT_DEBUGGER define.
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        - speed up string concatenation by reorganizing some simple cases
+
+        0.7% SunSpider speedup
+
+        * runtime/UString.cpp:
+        (JSC::concatenate): Put fast case for appending a single character
+        before the empty string special cases; streamline code a bit to
+        delay computing values that are not needed in the fast path.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add SamplingFlags mechanism.
+
+        This mechanism allows fine-grained JSC and JavaScript program aware
+        performance measurement.  The mechanism provides a set of 32 flags,
+        numbered #1..#32.  Flag #16 is initially set, and all other flags
+        are cleared.  Flags may be set and cleared from within
+
+        Enable by setting ENABLE_SAMPLING_FLAGS to 1 in wtf/Platform.h.
+        Disabled by default, no performance impact.  Flags may be modified
+        by calling SamplingFlags::setFlag() and SamplingFlags::clearFlag()
+        from within JSC implementation, or by calling setSamplingFlag() and
+        clearSamplingFlag() from JavaScript.
+
+        The flags are sampled with a frequency of 10000Hz, and the highest
+        set flag in recorded, allowing multiple events to be measured (with
+        the highest flag number representing the highest priority).
+
+        Disabled by default; no performance impact.
+
+        * JavaScriptCore.exp:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::sample):
+        (JSC::SamplingFlags::start):
+        (JSC::SamplingFlags::stop):
+        (JSC::SamplingThread::threadStartFunc):
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::sample):
+        (JSC::SamplingTool::start):
+        (JSC::SamplingTool::stop):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingFlags::setFlag):
+        (JSC::SamplingFlags::clearFlag):
+        (JSC::SamplingTool::SamplingTool):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionSetSamplingFlag):
+        (functionClearSamplingFlag):
+        (runWithScripts):
+        * wtf/Platform.h:
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Another attempt to fix the windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Try and fix the windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Peg-Leg" Hunt.
+
+        Coallesce input checking and reduce futzing with the index position
+        between alternatives and iterations of the main loop of a regex,
+        when run in YARR.
+
+        Consider the following regex:  /foo|bar/
+        
+        Prior to this patch, this will be implemented something like this pseudo-code description:
+        
+        loop:
+            check_for_available_input(3) // this increments the index by 3, for the first alterantive.
+                if (available) { test "foo" }
+            decrement_index(3)
+            check_for_available_input(3) // this increments the index by 3, for the second alterantive.
+                if (available) { test "bar" }
+            decrement_index(3)
+            check_for_available_input(1) // can we loop again?
+                if (available) { goto loop }
+
+        With these changes it will look more like this:
+
+            check_for_available_input(3) // this increments the index by 3, for the first alterantive.
+            if (!available) { goto fail }
+        loop:
+            test "foo"
+            test "bar"
+            check_for_available_input(1) // can we loop again?
+                if (available) { goto loop }
+        fail:
+
+
+        This gives about a 5% gain on v8-regex, no change on Sunspider.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracksTo):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2009-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clean up ArgList to be a trivial type
+
+        Separate out old ArgList logic to handle buffering and marking arguments
+        into a distinct MarkedArgumentBuffer type.  ArgList becomes a trivial
+        struct of a pointer and length.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * JavaScriptCore.exp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::emptyList):
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::getSlice):
+        (JSC::MarkedArgumentBuffer::markLists):
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
+        (JSC::ArgList::ArgList):
+        (JSC::ArgList::at):
+        (JSC::ArgList::isEmpty):
+        (JSC::ArgList::size):
+        (JSC::ArgList::begin):
+        (JSC::ArgList::end):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::fillArgList):
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/Collector.h:
+        (JSC::Heap::markListSet):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::Error::create):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::fillArgList):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncMatch):
+
+2009-04-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25334
+
+        Fix Qt build when ENABLE_JIT is explicitly set to 1
+        to overrule defaults.
+
+        * JavaScriptCore.pri:
+
+2009-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Crash in profiler due to incorrect assuming displayName would be a string.
+
+        Fixed by adding a type guard.
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+
+2009-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Beth Dakin.
+        
+        Removed scaffolding supporting dynamically converting between 32bit and
+        64bit value representations. 
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::construct):
+        (JSC::::call):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::thisValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::jsValue):
+        (JSC::Register::marked):
+        (JSC::Register::mark):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::arguments):
+        (JSC::Register::callFrame):
+        (JSC::Register::codeBlock):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        (JSC::Register::vPC):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_call_eval):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionRun):
+        (functionLoad):
+        * runtime/ArgList.h:
+        (JSC::ArgList::at):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToRegisters):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlot):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructError):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::construct):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::constructWithStringConstructor):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+
+2009-04-28  David Kilzer  <ddkilzer@apple.com>
+
+        A little more hardening for UString
+
+        Reviewed by Maciej Stachowiak.
+
+        Revised fix for <rdar://problem/5861045> in r42644.
+
+        * runtime/UString.cpp:
+        (JSC::newCapacityWithOverflowCheck): Added.
+        (JSC::concatenate): Used newCapacityWithOverflowCheck().
+        (JSC::UString::append): Ditto.
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bring back r42969, this time with correct codegen
+
+        Add logic to the codegen for right shift to avoid jumping to a helper function
+        when shifting a small floating point value.
+
+        * jit/JITArithmetic.cpp:
+        (isSSE2Present):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+
+2009-04-28  Kevin Ollivier <kevino@theolliviers.com>
+
+        wxMSW build fix. Switch JSCore build back to static. 
+
+        * API/JSBase.h:
+        * config.h:
+        * jscore.bkl:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Roll out r42969, due to hangs in build bot.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::isSSE2Present):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add (even more) missing files to list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve performance of string indexing
+
+        Add a cti_get_by_val_string function to specialise indexing into a string object.
+        This gives us a slight performance win on a number of string tests.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        * jit/JITStubs.h:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve performance of right shifts of large or otherwise floating point values.
+
+        Add logic to the codegen for right shift to avoid jumping to a helper function
+        when shifting a small floating point value.
+
+        * jit/JITArithmetic.cpp:
+        (isSSE2Present): Moved to the head of file.
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add (more) missing files to list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add missing header to file list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Maciej "Henry Morgan" Stachowiak.
+
+        Enable YARR.
+        (Again.)
+
+        * wtf/Platform.h:
+
+2009-04-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Tweak a loop condition to keep GCC happy,
+        some GCCs seem to be having issues with this. :-/
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::breakTarget):
+        * wtf/Platform.h:
+
+2009-04-27  Adam Roben  <aroben@apple.com>
+
+        Windows Debug build fix
+
+        Not sure why the buildbots weren't affected by this problem.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Let VS
+        re-order the file list, and added JavaScriptCore[_debug].def to the
+        project. This was not necessary for the fix, but made making the fix
+        easier.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed a function that no longer exists.
+
+2009-04-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Weinig Sam.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25416
+        "Cached prototype accesses unsafely hoist property storage load above structure checks."
+        
+        Do not hoist the load of the pointer to the property storage array.
+
+        No performance impact.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+
+2009-04-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey "Gaffe or energy?" Garen.
+
+        Randomize address requested by ExecutableAllocatorFixedVMPool.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+
+2009-04-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove scons-based build system.
+
+        * JavaScriptCore.scons: Removed.
+
+2009-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Make HAVE_MADV_FREE darwin only for now
+
+        * wtf/Platform.h:
+
+2009-04-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk build fix - check if we have MADV_FREE before using it.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+        * wtf/Platform.h:
+
+2009-04-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switching JSCore from a static lib to a dynamic lib
+        to match the Apple build and fix symbol exports.
+
+        * jscore.bkl:
+
+2009-04-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25337
+        Move ThreadingQt.cpp under the qt directory.
+
+        * JavaScriptCore.pri:
+        * wtf/ThreadingQt.cpp: Removed.
+        * wtf/qt/ThreadingQt.cpp: Copied from JavaScriptCore/wtf/ThreadingQt.cpp.
+
+2009-04-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25338
+        Move ThreadingGtk.cpp under the gtk directory.
+
+        * GNUmakefile.am:
+        * wtf/ThreadingGtk.cpp: Removed.
+        * wtf/gtk/ThreadingGtk.cpp: Copied from JavaScriptCore/wtf/ThreadingGtk.cpp.
+
+2009-04-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Wesley" Weinig.
+
+        Improve performance to YARR interpreter.
+        (From about 3x slower than PCRE on regex-dna to about 30% slower).
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::checkCasedCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::regexEnd):
+        (JSC::Yarr::ByteCompiler::alterantiveBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::ByteTerm::):
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BodyAlternativeBegin):
+        (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::BodyAlternativeEnd):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+        (JSC::Yarr::ByteTerm::SubpatternBegin):
+        (JSC::Yarr::ByteTerm::SubpatternEnd):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        * yarr/RegexPattern.h:
+
+2009-04-24  Rob Raguet-Schofield  <ragfield@gmail.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        * wtf/CurrentTime.h: Fix a typo in a comment.
+
+2009-04-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add reinterpret_cast
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+
+2009-04-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6050421> JavaScript register file should remap to release physical pages accumulated during deep recursion
+
+        We now track the maximum extent of the RegisterFile, and when we reach the final
+        return from JS (so the stack portion of the registerfile becomes empty) we see
+        if that extent is greater than maxExcessCapacity.  If it is we use madvise or
+        VirtualFree to release the physical pages that were backing the excess.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        With great sadness and a heavy heart I switch us back from YARR to WREC in
+        order to restore greenness to the world once more.
+
+        * wtf/Platform.h:
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        More Windows build fixage.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:  Remove a symbol that no longer exists.
+
+2009-04-23  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 24604: WebKit profiler reports incorrect total times
+        <https://bugs.webkit.org/show_bug.cgi?id=24604>
+
+        Reviewed by Timothy Hatcher and Kevin McCullough.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::Hash::hash):
+        (JSC::CallIdentifier::Hash::equal):
+        (JSC::CallIdentifier::hash):
+        (WTF::):
+        * profiler/HeavyProfile.cpp: Removed.
+        * profiler/HeavyProfile.h: Removed.
+        * profiler/Profile.cpp: No more need for TreeProfile/HeavyProfile
+        (JSC::Profile::create):
+        * profiler/Profile.h:
+        * profiler/ProfileNode.cpp:
+        * profiler/ProfileNode.h:
+        * profiler/TreeProfile.cpp: Removed.
+        * profiler/TreeProfile.h: Removed.
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Not Reviewed.
+
+        Speculative Windows build fix II.
+
+        * yarr/RegexInterpreter.cpp:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Not Reviewed.
+
+        Speculative Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * runtime/RegExp.cpp:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by salty sea dogs Sam & Geoff.
+
+        Enable YARR_JIT by default (where supported), replacing WREC.
+
+        * wtf/Platform.h:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff "Dread Pirate Roberts" Garen.
+
+        Various small fixes to YARR JIT, in preparation for enabling it by default.
+
+        * Correctly index into the callframe when storing restart addresses for
+          nested alternatives.
+        * Allow backtracking back into matched alternatives of parentheses.
+        * Fix callframe offset calculation for parenthetical assertions.
+        * When a set of parenthese are quantified with a fixed and variable portion,
+          and the variable portion is quantified once, this should not reset the
+          pattern match on failure to match (the last match from the firxed portion
+          should be preserved).
+        * Up the pattern size limit to match PCRE's new limit.
+        * Unlclosed parentheses should be reported with the message "missing )".
+
+        * wtf/Platform.h:
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::loadFromFrameAndJump):
+        (JSC::Yarr::RegexGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+
+2009-04-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Add the m_ prefix on FixedVMPoolAllocator's member variables, and fix typos in a few comments.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::addToFreeList):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+
+2009-04-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Add some assertions to FixedVMPoolAllocator to guard against cases where we
+        attempt to free memory that didn't originate from the pool, or we attempt to
+        hand out a bogus address from alloc.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+
+2009-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam "Blackbeard" Weinig.
+
+        Although pirates do spell the word 'generate' as 'genertate',
+        webkit developers do not.  Fixertate.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+
+2009-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Blackbeard" Weinig.
+
+        Improvements to YARR JIT.  This patch expands support in three key areas:
+            * Add (temporary) support for falling back to PCRE for expressions not supported.
+            * Add support for x86_64 and Windows.
+            * Add support for singly quantified parentheses (? and ??), alternatives within
+              parentheses, and parenthetical assertions.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::storeToFrame):
+        (JSC::Yarr::RegexGenerator::storeToFrameWithPatch):
+        (JSC::Yarr::RegexGenerator::loadFromFrameAndJump):
+        (JSC::Yarr::RegexGenerator::AlternativeBacktrackRecord::AlternativeBacktrackRecord):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::addBacktrackJump):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracks):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::propagateBacktrackingFrom):
+        (JSC::Yarr::RegexGenerator::genertateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::genertateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::matchAssertionWordchar):
+        (JSC::Yarr::RegexGenerator::genertateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::generate):
+        (JSC::Yarr::RegexGenerator::compile):
+        (JSC::Yarr::RegexGenerator::generationFailed):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Fix for <rdar://problem/6816957>
+        Turn off Geolocation by default
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        * interpreter/CachedCall.h:
+
+2009-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        * runtime/StringPrototype.cpp:
+
+2009-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Improve String.replace performance slightly
+
+        Apply our vm reentry caching logic to String.replace with global
+        regexes.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Oliver Hunt.
+        
+        Re-Fixed <rdar://problem/6406045> REGRESSION: Stack overflow on PowerPC on
+        fast/workers/use-machine-stack.html (22531)
+        
+        SunSpider reports no change.
+        
+        Use a larger recursion limit on the main thread (because we can, and
+        there's some evidence that it may improve compatibility), and a smaller
+        recursion limit on secondary threads (because they tend to have smaller
+        stacks).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+        (JSC::): Ditto. I wrote the recursion test slightly funny, so that the
+        common case remains a simple compare to constant.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin): Conservatively, set the array recursion limits
+        to the lower, secondary thread limit. We can do something fancier if
+        compatibility moves us, but this seems sufficient for now.
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Adam Roben.
+        
+        Disabled one more Mozilla JS test because it fails intermittently on Windows.
+        (See https://bugs.webkit.org/show_bug.cgi?id=25160.)
+
+        * tests/mozilla/expected.html:
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Rename JavaScriptCore_debug.dll to JavaScriptCore.dll in the Debug
+        configuration
+
+        This matches the naming scheme for WebKit.dll, and will be necessary
+        once Safari links against JavaScriptCore.dll. This change also causes
+        run-safari not to fail (because the launcher printed by FindSafari was
+        always looking for JavaScriptCore.dll, never
+        JavaScriptCore_debug.dll).
+
+        Part of Bug 25305: can't run safari or drt on windows
+        <https://bugs.webkit.org/show_bug.cgi?id=25305>
+
+        Reviewed by Steve Falkenburg and Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        Use $(WebKitDLLConfigSuffix) for naming JavaScriptCore.{dll,lib}.
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Fix JavaScriptCore build on VC++ Express
+
+        Reviewed by Steve Falkenburg and Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Link
+        explicitly against gdi32.lib and oleaut32.lib.
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Tiger crash fix: Put VM tags in their own header file, and fixed up the
+        #ifdefs so they're not used on Tiger.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+        * wtf/VMTags.h: Added.
+
+2009-04-20  Steve Falkenburg  <sfalken@apple.com>
+
+        More Windows build fixes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Copy DLLs, PDBs.
+        * JavaScriptCore.vcproj/JavaScriptCore.resources: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add version stamping, resource copying.
+
+2009-04-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Separate JavaScriptCore.dll from WebKit.dll.
+        Slight performance improvement or no change on benchmarks.
+        
+        Allows us to break a circular dependency between CFNetwork and WebKit on Windows,
+        and simplifies standalone JavaScriptCore builds.
+
+        Reviewed by Oliver Hunt.
+
+        * API/JSBase.h: Export symbols with JS_EXPORT when using MSVC.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Build JavaScriptCore as a DLL instead of a static library.
+        * config.h: Specify __declspec(dllexport/dllimport) appropriately when exporting data.
+        * runtime/InternalFunction.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/JSArray.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/JSFunction.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/StringObject.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/UString.h: Specify JS_EXPORTDATA on exported data.
+
+2009-04-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Kevin McCullough.
+
+        Always tag mmaped memory on darwin and clean up #defines
+        now that they are a little bigger.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+
+2009-04-20  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Tim Hatcher.
+
+        Add licenses for xcconfig files.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2009-04-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Build fix for Qt port (after r42646). Not reviewed.
+
+        * wtf/unicode/qt4/UnicodeQt4.h: Added U16_PREV.
+
+2009-04-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Better fix for JSStringCreateWithCFString hardening.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2009-04-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/5860954>
+        Harden JSStringCreateWithCFString against malformed CFStringRefs.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2009-04-19  David Kilzer  <ddkilzer@apple.com>
+
+        Make FEATURE_DEFINES completely dynamic
+
+        Reviewed by Darin Adler.
+
+        Make FEATURE_DEFINES depend on individual ENABLE_FEATURE_NAME
+        variables for each feature, making it possible to remove all
+        knowledge of FEATURE_DEFINES from build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig: Extract a variable
+        from FEATURE_DEFINES for each feature setting.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix typo.  s/VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE/VM_MEMORY_JAVASCRIPT_CORE/
+
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock): Fix bozo typo.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/6801555> Tag JavaScript memory on SnowLeopard
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+
+2009-04-18  Drew Wilson  <amw@apple.com>
+
+        <rdar://problem/6781407> VisiblePosition.characterAfter should return UChar32
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::hasLineBreakingPropertyComplexContextOrIdeographic): Added.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for <rdar://problem/5861045>
+        A little bit of hardening for UString.
+
+        * runtime/UString.cpp:
+        (JSC::concatenate):
+        (JSC::UString::append):
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe and Dan Bernstein.
+
+        Fix for <rdar://problem/5861188>
+        A little bit of hardening for Vector.
+
+        * wtf/Vector.h:
+        (WTF::Vector<T, inlineCapacity>::append):
+        (WTF::Vector<T, inlineCapacity>::insert):
+
+2009-04-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        On x86_64, make all JIT-code allocations from a new heap, managed
+        by FixedVMPoolAllocator.  This class allocates a single large (2Gb)
+        pool of virtual memory from which all further allocations take place.
+        Since all JIT code is allocated from this pool, we can continue to
+        safely assume (as is already asserted) that it will always be possible
+        to link any JIT-code to JIT-code jumps and calls.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            Add new file.
+        * jit/ExecutableAllocatorFixedVMPool.cpp: Added.
+        (JSC::FreeListEntry::FreeListEntry):
+        (JSC::AVLTreeAbstractorForFreeList::get_less):
+        (JSC::AVLTreeAbstractorForFreeList::set_less):
+        (JSC::AVLTreeAbstractorForFreeList::get_greater):
+        (JSC::AVLTreeAbstractorForFreeList::set_greater):
+        (JSC::AVLTreeAbstractorForFreeList::get_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::set_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::null):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_key):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_node):
+        (JSC::AVLTreeAbstractorForFreeList::compare_node_node):
+        (JSC::sortFreeListEntriesByPointer):
+        (JSC::sortCommonSizedAllocations):
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::addToFreeList):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+            The new 2Gb heap class!
+        * jit/ExecutableAllocatorPosix.cpp:
+            Disable use of this implementation on x86_64.
+        * wtf/AVLTree.h:
+            Add missing variable initialization.
+        (WTF::::remove):
+
+2009-04-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix bug where the VM reentry cache would not correctly unroll the cached callframe
+
+        Fix a check that was intended to mark a cached call as invalid when the callframe could
+        not be constructed.  Instead it was just checking that there was a place to put the
+        exception.  This eventually results in a non-recoverable RegisterFile starvation.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call): add assertion to ensure we don't use a bad callframe
+
+2009-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        Simplify FEATURE_DEFINES definition
+
+        Reviewed by Darin Adler.
+
+        This moves FEATURE_DEFINES and its related ENABLE_FEATURE_NAME
+        variables to their own FeatureDefines.xcconfig file.  It also
+        extracts a new ENABLE_GEOLOCATION variable so that
+        FEATURE_DEFINES only needs to be defined once.
+
+        * Configurations/FeatureDefines.xcconfig: Added.
+        * Configurations/JavaScriptCore.xcconfig: Removed definition of
+        ENABLE_SVG_DOM_OBJC_BINDINGS and FEATURE_DEFINES.  Added include
+        of FeatureDefines.xcconfig.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added
+        FeatureDefines.xcconfig file.
+
+2009-04-08  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 25027: JavaScript parseInt wrong on negative numbers
+        <https://bugs.webkit.org/show_bug.cgi?id=25027>
+
+        When dealing with negative numbers, parseInt should use ceil instead of floor.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2009-04-16  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6744652> 32-bit to 64-bit: Javascript hash tables double in size
+
+        Remove perfect hash optimization which removes 1 MB of overhead on 32-bit and almost 2 MB on 64-bit.  Removing the optimization was not a regression on SunSpider and the acid 3 test still passes.
+
+        * create_hash_table:
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::HashTable::deleteTable):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::next):
+        (JSC::HashTable::entry):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getEnumerableNamesFromClassInfoTable):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix subtle error in optimised VM reentry in Array.sort
+
+        Basically to ensure we don't accidentally invalidate the cached callframe
+        we should be using the cached callframe rather than our own exec state.
+        While the old behaviour was wrong i have been unable to actually create a
+        test case where anything actually ends up going wrong.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::newCallFrame):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Optimise op_resolve_base
+
+        If we can statically find a property we are trying to resolve
+        the base of, the base is guaranteed to be the global object.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolveBase):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of read-write-modify operators
+
+        Implement cross scope optimisation for read-write-modify
+        operators, to avoid unnecessary calls to property resolve
+        helper functions.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitLoadGlobalObject):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        * bytecompiler/BytecodeGenerator.h:
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of remaining array enumeration functions
+
+        Make use of function entry cache for remaining Array enumeration functions.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of Array.sort
+
+        Cache the VM entry for Array.sort when using a JS comparison function.
+
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::sort):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25229: Need support for Array.prototype.reduceRight
+        <https://bugs.webkit.org/show_bug.cgi?id=25229>
+
+        Implement Array.reduceRight
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncReduceRight):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25227: Array.filter triggers an assertion when the target array shrinks while being filtered
+        <https://bugs.webkit.org/show_bug.cgi?id=25227>
+
+        We correct this simply by making the fast array path fall back on the slow path if
+        we ever discover the fast access is unsafe.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+
+2009-04-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25159: Support Array.prototype.reduce
+        <https://bugs.webkit.org/show_bug.cgi?id=25159>
+
+        Implement Array.prototype.reduce
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncReduce):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Move CallFrameClosure from inside the Interpreter class to its own file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CachedCall.h:
+        * interpreter/CallFrameClosure.h: Copied from JavaScriptCore/yarr/RegexJIT.h.
+        (JSC::CallFrameClosure::setArgument):
+        (JSC::CallFrameClosure::resetCallFrame):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+
+2009-04-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25202: Improve performance of repeated callbacks into the VM
+
+        Add the concept of a CachedCall to native code for use in Array
+        prototype and similar functions where a single callback function
+        is called repeatedly with the same number of arguments.
+
+        Used Array.prototype.filter as the test function and got a 50% win
+        over a naive non-caching specialised version.  This makes the native
+        implementation of Array.prototype.filter faster than the JS one once
+        more.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CachedCall.h: Added.
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        (JSC::CachedCall::setThis):
+        (JSC::CachedCall::setArgument):
+        (JSC::CachedCall::~CachedCall):
+           CachedCall is a wrapper that automates the calling and teardown
+           for a CallFrameClosure
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
+           Create the basic entry closure for a function
+        (JSC::Interpreter::execute):
+           A new ::execute method to enter the interpreter from a closure
+        (JSC::Interpreter::endRepeatCall):
+           Clear the entry closure
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::CallFrameClosure::setArgument):
+        (JSC::Interpreter::CallFrameClosure::resetCallFrame):
+           Helper functions to simplify setting up the closure's callframe
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the build.
+
+        Add the yarr headers (and only the headers) to the build, so that
+        RegExp.cpp can compile. The headers are ifdefed out with yarr
+        disabled, so we don't need anything else for now.
+
+        * GNUmakefile.am:
+
+2009-04-14  Adam Roben  <aroben@apple.com>
+
+        Remove support for profile-guided optimization on Windows
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Removed
+        the Release_PGO configuration. Also let VS re-order the source files
+        list.
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        * GNUmakefile.am:
+
+2009-04-14  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix when building minidom. Not reviewed.
+
+        Use C-style comment instead of C++ style since autotools builds
+        minidom using gcc and not g++.
+
+        * wtf/Platform.h:
+
+2009-04-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative build fix.
+
+        * runtime/RegExp.h:
+
+2009-04-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cap'n Geoff Garen.
+
+        Yarr!
+        (Yet another regex runtime).
+
+        Currently disabled by default since the interpreter, whilst awesomely
+        functional, has not been optimized and is likely slower than PCRE, and
+        the JIT, whilst faster than WREC, is presently incomplete and does not
+        fallback to using an interpreter for the cases it cannot handle.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::swap):
+        (JSC::MacroAssemblerX86Common::signExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch16):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmpw_im):
+        (JSC::X86Assembler::testw_rr):
+        (JSC::X86Assembler::X86InstructionFormatter::immediate16):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wtf/Platform.h:
+        * yarr: Added.
+        * yarr/RegexCompiler.cpp: Added.
+        (JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::Yarr::CharacterClassConstructor::reset):
+        (JSC::Yarr::CharacterClassConstructor::append):
+        (JSC::Yarr::CharacterClassConstructor::putChar):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeUpper):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeLower):
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+        (JSC::Yarr::CharacterClassConstructor::addSorted):
+        (JSC::Yarr::CharacterClassConstructor::addSortedRange):
+        (JSC::Yarr::newlineCreate):
+        (JSC::Yarr::digitsCreate):
+        (JSC::Yarr::spacesCreate):
+        (JSC::Yarr::wordcharCreate):
+        (JSC::Yarr::nondigitsCreate):
+        (JSC::Yarr::nonspacesCreate):
+        (JSC::Yarr::nonwordcharCreate):
+        (JSC::Yarr::RegexPatternConstructor::RegexPatternConstructor):
+        (JSC::Yarr::RegexPatternConstructor::~RegexPatternConstructor):
+        (JSC::Yarr::RegexPatternConstructor::reset):
+        (JSC::Yarr::RegexPatternConstructor::assertionBOL):
+        (JSC::Yarr::RegexPatternConstructor::assertionEOL):
+        (JSC::Yarr::RegexPatternConstructor::assertionWordBoundary):
+        (JSC::Yarr::RegexPatternConstructor::atomPatternCharacter):
+        (JSC::Yarr::RegexPatternConstructor::atomBuiltInCharacterClass):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassAtom):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassRange):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassBuiltIn):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassEnd):
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomParentheticalAssertionBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::copyDisjunction):
+        (JSC::Yarr::RegexPatternConstructor::copyTerm):
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        (JSC::Yarr::RegexPatternConstructor::disjunction):
+        (JSC::Yarr::RegexPatternConstructor::regexBegin):
+        (JSC::Yarr::RegexPatternConstructor::regexEnd):
+        (JSC::Yarr::RegexPatternConstructor::regexError):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        (JSC::Yarr::RegexPatternConstructor::setupDisjunctionOffsets):
+        (JSC::Yarr::RegexPatternConstructor::setupOffsets):
+        (JSC::Yarr::compileRegex):
+        * yarr/RegexCompiler.h: Added.
+        * yarr/RegexInterpreter.cpp: Added.
+        (JSC::Yarr::Interpreter::appendParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::DisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::restoreOutput):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::getDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::InputStream::InputStream):
+        (JSC::Yarr::Interpreter::InputStream::next):
+        (JSC::Yarr::Interpreter::InputStream::rewind):
+        (JSC::Yarr::Interpreter::InputStream::read):
+        (JSC::Yarr::Interpreter::InputStream::readChecked):
+        (JSC::Yarr::Interpreter::InputStream::reread):
+        (JSC::Yarr::Interpreter::InputStream::prev):
+        (JSC::Yarr::Interpreter::InputStream::getPos):
+        (JSC::Yarr::Interpreter::InputStream::setPos):
+        (JSC::Yarr::Interpreter::InputStream::atStart):
+        (JSC::Yarr::Interpreter::InputStream::atEnd):
+        (JSC::Yarr::Interpreter::InputStream::checkInput):
+        (JSC::Yarr::Interpreter::InputStream::uncheckInput):
+        (JSC::Yarr::Interpreter::testCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeCharacter):
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::tryConsumeCharacterClass):
+        (JSC::Yarr::Interpreter::checkCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::matchAssertionBOL):
+        (JSC::Yarr::Interpreter::matchAssertionEOL):
+        (JSC::Yarr::Interpreter::matchAssertionWordBoundary):
+        (JSC::Yarr::Interpreter::matchPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::matchCharacterClass):
+        (JSC::Yarr::Interpreter::backtrackCharacterClass):
+        (JSC::Yarr::Interpreter::matchBackReference):
+        (JSC::Yarr::Interpreter::backtrackBackReference):
+        (JSC::Yarr::Interpreter::recordParenthesesMatch):
+        (JSC::Yarr::Interpreter::resetMatches):
+        (JSC::Yarr::Interpreter::resetAssertionMatches):
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionOnceBegin):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionOnceEnd):
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::Interpreter::matchTerm):
+        (JSC::Yarr::Interpreter::backtrackTerm):
+        (JSC::Yarr::Interpreter::matchAlternative):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::matchNonZeroDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::ByteCompiler::ParenthesesStackEntry::ParenthesesStackEntry):
+        (JSC::Yarr::ByteCompiler::ByteCompiler):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::checkInput):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::popParenthesesStack):
+        (JSC::Yarr::ByteCompiler::dumpDisjunction):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::regexEnd):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        (JSC::Yarr::byteCompileRegex):
+        (JSC::Yarr::interpretRegex):
+        * yarr/RegexInterpreter.h: Added.
+        (JSC::Yarr::ByteTerm::):
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BOL):
+        (JSC::Yarr::ByteTerm::CheckInput):
+        (JSC::Yarr::ByteTerm::EOL):
+        (JSC::Yarr::ByteTerm::WordBoundary):
+        (JSC::Yarr::ByteTerm::BackReference):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+        (JSC::Yarr::ByteTerm::PatternEnd):
+        (JSC::Yarr::ByteTerm::invert):
+        (JSC::Yarr::ByteTerm::capture):
+        (JSC::Yarr::ByteDisjunction::ByteDisjunction):
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        (JSC::Yarr::BytecodePattern::~BytecodePattern):
+        * yarr/RegexJIT.cpp: Added.
+        (JSC::Yarr::RegexGenerator::optimizeAlternative):
+        (JSC::Yarr::RegexGenerator::matchCharacterClassRange):
+        (JSC::Yarr::RegexGenerator::matchCharacterClass):
+        (JSC::Yarr::RegexGenerator::jumpIfNoAvailableInput):
+        (JSC::Yarr::RegexGenerator::jumpIfAvailableInput):
+        (JSC::Yarr::RegexGenerator::checkInput):
+        (JSC::Yarr::RegexGenerator::atEndOfInput):
+        (JSC::Yarr::RegexGenerator::notAtEndOfInput):
+        (JSC::Yarr::RegexGenerator::jumpIfCharEquals):
+        (JSC::Yarr::RegexGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::RegexGenerator::readCharacter):
+        (JSC::Yarr::RegexGenerator::storeToFrame):
+        (JSC::Yarr::RegexGenerator::loadFromFrame):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::alternativeValid):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::nextAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::alternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::termValid):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::nextTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::term):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::lookaheadTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isSinglePatternCharacterLookaheadTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::inputOffset):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setBacktrackGenerated):
+        (JSC::Yarr::RegexGenerator::jumpToBacktrackCheckEmitPending):
+        (JSC::Yarr::RegexGenerator::genertateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::genertateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::matchAssertionWordchar):
+        (JSC::Yarr::RegexGenerator::genertateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingleDisjunctionOneAlternative):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::generate):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h: Added.
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        * yarr/RegexParser.h: Added.
+        (JSC::Yarr::):
+        (JSC::Yarr::Parser::):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::begin):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacterUnescaped):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::end):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::assertionWordBoundary):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBackReference):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::flush):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::):
+        (JSC::Yarr::Parser::Parser):
+        (JSC::Yarr::Parser::parseEscape):
+        (JSC::Yarr::Parser::parseAtomEscape):
+        (JSC::Yarr::Parser::parseCharacterClassEscape):
+        (JSC::Yarr::Parser::parseCharacterClass):
+        (JSC::Yarr::Parser::parseParenthesesBegin):
+        (JSC::Yarr::Parser::parseParenthesesEnd):
+        (JSC::Yarr::Parser::parseQuantifier):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        (JSC::Yarr::Parser::saveState):
+        (JSC::Yarr::Parser::restoreState):
+        (JSC::Yarr::Parser::atEndOfPattern):
+        (JSC::Yarr::Parser::peek):
+        (JSC::Yarr::Parser::peekIsDigit):
+        (JSC::Yarr::Parser::peekDigit):
+        (JSC::Yarr::Parser::consume):
+        (JSC::Yarr::Parser::consumeDigit):
+        (JSC::Yarr::Parser::consumeNumber):
+        (JSC::Yarr::Parser::consumeOctal):
+        (JSC::Yarr::Parser::tryConsume):
+        (JSC::Yarr::Parser::tryConsumeHex):
+        (JSC::Yarr::parse):
+        * yarr/RegexPattern.h: Added.
+        (JSC::Yarr::CharacterRange::CharacterRange):
+        (JSC::Yarr::):
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::BOL):
+        (JSC::Yarr::PatternTerm::EOL):
+        (JSC::Yarr::PatternTerm::WordBoundary):
+        (JSC::Yarr::PatternTerm::invert):
+        (JSC::Yarr::PatternTerm::capture):
+        (JSC::Yarr::PatternTerm::quantify):
+        (JSC::Yarr::PatternAlternative::PatternAlternative):
+        (JSC::Yarr::PatternAlternative::lastTerm):
+        (JSC::Yarr::PatternAlternative::removeLastTerm):
+        (JSC::Yarr::PatternDisjunction::PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::~PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::addNewAlternative):
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::~RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+        (JSC::Yarr::RegexPattern::containsIllegalBackReference):
+        (JSC::Yarr::RegexPattern::newlineCharacterClass):
+        (JSC::Yarr::RegexPattern::digitsCharacterClass):
+        (JSC::Yarr::RegexPattern::spacesCharacterClass):
+        (JSC::Yarr::RegexPattern::wordcharCharacterClass):
+        (JSC::Yarr::RegexPattern::nondigitsCharacterClass):
+        (JSC::Yarr::RegexPattern::nonspacesCharacterClass):
+        (JSC::Yarr::RegexPattern::nonwordcharCharacterClass):
+
+2009-04-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Missed code from last patch).
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+        (JSC::InternalFunction::calculatedDisplayName):
+        * runtime/InternalFunction.h:
+
+2009-04-13  Francisco Tolmasky  <francisco@280north.com>
+
+        Reviewed by Oliver Hunt.
+        
+        BUG 25171: It should be possible to manually set the name of an anonymous function
+        <https://bugs.webkit.org/show_bug.cgi?id=25171>
+
+        This change adds the displayName property to functions, which when set overrides the 
+        normal name when appearing in the console.
+
+        * profiler/Profiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp): Changed call to InternalFunction::name to InternalFunction::calculatedDisplayName
+        * runtime/CommonIdentifiers.h: Added displayName common identifier.
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName): Access to user settable displayName property
+        (JSC::InternalFunction::calculatedDisplayName): Returns displayName if it exists, if not then the natural name
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Disabled another JavaScriptCore test because it fails on Windows but
+        not Mac, so it makes the bots red.
+
+        * tests/mozilla/expected.html:
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Disabled two JavaScriptCore tests because they fail on Window or Mac but
+        not both, so they make the bots red.
+
+        * tests/mozilla/expected.html: Updated expected results.
+
+2009-04-09  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25091
+        The Android platform requires threads to be registered with the VM.
+        This patch implements this behaviour inside ThreadingPthreads.cpp.
+
+        * wtf/ThreadingPthreads.cpp: Add a level above threadEntryPoint that takes care of (un)registering threads with the VM.
+        (WTF::runThreadWithRegistration): register the thread and run entryPoint. Unregister the thread afterwards.
+        (WTF::createThreadInternal): call runThreadWithRegistration instead of entryPoint directly.
+
+2009-04-09  David Kilzer  <ddkilzer@apple.com>
+
+        Reinstating <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Rolled r42345 back in.  The build failure was caused by an
+        internal script which had not been updated the same way that
+        build-webkit was updated.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2009-04-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reverting <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings.
+        It broke Mac build, and I don't know how to fix it.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Checking for __GLIBCXX__ being bigger than some date is not enough
+        to get std::tr1, C++0x has to be in use too. Add another check for
+        __GXX_EXPERIMENTAL_CXX0X__.
+
+        * wtf/TypeTraits.h:
+
+2009-04-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix assertion failure in function.apply
+
+        The result of excess arguments to function.apply is irrelevant
+        so we don't need to provide a result register.  We were providing
+        temporary result register but not ref'ing it resulting in an
+        assertion failure.
+
+        * parser/Nodes.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2009-04-08  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Reviewed by Darin Adler and Maciej Stachowiak.
+
+        Introduce the ENABLE_SVG_DOM_OBJC_BINDINGS feature define so
+        that SVG DOM Objective-C bindings may be optionally disabled.
+
+        * Configurations/JavaScriptCore.xcconfig: Added
+        ENABLE_SVG_DOM_OBJC_BINDINGS variable and use it in
+        FEATURE_DEFINES.
+
+2009-04-08  Paul Pedriana <ppedriana@ea.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20422
+        Allow custom memory allocation control.
+        
+        * wtf/FastAllocBase.h:
+        New added file. Implements allocation base class.
+        * wtf/TypeTraits.h:
+        Augments existing type traits support as needed by FastAllocBase.
+        * wtf/FastMalloc.h:
+        Changed to support FastMalloc match validation.
+        * wtf/FastMalloc.cpp:
+        Changed to support FastMalloc match validation.
+        * wtf/Platform.h:
+        Added ENABLE_FAST_MALLOC_MATCH_VALIDATION; defaults to 0.
+        * GNUmakefile.am:
+        Updated to include added FastAllocBase.h.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Updated to include added FastAllocBase.h.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        Updated to include added FastAllocBase.h.
+
+2009-04-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve function.apply performance
+
+        Jump through a few hoops to improve performance of function.apply in the general case.
+
+        In the case of zero or one arguments, or if there are only two arguments and the
+        second is an array literal we treat function.apply as function.call.
+
+        Otherwise we use the new opcodes op_load_varargs and op_call_varargs to do the .apply call
+        without re-entering the virtual machine.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::emitLoadVarargs):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs):
+        * jit/JITStubs.h:
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::ArrayNode::isSimpleArray):
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::ApplyFunctionCallDotNode::):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToRegisters):
+        (JSC::Arguments::fillArgList):
+        * runtime/Arguments.h:
+        (JSC::Arguments::numProvidedArguments):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::copyToRegisters):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+
+2009-04-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25073
+        JavaScriptCore tests don't run if time zone is not PST
+
+        * API/tests/testapi.c:
+        (timeZoneIsPST): Added a function that checks whether the time zone is PST, using the same
+        method as functions in DateMath.cpp do for formatting the result.
+        (main): Skip date string format test if the time zone is not PST.
+
+2009-04-07  David Levin  <levin@chromium.org>
+
+        Reviewed by Sam Weinig and Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25039
+        UString refactoring to support UChar* sharing.
+
+        No change in sunspider perf.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::initializeUString):
+        (JSC::UString::BaseString::isShared):
+        Encapsulate the meaning behind the refcount == 1 checks because
+        this needs to do slightly more when sharing is added.
+        (JSC::concatenate):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        Make m_baseString part of a union to get rid of casts, but make it protected because
+        it is tricky to use it correctly since it is only valid when the Rep is not a BaseString.
+        The void* will be filled in when sharing is added.
+
+        Add constructors due to the making members protected and it make ensuring proper
+        initialization work better (like in SmallStringsStorage).
+        (JSC::UString::Rep::create):
+        (JSC::UString::Rep::Rep):
+        (JSC::UString::Rep::):
+        (JSC::UString::BaseString::BaseString):
+        (JSC::UString::Rep::setBaseString):
+        (JSC::UString::Rep::baseString):
+
+2009-04-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25033
+        dtoa.cpp segfaults with g++ 4.4.0
+
+        g++ 4.4.0 seems to be more strict about aliasing rules, so it
+        produces incorrect code if dtoa.cpp is compiled with
+        -fstrict-aliasing (it also emits a ton of warnings, so fair enough
+        I guess). The problem was that we were only casting variables to
+        union types in order to do type punning, but GCC and the C
+        standard require that we actually use a union to store the value.
+
+        This patch does just that, the code is mostly copied from the dtoa
+        version in GCC:
+        http://gcc.gnu.org/viewcvs/trunk/libjava/classpath/native/fdlibm/dtoa.c?view=markup.
+
+        * wtf/dtoa.cpp:
+        (WTF::ulp):
+        (WTF::b2d):
+        (WTF::ratio):
+        (WTF::hexnan):
+        (WTF::strtod):
+        (WTF::dtoa):
+
+2009-04-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for Win port. Build the assembler sources to get missing functions.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+        * wtf/Platform.h:
+
+2009-04-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/6744471> crash in GC due to uninitialized callFunction pointer
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData): Initialize
+        callFunction as we do the other data members that are used in the mark function.
+
+2009-04-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann
+
+        https://bugs.webkit.org/show_bug.cgi?id=24490
+
+        Implement WTF::ThreadSpecific in the Qt build using
+        QThreadStorage.
+
+        * wtf/ThreadSpecific.h:
+
+2009-04-01  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24990
+        Put SECTORDER_FLAGS into xcconfig files.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix non-AllInOneFile builds.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+
+2009-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of Function.prototype.call
+        <https://bugs.webkit.org/show_bug.cgi?id=24907>
+
+        Optimistically assume that expression.call(..) is going to be a call to
+        Function.prototype.call, and handle it specially to attempt to reduce the
+        degree of VM reentrancy.
+
+        When everything goes right this removes the vm reentry improving .call()
+        by around a factor of 10.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::CallFunctionCallDotNode::):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+
+2009-03-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 24884: Include strings.h for strcasecmp()
+        https://bugs.webkit.org/show_bug.cgi?id=24884
+
+        * runtime/DateMath.cpp: Reversed previous change including strings.h
+        * wtf/StringExtras.h: Include strings.h here is available
+
 2009-03-26  Adam Roben  <aroben@apple.com>
 
         Copy testapi.js to $WebKitOutputDir on Windows
diff --git a/JavaScriptCore/Configurations/Base.xcconfig b/JavaScriptCore/Configurations/Base.xcconfig
index b639dad..db89a7b 100644
--- a/JavaScriptCore/Configurations/Base.xcconfig
+++ b/JavaScriptCore/Configurations/Base.xcconfig
@@ -1,3 +1,26 @@
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
 DEBUG_INFORMATION_FORMAT = dwarf;
 GCC_C_LANGUAGE_STANDARD = gnu99;
 GCC_DEBUGGING_SYMBOLS = default;
@@ -5,9 +28,13 @@
 GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
-GCC_ENABLE_OBJC_GC = supported;
+GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(REAL_PLATFORM_NAME));
+GCC_ENABLE_OBJC_GC_iphoneos = NO;
+GCC_ENABLE_OBJC_GC_iphonesimulator = NO;
+GCC_ENABLE_OBJC_GC_macosx = supported;
 GCC_ENABLE_SYMBOL_SEPARATION = NO;
 GCC_FAST_OBJC_DISPATCH = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS = YES;
 GCC_INLINES_ARE_PRIVATE_EXTERN = YES;
 GCC_MODEL_TUNING = G5;
 GCC_OBJC_CALL_CXX_CDTORS = YES;
@@ -22,7 +49,7 @@
 GCC_WARN_NON_VIRTUAL_DESTRUCTOR = YES;
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 PREBINDING = NO;
-VALID_ARCHS = i386 ppc x86_64 ppc64;
+VALID_ARCHS = i386 ppc x86_64 ppc64 $(ARCHS_UNIVERSAL_IPHONE_OS);
 WARNING_CFLAGS = $(WARNING_CFLAGS_$(CURRENT_ARCH));
 WARNING_CFLAGS_BASE = -Wall -Wextra -Wcast-align -Wcast-qual -Wchar-subscripts -Wextra-tokens -Wformat=2 -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings;
 WARNING_CFLAGS_ = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
@@ -36,6 +63,8 @@
 
 REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
 REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
+REAL_PLATFORM_NAME_iphoneos = iphoneos;
+REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
 REAL_PLATFORM_NAME_macosx = macosx;
 
 
@@ -57,31 +86,23 @@
 DEAD_CODE_STRIPPING_normal = YES;
 DEAD_CODE_STRIPPING = $(DEAD_CODE_STRIPPING_$(CURRENT_VARIANT));
 
+SECTORDER_FLAGS = -sectorder __TEXT __text JavaScriptCore.order;
 
-GCC_VERSION = $(GCC_VERSION_$(XCODE_VERSION_ACTUAL));
+// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
+// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
+// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
+// XCODE_VERSION_ACTUAL for the full version number.
+GCC_VERSION = $(GCC_VERSION_$(XCODE_VERSION_MINOR));
+GCC_VERSION_ = $(GCC_VERSION_$(XCODE_VERSION_ACTUAL));
 GCC_VERSION_0310 = 4.2;
 
 
 // HAVE_DTRACE is disabled on Leopard due to <rdar://problem/5628149>
 HAVE_DTRACE = $(HAVE_DTRACE_$(REAL_PLATFORM_NAME));
+HAVE_DTRACE_iphoneos = 1;
+HAVE_DTRACE_iphonesimulator = 0;
 HAVE_DTRACE_macosx = $(HAVE_DTRACE_macosx_$(MAC_OS_X_VERSION_MAJOR));
 HAVE_DTRACE_macosx_ = $(HAVE_DTRACE_macosx_1040);
 HAVE_DTRACE_macosx_1040 = 0;
 HAVE_DTRACE_macosx_1050 = 0;
 HAVE_DTRACE_macosx_1060 = 1;
-
-
-// <rdar://problem/5488678>: Production builds on 10.4 PowerPC need to have debugging symbols disabled to prevent a huge STABS section being generated.
-//                           Xcode on 10.4 does not define MAC_OS_X_VERSION_MAJOR, so the default Mac OS X version is treated as 10.4.
-GCC_GENERATE_DEBUGGING_SYMBOLS = $(GCC_GENERATE_DEBUGGING_SYMBOLS_$(CURRENT_ARCH));
-GCC_GENERATE_DEBUGGING_SYMBOLS_i386 = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_x86_64 = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc64 = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc = $(GCC_GENERATE_DEBUGGING_SYMBOLS_$(CURRENT_ARCH)_$(CONFIGURATION));
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Debug = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Release = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Production = $(GCC_GENERATE_DEBUGGING_SYMBOLS_$(CURRENT_ARCH)_$(CONFIGURATION)_$(MAC_OS_X_VERSION_MAJOR));
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Production_ = NO;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Production_1040 = NO;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Production_1050 = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Production_1060 = YES;
diff --git a/JavaScriptCore/Configurations/DebugRelease.xcconfig b/JavaScriptCore/Configurations/DebugRelease.xcconfig
index a9c39aa..3b8651c 100644
--- a/JavaScriptCore/Configurations/DebugRelease.xcconfig
+++ b/JavaScriptCore/Configurations/DebugRelease.xcconfig
@@ -1,10 +1,36 @@
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
 #include "Base.xcconfig"
 
-ARCHS = $(ARCHS_$(MAC_OS_X_VERSION_MAJOR));
-ARCHS_ = $(ARCHS_1040);
-ARCHS_1040 = $(NATIVE_ARCH);
-ARCHS_1050 = $(NATIVE_ARCH);
-ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS = $(ARCHS_$(REAL_PLATFORM_NAME));
+ARCHS_iphoneos = $(ARCHS_UNIVERSAL_IPHONE_OS);
+ARCHS_iphonesimulator = $(NATIVE_ARCH);
+ARCHS_macosx = $(ARCHS_macosx_$(MAC_OS_X_VERSION_MAJOR));
+ARCHS_macosx_ = $(ARCHS_macosx_1040);
+ARCHS_macosx_1040 = $(NATIVE_ARCH);
+ARCHS_macosx_1050 = $(NATIVE_ARCH);
+ARCHS_macosx_1060 = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
@@ -15,3 +41,5 @@
 MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
 
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = YES;
+
+SECTORDER_FLAGS = ; 
diff --git a/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
new file mode 100644
index 0000000..95fb0c6
--- /dev/null
+++ b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -0,0 +1,52 @@
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+// The contents of this file must be kept in sync with FeatureDefines.xcconfig in JavaScriptCore,
+// WebCore and WebKit.  Also the default values of the ENABLE_FEATURE_NAME macros in build-webkit
+// should match the values below, but they do not need to be in the same order.
+
+// Set any ENABLE_FEATURE_NAME macro to an empty string to disable that feature.
+
+ENABLE_3D_RENDERING = ;
+ENABLE_CHANNEL_MESSAGING = ;
+ENABLE_DATABASE = ENABLE_DATABASE;
+ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
+ENABLE_FILTERS = ;
+ENABLE_GEOLOCATION = ;
+ENABLE_ICONDATABASE = ENABLE_ICONDATABASE;
+ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
+ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
+ENABLE_SVG = ENABLE_SVG;
+ENABLE_SVG_ANIMATION = ENABLE_SVG_ANIMATION;
+ENABLE_SVG_AS_IMAGE = ENABLE_SVG_AS_IMAGE;
+ENABLE_SVG_DOM_OBJC_BINDINGS = ENABLE_SVG_DOM_OBJC_BINDINGS;
+ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
+ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
+ENABLE_SVG_USE = ENABLE_SVG_USE;
+ENABLE_VIDEO = ENABLE_VIDEO;
+ENABLE_WML = ;
+ENABLE_WORKERS = ENABLE_WORKERS;
+ENABLE_XPATH = ENABLE_XPATH;
+ENABLE_XSLT = ENABLE_XSLT;
+
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DOM_STORAGE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/JavaScriptCore/Configurations/JavaScriptCore.xcconfig b/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
index 0976c16..f8d6c2c 100644
--- a/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
+++ b/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
@@ -1,26 +1,48 @@
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+#include "FeatureDefines.xcconfig"
 #include "Version.xcconfig"
+
 EXPORTED_SYMBOLS_FILE = $(EXPORTED_SYMBOLS_FILE_$(CURRENT_ARCH));
 EXPORTED_SYMBOLS_FILE_ = JavaScriptCore.exp;
+EXPORTED_SYMBOLS_FILE_armv6 = JavaScriptCore.exp;
+EXPORTED_SYMBOLS_FILE_armv7 = JavaScriptCore.exp;
 EXPORTED_SYMBOLS_FILE_i386 = JavaScriptCore.exp;
 EXPORTED_SYMBOLS_FILE_ppc = JavaScriptCore.exp;
 EXPORTED_SYMBOLS_FILE_ppc64 = $(BUILT_PRODUCTS_DIR)/DerivedSources/JavaScriptCore/JavaScriptCore.LP64.exp;
 EXPORTED_SYMBOLS_FILE_x86_64 = $(BUILT_PRODUCTS_DIR)/DerivedSources/JavaScriptCore/JavaScriptCore.LP64.exp;
-OTHER_LDFLAGS = -lobjc -sub_library libobjc -Wl,-Y,3;
+OTHER_LDFLAGS_BASE = -lobjc -Wl,-Y,3;
+OTHER_LDFLAGS = $(OTHER_LDFLAGS_$(REAL_PLATFORM_NAME));
+OTHER_LDFLAGS_iphoneos = $(OTHER_LDFLAGS_BASE);
+OTHER_LDFLAGS_iphonesimulator = $(OTHER_LDFLAGS_iphoneos);
+OTHER_LDFLAGS_macosx = $(OTHER_LDFLAGS_BASE) -sub_library libobjc -framework CoreServices;
 GCC_PREFIX_HEADER = JavaScriptCorePrefix.h;
 HEADER_SEARCH_PATHS = "${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore" $(HEADER_SEARCH_PATHS);
 INFOPLIST_FILE = Info.plist;
 INSTALL_PATH = $(SYSTEM_LIBRARY_DIR)/Frameworks;
 PRODUCT_NAME = JavaScriptCore;
 
-// This needs to be kept sorted, and in sync with FEATURE_DEFINES in WebCore.xcconfig, WebKit.xcconfig and
-// the default settings of build-webkit to prevent needless rebuilding when using both Xcode and build-webkit.
-FEATURE_DEFINES = $(FEATURE_DEFINES_$(MAC_OS_X_VERSION_MAJOR));
-FEATURE_DEFINES_BASE = ENABLE_DATABASE ENABLE_DOM_STORAGE ENABLE_ICONDATABASE ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT;
-FEATURE_DEFINES_ = $(FEATURE_DEFINES_1040);
-FEATURE_DEFINES_1040 = $(FEATURE_DEFINES_BASE);
-FEATURE_DEFINES_1050 = $(FEATURE_DEFINES_BASE);
-FEATURE_DEFINES_1060 = $(FEATURE_DEFINES_BASE) ENABLE_GEOLOCATION;
-
 OTHER_CFLAGS = $(OTHER_CFLAGS_$(CONFIGURATION)_$(CURRENT_VARIANT));
 OTHER_CFLAGS_Release_normal = $(OTHER_CFLAGS_normal_$(XCODE_VERSION_ACTUAL));
 OTHER_CFLAGS_Production_normal = $(OTHER_CFLAGS_normal_$(XCODE_VERSION_ACTUAL));
diff --git a/JavaScriptCore/Configurations/Version.xcconfig b/JavaScriptCore/Configurations/Version.xcconfig
index ab0aa9b..cc515f2 100644
--- a/JavaScriptCore/Configurations/Version.xcconfig
+++ b/JavaScriptCore/Configurations/Version.xcconfig
@@ -1,5 +1,28 @@
-MAJOR_VERSION = 530;
-MINOR_VERSION = 5;
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+MAJOR_VERSION = 531;
+MINOR_VERSION = 0;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/JavaScriptCore/GNUmakefile.am b/JavaScriptCore/GNUmakefile.am
index b9feada..e51a23f 100644
--- a/JavaScriptCore/GNUmakefile.am
+++ b/JavaScriptCore/GNUmakefile.am
@@ -1,4 +1,5 @@
 javascriptcore_cppflags += \
+	-I$(srcdir)/JavaScriptCore \
 	-I$(srcdir)/JavaScriptCore/API \
 	-I$(srcdir)/JavaScriptCore/ForwardingHeaders \
 	-I$(srcdir)/JavaScriptCore/interpreter \
@@ -13,6 +14,7 @@
 	-I$(srcdir)/JavaScriptCore/jit \
 	-I$(srcdir)/JavaScriptCore/assembler \
 	-I$(srcdir)/JavaScriptCore/wtf/unicode \
+	-I$(srcdir)/JavaScriptCore/yarr \
 	-I$(top_builddir)/JavaScriptCore/pcre \
 	-I$(top_builddir)/JavaScriptCore/parser \
 	-I$(top_builddir)/JavaScriptCore/runtime
@@ -75,16 +77,17 @@
 	JavaScriptCore/JavaScriptCorePrefix.h \
 	JavaScriptCore/jit/ExecutableAllocator.h \
 	JavaScriptCore/jit/JIT.cpp \
+	JavaScriptCore/jit/JITOpcodes.cpp \
 	JavaScriptCore/jit/JITCall.cpp \
 	JavaScriptCore/jit/JITCode.h \
 	JavaScriptCore/jit/JITPropertyAccess.cpp \
 	JavaScriptCore/jit/JITArithmetic.cpp \
 	JavaScriptCore/jit/ExecutableAllocator.cpp \
-	JavaScriptCore/jit/ExecutableAllocatorPosix.cpp \
 	JavaScriptCore/jit/JIT.h \
 	JavaScriptCore/jit/JITInlineMethods.h \
 	JavaScriptCore/jit/JITStubs.cpp \
 	JavaScriptCore/jit/JITStubs.h \
+	JavaScriptCore/jit/JITStubCall.h \
 	JavaScriptCore/bytecode/StructureStubInfo.cpp \
 	JavaScriptCore/bytecode/StructureStubInfo.h \
 	JavaScriptCore/bytecode/CodeBlock.cpp \
@@ -136,7 +139,9 @@
 	JavaScriptCore/assembler/AbstractMacroAssembler.h \
 	JavaScriptCore/assembler/AssemblerBuffer.h \
 	JavaScriptCore/assembler/MacroAssembler.h \
+	JavaScriptCore/assembler/MacroAssemblerCodeRef.h \
 	JavaScriptCore/assembler/MacroAssemblerX86.h \
+	JavaScriptCore/assembler/MacroAssemblerX86_64.h \
 	JavaScriptCore/assembler/MacroAssemblerX86Common.h \
 	JavaScriptCore/os-win32/stdbool.h \
 	JavaScriptCore/os-win32/stdint.h \
@@ -161,8 +166,10 @@
 	JavaScriptCore/profiler/Profiler.h \
 	JavaScriptCore/profiler/TreeProfile.cpp \
 	JavaScriptCore/profiler/TreeProfile.h \
+	JavaScriptCore/interpreter/CachedCall.h \
 	JavaScriptCore/interpreter/CallFrame.cpp \
 	JavaScriptCore/interpreter/CallFrame.h \
+	JavaScriptCore/interpreter/CallFrameClosure.h \
 	JavaScriptCore/runtime/TimeoutChecker.cpp \
 	JavaScriptCore/runtime/TimeoutChecker.h \
 	JavaScriptCore/runtime/InitializeThreading.cpp \
@@ -177,6 +184,8 @@
 	JavaScriptCore/runtime/JSNotAnObject.h \
 	JavaScriptCore/runtime/JSPropertyNameIterator.cpp \
 	JavaScriptCore/runtime/JSPropertyNameIterator.h \
+	JavaScriptCore/runtime/LiteralParser.cpp \
+	JavaScriptCore/runtime/LiteralParser.h \
 	JavaScriptCore/runtime/SmallStrings.cpp \
 	JavaScriptCore/runtime/SmallStrings.h \
 	JavaScriptCore/runtime/Structure.cpp \
@@ -185,19 +194,13 @@
 	JavaScriptCore/runtime/StructureChain.h \
 	JavaScriptCore/runtime/StructureTransitionTable.h \
 	JavaScriptCore/runtime/TypeInfo.h \
-	JavaScriptCore/wrec/CharacterClass.cpp \
 	JavaScriptCore/wrec/CharacterClass.h \
-	JavaScriptCore/wrec/CharacterClassConstructor.cpp \
 	JavaScriptCore/wrec/CharacterClassConstructor.h \
 	JavaScriptCore/wrec/Escapes.h \
 	JavaScriptCore/wrec/Quantifier.h \
-	JavaScriptCore/wrec/WREC.cpp \
 	JavaScriptCore/wrec/WREC.h \
-	JavaScriptCore/wrec/WRECFunctors.cpp \
 	JavaScriptCore/wrec/WRECFunctors.h \
-	JavaScriptCore/wrec/WRECGenerator.cpp \
 	JavaScriptCore/wrec/WRECGenerator.h \
-	JavaScriptCore/wrec/WRECParser.cpp \
 	JavaScriptCore/wrec/WRECParser.h \
 	JavaScriptCore/wtf/ASCIICType.h \
 	JavaScriptCore/wtf/AVLTree.h \
@@ -206,8 +209,12 @@
 	JavaScriptCore/wtf/Assertions.h \
 	JavaScriptCore/wtf/ByteArray.cpp \
 	JavaScriptCore/wtf/ByteArray.h \
+	JavaScriptCore/wtf/CrossThreadRefCounted.h \
+	JavaScriptCore/wtf/OwnFastMallocPtr.h \
 	JavaScriptCore/wtf/CurrentTime.cpp \
 	JavaScriptCore/wtf/CurrentTime.h \
+	JavaScriptCore/wtf/DateMath.cpp \
+	JavaScriptCore/wtf/DateMath.h \
 	JavaScriptCore/wtf/Deque.h \
 	JavaScriptCore/wtf/DisallowCType.h \
 	JavaScriptCore/wtf/Forward.h \
@@ -233,6 +240,8 @@
 	JavaScriptCore/wtf/NotFound.h \
 	JavaScriptCore/wtf/OwnArrayPtr.h \
 	JavaScriptCore/wtf/OwnPtr.h \
+	JavaScriptCore/wtf/OwnPtrCommon.h \
+	JavaScriptCore/wtf/PassOwnPtr.h \
 	JavaScriptCore/wtf/PassRefPtr.h \
 	JavaScriptCore/wtf/Platform.h \
 	JavaScriptCore/wtf/PtrAndFlags.h \
@@ -253,7 +262,6 @@
 	JavaScriptCore/wtf/ThreadSpecific.h \
 	JavaScriptCore/wtf/Threading.h \
 	JavaScriptCore/wtf/Threading.cpp \
-	JavaScriptCore/wtf/ThreadingGtk.cpp \
 	JavaScriptCore/wtf/ThreadingPthreads.cpp \
 	JavaScriptCore/wtf/TypeTraits.cpp \
 	JavaScriptCore/wtf/TypeTraits.h \
@@ -261,13 +269,51 @@
 	JavaScriptCore/wtf/Vector.h \
 	JavaScriptCore/wtf/VectorTraits.h \
 	JavaScriptCore/wtf/gtk/MainThreadGtk.cpp \
+	JavaScriptCore/wtf/gtk/ThreadingGtk.cpp \
 	JavaScriptCore/wtf/unicode/Collator.h \
 	JavaScriptCore/wtf/unicode/CollatorDefault.cpp \
 	JavaScriptCore/wtf/unicode/UTF8.cpp \
 	JavaScriptCore/wtf/unicode/UTF8.h \
-	JavaScriptCore/wtf/unicode/Unicode.h \
+	JavaScriptCore/wtf/unicode/Unicode.h
+
+if TARGET_WIN32
+javascriptcore_sources += \
+	JavaScriptCore/wtf/ThreadSpecificWin.cpp \
+	JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+else
+javascriptcore_sources += \
+	JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+endif
+
+# ----
+# icu unicode backend
+# ----
+if USE_ICU_UNICODE
+javascriptcore_sources += \
 	JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp \
 	JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
+endif # USE_ICU_UNICODE
+
+# ----
+# glib unicode backend
+# ----
+if USE_GLIB_UNICODE
+javascriptcore_sources += \
+	JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h \
+	JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp \
+	JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h
+endif
+
+javascriptcore_sources += \
+	JavaScriptCore/wtf/VMTags.h \
+	JavaScriptCore/yarr/RegexCompiler.cpp \
+	JavaScriptCore/yarr/RegexCompiler.h \
+	JavaScriptCore/yarr/RegexInterpreter.cpp \
+	JavaScriptCore/yarr/RegexInterpreter.h \
+	JavaScriptCore/yarr/RegexJIT.cpp \
+	JavaScriptCore/yarr/RegexJIT.h \
+	JavaScriptCore/yarr/RegexParser.h \
+	JavaScriptCore/yarr/RegexPattern.h
 
 # Debug build
 if ENABLE_DEBUG
@@ -285,11 +331,14 @@
 	JavaScriptCore/debugger/Debugger.h \
 	JavaScriptCore/parser/Lexer.cpp \
 	JavaScriptCore/parser/Lexer.h \
+	JavaScriptCore/parser/NodeConstructors.h \
 	JavaScriptCore/parser/NodeInfo.h \
 	JavaScriptCore/parser/Nodes.cpp \
 	JavaScriptCore/parser/Nodes.h \
 	JavaScriptCore/parser/Parser.cpp \
 	JavaScriptCore/parser/Parser.h \
+	JavaScriptCore/parser/ParserArena.cpp \
+	JavaScriptCore/parser/ParserArena.h \
 	JavaScriptCore/parser/ResultType.h \
 	JavaScriptCore/parser/SourceCode.h \
 	JavaScriptCore/parser/SourceProvider.h \
@@ -321,10 +370,10 @@
 	JavaScriptCore/runtime/ConstructData.h \
 	JavaScriptCore/runtime/DateConstructor.cpp \
 	JavaScriptCore/runtime/DateConstructor.h \
+	JavaScriptCore/runtime/DateConversion.cpp \
+	JavaScriptCore/runtime/DateConversion.h \
 	JavaScriptCore/runtime/DateInstance.cpp \
 	JavaScriptCore/runtime/DateInstance.h \
-	JavaScriptCore/runtime/DateMath.cpp \
-	JavaScriptCore/runtime/DateMath.h \
 	JavaScriptCore/runtime/DatePrototype.cpp \
 	JavaScriptCore/runtime/DatePrototype.h \
 	JavaScriptCore/runtime/Error.cpp \
@@ -385,6 +434,7 @@
 	JavaScriptCore/runtime/NativeErrorConstructor.h \
 	JavaScriptCore/runtime/NativeErrorPrototype.cpp \
 	JavaScriptCore/runtime/NativeErrorPrototype.h \
+	JavaScriptCore/runtime/NativeFunctionWrapper.h \
 	JavaScriptCore/runtime/NumberConstructor.cpp \
 	JavaScriptCore/runtime/NumberConstructor.h \
 	JavaScriptCore/runtime/NumberObject.cpp \
@@ -429,6 +479,7 @@
 	JavaScriptCore/runtime/Tracing.h \
 	JavaScriptCore/runtime/UString.cpp \
 	JavaScriptCore/runtime/UString.h \
+	JavaScriptCore/wtf/FastAllocBase.h \
 	JavaScriptCore/wtf/FastMalloc.cpp \
 	JavaScriptCore/wtf/FastMalloc.h \
 	JavaScriptCore/wtf/MallocZoneSupport.h \
@@ -443,7 +494,9 @@
 	DerivedSources/Grammar.h
 
 javascriptcore_sources += \
-	JavaScriptCore/AllInOneFile.cpp
+	JavaScriptCore/AllInOneFile.cpp \
+	JavaScriptCore/parser/ParserArena.cpp \
+	JavaScriptCore/parser/ParserArena.h
 endif # END ENABLE_DEBUG
 
 DerivedSources/Grammar.h: DerivedSources/Grammar.cpp;
@@ -488,7 +541,6 @@
 Programs_minidom_CFLAGS = \
 	-ansi \
 	-fno-strict-aliasing \
-	-O2 \
 	$(global_cflags) \
 	$(GLOBALDEPS_CFLAGS)
 
@@ -497,6 +549,10 @@
 	 -lm \
 	 -lstdc++
 
+Programs_minidom_LDFLAGS = \
+	-no-install \
+	-no-fast-install
+
 # jsc
 Programs_jsc_SOURCES = \
 	JavaScriptCore/jsc.cpp
@@ -507,7 +563,6 @@
 
 Programs_jsc_CXXFLAGS = \
 	-fno-strict-aliasing \
-	-O2 \
 	$(global_cxxflags) \
 	$(global_cflags) \
 	$(GLOBALDEPS_CFLAGS) \
diff --git a/JavaScriptCore/JavaScriptCore.exp b/JavaScriptCore/JavaScriptCore.exp
index 993ebe7..82786b0 100644
--- a/JavaScriptCore/JavaScriptCore.exp
+++ b/JavaScriptCore/JavaScriptCore.exp
@@ -96,16 +96,18 @@
 __ZN3JSC10Identifier3addEPNS_9ExecStateEPKc
 __ZN3JSC10Identifier5equalEPKNS_7UString3RepEPKc
 __ZN3JSC10JSFunction4infoE
+__ZN3JSC10JSFunctionC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RKNS_7ArgListEE
 __ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeE
 __ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKc
 __ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringE
-__ZN3JSC11JSByteArray15createStructureENS_10JSValuePtrE
+__ZN3JSC11JSByteArray15createStructureENS_7JSValueE
 __ZN3JSC11JSByteArrayC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
 __ZN3JSC11JSImmediate12nonInlineNaNEv
-__ZN3JSC11JSImmediate8toObjectENS_10JSValuePtrEPNS_9ExecStateE
-__ZN3JSC11JSImmediate8toStringENS_10JSValuePtrE
-__ZN3JSC11JSImmediate9prototypeENS_10JSValuePtrEPNS_9ExecStateE
-__ZN3JSC11ProfileNode4sortEPFbRKN3WTF6RefPtrIS0_EES5_E
+__ZN3JSC11JSImmediate12toThisObjectENS_7JSValueEPNS_9ExecStateE
+__ZN3JSC11JSImmediate8toObjectENS_7JSValueEPNS_9ExecStateE
+__ZN3JSC11JSImmediate8toStringENS_7JSValueE
+__ZN3JSC11JSImmediate9prototypeENS_7JSValueEPNS_9ExecStateE
+__ZN3JSC11ParserArena5resetEv
 __ZN3JSC11checkSyntaxEPNS_9ExecStateERKNS_10SourceCodeE
 __ZN3JSC12DateInstance4infoE
 __ZN3JSC12JSGlobalData10ClientDataD2Ev
@@ -113,58 +115,62 @@
 __ZN3JSC12JSGlobalData14sharedInstanceEv
 __ZN3JSC12JSGlobalData6createEb
 __ZN3JSC12JSGlobalDataD1Ev
-__ZN3JSC12SamplingTool13notifyOfScopeEPNS_9ScopeNodeE
 __ZN3JSC12SamplingTool4dumpEPNS_9ExecStateE
-__ZN3JSC12SamplingTool4stopEv
-__ZN3JSC12SamplingTool5startEj
+__ZN3JSC12SamplingTool5setupEv
 __ZN3JSC12SmallStrings17createEmptyStringEPNS_12JSGlobalDataE
 __ZN3JSC12StringObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC12StringObject14toThisJSStringEPNS_9ExecStateE
 __ZN3JSC12StringObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
 __ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
 __ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSC12StringObject3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
+__ZN3JSC12StringObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
 __ZN3JSC12StringObject4infoE
 __ZN3JSC12StringObjectC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEERKNS_7UStringE
 __ZN3JSC12jsNumberCellEPNS_9ExecStateEd
+__ZN3JSC13SamplingFlags4stopEv
+__ZN3JSC13SamplingFlags5startEv
+__ZN3JSC13SamplingFlags7s_flagsE
 __ZN3JSC13StatementNode6setLocEii
 __ZN3JSC13jsOwnedStringEPNS_12JSGlobalDataERKNS_7UStringE
 __ZN3JSC14JSGlobalObject10globalExecEv
 __ZN3JSC14JSGlobalObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
 __ZN3JSC14JSGlobalObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
-__ZN3JSC14JSGlobalObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrEj
-__ZN3JSC14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
+__ZN3JSC14JSGlobalObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
+__ZN3JSC14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE  
 __ZN3JSC14JSGlobalObject4initEPNS_8JSObjectE
 __ZN3JSC14JSGlobalObject4markEv
 __ZN3JSC14JSGlobalObjectD2Ev
 __ZN3JSC14JSGlobalObjectnwEmPNS_12JSGlobalDataE
+__ZN3JSC14SamplingThread4stopEv
+__ZN3JSC14SamplingThread5startEj
 __ZN3JSC14TimeoutChecker5resetEv
 __ZN3JSC14constructArrayEPNS_9ExecStateERKNS_7ArgListE
 __ZN3JSC15JSWrapperObject4markEv
 __ZN3JSC15toInt32SlowCaseEdRb
 __ZN3JSC16FunctionBodyNode13finishParsingEPNS_10IdentifierEm
 __ZN3JSC16FunctionBodyNode14copyParametersEv
-__ZN3JSC16FunctionBodyNode6createEPNS_12JSGlobalDataEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS6_INS5_6RefPtrINS_12FuncDeclNodeEEELm0EEERKNS_10SourceCodeEji
+__ZN3JSC16FunctionBodyNode6createEPNS_12JSGlobalDataEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS6_IPNS_12FuncDeclNodeELm0EEERKNS_10SourceCodeEji
 __ZN3JSC16InternalFunction4infoE
 __ZN3JSC16InternalFunction4nameEPNS_12JSGlobalDataE
 __ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEN3WTF10PassRefPtrINS_9StructureEEERKNS_10IdentifierE
 __ZN3JSC16JSVariableObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC16JSVariableObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZN3JSC16ParserRefCounted3refEv
-__ZN3JSC16ParserRefCounted5derefEv
 __ZN3JSC16toUInt32SlowCaseEdRb
 __ZN3JSC17BytecodeGenerator21setDumpsGeneratedCodeEb
 __ZN3JSC17PropertyNameArray3addEPNS_7UString3RepE
-__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_10JSValuePtrES2_PNS_8JSObjectESA_RKNS_7ArgListEE
-__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEiRKNS_10IdentifierEPFNS_10JSValuePtrES2_PNS_8JSObjectES6_RKNS_7ArgListEE
+__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RKNS_7ArgListEE
+__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectES6_RKNS_7ArgListEE
 __ZN3JSC17constructFunctionEPNS_9ExecStateERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
 __ZN3JSC18DebuggerActivationC1EPNS_8JSObjectE
+__ZN3JSC18jsAPIMangledNumberEPNS_9ExecStateEd
 __ZN3JSC19constructEmptyArrayEPNS_9ExecStateE
 __ZN3JSC19initializeThreadingEv
+__ZN3JSC20MarkedArgumentBuffer10slowAppendENS_7JSValueE
 __ZN3JSC20constructEmptyObjectEPNS_9ExecStateE
-__ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
+__ZN3JSC23AbstractSamplingCounter4dumpEv
+__ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSC23setUpStaticFunctionSlotEPNS_9ExecStateEPKNS_9HashEntryEPNS_8JSObjectERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC25evaluateInGlobalCallFrameERKNS_7UStringERNS_10JSValuePtrEPNS_14JSGlobalObjectE
+__ZN3JSC25evaluateInGlobalCallFrameERKNS_7UStringERNS_7JSValueEPNS_14JSGlobalObjectE
 __ZN3JSC4Heap11objectCountEv
 __ZN3JSC4Heap14allocateNumberEm
 __ZN3JSC4Heap14primaryHeapEndEv
@@ -175,14 +181,14 @@
 __ZN3JSC4Heap24setGCProtectNeedsLockingEv
 __ZN3JSC4Heap25protectedObjectTypeCountsEv
 __ZN3JSC4Heap26protectedGlobalObjectCountEv
-__ZN3JSC4Heap4heapENS_10JSValuePtrE
+__ZN3JSC4Heap4heapENS_7JSValueE  
 __ZN3JSC4Heap6isBusyEv
 __ZN3JSC4Heap7collectEv
 __ZN3JSC4Heap7destroyEv
-__ZN3JSC4Heap7protectENS_10JSValuePtrE
+__ZN3JSC4Heap7protectENS_7JSValueE
 __ZN3JSC4Heap8allocateEm
-__ZN3JSC4Heap9unprotectENS_10JSValuePtrE
-__ZN3JSC4callEPNS_9ExecStateENS_10JSValuePtrENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE
+__ZN3JSC4Heap9unprotectENS_7JSValueE
+__ZN3JSC4callEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE
 __ZN3JSC5equalEPKNS_7UString3RepES3_
 __ZN3JSC6JSCell11getCallDataERNS_8CallDataE
 __ZN3JSC6JSCell11getJSNumberEv
@@ -192,8 +198,8 @@
 __ZN3JSC6JSCell16getConstructDataERNS_13ConstructDataE
 __ZN3JSC6JSCell18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
 __ZN3JSC6JSCell18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSC6JSCell3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSC6JSCell3putEPNS_9ExecStateEjNS_10JSValuePtrE
+__ZN3JSC6JSCell3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC6JSCell3putEPNS_9ExecStateEjNS_7JSValueE  
 __ZN3JSC6JSCell9getObjectEv
 __ZN3JSC6JSCellnwEmPNS_9ExecStateE
 __ZN3JSC6JSLock12DropAllLocksC1EPNS_9ExecStateE
@@ -204,7 +210,6 @@
 __ZN3JSC6JSLock9lockCountEv
 __ZN3JSC6JSLockC1EPNS_9ExecStateE
 __ZN3JSC6Parser5parseEPNS_12JSGlobalDataEPiPNS_7UStringE
-__ZN3JSC7ArgList10slowAppendENS_10JSValuePtrE
 __ZN3JSC7CStringD1Ev
 __ZN3JSC7CStringaSERKS0_
 __ZN3JSC7JSArray4infoE
@@ -212,8 +217,11 @@
 __ZN3JSC7Profile5focusEPKNS_11ProfileNodeE
 __ZN3JSC7Profile7excludeEPKNS_11ProfileNodeE
 __ZN3JSC7Profile7forEachEMNS_11ProfileNodeEFvvE
+__ZN3JSC7UString10BaseString12sharedBufferEv
+__ZN3JSC7UString3Rep11computeHashEPKci
 __ZN3JSC7UString3Rep11computeHashEPKti
 __ZN3JSC7UString3Rep14nullBaseStringE
+__ZN3JSC7UString3Rep6createEPtiN3WTF10PassRefPtrINS3_21CrossThreadRefCountedINS3_16OwnFastMallocPtrItEEEEEE
 __ZN3JSC7UString3Rep7destroyEv
 __ZN3JSC7UString4fromEi
 __ZN3JSC7UString4fromEj
@@ -226,7 +234,7 @@
 __ZN3JSC8Debugger6detachEPNS_14JSGlobalObjectE
 __ZN3JSC8DebuggerC2Ev
 __ZN3JSC8DebuggerD2Ev
-__ZN3JSC8JSObject11hasInstanceEPNS_9ExecStateENS_10JSValuePtrES3_
+__ZN3JSC8JSObject11hasInstanceEPNS_9ExecStateENS_7JSValueES3_
 __ZN3JSC8JSObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
 __ZN3JSC8JSObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
 __ZN3JSC8JSObject12lookupGetterEPNS_9ExecStateERKNS_10IdentifierE
@@ -237,35 +245,37 @@
 __ZN3JSC8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
 __ZN3JSC8JSObject17createInheritorIDEv
 __ZN3JSC8JSObject17putDirectFunctionEPNS_9ExecStateEPNS_16InternalFunctionEj
-__ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrEj
-__ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateEjNS_10JSValuePtrEj
+__ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
+__ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEjbRNS_15PutPropertySlotE
+__ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateEjNS_7JSValueEj
 __ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSC8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRNS_10JSValuePtrE
-__ZN3JSC8JSObject22fillGetterPropertySlotERNS_12PropertySlotEPNS_10JSValuePtrE
+__ZN3JSC8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZN3JSC8JSObject22fillGetterPropertySlotERNS_12PropertySlotEPNS_7JSValueE  
 __ZN3JSC8JSObject23allocatePropertyStorageEmm
-__ZN3JSC8JSObject3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSC8JSObject3putEPNS_9ExecStateEjNS_10JSValuePtrE
+__ZN3JSC8JSObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JSObject3putEPNS_9ExecStateEjNS_7JSValueE  
 __ZN3JSC8JSObject4markEv
 __ZN3JSC8Profiler13stopProfilingEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC8Profiler14startProfilingEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC8Profiler8profilerEv
-__ZN3JSC8evaluateEPNS_9ExecStateERNS_10ScopeChainERKNS_10SourceCodeENS_10JSValuePtrE
+__ZN3JSC8evaluateEPNS_9ExecStateERNS_10ScopeChainERKNS_10SourceCodeENS_7JSValueE
 __ZN3JSC8jsStringEPNS_12JSGlobalDataERKNS_7UStringE
 __ZN3JSC9CodeBlockD1Ev
 __ZN3JSC9CodeBlockD2Ev
 __ZN3JSC9Structure17stopIgnoringLeaksEv
 __ZN3JSC9Structure18startIgnoringLeaksEv
-__ZN3JSC9Structure21addPropertyTransitionEPS0_RKNS_10IdentifierEjRm
+__ZN3JSC9Structure21addPropertyTransitionEPS0_RKNS_10IdentifierEjPNS_6JSCellERm
 __ZN3JSC9Structure22materializePropertyMapEv
-__ZN3JSC9Structure25changePrototypeTransitionEPS0_NS_10JSValuePtrE
-__ZN3JSC9Structure28addPropertyWithoutTransitionERKNS_10IdentifierEj
-__ZN3JSC9Structure3getERKNS_10IdentifierERj
-__ZN3JSC9Structure40addPropertyTransitionToExistingStructureEPS0_RKNS_10IdentifierEjRm
-__ZN3JSC9StructureC1ENS_10JSValuePtrERKNS_8TypeInfoE
+__ZN3JSC9Structure25changePrototypeTransitionEPS0_NS_7JSValueE
+__ZN3JSC9Structure27despecifyDictionaryFunctionERKNS_10IdentifierE
+__ZN3JSC9Structure27despecifyFunctionTransitionEPS0_RKNS_10IdentifierE
+__ZN3JSC9Structure28addPropertyWithoutTransitionERKNS_10IdentifierEjPNS_6JSCellE
+__ZN3JSC9Structure3getEPKNS_7UString3RepERjRPNS_6JSCellE
+__ZN3JSC9Structure40addPropertyTransitionToExistingStructureEPS0_RKNS_10IdentifierEjPNS_6JSCellERm
+__ZN3JSC9StructureC1ENS_7JSValueERKNS_8TypeInfoE
 __ZN3JSC9StructureD1Ev
-__ZN3JSC9constructEPNS_9ExecStateENS_10JSValuePtrENS_13ConstructTypeERKNS_13ConstructDataERKNS_7ArgListE
+__ZN3JSC9constructEPNS_9ExecStateENS_7JSValueENS_13ConstructTypeERKNS_13ConstructDataERKNS_7ArgListE
 __ZN3JSCeqERKNS_7UStringEPKc
-__ZN3JSCeqERKNS_7UStringES2_
 __ZN3JSCgtERKNS_7UStringES2_
 __ZN3JSCltERKNS_7UStringES2_
 __ZN3WTF10fastCallocEmm
@@ -278,6 +288,7 @@
 __ZN3WTF12isMainThreadEv
 __ZN3WTF12randomNumberEv
 __ZN3WTF13currentThreadEv
+__ZN3WTF37parseDateFromNullTerminatedCharactersEPKc
 __ZN3WTF13tryFastCallocEmm
 __ZN3WTF15ThreadCondition4waitERNS_5MutexE
 __ZN3WTF15ThreadCondition6signalEv
@@ -312,9 +323,8 @@
 __ZN3WTF8CollatorD1Ev
 __ZN3WTF8fastFreeEPv
 __ZN3WTF9ByteArray6createEm
-__ZNK3JSC10JSValuePtr9toIntegerEPNS_9ExecStateE
 __ZNK3JSC11Interpreter14retrieveCallerEPNS_9ExecStateEPNS_16InternalFunctionE
-__ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_10JSValuePtrE
+__ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_7JSValueE  
 __ZNK3JSC12DateInstance7getTimeERdRi
 __ZNK3JSC12StringObject12toThisStringEPNS_9ExecStateE
 __ZNK3JSC12StringObject8toStringEPNS_9ExecStateE
@@ -324,8 +334,9 @@
 __ZNK3JSC16JSVariableObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
 __ZNK3JSC17DebuggerCallFrame10thisObjectEv
 __ZNK3JSC17DebuggerCallFrame12functionNameEv
+__ZNK3JSC17DebuggerCallFrame22calculatedFunctionNameEv
 __ZNK3JSC17DebuggerCallFrame4typeEv
-__ZNK3JSC17DebuggerCallFrame8evaluateERKNS_7UStringERNS_10JSValuePtrE
+__ZNK3JSC17DebuggerCallFrame8evaluateERKNS_7UStringERNS_7JSValueE
 __ZNK3JSC4Heap10statisticsEv
 __ZNK3JSC6JSCell12toThisObjectEPNS_9ExecStateE
 __ZNK3JSC6JSCell12toThisStringEPNS_9ExecStateE
@@ -337,6 +348,7 @@
 __ZNK3JSC6JSCell9getStringEv
 __ZNK3JSC6JSCell9getUInt32ERj
 __ZNK3JSC7ArgList8getSliceEiRS0_
+__ZNK3JSC7JSValue9toIntegerEPNS_9ExecStateE
 __ZNK3JSC7UString10UTF8StringEb
 __ZNK3JSC7UString14toStrictUInt32EPb
 __ZNK3JSC7UString5asciiEv
diff --git a/JavaScriptCore/JavaScriptCore.order b/JavaScriptCore/JavaScriptCore.order
index 05c300c..bb56e98 100644
--- a/JavaScriptCore/JavaScriptCore.order
+++ b/JavaScriptCore/JavaScriptCore.order
@@ -1,18 +1,20 @@
-__ZN3WTF19initializeThreadingEv
 __ZN3WTF10fastMallocEm
 __ZN3WTF10fastMallocILb1EEEPvm
 __ZN3WTF20TCMalloc_ThreadCache10InitModuleEv
 __ZN3WTFL15InitSizeClassesEv
 __Z20TCMalloc_SystemAllocmPmm
+__ZN3WTFL13MetaDataAllocEm
 __ZN3WTF20TCMalloc_ThreadCache22CreateCacheIfNecessaryEv
 __ZN3WTF25TCMalloc_Central_FreeList11RemoveRangeEPPvS2_Pi
 __ZN3WTF25TCMalloc_Central_FreeList18FetchFromSpansSafeEv
 __ZN3WTF17TCMalloc_PageHeap10AllocLargeEm
 __ZN3WTF17TCMalloc_PageHeap8GrowHeapEm
-__ZN3WTFL13MetaDataAllocEm
+__ZN3WTF19initializeThreadingEv
 __ZN3WTF20initializeMainThreadEv
 __ZN3WTF5MutexC1Ev
+__ZN3WTF28initializeMainThreadPlatformEv
 __ZN3WTF36lockAtomicallyInitializedStaticMutexEv
+__ZN3WTF8fastFreeEPv
 __ZN3WTF38unlockAtomicallyInitializedStaticMutexEv
 __ZN3JSC19initializeThreadingEv
 __ZN3JSCL23initializeThreadingOnceEv
@@ -22,95 +24,128 @@
 __ZN3WTF15ThreadConditionC1Ev
 __ZN3WTF5Mutex4lockEv
 __ZN3WTF5Mutex6unlockEv
-__ZN3WTF8fastFreeEPv
 __ZN3WTF12createThreadEPFPvS0_ES0_PKc
 __ZN3WTF20createThreadInternalEPFPvS0_ES0_PKc
 __ZN3WTFL35establishIdentifierForPthreadHandleERP17_opaque_pthread_t
+__ZN3WTF9HashTableIjSt4pairIjP17_opaque_pthread_tENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTrai
 __ZN3WTFL16threadEntryPointEPv
-__ZN3WTF7HashMapIjP17_opaque_pthread_tNS_7IntHashIjEENS_10HashTraitsIjEENS5_IS2_EEE3addERKjRKS2_
-__ZN3WTF9HashTableIjSt4pairIjP17_opaque_pthread_tENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSA_IS3_EEEESB_E6rehashEi
 __ZN3WTF16fastZeroedMallocEm
+__ZN3WTF21setThreadNameInternalEPKc
 __ZN3WTF5MutexD1Ev
 __ZN3WTF25TCMalloc_Central_FreeList11InsertRangeEPvS1_i
 __ZN3WTF25TCMalloc_Central_FreeList18ReleaseListToSpansEPv
+__ZN3WTF12isMainThreadEv
 __ZN3WTF14FastMallocZone4sizeEP14_malloc_zone_tPKv
 __ZN3WTF13currentThreadEv
 __ZN3WTF16callOnMainThreadEPFvPvES0_
-__ZN3WTF6VectorINS_19FunctionWithContextELm0EE14expandCapacityEm
+__ZN3WTF5DequeINS_19FunctionWithContextEE14expandCapacityEv
 __ZN3WTF37scheduleDispatchFunctionsOnMainThreadEv
 __ZN3WTF15ThreadCondition4waitERNS_5MutexE
 __ZN3JSC8DebuggerC2Ev
 __ZN3WTF6strtodEPKcPPc
 __ZN3WTF15ThreadCondition6signalEv
+__ZN3WTF15ThreadCondition9timedWaitERNS_5MutexEd
 __ZN3WTF15ThreadCondition9broadcastEv
+-[WTFMainThreadCaller call]
+__ZN3WTF31dispatchFunctionsFromMainThreadEv
+__ZN3WTF14FastMallocZone9forceLockEP14_malloc_zone_t
+__ZN3WTF11fastReallocEPvm
+__ZN3WTF11fastReallocILb1EEEPvS1_m
+__ZN3JSC7UStringC1EPKti
+__ZN3JSC7UStringC2EPKti
 __ZN3JSC12JSGlobalData12createLeakedEv
-__ZN3JSC12JSGlobalDataC2Eb
-__ZN3JSC11InterpreterC1Ev
-__ZN3JSC11Interpreter14privateExecuteENS0_13ExecutionFlagEPNS_12RegisterFileEPNS_9ExecStateEPNS_10JSValuePtrE
-__ZN3WTF7HashMapIPvN3JSC8OpcodeIDENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS6_IS3_EEE3addERKS1_RKS3_
-__ZN3WTF9HashTableIPvSt4pairIS1_N3JSC8OpcodeIDEENS_18PairFirstExtractorIS5_EENS_7PtrHashIS1_EENS_14PairHashTraitsINS_10HashTraitsIS1_EENSB_IS4_EEEESC_E6expandEv
-__ZN3JSC9StructureC1ENS_10JSValuePtrERKNS_8TypeInfoE
+__ZN3JSC9Structure18startIgnoringLeaksEv
+__ZN3JSC7VPtrSetC2Ev
+__ZN3JSC9StructureC1ENS_7JSValueERKNS_8TypeInfoE
 __ZN3JSC7JSArrayC1EN3WTF10PassRefPtrINS_9StructureEEE
-__ZN3JSC7JSArrayD0Ev
+__ZN3JSC7JSArrayD1Ev
+__ZN3JSC7JSArrayD2Ev
 __ZN3WTF10RefCountedIN3JSC9StructureEE5derefEv
 __ZN3JSC9StructureD1Ev
-__ZN3JSC11JSByteArray15createStructureENS_10JSValuePtrE
+__ZN3JSC9StructureD2Ev
+__ZN3JSC11JSByteArray15createStructureENS_7JSValueE
+__ZN3JSC11JSByteArrayD1Ev
+__ZN3JSC8JSStringD1Ev
+__ZN3JSC10JSFunctionD1Ev
+__ZN3JSC10JSFunctionD2Ev
+__ZN3JSC8JSObjectD2Ev
+__ZN3JSC12JSGlobalDataC2EbRKNS_7VPtrSetE
 __ZN3JSC21createIdentifierTableEv
 __ZN3JSC17CommonIdentifiersC1EPNS_12JSGlobalDataE
+__ZN3JSC17CommonIdentifiersC2EPNS_12JSGlobalDataE
 __ZN3JSC10Identifier3addEPNS_12JSGlobalDataEPKc
-__ZN3WTF9HashTableIPKcSt4pairIS2_NS_6RefPtrIN3JSC7UString3RepEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSF_IS8_EEEESG_E4findIS2_NS_22IdentityHashTranslatorIS2_S9_SD_EEEENS_17HashTableIteratorIS2_S9_SB_SD_SI_SG_EERKT_
+__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addIPKcNS1_17CStringTranslatorEEESt4pairINS_24HashT
 __ZN3WTF9HashTableIPN3JSC7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7StrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashEi
-__ZN3WTF9HashTableIPKcSt4pairIS2_NS_6RefPtrIN3JSC7UString3RepEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSF_IS8_EEEESG_E6expandEv
-__ZN3WTF9HashTableIPN3JSC7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7StrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEENS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EERKT_
+__ZN3WTF9HashTableIPKcSt4pairIS2_NS_6RefPtrIN3JSC7UString3RepEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS2_EENS_14PairHashTra
+__ZN3WTF6RefPtrIN3JSC7UString3RepEED1Ev
 __ZN3JSC12SmallStringsC1Ev
-__ZN3JSC5LexerC1EPNS_12JSGlobalDataE
-__ZN3JSC4HeapC1EPNS_12JSGlobalDataE
 __ZN3JSC19ExecutableAllocator17intializePageSizeEv
 __ZN3JSC14ExecutablePool11systemAllocEm
+__ZN3JSC5LexerC1EPNS_12JSGlobalDataE
+__ZN3JSC5LexerC2EPNS_12JSGlobalDataE
+__ZN3JSC11InterpreterC1Ev
+__ZN3JSC11InterpreterC2Ev
+__ZN3JSC11Interpreter14privateExecuteENS0_13ExecutionFlagEPNS_12RegisterFileEPNS_9ExecStateEPNS_7JSValueE
+__ZN3WTF7HashMapIPvN3JSC8OpcodeIDENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS6_IS3_EEE3addERKS1_RKS3_
+__ZN3WTF9HashTableIPvSt4pairIS1_N3JSC8OpcodeIDEENS_18PairFirstExtractorIS5_EENS_7PtrHashIS1_EENS_14PairHashTraitsINS_10HashTrai
+__ZN3JSC8JITStubsC1EPNS_12JSGlobalDataE
+__ZN3JSC3JITC1EPNS_12JSGlobalDataEPNS_9CodeBlockE
+__ZN3JSC3JITC2EPNS_12JSGlobalDataEPNS_9CodeBlockE
+__ZN3JSC3JIT35privateCompileCTIMachineTrampolinesEPN3WTF6RefPtrINS_14ExecutablePoolEEEPNS_12JSGlobalDataEPPvS9_S9_S9_S9_S9_
+__ZN3JSC12X86Assembler23X86InstructionFormatter11oneByteOp64ENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC12X86Assembler3jCCENS0_9ConditionE
+__ZN3JSC23MacroAssemblerX86Common4moveENS_22AbstractMacroAssemblerINS_12X86AssemblerEE6ImmPtrENS_3X8610RegisterIDE
+__ZN3JSC12X86Assembler23X86InstructionFormatter11oneByteOp64ENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDEi
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC15AssemblerBuffer11ensureSpaceEi
+__ZN3JSC20MacroAssemblerX86_6413branchTestPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAsse
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDENS_3X8610RegisterIDE
+__ZN3JSC20MacroAssemblerX86_644callEv
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDEi
+__ZN3JSC3JIT32compileOpCallInitializeCallFrameEv
+__ZN3JSC12X86Assembler23X86InstructionFormatter11memoryModRMEiNS_3X8610RegisterIDEi
+__ZN3JSC20MacroAssemblerX86_6421makeTailRecursiveCallENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpE
+__ZN3JSC14TimeoutCheckerC1Ev
+__ZN3JSC4HeapC1EPNS_12JSGlobalDataE
 __ZN3JSC27startProfilerServerIfNeededEv
 +[ProfilerServer sharedProfileServer]
 -[ProfilerServer init]
-__ZN3JSC11Interpreter10initializeEPNS_12JSGlobalDataE
-__ZN3JSC3JITC1EPNS_12JSGlobalDataEPNS_9CodeBlockE
-__ZN3JSC3JIT35privateCompileCTIMachineTrampolinesEv
-__ZN3JSC15AssemblerBuffer11ensureSpaceEi
-__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDEi
-__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDE
-__ZN3JSC14MacroAssembler4pokeENS_3X8610RegisterIDEi
-__ZN3JSC3JIT32compileOpCallInitializeCallFrameEv
-__ZN3JSC14MacroAssembler5jnz32ENS_3X8610RegisterIDENS0_5Imm32E
-__ZN3WTF11fastReallocEPvm
-__ZN3WTF11fastReallocILb1EEEPvS1_m
+__ZN3JSC9Structure17stopIgnoringLeaksEv
 __ZN3JSC4Heap8allocateEm
 __ZN3JSCL13allocateBlockILNS_8HeapTypeE0EEEPNS_14CollectorBlockEv
+__ZN3JSC4Heap4heapENS_7JSValueE
+__ZN3JSC4Heap7protectENS_7JSValueE
+__ZN3WTF7HashMapIPN3JSC6JSCellEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN3WTF9HashTableIPN3JSC6JSCellESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraits
 __ZN3JSC14JSGlobalObjectnwEmPNS_12JSGlobalDataE
 __ZN3JSC14JSGlobalObject4initEPNS_8JSObjectE
-__ZN3JSC14JSGlobalObject5resetENS_10JSValuePtrE
+__ZN3JSC14JSGlobalObject5resetENS_7JSValueE
 __ZN3JSC4Heap12heapAllocateILNS_8HeapTypeE0EEEPvm
-__ZN3JSC17FunctionPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEE
 __ZN3JSC8jsStringEPNS_12JSGlobalDataERKNS_7UStringE
 __ZN3JSC12SmallStrings17createEmptyStringEPNS_12JSGlobalDataE
 __ZN3JSC7UStringC1EPKc
 __ZN3JSCL9createRepEPKc
-__ZN3JSC8JSObject9putDirectERKNS_10IdentifierENS_10JSValuePtrEjbRNS_15PutPropertySlotE
+__ZN3JSC8JSObject9putDirectERKNS_10IdentifierENS_7JSValueEjbRNS_15PutPropertySlotE
 __ZN3JSC9Structure40addPropertyTransitionToExistingStructureEPS0_RKNS_10IdentifierEjRm
 __ZN3JSC9Structure3getERKNS_10IdentifierERj
 __ZN3JSC9Structure21addPropertyTransitionEPS0_RKNS_10IdentifierEjRm
 __ZN3JSC9Structure3putERKNS_10IdentifierEj
+__ZN3JSC8JSObject26putDirectWithoutTransitionERKNS_10IdentifierENS_7JSValueEj
 __ZN3JSC9Structure28addPropertyWithoutTransitionERKNS_10IdentifierEj
-__ZN3JSC17FunctionPrototype21addFunctionPropertiesEPNS_9ExecStateEPNS_9StructureE
-__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_10JSValuePtrES2_PNS_8JSObjectESA_RKNS_7ArgListEE
+__ZN3JSC17FunctionPrototype21addFunctionPropertiesEPNS_9ExecStateEPNS_9StructureEPPNS_10JSFunctionES7_
+__ZN3JSC10JSFunctionC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RK
+__ZN3JSC12JSGlobalData17createNativeThunkEv
+__ZN3JSC16FunctionBodyNode17createNativeThunkEPNS_12JSGlobalDataE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC21ParserArenaRefCountedEEELm0EE15reserveCapacityEm
+__ZN3JSC11ParserArena5resetEv
 __ZN3JSC8JSObject34putDirectFunctionWithoutTransitionEPNS_9ExecStateEPNS_16InternalFunctionEj
 __ZN3JSC15ObjectPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
 __ZN3JSC9Structure26rehashPropertyMapHashTableEj
 __ZN3JSC15StringPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEE
 __ZN3JSC16BooleanPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
 __ZN3JSC15NumberPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
-__ZN3JSC12jsNumberCellEPNS_9ExecStateEd
-__ZN3JSCL13allocateBlockILNS_8HeapTypeE1EEEPNS_14CollectorBlockEv
 __ZN3JSC15RegExpPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
 __ZN3JSC14ErrorPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
-__ZN3WTF6RefPtrIN3JSC7UString3RepEED1Ev
 __ZN3JSC20NativeErrorPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEERKNS_7UStringES9_
 __ZN3JSC17ObjectConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_15ObjectPrototypeE
 __ZN3JSC19FunctionConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_17FunctionPrototypeE
@@ -132,512 +167,1105 @@
 __ZN3WTF7HashSetIPN3JSC7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
 __ZN3JSC10MathObjectC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEE
 __ZN3JSC12SmallStrings24singleCharacterStringRepEh
-__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS2_16SymbolTableEntryENS2_17IdentifierRepHashENS_10HashTraitsIS5_EENS2_26SymbolTableIndexHashTraitsEE3addEPS4_RKS6_
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS2_16SymbolTableEntryEENS_18PairFirstExtractorIS8_EENS2_17IdentifierRepHashENS_14PairHashTraitsINS_10HashTraitsIS5_EENS2_26SymbolTableIndexHashTraitsEEESE_E6rehashEi
-__ZN3JSC9Structure25changePrototypeTransitionEPS0_NS_10JSValuePtrE
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS2_16SymbolTableEntryENS2_17IdentifierRepHashENS_10HashTraitsIS5_EENS2_26Symbo
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS2_16SymbolTableEntryEENS_18PairFirstExtractorIS8_EENS2_17Identif
+__ZN3JSC17PrototypeFunctionC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjec
+__ZN3JSC9Structure25changePrototypeTransitionEPS0_NS_7JSValueE
 __ZN3JSC9Structure17copyPropertyTableEv
-__ZN3JSC14JSGlobalObject14setTimeoutTimeEj
 __ZN3JSC14JSGlobalObject10globalExecEv
 __ZN3JSC10Identifier3addEPNS_9ExecStateEPKc
-__ZN3JSC4Heap4heapENS_10JSValuePtrE
-__ZN3JSC4Heap7protectENS_10JSValuePtrE
-__ZN3WTF7HashMapIPN3JSC6JSCellEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
-__ZN3WTF9HashTableIPN3JSC6JSCellESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E6rehashEi
+__ZN3JSC4Heap9unprotectENS_7JSValueE
 __ZN3JSC6JSCellnwEmPNS_9ExecStateE
-__ZN3JSC14JSGlobalObject17startTimeoutCheckEv
-__ZN3JSC11Interpreter17resetTimeoutCheckEv
-__ZN3JSC8evaluateEPNS_9ExecStateERNS_10ScopeChainERKNS_10SourceCodeENS_10JSValuePtrE
+__ZN3JSC14TimeoutChecker5resetEv
+__ZN3JSC8evaluateEPNS_9ExecStateERNS_10ScopeChainERKNS_10SourceCodeENS_7JSValueE
 __ZN3JSC6JSLock4lockEb
 __ZN3JSC6Parser5parseINS_11ProgramNodeEEEN3WTF10PassRefPtrIT_EEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPiPNS_7UStringE
 __ZN3JSC6Parser5parseEPNS_12JSGlobalDataEPiPNS_7UStringE
 __ZN3JSC7UStringaSEPKc
 __Z10jscyyparsePv
 __ZN3JSC5Lexer3lexEPvS1_
-__ZN3WTF6VectorItLm0EE15reserveCapacityEm
-__ZN3WTF6VectorItLm0EE6appendItEEvRKT_
 __ZN3JSC10Identifier3addEPNS_12JSGlobalDataEPKti
-__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addIPKcNS1_17CStringTranslatorEEESt4pairINS_24HashTableIteratorAdapterINS_9HashTableIS4_S4_NS_17IdentityExtractorIS4_EES6_S8_S8_EES4_EEbERKT_
+__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addINS1_11UCharBufferENS1_21UCharBufferTranslatorEE
+__ZN3JSC15SegmentedVectorINS_10IdentifierELm64EE6appendIS1_EEvRKT_
 __ZNK3JSC9HashTable11createTableEPNS_12JSGlobalDataE
-__ZN3WTF7HashSetIPN3JSC16ParserRefCountedENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN3JSC16ParserRefCountedES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
-__ZN3JSC16ParserRefCountedC2EPNS_12JSGlobalDataE
-__ZN3JSC16ParserRefCounted3refEv
-__ZL20makeFunctionCallNodePvN3JSC8NodeInfoIPNS0_14ExpressionNodeEEENS1_IPNS0_13ArgumentsNodeEEEiii
-__ZNK3JSC15DotAccessorNode10isLocationEv
-__ZNK3JSC14ExpressionNode13isResolveNodeEv
-__ZNK3JSC14ExpressionNode21isBracketAccessorNodeEv
-__ZN3WTF7HashMapIPN3JSC16ParserRefCountedEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
-__ZN3WTF9HashTableIPN3JSC16ParserRefCountedESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E6rehashEi
-__ZN3JSC14SourceElements6appendEN3WTF10PassRefPtrINS_13StatementNodeEEE
+__ZN3JSC20ParserArenaDeletablenwEmPNS_12JSGlobalDataE
+__ZN3WTF6VectorIPN3JSC20ParserArenaDeletableELm0EE15reserveCapacityEm
+__ZN3JSC5Lexer10sourceCodeEiii
+__ZN3JSC16FunctionBodyNode13finishParsingERKNS_10SourceCodeEPNS_13ParameterNodeE
+__ZN3WTF6VectorIN3JSC10IdentifierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC12FuncDeclNodeELm0EE14expandCapacityEm
+__ZN3JSC14SourceElements6appendEPNS_13StatementNodeE
 __ZNK3JSC13StatementNode16isEmptyStatementEv
-__ZN3JSC6Parser16didFinishParsingEPNS_14SourceElementsEPNS_20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEEEPNS3_INS5_INS4_6RefPtrINS_12FuncDeclNodeEEELm0EEEEEjii
+__ZN3WTF6VectorIPN3JSC13StatementNodeELm0EE14expandCapacityEm
+__ZL20makeFunctionCallNodePvN3JSC8NodeInfoIPNS0_14ExpressionNodeEEENS1_IPNS0_13ArgumentsNodeEEEiii
+__ZNK3JSC11ResolveNode10isLocationEv
+__ZNK3JSC11ResolveNode13isResolveNodeEv
+__ZN3JSC5Lexer7record8Ei
+__ZN3JSC5Lexer10scanRegExpEv
+__ZN3JSC7UStringC2ERKN3WTF6VectorItLm0EEE
+__ZN3JSC7UString3Rep7destroyEv
 __ZN3JSC5Lexer5clearEv
+__ZN3JSC10Identifier6removeEPNS_7UString3RepE
 __ZN3WTF6VectorIN3JSC10IdentifierELm64EE14shrinkCapacityEm
-__ZN3WTF15deleteAllValuesIPN3JSC16ParserRefCountedEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EESA_EEEEvRT0_
-__ZN3JSC15DotAccessorNodeD1Ev
-__ZN3JSC12NodeReleaser15releaseAllNodesEPNS_16ParserRefCountedE
-__ZN3JSC15DotAccessorNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC12NodeReleaser5adoptEN3WTF10PassRefPtrINS_16ParserRefCountedEEE
-__ZN3JSC16ParserRefCounted9hasOneRefEv
-__ZN3JSC16ParserRefCounted5derefEv
-__ZN3JSC9ScopeNodeC2EPNS_12JSGlobalDataERKNS_10SourceCodeEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS9_INS8_6RefPtrINS_12FuncDeclNodeEEELm0EEEji
-__ZN3WTF6VectorINS_6RefPtrIN3JSC13StatementNodeEEELm0EE14shrinkCapacityEm
-__ZN3JSC14SourceElementsD1Ev
+__ZN3JSC9ScopeNodeC2EPNS_12JSGlobalDataERKNS_10SourceCodeEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPN
+__ZN3WTF6VectorIPN3JSC13StatementNodeELm0EE14shrinkCapacityEm
+__ZN3JSC11ParserArena10removeLastEv
 __ZNK3JSC8JSObject8toObjectEPNS_9ExecStateE
-__ZN3JSC11Interpreter7executeEPNS_11ProgramNodeEPNS_9ExecStateEPNS_14ScopeChainNodeEPNS_8JSObjectEPNS_10JSValuePtrE
+__ZN3JSC11Interpreter7executeEPNS_11ProgramNodeEPNS_9ExecStateEPNS_14ScopeChainNodeEPNS_8JSObjectEPNS_7JSValueE
 __ZN3JSC11ProgramNode16generateBytecodeEPNS_14ScopeChainNodeE
-__ZN3JSC9CodeBlockC1EPNS_9ScopeNodeENS_8CodeTypeEN3WTF10PassRefPtrINS_14SourceProviderEEEj
+__ZN3JSC9CodeBlockC2EPNS_9ScopeNodeENS_8CodeTypeEN3WTF10PassRefPtrINS_14SourceProviderEEEj
 __ZN3WTF7HashSetIPN3JSC16ProgramCodeBlockENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
 __ZN3WTF9HashTableIPN3JSC16ProgramCodeBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
-__ZN3JSC17BytecodeGeneratorC2EPNS_11ProgramNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3RepEEENS_16SymbolTableEntryENS_17IdentifierRepHashENS9_10HashTraitsISE_EENS_26SymbolTableIndexHashTraitsEEEPNS_16ProgramCodeBlockE
+__ZN3JSC17BytecodeGeneratorC2EPNS_11ProgramNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3RepEEEN
 __ZN3WTF6VectorIN3JSC11InstructionELm0EE14expandCapacityEm
 __ZN3JSC9Structure22toDictionaryTransitionEPS0_
-__ZN3JSC17BytecodeGenerator11newRegisterEv
-__ZN3JSC9Structure24fromDictionaryTransitionEPS0_
-__ZN3JSC17BytecodeGenerator8generateEv
-__ZN3JSC11ProgramNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator13emitDebugHookENS_11DebugHookIDEii
-__ZN3JSC17BytecodeGenerator11addConstantENS_10JSValuePtrE
-__ZN3WTF9HashTableIPN3JSC23JSValueEncodedAsPointerESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS1_17BytecodeGenerator17JSValueHashTraitsENS_10HashTraitsIjEEEESC_E6expandEv
-__ZN3WTF6VectorIN3JSC8RegisterELm0EE14expandCapacityEm
-__ZNK3JSC13StatementNode6isLoopEv
-__ZN3JSC17BytecodeGenerator8emitNodeEPNS_10RegisterIDEPNS_4NodeE
-__ZN3WTF6VectorIN3JSC8LineInfoELm0EE14expandCapacityEm
-__ZN3JSC17ExprStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC19FunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC11ResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator11registerForERKNS_10IdentifierE
-__ZN3WTF6VectorIN3JSC19ExpressionRangeInfoELm0EE14expandCapacityEm
-__ZN3JSC17BytecodeGenerator11emitGetByIdEPNS_10RegisterIDES2_RKNS_10IdentifierE
-__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE14expandCapacityEm
-__ZN3JSC17BytecodeGenerator11addConstantERKNS_10IdentifierE
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_iENS_18PairFirstExtractorIS7_EENS2_17IdentifierRepHashENS_14PairHashTraitsINS_10HashTraitsIS5_EENS2_17BytecodeGenerator28IdentifierMapIndexHashTraitsEEESD_E6expandEv
-__ZN3WTF6VectorIN3JSC10IdentifierELm0EE14expandCapacityEm
-__ZN3JSC17BytecodeGenerator8emitCallENS_8OpcodeIDEPNS_10RegisterIDES3_S3_PNS_13ArgumentsNodeEjjj
-__ZN3WTF6VectorIN3JSC12CallLinkInfoELm0EE14expandCapacityEm
-__ZN3JSC9CodeBlock11shrinkToFitEv
-__ZN3WTF6VectorIN3JSC11InstructionELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIN3JSC17GlobalResolveInfoELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIPN3JSC12CallLinkInfoELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIN3JSC10IdentifierELm0EE14shrinkCapacityEm
-__ZN3JSC17ExprStatementNodeD1Ev
-__ZN3JSC19FunctionCallDotNodeD1Ev
-__ZN3JSC19FunctionCallDotNode12releaseNodesERNS_12NodeReleaserE
-__ZN3WTF6VectorINS_6RefPtrIN3JSC16ParserRefCountedEEELm0EE14expandCapacityEm
-__ZN3JSC16ParserRefCounted12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC13ArgumentsNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11ResolveNodeD1Ev
-__ZN3JSC13ArgumentsNodeD1Ev
-__ZN3JSC14JSGlobalObject13copyGlobalsToERNS_12RegisterFileE
-__ZN3JSC3JIT14privateCompileEv
-__ZN3JSC3JIT22privateCompileMainPassEv
-__ZN3JSC3JIT21compileGetByIdHotPathEiiPNS_10IdentifierEj
-__ZN3WTF6VectorIN3JSC13SlowCaseEntryELm0EE14expandCapacityEm
-__ZN3JSC3JIT13compileOpCallENS_8OpcodeIDEPNS_11InstructionEj
-__ZN3WTF6VectorIN3JSC10CallRecordELm0EE14expandCapacityEm
-__ZN3JSC3JIT22privateCompileLinkPassEv
-__ZN3JSC3JIT23privateCompileSlowCasesEv
-__ZN3JSC3JIT22compileGetByIdSlowCaseEiiPNS_10IdentifierERPNS_13SlowCaseEntryEj
-__ZN3JSC3JIT21compileOpCallSlowCaseEPNS_11InstructionERPNS_13SlowCaseEntryEjNS_8OpcodeIDE
-__ZN3JSC3JIT22compileOpCallSetupArgsEPNS_11InstructionE
-__ZN3JSC12X86Assembler3jneEv
-__ZN3WTF6VectorIN3JSC10CallRecordELm0EE6appendIS2_EEvRKT_
-__ZN3JSC9CodeBlock10setJITCodeERNS_10JITCodeRefE
-__ZN3JSC17BytecodeGenerator18dumpsGeneratedCodeEv
-__ZN3WTF10RefCountedIN3JSC14ExecutablePoolEE5derefEv
-ctiTrampoline
-__ZN3JSC11Interpreter16cti_op_get_by_idEPvz
-__ZNK3JSC10JSValuePtr3getEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC10MathObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC23setUpStaticFunctionSlotEPNS_9ExecStateEPKNS_9HashEntryEPNS_8JSObjectERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEiRKNS_10IdentifierEPFNS_10JSValuePtrES2_PNS_8JSObjectES6_RKNS_7ArgListEE
-__ZN3JSC27ctiPatchCallByReturnAddressEPvS0_
-__ZN3JSC11Interpreter25cti_op_call_NotJSFunctionEPvz
-__ZN3JSC17PrototypeFunction11getCallDataERNS_8CallDataE
-__ZN3JSCL19mathProtoFuncRandomEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3WTF12randomNumberEv
-__ZN3JSC11ProgramNodeD1Ev
-__ZN3WTF9HashTableIPN3JSC16ProgramCodeBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN3JSC9CodeBlockD2Ev
-__ZN3JSC17StructureStubInfo5derefEv
-__ZN3JSC9ScopeNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC14JSGlobalObject16stopTimeoutCheckEv
-__ZN3JSC4Heap9unprotectENS_10JSValuePtrE
-__ZNK3JSC12JSNumberCell8toStringEPNS_9ExecStateE
-__ZN3JSC7UString4fromEd
-__ZN3WTF4dtoaEdiPiS0_PPc
-__ZN3WTFL3d2bEdPiS0_
-__ZN3WTFL8pow5multEPNS_6BigintEi
-__ZN3WTFL4multEPNS_6BigintES1_
-__ZN3WTFL6lshiftEPNS_6BigintEi
-__ZN3WTFL6quoremEPNS_6BigintES1_
-__ZN3WTFL4diffEPNS_6BigintES1_
-__ZN3JSC7UString3Rep7destroyEv
--[WTFMainThreadCaller call]
-__ZN3WTF31dispatchFunctionsFromMainThreadEv
-__ZN3JSC4Heap7collectEv
-__ZN3JSC4Heap30markStackObjectsConservativelyEv
-__ZN3JSC4Heap31markCurrentThreadConservativelyEv
-__ZN3JSC4Heap39markCurrentThreadConservativelyInternalEv
-__ZN3JSC4Heap18markConservativelyEPvS1_
-__ZN3JSC4Heap20markProtectedObjectsEv
-__ZN3JSC12SmallStrings4markEv
-__ZN3JSC6JSCell4markEv
-__ZN3JSC4Heap5sweepILNS_8HeapTypeE0EEEmv
-__ZN3JSC14JSGlobalObjectD2Ev
-__ZN3JSC17FunctionPrototypeD0Ev
-__ZN3JSC17PrototypeFunctionD0Ev
-__ZN3JSC16BooleanPrototypeD0Ev
-__ZN3JSC15NumberPrototypeD0Ev
-__ZN3JSC14ErrorPrototypeD0Ev
-__ZN3JSC17ObjectConstructorD0Ev
-__ZN3JSC16ArrayConstructorD0Ev
-__ZN3JSC17StringConstructorD0Ev
-__ZN3JSC18BooleanConstructorD0Ev
-__ZN3JSC17NumberConstructorD0Ev
-__ZN3JSC17RegExpConstructorD0Ev
-__ZN3JSC16ErrorConstructorD0Ev
-__ZN3JSC22NativeErrorConstructorD0Ev
-__ZN3JSC18GlobalEvalFunctionD0Ev
-__ZN3JSC4Heap5sweepILNS_8HeapTypeE1EEEmv
-__ZN3WTF25TCMalloc_Central_FreeList11ShrinkCacheEib
-__ZN3WTF14FastMallocZone9forceLockEP14_malloc_zone_t
-__ZN3WTF14FastMallocZone11forceUnlockEP14_malloc_zone_t
-__ZN3JSC7UStringC1EPKti
-__ZN3JSC5Lexer7record8Ei
-__ZN3JSC16FunctionBodyNode13finishParsingERKNS_10SourceCodeEPNS_13ParameterNodeE
-__ZN3WTF6VectorINS_6RefPtrIN3JSC12FuncDeclNodeEEELm0EE15reserveCapacityEm
-__ZN3JSC10Identifier6removeEPNS_7UString3RepE
-__ZN3WTF6VectorINS_6RefPtrIN3JSC12FuncDeclNodeEEELm0EEaSERKS5_
 __ZN3JSC8JSObject12removeDirectERKNS_10IdentifierE
 __ZN3JSC9Structure31removePropertyWithoutTransitionERKNS_10IdentifierE
 __ZN3JSC9Structure6removeERKNS_10IdentifierE
 __ZN3JSC17BytecodeGenerator12addGlobalVarERKNS_10IdentifierEbRPNS_10RegisterIDE
 __ZN3JSC17BytecodeGenerator15emitNewFunctionEPNS_10RegisterIDEPNS_12FuncDeclNodeE
 __ZN3JSC9CodeBlock25createRareDataIfNecessaryEv
+__ZN3JSC17BytecodeGenerator11newRegisterEv
+__ZN3JSC9Structure24fromDictionaryTransitionEPS0_
+__ZN3JSC17BytecodeGenerator8generateEv
+__ZN3JSC11ProgramNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13emitDebugHookENS_11DebugHookIDEii
+__ZN3JSC17BytecodeGenerator11addConstantENS_7JSValueE
+__ZN3WTF9HashTableIPvSt4pairIS1_jENS_18PairFirstExtractorIS3_EENS_7PtrHashIS1_EENS_14PairHashTraitsIN3JSC17JSValueHashTraitsENS
+__ZN3WTF6VectorIN3JSC8RegisterELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator8emitMoveEPNS_10RegisterIDES2_
+__ZN3JSC17BytecodeGenerator8emitNodeEPNS_10RegisterIDEPNS_4NodeE
+__ZN3WTF6VectorIN3JSC8LineInfoELm0EE14expandCapacityEm
 __ZN3JSC12FuncDeclNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17ExprStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC23FunctionCallResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11registerForERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator8emitCallENS_8OpcodeIDEPNS_10RegisterIDES3_S3_PNS_13ArgumentsNodeEjjj
+__ZN3JSC16ArgumentListNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC12FuncExprNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator25emitNewFunctionExpressionEPNS_10RegisterIDEPNS_12FuncExprNodeE
+__ZN3WTF6VectorIN3JSC19ExpressionRangeInfoELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC12CallLinkInfoELm0EE14expandCapacityEm
+__ZN3JSC11ResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC12JSGlobalData22numericCompareFunctionEPNS_9ExecStateE
+__ZNK3JSC21UStringSourceProvider6lengthEv
+__ZNK3JSC21UStringSourceProvider4dataEv
+__ZN3JSC19extractFunctionBodyEPNS_11ProgramNodeE
+__ZNK3JSC17ExprStatementNode15isExprStatementEv
+__ZNK3JSC12FuncExprNode14isFuncExprNodeEv
+__ZN3JSC16FunctionBodyNode16generateBytecodeEPNS_14ScopeChainNodeE
+__ZN3JSC6Parser14reparseInPlaceEPNS_12JSGlobalDataEPNS_16FunctionBodyNodeE
+__ZL11makeSubNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC14ExpressionNode14stripUnaryPlusEv
+__ZNK3JSC14ExpressionNode8isNumberEv
+__ZN3JSC9CodeBlockC1EPNS_9ScopeNodeENS_8CodeTypeEN3WTF10PassRefPtrINS_14SourceProviderEEEj
+__ZN3JSC17BytecodeGeneratorC2EPNS_16FunctionBodyNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3Re
+__ZN3JSC17BytecodeGenerator12addParameterERKNS_10IdentifierE
+__ZN3JSC16FunctionBodyNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9BlockNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC10ReturnNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC12BinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC11ResolveNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC17BytecodeGenerator12newTemporaryEv
+__ZN3JSC17BytecodeGenerator12emitBinaryOpENS_8OpcodeIDEPNS_10RegisterIDES3_S3_NS_12OperandTypesE
+__ZN3JSC17BytecodeGenerator10emitReturnEPNS_10RegisterIDE
+__ZNK3JSC9BlockNode7isBlockEv
+__ZNK3JSC10ReturnNode12isReturnNodeEv
+__ZN3JSC9CodeBlock11shrinkToFitEv
+__ZN3WTF6VectorIN3JSC11InstructionELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN3JSC12CallLinkInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC10IdentifierELm0EE14shrinkCapacityEm
+__ZN3JSC11ParserArenaD1Ev
+__ZN3JSC11ResolveNodeD0Ev
+__ZN3JSC7SubNodeD0Ev
+__ZN3JSC10ReturnNodeD0Ev
+__ZN3JSC14SourceElementsD0Ev
+__ZN3JSC9BlockNodeD0Ev
+__ZN3JSC17BytecodeGeneratorD2Ev
+__ZN3WTF6VectorIN3JSC11InstructionELm0EEaSERKS3_
+__ZThn16_N3JSC11ProgramNodeD0Ev
+__ZN3JSC11ProgramNodeD0Ev
+__ZN3JSC13ParameterNodeD0Ev
+__ZN3JSC17ExprStatementNodeD0Ev
+__ZThn16_N3JSC12FuncExprNodeD0Ev
+__ZN3JSC12FuncExprNodeD0Ev
+__ZThn16_N3JSC16FunctionBodyNodeD0Ev
+__ZN3JSC16FunctionBodyNodeD0Ev
+__ZN3JSC9CodeBlockD1Ev
+__ZN3JSC9CodeBlockD2Ev
+__ZN3JSC21UStringSourceProviderD0Ev
+__ZN3WTF6VectorIN3JSC19ExpressionRangeInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC8LineInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC12FuncDeclNodeEEELm0EE14shrinkCapacityEm
 __ZN3WTF6VectorIN3JSC15SimpleJumpTableELm0EE14shrinkCapacityEm
 __ZN3WTF6VectorIN3JSC15StringJumpTableELm0EE14shrinkCapacityEm
-__ZN3JSC3JIT11emitCTICallEPFvPvzE
-__ZN3JSC11Interpreter15cti_op_new_funcEPvz
+__ZN3JSC15ParserArenaDataIN3WTF6VectorIPNS_12FuncDeclNodeELm0EEEED0Ev
+__ZN3JSC16ArgumentListNodeD0Ev
+__ZN3JSC13ArgumentsNodeD0Ev
+__ZN3JSC23FunctionCallResolveNodeD0Ev
+__ZN3JSC14JSGlobalObject13copyGlobalsToERNS_12RegisterFileE
+__ZN3JSC3JIT14privateCompileEv
+__ZN3JSC3JIT22privateCompileMainPassEv
+__ZN3JSC3JIT13emit_op_enterEPNS_11InstructionE
+__ZN3JSC3JIT16emit_op_new_funcEPNS_11InstructionE
+__ZN3JSC20MacroAssemblerX86_648storePtrENS_22AbstractMacroAssemblerINS_12X86AssemblerEE6ImmPtrENS3_15ImplicitAddressE
+__ZN3JSC11JITStubCall4callEj
+__ZN3WTF6VectorIN3JSC10CallRecordELm0EE14expandCapacityEm
+__ZN3JSC3JIT11emit_op_movEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_new_func_expEPNS_11InstructionE
+__ZN3JSC3JIT12emit_op_callEPNS_11InstructionE
+__ZN3JSC3JIT13compileOpCallENS_8OpcodeIDEPNS_11InstructionEj
+__ZN3WTF6VectorIN3JSC13SlowCaseEntryELm0EE14expandCapacityEm
+__ZN3JSC3JIT11emit_op_endEPNS_11InstructionE
+__ZN3JSC11JITStubCall4callEv
+__ZN3WTF6VectorIN3JSC9JumpTableELm0EE14shrinkCapacityEm
+__ZN3JSC3JIT23privateCompileSlowCasesEv
+__ZN3JSC3JIT16emitSlow_op_callEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21compileOpCallSlowCaseEPNS_11InstructionERPNS_13SlowCaseEntryEjNS_8OpcodeIDE
+__ZN3JSC3JIT22compileOpCallSetupArgsEPNS_11InstructionE
+__ZN3JSC9CodeBlock10setJITCodeERNS_10JITCodeRefE
+__ZN3JSC17BytecodeGenerator18dumpsGeneratedCodeEv
+__ZN3WTF10RefCountedIN3JSC14ExecutablePoolEE5derefEv
+_ctiTrampoline
+__ZN3JSC8JITStubs15cti_op_new_funcEPPv
 __ZN3JSC12FuncDeclNode12makeFunctionEPNS_9ExecStateEPNS_14ScopeChainNodeE
-__ZN3JSC11Interpreter10cti_op_endEPvz
-__ZN3JSC12FuncDeclNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC12NodeReleaser21adoptFunctionBodyNodeERN3WTF6RefPtrINS_16FunctionBodyNodeEEE
-__ZN3JSC8JSObject4markEv
-__ZN3JSC14JSGlobalObject4markEv
-__ZN3JSC7JSArray4markEv
-__ZN3JSC15JSWrapperObject4markEv
-__ZN3JSC18GlobalEvalFunction4markEv
-__ZNK3JSC10NumberNode8isNumberEv
-__ZN3JSC5Lexer10scanRegExpEv
-__ZN3JSC7UStringC2ERKN3WTF6VectorItLm0EEE
-__ZL26appendToVarDeclarationListPvRPN3JSC20ParserRefCountedDataIN3WTF6VectorISt4pairINS0_10IdentifierEjELm0EEEEERKS5_j
-__ZN3WTF6VectorISt4pairIN3JSC10IdentifierEjELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorISt4pairIN3JSC10IdentifierEjELm0EE15reserveCapacityEm
-__ZL20makeVarStatementNodePvPN3JSC14ExpressionNodeE
-__ZL14makeAssignNodePvPN3JSC14ExpressionNodeENS0_8OperatorES2_bbiii
-__Z21mergeDeclarationListsIPN3JSC20ParserRefCountedDataIN3WTF6VectorINS2_6RefPtrINS0_12FuncDeclNodeEEELm0EEEEEET_SA_SA_
-__ZN3JSC20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEED1Ev
-__ZN3WTF6VectorIPNS0_IN3JSC10IdentifierELm64EEELm32EE14expandCapacityEm
-__ZNK3JSC18EmptyStatementNode16isEmptyStatementEv
-__ZNK3JSC14ExpressionNode10isLocationEv
-__ZL11makeAddNodePvPN3JSC14ExpressionNodeES2_b
-__ZNK3JSC14ExpressionNode8isNumberEv
-__ZN3JSC16PropertyListNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator11emitPutByIdEPNS_10RegisterIDERKNS_10IdentifierES2_
-__ZN3JSC11UnaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC13LogicalOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8JITStubs19cti_op_new_func_expEPPv
+__ZN3JSC12FuncExprNode12makeFunctionEPNS_9ExecStateEPNS_14ScopeChainNodeE
+__ZN3JSC8JITStubs22cti_op_call_JSFunctionEPPv
+__ZN3JSC16FunctionBodyNode15generateJITCodeEPNS_14ScopeChainNodeE
+__ZN3JSC10IfElseNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
 __ZN3JSC17BytecodeGenerator8newLabelEv
+__ZN3JSC15DotAccessorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11emitResolveEPNS_10RegisterIDERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator18findScopedPropertyERKNS_10IdentifierERiRmbRPNS_8JSObjectE
+__ZNK3JSC16JSVariableObject16isVariableObjectEv
+__ZN3JSC17BytecodeGenerator16emitGetScopedVarEPNS_10RegisterIDEmiNS_7JSValueE
+__ZN3JSC17BytecodeGenerator11emitGetByIdEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator11addConstantERKNS_10IdentifierE
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEiNS2_17IdentifierRepHashENS_10HashTraitsIS5_EENS2_17BytecodeGenerator28Identifi
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_iENS_18PairFirstExtractorIS7_EENS2_17IdentifierRepHashENS_14PairHa
 __ZN3JSC17BytecodeGenerator15emitJumpIfFalseEPNS_10RegisterIDEPNS_5LabelE
-__ZNK3JSC14LogicalNotNode8opcodeIDEv
+__ZNK3JSC14JSGlobalObject14isDynamicScopeEv
+__ZN3JSC17BytecodeGenerator19emitResolveFunctionEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3JSC10StringNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8emitLoadEPNS_10RegisterIDERKNS_10IdentifierE
+__ZN3WTF9HashTableIPN3JSC7UString3RepESt4pairIS4_PNS1_8JSStringEENS_18PairFirstExtractorIS8_EENS1_17IdentifierRepHashENS_14Pair
+__ZN3JSC11BooleanNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8emitJumpEPNS_5LabelE
 __ZN3JSC17BytecodeGenerator9emitLabelEPNS_5LabelE
 __ZN3WTF6VectorIjLm0EE15reserveCapacityEm
-__ZN3JSC19ReverseBinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC10NumberNode6isPureERNS_17BytecodeGeneratorE
-__ZN3JSC17BytecodeGenerator11emitResolveEPNS_10RegisterIDERKNS_10IdentifierE
-__ZN3WTF6VectorIN3JSC17GlobalResolveInfoELm0EE14expandCapacityEm
-__ZNK3JSC11GreaterNode8opcodeIDEv
-__ZN3JSC17BytecodeGenerator12emitBinaryOpENS_8OpcodeIDEPNS_10RegisterIDES3_S3_NS_12OperandTypesE
-__ZN3JSC9EqualNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC14ExpressionNode6isNullEv
-__ZN3JSC17BytecodeGenerator14emitEqualityOpENS_8OpcodeIDEPNS_10RegisterIDES3_S3_
+__ZN3JSC6IfNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC13StatementNode12isReturnNodeEv
+__ZN3JSC15DotAccessorNodeD0Ev
+__ZN3JSC10StringNodeD0Ev
+__ZN3JSC11BooleanNodeD0Ev
+__ZN3JSC6IfNodeD0Ev
+__ZN3JSC10IfElseNodeD0Ev
+__ZN3JSC3JIT22emit_op_get_global_varEPNS_11InstructionE
+__ZN3JSC3JIT29emitGetVariableObjectRegisterENS_3X8610RegisterIDEiS2_
+__ZN3JSC3JIT17emit_op_get_by_idEPNS_11InstructionE
+__ZN3JSC3JIT21compileGetByIdHotPathEiiPNS_10IdentifierEj
+__ZN3WTF6VectorIN3JSC13SlowCaseEntryELm0EE14expandCapacityEmPKS2_
+__ZN3JSC3JIT14emit_op_jfalseEPNS_11InstructionE
+__ZN3JSC20MacroAssemblerX86_649branchPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAssembler
+__ZN3JSC20MacroAssemblerX86_649branchPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDES4_
+__ZN3WTF6VectorIN3JSC9JumpTableELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN3JSC9JumpTableELm0EE14expandCapacityEm
+__ZN3JSC3JIT20emit_op_resolve_funcEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_jmpEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_retEPNS_11InstructionE
+__ZN3JSC3JIT21emitSlow_op_get_by_idEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22compileGetByIdSlowCaseEiiPNS_10IdentifierERPNS_13SlowCaseEntryEj
+__ZN3JSC3JIT18emitSlow_op_jfalseEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC23MacroAssemblerX86Common12branchTest32ENS0_9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAssemblerINS_12X86Assemble
+__ZN3JSC8JITStubs23cti_vm_dontLazyLinkCallEPPv
+__ZN3JSC31ctiPatchNearCallByReturnAddressENS_22AbstractMacroAssemblerINS_12X86AssemblerEE22ProcessorReturnAddressEPv
+__ZN3JSC8JITStubs23cti_register_file_checkEPPv
+__ZN3JSC8JITStubs16cti_op_get_by_idEPPv
+__ZNK3JSC7JSValue3getEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC23setUpStaticFunctionSlotEPNS_9ExecStateEPKNS_9HashEntryEPNS_8JSObjectERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC27ctiPatchCallByReturnAddressENS_22AbstractMacroAssemblerINS_12X86AssemblerEE22ProcessorReturnAddressEPv
+__ZN3JSC8JITStubs12cti_op_jtrueEPPv
+__ZNK3JSC8JSObject9toBooleanEPNS_9ExecStateE
+__ZN3JSC8JITStubs19cti_op_resolve_funcEPPv
+__ZNK3JSC8JSObject12toThisObjectEPNS_9ExecStateE
+__ZNK3JSC8JSString8toStringEPNS_9ExecStateE
+__ZN3JSC8JITStubs23cti_op_get_by_id_secondEPPv
+__ZN3JSC8JITStubs15tryCacheGetByIDEPNS_9ExecStateEPNS_9CodeBlockEPvNS_7JSValueERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC3JIT26privateCompileGetByIdProtoEPNS_17StructureStubInfoEPNS_9StructureES4_mNS_22AbstractMacroAssemblerINS_12X86Assembl
+__ZN3JSC3JIT22compileGetDirectOffsetEPNS_8JSObjectENS_3X8610RegisterIDES4_m
+__ZN3JSC8JITStubs19cti_vm_lazyLinkCallEPPv
+__ZN3JSC3JIT8linkCallEPNS_10JSFunctionEPNS_9CodeBlockENS_7JITCodeEPNS_12CallLinkInfoEi
+__ZN3JSC8JITStubs10cti_op_endEPPv
+__ZThn16_N3JSC12FuncDeclNodeD0Ev
+__ZN3JSC12FuncDeclNodeD0Ev
+__ZN3WTF25TCMalloc_Central_FreeList11ShrinkCacheEib
+__ZN3JSC10JSFunction18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC10JSFunction11getCallDataERNS_8CallDataE
+__ZN3JSC4callEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE
+__ZN3JSC11Interpreter7executeEPNS_16FunctionBodyNodeEPNS_9ExecStateEPNS_10JSFunctionEPNS_8JSObjectERKNS_7ArgListEPNS_14ScopeCha
+__ZNK3JSC15DotAccessorNode10isLocationEv
+__ZNK3JSC14ExpressionNode13isResolveNodeEv
+__ZNK3JSC14ExpressionNode21isBracketAccessorNodeEv
+__ZN3JSC19FunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC19FunctionCallDotNodeD0Ev
+__ZL26appendToVarDeclarationListPvRPN3JSC15ParserArenaDataIN3WTF6VectorISt4pairINS0_10IdentifierEjELm0EEEEERKS5_j
+__ZN3WTF6VectorISt4pairIN3JSC10IdentifierEjELm0EE14expandCapacityEm
+__ZL14makeAssignNodePvPN3JSC14ExpressionNodeENS0_8OperatorES2_bbiii
+__ZL11makeAddNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC16VarStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17AssignResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC11UnaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
 __ZN3JSC10RegExpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
 __ZN3JSC6RegExp6createEPNS_12JSGlobalDataERKNS_7UStringES5_
-__ZN3JSC4WREC9Generator13compileRegExpEPNS_12JSGlobalDataERKNS_7UStringEPjPPKcRN3WTF6RefPtrINS_14ExecutablePoolEEEbb
-__ZN3JSC4WREC9Generator13generateEnterEv
-__ZN3JSC4WREC9Generator17generateSaveIndexEv
-__ZN3JSC4WREC6Parser16parseDisjunctionERNS_14MacroAssembler8JumpListE
-__ZN3JSC4WREC6Parser16parseAlternativeERNS_14MacroAssembler8JumpListE
-__ZN3JSC4WREC9Generator32generatePatternCharacterSequenceERNS_14MacroAssembler8JumpListEPim
-__ZN3JSC4WREC9Generator28generatePatternCharacterPairERNS_14MacroAssembler8JumpListEii
-__ZN3WTF6VectorIN3JSC14MacroAssembler4JumpELm16EE6appendIS3_EEvRKT_
-__ZN3JSC12X86Assembler7cmpl_irEiNS_3X8610RegisterIDE
-__ZN3JSC4WREC9Generator24generatePatternCharacterERNS_14MacroAssembler8JumpListEi
-__ZN3JSC4WREC9Generator21generateLoadCharacterERNS_14MacroAssembler8JumpListE
-__ZN3JSC4WREC14CharacterClass7newlineEv
-__ZN3JSC4WREC6Parser29parseCharacterClassQuantifierERNS_14MacroAssembler8JumpListERKNS0_14CharacterClassEb
-__ZN3JSC4WREC6Parser17consumeQuantifierEv
-__ZN3JSC4WREC9Generator24generateGreedyQuantifierERNS_14MacroAssembler8JumpListERNS0_19GenerateAtomFunctorEjj
-__ZN3JSC4WREC29GenerateCharacterClassFunctor12generateAtomEPNS0_9GeneratorERNS_14MacroAssembler8JumpListE
-__ZN3JSC4WREC9Generator22generateCharacterClassERNS_14MacroAssembler8JumpListERKNS0_14CharacterClassEb
-__ZN3JSC4WREC9Generator30generateCharacterClassInvertedERNS_14MacroAssembler8JumpListERKNS0_14CharacterClassE
-__ZN3JSC4WREC29GenerateCharacterClassFunctor9backtrackEPNS0_9GeneratorE
-__ZN3JSC4WREC9Generator18generateBacktrack1Ev
-__ZN3JSC15AssemblerBuffer4growEv
+__ZN3JSC4Yarr15jitCompileRegexEPNS_12JSGlobalDataERNS0_14RegexCodeBlockERKNS_7UStringERjRPKcbb
+__ZN3JSC4Yarr12compileRegexERKNS_7UStringERNS0_12RegexPatternE
+__ZN3JSC4Yarr18PatternDisjunction17addNewAlternativeEv
+__ZN3WTF6VectorIPN3JSC4Yarr18PatternAlternativeELm0EE14expandCapacityEm
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE11parseTokensEv
+__ZN3WTF6VectorIN3JSC4Yarr11PatternTermELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN3JSC4Yarr11PatternTermELm0EE14expandCapacityEm
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE11parseEscapeILb0ES2_EEbRT0_
+__ZN3JSC4Yarr23RegexPatternConstructor25atomBuiltInCharacterClassENS0_23BuiltInCharacterClassIDEb
+__ZN3JSC4Yarr14wordcharCreateEv
+__ZN3WTF6VectorItLm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC4Yarr14CharacterRangeELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN3JSC4Yarr14CharacterRangeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC4Yarr14CharacterClassELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPN3JSC4Yarr14CharacterClassELm0EE14expandCapacityEm
+__ZN3JSC4Yarr14RegexGenerator19generateDisjunctionEPNS0_18PatternDisjunctionE
 __ZN3JSC12X86Assembler7addl_irEiNS_3X8610RegisterIDE
-__ZN3JSC4WREC9Generator21generateReturnSuccessEv
-__ZN3JSC4WREC9Generator22generateIncrementIndexEPNS_14MacroAssembler4JumpE
-__ZN3JSC4WREC9Generator27generateJumpIfNotEndOfInputENS_14MacroAssembler5LabelE
-__ZN3JSC4WREC9Generator21generateReturnFailureEv
+__ZN3JSC23MacroAssemblerX86Common8branch32ENS0_9ConditionENS_3X8610RegisterIDES3_
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList6appendENS2_4JumpE
+__ZN3JSC4Yarr14RegexGenerator12generateTermERNS1_19TermGenerationStateE
+__ZN3JSC23MacroAssemblerX86Common8branch32ENS0_9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5I
+__ZN3JSC4Yarr14RegexGenerator19TermGenerationState15jumpToBacktrackENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPNS_14
+__ZN3JSC4Yarr14RegexGenerator13readCharacterEiNS_3X8610RegisterIDE
+__ZN3JSC4Yarr14RegexGenerator19matchCharacterClassENS_3X8610RegisterIDERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpLis
+__ZN3JSC4Yarr14RegexGenerator24matchCharacterClassRangeENS_3X8610RegisterIDERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8Ju
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList4linkEPS2_
+__ZN3JSC23MacroAssemblerX86Common4jumpEv
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE4JumpELm16EED1Ev
+__ZN3JSC4Yarr14RegexGenerator28generateCharacterClassGreedyERNS1_19TermGenerationStateE
+__ZN3JSC12X86Assembler7subl_irEiNS_3X8610RegisterIDE
+__ZN3JSC15AssemblerBuffer4growEv
+__ZN3WTF15deleteAllValuesIPN3JSC4Yarr14CharacterClassELm0EEEvRKNS_6VectorIT_XT0_EEE
 __ZN3JSC17BytecodeGenerator13emitNewRegExpEPNS_10RegisterIDEPNS_6RegExpE
-__ZN3JSC12BinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC18NotStrictEqualNode8opcodeIDEv
-__ZNK3JSC14ExpressionNode6isPureERNS_17BytecodeGeneratorE
-__ZN3JSC4WREC9Generator20generateAssertionBOLERNS_14MacroAssembler8JumpListE
-__ZN3JSC4WREC6Parser13consumeEscapeEb
-__ZN3WTF6VectorIiLm8EE14expandCapacityEm
-__ZN3JSC4WREC6Parser16parseParenthesesERNS_14MacroAssembler8JumpListE
+__ZN3JSC15ConditionalNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9EqualNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode6isNullEv
+__ZNK3JSC10StringNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC19BracketAccessorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC10NumberNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC10NumberNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8emitLoadEPNS_10RegisterIDEd
+__ZN3JSC17BytecodeGenerator12emitGetByValEPNS_10RegisterIDES2_S2_
+__ZN3JSC17BytecodeGenerator14emitEqualityOpENS_8OpcodeIDEPNS_10RegisterIDES3_S3_
+__ZN3JSC19ReverseBinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode5isAddEv
+__ZN3JSC12SmallStrings27createSingleCharacterStringEPNS_12JSGlobalDataEh
+__ZN3JSC13AssignDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11emitPutByIdEPNS_10RegisterIDERKNS_10IdentifierES2_
+__ZN3JSC17AssignResolveNodeD0Ev
+__ZN3JSC15ParserArenaDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEED0Ev
+__ZN3JSC16VarStatementNodeD0Ev
+__ZN3JSC14LogicalNotNodeD0Ev
+__ZN3JSC10RegExpNodeD0Ev
+__ZN3JSC10NumberNodeD0Ev
+__ZN3JSC19BracketAccessorNodeD0Ev
+__ZN3JSC9EqualNodeD0Ev
+__ZN3JSC15ConditionalNodeD0Ev
+__ZN3JSC7AddNodeD0Ev
+__ZN3JSC13GreaterEqNodeD0Ev
+__ZN3JSC13AssignDotNodeD0Ev
+__ZN3JSC3JIT13emit_op_jtrueEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_new_regexpEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_get_by_valEPNS_11InstructionE
+__ZN3JSC3JIT10emit_op_eqEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_addEPNS_11InstructionE
+__ZN3JSC11JITStubCall11addArgumentEjNS_3X8610RegisterIDE
+__ZN3JSC3JIT16emit_op_jnlesseqEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_put_by_idEPNS_11InstructionE
+__ZN3JSC3JIT21compilePutByIdHotPathEiPNS_10IdentifierEij
+__ZN3JSC3JIT17emitSlow_op_jtrueEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22emitSlow_op_get_by_valEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT14emitSlow_op_eqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT20emitSlow_op_jnlesseqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC20MacroAssemblerX86_6413branchTestPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDES4_
+__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC23MacroAssemblerX86Common12branchDoubleENS0_15DoubleConditionENS_3X8613XMMRegisterIDES3_
+__ZN3JSC3JIT21emitSlow_op_put_by_idEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22compilePutByIdSlowCaseEiPNS_10IdentifierEiRPNS_13SlowCaseEntryEj
+__ZN3JSC13LogicalOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3WTF6VectorIN3JSC17GlobalResolveInfoELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator14emitJumpIfTrueEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC13LogicalOpNodeD0Ev
+__ZN3JSC3JIT22emit_op_resolve_globalEPNS_11InstructionE
+__ZN3JSC8JITStubs21cti_op_resolve_globalEPPv
+__ZNK3JSC8JSString9toBooleanEPNS_9ExecStateE
+__ZN3JSC8JSString18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC15StringPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL20stringProtoFuncMatchEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSString12toThisStringEPNS_9ExecStateE
+__ZNK3JSC6JSCell8isObjectEPKNS_9ClassInfoE
+__ZNK3JSC6JSCell9classInfoEv
+__ZN3JSC4Yarr23RegexPatternConstructor20atomPatternCharacterEt
+__ZN3JSC4Yarr25CharacterClassConstructor7putCharEt
+__ZN3JSC4Yarr25CharacterClassConstructor9addSortedERN3WTF6VectorItLm0EEEt
+__ZN3JSC4Yarr23RegexPatternConstructor21atomCharacterClassEndEv
+__ZN3JSC4Yarr23RegexPatternConstructor23setupDisjunctionOffsetsEPNS0_18PatternDisjunctionEjj
+__ZN3JSC4Yarr14RegexGenerator25generateParenthesesSingleERNS1_19TermGenerationStateE
+__ZN3JSC4Yarr14RegexGenerator30generateParenthesesDisjunctionERNS0_11PatternTermERNS1_19TermGenerationStateEj
+__ZN3WTF6VectorIN3JSC4Yarr14RegexGenerator26AlternativeBacktrackRecordELm0EE14expandCapacityEm
+__ZN3JSC4Yarr14RegexGenerator19jumpIfCharNotEqualsEti
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDES4_ii
+__ZN3JSC4Yarr14RegexGenerator19TermGenerationState15jumpToBacktrackERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEP
+__ZN3JSC17RegExpConstructor12performMatchEPNS_6RegExpERKNS_7UStringEiRiS6_PPi
+__ZN3JSC6RegExp5matchERKNS_7UStringEiPN3WTF11OwnArrayPtrIiEE
+__ZN3JSC4Yarr12executeRegexERNS0_14RegexCodeBlockEPKtjjPii
+__ZN3JSC8JITStubs17cti_op_new_regexpEPPv
+__ZN3JSC12RegExpObjectC1EN3WTF10PassRefPtrINS_9StructureEEENS2_INS_6RegExpEEE
+__ZNK3JSC12RegExpObject9classInfoEv
+__ZN3JSC18RegExpMatchesArrayC2EPNS_9ExecStateEPNS_24RegExpConstructorPrivateE
+__ZN3JSC8JITStubs17cti_op_get_by_valEPPv
+__ZN3JSC18RegExpMatchesArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC18RegExpMatchesArray17fillArrayInstanceEPNS_9ExecStateE
+__ZN3JSC11jsSubstringEPNS_12JSGlobalDataERKNS_7UStringEjj
+__ZN3JSC7JSArray3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JSObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC8JITStubs9cti_op_eqEPPv
+__ZN3JSCeqERKNS_7UStringES2_
+__ZN3JSC8JITStubs10cti_op_addEPPv
+__ZN3JSC11concatenateEPNS_7UString3RepES2_
+__ZN3JSCL22stringProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString4findERKS0_i
+__ZN3JSC8JITStubs16cti_op_put_by_idEPPv
+__ZNK3JSC7UString8toUInt32EPbb
+__ZNK3JSC7UString8toDoubleEbb
+__ZNK3JSC7UString10getCStringERN3WTF6VectorIcLm32EEE
+__ZN3WTF14FastMallocZone11forceUnlockEP14_malloc_zone_t
 __Z15jsRegExpCompilePKti24JSRegExpIgnoreCaseOption23JSRegExpMultilineOptionPjPPKc
 __ZL30calculateCompiledPatternLengthPKti24JSRegExpIgnoreCaseOptionR11CompileDataR9ErrorCode
 __ZL11checkEscapePPKtS0_P9ErrorCodeib
 __ZL13compileBranchiPiPPhPPKtS3_P9ErrorCodeS_S_R11CompileData
-__ZN3JSC4WREC14CharacterClass6spacesEv
-__ZN3JSC4WREC6Parser23parseNonCharacterEscapeERNS_14MacroAssembler8JumpListERKNS0_6EscapeE
-__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDE
-__ZN3JSC4WREC9Generator35generateCharacterClassInvertedRangeERNS_14MacroAssembler8JumpListES4_PKNS0_14CharacterRangeEjPjPKtj
-__ZN3JSC4WREC9Generator20terminateAlternativeERNS_14MacroAssembler8JumpListES4_
-__ZN3JSC4WREC6Parser19parseCharacterClassERNS_14MacroAssembler8JumpListE
-__ZN3JSC4WREC14CharacterClass8wordcharEv
-__ZN3JSC4WREC25CharacterClassConstructor6appendERKNS0_14CharacterClassE
-__ZN3JSC4WREC25CharacterClassConstructor5flushEv
-__ZN3JSC4WREC25CharacterClassConstructor9addSortedERN3WTF6VectorItLm0EEEt
-__ZN3WTF6VectorItLm0EE14expandCapacityEm
-__ZN3JSC4WREC25CharacterClassConstructor14addSortedRangeERN3WTF6VectorINS0_14CharacterRangeELm0EEEtt
-__ZN3WTF6VectorIN3JSC4WREC14CharacterRangeELm0EE14expandCapacityEm
-__ZN3JSC4WREC25CharacterClassConstructor3putEt
-__ZN3JSC4WREC9Generator20terminateDisjunctionERNS_14MacroAssembler8JumpListE
+__Z15jsRegExpExecutePK8JSRegExpPKtiiPii
+__ZL5matchPKtPKhiR9MatchData
+__ZNK3JSC7UString14toStrictUInt32EPb
+__ZN3JSC17ObjectLiteralNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC16PropertyListNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC7TryNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator9emitCatchEPNS_10RegisterIDEPNS_5LabelES4_
+__ZN3WTF6VectorIN3JSC11HandlerInfoELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator16emitPushNewScopeEPNS_10RegisterIDERNS_10IdentifierES2_
+__ZN3WTF6VectorIN3JSC18ControlFlowContextELm0EE14expandCapacityEm
+__ZNK3JSC14ExpressionNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC12PropertyNodeD0Ev
+__ZN3JSC16PropertyListNodeD0Ev
+__ZN3JSC17ObjectLiteralNodeD0Ev
+__ZN3JSC7TryNodeD0Ev
+__ZN3JSC3JIT18emit_op_new_objectEPNS_11InstructionE
+__ZN3JSC3JIT13emit_op_catchEPNS_11InstructionE
+__ZN3JSC3JIT22emit_op_push_new_scopeEPNS_11InstructionE
+__ZN3JSC3JIT15emit_op_resolveEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_pop_scopeEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_new_objectEPPv
+__ZN3JSC20constructEmptyObjectEPNS_9ExecStateE
+__ZN3JSC17StructureStubInfo5derefEv
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEES5_NS_17IdentityExtractorIS5_EENS2_17IdentifierRepHashENS_10HashTraitsIS5_EES
+__ZN3JSC8ThisNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21ThrowableBinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8ThisNodeD0Ev
+__ZN3JSC6InNodeD0Ev
+__ZN3JSC3JIT29emit_op_enter_with_activationEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_convert_thisEPNS_11InstructionE
+__ZN3JSC3JIT27emit_op_tear_off_activationEPNS_11InstructionE
+__ZN3JSC3JIT24emitSlow_op_convert_thisEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs22cti_op_push_activationEPPv
+__ZN3JSC12JSActivationC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_16FunctionBodyNodeEEE
+__ZN3JSC12JSActivationC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_16FunctionBodyNodeEEE
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE11parseEscapeILb1ENS3_28CharacterClassParserDelegateEEEbRT0_
+__ZN3JSC4Yarr12digitsCreateEv
+__ZN3JSC4Yarr25CharacterClassConstructor6appendEPKNS0_14CharacterClassE
+__ZN3JSC4Yarr25CharacterClassConstructor14addSortedRangeERN3WTF6VectorINS0_14CharacterRangeELm0EEEtt
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE28CharacterClassParserDelegate20atomPatternCharacterEt
+__ZN3JSC11GreaterNodeD0Ev
+__ZN3JSCL26stringProtoFuncToLowerCaseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSString14toThisJSStringEPNS_9ExecStateE
+__ZN3JSC7UStringC2EPtib
+__ZN3JSC18globalFuncParseIntEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC11JSImmediate12nonInlineNaNEv
+__ZN3JSC8JITStubs11cti_op_lessEPPv
+__ZN3JSC8JITStubs9cti_op_inEPPv
+__ZNK3JSC6JSCell9getUInt32ERj
+__ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZL14makePrefixNodePvPN3JSC14ExpressionNodeENS0_8OperatorEiii
+__ZN3JSC7ForNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13newLabelScopeENS_10LabelScope4TypeEPKNS_10IdentifierE
+__ZN3JSC12ContinueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14continueTargetERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator14emitJumpScopesEPNS_5LabelEi
+__ZN3JSC17PrefixResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21ReadModifyResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
 __ZN3JSC11NewExprNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
 __ZN3JSC17BytecodeGenerator13emitConstructEPNS_10RegisterIDES2_PNS_13ArgumentsNodeEjjj
 __ZN3WTF6VectorIN3JSC20GetByIdExceptionInfoELm0EE14expandCapacityEm
-__ZN3JSC16VarStatementNodeD1Ev
-__ZN3JSC16VarStatementNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC17AssignResolveNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC17ObjectLiteralNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC16PropertyListNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC12PropertyNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11UnaryOpNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC13LogicalOpNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC12BinaryOpNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC17AssignResolveNodeD1Ev
-__ZN3JSC17ObjectLiteralNodeD1Ev
-__ZN3JSC16PropertyListNodeD1Ev
-__ZN3JSC12PropertyNodeD1Ev
-__ZN3JSC14LogicalNotNodeD1Ev
-__ZN3JSC10RegExpNodeD1Ev
-__ZN3JSC13LogicalOpNodeD1Ev
-__ZN3JSC9EqualNodeD1Ev
-__ZN3JSC18NotStrictEqualNodeD1Ev
-__ZN3JSC6IfNodeD1Ev
-__ZN3JSC6IfNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC13AssignDotNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC8WithNodeD1Ev
-__ZN3JSC8WithNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC21FunctionCallValueNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC21FunctionCallValueNodeD1Ev
-__ZN3JSC9ArrayNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC9ArrayNodeD1Ev
-__ZN3JSC11ElementNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC10IfElseNodeD1Ev
-__ZN3JSC10IfElseNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC7AddNodeD1Ev
-__ZN3JSC11NewExprNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11NewExprNodeD1Ev
-__ZN3JSC3JIT21compilePutByIdHotPathEiPNS_10IdentifierEij
-__ZN3WTF6VectorIN3JSC9JumpTableELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN3JSC13SlowCaseEntryELm0EE6appendIS2_EEvRKT_
-__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDES4_ii
-__ZN3JSC3JIT11emitCTICallEPFPNS_23JSValueEncodedAsPointerEPvzE
-__ZN3JSC3JIT17compileOpStrictEqEPNS_11InstructionENS0_21CompileOpStrictEqTypeE
-__ZN3JSC3JIT23compileFastArith_op_addEPNS_11InstructionE
-__ZN3JSC3JIT22compilePutByIdSlowCaseEiPNS_10IdentifierEiRPNS_13SlowCaseEntryEj
+__ZN3JSC8LessNodeD0Ev
+__ZN3JSC17PrefixResolveNodeD0Ev
+__ZN3JSC12ContinueNodeD0Ev
+__ZN3JSC7ForNodeD0Ev
+__ZN3JSC21ReadModifyResolveNodeD0Ev
+__ZN3JSC11NewExprNodeD0Ev
+__ZN3JSC3JIT11emit_op_notEPNS_11InstructionE
+__ZN3JSC3JIT15emit_op_pre_incEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_loop_if_lessEPNS_11InstructionE
+__ZN3JSC3JIT16emitTimeoutCheckEv
+__ZN3JSC3JIT20compileBinaryArithOpENS_8OpcodeIDEjjjNS_12OperandTypesE
+__ZN3JSC3JIT11emit_op_subEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_constructEPNS_11InstructionE
+__ZN3JSC3JIT24emit_op_construct_verifyEPNS_11InstructionE
+__ZN3JSC3JIT15emitSlow_op_notEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT19emitSlow_op_pre_incEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT24emitSlow_op_loop_if_lessEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT15emitSlow_op_addEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT28compileBinaryArithOpSlowCaseENS_8OpcodeIDERPNS_13SlowCaseEntryEjjjNS_12OperandTypesE
+__ZN3JSC15AssemblerBuffer7putByteEi
+__ZN3JSC12X86Assembler23X86InstructionFormatter11twoByteOp64ENS0_15TwoByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC3JIT15emitSlow_op_subEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21emitSlow_op_constructEPNS_11InstructionERPNS_13SlowCaseEntryE
 __ZN3JSC3JIT27compileOpConstructSetupArgsEPNS_11InstructionE
-__ZN3JSC3JIT11emitCTICallEPFPNS_8JSObjectEPvzE
-__ZN3JSC12SmallStrings27createSingleCharacterStringEPNS_12JSGlobalDataEh
-__ZN3JSC11Interpreter17cti_op_new_objectEPvz
-__ZN3JSC20constructEmptyObjectEPNS_9ExecStateE
-__ZN3JSC11Interpreter16cti_op_put_by_idEPvz
-__ZN3JSC8JSObject3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSC11Interpreter12cti_op_jtrueEPvz
-__ZN3JSC11Interpreter10cti_op_notEPvz
-__ZN3WTF7HashMapISt4pairINS_6RefPtrIN3JSC7UString3RepEEEjEPNS3_9StructureENS3_28StructureTransitionTableHashENS3_34StructureTransitionTableHashTraitsENS_10HashTraitsIS9_EEE3addERKS7_RKS9_
-__ZN3WTF9HashTableISt4pairINS_6RefPtrIN3JSC7UString3RepEEEjES1_IS7_PNS3_9StructureEENS_18PairFirstExtractorISA_EENS3_28StructureTransitionTableHashENS_14PairHashTraitsINS3_34StructureTransitionTableHashTraitsENS_10HashTraitsIS9_EEEESF_E6rehashEi
-__ZN3JSC11Interpreter21cti_op_resolve_globalEPvz
-__ZN3JSC8JSString18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC15StringPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSCL22stringProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC8JSString12toThisStringEPNS_9ExecStateE
-__ZNK3JSC10JSValuePtr9toIntegerEPNS_9ExecStateE
-__ZN3JSC11JSImmediate12nonInlineNaNEv
-__ZNK3JSC7UString4findERKS0_i
-__ZN3JSC11Interpreter11cti_op_lessEPvz
-__ZN3JSC11Interpreter17cti_op_new_regexpEPvz
-__ZN3JSC12RegExpObjectC1EN3WTF10PassRefPtrINS_9StructureEEENS2_INS_6RegExpEEE
-__ZN3JSCL20stringProtoFuncMatchEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC6JSCell8isObjectEPKNS_9ClassInfoE
-__ZNK3JSC12RegExpObject9classInfoEv
-__ZN3JSC17RegExpConstructor12performMatchEPNS_6RegExpERKNS_7UStringEiRiS6_PPi
-__ZN3JSC6RegExp5matchERKNS_7UStringEiPN3WTF11OwnArrayPtrIiEE
-__ZNK3JSC8JSObject9toBooleanEPNS_9ExecStateE
-__ZNK3JSC7UString8toUInt32EPbb
-__ZNK3JSC7UString8toDoubleEbb
-__ZN3WTF6VectorIcLm32EE6resizeEm
-__ZN3JSC11Interpreter16cti_op_nstricteqEPvz
-__ZN3JSC10JSValuePtr19strictEqualSlowCaseES0_S0_
-__ZN3JSC11Interpreter19cti_op_new_func_expEPvz
-__ZN3JSC12FuncExprNode12makeFunctionEPNS_9ExecStateEPNS_14ScopeChainNodeE
+__ZN3JSC3JIT28emitSlow_op_construct_verifyEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC7UString4fromEj
+__ZN3JSC10Identifier11addSlowCaseEPNS_9ExecStateEPNS_7UString3RepE
+__ZN3JSC8JITStubs10cti_op_notEPPv
+__ZN3JSC8JITStubs24cti_op_get_by_id_genericEPPv
+__ZN3JSC7JSArrayC2EN3WTF10PassRefPtrINS_9StructureEEERKNS_7ArgListE
+__ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL24stringProtoFuncSubstringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs31cti_op_construct_NotJSConstructEPPv
+__ZN3JSC3JIT33privateCompilePatchGetArrayLengthENS_22AbstractMacroAssemblerINS_12X86AssemblerEE22ProcessorReturnAddressE
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_listEPPv
+__ZN3JSC3JIT30privateCompileGetByIdProtoListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureES6_mP
+__ZN3JSC3JIT16patchGetByIdSelfEPNS_17StructureStubInfoEPNS_9StructureEmNS_22AbstractMacroAssemblerINS_12X86AssemblerEE22Process
+__ZN3JSC14StructureChainC1EPNS_9StructureE
+__ZN3JSC14StructureChainC2EPNS_9StructureE
+__ZN3JSC3JIT26privateCompileGetByIdChainEPNS_17StructureStubInfoEPNS_9StructureEPNS_14StructureChainEmmNS_22AbstractMacroAssemb
+__ZN3JSC8JITStubs23cti_op_put_by_id_secondEPPv
+__ZN3JSC8JITStubs15tryCachePutByIDEPNS_9ExecStateEPNS_9CodeBlockEPvNS_7JSValueERKNS_15PutPropertySlotE
+__ZN3JSC8JITStubs24cti_op_put_by_id_genericEPPv
+__ZN3JSC8JITStubs26cti_op_tear_off_activationEPPv
+__ZN3JSC8JITStubs21cti_op_ret_scopeChainEPPv
+__ZN3JSC17BytecodeGenerator16emitPutScopedVarEmiPNS_10RegisterIDENS_7JSValueE
+__ZN3JSC3JIT22emit_op_get_scoped_varEPNS_11InstructionE
+__ZN3JSC3JIT22emit_op_put_scoped_varEPNS_11InstructionE
+__ZN3JSC3JIT29emitPutVariableObjectRegisterENS_3X8610RegisterIDES2_i
+__ZN3JSC12X86Assembler7movq_rrENS_3X8610RegisterIDENS1_13XMMRegisterIDE
+__ZN3WTF20TCMalloc_ThreadCache18DestroyThreadCacheEPv
+__ZN3WTF20TCMalloc_ThreadCache11DeleteCacheEPS0_
+__ZN3JSC15StrictEqualNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15StrictEqualNodeD0Ev
+__ZN3JSC3JIT16emit_op_stricteqEPNS_11InstructionE
+__ZN3JSC3JIT17compileOpStrictEqEPNS_11InstructionENS0_21CompileOpStrictEqTypeE
+__ZN3JSC3JIT20emitSlow_op_stricteqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs15cti_op_stricteqEPPv
+__ZN3WTF12detachThreadEj
+__ZN3WTFL26pthreadHandleForIdentifierEj
+__ZN3WTFL31clearPthreadHandleForIdentifierEj
+__ZN3WTF6VectorIPNS0_IN3JSC10IdentifierELm64EEELm32EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPNS0_IN3JSC10IdentifierELm64EEELm32EE15reserveCapacityEm
+__ZN3JSC8NullNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8NullNodeD0Ev
+__ZN3WTF7HashMapISt4pairINS_6RefPtrIN3JSC7UString3RepEEEjEPNS3_9StructureENS3_28StructureTransitionTableHashENS3_34StructureTra
+__ZN3WTF9HashTableISt4pairINS_6RefPtrIN3JSC7UString3RepEEEjES1_IS7_PNS3_9StructureEENS_18PairFirstExtractorISA_EENS3_28Structur
+__ZN3JSC9Structure22materializePropertyMapEv
+__ZN3JSC15TypeOfValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15TypeOfValueNodeD0Ev
+__ZN3JSC12NotEqualNodeD0Ev
+__ZN3JSC3JIT11emit_op_neqEPNS_11InstructionE
+__ZN3JSC3JIT15emitSlow_op_neqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs13cti_op_typeofEPPv
+__ZN3JSC20jsTypeStringForValueEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC8JITStubs10cti_op_neqEPPv
+__ZN3JSC14ExecutablePool13systemReleaseERKNS0_10AllocationE
+__ZN3WTF6VectorItLm0EE14expandCapacityEmPKt
+__ZNK3JSC10NumberNode8isNumberEv
+__ZNK3JSC14ExpressionNode10isLocationEv
+__ZN3WTF6VectorIPN3JSC10RegisterIDELm32EE14expandCapacityEm
+__ZNK3JSC11BooleanNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC4Yarr13newlineCreateEv
+__ZN3JSC12X86Assembler23X86InstructionFormatter15emitRexIfNeededEiii
+__ZN3JSC12X86Assembler23X86InstructionFormatter11memoryModRMEiNS_3X8610RegisterIDES3_ii
+__ZN3JSC17TypeOfResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator15emitResolveBaseEPNS_10RegisterIDERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator20emitLoadGlobalObjectEPNS_10RegisterIDEPNS_8JSObjectE
+__ZN3WTF6VectorIN3JSC7JSValueELm0EE14expandCapacityEm
+__ZNK3JSC7AddNode5isAddEv
+__ZN3JSC12BinaryOpNode10emitStrcatERNS_17BytecodeGeneratorEPNS_10RegisterIDES4_PNS_21ReadModifyResolveNodeE
+__ZNK3JSC10StringNode8isStringEv
+__ZNK3JSC14ExpressionNode8isStringEv
+__ZN3JSC17BytecodeGenerator10emitStrcatEPNS_10RegisterIDES2_i
+__ZN3JSC4Yarr12spacesCreateEv
+__ZN3JSC4Yarr15nonspacesCreateEv
+__ZN3JSC8WithNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13emitPushScopeEPNS_10RegisterIDE
+__ZN3JSC23MacroAssemblerX86Common4moveENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_3X8610RegisterIDE
+__ZN3JSC14MacroAssembler4peekENS_3X8610RegisterIDEi
+__ZN3JSC4Yarr14RegexGenerator12atEndOfInputEv
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList6linkToENS2_5LabelEPS2_
+__ZN3JSC14MacroAssembler4pokeENS_3X8610RegisterIDEi
+__ZN3JSC21FunctionCallValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9ArrayNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator12emitNewArrayEPNS_10RegisterIDEPNS_11ElementNodeE
+__ZN3JSC23CallFunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator25emitJumpIfNotFunctionCallEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC4Yarr14RegexGenerator29generateAssertionWordBoundaryERNS1_19TermGenerationStateE
+__ZN3JSC4Yarr14RegexGenerator22matchAssertionWordcharERNS1_19TermGenerationStateERNS_22AbstractMacroAssemblerINS_12X86Assembler
+__ZN3WTF6VectorIPN3JSC4Yarr18PatternDisjunctionELm4EE14expandCapacityEm
+__ZL14compileBracketiPiPPhPPKtS3_P9ErrorCodeiS_S_R11CompileData
+__ZN3JSC9ThrowNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9CommaNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3WTF9HashTableIdSt4pairIdN3JSC7JSValueEENS_18PairFirstExtractorIS4_EENS_9FloatHashIdEENS_14PairHashTraitsINS_10HashTraitsId
+__ZN3JSC17TypeOfResolveNodeD0Ev
+__ZN3JSC18NotStrictEqualNodeD0Ev
+__ZN3JSC8WithNodeD0Ev
+__ZN3JSC21FunctionCallValueNodeD0Ev
+__ZN3JSC9ArrayNodeD0Ev
+__ZN3JSC11ElementNodeD0Ev
+__ZN3JSC23CallFunctionCallDotNodeD0Ev
+__ZN3JSC9ThrowNodeD0Ev
+__ZN3JSC9CommaNodeD0Ev
+__ZN3JSC3JIT23emit_op_unexpected_loadEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_to_primitiveEPNS_11InstructionE
+__ZN3JSC3JIT14emit_op_strcatEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_nstricteqEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_push_scopeEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_new_arrayEPNS_11InstructionE
+__ZN3JSC3JIT16emit_op_jneq_ptrEPNS_11InstructionE
+__ZN3JSC3JIT13emit_op_throwEPNS_11InstructionE
+__ZN3JSC3JIT14emit_op_jnlessEPNS_11InstructionE
+__ZN3JSC3JIT24emitSlow_op_to_primitiveEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21emitSlow_op_nstricteqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT18emitSlow_op_jnlessEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZL15makePostfixNodePvPN3JSC14ExpressionNodeENS0_8OperatorEiii
+__ZN3JSC18PostfixResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC18PostfixResolveNodeD0Ev
+__ZN3JSC8JITStubs22cti_op_call_arityCheckEPPv
+__ZN3JSC19FunctionConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL32constructWithFunctionConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC17constructFunctionEPNS_9ExecStateERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
+__ZN3JSCplERKNS_7UStringES2_
+__ZN3JSC7UString6appendERKS0_
+__ZN3JSC7UString17expandPreCapacityEi
+__ZN3WTF11fastReallocILb0EEEPvS1_m
+__ZN3JSC14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZL11makeDivNodePvPN3JSC14ExpressionNodeES2_b
+__ZL12makeMultNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC9WhileNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC7ModNodeD0Ev
+__ZN3JSC7DivNodeD0Ev
+__ZN3JSC8MultNodeD0Ev
+__ZN3JSC9WhileNodeD0Ev
+__ZN3JSC3JIT11emit_op_modEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_mulEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_loop_if_trueEPNS_11InstructionE
+__ZN3JSC3JIT15emitSlow_op_modEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT15emitSlow_op_mulEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT24emitSlow_op_loop_if_trueEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSCL26stringProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7JSValue20toIntegerPreserveNaNEPNS_9ExecStateE
+__ZN3JSC8JITStubs10cti_op_divEPPv
+__ZN3JSC3JIT22emit_op_loop_if_lesseqEPNS_11InstructionE
+__ZN3JSC3JIT26emitSlow_op_loop_if_lesseqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs13cti_op_lesseqEPPv
+__ZN3JSCL20stringProtoFuncSplitEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC19constructEmptyArrayEPNS_9ExecStateE
+__ZN3JSC7JSArray3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC7JSArray11putSlowCaseEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC14ArrayPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL18arrayProtoFuncJoinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF7HashSetIPN3JSC8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC8JSObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF6VectorItLm256EE6appendItEEvPKT_m
+__ZN3WTF6VectorItLm256EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC12CallLinkInfoELm0EE15reserveCapacityEm
+__ZN3JSC4Heap7collectEv
+__ZN3JSC4Heap30markStackObjectsConservativelyEv
+__ZN3JSC4Heap31markCurrentThreadConservativelyEv
+__ZN3JSC4Heap39markCurrentThreadConservativelyInternalEv
+__ZN3JSC4Heap18markConservativelyEPvS1_
+__ZN3JSC7JSArray4markEv
+__ZN3JSC8JSObject4markEv
+__ZN3JSC10JSFunction4markEv
+__ZN3JSC6JSCell4markEv
+__ZN3JSC14JSGlobalObject4markEv
+__ZN3JSC15JSWrapperObject4markEv
+__ZN3JSC18GlobalEvalFunction4markEv
+__ZN3JSC16FunctionBodyNode4markEv
+__ZN3JSC9CodeBlock4markEv
+__ZN3JSC4Heap20markProtectedObjectsEv
+__ZN3JSC12SmallStrings4markEv
+__ZN3JSC4Heap5sweepILNS_8HeapTypeE0EEEmv
+__ZN3JSC14JSGlobalObjectD2Ev
+__ZN3JSC17FunctionPrototypeD1Ev
+__ZN3JSC15ObjectPrototypeD1Ev
+__ZN3JSC14ArrayPrototypeD1Ev
+__ZN3JSC15StringPrototypeD1Ev
+__ZN3JSC16BooleanPrototypeD1Ev
+__ZN3JSC15NumberPrototypeD1Ev
+__ZN3JSC13DatePrototypeD1Ev
+__ZN3JSC12DateInstanceD2Ev
+__ZN3JSC15RegExpPrototypeD1Ev
+__ZN3JSC14ErrorPrototypeD1Ev
+__ZN3JSC20NativeErrorPrototypeD1Ev
+__ZN3JSC17ObjectConstructorD1Ev
+__ZN3JSC19FunctionConstructorD1Ev
+__ZN3JSC16ArrayConstructorD1Ev
+__ZN3JSC17StringConstructorD1Ev
+__ZN3JSC18BooleanConstructorD1Ev
+__ZN3JSC17NumberConstructorD1Ev
+__ZN3JSC15DateConstructorD1Ev
+__ZN3JSC17RegExpConstructorD1Ev
+__ZN3JSC16ErrorConstructorD1Ev
+__ZN3JSC22NativeErrorConstructorD1Ev
+__ZN3JSC10MathObjectD1Ev
+__ZN3JSC18GlobalEvalFunctionD1Ev
+__ZN3JSC8JSObjectD1Ev
+__ZN3JSC9CodeBlock13unlinkCallersEv
+__ZN3WTF6VectorINS_6RefPtrIN3JSC6RegExpEEELm0EE6shrinkEm
+__ZN3JSC12JSActivationD1Ev
+__ZN3JSC12JSActivationD2Ev
+__ZN3JSC12RegExpObjectD1Ev
+__ZN3JSC18RegExpMatchesArrayD1Ev
+__ZN3JSC4Heap5sweepILNS_8HeapTypeE1EEEmv
+__ZN3JSC20globalFuncParseFloatEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF17TCMalloc_PageHeap3NewEm
+__ZN3JSC8JITStubs28cti_op_construct_JSConstructEPPv
+__ZN3JSC8JSObject17createInheritorIDEv
 __ZNK3JSC19BracketAccessorNode10isLocationEv
 __ZNK3JSC19BracketAccessorNode21isBracketAccessorNodeEv
-__ZN3JSC9ForInNodeC2EPNS_12JSGlobalDataERKNS_10IdentifierEPNS_14ExpressionNodeES7_PNS_13StatementNodeEiii
-__ZN3JSC19BracketAccessorNodeD1Ev
-__ZN3JSC19BracketAccessorNode12releaseNodesERNS_12NodeReleaserE
-__ZNK3JSC9ForInNode6isLoopEv
-__ZN3JSC9ForInNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSCL20dateProtoFuncSetTimeEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC20EvalFunctionCallNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator19emitResolveWithBaseEPNS_10RegisterIDES2_RKNS_10IdentifierE
-__ZN3JSC20EvalFunctionCallNodeD1Ev
-__ZN3JSC20EvalFunctionCallNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC3JIT26compileOpCallEvalSetupArgsEPNS_11InstructionE
-__ZN3JSC11Interpreter24cti_op_resolve_with_baseEPvz
-__ZN3JSC11Interpreter16cti_op_call_evalEPvz
-__ZN3JSC11Interpreter8callEvalEPNS_9ExecStateEPNS_12RegisterFileEPNS_8RegisterEiiRNS_10JSValuePtrE
-__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS1_INS2_8EvalNodeEEENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3getEPS4_
+__ZN3JSC17AssignBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator12emitPutByValEPNS_10RegisterIDES2_S2_
+__ZN3JSC14PostfixDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17ReadModifyDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17AssignBracketNodeD0Ev
+__ZN3JSC14PostfixDotNodeD0Ev
+__ZN3JSC17ReadModifyDotNodeD0Ev
+__ZN3JSC3JIT18emit_op_put_by_valEPNS_11InstructionE
+__ZN3JSC3JIT22emitSlow_op_put_by_valEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC16ArrayConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL29constructWithArrayConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSCL27constructArrayWithSizeQuirkEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8JITStubs23cti_op_put_by_val_arrayEPPv
+__ZN3JSC8JITStubs13cti_op_strcatEPPv
+__ZN3JSC7UString3Rep15reserveCapacityEi
+__ZN3JSC7UString13appendNumericEi
+__ZN3JSC11concatenateEPNS_7UString3RepEi
+__ZN3JSC12JSActivation18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL18stringFromCharCodeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC16globalFuncEscapeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26stringProtoFuncToUpperCaseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12JSActivation14isDynamicScopeEv
+__ZN3WTF6VectorINS_6RefPtrIN3JSC10RegisterIDEEELm16EE14expandCapacityEm
+__ZN3JSC17ObjectConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL30constructWithObjectConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC8JITStubs17cti_op_put_by_valEPPv
+__ZN3JSC15DateConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL28constructWithDateConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC13constructDateEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8JITStubs18cti_op_is_functionEPPv
+__ZN3JSC16jsIsFunctionTypeENS_7JSValueE
+__ZN3JSC10Identifier5equalEPKNS_7UString3RepEPKc
+__ZN3JSC11JSImmediate8toStringENS_7JSValueE
+__ZN3JSC7UString4fromEi
 __ZN3JSC7UString3Rep11computeHashEPKti
-__ZN3JSC6Parser5parseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPiPNS_7UStringE
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS1_INS2_8EvalNodeEEEENS_18PairFirstExtractorIS9_EENS_7StrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSF_IS8_EEEESG_E6rehashEi
-__ZN3JSC9ExecState9thisValueEv
-__ZN3JSC11Interpreter7executeEPNS_8EvalNodeEPNS_9ExecStateEPNS_8JSObjectEiPNS_14ScopeChainNodeEPNS_10JSValuePtrE
-__ZN3JSC8EvalNode16generateBytecodeEPNS_14ScopeChainNodeE
-__ZN3JSC17BytecodeGeneratorC2EPNS_8EvalNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3RepEEENS_16SymbolTableEntryENS_17IdentifierRepHashENS9_10HashTraitsISE_EENS_26SymbolTableIndexHashTraitsEEEPNS_13EvalCodeBlockE
-__ZN3JSC8EvalNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC18globalFuncParseIntEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL24dateProtoFuncToGMTStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC10formatTimeERKNS_17GregorianDateTimeEb
+__ZNK3JSC8NullNode6isNullEv
 __ZN3JSC9BreakNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
 __ZN3JSC17BytecodeGenerator11breakTargetERKNS_10IdentifierE
-__ZN3JSC9BreakNodeD1Ev
-__ZN3JSC8JSString18getPrimitiveNumberEPNS_9ExecStateERdRNS_10JSValuePtrE
-__ZNK3JSC8JSString8toNumberEPNS_9ExecStateE
-__ZL18makeRightShiftNodePvPN3JSC14ExpressionNodeES2_b
-__ZN3JSC4WREC14CharacterClass6digitsEv
-__ZNK3JSC14RightShiftNode8opcodeIDEv
-__ZN3JSC14RightShiftNodeD1Ev
-__ZN3JSC3JIT26compileFastArith_op_rshiftEjjj
-__ZN3JSC3JIT30compileFastArithSlow_op_rshiftEjjjRPNS_13SlowCaseEntryE
-__ZN3JSCL20dateProtoFuncSetYearEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC21gregorianDateTimeToMSERKNS_17GregorianDateTimeEdb
-__ZN3JSCL15dateToDayInYearEiii
-__ZN3JSC8EvalNode4markEv
-__ZN3JSC19JSStaticScopeObjectD0Ev
-__ZN3JSC18PostfixBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC18PostfixBracketNodeD1Ev
-__ZN3JSC18PostfixBracketNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC9ForInNodeC2EPNS_12JSGlobalDataEPNS_14ExpressionNodeES4_PNS_13StatementNodeE
-__ZN3JSC21ReadModifyBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC21ReadModifyBracketNodeD1Ev
-__ZN3JSC21ReadModifyBracketNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSCL20arrayProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
+__ZN3JSC9BreakNodeD0Ev
+__ZN3JSC3JIT15emit_op_eq_nullEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_is_undefinedEPPv
+__ZN3JSC12JSActivation4markEv
+__ZN3JSC12DateInstanceD1Ev
+__ZNK3JSC18EmptyStatementNode16isEmptyStatementEv
+__ZN3JSC18EmptyStatementNodeD0Ev
+__ZN3JSC3JIT15emit_op_pre_decEPNS_11InstructionE
+__ZN3JSC3JIT19emitSlow_op_pre_decEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3WTF13tryFastMallocEm
+__ZN3JSC8JITStubs17cti_timeout_checkEPPv
+__ZN3JSC14TimeoutChecker10didTimeOutEPNS_9ExecStateE
+__ZN3JSC8JITStubs14cti_op_pre_decEPPv
+__ZN3JSC13jsAddSlowCaseEPNS_9ExecStateENS_7JSValueES2_
+__ZNK3JSC8JSString11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8JSObject11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8JSObject12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZN3JSCL22objectProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25functionProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC10JSFunction9classInfoEv
+__ZNK3JSC21UStringSourceProvider8getRangeEii
+__ZNK3JSC7UString6substrEii
+__ZN3JSC8JITStubs26cti_op_get_by_id_self_failEPPv
+__ZN3JSC3JIT29privateCompileGetByIdSelfListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureEm
+__ZN3JSC8JITStubs16cti_op_nstricteqEPPv
+__ZN3JSC9ForInNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator20emitNextPropertyNameEPNS_10RegisterIDES2_PNS_5LabelE
+__ZN3JSC9ForInNodeD0Ev
+__ZN3JSC3JIT18emit_op_next_pnameEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_get_pnamesEPPv
+__ZN3JSC8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3JSC9Structure26getEnumerablePropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayEPNS_8JSObjectE
+__ZN3JSC9Structure35getEnumerableNamesFromPropertyTableERNS_17PropertyNameArrayE
+__ZN3JSC8JITStubs17cti_op_next_pnameEPPv
+__ZN3JSC13jsOwnedStringEPNS_12JSGlobalDataERKNS_7UStringE
+__ZN3JSC22JSPropertyNameIterator10invalidateEv
+__ZN3JSC3JIT22emit_op_init_argumentsEPNS_11InstructionE
+__ZN3JSC3JIT24emit_op_create_argumentsEPNS_11InstructionE
+__ZN3JSC8JITStubs33cti_op_create_arguments_no_paramsEPPv
+__ZN3JSC9Arguments18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC3JIT16emit_op_post_decEPNS_11InstructionE
+__ZN3JSC3JIT20emitSlow_op_post_decEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs15cti_op_post_decEPPv
+__ZN3JSC9Arguments18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC17RegExpConstructor18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC17RegExpConstructor3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC6JSCell11getCallDataERNS_8CallDataE
+__ZN3JSC10JSFunction3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JITStubs16cti_op_new_arrayEPPv
+__ZN3JSC14constructArrayEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL18arrayProtoFuncPushEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL30comparePropertyMapEntryIndicesEPKvS1_
+__ZN3WTF6VectorIN3JSC10IdentifierELm20EE15reserveCapacityEm
+__ZN3JSC12StringObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JITStubs17cti_op_push_scopeEPPv
+__ZN3JSC8JITStubs14cti_op_resolveEPPv
+__ZN3JSC8JITStubs16cti_op_pop_scopeEPPv
+__ZN3JSC3JIT31privateCompilePutByIdTransitionEPNS_17StructureStubInfoEPNS_9StructureES4_mPNS_14StructureChainENS_22AbstractMacr
+__ZN3JSC20MacroAssemblerX86_649branchPtrENS_23MacroAssemblerX86Common9ConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE
+__ZN3JSC3JIT19patchPutByIdReplaceEPNS_17StructureStubInfoEPNS_9StructureEmNS_22AbstractMacroAssemblerINS_12X86AssemblerEE22Proc
+__ZN3JSC17NumberConstructor18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC8JITStubs16cti_op_is_stringEPPv
+__ZN3JSC8JITStubs19cti_op_convert_thisEPPv
+__ZNK3JSC8JSString12toThisObjectEPNS_9ExecStateE
+__ZN3JSCL22stringProtoFuncReplaceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12StringObject14toThisJSStringEPNS_9ExecStateE
+__ZN3JSCL21arrayProtoFuncForEachEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC11Interpreter20prepareForRepeatCallEPNS_16FunctionBodyNodeEPNS_9ExecStateEPNS_10JSFunctionEiPNS_14ScopeChainNodeEPNS_7J
+__ZN3JSC3JIT16emit_op_post_incEPNS_11InstructionE
+__ZN3JSC3JIT20emitSlow_op_post_incEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC11Interpreter7executeERNS_16CallFrameClosureEPNS_7JSValueE
+__ZN3JSC10MathObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC11Interpreter13endRepeatCallERNS_16CallFrameClosureE
+__ZN3JSCL21resizePropertyStorageEPNS_8JSObjectEii
+__ZN3JSC8JSObject23allocatePropertyStorageEmm
+__ZN3JSC14ExecutablePool12poolAllocateEm
+__ZN3JSC9Arguments4markEv
+__ZN3JSC22JSPropertyNameIterator4markEv
+__ZN3JSC3JIT10unlinkCallEPNS_12CallLinkInfoE
+__ZN3JSC22JSPropertyNameIteratorD1Ev
+__ZN3JSC9ArgumentsD1Ev
+__ZN3JSC9ArgumentsD2Ev
+__ZN3JSC12StringObjectD1Ev
+__ZN3WTF6VectorIPN3JSC9StructureELm8EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN3JSC9StructureELm8EE15reserveCapacityEm
+__ZN3JSCL19arrayProtoFuncShiftEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL11getPropertyEPNS_9ExecStateEPNS_8JSObjectEj
+__ZN3JSC7JSArray14deletePropertyEPNS_9ExecStateEj
+__ZN3JSC7JSArray9setLengthEj
+__ZN3JSC7UString6appendEPKc
+__ZN3JSC8JITStubs23cti_op_create_argumentsEPPv
+__ZN3JSCL19arrayProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7JSValue9toIntegerEPNS_9ExecStateE
+__ZN3JSC24ApplyFunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode13isSimpleArrayEv
+__ZN3JSC17BytecodeGenerator26emitJumpIfNotFunctionApplyEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC17BytecodeGenerator15emitCallVarargsEPNS_10RegisterIDES2_S2_S2_jjj
+__ZN3JSC24ApplyFunctionCallDotNodeD0Ev
+__ZN3JSC3JIT20emit_op_load_varargsEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_call_varargsEPNS_11InstructionE
+__ZN3JSC3JIT20compileOpCallVarargsEPNS_11InstructionE
+__ZN3JSC3JIT29compileOpCallVarargsSetupArgsEPNS_11InstructionE
+__ZN3JSC3JIT24emitSlow_op_call_varargsEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT28compileOpCallVarargsSlowCaseEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs19cti_op_load_varargsEPPv
+__ZNK3JSC7JSArray9classInfoEv
+__ZN3JSC7JSArray15copyToRegistersEPNS_9ExecStateEPNS_8RegisterEj
+__ZNK3JSC7UString30spliceSubstringsWithSeparatorsEPKNS0_5RangeEiPKS0_i
+__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC7UString4fromEd
+__ZN3WTF4dtoaEPcdiPiS1_PS0_
+__ZN3JSC8JITStubs21cti_op_put_by_id_failEPPv
+__ZN3JSC13DeleteDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14emitDeleteByIdEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3JSC13DeleteDotNodeD0Ev
+__ZN3JSC3JIT17emit_op_del_by_idEPNS_11InstructionE
+__ZN3JSC8JITStubs16cti_op_del_by_idEPPv
+__ZN3JSC10JSFunction14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZNK3JSC7ArgList8getSliceEiRS0_
+__ZN3JSC3JIT26emit_op_tear_off_argumentsEPNS_11InstructionE
+__ZN3JSC8JITStubs25cti_op_tear_off_argumentsEPPv
+__ZNK3JSC12StringObject12toThisStringEPNS_9ExecStateE
+__ZN3JSC13PrefixDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13PrefixDotNodeD0Ev
+__ZNK3JSC8JSObject8toStringEPNS_9ExecStateE
+__ZN3JSCL22arrayProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21arrayProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC16ErrorConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL29constructWithErrorConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC14constructErrorEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL21stringProtoFuncCharAtEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs32cti_op_get_by_id_proto_list_fullEPPv
+__ZN3JSC14InstanceOfNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14emitInstanceOfEPNS_10RegisterIDES2_S2_S2_
+__ZN3JSC14InstanceOfNodeD0Ev
+__ZN3JSC3JIT18emit_op_instanceofEPNS_11InstructionE
+__ZN3JSC3JIT22emitSlow_op_instanceofEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC12X86Assembler6orl_irEiNS_3X8610RegisterIDE
 __ZN3JSC17RegExpConstructor16getConstructDataERNS_13ConstructDataE
 __ZN3JSCL30constructWithRegExpConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
 __ZN3JSC15constructRegExpEPNS_9ExecStateERKNS_7ArgListE
-__ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC8JSObject9classNameEv
-__ZN3JSC18RegExpMatchesArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSCL20stringProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC8NullNode6isNullEv
-__ZN3JSC17StringConstructor11getCallDataERNS_8CallDataE
-__ZN3JSCL21callStringConstructorEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC12StringObject8toStringEPNS_9ExecStateE
-__ZN3JSCL23stringProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter28cti_op_get_by_id_string_failEPvz
-__ZN3JSCL19regExpProtoFuncExecEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter16cti_op_is_numberEPvz
+__ZN3JSC13DatePrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL20dateProtoFuncGetTimeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12DateInstance9classInfoEv
+__ZN3JSC12RegExpObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL19regExpProtoFuncTestEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12RegExpObject5matchEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC3JIT18emit_op_jmp_scopesEPNS_11InstructionE
+__ZN3JSC3JIT30privateCompileGetByIdChainListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureEPNS_1
+__ZN3JSC18globalFuncUnescapeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7UString6appendEt
+__ZN3JSC8JSObject3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC17PropertyNameArray3addEPNS_7UString3RepE
+__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPN3JSC7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashEi
+__ZN3WTF6VectorIN3JSC10IdentifierELm20EE14expandCapacityEm
+__ZN3JSCL20arrayProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC9ArrayNode13isSimpleArrayEv
+__ZN3JSC8JITStubs10cti_op_mulEPPv
+__ZN3JSC8JITStubs16cti_op_is_objectEPPv
+__ZN3JSC14jsIsObjectTypeENS_7JSValueE
+__ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_7JSValueE
+__ZN3JSC9CodeBlock34reparseForExceptionInfoIfNecessaryEPNS_9ExecStateE
+__ZNK3JSC10ScopeChain10localDepthEv
+__ZNK3JSC12JSActivation9classInfoEv
+__ZN3JSC6Parser7reparseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EEPNS_12JSGlobalDataEPS5_
+__ZN3JSC16FunctionBodyNode6createEPNS_12JSGlobalDataEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS6_IP
+__ZN3JSC13StatementNode6setLocEii
+__ZN3JSC16FunctionBodyNode14copyParametersEv
+__ZN3JSC16FunctionBodyNode13finishParsingEPNS_10IdentifierEm
+__ZN3JSC16FunctionBodyNode31bytecodeForExceptionInfoReparseEPNS_14ScopeChainNodeEPNS_9CodeBlockE
+__ZN3JSC9CodeBlock36hasGlobalResolveInfoAtBytecodeOffsetEj
+__ZN3JSC9CodeBlock27lineNumberForBytecodeOffsetEPNS_9ExecStateEj
+__ZN3WTF6VectorIPvLm0EE14expandCapacityEmPKS1_
+__ZN3WTF6VectorIPvLm0EE15reserveCapacityEm
+__ZN3JSC3JIT16emit_op_jeq_nullEPNS_11InstructionE
+__ZN3JSC8JITStubs16cti_op_is_numberEPPv
+__ZN3JSCL23stringProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZNK3JSC12StringObject9classInfoEv
-__ZN3JSC11Interpreter16cti_op_is_objectEPvz
-__ZN3JSC3JIT30privateCompileGetByIdChainListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureEPNS_14StructureChainEmmPNS_9ExecStateE
-__ZN3JSCL23numberProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC10Identifier5equalEPKNS_7UString3RepEPKc
+__ZN3JSC8JITStubs28cti_op_get_by_id_string_failEPPv
+__ZN3JSC11JSImmediate9prototypeENS_7JSValueEPNS_9ExecStateE
+__ZN3JSCL23numberProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC3JIT16emit_op_neq_nullEPNS_11InstructionE
+__ZN3JSC4Yarr23RegexPatternConstructor8copyTermERNS0_11PatternTermE
+__ZL17bracketIsAnchoredPKh
+__ZL32branchFindFirstAssertedCharacterPKhb
+__ZL20branchNeedsLineStartPKhjj
+__ZN3JSC18RegExpMatchesArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL20stringProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC3JIT17emit_op_jneq_nullEPNS_11InstructionE
+__ZN3JSC8JITStubs25cti_op_call_NotJSFunctionEPPv
+__ZN3JSC17StringConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL21callStringConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12StringObject8toStringEPNS_9ExecStateE
+__ZN3JSC23FunctionCallBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC20EvalFunctionCallNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator19emitResolveWithBaseEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3JSC23FunctionCallBracketNodeD0Ev
+__ZN3JSC20EvalFunctionCallNodeD0Ev
+__ZN3JSC3JIT25emit_op_resolve_with_baseEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_call_evalEPNS_11InstructionE
+__ZN3JSC3JIT21emitSlow_op_call_evalEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC14MacroAssembler4jumpENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5LabelE
+__ZN3JSCL19regExpProtoFuncExecEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString12replaceRangeEiiRKS0_
+__ZN3JSC8JITStubs17cti_op_is_booleanEPPv
+__ZN3JSC3JIT22emit_op_put_global_varEPNS_11InstructionE
+__ZN3JSCL23regExpProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18regExpObjectSourceEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL18regExpObjectGlobalEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL22regExpObjectIgnoreCaseEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL21regExpObjectMultilineEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC4Yarr14RegexGenerator30generatePatternCharacterGreedyERNS1_19TermGenerationStateE
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_failEPPv
+__ZN3JSC17DeleteResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17DeleteResolveNodeD0Ev
+__ZN3JSC3JIT20emit_op_resolve_baseEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_resolve_baseEPPv
+__ZN3JSC12JSActivation14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC16JSVariableObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZNK3JSC8JSString8toNumberEPNS_9ExecStateE
+__ZN3JSC8JITStubs24cti_op_resolve_with_baseEPPv
+__ZN3JSC8JITStubs16cti_op_call_evalEPPv
+__ZN3JSC11Interpreter8callEvalEPNS_9ExecStateEPNS_12RegisterFileEPNS_8RegisterEiiRNS_7JSValueE
+__ZN3JSC13LiteralParser5Lexer3lexERNS1_18LiteralParserTokenE
+__ZN3JSC13LiteralParser14parseStatementEv
+__ZN3JSC13LiteralParser15parseExpressionEv
+__ZN3JSC13LiteralParser10parseArrayEv
+__ZN3JSC13LiteralParser11parseObjectEv
+__ZN3JSC10Identifier3addEPNS_9ExecStateEPKti
+__ZN3JSC7JSArray4pushEPNS_9ExecStateENS_7JSValueE
+__ZN3JSCL19mathProtoFuncRandomEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF16weakRandomNumberEv
+__ZN3JSCL18mathProtoFuncFloorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC4Heap15recordExtraCostEm
+__ZN3JSC6Parser5parseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPiPNS_7UStringE
+__ZN3JSC9ExecState9thisValueEv
+__ZN3JSC11Interpreter7executeEPNS_8EvalNodeEPNS_9ExecStateEPNS_8JSObjectEiPNS_14ScopeChainNodeEPNS_7JSValueE
+__ZN3JSC8EvalNode16generateBytecodeEPNS_14ScopeChainNodeE
+__ZN3JSC17BytecodeGeneratorC2EPNS_8EvalNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3RepEEENS_16
+__ZN3JSC8EvalNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZThn16_N3JSC8EvalNodeD0Ev
+__ZN3JSC8EvalNodeD0Ev
+__ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSObject9classNameEv
+__ZN3JSC11JSImmediate12toThisObjectENS_7JSValueEPNS_9ExecStateE
 __ZNK3JSC6JSCell17getTruncatedInt32ERi
 __ZN3JSC15toInt32SlowCaseEdRb
-__ZNK3JSC12JSNumberCell9toBooleanEPNS_9ExecStateE
+__ZN3JSCL20dateProtoFuncSetYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12DateInstance21msToGregorianDateTimeEdbRNS_17GregorianDateTimeE
+__ZN3JSC21msToGregorianDateTimeEdbRNS_17GregorianDateTimeE
+__ZN3JSCL12getDSTOffsetEdd
+__ZN3JSC21gregorianDateTimeToMSERKNS_17GregorianDateTimeEdb
+__ZN3JSCL15dateToDayInYearEiii
+__ZN3JSC8JITStubs19cti_op_to_primitiveEPPv
+__ZN3JSCL21dateProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC10formatTimeERKNS_17GregorianDateTimeEb
+__ZN3JSCL24dateProtoFuncToGMTStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7UString13appendNumericEd
+__ZN3JSC11concatenateEPNS_7UString3RepEd
+__ZN3JSCL20dateProtoFuncGetYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL20dateProtoFuncGetDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21dateProtoFuncGetMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21dateProtoFuncGetHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncGetMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncGetSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL19dateProtoFuncGetDayEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL30dateProtoFuncGetTimezoneOffsetEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC28createUndefinedVariableErrorEPNS_9ExecStateERKNS_10IdentifierEjPNS_9CodeBlockE
+__ZN3JSC9CodeBlock32expressionRangeForBytecodeOffsetEPNS_9ExecStateEjRiS3_S3_
+__ZN3JSC5Error6createEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringEilS6_
+__ZN3JSC22NativeErrorConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL35constructWithNativeErrorConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC22NativeErrorConstructor9constructEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
+__ZN3JSCL23returnToThrowTrampolineEPNS_12JSGlobalDataEPvRS2_
+_ctiVMThrowTrampoline
+__ZN3JSC8JITStubs12cti_vm_throwEPPv
+__ZN3JSC11Interpreter14throwExceptionERPNS_9ExecStateERNS_7JSValueEjb
+__ZNK3JSC8JSObject22isNotAnObjectErrorStubEv
+__ZNK3JSC8JSObject19isWatchdogExceptionEv
+__ZN3JSC9CodeBlock24handlerForBytecodeOffsetEj
+__ZN3JSC8JITStubs21cti_op_push_new_scopeEPPv
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE4JumpELm16EE14expandCapacityEm
+__ZN3JSCL20dateProtoFuncSetTimeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS1_INS2_8EvalNodeEEENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3getEPS4
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS1_INS2_8EvalNodeEEENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3setEPS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS1_INS2_8EvalNodeEEEENS_18PairFirstExtractorIS9_EENS_7StrHashIS5_
+__ZN3JSC10LessEqNodeD0Ev
+__ZN3JSC8JITStubs14cti_op_jlesseqEPPv
+__ZN3JSC8JSString18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZL18makeRightShiftNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC14RightShiftNodeD0Ev
+__ZN3JSC3JIT14emit_op_rshiftEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_rshiftEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC18PostfixBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC18PostfixBracketNodeD0Ev
+__ZN3JSC21ReadModifyBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21ReadModifyBracketNodeD0Ev
+__ZN3JSC11Interpreter15unwindCallFrameERPNS_9ExecStateENS_7JSValueERjRPNS_9CodeBlockE
+__ZN3JSCL22errorProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF23waitForThreadCompletionEjPPv
+__ZN3WTF15ThreadConditionD1Ev
 __ZN3JSC9Structure24removePropertyTransitionEPS0_RKNS_10IdentifierERm
-__ZN3JSC11Interpreter10cti_op_subEPvz
-__ZN3JSC28globalFuncEncodeURIComponentEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
+__ZN3JSC12JSActivation3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC26createNotAnObjectErrorStubEPNS_9ExecStateEb
+__ZN3JSC13JSNotAnObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZNK3JSC22JSNotAnObjectErrorStub22isNotAnObjectErrorStubEv
+__ZN3JSC22createNotAnObjectErrorEPNS_9ExecStateEPNS_22JSNotAnObjectErrorStubEjPNS_9CodeBlockE
+__ZN3JSC9CodeBlock37getByIdExceptionInfoForBytecodeOffsetEPNS_9ExecStateEjRNS_8OpcodeIDE
+__ZN3JSCL18createErrorMessageEPNS_9ExecStateEPNS_9CodeBlockEiiiNS_7JSValueENS_7UStringE
+__ZN3JSC13ErrorInstanceD1Ev
+__ZN3JSC22JSNotAnObjectErrorStubD1Ev
+__ZN3JSC13JSNotAnObjectD1Ev
+__ZN3JSC19JSStaticScopeObjectD1Ev
+__ZN3JSC19JSStaticScopeObjectD2Ev
+__ZN3JSC17DeleteBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator15emitDeleteByValEPNS_10RegisterIDES2_S2_
+__ZN3JSC17DeleteBracketNodeD0Ev
+__ZN3JSC8JITStubs17cti_op_del_by_valEPPv
+__ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateEj
+__ZN3JSC28globalFuncEncodeURIComponentEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSCL6encodeEPNS_9ExecStateERKNS_7ArgListEPKc
 __ZNK3JSC7UString10UTF8StringEb
 __ZN3WTF7Unicode18convertUTF16ToUTF8EPPKtS2_PPcS4_b
-__ZN3JSC17PrefixResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC10NegateNode8opcodeIDEv
-__ZN3JSC10NegateNodeD1Ev
-__ZN3JSC11Interpreter13cti_op_negateEPvz
-__ZN3JSCL17mathProtoFuncSqrtEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11JSImmediate12toThisObjectENS_10JSValuePtrEPNS_9ExecStateE
-__ZN3JSCL16mathProtoFuncAbsEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL18mathProtoFuncRoundEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL16mathProtoFuncCosEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL16mathProtoFuncSinEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter12cti_op_jlessEPvz
+__ZN3JSC10NegateNodeD0Ev
+__ZN3JSC8JITStubs13cti_op_negateEPPv
+__ZN3JSCL17mathProtoFuncSqrtEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncAbsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18mathProtoFuncRoundEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncCosEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncSinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs10cti_op_subEPPv
 __ZNK3JSC8JSObject8toNumberEPNS_9ExecStateE
 __ZN3JSC16ArrayConstructor11getCallDataERNS_8CallDataE
-__ZN3JSCL20callArrayConstructorEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC12JSNumberCell18getPrimitiveNumberEPNS_9ExecStateERdRNS_10JSValuePtrE
-__ZN3JSC11Interpreter10cti_op_modEPvz
+__ZN3JSCL20callArrayConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs10cti_op_modEPPv
+__ZN3JSC8JITStubs12cti_op_jlessEPPv
 __ZL17makeLeftShiftNodePvPN3JSC14ExpressionNodeES2_b
-__ZNK3JSC13LeftShiftNode8opcodeIDEv
-__ZN3JSC13LeftShiftNodeD1Ev
-__ZN3JSC3JIT26compileFastArith_op_lshiftEjjj
-__ZN3JSC3JIT30compileFastArithSlow_op_lshiftEjjjRPNS_13SlowCaseEntryE
-__ZN3JSCL16mathProtoFuncMaxEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC10BitAndNode8opcodeIDEv
-__ZN3JSC10BitAndNodeD1Ev
-__ZN3JSC3JIT26compileFastArith_op_bitandEjjj
-__ZN3JSC3JIT30compileFastArithSlow_op_bitandEjjjRPNS_13SlowCaseEntryE
-__ZN3JSC11Interpreter13cti_op_bitandEPvz
-__ZNK3JSC14BitwiseNotNode8opcodeIDEv
-__ZN3JSC14BitwiseNotNodeD1Ev
-__ZN3JSC11Interpreter13cti_op_lshiftEPvz
-__ZN3JSC11Interpreter13cti_op_bitnotEPvz
-__ZNK3JSC22UnsignedRightShiftNode8opcodeIDEv
-__ZNK3JSC10BitXOrNode8opcodeIDEv
-__ZN3JSC22UnsignedRightShiftNodeD1Ev
-__ZN3JSC10BitXOrNodeD1Ev
-__ZN3JSCL25stringProtoFuncCharCodeAtEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter14cti_op_urshiftEPvz
-__ZNK3JSC12JSNumberCell18getTruncatedUInt32ERj
+__ZN3JSC13LeftShiftNodeD0Ev
+__ZN3JSC3JIT14emit_op_lshiftEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_lshiftEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC11JITStubCall11addArgumentENS_3X8610RegisterIDE
+__ZN3JSCL16mathProtoFuncMaxEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC10BitAndNodeD0Ev
+__ZN3JSC3JIT14emit_op_bitandEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_bitandEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs13cti_op_bitandEPPv
+__ZN3JSC14BitwiseNotNodeD0Ev
+__ZN3JSC3JIT14emit_op_bitnotEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_bitnotEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC22UnsignedRightShiftNodeD0Ev
+__ZN3JSC10BitXOrNodeD0Ev
+__ZN3JSC3JIT14emit_op_bitxorEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_bitxorEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSCL25stringProtoFuncCharCodeAtEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs14cti_op_urshiftEPPv
 __ZN3JSC16toUInt32SlowCaseEdRb
-__ZN3JSCL17mathProtoFuncCeilEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
+__ZN3JSCL17mathProtoFuncCeilEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZNK3JSC6JSCell18getTruncatedUInt32ERj
-__ZN3JSC11Interpreter12cti_op_bitorEPvz
-__ZNK3JSC12JSNumberCell17getTruncatedInt32ERi
-__ZNK3JSC9BitOrNode8opcodeIDEv
-__ZN3JSC9BitOrNodeD1Ev
-__ZN3JSC11Interpreter13cti_op_rshiftEPvz
-__ZN3JSC11Interpreter13cti_op_bitxorEPvz
+__ZN3JSC3JIT13emit_op_bitorEPNS_11InstructionE
+__ZN3JSC3JIT17emitSlow_op_bitorEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs12cti_op_bitorEPPv
+__ZN3JSC9BitOrNodeD0Ev
+__ZN3JSC8JITStubs13cti_op_rshiftEPPv
+__ZN3JSC8JITStubs13cti_op_bitxorEPPv
 __ZN3JSC9parseDateERKNS_7UStringE
+__ZN3WTF6VectorIN3JSC10CallRecordELm0EE14expandCapacityEmPKS2_
 __ZNK3JSC12JSActivation12toThisObjectEPNS_9ExecStateE
-__ZN3JSC11Interpreter19cti_op_resolve_skipEPvz
-__ZN3JSCL24dateProtoFuncGetFullYearEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
+__ZN3JSC3JIT20emit_op_resolve_skipEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_resolve_skipEPPv
+__ZN3JSCL24dateProtoFuncGetFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSC17StringConstructor16getConstructDataERNS_13ConstructDataE
 __ZN3JSCL30constructWithStringConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
 __ZN3JSC5equalEPKNS_7UString3RepES3_
+__ZN3JSC8EvalNode4markEv
 __ZN3JSC10SwitchNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
 __ZN3JSC13CaseBlockNode20emitBytecodeForBlockERNS_17BytecodeGeneratorEPNS_10RegisterIDES4_
 __ZN3JSC13CaseBlockNode18tryOptimizedSwitchERN3WTF6VectorIPNS_14ExpressionNodeELm8EEERiS7_
 __ZN3JSCL17processClauseListEPNS_14ClauseListNodeERN3WTF6VectorIPNS_14ExpressionNodeELm8EEERNS_10SwitchKindERbRiSB_
-__ZNK3JSC10StringNode8isStringEv
 __ZN3WTF6VectorIPN3JSC14ExpressionNodeELm8EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN3JSC5LabelEEELm8EE14expandCapacityEm
 __ZN3JSC17BytecodeGenerator11beginSwitchEPNS_10RegisterIDENS_10SwitchInfo10SwitchTypeE
@@ -645,994 +1273,693 @@
 __ZN3JSC17BytecodeGenerator9endSwitchEjPN3WTF6RefPtrINS_5LabelEEEPPNS_14ExpressionNodeEPS3_ii
 __ZN3WTF6VectorIN3JSC15SimpleJumpTableELm0EE14expandCapacityEm
 __ZN3WTF6VectorIiLm0EE15reserveCapacityEm
-__ZN3JSC10SwitchNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC13CaseBlockNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC14ClauseListNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC14CaseClauseNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC10SwitchNodeD1Ev
-__ZN3JSC13CaseBlockNodeD1Ev
-__ZN3JSC14ClauseListNodeD1Ev
-__ZN3JSC14CaseClauseNodeD1Ev
+__ZN3JSC14CaseClauseNodeD0Ev
+__ZN3JSC14ClauseListNodeD0Ev
+__ZN3JSC13CaseBlockNodeD0Ev
+__ZN3JSC10SwitchNodeD0Ev
+__ZN3JSC3JIT19emit_op_switch_charEPNS_11InstructionE
 __ZN3WTF6VectorIN3JSC12SwitchRecordELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPvLm0EE15reserveCapacityEm
-__ZN3JSC11Interpreter18cti_op_switch_charEPvz
-__ZN3JSC8EvalNodeD1Ev
-__ZN3JSCL16mathProtoFuncPowEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE17CodeLocationLabelELm0EE4growEm
+__ZN3JSC8JITStubs18cti_op_switch_charEPPv
+__ZN3JSCL16mathProtoFuncPowEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3WTF6VectorIcLm0EE14expandCapacityEm
 __ZN3WTF6VectorIN3JSC7UString5RangeELm16EE14expandCapacityEm
-__ZN3WTF6VectorIN3JSC7UStringELm16EE14expandCapacityEm
-__ZN3WTF17TCMalloc_PageHeap3NewEm
+__ZN3WTF6VectorIN3JSC7UStringELm16EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN3JSC7UStringELm16EE15reserveCapacityEm
 __ZN3JSC7JSArray16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
 __ZN3JSC9ExecState10arrayTableEPS0_
-__ZN3JSCL18regExpObjectSourceEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSC7ArgList10slowAppendENS_10JSValuePtrE
-__ZN3WTF7HashSetIPN3JSC7ArgListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN3JSC7ArgListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
-__ZN3WTF6VectorIN3JSC8RegisterELm8EE15reserveCapacityEm
-__ZN3JSC22JSPropertyNameIterator4markEv
-__ZN3JSCL16mathProtoFuncLogEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL29objectProtoFuncHasOwnPropertyEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL18arrayProtoFuncSortEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC7JSArray4sortEPNS_9ExecStateENS_10JSValuePtrENS_8CallTypeERKNS_8CallDataE
+__ZN3JSC20MarkedArgumentBuffer10slowAppendENS_7JSValueE
+__ZN3WTF9HashTableIPN3JSC20MarkedArgumentBufferES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3JSC8JITStubs24cti_op_get_by_val_stringEPPv
+__ZN3JSCL16mathProtoFuncLogEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString8toDoubleEv
+__ZN3WTF9HashTableIPN3JSC7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22Id
+__ZN3JSCL29objectProtoFuncHasOwnPropertyEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18arrayProtoFuncSortEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArray4sortEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
 __ZN3WTF7AVLTreeIN3JSC32AVLTreeAbstractorForArrayCompareELj44ENS_18AVLTreeDefaultBSetILj44EEEE6insertEi
 __ZN3JSCltERKNS_7UStringES2_
 __ZN3WTF7AVLTreeIN3JSC32AVLTreeAbstractorForArrayCompareELj44ENS_18AVLTreeDefaultBSetILj44EEEE7balanceEi
-__ZN3JSC4WREC9Generator29generateAssertionWordBoundaryERNS_14MacroAssembler8JumpListEb
-__ZN3JSC12X86Assembler23X86InstructionFormatter11memoryModRMEiNS_3X8610RegisterIDES3_ii
-__ZN3JSCL21stringProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC19globalFuncEncodeURIEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC19globalFuncDecodeURIEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
+__Z12jsRegExpFreeP8JSRegExp
+__ZN3JSCL21stringProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC19globalFuncEncodeURIEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC19globalFuncDecodeURIEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSCL6decodeEPNS_9ExecStateERKNS_7ArgListEPKcb
 __ZN3WTF7Unicode18UTF8SequenceLengthEc
 __ZN3WTF7Unicode18decodeUTF8SequenceEPKc
-__ZN3JSC6JSCell18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZNK3JSC12JSNumberCell8toObjectEPNS_9ExecStateE
-__ZN3JSC15constructNumberEPNS_9ExecStateENS_10JSValuePtrE
-__ZN3JSCL22numberProtoFuncToFixedEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC12JSNumberCell11getJSNumberEv
+__ZN3JSCL22numberProtoFuncToFixedEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSCL16integerPartNoExpEd
-__ZN3JSC11Interpreter27cti_op_get_by_id_proto_failEPvz
-__ZN3WTF6VectorIPN3JSC10RegisterIDELm32EE14expandCapacityEm
-__ZN3JSCL17arrayProtoFuncPopEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC7JSArray3popEv
-__ZNK3JSC11DoWhileNode6isLoopEv
-__ZN3JSC11DoWhileNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC11DoWhileNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11DoWhileNodeD1Ev
-__ZN3JSC11Interpreter17cti_op_switch_immEPvz
-__ZN3JSCL16mathProtoFuncMinEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC13UnaryPlusNode14stripUnaryPlusEv
-__ZN3JSC13UnaryPlusNodeD1Ev
-__ZN3JSCL21stringProtoFuncSubstrEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC15globalFuncIsNaNEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC17NumberConstructor11getCallDataERNS_8CallDataE
-__ZN3JSCL21callNumberConstructorEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter15cti_op_post_incEPvz
-__ZN3JSCL23stringProtoFuncFontsizeEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL24dateProtoFuncSetFullYearEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL23setNewValueFromDateArgsEPNS_9ExecStateENS_10JSValuePtrERKNS_7ArgListEib
-__ZN3JSCL24dateProtoFuncToUTCStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL19stringProtoFuncLinkEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL9dateParseEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter21cti_op_loop_if_lesseqEPvz
-__ZN3JSCL16mathProtoFuncExpEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC6RegExp6createEPNS_12JSGlobalDataERKNS_7UStringE
-__ZN3JSCL21dateProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC4WREC9Generator36generateParenthesesInvertedAssertionERNS_14MacroAssembler8JumpListE
-__ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_10JSValuePtrE
-__ZN3JSC9CodeBlock27lineNumberForBytecodeOffsetEPNS_9ExecStateEj
-__ZN3JSCL23regExpProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL18regExpObjectGlobalEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL22regExpObjectIgnoreCaseEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL21regExpObjectMultilineEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSC11Interpreter17cti_op_is_booleanEPvz
-__ZNK3JSC12JSNumberCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
-__ZN3JSC4WREC14CharacterClass9nonspacesEv
-__ZN3JSC4Heap15recordExtraCostEm
-__ZN3WTF6VectorIN3JSC15StringJumpTableELm0EE15reserveCapacityEm
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS2_14OffsetLocationEENS_18PairFirstExtractorIS8_EENS_7StrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSE_IS7_EEEESF_EC2ERKSI_
-__ZN3JSC11Interpreter20cti_op_switch_stringEPvz
-__ZNK3JSC12JSNumberCell12toThisObjectEPNS_9ExecStateE
-__ZN3JSCL22numberProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC12NumberObject11getJSNumberEv
-__ZNK3JSC13UnaryPlusNode8opcodeIDEv
-__ZN3WTF12detachThreadEj
-__ZN3WTFL26pthreadHandleForIdentifierEj
-__ZN3WTFL31clearPthreadHandleForIdentifierEj
-__ZN3WTF15ThreadConditionD1Ev
-__ZN3WTF23waitForThreadCompletionEjPPv
-__ZN3WTF20TCMalloc_ThreadCache18DestroyThreadCacheEPv
-__ZN3WTF20TCMalloc_ThreadCache11DeleteCacheEPS0_
 __ZN3WTF14FastMallocZone10statisticsEP14_malloc_zone_tP19malloc_statistics_t
 __ZN3JSC4Heap26protectedGlobalObjectCountEv
-__ZNK3JSC11ResolveNode10isLocationEv
-__ZNK3JSC11ResolveNode13isResolveNodeEv
-__ZN3JSC17AssignResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator18findScopedPropertyERKNS_10IdentifierERiRmbRPNS_8JSObjectE
-__ZN3JSC17BytecodeGenerator15emitResolveBaseEPNS_10RegisterIDERKNS_10IdentifierE
-__ZN3JSC15DotAccessorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator12newTemporaryEv
-__ZN3JSC10StringNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator8emitLoadEPNS_10RegisterIDERKNS_10IdentifierE
-__ZN3WTF9HashTableIPN3JSC7UString3RepESt4pairIS4_PNS1_8JSStringEENS_18PairFirstExtractorIS8_EENS1_17IdentifierRepHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSD_IS7_EEEESE_E6expandEv
-__ZN3JSC16ArgumentListNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC10StringNodeD1Ev
-__ZN3JSC16ArgumentListNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC16ArgumentListNodeD1Ev
-__ZN3JSC11Interpreter19cti_op_resolve_baseEPvz
-__ZN3JSC14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZNK3JSC8JSString8toStringEPNS_9ExecStateE
-__ZN3JSC13AssignDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC10StringNode6isPureERNS_17BytecodeGeneratorE
-__ZN3JSC13ParameterNode12releaseNodesERNS_12NodeReleaserE
-__ZN3WTF6VectorISt4pairIN3JSC10IdentifierEjELm0EEaSERKS5_
-__ZNK3JSC7UString14toStrictUInt32EPb
-__ZN3JSC17BytecodeGenerator8emitMoveEPNS_10RegisterIDES2_
-__ZN3JSC16VarStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZL12makeMultNodePvPN3JSC14ExpressionNodeES2_b
-__ZN3JSC14ExpressionNode14stripUnaryPlusEv
-__ZN3JSC10NumberNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator8emitLoadEPNS_10RegisterIDEd
-__ZN3WTF9HashTableIdSt4pairIdN3JSC10JSValuePtrEENS_18PairFirstExtractorIS4_EENS_9FloatHashIdEENS_14PairHashTraitsINS_10HashTraitsIdEENSA_IS3_EEEESB_E6expandEv
-__ZNK3JSC7AddNode8opcodeIDEv
-__ZNK3JSC8MultNode8opcodeIDEv
-__ZN3JSC10NumberNodeD1Ev
-__ZN3JSC8MultNodeD1Ev
-__ZN3JSC3JIT23compileFastArith_op_mulEPNS_11InstructionE
-__ZN3JSC14MacroAssembler4jz32ENS_3X8610RegisterIDENS0_5Imm32E
-__ZN3JSC12X86Assembler7subl_irEiNS_3X8610RegisterIDE
-__ZN3JSC3JIT20compileBinaryArithOpENS_8OpcodeIDEjjjNS_12OperandTypesE
-__ZN3JSC9CodeBlock19isKnownNotImmediateEi
-__ZN3JSC12X86Assembler23X86InstructionFormatter11memoryModRMEiNS_3X8610RegisterIDEi
-__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDEiNS_3X8610RegisterIDEi
-__ZN3JSC12X86Assembler8sarl_i8rEiNS_3X8610RegisterIDE
-__ZN3JSC15AssemblerBuffer7putByteEi
-__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDEiNS_3X8610RegisterIDE
-__ZN3JSC3JIT42putDoubleResultToJSNumberCellOrJSImmediateENS_3X8613XMMRegisterIDENS1_10RegisterIDEjPNS_12X86Assembler6JmpSrcES2_S3_S3_
-__ZN3JSC3JIT27compileFastArithSlow_op_mulEPNS_11InstructionERPNS_13SlowCaseEntryE
-__ZN3JSC3JIT27compileFastArithSlow_op_addEPNS_11InstructionERPNS_13SlowCaseEntryE
-__ZN3JSC3JIT28compileBinaryArithOpSlowCaseENS_8OpcodeIDERPNS_13SlowCaseEntryEjjjNS_12OperandTypesE
-__ZN3JSC11Interpreter31cti_op_construct_NotJSConstructEPvz
-__ZN3JSC15DateConstructor16getConstructDataERNS_13ConstructDataE
-__ZN3JSCL28constructWithDateConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
-__ZN3JSC13constructDateEPNS_9ExecStateERKNS_7ArgListE
-__ZN3JSC13DatePrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSCL20dateProtoFuncGetTimeEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC12DateInstance9classInfoEv
-__ZN3JSC11Interpreter10cti_op_addEPvz
-__ZN3JSC12jsNumberCellEPNS_12JSGlobalDataEd
-__ZNK3JSC12JSNumberCell8toNumberEPNS_9ExecStateE
-__ZN3JSC11BooleanNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC6IfNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC9BlockNode7isBlockEv
-__ZN3JSC9BlockNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC9BlockNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC10JSFunction4markEv
-__ZN3JSC16FunctionBodyNode4markEv
-__ZN3JSC23FunctionCallResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator19emitResolveFunctionEPNS_10RegisterIDES2_RKNS_10IdentifierE
-__ZNK3JSC12NotEqualNode8opcodeIDEv
-__ZNK3JSC8LessNode8opcodeIDEv
-__ZN3JSC23FunctionCallResolveNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC23FunctionCallResolveNodeD1Ev
-__ZN3JSC12NotEqualNodeD1Ev
-__ZN3JSC8LessNodeD1Ev
-__ZN3JSC11Interpreter19cti_op_resolve_funcEPvz
-__ZN3JSC11Interpreter22cti_op_call_JSFunctionEPvz
-__ZN3JSC16FunctionBodyNode16generateBytecodeEPNS_14ScopeChainNodeE
-__ZN3JSC6Parser14reparseInPlaceEPNS_12JSGlobalDataEPNS_16FunctionBodyNodeE
-__ZN3JSC17BytecodeGeneratorC2EPNS_16FunctionBodyNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3RepEEENS_16SymbolTableEntryENS_17IdentifierRepHashENS9_10HashTraitsISE_EENS_26SymbolTableIndexHashTraitsEEEPNS_9CodeBlockE
-__ZN3JSC16FunctionBodyNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC16JSVariableObject16isVariableObjectEv
-__ZN3JSC17BytecodeGenerator16emitGetScopedVarEPNS_10RegisterIDEmiNS_10JSValuePtrE
-__ZNK3JSC13StatementNode12isReturnNodeEv
-__ZN3JSC17BytecodeGenerator10emitReturnEPNS_10RegisterIDE
-__ZN3JSC11Interpreter23cti_vm_dontLazyLinkCallEPvz
-__ZN3JSC11Interpreter23cti_register_file_checkEPvz
-__ZN3JSC17BytecodeGenerator12addParameterERKNS_10IdentifierE
-__ZNK3JSC13StatementNode7isBlockEv
-__ZN3JSC10ReturnNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC14JSGlobalObject14isDynamicScopeEv
-__ZN3JSC10ReturnNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC10ReturnNodeD1Ev
-__ZN3JSC11concatenateEPNS_7UString3RepES2_
-__ZN3JSC11Interpreter23cti_op_get_by_id_secondEPvz
-__ZN3JSC11Interpreter18tryCTICacheGetByIDEPNS_9ExecStateEPNS_9CodeBlockEPvNS_10JSValuePtrERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSC3JIT26privateCompileGetByIdProtoEPNS_17StructureStubInfoEPNS_9StructureES4_mPvPNS_9ExecStateE
-__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiPv
-__ZNK3JSC11ResolveNode6isPureERNS_17BytecodeGeneratorE
-__ZN3JSC9CodeBlock4markEv
-__ZN3JSC19BracketAccessorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator12emitGetByValEPNS_10RegisterIDES2_S2_
-__ZN3JSC10JSFunction18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC11Interpreter28cti_op_construct_JSConstructEPvz
-__ZN3JSC8JSObject17createInheritorIDEv
-__ZL15makePostfixNodePvPN3JSC14ExpressionNodeENS0_8OperatorEiii
-__ZNK3JSC7ForNode6isLoopEv
-__ZN3JSC7ForNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator13newLabelScopeENS_10LabelScope4TypeEPKNS_10IdentifierE
-__ZN3JSC17BytecodeGenerator8emitJumpEPNS_5LabelE
-__ZN3JSC17AssignBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC8ThisNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator12emitPutByValEPNS_10RegisterIDES2_S2_
-__ZN3JSC18PostfixResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator14emitJumpIfTrueEPNS_10RegisterIDEPNS_5LabelE
-__ZN3JSC7ForNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC7ForNodeD1Ev
-__ZN3JSC18PostfixResolveNodeD1Ev
-__ZN3JSC17AssignBracketNodeD1Ev
-__ZN3JSC17AssignBracketNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC8ThisNodeD1Ev
-__ZN3JSC3JIT27compileFastArith_op_pre_incEj
-__ZN3JSC12X86Assembler2joEv
-__ZN3JSC3JIT19emitSlowScriptCheckEv
-__ZN3JSC3JIT31compileFastArithSlow_op_pre_incEjRPNS_13SlowCaseEntryE
-__ZN3JSC11Interpreter22cti_op_call_arityCheckEPvz
 __ZN3JSC10JSFunction15argumentsGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 __ZNK3JSC11Interpreter17retrieveArgumentsEPNS_9ExecStateEPNS_10JSFunctionE
-__ZN3JSC9Arguments18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC11Interpreter17cti_op_get_by_valEPvz
-__ZN3JSC9Arguments18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSC11Interpreter17cti_op_put_by_valEPvz
-__ZN3JSC8JSObject3putEPNS_9ExecStateEjNS_10JSValuePtrE
-__ZN3JSC11Interpreter24cti_op_get_by_id_genericEPvz
-__ZN3JSCL21dateProtoFuncGetMonthEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC12DateInstance21msToGregorianDateTimeEdbRNS_17GregorianDateTimeE
-__ZN3JSC21msToGregorianDateTimeEdbRNS_17GregorianDateTimeE
-__ZN3JSCL12getDSTOffsetEdd
-__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSCL20dateProtoFuncGetDateEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11concatenateEPNS_7UString3RepEi
-__ZN3JSC21ReadModifyResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC21ReadModifyResolveNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSCL20dateProtoFuncGetYearEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZL11makeSubNodePvPN3JSC14ExpressionNodeES2_b
-__ZN3JSC10IfElseNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC10LessEqNode8opcodeIDEv
-__ZNK3JSC7SubNode8opcodeIDEv
-__ZN3JSC10LessEqNodeD1Ev
-__ZN3JSC7SubNodeD1Ev
-__ZN3JSC3JIT23compileFastArith_op_subEPNS_11InstructionE
-__ZN3JSC3JIT27compileFastArithSlow_op_subEPNS_11InstructionERPNS_13SlowCaseEntryE
-__ZN3JSCL21dateProtoFuncGetHoursEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter13cti_op_lesseqEPvz
-__ZN3JSCL23dateProtoFuncGetMinutesEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC13GreaterEqNode8opcodeIDEv
-__ZN3JSC13GreaterEqNodeD1Ev
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS2_16SymbolTableEntryEENS_18PairFirstExtractorIS8_EENS2_17IdentifierRepHashENS_14PairHashTraitsINS_10HashTraitsIS5_EENS2_26SymbolTableIndexHashTraitsEEESE_E4findIS5_NS_22IdentityHashTranslatorIS5_S8_SB_EEEENS_17HashTableIteratorIS5_S8_SA_SB_SG_SE_EERKT_
-__ZN3JSC8WithNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator13emitPushScopeEPNS_10RegisterIDE
-__ZN3WTF6VectorIN3JSC18ControlFlowContextELm0EE14expandCapacityEm
-__ZN3JSC11Interpreter9cti_op_eqEPvz
-__ZN3JSCeqERKNS_7UStringES2_
-__ZN3JSC11Interpreter17cti_op_push_scopeEPvz
-__ZN3JSC11Interpreter14cti_op_resolveEPvz
-__ZN3JSC11Interpreter16cti_op_pop_scopeEPvz
-__ZN3JSC8NullNodeD1Ev
-__ZN3JSC8NullNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator20emitNextPropertyNameEPNS_10RegisterIDES2_PNS_5LabelE
-__ZN3JSC9ForInNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11Interpreter17cti_op_get_pnamesEPvz
-__ZN3JSC22JSPropertyNameIterator6createEPNS_9ExecStateENS_10JSValuePtrE
-__ZN3JSC8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZN3JSC9Structure26getEnumerablePropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayEPNS_8JSObjectE
-__ZN3JSC9Structure34getEnumerablePropertyNamesInternalERNS_17PropertyNameArrayE
-__ZNK3JSC6JSCell9classInfoEv
-__ZN3JSC9Structure26createCachedPrototypeChainEv
-__ZN3JSC14StructureChainC1EPNS_9StructureE
-__ZN3JSC11Interpreter17cti_op_next_pnameEPvz
-__ZN3JSC23structureChainsAreEqualEPNS_14StructureChainES1_
-__ZN3JSC13jsOwnedStringEPNS_12JSGlobalDataERKNS_7UStringE
-__ZN3JSC11Interpreter10cti_op_neqEPvz
-__ZN3JSC16globalFuncEscapeEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11JSImmediate8toStringENS_10JSValuePtrE
-__ZN3JSC7UString4fromEi
-__ZN3JSC7UString6appendERKS0_
-__ZN3JSC22JSPropertyNameIterator10invalidateEv
-__ZN3JSCL21dateProtoFuncSetMonthEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL20dateProtoFuncSetDateEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCplERKNS_7UStringES2_
-__ZN3JSC14ExecutablePool13systemReleaseERKNS0_10AllocationE
-__ZNK3JSC8JSString11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
-__ZN3JSC16ArrayConstructor16getConstructDataERNS_13ConstructDataE
-__ZN3JSCL29constructWithArrayConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
-__ZN3JSCL27constructArrayWithSizeQuirkEPNS_9ExecStateERKNS_7ArgListE
-__ZL14makePrefixNodePvPN3JSC14ExpressionNodeENS0_8OperatorEiii
-__ZN3JSC13PrefixDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC9WhileNode6isLoopEv
-__ZN3JSC9WhileNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC9WhileNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC13PrefixDotNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC13PrefixDotNodeD1Ev
-__ZN3JSC9WhileNodeD1Ev
-__ZN3JSC3JIT28compileFastArith_op_post_incEjj
-__ZN3JSC3JIT32compileFastArithSlow_op_post_incEjjRPNS_13SlowCaseEntryE
-__ZN3JSC11Interpreter22cti_op_push_activationEPvz
-__ZN3JSC12JSActivationC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_16FunctionBodyNodeEEE
-__ZN3JSC12JSActivation18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZL11makeDivNodePvPN3JSC14ExpressionNodeES2_b
-__ZN3JSC15ConditionalNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC7DivNode8opcodeIDEv
-__ZN3JSC15ConditionalNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC15ConditionalNodeD1Ev
-__ZN3JSC7DivNodeD1Ev
-__ZN3JSC7JSArrayC2EN3WTF10PassRefPtrINS_9StructureEEEj
-__ZN3JSC11Interpreter23cti_op_put_by_val_arrayEPvz
-__ZN3JSC7JSArray3putEPNS_9ExecStateEjNS_10JSValuePtrE
-__ZN3JSC7JSArray3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSC12StringObject3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC11Interpreter10cti_op_divEPvz
-__ZN3JSC3JIT16patchGetByIdSelfEPNS_17StructureStubInfoEPNS_9StructureEmPv
-__ZN3JSC3JIT33privateCompilePatchGetArrayLengthEPv
-__ZN3JSC11Interpreter23cti_op_put_by_id_secondEPvz
-__ZN3JSC11Interpreter18tryCTICachePutByIDEPNS_9ExecStateEPNS_9CodeBlockEPvNS_10JSValuePtrERKNS_15PutPropertySlotE
-__ZN3JSCL19cachePrototypeChainEPNS_9ExecStateEPNS_9StructureE
-__ZN3JSC3JIT31privateCompilePutByIdTransitionEPNS_17StructureStubInfoEPNS_9StructureES4_mPNS_14StructureChainEPv
-__ZN3JSC9Structure22materializePropertyMapEv
-__ZN3JSC3JIT19patchPutByIdReplaceEPNS_17StructureStubInfoEPNS_9StructureEmPv
-__ZN3JSCL21resizePropertyStorageEPNS_8JSObjectEii
-__ZN3JSC8JSObject23allocatePropertyStorageEmm
-__ZN3JSC11Interpreter14cti_op_pre_incEPvz
-__ZN3JSCL21stringProtoFuncCharAtEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC12StringObject12toThisStringEPNS_9ExecStateE
-__ZN3JSC11Interpreter26cti_op_tear_off_activationEPvz
-__ZN3JSC11Interpreter21cti_op_ret_scopeChainEPvz
-__ZN3JSC11Interpreter27cti_op_get_by_id_proto_listEPvz
-__ZN3JSC3JIT30privateCompileGetByIdProtoListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureES6_mPNS_9ExecStateE
-__ZN3JSC12JSActivationD0Ev
-__ZN3JSCL26stringProtoFuncToLowerCaseEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC8JSString14toThisJSStringEPNS_9ExecStateE
-__ZN3JSC7JSArray11putSlowCaseEPNS_9ExecStateEjNS_10JSValuePtrE
-__ZN3WTF11fastReallocILb0EEEPvS1_m
-__ZN3JSCL24stringProtoFuncSubstringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11jsSubstringEPNS_12JSGlobalDataERKNS_7UStringEjj
-__ZN3JSCL20stringProtoFuncSplitEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC19constructEmptyArrayEPNS_9ExecStateE
-__ZNK3JSC11BooleanNode6isPureERNS_17BytecodeGeneratorE
-__ZNK3JSC7ModNode8opcodeIDEv
-__ZN3JSC7ModNodeD1Ev
-__ZN3JSC3JIT23compileFastArith_op_modEjjj
-__ZN3JSC3JIT27compileFastArithSlow_op_modEjjjRPNS_13SlowCaseEntryE
-__ZN3JSCL23dateProtoFuncGetSecondsEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC17BytecodeGenerator16emitPutScopedVarEmiPNS_10RegisterIDENS_10JSValuePtrE
-__ZN3JSC18globalFuncUnescapeEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC7UString6appendEt
-__ZN3JSC11Interpreter19cti_vm_lazyLinkCallEPvz
-__ZN3JSC3JIT8linkCallEPNS_10JSFunctionEPNS_9CodeBlockEPvPNS_12CallLinkInfoEi
-__ZN3WTF6VectorIPN3JSC12CallLinkInfoELm0EE14expandCapacityEm
-__ZN3JSC12X86Assembler7cmpl_imEiiNS_3X8610RegisterIDE
-__ZN3JSC9CodeBlock13unlinkCallersEv
-__ZNK3JSC8JSString9toBooleanEPNS_9ExecStateE
-__ZN3JSC11Interpreter10cti_op_mulEPvz
-__ZN3JSC11Interpreter18cti_op_to_jsnumberEPvz
-__ZN3JSCL30dateProtoFuncGetTimezoneOffsetEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL18mathProtoFuncFloorEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL13jsAddSlowCaseEPNS_9ExecStateENS_10JSValuePtrES2_
-__ZN3JSC20globalFuncParseFloatEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC7UString4fromEj
-__ZN3JSC10Identifier11addSlowCaseEPNS_9ExecStateEPNS_7UString3RepE
-__ZN3JSC7UString17expandPreCapacityEi
-__ZN3JSC9CommaNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC9CommaNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC16VarDeclCommaNodeD1Ev
-__ZN3JSC7UStringC1EPtib
-__ZN3JSC5Error6createEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringEilS6_
-__ZN3JSC22NativeErrorConstructor16getConstructDataERNS_13ConstructDataE
-__ZN3JSCL35constructWithNativeErrorConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
-__ZN3JSC22NativeErrorConstructor9constructEPNS_9ExecStateERKNS_7ArgListE
-__ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrEj
-__ZNK3JSC8JSObject8toStringEPNS_9ExecStateE
-__ZNK3JSC8JSObject11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
-__ZNK3JSC8JSObject12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
-__ZN3JSCL22errorProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC8JSObject12toThisObjectEPNS_9ExecStateE
-__ZN3JSC7UString6appendEPKc
-__ZN3JSC3JIT10unlinkCallEPNS_12CallLinkInfoE
-__ZN3JSC11Interpreter24cti_op_put_by_id_genericEPvz
-__ZN3JSC21FunctionCallValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC12FuncExprNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator25emitNewFunctionExpressionEPNS_10RegisterIDEPNS_12FuncExprNodeE
-__ZN3WTF6VectorINS_6RefPtrIN3JSC12FuncExprNodeEEELm0EE15reserveCapacityEm
-__ZN3WTF7HashSetINS_6RefPtrIN3JSC7UString3RepEEENS2_17IdentifierRepHashENS_10HashTraitsIS5_EEE3addERKS5_
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEES5_NS_17IdentityExtractorIS5_EENS2_17IdentifierRepHashENS_10HashTraitsIS5_EESA_E6expandEv
-__ZL14compileBracketiPiPPhPPKtS3_P9ErrorCodeiS_S_R11CompileData
-__ZN3JSC4WREC9Generator20generateAssertionEOLERNS_14MacroAssembler8JumpListE
-__ZN3JSC17ObjectLiteralNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC4WREC31GeneratePatternCharacterFunctor12generateAtomEPNS0_9GeneratorERNS_14MacroAssembler8JumpListE
-__ZN3JSC4WREC31GeneratePatternCharacterFunctor9backtrackEPNS0_9GeneratorE
-__ZL20branchNeedsLineStartPKhjj
-__ZN3JSC9ArrayNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator12emitNewArrayEPNS_10RegisterIDEPNS_11ElementNodeE
-__ZL17bracketIsAnchoredPKh
-__ZL32branchFindFirstAssertedCharacterPKhb
-__ZN3JSC10JSFunction3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSC11concatenateEPNS_7UString3RepEd
-__ZNK3JSC12JSActivation14isDynamicScopeEv
-__ZN3JSC17TypeOfResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC15StrictEqualNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC12ContinueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator14continueTargetERKNS_10IdentifierE
-__ZN3JSC17BytecodeGenerator14emitJumpScopesEPNS_5LabelEi
-__ZN3JSC15TypeOfValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC15TypeOfValueNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC17TypeOfResolveNodeD1Ev
-__ZN3JSC15StrictEqualNodeD1Ev
-__ZN3JSC12ContinueNodeD1Ev
-__ZN3JSC15TypeOfValueNodeD1Ev
-__ZN3JSC11Interpreter33cti_op_create_arguments_no_paramsEPvz
-__ZN3JSC11Interpreter13cti_op_typeofEPvz
-__ZN3JSCL20jsTypeStringForValueEPNS_9ExecStateENS_10JSValuePtrE
-__ZN3JSC6JSCell11getCallDataERNS_8CallDataE
-__ZN3JSCL30comparePropertyMapEntryIndicesEPKvS1_
-__ZN3WTF6VectorIN3JSC10IdentifierELm20EE15reserveCapacityEm
-__ZN3JSCL22objectProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC14ArrayPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSCL22functionProtoFuncApplyEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC7JSArray9classInfoEv
-__ZN3JSCL18arrayProtoFuncPushEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter27cti_op_get_by_id_array_failEPvz
-__ZN3JSC14PostfixDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC14PostfixDotNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11Interpreter32cti_op_get_by_id_proto_list_fullEPvz
-__ZN3JSC12FuncExprNodeD1Ev
-__ZN3JSC12FuncExprNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11Interpreter26cti_op_get_by_id_self_failEPvz
-__ZN3JSC3JIT29privateCompileGetByIdSelfListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureEm
-__ZN3JSCL19arrayProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter25cti_op_tear_off_argumentsEPvz
-__ZN3WTF6VectorIPN3JSC9StructureELm8EE14expandCapacityEm
-__ZN3JSCL44countPrototypeChainEntriesAndCheckForProxiesEPNS_9ExecStateENS_10JSValuePtrERKNS_12PropertySlotE
-__ZN3JSC17DeleteBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17DeleteBracketNodeD1Ev
-__ZN3JSC17DeleteBracketNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11Interpreter17cti_op_del_by_valEPvz
-__ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateEj
-__ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZNK3JSC6JSCell9getUInt32ERj
-__ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3JSCL11getPropertyEPNS_9ExecStateEPNS_8JSObjectEj
-__ZN3JSC17ReadModifyDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17ReadModifyDotNodeD1Ev
-__ZN3JSC17ReadModifyDotNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11JSImmediate9prototypeENS_10JSValuePtrEPNS_9ExecStateE
-__ZN3JSC9CodeBlock34reparseForExceptionInfoIfNecessaryEPNS_9ExecStateE
-__ZNK3JSC10ScopeChain10localDepthEv
-__ZNK3JSC12JSActivation9classInfoEv
-__ZN3JSC6Parser7reparseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EEPNS_12JSGlobalDataEPS5_
-__ZN3JSC16FunctionBodyNode6createEPNS_12JSGlobalDataEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS6_INS5_6RefPtrINS_12FuncDeclNodeEEELm0EEERKNS_10SourceCodeEji
-__ZN3JSC13StatementNode6setLocEii
-__ZN3JSC16FunctionBodyNode14copyParametersEv
-__ZN3JSC16FunctionBodyNode13finishParsingEPNS_10IdentifierEm
-__ZN3JSC16FunctionBodyNode31bytecodeForExceptionInfoReparseEPNS_14ScopeChainNodeEPNS_9CodeBlockE
-__ZN3JSC9CodeBlock36hasGlobalResolveInfoAtBytecodeOffsetEj
-__ZN3JSC6RegExpD1Ev
-__Z12jsRegExpFreeP8JSRegExp
-__ZN3JSC12JSActivation4markEv
-__ZN3JSC9ThrowNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC9ThrowNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC9ThrowNodeD1Ev
-__ZNK3JSC21UStringSourceProvider6lengthEv
-__ZNK3JSC21UStringSourceProvider4dataEv
-__ZN3JSC21UStringSourceProviderD1Ev
-__ZN3JSC3JIT26privateCompileGetByIdChainEPNS_17StructureStubInfoEPNS_9StructureEPNS_14StructureChainEmmPvPNS_9ExecStateE
-__ZN3JSCL18arrayProtoFuncJoinEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3WTF7HashSetIPN3JSC8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN3JSC8JSObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
-__ZN3WTF6VectorItLm256EE14expandCapacityEm
-__ZN3WTF9HashTableIPN3JSC8JSObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN3JSC3JIT28compileFastArith_op_post_decEjj
-__ZN3JSC3JIT27compileFastArith_op_pre_decEj
-__ZN3JSC3JIT32compileFastArithSlow_op_post_decEjjRPNS_13SlowCaseEntryE
-__ZN3JSC3JIT31compileFastArithSlow_op_pre_decEjRPNS_13SlowCaseEntryE
-__ZN3JSCL26stringProtoFuncToUpperCaseEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC9Arguments4markEv
-__ZN3JSC11Interpreter17cti_timeout_checkEPvz
-__ZN3JSCL18stringFromCharCodeEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC17ObjectConstructor16getConstructDataERNS_13ConstructDataE
-__ZN3JSCL30constructWithObjectConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
-__ZN3JSC19JSStaticScopeObject4markEv
-__ZN3JSC17NumberConstructor18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC21ThrowableBinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZNK3JSC6InNode8opcodeIDEv
-__ZN3JSC11Interpreter9cti_op_inEPvz
-__ZN3JSC11Interpreter21cti_op_put_by_id_failEPvz
-__ZN3JSC17RegExpConstructor3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSC11Interpreter18cti_op_is_functionEPvz
-__ZN3JSC18globalFuncIsFiniteEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL21arrayProtoFuncForEachEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL17arrayProtoFuncMapEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC12StringObject14toThisJSStringEPNS_9ExecStateE
-__ZNK3JSC8JSString12toThisObjectEPNS_9ExecStateE
-__ZN3JSCL21arrayProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC13DeleteDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator14emitDeleteByIdEPNS_10RegisterIDES2_RKNS_10IdentifierE
-__ZN3JSC13DeleteDotNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11Interpreter16cti_op_del_by_idEPvz
-__ZN3JSC10JSFunction14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3JSC10JSFunction12callerGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3JSC11Interpreter14retrieveCallerEPNS_9ExecStateEPNS_16InternalFunctionE
-__ZN3JSCL22arrayProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC16ErrorConstructor16getConstructDataERNS_13ConstructDataE
-__ZN3JSCL29constructWithErrorConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
-__ZN3JSC14constructErrorEPNS_9ExecStateERKNS_7ArgListE
-__ZN3JSC12JSActivation3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3WTF6VectorIN3JSC14MacroAssembler4JumpELm16EE14expandCapacityEm
-__ZN3JSC14InstanceOfNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator14emitInstanceOfEPNS_10RegisterIDES2_S2_S2_
-__ZN3JSC14InstanceOfNodeD1Ev
-__ZN3JSC11JSImmediate8toObjectENS_10JSValuePtrEPNS_9ExecStateE
-__ZNK3JSC12NumberObject9classInfoEv
-__ZN3JSC11Interpreter17cti_op_instanceofEPvz
-__ZNK3JSC7UString6substrEii
-__ZN3JSCL20arrayProtoFuncSpliceEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC19FunctionConstructor16getConstructDataERNS_13ConstructDataE
-__ZN3JSCL32constructWithFunctionConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
-__ZN3JSC17constructFunctionEPNS_9ExecStateERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
-__ZNK3JSC17ExprStatementNode15isExprStatementEv
-__ZNK3JSC12FuncExprNode14isFuncExprNodeEv
-__ZN3JSC7ArgList9markListsERN3WTF7HashSetIPS0_NS1_7PtrHashIS3_EENS1_10HashTraitsIS3_EEEE
-__ZN3JSC9CommaNodeD1Ev
-__ZN3JSC11Interpreter12cti_op_throwEPvz
-__ZN3JSC11Interpreter14throwExceptionERPNS_9ExecStateERNS_10JSValuePtrEjb
-__ZNK3JSC8JSObject22isNotAnObjectErrorStubEv
-__ZN3JSC9CodeBlock32expressionRangeForBytecodeOffsetEPNS_9ExecStateEjRiS3_S3_
-__ZNK3JSC8JSObject19isWatchdogExceptionEv
-__ZN3JSC9CodeBlock24handlerForBytecodeOffsetEj
-__ZN3JSC11Interpreter15unwindCallFrameERPNS_9ExecStateENS_10JSValuePtrERjRPNS_9CodeBlockE
-__ZN3JSCL23returnToThrowTrampolineEPNS_12JSGlobalDataEPvRS2_
-__ZN3JSC19ctiSetReturnAddressEPPvS0_
-ctiVMThrowTrampoline
-__ZN3JSC11Interpreter12cti_vm_throwEPvz
-__ZN3JSC11Interpreter21cti_op_push_new_scopeEPvz
-__ZN3JSC19JSStaticScopeObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC9Arguments3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSC4WREC9Generator27generateNonGreedyQuantifierERNS_14MacroAssembler8JumpListERNS0_19GenerateAtomFunctorEjj
-__ZN3JSCL21arrayProtoFuncReverseEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC7UString6appendEPKti
-__ZN3JSCL26stringProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC10JSValuePtr20toIntegerPreserveNaNEPNS_9ExecStateE
-__Z22jsc_pcre_ucp_othercasej
-__ZN3JSCL24regExpConstructorDollar1EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL24regExpConstructorDollar2EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL24regExpConstructorDollar3EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL24regExpConstructorDollar4EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL19dateProtoFuncGetDayEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC19JSStaticScopeObject14isDynamicScopeEv
-__ZN3JSCL35objectProtoFuncPropertyIsEnumerableEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC8JSObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
-__ZN3WTF9HashTableIjSt4pairIjN3JSC10JSValuePtrEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSA_IS3_EEEESB_EC2ERKSE_
-__ZN3JSC11Interpreter14cti_op_pre_decEPvz
-__ZN3JSC11Interpreter16cti_op_new_arrayEPvz
-__ZN3JSC14constructArrayEPNS_9ExecStateERKNS_7ArgListE
-__ZN3JSC10JSFunction11getCallDataERNS_8CallDataE
-__ZN3JSC4callEPNS_9ExecStateENS_10JSValuePtrENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE
-__ZN3JSC11Interpreter7executeEPNS_16FunctionBodyNodeEPNS_9ExecStateEPNS_10JSFunctionEPNS_8JSObjectERKNS_7ArgListEPNS_14ScopeChainNodeEPNS_10JSValuePtrE
-__ZN3JSC9LabelNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC9LabelNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11Interpreter15cti_op_stricteqEPvz
-__Z15jsRegExpExecutePK8JSRegExpPKtiiPii
-__ZL5matchPKtPKhiR9MatchData
-__ZN3JSC18RegExpMatchesArrayC2EPNS_9ExecStateEPNS_24RegExpConstructorPrivateE
-__ZN3JSC18RegExpMatchesArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSC18RegExpMatchesArray17fillArrayInstanceEPNS_9ExecStateE
-__ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSC12RegExpObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSCL19regExpProtoFuncTestEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC12RegExpObject5matchEPNS_9ExecStateERKNS_7ArgListE
-__ZN3JSCL21functionProtoFuncCallEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC8JSString8toObjectEPNS_9ExecStateE
-__ZNK3JSC7ArgList8getSliceEiRS0_
-__ZN3JSC17RegExpConstructor18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC23FunctionCallBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC23FunctionCallBracketNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC23FunctionCallBracketNodeD1Ev
-__ZN3JSC11Interpreter16cti_op_is_stringEPvz
-__ZN3JSC7TryNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17BytecodeGenerator9emitCatchEPNS_10RegisterIDEPNS_5LabelES4_
-__ZN3WTF6VectorIN3JSC11HandlerInfoELm0EE14expandCapacityEm
-__ZN3JSC17BytecodeGenerator16emitPushNewScopeEPNS_10RegisterIDERNS_10IdentifierES2_
-__ZN3JSC7TryNode12releaseNodesERNS_12NodeReleaserE
-__ZN3WTF6VectorIN3JSC14ExecutablePool10AllocationELm2EE14expandCapacityEm
-__ZN3JSC11Interpreter19cti_op_loop_if_lessEPvz
-__ZN3JSCL22stringProtoFuncReplaceEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC7UString30spliceSubstringsWithSeparatorsEPKNS0_5RangeEiPKS0_i
-__Z15jsc_pcre_xclassiPKh
-__ZN3JSC18RegExpMatchesArray3putEPNS_9ExecStateEjNS_10JSValuePtrE
-__ZN3JSC7JSArray9setLengthEj
-__ZN3JSCL21arrayProtoFuncUnShiftEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL19arrayProtoFuncShiftEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC7JSArray14deletePropertyEPNS_9ExecStateEj
-__ZN3JSC11Interpreter19cti_op_is_undefinedEPvz
-__ZNK3JSC9Arguments9classInfoEv
-__ZN3JSC9Arguments11fillArgListEPNS_9ExecStateERNS_7ArgListE
-__ZN3JSC11Interpreter23cti_op_create_argumentsEPvz
-__ZN3JSC17PropertyNameArray3addEPNS_7UString3RepE
-__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF9HashTableIPN3JSC7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandEv
-__ZN3WTF6VectorIN3JSC10IdentifierELm20EE14expandCapacityEm
-__ZN3JSC11Interpreter19cti_op_convert_thisEPvz
-__ZN3JSC17PrefixBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC17PrefixBracketNodeD1Ev
-__ZN3JSC17PrefixBracketNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSCL25functionProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC10JSFunction9classInfoEv
-__ZN3JSC7CStringD1Ev
+__ZN3JSCL21dateProtoFuncSetMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23setNewValueFromDateArgsEPNS_9ExecStateENS_7JSValueERKNS_7ArgListEib
+__ZN3JSCL20dateProtoFuncSetDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF6VectorIPNS0_IN3JSC10RegisterIDELm32EEELm32EE14expandCapacityEm
+__ZN3JSC8JITStubs14cti_op_pre_incEPPv
+__ZN3WTF6VectorIPN3JSC14ExpressionNodeELm16EE14expandCapacityEm
+__ZN3JSC13UnaryPlusNodeD0Ev
+__ZN3JSC3JIT19emit_op_to_jsnumberEPNS_11InstructionE
+__ZN3JSC3JIT23emitSlow_op_to_jsnumberEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs18cti_op_to_jsnumberEPPv
 __ZN3JSC6JSLock12DropAllLocksC1Eb
 __ZN3JSCL17createJSLockCountEv
 __ZN3JSC6JSLock12DropAllLocksD1Ev
-__ZN3JSC26createNotAnObjectErrorStubEPNS_9ExecStateEb
-__ZN3JSC13JSNotAnObject3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZNK3JSC22JSNotAnObjectErrorStub22isNotAnObjectErrorStubEv
-__ZN3JSC22createNotAnObjectErrorEPNS_9ExecStateEPNS_22JSNotAnObjectErrorStubEjPNS_9CodeBlockE
-__ZN3JSC9CodeBlock37getByIdExceptionInfoForBytecodeOffsetEPNS_9ExecStateEjRNS_8OpcodeIDE
-__ZN3JSCL18createErrorMessageEPNS_9ExecStateEPNS_9CodeBlockEiiiNS_10JSValuePtrENS_7UStringE
+__ZN3JSCL24dateProtoFuncSetFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF6VectorIN3JSC15StringJumpTableELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS2_14OffsetLocationENS_7StrHashIS5_EENS_10HashTraitsIS5_EENS9_IS6_EEE3addEPS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS2_14OffsetLocationEENS_18PairFirstExtractorIS8_EENS_7StrHashIS5_
+__ZN3JSC3JIT21emit_op_switch_stringEPNS_11InstructionE
+__ZN3JSC8JITStubs20cti_op_switch_stringEPPv
+__ZN3WTF6VectorIN3JSC14ExecutablePool10AllocationELm2EE14expandCapacityEm
+__ZN3JSC12JSGlobalData6createEb
+__ZN3JSCL13allocateBlockILNS_8HeapTypeE1EEEPNS_14CollectorBlockEv
+__ZN3JSC7JSValueC1EPNS_9ExecStateEd
+__ZN3JSC10JSFunctionC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RK
+__ZN3JSC8JSObject17putDirectFunctionEPNS_9ExecStateEPNS_16InternalFunctionEj
+__ZN3JSC7CStringD1Ev
+__ZN3WTF7HashMapIPvjNS_7PtrHashIS1_EEN3JSC17JSValueHashTraitsENS_10HashTraitsIjEEE3addERKS1_RKj
+__ZN3WTF6VectorINS_6RefPtrIN3JSC12FuncExprNodeEEELm0EE14shrinkCapacityEm
+__ZN3JSC14ExpressionNodeD2Ev
+__ZThn12_N3JSC11ProgramNodeD0Ev
+__ZThn12_N3JSC12FuncExprNodeD0Ev
+__ZThn12_N3JSC16FunctionBodyNodeD0Ev
+__ZN3JSC8JITStubs16cti_op_new_arrayEPvz
+__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator10emitOpcodeENS_8OpcodeIDE
+__ZN3JSC23MacroAssemblerX86Common4moveENS_3X8610RegisterIDES2_
+__ZN3JSC8JITStubs15cti_op_new_funcEPvz
+__ZN3JSC8JITStubs21cti_op_resolve_globalEPvz
+__ZN3JSC8JITStubs16cti_op_get_by_idEPvz
+__ZN3JSC8JITStubs31cti_op_construct_NotJSConstructEPvz
+__ZN3JSC8JITStubs16cti_op_put_by_idEPvz
+__ZN3JSC8JITStubs13cti_op_strcatEPvz
+__ZN3JSC8JITStubs19cti_op_resolve_funcEPvz
+__ZN3JSC8JITStubs23cti_vm_dontLazyLinkCallEPvz
+__ZN3JSC8JITStubs22cti_op_call_JSFunctionEPvz
+__ZN3JSC8JITStubs23cti_register_file_checkEPvz
+__ZN3JSC8JITStubs13cti_op_negateEPvz
+__ZN3JSC8JITStubs28cti_op_construct_JSConstructEPvz
+__ZN3JSC23MacroAssemblerX86Common12branchTest32ENS0_9ConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE7AddressENS4_5Imm
+__ZN3JSC8JITStubs23cti_op_put_by_val_arrayEPvz
+__ZN3JSC8JITStubs23cti_op_put_by_id_secondEPvz
+__ZN3JSC15AssemblerBuffer14executableCopyEPNS_14ExecutablePoolE
+__ZN3JSC12X86Assembler8sarl_i8rEiNS_3X8610RegisterIDE
+__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDEiNS_3X8610RegisterIDEi
+__ZN3JSC8JITStubs10cti_op_mulEPvz
+__ZN3JSC12jsNumberCellEPNS_12JSGlobalDataEd
+__ZN3JSC8JITStubs10cti_op_subEPvz
+__ZN3JSC8JITStubs10cti_op_divEPvz
+__ZN3JSC8JITStubs23cti_op_get_by_id_secondEPvz
+__ZN3JSC8JITStubs19cti_vm_lazyLinkCallEPvz
+__ZN3WTF6VectorIPN3JSC12CallLinkInfoELm0EE14expandCapacityEm
+__ZN3JSC8JITStubs19cti_op_convert_thisEPvz
+__ZN3JSC8JITStubs21cti_op_put_by_id_failEPvz
+__ZN3JSC8JITStubs10cti_op_addEPvz
+__ZN3JSC8JITStubs17cti_timeout_checkEPvz
+__ZN3JSC9jsBooleanEb
+__ZN3JSC9CodeBlock19isKnownNotImmediateEi
+__ZN3JSC12X86Assembler8movsd_mrEiNS_3X8610RegisterIDENS1_13XMMRegisterIDE
+__ZN3JSC8JITStubs25cti_op_call_NotJSFunctionEPvz
+__ZNK3JSC12JSNumberCell8toNumberEPNS_9ExecStateE
+__ZN3JSC8JITStubs26cti_op_get_by_id_self_failEPvz
+__ZN3JSC8JITStubs10cti_op_endEPvz
+__ZThn12_N3JSC12FuncDeclNodeD0Ev
+__ZN3JSC8JITStubs24cti_op_resolve_with_baseEPvz
+__ZN3JSC8JITStubs19cti_op_new_func_expEPvz
+__ZN3JSC8JITStubs22cti_op_push_activationEPvz
+__ZN3JSC8JITStubs17cti_op_get_by_valEPvz
+__ZN3JSC8JITStubs22cti_op_call_arityCheckEPvz
+__ZN3JSC8JITStubs11cti_op_lessEPvz
+__ZN3JSC12JSNumberCell18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDE
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_listEPvz
+__ZN3JSC8JITStubs12cti_op_jtrueEPvz
+__ZN3JSC8JITStubs10cti_op_modEPvz
+__ZN3JSC8JITStubs10cti_op_neqEPvz
+__ZN3JSC8JITStubs12cti_op_jlessEPvz
+__ZN3JSC8JITStubs24cti_op_get_by_id_genericEPvz
+__ZN3JSC8JITStubs14cti_op_jlesseqEPvz
+__ZN3JSC8JITStubs26cti_op_tear_off_activationEPvz
+__ZN3JSC8JITStubs21cti_op_ret_scopeChainEPvz
+__ZN3JSC8JITStubs19cti_op_to_primitiveEPvz
+__ZNK3JSC12JSNumberCell8toStringEPNS_9ExecStateE
+__ZN3JSC8JITStubs13cti_op_bitandEPvz
+__ZN3JSC8JITStubs13cti_op_lshiftEPvz
+__ZN3JSC8JITStubs13cti_op_bitnotEPvz
+__ZNK3JSC12JSNumberCell9toBooleanEPNS_9ExecStateE
+__ZN3JSC8JITStubs14cti_op_urshiftEPvz
+__ZNK3JSC12JSNumberCell18getTruncatedUInt32ERj
+__ZN3JSC4Yarr14RegexGenerator28generateCharacterClassSingleERNS1_19TermGenerationStateE
+__ZN3WTF15deleteAllValuesIPN3JSC4Yarr18PatternDisjunctionELm4EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3JSC8JITStubs17cti_op_new_regexpEPvz
+__ZN3JSC8JITStubs12cti_op_bitorEPvz
+__ZNK3JSC12JSNumberCell17getTruncatedInt32ERi
+__ZN3JSC8JITStubs13cti_op_rshiftEPvz
+__ZN3JSC8JITStubs13cti_op_bitxorEPvz
+__ZN3WTF7HashSetINS_6RefPtrIN3JSC7UString3RepEEENS2_17IdentifierRepHashENS_10HashTraitsIS5_EEE3addERKS5_
+__ZN3JSC8JITStubs9cti_op_eqEPvz
+__ZN3JSC8JITStubs16cti_op_call_evalEPvz
+__ZN3JSC8JITStubs19cti_op_resolve_skipEPvz
+__ZN3JSC8JITStubs17cti_op_new_objectEPvz
+__ZN3JSC8JITStubs14cti_op_resolveEPvz
+__ZN3JSC8JITStubs17cti_op_put_by_valEPvz
+__ZN3JSC8JITStubs18cti_op_switch_charEPvz
+__ZN3JSC8JITStubs28cti_op_get_by_id_string_failEPvz
+__ZThn12_N3JSC8EvalNodeD0Ev
+__ZN3WTF6VectorIN3JSC7UStringELm16EE14expandCapacityEm
+__ZN3JSC8JITStubs17cti_op_get_pnamesEPvz
+__ZN3JSC8JITStubs17cti_op_next_pnameEPvz
+__ZN3WTF7HashSetIPN3JSC20MarkedArgumentBufferENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC20MarkedArgumentBufferES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3JSC8JITStubs24cti_op_get_by_val_stringEPvz
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE28CharacterClassParserDelegate25atomBuiltInCharacterClassENS0_23BuiltInChar
+__ZN3JSC12jsNumberCellEPNS_9ExecStateEd
+__ZN3JSC8JITStubs18cti_op_is_functionEPvz
+__ZN3JSC8JITStubs16cti_op_is_objectEPvz
+__ZN3JSC8JITStubs16cti_op_nstricteqEPvz
+__ZN3JSC8JITStubs13cti_op_lesseqEPvz
+__ZNK3JSC12JSNumberCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZN3JSC4Yarr14RegexGenerator27generateCharacterClassFixedERNS1_19TermGenerationStateE
+__ZN3JSC4Heap7destroyEv
+__ZN3JSC12JSGlobalDataD1Ev
+__ZN3JSC12JSGlobalDataD2Ev
+__ZN3JSC12RegisterFileD1Ev
+__ZNK3JSC9HashTable11deleteTableEv
+__ZN3JSC5LexerD1Ev
+__ZN3JSC5LexerD2Ev
+__ZN3WTF20deleteAllPairSecondsIP24OpaqueJSClassContextDataKNS_7HashMapIP13OpaqueJSClassS2_NS_7PtrHashIS5_EENS_10HashTraitsIS5_E
+__ZN3JSC17CommonIdentifiersD2Ev
+__ZN3JSC21deleteIdentifierTableEPNS_15IdentifierTableE
+__ZN3JSC4HeapD1Ev
+__ZN3JSC12SmallStringsD1Ev
+__ZN3JSCL16mathProtoFuncMinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL17arrayProtoFuncPopEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArray3popEv
+__ZN3JSC11DoWhileNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC11DoWhileNodeD0Ev
+__ZN3JSC3JIT18emit_op_switch_immEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_switch_immEPPv
+__ZN3JSC13UnaryPlusNode14stripUnaryPlusEv
+__ZN3JSC15globalFuncIsNaNEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17NumberConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL21callNumberConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF6VectorIPNS0_IN3JSC10IdentifierELm64EEELm32EE14expandCapacityEm
+__ZN3JSC8JITStubs19cti_op_is_undefinedEPvz
+__ZN3JSC8JITStubs13cti_op_typeofEPvz
+__ZN3JSC8JITStubs33cti_op_create_arguments_no_paramsEPvz
+__ZN3JSC8JITStubs19cti_op_load_varargsEPvz
+__ZN3JSC8JITStubs10cti_op_notEPvz
+__ZN3JSC8JITStubs16cti_op_is_stringEPvz
+__ZN3JSCL24regExpConstructorDollar1EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3WTF6VectorIN3JSC15StringJumpTableELm0EE14expandCapacityEm
+__ZN3JSC8JITStubs20cti_op_switch_stringEPvz
+__ZN3JSC9Arguments3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JITStubs18cti_op_to_jsnumberEPvz
+__ZN3JSC8JITStubs19cti_op_loop_if_lessEPvz
+__ZN3JSC9LabelNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9LabelNodeD0Ev
 __ZNK3JSC7UString5asciiEv
-__ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEN3WTF10PassRefPtrINS_9StructureEEERKNS_10IdentifierE
-__ZN3WTF13tryFastCallocEmm
-__ZN3JSC13JSNotAnObjectD0Ev
-__ZN3JSCL31dateProtoFuncToLocaleTimeStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL16formatLocaleDateEPNS_9ExecStateEPNS_12DateInstanceEdNS_20LocaleDateTimeFormatERKNS_7ArgListE
-__ZN3JSC16InternalFunction4nameEPNS_12JSGlobalDataE
-__ZNK3JSC6JSCell9getStringERNS_7UStringE
-__ZN3JSC28globalFuncDecodeURIComponentEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC14ExpressionNode8isStringEv
-__ZN3JSC17RegExpConstructor11getCallDataERNS_8CallDataE
-__ZN3JSCL21callRegExpConstructorEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC23createNotAFunctionErrorEPNS_9ExecStateENS_10JSValuePtrEjPNS_9CodeBlockE
-__ZN3JSC11Interpreter17cti_op_jmp_scopesEPvz
-__ZN3JSC17BytecodeGenerator18emitJumpSubroutineEPNS_10RegisterIDEPNS_5LabelE
-__ZN3WTF6VectorIN3JSC3JIT7JSRInfoELm0EE14expandCapacityEm
-__ZN3JSC18RegExpMatchesArray16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZN3JSC28createUndefinedVariableErrorEPNS_9ExecStateERKNS_10IdentifierEjPNS_9CodeBlockE
-__ZN3JSC17DeleteResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSCL21stringProtoFuncSearchEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL27objectProtoFuncDefineGetterEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC8JSObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
-__ZN3JSC9Structure22getterSetterTransitionEPS0_
-__ZN3JSCL27objectProtoFuncLookupGetterEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC8JSObject12lookupGetterEPNS_9ExecStateERKNS_10IdentifierE
-__ZNK3JSC6JSCell14isGetterSetterEv
-__ZN3JSCL27objectProtoFuncLookupSetterEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC8JSObject12lookupSetterEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3JSC10JSFunction12lengthGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL27objectProtoFuncDefineSetterEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC8JSObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
-__ZNK3JSC12GetterSetter14isGetterSetterEv
-__ZN3JSC12GetterSetter4markEv
-__ZN3JSC16JSVariableObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateEj
-__ZN3JSC17BytecodeGenerator21emitComplexJumpScopesEPNS_5LabelEPNS_18ControlFlowContextES4_
-__ZN3JSC8JSObject22fillGetterPropertySlotERNS_12PropertySlotEPNS_10JSValuePtrE
-__ZN3JSC12PropertySlot14functionGetterEPNS_9ExecStateERKNS_10IdentifierERKS0_
-__ZN3JSC7JSArray4sortEPNS_9ExecStateE
+__ZN3JSC8JITStubs27cti_op_get_by_id_array_failEPvz
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiPv
+__ZN3JSC8JITStubs23cti_op_create_argumentsEPvz
+__ZN3JSCL21arrayProtoFuncUnShiftEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs25cti_op_tear_off_argumentsEPvz
+__ZN3JSC7JSArray11sortNumericEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
 __ZN3JSC7JSArray17compactForSortingEv
-__ZN3JSCL24booleanProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC8VoidNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC8VoidNodeD1Ev
-__ZN3JSC8VoidNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC13JSNotAnObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSCL27compareByStringPairForQSortEPKvS1_
+__ZN3JSCL22compareNumbersForQSortEPKvS1_
+__ZN3JSC8JITStubs15cti_op_post_incEPPv
+__ZN3JSC8JITStubs24cti_op_put_by_id_genericEPvz
+__ZN3JSCL24regExpConstructorDollar2EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar3EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar4EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar5EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar6EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL21stringProtoFuncSubstrEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23stringProtoFuncFontsizeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncToUTCStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL19stringProtoFuncLinkEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL9dateParseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs21cti_op_loop_if_lesseqEPPv
+__ZN3JSCL16mathProtoFuncExpEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC4Yarr17nonwordcharCreateEv
+__ZN3WTF6VectorIPN3JSC4Yarr18PatternDisjunctionELm4EE14expandCapacityEmPKS4_
+__Z15jsc_pcre_xclassiPKh
+__ZN3JSC18RegExpMatchesArray3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC28globalFuncDecodeURIComponentEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs27cti_op_get_by_id_array_failEPPv
+__ZNK3JSC9Arguments9classInfoEv
+__ZN3JSC9Arguments15copyToRegistersEPNS_9ExecStateEPNS_8RegisterEj
+__ZN3JSC19JSStaticScopeObject4markEv
+__ZN3JSC8JITStubs19cti_op_loop_if_lessEPPv
+__ZN3JSC8JITStubs16cti_op_del_by_idEPvz
+__ZN3JSC7JSArray14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC7UString6appendEPKti
+__ZN3JSC8JITStubs17cti_op_push_scopeEPvz
+__ZN3JSC8JITStubs19cti_op_resolve_baseEPvz
+__ZN3JSC8JITStubs16cti_op_pop_scopeEPvz
+__ZN3JSC8JITStubs17cti_op_is_booleanEPvz
+__ZN3JSCL20arrayProtoFuncSpliceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs17cti_op_jmp_scopesEPvz
+__ZN3JSC8JITStubs9cti_op_inEPvz
+__ZN3JSC8JITStubs15cti_op_stricteqEPvz
+__ZN3JSC8JITStubs32cti_op_get_by_id_proto_list_fullEPvz
+__ZN3WTF6VectorIiLm8EE14expandCapacityEm
+__ZN3JSCL21stringProtoFuncSearchEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs12cti_vm_throwEPvz
+__ZN3JSC8JITStubs21cti_op_push_new_scopeEPvz
+__ZN3JSC8JITStubs16cti_op_is_numberEPvz
+__ZN3JSC16JSVariableObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZNK3JSC8JSString8toObjectEPNS_9ExecStateE
+__ZN3JSC12StringObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3JSC9ExecState11stringTableEPS0_
+__ZN3JSC11JSImmediate8toObjectENS_7JSValueEPNS_9ExecStateE
+__ZN3JSC36constructBooleanFromImmediateBooleanEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC13BooleanObjectD1Ev
+__ZN3JSCL17arrayProtoFuncMapEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArrayC2EN3WTF10PassRefPtrINS_9StructureEEEj
+__ZN3JSC8JITStubs17cti_op_del_by_valEPvz
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_failEPvz
+__ZN3JSC10JSFunction12callerGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC11Interpreter14retrieveCallerEPNS_9ExecStateEPNS_16InternalFunctionE
+__ZN3JSC18globalFuncIsFiniteEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC6JSCell18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZNK3JSC12JSNumberCell8toObjectEPNS_9ExecStateE
+__ZN3JSC15constructNumberEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC12NumberObject11getJSNumberEv
+__ZN3JSCL7dateNowEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12NumberObjectD1Ev
+__ZN3JSC8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZN3JSCL22numberProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC13JSNotAnObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC19JSStaticScopeObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC16InternalFunction4nameEPNS_12JSGlobalDataE
+__ZN3JSCL18arrayProtoFuncSomeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSString18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC12JSNumberCell11getJSNumberEv
+__ZN3JSC23createNotAFunctionErrorEPNS_9ExecStateENS_7JSValueEjPNS_9CodeBlockE
+__ZN3JSC17PrefixBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17PrefixBracketNodeD0Ev
+__ZN3JSC17RegExpConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL21callRegExpConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArray4sortEPNS_9ExecStateE
+__ZN3JSCL27dateProtoFuncSetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncSetUTCHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23setNewValueFromTimeArgsEPNS_9ExecStateENS_7JSValueERKNS_7ArgListEib
+__ZN3JSC8JITStubs17cti_op_switch_immEPvz
+__ZN3JSC12RegExpObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSCL24setRegExpObjectLastIndexEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
+__ZN3JSCL28regExpConstructorLeftContextEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC18RegExpMatchesArray14deletePropertyEPNS_9ExecStateEj
+__ZN3JSC18RegExpMatchesArray3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC10JSFunction12lengthGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC12NumberObject9classInfoEv
+__ZN3JSC8JITStubs12cti_op_throwEPvz
+__ZN3JSCL19isNonASCIIIdentPartEi
+__ZN3JSCL27dateProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16formatLocaleDateEPNS_9ExecStateEPNS_12DateInstanceEdNS_20LocaleDateTimeFormatERKNS_7ArgListE
+__ZN3JSCL21dateProtoFuncSetHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncSetMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncSetSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28dateProtoFuncSetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12JSNumberCell12toThisObjectEPNS_9ExecStateE
+__ZN3JSC16ErrorConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL20callErrorConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectES6_RKNS_7ArgListEE
+__ZN3JSC17PrototypeFunctionC2EPNS_9ExecStateEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectES6_RKNS_7ArgListEE
+__ZN3JSC17PrototypeFunction11getCallDataERNS_8CallDataE
+__ZN3JSC17PrototypeFunctionD1Ev
+__ZN3JSCL24booleanProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17BytecodeGenerator18emitJumpSubroutineEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC3JIT11emit_op_jsrEPNS_11InstructionE
+__ZN3WTF6VectorIN3JSC3JIT7JSRInfoELm0EE14expandCapacityEm
+__ZN3JSC3JIT12emit_op_sretEPNS_11InstructionE
 __ZN3JSC6Parser7reparseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EEPNS_12JSGlobalDataEPS5_
-__ZN3JSC8EvalNode6createEPNS_12JSGlobalDataEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS6_INS5_6RefPtrINS_12FuncDeclNodeEEELm0EEERKNS_10SourceCodeEji
+__ZN3JSC8EvalNode6createEPNS_12JSGlobalDataEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS6_IPNS_12Func
 __ZN3JSC8EvalNode31bytecodeForExceptionInfoReparseEPNS_14ScopeChainNodeEPNS_9CodeBlockE
+__ZN3JSC20FixedVMPoolAllocator17coalesceFreeSpaceEv
+__ZN3WTF6VectorIPN3JSC13FreeListEntryELm0EE15reserveCapacityEm
+__ZN3JSCL35reverseSortFreeListEntriesByPointerEPKvS1_
+__ZN3JSC14globalFuncEvalEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21functionProtoFuncCallEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL22functionProtoFuncApplyEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC9Arguments11fillArgListEPNS_9ExecStateERNS_20MarkedArgumentBufferE
+__ZNK3JSC7JSValue12toThisObjectEPNS_9ExecStateE
+__ZN3JSC8VoidNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8VoidNodeD0Ev
+__ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEN3WTF10PassRefPtrINS_9StructureEEERKNS_10IdentifierE
+__ZN3JSC20MarkedArgumentBuffer9markListsERN3WTF7HashSetIPS0_NS1_7PtrHashIS3_EENS1_10HashTraitsIS3_EEEE
+__ZN3JSC7CStringaSERKS0_
+__ZNK3JSC19JSStaticScopeObject14isDynamicScopeEv
+__ZN3JSCL33reverseSortCommonSizedAllocationsEPKvS1_
+__ZN3JSCL20arrayProtoFuncFilterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSC17NumberConstructor16getConstructDataERNS_13ConstructDataE
 __ZN3JSCL30constructWithNumberConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC17BytecodeGenerator18emitUnexpectedLoadEPNS_10RegisterIDEb
+__ZN3JSC8JITStubs12cti_op_throwEPPv
+__ZN3JSC6JSCell9getObjectEv
+__ZN3JSCL21arrayProtoFuncReverseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZNK3JSC8JSObject16isVariableObjectEv
-__ZN3JSC36constructBooleanFromImmediateBooleanEPNS_9ExecStateENS_10JSValuePtrE
-__ZN3JSC13BooleanObjectD0Ev
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS2_14OffsetLocationEENS_18PairFirstExtractorIS8_EENS_7StrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSE_IS7_EEEESF_E4findIPS4_NS_29RefPtrHashMapRawKeyTranslatorISK_S8_SH_SC_EEEENS_17HashTableIteratorIS5_S8_SA_SC_SH_SF_EERKT_
-__ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeE
-__ZN3JSC14globalFuncEvalEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter7executeEPNS_8EvalNodeEPNS_9ExecStateEPNS_8JSObjectEPNS_14ScopeChainNodeEPNS_10JSValuePtrE
-__ZN3JSC11Interpreter19cti_op_put_by_indexEPvz
+__ZN3JSC18EmptyStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSCL27compareByStringPairForQSortEPKvS1_
+__Z22jsc_pcre_ucp_othercasej
+__ZN3JSCL35objectProtoFuncPropertyIsEnumerableEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
+__ZN3WTF7HashMapIjN3JSC7JSValueENS_7IntHashIjEENS_10HashTraitsIjEENS5_IS2_EEE3setERKjRKS2_
+__ZN3WTF9HashTableIjSt4pairIjN3JSC7JSValueEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEE
+__ZN3JSC12RegisterFile21releaseExcessCapacityEv
+__ZN3JSCL20isNonASCIIIdentStartEi
+__ZN3JSC17BytecodeGenerator14emitPutByIndexEPNS_10RegisterIDEjS2_
+__ZN3JSC3JIT20emit_op_put_by_indexEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_put_by_indexEPPv
 __ZN3JSCL25numberConstructorMaxValueEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 __ZN3JSCL28numberConstructorPosInfinityEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 __ZN3JSCL28numberConstructorNegInfinityEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL17mathProtoFuncATanEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC18RegExpMatchesArray14deletePropertyEPNS_9ExecStateEj
-__ZN3JSC18RegExpMatchesArray3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSC7JSArray14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3JSC18EmptyStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSCL17mathProtoFuncASinEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL18mathProtoFuncATan2EPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC16ErrorConstructor11getCallDataERNS_8CallDataE
-__ZN3JSCL20callErrorConstructorEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL7dateNowEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
 __ZN3JSC18BooleanConstructor11getCallDataERNS_8CallDataE
-__ZN3JSCL22callBooleanConstructorEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL20arrayProtoFuncFilterEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC4WREC9Generator28generateParenthesesAssertionERNS_14MacroAssembler8JumpListE
-__ZN3JSCL21regExpObjectLastIndexEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL18arrayProtoFuncSomeEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC12RegExpObject3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSCL24setRegExpObjectLastIndexEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrE
-__ZN3JSC26createNotAConstructorErrorEPNS_9ExecStateENS_10JSValuePtrEjPNS_9CodeBlockE
-__ZN3JSC15isStrWhiteSpaceEt
-__ZN3JSCL27dateProtoFuncGetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL24dateProtoFuncGetUTCMonthEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL23dateProtoFuncGetUTCDateEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL24dateProtoFuncGetUTCHoursEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL26dateProtoFuncGetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL7dateUTCEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL21dateProtoFuncSetHoursEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL23setNewValueFromTimeArgsEPNS_9ExecStateENS_10JSValuePtrERKNS_7ArgListEib
-__ZN3JSCL23dateProtoFuncSetMinutesEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL23dateProtoFuncSetSecondsEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL28dateProtoFuncSetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC7CStringaSERKS0_
-__ZN3JSCL22dateProtoFuncGetUTCDayEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC7UString8toUInt32EPb
-__ZN3JSC12RegExpObject11getCallDataERNS_8CallDataE
-__ZNK3JSC8JSObject14isGlobalObjectEv
-__ZN3JSC8JSString18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSC8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRNS_10JSValuePtrE
-__ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKc
-__ZN3JSC16JSVariableObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZN3JSC17BytecodeGenerator18emitUnexpectedLoadEPNS_10RegisterIDEb
-__ZN3WTF6VectorIN3JSC10JSValuePtrELm0EE14expandCapacityEm
-__ZN3JSC18BooleanConstructor16getConstructDataERNS_13ConstructDataE
-__ZN3JSCL31constructWithBooleanConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
-__ZN3JSC16constructBooleanEPNS_9ExecStateERKNS_7ArgListE
-__ZN3JSCL26stringFromCharCodeSlowCaseEPNS_9ExecStateERKNS_7ArgListE
-__ZN3JSCL27dateProtoFuncSetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL26dateProtoFuncGetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL31dateProtoFuncGetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL28dateProtoFuncGetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK3JSC12JSNumberCell9getUInt32ERj
-__ZN3JSC13JSNotAnObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSCL23booleanProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL27dateProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC9Arguments14deletePropertyEPNS_9ExecStateEj
-__ZNK3JSC21UStringSourceProvider8getRangeEii
-__ZN3JSC22NativeErrorConstructor11getCallDataERNS_8CallDataE
-__ZN3JSCL23dateProtoFuncSetUTCDateEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-JSClassCreate
+__ZN3JSCL22callBooleanConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL17mathProtoFuncATanEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs17cti_op_jmp_scopesEPPv
+__ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateEj
+__ZN3JSCL17mathProtoFuncASinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC11Interpreter7executeEPNS_8EvalNodeEPNS_9ExecStateEPNS_8JSObjectEPNS_14ScopeChainNodeEPNS_7JSValueE
+_JSContextGetGlobalObject
+__ZN3JSC4Heap14registerThreadEv
+__ZN3JSC6JSLockC1EPNS_9ExecStateE
+_JSStringCreateWithUTF8CString
+__ZN3WTF7Unicode18convertUTF8ToUTF16EPPKcS2_PPtS4_b
+_JSClassCreate
 __ZN13OpaqueJSClass6createEPK17JSClassDefinition
 __ZN13OpaqueJSClassC2EPK17JSClassDefinitionPS_
 __ZN3JSC7UString3Rep14createFromUTF8EPKc
-__ZN3WTF7Unicode18convertUTF8ToUTF16EPPKcS2_PPtS4_b
-__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEP19StaticFunctionEntryNS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3addERKS5_RKS7_
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_P19StaticFunctionEntryENS_18PairFirstExtractorIS9_EENS_7StrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSF_IS8_EEEESG_E6expandEv
-JSClassRetain
-JSObjectMake
-__ZN3JSC4Heap14registerThreadEv
-__ZN3JSC6JSLockC1EPNS_9ExecStateE
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEP19StaticFunctionEntryNS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3addERKS
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_P19StaticFunctionEntryENS_18PairFirstExtractorIS9_EENS_7StrHashIS5
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEP16StaticValueEntryNS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3addERKS5_R
+_JSClassRetain
+_JSObjectMake
 __ZN3JSC16JSCallbackObjectINS_8JSObjectEE4initEPNS_9ExecStateE
 __ZN13OpaqueJSClass9prototypeEPN3JSC9ExecStateE
 __ZN13OpaqueJSClass11contextDataEPN3JSC9ExecStateE
-__ZN3WTF9HashTableIP13OpaqueJSClassSt4pairIS2_P24OpaqueJSClassContextDataENS_18PairFirstExtractorIS6_EENS_7PtrHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS5_EEEESD_E6expandEv
+__ZN3WTF9HashTableIP13OpaqueJSClassSt4pairIS2_P24OpaqueJSClassContextDataENS_18PairFirstExtractorIS6_EENS_7PtrHashIS2_EENS_14Pa
 __ZN24OpaqueJSClassContextDataC2EP13OpaqueJSClass
-JSStringCreateWithCFString
-JSObjectSetProperty
-__ZNK14OpaqueJSString10identifierEPN3JSC12JSGlobalDataE
-JSStringRelease
-__ZL30makeGetterOrSetterPropertyNodePvRKN3JSC10IdentifierES3_PNS0_13ParameterNodeEPNS0_16FunctionBodyNodeERKNS0_10SourceCodeE
-__ZN3JSC18ConstStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC13ConstDeclNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC13ConstDeclNode14emitCodeSingleERNS_17BytecodeGeneratorE
-__ZN3JSC17BytecodeGenerator13emitPutGetterEPNS_10RegisterIDERKNS_10IdentifierES2_
-__ZN3JSC17BytecodeGenerator13emitPutSetterEPNS_10RegisterIDERKNS_10IdentifierES2_
-__ZN3JSC18ConstStatementNodeD1Ev
-__ZN3JSC18ConstStatementNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC13ConstDeclNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC11Interpreter17cti_op_put_getterEPvz
-__ZN3JSC11Interpreter17cti_op_put_setterEPvz
-__ZN3JSC16JSCallbackObjectINS_8JSObjectEE18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
 __ZN3JSC7UString3Rep13createCopyingEPKti
+_JSObjectSetProperty
+__ZNK14OpaqueJSString10identifierEPN3JSC12JSGlobalDataE
+__ZN3JSC14JSGlobalObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
+_JSStringRelease
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
 __ZN3JSC16JSCallbackObjectINS_8JSObjectEE20staticFunctionGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 __ZN3JSC18JSCallbackFunctionC1EPNS_9ExecStateEPFPK13OpaqueJSValuePK15OpaqueJSContextPS3_S9_mPKS5_PS5_ERKNS_10IdentifierE
 __ZN3JSC18JSCallbackFunction11getCallDataERNS_8CallDataE
-__ZN3JSC18JSCallbackFunction4callEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
+__ZN3JSC18JSCallbackFunction4callEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSC6JSLock12DropAllLocksC1EPNS_9ExecStateE
-JSValueIsObjectOfClass
-__ZN3JSC6JSCell9getObjectEv
+_JSObjectGetPrivate
 __ZNK3JSC16JSCallbackObjectINS_8JSObjectEE9classInfoEv
-JSObjectGetPrivate
-JSValueMakeString
-__ZNK14OpaqueJSString7ustringEv
-JSValueMakeBoolean
-JSContextGetGlobalObject
-JSStringCreateWithUTF8CString
-JSObjectGetProperty
-JSValueToObject
-JSObjectIsFunction
-JSObjectCallAsFunction
-JSValueMakeUndefined
-__ZN3JSC18JSCallbackFunctionD0Ev
-__ZN3JSC16JSCallbackObjectINS_8JSObjectEED0Ev
-__ZL25clearReferenceToPrototypeP13OpaqueJSValue
-JSClassRelease
-__ZN3JSC15AssignErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC23ThrowableExpressionData14emitThrowErrorERNS_17BytecodeGeneratorENS_9ErrorTypeEPKc
-__ZN3JSC17BytecodeGenerator12emitNewErrorEPNS_10RegisterIDENS_9ErrorTypeENS_10JSValuePtrE
-__ZN3JSC15AssignErrorNodeD1Ev
-__ZN3JSC15AssignErrorNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC12StringObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3JSC12StringObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZN3JSC9ExecState11stringTableEPS0_
-__ZN3JSCL24dateProtoFuncSetUTCHoursEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
+_JSValueMakeUndefined
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE17staticValueGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 __ZN14OpaqueJSString6createERKN3JSC7UStringE
-JSStringIsEqualToUTF8CString
-__ZN3JSC16JSCallbackObjectINS_8JSObjectEE14callbackGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-JSValueToStringCopy
-JSStringCopyCFString
-JSValueMakeNumber
-__ZN3JSC16JSCallbackObjectINS_8JSObjectEE3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-JSValueToNumber
-JSObjectSetPrivate
-__ZN3JSC8Profiler8profilerEv
-__ZN3JSC8Profiler13stopProfilingEPNS_9ExecStateERKNS_7UStringE
+_JSStringCreateWithCharacters
+_JSValueMakeString
+__ZNK14OpaqueJSString7ustringEv
+__ZN3JSC7UStringC1EPtib
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEED1Ev
+_JSClassRelease
+__ZL25clearReferenceToPrototypeP13OpaqueJSValue
+_JSObjectGetProperty
+_JSValueToObject
+__ZN3JSCL22dateProtoFuncGetUTCDayEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncGetUTCMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncGetUTCDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL27dateProtoFuncGetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString8toUInt32EPb
+__ZN3JSCL24dateProtoFuncGetUTCHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncGetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncGetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL7dateUTCEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12RegExpObject11getCallDataERNS_8CallDataE
+__ZN3JSC9Arguments14deletePropertyEPNS_9ExecStateEj
+_JSValueMakeBoolean
+_JSValueToNumber
+_JSStringCreateWithCFString
+__ZN3WTF13tryFastCallocEmm
+_JSValueMakeNumber
+__ZN3JSC18JSCallbackFunctionD1Ev
+_JSValueToStringCopy
+_JSStringCopyCFString
+__ZN3JSC18ConstStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13ConstDeclNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13ConstDeclNode14emitCodeSingleERNS_17BytecodeGeneratorE
+__ZN3JSC13ConstDeclNodeD0Ev
+__ZN3JSC18ConstStatementNodeD0Ev
+__ZN3JSC18BooleanConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL31constructWithBooleanConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC16constructBooleanEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL31dateProtoFuncGetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28dateProtoFuncGetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL31dateProtoFuncToLocaleTimeStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21regExpObjectLastIndexEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC21DebuggerStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21DebuggerStatementNodeD0Ev
+__ZN3JSC4Yarr12RegexPattern21newlineCharacterClassEv
+__ZN3JSC17ObjectConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL23dateProtoFuncSetUTCDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26stringFromCharCodeSlowCaseEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL21callObjectConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL27objectProtoFuncDefineGetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
+__ZN3JSC12GetterSetter4markEv
+__ZN3JSC12GetterSetterD1Ev
+__ZN3JSCL22regExpProtoFuncCompileEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC17NumberConstructor9classInfoEv
+__ZNK3JSC17RegExpConstructor9classInfoEv
+__ZN3JSCL31dateProtoFuncToLocaleDateStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSObject14isGlobalObjectEv
+_JSValueToBoolean
+__ZN3JSC8JITStubs13cti_op_lshiftEPPv
+__ZN3JSC8JITStubs13cti_op_bitnotEPPv
+__ZN3JSC6JSCell3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC19FunctionConstructor11getCallDataERNS_8CallDataE
+__ZN3WTF9ByteArray6createEm
+__ZNK3JSC6JSCell9getStringERNS_7UStringE
+__ZN3JSC3JIT12emit_op_loopEPNS_11InstructionE
+__ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeE
+__ZN3JSC11JSByteArrayC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
+__ZN3JSC11JSByteArrayC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
+__ZN3JSC11JSByteArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC11JSByteArray3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC11JSByteArray3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC11JSByteArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC8JITStubs28cti_op_get_by_val_byte_arrayEPPv
+__ZN3JSC8JITStubs28cti_op_put_by_val_byte_arrayEPPv
+__ZL30makeGetterOrSetterPropertyNodePvRKN3JSC10IdentifierES3_PNS0_13ParameterNodeEPNS0_16FunctionBodyNodeERKNS0_10SourceCodeE
+__ZN3JSC17BytecodeGenerator13emitPutGetterEPNS_10RegisterIDERKNS_10IdentifierES2_
+__ZN3JSC17BytecodeGenerator13emitPutSetterEPNS_10RegisterIDERKNS_10IdentifierES2_
+__ZN3JSC3JIT18emit_op_put_getterEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_put_setterEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_put_getterEPPv
+__ZN3JSC8JITStubs17cti_op_put_setterEPPv
+__ZN3JSC8JSObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
+__ZNK3JSC12GetterSetter14isGetterSetterEv
+__ZNK3JSC6JSCell14isGetterSetterEv
+__ZN3JSCL29regExpConstructorRightContextEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC5Lexer19copyCodeWithoutBOMsEv
+__ZN3JSC13JSNotAnObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC6JSCell16getConstructDataERNS_13ConstructDataE
+__ZN3JSC26createNotAConstructorErrorEPNS_9ExecStateENS_7JSValueEjPNS_9CodeBlockE
+__ZN3JSC15isStrWhiteSpaceEt
+__ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKc
+__ZNK3JSC22NativeErrorConstructor9classInfoEv
+__ZNK3JSC16JSCallbackObjectINS_8JSObjectEE9classNameEv
+__ZN3JSC4Heap11objectCountEv
+__ZNK3JSC12SmallStrings5countEv
+__ZN3JSC14JSGlobalObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
+__ZN3JSCL27objectProtoFuncLookupGetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSObject12lookupGetterEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSCL27objectProtoFuncDefineSetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC14JSGlobalObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
+__ZN3JSC9Structure22getterSetterTransitionEPS0_
+__ZN3JSC8JSObject22fillGetterPropertySlotERNS_12PropertySlotEPNS_7JSValueE
+__ZN3JSC12PropertySlot14functionGetterEPNS_9ExecStateERKNS_10IdentifierERKS0_
+__ZN3JSCL28objectProtoFuncIsPrototypeOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12StringObjectC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEERKNS_7UStringE
+__ZNK3JSC7UString6is8BitEv
 __ZN3JSC8JSObject15unwrappedObjectEv
-JSStringCreateWithCharacters
-__ZN3JSC9Structure18startIgnoringLeaksEv
-__ZN3JSC9Structure17stopIgnoringLeaksEv
-JSValueProtect
-JSObjectCallAsConstructor
-__ZN3JSC10JSFunction16getConstructDataERNS_13ConstructDataE
-__ZN3JSC9constructEPNS_9ExecStateENS_10JSValuePtrENS_13ConstructTypeERKNS_13ConstructDataERKNS_7ArgListE
-__ZN3JSC10JSFunction9constructEPNS_9ExecStateERKNS_7ArgListE
-__ZN3JSCL28stringProtoFuncLocaleCompareEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
+__ZN3JSC22NativeErrorConstructor11getCallDataERNS_8CallDataE
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE11getCallDataERNS_8CallDataE
+__ZN3JSC17BytecodeGenerator21emitComplexJumpScopesEPNS_5LabelEPNS_18ControlFlowContextES4_
+__ZN3JSC23ThrowableExpressionData14emitThrowErrorERNS_17BytecodeGeneratorENS_9ErrorTypeEPKc
+__ZN3JSC17BytecodeGenerator12emitNewErrorEPNS_10RegisterIDENS_9ErrorTypeENS_7JSValueE
+__ZN3JSC3JIT17emit_op_new_errorEPNS_11InstructionE
+__ZN3JSC23MacroAssemblerX86Common8branch16ENS0_9ConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE9BaseIndexENS4_5Imm32E
+_JSStringRetain
+__ZN3JSCL19arrayProtoFuncEveryEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL20arrayProtoFuncReduceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25arrayProtoFuncReduceRightEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28arrayProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25arrayProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC15AssignErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8JITStubs16cti_op_new_errorEPPv
+__ZN3JSC15AssignErrorNodeD0Ev
+__ZN3JSC17BytecodeGenerator18emitUnexpectedLoadEPNS_10RegisterIDEd
+__ZN3JSC19JSStaticScopeObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC9ExecState9dateTableEPS0_
+__ZNK3JSC15RegExpPrototype9classInfoEv
+__ZN3JSC12StringObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSCL25dateProtoFuncToDateStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25dateProtoFuncToTimeStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25numberConstructorNaNValueEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL31dateProtoFuncSetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncSetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncSetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncSetUTCMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23throwStackOverflowErrorEPNS_9ExecStateEPNS_12JSGlobalDataEPvRS4_
+__ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
+__ZN3JSC15DeleteValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15DeleteValueNodeD0Ev
+__ZN3JSC16PostfixErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15PrefixErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC16PostfixErrorNodeD0Ev
+__ZN3JSC15PrefixErrorNodeD0Ev
+__ZN3JSC23createInvalidParamErrorEPNS_9ExecStateEPKcNS_7JSValueEjPNS_9CodeBlockE
+__ZNK3JSC15DotAccessorNode17isDotAccessorNodeEv
+__ZNK3JSC14ExpressionNode17isDotAccessorNodeEv
+__ZN3JSC13JSNotAnObject3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC4Heap24setGCProtectNeedsLockingEv
+__ZN3JSCL23callFunctionConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC16JSCallbackObjectINS_8JSObjectEE8toStringEPNS_9ExecStateE
+__ZN3JSC8JITStubs17cti_op_instanceofEPPv
+__ZN3JSC17BytecodeGenerator35emitThrowExpressionTooDeepExceptionEv
+__ZN3JSCL25numberConstructorMinValueEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL17mathProtoFuncACosEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18mathProtoFuncATan2EPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncTanEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28numberProtoFuncToExponentialEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26numberProtoFuncToPrecisionEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL12charSequenceEci
+__ZN3JSCL29objectProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC6JSCell14toThisJSStringEPNS_9ExecStateE
+__ZNK3JSC6JSCell12toThisStringEPNS_9ExecStateE
+__ZN3JSCL27objectProtoFuncLookupSetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSObject12lookupSetterEPNS_9ExecStateERKNS_10IdentifierE
+__ZNK3JSC16JSVariableObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
+__ZN3JSC9ExecState22regExpConstructorTableEPS0_
+__ZN3JSCL24regExpConstructorDollar7EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar8EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar9EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL22regExpConstructorInputEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL25setRegExpConstructorInputEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
+__ZN3JSCL26regExpConstructorLastMatchEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL26regExpConstructorLastParenEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL26regExpConstructorMultilineEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL29setRegExpConstructorMultilineEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
+__ZN3JSC4Yarr15nondigitsCreateEv
+__ZNK3JSC19JSStaticScopeObject12toThisObjectEPNS_9ExecStateE
+__ZN3JSC12JSActivation18getArgumentsGetterEv
+__ZN3JSC12JSActivation15argumentsGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL23booleanProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28stringProtoFuncLocaleCompareEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3WTF8Collator11userDefaultEv
 __ZNK3WTF8Collator7collateEPKtmS2_m
 __ZNK3WTF8Collator14createCollatorEv
 __ZN3WTF8CollatorD1Ev
 __ZN3WTF8Collator15releaseCollatorEv
-__ZNK3JSC22NativeErrorConstructor9classInfoEv
-JSValueUnprotect
-JSValueIsNumber
-__ZN3JSC8Debugger6attachEPNS_14JSGlobalObjectE
-__ZN3WTF7HashSetIPN3JSC14JSGlobalObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
-__ZN3JSC4Heap14primaryHeapEndEv
-__ZN3JSC4Heap16primaryHeapBeginEv
-__ZNK3JSC15RegExpPrototype9classInfoEv
-__ZNK3JSC17NumberConstructor9classInfoEv
-__ZNK3JSC17RegExpConstructor9classInfoEv
 __ZNK3JSC10MathObject9classInfoEv
-__ZNK3JSC18JSCallbackFunction9classInfoEv
-JSValueIsString
-JSStringGetLength
-JSStringGetCharactersPtr
-__ZN3JSC11Interpreter12cti_op_debugEPvz
-__ZN3JSC11Interpreter5debugEPNS_9ExecStateENS_11DebugHookIDEii
-__ZNK3JSC17DebuggerCallFrame4typeEv
-__ZNK3JSC17DebuggerCallFrame12functionNameEv
-__ZNK3JSC17DebuggerCallFrame10thisObjectEv
-__ZN3WTF28setMainThreadCallbacksPausedEb
-__ZN3JSC8Debugger6detachEPNS_14JSGlobalObjectE
-__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
+__ZN3JSC9ExecState9mathTableEPS0_
 __ZN3WTF6VectorIN3JSC20FunctionRegisterInfoELm0EE14expandCapacityEm
+__ZN3JSC3JIT25emit_op_profile_will_callEPNS_11InstructionE
+__ZN3JSC3JIT24emit_op_profile_did_callEPNS_11InstructionE
+__ZN3JSC8Profiler8profilerEv
 __ZN3JSC8Profiler14startProfilingEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC16ProfileGenerator6createERKNS_7UStringEPNS_9ExecStateEj
 __ZN3JSC16ProfileGeneratorC2ERKNS_7UStringEPNS_9ExecStateEj
 __ZN3JSC7Profile6createERKNS_7UStringEj
-__ZN3JSC11TreeProfile6createERKNS_7UStringEj
 __ZN3JSC7ProfileC2ERKNS_7UStringEj
 __ZN3JSC11ProfileNodeC1ERKNS_14CallIdentifierEPS0_S4_
 __ZN3JSC33getCurrentUTCTimeWithMicrosecondsEv
 __ZN3JSC16ProfileGenerator24addParentForConsoleStartEPNS_9ExecStateE
-__ZN3JSC8Profiler20createCallIdentifierEPNS_12JSGlobalDataENS_10JSValuePtrERKNS_7UStringEi
+__ZN3JSC8Profiler20createCallIdentifierEPNS_12JSGlobalDataENS_7JSValueERKNS_7UStringEi
+__ZN3JSC16InternalFunction21calculatedDisplayNameEPNS_12JSGlobalDataE
 __ZN3JSC11ProfileNode10insertNodeEN3WTF10PassRefPtrIS0_EE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC11ProfileNodeEEELm0EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN3JSC16ProfileGeneratorEEELm0EE14expandCapacityEm
-__ZN3WTF10RefCountedIN3JSC16ProfileGeneratorEE5derefEv
-__ZN3JSC8Profiler11willExecuteEPNS_9ExecStateENS_10JSValuePtrE
-__ZN3JSC8Profiler10didExecuteEPNS_9ExecStateENS_10JSValuePtrE
-__ZN3JSC16ProfileGenerator11willExecuteERKNS_14CallIdentifierE
-__ZN3JSC11ProfileNode11willExecuteERKNS_14CallIdentifierE
-__ZN3JSC11Interpreter24cti_op_profile_will_callEPvz
-__ZN3JSC11Interpreter23cti_op_profile_did_callEPvz
+__ZN3JSC8JITStubs23cti_op_profile_did_callEPPv
+__ZN3JSC8Profiler10didExecuteEPNS_9ExecStateENS_7JSValueE
 __ZN3JSC16ProfileGenerator10didExecuteERKNS_14CallIdentifierE
 __ZN3JSC11ProfileNode10didExecuteEv
-__ZN3JSCL28numberProtoFuncToExponentialEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL26numberProtoFuncToPrecisionEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter16cti_op_new_errorEPvz
-__ZN3JSC19JSStaticScopeObject3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSC4WREC14CharacterClass11nonwordcharEv
-__ZN3JSC19FunctionConstructor11getCallDataERNS_8CallDataE
-__ZN3JSCL23callFunctionConstructorEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC17ObjectConstructor11getCallDataERNS_8CallDataE
-__ZN3JSCL21callObjectConstructorEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC12JSActivation14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3JSCL26dateProtoFuncSetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL26dateProtoFuncSetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC15PrefixErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC15PrefixErrorNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC15PrefixErrorNodeD1Ev
-__ZN3JSCL19stringProtoFuncBoldEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3WTF6VectorIPNS0_IN3JSC10RegisterIDELm512EEELm32EE15reserveCapacityEm
-__ZN3JSC12StringObjectC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEERKNS_7UStringE
-__ZN3JSCL24regExpConstructorDollar5EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
-__ZN3JSC6JSCell3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-JSValueIsEqual
-__ZN3JSC10JSValuePtr13equalSlowCaseEPNS_9ExecStateES0_S0_
-__ZN3JSCL16mathProtoFuncTanEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC11Interpreter15cti_op_post_decEPvz
-__ZN3JSCL28regExpConstructorLeftContextEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL31dateProtoFuncToLocaleDateStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC21DebuggerStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC21DebuggerStatementNodeD1Ev
-__ZN3JSCL12charSequenceEci
-__ZN3JSCL17mathProtoFuncACosEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC4Heap24setGCProtectNeedsLockingEv
-__ZNK3JSC7UString6is8BitEv
-__ZN3WTF9ByteArray6createEm
-__ZN3JSC11JSByteArrayC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
-__ZN3JSC11JSByteArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC11Interpreter28cti_op_get_by_val_byte_arrayEPvz
-__ZN3JSC11JSByteArray3putEPNS_9ExecStateEjNS_10JSValuePtrE
-__ZN3JSC11JSByteArray3putEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrERNS_15PutPropertySlotE
-__ZN3JSC11JSByteArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSC11Interpreter28cti_op_put_by_val_byte_arrayEPvz
-__ZN3JSCL28objectProtoFuncIsPrototypeOfEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC14JSGlobalObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
-__ZN3JSC14JSGlobalObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
-__ZN3JSC6JSCell16getConstructDataERNS_13ConstructDataE
-__ZN3JSCL25numberConstructorNaNValueEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL23throwStackOverflowErrorEPNS_9ExecStateEPNS_12JSGlobalDataEPvRS4_
-__ZN3JSCL24regExpConstructorDollar6EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL24regExpConstructorDollar7EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSC9ExecState9mathTableEPS0_
-__ZN3JSC9ExecState22regExpConstructorTableEPS0_
-__ZN3JSCL24regExpConstructorDollar8EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL24regExpConstructorDollar9EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL22regExpConstructorInputEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL25setRegExpConstructorInputEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrE
-__ZN3JSCL26regExpConstructorLastMatchEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL26regExpConstructorLastParenEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL26regExpConstructorMultilineEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL29setRegExpConstructorMultilineEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrE
-__ZN3JSCL29regExpConstructorRightContextEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSC16PostfixErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC16PostfixErrorNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC16PostfixErrorNodeD1Ev
-__ZN3JSC6JSCell11getJSNumberEv
-__ZN3JSC14JSGlobalObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_10JSValuePtrEj
-__ZN3JSCL25arrayProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL25numberConstructorMinValueEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSCL22regExpProtoFuncCompileEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL19arrayProtoFuncEveryEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL29objectProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC6JSCell14toThisJSStringEPNS_9ExecStateE
-__ZNK3JSC6JSCell12toThisStringEPNS_9ExecStateE
-__ZN3JSCL31dateProtoFuncSetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL24dateProtoFuncSetUTCMonthEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL28arrayProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC12JSActivation18getArgumentsGetterEv
-__ZN3JSC12JSActivation15argumentsGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSC9ExecState9dateTableEPS0_
-__ZN3JSC23createInvalidParamErrorEPNS_9ExecStateEPKcNS_10JSValuePtrEjPNS_9CodeBlockE
-__ZNK3JSC15DotAccessorNode17isDotAccessorNodeEv
-__ZNK3JSC14ExpressionNode17isDotAccessorNodeEv
-__ZN3JSC13JSNotAnObject3putEPNS_9ExecStateEjNS_10JSValuePtrE
-__ZN3JSC15DeleteValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
-__ZN3JSC15DeleteValueNodeD1Ev
-__ZN3JSC15DeleteValueNode12releaseNodesERNS_12NodeReleaserE
-__ZN3JSC17BytecodeGenerator18emitUnexpectedLoadEPNS_10RegisterIDEd
-__ZN3JSC4WREC14CharacterClass9nondigitsEv
-__ZNK3JSC19JSStaticScopeObject12toThisObjectEPNS_9ExecStateE
-__ZNK3JSC16JSVariableObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
-__ZN3JSCL25dateProtoFuncToDateStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSCL25dateProtoFuncToTimeStringEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN3JSC17BytecodeGenerator35emitThrowExpressionTooDeepExceptionEv
-__ZN3JSC12JSGlobalData6createEv
-__ZN3WTF12isMainThreadEv
-__ZN3JSC4Heap7destroyEv
-__ZN3JSC12JSGlobalDataD1Ev
-__ZN3JSC11InterpreterD1Ev
-__ZN3JSC12RegisterFileD1Ev
-__ZNK3JSC9HashTable11deleteTableEv
-__ZN3JSC5LexerD1Ev
-__ZN3WTF20deleteAllPairSecondsIP24OpaqueJSClassContextDataKNS_7HashMapIP13OpaqueJSClassS2_NS_7PtrHashIS5_EENS_10HashTraitsIS5_EENS8_IS2_EEEEEEvRT0_
-__ZN3JSC17CommonIdentifiersD2Ev
-__ZN3JSC21deleteIdentifierTableEPNS_15IdentifierTableE
-__ZN3JSC4HeapD1Ev
-__ZN3JSC12SmallStringsD1Ev
-__ZN3JSC12JSGlobalData10ClientDataD2Ev
-__ZN3WTF8CollatorC1EPKc
-__ZN3WTF8Collator18setOrderLowerFirstEb
+__ZN3JSC8JITStubs24cti_op_profile_will_callEPPv
+__ZN3JSC8Profiler11willExecuteEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC16ProfileGenerator11willExecuteERKNS_14CallIdentifierE
+__ZN3JSC11ProfileNode11willExecuteERKNS_14CallIdentifierE
+__ZN3JSC8Profiler13stopProfilingEPNS_9ExecStateERKNS_7UStringE
+__ZN3JSC16ProfileGenerator13stopProfilingEv
+__ZN3JSC7Profile7forEachEMNS_11ProfileNodeEFvvE
+__ZNK3JSC11ProfileNode25traverseNextNodePostOrderEv
+__ZN3JSC11ProfileNode13stopProfilingEv
+__ZN3JSCeqERKNS_7UStringEPKc
+__ZN3JSC11ProfileNode11removeChildEPS0_
+__ZN3JSC11ProfileNode8addChildEN3WTF10PassRefPtrIS0_EE
+_JSValueIsObjectOfClass
+_JSObjectCallAsConstructor
+__ZN3JSC9constructEPNS_9ExecStateENS_7JSValueENS_13ConstructTypeERKNS_13ConstructDataERKNS_7ArgListE
+_JSObjectCallAsFunction
+__ZN3JSC4Heap14primaryHeapEndEv
+__ZN3JSC4Heap16primaryHeapBeginEv
+__ZNK3JSC18JSCallbackFunction9classInfoEv
+__ZN3JSC8Profiler11willExecuteEPNS_9ExecStateERKNS_7UStringEi
+__ZN3JSC8Profiler10didExecuteEPNS_9ExecStateERKNS_7UStringEi
+__ZNK3JSC16ProfileGenerator5titleEv
+__ZN3JSC7ProfileD0Ev
+__ZN3WTF10RefCountedIN3JSC11ProfileNodeEE5derefEv
+__ZN3JSC4Yarr14RegexGenerator33generatePatternCharacterNonGreedyERNS1_19TermGenerationStateE
 __ZN3JSC35createInterruptedExecutionExceptionEPNS_12JSGlobalDataE
 __ZNK3JSC25InterruptedExecutionError19isWatchdogExceptionEv
+__ZN3JSC25InterruptedExecutionErrorD1Ev
+__ZN3JSC12JSGlobalData10ClientDataD2Ev
+__ZN3JSC18RegExpMatchesArray16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3WTF8CollatorC1EPKc
+__ZN3WTF8Collator18setOrderLowerFirstEb
+__ZN3WTF12randomNumberEv
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZNK3JSC6JSCell9getStringEv
+__ZNK3JSC12DateInstance7getTimeERdRi
+__ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringE
+_JSGlobalContextCreate
+_JSGlobalContextCreateInGroup
+__ZN3JSC4Heap29makeUsableFromMultipleThreadsEv
+_JSGlobalContextRetain
+__ZN3JSC6JSLock6unlockEb
+_JSEvaluateScript
+__ZNK3JSC14JSGlobalObject17supportsProfilingEv
+_JSGlobalContextRelease
+__ZN3JSC14JSGlobalObjectD1Ev
+__ZN3JSC14JSGlobalObject18JSGlobalObjectDataD0Ev
+__ZN3JSC17FunctionPrototype11getCallDataERNS_8CallDataE
+__ZN3JSC15DateConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL8callDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC13JSNotAnObject4markEv
+_JSObjectIsFunction
+__ZN3JSC4Heap17globalObjectCountEv
+__ZN3JSC4Heap20protectedObjectCountEv
+__ZN3JSC4Heap25protectedObjectTypeCountsEv
+__ZN3WTF9HashTableIPKcSt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7PtrHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_I
+__ZN3WTF20fastMallocStatisticsEv
+__ZNK3JSC4Heap10statisticsEv
+__ZN3WTF27releaseFastMallocFreeMemoryEv
+__ZN3JSC10JSFunction16getConstructDataERNS_13ConstructDataE
+__ZN3JSC10JSFunction9constructEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8Debugger6attachEPNS_14JSGlobalObjectE
+__ZN3WTF7HashSetIPN3JSC14JSGlobalObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3JSC3JIT13emit_op_debugEPNS_11InstructionE
+__ZN3JSC8JITStubs12cti_op_debugEPPv
+__ZN3JSC11Interpreter5debugEPNS_9ExecStateENS_11DebugHookIDEii
+__ZN3JSC8Debugger6detachEPNS_14JSGlobalObjectE
+__ZN3JSC9CodeBlock33functionRegisterForBytecodeOffsetEjRi
+_JSStringIsEqualToUTF8CString
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE14callbackGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+_JSObjectSetPrivate
+__ZN3JSC7UString3Rep11computeHashEPKci
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+_JSGarbageCollect
+__ZN3JSC4Heap6isBusyEv
+__ZN3JSCL18styleFromArgStringERKNS_7UStringEl
diff --git a/JavaScriptCore/JavaScriptCore.pri b/JavaScriptCore/JavaScriptCore.pri
index eb4bab3..ef42965 100644
--- a/JavaScriptCore/JavaScriptCore.pri
+++ b/JavaScriptCore/JavaScriptCore.pri
@@ -1,31 +1,67 @@
 # JavaScriptCore - Qt4 build info
 VPATH += $$PWD
 
-INCLUDEPATH += tmp
-INCLUDEPATH += $$PWD $$PWD/parser $$PWD/bytecompiler $$PWD/debugger $$PWD/runtime $$PWD/wtf $$PWD/wtf/unicode $$PWD/interpreter $$PWD/jit $$PWD/profiler $$PWD/wrec $$PWD/API $$PWD/.. \
-               $$PWD/ForwardingHeaders $$PWD/bytecode $$PWD/assembler
-DEFINES += BUILDING_QT__
+CONFIG(debug, debug|release) {
+    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
+    OBJECTS_DIR = obj/debug
+} else { # Release
+    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
+    OBJECTS_DIR = obj/release
+}
 
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR/
+INCLUDEPATH += $$GENERATED_SOURCES_DIR \
+               $$PWD \
+               $$PWD/parser \
+               $$PWD/bytecompiler \
+               $$PWD/debugger \
+               $$PWD/runtime \
+               $$PWD/wtf \
+               $$PWD/wtf/unicode \
+               $$PWD/interpreter \
+               $$PWD/jit \
+               $$PWD/profiler \
+               $$PWD/wrec \
+               $$PWD/yarr \
+               $$PWD/API \
+               $$PWD/.. \
+               $$PWD/ForwardingHeaders \
+               $$PWD/bytecode \
+               $$PWD/assembler \
+
+DEFINES += BUILDING_QT__ BUILDING_JavaScriptCore BUILDING_WTF
+
+GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
 win32-* {
-    GENERATED_SOURCES_DIR_SLASH ~= s|/|\|
     LIBS += -lwinmm
 }
 
-# Disable the JIT due to numerous observed miscompilations :(
+# Default rules to turn JIT on/off
 !contains(DEFINES, ENABLE_JIT=.) {
-    CONFIG(release):isEqual(QT_ARCH,i386) {
-         JIT_DEFINES = ENABLE_JIT ENABLE_WREC ENABLE_JIT_OPTIMIZE_CALL ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS ENABLE_JIT_OPTIMIZE_ARITHMETIC
-         # Require gcc >= 4.1
-         linux-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
-             DEFINES += $$JIT_DEFINES WTF_USE_JIT_STUB_ARGUMENT_VA_LIST
-             QMAKE_CXXFLAGS += -fno-stack-protector
-             QMAKE_CFLAGS += -fno-stack-protector
-         }
-         win32-msvc* {
-             DEFINES += $$JIT_DEFINES WTF_USE_JIT_STUB_ARGUMENT_REGISTER
-         }
+    isEqual(QT_ARCH,i386)|isEqual(QT_ARCH,windows) {
+        # Require gcc >= 4.1
+        CONFIG(release):linux-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
+            DEFINES += ENABLE_JIT=1
+        }
+        win32-msvc* {
+            DEFINES += ENABLE_JIT=1
+        }
+    }
+}
+
+# Rules when JIT enabled
+contains(DEFINES, ENABLE_JIT=1) {
+    !contains(DEFINES, ENABLE_YARR=.): DEFINES += ENABLE_YARR=1
+    !contains(DEFINES, ENABLE_YARR_JIT=.): DEFINES += ENABLE_YARR_JIT=1
+    !contains(DEFINES, ENABLE_JIT_OPTIMIZE_CALL=.): DEFINES += ENABLE_JIT_OPTIMIZE_CALL=1
+    !contains(DEFINES, ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS=.): DEFINES += ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS=1
+    !contains(DEFINES, ENABLE_JIT_OPTIMIZE_ARITHMETIC=.): DEFINES += ENABLE_JIT_OPTIMIZE_ARITHMETIC=1
+    linux-g++* {
+        !contains(DEFINES, WTF_USE_JIT_STUB_ARGUMENT_VA_LIST=.): DEFINES += WTF_USE_JIT_STUB_ARGUMENT_VA_LIST=1
+        QMAKE_CXXFLAGS += -fno-stack-protector
+        QMAKE_CFLAGS += -fno-stack-protector
+    }
+    win32-msvc* {
+        !contains(DEFINES, WTF_USE_JIT_STUB_ARGUMENT_REGISTER=.): DEFINES += WTF_USE_JIT_STUB_ARGUMENT_REGISTER=1
     }
 }
 
@@ -74,6 +110,7 @@
     runtime/JSVariableObject.cpp \
     runtime/JSActivation.cpp \
     runtime/JSNotAnObject.cpp \
+    runtime/LiteralParser.cpp \
     runtime/TimeoutChecker.cpp \
     bytecode/CodeBlock.cpp \
     bytecode/StructureStubInfo.cpp \
@@ -81,6 +118,7 @@
     jit/JIT.cpp \
     jit/JITCall.cpp \
     jit/JITArithmetic.cpp \
+    jit/JITOpcodes.cpp \
     jit/JITPropertyAccess.cpp \
     jit/ExecutableAllocator.cpp \
     jit/JITStubs.cpp \
@@ -90,12 +128,9 @@
     interpreter/Interpreter.cpp \
     bytecode/Opcode.cpp \
     bytecode/SamplingTool.cpp \
-    wrec/CharacterClass.cpp \
-    wrec/CharacterClassConstructor.cpp \
-    wrec/WREC.cpp \
-    wrec/WRECFunctors.cpp \
-    wrec/WRECGenerator.cpp \
-    wrec/WRECParser.cpp \
+    yarr/RegexCompiler.cpp \
+    yarr/RegexInterpreter.cpp \
+    yarr/RegexJIT.cpp \
     interpreter/RegisterFile.cpp
 
 win32-*: SOURCES += jit/ExecutableAllocatorWin.cpp
@@ -117,8 +152,8 @@
     runtime/ConstructData.cpp \
     wtf/CurrentTime.cpp \
     runtime/DateConstructor.cpp \
+    runtime/DateConversion.cpp \
     runtime/DateInstance.cpp \
-    runtime/DateMath.cpp \
     runtime/DatePrototype.cpp \
     debugger/Debugger.cpp \
     debugger/DebuggerCallFrame.cpp \
@@ -161,6 +196,7 @@
     runtime/ObjectPrototype.cpp \
     runtime/Operations.cpp \
     parser/Parser.cpp \
+    parser/ParserArena.cpp \
     runtime/PropertyNameArray.cpp \
     runtime/PropertySlot.cpp \
     runtime/PrototypeFunction.cpp \
@@ -182,13 +218,20 @@
     profiler/ProfileNode.cpp \
     profiler/Profiler.cpp \
     profiler/TreeProfile.cpp \
+    wtf/DateMath.cpp \
     wtf/FastMalloc.cpp \
     wtf/Threading.cpp \
-    wtf/ThreadingQt.cpp \
     wtf/qt/MainThreadQt.cpp
 
+!contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+    SOURCES += wtf/qt/ThreadingQt.cpp
+} else {
+    DEFINES += ENABLE_JSC_MULTIPLE_THREADS=0
+    SOURCES += wtf/ThreadingNone.cpp
+}
+
 # GENERATOR 1-A: LUT creator
-lut.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.lut.h
+lut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
 lut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
 lut.depend = ${QMAKE_FILE_NAME}
 lut.input = LUT_FILES
@@ -196,7 +239,7 @@
 addExtraCompiler(lut)
 
 # GENERATOR 1-B: particular LUT creator (for 1 file only)
-keywordlut.output = $$GENERATED_SOURCES_DIR/Lexer.lut.h
+keywordlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}Lexer.lut.h
 keywordlut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
 keywordlut.depend = ${QMAKE_FILE_NAME}
 keywordlut.input = KEYWORDLUT_FILES
@@ -204,8 +247,8 @@
 addExtraCompiler(keywordlut)
 
 # GENERATOR 2: bison grammar
-jscbison.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
-jscbison.commands = bison -d -p jscyy ${QMAKE_FILE_NAME} -o ${QMAKE_FILE_BASE}.tab.c && $(MOVE) ${QMAKE_FILE_BASE}.tab.c ${QMAKE_FILE_OUT} && $(MOVE) ${QMAKE_FILE_BASE}.tab.h $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.h
+jscbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+jscbison.commands = bison -d -p jscyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c ${QMAKE_FILE_OUT} && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
 jscbison.depend = ${QMAKE_FILE_NAME}
 jscbison.input = JSCBISON
 jscbison.variable_out = GENERATED_SOURCES
diff --git a/JavaScriptCore/JavaScriptCore.pro b/JavaScriptCore/JavaScriptCore.pro
index 56dae05..28f0e6b 100644
--- a/JavaScriptCore/JavaScriptCore.pro
+++ b/JavaScriptCore/JavaScriptCore.pro
@@ -21,13 +21,16 @@
 }
 
 isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR/
-win32-*: GENERATED_SOURCES_DIR_SLASH ~= s|/|\|
+GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
 
 INCLUDEPATH += $$GENERATED_SOURCES_DIR
 
 !CONFIG(QTDIR_build) {
-     OBJECTS_DIR = tmp
+    CONFIG(debug, debug|release) {
+        OBJECTS_DIR = obj/debug
+    } else { # Release
+        OBJECTS_DIR = obj/release
+    }
 }
 
 include($$OUTPUT_DIR/config.pri)
@@ -64,7 +67,7 @@
 
 QMAKE_EXTRA_TARGETS += generated_files
 
-qt-port: lessThan(QT_MINOR_VERSION, 4) {
+lessThan(QT_MINOR_VERSION, 4) {
     DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
 }
 
diff --git a/JavaScriptCore/JavaScriptCore.scons b/JavaScriptCore/JavaScriptCore.scons
deleted file mode 100644
index 30665cf..0000000
--- a/JavaScriptCore/JavaScriptCore.scons
+++ /dev/null
@@ -1,309 +0,0 @@
-# The keys in sources are the paths to the directories
-# the values are an array of source files in those directories to compile
-sources = {}
-sources['API'] = [
-    'API/JSBase.cpp',
-    'API/JSCallbackConstructor.cpp',
-    'API/JSCallbackFunction.cpp',
-    'API/JSCallbackObject.cpp',
-    'API/JSClassRef.cpp',
-    'API/JSContextRef.cpp',
-    'API/JSObjectRef.cpp',
-    'API/JSProfilerPrivate.cpp',
-    'API/JSStringRef.cpp',
-    'API/JSValueRef.cpp',
-    'API/OpaqueJSString.cpp',
-]
-sources['bytecompiler'] = [
-    'bytecompiler/BytecodeGenerator.cpp',
-]
-sources['debugger'] = [
-    'debugger/Debugger.cpp',
-    'debugger/DebuggerActivation.cpp',
-    'debugger/DebuggerCallFrame.cpp',
-]
-sources['parser'] = [
-    'parser/Lexer.cpp',
-    'parser/Nodes.cpp',
-    'parser/Parser.cpp',
-]
-sources['pcre'] = [
-    'pcre/pcre_compile.cpp',
-    'pcre/pcre_exec.cpp',
-    'pcre/pcre_tables.cpp',
-    'pcre/pcre_ucp_searchfuncs.cpp',
-    'pcre/pcre_xclass.cpp',
-]
-sources['profiler'] = [
-    'profiler/HeavyProfile.cpp',
-    'profiler/Profile.cpp',
-    'profiler/ProfileGenerator.cpp',
-    'profiler/ProfileNode.cpp',
-    'profiler/Profiler.cpp',
-    'profiler/TreeProfile.cpp',
-]
-sources['runtime'] = [
-    'runtime/ArgList.cpp',
-    'runtime/Arguments.cpp',
-    'runtime/ArrayConstructor.cpp',
-    'runtime/ArrayPrototype.cpp',
-    'runtime/BooleanConstructor.cpp',
-    'runtime/BooleanObject.cpp',
-    'runtime/BooleanPrototype.cpp',
-    'runtime/CallData.cpp',
-    'runtime/Collector.cpp',
-    'runtime/Completion.cpp',
-    'runtime/CommonIdentifiers.cpp',
-    'runtime/ConstructData.cpp',
-    'runtime/DateConstructor.cpp',
-    'runtime/DateInstance.cpp',
-    'runtime/DateMath.cpp',
-    'runtime/DatePrototype.cpp',
-    'runtime/Error.cpp',
-    'runtime/ErrorConstructor.cpp',
-    'runtime/ErrorInstance.cpp',
-    'runtime/ErrorPrototype.cpp',
-    'runtime/ExceptionHelpers.cpp',
-    'runtime/FunctionConstructor.cpp',
-    'runtime/FunctionPrototype.cpp',
-    'runtime/GetterSetter.cpp',
-    'runtime/GlobalEvalFunction.cpp',
-    'runtime/Identifier.cpp',
-    'runtime/InitializeThreading.cpp',
-    'runtime/InternalFunction.cpp',
-    'runtime/JSActivation.cpp',
-    'runtime/JSArray.cpp',
-    'runtime/JSByteArray.cpp',
-    'runtime/JSCell.cpp',
-    'runtime/JSFunction.cpp',
-    'runtime/JSGlobalData.cpp',
-    'runtime/JSGlobalObject.cpp',
-    'runtime/JSGlobalObjectFunctions.cpp',
-    'runtime/JSImmediate.cpp',
-    'runtime/JSLock.cpp',
-    'runtime/JSNotAnObject.cpp',
-    'runtime/JSNumberCell.cpp',
-    'runtime/JSObject.cpp',
-    'runtime/JSPropertyNameIterator.cpp',
-    'runtime/JSStaticScopeObject.cpp',
-    'runtime/JSString.cpp',
-    'runtime/JSValue.cpp',
-    'runtime/JSVariableObject.cpp',
-    'runtime/JSWrapperObject.cpp',
-    'runtime/Lookup.cpp',
-    'runtime/MathObject.cpp',
-    'runtime/NativeErrorConstructor.cpp',
-    'runtime/NativeErrorPrototype.cpp',
-    'runtime/NumberConstructor.cpp',
-    'runtime/NumberObject.cpp',
-    'runtime/NumberPrototype.cpp',
-    'runtime/ObjectConstructor.cpp',
-    'runtime/ObjectPrototype.cpp',
-    'runtime/Operations.cpp',
-    'runtime/PropertyNameArray.cpp',
-    'runtime/PropertySlot.cpp',
-    'runtime/PrototypeFunction.cpp',
-    'runtime/RegExp.cpp',
-    'runtime/RegExpConstructor.cpp',
-    'runtime/RegExpObject.cpp',
-    'runtime/RegExpPrototype.cpp',
-    'runtime/ScopeChain.cpp',
-    'runtime/SmallStrings.cpp',
-    'runtime/StringConstructor.cpp',
-    'runtime/StringObject.cpp',
-    'runtime/StringPrototype.cpp',
-    'runtime/Structure.cpp',
-    'runtime/StructureChain.cpp',
-    'runtime/TimeoutChecker.cpp',
-    'runtime/UString.cpp',
-]
-sources['bytecode'] = [
-    'bytecode/CodeBlock.cpp',
-    'bytecode/StructureStubInfo.cpp',
-    'bytecode/JumpTable.cpp',
-    'bytecode/Opcode.cpp',
-    'bytecode/SamplingTool.cpp',
-]
-sources['interpreter'] = [
-    'interpreter/CallFrame.cpp',
-    'interpreter/Interpreter.cpp',
-    'interpreter/RegisterFile.cpp',
-]
-sources['jit'] = [
-    'jit/ExecutableAllocator.cpp',
-    'jit/JIT.cpp',
-]
-sources['wrec'] = [
-    'wrec/CharacterClass.cpp',
-    'wrec/CharacterClassConstructor.cpp',
-    'wrec/WREC.cpp',
-    'wrec/WRECFunctors.cpp',
-    'wrec/WRECGenerator.cpp',
-    'wrec/WRECParser.cpp',
-]
-sources['wtf'] = [
-    'wtf/Assertions.cpp',
-    'wtf/ByteArray.cpp',
-    'wtf/CurrentTime.cpp',
-    'wtf/FastMalloc.cpp',
-    'wtf/HashTable.cpp',
-    'wtf/RandomNumber.cpp',
-    'wtf/RefCountedLeakCounter.cpp',
-    'wtf/Threading.cpp',
-    'wtf/TypeTraits.cpp',
-    'wtf/dtoa.cpp',
-]
-sources['wtf/unicode'] = [
-    'wtf/unicode/CollatorDefault.cpp',
-    'wtf/unicode/UTF8.cpp',
-]
-sources['wtf/unicode/icu'] = [
-    'wtf/unicode/icu/CollatorICU.cpp',
-]
-
-env = Environment()
-
-building_on_win32 = env['PLATFORM'] == 'win32' or env['PLATFORM'] == 'cygwin'
-
-# Scons uses gcc when building under cygwin by default
-# We also have to manually force 8.0 or Scons will try and
-# look up what version to use using the registry and fail
-# due to lack of cygwin-python registry support
-if env['PLATFORM'] == 'cygwin':
-    env['MSVS_VERSION'] = '8.0'
-    # Some systems have PROGRAMFILES, some have ProgramFiles
-    # Scons msvc tool only expects 'ProgramFiles'
-    import os
-    if os.getenv('PROGRAMFILES') and not os.getenv('ProgramFiles'):
-        os.environ['ProgramFiles'] = os.getenv('PROGRAMFILES')
-
-    env.Tool('msvc')
-    env.Tool('mslink')
-    env.Tool('mslib')
-
-# Scons is failing to carry the %PATH% value through correctly
-# Hack IncrediBuild into our path so cl.exe doesn't crash
-if env['PLATFORM'] == 'win32':
-    env.AppendENVPath('PATH', 'c:/Program Files/Xoreax/IncrediBuild')
-
-if env['PLATFORM'] == 'darwin':
-    sources['API'].append('API/JSStringRefCF.cpp')
-    sources['profiler'].append('profiler/ProfilerServer.mm')
-    sources['wtf'].append('wtf/ThreadingPthreads.cpp')
-    sources['wtf'].append('wtf/MainThread.cpp')
-    sources['wtf/mac'] = ['wtf/mac/MainThreadMac.mm']
-    sources['wtf'].append('wtf/TCSystemAlloc.cpp')
-    sources['jit'].append('jit/ExecutableAllocatorPosix.cpp')
-elif building_on_win32:
-    sources['wtf'].append('wtf/ThreadingNone.cpp')
-    sources['jit'].append('jit/ExecutableAllocatorWin.cpp')
-    env.Append(CPPDEFINES = ['ENABLE_JSC_MULTIPLE_THREADS=0'])
-
-derived_sources_path = 'DerivedSources/JavaScriptCore/'
-def DerivedSources(path):
-    return derived_sources_path + path
-
-derived_sources_results = map(DerivedSources, [
-    'ArrayPrototype.lut.h',
-    'DatePrototype.lut.h',
-    'MathObject.lut.h',
-    'NumberConstructor.lut.h',
-    'RegExpConstructor.lut.h',
-    'RegExpObject.lut.h',
-    'StringPrototype.lut.h'
-    'chartables.c',
-    'grammar.cpp',
-    'grammar.h',
-    'lexer.lut.h',
-])
-
-derived_sources_sources = [
-    'runtime/ArrayPrototype.cpp',
-    'runtime/DatePrototype.cpp',
-    'runtime/MathObject.cpp',
-    'runtime/NumberConstructor.cpp',
-    'runtime/RegExpConstructor.cpp',
-    'runtime/RegExpObject.cpp',
-    'runtime/StringPrototype.cpp',
-    'parser/Grammar.y',
-    'parser/Lexer.cpp',
-]
-
-# Generate DerivedSources
-# Make sure Windows knows where bash (and all the other cygwin commands) live
-if env['PLATFORM'] == 'win32':
-    env.AppendENVPath('PATH', 'C:/cygwin/bin')
-env.Command(derived_sources_results, derived_sources_sources, 'bash make-generated-sources.sh')
-sources[derived_sources_path] = [DerivedSources('Grammar.cpp')]
-
-# Handle os-version specific build settings
-if env['PLATFORM'] == 'darwin':
-    from subprocess import Popen, PIPE
-    version_pieces = Popen(["sw_vers", "-productVersion"], stdout = PIPE).communicate()[0].split('.')
-    if map(int, version_pieces)[:2] > (10, 5):
-        # Dtrace doesn't exist in Tiger, and was broken in Leopard
-        env.Command(DerivedSources('TracingDtrace.h'), 'runtime/Tracing.d', '/usr/sbin/dtrace -h -o $TARGET -s $SOURCE')
-
-# This build file builds the Chromium port for now, support for
-# others could be added later.
-env.Append(CPPDEFINES = ['BUILDING_CHROMIUM__'])
-
-# I'm not certain how many of these windows defines are actually required.
-if building_on_win32:
-    env.Append(CPPDEFINES = ['_WIN32_WINNT=0x0600', 'WINVER=0x0600', 'WIN32', '_WINDOWS', 'NOMINMAX', 'UNICODE', '_UNICODE', '__STD_C', '_HAS_EXCEPTIONS=0'])
-
-# Scons out-of-the-box only supports precompiled headers for MSVC
-# remove this when we fix Scons to understand GCC precompiled headers
-if env['CC'] == 'gcc':
-    env['CCFLAGS'] = '-include JavaScriptCorePrefix.h'
-# Turns out the MSVC PCH support is badly broken
-# env['PCH'] = 'JavaScriptCorePrefix.h'
-# env['PCHSTOP'] = 'JavaScriptCorePrefix.h'
-
-if env['PLATFORM'] == 'darwin':
-    env['FRAMEWORKS'] = ['CoreFoundation', 'Foundation']
-    env['LIBS'] = ['icucore']
-    # Apple does not ship the ICU headers with Mac OS X, so WebKit includes a copy of 3.2 headers
-    env.Append(CPPPATH = 'icu')
-
-webkit_libraries_path = "../WebKitLibraries/win/"
-def WebKitLibraries(path):
-    return webkit_libraries_path + path
-
-include_paths = ['.', '..', 'ForwardingHeaders'] + sources.keys()
-env.Append(CPPPATH = include_paths)
-if building_on_win32:
-    env.Append(CPPPATH = ['os-win32', WebKitLibraries('include')])
-    env.Prepend(LIBPATH = [WebKitLibraries('lib')])
-    env.Append(LIBS = ['icuin', 'icuuc', 'user32', 'winmm'])
-
-# Save off a copy of the environment for use with jsc
-jsc_env = env.Clone()
-
-if building_on_win32:
-    env.StaticLibrary("JavaScriptCore", sources.values())
-else:
-    env.SharedLibrary("JavaScriptCore", sources.values())
-
-
-env = jsc_env
-
-# Build the jsc testing shell
-shell_sources = ['jsc.cpp']
-build_directory = '.' # This should be changed to point to wherever JavaScriptCore gets built to
-
-# It's hacky to re-use the same environment from JavaScriptCore
-# but it makes building on windows easier for now
-env['CPPPATH'] = include_paths
-env['LIBS'] = ['JavaScriptCore']
-env['LIBPATH'] = [build_directory]
-
-if env['PLATFORM'] == 'darwin':
-    env.Append(LIBS = ['edit'])
-    env.Append(CPPPATH = 'icu')
-elif building_on_win32:
-    env.Append(CPPPATH = ['os-win32', WebKitLibraries('include')])
-    env.Prepend(LIBPATH = [WebKitLibraries('lib')])
-    env.Append(LIBS = ['icuin', 'icuuc', 'user32', 'winmm'])
-
-env.Program('jsc', shell_sources)
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
index 34dc931..fbbe23e 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
@@ -6,8 +6,28 @@
 
 install:
     set PRODUCTION=1
-	set WebKitLibrariesDir="$(SRCROOT)\AppleInternal"
-	set WebKitOutputDir=$(OBJROOT)
-	devenv "JavaScriptCoreSubmit.sln" /rebuild $(BUILDSTYLE)
-	xcopy "$(OBJROOT)\include\*" "$(DSTROOT)\AppleInternal\include\" /e/v/i/h/y	
-	xcopy "$(OBJROOT)\lib\*" "$(DSTROOT)\AppleInternal\lib\" /e/v/i/h/y	
+    set WebKitLibrariesDir=$(SRCROOT)\AppleInternal
+    set WebKitOutputDir=$(OBJROOT)
+!IF "$(BUILDSTYLE)"=="Release"
+    devenv "JavaScriptCoreSubmit.sln" /rebuild Release_PGOInstrument
+    set PATH=$(SYSTEMDRIVE)\cygwin\bin;$(PATH)
+    xcopy "$(SRCROOT)\AppleInternal\tests\SunSpider\*" "$(OBJROOT)\tests\SunSpider" /e/v/i/h/y
+    cd "$(OBJROOT)\tests\SunSpider"
+    perl sunspider --shell ../../bin/jsc.exe --runs 3
+    del "$(OBJROOT)\bin\JavaScriptCore.dll"
+    cd "$(SRCROOT)\JavaScriptCore.vcproj"
+    devenv "JavaScriptCoreSubmit.sln" /build Release_PGOOptimize
+!ELSE
+    devenv "JavaScriptCoreSubmit.sln" /rebuild $(BUILDSTYLE)
+!ENDIF
+    -xcopy "$(OBJROOT)\bin\JavaScriptCore.dll" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "$(OBJROOT)\bin\JavaScriptCore_debug.dll" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "$(OBJROOT)\bin\JavaScriptCore.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "$(OBJROOT)\bin\JavaScriptCore_debug.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "$(OBJROOT)\bin\jsc.exe" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "$(OBJROOT)\bin\jsc_debug.exe" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "$(OBJROOT)\bin\jsc.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "$(OBJROOT)\bin\jsc_debug.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    xcopy "$(OBJROOT)\include\*" "$(DSTROOT)\AppleInternal\include\" /e/v/i/h/y    
+    xcopy "$(OBJROOT)\lib\*" "$(DSTROOT)\AppleInternal\lib\" /e/v/i/h/y    
+    xcopy "$(OBJROOT)\bin\JavaScriptCore.resources\*" "$(DSTROOT)\AppleInternal\bin\JavaScriptCore.resources" /e/v/i/h/y
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist
new file mode 100644
index 0000000..bccf2b5
--- /dev/null
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleExecutable</key>
+	<string>JavaScriptCore</string>
+	<key>CFBundleGetInfoString</key>
+	<string>530, Copyright 2003-2009 Apple Inc.</string>
+	<key>CFBundleIdentifier</key>
+	<string>com.apple.JavaScriptCore</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>JavaScriptCore</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>530</string>
+	<key>CFBundleVersion</key>
+	<string>530</string>
+</dict>
+</plist>
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
index 0fbc787..32e7301 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
@@ -22,6 +22,8 @@
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution

 		Debug_Internal|Win32 = Debug_Internal|Win32

 		Debug|Win32 = Debug|Win32

+		Release_PGOInstrument|Win32 = Release_PGOInstrument|Win32

+		Release_PGOOptimize|Win32 = Release_PGOOptimize|Win32

 		Release|Win32 = Release|Win32

 	EndGlobalSection

 	GlobalSection(ProjectConfigurationPlatforms) = postSolution

@@ -29,30 +31,50 @@
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGOInstrument|Win32.ActiveCfg = Release_PGOInstrument|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGOInstrument|Win32.Build.0 = Release_PGOInstrument|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGOOptimize|Win32.ActiveCfg = Release_PGOOptimize|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGOOptimize|Win32.Build.0 = Release_PGOOptimize|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGOInstrument|Win32.ActiveCfg = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGOInstrument|Win32.Build.0 = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGOOptimize|Win32.ActiveCfg = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.ActiveCfg = Release|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.Build.0 = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.Build.0 = Debug|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGOInstrument|Win32.ActiveCfg = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGOInstrument|Win32.Build.0 = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGOOptimize|Win32.ActiveCfg = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32

 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.ActiveCfg = Debug|Win32

 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.Build.0 = Debug|Win32

 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.ActiveCfg = Debug|Win32

 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = Debug|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOInstrument|Win32.ActiveCfg = Release|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOInstrument|Win32.Build.0 = Release|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOOptimize|Win32.ActiveCfg = Release|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.ActiveCfg = Release|Win32

 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.Build.0 = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.ActiveCfg = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.Build.0 = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.ActiveCfg = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.Build.0 = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.ActiveCfg = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = Release|Win32

 	EndGlobalSection

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
new file mode 100644
index 0000000..4b086dd
--- /dev/null
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -0,0 +1,274 @@
+LIBRARY    "JavaScriptCore"
+
+EXPORTS
+    ??0Collator@WTF@@QAE@PBD@Z
+    ??0Debugger@JSC@@QAE@XZ
+    ??0DropAllLocks@JSLock@JSC@@QAE@_N@Z
+    ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@ABVIdentifier@1@@Z
+    ??0JSByteArray@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@PAVByteArray@4@PBUClassInfo@1@@Z
+    ??0JSFunction@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
+    ??0Mutex@WTF@@QAE@XZ
+    ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V41@ABVArgList@1@@Z@Z
+    ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
+    ??0RefCountedLeakCounter@WTF@@QAE@PBD@Z
+    ??0StringObject@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@ABVUString@1@@Z
+    ??0Structure@JSC@@AAE@VJSValue@1@ABVTypeInfo@1@@Z
+    ??0ThreadCondition@WTF@@QAE@XZ
+    ??0UString@JSC@@QAE@PBD@Z
+    ??0UString@JSC@@QAE@PB_WH@Z
+    ??1CString@JSC@@QAE@XZ
+    ??1ClientData@JSGlobalData@JSC@@UAE@XZ
+    ??1Collator@WTF@@QAE@XZ
+    ??1Debugger@JSC@@UAE@XZ
+    ??1DropAllLocks@JSLock@JSC@@QAE@XZ
+    ??1JSGlobalData@JSC@@QAE@XZ
+    ??1JSGlobalObject@JSC@@UAE@XZ
+    ??1Mutex@WTF@@QAE@XZ
+    ??1RefCountedLeakCounter@WTF@@QAE@XZ
+    ??1Structure@JSC@@QAE@XZ
+    ??1ThreadCondition@WTF@@QAE@XZ
+    ??2JSCell@JSC@@SAPAXIPAVExecState@1@@Z
+    ??2JSGlobalObject@JSC@@SAPAXIPAVJSGlobalData@1@@Z
+    ??4UString@JSC@@QAEAAV01@PBD@Z
+    ??8JSC@@YA_NABVUString@0@0@Z
+    ?UTF8String@UString@JSC@@QBE?AVCString@2@_N@Z
+    ?add@Identifier@JSC@@SA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PAVExecState@2@PBD@Z
+    ?add@PropertyNameArray@JSC@@QAEXPAURep@UString@2@@Z
+    ?addPropertyTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
+    ?addPropertyTransitionToExistingStructure@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
+    ?addPropertyWithoutTransition@Structure@JSC@@QAEIABVIdentifier@2@IPAVJSCell@2@@Z
+    ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PAVExecState@2@PAURep@UString@2@@Z
+    ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PAVJSGlobalData@2@PAURep@UString@2@@Z
+    ?allocate@Heap@JSC@@QAEPAXI@Z
+    ?allocatePropertyStorage@JSObject@JSC@@QAEXII@Z
+    ?append@UString@JSC@@QAEAAV12@ABV12@@Z
+    ?append@UString@JSC@@QAEAAV12@PBD@Z
+    ?ascii@UString@JSC@@QBEPADXZ
+    ?attach@Debugger@JSC@@QAEXPAVJSGlobalObject@2@@Z
+    ?broadcast@ThreadCondition@WTF@@QAEXXZ
+    ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVUString@2@XZ
+    ?call@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@W4CallType@1@ABTCallData@1@1ABVArgList@1@@Z
+    ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
+    ?changePrototypeTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@VJSValue@2@@Z
+    ?checkSameIdentifierTable@Identifier@JSC@@CAXPAVExecState@2@PAURep@UString@2@@Z
+    ?checkSameIdentifierTable@Identifier@JSC@@CAXPAVJSGlobalData@2@PAURep@UString@2@@Z
+    ?classInfo@InternalFunction@JSC@@UBEPBUClassInfo@2@XZ
+    ?classInfo@JSCell@JSC@@UBEPBUClassInfo@2@XZ
+    ?className@JSObject@JSC@@UBE?AVUString@2@XZ
+    ?collate@Collator@WTF@@QBE?AW4Result@12@PB_WI0I@Z
+    ?collect@Heap@JSC@@QAE_NXZ
+    ?computeHash@Rep@UString@JSC@@SAIPBDH@Z
+    ?computeHash@Rep@UString@JSC@@SAIPB_WH@Z
+    ?construct@JSC@@YAPAVJSObject@1@PAVExecState@1@VJSValue@1@W4ConstructType@1@ABTConstructData@1@ABVArgList@1@@Z
+    ?constructArray@JSC@@YAPAVJSArray@1@PAVExecState@1@ABVArgList@1@@Z
+    ?constructEmptyArray@JSC@@YAPAVJSArray@1@PAVExecState@1@@Z
+    ?constructEmptyObject@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
+    ?constructFunction@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@H@Z
+    ?convertUTF16ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPB_WPB_WPAPADPAD_N@Z
+    ?copyParameters@FunctionBodyNode@JSC@@QAEPAVIdentifier@2@XZ
+    ?create@ByteArray@WTF@@SA?AV?$PassRefPtr@VByteArray@WTF@@@2@I@Z
+    ?create@FunctionBodyNode@JSC@@SA?AV?$PassRefPtr@VFunctionBodyNode@JSC@@@WTF@@PAVJSGlobalData@2@PAVSourceElements@2@PAV?$Vector@U?$pair@VIdentifier@JSC@@I@std@@$0A@@4@PAV?$Vector@PAVFuncDeclNode@JSC@@$0A@@4@ABVSourceCode@2@IH@Z
+    ?create@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@_N@Z
+    ?create@OpaqueJSString@@SA?AV?$PassRefPtr@UOpaqueJSString@@@WTF@@ABVUString@JSC@@@Z
+    ?create@Rep@UString@JSC@@SA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PA_WHV?$PassRefPtr@V?$CrossThreadRefCounted@V?$OwnFastMallocPtr@_W@WTF@@@WTF@@@5@@Z
+    ?createEmptyString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@@Z
+    ?createInheritorID@JSObject@JSC@@AAEPAVStructure@2@XZ
+    ?createLeaked@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@XZ
+    ?createStructure@JSByteArray@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@VJSValue@2@@Z
+    ?createTable@HashTable@JSC@@ABEXPAVJSGlobalData@2@@Z
+    ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
+    ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
+    ?currentThread@WTF@@YAIXZ
+    ?currentTime@WTF@@YANXZ
+    ?decrement@RefCountedLeakCounter@WTF@@QAEXXZ
+    ?defaultValue@JSObject@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
+    ?defineGetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@@Z
+    ?defineGetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@@Z
+    ?defineSetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@@Z
+    ?defineSetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@@Z
+    ?deleteOwnedPtr@WTF@@YAXPAUHBITMAP__@@@Z
+    ?deleteOwnedPtr@WTF@@YAXPAUHRGN__@@@Z
+    ?deleteProperty@JSCell@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
+    ?deleteProperty@JSCell@JSC@@UAE_NPAVExecState@2@I@Z
+    ?deleteProperty@JSObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
+    ?deleteProperty@JSObject@JSC@@UAE_NPAVExecState@2@I@Z
+    ?deleteProperty@JSVariableObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
+    ?deleteProperty@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
+    ?deleteTable@HashTable@JSC@@QBEXXZ
+    ?despecifyDictionaryFunction@Structure@JSC@@QAEXABVIdentifier@2@@Z
+    ?despecifyFunctionTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@@Z
+    ?destroy@Heap@JSC@@QAEXXZ
+    ?destroy@Rep@UString@JSC@@QAEXXZ
+    ?detach@Debugger@JSC@@QAEXPAVJSGlobalObject@2@@Z
+    ?detachThread@WTF@@YAXI@Z
+    ?equal@Identifier@JSC@@SA_NPBURep@UString@2@PBD@Z
+    ?equal@JSC@@YA_NPBURep@UString@1@0@Z
+    ?evaluate@DebuggerCallFrame@JSC@@QBE?AVJSValue@2@ABVUString@2@AAV32@@Z
+    ?evaluate@JSC@@YA?AVCompletion@1@PAVExecState@1@AAVScopeChain@1@ABVSourceCode@1@VJSValue@1@@Z
+    ?exclude@Profile@JSC@@QAEXPBVProfileNode@2@@Z
+    ?fastCalloc@WTF@@YAPAXII@Z
+    ?fastFree@WTF@@YAXPAX@Z
+    ?fastMalloc@WTF@@YAPAXI@Z
+    ?fastRealloc@WTF@@YAPAXPAXI@Z
+    ?fastZeroedMalloc@WTF@@YAPAXI@Z
+    ?fillGetterPropertySlot@JSObject@JSC@@QAEXAAVPropertySlot@2@PAVJSValue@2@@Z
+    ?finishParsing@FunctionBodyNode@JSC@@QAEXPAVIdentifier@2@I@Z
+    ?focus@Profile@JSC@@QAEXPBVProfileNode@2@@Z
+    ?from@UString@JSC@@SA?AV12@H@Z
+    ?from@UString@JSC@@SA?AV12@I@Z
+    ?functionName@DebuggerCallFrame@JSC@@QBEPBVUString@2@XZ
+    ?get@Structure@JSC@@QAEIPBURep@UString@2@AAIAAPAVJSCell@2@@Z
+    ?getCallData@JSCell@JSC@@UAE?AW4CallType@2@AATCallData@2@@Z
+    ?getConstructData@JSCell@JSC@@UAE?AW4ConstructType@2@AATConstructData@2@@Z
+    ?getJSNumber@JSCell@JSC@@UAE?AVJSValue@2@XZ
+    ?getObject@JSCell@JSC@@QAEPAVJSObject@2@XZ
+    ?getOwnPropertySlot@JSCell@JSC@@EAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@JSCell@JSC@@EAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@JSObject@JSC@@UAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@JSString@JSC@@EAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@JSString@JSC@@EAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@StringObject@JSC@@UAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
+    ?getPrimitiveNumber@JSObject@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
+    ?getPrimitiveNumber@JSString@JSC@@EAE_NPAVExecState@2@AANAAVJSValue@2@@Z
+    ?getPropertyAttributes@JSObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
+    ?getPropertyAttributes@JSVariableObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
+    ?getPropertyNames@JSObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
+    ?getPropertyNames@JSVariableObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
+    ?getPropertyNames@StringObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
+    ?getSlice@ArgList@JSC@@QBEXHAAV12@@Z
+    ?getString@JSCell@JSC@@QBE?AVUString@2@XZ
+    ?getString@JSCell@JSC@@QBE_NAAVUString@2@@Z
+    ?getTruncatedInt32@JSCell@JSC@@UBE_NAAH@Z
+    ?getTruncatedUInt32@JSCell@JSC@@UBE_NAAI@Z
+    ?getUInt32@JSCell@JSC@@UBE_NAAI@Z
+    ?globalExec@JSGlobalObject@JSC@@UAEPAVExecState@2@XZ
+    ?globalObjectCount@Heap@JSC@@QAEIXZ
+    ?hasInstance@JSObject@JSC@@UAE_NPAVExecState@2@VJSValue@2@1@Z
+    ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@ABVIdentifier@2@@Z
+    ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@I@Z
+    ?heap@Heap@JSC@@SAPAV12@VJSValue@2@@Z
+    ?increment@RefCountedLeakCounter@WTF@@QAEXXZ
+    ?init@JSGlobalObject@JSC@@AAEXPAVJSObject@2@@Z
+    ?initializeMainThread@WTF@@YAXXZ
+    ?initializeThreading@JSC@@YAXXZ
+    ?initializeThreading@WTF@@YAXXZ
+    ?is8Bit@UString@JSC@@QBE_NXZ
+    ?isBusy@Heap@JSC@@QAE_NXZ
+    ?isDynamicScope@JSGlobalObject@JSC@@UBE_NXZ
+    ?isGetterSetter@JSCell@JSC@@UBE_NXZ
+    ?isMainThread@WTF@@YA_NXZ
+    ?isVariableObject@JSVariableObject@JSC@@UBE_NXZ
+    ?jsAPIMangledNumber@JSC@@YA?AVJSValue@1@PAVExecState@1@N@Z
+    ?jsNumberCell@JSC@@YA?AVJSValue@1@PAVExecState@1@N@Z
+    ?jsOwnedString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
+    ?jsRegExpCompile@@YAPAUJSRegExp@@PB_WHW4JSRegExpIgnoreCaseOption@@W4JSRegExpMultilineOption@@PAIPAPBD@Z
+    ?jsRegExpExecute@@YAHPBUJSRegExp@@PB_WHHPAHH@Z
+    ?jsRegExpFree@@YAXPAUJSRegExp@@@Z
+    ?jsString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
+    ?lock@JSLock@JSC@@SAX_N@Z
+    ?lock@Mutex@WTF@@QAEXXZ
+    ?lockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
+    ?lookupGetter@JSObject@JSC@@UAE?AVJSValue@2@PAVExecState@2@ABVIdentifier@2@@Z
+    ?lookupSetter@JSObject@JSC@@UAE?AVJSValue@2@PAVExecState@2@ABVIdentifier@2@@Z
+    ?mark@JSGlobalObject@JSC@@UAEXXZ
+    ?mark@JSObject@JSC@@UAEXXZ
+    ?mark@JSWrapperObject@JSC@@UAEXXZ
+    ?materializePropertyMap@Structure@JSC@@AAEXXZ
+    ?name@InternalFunction@JSC@@QAEABVUString@2@PAVJSGlobalData@2@@Z
+    ?nonInlineNaN@JSImmediate@JSC@@CANXZ
+    ?objectCount@Heap@JSC@@QAEIXZ
+    ?objectProtoFuncToString@JSC@@YI?AVJSValue@1@PAVExecState@1@PAVJSObject@1@V21@ABVArgList@1@@Z
+    ?parse@Parser@JSC@@AAEXPAVJSGlobalData@2@PAHPAVUString@2@@Z
+    ?parseDateFromNullTerminatedCharacters@WTF@@YANPBD@Z
+    ?primaryHeapBegin@Heap@JSC@@QAE?AV?$CollectorHeapIterator@$0A@@2@XZ
+    ?primaryHeapEnd@Heap@JSC@@QAE?AV?$CollectorHeapIterator@$0A@@2@XZ
+    ?profiler@Profiler@JSC@@SAPAV12@XZ
+    ?protect@Heap@JSC@@QAEXVJSValue@2@@Z
+    ?protectedGlobalObjectCount@Heap@JSC@@QAEIXZ
+    ?protectedObjectCount@Heap@JSC@@QAEIXZ
+    ?protectedObjectTypeCounts@Heap@JSC@@QAEPAV?$HashCountedSet@PBDU?$PtrHash@PBD@WTF@@U?$HashTraits@PBD@2@@WTF@@XZ
+    ?prototype@JSImmediate@JSC@@CAPAVJSObject@2@VJSValue@2@PAVExecState@2@@Z
+    ?put@JSCell@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
+    ?put@JSCell@JSC@@UAEXPAVExecState@2@IVJSValue@2@@Z
+    ?put@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
+    ?put@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
+    ?put@JSObject@JSC@@UAEXPAVExecState@2@IVJSValue@2@@Z
+    ?put@StringObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
+    ?putDirectFunction@JSObject@JSC@@QAEXPAVExecState@2@PAVInternalFunction@2@I@Z
+    ?putWithAttributes@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
+    ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
+    ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I_NAAVPutPropertySlot@2@@Z
+    ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@IVJSValue@2@I@Z
+    ?randomNumber@WTF@@YANXZ
+    ?recordExtraCost@Heap@JSC@@AAEXI@Z
+    ?reset@ParserArena@JSC@@QAEXXZ
+    ?reset@TimeoutChecker@JSC@@QAEXXZ
+    ?restoreAll@Profile@JSC@@QAEXXZ
+    ?retrieveCaller@Interpreter@JSC@@QBE?AVJSValue@2@PAVExecState@2@PAVInternalFunction@2@@Z
+    ?retrieveLastCaller@Interpreter@JSC@@QBEXPAVExecState@2@AAH1AAVUString@2@AAVJSValue@2@@Z
+    ?setDumpsGeneratedCode@BytecodeGenerator@JSC@@SAX_N@Z
+    ?setGCProtectNeedsLocking@Heap@JSC@@QAEXXZ
+    ?setLoc@StatementNode@JSC@@QAEXHH@Z
+    ?setMainThreadCallbacksPaused@WTF@@YAX_N@Z
+    ?setOrderLowerFirst@Collator@WTF@@QAEX_N@Z
+    ?setUpStaticFunctionSlot@JSC@@YAXPAVExecState@1@PBVHashEntry@1@PAVJSObject@1@ABVIdentifier@1@AAVPropertySlot@1@@Z
+    ?sharedBuffer@BaseString@UString@JSC@@QAEPAV?$CrossThreadRefCounted@V?$OwnFastMallocPtr@_W@WTF@@@WTF@@XZ
+    ?signal@ThreadCondition@WTF@@QAEXXZ
+    ?slowAppend@MarkedArgumentBuffer@JSC@@AAEXVJSValue@2@@Z
+    ?startIgnoringLeaks@Structure@JSC@@SAXXZ
+    ?startProfiling@Profiler@JSC@@QAEXPAVExecState@2@ABVUString@2@@Z
+    ?stopIgnoringLeaks@Structure@JSC@@SAXXZ
+    ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVUString@2@@Z
+    ?strtod@WTF@@YANPBDPAPAD@Z
+    ?substr@UString@JSC@@QBE?AV12@HH@Z
+    ?thisObject@DebuggerCallFrame@JSC@@QBEPAVJSObject@2@XZ
+    ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@@Z
+    ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@ABVUString@1@@Z
+    ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@PBD@Z
+    ?timedWait@ThreadCondition@WTF@@QAE_NAAVMutex@2@N@Z
+    ?tlsKeyCount@WTF@@YAAAJXZ
+    ?tlsKeys@WTF@@YAPAKXZ
+    ?toBoolean@JSObject@JSC@@UBE_NPAVExecState@2@@Z
+    ?toBoolean@JSString@JSC@@EBE_NPAVExecState@2@@Z
+    ?toInt32SlowCase@JSC@@YAHNAA_N@Z
+    ?toNumber@JSObject@JSC@@UBENPAVExecState@2@@Z
+    ?toNumber@JSString@JSC@@EBENPAVExecState@2@@Z
+    ?toObject@JSImmediate@JSC@@CAPAVJSObject@2@VJSValue@2@PAVExecState@2@@Z
+    ?toObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
+    ?toObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
+    ?toPrimitive@JSString@JSC@@EBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
+    ?toStrictUInt32@UString@JSC@@QBEIPA_N@Z
+    ?toString@JSImmediate@JSC@@CA?AVUString@2@VJSValue@2@@Z
+    ?toString@JSObject@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
+    ?toString@JSString@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
+    ?toString@StringObject@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
+    ?toThisJSString@JSCell@JSC@@UAEPAVJSString@2@PAVExecState@2@@Z
+    ?toThisJSString@JSString@JSC@@EAEPAV12@PAVExecState@2@@Z
+    ?toThisJSString@StringObject@JSC@@EAEPAVJSString@2@PAVExecState@2@@Z
+    ?toThisObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
+    ?toThisObject@JSImmediate@JSC@@CAPAVJSObject@2@VJSValue@2@PAVExecState@2@@Z
+    ?toThisObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
+    ?toThisObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
+    ?toThisString@JSCell@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
+    ?toThisString@JSString@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
+    ?toThisString@StringObject@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
+    ?toUInt32@UString@JSC@@QBEIPA_N@Z
+    ?toUInt32@UString@JSC@@QBEIPA_N_N@Z
+    ?toUInt32SlowCase@JSC@@YAINAA_N@Z
+    ?tryFastCalloc@WTF@@YAPAXII@Z
+    ?tryLock@Mutex@WTF@@QAE_NXZ
+    ?type@DebuggerCallFrame@JSC@@QBE?AW4Type@12@XZ
+    ?unlock@JSLock@JSC@@SAX_N@Z
+    ?unlock@Mutex@WTF@@QAEXXZ
+    ?unlockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
+    ?unprotect@Heap@JSC@@QAEXVJSValue@2@@Z
+    ?unwrappedObject@JSObject@JSC@@UAEPAV12@XZ
+    ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
+    ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
+    WTFLog
+    WTFLogVerbose
+    WTFReportArgumentAssertionFailure
+    WTFReportAssertionFailure
+    WTFReportAssertionFailureWithMessage
+    WTFReportError
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc
new file mode 100644
index 0000000..bb2b0fe
--- /dev/null
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc
@@ -0,0 +1,47 @@
+// Microsoft Visual C++ generated resource script.
+//
+#include "autoversion.h"
+#include "winres.h"
+
+#ifdef _WIN32
+LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
+#pragma code_page(1252)
+#endif //_WIN32
+
+/////////////////////////////////////////////////////////////////////////////
+//
+// Version
+//
+
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION __VERSION_MAJOR__,__BUILD_NUMBER_MAJOR__,__BUILD_NUMBER_MINOR__,__BUILD_NUMBER_VARIANT__
+ PRODUCTVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,0
+ FILEFLAGSMASK 0x17L
+#ifdef _DEBUG
+ FILEFLAGS 0x1L
+#else
+ FILEFLAGS 0x0L
+#endif
+ FILEOS 0x4L
+ FILETYPE 0x2L
+ FILESUBTYPE 0x0L
+BEGIN
+    BLOCK "StringFileInfo"
+    BEGIN
+        BLOCK "040904b0"
+        BEGIN
+            VALUE "FileDescription", "JavaScriptCore Dynamic Link Library"
+            VALUE "FileVersion", __VERSION_TEXT__
+            VALUE "CompanyName", "Apple Inc."
+            VALUE "InternalName", "JavaScriptCore"
+            VALUE "LegalCopyright", "Copyright Apple Inc. 2003-2009"
+            VALUE "OriginalFilename", "JavaScriptCore.dll"
+            VALUE "ProductName", " JavaScriptCore"
+            VALUE "ProductVersion", __BUILD_NUMBER_SHORT__
+        END
+    END
+    BLOCK "VarFileInfo"
+    BEGIN
+        VALUE "Translation", 0x409, 1200
+    END
+END
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index a19b310..4125568 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -17,19 +17,15 @@
 	<Configurations>

 		<Configuration

 			Name="Debug|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

-			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\common.vsprops"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

-				Description=""

-				CommandLine=""

 			/>

 			<Tool

 				Name="VCXMLDataGeneratorTool"

@@ -42,9 +38,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../pcre/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../wrec/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;../../../icu/include;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

-				PreprocessorDefinitions="__STD_C"

-				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -56,13 +49,15 @@
 				Name="VCPreLinkEventTool"

 			/>

 			<Tool

-				Name="VCLibrarianTool"

-				AdditionalDependencies="winmm.lib"

+				Name="VCLinkerTool"

 			/>

 			<Tool

 				Name="VCALinkTool"

 			/>

 			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

 				Name="VCXDCMakeTool"

 			/>

 			<Tool

@@ -72,26 +67,27 @@
 				Name="VCFxCopTool"

 			/>

 			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\VM\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\bytecode\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\interpreter\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\assembler\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\jit\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\debugger\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\create_hash_table&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\pcre\pcre.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Release|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

-			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"

 			CharacterSet="1"

 			WholeProgramOptimization="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

-				Description=""

-				CommandLine=""

 			/>

 			<Tool

 				Name="VCXMLDataGeneratorTool"

@@ -104,9 +100,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../pcre/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../wrec/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;../../../icu/include;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

-				PreprocessorDefinitions="__STD_C"

-				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -118,13 +111,15 @@
 				Name="VCPreLinkEventTool"

 			/>

 			<Tool

-				Name="VCLibrarianTool"

-				AdditionalDependencies="winmm.lib"

+				Name="VCLinkerTool"

 			/>

 			<Tool

 				Name="VCALinkTool"

 			/>

 			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

 				Name="VCXDCMakeTool"

 			/>

 			<Tool

@@ -134,25 +129,26 @@
 				Name="VCFxCopTool"

 			/>

 			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\VM\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\bytecode\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\interpreter\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\assembler\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\jit\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\debugger\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\create_hash_table&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\pcre\pcre.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Debug_Internal|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

-			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

-				Description=""

-				CommandLine=""

 			/>

 			<Tool

 				Name="VCXMLDataGeneratorTool"

@@ -165,9 +161,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../pcre/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../wrec/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;../../../icu/include;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

-				PreprocessorDefinitions="__STD_C"

-				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -179,13 +172,15 @@
 				Name="VCPreLinkEventTool"

 			/>

 			<Tool

-				Name="VCLibrarianTool"

-				AdditionalDependencies="winmm.lib"

+				Name="VCLinkerTool"

 			/>

 			<Tool

 				Name="VCALinkTool"

 			/>

 			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

 				Name="VCXDCMakeTool"

 			/>

 			<Tool

@@ -195,26 +190,214 @@
 				Name="VCFxCopTool"

 			/>

 			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\VM\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\bytecode\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\interpreter\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\assembler\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\jit\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\debugger\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\create_hash_table&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\pcre\pcre.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

-			Name="Release_PGO|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

-			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

+			Name="Release_PGOInstrument|Win32"

+			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\Release"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="2"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_PGOOptimize|Win32"

+			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\Release"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="4"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_CFLite|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_CFLite|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"

 			CharacterSet="1"

 			WholeProgramOptimization="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

-				Description=""

-				CommandLine=""

 			/>

 			<Tool

 				Name="VCXMLDataGeneratorTool"

@@ -227,9 +410,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../pcre/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../wrec/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;../../../icu/include;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

-				PreprocessorDefinitions="__STD_C"

-				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -241,13 +421,15 @@
 				Name="VCPreLinkEventTool"

 			/>

 			<Tool

-				Name="VCLibrarianTool"

-				AdditionalDependencies="winmm.lib"

+				Name="VCLinkerTool"

 			/>

 			<Tool

 				Name="VCALinkTool"

 			/>

 			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

 				Name="VCXDCMakeTool"

 			/>

 			<Tool

@@ -257,8 +439,13 @@
 				Name="VCFxCopTool"

 			/>

 			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\VM\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\bytecode\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\interpreter\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\assembler\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\jit\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\debugger\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\create_hash_table&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\pcre\pcre.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 	</Configurations>

@@ -325,6 +512,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\interpreter\CachedCall.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\runtime\CallData.cpp"

 				>

 			</File>

@@ -341,6 +532,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\interpreter\CallFrameClosure.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\runtime\ClassInfo.h"

 				>

 			</File>

@@ -401,11 +596,11 @@
 				>

 			</File>

 			<File

-				RelativePath="..\..\runtime\DateMath.cpp"

+				RelativePath="..\..\runtime\DateConversion.cpp"

 				>

 			</File>

 			<File

-				RelativePath="..\..\runtime\DateMath.h"

+				RelativePath="..\..\runtime\DateConversion.h"

 				>

 			</File>

 			<File

@@ -657,6 +852,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\runtime\LiteralParser.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\LiteralParser.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\runtime\Lookup.cpp"

 				>

 			</File>

@@ -689,7 +892,7 @@
 				>

 			</File>

 			<File

-				RelativePath="..\..\parser\NodeInfo.h"

+				RelativePath="..\..\runtime\NativeFunctionWrapper.h"

 				>

 			</File>

 			<File

@@ -931,11 +1134,34 @@
 						/>

 					</FileConfiguration>

 					<FileConfiguration

-						Name="Release_PGO|Win32"

+						Name="Release_PGOInstrument|Win32"

 						>

 						<Tool

 							Name="VCCLCompilerTool"

-							WholeProgramOptimization="false"

+							DisableSpecificWarnings="4701"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_PGOOptimize|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							DisableSpecificWarnings="4701"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_CFLite|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							DisableSpecificWarnings="4701"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_CFLite|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

 							DisableSpecificWarnings="4701"

 						/>

 					</FileConfiguration>

@@ -1202,16 +1428,16 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\parser\NodeConstructors.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\NodeInfo.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\parser\Nodes.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="false"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\..\parser\Nodes.h"

@@ -1226,6 +1452,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\parser\ParserArena.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\ParserArena.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\bytecompiler\RegisterID.h"

 				>

 			</File>

@@ -1238,14 +1472,6 @@
 			Name="bytecode"

 			>

 			<File

-				RelativePath="..\..\bytecode\StructureStubInfo.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\..\bytecode\StructureStubInfo.h"

-				>

-			</File>

-			<File

 				RelativePath="..\..\bytecode\CodeBlock.cpp"

 				>

 			</File>

@@ -1254,14 +1480,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\..\bytecode\JumpTable.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\..\bytecode\JumpTable.h"

-				>

-			</File>

-			<File

 				RelativePath="..\..\bytecode\EvalCodeCache.h"

 				>

 			</File>

@@ -1286,11 +1504,7 @@
 				>

 			</File>

 			<File

-				RelativePath="..\..\runtime\TimeoutChecker.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\..\runtime\TimeoutChecker.h"

+				RelativePath="..\..\jit\JITStubs.cpp"

 				>

 			</File>

 			<File

@@ -1298,10 +1512,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\..\jit\JITStubs.cpp"

-				>

-			</File>

-			<File

 				RelativePath="..\..\runtime\JSPropertyNameIterator.cpp"

 				>

 			</File>

@@ -1310,6 +1520,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\bytecode\JumpTable.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\JumpTable.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\bytecode\Opcode.cpp"

 				>

 			</File>

@@ -1337,6 +1555,22 @@
 				RelativePath="..\..\bytecode\SamplingTool.h"

 				>

 			</File>

+			<File

+				RelativePath="..\..\bytecode\StructureStubInfo.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\StructureStubInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\TimeoutChecker.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\TimeoutChecker.h"

+				>

+			</File>

 		</Filter>

 		<Filter

 			Name="Debugger"

@@ -1370,10 +1604,26 @@
 			Name="assembler"

 			>

 			<File

+				RelativePath="..\..\assembler\AbstractMacroAssembler.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\assembler\AssemblerBuffer.h"

 				>

 			</File>

 			<File

+				RelativePath="..\..\assembler\MacroAssembler.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\assembler\MacroAssemblerX86.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\assembler\MacroAssemblerX86Common.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\assembler\X86Assembler.h"

 				>

 			</File>

@@ -1435,77 +1685,105 @@
 			</File>

 		</Filter>

 		<Filter

+			Name="yarr"

+			>

+			<File

+				RelativePath="..\..\yarr\RegexCompiler.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\RegexCompiler.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\RegexInterpreter.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\RegexInterpreter.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\RegexJIT.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\RegexJIT.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\RegexParser.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\RegexPattern.h"

+				>

+			</File>

+		</Filter>

+		<Filter

 			Name="jit"

 			>

 			<File

-				RelativePath="..\..\jit\JIT.cpp"

-				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="false"

-					/>

-				</FileConfiguration>

-			</File>

-			<File

-				RelativePath="..\..\jit\JIT.h"

-				>

-			</File>

-			<File

 				RelativePath="..\..\jit\ExecutableAllocator.cpp"

 				>

 			</File>

 			<File

-				RelativePath="..\..\jit\ExecutableAllocatorWin.cpp"

-				>

-			</File>

-			<File

 				RelativePath="..\..\jit\ExecutableAllocator.h"

 				>

 			</File>

 			<File

+				RelativePath="..\..\jit\ExecutableAllocatorWin.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JIT.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JIT.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\jit\JITArithmetic.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="false"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\..\jit\JITCall.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="false"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\..\jit\JITInlineMethods.h"

 				>

 			</File>

 			<File

+				RelativePath="..\..\jit\JITOpcodes.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\..\jit\JITPropertyAccess.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="false"

-					/>

-				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITStubCall.h"

+				>

 			</File>

 		</Filter>

+		<Filter

+			Name="Resources"

+			>

+			<File

+				RelativePath=".\JavaScriptCore.rc"

+				>

+			</File>

+		</Filter>

+		<File

+			RelativePath=".\JavaScriptCore.def"

+			>

+		</File>

+		<File

+			RelativePath=".\JavaScriptCore_debug.def"

+			>

+		</File>

 	</Files>

 	<Globals>

 	</Globals>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops
new file mode 100644
index 0000000..fe884aa
--- /dev/null
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreCF"

+	>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="CoreFoundation$(LibraryConfigSuffix).lib"

+	/>

+</VisualStudioPropertySheet>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops
new file mode 100644
index 0000000..02f213b
--- /dev/null
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreCFLite"

+	>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="CFLite$(LibraryConfigSuffix).lib"

+	/>

+</VisualStudioPropertySheet>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
new file mode 100644
index 0000000..1b7cc06
--- /dev/null
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreCommon"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../pcre/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../wrec/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;../../../icu/include;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+		PreprocessorDefinitions="__STD_C"

+	/>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="gdi32.lib oleaut32.lib winmm.lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib WTF$(WebKitConfigSuffix).lib"

+		OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"

+		ModuleDefinitionFile="JavaScriptCore$(WebKitDLLConfigSuffix).def"

+	/>

+	<Tool

+		Name="VCPostBuildEventTool"

+		CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\VM\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\bytecode\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\interpreter\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\assembler\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\jit\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\debugger\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\create_hash_table&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\pcre\pcre.h&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\JavaScriptCore.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+	/>

+	<Tool

+		Name="VCPreBuildEventTool"

+		CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+	/>

+	<Tool

+		Name="VCPreLinkEventTool"

+		CommandLine="if not exist &quot;$(WebKitOutputDir)\public\sym&quot; mkdir &quot;$(WebKitOutputDir)\public\sym&quot;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def
new file mode 100644
index 0000000..31f3e3d
--- /dev/null
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def
@@ -0,0 +1,274 @@
+LIBRARY    "JavaScriptCore_debug"
+
+EXPORTS
+    ??0Collator@WTF@@QAE@PBD@Z
+    ??0Debugger@JSC@@QAE@XZ
+    ??0DropAllLocks@JSLock@JSC@@QAE@_N@Z
+    ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@ABVIdentifier@1@@Z
+    ??0JSByteArray@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@PAVByteArray@4@PBUClassInfo@1@@Z
+    ??0JSFunction@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
+    ??0Mutex@WTF@@QAE@XZ
+    ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V41@ABVArgList@1@@Z@Z
+    ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
+    ??0RefCountedLeakCounter@WTF@@QAE@PBD@Z
+    ??0StringObject@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@ABVUString@1@@Z
+    ??0Structure@JSC@@AAE@VJSValue@1@ABVTypeInfo@1@@Z
+    ??0ThreadCondition@WTF@@QAE@XZ
+    ??0UString@JSC@@QAE@PBD@Z
+    ??0UString@JSC@@QAE@PB_WH@Z
+    ??1CString@JSC@@QAE@XZ
+    ??1ClientData@JSGlobalData@JSC@@UAE@XZ
+    ??1Collator@WTF@@QAE@XZ
+    ??1Debugger@JSC@@UAE@XZ
+    ??1DropAllLocks@JSLock@JSC@@QAE@XZ
+    ??1JSGlobalData@JSC@@QAE@XZ
+    ??1JSGlobalObject@JSC@@UAE@XZ
+    ??1Mutex@WTF@@QAE@XZ
+    ??1RefCountedLeakCounter@WTF@@QAE@XZ
+    ??1Structure@JSC@@QAE@XZ
+    ??1ThreadCondition@WTF@@QAE@XZ
+    ??2JSCell@JSC@@SAPAXIPAVExecState@1@@Z
+    ??2JSGlobalObject@JSC@@SAPAXIPAVJSGlobalData@1@@Z
+    ??4UString@JSC@@QAEAAV01@PBD@Z
+    ??8JSC@@YA_NABVUString@0@0@Z
+    ?UTF8String@UString@JSC@@QBE?AVCString@2@_N@Z
+    ?add@Identifier@JSC@@SA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PAVExecState@2@PBD@Z
+    ?add@PropertyNameArray@JSC@@QAEXPAURep@UString@2@@Z
+    ?addPropertyTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
+    ?addPropertyTransitionToExistingStructure@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
+    ?addPropertyWithoutTransition@Structure@JSC@@QAEIABVIdentifier@2@IPAVJSCell@2@@Z
+    ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PAVExecState@2@PAURep@UString@2@@Z
+    ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PAVJSGlobalData@2@PAURep@UString@2@@Z
+    ?allocate@Heap@JSC@@QAEPAXI@Z
+    ?allocatePropertyStorage@JSObject@JSC@@QAEXII@Z
+    ?append@UString@JSC@@QAEAAV12@ABV12@@Z
+    ?append@UString@JSC@@QAEAAV12@PBD@Z
+    ?ascii@UString@JSC@@QBEPADXZ
+    ?attach@Debugger@JSC@@QAEXPAVJSGlobalObject@2@@Z
+    ?broadcast@ThreadCondition@WTF@@QAEXXZ
+    ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVUString@2@XZ
+    ?call@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@W4CallType@1@ABTCallData@1@1ABVArgList@1@@Z
+    ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
+    ?changePrototypeTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@VJSValue@2@@Z
+    ?checkSameIdentifierTable@Identifier@JSC@@CAXPAVExecState@2@PAURep@UString@2@@Z
+    ?checkSameIdentifierTable@Identifier@JSC@@CAXPAVJSGlobalData@2@PAURep@UString@2@@Z
+    ?classInfo@InternalFunction@JSC@@UBEPBUClassInfo@2@XZ
+    ?classInfo@JSCell@JSC@@UBEPBUClassInfo@2@XZ
+    ?className@JSObject@JSC@@UBE?AVUString@2@XZ
+    ?collate@Collator@WTF@@QBE?AW4Result@12@PB_WI0I@Z
+    ?collect@Heap@JSC@@QAE_NXZ
+    ?computeHash@Rep@UString@JSC@@SAIPBDH@Z
+    ?computeHash@Rep@UString@JSC@@SAIPB_WH@Z
+    ?construct@JSC@@YAPAVJSObject@1@PAVExecState@1@VJSValue@1@W4ConstructType@1@ABTConstructData@1@ABVArgList@1@@Z
+    ?constructArray@JSC@@YAPAVJSArray@1@PAVExecState@1@ABVArgList@1@@Z
+    ?constructEmptyArray@JSC@@YAPAVJSArray@1@PAVExecState@1@@Z
+    ?constructEmptyObject@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
+    ?constructFunction@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@H@Z
+    ?convertUTF16ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPB_WPB_WPAPADPAD_N@Z
+    ?copyParameters@FunctionBodyNode@JSC@@QAEPAVIdentifier@2@XZ
+    ?create@ByteArray@WTF@@SA?AV?$PassRefPtr@VByteArray@WTF@@@2@I@Z
+    ?create@FunctionBodyNode@JSC@@SA?AV?$PassRefPtr@VFunctionBodyNode@JSC@@@WTF@@PAVJSGlobalData@2@PAVSourceElements@2@PAV?$Vector@U?$pair@VIdentifier@JSC@@I@std@@$0A@@4@PAV?$Vector@PAVFuncDeclNode@JSC@@$0A@@4@ABVSourceCode@2@IH@Z
+    ?create@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@_N@Z
+    ?create@OpaqueJSString@@SA?AV?$PassRefPtr@UOpaqueJSString@@@WTF@@ABVUString@JSC@@@Z
+    ?create@Rep@UString@JSC@@SA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PA_WHV?$PassRefPtr@V?$CrossThreadRefCounted@V?$OwnFastMallocPtr@_W@WTF@@@WTF@@@5@@Z
+    ?createEmptyString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@@Z
+    ?createInheritorID@JSObject@JSC@@AAEPAVStructure@2@XZ
+    ?createLeaked@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@XZ
+    ?createStructure@JSByteArray@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@VJSValue@2@@Z
+    ?createTable@HashTable@JSC@@ABEXPAVJSGlobalData@2@@Z
+    ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
+    ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
+    ?currentThread@WTF@@YAIXZ
+    ?currentTime@WTF@@YANXZ
+    ?decrement@RefCountedLeakCounter@WTF@@QAEXXZ
+    ?defaultValue@JSObject@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
+    ?defineGetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@@Z
+    ?defineGetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@@Z
+    ?defineSetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@@Z
+    ?defineSetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@@Z
+    ?deleteOwnedPtr@WTF@@YAXPAUHBITMAP__@@@Z
+    ?deleteOwnedPtr@WTF@@YAXPAUHRGN__@@@Z
+    ?deleteProperty@JSCell@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
+    ?deleteProperty@JSCell@JSC@@UAE_NPAVExecState@2@I@Z
+    ?deleteProperty@JSObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
+    ?deleteProperty@JSObject@JSC@@UAE_NPAVExecState@2@I@Z
+    ?deleteProperty@JSVariableObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
+    ?deleteProperty@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
+    ?deleteTable@HashTable@JSC@@QBEXXZ
+    ?despecifyDictionaryFunction@Structure@JSC@@QAEXABVIdentifier@2@@Z
+    ?despecifyFunctionTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@@Z
+    ?destroy@Heap@JSC@@QAEXXZ
+    ?destroy@Rep@UString@JSC@@QAEXXZ
+    ?detach@Debugger@JSC@@QAEXPAVJSGlobalObject@2@@Z
+    ?detachThread@WTF@@YAXI@Z
+    ?equal@Identifier@JSC@@SA_NPBURep@UString@2@PBD@Z
+    ?equal@JSC@@YA_NPBURep@UString@1@0@Z
+    ?evaluate@DebuggerCallFrame@JSC@@QBE?AVJSValue@2@ABVUString@2@AAV32@@Z
+    ?evaluate@JSC@@YA?AVCompletion@1@PAVExecState@1@AAVScopeChain@1@ABVSourceCode@1@VJSValue@1@@Z
+    ?exclude@Profile@JSC@@QAEXPBVProfileNode@2@@Z
+    ?fastCalloc@WTF@@YAPAXII@Z
+    ?fastFree@WTF@@YAXPAX@Z
+    ?fastMalloc@WTF@@YAPAXI@Z
+    ?fastRealloc@WTF@@YAPAXPAXI@Z
+    ?fastZeroedMalloc@WTF@@YAPAXI@Z
+    ?fillGetterPropertySlot@JSObject@JSC@@QAEXAAVPropertySlot@2@PAVJSValue@2@@Z
+    ?finishParsing@FunctionBodyNode@JSC@@QAEXPAVIdentifier@2@I@Z
+    ?focus@Profile@JSC@@QAEXPBVProfileNode@2@@Z
+    ?from@UString@JSC@@SA?AV12@H@Z
+    ?from@UString@JSC@@SA?AV12@I@Z
+    ?functionName@DebuggerCallFrame@JSC@@QBEPBVUString@2@XZ
+    ?get@Structure@JSC@@QAEIPBURep@UString@2@AAIAAPAVJSCell@2@@Z
+    ?getCallData@JSCell@JSC@@UAE?AW4CallType@2@AATCallData@2@@Z
+    ?getConstructData@JSCell@JSC@@UAE?AW4ConstructType@2@AATConstructData@2@@Z
+    ?getJSNumber@JSCell@JSC@@UAE?AVJSValue@2@XZ
+    ?getObject@JSCell@JSC@@QAEPAVJSObject@2@XZ
+    ?getOwnPropertySlot@JSCell@JSC@@EAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@JSCell@JSC@@EAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@JSObject@JSC@@UAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@JSString@JSC@@EAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@JSString@JSC@@EAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
+    ?getOwnPropertySlot@StringObject@JSC@@UAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
+    ?getPrimitiveNumber@JSObject@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
+    ?getPrimitiveNumber@JSString@JSC@@EAE_NPAVExecState@2@AANAAVJSValue@2@@Z
+    ?getPropertyAttributes@JSObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
+    ?getPropertyAttributes@JSVariableObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
+    ?getPropertyNames@JSObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
+    ?getPropertyNames@JSVariableObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
+    ?getPropertyNames@StringObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
+    ?getSlice@ArgList@JSC@@QBEXHAAV12@@Z
+    ?getString@JSCell@JSC@@QBE?AVUString@2@XZ
+    ?getString@JSCell@JSC@@QBE_NAAVUString@2@@Z
+    ?getTruncatedInt32@JSCell@JSC@@UBE_NAAH@Z
+    ?getTruncatedUInt32@JSCell@JSC@@UBE_NAAI@Z
+    ?getUInt32@JSCell@JSC@@UBE_NAAI@Z
+    ?globalExec@JSGlobalObject@JSC@@UAEPAVExecState@2@XZ
+    ?globalObjectCount@Heap@JSC@@QAEIXZ
+    ?hasInstance@JSObject@JSC@@UAE_NPAVExecState@2@VJSValue@2@1@Z
+    ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@ABVIdentifier@2@@Z
+    ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@I@Z
+    ?heap@Heap@JSC@@SAPAV12@VJSValue@2@@Z
+    ?increment@RefCountedLeakCounter@WTF@@QAEXXZ
+    ?init@JSGlobalObject@JSC@@AAEXPAVJSObject@2@@Z
+    ?initializeMainThread@WTF@@YAXXZ
+    ?initializeThreading@JSC@@YAXXZ
+    ?initializeThreading@WTF@@YAXXZ
+    ?is8Bit@UString@JSC@@QBE_NXZ
+    ?isBusy@Heap@JSC@@QAE_NXZ
+    ?isDynamicScope@JSGlobalObject@JSC@@UBE_NXZ
+    ?isGetterSetter@JSCell@JSC@@UBE_NXZ
+    ?isMainThread@WTF@@YA_NXZ
+    ?isVariableObject@JSVariableObject@JSC@@UBE_NXZ
+    ?jsAPIMangledNumber@JSC@@YA?AVJSValue@1@PAVExecState@1@N@Z
+    ?jsNumberCell@JSC@@YA?AVJSValue@1@PAVExecState@1@N@Z
+    ?jsOwnedString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
+    ?jsRegExpCompile@@YAPAUJSRegExp@@PB_WHW4JSRegExpIgnoreCaseOption@@W4JSRegExpMultilineOption@@PAIPAPBD@Z
+    ?jsRegExpExecute@@YAHPBUJSRegExp@@PB_WHHPAHH@Z
+    ?jsRegExpFree@@YAXPAUJSRegExp@@@Z
+    ?jsString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
+    ?lock@JSLock@JSC@@SAX_N@Z
+    ?lock@Mutex@WTF@@QAEXXZ
+    ?lockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
+    ?lookupGetter@JSObject@JSC@@UAE?AVJSValue@2@PAVExecState@2@ABVIdentifier@2@@Z
+    ?lookupSetter@JSObject@JSC@@UAE?AVJSValue@2@PAVExecState@2@ABVIdentifier@2@@Z
+    ?mark@JSGlobalObject@JSC@@UAEXXZ
+    ?mark@JSObject@JSC@@UAEXXZ
+    ?mark@JSWrapperObject@JSC@@UAEXXZ
+    ?materializePropertyMap@Structure@JSC@@AAEXXZ
+    ?name@InternalFunction@JSC@@QAEABVUString@2@PAVJSGlobalData@2@@Z
+    ?nonInlineNaN@JSImmediate@JSC@@CANXZ
+    ?objectCount@Heap@JSC@@QAEIXZ
+    ?objectProtoFuncToString@JSC@@YI?AVJSValue@1@PAVExecState@1@PAVJSObject@1@V21@ABVArgList@1@@Z
+    ?parse@Parser@JSC@@AAEXPAVJSGlobalData@2@PAHPAVUString@2@@Z
+    ?parseDateFromNullTerminatedCharacters@WTF@@YANPBD@Z
+    ?primaryHeapBegin@Heap@JSC@@QAE?AV?$CollectorHeapIterator@$0A@@2@XZ
+    ?primaryHeapEnd@Heap@JSC@@QAE?AV?$CollectorHeapIterator@$0A@@2@XZ
+    ?profiler@Profiler@JSC@@SAPAV12@XZ
+    ?protect@Heap@JSC@@QAEXVJSValue@2@@Z
+    ?protectedGlobalObjectCount@Heap@JSC@@QAEIXZ
+    ?protectedObjectCount@Heap@JSC@@QAEIXZ
+    ?protectedObjectTypeCounts@Heap@JSC@@QAEPAV?$HashCountedSet@PBDU?$PtrHash@PBD@WTF@@U?$HashTraits@PBD@2@@WTF@@XZ
+    ?prototype@JSImmediate@JSC@@CAPAVJSObject@2@VJSValue@2@PAVExecState@2@@Z
+    ?put@JSCell@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
+    ?put@JSCell@JSC@@UAEXPAVExecState@2@IVJSValue@2@@Z
+    ?put@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
+    ?put@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
+    ?put@JSObject@JSC@@UAEXPAVExecState@2@IVJSValue@2@@Z
+    ?put@StringObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
+    ?putDirectFunction@JSObject@JSC@@QAEXPAVExecState@2@PAVInternalFunction@2@I@Z
+    ?putWithAttributes@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
+    ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
+    ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I_NAAVPutPropertySlot@2@@Z
+    ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@IVJSValue@2@I@Z
+    ?randomNumber@WTF@@YANXZ
+    ?recordExtraCost@Heap@JSC@@AAEXI@Z
+    ?reset@ParserArena@JSC@@QAEXXZ
+    ?reset@TimeoutChecker@JSC@@QAEXXZ
+    ?restoreAll@Profile@JSC@@QAEXXZ
+    ?retrieveCaller@Interpreter@JSC@@QBE?AVJSValue@2@PAVExecState@2@PAVInternalFunction@2@@Z
+    ?retrieveLastCaller@Interpreter@JSC@@QBEXPAVExecState@2@AAH1AAVUString@2@AAVJSValue@2@@Z
+    ?setDumpsGeneratedCode@BytecodeGenerator@JSC@@SAX_N@Z
+    ?setGCProtectNeedsLocking@Heap@JSC@@QAEXXZ
+    ?setLoc@StatementNode@JSC@@QAEXHH@Z
+    ?setMainThreadCallbacksPaused@WTF@@YAX_N@Z
+    ?setOrderLowerFirst@Collator@WTF@@QAEX_N@Z
+    ?setUpStaticFunctionSlot@JSC@@YAXPAVExecState@1@PBVHashEntry@1@PAVJSObject@1@ABVIdentifier@1@AAVPropertySlot@1@@Z
+    ?sharedBuffer@BaseString@UString@JSC@@QAEPAV?$CrossThreadRefCounted@V?$OwnFastMallocPtr@_W@WTF@@@WTF@@XZ
+    ?signal@ThreadCondition@WTF@@QAEXXZ
+    ?slowAppend@MarkedArgumentBuffer@JSC@@AAEXVJSValue@2@@Z
+    ?startIgnoringLeaks@Structure@JSC@@SAXXZ
+    ?startProfiling@Profiler@JSC@@QAEXPAVExecState@2@ABVUString@2@@Z
+    ?stopIgnoringLeaks@Structure@JSC@@SAXXZ
+    ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVUString@2@@Z
+    ?strtod@WTF@@YANPBDPAPAD@Z
+    ?substr@UString@JSC@@QBE?AV12@HH@Z
+    ?thisObject@DebuggerCallFrame@JSC@@QBEPAVJSObject@2@XZ
+    ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@@Z
+    ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@ABVUString@1@@Z
+    ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@PBD@Z
+    ?timedWait@ThreadCondition@WTF@@QAE_NAAVMutex@2@N@Z
+    ?tlsKeyCount@WTF@@YAAAJXZ
+    ?tlsKeys@WTF@@YAPAKXZ
+    ?toBoolean@JSObject@JSC@@UBE_NPAVExecState@2@@Z
+    ?toBoolean@JSString@JSC@@EBE_NPAVExecState@2@@Z
+    ?toInt32SlowCase@JSC@@YAHNAA_N@Z
+    ?toNumber@JSObject@JSC@@UBENPAVExecState@2@@Z
+    ?toNumber@JSString@JSC@@EBENPAVExecState@2@@Z
+    ?toObject@JSImmediate@JSC@@CAPAVJSObject@2@VJSValue@2@PAVExecState@2@@Z
+    ?toObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
+    ?toObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
+    ?toPrimitive@JSString@JSC@@EBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
+    ?toStrictUInt32@UString@JSC@@QBEIPA_N@Z
+    ?toString@JSImmediate@JSC@@CA?AVUString@2@VJSValue@2@@Z
+    ?toString@JSObject@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
+    ?toString@JSString@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
+    ?toString@StringObject@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
+    ?toThisJSString@JSCell@JSC@@UAEPAVJSString@2@PAVExecState@2@@Z
+    ?toThisJSString@JSString@JSC@@EAEPAV12@PAVExecState@2@@Z
+    ?toThisJSString@StringObject@JSC@@EAEPAVJSString@2@PAVExecState@2@@Z
+    ?toThisObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
+    ?toThisObject@JSImmediate@JSC@@CAPAVJSObject@2@VJSValue@2@PAVExecState@2@@Z
+    ?toThisObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
+    ?toThisObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
+    ?toThisString@JSCell@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
+    ?toThisString@JSString@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
+    ?toThisString@StringObject@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
+    ?toUInt32@UString@JSC@@QBEIPA_N@Z
+    ?toUInt32@UString@JSC@@QBEIPA_N_N@Z
+    ?toUInt32SlowCase@JSC@@YAINAA_N@Z
+    ?tryFastCalloc@WTF@@YAPAXII@Z
+    ?tryLock@Mutex@WTF@@QAE_NXZ
+    ?type@DebuggerCallFrame@JSC@@QBE?AW4Type@12@XZ
+    ?unlock@JSLock@JSC@@SAX_N@Z
+    ?unlock@Mutex@WTF@@QAEXXZ
+    ?unlockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
+    ?unprotect@Heap@JSC@@QAEXVJSValue@2@@Z
+    ?unwrappedObject@JSObject@JSC@@UAEPAV12@XZ
+    ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
+    ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
+    WTFLog
+    WTFLogVerbose
+    WTFReportArgumentAssertionFailure
+    WTFReportAssertionFailure
+    WTFReportAssertionFailureWithMessage
+    WTFReportError
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
index 8bec96e..fe3a7ba 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
@@ -3,17 +3,27 @@
 # Visual Studio 2005

 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCore", "JavaScriptCore\JavaScriptCore.vcproj", "{011D10F1-B656-4A1B-A0C3-3842F02122C5}"

 	ProjectSection(ProjectDependencies) = postProject

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}

 	EndProjectSection

 EndProject

 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTF", "WTF\WTF.vcproj", "{AA8A5A85-592B-4357-BC60-E0E91E026AF6}"

+	ProjectSection(ProjectDependencies) = postProject

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}

+	EndProjectSection

 EndProject

 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "JavaScriptCore\JavaScriptCoreGenerated.vcproj", "{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"

 EndProject

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "jsc\jsc.vcproj", "{C59E5129-B453-49B7-A52B-1E104715F76E}"

+	ProjectSection(ProjectDependencies) = postProject

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5} = {011D10F1-B656-4A1B-A0C3-3842F02122C5}

+	EndProjectSection

+EndProject

 Global

 	GlobalSection(SolutionConfigurationPlatforms) = preSolution

 		Debug_Internal|Win32 = Debug_Internal|Win32

 		Debug|Win32 = Debug|Win32

+		Release_PGOInstrument|Win32 = Release_PGOInstrument|Win32

+		Release_PGOOptimize|Win32 = Release_PGOOptimize|Win32

 		Release|Win32 = Release|Win32

 	EndGlobalSection

 	GlobalSection(ProjectConfigurationPlatforms) = postSolution

@@ -21,20 +31,42 @@
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGOInstrument|Win32.ActiveCfg = Release_PGOInstrument|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGOInstrument|Win32.Build.0 = Release_PGOInstrument|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGOOptimize|Win32.ActiveCfg = Release_PGOOptimize|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGOOptimize|Win32.Build.0 = Release_PGOOptimize|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.Build.0 = Debug|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGOInstrument|Win32.ActiveCfg = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGOInstrument|Win32.Build.0 = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGOOptimize|Win32.ActiveCfg = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.ActiveCfg = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.Build.0 = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.ActiveCfg = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.Build.0 = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.ActiveCfg = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = Release|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGOInstrument|Win32.ActiveCfg = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGOInstrument|Win32.Build.0 = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGOOptimize|Win32.ActiveCfg = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.ActiveCfg = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.Build.0 = Release|Win32

 	EndGlobalSection

 	GlobalSection(SolutionProperties) = preSolution

 		HideSolutionNode = FALSE

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
index 76c76ff..d33c322 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="windows-1251"?>

 <VisualStudioProject

 	ProjectType="Visual C++"

-	Version="8,00"

+	Version="8.00"

 	Name="WTF"

 	ProjectGUID="{AA8A5A85-592B-4357-BC60-E0E91E026AF6}"

 	RootNamespace="WTF"

@@ -17,19 +17,15 @@
 	<Configurations>

 		<Configuration

 			Name="Debug|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

 			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;.\WTFCommon.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

-				Description=""

-				CommandLine=""

 			/>

 			<Tool

 				Name="VCXMLDataGeneratorTool"

@@ -42,9 +38,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../parser/;../../wtf/;../../wtf/unicode/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;../../../icu/include;../../bindings;../../bindings/c;../../bindings/jni;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"

-				PreprocessorDefinitions="__STD_C"

-				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -57,8 +50,6 @@
 			/>

 			<Tool

 				Name="VCLibrarianTool"

-				AdditionalDependencies="user32.lib"

-				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).lib"

 			/>

 			<Tool

 				Name="VCALinkTool"

@@ -74,25 +65,20 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Release|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

 			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\WTFCommon.vsprops"

 			CharacterSet="1"

 			WholeProgramOptimization="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

-				Description=""

-				CommandLine=""

 			/>

 			<Tool

 				Name="VCXMLDataGeneratorTool"

@@ -105,9 +91,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../parser/;../../wtf/;../../wtf/unicode/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;../../../icu/include;../../bindings;../../bindings/c;../../bindings/jni;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"

-				PreprocessorDefinitions="__STD_C"

-				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -120,8 +103,6 @@
 			/>

 			<Tool

 				Name="VCLibrarianTool"

-				AdditionalDependencies="user32.lib"

-				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).lib"

 			/>

 			<Tool

 				Name="VCALinkTool"

@@ -137,24 +118,19 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Debug_Internal|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

 			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\WTFCommon.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

-				Description=""

-				CommandLine=""

 			/>

 			<Tool

 				Name="VCXMLDataGeneratorTool"

@@ -167,9 +143,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../parser/;../../wtf/;../../wtf/unicode/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;../../../icu/include;../../bindings;../../bindings/c;../../bindings/jni;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"

-				PreprocessorDefinitions="__STD_C"

-				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -182,8 +155,6 @@
 			/>

 			<Tool

 				Name="VCLibrarianTool"

-				AdditionalDependencies="user32.lib"

-				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).lib"

 			/>

 			<Tool

 				Name="VCALinkTool"

@@ -199,7 +170,6 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 	</Configurations>

@@ -230,14 +200,14 @@
 			RelativePath="..\..\wtf\Assertions.h"

 			>

 		</File>

-	    <File

-    		RelativePath="..\..\wtf\ByteArray.cpp"

-    		>

-    	</File>

-    	<File

-    		RelativePath="..\..\wtf\ByteArray.h"

-    		>

-    	</File>

+		<File

+			RelativePath="..\..\wtf\ByteArray.cpp"

+			>

+		</File>

+		<File

+			RelativePath="..\..\wtf\ByteArray.h"

+			>

+		</File>

 		<File

 			RelativePath="..\..\wtf\unicode\Collator.h"

 			>

@@ -251,6 +221,10 @@
 			>

 		</File>

 		<File

+			RelativePath="..\..\wtf\CrossThreadRefCounted.h"

+			>

+		</File>

+		<File

 			RelativePath="..\..\wtf\CurrentTime.cpp"

 			>

 		</File>

@@ -259,6 +233,14 @@
 			>

 		</File>

 		<File

+			RelativePath="..\..\wtf\DateMath.cpp"

+			>

+		</File>

+		<File

+			RelativePath="..\..\wtf\DateMath.h"

+			>

+		</File>

+		<File

 			RelativePath="..\..\wtf\Deque.h"

 			>

 		</File>

@@ -271,6 +253,10 @@
 			>

 		</File>

 		<File

+			RelativePath="..\..\wtf\FastAllocBase.h"

+			>

+		</File>

+		<File

 			RelativePath="..\..\wtf\FastMalloc.cpp"

 			>

 		</File>

@@ -359,14 +345,26 @@
 			>

 		</File>

 		<File

+			RelativePath="..\..\wtf\OwnFastMallocPtr.h"

+			>

+		</File>

+		<File

 			RelativePath="..\..\wtf\OwnPtr.h"

 			>

 		</File>

 		<File

+			RelativePath="..\..\wtf\OwnPtrCommon.h"

+			>

+		</File>

+		<File

 			RelativePath="..\..\wtf\OwnPtrWin.cpp"

 			>

 		</File>

 		<File

+			RelativePath="..\..\wtf\PassOwnPtr.h"

+			>

+		</File>

+		<File

 			RelativePath="..\..\wtf\PassRefPtr.h"

 			>

 		</File>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFCommon.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFCommon.vsprops
new file mode 100644
index 0000000..b124b27
--- /dev/null
+++ b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFCommon.vsprops
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WTFCommon"

+	OutputDirectory="$(WebKitOutputDir)\lib"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../parser/;../../wtf/;../../wtf/unicode/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;../../../icu/include;../../bindings;../../bindings/c;../../bindings/jni;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"

+		PreprocessorDefinitions="__STD_C"

+	/>

+	<Tool

+		Name="VCLibrarianTool"

+		AdditionalDependencies="user32.lib"

+		OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).lib"

+	/>

+	<Tool

+		Name="VCPostBuildEventTool"

+		CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

+	/>

+	<Tool

+		Name="VCPreBuildEventTool"

+		CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%"

+	/>

+</VisualStudioPropertySheet>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
index 5ca2306..ce2fe04 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
@@ -18,12 +18,11 @@
 		<Configuration

 			Name="Debug|Win32"

 			ConfigurationType="1"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;.\jscCommon.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -39,8 +38,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../assembler/;../../wrec/;../../parser/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;../../../icu/include;&quot;$(WebKitLibrariesDir)\include&quot;;../../jit/"

-				PreprocessorDefinitions="__STD_C"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -53,10 +50,6 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="JavaScriptCore$(WebKitConfigSuffix).lib WTF$(WebKitConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib user32.lib"

-				AdditionalLibraryDirectories=""

-				DelayLoadDLLs=""

-				SubSystem="1"

 			/>

 			<Tool

 				Name="VCALinkTool"

@@ -81,19 +74,17 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Release|Win32"

 			ConfigurationType="1"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\jscCommon.vsprops"

 			CharacterSet="1"

 			WholeProgramOptimization="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -109,8 +100,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../assembler/;../../wrec/;../../parser/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;../../../icu/include;&quot;$(WebKitLibrariesDir)\include&quot;;../../jit/"

-				PreprocessorDefinitions="__STD_C"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -123,10 +112,6 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="JavaScriptCore$(WebKitConfigSuffix).lib WTF$(WebKitConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib user32.lib"

-				AdditionalLibraryDirectories=""

-				DelayLoadDLLs=""

-				SubSystem="1"

 			/>

 			<Tool

 				Name="VCALinkTool"

@@ -151,18 +136,16 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Debug_Internal|Win32"

 			ConfigurationType="1"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\jscCommon.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -178,8 +161,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../assembler/;../../wrec/;../../parser/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;../../../icu/include;&quot;$(WebKitLibrariesDir)\include&quot;;../../jit/"

-				PreprocessorDefinitions="__STD_C"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -192,10 +173,6 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="JavaScriptCore$(WebKitConfigSuffix).lib WTF$(WebKitConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib user32.lib"

-				AdditionalLibraryDirectories=""

-				DelayLoadDLLs=""

-				SubSystem="1"

 			/>

 			<Tool

 				Name="VCALinkTool"

@@ -220,7 +197,6 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

 			/>

 		</Configuration>

 	</Configurations>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
new file mode 100644
index 0000000..8fa98b4
--- /dev/null
+++ b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="jscCommon"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../assembler/;../../wrec/;../../parser/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;../../../icu/include;&quot;$(WebKitLibrariesDir)\include&quot;;../../jit/"

+		PreprocessorDefinitions="__STD_C"

+	/>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WTF$(WebKitConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib user32.lib"

+		SubSystem="1"

+	/>

+	<Tool

+		Name="VCPostBuildEventTool"

+		CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\objc$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\objc$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\ASL$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\ASL$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;cmd /c&#x0D;&#x0A;"

+	/>

+	<Tool

+		Name="VCPreBuildEventTool"

+		CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
index d13ed56..ef45c5b 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
@@ -18,12 +18,11 @@
 		<Configuration

 			Name="Debug|Win32"

 			ConfigurationType="1"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;.\testapiCommon.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -39,15 +38,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				Optimization="0"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..\..\API&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

-				MinimalRebuild="true"

-				BasicRuntimeChecks="3"

-				RuntimeLibrary="3"

-				UsePrecompiledHeader="0"

-				WarningLevel="4"

-				Detect64BitPortabilityProblems="true"

-				DebugInformationFormat="4"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -60,11 +50,6 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="JavaScriptCore$(WebKitConfigSuffix).lib WTF$(WebKitConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib"

-				LinkIncremental="2"

-				GenerateDebugInformation="true"

-				SubSystem="1"

-				TargetMachine="1"

 			/>

 			<Tool

 				Name="VCALinkTool"

@@ -89,19 +74,17 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\API\tests\testapi.js&quot; &quot;$(OutDir)&quot;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Release|Win32"

 			ConfigurationType="1"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\testapiCommon.vsprops"

 			CharacterSet="1"

 			WholeProgramOptimization="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -117,12 +100,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..\..\API&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

-				RuntimeLibrary="2"

-				UsePrecompiledHeader="0"

-				WarningLevel="4"

-				Detect64BitPortabilityProblems="true"

-				DebugInformationFormat="3"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -135,13 +112,6 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="JavaScriptCore$(WebKitConfigSuffix).lib WTF$(WebKitConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib"

-				LinkIncremental="1"

-				GenerateDebugInformation="true"

-				SubSystem="1"

-				OptimizeReferences="2"

-				EnableCOMDATFolding="2"

-				TargetMachine="1"

 			/>

 			<Tool

 				Name="VCALinkTool"

@@ -166,18 +136,16 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\API\tests\testapi.js&quot; &quot;$(OutDir)&quot;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Debug_Internal|Win32"

 			ConfigurationType="1"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\testapiCommon.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -193,14 +161,6 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				Optimization="0"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..\..\API&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

-				MinimalRebuild="true"

-				BasicRuntimeChecks="3"

-				RuntimeLibrary="3"

-				UsePrecompiledHeader="0"

-				WarningLevel="4"

-				Detect64BitPortabilityProblems="true"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -213,11 +173,6 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="JavaScriptCore$(WebKitConfigSuffix).lib WTF$(WebKitConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib"

-				LinkIncremental="2"

-				GenerateDebugInformation="true"

-				SubSystem="1"

-				TargetMachine="1"

 			/>

 			<Tool

 				Name="VCALinkTool"

@@ -242,7 +197,6 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\API\tests\testapi.js&quot; &quot;$(OutDir)&quot;"

 			/>

 		</Configuration>

 	</Configurations>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops
new file mode 100644
index 0000000..af17f27
--- /dev/null
+++ b/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testapiCommon"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ProjectDir)\..\..\API&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+		WarningLevel="4"

+		Detect64BitPortabilityProblems="true"

+	/>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WTF$(WebKitConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib"

+		SubSystem="1"

+	/>

+	<Tool

+		Name="VCPostBuildEventTool"

+		CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\API\tests\testapi.js&quot; &quot;$(OutDir)&quot;"

+	/>

+	<Tool

+		Name="VCPreBuildEventTool"

+		CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index e10ec7b..8e3eb2e 100644
--- a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -42,6 +42,8 @@
 		0B1F921D0F1753500036468E /* PtrAndFlags.h in Headers */ = {isa = PBXBuildFile; fileRef = 0B1F921B0F17502D0036468E /* PtrAndFlags.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0B330C270F38C62300692DE3 /* TypeTraits.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0B330C260F38C62300692DE3 /* TypeTraits.cpp */; };
 		0B4D7E630F319AC800AD7E58 /* TypeTraits.h in Headers */ = {isa = PBXBuildFile; fileRef = 0B4D7E620F319AC800AD7E58 /* TypeTraits.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0BDFFAE00FC6192900D69EF4 /* CrossThreadRefCounted.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BDFFAD40FC6171000D69EF4 /* CrossThreadRefCounted.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0BDFFAE10FC6193100D69EF4 /* OwnFastMallocPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BDFFAD10FC616EC00D69EF4 /* OwnFastMallocPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		140B7D1D0DC69AF7009C42B8 /* JSActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14DA818F0D99FD2000B0A4FB /* JSActivation.cpp */; };
 		140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		141211310A48794D00480255 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
@@ -98,6 +100,11 @@
 		180B9BFE0F16E94D009BDBC5 /* CurrentTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 180B9AEF0F16C569009BDBC5 /* CurrentTime.cpp */; };
 		1C61516C0EBAC7A00031376F /* ProfilerServer.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1C61516A0EBAC7A00031376F /* ProfilerServer.mm */; settings = {COMPILER_FLAGS = "-fno-strict-aliasing"; }; };
 		1C61516D0EBAC7A00031376F /* ProfilerServer.h in Headers */ = {isa = PBXBuildFile; fileRef = 1C61516B0EBAC7A00031376F /* ProfilerServer.h */; };
+		41359CF30FDD89AD00206180 /* DateConversion.h in Headers */ = {isa = PBXBuildFile; fileRef = D21202290AD4310C00ED79B6 /* DateConversion.h */; };
+		41359CF60FDD89CB00206180 /* DateMath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41359CF40FDD89CB00206180 /* DateMath.cpp */; };
+		41359CF70FDD89CB00206180 /* DateMath.h in Headers */ = {isa = PBXBuildFile; fileRef = 41359CF50FDD89CB00206180 /* DateMath.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		4409D8470FAF80A200523B87 /* OwnPtrCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 440B7AED0FAF7FCB0073323E /* OwnPtrCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		44DD48530FAEA85000D6B4EB /* PassOwnPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 44DD48520FAEA85000D6B4EB /* PassOwnPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5D53726F0E1C54880021E549 /* Tracing.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D53726E0E1C54880021E549 /* Tracing.h */; };
 		5D5D8AB60E0D0A7200F9C692 /* jsc in Copy Into Framework */ = {isa = PBXBuildFile; fileRef = 932F5BE10822A1C700736975 /* jsc */; };
 		5D5D8AD10E0D0EBE00F9C692 /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
@@ -116,22 +123,35 @@
 		860161E40F3A83C100F84710 /* MacroAssemblerX86.h in Headers */ = {isa = PBXBuildFile; fileRef = 860161E00F3A83C100F84710 /* MacroAssemblerX86.h */; };
 		860161E50F3A83C100F84710 /* MacroAssemblerX86_64.h in Headers */ = {isa = PBXBuildFile; fileRef = 860161E10F3A83C100F84710 /* MacroAssemblerX86_64.h */; };
 		860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */ = {isa = PBXBuildFile; fileRef = 860161E20F3A83C100F84710 /* MacroAssemblerX86Common.h */; };
+		863B23E00FC6118900703AA4 /* MacroAssemblerCodeRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 863B23DF0FC60E6200703AA4 /* MacroAssemblerCodeRef.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		869083150E6518D7000D36ED /* WREC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 869083130E6518D7000D36ED /* WREC.cpp */; };
 		869083160E6518D7000D36ED /* WREC.h in Headers */ = {isa = PBXBuildFile; fileRef = 869083140E6518D7000D36ED /* WREC.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		869EBCB70E8C6D4A008722CC /* ResultType.h in Headers */ = {isa = PBXBuildFile; fileRef = 869EBCB60E8C6D4A008722CC /* ResultType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86A90ED00EE7D51F00AB350D /* JITArithmetic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86A90ECF0EE7D51F00AB350D /* JITArithmetic.cpp */; };
+		86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */; };
+		86ADD1460FDDEA980006EEC2 /* MacroAssemblerARMv7.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ADD1440FDDEA980006EEC2 /* MacroAssemblerARMv7.h */; };
 		86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */; };
 		86CC85A10EE79A4700288682 /* JITInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = 86CC85A00EE79A4700288682 /* JITInlineMethods.h */; };
 		86CC85A30EE79B7400288682 /* JITCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86CC85A20EE79B7400288682 /* JITCall.cpp */; };
 		86CC85C40EE7A89400288682 /* JITPropertyAccess.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86CC85C30EE7A89400288682 /* JITPropertyAccess.cpp */; };
-		86CCEFDE0F413F8900FD7F9E /* JITCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 86CCEFDD0F413F8900FD7F9E /* JITCode.h */; };
+		86CCEFDE0F413F8900FD7F9E /* JITCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 86CCEFDD0F413F8900FD7F9E /* JITCode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86DB64640F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */; };
+		86EAC4950F93E8D1008EC948 /* RegexCompiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EAC48D0F93E8D1008EC948 /* RegexCompiler.cpp */; };
+		86EAC4960F93E8D1008EC948 /* RegexCompiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EAC48E0F93E8D1008EC948 /* RegexCompiler.h */; };
+		86EAC4970F93E8D1008EC948 /* RegexInterpreter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EAC48F0F93E8D1008EC948 /* RegexInterpreter.cpp */; };
+		86EAC4980F93E8D1008EC948 /* RegexInterpreter.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EAC4900F93E8D1008EC948 /* RegexInterpreter.h */; };
+		86EAC4990F93E8D1008EC948 /* RegexJIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EAC4910F93E8D1008EC948 /* RegexJIT.cpp */; };
+		86EAC49A0F93E8D1008EC948 /* RegexJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EAC4920F93E8D1008EC948 /* RegexJIT.h */; };
+		86EAC49B0F93E8D1008EC948 /* RegexParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EAC4930F93E8D1008EC948 /* RegexParser.h */; };
+		86EAC49C0F93E8D1008EC948 /* RegexPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EAC4940F93E8D1008EC948 /* RegexPattern.h */; };
 		905B02AE0E28640F006DF882 /* RefCountedLeakCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 905B02AD0E28640F006DF882 /* RefCountedLeakCounter.cpp */; };
 		90D3469C0E285280009492EE /* RefCountedLeakCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 90D3469B0E285280009492EE /* RefCountedLeakCounter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93052C320FB792190048FDC3 /* ParserArena.cpp */; };
+		93052C350FB792190048FDC3 /* ParserArena.h in Headers */ = {isa = PBXBuildFile; fileRef = 93052C330FB792190048FDC3 /* ParserArena.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		930754C108B0F68000AB3056 /* pcre_compile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 930754BF08B0F68000AB3056 /* pcre_compile.cpp */; };
 		930754D008B0F74600AB3056 /* pcre_tables.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 930754CE08B0F74500AB3056 /* pcre_tables.cpp */; };
 		930754EB08B0F78500AB3056 /* pcre_exec.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 930754E908B0F78500AB3056 /* pcre_exec.cpp */; settings = {COMPILER_FLAGS = "-fno-move-loop-invariants"; }; };
 		932F5BD30822A1C700736975 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */; };
-		932F5BD40822A1C700736975 /* CoreServices.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6560A63D04B3B69F008AE952 /* CoreServices.framework */; };
 		932F5BD50822A1C700736975 /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EB6105C86C6B00E6DF1B /* Foundation.framework */; };
 		932F5BD60822A1C700736975 /* libobjc.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EC0705C86C9A00E6DF1B /* libobjc.dylib */; };
 		932F5BD70822A1C700736975 /* libicucore.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 9322A00306C341D3009067BB /* libicucore.dylib */; };
@@ -145,15 +165,12 @@
 		95742F650DD11F5A000917FB /* Profile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 95742F630DD11F5A000917FB /* Profile.cpp */; };
 		95AB83420DA4322500BC83F3 /* Profiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 95AB832E0DA42CAD00BC83F3 /* Profiler.cpp */; };
 		95AB83560DA43C3000BC83F3 /* ProfileNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 95AB83540DA43B4400BC83F3 /* ProfileNode.cpp */; };
-		95CD41B30E1BF6560085358E /* TreeProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 95CD41B10E1BF6560085358E /* TreeProfile.cpp */; };
-		95CD41B40E1BF6560085358E /* TreeProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 95CD41B20E1BF6560085358E /* TreeProfile.h */; };
 		95CD45760E1C4FDD0085358E /* ProfileGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 95CD45740E1C4FDD0085358E /* ProfileGenerator.cpp */; };
 		95CD45770E1C4FDD0085358E /* ProfileGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 95CD45750E1C4FDD0085358E /* ProfileGenerator.h */; settings = {ATTRIBUTES = (); }; };
 		95E3BC050E1AE68200B2D1C1 /* CallIdentifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 95E3BC040E1AE68200B2D1C1 /* CallIdentifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		95F6E6950E5B5F970091E860 /* JSProfilerPrivate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 95988BA90E477BEC00D28D4D /* JSProfilerPrivate.cpp */; };
-		95FDFA140E22998F0006FB00 /* HeavyProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 95FDFA130E22998F0006FB00 /* HeavyProfile.cpp */; };
-		95FDFA160E2299980006FB00 /* HeavyProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 95FDFA150E2299980006FB00 /* HeavyProfile.h */; };
 		960097A60EBABB58007A7297 /* LabelScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 960097A50EBABB58007A7297 /* LabelScope.h */; };
+		960626960FB8EC02009798AB /* JITStubCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 960626950FB8EC02009798AB /* JITStubCall.h */; };
 		9688CB150ED12B4E001D649F /* AssemblerBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 9688CB130ED12B4E001D649F /* AssemblerBuffer.h */; };
 		9688CB160ED12B4E001D649F /* X86Assembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 9688CB140ED12B4E001D649F /* X86Assembler.h */; };
 		969A07230ED1CE3300F1F681 /* BytecodeGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07210ED1CE3300F1F681 /* BytecodeGenerator.h */; };
@@ -167,16 +184,20 @@
 		969A079A0ED1D3AE00F1F681 /* Opcode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 969A07940ED1D3AE00F1F681 /* Opcode.cpp */; };
 		969A079B0ED1D3AE00F1F681 /* Opcode.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07950ED1D3AE00F1F681 /* Opcode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		96A746410EDDF70600904779 /* Escapes.h in Headers */ = {isa = PBXBuildFile; fileRef = 96A7463F0EDDF70600904779 /* Escapes.h */; };
+		96DD73790F9DA3100027FBCC /* VMTags.h in Headers */ = {isa = PBXBuildFile; fileRef = 96DD73780F9DA3100027FBCC /* VMTags.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A72700900DAC6BBC00E548D7 /* JSNotAnObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A72700780DAC605600E548D7 /* JSNotAnObject.cpp */; };
 		A72701B90DADE94900E548D7 /* ExceptionHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = A72701B30DADE94900E548D7 /* ExceptionHelpers.h */; };
 		A727FF6B0DA3092200E548D7 /* JSPropertyNameIterator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A727FF660DA3053B00E548D7 /* JSPropertyNameIterator.cpp */; };
 		A766B44F0EE8DCD1009518CA /* ExecutableAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A76EE6590FAE59D5003F069A /* NativeFunctionWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = A76EE6580FAE59D5003F069A /* NativeFunctionWrapper.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A782F1A50EEC9FA20036273F /* ExecutableAllocatorPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A782F1A40EEC9FA20036273F /* ExecutableAllocatorPosix.cpp */; };
 		A791EF280F11E07900AE1F68 /* JSByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A791EF260F11E07900AE1F68 /* JSByteArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A791EF290F11E07900AE1F68 /* JSByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A791EF270F11E07900AE1F68 /* JSByteArray.cpp */; };
 		A7A1F7AC0F252B3C00E184E2 /* ByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7A1F7AA0F252B3C00E184E2 /* ByteArray.cpp */; };
 		A7A1F7AD0F252B3C00E184E2 /* ByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */; };
+		A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E2EA690FB460CF00601F06 /* LiteralParser.h */; };
+		A7E2EA6C0FB460CF00601F06 /* LiteralParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */; };
 		BC02E90D0E1839DB000F9297 /* ErrorConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9050E1839DB000F9297 /* ErrorConstructor.h */; };
 		BC02E90F0E1839DB000F9297 /* ErrorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9070E1839DB000F9297 /* ErrorPrototype.h */; };
 		BC02E9110E1839DB000F9297 /* NativeErrorConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9090E1839DB000F9297 /* NativeErrorConstructor.h */; };
@@ -200,7 +221,6 @@
 		BC18C3F40E16F5CD00B34460 /* Completion.h in Headers */ = {isa = PBXBuildFile; fileRef = F5BB2BC5030F772101FCFE1D /* Completion.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3F50E16F5CD00B34460 /* config.h in Headers */ = {isa = PBXBuildFile; fileRef = F68EBB8C0255D4C601FF60F7 /* config.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3F60E16F5CD00B34460 /* ConstructData.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8F3CCF0DAF17BA00577A80 /* ConstructData.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C3F90E16F5CD00B34460 /* DateMath.h in Headers */ = {isa = PBXBuildFile; fileRef = D21202290AD4310C00ED79B6 /* DateMath.h */; };
 		BC18C3FA0E16F5CD00B34460 /* Debugger.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8590255597D01FF60F7 /* Debugger.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3FB0E16F5CD00B34460 /* DebuggerCallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 1480DB9B0DDC227F003CFDF2 /* DebuggerCallFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3FC0E16F5CD00B34460 /* Deque.h in Headers */ = {isa = PBXBuildFile; fileRef = 5186111D0CC824830081412B /* Deque.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -255,7 +275,7 @@
 		BC18C4360E16F5CD00B34460 /* Locker.h in Headers */ = {isa = PBXBuildFile; fileRef = E1EE79270D6C964500FEA3BA /* Locker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4370E16F5CD00B34460 /* Lookup.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8690255597D01FF60F7 /* Lookup.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4390E16F5CD00B34460 /* MainThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 06D358A30DAAD9C4003B174E /* MainThread.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C43A0E16F5CD00B34460 /* MallocZoneSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DBD18AF0C5401A700C15EAE /* MallocZoneSupport.h */; };
+		BC18C43A0E16F5CD00B34460 /* MallocZoneSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DBD18AF0C5401A700C15EAE /* MallocZoneSupport.h */; settings = {ATTRIBUTES = (); }; };
 		BC18C43B0E16F5CD00B34460 /* MathExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF6553B0A2048DE0038A194 /* MathExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A86B0255597D01FF60F7 /* MathObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C43E0E16F5CD00B34460 /* MessageQueue.h in Headers */ = {isa = PBXBuildFile; fileRef = E1EE798B0D6CA53D00FEA3BA /* MessageQueue.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -338,6 +358,7 @@
 		BCD2034A0E17135E002C7E82 /* DateConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD203460E17135E002C7E82 /* DateConstructor.h */; };
 		BCD2034C0E17135E002C7E82 /* DatePrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD203480E17135E002C7E82 /* DatePrototype.h */; };
 		BCD203E80E1718F4002C7E82 /* DatePrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD203E70E1718F4002C7E82 /* DatePrototype.lut.h */; };
+		BCDD51EB0FB8DF74004A8BDC /* JITOpcodes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCDD51E90FB8DF74004A8BDC /* JITOpcodes.cpp */; };
 		BCDE3AB80E6C82F5001453A7 /* Structure.h in Headers */ = {isa = PBXBuildFile; fileRef = BCDE3AB10E6C82CF001453A7 /* Structure.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCDE3B430E6C832D001453A7 /* Structure.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCDE3AB00E6C82CF001453A7 /* Structure.cpp */; };
 		BCF605140E203EF800B9A64D /* ArgList.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF605120E203EF800B9A64D /* ArgList.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -352,6 +373,7 @@
 		E1A862D60D7F2B5C001EC6AA /* CollatorDefault.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A862D50D7F2B5C001EC6AA /* CollatorDefault.cpp */; };
 		E1EE793D0D6C9B9200FEA3BA /* ThreadingPthreads.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1EE793C0D6C9B9200FEA3BA /* ThreadingPthreads.cpp */; };
 		E1EF79AA0CE97BA60088D500 /* UTF8.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1EF79A80CE97BA60088D500 /* UTF8.cpp */; };
+		E48E0F2D0F82151700A8CA37 /* FastAllocBase.h in Headers */ = {isa = PBXBuildFile; fileRef = E48E0F2C0F82151700A8CA37 /* FastAllocBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FE1B447A0ECCD73B004F4DD1 /* StdLibExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = FE1B44790ECCD73B004F4DD1 /* StdLibExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
 /* End PBXBuildFile section */
 
@@ -438,6 +460,8 @@
 		0B1F921B0F17502D0036468E /* PtrAndFlags.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PtrAndFlags.h; sourceTree = "<group>"; };
 		0B330C260F38C62300692DE3 /* TypeTraits.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypeTraits.cpp; sourceTree = "<group>"; };
 		0B4D7E620F319AC800AD7E58 /* TypeTraits.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeTraits.h; sourceTree = "<group>"; };
+		0BDFFAD10FC616EC00D69EF4 /* OwnFastMallocPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OwnFastMallocPtr.h; sourceTree = "<group>"; };
+		0BDFFAD40FC6171000D69EF4 /* CrossThreadRefCounted.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CrossThreadRefCounted.h; sourceTree = "<group>"; };
 		140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBasePrivate.h; sourceTree = "<group>"; };
 		141211020A48780900480255 /* minidom.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = minidom.c; path = tests/minidom.c; sourceTree = "<group>"; };
 		1412110D0A48788700480255 /* minidom.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = minidom.js; path = tests/minidom.js; sourceTree = "<group>"; };
@@ -528,6 +552,11 @@
 		1C9051450BA9E8A70081E9D0 /* Base.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Base.xcconfig; sourceTree = "<group>"; };
 		1CAA8B4A0D32C39A0041BCFF /* JavaScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaScript.h; sourceTree = "<group>"; };
 		1CAA8B4B0D32C39A0041BCFF /* JavaScriptCore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaScriptCore.h; sourceTree = "<group>"; };
+		41359CF40FDD89CB00206180 /* DateMath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DateMath.cpp; sourceTree = "<group>"; };
+		41359CF50FDD89CB00206180 /* DateMath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateMath.h; sourceTree = "<group>"; };
+		440B7AED0FAF7FCB0073323E /* OwnPtrCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OwnPtrCommon.h; sourceTree = "<group>"; };
+		449097EE0F8F81B50076A327 /* FeatureDefines.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = FeatureDefines.xcconfig; sourceTree = "<group>"; };
+		44DD48520FAEA85000D6B4EB /* PassOwnPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PassOwnPtr.h; sourceTree = "<group>"; };
 		45E12D8806A49B0F00E9DF84 /* jsc.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = jsc.cpp; sourceTree = "<group>"; tabWidth = 4; };
 		5186111D0CC824830081412B /* Deque.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Deque.h; sourceTree = "<group>"; };
 		51F0EB6105C86C6B00E6DF1B /* Foundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Foundation.framework; path = /System/Library/Frameworks/Foundation.framework; sourceTree = "<absolute>"; };
@@ -553,7 +582,6 @@
 		6541BD7008E80A17002CBEE7 /* TCSystemAlloc.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TCSystemAlloc.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		6541BD7108E80A17002CBEE7 /* TCSystemAlloc.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = TCSystemAlloc.h; sourceTree = "<group>"; tabWidth = 8; };
 		6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreFoundation.framework; path = /System/Library/Frameworks/CoreFoundation.framework; sourceTree = "<absolute>"; };
-		6560A63D04B3B69F008AE952 /* CoreServices.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreServices.framework; path = /System/Library/Frameworks/CoreServices.framework; sourceTree = "<absolute>"; };
 		65621E6B089E859700760F35 /* PropertySlot.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertySlot.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		65621E6C089E859700760F35 /* PropertySlot.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = PropertySlot.h; sourceTree = "<group>"; tabWidth = 8; };
 		657EB7450B708F540063461B /* ListHashSet.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ListHashSet.h; sourceTree = "<group>"; };
@@ -596,23 +624,39 @@
 		860161E00F3A83C100F84710 /* MacroAssemblerX86.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerX86.h; sourceTree = "<group>"; };
 		860161E10F3A83C100F84710 /* MacroAssemblerX86_64.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerX86_64.h; sourceTree = "<group>"; };
 		860161E20F3A83C100F84710 /* MacroAssemblerX86Common.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerX86Common.h; sourceTree = "<group>"; };
+		863B23DF0FC60E6200703AA4 /* MacroAssemblerCodeRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerCodeRef.h; sourceTree = "<group>"; };
 		869083130E6518D7000D36ED /* WREC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WREC.cpp; sourceTree = "<group>"; };
 		869083140E6518D7000D36ED /* WREC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WREC.h; sourceTree = "<group>"; };
 		869EBCB60E8C6D4A008722CC /* ResultType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResultType.h; sourceTree = "<group>"; };
 		86A90ECF0EE7D51F00AB350D /* JITArithmetic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITArithmetic.cpp; sourceTree = "<group>"; };
+		86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ARMv7Assembler.h; sourceTree = "<group>"; };
+		86ADD1440FDDEA980006EEC2 /* MacroAssemblerARMv7.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerARMv7.h; sourceTree = "<group>"; };
 		86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssembler.h; sourceTree = "<group>"; };
 		86CC85A00EE79A4700288682 /* JITInlineMethods.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITInlineMethods.h; sourceTree = "<group>"; };
 		86CC85A20EE79B7400288682 /* JITCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITCall.cpp; sourceTree = "<group>"; };
 		86CC85C30EE7A89400288682 /* JITPropertyAccess.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITPropertyAccess.cpp; sourceTree = "<group>"; };
 		86CCEFDD0F413F8900FD7F9E /* JITCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCode.h; sourceTree = "<group>"; };
+		86DB645F0F954E9100D7D921 /* ExecutableAllocatorWin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocatorWin.cpp; sourceTree = "<group>"; };
+		86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocatorFixedVMPool.cpp; sourceTree = "<group>"; };
+		86EAC48D0F93E8D1008EC948 /* RegexCompiler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RegexCompiler.cpp; path = yarr/RegexCompiler.cpp; sourceTree = "<group>"; };
+		86EAC48E0F93E8D1008EC948 /* RegexCompiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RegexCompiler.h; path = yarr/RegexCompiler.h; sourceTree = "<group>"; };
+		86EAC48F0F93E8D1008EC948 /* RegexInterpreter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RegexInterpreter.cpp; path = yarr/RegexInterpreter.cpp; sourceTree = "<group>"; };
+		86EAC4900F93E8D1008EC948 /* RegexInterpreter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RegexInterpreter.h; path = yarr/RegexInterpreter.h; sourceTree = "<group>"; };
+		86EAC4910F93E8D1008EC948 /* RegexJIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RegexJIT.cpp; path = yarr/RegexJIT.cpp; sourceTree = "<group>"; };
+		86EAC4920F93E8D1008EC948 /* RegexJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RegexJIT.h; path = yarr/RegexJIT.h; sourceTree = "<group>"; };
+		86EAC4930F93E8D1008EC948 /* RegexParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RegexParser.h; path = yarr/RegexParser.h; sourceTree = "<group>"; };
+		86EAC4940F93E8D1008EC948 /* RegexPattern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RegexPattern.h; path = yarr/RegexPattern.h; sourceTree = "<group>"; };
 		905B02AD0E28640F006DF882 /* RefCountedLeakCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RefCountedLeakCounter.cpp; sourceTree = "<group>"; };
 		90D3469B0E285280009492EE /* RefCountedLeakCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RefCountedLeakCounter.h; sourceTree = "<group>"; };
 		9303F567099118FA00AD71B8 /* OwnPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OwnPtr.h; sourceTree = "<group>"; };
 		9303F5690991190000AD71B8 /* Noncopyable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Noncopyable.h; sourceTree = "<group>"; };
 		9303F5A409911A5800AD71B8 /* OwnArrayPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OwnArrayPtr.h; sourceTree = "<group>"; };
+		93052C320FB792190048FDC3 /* ParserArena.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ParserArena.cpp; sourceTree = "<group>"; };
+		93052C330FB792190048FDC3 /* ParserArena.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ParserArena.h; sourceTree = "<group>"; };
 		930754BF08B0F68000AB3056 /* pcre_compile.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = pcre_compile.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		930754CE08B0F74500AB3056 /* pcre_tables.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = pcre_tables.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		930754E908B0F78500AB3056 /* pcre_exec.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = pcre_exec.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		930DAD030FB1EB1A0082D205 /* NodeConstructors.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeConstructors.h; sourceTree = "<group>"; };
 		9322A00306C341D3009067BB /* libicucore.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libicucore.dylib; path = /usr/lib/libicucore.dylib; sourceTree = "<absolute>"; };
 		932F5BD80822A1C700736975 /* Info.plist */ = {isa = PBXFileReference; indentWidth = 4; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; tabWidth = 8; usesTabs = 1; };
 		932F5BD90822A1C700736975 /* JavaScriptCore.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = JavaScriptCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -650,14 +694,11 @@
 		95AB83540DA43B4400BC83F3 /* ProfileNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfileNode.cpp; path = profiler/ProfileNode.cpp; sourceTree = "<group>"; };
 		95AB83550DA43B4400BC83F3 /* ProfileNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfileNode.h; path = profiler/ProfileNode.h; sourceTree = "<group>"; };
 		95C18D3E0C90E7EF00E72F73 /* JSRetainPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSRetainPtr.h; sourceTree = "<group>"; };
-		95CD41B10E1BF6560085358E /* TreeProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = TreeProfile.cpp; path = profiler/TreeProfile.cpp; sourceTree = "<group>"; };
-		95CD41B20E1BF6560085358E /* TreeProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TreeProfile.h; path = profiler/TreeProfile.h; sourceTree = "<group>"; };
 		95CD45740E1C4FDD0085358E /* ProfileGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfileGenerator.cpp; path = profiler/ProfileGenerator.cpp; sourceTree = "<group>"; };
 		95CD45750E1C4FDD0085358E /* ProfileGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfileGenerator.h; path = profiler/ProfileGenerator.h; sourceTree = "<group>"; };
 		95E3BC040E1AE68200B2D1C1 /* CallIdentifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CallIdentifier.h; path = profiler/CallIdentifier.h; sourceTree = "<group>"; };
-		95FDFA130E22998F0006FB00 /* HeavyProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = HeavyProfile.cpp; path = profiler/HeavyProfile.cpp; sourceTree = "<group>"; };
-		95FDFA150E2299980006FB00 /* HeavyProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HeavyProfile.h; path = profiler/HeavyProfile.h; sourceTree = "<group>"; };
 		960097A50EBABB58007A7297 /* LabelScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LabelScope.h; sourceTree = "<group>"; };
+		960626950FB8EC02009798AB /* JITStubCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITStubCall.h; sourceTree = "<group>"; };
 		9688CB130ED12B4E001D649F /* AssemblerBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AssemblerBuffer.h; sourceTree = "<group>"; };
 		9688CB140ED12B4E001D649F /* X86Assembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = X86Assembler.h; sourceTree = "<group>"; };
 		969A07200ED1CE3300F1F681 /* BytecodeGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BytecodeGenerator.cpp; sourceTree = "<group>"; };
@@ -673,11 +714,13 @@
 		969A07950ED1D3AE00F1F681 /* Opcode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Opcode.h; sourceTree = "<group>"; };
 		969A09220ED1E09C00F1F681 /* Completion.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Completion.cpp; sourceTree = "<group>"; };
 		96A7463F0EDDF70600904779 /* Escapes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Escapes.h; sourceTree = "<group>"; };
+		96DD73780F9DA3100027FBCC /* VMTags.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VMTags.h; sourceTree = "<group>"; };
 		A72700770DAC605600E548D7 /* JSNotAnObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNotAnObject.h; sourceTree = "<group>"; };
 		A72700780DAC605600E548D7 /* JSNotAnObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotAnObject.cpp; sourceTree = "<group>"; };
 		A72701B30DADE94900E548D7 /* ExceptionHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionHelpers.h; sourceTree = "<group>"; };
 		A727FF650DA3053B00E548D7 /* JSPropertyNameIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPropertyNameIterator.h; sourceTree = "<group>"; };
 		A727FF660DA3053B00E548D7 /* JSPropertyNameIterator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPropertyNameIterator.cpp; sourceTree = "<group>"; };
+		A76EE6580FAE59D5003F069A /* NativeFunctionWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NativeFunctionWrapper.h; sourceTree = "<group>"; };
 		A782F1A40EEC9FA20036273F /* ExecutableAllocatorPosix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocatorPosix.cpp; sourceTree = "<group>"; };
 		A791EF260F11E07900AE1F68 /* JSByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSByteArray.h; sourceTree = "<group>"; };
 		A791EF270F11E07900AE1F68 /* JSByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSByteArray.cpp; sourceTree = "<group>"; };
@@ -685,8 +728,12 @@
 		A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByteArray.h; sourceTree = "<group>"; };
 		A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutableAllocator.h; sourceTree = "<group>"; };
 		A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocator.cpp; sourceTree = "<group>"; };
+		A7E2EA690FB460CF00601F06 /* LiteralParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LiteralParser.h; sourceTree = "<group>"; };
+		A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LiteralParser.cpp; sourceTree = "<group>"; };
 		A7E42C180E3938830065A544 /* JSStaticScopeObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStaticScopeObject.h; sourceTree = "<group>"; };
 		A7E42C190E3938830065A544 /* JSStaticScopeObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStaticScopeObject.cpp; sourceTree = "<group>"; };
+		A7F8690E0F9584A100558697 /* CachedCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedCall.h; sourceTree = "<group>"; };
+		A7F869EC0F95C2EC00558697 /* CallFrameClosure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallFrameClosure.h; sourceTree = "<group>"; };
 		A8E894310CD0602400367179 /* JSCallbackObjectFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackObjectFunctions.h; sourceTree = "<group>"; };
 		A8E894330CD0603F00367179 /* JSGlobalObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObject.h; sourceTree = "<group>"; };
 		BC02E9040E1839DB000F9297 /* ErrorConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ErrorConstructor.cpp; sourceTree = "<group>"; };
@@ -773,6 +820,7 @@
 		BCD203470E17135E002C7E82 /* DatePrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatePrototype.cpp; sourceTree = "<group>"; };
 		BCD203480E17135E002C7E82 /* DatePrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatePrototype.h; sourceTree = "<group>"; };
 		BCD203E70E1718F4002C7E82 /* DatePrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatePrototype.lut.h; sourceTree = "<group>"; };
+		BCDD51E90FB8DF74004A8BDC /* JITOpcodes.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITOpcodes.cpp; sourceTree = "<group>"; };
 		BCDE3AB00E6C82CF001453A7 /* Structure.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Structure.cpp; sourceTree = "<group>"; };
 		BCDE3AB10E6C82CF001453A7 /* Structure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Structure.h; sourceTree = "<group>"; };
 		BCF605110E203EF800B9A64D /* ArgList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArgList.cpp; sourceTree = "<group>"; };
@@ -781,8 +829,8 @@
 		BCFD8C900EEB2EE700283848 /* JumpTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JumpTable.cpp; sourceTree = "<group>"; };
 		BCFD8C910EEB2EE700283848 /* JumpTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JumpTable.h; sourceTree = "<group>"; };
 		C0A2723F0E509F1E00E96E15 /* NotFound.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NotFound.h; sourceTree = "<group>"; };
-		D21202280AD4310C00ED79B6 /* DateMath.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = DateMath.cpp; sourceTree = "<group>"; };
-		D21202290AD4310C00ED79B6 /* DateMath.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DateMath.h; sourceTree = "<group>"; };
+		D21202280AD4310C00ED79B6 /* DateConversion.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = DateConversion.cpp; sourceTree = "<group>"; };
+		D21202290AD4310C00ED79B6 /* DateConversion.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DateConversion.h; sourceTree = "<group>"; };
 		E11D51750B2E798D0056C188 /* StringExtras.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringExtras.h; sourceTree = "<group>"; };
 		E124A8F50E555775003091F1 /* OpaqueJSString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OpaqueJSString.h; sourceTree = "<group>"; };
 		E124A8F60E555775003091F1 /* OpaqueJSString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OpaqueJSString.cpp; sourceTree = "<group>"; };
@@ -803,6 +851,7 @@
 		E1EE798B0D6CA53D00FEA3BA /* MessageQueue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MessageQueue.h; sourceTree = "<group>"; };
 		E1EF79A80CE97BA60088D500 /* UTF8.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UTF8.cpp; sourceTree = "<group>"; };
 		E1EF79A90CE97BA60088D500 /* UTF8.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UTF8.h; sourceTree = "<group>"; };
+		E48E0F2C0F82151700A8CA37 /* FastAllocBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FastAllocBase.h; sourceTree = "<group>"; };
 		F5BB2BC5030F772101FCFE1D /* Completion.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Completion.h; sourceTree = "<group>"; tabWidth = 8; };
 		F5C290E60284F98E018635CA /* JavaScriptCorePrefix.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = JavaScriptCorePrefix.h; sourceTree = "<group>"; tabWidth = 8; };
 		F68EBB8C0255D4C601FF60F7 /* config.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = config.h; sourceTree = "<group>"; tabWidth = 8; };
@@ -865,7 +914,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				932F5BD30822A1C700736975 /* CoreFoundation.framework in Frameworks */,
-				932F5BD40822A1C700736975 /* CoreServices.framework in Frameworks */,
 				932F5BD50822A1C700736975 /* Foundation.framework in Frameworks */,
 				932F5BD70822A1C700736975 /* libicucore.dylib in Frameworks */,
 				932F5BD60822A1C700736975 /* libobjc.dylib in Frameworks */,
@@ -929,6 +977,7 @@
 				141211000A48772600480255 /* tests */,
 				869083120E6518D7000D36ED /* wrec */,
 				65162EF108E6A21C007556CD /* wtf */,
+				86EAC48C0F93E8B9008EC948 /* yarr */,
 				1C90513E0BA9E8830081E9D0 /* Configurations */,
 				650FDF8D09D0FCA700769E54 /* Derived Sources */,
 				0867D69AFE84028FC02AAC07 /* Frameworks */,
@@ -942,7 +991,6 @@
 			isa = PBXGroup;
 			children = (
 				6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */,
-				6560A63D04B3B69F008AE952 /* CoreServices.framework */,
 				51F0EB6105C86C6B00E6DF1B /* Foundation.framework */,
 				5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */,
 				9322A00306C341D3009067BB /* libicucore.dylib */,
@@ -968,8 +1016,10 @@
 		1429D77A0ED20D7300B89619 /* interpreter */ = {
 			isa = PBXGroup;
 			children = (
+				A7F8690E0F9584A100558697 /* CachedCall.h */,
 				1429D8DB0ED2205B00B89619 /* CallFrame.cpp */,
 				1429D8DC0ED2205B00B89619 /* CallFrame.h */,
+				A7F869EC0F95C2EC00558697 /* CallFrameClosure.h */,
 				1429D7D30ED2128200B89619 /* Interpreter.cpp */,
 				1429D77B0ED20D7300B89619 /* Interpreter.h */,
 				149B24FF0D8AF6D1009CB8C7 /* Register.h */,
@@ -982,18 +1032,22 @@
 		1429D92C0ED22D7000B89619 /* jit */ = {
 			isa = PBXGroup;
 			children = (
-				14A6581A0F4E36F4000150FD /* JITStubs.h */,
-				14A23D6C0F4E19CE0023CDAD /* JITStubs.cpp */,
-				86CCEFDD0F413F8900FD7F9E /* JITCode.h */,
 				A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */,
 				A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */,
+				86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */,
 				A782F1A40EEC9FA20036273F /* ExecutableAllocatorPosix.cpp */,
+				86DB645F0F954E9100D7D921 /* ExecutableAllocatorWin.cpp */,
 				1429D92D0ED22D7000B89619 /* JIT.cpp */,
+				BCDD51E90FB8DF74004A8BDC /* JITOpcodes.cpp */,
 				1429D92E0ED22D7000B89619 /* JIT.h */,
 				86A90ECF0EE7D51F00AB350D /* JITArithmetic.cpp */,
 				86CC85A20EE79B7400288682 /* JITCall.cpp */,
+				86CCEFDD0F413F8900FD7F9E /* JITCode.h */,
 				86CC85A00EE79A4700288682 /* JITInlineMethods.h */,
 				86CC85C30EE7A89400288682 /* JITPropertyAccess.cpp */,
+				960626950FB8EC02009798AB /* JITStubCall.h */,
+				14A23D6C0F4E19CE0023CDAD /* JITStubs.cpp */,
+				14A6581A0F4E36F4000150FD /* JITStubs.h */,
 			);
 			path = jit;
 			sourceTree = "<group>";
@@ -1074,6 +1128,7 @@
 			children = (
 				1C9051450BA9E8A70081E9D0 /* Base.xcconfig */,
 				1C9051440BA9E8A70081E9D0 /* DebugRelease.xcconfig */,
+				449097EE0F8F81B50076A327 /* FeatureDefines.xcconfig */,
 				1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */,
 				1C9051420BA9E8A70081E9D0 /* Version.xcconfig */,
 			);
@@ -1107,20 +1162,23 @@
 		65162EF108E6A21C007556CD /* wtf */ = {
 			isa = PBXGroup;
 			children = (
-				0B330C260F38C62300692DE3 /* TypeTraits.cpp */,
-				06D358A00DAAD9C4003B174E /* mac */,
-				E195678D09E7CF1200B89D13 /* unicode */,
-				938C4F690CA06BC700D9310A /* ASCIICType.h */,
-				E1A596370DE3E1C300C17E37 /* AVLTree.h */,
 				93AA4F770957251F0084B3A7 /* AlwaysInline.h */,
+				938C4F690CA06BC700D9310A /* ASCIICType.h */,
 				65E217B808E7EECC0023E5F6 /* Assertions.cpp */,
 				65E217B708E7EECC0023E5F6 /* Assertions.h */,
+				E1A596370DE3E1C300C17E37 /* AVLTree.h */,
 				A7A1F7AA0F252B3C00E184E2 /* ByteArray.cpp */,
 				A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */,
+				0BDFFAD40FC6171000D69EF4 /* CrossThreadRefCounted.h */,
 				180B9AEF0F16C569009BDBC5 /* CurrentTime.cpp */,
 				180B9AF00F16C569009BDBC5 /* CurrentTime.h */,
+				41359CF40FDD89CB00206180 /* DateMath.cpp */,
+				41359CF50FDD89CB00206180 /* DateMath.h */,
 				5186111D0CC824830081412B /* Deque.h */,
 				938C4F6B0CA06BCE00D9310A /* DisallowCType.h */,
+				651F6412039D5B5F0078395C /* dtoa.cpp */,
+				651F6413039D5B5F0078395C /* dtoa.h */,
+				E48E0F2C0F82151700A8CA37 /* FastAllocBase.h */,
 				65E217B908E7EECC0023E5F6 /* FastMalloc.cpp */,
 				65E217BA08E7EECC0023E5F6 /* FastMalloc.h */,
 				935AF46909E9D9DB00ACD1D8 /* Forward.h */,
@@ -1136,6 +1194,7 @@
 				657EB7450B708F540063461B /* ListHashSet.h */,
 				148A1626095D16BB00666D0D /* ListRefPtr.h */,
 				E1EE79270D6C964500FEA3BA /* Locker.h */,
+				06D358A00DAAD9C4003B174E /* mac */,
 				06D358A20DAAD9C4003B174E /* MainThread.cpp */,
 				06D358A30DAAD9C4003B174E /* MainThread.h */,
 				5DBD18AF0C5401A700C15EAE /* MallocZoneSupport.h */,
@@ -1144,7 +1203,10 @@
 				9303F5690991190000AD71B8 /* Noncopyable.h */,
 				C0A2723F0E509F1E00E96E15 /* NotFound.h */,
 				9303F5A409911A5800AD71B8 /* OwnArrayPtr.h */,
+				0BDFFAD10FC616EC00D69EF4 /* OwnFastMallocPtr.h */,
 				9303F567099118FA00AD71B8 /* OwnPtr.h */,
+				440B7AED0FAF7FCB0073323E /* OwnPtrCommon.h */,
+				44DD48520FAEA85000D6B4EB /* PassOwnPtr.h */,
 				6580F795094070560082C219 /* PassRefPtr.h */,
 				65D6D87E09B5A32E0002E4D7 /* Platform.h */,
 				0B1F921B0F17502D0036468E /* PtrAndFlags.h */,
@@ -1164,16 +1226,17 @@
 				6541BD6F08E80A17002CBEE7 /* TCSpinLock.h */,
 				6541BD7008E80A17002CBEE7 /* TCSystemAlloc.cpp */,
 				6541BD7108E80A17002CBEE7 /* TCSystemAlloc.h */,
-				E1B7C8BD0DA3A3360074B0DC /* ThreadSpecific.h */,
 				5D6A566A0F05995500266145 /* Threading.cpp */,
 				E1EE79220D6C95CD00FEA3BA /* Threading.h */,
 				E1EE793C0D6C9B9200FEA3BA /* ThreadingPthreads.cpp */,
+				E1B7C8BD0DA3A3360074B0DC /* ThreadSpecific.h */,
+				0B330C260F38C62300692DE3 /* TypeTraits.cpp */,
 				0B4D7E620F319AC800AD7E58 /* TypeTraits.h */,
+				E195678D09E7CF1200B89D13 /* unicode */,
 				935AF46B09E9D9DB00ACD1D8 /* UnusedParam.h */,
 				6592C316098B7DE10003D4F6 /* Vector.h */,
 				6592C317098B7DE10003D4F6 /* VectorTraits.h */,
-				651F6412039D5B5F0078395C /* dtoa.cpp */,
-				651F6413039D5B5F0078395C /* dtoa.h */,
+				96DD73780F9DA3100027FBCC /* VMTags.h */,
 			);
 			path = wtf;
 			sourceTree = "<group>";
@@ -1217,11 +1280,14 @@
 				93F1981A08245AAE001E9ABC /* Keywords.table */,
 				F692A8650255597D01FF60F7 /* Lexer.cpp */,
 				F692A8660255597D01FF60F7 /* Lexer.h */,
+				930DAD030FB1EB1A0082D205 /* NodeConstructors.h */,
 				7EFF00630EC05A9A00AA7C93 /* NodeInfo.h */,
 				F692A86D0255597D01FF60F7 /* Nodes.cpp */,
 				F692A86E0255597D01FF60F7 /* Nodes.h */,
 				93F0B3A909BB4DC00068FCE3 /* Parser.cpp */,
 				93F0B3AA09BB4DC00068FCE3 /* Parser.h */,
+				93052C320FB792190048FDC3 /* ParserArena.cpp */,
+				93052C330FB792190048FDC3 /* ParserArena.h */,
 				869EBCB60E8C6D4A008722CC /* ResultType.h */,
 				65E866EE0DD59AFA00A2B2A1 /* SourceCode.h */,
 				65E866ED0DD59AFA00A2B2A1 /* SourceProvider.h */,
@@ -1263,8 +1329,8 @@
 				BCD203460E17135E002C7E82 /* DateConstructor.h */,
 				BC1166000E1997B1008066DD /* DateInstance.cpp */,
 				BC1166010E1997B1008066DD /* DateInstance.h */,
-				D21202280AD4310C00ED79B6 /* DateMath.cpp */,
-				D21202290AD4310C00ED79B6 /* DateMath.h */,
+				D21202280AD4310C00ED79B6 /* DateConversion.cpp */,
+				D21202290AD4310C00ED79B6 /* DateConversion.h */,
 				BCD203470E17135E002C7E82 /* DatePrototype.cpp */,
 				BCD203480E17135E002C7E82 /* DatePrototype.h */,
 				BC337BEA0E1B00CB0076918A /* Error.cpp */,
@@ -1330,6 +1396,8 @@
 				14F252560D08DD8D004ECFFF /* JSVariableObject.h */,
 				65C7A1710A8EAACB00FA37EA /* JSWrapperObject.cpp */,
 				65C7A1720A8EAACB00FA37EA /* JSWrapperObject.h */,
+				A7E2EA690FB460CF00601F06 /* LiteralParser.h */,
+				A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */,
 				F692A8680255597D01FF60F7 /* Lookup.cpp */,
 				F692A8690255597D01FF60F7 /* Lookup.h */,
 				F692A86A0255597D01FF60F7 /* MathObject.cpp */,
@@ -1338,6 +1406,7 @@
 				BC02E9090E1839DB000F9297 /* NativeErrorConstructor.h */,
 				BC02E90A0E1839DB000F9297 /* NativeErrorPrototype.cpp */,
 				BC02E90B0E1839DB000F9297 /* NativeErrorPrototype.h */,
+				A76EE6580FAE59D5003F069A /* NativeFunctionWrapper.h */,
 				BC2680C20E16D4E900A06E92 /* NumberConstructor.cpp */,
 				BC2680C30E16D4E900A06E92 /* NumberConstructor.h */,
 				F692A8700255597D01FF60F7 /* NumberObject.cpp */,
@@ -1418,6 +1487,21 @@
 			path = wrec;
 			sourceTree = "<group>";
 		};
+		86EAC48C0F93E8B9008EC948 /* yarr */ = {
+			isa = PBXGroup;
+			children = (
+				86EAC48D0F93E8D1008EC948 /* RegexCompiler.cpp */,
+				86EAC48E0F93E8D1008EC948 /* RegexCompiler.h */,
+				86EAC48F0F93E8D1008EC948 /* RegexInterpreter.cpp */,
+				86EAC4900F93E8D1008EC948 /* RegexInterpreter.h */,
+				86EAC4910F93E8D1008EC948 /* RegexJIT.cpp */,
+				86EAC4920F93E8D1008EC948 /* RegexJIT.h */,
+				86EAC4930F93E8D1008EC948 /* RegexParser.h */,
+				86EAC4940F93E8D1008EC948 /* RegexPattern.h */,
+			);
+			name = yarr;
+			sourceTree = "<group>";
+		};
 		932FC3C20824BB70005B3C75 /* Resources */ = {
 			isa = PBXGroup;
 			children = (
@@ -1432,8 +1516,6 @@
 			isa = PBXGroup;
 			children = (
 				95E3BC040E1AE68200B2D1C1 /* CallIdentifier.h */,
-				95FDFA130E22998F0006FB00 /* HeavyProfile.cpp */,
-				95FDFA150E2299980006FB00 /* HeavyProfile.h */,
 				95742F630DD11F5A000917FB /* Profile.cpp */,
 				95742F640DD11F5A000917FB /* Profile.h */,
 				95CD45740E1C4FDD0085358E /* ProfileGenerator.cpp */,
@@ -1444,8 +1526,6 @@
 				95AB832F0DA42CAD00BC83F3 /* Profiler.h */,
 				1C61516B0EBAC7A00031376F /* ProfilerServer.h */,
 				1C61516A0EBAC7A00031376F /* ProfilerServer.mm */,
-				95CD41B10E1BF6560085358E /* TreeProfile.cpp */,
-				95CD41B20E1BF6560085358E /* TreeProfile.h */,
 			);
 			name = profiler;
 			sourceTree = "<group>";
@@ -1455,10 +1535,13 @@
 			isa = PBXGroup;
 			children = (
 				860161DF0F3A83C100F84710 /* AbstractMacroAssembler.h */,
+				86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */,
+				9688CB130ED12B4E001D649F /* AssemblerBuffer.h */,
+				863B23DF0FC60E6200703AA4 /* MacroAssemblerCodeRef.h */,
+				86ADD1440FDDEA980006EEC2 /* MacroAssemblerARMv7.h */,
 				860161E00F3A83C100F84710 /* MacroAssemblerX86.h */,
 				860161E10F3A83C100F84710 /* MacroAssemblerX86_64.h */,
 				860161E20F3A83C100F84710 /* MacroAssemblerX86Common.h */,
-				9688CB130ED12B4E001D649F /* AssemblerBuffer.h */,
 				86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */,
 				9688CB140ED12B4E001D649F /* X86Assembler.h */,
 			);
@@ -1555,8 +1638,9 @@
 				BC18C3F60E16F5CD00B34460 /* ConstructData.h in Headers */,
 				180B9B080F16D94F009BDBC5 /* CurrentTime.h in Headers */,
 				BCD2034A0E17135E002C7E82 /* DateConstructor.h in Headers */,
+				41359CF30FDD89AD00206180 /* DateConversion.h in Headers */,
 				BC1166020E1997B4008066DD /* DateInstance.h in Headers */,
-				BC18C3F90E16F5CD00B34460 /* DateMath.h in Headers */,
+				41359CF70FDD89CB00206180 /* DateMath.h in Headers */,
 				BCD2034C0E17135E002C7E82 /* DatePrototype.h in Headers */,
 				BCD203E80E1718F4002C7E82 /* DatePrototype.lut.h in Headers */,
 				BC18C3FA0E16F5CD00B34460 /* Debugger.h in Headers */,
@@ -1584,7 +1668,6 @@
 				BC18C40C0E16F5CD00B34460 /* HashSet.h in Headers */,
 				BC18C40D0E16F5CD00B34460 /* HashTable.h in Headers */,
 				BC18C40E0E16F5CD00B34460 /* HashTraits.h in Headers */,
-				95FDFA160E2299980006FB00 /* HeavyProfile.h in Headers */,
 				BC18C40F0E16F5CD00B34460 /* Identifier.h in Headers */,
 				BC18C4100E16F5CD00B34460 /* InitializeThreading.h in Headers */,
 				969A07990ED1D3AE00F1F681 /* Instruction.h in Headers */,
@@ -1658,7 +1741,9 @@
 				BC18C4480E16F5CD00B34460 /* Operations.h in Headers */,
 				BC18C4490E16F5CD00B34460 /* OwnArrayPtr.h in Headers */,
 				BC18C44A0E16F5CD00B34460 /* OwnPtr.h in Headers */,
+				4409D8470FAF80A200523B87 /* OwnPtrCommon.h in Headers */,
 				BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */,
+				44DD48530FAEA85000D6B4EB /* PassOwnPtr.h in Headers */,
 				BC18C44C0E16F5CD00B34460 /* PassRefPtr.h in Headers */,
 				BC18C44F0E16F5CD00B34460 /* Platform.h in Headers */,
 				BC18C4500E16F5CD00B34460 /* Profile.h in Headers */,
@@ -1716,7 +1801,6 @@
 				BC18C4710E16F5CD00B34460 /* ThreadSpecific.h in Headers */,
 				BC18C4700E16F5CD00B34460 /* Threading.h in Headers */,
 				5D53726F0E1C54880021E549 /* Tracing.h in Headers */,
-				95CD41B40E1BF6560085358E /* TreeProfile.h in Headers */,
 				6507D29E0E871E5E00D7D896 /* TypeInfo.h in Headers */,
 				0B4D7E630F319AC800AD7E58 /* TypeTraits.h in Headers */,
 				BC18C4760E16F5CD00B34460 /* UString.h in Headers */,
@@ -1743,11 +1827,27 @@
 				A7A1F7AD0F252B3C00E184E2 /* ByteArray.h in Headers */,
 				BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */,
 				860161E30F3A83C100F84710 /* AbstractMacroAssembler.h in Headers */,
+				863B23E00FC6118900703AA4 /* MacroAssemblerCodeRef.h in Headers */,
 				860161E40F3A83C100F84710 /* MacroAssemblerX86.h in Headers */,
 				860161E50F3A83C100F84710 /* MacroAssemblerX86_64.h in Headers */,
 				860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */,
 				86CCEFDE0F413F8900FD7F9E /* JITCode.h in Headers */,
 				14A42E400F4F60EE00599099 /* TimeoutChecker.h in Headers */,
+				E48E0F2D0F82151700A8CA37 /* FastAllocBase.h in Headers */,
+				86EAC4960F93E8D1008EC948 /* RegexCompiler.h in Headers */,
+				86EAC4980F93E8D1008EC948 /* RegexInterpreter.h in Headers */,
+				86EAC49A0F93E8D1008EC948 /* RegexJIT.h in Headers */,
+				86EAC49B0F93E8D1008EC948 /* RegexParser.h in Headers */,
+				86EAC49C0F93E8D1008EC948 /* RegexPattern.h in Headers */,
+				96DD73790F9DA3100027FBCC /* VMTags.h in Headers */,
+				A76EE6590FAE59D5003F069A /* NativeFunctionWrapper.h in Headers */,
+				A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */,
+				93052C350FB792190048FDC3 /* ParserArena.h in Headers */,
+				960626960FB8EC02009798AB /* JITStubCall.h in Headers */,
+				0BDFFAE00FC6192900D69EF4 /* CrossThreadRefCounted.h in Headers */,
+				0BDFFAE10FC6193100D69EF4 /* OwnFastMallocPtr.h in Headers */,
+				86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */,
+				86ADD1460FDDEA980006EEC2 /* MacroAssemblerARMv7.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1974,7 +2074,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"\n\nln -sfh \"${SRCROOT}\" JavaScriptCore\nexport JavaScriptCore=\"JavaScriptCore\"\nexport BUILT_PRODUCTS_DIR=\"../..\"\n\nmake -f \"JavaScriptCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.ncpu`\n";
+			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" JavaScriptCore\nexport JavaScriptCore=\"JavaScriptCore\"\nexport BUILT_PRODUCTS_DIR=\"../..\"\n\nmake -f \"JavaScriptCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.ncpu`\n";
 		};
 		9319586B09D9F91A00A56FD4 /* Check For Global Initializers */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -2040,12 +2140,12 @@
 				E1A862D60D7F2B5C001EC6AA /* CollatorDefault.cpp in Sources */,
 				E1A862A90D7EBB76001EC6AA /* CollatorICU.cpp in Sources */,
 				180B9BFE0F16E94D009BDBC5 /* CurrentTime.cpp in Sources */,
+				41359CF60FDD89CB00206180 /* DateMath.cpp in Sources */,
 				149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */,
 				1429D8780ED21ACD00B89619 /* ExceptionHelpers.cpp in Sources */,
 				A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */,
 				A782F1A50EEC9FA20036273F /* ExecutableAllocatorPosix.cpp in Sources */,
 				65DFC93308EA173A00F7300B /* HashTable.cpp in Sources */,
-				95FDFA140E22998F0006FB00 /* HeavyProfile.cpp in Sources */,
 				E178636D0D9BEEC300D74E75 /* InitializeThreading.cpp in Sources */,
 				1429D7D40ED2128200B89619 /* Interpreter.cpp in Sources */,
 				1429D92F0ED22D7000B89619 /* JIT.cpp in Sources */,
@@ -2088,7 +2188,6 @@
 				BCCF0D0C0EF0B8A500413C8F /* StructureStubInfo.cpp in Sources */,
 				5D6A566B0F05995500266145 /* Threading.cpp in Sources */,
 				E1EE793D0D6C9B9200FEA3BA /* ThreadingPthreads.cpp in Sources */,
-				95CD41B30E1BF6560085358E /* TreeProfile.cpp in Sources */,
 				E1EF79AA0CE97BA60088D500 /* UTF8.cpp in Sources */,
 				869083150E6518D7000D36ED /* WREC.cpp in Sources */,
 				1429DA820ED2482900B89619 /* WRECFunctors.cpp in Sources */,
@@ -2103,6 +2202,13 @@
 				BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */,
 				0B330C270F38C62300692DE3 /* TypeTraits.cpp in Sources */,
 				14A42E3F0F4F60EE00599099 /* TimeoutChecker.cpp in Sources */,
+				86EAC4950F93E8D1008EC948 /* RegexCompiler.cpp in Sources */,
+				86EAC4970F93E8D1008EC948 /* RegexInterpreter.cpp in Sources */,
+				86EAC4990F93E8D1008EC948 /* RegexJIT.cpp in Sources */,
+				86DB64640F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp in Sources */,
+				A7E2EA6C0FB460CF00601F06 /* LiteralParser.cpp in Sources */,
+				93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */,
+				BCDD51EB0FB8DF74004A8BDC /* JITOpcodes.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2205,12 +2311,6 @@
 					normal,
 					debug,
 				);
-				SECTORDER_FLAGS = (
-					"-sectorder",
-					__TEXT,
-					__text,
-					JavaScriptCore.order,
-				);
 			};
 			name = Production;
 		};
diff --git a/JavaScriptCore/JavaScriptCoreSources.bkl b/JavaScriptCore/JavaScriptCoreSources.bkl
index b3a461b..2146c09 100644
--- a/JavaScriptCore/JavaScriptCoreSources.bkl
+++ b/JavaScriptCore/JavaScriptCoreSources.bkl
@@ -64,6 +64,7 @@
         parser/Lexer.cpp
         parser/Nodes.cpp
         parser/Parser.cpp
+        parser/ParserArena.cpp
     </set>
     <set append="1" var="JSCORE_PROFILER_SOURCES">
         profiler/HeavyProfile.cpp
@@ -86,8 +87,8 @@
         runtime/CommonIdentifiers.cpp
         runtime/ConstructData.cpp
         runtime/DateConstructor.cpp
+        runtime/DateConversion.cpp
         runtime/DateInstance.cpp
-        runtime/DateMath.cpp
         runtime/DatePrototype.cpp
         runtime/Error.cpp
         runtime/ErrorConstructor.cpp
@@ -121,6 +122,7 @@
         runtime/JSValue.cpp
         runtime/JSVariableObject.cpp
         runtime/JSWrapperObject.cpp
+        runtime/LiteralParser.cpp
         runtime/Lookup.cpp
         runtime/MathObject.cpp
         runtime/NativeErrorConstructor.cpp
@@ -157,11 +159,19 @@
         bytecode/Opcode.cpp
         bytecode/SamplingTool.cpp
         interpreter/RegisterFile.cpp
+        jit/ExecutableAllocator.cpp
+    </set>
+    <set append="1" var="JSCORE_VM_SOURCES_WIN">
+       jit/ExecutableAllocatorWin.cpp
+    </set>
+   <set append="1" var="JSCORE_VM_SOURCES_POSIX">
+       jit/ExecutableAllocatorPosix.cpp
     </set>
     <set append="1" var="JSCORE_WTF_SOURCES">
         wtf/Assertions.cpp
         wtf/ByteArray.cpp
         wtf/CurrentTime.cpp
+        wtf/DateMath.cpp
         wtf/FastMalloc.cpp
         wtf/HashTable.cpp
         wtf/MainThread.cpp
diff --git a/JavaScriptCore/assembler/ARMv7Assembler.h b/JavaScriptCore/assembler/ARMv7Assembler.h
new file mode 100644
index 0000000..c9cb87e
--- /dev/null
+++ b/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -0,0 +1,1758 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ARMAssembler_h
+#define ARMAssembler_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM_V7)
+
+#include "AssemblerBuffer.h"
+#include <wtf/Assertions.h>
+#include <wtf/Vector.h>
+#include <stdint.h>
+
+namespace JSC {
+
+namespace ARM {
+    typedef enum {
+        r0,
+        r1,
+        r2,
+        r3,
+        r4,
+        r5,
+        r6,
+        r7, wr = r7,   // thumb work register
+        r8,
+        r9, sb = r9,   // static base
+        r10, sl = r10, // stack limit
+        r11, fp = r11, // frame pointer
+        r12, ip = r12,
+        r13, sp = r13,
+        r14, lr = r14,
+        r15, pc = r15,
+    } RegisterID;
+
+    // s0 == d0 == q0
+    // s4 == d2 == q1
+    // etc
+    typedef enum {
+        s0 = 0,
+        s1 = 1,
+        s2 = 2,
+        s3 = 3,
+        s4 = 4,
+        s5 = 5,
+        s6 = 6,
+        s7 = 7,
+        s8 = 8,
+        s9 = 9,
+        s10 = 10,
+        s11 = 11,
+        s12 = 12,
+        s13 = 13,
+        s14 = 14,
+        s15 = 15,
+        s16 = 16,
+        s17 = 17,
+        s18 = 18,
+        s19 = 19,
+        s20 = 20,
+        s21 = 21,
+        s22 = 22,
+        s23 = 23,
+        s24 = 24,
+        s25 = 25,
+        s26 = 26,
+        s27 = 27,
+        s28 = 28,
+        s29 = 29,
+        s30 = 30,
+        s31 = 31,
+        d0 = 0 << 1,
+        d1 = 1 << 1,
+        d2 = 2 << 1,
+        d3 = 3 << 1,
+        d4 = 4 << 1,
+        d5 = 5 << 1,
+        d6 = 6 << 1,
+        d7 = 7 << 1,
+        d8 = 8 << 1,
+        d9 = 9 << 1,
+        d10 = 10 << 1,
+        d11 = 11 << 1,
+        d12 = 12 << 1,
+        d13 = 13 << 1,
+        d14 = 14 << 1,
+        d15 = 15 << 1,
+        d16 = 16 << 1,
+        d17 = 17 << 1,
+        d18 = 18 << 1,
+        d19 = 19 << 1,
+        d20 = 20 << 1,
+        d21 = 21 << 1,
+        d22 = 22 << 1,
+        d23 = 23 << 1,
+        d24 = 24 << 1,
+        d25 = 25 << 1,
+        d26 = 26 << 1,
+        d27 = 27 << 1,
+        d28 = 28 << 1,
+        d29 = 29 << 1,
+        d30 = 30 << 1,
+        d31 = 31 << 1,
+        q0 = 0 << 2,
+        q1 = 1 << 2,
+        q2 = 2 << 2,
+        q3 = 3 << 2,
+        q4 = 4 << 2,
+        q5 = 5 << 2,
+        q6 = 6 << 2,
+        q7 = 7 << 2,
+        q8 = 8 << 2,
+        q9 = 9 << 2,
+        q10 = 10 << 2,
+        q11 = 11 << 2,
+        q12 = 12 << 2,
+        q13 = 13 << 2,
+        q14 = 14 << 2,
+        q15 = 15 << 2,
+        q16 = 16 << 2,
+        q17 = 17 << 2,
+        q18 = 18 << 2,
+        q19 = 19 << 2,
+        q20 = 20 << 2,
+        q21 = 21 << 2,
+        q22 = 22 << 2,
+        q23 = 23 << 2,
+        q24 = 24 << 2,
+        q25 = 25 << 2,
+        q26 = 26 << 2,
+        q27 = 27 << 2,
+        q28 = 28 << 2,
+        q29 = 29 << 2,
+        q30 = 30 << 2,
+        q31 = 31 << 2,
+    } FPRegisterID;
+}
+
+class ARMv7Assembler;
+class ARMThumbImmediate {
+    friend class ARMv7Assembler;
+
+    typedef uint8_t ThumbImmediateType;
+    static const ThumbImmediateType TypeInvalid = 0;
+    static const ThumbImmediateType TypeEncoded = 1;
+    static const ThumbImmediateType TypeUInt16 = 2;
+
+    typedef union {
+        int16_t asInt;
+        struct {
+            unsigned imm8 : 8;
+            unsigned imm3 : 3;
+            unsigned i    : 1;
+            unsigned imm4 : 4;
+        };
+        // If this is an encoded immediate, then it may describe a shift, or a pattern.
+        struct {
+            unsigned shiftValue7 : 7;
+            unsigned shiftAmount : 5;
+        };
+        struct {
+            unsigned immediate   : 8;
+            unsigned pattern     : 4;
+        };
+    } ThumbImmediateValue;
+
+    // byte0 contains least significant bit; not using an array to make client code endian agnostic.
+    typedef union {
+        int32_t asInt;
+        struct {
+            uint8_t byte0;
+            uint8_t byte1;
+            uint8_t byte2;
+            uint8_t byte3;
+        };
+    } PatternBytes;
+
+    ALWAYS_INLINE static int32_t countLeadingZerosPartial(uint32_t& value, int32_t& zeros, const int N)
+    {
+        if (value & ~((1<<N)-1)) /* check for any of the top N bits (of 2N bits) are set */ \
+            value >>= N;         /* if any were set, lose the bottom N */ \
+        else                     /* if none of the top N bits are set, */ \
+            zeros += N;          /* then we have identified N leading zeros */
+    }
+
+    static int32_t countLeadingZeros(uint32_t value)
+    {
+        if (!value)
+            return 32;
+
+        int32_t zeros = 0;
+        countLeadingZerosPartial(value, zeros, 16);
+        countLeadingZerosPartial(value, zeros, 8);
+        countLeadingZerosPartial(value, zeros, 4);
+        countLeadingZerosPartial(value, zeros, 2);
+        countLeadingZerosPartial(value, zeros, 1);
+        return zeros;
+    }
+
+    ARMThumbImmediate()
+        : m_type(TypeInvalid)
+    {
+        m_value.asInt = 0;
+    }
+        
+    ARMThumbImmediate(ThumbImmediateType type, ThumbImmediateValue value)
+        : m_type(type)
+        , m_value(value)
+    {
+    }
+
+    ARMThumbImmediate(ThumbImmediateType type, uint16_t value)
+        : m_type(TypeUInt16)
+    {
+        m_value.asInt = value;
+    }
+
+public:
+    static ARMThumbImmediate makeEncodedImm(uint32_t value)
+    {
+        ThumbImmediateValue encoding;
+        encoding.asInt = 0;
+
+        // okay, these are easy.
+        if (value < 256) {
+            encoding.immediate = value;
+            encoding.pattern = 0;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        int32_t leadingZeros = countLeadingZeros(value);
+        // if there were 24 or more leading zeros, then we'd have hit the (value < 256) case.
+        ASSERT(leadingZeros < 24);
+
+        // Given a number with bit fields Z:B:C, where count(Z)+count(B)+count(C) == 32,
+        // Z are the bits known zero, B is the 8-bit immediate, C are the bits to check for
+        // zero.  count(B) == 8, so the count of bits to be checked is 24 - count(Z).
+        int32_t rightShiftAmount = 24 - leadingZeros;
+        if (value == ((value >> rightShiftAmount) << rightShiftAmount)) {
+            // Shift the value down to the low byte position.  The assign to 
+            // shiftValue7 drops the implicit top bit.
+            encoding.shiftValue7 = value >> rightShiftAmount;
+            // The endoded shift amount is the magnitude of a right rotate.
+            encoding.shiftAmount = 8 + leadingZeros;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+        
+        PatternBytes bytes;
+        bytes.asInt = value;
+
+        if ((bytes.byte0 == bytes.byte1) && (bytes.byte0 == bytes.byte2) && (bytes.byte0 == bytes.byte3)) {
+            encoding.immediate = bytes.byte0;
+            encoding.pattern = 3;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        if ((bytes.byte0 == bytes.byte2) && !(bytes.byte1 | bytes.byte3)) {
+            encoding.immediate = bytes.byte0;
+            encoding.pattern = 1;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        if ((bytes.byte1 == bytes.byte3) && !(bytes.byte0 | bytes.byte2)) {
+            encoding.immediate = bytes.byte0;
+            encoding.pattern = 2;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        return ARMThumbImmediate();
+    }
+
+    static ARMThumbImmediate makeUInt12(int32_t value)
+    {
+        return (!(value & 0xfffff000))
+            ? ARMThumbImmediate(TypeUInt16, (uint16_t)value)
+            : ARMThumbImmediate();
+    }
+
+    static ARMThumbImmediate makeUInt12OrEncodedImm(int32_t value)
+    {
+        // If this is not a 12-bit unsigned it, try making an encoded immediate.
+        return (!(value & 0xfffff000))
+            ? ARMThumbImmediate(TypeUInt16, (uint16_t)value)
+            : makeEncodedImm(value);
+    }
+
+    // The 'make' methods, above, return a !isValid() value if the argument
+    // cannot be represented as the requested type.  This methods  is called
+    // 'get' since the argument can always be represented.
+    static ARMThumbImmediate makeUInt16(uint16_t value)
+    {
+        return ARMThumbImmediate(TypeUInt16, value);
+    }
+    
+    bool isValid()
+    {
+        return m_type != TypeInvalid;
+    }
+
+    // These methods rely on the format of encoded byte values.
+    bool isUInt3() { return !(m_value.asInt & 0xfff8); }
+    bool isUInt4() { return !(m_value.asInt & 0xfff0); }
+    bool isUInt5() { return !(m_value.asInt & 0xffe0); }
+    bool isUInt6() { return !(m_value.asInt & 0xffc0); }
+    bool isUInt7() { return !(m_value.asInt & 0xff80); }
+    bool isUInt8() { return !(m_value.asInt & 0xff00); }
+    bool isUInt9() { return (m_type == TypeUInt16) && !(m_value.asInt & 0xfe00); }
+    bool isUInt10() { return (m_type == TypeUInt16) && !(m_value.asInt & 0xfc00); }
+    bool isUInt12() { return (m_type == TypeUInt16) && !(m_value.asInt & 0xf000); }
+    bool isUInt16() { return m_type == TypeUInt16; }
+    uint8_t getUInt3() { ASSERT(isUInt3()); return m_value.asInt; }
+    uint8_t getUInt4() { ASSERT(isUInt4()); return m_value.asInt; }
+    uint8_t getUInt5() { ASSERT(isUInt5()); return m_value.asInt; }
+    uint8_t getUInt6() { ASSERT(isUInt6()); return m_value.asInt; }
+    uint8_t getUInt7() { ASSERT(isUInt7()); return m_value.asInt; }
+    uint8_t getUInt8() { ASSERT(isUInt8()); return m_value.asInt; }
+    uint8_t getUInt9() { ASSERT(isUInt9()); return m_value.asInt; }
+    uint8_t getUInt10() { ASSERT(isUInt10()); return m_value.asInt; }
+    uint16_t getUInt12() { ASSERT(isUInt12()); return m_value.asInt; }
+    uint16_t getUInt16() { ASSERT(isUInt16()); return m_value.asInt; }
+
+    bool isEncodedImm() { return m_type == TypeEncoded; }
+
+private:
+    ThumbImmediateType m_type;
+    ThumbImmediateValue m_value;
+};
+
+
+typedef enum {
+    SRType_LSL,
+    SRType_LSR,
+    SRType_ASR,
+    SRType_ROR,
+
+    SRType_RRX = SRType_ROR
+} ARMShiftType;
+
+class ARMv7Assembler;
+class ShiftTypeAndAmount {
+    friend class ARMv7Assembler;
+
+public:
+    ShiftTypeAndAmount()
+    {
+        m_u.type = (ARMShiftType)0;
+        m_u.amount = 0;
+    }
+    
+    ShiftTypeAndAmount(ARMShiftType type, unsigned amount)
+    {
+        m_u.type = type;
+        m_u.amount = amount & 31;
+    }
+    
+    unsigned lo4() { return m_u.lo4; }
+    unsigned hi4() { return m_u.hi4; }
+    
+private:
+    union {
+        struct {
+            unsigned lo4 : 4;
+            unsigned hi4 : 4;
+        };
+        struct {
+            unsigned type   : 2;
+            unsigned amount : 5;
+        };
+    } m_u;
+};
+
+
+/*
+Some features of the Thumb instruction set are deprecated in ARMv7. Deprecated features affecting 
+instructions supported by ARMv7-M are as follows: 
+• use of the PC as <Rd> or <Rm> in a 16-bit ADD (SP plus register) instruction 
+• use of the SP as <Rm> in a 16-bit ADD (SP plus register) instruction 
+• use of the SP as <Rm> in a 16-bit CMP (register) instruction 
+• use of MOV (register) instructions in which <Rd> is the SP or PC and <Rm> is also the SP or PC. 
+• use of <Rn> as the lowest-numbered register in the register list of a 16-bit STM instruction with base 
+register writeback 
+*/
+
+class ARMv7Assembler {
+public:
+    typedef ARM::RegisterID RegisterID;
+    typedef ARM::FPRegisterID FPRegisterID;
+
+    // (HS, LO, HI, LS) -> (AE, B, A, BE)
+    // (VS, VC) -> (O, NO)
+    typedef enum {
+        ConditionEQ,
+        ConditionNE,
+        ConditionHS,
+        ConditionLO,
+        ConditionMI,
+        ConditionPL,
+        ConditionVS,
+        ConditionVC,
+        ConditionHI,
+        ConditionLS,
+        ConditionGE,
+        ConditionLT,
+        ConditionGT,
+        ConditionLE,
+        ConditionAL,
+
+        ConditionCS = ConditionHS,
+        ConditionCC = ConditionLO,
+    } Condition;
+
+    class JmpSrc {
+        friend class ARMv7Assembler;
+        friend class ARMInstructionFormatter;
+    public:
+        JmpSrc()
+            : m_offset(-1)
+        {
+        }
+
+    private:
+        JmpSrc(int offset)
+            : m_offset(offset)
+        {
+        }
+
+        int m_offset;
+    };
+    
+    class JmpDst {
+        friend class ARMv7Assembler;
+        friend class ARMInstructionFormatter;
+    public:
+        JmpDst()
+            : m_offset(-1)
+            , m_used(false)
+        {
+        }
+
+        bool isUsed() const { return m_used; }
+        void used() { m_used = true; }
+    private:
+        JmpDst(int offset)
+            : m_offset(offset)
+            , m_used(false)
+        {
+            ASSERT(m_offset == offset);
+        }
+
+        int m_offset : 31;
+        int m_used : 1;
+    };
+
+private:
+
+    // ARMv7, Appx-A.6.3
+    bool BadReg(RegisterID reg)
+    {
+        return (reg == ARM::sp) || (reg == ARM::pc);
+    }
+
+    bool isSingleRegister(FPRegisterID reg)
+    {
+        // Check that the high bit isn't set (q16+), and that the low bit isn't (s1, s3, etc).
+        return !(reg & ~31);
+    }
+
+    bool isDoubleRegister(FPRegisterID reg)
+    {
+        // Check that the high bit isn't set (q16+), and that the low bit isn't (s1, s3, etc).
+        return !(reg & ~(31 << 1));
+    }
+
+    bool isQuadRegister(FPRegisterID reg)
+    {
+        return !(reg & ~(31 << 2));
+    }
+
+    uint32_t singleRegisterNum(FPRegisterID reg)
+    {
+        ASSERT(isSingleRegister(reg));
+        return reg;
+    }
+
+    uint32_t doubleRegisterNum(FPRegisterID reg)
+    {
+        ASSERT(isDoubleRegister(reg));
+        return reg >> 1;
+    }
+
+    uint32_t quadRegisterNum(FPRegisterID reg)
+    {
+        ASSERT(isQuadRegister(reg));
+        return reg >> 2;
+    }
+
+    uint32_t singleRegisterMask(FPRegisterID rd, int highBitsShift, int lowBitShift)
+    {
+        uint32_t rdNum = singleRegisterNum(rd);
+        uint32_t rdMask = (rdNum >> 1) << highBitsShift;
+        if (rdNum & 1)
+            rdMask |= 1 << lowBitShift;
+        return rdMask;
+    }
+
+    uint32_t doubleRegisterMask(FPRegisterID rd, int highBitShift, int lowBitsShift)
+    {
+        uint32_t rdNum = doubleRegisterNum(rd);
+        uint32_t rdMask = (rdNum & 0xf) << lowBitsShift;
+        if (rdNum & 16)
+            rdMask |= 1 << highBitShift;
+        return rdMask;
+    }
+
+    typedef enum {
+        OP_ADD_reg_T1       = 0x1800,
+        OP_ADD_S_reg_T1     = 0x1800,
+        OP_SUB_reg_T1       = 0x1A00,
+        OP_SUB_S_reg_T1     = 0x1A00,
+        OP_ADD_imm_T1       = 0x1C00,
+        OP_ADD_S_imm_T1     = 0x1C00,
+        OP_SUB_imm_T1       = 0x1E00,
+        OP_SUB_S_imm_T1     = 0x1E00,
+        OP_MOV_imm_T1       = 0x2000,
+        OP_CMP_imm_T1       = 0x2800,
+        OP_ADD_imm_T2       = 0x3000,
+        OP_ADD_S_imm_T2     = 0x3000,
+        OP_SUB_imm_T2       = 0x3800,
+        OP_SUB_S_imm_T2     = 0x3800,
+        OP_AND_reg_T1       = 0x4000,
+        OP_EOR_reg_T1       = 0x4040,
+        OP_TST_reg_T1       = 0x4200,
+        OP_CMP_reg_T1       = 0x4280,
+        OP_ORR_reg_T1       = 0x4300,
+        OP_MVN_reg_T1       = 0x43C0,
+        OP_ADD_reg_T2       = 0x4400,
+        OP_MOV_reg_T1       = 0x4600,
+        OP_BLX              = 0x4700,
+        OP_BX               = 0x4700,
+        OP_LDRH_reg_T1      = 0x5A00,
+        OP_STR_reg_T1       = 0x5000,
+        OP_LDR_reg_T1       = 0x5800,
+        OP_STR_imm_T1       = 0x6000,
+        OP_LDR_imm_T1       = 0x6800,
+        OP_LDRH_imm_T1      = 0x8800,
+        OP_STR_imm_T2       = 0x9000,
+        OP_LDR_imm_T2       = 0x9800,
+        OP_ADD_SP_imm_T1    = 0xA800,
+        OP_ADD_SP_imm_T2    = 0xB000,
+        OP_SUB_SP_imm_T1    = 0xB080,
+        OP_BKPT             = 0xBE00,
+        OP_IT               = 0xBF00,
+    } OpcodeID;
+
+    typedef enum {
+        OP_AND_reg_T2   = 0xEA00,
+        OP_TST_reg_T2   = 0xEA10,
+        OP_ORR_reg_T2   = 0xEA40,
+        OP_ASR_imm_T1   = 0xEA4F,
+        OP_LSL_imm_T1   = 0xEA4F,
+        OP_LSR_imm_T1   = 0xEA4F,
+        OP_ROR_imm_T1   = 0xEA4F,
+        OP_MVN_reg_T2   = 0xEA6F,
+        OP_EOR_reg_T2   = 0xEA80,
+        OP_ADD_reg_T3   = 0xEB00,
+        OP_ADD_S_reg_T3 = 0xEB10,
+        OP_SUB_reg_T2   = 0xEBA0,
+        OP_SUB_S_reg_T2 = 0xEBB0,
+        OP_CMP_reg_T2   = 0xEBB0,
+        OP_B_T4a        = 0xF000,
+        OP_AND_imm_T1   = 0xF000,
+        OP_TST_imm      = 0xF010,
+        OP_ORR_imm_T1   = 0xF040,
+        OP_MOV_imm_T2   = 0xF040,
+        OP_MVN_imm      = 0xF060,
+        OP_EOR_imm_T1   = 0xF080,
+        OP_ADD_imm_T3   = 0xF100,
+        OP_ADD_S_imm_T3 = 0xF110,
+        OP_CMN_imm      = 0xF110,
+        OP_SUB_imm_T3   = 0xF1A0,
+        OP_SUB_S_imm_T3 = 0xF1B0,
+        OP_CMP_imm_T2   = 0xF1B0,
+        OP_ADD_imm_T4   = 0xF200,
+        OP_MOV_imm_T3   = 0xF240,
+        OP_SUB_imm_T4   = 0xF2A0,
+        OP_MOVT         = 0xF2C0,
+        OP_LDRH_reg_T2  = 0xF830,
+        OP_LDRH_imm_T3  = 0xF830,
+        OP_STR_imm_T4   = 0xF840,
+        OP_STR_reg_T2   = 0xF840,
+        OP_LDR_imm_T4   = 0xF850,
+        OP_LDR_reg_T2   = 0xF850,
+        OP_LDRH_imm_T2  = 0xF8B0,
+        OP_STR_imm_T3   = 0xF8C0,
+        OP_LDR_imm_T3   = 0xF8D0,
+        OP_LSL_reg_T2   = 0xFA00,
+        OP_LSR_reg_T2   = 0xFA20,
+        OP_ASR_reg_T2   = 0xFA40,
+        OP_ROR_reg_T2   = 0xFA60,
+        OP_SMULL_T1     = 0xFB80,
+    } OpcodeID1;
+
+    typedef enum {
+        OP_B_T4b        = 0x9000,
+    } OpcodeID2;
+
+    struct FourFours {
+        FourFours(unsigned f3, unsigned f2, unsigned f1, unsigned f0)
+        {
+            m_u.f0 = f0;
+            m_u.f1 = f1;
+            m_u.f2 = f2;
+            m_u.f3 = f3;
+        }
+
+        union {
+            unsigned value;
+            struct {
+                unsigned f0 : 4;
+                unsigned f1 : 4;
+                unsigned f2 : 4;
+                unsigned f3 : 4;
+            };
+        } m_u;
+    };
+
+    class ARMInstructionFormatter;
+
+    // false means else!
+    bool ifThenElseConditionBit(Condition condition, bool isIf)
+    {
+        return isIf ? (condition & 1) : !(condition & 1);
+    }
+    uint8_t ifThenElse(Condition condition, bool inst2if, bool inst3if, bool inst4if)
+    {
+        int mask = (ifThenElseConditionBit(condition, inst2if) << 3)
+            | (ifThenElseConditionBit(condition, inst3if) << 2)
+            | (ifThenElseConditionBit(condition, inst4if) << 1)
+            | 1;
+        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
+        return (condition << 4) | mask;
+    }
+    uint8_t ifThenElse(Condition condition, bool inst2if, bool inst3if)
+    {
+        int mask = (ifThenElseConditionBit(condition, inst2if) << 3)
+            | (ifThenElseConditionBit(condition, inst3if) << 2)
+            | 2;
+        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
+        return (condition << 4) | mask;
+    }
+    uint8_t ifThenElse(Condition condition, bool inst2if)
+    {
+        int mask = (ifThenElseConditionBit(condition, inst2if) << 3)
+            | 4;
+        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
+        return (condition << 4) | mask;
+    }
+
+    uint8_t ifThenElse(Condition condition)
+    {
+        int mask = 8;
+        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
+        return (condition << 4) | mask;
+    }
+
+public:
+
+    void add(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isValid());
+
+        if (rn == ARM::sp) {
+            if (!(rd & 8) && imm.isUInt10()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_ADD_SP_imm_T1, rd, imm.getUInt10() >> 2);
+                return;
+            } else if ((rd == ARM::sp) && imm.isUInt9()) {
+                m_formatter.oneWordOp9Imm7(OP_ADD_SP_imm_T2, imm.getUInt9() >> 2);
+                return;
+            }
+        } else if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_ADD_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        if (imm.isEncodedImm())
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ADD_imm_T3, rn, rd, imm);
+        else {
+            ASSERT(imm.isUInt12());
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ADD_imm_T4, rn, rd, imm);
+        }
+    }
+
+    void add(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ADD_reg_T3, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // NOTE: In an IT block, add doesn't modify the flags register.
+    void add(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (rd == rn)
+            m_formatter.oneWordOp8RegReg143(OP_ADD_reg_T2, rm, rd);
+        else if (rd == rm)
+            m_formatter.oneWordOp8RegReg143(OP_ADD_reg_T2, rn, rd);
+        else if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_reg_T1, rm, rn, rd);
+        else
+            add(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    // Not allowed in an IT (if then) block.
+    void add_S(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isEncodedImm());
+
+        if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_S_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_ADD_S_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ADD_S_imm_T3, rn, rd, imm);
+    }
+
+    // Not allowed in an IT (if then) block?
+    void add_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ADD_S_reg_T3, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // Not allowed in an IT (if then) block.
+    void add_S(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_S_reg_T1, rm, rn, rd);
+        else
+            add_S(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    void ARM_and(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_AND_imm_T1, rn, rd, imm);
+    }
+
+    void ARM_and(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_AND_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void ARM_and(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if ((rd == rn) && !((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_AND_reg_T1, rm, rd);
+        else if ((rd == rm) && !((rd | rn) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_AND_reg_T1, rn, rd);
+        else
+            ARM_and(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    void asr(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_ASR, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_ASR_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void asr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ASR_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+
+    // Only allowed in IT (if then) block if last instruction.
+    JmpSrc b()
+    {
+        m_formatter.twoWordOp16Op16(OP_B_T4a, OP_B_T4b);
+        return JmpSrc(m_formatter.size());
+    }
+    
+    // Only allowed in IT (if then) block if last instruction.
+    JmpSrc blx(RegisterID rm)
+    {
+        ASSERT(rm != ARM::pc);
+        m_formatter.oneWordOp8RegReg143(OP_BLX, rm, (RegisterID)8);
+        return JmpSrc(m_formatter.size());
+    }
+
+    // Only allowed in IT (if then) block if last instruction.
+    JmpSrc bx(RegisterID rm)
+    {
+        m_formatter.oneWordOp8RegReg143(OP_BX, rm, (RegisterID)0);
+        return JmpSrc(m_formatter.size());
+    }
+
+    void bkpt(uint8_t imm=0)
+    {
+        m_formatter.oneWordOp8Imm8(OP_BKPT, imm);
+    }
+
+    void cmn(RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isEncodedImm());
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_CMN_imm, rn, (RegisterID)0xf, imm);
+    }
+
+    void cmp(RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isEncodedImm());
+
+        if (!(rn & 8) && imm.isUInt8())
+            m_formatter.oneWordOp5Reg3Imm8(OP_CMP_imm_T1, rn, imm.getUInt8());
+        else
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_CMP_imm_T2, rn, (RegisterID)0xf, imm);
+    }
+
+    void cmp(RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_CMP_reg_T2, rn, FourFours(shift.hi4(), 0xf, shift.lo4(), rm));
+    }
+
+    void cmp(RegisterID rn, RegisterID rm)
+    {
+        if ((rn | rm) & 8)
+            cmp(rn, rm, ShiftTypeAndAmount());
+        else
+            m_formatter.oneWordOp10Reg3Reg3(OP_CMP_reg_T1, rm, rn);
+    }
+
+    // xor is not spelled with an 'e'. :-(
+    void eor(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_EOR_imm_T1, rn, rd, imm);
+    }
+
+    // What is wrong with you people?, xor is not spelled with an 'e'. :-(
+    void eor(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_EOR_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // What is wrong with you people?, xor is not spelled with an 'e'. :-(
+    void eor(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if ((rd == rn) && !((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_EOR_reg_T1, rm, rd);
+        else if ((rd == rm) && !((rd | rn) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_EOR_reg_T1, rn, rd);
+        else
+            eor(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    void it(Condition cond)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond));
+    }
+
+    void it(Condition cond, bool inst2if)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond, inst2if));
+    }
+
+    void it(Condition cond, bool inst2if, bool inst3if)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond, inst2if, inst3if));
+    }
+
+    void it(Condition cond, bool inst2if, bool inst3if, bool inst4if)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond, inst2if, inst3if, inst4if));
+    }
+
+    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    void ldr(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt7())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDR_imm_T1, imm.getUInt7() >> 2, rn, rt);
+        else if ((rn == ARM::sp) && !(rt & 8) && imm.isUInt10())
+            m_formatter.oneWordOp5Reg3Imm8(OP_LDR_imm_T2, rt, imm.getUInt10() >> 2);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T3, rn, rt, imm.getUInt12());
+    }
+
+    // If index is set, this is a regular offset or a pre-indexed load;
+    // if index is not set then is is a post-index load.
+    //
+    // If wback is set rn is updated - this is a pre or post index load,
+    // if wback is not set this is a regular offset memory access.
+    //
+    // (-255 <= offset <= 255)
+    // _reg = REG[rn]
+    // _tmp = _reg + offset
+    // MEM[index ? _tmp : _reg] = REG[rt]
+    // if (wback) REG[rn] = _tmp
+    void ldr(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+    
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        ASSERT((offset & ~0xff) == 0);
+        
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+        
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T4, rn, rt, offset);
+    }
+
+    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    void ldr(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
+    {
+        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDR_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDR_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    void ldrh(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt6())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDRH_imm_T1, imm.getUInt6() >> 2, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRH_imm_T2, rn, rt, imm.getUInt12());
+    }
+
+    // If index is set, this is a regular offset or a pre-indexed load;
+    // if index is not set then is is a post-index load.
+    //
+    // If wback is set rn is updated - this is a pre or post index load,
+    // if wback is not set this is a regular offset memory access.
+    //
+    // (-255 <= offset <= 255)
+    // _reg = REG[rn]
+    // _tmp = _reg + offset
+    // MEM[index ? _tmp : _reg] = REG[rt]
+    // if (wback) REG[rn] = _tmp
+    void ldrh(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+    
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        ASSERT((offset & ~0xff) == 0);
+        
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+        
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRH_imm_T3, rn, rt, offset);
+    }
+
+    void ldrh(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
+    {
+        ASSERT(!BadReg(rt));   // Memory hint
+        ASSERT(rn != ARM::pc); // LDRH (literal)
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDRH_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDRH_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    void lsl(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_LSL, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_LSL_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void lsl(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_LSL_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+
+    void lsr(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_LSR, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_LSR_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void lsr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_LSR_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+
+    void movT3(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isValid());
+        ASSERT(!imm.isEncodedImm());
+        ASSERT(!BadReg(rd));
+        
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MOV_imm_T3, imm.m_value.imm4, rd, imm);
+    }
+
+     void mov(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isValid());
+        ASSERT(!BadReg(rd));
+        
+        if ((rd < 8) && imm.isUInt8())
+            m_formatter.oneWordOp5Reg3Imm8(OP_MOV_imm_T1, rd, imm.getUInt8());
+        else if (imm.isEncodedImm())
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MOV_imm_T2, 0xf, rd, imm);
+        else
+            movT3(rd, imm);
+    }
+
+   void mov(RegisterID rd, RegisterID rm)
+    {
+        m_formatter.oneWordOp8RegReg143(OP_MOV_reg_T1, rm, rd);
+    }
+
+    void movt(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isUInt16());
+        ASSERT(!BadReg(rd));
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MOVT, imm.m_value.imm4, rd, imm);
+    }
+
+    void mvn(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isEncodedImm());
+        ASSERT(!BadReg(rd));
+        
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MVN_imm, 0xf, rd, imm);
+    }
+
+    void mvn(RegisterID rd, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp16FourFours(OP_MVN_reg_T2, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void mvn(RegisterID rd, RegisterID rm)
+    {
+        if (!((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_MVN_reg_T1, rm, rd);
+        else
+            mvn(rd, rm, ShiftTypeAndAmount());
+    }
+
+    void orr(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ORR_imm_T1, rn, rd, imm);
+    }
+
+    void orr(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ORR_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void orr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if ((rd == rn) && !((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_ORR_reg_T1, rm, rd);
+        else if ((rd == rm) && !((rd | rn) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_ORR_reg_T1, rn, rd);
+        else
+            orr(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    void ror(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_ROR, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_ROR_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void ror(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ROR_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+
+    void smull(RegisterID rdLo, RegisterID rdHi, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rdLo));
+        ASSERT(!BadReg(rdHi));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        ASSERT(rdLo != rdHi);
+        m_formatter.twoWordOp12Reg4FourFours(OP_SMULL_T1, rn, FourFours(rdLo, rdHi, 0, rm));
+    }
+
+    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    void str(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rt != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt7())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_STR_imm_T1, imm.getUInt7() >> 2, rn, rt);
+        else if ((rn == ARM::sp) && !(rt & 8) && imm.isUInt10())
+            m_formatter.oneWordOp5Reg3Imm8(OP_STR_imm_T2, rt, imm.getUInt10() >> 2);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STR_imm_T3, rn, rt, imm.getUInt12());
+    }
+
+    // If index is set, this is a regular offset or a pre-indexed store;
+    // if index is not set then is is a post-index store.
+    //
+    // If wback is set rn is updated - this is a pre or post index store,
+    // if wback is not set this is a regular offset memory access.
+    //
+    // (-255 <= offset <= 255)
+    // _reg = REG[rn]
+    // _tmp = _reg + offset
+    // MEM[index ? _tmp : _reg] = REG[rt]
+    // if (wback) REG[rn] = _tmp
+    void str(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+    
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        ASSERT((offset & ~0xff) == 0);
+        
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+        
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STR_imm_T4, rn, rt, offset);
+    }
+
+    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    void str(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
+    {
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_STR_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_STR_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    void sub(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isValid());
+
+        if ((rn == ARM::sp) && (rd == ARM::sp) && imm.isUInt9()) {
+            m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, imm.getUInt9() >> 2);
+            return;
+        } else if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_SUB_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        if (imm.isEncodedImm())
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_SUB_imm_T3, rn, rd, imm);
+        else {
+            ASSERT(imm.isUInt12());
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_SUB_imm_T4, rn, rd, imm);
+        }
+    }
+
+    void sub(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_SUB_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // NOTE: In an IT block, add doesn't modify the flags register.
+    void sub(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_reg_T1, rm, rn, rd);
+        else
+            sub(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    // Not allowed in an IT (if then) block.
+    void sub_S(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isValid());
+
+        if ((rn == ARM::sp) && (rd == ARM::sp) && imm.isUInt9()) {
+            m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, imm.getUInt9() >> 2);
+            return;
+        } else if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_S_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_SUB_S_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_SUB_S_imm_T3, rn, rd, imm);
+    }
+
+    // Not allowed in an IT (if then) block?
+    void sub_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_SUB_S_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // Not allowed in an IT (if then) block.
+    void sub_S(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_S_reg_T1, rm, rn, rd);
+        else
+            sub_S(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    void tst(RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_TST_imm, rn, (RegisterID)0xf, imm);
+    }
+
+    void tst(RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_TST_reg_T2, rn, FourFours(shift.hi4(), 0xf, shift.lo4(), rm));
+    }
+
+    void tst(RegisterID rn, RegisterID rm)
+    {
+        if ((rn | rm) & 8)
+            tst(rn, rm, ShiftTypeAndAmount());
+        else
+            m_formatter.oneWordOp10Reg3Reg3(OP_TST_reg_T1, rm, rn);
+    }
+
+    void vadd_F64(FPRegisterID rd, FPRegisterID rn, FPRegisterID rm)
+    {
+        m_formatter.vfpOp(0x0b00ee30 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rn, 23, 0) | doubleRegisterMask(rm, 21, 16));
+    }
+
+    void vcmp_F64(FPRegisterID rd, FPRegisterID rm)
+    {
+        m_formatter.vfpOp(0x0bc0eeb4 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rm, 21, 16));
+    }
+
+    void vcvt_F64_S32(FPRegisterID fd, FPRegisterID sm)
+    {
+        m_formatter.vfpOp(0x0bc0eeb8 | doubleRegisterMask(fd, 6, 28) | singleRegisterMask(sm, 16, 21));
+    }
+
+    void vcvt_S32_F64(FPRegisterID sd, FPRegisterID fm)
+    {
+        m_formatter.vfpOp(0x0bc0eebd | singleRegisterMask(sd, 28, 6) | doubleRegisterMask(fm, 21, 16));
+    }
+
+    void vldr(FPRegisterID rd, RegisterID rn, int32_t imm)
+    {
+        vmem(rd, rn, imm, true);
+    }
+
+    void vmov(RegisterID rd, FPRegisterID sn)
+    {
+        m_formatter.vfpOp(0x0a10ee10 | (rd << 28) | singleRegisterMask(sn, 0, 23));
+    }
+
+    void vmov(FPRegisterID sn, RegisterID rd)
+    {
+        m_formatter.vfpOp(0x0a10ee00 | (rd << 28) | singleRegisterMask(sn, 0, 23));
+    }
+
+    // move FPSCR flags to APSR.
+    void vmrs_APSR_nzcv_FPSCR()
+    {
+        m_formatter.vfpOp(0xfa10eef1);
+    }
+
+    void vmul_F64(FPRegisterID rd, FPRegisterID rn, FPRegisterID rm)
+    {
+        m_formatter.vfpOp(0x0b00ee20 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rn, 23, 0) | doubleRegisterMask(rm, 21, 16));
+    }
+
+    void vstr(FPRegisterID rd, RegisterID rn, int32_t imm)
+    {
+        vmem(rd, rn, imm, false);
+    }
+
+    void vsub_F64(FPRegisterID rd, FPRegisterID rn, FPRegisterID rm)
+    {
+        m_formatter.vfpOp(0x0b40ee30 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rn, 23, 0) | doubleRegisterMask(rm, 21, 16));
+    }
+
+
+    JmpDst label()
+    {
+        return JmpDst(m_formatter.size());
+    }
+    
+    JmpDst align(int alignment)
+    {
+        while (!m_formatter.isAligned(alignment))
+            bkpt();
+
+        return label();
+    }
+    
+    static void* getRelocatedAddress(void* code, JmpSrc jump)
+    {
+        ASSERT(jump.m_offset != -1);
+
+        return reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(code) + jump.m_offset);
+    }
+    
+    static void* getRelocatedAddress(void* code, JmpDst destination)
+    {
+        ASSERT(destination.m_offset != -1);
+
+        return reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(code) + destination.m_offset);
+    }
+    
+    static int getDifferenceBetweenLabels(JmpDst src, JmpDst dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+    
+    static int getDifferenceBetweenLabels(JmpDst src, JmpSrc dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+    
+    static int getDifferenceBetweenLabels(JmpSrc src, JmpDst dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+    
+    // Assembler admin methods:
+
+    size_t size() const
+    {
+        return m_formatter.size();
+    }
+
+    void* executableCopy(ExecutablePool* allocator)
+    {
+        void* copy = m_formatter.executableCopy(allocator);
+        ASSERT(copy);
+        return copy;
+    }
+
+    static unsigned getCallReturnOffset(JmpSrc call)
+    {
+        ASSERT(call.m_offset >= 0);
+        return call.m_offset;
+    }
+
+    // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer.  Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
+
+    void linkJump(JmpSrc from, JmpDst to)
+    {
+        ASSERT(to.m_offset != -1);
+        ASSERT(from.m_offset != -1);
+
+        uint16_t* location = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(m_formatter.data()) + from.m_offset);
+        intptr_t relative = to.m_offset - from.m_offset;
+
+        linkWithOffset(location, relative);
+    }
+
+    static void linkJump(void* code, JmpSrc from, void* to)
+    {
+        ASSERT(from.m_offset != -1);
+        
+        uint16_t* location = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+        intptr_t relative = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(location);
+
+        linkWithOffset(location, relative);
+    }
+
+    // bah, this mathod should really be static, since it is used by the PatchBuffer.
+    // return a bool saying whether the link was successful?
+    static void linkCall(void* code, JmpSrc from, void* to)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(code) & 1));
+        ASSERT(from.m_offset != -1);
+        ASSERT(reinterpret_cast<intptr_t>(to) & 1);
+
+        patchPointer(reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(code) + from.m_offset) - 1, to);
+    }
+
+    static void patchPointer(void* code, JmpDst where, void* value)
+    {
+        patchPointer(reinterpret_cast<char*>(code) + where.m_offset, value);
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<uint16_t*>(from) - 2, 2 * sizeof(uint16_t));
+
+        ASSERT(!(reinterpret_cast<intptr_t>(from) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(to) & 1));
+
+        intptr_t relative = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(from);
+        linkWithOffset(reinterpret_cast<uint16_t*>(from), relative);
+    }
+    
+    static void relinkCall(void* from, void* to)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<uint16_t*>(from) - 5, 4 * sizeof(uint16_t));
+
+        ASSERT(!(reinterpret_cast<intptr_t>(from) & 1));
+        ASSERT(reinterpret_cast<intptr_t>(to) & 1);
+
+        patchPointer(reinterpret_cast<uint16_t*>(from) - 1, to);
+    }
+
+    static void repatchInt32(void* where, int32_t value)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<uint16_t*>(where) - 4, 4 * sizeof(uint16_t));
+
+        ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
+        
+        patchInt32(where, value);
+    }
+
+    static void repatchPointer(void* where, void* value)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<uint16_t*>(where) - 4, 4 * sizeof(uint16_t));
+
+        ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
+        
+        patchPointer(where, value);
+    }
+
+    static void repatchLoadPtrToLEA(void* where)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
+
+        uint16_t* loadOp = reinterpret_cast<uint16_t*>(where) + 4;
+        ASSERT((*loadOp & 0xfff0) == OP_LDR_reg_T2);
+
+        ExecutableAllocator::MakeWritable unprotect(loadOp, sizeof(uint16_t));
+        *loadOp = OP_ADD_reg_T3 | (*loadOp & 0xf);
+    }
+
+private:
+
+    // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+    // (i.e. +/-(0..255) 32-bit words)
+    void vmem(FPRegisterID rd, RegisterID rn, int32_t imm, bool isLoad)
+    {
+        bool up;
+        uint32_t offset;
+        if (imm < 0) {
+            offset = -imm;
+            up = false;
+        } else {
+            offset = imm;
+            up = true;
+        }
+
+        // offset is effectively leftshifted by 2 already (the bottom two bits are zero, and not
+        // reperesented in the instruction.  Left shift by 14, to mov it into position 0x00AA0000.
+        ASSERT((offset & ~(0xff << 2)) == 0);
+        offset <<= 14;
+
+        m_formatter.vfpOp(0x0b00ed00 | offset | (up << 7) | (isLoad << 4) | doubleRegisterMask(rd, 6, 28) | rn);
+    }
+
+    static void patchInt32(void* code, uint32_t value)
+    {
+        uint16_t* location = reinterpret_cast<uint16_t*>(code);
+
+        ExecutableAllocator::MakeWritable unprotect(location - 4, 4 * sizeof(uint16_t));
+
+        uint16_t lo16 = value;
+        uint16_t hi16 = value >> 16;
+
+        spliceHi5(location - 4, lo16);
+        spliceLo11(location - 3, lo16);
+        spliceHi5(location - 2, hi16);
+        spliceLo11(location - 1, hi16);
+    }
+
+    static void patchPointer(void* code, void* value)
+    {
+        patchInt32(code, reinterpret_cast<uint32_t>(value));
+    }
+
+    // Linking & patching:
+    // This method assumes that the JmpSrc being linked is a T4 b instruction.
+    static void linkWithOffset(uint16_t* instruction, intptr_t relative)
+    {
+        // Currently branches > 16m = mostly deathy.
+        if (((relative << 7) >> 7) != relative) {
+            // FIXME: This CRASH means we cannot turn the JIT on by default on arm-v7.
+            fprintf(stderr, "Error: Cannot link T4b.\n");
+            CRASH();
+        }
+        
+        // ARM encoding for the top two bits below the sign bit is 'peculiar'.
+        if (relative >= 0)
+            relative ^= 0xC00000;
+
+        // All branch offsets should be an even distance.
+        ASSERT(!(relative & 1));
+
+        int word1 = ((relative & 0x1000000) >> 14) | ((relative & 0x3ff000) >> 12);
+        int word2 = ((relative & 0x800000) >> 10) | ((relative & 0x400000) >> 11) | ((relative & 0xffe) >> 1);
+
+        instruction[-2] = OP_B_T4a | word1;
+        instruction[-1] = OP_B_T4b | word2;
+    }
+
+    // These functions can be used to splice 16-bit immediates back into previously generated instructions.
+    static void spliceHi5(uint16_t* where, uint16_t what)
+    {
+        uint16_t pattern = (what >> 12) | ((what & 0x0800) >> 1);
+        *where = (*where & 0xFBF0) | pattern;
+    }
+    static void spliceLo11(uint16_t* where, uint16_t what)
+    {
+        uint16_t pattern = ((what & 0x0700) << 4) | (what & 0x00FF);
+        *where = (*where & 0x8F00) | pattern;
+    }
+
+    class ARMInstructionFormatter {
+    public:
+        void oneWordOp5Reg3Imm8(OpcodeID op, RegisterID rd, uint8_t imm)
+        {
+            m_buffer.putShort(op | (rd << 8) | imm);
+        }
+        
+        void oneWordOp5Imm5Reg3Reg3(OpcodeID op, uint8_t imm, RegisterID reg1, RegisterID reg2)
+        {
+            m_buffer.putShort(op | (imm << 6) | (reg1 << 3) | reg2);
+        }
+
+        void oneWordOp7Reg3Reg3Reg3(OpcodeID op, RegisterID reg1, RegisterID reg2, RegisterID reg3)
+        {
+            m_buffer.putShort(op | (reg1 << 6) | (reg2 << 3) | reg3);
+        }
+
+        void oneWordOp8Imm8(OpcodeID op, uint8_t imm)
+        {
+            m_buffer.putShort(op | imm);
+        }
+
+        void oneWordOp8RegReg143(OpcodeID op, RegisterID reg1, RegisterID reg2)
+        {
+            m_buffer.putShort(op | ((reg2 & 8) << 4) | (reg1 << 3) | (reg2 & 7));
+        }
+        void oneWordOp9Imm7(OpcodeID op, uint8_t imm)
+        {
+            m_buffer.putShort(op | imm);
+        }
+
+        void oneWordOp10Reg3Reg3(OpcodeID op, RegisterID reg1, RegisterID reg2)
+        {
+            m_buffer.putShort(op | (reg1 << 3) | reg2);
+        }
+
+        void twoWordOp12Reg4FourFours(OpcodeID1 op, RegisterID reg, FourFours ff)
+        {
+            m_buffer.putShort(op | reg);
+            m_buffer.putShort(ff.m_u.value);
+        }
+        
+        void twoWordOp16FourFours(OpcodeID1 op, FourFours ff)
+        {
+            m_buffer.putShort(op);
+            m_buffer.putShort(ff.m_u.value);
+        }
+        
+        void twoWordOp16Op16(OpcodeID1 op1, OpcodeID2 op2)
+        {
+            m_buffer.putShort(op1);
+            m_buffer.putShort(op2);
+        }
+
+        void twoWordOp5i6Imm4Reg4EncodedImm(OpcodeID1 op, int imm4, RegisterID rd, ARMThumbImmediate imm)
+        {
+            m_buffer.putShort(op | (imm.m_value.i << 10) | imm4);
+            m_buffer.putShort((imm.m_value.imm3 << 12) | (rd << 8) | imm.m_value.imm8);
+        }
+
+        void twoWordOp12Reg4Reg4Imm12(OpcodeID1 op, RegisterID reg1, RegisterID reg2, uint16_t imm)
+        {
+            m_buffer.putShort(op | reg1);
+            m_buffer.putShort((reg2 << 12) | imm);
+        }
+
+        void vfpOp(int32_t op)
+        {
+            m_buffer.putInt(op);
+        }
+
+
+        // Administrative methods:
+
+        size_t size() const { return m_buffer.size(); }
+        bool isAligned(int alignment) const { return m_buffer.isAligned(alignment); }
+        void* data() const { return m_buffer.data(); }
+        void* executableCopy(ExecutablePool* allocator) { return m_buffer.executableCopy(allocator); }
+
+    private:
+        AssemblerBuffer m_buffer;
+    } m_formatter;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_V7)
+
+#endif // ARMAssembler_h
diff --git a/JavaScriptCore/assembler/AbstractMacroAssembler.h b/JavaScriptCore/assembler/AbstractMacroAssembler.h
index 851b6d5..7460029 100644
--- a/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -28,22 +28,38 @@
 
 #include <wtf/Platform.h>
 
+#include <MacroAssemblerCodeRef.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/UnusedParam.h>
+
 #if ENABLE(ASSEMBLER)
 
+// FIXME: keep transitioning this out into MacroAssemblerX86_64.
+#if PLATFORM(X86_64)
+#define REPTACH_OFFSET_CALL_R11 3
+#endif
+
 namespace JSC {
 
 template <class AssemblerType>
 class AbstractMacroAssembler {
 public:
+    typedef MacroAssemblerCodePtr CodePtr;
+    typedef MacroAssemblerCodeRef CodeRef;
+
     class Jump;
     class PatchBuffer;
+    class CodeLocationInstruction;
     class CodeLocationLabel;
     class CodeLocationJump;
     class CodeLocationCall;
+    class CodeLocationNearCall;
     class CodeLocationDataLabel32;
     class CodeLocationDataLabelPtr;
+    class ProcessorReturnAddress;
 
     typedef typename AssemblerType::RegisterID RegisterID;
+    typedef typename AssemblerType::FPRegisterID FPRegisterID;
     typedef typename AssemblerType::JmpSrc JmpSrc;
     typedef typename AssemblerType::JmpDst JmpDst;
 
@@ -165,17 +181,32 @@
     struct Imm32 {
         explicit Imm32(int32_t value)
             : m_value(value)
+#if PLATFORM(ARM_V7)
+            , m_isPointer(false)
+#endif
         {
         }
 
 #if !PLATFORM(X86_64)
         explicit Imm32(ImmPtr ptr)
             : m_value(ptr.asIntptr())
+#if PLATFORM(ARM_V7)
+            , m_isPointer(true)
+#endif
         {
         }
 #endif
 
         int32_t m_value;
+#if PLATFORM(ARM_V7)
+        // We rely on being able to regenerate code to recover exception handling
+        // information.  Since ARMv7 supports 16-bit immediates there is a danger
+        // that if pointer values change the layout of the generated code will change.
+        // To avoid this problem, always generate pointers (and thus Imm32s constructed
+        // from ImmPtrs) with a code sequence that is able  to represent  any pointer
+        // value - don't use a more compact form in these cases.
+        bool m_isPointer;
+#endif
     };
 
 
@@ -192,10 +223,12 @@
     // A Label records a point in the generated instruction stream, typically such that
     // it may be used as a destination for a jump.
     class Label {
-        friend class Jump;
-        template<class AssemblerType_T>
+        template<class TemplateAssemblerType>
         friend class AbstractMacroAssembler;
+        friend class Jump;
+        friend class MacroAssemblerCodeRef;
         friend class PatchBuffer;
+
     public:
         Label()
         {
@@ -217,7 +250,7 @@
     // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
     // patched after the code has been generated.
     class DataLabelPtr {
-        template<class AssemblerType_T>
+        template<class TemplateAssemblerType>
         friend class AbstractMacroAssembler;
         friend class PatchBuffer;
     public:
@@ -239,7 +272,7 @@
     // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
     // patched after the code has been generated.
     class DataLabel32 {
-        template<class AssemblerType_T>
+        template<class TemplateAssemblerType>
         friend class AbstractMacroAssembler;
         friend class PatchBuffer;
     public:
@@ -263,9 +296,9 @@
     // relative offset such that when executed it will call to the desired
     // destination.
     class Call {
-        friend class PatchBuffer;
-        template<class AssemblerType_T>
+        template<class TemplateAssemblerType>
         friend class AbstractMacroAssembler;
+        friend class PatchBuffer;
     public:
         enum Flags {
             None = 0x0,
@@ -307,10 +340,10 @@
     // relative offset such that when executed it will jump to the desired
     // destination.
     class Jump {
-        friend class PatchBuffer;
-        template<class AssemblerType_T>
+        template<class TemplateAssemblerType>
         friend class AbstractMacroAssembler;
         friend class Call;
+        friend class PatchBuffer;
     public:
         Jump()
         {
@@ -397,7 +430,6 @@
     class CodeLocationCommon {
     public:
         CodeLocationCommon()
-            : m_location(0)
         {
         }
 
@@ -406,22 +438,52 @@
         // and the labels will always be a fixed distance apart, these
         // methods may be used to recover a handle that has nopw been
         // retained, based on a known fixed relative offset from one that has.
+        CodeLocationInstruction instructionAtOffset(int offset);
         CodeLocationLabel labelAtOffset(int offset);
         CodeLocationJump jumpAtOffset(int offset);
         CodeLocationCall callAtOffset(int offset);
+        CodeLocationNearCall nearCallAtOffset(int offset);
         CodeLocationDataLabelPtr dataLabelPtrAtOffset(int offset);
         CodeLocationDataLabel32 dataLabel32AtOffset(int offset);
 
-        operator bool() { return m_location; }
-        void reset() { m_location = 0; }
-
     protected:
-        explicit CodeLocationCommon(void* location)
+        explicit CodeLocationCommon(CodePtr location)
             : m_location(location)
         {
         }
 
-        void* m_location;
+        void* dataLocation() { return m_location.dataLocation(); }
+        void* executableAddress() { return m_location.executableAddress(); }
+    
+        void reset()
+        {
+            m_location = CodePtr();
+        }
+
+    private:
+        CodePtr m_location;
+    };
+
+    // CodeLocationInstruction:
+    //
+    // An arbitrary instruction in the JIT code.
+    class CodeLocationInstruction : public CodeLocationCommon {
+        friend class CodeLocationCommon;
+    public:
+        CodeLocationInstruction()
+        {
+        }
+
+        void repatchLoadPtrToLEA()
+        {
+            AssemblerType::repatchLoadPtrToLEA(this->dataLocation());
+        }
+
+    private:
+        explicit CodeLocationInstruction(void* location)
+            : CodeLocationCommon(CodePtr(location))
+        {
+        }
     };
 
     // CodeLocationLabel:
@@ -430,23 +492,42 @@
     class CodeLocationLabel : public CodeLocationCommon {
         friend class CodeLocationCommon;
         friend class CodeLocationJump;
+        friend class CodeLocationCall;
+        friend class CodeLocationNearCall;
         friend class PatchBuffer;
+        friend class ProcessorReturnAddress;
+
     public:
         CodeLocationLabel()
         {
         }
 
-        void* addressForSwitch() { return this->m_location; }
-        void* addressForExceptionHandler() { return this->m_location; }
-        void* addressForJSR() { return this->m_location; }
+        void* addressForSwitch() { return this->executableAddress(); }
+        void* addressForExceptionHandler() { return this->executableAddress(); }
+        void* addressForJSR() { return this->executableAddress(); }
+
+        bool operator!()
+        {
+            return !this->executableAddress();
+        }
+
+        void reset()
+        {
+            CodeLocationCommon::reset();
+        }
 
     private:
-        explicit CodeLocationLabel(void* location)
+        explicit CodeLocationLabel(CodePtr location)
             : CodeLocationCommon(location)
         {
         }
 
-        void* getJumpDestination() { return this->m_location; }
+        explicit CodeLocationLabel(void* location)
+            : CodeLocationCommon(CodePtr(location))
+        {
+        }
+
+        void* getJumpDestination() { return this->executableAddress(); }
     };
 
     // CodeLocationJump:
@@ -462,12 +543,12 @@
 
         void relink(CodeLocationLabel destination)
         {
-            AssemblerType::patchJump(reinterpret_cast<intptr_t>(this->m_location), destination.m_location);
+            AssemblerType::relinkJump(this->dataLocation(), destination.dataLocation());
         }
 
     private:
         explicit CodeLocationJump(void* location)
-            : CodeLocationCommon(location)
+            : CodeLocationCommon(CodePtr(location))
         {
         }
     };
@@ -478,29 +559,47 @@
     class CodeLocationCall : public CodeLocationCommon {
         friend class CodeLocationCommon;
         friend class PatchBuffer;
+        friend class ProcessorReturnAddress;
     public:
         CodeLocationCall()
         {
         }
 
-        template<typename FunctionSig>
-        void relink(FunctionSig* function)
+        void relink(CodeLocationLabel destination)
         {
-            AssemblerType::patchMacroAssemblerCall(reinterpret_cast<intptr_t>(this->m_location), reinterpret_cast<void*>(function));
+#if PLATFORM(X86_64)
+            CodeLocationCommon::dataLabelPtrAtOffset(-REPTACH_OFFSET_CALL_R11).repatch(destination.executableAddress());
+#else
+            AssemblerType::relinkCall(this->dataLocation(), destination.executableAddress());
+#endif
+        }
+
+        void relink(FunctionPtr destination)
+        {
+#if PLATFORM(X86_64)
+            CodeLocationCommon::dataLabelPtrAtOffset(-REPTACH_OFFSET_CALL_R11).repatch(destination.executableAddress());
+#else
+            AssemblerType::relinkCall(this->dataLocation(), destination.executableAddress());
+#endif
         }
 
         // This methods returns the value that will be set as the return address
         // within a function that has been called from this call instruction.
         void* calleeReturnAddressValue()
         {
-            return this->m_location;
+            return this->executableAddress();
         }
 
     private:
-        explicit CodeLocationCall(void* location)
+        explicit CodeLocationCall(CodePtr location)
             : CodeLocationCommon(location)
         {
         }
+
+        explicit CodeLocationCall(void* location)
+            : CodeLocationCommon(CodePtr(location))
+        {
+        }
     };
 
     // CodeLocationNearCall:
@@ -509,29 +608,44 @@
     class CodeLocationNearCall : public CodeLocationCommon {
         friend class CodeLocationCommon;
         friend class PatchBuffer;
+        friend class ProcessorReturnAddress;
     public:
         CodeLocationNearCall()
         {
         }
 
-        template<typename FunctionSig>
-        void relink(FunctionSig* function)
+        void relink(CodePtr destination)
         {
-            AssemblerType::patchCall(reinterpret_cast<intptr_t>(this->m_location), reinterpret_cast<void*>(function));
+            AssemblerType::relinkCall(this->dataLocation(), destination.executableAddress());
+        }
+
+        void relink(CodeLocationLabel destination)
+        {
+            AssemblerType::relinkCall(this->dataLocation(), destination.executableAddress());
+        }
+
+        void relink(FunctionPtr destination)
+        {
+            AssemblerType::relinkCall(this->dataLocation(), destination.executableAddress());
         }
 
         // This methods returns the value that will be set as the return address
         // within a function that has been called from this call instruction.
         void* calleeReturnAddressValue()
         {
-            return this->m_location;
+            return this->executableAddress();
         }
 
     private:
-        explicit CodeLocationNearCall(void* location)
+        explicit CodeLocationNearCall(CodePtr location)
             : CodeLocationCommon(location)
         {
         }
+
+        explicit CodeLocationNearCall(void* location)
+            : CodeLocationCommon(CodePtr(location))
+        {
+        }
     };
 
     // CodeLocationDataLabel32:
@@ -547,12 +661,12 @@
 
         void repatch(int32_t value)
         {
-            AssemblerType::patchImmediate(reinterpret_cast<intptr_t>(this->m_location), value);
+            AssemblerType::repatchInt32(this->dataLocation(), value);
         }
 
     private:
         explicit CodeLocationDataLabel32(void* location)
-            : CodeLocationCommon(location)
+            : CodeLocationCommon(CodePtr(location))
         {
         }
     };
@@ -570,12 +684,12 @@
 
         void repatch(void* value)
         {
-            AssemblerType::patchPointer(reinterpret_cast<intptr_t>(this->m_location), reinterpret_cast<intptr_t>(value));
+            AssemblerType::repatchPointer(this->dataLocation(), value);
         }
 
     private:
         explicit CodeLocationDataLabelPtr(void* location)
-            : CodeLocationCommon(location)
+            : CodeLocationCommon(CodePtr(location))
         {
         }
     };
@@ -584,36 +698,55 @@
     //
     // This class can be used to relink a call identified by its return address.
     class ProcessorReturnAddress {
+        friend class CodeLocationCall;
+        friend class CodeLocationNearCall;
     public:
         ProcessorReturnAddress(void* location)
             : m_location(location)
         {
         }
 
-        template<typename FunctionSig>
-        void relinkCallerToFunction(FunctionSig* newCalleeFunction)
+        void relinkCallerToTrampoline(CodeLocationLabel label)
         {
-            AssemblerType::patchMacroAssemblerCall(reinterpret_cast<intptr_t>(this->m_location), reinterpret_cast<void*>(newCalleeFunction));
+            CodeLocationCall(CodePtr(m_location)).relink(label);
         }
         
-        template<typename FunctionSig>
-        void relinkNearCallerToFunction(FunctionSig* newCalleeFunction)
+        void relinkCallerToTrampoline(CodePtr newCalleeFunction)
         {
-            AssemblerType::patchCall(reinterpret_cast<intptr_t>(this->m_location), reinterpret_cast<void*>(newCalleeFunction));
+            relinkCallerToTrampoline(CodeLocationLabel(newCalleeFunction));
+        }
+
+        void relinkCallerToFunction(FunctionPtr function)
+        {
+            CodeLocationCall(CodePtr(m_location)).relink(function);
         }
         
-        operator void*()
+        void relinkNearCallerToTrampoline(CodeLocationLabel label)
         {
-            return m_location;
+            CodeLocationNearCall(CodePtr(m_location)).relink(label);
+        }
+        
+        void relinkNearCallerToTrampoline(CodePtr newCalleeFunction)
+        {
+            relinkNearCallerToTrampoline(CodeLocationLabel(newCalleeFunction));
+        }
+
+        void* addressForLookup()
+        {
+            return m_location.value();
         }
 
     private:
-        void* m_location;
+        ReturnAddressPtr m_location;
     };
 
 
-    // Section 4: The patch buffer - utility to finalize code generation.
+    // Section 4: PatchBuffer - utility to finalize code generation.
 
+    static CodePtr trampolineAt(CodeRef ref, Label label)
+    {
+        return CodePtr(AssemblerType::getRelocatedAddress(ref.m_code.dataLocation(), label.m_label));
+    }
 
     // PatchBuffer:
     //
@@ -632,69 +765,59 @@
     // FIXME: distinguish between Calls & Jumps (make a specific call to obtain the return
     // address of calls, as opposed to a point that can be used to later relink a Jump -
     // possibly wrap the later up in an object that can do just that).
-    class PatchBuffer {
+    class PatchBuffer : public Noncopyable {
     public:
-        PatchBuffer(void* code)
-            : m_code(code)
+        // Note: Initialization sequence is significant, since executablePool is a PassRefPtr.
+        //       First, executablePool is copied into m_executablePool, then the initialization of
+        //       m_code uses m_executablePool, *not* executablePool, since this is no longer valid.
+        PatchBuffer(AbstractMacroAssembler<AssemblerType>* masm, PassRefPtr<ExecutablePool> executablePool)
+            : m_executablePool(executablePool)
+            , m_code(masm->m_assembler.executableCopy(m_executablePool.get()))
+            , m_size(masm->m_assembler.size())
+#ifndef NDEBUG
+            , m_completed(false)
+#endif
         {
         }
 
-        CodeLocationLabel entry()
+        ~PatchBuffer()
         {
-            return CodeLocationLabel(m_code);
+            ASSERT(m_completed);
         }
 
-        void* trampolineAt(Label label)
-        {
-            return AssemblerType::getRelocatedAddress(m_code, label.m_label);
-        }
-        
         // These methods are used to link or set values at code generation time.
 
-        template<typename FunctionSig>
-        void link(Call call, FunctionSig* function)
+        void link(Call call, FunctionPtr function)
         {
             ASSERT(call.isFlagSet(Call::Linkable));
 #if PLATFORM(X86_64)
-            if (call.isFlagSet(Call::Near)) {
-                AssemblerType::linkCall(m_code, call.m_jmp, reinterpret_cast<void*>(function));
-            } else {
-                intptr_t callLocation = reinterpret_cast<intptr_t>(AssemblerType::getRelocatedAddress(m_code, call.m_jmp));
-                AssemblerType::patchMacroAssemblerCall(callLocation, reinterpret_cast<void*>(function));
-            }
-#else
-            AssemblerType::linkCall(m_code, call.m_jmp, reinterpret_cast<void*>(function));
+            if (!call.isFlagSet(Call::Near)) {
+                char* callLocation = reinterpret_cast<char*>(AssemblerType::getRelocatedAddress(code(), call.m_jmp)) - REPTACH_OFFSET_CALL_R11;
+                AssemblerType::patchPointerForCall(callLocation, function.value());
+            } else
 #endif
+            AssemblerType::linkCall(code(), call.m_jmp, function.value());
         }
         
-        template<typename FunctionSig>
-        void linkTailRecursive(Jump jump, FunctionSig* function)
-        {
-            AssemblerType::linkJump(m_code, jump.m_jmp, reinterpret_cast<void*>(function));
-        }
-
-        template<typename FunctionSig>
-        void linkTailRecursive(JumpList list, FunctionSig* function)
-        {
-            for (unsigned i = 0; i < list.m_jumps.size(); ++i) {
-                AssemblerType::linkJump(m_code, list.m_jumps[i].m_jmp, reinterpret_cast<void*>(function));
-            }
-        }
-
         void link(Jump jump, CodeLocationLabel label)
         {
-            AssemblerType::linkJump(m_code, jump.m_jmp, label.m_location);
+            AssemblerType::linkJump(code(), jump.m_jmp, label.dataLocation());
         }
 
         void link(JumpList list, CodeLocationLabel label)
         {
             for (unsigned i = 0; i < list.m_jumps.size(); ++i)
-                AssemblerType::linkJump(m_code, list.m_jumps[i].m_jmp, label.m_location);
+                AssemblerType::linkJump(code(), list.m_jumps[i].m_jmp, label.dataLocation());
         }
 
         void patch(DataLabelPtr label, void* value)
         {
-            AssemblerType::patchAddress(m_code, label.m_label, value);
+            AssemblerType::patchPointer(code(), label.m_label, value);
+        }
+
+        void patch(DataLabelPtr label, CodeLocationLabel value)
+        {
+            AssemblerType::patchPointer(code(), label.m_label, value.getJumpDestination());
         }
 
         // These methods are used to obtain handles to allow the code to be relinked / repatched later.
@@ -703,29 +826,29 @@
         {
             ASSERT(call.isFlagSet(Call::Linkable));
             ASSERT(!call.isFlagSet(Call::Near));
-            return CodeLocationCall(AssemblerType::getRelocatedAddress(m_code, call.m_jmp));
+            return CodeLocationCall(AssemblerType::getRelocatedAddress(code(), call.m_jmp));
         }
 
         CodeLocationNearCall locationOfNearCall(Call call)
         {
             ASSERT(call.isFlagSet(Call::Linkable));
             ASSERT(call.isFlagSet(Call::Near));
-            return CodeLocationNearCall(AssemblerType::getRelocatedAddress(m_code, call.m_jmp));
+            return CodeLocationNearCall(AssemblerType::getRelocatedAddress(code(), call.m_jmp));
         }
 
         CodeLocationLabel locationOf(Label label)
         {
-            return CodeLocationLabel(AssemblerType::getRelocatedAddress(m_code, label.m_label));
+            return CodeLocationLabel(AssemblerType::getRelocatedAddress(code(), label.m_label));
         }
 
         CodeLocationDataLabelPtr locationOf(DataLabelPtr label)
         {
-            return CodeLocationDataLabelPtr(AssemblerType::getRelocatedAddress(m_code, label.m_label));
+            return CodeLocationDataLabelPtr(AssemblerType::getRelocatedAddress(code(), label.m_label));
         }
 
         CodeLocationDataLabel32 locationOf(DataLabel32 label)
         {
-            return CodeLocationDataLabel32(AssemblerType::getRelocatedAddress(m_code, label.m_label));
+            return CodeLocationDataLabel32(AssemblerType::getRelocatedAddress(code(), label.m_label));
         }
 
         // This method obtains the return address of the call, given as an offset from
@@ -735,8 +858,47 @@
             return AssemblerType::getCallReturnOffset(call.m_jmp);
         }
 
+        // Upon completion of all patching either 'finalizeCode()' or 'finalizeCodeAddendum()' should be called
+        // once to complete generation of the code.  'finalizeCode()' is suited to situations
+        // where the executable pool must also be retained, the lighter-weight 'finalizeCodeAddendum()' is
+        // suited to adding to an existing allocation.
+        CodeRef finalizeCode()
+        {
+            performFinalization();
+
+            return CodeRef(m_code, m_executablePool, m_size);
+        }
+        CodeLocationLabel finalizeCodeAddendum()
+        {
+            performFinalization();
+
+            return CodeLocationLabel(code());
+        }
+
     private:
+        // Keep this private! - the underlying code should only be obtained externally via 
+        // finalizeCode() or finalizeCodeAddendum().
+        void* code()
+        {
+            return m_code;
+        }
+
+        void performFinalization()
+        {
+#ifndef NDEBUG
+            ASSERT(!m_completed);
+            m_completed = true;
+#endif
+
+            ExecutableAllocator::makeExecutable(code(), m_size);
+        }
+
+        RefPtr<ExecutablePool> m_executablePool;
         void* m_code;
+        size_t m_size;
+#ifndef NDEBUG
+        bool m_completed;
+#endif
     };
 
 
@@ -747,11 +909,6 @@
         return m_assembler.size();
     }
 
-    void* copyCode(ExecutablePool* allocator)
-    {
-        return m_assembler.executableCopy(allocator);
-    }
-
     Label label()
     {
         return Label(this);
@@ -793,6 +950,11 @@
         return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
     }
 
+    ptrdiff_t differenceBetween(DataLabelPtr from, DataLabelPtr to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_label);
+    }
+
     ptrdiff_t differenceBetween(DataLabelPtr from, Call to)
     {
         return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
@@ -804,36 +966,47 @@
 
 
 template <class AssemblerType>
+typename AbstractMacroAssembler<AssemblerType>::CodeLocationInstruction AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::instructionAtOffset(int offset)
+{
+    return typename AbstractMacroAssembler::CodeLocationInstruction(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+template <class AssemblerType>
 typename AbstractMacroAssembler<AssemblerType>::CodeLocationLabel AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::labelAtOffset(int offset)
 {
-    return typename AbstractMacroAssembler::CodeLocationLabel(reinterpret_cast<char*>(m_location) + offset);
+    return typename AbstractMacroAssembler::CodeLocationLabel(reinterpret_cast<char*>(dataLocation()) + offset);
 }
 
 template <class AssemblerType>
 typename AbstractMacroAssembler<AssemblerType>::CodeLocationJump AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::jumpAtOffset(int offset)
 {
-    return typename AbstractMacroAssembler::CodeLocationJump(reinterpret_cast<char*>(m_location) + offset);
+    return typename AbstractMacroAssembler::CodeLocationJump(reinterpret_cast<char*>(dataLocation()) + offset);
 }
 
 template <class AssemblerType>
 typename AbstractMacroAssembler<AssemblerType>::CodeLocationCall AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::callAtOffset(int offset)
 {
-    return typename AbstractMacroAssembler::CodeLocationCall(reinterpret_cast<char*>(m_location) + offset);
+    return typename AbstractMacroAssembler::CodeLocationCall(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+template <class AssemblerType>
+typename AbstractMacroAssembler<AssemblerType>::CodeLocationNearCall AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::nearCallAtOffset(int offset)
+{
+    return typename AbstractMacroAssembler::CodeLocationNearCall(reinterpret_cast<char*>(dataLocation()) + offset);
 }
 
 template <class AssemblerType>
 typename AbstractMacroAssembler<AssemblerType>::CodeLocationDataLabelPtr AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::dataLabelPtrAtOffset(int offset)
 {
-    return typename AbstractMacroAssembler::CodeLocationDataLabelPtr(reinterpret_cast<char*>(m_location) + offset);
+    return typename AbstractMacroAssembler::CodeLocationDataLabelPtr(reinterpret_cast<char*>(dataLocation()) + offset);
 }
 
 template <class AssemblerType>
 typename AbstractMacroAssembler<AssemblerType>::CodeLocationDataLabel32 AbstractMacroAssembler<AssemblerType>::CodeLocationCommon::dataLabel32AtOffset(int offset)
 {
-    return typename AbstractMacroAssembler::CodeLocationDataLabel32(reinterpret_cast<char*>(m_location) + offset);
+    return typename AbstractMacroAssembler::CodeLocationDataLabel32(reinterpret_cast<char*>(dataLocation()) + offset);
 }
 
-
 } // namespace JSC
 
 #endif // ENABLE(ASSEMBLER)
diff --git a/JavaScriptCore/assembler/AssemblerBuffer.h b/JavaScriptCore/assembler/AssemblerBuffer.h
index e1f53d8..7a5a8d3 100644
--- a/JavaScriptCore/assembler/AssemblerBuffer.h
+++ b/JavaScriptCore/assembler/AssemblerBuffer.h
@@ -132,6 +132,8 @@
             if (!result)
                 return 0;
 
+            ExecutableAllocator::makeWritable(result, m_size);
+
             return memcpy(result, m_buffer, m_size);
         }
 
diff --git a/JavaScriptCore/assembler/MacroAssembler.h b/JavaScriptCore/assembler/MacroAssembler.h
index 71ac1f6..c9749a0 100644
--- a/JavaScriptCore/assembler/MacroAssembler.h
+++ b/JavaScriptCore/assembler/MacroAssembler.h
@@ -30,7 +30,11 @@
 
 #if ENABLE(ASSEMBLER)
 
-#if PLATFORM(X86)
+#if PLATFORM(ARM_V7)
+#include "MacroAssemblerARMv7.h"
+namespace JSC { typedef MacroAssemblerARMv7 MacroAssemblerBase; };
+
+#elif PLATFORM(X86)
 #include "MacroAssemblerX86.h"
 namespace JSC { typedef MacroAssemblerX86 MacroAssemblerBase; };
 
@@ -242,6 +246,11 @@
         store32(src, address);
     }
 
+    void storePtr(RegisterID src, void* address)
+    {
+        store32(src, address);
+    }
+
     void storePtr(ImmPtr imm, ImplicitAddress address)
     {
         store32(Imm32(imm), address);
diff --git a/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
new file mode 100644
index 0000000..5ccbd43
--- /dev/null
+++ b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -0,0 +1,1063 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MacroAssemblerARMv7_h
+#define MacroAssemblerARMv7_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(ASSEMBLER)
+
+#include "ARMv7Assembler.h"
+#include "AbstractMacroAssembler.h"
+
+namespace JSC {
+
+class MacroAssemblerARMv7 : public AbstractMacroAssembler<ARMv7Assembler> {
+    // FIXME: switch dataTempRegister & addressTempRegister, or possibly use r7?
+    //        - dTR is likely used more than aTR, and we'll get better instruction
+    //        encoding if it's in the low 8 registers.
+    static const ARM::RegisterID dataTempRegister = ARM::ip;
+    static const RegisterID addressTempRegister = ARM::r3;
+    static const FPRegisterID fpTempRegister = ARM::d7;
+
+    struct ArmAddress {
+        enum AddressType {
+            HasOffset,
+            HasIndex,
+        } type;
+        RegisterID base;
+        union {
+            int32_t offset;
+            struct {
+                RegisterID index;
+                Scale scale;
+            };
+        } u;
+        
+        explicit ArmAddress(RegisterID base, int32_t offset = 0)
+            : type(HasOffset)
+            , base(base)
+        {
+            u.offset = offset;
+        }
+        
+        explicit ArmAddress(RegisterID base, RegisterID index, Scale scale = TimesOne)
+            : type(HasIndex)
+            , base(base)
+        {
+            u.index = index;
+            u.scale = scale;
+        }
+    };
+    
+public:
+
+    static const Scale ScalePtr = TimesFour;
+
+    enum Condition {
+        Equal = ARMv7Assembler::ConditionEQ,
+        NotEqual = ARMv7Assembler::ConditionNE,
+        Above = ARMv7Assembler::ConditionHI,
+        AboveOrEqual = ARMv7Assembler::ConditionHS,
+        Below = ARMv7Assembler::ConditionLO,
+        BelowOrEqual = ARMv7Assembler::ConditionLS,
+        GreaterThan = ARMv7Assembler::ConditionGT,
+        GreaterThanOrEqual = ARMv7Assembler::ConditionGE,
+        LessThan = ARMv7Assembler::ConditionLT,
+        LessThanOrEqual = ARMv7Assembler::ConditionLE,
+        Overflow = ARMv7Assembler::ConditionVS,
+        Signed = ARMv7Assembler::ConditionMI,
+        Zero = ARMv7Assembler::ConditionEQ,
+        NonZero = ARMv7Assembler::ConditionNE
+    };
+
+    enum DoubleCondition {
+        DoubleEqual = ARMv7Assembler::ConditionEQ,
+        DoubleGreaterThan = ARMv7Assembler::ConditionGT,
+        DoubleGreaterThanOrEqual = ARMv7Assembler::ConditionGE,
+        DoubleLessThan = ARMv7Assembler::ConditionLO,
+        DoubleLessThanOrEqual = ARMv7Assembler::ConditionLS,
+    };
+
+    static const RegisterID stackPointerRegister = ARM::sp;
+    static const RegisterID linkRegister = ARM::lr;
+
+    // Integer arithmetic operations:
+    //
+    // Operations are typically two operand - operation(source, srcDst)
+    // For many operations the source may be an Imm32, the srcDst operand
+    // may often be a memory location (explictly described using an Address
+    // object).
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.add(dest, dest, src);
+    }
+
+    void add32(Imm32 imm, RegisterID dest)
+    {
+        add32(imm, dest, dest);
+    }
+
+    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add(dest, src, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.add(dest, src, dataTempRegister);
+        }
+    }
+
+    void add32(Imm32 imm, Address address)
+    {
+        load32(address, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.add(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address);
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        add32(dataTempRegister, dest);
+    }
+
+    void add32(Imm32 imm, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.add(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address.m_ptr);
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.ARM_and(dest, dest, src);
+    }
+
+    void and32(Imm32 imm, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.ARM_and(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.ARM_and(dest, dest, dataTempRegister);
+        }
+    }
+
+    void lshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.lsl(dest, dest, imm.m_value);
+    }
+
+    void lshift32(RegisterID shift_amount, RegisterID dest)
+    {
+        m_assembler.lsl(dest, dest, shift_amount);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.smull(dest, dataTempRegister, dest, src);
+    }
+
+    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(imm, dataTempRegister);
+        m_assembler.smull(dest, dataTempRegister, src, dataTempRegister);
+    }
+
+    void not32(RegisterID srcDest)
+    {
+        m_assembler.mvn(srcDest, srcDest);
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orr(dest, dest, src);
+    }
+
+    void or32(Imm32 imm, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.orr(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.orr(dest, dest, dataTempRegister);
+        }
+    }
+
+    void rshift32(RegisterID shift_amount, RegisterID dest)
+    {
+        m_assembler.asr(dest, dest, shift_amount);
+    }
+
+    void rshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.asr(dest, dest, imm.m_value);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.sub(dest, dest, src);
+    }
+
+    void sub32(Imm32 imm, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.sub(dest, dest, dataTempRegister);
+        }
+    }
+
+    void sub32(Imm32 imm, Address address)
+    {
+        load32(address, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.sub(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address);
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        sub32(dataTempRegister, dest);
+    }
+
+    void sub32(Imm32 imm, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.sub(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address.m_ptr);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.eor(dest, dest, src);
+    }
+
+    void xor32(Imm32 imm, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.eor(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.eor(dest, dest, dataTempRegister);
+        }
+    }
+    
+
+    // Memory access operations:
+    //
+    // Loads are of the form load(address, destination) and stores of the form
+    // store(source, address).  The source for a store may be an Imm32.  Address
+    // operand objects to loads and store will be implicitly constructed if a
+    // register is passed.
+
+private:
+    void load32(ArmAddress address, RegisterID dest)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.ldr(dest, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.ldr(dest, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.ldr(dest, address.base, address.u.offset, true, false);
+        }
+    }
+
+    void load16(ArmAddress address, RegisterID dest)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.ldrh(dest, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.ldrh(dest, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.ldrh(dest, address.base, address.u.offset, true, false);
+        }
+    }
+
+    void store32(RegisterID src, ArmAddress address)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.str(src, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.str(src, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.str(src, address.base, address.u.offset, true, false);
+        }
+    }
+
+public:
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        load32(setupArmAddress(address), dest);
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        load32(setupArmAddress(address), dest);
+    }
+
+    void load32(void* address, RegisterID dest)
+    {
+        move(ImmPtr(address), addressTempRegister);
+        m_assembler.ldr(dest, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        DataLabel32 label = moveWithPatch(Imm32(address.offset), dataTempRegister);
+        load32(ArmAddress(address.base, dataTempRegister), dest);
+        return label;
+    }
+
+    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
+    {
+        Label label(this);
+        moveFixedWidthEncoding(Imm32(address.offset), dataTempRegister);
+        load32(ArmAddress(address.base, dataTempRegister), dest);
+        return label;
+    }
+
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.ldrh(dest, makeBaseIndexBase(address), address.index, address.scale);
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        DataLabel32 label = moveWithPatch(Imm32(address.offset), dataTempRegister);
+        store32(src, ArmAddress(address.base, dataTempRegister));
+        return label;
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        store32(src, setupArmAddress(address));
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        store32(src, setupArmAddress(address));
+    }
+
+    void store32(Imm32 imm, ImplicitAddress address)
+    {
+        move(imm, dataTempRegister);
+        store32(dataTempRegister, setupArmAddress(address));
+    }
+
+    void store32(RegisterID src, void* address)
+    {
+        move(ImmPtr(address), addressTempRegister);
+        m_assembler.str(src, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    void store32(Imm32 imm, void* address)
+    {
+        move(imm, dataTempRegister);
+        store32(dataTempRegister, address);
+    }
+
+
+    // Floating-point operations:
+
+    bool supportsFloatingPoint() const { return true; }
+    // On x86(_64) the MacroAssembler provides an interface to truncate a double to an integer.
+    // If a value is not representable as an integer, and possibly for some values that are,
+    // (on x86 INT_MIN, since this is indistinguishable from results for out-of-range/NaN input)
+    // a branch will  be taken.  It is not clear whether this interface will be well suited to
+    // other platforms.  On ARMv7 the hardware truncation operation produces multiple possible
+    // failure values (saturates to INT_MIN & INT_MAX, NaN reulsts in a value of 0).  This is a
+    // temporary solution while we work out what this interface should be.  Either we need to
+    // decide to make this interface work on all platforms, rework the interface to make it more
+    // generic, or decide that the MacroAssembler cannot practically be used to abstracted these
+    // operations, and make clients go directly to the m_assembler to plant truncation instructions.
+    // In short, FIXME:.
+    bool supportsFloatingPointTruncate() const { return false; }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        RegisterID base = address.base;
+        int32_t offset = address.offset;
+
+        // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+        if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
+            add32(Imm32(offset), base, addressTempRegister);
+            base = addressTempRegister;
+            offset = 0;
+        }
+        
+        m_assembler.vldr(dest, base, offset);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        RegisterID base = address.base;
+        int32_t offset = address.offset;
+
+        // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+        if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
+            add32(Imm32(offset), base, addressTempRegister);
+            base = addressTempRegister;
+            offset = 0;
+        }
+        
+        m_assembler.vstr(src, base, offset);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vadd_F64(dest, dest, src);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        addDouble(fpTempRegister, dest);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vsub_F64(dest, dest, src);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        subDouble(fpTempRegister, dest);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vmul_F64(dest, dest, src);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        mulDouble(fpTempRegister, dest);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vmov(fpTempRegister, src);
+        m_assembler.vcvt_F64_S32(dest, fpTempRegister);
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        m_assembler.vcmp_F64(left, right);
+        m_assembler.vmrs_APSR_nzcv_FPSCR();
+        return makeBranch(cond);
+    }
+
+    Jump branchTruncateDoubleToInt32(FPRegisterID, RegisterID)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+
+    // Stack manipulation operations:
+    //
+    // The ABI is assumed to provide a stack abstraction to memory,
+    // containing machine word sized units of data.  Push and pop
+    // operations add and remove a single register sized unit of data
+    // to or from the stack.  Peek and poke operations read or write
+    // values on the stack, without moving the current stack position.
+    
+    void pop(RegisterID dest)
+    {
+        // store postindexed with writeback
+        m_assembler.ldr(dest, ARM::sp, sizeof(void*), false, true);
+    }
+
+    void push(RegisterID src)
+    {
+        // store preindexed with writeback
+        m_assembler.str(src, ARM::sp, -sizeof(void*), true, true);
+    }
+
+    void push(Address address)
+    {
+        load32(address, dataTempRegister);
+        push(dataTempRegister);
+    }
+
+    void push(Imm32 imm)
+    {
+        move(imm, dataTempRegister);
+        push(dataTempRegister);
+    }
+
+    // Register move operations:
+    //
+    // Move values in registers.
+
+    void move(Imm32 imm, RegisterID dest)
+    {
+        uint32_t value = imm.m_value;
+
+        if (imm.m_isPointer)
+            moveFixedWidthEncoding(imm, dest);
+        else {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(value);
+
+            if (armImm.isValid())
+                m_assembler.mov(dest, armImm);
+            else if ((armImm = ARMThumbImmediate::makeEncodedImm(~value)).isValid())
+                m_assembler.mvn(dest, armImm);
+            else {
+                m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(value));
+                if (value & 0xffff0000)
+                    m_assembler.movt(dest, ARMThumbImmediate::makeUInt16(value >> 16));
+            }
+        }
+    }
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        m_assembler.mov(dest, src);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        move(Imm32(imm), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        move(reg1, dataTempRegister);
+        move(reg2, reg1);
+        move(dataTempRegister, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+    }
+
+
+    // Forwards / external control flow operations:
+    //
+    // This set of jump and conditional branch operations return a Jump
+    // object which may linked at a later point, allow forwards jump,
+    // or jumps that will require external linkage (after the code has been
+    // relocated).
+    //
+    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
+    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
+    // used (representing the names 'below' and 'above').
+    //
+    // Operands to the comparision are provided in the expected order, e.g.
+    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // treated as a signed 32bit value, is less than or equal to 5.
+    //
+    // jz and jnz test whether the first operand is equal to zero, and take
+    // an optional second operand of a mask under which to perform the test.
+private:
+
+    // Should we be using TEQ for equal/not-equal?
+    void compare32(RegisterID left, Imm32 right)
+    {
+        int32_t imm = right.m_value;
+        if (!imm)
+            m_assembler.tst(left, left);
+        else {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm);
+            if (armImm.isValid())
+                m_assembler.cmp(left, armImm);
+            if ((armImm = ARMThumbImmediate::makeEncodedImm(-imm)).isValid())
+                m_assembler.cmn(left, armImm);
+            else {
+                move(Imm32(imm), dataTempRegister);
+                m_assembler.cmp(left, dataTempRegister);
+            }
+        }
+    }
+
+    void test32(RegisterID reg, Imm32 mask)
+    {
+        int32_t imm = mask.m_value;
+
+        if (imm == -1)
+            m_assembler.tst(reg, reg);
+        else {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm);
+            if (armImm.isValid())
+                m_assembler.tst(reg, armImm);
+            else {
+                move(mask, dataTempRegister);
+                m_assembler.tst(reg, dataTempRegister);
+            }
+        }
+    }
+
+public:
+    Jump branch32(Condition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmp(left, right);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    {
+        compare32(left, right);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Address right)
+    {
+        load32(right, dataTempRegister);
+        return branch32(cond, left, dataTempRegister);
+    }
+
+    Jump branch32(Condition cond, Address left, RegisterID right)
+    {
+        load32(left, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, Address left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32(left, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32(left, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
+    {
+        load32(left.m_ptr, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32(left.m_ptr, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, RegisterID right)
+    {
+        load16(left, dataTempRegister);
+        m_assembler.lsl(addressTempRegister, right, 16);
+        m_assembler.lsl(dataTempRegister, dataTempRegister, 16);
+        return branch32(cond, dataTempRegister, addressTempRegister);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load16(left, addressTempRegister);
+        m_assembler.lsl(addressTempRegister, addressTempRegister, 16);
+        return branch32(cond, addressTempRegister, Imm32(right.m_value << 16));
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        m_assembler.tst(reg, mask);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        test32(reg, mask);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        // use addressTempRegister incase the branchTest32 we call uses dataTempRegister. :-/
+        load32(address, addressTempRegister);
+        return branchTest32(cond, addressTempRegister, mask);
+    }
+
+    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        // use addressTempRegister incase the branchTest32 we call uses dataTempRegister. :-/
+        load32(address, addressTempRegister);
+        return branchTest32(cond, addressTempRegister, mask);
+    }
+
+    Jump jump()
+    {
+        return Jump(makeJump());
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.bx(target);
+    }
+
+    // Address is a memory location containing the address to jump to
+    void jump(Address address)
+    {
+        load32(address, dataTempRegister);
+        m_assembler.bx(dataTempRegister);
+    }
+
+
+    // Arithmetic control flow operations:
+    //
+    // This set of conditional branch operations branch based
+    // on the result of an arithmetic operation.  The operation
+    // is performed as normal, storing the result.
+    //
+    // * jz operations branch if the result is zero.
+    // * jo operations branch if the (signed) arithmetic
+    //   operation caused an overflow to occur.
+    
+    Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        m_assembler.add_S(dest, dest, src);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add_S(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.add_S(dest, dest, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT(cond == Overflow);
+        m_assembler.smull(dest, dataTempRegister, dest, src);
+        m_assembler.asr(addressTempRegister, dest, 31);
+        return branch32(NotEqual, addressTempRegister, dataTempRegister);
+    }
+
+    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        ASSERT(cond == Overflow);
+        move(imm, dataTempRegister);
+        m_assembler.smull(dest, dataTempRegister, src, dataTempRegister);
+        m_assembler.asr(addressTempRegister, dest, 31);
+        return branch32(NotEqual, addressTempRegister, dataTempRegister);
+    }
+
+    Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        m_assembler.sub_S(dest, dest, src);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub_S(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.sub_S(dest, dest, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+    
+
+    // Miscellaneous operations:
+
+    void breakpoint()
+    {
+        m_assembler.bkpt();
+    }
+
+    Call nearCall()
+    {
+        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        return Call(m_assembler.blx(dataTempRegister), Call::LinkableNear);
+    }
+
+    Call call()
+    {
+        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        return Call(m_assembler.blx(dataTempRegister), Call::Linkable);
+    }
+
+    Call call(RegisterID target)
+    {
+        return Call(m_assembler.blx(target), Call::None);
+    }
+
+    Call call(Address address)
+    {
+        load32(address, dataTempRegister);
+        return Call(m_assembler.blx(dataTempRegister), Call::None);
+    }
+
+    void ret()
+    {
+        m_assembler.bx(linkRegister);
+    }
+
+    void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmp(left, right);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    void set32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        compare32(left, right);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    // FIXME:
+    // The mask should be optional... paerhaps the argument order should be
+    // dest-src, operations always have a dest? ... possibly not true, considering
+    // asm ops like test, or pseudo ops like pop().
+    void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        load32(address, dataTempRegister);
+        test32(dataTempRegister, mask);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
+
+
+    DataLabel32 moveWithPatch(Imm32 imm, RegisterID dst)
+    {
+        moveFixedWidthEncoding(imm, dst);
+        return DataLabel32(this);
+    }
+
+    DataLabelPtr moveWithPatch(ImmPtr imm, RegisterID dst)
+    {
+        moveFixedWidthEncoding(Imm32(imm), dst);
+        return DataLabelPtr(this);
+    }
+
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
+        return branch32(cond, left, dataTempRegister);
+    }
+
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        load32(left, addressTempRegister);
+        dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
+        return branch32(cond, addressTempRegister, dataTempRegister);
+    }
+
+    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    {
+        DataLabelPtr label = moveWithPatch(initialValue, dataTempRegister);
+        store32(dataTempRegister, address);
+        return label;
+    }
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address) { return storePtrWithPatch(ImmPtr(0), address); }
+
+
+    Call tailRecursiveCall()
+    {
+        // Like a normal call, but don't link.
+        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        return Call(m_assembler.bx(dataTempRegister), Call::Linkable);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        return tailRecursiveCall();
+    }
+
+
+protected:
+    ARMv7Assembler::JmpSrc makeJump()
+    {
+        return m_assembler.b();
+    }
+
+    ARMv7Assembler::JmpSrc makeBranch(ARMv7Assembler::Condition cond)
+    {
+        m_assembler.it(cond);
+        return m_assembler.b();
+    }
+    ARMv7Assembler::JmpSrc makeBranch(Condition cond) { return makeBranch(armV7Condition(cond)); }
+    ARMv7Assembler::JmpSrc makeBranch(DoubleCondition cond) { return makeBranch(armV7Condition(cond)); }
+
+    ArmAddress setupArmAddress(BaseIndex address)
+    {
+        if (address.offset) {
+            ARMThumbImmediate imm = ARMThumbImmediate::makeUInt12OrEncodedImm(address.offset);
+            if (imm.isValid())
+                m_assembler.add(addressTempRegister, address.base, imm);
+            else {
+                move(Imm32(address.offset), addressTempRegister);
+                m_assembler.add(addressTempRegister, addressTempRegister, address.base);
+            }
+
+            return ArmAddress(addressTempRegister, address.index, address.scale);
+        } else
+            return ArmAddress(address.base, address.index, address.scale);
+    }
+
+    ArmAddress setupArmAddress(Address address)
+    {
+        if ((address.offset >= -0xff) && (address.offset <= 0xfff))
+            return ArmAddress(address.base, address.offset);
+
+        move(Imm32(address.offset), addressTempRegister);
+        return ArmAddress(address.base, addressTempRegister);
+    }
+
+    ArmAddress setupArmAddress(ImplicitAddress address)
+    {
+        if ((address.offset >= -0xff) && (address.offset <= 0xfff))
+            return ArmAddress(address.base, address.offset);
+
+        move(Imm32(address.offset), addressTempRegister);
+        return ArmAddress(address.base, addressTempRegister);
+    }
+
+    RegisterID makeBaseIndexBase(BaseIndex address)
+    {
+        if (!address.offset)
+            return address.base;
+
+        ARMThumbImmediate imm = ARMThumbImmediate::makeUInt12OrEncodedImm(address.offset);
+        if (imm.isValid())
+            m_assembler.add(addressTempRegister, address.base, imm);
+        else {
+            move(Imm32(address.offset), addressTempRegister);
+            m_assembler.add(addressTempRegister, addressTempRegister, address.base);
+        }
+
+        return addressTempRegister;
+    }
+
+    DataLabel32 moveFixedWidthEncoding(Imm32 imm, RegisterID dst)
+    {
+        uint32_t value = imm.m_value;
+        m_assembler.movT3(dst, ARMThumbImmediate::makeUInt16(value & 0xffff));
+        m_assembler.movt(dst, ARMThumbImmediate::makeUInt16(value >> 16));
+    }
+
+    ARMv7Assembler::Condition armV7Condition(Condition cond)
+    {
+        return static_cast<ARMv7Assembler::Condition>(cond);
+    }
+
+    ARMv7Assembler::Condition armV7Condition(DoubleCondition cond)
+    {
+        return static_cast<ARMv7Assembler::Condition>(cond);
+    }
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerARMv7_h
diff --git a/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
new file mode 100644
index 0000000..0aa985c
--- /dev/null
+++ b/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MacroAssemblerCodeRef_h
+#define MacroAssemblerCodeRef_h
+
+#include <wtf/Platform.h>
+
+#include "ExecutableAllocator.h"
+#include "PassRefPtr.h"
+#include "RefPtr.h"
+#include "UnusedParam.h"
+
+#if ENABLE(ASSEMBLER)
+
+// ASSERT_VALID_CODE_POINTER checks that ptr is a non-null pointer, and that it is a valid
+// instruction address on the platform (for example, check any alignment requirements).
+#if PLATFORM(ARM_V7)
+// ARM/thumb instructions must be 16-bit aligned, but all code pointers to be loaded
+// into the processor are decorated with the bottom bit set, indicating that this is
+// thumb code (as oposed to 32-bit traditional ARM).  The first test checks for both
+// decorated and undectorated null, and the second test ensures that the pointer is
+// decorated.
+#define ASSERT_VALID_CODE_POINTER(ptr) \
+    ASSERT(reinterpret_cast<intptr_t>(ptr) & ~1); \
+    ASSERT(reinterpret_cast<intptr_t>(ptr) & 1)
+#else
+#define ASSERT_VALID_CODE_POINTER(ptr) \
+    ASSERT(ptr)
+#endif
+
+namespace JSC {
+
+// FunctionPtr:
+//
+// FunctionPtr should be used to wrap pointers to C/C++ functions in JSC
+// (particularly, the stub functions).
+class FunctionPtr {
+public:
+    FunctionPtr()
+        : m_value(0)
+    {
+    }
+
+    template<typename FunctionType>
+    explicit FunctionPtr(FunctionType* value)
+        : m_value(reinterpret_cast<void*>(value))
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    void* value() const { return m_value; }
+    void* executableAddress() const { return m_value; }
+
+
+private:
+    void* m_value;
+};
+
+// ReturnAddressPtr:
+//
+// ReturnAddressPtr should be used to wrap return addresses generated by processor
+// 'call' instructions exectued in JIT code.  We use return addresses to look up
+// exception and optimization information, and to repatch the call instruction
+// that is the source of the return address.
+class ReturnAddressPtr {
+public:
+    ReturnAddressPtr()
+        : m_value(0)
+    {
+    }
+
+    explicit ReturnAddressPtr(void* value)
+        : m_value(value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    void* value() const { return m_value; }
+
+private:
+    void* m_value;
+};
+
+// MacroAssemblerCodePtr:
+//
+// MacroAssemblerCodePtr should be used to wrap pointers to JIT generated code.
+class MacroAssemblerCodePtr {
+public:
+    MacroAssemblerCodePtr()
+        : m_value(0)
+    {
+    }
+
+    explicit MacroAssemblerCodePtr(void* value)
+#if PLATFORM(ARM_V7)
+        // Decorate the pointer as a thumb code pointer.
+        : m_value(reinterpret_cast<char*>(value) + 1)
+#else
+        : m_value(value)
+#endif
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    explicit MacroAssemblerCodePtr(ReturnAddressPtr ra)
+        : m_value(ra.value())
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    void* executableAddress() const { return m_value; }
+#if PLATFORM(ARM_V7)
+    // To use this pointer as a data address remove the decoration.
+    void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return reinterpret_cast<char*>(m_value) - 1; }
+#else
+    void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return m_value; }
+#endif
+
+private:
+    void* m_value;
+};
+
+// MacroAssemblerCodeRef:
+//
+// A reference to a section of JIT generated code.  A CodeRef consists of a
+// pointer to the code, and a ref pointer to the pool from within which it
+// was allocated.
+class MacroAssemblerCodeRef {
+public:
+    MacroAssemblerCodeRef()
+#ifndef NDEBUG
+        : m_size(0)
+#endif
+    {
+    }
+
+    MacroAssemblerCodeRef(void* code, PassRefPtr<ExecutablePool> executablePool, size_t size)
+        : m_code(code)
+        , m_executablePool(executablePool)
+    {
+#ifndef NDEBUG
+        m_size = size;
+#else
+        UNUSED_PARAM(size);
+#endif
+    }
+
+    MacroAssemblerCodePtr m_code;
+    RefPtr<ExecutablePool> m_executablePool;
+#ifndef NDEBUG
+    size_t m_size;
+#endif
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerCodeRef_h
diff --git a/JavaScriptCore/assembler/MacroAssemblerX86.h b/JavaScriptCore/assembler/MacroAssemblerX86.h
index b85b8b2..aaf98fd 100644
--- a/JavaScriptCore/assembler/MacroAssemblerX86.h
+++ b/JavaScriptCore/assembler/MacroAssemblerX86.h
@@ -36,10 +36,17 @@
 
 class MacroAssemblerX86 : public MacroAssemblerX86Common {
 public:
+    MacroAssemblerX86()
+        : m_isSSE2Present(isSSE2Present())
+    {
+    }
+
     static const Scale ScalePtr = TimesFour;
 
     using MacroAssemblerX86Common::add32;
+    using MacroAssemblerX86Common::and32;
     using MacroAssemblerX86Common::sub32;
+    using MacroAssemblerX86Common::or32;
     using MacroAssemblerX86Common::load32;
     using MacroAssemblerX86Common::store32;
     using MacroAssemblerX86Common::branch32;
@@ -55,6 +62,21 @@
         m_assembler.addl_im(imm.m_value, address.m_ptr);
     }
     
+    void addWithCarry32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.adcl_im(imm.m_value, address.m_ptr);
+    }
+    
+    void and32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.andl_im(imm.m_value, address.m_ptr);
+    }
+    
+    void or32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.orl_im(imm.m_value, address.m_ptr);
+    }
+
     void sub32(Imm32 imm, AbsoluteAddress address)
     {
         m_assembler.subl_im(imm.m_value, address.m_ptr);
@@ -70,16 +92,21 @@
         m_assembler.movl_i32m(imm.m_value, address);
     }
 
+    void store32(RegisterID src, void* address)
+    {
+        m_assembler.movl_rm(src, address);
+    }
+
     Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
     {
         m_assembler.cmpl_rm(right, left.m_ptr);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
     {
         m_assembler.cmpl_im(right.m_value, left.m_ptr);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Call call()
@@ -98,25 +125,45 @@
     }
 
 
+    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    {
+        m_assembler.movl_i32r(initialValue.asIntptr(), dest);
+        return DataLabelPtr(this);
+    }
+
     Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
     {
         m_assembler.cmpl_ir_force32(initialRightValue.asIntptr(), left);
         dataLabel = DataLabelPtr(this);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
     {
         m_assembler.cmpl_im_force32(initialRightValue.asIntptr(), left.offset, left.base);
         dataLabel = DataLabelPtr(this);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    DataLabelPtr storePtrWithPatch(Address address)
+    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
     {
-        m_assembler.movl_i32m(0, address.offset, address.base);
+        m_assembler.movl_i32m(initialValue.asIntptr(), address.offset, address.base);
         return DataLabelPtr(this);
     }
+
+    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
+    {
+        Label label(this);
+        load32(address, dest);
+        return label;
+    }
+
+    bool supportsFloatingPoint() const { return m_isSSE2Present; }
+    // See comment on MacroAssemblerARMv7::supportsFloatingPointTruncate()
+    bool supportsFloatingPointTruncate() const { return m_isSSE2Present; }
+
+private:
+    const bool m_isSSE2Present;
 };
 
 } // namespace JSC
diff --git a/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index 5fcd25d..cea691e 100644
--- a/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -38,20 +38,30 @@
 class MacroAssemblerX86Common : public AbstractMacroAssembler<X86Assembler> {
 public:
 
-    typedef X86Assembler::Condition Condition;
-    static const Condition Equal = X86Assembler::ConditionE;
-    static const Condition NotEqual = X86Assembler::ConditionNE;
-    static const Condition Above = X86Assembler::ConditionA;
-    static const Condition AboveOrEqual = X86Assembler::ConditionAE;
-    static const Condition Below = X86Assembler::ConditionB;
-    static const Condition BelowOrEqual = X86Assembler::ConditionBE;
-    static const Condition GreaterThan = X86Assembler::ConditionG;
-    static const Condition GreaterThanOrEqual = X86Assembler::ConditionGE;
-    static const Condition LessThan = X86Assembler::ConditionL;
-    static const Condition LessThanOrEqual = X86Assembler::ConditionLE;
-    static const Condition Overflow = X86Assembler::ConditionO;
-    static const Condition Zero = X86Assembler::ConditionE;
-    static const Condition NonZero = X86Assembler::ConditionNE;
+    enum Condition {
+        Equal = X86Assembler::ConditionE,
+        NotEqual = X86Assembler::ConditionNE,
+        Above = X86Assembler::ConditionA,
+        AboveOrEqual = X86Assembler::ConditionAE,
+        Below = X86Assembler::ConditionB,
+        BelowOrEqual = X86Assembler::ConditionBE,
+        GreaterThan = X86Assembler::ConditionG,
+        GreaterThanOrEqual = X86Assembler::ConditionGE,
+        LessThan = X86Assembler::ConditionL,
+        LessThanOrEqual = X86Assembler::ConditionLE,
+        Overflow = X86Assembler::ConditionO,
+        Signed = X86Assembler::ConditionS,
+        Zero = X86Assembler::ConditionE,
+        NonZero = X86Assembler::ConditionNE
+    };
+
+    enum DoubleCondition {
+        DoubleEqual = X86Assembler::ConditionE,
+        DoubleGreaterThan = X86Assembler::ConditionA,
+        DoubleGreaterThanOrEqual = X86Assembler::ConditionAE,
+        DoubleLessThan = X86Assembler::ConditionB,
+        DoubleLessThanOrEqual = X86Assembler::ConditionBE,
+    };
 
     static const RegisterID stackPointerRegister = X86::esp;
 
@@ -92,6 +102,11 @@
         m_assembler.andl_ir(imm.m_value, dest);
     }
 
+    void and32(Imm32 imm, Address address)
+    {
+        m_assembler.andl_im(imm.m_value, address.offset, address.base);
+    }
+
     void lshift32(Imm32 imm, RegisterID dest)
     {
         m_assembler.shll_i8r(imm.m_value, dest);
@@ -144,6 +159,11 @@
         m_assembler.orl_ir(imm.m_value, dest);
     }
 
+    void or32(Imm32 imm, Address address)
+    {
+        m_assembler.orl_im(imm.m_value, address.offset, address.base);
+    }
+
     void rshift32(RegisterID shift_amount, RegisterID dest)
     {
         // On x86 we can only shift by ecx; if asked to shift by another register we'll
@@ -250,7 +270,84 @@
     {
         m_assembler.movl_i32m(imm.m_value, address.offset, address.base);
     }
-    
+
+
+    // Floating-point operation:
+    //
+    // Presently only supports SSE, not x87 floating point.
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_mr(address.offset, address.base, dest);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_rm(src, address.offset, address.base);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.addsd_rr(src, dest);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.addsd_mr(src.offset, src.base, dest);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.subsd_rr(src, dest);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.subsd_mr(src.offset, src.base, dest);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.mulsd_rr(src, dest);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.mulsd_mr(src.offset, src.base, dest);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvtsi2sd_rr(src, dest);
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.ucomisd_rr(right, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    // Truncates 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, INT_MIN).
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttsd2si_rr(src, dest);
+        return branch32(Equal, dest, Imm32(0x80000000));
+    }
+
 
     // Stack manipulation operations:
     //
@@ -280,6 +377,7 @@
         m_assembler.push_i32(imm.m_value);
     }
 
+
     // Register move operations:
     //
     // Move values in registers.
@@ -327,7 +425,8 @@
 #else
     void move(RegisterID src, RegisterID dest)
     {
-        m_assembler.movl_rr(src, dest);
+        if (src != dest)
+            m_assembler.movl_rr(src, dest);
     }
 
     void move(ImmPtr imm, RegisterID dest)
@@ -337,19 +436,18 @@
 
     void swap(RegisterID reg1, RegisterID reg2)
     {
-        m_assembler.xchgl_rr(reg1, reg2);
+        if (reg1 != reg2)
+            m_assembler.xchgl_rr(reg1, reg2);
     }
 
     void signExtend32ToPtr(RegisterID src, RegisterID dest)
     {
-        if (src != dest)
-            move(src, dest);
+        move(src, dest);
     }
 
     void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
     {
-        if (src != dest)
-            move(src, dest);
+        move(src, dest);
     }
 #endif
 
@@ -376,7 +474,7 @@
     Jump branch32(Condition cond, RegisterID left, RegisterID right)
     {
         m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branch32(Condition cond, RegisterID left, Imm32 right)
@@ -385,38 +483,52 @@
             m_assembler.testl_rr(left, left);
         else
             m_assembler.cmpl_ir(right.m_value, left);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
     Jump branch32(Condition cond, RegisterID left, Address right)
     {
         m_assembler.cmpl_mr(right.offset, right.base, left);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
     Jump branch32(Condition cond, Address left, RegisterID right)
     {
         m_assembler.cmpl_rm(right, left.offset, left.base);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branch32(Condition cond, Address left, Imm32 right)
     {
         m_assembler.cmpl_im(right.m_value, left.offset, left.base);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    {
+        m_assembler.cmpl_im(right.m_value, left.offset, left.base, left.index, left.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branch16(Condition cond, BaseIndex left, RegisterID right)
     {
         m_assembler.cmpw_rm(right, left.offset, left.base, left.index, left.scale);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    {
+        ASSERT(!(right.m_value & 0xFFFF0000));
+
+        m_assembler.cmpw_im(right.m_value, left.offset, left.base, left.index, left.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         m_assembler.testl_rr(reg, mask);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
@@ -429,7 +541,7 @@
             m_assembler.testb_i8r(mask.m_value, reg);
         else
             m_assembler.testl_i32r(mask.m_value, reg);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
@@ -439,7 +551,7 @@
             m_assembler.cmpl_im(0, address.offset, address.base);
         else
             m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
@@ -449,7 +561,7 @@
             m_assembler.cmpl_im(0, address.offset, address.base, address.index, address.scale);
         else
             m_assembler.testl_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump jump()
@@ -481,44 +593,44 @@
     
     Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
     {
-        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         add32(src, dest);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
-    
+
     Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
     {
-        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         add32(imm, dest);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
     Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
     {
-        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        ASSERT(cond == Overflow);
         mul32(src, dest);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
     Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
     {
-        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        ASSERT(cond == Overflow);
         mul32(imm, src, dest);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
     Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
     {
-        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         sub32(src, dest);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
     Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
     {
-        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         sub32(imm, dest);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
 
@@ -539,6 +651,11 @@
         return Call(m_assembler.call(target), Call::None);
     }
 
+    void call(Address address)
+    {
+        m_assembler.call_m(address.offset, address.base);
+    }
+
     void ret()
     {
         m_assembler.ret();
@@ -547,7 +664,7 @@
     void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
     {
         m_assembler.cmpl_rr(right, left);
-        m_assembler.setCC_r(cond, dest);
+        m_assembler.setCC_r(x86Condition(cond), dest);
         m_assembler.movzbl_rr(dest, dest);
     }
 
@@ -557,7 +674,7 @@
             m_assembler.testl_rr(left, left);
         else
             m_assembler.cmpl_ir(right.m_value, left);
-        m_assembler.setCC_r(cond, dest);
+        m_assembler.setCC_r(x86Condition(cond), dest);
         m_assembler.movzbl_rr(dest, dest);
     }
 
@@ -571,9 +688,89 @@
             m_assembler.cmpl_im(0, address.offset, address.base);
         else
             m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
-        m_assembler.setCC_r(cond, dest);
+        m_assembler.setCC_r(x86Condition(cond), dest);
         m_assembler.movzbl_rr(dest, dest);
     }
+
+protected:
+    X86Assembler::Condition x86Condition(Condition cond)
+    {
+        return static_cast<X86Assembler::Condition>(cond);
+    }
+
+    X86Assembler::Condition x86Condition(DoubleCondition cond)
+    {
+        return static_cast<X86Assembler::Condition>(cond);
+    }
+
+private:
+    // Only MacroAssemblerX86 should be using the following method; SSE2 is always available on
+    // x86_64, and clients & subclasses of MacroAssembler should be using 'supportsFloatingPoint()'.
+    friend class MacroAssemblerX86;
+
+#if PLATFORM(X86)
+#if PLATFORM(MAC)
+
+    // All X86 Macs are guaranteed to support at least SSE2,
+    static bool isSSE2Present()
+    {
+        return true;
+    }
+
+#else // PLATFORM(MAC)
+
+    enum SSE2CheckState {
+        NotCheckedSSE2,
+        HasSSE2,
+        NoSSE2
+    };
+
+    static bool isSSE2Present()
+    {
+        if (s_sse2CheckState == NotCheckedSSE2) {
+            // Default the flags value to zero; if the compiler is
+            // not MSVC or GCC we will read this as SSE2 not present.
+            int flags = 0;
+#if COMPILER(MSVC)
+            _asm {
+                mov eax, 1 // cpuid function 1 gives us the standard feature set
+                cpuid;
+                mov flags, edx;
+            }
+#elif COMPILER(GCC)
+            asm (
+                 "movl $0x1, %%eax;"
+                 "pushl %%ebx;"
+                 "cpuid;"
+                 "popl %%ebx;"
+                 "movl %%edx, %0;"
+                 : "=g" (flags)
+                 :
+                 : "%eax", "%ecx", "%edx"
+                 );
+#endif
+            static const int SSE2FeatureBit = 1 << 26;
+            s_sse2CheckState = (flags & SSE2FeatureBit) ? HasSSE2 : NoSSE2;
+        }
+        // Only check once.
+        ASSERT(s_sse2CheckState != NotCheckedSSE2);
+
+        return s_sse2CheckState == HasSSE2;
+    }
+    
+    static SSE2CheckState s_sse2CheckState;
+
+#endif // PLATFORM(MAC)
+#elif !defined(NDEBUG) // PLATFORM(X86)
+
+    // On x86-64 we should never be checking for SSE2 in a non-debug build,
+    // but non debug add this method to keep the asserts above happy.
+    static bool isSSE2Present()
+    {
+        return true;
+    }
+
+#endif
 };
 
 } // namespace JSC
diff --git a/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index 971787b..ffdca7c 100644
--- a/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -42,6 +42,8 @@
     static const Scale ScalePtr = TimesEight;
 
     using MacroAssemblerX86Common::add32;
+    using MacroAssemblerX86Common::and32;
+    using MacroAssemblerX86Common::or32;
     using MacroAssemblerX86Common::sub32;
     using MacroAssemblerX86Common::load32;
     using MacroAssemblerX86Common::store32;
@@ -53,6 +55,18 @@
         add32(imm, Address(scratchRegister));
     }
     
+    void and32(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        and32(imm, Address(scratchRegister));
+    }
+    
+    void or32(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        or32(imm, Address(scratchRegister));
+    }
+
     void sub32(Imm32 imm, AbsoluteAddress address)
     {
         move(ImmPtr(address.m_ptr), scratchRegister);
@@ -122,9 +136,20 @@
 
     void addPtr(Imm32 imm, RegisterID src, RegisterID dest)
     {
-        m_assembler.leal_mr(imm.m_value, src, dest);
+        m_assembler.leaq_mr(imm.m_value, src, dest);
     }
 
+    void addPtr(Imm32 imm, Address address)
+    {
+        m_assembler.addq_im(imm.m_value, address.offset, address.base);
+    }
+
+    void addPtr(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        addPtr(imm, Address(scratchRegister));
+    }
+    
     void andPtr(RegisterID src, RegisterID dest)
     {
         m_assembler.andq_rr(src, dest);
@@ -241,6 +266,17 @@
     {
         m_assembler.movq_rm(src, address.offset, address.base, address.index, address.scale);
     }
+    
+    void storePtr(RegisterID src, void* address)
+    {
+        if (src == X86::eax)
+            m_assembler.movq_EAXm(address);
+        else {
+            swap(X86::eax, src);
+            m_assembler.movq_EAXm(address);
+            swap(X86::eax, src);
+        }
+    }
 
     void storePtr(ImmPtr imm, ImplicitAddress address)
     {
@@ -259,20 +295,30 @@
         return DataLabel32(this);
     }
 
+    void movePtrToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.movq_rr(src, dest);
+    }
+
+    void moveDoubleToPtr(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.movq_rr(src, dest);
+    }
+
     void setPtr(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
     {
         if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
             m_assembler.testq_rr(left, left);
         else
             m_assembler.cmpq_ir(right.m_value, left);
-        m_assembler.setCC_r(cond, dest);
+        m_assembler.setCC_r(x86Condition(cond), dest);
         m_assembler.movzbl_rr(dest, dest);
     }
 
     Jump branchPtr(Condition cond, RegisterID left, RegisterID right)
     {
         m_assembler.cmpq_rr(right, left);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchPtr(Condition cond, RegisterID left, ImmPtr right)
@@ -283,7 +329,7 @@
                 m_assembler.testq_rr(left, left);
             else
                 m_assembler.cmpq_ir(imm, left);
-            return Jump(m_assembler.jCC(cond));
+            return Jump(m_assembler.jCC(x86Condition(cond)));
         } else {
             move(right, scratchRegister);
             return branchPtr(cond, left, scratchRegister);
@@ -293,7 +339,7 @@
     Jump branchPtr(Condition cond, RegisterID left, Address right)
     {
         m_assembler.cmpq_mr(right.offset, right.base, left);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchPtr(Condition cond, AbsoluteAddress left, RegisterID right)
@@ -305,7 +351,7 @@
     Jump branchPtr(Condition cond, Address left, RegisterID right)
     {
         m_assembler.cmpq_rm(right, left.offset, left.base);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchPtr(Condition cond, Address left, ImmPtr right)
@@ -317,7 +363,7 @@
     Jump branchTestPtr(Condition cond, RegisterID reg, RegisterID mask)
     {
         m_assembler.testq_rr(reg, mask);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchTestPtr(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
@@ -329,7 +375,7 @@
             m_assembler.testb_i8r(mask.m_value, reg);
         else
             m_assembler.testq_i32r(mask.m_value, reg);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchTestPtr(Condition cond, Address address, Imm32 mask = Imm32(-1))
@@ -338,7 +384,7 @@
             m_assembler.cmpq_im(0, address.offset, address.base);
         else
             m_assembler.testq_i32m(mask.m_value, address.offset, address.base);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchTestPtr(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
@@ -347,7 +393,7 @@
             m_assembler.cmpq_im(0, address.offset, address.base, address.index, address.scale);
         else
             m_assembler.testq_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
 
@@ -355,14 +401,14 @@
     {
         ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
         addPtr(src, dest);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     Jump branchSubPtr(Condition cond, Imm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
         subPtr(imm, dest);
-        return Jump(m_assembler.jCC(cond));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
     DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
@@ -383,12 +429,23 @@
         return branchPtr(cond, left, scratchRegister);
     }
 
-    DataLabelPtr storePtrWithPatch(Address address)
+    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
     {
-        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        DataLabelPtr label = moveWithPatch(initialValue, scratchRegister);
         storePtr(scratchRegister, address);
         return label;
     }
+
+    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
+    {
+        Label label(this);
+        loadPtr(address, dest);
+        return label;
+    }
+
+    bool supportsFloatingPoint() const { return true; }
+    // See comment on MacroAssemblerARMv7::supportsFloatingPointTruncate()
+    bool supportsFloatingPointTruncate() const { return true; }
 };
 
 } // namespace JSC
diff --git a/JavaScriptCore/assembler/X86Assembler.h b/JavaScriptCore/assembler/X86Assembler.h
index bcafda1..7a8b58d 100644
--- a/JavaScriptCore/assembler/X86Assembler.h
+++ b/JavaScriptCore/assembler/X86Assembler.h
@@ -41,8 +41,6 @@
 #if PLATFORM(X86_64)
 inline bool CAN_SIGN_EXTEND_32_64(intptr_t value) { return value == (intptr_t)(int32_t)value; }
 inline bool CAN_SIGN_EXTEND_U32_64(intptr_t value) { return value == (intptr_t)(uint32_t)value; }
-
-#define REPTACH_OFFSET_CALL_R11 3
 #endif
 
 namespace X86 {
@@ -84,6 +82,7 @@
 public:
     typedef X86::RegisterID RegisterID;
     typedef X86::XMMRegisterID XMMRegisterID;
+    typedef XMMRegisterID FPRegisterID;
 
     typedef enum {
         ConditionO,
@@ -193,6 +192,7 @@
     typedef enum {
         GROUP1_OP_ADD = 0,
         GROUP1_OP_OR  = 1,
+        GROUP1_OP_ADC = 2,
         GROUP1_OP_AND = 4,
         GROUP1_OP_SUB = 5,
         GROUP1_OP_XOR = 6,
@@ -295,6 +295,19 @@
 
     // Arithmetic operations:
 
+#if !PLATFORM(X86_64)
+    void adcl_im(int imm, void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADC, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_ADC, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
+#endif
+
     void addl_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp(OP_ADD_EvGv, src, dst);
@@ -343,6 +356,17 @@
             m_formatter.immediate32(imm);
         }
     }
+
+    void addq_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
 #else
     void addl_im(int imm, void* addr)
     {
@@ -372,6 +396,17 @@
         }
     }
 
+    void andl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_AND, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_AND, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
 #if PLATFORM(X86_64)
     void andq_rr(RegisterID src, RegisterID dst)
     {
@@ -388,6 +423,17 @@
             m_formatter.immediate32(imm);
         }
     }
+#else
+    void andl_im(int imm, void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_AND, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_AND, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
 #endif
 
     void notl_r(RegisterID dst)
@@ -416,6 +462,17 @@
         }
     }
 
+    void orl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_OR, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_OR, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
 #if PLATFORM(X86_64)
     void orq_rr(RegisterID src, RegisterID dst)
     {
@@ -432,6 +489,17 @@
             m_formatter.immediate32(imm);
         }
     }
+#else
+    void orl_im(int imm, void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_OR, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_OR, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
 #endif
 
     void subl_rr(RegisterID src, RegisterID dst)
@@ -726,6 +794,19 @@
         m_formatter.oneByteOp(OP_CMP_EvGv, src, base, index, scale, offset);
     }
 
+    void cmpw_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.prefix(PRE_OPERAND_SIZE);
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.prefix(PRE_OPERAND_SIZE);
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate16(imm);
+        }
+    }
+
     void testl_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp(OP_TEST_EvGv, src, dst);
@@ -774,6 +855,12 @@
     }
 #endif 
 
+    void testw_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_OPERAND_SIZE);
+        m_formatter.oneByteOp(OP_TEST_EvGv, src, dst);
+    }
+    
     void testb_i8r(int imm, RegisterID dst)
     {
         m_formatter.oneByteOp8(OP_GROUP3_EbIb, GROUP3_OP_TEST, dst);
@@ -918,6 +1005,12 @@
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
     }
 
+    void movq_EAXm(void* addr)
+    {
+        m_formatter.oneByteOp64(OP_MOV_OvEAX);
+        m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
+    }
+
     void movq_mr(int offset, RegisterID base, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_MOV_GvEv, dst, base, offset);
@@ -952,6 +1045,14 @@
     
     
 #else
+    void movl_rm(RegisterID src, void* addr)
+    {
+        if (src == X86::eax)
+            movl_EAXm(addr);
+        else 
+            m_formatter.oneByteOp(OP_MOV_EvGv, src, addr);
+    }
+    
     void movl_mr(void* addr, RegisterID dst)
     {
         if (dst == X86::eax)
@@ -989,6 +1090,12 @@
     {
         m_formatter.oneByteOp(OP_LEA, dst, base, offset);
     }
+#if PLATFORM(X86_64)
+    void leaq_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_LEA, dst, base, offset);
+    }
+#endif
 
     // Flow control:
 
@@ -1003,6 +1110,11 @@
         m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_CALLN, dst);
         return JmpSrc(m_formatter.size());
     }
+    
+    void call_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_CALLN, base, offset);
+    }
 
     JmpSrc jmp()
     {
@@ -1241,74 +1353,83 @@
     }
 
     // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer.  Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
 
     void linkJump(JmpSrc from, JmpDst to)
     {
-        ASSERT(to.m_offset != -1);
         ASSERT(from.m_offset != -1);
-        
-        reinterpret_cast<int*>(reinterpret_cast<ptrdiff_t>(m_formatter.data()) + from.m_offset)[-1] = to.m_offset - from.m_offset;
+        ASSERT(to.m_offset != -1);
+
+        char* code = reinterpret_cast<char*>(m_formatter.data());
+        patchRel32(code + from.m_offset, code + to.m_offset);
     }
     
     static void linkJump(void* code, JmpSrc from, void* to)
     {
         ASSERT(from.m_offset != -1);
-        ptrdiff_t linkOffset = reinterpret_cast<ptrdiff_t>(to) - (reinterpret_cast<ptrdiff_t>(code) + from.m_offset);
-        ASSERT(linkOffset == static_cast<int>(linkOffset));
-        reinterpret_cast<int*>(reinterpret_cast<ptrdiff_t>(code) + from.m_offset)[-1] = linkOffset;
-    }
-    
-    static void patchJump(intptr_t where, void* destination)
-    {
-        intptr_t offset = reinterpret_cast<intptr_t>(destination) - where;
-        ASSERT(offset == static_cast<int32_t>(offset));
-        reinterpret_cast<int32_t*>(where)[-1] = static_cast<int32_t>(offset);
-    }
-    
-#if PLATFORM(X86_64)
-    // FIXME: transition these functions out of here - the assembler
-    // shouldn't know that that this is mov/call pair using r11. :-/
-    static void patchMacroAssemblerCall(intptr_t where, void* destination)
-    {
-        patchAddress(reinterpret_cast<void*>(where - REPTACH_OFFSET_CALL_R11), JmpDst(0), destination);
-    }
-#else
-    static void patchMacroAssemblerCall(intptr_t where, void* destination)
-    {
-        intptr_t offset = reinterpret_cast<intptr_t>(destination) - where;
-        ASSERT(offset == static_cast<int32_t>(offset));
-        reinterpret_cast<int32_t*>(where)[-1] = static_cast<int32_t>(offset);
-    }
-#endif
 
-    void linkCall(JmpSrc from, JmpDst to)
-    {
-        ASSERT(to.m_offset != -1);
-        ASSERT(from.m_offset != -1);
-        
-        reinterpret_cast<int*>(reinterpret_cast<ptrdiff_t>(m_formatter.data()) + from.m_offset)[-1] = to.m_offset - from.m_offset;
+        patchRel32(reinterpret_cast<char*>(code) + from.m_offset, to);
     }
-    
+
     static void linkCall(void* code, JmpSrc from, void* to)
     {
         ASSERT(from.m_offset != -1);
-        ptrdiff_t linkOffset = reinterpret_cast<ptrdiff_t>(to) - (reinterpret_cast<ptrdiff_t>(code) + from.m_offset);
-        ASSERT(linkOffset == static_cast<int>(linkOffset));
-        reinterpret_cast<int*>(reinterpret_cast<ptrdiff_t>(code) + from.m_offset)[-1] = linkOffset;
+
+        patchRel32(reinterpret_cast<char*>(code) + from.m_offset, to);
     }
 
-    static void patchCall(intptr_t where, void* destination)
+#if PLATFORM(X86_64)
+    static void patchPointerForCall(void* where, void* value)
     {
-        intptr_t offset = reinterpret_cast<intptr_t>(destination) - where;
-        ASSERT(offset == static_cast<int32_t>(offset));
-        reinterpret_cast<int32_t*>(where)[-1] = static_cast<int32_t>(offset);
+        reinterpret_cast<void**>(where)[-1] = value;
+    }
+#endif
+
+    static void patchPointer(void* code, JmpDst where, void* value)
+    {
+        ASSERT(where.m_offset != -1);
+
+        patchPointer(reinterpret_cast<char*>(code) + where.m_offset, value);
     }
 
-    static void patchAddress(void* code, JmpDst position, void* value)
+    static void relinkJump(void* from, void* to)
     {
-        ASSERT(position.m_offset != -1);
-        
-        reinterpret_cast<void**>(reinterpret_cast<ptrdiff_t>(code) + position.m_offset)[-1] = value;
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(from) - sizeof(int32_t), sizeof(int32_t));
+        patchRel32(from, to);
+    }
+    
+    static void relinkCall(void* from, void* to)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(from) - sizeof(int32_t), sizeof(int32_t));
+        patchRel32(from, to);
+    }
+
+    static void repatchInt32(void* where, int32_t value)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(where) - sizeof(int32_t), sizeof(int32_t));
+        patchInt32(where, value);
+    }
+
+    static void repatchPointer(void* where, void* value)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(where) - sizeof(void*), sizeof(void*));
+        patchPointer(where, value);
+    }
+
+    static void repatchLoadPtrToLEA(void* where)
+    {
+#if PLATFORM(X86_64)
+        // On x86-64 pointer memory accesses require a 64-bit operand, and as such a REX prefix.
+        // Skip over the prefix byte.
+        where = reinterpret_cast<char*>(where) + 1;
+#endif
+        ExecutableAllocator::MakeWritable unprotect(where, 1);
+        *reinterpret_cast<unsigned char*>(where) = static_cast<unsigned char>(OP_LEA);
     }
     
     static unsigned getCallReturnOffset(JmpSrc call)
@@ -1319,6 +1440,8 @@
 
     static void* getRelocatedAddress(void* code, JmpSrc jump)
     {
+        ASSERT(jump.m_offset != -1);
+
         return reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(code) + jump.m_offset);
     }
     
@@ -1344,16 +1467,6 @@
         return dst.m_offset - src.m_offset;
     }
     
-    static void patchImmediate(intptr_t where, int32_t value)
-    {
-        reinterpret_cast<int32_t*>(where)[-1] = value;
-    }
-    
-    static void patchPointer(intptr_t where, intptr_t value)
-    {
-        reinterpret_cast<intptr_t*>(where)[-1] = value;
-    }
-    
     void* executableCopy(ExecutablePool* allocator)
     {
         void* copy = m_formatter.executableCopy(allocator);
@@ -1363,6 +1476,24 @@
 
 private:
 
+    static void patchPointer(void* where, void* value)
+    {
+        reinterpret_cast<void**>(where)[-1] = value;
+    }
+
+    static void patchInt32(void* where, int32_t value)
+    {
+        reinterpret_cast<int32_t*>(where)[-1] = value;
+    }
+
+    static void patchRel32(void* from, void* to)
+    {
+        intptr_t offset = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(from);
+        ASSERT(offset == static_cast<int32_t>(offset));
+
+        patchInt32(from, offset);
+    }
+
     class X86InstructionFormatter {
 
         static const int maxInstructionSize = 16;
@@ -1604,6 +1735,11 @@
             m_buffer.putByteUnchecked(imm);
         }
 
+        void immediate16(int imm)
+        {
+            m_buffer.putShortUnchecked(imm);
+        }
+
         void immediate32(int imm)
         {
             m_buffer.putIntUnchecked(imm);
diff --git a/JavaScriptCore/bytecode/CodeBlock.cpp b/JavaScriptCore/bytecode/CodeBlock.cpp
index be060d0..d2b122a 100644
--- a/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -55,7 +55,7 @@
     return result;
 }
 
-static UString valueToSourceString(ExecState* exec, JSValuePtr val)
+static UString valueToSourceString(ExecState* exec, JSValue val)
 {
     if (val.isString()) {
         UString result("\"");
@@ -74,7 +74,7 @@
     return (UString("r") + UString::from(r)).UTF8String();
 }
 
-static CString constantName(ExecState* exec, int k, JSValuePtr value)
+static CString constantName(ExecState* exec, int k, JSValue value)
 {
     return (valueToSourceString(exec, value) + "(@k" + UString::from(k) + ")").UTF8String();
 }
@@ -357,7 +357,7 @@
         unsigned registerIndex = m_numVars;
         size_t i = 0;
         do {
-            printf("   r%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue(exec)).ascii());
+            printf("   r%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).ascii());
             ++i;
             ++registerIndex;
         } while (i < m_constantRegisters.size());
@@ -497,6 +497,10 @@
             printf("[%4d] create_arguments\n", location);
             break;
         }
+        case op_init_arguments: {
+            printf("[%4d] init_arguments\n", location);
+            break;
+        }
         case op_convert_this: {
             int r0 = (++it)->u.operand;
             printf("[%4d] convert_this %s\n", location, registerName(r0).c_str());
@@ -703,7 +707,7 @@
         }
         case op_resolve_global: {
             int r0 = (++it)->u.operand;
-            JSValuePtr scope = JSValuePtr((++it)->u.jsCell);
+            JSValue scope = JSValue((++it)->u.jsCell);
             int id0 = (++it)->u.operand;
             printf("[%4d] resolve_global\t %s, %s, %s\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), idName(id0, m_identifiers[id0]).c_str());
             it += 2;
@@ -725,13 +729,13 @@
         }
         case op_get_global_var: {
             int r0 = (++it)->u.operand;
-            JSValuePtr scope = JSValuePtr((++it)->u.jsCell);
+            JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
             printf("[%4d] get_global_var\t %s, %s, %d\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), index);
             break;
         }
         case op_put_global_var: {
-            JSValuePtr scope = JSValuePtr((++it)->u.jsCell);
+            JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
             int r0 = (++it)->u.operand;
             printf("[%4d] put_global_var\t %s, %d, %s\n", location, valueToSourceString(exec, scope).ascii(), index, registerName(r0).c_str());
@@ -823,6 +827,10 @@
             printf("[%4d] put_setter\t %s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
             break;
         }
+        case op_method_check: {
+            printf("[%4d] op_method_check\n", location);
+            break;
+        }
         case op_del_by_id: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -888,6 +896,13 @@
             printConditionalJump(begin, it, location, "jneq_null");
             break;
         }
+        case op_jneq_ptr: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            break;
+        }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -895,6 +910,13 @@
             printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
             break;
         }
+        case op_jnlesseq: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            break;
+        }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -958,6 +980,18 @@
             printf("[%4d] call_eval\t %s, %s, %d, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset);
             break;
         }
+        case op_call_varargs: {
+            int dst = (++it)->u.operand;
+            int func = (++it)->u.operand;
+            int argCount = (++it)->u.operand;
+            int registerOffset = (++it)->u.operand;
+            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), registerName(argCount).c_str(), registerOffset);
+            break;
+        }
+        case op_load_varargs: {
+            printUnaryOp(location, it, "load_varargs");
+            break;
+        }
         case op_tear_off_activation: {
             int r0 = (++it)->u.operand;
             printf("[%4d] tear_off_activation\t %s\n", location, registerName(r0).c_str());
@@ -988,6 +1022,19 @@
             printf("[%4d] construct_verify\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
             break;
         }
+        case op_strcat: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int count = (++it)->u.operand;
+            printf("[%4d] op_strcat\t %s, %s, %d\n", location, registerName(r0).c_str(), registerName(r1).c_str(), count);
+            break;
+        }
+        case op_to_primitive: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printf("[%4d] op_to_primitive\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            break;
+        }
         case op_get_pnames: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -1267,6 +1314,11 @@
             callLinkInfo->callee->removeCaller(callLinkInfo);
     }
 
+    for (size_t size = m_methodCallLinkInfos.size(), i = 0; i < size; ++i) {
+        if (Structure* structure = m_methodCallLinkInfos[i].cachedStructure)
+            structure->deref();
+    }
+
     unlinkCallers();
 #endif
 
@@ -1420,7 +1472,7 @@
 
 #if ENABLE(JIT)
             JIT::compile(m_globalData, &newCodeBlock);
-            ASSERT(newCodeBlock.m_jitCode.codeSize == m_jitCode.codeSize);
+            ASSERT(newFunctionBody->generatedJITCode().size() == ownerNode()->generatedJITCode().size());
 #endif
 
             m_exceptionInfo.set(newCodeBlock.m_exceptionInfo.release());
@@ -1441,7 +1493,7 @@
 
 #if ENABLE(JIT)
             JIT::compile(m_globalData, &newCodeBlock);
-            ASSERT(newCodeBlock.m_jitCode.codeSize == m_jitCode.codeSize);
+            ASSERT(newEvalBody->generatedJITCode().size() == ownerNode()->generatedJITCode().size());
 #endif
 
             m_exceptionInfo.set(newCodeBlock.m_exceptionInfo.release());
@@ -1635,9 +1687,9 @@
 #endif
 
 #if ENABLE(JIT)
-void CodeBlock::setJITCode(JITCodeRef& jitCode)
+void CodeBlock::setJITCode(JITCode jitCode)
 {
-    m_jitCode = jitCode;
+    ownerNode()->setJITCode(jitCode);
 #if !ENABLE(OPCODE_SAMPLING)
     if (!BytecodeGenerator::dumpsGeneratedCode())
         m_instructions.clear();
diff --git a/JavaScriptCore/bytecode/CodeBlock.h b/JavaScriptCore/bytecode/CodeBlock.h
index 9bd4090..ac29c6c 100644
--- a/JavaScriptCore/bytecode/CodeBlock.h
+++ b/JavaScriptCore/bytecode/CodeBlock.h
@@ -63,34 +63,6 @@
 #endif
     };
 
-#if ENABLE(JIT)
-    // The code, and the associated pool from which it was allocated.
-    struct JITCodeRef {
-        JITCode code;
-#ifndef NDEBUG
-        unsigned codeSize;
-#endif
-        RefPtr<ExecutablePool> executablePool;
-
-        JITCodeRef()
-            : code(0)
-#ifndef NDEBUG
-            , codeSize(0)
-#endif
-        {
-        }
-        
-        JITCodeRef(void* code, PassRefPtr<ExecutablePool> executablePool)
-            : code(code)
-#ifndef NDEBUG
-            , codeSize(0)
-#endif
-            , executablePool(executablePool)
-        {
-        }
-    };
-#endif
-
     struct ExpressionRangeInfo {
         enum {
             MaxOffset = (1 << 7) - 1, 
@@ -134,6 +106,17 @@
         bool isLinked() { return callee; }
     };
 
+    struct MethodCallLinkInfo {
+        MethodCallLinkInfo()
+            : cachedStructure(0)
+        {
+        }
+
+        MacroAssembler::CodeLocationCall callReturnLocation;
+        MacroAssembler::CodeLocationDataLabelPtr structureLabel;
+        Structure* cachedStructure;
+    };
+
     struct FunctionRegisterInfo {
         FunctionRegisterInfo(unsigned bytecodeOffset, int functionRegisterIndex)
             : bytecodeOffset(bytecodeOffset)
@@ -185,6 +168,11 @@
         return callLinkInfo->callReturnLocation.calleeReturnAddressValue();
     }
 
+    inline void* getMethodCallLinkInfoReturnLocation(MethodCallLinkInfo* methodCallLinkInfo)
+    {
+        return methodCallLinkInfo->callReturnLocation.calleeReturnAddressValue();
+    }
+
     inline unsigned getCallReturnOffset(CallReturnOffsetToBytecodeIndex* pc)
     {
         return pc->callReturnOffset;
@@ -264,9 +252,9 @@
             return index >= m_numVars && index < m_numVars + m_numConstants;
         }
 
-        ALWAYS_INLINE JSValuePtr getConstant(int index)
+        ALWAYS_INLINE JSValue getConstant(int index)
         {
-            return m_constantRegisters[index - m_numVars].getJSValue();
+            return m_constantRegisters[index - m_numVars].jsValue();
         }
 
         ALWAYS_INLINE bool isTemporaryRegisterIndex(int index)
@@ -309,10 +297,15 @@
             return *(binaryChop<CallLinkInfo, void*, getCallLinkInfoReturnLocation>(m_callLinkInfos.begin(), m_callLinkInfos.size(), returnAddress));
         }
 
+        MethodCallLinkInfo& getMethodCallLinkInfo(void* returnAddress)
+        {
+            return *(binaryChop<MethodCallLinkInfo, void*, getMethodCallLinkInfoReturnLocation>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), returnAddress));
+        }
+
         unsigned getBytecodeIndex(CallFrame* callFrame, void* nativePC)
         {
             reparseForExceptionInfoIfNecessary(callFrame);
-            return binaryChop<CallReturnOffsetToBytecodeIndex, unsigned, getCallReturnOffset>(m_exceptionInfo->m_callReturnIndexVector.begin(), m_exceptionInfo->m_callReturnIndexVector.size(), m_jitCode.code.offsetOf(nativePC))->bytecodeIndex;
+            return binaryChop<CallReturnOffsetToBytecodeIndex, unsigned, getCallReturnOffset>(m_exceptionInfo->m_callReturnIndexVector.begin(), m_exceptionInfo->m_callReturnIndexVector.size(), ownerNode()->generatedJITCode().offsetOf(nativePC))->bytecodeIndex;
         }
         
         bool functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int& functionRegisterIndex);
@@ -327,9 +320,8 @@
 #endif
 
 #if ENABLE(JIT)
-        void setJITCode(JITCodeRef& jitCode);
-        JITCode jitCode() { return m_jitCode.code; }
-        ExecutablePool* executablePool() { return m_jitCode.executablePool.get(); }
+        void setJITCode(JITCode);
+        ExecutablePool* executablePool() { return ownerNode()->getExecutablePool(); }
 #endif
 
         ScopeNode* ownerNode() const { return m_ownerNode; }
@@ -373,6 +365,9 @@
         void addCallLinkInfo() { m_callLinkInfos.append(CallLinkInfo()); }
         CallLinkInfo& callLinkInfo(int index) { return m_callLinkInfos[index]; }
 
+        void addMethodCallLinkInfos(unsigned n) { m_methodCallLinkInfos.grow(n); }
+        MethodCallLinkInfo& methodCallLinkInfo(int index) { return m_methodCallLinkInfos[index]; }
+
         void addFunctionRegisterInfo(unsigned bytecodeOffset, int functionIndex) { createRareDataIfNecessary(); m_rareData->m_functionRegisterInfos.append(FunctionRegisterInfo(bytecodeOffset, functionIndex)); }
 #endif
 
@@ -414,8 +409,8 @@
 
         bool hasFunctions() const { return m_functionExpressions.size() || (m_rareData && m_rareData->m_functions.size()); }
 
-        unsigned addUnexpectedConstant(JSValuePtr v) { createRareDataIfNecessary(); unsigned size = m_rareData->m_unexpectedConstants.size(); m_rareData->m_unexpectedConstants.append(v); return size; }
-        JSValuePtr unexpectedConstant(int index) const { ASSERT(m_rareData); return m_rareData->m_unexpectedConstants[index]; }
+        unsigned addUnexpectedConstant(JSValue v) { createRareDataIfNecessary(); unsigned size = m_rareData->m_unexpectedConstants.size(); m_rareData->m_unexpectedConstants.append(v); return size; }
+        JSValue unexpectedConstant(int index) const { ASSERT(m_rareData); return m_rareData->m_unexpectedConstants[index]; }
 
         unsigned addRegExp(RegExp* r) { createRareDataIfNecessary(); unsigned size = m_rareData->m_regexps.size(); m_rareData->m_regexps.append(r); return size; }
         RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); }
@@ -473,9 +468,6 @@
 #ifndef NDEBUG
         unsigned m_instructionCount;
 #endif
-#if ENABLE(JIT)
-        JITCodeRef m_jitCode;
-#endif
 
         int m_thisRegister;
 
@@ -496,6 +488,7 @@
         Vector<StructureStubInfo> m_structureStubInfos;
         Vector<GlobalResolveInfo> m_globalResolveInfos;
         Vector<CallLinkInfo> m_callLinkInfos;
+        Vector<MethodCallLinkInfo> m_methodCallLinkInfos;
         Vector<CallLinkInfo*> m_linkedCallerList;
 #endif
 
@@ -524,7 +517,7 @@
 
             // Rare Constants
             Vector<RefPtr<FuncDeclNode> > m_functions;
-            Vector<JSValuePtr> m_unexpectedConstants;
+            Vector<JSValue> m_unexpectedConstants;
             Vector<RefPtr<RegExp> > m_regexps;
 
             // Jump Tables
diff --git a/JavaScriptCore/bytecode/EvalCodeCache.h b/JavaScriptCore/bytecode/EvalCodeCache.h
index 2d6f7dc..f0ce73e 100644
--- a/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -41,7 +41,7 @@
 
     class EvalCodeCache {
     public:
-        PassRefPtr<EvalNode> get(ExecState* exec, const UString& evalSource, ScopeChainNode* scopeChain, JSValuePtr& exceptionValue)
+        PassRefPtr<EvalNode> get(ExecState* exec, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
         {
             RefPtr<EvalNode> evalNode;
 
diff --git a/JavaScriptCore/bytecode/Instruction.h b/JavaScriptCore/bytecode/Instruction.h
index 314fda4..24ba490 100644
--- a/JavaScriptCore/bytecode/Instruction.h
+++ b/JavaScriptCore/bytecode/Instruction.h
@@ -34,7 +34,7 @@
 #include "Structure.h"
 #include <wtf/VectorTraits.h>
 
-#define POLYMORPHIC_LIST_CACHE_SIZE 4
+#define POLYMORPHIC_LIST_CACHE_SIZE 8
 
 namespace JSC {
 
diff --git a/JavaScriptCore/bytecode/Opcode.h b/JavaScriptCore/bytecode/Opcode.h
index d00178b..f4421df 100644
--- a/JavaScriptCore/bytecode/Opcode.h
+++ b/JavaScriptCore/bytecode/Opcode.h
@@ -40,6 +40,7 @@
     #define FOR_EACH_OPCODE_ID(macro) \
         macro(op_enter, 1) \
         macro(op_enter_with_activation, 2) \
+        macro(op_init_arguments, 1) \
         macro(op_create_arguments, 1) \
         macro(op_convert_this, 2) \
         \
@@ -125,7 +126,9 @@
         macro(op_jfalse, 3) \
         macro(op_jeq_null, 3) \
         macro(op_jneq_null, 3) \
+        macro(op_jneq_ptr, 4) \
         macro(op_jnless, 4) \
+        macro(op_jnlesseq, 4) \
         macro(op_jmp_scopes, 3) \
         macro(op_loop, 2) \
         macro(op_loop_if_true, 3) \
@@ -139,12 +142,17 @@
         macro(op_new_func_exp, 3) \
         macro(op_call, 5) \
         macro(op_call_eval, 5) \
+        macro(op_call_varargs, 5) \
+        macro(op_load_varargs, 3) \
         macro(op_tear_off_activation, 2) \
         macro(op_tear_off_arguments, 1) \
         macro(op_ret, 2) \
+        macro(op_method_check, 1) \
         \
         macro(op_construct, 7) \
         macro(op_construct_verify, 3) \
+        macro(op_strcat, 4) \
+        macro(op_to_primitive, 3) \
         \
         macro(op_get_pnames, 3) \
         macro(op_next_pname, 4) \
diff --git a/JavaScriptCore/bytecode/SamplingTool.cpp b/JavaScriptCore/bytecode/SamplingTool.cpp
index 215ebe5..8651723 100644
--- a/JavaScriptCore/bytecode/SamplingTool.cpp
+++ b/JavaScriptCore/bytecode/SamplingTool.cpp
@@ -39,25 +39,58 @@
 
 namespace JSC {
 
-void ScopeSampleRecord::sample(CodeBlock* codeBlock, Instruction* vPC)
+#if ENABLE(SAMPLING_FLAGS)
+
+void SamplingFlags::sample()
 {
-    if (!m_samples) {
-        m_size = codeBlock->instructions().size();
-        m_samples = static_cast<int*>(calloc(m_size, sizeof(int)));
-        m_codeBlock = codeBlock;
+    uint32_t mask = 1 << 31;
+    unsigned index;
+
+    for (index = 0; index < 32; ++index) {
+        if (mask & s_flags)
+            break;
+        mask >>= 1;
     }
 
-    ++m_sampleCount;
-
-    unsigned offest = vPC - codeBlock->instructions().begin();
-    // Since we don't read and write codeBlock and vPC atomically, this check
-    // can fail if we sample mid op_call / op_ret.
-    if (offest < m_size) {
-        m_samples[offest]++;
-        m_opcodeSampleCount++;
-    }
+    s_flagCounts[32 - index]++;
 }
 
+void SamplingFlags::start()
+{
+    for (unsigned i = 0; i <= 32; ++i)
+        s_flagCounts[i] = 0;
+}
+void SamplingFlags::stop()
+{
+    uint64_t total = 0;
+    for (unsigned i = 0; i <= 32; ++i)
+        total += s_flagCounts[i];
+
+    if (total) {
+        printf("\nSamplingFlags: sample counts with flags set: (%lld total)\n", total);
+        for (unsigned i = 0; i <= 32; ++i) {
+            if (s_flagCounts[i])
+                printf("  [ %02d ] : %lld\t\t(%03.2f%%)\n", i, s_flagCounts[i], (100.0 * s_flagCounts[i]) / total);
+        }
+        printf("\n");
+    } else
+    printf("\nSamplingFlags: no samples.\n\n");
+}
+uint64_t SamplingFlags::s_flagCounts[33];
+
+#else
+void SamplingFlags::start() {}
+void SamplingFlags::stop() {}
+#endif
+
+/*
+  Start with flag 16 set.
+  By doing this the monitoring of lower valued flags will be masked out
+  until flag 16 is explictly cleared.
+*/
+uint32_t SamplingFlags::s_flags = 1 << 15;
+
+
 #if PLATFORM(WIN_OS)
 
 static void sleepForMicroseconds(unsigned us)
@@ -82,62 +115,113 @@
     return 1000000 / hertz;
 }
 
-void SamplingTool::run()
+
+SamplingTool* SamplingTool::s_samplingTool = 0;
+
+
+bool SamplingThread::s_running = false;
+unsigned SamplingThread::s_hertz = 10000;
+ThreadIdentifier SamplingThread::s_samplingThread;
+
+void* SamplingThread::threadStartFunc(void*)
 {
-    while (m_running) {
-        sleepForMicroseconds(hertz2us(m_hertz));
+    while (s_running) {
+        sleepForMicroseconds(hertz2us(s_hertz));
 
-        Sample sample(m_sample, m_codeBlock);
-        ++m_sampleCount;
-
-        if (sample.isNull())
-            continue;
-
-        if (!sample.inHostFunction()) {
-            unsigned opcodeID = m_interpreter->getOpcodeID(sample.vPC()[0].u.opcode);
-
-            ++m_opcodeSampleCount;
-            ++m_opcodeSamples[opcodeID];
-
-            if (sample.inCTIFunction())
-                m_opcodeSamplesInCTIFunctions[opcodeID]++;
-        }
-
-#if ENABLE(CODEBLOCK_SAMPLING)
-        MutexLocker locker(m_scopeSampleMapMutex);
-        ScopeSampleRecord* record = m_scopeSampleMap->get(sample.codeBlock()->ownerNode());
-        ASSERT(record);
-        record->sample(sample.codeBlock(), sample.vPC());
+#if ENABLE(SAMPLING_FLAGS)
+        SamplingFlags::sample();
 #endif
+#if ENABLE(OPCODE_SAMPLING)
+        SamplingTool::sample();
+#endif
+    }
+
+    return 0;
+}
+
+
+void SamplingThread::start(unsigned hertz)
+{
+    ASSERT(!s_running);
+    s_running = true;
+    s_hertz = hertz;
+
+    s_samplingThread = createThread(threadStartFunc, 0, "JavaScriptCore::Sampler");
+}
+
+void SamplingThread::stop()
+{
+    ASSERT(s_running);
+    s_running = false;
+    waitForThreadCompletion(s_samplingThread, 0);
+}
+
+
+void ScopeSampleRecord::sample(CodeBlock* codeBlock, Instruction* vPC)
+{
+    if (!m_samples) {
+        m_size = codeBlock->instructions().size();
+        m_samples = static_cast<int*>(calloc(m_size, sizeof(int)));
+        m_codeBlock = codeBlock;
+    }
+
+    ++m_sampleCount;
+
+    unsigned offest = vPC - codeBlock->instructions().begin();
+    // Since we don't read and write codeBlock and vPC atomically, this check
+    // can fail if we sample mid op_call / op_ret.
+    if (offest < m_size) {
+        m_samples[offest]++;
+        m_opcodeSampleCount++;
     }
 }
 
-void* SamplingTool::threadStartFunc(void* samplingTool)
+void SamplingTool::doRun()
 {
-    reinterpret_cast<SamplingTool*>(samplingTool)->run();
-    return 0;
+    Sample sample(m_sample, m_codeBlock);
+    ++m_sampleCount;
+
+    if (sample.isNull())
+        return;
+
+    if (!sample.inHostFunction()) {
+        unsigned opcodeID = m_interpreter->getOpcodeID(sample.vPC()[0].u.opcode);
+
+        ++m_opcodeSampleCount;
+        ++m_opcodeSamples[opcodeID];
+
+        if (sample.inCTIFunction())
+            m_opcodeSamplesInCTIFunctions[opcodeID]++;
+    }
+
+#if ENABLE(CODEBLOCK_SAMPLING)
+    if (CodeBlock* codeBlock = sample.codeBlock()) {
+        MutexLocker locker(m_scopeSampleMapMutex);
+        ScopeSampleRecord* record = m_scopeSampleMap->get(codeBlock->ownerNode());
+        ASSERT(record);
+        record->sample(codeBlock, sample.vPC());
+    }
+#endif
+}
+
+void SamplingTool::sample()
+{
+    s_samplingTool->doRun();
 }
 
 void SamplingTool::notifyOfScope(ScopeNode* scope)
 {
+#if ENABLE(CODEBLOCK_SAMPLING)
     MutexLocker locker(m_scopeSampleMapMutex);
     m_scopeSampleMap->set(scope, new ScopeSampleRecord(scope));
+#else
+    UNUSED_PARAM(scope);
+#endif
 }
 
-void SamplingTool::start(unsigned hertz)
+void SamplingTool::setup()
 {
-    ASSERT(!m_running);
-    m_running = true;
-    m_hertz = hertz;
-
-    m_samplingThread = createThread(threadStartFunc, this, "JavaScriptCore::Sampler");
-}
-
-void SamplingTool::stop()
-{
-    ASSERT(m_running);
-    m_running = false;
-    waitForThreadCompletion(m_samplingThread, 0);
+    s_samplingTool = this;
 }
 
 #if ENABLE(OPCODE_SAMPLING)
@@ -153,14 +237,6 @@
     unsigned count;
 };
 
-static int compareLineCountInfoSampling(const void* left, const void* right)
-{
-    const LineCountInfo* leftLineCount = reinterpret_cast<const LineCountInfo*>(left);
-    const LineCountInfo* rightLineCount = reinterpret_cast<const LineCountInfo*>(right);
-
-    return (leftLineCount->line > rightLineCount->line) ? 1 : (leftLineCount->line < rightLineCount->line) ? -1 : 0;
-}
-
 static int compareOpcodeIndicesSampling(const void* left, const void* right)
 {
     const OpcodeSampleInfo* leftSampleInfo = reinterpret_cast<const OpcodeSampleInfo*>(left);
@@ -169,6 +245,15 @@
     return (leftSampleInfo->count < rightSampleInfo->count) ? 1 : (leftSampleInfo->count > rightSampleInfo->count) ? -1 : 0;
 }
 
+#if ENABLE(CODEBLOCK_SAMPLING)
+static int compareLineCountInfoSampling(const void* left, const void* right)
+{
+    const LineCountInfo* leftLineCount = reinterpret_cast<const LineCountInfo*>(left);
+    const LineCountInfo* rightLineCount = reinterpret_cast<const LineCountInfo*>(right);
+
+    return (leftLineCount->line > rightLineCount->line) ? 1 : (leftLineCount->line < rightLineCount->line) ? -1 : 0;
+}
+
 static int compareScopeSampleRecords(const void* left, const void* right)
 {
     const ScopeSampleRecord* const leftValue = *static_cast<const ScopeSampleRecord* const *>(left);
@@ -176,6 +261,7 @@
 
     return (leftValue->m_sampleCount < rightValue->m_sampleCount) ? 1 : (leftValue->m_sampleCount > rightValue->m_sampleCount) ? -1 : 0;
 }
+#endif
 
 void SamplingTool::dump(ExecState* exec)
 {
@@ -227,6 +313,8 @@
     printf("\tcti count:\tsamples inside a CTI function called by this opcode\n");
     printf("\tcti %% of self:\tcti count / sample count\n");
     
+#if ENABLE(CODEBLOCK_SAMPLING)
+
     // (3) Build and sort 'codeBlockSamples' array.
 
     int scopeCount = m_scopeSampleMap->size();
@@ -285,6 +373,9 @@
             }
         }
     }
+#else
+    UNUSED_PARAM(exec);
+#endif
 }
 
 #else
@@ -295,4 +386,21 @@
 
 #endif
 
+void AbstractSamplingCounter::dump()
+{
+#if ENABLE(SAMPLING_COUNTERS)
+    if (s_abstractSamplingCounterChain != &s_abstractSamplingCounterChainEnd) {
+        printf("\nSampling Counter Values:\n");
+        for (AbstractSamplingCounter* currCounter = s_abstractSamplingCounterChain; (currCounter != &s_abstractSamplingCounterChainEnd); currCounter = currCounter->m_next)
+            printf("\t%s\t: %lld\n", currCounter->m_name, currCounter->m_counter);
+        printf("\n\n");
+    }
+    s_completed = true;
+#endif
+}
+
+AbstractSamplingCounter AbstractSamplingCounter::s_abstractSamplingCounterChainEnd;
+AbstractSamplingCounter* AbstractSamplingCounter::s_abstractSamplingCounterChain = &s_abstractSamplingCounterChainEnd;
+bool AbstractSamplingCounter::s_completed = false;
+
 } // namespace JSC
diff --git a/JavaScriptCore/bytecode/SamplingTool.h b/JavaScriptCore/bytecode/SamplingTool.h
index d1cf2e88..7d7dc9c 100644
--- a/JavaScriptCore/bytecode/SamplingTool.h
+++ b/JavaScriptCore/bytecode/SamplingTool.h
@@ -38,6 +38,54 @@
 
 namespace JSC {
 
+    class SamplingFlags {
+        friend class JIT;
+    public:
+        static void start();
+        static void stop();
+
+#if ENABLE(SAMPLING_FLAGS)
+        static void setFlag(unsigned flag)
+        {
+            ASSERT(flag >= 1);
+            ASSERT(flag <= 32);
+            s_flags |= 1u << (flag - 1);
+        }
+
+        static void clearFlag(unsigned flag)
+        {
+            ASSERT(flag >= 1);
+            ASSERT(flag <= 32);
+            s_flags &= ~(1u << (flag - 1));
+        }
+
+        static void sample();
+
+        class ScopedFlag {
+        public:
+            ScopedFlag(int flag)
+                : m_flag(flag)
+            {
+                setFlag(flag);
+            }
+
+            ~ScopedFlag()
+            {
+                clearFlag(m_flag);
+            }
+
+        private:
+            int m_flag;
+        };
+    
+#endif
+    private:
+        static uint32_t s_flags;
+#if ENABLE(SAMPLING_FLAGS)
+        static uint64_t s_flagCounts[33];
+#endif
+    };
+
     class CodeBlock;
     class ExecState;
     class Interpreter;
@@ -73,6 +121,19 @@
 
     typedef WTF::HashMap<ScopeNode*, ScopeSampleRecord*> ScopeSampleRecordMap;
 
+    class SamplingThread {
+    public:
+        // Sampling thread state.
+        static bool s_running;
+        static unsigned s_hertz;
+        static ThreadIdentifier s_samplingThread;
+
+        static void start(unsigned hertz=10000);
+        static void stop();
+
+        static void* threadStartFunc(void*);
+    };
+
     class SamplingTool {
     public:
         friend class CallRecord;
@@ -127,12 +188,13 @@
 
         SamplingTool(Interpreter* interpreter)
             : m_interpreter(interpreter)
-            , m_running(false)
             , m_codeBlock(0)
             , m_sample(0)
             , m_sampleCount(0)
             , m_opcodeSampleCount(0)
+#if ENABLE(CODEBLOCK_SAMPLING)
             , m_scopeSampleMap(new ScopeSampleRecordMap())
+#endif
         {
             memset(m_opcodeSamples, 0, sizeof(m_opcodeSamples));
             memset(m_opcodeSamplesInCTIFunctions, 0, sizeof(m_opcodeSamplesInCTIFunctions));
@@ -140,11 +202,12 @@
 
         ~SamplingTool()
         {
+#if ENABLE(CODEBLOCK_SAMPLING)
             deleteAllValues(*m_scopeSampleMap);
+#endif
         }
 
-        void start(unsigned hertz=10000);
-        void stop();
+        void setup();
         void dump(ExecState*);
 
         void notifyOfScope(ScopeNode* scope);
@@ -165,6 +228,8 @@
             return reinterpret_cast<void*>(reinterpret_cast<intptr_t>(vPC) | (static_cast<intptr_t>(inCTIFunction) << 1) | static_cast<intptr_t>(inHostFunction));
         }
 
+        static void sample();
+
     private:
         class Sample {
         public:
@@ -174,7 +239,7 @@
             {
             }
             
-            bool isNull() { return !m_sample || !m_codeBlock; }
+            bool isNull() { return !m_sample; }
             CodeBlock* codeBlock() { return m_codeBlock; }
             Instruction* vPC() { return reinterpret_cast<Instruction*>(m_sample & ~0x3); }
             bool inHostFunction() { return m_sample & 0x1; }
@@ -184,17 +249,12 @@
             intptr_t m_sample;
             CodeBlock* m_codeBlock;
         };
-        
-        static void* threadStartFunc(void*);
-        void run();
+
+        void doRun();
+        static SamplingTool* s_samplingTool;
         
         Interpreter* m_interpreter;
         
-        // Sampling thread state.
-        bool m_running;
-        unsigned m_hertz;
-        ThreadIdentifier m_samplingThread;
-
         // State tracked by the main thread, used by the sampling thread.
         CodeBlock* m_codeBlock;
         intptr_t m_sample;
@@ -205,10 +265,148 @@
         unsigned m_opcodeSamples[numOpcodeIDs];
         unsigned m_opcodeSamplesInCTIFunctions[numOpcodeIDs];
         
+#if ENABLE(CODEBLOCK_SAMPLING)
         Mutex m_scopeSampleMapMutex;
         OwnPtr<ScopeSampleRecordMap> m_scopeSampleMap;
+#endif
     };
 
+    // AbstractSamplingCounter:
+    //
+    // Implements a named set of counters, printed on exit if ENABLE(SAMPLING_COUNTERS).
+    // See subclasses below, SamplingCounter, GlobalSamplingCounter and DeletableSamplingCounter.
+    class AbstractSamplingCounter {
+        friend class JIT;
+        friend class DeletableSamplingCounter;
+    public:
+        void count(uint32_t count = 1)
+        {
+            m_counter += count;
+        }
+
+        static void dump();
+
+    protected:
+        // Effectively the contructor, however called lazily in the case of GlobalSamplingCounter.
+        void init(const char* name)
+        {
+            m_counter = 0;
+            m_name = name;
+
+            // Set m_next to point to the head of the chain, and inform whatever is
+            // currently at the head that this node will now hold the pointer to it.
+            m_next = s_abstractSamplingCounterChain;
+            s_abstractSamplingCounterChain->m_referer = &m_next;
+            // Add this node to the head of the list.
+            s_abstractSamplingCounterChain = this;
+            m_referer = &s_abstractSamplingCounterChain;
+        }
+
+        int64_t m_counter;
+        const char* m_name;
+        AbstractSamplingCounter* m_next;
+        // This is a pointer to the pointer to this node in the chain; used to
+        // allow fast linked list deletion.
+        AbstractSamplingCounter** m_referer;
+        // Null object used to detect end of static chain.
+        static AbstractSamplingCounter s_abstractSamplingCounterChainEnd;
+        static AbstractSamplingCounter* s_abstractSamplingCounterChain;
+        static bool s_completed;
+    };
+
+#if ENABLE(SAMPLING_COUNTERS)
+    // SamplingCounter:
+    //
+    // This class is suitable and (hopefully!) convenient for cases where a counter is
+    // required within the scope of a single function.  It can be instantiated as a
+    // static variable since it contains a constructor but not a destructor (static
+    // variables in WebKit cannot have destructors).
+    //
+    // For example:
+    //
+    // void someFunction()
+    // {
+    //     static SamplingCounter countMe("This is my counter.  There are many like it, but this one is mine.");
+    //     countMe.count();
+    //     // ...
+    // }
+    //
+    class SamplingCounter : public AbstractSamplingCounter {
+    public:
+        SamplingCounter(const char* name) { init(name); }
+    };
+
+    // GlobalSamplingCounter:
+    //
+    // This class is suitable for use where a counter is to be declared globally,
+    // since it contains neither a constructor nor destructor.  Instead, ensure
+    // that 'name()' is called to provide the counter with a name (and also to
+    // allow it to be printed out on exit).
+    //
+    // GlobalSamplingCounter globalCounter;
+    //
+    // void firstFunction()
+    // {
+    //     // Put this within a function that is definitely called!
+    //     // (Or alternatively alongside all calls to 'count()').
+    //     globalCounter.name("I Name You Destroyer.");
+    //     globalCounter.count();
+    //     // ...
+    // }
+    //
+    // void secondFunction()
+    // {
+    //     globalCounter.count();
+    //     // ...
+    // }
+    //
+    class GlobalSamplingCounter : public AbstractSamplingCounter {
+    public:
+        void name(const char* name)
+        {
+            // Global objects should be mapped in zero filled memory, so this should
+            // be a safe (albeit not necessarily threadsafe) check for 'first call'.
+            if (!m_next)
+                init(name);
+        }
+    };
+
+    // DeletableSamplingCounter:
+    //
+    // The above classes (SamplingCounter, GlobalSamplingCounter), are intended for
+    // use within a global or static scope, and as such cannot have a destructor.
+    // This means there is no convenient way for them to remove themselves from the
+    // static list of counters, and should an instance of either class be freed
+    // before 'dump()' has walked over the list it will potentially walk over an
+    // invalid pointer.
+    //
+    // This class is intended for use where the counter may possibly be deleted before
+    // the program exits.  Should this occur, the counter will print it's value to
+    // stderr, and remove itself from the static list.  Example:
+    //
+    // DeletableSamplingCounter* counter = new DeletableSamplingCounter("The Counter With No Name");
+    // counter->count();
+    // delete counter;
+    //
+    class DeletableSamplingCounter : public AbstractSamplingCounter {
+    public:
+        DeletableSamplingCounter(const char* name) { init(name); }
+
+        ~DeletableSamplingCounter()
+        {
+            if (!s_completed)
+                fprintf(stderr, "DeletableSamplingCounter \"%s\" deleted early (with count %lld)\n", m_name, m_counter);
+            // Our m_referer pointer should know where the pointer to this node is,
+            // and m_next should know that this node is the previous node in the list.
+            ASSERT(*m_referer == this);
+            ASSERT(m_next->m_referer == &m_next);
+            // Remove this node from the list, and inform m_next that we have done so.
+            m_next->m_referer = m_referer;
+            *m_referer = m_next;
+        }
+    };
+#endif
+
 } // namespace JSC
 
 #endif // SamplingTool_h
diff --git a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index c83cdc7..21a3016 100644
--- a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -31,6 +31,7 @@
 #include "BytecodeGenerator.h"
 
 #include "BatchedTransitionOptimizer.h"
+#include "PrototypeFunction.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
 #include "UString.h"
@@ -221,6 +222,7 @@
     , m_baseScopeDepth(0)
     , m_codeType(GlobalCode)
     , m_nextGlobalIndex(-1)
+    , m_globalConstantIndex(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
     , m_lastOpcodeID(op_end)
     , m_emitNodeDepth(0)
@@ -260,7 +262,7 @@
         m_nextGlobalIndex -= symbolTable->size();
 
         for (size_t i = 0; i < functionStack.size(); ++i) {
-            FuncDeclNode* funcDecl = functionStack[i].get();
+            FuncDeclNode* funcDecl = functionStack[i];
             globalObject->removeDirect(funcDecl->m_ident); // Make sure our new function is not shadowed by an old property.
             emitNewFunction(addGlobalVar(funcDecl->m_ident, false), funcDecl);
         }
@@ -276,7 +278,7 @@
             emitLoad(newVars[i], jsUndefined());
     } else {
         for (size_t i = 0; i < functionStack.size(); ++i) {
-            FuncDeclNode* funcDecl = functionStack[i].get();
+            FuncDeclNode* funcDecl = functionStack[i];
             globalObject->putWithAttributes(exec, funcDecl->m_ident, funcDecl->makeFunction(exec, scopeChain.node()), DontDelete);
         }
         for (size_t i = 0; i < varStack.size(); ++i) {
@@ -303,6 +305,7 @@
     , m_dynamicScopeDepth(0)
     , m_baseScopeDepth(0)
     , m_codeType(FunctionCode)
+    , m_globalConstantIndex(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
     , m_lastOpcodeID(op_end)
     , m_emitNodeDepth(0)
@@ -329,12 +332,19 @@
     } else
         emitOpcode(op_enter);
 
-    if (usesArguments)
-        emitOpcode(op_create_arguments);
+     if (usesArguments) {
+        emitOpcode(op_init_arguments);
+
+        // The debugger currently retrieves the arguments object from an activation rather than pulling
+        // it from a call frame.  In the long-term it should stop doing that (<rdar://problem/6911886>),
+        // but for now we force eager creation of the arguments object when debugging.
+        if (m_shouldEmitDebugHooks)
+            emitOpcode(op_create_arguments);
+    }
 
     const DeclarationStacks::FunctionStack& functionStack = functionBody->functionStack();
     for (size_t i = 0; i < functionStack.size(); ++i) {
-        FuncDeclNode* funcDecl = functionStack[i].get();
+        FuncDeclNode* funcDecl = functionStack[i];
         const Identifier& ident = funcDecl->m_ident;
         m_functions.add(ident.ustring().rep());
         emitNewFunction(addVar(ident, false), funcDecl);
@@ -377,6 +387,7 @@
     , m_dynamicScopeDepth(0)
     , m_baseScopeDepth(codeBlock->baseScopeDepth())
     , m_codeType(EvalCode)
+    , m_globalConstantIndex(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
     , m_lastOpcodeID(op_end)
     , m_emitNodeDepth(0)
@@ -424,6 +435,36 @@
     if (entry.isNull())
         return 0;
 
+    if (ident == propertyNames().arguments)
+        createArgumentsIfNecessary();
+
+    return &registerFor(entry.getIndex());
+}
+
+bool BytecodeGenerator::willResolveToArguments(const Identifier& ident)
+{
+    if (ident != propertyNames().arguments)
+        return false;
+    
+    if (!shouldOptimizeLocals())
+        return false;
+    
+    SymbolTableEntry entry = symbolTable().get(ident.ustring().rep());
+    if (entry.isNull())
+        return false;
+    
+    if (m_codeBlock->usesArguments() && m_codeType == FunctionCode)
+        return true;
+    
+    return false;
+}
+
+RegisterID* BytecodeGenerator::uncheckedRegisterForArguments()
+{
+    ASSERT(willResolveToArguments(propertyNames().arguments));
+
+    SymbolTableEntry entry = symbolTable().get(propertyNames().arguments.ustring().rep());
+    ASSERT(!entry.isNull());
     return &registerFor(entry.getIndex());
 }
 
@@ -648,6 +689,21 @@
             instructions().append(target->offsetFrom(instructions().size()));
             return target;
         }
+    } else if (m_lastOpcodeID == op_lesseq) {
+        int dstIndex;
+        int src1Index;
+        int src2Index;
+
+        retrieveLastBinaryOp(dstIndex, src1Index, src2Index);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindBinaryOp();
+            emitOpcode(op_jnlesseq);
+            instructions().append(src1Index);
+            instructions().append(src2Index);
+            instructions().append(target->offsetFrom(instructions().size()));
+            return target;
+        }
     } else if (m_lastOpcodeID == op_not) {
         int dstIndex;
         int srcIndex;
@@ -695,6 +751,24 @@
     return target;
 }
 
+PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionCall(RegisterID* cond, Label* target)
+{
+    emitOpcode(op_jneq_ptr);
+    instructions().append(cond->index());
+    instructions().append(m_scopeChain->globalObject()->d()->callFunction);
+    instructions().append(target->offsetFrom(instructions().size()));
+    return target;
+}
+
+PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond, Label* target)
+{
+    emitOpcode(op_jneq_ptr);
+    instructions().append(cond->index());
+    instructions().append(m_scopeChain->globalObject()->d()->applyFunction);
+    instructions().append(target->offsetFrom(instructions().size()));
+    return target;
+}
+
 unsigned BytecodeGenerator::addConstant(FuncDeclNode* n)
 {
     // No need to explicitly unique function body nodes -- they're unique already.
@@ -717,26 +791,36 @@
     return result.first->second;
 }
 
-RegisterID* BytecodeGenerator::addConstant(JSValuePtr v)
+RegisterID* BytecodeGenerator::addConstant(JSValue v)
 {
-    pair<JSValueMap::iterator, bool> result = m_jsValueMap.add(JSValuePtr::encode(v), m_nextConstantIndex);
+    pair<JSValueMap::iterator, bool> result = m_jsValueMap.add(JSValue::encode(v), m_nextConstantIndex);
     if (result.second) {
         RegisterID& constant = m_calleeRegisters[m_nextConstantIndex];
         
         ++m_nextConstantIndex;
 
-        m_codeBlock->addConstantRegister(JSValuePtr(v));
+        m_codeBlock->addConstantRegister(JSValue(v));
         return &constant;
     }
 
     return &registerFor(result.first->second);
 }
 
-unsigned BytecodeGenerator::addUnexpectedConstant(JSValuePtr v)
+unsigned BytecodeGenerator::addUnexpectedConstant(JSValue v)
 {
     return m_codeBlock->addUnexpectedConstant(v);
 }
 
+RegisterID* BytecodeGenerator::emitLoadGlobalObject(RegisterID* dst, JSObject* globalObject)
+{
+    if (!m_globalConstantIndex)
+        m_globalConstantIndex = m_codeBlock->addUnexpectedConstant(globalObject);
+    emitOpcode(op_unexpected_load);
+    instructions().append(dst->index());
+    instructions().append(m_globalConstantIndex);
+    return dst;
+}
+
 unsigned BytecodeGenerator::addRegExp(RegExp* r)
 {
     return m_codeBlock->addRegExp(r);
@@ -814,8 +898,8 @@
         if (src1->index() == dstIndex
             && src1->isTemporary()
             && m_codeBlock->isConstantRegisterIndex(src2->index())
-            && m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue(m_scopeChain->globalObject()->globalExec()).isString()) {
-            const UString& value = asString(m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue(m_scopeChain->globalObject()->globalExec()))->value();
+            && m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue().isString()) {
+            const UString& value = asString(m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue())->value();
             if (value == "undefined") {
                 rewindUnaryOp();
                 emitOpcode(op_is_undefined);
@@ -879,7 +963,7 @@
     // Later we can do the extra work to handle that like the other cases.
     if (number == HashTraits<double>::emptyValue() || HashTraits<double>::isDeletedValue(number))
         return emitLoad(dst, jsNumber(globalData(), number));
-    JSValuePtr& valueInMap = m_numberMap.add(number, noValue()).first->second;
+    JSValue& valueInMap = m_numberMap.add(number, JSValue()).first->second;
     if (!valueInMap)
         valueInMap = jsNumber(globalData(), number);
     return emitLoad(dst, valueInMap);
@@ -890,10 +974,10 @@
     JSString*& stringInMap = m_stringMap.add(identifier.ustring().rep(), 0).first->second;
     if (!stringInMap)
         stringInMap = jsOwnedString(globalData(), identifier.ustring());
-    return emitLoad(dst, JSValuePtr(stringInMap));
+    return emitLoad(dst, JSValue(stringInMap));
 }
 
-RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, JSValuePtr v)
+RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, JSValue v)
 {
     RegisterID* constantID = addConstant(v);
     if (dst)
@@ -1037,7 +1121,7 @@
     return dst;
 }
 
-RegisterID* BytecodeGenerator::emitGetScopedVar(RegisterID* dst, size_t depth, int index, JSValuePtr globalObject)
+RegisterID* BytecodeGenerator::emitGetScopedVar(RegisterID* dst, size_t depth, int index, JSValue globalObject)
 {
     if (globalObject) {
         emitOpcode(op_get_global_var);
@@ -1054,7 +1138,7 @@
     return dst;
 }
 
-RegisterID* BytecodeGenerator::emitPutScopedVar(size_t depth, int index, RegisterID* value, JSValuePtr globalObject)
+RegisterID* BytecodeGenerator::emitPutScopedVar(size_t depth, int index, RegisterID* value, JSValue globalObject)
 {
     if (globalObject) {
         emitOpcode(op_put_global_var);
@@ -1072,18 +1156,65 @@
 
 RegisterID* BytecodeGenerator::emitResolveBase(RegisterID* dst, const Identifier& property)
 {
-    emitOpcode(op_resolve_base);
-    instructions().append(dst->index());
-    instructions().append(addConstant(property));
-    return dst;
+    size_t depth = 0;
+    int index = 0;
+    JSObject* globalObject = 0;
+    findScopedProperty(property, index, depth, false, globalObject);
+    if (!globalObject) {
+        // We can't optimise at all :-(
+        emitOpcode(op_resolve_base);
+        instructions().append(dst->index());
+        instructions().append(addConstant(property));
+        return dst;
+    }
+
+    // Global object is the base
+    return emitLoadGlobalObject(dst, globalObject);
 }
 
 RegisterID* BytecodeGenerator::emitResolveWithBase(RegisterID* baseDst, RegisterID* propDst, const Identifier& property)
 {
-    emitOpcode(op_resolve_with_base);
-    instructions().append(baseDst->index());
+    size_t depth = 0;
+    int index = 0;
+    JSObject* globalObject = 0;
+    if (!findScopedProperty(property, index, depth, false, globalObject) || !globalObject) {
+        // We can't optimise at all :-(
+        emitOpcode(op_resolve_with_base);
+        instructions().append(baseDst->index());
+        instructions().append(propDst->index());
+        instructions().append(addConstant(property));
+        return baseDst;
+    }
+
+    bool forceGlobalResolve = false;
+    if (m_regeneratingForExceptionInfo) {
+#if ENABLE(JIT)
+        forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInfoAtBytecodeOffset(instructions().size());
+#else
+        forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInstructionAtBytecodeOffset(instructions().size());
+#endif
+    }
+
+    // Global object is the base
+    emitLoadGlobalObject(baseDst, globalObject);
+
+    if (index != missingSymbolMarker() && !forceGlobalResolve) {
+        // Directly index the property lookup across multiple scopes.
+        emitGetScopedVar(propDst, depth, index, globalObject);
+        return baseDst;
+    }
+
+#if ENABLE(JIT)
+    m_codeBlock->addGlobalResolveInfo(instructions().size());
+#else
+    m_codeBlock->addGlobalResolveInstruction(instructions().size());
+#endif
+    emitOpcode(op_resolve_global);
     instructions().append(propDst->index());
+    instructions().append(globalObject);
     instructions().append(addConstant(property));
+    instructions().append(0);
+    instructions().append(0);
     return baseDst;
 }
 
@@ -1096,6 +1227,11 @@
     return baseDst;
 }
 
+void BytecodeGenerator::emitMethodCheck()
+{
+    emitOpcode(op_method_check);
+}
+
 RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property)
 {
 #if ENABLE(JIT)
@@ -1252,8 +1388,15 @@
     return emitCall(op_call, dst, func, thisRegister, argumentsNode, divot, startOffset, endOffset);
 }
 
+void BytecodeGenerator::createArgumentsIfNecessary()
+{
+    if (m_codeBlock->usesArguments() && m_codeType == FunctionCode)
+        emitOpcode(op_create_arguments);
+}
+
 RegisterID* BytecodeGenerator::emitCallEval(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode* argumentsNode, unsigned divot, unsigned startOffset, unsigned endOffset)
 {
+    createArgumentsIfNecessary();
     return emitCall(op_call_eval, dst, func, thisRegister, argumentsNode, divot, startOffset, endOffset);
 }
 
@@ -1280,7 +1423,7 @@
     // Generate code for arguments.
     Vector<RefPtr<RegisterID>, 16> argv;
     argv.append(thisRegister);
-    for (ArgumentListNode* n = argumentsNode->m_listNode.get(); n; n = n->m_next.get()) {
+    for (ArgumentListNode* n = argumentsNode->m_listNode; n; n = n->m_next) {
         argv.append(newTemporary());
         // op_call requires the arguments to be a sequential range of registers
         ASSERT(argv[argv.size() - 1]->index() == argv[argv.size() - 2]->index() + 1);
@@ -1327,6 +1470,44 @@
     return dst;
 }
 
+RegisterID* BytecodeGenerator::emitLoadVarargs(RegisterID* argCountDst, RegisterID* arguments)
+{
+    ASSERT(argCountDst->index() < arguments->index());
+    emitOpcode(op_load_varargs);
+    instructions().append(argCountDst->index());
+    instructions().append(arguments->index());
+    return argCountDst;
+}
+
+RegisterID* BytecodeGenerator::emitCallVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* argCountRegister, unsigned divot, unsigned startOffset, unsigned endOffset)
+{
+    ASSERT(func->refCount());
+    ASSERT(thisRegister->refCount());
+    ASSERT(dst != func);
+    if (m_shouldEmitProfileHooks) {
+        emitOpcode(op_profile_will_call);
+        instructions().append(func->index());
+        
+#if ENABLE(JIT)
+        m_codeBlock->addFunctionRegisterInfo(instructions().size(), func->index());
+#endif
+    }
+    
+    emitExpressionInfo(divot, startOffset, endOffset);
+    
+    // Emit call.
+    emitOpcode(op_call_varargs);
+    instructions().append(dst->index()); // dst
+    instructions().append(func->index()); // func
+    instructions().append(argCountRegister->index()); // arg count
+    instructions().append(thisRegister->index() + RegisterFile::CallFrameHeaderSize); // initial registerOffset
+    if (m_shouldEmitProfileHooks) {
+        emitOpcode(op_profile_did_call);
+        instructions().append(func->index());
+    }
+    return dst;
+}
+
 RegisterID* BytecodeGenerator::emitReturn(RegisterID* src)
 {
     if (m_codeBlock->needsFullScopeChain()) {
@@ -1365,7 +1546,7 @@
     // Generate code for arguments.
     Vector<RefPtr<RegisterID>, 16> argv;
     argv.append(newTemporary()); // reserve space for "this"
-    for (ArgumentListNode* n = argumentsNode ? argumentsNode->m_listNode.get() : 0; n; n = n->m_next.get()) {
+    for (ArgumentListNode* n = argumentsNode ? argumentsNode->m_listNode : 0; n; n = n->m_next) {
         argv.append(newTemporary());
         // op_construct requires the arguments to be a sequential range of registers
         ASSERT(argv[argv.size() - 1]->index() == argv[argv.size() - 2]->index() + 1);
@@ -1416,6 +1597,23 @@
     return dst;
 }
 
+RegisterID* BytecodeGenerator::emitStrcat(RegisterID* dst, RegisterID* src, int count)
+{
+    emitOpcode(op_strcat);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+    instructions().append(count);
+
+    return dst;
+}
+
+void BytecodeGenerator::emitToPrimitive(RegisterID* dst, RegisterID* src)
+{
+    emitOpcode(op_to_primitive);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+}
+
 RegisterID* BytecodeGenerator::emitPushScope(RegisterID* scope)
 {
     ASSERT(scope->isTemporary());
@@ -1423,6 +1621,7 @@
     context.isFinallyBlock = false;
     m_scopeContextStack.append(context);
     m_dynamicScopeDepth++;
+    createArgumentsIfNecessary();
 
     return emitUnaryNoDstOp(op_push_scope, scope);
 }
@@ -1470,8 +1669,17 @@
 LabelScope* BytecodeGenerator::breakTarget(const Identifier& name)
 {
     // Reclaim free label scopes.
-    while (m_labelScopes.size() && !m_labelScopes.last().refCount())
+    //
+    // The condition was previously coded as 'm_labelScopes.size() && !m_labelScopes.last().refCount()',
+    // however sometimes this appears to lead to GCC going a little haywire and entering the loop with
+    // size 0, leading to segfaulty badness.  We are yet to identify a valid cause within our code to
+    // cause the GCC codegen to misbehave in this fashion, and as such the following refactoring of the
+    // loop condition is a workaround.
+    while (m_labelScopes.size()) {
+        if  (m_labelScopes.last().refCount())
+            break;
         m_labelScopes.removeLast();
+    }
 
     if (!m_labelScopes.size())
         return 0;
@@ -1568,14 +1776,10 @@
             emitLabel(nextInsn.get());
         }
 
-        // To get here there must be at least one finally block present
-        do {
-            ASSERT(topScope->isFinallyBlock);
+        while (topScope > bottomScope && topScope->isFinallyBlock) {
             emitJumpSubroutine(topScope->finallyContext.retAddrDst, topScope->finallyContext.finallyAddr);
             --topScope;
-            if (!topScope->isFinallyBlock)
-                break;
-        } while (topScope > bottomScope);
+        }
     }
     return emitJump(target);
 }
@@ -1622,7 +1826,7 @@
     return targetRegister;
 }
 
-RegisterID* BytecodeGenerator::emitNewError(RegisterID* dst, ErrorType type, JSValuePtr message)
+RegisterID* BytecodeGenerator::emitNewError(RegisterID* dst, ErrorType type, JSValue message)
 {
     emitOpcode(op_new_error);
     instructions().append(dst->index());
@@ -1652,6 +1856,8 @@
     m_scopeContextStack.append(context);
     m_dynamicScopeDepth++;
     
+    createArgumentsIfNecessary();
+
     emitOpcode(op_push_new_scope);
     instructions().append(dst->index());
     instructions().append(addConstant(property));
@@ -1687,7 +1893,7 @@
     ASSERT(node->isNumber());
     double value = static_cast<NumberNode*>(node)->value();
     int32_t key = static_cast<int32_t>(value);
-    ASSERT(JSValuePtr::makeInt32Fast(key) && (JSValuePtr::makeInt32Fast(key).getInt32Fast() == value));
+    ASSERT(JSValue::makeInt32Fast(key) && (JSValue::makeInt32Fast(key).getInt32Fast() == value));
     ASSERT(key == value);
     ASSERT(key >= min);
     ASSERT(key <= max);
diff --git a/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index a6f245d..6813d69 100644
--- a/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -81,6 +81,9 @@
         // such register exists. Registers returned by registerFor do not
         // require explicit reference counting.
         RegisterID* registerFor(const Identifier&);
+        
+        bool willResolveToArguments(const Identifier&);
+        RegisterID* uncheckedRegisterForArguments();
 
         // Behaves as registerFor does, but ignores dynamic scope as
         // dynamic scope should not interfere with const initialisation
@@ -240,9 +243,10 @@
         RegisterID* emitLoad(RegisterID* dst, bool);
         RegisterID* emitLoad(RegisterID* dst, double);
         RegisterID* emitLoad(RegisterID* dst, const Identifier&);
-        RegisterID* emitLoad(RegisterID* dst, JSValuePtr);
+        RegisterID* emitLoad(RegisterID* dst, JSValue);
         RegisterID* emitUnexpectedLoad(RegisterID* dst, bool);
         RegisterID* emitUnexpectedLoad(RegisterID* dst, double);
+        RegisterID* emitLoadGlobalObject(RegisterID* dst, JSObject* globalObject);
 
         RegisterID* emitUnaryOp(OpcodeID, RegisterID* dst, RegisterID* src);
         RegisterID* emitBinaryOp(OpcodeID, RegisterID* dst, RegisterID* src1, RegisterID* src2, OperandTypes);
@@ -269,13 +273,15 @@
         RegisterID* emitIn(RegisterID* dst, RegisterID* property, RegisterID* base) { return emitBinaryOp(op_in, dst, property, base, OperandTypes()); }
 
         RegisterID* emitResolve(RegisterID* dst, const Identifier& property);
-        RegisterID* emitGetScopedVar(RegisterID* dst, size_t skip, int index, JSValuePtr globalObject);
-        RegisterID* emitPutScopedVar(size_t skip, int index, RegisterID* value, JSValuePtr globalObject);
+        RegisterID* emitGetScopedVar(RegisterID* dst, size_t skip, int index, JSValue globalObject);
+        RegisterID* emitPutScopedVar(size_t skip, int index, RegisterID* value, JSValue globalObject);
 
         RegisterID* emitResolveBase(RegisterID* dst, const Identifier& property);
         RegisterID* emitResolveWithBase(RegisterID* baseDst, RegisterID* propDst, const Identifier& property);
         RegisterID* emitResolveFunction(RegisterID* baseDst, RegisterID* funcDst, const Identifier& property);
 
+        void emitMethodCheck();
+
         RegisterID* emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property);
         RegisterID* emitPutById(RegisterID* base, const Identifier& property, RegisterID* value);
         RegisterID* emitDeleteById(RegisterID* dst, RegisterID* base, const Identifier&);
@@ -288,16 +294,22 @@
 
         RegisterID* emitCall(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
         RegisterID* emitCallEval(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        RegisterID* emitCallVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* argCount, unsigned divot, unsigned startOffset, unsigned endOffset);
+        RegisterID* emitLoadVarargs(RegisterID* argCountDst, RegisterID* args);
 
         RegisterID* emitReturn(RegisterID* src);
         RegisterID* emitEnd(RegisterID* src) { return emitUnaryNoDstOp(op_end, src); }
 
         RegisterID* emitConstruct(RegisterID* dst, RegisterID* func, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        RegisterID* emitStrcat(RegisterID* dst, RegisterID* src, int count);
+        void emitToPrimitive(RegisterID* dst, RegisterID* src);
 
         PassRefPtr<Label> emitLabel(Label*);
         PassRefPtr<Label> emitJump(Label* target);
         PassRefPtr<Label> emitJumpIfTrue(RegisterID* cond, Label* target);
         PassRefPtr<Label> emitJumpIfFalse(RegisterID* cond, Label* target);
+        PassRefPtr<Label> emitJumpIfNotFunctionCall(RegisterID* cond, Label* target);
+        PassRefPtr<Label> emitJumpIfNotFunctionApply(RegisterID* cond, Label* target);
         PassRefPtr<Label> emitJumpScopes(Label* target, int targetScopeDepth);
 
         PassRefPtr<Label> emitJumpSubroutine(RegisterID* retAddrDst, Label*);
@@ -308,7 +320,7 @@
 
         RegisterID* emitCatch(RegisterID*, Label* start, Label* end);
         void emitThrow(RegisterID* exc) { emitUnaryNoDstOp(op_throw, exc); }
-        RegisterID* emitNewError(RegisterID* dst, ErrorType type, JSValuePtr message);
+        RegisterID* emitNewError(RegisterID* dst, ErrorType type, JSValue message);
         void emitPushNewScope(RegisterID* dst, Identifier& property, RegisterID* value);
 
         RegisterID* emitPushScope(RegisterID* scope);
@@ -345,12 +357,7 @@
 
         PassRefPtr<Label> emitComplexJumpScopes(Label* target, ControlFlowContext* topScope, ControlFlowContext* bottomScope);
 
-        struct JSValueHashTraits : HashTraits<JSValueEncodedAsPointer*> {
-            static void constructDeletedValue(JSValueEncodedAsPointer*& slot) { slot = JSValuePtr::encode(jsImpossibleValue()); }
-            static bool isDeletedValue(JSValueEncodedAsPointer* value) { return value == JSValuePtr::encode(jsImpossibleValue()); }
-        };
-
-        typedef HashMap<JSValueEncodedAsPointer*, unsigned, PtrHash<JSValueEncodedAsPointer*>, JSValueHashTraits> JSValueMap;
+        typedef HashMap<EncodedJSValue, unsigned, PtrHash<EncodedJSValue>, JSValueHashTraits> JSValueMap;
 
         struct IdentifierMapIndexHashTraits {
             typedef int TraitType;
@@ -362,9 +369,9 @@
         };
 
         typedef HashMap<RefPtr<UString::Rep>, int, IdentifierRepHash, HashTraits<RefPtr<UString::Rep> >, IdentifierMapIndexHashTraits> IdentifierMap;
-        typedef HashMap<double, JSValuePtr> NumberMap;
+        typedef HashMap<double, JSValue> NumberMap;
         typedef HashMap<UString::Rep*, JSString*, IdentifierRepHash> IdentifierStringMap;
-
+        
         RegisterID* emitCall(OpcodeID, RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
         
         RegisterID* newRegister();
@@ -412,8 +419,8 @@
         unsigned addConstant(FuncDeclNode*);
         unsigned addConstant(FuncExprNode*);
         unsigned addConstant(const Identifier&);
-        RegisterID* addConstant(JSValuePtr);
-        unsigned addUnexpectedConstant(JSValuePtr);
+        RegisterID* addConstant(JSValue);
+        unsigned addUnexpectedConstant(JSValue);
         unsigned addRegExp(RegExp*);
 
         Vector<Instruction>& instructions() { return m_codeBlock->instructions(); }
@@ -424,6 +431,8 @@
 
         RegisterID* emitThrowExpressionTooDeepException();
 
+        void createArgumentsIfNecessary();
+
         bool m_shouldEmitDebugHooks;
         bool m_shouldEmitProfileHooks;
 
@@ -457,6 +466,7 @@
         int m_nextGlobalIndex;
         int m_nextParameterIndex;
         int m_nextConstantIndex;
+        unsigned m_globalConstantIndex;
 
         int m_globalVarStorageOffset;
 
diff --git a/JavaScriptCore/config.h b/JavaScriptCore/config.h
index a85178c..cecae47 100644
--- a/JavaScriptCore/config.h
+++ b/JavaScriptCore/config.h
@@ -25,6 +25,16 @@
 
 #include <wtf/Platform.h>
 
+#if PLATFORM(WIN_OS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+#define JS_EXPORTDATA __declspec(dllexport)
+#else
+#define JS_EXPORTDATA __declspec(dllimport)
+#endif
+#else
+#define JS_EXPORTDATA
+#endif
+
 #if PLATFORM(WIN_OS)
 
 // If we don't define these, they get defined in windef.h. 
diff --git a/JavaScriptCore/create_hash_table b/JavaScriptCore/create_hash_table
index 3bd9f76..25d0b02 100755
--- a/JavaScriptCore/create_hash_table
+++ b/JavaScriptCore/create_hash_table
@@ -269,10 +269,6 @@
     print "   { 0, 0, 0, 0 }\n";
     print "};\n\n";
     print "extern const struct HashTable $name =\n";
-    print "#if ENABLE(PERFECT_HASH_SIZE)\n";
-    print "    \{ ", $pefectHashSize - 1, ", $nameEntries, 0 \};\n";
-    print "#else\n";
     print "    \{ $compactSize, $compactHashSizeMask, $nameEntries, 0 \};\n";
-    print "#endif\n\n";
     print "} // namespace\n";
 }
diff --git a/JavaScriptCore/debugger/Debugger.cpp b/JavaScriptCore/debugger/Debugger.cpp
index da1cb3d..7d791e7 100644
--- a/JavaScriptCore/debugger/Debugger.cpp
+++ b/JavaScriptCore/debugger/Debugger.cpp
@@ -53,7 +53,7 @@
     globalObject->setDebugger(0);
 }
 
-JSValuePtr evaluateInGlobalCallFrame(const UString& script, JSValuePtr& exception, JSGlobalObject* globalObject)
+JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
 {
     CallFrame* globalCallFrame = globalObject->globalExec();
 
diff --git a/JavaScriptCore/debugger/Debugger.h b/JavaScriptCore/debugger/Debugger.h
index 0559898..868ea71 100644
--- a/JavaScriptCore/debugger/Debugger.h
+++ b/JavaScriptCore/debugger/Debugger.h
@@ -56,7 +56,7 @@
 
     // This method exists only for backwards compatibility with existing
     // WebScriptDebugger clients
-    JSValuePtr evaluateInGlobalCallFrame(const UString&, JSValuePtr& exception, JSGlobalObject*);
+    JSValue evaluateInGlobalCallFrame(const UString&, JSValue& exception, JSGlobalObject*);
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/debugger/DebuggerActivation.cpp b/JavaScriptCore/debugger/DebuggerActivation.cpp
index 9d4dcbf..4b2568f 100644
--- a/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -55,12 +55,12 @@
     return m_activation->getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void DebuggerActivation::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void DebuggerActivation::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     m_activation->put(exec, propertyName, value, slot);
 }
 
-void DebuggerActivation::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void DebuggerActivation::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     m_activation->putWithAttributes(exec, propertyName, value, attributes);
 }
@@ -90,12 +90,12 @@
     m_activation->defineSetter(exec, propertyName, setterFunction);
 }
 
-JSValuePtr DebuggerActivation::lookupGetter(ExecState* exec, const Identifier& propertyName)
+JSValue DebuggerActivation::lookupGetter(ExecState* exec, const Identifier& propertyName)
 {
     return m_activation->lookupGetter(exec, propertyName);
 }
 
-JSValuePtr DebuggerActivation::lookupSetter(ExecState* exec, const Identifier& propertyName)
+JSValue DebuggerActivation::lookupSetter(ExecState* exec, const Identifier& propertyName)
 {
     return m_activation->lookupSetter(exec, propertyName);
 }
diff --git a/JavaScriptCore/debugger/DebuggerActivation.h b/JavaScriptCore/debugger/DebuggerActivation.h
index c2ede4f..9e1f9f5 100644
--- a/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/JavaScriptCore/debugger/DebuggerActivation.h
@@ -39,17 +39,17 @@
         virtual void mark();
         virtual UString className() const;
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr, unsigned attributes);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue, unsigned attributes);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
         virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction);
-        virtual JSValuePtr lookupGetter(ExecState*, const Identifier& propertyName);
-        virtual JSValuePtr lookupSetter(ExecState*, const Identifier& propertyName);
+        virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
+        virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype) 
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
         {
             return Structure::create(prototype, TypeInfo(ObjectType)); 
         }
diff --git a/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index 27b824c..cd8702b 100644
--- a/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -46,6 +46,17 @@
         return 0;
     return &function->name(&m_callFrame->globalData());
 }
+    
+UString DebuggerCallFrame::calculatedFunctionName() const
+{
+    if (!m_callFrame->codeBlock())
+        return 0;
+    
+    JSFunction* function = static_cast<JSFunction*>(m_callFrame->callee());
+    if (!function)
+        return 0;
+    return function->calculatedDisplayName(&m_callFrame->globalData());
+}
 
 DebuggerCallFrame::Type DebuggerCallFrame::type() const
 {
@@ -63,10 +74,10 @@
     return asObject(m_callFrame->thisValue());
 }
 
-JSValuePtr DebuggerCallFrame::evaluate(const UString& script, JSValuePtr& exception) const
+JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) const
 {
     if (!m_callFrame->codeBlock())
-        return noValue();
+        return JSValue();
 
     int errLine;
     UString errMsg;
diff --git a/JavaScriptCore/debugger/DebuggerCallFrame.h b/JavaScriptCore/debugger/DebuggerCallFrame.h
index cdf4965..9d377ef 100644
--- a/JavaScriptCore/debugger/DebuggerCallFrame.h
+++ b/JavaScriptCore/debugger/DebuggerCallFrame.h
@@ -39,11 +39,10 @@
 
         DebuggerCallFrame(CallFrame* callFrame)
             : m_callFrame(callFrame)
-            , m_exception(noValue())
         {
         }
 
-        DebuggerCallFrame(CallFrame* callFrame, JSValuePtr exception)
+        DebuggerCallFrame(CallFrame* callFrame, JSValue exception)
             : m_callFrame(callFrame)
             , m_exception(exception)
         {
@@ -52,14 +51,15 @@
         JSGlobalObject* dynamicGlobalObject() const { return m_callFrame->dynamicGlobalObject(); }
         const ScopeChainNode* scopeChain() const { return m_callFrame->scopeChain(); }
         const UString* functionName() const;
+        UString calculatedFunctionName() const;
         Type type() const;
         JSObject* thisObject() const;
-        JSValuePtr evaluate(const UString&, JSValuePtr& exception) const;
-        JSValuePtr exception() const { return m_exception; }
+        JSValue evaluate(const UString&, JSValue& exception) const;
+        JSValue exception() const { return m_exception; }
 
     private:
         CallFrame* m_callFrame;
-        JSValuePtr m_exception;
+        JSValue m_exception;
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/interpreter/CachedCall.h b/JavaScriptCore/interpreter/CachedCall.h
new file mode 100644
index 0000000..f48f4f4
--- /dev/null
+++ b/JavaScriptCore/interpreter/CachedCall.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CachedCall_h
+#define CachedCall_h
+
+#include "CallFrameClosure.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "Interpreter.h"
+
+namespace JSC {
+    class CachedCall : Noncopyable {
+    public:
+        CachedCall(CallFrame* callFrame, JSFunction* function, int argCount, JSValue* exception)
+            : m_valid(false)
+            , m_interpreter(callFrame->interpreter())
+            , m_exception(exception)
+            , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().node()->globalObject())
+        {
+            m_closure = m_interpreter->prepareForRepeatCall(function->body(), callFrame, function, argCount, function->scope().node(), exception);
+            m_valid = !*exception;
+        }
+        
+        JSValue call()
+        { 
+            ASSERT(m_valid);
+            return m_interpreter->execute(m_closure, m_exception);
+        }
+        void setThis(JSValue v) { m_closure.setArgument(0, v); }
+        void setArgument(int n, JSValue v) { m_closure.setArgument(n + 1, v); }
+        CallFrame* newCallFrame() { return m_closure.newCallFrame; }
+        ~CachedCall()
+        {
+            if (m_valid)
+                m_interpreter->endRepeatCall(m_closure);
+        }
+        
+    private:
+        bool m_valid;
+        Interpreter* m_interpreter;
+        JSValue* m_exception;
+        DynamicGlobalObjectScope m_globalObjectScope;
+        CallFrameClosure m_closure;
+    };
+}
+
+#endif
diff --git a/JavaScriptCore/interpreter/CallFrame.cpp b/JavaScriptCore/interpreter/CallFrame.cpp
index 1c74280..9724875 100644
--- a/JavaScriptCore/interpreter/CallFrame.cpp
+++ b/JavaScriptCore/interpreter/CallFrame.cpp
@@ -27,12 +27,26 @@
 #include "CallFrame.h"
 
 #include "CodeBlock.h"
+#include "Interpreter.h"
 
 namespace JSC {
 
-JSValuePtr CallFrame::thisValue()
+JSValue CallFrame::thisValue()
 {
-    return this[codeBlock()->thisRegister()].jsValue(this);
+    return this[codeBlock()->thisRegister()].jsValue();
 }
 
+#ifndef NDEBUG
+void CallFrame::dumpCaller()
+{
+    int signedLineNumber;
+    intptr_t sourceID;
+    UString urlString;
+    JSValue function;
+    
+    interpreter()->retrieveLastCaller(this, signedLineNumber, sourceID, urlString, function);
+    printf("Callpoint => %s:%d\n", urlString.ascii(), signedLineNumber);
+}
+#endif
+
 }
diff --git a/JavaScriptCore/interpreter/CallFrame.h b/JavaScriptCore/interpreter/CallFrame.h
index 10d0b99..a61e143 100644
--- a/JavaScriptCore/interpreter/CallFrame.h
+++ b/JavaScriptCore/interpreter/CallFrame.h
@@ -40,8 +40,9 @@
         JSFunction* callee() const { return this[RegisterFile::Callee].function(); }
         CodeBlock* codeBlock() const { return this[RegisterFile::CodeBlock].Register::codeBlock(); }
         ScopeChainNode* scopeChain() const { return this[RegisterFile::ScopeChain].Register::scopeChain(); }
+        int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
 
-        JSValuePtr thisValue();
+        JSValue thisValue();
 
         // Global object in which execution began.
         JSGlobalObject* dynamicGlobalObject();
@@ -73,17 +74,19 @@
         // pointer, so these are inefficient, and should be used sparingly in new code.
         // But they're used in many places in legacy code, so they're not going away any time soon.
 
-        void setException(JSValuePtr exception) { globalData().exception = exception; }
-        void clearException() { globalData().exception = noValue(); }
-        JSValuePtr exception() const { return globalData().exception; }
-        JSValuePtr* exceptionSlot() { return &globalData().exception; }
+        void setException(JSValue exception) { globalData().exception = exception; }
+        void clearException() { globalData().exception = JSValue(); }
+        JSValue exception() const { return globalData().exception; }
+        JSValue* exceptionSlot() { return &globalData().exception; }
         bool hadException() const { return globalData().exception; }
 
         const CommonIdentifiers& propertyNames() const { return *globalData().propertyNames; }
-        const ArgList& emptyList() const { return *globalData().emptyList; }
+        const MarkedArgumentBuffer& emptyList() const { return *globalData().emptyList; }
         Interpreter* interpreter() { return globalData().interpreter; }
         Heap* heap() { return &globalData().heap; }
-
+#ifndef NDEBUG
+        void dumpCaller();
+#endif
         static const HashTable* arrayTable(CallFrame* callFrame) { return callFrame->globalData().arrayTable; }
         static const HashTable* dateTable(CallFrame* callFrame) { return callFrame->globalData().dateTable; }
         static const HashTable* mathTable(CallFrame* callFrame) { return callFrame->globalData().mathTable; }
@@ -92,29 +95,17 @@
         static const HashTable* regExpConstructorTable(CallFrame* callFrame) { return callFrame->globalData().regExpConstructorTable; }
         static const HashTable* stringTable(CallFrame* callFrame) { return callFrame->globalData().stringTable; }
 
-    private:
-        friend class Arguments;
-        friend class JSActivation;
-        friend class JSGlobalObject;
-        friend class Interpreter;
-        friend class JITStubs;
-
         static CallFrame* create(Register* callFrameBase) { return static_cast<CallFrame*>(callFrameBase); }
         Register* registers() { return this; }
 
         CallFrame& operator=(const Register& r) { *static_cast<Register*>(this) = r; return *this; }
 
-        int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
         CallFrame* callerFrame() const { return this[RegisterFile::CallerFrame].callFrame(); }
         Arguments* optionalCalleeArguments() const { return this[RegisterFile::OptionalCalleeArguments].arguments(); }
         Instruction* returnPC() const { return this[RegisterFile::ReturnPC].vPC(); }
-        int returnValueRegister() const { return this[RegisterFile::ReturnValueRegister].i(); }
 
-        void setArgumentCount(int count) { this[RegisterFile::ArgumentCount] = count; }
-        void setCallee(JSFunction* callee) { this[RegisterFile::Callee] = callee; }
         void setCalleeArguments(Arguments* arguments) { this[RegisterFile::OptionalCalleeArguments] = arguments; }
         void setCallerFrame(CallFrame* callerFrame) { this[RegisterFile::CallerFrame] = callerFrame; }
-        void setCodeBlock(CodeBlock* codeBlock) { this[RegisterFile::CodeBlock] = codeBlock; }
         void setScopeChain(ScopeChainNode* scopeChain) { this[RegisterFile::ScopeChain] = scopeChain; }
 
         ALWAYS_INLINE void init(CodeBlock* codeBlock, Instruction* vPC, ScopeChainNode* scopeChain,
@@ -132,6 +123,19 @@
             setCalleeArguments(0);
         }
 
+    private:
+        friend class Arguments;
+        friend class JSActivation;
+        friend class JSGlobalObject;
+        friend class Interpreter;
+        friend struct CallFrameClosure;
+
+        int returnValueRegister() const { return this[RegisterFile::ReturnValueRegister].i(); }
+
+        void setArgumentCount(int count) { this[RegisterFile::ArgumentCount] = count; }
+        void setCallee(JSFunction* callee) { this[RegisterFile::Callee] = callee; }
+        void setCodeBlock(CodeBlock* codeBlock) { this[RegisterFile::CodeBlock] = codeBlock; }
+
         static const intptr_t HostCallFrameFlag = 1;
 
         static CallFrame* noCaller() { return reinterpret_cast<CallFrame*>(HostCallFrameFlag); }
diff --git a/JavaScriptCore/interpreter/CallFrameClosure.h b/JavaScriptCore/interpreter/CallFrameClosure.h
new file mode 100644
index 0000000..0e14ced
--- /dev/null
+++ b/JavaScriptCore/interpreter/CallFrameClosure.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CallFrameClosure_h
+#define CallFrameClosure_h
+
+namespace JSC {
+
+struct CallFrameClosure {
+    CallFrame* oldCallFrame;
+    CallFrame* newCallFrame;
+    JSFunction* function;
+    FunctionBodyNode* functionBody;
+    JSGlobalData* globalData;
+    Register* oldEnd;
+    ScopeChainNode* scopeChain;
+    int expectedParams;
+    int providedParams;
+    
+    void setArgument(int arg, JSValue value)
+    {
+        if (arg < expectedParams)
+            newCallFrame[arg - RegisterFile::CallFrameHeaderSize - expectedParams] = value;
+        else
+            newCallFrame[arg - RegisterFile::CallFrameHeaderSize - expectedParams - providedParams] = value;
+    }
+    void resetCallFrame()
+    {
+        newCallFrame->setScopeChain(scopeChain);
+        newCallFrame->setCalleeArguments(0);
+        for (int i = providedParams; i < expectedParams; ++i)
+            newCallFrame[i - RegisterFile::CallFrameHeaderSize - expectedParams] = jsUndefined();
+    }
+};
+
+}
+
+#endif
diff --git a/JavaScriptCore/interpreter/Interpreter.cpp b/JavaScriptCore/interpreter/Interpreter.cpp
index 8178d15..d980962 100644
--- a/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/JavaScriptCore/interpreter/Interpreter.cpp
@@ -32,11 +32,14 @@
 
 #include "Arguments.h"
 #include "BatchedTransitionOptimizer.h"
+#include "CallFrame.h"
+#include "CallFrameClosure.h"
 #include "CodeBlock.h"
+#include "Collector.h"
+#include "Debugger.h"
 #include "DebuggerCallFrame.h"
 #include "EvalCodeCache.h"
 #include "ExceptionHelpers.h"
-#include "CallFrame.h"
 #include "GlobalEvalFunction.h"
 #include "JSActivation.h"
 #include "JSArray.h"
@@ -44,19 +47,19 @@
 #include "JSFunction.h"
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
+#include "LiteralParser.h"
 #include "JSStaticScopeObject.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
+#include "Operations.h"
 #include "Parser.h"
 #include "Profiler.h"
 #include "RegExpObject.h"
 #include "RegExpPrototype.h"
 #include "Register.h"
-#include "Collector.h"
-#include "Debugger.h"
-#include "Operations.h"
 #include "SamplingTool.h"
 #include <stdio.h>
+#include <wtf/Threading.h>
 
 #if ENABLE(JIT)
 #include "JIT.h"
@@ -88,7 +91,8 @@
     return sc.localDepth();
 }
 
-NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+#if USE(INTERPRETER)
+NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int dst = (vPC + 1)->u.operand;
     int property = (vPC + 2)->u.operand;
@@ -104,11 +108,11 @@
         JSObject* o = *iter;
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
-            callFrame[dst] = JSValuePtr(result);
+            callFrame[dst] = JSValue(result);
             return true;
         }
     } while (++iter != end);
@@ -116,7 +120,7 @@
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     CodeBlock* codeBlock = callFrame->codeBlock();
 
@@ -137,11 +141,11 @@
         JSObject* o = *iter;
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
-            callFrame[dst] = JSValuePtr(result);
+            callFrame[dst] = JSValue(result);
             return true;
         }
     } while (++iter != end);
@@ -149,7 +153,7 @@
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int dst = (vPC + 1)->u.operand;
     JSGlobalObject* globalObject = static_cast<JSGlobalObject*>((vPC + 2)->u.jsCell);
@@ -159,7 +163,7 @@
     int offset = (vPC + 5)->u.operand;
 
     if (structure == globalObject->structure()) {
-        callFrame[dst] = JSValuePtr(globalObject->getDirectOffset(offset));
+        callFrame[dst] = JSValue(globalObject->getDirectOffset(offset));
         return true;
     }
 
@@ -167,21 +171,21 @@
     Identifier& ident = codeBlock->identifier(property);
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
-        JSValuePtr result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary()) {
+        JSValue result = slot.getValue(callFrame, ident);
+        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
             if (vPC[4].u.structure)
                 vPC[4].u.structure->deref();
             globalObject->structure()->ref();
             vPC[4] = globalObject->structure();
             vPC[5] = slot.cachedOffset();
-            callFrame[dst] = JSValuePtr(result);
+            callFrame[dst] = JSValue(result);
             return true;
         }
 
         exceptionValue = callFrame->globalData().exception;
         if (exceptionValue)
             return false;
-        callFrame[dst] = JSValuePtr(result);
+        callFrame[dst] = JSValue(result);
         return true;
     }
 
@@ -193,10 +197,10 @@
 {
     int dst = (vPC + 1)->u.operand;
     int property = (vPC + 2)->u.operand;
-    callFrame[dst] = JSValuePtr(JSC::resolveBase(callFrame, callFrame->codeBlock()->identifier(property), callFrame->scopeChain()));
+    callFrame[dst] = JSValue(JSC::resolveBase(callFrame, callFrame->codeBlock()->identifier(property), callFrame->scopeChain()));
 }
 
-NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int baseDst = (vPC + 1)->u.operand;
     int propDst = (vPC + 2)->u.operand;
@@ -217,12 +221,12 @@
         base = *iter;
         PropertySlot slot(base);
         if (base->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
-            callFrame[propDst] = JSValuePtr(result);
-            callFrame[baseDst] = JSValuePtr(base);
+            callFrame[propDst] = JSValue(result);
+            callFrame[baseDst] = JSValue(base);
             return true;
         }
         ++iter;
@@ -232,7 +236,7 @@
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int baseDst = (vPC + 1)->u.operand;
     int funcDst = (vPC + 2)->u.operand;
@@ -261,13 +265,13 @@
             // that in host objects you always get a valid object for this.
             // We also handle wrapper substitution for the global object at the same time.
             JSObject* thisObj = base->toThisObject(callFrame);
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
 
-            callFrame[baseDst] = JSValuePtr(thisObj);
-            callFrame[funcDst] = JSValuePtr(result);
+            callFrame[baseDst] = JSValue(thisObj);
+            callFrame[funcDst] = JSValue(result);
             return true;
         }
         ++iter;
@@ -277,6 +281,8 @@
     return false;
 }
 
+#endif // USE(INTERPRETER)
+
 ALWAYS_INLINE CallFrame* Interpreter::slideRegisterWindowForCall(CodeBlock* newCodeBlock, RegisterFile* registerFile, CallFrame* callFrame, size_t registerOffset, int argc)
 {
     Register* r = callFrame->registers();
@@ -314,31 +320,46 @@
     return CallFrame::create(r);
 }
 
-static NEVER_INLINE bool isNotObject(CallFrame* callFrame, bool forInstanceOf, CodeBlock* codeBlock, const Instruction* vPC, JSValuePtr value, JSValuePtr& exceptionData)
+#if USE(INTERPRETER)
+static NEVER_INLINE bool isInvalidParamForIn(CallFrame* callFrame, CodeBlock* codeBlock, const Instruction* vPC, JSValue value, JSValue& exceptionData)
 {
     if (value.isObject())
         return false;
-    exceptionData = createInvalidParamError(callFrame, forInstanceOf ? "instanceof" : "in" , value, vPC - codeBlock->instructions().begin(), codeBlock);
+    exceptionData = createInvalidParamError(callFrame, "in" , value, vPC - codeBlock->instructions().begin(), codeBlock);
     return true;
 }
 
-NEVER_INLINE JSValuePtr Interpreter::callEval(CallFrame* callFrame, RegisterFile* registerFile, Register* argv, int argc, int registerOffset, JSValuePtr& exceptionValue)
+static NEVER_INLINE bool isInvalidParamForInstanceOf(CallFrame* callFrame, CodeBlock* codeBlock, const Instruction* vPC, JSValue value, JSValue& exceptionData)
+{
+    if (value.isObject() && asObject(value)->structure()->typeInfo().implementsHasInstance())
+        return false;
+    exceptionData = createInvalidParamError(callFrame, "instanceof" , value, vPC - codeBlock->instructions().begin(), codeBlock);
+    return true;
+}
+#endif
+
+NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* registerFile, Register* argv, int argc, int registerOffset, JSValue& exceptionValue)
 {
     if (argc < 2)
         return jsUndefined();
 
-    JSValuePtr program = argv[1].jsValue(callFrame);
+    JSValue program = argv[1].jsValue();
 
     if (!program.isString())
         return program;
 
     UString programSource = asString(program)->value();
 
+    LiteralParser preparser(callFrame, programSource);
+    if (JSValue parsedObject = preparser.tryLiteralParse())
+        return parsedObject;
+    
+    
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     CodeBlock* codeBlock = callFrame->codeBlock();
     RefPtr<EvalNode> evalNode = codeBlock->evalCodeCache().get(callFrame, programSource, scopeChain, exceptionValue);
 
-    JSValuePtr result = jsUndefined();
+    JSValue result = jsUndefined();
     if (evalNode)
         result = callFrame->globalData().interpreter->execute(evalNode.get(), callFrame, callFrame->thisValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain, &exceptionValue);
 
@@ -449,7 +470,7 @@
 #endif
 }
 
-NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValuePtr exceptionValue, unsigned& bytecodeOffset, CodeBlock*& codeBlock)
+NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue exceptionValue, unsigned& bytecodeOffset, CodeBlock*& codeBlock)
 {
     CodeBlock* oldCodeBlock = codeBlock;
     ScopeChainNode* scopeChain = callFrame->scopeChain();
@@ -492,7 +513,7 @@
     return true;
 }
 
-NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSValuePtr& exceptionValue, unsigned bytecodeOffset, bool explicitThrow)
+NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSValue& exceptionValue, unsigned bytecodeOffset, bool explicitThrow)
 {
     // Set up the exception object
 
@@ -546,13 +567,13 @@
     if (Profiler* profiler = *Profiler::enabledProfilerReference()) {
 #if !ENABLE(JIT)
         if (isCallBytecode(codeBlock->instructions()[bytecodeOffset].u.opcode))
-            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 2].u.operand].jsValue(callFrame));
+            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 2].u.operand].jsValue());
         else if (codeBlock->instructions()[bytecodeOffset + 8].u.opcode == getOpcode(op_construct))
-            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 10].u.operand].jsValue(callFrame));
+            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 10].u.operand].jsValue());
 #else
         int functionRegisterIndex;
         if (codeBlock->functionRegisterForBytecodeOffset(bytecodeOffset, functionRegisterIndex))
-            profiler->didExecute(callFrame, callFrame[functionRegisterIndex].jsValue(callFrame));
+            profiler->didExecute(callFrame, callFrame[functionRegisterIndex].jsValue());
 #endif
     }
 
@@ -577,13 +598,15 @@
     return handler;
 }
 
-JSValuePtr Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj, JSValuePtr* exception)
+JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
-    if (m_reentryDepth >= MaxReentryDepth) {
-        *exception = createStackOverflowError(callFrame);
-        return jsNull();
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return jsNull();
+        }
     }
 
     CodeBlock* codeBlock = &programNode->bytecode(scopeChain);
@@ -602,7 +625,7 @@
     globalObject->copyGlobalsTo(m_registerFile);
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd + codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize);
-    newCallFrame[codeBlock->thisRegister()] = JSValuePtr(thisObj);
+    newCallFrame[codeBlock->thisRegister()] = JSValue(thisObj);
     newCallFrame->init(codeBlock, 0, scopeChain, CallFrame::noCaller(), 0, 0, 0);
 
     if (codeBlock->needsFullScopeChain())
@@ -612,15 +635,13 @@
     if (*profiler)
         (*profiler)->willExecute(newCallFrame, programNode->sourceURL(), programNode->lineNo());
 
-    JSValuePtr result;
+    JSValue result;
     {
         SamplingTool::CallRecord callRecord(m_sampler);
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        if (!codeBlock->jitCode())
-            JIT::compile(scopeChain->globalData, codeBlock);
-        result = codeBlock->jitCode().execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = programNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -638,13 +659,15 @@
     return result;
 }
 
-JSValuePtr Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, JSObject* thisObj, const ArgList& args, ScopeChainNode* scopeChain, JSValuePtr* exception)
+JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, JSObject* thisObj, const ArgList& args, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
-    if (m_reentryDepth >= MaxReentryDepth) {
-        *exception = createStackOverflowError(callFrame);
-        return jsNull();
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return jsNull();
+        }
     }
 
     Register* oldEnd = m_registerFile.end();
@@ -659,7 +682,7 @@
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
     size_t dst = 0;
-    newCallFrame[0] = JSValuePtr(thisObj);
+    newCallFrame[0] = JSValue(thisObj);
     ArgList::const_iterator end = args.end();
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
         newCallFrame[++dst] = *it;
@@ -678,15 +701,13 @@
     if (*profiler)
         (*profiler)->willExecute(callFrame, function);
 
-    JSValuePtr result;
+    JSValue result;
     {
         SamplingTool::CallRecord callRecord(m_sampler);
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        if (!codeBlock->jitCode())
-            JIT::compile(scopeChain->globalData, codeBlock);
-        result = codeBlock->jitCode().execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = functionBodyNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -700,18 +721,91 @@
     return result;
 }
 
-JSValuePtr Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain, JSValuePtr* exception)
+CallFrameClosure Interpreter::prepareForRepeatCall(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, int argCount, ScopeChainNode* scopeChain, JSValue* exception)
+{
+    ASSERT(!scopeChain->globalData->exception);
+    
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return CallFrameClosure();
+        }
+    }
+    
+    Register* oldEnd = m_registerFile.end();
+    int argc = 1 + argCount; // implicit "this" parameter
+    
+    if (!m_registerFile.grow(oldEnd + argc)) {
+        *exception = createStackOverflowError(callFrame);
+        return CallFrameClosure();
+    }
+
+    CallFrame* newCallFrame = CallFrame::create(oldEnd);
+    size_t dst = 0;
+    for (int i = 0; i < argc; ++i)
+        newCallFrame[++dst] = jsUndefined();
+    
+    CodeBlock* codeBlock = &functionBodyNode->bytecode(scopeChain);
+    newCallFrame = slideRegisterWindowForCall(codeBlock, &m_registerFile, newCallFrame, argc + RegisterFile::CallFrameHeaderSize, argc);
+    if (UNLIKELY(!newCallFrame)) {
+        *exception = createStackOverflowError(callFrame);
+        m_registerFile.shrink(oldEnd);
+        return CallFrameClosure();
+    }
+    // a 0 codeBlock indicates a built-in caller
+    newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), 0, argc, function);
+#if ENABLE(JIT)
+    functionBodyNode->jitCode(scopeChain);
+#endif
+
+    CallFrameClosure result = { callFrame, newCallFrame, function, functionBodyNode, scopeChain->globalData, oldEnd, scopeChain, codeBlock->m_numParameters, argc };
+    return result;
+}
+
+JSValue Interpreter::execute(CallFrameClosure& closure, JSValue* exception) 
+{
+    closure.resetCallFrame();
+    Profiler** profiler = Profiler::enabledProfilerReference();
+    if (*profiler)
+        (*profiler)->willExecute(closure.oldCallFrame, closure.function);
+    
+    JSValue result;
+    {
+        SamplingTool::CallRecord callRecord(m_sampler);
+        
+        m_reentryDepth++;
+#if ENABLE(JIT)
+        result = closure.functionBody->generatedJITCode().execute(&m_registerFile, closure.newCallFrame, closure.globalData, exception);
+#else
+        result = privateExecute(Normal, &m_registerFile, closure.newCallFrame, exception);
+#endif
+        m_reentryDepth--;
+    }
+    
+    if (*profiler)
+        (*profiler)->didExecute(closure.oldCallFrame, closure.function);
+    return result;
+}
+
+void Interpreter::endRepeatCall(CallFrameClosure& closure)
+{
+    m_registerFile.shrink(closure.oldEnd);
+}
+
+JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception)
 {
     return execute(evalNode, callFrame, thisObj, m_registerFile.size() + evalNode->bytecode(scopeChain).m_numParameters + RegisterFile::CallFrameHeaderSize, scopeChain, exception);
 }
 
-JSValuePtr Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain, JSValuePtr* exception)
+JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
-    if (m_reentryDepth >= MaxReentryDepth) {
-        *exception = createStackOverflowError(callFrame);
-        return jsNull();
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return jsNull();
+        }
     }
 
     DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject());
@@ -760,7 +854,7 @@
     CallFrame* newCallFrame = CallFrame::create(m_registerFile.start() + globalRegisterOffset);
 
     // a 0 codeBlock indicates a built-in caller
-    newCallFrame[codeBlock->thisRegister()] = JSValuePtr(thisObj);
+    newCallFrame[codeBlock->thisRegister()] = JSValue(thisObj);
     newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), 0, 0, 0);
 
     if (codeBlock->needsFullScopeChain())
@@ -770,15 +864,13 @@
     if (*profiler)
         (*profiler)->willExecute(newCallFrame, evalNode->sourceURL(), evalNode->lineNo());
 
-    JSValuePtr result;
+    JSValue result;
     {
         SamplingTool::CallRecord callRecord(m_sampler);
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        if (!codeBlock->jitCode())
-            JIT::compile(scopeChain->globalData, codeBlock);
-        result = codeBlock->jitCode().execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = evalNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -819,30 +911,21 @@
             return;
     }
 }
-
+    
+#if USE(INTERPRETER)
 NEVER_INLINE ScopeChainNode* Interpreter::createExceptionScope(CallFrame* callFrame, const Instruction* vPC)
 {
     int dst = (++vPC)->u.operand;
     CodeBlock* codeBlock = callFrame->codeBlock();
     Identifier& property = codeBlock->identifier((++vPC)->u.operand);
-    JSValuePtr value = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+    JSValue value = callFrame[(++vPC)->u.operand].jsValue();
     JSObject* scope = new (callFrame) JSStaticScopeObject(callFrame, property, value, DontDelete);
-    callFrame[dst] = JSValuePtr(scope);
+    callFrame[dst] = JSValue(scope);
 
     return callFrame->scopeChain()->push(scope);
 }
 
-static StructureChain* cachePrototypeChain(CallFrame* callFrame, Structure* structure)
-{
-    JSValuePtr prototype = structure->prototypeForLookup(callFrame);
-    if (!prototype.isCell())
-        return 0;
-    RefPtr<StructureChain> chain = StructureChain::create(asObject(prototype)->structure());
-    structure->setCachedPrototypeChain(chain.release());
-    return structure->cachedPrototypeChain();
-}
-
-NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValuePtr baseValue, const PutPropertySlot& slot)
+NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValue baseValue, const PutPropertySlot& slot)
 {
     // Recursive invocation may already have specialized this instruction.
     if (vPC[0].u.opcode != getOpcode(op_put_by_id))
@@ -892,16 +975,7 @@
         vPC[0] = getOpcode(op_put_by_id_transition);
         vPC[4] = structure->previousID();
         vPC[5] = structure;
-        StructureChain* chain = structure->cachedPrototypeChain();
-        if (!chain) {
-            chain = cachePrototypeChain(callFrame, structure);
-            if (!chain) {
-                // This happens if someone has manually inserted null into the prototype chain
-                vPC[0] = getOpcode(op_put_by_id_generic);
-                return;
-            }
-        }
-        vPC[6] = chain;
+        vPC[6] = structure->prototypeChain(callFrame);
         vPC[7] = slot.cachedOffset();
         codeBlock->refStructures(vPC);
         return;
@@ -919,7 +993,7 @@
     vPC[4] = 0;
 }
 
-NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot& slot)
+NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValue baseValue, const Identifier& propertyName, const PropertySlot& slot)
 {
     // Recursive invocation may already have specialized this instruction.
     if (vPC[0].u.opcode != getOpcode(op_get_by_id))
@@ -986,11 +1060,8 @@
 
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (baseObject->structure()->isDictionary()) {
-            RefPtr<Structure> transition = Structure::fromDictionaryTransition(baseObject->structure());
-            baseObject->setStructure(transition.release());
-            asCell(baseValue)->structure()->setCachedPrototypeChain(0);
-        }
+        if (baseObject->structure()->isDictionary())
+            baseObject->setStructure(Structure::fromDictionaryTransition(baseObject->structure()));
 
         vPC[0] = getOpcode(op_get_by_id_proto);
         vPC[5] = baseObject->structure();
@@ -1006,14 +1077,9 @@
         return;
     }
 
-    StructureChain* chain = structure->cachedPrototypeChain();
-    if (!chain)
-        chain = cachePrototypeChain(callFrame, structure);
-    ASSERT(chain);
-
     vPC[0] = getOpcode(op_get_by_id_chain);
     vPC[4] = structure;
-    vPC[5] = chain;
+    vPC[5] = structure->prototypeChain(callFrame);
     vPC[6] = count;
     vPC[7] = slot.cachedOffset();
     codeBlock->refStructures(vPC);
@@ -1026,7 +1092,9 @@
     vPC[4] = 0;
 }
 
-JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFile, CallFrame* callFrame, JSValuePtr* exception)
+#endif // USE(INTERPRETER)
+
+JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFile, CallFrame* callFrame, JSValue* exception)
 {
     // One-time initialization of our address tables. We have to put this code
     // here because our labels are only in scope inside this function.
@@ -1041,16 +1109,22 @@
             #undef ADD_OPCODE_ID
             ASSERT(m_opcodeIDTable.size() == numOpcodeIDs);
         #endif // HAVE(COMPUTED_GOTO)
-        return noValue();
+        return JSValue();
     }
 
 #if ENABLE(JIT)
     // Currently with CTI enabled we never interpret functions
     ASSERT_NOT_REACHED();
 #endif
+#if !USE(INTERPRETER)
+    UNUSED_PARAM(registerFile);
+    UNUSED_PARAM(callFrame);
+    UNUSED_PARAM(exception);
+    return JSValue();
+#else
 
     JSGlobalData* globalData = &callFrame->globalData();
-    JSValuePtr exceptionValue = noValue();
+    JSValue exceptionValue;
     HandlerInfo* handler = 0;
 
     Instruction* vPC = callFrame->codeBlock()->instructions().begin();
@@ -1059,7 +1133,7 @@
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
-        if (UNLIKELY(globalData->exception != noValue())) { \
+        if (UNLIKELY(globalData->exception != JSValue())) { \
             exceptionValue = globalData->exception; \
             goto vm_throw; \
         } \
@@ -1111,7 +1185,7 @@
            constructor, and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(constructEmptyObject(callFrame));
+        callFrame[dst] = JSValue(constructEmptyObject(callFrame));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1128,7 +1202,7 @@
         int firstArg = (++vPC)->u.operand;
         int argCount = (++vPC)->u.operand;
         ArgList args(callFrame->registers() + firstArg, argCount);
-        callFrame[dst] = JSValuePtr(constructArray(callFrame, args));
+        callFrame[dst] = JSValue(constructArray(callFrame, args));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1142,7 +1216,7 @@
         */
         int dst = (++vPC)->u.operand;
         int regExp = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject()->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
+        callFrame[dst] = JSValue(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject()->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1167,12 +1241,12 @@
            as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
             callFrame[dst] = JSFastMath::equal(src1, src2);
         else {
-            JSValuePtr result = jsBoolean(JSValuePtr::equalSlowCase(callFrame, src1, src2));
+            JSValue result = jsBoolean(JSValue::equalSlowCase(callFrame, src1, src2));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1187,7 +1261,7 @@
            operator, and puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
 
         if (src.isUndefinedOrNull()) {
             callFrame[dst] = jsBoolean(true);
@@ -1207,12 +1281,12 @@
            result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
             callFrame[dst] = JSFastMath::notEqual(src1, src2);
         else {
-            JSValuePtr result = jsBoolean(!JSValuePtr::equalSlowCase(callFrame, src1, src2));
+            JSValue result = jsBoolean(!JSValue::equalSlowCase(callFrame, src1, src2));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1227,7 +1301,7 @@
            operator, and puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
 
         if (src.isUndefinedOrNull()) {
             callFrame[dst] = jsBoolean(false);
@@ -1247,9 +1321,9 @@
            result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        callFrame[dst] = jsBoolean(JSValuePtr::strictEqual(src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        callFrame[dst] = jsBoolean(JSValue::strictEqual(src1, src2));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1262,9 +1336,9 @@
            puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        callFrame[dst] = jsBoolean(!JSValuePtr::strictEqual(src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        callFrame[dst] = jsBoolean(!JSValue::strictEqual(src1, src2));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1277,9 +1351,9 @@
            a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr result = jsBoolean(jsLess(callFrame, src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue result = jsBoolean(jsLess(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
 
@@ -1294,9 +1368,9 @@
            puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr result = jsBoolean(jsLessEq(callFrame, src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue result = jsBoolean(jsLessEq(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
 
@@ -1310,11 +1384,11 @@
            back in register srcDst.
         */
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
+        JSValue v = callFrame[srcDst].jsValue();
         if (JSFastMath::canDoFastAdditiveOperations(v))
-            callFrame[srcDst] = JSValuePtr(JSFastMath::incImmediateNumber(v));
+            callFrame[srcDst] = JSValue(JSFastMath::incImmediateNumber(v));
         else {
-            JSValuePtr result = jsNumber(callFrame, v.toNumber(callFrame) + 1);
+            JSValue result = jsNumber(callFrame, v.toNumber(callFrame) + 1);
             CHECK_FOR_EXCEPTION();
             callFrame[srcDst] = result;
         }
@@ -1329,11 +1403,11 @@
            back in register srcDst.
         */
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
+        JSValue v = callFrame[srcDst].jsValue();
         if (JSFastMath::canDoFastAdditiveOperations(v))
-            callFrame[srcDst] = JSValuePtr(JSFastMath::decImmediateNumber(v));
+            callFrame[srcDst] = JSValue(JSFastMath::decImmediateNumber(v));
         else {
-            JSValuePtr result = jsNumber(callFrame, v.toNumber(callFrame) - 1);
+            JSValue result = jsNumber(callFrame, v.toNumber(callFrame) - 1);
             CHECK_FOR_EXCEPTION();
             callFrame[srcDst] = result;
         }
@@ -1350,15 +1424,15 @@
         */
         int dst = (++vPC)->u.operand;
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
+        JSValue v = callFrame[srcDst].jsValue();
         if (JSFastMath::canDoFastAdditiveOperations(v)) {
             callFrame[dst] = v;
-            callFrame[srcDst] = JSValuePtr(JSFastMath::incImmediateNumber(v));
+            callFrame[srcDst] = JSValue(JSFastMath::incImmediateNumber(v));
         } else {
-            JSValuePtr number = callFrame[srcDst].jsValue(callFrame).toJSNumber(callFrame);
+            JSValue number = callFrame[srcDst].jsValue().toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = number;
-            callFrame[srcDst] = JSValuePtr(jsNumber(callFrame, number.uncheckedGetNumber() + 1));
+            callFrame[srcDst] = JSValue(jsNumber(callFrame, number.uncheckedGetNumber() + 1));
         }
 
         ++vPC;
@@ -1373,15 +1447,15 @@
         */
         int dst = (++vPC)->u.operand;
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
+        JSValue v = callFrame[srcDst].jsValue();
         if (JSFastMath::canDoFastAdditiveOperations(v)) {
             callFrame[dst] = v;
-            callFrame[srcDst] = JSValuePtr(JSFastMath::decImmediateNumber(v));
+            callFrame[srcDst] = JSValue(JSFastMath::decImmediateNumber(v));
         } else {
-            JSValuePtr number = callFrame[srcDst].jsValue(callFrame).toJSNumber(callFrame);
+            JSValue number = callFrame[srcDst].jsValue().toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = number;
-            callFrame[srcDst] = JSValuePtr(jsNumber(callFrame, number.uncheckedGetNumber() - 1));
+            callFrame[srcDst] = JSValue(jsNumber(callFrame, number.uncheckedGetNumber() - 1));
         }
 
         ++vPC;
@@ -1396,12 +1470,12 @@
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
 
-        JSValuePtr srcVal = callFrame[src].jsValue(callFrame);
+        JSValue srcVal = callFrame[src].jsValue();
 
         if (LIKELY(srcVal.isNumber()))
             callFrame[dst] = callFrame[src];
         else {
-            JSValuePtr result = srcVal.toJSNumber(callFrame);
+            JSValue result = srcVal.toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1416,13 +1490,13 @@
            result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
         ++vPC;
         double v;
         if (src.getNumber(v))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, -v));
+            callFrame[dst] = JSValue(jsNumber(callFrame, -v));
         else {
-            JSValuePtr result = jsNumber(callFrame, -src.toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, -src.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1437,12 +1511,12 @@
            numeric add, depending on the types of the operands.)
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         if (JSFastMath::canDoFastAdditiveOperations(src1, src2))
-            callFrame[dst] = JSValuePtr(JSFastMath::addImmediateNumbers(src1, src2));
+            callFrame[dst] = JSValue(JSFastMath::addImmediateNumbers(src1, src2));
         else {
-            JSValuePtr result = jsAdd(callFrame, src1, src2);
+            JSValue result = jsAdd(callFrame, src1, src2);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1456,21 +1530,21 @@
            numbers), and puts the product in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         double left;
         double right;
-        if (JSValuePtr::areBothInt32Fast(src1, src2)) {
+        if (JSValue::areBothInt32Fast(src1, src2)) {
             int32_t left = src1.getInt32Fast();
             int32_t right = src2.getInt32Fast();
             if ((left | right) >> 15 == 0)
-                callFrame[dst] = JSValuePtr(jsNumber(callFrame, left * right));
+                callFrame[dst] = JSValue(jsNumber(callFrame, left * right));
             else
-                callFrame[dst] = JSValuePtr(jsNumber(callFrame, static_cast<double>(left) * static_cast<double>(right)));
+                callFrame[dst] = JSValue(jsNumber(callFrame, static_cast<double>(left) * static_cast<double>(right)));
         } else if (src1.getNumber(left) && src2.getNumber(right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left * right));
+            callFrame[dst] = JSValue(jsNumber(callFrame, left * right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1.toNumber(callFrame) * src2.toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) * src2.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1486,14 +1560,14 @@
            quotient in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr dividend = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr divisor = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue dividend = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue divisor = callFrame[(++vPC)->u.operand].jsValue();
         double left;
         double right;
         if (dividend.getNumber(left) && divisor.getNumber(right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left / right));
+            callFrame[dst] = JSValue(jsNumber(callFrame, left / right));
         else {
-            JSValuePtr result = jsNumber(callFrame, dividend.toNumber(callFrame) / divisor.toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, dividend.toNumber(callFrame) / divisor.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1511,13 +1585,13 @@
         int dividend = (++vPC)->u.operand;
         int divisor = (++vPC)->u.operand;
 
-        JSValuePtr dividendValue = callFrame[dividend].jsValue(callFrame);
-        JSValuePtr divisorValue = callFrame[divisor].jsValue(callFrame);
+        JSValue dividendValue = callFrame[dividend].jsValue();
+        JSValue divisorValue = callFrame[divisor].jsValue();
 
-        if (JSValuePtr::areBothInt32Fast(dividendValue, divisorValue) && divisorValue != js0()) {
+        if (JSValue::areBothInt32Fast(dividendValue, divisorValue) && divisorValue != jsNumber(callFrame, 0)) {
             // We expect the result of the modulus of a number that was representable as an int32 to also be representable
             // as an int32.
-            JSValuePtr result = JSValuePtr::makeInt32Fast(dividendValue.getInt32Fast() % divisorValue.getInt32Fast());
+            JSValue result = JSValue::makeInt32Fast(dividendValue.getInt32Fast() % divisorValue.getInt32Fast());
             ASSERT(result);
             callFrame[dst] = result;
             ++vPC;
@@ -1525,7 +1599,7 @@
         }
 
         double d = dividendValue.toNumber(callFrame);
-        JSValuePtr result = jsNumber(callFrame, fmod(d, divisorValue.toNumber(callFrame)));
+        JSValue result = jsNumber(callFrame, fmod(d, divisorValue.toNumber(callFrame)));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
         ++vPC;
@@ -1539,16 +1613,16 @@
            register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         double left;
         double right;
         if (JSFastMath::canDoFastAdditiveOperations(src1, src2))
-            callFrame[dst] = JSValuePtr(JSFastMath::subImmediateNumbers(src1, src2));
+            callFrame[dst] = JSValue(JSFastMath::subImmediateNumbers(src1, src2));
         else if (src1.getNumber(left) && src2.getNumber(right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left - right));
+            callFrame[dst] = JSValue(jsNumber(callFrame, left - right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1.toNumber(callFrame) - src2.toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) - src2.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1563,16 +1637,16 @@
            in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr val = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr shift = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue val = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue shift = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         uint32_t right;
-        if (JSValuePtr::areBothInt32Fast(val, shift))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, val.getInt32Fast() << (shift.getInt32Fast() & 0x1f)));
+        if (JSValue::areBothInt32Fast(val, shift))
+            callFrame[dst] = JSValue(jsNumber(callFrame, val.getInt32Fast() << (shift.getInt32Fast() & 0x1f)));
         else if (val.numberToInt32(left) && shift.numberToUInt32(right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left << (right & 0x1f)));
+            callFrame[dst] = JSValue(jsNumber(callFrame, left << (right & 0x1f)));
         else {
-            JSValuePtr result = jsNumber(callFrame, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber(callFrame, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1588,16 +1662,16 @@
            uint32), and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr val = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr shift = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue val = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue shift = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         uint32_t right;
         if (JSFastMath::canDoFastRshift(val, shift))
-            callFrame[dst] = JSValuePtr(JSFastMath::rightShiftImmediateNumbers(val, shift));
+            callFrame[dst] = JSValue(JSFastMath::rightShiftImmediateNumbers(val, shift));
         else if (val.numberToInt32(left) && shift.numberToUInt32(right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left >> (right & 0x1f)));
+            callFrame[dst] = JSValue(jsNumber(callFrame, left >> (right & 0x1f)));
         else {
-            JSValuePtr result = jsNumber(callFrame, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber(callFrame, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1613,12 +1687,12 @@
            uint32), and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr val = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr shift = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue val = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue shift = callFrame[(++vPC)->u.operand].jsValue();
         if (JSFastMath::canDoFastUrshift(val, shift))
-            callFrame[dst] = JSValuePtr(JSFastMath::rightShiftImmediateNumbers(val, shift));
+            callFrame[dst] = JSValue(JSFastMath::rightShiftImmediateNumbers(val, shift));
         else {
-            JSValuePtr result = jsNumber(callFrame, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber(callFrame, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1634,16 +1708,16 @@
            in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         int32_t right;
         if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
-            callFrame[dst] = JSValuePtr(JSFastMath::andImmediateNumbers(src1, src2));
+            callFrame[dst] = JSValue(JSFastMath::andImmediateNumbers(src1, src2));
         else if (src1.numberToInt32(left) && src2.numberToInt32(right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left & right));
+            callFrame[dst] = JSValue(jsNumber(callFrame, left & right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1.toInt32(callFrame) & src2.toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) & src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1659,16 +1733,16 @@
            in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         int32_t right;
         if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
-            callFrame[dst] = JSValuePtr(JSFastMath::xorImmediateNumbers(src1, src2));
+            callFrame[dst] = JSValue(JSFastMath::xorImmediateNumbers(src1, src2));
         else if (src1.numberToInt32(left) && src2.numberToInt32(right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left ^ right));
+            callFrame[dst] = JSValue(jsNumber(callFrame, left ^ right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1684,16 +1758,16 @@
            result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         int32_t right;
         if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
-            callFrame[dst] = JSValuePtr(JSFastMath::orImmediateNumbers(src1, src2));
+            callFrame[dst] = JSValue(JSFastMath::orImmediateNumbers(src1, src2));
         else if (src1.numberToInt32(left) && src2.numberToInt32(right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left | right));
+            callFrame[dst] = JSValue(jsNumber(callFrame, left | right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1.toInt32(callFrame) | src2.toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) | src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1708,12 +1782,12 @@
            and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
         int32_t value;
         if (src.numberToInt32(value))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, ~value));
+            callFrame[dst] = JSValue(jsNumber(callFrame, ~value));
         else {
-            JSValuePtr result = jsNumber(callFrame, ~src.toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, ~src.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1728,7 +1802,7 @@
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        JSValuePtr result = jsBoolean(!callFrame[src].jsValue(callFrame).toBoolean(callFrame));
+        JSValue result = jsBoolean(!callFrame[src].jsValue().toBoolean(callFrame));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
 
@@ -1753,18 +1827,14 @@
         int base = vPC[3].u.operand;
         int baseProto = vPC[4].u.operand;
 
-        JSValuePtr baseVal = callFrame[base].jsValue(callFrame);
+        JSValue baseVal = callFrame[base].jsValue();
 
-        if (isNotObject(callFrame, true, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
+        if (isInvalidParamForInstanceOf(callFrame, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
             goto vm_throw;
 
-        JSObject* baseObj = asObject(baseVal);
-        if (baseObj->structure()->typeInfo().implementsHasInstance()) {
-            bool result = baseObj->hasInstance(callFrame, callFrame[value].jsValue(callFrame), callFrame[baseProto].jsValue(callFrame));
-            CHECK_FOR_EXCEPTION();
-            callFrame[dst] = jsBoolean(result);
-        } else
-            callFrame[dst] = jsBoolean(false);
+        bool result = asObject(baseVal)->hasInstance(callFrame, callFrame[value].jsValue(), callFrame[baseProto].jsValue());
+        CHECK_FOR_EXCEPTION();
+        callFrame[dst] = jsBoolean(result);
 
         vPC += 5;
         NEXT_INSTRUCTION();
@@ -1777,7 +1847,7 @@
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(jsTypeStringForValue(callFrame, callFrame[src].jsValue(callFrame)));
+        callFrame[dst] = JSValue(jsTypeStringForValue(callFrame, callFrame[src].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1791,7 +1861,7 @@
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[src].jsValue(callFrame);
+        JSValue v = callFrame[src].jsValue();
         callFrame[dst] = jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined());
 
         ++vPC;
@@ -1806,7 +1876,7 @@
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(callFrame[src].jsValue(callFrame).isBoolean());
+        callFrame[dst] = jsBoolean(callFrame[src].jsValue().isBoolean());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1820,7 +1890,7 @@
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(callFrame[src].jsValue(callFrame).isNumber());
+        callFrame[dst] = jsBoolean(callFrame[src].jsValue().isNumber());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1834,7 +1904,7 @@
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(callFrame[src].jsValue(callFrame).isString());
+        callFrame[dst] = jsBoolean(callFrame[src].jsValue().isString());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1848,7 +1918,7 @@
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(jsIsObjectType(callFrame[src].jsValue(callFrame)));
+        callFrame[dst] = jsBoolean(jsIsObjectType(callFrame[src].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1862,7 +1932,7 @@
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(jsIsFunctionType(callFrame[src].jsValue(callFrame)));
+        callFrame[dst] = jsBoolean(jsIsFunctionType(callFrame[src].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1880,13 +1950,13 @@
         int property = (++vPC)->u.operand;
         int base = (++vPC)->u.operand;
 
-        JSValuePtr baseVal = callFrame[base].jsValue(callFrame);
-        if (isNotObject(callFrame, false, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
+        JSValue baseVal = callFrame[base].jsValue();
+        if (isInvalidParamForIn(callFrame, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
             goto vm_throw;
 
         JSObject* baseObj = asObject(baseVal);
 
-        JSValuePtr propName = callFrame[property].jsValue(callFrame);
+        JSValue propName = callFrame[property].jsValue();
 
         uint32_t i;
         if (propName.getUInt32(i))
@@ -1966,7 +2036,7 @@
         int index = (++vPC)->u.operand;
         int value = (++vPC)->u.operand;
         
-        scope->registerAt(index) = JSValuePtr(callFrame[value].jsValue(callFrame));
+        scope->registerAt(index) = JSValue(callFrame[value].jsValue());
         ++vPC;
         NEXT_INSTRUCTION();
     }            
@@ -2014,7 +2084,7 @@
 
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
-        scope->registerAt(index) = JSValuePtr(callFrame[value].jsValue(callFrame));
+        scope->registerAt(index) = JSValue(callFrame[value].jsValue());
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -2082,9 +2152,9 @@
 
         CodeBlock* codeBlock = callFrame->codeBlock();
         Identifier& ident = codeBlock->identifier(property);
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         PropertySlot slot(baseValue);
-        JSValuePtr result = baseValue.get(callFrame, ident, slot);
+        JSValue result = baseValue.get(callFrame, ident, slot);
         CHECK_FOR_EXCEPTION();
 
         tryCacheGetByID(callFrame, codeBlock, vPC, baseValue, ident, slot);
@@ -2101,7 +2171,7 @@
            op_get_by_id.
         */
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
@@ -2114,7 +2184,7 @@
                 int offset = vPC[5].u.operand;
 
                 ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
-                callFrame[dst] = JSValuePtr(baseObject->getDirectOffset(offset));
+                callFrame[dst] = JSValue(baseObject->getDirectOffset(offset));
 
                 vPC += 8;
                 NEXT_INSTRUCTION();
@@ -2132,7 +2202,7 @@
            reverts to op_get_by_id.
         */
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
@@ -2148,7 +2218,7 @@
                     int offset = vPC[6].u.operand;
 
                     ASSERT(protoObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == protoObject->getDirectOffset(offset));
-                    callFrame[dst] = JSValuePtr(protoObject->getDirectOffset(offset));
+                    callFrame[dst] = JSValue(protoObject->getDirectOffset(offset));
 
                     vPC += 8;
                     NEXT_INSTRUCTION();
@@ -2181,7 +2251,7 @@
            reverts to op_get_by_id.
         */
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
@@ -2203,7 +2273,7 @@
                         int offset = vPC[7].u.operand;
 
                         ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
-                        callFrame[dst] = JSValuePtr(baseObject->getDirectOffset(offset));
+                        callFrame[dst] = JSValue(baseObject->getDirectOffset(offset));
 
                         vPC += 8;
                         NEXT_INSTRUCTION();
@@ -2229,9 +2299,9 @@
         int property = vPC[3].u.operand;
 
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         PropertySlot slot(baseValue);
-        JSValuePtr result = baseValue.get(callFrame, ident, slot);
+        JSValue result = baseValue.get(callFrame, ident, slot);
         CHECK_FOR_EXCEPTION();
 
         callFrame[dst] = result;
@@ -2247,10 +2317,10 @@
         */
 
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         if (LIKELY(isJSArray(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, asArray(baseValue)->length()));
+            callFrame[dst] = JSValue(jsNumber(callFrame, asArray(baseValue)->length()));
             vPC += 8;
             NEXT_INSTRUCTION();
         }
@@ -2267,10 +2337,10 @@
         */
 
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, asString(baseValue)->value().size()));
+            callFrame[dst] = JSValue(jsNumber(callFrame, asString(baseValue)->value().size()));
             vPC += 8;
             NEXT_INSTRUCTION();
         }
@@ -2293,10 +2363,10 @@
         int value = vPC[3].u.operand;
 
         CodeBlock* codeBlock = callFrame->codeBlock();
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         Identifier& ident = codeBlock->identifier(property);
         PutPropertySlot slot;
-        baseValue.put(callFrame, ident, callFrame[value].jsValue(callFrame), slot);
+        baseValue.put(callFrame, ident, callFrame[value].jsValue(), slot);
         CHECK_FOR_EXCEPTION();
 
         tryCachePutByID(callFrame, codeBlock, vPC, baseValue, slot);
@@ -2316,7 +2386,7 @@
            the register file.
          */
         int base = vPC[1].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
@@ -2329,7 +2399,7 @@
 
                 RefPtr<Structure>* it = vPC[6].u.structureChain->head();
 
-                JSValuePtr proto = baseObject->structure()->prototypeForLookup(callFrame);
+                JSValue proto = baseObject->structure()->prototypeForLookup(callFrame);
                 while (!proto.isNull()) {
                     if (UNLIKELY(asObject(proto)->structure() != (*it).get())) {
                         uncachePutByID(callFrame->codeBlock(), vPC);
@@ -2344,7 +2414,7 @@
                 int value = vPC[3].u.operand;
                 unsigned offset = vPC[7].u.operand;
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
-                baseObject->putDirectOffset(offset, callFrame[value].jsValue(callFrame));
+                baseObject->putDirectOffset(offset, callFrame[value].jsValue());
 
                 vPC += 8;
                 NEXT_INSTRUCTION();
@@ -2366,7 +2436,7 @@
            the register file.
         */
         int base = vPC[1].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
@@ -2379,7 +2449,7 @@
                 unsigned offset = vPC[5].u.operand;
                 
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
-                baseObject->putDirectOffset(offset, callFrame[value].jsValue(callFrame));
+                baseObject->putDirectOffset(offset, callFrame[value].jsValue());
 
                 vPC += 8;
                 NEXT_INSTRUCTION();
@@ -2402,10 +2472,10 @@
         int property = vPC[2].u.operand;
         int value = vPC[3].u.operand;
 
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         Identifier& ident = callFrame->codeBlock()->identifier(property);
         PutPropertySlot slot;
-        baseValue.put(callFrame, ident, callFrame[value].jsValue(callFrame), slot);
+        baseValue.put(callFrame, ident, callFrame[value].jsValue(), slot);
         CHECK_FOR_EXCEPTION();
 
         vPC += 8;
@@ -2423,9 +2493,9 @@
         int base = (++vPC)->u.operand;
         int property = (++vPC)->u.operand;
 
-        JSObject* baseObj = callFrame[base].jsValue(callFrame).toObject(callFrame);
+        JSObject* baseObj = callFrame[base].jsValue().toObject(callFrame);
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        JSValuePtr result = jsBoolean(baseObj->deleteProperty(callFrame, ident));
+        JSValue result = jsBoolean(baseObj->deleteProperty(callFrame, ident));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
         ++vPC;
@@ -2443,10 +2513,10 @@
         int base = (++vPC)->u.operand;
         int property = (++vPC)->u.operand;
         
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
-        JSValuePtr subscript = callFrame[property].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
+        JSValue subscript = callFrame[property].jsValue();
 
-        JSValuePtr result;
+        JSValue result;
 
         if (LIKELY(subscript.isUInt32Fast())) {
             uint32_t i = subscript.getUInt32Fast();
@@ -2487,21 +2557,21 @@
         int property = (++vPC)->u.operand;
         int value = (++vPC)->u.operand;
 
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
-        JSValuePtr subscript = callFrame[property].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
+        JSValue subscript = callFrame[property].jsValue();
 
         if (LIKELY(subscript.isUInt32Fast())) {
             uint32_t i = subscript.getUInt32Fast();
             if (isJSArray(globalData, baseValue)) {
                 JSArray* jsArray = asArray(baseValue);
                 if (jsArray->canSetIndex(i))
-                    jsArray->setIndex(i, callFrame[value].jsValue(callFrame));
+                    jsArray->setIndex(i, callFrame[value].jsValue());
                 else
-                    jsArray->JSArray::put(callFrame, i, callFrame[value].jsValue(callFrame));
+                    jsArray->JSArray::put(callFrame, i, callFrame[value].jsValue());
             } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
                 JSByteArray* jsByteArray = asByteArray(baseValue);
                 double dValue = 0;
-                JSValuePtr jsValue = callFrame[value].jsValue(callFrame);
+                JSValue jsValue = callFrame[value].jsValue();
                 if (jsValue.isInt32Fast())
                     jsByteArray->setIndex(i, jsValue.getInt32Fast());
                 else if (jsValue.getNumber(dValue))
@@ -2509,12 +2579,12 @@
                 else
                     baseValue.put(callFrame, i, jsValue);
             } else
-                baseValue.put(callFrame, i, callFrame[value].jsValue(callFrame));
+                baseValue.put(callFrame, i, callFrame[value].jsValue());
         } else {
             Identifier property(callFrame, subscript.toString(callFrame));
             if (!globalData->exception) { // Don't put to an object if toString threw an exception.
                 PutPropertySlot slot;
-                baseValue.put(callFrame, property, callFrame[value].jsValue(callFrame), slot);
+                baseValue.put(callFrame, property, callFrame[value].jsValue(), slot);
             }
         }
 
@@ -2534,10 +2604,10 @@
         int base = (++vPC)->u.operand;
         int property = (++vPC)->u.operand;
 
-        JSObject* baseObj = callFrame[base].jsValue(callFrame).toObject(callFrame); // may throw
+        JSObject* baseObj = callFrame[base].jsValue().toObject(callFrame); // may throw
 
-        JSValuePtr subscript = callFrame[property].jsValue(callFrame);
-        JSValuePtr result;
+        JSValue subscript = callFrame[property].jsValue();
+        JSValue result;
         uint32_t i;
         if (subscript.getUInt32(i))
             result = jsBoolean(baseObj->deleteProperty(callFrame, i));
@@ -2569,7 +2639,7 @@
         unsigned property = (++vPC)->u.operand;
         int value = (++vPC)->u.operand;
 
-        callFrame[base].jsValue(callFrame).put(callFrame, property, callFrame[value].jsValue(callFrame));
+        callFrame[base].jsValue().put(callFrame, property, callFrame[value].jsValue());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2616,7 +2686,7 @@
          */
         int cond = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        if (callFrame[cond].jsValue(callFrame).toBoolean(callFrame)) {
+        if (callFrame[cond].jsValue().toBoolean(callFrame)) {
             vPC += target;
             CHECK_FOR_TIMEOUT();
             NEXT_INSTRUCTION();
@@ -2633,7 +2703,7 @@
         */
         int cond = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        if (callFrame[cond].jsValue(callFrame).toBoolean(callFrame)) {
+        if (callFrame[cond].jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -2649,7 +2719,7 @@
         */
         int cond = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        if (!callFrame[cond].jsValue(callFrame).toBoolean(callFrame)) {
+        if (!callFrame[cond].jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -2665,7 +2735,7 @@
         */
         int src = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        JSValuePtr srcValue = callFrame[src].jsValue(callFrame);
+        JSValue srcValue = callFrame[src].jsValue();
 
         if (srcValue.isUndefinedOrNull() || (srcValue.isCell() && srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
             vPC += target;
@@ -2683,7 +2753,7 @@
         */
         int src = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        JSValuePtr srcValue = callFrame[src].jsValue(callFrame);
+        JSValue srcValue = callFrame[src].jsValue();
 
         if (!srcValue.isUndefinedOrNull() || (srcValue.isCell() && !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
             vPC += target;
@@ -2693,6 +2763,24 @@
         ++vPC;
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_jneq_ptr) {
+        /* jneq_ptr src(r) ptr(jsCell) target(offset)
+         
+           Jumps to offset target from the current instruction, if the value r is equal
+           to ptr, using pointer equality.
+         */
+        int src = (++vPC)->u.operand;
+        JSValue ptr = JSValue((++vPC)->u.jsCell);
+        int target = (++vPC)->u.operand;
+        JSValue srcValue = callFrame[src].jsValue();
+        if (srcValue != ptr) {
+            vPC += target;
+            NEXT_INSTRUCTION();
+        }
+
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_loop_if_less) {
         /* loop_if_less src1(r) src2(r) target(offset)
 
@@ -2704,8 +2792,8 @@
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
          */
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int target = (++vPC)->u.operand;
         
         bool result = jsLess(callFrame, src1, src2);
@@ -2731,8 +2819,8 @@
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
         */
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int target = (++vPC)->u.operand;
         
         bool result = jsLessEq(callFrame, src1, src2);
@@ -2755,8 +2843,8 @@
            target from the current instruction, if and only if the 
            result of the comparison is false.
         */
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int target = (++vPC)->u.operand;
 
         bool result = jsLess(callFrame, src1, src2);
@@ -2770,6 +2858,29 @@
         ++vPC;
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_jnlesseq) {
+        /* jnlesseq src1(r) src2(r) target(offset)
+
+           Checks whether register src1 is less than or equal to
+           register src2, as with the ECMAScript '<=' operator,
+           and then jumps to offset target from the current instruction,
+           if and only if theresult of the comparison is false.
+        */
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        int target = (++vPC)->u.operand;
+
+        bool result = jsLessEq(callFrame, src1, src2);
+        CHECK_FOR_EXCEPTION();
+        
+        if (!result) {
+            vPC += target;
+            NEXT_INSTRUCTION();
+        }
+
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_switch_imm) {
         /* switch_imm tableIndex(n) defaultOffset(offset) scrutinee(r)
 
@@ -2781,7 +2892,7 @@
          */
         int tableIndex = (++vPC)->u.operand;
         int defaultOffset = (++vPC)->u.operand;
-        JSValuePtr scrutinee = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue scrutinee = callFrame[(++vPC)->u.operand].jsValue();
         if (scrutinee.isInt32Fast())
             vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(scrutinee.getInt32Fast(), defaultOffset);
         else {
@@ -2805,7 +2916,7 @@
          */
         int tableIndex = (++vPC)->u.operand;
         int defaultOffset = (++vPC)->u.operand;
-        JSValuePtr scrutinee = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue scrutinee = callFrame[(++vPC)->u.operand].jsValue();
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else {
@@ -2828,7 +2939,7 @@
          */
         int tableIndex = (++vPC)->u.operand;
         int defaultOffset = (++vPC)->u.operand;
-        JSValuePtr scrutinee = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue scrutinee = callFrame[(++vPC)->u.operand].jsValue();
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else 
@@ -2884,15 +2995,15 @@
         int argCount = vPC[3].u.operand;
         int registerOffset = vPC[4].u.operand;
 
-        JSValuePtr funcVal = callFrame[func].jsValue(callFrame);
+        JSValue funcVal = callFrame[func].jsValue();
 
         Register* newCallFrame = callFrame->registers() + registerOffset;
         Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
-        JSValuePtr thisValue = argv[0].jsValue(callFrame);
+        JSValue thisValue = argv[0].jsValue();
         JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
 
         if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
-            JSValuePtr result = callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
+            JSValue result = callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
             if (exceptionValue)
                 goto vm_throw;
             callFrame[dst] = result;
@@ -2921,7 +3032,7 @@
         int argCount = vPC[3].u.operand;
         int registerOffset = vPC[4].u.operand;
 
-        JSValuePtr v = callFrame[func].jsValue(callFrame);
+        JSValue v = callFrame[func].jsValue();
 
         CallData callData;
         CallType callType = v.getCallData(callData);
@@ -2959,18 +3070,18 @@
             ArgList args(thisRegister + 1, argCount - 1);
 
             // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
-            JSValuePtr thisValue = thisRegister->jsValue(callFrame);
+            JSValue thisValue = thisRegister->jsValue();
             if (thisValue == jsNull())
                 thisValue = callFrame->globalThisValue();
 
-            JSValuePtr returnValue;
+            JSValue returnValue;
             {
                 SamplingTool::HostCallRecord callRecord(m_sampler);
                 returnValue = callData.native.function(newCallFrame, asObject(v), thisValue, args);
             }
             CHECK_FOR_EXCEPTION();
 
-            callFrame[dst] = JSValuePtr(returnValue);
+            callFrame[dst] = JSValue(returnValue);
 
             vPC += 5;
             NEXT_INSTRUCTION();
@@ -2981,6 +3092,160 @@
         exceptionValue = createNotAFunctionError(callFrame, v, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
         goto vm_throw;
     }
+    DEFINE_OPCODE(op_load_varargs) {
+        int argCountDst = (++vPC)->u.operand;
+        int argsOffset = (++vPC)->u.operand;
+        
+        JSValue arguments = callFrame[argsOffset].jsValue();
+        uint32_t argCount = 0;
+        if (!arguments) {
+            argCount = (uint32_t)(callFrame[RegisterFile::ArgumentCount].u.i) - 1;
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                exceptionValue = createStackOverflowError(callFrame);
+                goto vm_throw;
+            }
+            uint32_t expectedParams = asFunction(callFrame[RegisterFile::Callee].jsValue())->body()->parameterCount();
+            uint32_t inplaceArgs = min(argCount, expectedParams);
+            uint32_t i = 0;
+            Register* argStore = callFrame->registers() + argsOffset;
+
+            // First step is to copy the "expected" parameters from their normal location relative to the callframe
+            for (; i < inplaceArgs; i++)
+                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams];
+            // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this')
+            for (; i < argCount; i++)
+                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - argCount - 1];
+        } else if (!arguments.isUndefinedOrNull()) {
+            if (!arguments.isObject()) {
+                exceptionValue = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
+                goto vm_throw;
+            }
+            if (asObject(arguments)->classInfo() == &Arguments::info) {
+                Arguments* args = asArguments(arguments);
+                argCount = args->numProvidedArguments(callFrame);
+                int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+                Register* newEnd = callFrame->registers() + sizeDelta;
+                if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                    exceptionValue = createStackOverflowError(callFrame);
+                    goto vm_throw;
+                }
+                args->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+            } else if (isJSArray(&callFrame->globalData(), arguments)) {
+                JSArray* array = asArray(arguments);
+                argCount = array->length();
+                int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+                Register* newEnd = callFrame->registers() + sizeDelta;
+                if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                    exceptionValue = createStackOverflowError(callFrame);
+                    goto vm_throw;
+                }
+                array->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+            } else if (asObject(arguments)->inherits(&JSArray::info)) {
+                JSObject* argObject = asObject(arguments);
+                argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
+                int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+                Register* newEnd = callFrame->registers() + sizeDelta;
+                if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                    exceptionValue = createStackOverflowError(callFrame);
+                    goto vm_throw;
+                }
+                Register* argsBuffer = callFrame->registers() + argsOffset;
+                for (unsigned i = 0; i < argCount; ++i) {
+                    argsBuffer[i] = asObject(arguments)->get(callFrame, i);
+                    CHECK_FOR_EXCEPTION();
+                }
+            } else {
+                if (!arguments.isObject()) {
+                    exceptionValue = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
+                    goto vm_throw;
+                }
+            }
+        }
+        CHECK_FOR_EXCEPTION();
+        callFrame[argCountDst] = argCount + 1;
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_call_varargs) {
+        /* call_varargs dst(r) func(r) argCountReg(r) baseRegisterOffset(n)
+         
+         Perform a function call with a dynamic set of arguments.
+         
+         registerOffset is the distance the callFrame pointer should move
+         before the VM initializes the new call frame's header, excluding
+         space for arguments.
+         
+         dst is where op_ret should store its result.
+         */
+        
+        int dst = vPC[1].u.operand;
+        int func = vPC[2].u.operand;
+        int argCountReg = vPC[3].u.operand;
+        int registerOffset = vPC[4].u.operand;
+        
+        JSValue v = callFrame[func].jsValue();
+        int argCount = callFrame[argCountReg].i();
+        registerOffset += argCount;
+        CallData callData;
+        CallType callType = v.getCallData(callData);
+        
+        if (callType == CallTypeJS) {
+            ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
+            FunctionBodyNode* functionBodyNode = callData.js.functionBody;
+            CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
+            
+            CallFrame* previousCallFrame = callFrame;
+            
+            callFrame = slideRegisterWindowForCall(newCodeBlock, registerFile, callFrame, registerOffset, argCount);
+            if (UNLIKELY(!callFrame)) {
+                callFrame = previousCallFrame;
+                exceptionValue = createStackOverflowError(callFrame);
+                goto vm_throw;
+            }
+            
+            callFrame->init(newCodeBlock, vPC + 5, callDataScopeChain, previousCallFrame, dst, argCount, asFunction(v));
+            vPC = newCodeBlock->instructions().begin();
+            
+#if ENABLE(OPCODE_STATS)
+            OpcodeStats::resetLastInstruction();
+#endif
+            
+            NEXT_INSTRUCTION();
+        }
+        
+        if (callType == CallTypeHost) {
+            ScopeChainNode* scopeChain = callFrame->scopeChain();
+            CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
+            newCallFrame->init(0, vPC + 5, scopeChain, callFrame, dst, argCount, 0);
+            
+            Register* thisRegister = newCallFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
+            ArgList args(thisRegister + 1, argCount - 1);
+            
+            // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
+            JSValue thisValue = thisRegister->jsValue();
+            if (thisValue == jsNull())
+                thisValue = callFrame->globalThisValue();
+            
+            JSValue returnValue;
+            {
+                SamplingTool::HostCallRecord callRecord(m_sampler);
+                returnValue = callData.native.function(newCallFrame, asObject(v), thisValue, args);
+            }
+            CHECK_FOR_EXCEPTION();
+            
+            callFrame[dst] = JSValue(returnValue);
+            
+            vPC += 5;
+            NEXT_INSTRUCTION();
+        }
+        
+        ASSERT(callType == CallTypeNone);
+        
+        exceptionValue = createNotAFunctionError(callFrame, v, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
+        goto vm_throw;
+    }
     DEFINE_OPCODE(op_tear_off_activation) {
         /* tear_off_activation activation(r)
 
@@ -2997,7 +3262,7 @@
         int src = (++vPC)->u.operand;
         ASSERT(callFrame->codeBlock()->needsFullScopeChain());
 
-        asActivation(callFrame[src].getJSValue())->copyRegisters(callFrame->optionalCalleeArguments());
+        asActivation(callFrame[src].jsValue())->copyRegisters(callFrame->optionalCalleeArguments());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3016,8 +3281,8 @@
         */
 
         ASSERT(callFrame->codeBlock()->usesArguments() && !callFrame->codeBlock()->needsFullScopeChain());
-
-        callFrame->optionalCalleeArguments()->copyRegisters();
+        if (callFrame->optionalCalleeArguments())
+            callFrame->optionalCalleeArguments()->copyRegisters();
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3037,7 +3302,7 @@
         if (callFrame->codeBlock()->needsFullScopeChain())
             callFrame->scopeChain()->deref();
 
-        JSValuePtr returnValue = callFrame[result].jsValue(callFrame);
+        JSValue returnValue = callFrame[result].jsValue();
 
         vPC = callFrame->returnPC();
         int dst = callFrame->returnValueRegister();
@@ -3046,7 +3311,7 @@
         if (callFrame->hasHostCallFrameFlag())
             return returnValue;
 
-        callFrame[dst] = JSValuePtr(returnValue);
+        callFrame[dst] = JSValue(returnValue);
 
         NEXT_INSTRUCTION();
     }
@@ -3116,28 +3381,40 @@
         */
 
         int thisRegister = (++vPC)->u.operand;
-        JSValuePtr thisVal = callFrame[thisRegister].getJSValue();
+        JSValue thisVal = callFrame[thisRegister].jsValue();
         if (thisVal.needsThisConversion())
-            callFrame[thisRegister] = JSValuePtr(thisVal.toThisObject(callFrame));
+            callFrame[thisRegister] = JSValue(thisVal.toThisObject(callFrame));
 
         ++vPC;
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_init_arguments) {
+        /* create_arguments
+
+           Initialises the arguments object reference to null to ensure
+           we can correctly detect that we need to create it later (or
+           avoid creating it altogether).
+
+           This opcode should only be used at the beginning of a code
+           block.
+         */
+        callFrame[RegisterFile::ArgumentsRegister] = JSValue();
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_create_arguments) {
         /* create_arguments
 
            Creates the 'arguments' object and places it in both the
            'arguments' call frame slot and the local 'arguments'
-           register.
-
-           This opcode should only be used at the beginning of a code
-           block.
-        */
-
-        Arguments* arguments = new (globalData) Arguments(callFrame);
-        callFrame->setCalleeArguments(arguments);
-        callFrame[RegisterFile::ArgumentsRegister] = arguments;
+           register, if it has not already been initialised.
+         */
         
+         if (!callFrame->optionalCalleeArguments()) {
+             Arguments* arguments = new (globalData) Arguments(callFrame);
+             callFrame->setCalleeArguments(arguments);
+             callFrame[RegisterFile::ArgumentsRegister] = arguments;
+         }
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -3163,7 +3440,7 @@
         int proto = vPC[5].u.operand;
         int thisRegister = vPC[6].u.operand;
 
-        JSValuePtr v = callFrame[func].jsValue(callFrame);
+        JSValue v = callFrame[func].jsValue();
 
         ConstructData constructData;
         ConstructType constructType = v.getConstructData(constructData);
@@ -3174,14 +3451,14 @@
             CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
 
             Structure* structure;
-            JSValuePtr prototype = callFrame[proto].jsValue(callFrame);
+            JSValue prototype = callFrame[proto].jsValue();
             if (prototype.isObject())
                 structure = asObject(prototype)->inheritorID();
             else
                 structure = callDataScopeChain->globalObject()->emptyObjectStructure();
             JSObject* newObject = new (globalData) JSObject(structure);
 
-            callFrame[thisRegister] = JSValuePtr(newObject); // "this" value
+            callFrame[thisRegister] = JSValue(newObject); // "this" value
 
             CallFrame* previousCallFrame = callFrame;
 
@@ -3209,13 +3486,13 @@
             CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
             newCallFrame->init(0, vPC + 7, scopeChain, callFrame, dst, argCount, 0);
 
-            JSValuePtr returnValue;
+            JSValue returnValue;
             {
                 SamplingTool::HostCallRecord callRecord(m_sampler);
                 returnValue = constructData.native.function(newCallFrame, asObject(v), args);
             }
             CHECK_FOR_EXCEPTION();
-            callFrame[dst] = JSValuePtr(returnValue);
+            callFrame[dst] = JSValue(returnValue);
 
             vPC += 7;
             NEXT_INSTRUCTION();
@@ -3234,7 +3511,7 @@
         */
 
         int dst = vPC[1].u.operand;
-        if (LIKELY(callFrame[dst].jsValue(callFrame).isObject())) {
+        if (LIKELY(callFrame[dst].jsValue().isObject())) {
             vPC += 3;
             NEXT_INSTRUCTION();
         }
@@ -3245,6 +3522,25 @@
         vPC += 3;
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_strcat) {
+        int dst = (++vPC)->u.operand;
+        int src = (++vPC)->u.operand;
+        int count = (++vPC)->u.operand;
+
+        callFrame[dst] = concatenateStrings(callFrame, &callFrame->registers()[src], count);
+        ++vPC;
+
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_to_primitive) {
+        int dst = (++vPC)->u.operand;
+        int src = (++vPC)->u.operand;
+
+        callFrame[dst] = callFrame[src].jsValue().toPrimitive(callFrame);
+        ++vPC;
+
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_push_scope) {
         /* push_scope scope(r)
 
@@ -3253,11 +3549,11 @@
            are replaced by the result of toObject conversion of the scope.
         */
         int scope = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[scope].jsValue(callFrame);
+        JSValue v = callFrame[scope].jsValue();
         JSObject* o = v.toObject(callFrame);
         CHECK_FOR_EXCEPTION();
 
-        callFrame[scope] = JSValuePtr(o);
+        callFrame[scope] = JSValue(o);
         callFrame->setScopeChain(callFrame->scopeChain()->push(o));
 
         ++vPC;
@@ -3284,7 +3580,7 @@
         int dst = (++vPC)->u.operand;
         int base = (++vPC)->u.operand;
 
-        callFrame[dst] = JSPropertyNameIterator::create(callFrame, callFrame[base].jsValue(callFrame));
+        callFrame[dst] = JSPropertyNameIterator::create(callFrame, callFrame[base].jsValue());
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -3302,9 +3598,9 @@
         int target = (++vPC)->u.operand;
 
         JSPropertyNameIterator* it = callFrame[iter].propertyNameIterator();
-        if (JSValuePtr temp = it->next(callFrame)) {
+        if (JSValue temp = it->next(callFrame)) {
             CHECK_FOR_TIMEOUT();
-            callFrame[dst] = JSValuePtr(temp);
+            callFrame[dst] = JSValue(temp);
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3361,7 +3657,7 @@
         ASSERT(!globalData->exception);
         int ex = (++vPC)->u.operand;
         callFrame[ex] = exceptionValue;
-        exceptionValue = noValue();
+        exceptionValue = JSValue();
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3378,7 +3674,7 @@
         */
 
         int ex = (++vPC)->u.operand;
-        exceptionValue = callFrame[ex].jsValue(callFrame);
+        exceptionValue = callFrame[ex].jsValue();
 
         handler = throwException(callFrame, exceptionValue, vPC - callFrame->codeBlock()->instructions().begin(), true);
         if (!handler) {
@@ -3396,7 +3692,7 @@
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(callFrame->codeBlock()->unexpectedConstant(src));
+        callFrame[dst] = JSValue(callFrame->codeBlock()->unexpectedConstant(src));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3414,7 +3710,7 @@
         int message = (++vPC)->u.operand;
 
         CodeBlock* codeBlock = callFrame->codeBlock();
-        callFrame[dst] = JSValuePtr(Error::create(callFrame, (ErrorType)type, codeBlock->unexpectedConstant(message).toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL()));
+        callFrame[dst] = JSValue(Error::create(callFrame, (ErrorType)type, codeBlock->unexpectedConstant(message).toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3432,7 +3728,7 @@
             scopeChain->deref();
         }
         int result = (++vPC)->u.operand;
-        return callFrame[result].jsValue(callFrame);
+        return callFrame[result].jsValue();
     }
     DEFINE_OPCODE(op_put_getter) {
         /* put_getter base(r) property(id) function(r)
@@ -3449,11 +3745,11 @@
         int property = (++vPC)->u.operand;
         int function = (++vPC)->u.operand;
 
-        ASSERT(callFrame[base].jsValue(callFrame).isObject());
-        JSObject* baseObj = asObject(callFrame[base].jsValue(callFrame));
+        ASSERT(callFrame[base].jsValue().isObject());
+        JSObject* baseObj = asObject(callFrame[base].jsValue());
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        ASSERT(callFrame[function].jsValue(callFrame).isObject());
-        baseObj->defineGetter(callFrame, ident, asObject(callFrame[function].jsValue(callFrame)));
+        ASSERT(callFrame[function].jsValue().isObject());
+        baseObj->defineGetter(callFrame, ident, asObject(callFrame[function].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3473,15 +3769,19 @@
         int property = (++vPC)->u.operand;
         int function = (++vPC)->u.operand;
 
-        ASSERT(callFrame[base].jsValue(callFrame).isObject());
-        JSObject* baseObj = asObject(callFrame[base].jsValue(callFrame));
+        ASSERT(callFrame[base].jsValue().isObject());
+        JSObject* baseObj = asObject(callFrame[base].jsValue());
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        ASSERT(callFrame[function].jsValue(callFrame).isObject());
-        baseObj->defineSetter(callFrame, ident, asObject(callFrame[function].jsValue(callFrame)));
+        ASSERT(callFrame[function].jsValue().isObject());
+        baseObj->defineSetter(callFrame, ident, asObject(callFrame[function].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_method_check) {
+        vPC++;
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_jsr) {
         /* jsr retAddrDst(r) target(offset)
 
@@ -3530,7 +3830,7 @@
         int function = vPC[1].u.operand;
 
         if (*enabledProfilerReference)
-            (*enabledProfilerReference)->willExecute(callFrame, callFrame[function].jsValue(callFrame));
+            (*enabledProfilerReference)->willExecute(callFrame, callFrame[function].jsValue());
 
         vPC += 2;
         NEXT_INSTRUCTION();
@@ -3544,13 +3844,13 @@
         int function = vPC[1].u.operand;
 
         if (*enabledProfilerReference)
-            (*enabledProfilerReference)->didExecute(callFrame, callFrame[function].jsValue(callFrame));
+            (*enabledProfilerReference)->didExecute(callFrame, callFrame[function].jsValue());
 
         vPC += 2;
         NEXT_INSTRUCTION();
     }
     vm_throw: {
-        globalData->exception = noValue();
+        globalData->exception = JSValue();
         if (!tickCount) {
             // The exceptionValue is a lie! (GCC produces bad code for reasons I 
             // cannot fathom if we don't assign to the exceptionValue before branching)
@@ -3569,13 +3869,14 @@
 #if !HAVE(COMPUTED_GOTO)
     } // iterator loop ends
 #endif
+#endif // USE(INTERPRETER)
     #undef NEXT_INSTRUCTION
     #undef DEFINE_OPCODE
     #undef CHECK_FOR_EXCEPTION
     #undef CHECK_FOR_TIMEOUT
 }
 
-JSValuePtr Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* function) const
+JSValue Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* function) const
 {
     CallFrame* functionCallFrame = findFunctionCallFrame(callFrame, function);
     if (!functionCallFrame)
@@ -3586,7 +3887,12 @@
         ASSERT(codeBlock->codeType() == FunctionCode);
         SymbolTable& symbolTable = codeBlock->symbolTable();
         int argumentsIndex = symbolTable.get(functionCallFrame->propertyNames().arguments.ustring().rep()).getIndex();
-        return functionCallFrame[argumentsIndex].jsValue(callFrame);
+        if (!functionCallFrame[argumentsIndex].arguments()) {
+            Arguments* arguments = new (callFrame) Arguments(functionCallFrame);
+            functionCallFrame->setCalleeArguments(arguments);
+            functionCallFrame[RegisterFile::ArgumentsRegister] = arguments;
+        }
+        return functionCallFrame[argumentsIndex].jsValue();
     }
 
     Arguments* arguments = functionCallFrame->optionalCalleeArguments();
@@ -3599,7 +3905,7 @@
     return arguments;
 }
 
-JSValuePtr Interpreter::retrieveCaller(CallFrame* callFrame, InternalFunction* function) const
+JSValue Interpreter::retrieveCaller(CallFrame* callFrame, InternalFunction* function) const
 {
     CallFrame* functionCallFrame = findFunctionCallFrame(callFrame, function);
     if (!functionCallFrame)
@@ -3609,16 +3915,16 @@
     if (callerFrame->hasHostCallFrameFlag())
         return jsNull();
 
-    JSValuePtr caller = callerFrame->callee();
+    JSValue caller = callerFrame->callee();
     if (!caller)
         return jsNull();
 
     return caller;
 }
 
-void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValuePtr& function) const
+void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValue& function) const
 {
-    function = noValue();
+    function = JSValue();
     lineNumber = -1;
     sourceURL = UString();
 
@@ -3646,2140 +3952,4 @@
     return 0;
 }
 
-#ifdef MANUAL_MERGE_REQUIRED
-#if ENABLE(JIT)
-
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-NEVER_INLINE void Interpreter::tryCTICachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValuePtr baseValue, const PutPropertySlot& slot)
-{
-    // The interpreter checks for recursion here; I do not believe this can occur in CTI.
-
-    if (!baseValue.isCell())
-        return;
-
-    // Uncacheable: give up.
-    if (!slot.isCacheable()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_put_by_id_generic));
-        return;
-    }
-    
-    JSCell* baseCell = asCell(baseValue);
-    Structure* structure = baseCell->structure();
-
-    if (structure->isDictionary()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_put_by_id_generic));
-        return;
-    }
-
-    // If baseCell != base, then baseCell must be a proxy for another object.
-    if (baseCell != slot.base()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_put_by_id_generic));
-        return;
-    }
-
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
-
-    // Cache hit: Specialize instruction and ref Structures.
-
-    // Structure transition, cache transition info
-    if (slot.type() == PutPropertySlot::NewProperty) {
-        StructureChain* chain = structure->cachedPrototypeChain();
-        if (!chain) {
-            chain = cachePrototypeChain(callFrame, structure);
-            if (!chain) {
-                // This happens if someone has manually inserted null into the prototype chain 
-                stubInfo->opcodeID = op_put_by_id_generic;
-                return;
-            }
-        }
-        stubInfo->initPutByIdTransition(structure->previousID(), structure, chain);
-        JIT::compilePutByIdTransition(callFrame->scopeChain()->globalData, codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), chain, returnAddress);
-        return;
-    }
-    
-    stubInfo->initPutByIdReplace(structure);
-
-#if USE(CTI_REPATCH_PIC)
-    UNUSED_PARAM(callFrame);
-    JIT::patchPutByIdReplace(stubInfo, structure, slot.cachedOffset(), returnAddress);
-#else
-    JIT::compilePutByIdReplace(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
-#endif
-}
-
-NEVER_INLINE void Interpreter::tryCTICacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot& slot)
-{
-    // FIXME: Write a test that proves we need to check for recursion here just
-    // like the interpreter does, then add a check for recursion.
-
-    // FIXME: Cache property access for immediates.
-    if (!baseValue.isCell()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-        return;
-    }
-
-    if (isJSArray(baseValue) && propertyName == callFrame->propertyNames().length) {
-#if USE(CTI_REPATCH_PIC)
-        JIT::compilePatchGetArrayLength(callFrame->scopeChain()->globalData, codeBlock, returnAddress);
-#else
-        ctiPatchCallByReturnAddress(returnAddress, m_ctiArrayLengthTrampoline);
-#endif
-        return;
-    }
-    if (isJSString(baseValue) && propertyName == callFrame->propertyNames().length) {
-        // The tradeoff of compiling an patched inline string length access routine does not seem
-        // to pay off, so we currently only do this for arrays.
-        ctiPatchCallByReturnAddress(returnAddress, m_ctiStringLengthTrampoline);
-        return;
-    }
-
-    // Uncacheable: give up.
-    if (!slot.isCacheable()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-        return;
-    }
-
-    JSCell* baseCell = asCell(baseValue);
-    Structure* structure = baseCell->structure();
-
-    if (structure->isDictionary()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-        return;
-    }
-
-    // In the interpreter the last structure is trapped here; in CTI we use the
-    // *_second method to achieve a similar (but not quite the same) effect.
-
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
-
-    // Cache hit: Specialize instruction and ref Structures.
-
-    if (slot.slotBase() == baseValue) {
-        // set this up, so derefStructures can do it's job.
-        stubInfo->initGetByIdSelf(structure);
-        
-#if USE(CTI_REPATCH_PIC)
-        JIT::patchGetByIdSelf(stubInfo, structure, slot.cachedOffset(), returnAddress);
-#else
-        JIT::compileGetByIdSelf(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
-#endif
-        return;
-    }
-
-    if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
-        ASSERT(slot.slotBase().isObject());
-
-        JSObject* slotBaseObject = asObject(slot.slotBase());
-
-        // Since we're accessing a prototype in a loop, it's a good bet that it
-        // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary()) {
-            RefPtr<Structure> transition = Structure::fromDictionaryTransition(slotBaseObject->structure());
-            slotBaseObject->setStructure(transition.release());
-            asCell(baseValue)->structure()->setCachedPrototypeChain(0);
-        }
-        
-        stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
-
-        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), slot.cachedOffset(), returnAddress);
-        return;
-    }
-
-    size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
-    if (!count) {
-        stubInfo->opcodeID = op_get_by_id_generic;
-        return;
-    }
-
-    StructureChain* chain = structure->cachedPrototypeChain();
-    if (!chain)
-        chain = cachePrototypeChain(callFrame, structure);
-    ASSERT(chain);
-
-    stubInfo->initGetByIdChain(structure, chain);
-
-    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, chain, count, slot.cachedOffset(), returnAddress);
-}
-
-#endif
-
-#if USE(JIT_STUB_ARGUMENT_VA_LIST)
-#define SETUP_VA_LISTL_ARGS va_list vl_args; va_start(vl_args, args)
-#else // JIT_STUB_ARGUMENT_REGISTER or JIT_STUB_ARGUMENT_STACK
-#define SETUP_VA_LISTL_ARGS
-#endif
-
-#ifndef NDEBUG
-
-extern "C" {
-
-static void jscGeneratedNativeCode() 
-{
-    // When executing a CTI function (which might do an allocation), we hack the return address
-    // to pretend to be executing this function, to keep stack logging tools from blowing out
-    // memory.
-}
-
-}
-
-struct StackHack {
-    ALWAYS_INLINE StackHack(void** location) 
-    { 
-        returnAddressLocation = location;
-        savedReturnAddress = *returnAddressLocation;
-        ctiSetReturnAddress(returnAddressLocation, reinterpret_cast<void*>(jscGeneratedNativeCode));
-    }
-    ALWAYS_INLINE ~StackHack() 
-    { 
-        ctiSetReturnAddress(returnAddressLocation, savedReturnAddress);
-    }
-
-    void** returnAddressLocation;
-    void* savedReturnAddress;
-};
-
-#define BEGIN_STUB_FUNCTION() SETUP_VA_LISTL_ARGS; StackHack stackHack(&STUB_RETURN_ADDRESS_SLOT)
-#define STUB_SET_RETURN_ADDRESS(address) stackHack.savedReturnAddress = address
-#define STUB_RETURN_ADDRESS stackHack.savedReturnAddress
-
-#else
-
-#define BEGIN_STUB_FUNCTION() SETUP_VA_LISTL_ARGS
-#define STUB_SET_RETURN_ADDRESS(address) ctiSetReturnAddress(&STUB_RETURN_ADDRESS_SLOT, address);
-#define STUB_RETURN_ADDRESS STUB_RETURN_ADDRESS_SLOT
-
-#endif
-
-// The reason this is not inlined is to avoid having to do a PIC branch
-// to get the address of the ctiVMThrowTrampoline function. It's also
-// good to keep the code size down by leaving as much of the exception
-// handling code out of line as possible.
-static NEVER_INLINE void returnToThrowTrampoline(JSGlobalData* globalData, void* exceptionLocation, void*& returnAddressSlot)
-{
-    ASSERT(globalData->exception);
-    globalData->exceptionLocation = exceptionLocation;
-    ctiSetReturnAddress(&returnAddressSlot, reinterpret_cast<void*>(ctiVMThrowTrampoline));
-}
-
-static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalData* globalData, void* exceptionLocation, void*& returnAddressSlot)
-{
-    globalData->exception = createStackOverflowError(callFrame);
-    returnToThrowTrampoline(globalData, exceptionLocation, returnAddressSlot);
-}
-
-#define VM_THROW_EXCEPTION() \
-    do { \
-        VM_THROW_EXCEPTION_AT_END(); \
-        return 0; \
-    } while (0)
-#define VM_THROW_EXCEPTION_2() \
-    do { \
-        VM_THROW_EXCEPTION_AT_END(); \
-        RETURN_PAIR(0, 0); \
-    } while (0)
-#define VM_THROW_EXCEPTION_AT_END() \
-    returnToThrowTrampoline(ARG_globalData, STUB_RETURN_ADDRESS, STUB_RETURN_ADDRESS)
-
-#define CHECK_FOR_EXCEPTION() \
-    do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) \
-            VM_THROW_EXCEPTION(); \
-    } while (0)
-#define CHECK_FOR_EXCEPTION_AT_END() \
-    do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) \
-            VM_THROW_EXCEPTION_AT_END(); \
-    } while (0)
-#define CHECK_FOR_EXCEPTION_VOID() \
-    do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) { \
-            VM_THROW_EXCEPTION_AT_END(); \
-            return; \
-        } \
-    } while (0)
-
-JSObject* Interpreter::cti_op_convert_this(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v1 = ARG_src1;
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSObject* result = v1.toThisObject(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-void Interpreter::cti_op_end(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ScopeChainNode* scopeChain = ARG_callFrame->scopeChain();
-    ASSERT(scopeChain->refCount > 1);
-    scopeChain->deref();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_add(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v1 = ARG_src1;
-    JSValuePtr v2 = ARG_src2;
-
-    double left;
-    double right = 0.0;
-
-    bool rightIsNumber = v2.getNumber(right);
-    if (rightIsNumber && v1.getNumber(left))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left + right));
-    
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool leftIsString = v1.isString();
-    if (leftIsString && v2.isString()) {
-        RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-
-        return JSValuePtr::encode(jsString(ARG_globalData, value.release()));
-    }
-
-    if (rightIsNumber & leftIsString) {
-        RefPtr<UString::Rep> value = v2.isInt32Fast() ?
-            concatenate(asString(v1)->value().rep(), v2.getInt32Fast()) :
-            concatenate(asString(v1)->value().rep(), right);
-
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-        return JSValuePtr::encode(jsString(ARG_globalData, value.release()));
-    }
-
-    // All other cases are pretty uncommon
-    JSValuePtr result = jsAddSlowCase(callFrame, v1, v2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_pre_inc(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, v.toNumber(callFrame) + 1);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_timeout_check(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-    Interpreter* interpreter = ARG_globalData->interpreter;
-
-    if (interpreter->checkTimeout(ARG_callFrame->dynamicGlobalObject())) {
-        ARG_globalData->exception = createInterruptedExecutionException(ARG_globalData);
-        VM_THROW_EXCEPTION_AT_END();
-    }
-    
-    return interpreter->m_ticksUntilNextTimeoutCheck;
-}
-
-void Interpreter::cti_register_file_check(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    if (LIKELY(ARG_registerFile->grow(ARG_callFrame + ARG_callFrame->codeBlock()->m_numCalleeRegisters)))
-        return;
-
-    // Rewind to the previous call frame because op_call already optimistically
-    // moved the call frame forward.
-    CallFrame* oldCallFrame = ARG_callFrame->callerFrame();
-    ARG_setCallFrame(oldCallFrame);
-    throwStackOverflowError(oldCallFrame, ARG_globalData, oldCallFrame->returnPC(), STUB_RETURN_ADDRESS);
-}
-
-int Interpreter::cti_op_loop_if_less(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = jsLess(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-int Interpreter::cti_op_loop_if_lesseq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = jsLessEq(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-JSObject* Interpreter::cti_op_new_object(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return constructEmptyObject(ARG_callFrame);
-}
-
-void Interpreter::cti_op_put_by_id_generic(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    PutPropertySlot slot;
-    ARG_src1.put(ARG_callFrame, *ARG_id2, ARG_src3, slot);
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_generic(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(callFrame, ident, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-void Interpreter::cti_op_put_by_id(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    PutPropertySlot slot;
-    ARG_src1.put(callFrame, ident, ARG_src3, slot);
-
-    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_put_by_id_second));
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-void Interpreter::cti_op_put_by_id_second(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    PutPropertySlot slot;
-    ARG_src1.put(ARG_callFrame, *ARG_id2, ARG_src3, slot);
-    ARG_globalData->interpreter->tryCTICachePutByID(ARG_callFrame, ARG_callFrame->codeBlock(), STUB_RETURN_ADDRESS, ARG_src1, slot);
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-void Interpreter::cti_op_put_by_id_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    PutPropertySlot slot;
-    ARG_src1.put(callFrame, ident, ARG_src3, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(callFrame, ident, slot);
-
-    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_second));
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_second(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(callFrame, ident, slot);
-
-    ARG_globalData->interpreter->tryCTICacheGetByID(callFrame, callFrame->codeBlock(), STUB_RETURN_ADDRESS, baseValue, ident, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_self_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(callFrame, ident, slot);
-
-    CHECK_FOR_EXCEPTION();
-
-    if (baseValue.isCell()
-        && slot.isCacheable()
-        && !asCell(baseValue)->structure()->isDictionary()
-        && slot.slotBase() == baseValue) {
-
-        CodeBlock* codeBlock = callFrame->codeBlock();
-        StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
-
-        ASSERT(slot.slotBase().isObject());
-
-        PolymorphicAccessStructureList* polymorphicStructureList;
-        int listIndex = 1;
-
-        if (stubInfo->opcodeID == op_get_by_id_self) {
-            ASSERT(!stubInfo->stubRoutine);
-            polymorphicStructureList = new PolymorphicAccessStructureList(0, stubInfo->u.getByIdSelf.baseObjectStructure);
-            stubInfo->initGetByIdSelfList(polymorphicStructureList, 2);
-        } else {
-            polymorphicStructureList = stubInfo->u.getByIdSelfList.structureList;
-            listIndex = stubInfo->u.getByIdSelfList.listSize;
-            stubInfo->u.getByIdSelfList.listSize++;
-        }
-
-        JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-    } else {
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-    }
-    return JSValuePtr::encode(result);
-}
-
-static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(StructureStubInfo* stubInfo, int& listIndex)
-{
-    PolymorphicAccessStructureList* prototypeStructureList = 0;
-    listIndex = 1;
-
-    switch (stubInfo->opcodeID) {
-    case op_get_by_id_proto:
-        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure, stubInfo->u.getByIdProto.prototypeStructure);
-        stubInfo->stubRoutine = 0;
-        stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
-        break;
-    case op_get_by_id_chain:
-        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure, stubInfo->u.getByIdChain.chain);
-        stubInfo->stubRoutine = 0;
-        stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
-        break;
-    case op_get_by_id_proto_list:
-        prototypeStructureList = stubInfo->u.getByIdProtoList.structureList;
-        listIndex = stubInfo->u.getByIdProtoList.listSize;
-        stubInfo->u.getByIdProtoList.listSize++;
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-    }
-    
-    ASSERT(listIndex < POLYMORPHIC_LIST_CACHE_SIZE);
-    return prototypeStructureList;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_proto_list(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION();
-
-    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
-        return JSValuePtr::encode(result);
-    }
-
-    Structure* structure = asCell(baseValue)->structure();
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
-
-    ASSERT(slot.slotBase().isObject());
-    JSObject* slotBaseObject = asObject(slot.slotBase());
-
-    if (slot.slotBase() == baseValue)
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
-    else if (slot.slotBase() == asCell(baseValue)->structure()->prototypeForLookup(callFrame)) {
-        // Since we're accessing a prototype in a loop, it's a good bet that it
-        // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary()) {
-            RefPtr<Structure> transition = Structure::fromDictionaryTransition(slotBaseObject->structure());
-            slotBaseObject->setStructure(transition.release());
-            asCell(baseValue)->structure()->setCachedPrototypeChain(0);
-        }
-
-        int listIndex;
-        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
-
-        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_list_full));
-    } else if (size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot)) {
-        StructureChain* chain = structure->cachedPrototypeChain();
-        if (!chain)
-            chain = cachePrototypeChain(callFrame, structure);
-        ASSERT(chain);
-
-        int listIndex;
-        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
-
-        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, chain, count, slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_list_full));
-    } else
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
-
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_proto_list_full(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_proto_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_array_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_string_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-#endif
-
-JSValueEncodedAsPointer* Interpreter::cti_op_instanceof(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr value = ARG_src1;
-    JSValuePtr baseVal = ARG_src2;
-    JSValuePtr proto = ARG_src3;
-
-    // at least one of these checks must have failed to get to the slow case
-    ASSERT(!value.isCell() || !baseVal.isCell() || !proto.isCell()
-           || !value.isObject() || !baseVal.isObject() || !proto.isObject() 
-           || (asObject(baseVal)->structure()->typeInfo().flags() & (ImplementsHasInstance | OverridesHasInstance)) != ImplementsHasInstance);
-
-    if (!baseVal.isObject()) {
-        CallFrame* callFrame = ARG_callFrame;
-        CodeBlock* codeBlock = callFrame->codeBlock();
-        unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-        ARG_globalData->exception = createInvalidParamError(callFrame, "instanceof", baseVal, vPCIndex, codeBlock);
-        VM_THROW_EXCEPTION();
-    }
-
-    if (!asObject(baseVal)->structure()->typeInfo().implementsHasInstance())
-        return JSValuePtr::encode(jsBoolean(false));
-
-    if (!proto.isObject()) {
-        throwError(callFrame, TypeError, "instanceof called on an object with an invalid prototype property.");
-        VM_THROW_EXCEPTION();
-    }
-        
-    if (!value.isObject())
-        return JSValuePtr::encode(jsBoolean(false));
-
-    JSValuePtr result = jsBoolean(asObject(baseVal)->hasInstance(callFrame, value, proto));
-    CHECK_FOR_EXCEPTION_AT_END();
-
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_del_by_id(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    
-    JSObject* baseObj = ARG_src1.toObject(callFrame);
-
-    JSValuePtr result = jsBoolean(baseObj->deleteProperty(callFrame, *ARG_id2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_mul(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    double left;
-    double right;
-    if (src1.getNumber(left) && src2.getNumber(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left * right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toNumber(callFrame) * src2.toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSObject* Interpreter::cti_op_new_func(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return ARG_func1->makeFunction(ARG_callFrame, ARG_callFrame->scopeChain());
-}
-
-void* Interpreter::cti_op_call_JSFunction(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-#ifndef NDEBUG
-    CallData callData;
-    ASSERT(ARG_src1.getCallData(callData) == CallTypeJS);
-#endif
-
-    ScopeChainNode* callDataScopeChain = asFunction(ARG_src1)->m_scopeChain.node();
-    CodeBlock* newCodeBlock = &asFunction(ARG_src1)->body()->bytecode(callDataScopeChain);
-
-    if (!newCodeBlock->jitCode())
-        JIT::compile(ARG_globalData, newCodeBlock);
-
-    return newCodeBlock;
-}
-
-VoidPtrPair Interpreter::cti_op_call_arityCheck(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* newCodeBlock = ARG_codeBlock4;
-    int argCount = ARG_int3;
-
-    ASSERT(argCount != newCodeBlock->m_numParameters);
-
-    CallFrame* oldCallFrame = callFrame->callerFrame();
-
-    if (argCount > newCodeBlock->m_numParameters) {
-        size_t numParameters = newCodeBlock->m_numParameters;
-        Register* r = callFrame->registers() + numParameters;
-
-        Register* argv = r - RegisterFile::CallFrameHeaderSize - numParameters - argCount;
-        for (size_t i = 0; i < numParameters; ++i)
-            argv[i + argCount] = argv[i];
-
-        callFrame = CallFrame::create(r);
-        callFrame->setCallerFrame(oldCallFrame);
-    } else {
-        size_t omittedArgCount = newCodeBlock->m_numParameters - argCount;
-        Register* r = callFrame->registers() + omittedArgCount;
-        Register* newEnd = r + newCodeBlock->m_numCalleeRegisters;
-        if (!ARG_registerFile->grow(newEnd)) {
-            // Rewind to the previous call frame because op_call already optimistically
-            // moved the call frame forward.
-            ARG_setCallFrame(oldCallFrame);
-            throwStackOverflowError(oldCallFrame, ARG_globalData, ARG_returnAddress2, STUB_RETURN_ADDRESS);
-            RETURN_PAIR(0, 0);
-        }
-
-        Register* argv = r - RegisterFile::CallFrameHeaderSize - omittedArgCount;
-        for (size_t i = 0; i < omittedArgCount; ++i)
-            argv[i] = jsUndefined();
-
-        callFrame = CallFrame::create(r);
-        callFrame->setCallerFrame(oldCallFrame);
-    }
-
-    RETURN_PAIR(newCodeBlock, callFrame);
-}
-
-void* Interpreter::cti_vm_dontLazyLinkCall(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSFunction* callee = asFunction(ARG_src1);
-    CodeBlock* codeBlock = &callee->body()->bytecode(callee->m_scopeChain.node());
-    if (!codeBlock->jitCode())
-        JIT::compile(ARG_globalData, codeBlock);
-
-    ctiPatchCallByReturnAddress(ARG_returnAddress2, ARG_globalData->interpreter->m_ctiVirtualCallLink);
-
-    return codeBlock->jitCode();
-}
-
-void* Interpreter::cti_vm_lazyLinkCall(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSFunction* callee = asFunction(ARG_src1);
-    CodeBlock* codeBlock = &callee->body()->bytecode(callee->m_scopeChain.node());
-    if (!codeBlock->jitCode())
-        JIT::compile(ARG_globalData, codeBlock);
-
-    CallLinkInfo* callLinkInfo = &ARG_callFrame->callerFrame()->codeBlock()->getCallLinkInfo(ARG_returnAddress2);
-    JIT::linkCall(callee, codeBlock, codeBlock->jitCode(), callLinkInfo, ARG_int3);
-
-    return codeBlock->jitCode();
-}
-
-JSObject* Interpreter::cti_op_push_activation(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSActivation* activation = new (ARG_globalData) JSActivation(ARG_callFrame, static_cast<FunctionBodyNode*>(ARG_callFrame->codeBlock()->ownerNode()));
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->copy()->push(activation));
-    return activation;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_call_NotJSFunction(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr funcVal = ARG_src1;
-
-    CallData callData;
-    CallType callType = funcVal.getCallData(callData);
-
-    ASSERT(callType != CallTypeJS);
-
-    if (callType == CallTypeHost) {
-        int registerOffset = ARG_int2;
-        int argCount = ARG_int3;
-        CallFrame* previousCallFrame = ARG_callFrame;
-        CallFrame* callFrame = CallFrame::create(previousCallFrame->registers() + registerOffset);
-
-        callFrame->init(0, static_cast<Instruction*>(STUB_RETURN_ADDRESS), previousCallFrame->scopeChain(), previousCallFrame, 0, argCount, 0);
-        ARG_setCallFrame(callFrame);
-
-        Register* argv = ARG_callFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
-        ArgList argList(argv + 1, argCount - 1);
-
-        JSValuePtr returnValue;
-        {
-            SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
-
-            // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
-            JSValuePtr thisValue = argv[0].jsValue(callFrame);
-            if (thisValue == jsNull())
-                thisValue = callFrame->globalThisValue();
-
-            returnValue = callData.native.function(callFrame, asObject(funcVal), thisValue, argList);
-        }
-        ARG_setCallFrame(previousCallFrame);
-        CHECK_FOR_EXCEPTION();
-
-        return JSValuePtr::encode(returnValue);
-    }
-
-    ASSERT(callType == CallTypeNone);
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createNotAFunctionError(ARG_callFrame, funcVal, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-void Interpreter::cti_op_create_arguments(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    Arguments* arguments = new (ARG_globalData) Arguments(ARG_callFrame);
-    ARG_callFrame->setCalleeArguments(arguments);
-    ARG_callFrame[RegisterFile::ArgumentsRegister] = arguments;
-}
-
-void Interpreter::cti_op_create_arguments_no_params(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    Arguments* arguments = new (ARG_globalData) Arguments(ARG_callFrame, Arguments::NoParameters);
-    ARG_callFrame->setCalleeArguments(arguments);
-    ARG_callFrame[RegisterFile::ArgumentsRegister] = arguments;
-}
-
-void Interpreter::cti_op_tear_off_activation(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(ARG_callFrame->codeBlock()->needsFullScopeChain());
-    asActivation(ARG_src1)->copyRegisters(ARG_callFrame->optionalCalleeArguments());
-}
-
-void Interpreter::cti_op_tear_off_arguments(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(ARG_callFrame->codeBlock()->usesArguments() && !ARG_callFrame->codeBlock()->needsFullScopeChain());
-    ARG_callFrame->optionalCalleeArguments()->copyRegisters();
-}
-
-void Interpreter::cti_op_profile_will_call(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(*ARG_profilerReference);
-    (*ARG_profilerReference)->willExecute(ARG_callFrame, ARG_src1);
-}
-
-void Interpreter::cti_op_profile_did_call(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(*ARG_profilerReference);
-    (*ARG_profilerReference)->didExecute(ARG_callFrame, ARG_src1);
-}
-
-void Interpreter::cti_op_ret_scopeChain(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(ARG_callFrame->codeBlock()->needsFullScopeChain());
-    ARG_callFrame->scopeChain()->deref();
-}
-
-JSObject* Interpreter::cti_op_new_array(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ArgList argList(&ARG_callFrame->registers()[ARG_int1], ARG_int2);
-    return constructArray(ARG_callFrame, argList);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-
-    Identifier& ident = *ARG_id1;
-    do {
-        JSObject* o = *iter;
-        PropertySlot slot(o);
-        if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-            return JSValuePtr::encode(result);
-        }
-    } while (++iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-JSObject* Interpreter::cti_op_construct_JSConstruct(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-#ifndef NDEBUG
-    ConstructData constructData;
-    ASSERT(asFunction(ARG_src1)->getConstructData(constructData) == ConstructTypeJS);
-#endif
-
-    Structure* structure;
-    if (ARG_src4.isObject())
-        structure = asObject(ARG_src4)->inheritorID();
-    else
-        structure = asFunction(ARG_src1)->m_scopeChain.node()->globalObject()->emptyObjectStructure();
-    return new (ARG_globalData) JSObject(structure);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_construct_NotJSConstruct(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr constrVal = ARG_src1;
-    int argCount = ARG_int3;
-    int thisRegister = ARG_int5;
-
-    ConstructData constructData;
-    ConstructType constructType = constrVal.getConstructData(constructData);
-
-    if (constructType == ConstructTypeHost) {
-        ArgList argList(callFrame->registers() + thisRegister + 1, argCount - 1);
-
-        JSValuePtr returnValue;
-        {
-            SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
-            returnValue = constructData.native.function(callFrame, asObject(constrVal), argList);
-        }
-        CHECK_FOR_EXCEPTION();
-
-        return JSValuePtr::encode(returnValue);
-    }
-
-    ASSERT(constructType == ConstructTypeNone);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createNotAConstructorError(callFrame, constrVal, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_val(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Interpreter* interpreter = ARG_globalData->interpreter;
-
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
-
-    JSValuePtr result;
-
-    if (LIKELY(subscript.isUInt32Fast())) {
-        uint32_t i = subscript.getUInt32Fast();
-        if (interpreter->isJSArray(baseValue)) {
-            JSArray* jsArray = asArray(baseValue);
-            if (jsArray->canGetIndex(i))
-                result = jsArray->getIndex(i);
-            else
-                result = jsArray->JSArray::get(callFrame, i);
-        } else if (interpreter->isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
-            result = asString(baseValue)->getIndex(ARG_globalData, i);
-        else if (interpreter->isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
-            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_val_byte_array));
-            return JSValuePtr::encode(asByteArray(baseValue)->getIndex(callFrame, i));
-        } else
-            result = baseValue.get(callFrame, i);
-    } else {
-        Identifier property(callFrame, subscript.toString(callFrame));
-        result = baseValue.get(callFrame, property);
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_val_byte_array(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-    
-    CallFrame* callFrame = ARG_callFrame;
-    Interpreter* interpreter = ARG_globalData->interpreter;
-    
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
-    
-    JSValuePtr result;
-
-    if (LIKELY(subscript.isUInt32Fast())) {
-        uint32_t i = subscript.getUInt32Fast();
-        if (interpreter->isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
-            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
-            return JSValuePtr::encode(asByteArray(baseValue)->getIndex(callFrame, i));
-        }
-
-        result = baseValue.get(callFrame, i);
-        if (!interpreter->isJSByteArray(baseValue))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_val));
-    } else {
-        Identifier property(callFrame, subscript.toString(callFrame));
-        result = baseValue.get(callFrame, property);
-    }
-    
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-VoidPtrPair Interpreter::cti_op_resolve_func(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    Identifier& ident = *ARG_id1;
-    JSObject* base;
-    do {
-        base = *iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {            
-            // ECMA 11.2.3 says that if we hit an activation the this value should be null.
-            // However, section 10.2.3 says that in the case where the value provided
-            // by the caller is null, the global object should be used. It also says
-            // that the section does not apply to internal functions, but for simplicity
-            // of implementation we use the global object anyway here. This guarantees
-            // that in host objects you always get a valid object for this.
-            // We also handle wrapper substitution for the global object at the same time.
-            JSObject* thisObj = base->toThisObject(callFrame);
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-
-            RETURN_PAIR(thisObj, JSValuePtr::encode(result));
-        }
-        ++iter;
-    } while (iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION_2();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_sub(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    double left;
-    double right;
-    if (src1.getNumber(left) && src2.getNumber(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left - right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toNumber(callFrame) - src2.toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-void Interpreter::cti_op_put_by_val(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Interpreter* interpreter = ARG_globalData->interpreter;
-
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
-    JSValuePtr value = ARG_src3;
-
-    if (LIKELY(subscript.isUInt32Fast())) {
-        uint32_t i = subscript.getUInt32Fast();
-        if (interpreter->isJSArray(baseValue)) {
-            JSArray* jsArray = asArray(baseValue);
-            if (jsArray->canSetIndex(i))
-                jsArray->setIndex(i, value);
-            else
-                jsArray->JSArray::put(callFrame, i, value);
-        } else if (interpreter->isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
-            JSByteArray* jsByteArray = asByteArray(baseValue);
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_put_by_val_byte_array));
-            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
-            if (value.isInt32Fast()) {
-                jsByteArray->setIndex(i, value.getInt32Fast());
-                return;
-            } else {
-                double dValue = 0;
-                if (value.getNumber(dValue)) {
-                    jsByteArray->setIndex(i, dValue);
-                    return;
-                }
-            }
-
-            baseValue.put(callFrame, i, value);
-        } else
-            baseValue.put(callFrame, i, value);
-    } else {
-        Identifier property(callFrame, subscript.toString(callFrame));
-        if (!ARG_globalData->exception) { // Don't put to an object if toString threw an exception.
-            PutPropertySlot slot;
-            baseValue.put(callFrame, property, value, slot);
-        }
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-void Interpreter::cti_op_put_by_val_array(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr baseValue = ARG_src1;
-    int i = ARG_int2;
-    JSValuePtr value = ARG_src3;
-
-    ASSERT(ARG_globalData->interpreter->isJSArray(baseValue));
-
-    if (LIKELY(i >= 0))
-        asArray(baseValue)->JSArray::put(callFrame, i, value);
-    else {
-        // This should work since we're re-boxing an immediate unboxed in JIT code.
-        ASSERT(JSValuePtr::makeInt32Fast(i));
-        Identifier property(callFrame, JSValuePtr::makeInt32Fast(i).toString(callFrame));
-        // FIXME: can toString throw an exception here?
-        if (!ARG_globalData->exception) { // Don't put to an object if toString threw an exception.
-            PutPropertySlot slot;
-            baseValue.put(callFrame, property, value, slot);
-        }
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-void Interpreter::cti_op_put_by_val_byte_array(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-    
-    CallFrame* callFrame = ARG_callFrame;
-    Interpreter* interpreter = ARG_globalData->interpreter;
-    
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
-    JSValuePtr value = ARG_src3;
-    
-    if (LIKELY(subscript.isUInt32Fast())) {
-        uint32_t i = subscript.getUInt32Fast();
-        if (interpreter->isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
-            JSByteArray* jsByteArray = asByteArray(baseValue);
-            
-            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
-            if (value.isInt32Fast()) {
-                jsByteArray->setIndex(i, value.getInt32Fast());
-                return;
-            } else {
-                double dValue = 0;                
-                if (value.getNumber(dValue)) {
-                    jsByteArray->setIndex(i, dValue);
-                    return;
-                }
-            }
-        }
-
-        if (!interpreter->isJSByteArray(baseValue))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_put_by_val));
-        baseValue.put(callFrame, i, value);
-    } else {
-        Identifier property(callFrame, subscript.toString(callFrame));
-        if (!ARG_globalData->exception) { // Don't put to an object if toString threw an exception.
-            PutPropertySlot slot;
-            baseValue.put(callFrame, property, value, slot);
-        }
-    }
-    
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_lesseq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(jsLessEq(callFrame, ARG_src1, ARG_src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_op_loop_if_true(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = src1.toBoolean(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_negate(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-
-    double v;
-    if (src.getNumber(v))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, -v));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, -src.toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve_base(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(inlineResolveBase(ARG_callFrame, *ARG_id1, ARG_callFrame->scopeChain()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve_skip(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    int skip = ARG_int2;
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-    while (skip--) {
-        ++iter;
-        ASSERT(iter != end);
-    }
-    Identifier& ident = *ARG_id1;
-    do {
-        JSObject* o = *iter;
-        PropertySlot slot(o);
-        if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-            return JSValuePtr::encode(result);
-        }
-    } while (++iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve_global(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSGlobalObject* globalObject = asGlobalObject(ARG_src1);
-    Identifier& ident = *ARG_id2;
-    unsigned globalResolveInfoIndex = ARG_int3;
-    ASSERT(globalObject->isGlobalObject());
-
-    PropertySlot slot(globalObject);
-    if (globalObject->getPropertySlot(callFrame, ident, slot)) {
-        JSValuePtr result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary()) {
-            GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
-            if (globalResolveInfo.structure)
-                globalResolveInfo.structure->deref();
-            globalObject->structure()->ref();
-            globalResolveInfo.structure = globalObject->structure();
-            globalResolveInfo.offset = slot.cachedOffset();
-            return JSValuePtr::encode(result);
-        }
-
-        CHECK_FOR_EXCEPTION_AT_END();
-        return JSValuePtr::encode(result);
-    }
-
-    unsigned vPCIndex = callFrame->codeBlock()->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, callFrame->codeBlock());
-    VM_THROW_EXCEPTION();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_div(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    double left;
-    double right;
-    if (src1.getNumber(left) && src2.getNumber(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left / right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toNumber(callFrame) / src2.toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_pre_dec(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, v.toNumber(callFrame) - 1);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_op_jless(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = jsLess(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_not(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = jsBoolean(!src.toBoolean(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_op_jtrue(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = src1.toBoolean(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-VoidPtrPair Interpreter::cti_op_post_inc(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr number = v.toJSNumber(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-
-    RETURN_PAIR(JSValuePtr::encode(number), JSValuePtr::encode(jsNumber(ARG_globalData, number.uncheckedGetNumber() + 1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_eq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    ASSERT(!JSValuePtr::areBothInt32Fast(src1, src2));
-    JSValuePtr result = jsBoolean(JSValuePtr::equalSlowCaseInline(callFrame, src1, src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_lshift(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
-
-    int32_t left;
-    uint32_t right;
-    if (JSValuePtr::areBothInt32Fast(val, shift))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, val.getInt32Fast() << (shift.getInt32Fast() & 0x1f)));
-    if (val.numberToInt32(left) && shift.numberToUInt32(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left << (right & 0x1f)));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitand(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    int32_t left;
-    int32_t right;
-    if (src1.numberToInt32(left) && src2.numberToInt32(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left & right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toInt32(callFrame) & src2.toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_rshift(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
-
-    int32_t left;
-    uint32_t right;
-    if (JSFastMath::canDoFastRshift(val, shift))
-        return JSValuePtr::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
-    if (val.numberToInt32(left) && shift.numberToUInt32(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left >> (right & 0x1f)));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitnot(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-
-    int value;
-    if (src.numberToInt32(value))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, ~value));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, ~src.toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-VoidPtrPair Interpreter::cti_op_resolve_with_base(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    Identifier& ident = *ARG_id1;
-    JSObject* base;
-    do {
-        base = *iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-
-            RETURN_PAIR(base, JSValuePtr::encode(result));
-        }
-        ++iter;
-    } while (iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION_2();
-}
-
-JSObject* Interpreter::cti_op_new_func_exp(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return ARG_funcexp1->makeFunction(ARG_callFrame, ARG_callFrame->scopeChain());
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_mod(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr dividendValue = ARG_src1;
-    JSValuePtr divisorValue = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-    double d = dividendValue.toNumber(callFrame);
-    JSValuePtr result = jsNumber(ARG_globalData, fmod(d, divisorValue.toNumber(callFrame)));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_less(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(jsLess(callFrame, ARG_src1, ARG_src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_neq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    ASSERT(!JSValuePtr::areBothInt32Fast(src1, src2));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(!JSValuePtr::equalSlowCaseInline(callFrame, src1, src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-VoidPtrPair Interpreter::cti_op_post_dec(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr number = v.toJSNumber(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-
-    RETURN_PAIR(JSValuePtr::encode(number), JSValuePtr::encode(jsNumber(ARG_globalData, number.uncheckedGetNumber() - 1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_urshift(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    if (JSFastMath::canDoFastUrshift(val, shift))
-        return JSValuePtr::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
-    else {
-        JSValuePtr result = jsNumber(ARG_globalData, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
-        CHECK_FOR_EXCEPTION_AT_END();
-        return JSValuePtr::encode(result);
-    }
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitxor(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSObject* Interpreter::cti_op_new_regexp(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return new (ARG_globalData) RegExpObject(ARG_callFrame->lexicalGlobalObject()->regExpStructure(), ARG_regexp1);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitor(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toInt32(callFrame) | src2.toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_call_eval(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    RegisterFile* registerFile = ARG_registerFile;
-
-    Interpreter* interpreter = ARG_globalData->interpreter;
-    
-    JSValuePtr funcVal = ARG_src1;
-    int registerOffset = ARG_int2;
-    int argCount = ARG_int3;
-
-    Register* newCallFrame = callFrame->registers() + registerOffset;
-    Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
-    JSValuePtr thisValue = argv[0].jsValue(callFrame);
-    JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
-
-    if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
-        JSValuePtr exceptionValue = noValue();
-        JSValuePtr result = interpreter->callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
-        if (UNLIKELY(exceptionValue != noValue())) {
-            ARG_globalData->exception = exceptionValue;
-            VM_THROW_EXCEPTION_AT_END();
-        }
-        return JSValuePtr::encode(result);
-    }
-
-    return JSValuePtr::encode(jsImpossibleValue());
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_throw(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-
-    JSValuePtr exceptionValue = ARG_src1;
-    ASSERT(exceptionValue);
-
-    HandlerInfo* handler = ARG_globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, true);
-
-    if (!handler) {
-        *ARG_exception = exceptionValue;
-        return JSValuePtr::encode(jsNull());
-    }
-
-    ARG_setCallFrame(callFrame);
-    void* catchRoutine = handler->nativeCode;
-    ASSERT(catchRoutine);
-    STUB_SET_RETURN_ADDRESS(catchRoutine);
-    return JSValuePtr::encode(exceptionValue);
-}
-
-JSPropertyNameIterator* Interpreter::cti_op_get_pnames(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSPropertyNameIterator::create(ARG_callFrame, ARG_src1);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_next_pname(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSPropertyNameIterator* it = ARG_pni1;
-    JSValuePtr temp = it->next(ARG_callFrame);
-    if (!temp)
-        it->invalidate();
-    return JSValuePtr::encode(temp);
-}
-
-JSObject* Interpreter::cti_op_push_scope(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSObject* o = ARG_src1.toObject(ARG_callFrame);
-    CHECK_FOR_EXCEPTION();
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->push(o));
-    return o;
-}
-
-void Interpreter::cti_op_pop_scope(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->pop());
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_typeof(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsTypeStringForValue(ARG_callFrame, ARG_src1));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_undefined(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-    return JSValuePtr::encode(jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_boolean(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(ARG_src1.isBoolean()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_number(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(ARG_src1.isNumber()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_string(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(ARG_globalData->interpreter->isJSString(ARG_src1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_object(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(jsIsObjectType(ARG_src1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_function(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(jsIsFunctionType(ARG_src1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_stricteq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    return JSValuePtr::encode(jsBoolean(JSValuePtr::strictEqual(src1, src2)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_nstricteq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    return JSValuePtr::encode(jsBoolean(!JSValuePtr::strictEqual(src1, src2)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_to_jsnumber(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = src.toJSNumber(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_in(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr baseVal = ARG_src2;
-
-    if (!baseVal.isObject()) {
-        CallFrame* callFrame = ARG_callFrame;
-        CodeBlock* codeBlock = callFrame->codeBlock();
-        unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-        ARG_globalData->exception = createInvalidParamError(callFrame, "in", baseVal, vPCIndex, codeBlock);
-        VM_THROW_EXCEPTION();
-    }
-
-    JSValuePtr propName = ARG_src1;
-    JSObject* baseObj = asObject(baseVal);
-
-    uint32_t i;
-    if (propName.getUInt32(i))
-        return JSValuePtr::encode(jsBoolean(baseObj->hasProperty(callFrame, i)));
-
-    Identifier property(callFrame, propName.toString(callFrame));
-    CHECK_FOR_EXCEPTION();
-    return JSValuePtr::encode(jsBoolean(baseObj->hasProperty(callFrame, property)));
-}
-
-JSObject* Interpreter::cti_op_push_new_scope(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSObject* scope = new (ARG_globalData) JSStaticScopeObject(ARG_callFrame, *ARG_id1, ARG_src2, DontDelete);
-
-    CallFrame* callFrame = ARG_callFrame;
-    callFrame->setScopeChain(callFrame->scopeChain()->push(scope));
-    return scope;
-}
-
-void Interpreter::cti_op_jmp_scopes(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    unsigned count = ARG_int1;
-    CallFrame* callFrame = ARG_callFrame;
-
-    ScopeChainNode* tmp = callFrame->scopeChain();
-    while (count--)
-        tmp = tmp->pop();
-    callFrame->setScopeChain(tmp);
-}
-
-void Interpreter::cti_op_put_by_index(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    unsigned property = ARG_int2;
-
-    ARG_src1.put(callFrame, property, ARG_src3);
-}
-
-void* Interpreter::cti_op_switch_imm(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    if (scrutinee.isInt32Fast())
-        return codeBlock->immediateSwitchJumpTable(tableIndex).ctiForValue(scrutinee.getInt32Fast());
-    else {
-        int32_t value;
-        if (scrutinee.numberToInt32(value))
-            return codeBlock->immediateSwitchJumpTable(tableIndex).ctiForValue(value);
-        else
-            return codeBlock->immediateSwitchJumpTable(tableIndex).ctiDefault;
-    }
-}
-
-void* Interpreter::cti_op_switch_char(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    void* result = codeBlock->characterSwitchJumpTable(tableIndex).ctiDefault;
-
-    if (scrutinee.isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
-        if (value->size() == 1)
-            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->data()[0]);
-    }
-
-    return result;
-}
-
-void* Interpreter::cti_op_switch_string(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    void* result = codeBlock->stringSwitchJumpTable(tableIndex).ctiDefault;
-
-    if (scrutinee.isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
-        result = codeBlock->stringSwitchJumpTable(tableIndex).ctiForValue(value);
-    }
-
-    return result;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_del_by_val(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr baseValue = ARG_src1;
-    JSObject* baseObj = baseValue.toObject(callFrame); // may throw
-
-    JSValuePtr subscript = ARG_src2;
-    JSValuePtr result;
-    uint32_t i;
-    if (subscript.getUInt32(i))
-        result = jsBoolean(baseObj->deleteProperty(callFrame, i));
-    else {
-        CHECK_FOR_EXCEPTION();
-        Identifier property(callFrame, subscript.toString(callFrame));
-        CHECK_FOR_EXCEPTION();
-        result = jsBoolean(baseObj->deleteProperty(callFrame, property));
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-void Interpreter::cti_op_put_getter(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    ASSERT(ARG_src1.isObject());
-    JSObject* baseObj = asObject(ARG_src1);
-    ASSERT(ARG_src3.isObject());
-    baseObj->defineGetter(callFrame, *ARG_id2, asObject(ARG_src3));
-}
-
-void Interpreter::cti_op_put_setter(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    ASSERT(ARG_src1.isObject());
-    JSObject* baseObj = asObject(ARG_src1);
-    ASSERT(ARG_src3.isObject());
-    baseObj->defineSetter(callFrame, *ARG_id2, asObject(ARG_src3));
-}
-
-JSObject* Interpreter::cti_op_new_error(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned type = ARG_int1;
-    JSValuePtr message = ARG_src2;
-    unsigned bytecodeOffset = ARG_int3;
-
-    unsigned lineNumber = codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset);
-    return Error::create(callFrame, static_cast<ErrorType>(type), message.toString(callFrame), lineNumber, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
-}
-
-void Interpreter::cti_op_debug(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    int debugHookID = ARG_int1;
-    int firstLine = ARG_int2;
-    int lastLine = ARG_int3;
-
-    ARG_globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_vm_throw(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    JSGlobalData* globalData = ARG_globalData;
-
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, globalData->exceptionLocation);
-
-    JSValuePtr exceptionValue = globalData->exception;
-    ASSERT(exceptionValue);
-    globalData->exception = noValue();
-
-    HandlerInfo* handler = globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, false);
-
-    if (!handler) {
-        *ARG_exception = exceptionValue;
-        return JSValuePtr::encode(jsNull());
-    }
-
-    ARG_setCallFrame(callFrame);
-    void* catchRoutine = handler->nativeCode;
-    ASSERT(catchRoutine);
-    STUB_SET_RETURN_ADDRESS(catchRoutine);
-    return JSValuePtr::encode(exceptionValue);
-}
-
-#undef STUB_RETURN_ADDRESS
-#undef STUB_SET_RETURN_ADDRESS
-#undef BEGIN_STUB_FUNCTION
-#undef CHECK_FOR_EXCEPTION
-#undef CHECK_FOR_EXCEPTION_AT_END
-#undef CHECK_FOR_EXCEPTION_VOID
-#undef VM_THROW_EXCEPTION
-#undef VM_THROW_EXCEPTION_2
-#undef VM_THROW_EXCEPTION_AT_END
-
-#endif // ENABLE(JIT)
-
-#else // MANUAL_MERGE_REQUIRED
-#endif // MANUAL_MERGE_REQUIRED
 } // namespace JSC
diff --git a/JavaScriptCore/interpreter/Interpreter.h b/JavaScriptCore/interpreter/Interpreter.h
index 3f261d4..7cab254 100644
--- a/JavaScriptCore/interpreter/Interpreter.h
+++ b/JavaScriptCore/interpreter/Interpreter.h
@@ -30,12 +30,13 @@
 #define Interpreter_h
 
 #include "ArgList.h"
+#include "FastAllocBase.h"
+#include "HashMap.h"
 #include "JSCell.h"
 #include "JSValue.h"
 #include "JSObject.h"
 #include "Opcode.h"
 #include "RegisterFile.h"
-#include <wtf/HashMap.h>
 
 namespace JSC {
 
@@ -51,6 +52,7 @@
     class Register;
     class ScopeChainNode;
     class SamplingTool;
+    struct CallFrameClosure;
     struct HandlerInfo;
 
     enum DebugHookID {
@@ -62,12 +64,11 @@
         WillExecuteStatement
     };
 
-    enum { MaxReentryDepth = 64 };
+    enum { MaxMainThreadReentryDepth = 256, MaxSecondaryThreadReentryDepth = 32 };
 
-    class Interpreter {
+    class Interpreter : public WTF::FastAllocBase {
         friend class JIT;
-        friend class JITStubs;
-
+        friend class CachedCall;
     public:
         Interpreter();
 
@@ -94,50 +95,57 @@
 
         bool isOpcode(Opcode);
         
-        JSValuePtr execute(ProgramNode*, CallFrame*, ScopeChainNode*, JSObject* thisObj, JSValuePtr* exception);
-        JSValuePtr execute(FunctionBodyNode*, CallFrame*, JSFunction*, JSObject* thisObj, const ArgList& args, ScopeChainNode*, JSValuePtr* exception);
-        JSValuePtr execute(EvalNode* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain, JSValuePtr* exception);
+        JSValue execute(ProgramNode*, CallFrame*, ScopeChainNode*, JSObject* thisObj, JSValue* exception);
+        JSValue execute(FunctionBodyNode*, CallFrame*, JSFunction*, JSObject* thisObj, const ArgList& args, ScopeChainNode*, JSValue* exception);
+        JSValue execute(EvalNode* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception);
 
-        JSValuePtr retrieveArguments(CallFrame*, JSFunction*) const;
-        JSValuePtr retrieveCaller(CallFrame*, InternalFunction*) const;
-        void retrieveLastCaller(CallFrame*, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValuePtr& function) const;
+        JSValue retrieveArguments(CallFrame*, JSFunction*) const;
+        JSValue retrieveCaller(CallFrame*, InternalFunction*) const;
+        void retrieveLastCaller(CallFrame*, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValue& function) const;
         
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
+        
         void setSampler(SamplingTool* sampler) { m_sampler = sampler; }
         SamplingTool* sampler() { return m_sampler; }
 
+        NEVER_INLINE JSValue callEval(CallFrame*, RegisterFile*, Register* argv, int argc, int registerOffset, JSValue& exceptionValue);
+        NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValue&, unsigned bytecodeOffset, bool);
+        NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine);
+
     private:
         enum ExecutionFlag { Normal, InitializeAndReturn };
 
-        NEVER_INLINE JSValuePtr callEval(CallFrame*, RegisterFile*, Register* argv, int argc, int registerOffset, JSValuePtr& exceptionValue);
-        JSValuePtr execute(EvalNode*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*, JSValuePtr* exception);
+        CallFrameClosure prepareForRepeatCall(FunctionBodyNode*, CallFrame*, JSFunction*, int argCount, ScopeChainNode*, JSValue* exception);
+        void endRepeatCall(CallFrameClosure&);
+        JSValue execute(CallFrameClosure&, JSValue* exception);
 
-        NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine);
+        JSValue execute(EvalNode*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*, JSValue* exception);
 
-        NEVER_INLINE bool resolve(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
-        NEVER_INLINE bool resolveSkip(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
-        NEVER_INLINE bool resolveGlobal(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
+#if USE(INTERPRETER)
+        NEVER_INLINE bool resolve(CallFrame*, Instruction*, JSValue& exceptionValue);
+        NEVER_INLINE bool resolveSkip(CallFrame*, Instruction*, JSValue& exceptionValue);
+        NEVER_INLINE bool resolveGlobal(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE void resolveBase(CallFrame*, Instruction* vPC);
-        NEVER_INLINE bool resolveBaseAndProperty(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
+        NEVER_INLINE bool resolveBaseAndProperty(CallFrame*, Instruction*, JSValue& exceptionValue);
+        NEVER_INLINE bool resolveBaseAndFunc(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE ScopeChainNode* createExceptionScope(CallFrame*, const Instruction* vPC);
 
-        NEVER_INLINE bool unwindCallFrame(CallFrame*&, JSValuePtr, unsigned& bytecodeOffset, CodeBlock*&);
-        NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValuePtr&, unsigned bytecodeOffset, bool);
-        NEVER_INLINE bool resolveBaseAndFunc(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
+        void tryCacheGetByID(CallFrame*, CodeBlock*, Instruction*, JSValue baseValue, const Identifier& propertyName, const PropertySlot&);
+        void uncacheGetByID(CodeBlock*, Instruction* vPC);
+        void tryCachePutByID(CallFrame*, CodeBlock*, Instruction*, JSValue baseValue, const PutPropertySlot&);
+        void uncachePutByID(CodeBlock*, Instruction* vPC);        
+#endif
+
+        NEVER_INLINE bool unwindCallFrame(CallFrame*&, JSValue, unsigned& bytecodeOffset, CodeBlock*&);
 
         static ALWAYS_INLINE CallFrame* slideRegisterWindowForCall(CodeBlock*, RegisterFile*, CallFrame*, size_t registerOffset, int argc);
 
         static CallFrame* findFunctionCallFrame(CallFrame*, InternalFunction*);
 
-        JSValuePtr privateExecute(ExecutionFlag, RegisterFile*, CallFrame*, JSValuePtr* exception);
+        JSValue privateExecute(ExecutionFlag, RegisterFile*, CallFrame*, JSValue* exception);
 
         void dumpCallFrame(CallFrame*);
         void dumpRegisters(CallFrame*);
-
-        void tryCacheGetByID(CallFrame*, CodeBlock*, Instruction*, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot&);
-        void uncacheGetByID(CodeBlock*, Instruction* vPC);
-        void tryCachePutByID(CallFrame*, CodeBlock*, Instruction*, JSValuePtr baseValue, const PutPropertySlot&);
-        void uncachePutByID(CodeBlock*, Instruction* vPC);
         
         bool isCallBytecode(Opcode opcode) { return opcode == getOpcode(op_call) || opcode == getOpcode(op_construct) || opcode == getOpcode(op_call_eval); }
 
@@ -152,7 +160,7 @@
         HashMap<Opcode, OpcodeID> m_opcodeIDTable; // Maps Opcode => OpcodeID for decompiling
 #endif
     };
-
+    
 } // namespace JSC
 
 #endif // Interpreter_h
diff --git a/JavaScriptCore/interpreter/Register.h b/JavaScriptCore/interpreter/Register.h
index 5277a0f..cceac74 100644
--- a/JavaScriptCore/interpreter/Register.h
+++ b/JavaScriptCore/interpreter/Register.h
@@ -30,6 +30,7 @@
 #define Register_h
 
 #include "JSValue.h"
+#include <wtf/Assertions.h>
 #include <wtf/VectorTraits.h>
 
 namespace JSC {
@@ -49,25 +50,26 @@
     class Register {
     public:
         Register();
-        Register(JSValuePtr);
+        Register(JSValue);
+        Register(Arguments*);
 
-        JSValuePtr jsValue(CallFrame*) const;
-        JSValuePtr getJSValue() const;
+        JSValue jsValue() const;
 
         bool marked() const;
         void mark();
         
+        int32_t i() const;
+        void* v() const;
+
     private:
         friend class ExecState;
         friend class Interpreter;
-        friend class JITStubs;
 
         // Only CallFrame, Interpreter, and JITStubs should use these functions.
 
         Register(intptr_t);
 
         Register(JSActivation*);
-        Register(Arguments*);
         Register(CallFrame*);
         Register(CodeBlock*);
         Register(JSFunction*);
@@ -75,9 +77,6 @@
         Register(ScopeChainNode*);
         Register(Instruction*);
 
-        intptr_t i() const;
-        void* v() const;
-
         JSActivation* activation() const;
         Arguments* arguments() const;
         CallFrame* callFrame() const;
@@ -90,7 +89,7 @@
         union {
             intptr_t i;
             void* v;
-            JSValueEncodedAsPointer* value;
+            EncodedJSValue value;
 
             JSActivation* activation;
             Arguments* arguments;
@@ -101,136 +100,89 @@
             ScopeChainNode* scopeChain;
             Instruction* vPC;
         } u;
-
-#ifndef NDEBUG
-        enum {
-            EmptyType,
-
-            IntType,
-            ValueType,
-
-            ActivationType,
-            ArgumentsType,
-            CallFrameType,
-            CodeBlockType,
-            FunctionType,
-            InstructionType,
-            PropertyNameIteratorType,
-            RegisterType,
-            ScopeChainNodeType
-        } m_type;
-#endif
     };
 
-#ifndef NDEBUG
-    #define SET_TYPE(type) m_type = (type)
-    // FIXME: The CTI code to put value into registers doesn't set m_type.
-    // Once it does, we can turn this assertion back on.
-    #define ASSERT_TYPE(type)
-#else
-    #define SET_TYPE(type)
-    #define ASSERT_TYPE(type)
-#endif
-
     ALWAYS_INLINE Register::Register()
     {
 #ifndef NDEBUG
-        SET_TYPE(EmptyType);
-        u.value = JSValuePtr::encode(noValue());
+        u.value = JSValue::encode(JSValue());
 #endif
     }
 
-    ALWAYS_INLINE Register::Register(JSValuePtr v)
+    ALWAYS_INLINE Register::Register(JSValue v)
     {
-        SET_TYPE(ValueType);
-        u.value = JSValuePtr::encode(v);
+        u.value = JSValue::encode(v);
     }
 
-    // This function is scaffolding for legacy clients. It will eventually go away.
-    ALWAYS_INLINE JSValuePtr Register::jsValue(CallFrame*) const
+    ALWAYS_INLINE JSValue Register::jsValue() const
     {
-        // Once registers hold doubles, this function will allocate a JSValue*
-        // if the register doesn't hold one already. 
-        ASSERT_TYPE(ValueType);
-        return JSValuePtr::decode(u.value);
-    }
-    
-    ALWAYS_INLINE JSValuePtr Register::getJSValue() const
-    {
-        ASSERT_TYPE(JSValueType);
-        return JSValuePtr::decode(u.value);
+        return JSValue::decode(u.value);
     }
     
     ALWAYS_INLINE bool Register::marked() const
     {
-        return getJSValue().marked();
+        return jsValue().marked();
     }
 
     ALWAYS_INLINE void Register::mark()
     {
-        getJSValue().mark();
+        jsValue().mark();
     }
     
     // Interpreter functions
 
     ALWAYS_INLINE Register::Register(Arguments* arguments)
     {
-        SET_TYPE(ArgumentsType);
         u.arguments = arguments;
     }
 
     ALWAYS_INLINE Register::Register(JSActivation* activation)
     {
-        SET_TYPE(ActivationType);
         u.activation = activation;
     }
 
     ALWAYS_INLINE Register::Register(CallFrame* callFrame)
     {
-        SET_TYPE(CallFrameType);
         u.callFrame = callFrame;
     }
 
     ALWAYS_INLINE Register::Register(CodeBlock* codeBlock)
     {
-        SET_TYPE(CodeBlockType);
         u.codeBlock = codeBlock;
     }
 
     ALWAYS_INLINE Register::Register(JSFunction* function)
     {
-        SET_TYPE(FunctionType);
         u.function = function;
     }
 
     ALWAYS_INLINE Register::Register(Instruction* vPC)
     {
-        SET_TYPE(InstructionType);
         u.vPC = vPC;
     }
 
     ALWAYS_INLINE Register::Register(ScopeChainNode* scopeChain)
     {
-        SET_TYPE(ScopeChainNodeType);
         u.scopeChain = scopeChain;
     }
 
     ALWAYS_INLINE Register::Register(JSPropertyNameIterator* propertyNameIterator)
     {
-        SET_TYPE(PropertyNameIteratorType);
         u.propertyNameIterator = propertyNameIterator;
     }
 
     ALWAYS_INLINE Register::Register(intptr_t i)
     {
-        SET_TYPE(IntType);
+        // See comment on 'i()' below.
+        ASSERT(i == static_cast<int32_t>(i));
         u.i = i;
     }
 
-    ALWAYS_INLINE intptr_t Register::i() const
+    // Read 'i' as a 32-bit integer; we only use it to hold 32-bit values,
+    // and we only write 32-bits when writing the arg count from JIT code.
+    ALWAYS_INLINE int32_t Register::i() const
     {
-        ASSERT_TYPE(IntType);
-        return u.i;
+        return static_cast<int32_t>(u.i);
     }
     
     ALWAYS_INLINE void* Register::v() const
@@ -240,55 +192,44 @@
 
     ALWAYS_INLINE JSActivation* Register::activation() const
     {
-        ASSERT_TYPE(ActivationType);
         return u.activation;
     }
     
     ALWAYS_INLINE Arguments* Register::arguments() const
     {
-        ASSERT_TYPE(ArgumentsType);
         return u.arguments;
     }
     
     ALWAYS_INLINE CallFrame* Register::callFrame() const
     {
-        ASSERT_TYPE(CallFrameType);
         return u.callFrame;
     }
     
     ALWAYS_INLINE CodeBlock* Register::codeBlock() const
     {
-        ASSERT_TYPE(CodeBlockType);
         return u.codeBlock;
     }
     
     ALWAYS_INLINE JSFunction* Register::function() const
     {
-        ASSERT_TYPE(FunctionType);
         return u.function;
     }
     
     ALWAYS_INLINE JSPropertyNameIterator* Register::propertyNameIterator() const
     {
-        ASSERT_TYPE(PropertyNameIteratorType);
         return u.propertyNameIterator;
     }
     
     ALWAYS_INLINE ScopeChainNode* Register::scopeChain() const
     {
-        ASSERT_TYPE(ScopeChainNodeType);
         return u.scopeChain;
     }
     
     ALWAYS_INLINE Instruction* Register::vPC() const
     {
-        ASSERT_TYPE(InstructionType);
         return u.vPC;
     }
 
-    #undef SET_TYPE
-    #undef ASSERT_TYPE
-
 } // namespace JSC
 
 namespace WTF {
diff --git a/JavaScriptCore/interpreter/RegisterFile.cpp b/JavaScriptCore/interpreter/RegisterFile.cpp
index 50698f5..cfcf1d3 100644
--- a/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -42,4 +42,15 @@
 #endif
 }
 
+void RegisterFile::releaseExcessCapacity()
+{
+#if HAVE(MMAP) && HAVE(MADV_FREE) && !HAVE(VIRTUALALLOC)
+    while (madvise(m_start, (m_max - m_start) * sizeof(Register), MADV_FREE) == -1 && errno == EAGAIN) { }
+#elif HAVE(VIRTUALALLOC)
+    VirtualFree(m_start, (m_max - m_start) * sizeof(Register), MEM_DECOMMIT);
+    m_commitEnd = m_start;
+#endif
+    m_maxUsed = m_start;
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/interpreter/RegisterFile.h b/JavaScriptCore/interpreter/RegisterFile.h
index c320f04..09a3963 100644
--- a/JavaScriptCore/interpreter/RegisterFile.h
+++ b/JavaScriptCore/interpreter/RegisterFile.h
@@ -29,10 +29,11 @@
 #ifndef RegisterFile_h
 #define RegisterFile_h
 
+#include "Collector.h"
 #include "ExecutableAllocator.h"
 #include "Register.h"
-#include "Collector.h"
 #include <wtf/Noncopyable.h>
+#include <wtf/VMTags.h>
 
 #if HAVE(MMAP)
 #include <errno.h>
@@ -113,6 +114,8 @@
         static const size_t defaultCapacity = 524288;
         static const size_t defaultMaxGlobals = 8192;
         static const size_t commitSize = 1 << 14;
+        // Allow 8k of excess registers before we start trying to reap the registerfile
+        static const ptrdiff_t maxExcessCapacity = 8 * 1024;
 
         RegisterFile(size_t capacity = defaultCapacity, size_t maxGlobals = defaultMaxGlobals);
         ~RegisterFile();
@@ -137,12 +140,15 @@
         void markCallFrames(Heap* heap) { heap->markConservatively(m_start, m_end); }
 
     private:
+        void releaseExcessCapacity();
         size_t m_numGlobals;
         const size_t m_maxGlobals;
         Register* m_start;
         Register* m_end;
         Register* m_max;
         Register* m_buffer;
+        Register* m_maxUsed;
+
 #if HAVE(VIRTUALALLOC)
         Register* m_commitEnd;
 #endif
@@ -150,6 +156,9 @@
         JSGlobalObject* m_globalObject; // The global object whose vars are currently stored in the register file.
     };
 
+    // FIXME: Add a generic getpagesize() to WTF, then move this function to WTF as well.
+    inline bool isPageAligned(size_t size) { return size != 0 && size % (8 * 1024) == 0; }
+
     inline RegisterFile::RegisterFile(size_t capacity, size_t maxGlobals)
         : m_numGlobals(0)
         , m_maxGlobals(maxGlobals)
@@ -159,9 +168,13 @@
         , m_buffer(0)
         , m_globalObject(0)
     {
+        // Verify that our values will play nice with mmap and VirtualAlloc.
+        ASSERT(isPageAligned(maxGlobals));
+        ASSERT(isPageAligned(capacity));
+
         size_t bufferLength = (capacity + maxGlobals) * sizeof(Register);
     #if HAVE(MMAP)
-        m_buffer = static_cast<Register*>(mmap(0, bufferLength, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0));
+        m_buffer = static_cast<Register*>(mmap(0, bufferLength, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, VM_TAG_FOR_REGISTERFILE_MEMORY, 0));
         if (m_buffer == MAP_FAILED) {
             fprintf(stderr, "Could not allocate register file: %d\n", errno);
             CRASH();
@@ -184,13 +197,17 @@
     #endif
         m_start = m_buffer + maxGlobals;
         m_end = m_start;
+        m_maxUsed = m_end;
         m_max = m_start + capacity;
     }
 
     inline void RegisterFile::shrink(Register* newEnd)
     {
-        if (newEnd < m_end)
-            m_end = newEnd;
+        if (newEnd >= m_end)
+            return;
+        m_end = newEnd;
+        if (m_end == m_start && (m_maxUsed - m_start) > maxExcessCapacity)
+            releaseExcessCapacity();
     }
 
     inline bool RegisterFile::grow(Register* newEnd)
@@ -212,6 +229,9 @@
         }
 #endif
 
+        if (newEnd > m_maxUsed)
+            m_maxUsed = newEnd;
+
         m_end = newEnd;
         return true;
     }
diff --git a/JavaScriptCore/jit/ExecutableAllocator.h b/JavaScriptCore/jit/ExecutableAllocator.h
index 0cb78ad..a545b0c 100644
--- a/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/JavaScriptCore/jit/ExecutableAllocator.h
@@ -26,18 +26,29 @@
 #ifndef ExecutableAllocator_h
 #define ExecutableAllocator_h
 
-#if ENABLE(ASSEMBLER)
-
+#include <limits>
 #include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
+#include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
 
-#include <limits>
+#if PLATFORM(IPHONE)
+#include <libkern/OSCacheControl.h>
+#include <sys/mman.h>
+#endif
 
 #define JIT_ALLOCATOR_PAGE_SIZE (ExecutableAllocator::pageSize)
 #define JIT_ALLOCATOR_LARGE_ALLOC_SIZE (ExecutableAllocator::pageSize * 4)
 
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+#define PROTECTION_FLAGS_RW (PROT_READ | PROT_WRITE)
+#define PROTECTION_FLAGS_RX (PROT_READ | PROT_EXEC)
+#define INITIAL_PROTECTION_FLAGS PROTECTION_FLAGS_RX
+#else
+#define INITIAL_PROTECTION_FLAGS (PROT_READ | PROT_WRITE | PROT_EXEC)
+#endif
+
 namespace JSC {
 
 inline size_t roundUpAllocationSize(size_t request, size_t granularity)
@@ -52,6 +63,12 @@
     return size;
 }
 
+}
+
+#if ENABLE(ASSEMBLER)
+
+namespace JSC {
+
 class ExecutablePool : public RefCounted<ExecutablePool> {
 private:
     struct Allocation {
@@ -108,6 +125,8 @@
 };
 
 class ExecutableAllocator {
+    enum ProtectionSeting { Writable, Executable };
+
 public:
     static size_t pageSize;
     ExecutableAllocator()
@@ -137,7 +156,69 @@
         return pool.release();
     }
 
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE) || !(PLATFORM(X86) || PLATFORM(X86_64))
+    static void makeWritable(void* start, size_t size)
+    {
+        reprotectRegion(start, size, Writable);
+    }
+
+    static void makeExecutable(void* start, size_t size)
+    {
+        reprotectRegion(start, size, Executable);
+        cacheFlush(start, size);
+    }
+
+    // If ASSEMBLER_WX_EXCLUSIVE protection is turned on, or on non-x86 platforms,
+    // we need to track start & size so we can makeExecutable/cacheFlush at the end.
+    class MakeWritable {
+    public:
+        MakeWritable(void* start, size_t size)
+            : m_start(start)
+            , m_size(size)
+        {
+            makeWritable(start, size);
+        }
+
+        ~MakeWritable()
+        {
+            makeExecutable(m_start, m_size);
+        }
+
+    private:
+        void* m_start;
+        size_t m_size;
+    };
+#else
+    static void makeWritable(void*, size_t) {}
+    static void makeExecutable(void*, size_t) {}
+
+    // On x86, without ASSEMBLER_WX_EXCLUSIVE, there is nothing to do here.
+    class MakeWritable { public: MakeWritable(void*, size_t) {} };
+#endif
+
 private:
+
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE) || !(PLATFORM(X86) || PLATFORM(X86_64))
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+    static void reprotectRegion(void*, size_t, ProtectionSeting);
+#else
+    static void reprotectRegion(void*, size_t, ProtectionSeting) {}
+#endif
+
+   static void cacheFlush(void* code, size_t size)
+    {
+#if PLATFORM(X86) || PLATFORM(X86_64)
+        UNUSED_PARAM(code);
+        UNUSED_PARAM(size);
+#elif PLATFORM(ARM_V7) && PLATFORM(IPHONE)
+        sys_dcache_flush(code, size);
+        sys_icache_invalidate(code, size);
+#else
+#error "ExecutableAllocator::cacheFlush not implemented on this platform."
+#endif
+    }
+#endif
+
     RefPtr<ExecutablePool> m_smallAllocationPool;
     static void intializePageSize();
 };
diff --git a/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
new file mode 100644
index 0000000..7682b9c
--- /dev/null
+++ b/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -0,0 +1,447 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "ExecutableAllocator.h"
+
+#include <errno.h>
+
+#if ENABLE(ASSEMBLER) && PLATFORM(MAC) && PLATFORM(X86_64)
+
+#include "TCSpinLock.h"
+#include <mach/mach_init.h>
+#include <mach/vm_map.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#include <wtf/AVLTree.h>
+#include <wtf/VMTags.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+#define TWO_GB (2u * 1024u * 1024u * 1024u)
+#define SIXTEEN_MB (16u * 1024u * 1024u)
+
+// FreeListEntry describes a free chunk of memory, stored in the freeList.
+struct FreeListEntry {
+    FreeListEntry(void* pointer, size_t size)
+        : pointer(pointer)
+        , size(size)
+        , nextEntry(0)
+        , less(0)
+        , greater(0)
+        , balanceFactor(0)
+    {
+    }
+
+    // All entries of the same size share a single entry
+    // in the AVLTree, and are linked together in a linked
+    // list, using nextEntry.
+    void* pointer;
+    size_t size;
+    FreeListEntry* nextEntry;
+
+    // These fields are used by AVLTree.
+    FreeListEntry* less;
+    FreeListEntry* greater;
+    int balanceFactor;
+};
+
+// Abstractor class for use in AVLTree.
+// Nodes in the AVLTree are of type FreeListEntry, keyed on
+// (and thus sorted by) their size.
+struct AVLTreeAbstractorForFreeList {
+    typedef FreeListEntry* handle;
+    typedef int32_t size;
+    typedef size_t key;
+
+    handle get_less(handle h) { return h->less; }
+    void set_less(handle h, handle lh) { h->less = lh; }
+    handle get_greater(handle h) { return h->greater; }
+    void set_greater(handle h, handle gh) { h->greater = gh; }
+    int get_balance_factor(handle h) { return h->balanceFactor; }
+    void set_balance_factor(handle h, int bf) { h->balanceFactor = bf; }
+
+    static handle null() { return 0; }
+
+    int compare_key_key(key va, key vb) { return va - vb; }
+    int compare_key_node(key k, handle h) { return compare_key_key(k, h->size); }
+    int compare_node_node(handle h1, handle h2) { return compare_key_key(h1->size, h2->size); }
+};
+
+// Used to reverse sort an array of FreeListEntry pointers.
+static int reverseSortFreeListEntriesByPointer(const void* leftPtr, const void* rightPtr)
+{
+    FreeListEntry* left = *(FreeListEntry**)leftPtr;
+    FreeListEntry* right = *(FreeListEntry**)rightPtr;
+
+    return (intptr_t)(right->pointer) - (intptr_t)(left->pointer);
+}
+
+// Used to reverse sort an array of pointers.
+static int reverseSortCommonSizedAllocations(const void* leftPtr, const void* rightPtr)
+{
+    void* left = *(void**)leftPtr;
+    void* right = *(void**)rightPtr;
+
+    return (intptr_t)right - (intptr_t)left;
+}
+
+class FixedVMPoolAllocator
+{
+    // The free list is stored in a sorted tree.
+    typedef AVLTree<AVLTreeAbstractorForFreeList, 40> SizeSortedFreeTree;
+
+    // Use madvise as apropriate to prevent freed pages from being spilled,
+    // and to attempt to ensure that used memory is reported correctly.
+#if HAVE(MADV_FREE_REUSE)
+    void release(void* position, size_t size)
+    {
+        while (madvise(position, size, MADV_FREE_REUSABLE) == -1 && errno == EAGAIN) { }
+    }
+
+    void reuse(void* position, size_t size)
+    {
+        while (madvise(position, size, MADV_FREE_REUSE) == -1 && errno == EAGAIN) { }
+    }
+#elif HAVE(MADV_DONTNEED)
+    void release(void* position, size_t size)
+    {
+        while (madvise(position, size, MADV_DONTNEED) == -1 && errno == EAGAIN) { }
+    }
+
+    void reuse(void*, size_t) {}
+#else
+    void release(void*, size_t) {}
+    void reuse(void*, size_t) {}
+#endif
+
+    // All addition to the free list should go through this method, rather than
+    // calling insert directly, to avoid multiple entries beging added with the
+    // same key.  All nodes being added should be singletons, they should not
+    // already be a part of a chain.
+    void addToFreeList(FreeListEntry* entry)
+    {
+        ASSERT(!entry->nextEntry);
+
+        if (entry->size == m_commonSize) {
+            m_commonSizedAllocations.append(entry->pointer);
+            delete entry;
+        } else if (FreeListEntry* entryInFreeList = m_freeList.search(entry->size, m_freeList.EQUAL)) {
+            // m_freeList already contain an entry for this size - insert this node into the chain.
+            entry->nextEntry = entryInFreeList->nextEntry;
+            entryInFreeList->nextEntry = entry;
+        } else
+            m_freeList.insert(entry);
+    }
+
+    // We do not attempt to coalesce addition, which may lead to fragmentation;
+    // instead we periodically perform a sweep to try to coalesce neigboring
+    // entries in m_freeList.  Presently this is triggered at the point 16MB
+    // of memory has been released.
+    void coalesceFreeSpace()
+    {
+        Vector<FreeListEntry*> freeListEntries;
+        SizeSortedFreeTree::Iterator iter;
+        iter.start_iter_least(m_freeList);
+
+        // Empty m_freeList into a Vector.
+        for (FreeListEntry* entry; (entry = *iter); ++iter) {
+            // Each entry in m_freeList might correspond to multiple
+            // free chunks of memory (of the same size).  Walk the chain
+            // (this is likely of couse only be one entry long!) adding
+            // each entry to the Vector (at reseting the next in chain
+            // pointer to separate each node out).
+            FreeListEntry* next;
+            do {
+                next = entry->nextEntry;
+                entry->nextEntry = 0;
+                freeListEntries.append(entry);
+            } while ((entry = next));
+        }
+        // All entries are now in the Vector; purge the tree.
+        m_freeList.purge();
+
+        // Reverse-sort the freeListEntries and m_commonSizedAllocations Vectors.
+        // We reverse-sort so that we can logically work forwards through memory,
+        // whilst popping items off the end of the Vectors using last() and removeLast().
+        qsort(freeListEntries.begin(), freeListEntries.size(), sizeof(FreeListEntry*), reverseSortFreeListEntriesByPointer);
+        qsort(m_commonSizedAllocations.begin(), m_commonSizedAllocations.size(), sizeof(void*), reverseSortCommonSizedAllocations);
+
+        // The entries from m_commonSizedAllocations that cannot be
+        // coalesced into larger chunks will be temporarily stored here.
+        Vector<void*> newCommonSizedAllocations;
+
+        // Keep processing so long as entries remain in either of the vectors.
+        while (freeListEntries.size() || m_commonSizedAllocations.size()) {
+            // We're going to try to find a FreeListEntry node that we can coalesce onto.
+            FreeListEntry* coalescionEntry = 0;
+
+            // Is the lowest addressed chunk of free memory of common-size, or is it in the free list?
+            if (m_commonSizedAllocations.size() && (!freeListEntries.size() || (m_commonSizedAllocations.last() < freeListEntries.last()->pointer))) {
+                // Pop an item from the m_commonSizedAllocations vector - this is the lowest
+                // addressed free chunk.  Find out the begin and end addresses of the memory chunk.
+                void* begin = m_commonSizedAllocations.last();
+                void* end = (void*)((intptr_t)begin + m_commonSize);
+                m_commonSizedAllocations.removeLast();
+
+                // Try to find another free chunk abutting onto the end of the one we have already found.
+                if (freeListEntries.size() && (freeListEntries.last()->pointer == end)) {
+                    // There is an existing FreeListEntry for the next chunk of memory!
+                    // we can reuse this.  Pop it off the end of m_freeList.
+                    coalescionEntry = freeListEntries.last();
+                    freeListEntries.removeLast();
+                    // Update the existing node to include the common-sized chunk that we also found. 
+                    coalescionEntry->pointer = (void*)((intptr_t)coalescionEntry->pointer - m_commonSize);
+                    coalescionEntry->size += m_commonSize;
+                } else if (m_commonSizedAllocations.size() && (m_commonSizedAllocations.last() == end)) {
+                    // There is a second common-sized chunk that can be coalesced.
+                    // Allocate a new node.
+                    m_commonSizedAllocations.removeLast();
+                    coalescionEntry = new FreeListEntry(begin, 2 * m_commonSize);
+                } else {
+                    // Nope - this poor little guy is all on his own. :-(
+                    // Add him into the newCommonSizedAllocations vector for now, we're
+                    // going to end up adding him back into the m_commonSizedAllocations
+                    // list when we're done.
+                    newCommonSizedAllocations.append(begin);
+                    continue;
+                }
+            } else {
+                ASSERT(freeListEntries.size());
+                ASSERT(!m_commonSizedAllocations.size() || (freeListEntries.last()->pointer < m_commonSizedAllocations.last()));
+                // The lowest addressed item is from m_freeList; pop it from the Vector.
+                coalescionEntry = freeListEntries.last();
+                freeListEntries.removeLast();
+            }
+            
+            // Right, we have a FreeListEntry, we just need check if there is anything else
+            // to coalesce onto the end.
+            ASSERT(coalescionEntry);
+            while (true) {
+                // Calculate the end address of the chunk we have found so far.
+                void* end = (void*)((intptr_t)coalescionEntry->pointer - coalescionEntry->size);
+
+                // Is there another chunk adjacent to the one we already have?
+                if (freeListEntries.size() && (freeListEntries.last()->pointer == end)) {
+                    // Yes - another FreeListEntry -pop it from the list.
+                    FreeListEntry* coalescee = freeListEntries.last();
+                    freeListEntries.removeLast();
+                    // Add it's size onto our existing node.
+                    coalescionEntry->size += coalescee->size;
+                    delete coalescee;
+                } else if (m_commonSizedAllocations.size() && (m_commonSizedAllocations.last() == end)) {
+                    // We can coalesce the next common-sized chunk.
+                    m_commonSizedAllocations.removeLast();
+                    coalescionEntry->size += m_commonSize;
+                } else
+                    break; // Nope, nothing to be added - stop here.
+            }
+
+            // We've coalesced everything we can onto the current chunk.
+            // Add it back into m_freeList.
+            addToFreeList(coalescionEntry);
+        }
+
+        // All chunks of free memory larger than m_commonSize should be
+        // back in m_freeList by now.  All that remains to be done is to
+        // copy the contents on the newCommonSizedAllocations back into
+        // the m_commonSizedAllocations Vector.
+        ASSERT(m_commonSizedAllocations.size() == 0);
+        m_commonSizedAllocations.append(newCommonSizedAllocations);
+    }
+
+public:
+
+    FixedVMPoolAllocator(size_t commonSize, size_t totalHeapSize)
+        : m_commonSize(commonSize)
+        , m_countFreedSinceLastCoalesce(0)
+        , m_totalHeapSize(totalHeapSize)
+    {
+        // Cook up an address to allocate at, using the following recipe:
+        //   17 bits of zero, stay in userspace kids.
+        //   26 bits of randomness for ASLR.
+        //   21 bits of zero, at least stay aligned within one level of the pagetables.
+        //
+        // But! - as a temporary workaround for some plugin problems (rdar://problem/6812854),
+        // for now instead of 2^26 bits of ASLR lets stick with 25 bits of randomization plus
+        // 2^24, which should put up somewhere in the middle of usespace (in the address range
+        // 0x200000000000 .. 0x5fffffffffff).
+        intptr_t randomLocation = arc4random() & ((1 << 25) - 1);
+        randomLocation += (1 << 24);
+        randomLocation <<= 21;
+        m_base = mmap(reinterpret_cast<void*>(randomLocation), m_totalHeapSize, INITIAL_PROTECTION_FLAGS, MAP_PRIVATE | MAP_ANON, VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY, 0);
+        if (!m_base)
+            CRASH();
+
+        // For simplicity, we keep all memory in m_freeList in a 'released' state.
+        // This means that we can simply reuse all memory when allocating, without
+        // worrying about it's previous state, and also makes coalescing m_freeList
+        // simpler since we need not worry about the possibility of coalescing released
+        // chunks with non-released ones.
+        release(m_base, m_totalHeapSize);
+        m_freeList.insert(new FreeListEntry(m_base, m_totalHeapSize));
+    }
+
+    void* alloc(size_t size)
+    {
+        void* result;
+
+        // Freed allocations of the common size are not stored back into the main
+        // m_freeList, but are instead stored in a separate vector.  If the request
+        // is for a common sized allocation, check this list.
+        if ((size == m_commonSize) && m_commonSizedAllocations.size()) {
+            result = m_commonSizedAllocations.last();
+            m_commonSizedAllocations.removeLast();
+        } else {
+            // Serach m_freeList for a suitable sized chunk to allocate memory from.
+            FreeListEntry* entry = m_freeList.search(size, m_freeList.GREATER_EQUAL);
+
+            // This would be bad news.
+            if (!entry) {
+                // Errk!  Lets take a last-ditch desparation attempt at defragmentation...
+                coalesceFreeSpace();
+                // Did that free up a large enough chunk?
+                entry = m_freeList.search(size, m_freeList.GREATER_EQUAL);
+                // No?...  *BOOM!*
+                if (!entry)
+                    CRASH();
+            }
+            ASSERT(entry->size != m_commonSize);
+
+            // Remove the entry from m_freeList.  But! -
+            // Each entry in the tree may represent a chain of multiple chunks of the
+            // same size, and we only want to remove one on them.  So, if this entry
+            // does have a chain, just remove the first-but-one item from the chain.
+            if (FreeListEntry* next = entry->nextEntry) {
+                // We're going to leave 'entry' in the tree; remove 'next' from its chain.
+                entry->nextEntry = next->nextEntry;
+                next->nextEntry = 0;
+                entry = next;
+            } else
+                m_freeList.remove(entry->size);
+
+            // Whoo!, we have a result!
+            ASSERT(entry->size >= size);
+            result = entry->pointer;
+
+            // If the allocation exactly fits the chunk we found in the,
+            // m_freeList then the FreeListEntry node is no longer needed.
+            if (entry->size == size)
+                delete entry;
+            else {
+                // There is memory left over, and it is not of the common size.
+                // We can reuse the existing FreeListEntry node to add this back
+                // into m_freeList.
+                entry->pointer = (void*)((intptr_t)entry->pointer + size);
+                entry->size -= size;
+                addToFreeList(entry);
+            }
+        }
+
+        // Call reuse to report to the operating system that this memory is in use.
+        ASSERT(isWithinVMPool(result, size));
+        reuse(result, size);
+        return result;
+    }
+
+    void free(void* pointer, size_t size)
+    {
+        // Call release to report to the operating system that this
+        // memory is no longer in use, and need not be paged out.
+        ASSERT(isWithinVMPool(pointer, size));
+        release(pointer, size);
+
+        // Common-sized allocations are stored in the m_commonSizedAllocations
+        // vector; all other freed chunks are added to m_freeList.
+        if (size == m_commonSize)
+            m_commonSizedAllocations.append(pointer);
+        else
+            addToFreeList(new FreeListEntry(pointer, size));
+
+        // Do some housekeeping.  Every time we reach a point that
+        // 16MB of allocations have been freed, sweep m_freeList
+        // coalescing any neighboring fragments.
+        m_countFreedSinceLastCoalesce += size;
+        if (m_countFreedSinceLastCoalesce >= SIXTEEN_MB) {
+            m_countFreedSinceLastCoalesce = 0;
+            coalesceFreeSpace();
+        }
+    }
+
+private:
+
+#ifndef NDEBUG
+    bool isWithinVMPool(void* pointer, size_t size)
+    {
+        return pointer >= m_base && (reinterpret_cast<char*>(pointer) + size <= reinterpret_cast<char*>(m_base) + m_totalHeapSize);
+    }
+#endif
+
+    // Freed space from the most common sized allocations will be held in this list, ...
+    const size_t m_commonSize;
+    Vector<void*> m_commonSizedAllocations;
+
+    // ... and all other freed allocations are held in m_freeList.
+    SizeSortedFreeTree m_freeList;
+
+    // This is used for housekeeping, to trigger defragmentation of the freed lists.
+    size_t m_countFreedSinceLastCoalesce;
+
+    void* m_base;
+    size_t m_totalHeapSize;
+};
+
+void ExecutableAllocator::intializePageSize()
+{
+    ExecutableAllocator::pageSize = getpagesize();
+}
+
+static FixedVMPoolAllocator* allocator = 0;
+static SpinLock spinlock = SPINLOCK_INITIALIZER;
+
+ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t size)
+{
+  SpinLockHolder lock_holder(&spinlock);
+
+    if (!allocator)
+        allocator = new FixedVMPoolAllocator(JIT_ALLOCATOR_LARGE_ALLOC_SIZE, TWO_GB);
+    ExecutablePool::Allocation alloc = {reinterpret_cast<char*>(allocator->alloc(size)), size};
+    return alloc;
+}
+
+void ExecutablePool::systemRelease(const ExecutablePool::Allocation& allocation) 
+{
+  SpinLockHolder lock_holder(&spinlock);
+
+    ASSERT(allocator);
+    allocator->free(allocation.pages, allocation.size);
+}
+
+}
+
+#endif // HAVE(ASSEMBLER)
diff --git a/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp b/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
index 21955d7..4bd5a2c 100644
--- a/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+++ b/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
@@ -31,9 +31,12 @@
 
 #include <sys/mman.h>
 #include <unistd.h>
+#include <wtf/VMTags.h>
 
 namespace JSC {
 
+#if !(PLATFORM(MAC) && PLATFORM(X86_64))
+
 void ExecutableAllocator::intializePageSize()
 {
     ExecutableAllocator::pageSize = getpagesize();
@@ -41,16 +44,39 @@
 
 ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t n)
 {
-    ExecutablePool::Allocation alloc = {reinterpret_cast<char*>(mmap(NULL, n, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0)), n};
+    ExecutablePool::Allocation alloc = { reinterpret_cast<char*>(mmap(NULL, n, INITIAL_PROTECTION_FLAGS, MAP_PRIVATE | MAP_ANON, VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY, 0)), n };
     return alloc;
 }
 
-void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc) 
+void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
 { 
     int result = munmap(alloc.pages, alloc.size);
     ASSERT_UNUSED(result, !result);
 }
 
+#endif // !(PLATFORM(MAC) && PLATFORM(X86_64))
+
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+void ExecutableAllocator::reprotectRegion(void* start, size_t size, ProtectionSeting setting)
+{
+    if (!pageSize)
+        intializePageSize();
+
+    // Calculate the start of the page containing this region,
+    // and account for this extra memory within size.
+    intptr_t startPtr = reinterpret_cast<intptr_t>(start);
+    intptr_t pageStartPtr = startPtr & ~(pageSize - 1);
+    void* pageStart = reinterpret_cast<void*>(pageStartPtr);
+    size += (startPtr - pageStartPtr);
+
+    // Round size up
+    size += (pageSize - 1);
+    size &= ~(pageSize - 1);
+
+    mprotect(pageStart, size, (setting == Writable) ? PROTECTION_FLAGS_RW : PROTECTION_FLAGS_RX);
+}
+#endif
+
 }
 
 #endif // HAVE(ASSEMBLER)
diff --git a/JavaScriptCore/jit/ExecutableAllocatorWin.cpp b/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
index 7467f81..a9ba7d0 100644
--- a/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+++ b/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
@@ -51,6 +51,10 @@
     VirtualFree(alloc.pages, 0, MEM_RELEASE); 
 }
 
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+#error "ASSEMBLER_WX_EXCLUSIVE not yet suported on this platform."
+#endif
+
 }
 
 #endif // HAVE(ASSEMBLER)
diff --git a/JavaScriptCore/jit/JIT.cpp b/JavaScriptCore/jit/JIT.cpp
index e6113fc..0cfb535 100644
--- a/JavaScriptCore/jit/JIT.cpp
+++ b/JavaScriptCore/jit/JIT.cpp
@@ -1,3 +1,4 @@
+
 /*
  * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
@@ -29,10 +30,11 @@
 #if ENABLE(JIT)
 
 #include "CodeBlock.h"
+#include "Interpreter.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
-#include "Interpreter.h"
 #include "ResultType.h"
 #include "SamplingTool.h"
 
@@ -44,177 +46,21 @@
 
 namespace JSC {
 
-#if COMPILER(GCC) && PLATFORM(X86)
-
-COMPILE_ASSERT(STUB_ARGS_code == 0x0C, STUB_ARGS_code_is_0x0C);
-COMPILE_ASSERT(STUB_ARGS_callFrame == 0x0E, STUB_ARGS_callFrame_is_0x0E);
-
-#if PLATFORM(DARWIN)
-#define SYMBOL_STRING(name) "_" #name
-#else
-#define SYMBOL_STRING(name) #name
-#endif
-
-asm(
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "pushl %ebp" "\n"
-    "movl %esp, %ebp" "\n"
-    "pushl %esi" "\n"
-    "pushl %edi" "\n"
-    "pushl %ebx" "\n"
-    "subl $0x1c, %esp" "\n"
-    "movl $512, %esi" "\n"
-    "movl 0x38(%esp), %edi" "\n" // Ox38 = 0x0E * 4, 0x0E = STUB_ARGS_callFrame (see assertion above)
-    "call *0x30(%esp)" "\n" // Ox30 = 0x0C * 4, 0x0C = STUB_ARGS_code (see assertion above)
-    "addl $0x1c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
-);
-
-asm(
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-#if USE(JIT_STUB_ARGUMENT_VA_LIST)
-    "call " SYMBOL_STRING(_ZN3JSC8JITStubs12cti_vm_throwEPvz) "\n"
-#else
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-    "movl %esp, %ecx" "\n"
-#else // JIT_STUB_ARGUMENT_STACK
-    "movl %esp, 0(%esp)" "\n"
-#endif
-    "call " SYMBOL_STRING(_ZN3JSC8JITStubs12cti_vm_throwEPPv) "\n"
-#endif
-    "addl $0x1c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
-);
-    
-#elif COMPILER(GCC) && PLATFORM(X86_64)
-
-COMPILE_ASSERT(STUB_ARGS_code == 0x10, STUB_ARGS_code_is_0x10);
-COMPILE_ASSERT(STUB_ARGS_callFrame == 0x12, STUB_ARGS_callFrame_is_0x12);
-
-#if PLATFORM(DARWIN)
-#define SYMBOL_STRING(name) "_" #name
-#else
-#define SYMBOL_STRING(name) #name
-#endif
-
-asm(
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "pushq %rbp" "\n"
-    "movq %rsp, %rbp" "\n"
-    "pushq %r12" "\n"
-    "pushq %r13" "\n"
-    "pushq %r14" "\n"
-    "pushq %r15" "\n"
-    "pushq %rbx" "\n"
-    "subq $0x48, %rsp" "\n"
-    "movq $512, %r12" "\n"
-    "movq $0xFFFF000000000000, %r14" "\n"
-    "movq $0xFFFF000000000002, %r15" "\n"
-    "movq 0x90(%rsp), %r13" "\n" // Ox90 = 0x12 * 8, 0x12 = STUB_ARGS_callFrame (see assertion above)
-    "call *0x80(%rsp)" "\n" // Ox80 = 0x10 * 8, 0x10 = STUB_ARGS_code (see assertion above)
-    "addq $0x48, %rsp" "\n"
-    "popq %rbx" "\n"
-    "popq %r15" "\n"
-    "popq %r14" "\n"
-    "popq %r13" "\n"
-    "popq %r12" "\n"
-    "popq %rbp" "\n"
-    "ret" "\n"
-);
-
-asm(
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-    "movq %rsp, %rdi" "\n"
-    "call " SYMBOL_STRING(_ZN3JSC8JITStubs12cti_vm_throwEPPv) "\n"
-#else // JIT_STUB_ARGUMENT_VA_LIST or JIT_STUB_ARGUMENT_STACK
-#error "JIT_STUB_ARGUMENT configuration not supported."
-#endif
-    "addq $0x48, %rsp" "\n"
-    "popq %rbx" "\n"
-    "popq %r15" "\n"
-    "popq %r14" "\n"
-    "popq %r13" "\n"
-    "popq %r12" "\n"
-    "popq %rbp" "\n"
-    "ret" "\n"
-);
-    
-#elif COMPILER(MSVC)
-
-extern "C" {
-    
-    __declspec(naked) JSValueEncodedAsPointer* ctiTrampoline(void* code, RegisterFile*, CallFrame*, JSValuePtr* exception, Profiler**, JSGlobalData*)
-    {
-        __asm {
-            push ebp;
-            mov ebp, esp;
-            push esi;
-            push edi;
-            push ebx;
-            sub esp, 0x1c;
-            mov esi, 512;
-            mov ecx, esp;
-            mov edi, [esp + 0x38];
-            call [esp + 0x30]; // Ox30 = 0x0C * 4, 0x0C = STUB_ARGS_code (see assertion above)
-            add esp, 0x1c;
-            pop ebx;
-            pop edi;
-            pop esi;
-            pop ebp;
-            ret;
-        }
-    }
-    
-    __declspec(naked) void ctiVMThrowTrampoline()
-    {
-        __asm {
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-            mov ecx, esp;
-#else // JIT_STUB_ARGUMENT_VA_LIST or JIT_STUB_ARGUMENT_STACK
-#error "JIT_STUB_ARGUMENT configuration not supported."
-#endif
-            call JSC::JITStubs::cti_vm_throw;
-            add esp, 0x1c;
-            pop ebx;
-            pop edi;
-            pop esi;
-            pop ebp;
-            ret;
-        }
-    }
-    
-}
-
-#endif
-
-void ctiSetReturnAddress(void** addressOfReturnAddress, void* newDestinationToReturnTo)
+void ctiPatchNearCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, MacroAssemblerCodePtr newCalleeFunction)
 {
-    *addressOfReturnAddress = newDestinationToReturnTo;
+    returnAddress.relinkNearCallerToTrampoline(newCalleeFunction);
 }
 
-void ctiPatchCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, void* newCalleeFunction)
+void ctiPatchCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, MacroAssemblerCodePtr newCalleeFunction)
+{
+    returnAddress.relinkCallerToTrampoline(newCalleeFunction);
+}
+
+void ctiPatchCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, FunctionPtr newCalleeFunction)
 {
     returnAddress.relinkCallerToFunction(newCalleeFunction);
 }
 
-void ctiPatchNearCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, void* newCalleeFunction)
-{
-    returnAddress.relinkNearCallerToFunction(newCalleeFunction);
-}
-
 JIT::JIT(JSGlobalData* globalData, CodeBlock* codeBlock)
     : m_interpreter(globalData->interpreter)
     , m_globalData(globalData)
@@ -253,8 +99,7 @@
 void JIT::emitTimeoutCheck()
 {
     Jump skipTimeout = branchSub32(NonZero, Imm32(1), timeoutCheckRegister);
-    emitCTICall(JITStubs::cti_timeout_check);
-    move(regT0, timeoutCheckRegister);
+    JITStubCall(this, JITStubs::cti_timeout_check).call(timeoutCheckRegister);
     skipTimeout.link(this);
 
     killLastResultRegister();
@@ -265,33 +110,43 @@
     m_bytecodeIndex += OPCODE_LENGTH(name); \
     break;
 
-#define CTI_COMPILE_BINARY_OP(name) \
+#define DEFINE_BINARY_OP(name) \
     case name: { \
-        emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, regT2); \
-        emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, regT2); \
-        emitCTICall(JITStubs::cti_##name); \
-        emitPutVirtualRegister(currentInstruction[1].u.operand); \
+        JITStubCall stubCall(this, JITStubs::cti_##name); \
+        stubCall.addArgument(currentInstruction[2].u.operand, regT2); \
+        stubCall.addArgument(currentInstruction[3].u.operand, regT2); \
+        stubCall.call(currentInstruction[1].u.operand); \
         NEXT_OPCODE(name); \
     }
 
-#define CTI_COMPILE_UNARY_OP(name) \
+#define DEFINE_UNARY_OP(name) \
     case name: { \
-        emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, regT2); \
-        emitCTICall(JITStubs::cti_##name); \
-        emitPutVirtualRegister(currentInstruction[1].u.operand); \
+        JITStubCall stubCall(this, JITStubs::cti_##name); \
+        stubCall.addArgument(currentInstruction[2].u.operand, regT2); \
+        stubCall.call(currentInstruction[1].u.operand); \
         NEXT_OPCODE(name); \
     }
 
-#define RECORD_JUMP_TARGET(targetOffset) \
-   do { m_labels[m_bytecodeIndex + (targetOffset)].used(); } while (false)
+#define DEFINE_OP(name) \
+    case name: { \
+        emit_##name(currentInstruction); \
+        NEXT_OPCODE(name); \
+    }
+
+#define DEFINE_SLOWCASE_OP(name) \
+    case name: { \
+        emitSlow_##name(currentInstruction, iter); \
+        NEXT_OPCODE(name); \
+    }
 
 void JIT::privateCompileMainPass()
 {
     Instruction* instructionsBegin = m_codeBlock->instructions().begin();
     unsigned instructionCount = m_codeBlock->instructions().size();
-    unsigned propertyAccessInstructionIndex = 0;
-    unsigned globalResolveInfoIndex = 0;
-    unsigned callLinkInfoIndex = 0;
+
+    m_propertyAccessInstructionIndex = 0;
+    m_globalResolveInfoIndex = 0;
+    m_callLinkInfoIndex = 0;
 
     for (m_bytecodeIndex = 0; m_bytecodeIndex < instructionCount; ) {
         Instruction* currentInstruction = instructionsBegin + m_bytecodeIndex;
@@ -306,947 +161,119 @@
             killLastResultRegister();
         
         m_labels[m_bytecodeIndex] = label();
-        OpcodeID opcodeID = m_interpreter->getOpcodeID(currentInstruction->u.opcode);
 
-        switch (opcodeID) {
-        case op_mov: {
-            int src = currentInstruction[2].u.operand;
-            int dst = currentInstruction[1].u.operand;
+        switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
+        DEFINE_BINARY_OP(op_del_by_val)
+        DEFINE_BINARY_OP(op_div)
+        DEFINE_BINARY_OP(op_in)
+        DEFINE_BINARY_OP(op_less)
+        DEFINE_BINARY_OP(op_lesseq)
+        DEFINE_BINARY_OP(op_urshift)
+        DEFINE_UNARY_OP(op_get_pnames)
+        DEFINE_UNARY_OP(op_is_boolean)
+        DEFINE_UNARY_OP(op_is_function)
+        DEFINE_UNARY_OP(op_is_number)
+        DEFINE_UNARY_OP(op_is_object)
+        DEFINE_UNARY_OP(op_is_string)
+        DEFINE_UNARY_OP(op_is_undefined)
+        DEFINE_UNARY_OP(op_negate)
+        DEFINE_UNARY_OP(op_typeof)
 
-            if (m_codeBlock->isConstantRegisterIndex(src)) {
-                storePtr(ImmPtr(JSValuePtr::encode(getConstantOperand(src))), Address(callFrameRegister, dst * sizeof(Register)));
-                if (dst == m_lastResultBytecodeRegister)
-                    killLastResultRegister();
-            } else if ((src == m_lastResultBytecodeRegister) || (dst == m_lastResultBytecodeRegister)) {
-                // If either the src or dst is the cached register go though
-                // get/put registers to make sure we track this correctly.
-                emitGetVirtualRegister(src, regT0);
-                emitPutVirtualRegister(dst);
-            } else {
-                // Perform the copy via regT1; do not disturb any mapping in regT0.
-                loadPtr(Address(callFrameRegister, src * sizeof(Register)), regT1);
-                storePtr(regT1, Address(callFrameRegister, dst * sizeof(Register)));
-            }
-            NEXT_OPCODE(op_mov);
-        }
-        case op_add: {
-            compileFastArith_op_add(currentInstruction);
-            NEXT_OPCODE(op_add);
-        }
-        case op_end: {
-            if (m_codeBlock->needsFullScopeChain())
-                emitCTICall(JITStubs::cti_op_end);
-            ASSERT(returnValueRegister != callFrameRegister);
-            emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
-            push(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));
-            ret();
-            NEXT_OPCODE(op_end);
-        }
-        case op_jmp: {
-            unsigned target = currentInstruction[1].u.operand;
-            addJump(jump(), target + 1);
-            RECORD_JUMP_TARGET(target + 1);
-            NEXT_OPCODE(op_jmp);
-        }
-        case op_pre_inc: {
-            compileFastArith_op_pre_inc(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_pre_inc);
-        }
-        case op_loop: {
-            emitTimeoutCheck();
-
-            unsigned target = currentInstruction[1].u.operand;
-            addJump(jump(), target + 1);
-            NEXT_OPCODE(op_end);
-        }
-        case op_loop_if_less: {
-            emitTimeoutCheck();
-
-            unsigned op1 = currentInstruction[1].u.operand;
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                emitGetVirtualRegister(op1, regT0);
-                emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
-                int32_t op2imm = getConstantOperandImmediateInt(op2);
-#else
-                int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-                addJump(branch32(LessThan, regT0, Imm32(op2imm)), target + 3);
-            } else {
-                emitGetVirtualRegisters(op1, regT0, op2, regT1);
-                emitJumpSlowCaseIfNotImmediateInteger(regT0);
-                emitJumpSlowCaseIfNotImmediateInteger(regT1);
-                addJump(branch32(LessThan, regT0, regT1), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_less);
-        }
-        case op_loop_if_lesseq: {
-            emitTimeoutCheck();
-
-            unsigned op1 = currentInstruction[1].u.operand;
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                emitGetVirtualRegister(op1, regT0);
-                emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
-                int32_t op2imm = getConstantOperandImmediateInt(op2);
-#else
-                int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-                addJump(branch32(LessThanOrEqual, regT0, Imm32(op2imm)), target + 3);
-            } else {
-                emitGetVirtualRegisters(op1, regT0, op2, regT1);
-                emitJumpSlowCaseIfNotImmediateInteger(regT0);
-                emitJumpSlowCaseIfNotImmediateInteger(regT1);
-                addJump(branch32(LessThanOrEqual, regT0, regT1), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_less);
-        }
-        case op_new_object: {
-            emitCTICall(JITStubs::cti_op_new_object);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_object);
-        }
-        case op_put_by_id: {
-            compilePutByIdHotPath(currentInstruction[1].u.operand, &(m_codeBlock->identifier(currentInstruction[2].u.operand)), currentInstruction[3].u.operand, propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_put_by_id);
-        }
-        case op_get_by_id: {
-            compileGetByIdHotPath(currentInstruction[1].u.operand, currentInstruction[2].u.operand, &(m_codeBlock->identifier(currentInstruction[3].u.operand)), propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_get_by_id);
-        }
-        case op_instanceof: {
-            emitGetVirtualRegister(currentInstruction[2].u.operand, regT0); // value
-            emitGetVirtualRegister(currentInstruction[3].u.operand, regT2); // baseVal
-            emitGetVirtualRegister(currentInstruction[4].u.operand, regT1); // proto
-
-            // check if any are immediates
-            move(regT0, regT3);
-            orPtr(regT2, regT3);
-            orPtr(regT1, regT3);
-            emitJumpSlowCaseIfNotJSCell(regT3);
-
-            // check that all are object type - this is a bit of a bithack to avoid excess branching;
-            // we check that the sum of the three type codes from Structures is exactly 3 * ObjectType,
-            // this works because NumberType and StringType are smaller
-            move(Imm32(3 * ObjectType), regT3);
-            loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT0);
-            loadPtr(Address(regT2, FIELD_OFFSET(JSCell, m_structure)), regT2);
-            loadPtr(Address(regT1, FIELD_OFFSET(JSCell, m_structure)), regT1);
-            sub32(Address(regT0, FIELD_OFFSET(Structure, m_typeInfo.m_type)), regT3);
-            sub32(Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_type)), regT3);
-            addSlowCase(branch32(NotEqual, Address(regT1, FIELD_OFFSET(Structure, m_typeInfo.m_type)), regT3));
-
-            // check that baseVal's flags include ImplementsHasInstance but not OverridesHasInstance
-            load32(Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), regT2);
-            and32(Imm32(ImplementsHasInstance | OverridesHasInstance), regT2);
-            addSlowCase(branch32(NotEqual, regT2, Imm32(ImplementsHasInstance)));
-
-            emitGetVirtualRegister(currentInstruction[2].u.operand, regT2); // reload value
-            emitGetVirtualRegister(currentInstruction[4].u.operand, regT1); // reload proto
-
-            // optimistically load true result
-            move(ImmPtr(JSValuePtr::encode(jsBoolean(true))), regT0);
-
-            Label loop(this);
-
-            // load value's prototype
-            loadPtr(Address(regT2, FIELD_OFFSET(JSCell, m_structure)), regT2);
-            loadPtr(Address(regT2, FIELD_OFFSET(Structure, m_prototype)), regT2);
-
-            Jump exit = branchPtr(Equal, regT2, regT1);
-
-            branchPtr(NotEqual, regT2, ImmPtr(JSValuePtr::encode(jsNull())), loop);
-
-            move(ImmPtr(JSValuePtr::encode(jsBoolean(false))), regT0);
-
-            exit.link(this);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_instanceof);
-        }
-        case op_del_by_id: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, regT2);
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            emitPutJITStubArgConstant(ident, 2);
-            emitCTICall(JITStubs::cti_op_del_by_id);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_del_by_id);
-        }
-        case op_mul: {
-            compileFastArith_op_mul(currentInstruction);
-            NEXT_OPCODE(op_mul);
-        }
-        case op_new_func: {
-            FuncDeclNode* func = m_codeBlock->function(currentInstruction[2].u.operand);
-            emitPutJITStubArgConstant(func, 1);
-            emitCTICall(JITStubs::cti_op_new_func);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_func);
-        }
-        case op_call: {
-            compileOpCall(opcodeID, currentInstruction, callLinkInfoIndex++);
-            NEXT_OPCODE(op_call);
-        }
-        case op_call_eval: {
-            compileOpCall(opcodeID, currentInstruction, callLinkInfoIndex++);
-            NEXT_OPCODE(op_call_eval);
-        }
-        case op_construct: {
-            compileOpCall(opcodeID, currentInstruction, callLinkInfoIndex++);
-            NEXT_OPCODE(op_construct);
-        }
-        case op_get_global_var: {
-            JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[2].u.jsCell);
-            move(ImmPtr(globalObject), regT0);
-            emitGetVariableObjectRegister(regT0, currentInstruction[3].u.operand, regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_global_var);
-        }
-        case op_put_global_var: {
-            emitGetVirtualRegister(currentInstruction[3].u.operand, regT1);
-            JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[1].u.jsCell);
-            move(ImmPtr(globalObject), regT0);
-            emitPutVariableObjectRegister(regT1, regT0, currentInstruction[2].u.operand);
-            NEXT_OPCODE(op_put_global_var);
-        }
-        case op_get_scoped_var: {
-            int skip = currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain();
-
-            emitGetFromCallFrameHeader(RegisterFile::ScopeChain, regT0);
-            while (skip--)
-                loadPtr(Address(regT0, FIELD_OFFSET(ScopeChainNode, next)), regT0);
-
-            loadPtr(Address(regT0, FIELD_OFFSET(ScopeChainNode, object)), regT0);
-            emitGetVariableObjectRegister(regT0, currentInstruction[2].u.operand, regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_scoped_var);
-        }
-        case op_put_scoped_var: {
-            int skip = currentInstruction[2].u.operand + m_codeBlock->needsFullScopeChain();
-
-            emitGetFromCallFrameHeader(RegisterFile::ScopeChain, regT1);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
-            while (skip--)
-                loadPtr(Address(regT1, FIELD_OFFSET(ScopeChainNode, next)), regT1);
-
-            loadPtr(Address(regT1, FIELD_OFFSET(ScopeChainNode, object)), regT1);
-            emitPutVariableObjectRegister(regT0, regT1, currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_put_scoped_var);
-        }
-        case op_tear_off_activation: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, regT2);
-            emitCTICall(JITStubs::cti_op_tear_off_activation);
-            NEXT_OPCODE(op_tear_off_activation);
-        }
-        case op_tear_off_arguments: {
-            emitCTICall(JITStubs::cti_op_tear_off_arguments);
-            NEXT_OPCODE(op_tear_off_arguments);
-        }
-        case op_ret: {
-            // We could JIT generate the deref, only calling out to C when the refcount hits zero.
-            if (m_codeBlock->needsFullScopeChain())
-                emitCTICall(JITStubs::cti_op_ret_scopeChain);
-
-            ASSERT(callFrameRegister != regT1);
-            ASSERT(regT1 != returnValueRegister);
-            ASSERT(returnValueRegister != callFrameRegister);
-
-            // Return the result in %eax.
-            emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
-
-            // Grab the return address.
-            emitGetFromCallFrameHeader(RegisterFile::ReturnPC, regT1);
-
-            // Restore our caller's "r".
-            emitGetFromCallFrameHeader(RegisterFile::CallerFrame, callFrameRegister);
-
-            // Return.
-            push(regT1);
-            ret();
-
-            NEXT_OPCODE(op_ret);
-        }
-        case op_new_array: {
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 1);
-            emitPutJITStubArgConstant(currentInstruction[3].u.operand, 2);
-            emitCTICall(JITStubs::cti_op_new_array);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_array);
-        }
-        case op_resolve: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(JITStubs::cti_op_resolve);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve);
-        }
-        case op_construct_verify: {
-            emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
-
-            emitJumpSlowCaseIfNotJSCell(regT0);
-            loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
-            addSlowCase(branch32(NotEqual, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
-
-            NEXT_OPCODE(op_construct_verify);
-        }
-        case op_get_by_val: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
-            emitJumpSlowCaseIfNotImmediateInteger(regT1);
-#if USE(ALTERNATE_JSIMMEDIATE)
-            // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
-            // We check the value as if it was a uint32 against the m_fastAccessCutoff - which will always fail if
-            // number was signed since m_fastAccessCutoff is always less than intmax (since the total allocation
-            // size is always less than 4Gb).  As such zero extending wil have been correct (and extending the value
-            // to 64-bits is necessary since it's used in the address calculation.  We zero extend rather than sign
-            // extending since it makes it easier to re-tag the value in the slow case.
-            zeroExtend32ToPtr(regT1, regT1);
-#else
-            emitFastArithImmToInt(regT1);
-#endif
-            emitJumpSlowCaseIfNotJSCell(regT0);
-            addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-
-            // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
-            loadPtr(Address(regT0, FIELD_OFFSET(JSArray, m_storage)), regT2);
-            addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, FIELD_OFFSET(JSArray, m_fastAccessCutoff))));
-
-            // Get the value from the vector
-            loadPtr(BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])), regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_by_val);
-        }
-        case op_resolve_func: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(JITStubs::cti_op_resolve_func);
-            emitPutVirtualRegister(currentInstruction[2].u.operand, regT1);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_func);
-        }
-        case op_sub: {
-            compileFastArith_op_sub(currentInstruction);
-            NEXT_OPCODE(op_sub);
-        }
-        case op_put_by_val: {
-            emitGetVirtualRegisters(currentInstruction[1].u.operand, regT0, currentInstruction[2].u.operand, regT1);
-            emitJumpSlowCaseIfNotImmediateInteger(regT1);
-#if USE(ALTERNATE_JSIMMEDIATE)
-            // See comment in op_get_by_val.
-            zeroExtend32ToPtr(regT1, regT1);
-#else
-            emitFastArithImmToInt(regT1);
-#endif
-            emitJumpSlowCaseIfNotJSCell(regT0);
-            addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-
-            // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
-            loadPtr(Address(regT0, FIELD_OFFSET(JSArray, m_storage)), regT2);
-            Jump inFastVector = branch32(Below, regT1, Address(regT0, FIELD_OFFSET(JSArray, m_fastAccessCutoff)));
-            // No; oh well, check if the access if within the vector - if so, we may still be okay.
-            addSlowCase(branch32(AboveOrEqual, regT1, Address(regT2, FIELD_OFFSET(ArrayStorage, m_vectorLength))));
-
-            // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
-            // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
-            addSlowCase(branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0]))));
-
-            // All good - put the value into the array.
-            inFastVector.link(this);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
-            storePtr(regT0, BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])));
-            NEXT_OPCODE(op_put_by_val);
-        }
-        CTI_COMPILE_BINARY_OP(op_lesseq)
-        case op_loop_if_true: {
-            emitTimeoutCheck();
-
-            unsigned target = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
-
-            Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValuePtr::encode(js0())));
-            addJump(emitJumpIfImmediateInteger(regT0), target + 2);
-
-            addJump(branchPtr(Equal, regT0, ImmPtr(JSValuePtr::encode(jsBoolean(true)))), target + 2);
-            addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValuePtr::encode(jsBoolean(false)))));
-
-            isZero.link(this);
-            NEXT_OPCODE(op_loop_if_true);
-        };
-        case op_resolve_base: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(JITStubs::cti_op_resolve_base);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_base);
-        }
-        case op_negate: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, regT2);
-            emitCTICall(JITStubs::cti_op_negate);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_negate);
-        }
-        case op_resolve_skip: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitPutJITStubArgConstant(currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain(), 2);
-            emitCTICall(JITStubs::cti_op_resolve_skip);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_skip);
-        }
-        case op_resolve_global: {
-            // Fast case
-            void* globalObject = currentInstruction[2].u.jsCell;
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            
-            unsigned currentIndex = globalResolveInfoIndex++;
-            void* structureAddress = &(m_codeBlock->globalResolveInfo(currentIndex).structure);
-            void* offsetAddr = &(m_codeBlock->globalResolveInfo(currentIndex).offset);
-
-            // Check Structure of global object
-            move(ImmPtr(globalObject), regT0);
-            loadPtr(structureAddress, regT1);
-            Jump noMatch = branchPtr(NotEqual, regT1, Address(regT0, FIELD_OFFSET(JSCell, m_structure))); // Structures don't match
-
-            // Load cached property
-            loadPtr(Address(regT0, FIELD_OFFSET(JSGlobalObject, m_propertyStorage)), regT0);
-            load32(offsetAddr, regT1);
-            loadPtr(BaseIndex(regT0, regT1, ScalePtr), regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            Jump end = jump();
-
-            // Slow case
-            noMatch.link(this);
-            emitPutJITStubArgConstant(globalObject, 1);
-            emitPutJITStubArgConstant(ident, 2);
-            emitPutJITStubArgConstant(currentIndex, 3);
-            emitCTICall(JITStubs::cti_op_resolve_global);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            end.link(this);
-            NEXT_OPCODE(op_resolve_global);
-        }
-        CTI_COMPILE_BINARY_OP(op_div)
-        case op_pre_dec: {
-            compileFastArith_op_pre_dec(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_pre_dec);
-        }
-        case op_jnless: {
-            unsigned op1 = currentInstruction[1].u.operand;
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                emitGetVirtualRegister(op1, regT0);
-                emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
-                int32_t op2imm = getConstantOperandImmediateInt(op2);
-#else
-                int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-                addJump(branch32(GreaterThanOrEqual, regT0, Imm32(op2imm)), target + 3);
-            } else {
-                emitGetVirtualRegisters(op1, regT0, op2, regT1);
-                emitJumpSlowCaseIfNotImmediateInteger(regT0);
-                emitJumpSlowCaseIfNotImmediateInteger(regT1);
-                addJump(branch32(GreaterThanOrEqual, regT0, regT1), target + 3);
-            }
-            RECORD_JUMP_TARGET(target + 3);
-            NEXT_OPCODE(op_jnless);
-        }
-        case op_not: {
-            emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
-            xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
-            addSlowCase(branchTestPtr(NonZero, regT0, Imm32(static_cast<int32_t>(~JSImmediate::ExtendedPayloadBitBoolValue))));
-            xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool | JSImmediate::ExtendedPayloadBitBoolValue)), regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_not);
-        }
-        case op_jfalse: {
-            unsigned target = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
-
-            addJump(branchPtr(Equal, regT0, ImmPtr(JSValuePtr::encode(js0()))), target + 2);
-            Jump isNonZero = emitJumpIfImmediateInteger(regT0);
-
-            addJump(branchPtr(Equal, regT0, ImmPtr(JSValuePtr::encode(jsBoolean(false)))), target + 2);
-            addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValuePtr::encode(jsBoolean(true)))));
-
-            isNonZero.link(this);
-            RECORD_JUMP_TARGET(target + 2);
-            NEXT_OPCODE(op_jfalse);
-        };
-        case op_jeq_null: {
-            unsigned src = currentInstruction[1].u.operand;
-            unsigned target = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src, regT0);
-            Jump isImmediate = emitJumpIfNotJSCell(regT0);
-
-            // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-            loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
-            addJump(branchTest32(NonZero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
-            Jump wasNotImmediate = jump();
-
-            // Now handle the immediate cases - undefined & null
-            isImmediate.link(this);
-            andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-            addJump(branchPtr(Equal, regT0, ImmPtr(JSValuePtr::encode(jsNull()))), target + 2);            
-
-            wasNotImmediate.link(this);
-            RECORD_JUMP_TARGET(target + 2);
-            NEXT_OPCODE(op_jeq_null);
-        };
-        case op_jneq_null: {
-            unsigned src = currentInstruction[1].u.operand;
-            unsigned target = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src, regT0);
-            Jump isImmediate = emitJumpIfNotJSCell(regT0);
-
-            // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-            loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
-            addJump(branchTest32(Zero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
-            Jump wasNotImmediate = jump();
-
-            // Now handle the immediate cases - undefined & null
-            isImmediate.link(this);
-            andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-            addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValuePtr::encode(jsNull()))), target + 2);            
-
-            wasNotImmediate.link(this);
-            RECORD_JUMP_TARGET(target + 2);
-            NEXT_OPCODE(op_jneq_null);
-        }
-        case op_post_inc: {
-            compileFastArith_op_post_inc(currentInstruction[1].u.operand, currentInstruction[2].u.operand);
-            NEXT_OPCODE(op_post_inc);
-        }
-        case op_unexpected_load: {
-            JSValuePtr v = m_codeBlock->unexpectedConstant(currentInstruction[2].u.operand);
-            move(ImmPtr(JSValuePtr::encode(v)), regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_unexpected_load);
-        }
-        case op_jsr: {
-            int retAddrDst = currentInstruction[1].u.operand;
-            int target = currentInstruction[2].u.operand;
-            DataLabelPtr storeLocation = storePtrWithPatch(Address(callFrameRegister, sizeof(Register) * retAddrDst));
-            addJump(jump(), target + 2);
-            m_jsrSites.append(JSRInfo(storeLocation, label()));
-            killLastResultRegister();
-            RECORD_JUMP_TARGET(target + 2);
-            NEXT_OPCODE(op_jsr);
-        }
-        case op_sret: {
-            jump(Address(callFrameRegister, sizeof(Register) * currentInstruction[1].u.operand));
-            killLastResultRegister();
-            NEXT_OPCODE(op_sret);
-        }
-        case op_eq: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
-            emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
-            set32(Equal, regT1, regT0, regT0);
-            emitTagAsBoolImmediate(regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_eq);
-        }
-        case op_lshift: {
-            compileFastArith_op_lshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_lshift);
-        }
-        case op_bitand: {
-            compileFastArith_op_bitand(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_bitand);
-        }
-        case op_rshift: {
-            compileFastArith_op_rshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_rshift);
-        }
-        case op_bitnot: {
-            emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
-            emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
-            not32(regT0);
-            emitFastArithIntToImmNoCheck(regT0, regT0);
-#else
-            xorPtr(Imm32(~JSImmediate::TagTypeNumber), regT0);
-#endif
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitnot);
-        }
-        case op_resolve_with_base: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(JITStubs::cti_op_resolve_with_base);
-            emitPutVirtualRegister(currentInstruction[2].u.operand, regT1);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_with_base);
-        }
-        case op_new_func_exp: {
-            FuncExprNode* func = m_codeBlock->functionExpression(currentInstruction[2].u.operand);
-            emitPutJITStubArgConstant(func, 1);
-            emitCTICall(JITStubs::cti_op_new_func_exp);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_func_exp);
-        }
-        case op_mod: {
-            compileFastArith_op_mod(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_mod);
-        }
-        case op_jtrue: {
-            unsigned target = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
-
-            Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValuePtr::encode(js0())));
-            addJump(emitJumpIfImmediateInteger(regT0), target + 2);
-
-            addJump(branchPtr(Equal, regT0, ImmPtr(JSValuePtr::encode(jsBoolean(true)))), target + 2);
-            addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValuePtr::encode(jsBoolean(false)))));
-
-            isZero.link(this);
-            RECORD_JUMP_TARGET(target + 2);
-            NEXT_OPCODE(op_jtrue);
-        }
-        CTI_COMPILE_BINARY_OP(op_less)
-        case op_neq: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
-            emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
-            set32(NotEqual, regT1, regT0, regT0);
-            emitTagAsBoolImmediate(regT0);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_neq);
-        }
-        case op_post_dec: {
-            compileFastArith_op_post_dec(currentInstruction[1].u.operand, currentInstruction[2].u.operand);
-            NEXT_OPCODE(op_post_dec);
-        }
-        CTI_COMPILE_BINARY_OP(op_urshift)
-        case op_bitxor: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
-            emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
-            xorPtr(regT1, regT0);
-            emitFastArithReTagImmediate(regT0, regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitxor);
-        }
-        case op_new_regexp: {
-            RegExp* regExp = m_codeBlock->regexp(currentInstruction[2].u.operand);
-            emitPutJITStubArgConstant(regExp, 1);
-            emitCTICall(JITStubs::cti_op_new_regexp);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_regexp);
-        }
-        case op_bitor: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
-            emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
-            orPtr(regT1, regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitor);
-        }
-        case op_throw: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, regT2);
-            emitCTICall(JITStubs::cti_op_throw);
-            ASSERT(regT0 == returnValueRegister);
-#if PLATFORM(X86_64)
-            addPtr(Imm32(0x48), X86::esp);
-            pop(X86::ebx);
-            pop(X86::r15);
-            pop(X86::r14);
-            pop(X86::r13);
-            pop(X86::r12);
-            pop(X86::ebp);
-            ret();
-#else
-            addPtr(Imm32(0x1c), X86::esp);
-            pop(X86::ebx);
-            pop(X86::edi);
-            pop(X86::esi);
-            pop(X86::ebp);
-            ret();
-#endif
-            NEXT_OPCODE(op_throw);
-        }
-        case op_get_pnames: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, regT2);
-            emitCTICall(JITStubs::cti_op_get_pnames);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_pnames);
-        }
-        case op_next_pname: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, regT2);
-            unsigned target = currentInstruction[3].u.operand;
-            emitCTICall(JITStubs::cti_op_next_pname);
-            Jump endOfIter = branchTestPtr(Zero, regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            addJump(jump(), target + 3);
-            endOfIter.link(this);
-            NEXT_OPCODE(op_next_pname);
-        }
-        case op_push_scope: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, regT2);
-            emitCTICall(JITStubs::cti_op_push_scope);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_push_scope);
-        }
-        case op_pop_scope: {
-            emitCTICall(JITStubs::cti_op_pop_scope);
-            NEXT_OPCODE(op_pop_scope);
-        }
-        CTI_COMPILE_UNARY_OP(op_typeof)
-        CTI_COMPILE_UNARY_OP(op_is_undefined)
-        CTI_COMPILE_UNARY_OP(op_is_boolean)
-        CTI_COMPILE_UNARY_OP(op_is_number)
-        CTI_COMPILE_UNARY_OP(op_is_string)
-        CTI_COMPILE_UNARY_OP(op_is_object)
-        CTI_COMPILE_UNARY_OP(op_is_function)
-        case op_stricteq: {
-            compileOpStrictEq(currentInstruction, OpStrictEq);
-            NEXT_OPCODE(op_stricteq);
-        }
-        case op_nstricteq: {
-            compileOpStrictEq(currentInstruction, OpNStrictEq);
-            NEXT_OPCODE(op_nstricteq);
-        }
-        case op_to_jsnumber: {
-            int srcVReg = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(srcVReg, regT0);
-            
-            Jump wasImmediate = emitJumpIfImmediateInteger(regT0);
-
-            emitJumpSlowCaseIfNotJSCell(regT0, srcVReg);
-            loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
-            addSlowCase(branch32(NotEqual, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
-            
-            wasImmediate.link(this);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_to_jsnumber);
-        }
-        CTI_COMPILE_BINARY_OP(op_in)
-        case op_push_new_scope: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, regT2);
-            emitCTICall(JITStubs::cti_op_push_new_scope);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_push_new_scope);
-        }
-        case op_catch: {
-            emitGetCTIParam(STUB_ARGS_callFrame, callFrameRegister);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_catch);
-        }
-        case op_jmp_scopes: {
-            unsigned count = currentInstruction[1].u.operand;
-            emitPutJITStubArgConstant(count, 1);
-            emitCTICall(JITStubs::cti_op_jmp_scopes);
-            unsigned target = currentInstruction[2].u.operand;
-            addJump(jump(), target + 2);
-            RECORD_JUMP_TARGET(target + 2);
-            NEXT_OPCODE(op_jmp_scopes);
-        }
-        case op_put_by_index: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, regT2);
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 3, regT2);
-            emitCTICall(JITStubs::cti_op_put_by_index);
-            NEXT_OPCODE(op_put_by_index);
-        }
-        case op_switch_imm: {
-            unsigned tableIndex = currentInstruction[1].u.operand;
-            unsigned defaultOffset = currentInstruction[2].u.operand;
-            unsigned scrutinee = currentInstruction[3].u.operand;
-
-            // create jump table for switch destinations, track this switch statement.
-            SimpleJumpTable* jumpTable = &m_codeBlock->immediateSwitchJumpTable(tableIndex);
-            m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Immediate));
-            jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
-
-            emitPutJITStubArgFromVirtualRegister(scrutinee, 1, regT2);
-            emitPutJITStubArgConstant(tableIndex, 2);
-            emitCTICall(JITStubs::cti_op_switch_imm);
-            jump(regT0);
-            NEXT_OPCODE(op_switch_imm);
-        }
-        case op_switch_char: {
-            unsigned tableIndex = currentInstruction[1].u.operand;
-            unsigned defaultOffset = currentInstruction[2].u.operand;
-            unsigned scrutinee = currentInstruction[3].u.operand;
-
-            // create jump table for switch destinations, track this switch statement.
-            SimpleJumpTable* jumpTable = &m_codeBlock->characterSwitchJumpTable(tableIndex);
-            m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Character));
-            jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
-
-            emitPutJITStubArgFromVirtualRegister(scrutinee, 1, regT2);
-            emitPutJITStubArgConstant(tableIndex, 2);
-            emitCTICall(JITStubs::cti_op_switch_char);
-            jump(regT0);
-            NEXT_OPCODE(op_switch_char);
-        }
-        case op_switch_string: {
-            unsigned tableIndex = currentInstruction[1].u.operand;
-            unsigned defaultOffset = currentInstruction[2].u.operand;
-            unsigned scrutinee = currentInstruction[3].u.operand;
-
-            // create jump table for switch destinations, track this switch statement.
-            StringJumpTable* jumpTable = &m_codeBlock->stringSwitchJumpTable(tableIndex);
-            m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset));
-
-            emitPutJITStubArgFromVirtualRegister(scrutinee, 1, regT2);
-            emitPutJITStubArgConstant(tableIndex, 2);
-            emitCTICall(JITStubs::cti_op_switch_string);
-            jump(regT0);
-            NEXT_OPCODE(op_switch_string);
-        }
-        case op_del_by_val: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, regT2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, regT2);
-            emitCTICall(JITStubs::cti_op_del_by_val);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_del_by_val);
-        }
-        case op_put_getter: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, regT2);
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 3, regT2);
-            emitCTICall(JITStubs::cti_op_put_getter);
-            NEXT_OPCODE(op_put_getter);
-        }
-        case op_put_setter: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, regT2);
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 3, regT2);
-            emitCTICall(JITStubs::cti_op_put_setter);
-            NEXT_OPCODE(op_put_setter);
-        }
-        case op_new_error: {
-            JSValuePtr message = m_codeBlock->unexpectedConstant(currentInstruction[3].u.operand);
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 1);
-            emitPutJITStubArgConstant(JSValuePtr::encode(message), 2);
-            emitPutJITStubArgConstant(m_bytecodeIndex, 3);
-            emitCTICall(JITStubs::cti_op_new_error);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_error);
-        }
-        case op_debug: {
-            emitPutJITStubArgConstant(currentInstruction[1].u.operand, 1);
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 2);
-            emitPutJITStubArgConstant(currentInstruction[3].u.operand, 3);
-            emitCTICall(JITStubs::cti_op_debug);
-            NEXT_OPCODE(op_debug);
-        }
-        case op_eq_null: {
-            unsigned dst = currentInstruction[1].u.operand;
-            unsigned src1 = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src1, regT0);
-            Jump isImmediate = emitJumpIfNotJSCell(regT0);
-
-            loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
-            setTest32(NonZero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
-
-            Jump wasNotImmediate = jump();
-
-            isImmediate.link(this);
-
-            andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-            setPtr(Equal, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
-
-            wasNotImmediate.link(this);
-
-            emitTagAsBoolImmediate(regT0);
-            emitPutVirtualRegister(dst);
-
-            NEXT_OPCODE(op_eq_null);
-        }
-        case op_neq_null: {
-            unsigned dst = currentInstruction[1].u.operand;
-            unsigned src1 = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src1, regT0);
-            Jump isImmediate = emitJumpIfNotJSCell(regT0);
-
-            loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
-            setTest32(Zero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
-
-            Jump wasNotImmediate = jump();
-
-            isImmediate.link(this);
-
-            andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-            setPtr(NotEqual, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
-
-            wasNotImmediate.link(this);
-
-            emitTagAsBoolImmediate(regT0);
-            emitPutVirtualRegister(dst);
-
-            NEXT_OPCODE(op_neq_null);
-        }
-        case op_enter: {
-            // Even though CTI doesn't use them, we initialize our constant
-            // registers to zap stale pointers, to avoid unnecessarily prolonging
-            // object lifetime and increasing GC pressure.
-            size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
-            for (size_t j = 0; j < count; ++j)
-                emitInitRegister(j);
-
-            NEXT_OPCODE(op_enter);
-        }
-        case op_enter_with_activation: {
-            // Even though CTI doesn't use them, we initialize our constant
-            // registers to zap stale pointers, to avoid unnecessarily prolonging
-            // object lifetime and increasing GC pressure.
-            size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
-            for (size_t j = 0; j < count; ++j)
-                emitInitRegister(j);
-
-            emitCTICall(JITStubs::cti_op_push_activation);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_enter_with_activation);
-        }
-        case op_create_arguments: {
-            if (m_codeBlock->m_numParameters == 1)
-                emitCTICall(JITStubs::cti_op_create_arguments_no_params);
-            else
-                emitCTICall(JITStubs::cti_op_create_arguments);
-            NEXT_OPCODE(op_create_arguments);
-        }
-        case op_convert_this: {
-            emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
-
-            emitJumpSlowCaseIfNotJSCell(regT0);
-            loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT1);
-            addSlowCase(branchTest32(NonZero, Address(regT1, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
-
-            NEXT_OPCODE(op_convert_this);
-        }
-        case op_profile_will_call: {
-            emitGetCTIParam(STUB_ARGS_profilerReference, regT0);
-            Jump noProfiler = branchTestPtr(Zero, Address(regT0));
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, regT0);
-            emitCTICall(JITStubs::cti_op_profile_will_call);
-            noProfiler.link(this);
-
-            NEXT_OPCODE(op_profile_will_call);
-        }
-        case op_profile_did_call: {
-            emitGetCTIParam(STUB_ARGS_profilerReference, regT0);
-            Jump noProfiler = branchTestPtr(Zero, Address(regT0));
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, regT0);
-            emitCTICall(JITStubs::cti_op_profile_did_call);
-            noProfiler.link(this);
+        DEFINE_OP(op_add)
+        DEFINE_OP(op_bitand)
+        DEFINE_OP(op_bitnot)
+        DEFINE_OP(op_bitor)
+        DEFINE_OP(op_bitxor)
+        DEFINE_OP(op_call)
+        DEFINE_OP(op_call_eval)
+        DEFINE_OP(op_call_varargs)
+        DEFINE_OP(op_catch)
+        DEFINE_OP(op_construct)
+        DEFINE_OP(op_construct_verify)
+        DEFINE_OP(op_convert_this)
+        DEFINE_OP(op_init_arguments)
+        DEFINE_OP(op_create_arguments)
+        DEFINE_OP(op_debug)
+        DEFINE_OP(op_del_by_id)
+        DEFINE_OP(op_end)
+        DEFINE_OP(op_enter)
+        DEFINE_OP(op_enter_with_activation)
+        DEFINE_OP(op_eq)
+        DEFINE_OP(op_eq_null)
+        DEFINE_OP(op_get_by_id)
+        DEFINE_OP(op_get_by_val)
+        DEFINE_OP(op_get_global_var)
+        DEFINE_OP(op_get_scoped_var)
+        DEFINE_OP(op_instanceof)
+        DEFINE_OP(op_jeq_null)
+        DEFINE_OP(op_jfalse)
+        DEFINE_OP(op_jmp)
+        DEFINE_OP(op_jmp_scopes)
+        DEFINE_OP(op_jneq_null)
+        DEFINE_OP(op_jneq_ptr)
+        DEFINE_OP(op_jnless)
+        DEFINE_OP(op_jnlesseq)
+        DEFINE_OP(op_jsr)
+        DEFINE_OP(op_jtrue)
+        DEFINE_OP(op_load_varargs)
+        DEFINE_OP(op_loop)
+        DEFINE_OP(op_loop_if_less)
+        DEFINE_OP(op_loop_if_lesseq)
+        DEFINE_OP(op_loop_if_true)
+        DEFINE_OP(op_lshift)
+        DEFINE_OP(op_method_check)
+        DEFINE_OP(op_mod)
+        DEFINE_OP(op_mov)
+        DEFINE_OP(op_mul)
+        DEFINE_OP(op_neq)
+        DEFINE_OP(op_neq_null)
+        DEFINE_OP(op_new_array)
+        DEFINE_OP(op_new_error)
+        DEFINE_OP(op_new_func)
+        DEFINE_OP(op_new_func_exp)
+        DEFINE_OP(op_new_object)
+        DEFINE_OP(op_new_regexp)
+        DEFINE_OP(op_next_pname)
+        DEFINE_OP(op_not)
+        DEFINE_OP(op_nstricteq)
+        DEFINE_OP(op_pop_scope)
+        DEFINE_OP(op_post_dec)
+        DEFINE_OP(op_post_inc)
+        DEFINE_OP(op_pre_dec)
+        DEFINE_OP(op_pre_inc)
+        DEFINE_OP(op_profile_did_call)
+        DEFINE_OP(op_profile_will_call)
+        DEFINE_OP(op_push_new_scope)
+        DEFINE_OP(op_push_scope)
+        DEFINE_OP(op_put_by_id)
+        DEFINE_OP(op_put_by_index)
+        DEFINE_OP(op_put_by_val)
+        DEFINE_OP(op_put_getter)
+        DEFINE_OP(op_put_global_var)
+        DEFINE_OP(op_put_scoped_var)
+        DEFINE_OP(op_put_setter)
+        DEFINE_OP(op_resolve)
+        DEFINE_OP(op_resolve_base)
+        DEFINE_OP(op_resolve_func)
+        DEFINE_OP(op_resolve_global)
+        DEFINE_OP(op_resolve_skip)
+        DEFINE_OP(op_resolve_with_base)
+        DEFINE_OP(op_ret)
+        DEFINE_OP(op_rshift)
+        DEFINE_OP(op_sret)
+        DEFINE_OP(op_strcat)
+        DEFINE_OP(op_stricteq)
+        DEFINE_OP(op_sub)
+        DEFINE_OP(op_switch_char)
+        DEFINE_OP(op_switch_imm)
+        DEFINE_OP(op_switch_string)
+        DEFINE_OP(op_tear_off_activation)
+        DEFINE_OP(op_tear_off_arguments)
+        DEFINE_OP(op_throw)
+        DEFINE_OP(op_to_jsnumber)
+        DEFINE_OP(op_to_primitive)
+        DEFINE_OP(op_unexpected_load)
 
-            NEXT_OPCODE(op_profile_did_call);
-        }
         case op_get_array_length:
         case op_get_by_id_chain:
         case op_get_by_id_generic:
@@ -1262,11 +289,11 @@
         }
     }
 
-    ASSERT(propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
-    ASSERT(callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
+    ASSERT(m_propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
+    ASSERT(m_callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
 
 #ifndef NDEBUG
-    // reset this, in order to guard it's use with asserts
+    // Reset this, in order to guard its use with ASSERTs.
     m_bytecodeIndex = (unsigned)-1;
 #endif
 }
@@ -1283,8 +310,9 @@
 void JIT::privateCompileSlowCases()
 {
     Instruction* instructionsBegin = m_codeBlock->instructions().begin();
-    unsigned propertyAccessInstructionIndex = 0;
-    unsigned callLinkInfoIndex = 0;
+
+    m_propertyAccessInstructionIndex = 0;
+    m_callLinkInfoIndex = 0;
 
     for (Vector<SlowCaseEntry>::iterator iter = m_slowCases.begin(); iter != m_slowCases.end();) {
         // FIXME: enable peephole optimizations for slow cases when applicable
@@ -1296,310 +324,47 @@
 #endif
         Instruction* currentInstruction = instructionsBegin + m_bytecodeIndex;
 
-        switch (OpcodeID opcodeID = m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
-        case op_convert_this: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArg(regT0, 1);
-            emitCTICall(JITStubs::cti_op_convert_this);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_convert_this);
-        }
-        case op_add: {
-            compileFastArithSlow_op_add(currentInstruction, iter);
-            NEXT_OPCODE(op_add);
-        }
-        case op_construct_verify: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_construct_verify);
-        }
-        case op_get_by_val: {
-            // The slow case that handles accesses to arrays (below) may jump back up to here. 
-            Label beginGetByValSlow(this);
-
-            Jump notImm = getSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitFastArithIntToImmNoCheck(regT1, regT1);
-            notImm.link(this);
-            emitPutJITStubArg(regT0, 1);
-            emitPutJITStubArg(regT1, 2);
-            emitCTICall(JITStubs::cti_op_get_by_val);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-            // This is slow case that handles accesses to arrays above the fast cut-off.
-            // First, check if this is an access to the vector
-            linkSlowCase(iter);
-            branch32(AboveOrEqual, regT1, Address(regT2, FIELD_OFFSET(ArrayStorage, m_vectorLength)), beginGetByValSlow);
-
-            // okay, missed the fast region, but it is still in the vector.  Get the value.
-            loadPtr(BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])), regT2);
-            // Check whether the value loaded is zero; if so we need to return undefined.
-            branchTestPtr(Zero, regT2, beginGetByValSlow);
-            move(regT2, regT0);
-            emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
-
-            NEXT_OPCODE(op_get_by_val);
-        }
-        case op_sub: {
-            compileFastArithSlow_op_sub(currentInstruction, iter);
-            NEXT_OPCODE(op_sub);
-        }
-        case op_rshift: {
-            compileFastArithSlow_op_rshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_rshift);
-        }
-        case op_lshift: {
-            compileFastArithSlow_op_lshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_lshift);
-        }
-        case op_loop_if_less: {
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                linkSlowCase(iter);
-                emitPutJITStubArg(regT0, 1);
-                emitPutJITStubArgFromVirtualRegister(op2, 2, regT2);
-                emitCTICall(JITStubs::cti_op_loop_if_less);
-                emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
-            } else {
-                linkSlowCase(iter);
-                linkSlowCase(iter);
-                emitPutJITStubArg(regT0, 1);
-                emitPutJITStubArg(regT1, 2);
-                emitCTICall(JITStubs::cti_op_loop_if_less);
-                emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_less);
-        }
-        case op_put_by_id: {
-            compilePutByIdSlowCase(currentInstruction[1].u.operand, &(m_codeBlock->identifier(currentInstruction[2].u.operand)), currentInstruction[3].u.operand, iter, propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_put_by_id);
-        }
-        case op_get_by_id: {
-            compileGetByIdSlowCase(currentInstruction[1].u.operand, currentInstruction[2].u.operand, &(m_codeBlock->identifier(currentInstruction[3].u.operand)), iter, propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_get_by_id);
-        }
-        case op_loop_if_lesseq: {
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                linkSlowCase(iter);
-                emitPutJITStubArg(regT0, 1);
-                emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 2, regT2);
-                emitCTICall(JITStubs::cti_op_loop_if_lesseq);
-                emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
-            } else {
-                linkSlowCase(iter);
-                linkSlowCase(iter);
-                emitPutJITStubArg(regT0, 1);
-                emitPutJITStubArg(regT1, 2);
-                emitCTICall(JITStubs::cti_op_loop_if_lesseq);
-                emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_lesseq);
-        }
-        case op_pre_inc: {
-            compileFastArithSlow_op_pre_inc(currentInstruction[1].u.operand, iter);
-            NEXT_OPCODE(op_pre_inc);
-        }
-        case op_put_by_val: {
-            // Normal slow cases - either is not an immediate imm, or is an array.
-            Jump notImm = getSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitFastArithIntToImmNoCheck(regT1, regT1);
-            notImm.link(this);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, regT2);
-            emitPutJITStubArg(regT0, 1);
-            emitPutJITStubArg(regT1, 2);
-            emitPutJITStubArg(regT2, 3);
-            emitCTICall(JITStubs::cti_op_put_by_val);
-            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_put_by_val));
-
-            // slow cases for immediate int accesses to arrays
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, regT2);
-            emitPutJITStubArg(regT0, 1);
-            emitPutJITStubArg(regT1, 2);
-            emitPutJITStubArg(regT2, 3);
-            emitCTICall(JITStubs::cti_op_put_by_val_array);
-
-            NEXT_OPCODE(op_put_by_val);
-        }
-        case op_loop_if_true: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(regT0, 1);
-            emitCTICall(JITStubs::cti_op_jtrue);
-            unsigned target = currentInstruction[2].u.operand;
-            emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 2);
-            NEXT_OPCODE(op_loop_if_true);
-        }
-        case op_pre_dec: {
-            compileFastArithSlow_op_pre_dec(currentInstruction[1].u.operand, iter);
-            NEXT_OPCODE(op_pre_dec);
-        }
-        case op_jnless: {
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                linkSlowCase(iter);
-                emitPutJITStubArg(regT0, 1);
-                emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 2, regT2);
-                emitCTICall(JITStubs::cti_op_jless);
-                emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
-            } else {
-                linkSlowCase(iter);
-                linkSlowCase(iter);
-                emitPutJITStubArg(regT0, 1);
-                emitPutJITStubArg(regT1, 2);
-                emitCTICall(JITStubs::cti_op_jless);
-                emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
-            }
-            NEXT_OPCODE(op_jnless);
-        }
-        case op_not: {
-            linkSlowCase(iter);
-            xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
-            emitPutJITStubArg(regT0, 1);
-            emitCTICall(JITStubs::cti_op_not);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_not);
-        }
-        case op_jfalse: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(regT0, 1);
-            emitCTICall(JITStubs::cti_op_jtrue);
-            unsigned target = currentInstruction[2].u.operand;
-            emitJumpSlowToHot(branchTest32(Zero, regT0), target + 2); // inverted!
-            NEXT_OPCODE(op_jfalse);
-        }
-        case op_post_inc: {
-            compileFastArithSlow_op_post_inc(currentInstruction[1].u.operand, currentInstruction[2].u.operand, iter);
-            NEXT_OPCODE(op_post_inc);
-        }
-        case op_bitnot: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(regT0, 1);
-            emitCTICall(JITStubs::cti_op_bitnot);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitnot);
-        }
-        case op_bitand: {
-            compileFastArithSlow_op_bitand(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_bitand);
-        }
-        case op_jtrue: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(regT0, 1);
-            emitCTICall(JITStubs::cti_op_jtrue);
-            unsigned target = currentInstruction[2].u.operand;
-            emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 2);
-            NEXT_OPCODE(op_jtrue);
-        }
-        case op_post_dec: {
-            compileFastArithSlow_op_post_dec(currentInstruction[1].u.operand, currentInstruction[2].u.operand, iter);
-            NEXT_OPCODE(op_post_dec);
-        }
-        case op_bitxor: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(regT0, 1);
-            emitPutJITStubArg(regT1, 2);
-            emitCTICall(JITStubs::cti_op_bitxor);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitxor);
-        }
-        case op_bitor: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(regT0, 1);
-            emitPutJITStubArg(regT1, 2);
-            emitCTICall(JITStubs::cti_op_bitor);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitor);
-        }
-        case op_eq: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(regT0, 1);
-            emitPutJITStubArg(regT1, 2);
-            emitCTICall(JITStubs::cti_op_eq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_eq);
-        }
-        case op_neq: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(regT0, 1);
-            emitPutJITStubArg(regT1, 2);
-            emitCTICall(JITStubs::cti_op_neq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_neq);
-        }
-        case op_stricteq: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArg(regT0, 1);
-            emitPutJITStubArg(regT1, 2);
-            emitCTICall(JITStubs::cti_op_stricteq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_stricteq);
-        }
-        case op_nstricteq: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArg(regT0, 1);
-            emitPutJITStubArg(regT1, 2);
-            emitCTICall(JITStubs::cti_op_nstricteq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_nstricteq);
-        }
-        case op_instanceof: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, regT2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, regT2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[4].u.operand, 3, regT2);
-            emitCTICall(JITStubs::cti_op_instanceof);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_instanceof);
-        }
-        case op_mod: {
-            compileFastArithSlow_op_mod(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_mod);
-        }
-        case op_mul: {
-            compileFastArithSlow_op_mul(currentInstruction, iter);
-            NEXT_OPCODE(op_mul);
-        }
-
-        case op_call: {
-            compileOpCallSlowCase(currentInstruction, iter, callLinkInfoIndex++, opcodeID);
-            NEXT_OPCODE(op_call);
-        }
-        case op_call_eval: {
-            compileOpCallSlowCase(currentInstruction, iter, callLinkInfoIndex++, opcodeID);
-            NEXT_OPCODE(op_call_eval);
-        }
-        case op_construct: {
-            compileOpCallSlowCase(currentInstruction, iter, callLinkInfoIndex++, opcodeID);
-            NEXT_OPCODE(op_construct);
-        }
-        case op_to_jsnumber: {
-            linkSlowCaseIfNotJSCell(iter, currentInstruction[2].u.operand);
-            linkSlowCase(iter);
-
-            emitPutJITStubArg(regT0, 1);
-            emitCTICall(JITStubs::cti_op_to_jsnumber);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_to_jsnumber);
-        }
-
+        switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
+        DEFINE_SLOWCASE_OP(op_add)
+        DEFINE_SLOWCASE_OP(op_bitand)
+        DEFINE_SLOWCASE_OP(op_bitnot)
+        DEFINE_SLOWCASE_OP(op_bitor)
+        DEFINE_SLOWCASE_OP(op_bitxor)
+        DEFINE_SLOWCASE_OP(op_call)
+        DEFINE_SLOWCASE_OP(op_call_eval)
+        DEFINE_SLOWCASE_OP(op_call_varargs)
+        DEFINE_SLOWCASE_OP(op_construct)
+        DEFINE_SLOWCASE_OP(op_construct_verify)
+        DEFINE_SLOWCASE_OP(op_convert_this)
+        DEFINE_SLOWCASE_OP(op_eq)
+        DEFINE_SLOWCASE_OP(op_get_by_id)
+        DEFINE_SLOWCASE_OP(op_get_by_val)
+        DEFINE_SLOWCASE_OP(op_instanceof)
+        DEFINE_SLOWCASE_OP(op_jfalse)
+        DEFINE_SLOWCASE_OP(op_jnless)
+        DEFINE_SLOWCASE_OP(op_jnlesseq)
+        DEFINE_SLOWCASE_OP(op_jtrue)
+        DEFINE_SLOWCASE_OP(op_loop_if_less)
+        DEFINE_SLOWCASE_OP(op_loop_if_lesseq)
+        DEFINE_SLOWCASE_OP(op_loop_if_true)
+        DEFINE_SLOWCASE_OP(op_lshift)
+        DEFINE_SLOWCASE_OP(op_mod)
+        DEFINE_SLOWCASE_OP(op_mul)
+        DEFINE_SLOWCASE_OP(op_method_check)
+        DEFINE_SLOWCASE_OP(op_neq)
+        DEFINE_SLOWCASE_OP(op_not)
+        DEFINE_SLOWCASE_OP(op_nstricteq)
+        DEFINE_SLOWCASE_OP(op_post_dec)
+        DEFINE_SLOWCASE_OP(op_post_inc)
+        DEFINE_SLOWCASE_OP(op_pre_dec)
+        DEFINE_SLOWCASE_OP(op_pre_inc)
+        DEFINE_SLOWCASE_OP(op_put_by_id)
+        DEFINE_SLOWCASE_OP(op_put_by_val)
+        DEFINE_SLOWCASE_OP(op_rshift)
+        DEFINE_SLOWCASE_OP(op_stricteq)
+        DEFINE_SLOWCASE_OP(op_sub)
+        DEFINE_SLOWCASE_OP(op_to_jsnumber)
+        DEFINE_SLOWCASE_OP(op_to_primitive)
         default:
             ASSERT_NOT_REACHED();
         }
@@ -1611,12 +376,12 @@
     }
 
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    ASSERT(propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
+    ASSERT(m_propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
 #endif
-    ASSERT(callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
+    ASSERT(m_callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
 
 #ifndef NDEBUG
-    // reset this, in order to guard it's use with asserts
+    // Reset this, in order to guard its use with ASSERTs.
     m_bytecodeIndex = (unsigned)-1;
 #endif
 }
@@ -1629,7 +394,7 @@
 #endif
 
     // Could use a pop_m, but would need to offset the following instruction if so.
-    pop(regT2);
+    preverveReturnAddressAfterCall(regT2);
     emitPutToCallFrameHeader(regT2, RegisterFile::ReturnPC);
 
     Jump slowRegisterFileCheck;
@@ -1638,10 +403,10 @@
         // In the case of a fast linked call, we do not set this up in the caller.
         emitPutImmediateToCallFrameHeader(m_codeBlock, RegisterFile::CodeBlock);
 
-        emitGetCTIParam(STUB_ARGS_registerFile, regT0);
+        peek(regT0, FIELD_OFFSET(JITStackFrame, registerFile) / sizeof (void*));
         addPtr(Imm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, regT1);
-        
-        slowRegisterFileCheck = branch32(GreaterThan, regT1, Address(regT0, FIELD_OFFSET(RegisterFile, m_end)));
+
+        slowRegisterFileCheck = branchPtr(Above, regT1, Address(regT0, FIELD_OFFSET(RegisterFile, m_end)));
         afterRegisterFileCheck = label();
     }
 
@@ -1651,25 +416,17 @@
 
     if (m_codeBlock->codeType() == FunctionCode) {
         slowRegisterFileCheck.link(this);
-        m_bytecodeIndex = 0; // emitCTICall will add to the map, but doesn't actually need this...
-        emitCTICall(JITStubs::cti_register_file_check);
+        m_bytecodeIndex = 0;
+        JITStubCall(this, JITStubs::cti_register_file_check).call();
 #ifndef NDEBUG
-        // reset this, in order to guard it's use with asserts
-        m_bytecodeIndex = (unsigned)-1;
+        m_bytecodeIndex = (unsigned)-1; // Reset this, in order to guard its use with ASSERTs.
 #endif
         jump(afterRegisterFileCheck);
     }
 
     ASSERT(m_jmpTable.isEmpty());
 
-    RefPtr<ExecutablePool> allocator = m_globalData->executableAllocator.poolForSize(m_assembler.size());
-    void* code = m_assembler.executableCopy(allocator.get());
-    JITCodeRef codeRef(code, allocator);
-#ifndef NDEBUG
-    codeRef.codeSize = m_assembler.size();
-#endif
-
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()));
 
     // Translate vPC offsets into addresses in JIT generated code, for switch tables.
     for (unsigned i = 0; i < m_switches.size(); ++i) {
@@ -1706,7 +463,7 @@
 
     for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
         if (iter->to)
-            patchBuffer.link(iter->from, iter->to);
+            patchBuffer.link(iter->from, FunctionPtr(iter->to));
     }
 
     if (m_codeBlock->hasExceptionInfo()) {
@@ -1735,11 +492,18 @@
         info.coldPathOther = patchBuffer.locationOf(m_callStructureStubCompilationInfo[i].coldPathOther);
     }
 #endif
+    unsigned methodCallCount = m_methodCallCompilationInfo.size();
+    m_codeBlock->addMethodCallLinkInfos(methodCallCount);
+    for (unsigned i = 0; i < methodCallCount; ++i) {
+        MethodCallLinkInfo& info = m_codeBlock->methodCallLinkInfo(i);
+        info.structureLabel = patchBuffer.locationOf(m_methodCallCompilationInfo[i].structureToCompare);
+        info.callReturnLocation = m_codeBlock->structureStubInfo(m_methodCallCompilationInfo[i].propertyAccessIndex).callReturnLocation;
+    }
 
-    m_codeBlock->setJITCode(codeRef);
+    m_codeBlock->setJITCode(patchBuffer.finalizeCode());
 }
 
-void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, void** ctiArrayLengthTrampoline, void** ctiStringLengthTrampoline, void** ctiVirtualCallPreLink, void** ctiVirtualCallLink, void** ctiVirtualCall)
+void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
 {
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     // (1) The first function provides fast property access for array length
@@ -1779,29 +543,28 @@
     ret();
 #endif
 
-#if !(PLATFORM(X86) || PLATFORM(X86_64))
-#error "This code is less portable than it looks this code assumes that regT3 is callee preserved, which happens to be true on x86/x86-64."
-#endif
-
     // (3) Trampolines for the slow cases of op_call / op_call_eval / op_construct.
     
     Label virtualCallPreLinkBegin = align();
 
     // Load the callee CodeBlock* into eax
-    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT0);
-    loadPtr(Address(regT0, FIELD_OFFSET(FunctionBodyNode, m_code)), regT0);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT3);
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_code)), regT0);
     Jump hasCodeBlock1 = branchTestPtr(NonZero, regT0);
-    pop(regT3);
+    // If m_code is null and m_jitCode is not, then we have a native function, so arity is irrelevant
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_jitCode)), regT0);
+    Jump isNativeFunc1 = branchTestPtr(NonZero, regT0);
+    preverveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callJSFunction1 = call();
     emitGetJITStubArg(1, regT2);
     emitGetJITStubArg(3, regT1);
-    push(regT3);
+    restoreReturnAddressBeforeReturn(regT3);
     hasCodeBlock1.link(this);
 
     // Check argCount matches callee arity.
     Jump arityCheckOkay1 = branch32(Equal, Address(regT0, FIELD_OFFSET(CodeBlock, m_numParameters)), regT1);
-    pop(regT3);
+    preverveReturnAddressAfterCall(regT3);
     emitPutJITStubArg(regT3, 2);
     emitPutJITStubArg(regT0, 4);
     restoreArgumentReference();
@@ -1809,36 +572,41 @@
     move(regT1, callFrameRegister);
     emitGetJITStubArg(1, regT2);
     emitGetJITStubArg(3, regT1);
-    push(regT3);
+    restoreReturnAddressBeforeReturn(regT3);
     arityCheckOkay1.link(this);
+    isNativeFunc1.link(this);
     
     compileOpCallInitializeCallFrame();
 
-    pop(regT3);
+    preverveReturnAddressAfterCall(regT3);
     emitPutJITStubArg(regT3, 2);
     restoreArgumentReference();
     Call callDontLazyLinkCall = call();
-    push(regT3);
+    emitGetJITStubArg(1, regT2);
+    restoreReturnAddressBeforeReturn(regT3);
 
     jump(regT0);
 
     Label virtualCallLinkBegin = align();
 
     // Load the callee CodeBlock* into eax
-    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT0);
-    loadPtr(Address(regT0, FIELD_OFFSET(FunctionBodyNode, m_code)), regT0);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT3);
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_code)), regT0);
     Jump hasCodeBlock2 = branchTestPtr(NonZero, regT0);
-    pop(regT3);
+    // If m_code is null and m_jitCode is not, then we have a native function, so arity is irrelevant
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_jitCode)), regT0);
+    Jump isNativeFunc2 = branchTestPtr(NonZero, regT0);
+    preverveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callJSFunction2 = call();
     emitGetJITStubArg(1, regT2);
     emitGetJITStubArg(3, regT1);
-    push(regT3);
+    restoreReturnAddressBeforeReturn(regT3);
     hasCodeBlock2.link(this);
 
     // Check argCount matches callee arity.
     Jump arityCheckOkay2 = branch32(Equal, Address(regT0, FIELD_OFFSET(CodeBlock, m_numParameters)), regT1);
-    pop(regT3);
+    preverveReturnAddressAfterCall(regT3);
     emitPutJITStubArg(regT3, 2);
     emitPutJITStubArg(regT0, 4);
     restoreArgumentReference();
@@ -1846,36 +614,41 @@
     move(regT1, callFrameRegister);
     emitGetJITStubArg(1, regT2);
     emitGetJITStubArg(3, regT1);
-    push(regT3);
+    restoreReturnAddressBeforeReturn(regT3);
     arityCheckOkay2.link(this);
+    isNativeFunc2.link(this);
 
     compileOpCallInitializeCallFrame();
 
-    pop(regT3);
+    preverveReturnAddressAfterCall(regT3);
     emitPutJITStubArg(regT3, 2);
     restoreArgumentReference();
     Call callLazyLinkCall = call();
-    push(regT3);
+    restoreReturnAddressBeforeReturn(regT3);
 
     jump(regT0);
 
     Label virtualCallBegin = align();
 
     // Load the callee CodeBlock* into eax
-    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT0);
-    loadPtr(Address(regT0, FIELD_OFFSET(FunctionBodyNode, m_code)), regT0);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT3);
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_code)), regT0);
     Jump hasCodeBlock3 = branchTestPtr(NonZero, regT0);
-    pop(regT3);
+    // If m_code is null and m_jitCode is not, then we have a native function, so arity is irrelevant
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_jitCode)), regT0);
+    Jump isNativeFunc3 = branchTestPtr(NonZero, regT0);
+    preverveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callJSFunction3 = call();
     emitGetJITStubArg(1, regT2);
     emitGetJITStubArg(3, regT1);
-    push(regT3);
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT3); // reload the function body nody, so we can reload the code pointer.
     hasCodeBlock3.link(this);
 
     // Check argCount matches callee arity.
     Jump arityCheckOkay3 = branch32(Equal, Address(regT0, FIELD_OFFSET(CodeBlock, m_numParameters)), regT1);
-    pop(regT3);
+    preverveReturnAddressAfterCall(regT3);
     emitPutJITStubArg(regT3, 2);
     emitPutJITStubArg(regT0, 4);
     restoreArgumentReference();
@@ -1883,16 +656,189 @@
     move(regT1, callFrameRegister);
     emitGetJITStubArg(1, regT2);
     emitGetJITStubArg(3, regT1);
-    push(regT3);
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_body)), regT3); // reload the function body nody, so we can reload the code pointer.
     arityCheckOkay3.link(this);
+    // load ctiCode from the new codeBlock.
+    loadPtr(Address(regT3, FIELD_OFFSET(FunctionBodyNode, m_jitCode)), regT0);
+    isNativeFunc3.link(this);
 
     compileOpCallInitializeCallFrame();
-
-    // load ctiCode from the new codeBlock.
-    loadPtr(Address(regT0, FIELD_OFFSET(CodeBlock, m_jitCode)), regT0);
-
     jump(regT0);
 
+    
+    Label nativeCallThunk = align();
+    preverveReturnAddressAfterCall(regT0);
+    emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address
+
+    // Load caller frame's scope chain into this callframe so that whatever we call can
+    // get to its global data.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT1);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT1);
+    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    
+
+#if PLATFORM(X86_64)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, X86::ecx);
+
+    // Allocate stack space for our arglist
+    subPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+    COMPILE_ASSERT((sizeof(ArgList) & 0xf) == 0, ArgList_should_by_16byte_aligned);
+    
+    // Set up arguments
+    subPtr(Imm32(1), X86::ecx); // Don't include 'this' in argcount
+
+    // Push argcount
+    storePtr(X86::ecx, Address(stackPointerRegister, FIELD_OFFSET(ArgList, m_argCount)));
+
+    // Calculate the start of the callframe header, and store in edx
+    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), callFrameRegister, X86::edx);
+    
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (ecx)
+    mul32(Imm32(sizeof(Register)), X86::ecx, X86::ecx);
+    subPtr(X86::ecx, X86::edx);
+
+    // push pointer to arguments
+    storePtr(X86::edx, Address(stackPointerRegister, FIELD_OFFSET(ArgList, m_args)));
+    
+    // ArgList is passed by reference so is stackPointerRegister
+    move(stackPointerRegister, X86::ecx);
+    
+    // edx currently points to the first argument, edx-sizeof(Register) points to 'this'
+    loadPtr(Address(X86::edx, -(int32_t)sizeof(Register)), X86::edx);
+    
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::esi);
+
+    move(callFrameRegister, X86::edi); 
+
+    call(Address(X86::esi, FIELD_OFFSET(JSFunction, m_data)));
+    
+    addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+#elif PLATFORM(X86)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
+
+    /* We have two structs that we use to describe the stackframe we set up for our
+     * call to native code.  NativeCallFrameStructure describes the how we set up the stack
+     * in advance of the call.  NativeFunctionCalleeSignature describes the callframe
+     * as the native code expects it.  We do this as we are using the fastcall calling
+     * convention which results in the callee popping its arguments off the stack, but
+     * not the rest of the callframe so we need a nice way to ensure we increment the
+     * stack pointer by the right amount after the call.
+     */
+#if COMPILER(MSVC) || PLATFORM(LINUX)
+    struct NativeCallFrameStructure {
+      //  CallFrame* callFrame; // passed in EDX
+        JSObject* callee;
+        JSValue thisValue;
+        ArgList* argPointer;
+        ArgList args;
+        JSValue result;
+    };
+    struct NativeFunctionCalleeSignature {
+        JSObject* callee;
+        JSValue thisValue;
+        ArgList* argPointer;
+    };
+#else
+    struct NativeCallFrameStructure {
+      //  CallFrame* callFrame; // passed in ECX
+      //  JSObject* callee; // passed in EDX
+        JSValue thisValue;
+        ArgList* argPointer;
+        ArgList args;
+    };
+    struct NativeFunctionCalleeSignature {
+        JSValue thisValue;
+        ArgList* argPointer;
+    };
+#endif
+    const int NativeCallFrameSize = (sizeof(NativeCallFrameStructure) + 15) & ~15;
+    // Allocate system stack frame
+    subPtr(Imm32(NativeCallFrameSize), stackPointerRegister);
+
+    // Set up arguments
+    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount
+
+    // push argcount
+    storePtr(regT0, Address(stackPointerRegister, FIELD_OFFSET(NativeCallFrameStructure, args) + FIELD_OFFSET(ArgList, m_argCount)));
+    
+    // Calculate the start of the callframe header, and store in regT1
+    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int)sizeof(Register)), callFrameRegister, regT1);
+    
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT0)
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    subPtr(regT0, regT1);
+    storePtr(regT1, Address(stackPointerRegister, FIELD_OFFSET(NativeCallFrameStructure, args) + FIELD_OFFSET(ArgList, m_args)));
+
+    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+    addPtr(Imm32(FIELD_OFFSET(NativeCallFrameStructure, args)), stackPointerRegister, regT0);
+    storePtr(regT0, Address(stackPointerRegister, FIELD_OFFSET(NativeCallFrameStructure, argPointer)));
+
+    // regT1 currently points to the first argument, regT1 - sizeof(Register) points to 'this'
+    loadPtr(Address(regT1, -(int)sizeof(Register)), regT1);
+    storePtr(regT1, Address(stackPointerRegister, FIELD_OFFSET(NativeCallFrameStructure, thisValue)));
+
+#if COMPILER(MSVC) || PLATFORM(LINUX)
+    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+    addPtr(Imm32(FIELD_OFFSET(NativeCallFrameStructure, result)), stackPointerRegister, X86::ecx);
+
+    // Plant callee
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::eax);
+    storePtr(X86::eax, Address(stackPointerRegister, FIELD_OFFSET(NativeCallFrameStructure, callee)));
+
+    // Plant callframe
+    move(callFrameRegister, X86::edx);
+
+    call(Address(X86::eax, FIELD_OFFSET(JSFunction, m_data)));
+
+    // JSValue is a non-POD type
+    loadPtr(Address(X86::eax), X86::eax);
+#else
+    // Plant callee
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::edx);
+
+    // Plant callframe
+    move(callFrameRegister, X86::ecx);
+    call(Address(X86::edx, FIELD_OFFSET(JSFunction, m_data)));
+#endif
+
+    // We've put a few temporaries on the stack in addition to the actual arguments
+    // so pull them off now
+    addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
+
+#elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
+#error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."
+#else
+    breakpoint();
+#endif
+
+    // Check for an exception
+    loadPtr(&(globalData->exception), regT2);
+    Jump exceptionHandler = branchTestPtr(NonZero, regT2);
+
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+    
+    // Restore our caller's "r".
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+    
+    // Return.
+    restoreReturnAddressBeforeReturn(regT1);
+    ret();
+
+    // Handle an exception
+    exceptionHandler.link(this);
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    storePtr(regT1, regT2);
+    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+    poke(callFrameRegister, offsetof(struct JITStackFrame, callFrame) / sizeof (void*));
+    restoreReturnAddressBeforeReturn(regT2);
+    ret();
+    
+
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     Call array_failureCases1Call = makeTailRecursiveCall(array_failureCases1);
     Call array_failureCases2Call = makeTailRecursiveCall(array_failureCases2);
@@ -1903,36 +849,39 @@
 #endif
 
     // All trampolines constructed! copy the code, link up calls, and set the pointers on the Machine object.
-    *executablePool = m_globalData->executableAllocator.poolForSize(m_assembler.size());
-    void* code = m_assembler.executableCopy((*executablePool).get());
+    PatchBuffer patchBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()));
 
-    PatchBuffer patchBuffer(code);
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    patchBuffer.link(array_failureCases1Call, JITStubs::cti_op_get_by_id_array_fail);
-    patchBuffer.link(array_failureCases2Call, JITStubs::cti_op_get_by_id_array_fail);
-    patchBuffer.link(array_failureCases3Call, JITStubs::cti_op_get_by_id_array_fail);
-    patchBuffer.link(string_failureCases1Call, JITStubs::cti_op_get_by_id_string_fail);
-    patchBuffer.link(string_failureCases2Call, JITStubs::cti_op_get_by_id_string_fail);
-    patchBuffer.link(string_failureCases3Call, JITStubs::cti_op_get_by_id_string_fail);
+    patchBuffer.link(array_failureCases1Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
+    patchBuffer.link(array_failureCases2Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
+    patchBuffer.link(array_failureCases3Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
+    patchBuffer.link(string_failureCases1Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
+    patchBuffer.link(string_failureCases2Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
+    patchBuffer.link(string_failureCases3Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
+#endif
+    patchBuffer.link(callArityCheck1, FunctionPtr(JITStubs::cti_op_call_arityCheck));
+    patchBuffer.link(callArityCheck2, FunctionPtr(JITStubs::cti_op_call_arityCheck));
+    patchBuffer.link(callArityCheck3, FunctionPtr(JITStubs::cti_op_call_arityCheck));
+    patchBuffer.link(callJSFunction1, FunctionPtr(JITStubs::cti_op_call_JSFunction));
+    patchBuffer.link(callJSFunction2, FunctionPtr(JITStubs::cti_op_call_JSFunction));
+    patchBuffer.link(callJSFunction3, FunctionPtr(JITStubs::cti_op_call_JSFunction));
+    patchBuffer.link(callDontLazyLinkCall, FunctionPtr(JITStubs::cti_vm_dontLazyLinkCall));
+    patchBuffer.link(callLazyLinkCall, FunctionPtr(JITStubs::cti_vm_lazyLinkCall));
 
-    *ctiArrayLengthTrampoline = patchBuffer.trampolineAt(arrayLengthBegin);
-    *ctiStringLengthTrampoline = patchBuffer.trampolineAt(stringLengthBegin);
+    CodeRef finalCode = patchBuffer.finalizeCode();
+    *executablePool = finalCode.m_executablePool;
+
+    *ctiVirtualCallPreLink = trampolineAt(finalCode, virtualCallPreLinkBegin);
+    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
+    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
+    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    *ctiArrayLengthTrampoline = trampolineAt(finalCode, arrayLengthBegin);
+    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
 #else
     UNUSED_PARAM(ctiArrayLengthTrampoline);
     UNUSED_PARAM(ctiStringLengthTrampoline);
 #endif
-    patchBuffer.link(callArityCheck1, JITStubs::cti_op_call_arityCheck);
-    patchBuffer.link(callArityCheck2, JITStubs::cti_op_call_arityCheck);
-    patchBuffer.link(callArityCheck3, JITStubs::cti_op_call_arityCheck);
-    patchBuffer.link(callJSFunction1, JITStubs::cti_op_call_JSFunction);
-    patchBuffer.link(callJSFunction2, JITStubs::cti_op_call_JSFunction);
-    patchBuffer.link(callJSFunction3, JITStubs::cti_op_call_JSFunction);
-    patchBuffer.link(callDontLazyLinkCall, JITStubs::cti_vm_dontLazyLinkCall);
-    patchBuffer.link(callLazyLinkCall, JITStubs::cti_vm_lazyLinkCall);
-
-    *ctiVirtualCallPreLink = patchBuffer.trampolineAt(virtualCallPreLinkBegin);
-    *ctiVirtualCallLink = patchBuffer.trampolineAt(virtualCallLinkBegin);
-    *ctiVirtualCall = patchBuffer.trampolineAt(virtualCallBegin);
 }
 
 void JIT::emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst)
@@ -1949,6 +898,41 @@
     storePtr(src, Address(variableObject, index * sizeof(Register)));
 }
 
+void JIT::unlinkCall(CallLinkInfo* callLinkInfo)
+{
+    // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
+    // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
+    // match).  Reset the check so it no longer matches.
+    callLinkInfo->hotPathBegin.repatch(JSValue::encode(JSValue()));
+}
+
+void JIT::linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, JITCode& code, CallLinkInfo* callLinkInfo, int callerArgCount)
+{
+    // Currently we only link calls with the exact number of arguments.
+    // If this is a native call calleeCodeBlock is null so the number of parameters is unimportant
+    if (!calleeCodeBlock || callerArgCount == calleeCodeBlock->m_numParameters) {
+        ASSERT(!callLinkInfo->isLinked());
+    
+        if (calleeCodeBlock)
+            calleeCodeBlock->addCaller(callLinkInfo);
+    
+        callLinkInfo->hotPathBegin.repatch(callee);
+        callLinkInfo->hotPathOther.relink(code.addressForCall());
+    }
+
+    // patch the instruction that jumps out to the cold path, so that we only try to link once.
+    callLinkInfo->hotPathBegin.jumpAtOffset(patchOffsetOpCallCompareToJump).relink(callLinkInfo->coldPathOther);
+}
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
+
+// This probably does not belong here; adding here for now as a quick Windows build fix.
+#if ENABLE(ASSEMBLER)
+
+#if PLATFORM(X86) && !PLATFORM(MAC)
+JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse2CheckState = NotCheckedSSE2;
+#endif
+
+#endif
diff --git a/JavaScriptCore/jit/JIT.h b/JavaScriptCore/jit/JIT.h
index 25c7825..81f804a 100644
--- a/JavaScriptCore/jit/JIT.h
+++ b/JavaScriptCore/jit/JIT.h
@@ -30,8 +30,15 @@
 
 #if ENABLE(JIT)
 
-#define WTF_USE_CTI_REPATCH_PIC 1
+// We've run into some problems where changing the size of the class JIT leads to
+// performance fluctuations.  Try forcing alignment in an attempt to stabalize this.
+#if COMPILER(GCC)
+#define JIT_CLASS_ALIGNMENT __attribute__ ((aligned (32)))
+#else
+#define JIT_CLASS_ALIGNMENT
+#endif
 
+#include "CodeBlock.h"
 #include "Interpreter.h"
 #include "JITCode.h"
 #include "JITStubs.h"
@@ -43,54 +50,10 @@
 #include <wtf/AlwaysInline.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(X86_64)
-#define STUB_ARGS_offset 0x10
-#else
-#define STUB_ARGS_offset 0x0C
-#endif
-
-#define STUB_ARGS_code (STUB_ARGS_offset)
-#define STUB_ARGS_registerFile (STUB_ARGS_offset + 1)
-#define STUB_ARGS_callFrame (STUB_ARGS_offset + 2)
-#define STUB_ARGS_exception (STUB_ARGS_offset + 3)
-#define STUB_ARGS_profilerReference (STUB_ARGS_offset + 4)
-#define STUB_ARGS_globalData (STUB_ARGS_offset + 5)
-
-#define ARG_callFrame static_cast<CallFrame*>(ARGS[STUB_ARGS_callFrame])
-#define ARG_registerFile static_cast<RegisterFile*>(ARGS[STUB_ARGS_registerFile])
-#define ARG_exception static_cast<JSValuePtr*>(ARGS[STUB_ARGS_exception])
-#define ARG_profilerReference static_cast<Profiler**>(ARGS[STUB_ARGS_profilerReference])
-#define ARG_globalData static_cast<JSGlobalData*>(ARGS[STUB_ARGS_globalData])
-
-#define ARG_setCallFrame(newCallFrame) (ARGS[STUB_ARGS_callFrame] = (newCallFrame))
-
-#define ARG_src1 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[1]))
-#define ARG_src2 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[2]))
-#define ARG_src3 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[3]))
-#define ARG_src4 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[4]))
-#define ARG_src5 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[5]))
-#define ARG_id1 static_cast<Identifier*>(ARGS[1])
-#define ARG_id2 static_cast<Identifier*>(ARGS[2])
-#define ARG_id3 static_cast<Identifier*>(ARGS[3])
-#define ARG_id4 static_cast<Identifier*>(ARGS[4])
-#define ARG_int1 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[1]))
-#define ARG_int2 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[2]))
-#define ARG_int3 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[3]))
-#define ARG_int4 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[4]))
-#define ARG_int5 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[5]))
-#define ARG_int6 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[6]))
-#define ARG_func1 static_cast<FuncDeclNode*>(ARGS[1])
-#define ARG_funcexp1 static_cast<FuncExprNode*>(ARGS[1])
-#define ARG_regexp1 static_cast<RegExp*>(ARGS[1])
-#define ARG_pni1 static_cast<JSPropertyNameIterator*>(ARGS[1])
-#define ARG_returnAddress2 static_cast<void*>(ARGS[2])
-#define ARG_codeBlock4 static_cast<CodeBlock*>(ARGS[4])
-
-#define STUB_RETURN_ADDRESS_SLOT (ARGS[-1])
-
 namespace JSC {
 
     class CodeBlock;
+    class JIT;
     class JSPropertyNameIterator;
     class Interpreter;
     class Register;
@@ -106,14 +69,6 @@
     struct PolymorphicAccessStructureList;
     struct StructureStubInfo;
 
-    typedef JSValueEncodedAsPointer* (JIT_STUB *CTIHelper_j)(STUB_ARGS);
-    typedef JSObject* (JIT_STUB *CTIHelper_o)(STUB_ARGS);
-    typedef JSPropertyNameIterator* (JIT_STUB *CTIHelper_p)(STUB_ARGS);
-    typedef void (JIT_STUB *CTIHelper_v)(STUB_ARGS);
-    typedef void* (JIT_STUB *CTIHelper_s)(STUB_ARGS);
-    typedef int (JIT_STUB *CTIHelper_b)(STUB_ARGS);
-    typedef VoidPtrPair (JIT_STUB *CTIHelper_2)(STUB_ARGS);
-
     struct CallRecord {
         MacroAssembler::Call from;
         unsigned bytecodeIndex;
@@ -201,15 +156,25 @@
         MacroAssembler::Label coldPathOther;
     };
 
-    extern "C" {
-        void ctiVMThrowTrampoline();
+    struct MethodCallCompilationInfo {
+        MethodCallCompilationInfo(unsigned propertyAccessIndex)
+            : propertyAccessIndex(propertyAccessIndex)
+        {
+        }
+
+        MacroAssembler::DataLabelPtr structureToCompare;
+        unsigned propertyAccessIndex;
     };
 
-    void ctiSetReturnAddress(void** addressOfReturnAddress, void* newDestinationToReturnTo);
-    void ctiPatchCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, void* newCalleeFunction);
-    void ctiPatchNearCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, void* newCalleeFunction);
+    // Near calls can only be patched to other JIT code, regular calls can be patched to JIT code or relinked to stub functions.
+    void ctiPatchNearCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, MacroAssemblerCodePtr newCalleeFunction);
+    void ctiPatchCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, MacroAssemblerCodePtr newCalleeFunction);
+    void ctiPatchCallByReturnAddress(MacroAssembler::ProcessorReturnAddress returnAddress, FunctionPtr newCalleeFunction);
 
     class JIT : private MacroAssembler {
+        friend class JITStubCall;
+        friend class CallEvalJITStub;
+
         using MacroAssembler::Jump;
         using MacroAssembler::JumpList;
         using MacroAssembler::Label;
@@ -221,6 +186,8 @@
         // a register is specified) emitPutVirtualRegister() will store
         // the value from regT0.
         //
+        // regT3 is required to be callee-preserved.
+        //
         // tempRegister2 is has no such dependencies.  It is important that
         // on x86/x86-64 it is ecx for performance reasons, since the
         // MacroAssembler will need to plant register swaps if it is not -
@@ -238,8 +205,11 @@
         static const RegisterID regT0 = X86::eax;
         static const RegisterID regT1 = X86::edx;
         static const RegisterID regT2 = X86::ecx;
-        // NOTE: privateCompileCTIMachineTrampolines() relies on this being callee preserved; this should be considered non-interface.
         static const RegisterID regT3 = X86::ebx;
+
+        static const FPRegisterID fpRegT0 = X86::xmm0;
+        static const FPRegisterID fpRegT1 = X86::xmm1;
+        static const FPRegisterID fpRegT2 = X86::xmm2;
 #elif PLATFORM(X86)
         static const RegisterID returnValueRegister = X86::eax;
         static const RegisterID cachedResultRegister = X86::eax;
@@ -253,8 +223,27 @@
         static const RegisterID regT0 = X86::eax;
         static const RegisterID regT1 = X86::edx;
         static const RegisterID regT2 = X86::ecx;
-        // NOTE: privateCompileCTIMachineTrampolines() relies on this being callee preserved; this should be considered non-interface.
         static const RegisterID regT3 = X86::ebx;
+
+        static const FPRegisterID fpRegT0 = X86::xmm0;
+        static const FPRegisterID fpRegT1 = X86::xmm1;
+        static const FPRegisterID fpRegT2 = X86::xmm2;
+#elif PLATFORM(ARM_V7)
+        static const RegisterID returnValueRegister = ARM::r0;
+        static const RegisterID cachedResultRegister = ARM::r0;
+        static const RegisterID firstArgumentRegister = ARM::r0;
+
+        static const RegisterID regT0 = ARM::r0;
+        static const RegisterID regT1 = ARM::r1;
+        static const RegisterID regT2 = ARM::r2;
+        static const RegisterID regT3 = ARM::r4;
+
+        static const RegisterID callFrameRegister = ARM::r5;
+        static const RegisterID timeoutCheckRegister = ARM::r6;
+
+        static const FPRegisterID fpRegT0 = ARM::d0;
+        static const FPRegisterID fpRegT1 = ARM::d1;
+        static const FPRegisterID fpRegT2 = ARM::d2;
 #else
     #error "JIT not supported on this platform."
 #endif
@@ -264,48 +253,79 @@
         // will compress the displacement, and we may not be able to fit a patched offset.
         static const int patchGetByIdDefaultOffset = 256;
 
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-#if PLATFORM(X86_64)
-        static const int ctiArgumentInitSize = 6;
-#else
-        static const int ctiArgumentInitSize = 2;
-#endif
-#elif USE(JIT_STUB_ARGUMENT_STACK)
-        static const int ctiArgumentInitSize = 4;
-#else // JIT_STUB_ARGUMENT_VA_LIST
-        static const int ctiArgumentInitSize = 0;
-#endif
-
 #if PLATFORM(X86_64)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
+        static const int patchOffsetPutByIdExternalLoad = 20;
+        static const int patchLengthPutByIdExternalLoad = 4;
         static const int patchOffsetPutByIdPropertyMapOffset = 31;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 10;
         static const int patchOffsetGetByIdBranchToSlowCase = 20;
+        static const int patchOffsetGetByIdExternalLoad = 20;
+        static const int patchLengthGetByIdExternalLoad = 4;
         static const int patchOffsetGetByIdPropertyMapOffset = 31;
         static const int patchOffsetGetByIdPutResult = 31;
 #if ENABLE(OPCODE_SAMPLING)
-        static const int patchOffsetGetByIdSlowCaseCall = 61 + ctiArgumentInitSize;
+        static const int patchOffsetGetByIdSlowCaseCall = 66;
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 38 + ctiArgumentInitSize;
+        static const int patchOffsetGetByIdSlowCaseCall = 44;
 #endif
         static const int patchOffsetOpCallCompareToJump = 9;
-#else
+
+        static const int patchOffsetMethodCheckProtoObj = 20;
+        static const int patchOffsetMethodCheckProtoStruct = 30;
+        static const int patchOffsetMethodCheckPutFunction = 50;
+#elif PLATFORM(X86)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 7;
+        static const int patchOffsetPutByIdExternalLoad = 13;
+        static const int patchLengthPutByIdExternalLoad = 3;
         static const int patchOffsetPutByIdPropertyMapOffset = 22;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 7;
         static const int patchOffsetGetByIdBranchToSlowCase = 13;
+        static const int patchOffsetGetByIdExternalLoad = 13;
+        static const int patchLengthGetByIdExternalLoad = 3;
         static const int patchOffsetGetByIdPropertyMapOffset = 22;
         static const int patchOffsetGetByIdPutResult = 22;
-#if ENABLE(OPCODE_SAMPLING)
-        static const int patchOffsetGetByIdSlowCaseCall = 31 + ctiArgumentInitSize;
+#if ENABLE(OPCODE_SAMPLING) && USE(JIT_STUB_ARGUMENT_VA_LIST)
+        static const int patchOffsetGetByIdSlowCaseCall = 31;
+#elif ENABLE(OPCODE_SAMPLING)
+        static const int patchOffsetGetByIdSlowCaseCall = 33;
+#elif USE(JIT_STUB_ARGUMENT_VA_LIST)
+        static const int patchOffsetGetByIdSlowCaseCall = 21;
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 21 + ctiArgumentInitSize;
+        static const int patchOffsetGetByIdSlowCaseCall = 23;
 #endif
         static const int patchOffsetOpCallCompareToJump = 6;
+
+        static const int patchOffsetMethodCheckProtoObj = 11;
+        static const int patchOffsetMethodCheckProtoStruct = 18;
+        static const int patchOffsetMethodCheckPutFunction = 29;
+#elif PLATFORM(ARM_V7)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 10;
+        static const int patchOffsetPutByIdExternalLoad = 20;
+        static const int patchLengthPutByIdExternalLoad = 12;
+        static const int patchOffsetPutByIdPropertyMapOffset = 40;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 10;
+        static const int patchOffsetGetByIdBranchToSlowCase = 20;
+        static const int patchOffsetGetByIdExternalLoad = 20;
+        static const int patchLengthGetByIdExternalLoad = 12;
+        static const int patchOffsetGetByIdPropertyMapOffset = 40;
+        static const int patchOffsetGetByIdPutResult = 44;
+#if ENABLE(OPCODE_SAMPLING)
+        static const int patchOffsetGetByIdSlowCaseCall = 0; // FIMXE
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 28;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 10;
+
+        static const int patchOffsetMethodCheckProtoObj = 18;
+        static const int patchOffsetMethodCheckProtoStruct = 28;
+        static const int patchOffsetMethodCheckPutFunction = 46;
 #endif
 
     public:
@@ -315,19 +335,12 @@
             jit.privateCompile();
         }
 
-        static void compileGetByIdSelf(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ProcessorReturnAddress returnAddress)
-        {
-            JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdSelf(stubInfo, structure, cachedOffset, returnAddress);
-        }
-
         static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ProcessorReturnAddress returnAddress)
         {
             JIT jit(globalData, codeBlock);
             jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, cachedOffset, returnAddress, callFrame);
         }
 
-#if USE(CTI_REPATCH_PIC)
         static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
@@ -343,19 +356,12 @@
             JIT jit(globalData, codeBlock);
             jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, cachedOffset, callFrame);
         }
-#endif
 
         static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ProcessorReturnAddress returnAddress)
         {
             JIT jit(globalData, codeBlock);
             jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, cachedOffset, returnAddress, callFrame);
         }
-
-        static void compilePutByIdReplace(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ProcessorReturnAddress returnAddress)
-        {
-            JIT jit(globalData, codeBlock);
-            jit.privateCompilePutByIdReplace(stubInfo, structure, cachedOffset, returnAddress);
-        }
         
         static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ProcessorReturnAddress returnAddress)
         {
@@ -363,15 +369,15 @@
             jit.privateCompilePutByIdTransition(stubInfo, oldStructure, newStructure, cachedOffset, chain, returnAddress);
         }
 
-        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, void** ctiArrayLengthTrampoline, void** ctiStringLengthTrampoline, void** ctiVirtualCallPreLink, void** ctiVirtualCallLink, void** ctiVirtualCall)
-
+        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
         {
             JIT jit(globalData);
-            jit.privateCompileCTIMachineTrampolines(executablePool, ctiArrayLengthTrampoline, ctiStringLengthTrampoline, ctiVirtualCallPreLink, ctiVirtualCallLink, ctiVirtualCall);
+            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, ctiArrayLengthTrampoline, ctiStringLengthTrampoline, ctiVirtualCallPreLink, ctiVirtualCallLink, ctiVirtualCall, ctiNativeCallThunk);
         }
 
         static void patchGetByIdSelf(StructureStubInfo*, Structure*, size_t cachedOffset, ProcessorReturnAddress returnAddress);
         static void patchPutByIdReplace(StructureStubInfo*, Structure*, size_t cachedOffset, ProcessorReturnAddress returnAddress);
+        static void patchMethodCallProto(MethodCallLinkInfo&, JSFunction*, Structure*, JSObject*);
 
         static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ProcessorReturnAddress returnAddress)
         {
@@ -379,69 +385,200 @@
             return jit.privateCompilePatchGetArrayLength(returnAddress);
         }
 
-        static void linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, JITCode ctiCode, CallLinkInfo* callLinkInfo, int callerArgCount);
+        static void linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, JITCode&, CallLinkInfo*, int callerArgCount);
         static void unlinkCall(CallLinkInfo*);
 
     private:
+        struct JSRInfo {
+            DataLabelPtr storeLocation;
+            Label target;
+
+            JSRInfo(DataLabelPtr storeLocation, Label targetLocation)
+                : storeLocation(storeLocation)
+                , target(targetLocation)
+            {
+            }
+        };
+
         JIT(JSGlobalData*, CodeBlock* = 0);
 
         void privateCompileMainPass();
         void privateCompileLinkPass();
         void privateCompileSlowCases();
         void privateCompile();
-        void privateCompileGetByIdSelf(StructureStubInfo*, Structure*, size_t cachedOffset, ProcessorReturnAddress returnAddress);
         void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, size_t cachedOffset, ProcessorReturnAddress returnAddress, CallFrame* callFrame);
-#if USE(CTI_REPATCH_PIC)
         void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, size_t cachedOffset);
         void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame);
         void privateCompileGetByIdChainList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame);
-#endif
         void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, size_t cachedOffset, ProcessorReturnAddress returnAddress, CallFrame* callFrame);
-        void privateCompilePutByIdReplace(StructureStubInfo*, Structure*, size_t cachedOffset, ProcessorReturnAddress returnAddress);
         void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, size_t cachedOffset, StructureChain*, ProcessorReturnAddress returnAddress);
 
-        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, void** ctiArrayLengthTrampoline, void** ctiStringLengthTrampoline, void** ctiVirtualCallPreLink, void** ctiVirtualCallLink, void** ctiVirtualCall);
+        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk);
         void privateCompilePatchGetArrayLength(ProcessorReturnAddress returnAddress);
 
         void addSlowCase(Jump);
         void addJump(Jump, int);
         void emitJumpSlowToHot(Jump, int);
 
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
         void compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier* ident, unsigned propertyAccessInstructionIndex);
-        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex);
-        void compilePutByIdHotPath(int baseVReg, Identifier* ident, int valueVReg, unsigned propertyAccessInstructionIndex);
-        void compilePutByIdSlowCase(int baseVReg, Identifier* ident, int valueVReg, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex);
+        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex, bool isMethodCheck = false);
+#endif
         void compileOpCall(OpcodeID, Instruction* instruction, unsigned callLinkInfoIndex);
+        void compileOpCallVarargs(Instruction* instruction);
         void compileOpCallInitializeCallFrame();
         void compileOpCallSetupArgs(Instruction*);
-        void compileOpCallEvalSetupArgs(Instruction*);
+        void compileOpCallVarargsSetupArgs(Instruction*);
         void compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned callLinkInfoIndex, OpcodeID opcodeID);
+        void compileOpCallVarargsSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter);
         void compileOpConstructSetupArgs(Instruction*);
         enum CompileOpStrictEqType { OpStrictEq, OpNStrictEq };
         void compileOpStrictEq(Instruction* instruction, CompileOpStrictEqType type);
 
-        void compileFastArith_op_add(Instruction*);
-        void compileFastArith_op_sub(Instruction*);
-        void compileFastArith_op_mul(Instruction*);
-        void compileFastArith_op_mod(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_bitand(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_lshift(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_rshift(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_pre_inc(unsigned srcDst);
-        void compileFastArith_op_pre_dec(unsigned srcDst);
-        void compileFastArith_op_post_inc(unsigned result, unsigned srcDst);
-        void compileFastArith_op_post_dec(unsigned result, unsigned srcDst);
-        void compileFastArithSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_mod(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_bitand(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_lshift(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_rshift(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_pre_inc(unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_pre_dec(unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_post_inc(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_post_dec(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
+        void compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset);
+        void compileGetDirectOffset(JSObject* base, RegisterID result, size_t cachedOffset);
+        void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);
+
+        // Arithmetic Ops
+
+        void emit_op_add(Instruction*);
+        void emit_op_sub(Instruction*);
+        void emit_op_mul(Instruction*);
+        void emit_op_mod(Instruction*);
+        void emit_op_bitand(Instruction*);
+        void emit_op_lshift(Instruction*);
+        void emit_op_rshift(Instruction*);
+        void emit_op_jnless(Instruction*);
+        void emit_op_jnlesseq(Instruction*);
+        void emit_op_pre_inc(Instruction*);
+        void emit_op_pre_dec(Instruction*);
+        void emit_op_post_inc(Instruction*);
+        void emit_op_post_dec(Instruction*);
+        void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitand(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_lshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_rshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jnlesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_pre_inc(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_pre_dec(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_post_inc(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_post_dec(Instruction*, Vector<SlowCaseEntry>::iterator&);
+
+        void emit_op_get_by_val(Instruction*);
+        void emit_op_put_by_val(Instruction*);
+        void emit_op_put_by_index(Instruction*);
+        void emit_op_put_getter(Instruction*);
+        void emit_op_put_setter(Instruction*);
+        void emit_op_del_by_id(Instruction*);
+
+        void emit_op_mov(Instruction*);
+        void emit_op_end(Instruction*);
+        void emit_op_jmp(Instruction*);
+        void emit_op_loop(Instruction*);
+        void emit_op_loop_if_less(Instruction*);
+        void emit_op_loop_if_lesseq(Instruction*);
+        void emit_op_new_object(Instruction*);
+        void emit_op_put_by_id(Instruction*);
+        void emit_op_get_by_id(Instruction*);
+        void emit_op_instanceof(Instruction*);
+        void emit_op_new_func(Instruction*);
+        void emit_op_call(Instruction*);
+        void emit_op_call_eval(Instruction*);
+        void emit_op_method_check(Instruction*);
+        void emit_op_load_varargs(Instruction*);
+        void emit_op_call_varargs(Instruction*);
+        void emit_op_construct(Instruction*);
+        void emit_op_get_global_var(Instruction*);
+        void emit_op_put_global_var(Instruction*);
+        void emit_op_get_scoped_var(Instruction*);
+        void emit_op_put_scoped_var(Instruction*);
+        void emit_op_tear_off_activation(Instruction*);
+        void emit_op_tear_off_arguments(Instruction*);
+        void emit_op_ret(Instruction*);
+        void emit_op_new_array(Instruction*);
+        void emit_op_resolve(Instruction*);
+        void emit_op_construct_verify(Instruction*);
+        void emit_op_to_primitive(Instruction*);
+        void emit_op_strcat(Instruction*);
+        void emit_op_resolve_func(Instruction*);
+        void emit_op_loop_if_true(Instruction*);
+        void emit_op_resolve_base(Instruction*);
+        void emit_op_resolve_skip(Instruction*);
+        void emit_op_resolve_global(Instruction*);
+        void emit_op_not(Instruction*);
+        void emit_op_jfalse(Instruction*);
+        void emit_op_jeq_null(Instruction*);
+        void emit_op_jneq_null(Instruction*);
+        void emit_op_jneq_ptr(Instruction*);
+        void emit_op_unexpected_load(Instruction*);
+        void emit_op_jsr(Instruction*);
+        void emit_op_sret(Instruction*);
+        void emit_op_eq(Instruction*);
+        void emit_op_bitnot(Instruction*);
+        void emit_op_resolve_with_base(Instruction*);
+        void emit_op_new_func_exp(Instruction*);
+        void emit_op_jtrue(Instruction*);
+        void emit_op_neq(Instruction*);
+        void emit_op_bitxor(Instruction*);
+        void emit_op_new_regexp(Instruction*);
+        void emit_op_bitor(Instruction*);
+        void emit_op_throw(Instruction*);
+        void emit_op_next_pname(Instruction*);
+        void emit_op_push_scope(Instruction*);
+        void emit_op_pop_scope(Instruction*);
+        void emit_op_stricteq(Instruction*);
+        void emit_op_nstricteq(Instruction*);
+        void emit_op_to_jsnumber(Instruction*);
+        void emit_op_push_new_scope(Instruction*);
+        void emit_op_catch(Instruction*);
+        void emit_op_jmp_scopes(Instruction*);
+        void emit_op_switch_imm(Instruction*);
+        void emit_op_switch_char(Instruction*);
+        void emit_op_switch_string(Instruction*);
+        void emit_op_new_error(Instruction*);
+        void emit_op_debug(Instruction*);
+        void emit_op_eq_null(Instruction*);
+        void emit_op_neq_null(Instruction*);
+        void emit_op_enter(Instruction*);
+        void emit_op_enter_with_activation(Instruction*);
+        void emit_op_init_arguments(Instruction*);
+        void emit_op_create_arguments(Instruction*);
+        void emit_op_convert_this(Instruction*);
+        void emit_op_profile_will_call(Instruction*);
+        void emit_op_profile_did_call(Instruction*);
+
+        void emitSlow_op_convert_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_construct_verify(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_to_primitive(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_less(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_lesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_true(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_not(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jfalse(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitnot(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jtrue(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitxor(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitor(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_eq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_neq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_stricteq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_nstricteq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call_eval(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call_varargs(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_construct(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_to_jsnumber(Instruction*, Vector<SlowCaseEntry>::iterator&);
+
 #if ENABLE(JIT_OPTIMIZE_ARITHMETIC)
         void compileBinaryArithOp(OpcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
         void compileBinaryArithOpSlowCase(OpcodeID, Vector<SlowCaseEntry>::iterator&, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
@@ -459,15 +596,12 @@
 
         void emitInitRegister(unsigned dst);
 
-        void emitPutCTIParam(void* value, unsigned name);
-        void emitPutCTIParam(RegisterID from, unsigned name);
-        void emitGetCTIParam(unsigned name, RegisterID to);
-
         void emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry);
         void emitPutImmediateToCallFrameHeader(void* value, RegisterFile::CallFrameHeaderEntry entry);
-        void emitGetFromCallFrameHeader(RegisterFile::CallFrameHeaderEntry entry, RegisterID to);
+        void emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from = callFrameRegister);
+        void emitGetFromCallFrameHeader32(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from = callFrameRegister);
 
-        JSValuePtr getConstantOperand(unsigned src);
+        JSValue getConstantOperand(unsigned src);
         int32_t getConstantOperandImmediateInt(unsigned src);
         bool isOperandConstantImmediateInt(unsigned src);
 
@@ -524,15 +658,10 @@
         void restoreArgumentReference();
         void restoreArgumentReferenceForTrampoline();
 
-        Call emitNakedCall(void* function);
-        Call emitCTICall_internal(void*);
-        Call emitCTICall(CTIHelper_j helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Call emitCTICall(CTIHelper_o helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Call emitCTICall(CTIHelper_p helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Call emitCTICall(CTIHelper_v helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Call emitCTICall(CTIHelper_s helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Call emitCTICall(CTIHelper_b helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Call emitCTICall(CTIHelper_2 helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
+        Call emitNakedCall(CodePtr function = CodePtr());
+        void preverveReturnAddressAfterCall(RegisterID);
+        void restoreReturnAddressBeforeReturn(RegisterID);
+        void restoreReturnAddressBeforeReturn(Address);
 
         void emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst);
         void emitPutVariableObjectRegister(RegisterID src, RegisterID variableObject, int index);
@@ -544,32 +673,24 @@
 
         void killLastResultRegister();
 
-#if ENABLE(CODEBLOCK_SAMPLING)
-        void sampleCodeBlock(CodeBlock* codeBlock)
-        {
-#if PLATFORM(X86_64)
-            move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86::ecx);
-            storePtr(ImmPtr(codeBlock), X86::ecx);
-#else
-            storePtr(ImmPtr(codeBlock), m_interpreter->sampler()->codeBlockSlot());
+
+#if ENABLE(SAMPLING_FLAGS)
+        void setSamplingFlag(int32_t);
+        void clearSamplingFlag(int32_t);
 #endif
-        }
-#else
-        void sampleCodeBlock(CodeBlock*) {}
+
+#if ENABLE(SAMPLING_COUNTERS)
+        void emitCount(AbstractSamplingCounter&, uint32_t = 1);
 #endif
 
 #if ENABLE(OPCODE_SAMPLING)
-        void sampleInstruction(Instruction* instruction, bool inHostFunction=false)
-        {
-#if PLATFORM(X86_64)
-            move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86::ecx);
-            storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86::ecx);
-#else
-            storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), m_interpreter->sampler()->sampleSlot());
+        void sampleInstruction(Instruction*, bool = false);
 #endif
-        }
+
+#if ENABLE(CODEBLOCK_SAMPLING)
+        void sampleCodeBlock(CodeBlock*);
 #else
-        void sampleInstruction(Instruction*, bool) {}
+        void sampleCodeBlock(CodeBlock*) {}
 #endif
 
         Interpreter* m_interpreter;
@@ -580,19 +701,9 @@
         Vector<Label> m_labels;
         Vector<PropertyStubCompilationInfo> m_propertyAccessCompilationInfo;
         Vector<StructureStubCompilationInfo> m_callStructureStubCompilationInfo;
+        Vector<MethodCallCompilationInfo> m_methodCallCompilationInfo;
         Vector<JumpTable> m_jmpTable;
 
-        struct JSRInfo {
-            DataLabelPtr storeLocation;
-            Label target;
-
-            JSRInfo(DataLabelPtr storeLocation, Label targetLocation)
-                : storeLocation(storeLocation)
-                , target(targetLocation)
-            {
-            }
-        };
-
         unsigned m_bytecodeIndex;
         Vector<JSRInfo> m_jsrSites;
         Vector<SlowCaseEntry> m_slowCases;
@@ -600,7 +711,12 @@
 
         int m_lastResultBytecodeRegister;
         unsigned m_jumpTargetsPosition;
-    };
+
+        unsigned m_propertyAccessInstructionIndex;
+        unsigned m_globalResolveInfoIndex;
+        unsigned m_callLinkInfoIndex;
+    } JIT_CLASS_ALIGNMENT;
+
 }
 
 #endif // ENABLE(JIT)
diff --git a/JavaScriptCore/jit/JITArithmetic.cpp b/JavaScriptCore/jit/JITArithmetic.cpp
index 8fe245e..86c01d9 100644
--- a/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/JavaScriptCore/jit/JITArithmetic.cpp
@@ -30,6 +30,7 @@
 
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -40,14 +41,17 @@
 #include <stdio.h>
 #endif
 
-#define __ m_assembler.
 
 using namespace std;
 
 namespace JSC {
 
-void JIT::compileFastArith_op_lshift(unsigned result, unsigned op1, unsigned op2)
+void JIT::emit_op_lshift(Instruction* currentInstruction)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
     emitGetVirtualRegisters(op1, regT0, op2, regT2);
     // FIXME: would we be better using 'emitJumpSlowCaseIfNotImmediateIntegers'? - we *probably* ought to be consistent.
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
@@ -67,8 +71,13 @@
     emitFastArithReTagImmediate(regT0, regT0);
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_lshift(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_lshift(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
 #if USE(ALTERNATE_JSIMMEDIATE)
     UNUSED_PARAM(op1);
     UNUSED_PARAM(op2);
@@ -83,15 +92,20 @@
     notImm1.link(this);
     notImm2.link(this);
 #endif
-    emitPutJITStubArg(regT0, 1);
-    emitPutJITStubArg(regT2, 2);
-    emitCTICall(JITStubs::cti_op_lshift);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_lshift);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT2);
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_rshift(unsigned result, unsigned op1, unsigned op2)
+void JIT::emit_op_rshift(Instruction* currentInstruction)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
     if (isOperandConstantImmediateInt(op2)) {
+        // isOperandConstantImmediateInt(op2) => 1 SlowCase
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         // Mask with 0x1f as per ecma-262 11.7.2 step 7.
@@ -102,8 +116,28 @@
 #endif
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT2);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT2);
+        if (supportsFloatingPointTruncate()) {
+            Jump lhsIsInt = emitJumpIfImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+            // supportsFloatingPoint() && USE(ALTERNATE_JSIMMEDIATE) => 3 SlowCases
+            addSlowCase(emitJumpIfNotImmediateNumber(regT0));
+            movePtrToDouble(regT0, fpRegT0);
+            addSlowCase(branchTruncateDoubleToInt32(fpRegT0, regT0));
+#else
+            // supportsFloatingPoint() && !USE(ALTERNATE_JSIMMEDIATE) => 5 SlowCases (of which 1 IfNotJSCell)
+            emitJumpSlowCaseIfNotJSCell(regT0, op1);
+            addSlowCase(checkStructure(regT0, m_globalData->numberStructure.get()));
+            loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
+            addSlowCase(branchTruncateDoubleToInt32(fpRegT0, regT0));
+            addSlowCase(branchAdd32(Overflow, regT0, regT0));
+#endif
+            lhsIsInt.link(this);
+            emitJumpSlowCaseIfNotImmediateInteger(regT2);
+        } else {
+            // !supportsFloatingPoint() => 2 SlowCases
+            emitJumpSlowCaseIfNotImmediateInteger(regT0);
+            emitJumpSlowCaseIfNotImmediateInteger(regT2);
+        }
         emitFastArithImmToInt(regT2);
 #if !PLATFORM(X86)
         // Mask with 0x1f as per ecma-262 11.7.2 step 7.
@@ -123,23 +157,424 @@
 #endif
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_rshift(unsigned result, unsigned, unsigned op2, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_rshift(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    linkSlowCase(iter);
-    if (isOperandConstantImmediateInt(op2))
-        emitPutJITStubArgFromVirtualRegister(op2, 2, regT2);
-    else {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_rshift);
+
+    if (isOperandConstantImmediateInt(op2)) {
         linkSlowCase(iter);
-        emitPutJITStubArg(regT2, 2);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+    } else {
+        if (supportsFloatingPointTruncate()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+#else
+            linkSlowCaseIfNotJSCell(iter, op1);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+#endif
+            // We're reloading op1 to regT0 as we can no longer guarantee that
+            // we have not munged the operand.  It may have already been shifted
+            // correctly, but it still will not have been tagged.
+            stubCall.addArgument(op1, regT0);
+            stubCall.addArgument(regT2);
+        } else {
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            stubCall.addArgument(regT0);
+            stubCall.addArgument(regT2);
+        }
     }
 
-    emitPutJITStubArg(regT0, 1);
-    emitCTICall(JITStubs::cti_op_rshift);
-    emitPutVirtualRegister(result);
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_bitand(unsigned result, unsigned op1, unsigned op2)
+void JIT::emit_op_jnless(Instruction* currentInstruction)
 {
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the fast path:
+    // - int immediate to constant int immediate
+    // - constant int immediate to int immediate
+    // - int immediate to int immediate
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
+#else
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
+#endif
+        addJump(branch32(LessThanOrEqual, regT1, Imm32(op1imm)), target + 3);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+
+        addJump(branch32(GreaterThanOrEqual, regT0, regT1), target + 3);
+    }
+}
+
+void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the slow path:
+    // - floating-point number to constant int immediate
+    // - constant int immediate to floating-point number
+    // - floating-point number to floating-point number.
+
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            addPtr(tagTypeNumberRegister, regT0);
+            movePtrToDouble(regT0, fpRegT0);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
+#endif
+            
+            int32_t op2imm = getConstantOperand(op2).getInt32Fast();;
+                    
+            move(Imm32(op2imm), regT1);
+            convertInt32ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
+    } else if (isOperandConstantImmediateInt(op1)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1 = emitJumpIfNotJSCell(regT1);
+            
+            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT1);
+#endif
+            
+            int32_t op1imm = getConstantOperand(op1).getInt32Fast();;
+                    
+            move(Imm32(op1imm), regT0);
+            convertInt32ToDouble(regT0, fpRegT0);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
+    } else {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
+            Jump fail3 = emitJumpIfImmediateInteger(regT1);
+            addPtr(tagTypeNumberRegister, regT0);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT0, fpRegT0);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2 = emitJumpIfNotJSCell(regT1);
+
+            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
+            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
+            loadDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT1);
+#endif
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+            fail2.link(this);
+            fail3.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2.link(this);
+            fail3.link(this);
+            fail4.link(this);
+#endif
+        }
+
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+    }
+}
+
+void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the fast path:
+    // - int immediate to constant int immediate
+    // - constant int immediate to int immediate
+    // - int immediate to int immediate
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(GreaterThan, regT0, Imm32(op2imm)), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
+#else
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
+#endif
+        addJump(branch32(LessThan, regT1, Imm32(op1imm)), target + 3);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+
+        addJump(branch32(GreaterThan, regT0, regT1), target + 3);
+    }
+}
+
+void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the slow path:
+    // - floating-point number to constant int immediate
+    // - constant int immediate to floating-point number
+    // - floating-point number to floating-point number.
+
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            addPtr(tagTypeNumberRegister, regT0);
+            movePtrToDouble(regT0, fpRegT0);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
+#endif
+            
+            int32_t op2imm = getConstantOperand(op2).getInt32Fast();;
+                    
+            move(Imm32(op2imm), regT1);
+            convertInt32ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
+    } else if (isOperandConstantImmediateInt(op1)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1 = emitJumpIfNotJSCell(regT1);
+            
+            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT1);
+#endif
+            
+            int32_t op1imm = getConstantOperand(op1).getInt32Fast();;
+                    
+            move(Imm32(op1imm), regT0);
+            convertInt32ToDouble(regT0, fpRegT0);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
+    } else {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
+            Jump fail3 = emitJumpIfImmediateInteger(regT1);
+            addPtr(tagTypeNumberRegister, regT0);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT0, fpRegT0);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2 = emitJumpIfNotJSCell(regT1);
+
+            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
+            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
+            loadDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT1);
+#endif
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+            fail2.link(this);
+            fail3.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2.link(this);
+            fail3.link(this);
+            fail4.link(this);
+#endif
+        }
+
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+    }
+}
+
+void JIT::emit_op_bitand(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
     if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
@@ -169,79 +604,37 @@
     }
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_bitand(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_bitand(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
     linkSlowCase(iter);
     if (isOperandConstantImmediateInt(op1)) {
-        emitPutJITStubArgFromVirtualRegister(op1, 1, regT2);
-        emitPutJITStubArg(regT0, 2);
+        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT0);
+        stubCall.call(result);
     } else if (isOperandConstantImmediateInt(op2)) {
-        emitPutJITStubArg(regT0, 1);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, regT2);
+        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
     } else {
-        emitPutJITStubArgFromVirtualRegister(op1, 1, regT2);
-        emitPutJITStubArg(regT1, 2);
+        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call(result);
     }
-    emitCTICall(JITStubs::cti_op_bitand);
-    emitPutVirtualRegister(result);
 }
 
-#if PLATFORM(X86) || PLATFORM(X86_64)
-void JIT::compileFastArith_op_mod(unsigned result, unsigned op1, unsigned op2)
+void JIT::emit_op_post_inc(Instruction* currentInstruction)
 {
-    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
-    emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-    emitJumpSlowCaseIfNotImmediateInteger(X86::ecx);
-#if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(branchPtr(Equal, X86::ecx, ImmPtr(JSValuePtr::encode(js0()))));
-    m_assembler.cdq();
-    m_assembler.idivl_r(X86::ecx);
-#else
-    emitFastArithDeTagImmediate(X86::eax);
-    addSlowCase(emitFastArithDeTagImmediateJumpIfZero(X86::ecx));
-    m_assembler.cdq();
-    m_assembler.idivl_r(X86::ecx);
-    signExtend32ToPtr(X86::edx, X86::edx);
-#endif
-    emitFastArithReTagImmediate(X86::edx, X86::eax);
-    emitPutVirtualRegister(result);
-}
-void JIT::compileFastArithSlow_op_mod(unsigned result, unsigned, unsigned, Vector<SlowCaseEntry>::iterator& iter)
-{
-#if USE(ALTERNATE_JSIMMEDIATE)
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-#else
-    Jump notImm1 = getSlowCase(iter);
-    Jump notImm2 = getSlowCase(iter);
-    linkSlowCase(iter);
-    emitFastArithReTagImmediate(X86::eax, X86::eax);
-    emitFastArithReTagImmediate(X86::ecx, X86::ecx);
-    notImm1.link(this);
-    notImm2.link(this);
-#endif
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArg(X86::ecx, 2);
-    emitCTICall(JITStubs::cti_op_mod);
-    emitPutVirtualRegister(result);
-}
-#else
-void JIT::compileFastArith_op_mod(unsigned result, unsigned op1, unsigned op2)
-{
-    emitPutJITStubArgFromVirtualRegister(op1, 1, regT2);
-    emitPutJITStubArgFromVirtualRegister(op2, 2, regT2);
-    emitCTICall(JITStubs::cti_op_mod);
-    emitPutVirtualRegister(result);
-}
-void JIT::compileFastArithSlow_op_mod(unsigned, unsigned, unsigned, Vector<SlowCaseEntry>::iterator&)
-{
-    ASSERT_NOT_REACHED();
-}
-#endif
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
 
-void JIT::compileFastArith_op_post_inc(unsigned result, unsigned srcDst)
-{
     emitGetVirtualRegister(srcDst, regT0);
     move(regT0, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
@@ -255,18 +648,25 @@
     emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_post_inc(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_post_inc(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
     linkSlowCase(iter);
     linkSlowCase(iter);
-    emitPutJITStubArg(regT0, 1);
-    emitCTICall(JITStubs::cti_op_post_inc);
-    emitPutVirtualRegister(srcDst, regT1);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_post_inc);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(Imm32(srcDst));
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_post_dec(unsigned result, unsigned srcDst)
+void JIT::emit_op_post_dec(Instruction* currentInstruction)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
     emitGetVirtualRegister(srcDst, regT0);
     move(regT0, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
@@ -280,18 +680,24 @@
     emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_post_dec(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_post_dec(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
     linkSlowCase(iter);
     linkSlowCase(iter);
-    emitPutJITStubArg(regT0, 1);
-    emitCTICall(JITStubs::cti_op_post_dec);
-    emitPutVirtualRegister(srcDst, regT1);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_post_dec);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(Imm32(srcDst));
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_pre_inc(unsigned srcDst)
+void JIT::emit_op_pre_inc(Instruction* currentInstruction)
 {
+    unsigned srcDst = currentInstruction[1].u.operand;
+
     emitGetVirtualRegister(srcDst, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
@@ -303,19 +709,24 @@
 #endif
     emitPutVirtualRegister(srcDst);
 }
-void JIT::compileFastArithSlow_op_pre_inc(unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_pre_inc(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned srcDst = currentInstruction[1].u.operand;
+
     Jump notImm = getSlowCase(iter);
     linkSlowCase(iter);
     emitGetVirtualRegister(srcDst, regT0);
     notImm.link(this);
-    emitPutJITStubArg(regT0, 1);
-    emitCTICall(JITStubs::cti_op_pre_inc);
-    emitPutVirtualRegister(srcDst);
+    JITStubCall stubCall(this, JITStubs::cti_op_pre_inc);
+    stubCall.addArgument(regT0);
+    stubCall.call(srcDst);
 }
 
-void JIT::compileFastArith_op_pre_dec(unsigned srcDst)
+void JIT::emit_op_pre_dec(Instruction* currentInstruction)
 {
+    unsigned srcDst = currentInstruction[1].u.operand;
+
     emitGetVirtualRegister(srcDst, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
@@ -327,88 +738,171 @@
 #endif
     emitPutVirtualRegister(srcDst);
 }
-void JIT::compileFastArithSlow_op_pre_dec(unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_pre_dec(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned srcDst = currentInstruction[1].u.operand;
+
     Jump notImm = getSlowCase(iter);
     linkSlowCase(iter);
     emitGetVirtualRegister(srcDst, regT0);
     notImm.link(this);
-    emitPutJITStubArg(regT0, 1);
-    emitCTICall(JITStubs::cti_op_pre_dec);
-    emitPutVirtualRegister(srcDst);
+    JITStubCall stubCall(this, JITStubs::cti_op_pre_dec);
+    stubCall.addArgument(regT0);
+    stubCall.call(srcDst);
 }
 
+/* ------------------------------ BEGIN: OP_MOD ------------------------------ */
+
+#if PLATFORM(X86) || PLATFORM(X86_64)
+
+void JIT::emit_op_mod(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
+    emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
+    emitJumpSlowCaseIfNotImmediateInteger(X86::ecx);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    addSlowCase(branchPtr(Equal, X86::ecx, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))));
+    m_assembler.cdq();
+    m_assembler.idivl_r(X86::ecx);
+#else
+    emitFastArithDeTagImmediate(X86::eax);
+    addSlowCase(emitFastArithDeTagImmediateJumpIfZero(X86::ecx));
+    m_assembler.cdq();
+    m_assembler.idivl_r(X86::ecx);
+    signExtend32ToPtr(X86::edx, X86::edx);
+#endif
+    emitFastArithReTagImmediate(X86::edx, X86::eax);
+    emitPutVirtualRegister(result);
+}
+
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+#else
+    Jump notImm1 = getSlowCase(iter);
+    Jump notImm2 = getSlowCase(iter);
+    linkSlowCase(iter);
+    emitFastArithReTagImmediate(X86::eax, X86::eax);
+    emitFastArithReTagImmediate(X86::ecx, X86::ecx);
+    notImm1.link(this);
+    notImm2.link(this);
+#endif
+    JITStubCall stubCall(this, JITStubs::cti_op_mod);
+    stubCall.addArgument(X86::eax);
+    stubCall.addArgument(X86::ecx);
+    stubCall.call(result);
+}
+
+#else // PLATFORM(X86) || PLATFORM(X86_64)
+
+void JIT::emit_op_mod(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_mod);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+}
+
+void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+#endif // PLATFORM(X86) || PLATFORM(X86_64)
+
+/* ------------------------------ END: OP_MOD ------------------------------ */
 
 #if !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
 
-void JIT::compileFastArith_op_add(Instruction* currentInstruction)
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_ARITHMETIC) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
+
+void JIT::emit_op_add(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
-    emitPutJITStubArgFromVirtualRegister(op1, 1, regT2);
-    emitPutJITStubArgFromVirtualRegister(op2, 2, regT2);
-    emitCTICall(JITStubs::cti_op_add);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_add);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
 }
-void JIT::compileFastArithSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&)
+
+void JIT::emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&)
 {
     ASSERT_NOT_REACHED();
 }
 
-void JIT::compileFastArith_op_mul(Instruction* currentInstruction)
+void JIT::emit_op_mul(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
-    emitPutJITStubArgFromVirtualRegister(op1, 1, regT2);
-    emitPutJITStubArgFromVirtualRegister(op2, 2, regT2);
-    emitCTICall(JITStubs::cti_op_mul);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_mul);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
 }
-void JIT::compileFastArithSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&)
+
+void JIT::emitSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&)
 {
     ASSERT_NOT_REACHED();
 }
 
-void JIT::compileFastArith_op_sub(Instruction* currentInstruction)
+void JIT::emit_op_sub(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
-    emitPutJITStubArgFromVirtualRegister(op1, 1, regT2);
-    emitPutJITStubArgFromVirtualRegister(op2, 2, regT2);
-    emitCTICall(JITStubs::cti_op_sub);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_sub);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
 }
-void JIT::compileFastArithSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&)
+
+void JIT::emitSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&)
 {
     ASSERT_NOT_REACHED();
 }
 
 #elif USE(ALTERNATE_JSIMMEDIATE) // *AND* ENABLE(JIT_OPTIMIZE_ARITHMETIC)
 
+/* ------------------------------ BEGIN: USE(ALTERNATE_JSIMMEDIATE) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
+
 void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned, unsigned op1, unsigned op2, OperandTypes)
 {
-    emitGetVirtualRegisters(op1, X86::eax, op2, X86::edx);
-    emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-    emitJumpSlowCaseIfNotImmediateInteger(X86::edx);
+    emitGetVirtualRegisters(op1, regT0, op2, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT1);
     if (opcodeID == op_add)
-        addSlowCase(branchAdd32(Overflow, X86::edx, X86::eax));
+        addSlowCase(branchAdd32(Overflow, regT1, regT0));
     else if (opcodeID == op_sub)
-        addSlowCase(branchSub32(Overflow, X86::edx, X86::eax));
+        addSlowCase(branchSub32(Overflow, regT1, regT0));
     else {
         ASSERT(opcodeID == op_mul);
-        addSlowCase(branchMul32(Overflow, X86::edx, X86::eax));
-        addSlowCase(branchTest32(Zero, X86::eax));
+        addSlowCase(branchMul32(Overflow, regT1, regT0));
+        addSlowCase(branchTest32(Zero, regT0));
     }
-    emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+    emitFastArithIntToImmNoCheck(regT0, regT0);
 }
 
-void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned, unsigned op1, unsigned, OperandTypes types)
+void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned result, unsigned op1, unsigned, OperandTypes types)
 {
     // We assume that subtracting TagTypeNumber is equivalent to adding DoubleEncodeOffset.
     COMPILE_ASSERT(((JSImmediate::TagTypeNumber + JSImmediate::DoubleEncodeOffset) == 0), TagTypeNumber_PLUS_DoubleEncodeOffset_EQUALS_0);
@@ -419,58 +913,53 @@
     linkSlowCase(iter); // Integer overflow case - we could handle this in JIT code, but this is likely rare.
     if (opcodeID == op_mul) // op_mul has an extra slow case to handle 0 * negative number.
         linkSlowCase(iter);
-    emitGetVirtualRegister(op1, X86::eax);
+    emitGetVirtualRegister(op1, regT0);
 
     Label stubFunctionCall(this);
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArg(X86::edx, 2);
-    if (opcodeID == op_add)
-        emitCTICall(JITStubs::cti_op_add);
-    else if (opcodeID == op_sub)
-        emitCTICall(JITStubs::cti_op_sub);
-    else {
-        ASSERT(opcodeID == op_mul);
-        emitCTICall(JITStubs::cti_op_mul);
-    }
+    JITStubCall stubCall(this, opcodeID == op_add ? JITStubs::cti_op_add : opcodeID == op_sub ? JITStubs::cti_op_sub : JITStubs::cti_op_mul);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(result);
     Jump end = jump();
 
     // if we get here, eax is not an int32, edx not yet checked.
     notImm1.link(this);
     if (!types.first().definitelyIsNumber())
-        emitJumpIfNotImmediateNumber(X86::eax).linkTo(stubFunctionCall, this);
+        emitJumpIfNotImmediateNumber(regT0).linkTo(stubFunctionCall, this);
     if (!types.second().definitelyIsNumber())
-        emitJumpIfNotImmediateNumber(X86::edx).linkTo(stubFunctionCall, this);
-    addPtr(tagTypeNumberRegister, X86::eax);
-    m_assembler.movq_rr(X86::eax, X86::xmm1);
-    Jump op2isDouble = emitJumpIfNotImmediateInteger(X86::edx);
-    m_assembler.cvtsi2sd_rr(X86::edx, X86::xmm2);
+        emitJumpIfNotImmediateNumber(regT1).linkTo(stubFunctionCall, this);
+    addPtr(tagTypeNumberRegister, regT0);
+    movePtrToDouble(regT0, fpRegT1);
+    Jump op2isDouble = emitJumpIfNotImmediateInteger(regT1);
+    convertInt32ToDouble(regT1, fpRegT2);
     Jump op2wasInteger = jump();
 
     // if we get here, eax IS an int32, edx is not.
     notImm2.link(this);
     if (!types.second().definitelyIsNumber())
-        emitJumpIfNotImmediateNumber(X86::edx).linkTo(stubFunctionCall, this);
-    m_assembler.cvtsi2sd_rr(X86::eax, X86::xmm1);
+        emitJumpIfNotImmediateNumber(regT1).linkTo(stubFunctionCall, this);
+    convertInt32ToDouble(regT0, fpRegT1);
     op2isDouble.link(this);
-    addPtr(tagTypeNumberRegister, X86::edx);
-    m_assembler.movq_rr(X86::edx, X86::xmm2);
+    addPtr(tagTypeNumberRegister, regT1);
+    movePtrToDouble(regT1, fpRegT2);
     op2wasInteger.link(this);
 
     if (opcodeID == op_add)
-        m_assembler.addsd_rr(X86::xmm2, X86::xmm1);
+        addDouble(fpRegT2, fpRegT1);
     else if (opcodeID == op_sub)
-        m_assembler.subsd_rr(X86::xmm2, X86::xmm1);
+        subDouble(fpRegT2, fpRegT1);
     else {
         ASSERT(opcodeID == op_mul);
-        m_assembler.mulsd_rr(X86::xmm2, X86::xmm1);
+        mulDouble(fpRegT2, fpRegT1);
     }
-    m_assembler.movq_rr(X86::xmm1, X86::eax);
-    subPtr(tagTypeNumberRegister, X86::eax);
+    moveDoubleToPtr(fpRegT1, regT0);
+    subPtr(tagTypeNumberRegister, regT0);
+    emitPutVirtualRegister(result, regT0);
 
     end.link(this);
 }
 
-void JIT::compileFastArith_op_add(Instruction* currentInstruction)
+void JIT::emit_op_add(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
@@ -478,54 +967,47 @@
     OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
     if (!types.first().mightBeNumber() || !types.second().mightBeNumber()) {
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-        emitCTICall(JITStubs::cti_op_add);
-        emitPutVirtualRegister(result);
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
         return;
     }
 
     if (isOperandConstantImmediateInt(op1)) {
-        emitGetVirtualRegister(op2, X86::eax);
-        emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op1)), X86::eax));
-        emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op1)), regT0));
+        emitFastArithIntToImmNoCheck(regT0, regT0);
     } else if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op2)), X86::eax));
-        emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op2)), regT0));
+        emitFastArithIntToImmNoCheck(regT0, regT0);
     } else
         compileBinaryArithOp(op_add, result, op1, op2, types);
 
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
-    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
-    if (isOperandConstantImmediateInt(op1)) {
+    if (isOperandConstantImmediateInt(op1) || isOperandConstantImmediateInt(op2)) {
         linkSlowCase(iter);
         linkSlowCase(iter);
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-        emitCTICall(JITStubs::cti_op_add);
-    } else if (isOperandConstantImmediateInt(op2)) {
-        linkSlowCase(iter);
-        linkSlowCase(iter);
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-        emitCTICall(JITStubs::cti_op_add);
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
     } else
-        compileBinaryArithOpSlowCase(op_add, iter, result, op1, op2, types);
-
-    emitPutVirtualRegister(result);
+        compileBinaryArithOpSlowCase(op_add, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
 }
 
-void JIT::compileFastArith_op_mul(Instruction* currentInstruction)
+void JIT::emit_op_mul(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
@@ -535,21 +1017,22 @@
     // For now, only plant a fast int case if the constant operand is greater than zero.
     int32_t value;
     if (isOperandConstantImmediateInt(op1) && ((value = getConstantOperandImmediateInt(op1)) > 0)) {
-        emitGetVirtualRegister(op2, X86::eax);
-        emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-        addSlowCase(branchMul32(Overflow, Imm32(value), X86::eax, X86::eax));
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        emitFastArithReTagImmediate(regT0, regT0);
     } else if (isOperandConstantImmediateInt(op2) && ((value = getConstantOperandImmediateInt(op2)) > 0)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-        addSlowCase(branchMul32(Overflow, Imm32(value), X86::eax, X86::eax));
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        emitFastArithReTagImmediate(regT0, regT0);
     } else
         compileBinaryArithOp(op_mul, result, op1, op2, types);
 
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
@@ -561,16 +1044,15 @@
         linkSlowCase(iter);
         linkSlowCase(iter);
         // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-        emitCTICall(JITStubs::cti_op_mul);
+        JITStubCall stubCall(this, JITStubs::cti_op_mul);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
     } else
         compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, types);
-
-    emitPutVirtualRegister(result);
 }
 
-void JIT::compileFastArith_op_sub(Instruction* currentInstruction)
+void JIT::emit_op_sub(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
@@ -581,7 +1063,8 @@
 
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
@@ -589,218 +1072,153 @@
     OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
     compileBinaryArithOpSlowCase(op_sub, iter, result, op1, op2, types);
-
-    emitPutVirtualRegister(result);
 }
 
-#else
+#else // !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
 
-typedef X86Assembler::JmpSrc JmpSrc;
-typedef X86Assembler::JmpDst JmpDst;
-typedef X86Assembler::XMMRegisterID XMMRegisterID;
-
-#if PLATFORM(MAC)
-
-static inline bool isSSE2Present()
-{
-    return true; // All X86 Macs are guaranteed to support at least SSE2
-}
-
-#else
-
-static bool isSSE2Present()
-{
-    static const int SSE2FeatureBit = 1 << 26;
-    struct SSE2Check {
-        SSE2Check()
-        {
-            int flags;
-#if COMPILER(MSVC)
-            _asm {
-                mov eax, 1 // cpuid function 1 gives us the standard feature set
-                cpuid;
-                mov flags, edx;
-            }
-#elif COMPILER(GCC)
-            asm (
-                "movl $0x1, %%eax;"
-                "pushl %%ebx;"
-                "cpuid;"
-                "popl %%ebx;"
-                "movl %%edx, %0;"
-                : "=g" (flags)
-                :
-                : "%eax", "%ecx", "%edx"
-            );
-#else
-            flags = 0;
-#endif
-            present = (flags & SSE2FeatureBit) != 0;
-        }
-        bool present;
-    };
-    static SSE2Check check;
-    return check.present;
-}
-
-#endif
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_ARITHMETIC) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
 
 void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes types)
 {
     Structure* numberStructure = m_globalData->numberStructure.get();
-    JmpSrc wasJSNumberCell1;
-    JmpSrc wasJSNumberCell2;
+    Jump wasJSNumberCell1;
+    Jump wasJSNumberCell2;
 
-    emitGetVirtualRegisters(src1, X86::eax, src2, X86::edx);
+    emitGetVirtualRegisters(src1, regT0, src2, regT1);
 
-    if (types.second().isReusable() && isSSE2Present()) {
+    if (types.second().isReusable() && supportsFloatingPoint()) {
         ASSERT(types.second().mightBeNumber());
 
         // Check op2 is a number
-        __ testl_i32r(JSImmediate::TagTypeNumber, X86::edx);
-        JmpSrc op2imm = __ jne();
+        Jump op2imm = emitJumpIfImmediateInteger(regT1);
         if (!types.second().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::edx, src2);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::edx);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT1, src2);
+            addSlowCase(checkStructure(regT1, numberStructure));
         }
 
         // (1) In this case src2 is a reusable number cell.
         //     Slow case if src1 is not a number type.
-        __ testl_i32r(JSImmediate::TagTypeNumber, X86::eax);
-        JmpSrc op1imm = __ jne();
+        Jump op1imm = emitJumpIfImmediateInteger(regT0);
         if (!types.first().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::eax, src1);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::eax);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT0, src1);
+            addSlowCase(checkStructure(regT0, numberStructure));
         }
 
         // (1a) if we get here, src1 is also a number cell
-        __ movsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::eax, X86::xmm0);
-        JmpSrc loadedDouble = __ jmp();
+        loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
+        Jump loadedDouble = jump();
         // (1b) if we get here, src1 is an immediate
-        __ linkJump(op1imm, __ label());
-        emitFastArithImmToInt(X86::eax);
-        __ cvtsi2sd_rr(X86::eax, X86::xmm0);
+        op1imm.link(this);
+        emitFastArithImmToInt(regT0);
+        convertInt32ToDouble(regT0, fpRegT0);
         // (1c) 
-        __ linkJump(loadedDouble, __ label());
+        loadedDouble.link(this);
         if (opcodeID == op_add)
-            __ addsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm0);
+            addDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
         else if (opcodeID == op_sub)
-            __ subsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm0);
+            subDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
         else {
             ASSERT(opcodeID == op_mul);
-            __ mulsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm0);
+            mulDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
         }
 
         // Store the result to the JSNumberCell and jump.
-        __ movsd_rm(X86::xmm0, FIELD_OFFSET(JSNumberCell, m_value), X86::edx);
-        __ movl_rr(X86::edx, X86::eax);
+        storeDouble(fpRegT0, Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)));
+        move(regT1, regT0);
         emitPutVirtualRegister(dst);
-        wasJSNumberCell2 = __ jmp();
+        wasJSNumberCell2 = jump();
 
         // (2) This handles cases where src2 is an immediate number.
         //     Two slow cases - either src1 isn't an immediate, or the subtract overflows.
-        __ linkJump(op2imm, __ label());
-        emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-    } else if (types.first().isReusable() && isSSE2Present()) {
+        op2imm.link(this);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    } else if (types.first().isReusable() && supportsFloatingPoint()) {
         ASSERT(types.first().mightBeNumber());
 
         // Check op1 is a number
-        __ testl_i32r(JSImmediate::TagTypeNumber, X86::eax);
-        JmpSrc op1imm = __ jne();
+        Jump op1imm = emitJumpIfImmediateInteger(regT0);
         if (!types.first().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::eax, src1);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::eax);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT0, src1);
+            addSlowCase(checkStructure(regT0, numberStructure));
         }
 
         // (1) In this case src1 is a reusable number cell.
         //     Slow case if src2 is not a number type.
-        __ testl_i32r(JSImmediate::TagTypeNumber, X86::edx);
-        JmpSrc op2imm = __ jne();
+        Jump op2imm = emitJumpIfImmediateInteger(regT1);
         if (!types.second().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::edx, src2);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::edx);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT1, src2);
+            addSlowCase(checkStructure(regT1, numberStructure));
         }
 
         // (1a) if we get here, src2 is also a number cell
-        __ movsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm1);
-        JmpSrc loadedDouble = __ jmp();
+        loadDouble(Address(regT1, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT1);
+        Jump loadedDouble = jump();
         // (1b) if we get here, src2 is an immediate
-        __ linkJump(op2imm, __ label());
-        emitFastArithImmToInt(X86::edx);
-        __ cvtsi2sd_rr(X86::edx, X86::xmm1);
+        op2imm.link(this);
+        emitFastArithImmToInt(regT1);
+        convertInt32ToDouble(regT1, fpRegT1);
         // (1c) 
-        __ linkJump(loadedDouble, __ label());
-        __ movsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::eax, X86::xmm0);
+        loadedDouble.link(this);
+        loadDouble(Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)), fpRegT0);
         if (opcodeID == op_add)
-            __ addsd_rr(X86::xmm1, X86::xmm0);
+            addDouble(fpRegT1, fpRegT0);
         else if (opcodeID == op_sub)
-            __ subsd_rr(X86::xmm1, X86::xmm0);
+            subDouble(fpRegT1, fpRegT0);
         else {
             ASSERT(opcodeID == op_mul);
-            __ mulsd_rr(X86::xmm1, X86::xmm0);
+            mulDouble(fpRegT1, fpRegT0);
         }
-        __ movsd_rm(X86::xmm0, FIELD_OFFSET(JSNumberCell, m_value), X86::eax);
+        storeDouble(fpRegT0, Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)));
         emitPutVirtualRegister(dst);
 
         // Store the result to the JSNumberCell and jump.
-        __ movsd_rm(X86::xmm0, FIELD_OFFSET(JSNumberCell, m_value), X86::eax);
+        storeDouble(fpRegT0, Address(regT0, FIELD_OFFSET(JSNumberCell, m_value)));
         emitPutVirtualRegister(dst);
-        wasJSNumberCell1 = __ jmp();
+        wasJSNumberCell1 = jump();
 
         // (2) This handles cases where src1 is an immediate number.
         //     Two slow cases - either src2 isn't an immediate, or the subtract overflows.
-        __ linkJump(op1imm, __ label());
-        emitJumpSlowCaseIfNotImmediateInteger(X86::edx);
+        op1imm.link(this);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
     } else
-        emitJumpSlowCaseIfNotImmediateIntegers(X86::eax, X86::edx, X86::ecx);
+        emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
 
     if (opcodeID == op_add) {
-        emitFastArithDeTagImmediate(X86::eax);
-        __ addl_rr(X86::edx, X86::eax);
-        addSlowCase(__ jo());
+        emitFastArithDeTagImmediate(regT0);
+        addSlowCase(branchAdd32(Overflow, regT1, regT0));
     } else  if (opcodeID == op_sub) {
-        __ subl_rr(X86::edx, X86::eax);
-        addSlowCase(__ jo());
-        signExtend32ToPtr(X86::eax, X86::eax);
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
+        addSlowCase(branchSub32(Overflow, regT1, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
     } else {
         ASSERT(opcodeID == op_mul);
         // convert eax & edx from JSImmediates to ints, and check if either are zero
-        emitFastArithImmToInt(X86::edx);
-        Jump op1Zero = emitFastArithDeTagImmediateJumpIfZero(X86::eax);
-        __ testl_rr(X86::edx, X86::edx);
-        JmpSrc op2NonZero = __ jne();
+        emitFastArithImmToInt(regT1);
+        Jump op1Zero = emitFastArithDeTagImmediateJumpIfZero(regT0);
+        Jump op2NonZero = branchTest32(NonZero, regT1);
         op1Zero.link(this);
         // if either input is zero, add the two together, and check if the result is < 0.
         // If it is, we have a problem (N < 0), (N * 0) == -0, not representatble as a JSImmediate. 
-        __ movl_rr(X86::eax, X86::ecx);
-        __ addl_rr(X86::edx, X86::ecx);
-        addSlowCase(__ js());
+        move(regT0, regT2);
+        addSlowCase(branchAdd32(Signed, regT1, regT2));
         // Skip the above check if neither input is zero
-        __ linkJump(op2NonZero, __ label());
-        __ imull_rr(X86::edx, X86::eax);
-        addSlowCase(__ jo());
-        signExtend32ToPtr(X86::eax, X86::eax);
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
+        op2NonZero.link(this);
+        addSlowCase(branchMul32(Overflow, regT1, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
     }
     emitPutVirtualRegister(dst);
 
-    if (types.second().isReusable() && isSSE2Present()) {
-        __ linkJump(wasJSNumberCell2, __ label());
-    }
-    else if (types.first().isReusable() && isSSE2Present()) {
-        __ linkJump(wasJSNumberCell1, __ label());
-    }
+    if (types.second().isReusable() && supportsFloatingPoint())
+        wasJSNumberCell2.link(this);
+    else if (types.first().isReusable() && supportsFloatingPoint())
+        wasJSNumberCell1.link(this);
 }
 
 void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned dst, unsigned src1, unsigned src2, OperandTypes types)
 {
     linkSlowCase(iter);
-    if (types.second().isReusable() && isSSE2Present()) {
+    if (types.second().isReusable() && supportsFloatingPoint()) {
         if (!types.first().definitelyIsNumber()) {
             linkSlowCaseIfNotJSCell(iter, src1);
             linkSlowCase(iter);
@@ -809,7 +1227,7 @@
             linkSlowCaseIfNotJSCell(iter, src2);
             linkSlowCase(iter);
         }
-    } else if (types.first().isReusable() && isSSE2Present()) {
+    } else if (types.first().isReusable() && supportsFloatingPoint()) {
         if (!types.first().definitelyIsNumber()) {
             linkSlowCaseIfNotJSCell(iter, src1);
             linkSlowCase(iter);
@@ -825,50 +1243,44 @@
     if (opcodeID == op_mul)
         linkSlowCase(iter);
 
-    emitPutJITStubArgFromVirtualRegister(src1, 1, X86::ecx);
-    emitPutJITStubArgFromVirtualRegister(src2, 2, X86::ecx);
-    if (opcodeID == op_add)
-        emitCTICall(JITStubs::cti_op_add);
-    else if (opcodeID == op_sub)
-        emitCTICall(JITStubs::cti_op_sub);
-    else {
-        ASSERT(opcodeID == op_mul);
-        emitCTICall(JITStubs::cti_op_mul);
-    }
-    emitPutVirtualRegister(dst);
+    JITStubCall stubCall(this, opcodeID == op_add ? JITStubs::cti_op_add : opcodeID == op_sub ? JITStubs::cti_op_sub : JITStubs::cti_op_mul);
+    stubCall.addArgument(src1, regT2);
+    stubCall.addArgument(src2, regT2);
+    stubCall.call(dst);
 }
 
-void JIT::compileFastArith_op_add(Instruction* currentInstruction)
+void JIT::emit_op_add(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
     if (isOperandConstantImmediateInt(op1)) {
-        emitGetVirtualRegister(op2, X86::eax);
-        emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), regT0));
+        signExtend32ToPtr(regT0, regT0);
         emitPutVirtualRegister(result);
     } else if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), regT0));
+        signExtend32ToPtr(regT0, regT0);
         emitPutVirtualRegister(result);
     } else {
         OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
         if (types.first().mightBeNumber() && types.second().mightBeNumber())
             compileBinaryArithOp(op_add, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
         else {
-            emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-            emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-            emitCTICall(JITStubs::cti_op_add);
-            emitPutVirtualRegister(result);
+            JITStubCall stubCall(this, JITStubs::cti_op_add);
+            stubCall.addArgument(op1, regT2);
+            stubCall.addArgument(op2, regT2);
+            stubCall.call(result);
         }
     }
 }
-void JIT::compileFastArithSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
@@ -877,21 +1289,21 @@
     if (isOperandConstantImmediateInt(op1)) {
         Jump notImm = getSlowCase(iter);
         linkSlowCase(iter);
-        sub32(Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), X86::eax);
+        sub32(Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), regT0);
         notImm.link(this);
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArg(X86::eax, 2);
-        emitCTICall(JITStubs::cti_op_add);
-        emitPutVirtualRegister(result);
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT0);
+        stubCall.call(result);
     } else if (isOperandConstantImmediateInt(op2)) {
         Jump notImm = getSlowCase(iter);
         linkSlowCase(iter);
-        sub32(Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), X86::eax);
+        sub32(Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), regT0);
         notImm.link(this);
-        emitPutJITStubArg(X86::eax, 1);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-        emitCTICall(JITStubs::cti_op_add);
-        emitPutVirtualRegister(result);
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
     } else {
         OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
         ASSERT(types.first().mightBeNumber() && types.second().mightBeNumber());
@@ -899,7 +1311,7 @@
     }
 }
 
-void JIT::compileFastArith_op_mul(Instruction* currentInstruction)
+void JIT::emit_op_mul(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
@@ -908,25 +1320,26 @@
     // For now, only plant a fast int case if the constant operand is greater than zero.
     int32_t value;
     if (isOperandConstantImmediateInt(op1) && ((value = getConstantOperandImmediateInt(op1)) > 0)) {
-        emitGetVirtualRegister(op2, X86::eax);
-        emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-        emitFastArithDeTagImmediate(X86::eax);
-        addSlowCase(branchMul32(Overflow, Imm32(value), X86::eax, X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitFastArithDeTagImmediate(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
         emitPutVirtualRegister(result);
     } else if (isOperandConstantImmediateInt(op2) && ((value = getConstantOperandImmediateInt(op2)) > 0)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-        emitFastArithDeTagImmediate(X86::eax);
-        addSlowCase(branchMul32(Overflow, Imm32(value), X86::eax, X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitFastArithDeTagImmediate(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
         emitPutVirtualRegister(result);
     } else
         compileBinaryArithOp(op_mul, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
 }
-void JIT::compileFastArithSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
@@ -937,24 +1350,27 @@
         linkSlowCase(iter);
         linkSlowCase(iter);
         // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-        emitCTICall(JITStubs::cti_op_mul);
-        emitPutVirtualRegister(result);
+        JITStubCall stubCall(this, JITStubs::cti_op_mul);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
     } else
         compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
 }
 
-void JIT::compileFastArith_op_sub(Instruction* currentInstruction)
+void JIT::emit_op_sub(Instruction* currentInstruction)
 {
     compileBinaryArithOp(op_sub, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
 }
-void JIT::compileFastArithSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     compileBinaryArithOpSlowCase(op_sub, iter, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
 }
 
-#endif
+#endif // !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
+
+/* ------------------------------ END: OP_ADD, OP_SUB, OP_MUL ------------------------------ */
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/jit/JITCall.cpp b/JavaScriptCore/jit/JITCall.cpp
index 62c7149..cf852be 100644
--- a/JavaScriptCore/jit/JITCall.cpp
+++ b/JavaScriptCore/jit/JITCall.cpp
@@ -30,6 +30,7 @@
 
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -44,38 +45,13 @@
 
 namespace JSC {
 
-void JIT::unlinkCall(CallLinkInfo* callLinkInfo)
-{
-    // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
-    // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
-    // match).  Reset the check so it no longer matches.
-    callLinkInfo->hotPathBegin.repatch(JSValuePtr::encode(jsImpossibleValue()));
-}
-
-//void JIT::linkCall(JSFunction* , CodeBlock* , JITCode , CallLinkInfo* callLinkInfo, int )
-void JIT::linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, JITCode ctiCode, CallLinkInfo* callLinkInfo, int callerArgCount)
-{
-    // Currently we only link calls with the exact number of arguments.
-    if (callerArgCount == calleeCodeBlock->m_numParameters) {
-        ASSERT(!callLinkInfo->isLinked());
-    
-        calleeCodeBlock->addCaller(callLinkInfo);
-    
-        callLinkInfo->hotPathBegin.repatch(callee);
-        callLinkInfo->hotPathOther.relink(ctiCode.addressForCall());
-    }
-
-    // patch the instruction that jumps out to the cold path, so that we only try to link once.
-    callLinkInfo->hotPathBegin.jumpAtOffset(patchOffsetOpCallCompareToJump).relink(callLinkInfo->coldPathOther);
-}
-
 void JIT::compileOpCallInitializeCallFrame()
 {
     store32(regT1, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
 
-    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_scopeChain) + FIELD_OFFSET(ScopeChain, m_node)), regT1); // newScopeChain
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_data) + FIELD_OFFSET(ScopeChain, m_node)), regT1); // newScopeChain
 
-    storePtr(ImmPtr(JSValuePtr::encode(noValue())), Address(callFrameRegister, RegisterFile::OptionalCalleeArguments * static_cast<int>(sizeof(Register))));
+    storePtr(ImmPtr(JSValue::encode(JSValue())), Address(callFrameRegister, RegisterFile::OptionalCalleeArguments * static_cast<int>(sizeof(Register))));
     storePtr(regT2, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register))));
     storePtr(regT1, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register))));
 }
@@ -87,19 +63,19 @@
 
     // ecx holds func
     emitPutJITStubArg(regT2, 1);
-    emitPutJITStubArgConstant(registerOffset, 2);
     emitPutJITStubArgConstant(argCount, 3);
+    emitPutJITStubArgConstant(registerOffset, 2);
 }
-
-void JIT::compileOpCallEvalSetupArgs(Instruction* instruction)
+          
+void JIT::compileOpCallVarargsSetupArgs(Instruction* instruction)
 {
-    int argCount = instruction[3].u.operand;
     int registerOffset = instruction[4].u.operand;
-
+    
     // ecx holds func
     emitPutJITStubArg(regT2, 1);
-    emitPutJITStubArgConstant(registerOffset, 2);
-    emitPutJITStubArgConstant(argCount, 3);
+    emitPutJITStubArg(regT1, 3);
+    addPtr(Imm32(registerOffset), regT1, regT0);
+    emitPutJITStubArg(regT0, 2);
 }
 
 void JIT::compileOpConstructSetupArgs(Instruction* instruction)
@@ -117,8 +93,51 @@
     emitPutJITStubArgConstant(thisRegister, 5);
 }
 
+void JIT::compileOpCallVarargs(Instruction* instruction)
+{
+    int dst = instruction[1].u.operand;
+    int callee = instruction[2].u.operand;
+    int argCountRegister = instruction[3].u.operand;
+
+    emitGetVirtualRegister(argCountRegister, regT1);
+    emitGetVirtualRegister(callee, regT2);
+    compileOpCallVarargsSetupArgs(instruction);
+
+    // Check for JSFunctions.
+    emitJumpSlowCaseIfNotJSCell(regT2);
+    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
+    
+    // Speculatively roll the callframe, assuming argCount will match the arity.
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    intptr_t offset = (intptr_t)sizeof(Register) * (intptr_t)RegisterFile::CallerFrame;
+    addPtr(Imm32((int32_t)offset), regT0, regT3);
+    addPtr(callFrameRegister, regT3);
+    storePtr(callFrameRegister, regT3);
+    addPtr(regT0, callFrameRegister);
+    emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
+
+    // Put the return value in dst. In the interpreter, op_ret does this.
+    emitPutVirtualRegister(dst);
+    
+    sampleCodeBlock(m_codeBlock);
+}
+
+void JIT::compileOpCallVarargsSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = instruction[1].u.operand;
+    
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_call_NotJSFunction);
+    stubCall.call(dst); // In the interpreter, the callee puts the return value in dst.
+    
+    sampleCodeBlock(m_codeBlock);
+}
+    
 #if !ENABLE(JIT_OPTIMIZE_CALL)
 
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
+
 void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
 {
     int dst = instruction[1].u.operand;
@@ -129,11 +148,8 @@
     // Handle eval
     Jump wasEval;
     if (opcodeID == op_call_eval) {
-        emitGetVirtualRegister(callee, regT2);
-        compileOpCallEvalSetupArgs(instruction);
-
-        emitCTICall(JITStubs::cti_op_call_eval);
-        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValuePtr::encode(jsImpossibleValue())));
+        CallEvalJITStub(this, instruction).call();
+        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
     }
 
     emitGetVirtualRegister(callee, regT2);
@@ -149,8 +165,7 @@
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
-        emitCTICall(JITStubs::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        JITStubCall(this, JITStubs::cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
         emitGetVirtualRegister(callee, regT2);
     }
 
@@ -176,16 +191,15 @@
 
     linkSlowCase(iter);
     linkSlowCase(iter);
-
-    // This handles host functions
-    emitCTICall(((opcodeID == op_construct) ? JITStubs::cti_op_construct_NotJSConstruct : JITStubs::cti_op_call_NotJSFunction));
-    // Put the return value in dst. In the interpreter, op_ret does this.
-    emitPutVirtualRegister(dst);
+    JITStubCall stubCall(this, opcodeID == op_construct ? JITStubs::cti_op_construct_NotJSConstruct : JITStubs::cti_op_call_NotJSFunction);
+    stubCall.call(dst); // In the interpreter, the callee puts the return value in dst.
 
     sampleCodeBlock(m_codeBlock);
 }
 
-#else
+#else // !ENABLE(JIT_OPTIMIZE_CALL)
+
+/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
 
 void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned callLinkInfoIndex)
 {
@@ -197,18 +211,15 @@
     // Handle eval
     Jump wasEval;
     if (opcodeID == op_call_eval) {
-        emitGetVirtualRegister(callee, regT2);
-        compileOpCallEvalSetupArgs(instruction);
-
-        emitCTICall(JITStubs::cti_op_call_eval);
-        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValuePtr::encode(jsImpossibleValue())));
+        CallEvalJITStub(this, instruction).call();
+        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
     }
 
     // This plants a check for a cached JSFunction value, so we can plant a fast link to the callee.
     // This deliberately leaves the callee in ecx, used when setting up the stack frame below
     emitGetVirtualRegister(callee, regT2);
     DataLabelPtr addressOfLinkedFunctionCheck;
-    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT2, addressOfLinkedFunctionCheck, ImmPtr(JSValuePtr::encode(jsImpossibleValue())));
+    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT2, addressOfLinkedFunctionCheck, ImmPtr(JSValue::encode(JSValue())));
     addSlowCase(jumpToSlow);
     ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
@@ -222,23 +233,23 @@
 
         emitPutJITStubArg(regT2, 1);
         emitPutJITStubArgFromVirtualRegister(proto, 4, regT0);
-        emitCTICall(JITStubs::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(thisRegister);
+        JITStubCall stubCall(this, JITStubs::cti_op_construct_JSConstruct);
+        stubCall.call(thisRegister);
         emitGetVirtualRegister(callee, regT2);
     }
 
     // Fast version of stack frame initialization, directly relative to edi.
     // Note that this omits to set up RegisterFile::CodeBlock, which is set in the callee
-    storePtr(ImmPtr(JSValuePtr::encode(noValue())), Address(callFrameRegister, (registerOffset + RegisterFile::OptionalCalleeArguments) * static_cast<int>(sizeof(Register))));
+    storePtr(ImmPtr(JSValue::encode(JSValue())), Address(callFrameRegister, (registerOffset + RegisterFile::OptionalCalleeArguments) * static_cast<int>(sizeof(Register))));
     storePtr(regT2, Address(callFrameRegister, (registerOffset + RegisterFile::Callee) * static_cast<int>(sizeof(Register))));
-    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_scopeChain) + FIELD_OFFSET(ScopeChain, m_node)), regT1); // newScopeChain
+    loadPtr(Address(regT2, FIELD_OFFSET(JSFunction, m_data) + FIELD_OFFSET(ScopeChain, m_node)), regT1); // newScopeChain
     store32(Imm32(argCount), Address(callFrameRegister, (registerOffset + RegisterFile::ArgumentCount) * static_cast<int>(sizeof(Register))));
     storePtr(callFrameRegister, Address(callFrameRegister, (registerOffset + RegisterFile::CallerFrame) * static_cast<int>(sizeof(Register))));
     storePtr(regT1, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
     addPtr(Imm32(registerOffset * sizeof(Register)), callFrameRegister);
 
     // Call to the callee
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall(reinterpret_cast<void*>(0));
+    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
     
     if (opcodeID == op_call_eval)
         wasEval.link(this);
@@ -270,8 +281,7 @@
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
-        emitCTICall(JITStubs::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        JITStubCall(this, JITStubs::cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
         emitGetVirtualRegister(callee, regT2);
     }
 
@@ -286,7 +296,6 @@
 
     Jump storeResultForFirstRun = jump();
 
-// FIXME: this label can be removed, since it is a fixed offset from 'callReturnLocation'.
     // This is the address for the cold path *after* the first run (which tries to link the call).
     m_callStructureStubCompilationInfo[callLinkInfoIndex].coldPathOther = MacroAssembler::Label(this);
 
@@ -304,7 +313,8 @@
     isNotObject.link(this);
     callLinkFailNotObject.link(this);
     callLinkFailNotJSFunction.link(this);
-    emitCTICall(((opcodeID == op_construct) ? JITStubs::cti_op_construct_NotJSConstruct : JITStubs::cti_op_call_NotJSFunction));
+    JITStubCall stubCall(this, opcodeID == op_construct ? JITStubs::cti_op_construct_NotJSConstruct : JITStubs::cti_op_call_NotJSFunction);
+    stubCall.call();
     Jump wasNotJSFunction = jump();
 
     // Next, handle JSFunctions...
@@ -312,8 +322,8 @@
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
-        emitCTICall(JITStubs::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        JITStubCall stubCall(this, JITStubs::cti_op_construct_JSConstruct);
+        stubCall.call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
         emitGetVirtualRegister(callee, regT2);
     }
 
@@ -332,7 +342,9 @@
     sampleCodeBlock(m_codeBlock);
 }
 
-#endif
+/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
+
+#endif // !ENABLE(JIT_OPTIMIZE_CALL)
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/jit/JITCode.h b/JavaScriptCore/jit/JITCode.h
index 0490d0e..7ee644b 100644
--- a/JavaScriptCore/jit/JITCode.h
+++ b/JavaScriptCore/jit/JITCode.h
@@ -32,6 +32,7 @@
 
 #include "CallFrame.h"
 #include "JSValue.h"
+#include "MacroAssemblerCodeRef.h"
 #include "Profiler.h"
 
 namespace JSC {
@@ -39,31 +40,27 @@
     class JSGlobalData;
     class RegisterFile;
 
-    extern "C" {
-        JSValueEncodedAsPointer* ctiTrampoline(
-#if PLATFORM(X86_64)
-            // FIXME: (bug #22910) this will force all arguments onto the stack (regparm(0) does not appear to have any effect).
-            // We can allow register passing here, and move the writes of these values into the trampoline.
-            void*, void*, void*, void*, void*, void*,
-#endif
-            void* code, RegisterFile*, CallFrame*, JSValuePtr* exception, Profiler**, JSGlobalData*);
-    };
-
     class JITCode {
+        typedef MacroAssemblerCodeRef CodeRef;
+        typedef MacroAssemblerCodePtr CodePtr;
     public:
-        JITCode(void* code)
-            : code(code)
+        JITCode()
         {
         }
 
-        operator bool()
+        JITCode(const CodeRef ref)
+            : m_ref(ref)
         {
-            return code != 0;
         }
 
-        void* addressForCall()
+        bool operator !() const
         {
-            return code;
+            return !m_ref.m_code.executableAddress();
+        }
+
+        CodePtr addressForCall()
+        {
+            return m_ref.m_code;
         }
 
         // This function returns the offset in bytes of 'pointerIntoCode' into
@@ -71,23 +68,48 @@
         // block of code.  It is ASSERTed that no codeblock >4gb in size.
         unsigned offsetOf(void* pointerIntoCode)
         {
-            intptr_t result = reinterpret_cast<intptr_t>(pointerIntoCode) - reinterpret_cast<intptr_t>(code);
+            intptr_t result = reinterpret_cast<intptr_t>(pointerIntoCode) - reinterpret_cast<intptr_t>(m_ref.m_code.executableAddress());
             ASSERT(static_cast<intptr_t>(static_cast<unsigned>(result)) == result);
             return static_cast<unsigned>(result);
         }
 
         // Execute the code!
-        inline JSValuePtr execute(RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData, JSValuePtr* exception)
+        inline JSValue execute(RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData, JSValue* exception)
         {
-            return JSValuePtr::decode(ctiTrampoline(
+            return JSValue::decode(ctiTrampoline(
 #if PLATFORM(X86_64)
                 0, 0, 0, 0, 0, 0,
 #endif
-                code, registerFile, callFrame, exception, Profiler::enabledProfilerReference(), globalData));
+                m_ref.m_code.executableAddress(), registerFile, callFrame, exception, Profiler::enabledProfilerReference(), globalData));
+        }
+
+#ifndef NDEBUG
+        size_t size()
+        {
+            ASSERT(m_ref.m_code.executableAddress());
+            return m_ref.m_size;
+        }
+#endif
+
+        ExecutablePool* getExecutablePool()
+        {
+            return m_ref.m_executablePool.get();
+        }
+
+        // Host functions are a bit special; they have a m_code pointer but they
+        // do not individully ref the executable pool containing the trampoline.
+        static JITCode HostFunction(CodePtr code)
+        {
+            return JITCode(code.dataLocation(), 0, 0);
         }
 
     private:
-        void* code;
+        JITCode(void* code, PassRefPtr<ExecutablePool> executablePool, size_t size)
+            : m_ref(code, executablePool, size)
+        {
+        }
+
+        CodeRef m_ref;
     };
 
 };
diff --git a/JavaScriptCore/jit/JITInlineMethods.h b/JavaScriptCore/jit/JITInlineMethods.h
index 684c404..b3dc418 100644
--- a/JavaScriptCore/jit/JITInlineMethods.h
+++ b/JavaScriptCore/jit/JITInlineMethods.h
@@ -53,8 +53,8 @@
 
     // TODO: we want to reuse values that are already in registers if we can - add a register allocator!
     if (m_codeBlock->isConstantRegisterIndex(src)) {
-        JSValuePtr value = m_codeBlock->getConstant(src);
-        move(ImmPtr(JSValuePtr::encode(value)), dst);
+        JSValue value = m_codeBlock->getConstant(src);
+        move(ImmPtr(JSValue::encode(value)), dst);
         killLastResultRegister();
         return;
     }
@@ -112,7 +112,7 @@
     peek(dst, argumentNumber);
 }
 
-ALWAYS_INLINE JSValuePtr JIT::getConstantOperand(unsigned src)
+ALWAYS_INLINE JSValue JIT::getConstantOperand(unsigned src)
 {
     ASSERT(m_codeBlock->isConstantRegisterIndex(src));
     return m_codeBlock->getConstant(src);
@@ -132,8 +132,8 @@
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch)
 {
     if (m_codeBlock->isConstantRegisterIndex(src)) {
-        JSValuePtr value = m_codeBlock->getConstant(src);
-        emitPutJITStubArgConstant(JSValuePtr::encode(value), argumentNumber);
+        JSValue value = m_codeBlock->getConstant(src);
+        emitPutJITStubArgConstant(JSValue::encode(value), argumentNumber);
     } else {
         loadPtr(Address(callFrameRegister, src * sizeof(Register)), scratch);
         emitPutJITStubArg(scratch, argumentNumber);
@@ -142,22 +142,6 @@
     killLastResultRegister();
 }
 
-ALWAYS_INLINE void JIT::emitPutCTIParam(void* value, unsigned name)
-{
-    poke(ImmPtr(value), name);
-}
-
-ALWAYS_INLINE void JIT::emitPutCTIParam(RegisterID from, unsigned name)
-{
-    poke(from, name);
-}
-
-ALWAYS_INLINE void JIT::emitGetCTIParam(unsigned name, RegisterID to)
-{
-    peek(to, name);
-    killLastResultRegister();
-}
-
 ALWAYS_INLINE void JIT::emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
 {
     storePtr(from, Address(callFrameRegister, entry * sizeof(Register)));
@@ -168,9 +152,15 @@
     storePtr(ImmPtr(value), Address(callFrameRegister, entry * sizeof(Register)));
 }
 
-ALWAYS_INLINE void JIT::emitGetFromCallFrameHeader(RegisterFile::CallFrameHeaderEntry entry, RegisterID to)
+ALWAYS_INLINE void JIT::emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
 {
-    loadPtr(Address(callFrameRegister, entry * sizeof(Register)), to);
+    loadPtr(Address(from, entry * sizeof(Register)), to);
+    killLastResultRegister();
+}
+
+ALWAYS_INLINE void JIT::emitGetFromCallFrameHeader32(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
+{
+    load32(Address(from, entry * sizeof(Register)), to);
     killLastResultRegister();
 }
 
@@ -183,66 +173,79 @@
 
 ALWAYS_INLINE void JIT::emitInitRegister(unsigned dst)
 {
-    storePtr(ImmPtr(JSValuePtr::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
+    storePtr(ImmPtr(JSValue::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
     // FIXME: #ifndef NDEBUG, Write the correct m_type to the register.
 }
 
-ALWAYS_INLINE JIT::Call JIT::emitNakedCall(void* function)
+ALWAYS_INLINE JIT::Call JIT::emitNakedCall(CodePtr function)
 {
     ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
 
     Call nakedCall = nearCall();
-    m_calls.append(CallRecord(nakedCall, m_bytecodeIndex, function));
+    m_calls.append(CallRecord(nakedCall, m_bytecodeIndex, function.executableAddress()));
     return nakedCall;
 }
 
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
+#if PLATFORM(X86) || PLATFORM(X86_64)
+
+ALWAYS_INLINE void JIT::preverveReturnAddressAfterCall(RegisterID reg)
+{
+    pop(reg);
+}
+
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(RegisterID reg)
+{
+    push(reg);
+}
+
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
+{
+    push(address);
+}
+
+#elif PLATFORM(ARM_V7)
+
+ALWAYS_INLINE void JIT::preverveReturnAddressAfterCall(RegisterID reg)
+{
+    move(linkRegister, reg);
+}
+
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(RegisterID reg)
+{
+    move(reg, linkRegister);
+}
+
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
+{
+    loadPtr(address, linkRegister);
+}
+
+#endif
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+ALWAYS_INLINE void JIT::restoreArgumentReference()
+{
+    poke(callFrameRegister, offsetof(struct JITStackFrame, callFrame) / sizeof (void*));
+}
+ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline() {}
+#else
 ALWAYS_INLINE void JIT::restoreArgumentReference()
 {
     move(stackPointerRegister, firstArgumentRegister);
-    emitPutCTIParam(callFrameRegister, STUB_ARGS_callFrame);
+    poke(callFrameRegister, offsetof(struct JITStackFrame, callFrame) / sizeof (void*));
 }
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {
-    // In the trampoline on x86-64, the first argument register is not overwritten.
-#if !PLATFORM(X86_64)
+#if PLATFORM(X86)
+    // Within a trampoline the return address will be on the stack at this point.
+    addPtr(Imm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
+#elif PLATFORM(ARM_V7)
     move(stackPointerRegister, firstArgumentRegister);
-    addPtr(Imm32(sizeof(void*)), firstArgumentRegister);
 #endif
+    // In the trampoline on x86-64, the first argument register is not overwritten.
 }
-#elif USE(JIT_STUB_ARGUMENT_STACK)
-ALWAYS_INLINE void JIT::restoreArgumentReference()
-{
-    poke(stackPointerRegister);
-    emitPutCTIParam(callFrameRegister, STUB_ARGS_callFrame);
-}
-ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline() {}
-#else // JIT_STUB_ARGUMENT_VA_LIST
-ALWAYS_INLINE void JIT::restoreArgumentReference()
-{
-    emitPutCTIParam(callFrameRegister, STUB_ARGS_callFrame);
-}
-ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline() {}
 #endif
 
-ALWAYS_INLINE JIT::Call JIT::emitCTICall_internal(void* helper)
-{
-    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
-
-#if ENABLE(OPCODE_SAMPLING)
-    sampleInstruction(m_codeBlock->instructions().begin() + m_bytecodeIndex, true);
-#endif
-    restoreArgumentReference();
-    Call ctiCall = call();
-    m_calls.append(CallRecord(ctiCall, m_bytecodeIndex, helper));
-#if ENABLE(OPCODE_SAMPLING)
-    sampleInstruction(m_codeBlock->instructions().begin() + m_bytecodeIndex, false);
-#endif
-    killLastResultRegister();
-
-    return ctiCall;
-}
-
 ALWAYS_INLINE JIT::Jump JIT::checkStructure(RegisterID reg, Structure* structure)
 {
     return branchPtr(NotEqual, Address(reg, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(structure));
@@ -414,6 +417,66 @@
     jump.linkTo(m_labels[m_bytecodeIndex + relativeOffset], this);
 }
 
+#if ENABLE(SAMPLING_FLAGS)
+ALWAYS_INLINE void JIT::setSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    or32(Imm32(1u << (flag - 1)), AbsoluteAddress(&SamplingFlags::s_flags));
+}
+
+ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    and32(Imm32(~(1u << (flag - 1))), AbsoluteAddress(&SamplingFlags::s_flags));
+}
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS)
+ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t count)
+{
+#if PLATFORM(X86_64) // Or any other 64-bit plattform.
+    addPtr(Imm32(count), AbsoluteAddress(&counter.m_counter));
+#elif PLATFORM(X86) // Or any other little-endian 32-bit plattform.
+    intptr_t hiWord = reinterpret_cast<intptr_t>(&counter.m_counter) + sizeof(int32_t);
+    add32(Imm32(count), AbsoluteAddress(&counter.m_counter));
+    addWithCarry32(Imm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
+#else
+#error "SAMPLING_FLAGS not implemented on this platform."
+#endif
+}
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+#if PLATFORM(X86_64)
+ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
+{
+    move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86::ecx);
+    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86::ecx);
+}
+#else
+ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
+{
+    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), m_interpreter->sampler()->sampleSlot());
+}
+#endif
+#endif
+
+#if ENABLE(CODEBLOCK_SAMPLING)
+#if PLATFORM(X86_64)
+ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
+{
+    move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86::ecx);
+    storePtr(ImmPtr(codeBlock), X86::ecx);
+}
+#else
+ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
+{
+    storePtr(ImmPtr(codeBlock), m_interpreter->sampler()->codeBlockSlot());
+}
+#endif
+#endif
 }
 
 #endif // ENABLE(JIT)
diff --git a/JavaScriptCore/jit/JITOpcodes.cpp b/JavaScriptCore/jit/JITOpcodes.cpp
new file mode 100644
index 0000000..1737551
--- /dev/null
+++ b/JavaScriptCore/jit/JITOpcodes.cpp
@@ -0,0 +1,1183 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JIT.h"
+
+#if ENABLE(JIT)
+
+#include "JITInlineMethods.h"
+#include "JITStubCall.h"
+#include "JSArray.h"
+#include "JSCell.h"
+
+namespace JSC {
+
+#define RECORD_JUMP_TARGET(targetOffset) \
+   do { m_labels[m_bytecodeIndex + (targetOffset)].used(); } while (false)
+
+void JIT::emit_op_mov(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    if (m_codeBlock->isConstantRegisterIndex(src)) {
+        storePtr(ImmPtr(JSValue::encode(getConstantOperand(src))), Address(callFrameRegister, dst * sizeof(Register)));
+        if (dst == m_lastResultBytecodeRegister)
+            killLastResultRegister();
+    } else if ((src == m_lastResultBytecodeRegister) || (dst == m_lastResultBytecodeRegister)) {
+        // If either the src or dst is the cached register go though
+        // get/put registers to make sure we track this correctly.
+        emitGetVirtualRegister(src, regT0);
+        emitPutVirtualRegister(dst);
+    } else {
+        // Perform the copy via regT1; do not disturb any mapping in regT0.
+        loadPtr(Address(callFrameRegister, src * sizeof(Register)), regT1);
+        storePtr(regT1, Address(callFrameRegister, dst * sizeof(Register)));
+    }
+}
+
+void JIT::emit_op_end(Instruction* currentInstruction)
+{
+    if (m_codeBlock->needsFullScopeChain())
+        JITStubCall(this, JITStubs::cti_op_end).call();
+    ASSERT(returnValueRegister != callFrameRegister);
+    emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
+    restoreReturnAddressBeforeReturn(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));
+    ret();
+}
+
+void JIT::emit_op_jmp(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[1].u.operand;
+    addJump(jump(), target + 1);
+    RECORD_JUMP_TARGET(target + 1);
+}
+
+void JIT::emit_op_loop(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned target = currentInstruction[1].u.operand;
+    addJump(jump(), target + 1);
+}
+
+void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
+#else
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
+#endif
+        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target + 3);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+        addJump(branch32(LessThan, regT0, regT1), target + 3);
+    }
+}
+
+void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(LessThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+        addJump(branch32(LessThanOrEqual, regT0, regT1), target + 3);
+    }
+}
+
+void JIT::emit_op_new_object(Instruction* currentInstruction)
+{
+    JITStubCall(this, JITStubs::cti_op_new_object).call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_instanceof(Instruction* currentInstruction)
+{
+    // Load the operands (baseVal, proto, and value respectively) into registers.
+    // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    emitGetVirtualRegister(currentInstruction[4].u.operand, regT1);
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT2);
+
+    // Check that baseVal & proto are cells.
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    emitJumpSlowCaseIfNotJSCell(regT1);
+
+    // Check that baseVal is an object, that it 'ImplementsHasInstance' but that it does not 'OverridesHasInstance'.
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT0);
+    addSlowCase(branch32(NotEqual, Address(regT0, FIELD_OFFSET(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    addSlowCase(branchTest32(Zero, Address(regT0, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+
+    // If value is not an Object, return false.
+    Jump valueIsImmediate = emitJumpIfNotJSCell(regT2);
+    loadPtr(Address(regT2, FIELD_OFFSET(JSCell, m_structure)), regT0);
+    Jump valueIsNotObject = branch32(NotEqual, Address(regT0, FIELD_OFFSET(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
+
+    // Check proto is object.
+    loadPtr(Address(regT1, FIELD_OFFSET(JSCell, m_structure)), regT0);
+    addSlowCase(branch32(NotEqual, Address(regT0, FIELD_OFFSET(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+
+    // Optimistically load the result true, and start looping.
+    // Initially, regT1 still contains proto and regT2 still contains value.
+    // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
+    move(ImmPtr(JSValue::encode(jsBoolean(true))), regT0);
+    Label loop(this);
+
+    // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
+    // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
+    loadPtr(Address(regT2, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    loadPtr(Address(regT2, FIELD_OFFSET(Structure, m_prototype)), regT2);
+    Jump isInstance = branchPtr(Equal, regT2, regT1);
+    branchPtr(NotEqual, regT2, ImmPtr(JSValue::encode(jsNull())), loop);
+
+    // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
+    valueIsImmediate.link(this);
+    valueIsNotObject.link(this);
+    move(ImmPtr(JSValue::encode(jsBoolean(false))), regT0);
+
+    // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
+    isInstance.link(this);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_new_func(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_func);
+    stubCall.addArgument(ImmPtr(m_codeBlock->function(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_call(Instruction* currentInstruction)
+{
+    compileOpCall(op_call, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_call_eval(Instruction* currentInstruction)
+{
+    compileOpCall(op_call_eval, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_load_varargs(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_load_varargs);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_call_varargs(Instruction* currentInstruction)
+{
+    compileOpCallVarargs(currentInstruction);
+}
+
+void JIT::emit_op_construct(Instruction* currentInstruction)
+{
+    compileOpCall(op_construct, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_get_global_var(Instruction* currentInstruction)
+{
+    JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[2].u.jsCell);
+    move(ImmPtr(globalObject), regT0);
+    emitGetVariableObjectRegister(regT0, currentInstruction[3].u.operand, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_put_global_var(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT1);
+    JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[1].u.jsCell);
+    move(ImmPtr(globalObject), regT0);
+    emitPutVariableObjectRegister(regT1, regT0, currentInstruction[2].u.operand);
+}
+
+void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
+{
+    int skip = currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain();
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT0);
+    while (skip--)
+        loadPtr(Address(regT0, FIELD_OFFSET(ScopeChainNode, next)), regT0);
+
+    loadPtr(Address(regT0, FIELD_OFFSET(ScopeChainNode, object)), regT0);
+    emitGetVariableObjectRegister(regT0, currentInstruction[2].u.operand, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
+{
+    int skip = currentInstruction[2].u.operand + m_codeBlock->needsFullScopeChain();
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1);
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    while (skip--)
+        loadPtr(Address(regT1, FIELD_OFFSET(ScopeChainNode, next)), regT1);
+
+    loadPtr(Address(regT1, FIELD_OFFSET(ScopeChainNode, object)), regT1);
+    emitPutVariableObjectRegister(regT0, regT1, currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_tear_off_activation(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_tear_off_activation);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.call();
+}
+
+void JIT::emit_op_tear_off_arguments(Instruction*)
+{
+    JITStubCall(this, JITStubs::cti_op_tear_off_arguments).call();
+}
+
+void JIT::emit_op_ret(Instruction* currentInstruction)
+{
+    // We could JIT generate the deref, only calling out to C when the refcount hits zero.
+    if (m_codeBlock->needsFullScopeChain())
+        JITStubCall(this, JITStubs::cti_op_ret_scopeChain).call();
+
+    ASSERT(callFrameRegister != regT1);
+    ASSERT(regT1 != returnValueRegister);
+    ASSERT(returnValueRegister != callFrameRegister);
+
+    // Return the result in %eax.
+    emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
+
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+
+    // Restore our caller's "r".
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+
+    // Return.
+    restoreReturnAddressBeforeReturn(regT1);
+    ret();
+}
+
+void JIT::emit_op_new_array(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_array);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_construct_verify(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    addSlowCase(branch32(NotEqual, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
+
+}
+
+void JIT::emit_op_to_primitive(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    
+    Jump isImm = emitJumpIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
+    isImm.link(this);
+
+    if (dst != src)
+        emitPutVirtualRegister(dst);
+
+}
+
+void JIT::emit_op_strcat(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_strcat);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_func(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_func);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.call(currentInstruction[2].u.operand);
+}
+
+void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned target = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
+    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
+
+    isZero.link(this);
+};
+void JIT::emit_op_resolve_base(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_skip(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_skip);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain()));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_global(Instruction* currentInstruction)
+{
+    // Fast case
+    void* globalObject = currentInstruction[2].u.jsCell;
+    Identifier* ident = &m_codeBlock->identifier(currentInstruction[3].u.operand);
+    
+    unsigned currentIndex = m_globalResolveInfoIndex++;
+    void* structureAddress = &(m_codeBlock->globalResolveInfo(currentIndex).structure);
+    void* offsetAddr = &(m_codeBlock->globalResolveInfo(currentIndex).offset);
+
+    // Check Structure of global object
+    move(ImmPtr(globalObject), regT0);
+    loadPtr(structureAddress, regT1);
+    Jump noMatch = branchPtr(NotEqual, regT1, Address(regT0, FIELD_OFFSET(JSCell, m_structure))); // Structures don't match
+
+    // Load cached property
+    // Assume that the global object always uses external storage.
+    loadPtr(Address(regT0, FIELD_OFFSET(JSGlobalObject, m_externalStorage)), regT0);
+    load32(offsetAddr, regT1);
+    loadPtr(BaseIndex(regT0, regT1, ScalePtr), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    Jump end = jump();
+
+    // Slow case
+    noMatch.link(this);
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_global);
+    stubCall.addArgument(ImmPtr(globalObject));
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(Imm32(currentIndex));
+    stubCall.call(currentInstruction[1].u.operand);
+    end.link(this);
+}
+
+void JIT::emit_op_not(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
+    addSlowCase(branchTestPtr(NonZero, regT0, Imm32(static_cast<int32_t>(~JSImmediate::ExtendedPayloadBitBoolValue))));
+    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool | JSImmediate::ExtendedPayloadBitBoolValue)), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jfalse(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))), target + 2);
+    Jump isNonZero = emitJumpIfImmediateInteger(regT0);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target + 2);
+    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))));
+
+    isNonZero.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+};
+void JIT::emit_op_jeq_null(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    addJump(branchTest32(NonZero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    Jump wasNotImmediate = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+
+    wasNotImmediate.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+};
+void JIT::emit_op_jneq_null(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    addJump(branchTest32(Zero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    Jump wasNotImmediate = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+
+    wasNotImmediate.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+}
+
+void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    JSCell* ptr = currentInstruction[2].u.jsCell;
+    unsigned target = currentInstruction[3].u.operand;
+    
+    emitGetVirtualRegister(src, regT0);
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue(ptr)))), target + 3);            
+
+    RECORD_JUMP_TARGET(target + 3);
+}
+
+void JIT::emit_op_unexpected_load(Instruction* currentInstruction)
+{
+    JSValue v = m_codeBlock->unexpectedConstant(currentInstruction[2].u.operand);
+    move(ImmPtr(JSValue::encode(v)), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jsr(Instruction* currentInstruction)
+{
+    int retAddrDst = currentInstruction[1].u.operand;
+    int target = currentInstruction[2].u.operand;
+    DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
+    addJump(jump(), target + 2);
+    m_jsrSites.append(JSRInfo(storeLocation, label()));
+    killLastResultRegister();
+    RECORD_JUMP_TARGET(target + 2);
+}
+
+void JIT::emit_op_sret(Instruction* currentInstruction)
+{
+    jump(Address(callFrameRegister, sizeof(Register) * currentInstruction[1].u.operand));
+    killLastResultRegister();
+}
+
+void JIT::emit_op_eq(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    set32(Equal, regT1, regT0, regT0);
+    emitTagAsBoolImmediate(regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_bitnot(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    not32(regT0);
+    emitFastArithIntToImmNoCheck(regT0, regT0);
+#else
+    xorPtr(Imm32(~JSImmediate::TagTypeNumber), regT0);
+#endif
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_with_base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.call(currentInstruction[2].u.operand);
+}
+
+void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_func_exp);
+    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpression(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jtrue(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
+    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
+
+    isZero.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+}
+
+void JIT::emit_op_neq(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    set32(NotEqual, regT1, regT0, regT0);
+    emitTagAsBoolImmediate(regT0);
+
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+
+}
+
+void JIT::emit_op_bitxor(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    xorPtr(regT1, regT0);
+    emitFastArithReTagImmediate(regT0, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_new_regexp(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_regexp);
+    stubCall.addArgument(ImmPtr(m_codeBlock->regexp(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_bitor(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    orPtr(regT1, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_throw(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_throw);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.call();
+    ASSERT(regT0 == returnValueRegister);
+#ifndef NDEBUG
+    // cti_op_throw always changes it's return address,
+    // this point in the code should never be reached.
+    breakpoint();
+#endif
+}
+
+void JIT::emit_op_next_pname(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_next_pname);
+    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    stubCall.call();
+    Jump endOfIter = branchTestPtr(Zero, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    addJump(jump(), currentInstruction[3].u.operand + 3);
+    endOfIter.link(this);
+}
+
+void JIT::emit_op_push_scope(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_push_scope);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_pop_scope(Instruction*)
+{
+    JITStubCall(this, JITStubs::cti_op_pop_scope).call();
+}
+
+void JIT::emit_op_stricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpStrictEq);
+}
+
+void JIT::emit_op_nstricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpNStrictEq);
+}
+
+void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
+{
+    int srcVReg = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(srcVReg, regT0);
+    
+    Jump wasImmediate = emitJumpIfImmediateInteger(regT0);
+
+    emitJumpSlowCaseIfNotJSCell(regT0, srcVReg);
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    addSlowCase(branch32(NotEqual, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
+    
+    wasImmediate.link(this);
+
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_push_new_scope);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_catch(Instruction* currentInstruction)
+{
+    killLastResultRegister(); // FIXME: Implicitly treat op_catch as a labeled statement, and remove this line of code.
+    peek(callFrameRegister, offsetof(struct JITStackFrame, callFrame) / sizeof (void*));
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_jmp_scopes);
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.call();
+    addJump(jump(), currentInstruction[2].u.operand + 2);
+    RECORD_JUMP_TARGET(currentInstruction[2].u.operand + 2);
+}
+
+void JIT::emit_op_switch_imm(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->immediateSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Immediate));
+    jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
+
+    JITStubCall stubCall(this, JITStubs::cti_op_switch_imm);
+    stubCall.addArgument(scrutinee, regT2);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_switch_char(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->characterSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Character));
+    jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
+
+    JITStubCall stubCall(this, JITStubs::cti_op_switch_char);
+    stubCall.addArgument(scrutinee, regT2);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_switch_string(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    StringJumpTable* jumpTable = &m_codeBlock->stringSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset));
+
+    JITStubCall stubCall(this, JITStubs::cti_op_switch_string);
+    stubCall.addArgument(scrutinee, regT2);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_new_error(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_error);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(ImmPtr(JSValue::encode(m_codeBlock->unexpectedConstant(currentInstruction[3].u.operand))));
+    stubCall.addArgument(Imm32(m_bytecodeIndex));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_debug(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_debug);
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call();
+}
+
+void JIT::emit_op_eq_null(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src1, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    setTest32(NonZero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    setPtr(Equal, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
+
+    wasNotImmediate.link(this);
+
+    emitTagAsBoolImmediate(regT0);
+    emitPutVirtualRegister(dst);
+
+}
+
+void JIT::emit_op_neq_null(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src1, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
+    setTest32(Zero, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    setPtr(NotEqual, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
+
+    wasNotImmediate.link(this);
+
+    emitTagAsBoolImmediate(regT0);
+    emitPutVirtualRegister(dst);
+
+}
+
+void JIT::emit_op_enter(Instruction*)
+{
+    // Even though CTI doesn't use them, we initialize our constant
+    // registers to zap stale pointers, to avoid unnecessarily prolonging
+    // object lifetime and increasing GC pressure.
+    size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
+    for (size_t j = 0; j < count; ++j)
+        emitInitRegister(j);
+
+}
+
+void JIT::emit_op_enter_with_activation(Instruction* currentInstruction)
+{
+    // Even though CTI doesn't use them, we initialize our constant
+    // registers to zap stale pointers, to avoid unnecessarily prolonging
+    // object lifetime and increasing GC pressure.
+    size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
+    for (size_t j = 0; j < count; ++j)
+        emitInitRegister(j);
+
+    JITStubCall(this, JITStubs::cti_op_push_activation).call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_create_arguments(Instruction*)
+{
+    Jump argsCreated = branchTestPtr(NonZero, Address(callFrameRegister, sizeof(Register) * RegisterFile::ArgumentsRegister));
+    if (m_codeBlock->m_numParameters == 1)
+        JITStubCall(this, JITStubs::cti_op_create_arguments_no_params).call();
+    else
+        JITStubCall(this, JITStubs::cti_op_create_arguments).call();
+    argsCreated.link(this);
+}
+    
+void JIT::emit_op_init_arguments(Instruction*)
+{
+    storePtr(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * RegisterFile::ArgumentsRegister));
+}
+
+void JIT::emit_op_convert_this(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT1);
+    addSlowCase(branchTest32(NonZero, Address(regT1, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+
+}
+
+void JIT::emit_op_profile_will_call(Instruction* currentInstruction)
+{
+    peek(regT1, FIELD_OFFSET(JITStackFrame, enabledProfilerReference) / sizeof (void*));
+    Jump noProfiler = branchTestPtr(Zero, Address(regT1));
+
+    JITStubCall stubCall(this, JITStubs::cti_op_profile_will_call);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT1);
+    stubCall.call();
+    noProfiler.link(this);
+
+}
+
+void JIT::emit_op_profile_did_call(Instruction* currentInstruction)
+{
+    peek(regT1, FIELD_OFFSET(JITStackFrame, enabledProfilerReference) / sizeof (void*));
+    Jump noProfiler = branchTestPtr(Zero, Address(regT1));
+
+    JITStubCall stubCall(this, JITStubs::cti_op_profile_did_call);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT1);
+    stubCall.call();
+    noProfiler.link(this);
+}
+
+
+// Slow cases
+
+void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_convert_this);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_construct_verify(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, JITStubs::cti_op_to_primitive);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    // The slow void JIT::emitSlow_that handles accesses to arrays (below) may jump back up to here. 
+    Label beginGetByValSlow(this);
+
+    Jump notImm = getSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    emitFastArithIntToImmNoCheck(regT1, regT1);
+
+    notImm.link(this);
+    JITStubCall stubCall(this, JITStubs::cti_op_get_by_val);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
+
+    // This is slow void JIT::emitSlow_that handles accesses to arrays above the fast cut-off.
+    // First, check if this is an access to the vector
+    linkSlowCase(iter);
+    branch32(AboveOrEqual, regT1, Address(regT2, FIELD_OFFSET(ArrayStorage, m_vectorLength)), beginGetByValSlow);
+
+    // okay, missed the fast region, but it is still in the vector.  Get the value.
+    loadPtr(BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])), regT2);
+    // Check whether the value loaded is zero; if so we need to return undefined.
+    branchTestPtr(Zero, regT2, beginGetByValSlow);
+    move(regT2, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
+}
+
+void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT0);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    } else {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    }
+}
+
+void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_lesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    } else {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_lesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    }
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    // Normal slow cases - either is not an immediate imm, or is an array.
+    Jump notImm = getSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    emitFastArithIntToImmNoCheck(regT1, regT1);
+
+    notImm.link(this); {
+        JITStubCall stubCall(this, JITStubs::cti_op_put_by_val);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_put_by_val));
+    }
+
+    // slow cases for immediate int accesses to arrays
+    linkSlowCase(iter);
+    linkSlowCase(iter); {
+        JITStubCall stubCall(this, JITStubs::cti_op_put_by_val_array);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+        stubCall.call();
+    }
+}
+
+void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    stubCall.addArgument(regT0);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+}
+
+void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
+    JITStubCall stubCall(this, JITStubs::cti_op_not);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    stubCall.addArgument(regT0);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand + 2); // inverted!
+}
+
+void JIT::emitSlow_op_bitnot(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_bitnot);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    stubCall.addArgument(regT0);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+}
+
+void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_bitxor);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_bitor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_bitor);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_eq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_neq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_stricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_stricteq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_nstricteq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_instanceof);
+    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.addArgument(currentInstruction[4].u.operand, regT2);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_call(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_call);
+}
+
+void JIT::emitSlow_op_call_eval(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_call_eval);
+}
+
+void JIT::emitSlow_op_call_varargs(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallVarargsSlowCase(currentInstruction, iter);
+}
+
+void JIT::emitSlow_op_construct(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_construct);
+}
+
+void JIT::emitSlow_op_to_jsnumber(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCaseIfNotJSCell(iter, currentInstruction[2].u.operand);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, JITStubs::cti_op_to_jsnumber);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/JavaScriptCore/jit/JITPropertyAccess.cpp b/JavaScriptCore/jit/JITPropertyAccess.cpp
index ce90ee4..3a6f9b3 100644
--- a/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -30,6 +30,7 @@
 
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -44,59 +45,240 @@
 
 namespace JSC {
 
-#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-void JIT::compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier* ident, unsigned)
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 {
-    // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
-    // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
-    // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
-    // to jump back to if one of these trampolies finds a match.
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
+    // We check the value as if it was a uint32 against the m_fastAccessCutoff - which will always fail if
+    // number was signed since m_fastAccessCutoff is always less than intmax (since the total allocation
+    // size is always less than 4Gb).  As such zero extending wil have been correct (and extending the value
+    // to 64-bits is necessary since it's used in the address calculation.  We zero extend rather than sign
+    // extending since it makes it easier to re-tag the value in the slow case.
+    zeroExtend32ToPtr(regT1, regT1);
+#else
+    emitFastArithImmToInt(regT1);
+#endif
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
 
-    emitGetVirtualRegister(baseVReg, regT0);
+    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
+    loadPtr(Address(regT0, FIELD_OFFSET(JSArray, m_storage)), regT2);
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, FIELD_OFFSET(JSArray, m_fastAccessCutoff))));
 
-    emitPutJITStubArg(regT0, 1);
-    emitPutJITStubArgConstant(ident, 2);
-    emitCTICall(JITStubs::cti_op_get_by_id_generic);
-    emitPutVirtualRegister(resultVReg);
+    // Get the value from the vector
+    loadPtr(BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[1].u.operand, regT0, currentInstruction[2].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    // See comment in op_get_by_val.
+    zeroExtend32ToPtr(regT1, regT1);
+#else
+    emitFastArithImmToInt(regT1);
+#endif
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+
+    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
+    loadPtr(Address(regT0, FIELD_OFFSET(JSArray, m_storage)), regT2);
+    Jump inFastVector = branch32(Below, regT1, Address(regT0, FIELD_OFFSET(JSArray, m_fastAccessCutoff)));
+    // No; oh well, check if the access if within the vector - if so, we may still be okay.
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT2, FIELD_OFFSET(ArrayStorage, m_vectorLength))));
+
+    // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
+    // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
+    addSlowCase(branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0]))));
+
+    // All good - put the value into the array.
+    inFastVector.link(this);
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    storePtr(regT0, BaseIndex(regT2, regT1, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])));
+}
+
+void JIT::emit_op_put_by_index(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_put_by_index);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call();
+}
+
+void JIT::emit_op_put_getter(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_put_getter);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call();
+}
+
+void JIT::emit_op_put_setter(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_put_setter);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call();
+}
+
+void JIT::emit_op_del_by_id(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_del_by_id);
+    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
 }
 
 
-void JIT::compileGetByIdSlowCase(int, int, Identifier*, Vector<SlowCaseEntry>::iterator&, unsigned)
+#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+#error "JIT_OPTIMIZE_METHOD_CALLS requires JIT_OPTIMIZE_PROPERTY_ACCESS"
+#endif
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitGetVirtualRegister(baseVReg, regT0);
+    JITStubCall stubCall(this, JITStubs::cti_op_get_by_id_generic);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.call(resultVReg);
+
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
 {
     ASSERT_NOT_REACHED();
 }
 
-void JIT::compilePutByIdHotPath(int baseVReg, Identifier* ident, int valueVReg, unsigned)
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 {
-    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
-    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
-    // such that the Structure & offset are always at the same distance from this.
+    unsigned baseVReg = currentInstruction[1].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
+    unsigned valueVReg = currentInstruction[3].u.operand;
 
     emitGetVirtualRegisters(baseVReg, regT0, valueVReg, regT1);
 
-    emitPutJITStubArgConstant(ident, 2);
-    emitPutJITStubArg(regT0, 1);
-    emitPutJITStubArg(regT1, 3);
-    emitCTICall(JITStubs::cti_op_put_by_id_generic);
+    JITStubCall stubCall(this, JITStubs::cti_op_put_by_id_generic);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(regT1);
+    stubCall.call();
+
+    m_propertyAccessInstructionIndex++;
 }
 
-void JIT::compilePutByIdSlowCase(int, Identifier*, int, Vector<SlowCaseEntry>::iterator&, unsigned)
+void JIT::emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
 {
     ASSERT_NOT_REACHED();
 }
 
-#else
+#else // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
-void JIT::compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier*, unsigned propertyAccessInstructionIndex)
+/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+void JIT::emit_op_method_check(Instruction* currentInstruction)
+{
+    // Assert that the following instruction is a get_by_id.
+    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
+
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitGetVirtualRegister(baseVReg, regT0);
+
+    // Do the method check - check the object & its prototype's structure inline (this is the common case).
+    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
+    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
+    Jump notCell = emitJumpIfNotJSCell(regT0);
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, FIELD_OFFSET(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT1);
+    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT1, FIELD_OFFSET(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+
+    // This will be relinked to load the function without doing a load.
+    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+    Jump match = jump();
+
+    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
+    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
+    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
+
+    // Link the failure cases here.
+    notCell.link(this);
+    structureCheck.link(this);
+    protoStructureCheck.link(this);
+
+    // Do a regular(ish) get_by_id (the slow case will be link to
+    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
+    compileGetByIdHotPath(resultVReg, baseVReg, ident, m_propertyAccessInstructionIndex++);
+
+    match.link(this);
+    emitPutVirtualRegister(resultVReg);
+
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, m_propertyAccessInstructionIndex++, true);
+
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+#else //!ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+
+#endif
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitGetVirtualRegister(baseVReg, regT0);
+    compileGetByIdHotPath(resultVReg, baseVReg, ident, m_propertyAccessInstructionIndex++);
+    emitPutVirtualRegister(resultVReg);
+}
+
+void JIT::compileGetByIdHotPath(int, int baseVReg, Identifier*, unsigned propertyAccessInstructionIndex)
 {
     // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
     // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
     // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
     // to jump back to if one of these trampolies finds a match.
 
-    emitGetVirtualRegister(baseVReg, regT0);
-
     emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
 
     Label hotPathBegin(this);
@@ -108,17 +290,28 @@
     ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
     ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
 
-    loadPtr(Address(regT0, FIELD_OFFSET(JSObject, m_propertyStorage)), regT0);
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, FIELD_OFFSET(JSObject, m_externalStorage)), regT0);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
+
     DataLabel32 displacementLabel = loadPtrWithAddressOffsetPatch(Address(regT0, patchGetByIdDefaultOffset), regT0);
     ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetGetByIdPropertyMapOffset);
 
     Label putResult(this);
     ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
-    emitPutVirtualRegister(resultVReg);
 }
 
+void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
 
-void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex)
+    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, m_propertyAccessInstructionIndex++, false);
+}
+
+void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex, bool isMethodCheck)
 {
     // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
     // so that we only need track one pointer into the slow case code - we track a pointer to the location
@@ -132,10 +325,10 @@
 #ifndef NDEBUG
     Label coldPathBegin(this);
 #endif
-    emitPutJITStubArg(regT0, 1);
-    emitPutJITStubArgConstant(ident, 2);
-    Call call = emitCTICall(JITStubs::cti_op_get_by_id);
-    emitPutVirtualRegister(resultVReg);
+    JITStubCall stubCall(this, isMethodCheck ? JITStubs::cti_op_get_by_id_method_check : JITStubs::cti_op_get_by_id);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    Call call = stubCall.call(resultVReg);
 
     ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
 
@@ -143,8 +336,13 @@
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].callReturnLocation = call;
 }
 
-void JIT::compilePutByIdHotPath(int baseVReg, Identifier*, int valueVReg, unsigned propertyAccessInstructionIndex)
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 {
+    unsigned baseVReg = currentInstruction[1].u.operand;
+    unsigned valueVReg = currentInstruction[3].u.operand;
+
+    unsigned propertyAccessInstructionIndex = m_propertyAccessInstructionIndex++;
+
     // In order to be able to patch both the Structure, and the object offset, we store one pointer,
     // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
     // such that the Structure & offset are always at the same distance from this.
@@ -163,34 +361,64 @@
     ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
 
     // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
-    loadPtr(Address(regT0, FIELD_OFFSET(JSObject, m_propertyStorage)), regT0);
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, FIELD_OFFSET(JSObject, m_externalStorage)), regT0);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
+
     DataLabel32 displacementLabel = storePtrWithAddressOffsetPatch(regT1, Address(regT0, patchGetByIdDefaultOffset));
     ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetPutByIdPropertyMapOffset);
 }
 
-void JIT::compilePutByIdSlowCase(int baseVReg, Identifier* ident, int, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex)
+void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned baseVReg = currentInstruction[1].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
+
+    unsigned propertyAccessInstructionIndex = m_propertyAccessInstructionIndex++;
+
     linkSlowCaseIfNotJSCell(iter, baseVReg);
     linkSlowCase(iter);
 
-    emitPutJITStubArgConstant(ident, 2);
-    emitPutJITStubArg(regT0, 1);
-    emitPutJITStubArg(regT1, 3);
-    Call call = emitCTICall(JITStubs::cti_op_put_by_id);
+    JITStubCall stubCall(this, JITStubs::cti_op_put_by_id);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(regT1);
+    Call call = stubCall.call();
 
     // Track the location of the call; this will be used to recover patch information.
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].callReturnLocation = call;
 }
 
-static JSObject* resizePropertyStorage(JSObject* baseObject, int32_t oldSize, int32_t newSize)
+// Compile a store into an object's property storage.  May overwrite the
+// value in objectReg.
+void JIT::compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset)
 {
-    baseObject->allocatePropertyStorage(oldSize, newSize);
-    return baseObject;
+    int offset = cachedOffset * sizeof(JSValue);
+    if (structure->isUsingInlineStorage())
+        offset += FIELD_OFFSET(JSObject, m_inlineStorage);
+    else
+        loadPtr(Address(base, FIELD_OFFSET(JSObject, m_externalStorage)), base);
+    storePtr(value, Address(base, offset));
 }
 
-static inline bool transitionWillNeedStorageRealloc(Structure* oldStructure, Structure* newStructure)
+// Compile a load from an object's property storage.  May overwrite base.
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset)
 {
-    return oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
+    int offset = cachedOffset * sizeof(JSValue);
+    if (structure->isUsingInlineStorage())
+        offset += FIELD_OFFSET(JSObject, m_inlineStorage);
+    else
+        loadPtr(Address(base, FIELD_OFFSET(JSObject, m_externalStorage)), base);
+    loadPtr(Address(base, offset), result);
+}
+
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID result, size_t cachedOffset)
+{
+    if (base->isUsingInlineStorage())
+        loadPtr(static_cast<void*>(&base->m_inlineStorage[cachedOffset]), result);
+    else
+        loadPtr(static_cast<void*>(&base->m_externalStorage[cachedOffset]), result);
 }
 
 void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ProcessorReturnAddress returnAddress)
@@ -201,7 +429,7 @@
     failureCases.append(branchPtr(NotEqual, Address(regT0, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(oldStructure)));
     JumpList successCases;
 
-    //  ecx = baseObject
+    // ecx = baseObject
     loadPtr(Address(regT0, FIELD_OFFSET(JSCell, m_structure)), regT2);
     // proto(ecx) = baseObject->structure()->prototype()
     failureCases.append(branch32(NotEqual, Address(regT2, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
@@ -211,7 +439,7 @@
     // ecx = baseObject->m_structure
     for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
         // null check the prototype
-        successCases.append(branchPtr(Equal, regT2, ImmPtr(JSValuePtr::encode(jsNull()))));
+        successCases.append(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNull()))));
 
         // Check the structure id
         failureCases.append(branchPtr(NotEqual, Address(regT2, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(it->get())));
@@ -226,23 +454,21 @@
     Call callTarget;
 
     // emit a call only if storage realloc is needed
-    bool willNeedStorageRealloc = transitionWillNeedStorageRealloc(oldStructure, newStructure);
+    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
     if (willNeedStorageRealloc) {
-        pop(X86::ebx);
-#if PLATFORM(X86_64)
-        move(Imm32(newStructure->propertyStorageCapacity()), regT1);
-        move(Imm32(oldStructure->propertyStorageCapacity()), X86::esi);
-        move(regT0, X86::edi);
-        callTarget = call();
-#else
-        push(Imm32(newStructure->propertyStorageCapacity()));
-        push(Imm32(oldStructure->propertyStorageCapacity()));
-        push(regT0);
-        callTarget = call();
-        addPtr(Imm32(3 * sizeof(void*)), X86::esp);
-#endif
-        emitGetJITStubArg(3, regT1);
-        push(X86::ebx);
+        // This trampoline was called to like a JIT stub; before we can can call again we need to
+        // remove the return address from the stack, to prevent the stack from becoming misaligned.
+        preverveReturnAddressAfterCall(regT3);
+ 
+        JITStubCall stubCall(this, JITStubs::cti_op_put_by_id_transition_realloc);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
+        stubCall.addArgument(regT1); // This argument is not used in the stub; we set it up on the stack so that it can be restored, below.
+        stubCall.call(regT0);
+        emitGetJITStubArg(4, regT1);
+
+        restoreReturnAddressBeforeReturn(regT3);
     }
 
     // Assumes m_refCount can be decremented easily, refcount decrement is safe as 
@@ -252,8 +478,7 @@
     storePtr(ImmPtr(newStructure), Address(regT0, FIELD_OFFSET(JSCell, m_structure)));
 
     // write the value
-    loadPtr(Address(regT0, FIELD_OFFSET(JSObject, m_propertyStorage)), regT0);
-    storePtr(regT1, Address(regT0, cachedOffset * sizeof(JSValuePtr)));
+    compilePutDirectOffset(regT0, regT1, newStructure, cachedOffset);
 
     ret();
     
@@ -262,47 +487,74 @@
     restoreArgumentReferenceForTrampoline();
     Call failureCall = tailRecursiveCall();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
-    patchBuffer.link(failureCall, JITStubs::cti_op_put_by_id_fail);
+    patchBuffer.link(failureCall, FunctionPtr(JITStubs::cti_op_put_by_id_fail));
 
-    if (willNeedStorageRealloc)
-        patchBuffer.link(callTarget, resizePropertyStorage);
+    if (willNeedStorageRealloc) {
+        ASSERT(m_calls.size() == 1);
+        patchBuffer.link(m_calls[0].from, FunctionPtr(JITStubs::cti_op_put_by_id_transition_realloc));
+    }
     
-    stubInfo->stubRoutine = patchBuffer.entry();
-
-    returnAddress.relinkCallerToFunction(code);
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    returnAddress.relinkCallerToTrampoline(entryLabel);
 }
 
 void JIT::patchGetByIdSelf(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ProcessorReturnAddress returnAddress)
 {
     // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
     // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
-    returnAddress.relinkCallerToFunction(JITStubs::cti_op_get_by_id_self_fail);
+    returnAddress.relinkCallerToFunction(FunctionPtr(JITStubs::cti_op_get_by_id_self_fail));
+
+    int offset = sizeof(JSValue) * cachedOffset;
+
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad).repatchLoadPtrToLEA();
 
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure).repatch(structure);
-    stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset).repatch(cachedOffset * sizeof(JSValuePtr));
+    stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset).repatch(offset);
+}
+
+void JIT::patchMethodCallProto(MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto)
+{
+    ASSERT(!methodCallLinkInfo.cachedStructure);
+    methodCallLinkInfo.cachedStructure = structure;
+    structure->ref();
+
+    methodCallLinkInfo.structureLabel.repatch(structure);
+    methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj).repatch(proto);
+    methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct).repatch(proto->structure());
+    methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction).repatch(callee);
 }
 
 void JIT::patchPutByIdReplace(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ProcessorReturnAddress returnAddress)
 {
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
     // Should probably go to JITStubs::cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
-    returnAddress.relinkCallerToFunction(JITStubs::cti_op_put_by_id_generic);
+    returnAddress.relinkCallerToFunction(FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+
+    int offset = sizeof(JSValue) * cachedOffset;
+
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad).repatchLoadPtrToLEA();
 
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure).repatch(structure);
-    stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset).repatch(cachedOffset * sizeof(JSValuePtr));
+    stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset).repatch(offset);
 }
 
 void JIT::privateCompilePatchGetArrayLength(ProcessorReturnAddress returnAddress)
 {
-    StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
+    StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress.addressForLookup());
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    returnAddress.relinkCallerToFunction(JITStubs::cti_op_get_by_id_array_fail);
+    returnAddress.relinkCallerToFunction(FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
 
     // Check eax is an array
     Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
@@ -316,8 +568,7 @@
     emitFastArithIntToImmNoCheck(regT2, regT0);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
@@ -328,7 +579,7 @@
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.entry();
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
     stubInfo->stubRoutine = entryLabel;
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
@@ -336,42 +587,14 @@
     jumpLocation.relink(entryLabel);
 }
 
-void JIT::privateCompileGetByIdSelf(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ProcessorReturnAddress returnAddress)
-{
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = emitJumpIfNotJSCell(regT0);
-    Jump failureCases2 = checkStructure(regT0, structure);
-
-    // Checks out okay! - getDirectOffset
-    loadPtr(Address(regT0, FIELD_OFFSET(JSObject, m_propertyStorage)), regT0);
-    loadPtr(Address(regT0, cachedOffset * sizeof(JSValuePtr)), regT0);
-    ret();
-
-    Call failureCases1Call = makeTailRecursiveCall(failureCases1);
-    Call failureCases2Call = makeTailRecursiveCall(failureCases2);
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
-
-    patchBuffer.link(failureCases1Call, JITStubs::cti_op_get_by_id_self_fail);
-    patchBuffer.link(failureCases2Call, JITStubs::cti_op_get_by_id_self_fail);
-
-    stubInfo->stubRoutine = patchBuffer.entry();
-
-    returnAddress.relinkCallerToFunction(code);
-}
-
 void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ProcessorReturnAddress returnAddress, CallFrame* callFrame)
 {
-#if USE(CTI_REPATCH_PIC)
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    returnAddress.relinkCallerToFunction(JITStubs::cti_op_get_by_id_proto_list);
+    returnAddress.relinkCallerToFunction(FunctionPtr(JITStubs::cti_op_get_by_id_proto_list));
 
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
     JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(static_cast<void*>(protoPropertyStorage), regT1);
 
     // Check eax is an object of the right Structure.
     Jump failureCases1 = checkStructure(regT0, structure);
@@ -386,12 +609,11 @@
 #endif
 
     // Checks out okay! - getDirectOffset
-    loadPtr(Address(regT1, cachedOffset * sizeof(JSValuePtr)), regT0);
+    compileGetDirectOffset(protoObject, regT0, cachedOffset);
 
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
@@ -402,56 +624,21 @@
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.entry();
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
     stubInfo->stubRoutine = entryLabel;
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     jumpLocation.relink(entryLabel);
-#else
-    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
-    // referencing the prototype object - let's speculatively load it's table nice and early!)
-    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, regT1);
-
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = emitJumpIfNotJSCell(regT0);
-    Jump failureCases2 = checkStructure(regT0, structure);
-
-    // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
-    Jump failureCases3 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
-
-    // Checks out okay! - getDirectOffset
-    loadPtr(Address(regT1, cachedOffset * sizeof(JSValuePtr)), regT0);
-
-    ret();
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
-
-    patchBuffer.link(failureCases1, JITStubs::cti_op_get_by_id_proto_fail);
-    patchBuffer.link(failureCases2, JITStubs::cti_op_get_by_id_proto_fail);
-    patchBuffer.link(failureCases3, JITStubs::cti_op_get_by_id_proto_fail);
-
-    stubInfo->stubRoutine = patchBuffer.entry();
-
-    returnAddress.relinkCallerToFunction(code);
-#endif
 }
 
-#if USE(CTI_REPATCH_PIC)
 void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
 {
     Jump failureCase = checkStructure(regT0, structure);
-    loadPtr(Address(regT0, FIELD_OFFSET(JSObject, m_propertyStorage)), regT0);
-    loadPtr(Address(regT0, cachedOffset * sizeof(JSValuePtr)), regT0);
+    compileGetDirectOffset(regT0, regT0, structure, cachedOffset);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    ASSERT(code);
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
@@ -463,7 +650,7 @@
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
-    CodeLocationLabel entryLabel = patchBuffer.entry();
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
     structure->ref();
     polymorphicStructures->list[currentIndex].set(entryLabel, structure);
@@ -478,8 +665,6 @@
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
     JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, regT1);
 
     // Check eax is an object of the right Structure.
     Jump failureCases1 = checkStructure(regT0, structure);
@@ -494,12 +679,11 @@
 #endif
 
     // Checks out okay! - getDirectOffset
-    loadPtr(Address(regT1, cachedOffset * sizeof(JSValuePtr)), regT0);
+    compileGetDirectOffset(protoObject, regT0, cachedOffset);
 
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
@@ -509,7 +693,7 @@
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
-    CodeLocationLabel entryLabel = patchBuffer.entry();
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
     structure->ref();
     prototypeStructure->ref();
@@ -548,13 +732,10 @@
     }
     ASSERT(protoObject);
 
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, regT1);
-    loadPtr(Address(regT1, cachedOffset * sizeof(JSValuePtr)), regT0);
+    compileGetDirectOffset(protoObject, regT0, cachedOffset);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
@@ -564,7 +745,7 @@
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
-    CodeLocationLabel entryLabel = patchBuffer.entry();
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
     // Track the stub we have created so that it will be deleted later.
     structure->ref();
@@ -575,13 +756,11 @@
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     jumpLocation.relink(entryLabel);
 }
-#endif
 
 void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ProcessorReturnAddress returnAddress, CallFrame* callFrame)
 {
-#if USE(CTI_REPATCH_PIC)
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    returnAddress.relinkCallerToFunction(JITStubs::cti_op_get_by_id_proto_list);
+    returnAddress.relinkCallerToFunction(FunctionPtr(JITStubs::cti_op_get_by_id_proto_list));
 
     ASSERT(count);
     
@@ -608,13 +787,10 @@
     }
     ASSERT(protoObject);
 
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, regT1);
-    loadPtr(Address(regT1, cachedOffset * sizeof(JSValuePtr)), regT0);
+    compileGetDirectOffset(protoObject, regT0, cachedOffset);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    PatchBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
     patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
@@ -623,80 +799,17 @@
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.entry();
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
     stubInfo->stubRoutine = entryLabel;
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     jumpLocation.relink(entryLabel);
-#else
-    ASSERT(count);
-    
-    JumpList bucketsOfFail;
-
-    // Check eax is an object of the right Structure.
-    bucketsOfFail.append(emitJumpIfNotJSCell(regT0));
-    bucketsOfFail.append(checkStructure(regT0, structure));
-
-    Structure* currStructure = structure;
-    RefPtr<Structure>* chainEntries = chain->head();
-    JSObject* protoObject = 0;
-    for (unsigned i = 0; i < count; ++i) {
-        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
-        currStructure = chainEntries[i].get();
-
-        // Check the prototype object's Structure had not changed.
-        Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), regT3);
-        bucketsOfFail.append(branchPtr(NotEqual, regT3, AbsoluteAddress(prototypeStructureAddress)));
-#else
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
-#endif
-    }
-    ASSERT(protoObject);
-
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, regT1);
-    loadPtr(Address(regT1, cachedOffset * sizeof(JSValuePtr)), regT0);
-    ret();
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-
-    patchBuffer.link(bucketsOfFail, JITStubs::cti_op_get_by_id_proto_fail);
-
-    stubInfo->stubRoutine = patchBuffer.entry();
-
-    returnAddress.relinkCallerToFunction(code);
-#endif
 }
 
-void JIT::privateCompilePutByIdReplace(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ProcessorReturnAddress returnAddress)
-{
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = emitJumpIfNotJSCell(regT0);
-    Jump failureCases2 = checkStructure(regT0, structure);
+/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
 
-    // checks out okay! - putDirectOffset
-    loadPtr(Address(regT0, FIELD_OFFSET(JSObject, m_propertyStorage)), regT0);
-    storePtr(regT1, Address(regT0, cachedOffset * sizeof(JSValuePtr)));
-    ret();
-
-    Call failureCases1Call = makeTailRecursiveCall(failureCases1);
-    Call failureCases2Call = makeTailRecursiveCall(failureCases2);
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
-    
-    patchBuffer.link(failureCases1Call, JITStubs::cti_op_put_by_id_fail);
-    patchBuffer.link(failureCases2Call, JITStubs::cti_op_put_by_id_fail);
-
-    stubInfo->stubRoutine = patchBuffer.entry();
-    
-    returnAddress.relinkCallerToFunction(code);
-}
-
-#endif
+#endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/jit/JITStubCall.h b/JavaScriptCore/jit/JITStubCall.h
new file mode 100644
index 0000000..6c9ccc1
--- /dev/null
+++ b/JavaScriptCore/jit/JITStubCall.h
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JITStubCall_h
+#define JITStubCall_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+    class JITStubCall {
+    public:
+        JITStubCall(JIT* jit, JSObject* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, JSPropertyNameIterator* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, void* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, int (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, void (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Void)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        // Arguments are added first to last.
+
+        void addArgument(JIT::Imm32 argument)
+        {
+            m_jit->poke(argument, m_argumentIndex);
+            ++m_argumentIndex;
+        }
+
+        void addArgument(JIT::ImmPtr argument)
+        {
+            m_jit->poke(argument, m_argumentIndex);
+            ++m_argumentIndex;
+        }
+
+        void addArgument(JIT::RegisterID argument)
+        {
+            m_jit->poke(argument, m_argumentIndex);
+            ++m_argumentIndex;
+        }
+
+        void addArgument(unsigned src, JIT::RegisterID scratchRegister) // src is a virtual register.
+        {
+            if (m_jit->m_codeBlock->isConstantRegisterIndex(src))
+                addArgument(JIT::ImmPtr(JSValue::encode(m_jit->m_codeBlock->getConstant(src))));
+            else {
+                m_jit->loadPtr(JIT::Address(JIT::callFrameRegister, src * sizeof(Register)), scratchRegister);
+                addArgument(scratchRegister);
+            }
+            m_jit->killLastResultRegister();
+        }
+
+        JIT::Call call()
+        {
+            ASSERT(m_jit->m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
+
+#if ENABLE(OPCODE_SAMPLING)
+            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, true);
+#endif
+
+            m_jit->restoreArgumentReference();
+            JIT::Call call = m_jit->call();
+            m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub));
+
+#if ENABLE(OPCODE_SAMPLING)
+            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, false);
+#endif
+
+            m_jit->killLastResultRegister();
+            return call;
+        }
+
+        JIT::Call call(unsigned dst) // dst is a virtual register.
+        {
+            ASSERT(m_returnType == Value);
+            JIT::Call call = this->call();
+            m_jit->emitPutVirtualRegister(dst);
+            return call;
+        }
+
+        JIT::Call call(JIT::RegisterID dst)
+        {
+            ASSERT(m_returnType == Value);
+            JIT::Call call = this->call();
+            if (dst != JIT::returnValueRegister)
+                m_jit->move(JIT::returnValueRegister, dst);
+            return call;
+        }
+
+    private:
+        JIT* m_jit;
+        void* m_stub;
+        enum { Value, Void } m_returnType;
+        size_t m_argumentIndex;
+    };
+
+    class CallEvalJITStub : public JITStubCall {
+    public:
+        CallEvalJITStub(JIT* jit, Instruction* instruction)
+            : JITStubCall(jit, JITStubs::cti_op_call_eval)
+        {
+            int callee = instruction[2].u.operand;
+            int argCount = instruction[3].u.operand;
+            int registerOffset = instruction[4].u.operand;
+
+            addArgument(callee, JIT::regT2);
+            addArgument(JIT::Imm32(registerOffset));
+            addArgument(JIT::Imm32(argCount));
+        }
+    };
+}
+
+#endif // ENABLE(JIT)
+
+#endif // JITStubCall_h
diff --git a/JavaScriptCore/jit/JITStubs.cpp b/JavaScriptCore/jit/JITStubs.cpp
index de528a5..a40d1ba 100644
--- a/JavaScriptCore/jit/JITStubs.cpp
+++ b/JavaScriptCore/jit/JITStubs.cpp
@@ -62,25 +62,267 @@
 
 namespace JSC {
 
+
+#if PLATFORM(DARWIN) || PLATFORM(WIN_OS)
+#define SYMBOL_STRING(name) "_" #name
+#else
+#define SYMBOL_STRING(name) #name
+#endif
+
+#if COMPILER(GCC) && PLATFORM(X86)
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x38, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x30, JITStackFrame_code_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+
+asm(
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "pushl %ebp" "\n"
+    "movl %esp, %ebp" "\n"
+    "pushl %esi" "\n"
+    "pushl %edi" "\n"
+    "pushl %ebx" "\n"
+    "subl $0x1c, %esp" "\n"
+    "movl $512, %esi" "\n"
+    "movl 0x38(%esp), %edi" "\n"
+    "call *0x30(%esp)" "\n"
+    "addl $0x1c, %esp" "\n"
+    "popl %ebx" "\n"
+    "popl %edi" "\n"
+    "popl %esi" "\n"
+    "popl %ebp" "\n"
+    "ret" "\n"
+);
+
+asm(
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+#if !USE(JIT_STUB_ARGUMENT_VA_LIST)
+    "movl %esp, %ecx" "\n"
+#endif
+    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "addl $0x1c, %esp" "\n"
+    "popl %ebx" "\n"
+    "popl %edi" "\n"
+    "popl %esi" "\n"
+    "popl %ebp" "\n"
+    "ret" "\n"
+);
+    
+#elif COMPILER(GCC) && PLATFORM(X86_64)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#error "JIT_STUB_ARGUMENT_VA_LIST not supported on x86-64."
+#endif
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x90, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x80, JITStackFrame_code_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedRBX) == 0x48, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+
+asm(
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "pushq %rbp" "\n"
+    "movq %rsp, %rbp" "\n"
+    "pushq %r12" "\n"
+    "pushq %r13" "\n"
+    "pushq %r14" "\n"
+    "pushq %r15" "\n"
+    "pushq %rbx" "\n"
+    "subq $0x48, %rsp" "\n"
+    "movq $512, %r12" "\n"
+    "movq $0xFFFF000000000000, %r14" "\n"
+    "movq $0xFFFF000000000002, %r15" "\n"
+    "movq 0x90(%rsp), %r13" "\n"
+    "call *0x80(%rsp)" "\n"
+    "addq $0x48, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+
+asm(
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "movq %rsp, %rdi" "\n"
+    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "addq $0x48, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+
+#elif COMPILER(GCC) && PLATFORM(ARM_V7)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
+#endif
+
+COMPILE_ASSERT(offsetof(struct JITStackFrame, preservedReturnAddress) == 0x20, JITStackFrame_outerReturnAddress_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, preservedR4) == 0x24, JITStackFrame_outerReturnAddress_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, preservedR5) == 0x28, JITStackFrame_outerReturnAddress_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, preservedR6) == 0x2c, JITStackFrame_outerReturnAddress_offset_matches_ctiTrampoline);
+
+COMPILE_ASSERT(offsetof(struct JITStackFrame, registerFile) == 0x30, JITStackFrame_registerFile_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x34, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, exception) == 0x38, JITStackFrame_exception_offset_matches_ctiTrampoline);
+// The fifth argument is the first item already on the stack.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, enabledProfilerReference) == 0x3c, JITStackFrame_enabledProfilerReference_offset_matches_ctiTrampoline);
+
+asm volatile  (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "sub sp, sp, #0x3c" "\n"
+    "str lr, [sp, #0x20]" "\n"
+    "str r4, [sp, #0x24]" "\n"
+    "str r5, [sp, #0x28]" "\n"
+    "str r6, [sp, #0x2c]" "\n"
+    "str r1, [sp, #0x30]" "\n"
+    "str r2, [sp, #0x34]" "\n"
+    "str r3, [sp, #0x38]" "\n"
+    "cpy r5, r2" "\n"
+    "mov r6, #512" "\n"
+    "blx r0" "\n"
+    "ldr r6, [sp, #0x2c]" "\n"
+    "ldr r5, [sp, #0x28]" "\n"
+    "ldr r4, [sp, #0x24]" "\n"
+    "ldr lr, [sp, #0x20]" "\n"
+    "add sp, sp, #0x3c" "\n"
+    "bx lr" "\n"
+);
+
+asm volatile (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "cpy r0, sp" "\n"
+    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+    "ldr r6, [sp, #0x2c]" "\n"
+    "ldr r5, [sp, #0x28]" "\n"
+    "ldr r4, [sp, #0x24]" "\n"
+    "ldr lr, [sp, #0x20]" "\n"
+    "add sp, sp, #0x3c" "\n"
+    "bx lr" "\n"
+);
+
+asm volatile (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+".thumb" "\n"
+".thumb_func " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "ldr r6, [sp, #0x2c]" "\n"
+    "ldr r5, [sp, #0x28]" "\n"
+    "ldr r4, [sp, #0x24]" "\n"
+    "ldr lr, [sp, #0x20]" "\n"
+    "add sp, sp, #0x3c" "\n"
+    "bx lr" "\n"
+);
+
+#elif COMPILER(MSVC)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#error "JIT_STUB_ARGUMENT_VA_LIST configuration not supported on MSVC."
+#endif
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x38, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x30, JITStackFrame_code_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+
+extern "C" {
+
+    __declspec(naked) EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*)
+    {
+        __asm {
+            push ebp;
+            mov ebp, esp;
+            push esi;
+            push edi;
+            push ebx;
+            sub esp, 0x1c;
+            mov esi, 512;
+            mov ecx, esp;
+            mov edi, [esp + 0x38];
+            call [esp + 0x30];
+            add esp, 0x1c;
+            pop ebx;
+            pop edi;
+            pop esi;
+            pop ebp;
+            ret;
+        }
+    }
+
+    __declspec(naked) void ctiVMThrowTrampoline()
+    {
+        __asm {
+            mov ecx, esp;
+            call JITStubs::cti_vm_throw;
+            add esp, 0x1c;
+            pop ebx;
+            pop edi;
+            pop esi;
+            pop ebp;
+            ret;
+        }
+    }
+
+    __declspec(naked) void ctiOpThrowNotCaught()
+    {
+        __asm {
+            add esp, 0x1c;
+            pop ebx;
+            pop edi;
+            pop esi;
+            pop ebp;
+            ret;
+        }
+    }
+}
+
+#endif
+
 #if ENABLE(OPCODE_SAMPLING)
-    #define CTI_SAMPLER ARG_globalData->interpreter->sampler()
+    #define CTI_SAMPLER stackFrame.globalData->interpreter->sampler()
 #else
     #define CTI_SAMPLER 0
 #endif
 
-JITStubs::JITStubs(JSGlobalData* globalData)
-    : m_ctiArrayLengthTrampoline(0)
-    , m_ctiStringLengthTrampoline(0)
-    , m_ctiVirtualCallPreLink(0)
-    , m_ctiVirtualCallLink(0)
-    , m_ctiVirtualCall(0)
+JITThunks::JITThunks(JSGlobalData* globalData)
 {
-    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_ctiArrayLengthTrampoline, &m_ctiStringLengthTrampoline, &m_ctiVirtualCallPreLink, &m_ctiVirtualCallLink, &m_ctiVirtualCall);
+    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_ctiArrayLengthTrampoline, &m_ctiStringLengthTrampoline, &m_ctiVirtualCallPreLink, &m_ctiVirtualCallLink, &m_ctiVirtualCall, &m_ctiNativeCallThunk);
 }
 
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
-NEVER_INLINE void JITStubs::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValuePtr baseValue, const PutPropertySlot& slot)
+NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValue baseValue, const PutPropertySlot& slot)
 {
     // The interpreter checks for recursion here; I do not believe this can occur in CTI.
 
@@ -89,7 +331,7 @@
 
     // Uncacheable: give up.
     if (!slot.isCacheable()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(JITStubs::cti_op_put_by_id_generic));
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
         return;
     }
     
@@ -97,13 +339,13 @@
     Structure* structure = baseCell->structure();
 
     if (structure->isDictionary()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(JITStubs::cti_op_put_by_id_generic));
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
         return;
     }
 
     // If baseCell != base, then baseCell must be a proxy for another object.
     if (baseCell != slot.base()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(JITStubs::cti_op_put_by_id_generic));
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
         return;
     }
 
@@ -121,32 +363,24 @@
     
     stubInfo->initPutByIdReplace(structure);
 
-#if USE(CTI_REPATCH_PIC)
     JIT::patchPutByIdReplace(stubInfo, structure, slot.cachedOffset(), returnAddress);
-#else
-    JIT::compilePutByIdReplace(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
-#endif
 }
 
-NEVER_INLINE void JITStubs::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot& slot)
+NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot& slot)
 {
     // FIXME: Write a test that proves we need to check for recursion here just
     // like the interpreter does, then add a check for recursion.
 
     // FIXME: Cache property access for immediates.
     if (!baseValue.isCell()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(JITStubs::cti_op_get_by_id_generic));
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
         return;
     }
     
     JSGlobalData* globalData = &callFrame->globalData();
 
     if (isJSArray(globalData, baseValue) && propertyName == callFrame->propertyNames().length) {
-#if USE(CTI_REPATCH_PIC)
         JIT::compilePatchGetArrayLength(callFrame->scopeChain()->globalData, codeBlock, returnAddress);
-#else
-        ctiPatchCallByReturnAddress(returnAddress, globalData->jitStubs.ctiArrayLengthTrampoline());
-#endif
         return;
     }
     
@@ -159,7 +393,7 @@
 
     // Uncacheable: give up.
     if (!slot.isCacheable()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(JITStubs::cti_op_get_by_id_generic));
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
         return;
     }
 
@@ -167,7 +401,7 @@
     Structure* structure = baseCell->structure();
 
     if (structure->isDictionary()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(JITStubs::cti_op_get_by_id_generic));
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
         return;
     }
 
@@ -181,12 +415,8 @@
     if (slot.slotBase() == baseValue) {
         // set this up, so derefStructures can do it's job.
         stubInfo->initGetByIdSelf(structure);
-        
-#if USE(CTI_REPATCH_PIC)
+
         JIT::patchGetByIdSelf(stubInfo, structure, slot.cachedOffset(), returnAddress);
-#else
-        JIT::compileGetByIdSelf(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
-#endif
         return;
     }
 
@@ -221,7 +451,7 @@
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #define SETUP_VA_LISTL_ARGS va_list vl_args; va_start(vl_args, args)
-#else // JIT_STUB_ARGUMENT_REGISTER or JIT_STUB_ARGUMENT_STACK
+#else
 #define SETUP_VA_LISTL_ARGS
 #endif
 
@@ -231,7 +461,7 @@
 
 static void jscGeneratedNativeCode() 
 {
-    // When executing a CTI function (which might do an allocation), we hack the return address
+    // When executing a JIT stub function (which might do an allocation), we hack the return address
     // to pretend to be executing this function, to keep stack logging tools from blowing out
     // memory.
 }
@@ -239,30 +469,31 @@
 }
 
 struct StackHack {
-    ALWAYS_INLINE StackHack(void** location) 
-    { 
-        returnAddressLocation = location;
-        savedReturnAddress = *returnAddressLocation;
-        ctiSetReturnAddress(returnAddressLocation, reinterpret_cast<void*>(jscGeneratedNativeCode));
-    }
-    ALWAYS_INLINE ~StackHack() 
-    { 
-        ctiSetReturnAddress(returnAddressLocation, savedReturnAddress);
+    ALWAYS_INLINE StackHack(JITStackFrame& stackFrame) 
+        : stackFrame(stackFrame)
+        , savedReturnAddress(*stackFrame.returnAddressSlot())
+    {
+        *stackFrame.returnAddressSlot() = reinterpret_cast<void*>(jscGeneratedNativeCode);
     }
 
-    void** returnAddressLocation;
+    ALWAYS_INLINE ~StackHack() 
+    { 
+        *stackFrame.returnAddressSlot() = savedReturnAddress;
+    }
+
+    JITStackFrame& stackFrame;
     void* savedReturnAddress;
 };
 
-#define BEGIN_STUB_FUNCTION() SETUP_VA_LISTL_ARGS; StackHack stackHack(&STUB_RETURN_ADDRESS_SLOT)
-#define STUB_SET_RETURN_ADDRESS(address) stackHack.savedReturnAddress = address
+#define STUB_INIT_STACK_FRAME(stackFrame) SETUP_VA_LISTL_ARGS; JITStackFrame& stackFrame = *reinterpret_cast<JITStackFrame*>(STUB_ARGS); StackHack stackHack(stackFrame)
+#define STUB_SET_RETURN_ADDRESS(returnAddress) stackHack.savedReturnAddress = returnAddress
 #define STUB_RETURN_ADDRESS stackHack.savedReturnAddress
 
 #else
 
-#define BEGIN_STUB_FUNCTION() SETUP_VA_LISTL_ARGS
-#define STUB_SET_RETURN_ADDRESS(address) ctiSetReturnAddress(&STUB_RETURN_ADDRESS_SLOT, address);
-#define STUB_RETURN_ADDRESS STUB_RETURN_ADDRESS_SLOT
+#define STUB_INIT_STACK_FRAME(stackFrame) SETUP_VA_LISTL_ARGS; JITStackFrame& stackFrame = *reinterpret_cast<JITStackFrame*>(STUB_ARGS)
+#define STUB_SET_RETURN_ADDRESS(returnAddress) *stackFrame.returnAddressSlot() = returnAddress
+#define STUB_RETURN_ADDRESS *stackFrame.returnAddressSlot()
 
 #endif
 
@@ -274,7 +505,7 @@
 {
     ASSERT(globalData->exception);
     globalData->exceptionLocation = exceptionLocation;
-    ctiSetReturnAddress(&returnAddressSlot, reinterpret_cast<void*>(ctiVMThrowTrampoline));
+    returnAddressSlot = reinterpret_cast<void*>(ctiVMThrowTrampoline);
 }
 
 static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalData* globalData, void* exceptionLocation, void*& returnAddressSlot)
@@ -288,68 +519,91 @@
         VM_THROW_EXCEPTION_AT_END(); \
         return 0; \
     } while (0)
-#define VM_THROW_EXCEPTION_2() \
-    do { \
-        VM_THROW_EXCEPTION_AT_END(); \
-        RETURN_PAIR(0, 0); \
-    } while (0)
 #define VM_THROW_EXCEPTION_AT_END() \
-    returnToThrowTrampoline(ARG_globalData, STUB_RETURN_ADDRESS, STUB_RETURN_ADDRESS)
+    returnToThrowTrampoline(stackFrame.globalData, STUB_RETURN_ADDRESS, STUB_RETURN_ADDRESS)
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) \
+        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) \
             VM_THROW_EXCEPTION(); \
     } while (0)
 #define CHECK_FOR_EXCEPTION_AT_END() \
     do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) \
+        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) \
             VM_THROW_EXCEPTION_AT_END(); \
     } while (0)
 #define CHECK_FOR_EXCEPTION_VOID() \
     do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) { \
+        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) { \
             VM_THROW_EXCEPTION_AT_END(); \
             return; \
         } \
     } while (0)
 
-JSObject* JITStubs::cti_op_convert_this(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
+namespace JITStubs {
 
-    JSValuePtr v1 = ARG_src1;
-    CallFrame* callFrame = ARG_callFrame;
+#if PLATFORM(ARM_V7)
+
+COMPILE_ASSERT(offsetof(struct JITStackFrame, thunkReturnAddress) == 0x1C, JITStackFrame_outerReturnAddress_offset_matches_ctiTrampoline);
+
+#define DEFINE_STUB_FUNCTION(rtype, op) \
+    extern "C" { \
+        rtype JITStubThunked_##op(STUB_ARGS_DECLARATION); \
+    }; \
+    asm volatile ( \
+        ".text" "\n" \
+        ".align 2" "\n" \
+        ".globl " SYMBOL_STRING(cti_##op) "\n" \
+        ".thumb" "\n" \
+        ".thumb_func " SYMBOL_STRING(cti_##op) "\n" \
+        SYMBOL_STRING(cti_##op) ":" "\n" \
+        "str lr, [sp, #0x1c]" "\n" \
+        "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
+        "ldr lr, [sp, #0x1c]" "\n" \
+        "bx lr" "\n" \
+        ); \
+    rtype JITStubThunked_##op(STUB_ARGS_DECLARATION) \
+
+#else
+#define DEFINE_STUB_FUNCTION(rtype, op) rtype JIT_STUB cti_##op(STUB_ARGS_DECLARATION)
+#endif
+
+DEFINE_STUB_FUNCTION(JSObject*, op_convert_this)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v1 = stackFrame.args[0].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
 
     JSObject* result = v1.toThisObject(callFrame);
     CHECK_FOR_EXCEPTION_AT_END();
     return result;
 }
 
-void JITStubs::cti_op_end(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_end)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    ScopeChainNode* scopeChain = ARG_callFrame->scopeChain();
+    ScopeChainNode* scopeChain = stackFrame.callFrame->scopeChain();
     ASSERT(scopeChain->refCount > 1);
     scopeChain->deref();
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_add(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_add)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr v1 = ARG_src1;
-    JSValuePtr v2 = ARG_src2;
+    JSValue v1 = stackFrame.args[0].jsValue();
+    JSValue v2 = stackFrame.args[1].jsValue();
 
     double left;
     double right = 0.0;
 
     bool rightIsNumber = v2.getNumber(right);
     if (rightIsNumber && v1.getNumber(left))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left + right));
+        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
     
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
     bool leftIsString = v1.isString();
     if (leftIsString && v2.isString()) {
@@ -359,7 +613,7 @@
             VM_THROW_EXCEPTION();
         }
 
-        return JSValuePtr::encode(jsString(ARG_globalData, value.release()));
+        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
     }
 
     if (rightIsNumber & leftIsString) {
@@ -371,35 +625,35 @@
             throwOutOfMemoryError(callFrame);
             VM_THROW_EXCEPTION();
         }
-        return JSValuePtr::encode(jsString(ARG_globalData, value.release()));
+        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
     }
 
     // All other cases are pretty uncommon
-    JSValuePtr result = jsAddSlowCase(callFrame, v1, v2);
+    JSValue result = jsAddSlowCase(callFrame, v1, v2);
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_pre_inc(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_pre_inc)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr v = ARG_src1;
+    JSValue v = stackFrame.args[0].jsValue();
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, v.toNumber(callFrame) + 1);
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, v.toNumber(callFrame) + 1);
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-int JITStubs::cti_timeout_check(STUB_ARGS)
+DEFINE_STUB_FUNCTION(int, timeout_check)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
     
-    JSGlobalData* globalData = ARG_globalData;
+    JSGlobalData* globalData = stackFrame.globalData;
     TimeoutChecker& timeoutChecker = globalData->timeoutChecker;
 
-    if (timeoutChecker.didTimeOut(ARG_callFrame)) {
+    if (timeoutChecker.didTimeOut(stackFrame.callFrame)) {
         globalData->exception = createInterruptedExecutionException(globalData);
         VM_THROW_EXCEPTION_AT_END();
     }
@@ -407,161 +661,258 @@
     return timeoutChecker.ticksUntilNextCheck();
 }
 
-void JITStubs::cti_register_file_check(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, register_file_check)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    if (LIKELY(ARG_registerFile->grow(ARG_callFrame + ARG_callFrame->codeBlock()->m_numCalleeRegisters)))
+    if (LIKELY(stackFrame.registerFile->grow(&stackFrame.callFrame->registers()[stackFrame.callFrame->codeBlock()->m_numCalleeRegisters])))
         return;
 
     // Rewind to the previous call frame because op_call already optimistically
     // moved the call frame forward.
-    CallFrame* oldCallFrame = ARG_callFrame->callerFrame();
-    ARG_setCallFrame(oldCallFrame);
-    throwStackOverflowError(oldCallFrame, ARG_globalData, oldCallFrame->returnPC(), STUB_RETURN_ADDRESS);
+    CallFrame* oldCallFrame = stackFrame.callFrame->callerFrame();
+    stackFrame.callFrame = oldCallFrame;
+    throwStackOverflowError(oldCallFrame, stackFrame.globalData, oldCallFrame->returnPC(), STUB_RETURN_ADDRESS);
 }
 
-int JITStubs::cti_op_loop_if_less(STUB_ARGS)
+DEFINE_STUB_FUNCTION(int, op_loop_if_less)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
 
     bool result = jsLess(callFrame, src1, src2);
     CHECK_FOR_EXCEPTION_AT_END();
     return result;
 }
 
-int JITStubs::cti_op_loop_if_lesseq(STUB_ARGS)
+DEFINE_STUB_FUNCTION(int, op_loop_if_lesseq)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
 
     bool result = jsLessEq(callFrame, src1, src2);
     CHECK_FOR_EXCEPTION_AT_END();
     return result;
 }
 
-JSObject* JITStubs::cti_op_new_object(STUB_ARGS)
+DEFINE_STUB_FUNCTION(JSObject*, op_new_object)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return constructEmptyObject(ARG_callFrame);
+    return constructEmptyObject(stackFrame.callFrame);
 }
 
-void JITStubs::cti_op_put_by_id_generic(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_put_by_id_generic)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
     PutPropertySlot slot;
-    ARG_src1.put(ARG_callFrame, *ARG_id2, ARG_src3, slot);
+    stackFrame.args[0].jsValue().put(stackFrame.callFrame, stackFrame.args[1].identifier(), stackFrame.args[2].jsValue(), slot);
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_get_by_id_generic(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_generic)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
 
-    JSValuePtr baseValue = ARG_src1;
+    JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(callFrame, ident, slot);
+    JSValue result = baseValue.get(callFrame, ident, slot);
 
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
-void JITStubs::cti_op_put_by_id(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_put_by_id)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
 
     PutPropertySlot slot;
-    ARG_src1.put(callFrame, ident, ARG_src3, slot);
+    stackFrame.args[0].jsValue().put(callFrame, ident, stackFrame.args[2].jsValue(), slot);
 
-    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_put_by_id_second));
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_id_second));
 
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-void JITStubs::cti_op_put_by_id_second(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_put_by_id_second)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
     PutPropertySlot slot;
-    ARG_src1.put(ARG_callFrame, *ARG_id2, ARG_src3, slot);
-    tryCachePutByID(ARG_callFrame, ARG_callFrame->codeBlock(), STUB_RETURN_ADDRESS, ARG_src1, slot);
+    stackFrame.args[0].jsValue().put(stackFrame.callFrame, stackFrame.args[1].identifier(), stackFrame.args[2].jsValue(), slot);
+    JITThunks::tryCachePutByID(stackFrame.callFrame, stackFrame.callFrame->codeBlock(), STUB_RETURN_ADDRESS, stackFrame.args[0].jsValue(), slot);
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-void JITStubs::cti_op_put_by_id_fail(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_put_by_id_fail)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
 
     PutPropertySlot slot;
-    ARG_src1.put(callFrame, ident, ARG_src3, slot);
+    stackFrame.args[0].jsValue().put(callFrame, ident, stackFrame.args[2].jsValue(), slot);
 
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_get_by_id(STUB_ARGS)
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_put_by_id_transition_realloc)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    int32_t oldSize = stackFrame.args[1].int32();
+    int32_t newSize = stackFrame.args[2].int32();
 
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(callFrame, ident, slot);
+    ASSERT(baseValue.isObject());
+    asObject(baseValue)->allocatePropertyStorage(oldSize, newSize);
 
-    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_second));
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(baseValue);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_get_by_id_second(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
 
-    JSValuePtr baseValue = ARG_src1;
+    JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(callFrame, ident, slot);
+    JSValue result = baseValue.get(callFrame, ident, slot);
 
-    tryCacheGetByID(callFrame, callFrame->codeBlock(), STUB_RETURN_ADDRESS, baseValue, ident, slot);
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_second));
 
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_get_by_id_self_fail(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
 
-    JSValuePtr baseValue = ARG_src1;
+    JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(callFrame, ident, slot);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_method_check_second));
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check_second)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    CHECK_FOR_EXCEPTION();
+
+    // If we successfully got something, then the base from which it is being accessed must
+    // be an object.  (Assertion to ensure asObject() call below is safe, which comes after
+    // an isCacheable() chceck.
+    ASSERT(!slot.isCacheable() || slot.slotBase().isObject());
+
+    // Check that:
+    //   * We're dealing with a JSCell,
+    //   * the property is cachable,
+    //   * it's not a dictionary
+    //   * there is a function cached.
+    Structure* structure;
+    JSCell* specific;
+    JSObject* slotBaseObject;
+    if (baseValue.isCell()
+        && slot.isCacheable()
+        && !(structure = asCell(baseValue)->structure())->isDictionary()
+        && (slotBaseObject = asObject(slot.slotBase()))->getPropertySpecificValue(callFrame, ident, specific)
+        && specific
+        ) {
+
+        JSFunction* callee = (JSFunction*)specific;
+
+        // Since we're accessing a prototype in a loop, it's a good bet that it
+        // should not be treated as a dictionary.
+        if (slotBaseObject->structure()->isDictionary())
+            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+
+        // The result fetched should always be the callee!
+        ASSERT(result == JSValue(callee));
+        MethodCallLinkInfo& methodCallLinkInfo = callFrame->codeBlock()->getMethodCallLinkInfo(STUB_RETURN_ADDRESS);
+
+        // Check to see if the function is on the object's prototype.  Patch up the code to optimize.
+        if (slot.slotBase() == structure->prototypeForLookup(callFrame))
+            JIT::patchMethodCallProto(methodCallLinkInfo, callee, structure, slotBaseObject);
+        // Check to see if the function is on the object itself.
+        // Since we generate the method-check to check both the structure and a prototype-structure (since this
+        // is the common case) we have a problem - we need to patch the prototype structure check to do something
+        // useful.  We could try to nop it out altogether, but that's a little messy, so lets do something simpler
+        // for now.  For now it performs a check on a special object on the global object only used for this
+        // purpose.  The object is in no way exposed, and as such the check will always pass.
+        else if (slot.slotBase() == baseValue)
+            JIT::patchMethodCallProto(methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject()->methodCallDummy());
+
+        // For now let any other case be cached as a normal get_by_id.
+    }
+
+    // Revert the get_by_id op back to being a regular get_by_id - allow it to cache like normal, if it needs to.
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id));
+
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_second)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    JITThunks::tryCacheGetByID(callFrame, callFrame->codeBlock(), STUB_RETURN_ADDRESS, baseValue, ident, slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
 
     CHECK_FOR_EXCEPTION();
 
@@ -591,11 +942,11 @@
         JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), slot.cachedOffset());
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_generic));
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
     } else {
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_generic));
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
     }
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
 static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(StructureStubInfo* stubInfo, int& listIndex)
@@ -627,21 +978,21 @@
     return prototypeStructureList;
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_get_by_id_proto_list(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    JSValuePtr baseValue = ARG_src1;
+    JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(callFrame, *ARG_id2, slot);
+    JSValue result = baseValue.get(callFrame, stackFrame.args[1].identifier(), slot);
 
     CHECK_FOR_EXCEPTION();
 
     if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
-        return JSValuePtr::encode(result);
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
+        return JSValue::encode(result);
     }
 
     Structure* structure = asCell(baseValue)->structure();
@@ -652,7 +1003,7 @@
     JSObject* slotBaseObject = asObject(slot.slotBase());
 
     if (slot.slotBase() == baseValue)
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
     else if (slot.slotBase() == asCell(baseValue)->structure()->prototypeForLookup(callFrame)) {
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
@@ -665,176 +1016,175 @@
         JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), slot.cachedOffset());
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_list_full));
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
     } else if (size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot)) {
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
         JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, structure->prototypeChain(callFrame), count, slot.cachedOffset());
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_list_full));
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
     } else
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
 
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_get_by_id_proto_list_full(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list_full)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr baseValue = ARG_src1;
+    JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(ARG_callFrame, *ARG_id2, slot);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
 
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_get_by_id_proto_fail(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_fail)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr baseValue = ARG_src1;
+    JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(ARG_callFrame, *ARG_id2, slot);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
 
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_get_by_id_array_fail(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_array_fail)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr baseValue = ARG_src1;
+    JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(ARG_callFrame, *ARG_id2, slot);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
 
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_get_by_id_string_fail(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_string_fail)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr baseValue = ARG_src1;
+    JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue.get(ARG_callFrame, *ARG_id2, slot);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
 
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
 #endif
 
-JSValueEncodedAsPointer* JITStubs::cti_op_instanceof(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_instanceof)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr value = ARG_src1;
-    JSValuePtr baseVal = ARG_src2;
-    JSValuePtr proto = ARG_src3;
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue value = stackFrame.args[0].jsValue();
+    JSValue baseVal = stackFrame.args[1].jsValue();
+    JSValue proto = stackFrame.args[2].jsValue();
 
-    // at least one of these checks must have failed to get to the slow case
+    // At least one of these checks must have failed to get to the slow case.
     ASSERT(!value.isCell() || !baseVal.isCell() || !proto.isCell()
            || !value.isObject() || !baseVal.isObject() || !proto.isObject() 
            || (asObject(baseVal)->structure()->typeInfo().flags() & (ImplementsHasInstance | OverridesHasInstance)) != ImplementsHasInstance);
 
-    if (!baseVal.isObject()) {
-        CallFrame* callFrame = ARG_callFrame;
+
+    // ECMA-262 15.3.5.3:
+    // Throw an exception either if baseVal is not an object, or if it does not implement 'HasInstance' (i.e. is a function).
+    TypeInfo typeInfo(UnspecifiedType, 0);
+    if (!baseVal.isObject() || !(typeInfo = asObject(baseVal)->structure()->typeInfo()).implementsHasInstance()) {
+        CallFrame* callFrame = stackFrame.callFrame;
         CodeBlock* codeBlock = callFrame->codeBlock();
         unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-        ARG_globalData->exception = createInvalidParamError(callFrame, "instanceof", baseVal, vPCIndex, codeBlock);
+        stackFrame.globalData->exception = createInvalidParamError(callFrame, "instanceof", baseVal, vPCIndex, codeBlock);
         VM_THROW_EXCEPTION();
     }
-
-    JSObject* baseObj = asObject(baseVal);
-    TypeInfo typeInfo = baseObj->structure()->typeInfo();
-    if (!typeInfo.implementsHasInstance())
-        return JSValuePtr::encode(jsBoolean(false));
+    ASSERT(typeInfo.type() != UnspecifiedType);
 
     if (!typeInfo.overridesHasInstance()) {
+        if (!value.isObject())
+            return JSValue::encode(jsBoolean(false));
+
         if (!proto.isObject()) {
             throwError(callFrame, TypeError, "instanceof called on an object with an invalid prototype property.");
             VM_THROW_EXCEPTION();
         }
-
-        if (!value.isObject())
-            return JSValuePtr::encode(jsBoolean(false));
     }
 
-    JSValuePtr result = jsBoolean(baseObj->hasInstance(callFrame, value, proto));
+    JSValue result = jsBoolean(asObject(baseVal)->hasInstance(callFrame, value, proto));
     CHECK_FOR_EXCEPTION_AT_END();
 
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_del_by_id(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_del_by_id)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
     
-    JSObject* baseObj = ARG_src1.toObject(callFrame);
+    JSObject* baseObj = stackFrame.args[0].jsValue().toObject(callFrame);
 
-    JSValuePtr result = jsBoolean(baseObj->deleteProperty(callFrame, *ARG_id2));
+    JSValue result = jsBoolean(baseObj->deleteProperty(callFrame, stackFrame.args[1].identifier()));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_mul(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_mul)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
 
     double left;
     double right;
     if (src1.getNumber(left) && src2.getNumber(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left * right));
+        return JSValue::encode(jsNumber(stackFrame.globalData, left * right));
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toNumber(callFrame) * src2.toNumber(callFrame));
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) * src2.toNumber(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSObject* JITStubs::cti_op_new_func(STUB_ARGS)
+DEFINE_STUB_FUNCTION(JSObject*, op_new_func)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return ARG_func1->makeFunction(ARG_callFrame, ARG_callFrame->scopeChain());
+    return stackFrame.args[0].funcDeclNode()->makeFunction(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
 }
 
-void* JITStubs::cti_op_call_JSFunction(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void*, op_call_JSFunction)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
 #ifndef NDEBUG
     CallData callData;
-    ASSERT(ARG_src1.getCallData(callData) == CallTypeJS);
+    ASSERT(stackFrame.args[0].jsValue().getCallData(callData) == CallTypeJS);
 #endif
 
-    ScopeChainNode* callDataScopeChain = asFunction(ARG_src1)->scope().node();
-    CodeBlock* newCodeBlock = &asFunction(ARG_src1)->body()->bytecode(callDataScopeChain);
+    JSFunction* function = asFunction(stackFrame.args[0].jsValue());
+    FunctionBodyNode* body = function->body();
+    ScopeChainNode* callDataScopeChain = function->scope().node();
+    body->jitCode(callDataScopeChain);
 
-    if (!newCodeBlock->jitCode())
-        JIT::compile(ARG_globalData, newCodeBlock);
-
-    return newCodeBlock;
+    return &(body->generatedBytecode());
 }
 
-VoidPtrPair JITStubs::cti_op_call_arityCheck(STUB_ARGS)
+DEFINE_STUB_FUNCTION(VoidPtrPair, op_call_arityCheck)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* newCodeBlock = ARG_codeBlock4;
-    int argCount = ARG_int3;
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* newCodeBlock = stackFrame.args[3].codeBlock();
+    int argCount = stackFrame.args[2].int32();
 
     ASSERT(argCount != newCodeBlock->m_numParameters);
 
@@ -854,12 +1204,12 @@
         size_t omittedArgCount = newCodeBlock->m_numParameters - argCount;
         Register* r = callFrame->registers() + omittedArgCount;
         Register* newEnd = r + newCodeBlock->m_numCalleeRegisters;
-        if (!ARG_registerFile->grow(newEnd)) {
+        if (!stackFrame.registerFile->grow(newEnd)) {
             // Rewind to the previous call frame because op_call already optimistically
             // moved the call frame forward.
-            ARG_setCallFrame(oldCallFrame);
-            throwStackOverflowError(oldCallFrame, ARG_globalData, ARG_returnAddress2, STUB_RETURN_ADDRESS);
-            RETURN_PAIR(0, 0);
+            stackFrame.callFrame = oldCallFrame;
+            throwStackOverflowError(oldCallFrame, stackFrame.globalData, stackFrame.args[1].returnAddress(), STUB_RETURN_ADDRESS);
+            RETURN_POINTER_PAIR(0, 0);
         }
 
         Register* argv = r - RegisterFile::CallFrameHeaderSize - omittedArgCount;
@@ -870,53 +1220,52 @@
         callFrame->setCallerFrame(oldCallFrame);
     }
 
-    RETURN_PAIR(newCodeBlock, callFrame);
+    RETURN_POINTER_PAIR(newCodeBlock, callFrame);
 }
 
-void* JITStubs::cti_vm_dontLazyLinkCall(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void*, vm_dontLazyLinkCall)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSGlobalData* globalData = ARG_globalData;
-    JSFunction* callee = asFunction(ARG_src1);
-    CodeBlock* codeBlock = &callee->body()->bytecode(callee->scope().node());
-    if (!codeBlock->jitCode())
-        JIT::compile(globalData, codeBlock);
+    JSGlobalData* globalData = stackFrame.globalData;
+    JSFunction* callee = asFunction(stackFrame.args[0].jsValue());
 
-    ctiPatchNearCallByReturnAddress(ARG_returnAddress2, globalData->jitStubs.ctiVirtualCallLink());
+    ctiPatchNearCallByReturnAddress(stackFrame.args[1].returnAddress(), globalData->jitStubs.ctiVirtualCallLink());
 
-    return codeBlock->jitCode().addressForCall();
+    return callee->body()->generatedJITCode().addressForCall().executableAddress();
 }
 
-void* JITStubs::cti_vm_lazyLinkCall(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void*, vm_lazyLinkCall)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSFunction* callee = asFunction(ARG_src1);
-    CodeBlock* codeBlock = &callee->body()->bytecode(callee->scope().node());
-    if (!codeBlock->jitCode())
-        JIT::compile(ARG_globalData, codeBlock);
+    JSFunction* callee = asFunction(stackFrame.args[0].jsValue());
+    JITCode& jitCode = callee->body()->generatedJITCode();
+    
+    CodeBlock* codeBlock = 0;
+    if (!callee->isHostFunction())
+        codeBlock = &callee->body()->bytecode(callee->scope().node());
 
-    CallLinkInfo* callLinkInfo = &ARG_callFrame->callerFrame()->codeBlock()->getCallLinkInfo(ARG_returnAddress2);
-    JIT::linkCall(callee, codeBlock, codeBlock->jitCode(), callLinkInfo, ARG_int3);
+    CallLinkInfo* callLinkInfo = &stackFrame.callFrame->callerFrame()->codeBlock()->getCallLinkInfo(stackFrame.args[1].returnAddress());
+    JIT::linkCall(callee, codeBlock, jitCode, callLinkInfo, stackFrame.args[2].int32());
 
-    return codeBlock->jitCode().addressForCall();
+    return jitCode.addressForCall().executableAddress();
 }
 
-JSObject* JITStubs::cti_op_push_activation(STUB_ARGS)
+DEFINE_STUB_FUNCTION(JSObject*, op_push_activation)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSActivation* activation = new (ARG_globalData) JSActivation(ARG_callFrame, static_cast<FunctionBodyNode*>(ARG_callFrame->codeBlock()->ownerNode()));
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->copy()->push(activation));
+    JSActivation* activation = new (stackFrame.globalData) JSActivation(stackFrame.callFrame, static_cast<FunctionBodyNode*>(stackFrame.callFrame->codeBlock()->ownerNode()));
+    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->copy()->push(activation));
     return activation;
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_call_NotJSFunction(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_NotJSFunction)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr funcVal = ARG_src1;
+    JSValue funcVal = stackFrame.args[0].jsValue();
 
     CallData callData;
     CallType callType = funcVal.getCallData(callData);
@@ -924,163 +1273,173 @@
     ASSERT(callType != CallTypeJS);
 
     if (callType == CallTypeHost) {
-        int registerOffset = ARG_int2;
-        int argCount = ARG_int3;
-        CallFrame* previousCallFrame = ARG_callFrame;
+        int registerOffset = stackFrame.args[1].int32();
+        int argCount = stackFrame.args[2].int32();
+        CallFrame* previousCallFrame = stackFrame.callFrame;
         CallFrame* callFrame = CallFrame::create(previousCallFrame->registers() + registerOffset);
 
         callFrame->init(0, static_cast<Instruction*>(STUB_RETURN_ADDRESS), previousCallFrame->scopeChain(), previousCallFrame, 0, argCount, 0);
-        ARG_setCallFrame(callFrame);
+        stackFrame.callFrame = callFrame;
 
-        Register* argv = ARG_callFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
+        Register* argv = stackFrame.callFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
         ArgList argList(argv + 1, argCount - 1);
 
-        JSValuePtr returnValue;
+        JSValue returnValue;
         {
             SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
 
             // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
-            JSValuePtr thisValue = argv[0].jsValue(callFrame);
+            JSValue thisValue = argv[0].jsValue();
             if (thisValue == jsNull())
                 thisValue = callFrame->globalThisValue();
 
             returnValue = callData.native.function(callFrame, asObject(funcVal), thisValue, argList);
         }
-        ARG_setCallFrame(previousCallFrame);
+        stackFrame.callFrame = previousCallFrame;
         CHECK_FOR_EXCEPTION();
 
-        return JSValuePtr::encode(returnValue);
+        return JSValue::encode(returnValue);
     }
 
     ASSERT(callType == CallTypeNone);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
     CodeBlock* codeBlock = callFrame->codeBlock();
     unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createNotAFunctionError(ARG_callFrame, funcVal, vPCIndex, codeBlock);
+    stackFrame.globalData->exception = createNotAFunctionError(stackFrame.callFrame, funcVal, vPCIndex, codeBlock);
     VM_THROW_EXCEPTION();
 }
 
-void JITStubs::cti_op_create_arguments(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_create_arguments)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    Arguments* arguments = new (ARG_globalData) Arguments(ARG_callFrame);
-    ARG_callFrame->setCalleeArguments(arguments);
-    ARG_callFrame[RegisterFile::ArgumentsRegister] = arguments;
+    Arguments* arguments = new (stackFrame.globalData) Arguments(stackFrame.callFrame);
+    stackFrame.callFrame->setCalleeArguments(arguments);
+    stackFrame.callFrame[RegisterFile::ArgumentsRegister] = arguments;
 }
 
-void JITStubs::cti_op_create_arguments_no_params(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_create_arguments_no_params)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    Arguments* arguments = new (ARG_globalData) Arguments(ARG_callFrame, Arguments::NoParameters);
-    ARG_callFrame->setCalleeArguments(arguments);
-    ARG_callFrame[RegisterFile::ArgumentsRegister] = arguments;
+    Arguments* arguments = new (stackFrame.globalData) Arguments(stackFrame.callFrame, Arguments::NoParameters);
+    stackFrame.callFrame->setCalleeArguments(arguments);
+    stackFrame.callFrame[RegisterFile::ArgumentsRegister] = arguments;
 }
 
-void JITStubs::cti_op_tear_off_activation(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_tear_off_activation)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    ASSERT(ARG_callFrame->codeBlock()->needsFullScopeChain());
-    asActivation(ARG_src1)->copyRegisters(ARG_callFrame->optionalCalleeArguments());
+    ASSERT(stackFrame.callFrame->codeBlock()->needsFullScopeChain());
+    asActivation(stackFrame.args[0].jsValue())->copyRegisters(stackFrame.callFrame->optionalCalleeArguments());
 }
 
-void JITStubs::cti_op_tear_off_arguments(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_tear_off_arguments)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    ASSERT(ARG_callFrame->codeBlock()->usesArguments() && !ARG_callFrame->codeBlock()->needsFullScopeChain());
-    ARG_callFrame->optionalCalleeArguments()->copyRegisters();
+    ASSERT(stackFrame.callFrame->codeBlock()->usesArguments() && !stackFrame.callFrame->codeBlock()->needsFullScopeChain());
+    if (stackFrame.callFrame->optionalCalleeArguments())
+        stackFrame.callFrame->optionalCalleeArguments()->copyRegisters();
 }
 
-void JITStubs::cti_op_profile_will_call(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_profile_will_call)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    ASSERT(*ARG_profilerReference);
-    (*ARG_profilerReference)->willExecute(ARG_callFrame, ARG_src1);
+    ASSERT(*stackFrame.enabledProfilerReference);
+    (*stackFrame.enabledProfilerReference)->willExecute(stackFrame.callFrame, stackFrame.args[0].jsValue());
 }
 
-void JITStubs::cti_op_profile_did_call(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_profile_did_call)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    ASSERT(*ARG_profilerReference);
-    (*ARG_profilerReference)->didExecute(ARG_callFrame, ARG_src1);
+    ASSERT(*stackFrame.enabledProfilerReference);
+    (*stackFrame.enabledProfilerReference)->didExecute(stackFrame.callFrame, stackFrame.args[0].jsValue());
 }
 
-void JITStubs::cti_op_ret_scopeChain(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_ret_scopeChain)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    ASSERT(ARG_callFrame->codeBlock()->needsFullScopeChain());
-    ARG_callFrame->scopeChain()->deref();
+    ASSERT(stackFrame.callFrame->codeBlock()->needsFullScopeChain());
+    stackFrame.callFrame->scopeChain()->deref();
 }
 
-JSObject* JITStubs::cti_op_new_array(STUB_ARGS)
+DEFINE_STUB_FUNCTION(JSObject*, op_new_array)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    ArgList argList(&ARG_callFrame->registers()[ARG_int1], ARG_int2);
-    return constructArray(ARG_callFrame, argList);
+    ArgList argList(&stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32());
+    return constructArray(stackFrame.callFrame, argList);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_resolve(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
     ScopeChainNode* scopeChain = callFrame->scopeChain();
 
     ScopeChainIterator iter = scopeChain->begin();
     ScopeChainIterator end = scopeChain->end();
     ASSERT(iter != end);
 
-    Identifier& ident = *ARG_id1;
+    Identifier& ident = stackFrame.args[0].identifier();
     do {
         JSObject* o = *iter;
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             CHECK_FOR_EXCEPTION_AT_END();
-            return JSValuePtr::encode(result);
+            return JSValue::encode(result);
         }
     } while (++iter != end);
 
     CodeBlock* codeBlock = callFrame->codeBlock();
     unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
     VM_THROW_EXCEPTION();
 }
 
-JSObject* JITStubs::cti_op_construct_JSConstruct(STUB_ARGS)
+DEFINE_STUB_FUNCTION(JSObject*, op_construct_JSConstruct)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSFunction* constructor = asFunction(stackFrame.args[0].jsValue());
+    if (constructor->isHostFunction()) {
+        CallFrame* callFrame = stackFrame.callFrame;
+        CodeBlock* codeBlock = callFrame->codeBlock();
+        unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+        stackFrame.globalData->exception = createNotAConstructorError(callFrame, constructor, vPCIndex, codeBlock);
+        VM_THROW_EXCEPTION();
+    }
 
 #ifndef NDEBUG
     ConstructData constructData;
-    ASSERT(asFunction(ARG_src1)->getConstructData(constructData) == ConstructTypeJS);
+    ASSERT(constructor->getConstructData(constructData) == ConstructTypeJS);
 #endif
 
     Structure* structure;
-    if (ARG_src4.isObject())
-        structure = asObject(ARG_src4)->inheritorID();
+    if (stackFrame.args[3].jsValue().isObject())
+        structure = asObject(stackFrame.args[3].jsValue())->inheritorID();
     else
-        structure = asFunction(ARG_src1)->scope().node()->globalObject()->emptyObjectStructure();
-    return new (ARG_globalData) JSObject(structure);
+        structure = constructor->scope().node()->globalObject()->emptyObjectStructure();
+    return new (stackFrame.globalData) JSObject(structure);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_construct_NotJSConstruct(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_construct_NotJSConstruct)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    JSValuePtr constrVal = ARG_src1;
-    int argCount = ARG_int3;
-    int thisRegister = ARG_int5;
+    JSValue constrVal = stackFrame.args[0].jsValue();
+    int argCount = stackFrame.args[2].int32();
+    int thisRegister = stackFrame.args[4].int32();
 
     ConstructData constructData;
     ConstructType constructType = constrVal.getConstructData(constructData);
@@ -1088,35 +1447,35 @@
     if (constructType == ConstructTypeHost) {
         ArgList argList(callFrame->registers() + thisRegister + 1, argCount - 1);
 
-        JSValuePtr returnValue;
+        JSValue returnValue;
         {
             SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
             returnValue = constructData.native.function(callFrame, asObject(constrVal), argList);
         }
         CHECK_FOR_EXCEPTION();
 
-        return JSValuePtr::encode(returnValue);
+        return JSValue::encode(returnValue);
     }
 
     ASSERT(constructType == ConstructTypeNone);
 
     CodeBlock* codeBlock = callFrame->codeBlock();
     unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createNotAConstructorError(callFrame, constrVal, vPCIndex, codeBlock);
+    stackFrame.globalData->exception = createNotAConstructorError(callFrame, constrVal, vPCIndex, codeBlock);
     VM_THROW_EXCEPTION();
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_get_by_val(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSGlobalData* globalData = ARG_globalData;
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
 
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
 
-    JSValuePtr result;
+    JSValue result;
 
     if (LIKELY(subscript.isUInt32Fast())) {
         uint32_t i = subscript.getUInt32Fast();
@@ -1126,12 +1485,14 @@
                 result = jsArray->getIndex(i);
             else
                 result = jsArray->JSArray::get(callFrame, i);
-        } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
-            result = asString(baseValue)->getIndex(ARG_globalData, i);
-        else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+        } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i)) {
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_val_byte_array));
-            return JSValuePtr::encode(asByteArray(baseValue)->getIndex(callFrame, i));
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_string));
+            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+        } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_byte_array));
+            return JSValue::encode(asByteArray(baseValue)->getIndex(callFrame, i));
         } else
             result = baseValue.get(callFrame, i);
     } else {
@@ -1140,45 +1501,76 @@
     }
 
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
-
-JSValueEncodedAsPointer* JITStubs::cti_op_get_by_val_byte_array(STUB_ARGS)
+    
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_string)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
     
-    CallFrame* callFrame = ARG_callFrame;
-    JSGlobalData* globalData = ARG_globalData;
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
     
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
     
-    JSValuePtr result;
-
+    JSValue result;
+    
     if (LIKELY(subscript.isUInt32Fast())) {
         uint32_t i = subscript.getUInt32Fast();
-        if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
-            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
-            return JSValuePtr::encode(asByteArray(baseValue)->getIndex(callFrame, i));
+        if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
+            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+        else {
+            result = baseValue.get(callFrame, i);
+            if (!isJSString(globalData, baseValue))
+                ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val));
         }
-
-        result = baseValue.get(callFrame, i);
-        if (!isJSByteArray(globalData, baseValue))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_val));
     } else {
         Identifier property(callFrame, subscript.toString(callFrame));
         result = baseValue.get(callFrame, property);
     }
     
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
+}
+    
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_byte_array)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
+    
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+    
+    JSValue result;
+
+    if (LIKELY(subscript.isUInt32Fast())) {
+        uint32_t i = subscript.getUInt32Fast();
+        if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            return JSValue::encode(asByteArray(baseValue)->getIndex(callFrame, i));
+        }
+
+        result = baseValue.get(callFrame, i);
+        if (!isJSByteArray(globalData, baseValue))
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val));
+    } else {
+        Identifier property(callFrame, subscript.toString(callFrame));
+        result = baseValue.get(callFrame, property);
+    }
+    
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
 }
 
-VoidPtrPair JITStubs::cti_op_resolve_func(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_func)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
     ScopeChainNode* scopeChain = callFrame->scopeChain();
 
     ScopeChainIterator iter = scopeChain->begin();
@@ -1188,7 +1580,7 @@
 
     ASSERT(iter != end);
 
-    Identifier& ident = *ARG_id1;
+    Identifier& ident = stackFrame.args[0].identifier();
     JSObject* base;
     do {
         base = *iter;
@@ -1202,48 +1594,50 @@
             // that in host objects you always get a valid object for this.
             // We also handle wrapper substitution for the global object at the same time.
             JSObject* thisObj = base->toThisObject(callFrame);
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             CHECK_FOR_EXCEPTION_AT_END();
 
-            RETURN_PAIR(thisObj, JSValuePtr::encode(result));
+            callFrame->registers()[stackFrame.args[1].int32()] = JSValue(thisObj);
+            return JSValue::encode(result);
         }
         ++iter;
     } while (iter != end);
 
     CodeBlock* codeBlock = callFrame->codeBlock();
     unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION_2();
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION_AT_END();
+    return JSValue::encode(JSValue());
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_sub(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_sub)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
 
     double left;
     double right;
     if (src1.getNumber(left) && src2.getNumber(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left - right));
+        return JSValue::encode(jsNumber(stackFrame.globalData, left - right));
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toNumber(callFrame) - src2.toNumber(callFrame));
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) - src2.toNumber(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-void JITStubs::cti_op_put_by_val(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_put_by_val)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSGlobalData* globalData = ARG_globalData;
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
 
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
-    JSValuePtr value = ARG_src3;
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+    JSValue value = stackFrame.args[2].jsValue();
 
     if (LIKELY(subscript.isUInt32Fast())) {
         uint32_t i = subscript.getUInt32Fast();
@@ -1255,7 +1649,7 @@
                 jsArray->JSArray::put(callFrame, i, value);
         } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
             JSByteArray* jsByteArray = asByteArray(baseValue);
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_put_by_val_byte_array));
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_val_byte_array));
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
             if (value.isInt32Fast()) {
                 jsByteArray->setIndex(i, value.getInt32Fast());
@@ -1273,7 +1667,7 @@
             baseValue.put(callFrame, i, value);
     } else {
         Identifier property(callFrame, subscript.toString(callFrame));
-        if (!ARG_globalData->exception) { // Don't put to an object if toString threw an exception.
+        if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
             PutPropertySlot slot;
             baseValue.put(callFrame, property, value, slot);
         }
@@ -1282,25 +1676,25 @@
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-void JITStubs::cti_op_put_by_val_array(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_put_by_val_array)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr baseValue = ARG_src1;
-    int i = ARG_int2;
-    JSValuePtr value = ARG_src3;
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    int i = stackFrame.args[1].int32();
+    JSValue value = stackFrame.args[2].jsValue();
 
-    ASSERT(isJSArray(ARG_globalData, baseValue));
+    ASSERT(isJSArray(stackFrame.globalData, baseValue));
 
     if (LIKELY(i >= 0))
         asArray(baseValue)->JSArray::put(callFrame, i, value);
     else {
         // This should work since we're re-boxing an immediate unboxed in JIT code.
-        ASSERT(JSValuePtr::makeInt32Fast(i));
-        Identifier property(callFrame, JSValuePtr::makeInt32Fast(i).toString(callFrame));
+        ASSERT(JSValue::makeInt32Fast(i));
+        Identifier property(callFrame, JSValue::makeInt32Fast(i).toString(callFrame));
         // FIXME: can toString throw an exception here?
-        if (!ARG_globalData->exception) { // Don't put to an object if toString threw an exception.
+        if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
             PutPropertySlot slot;
             baseValue.put(callFrame, property, value, slot);
         }
@@ -1309,16 +1703,16 @@
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-void JITStubs::cti_op_put_by_val_byte_array(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_put_by_val_byte_array)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
     
-    CallFrame* callFrame = ARG_callFrame;
-    JSGlobalData* globalData = ARG_globalData;
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
     
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
-    JSValuePtr value = ARG_src3;
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+    JSValue value = stackFrame.args[2].jsValue();
     
     if (LIKELY(subscript.isUInt32Fast())) {
         uint32_t i = subscript.getUInt32Fast();
@@ -1339,11 +1733,11 @@
         }
 
         if (!isJSByteArray(globalData, baseValue))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_put_by_val));
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_val));
         baseValue.put(callFrame, i, value);
     } else {
         Identifier property(callFrame, subscript.toString(callFrame));
-        if (!ARG_globalData->exception) { // Don't put to an object if toString threw an exception.
+        if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
             PutPropertySlot slot;
             baseValue.put(callFrame, property, value, slot);
         }
@@ -1352,60 +1746,148 @@
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_lesseq(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_lesseq)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(jsLessEq(callFrame, ARG_src1, ARG_src2));
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsBoolean(jsLessEq(callFrame, stackFrame.args[0].jsValue(), stackFrame.args[1].jsValue()));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-int JITStubs::cti_op_loop_if_true(STUB_ARGS)
+DEFINE_STUB_FUNCTION(int, op_loop_if_true)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
+    JSValue src1 = stackFrame.args[0].jsValue();
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
     bool result = src1.toBoolean(callFrame);
     CHECK_FOR_EXCEPTION_AT_END();
     return result;
 }
-
-JSValueEncodedAsPointer* JITStubs::cti_op_negate(STUB_ARGS)
+    
+DEFINE_STUB_FUNCTION(int, op_load_varargs)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
+    RegisterFile* registerFile = stackFrame.registerFile;
+    int argsOffset = stackFrame.args[0].int32();
+    JSValue arguments = callFrame->registers()[argsOffset].jsValue();
+    uint32_t argCount = 0;
+    if (!arguments) {
+        int providedParams = callFrame->registers()[RegisterFile::ArgumentCount].i() - 1;
+        argCount = providedParams;
+        int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+        Register* newEnd = callFrame->registers() + sizeDelta;
+        if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+            stackFrame.globalData->exception = createStackOverflowError(callFrame);
+            VM_THROW_EXCEPTION();
+        }
+        int32_t expectedParams = asFunction(callFrame->registers()[RegisterFile::Callee].jsValue())->body()->parameterCount();
+        int32_t inplaceArgs = min(providedParams, expectedParams);
+        
+        Register* inplaceArgsDst = callFrame->registers() + argsOffset;
 
-    JSValuePtr src = ARG_src1;
+        Register* inplaceArgsEnd = inplaceArgsDst + inplaceArgs;
+        Register* inplaceArgsEnd2 = inplaceArgsDst + providedParams;
+
+        Register* inplaceArgsSrc = callFrame->registers() - RegisterFile::CallFrameHeaderSize - expectedParams;
+        Register* inplaceArgsSrc2 = inplaceArgsSrc - providedParams - 1 + inplaceArgs;
+ 
+        // First step is to copy the "expected" parameters from their normal location relative to the callframe
+        while (inplaceArgsDst < inplaceArgsEnd)
+            *inplaceArgsDst++ = *inplaceArgsSrc++;
+
+        // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this')
+        while (inplaceArgsDst < inplaceArgsEnd2)
+            *inplaceArgsDst++ = *inplaceArgsSrc2++;
+
+    } else if (!arguments.isUndefinedOrNull()) {
+        if (!arguments.isObject()) {
+            CodeBlock* codeBlock = callFrame->codeBlock();
+            unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+            stackFrame.globalData->exception = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPCIndex, codeBlock);
+            VM_THROW_EXCEPTION();
+        }
+        if (asObject(arguments)->classInfo() == &Arguments::info) {
+            Arguments* argsObject = asArguments(arguments);
+            argCount = argsObject->numProvidedArguments(callFrame);
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                stackFrame.globalData->exception = createStackOverflowError(callFrame);
+                VM_THROW_EXCEPTION();
+            }
+            argsObject->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+        } else if (isJSArray(&callFrame->globalData(), arguments)) {
+            JSArray* array = asArray(arguments);
+            argCount = array->length();
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                stackFrame.globalData->exception = createStackOverflowError(callFrame);
+                VM_THROW_EXCEPTION();
+            }
+            array->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+        } else if (asObject(arguments)->inherits(&JSArray::info)) {
+            JSObject* argObject = asObject(arguments);
+            argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                stackFrame.globalData->exception = createStackOverflowError(callFrame);
+                VM_THROW_EXCEPTION();
+            }
+            Register* argsBuffer = callFrame->registers() + argsOffset;
+            for (unsigned i = 0; i < argCount; ++i) {
+                argsBuffer[i] = asObject(arguments)->get(callFrame, i);
+                CHECK_FOR_EXCEPTION();
+            }
+        } else {
+            CodeBlock* codeBlock = callFrame->codeBlock();
+            unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+            stackFrame.globalData->exception = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPCIndex, codeBlock);
+            VM_THROW_EXCEPTION();
+        }
+    }
+
+    return argCount + 1;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_negate)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src = stackFrame.args[0].jsValue();
 
     double v;
     if (src.getNumber(v))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, -v));
+        return JSValue::encode(jsNumber(stackFrame.globalData, -v));
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, -src.toNumber(callFrame));
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, -src.toNumber(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_resolve_base(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_base)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValuePtr::encode(JSC::resolveBase(ARG_callFrame, *ARG_id1, ARG_callFrame->scopeChain()));
+    return JSValue::encode(JSC::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.callFrame->scopeChain()));
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_resolve_skip(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_skip)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
     ScopeChainNode* scopeChain = callFrame->scopeChain();
 
-    int skip = ARG_int2;
+    int skip = stackFrame.args[1].int32();
 
     ScopeChainIterator iter = scopeChain->begin();
     ScopeChainIterator end = scopeChain->end();
@@ -1414,232 +1896,246 @@
         ++iter;
         ASSERT(iter != end);
     }
-    Identifier& ident = *ARG_id1;
+    Identifier& ident = stackFrame.args[0].identifier();
     do {
         JSObject* o = *iter;
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             CHECK_FOR_EXCEPTION_AT_END();
-            return JSValuePtr::encode(result);
+            return JSValue::encode(result);
         }
     } while (++iter != end);
 
     CodeBlock* codeBlock = callFrame->codeBlock();
     unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
     VM_THROW_EXCEPTION();
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_resolve_global(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSGlobalObject* globalObject = asGlobalObject(ARG_src1);
-    Identifier& ident = *ARG_id2;
-    unsigned globalResolveInfoIndex = ARG_int3;
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalObject* globalObject = asGlobalObject(stackFrame.args[0].jsValue());
+    Identifier& ident = stackFrame.args[1].identifier();
+    unsigned globalResolveInfoIndex = stackFrame.args[2].int32();
     ASSERT(globalObject->isGlobalObject());
 
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
-        JSValuePtr result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary()) {
+        JSValue result = slot.getValue(callFrame, ident);
+        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
             GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
             if (globalResolveInfo.structure)
                 globalResolveInfo.structure->deref();
             globalObject->structure()->ref();
             globalResolveInfo.structure = globalObject->structure();
             globalResolveInfo.offset = slot.cachedOffset();
-            return JSValuePtr::encode(result);
+            return JSValue::encode(result);
         }
 
         CHECK_FOR_EXCEPTION_AT_END();
-        return JSValuePtr::encode(result);
+        return JSValue::encode(result);
     }
 
     unsigned vPCIndex = callFrame->codeBlock()->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, callFrame->codeBlock());
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, callFrame->codeBlock());
     VM_THROW_EXCEPTION();
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_div(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_div)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
 
     double left;
     double right;
     if (src1.getNumber(left) && src2.getNumber(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left / right));
+        return JSValue::encode(jsNumber(stackFrame.globalData, left / right));
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toNumber(callFrame) / src2.toNumber(callFrame));
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) / src2.toNumber(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_pre_dec(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_pre_dec)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr v = ARG_src1;
+    JSValue v = stackFrame.args[0].jsValue();
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, v.toNumber(callFrame) - 1);
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, v.toNumber(callFrame) - 1);
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-int JITStubs::cti_op_jless(STUB_ARGS)
+DEFINE_STUB_FUNCTION(int, op_jless)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
 
     bool result = jsLess(callFrame, src1, src2);
     CHECK_FOR_EXCEPTION_AT_END();
     return result;
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_not(STUB_ARGS)
+DEFINE_STUB_FUNCTION(int, op_jlesseq)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src = ARG_src1;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = jsBoolean(!src.toBoolean(callFrame));
+    bool result = jsLessEq(callFrame, src1, src2);
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return result;
 }
 
-int JITStubs::cti_op_jtrue(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_not)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
+    JSValue src = stackFrame.args[0].jsValue();
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue result = jsBoolean(!src.toBoolean(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(int, op_jtrue)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
 
     bool result = src1.toBoolean(callFrame);
     CHECK_FOR_EXCEPTION_AT_END();
     return result;
 }
 
-VoidPtrPair JITStubs::cti_op_post_inc(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_inc)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr v = ARG_src1;
+    JSValue v = stackFrame.args[0].jsValue();
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    JSValuePtr number = v.toJSNumber(callFrame);
+    JSValue number = v.toJSNumber(callFrame);
     CHECK_FOR_EXCEPTION_AT_END();
 
-    RETURN_PAIR(JSValuePtr::encode(number), JSValuePtr::encode(jsNumber(ARG_globalData, number.uncheckedGetNumber() + 1)));
+    callFrame->registers()[stackFrame.args[1].int32()] = jsNumber(stackFrame.globalData, number.uncheckedGetNumber() + 1);
+    return JSValue::encode(number);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_eq(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_eq)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    ASSERT(!JSValuePtr::areBothInt32Fast(src1, src2));
-    JSValuePtr result = jsBoolean(JSValuePtr::equalSlowCaseInline(callFrame, src1, src2));
+    ASSERT(!JSValue::areBothInt32Fast(src1, src2));
+    JSValue result = jsBoolean(JSValue::equalSlowCaseInline(callFrame, src1, src2));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_lshift(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_lshift)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
+    JSValue val = stackFrame.args[0].jsValue();
+    JSValue shift = stackFrame.args[1].jsValue();
 
     int32_t left;
     uint32_t right;
-    if (JSValuePtr::areBothInt32Fast(val, shift))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, val.getInt32Fast() << (shift.getInt32Fast() & 0x1f)));
+    if (JSValue::areBothInt32Fast(val, shift))
+        return JSValue::encode(jsNumber(stackFrame.globalData, val.getInt32Fast() << (shift.getInt32Fast() & 0x1f)));
     if (val.numberToInt32(left) && shift.numberToUInt32(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left << (right & 0x1f)));
+        return JSValue::encode(jsNumber(stackFrame.globalData, left << (right & 0x1f)));
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_bitand(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitand)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
 
     int32_t left;
     int32_t right;
     if (src1.numberToInt32(left) && src2.numberToInt32(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left & right));
+        return JSValue::encode(jsNumber(stackFrame.globalData, left & right));
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toInt32(callFrame) & src2.toInt32(callFrame));
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) & src2.toInt32(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_rshift(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_rshift)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
+    JSValue val = stackFrame.args[0].jsValue();
+    JSValue shift = stackFrame.args[1].jsValue();
 
     int32_t left;
     uint32_t right;
     if (JSFastMath::canDoFastRshift(val, shift))
-        return JSValuePtr::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
+        return JSValue::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
     if (val.numberToInt32(left) && shift.numberToUInt32(right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left >> (right & 0x1f)));
+        return JSValue::encode(jsNumber(stackFrame.globalData, left >> (right & 0x1f)));
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_bitnot(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitnot)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src = ARG_src1;
+    JSValue src = stackFrame.args[0].jsValue();
 
     int value;
     if (src.numberToInt32(value))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, ~value));
+        return JSValue::encode(jsNumber(stackFrame.globalData, ~value));
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, ~src.toInt32(callFrame));
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, ~src.toInt32(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-VoidPtrPair JITStubs::cti_op_resolve_with_base(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_with_base)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
     ScopeChainNode* scopeChain = callFrame->scopeChain();
 
     ScopeChainIterator iter = scopeChain->begin();
@@ -1649,357 +2145,375 @@
 
     ASSERT(iter != end);
 
-    Identifier& ident = *ARG_id1;
+    Identifier& ident = stackFrame.args[0].identifier();
     JSObject* base;
     do {
         base = *iter;
         PropertySlot slot(base);
         if (base->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             CHECK_FOR_EXCEPTION_AT_END();
 
-            RETURN_PAIR(base, JSValuePtr::encode(result));
+            callFrame->registers()[stackFrame.args[1].int32()] = JSValue(base);
+            return JSValue::encode(result);
         }
         ++iter;
     } while (iter != end);
 
     CodeBlock* codeBlock = callFrame->codeBlock();
     unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION_2();
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION_AT_END();
+    return JSValue::encode(JSValue());
 }
 
-JSObject* JITStubs::cti_op_new_func_exp(STUB_ARGS)
+DEFINE_STUB_FUNCTION(JSObject*, op_new_func_exp)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return ARG_funcexp1->makeFunction(ARG_callFrame, ARG_callFrame->scopeChain());
+    return stackFrame.args[0].funcExprNode()->makeFunction(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_mod(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_mod)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr dividendValue = ARG_src1;
-    JSValuePtr divisorValue = ARG_src2;
+    JSValue dividendValue = stackFrame.args[0].jsValue();
+    JSValue divisorValue = stackFrame.args[1].jsValue();
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
     double d = dividendValue.toNumber(callFrame);
-    JSValuePtr result = jsNumber(ARG_globalData, fmod(d, divisorValue.toNumber(callFrame)));
+    JSValue result = jsNumber(stackFrame.globalData, fmod(d, divisorValue.toNumber(callFrame)));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_less(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_less)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(jsLess(callFrame, ARG_src1, ARG_src2));
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsBoolean(jsLess(callFrame, stackFrame.args[0].jsValue(), stackFrame.args[1].jsValue()));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_neq(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_neq)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
 
-    ASSERT(!JSValuePtr::areBothInt32Fast(src1, src2));
+    ASSERT(!JSValue::areBothInt32Fast(src1, src2));
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(!JSValuePtr::equalSlowCaseInline(callFrame, src1, src2));
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsBoolean(!JSValue::equalSlowCaseInline(callFrame, src1, src2));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-VoidPtrPair JITStubs::cti_op_post_dec(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_dec)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr v = ARG_src1;
+    JSValue v = stackFrame.args[0].jsValue();
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    JSValuePtr number = v.toJSNumber(callFrame);
+    JSValue number = v.toJSNumber(callFrame);
     CHECK_FOR_EXCEPTION_AT_END();
 
-    RETURN_PAIR(JSValuePtr::encode(number), JSValuePtr::encode(jsNumber(ARG_globalData, number.uncheckedGetNumber() - 1)));
+    callFrame->registers()[stackFrame.args[1].int32()] = jsNumber(stackFrame.globalData, number.uncheckedGetNumber() - 1);
+    return JSValue::encode(number);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_urshift(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_urshift)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
+    JSValue val = stackFrame.args[0].jsValue();
+    JSValue shift = stackFrame.args[1].jsValue();
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
     if (JSFastMath::canDoFastUrshift(val, shift))
-        return JSValuePtr::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
+        return JSValue::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
     else {
-        JSValuePtr result = jsNumber(ARG_globalData, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+        JSValue result = jsNumber(stackFrame.globalData, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
         CHECK_FOR_EXCEPTION_AT_END();
-        return JSValuePtr::encode(result);
+        return JSValue::encode(result);
     }
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_bitxor(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitxor)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
+    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSObject* JITStubs::cti_op_new_regexp(STUB_ARGS)
+DEFINE_STUB_FUNCTION(JSObject*, op_new_regexp)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return new (ARG_globalData) RegExpObject(ARG_callFrame->lexicalGlobalObject()->regExpStructure(), ARG_regexp1);
+    return new (stackFrame.globalData) RegExpObject(stackFrame.callFrame->lexicalGlobalObject()->regExpStructure(), stackFrame.args[0].regExp());
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_bitor(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitor)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    JSValuePtr result = jsNumber(ARG_globalData, src1.toInt32(callFrame) | src2.toInt32(callFrame));
+    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) | src2.toInt32(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_call_eval(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_eval)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    RegisterFile* registerFile = ARG_registerFile;
+    CallFrame* callFrame = stackFrame.callFrame;
+    RegisterFile* registerFile = stackFrame.registerFile;
 
-    Interpreter* interpreter = ARG_globalData->interpreter;
+    Interpreter* interpreter = stackFrame.globalData->interpreter;
     
-    JSValuePtr funcVal = ARG_src1;
-    int registerOffset = ARG_int2;
-    int argCount = ARG_int3;
+    JSValue funcVal = stackFrame.args[0].jsValue();
+    int registerOffset = stackFrame.args[1].int32();
+    int argCount = stackFrame.args[2].int32();
 
     Register* newCallFrame = callFrame->registers() + registerOffset;
     Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
-    JSValuePtr thisValue = argv[0].jsValue(callFrame);
+    JSValue thisValue = argv[0].jsValue();
     JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
 
     if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
-        JSValuePtr exceptionValue = noValue();
-        JSValuePtr result = interpreter->callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
-        if (UNLIKELY(exceptionValue != noValue())) {
-            ARG_globalData->exception = exceptionValue;
+        JSValue exceptionValue;
+        JSValue result = interpreter->callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
+        if (UNLIKELY(exceptionValue != JSValue())) {
+            stackFrame.globalData->exception = exceptionValue;
             VM_THROW_EXCEPTION_AT_END();
         }
-        return JSValuePtr::encode(result);
+        return JSValue::encode(result);
     }
 
-    return JSValuePtr::encode(jsImpossibleValue());
+    return JSValue::encode(JSValue());
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_throw(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
     CodeBlock* codeBlock = callFrame->codeBlock();
 
     unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
 
-    JSValuePtr exceptionValue = ARG_src1;
+    JSValue exceptionValue = stackFrame.args[0].jsValue();
     ASSERT(exceptionValue);
 
-    HandlerInfo* handler = ARG_globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, true);
+    HandlerInfo* handler = stackFrame.globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, true);
 
     if (!handler) {
-        *ARG_exception = exceptionValue;
-        return JSValuePtr::encode(jsNull());
+        *stackFrame.exception = exceptionValue;
+        STUB_SET_RETURN_ADDRESS(reinterpret_cast<void*>(ctiOpThrowNotCaught));
+        return JSValue::encode(jsNull());
     }
 
-    ARG_setCallFrame(callFrame);
+    stackFrame.callFrame = callFrame;
     void* catchRoutine = handler->nativeCode.addressForExceptionHandler();
     ASSERT(catchRoutine);
     STUB_SET_RETURN_ADDRESS(catchRoutine);
-    return JSValuePtr::encode(exceptionValue);
+    return JSValue::encode(exceptionValue);
 }
 
-JSPropertyNameIterator* JITStubs::cti_op_get_pnames(STUB_ARGS)
+DEFINE_STUB_FUNCTION(JSPropertyNameIterator*, op_get_pnames)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSPropertyNameIterator::create(ARG_callFrame, ARG_src1);
+    return JSPropertyNameIterator::create(stackFrame.callFrame, stackFrame.args[0].jsValue());
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_next_pname(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_next_pname)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSPropertyNameIterator* it = ARG_pni1;
-    JSValuePtr temp = it->next(ARG_callFrame);
+    JSPropertyNameIterator* it = stackFrame.args[0].propertyNameIterator();
+    JSValue temp = it->next(stackFrame.callFrame);
     if (!temp)
         it->invalidate();
-    return JSValuePtr::encode(temp);
+    return JSValue::encode(temp);
 }
 
-JSObject* JITStubs::cti_op_push_scope(STUB_ARGS)
+DEFINE_STUB_FUNCTION(JSObject*, op_push_scope)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSObject* o = ARG_src1.toObject(ARG_callFrame);
+    JSObject* o = stackFrame.args[0].jsValue().toObject(stackFrame.callFrame);
     CHECK_FOR_EXCEPTION();
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->push(o));
+    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->push(o));
     return o;
 }
 
-void JITStubs::cti_op_pop_scope(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_pop_scope)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->pop());
+    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->pop());
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_typeof(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_typeof)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValuePtr::encode(jsTypeStringForValue(ARG_callFrame, ARG_src1));
+    return JSValue::encode(jsTypeStringForValue(stackFrame.callFrame, stackFrame.args[0].jsValue()));
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_is_undefined(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_undefined)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr v = ARG_src1;
-    return JSValuePtr::encode(jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined()));
+    JSValue v = stackFrame.args[0].jsValue();
+    return JSValue::encode(jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined()));
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_is_boolean(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_boolean)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValuePtr::encode(jsBoolean(ARG_src1.isBoolean()));
+    return JSValue::encode(jsBoolean(stackFrame.args[0].jsValue().isBoolean()));
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_is_number(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_number)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValuePtr::encode(jsBoolean(ARG_src1.isNumber()));
+    return JSValue::encode(jsBoolean(stackFrame.args[0].jsValue().isNumber()));
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_is_string(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_string)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValuePtr::encode(jsBoolean(isJSString(ARG_globalData, ARG_src1)));
+    return JSValue::encode(jsBoolean(isJSString(stackFrame.globalData, stackFrame.args[0].jsValue())));
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_is_object(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_object)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValuePtr::encode(jsBoolean(jsIsObjectType(ARG_src1)));
+    return JSValue::encode(jsBoolean(jsIsObjectType(stackFrame.args[0].jsValue())));
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_is_function(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_function)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValuePtr::encode(jsBoolean(jsIsFunctionType(ARG_src1)));
+    return JSValue::encode(jsBoolean(jsIsFunctionType(stackFrame.args[0].jsValue())));
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_stricteq(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_stricteq)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
 
-    return JSValuePtr::encode(jsBoolean(JSValuePtr::strictEqual(src1, src2)));
+    return JSValue::encode(jsBoolean(JSValue::strictEqual(src1, src2)));
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_nstricteq(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_primitive)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    return JSValuePtr::encode(jsBoolean(!JSValuePtr::strictEqual(src1, src2)));
+    return JSValue::encode(stackFrame.args[0].jsValue().toPrimitive(stackFrame.callFrame));
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_to_jsnumber(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_strcat)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr src = ARG_src1;
-    CallFrame* callFrame = ARG_callFrame;
+    return JSValue::encode(concatenateStrings(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32()));
+}
 
-    JSValuePtr result = src.toJSNumber(callFrame);
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_nstricteq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    return JSValue::encode(jsBoolean(!JSValue::strictEqual(src1, src2)));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_jsnumber)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src = stackFrame.args[0].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue result = src.toJSNumber(callFrame);
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_in(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_in)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr baseVal = ARG_src2;
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue baseVal = stackFrame.args[1].jsValue();
 
     if (!baseVal.isObject()) {
-        CallFrame* callFrame = ARG_callFrame;
+        CallFrame* callFrame = stackFrame.callFrame;
         CodeBlock* codeBlock = callFrame->codeBlock();
         unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-        ARG_globalData->exception = createInvalidParamError(callFrame, "in", baseVal, vPCIndex, codeBlock);
+        stackFrame.globalData->exception = createInvalidParamError(callFrame, "in", baseVal, vPCIndex, codeBlock);
         VM_THROW_EXCEPTION();
     }
 
-    JSValuePtr propName = ARG_src1;
+    JSValue propName = stackFrame.args[0].jsValue();
     JSObject* baseObj = asObject(baseVal);
 
     uint32_t i;
     if (propName.getUInt32(i))
-        return JSValuePtr::encode(jsBoolean(baseObj->hasProperty(callFrame, i)));
+        return JSValue::encode(jsBoolean(baseObj->hasProperty(callFrame, i)));
 
     Identifier property(callFrame, propName.toString(callFrame));
     CHECK_FOR_EXCEPTION();
-    return JSValuePtr::encode(jsBoolean(baseObj->hasProperty(callFrame, property)));
+    return JSValue::encode(jsBoolean(baseObj->hasProperty(callFrame, property)));
 }
 
-JSObject* JITStubs::cti_op_push_new_scope(STUB_ARGS)
+DEFINE_STUB_FUNCTION(JSObject*, op_push_new_scope)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSObject* scope = new (ARG_globalData) JSStaticScopeObject(ARG_callFrame, *ARG_id1, ARG_src2, DontDelete);
+    JSObject* scope = new (stackFrame.globalData) JSStaticScopeObject(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.args[1].jsValue(), DontDelete);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
     callFrame->setScopeChain(callFrame->scopeChain()->push(scope));
     return scope;
 }
 
-void JITStubs::cti_op_jmp_scopes(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_jmp_scopes)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    unsigned count = ARG_int1;
-    CallFrame* callFrame = ARG_callFrame;
+    unsigned count = stackFrame.args[0].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
 
     ScopeChainNode* tmp = callFrame->scopeChain();
     while (count--)
@@ -2007,23 +2521,23 @@
     callFrame->setScopeChain(tmp);
 }
 
-void JITStubs::cti_op_put_by_index(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_put_by_index)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
-    unsigned property = ARG_int2;
+    CallFrame* callFrame = stackFrame.callFrame;
+    unsigned property = stackFrame.args[1].int32();
 
-    ARG_src1.put(callFrame, property, ARG_src3);
+    stackFrame.args[0].jsValue().put(callFrame, property, stackFrame.args[2].jsValue());
 }
 
-void* JITStubs::cti_op_switch_imm(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void*, op_switch_imm)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
+    JSValue scrutinee = stackFrame.args[0].jsValue();
+    unsigned tableIndex = stackFrame.args[1].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
     CodeBlock* codeBlock = callFrame->codeBlock();
 
     if (scrutinee.isInt32Fast())
@@ -2038,13 +2552,13 @@
     }
 }
 
-void* JITStubs::cti_op_switch_char(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void*, op_switch_char)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
+    JSValue scrutinee = stackFrame.args[0].jsValue();
+    unsigned tableIndex = stackFrame.args[1].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
     CodeBlock* codeBlock = callFrame->codeBlock();
 
     void* result = codeBlock->characterSwitchJumpTable(tableIndex).ctiDefault.addressForSwitch();
@@ -2058,13 +2572,13 @@
     return result;
 }
 
-void* JITStubs::cti_op_switch_string(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void*, op_switch_string)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
+    JSValue scrutinee = stackFrame.args[0].jsValue();
+    unsigned tableIndex = stackFrame.args[1].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
     CodeBlock* codeBlock = callFrame->codeBlock();
 
     void* result = codeBlock->stringSwitchJumpTable(tableIndex).ctiDefault.addressForSwitch();
@@ -2077,17 +2591,17 @@
     return result;
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_op_del_by_val(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_del_by_val)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    JSValuePtr baseValue = ARG_src1;
+    JSValue baseValue = stackFrame.args[0].jsValue();
     JSObject* baseObj = baseValue.toObject(callFrame); // may throw
 
-    JSValuePtr subscript = ARG_src2;
-    JSValuePtr result;
+    JSValue subscript = stackFrame.args[1].jsValue();
+    JSValue result;
     uint32_t i;
     if (subscript.getUInt32(i))
         result = jsBoolean(baseObj->deleteProperty(callFrame, i));
@@ -2099,97 +2613,89 @@
     }
 
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
+    return JSValue::encode(result);
 }
 
-void JITStubs::cti_op_put_getter(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_put_getter)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    ASSERT(ARG_src1.isObject());
-    JSObject* baseObj = asObject(ARG_src1);
-    ASSERT(ARG_src3.isObject());
-    baseObj->defineGetter(callFrame, *ARG_id2, asObject(ARG_src3));
+    ASSERT(stackFrame.args[0].jsValue().isObject());
+    JSObject* baseObj = asObject(stackFrame.args[0].jsValue());
+    ASSERT(stackFrame.args[2].jsValue().isObject());
+    baseObj->defineGetter(callFrame, stackFrame.args[1].identifier(), asObject(stackFrame.args[2].jsValue()));
 }
 
-void JITStubs::cti_op_put_setter(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_put_setter)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    ASSERT(ARG_src1.isObject());
-    JSObject* baseObj = asObject(ARG_src1);
-    ASSERT(ARG_src3.isObject());
-    baseObj->defineSetter(callFrame, *ARG_id2, asObject(ARG_src3));
+    ASSERT(stackFrame.args[0].jsValue().isObject());
+    JSObject* baseObj = asObject(stackFrame.args[0].jsValue());
+    ASSERT(stackFrame.args[2].jsValue().isObject());
+    baseObj->defineSetter(callFrame, stackFrame.args[1].identifier(), asObject(stackFrame.args[2].jsValue()));
 }
 
-JSObject* JITStubs::cti_op_new_error(STUB_ARGS)
+DEFINE_STUB_FUNCTION(JSObject*, op_new_error)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
     CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned type = ARG_int1;
-    JSValuePtr message = ARG_src2;
-    unsigned bytecodeOffset = ARG_int3;
+    unsigned type = stackFrame.args[0].int32();
+    JSValue message = stackFrame.args[1].jsValue();
+    unsigned bytecodeOffset = stackFrame.args[2].int32();
 
     unsigned lineNumber = codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset);
     return Error::create(callFrame, static_cast<ErrorType>(type), message.toString(callFrame), lineNumber, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
 }
 
-void JITStubs::cti_op_debug(STUB_ARGS)
+DEFINE_STUB_FUNCTION(void, op_debug)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    int debugHookID = ARG_int1;
-    int firstLine = ARG_int2;
-    int lastLine = ARG_int3;
+    int debugHookID = stackFrame.args[0].int32();
+    int firstLine = stackFrame.args[1].int32();
+    int lastLine = stackFrame.args[2].int32();
 
-    ARG_globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
+    stackFrame.globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
 }
 
-JSValueEncodedAsPointer* JITStubs::cti_vm_throw(STUB_ARGS)
+DEFINE_STUB_FUNCTION(EncodedJSValue, vm_throw)
 {
-    BEGIN_STUB_FUNCTION();
+    STUB_INIT_STACK_FRAME(stackFrame);
 
-    CallFrame* callFrame = ARG_callFrame;
+    CallFrame* callFrame = stackFrame.callFrame;
     CodeBlock* codeBlock = callFrame->codeBlock();
-    JSGlobalData* globalData = ARG_globalData;
+    JSGlobalData* globalData = stackFrame.globalData;
 
     unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, globalData->exceptionLocation);
 
-    JSValuePtr exceptionValue = globalData->exception;
+    JSValue exceptionValue = globalData->exception;
     ASSERT(exceptionValue);
-    globalData->exception = noValue();
+    globalData->exception = JSValue();
 
     HandlerInfo* handler = globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, false);
 
     if (!handler) {
-        *ARG_exception = exceptionValue;
-        return JSValuePtr::encode(jsNull());
+        *stackFrame.exception = exceptionValue;
+        return JSValue::encode(jsNull());
     }
 
-    ARG_setCallFrame(callFrame);
+    stackFrame.callFrame = callFrame;
     void* catchRoutine = handler->nativeCode.addressForExceptionHandler();
     ASSERT(catchRoutine);
     STUB_SET_RETURN_ADDRESS(catchRoutine);
-    return JSValuePtr::encode(exceptionValue);
+    return JSValue::encode(exceptionValue);
 }
 
-#undef STUB_RETURN_ADDRESS
-#undef STUB_SET_RETURN_ADDRESS
-#undef BEGIN_STUB_FUNCTION
-#undef CHECK_FOR_EXCEPTION
-#undef CHECK_FOR_EXCEPTION_AT_END
-#undef CHECK_FOR_EXCEPTION_VOID
-#undef VM_THROW_EXCEPTION
-#undef VM_THROW_EXCEPTION_2
-#undef VM_THROW_EXCEPTION_AT_END
+} // namespace JITStubs
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/jit/JITStubs.h b/JavaScriptCore/jit/JITStubs.h
index b7b8f35..8e81ade 100644
--- a/JavaScriptCore/jit/JITStubs.h
+++ b/JavaScriptCore/jit/JITStubs.h
@@ -29,196 +29,312 @@
 #ifndef JITStubs_h
 #define JITStubs_h
 
-#include "Register.h"
 #include <wtf/Platform.h>
 
+#include "MacroAssemblerCodeRef.h"
+#include "Register.h"
+
 #if ENABLE(JIT)
 
 namespace JSC {
 
+    class CodeBlock;
     class ExecutablePool;
+    class Identifier;
+    class JSGlobalData;
     class JSGlobalData;
     class JSObject;
     class JSPropertyNameIterator;
+    class JSValue;
     class JSValueEncodedAsPointer;
-    class CodeBlock;
-    class JSValuePtr;
-    class Identifier;
+    class Profiler;
     class PropertySlot;
     class PutPropertySlot;
+    class RegisterFile;
+    class FuncDeclNode;
+    class FuncExprNode;
+    class RegExp;
 
-#if USE(JIT_STUB_ARGUMENT_VA_LIST)
-    #define STUB_ARGS void* args, ...
-    #define ARGS (reinterpret_cast<void**>(vl_args) - 1)
-#else // JIT_STUB_ARGUMENT_REGISTER or JIT_STUB_ARGUMENT_STACK
-    #define STUB_ARGS void** args
-    #define ARGS (args)
+    union JITStubArg {
+        void* asPointer;
+        EncodedJSValue asEncodedJSValue;
+        int32_t asInt32;
+
+        JSValue jsValue() { return JSValue::decode(asEncodedJSValue); }
+        Identifier& identifier() { return *static_cast<Identifier*>(asPointer); }
+        int32_t int32() { return asInt32; }
+        CodeBlock* codeBlock() { return static_cast<CodeBlock*>(asPointer); }
+        FuncDeclNode* funcDeclNode() { return static_cast<FuncDeclNode*>(asPointer); }
+        FuncExprNode* funcExprNode() { return static_cast<FuncExprNode*>(asPointer); }
+        RegExp* regExp() { return static_cast<RegExp*>(asPointer); }
+        JSPropertyNameIterator* propertyNameIterator() { return static_cast<JSPropertyNameIterator*>(asPointer); }
+        void* returnAddress() { return asPointer; }
+    };
+
+#if PLATFORM(X86_64)
+    struct JITStackFrame {
+        JITStubArg padding; // Unused
+        JITStubArg args[8];
+
+        void* savedRBX;
+        void* savedR15;
+        void* savedR14;
+        void* savedR13;
+        void* savedR12;
+        void* savedRBP;
+        void* savedRIP;
+
+        void* code;
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
+
+        // When JIT code makes a call, it pushes its return address just below the rest of the stack.
+        void** returnAddressSlot() { return reinterpret_cast<void**>(this) - 1; }
+    };
+#elif PLATFORM(X86)
+    struct JITStackFrame {
+        JITStubArg padding; // Unused
+        JITStubArg args[6];
+
+        void* savedEBX;
+        void* savedEDI;
+        void* savedESI;
+        void* savedEBP;
+        void* savedEIP;
+
+        void* code;
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
+        
+        // When JIT code makes a call, it pushes its return address just below the rest of the stack.
+        void** returnAddressSlot() { return reinterpret_cast<void**>(this) - 1; }
+    };
+#elif PLATFORM(ARM_V7)
+    struct JITStackFrame {
+        JITStubArg padding; // Unused
+        JITStubArg args[6];
+
+        void* thunkReturnAddress;
+
+        void* preservedReturnAddress;
+        void* preservedR4;
+        void* preservedR5;
+        void* preservedR6;
+
+        // These arguments passed in r1..r3 (r0 contained the entry code pointed, which is not preserved)
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+
+        // These arguments passed on the stack.
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
+        
+        void** returnAddressSlot() { return &thunkReturnAddress; }
+    };
+#else
+#error "JITStackFrame not defined for this platform."
 #endif
 
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-    #if PLATFORM(X86_64)
-    #define JIT_STUB
-    #elif COMPILER(MSVC)
-    #define JIT_STUB __fastcall
-    #elif COMPILER(GCC)
-    #define JIT_STUB  __attribute__ ((fastcall))
-    #else
-    #error Need to support register calling convention in this compiler
-    #endif
-#else // JIT_STUB_ARGUMENT_VA_LIST or JIT_STUB_ARGUMENT_STACK
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+    #define STUB_ARGS_DECLARATION void* args, ...
+    #define STUB_ARGS (reinterpret_cast<void**>(vl_args) - 1)
+
     #if COMPILER(MSVC)
     #define JIT_STUB __cdecl
     #else
     #define JIT_STUB
     #endif
+#else
+    #define STUB_ARGS_DECLARATION void** args
+    #define STUB_ARGS (args)
+
+    #if PLATFORM(X86) && COMPILER(MSVC)
+    #define JIT_STUB __fastcall
+    #elif PLATFORM(X86) && COMPILER(GCC)
+    #define JIT_STUB  __attribute__ ((fastcall))
+    #else
+    #define JIT_STUB
+    #endif
 #endif
 
-// The Mac compilers are fine with this, 
-#if PLATFORM(MAC)
+#if PLATFORM(X86_64)
     struct VoidPtrPair {
         void* first;
         void* second;
     };
-#define RETURN_PAIR(a,b) VoidPtrPair pair = { a, b }; return pair
+    #define RETURN_POINTER_PAIR(a,b) VoidPtrPair pair = { a, b }; return pair
 #else
+    // MSVC doesn't support returning a two-value struct in two registers, so
+    // we cast the struct to int64_t instead.
     typedef uint64_t VoidPtrPair;
-    union VoidPtrPairValue {
+    union VoidPtrPairUnion {
         struct { void* first; void* second; } s;
         VoidPtrPair i;
     };
-#define RETURN_PAIR(a,b) VoidPtrPairValue pair = {{ a, b }}; return pair.i
+    #define RETURN_POINTER_PAIR(a,b) VoidPtrPairUnion pair = {{ a, b }}; return pair.i
 #endif
 
-    class JITStubs {
+    extern "C" void ctiVMThrowTrampoline();
+    extern "C" void ctiOpThrowNotCaught();
+    extern "C" EncodedJSValue ctiTrampoline(
+#if PLATFORM(X86_64)
+            // FIXME: (bug #22910) this will force all arguments onto the stack (regparm(0) does not appear to have any effect).
+            // We can allow register passing here, and move the writes of these values into the trampoline.
+            void*, void*, void*, void*, void*, void*,
+#endif
+            void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*);
+
+    class JITThunks {
     public:
-        JITStubs(JSGlobalData*);
+        JITThunks(JSGlobalData*);
 
-        static JSObject* JIT_STUB cti_op_construct_JSConstruct(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_convert_this(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_array(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_error(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_func(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_func_exp(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_object(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_regexp(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_push_activation(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_push_new_scope(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_push_scope(STUB_ARGS);
-        static JSPropertyNameIterator* JIT_STUB cti_op_get_pnames(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_add(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitand(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitnot(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitor(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitxor(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_call_NotJSFunction(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_call_eval(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_construct_NotJSConstruct(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_del_by_id(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_del_by_val(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_div(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_eq(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_array_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_generic(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_proto_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_proto_list(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_proto_list_full(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_second(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_self_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_string_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_val(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_val_byte_array(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_in(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_instanceof(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_boolean(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_function(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_number(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_object(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_string(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_undefined(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_less(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_lesseq(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_lshift(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_mod(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_mul(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_negate(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_neq(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_next_pname(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_not(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_nstricteq(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_pre_dec(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_pre_inc(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve_base(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve_global(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve_skip(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_rshift(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_stricteq(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_sub(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_throw(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_to_jsnumber(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_typeof(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_urshift(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_vm_throw(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_call_arityCheck(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_post_dec(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_post_inc(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_resolve_func(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_resolve_with_base(STUB_ARGS);
-        static int JIT_STUB cti_op_jless(STUB_ARGS);
-        static int JIT_STUB cti_op_jtrue(STUB_ARGS);
-        static int JIT_STUB cti_op_loop_if_less(STUB_ARGS);
-        static int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS);
-        static int JIT_STUB cti_op_loop_if_true(STUB_ARGS);
-        static int JIT_STUB cti_timeout_check(STUB_ARGS);
-        static void JIT_STUB cti_op_create_arguments(STUB_ARGS);
-        static void JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS);
-        static void JIT_STUB cti_op_debug(STUB_ARGS);
-        static void JIT_STUB cti_op_end(STUB_ARGS);
-        static void JIT_STUB cti_op_jmp_scopes(STUB_ARGS);
-        static void JIT_STUB cti_op_pop_scope(STUB_ARGS);
-        static void JIT_STUB cti_op_profile_did_call(STUB_ARGS);
-        static void JIT_STUB cti_op_profile_will_call(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id_fail(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id_generic(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id_second(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_index(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_val(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_val_array(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_val_byte_array(STUB_ARGS);
-        static void JIT_STUB cti_op_put_getter(STUB_ARGS);
-        static void JIT_STUB cti_op_put_setter(STUB_ARGS);
-        static void JIT_STUB cti_op_ret_scopeChain(STUB_ARGS);
-        static void JIT_STUB cti_op_tear_off_activation(STUB_ARGS);
-        static void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS);
-        static void JIT_STUB cti_register_file_check(STUB_ARGS);
-        static void* JIT_STUB cti_op_call_JSFunction(STUB_ARGS);
-        static void* JIT_STUB cti_op_switch_char(STUB_ARGS);
-        static void* JIT_STUB cti_op_switch_imm(STUB_ARGS);
-        static void* JIT_STUB cti_op_switch_string(STUB_ARGS);
-        static void* JIT_STUB cti_vm_dontLazyLinkCall(STUB_ARGS);
-        static void* JIT_STUB cti_vm_lazyLinkCall(STUB_ARGS);
-
-        static void tryCacheGetByID(CallFrame*, CodeBlock*, void* returnAddress, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot&);
-        static void tryCachePutByID(CallFrame*, CodeBlock*, void* returnAddress, JSValuePtr baseValue, const PutPropertySlot&);
+        static void tryCacheGetByID(CallFrame*, CodeBlock*, void* returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot&);
+        static void tryCachePutByID(CallFrame*, CodeBlock*, void* returnAddress, JSValue baseValue, const PutPropertySlot&);
         
-        void* ctiArrayLengthTrampoline() { return m_ctiArrayLengthTrampoline; }
-        void* ctiStringLengthTrampoline() { return m_ctiStringLengthTrampoline; }
-        void* ctiVirtualCallPreLink() { return m_ctiVirtualCallPreLink; }
-        void* ctiVirtualCallLink() { return m_ctiVirtualCallLink; }
-        void* ctiVirtualCall() { return m_ctiVirtualCall; }
+        MacroAssemblerCodePtr ctiArrayLengthTrampoline() { return m_ctiArrayLengthTrampoline; }
+        MacroAssemblerCodePtr ctiStringLengthTrampoline() { return m_ctiStringLengthTrampoline; }
+        MacroAssemblerCodePtr ctiVirtualCallPreLink() { return m_ctiVirtualCallPreLink; }
+        MacroAssemblerCodePtr ctiVirtualCallLink() { return m_ctiVirtualCallLink; }
+        MacroAssemblerCodePtr ctiVirtualCall() { return m_ctiVirtualCall; }
+        MacroAssemblerCodePtr ctiNativeCallThunk() { return m_ctiNativeCallThunk; }
 
     private:
         RefPtr<ExecutablePool> m_executablePool;
 
-        void* m_ctiArrayLengthTrampoline;
-        void* m_ctiStringLengthTrampoline;
-        void* m_ctiVirtualCallPreLink;
-        void* m_ctiVirtualCallLink;
-        void* m_ctiVirtualCall;
+        MacroAssemblerCodePtr m_ctiArrayLengthTrampoline;
+        MacroAssemblerCodePtr m_ctiStringLengthTrampoline;
+        MacroAssemblerCodePtr m_ctiVirtualCallPreLink;
+        MacroAssemblerCodePtr m_ctiVirtualCallLink;
+        MacroAssemblerCodePtr m_ctiVirtualCall;
+        MacroAssemblerCodePtr m_ctiNativeCallThunk;
     };
 
+namespace JITStubs { extern "C" {
+
+    void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_debug(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_end(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_jmp_scopes(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_pop_scope(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_profile_did_call(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_profile_will_call(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id_fail(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id_generic(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id_second(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_index(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val_array(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_getter(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_setter(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_ret_scopeChain(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_tear_off_activation(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_register_file_check(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_jless(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_jlesseq(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_jtrue(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_load_varargs(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_less(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_call_JSFunction(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_char(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_imm(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_string(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_vm_dontLazyLinkCall(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_vm_lazyLinkCall(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_construct_JSConstruct(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_convert_this(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_array(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_error(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_func(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_func_exp(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_object(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_regexp(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_activation(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_new_scope(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_scope(STUB_ARGS_DECLARATION);
+    JSPropertyNameIterator* JIT_STUB cti_op_get_pnames(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_add(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitand(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitnot(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitor(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitxor(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_call_NotJSFunction(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_call_eval(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_construct_NotJSConstruct(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_del_by_id(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_del_by_val(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_div(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_eq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_method_check_second(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_array_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_generic(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_second(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_self_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_string_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_val(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_val_byte_array(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_val_string(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_in(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_instanceof(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_boolean(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_function(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_number(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_object(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_string(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_undefined(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_less(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_lesseq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_lshift(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_mod(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_mul(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_negate(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_neq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_next_pname(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_not(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_nstricteq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_pre_dec(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_pre_inc(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_base(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_global(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_skip(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_rshift(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_strcat(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_stricteq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_sub(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_throw(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_to_jsnumber(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_to_primitive(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_typeof(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_urshift(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_vm_throw(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_post_dec(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_post_inc(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_func(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_with_base(STUB_ARGS_DECLARATION);
+    VoidPtrPair JIT_STUB cti_op_call_arityCheck(STUB_ARGS_DECLARATION);
+
+}; } // extern "C" namespace JITStubs
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/JavaScriptCore/jsc.cpp b/JavaScriptCore/jsc.cpp
index 746868b..21a8c18 100644
--- a/JavaScriptCore/jsc.cpp
+++ b/JavaScriptCore/jsc.cpp
@@ -26,6 +26,7 @@
 #include "Completion.h"
 #include "InitializeThreading.h"
 #include "JSArray.h"
+#include "JSFunction.h"
 #include "JSLock.h"
 #include "PrototypeFunction.h"
 #include "SamplingTool.h"
@@ -68,14 +69,19 @@
 static void cleanupGlobalData(JSGlobalData*);
 static bool fillBufferWithContentsOfFile(const UString& fileName, Vector<char>& buffer);
 
-static JSValuePtr functionPrint(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionDebug(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionGC(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionVersion(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionRun(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionLoad(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionReadline(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static NO_RETURN JSValuePtr functionQuit(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL functionPrint(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionDebug(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionGC(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionVersion(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionRun(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionLoad(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionReadline(ExecState*, JSObject*, JSValue, const ArgList&);
+static NO_RETURN JSValue JSC_HOST_CALL functionQuit(ExecState*, JSObject*, JSValue, const ArgList&);
+
+#if ENABLE(SAMPLING_FLAGS)
+static JSValue JSC_HOST_CALL functionSetSamplingFlags(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionClearSamplingFlags(ExecState*, JSObject*, JSValue, const ArgList&);
+#endif
 
 struct Script {
     bool isFile;
@@ -171,14 +177,19 @@
 GlobalObject::GlobalObject(const Vector<UString>& arguments)
     : JSGlobalObject()
 {
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "debug"), functionDebug));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "print"), functionPrint));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "quit"), functionQuit));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "gc"), functionGC));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "version"), functionVersion));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "run"), functionRun));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "load"), functionLoad));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "readline"), functionReadline));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "debug"), functionDebug));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "print"), functionPrint));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "quit"), functionQuit));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "gc"), functionGC));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "version"), functionVersion));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "run"), functionRun));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "load"), functionLoad));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "readline"), functionReadline));
+
+#if ENABLE(SAMPLING_FLAGS)
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "setSamplingFlags"), functionSetSamplingFlags));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "clearSamplingFlags"), functionClearSamplingFlags));
+#endif
 
     JSObject* array = constructEmptyArray(globalExec());
     for (size_t i = 0; i < arguments.size(); ++i)
@@ -186,13 +197,13 @@
     putDirect(Identifier(globalExec(), "arguments"), array);
 }
 
-JSValuePtr functionPrint(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionPrint(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     for (unsigned i = 0; i < args.size(); ++i) {
         if (i != 0)
             putchar(' ');
         
-        printf("%s", args.at(exec, i).toString(exec).UTF8String().c_str());
+        printf("%s", args.at(i).toString(exec).UTF8String().c_str());
     }
     
     putchar('\n');
@@ -200,30 +211,30 @@
     return jsUndefined();
 }
 
-JSValuePtr functionDebug(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionDebug(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    fprintf(stderr, "--> %s\n", args.at(exec, 0).toString(exec).UTF8String().c_str());
+    fprintf(stderr, "--> %s\n", args.at(0).toString(exec).UTF8String().c_str());
     return jsUndefined();
 }
 
-JSValuePtr functionGC(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL functionGC(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     JSLock lock(false);
     exec->heap()->collect();
     return jsUndefined();
 }
 
-JSValuePtr functionVersion(ExecState*, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL functionVersion(ExecState*, JSObject*, JSValue, const ArgList&)
 {
     // We need this function for compatibility with the Mozilla JS tests but for now
     // we don't actually do any version-specific handling
     return jsUndefined();
 }
 
-JSValuePtr functionRun(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionRun(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     StopWatch stopWatch;
-    UString fileName = args.at(exec, 0).toString(exec);
+    UString fileName = args.at(0).toString(exec);
     Vector<char> script;
     if (!fillBufferWithContentsOfFile(fileName, script))
         return throwError(exec, GeneralError, "Could not open file.");
@@ -237,9 +248,11 @@
     return jsNumber(globalObject->globalExec(), stopWatch.getElapsedMS());
 }
 
-JSValuePtr functionLoad(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionLoad(ExecState* exec, JSObject* o, JSValue v, const ArgList& args)
 {
-    UString fileName = args.at(exec, 0).toString(exec);
+    UNUSED_PARAM(o);
+    UNUSED_PARAM(v);
+    UString fileName = args.at(0).toString(exec);
     Vector<char> script;
     if (!fillBufferWithContentsOfFile(fileName, script))
         return throwError(exec, GeneralError, "Could not open file.");
@@ -251,7 +264,29 @@
     return result.value();
 }
 
-JSValuePtr functionReadline(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+#if ENABLE(SAMPLING_FLAGS)
+JSValue JSC_HOST_CALL functionSetSamplingFlags(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    for (unsigned i = 0; i < args.size(); ++i) {
+        unsigned flag = static_cast<unsigned>(args.at(i).toNumber(exec));
+        if ((flag >= 1) && (flag <= 32))
+            SamplingFlags::setFlag(flag);
+    }
+    return jsNull();
+}
+
+JSValue JSC_HOST_CALL functionClearSamplingFlags(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    for (unsigned i = 0; i < args.size(); ++i) {
+        unsigned flag = static_cast<unsigned>(args.at(i).toNumber(exec));
+        if ((flag >= 1) && (flag <= 32))
+            SamplingFlags::clearFlag(flag);
+    }
+    return jsNull();
+}
+#endif
+
+JSValue JSC_HOST_CALL functionReadline(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     Vector<char, 256> line;
     int c;
@@ -265,7 +300,7 @@
     return jsString(exec, line.data());
 }
 
-JSValuePtr functionQuit(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL functionQuit(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     cleanupGlobalData(&exec->globalData());
     exit(EXIT_SUCCESS);
@@ -339,6 +374,10 @@
 #if ENABLE(OPCODE_SAMPLING)
     Interpreter* interpreter = globalObject->globalData()->interpreter;
     interpreter->setSampler(new SamplingTool(interpreter));
+    interpreter->sampler()->setup();
+#endif
+#if ENABLE(SAMPLING_FLAGS)
+    SamplingFlags::start();
 #endif
 
     bool success = true;
@@ -353,9 +392,10 @@
             fileName = "[Command Line]";
         }
 
-#if ENABLE(OPCODE_SAMPLING)
-        interpreter->sampler()->start();
+#if ENABLE(SAMPLING_THREAD)
+        SamplingThread::start();
 #endif
+
         Completion completion = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script, fileName));
         success = success && completion.complType() != Throw;
         if (dump) {
@@ -365,17 +405,23 @@
                 printf("End: %s\n", completion.value().toString(globalObject->globalExec()).ascii());
         }
 
-        globalObject->globalExec()->clearException();
-
-#if ENABLE(OPCODE_SAMPLING)
-        interpreter->sampler()->stop();
+#if ENABLE(SAMPLING_THREAD)
+        SamplingThread::stop();
 #endif
+
+        globalObject->globalExec()->clearException();
     }
 
+#if ENABLE(SAMPLING_FLAGS)
+    SamplingFlags::stop();
+#endif
 #if ENABLE(OPCODE_SAMPLING)
     interpreter->sampler()->dump(globalObject->globalExec());
     delete interpreter->sampler();
 #endif
+#if ENABLE(SAMPLING_COUNTERS)
+    AbstractSamplingCounter::dump();
+#endif
     return success;
 }
 
@@ -417,7 +463,7 @@
     printf("\n");
 }
 
-static NO_RETURN void printUsageStatement(bool help = false)
+static NO_RETURN void printUsageStatement(JSGlobalData* globalData, bool help = false)
 {
     fprintf(stderr, "Usage: jsc [options] [files] [-- arguments]\n");
     fprintf(stderr, "  -d         Dumps bytecode (debug builds only)\n");
@@ -426,28 +472,30 @@
     fprintf(stderr, "  -h|--help  Prints this help message\n");
     fprintf(stderr, "  -i         Enables interactive mode (default if no files are specified)\n");
     fprintf(stderr, "  -s         Installs signal handlers that exit on a crash (Unix platforms only)\n");
+
+    cleanupGlobalData(globalData);
     exit(help ? EXIT_SUCCESS : EXIT_FAILURE);
 }
 
-static void parseArguments(int argc, char** argv, Options& options)
+static void parseArguments(int argc, char** argv, Options& options, JSGlobalData* globalData)
 {
     int i = 1;
     for (; i < argc; ++i) {
         const char* arg = argv[i];
         if (strcmp(arg, "-f") == 0) {
             if (++i == argc)
-                printUsageStatement();
+                printUsageStatement(globalData);
             options.scripts.append(Script(true, argv[i]));
             continue;
         }
         if (strcmp(arg, "-e") == 0) {
             if (++i == argc)
-                printUsageStatement();
+                printUsageStatement(globalData);
             options.scripts.append(Script(false, argv[i]));
             continue;
         }
         if (strcmp(arg, "-h") == 0 || strcmp(arg, "--help") == 0) {
-            printUsageStatement(true);
+            printUsageStatement(globalData, true);
         }
         if (strcmp(arg, "-i") == 0) {
             options.interactive = true;
@@ -485,7 +533,7 @@
     JSLock lock(false);
 
     Options options;
-    parseArguments(argc, argv, options);
+    parseArguments(argc, argv, options, globalData);
 
     GlobalObject* globalObject = new (globalData) GlobalObject(options.arguments);
     bool success = runWithScripts(globalObject, options.scripts, options.dump);
diff --git a/JavaScriptCore/jsc.pro b/JavaScriptCore/jsc.pro
index 6262e62..35c9e63 100644
--- a/JavaScriptCore/jsc.pro
+++ b/JavaScriptCore/jsc.pro
@@ -3,21 +3,9 @@
 DESTDIR = .
 SOURCES = jsc.cpp
 QT -= gui
-INCLUDEPATH += $$PWD \
-    $$PWD/parser \
-    $$PWD/bindings \
-    $$PWD/bindings/c \
-    $$PWD/wtf \
-    $$PWD/jit \
-    $$PWD/bytecode
 CONFIG -= app_bundle
-DEFINES += BUILDING_QT__
 CONFIG += building-libs
 
-CONFIG(release) {
-    DEFINES += NDEBUG USE_SYSTEM_MALLOC
-}
-
 include($$PWD/../WebKit.pri)
 
 CONFIG += link_pkgconfig
@@ -26,9 +14,12 @@
 
 isEmpty(OUTPUT_DIR):OUTPUT_DIR=$$PWD/..
 include($$OUTPUT_DIR/config.pri)
-OBJECTS_DIR = tmp
-OBJECTS_DIR_WTR = $$OBJECTS_DIR/
-win32-*: OBJECTS_DIR_WTR ~= s|/|\|
+CONFIG(debug, debug|release) {
+    OBJECTS_DIR = obj/debug
+} else { # Release
+    OBJECTS_DIR = obj/release
+}
+OBJECTS_DIR_WTR = $$OBJECTS_DIR$${QMAKE_DIR_SEP}
 include($$PWD/JavaScriptCore.pri)
 
 lessThan(QT_MINOR_VERSION, 4) {
diff --git a/JavaScriptCore/jscore.bkl b/JavaScriptCore/jscore.bkl
index e88b9f0..25e17d7 100644
--- a/JavaScriptCore/jscore.bkl
+++ b/JavaScriptCore/jscore.bkl
@@ -48,6 +48,22 @@
             $(JSCORE_VM_SOURCES)
             $(JSCORE_WTF_SOURCES)
         </sources>
+
+        <set var="ASSEMBLER_SOURCES">
+            <if cond="WX_PORT=='gtk2'">
+                $(JSCORE_VM_SOURCES_POSIX)
+            </if>
+            <if cond="PLATFORM_OS=='mac'">
+                $(JSCORE_VM_SOURCES_POSIX)
+            </if>
+            <if cond="WX_PORT=='msw'">
+                $(JSCORE_VM_SOURCES_WIN)
+            </if>
+        </set>
+
+        <sources>
+            $(ASSEMBLER_SOURCES)
+        </sources>
         <install-to>$(WKOUTPUTDIR)</install-to>
         <pic>on</pic>
         <threading>multi</threading>
@@ -77,7 +93,7 @@
             <!-- FIXME: we need proper configure checks -->
             <define>HAVE_FUNC_ISNAN</define>
             <!-- check for undefined symbols for debugging reasons -->
-            <ldflags>-Wl,--no-undefined</ldflags>
+            <ldflags>-Wl</ldflags>
         </if>
 
         <if cond="PLATFORM_WIN32=='1'">
@@ -110,16 +126,12 @@
         <include>$(WK_ROOT)/JavaScriptCore/wtf</include>
         <dirname>$(WKOUTPUTDIR)</dirname>
         <sources>$(SRCDIR)/jsc.cpp</sources>
-        <if cond="FORMAT=='gnu'">
-            <ldflags>$(WKOUTPUTDIR)/libjscore.a</ldflags>
-        </if>
         <set var="READLINE_LIB">
             <if cond="WX_PORT=='mac'">edit</if>
         </set>
         <sys-lib>$(READLINE_LIB)</sys-lib>
         <if cond="FORMAT in ['msvc','msvs2005prj']">
             <include>$(WK_ROOT)/WebKitLibraries/win/include</include>
-            <sys-lib>jscore</sys-lib>
             <sys-lib>winmm</sys-lib> <!-- for timeGetTime -->
             <lib-path>$(WKOUTPUTDIR)</lib-path>
             <lib-path>$(WK_ROOT)/WebKitLibraries/win/lib</lib-path>
diff --git a/JavaScriptCore/parser/Grammar.y b/JavaScriptCore/parser/Grammar.y
index ae787f6..52dddde 100644
--- a/JavaScriptCore/parser/Grammar.y
+++ b/JavaScriptCore/parser/Grammar.y
@@ -29,7 +29,7 @@
 #include <stdlib.h>
 #include "JSValue.h"
 #include "JSObject.h"
-#include "Nodes.h"
+#include "NodeConstructors.h"
 #include "Lexer.h"
 #include "JSString.h"
 #include "JSGlobalData.h"
@@ -99,24 +99,24 @@
 #define YYPARSE_PARAM globalPtr
 #define YYLEX_PARAM globalPtr
 
-template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserRefCountedData<DeclarationStacks::VarStack>* varDecls, 
-                                                                       ParserRefCountedData<DeclarationStacks::FunctionStack>* funcDecls,
+template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserArenaData<DeclarationStacks::VarStack>* varDecls, 
+                                                                       ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
                                                                        CodeFeatures info,
                                                                        int numConstants) 
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeDeclarationInfo<T> result = {node, varDecls, funcDecls, info, numConstants};
+    NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
     return result;
 }
 
 template <typename T> NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeInfo<T> result = {node, info, numConstants};
+    NodeInfo<T> result = { node, info, numConstants };
     return result;
 }
 
-template <typename T> T mergeDeclarationLists(T decls1, T decls2) 
+template <typename T> inline T mergeDeclarationLists(T decls1, T decls2) 
 {
     // decls1 or both are null
     if (!decls1)
@@ -128,28 +128,28 @@
     // Both are non-null
     decls1->data.append(decls2->data);
     
-    // We manually release the declaration lists to avoid accumulating many many
-    // unused heap allocated vectors
-    decls2->ref();
-    decls2->deref();
+    // Manually release as much as possible from the now-defunct declaration lists
+    // to avoid accumulating so many unused heap allocated vectors.
+    decls2->data.clear();
+
     return decls1;
 }
 
-static void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
+static void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
 {
     if (!varDecls)
-        varDecls = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+        varDecls = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
 
     varDecls->data.append(make_pair(ident, attrs));
 
 }
 
-static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
+static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
 {
     unsigned attrs = DeclarationStacks::IsConstant;
-    if (decl->m_init)
+    if (decl->hasInitializer())
         attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalPtr, varDecls, decl->m_ident, attrs);
+    appendToVarDeclarationList(globalPtr, varDecls, decl->ident(), attrs);
 }
 
 %}
@@ -218,7 +218,7 @@
 %token ANDEQUAL MODEQUAL           /* &= and %= */
 %token XOREQUAL OREQUAL            /* ^= and |= */
 %token <intValue> OPENBRACE        /* { (with char offset) */
-%token <intValue> CLOSEBRACE        /* { (with char offset) */
+%token <intValue> CLOSEBRACE       /* } (with char offset) */
 
 /* terminal types */
 %token <doubleValue> NUMBER
@@ -264,7 +264,7 @@
 %type <expressionNode>  Initializer InitializerNoIn
 %type <statementNode>   FunctionDeclaration
 %type <funcExprNode>    FunctionExpr
-%type <functionBodyNode>  FunctionBody
+%type <functionBodyNode> FunctionBody
 %type <sourceElements>  SourceElements
 %type <parameterList>   FormalParameterList
 %type <op>              AssignmentOperator
@@ -287,16 +287,16 @@
 // In the mean time, make sure to make any changes to the grammar in both versions.
 
 Literal:
-    NULLTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new NullNode(GLOBAL_DATA), 0, 1); }
-  | TRUETOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, true), 0, 1); }
-  | FALSETOKEN                          { $$ = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, false), 0, 1); }
+    NULLTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); }
+  | TRUETOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); }
+  | FALSETOKEN                          { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); }
   | NUMBER                              { $$ = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, $1), 0, 1); }
-  | STRING                              { $$ = createNodeInfo<ExpressionNode*>(new StringNode(GLOBAL_DATA, *$1), 0, 1); }
+  | STRING                              { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *$1), 0, 1); }
   | '/' /* regexp */                    {
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size);
                                             $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -305,7 +305,7 @@
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size);
                                             $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -313,9 +313,9 @@
 ;
 
 Property:
-    IDENT ':' AssignmentExpr            { $$ = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | STRING ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | NUMBER ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from($1)), $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
+    IDENT ':' AssignmentExpr            { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
+  | STRING ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
+  | NUMBER ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from($1)), $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
   | IDENT IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE    { $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *$1, *$2, 0, $6, LEXER->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); DBG($6, @5, @7); if (!$$.m_node) YYABORT; }
   | IDENT IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
                                                              {
@@ -329,46 +329,46 @@
 ;
 
 PropertyList:
-    Property                            { $$.m_node.head = new PropertyListNode(GLOBAL_DATA, $1.m_node); 
+    Property                            { $$.m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, $1.m_node); 
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants; }
   | PropertyList ',' Property           { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new PropertyListNode(GLOBAL_DATA, $3.m_node, $1.m_node.tail);
+                                          $$.m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, $3.m_node, $1.m_node.tail);
                                           $$.m_features = $1.m_features | $3.m_features;
                                           $$.m_numConstants = $1.m_numConstants + $3.m_numConstants; }
 ;
 
 PrimaryExpr:
     PrimaryExprNoBrace
-  | OPENBRACE CLOSEBRACE                             { $$ = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA), 0, 0); }
-  | OPENBRACE PropertyList CLOSEBRACE                { $$ = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+  | OPENBRACE CLOSEBRACE                             { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); }
+  | OPENBRACE PropertyList CLOSEBRACE                { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
   /* allow extra comma, see http://bugs.webkit.org/show_bug.cgi?id=5939 */
-  | OPENBRACE PropertyList ',' CLOSEBRACE            { $$ = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+  | OPENBRACE PropertyList ',' CLOSEBRACE            { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
 ;
 
 PrimaryExprNoBrace:
-    THISTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new ThisNode(GLOBAL_DATA), ThisFeature, 0); }
+    THISTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); }
   | Literal
   | ArrayLiteral
-  | IDENT                               { $$ = createNodeInfo<ExpressionNode*>(new ResolveNode(GLOBAL_DATA, *$1, @1.first_column), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
+  | IDENT                               { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *$1, @1.first_column), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
   | '(' Expr ')'                        { $$ = $2; }
 ;
 
 ArrayLiteral:
-    '[' ElisionOpt ']'                  { $$ = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, $2), 0, $2 ? 1 : 0); }
-  | '[' ElementList ']'                 { $$ = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
-  | '[' ElementList ',' ElisionOpt ']'  { $$ = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, $4, $2.m_node.head), $2.m_features, $4 ? $2.m_numConstants + 1 : $2.m_numConstants); }
+    '[' ElisionOpt ']'                  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $2), 0, $2 ? 1 : 0); }
+  | '[' ElementList ']'                 { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+  | '[' ElementList ',' ElisionOpt ']'  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $4, $2.m_node.head), $2.m_features, $4 ? $2.m_numConstants + 1 : $2.m_numConstants); }
 ;
 
 ElementList:
-    ElisionOpt AssignmentExpr           { $$.m_node.head = new ElementNode(GLOBAL_DATA, $1, $2.m_node);
+    ElisionOpt AssignmentExpr           { $$.m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, $1, $2.m_node);
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_features = $2.m_features;
                                           $$.m_numConstants = $2.m_numConstants; }
   | ElementList ',' ElisionOpt AssignmentExpr
                                         { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new ElementNode(GLOBAL_DATA, $1.m_node.tail, $3, $4.m_node);
+                                          $$.m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, $1.m_node.tail, $3, $4.m_node);
                                           $$.m_features = $1.m_features | $4.m_features;
                                           $$.m_numConstants = $1.m_numConstants + $4.m_numConstants; }
 ;
@@ -386,15 +386,15 @@
 MemberExpr:
     PrimaryExpr
   | FunctionExpr                        { $$ = createNodeInfo<ExpressionNode*>($1.m_node, $1.m_features, $1.m_numConstants); }
-  | MemberExpr '[' Expr ']'             { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | MemberExpr '[' Expr ']'             { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | MemberExpr '.' IDENT                { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | MemberExpr '.' IDENT                { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
                                         }
-  | NEW MemberExpr Arguments            { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
+  | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
                                         }
@@ -402,15 +402,15 @@
 
 MemberExprNoBF:
     PrimaryExprNoBrace
-  | MemberExprNoBF '[' Expr ']'         { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | MemberExprNoBF '[' Expr ']'         { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | MemberExprNoBF '.' IDENT            { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | MemberExprNoBF '.' IDENT            { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
                                         }
-  | NEW MemberExpr Arguments            { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
+  | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
                                         }
@@ -418,7 +418,7 @@
 
 NewExpr:
     MemberExpr
-  | NEW NewExpr                         { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node);
+  | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants); 
                                         }
@@ -426,7 +426,7 @@
 
 NewExprNoBF:
     MemberExprNoBF
-  | NEW NewExpr                         { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node);
+  | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants);
                                         }
@@ -435,11 +435,11 @@
 CallExpr:
     MemberExpr Arguments                { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
   | CallExpr Arguments                  { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExpr '[' Expr ']'               { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | CallExpr '[' Expr ']'               { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | CallExpr '.' IDENT                  { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | CallExpr '.' IDENT                  { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); }
 ;
@@ -447,28 +447,28 @@
 CallExprNoBF:
     MemberExprNoBF Arguments            { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
   | CallExprNoBF Arguments              { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExprNoBF '[' Expr ']'           { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | CallExprNoBF '[' Expr ']'           { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | CallExprNoBF '.' IDENT              { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | CallExprNoBF '.' IDENT              { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); 
                                         }
 ;
 
 Arguments:
-    '(' ')'                             { $$ = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA), 0, 0); }
-  | '(' ArgumentList ')'                { $$ = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+    '(' ')'                             { $$ = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); }
+  | '(' ArgumentList ')'                { $$ = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
 ;
 
 ArgumentList:
-    AssignmentExpr                      { $$.m_node.head = new ArgumentListNode(GLOBAL_DATA, $1.m_node);
+    AssignmentExpr                      { $$.m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, $1.m_node);
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants; }
   | ArgumentList ',' AssignmentExpr     { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new ArgumentListNode(GLOBAL_DATA, $1.m_node.tail, $3.m_node);
+                                          $$.m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, $1.m_node.tail, $3.m_node);
                                           $$.m_features = $1.m_features | $3.m_features;
                                           $$.m_numConstants = $1.m_numConstants + $3.m_numConstants; }
 ;
@@ -497,16 +497,16 @@
 
 UnaryExprCommon:
     DELETETOKEN UnaryExpr               { $$ = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, $2.m_node, @1.first_column, @2.last_column, @2.last_column), $2.m_features, $2.m_numConstants); }
-  | VOIDTOKEN UnaryExpr                 { $$ = createNodeInfo<ExpressionNode*>(new VoidNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants + 1); }
+  | VOIDTOKEN UnaryExpr                 { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants + 1); }
   | TYPEOF UnaryExpr                    { $$ = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
   | PLUSPLUS UnaryExpr                  { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpPlusPlus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
   | AUTOPLUSPLUS UnaryExpr              { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpPlusPlus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
   | MINUSMINUS UnaryExpr                { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpMinusMinus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
   | AUTOMINUSMINUS UnaryExpr            { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpMinusMinus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
-  | '+' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new UnaryPlusNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
+  | '+' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
   | '-' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
   | '~' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
-  | '!' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new LogicalNotNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
+  | '!' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
 
 UnaryExpr:
     PostfixExpr
@@ -522,7 +522,7 @@
     UnaryExpr
   | MultiplicativeExpr '*' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | MultiplicativeExpr '/' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | MultiplicativeExpr '%' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | MultiplicativeExpr '%' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 MultiplicativeExprNoBF:
@@ -532,7 +532,7 @@
   | MultiplicativeExprNoBF '/' UnaryExpr
                                         { $$ = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | MultiplicativeExprNoBF '%' UnaryExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 AdditiveExpr:
@@ -553,188 +553,188 @@
     AdditiveExpr
   | ShiftExpr LSHIFT AdditiveExpr       { $$ = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | ShiftExpr RSHIFT AdditiveExpr       { $$ = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | ShiftExpr URSHIFT AdditiveExpr      { $$ = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ShiftExpr URSHIFT AdditiveExpr      { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ShiftExprNoBF:
     AdditiveExprNoBF
   | ShiftExprNoBF LSHIFT AdditiveExpr   { $$ = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | ShiftExprNoBF RSHIFT AdditiveExpr   { $$ = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | ShiftExprNoBF URSHIFT AdditiveExpr  { $$ = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ShiftExprNoBF URSHIFT AdditiveExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 RelationalExpr:
     ShiftExpr
-  | RelationalExpr '<' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr '>' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr LE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr GE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr INSTANCEOF ShiftExpr { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | RelationalExpr '<' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr '>' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr LE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr GE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr INSTANCEOF ShiftExpr { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr INTOKEN ShiftExpr    { InNode* node = new InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | RelationalExpr INTOKEN ShiftExpr    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 RelationalExprNoIn:
     ShiftExpr
-  | RelationalExprNoIn '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoIn INSTANCEOF ShiftExpr
-                                        { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+                                        { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 RelationalExprNoBF:
     ShiftExprNoBF
-  | RelationalExprNoBF '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoBF INSTANCEOF ShiftExpr
-                                        { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+                                        { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoBF INTOKEN ShiftExpr 
-                                        { InNode* node = new InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+                                        { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 EqualityExpr:
     RelationalExpr
-  | EqualityExpr EQEQ RelationalExpr    { $$ = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr NE RelationalExpr      { $$ = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr STREQ RelationalExpr   { $$ = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr STRNEQ RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr EQEQ RelationalExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr NE RelationalExpr      { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr STREQ RelationalExpr   { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr STRNEQ RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 EqualityExprNoIn:
     RelationalExprNoIn
   | EqualityExprNoIn EQEQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoIn NE RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoIn STREQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoIn STRNEQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 EqualityExprNoBF:
     RelationalExprNoBF
   | EqualityExprNoBF EQEQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExprNoBF NE RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExprNoBF NE RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoBF STREQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoBF STRNEQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseANDExpr:
     EqualityExpr
-  | BitwiseANDExpr '&' EqualityExpr     { $$ = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseANDExpr '&' EqualityExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseANDExprNoIn:
     EqualityExprNoIn
   | BitwiseANDExprNoIn '&' EqualityExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseANDExprNoBF:
     EqualityExprNoBF
-  | BitwiseANDExprNoBF '&' EqualityExpr { $$ = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseANDExprNoBF '&' EqualityExpr { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseXORExpr:
     BitwiseANDExpr
-  | BitwiseXORExpr '^' BitwiseANDExpr   { $$ = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseXORExpr '^' BitwiseANDExpr   { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseXORExprNoIn:
     BitwiseANDExprNoIn
   | BitwiseXORExprNoIn '^' BitwiseANDExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseXORExprNoBF:
     BitwiseANDExprNoBF
   | BitwiseXORExprNoBF '^' BitwiseANDExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseORExpr:
     BitwiseXORExpr
-  | BitwiseORExpr '|' BitwiseXORExpr    { $$ = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseORExpr '|' BitwiseXORExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseORExprNoIn:
     BitwiseXORExprNoIn
   | BitwiseORExprNoIn '|' BitwiseXORExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseORExprNoBF:
     BitwiseXORExprNoBF
   | BitwiseORExprNoBF '|' BitwiseXORExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalANDExpr:
     BitwiseORExpr
-  | LogicalANDExpr AND BitwiseORExpr    { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | LogicalANDExpr AND BitwiseORExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalANDExprNoIn:
     BitwiseORExprNoIn
   | LogicalANDExprNoIn AND BitwiseORExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalANDExprNoBF:
     BitwiseORExprNoBF
   | LogicalANDExprNoBF AND BitwiseORExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalORExpr:
     LogicalANDExpr
-  | LogicalORExpr OR LogicalANDExpr     { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | LogicalORExpr OR LogicalANDExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalORExprNoIn:
     LogicalANDExprNoIn
   | LogicalORExprNoIn OR LogicalANDExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalORExprNoBF:
     LogicalANDExprNoBF
-  | LogicalORExprNoBF OR LogicalANDExpr { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | LogicalORExprNoBF OR LogicalANDExpr { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ConditionalExpr:
     LogicalORExpr
   | LogicalORExpr '?' AssignmentExpr ':' AssignmentExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
 ;
 
 ConditionalExprNoIn:
     LogicalORExprNoIn
   | LogicalORExprNoIn '?' AssignmentExprNoIn ':' AssignmentExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
 ;
 
 ConditionalExprNoBF:
     LogicalORExprNoBF
   | LogicalORExprNoBF '?' AssignmentExpr ':' AssignmentExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
 ;
 
 AssignmentExpr:
@@ -778,17 +778,17 @@
 
 Expr:
     AssignmentExpr
-  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoIn:
     AssignmentExprNoIn
-  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoBF:
     AssignmentExprNoBF
-  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 Statement:
@@ -812,9 +812,9 @@
 ;
 
 Block:
-    OPENBRACE CLOSEBRACE                             { $$ = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
+    OPENBRACE CLOSEBRACE                             { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); }
-  | OPENBRACE SourceElements CLOSEBRACE              { $$ = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
+  | OPENBRACE SourceElements CLOSEBRACE              { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
                                           DBG($$.m_node, @1, @3); }
 ;
 
@@ -828,16 +828,16 @@
 
 VariableDeclarationList:
     IDENT                               { $$.m_node = 0;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, 0);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           $$.m_numConstants = 0;
                                         }
-  | IDENT Initializer                   { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
+  | IDENT Initializer                   { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.first_column + 1, @2.last_column);
                                           $$.m_node = node;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features;
@@ -852,7 +852,7 @@
                                           $$.m_numConstants = $1.m_numConstants;
                                         }
   | VariableDeclarationList ',' IDENT Initializer
-                                        { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
+                                        { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
                                           $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
@@ -865,16 +865,16 @@
 
 VariableDeclarationListNoIn:
     IDENT                               { $$.m_node = 0;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, 0);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           $$.m_numConstants = 0;
                                         }
-  | IDENT InitializerNoIn               { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
+  | IDENT InitializerNoIn               { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.first_column + 1, @2.last_column);
                                           $$.m_node = node;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features;
@@ -889,7 +889,7 @@
                                           $$.m_numConstants = $1.m_numConstants;
                                         }
   | VariableDeclarationListNoIn ',' IDENT InitializerNoIn
-                                        { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
+                                        { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
                                           $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
@@ -901,24 +901,24 @@
 ;
 
 ConstStatement:
-    CONSTTOKEN ConstDeclarationList ';' { $$ = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
+    CONSTTOKEN ConstDeclarationList ';' { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
                                           DBG($$.m_node, @1, @3); }
   | CONSTTOKEN ConstDeclarationList error
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
                                           DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 ConstDeclarationList:
     ConstDeclaration                    { $$.m_node.head = $1.m_node;
                                           $$.m_node.tail = $$.m_node.head;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, $1.m_node);
                                           $$.m_funcDeclarations = 0; 
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants;
     }
   | ConstDeclarationList ',' ConstDeclaration
-                                        {  $$.m_node.head = $1.m_node.head;
+                                        { $$.m_node.head = $1.m_node.head;
                                           $1.m_node.tail->m_next = $3.m_node;
                                           $$.m_node.tail = $3.m_node;
                                           $$.m_varDeclarations = $1.m_varDeclarations;
@@ -929,8 +929,8 @@
 ;
 
 ConstDeclaration:
-    IDENT                               { $$ = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *$1, 0), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
-  | IDENT Initializer                   { $$ = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *$1, $2.m_node), ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features, $2.m_numConstants); }
+    IDENT                               { $$ = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *$1, 0), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
+  | IDENT Initializer                   { $$ = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *$1, $2.m_node), ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features, $2.m_numConstants); }
 ;
 
 Initializer:
@@ -942,43 +942,44 @@
 ;
 
 EmptyStatement:
-    ';'                                 { $$ = createNodeDeclarationInfo<StatementNode*>(new EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); }
+    ';'                                 { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); }
 ;
 
 ExprStatement:
-    ExprNoBF ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
+    ExprNoBF ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
                                           DBG($$.m_node, @1, @2); }
-  | ExprNoBF error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
+  | ExprNoBF error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
                                           DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
 ;
 
 IfStatement:
     IF '(' Expr ')' Statement %prec IF_WITHOUT_ELSE
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new IfNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
   | IF '(' Expr ')' Statement ELSE Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new IfElseNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node), 
-                                                                                         mergeDeclarationLists($5.m_varDeclarations, $7.m_varDeclarations), mergeDeclarationLists($5.m_funcDeclarations, $7.m_funcDeclarations),
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node), 
+                                                                                         mergeDeclarationLists($5.m_varDeclarations, $7.m_varDeclarations),
+                                                                                         mergeDeclarationLists($5.m_funcDeclarations, $7.m_funcDeclarations),
                                                                                          $3.m_features | $5.m_features | $7.m_features,
                                                                                          $3.m_numConstants + $5.m_numConstants + $7.m_numConstants); 
                                           DBG($$.m_node, @1, @4); }
 ;
 
 IterationStatement:
-    DO Statement WHILE '(' Expr ')' ';'    { $$ = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
+    DO Statement WHILE '(' Expr ')' ';'    { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
                                              DBG($$.m_node, @1, @3); }
-  | DO Statement WHILE '(' Expr ')' error  { $$ = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
+  | DO Statement WHILE '(' Expr ')' error  { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
                                              DBG($$.m_node, @1, @3); } // Always performs automatic semicolon insertion.
-  | WHILE '(' Expr ')' Statement        { $$ = createNodeDeclarationInfo<StatementNode*>(new WhileNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
+  | WHILE '(' Expr ')' Statement        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
   | FOR '(' ExprNoInOpt ';' ExprOpt ';' ExprOpt ')' Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node, $9.m_node, false), $9.m_varDeclarations, $9.m_funcDeclarations, 
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node, $9.m_node, false), $9.m_varDeclarations, $9.m_funcDeclarations, 
                                                                                          $3.m_features | $5.m_features | $7.m_features | $9.m_features,
                                                                                          $3.m_numConstants + $5.m_numConstants + $7.m_numConstants + $9.m_numConstants);
                                           DBG($$.m_node, @1, @8); 
                                         }
   | FOR '(' VAR VariableDeclarationListNoIn ';' ExprOpt ';' ExprOpt ')' Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, $4.m_node, $6.m_node, $8.m_node, $10.m_node, true),
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $4.m_node, $6.m_node, $8.m_node, $10.m_node, true),
                                                                                          mergeDeclarationLists($4.m_varDeclarations, $10.m_varDeclarations),
                                                                                          mergeDeclarationLists($4.m_funcDeclarations, $10.m_funcDeclarations),
                                                                                          $4.m_features | $6.m_features | $8.m_features | $10.m_features,
@@ -986,7 +987,7 @@
                                           DBG($$.m_node, @1, @9); }
   | FOR '(' LeftHandSideExpr INTOKEN Expr ')' Statement
                                         {
-                                            ForInNode* node = new ForInNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node);
+                                            ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node);
                                             SET_EXCEPTION_LOCATION(node, @3.first_column, @3.last_column, @5.last_column);
                                             $$ = createNodeDeclarationInfo<StatementNode*>(node, $7.m_varDeclarations, $7.m_funcDeclarations,
                                                                                            $3.m_features | $5.m_features | $7.m_features,
@@ -994,13 +995,13 @@
                                             DBG($$.m_node, @1, @6);
                                         }
   | FOR '(' VAR IDENT INTOKEN Expr ')' Statement
-                                        { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *$4, 0, $6.m_node, $8.m_node, @5.first_column, @5.first_column - @4.first_column, @6.last_column - @5.first_column);
+                                        { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, 0, $6.m_node, $8.m_node, @5.first_column, @5.first_column - @4.first_column, @6.last_column - @5.first_column);
                                           SET_EXCEPTION_LOCATION(forIn, @4.first_column, @5.first_column + 1, @6.last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, $8.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $8.m_varDeclarations, $8.m_funcDeclarations, ((*$4 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $6.m_features | $8.m_features, $6.m_numConstants + $8.m_numConstants);
                                           DBG($$.m_node, @1, @7); }
   | FOR '(' VAR IDENT InitializerNoIn INTOKEN Expr ')' Statement
-                                        { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *$4, $5.m_node, $7.m_node, $9.m_node, @5.first_column, @5.first_column - @4.first_column, @5.last_column - @5.first_column);
+                                        { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, $5.m_node, $7.m_node, $9.m_node, @5.first_column, @5.first_column - @4.first_column, @5.last_column - @5.first_column);
                                           SET_EXCEPTION_LOCATION(forIn, @4.first_column, @6.first_column + 1, @7.last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, $9.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $9.m_varDeclarations, $9.m_funcDeclarations,
@@ -1020,70 +1021,70 @@
 ;
 
 ContinueStatement:
-    CONTINUE ';'                        { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+    CONTINUE ';'                        { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); }
-  | CONTINUE error                      { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+  | CONTINUE error                      { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | CONTINUE IDENT ';'                  { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *$2);
+  | CONTINUE IDENT ';'                  { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @3); }
-  | CONTINUE IDENT error                { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *$2);
+  | CONTINUE IDENT error                { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 BreakStatement:
-    BREAK ';'                           { BreakNode* node = new BreakNode(GLOBAL_DATA);
+    BREAK ';'                           { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @2); }
-  | BREAK error                         { BreakNode* node = new BreakNode(GLOBAL_DATA);
+  | BREAK error                         { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | BREAK IDENT ';'                     { BreakNode* node = new BreakNode(GLOBAL_DATA, *$2);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+  | BREAK IDENT ';'                     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @3); }
-  | BREAK IDENT error                   { BreakNode* node = new BreakNode(GLOBAL_DATA, *$2);
+  | BREAK IDENT error                   { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA, *$2), 0, 0, 0, 0); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2), 0, 0, 0, 0); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 ReturnStatement:
-    RETURN ';'                          { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+    RETURN ';'                          { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @2); }
-  | RETURN error                        { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+  | RETURN error                        { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | RETURN Expr ';'                     { ReturnNode* node = new ReturnNode(GLOBAL_DATA, $2.m_node); 
+  | RETURN Expr ';'                     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @3); }
-  | RETURN Expr error                   { ReturnNode* node = new ReturnNode(GLOBAL_DATA, $2.m_node); 
+  | RETURN Expr error                   { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 WithStatement:
-    WITH '(' Expr ')' Statement         { $$ = createNodeDeclarationInfo<StatementNode*>(new WithNode(GLOBAL_DATA, $3.m_node, $5.m_node, @3.last_column, @3.last_column - @3.first_column),
+    WITH '(' Expr ')' Statement         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, $3.m_node, $5.m_node, @3.last_column, @3.last_column - @3.first_column),
                                                                                          $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features | WithFeature, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
 ;
 
 SwitchStatement:
-    SWITCH '(' Expr ')' CaseBlock       { $$ = createNodeDeclarationInfo<StatementNode*>(new SwitchNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations,
+    SWITCH '(' Expr ')' CaseBlock       { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations,
                                                                                          $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
 ;
 
 CaseBlock:
-    OPENBRACE CaseClausesOpt CLOSEBRACE              { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, $2.m_node.head, 0, 0), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants); }
+    OPENBRACE CaseClausesOpt CLOSEBRACE              { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, $2.m_node.head, 0, 0), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants); }
   | OPENBRACE CaseClausesOpt DefaultClause CaseClausesOpt CLOSEBRACE
-                                        { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, $2.m_node.head, $3.m_node, $4.m_node.head),
+                                        { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, $2.m_node.head, $3.m_node, $4.m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_varDeclarations, $3.m_varDeclarations), $4.m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_funcDeclarations, $3.m_funcDeclarations), $4.m_funcDeclarations),
                                                                                          $2.m_features | $3.m_features | $4.m_features,
@@ -1096,14 +1097,14 @@
 ;
 
 CaseClauses:
-    CaseClause                          { $$.m_node.head = new ClauseListNode(GLOBAL_DATA, $1.m_node);
+    CaseClause                          { $$.m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, $1.m_node);
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           $$.m_funcDeclarations = $1.m_funcDeclarations; 
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants; }
   | CaseClauses CaseClause              { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new ClauseListNode(GLOBAL_DATA, $1.m_node.tail, $2.m_node);
+                                          $$.m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, $1.m_node.tail, $2.m_node);
                                           $$.m_varDeclarations = mergeDeclarationLists($1.m_varDeclarations, $2.m_varDeclarations);
                                           $$.m_funcDeclarations = mergeDeclarationLists($1.m_funcDeclarations, $2.m_funcDeclarations);
                                           $$.m_features = $1.m_features | $2.m_features;
@@ -1112,47 +1113,47 @@
 ;
 
 CaseClause:
-    CASE Expr ':'                       { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, $2.m_node), 0, 0, $2.m_features, $2.m_numConstants); }
-  | CASE Expr ':' SourceElements        { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, $2.m_node, $4.m_node), $4.m_varDeclarations, $4.m_funcDeclarations, $2.m_features | $4.m_features, $2.m_numConstants + $4.m_numConstants); }
+    CASE Expr ':'                       { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, $2.m_node), 0, 0, $2.m_features, $2.m_numConstants); }
+  | CASE Expr ':' SourceElements        { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, $2.m_node, $4.m_node), $4.m_varDeclarations, $4.m_funcDeclarations, $2.m_features | $4.m_features, $2.m_numConstants + $4.m_numConstants); }
 ;
 
 DefaultClause:
-    DEFAULT ':'                         { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); }
-  | DEFAULT ':' SourceElements          { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0, $3.m_node), $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
+    DEFAULT ':'                         { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); }
+  | DEFAULT ':' SourceElements          { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, $3.m_node), $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
 ;
 
 LabelledStatement:
-    IDENT ':' Statement                 { LabelNode* node = new LabelNode(GLOBAL_DATA, *$1, $3.m_node);
+    IDENT ':' Statement                 { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *$1, $3.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
 ;
 
 ThrowStatement:
-    THROW Expr ';'                      { ThrowNode* node = new ThrowNode(GLOBAL_DATA, $2.m_node);
+    THROW Expr ';'                      { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2);
                                         }
-  | THROW Expr error                    { ThrowNode* node = new ThrowNode(GLOBAL_DATA, $2.m_node);
+  | THROW Expr error                    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; 
                                         }
 ;
 
 TryStatement:
-    TRY Block FINALLY Block             { $$ = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, $2.m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, $4.m_node),
+    TRY Block FINALLY Block             { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, $4.m_node),
                                                                                          mergeDeclarationLists($2.m_varDeclarations, $4.m_varDeclarations),
                                                                                          mergeDeclarationLists($2.m_funcDeclarations, $4.m_funcDeclarations),
                                                                                          $2.m_features | $4.m_features,
                                                                                          $2.m_numConstants + $4.m_numConstants);
                                           DBG($$.m_node, @1, @2); }
-  | TRY Block CATCH '(' IDENT ')' Block { $$ = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, 0),
+  | TRY Block CATCH '(' IDENT ')' Block { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, 0),
                                                                                          mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations),
                                                                                          mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations),
                                                                                          $2.m_features | $7.m_features | CatchFeature,
                                                                                          $2.m_numConstants + $7.m_numConstants);
                                           DBG($$.m_node, @1, @2); }
   | TRY Block CATCH '(' IDENT ')' Block FINALLY Block
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, $9.m_node),
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, $9.m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations), $9.m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations), $9.m_funcDeclarations),
                                                                                          $2.m_features | $7.m_features | $9.m_features | CatchFeature,
@@ -1161,17 +1162,17 @@
 ;
 
 DebuggerStatement:
-    DEBUGGER ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+    DEBUGGER ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); }
-  | DEBUGGER error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+  | DEBUGGER error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
 ;
 
 FunctionDeclaration:
-    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $6, LEXER->sourceCode($5, $7, @5.first_line)), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG($6, @5, @7); $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)); }
+    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $6, LEXER->sourceCode($5, $7, @5.first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG($6, @5, @7); $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)); }
   | FUNCTION IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
       { 
-          $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $7, LEXER->sourceCode($6, $8, @6.first_line), $4.m_node.head), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features | ClosureFeature, 0); 
+          $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $7, LEXER->sourceCode($6, $8, @6.first_line), $4.m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features | ClosureFeature, 0); 
           if ($4.m_features & ArgumentsFeature)
               $7->setUsesArguments(); 
           DBG($7, @6, @8);
@@ -1199,12 +1200,12 @@
 ;
 
 FormalParameterList:
-    IDENT                               { $$.m_node.head = new ParameterNode(GLOBAL_DATA, *$1);
+    IDENT                               { $$.m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *$1);
                                           $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           $$.m_node.tail = $$.m_node.head; }
   | FormalParameterList ',' IDENT       { $$.m_node.head = $1.m_node.head;
                                           $$.m_features = $1.m_features | ((*$3 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          $$.m_node.tail = new ParameterNode(GLOBAL_DATA, $1.m_node.tail, *$3);  }
+                                          $$.m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, $1.m_node.tail, *$3);  }
 ;
 
 FunctionBody:
@@ -1213,13 +1214,13 @@
 ;
 
 Program:
-    /* not in spec */                   { GLOBAL_DATA->parser->didFinishParsing(new SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, @0.last_line, 0); }
+    /* not in spec */                   { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, @0.last_line, 0); }
     | SourceElements                    { GLOBAL_DATA->parser->didFinishParsing($1.m_node, $1.m_varDeclarations, $1.m_funcDeclarations, $1.m_features, 
                                                                                 @1.last_line, $1.m_numConstants); }
 ;
 
 SourceElements:
-    Statement                           { $$.m_node = new SourceElements(GLOBAL_DATA);
+    Statement                           { $$.m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           $$.m_node->append($1.m_node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           $$.m_funcDeclarations = $1.m_funcDeclarations;
@@ -1828,23 +1829,23 @@
 static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
-            AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
+            AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
             SET_EXCEPTION_LOCATION(node, start, divot, end);
             return node;
         } else
-            return new ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+            return new (GLOBAL_DATA) ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+            return new (GLOBAL_DATA) AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
         else {
-            ReadModifyBracketNode* node = new ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            ReadModifyBracketNode* node = new (GLOBAL_DATA) ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
             node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
             return node;
         }
@@ -1852,9 +1853,9 @@
     ASSERT(loc->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
     if (op == OpEqual)
-        return new AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (GLOBAL_DATA) AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
 
-    ReadModifyDotNode* node = new ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (GLOBAL_DATA) ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -1862,21 +1863,21 @@
 static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (GLOBAL_DATA) PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (GLOBAL_DATA) PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
@@ -1884,22 +1885,22 @@
 static ExpressionNode* makePostfixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 { 
     if (!expr->isLocation())
-        return new PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (GLOBAL_DATA) PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
         
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (GLOBAL_DATA) PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -1909,23 +1910,29 @@
     CodeFeatures features = func.m_features | args.m_features;
     int numConstants = func.m_numConstants + args.m_numConstants;
     if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
     if (func.m_node->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
         const Identifier& identifier = resolve->identifier();
         if (identifier == GLOBAL_DATA->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
+            return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
     }
     if (func.m_node->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (GLOBAL_DATA) FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return createNodeInfo<ExpressionNode*>(node, features, numConstants);
     }
     ASSERT(func.m_node->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
-    FunctionCallDotNode* node = new FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    FunctionCallDotNode* node;
+    if (dot->identifier() == GLOBAL_DATA->propertyNames->call)
+        node = new (GLOBAL_DATA) CallFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else if (dot->identifier() == GLOBAL_DATA->propertyNames->apply)
+        node = new (GLOBAL_DATA) ApplyFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else
+        node = new (GLOBAL_DATA) FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return createNodeInfo<ExpressionNode*>(node, features, numConstants);
 }
@@ -1934,26 +1941,26 @@
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
+        return new (GLOBAL_DATA) TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
     }
-    return new TypeOfValueNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) TypeOfValueNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeDeleteNode(void* globalPtr, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new DeleteValueNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) DeleteValueNode(GLOBAL_DATA, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (GLOBAL_DATA) DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
 static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
@@ -1965,7 +1972,7 @@
         type = PropertyNode::Setter;
     else
         return 0;
-    return new PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
+    return new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
 }
 
 static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
@@ -1979,19 +1986,19 @@
         }
     }
 
-    return new NegateNode(GLOBAL_DATA, n);
+    return new (GLOBAL_DATA) NegateNode(GLOBAL_DATA, n);
 }
 
 static NumberNode* makeNumberNode(void* globalPtr, double d)
 {
-    return new NumberNode(GLOBAL_DATA, d);
+    return new (GLOBAL_DATA) NumberNode(GLOBAL_DATA, d);
 }
 
 static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isNumber())
         return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new BitwiseNotNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) BitwiseNotNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -2003,12 +2010,12 @@
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr2);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr1);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr1);
 
-    return new MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -2018,14 +2025,14 @@
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeAddNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -2035,21 +2042,21 @@
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 /* called by yyparse on error */
@@ -2068,7 +2075,7 @@
 {
     if (!list)
         return init;
-    return new VarDeclCommaNode(GLOBAL_DATA, list, init);
+    return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
 // We turn variable declarations into either assignments or empty
@@ -2077,8 +2084,8 @@
 static StatementNode* makeVarStatementNode(void* globalPtr, ExpressionNode* expr)
 {
     if (!expr)
-        return new EmptyStatementNode(GLOBAL_DATA);
-    return new VarStatementNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA);
+    return new (GLOBAL_DATA) VarStatementNode(GLOBAL_DATA, expr);
 }
 
 #undef GLOBAL_DATA
diff --git a/JavaScriptCore/parser/Lexer.cpp b/JavaScriptCore/parser/Lexer.cpp
index 6f65096..8e89c18 100644
--- a/JavaScriptCore/parser/Lexer.cpp
+++ b/JavaScriptCore/parser/Lexer.cpp
@@ -31,13 +31,12 @@
 #include <ctype.h>
 #include <limits.h>
 #include <string.h>
-#include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
 
 using namespace WTF;
 using namespace Unicode;
 
-// we can't specify the namespace in yacc's C output, so do it here
+// We can't specify the namespace in yacc's C output, so do it here instead.
 using namespace JSC;
 
 #ifndef KDE_USE_FINAL
@@ -47,7 +46,7 @@
 #include "Lookup.h"
 #include "Lexer.lut.h"
 
-// a bridge for yacc from the C world to C++
+// A bridge for yacc from the C world to the C++ world.
 int jscyylex(void* lvalp, void* llocp, void* globalData)
 {
     return static_cast<JSGlobalData*>(globalData)->lexer->lex(lvalp, llocp);
@@ -55,29 +54,12 @@
 
 namespace JSC {
 
-static bool isDecimalDigit(int);
+static const UChar byteOrderMark = 0xFEFF;
 
 Lexer::Lexer(JSGlobalData* globalData)
-    : yylineno(1)
-    , m_restrKeyword(false)
-    , m_eatNextIdentifier(false)
-    , m_stackToken(-1)
-    , m_lastToken(-1)
-    , m_position(0)
-    , m_code(0)
-    , m_length(0)
-    , m_isReparsing(false)
-    , m_atLineStart(true)
-    , m_current(0)
-    , m_next1(0)
-    , m_next2(0)
-    , m_next3(0)
-    , m_currentOffset(0)
-    , m_nextOffset1(0)
-    , m_nextOffset2(0)
-    , m_nextOffset3(0)
+    : m_isReparsing(false)
     , m_globalData(globalData)
-    , m_mainTable(JSC::mainTable)
+    , m_keywordTable(JSC::mainTable)
 {
     m_buffer8.reserveInitialCapacity(initialReadBufferCapacity);
     m_buffer16.reserveInitialCapacity(initialReadBufferCapacity);
@@ -85,691 +67,176 @@
 
 Lexer::~Lexer()
 {
-    m_mainTable.deleteTable();
+    m_keywordTable.deleteTable();
+}
+
+inline const UChar* Lexer::currentCharacter() const
+{
+    return m_code - 4;
+}
+
+inline int Lexer::currentOffset() const
+{
+    return currentCharacter() - m_codeStart;
+}
+
+ALWAYS_INLINE void Lexer::shift1()
+{
+    m_current = m_next1;
+    m_next1 = m_next2;
+    m_next2 = m_next3;
+    if (LIKELY(m_code < m_codeEnd))
+        m_next3 = m_code[0];
+    else
+        m_next3 = -1;
+
+    ++m_code;
+}
+
+ALWAYS_INLINE void Lexer::shift2()
+{
+    m_current = m_next2;
+    m_next1 = m_next3;
+    if (LIKELY(m_code + 1 < m_codeEnd)) {
+        m_next2 = m_code[0];
+        m_next3 = m_code[1];
+    } else {
+        m_next2 = m_code < m_codeEnd ? m_code[0] : -1;
+        m_next3 = -1;
+    }
+
+    m_code += 2;
+}
+
+ALWAYS_INLINE void Lexer::shift3()
+{
+    m_current = m_next3;
+    if (LIKELY(m_code + 2 < m_codeEnd)) {
+        m_next1 = m_code[0];
+        m_next2 = m_code[1];
+        m_next3 = m_code[2];
+    } else {
+        m_next1 = m_code < m_codeEnd ? m_code[0] : -1;
+        m_next2 = m_code + 1 < m_codeEnd ? m_code[1] : -1;
+        m_next3 = -1;
+    }
+
+    m_code += 3;
+}
+
+ALWAYS_INLINE void Lexer::shift4()
+{
+    if (LIKELY(m_code + 3 < m_codeEnd)) {
+        m_current = m_code[0];
+        m_next1 = m_code[1];
+        m_next2 = m_code[2];
+        m_next3 = m_code[3];
+    } else {
+        m_current = m_code < m_codeEnd ? m_code[0] : -1;
+        m_next1 = m_code + 1 < m_codeEnd ? m_code[1] : -1;
+        m_next2 = m_code + 2 < m_codeEnd ? m_code[2] : -1;
+        m_next3 = -1;
+    }
+
+    m_code += 4;
 }
 
 void Lexer::setCode(const SourceCode& source)
 {
-    yylineno = source.firstLine();
-    m_restrKeyword = false;
+    m_lineNumber = source.firstLine();
     m_delimited = false;
-    m_eatNextIdentifier = false;
-    m_stackToken = -1;
     m_lastToken = -1;
 
-    m_position = source.startOffset();
+    const UChar* data = source.provider()->data();
+
     m_source = &source;
-    m_code = source.provider()->data();
-    m_length = source.endOffset();
-    m_skipLF = false;
-    m_skipCR = false;
+    m_codeStart = data;
+    m_code = data + source.startOffset();
+    m_codeEnd = data + source.endOffset();
     m_error = false;
     m_atLineStart = true;
 
-    // read first characters
-    shift(4);
-}
-
-void Lexer::shift(unsigned p)
-{
-    // ECMA-262 calls for stripping Cf characters here, but we only do this for BOM,
-    // see <https://bugs.webkit.org/show_bug.cgi?id=4931>.
-
-    while (p--) {
-        m_current = m_next1;
-        m_next1 = m_next2;
-        m_next2 = m_next3;
-        m_currentOffset = m_nextOffset1;
-        m_nextOffset1 = m_nextOffset2;
-        m_nextOffset2 = m_nextOffset3;
-        do {
-            if (m_position >= m_length) {
-                m_nextOffset3 = m_position;
-                m_position++;
-                m_next3 = -1;
+    // ECMA-262 calls for stripping all Cf characters, but we only strip BOM characters.
+    // See <https://bugs.webkit.org/show_bug.cgi?id=4931> for details.
+    if (source.provider()->hasBOMs()) {
+        for (const UChar* p = m_codeStart; p < m_codeEnd; ++p) {
+            if (UNLIKELY(*p == byteOrderMark)) {
+                copyCodeWithoutBOMs();
                 break;
             }
-            m_nextOffset3 = m_position;
-            m_next3 = m_code[m_position++];
-        } while (m_next3 == 0xFEFF);
-    }
-}
-
-// called on each new line
-void Lexer::nextLine()
-{
-    yylineno++;
-    m_atLineStart = true;
-}
-
-void Lexer::setDone(State s)
-{
-    m_state = s;
-    m_done = true;
-}
-
-int Lexer::lex(void* p1, void* p2)
-{
-    YYSTYPE* lvalp = static_cast<YYSTYPE*>(p1);
-    YYLTYPE* llocp = static_cast<YYLTYPE*>(p2);
-    int token = 0;
-    m_state = Start;
-    unsigned short stringType = 0; // either single or double quotes
-    m_buffer8.clear();
-    m_buffer16.clear();
-    m_done = false;
-    m_terminator = false;
-    m_skipLF = false;
-    m_skipCR = false;
-
-    // did we push a token on the stack previously ?
-    // (after an automatic semicolon insertion)
-    if (m_stackToken >= 0) {
-        setDone(Other);
-        token = m_stackToken;
-        m_stackToken = 0;
-    }
-    int startOffset = m_currentOffset;
-    while (!m_done) {
-        if (m_skipLF && m_current != '\n') // found \r but not \n afterwards
-            m_skipLF = false;
-        if (m_skipCR && m_current != '\r') // found \n but not \r afterwards
-            m_skipCR = false;
-        if (m_skipLF || m_skipCR) { // found \r\n or \n\r -> eat the second one
-            m_skipLF = false;
-            m_skipCR = false;
-            shift(1);
         }
-        switch (m_state) {
-            case Start:
-                startOffset = m_currentOffset;
-                if (isWhiteSpace()) {
-                    // do nothing
-                } else if (m_current == '/' && m_next1 == '/') {
-                    shift(1);
-                    m_state = InSingleLineComment;
-                } else if (m_current == '/' && m_next1 == '*') {
-                    shift(1);
-                    m_state = InMultiLineComment;
-                } else if (m_current == -1) {
-                    if (!m_terminator && !m_delimited && !m_isReparsing) {
-                        // automatic semicolon insertion if program incomplete
-                        token = ';';
-                        m_stackToken = 0;
-                        setDone(Other);
-                    } else
-                        setDone(Eof);
-                } else if (isLineTerminator()) {
-                    nextLine();
-                    m_terminator = true;
-                    if (m_restrKeyword) {
-                        token = ';';
-                        setDone(Other);
-                    }
-                } else if (m_current == '"' || m_current == '\'') {
-                    m_state = InString;
-                    stringType = static_cast<unsigned short>(m_current);
-                } else if (isIdentStart(m_current)) {
-                    record16(m_current);
-                    m_state = InIdentifierOrKeyword;
-                } else if (m_current == '\\')
-                    m_state = InIdentifierStartUnicodeEscapeStart;
-                else if (m_current == '0') {
-                    record8(m_current);
-                    m_state = InNum0;
-                } else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InNum;
-                } else if (m_current == '.' && isDecimalDigit(m_next1)) {
-                    record8(m_current);
-                    m_state = InDecimal;
-                    // <!-- marks the beginning of a line comment (for www usage)
-                } else if (m_current == '<' && m_next1 == '!' && m_next2 == '-' && m_next3 == '-') {
-                    shift(3);
-                    m_state = InSingleLineComment;
-                    // same for -->
-                } else if (m_atLineStart && m_current == '-' && m_next1 == '-' &&  m_next2 == '>') {
-                    shift(2);
-                    m_state = InSingleLineComment;
-                } else {
-                    token = matchPunctuator(lvalp->intValue, m_current, m_next1, m_next2, m_next3);
-                    if (token != -1)
-                        setDone(Other);
-                    else
-                        setDone(Bad);
-                }
-                break;
-            case InString:
-                if (m_current == stringType) {
-                    shift(1);
-                    setDone(String);
-                } else if (isLineTerminator() || m_current == -1)
-                    setDone(Bad);
-                else if (m_current == '\\')
-                    m_state = InEscapeSequence;
-                else
-                    record16(m_current);
-                break;
-            // Escape Sequences inside of strings
-            case InEscapeSequence:
-                if (isOctalDigit(m_current)) {
-                    if (m_current >= '0' && m_current <= '3' &&
-                        isOctalDigit(m_next1) && isOctalDigit(m_next2)) {
-                        record16(convertOctal(m_current, m_next1, m_next2));
-                        shift(2);
-                        m_state = InString;
-                    } else if (isOctalDigit(m_current) && isOctalDigit(m_next1)) {
-                        record16(convertOctal('0', m_current, m_next1));
-                        shift(1);
-                        m_state = InString;
-                    } else if (isOctalDigit(m_current)) {
-                        record16(convertOctal('0', '0', m_current));
-                        m_state = InString;
-                    } else
-                        setDone(Bad);
-                } else if (m_current == 'x')
-                    m_state = InHexEscape;
-                else if (m_current == 'u')
-                    m_state = InUnicodeEscape;
-                else if (isLineTerminator()) {
-                    nextLine();
-                    m_state = InString;
-                } else {
-                    record16(singleEscape(static_cast<unsigned short>(m_current)));
-                    m_state = InString;
-                }
-                break;
-            case InHexEscape:
-                if (isHexDigit(m_current) && isHexDigit(m_next1)) {
-                    m_state = InString;
-                    record16(convertHex(m_current, m_next1));
-                    shift(1);
-                } else if (m_current == stringType) {
-                    record16('x');
-                    shift(1);
-                    setDone(String);
-                } else {
-                    record16('x');
-                    record16(m_current);
-                    m_state = InString;
-                }
-                break;
-            case InUnicodeEscape:
-                if (isHexDigit(m_current) && isHexDigit(m_next1) && isHexDigit(m_next2) && isHexDigit(m_next3)) {
-                    record16(convertUnicode(m_current, m_next1, m_next2, m_next3));
-                    shift(3);
-                    m_state = InString;
-                } else if (m_current == stringType) {
-                    record16('u');
-                    shift(1);
-                    setDone(String);
-                } else
-                    setDone(Bad);
-                break;
-            case InSingleLineComment:
-                if (isLineTerminator()) {
-                    nextLine();
-                    m_terminator = true;
-                    if (m_restrKeyword) {
-                        token = ';';
-                        setDone(Other);
-                    } else
-                        m_state = Start;
-                } else if (m_current == -1)
-                    setDone(Eof);
-                break;
-            case InMultiLineComment:
-                if (m_current == -1)
-                    setDone(Bad);
-                else if (isLineTerminator())
-                    nextLine();
-                else if (m_current == '*' && m_next1 == '/') {
-                    m_state = Start;
-                    shift(1);
-                }
-                break;
-            case InIdentifierOrKeyword:
-            case InIdentifier:
-                if (isIdentPart(m_current))
-                    record16(m_current);
-                else if (m_current == '\\')
-                    m_state = InIdentifierPartUnicodeEscapeStart;
-                else
-                    setDone(m_state == InIdentifierOrKeyword ? IdentifierOrKeyword : Identifier);
-                break;
-            case InNum0:
-                if (m_current == 'x' || m_current == 'X') {
-                    record8(m_current);
-                    m_state = InHex;
-                } else if (m_current == '.') {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else if (m_current == 'e' || m_current == 'E') {
-                    record8(m_current);
-                    m_state = InExponentIndicator;
-                } else if (isOctalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InOctal;
-                } else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else
-                    setDone(Number);
-                break;
-            case InHex:
-                if (isHexDigit(m_current))
-                    record8(m_current);
-                else
-                    setDone(Hex);
-                break;
-            case InOctal:
-                if (isOctalDigit(m_current))
-                    record8(m_current);
-                else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else
-                    setDone(Octal);
-                break;
-            case InNum:
-                if (isDecimalDigit(m_current))
-                    record8(m_current);
-                else if (m_current == '.') {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else if (m_current == 'e' || m_current == 'E') {
-                    record8(m_current);
-                    m_state = InExponentIndicator;
-                } else
-                    setDone(Number);
-                break;
-            case InDecimal:
-                if (isDecimalDigit(m_current))
-                    record8(m_current);
-                else if (m_current == 'e' || m_current == 'E') {
-                    record8(m_current);
-                    m_state = InExponentIndicator;
-                } else
-                    setDone(Number);
-                break;
-            case InExponentIndicator:
-                if (m_current == '+' || m_current == '-')
-                    record8(m_current);
-                else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InExponent;
-                } else
-                    setDone(Bad);
-                break;
-            case InExponent:
-                if (isDecimalDigit(m_current))
-                    record8(m_current);
-                else
-                    setDone(Number);
-                break;
-            case InIdentifierStartUnicodeEscapeStart:
-                if (m_current == 'u')
-                    m_state = InIdentifierStartUnicodeEscape;
-                else
-                    setDone(Bad);
-                break;
-            case InIdentifierPartUnicodeEscapeStart:
-                if (m_current == 'u')
-                    m_state = InIdentifierPartUnicodeEscape;
-                else
-                    setDone(Bad);
-                break;
-            case InIdentifierStartUnicodeEscape:
-                if (!isHexDigit(m_current) || !isHexDigit(m_next1) || !isHexDigit(m_next2) || !isHexDigit(m_next3)) {
-                    setDone(Bad);
-                    break;
-                }
-                token = convertUnicode(m_current, m_next1, m_next2, m_next3);
-                shift(3);
-                if (!isIdentStart(token)) {
-                    setDone(Bad);
-                    break;
-                }
-                record16(token);
-                m_state = InIdentifier;
-                break;
-            case InIdentifierPartUnicodeEscape:
-                if (!isHexDigit(m_current) || !isHexDigit(m_next1) || !isHexDigit(m_next2) || !isHexDigit(m_next3)) {
-                    setDone(Bad);
-                    break;
-                }
-                token = convertUnicode(m_current, m_next1, m_next2, m_next3);
-                shift(3);
-                if (!isIdentPart(token)) {
-                    setDone(Bad);
-                    break;
-                }
-                record16(token);
-                m_state = InIdentifier;
-                break;
-            default:
-                ASSERT(!"Unhandled state in switch statement");
-        }
-
-        // move on to the next character
-        if (!m_done)
-            shift(1);
-        if (m_state != Start && m_state != InSingleLineComment)
-            m_atLineStart = false;
     }
 
-    // no identifiers allowed directly after numeric literal, e.g. "3in" is bad
-    if ((m_state == Number || m_state == Octal || m_state == Hex) && isIdentStart(m_current))
-        m_state = Bad;
-
-    // terminate string
-    m_buffer8.append('\0');
-
-#ifdef JSC_DEBUG_LEX
-    fprintf(stderr, "line: %d ", lineNo());
-    fprintf(stderr, "yytext (%x): ", m_buffer8[0]);
-    fprintf(stderr, "%s ", m_buffer8.data());
-#endif
-
-    double dval = 0;
-    if (m_state == Number)
-        dval = WTF::strtod(m_buffer8.data(), 0L);
-    else if (m_state == Hex) { // scan hex numbers
-        const char* p = m_buffer8.data() + 2;
-        while (char c = *p++) {
-            dval *= 16;
-            dval += convertHex(c);
-        }
-
-        if (dval >= mantissaOverflowLowerBound)
-            dval = parseIntOverflow(m_buffer8.data() + 2, p - (m_buffer8.data() + 3), 16);
-
-        m_state = Number;
-    } else if (m_state == Octal) {   // scan octal number
-        const char* p = m_buffer8.data() + 1;
-        while (char c = *p++) {
-            dval *= 8;
-            dval += c - '0';
-        }
-
-        if (dval >= mantissaOverflowLowerBound)
-            dval = parseIntOverflow(m_buffer8.data() + 1, p - (m_buffer8.data() + 2), 8);
-
-        m_state = Number;
-    }
-
-#ifdef JSC_DEBUG_LEX
-    switch (m_state) {
-        case Eof:
-            printf("(EOF)\n");
-            break;
-        case Other:
-            printf("(Other)\n");
-            break;
-        case Identifier:
-            printf("(Identifier)/(Keyword)\n");
-            break;
-        case String:
-            printf("(String)\n");
-            break;
-        case Number:
-            printf("(Number)\n");
-            break;
-        default:
-            printf("(unknown)");
-    }
-#endif
-
-    if (m_state != Identifier)
-        m_eatNextIdentifier = false;
-
-    m_restrKeyword = false;
-    m_delimited = false;
-    llocp->first_line = yylineno;
-    llocp->last_line = yylineno;
-    llocp->first_column = startOffset;
-    llocp->last_column = m_currentOffset;
-    switch (m_state) {
-        case Eof:
-            token = 0;
-            break;
-        case Other:
-            if (token == '}' || token == ';')
-                m_delimited = true;
-            break;
-        case Identifier:
-            // Apply anonymous-function hack below (eat the identifier).
-            if (m_eatNextIdentifier) {
-                m_eatNextIdentifier = false;
-                token = lex(lvalp, llocp);
-                break;
-            }
-            lvalp->ident = makeIdentifier(m_buffer16);
-            token = IDENT;
-            break;
-        case IdentifierOrKeyword: {
-            lvalp->ident = makeIdentifier(m_buffer16);
-            const HashEntry* entry = m_mainTable.entry(m_globalData, *lvalp->ident);
-            if (!entry) {
-                // Lookup for keyword failed, means this is an identifier.
-                token = IDENT;
-                break;
-            }
-            token = entry->lexerValue();
-            // Hack for "f = function somename() { ... }"; too hard to get into the grammar.
-            m_eatNextIdentifier = token == FUNCTION && m_lastToken == '=';
-            if (token == CONTINUE || token == BREAK || token == RETURN || token == THROW)
-                m_restrKeyword = true;
-            break;
-        }
-        case String:
-            // Atomize constant strings in case they're later used in property lookup.
-            lvalp->ident = makeIdentifier(m_buffer16);
-            token = STRING;
-            break;
-        case Number:
-            lvalp->doubleValue = dval;
-            token = NUMBER;
-            break;
-        case Bad:
-#ifdef JSC_DEBUG_LEX
-            fprintf(stderr, "yylex: ERROR.\n");
-#endif
-            m_error = true;
-            return -1;
-        default:
-            ASSERT(!"unhandled numeration value in switch");
-            m_error = true;
-            return -1;
-    }
-    m_lastToken = token;
-    return token;
+    // Read the first characters into the 4-character buffer.
+    shift4();
+    ASSERT(currentOffset() == source.startOffset());
 }
 
-bool Lexer::isWhiteSpace() const
+void Lexer::copyCodeWithoutBOMs()
 {
-    return isWhiteSpace(m_current);
+    // Note: In this case, the character offset data for debugging will be incorrect.
+    // If it's important to correctly debug code with extraneous BOMs, then the caller
+    // should strip the BOMs when creating the SourceProvider object and do its own
+    // mapping of offsets within the stripped text to original text offset.
+
+    m_codeWithoutBOMs.reserveCapacity(m_codeEnd - m_code);
+    for (const UChar* p = m_code; p < m_codeEnd; ++p) {
+        UChar c = *p;
+        if (c != byteOrderMark)
+            m_codeWithoutBOMs.append(c);
+    }
+    ptrdiff_t startDelta = m_codeStart - m_code;
+    m_code = m_codeWithoutBOMs.data();
+    m_codeStart = m_code + startDelta;
+    m_codeEnd = m_codeWithoutBOMs.data() + m_codeWithoutBOMs.size();
 }
 
-bool Lexer::isLineTerminator()
+void Lexer::shiftLineTerminator()
 {
-    bool cr = (m_current == '\r');
-    bool lf = (m_current == '\n');
-    if (cr)
-        m_skipLF = true;
-    else if (lf)
-        m_skipCR = true;
-    return cr || lf || m_current == 0x2028 || m_current == 0x2029;
+    ASSERT(isLineTerminator(m_current));
+
+    // Allow both CRLF and LFCR.
+    if (m_current + m_next1 == '\n' + '\r')
+        shift2();
+    else
+        shift1();
+
+    ++m_lineNumber;
 }
 
-bool Lexer::isIdentStart(int c)
+ALWAYS_INLINE Identifier* Lexer::makeIdentifier(const UChar* characters, size_t length)
 {
-    return isASCIIAlpha(c) || c == '$' || c == '_' || (!isASCII(c) && (category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other)));
+    m_identifiers.append(Identifier(m_globalData, characters, length));
+    return &m_identifiers.last();
 }
 
-bool Lexer::isIdentPart(int c)
+inline bool Lexer::lastTokenWasRestrKeyword() const
 {
-    return isASCIIAlphanumeric(c) || c == '$' || c == '_' || (!isASCII(c) && (category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other
-                            | Mark_NonSpacing | Mark_SpacingCombining | Number_DecimalDigit | Punctuation_Connector)));
+    return m_lastToken == CONTINUE || m_lastToken == BREAK || m_lastToken == RETURN || m_lastToken == THROW;
 }
 
-static bool isDecimalDigit(int c)
+static NEVER_INLINE bool isNonASCIIIdentStart(int c)
 {
-    return isASCIIDigit(c);
+    return category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other);
 }
 
-bool Lexer::isHexDigit(int c)
+static inline bool isIdentStart(int c)
 {
-    return isASCIIHexDigit(c); 
+    return isASCII(c) ? isASCIIAlpha(c) || c == '$' || c == '_' : isNonASCIIIdentStart(c);
 }
 
-bool Lexer::isOctalDigit(int c)
+static NEVER_INLINE bool isNonASCIIIdentPart(int c)
 {
-    return isASCIIOctalDigit(c);
+    return category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other
+        | Mark_NonSpacing | Mark_SpacingCombining | Number_DecimalDigit | Punctuation_Connector);
 }
 
-int Lexer::matchPunctuator(int& charPos, int c1, int c2, int c3, int c4)
+static inline bool isIdentPart(int c)
 {
-    if (c1 == '>' && c2 == '>' && c3 == '>' && c4 == '=') {
-        shift(4);
-        return URSHIFTEQUAL;
-    }
-    if (c1 == '=' && c2 == '=' && c3 == '=') {
-        shift(3);
-        return STREQ;
-    }
-    if (c1 == '!' && c2 == '=' && c3 == '=') {
-        shift(3);
-        return STRNEQ;
-    }
-    if (c1 == '>' && c2 == '>' && c3 == '>') {
-        shift(3);
-        return URSHIFT;
-    }
-    if (c1 == '<' && c2 == '<' && c3 == '=') {
-        shift(3);
-        return LSHIFTEQUAL;
-    }
-    if (c1 == '>' && c2 == '>' && c3 == '=') {
-        shift(3);
-        return RSHIFTEQUAL;
-    }
-    if (c1 == '<' && c2 == '=') {
-        shift(2);
-        return LE;
-    }
-    if (c1 == '>' && c2 == '=') {
-        shift(2);
-        return GE;
-    }
-    if (c1 == '!' && c2 == '=') {
-        shift(2);
-        return NE;
-    }
-    if (c1 == '+' && c2 == '+') {
-        shift(2);
-        if (m_terminator)
-            return AUTOPLUSPLUS;
-        return PLUSPLUS;
-    }
-    if (c1 == '-' && c2 == '-') {
-        shift(2);
-        if (m_terminator)
-            return AUTOMINUSMINUS;
-        return MINUSMINUS;
-    }
-    if (c1 == '=' && c2 == '=') {
-        shift(2);
-        return EQEQ;
-    }
-    if (c1 == '+' && c2 == '=') {
-        shift(2);
-        return PLUSEQUAL;
-    }
-    if (c1 == '-' && c2 == '=') {
-        shift(2);
-        return MINUSEQUAL;
-    }
-    if (c1 == '*' && c2 == '=') {
-        shift(2);
-        return MULTEQUAL;
-    }
-    if (c1 == '/' && c2 == '=') {
-        shift(2);
-        return DIVEQUAL;
-    }
-    if (c1 == '&' && c2 == '=') {
-        shift(2);
-        return ANDEQUAL;
-    }
-    if (c1 == '^' && c2 == '=') {
-        shift(2);
-        return XOREQUAL;
-    }
-    if (c1 == '%' && c2 == '=') {
-        shift(2);
-        return MODEQUAL;
-    }
-    if (c1 == '|' && c2 == '=') {
-        shift(2);
-        return OREQUAL;
-    }
-    if (c1 == '<' && c2 == '<') {
-        shift(2);
-        return LSHIFT;
-    }
-    if (c1 == '>' && c2 == '>') {
-        shift(2);
-        return RSHIFT;
-    }
-    if (c1 == '&' && c2 == '&') {
-        shift(2);
-        return AND;
-    }
-    if (c1 == '|' && c2 == '|') {
-        shift(2);
-        return OR;
-    }
-
-    switch (c1) {
-        case '=':
-        case '>':
-        case '<':
-        case ',':
-        case '!':
-        case '~':
-        case '?':
-        case ':':
-        case '.':
-        case '+':
-        case '-':
-        case '*':
-        case '/':
-        case '&':
-        case '|':
-        case '^':
-        case '%':
-        case '(':
-        case ')':
-        case '[':
-        case ']':
-        case ';':
-            shift(1);
-            return static_cast<int>(c1);
-        case '{':
-            charPos = m_currentOffset;
-            shift(1);
-            return OPENBRACE;
-        case '}':
-            charPos = m_currentOffset;
-            shift(1);
-            return CLOSEBRACE;
-        default:
-            return -1;
-    }
+    return isASCII(c) ? isASCIIAlphanumeric(c) || c == '$' || c == '_' : isNonASCIIIdentPart(c);
 }
 
-unsigned short Lexer::singleEscape(unsigned short c)
+static inline int singleEscape(int c)
 {
     switch (c) {
         case 'b':
@@ -784,96 +251,698 @@
             return 0x0C;
         case 'r':
             return 0x0D;
-        case '"':
-            return 0x22;
-        case '\'':
-            return 0x27;
-        case '\\':
-            return 0x5C;
         default:
             return c;
     }
 }
 
-unsigned short Lexer::convertOctal(int c1, int c2, int c3)
-{
-    return static_cast<unsigned short>((c1 - '0') * 64 + (c2 - '0') * 8 + c3 - '0');
-}
-
-unsigned char Lexer::convertHex(int c)
-{
-    if (c >= '0' && c <= '9')
-        return static_cast<unsigned char>(c - '0');
-    if (c >= 'a' && c <= 'f')
-        return static_cast<unsigned char>(c - 'a' + 10);
-    return static_cast<unsigned char>(c - 'A' + 10);
-}
-
-unsigned char Lexer::convertHex(int c1, int c2)
-{
-    return ((convertHex(c1) << 4) + convertHex(c2));
-}
-
-UChar Lexer::convertUnicode(int c1, int c2, int c3, int c4)
-{
-    unsigned char highByte = (convertHex(c1) << 4) + convertHex(c2);
-    unsigned char lowByte = (convertHex(c3) << 4) + convertHex(c4);
-    return (highByte << 8 | lowByte);
-}
-
-void Lexer::record8(int c)
+inline void Lexer::record8(int c)
 {
     ASSERT(c >= 0);
-    ASSERT(c <= 0xff);
+    ASSERT(c <= 0xFF);
     m_buffer8.append(static_cast<char>(c));
 }
 
-void Lexer::record16(int c)
+inline void Lexer::record16(UChar c)
+{
+    m_buffer16.append(c);
+}
+
+inline void Lexer::record16(int c)
 {
     ASSERT(c >= 0);
     ASSERT(c <= USHRT_MAX);
     record16(UChar(static_cast<unsigned short>(c)));
 }
 
-void Lexer::record16(UChar c)
+int Lexer::lex(void* p1, void* p2)
 {
-    m_buffer16.append(c);
+    ASSERT(!m_error);
+    ASSERT(m_buffer8.isEmpty());
+    ASSERT(m_buffer16.isEmpty());
+
+    YYSTYPE* lvalp = static_cast<YYSTYPE*>(p1);
+    YYLTYPE* llocp = static_cast<YYLTYPE*>(p2);
+    int token = 0;
+    m_terminator = false;
+
+start:
+    while (isWhiteSpace(m_current))
+        shift1();
+
+    int startOffset = currentOffset();
+
+    if (m_current == -1) {
+        if (!m_terminator && !m_delimited && !m_isReparsing) {
+            // automatic semicolon insertion if program incomplete
+            token = ';';
+            goto doneSemicolon;
+        }
+        return 0;
+    }
+
+    m_delimited = false;
+    switch (m_current) {
+        case '>':
+            if (m_next1 == '>' && m_next2 == '>') {
+                if (m_next3 == '=') {
+                    shift4();
+                    token = URSHIFTEQUAL;
+                    break;
+                }
+                shift3();
+                token = URSHIFT;
+                break;
+            }
+            if (m_next1 == '>') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = RSHIFTEQUAL;
+                    break;
+                }
+                shift2();
+                token = RSHIFT;
+                break;
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = GE;
+                break;
+            }
+            shift1();
+            token = '>';
+            break;
+        case '=':
+            if (m_next1 == '=') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = STREQ;
+                    break;
+                }
+                shift2();
+                token = EQEQ;
+                break;
+            }
+            shift1();
+            token = '=';
+            break;
+        case '!':
+            if (m_next1 == '=') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = STRNEQ;
+                    break;
+                }
+                shift2();
+                token = NE;
+                break;
+            }
+            shift1();
+            token = '!';
+            break;
+        case '<':
+            if (m_next1 == '!' && m_next2 == '-' && m_next3 == '-') {
+                // <!-- marks the beginning of a line comment (for www usage)
+                shift4();
+                goto inSingleLineComment;
+            }
+            if (m_next1 == '<') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = LSHIFTEQUAL;
+                    break;
+                }
+                shift2();
+                token = LSHIFT;
+                break;
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = LE;
+                break;
+            }
+            shift1();
+            token = '<';
+            break;
+        case '+':
+            if (m_next1 == '+') {
+                shift2();
+                if (m_terminator) {
+                    token = AUTOPLUSPLUS;
+                    break;
+                }
+                token = PLUSPLUS;
+                break;
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = PLUSEQUAL;
+                break;
+            }
+            shift1();
+            token = '+';
+            break;
+        case '-':
+            if (m_next1 == '-') {
+                if (m_atLineStart && m_next2 == '>') {
+                    shift3();
+                    goto inSingleLineComment;
+                }
+                shift2();
+                if (m_terminator) {
+                    token = AUTOMINUSMINUS;
+                    break;
+                }
+                token = MINUSMINUS;
+                break;
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = MINUSEQUAL;
+                break;
+            }
+            shift1();
+            token = '-';
+            break;
+        case '*':
+            if (m_next1 == '=') {
+                shift2();
+                token = MULTEQUAL;
+                break;
+            }
+            shift1();
+            token = '*';
+            break;
+        case '/':
+            if (m_next1 == '/') {
+                shift2();
+                goto inSingleLineComment;
+            }
+            if (m_next1 == '*')
+                goto inMultiLineComment;
+            if (m_next1 == '=') {
+                shift2();
+                token = DIVEQUAL;
+                break;
+            }
+            shift1();
+            token = '/';
+            break;
+        case '&':
+            if (m_next1 == '&') {
+                shift2();
+                token = AND;
+                break;
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = ANDEQUAL;
+                break;
+            }
+            shift1();
+            token = '&';
+            break;
+        case '^':
+            if (m_next1 == '=') {
+                shift2();
+                token = XOREQUAL;
+                break;
+            }
+            shift1();
+            token = '^';
+            break;
+        case '%':
+            if (m_next1 == '=') {
+                shift2();
+                token = MODEQUAL;
+                break;
+            }
+            shift1();
+            token = '%';
+            break;
+        case '|':
+            if (m_next1 == '=') {
+                shift2();
+                token = OREQUAL;
+                break;
+            }
+            if (m_next1 == '|') {
+                shift2();
+                token = OR;
+                break;
+            }
+            shift1();
+            token = '|';
+            break;
+        case '.':
+            if (isASCIIDigit(m_next1)) {
+                record8('.');
+                shift1();
+                goto inNumberAfterDecimalPoint;
+            }
+            token = '.';
+            shift1();
+            break;
+        case ',':
+        case '~':
+        case '?':
+        case ':':
+        case '(':
+        case ')':
+        case '[':
+        case ']':
+            token = m_current;
+            shift1();
+            break;
+        case ';':
+            shift1();
+            m_delimited = true;
+            token = ';';
+            break;
+        case '{':
+            lvalp->intValue = currentOffset();
+            shift1();
+            token = OPENBRACE;
+            break;
+        case '}':
+            lvalp->intValue = currentOffset();
+            shift1();
+            m_delimited = true;
+            token = CLOSEBRACE;
+            break;
+        case '\\':
+            goto startIdentifierWithBackslash;
+        case '0':
+            goto startNumberWithZeroDigit;
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9':
+            goto startNumber;
+        case '"':
+        case '\'':
+            goto startString;
+        default:
+            if (isIdentStart(m_current))
+                goto startIdentifierOrKeyword;
+            if (isLineTerminator(m_current)) {
+                shiftLineTerminator();
+                m_atLineStart = true;
+                m_terminator = true;
+                if (lastTokenWasRestrKeyword()) {
+                    token = ';';
+                    goto doneSemicolon;
+                }
+                goto start;
+            }
+            goto returnError;
+    }
+
+    m_atLineStart = false;
+    goto returnToken;
+
+startString: {
+    int stringQuoteCharacter = m_current;
+    shift1();
+
+    const UChar* stringStart = currentCharacter();
+    while (m_current != stringQuoteCharacter) {
+        // Fast check for characters that require special handling.
+        // Catches -1, \n, \r, \, 0x2028, and 0x2029 as efficiently
+        // as possible, and lets through all common ASCII characters.
+        if (UNLIKELY(m_current == '\\') || UNLIKELY(((static_cast<unsigned>(m_current) - 0xE) & 0x2000))) {
+            m_buffer16.append(stringStart, currentCharacter() - stringStart);
+            goto inString;
+        }
+        shift1();
+    }
+    lvalp->ident = makeIdentifier(stringStart, currentCharacter() - stringStart);
+    shift1();
+    m_atLineStart = false;
+    m_delimited = false;
+    token = STRING;
+    goto returnToken;
+
+inString:
+    while (m_current != stringQuoteCharacter) {
+        if (m_current == '\\')
+            goto inStringEscapeSequence;
+        if (UNLIKELY(isLineTerminator(m_current)))
+            goto returnError;
+        if (UNLIKELY(m_current == -1))
+            goto returnError;
+        record16(m_current);
+        shift1();
+    }
+    goto doneString;
+
+inStringEscapeSequence:
+    shift1();
+    if (m_current == 'x') {
+        shift1();
+        if (isASCIIHexDigit(m_current) && isASCIIHexDigit(m_next1)) {
+            record16(convertHex(m_current, m_next1));
+            shift2();
+            goto inString;
+        }
+        record16('x');
+        if (m_current == stringQuoteCharacter)
+            goto doneString;
+        goto inString;
+    }
+    if (m_current == 'u') {
+        shift1();
+        if (isASCIIHexDigit(m_current) && isASCIIHexDigit(m_next1) && isASCIIHexDigit(m_next2) && isASCIIHexDigit(m_next3)) {
+            record16(convertUnicode(m_current, m_next1, m_next2, m_next3));
+            shift4();
+            goto inString;
+        }
+        if (m_current == stringQuoteCharacter) {
+            record16('u');
+            goto doneString;
+        }
+        goto returnError;
+    }
+    if (isASCIIOctalDigit(m_current)) {
+        if (m_current >= '0' && m_current <= '3' && isASCIIOctalDigit(m_next1) && isASCIIOctalDigit(m_next2)) {
+            record16((m_current - '0') * 64 + (m_next1 - '0') * 8 + m_next2 - '0');
+            shift3();
+            goto inString;
+        }
+        if (isASCIIOctalDigit(m_next1)) {
+            record16((m_current - '0') * 8 + m_next1 - '0');
+            shift2();
+            goto inString;
+        }
+        record16(m_current - '0');
+        shift1();
+        goto inString;
+    }
+    if (isLineTerminator(m_current)) {
+        shiftLineTerminator();
+        goto inString;
+    }
+    record16(singleEscape(m_current));
+    shift1();
+    goto inString;
+}
+
+startIdentifierWithBackslash:
+    shift1();
+    if (UNLIKELY(m_current != 'u'))
+        goto returnError;
+    shift1();
+    if (UNLIKELY(!isASCIIHexDigit(m_current) || !isASCIIHexDigit(m_next1) || !isASCIIHexDigit(m_next2) || !isASCIIHexDigit(m_next3)))
+        goto returnError;
+    token = convertUnicode(m_current, m_next1, m_next2, m_next3);
+    if (UNLIKELY(!isIdentStart(token)))
+        goto returnError;
+    goto inIdentifierAfterCharacterCheck;
+
+startIdentifierOrKeyword: {
+    const UChar* identifierStart = currentCharacter();
+    shift1();
+    while (isIdentPart(m_current))
+        shift1();
+    if (LIKELY(m_current != '\\')) {
+        lvalp->ident = makeIdentifier(identifierStart, currentCharacter() - identifierStart);
+        goto doneIdentifierOrKeyword;
+    }
+    m_buffer16.append(identifierStart, currentCharacter() - identifierStart);
+}
+
+    do {
+        shift1();
+        if (UNLIKELY(m_current != 'u'))
+            goto returnError;
+        shift1();
+        if (UNLIKELY(!isASCIIHexDigit(m_current) || !isASCIIHexDigit(m_next1) || !isASCIIHexDigit(m_next2) || !isASCIIHexDigit(m_next3)))
+            goto returnError;
+        token = convertUnicode(m_current, m_next1, m_next2, m_next3);
+        if (UNLIKELY(!isIdentPart(token)))
+            goto returnError;
+inIdentifierAfterCharacterCheck:
+        record16(token);
+        shift4();
+
+        while (isIdentPart(m_current)) {
+            record16(m_current);
+            shift1();
+        }
+    } while (UNLIKELY(m_current == '\\'));
+    goto doneIdentifier;
+
+inSingleLineComment:
+    while (!isLineTerminator(m_current)) {
+        if (UNLIKELY(m_current == -1))
+            return 0;
+        shift1();
+    }
+    shiftLineTerminator();
+    m_atLineStart = true;
+    m_terminator = true;
+    if (lastTokenWasRestrKeyword())
+        goto doneSemicolon;
+    goto start;
+
+inMultiLineComment:
+    shift2();
+    while (m_current != '*' || m_next1 != '/') {
+        if (isLineTerminator(m_current))
+            shiftLineTerminator();
+        else {
+            shift1();
+            if (UNLIKELY(m_current == -1))
+                goto returnError;
+        }
+    }
+    shift2();
+    m_atLineStart = false;
+    goto start;
+
+startNumberWithZeroDigit:
+    shift1();
+    if ((m_current | 0x20) == 'x' && isASCIIHexDigit(m_next1)) {
+        shift1();
+        goto inHex;
+    }
+    if (m_current == '.') {
+        record8('0');
+        record8('.');
+        shift1();
+        goto inNumberAfterDecimalPoint;
+    }
+    if ((m_current | 0x20) == 'e') {
+        record8('0');
+        record8('e');
+        shift1();
+        goto inExponentIndicator;
+    }
+    if (isASCIIOctalDigit(m_current))
+        goto inOctal;
+    if (isASCIIDigit(m_current))
+        goto startNumber;
+    lvalp->doubleValue = 0;
+    goto doneNumeric;
+
+inNumberAfterDecimalPoint:
+    while (isASCIIDigit(m_current)) {
+        record8(m_current);
+        shift1();
+    }
+    if ((m_current | 0x20) == 'e') {
+        record8('e');
+        shift1();
+        goto inExponentIndicator;
+    }
+    goto doneNumber;
+
+inExponentIndicator:
+    if (m_current == '+' || m_current == '-') {
+        record8(m_current);
+        shift1();
+    }
+    if (!isASCIIDigit(m_current))
+        goto returnError;
+    do {
+        record8(m_current);
+        shift1();
+    } while (isASCIIDigit(m_current));
+    goto doneNumber;
+
+inOctal: {
+    do {
+        record8(m_current);
+        shift1();
+    } while (isASCIIOctalDigit(m_current));
+    if (isASCIIDigit(m_current))
+        goto startNumber;
+
+    double dval = 0;
+
+    const char* end = m_buffer8.end();
+    for (const char* p = m_buffer8.data(); p < end; ++p) {
+        dval *= 8;
+        dval += *p - '0';
+    }
+    if (dval >= mantissaOverflowLowerBound)
+        dval = parseIntOverflow(m_buffer8.data(), end - m_buffer8.data(), 8);
+
+    m_buffer8.resize(0);
+
+    lvalp->doubleValue = dval;
+    goto doneNumeric;
+}
+
+inHex: {
+    do {
+        record8(m_current);
+        shift1();
+    } while (isASCIIHexDigit(m_current));
+
+    double dval = 0;
+
+    const char* end = m_buffer8.end();
+    for (const char* p = m_buffer8.data(); p < end; ++p) {
+        dval *= 16;
+        dval += toASCIIHexValue(*p);
+    }
+    if (dval >= mantissaOverflowLowerBound)
+        dval = parseIntOverflow(m_buffer8.data(), end - m_buffer8.data(), 16);
+
+    m_buffer8.resize(0);
+
+    lvalp->doubleValue = dval;
+    goto doneNumeric;
+}
+
+startNumber:
+    record8(m_current);
+    shift1();
+    while (isASCIIDigit(m_current)) {
+        record8(m_current);
+        shift1();
+    }
+    if (m_current == '.') {
+        record8('.');
+        shift1();
+        goto inNumberAfterDecimalPoint;
+    }
+    if ((m_current | 0x20) == 'e') {
+        record8('e');
+        shift1();
+        goto inExponentIndicator;
+    }
+
+    // Fall through into doneNumber.
+
+doneNumber:
+    // Null-terminate string for strtod.
+    m_buffer8.append('\0');
+    lvalp->doubleValue = WTF::strtod(m_buffer8.data(), 0);
+    m_buffer8.resize(0);
+
+    // Fall through into doneNumeric.
+
+doneNumeric:
+    // No identifiers allowed directly after numeric literal, e.g. "3in" is bad.
+    if (UNLIKELY(isIdentStart(m_current)))
+        goto returnError;
+
+    m_atLineStart = false;
+    m_delimited = false;
+    token = NUMBER;
+    goto returnToken;
+
+doneSemicolon:
+    token = ';';
+    m_delimited = true;
+    goto returnToken;
+
+doneIdentifier:
+    m_atLineStart = false;
+    m_delimited = false;
+    lvalp->ident = makeIdentifier(m_buffer16.data(), m_buffer16.size());
+    m_buffer16.resize(0);
+    token = IDENT;
+    goto returnToken;
+
+doneIdentifierOrKeyword: {
+    m_atLineStart = false;
+    m_delimited = false;
+    m_buffer16.resize(0);
+    const HashEntry* entry = m_keywordTable.entry(m_globalData, *lvalp->ident);
+    token = entry ? entry->lexerValue() : IDENT;
+    goto returnToken;
+}
+
+doneString:
+    // Atomize constant strings in case they're later used in property lookup.
+    shift1();
+    m_atLineStart = false;
+    m_delimited = false;
+    lvalp->ident = makeIdentifier(m_buffer16.data(), m_buffer16.size());
+    m_buffer16.resize(0);
+    token = STRING;
+
+    // Fall through into returnToken.
+
+returnToken: {
+    int lineNumber = m_lineNumber;
+    llocp->first_line = lineNumber;
+    llocp->last_line = lineNumber;
+    llocp->first_column = startOffset;
+    llocp->last_column = currentOffset();
+
+    m_lastToken = token;
+    return token;
+}
+
+returnError:
+    m_error = true;
+    return -1;
 }
 
 bool Lexer::scanRegExp()
 {
-    m_buffer16.clear();
+    ASSERT(m_buffer16.isEmpty());
+
     bool lastWasEscape = false;
     bool inBrackets = false;
 
-    while (1) {
-        if (isLineTerminator() || m_current == -1)
+    while (true) {
+        if (isLineTerminator(m_current) || m_current == -1)
             return false;
-        else if (m_current != '/' || lastWasEscape == true || inBrackets == true) {
+        if (m_current != '/' || lastWasEscape || inBrackets) {
             // keep track of '[' and ']'
             if (!lastWasEscape) {
-                if ( m_current == '[' && !inBrackets )
+                if (m_current == '[' && !inBrackets)
                     inBrackets = true;
-                if ( m_current == ']' && inBrackets )
+                if (m_current == ']' && inBrackets)
                     inBrackets = false;
             }
             record16(m_current);
-            lastWasEscape =
-            !lastWasEscape && (m_current == '\\');
+            lastWasEscape = !lastWasEscape && m_current == '\\';
         } else { // end of regexp
             m_pattern = UString(m_buffer16);
-            m_buffer16.clear();
-            shift(1);
+            m_buffer16.resize(0);
+            shift1();
             break;
         }
-        shift(1);
+        shift1();
     }
 
     while (isIdentPart(m_current)) {
         record16(m_current);
-        shift(1);
+        shift1();
     }
     m_flags = UString(m_buffer16);
+    m_buffer16.resize(0);
 
     return true;
 }
@@ -881,6 +950,7 @@
 void Lexer::clear()
 {
     m_identifiers.clear();
+    m_codeWithoutBOMs.clear();
 
     Vector<char> newBuffer8;
     newBuffer8.reserveInitialCapacity(initialReadBufferCapacity);
@@ -892,8 +962,30 @@
 
     m_isReparsing = false;
 
-    m_pattern = 0;
-    m_flags = 0;
+    m_pattern = UString();
+    m_flags = UString();
+}
+
+SourceCode Lexer::sourceCode(int openBrace, int closeBrace, int firstLine)
+{
+    if (m_codeWithoutBOMs.isEmpty())
+        return SourceCode(m_source->provider(), openBrace, closeBrace + 1, firstLine);
+
+    const UChar* data = m_source->provider()->data();
+
+    ASSERT(openBrace < closeBrace);
+
+    int numBOMsBeforeOpenBrace = 0;
+    int numBOMsBetweenBraces = 0;
+
+    int i;
+    for (i = m_source->startOffset(); i < openBrace; ++i)
+        numBOMsBeforeOpenBrace += data[i] == byteOrderMark;
+    for (; i < closeBrace; ++i)
+        numBOMsBetweenBraces += data[i] == byteOrderMark;
+
+    return SourceCode(m_source->provider(), openBrace + numBOMsBeforeOpenBrace,
+        closeBrace + numBOMsBeforeOpenBrace + numBOMsBetweenBraces + 1, firstLine);
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/parser/Lexer.h b/JavaScriptCore/parser/Lexer.h
index 63c2da9..9c22a9c 100644
--- a/JavaScriptCore/parser/Lexer.h
+++ b/JavaScriptCore/parser/Lexer.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -22,10 +22,10 @@
 #ifndef Lexer_h
 #define Lexer_h
 
-#include "Identifier.h"
 #include "Lookup.h"
 #include "SegmentedVector.h"
 #include "SourceCode.h"
+#include <wtf/ASCIICType.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
 
@@ -35,125 +35,71 @@
 
     class Lexer : Noncopyable {
     public:
+        // Character manipulation functions.
+        static bool isWhiteSpace(int character);
+        static bool isLineTerminator(int character);
+        static unsigned char convertHex(int c1, int c2);
+        static UChar convertUnicode(int c1, int c2, int c3, int c4);
+
+        // Functions to set up parsing.
         void setCode(const SourceCode&);
         void setIsReparsing() { m_isReparsing = true; }
+
+        // Functions for the parser itself.
         int lex(void* lvalp, void* llocp);
-
-        int lineNo() const { return yylineno; }
-
+        int lineNumber() const { return m_lineNumber; }
         bool prevTerminator() const { return m_terminator; }
-
-        enum State {
-            Start,
-            IdentifierOrKeyword,
-            Identifier,
-            InIdentifierOrKeyword,
-            InIdentifier,
-            InIdentifierStartUnicodeEscapeStart,
-            InIdentifierStartUnicodeEscape,
-            InIdentifierPartUnicodeEscapeStart,
-            InIdentifierPartUnicodeEscape,
-            InSingleLineComment,
-            InMultiLineComment,
-            InNum,
-            InNum0,
-            InHex,
-            InOctal,
-            InDecimal,
-            InExponentIndicator,
-            InExponent,
-            Hex,
-            Octal,
-            Number,
-            String,
-            Eof,
-            InString,
-            InEscapeSequence,
-            InHexEscape,
-            InUnicodeEscape,
-            Other,
-            Bad
-        };
-
+        SourceCode sourceCode(int openBrace, int closeBrace, int firstLine);
         bool scanRegExp();
         const UString& pattern() const { return m_pattern; }
         const UString& flags() const { return m_flags; }
 
-        static unsigned char convertHex(int);
-        static unsigned char convertHex(int c1, int c2);
-        static UChar convertUnicode(int c1, int c2, int c3, int c4);
-        static bool isIdentStart(int);
-        static bool isIdentPart(int);
-        static bool isHexDigit(int);
-
+        // Functions for use after parsing.
         bool sawError() const { return m_error; }
-
         void clear();
-        SourceCode sourceCode(int openBrace, int closeBrace, int firstLine) { return SourceCode(m_source->provider(), openBrace, closeBrace + 1, firstLine); }
-
-        static inline bool isWhiteSpace(int ch)
-        {
-            return ch == '\t' || ch == 0x0b || ch == 0x0c || WTF::Unicode::isSeparatorSpace(ch);
-        }
-
-        static inline bool isLineTerminator(int ch)
-        {
-            return ch == '\r' || ch == '\n' || ch == 0x2028 || ch == 0x2029;
-        }
 
     private:
         friend class JSGlobalData;
+
         Lexer(JSGlobalData*);
         ~Lexer();
 
-        void setDone(State);
-        void shift(unsigned int p);
-        void nextLine();
-        int lookupKeyword(const char *);
-
-        bool isWhiteSpace() const;
-        bool isLineTerminator();
-        static bool isOctalDigit(int);
-
-        ALWAYS_INLINE int matchPunctuator(int& charPos, int c1, int c2, int c3, int c4);
-        static unsigned short singleEscape(unsigned short);
-        static unsigned short convertOctal(int c1, int c2, int c3);
+        void shift1();
+        void shift2();
+        void shift3();
+        void shift4();
+        void shiftLineTerminator();
 
         void record8(int);
         void record16(int);
         void record16(UChar);
 
-        JSC::Identifier* makeIdentifier(const Vector<UChar>& buffer)
-        {
-            m_identifiers.append(JSC::Identifier(m_globalData, buffer.data(), buffer.size()));
-            return &m_identifiers.last();
-        }
+        void copyCodeWithoutBOMs();
+
+        int currentOffset() const;
+        const UChar* currentCharacter() const;
+
+        JSC::Identifier* makeIdentifier(const UChar* buffer, size_t length);
+
+        bool lastTokenWasRestrKeyword() const;
 
         static const size_t initialReadBufferCapacity = 32;
         static const size_t initialIdentifierTableCapacity = 64;
 
-        int yylineno;
-        int yycolumn;
+        int m_lineNumber;
 
-        bool m_done;
         Vector<char> m_buffer8;
         Vector<UChar> m_buffer16;
         bool m_terminator;
-        bool m_restrKeyword;
         bool m_delimited; // encountered delimiter like "'" and "}" on last run
-        bool m_skipLF;
-        bool m_skipCR;
-        bool m_eatNextIdentifier;
-        int m_stackToken;
         int m_lastToken;
 
-        State m_state;
-        unsigned int m_position;
         const SourceCode* m_source;
         const UChar* m_code;
-        unsigned int m_length;
+        const UChar* m_codeStart;
+        const UChar* m_codeEnd;
         bool m_isReparsing;
-        int m_atLineStart;
+        bool m_atLineStart;
         bool m_error;
 
         // current and following unicode characters (int to allow for -1 for end-of-file marker)
@@ -162,11 +108,6 @@
         int m_next2;
         int m_next3;
         
-        int m_currentOffset;
-        int m_nextOffset1;
-        int m_nextOffset2;
-        int m_nextOffset3;
-        
         SegmentedVector<JSC::Identifier, initialIdentifierTableCapacity> m_identifiers;
 
         JSGlobalData* m_globalData;
@@ -174,9 +115,31 @@
         UString m_pattern;
         UString m_flags;
 
-        const HashTable m_mainTable;
+        const HashTable m_keywordTable;
+
+        Vector<UChar> m_codeWithoutBOMs;
     };
 
+    inline bool Lexer::isWhiteSpace(int ch)
+    {
+        return isASCII(ch) ? (ch == ' ' || ch == '\t' || ch == 0xB || ch == 0xC) : WTF::Unicode::isSeparatorSpace(ch);
+    }
+
+    inline bool Lexer::isLineTerminator(int ch)
+    {
+        return ch == '\r' || ch == '\n' || (ch & ~1) == 0x2028;
+    }
+
+    inline unsigned char Lexer::convertHex(int c1, int c2)
+    {
+        return (toASCIIHexValue(c1) << 4) | toASCIIHexValue(c2);
+    }
+
+    inline UChar Lexer::convertUnicode(int c1, int c2, int c3, int c4)
+    {
+        return (convertHex(c1, c2) << 8) | convertHex(c3, c4);
+    }
+
 } // namespace JSC
 
 #endif // Lexer_h
diff --git a/JavaScriptCore/parser/NodeConstructors.h b/JavaScriptCore/parser/NodeConstructors.h
new file mode 100644
index 0000000..ea1579b
--- /dev/null
+++ b/JavaScriptCore/parser/NodeConstructors.h
@@ -0,0 +1,911 @@
+/*
+ *  Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef NodeConstructors_h
+#define NodeConstructors_h
+
+#include "Nodes.h"
+#include "Lexer.h"
+#include "Parser.h"
+
+namespace JSC {
+
+    inline void* ParserArenaDeletable::operator new(size_t size, JSGlobalData* globalData)
+    {
+        ParserArenaDeletable* deletable = static_cast<ParserArenaDeletable*>(fastMalloc(size));
+        globalData->parser->arena().deleteWithArena(deletable);
+        return deletable;
+    }
+
+    inline void* ParserArenaDeletable::operator new(size_t size)
+    {
+        return fastMalloc(size);
+    }
+
+    inline ParserArenaRefCounted::ParserArenaRefCounted(JSGlobalData* globalData)
+    {
+        globalData->parser->arena().derefWithArena(adoptRef(this));
+    }
+
+    inline Node::Node(JSGlobalData* globalData)
+        : m_line(globalData->lexer->lineNumber())
+    {
+    }
+
+    inline ExpressionNode::ExpressionNode(JSGlobalData* globalData, ResultType resultType)
+        : Node(globalData)
+        , m_resultType(resultType)
+    {
+    }
+
+    inline StatementNode::StatementNode(JSGlobalData* globalData)
+        : Node(globalData)
+        , m_lastLine(-1)
+    {
+    }
+
+    inline NullNode::NullNode(JSGlobalData* globalData)
+        : ExpressionNode(globalData, ResultType::nullType())
+    {
+    }
+
+    inline BooleanNode::BooleanNode(JSGlobalData* globalData, bool value)
+        : ExpressionNode(globalData, ResultType::booleanType())
+        , m_value(value)
+    {
+    }
+
+    inline NumberNode::NumberNode(JSGlobalData* globalData, double v)
+        : ExpressionNode(globalData, ResultType::numberType())
+        , m_double(v)
+    {
+    }
+
+    inline StringNode::StringNode(JSGlobalData* globalData, const Identifier& v)
+        : ExpressionNode(globalData, ResultType::stringType())
+        , m_value(v)
+    {
+    }
+
+    inline RegExpNode::RegExpNode(JSGlobalData* globalData, const UString& pattern, const UString& flags)
+        : ExpressionNode(globalData)
+        , m_pattern(pattern)
+        , m_flags(flags)
+    {
+    }
+
+    inline ThisNode::ThisNode(JSGlobalData* globalData)
+        : ExpressionNode(globalData)
+    {
+    }
+
+    inline ResolveNode::ResolveNode(JSGlobalData* globalData, const Identifier& ident, int startOffset)
+        : ExpressionNode(globalData)
+        , m_ident(ident)
+        , m_startOffset(startOffset)
+    {
+    }
+
+    inline ElementNode::ElementNode(JSGlobalData*, int elision, ExpressionNode* node)
+        : m_next(0)
+        , m_elision(elision)
+        , m_node(node)
+    {
+    }
+
+    inline ElementNode::ElementNode(JSGlobalData*, ElementNode* l, int elision, ExpressionNode* node)
+        : m_next(0)
+        , m_elision(elision)
+        , m_node(node)
+    {
+        l->m_next = this;
+    }
+
+    inline ArrayNode::ArrayNode(JSGlobalData* globalData, int elision)
+        : ExpressionNode(globalData)
+        , m_element(0)
+        , m_elision(elision)
+        , m_optional(true)
+    {
+    }
+
+    inline ArrayNode::ArrayNode(JSGlobalData* globalData, ElementNode* element)
+        : ExpressionNode(globalData)
+        , m_element(element)
+        , m_elision(0)
+        , m_optional(false)
+    {
+    }
+
+    inline ArrayNode::ArrayNode(JSGlobalData* globalData, int elision, ElementNode* element)
+        : ExpressionNode(globalData)
+        , m_element(element)
+        , m_elision(elision)
+        , m_optional(true)
+    {
+    }
+
+    inline PropertyNode::PropertyNode(JSGlobalData*, const Identifier& name, ExpressionNode* assign, Type type)
+        : m_name(name)
+        , m_assign(assign)
+        , m_type(type)
+    {
+    }
+
+    inline PropertyListNode::PropertyListNode(JSGlobalData* globalData, PropertyNode* node)
+        : Node(globalData)
+        , m_node(node)
+        , m_next(0)
+    {
+    }
+
+    inline PropertyListNode::PropertyListNode(JSGlobalData* globalData, PropertyNode* node, PropertyListNode* list)
+        : Node(globalData)
+        , m_node(node)
+        , m_next(0)
+    {
+        list->m_next = this;
+    }
+
+    inline ObjectLiteralNode::ObjectLiteralNode(JSGlobalData* globalData)
+        : ExpressionNode(globalData)
+        , m_list(0)
+    {
+    }
+
+    inline ObjectLiteralNode::ObjectLiteralNode(JSGlobalData* globalData, PropertyListNode* list)
+        : ExpressionNode(globalData)
+        , m_list(list)
+    {
+    }
+
+    inline BracketAccessorNode::BracketAccessorNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments)
+        : ExpressionNode(globalData)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+    {
+    }
+
+    inline DotAccessorNode::DotAccessorNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident)
+        : ExpressionNode(globalData)
+        , m_base(base)
+        , m_ident(ident)
+    {
+    }
+
+    inline ArgumentListNode::ArgumentListNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : Node(globalData)
+        , m_next(0)
+        , m_expr(expr)
+    {
+    }
+
+    inline ArgumentListNode::ArgumentListNode(JSGlobalData* globalData, ArgumentListNode* listNode, ExpressionNode* expr)
+        : Node(globalData)
+        , m_next(0)
+        , m_expr(expr)
+    {
+        listNode->m_next = this;
+    }
+
+    inline ArgumentsNode::ArgumentsNode(JSGlobalData*)
+        : m_listNode(0)
+    {
+    }
+
+    inline ArgumentsNode::ArgumentsNode(JSGlobalData*, ArgumentListNode* listNode)
+        : m_listNode(listNode)
+    {
+    }
+
+    inline NewExprNode::NewExprNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+        , m_args(0)
+    {
+    }
+
+    inline NewExprNode::NewExprNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+        , m_args(args)
+    {
+    }
+
+    inline EvalFunctionCallNode::EvalFunctionCallNode(JSGlobalData* globalData, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallValueNode::FunctionCallValueNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_expr(expr)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallResolveNode::FunctionCallResolveNode(JSGlobalData* globalData, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallBracketNode::FunctionCallBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallDotNode::FunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_args(args)
+    {
+    }
+
+    inline CallFunctionCallDotNode::CallFunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : FunctionCallDotNode(globalData, base, ident, args, divot, startOffset, endOffset)
+    {
+    }
+
+    inline ApplyFunctionCallDotNode::ApplyFunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : FunctionCallDotNode(globalData, base, ident, args, divot, startOffset, endOffset)
+    {
+    }
+
+    inline PrePostResolveNode::PrePostResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData, ResultType::numberType()) // could be reusable for pre?
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+    {
+    }
+
+    inline PostfixResolveNode::PostfixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
+        , m_operator(oper)
+    {
+    }
+
+    inline PostfixBracketNode::PostfixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_operator(oper)
+    {
+    }
+
+    inline PostfixDotNode::PostfixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_operator(oper)
+    {
+    }
+
+    inline PostfixErrorNode::PostfixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_expr(expr)
+        , m_operator(oper)
+    {
+    }
+
+    inline DeleteResolveNode::DeleteResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+    {
+    }
+
+    inline DeleteBracketNode::DeleteBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+    {
+    }
+
+    inline DeleteDotNode::DeleteDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+    {
+    }
+
+    inline DeleteValueNode::DeleteValueNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline VoidNode::VoidNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline TypeOfResolveNode::TypeOfResolveNode(JSGlobalData* globalData, const Identifier& ident)
+        : ExpressionNode(globalData, ResultType::stringType())
+        , m_ident(ident)
+    {
+    }
+
+    inline TypeOfValueNode::TypeOfValueNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData, ResultType::stringType())
+        , m_expr(expr)
+    {
+    }
+
+    inline PrefixResolveNode::PrefixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
+        , m_operator(oper)
+    {
+    }
+
+    inline PrefixBracketNode::PrefixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_operator(oper)
+    {
+    }
+
+    inline PrefixDotNode::PrefixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_operator(oper)
+    {
+    }
+
+    inline PrefixErrorNode::PrefixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_expr(expr)
+        , m_operator(oper)
+    {
+    }
+
+    inline UnaryOpNode::UnaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr, OpcodeID opcodeID)
+        : ExpressionNode(globalData, type)
+        , m_expr(expr)
+        , m_opcodeID(opcodeID)
+    {
+    }
+
+    inline UnaryPlusNode::UnaryPlusNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::numberType(), expr, op_to_jsnumber)
+    {
+    }
+
+    inline NegateNode::NegateNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr, op_negate)
+    {
+    }
+
+    inline BitwiseNotNode::BitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::forBitOp(), expr, op_bitnot)
+    {
+    }
+
+    inline LogicalNotNode::LogicalNotNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::booleanType(), expr, op_not)
+    {
+    }
+
+    inline BinaryOpNode::BinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : ExpressionNode(globalData)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_opcodeID(opcodeID)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline BinaryOpNode::BinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : ExpressionNode(globalData, type)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_opcodeID(opcodeID)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline ReverseBinaryOpNode::ReverseBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline ReverseBinaryOpNode::ReverseBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, type, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline MultNode::MultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_mul, rightHasAssignments)
+    {
+    }
+
+    inline DivNode::DivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_div, rightHasAssignments)
+    {
+    }
+
+
+    inline ModNode::ModNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_mod, rightHasAssignments)
+    {
+    }
+
+    inline AddNode::AddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forAdd(expr1->resultDescriptor(), expr2->resultDescriptor()), expr1, expr2, op_add, rightHasAssignments)
+    {
+    }
+
+    inline SubNode::SubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_sub, rightHasAssignments)
+    {
+    }
+
+    inline LeftShiftNode::LeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_lshift, rightHasAssignments)
+    {
+    }
+
+    inline RightShiftNode::RightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_rshift, rightHasAssignments)
+    {
+    }
+
+    inline UnsignedRightShiftNode::UnsignedRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_urshift, rightHasAssignments)
+    {
+    }
+
+    inline LessNode::LessNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_less, rightHasAssignments)
+    {
+    }
+
+    inline GreaterNode::GreaterNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ReverseBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_less, rightHasAssignments)
+    {
+    }
+
+    inline LessEqNode::LessEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_lesseq, rightHasAssignments)
+    {
+    }
+
+    inline GreaterEqNode::GreaterEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ReverseBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_lesseq, rightHasAssignments)
+    {
+    }
+
+    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, type, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline InstanceOfNode::InstanceOfNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ThrowableBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_instanceof, rightHasAssignments)
+    {
+    }
+
+    inline InNode::InNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ThrowableBinaryOpNode(globalData, expr1, expr2, op_in, rightHasAssignments)
+    {
+    }
+
+    inline EqualNode::EqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_eq, rightHasAssignments)
+    {
+    }
+
+    inline NotEqualNode::NotEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_neq, rightHasAssignments)
+    {
+    }
+
+    inline StrictEqualNode::StrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_stricteq, rightHasAssignments)
+    {
+    }
+
+    inline NotStrictEqualNode::NotStrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_nstricteq, rightHasAssignments)
+    {
+    }
+
+    inline BitAndNode::BitAndNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_bitand, rightHasAssignments)
+    {
+    }
+
+    inline BitOrNode::BitOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_bitor, rightHasAssignments)
+    {
+    }
+
+    inline BitXOrNode::BitXOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_bitxor, rightHasAssignments)
+    {
+    }
+
+    inline LogicalOpNode::LogicalOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper)
+        : ExpressionNode(globalData, ResultType::booleanType())
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_operator(oper)
+    {
+    }
+
+    inline ConditionalNode::ConditionalNode(JSGlobalData* globalData, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2)
+        : ExpressionNode(globalData)
+        , m_logical(logical)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+    {
+    }
+
+    inline ReadModifyResolveNode::ReadModifyResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+        , m_right(right)
+        , m_operator(oper)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignResolveNode::AssignResolveNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments)
+        : ExpressionNode(globalData)
+        , m_ident(ident)
+        , m_right(right)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline ReadModifyBracketNode::ReadModifyBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_right(right)
+        , m_operator(oper)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignBracketNode::AssignBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_right(right)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignDotNode::AssignDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_right(right)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline ReadModifyDotNode::ReadModifyDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_right(right)
+        , m_operator(oper)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignErrorNode::AssignErrorNode(JSGlobalData* globalData, ExpressionNode* left, Operator oper, ExpressionNode* right, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_left(left)
+        , m_operator(oper)
+        , m_right(right)
+    {
+    }
+
+    inline CommaNode::CommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2)
+        : ExpressionNode(globalData)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+    {
+    }
+
+    inline ConstStatementNode::ConstStatementNode(JSGlobalData* globalData, ConstDeclNode* next)
+        : StatementNode(globalData)
+        , m_next(next)
+    {
+    }
+
+    inline SourceElements::SourceElements(JSGlobalData*)
+    {
+    }
+
+    inline EmptyStatementNode::EmptyStatementNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+
+    inline DebuggerStatementNode::DebuggerStatementNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+    
+    inline ExprStatementNode::ExprStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline VarStatementNode::VarStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_expr(expr)
+    {
+    }
+    
+    inline IfNode::IfNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock)
+        : StatementNode(globalData)
+        , m_condition(condition)
+        , m_ifBlock(ifBlock)
+    {
+    }
+
+    inline IfElseNode::IfElseNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock)
+        : IfNode(globalData, condition, ifBlock)
+        , m_elseBlock(elseBlock)
+    {
+    }
+
+    inline DoWhileNode::DoWhileNode(JSGlobalData* globalData, StatementNode* statement, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_statement(statement)
+        , m_expr(expr)
+    {
+    }
+
+    inline WhileNode::WhileNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement)
+        : StatementNode(globalData)
+        , m_expr(expr)
+        , m_statement(statement)
+    {
+    }
+
+    inline ForNode::ForNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, bool expr1WasVarDecl)
+        : StatementNode(globalData)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_expr3(expr3)
+        , m_statement(statement)
+        , m_expr1WasVarDecl(expr1 && expr1WasVarDecl)
+    {
+        ASSERT(statement);
+    }
+
+    inline ContinueNode::ContinueNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+
+    inline ContinueNode::ContinueNode(JSGlobalData* globalData, const Identifier& ident)
+        : StatementNode(globalData)
+        , m_ident(ident)
+    {
+    }
+    
+    inline BreakNode::BreakNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+
+    inline BreakNode::BreakNode(JSGlobalData* globalData, const Identifier& ident)
+        : StatementNode(globalData)
+        , m_ident(ident)
+    {
+    }
+    
+    inline ReturnNode::ReturnNode(JSGlobalData* globalData, ExpressionNode* value)
+        : StatementNode(globalData)
+        , m_value(value)
+    {
+    }
+
+    inline WithNode::WithNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement, uint32_t divot, uint32_t expressionLength)
+        : StatementNode(globalData)
+        , m_expr(expr)
+        , m_statement(statement)
+        , m_divot(divot)
+        , m_expressionLength(expressionLength)
+    {
+    }
+
+    inline LabelNode::LabelNode(JSGlobalData* globalData, const Identifier& name, StatementNode* statement)
+        : StatementNode(globalData)
+        , m_name(name)
+        , m_statement(statement)
+    {
+    }
+
+    inline ThrowNode::ThrowNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline TryNode::TryNode(JSGlobalData* globalData, StatementNode* tryBlock, const Identifier& exceptionIdent, bool catchHasEval, StatementNode* catchBlock, StatementNode* finallyBlock)
+        : StatementNode(globalData)
+        , m_tryBlock(tryBlock)
+        , m_exceptionIdent(exceptionIdent)
+        , m_catchBlock(catchBlock)
+        , m_finallyBlock(finallyBlock)
+        , m_catchHasEval(catchHasEval)
+    {
+    }
+
+    inline ParameterNode::ParameterNode(JSGlobalData*, const Identifier& ident)
+        : m_ident(ident)
+        , m_next(0)
+    {
+    }
+
+    inline ParameterNode::ParameterNode(JSGlobalData*, ParameterNode* l, const Identifier& ident)
+        : m_ident(ident)
+        , m_next(0)
+    {
+        l->m_next = this;
+    }
+
+    inline FuncExprNode::FuncExprNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
+        : ExpressionNode(globalData)
+        , ParserArenaRefCounted(globalData)
+        , m_ident(ident)
+        , m_body(body)
+    {
+        m_body->finishParsing(source, parameter);
+    }
+
+    inline FuncDeclNode::FuncDeclNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
+        : StatementNode(globalData)
+        , ParserArenaRefCounted(globalData)
+        , m_ident(ident)
+        , m_body(body)
+    {
+        m_body->finishParsing(source, parameter);
+    }
+
+    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr)
+        : m_expr(expr)
+    {
+    }
+
+    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr, SourceElements* children)
+        : m_expr(expr)
+    {
+        if (children)
+            children->releaseContentsIntoVector(m_children);
+    }
+
+    inline ClauseListNode::ClauseListNode(JSGlobalData*, CaseClauseNode* clause)
+        : m_clause(clause)
+        , m_next(0)
+    {
+    }
+
+    inline ClauseListNode::ClauseListNode(JSGlobalData*, ClauseListNode* clauseList, CaseClauseNode* clause)
+        : m_clause(clause)
+        , m_next(0)
+    {
+        clauseList->m_next = this;
+    }
+
+    inline CaseBlockNode::CaseBlockNode(JSGlobalData*, ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2)
+        : m_list1(list1)
+        , m_defaultClause(defaultClause)
+        , m_list2(list2)
+    {
+    }
+
+    inline SwitchNode::SwitchNode(JSGlobalData* globalData, ExpressionNode* expr, CaseBlockNode* block)
+        : StatementNode(globalData)
+        , m_expr(expr)
+        , m_block(block)
+    {
+    }
+
+    inline ConstDeclNode::ConstDeclNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* init)
+        : ExpressionNode(globalData)
+        , m_ident(ident)
+        , m_next(0)
+        , m_init(init)
+    {
+    }
+
+    inline BlockNode::BlockNode(JSGlobalData* globalData, SourceElements* children)
+        : StatementNode(globalData)
+    {
+        if (children)
+            children->releaseContentsIntoVector(m_children);
+    }
+
+    inline ForInNode::ForInNode(JSGlobalData* globalData, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
+        : StatementNode(globalData)
+        , m_init(0)
+        , m_lexpr(l)
+        , m_expr(expr)
+        , m_statement(statement)
+        , m_identIsVarDecl(false)
+    {
+    }
+
+    inline ForInNode::ForInNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* in, ExpressionNode* expr, StatementNode* statement, int divot, int startOffset, int endOffset)
+        : StatementNode(globalData)
+        , m_ident(ident)
+        , m_init(0)
+        , m_lexpr(new (globalData) ResolveNode(globalData, ident, divot - startOffset))
+        , m_expr(expr)
+        , m_statement(statement)
+        , m_identIsVarDecl(true)
+    {
+        if (in) {
+            AssignResolveNode* node = new (globalData) AssignResolveNode(globalData, ident, in, true);
+            node->setExceptionSourceCode(divot, divot - startOffset, endOffset - divot);
+            m_init = node;
+        }
+        // for( var foo = bar in baz )
+    }
+
+} // namespace JSC
+
+#endif // NodeConstructors_h
diff --git a/JavaScriptCore/parser/NodeInfo.h b/JavaScriptCore/parser/NodeInfo.h
index a518b23..7f4deff 100644
--- a/JavaScriptCore/parser/NodeInfo.h
+++ b/JavaScriptCore/parser/NodeInfo.h
@@ -43,8 +43,8 @@
     
     template <typename T> struct NodeDeclarationInfo {
         T m_node;
-        ParserRefCountedData<DeclarationStacks::VarStack>* m_varDeclarations;
-        ParserRefCountedData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
+        ParserArenaData<DeclarationStacks::VarStack>* m_varDeclarations;
+        ParserArenaData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
         CodeFeatures m_features;
         int m_numConstants;
     };
diff --git a/JavaScriptCore/parser/Nodes.cpp b/JavaScriptCore/parser/Nodes.cpp
index f7fa739..38e842a 100644
--- a/JavaScriptCore/parser/Nodes.cpp
+++ b/JavaScriptCore/parser/Nodes.cpp
@@ -25,24 +25,23 @@
 
 #include "config.h"
 #include "Nodes.h"
+#include "NodeConstructors.h"
 
 #include "BytecodeGenerator.h"
 #include "CallFrame.h"
+#include "Debugger.h"
+#include "JIT.h"
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSStaticScopeObject.h"
 #include "LabelScope.h"
+#include "Lexer.h"
+#include "Operations.h"
 #include "Parser.h"
 #include "PropertyNameArray.h"
 #include "RegExpObject.h"
 #include "SamplingTool.h"
-#include "Debugger.h"
-#include "Lexer.h"
-#include "Operations.h"
-#include <math.h>
 #include <wtf/Assertions.h>
-#include <wtf/HashCountedSet.h>
-#include <wtf/HashSet.h>
-#include <wtf/MathExtras.h>
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/Threading.h>
 
@@ -50,173 +49,7 @@
 
 namespace JSC {
 
-static void substitute(UString& string, const UString& substring) JSC_FAST_CALL;
-
-// ------------------------------ NodeReleaser --------------------------------
-
-class NodeReleaser : Noncopyable {
-public:
-    // Call this function inside the destructor of a class derived from Node.
-    // This will traverse the tree below this node, destroying all of those nodes,
-    // but without relying on recursion.
-    static void releaseAllNodes(ParserRefCounted* root);
-
-    // Call this on each node in a the releaseNodes virtual function.
-    // It gives the node to the NodeReleaser, which will then release the
-    // node later at the end of the releaseAllNodes process.
-    template <typename T> void release(RefPtr<T>& node) { if (node) adopt(node.release()); }
-    void release(RefPtr<FunctionBodyNode>& node) { if (node) adoptFunctionBodyNode(node); }
-
-private:
-    NodeReleaser() { }
-    ~NodeReleaser() { }
-
-    void adopt(PassRefPtr<ParserRefCounted>);
-    void adoptFunctionBodyNode(RefPtr<FunctionBodyNode>&);
-
-    typedef Vector<RefPtr<ParserRefCounted> > NodeReleaseVector;
-    OwnPtr<NodeReleaseVector> m_vector;
-};
-
-void NodeReleaser::releaseAllNodes(ParserRefCounted* root)
-{
-    ASSERT(root);
-    NodeReleaser releaser;
-    root->releaseNodes(releaser);
-    if (!releaser.m_vector)
-        return;
-    // Note: The call to release.m_vector->size() is intentionally inside
-    // the loop, since calls to releaseNodes are expected to increase the size.
-    for (size_t i = 0; i < releaser.m_vector->size(); ++i) {
-        ParserRefCounted* node = (*releaser.m_vector)[i].get();
-        if (node->hasOneRef())
-            node->releaseNodes(releaser);
-    }
-}
-
-void NodeReleaser::adopt(PassRefPtr<ParserRefCounted> node)
-{
-    ASSERT(node);
-    if (!node->hasOneRef())
-        return;
-    if (!m_vector)
-        m_vector.set(new NodeReleaseVector);
-    m_vector->append(node);
-}
-
-void NodeReleaser::adoptFunctionBodyNode(RefPtr<FunctionBodyNode>& functionBodyNode)
-{
-    // This sidesteps a problem where if you assign a PassRefPtr<FunctionBodyNode>
-    // to a PassRefPtr<Node> we leave the two reference counts (FunctionBodyNode
-    // and ParserRefCounted) unbalanced. It would be nice to fix this problem in
-    // a cleaner way -- perhaps we could remove the FunctionBodyNode reference
-    // count at some point.
-    RefPtr<Node> node = functionBodyNode;
-    functionBodyNode = 0;
-    adopt(node.release());
-}
-
-// ------------------------------ ParserRefCounted -----------------------------------------
-
-#ifndef NDEBUG
-static RefCountedLeakCounter parserRefCountedCounter("JSC::Node");
-#endif
-
-ParserRefCounted::ParserRefCounted(JSGlobalData* globalData)
-    : m_globalData(globalData)
-{
-#ifndef NDEBUG
-    parserRefCountedCounter.increment();
-#endif
-    if (!m_globalData->newParserObjects)
-        m_globalData->newParserObjects = new HashSet<ParserRefCounted*>;
-    m_globalData->newParserObjects->add(this);
-    ASSERT(m_globalData->newParserObjects->contains(this));
-}
-
-ParserRefCounted::~ParserRefCounted()
-{
-#ifndef NDEBUG
-    parserRefCountedCounter.decrement();
-#endif
-}
-
-void ParserRefCounted::releaseNodes(NodeReleaser&)
-{
-}
-
-void ParserRefCounted::ref()
-{
-    // bumping from 0 to 1 is just removing from the new nodes set
-    if (m_globalData->newParserObjects) {
-        HashSet<ParserRefCounted*>::iterator it = m_globalData->newParserObjects->find(this);
-        if (it != m_globalData->newParserObjects->end()) {
-            m_globalData->newParserObjects->remove(it);
-            ASSERT(!m_globalData->parserObjectExtraRefCounts || !m_globalData->parserObjectExtraRefCounts->contains(this));
-            return;
-        }
-    }
-
-    ASSERT(!m_globalData->newParserObjects || !m_globalData->newParserObjects->contains(this));
-
-    if (!m_globalData->parserObjectExtraRefCounts)
-        m_globalData->parserObjectExtraRefCounts = new HashCountedSet<ParserRefCounted*>;
-    m_globalData->parserObjectExtraRefCounts->add(this);
-}
-
-void ParserRefCounted::deref()
-{
-    ASSERT(!m_globalData->newParserObjects || !m_globalData->newParserObjects->contains(this));
-
-    if (!m_globalData->parserObjectExtraRefCounts) {
-        delete this;
-        return;
-    }
-
-    HashCountedSet<ParserRefCounted*>::iterator it = m_globalData->parserObjectExtraRefCounts->find(this);
-    if (it == m_globalData->parserObjectExtraRefCounts->end())
-        delete this;
-    else
-        m_globalData->parserObjectExtraRefCounts->remove(it);
-}
-
-bool ParserRefCounted::hasOneRef()
-{
-    if (m_globalData->newParserObjects && m_globalData->newParserObjects->contains(this)) {
-        ASSERT(!m_globalData->parserObjectExtraRefCounts || !m_globalData->parserObjectExtraRefCounts->contains(this));
-        return false;
-    }
-
-    ASSERT(!m_globalData->newParserObjects || !m_globalData->newParserObjects->contains(this));
-
-    if (!m_globalData->parserObjectExtraRefCounts)
-        return true;
-
-    return !m_globalData->parserObjectExtraRefCounts->contains(this);
-}
-
-void ParserRefCounted::deleteNewObjects(JSGlobalData* globalData)
-{
-    if (!globalData->newParserObjects)
-        return;
-
-#ifndef NDEBUG
-    HashSet<ParserRefCounted*>::iterator end = globalData->newParserObjects->end();
-    for (HashSet<ParserRefCounted*>::iterator it = globalData->newParserObjects->begin(); it != end; ++it)
-        ASSERT(!globalData->parserObjectExtraRefCounts || !globalData->parserObjectExtraRefCounts->contains(*it));
-#endif
-    deleteAllValues(*globalData->newParserObjects);
-    delete globalData->newParserObjects;
-    globalData->newParserObjects = 0;
-}
-
-// ------------------------------ Node --------------------------------
-
-Node::Node(JSGlobalData* globalData)
-    : ParserRefCounted(globalData)
-{
-    m_line = globalData->lexer->lineNo();
-}
+static void substitute(UString& string, const UString& substring);
 
 // ------------------------------ ThrowableExpressionData --------------------------------
 
@@ -247,14 +80,8 @@
     generator.emitThrow(exception);
     return exception;
 }
-    
-// ------------------------------ StatementNode --------------------------------
 
-StatementNode::StatementNode(JSGlobalData* globalData)
-    : Node(globalData)
-    , m_lastLine(-1)
-{
-}
+// ------------------------------ StatementNode --------------------------------
 
 void StatementNode::setLoc(int firstLine, int lastLine)
 {
@@ -264,11 +91,10 @@
 
 // ------------------------------ SourceElements --------------------------------
 
-void SourceElements::append(PassRefPtr<StatementNode> statement)
+void SourceElements::append(StatementNode* statement)
 {
     if (statement->isEmptyStatement())
         return;
-
     m_statements.append(statement);
 }
 
@@ -348,47 +174,24 @@
     return generator.emitResolve(generator.finalDestination(dst), m_ident);
 }
 
-// ------------------------------ ElementNode ------------------------------------
-
-ElementNode::~ElementNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ElementNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-    releaser.release(m_node);
-}
-
 // ------------------------------ ArrayNode ------------------------------------
 
-ArrayNode::~ArrayNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ArrayNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_element);
-}
-
 RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     // FIXME: Should we put all of this code into emitNewArray?
 
     unsigned length = 0;
     ElementNode* firstPutElement;
-    for (firstPutElement = m_element.get(); firstPutElement; firstPutElement = firstPutElement->next()) {
+    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
         if (firstPutElement->elision())
             break;
         ++length;
     }
 
     if (!firstPutElement && !m_elision)
-        return generator.emitNewArray(generator.finalDestination(dst), m_element.get());
+        return generator.emitNewArray(generator.finalDestination(dst), m_element);
 
-    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element.get());
+    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
 
     for (ElementNode* n = firstPutElement; n; n = n->next()) {
         RegisterID* value = generator.emitNode(n->value());
@@ -404,30 +207,35 @@
     return generator.moveToDestinationIfNeeded(dst, array.get());
 }
 
-// ------------------------------ PropertyNode ----------------------------
-
-PropertyNode::~PropertyNode()
+bool ArrayNode::isSimpleArray() const
 {
-    NodeReleaser::releaseAllNodes(this);
+    if (m_elision || m_optional)
+        return false;
+    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
+        if (ptr->elision())
+            return false;
+    }
+    return true;
 }
 
-void PropertyNode::releaseNodes(NodeReleaser& releaser)
+ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
 {
-    releaser.release(m_assign);
+    ASSERT(!m_elision && !m_optional);
+    ElementNode* ptr = m_element;
+    if (!ptr)
+        return 0;
+    ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
+    ArgumentListNode* tail = head;
+    ptr = ptr->next();
+    for (; ptr; ptr = ptr->next()) {
+        ASSERT(!ptr->elision());
+        tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
+    }
+    return head;
 }
 
 // ------------------------------ ObjectLiteralNode ----------------------------
 
-ObjectLiteralNode::~ObjectLiteralNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ObjectLiteralNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_list);
-}
-
 RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
      if (!m_list) {
@@ -435,30 +243,19 @@
              return 0;
          return generator.emitNewObject(generator.finalDestination(dst));
      }
-     return generator.emitNode(dst, m_list.get());
+     return generator.emitNode(dst, m_list);
 }
 
 // ------------------------------ PropertyListNode -----------------------------
 
-PropertyListNode::~PropertyListNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PropertyListNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_node);
-    releaser.release(m_next);
-}
-
 RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> newObj = generator.tempDestination(dst);
     
     generator.emitNewObject(newObj.get());
     
-    for (PropertyListNode* p = this; p; p = p->m_next.get()) {
-        RegisterID* value = generator.emitNode(p->m_node->m_assign.get());
+    for (PropertyListNode* p = this; p; p = p->m_next) {
+        RegisterID* value = generator.emitNode(p->m_node->m_assign);
         
         switch (p->m_node->m_type) {
             case PropertyNode::Constant: {
@@ -483,152 +280,66 @@
 
 // ------------------------------ BracketAccessorNode --------------------------------
 
-BracketAccessorNode::~BracketAccessorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void BracketAccessorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_subscriptHasAssignments, m_subscript->isPure(generator));
-    RegisterID* property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
+    RegisterID* property = generator.emitNode(m_subscript);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
 }
 
 // ------------------------------ DotAccessorNode --------------------------------
 
-DotAccessorNode::~DotAccessorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DotAccessorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RegisterID* base = generator.emitNode(m_base.get());
+    RegisterID* base = generator.emitNode(m_base);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
 }
 
 // ------------------------------ ArgumentListNode -----------------------------
 
-ArgumentListNode::~ArgumentListNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ArgumentListNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-    releaser.release(m_expr);
-}
-
 RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     ASSERT(m_expr);
-    return generator.emitNode(dst, m_expr.get());
-}
-
-// ------------------------------ ArgumentsNode -----------------------------
-
-ArgumentsNode::~ArgumentsNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ArgumentsNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_listNode);
+    return generator.emitNode(dst, m_expr);
 }
 
 // ------------------------------ NewExprNode ----------------------------------
 
-NewExprNode::~NewExprNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void NewExprNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_args);
-}
-
 RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> func = generator.emitNode(m_expr.get());
-    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args.get(), divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ EvalFunctionCallNode ----------------------------------
 
-EvalFunctionCallNode::~EvalFunctionCallNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void EvalFunctionCallNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_args);
-}
-
 RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> func = generator.tempDestination(dst);
     RefPtr<RegisterID> thisRegister = generator.newTemporary();
     generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
     generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
-    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallValueNode ----------------------------------
 
-FunctionCallValueNode::~FunctionCallValueNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FunctionCallValueNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_args);
-}
-
 RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> func = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
     RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallResolveNode ----------------------------------
 
-FunctionCallResolveNode::~FunctionCallResolveNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FunctionCallResolveNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_args);
-}
-
 RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
         RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
     }
 
     int index = 0;
@@ -637,7 +348,7 @@
     if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
         RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
         RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
     }
 
     RefPtr<RegisterID> func = generator.newTemporary();
@@ -645,53 +356,134 @@
     int identifierStart = divot() - startOffset();
     generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
     generator.emitResolveFunction(thisRegister.get(), func.get(), m_ident);
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallBracketNode ----------------------------------
 
-FunctionCallBracketNode::~FunctionCallBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FunctionCallBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-    releaser.release(m_args);
-}
-
 RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
-    RegisterID* property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RegisterID* property = generator.emitNode(m_subscript);
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
     RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallDotNode ----------------------------------
 
-FunctionCallDotNode::~FunctionCallDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FunctionCallDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_args);
-}
-
 RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    generator.emitMethodCheck();
     RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
     RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
+    {
+        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+        RefPtr<RegisterID> thisRegister = generator.newTemporary();
+        ArgumentListNode* oldList = m_args->m_listNode;
+        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            m_args->m_listNode = m_args->m_listNode->m_next;
+        } else
+            generator.emitLoad(thisRegister.get(), jsNull());
+
+        generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+        generator.emitJump(end.get());
+        m_args->m_listNode = oldList;
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
+}
+    
+static bool areTrivialApplyArguments(ArgumentsNode* args)
+{
+    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
+        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
+}
+
+RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // A few simple cases can be trivially handled as ordinary function calls.
+    // function.apply(), function.apply(arg) -> identical to function.call
+    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
+    bool mayBeCall = areTrivialApplyArguments(m_args);
+
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
+    {
+        if (mayBeCall) {
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            ArgumentListNode* oldList = m_args->m_listNode;
+            if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+                generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+                m_args->m_listNode = m_args->m_listNode->m_next;
+                if (m_args->m_listNode) {
+                    ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
+                    ASSERT(!m_args->m_listNode->m_next);
+                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
+                }
+            } else
+                generator.emitLoad(thisRegister.get(), jsNull());
+            generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+            m_args->m_listNode = oldList;
+        } else {
+            ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
+            RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            RefPtr<RegisterID> argsRegister = generator.newTemporary();
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            ArgumentListNode* args = m_args->m_listNode->m_next;
+            bool isArgumentsApply = false;
+            if (args->m_expr->isResolveNode()) {
+                ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
+                isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
+                if (isArgumentsApply)
+                    generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
+            }
+            if (!isArgumentsApply)
+                generator.emitNode(argsRegister.get(), args->m_expr);
+            while ((args = args->m_next))
+                generator.emitNode(args->m_expr);
+
+            generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
+            generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
+        }
+        generator.emitJump(end.get());
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
 }
 
 // ------------------------------ PostfixResolveNode ----------------------------------
@@ -752,21 +544,10 @@
 
 // ------------------------------ PostfixBracketNode ----------------------------------
 
-PostfixBracketNode::~PostfixBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PostfixBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
@@ -787,19 +568,9 @@
 
 // ------------------------------ PostfixDotNode ----------------------------------
 
-PostfixDotNode::~PostfixDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PostfixDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
@@ -820,16 +591,6 @@
 
 // ------------------------------ PostfixErrorNode -----------------------------------
 
-PostfixErrorNode::~PostfixErrorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PostfixErrorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus ? "Postfix ++ operator applied to value that is not a reference." : "Postfix -- operator applied to value that is not a reference.");
@@ -849,21 +610,10 @@
 
 // ------------------------------ DeleteBracketNode -----------------------------------
 
-DeleteBracketNode::~DeleteBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DeleteBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> r0 = generator.emitNode(m_base.get());
-    RegisterID* r1 = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
+    RegisterID* r1 = generator.emitNode(m_subscript);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
@@ -871,19 +621,9 @@
 
 // ------------------------------ DeleteDotNode -----------------------------------
 
-DeleteDotNode::~DeleteDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DeleteDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RegisterID* r0 = generator.emitNode(m_base.get());
+    RegisterID* r0 = generator.emitNode(m_base);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
@@ -891,19 +631,9 @@
 
 // ------------------------------ DeleteValueNode -----------------------------------
 
-DeleteValueNode::~DeleteValueNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DeleteValueNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitNode(generator.ignoredResult(), m_expr.get());
+    generator.emitNode(generator.ignoredResult(), m_expr);
 
     // delete on a non-location expression ignores the value and returns true
     return generator.emitUnexpectedLoad(generator.finalDestination(dst), true);
@@ -911,23 +641,13 @@
 
 // ------------------------------ VoidNode -------------------------------------
 
-VoidNode::~VoidNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void VoidNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr.get());
+        generator.emitNode(generator.ignoredResult(), m_expr);
         return 0;
     }
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
     return generator.emitLoad(dst, jsUndefined());
 }
 
@@ -950,23 +670,13 @@
 
 // ------------------------------ TypeOfValueNode -----------------------------------
 
-TypeOfValueNode::~TypeOfValueNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void TypeOfValueNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr.get());
+        generator.emitNode(generator.ignoredResult(), m_expr);
         return 0;
     }
-    RefPtr<RegisterID> src = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> src = generator.emitNode(m_expr);
     return generator.emitTypeOf(generator.finalDestination(dst), src.get());
 }
 
@@ -1006,21 +716,10 @@
 
 // ------------------------------ PrefixBracketNode ----------------------------------
 
-PrefixBracketNode::~PrefixBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PrefixBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
 
     generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
@@ -1036,19 +735,9 @@
 
 // ------------------------------ PrefixDotNode ----------------------------------
 
-PrefixDotNode::~PrefixDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PrefixDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
 
     generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
@@ -1064,16 +753,6 @@
 
 // ------------------------------ PrefixErrorNode -----------------------------------
 
-PrefixErrorNode::~PrefixErrorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PrefixErrorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus ? "Prefix ++ operator applied to value that is not a reference." : "Prefix -- operator applied to value that is not a reference.");
@@ -1081,48 +760,149 @@
 
 // ------------------------------ Unary Operation Nodes -----------------------------------
 
-UnaryOpNode::~UnaryOpNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void UnaryOpNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RegisterID* src = generator.emitNode(m_expr.get());
+    RegisterID* src = generator.emitNode(m_expr);
     return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
 }
 
 // ------------------------------ Binary Operation Nodes -----------------------------------
 
-BinaryOpNode::~BinaryOpNode()
+// BinaryOpNode::emitStrcat:
+//
+// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
+// more values, where we can determine a set of separate op_add operations would be operating on
+// string values.
+//
+// This function expects to be operating on a graph of AST nodes looking something like this:
+//
+//     (a)...     (b)
+//          \   /
+//           (+)     (c)
+//              \   /
+//      [d]     ((+))
+//         \    /
+//          [+=]
+//
+// The assignment operation is optional, if it exists the register holding the value on the
+// lefthand side of the assignment should be passing as the optional 'lhs' argument.
+//
+// The method should be called on the node at the root of the tree of regular binary add
+// operations (marked in the diagram with a double set of parentheses).  This node must
+// be performing a string concatenation (determined by statically detecting that at least
+// one child must be a string).  
+//
+// Since the minimum number of values being concatenated together is expected to be 3, if
+// a lhs to a concatenating assignment is not provided then the  root add should have at
+// least one left child that is also an add that can be determined to be operating on strings.
+//
+RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
 {
-    NodeReleaser::releaseAllNodes(this);
-}
+    ASSERT(isAdd());
+    ASSERT(resultDescriptor().definitelyIsString());
 
-void BinaryOpNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
+    // Create a list of expressions for all the adds in the tree of nodes we can convert into
+    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
+    // added first, and the leftmost child is never added, so the vector produced for the
+    // example above will be [ c, b ].
+    Vector<ExpressionNode*, 16> reverseExpressionList;
+    reverseExpressionList.append(m_expr2);
+
+    // Examine the left child of the add.  So long as this is a string add, add its right-child
+    // to the list, and keep processing along the left fork.
+    ExpressionNode* leftMostAddChild = m_expr1;
+    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
+        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
+        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
+    }
+
+    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
+
+    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
+    // We could possibly avoid this (the lhs is converted last anyway, we could let the
+    // op_strcat node handle its conversion if required).
+    if (lhs)
+        temporaryRegisters.append(generator.newTemporary());
+
+    // Emit code for the leftmost node ((a) in the example).
+    temporaryRegisters.append(generator.newTemporary());
+    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
+    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
+
+    // Note on ordering of conversions:
+    //
+    // We maintain the same ordering of conversions as we would see if the concatenations
+    // was performed as a sequence of adds (otherwise this optimization could change
+    // behaviour should an object have been provided a valueOf or toString method).
+    //
+    // Considering the above example, the sequnce of execution is:
+    //     * evaluate operand (a)
+    //     * evaluate operand (b)
+    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
+    //     * convert (b) to primitive   <-  (ditto)
+    //     * evaluate operand (c)
+    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
+    // And optionally, if there is an assignment:
+    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
+    //
+    // As such we do not plant an op to convert the leftmost child now.  Instead, use
+    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
+    // once the second node has been generated.  However, if the leftmost child is an
+    // immediate we can trivially determine that no conversion will be required.
+    // If this is the case
+    if (leftMostAddChild->isString())
+        leftMostAddChildTempRegister = 0;
+
+    while (reverseExpressionList.size()) {
+        ExpressionNode* node = reverseExpressionList.last();
+        reverseExpressionList.removeLast();
+
+        // Emit the code for the current node.
+        temporaryRegisters.append(generator.newTemporary());
+        generator.emitNode(temporaryRegisters.last().get(), node);
+
+        // On the first iteration of this loop, when we first reach this point we have just
+        // generated the second node, which means it is time to convert the leftmost operand.
+        if (leftMostAddChildTempRegister) {
+            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
+            leftMostAddChildTempRegister = 0; // Only do this once.
+        }
+        // Plant a conversion for this node, if necessary.
+        if (!node->isString())
+            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
+    }
+    ASSERT(temporaryRegisters.size() >= 3);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
+    // If there is an assignment convert the lhs now.  This will also copy lhs to
+    // the temporary register we allocated for it.
+    if (lhs)
+        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
+
+    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
 }
 
 RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     OpcodeID opcodeID = this->opcodeID();
+
+    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
+        return emitStrcat(generator, dst);
+
     if (opcodeID == op_neq) {
         if (m_expr1->isNull() || m_expr2->isNull()) {
             RefPtr<RegisterID> src = generator.tempDestination(dst);
-            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2.get() : m_expr1.get());
+            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
             return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
         }
     }
 
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
 }
 
@@ -1130,41 +910,41 @@
 {
     if (m_expr1->isNull() || m_expr2->isNull()) {
         RefPtr<RegisterID> src = generator.tempDestination(dst);
-        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2.get() : m_expr1.get());
+        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
         return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
     }
 
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
 }
 
 RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
 }
 
 RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
 }
 
 RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
 }
 
 RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitGetByIdExceptionInfo(op_instanceof);
@@ -1176,28 +956,17 @@
 
 // ------------------------------ LogicalOpNode ----------------------------
 
-LogicalOpNode::~LogicalOpNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void LogicalOpNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-}
-
 RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> temp = generator.tempDestination(dst);
     RefPtr<Label> target = generator.newLabel();
     
-    generator.emitNode(temp.get(), m_expr1.get());
+    generator.emitNode(temp.get(), m_expr1);
     if (m_operator == OpLogicalAnd)
         generator.emitJumpIfFalse(temp.get(), target.get());
     else
         generator.emitJumpIfTrue(temp.get(), target.get());
-    generator.emitNode(temp.get(), m_expr2.get());
+    generator.emitNode(temp.get(), m_expr2);
     generator.emitLabel(target.get());
 
     return generator.moveToDestinationIfNeeded(dst, temp.get());
@@ -1205,32 +974,20 @@
 
 // ------------------------------ ConditionalNode ------------------------------
 
-ConditionalNode::~ConditionalNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ConditionalNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_logical);
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-}
-
 RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> newDst = generator.finalDestination(dst);
     RefPtr<Label> beforeElse = generator.newLabel();
     RefPtr<Label> afterElse = generator.newLabel();
 
-    RegisterID* cond = generator.emitNode(m_logical.get());
+    RegisterID* cond = generator.emitNode(m_logical);
     generator.emitJumpIfFalse(cond, beforeElse.get());
 
-    generator.emitNode(newDst.get(), m_expr1.get());
+    generator.emitNode(newDst.get(), m_expr1);
     generator.emitJump(afterElse.get());
 
     generator.emitLabel(beforeElse.get());
-    generator.emitNode(newDst.get(), m_expr2.get());
+    generator.emitNode(newDst.get(), m_expr2);
 
     generator.emitLabel(afterElse.get());
 
@@ -1239,18 +996,8 @@
 
 // ------------------------------ ReadModifyResolveNode -----------------------------------
 
-ReadModifyResolveNode::~ReadModifyResolveNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReadModifyResolveNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_right);
-}
-
 // FIXME: should this be moved to be a method on BytecodeGenerator?
-static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, RegisterID* src2, Operator oper, OperandTypes types)
+static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
 {
     OpcodeID opcodeID;
     switch (oper) {
@@ -1261,6 +1008,8 @@
             opcodeID = op_div;
             break;
         case OpPlusEq:
+            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
+                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
             opcodeID = op_add;
             break;
         case OpMinusEq:
@@ -1291,7 +1040,14 @@
             ASSERT_NOT_REACHED();
             return dst;
     }
-    
+
+    RegisterID* src2 = generator.emitNode(m_right);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
     return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
 }
 
@@ -1299,21 +1055,18 @@
 {
     if (RegisterID* local = generator.registerFor(m_ident)) {
         if (generator.isLocalConstant(m_ident)) {
-            RegisterID* src2 = generator.emitNode(m_right.get());
-            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, src2, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
         }
         
         if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
             RefPtr<RegisterID> result = generator.newTemporary();
             generator.emitMove(result.get(), local);
-            RegisterID* src2 = generator.emitNode(m_right.get());
-            emitReadModifyAssignment(generator, result.get(), result.get(), src2, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
             generator.emitMove(local, result.get());
             return generator.moveToDestinationIfNeeded(dst, result.get());
         }
         
-        RegisterID* src2 = generator.emitNode(m_right.get());
-        RegisterID* result = emitReadModifyAssignment(generator, local, local, src2, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
         return generator.moveToDestinationIfNeeded(dst, result);
     }
 
@@ -1322,8 +1075,7 @@
     JSObject* globalObject = 0;
     if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
         RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
-        RegisterID* src2 = generator.emitNode(m_right.get());
-        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), src2, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
         generator.emitPutScopedVar(depth, index, result, globalObject);
         return result;
     }
@@ -1331,31 +1083,19 @@
     RefPtr<RegisterID> src1 = generator.tempDestination(dst);
     generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
     RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
-    RegisterID* src2 = generator.emitNode(m_right.get());
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), src2, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
     return generator.emitPutById(base.get(), m_ident, result);
 }
 
 // ------------------------------ AssignResolveNode -----------------------------------
 
-AssignResolveNode::~AssignResolveNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignResolveNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_right);
-}
-
 RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (RegisterID* local = generator.registerFor(m_ident)) {
         if (generator.isLocalConstant(m_ident))
-            return generator.emitNode(dst, m_right.get());
+            return generator.emitNode(dst, m_right);
         
-        RegisterID* result = generator.emitNode(local, m_right.get());
+        RegisterID* result = generator.emitNode(local, m_right);
         return generator.moveToDestinationIfNeeded(dst, result);
     }
 
@@ -1365,7 +1105,7 @@
     if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
         if (dst == generator.ignoredResult())
             dst = 0;
-        RegisterID* value = generator.emitNode(dst, m_right.get());
+        RegisterID* value = generator.emitNode(dst, m_right);
         generator.emitPutScopedVar(depth, index, value, globalObject);
         return value;
     }
@@ -1373,29 +1113,18 @@
     RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
     if (dst == generator.ignoredResult())
         dst = 0;
-    RegisterID* value = generator.emitNode(dst, m_right.get());
+    RegisterID* value = generator.emitNode(dst, m_right);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitPutById(base.get(), m_ident, value);
 }
 
 // ------------------------------ AssignDotNode -----------------------------------
 
-AssignDotNode::~AssignDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_right);
-}
-
 RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
     RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right.get());
+    RegisterID* result = generator.emitNode(value.get(), m_right);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitPutById(base.get(), m_ident, result);
     return generator.moveToDestinationIfNeeded(dst, result);
@@ -1403,25 +1132,13 @@
 
 // ------------------------------ ReadModifyDotNode -----------------------------------
 
-ReadModifyDotNode::~ReadModifyDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReadModifyDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_right);
-}
-
 RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RegisterID* change = generator.emitNode(m_right.get());
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), change, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitPutById(base.get(), m_ident, updatedValue);
@@ -1429,17 +1146,6 @@
 
 // ------------------------------ AssignErrorNode -----------------------------------
 
-AssignErrorNode::~AssignErrorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignErrorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_left);
-    releaser.release(m_right);
-}
-
 RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
@@ -1447,24 +1153,12 @@
 
 // ------------------------------ AssignBracketNode -----------------------------------
 
-AssignBracketNode::~AssignBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-    releaser.release(m_right);
-}
-
 RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
     RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right.get());
+    RegisterID* result = generator.emitNode(value.get(), m_right);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitPutByVal(base.get(), property.get(), result);
@@ -1473,27 +1167,14 @@
 
 // ------------------------------ ReadModifyBracketNode -----------------------------------
 
-ReadModifyBracketNode::~ReadModifyBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReadModifyBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-    releaser.release(m_right);
-}
-
 RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
-    RegisterID* change = generator.emitNode(m_right.get());
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), change, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitPutByVal(base.get(), property.get(), updatedValue);
@@ -1503,63 +1184,34 @@
 
 // ------------------------------ CommaNode ------------------------------------
 
-CommaNode::~CommaNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void CommaNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-}
-
 RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitNode(generator.ignoredResult(), m_expr1.get());
-    return generator.emitNode(dst, m_expr2.get());
+    generator.emitNode(generator.ignoredResult(), m_expr1);
+    return generator.emitNode(dst, m_expr2);
 }
 
 // ------------------------------ ConstDeclNode ------------------------------------
 
-ConstDeclNode::~ConstDeclNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ConstDeclNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-    releaser.release(m_init);
-}
-
-ConstDeclNode::ConstDeclNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* init)
-    : ExpressionNode(globalData)
-    , m_ident(ident)
-    , m_init(init)
-{
-}
-
 RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
 {
     if (RegisterID* local = generator.constRegisterFor(m_ident)) {
         if (!m_init)
             return local;
 
-        return generator.emitNode(local, m_init.get());
+        return generator.emitNode(local, m_init);
     }
     
     // FIXME: While this code should only be hit in eval code, it will potentially
     // assign to the wrong base if m_ident exists in an intervening dynamic scope.
     RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    RegisterID* value = m_init ? generator.emitNode(m_init.get()) : generator.emitLoad(0, jsUndefined());
+    RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
     return generator.emitPutById(base.get(), m_ident, value);
 }
 
 RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     RegisterID* result = 0;
-    for (ConstDeclNode* n = this; n; n = n->m_next.get())
+    for (ConstDeclNode* n = this; n; n = n->m_next)
         result = n->emitCodeSingle(generator);
 
     return result;
@@ -1567,58 +1219,27 @@
 
 // ------------------------------ ConstStatementNode -----------------------------
 
-ConstStatementNode::~ConstStatementNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ConstStatementNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-}
-
 RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return generator.emitNode(m_next.get());
+    return generator.emitNode(m_next);
 }
 
 // ------------------------------ Helper functions for handling Vectors of StatementNode -------------------------------
 
-static inline RegisterID* statementListEmitCode(const StatementVector& statements, BytecodeGenerator& generator, RegisterID* dst)
+static inline void statementListEmitCode(const StatementVector& statements, BytecodeGenerator& generator, RegisterID* dst)
 {
-    StatementVector::const_iterator end = statements.end();
-    for (StatementVector::const_iterator it = statements.begin(); it != end; ++it) {
-        StatementNode* n = it->get();
-        generator.emitNode(dst, n);
-    }
-    return 0;
+    size_t size = statements.size();
+    for (size_t i = 0; i < size; ++i)
+        generator.emitNode(dst, statements[i]);
 }
 
 // ------------------------------ BlockNode ------------------------------------
 
-BlockNode::~BlockNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void BlockNode::releaseNodes(NodeReleaser& releaser)
-{
-    size_t size = m_children.size();
-    for (size_t i = 0; i < size; ++i)
-        releaser.release(m_children[i]);
-}
-
-BlockNode::BlockNode(JSGlobalData* globalData, SourceElements* children)
-    : StatementNode(globalData)
-{
-    if (children)
-        children->releaseContentsIntoVector(m_children);
-}
-
 RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    return statementListEmitCode(m_children, generator, dst);
+    statementListEmitCode(m_children, generator, dst);
+    return 0;
 }
 
 // ------------------------------ EmptyStatementNode ---------------------------
@@ -1643,51 +1264,30 @@
 {
     ASSERT(m_expr);
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
-    return generator.emitNode(dst, m_expr.get());
+    return generator.emitNode(dst, m_expr);
 }
 
 // ------------------------------ VarStatementNode ----------------------------
 
-VarStatementNode::~VarStatementNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void VarStatementNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     ASSERT(m_expr);
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return generator.emitNode(m_expr.get());
+    return generator.emitNode(m_expr);
 }
 
 // ------------------------------ IfNode ---------------------------------------
 
-IfNode::~IfNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void IfNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_condition);
-    releaser.release(m_ifBlock);
-}
-
 RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     
     RefPtr<Label> afterThen = generator.newLabel();
 
-    RegisterID* cond = generator.emitNode(m_condition.get());
+    RegisterID* cond = generator.emitNode(m_condition);
     generator.emitJumpIfFalse(cond, afterThen.get());
 
-    generator.emitNode(dst, m_ifBlock.get());
+    generator.emitNode(dst, m_ifBlock);
     generator.emitLabel(afterThen.get());
 
     // FIXME: This should return the last statement executed so that it can be returned as a Completion.
@@ -1696,17 +1296,6 @@
 
 // ------------------------------ IfElseNode ---------------------------------------
 
-IfElseNode::~IfElseNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void IfElseNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_elseBlock);
-    IfNode::releaseNodes(releaser);
-}
-
 RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
@@ -1714,15 +1303,15 @@
     RefPtr<Label> beforeElse = generator.newLabel();
     RefPtr<Label> afterElse = generator.newLabel();
 
-    RegisterID* cond = generator.emitNode(m_condition.get());
+    RegisterID* cond = generator.emitNode(m_condition);
     generator.emitJumpIfFalse(cond, beforeElse.get());
 
-    generator.emitNode(dst, m_ifBlock.get());
+    generator.emitNode(dst, m_ifBlock);
     generator.emitJump(afterElse.get());
 
     generator.emitLabel(beforeElse.get());
 
-    generator.emitNode(dst, m_elseBlock.get());
+    generator.emitNode(dst, m_elseBlock);
 
     generator.emitLabel(afterElse.get());
 
@@ -1732,17 +1321,6 @@
 
 // ------------------------------ DoWhileNode ----------------------------------
 
-DoWhileNode::~DoWhileNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DoWhileNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_statement);
-    releaser.release(m_expr);
-}
-
 RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
@@ -1752,11 +1330,11 @@
 
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
    
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement.get());
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
     generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr.get());
+    RegisterID* cond = generator.emitNode(m_expr);
     generator.emitJumpIfTrue(cond, topOfLoop.get());
 
     generator.emitLabel(scope->breakTarget());
@@ -1765,17 +1343,6 @@
 
 // ------------------------------ WhileNode ------------------------------------
 
-WhileNode::~WhileNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void WhileNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_statement);
-}
-
 RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
@@ -1785,11 +1352,11 @@
     RefPtr<Label> topOfLoop = generator.newLabel();
     generator.emitLabel(topOfLoop.get());
     
-    generator.emitNode(dst, m_statement.get());
+    generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
     generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr.get());
+    RegisterID* cond = generator.emitNode(m_expr);
     generator.emitJumpIfTrue(cond, topOfLoop.get());
 
     generator.emitLabel(scope->breakTarget());
@@ -1800,19 +1367,6 @@
 
 // ------------------------------ ForNode --------------------------------------
 
-ForNode::~ForNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ForNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-    releaser.release(m_expr3);
-    releaser.release(m_statement);
-}
-
 RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (dst == generator.ignoredResult())
@@ -1823,7 +1377,7 @@
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (m_expr1)
-        generator.emitNode(generator.ignoredResult(), m_expr1.get());
+        generator.emitNode(generator.ignoredResult(), m_expr1);
 
     RefPtr<Label> condition = generator.newLabel();
     generator.emitJump(condition.get());
@@ -1831,16 +1385,16 @@
     RefPtr<Label> topOfLoop = generator.newLabel();
     generator.emitLabel(topOfLoop.get());
 
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement.get());
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     if (m_expr3)
-        generator.emitNode(generator.ignoredResult(), m_expr3.get());
+        generator.emitNode(generator.ignoredResult(), m_expr3);
 
     generator.emitLabel(condition.get());
     if (m_expr2) {
-        RegisterID* cond = generator.emitNode(m_expr2.get());
+        RegisterID* cond = generator.emitNode(m_expr2);
         generator.emitJumpIfTrue(cond, topOfLoop.get());
     } else
         generator.emitJump(topOfLoop.get());
@@ -1851,45 +1405,6 @@
 
 // ------------------------------ ForInNode ------------------------------------
 
-ForInNode::~ForInNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ForInNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_init);
-    releaser.release(m_lexpr);
-    releaser.release(m_expr);
-    releaser.release(m_statement);
-}
-
-ForInNode::ForInNode(JSGlobalData* globalData, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
-    : StatementNode(globalData)
-    , m_init(0L)
-    , m_lexpr(l)
-    , m_expr(expr)
-    , m_statement(statement)
-    , m_identIsVarDecl(false)
-{
-}
-
-ForInNode::ForInNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* in, ExpressionNode* expr, StatementNode* statement, int divot, int startOffset, int endOffset)
-    : StatementNode(globalData)
-    , m_ident(ident)
-    , m_lexpr(new ResolveNode(globalData, ident, divot - startOffset))
-    , m_expr(expr)
-    , m_statement(statement)
-    , m_identIsVarDecl(true)
-{
-    if (in) {
-        AssignResolveNode* node = new AssignResolveNode(globalData, ident, in, true);
-        node->setExceptionSourceCode(divot, divot - startOffset, endOffset - divot);
-        m_init = node;
-    }
-    // for( var foo = bar in baz )
-}
-
 RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
@@ -1902,8 +1417,8 @@
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (m_init)
-        generator.emitNode(generator.ignoredResult(), m_init.get());
-    RegisterID* forInBase = generator.emitNode(m_expr.get());
+        generator.emitNode(generator.ignoredResult(), m_init);
+    RegisterID* forInBase = generator.emitNode(m_expr);
     RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), forInBase);
     generator.emitJump(scope->continueTarget());
 
@@ -1912,7 +1427,7 @@
 
     RegisterID* propertyName;
     if (m_lexpr->isResolveNode()) {
-        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr.get())->identifier();
+        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
         propertyName = generator.registerFor(ident);
         if (!propertyName) {
             propertyName = generator.newTemporary();
@@ -1923,7 +1438,7 @@
             generator.emitPutById(base, ident, propertyName);
         }
     } else if (m_lexpr->isDotAccessorNode()) {
-        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr.get());
+        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
         const Identifier& ident = assignNode->identifier();
         propertyName = generator.newTemporary();
         RefPtr<RegisterID> protect = propertyName;
@@ -1933,7 +1448,7 @@
         generator.emitPutById(base, ident, propertyName);
     } else {
         ASSERT(m_lexpr->isBracketAccessorNode());
-        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr.get());
+        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
         propertyName = generator.newTemporary();
         RefPtr<RegisterID> protect = propertyName;
         RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
@@ -1943,7 +1458,7 @@
         generator.emitPutByVal(base.get(), subscript, propertyName);
     }   
 
-    generator.emitNode(dst, m_statement.get());
+    generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
     generator.emitNextPropertyName(propertyName, iter.get(), loopStart.get());
@@ -1990,16 +1505,6 @@
 
 // ------------------------------ ReturnNode -----------------------------------
 
-ReturnNode::~ReturnNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReturnNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_value);
-}
-
 RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
@@ -2008,7 +1513,7 @@
 
     if (dst == generator.ignoredResult())
         dst = 0;
-    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value.get()) : generator.emitLoad(dst, jsUndefined());
+    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
     RefPtr<RegisterID> returnRegister;
     if (generator.scopeDepth()) {
         RefPtr<Label> l0 = generator.newLabel();
@@ -2025,69 +1530,21 @@
 
 // ------------------------------ WithNode -------------------------------------
 
-WithNode::~WithNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void WithNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_statement);
-}
-
 RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     
     RefPtr<RegisterID> scope = generator.newTemporary();
-    generator.emitNode(scope.get(), m_expr.get()); // scope must be protected until popped
+    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
     generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
     generator.emitPushScope(scope.get());
-    RegisterID* result = generator.emitNode(dst, m_statement.get());
+    RegisterID* result = generator.emitNode(dst, m_statement);
     generator.emitPopScope();
     return result;
 }
 
-// ------------------------------ CaseClauseNode --------------------------------
-
-CaseClauseNode::~CaseClauseNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void CaseClauseNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
-// ------------------------------ ClauseListNode --------------------------------
-
-ClauseListNode::~ClauseListNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ClauseListNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_clause);
-    releaser.release(m_next);
-}
-
 // ------------------------------ CaseBlockNode --------------------------------
 
-CaseBlockNode::~CaseBlockNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void CaseBlockNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_list1);
-    releaser.release(m_defaultClause);
-    releaser.release(m_list2);
-}
-
 enum SwitchKind { 
     SwitchUnset = 0,
     SwitchNumber = 1, 
@@ -2102,7 +1559,7 @@
         literalVector.append(clauseExpression);
         if (clauseExpression->isNumber()) {
             double value = static_cast<NumberNode*>(clauseExpression)->value();
-            JSValuePtr jsValue = JSValuePtr::makeInt32Fast(static_cast<int32_t>(value));
+            JSValue jsValue = JSValue::makeInt32Fast(static_cast<int32_t>(value));
             if ((typeForTable & ~SwitchNumber) || !jsValue || (jsValue.getInt32Fast() != value)) {
                 typeForTable = SwitchNeither;
                 break;
@@ -2142,8 +1599,8 @@
     SwitchKind typeForTable = SwitchUnset;
     bool singleCharacterSwitch = true;
     
-    processClauseList(m_list1.get(), literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
-    processClauseList(m_list2.get(), literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
     
     if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
         return SwitchInfo::SwitchNone;
@@ -2183,7 +1640,7 @@
         generator.beginSwitch(switchExpression, switchType);
     } else {
         // Setup jumps
-        for (ClauseListNode* list = m_list1.get(); list; list = list->getNext()) {
+        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
             RefPtr<RegisterID> clauseVal = generator.newTemporary();
             generator.emitNode(clauseVal.get(), list->getClause()->expr());
             generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
@@ -2191,7 +1648,7 @@
             generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
         }
         
-        for (ClauseListNode* list = m_list2.get(); list; list = list->getNext()) {
+        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
             RefPtr<RegisterID> clauseVal = generator.newTemporary();
             generator.emitNode(clauseVal.get(), list->getClause()->expr());
             generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
@@ -2205,19 +1662,19 @@
     RegisterID* result = 0;
 
     size_t i = 0;
-    for (ClauseListNode* list = m_list1.get(); list; list = list->getNext()) {
+    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
         generator.emitLabel(labelVector[i++].get());
-        result = statementListEmitCode(list->getClause()->children(), generator, dst);
+        statementListEmitCode(list->getClause()->children(), generator, dst);
     }
 
     if (m_defaultClause) {
         generator.emitLabel(defaultLabel.get());
-        result = statementListEmitCode(m_defaultClause->children(), generator, dst);
+        statementListEmitCode(m_defaultClause->children(), generator, dst);
     }
 
-    for (ClauseListNode* list = m_list2.get(); list; list = list->getNext()) {
+    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
         generator.emitLabel(labelVector[i++].get());
-        result = statementListEmitCode(list->getClause()->children(), generator, dst);
+        statementListEmitCode(list->getClause()->children(), generator, dst);
     }
     if (!m_defaultClause)
         generator.emitLabel(defaultLabel.get());
@@ -2232,24 +1689,13 @@
 
 // ------------------------------ SwitchNode -----------------------------------
 
-SwitchNode::~SwitchNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void SwitchNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_block);
-}
-
 RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
 
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
     RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
 
     generator.emitLabel(scope->breakTarget());
@@ -2258,16 +1704,6 @@
 
 // ------------------------------ LabelNode ------------------------------------
 
-LabelNode::~LabelNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void LabelNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_statement);
-}
-
 RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
@@ -2276,7 +1712,7 @@
         return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
 
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
-    RegisterID* r0 = generator.emitNode(dst, m_statement.get());
+    RegisterID* r0 = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->breakTarget());
     return r0;
@@ -2284,23 +1720,13 @@
 
 // ------------------------------ ThrowNode ------------------------------------
 
-ThrowNode::~ThrowNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ThrowNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (dst == generator.ignoredResult())
         dst = 0;
-    RefPtr<RegisterID> expr = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitThrow(expr.get());
     return 0;
@@ -2308,18 +1734,6 @@
 
 // ------------------------------ TryNode --------------------------------------
 
-TryNode::~TryNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void TryNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_tryBlock);
-    releaser.release(m_catchBlock);
-    releaser.release(m_finallyBlock);
-}
-
 RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
@@ -2334,7 +1748,7 @@
         generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
     }
     generator.emitLabel(tryStartLabel.get());
-    generator.emitNode(dst, m_tryBlock.get());
+    generator.emitNode(dst, m_tryBlock);
     generator.emitLabel(tryEndLabel.get());
 
     if (m_catchBlock) {
@@ -2348,7 +1762,7 @@
             generator.emitPushScope(exceptionRegister.get());
         } else
             generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
-        generator.emitNode(dst, m_catchBlock.get());
+        generator.emitNode(dst, m_catchBlock);
         generator.emitPopScope();
         generator.emitLabel(handlerEndLabel.get());
     }
@@ -2377,7 +1791,7 @@
 
         // emit the finally block itself
         generator.emitLabel(finallyStart.get());
-        generator.emitNode(dst, m_finallyBlock.get());
+        generator.emitNode(dst, m_finallyBlock);
         generator.emitSubroutineReturn(finallyReturnAddr.get());
 
         generator.emitLabel(finallyEndLabel.get());
@@ -2386,27 +1800,16 @@
     return dst;
 }
 
-// ------------------------------ ParameterNode -----------------------------
-
-ParameterNode::~ParameterNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ParameterNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-}
-
 // -----------------------------ScopeNodeData ---------------------------
 
-ScopeNodeData::ScopeNodeData(SourceElements* children, VarStack* varStack, FunctionStack* funcStack, int numConstants)
+ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, int numConstants)
     : m_numConstants(numConstants)
 {
+    m_arena.swap(arena);
     if (varStack)
-        m_varStack = *varStack;
+        m_varStack.swap(*varStack);
     if (funcStack)
-        m_functionStack = *funcStack;
+        m_functionStack.swap(*funcStack);
     if (children)
         children->releaseContentsIntoVector(m_children);
 }
@@ -2426,48 +1829,44 @@
 
 ScopeNode::ScopeNode(JSGlobalData* globalData)
     : StatementNode(globalData)
+    , ParserArenaRefCounted(globalData)
     , m_features(NoFeatures)
 {
-#if ENABLE(OPCODE_SAMPLING)
-    globalData->interpreter->sampler()->notifyOfScope(this);
+#if ENABLE(CODEBLOCK_SAMPLING)
+    if (SamplingTool* sampler = globalData->interpreter->sampler())
+        sampler->notifyOfScope(this);
 #endif
 }
 
 ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, CodeFeatures features, int numConstants)
     : StatementNode(globalData)
-    , m_data(new ScopeNodeData(children, varStack, funcStack, numConstants))
+    , ParserArenaRefCounted(globalData)
+    , m_data(new ScopeNodeData(globalData->parser->arena(), children, varStack, funcStack, numConstants))
     , m_features(features)
     , m_source(source)
 {
-#if ENABLE(OPCODE_SAMPLING)
-    globalData->interpreter->sampler()->notifyOfScope(this);
+#if ENABLE(CODEBLOCK_SAMPLING)
+    if (SamplingTool* sampler = globalData->interpreter->sampler())
+        sampler->notifyOfScope(this);
 #endif
 }
 
-ScopeNode::~ScopeNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ScopeNode::releaseNodes(NodeReleaser& releaser)
-{
-    if (!m_data)
-        return;
-    size_t size = m_data->m_children.size();
-    for (size_t i = 0; i < size; ++i)
-        releaser.release(m_data->m_children[i]);
-}
-
 // ------------------------------ ProgramNode -----------------------------
 
-ProgramNode::ProgramNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+inline ProgramNode::ProgramNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
     : ScopeNode(globalData, source, children, varStack, funcStack, features, numConstants)
 {
 }
 
-ProgramNode* ProgramNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
 {
-    return new ProgramNode(globalData, children, varStack, funcStack, source, features, numConstants);
+    RefPtr<ProgramNode> node = new ProgramNode(globalData, children, varStack, funcStack, source, features, numConstants);
+
+    ASSERT(node->data()->m_arena.last() == node);
+    node->data()->m_arena.removeLast();
+    ASSERT(!node->data()->m_arena.contains(node.get()));
+
+    return node.release();
 }
 
 RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
@@ -2496,16 +1895,33 @@
     destroyData();
 }
 
+#if ENABLE(JIT)
+void ProgramNode::generateJITCode(ScopeChainNode* scopeChainNode)
+{
+    bytecode(scopeChainNode);
+    ASSERT(m_code);
+    ASSERT(!m_jitCode);
+    JIT::compile(scopeChainNode->globalData, m_code.get());
+    ASSERT(m_jitCode);
+}
+#endif
+
 // ------------------------------ EvalNode -----------------------------
 
-EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+inline EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
     : ScopeNode(globalData, source, children, varStack, funcStack, features, numConstants)
 {
 }
 
-EvalNode* EvalNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
 {
-    return new EvalNode(globalData, children, varStack, funcStack, source, features, numConstants);
+    RefPtr<EvalNode> node = new EvalNode(globalData, children, varStack, funcStack, source, features, numConstants);
+
+    ASSERT(node->data()->m_arena.last() == node);
+    node->data()->m_arena.removeLast();
+    ASSERT(!node->data()->m_arena.contains(node.get()));
+
+    return node.release();
 }
 
 RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
@@ -2558,27 +1974,35 @@
     data()->mark();
 }
 
+#if ENABLE(JIT)
+void EvalNode::generateJITCode(ScopeChainNode* scopeChainNode)
+{
+    bytecode(scopeChainNode);
+    ASSERT(m_code);
+    ASSERT(!m_jitCode);
+    JIT::compile(scopeChainNode->globalData, m_code.get());
+    ASSERT(m_jitCode);
+}
+#endif
+
 // ------------------------------ FunctionBodyNode -----------------------------
 
-FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData)
+inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData)
     : ScopeNode(globalData)
     , m_parameters(0)
     , m_parameterCount(0)
-    , m_refCount(0)
 {
 }
 
-FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
+inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
     : ScopeNode(globalData, sourceCode, children, varStack, funcStack, features, numConstants)
     , m_parameters(0)
     , m_parameterCount(0)
-    , m_refCount(0)
 {
 }
 
 FunctionBodyNode::~FunctionBodyNode()
 {
-    ASSERT(!m_refCount);
     for (size_t i = 0; i < m_parameterCount; ++i)
         m_parameters[i].~Identifier();
     fastFree(m_parameters);
@@ -2608,14 +2032,30 @@
         m_code->mark();
 }
 
+#if ENABLE(JIT)
+PassRefPtr<FunctionBodyNode> FunctionBodyNode::createNativeThunk(JSGlobalData* globalData)
+{
+    RefPtr<FunctionBodyNode> body = new FunctionBodyNode(globalData);
+    globalData->parser->arena().reset();
+    body->m_jitCode = JITCode(JITCode::HostFunction(globalData->jitStubs.ctiNativeCallThunk()));
+    return body.release();
+}
+#endif
+
 FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData)
 {
     return new FunctionBodyNode(globalData);
 }
 
-FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
+PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
 {
-    return new FunctionBodyNode(globalData, children, varStack, funcStack, sourceCode, features, numConstants);
+    RefPtr<FunctionBodyNode> node = new FunctionBodyNode(globalData, children, varStack, funcStack, sourceCode, features, numConstants);
+
+    ASSERT(node->data()->m_arena.last() == node);
+    node->data()->m_arena.removeLast();
+    ASSERT(!node->data()->m_arena.contains(node.get()));
+
+    return node.release();
 }
 
 void FunctionBodyNode::generateBytecode(ScopeChainNode* scopeChainNode)
@@ -2637,6 +2077,17 @@
     destroyData();
 }
 
+#if ENABLE(JIT)
+void FunctionBodyNode::generateJITCode(ScopeChainNode* scopeChainNode)
+{
+    bytecode(scopeChainNode);
+    ASSERT(m_code);
+    ASSERT(!m_jitCode);
+    JIT::compile(scopeChainNode->globalData, m_code.get());
+    ASSERT(m_jitCode);
+}
+#endif
+
 CodeBlock& FunctionBodyNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode, CodeBlock* codeBlockBeingRegeneratedFrom)
 {
     ASSERT(!m_code);
@@ -2658,7 +2109,7 @@
     generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
     statementListEmitCode(children(), generator, generator.ignoredResult());
     if (children().size() && children().last()->isBlock()) {
-        BlockNode* blockNode = static_cast<BlockNode*>(children().last().get());
+        BlockNode* blockNode = static_cast<BlockNode*>(children().last());
         if (blockNode->children().size() && blockNode->children().last()->isReturnNode())
             return 0;
     }
@@ -2690,17 +2141,6 @@
 
 // ------------------------------ FuncDeclNode ---------------------------------
 
-FuncDeclNode::~FuncDeclNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FuncDeclNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_parameter);
-    releaser.release(m_body);
-}
-
 JSFunction* FuncDeclNode::makeFunction(ExecState* exec, ScopeChainNode* scopeChain)
 {
     return new (exec) JSFunction(exec, m_ident, m_body.get(), scopeChain);
@@ -2715,17 +2155,6 @@
 
 // ------------------------------ FuncExprNode ---------------------------------
 
-FuncExprNode::~FuncExprNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FuncExprNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_parameter);
-    releaser.release(m_body);
-}
-
 RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
diff --git a/JavaScriptCore/parser/Nodes.h b/JavaScriptCore/parser/Nodes.h
index f209133..ec4fdb4 100644
--- a/JavaScriptCore/parser/Nodes.h
+++ b/JavaScriptCore/parser/Nodes.h
@@ -23,34 +23,30 @@
  *
  */
 
-#ifndef NODES_H_
-#define NODES_H_
+#ifndef Nodes_h
+#define Nodes_h
 
 #include "Error.h"
+#include "JITCode.h"
 #include "Opcode.h"
+#include "ParserArena.h"
 #include "ResultType.h"
 #include "SourceCode.h"
 #include "SymbolTable.h"
 #include <wtf/MathExtras.h>
 #include <wtf/OwnPtr.h>
-#include <wtf/Vector.h>
-
-#if PLATFORM(X86) && COMPILER(GCC)
-#define JSC_FAST_CALL __attribute__((regparm(3)))
-#else
-#define JSC_FAST_CALL
-#endif
 
 namespace JSC {
 
+    class ArgumentListNode;
     class CodeBlock;
     class BytecodeGenerator;
     class FuncDeclNode;
     class EvalCodeBlock;
     class JSFunction;
-    class NodeReleaser;
     class ProgramCodeBlock;
     class PropertyListNode;
+    class ReadModifyResolveNode;
     class RegisterID;
     class ScopeChainNode;
 
@@ -91,7 +87,7 @@
     namespace DeclarationStacks {
         enum VarAttrs { IsConstant = 1, HasInitializer = 2 };
         typedef Vector<std::pair<Identifier, unsigned> > VarStack;
-        typedef Vector<RefPtr<FuncDeclNode> > FunctionStack;
+        typedef Vector<FuncDeclNode*> FunctionStack;
     }
 
     struct SwitchInfo {
@@ -100,30 +96,37 @@
         SwitchType switchType;
     };
 
-    class ParserRefCounted : Noncopyable {
+    class ParserArenaDeletable {
     protected:
-        ParserRefCounted(JSGlobalData*) JSC_FAST_CALL;
+        ParserArenaDeletable() { }
 
     public:
-        virtual ~ParserRefCounted();
+        virtual ~ParserArenaDeletable() { }
 
-        // Nonrecursive destruction.
-        virtual void releaseNodes(NodeReleaser&);
+        // Objects created with this version of new are deleted when the arena is deleted.
+        void* operator new(size_t, JSGlobalData*);
 
-        void ref() JSC_FAST_CALL;
-        void deref() JSC_FAST_CALL;
-        bool hasOneRef() JSC_FAST_CALL;
-
-        static void deleteNewObjects(JSGlobalData*) JSC_FAST_CALL;
-
-    private:
-        JSGlobalData* m_globalData;
+        // Objects created with this version of new are not deleted when the arena is deleted.
+        // Other arrangements must be made.
+        void* operator new(size_t);
     };
 
-    class Node : public ParserRefCounted {
-    public:
-        Node(JSGlobalData*) JSC_FAST_CALL;
+    class ParserArenaRefCounted : public RefCounted<ParserArenaRefCounted> {
+    protected:
+        ParserArenaRefCounted(JSGlobalData*);
 
+    public:
+        virtual ~ParserArenaRefCounted()
+        {
+            ASSERT(deletionHasBegun());
+        }
+    };
+
+    class Node : public ParserArenaDeletable {
+    protected:
+        Node(JSGlobalData*);
+
+    public:
         /*
             Return value: The register holding the production's value.
                      dst: An optional parameter specifying the most efficient
@@ -146,7 +149,7 @@
             because the assignment node, "x =", passes r[x] as dst to the number
             node, "1".
         */
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0) JSC_FAST_CALL = 0;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0) = 0;
 
         int lineNo() const { return m_line; }
 
@@ -166,45 +169,44 @@
 
     class ExpressionNode : public Node {
     public:
-        ExpressionNode(JSGlobalData* globalData, ResultType resultDesc = ResultType::unknownType()) JSC_FAST_CALL
-            : Node(globalData)
-            , m_resultDesc(resultDesc)
-        {
-        }
+        ExpressionNode(JSGlobalData*, ResultType = ResultType::unknownType());
 
-        virtual bool isNumber() const JSC_FAST_CALL { return false; }
-        virtual bool isString() const JSC_FAST_CALL { return false; }
-        virtual bool isNull() const JSC_FAST_CALL { return false; }
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return false; }        
-        virtual bool isLocation() const JSC_FAST_CALL { return false; }
-        virtual bool isResolveNode() const JSC_FAST_CALL { return false; }
-        virtual bool isBracketAccessorNode() const JSC_FAST_CALL { return false; }
-        virtual bool isDotAccessorNode() const JSC_FAST_CALL { return false; }
-        virtual bool isFuncExprNode() const JSC_FAST_CALL { return false; } 
+        virtual bool isNumber() const { return false; }
+        virtual bool isString() const { return false; }
+        virtual bool isNull() const { return false; }
+        virtual bool isPure(BytecodeGenerator&) const { return false; }        
+        virtual bool isLocation() const { return false; }
+        virtual bool isResolveNode() const { return false; }
+        virtual bool isBracketAccessorNode() const { return false; }
+        virtual bool isDotAccessorNode() const { return false; }
+        virtual bool isFuncExprNode() const { return false; } 
+        virtual bool isSimpleArray() const { return false; }
+        virtual bool isAdd() const { return false; }
 
         virtual ExpressionNode* stripUnaryPlus() { return this; }
 
-        ResultType resultDescriptor() const JSC_FAST_CALL { return m_resultDesc; }
+        ResultType resultDescriptor() const { return m_resultType; }
 
         // This needs to be in public in order to compile using GCC 3.x 
         typedef enum { EvalOperator, FunctionCall } CallerType;
 
     private:
-        ResultType m_resultDesc;
+        ResultType m_resultType;
     };
 
     class StatementNode : public Node {
     public:
-        StatementNode(JSGlobalData*) JSC_FAST_CALL;
-        void setLoc(int line0, int line1) JSC_FAST_CALL;
-        int firstLine() const JSC_FAST_CALL { return lineNo(); }
-        int lastLine() const JSC_FAST_CALL { return m_lastLine; }
+        StatementNode(JSGlobalData*);
 
-        virtual bool isEmptyStatement() const JSC_FAST_CALL { return false; }
-        virtual bool isReturnNode() const JSC_FAST_CALL { return false; }
-        virtual bool isExprStatement() const JSC_FAST_CALL { return false; }
+        void setLoc(int line0, int line1);
+        int firstLine() const { return lineNo(); }
+        int lastLine() const { return m_lastLine; }
 
-        virtual bool isBlock() const JSC_FAST_CALL { return false; }
+        virtual bool isEmptyStatement() const { return false; }
+        virtual bool isReturnNode() const { return false; }
+        virtual bool isExprStatement() const { return false; }
+
+        virtual bool isBlock() const { return false; }
 
     private:
         int m_lastLine;
@@ -212,66 +214,54 @@
 
     class NullNode : public ExpressionNode {
     public:
-        NullNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::nullType())
-        {
-        }
+        NullNode(JSGlobalData*);
 
-        virtual bool isNull() const JSC_FAST_CALL { return true; }
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        virtual bool isNull() const { return true; }
     };
 
     class BooleanNode : public ExpressionNode {
     public:
-        BooleanNode(JSGlobalData* globalData, bool value) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::booleanType())
-            , m_value(value)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return true; }
+        BooleanNode(JSGlobalData*, bool value);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isPure(BytecodeGenerator&) const { return true; }
+
         bool m_value;
     };
 
     class NumberNode : public ExpressionNode {
     public:
-        NumberNode(JSGlobalData* globalData, double v) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::numberType())
-            , m_double(v)
-        {
-        }
+        NumberNode(JSGlobalData*, double v);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isNumber() const JSC_FAST_CALL { return true; }
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return true; }
-        double value() const JSC_FAST_CALL { return m_double; }
-        void setValue(double d) JSC_FAST_CALL { m_double = d; }
+        double value() const { return m_double; }
+        void setValue(double d) { m_double = d; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isNumber() const { return true; }
+        virtual bool isPure(BytecodeGenerator&) const { return true; }
+
         double m_double;
     };
 
     class StringNode : public ExpressionNode {
     public:
-        StringNode(JSGlobalData* globalData, const Identifier& v) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::stringType())
-            , m_value(v)
-        {
-        }
+        StringNode(JSGlobalData*, const Identifier& v);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        
-        virtual bool isString() const JSC_FAST_CALL { return true; }
         const Identifier& value() { return m_value; }
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return true; }
+        virtual bool isPure(BytecodeGenerator&) const { return true; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        
+        virtual bool isString() const { return true; }
+
         Identifier m_value;
     };
     
@@ -374,1158 +364,682 @@
 
     class RegExpNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        RegExpNode(JSGlobalData* globalData, const UString& pattern, const UString& flags) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_pattern(pattern)
-            , m_flags(flags)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        RegExpNode(JSGlobalData*, const UString& pattern, const UString& flags);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         UString m_pattern;
         UString m_flags;
     };
 
     class ThisNode : public ExpressionNode {
     public:
-        ThisNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-        {
-        }
+        ThisNode(JSGlobalData*);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class ResolveNode : public ExpressionNode {
     public:
-        ResolveNode(JSGlobalData* globalData, const Identifier& ident, int startOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_ident(ident)
-            , m_startOffset(startOffset)
-        {
-        }
+        ResolveNode(JSGlobalData*, const Identifier&, int startOffset);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL;
-        virtual bool isLocation() const JSC_FAST_CALL { return true; }
-        virtual bool isResolveNode() const JSC_FAST_CALL { return true; }
-        const Identifier& identifier() const JSC_FAST_CALL { return m_ident; }
+        const Identifier& identifier() const { return m_ident; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isPure(BytecodeGenerator&) const ;
+        virtual bool isLocation() const { return true; }
+        virtual bool isResolveNode() const { return true; }
+
         Identifier m_ident;
         int32_t m_startOffset;
     };
 
-    class ElementNode : public ParserRefCounted {
+    class ElementNode : public ParserArenaDeletable {
     public:
-        ElementNode(JSGlobalData* globalData, int elision, ExpressionNode* node) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_elision(elision)
-            , m_node(node)
-        {
-        }
-
-        ElementNode(JSGlobalData* globalData, ElementNode* l, int elision, ExpressionNode* node) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_elision(elision)
-            , m_node(node)
-        {
-            l->m_next = this;
-        }
-
-        virtual ~ElementNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ElementNode(JSGlobalData*, int elision, ExpressionNode*);
+        ElementNode(JSGlobalData*, ElementNode*, int elision, ExpressionNode*);
 
         int elision() const { return m_elision; }
-        ExpressionNode* value() { return m_node.get(); }
-
-        ElementNode* next() { return m_next.get(); }
+        ExpressionNode* value() { return m_node; }
+        ElementNode* next() { return m_next; }
 
     private:
-        RefPtr<ElementNode> m_next;
+        ElementNode* m_next;
         int m_elision;
-        RefPtr<ExpressionNode> m_node;
+        ExpressionNode* m_node;
     };
 
     class ArrayNode : public ExpressionNode {
     public:
-        ArrayNode(JSGlobalData* globalData, int elision) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_elision(elision)
-            , m_optional(true)
-        {
-        }
+        ArrayNode(JSGlobalData*, int elision);
+        ArrayNode(JSGlobalData*, ElementNode*);
+        ArrayNode(JSGlobalData*, int elision, ElementNode*);
 
-        ArrayNode(JSGlobalData* globalData, ElementNode* element) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_element(element)
-            , m_elision(0)
-            , m_optional(false)
-        {
-        }
-
-        ArrayNode(JSGlobalData* globalData, int elision, ElementNode* element) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_element(element)
-            , m_elision(elision)
-            , m_optional(true)
-        {
-        }
-
-        virtual ~ArrayNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ArgumentListNode* toArgumentList(JSGlobalData*) const;
 
     private:
-        RefPtr<ElementNode> m_element;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isSimpleArray() const ;
+
+        ElementNode* m_element;
         int m_elision;
         bool m_optional;
     };
 
-    class PropertyNode : public ParserRefCounted {
+    class PropertyNode : public ParserArenaDeletable {
     public:
         enum Type { Constant, Getter, Setter };
 
-        PropertyNode(JSGlobalData* globalData, const Identifier& name, ExpressionNode* assign, Type type) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_name(name)
-            , m_assign(assign)
-            , m_type(type)
-        {
-        }
-
-        virtual ~PropertyNode();
-        virtual void releaseNodes(NodeReleaser&);
+        PropertyNode(JSGlobalData*, const Identifier& name, ExpressionNode* value, Type);
 
         const Identifier& name() const { return m_name; }
 
     private:
         friend class PropertyListNode;
         Identifier m_name;
-        RefPtr<ExpressionNode> m_assign;
+        ExpressionNode* m_assign;
         Type m_type;
     };
 
     class PropertyListNode : public Node {
     public:
-        PropertyListNode(JSGlobalData* globalData, PropertyNode* node) JSC_FAST_CALL
-            : Node(globalData)
-            , m_node(node)
-        {
-        }
+        PropertyListNode(JSGlobalData*, PropertyNode*);
+        PropertyListNode(JSGlobalData*, PropertyNode*, PropertyListNode*);
 
-        PropertyListNode(JSGlobalData* globalData, PropertyNode* node, PropertyListNode* list) JSC_FAST_CALL
-            : Node(globalData)
-            , m_node(node)
-        {
-            list->m_next = this;
-        }
-
-        virtual ~PropertyListNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
     private:
-        RefPtr<PropertyNode> m_node;
-        RefPtr<PropertyListNode> m_next;
+        PropertyNode* m_node;
+        PropertyListNode* m_next;
     };
 
     class ObjectLiteralNode : public ExpressionNode {
     public:
-        ObjectLiteralNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-        {
-        }
-
-        ObjectLiteralNode(JSGlobalData* globalData, PropertyListNode* list) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_list(list)
-        {
-        }
-
-        virtual ~ObjectLiteralNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ObjectLiteralNode(JSGlobalData*);
+        ObjectLiteralNode(JSGlobalData*, PropertyListNode*);
 
     private:
-        RefPtr<PropertyListNode> m_list;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        PropertyListNode* m_list;
     };
     
     class BracketAccessorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        BracketAccessorNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_subscriptHasAssignments(subscriptHasAssignments)
-        {
-        }
+        BracketAccessorNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments);
 
-        virtual ~BracketAccessorNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isLocation() const JSC_FAST_CALL { return true; }
-        virtual bool isBracketAccessorNode() const JSC_FAST_CALL { return true; }
-        ExpressionNode* base() JSC_FAST_CALL { return m_base.get(); }
-        ExpressionNode* subscript() JSC_FAST_CALL { return m_subscript.get(); }
+        ExpressionNode* base() const { return m_base; }
+        ExpressionNode* subscript() const { return m_subscript; }
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isLocation() const { return true; }
+        virtual bool isBracketAccessorNode() const { return true; }
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
         bool m_subscriptHasAssignments;
     };
 
     class DotAccessorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DotAccessorNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_base(base)
-            , m_ident(ident)
-        {
-        }
+        DotAccessorNode(JSGlobalData*, ExpressionNode* base, const Identifier&);
 
-        virtual ~DotAccessorNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isLocation() const JSC_FAST_CALL { return true; }
-        virtual bool isDotAccessorNode() const JSC_FAST_CALL { return true; }
-        ExpressionNode* base() const JSC_FAST_CALL { return m_base.get(); }
-        const Identifier& identifier() const JSC_FAST_CALL { return m_ident; }
+        ExpressionNode* base() const { return m_base; }
+        const Identifier& identifier() const { return m_ident; }
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isLocation() const { return true; }
+        virtual bool isDotAccessorNode() const { return true; }
+
+        ExpressionNode* m_base;
         Identifier m_ident;
     };
 
     class ArgumentListNode : public Node {
     public:
-        ArgumentListNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : Node(globalData)
-            , m_expr(expr)
-        {
-        }
+        ArgumentListNode(JSGlobalData*, ExpressionNode*);
+        ArgumentListNode(JSGlobalData*, ArgumentListNode*, ExpressionNode*);
 
-        ArgumentListNode(JSGlobalData* globalData, ArgumentListNode* listNode, ExpressionNode* expr) JSC_FAST_CALL
-            : Node(globalData)
-            , m_expr(expr)
-        {
-            listNode->m_next = this;
-        }
+        ArgumentListNode* m_next;
+        ExpressionNode* m_expr;
 
-        virtual ~ArgumentListNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        RefPtr<ArgumentListNode> m_next;
-        RefPtr<ExpressionNode> m_expr;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
-    class ArgumentsNode : public ParserRefCounted {
+    class ArgumentsNode : public ParserArenaDeletable {
     public:
-        ArgumentsNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-        {
-        }
+        ArgumentsNode(JSGlobalData*);
+        ArgumentsNode(JSGlobalData*, ArgumentListNode*);
 
-        ArgumentsNode(JSGlobalData* globalData, ArgumentListNode* listNode) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_listNode(listNode)
-        {
-        }
-
-        virtual ~ArgumentsNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        RefPtr<ArgumentListNode> m_listNode;
+        ArgumentListNode* m_listNode;
     };
 
     class NewExprNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        NewExprNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        NewExprNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-            , m_args(args)
-        {
-        }
-
-        virtual ~NewExprNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        NewExprNode(JSGlobalData*, ExpressionNode*);
+        NewExprNode(JSGlobalData*, ExpressionNode*, ArgumentsNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        ArgumentsNode* m_args;
     };
 
     class EvalFunctionCallNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        EvalFunctionCallNode(JSGlobalData* globalData, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_args(args)
-        {
-        }
-
-        virtual ~EvalFunctionCallNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        EvalFunctionCallNode(JSGlobalData*, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ArgumentsNode* m_args;
     };
 
     class FunctionCallValueNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        FunctionCallValueNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_expr(expr)
-            , m_args(args)
-        {
-        }
-
-        virtual ~FunctionCallValueNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FunctionCallValueNode(JSGlobalData*, ExpressionNode*, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        ArgumentsNode* m_args;
     };
 
     class FunctionCallResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        FunctionCallResolveNode(JSGlobalData* globalData, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-            , m_args(args)
-        {
-        }
-
-        virtual ~FunctionCallResolveNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FunctionCallResolveNode(JSGlobalData*, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ArgumentsNode> m_args;
+        ArgumentsNode* m_args;
         size_t m_index; // Used by LocalVarFunctionCallNode.
         size_t m_scopeDepth; // Used by ScopedVarFunctionCallNode and NonLocalVarFunctionCallNode
     };
     
     class FunctionCallBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        FunctionCallBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_args(args)
-        {
-        }
-
-        virtual ~FunctionCallBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FunctionCallBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ArgumentsNode* m_args;
     };
 
     class FunctionCallDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        FunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_args(args)
-        {
-        }
-
-        virtual ~FunctionCallDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FunctionCallDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        Identifier m_ident;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+    protected:
+        ExpressionNode* m_base;
+        const Identifier m_ident;
+        ArgumentsNode* m_args;
+    };
+
+    class CallFunctionCallDotNode : public FunctionCallDotNode {
+    public:
+        CallFunctionCallDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+    };
+    
+    class ApplyFunctionCallDotNode : public FunctionCallDotNode {
+    public:
+        ApplyFunctionCallDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class PrePostResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        PrePostResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::numberType()) // could be reusable for pre?
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-        {
-        }
+        PrePostResolveNode(JSGlobalData*, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     protected:
-        Identifier m_ident;
+        const Identifier m_ident;
     };
 
     class PostfixResolveNode : public PrePostResolveNode {
     public:
-        PostfixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
-            , m_operator(oper)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixResolveNode(JSGlobalData*, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Operator m_operator;
     };
 
     class PostfixBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PostfixBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
         Operator m_operator;
     };
 
     class PostfixDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PostfixDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
         Operator m_operator;
     };
 
     class PostfixErrorNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_expr(expr)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PostfixErrorNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixErrorNode(JSGlobalData*, ExpressionNode*, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
         Operator m_operator;
     };
 
     class DeleteResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteResolveNode(JSGlobalData*, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class DeleteBracketNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-        {
-        }
-
-        virtual ~DeleteBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
     };
 
     class DeleteDotNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-        {
-        }
-
-        virtual ~DeleteDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
     };
 
     class DeleteValueNode : public ExpressionNode {
     public:
-        DeleteValueNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~DeleteValueNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteValueNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class VoidNode : public ExpressionNode {
     public:
-        VoidNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~VoidNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        VoidNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class TypeOfResolveNode : public ExpressionNode {
     public:
-        TypeOfResolveNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::stringType())
-            , m_ident(ident)
-        {
-        }
+        TypeOfResolveNode(JSGlobalData*, const Identifier&);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        const Identifier& identifier() const JSC_FAST_CALL { return m_ident; }
+        const Identifier& identifier() const { return m_ident; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class TypeOfValueNode : public ExpressionNode {
     public:
-        TypeOfValueNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::stringType())
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~TypeOfValueNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        TypeOfValueNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class PrefixResolveNode : public PrePostResolveNode {
     public:
-        PrefixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
-            , m_operator(oper)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixResolveNode(JSGlobalData*, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Operator m_operator;
     };
 
     class PrefixBracketNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
     public:
-        PrefixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PrefixBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
         Operator m_operator;
     };
 
     class PrefixDotNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
     public:
-        PrefixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PrefixDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
         Operator m_operator;
     };
 
     class PrefixErrorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        PrefixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_expr(expr)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PrefixErrorNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixErrorNode(JSGlobalData*, ExpressionNode*, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
         Operator m_operator;
     };
 
     class UnaryOpNode : public ExpressionNode {
     public:
-        UnaryOpNode(JSGlobalData* globalData, ExpressionNode* expr)
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        UnaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr)
-            : ExpressionNode(globalData, type)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~UnaryOpNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL = 0;
+        UnaryOpNode(JSGlobalData*, ResultType, ExpressionNode*, OpcodeID);
 
     protected:
-        RefPtr<ExpressionNode> m_expr;
+        ExpressionNode* expr() { return m_expr; }
+
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        OpcodeID opcodeID() const { return m_opcodeID; }
+
+        ExpressionNode* m_expr;
+        OpcodeID m_opcodeID;
     };
 
     class UnaryPlusNode : public UnaryOpNode {
     public:
-        UnaryPlusNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::numberType(), expr)
-        {
-        }
+        UnaryPlusNode(JSGlobalData*, ExpressionNode*);
 
-        virtual ExpressionNode* stripUnaryPlus() { return m_expr.get(); }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_to_jsnumber; }
+    private:
+        virtual ExpressionNode* stripUnaryPlus() { return expr(); }
     };
 
     class NegateNode : public UnaryOpNode {
     public:
-        NegateNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_negate; }
+        NegateNode(JSGlobalData*, ExpressionNode*);
     };
 
     class BitwiseNotNode : public UnaryOpNode {
     public:
-        BitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::forBitOp(), expr)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitnot; }
+        BitwiseNotNode(JSGlobalData*, ExpressionNode*);
     };
 
     class LogicalNotNode : public UnaryOpNode {
     public:
-        LogicalNotNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::booleanType(), expr)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_not; }
+        LogicalNotNode(JSGlobalData*, ExpressionNode*);
     };
 
     class BinaryOpNode : public ExpressionNode {
     public:
-        BinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : ExpressionNode(globalData)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
+        BinaryOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        BinaryOpNode(JSGlobalData*, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
 
-        BinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : ExpressionNode(globalData, type)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
+        RegisterID* emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs = 0, ReadModifyResolveNode* emitExpressionInfoForMe = 0);
 
-        virtual ~BinaryOpNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL = 0;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
     protected:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        OpcodeID opcodeID() const { return m_opcodeID; }
+
+    protected:
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
+    private:
+        OpcodeID m_opcodeID;
+    protected:
         bool m_rightHasAssignments;
     };
 
     class ReverseBinaryOpNode : public BinaryOpNode {
     public:
-        ReverseBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : BinaryOpNode(globalData, expr1, expr2, rightHasAssignments)
-        {
-        }
+        ReverseBinaryOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        ReverseBinaryOpNode(JSGlobalData*, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
 
-        ReverseBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : BinaryOpNode(globalData, type, expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class MultNode : public BinaryOpNode {
     public:
-        MultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_mul; }
+        MultNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class DivNode : public BinaryOpNode {
     public:
-        DivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_div; }
+        DivNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class ModNode : public BinaryOpNode {
     public:
-        ModNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_mod; }
+        ModNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class AddNode : public BinaryOpNode {
     public:
-        AddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::forAdd(expr1->resultDescriptor(), expr2->resultDescriptor()), expr1, expr2, rightHasAssignments)
-        {
-        }
+        AddNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_add; }
+        virtual bool isAdd() const { return true; }
     };
 
     class SubNode : public BinaryOpNode {
     public:
-        SubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_sub; }
+        SubNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class LeftShiftNode : public BinaryOpNode {
     public:
-        LeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_lshift; }
+        LeftShiftNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class RightShiftNode : public BinaryOpNode {
     public:
-        RightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_rshift; }
+        RightShiftNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class UnsignedRightShiftNode : public BinaryOpNode {
     public:
-        UnsignedRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_urshift; }
+        UnsignedRightShiftNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class LessNode : public BinaryOpNode {
     public:
-        LessNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_less; }
+        LessNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class GreaterNode : public ReverseBinaryOpNode {
     public:
-        GreaterNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ReverseBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_less; }
+        GreaterNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class LessEqNode : public BinaryOpNode {
     public:
-        LessEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_lesseq; }
+        LessEqNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class GreaterEqNode : public ReverseBinaryOpNode {
     public:
-        GreaterEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ReverseBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_lesseq; }
+        GreaterEqNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class ThrowableBinaryOpNode : public BinaryOpNode, public ThrowableExpressionData {
     public:
-        ThrowableBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, type, expr1, expr2, rightHasAssignments)
-        {
-        }
-        ThrowableBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, expr1, expr2, rightHasAssignments)
-        {
-        }
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ThrowableBinaryOpNode(JSGlobalData*, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        ThrowableBinaryOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
     
     class InstanceOfNode : public ThrowableBinaryOpNode {
     public:
-        InstanceOfNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ThrowableBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, rightHasAssignments)
-        {
-        }
+        InstanceOfNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_instanceof; }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class InNode : public ThrowableBinaryOpNode {
     public:
-        InNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ThrowableBinaryOpNode(globalData, expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_in; }
+        InNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class EqualNode : public BinaryOpNode {
     public:
-        EqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, rightHasAssignments)
-        {
-        }
+        EqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_eq; }
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class NotEqualNode : public BinaryOpNode {
     public:
-        NotEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_neq; }
+        NotEqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class StrictEqualNode : public BinaryOpNode {
     public:
-        StrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, rightHasAssignments)
-        {
-        }
+        StrictEqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_stricteq; }
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class NotStrictEqualNode : public BinaryOpNode {
     public:
-        NotStrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_nstricteq; }
+        NotStrictEqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitAndNode : public BinaryOpNode {
     public:
-        BitAndNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitand; }
+        BitAndNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitOrNode : public BinaryOpNode {
     public:
-        BitOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitor; }
+        BitOrNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitXOrNode : public BinaryOpNode {
     public:
-        BitXOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitxor; }
+        BitXOrNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
-    /**
-     * m_expr1 && m_expr2, m_expr1 || m_expr2
-     */
+    // m_expr1 && m_expr2, m_expr1 || m_expr2
     class LogicalOpNode : public ExpressionNode {
     public:
-        LogicalOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::booleanType())
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~LogicalOpNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        LogicalOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator);
 
     private:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
         LogicalOperator m_operator;
     };
 
-    /**
-     * The ternary operator, "m_logical ? m_expr1 : m_expr2"
-     */
+    // The ternary operator, "m_logical ? m_expr1 : m_expr2"
     class ConditionalNode : public ExpressionNode {
     public:
-        ConditionalNode(JSGlobalData* globalData, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_logical(logical)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-        {
-        }
-
-        virtual ~ConditionalNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ConditionalNode(JSGlobalData*, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2);
 
     private:
-        RefPtr<ExpressionNode> m_logical;
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_logical;
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
     };
 
     class ReadModifyResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        ReadModifyResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-            , m_right(right)
-            , m_operator(oper)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~ReadModifyResolveNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ReadModifyResolveNode(JSGlobalData*, const Identifier&, Operator, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         size_t m_index; // Used by ReadModifyLocalVarNode.
-        Operator m_operator : 31;
-        bool m_rightHasAssignments : 1;
+        Operator m_operator;
+        bool m_rightHasAssignments;
     };
 
     class AssignResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignResolveNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_ident(ident)
-            , m_right(right)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~AssignResolveNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignResolveNode(JSGlobalData*, const Identifier&, ExpressionNode* right, bool rightHasAssignments);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         size_t m_index; // Used by ReadModifyLocalVarNode.
         bool m_rightHasAssignments;
     };
 
     class ReadModifyBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        ReadModifyBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_right(right)
-            , m_operator(oper)
-            , m_subscriptHasAssignments(subscriptHasAssignments)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~ReadModifyBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ReadModifyBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, Operator, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
-        RefPtr<ExpressionNode> m_right;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ExpressionNode* m_right;
         Operator m_operator : 30;
         bool m_subscriptHasAssignments : 1;
         bool m_rightHasAssignments : 1;
@@ -1533,168 +1047,105 @@
 
     class AssignBracketNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_right(right)
-            , m_subscriptHasAssignments(subscriptHasAssignments)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~AssignBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
-        RefPtr<ExpressionNode> m_right;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ExpressionNode* m_right;
         bool m_subscriptHasAssignments : 1;
         bool m_rightHasAssignments : 1;
     };
 
     class AssignDotNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_right(right)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~AssignDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         bool m_rightHasAssignments;
     };
 
     class ReadModifyDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        ReadModifyDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_right(right)
-            , m_operator(oper)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~ReadModifyDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ReadModifyDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, Operator, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         Operator m_operator : 31;
         bool m_rightHasAssignments : 1;
     };
 
     class AssignErrorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignErrorNode(JSGlobalData* globalData, ExpressionNode* left, Operator oper, ExpressionNode* right, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_left(left)
-            , m_operator(oper)
-            , m_right(right)
-        {
-        }
-
-        virtual ~AssignErrorNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignErrorNode(JSGlobalData*, ExpressionNode* left, Operator, ExpressionNode* right, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_left;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_left;
         Operator m_operator;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
     };
 
     class CommaNode : public ExpressionNode {
     public:
-        CommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-        {
-        }
-
-        virtual ~CommaNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        CommaNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2);
 
     private:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
     };
     
-    class VarDeclCommaNode : public CommaNode {
-    public:
-        VarDeclCommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2) JSC_FAST_CALL
-            : CommaNode(globalData, expr1, expr2)
-        {
-        }
-    };
-
     class ConstDeclNode : public ExpressionNode {
     public:
-        ConstDeclNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* in) JSC_FAST_CALL;
+        ConstDeclNode(JSGlobalData*, const Identifier&, ExpressionNode*);
 
-        virtual ~ConstDeclNode();
-        virtual void releaseNodes(NodeReleaser&);
+        bool hasInitializer() const { return m_init; }
+        const Identifier& ident() { return m_ident; }
+
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        virtual RegisterID* emitCodeSingle(BytecodeGenerator&);
 
         Identifier m_ident;
-        RefPtr<ConstDeclNode> m_next;
-        RefPtr<ExpressionNode> m_init;
-        
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual RegisterID* emitCodeSingle(BytecodeGenerator&) JSC_FAST_CALL;
+
+    public:
+        ConstDeclNode* m_next;
+
+    private:
+        ExpressionNode* m_init;
     };
 
     class ConstStatementNode : public StatementNode {
     public:
-        ConstStatementNode(JSGlobalData* globalData, ConstDeclNode* next) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_next(next)
-        {
-        }
-
-        virtual ~ConstStatementNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ConstStatementNode(JSGlobalData*, ConstDeclNode* next);
 
     private:
-        RefPtr<ConstDeclNode> m_next;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ConstDeclNode* m_next;
     };
 
-    typedef Vector<RefPtr<StatementNode> > StatementVector;
+    typedef Vector<StatementNode*> StatementVector;
 
-    class SourceElements : public ParserRefCounted {
+    class SourceElements : public ParserArenaDeletable {
     public:
-        SourceElements(JSGlobalData* globalData) : ParserRefCounted(globalData) {}
+        SourceElements(JSGlobalData*);
 
-        void append(PassRefPtr<StatementNode>);
+        void append(StatementNode*);
         void releaseContentsIntoVector(StatementVector& destination)
         {
             ASSERT(destination.isEmpty());
@@ -1708,369 +1159,235 @@
 
     class BlockNode : public StatementNode {
     public:
-        BlockNode(JSGlobalData*, SourceElements* children) JSC_FAST_CALL;
-
-        virtual ~BlockNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        BlockNode(JSGlobalData*, SourceElements* children);
 
         StatementVector& children() { return m_children; }
 
-        virtual bool isBlock() const JSC_FAST_CALL { return true; }
-
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isBlock() const { return true; }
+
         StatementVector m_children;
     };
 
     class EmptyStatementNode : public StatementNode {
     public:
-        EmptyStatementNode(JSGlobalData* globalData) JSC_FAST_CALL // debug
-            : StatementNode(globalData)
-        {
-        }
+        EmptyStatementNode(JSGlobalData*);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual bool isEmptyStatement() const JSC_FAST_CALL { return true; }
+        virtual bool isEmptyStatement() const { return true; }
     };
     
     class DebuggerStatementNode : public StatementNode {
     public:
-        DebuggerStatementNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : StatementNode(globalData)
-        {
-        }
+        DebuggerStatementNode(JSGlobalData*);
         
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class ExprStatementNode : public StatementNode {
     public:
-        ExprStatementNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-        {
-        }
+        ExprStatementNode(JSGlobalData*, ExpressionNode*);
 
-        virtual bool isExprStatement() const JSC_FAST_CALL { return true; }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        ExpressionNode* expr() const { return m_expr.get(); }
+        ExpressionNode* expr() const { return m_expr; }
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual bool isExprStatement() const { return true; }
+
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class VarStatementNode : public StatementNode {
     public:
-        VarStatementNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-        {
-        }
-        
-        virtual ~VarStatementNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        VarStatementNode(JSGlobalData*, ExpressionNode*);        
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class IfNode : public StatementNode {
     public:
-        IfNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_condition(condition)
-            , m_ifBlock(ifBlock)
-        {
-        }
-
-        virtual ~IfNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        IfNode(JSGlobalData*, ExpressionNode* condition, StatementNode* ifBlock);
 
     protected:
-        RefPtr<ExpressionNode> m_condition;
-        RefPtr<StatementNode> m_ifBlock;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_condition;
+        StatementNode* m_ifBlock;
     };
 
     class IfElseNode : public IfNode {
     public:
-        IfElseNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock) JSC_FAST_CALL
-            : IfNode(globalData, condition, ifBlock)
-            , m_elseBlock(elseBlock)
-        {
-        }
-
-        virtual ~IfElseNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        IfElseNode(JSGlobalData*, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock);
 
     private:
-        RefPtr<StatementNode> m_elseBlock;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        StatementNode* m_elseBlock;
     };
 
     class DoWhileNode : public StatementNode {
     public:
-        DoWhileNode(JSGlobalData* globalData, StatementNode* statement, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_statement(statement)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~DoWhileNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DoWhileNode(JSGlobalData*, StatementNode* statement, ExpressionNode*);
 
     private:
-        RefPtr<StatementNode> m_statement;
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        StatementNode* m_statement;
+        ExpressionNode* m_expr;
     };
 
     class WhileNode : public StatementNode {
     public:
-        WhileNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-            , m_statement(statement)
-        {
-        }
-
-        virtual ~WhileNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        WhileNode(JSGlobalData*, ExpressionNode*, StatementNode* statement);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<StatementNode> m_statement;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
     };
 
     class ForNode : public StatementNode {
     public:
-        ForNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, bool expr1WasVarDecl) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_expr3(expr3)
-            , m_statement(statement)
-            , m_expr1WasVarDecl(expr1 && expr1WasVarDecl)
-        {
-            ASSERT(statement);
-        }
-
-        virtual ~ForNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ForNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, bool expr1WasVarDecl);
 
     private:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
-        RefPtr<ExpressionNode> m_expr3;
-        RefPtr<StatementNode> m_statement;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
+        ExpressionNode* m_expr3;
+        StatementNode* m_statement;
         bool m_expr1WasVarDecl;
     };
 
     class ForInNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ForInNode(JSGlobalData*, ExpressionNode*, ExpressionNode*, StatementNode*) JSC_FAST_CALL;
-        ForInNode(JSGlobalData*, const Identifier&, ExpressionNode*, ExpressionNode*, StatementNode*, int divot, int startOffset, int endOffset) JSC_FAST_CALL;
-        
-        virtual ~ForInNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ForInNode(JSGlobalData*, ExpressionNode*, ExpressionNode*, StatementNode*);
+        ForInNode(JSGlobalData*, const Identifier&, ExpressionNode*, ExpressionNode*, StatementNode*, int divot, int startOffset, int endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_init;
-        RefPtr<ExpressionNode> m_lexpr;
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<StatementNode> m_statement;
+        ExpressionNode* m_init;
+        ExpressionNode* m_lexpr;
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
         bool m_identIsVarDecl;
     };
 
     class ContinueNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ContinueNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : StatementNode(globalData)
-        {
-        }
-
-        ContinueNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_ident(ident)
-        {
-        }
+        ContinueNode(JSGlobalData*);
+        ContinueNode(JSGlobalData*, const Identifier&);
         
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class BreakNode : public StatementNode, public ThrowableExpressionData {
     public:
-        BreakNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : StatementNode(globalData)
-        {
-        }
-
-        BreakNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_ident(ident)
-        {
-        }
+        BreakNode(JSGlobalData*);
+        BreakNode(JSGlobalData*, const Identifier&);
         
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class ReturnNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ReturnNode(JSGlobalData* globalData, ExpressionNode* value) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_value(value)
-        {
-        }
-
-        virtual ~ReturnNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual bool isReturnNode() const JSC_FAST_CALL { return true; }
+        ReturnNode(JSGlobalData*, ExpressionNode* value);
 
     private:
-        RefPtr<ExpressionNode> m_value;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isReturnNode() const { return true; }
+
+        ExpressionNode* m_value;
     };
 
     class WithNode : public StatementNode {
     public:
-        WithNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement, uint32_t divot, uint32_t expressionLength) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-            , m_statement(statement)
-            , m_divot(divot)
-            , m_expressionLength(expressionLength)
-        {
-        }
-
-        virtual ~WithNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        WithNode(JSGlobalData*, ExpressionNode*, StatementNode*, uint32_t divot, uint32_t expressionLength);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<StatementNode> m_statement;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
         uint32_t m_divot;
         uint32_t m_expressionLength;
     };
 
     class LabelNode : public StatementNode, public ThrowableExpressionData {
     public:
-        LabelNode(JSGlobalData* globalData, const Identifier& name, StatementNode* statement) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_name(name)
-            , m_statement(statement)
-        {
-        }
-
-        virtual ~LabelNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        LabelNode(JSGlobalData*, const Identifier& name, StatementNode*);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_name;
-        RefPtr<StatementNode> m_statement;
+        StatementNode* m_statement;
     };
 
     class ThrowNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ThrowNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~ThrowNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ThrowNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class TryNode : public StatementNode {
     public:
-        TryNode(JSGlobalData* globalData, StatementNode* tryBlock, const Identifier& exceptionIdent, bool catchHasEval, StatementNode* catchBlock, StatementNode* finallyBlock) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_tryBlock(tryBlock)
-            , m_exceptionIdent(exceptionIdent)
-            , m_catchBlock(catchBlock)
-            , m_finallyBlock(finallyBlock)
-            , m_catchHasEval(catchHasEval)
-        {
-        }
-
-        virtual ~TryNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0) JSC_FAST_CALL;
+        TryNode(JSGlobalData*, StatementNode* tryBlock, const Identifier& exceptionIdent, bool catchHasEval, StatementNode* catchBlock, StatementNode* finallyBlock);
 
     private:
-        RefPtr<StatementNode> m_tryBlock;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0);
+
+        StatementNode* m_tryBlock;
         Identifier m_exceptionIdent;
-        RefPtr<StatementNode> m_catchBlock;
-        RefPtr<StatementNode> m_finallyBlock;
+        StatementNode* m_catchBlock;
+        StatementNode* m_finallyBlock;
         bool m_catchHasEval;
     };
 
-    class ParameterNode : public ParserRefCounted {
+    class ParameterNode : public ParserArenaDeletable {
     public:
-        ParameterNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_ident(ident)
-        {
-        }
+        ParameterNode(JSGlobalData*, const Identifier&);
+        ParameterNode(JSGlobalData*, ParameterNode*, const Identifier&);
 
-        ParameterNode(JSGlobalData* globalData, ParameterNode* l, const Identifier& ident) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_ident(ident)
-        {
-            l->m_next = this;
-        }
-
-        virtual ~ParameterNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        const Identifier& ident() const JSC_FAST_CALL { return m_ident; }
-        ParameterNode* nextParam() const JSC_FAST_CALL { return m_next.get(); }
+        const Identifier& ident() const { return m_ident; }
+        ParameterNode* nextParam() const { return m_next; }
 
     private:
         Identifier m_ident;
-        RefPtr<ParameterNode> m_next;
+        ParameterNode* m_next;
     };
 
     struct ScopeNodeData {
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
 
-        ScopeNodeData(SourceElements*, VarStack*, FunctionStack*, int numConstants);
+        ScopeNodeData(ParserArena&, SourceElements*, VarStack*, FunctionStack*, int numConstants);
 
+        ParserArena m_arena;
         VarStack m_varStack;
         FunctionStack m_functionStack;
         int m_numConstants;
@@ -2079,22 +1396,25 @@
         void mark();
     };
 
-    class ScopeNode : public StatementNode {
+    class ScopeNode : public StatementNode, public ParserArenaRefCounted {
     public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
 
-        ScopeNode(JSGlobalData*) JSC_FAST_CALL;
-        ScopeNode(JSGlobalData*, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, CodeFeatures, int numConstants) JSC_FAST_CALL;
-        virtual ~ScopeNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ScopeNode(JSGlobalData*);
+        ScopeNode(JSGlobalData*, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, CodeFeatures, int numConstants);
 
-        void adoptData(std::auto_ptr<ScopeNodeData> data) { m_data.adopt(data); }
+        void adoptData(std::auto_ptr<ScopeNodeData> data)
+        {
+            ASSERT(!data->m_arena.contains(this));
+            ASSERT(!m_data);
+            m_data.adopt(data);
+        }
         ScopeNodeData* data() const { return m_data.get(); }
         void destroyData() { m_data.clear(); }
 
         const SourceCode& source() const { return m_source; }
-        const UString& sourceURL() const JSC_FAST_CALL { return m_source.provider()->url(); }
+        const UString& sourceURL() const { return m_source.provider()->url(); }
         intptr_t sourceID() const { return m_source.provider()->asID(); }
 
         void setFeatures(CodeFeatures features) { m_features = features; }
@@ -2121,9 +1441,31 @@
 
         virtual void mark() { }
 
+#if ENABLE(JIT)
+        JITCode& generatedJITCode()
+        {
+            ASSERT(m_jitCode);
+            return m_jitCode;
+        }
+
+        ExecutablePool* getExecutablePool()
+        {
+            return m_jitCode.getExecutablePool();
+        }
+
+        void setJITCode(const JITCode jitCode)
+        {
+            m_jitCode = jitCode;
+        }
+#endif
+
     protected:
         void setSource(const SourceCode& source) { m_source = source; }
 
+#if ENABLE(JIT)
+        JITCode m_jitCode;
+#endif
+
     private:
         OwnPtr<ScopeNodeData> m_data;
         CodeFeatures m_features;
@@ -2132,44 +1474,70 @@
 
     class ProgramNode : public ScopeNode {
     public:
-        static ProgramNode* create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+        static PassRefPtr<ProgramNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        ProgramCodeBlock& bytecode(ScopeChainNode* scopeChain) JSC_FAST_CALL
+        ProgramCodeBlock& bytecode(ScopeChainNode* scopeChain) 
         {
             if (!m_code)
                 generateBytecode(scopeChain);
             return *m_code;
         }
 
-    private:
-        ProgramNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+#if ENABLE(JIT)
+        JITCode& jitCode(ScopeChainNode* scopeChain)
+        {
+            if (!m_jitCode)
+                generateJITCode(scopeChain);
+            return m_jitCode;
+        }
+#endif
 
-        void generateBytecode(ScopeChainNode*) JSC_FAST_CALL;
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        ProgramNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
+
+        void generateBytecode(ScopeChainNode*);
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+#if ENABLE(JIT)
+        void generateJITCode(ScopeChainNode*);
+#endif
 
         OwnPtr<ProgramCodeBlock> m_code;
     };
 
     class EvalNode : public ScopeNode {
     public:
-        static EvalNode* create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+        static PassRefPtr<EvalNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        EvalCodeBlock& bytecode(ScopeChainNode* scopeChain) JSC_FAST_CALL
+        EvalCodeBlock& bytecode(ScopeChainNode* scopeChain) 
         {
             if (!m_code)
                 generateBytecode(scopeChain);
             return *m_code;
         }
 
-        EvalCodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*) JSC_FAST_CALL;
+        EvalCodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*);
 
         virtual void mark();
 
-    private:
-        EvalNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+#if ENABLE(JIT)
+        JITCode& jitCode(ScopeChainNode* scopeChain)
+        {
+            if (!m_jitCode)
+                generateJITCode(scopeChain);
+            return m_jitCode;
+        }
+#endif
 
-        void generateBytecode(ScopeChainNode*) JSC_FAST_CALL;
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        EvalNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
+
+        void generateBytecode(ScopeChainNode*);
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+#if ENABLE(JIT)
+        void generateJITCode(ScopeChainNode*);
+#endif
         
         OwnPtr<EvalCodeBlock> m_code;
     };
@@ -2177,217 +1545,159 @@
     class FunctionBodyNode : public ScopeNode {
         friend class JIT;
     public:
-        static FunctionBodyNode* create(JSGlobalData*) JSC_FAST_CALL;
-        static FunctionBodyNode* create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+#if ENABLE(JIT)
+        static PassRefPtr<FunctionBodyNode> createNativeThunk(JSGlobalData*);
+#endif
+        static FunctionBodyNode* create(JSGlobalData*);
+        static PassRefPtr<FunctionBodyNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
         virtual ~FunctionBodyNode();
 
-        const Identifier* parameters() const JSC_FAST_CALL { return m_parameters; }
+        const Identifier* parameters() const { return m_parameters; }
         size_t parameterCount() const { return m_parameterCount; }
-        UString paramString() const JSC_FAST_CALL;
+        UString paramString() const ;
         Identifier* copyParameters();
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        
-        CodeBlock& bytecode(ScopeChainNode* scopeChain) JSC_FAST_CALL
-        {
-            ASSERT(scopeChain);
-            if (!m_code)
-                generateBytecode(scopeChain);
-            return *m_code;
-        }
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        CodeBlock& generatedBytecode() JSC_FAST_CALL
-        {
-            ASSERT(m_code);
-            return *m_code;
-        }
-
-        bool isGenerated() JSC_FAST_CALL
+        bool isGenerated() const
         {
             return m_code;
         }
 
+        bool isHostFunction() const
+        {
+#if ENABLE(JIT)
+            return !!m_jitCode && !m_code;
+#else
+            return true;
+#endif
+        }
+
         virtual void mark();
 
         void finishParsing(const SourceCode&, ParameterNode*);
         void finishParsing(Identifier* parameters, size_t parameterCount);
         
-        UString toSourceString() const JSC_FAST_CALL { return source().toString(); }
+        UString toSourceString() const { return source().toString(); }
 
-        // These objects are ref/deref'd a lot in the scope chain, so this is a faster ref/deref.
-        // If the virtual machine changes so this doesn't happen as much we can change back.
-        void ref()
+        CodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*);
+#if ENABLE(JIT)
+        JITCode& jitCode(ScopeChainNode* scopeChain)
         {
-            if (++m_refCount == 1)
-                ScopeNode::ref();
+            if (!m_jitCode)
+                generateJITCode(scopeChain);
+            return m_jitCode;
         }
-        void deref()
+#endif
+
+        CodeBlock& bytecode(ScopeChainNode* scopeChain) 
         {
-            ASSERT(m_refCount);
-            if (!--m_refCount)
-                ScopeNode::deref();
+            ASSERT(scopeChain);
+            if (!m_code)
+                generateBytecode(scopeChain);
+            return *m_code;
         }
-
-        CodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*) JSC_FAST_CALL;
-
+        
+        CodeBlock& generatedBytecode()
+        {
+            ASSERT(m_code);
+            return *m_code;
+        }
+        
     private:
-        FunctionBodyNode(JSGlobalData*) JSC_FAST_CALL;
-        FunctionBodyNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+        FunctionBodyNode(JSGlobalData*);
+        FunctionBodyNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        void generateBytecode(ScopeChainNode*) JSC_FAST_CALL;
-
+        void generateBytecode(ScopeChainNode*);
+#if ENABLE(JIT)
+        void generateJITCode(ScopeChainNode*);
+#endif
         Identifier* m_parameters;
         size_t m_parameterCount;
         OwnPtr<CodeBlock> m_code;
-        unsigned m_refCount;
     };
 
-    class FuncExprNode : public ExpressionNode {
+    class FuncExprNode : public ExpressionNode, public ParserArenaRefCounted {
     public:
-        FuncExprNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter = 0) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_ident(ident)
-            , m_parameter(parameter)
-            , m_body(body)
-        {
-            m_body->finishParsing(source, m_parameter.get());
-        }
+        FuncExprNode(JSGlobalData*, const Identifier&, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter = 0);
 
-        virtual ~FuncExprNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual bool isFuncExprNode() const JSC_FAST_CALL { return true; } 
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        JSFunction* makeFunction(ExecState*, ScopeChainNode*) JSC_FAST_CALL;
+        JSFunction* makeFunction(ExecState*, ScopeChainNode*);
 
         FunctionBodyNode* body() { return m_body.get(); }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isFuncExprNode() const { return true; } 
+
         Identifier m_ident;
-        RefPtr<ParameterNode> m_parameter;
         RefPtr<FunctionBodyNode> m_body;
     };
 
-    class FuncDeclNode : public StatementNode {
+    class FuncDeclNode : public StatementNode, public ParserArenaRefCounted {
     public:
-        FuncDeclNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter = 0) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_ident(ident)
-            , m_parameter(parameter)
-            , m_body(body)
-        {
-            m_body->finishParsing(source, m_parameter.get());
-        }
+        FuncDeclNode(JSGlobalData*, const Identifier&, FunctionBodyNode*, const SourceCode&, ParameterNode* = 0);
 
-        virtual ~FuncDeclNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        JSFunction* makeFunction(ExecState*, ScopeChainNode*) JSC_FAST_CALL;
+        JSFunction* makeFunction(ExecState*, ScopeChainNode*);
 
         Identifier m_ident;
 
         FunctionBodyNode* body() { return m_body.get(); }
 
     private:
-        RefPtr<ParameterNode> m_parameter;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         RefPtr<FunctionBodyNode> m_body;
     };
 
-    class CaseClauseNode : public ParserRefCounted {
+    class CaseClauseNode : public ParserArenaDeletable {
     public:
-        CaseClauseNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_expr(expr)
-        {
-        }
+        CaseClauseNode(JSGlobalData*, ExpressionNode*);
+        CaseClauseNode(JSGlobalData*, ExpressionNode*, SourceElements*);
 
-        CaseClauseNode(JSGlobalData* globalData, ExpressionNode* expr, SourceElements* children) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_expr(expr)
-        {
-            if (children)
-                children->releaseContentsIntoVector(m_children);
-        }
-
-        virtual ~CaseClauseNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        ExpressionNode* expr() const { return m_expr.get(); }
+        ExpressionNode* expr() const { return m_expr; }
         StatementVector& children() { return m_children; }
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        ExpressionNode* m_expr;
         StatementVector m_children;
     };
 
-    class ClauseListNode : public ParserRefCounted {
+    class ClauseListNode : public ParserArenaDeletable {
     public:
-        ClauseListNode(JSGlobalData* globalData, CaseClauseNode* clause) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_clause(clause)
-        {
-        }
+        ClauseListNode(JSGlobalData*, CaseClauseNode*);
+        ClauseListNode(JSGlobalData*, ClauseListNode*, CaseClauseNode*);
 
-        ClauseListNode(JSGlobalData* globalData, ClauseListNode* clauseList, CaseClauseNode* clause) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_clause(clause)
-        {
-            clauseList->m_next = this;
-        }
-
-        virtual ~ClauseListNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        CaseClauseNode* getClause() const JSC_FAST_CALL { return m_clause.get(); }
-        ClauseListNode* getNext() const JSC_FAST_CALL { return m_next.get(); }
+        CaseClauseNode* getClause() const { return m_clause; }
+        ClauseListNode* getNext() const { return m_next; }
 
     private:
-        RefPtr<CaseClauseNode> m_clause;
-        RefPtr<ClauseListNode> m_next;
+        CaseClauseNode* m_clause;
+        ClauseListNode* m_next;
     };
 
-    class CaseBlockNode : public ParserRefCounted {
+    class CaseBlockNode : public ParserArenaDeletable {
     public:
-        CaseBlockNode(JSGlobalData* globalData, ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_list1(list1)
-            , m_defaultClause(defaultClause)
-            , m_list2(list2)
-        {
-        }
+        CaseBlockNode(JSGlobalData*, ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2);
 
-        virtual ~CaseBlockNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        RegisterID* emitBytecodeForBlock(BytecodeGenerator&, RegisterID* input, RegisterID* dst = 0) JSC_FAST_CALL;
+        RegisterID* emitBytecodeForBlock(BytecodeGenerator&, RegisterID* input, RegisterID* dst = 0);
 
     private:
         SwitchInfo::SwitchType tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num);
-        RefPtr<ClauseListNode> m_list1;
-        RefPtr<CaseClauseNode> m_defaultClause;
-        RefPtr<ClauseListNode> m_list2;
+        ClauseListNode* m_list1;
+        CaseClauseNode* m_defaultClause;
+        ClauseListNode* m_list2;
     };
 
     class SwitchNode : public StatementNode {
     public:
-        SwitchNode(JSGlobalData* globalData, ExpressionNode* expr, CaseBlockNode* block) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-            , m_block(block)
-        {
-        }
-
-        virtual ~SwitchNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        SwitchNode(JSGlobalData*, ExpressionNode*, CaseBlockNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<CaseBlockNode> m_block;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        CaseBlockNode* m_block;
     };
 
     struct ElementList {
@@ -2422,4 +1732,4 @@
 
 } // namespace JSC
 
-#endif // NODES_H_
+#endif // Nodes_h
diff --git a/JavaScriptCore/parser/Parser.cpp b/JavaScriptCore/parser/Parser.cpp
index 886a513..96f4ae6 100644
--- a/JavaScriptCore/parser/Parser.cpp
+++ b/JavaScriptCore/parser/Parser.cpp
@@ -39,7 +39,7 @@
 
 void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
 {
-    ASSERT(!m_sourceElements);
+    m_sourceElements = 0;
 
     int defaultErrLine;
     UString defaultErrMsg;
@@ -57,14 +57,13 @@
 
     int parseError = jscyyparse(globalData);
     bool lexError = lexer.sawError();
+    int lineNumber = lexer.lineNumber();
     lexer.clear();
 
-    ParserRefCounted::deleteNewObjects(globalData);
-
     if (parseError || lexError) {
-        *errLine = lexer.lineNo();
+        *errLine = lineNumber;
         *errMsg = "Parse error";
-        m_sourceElements.clear();
+        m_sourceElements = 0;
     }
 }
 
@@ -77,23 +76,26 @@
     parse(globalData, 0, 0);
     ASSERT(m_sourceElements);
 
-    functionBodyNode->adoptData(std::auto_ptr<ScopeNodeData>(new ScopeNodeData(m_sourceElements.get(),
-                                                                               m_varDeclarations ? &m_varDeclarations->data : 0, 
-                                                                               m_funcDeclarations ? &m_funcDeclarations->data : 0,
-                                                                               m_numConstants)));
+    functionBodyNode->adoptData(std::auto_ptr<ScopeNodeData>(new ScopeNodeData(globalData->parser->arena(),
+        m_sourceElements,
+        m_varDeclarations ? &m_varDeclarations->data : 0, 
+        m_funcDeclarations ? &m_funcDeclarations->data : 0,
+        m_numConstants)));
     bool usesArguments = functionBodyNode->usesArguments();
     functionBodyNode->setFeatures(m_features);
     if (usesArguments && !functionBodyNode->usesArguments())
         functionBodyNode->setUsesArguments();
 
+    ASSERT(globalData->parser->arena().isEmpty());
+
     m_source = 0;
     m_sourceElements = 0;
     m_varDeclarations = 0;
     m_funcDeclarations = 0;
 }
 
-void Parser::didFinishParsing(SourceElements* sourceElements, ParserRefCountedData<DeclarationStacks::VarStack>* varStack, 
-                              ParserRefCountedData<DeclarationStacks::FunctionStack>* funcStack, CodeFeatures features, int lastLine, int numConstants)
+void Parser::didFinishParsing(SourceElements* sourceElements, ParserArenaData<DeclarationStacks::VarStack>* varStack, 
+                              ParserArenaData<DeclarationStacks::FunctionStack>* funcStack, CodeFeatures features, int lastLine, int numConstants)
 {
     m_sourceElements = sourceElements;
     m_varDeclarations = varStack;
diff --git a/JavaScriptCore/parser/Parser.h b/JavaScriptCore/parser/Parser.h
index 6191ccb..6f4c2b7 100644
--- a/JavaScriptCore/parser/Parser.h
+++ b/JavaScriptCore/parser/Parser.h
@@ -23,9 +23,9 @@
 #ifndef Parser_h
 #define Parser_h
 
-#include "SourceProvider.h"
 #include "Debugger.h"
 #include "Nodes.h"
+#include "SourceProvider.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
@@ -37,15 +37,7 @@
     class ProgramNode;
     class UString;
 
-    template <typename T>
-    struct ParserRefCountedData : ParserRefCounted {
-        ParserRefCountedData(JSGlobalData* globalData)
-            : ParserRefCounted(globalData)
-        {
-        }
-
-        T data;
-    };
+    template <typename T> struct ParserArenaData : ParserArenaDeletable { T data; };
 
     class Parser : Noncopyable {
     public:
@@ -53,16 +45,19 @@
         template <class ParsedNode> PassRefPtr<ParsedNode> reparse(JSGlobalData*, ParsedNode*);
         void reparseInPlace(JSGlobalData*, FunctionBodyNode*);
 
-        void didFinishParsing(SourceElements*, ParserRefCountedData<DeclarationStacks::VarStack>*, 
-                              ParserRefCountedData<DeclarationStacks::FunctionStack>*, CodeFeatures features, int lastLine, int numConstants);
+        void didFinishParsing(SourceElements*, ParserArenaData<DeclarationStacks::VarStack>*, 
+                              ParserArenaData<DeclarationStacks::FunctionStack>*, CodeFeatures features, int lastLine, int numConstants);
+
+        ParserArena& arena() { return m_arena; }
 
     private:
         void parse(JSGlobalData*, int* errLine, UString* errMsg);
 
+        ParserArena m_arena;
         const SourceCode* m_source;
-        RefPtr<SourceElements> m_sourceElements;
-        RefPtr<ParserRefCountedData<DeclarationStacks::VarStack> > m_varDeclarations;
-        RefPtr<ParserRefCountedData<DeclarationStacks::FunctionStack> > m_funcDeclarations;
+        SourceElements* m_sourceElements;
+        ParserArenaData<DeclarationStacks::VarStack>* m_varDeclarations;
+        ParserArenaData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
         CodeFeatures m_features;
         int m_lastLine;
         int m_numConstants;
@@ -75,7 +70,7 @@
         RefPtr<ParsedNode> result;
         if (m_sourceElements) {
             result = ParsedNode::create(&exec->globalData(),
-                                         m_sourceElements.get(),
+                                         m_sourceElements,
                                          m_varDeclarations ? &m_varDeclarations->data : 0, 
                                          m_funcDeclarations ? &m_funcDeclarations->data : 0,
                                          *m_source,
@@ -84,8 +79,9 @@
             result->setLoc(m_source->firstLine(), m_lastLine);
         }
 
+        m_arena.reset();
+
         m_source = 0;
-        m_sourceElements = 0;
         m_varDeclarations = 0;
         m_funcDeclarations = 0;
 
@@ -101,7 +97,7 @@
         RefPtr<ParsedNode> result;
         if (m_sourceElements) {
             result = ParsedNode::create(globalData,
-                                        m_sourceElements.get(),
+                                        m_sourceElements,
                                         m_varDeclarations ? &m_varDeclarations->data : 0, 
                                         m_funcDeclarations ? &m_funcDeclarations->data : 0,
                                         *m_source,
@@ -110,8 +106,9 @@
             result->setLoc(m_source->firstLine(), m_lastLine);
         }
 
+        m_arena.reset();
+
         m_source = 0;
-        m_sourceElements = 0;
         m_varDeclarations = 0;
         m_funcDeclarations = 0;
 
diff --git a/WebCore/page/chromium/AXObjectCacheChromium.cpp b/JavaScriptCore/parser/ParserArena.cpp
similarity index 64%
copy from WebCore/page/chromium/AXObjectCacheChromium.cpp
copy to JavaScriptCore/parser/ParserArena.cpp
index bbaf21d..2617506 100644
--- a/WebCore/page/chromium/AXObjectCacheChromium.cpp
+++ b/JavaScriptCore/parser/ParserArena.cpp
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- * Copyright (C) 2008 Google Inc.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,34 +24,37 @@
  */
 
 #include "config.h"
-#include "AXObjectCache.h"
+#include "ParserArena.h"
 
-#include "AccessibilityObject.h"
+#include "Nodes.h"
 
-namespace WebCore {
+namespace JSC {
 
-void AXObjectCache::detachWrapper(AccessibilityObject* obj)
+ParserArena::~ParserArena()
 {
-    // In Chromium, AccessibilityObjects are wrapped lazily.
-    if (AccessibilityObjectWrapper* wrapper = obj->wrapper())
-        wrapper->detach();
+    deleteAllValues(m_deletableObjects);
 }
 
-void AXObjectCache::attachWrapper(AccessibilityObject*)
+bool ParserArena::contains(ParserArenaRefCounted* object) const
 {
-    // In Chromium, AccessibilityObjects are wrapped lazily.
+    return m_refCountedObjects.find(object) != notFound;
 }
 
-void AXObjectCache::postNotification(RenderObject*, const String&)
+ParserArenaRefCounted* ParserArena::last() const
 {
+    return m_refCountedObjects.last().get();
 }
 
-void AXObjectCache::postNotificationToElement(RenderObject*, const String&)
+void ParserArena::removeLast()
 {
+    m_refCountedObjects.removeLast();
 }
 
-void AXObjectCache::handleFocusedUIElementChanged()
+void ParserArena::reset()
 {
+    deleteAllValues(m_deletableObjects);
+    m_deletableObjects.shrink(0);
+    m_refCountedObjects.shrink(0);
 }
 
-} // namespace WebCore
+}
diff --git a/JavaScriptCore/parser/ParserArena.h b/JavaScriptCore/parser/ParserArena.h
new file mode 100644
index 0000000..66c8529
--- /dev/null
+++ b/JavaScriptCore/parser/ParserArena.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ParserArena_h
+#define ParserArena_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+    class ParserArenaDeletable;
+    class ParserArenaRefCounted;
+
+    class ParserArena {
+    public:
+        void swap(ParserArena& otherArena)
+        {
+            m_deletableObjects.swap(otherArena.m_deletableObjects);
+            m_refCountedObjects.swap(otherArena.m_refCountedObjects);
+        }
+        ~ParserArena();
+
+        void deleteWithArena(ParserArenaDeletable* object) { m_deletableObjects.append(object); }
+        void derefWithArena(PassRefPtr<ParserArenaRefCounted> object) { m_refCountedObjects.append(object); }
+
+        bool contains(ParserArenaRefCounted*) const;
+        ParserArenaRefCounted* last() const;
+        void removeLast();
+
+        bool isEmpty() const { return m_deletableObjects.isEmpty() && m_refCountedObjects.isEmpty(); }
+        void reset();
+
+    private:
+        Vector<ParserArenaDeletable*> m_deletableObjects;
+        Vector<RefPtr<ParserArenaRefCounted> > m_refCountedObjects;
+    };
+
+}
+
+#endif
diff --git a/JavaScriptCore/parser/ResultType.h b/JavaScriptCore/parser/ResultType.h
index 3e7fddb..27b8112 100644
--- a/JavaScriptCore/parser/ResultType.h
+++ b/JavaScriptCore/parser/ResultType.h
@@ -63,6 +63,11 @@
             return (m_type & TypeBits) == TypeMaybeNumber;
         }
         
+        bool definitelyIsString()
+        {
+            return (m_type & TypeBits) == TypeMaybeString;
+        }
+
         bool mightBeNumber()
         {
             return m_type & TypeMaybeNumber;
@@ -117,7 +122,7 @@
         {
             if (op1.definitelyIsNumber() && op2.definitelyIsNumber())
                 return numberTypeCanReuse();
-            if (op1.isNotNumber() || op2.isNotNumber())
+            if (op1.definitelyIsString() || op2.definitelyIsString())
                 return stringType();
             return stringOrNumberTypeCanReuse();
         }
diff --git a/JavaScriptCore/parser/SourceProvider.h b/JavaScriptCore/parser/SourceProvider.h
index 07da9e0..1c59eed 100644
--- a/JavaScriptCore/parser/SourceProvider.h
+++ b/JavaScriptCore/parser/SourceProvider.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,10 +34,13 @@
 
 namespace JSC {
 
+    enum SourceBOMPresence { SourceHasNoBOMs, SourceCouldHaveBOMs };
+
     class SourceProvider : public RefCounted<SourceProvider> {
     public:
-        SourceProvider(const UString& url)
+        SourceProvider(const UString& url, SourceBOMPresence hasBOMs = SourceCouldHaveBOMs)
             : m_url(url)
+            , m_hasBOMs(hasBOMs)
         {
         }
         virtual ~SourceProvider() { }
@@ -49,8 +52,11 @@
         const UString& url() { return m_url; }
         intptr_t asID() { return reinterpret_cast<intptr_t>(this); }
 
+        SourceBOMPresence hasBOMs() const { return m_hasBOMs; }
+
     private:
         UString m_url;
+        SourceBOMPresence m_hasBOMs;
     };
 
     class UStringSourceProvider : public SourceProvider {
diff --git a/JavaScriptCore/pcre/dftables b/JavaScriptCore/pcre/dftables
index de2f5bb..8a2d140 100755
--- a/JavaScriptCore/pcre/dftables
+++ b/JavaScriptCore/pcre/dftables
@@ -244,7 +244,7 @@
  
     my ($fh, $tempFile) = tempfile(
         basename($0) . "-XXXXXXXX",
-        DIR => ($ENV{'TMPDIR'} || "/tmp"),
+        DIR => File::Spec->tmpdir,
         SUFFIX => ".in",
         UNLINK => 0,
     );
diff --git a/JavaScriptCore/pcre/pcre_compile.cpp b/JavaScriptCore/pcre/pcre_compile.cpp
index 18c54ff..2bedca6 100644
--- a/JavaScriptCore/pcre/pcre_compile.cpp
+++ b/JavaScriptCore/pcre/pcre_compile.cpp
@@ -2216,7 +2216,7 @@
                         
                         int d = -1;
                         if (safelyCheckNextChar(ptr, patternEnd, '-')) {
-                            UChar const *hyptr = ptr++;
+                            const UChar* hyptr = ptr++;
                             if (safelyCheckNextChar(ptr, patternEnd, '\\')) {
                                 ptr++;
                                 d = checkEscape(&ptr, patternEnd, &errorcode, cd.numCapturingBrackets, true);
diff --git a/JavaScriptCore/pcre/pcre_exec.cpp b/JavaScriptCore/pcre/pcre_exec.cpp
index 80a092a..af770f3 100644
--- a/JavaScriptCore/pcre/pcre_exec.cpp
+++ b/JavaScriptCore/pcre/pcre_exec.cpp
@@ -50,7 +50,7 @@
 #include <wtf/Vector.h>
 
 #if REGEXP_HISTOGRAM
-#include <parser/DateMath.h>
+#include <wtf/DateMath.h>
 #include <runtime/UString.h>
 #endif
 
diff --git a/JavaScriptCore/profiler/CallIdentifier.h b/JavaScriptCore/profiler/CallIdentifier.h
index 6ceef13..c2c25d5 100644
--- a/JavaScriptCore/profiler/CallIdentifier.h
+++ b/JavaScriptCore/profiler/CallIdentifier.h
@@ -51,32 +51,34 @@
         inline bool operator==(const CallIdentifier& ci) const { return ci.m_lineNumber == m_lineNumber && ci.m_name == m_name && ci.m_url == m_url; }
         inline bool operator!=(const CallIdentifier& ci) const { return !(*this == ci); }
 
+        struct Hash {
+            static unsigned hash(const CallIdentifier& key)
+            {
+                unsigned hashCodes[3] = {
+                    key.m_name.rep()->hash(),
+                    key.m_url.rep()->hash(),
+                    key.m_lineNumber
+                };
+                return UString::Rep::computeHash(reinterpret_cast<char*>(hashCodes), sizeof(hashCodes));
+            }
+
+            static bool equal(const CallIdentifier& a, const CallIdentifier& b) { return a == b; }
+            static const bool safeToCompareToEmptyOrDeleted = true;
+        };
+
+        unsigned hash() const { return Hash::hash(*this); }
+
 #ifndef NDEBUG
         operator const char*() const { return c_str(); }
         const char* c_str() const { return m_name.UTF8String().c_str(); }
 #endif
     };
 
-    struct CallIdentifierHash {
-        static unsigned hash(const CallIdentifier& key)
-        {
-            unsigned hashCodes[3] = {
-                key.m_name.rep()->hash(),
-                key.m_url.rep()->hash(),
-                key.m_lineNumber
-            };
-            return UString::Rep::computeHash(reinterpret_cast<char*>(hashCodes), sizeof(hashCodes));
-        }
-
-        static bool equal(const CallIdentifier& a, const CallIdentifier& b) { return a == b; }
-        static const bool safeToCompareToEmptyOrDeleted = true;
-    };
-
 } // namespace JSC
 
 namespace WTF {
 
-    template<> struct DefaultHash<JSC::CallIdentifier> { typedef JSC::CallIdentifierHash Hash; };
+    template<> struct DefaultHash<JSC::CallIdentifier> { typedef JSC::CallIdentifier::Hash Hash; };
 
     template<> struct HashTraits<JSC::CallIdentifier> : GenericHashTraits<JSC::CallIdentifier> {
         static void constructDeletedValue(JSC::CallIdentifier& slot)
diff --git a/JavaScriptCore/profiler/HeavyProfile.cpp b/JavaScriptCore/profiler/HeavyProfile.cpp
index 5ea9d3b..e69de29 100644
--- a/JavaScriptCore/profiler/HeavyProfile.cpp
+++ b/JavaScriptCore/profiler/HeavyProfile.cpp
@@ -1,115 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "HeavyProfile.h"
-
-#include "TreeProfile.h"
-
-namespace JSC {
-
-HeavyProfile::HeavyProfile(TreeProfile* treeProfile)
-    : Profile(treeProfile->title(), treeProfile->uid())
-{
-    m_treeProfile = treeProfile;
-    head()->setTotalTime(m_treeProfile->head()->actualTotalTime());
-    head()->setSelfTime(m_treeProfile->head()->actualSelfTime());
-    generateHeavyStructure();
-}
-
-void HeavyProfile::generateHeavyStructure()
-{
-    ProfileNode* treeHead = m_treeProfile->head();
-    ProfileNode* currentNode = treeHead->firstChild();
-    for (ProfileNode* nextNode = currentNode; nextNode; nextNode = nextNode->firstChild())
-        currentNode = nextNode;
-
-    // For each node
-    HashMap<CallIdentifier, ProfileNode*> foundChildren;
-    while (currentNode && currentNode != treeHead) {
-        ProfileNode* child = foundChildren.get(currentNode->callIdentifier());
-        if (child) // currentNode is in the set already
-            mergeProfiles(child, currentNode);
-        else { // currentNode is not in the set
-            child = addNode(currentNode);
-            foundChildren.set(currentNode->callIdentifier(), child);
-        }
-
-        currentNode = currentNode->traverseNextNodePostOrder();
-    }
-}
-
-ProfileNode* HeavyProfile::addNode(ProfileNode* currentNode)
-{
-    RefPtr<ProfileNode> node = ProfileNode::create(head(), currentNode);
-    head()->addChild(node);
-
-    addAncestorsAsChildren(currentNode->parent(), node.get());
-    return node.get();
-}
-
-void HeavyProfile::mergeProfiles(ProfileNode* heavyProfileHead, ProfileNode* treeProfileHead)
-{
-    ASSERT_ARG(heavyProfileHead, heavyProfileHead);
-    ASSERT_ARG(treeProfileHead, treeProfileHead);
-
-    ProfileNode* currentTreeNode = treeProfileHead;
-    ProfileNode* currentHeavyNode = heavyProfileHead;
-    ProfileNode* previousHeavyNode = 0;
-    
-    while (currentHeavyNode) {
-        previousHeavyNode = currentHeavyNode;
-
-        currentHeavyNode->setTotalTime(currentHeavyNode->actualTotalTime() + currentTreeNode->actualTotalTime());
-        currentHeavyNode->setSelfTime(currentHeavyNode->actualSelfTime() + currentTreeNode->actualSelfTime());
-        currentHeavyNode->setNumberOfCalls(currentHeavyNode->numberOfCalls() + currentTreeNode->numberOfCalls());
-
-        currentTreeNode = currentTreeNode->parent();
-        currentHeavyNode = currentHeavyNode->findChild(currentTreeNode);
-    }
-
-    // If currentTreeNode is null then we already have the whole tree we wanted to copy.
-    // If not we need to copy the subset of the tree that remains different between the two.
-    if (currentTreeNode)
-        addAncestorsAsChildren(currentTreeNode, previousHeavyNode);
-}
-
-void HeavyProfile::addAncestorsAsChildren(ProfileNode* getFrom, ProfileNode* addTo)
-{
-    ASSERT_ARG(getFrom, getFrom);
-    ASSERT_ARG(addTo, addTo);
-
-    if (!getFrom->head())
-        return;
-
-    RefPtr<ProfileNode> currentNode = addTo;
-    for (ProfileNode* treeAncestor = getFrom; treeAncestor && treeAncestor != getFrom->head(); treeAncestor = treeAncestor->parent()) {
-        RefPtr<ProfileNode> newChild = ProfileNode::create(currentNode->head(), treeAncestor);
-        currentNode->addChild(newChild);
-        currentNode = newChild.release();
-    }
-}
-
-}   // namespace JSC
diff --git a/JavaScriptCore/profiler/HeavyProfile.h b/JavaScriptCore/profiler/HeavyProfile.h
index 903d091..e69de29 100644
--- a/JavaScriptCore/profiler/HeavyProfile.h
+++ b/JavaScriptCore/profiler/HeavyProfile.h
@@ -1,63 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
- 
-#ifndef HeavyProfile_h
-#define HeavyProfile_h
-
-#include "Profile.h"
-#include "ProfileNode.h"
-#include "TreeProfile.h"
-
-namespace JSC {
-
-    class UString;
-
-    class HeavyProfile : public Profile {
-    public:
-        static PassRefPtr<HeavyProfile> create(TreeProfile* treeProfile)
-        {
-            return adoptRef(new HeavyProfile(treeProfile));
-        }
-
-        virtual Profile* heavyProfile() { return this; }
-        virtual Profile* treeProfile()
-        {
-            return m_treeProfile;
-        }
-
-
-    private:
-        HeavyProfile(TreeProfile*);
-        void generateHeavyStructure();
-        ProfileNode* addNode(ProfileNode*);
-        void mergeProfiles(ProfileNode* heavyProfileHead, ProfileNode* treeProfileHead);
-        void addAncestorsAsChildren(ProfileNode* getFrom, ProfileNode* addTo);
-
-        TreeProfile* m_treeProfile;
-    };
-
-} // namespace JSC
-
-#endif // HeavyProfile_h
diff --git a/JavaScriptCore/profiler/Profile.cpp b/JavaScriptCore/profiler/Profile.cpp
index fd32e1c..0a290ce 100644
--- a/JavaScriptCore/profiler/Profile.cpp
+++ b/JavaScriptCore/profiler/Profile.cpp
@@ -27,7 +27,6 @@
 #include "Profile.h"
 
 #include "ProfileNode.h"
-#include "TreeProfile.h"
 #include <stdio.h>
 
 #if PLATFORM(ANDROID)
@@ -41,7 +40,7 @@
 
 PassRefPtr<Profile> Profile::create(const UString& title, unsigned uid)
 {
-    return TreeProfile::create(title, uid);
+    return adoptRef(new Profile(title, uid));
 }
 
 Profile::Profile(const UString& title, unsigned uid)
diff --git a/JavaScriptCore/profiler/Profile.h b/JavaScriptCore/profiler/Profile.h
index dd96f77..6bf29f7 100644
--- a/JavaScriptCore/profiler/Profile.h
+++ b/JavaScriptCore/profiler/Profile.h
@@ -45,22 +45,11 @@
         unsigned int uid() const { return m_uid; }
 
         void forEach(void (ProfileNode::*)());
-        void sortTotalTimeDescending() { forEach(&ProfileNode::sortTotalTimeDescending); }
-        void sortTotalTimeAscending() { forEach(&ProfileNode::sortTotalTimeAscending); }
-        void sortSelfTimeDescending() { forEach(&ProfileNode::sortSelfTimeDescending); }
-        void sortSelfTimeAscending() { forEach(&ProfileNode::sortSelfTimeAscending); }
-        void sortCallsDescending() { forEach(&ProfileNode::sortCallsDescending); }
-        void sortCallsAscending() { forEach(&ProfileNode::sortCallsAscending); }
-        void sortFunctionNameDescending() { forEach(&ProfileNode::sortFunctionNameDescending); }
-        void sortFunctionNameAscending() { forEach(&ProfileNode::sortFunctionNameAscending); }
 
         void focus(const ProfileNode*);
         void exclude(const ProfileNode*);
         void restoreAll();
 
-        virtual Profile* heavyProfile() = 0;
-        virtual Profile* treeProfile() = 0; 
-
 #ifndef NDEBUG
         void debugPrintData() const;
         void debugPrintDataSampleStyle() const;
diff --git a/JavaScriptCore/profiler/ProfileGenerator.cpp b/JavaScriptCore/profiler/ProfileGenerator.cpp
index b1d5d48..1a061cb 100644
--- a/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -59,7 +59,7 @@
     int lineNumber;
     intptr_t sourceID;
     UString sourceURL;
-    JSValuePtr function;
+    JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, lineNumber, sourceID, sourceURL, function);
     m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(&exec->globalData(), function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
diff --git a/JavaScriptCore/profiler/ProfileGenerator.h b/JavaScriptCore/profiler/ProfileGenerator.h
index 54d4565..cccb502 100644
--- a/JavaScriptCore/profiler/ProfileGenerator.h
+++ b/JavaScriptCore/profiler/ProfileGenerator.h
@@ -26,6 +26,7 @@
 #ifndef ProfileGenerator_h
 #define ProfileGenerator_h
 
+#include "Profile.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
diff --git a/JavaScriptCore/profiler/ProfileNode.cpp b/JavaScriptCore/profiler/ProfileNode.cpp
index 3458902..19050aa 100644
--- a/JavaScriptCore/profiler/ProfileNode.cpp
+++ b/JavaScriptCore/profiler/ProfileNode.cpp
@@ -29,9 +29,9 @@
 #include "config.h"
 #include "ProfileNode.h"
 
-#include "DateMath.h"
 #include "Profiler.h"
 #include <stdio.h>
+#include <wtf/DateMath.h>
 
 #if PLATFORM(WIN_OS)
 #include <windows.h>
@@ -49,7 +49,7 @@
     QueryPerformanceCounter(&counter);
     return static_cast<double>(counter.QuadPart) / frequency.QuadPart;
 #else
-    return getCurrentUTCTimeWithMicroseconds();
+    return WTF::getCurrentUTCTimeWithMicroseconds();
 #endif
 }
 
@@ -204,12 +204,6 @@
     return next;
 }
 
-void ProfileNode::sort(bool comparator(const RefPtr<ProfileNode>& , const RefPtr<ProfileNode>& ))
-{
-    std::sort(childrenBegin(), childrenEnd(), comparator);    
-    resetChildrensSiblings();
-}
-
 void ProfileNode::setTreeVisible(ProfileNode* node, bool visible)
 {
     ProfileNode* nodeParent = node->parent();
diff --git a/JavaScriptCore/profiler/ProfileNode.h b/JavaScriptCore/profiler/ProfileNode.h
index b416011..2b5a936 100644
--- a/JavaScriptCore/profiler/ProfileNode.h
+++ b/JavaScriptCore/profiler/ProfileNode.h
@@ -112,16 +112,6 @@
         ProfileNode* traverseNextNodePostOrder() const;
         ProfileNode* traverseNextNodePreOrder(bool processChildren = true) const;
 
-        void sort(bool (*)(const RefPtr<ProfileNode>&, const RefPtr<ProfileNode>&));
-        void sortTotalTimeDescending() { sort(totalTimeDescendingComparator); }
-        void sortTotalTimeAscending() { sort(totalTimeAscendingComparator); }
-        void sortSelfTimeDescending() { sort(selfTimeDescendingComparator); }
-        void sortSelfTimeAscending() { sort(selfTimeAscendingComparator); }
-        void sortCallsDescending() { sort(callsDescendingComparator); }
-        void sortCallsAscending() { sort(callsAscendingComparator); }
-        void sortFunctionNameDescending() { sort(functionNameDescendingComparator); }
-        void sortFunctionNameAscending() { sort(functionNameAscendingComparator); }
-
         // Views
         void calculateVisibleTotalTime();
         bool focus(const CallIdentifier&);
diff --git a/JavaScriptCore/profiler/Profiler.cpp b/JavaScriptCore/profiler/Profiler.cpp
index ace0a33..e103fd1 100644
--- a/JavaScriptCore/profiler/Profiler.cpp
+++ b/JavaScriptCore/profiler/Profiler.cpp
@@ -33,6 +33,7 @@
 #include "CallFrame.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
+#include "Nodes.h"
 #include "Profile.h"
 #include "ProfileGenerator.h"
 #include "ProfileNode.h"
@@ -103,7 +104,7 @@
     }
 }
 
-void Profiler::willExecute(ExecState* exec, JSValuePtr function)
+void Profiler::willExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
@@ -114,12 +115,12 @@
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    CallIdentifier callIdentifier = createCallIdentifier(&exec->globalData(), noValue(), sourceURL, startingLineNumber);
+    CallIdentifier callIdentifier = createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber);
 
     dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, callIdentifier, exec->lexicalGlobalObject()->profileGroup());
 }
 
-void Profiler::didExecute(ExecState* exec, JSValuePtr function)
+void Profiler::didExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
@@ -130,17 +131,20 @@
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), noValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
 }
 
-CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValuePtr function, const UString& defaultSourceURL, int defaultLineNumber)
+CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue function, const UString& defaultSourceURL, int defaultLineNumber)
 {
     if (!function)
         return CallIdentifier(GlobalCodeExecution, defaultSourceURL, defaultLineNumber);
     if (!function.isObject())
         return CallIdentifier("(unknown)", defaultSourceURL, defaultLineNumber);
-    if (asObject(function)->inherits(&JSFunction::info))
-        return createCallIdentifierFromFunctionImp(globalData, asFunction(function));
+    if (asObject(function)->inherits(&JSFunction::info)) {
+        JSFunction* func = asFunction(function);
+        if (!func->isHostFunction())
+            return createCallIdentifierFromFunctionImp(globalData, func);
+    }
     if (asObject(function)->inherits(&InternalFunction::info))
         return CallIdentifier(static_cast<InternalFunction*>(asObject(function))->name(globalData), defaultSourceURL, defaultLineNumber);
     return CallIdentifier("(" + asObject(function)->className() + " object)", defaultSourceURL, defaultLineNumber);
@@ -148,7 +152,7 @@
 
 CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData* globalData, JSFunction* function)
 {
-    const UString& name = function->name(globalData);
+    const UString& name = function->calculatedDisplayName(globalData);
     return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, function->body()->sourceURL(), function->body()->lineNo());
 }
 
diff --git a/JavaScriptCore/profiler/Profiler.h b/JavaScriptCore/profiler/Profiler.h
index d00bccf..b37f613 100644
--- a/JavaScriptCore/profiler/Profiler.h
+++ b/JavaScriptCore/profiler/Profiler.h
@@ -40,7 +40,7 @@
     class ExecState;
     class JSGlobalData;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class ProfileGenerator;
     class UString;
 
@@ -52,14 +52,14 @@
         }
 
         static Profiler* profiler(); 
-        static CallIdentifier createCallIdentifier(JSGlobalData*, JSValuePtr, const UString& sourceURL, int lineNumber);
+        static CallIdentifier createCallIdentifier(JSGlobalData*, JSValue, const UString& sourceURL, int lineNumber);
 
         void startProfiling(ExecState*, const UString& title);
         PassRefPtr<Profile> stopProfiling(ExecState*, const UString& title);
 
-        void willExecute(ExecState*, JSValuePtr function);
+        void willExecute(ExecState*, JSValue function);
         void willExecute(ExecState*, const UString& sourceURL, int startingLineNumber);
-        void didExecute(ExecState*, JSValuePtr function);
+        void didExecute(ExecState*, JSValue function);
         void didExecute(ExecState*, const UString& sourceURL, int startingLineNumber);
 
         const Vector<RefPtr<ProfileGenerator> >& currentProfiles() { return m_currentProfiles; };
diff --git a/JavaScriptCore/profiler/ProfilerServer.mm b/JavaScriptCore/profiler/ProfilerServer.mm
index ef16f4c..a3944de 100644
--- a/JavaScriptCore/profiler/ProfilerServer.mm
+++ b/JavaScriptCore/profiler/ProfilerServer.mm
@@ -28,9 +28,12 @@
 
 #import "JSProfilerPrivate.h"
 #import "JSRetainPtr.h"
-
 #import <Foundation/Foundation.h>
 
+#if PLATFORM(IPHONE_SIMULATOR)
+#import <Foundation/NSDistributedNotificationCenter.h>
+#endif
+
 @interface ProfilerServer : NSObject {
 @private
     NSString *_serverName;
@@ -62,16 +65,22 @@
     if ([defaults boolForKey:@"EnableJSProfiling"])
         [self startProfiling];
 
+#if !PLATFORM(IPHONE) || PLATFORM(IPHONE_SIMULATOR)
+    // FIXME: <rdar://problem/6546135>
     // The catch-all notifications
     [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(startProfiling) name:@"ProfilerServerStartNotification" object:nil];
     [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(stopProfiling) name:@"ProfilerServerStopNotification" object:nil];
+#endif
 
     // The specific notifications
     NSProcessInfo *processInfo = [NSProcessInfo processInfo];
     _serverName = [[NSString alloc] initWithFormat:@"ProfilerServer-%d", [processInfo processIdentifier]];
 
+#if !PLATFORM(IPHONE) || PLATFORM(IPHONE_SIMULATOR)
+    // FIXME: <rdar://problem/6546135>
     [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(startProfiling) name:[_serverName stringByAppendingString:@"-Start"] object:nil];
     [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(stopProfiling) name:[_serverName stringByAppendingString:@"-Stop"] object:nil];
+#endif
 
     [pool drain];
 
diff --git a/JavaScriptCore/profiler/TreeProfile.cpp b/JavaScriptCore/profiler/TreeProfile.cpp
index 0c7fedb..e69de29 100644
--- a/JavaScriptCore/profiler/TreeProfile.cpp
+++ b/JavaScriptCore/profiler/TreeProfile.cpp
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "TreeProfile.h"
-
-#include "HeavyProfile.h"
-
-namespace JSC {
-
-PassRefPtr<TreeProfile> TreeProfile::create(const UString& title, unsigned uid)
-{
-    return adoptRef(new TreeProfile(title, uid));
-}
-
-TreeProfile::TreeProfile(const UString& title, unsigned uid)
-    : Profile(title, uid)
-{
-}
-
-Profile* TreeProfile::heavyProfile()
-{
-    if (!m_heavyProfile)
-        m_heavyProfile = HeavyProfile::create(this);
-
-    return m_heavyProfile.get();
-}
-
-} // namespace JSC
diff --git a/JavaScriptCore/profiler/TreeProfile.h b/JavaScriptCore/profiler/TreeProfile.h
index ebef4d8..e69de29 100644
--- a/JavaScriptCore/profiler/TreeProfile.h
+++ b/JavaScriptCore/profiler/TreeProfile.h
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
- 
-#ifndef TreeProfile_h
-#define TreeProfile_h
-
-#include "Profile.h"
-
-namespace JSC {
-
-    class ExecState;
-    class HeavyProfile;
-    class UString;
-
-    class TreeProfile : public Profile {
-    public:
-        static PassRefPtr<TreeProfile> create(const UString& title, unsigned uid);
-
-        virtual Profile* heavyProfile();
-        virtual Profile* treeProfile() { return this; }
-
-    private:
-        TreeProfile(const UString& title, unsigned uid);
-        RefPtr<HeavyProfile> m_heavyProfile;
-    };
-
-} // namespace JSC
-
-#endif // TreeProfiler_h
diff --git a/JavaScriptCore/runtime/ArgList.cpp b/JavaScriptCore/runtime/ArgList.cpp
index 5ead733..0b5d958 100644
--- a/JavaScriptCore/runtime/ArgList.cpp
+++ b/JavaScriptCore/runtime/ArgList.cpp
@@ -30,19 +30,18 @@
 
 void ArgList::getSlice(int startIndex, ArgList& result) const
 {
-    ASSERT(!result.m_isReadOnly);
-
-    const_iterator start = min(begin() + startIndex, end());
-    result.m_vector.appendRange(start, end());
-    result.m_size = result.m_vector.size();
-    result.m_buffer = result.m_vector.data();
+    if (startIndex <= 0 || static_cast<unsigned>(startIndex) >= m_argCount) {
+        result = ArgList(m_args, 0);
+        return;
+    }
+    result = ArgList(m_args + startIndex, m_argCount - startIndex);
 }
 
-void ArgList::markLists(ListSet& markSet)
+void MarkedArgumentBuffer::markLists(ListSet& markSet)
 {
     ListSet::iterator end = markSet.end();
     for (ListSet::iterator it = markSet.begin(); it != end; ++it) {
-        ArgList* list = *it;
+        MarkedArgumentBuffer* list = *it;
 
         iterator end2 = list->end();
         for (iterator it2 = list->begin(); it2 != end2; ++it2)
@@ -51,7 +50,7 @@
     }
 }
 
-void ArgList::slowAppend(JSValuePtr v)
+void MarkedArgumentBuffer::slowAppend(JSValue v)
 {
     // As long as our size stays within our Vector's inline 
     // capacity, all our values are allocated on the stack, and 
diff --git a/JavaScriptCore/runtime/ArgList.h b/JavaScriptCore/runtime/ArgList.h
index a1763e0..8e85d7f 100644
--- a/JavaScriptCore/runtime/ArgList.h
+++ b/JavaScriptCore/runtime/ArgList.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008 Apple Computer, Inc.
+ *  Copyright (C) 2003, 2007, 2008, 2009 Apple Computer, Inc.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -31,11 +31,11 @@
 
 namespace JSC {
     
-    class ArgList : Noncopyable {
+    class MarkedArgumentBuffer : Noncopyable {
     private:
         static const unsigned inlineCapacity = 8;
         typedef Vector<Register, inlineCapacity> VectorType;
-        typedef HashSet<ArgList*> ListSet;
+        typedef HashSet<MarkedArgumentBuffer*> ListSet;
 
     public:
         typedef VectorType::iterator iterator;
@@ -43,7 +43,7 @@
 
         // Constructor for a read-write list, to which you may append values.
         // FIXME: Remove all clients of this API, then remove this API.
-        ArgList()
+        MarkedArgumentBuffer()
             : m_markSet(0)
 #ifndef NDEBUG
             , m_isReadOnly(false)
@@ -54,7 +54,7 @@
         }
 
         // Constructor for a read-only list whose data has already been allocated elsewhere.
-        ArgList(Register* buffer, size_t size)
+        MarkedArgumentBuffer(Register* buffer, size_t size)
             : m_buffer(buffer)
             , m_size(size)
             , m_markSet(0)
@@ -76,7 +76,7 @@
 #endif
         }
 
-        ~ArgList()
+        ~MarkedArgumentBuffer()
         {
             if (m_markSet)
                 m_markSet->remove(this);
@@ -85,10 +85,10 @@
         size_t size() const { return m_size; }
         bool isEmpty() const { return !m_size; }
 
-        JSValuePtr at(ExecState* exec, size_t i) const
+        JSValue at(size_t i) const
         {
             if (i < m_size)
-                return m_buffer[i].jsValue(exec);
+                return m_buffer[i].jsValue();
             return jsUndefined();
         }
 
@@ -99,7 +99,7 @@
             m_size = 0;
         }
 
-        void append(JSValuePtr v)
+        void append(JSValue v)
         {
             ASSERT(!m_isReadOnly);
             
@@ -114,8 +114,6 @@
             }
         }
 
-        void getSlice(int startIndex, ArgList& result) const;
-
         iterator begin() { return m_buffer; }
         iterator end() { return m_buffer + m_size; }
 
@@ -125,7 +123,7 @@
         static void markLists(ListSet&);
 
     private:
-        void slowAppend(JSValuePtr);
+        void slowAppend(JSValue);
         
         Register* m_buffer;
         size_t m_size;
@@ -156,6 +154,60 @@
         void operator delete(void*, size_t);
     };
 
+    class ArgList {
+        friend class JIT;
+    public:
+        typedef JSValue* iterator;
+        typedef const JSValue* const_iterator;
+
+        ArgList()
+            : m_args(0)
+            , m_argCount(0)
+        {
+        }
+        
+        ArgList(JSValue* args, unsigned argCount)
+            : m_args(args)
+            , m_argCount(argCount)
+        {
+        }
+        
+        ArgList(Register* args, int argCount)
+            : m_args(reinterpret_cast<JSValue*>(args))
+            , m_argCount(argCount)
+        {
+            ASSERT(argCount >= 0);
+        }
+
+        ArgList(const MarkedArgumentBuffer& args)
+            : m_args(reinterpret_cast<JSValue*>(const_cast<Register*>(args.begin())))
+            , m_argCount(args.size())
+        {
+        }
+
+        JSValue at(size_t idx) const
+        {
+            if (idx < m_argCount)
+                return m_args[idx];
+            return jsUndefined();
+        }
+
+        bool isEmpty() const { return !m_argCount; }
+
+        size_t size() const { return m_argCount; }
+        
+        iterator begin() { return m_args; }
+        iterator end() { return m_args + m_argCount; }
+        
+        const_iterator begin() const { return m_args; }
+        const_iterator end() const { return m_args + m_argCount; }
+
+        void getSlice(int startIndex, ArgList& result) const;
+    private:
+        JSValue* m_args;
+        size_t m_argCount;
+    };
+
 } // namespace JSC
 
 #endif // ArgList_h
diff --git a/JavaScriptCore/runtime/Arguments.cpp b/JavaScriptCore/runtime/Arguments.cpp
index ea4b4f0..f867fe8 100644
--- a/JavaScriptCore/runtime/Arguments.cpp
+++ b/JavaScriptCore/runtime/Arguments.cpp
@@ -69,14 +69,49 @@
         d->activation->mark();
 }
 
-void Arguments::fillArgList(ExecState* exec, ArgList& args)
+void Arguments::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize)
+{
+    if (UNLIKELY(d->overrodeLength)) {
+        unsigned length = min(get(exec, exec->propertyNames().length).toUInt32(exec), maxSize);
+        for (unsigned i = 0; i < length; i++)
+            buffer[i] = get(exec, i);
+        return;
+    }
+
+    if (LIKELY(!d->deletedArguments)) {
+        unsigned parametersLength = min(min(d->numParameters, d->numArguments), maxSize);
+        unsigned i = 0;
+        for (; i < parametersLength; ++i)
+            buffer[i] = d->registers[d->firstParameterIndex + i].jsValue();
+        for (; i < d->numArguments; ++i)
+            buffer[i] = d->extraArguments[i - d->numParameters].jsValue();
+        return;
+    }
+    
+    unsigned parametersLength = min(min(d->numParameters, d->numArguments), maxSize);
+    unsigned i = 0;
+    for (; i < parametersLength; ++i) {
+        if (!d->deletedArguments[i])
+            buffer[i] = d->registers[d->firstParameterIndex + i].jsValue();
+        else
+            buffer[i] = get(exec, i);
+    }
+    for (; i < d->numArguments; ++i) {
+        if (!d->deletedArguments[i])
+            buffer[i] = d->extraArguments[i - d->numParameters].jsValue();
+        else
+            buffer[i] = get(exec, i);
+    }
+}
+
+void Arguments::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 {
     if (UNLIKELY(d->overrodeLength)) {
         unsigned length = get(exec, exec->propertyNames().length).toUInt32(exec); 
         for (unsigned i = 0; i < length; i++) 
             args.append(get(exec, i)); 
         return;
-   }
+    }
 
     if (LIKELY(!d->deletedArguments)) {
         if (LIKELY(!d->numParameters)) {
@@ -92,9 +127,9 @@
         unsigned parametersLength = min(d->numParameters, d->numArguments);
         unsigned i = 0;
         for (; i < parametersLength; ++i)
-            args.append(d->registers[d->firstParameterIndex + i].jsValue(exec));
+            args.append(d->registers[d->firstParameterIndex + i].jsValue());
         for (; i < d->numArguments; ++i)
-            args.append(d->extraArguments[i - d->numParameters].jsValue(exec));
+            args.append(d->extraArguments[i - d->numParameters].jsValue());
         return;
     }
 
@@ -102,13 +137,13 @@
     unsigned i = 0;
     for (; i < parametersLength; ++i) {
         if (!d->deletedArguments[i])
-            args.append(d->registers[d->firstParameterIndex + i].jsValue(exec));
+            args.append(d->registers[d->firstParameterIndex + i].jsValue());
         else
             args.append(get(exec, i));
     }
     for (; i < d->numArguments; ++i) {
         if (!d->deletedArguments[i])
-            args.append(d->extraArguments[i - d->numParameters].jsValue(exec));
+            args.append(d->extraArguments[i - d->numParameters].jsValue());
         else
             args.append(get(exec, i));
     }
@@ -120,7 +155,7 @@
         if (i < d->numParameters) {
             slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
         } else
-            slot.setValue(d->extraArguments[i - d->numParameters].jsValue(exec));
+            slot.setValue(d->extraArguments[i - d->numParameters].jsValue());
         return true;
     }
 
@@ -135,7 +170,7 @@
         if (i < d->numParameters) {
             slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
         } else
-            slot.setValue(d->extraArguments[i - d->numParameters].jsValue(exec));
+            slot.setValue(d->extraArguments[i - d->numParameters].jsValue());
         return true;
     }
 
@@ -152,28 +187,28 @@
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void Arguments::put(ExecState* exec, unsigned i, JSValuePtr value, PutPropertySlot& slot)
+void Arguments::put(ExecState* exec, unsigned i, JSValue value, PutPropertySlot& slot)
 {
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters)
-            d->registers[d->firstParameterIndex + i] = JSValuePtr(value);
+            d->registers[d->firstParameterIndex + i] = JSValue(value);
         else
-            d->extraArguments[i - d->numParameters] = JSValuePtr(value);
+            d->extraArguments[i - d->numParameters] = JSValue(value);
         return;
     }
 
     JSObject::put(exec, Identifier(exec, UString::from(i)), value, slot);
 }
 
-void Arguments::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void Arguments::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool isArrayIndex;
     unsigned i = propertyName.toArrayIndex(&isArrayIndex);
     if (isArrayIndex && i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters)
-            d->registers[d->firstParameterIndex + i] = JSValuePtr(value);
+            d->registers[d->firstParameterIndex + i] = JSValue(value);
         else
-            d->extraArguments[i - d->numParameters] = JSValuePtr(value);
+            d->extraArguments[i - d->numParameters] = JSValue(value);
         return;
     }
 
diff --git a/JavaScriptCore/runtime/Arguments.h b/JavaScriptCore/runtime/Arguments.h
index ebea6ad..72697eb 100644
--- a/JavaScriptCore/runtime/Arguments.h
+++ b/JavaScriptCore/runtime/Arguments.h
@@ -63,8 +63,16 @@
 
         virtual void mark();
 
-        void fillArgList(ExecState*, ArgList&);
+        void fillArgList(ExecState*, MarkedArgumentBuffer&);
 
+        uint32_t numProvidedArguments(ExecState* exec) const 
+        {
+            if (UNLIKELY(d->overrodeLength))
+                return get(exec, exec->propertyNames().length).toUInt32(exec);
+            return d->numArguments; 
+        }
+        
+        void copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize);
         void copyRegisters();
         bool isTornOff() const { return d->registerArray; }
         void setActivation(JSActivation* activation)
@@ -73,7 +81,7 @@
             d->registers = &activation->registerAt(0);
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype) 
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
             return Structure::create(prototype, TypeInfo(ObjectType)); 
         }
@@ -82,8 +90,8 @@
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
@@ -94,9 +102,9 @@
         OwnPtr<ArgumentsData> d;
     };
 
-    Arguments* asArguments(JSValuePtr);
+    Arguments* asArguments(JSValue);
 
-    inline Arguments* asArguments(JSValuePtr value)
+    inline Arguments* asArguments(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&Arguments::info));
         return static_cast<Arguments*>(asObject(value));
diff --git a/JavaScriptCore/runtime/ArrayConstructor.cpp b/JavaScriptCore/runtime/ArrayConstructor.cpp
index dd3ff4b..e96bdfc 100644
--- a/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -26,6 +26,7 @@
 
 #include "ArrayPrototype.h"
 #include "JSArray.h"
+#include "JSFunction.h"
 #include "Lookup.h"
 
 namespace JSC {
@@ -45,15 +46,15 @@
 static JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
 {
     // a single numeric argument denotes the array size (!)
-    if (args.size() == 1 && args.at(exec, 0).isNumber()) {
-        uint32_t n = args.at(exec, 0).toUInt32(exec);
-        if (n != args.at(exec, 0).toNumber(exec))
+    if (args.size() == 1 && args.at(0).isNumber()) {
+        uint32_t n = args.at(0).toUInt32(exec);
+        if (n != args.at(0).toNumber(exec))
             return throwError(exec, RangeError, "Array size is not a small enough positive integer.");
         return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), n);
     }
 
     // otherwise the array is constructed with the arguments in it
-    return new (exec) JSArray(exec, exec->lexicalGlobalObject()->arrayStructure(), args);
+    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), args);
 }
 
 static JSObject* constructWithArrayConstructor(ExecState* exec, JSObject*, const ArgList& args)
@@ -68,7 +69,7 @@
     return ConstructTypeHost;
 }
 
-static JSValuePtr callArrayConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callArrayConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructArrayWithSizeQuirk(exec, args);
 }
diff --git a/JavaScriptCore/runtime/ArrayPrototype.cpp b/JavaScriptCore/runtime/ArrayPrototype.cpp
index 654386b..807e59a 100644
--- a/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
@@ -25,6 +25,7 @@
 #include "ArrayPrototype.h"
 
 #include "CodeBlock.h"
+#include "CachedCall.h"
 #include "Interpreter.h"
 #include "JIT.h"
 #include "ObjectPrototype.h"
@@ -38,25 +39,27 @@
 
 ASSERT_CLASS_FITS_IN_CELL(ArrayPrototype);
 
-static JSValuePtr arrayProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncConcat(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncJoin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncPop(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncPush(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncReverse(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncShift(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSlice(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSort(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSplice(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncUnShift(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncEvery(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncForEach(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSome(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncFilter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncMap(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncLastIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -69,12 +72,13 @@
     if (callType != CallTypeJS)
         return false;
 
-    CodeBlock& codeBlock = callData.js.functionBody->bytecode(callData.js.scopeChain);
 #if ENABLE(JIT)
     // If the JIT is enabled then we need to preserve the invariant that every
     // function with a CodeBlock also has JIT code.
-    if (!codeBlock.jitCode())
-        JIT::compile(callData.js.scopeChain->globalData, &codeBlock);
+    callData.js.functionBody->jitCode(callData.js.scopeChain);
+    CodeBlock& codeBlock = callData.js.functionBody->generatedBytecode();
+#else
+    CodeBlock& codeBlock = callData.js.functionBody->bytecode(callData.js.scopeChain);
 #endif
 
     return codeBlock.isNumericCompareFunction();
@@ -104,6 +108,8 @@
   indexOf        arrayProtoFuncIndexOf        DontEnum|Function 1
   lastIndexOf    arrayProtoFuncLastIndexOf    DontEnum|Function 1
   filter         arrayProtoFuncFilter         DontEnum|Function 1
+  reduce         arrayProtoFuncReduce         DontEnum|Function 1
+  reduceRight    arrayProtoFuncReduceRight    DontEnum|Function 1
   map            arrayProtoFuncMap            DontEnum|Function 1
 @end
 */
@@ -122,29 +128,31 @@
 // ------------------------------ Array Functions ----------------------------
 
 // Helper function
-static JSValuePtr getProperty(ExecState* exec, JSObject* obj, unsigned index)
+static JSValue getProperty(ExecState* exec, JSObject* obj, unsigned index)
 {
     PropertySlot slot(obj);
     if (!obj->getPropertySlot(exec, index, slot))
-        return noValue();
+        return JSValue();
     return slot.getValue(exec, index);
 }
 
-static void putProperty(ExecState* exec, JSObject* obj, const Identifier& propertyName, JSValuePtr value)
+static void putProperty(ExecState* exec, JSObject* obj, const Identifier& propertyName, JSValue value)
 {
     PutPropertySlot slot;
     obj->put(exec, propertyName, value, slot);
 }
 
-JSValuePtr arrayProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&JSArray::info))
         return throwError(exec, TypeError);
     JSObject* thisObj = asArray(thisValue);
 
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() > MaxReentryDepth)
-        return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
+            return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    }
 
     bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
     if (alreadyVisited)
@@ -161,7 +169,7 @@
             break;
         }
 
-        JSValuePtr element = thisObj->get(exec, k);
+        JSValue element = thisObj->get(exec, k);
         if (element.isUndefinedOrNull())
             continue;
 
@@ -180,15 +188,17 @@
     return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
 }
 
-JSValuePtr arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&JSArray::info))
         return throwError(exec, TypeError);
     JSObject* thisObj = asArray(thisValue);
 
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() > MaxReentryDepth)
-        return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
+            return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    }
 
     bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
     if (alreadyVisited)
@@ -205,12 +215,12 @@
             break;
         }
 
-        JSValuePtr element = thisObj->get(exec, k);
+        JSValue element = thisObj->get(exec, k);
         if (element.isUndefinedOrNull())
             continue;
 
         JSObject* o = element.toObject(exec);
-        JSValuePtr conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
+        JSValue conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
         UString str;
         CallData callData;
         CallType callType = conversionFunction.getCallData(callData);
@@ -232,13 +242,15 @@
     return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
 }
 
-JSValuePtr arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
 
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() > MaxReentryDepth)
-        return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
+            return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    }
 
     bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
     if (alreadyVisited)
@@ -247,7 +259,7 @@
     Vector<UChar, 256> strBuffer;
 
     UChar comma = ',';
-    UString separator = args.at(exec, 0).isUndefined() ? UString(&comma, 1) : args.at(exec, 0).toString(exec);
+    UString separator = args.at(0).isUndefined() ? UString(&comma, 1) : args.at(0).toString(exec);
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
@@ -259,7 +271,7 @@
             break;
         }
 
-        JSValuePtr element = thisObj->get(exec, k);
+        JSValue element = thisObj->get(exec, k);
         if (element.isUndefinedOrNull())
             continue;
 
@@ -278,11 +290,11 @@
     return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
 }
 
-JSValuePtr arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSArray* arr = constructEmptyArray(exec);
     int n = 0;
-    JSValuePtr curArg = thisValue.toThisObject(exec);
+    JSValue curArg = thisValue.toThisObject(exec);
     ArgList::const_iterator it = args.begin();
     ArgList::const_iterator end = args.end();
     while (1) {
@@ -290,7 +302,7 @@
             unsigned length = curArg.get(exec, exec->propertyNames().length).toUInt32(exec);
             JSObject* curObject = curArg.toObject(exec);
             for (unsigned k = 0; k < length; ++k) {
-                if (JSValuePtr v = getProperty(exec, curObject, k))
+                if (JSValue v = getProperty(exec, curObject, k))
                     arr->put(exec, n, v);
                 n++;
             }
@@ -300,20 +312,20 @@
         }
         if (it == end)
             break;
-        curArg = (*it).jsValue(exec);
+        curArg = (*it);
         ++it;
     }
     arr->setLength(n);
     return arr;
 }
 
-JSValuePtr arrayProtoFuncPop(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (isJSArray(&exec->globalData(), thisValue))
         return asArray(thisValue)->pop();
 
     JSObject* thisObj = thisValue.toThisObject(exec);
-    JSValuePtr result;
+    JSValue result;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (length == 0) {
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length));
@@ -326,24 +338,24 @@
     return result;
 }
 
-JSValuePtr arrayProtoFuncPush(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (isJSArray(&exec->globalData(), thisValue) && args.size() == 1) {
         JSArray* array = asArray(thisValue);
-        array->push(exec, args.begin()->jsValue(exec));
+        array->push(exec, *args.begin());
         return jsNumber(exec, array->length());
     }
 
     JSObject* thisObj = thisValue.toThisObject(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned n = 0; n < args.size(); n++)
-        thisObj->put(exec, length + n, args.at(exec, n));
+        thisObj->put(exec, length + n, args.at(n));
     length += args.size();
     putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length));
     return jsNumber(exec, length);
 }
 
-JSValuePtr arrayProtoFuncReverse(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
@@ -351,8 +363,8 @@
 
     for (unsigned k = 0; k < middle; k++) {
         unsigned lk1 = length - k - 1;
-        JSValuePtr obj2 = getProperty(exec, thisObj, lk1);
-        JSValuePtr obj = getProperty(exec, thisObj, k);
+        JSValue obj2 = getProperty(exec, thisObj, lk1);
+        JSValue obj = getProperty(exec, thisObj, k);
 
         if (obj2)
             thisObj->put(exec, k, obj2);
@@ -367,10 +379,10 @@
     return thisObj;
 }
 
-JSValuePtr arrayProtoFuncShift(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
-    JSValuePtr result;
+    JSValue result;
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (length == 0) {
@@ -379,7 +391,7 @@
     } else {
         result = thisObj->get(exec, 0);
         for (unsigned k = 1; k < length; k++) {
-            if (JSValuePtr obj = getProperty(exec, thisObj, k))
+            if (JSValue obj = getProperty(exec, thisObj, k))
                 thisObj->put(exec, k - 1, obj);
             else
                 thisObj->deleteProperty(exec, k - 1);
@@ -390,7 +402,7 @@
     return result;
 }
 
-JSValuePtr arrayProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     // http://developer.netscape.com/docs/manuals/js/client/jsref/array.htm#1193713 or 15.4.4.10
 
@@ -398,8 +410,8 @@
 
     // We return a new array
     JSArray* resObj = constructEmptyArray(exec);
-    JSValuePtr result = resObj;
-    double begin = args.at(exec, 0).toInteger(exec);
+    JSValue result = resObj;
+    double begin = args.at(0).toInteger(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (begin >= 0) {
         if (begin > length)
@@ -410,10 +422,10 @@
             begin = 0;
     }
     double end;
-    if (args.at(exec, 1).isUndefined())
+    if (args.at(1).isUndefined())
         end = length;
     else {
-        end = args.at(exec, 1).toInteger(exec);
+        end = args.at(1).toInteger(exec);
         if (end < 0) {
             end += length;
             if (end < 0)
@@ -428,18 +440,18 @@
     int b = static_cast<int>(begin);
     int e = static_cast<int>(end);
     for (int k = b; k < e; k++, n++) {
-        if (JSValuePtr v = getProperty(exec, thisObj, k))
+        if (JSValue v = getProperty(exec, thisObj, k))
             resObj->put(exec, n, v);
     }
     resObj->setLength(n);
     return result;
 }
 
-JSValuePtr arrayProtoFuncSort(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
     CallType callType = function.getCallData(callData);
 
@@ -461,18 +473,18 @@
     // "Min" sort. Not the fastest, but definitely less code than heapsort
     // or quicksort, and much less swapping than bubblesort/insertionsort.
     for (unsigned i = 0; i < length - 1; ++i) {
-        JSValuePtr iObj = thisObj->get(exec, i);
+        JSValue iObj = thisObj->get(exec, i);
         unsigned themin = i;
-        JSValuePtr minObj = iObj;
+        JSValue minObj = iObj;
         for (unsigned j = i + 1; j < length; ++j) {
-            JSValuePtr jObj = thisObj->get(exec, j);
+            JSValue jObj = thisObj->get(exec, j);
             double compareResult;
             if (jObj.isUndefined())
                 compareResult = 1; // don't check minObj because there's no need to differentiate == (0) from > (1)
             else if (minObj.isUndefined())
                 compareResult = -1;
             else if (callType != CallTypeNone) {
-                ArgList l;
+                MarkedArgumentBuffer l;
                 l.append(jObj);
                 l.append(minObj);
                 compareResult = call(exec, function, callType, callData, exec->globalThisValue(), l).toNumber(exec);
@@ -493,17 +505,17 @@
     return thisObj;
 }
 
-JSValuePtr arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
 
     // 15.4.4.12
     JSArray* resObj = constructEmptyArray(exec);
-    JSValuePtr result = resObj;
+    JSValue result = resObj;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (!args.size())
         return jsUndefined();
-    int begin = args.at(exec, 0).toUInt32(exec);
+    int begin = args.at(0).toUInt32(exec);
     if (begin < 0)
         begin = std::max<int>(begin + length, 0);
     else
@@ -511,12 +523,12 @@
 
     unsigned deleteCount;
     if (args.size() > 1)
-        deleteCount = std::min<int>(std::max<int>(args.at(exec, 1).toUInt32(exec), 0), length - begin);
+        deleteCount = std::min<int>(std::max<int>(args.at(1).toUInt32(exec), 0), length - begin);
     else
         deleteCount = length - begin;
 
     for (unsigned k = 0; k < deleteCount; k++) {
-        if (JSValuePtr v = getProperty(exec, thisObj, k + begin))
+        if (JSValue v = getProperty(exec, thisObj, k + begin))
             resObj->put(exec, k, v);
     }
     resObj->setLength(deleteCount);
@@ -525,7 +537,7 @@
     if (additionalArgs != deleteCount) {
         if (additionalArgs < deleteCount) {
             for (unsigned k = begin; k < length - deleteCount; ++k) {
-                if (JSValuePtr v = getProperty(exec, thisObj, k + deleteCount))
+                if (JSValue v = getProperty(exec, thisObj, k + deleteCount))
                     thisObj->put(exec, k + additionalArgs, v);
                 else
                     thisObj->deleteProperty(exec, k + additionalArgs);
@@ -534,7 +546,7 @@
                 thisObj->deleteProperty(exec, k - 1);
         } else {
             for (unsigned k = length - deleteCount; (int)k > begin; --k) {
-                if (JSValuePtr obj = getProperty(exec, thisObj, k + deleteCount - 1))
+                if (JSValue obj = getProperty(exec, thisObj, k + deleteCount - 1))
                     thisObj->put(exec, k + additionalArgs - 1, obj);
                 else
                     thisObj->deleteProperty(exec, k + additionalArgs - 1);
@@ -542,13 +554,13 @@
         }
     }
     for (unsigned k = 0; k < additionalArgs; ++k)
-        thisObj->put(exec, k + begin, args.at(exec, k + 2));
+        thisObj->put(exec, k + begin, args.at(k + 2));
 
     putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length - deleteCount + additionalArgs));
     return result;
 }
 
-JSValuePtr arrayProtoFuncUnShift(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
 
@@ -557,49 +569,70 @@
     unsigned nrArgs = args.size();
     if (nrArgs) {
         for (unsigned k = length; k > 0; --k) {
-            if (JSValuePtr v = getProperty(exec, thisObj, k - 1))
+            if (JSValue v = getProperty(exec, thisObj, k - 1))
                 thisObj->put(exec, k + nrArgs - 1, v);
             else
                 thisObj->deleteProperty(exec, k + nrArgs - 1);
         }
     }
     for (unsigned k = 0; k < nrArgs; ++k)
-        thisObj->put(exec, k, args.at(exec, k));
-    JSValuePtr result = jsNumber(exec, length + nrArgs);
+        thisObj->put(exec, k, args.at(k));
+    JSValue result = jsNumber(exec, length + nrArgs);
     putProperty(exec, thisObj, exec->propertyNames().length, result);
     return result;
 }
 
-JSValuePtr arrayProtoFuncFilter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1).toObject(exec);
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
     JSArray* resultArray = constructEmptyArray(exec);
 
     unsigned filterIndex = 0;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (!array->canGetIndex(k))
+                break;
+            JSValue v = array->getIndex(k);
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, v);
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+            
+            JSValue result = cachedCall.call();
+            if (result.toBoolean(exec))
+                resultArray->put(exec, filterIndex++, v);
+        }
+        if (k == length)
+            return resultArray;
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
 
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        JSValuePtr v = slot.getValue(exec, k);
+        JSValue v = slot.getValue(exec, k);
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(v);
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
 
-        JSValuePtr result = call(exec, function, callType, callData, applyThis, eachArguments);
+        JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
 
         if (result.toBoolean(exec))
             resultArray->put(exec, filterIndex++, v);
@@ -607,36 +640,52 @@
     return resultArray;
 }
 
-JSValuePtr arrayProtoFuncMap(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1).toObject(exec);
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
 
     JSArray* resultArray = constructEmptyArray(exec, length);
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
 
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+
+            resultArray->JSArray::put(exec, k, cachedCall.call());
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        JSValuePtr v = slot.getValue(exec, k);
+        JSValue v = slot.getValue(exec, k);
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(v);
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
 
-        JSValuePtr result = call(exec, function, callType, callData, applyThis, eachArguments);
+        JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
         resultArray->put(exec, k, result);
     }
 
@@ -648,28 +697,46 @@
 // http://developer-test.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Objects:Array:forEach
 // http://developer-test.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Objects:Array:some
 
-JSValuePtr arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1).toObject(exec);
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
 
-    JSValuePtr result = jsBoolean(true);
+    JSValue result = jsBoolean(true);
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
+            
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+            
+            if (!cachedCall.call().toBoolean(exec))
+                return jsBoolean(false);
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
 
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(slot.getValue(exec, k));
         eachArguments.append(jsNumber(exec, k));
@@ -686,25 +753,42 @@
     return result;
 }
 
-JSValuePtr arrayProtoFuncForEach(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1).toObject(exec);
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
+
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+
+            cachedCall.call();
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
         eachArguments.append(slot.getValue(exec, k));
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
@@ -714,27 +798,45 @@
     return jsUndefined();
 }
 
-JSValuePtr arrayProtoFuncSome(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1).toObject(exec);
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
 
-    JSValuePtr result = jsBoolean(false);
+    JSValue result = jsBoolean(false);
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
+            
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+            
+            if (cachedCall.call().toBoolean(exec))
+                return jsBoolean(true);
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
         eachArguments.append(slot.getValue(exec, k));
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
@@ -749,7 +851,146 @@
     return result;
 }
 
-JSValuePtr arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    
+    JSValue function = args.at(0);
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone)
+        return throwError(exec, TypeError);
+
+    unsigned i = 0;
+    JSValue rv;
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (!length && args.size() == 1)
+        return throwError(exec, TypeError);
+    JSArray* array = 0;
+    if (isJSArray(&exec->globalData(), thisObj))
+        array = asArray(thisObj);
+
+    if (args.size() >= 2)
+        rv = args.at(1);
+    else if (array && array->canGetIndex(0)){
+        rv = array->getIndex(0);
+        i = 1;
+    } else {
+        for (i = 0; i < length; i++) {
+            rv = getProperty(exec, thisObj, i);
+            if (rv)
+                break;
+        }
+        if (!rv)
+            return throwError(exec, TypeError);
+        i++;
+    }
+
+    if (callType == CallTypeJS && array) {
+        CachedCall cachedCall(exec, asFunction(function), 4, exec->exceptionSlot());
+        for (; i < length && !exec->hadException(); ++i) {
+            cachedCall.setThis(jsNull());
+            cachedCall.setArgument(0, rv);
+            JSValue v;
+            if (LIKELY(array->canGetIndex(i)))
+                v = array->getIndex(i);
+            else
+                break; // length has been made unsafe while we enumerate fallback to slow path
+            cachedCall.setArgument(1, v);
+            cachedCall.setArgument(2, jsNumber(exec, i));
+            cachedCall.setArgument(3, array);
+            rv = cachedCall.call();
+        }
+        if (i == length) // only return if we reached the end of the array
+            return rv;
+    }
+
+    for (; i < length && !exec->hadException(); ++i) {
+        JSValue prop = getProperty(exec, thisObj, i);
+        if (!prop)
+            continue;
+        
+        MarkedArgumentBuffer eachArguments;
+        eachArguments.append(rv);
+        eachArguments.append(prop);
+        eachArguments.append(jsNumber(exec, i));
+        eachArguments.append(thisObj);
+        
+        rv = call(exec, function, callType, callData, jsNull(), eachArguments);
+    }
+    return rv;
+}
+
+JSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    
+    JSValue function = args.at(0);
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone)
+        return throwError(exec, TypeError);
+    
+    unsigned i = 0;
+    JSValue rv;
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (!length && args.size() == 1)
+        return throwError(exec, TypeError);
+    JSArray* array = 0;
+    if (isJSArray(&exec->globalData(), thisObj))
+        array = asArray(thisObj);
+    
+    if (args.size() >= 2)
+        rv = args.at(1);
+    else if (array && array->canGetIndex(length - 1)){
+        rv = array->getIndex(length - 1);
+        i = 1;
+    } else {
+        for (i = 0; i < length; i++) {
+            rv = getProperty(exec, thisObj, length - i - 1);
+            if (rv)
+                break;
+        }
+        if (!rv)
+            return throwError(exec, TypeError);
+        i++;
+    }
+    
+    if (callType == CallTypeJS && array) {
+        CachedCall cachedCall(exec, asFunction(function), 4, exec->exceptionSlot());
+        for (; i < length && !exec->hadException(); ++i) {
+            unsigned idx = length - i - 1;
+            cachedCall.setThis(jsNull());
+            cachedCall.setArgument(0, rv);
+            if (UNLIKELY(!array->canGetIndex(idx)))
+                break; // length has been made unsafe while we enumerate fallback to slow path
+            cachedCall.setArgument(1, array->getIndex(idx));
+            cachedCall.setArgument(2, jsNumber(exec, idx));
+            cachedCall.setArgument(3, array);
+            rv = cachedCall.call();
+        }
+        if (i == length) // only return if we reached the end of the array
+            return rv;
+    }
+    
+    for (; i < length && !exec->hadException(); ++i) {
+        unsigned idx = length - i - 1;
+        JSValue prop = getProperty(exec, thisObj, idx);
+        if (!prop)
+            continue;
+        
+        MarkedArgumentBuffer eachArguments;
+        eachArguments.append(rv);
+        eachArguments.append(prop);
+        eachArguments.append(jsNumber(exec, idx));
+        eachArguments.append(thisObj);
+        
+        rv = call(exec, function, callType, callData, jsNull(), eachArguments);
+    }
+    return rv;        
+}
+
+JSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     // JavaScript 1.5 Extension by Mozilla
     // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:indexOf
@@ -757,7 +998,7 @@
     JSObject* thisObj = thisValue.toThisObject(exec);
 
     unsigned index = 0;
-    double d = args.at(exec, 1).toInteger(exec);
+    double d = args.at(1).toInteger(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (d < 0)
         d += length;
@@ -768,19 +1009,19 @@
             index = static_cast<unsigned>(d);
     }
 
-    JSValuePtr searchElement = args.at(exec, 0);
+    JSValue searchElement = args.at(0);
     for (; index < length; ++index) {
-        JSValuePtr e = getProperty(exec, thisObj, index);
+        JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (JSValuePtr::strictEqual(searchElement, e))
+        if (JSValue::strictEqual(searchElement, e))
             return jsNumber(exec, index);
     }
 
     return jsNumber(exec, -1);
 }
 
-JSValuePtr arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     // JavaScript 1.6 Extension by Mozilla
     // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:lastIndexOf
@@ -789,7 +1030,7 @@
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     int index = length - 1;
-    double d = args.at(exec, 1).toIntegerPreserveNaN(exec);
+    double d = args.at(1).toIntegerPreserveNaN(exec);
 
     if (d < 0) {
         d += length;
@@ -799,12 +1040,12 @@
     if (d < length)
         index = static_cast<int>(d);
 
-    JSValuePtr searchElement = args.at(exec, 0);
+    JSValue searchElement = args.at(0);
     for (; index >= 0; --index) {
-        JSValuePtr e = getProperty(exec, thisObj, index);
+        JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (JSValuePtr::strictEqual(searchElement, e))
+        if (JSValue::strictEqual(searchElement, e))
             return jsNumber(exec, index);
     }
 
diff --git a/JavaScriptCore/runtime/BooleanConstructor.cpp b/JavaScriptCore/runtime/BooleanConstructor.cpp
index bdf3322..9fcba37 100644
--- a/JavaScriptCore/runtime/BooleanConstructor.cpp
+++ b/JavaScriptCore/runtime/BooleanConstructor.cpp
@@ -41,7 +41,7 @@
 JSObject* constructBoolean(ExecState* exec, const ArgList& args)
 {
     BooleanObject* obj = new (exec) BooleanObject(exec->lexicalGlobalObject()->booleanObjectStructure());
-    obj->setInternalValue(jsBoolean(args.at(exec, 0).toBoolean(exec)));
+    obj->setInternalValue(jsBoolean(args.at(0).toBoolean(exec)));
     return obj;
 }
 
@@ -57,9 +57,9 @@
 }
 
 // ECMA 15.6.1
-static JSValuePtr callBooleanConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callBooleanConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsBoolean(args.at(exec, 0).toBoolean(exec));
+    return jsBoolean(args.at(0).toBoolean(exec));
 }
 
 CallType BooleanConstructor::getCallData(CallData& callData)
@@ -68,7 +68,7 @@
     return CallTypeHost;
 }
 
-JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSValuePtr immediateBooleanValue)
+JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSValue immediateBooleanValue)
 {
     BooleanObject* obj = new (exec) BooleanObject(exec->lexicalGlobalObject()->booleanObjectStructure());
     obj->setInternalValue(immediateBooleanValue);
diff --git a/JavaScriptCore/runtime/BooleanConstructor.h b/JavaScriptCore/runtime/BooleanConstructor.h
index db4e8e2..d9f51ab 100644
--- a/JavaScriptCore/runtime/BooleanConstructor.h
+++ b/JavaScriptCore/runtime/BooleanConstructor.h
@@ -36,7 +36,7 @@
         virtual CallType getCallData(CallData&);
     };
 
-    JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSValuePtr);
+    JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSValue);
     JSObject* constructBoolean(ExecState*, const ArgList&);
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/BooleanObject.h b/JavaScriptCore/runtime/BooleanObject.h
index 68941e3..cfd55fe 100644
--- a/JavaScriptCore/runtime/BooleanObject.h
+++ b/JavaScriptCore/runtime/BooleanObject.h
@@ -33,9 +33,9 @@
         static const ClassInfo info;
     };
 
-    BooleanObject* asBooleanObject(JSValuePtr);
+    BooleanObject* asBooleanObject(JSValue);
 
-    inline BooleanObject* asBooleanObject(JSValuePtr value)
+    inline BooleanObject* asBooleanObject(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&BooleanObject::info));
         return static_cast<BooleanObject*>(asObject(value));
diff --git a/JavaScriptCore/runtime/BooleanPrototype.cpp b/JavaScriptCore/runtime/BooleanPrototype.cpp
index 9eb52d1..703a568 100644
--- a/JavaScriptCore/runtime/BooleanPrototype.cpp
+++ b/JavaScriptCore/runtime/BooleanPrototype.cpp
@@ -22,6 +22,7 @@
 #include "BooleanPrototype.h"
 
 #include "Error.h"
+#include "JSFunction.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
@@ -31,8 +32,8 @@
 ASSERT_CLASS_FITS_IN_CELL(BooleanPrototype);
 
 // Functions
-static JSValuePtr booleanProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr booleanProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.6.4
 
@@ -41,8 +42,8 @@
 {
     setInternalValue(jsBoolean(false));
 
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, booleanProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, booleanProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, booleanProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, booleanProtoFuncValueOf), DontEnum);
 }
 
 
@@ -50,7 +51,7 @@
 
 // ECMA 15.6.4.2 + 15.6.4.3
 
-JSValuePtr booleanProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (thisValue == jsBoolean(false))
         return jsNontrivialString(exec, "false");
@@ -68,7 +69,7 @@
     return jsNontrivialString(exec, "true");
 }
 
-JSValuePtr booleanProtoFuncValueOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (thisValue.isBoolean())
         return thisValue;
diff --git a/JavaScriptCore/runtime/CallData.cpp b/JavaScriptCore/runtime/CallData.cpp
index fbb6392..62e42fe 100644
--- a/JavaScriptCore/runtime/CallData.cpp
+++ b/JavaScriptCore/runtime/CallData.cpp
@@ -30,7 +30,7 @@
 
 namespace JSC {
 
-JSValuePtr call(ExecState* exec, JSValuePtr functionObject, CallType callType, const CallData& callData, JSValuePtr thisValue, const ArgList& args)
+JSValue call(ExecState* exec, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args)
 {
     if (callType == CallTypeHost)
         return callData.native.function(exec, asObject(functionObject), thisValue, args);
diff --git a/JavaScriptCore/runtime/CallData.h b/JavaScriptCore/runtime/CallData.h
index b8d84cd..d5b0172 100644
--- a/JavaScriptCore/runtime/CallData.h
+++ b/JavaScriptCore/runtime/CallData.h
@@ -29,13 +29,15 @@
 #ifndef CallData_h
 #define CallData_h
 
+#include "NativeFunctionWrapper.h"
+
 namespace JSC {
 
     class ArgList;
     class ExecState;
     class FunctionBodyNode;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class ScopeChainNode;
 
     enum CallType {
@@ -44,7 +46,7 @@
         CallTypeJS
     };
 
-    typedef JSValuePtr (*NativeFunction)(ExecState*, JSObject*, JSValuePtr thisValue, const ArgList&);
+    typedef JSValue (JSC_HOST_CALL *NativeFunction)(ExecState*, JSObject*, JSValue thisValue, const ArgList&);
 
     union CallData {
         struct {
@@ -56,7 +58,7 @@
         } js;
     };
 
-    JSValuePtr call(ExecState*, JSValuePtr functionObject, CallType, const CallData&, JSValuePtr thisValue, const ArgList&);
+    JSValue call(ExecState*, JSValue functionObject, CallType, const CallData&, JSValue thisValue, const ArgList&);
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/Collector.cpp b/JavaScriptCore/runtime/Collector.cpp
index a4fea7d..c799424 100644
--- a/JavaScriptCore/runtime/Collector.cpp
+++ b/JavaScriptCore/runtime/Collector.cpp
@@ -37,11 +37,12 @@
 #include <wtf/FastMalloc.h>
 #include <wtf/HashCountedSet.h>
 #include <wtf/UnusedParam.h>
+#include <wtf/VMTags.h>
 
 #if PLATFORM(DARWIN)
 
-#include <mach/mach_port.h>
 #include <mach/mach_init.h>
+#include <mach/mach_port.h>
 #include <mach/task.h>
 #include <mach/thread_act.h>
 #include <mach/vm_map.h>
@@ -58,9 +59,7 @@
 
 #if PLATFORM(SOLARIS)
 #include <thread.h>
-#endif
-
-#if PLATFORM(OPENBSD)
+#else
 #include <pthread.h>
 #endif
 
@@ -183,7 +182,7 @@
 #if PLATFORM(DARWIN)
     vm_address_t address = 0;
     // FIXME: tag the region as a JavaScriptCore heap when we get a registered VM tag: <rdar://problem/6054788>.
-    vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
+    vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE | VM_TAG_FOR_COLLECTOR_MEMORY, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
 #elif PLATFORM(SYMBIAN)
     // no memory map in symbian, need to hack with fastMalloc
     void* address = fastMalloc(BLOCK_SIZE);
@@ -427,6 +426,15 @@
     stack_t stack;
     pthread_stackseg_np(thread, &stack);
     return stack.ss_sp;
+#elif PLATFORM(SYMBIAN)
+    static void* stackBase = 0;
+    if (stackBase == 0) {
+        TThreadStackInfo info;
+        RThread thread;
+        thread.StackInfo(info);
+        stackBase = (void*)info.iBase;
+    }
+    return (void*)stackBase;
 #elif PLATFORM(UNIX)
     static void* stackBase = 0;
     static size_t stackSize = 0;
@@ -449,15 +457,6 @@
         stackThread = thread;
     }
     return static_cast<char*>(stackBase) + stackSize;
-#elif PLATFORM(SYMBIAN)
-    static void* stackBase = 0;
-    if (stackBase == 0) {
-        TThreadStackInfo info;
-        RThread thread;
-        thread.StackInfo(info);
-        stackBase = (void*)info.iBase;
-    }
-    return (void*)stackBase;
 #else
 #error Need a way to get the stack base on this platform
 #endif
@@ -807,7 +806,7 @@
         m_protectedValuesMutex.set(new Mutex);
 }
 
-void Heap::protect(JSValuePtr k)
+void Heap::protect(JSValue k)
 {
     ASSERT(k);
     ASSERT(JSLock::currentThreadIsHoldingLock() || !m_globalData->isSharedInstance);
@@ -824,7 +823,7 @@
         m_protectedValuesMutex->unlock();
 }
 
-void Heap::unprotect(JSValuePtr k)
+void Heap::unprotect(JSValue k)
 {
     ASSERT(k);
     ASSERT(JSLock::currentThreadIsHoldingLock() || !m_globalData->isSharedInstance);
@@ -841,7 +840,7 @@
         m_protectedValuesMutex->unlock();
 }
 
-Heap* Heap::heap(JSValuePtr v)
+Heap* Heap::heap(JSValue v)
 {
     if (!v.isCell())
         return 0;
@@ -985,7 +984,7 @@
     markStackObjectsConservatively();
     markProtectedObjects();
     if (m_markListSet && m_markListSet->size())
-        ArgList::markLists(*m_markListSet);
+        MarkedArgumentBuffer::markLists(*m_markListSet);
     if (m_globalData->exception && !m_globalData->exception.marked())
         m_globalData->exception.mark();
     m_globalData->interpreter->registerFile().markCallFrames(this);
diff --git a/JavaScriptCore/runtime/Collector.h b/JavaScriptCore/runtime/Collector.h
index ba41d60..23f9f15 100644
--- a/JavaScriptCore/runtime/Collector.h
+++ b/JavaScriptCore/runtime/Collector.h
@@ -39,11 +39,11 @@
 
 namespace JSC {
 
-    class ArgList;
+    class MarkedArgumentBuffer;
     class CollectorBlock;
     class JSCell;
     class JSGlobalData;
-    class JSValuePtr;
+    class JSValue;
 
     enum OperationInProgress { NoOperation, Allocation, Collection };
     enum HeapType { PrimaryHeap, NumberHeap };
@@ -96,10 +96,10 @@
         Statistics statistics() const;
 
         void setGCProtectNeedsLocking();
-        void protect(JSValuePtr);
-        void unprotect(JSValuePtr);
+        void protect(JSValue);
+        void unprotect(JSValue);
 
-        static Heap* heap(JSValuePtr); // 0 for immediate values
+        static Heap* heap(JSValue); // 0 for immediate values
 
         size_t globalObjectCount();
         size_t protectedObjectCount();
@@ -113,7 +113,7 @@
 
         void markConservatively(void* start, void* end);
 
-        HashSet<ArgList*>& markListSet() { if (!m_markListSet) m_markListSet = new HashSet<ArgList*>; return *m_markListSet; }
+        HashSet<MarkedArgumentBuffer*>& markListSet() { if (!m_markListSet) m_markListSet = new HashSet<MarkedArgumentBuffer*>; return *m_markListSet; }
 
         JSGlobalData* globalData() const { return m_globalData; }
         static bool isNumber(JSCell*);
@@ -147,7 +147,7 @@
         OwnPtr<Mutex> m_protectedValuesMutex; // Only non-null if the client explicitly requested it via setGCPrtotectNeedsLocking().
         ProtectCountSet m_protectedValues;
 
-        HashSet<ArgList*>* m_markListSet;
+        HashSet<MarkedArgumentBuffer*>* m_markListSet;
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
         void makeUsableFromMultipleThreads();
diff --git a/JavaScriptCore/runtime/CommonIdentifiers.h b/JavaScriptCore/runtime/CommonIdentifiers.h
index 45b99a8..d4c5d52 100644
--- a/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -24,7 +24,7 @@
 #include "Identifier.h"
 #include <wtf/Noncopyable.h>
 
-// ArgList of property names, passed to a macro so we can do set them up various
+// MarkedArgumentBuffer of property names, passed to a macro so we can do set them up various
 // ways without repeating the list.
 #define JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(macro) \
     macro(__defineGetter__) \
@@ -63,7 +63,8 @@
     macro(toPrecision) \
     macro(toString) \
     macro(UTC) \
-    macro(valueOf)
+    macro(valueOf) \
+    macro(displayName)
 
 namespace JSC {
 
diff --git a/JavaScriptCore/runtime/Completion.cpp b/JavaScriptCore/runtime/Completion.cpp
index 5655fa5..b8b1581 100644
--- a/JavaScriptCore/runtime/Completion.cpp
+++ b/JavaScriptCore/runtime/Completion.cpp
@@ -50,7 +50,7 @@
     return Completion(Normal);
 }
 
-Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValuePtr thisValue)
+Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValue thisValue)
 {
     JSLock lock(exec);
     
@@ -63,8 +63,8 @@
 
     JSObject* thisObj = (!thisValue || thisValue.isUndefinedOrNull()) ? exec->dynamicGlobalObject() : thisValue.toObject(exec);
 
-    JSValuePtr exception = noValue();
-    JSValuePtr result = exec->interpreter()->execute(programNode.get(), exec, scopeChain.node(), thisObj, &exception);
+    JSValue exception;
+    JSValue result = exec->interpreter()->execute(programNode.get(), exec, scopeChain.node(), thisObj, &exception);
 
     if (exception) {
         if (exception.isObject() && asObject(exception)->isWatchdogException())
diff --git a/JavaScriptCore/runtime/Completion.h b/JavaScriptCore/runtime/Completion.h
index 9631b50..41c9a64 100644
--- a/JavaScriptCore/runtime/Completion.h
+++ b/JavaScriptCore/runtime/Completion.h
@@ -39,24 +39,24 @@
      */
     class Completion {
     public:
-        Completion(ComplType type = Normal, JSValuePtr value = noValue())
+        Completion(ComplType type = Normal, JSValue value = JSValue())
             : m_type(type)
             , m_value(value)
         {
         }
 
         ComplType complType() const { return m_type; }
-        JSValuePtr value() const { return m_value; }
-        void setValue(JSValuePtr v) { m_value = v; }
+        JSValue value() const { return m_value; }
+        void setValue(JSValue v) { m_value = v; }
         bool isValueCompletion() const { return m_value; }
 
     private:
         ComplType m_type;
-        JSValuePtr m_value;
+        JSValue m_value;
     };
 
     Completion checkSyntax(ExecState*, const SourceCode&);
-    Completion evaluate(ExecState*, ScopeChain&, const SourceCode&, JSValuePtr thisValue = noValue());
+    Completion evaluate(ExecState*, ScopeChain&, const SourceCode&, JSValue thisValue = JSValue());
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/ConstructData.cpp b/JavaScriptCore/runtime/ConstructData.cpp
index 7a729ae..7ee59d7 100644
--- a/JavaScriptCore/runtime/ConstructData.cpp
+++ b/JavaScriptCore/runtime/ConstructData.cpp
@@ -30,7 +30,7 @@
 
 namespace JSC {
 
-JSObject* construct(ExecState* exec, JSValuePtr object, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
+JSObject* construct(ExecState* exec, JSValue object, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
 {
     if (constructType == ConstructTypeHost)
         return constructData.native.function(exec, asObject(object), args);
diff --git a/JavaScriptCore/runtime/ConstructData.h b/JavaScriptCore/runtime/ConstructData.h
index 559c1bd..9d580d5 100644
--- a/JavaScriptCore/runtime/ConstructData.h
+++ b/JavaScriptCore/runtime/ConstructData.h
@@ -35,7 +35,7 @@
     class ExecState;
     class FunctionBodyNode;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class ScopeChainNode;
 
     enum ConstructType {
@@ -56,7 +56,7 @@
         } js;
     };
 
-    JSObject* construct(ExecState*, JSValuePtr constructor, ConstructType, const ConstructData&, const ArgList&);
+    JSObject* construct(ExecState*, JSValue constructor, ConstructType, const ConstructData&, const ArgList&);
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/DateConstructor.cpp b/JavaScriptCore/runtime/DateConstructor.cpp
index 92ab897..f1cf933 100644
--- a/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/JavaScriptCore/runtime/DateConstructor.cpp
@@ -22,15 +22,17 @@
 #include "config.h"
 #include "DateConstructor.h"
 
+#include "DateConversion.h"
 #include "DateInstance.h"
-#include "DateMath.h"
 #include "DatePrototype.h"
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
 #include <math.h>
 #include <time.h>
+#include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
 
 #if HAVE(SYS_TIME_H)
@@ -41,24 +43,26 @@
 #include <sys/timeb.h>
 #endif
 
+using namespace WTF;
+
 namespace JSC {
 
 // TODO: MakeTime (15.9.11.1) etc. ?
 
 ASSERT_CLASS_FITS_IN_CELL(DateConstructor);
 
-static JSValuePtr dateParse(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateNow(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateUTC(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL dateParse(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateNow(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateUTC(ExecState*, JSObject*, JSValue, const ArgList&);
 
 DateConstructor::DateConstructor(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure, DatePrototype* datePrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, datePrototype->classInfo()->className))
 {
       putDirectWithoutTransition(exec->propertyNames().prototype, datePrototype, DontEnum|DontDelete|ReadOnly);
 
-      putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().parse, dateParse), DontEnum);
-      putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 7, exec->propertyNames().UTC, dateUTC), DontEnum);
-      putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().now, dateNow), DontEnum);
+      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().parse, dateParse), DontEnum);
+      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 7, exec->propertyNames().UTC, dateUTC), DontEnum);
+      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().now, dateNow), DontEnum);
 
       putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 7), ReadOnly | DontEnum | DontDelete);
 }
@@ -73,35 +77,35 @@
     if (numArgs == 0) // new Date() ECMA 15.9.3.3
         value = getCurrentUTCTime();
     else if (numArgs == 1) {
-        if (args.at(exec, 0).isObject(&DateInstance::info))
-            value = asDateInstance(args.at(exec, 0))->internalNumber();
+        if (args.at(0).isObject(&DateInstance::info))
+            value = asDateInstance(args.at(0))->internalNumber();
         else {
-            JSValuePtr primitive = args.at(exec, 0).toPrimitive(exec);
+            JSValue primitive = args.at(0).toPrimitive(exec);
             if (primitive.isString())
                 value = parseDate(primitive.getString());
             else
                 value = primitive.toNumber(exec);
         }
     } else {
-        if (isnan(args.at(exec, 0).toNumber(exec))
-                || isnan(args.at(exec, 1).toNumber(exec))
-                || (numArgs >= 3 && isnan(args.at(exec, 2).toNumber(exec)))
-                || (numArgs >= 4 && isnan(args.at(exec, 3).toNumber(exec)))
-                || (numArgs >= 5 && isnan(args.at(exec, 4).toNumber(exec)))
-                || (numArgs >= 6 && isnan(args.at(exec, 5).toNumber(exec)))
-                || (numArgs >= 7 && isnan(args.at(exec, 6).toNumber(exec))))
+        if (isnan(args.at(0).toNumber(exec))
+                || isnan(args.at(1).toNumber(exec))
+                || (numArgs >= 3 && isnan(args.at(2).toNumber(exec)))
+                || (numArgs >= 4 && isnan(args.at(3).toNumber(exec)))
+                || (numArgs >= 5 && isnan(args.at(4).toNumber(exec)))
+                || (numArgs >= 6 && isnan(args.at(5).toNumber(exec)))
+                || (numArgs >= 7 && isnan(args.at(6).toNumber(exec))))
             value = NaN;
         else {
           GregorianDateTime t;
-          int year = args.at(exec, 0).toInt32(exec);
+          int year = args.at(0).toInt32(exec);
           t.year = (year >= 0 && year <= 99) ? year : year - 1900;
-          t.month = args.at(exec, 1).toInt32(exec);
-          t.monthDay = (numArgs >= 3) ? args.at(exec, 2).toInt32(exec) : 1;
-          t.hour = args.at(exec, 3).toInt32(exec);
-          t.minute = args.at(exec, 4).toInt32(exec);
-          t.second = args.at(exec, 5).toInt32(exec);
+          t.month = args.at(1).toInt32(exec);
+          t.monthDay = (numArgs >= 3) ? args.at(2).toInt32(exec) : 1;
+          t.hour = args.at(3).toInt32(exec);
+          t.minute = args.at(4).toInt32(exec);
+          t.second = args.at(5).toInt32(exec);
           t.isDST = -1;
-          double ms = (numArgs >= 7) ? args.at(exec, 6).toNumber(exec) : 0;
+          double ms = (numArgs >= 7) ? args.at(6).toNumber(exec) : 0;
           value = gregorianDateTimeToMS(t, ms, false);
         }
     }
@@ -123,7 +127,7 @@
 }
 
 // ECMA 15.9.2
-static JSValuePtr callDate(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+static JSValue JSC_HOST_CALL callDate(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     time_t localTime = time(0);
     tm localTM;
@@ -138,37 +142,37 @@
     return CallTypeHost;
 }
 
-static JSValuePtr dateParse(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL dateParse(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, parseDate(args.at(exec, 0).toString(exec)));
+    return jsNumber(exec, parseDate(args.at(0).toString(exec)));
 }
 
-static JSValuePtr dateNow(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+static JSValue JSC_HOST_CALL dateNow(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     return jsNumber(exec, getCurrentUTCTime());
 }
 
-static JSValuePtr dateUTC(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const ArgList& args) 
 {
     int n = args.size();
-    if (isnan(args.at(exec, 0).toNumber(exec))
-            || isnan(args.at(exec, 1).toNumber(exec))
-            || (n >= 3 && isnan(args.at(exec, 2).toNumber(exec)))
-            || (n >= 4 && isnan(args.at(exec, 3).toNumber(exec)))
-            || (n >= 5 && isnan(args.at(exec, 4).toNumber(exec)))
-            || (n >= 6 && isnan(args.at(exec, 5).toNumber(exec)))
-            || (n >= 7 && isnan(args.at(exec, 6).toNumber(exec))))
+    if (isnan(args.at(0).toNumber(exec))
+            || isnan(args.at(1).toNumber(exec))
+            || (n >= 3 && isnan(args.at(2).toNumber(exec)))
+            || (n >= 4 && isnan(args.at(3).toNumber(exec)))
+            || (n >= 5 && isnan(args.at(4).toNumber(exec)))
+            || (n >= 6 && isnan(args.at(5).toNumber(exec)))
+            || (n >= 7 && isnan(args.at(6).toNumber(exec))))
         return jsNaN(exec);
 
     GregorianDateTime t;
-    int year = args.at(exec, 0).toInt32(exec);
+    int year = args.at(0).toInt32(exec);
     t.year = (year >= 0 && year <= 99) ? year : year - 1900;
-    t.month = args.at(exec, 1).toInt32(exec);
-    t.monthDay = (n >= 3) ? args.at(exec, 2).toInt32(exec) : 1;
-    t.hour = args.at(exec, 3).toInt32(exec);
-    t.minute = args.at(exec, 4).toInt32(exec);
-    t.second = args.at(exec, 5).toInt32(exec);
-    double ms = (n >= 7) ? args.at(exec, 6).toNumber(exec) : 0;
+    t.month = args.at(1).toInt32(exec);
+    t.monthDay = (n >= 3) ? args.at(2).toInt32(exec) : 1;
+    t.hour = args.at(3).toInt32(exec);
+    t.minute = args.at(4).toInt32(exec);
+    t.second = args.at(5).toInt32(exec);
+    double ms = (n >= 7) ? args.at(6).toNumber(exec) : 0;
     return jsNumber(exec, gregorianDateTimeToMS(t, ms, true));
 }
 
diff --git a/JavaScriptCore/runtime/DateConversion.cpp b/JavaScriptCore/runtime/DateConversion.cpp
new file mode 100644
index 0000000..a725478
--- /dev/null
+++ b/JavaScriptCore/runtime/DateConversion.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * The Original Code is Mozilla Communicator client code, released
+ * March 31, 1998.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * Alternatively, the contents of this file may be used under the terms
+ * of either the Mozilla Public License Version 1.1, found at
+ * http://www.mozilla.org/MPL/ (the "MPL") or the GNU General Public
+ * License Version 2.0, found at http://www.fsf.org/copyleft/gpl.html
+ * (the "GPL"), in which case the provisions of the MPL or the GPL are
+ * applicable instead of those above.  If you wish to allow use of your
+ * version of this file only under the terms of one of those two
+ * licenses (the MPL or the GPL) and not to allow others to use your
+ * version of this file under the LGPL, indicate your decision by
+ * deletingthe provisions above and replace them with the notice and
+ * other provisions required by the MPL or the GPL, as the case may be.
+ * If you do not delete the provisions above, a recipient may use your
+ * version of this file under any of the LGPL, the MPL or the GPL.
+ */
+
+#include "config.h"
+#include "DateConversion.h"
+
+#include "UString.h"
+#include <wtf/DateMath.h>
+#include <wtf/StringExtras.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+double parseDate(const UString &date)
+{
+    return parseDateFromNullTerminatedCharacters(date.UTF8String().c_str());
+}
+
+UString formatDate(const GregorianDateTime &t)
+{
+    char buffer[100];
+    snprintf(buffer, sizeof(buffer), "%s %s %02d %04d",
+        weekdayName[(t.weekDay + 6) % 7],
+        monthName[t.month], t.monthDay, t.year + 1900);
+    return buffer;
+}
+
+UString formatDateUTCVariant(const GregorianDateTime &t)
+{
+    char buffer[100];
+    snprintf(buffer, sizeof(buffer), "%s, %02d %s %04d",
+        weekdayName[(t.weekDay + 6) % 7],
+        t.monthDay, monthName[t.month], t.year + 1900);
+    return buffer;
+}
+
+UString formatTime(const GregorianDateTime &t, bool utc)
+{
+    char buffer[100];
+    if (utc) {
+        snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
+    } else {
+        int offset = abs(gmtoffset(t));
+        char timeZoneName[70];
+        struct tm gtm = t;
+        strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
+
+        if (timeZoneName[0]) {
+            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d (%s)",
+                t.hour, t.minute, t.second,
+                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
+        } else {
+            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d",
+                t.hour, t.minute, t.second,
+                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
+        }
+    }
+    return UString(buffer);
+}
+
+} // namespace JSC
diff --git a/JavaScriptCore/runtime/DateConversion.h b/JavaScriptCore/runtime/DateConversion.h
new file mode 100644
index 0000000..0d12815
--- /dev/null
+++ b/JavaScriptCore/runtime/DateConversion.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Communicator client code, released
+ * March 31, 1998.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ */
+
+#ifndef DateConversion_h
+#define DateConversion_h
+
+namespace WTF {
+    struct GregorianDateTime;
+}
+
+namespace JSC {
+
+class UString;
+
+double parseDate(const UString&);
+UString formatDate(const WTF::GregorianDateTime&);
+UString formatDateUTCVariant(const WTF::GregorianDateTime&);
+UString formatTime(const WTF::GregorianDateTime&, bool inputIsUTC);
+
+} // namespace JSC
+
+#endif // DateConversion_h
diff --git a/JavaScriptCore/runtime/DateInstance.cpp b/JavaScriptCore/runtime/DateInstance.cpp
index 8806dec..62791ae 100644
--- a/JavaScriptCore/runtime/DateInstance.cpp
+++ b/JavaScriptCore/runtime/DateInstance.cpp
@@ -22,10 +22,12 @@
 #include "config.h"
 #include "DateInstance.h"
 
-#include "DateMath.h"
 #include <math.h>
+#include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
 
+using namespace WTF;
+
 namespace JSC {
 
 struct DateInstance::Cache {
@@ -58,13 +60,13 @@
 
     if (outputIsUTC) {
         if (m_cache->m_gregorianDateTimeUTCCachedForMS != milli) {
-            JSC::msToGregorianDateTime(milli, true, m_cache->m_cachedGregorianDateTimeUTC);
+            WTF::msToGregorianDateTime(milli, true, m_cache->m_cachedGregorianDateTimeUTC);
             m_cache->m_gregorianDateTimeUTCCachedForMS = milli;
         }
         t.copyFrom(m_cache->m_cachedGregorianDateTimeUTC);
     } else {
         if (m_cache->m_gregorianDateTimeCachedForMS != milli) {
-            JSC::msToGregorianDateTime(milli, false, m_cache->m_cachedGregorianDateTime);
+            WTF::msToGregorianDateTime(milli, false, m_cache->m_cachedGregorianDateTime);
             m_cache->m_gregorianDateTimeCachedForMS = milli;
         }
         t.copyFrom(m_cache->m_cachedGregorianDateTime);
diff --git a/JavaScriptCore/runtime/DateInstance.h b/JavaScriptCore/runtime/DateInstance.h
index 398f299..3b73521 100644
--- a/JavaScriptCore/runtime/DateInstance.h
+++ b/JavaScriptCore/runtime/DateInstance.h
@@ -23,9 +23,11 @@
 
 #include "JSWrapperObject.h"
 
-namespace JSC {
-
+namespace WTF {
     struct GregorianDateTime;
+}
+
+namespace JSC {
 
     class DateInstance : public JSWrapperObject {
     public:
@@ -34,14 +36,14 @@
 
         double internalNumber() const { return internalValue().uncheckedGetNumber(); }
 
-        bool getTime(GregorianDateTime&, int& offset) const;
-        bool getUTCTime(GregorianDateTime&) const;
+        bool getTime(WTF::GregorianDateTime&, int& offset) const;
+        bool getUTCTime(WTF::GregorianDateTime&) const;
         bool getTime(double& milliseconds, int& offset) const;
         bool getUTCTime(double& milliseconds) const;
 
         static const ClassInfo info;
 
-        void msToGregorianDateTime(double, bool outputIsUTC, GregorianDateTime&) const;
+        void msToGregorianDateTime(double, bool outputIsUTC, WTF::GregorianDateTime&) const;
 
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
@@ -52,9 +54,9 @@
         mutable Cache* m_cache;
     };
 
-    DateInstance* asDateInstance(JSValuePtr);
+    DateInstance* asDateInstance(JSValue);
 
-    inline DateInstance* asDateInstance(JSValuePtr value)
+    inline DateInstance* asDateInstance(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&DateInstance::info));
         return static_cast<DateInstance*>(asObject(value));
diff --git a/JavaScriptCore/runtime/DatePrototype.cpp b/JavaScriptCore/runtime/DatePrototype.cpp
index fad1d55..1406197 100644
--- a/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/JavaScriptCore/runtime/DatePrototype.cpp
@@ -22,7 +22,8 @@
 #include "config.h"
 #include "DatePrototype.h"
 
-#include "DateMath.h"
+#include "DateConversion.h"
+#include "Error.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "DateInstance.h"
@@ -37,6 +38,7 @@
 #include <math.h>
 #include <time.h>
 #include <wtf/Assertions.h>
+#include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
 #include <wtf/StringExtras.h>
 #include <wtf/UnusedParam.h>
@@ -63,49 +65,49 @@
 
 ASSERT_CLASS_FITS_IN_CELL(DatePrototype);
 
-static JSValuePtr dateProtoFuncGetDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetDay(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetMilliSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetTime(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetTimezoneOffset(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCDay(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCMilliseconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetMilliSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetTime(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCMilliseconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToDateString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToGMTString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToLocaleDateString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToLocaleTimeString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToTimeString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToUTCString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetMilliSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCMilliseconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -141,16 +143,16 @@
     bool useCustomFormat = false;
     UString customFormatString;
 
-    UString arg0String = args.at(exec, 0).toString(exec);
-    if (arg0String == "custom" && !args.at(exec, 1).isUndefined()) {
+    UString arg0String = args.at(0).toString(exec);
+    if (arg0String == "custom" && !args.at(1).isUndefined()) {
         useCustomFormat = true;
-        customFormatString = args.at(exec, 1).toString(exec);
-    } else if (format == LocaleDateAndTime && !args.at(exec, 1).isUndefined()) {
+        customFormatString = args.at(1).toString(exec);
+    } else if (format == LocaleDateAndTime && !args.at(1).isUndefined()) {
         dateStyle = styleFromArgString(arg0String, dateStyle);
-        timeStyle = styleFromArgString(args.at(exec, 1).toString(exec), timeStyle);
-    } else if (format != LocaleTime && !args.at(exec, 0).isUndefined())
+        timeStyle = styleFromArgString(args.at(1).toString(exec), timeStyle);
+    } else if (format != LocaleTime && !args.at(0).isUndefined())
         dateStyle = styleFromArgString(arg0String, dateStyle);
-    else if (format != LocaleDate && !args.at(exec, 0).isUndefined())
+    else if (format != LocaleDate && !args.at(0).isUndefined())
         timeStyle = styleFromArgString(arg0String, timeStyle);
 
     CFLocaleRef locale = CFLocaleCopyCurrent();
@@ -266,19 +268,19 @@
     // hours
     if (maxArgs >= 4 && idx < numArgs) {
         t->hour = 0;
-        milliseconds += args.at(exec, idx++).toInt32(exec, ok) * msPerHour;
+        milliseconds += args.at(idx++).toInt32(exec, ok) * msPerHour;
     }
 
     // minutes
     if (maxArgs >= 3 && idx < numArgs && ok) {
         t->minute = 0;
-        milliseconds += args.at(exec, idx++).toInt32(exec, ok) * msPerMinute;
+        milliseconds += args.at(idx++).toInt32(exec, ok) * msPerMinute;
     }
     
     // seconds
     if (maxArgs >= 2 && idx < numArgs && ok) {
         t->second = 0;
-        milliseconds += args.at(exec, idx++).toInt32(exec, ok) * msPerSecond;
+        milliseconds += args.at(idx++).toInt32(exec, ok) * msPerSecond;
     }
     
     if (!ok)
@@ -286,7 +288,7 @@
         
     // milliseconds
     if (idx < numArgs) {
-        double millis = args.at(exec, idx).toNumber(exec);
+        double millis = args.at(idx).toNumber(exec);
         ok = isfinite(millis);
         milliseconds += millis;
     } else
@@ -312,16 +314,16 @@
   
     // years
     if (maxArgs >= 3 && idx < numArgs)
-        t->year = args.at(exec, idx++).toInt32(exec, ok) - 1900;
+        t->year = args.at(idx++).toInt32(exec, ok) - 1900;
     
     // months
     if (maxArgs >= 2 && idx < numArgs && ok)   
-        t->month = args.at(exec, idx++).toInt32(exec, ok);
+        t->month = args.at(idx++).toInt32(exec, ok);
     
     // days
     if (idx < numArgs && ok) {   
         t->monthDay = 0;
-        *ms += args.at(exec, idx).toInt32(exec, ok) * msPerDay;
+        *ms += args.at(idx).toInt32(exec, ok) * msPerDay;
     }
     
     return ok;
@@ -394,7 +396,7 @@
 
 // Functions
 
-JSValuePtr dateProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -411,7 +413,7 @@
     return jsNontrivialString(exec, formatDate(t) + " " + formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -428,7 +430,7 @@
     return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncToDateString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -445,7 +447,7 @@
     return jsNontrivialString(exec, formatDate(t));
 }
 
-JSValuePtr dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -462,7 +464,7 @@
     return jsNontrivialString(exec, formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -475,7 +477,7 @@
     return formatLocaleDate(exec, thisDateObj, milli, LocaleDateAndTime, args);
 }
 
-JSValuePtr dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -488,7 +490,7 @@
     return formatLocaleDate(exec, thisDateObj, milli, LocaleDate, args);
 }
 
-JSValuePtr dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -501,7 +503,7 @@
     return formatLocaleDate(exec, thisDateObj, milli, LocaleTime, args);
 }
 
-JSValuePtr dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -514,7 +516,7 @@
     return jsNumber(exec, milli);
 }
 
-JSValuePtr dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -531,7 +533,7 @@
     return jsNumber(exec, 1900 + t.year);
 }
 
-JSValuePtr dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -548,7 +550,7 @@
     return jsNumber(exec, 1900 + t.year);
 }
 
-JSValuePtr dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -565,7 +567,7 @@
     return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -582,7 +584,7 @@
     return jsNumber(exec, t.month);
 }
 
-JSValuePtr dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -599,7 +601,7 @@
     return jsNumber(exec, t.month);
 }
 
-JSValuePtr dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -616,7 +618,7 @@
     return jsNumber(exec, t.monthDay);
 }
 
-JSValuePtr dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -633,7 +635,7 @@
     return jsNumber(exec, t.monthDay);
 }
 
-JSValuePtr dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -650,7 +652,7 @@
     return jsNumber(exec, t.weekDay);
 }
 
-JSValuePtr dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -667,7 +669,7 @@
     return jsNumber(exec, t.weekDay);
 }
 
-JSValuePtr dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -684,7 +686,7 @@
     return jsNumber(exec, t.hour);
 }
 
-JSValuePtr dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -701,7 +703,7 @@
     return jsNumber(exec, t.hour);
 }
 
-JSValuePtr dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -718,7 +720,7 @@
     return jsNumber(exec, t.minute);
 }
 
-JSValuePtr dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -735,7 +737,7 @@
     return jsNumber(exec, t.minute);
 }
 
-JSValuePtr dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -752,7 +754,7 @@
     return jsNumber(exec, t.second);
 }
 
-JSValuePtr dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -769,7 +771,7 @@
     return jsNumber(exec, t.second);
 }
 
-JSValuePtr dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -784,7 +786,7 @@
     return jsNumber(exec, ms);
 }
 
-JSValuePtr dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -799,7 +801,7 @@
     return jsNumber(exec, ms);
 }
 
-JSValuePtr dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -816,20 +818,20 @@
     return jsNumber(exec, -gmtoffset(t) / minutesPerHour);
 }
 
-JSValuePtr dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    double milli = timeClip(args.at(exec, 0).toNumber(exec));
-    JSValuePtr result = jsNumber(exec, milli);
+    double milli = timeClip(args.at(0).toNumber(exec));
+    JSValue result = jsNumber(exec, milli);
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-static JSValuePtr setNewValueFromTimeArgs(ExecState* exec, JSValuePtr thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
+static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -838,7 +840,7 @@
     double milli = thisDateObj->internalNumber();
     
     if (args.isEmpty() || isnan(milli)) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }
@@ -850,24 +852,24 @@
     thisDateObj->msToGregorianDateTime(milli, inputIsUTC, t);
 
     if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &t)) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
     
-    JSValuePtr result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-static JSValuePtr setNewValueFromDateArgs(ExecState* exec, JSValuePtr thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
+static JSValue setNewValueFromDateArgs(ExecState* exec, JSValue thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
     if (args.isEmpty()) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }      
@@ -887,101 +889,101 @@
     }
     
     if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &t)) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
            
-    JSValuePtr result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-JSValuePtr dateProtoFuncSetMilliSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCMilliseconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCMilliseconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 4, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 4, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromDateArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromDateArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromDateArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromDateArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromDateArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromDateArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
@@ -990,7 +992,7 @@
 
     DateInstance* thisDateObj = asDateInstance(thisValue);     
     if (args.isEmpty()) { 
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }
@@ -1010,20 +1012,20 @@
     }
     
     bool ok = true;
-    int32_t year = args.at(exec, 0).toInt32(exec, ok);
+    int32_t year = args.at(0).toInt32(exec, ok);
     if (!ok) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }
             
     t.year = (year > 99 || year < 0) ? year - 1900 : year;
-    JSValuePtr result = jsNumber(exec, gregorianDateTimeToMS(t, ms, utc));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, utc));
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-JSValuePtr dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
diff --git a/JavaScriptCore/runtime/DatePrototype.h b/JavaScriptCore/runtime/DatePrototype.h
index a6bbdf2..5f4d0ec 100644
--- a/JavaScriptCore/runtime/DatePrototype.h
+++ b/JavaScriptCore/runtime/DatePrototype.h
@@ -36,7 +36,7 @@
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
diff --git a/JavaScriptCore/runtime/Error.cpp b/JavaScriptCore/runtime/Error.cpp
index 5e21c8e..db1d8cc 100644
--- a/JavaScriptCore/runtime/Error.cpp
+++ b/JavaScriptCore/runtime/Error.cpp
@@ -26,6 +26,7 @@
 
 #include "ConstructData.h"
 #include "ErrorConstructor.h"
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
 #include "JSString.h"
@@ -72,7 +73,7 @@
             break;
     }
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     if (message.isEmpty())
         args.append(jsString(exec, name));
     else
diff --git a/JavaScriptCore/runtime/ErrorConstructor.cpp b/JavaScriptCore/runtime/ErrorConstructor.cpp
index 5cc0df0..07b7e23 100644
--- a/JavaScriptCore/runtime/ErrorConstructor.cpp
+++ b/JavaScriptCore/runtime/ErrorConstructor.cpp
@@ -41,8 +41,8 @@
 ErrorInstance* constructError(ExecState* exec, const ArgList& args)
 {
     ErrorInstance* obj = new (exec) ErrorInstance(exec->lexicalGlobalObject()->errorStructure());
-    if (!args.at(exec, 0).isUndefined())
-        obj->putDirect(exec->propertyNames().message, jsString(exec, args.at(exec, 0).toString(exec)));
+    if (!args.at(0).isUndefined())
+        obj->putDirect(exec->propertyNames().message, jsString(exec, args.at(0).toString(exec)));
     return obj;
 }
 
@@ -58,7 +58,7 @@
 }
 
 // ECMA 15.9.2
-static JSValuePtr callErrorConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callErrorConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     // "Error()" gives the sames result as "new Error()"
     return constructError(exec, args);
diff --git a/JavaScriptCore/runtime/ErrorPrototype.cpp b/JavaScriptCore/runtime/ErrorPrototype.cpp
index 8703d81..599390e 100644
--- a/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ErrorPrototype.h"
 
+#include "JSFunction.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
@@ -30,7 +31,7 @@
 
 ASSERT_CLASS_FITS_IN_CELL(ErrorPrototype);
 
-static JSValuePtr errorProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL errorProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.9.4
 ErrorPrototype::ErrorPrototype(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
@@ -41,16 +42,16 @@
     putDirectWithoutTransition(exec->propertyNames().name, jsNontrivialString(exec, "Error"), DontEnum);
     putDirectWithoutTransition(exec->propertyNames().message, jsNontrivialString(exec, "Unknown error"), DontEnum);
 
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, errorProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, errorProtoFuncToString), DontEnum);
 }
 
-JSValuePtr errorProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
 
     UString s = "Error";
 
-    JSValuePtr v = thisObj->get(exec, exec->propertyNames().name);
+    JSValue v = thisObj->get(exec, exec->propertyNames().name);
     if (!v.isUndefined())
         s = v.toString(exec);
 
diff --git a/JavaScriptCore/runtime/ExceptionHelpers.cpp b/JavaScriptCore/runtime/ExceptionHelpers.cpp
index 30f1503..e63594c 100644
--- a/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -51,22 +51,22 @@
     virtual UString toString(ExecState*) const { return "JavaScript execution exceeded timeout."; }
 };
 
-JSValuePtr createInterruptedExecutionException(JSGlobalData* globalData)
+JSValue createInterruptedExecutionException(JSGlobalData* globalData)
 {
     return new (globalData) InterruptedExecutionError(globalData);
 }
 
-static JSValuePtr createError(ExecState* exec, ErrorType e, const char* msg)
+static JSValue createError(ExecState* exec, ErrorType e, const char* msg)
 {
     return Error::create(exec, e, msg, -1, -1, 0);
 }
 
-JSValuePtr createStackOverflowError(ExecState* exec)
+JSValue createStackOverflowError(ExecState* exec)
 {
     return createError(exec, RangeError, "Maximum call stack size exceeded.");
 }
 
-JSValuePtr createUndefinedVariableError(ExecState* exec, const Identifier& ident, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
     int endOffset = 0;
@@ -81,7 +81,7 @@
     return exception;
 }
     
-static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, int expressionStart, int expressionStop, JSValuePtr value, UString error)
+static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, int expressionStart, int expressionStop, JSValue value, UString error)
 {
     if (!expressionStop || expressionStart > codeBlock->source()->length()) {
         UString errorText = value.toString(exec);
@@ -125,7 +125,7 @@
     return errorText;
 }
 
-JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValuePtr value, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     UString message = "not a valid argument for '";
     message.append(op);
@@ -143,7 +143,7 @@
     return exception;
 }
 
-JSObject* createNotAConstructorError(ExecState* exec, JSValuePtr value, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSObject* createNotAConstructorError(ExecState* exec, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
     int endOffset = 0;
@@ -164,7 +164,7 @@
     return exception;
 }
 
-JSValuePtr createNotAFunctionError(ExecState* exec, JSValuePtr value, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSValue createNotAFunctionError(ExecState* exec, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
     int endOffset = 0;
diff --git a/JavaScriptCore/runtime/ExceptionHelpers.h b/JavaScriptCore/runtime/ExceptionHelpers.h
index d4dfdd8..09d99dc 100644
--- a/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -40,16 +40,16 @@
     class JSGlobalData;
     class JSNotAnObjectErrorStub;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class Node;
 
-    JSValuePtr createInterruptedExecutionException(JSGlobalData*);
-    JSValuePtr createStackOverflowError(ExecState*);
-    JSValuePtr createUndefinedVariableError(ExecState*, const Identifier&, unsigned bytecodeOffset, CodeBlock*);
+    JSValue createInterruptedExecutionException(JSGlobalData*);
+    JSValue createStackOverflowError(ExecState*);
+    JSValue createUndefinedVariableError(ExecState*, const Identifier&, unsigned bytecodeOffset, CodeBlock*);
     JSNotAnObjectErrorStub* createNotAnObjectErrorStub(ExecState*, bool isNull);
-    JSObject* createInvalidParamError(ExecState*, const char* op, JSValuePtr, unsigned bytecodeOffset, CodeBlock*);
-    JSObject* createNotAConstructorError(ExecState*, JSValuePtr, unsigned bytecodeOffset, CodeBlock*);
-    JSValuePtr createNotAFunctionError(ExecState*, JSValuePtr, unsigned bytecodeOffset, CodeBlock*);
+    JSObject* createInvalidParamError(ExecState*, const char* op, JSValue, unsigned bytecodeOffset, CodeBlock*);
+    JSObject* createNotAConstructorError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
+    JSValue createNotAFunctionError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSObject* createNotAnObjectError(ExecState*, JSNotAnObjectErrorStub*, unsigned bytecodeOffset, CodeBlock*);
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/FunctionConstructor.cpp b/JavaScriptCore/runtime/FunctionConstructor.cpp
index ff77b9d..f4f5cc8 100644
--- a/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -54,7 +54,7 @@
     return ConstructTypeHost;
 }
 
-static JSValuePtr callFunctionConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callFunctionConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructFunction(exec, args);
 }
@@ -75,17 +75,19 @@
     if (children.size() != 1)
         return 0;
 
-    ExprStatementNode* exprStatement = static_cast<ExprStatementNode*>(children[0].get()); 
+    StatementNode* exprStatement = children[0];
+    ASSERT(exprStatement);
     ASSERT(exprStatement->isExprStatement());
     if (!exprStatement || !exprStatement->isExprStatement())
         return 0;
 
-    FuncExprNode* funcExpr = static_cast<FuncExprNode*>(exprStatement->expr());
+    ExpressionNode* funcExpr = static_cast<ExprStatementNode*>(exprStatement)->expr();
+    ASSERT(funcExpr);
     ASSERT(funcExpr->isFuncExprNode());
     if (!funcExpr || !funcExpr->isFuncExprNode())
         return 0;
 
-    FunctionBodyNode* body = funcExpr->body();
+    FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
     ASSERT(body);
     return body;
 }
@@ -100,12 +102,12 @@
     if (args.isEmpty())
         program = "(function() { \n})";
     else if (args.size() == 1)
-        program = "(function() { " + args.at(exec, 0).toString(exec) + "\n})";
+        program = "(function() { " + args.at(0).toString(exec) + "\n})";
     else {
-        program = "(function(" + args.at(exec, 0).toString(exec);
+        program = "(function(" + args.at(0).toString(exec);
         for (size_t i = 1; i < args.size() - 1; i++)
-            program += "," + args.at(exec, i).toString(exec);
-        program += ") { " + args.at(exec, args.size() - 1).toString(exec) + "\n})";
+            program += "," + args.at(i).toString(exec);
+        program += ") { " + args.at(args.size() - 1).toString(exec) + "\n})";
     }
 
     int errLine;
diff --git a/JavaScriptCore/runtime/FunctionPrototype.cpp b/JavaScriptCore/runtime/FunctionPrototype.cpp
index 01fc57c..9ba2144 100644
--- a/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -33,9 +33,9 @@
 
 ASSERT_CLASS_FITS_IN_CELL(FunctionPrototype);
 
-static JSValuePtr functionProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionProtoFuncApply(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionProtoFuncCall(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionProtoFuncApply(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionProtoFuncCall(ExecState*, JSObject*, JSValue, const ArgList&);
 
 FunctionPrototype::FunctionPrototype(ExecState* exec, PassRefPtr<Structure> structure)
     : InternalFunction(&exec->globalData(), structure, exec->propertyNames().nullIdentifier)
@@ -43,14 +43,16 @@
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 0), DontDelete | ReadOnly | DontEnum);
 }
 
-void FunctionPrototype::addFunctionProperties(ExecState* exec, Structure* prototypeFunctionStructure)
+void FunctionPrototype::addFunctionProperties(ExecState* exec, Structure* prototypeFunctionStructure, NativeFunctionWrapper** callFunction, NativeFunctionWrapper** applyFunction)
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, functionProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 2, exec->propertyNames().apply, functionProtoFuncApply), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().call, functionProtoFuncCall), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, functionProtoFuncToString), DontEnum);
+    *applyFunction = new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().apply, functionProtoFuncApply);
+    putDirectFunctionWithoutTransition(exec, *applyFunction, DontEnum);
+    *callFunction = new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().call, functionProtoFuncCall);
+    putDirectFunctionWithoutTransition(exec, *callFunction, DontEnum);
 }
 
-static JSValuePtr callFunctionPrototype(ExecState*, JSObject*, JSValuePtr, const ArgList&)
+static JSValue JSC_HOST_CALL callFunctionPrototype(ExecState*, JSObject*, JSValue, const ArgList&)
 {
     return jsUndefined();
 }
@@ -80,13 +82,15 @@
     }
 }
 
-JSValuePtr functionProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (thisValue.isObject(&JSFunction::info)) {
         JSFunction* function = asFunction(thisValue);
-        UString functionBody = function->body()->toSourceString();
-        insertSemicolonIfNeeded(functionBody);
-        return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + function->body()->paramString() + ") " + functionBody);
+        if (!function->isHostFunction()) {
+            UString functionBody = function->body()->toSourceString();
+            insertSemicolonIfNeeded(functionBody);
+            return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + function->body()->paramString() + ") " + functionBody);
+        }
     }
 
     if (thisValue.isObject(&InternalFunction::info)) {
@@ -97,16 +101,16 @@
     return throwError(exec, TypeError);
 }
 
-JSValuePtr functionProtoFuncApply(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL functionProtoFuncApply(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
     CallType callType = thisValue.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSValuePtr array = args.at(exec, 1);
+    JSValue array = args.at(1);
 
-    ArgList applyArgs;
+    MarkedArgumentBuffer applyArgs;
     if (!array.isUndefinedOrNull()) {
         if (!array.isObject())
             return throwError(exec, TypeError);
@@ -122,10 +126,10 @@
             return throwError(exec, TypeError);
     }
 
-    return call(exec, thisValue, callType, callData, args.at(exec, 0), applyArgs);
+    return call(exec, thisValue, callType, callData, args.at(0), applyArgs);
 }
 
-JSValuePtr functionProtoFuncCall(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL functionProtoFuncCall(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
     CallType callType = thisValue.getCallData(callData);
@@ -134,7 +138,7 @@
 
     ArgList callArgs;
     args.getSlice(1, callArgs);
-    return call(exec, thisValue, callType, callData, args.at(exec, 0), callArgs);
+    return call(exec, thisValue, callType, callData, args.at(0), callArgs);
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/FunctionPrototype.h b/JavaScriptCore/runtime/FunctionPrototype.h
index 33d68b7..607ddab 100644
--- a/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/JavaScriptCore/runtime/FunctionPrototype.h
@@ -25,12 +25,14 @@
 
 namespace JSC {
 
+    class PrototypeFunction;
+
     class FunctionPrototype : public InternalFunction {
     public:
         FunctionPrototype(ExecState*, PassRefPtr<Structure>);
-        void addFunctionProperties(ExecState*, Structure* prototypeFunctionStructure);
+        void addFunctionProperties(ExecState*, Structure* prototypeFunctionStructure, NativeFunctionWrapper** callFunction, NativeFunctionWrapper** applyFunction);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto)
+        static PassRefPtr<Structure> createStructure(JSValue proto)
         {
             return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
         }
diff --git a/JavaScriptCore/runtime/GetterSetter.cpp b/JavaScriptCore/runtime/GetterSetter.cpp
index 39ee6fc..cd1b40a 100644
--- a/JavaScriptCore/runtime/GetterSetter.cpp
+++ b/JavaScriptCore/runtime/GetterSetter.cpp
@@ -38,17 +38,17 @@
         m_setter->mark();
 }
 
-JSValuePtr GetterSetter::toPrimitive(ExecState*, PreferredPrimitiveType) const
+JSValue GetterSetter::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     ASSERT_NOT_REACHED();
     return jsNull();
 }
 
-bool GetterSetter::getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value)
+bool GetterSetter::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
 {
     ASSERT_NOT_REACHED();
     number = 0;
-    value = noValue();
+    value = JSValue();
     return true;
 }
 
diff --git a/JavaScriptCore/runtime/GetterSetter.h b/JavaScriptCore/runtime/GetterSetter.h
index 48e1baf..e6b74a1 100644
--- a/JavaScriptCore/runtime/GetterSetter.h
+++ b/JavaScriptCore/runtime/GetterSetter.h
@@ -50,8 +50,8 @@
     private:
         virtual bool isGetterSetter() const;
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -61,9 +61,9 @@
         JSObject* m_setter;  
     };
 
-    GetterSetter* asGetterSetter(JSValuePtr);
+    GetterSetter* asGetterSetter(JSValue);
 
-    inline GetterSetter* asGetterSetter(JSValuePtr value)
+    inline GetterSetter* asGetterSetter(JSValue value)
     {
         ASSERT(asCell(value)->isGetterSetter());
         return static_cast<GetterSetter*>(asCell(value));
diff --git a/JavaScriptCore/runtime/InitializeThreading.cpp b/JavaScriptCore/runtime/InitializeThreading.cpp
index cda9fb1..a0620e7 100644
--- a/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -31,11 +31,11 @@
 
 #include "JSImmediate.h"
 #include "Collector.h"
-#include "DateMath.h"
 #include "dtoa.h"
 #include "Identifier.h"
 #include "JSGlobalObject.h"
 #include "UString.h"
+#include <wtf/DateMath.h>
 #include <wtf/Threading.h>
 
 using namespace WTF;
@@ -52,7 +52,7 @@
     initializeUString();
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex = new Mutex;
-    initDateMath();
+    WTF::initializeDates();
 #endif
 }
 
diff --git a/JavaScriptCore/runtime/InternalFunction.cpp b/JavaScriptCore/runtime/InternalFunction.cpp
index 6714cf5..b5c9571 100644
--- a/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/JavaScriptCore/runtime/InternalFunction.cpp
@@ -48,4 +48,24 @@
     return asString(getDirect(globalData->propertyNames->name))->value();
 }
 
+const UString InternalFunction::displayName(JSGlobalData* globalData)
+{
+    JSValue displayName = getDirect(globalData->propertyNames->displayName);
+    
+    if (displayName && isJSString(globalData, displayName))
+        return asString(displayName)->value();
+    
+    return UString::null();
+}
+
+const UString InternalFunction::calculatedDisplayName(JSGlobalData* globalData)
+{
+    const UString explicitName = displayName(globalData);
+    
+    if (!explicitName.isEmpty())
+        return explicitName;
+    
+    return name(globalData);
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/InternalFunction.h b/JavaScriptCore/runtime/InternalFunction.h
index cc4b917..310644c 100644
--- a/JavaScriptCore/runtime/InternalFunction.h
+++ b/JavaScriptCore/runtime/InternalFunction.h
@@ -34,11 +34,13 @@
     class InternalFunction : public JSObject {
     public:
         virtual const ClassInfo* classInfo() const; 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
         const UString& name(JSGlobalData*);
+        const UString displayName(JSGlobalData*);
+        const UString calculatedDisplayName(JSGlobalData*);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+        static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
             return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot)); 
         }
@@ -51,9 +53,9 @@
         virtual CallType getCallData(CallData&) = 0;
     };
 
-    InternalFunction* asInternalFunction(JSValuePtr);
+    InternalFunction* asInternalFunction(JSValue);
 
-    inline InternalFunction* asInternalFunction(JSValuePtr value)
+    inline InternalFunction* asInternalFunction(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&InternalFunction::info));
         return static_cast<InternalFunction*>(asObject(value));
diff --git a/JavaScriptCore/runtime/JSActivation.cpp b/JavaScriptCore/runtime/JSActivation.cpp
index a2d2634..8996629 100644
--- a/JavaScriptCore/runtime/JSActivation.cpp
+++ b/JavaScriptCore/runtime/JSActivation.cpp
@@ -75,7 +75,7 @@
 
     for ( ; i < count; ++i) {
         Register& r = registerArray[i];
-        if (!r.marked())
+        if (r.jsValue() && !r.marked())
             r.mark();
     }
 }
@@ -85,7 +85,7 @@
     if (symbolTableGet(propertyName, slot))
         return true;
 
-    if (JSValuePtr* location = getDirectLocation(propertyName)) {
+    if (JSValue* location = getDirectLocation(propertyName)) {
         slot.setValueSlot(location);
         return true;
     }
@@ -103,7 +103,7 @@
     return false;
 }
 
-void JSActivation::put(ExecState*, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSActivation::put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -118,7 +118,7 @@
 }
 
 // FIXME: Make this function honor ReadOnly (const) and DontEnum
-void JSActivation::putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSActivation::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -130,7 +130,7 @@
     // expose in the activation object.
     ASSERT(!hasGetterSetterProperties());
     PutPropertySlot slot;
-    putDirect(propertyName, value, attributes, true, slot);
+    JSObject::putWithAttributes(exec, propertyName, value, attributes, true, slot);
 }
 
 bool JSActivation::deleteProperty(ExecState* exec, const Identifier& propertyName)
@@ -151,7 +151,7 @@
     return d()->functionBody->usesEval();
 }
 
-JSValuePtr JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSActivation* activation = asActivation(slot.slotBase());
 
diff --git a/JavaScriptCore/runtime/JSActivation.h b/JavaScriptCore/runtime/JSActivation.h
index 5e82bdc..c183dac 100644
--- a/JavaScriptCore/runtime/JSActivation.h
+++ b/JavaScriptCore/runtime/JSActivation.h
@@ -54,9 +54,9 @@
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
 
-        virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
-        virtual void putWithAttributes(ExecState*, const Identifier&, JSValuePtr, unsigned attributes);
+        virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
 
         virtual JSObject* toThisObject(ExecState*) const;
@@ -66,7 +66,7 @@
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
 
     private:
         struct JSActivationData : public JSVariableObjectData {
@@ -79,15 +79,15 @@
             RefPtr<FunctionBodyNode> functionBody;
         };
         
-        static JSValuePtr argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
         NEVER_INLINE PropertySlot::GetValueFunc getArgumentsGetter();
 
         JSActivationData* d() const { return static_cast<JSActivationData*>(JSVariableObject::d); }
     };
 
-    JSActivation* asActivation(JSValuePtr);
+    JSActivation* asActivation(JSValue);
 
-    inline JSActivation* asActivation(JSValuePtr value)
+    inline JSActivation* asActivation(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&JSActivation::info));
         return static_cast<JSActivation*>(asObject(value));
diff --git a/JavaScriptCore/runtime/JSArray.cpp b/JavaScriptCore/runtime/JSArray.cpp
index 89a2b45..296ac9d 100644
--- a/JavaScriptCore/runtime/JSArray.cpp
+++ b/JavaScriptCore/runtime/JSArray.cpp
@@ -24,9 +24,11 @@
 #include "JSArray.h"
 
 #include "ArrayPrototype.h"
+#include "CachedCall.h"
 #include "PropertyNameArray.h"
 #include <wtf/AVLTree.h>
 #include <wtf/Assertions.h>
+#include <wtf/OwnPtr.h>
 #include <Operations.h>
 
 #define CHECK_ARRAY_CONSISTENCY 0
@@ -65,9 +67,9 @@
 
 // The definition of MAX_STORAGE_VECTOR_LENGTH is dependant on the definition storageSize
 // function below - the MAX_STORAGE_VECTOR_LENGTH limit is defined such that the storage
-// size calculation cannot overflow.  (sizeof(ArrayStorage) - sizeof(JSValuePtr)) +
-// (vectorLength * sizeof(JSValuePtr)) must be <= 0xFFFFFFFFU (which is maximum value of size_t).
-#define MAX_STORAGE_VECTOR_LENGTH static_cast<unsigned>((0xFFFFFFFFU - (sizeof(ArrayStorage) - sizeof(JSValuePtr))) / sizeof(JSValuePtr))
+// size calculation cannot overflow.  (sizeof(ArrayStorage) - sizeof(JSValue)) +
+// (vectorLength * sizeof(JSValue)) must be <= 0xFFFFFFFFU (which is maximum value of size_t).
+#define MAX_STORAGE_VECTOR_LENGTH static_cast<unsigned>((0xFFFFFFFFU - (sizeof(ArrayStorage) - sizeof(JSValue))) / sizeof(JSValue))
 
 // These values have to be macros to be used in max() and min() without introducing
 // a PIC branch in Mach-O binaries, see <rdar://problem/5971391>.
@@ -90,10 +92,10 @@
 
     // MAX_STORAGE_VECTOR_LENGTH is defined such that provided (vectorLength <= MAX_STORAGE_VECTOR_LENGTH)
     // - as asserted above - the following calculation cannot overflow.
-    size_t size = (sizeof(ArrayStorage) - sizeof(JSValuePtr)) + (vectorLength * sizeof(JSValuePtr));
+    size_t size = (sizeof(ArrayStorage) - sizeof(JSValue)) + (vectorLength * sizeof(JSValue));
     // Assertion to detect integer overflow in previous calculation (should not be possible, provided that
     // MAX_STORAGE_VECTOR_LENGTH is correctly defined).
-    ASSERT(((size - (sizeof(ArrayStorage) - sizeof(JSValuePtr))) / sizeof(JSValuePtr) == vectorLength) && (size >= (sizeof(ArrayStorage) - sizeof(JSValuePtr))));
+    ASSERT(((size - (sizeof(ArrayStorage) - sizeof(JSValue))) / sizeof(JSValue) == vectorLength) && (size >= (sizeof(ArrayStorage) - sizeof(JSValue))));
 
     return size;
 }
@@ -149,12 +151,12 @@
     m_storage->m_vectorLength = initialCapacity;
     m_storage->m_length = initialLength;
 
-    Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValuePtr));
+    Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValue));
 
     checkConsistency();
 }
 
-JSArray::JSArray(ExecState* exec, PassRefPtr<Structure> structure, const ArgList& list)
+JSArray::JSArray(PassRefPtr<Structure> structure, const ArgList& list)
     : JSObject(structure)
 {
     unsigned length = list.size();
@@ -171,7 +173,7 @@
     size_t i = 0;
     ArgList::const_iterator end = list.end();
     for (ArgList::const_iterator it = list.begin(); it != end; ++it, ++i)
-        storage->m_vector[i] = (*it).jsValue(exec);
+        storage->m_vector[i] = *it;
 
     m_storage = storage;
 
@@ -199,7 +201,7 @@
     }
 
     if (i < storage->m_vectorLength) {
-        JSValuePtr& valueSlot = storage->m_vector[i];
+        JSValue& valueSlot = storage->m_vector[i];
         if (valueSlot) {
             slot.setValueSlot(&valueSlot);
             return true;
@@ -233,7 +235,7 @@
 }
 
 // ECMA 15.4.5.1
-void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool isArrayIndex;
     unsigned i = propertyName.toArrayIndex(&isArrayIndex);
@@ -255,7 +257,7 @@
     JSObject::put(exec, propertyName, value, slot);
 }
 
-void JSArray::put(ExecState* exec, unsigned i, JSValuePtr value)
+void JSArray::put(ExecState* exec, unsigned i, JSValue value)
 {
     checkConsistency();
 
@@ -266,7 +268,7 @@
     }
 
     if (i < m_storage->m_vectorLength) {
-        JSValuePtr& valueSlot = m_storage->m_vector[i];
+        JSValue& valueSlot = m_storage->m_vector[i];
         if (valueSlot) {
             valueSlot = value;
             checkConsistency();
@@ -282,7 +284,7 @@
     putSlowCase(exec, i, value);
 }
 
-NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValuePtr value)
+NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue value)
 {
     ArrayStorage* storage = m_storage;
     SparseArrayValueMap* map = storage->m_sparseValueMap;
@@ -353,12 +355,12 @@
 
     if (newNumValuesInVector == storage->m_numValuesInVector + 1) {
         for (unsigned j = vectorLength; j < newVectorLength; ++j)
-            storage->m_vector[j] = noValue();
+            storage->m_vector[j] = JSValue();
         if (i > MIN_SPARSE_ARRAY_INDEX)
             map->remove(i);
     } else {
         for (unsigned j = vectorLength; j < max(vectorLength, MIN_SPARSE_ARRAY_INDEX); ++j)
-            storage->m_vector[j] = noValue();
+            storage->m_vector[j] = JSValue();
         for (unsigned j = max(vectorLength, MIN_SPARSE_ARRAY_INDEX); j < newVectorLength; ++j)
             storage->m_vector[j] = map->take(j);
     }
@@ -393,12 +395,12 @@
     ArrayStorage* storage = m_storage;
 
     if (i < storage->m_vectorLength) {
-        JSValuePtr& valueSlot = storage->m_vector[i];
+        JSValue& valueSlot = storage->m_vector[i];
         if (!valueSlot) {
             checkConsistency();
             return false;
         }
-        valueSlot = noValue();
+        valueSlot = JSValue();
         --storage->m_numValuesInVector;
         if (m_fastAccessCutoff > i)
             m_fastAccessCutoff = i;
@@ -468,7 +470,7 @@
     storage->m_vectorLength = newVectorLength;
 
     for (unsigned i = vectorLength; i < newVectorLength; ++i)
-        storage->m_vector[i] = noValue();
+        storage->m_vector[i] = JSValue();
 
     m_storage = storage;
     return true;
@@ -488,9 +490,9 @@
 
         unsigned usedVectorLength = min(length, storage->m_vectorLength);
         for (unsigned i = newLength; i < usedVectorLength; ++i) {
-            JSValuePtr& valueSlot = storage->m_vector[i];
+            JSValue& valueSlot = storage->m_vector[i];
             bool hadValue = valueSlot;
-            valueSlot = noValue();
+            valueSlot = JSValue();
             storage->m_numValuesInVector -= hadValue;
         }
 
@@ -513,7 +515,7 @@
     checkConsistency();
 }
 
-JSValuePtr JSArray::pop()
+JSValue JSArray::pop()
 {
     checkConsistency();
 
@@ -523,19 +525,19 @@
 
     --length;
 
-    JSValuePtr result;
+    JSValue result;
 
     if (m_fastAccessCutoff > length) {
-        JSValuePtr& valueSlot = m_storage->m_vector[length];
+        JSValue& valueSlot = m_storage->m_vector[length];
         result = valueSlot;
         ASSERT(result);
-        valueSlot = noValue();
+        valueSlot = JSValue();
         --m_storage->m_numValuesInVector;
         m_fastAccessCutoff = length;
     } else if (length < m_storage->m_vectorLength) {
-        JSValuePtr& valueSlot = m_storage->m_vector[length];
+        JSValue& valueSlot = m_storage->m_vector[length];
         result = valueSlot;
-        valueSlot = noValue();
+        valueSlot = JSValue();
         if (result)
             --m_storage->m_numValuesInVector;
         else
@@ -562,7 +564,7 @@
     return result;
 }
 
-void JSArray::push(ExecState* exec, JSValuePtr value)
+void JSArray::push(ExecState* exec, JSValue value)
 {
     checkConsistency();
 
@@ -602,7 +604,7 @@
 
     unsigned usedVectorLength = min(storage->m_length, storage->m_vectorLength);
     for (unsigned i = 0; i < usedVectorLength; ++i) {
-        JSValuePtr value = storage->m_vector[i];
+        JSValue value = storage->m_vector[i];
         if (value && !value.marked())
             value.mark();
     }
@@ -610,7 +612,7 @@
     if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
         SparseArrayValueMap::iterator end = map->end();
         for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it) {
-            JSValuePtr value = it->second;
+            JSValue value = it->second;
             if (!value.marked())
                 value.mark();
         }
@@ -619,12 +621,12 @@
 
 static int compareNumbersForQSort(const void* a, const void* b)
 {
-    double da = static_cast<const JSValuePtr*>(a)->uncheckedGetNumber();
-    double db = static_cast<const JSValuePtr*>(b)->uncheckedGetNumber();
+    double da = static_cast<const JSValue*>(a)->uncheckedGetNumber();
+    double db = static_cast<const JSValue*>(b)->uncheckedGetNumber();
     return (da > db) - (da < db);
 }
 
-typedef std::pair<JSValuePtr, UString> ValueStringPair;
+typedef std::pair<JSValue, UString> ValueStringPair;
 
 static int compareByStringPairForQSort(const void* a, const void* b)
 {
@@ -633,7 +635,7 @@
     return compare(va->second, vb->second);
 }
 
-void JSArray::sortNumeric(ExecState* exec, JSValuePtr compareFunction, CallType callType, const CallData& callData)
+void JSArray::sortNumeric(ExecState* exec, JSValue compareFunction, CallType callType, const CallData& callData)
 {
     unsigned lengthNotIncludingUndefined = compactForSorting();
     if (m_storage->m_sparseValueMap) {
@@ -659,7 +661,7 @@
     // For numeric comparison, which is fast, qsort is faster than mergesort. We
     // also don't require mergesort's stability, since there's no user visible
     // side-effect from swapping the order of equal primitive values.
-    qsort(m_storage->m_vector, size, sizeof(JSValuePtr), compareNumbersForQSort);
+    qsort(m_storage->m_vector, size, sizeof(JSValue), compareNumbersForQSort);
 
     checkConsistency(SortConsistencyCheck);
 }
@@ -687,7 +689,7 @@
     }
 
     for (size_t i = 0; i < lengthNotIncludingUndefined; i++) {
-        JSValuePtr value = m_storage->m_vector[i];
+        JSValue value = m_storage->m_vector[i];
         ASSERT(!value.isUndefined());
         values[i].first = value;
     }
@@ -725,7 +727,7 @@
 }
 
 struct AVLTreeNodeForArrayCompare {
-    JSValuePtr value;
+    JSValue value;
 
     // Child pointers.  The high bit of gt is robbed and used as the
     // balance factor sign.  The high bit of lt is robbed and used as
@@ -736,15 +738,16 @@
 
 struct AVLTreeAbstractorForArrayCompare {
     typedef int32_t handle; // Handle is an index into m_nodes vector.
-    typedef JSValuePtr key;
+    typedef JSValue key;
     typedef int32_t size;
 
     Vector<AVLTreeNodeForArrayCompare> m_nodes;
     ExecState* m_exec;
-    JSValuePtr m_compareFunction;
+    JSValue m_compareFunction;
     CallType m_compareCallType;
     const CallData* m_compareCallData;
-    JSValuePtr m_globalThisValue;
+    JSValue m_globalThisValue;
+    OwnPtr<CachedCall> m_cachedCall;
 
     handle get_less(handle h) { return m_nodes[h].lt & 0x7FFFFFFF; }
     void set_less(handle h, handle lh) { m_nodes[h].lt &= 0x80000000; m_nodes[h].lt |= lh; }
@@ -780,10 +783,18 @@
         if (m_exec->hadException())
             return 1;
 
-        ArgList arguments;
-        arguments.append(va);
-        arguments.append(vb);
-        double compareResult = call(m_exec, m_compareFunction, m_compareCallType, *m_compareCallData, m_globalThisValue, arguments).toNumber(m_exec);
+        double compareResult;
+        if (m_cachedCall) {
+            m_cachedCall->setThis(m_globalThisValue);
+            m_cachedCall->setArgument(0, va);
+            m_cachedCall->setArgument(1, vb);
+            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame());
+        } else {
+            MarkedArgumentBuffer arguments;
+            arguments.append(va);
+            arguments.append(vb);
+            compareResult = call(m_exec, m_compareFunction, m_compareCallType, *m_compareCallData, m_globalThisValue, arguments).toNumber(m_exec);
+        }
         return (compareResult < 0) ? -1 : 1; // Not passing equality through, because we need to store all values, even if equivalent.
     }
 
@@ -793,7 +804,7 @@
     static handle null() { return 0x7FFFFFFF; }
 };
 
-void JSArray::sort(ExecState* exec, JSValuePtr compareFunction, CallType callType, const CallData& callData)
+void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType, const CallData& callData)
 {
     checkConsistency();
 
@@ -818,6 +829,9 @@
     tree.abstractor().m_globalThisValue = exec->globalThisValue();
     tree.abstractor().m_nodes.resize(usedVectorLength + (m_storage->m_sparseValueMap ? m_storage->m_sparseValueMap->size() : 0));
 
+    if (callType == CallTypeJS)
+        tree.abstractor().m_cachedCall.set(new CachedCall(exec, asFunction(compareFunction), 2, exec->exceptionSlot()));
+
     if (!tree.abstractor().m_nodes.begin()) {
         throwOutOfMemoryError(exec);
         return;
@@ -831,14 +845,14 @@
 
     // Iterate over the array, ignoring missing values, counting undefined ones, and inserting all other ones into the tree.
     for (; numDefined < usedVectorLength; ++numDefined) {
-        JSValuePtr v = m_storage->m_vector[numDefined];
+        JSValue v = m_storage->m_vector[numDefined];
         if (!v || v.isUndefined())
             break;
         tree.abstractor().m_nodes[numDefined].value = v;
         tree.insert(numDefined);
     }
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
-        JSValuePtr v = m_storage->m_vector[i];
+        JSValue v = m_storage->m_vector[i];
         if (v) {
             if (v.isUndefined())
                 ++numUndefined;
@@ -892,7 +906,7 @@
 
     // Ensure that unused values in the vector are zeroed out.
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
-        m_storage->m_vector[i] = noValue();
+        m_storage->m_vector[i] = JSValue();
 
     m_fastAccessCutoff = newUsedVectorLength;
     m_storage->m_numValuesInVector = newUsedVectorLength;
@@ -900,7 +914,7 @@
     checkConsistency(SortConsistencyCheck);
 }
 
-void JSArray::fillArgList(ExecState* exec, ArgList& args)
+void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 {
     unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
     unsigned i = 0;
@@ -910,6 +924,19 @@
         args.append(get(exec, i));
 }
 
+void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize)
+{
+    ASSERT(m_storage->m_length == maxSize);
+    UNUSED_PARAM(maxSize);
+    unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
+    unsigned i = 0;
+    for (; i < fastAccessLength; ++i)
+        buffer[i] = getIndex(i);
+    uint32_t size = m_storage->m_length;
+    for (; i < size; ++i)
+        buffer[i] = get(exec, i);
+}
+
 unsigned JSArray::compactForSorting()
 {
     checkConsistency();
@@ -922,12 +949,12 @@
     unsigned numUndefined = 0;
 
     for (; numDefined < usedVectorLength; ++numDefined) {
-        JSValuePtr v = storage->m_vector[numDefined];
+        JSValue v = storage->m_vector[numDefined];
         if (!v || v.isUndefined())
             break;
     }
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
-        JSValuePtr v = storage->m_vector[i];
+        JSValue v = storage->m_vector[i];
         if (v) {
             if (v.isUndefined())
                 ++numUndefined;
@@ -959,7 +986,7 @@
     for (unsigned i = numDefined; i < newUsedVectorLength; ++i)
         storage->m_vector[i] = jsUndefined();
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
-        storage->m_vector[i] = noValue();
+        storage->m_vector[i] = JSValue();
 
     m_fastAccessCutoff = newUsedVectorLength;
     storage->m_numValuesInVector = newUsedVectorLength;
@@ -992,7 +1019,7 @@
 
     unsigned numValuesInVector = 0;
     for (unsigned i = 0; i < m_storage->m_vectorLength; ++i) {
-        if (JSValuePtr value = m_storage->m_vector[i]) {
+        if (JSValue value = m_storage->m_vector[i]) {
             ASSERT(i < m_storage->m_length);
             if (type != DestructorConsistencyCheck)
                 value->type(); // Likely to crash if the object was deallocated.
@@ -1031,16 +1058,16 @@
     return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), initialLength);
 }
 
-JSArray* constructArray(ExecState* exec, JSValuePtr singleItemValue)
+JSArray* constructArray(ExecState* exec, JSValue singleItemValue)
 {
-    ArgList values;
+    MarkedArgumentBuffer values;
     values.append(singleItemValue);
-    return new (exec) JSArray(exec, exec->lexicalGlobalObject()->arrayStructure(), values);
+    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
 }
 
 JSArray* constructArray(ExecState* exec, const ArgList& values)
 {
-    return new (exec) JSArray(exec, exec->lexicalGlobalObject()->arrayStructure(), values);
+    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSArray.h b/JavaScriptCore/runtime/JSArray.h
index f873f13..ea490d8 100644
--- a/JavaScriptCore/runtime/JSArray.h
+++ b/JavaScriptCore/runtime/JSArray.h
@@ -25,7 +25,7 @@
 
 namespace JSC {
 
-    typedef HashMap<unsigned, JSValuePtr> SparseArrayValueMap;
+    typedef HashMap<unsigned, JSValue> SparseArrayValueMap;
 
     struct ArrayStorage {
         unsigned m_length;
@@ -33,7 +33,7 @@
         unsigned m_numValuesInVector;
         SparseArrayValueMap* m_sparseValueMap;
         void* lazyCreationData; // A JSArray subclass can use this to fill the vector lazily.
-        JSValuePtr m_vector[1];
+        JSValue m_vector[1];
     };
 
     class JSArray : public JSObject {
@@ -42,48 +42,49 @@
     public:
         explicit JSArray(PassRefPtr<Structure>);
         JSArray(PassRefPtr<Structure>, unsigned initialLength);
-        JSArray(ExecState*, PassRefPtr<Structure>, const ArgList& initialValues);
+        JSArray(PassRefPtr<Structure>, const ArgList& initialValues);
         virtual ~JSArray();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr); // FIXME: Make protected and add setItem.
+        virtual void put(ExecState*, unsigned propertyName, JSValue); // FIXME: Make protected and add setItem.
 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
         unsigned length() const { return m_storage->m_length; }
         void setLength(unsigned); // OK to use on new arrays, but not if it might be a RegExpMatchArray.
 
         void sort(ExecState*);
-        void sort(ExecState*, JSValuePtr compareFunction, CallType, const CallData&);
-        void sortNumeric(ExecState*, JSValuePtr compareFunction, CallType, const CallData&);
+        void sort(ExecState*, JSValue compareFunction, CallType, const CallData&);
+        void sortNumeric(ExecState*, JSValue compareFunction, CallType, const CallData&);
 
-        void push(ExecState*, JSValuePtr);
-        JSValuePtr pop();
+        void push(ExecState*, JSValue);
+        JSValue pop();
 
         bool canGetIndex(unsigned i) { return i < m_fastAccessCutoff; }
-        JSValuePtr getIndex(unsigned i)
+        JSValue getIndex(unsigned i)
         {
             ASSERT(canGetIndex(i));
             return m_storage->m_vector[i];
         }
 
         bool canSetIndex(unsigned i) { return i < m_fastAccessCutoff; }
-        JSValuePtr setIndex(unsigned i, JSValuePtr v)
+        JSValue setIndex(unsigned i, JSValue v)
         {
             ASSERT(canSetIndex(i));
             return m_storage->m_vector[i] = v;
         }
 
-        void fillArgList(ExecState*, ArgList&);
+        void fillArgList(ExecState*, MarkedArgumentBuffer&);
+        void copyToRegisters(ExecState*, Register*, uint32_t);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
 
     protected:
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
@@ -96,7 +97,7 @@
         virtual const ClassInfo* classInfo() const { return &info; }
 
         bool getOwnPropertySlotSlowCase(ExecState*, unsigned propertyName, PropertySlot&);
-        void putSlowCase(ExecState*, unsigned propertyName, JSValuePtr);
+        void putSlowCase(ExecState*, unsigned propertyName, JSValue);
 
         bool increaseVectorLength(unsigned newLength);
         
@@ -109,20 +110,20 @@
         ArrayStorage* m_storage;
     };
 
-    JSArray* asArray(JSValuePtr);
+    JSArray* asArray(JSValue);
 
     JSArray* constructEmptyArray(ExecState*);
     JSArray* constructEmptyArray(ExecState*, unsigned initialLength);
-    JSArray* constructArray(ExecState*, JSValuePtr singleItemValue);
+    JSArray* constructArray(ExecState*, JSValue singleItemValue);
     JSArray* constructArray(ExecState*, const ArgList& values);
 
-    inline JSArray* asArray(JSValuePtr value)
+    inline JSArray* asArray(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&JSArray::info));
         return static_cast<JSArray*>(asObject(value));
     }
 
-    inline bool isJSArray(JSGlobalData* globalData, JSValuePtr v) { return v.isCell() && v.asCell()->vptr() == globalData->jsArrayVPtr; }
+    inline bool isJSArray(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsArrayVPtr; }
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/JSByteArray.cpp b/JavaScriptCore/runtime/JSByteArray.cpp
index 54cf7cb..2a5e72f 100644
--- a/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/JavaScriptCore/runtime/JSByteArray.cpp
@@ -43,7 +43,7 @@
     putDirect(exec->globalData().propertyNames->length, jsNumber(exec, m_storage->length()), ReadOnly | DontDelete);
 }
     
-PassRefPtr<Structure> JSByteArray::createStructure(JSValuePtr prototype)
+PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
 {
     PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType));
     return result;
@@ -69,7 +69,7 @@
     return JSObject::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-void JSByteArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSByteArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
@@ -80,7 +80,7 @@
     JSObject::put(exec, propertyName, value, slot);
 }
 
-void JSByteArray::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+void JSByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     setIndex(exec, propertyName, value);
 }
diff --git a/JavaScriptCore/runtime/JSByteArray.h b/JavaScriptCore/runtime/JSByteArray.h
index eb8e0ac..57374e0 100644
--- a/JavaScriptCore/runtime/JSByteArray.h
+++ b/JavaScriptCore/runtime/JSByteArray.h
@@ -36,7 +36,7 @@
         friend class VPtrSet;
     public:
         bool canAccessIndex(unsigned i) { return i < m_storage->length(); }
-        JSValuePtr getIndex(ExecState* exec, unsigned i)
+        JSValue getIndex(ExecState* exec, unsigned i)
         {
             ASSERT(canAccessIndex(i));
             return jsNumber(exec, m_storage->data()[i]);
@@ -64,7 +64,7 @@
             m_storage->data()[i] = static_cast<unsigned char>(value + 0.5);
         }
         
-        void setIndex(ExecState* exec, unsigned i, JSValuePtr value)
+        void setIndex(ExecState* exec, unsigned i, JSValue value)
         {
             double byteValue = value.toNumber(exec);
             if (exec->hadException())
@@ -74,12 +74,12 @@
         }
 
         JSByteArray(ExecState* exec, PassRefPtr<Structure>, WTF::ByteArray* storage, const JSC::ClassInfo* = &s_defaultInfo);
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype);
+        static PassRefPtr<Structure> createStructure(JSValue prototype);
         
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-        virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValuePtr);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+        virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
 
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
@@ -102,13 +102,13 @@
         const ClassInfo* m_classInfo;
     };
     
-    JSByteArray* asByteArray(JSValuePtr value);
-    inline JSByteArray* asByteArray(JSValuePtr value)
+    JSByteArray* asByteArray(JSValue value);
+    inline JSByteArray* asByteArray(JSValue value)
     {
         return static_cast<JSByteArray*>(asCell(value));
     }
 
-    inline bool isJSByteArray(JSGlobalData* globalData, JSValuePtr v) { return v.isCell() && v.asCell()->vptr() == globalData->jsByteArrayVPtr; }
+    inline bool isJSByteArray(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsByteArrayVPtr; }
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/JSCell.cpp b/JavaScriptCore/runtime/JSCell.cpp
index d449deb..8cf7943 100644
--- a/JavaScriptCore/runtime/JSCell.cpp
+++ b/JavaScriptCore/runtime/JSCell.cpp
@@ -157,12 +157,12 @@
     return true;
 }
 
-void JSCell::put(ExecState* exec, const Identifier& identifier, JSValuePtr value, PutPropertySlot& slot)
+void JSCell::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     toObject(exec)->put(exec, identifier, value, slot);
 }
 
-void JSCell::put(ExecState* exec, unsigned identifier, JSValuePtr value)
+void JSCell::put(ExecState* exec, unsigned identifier, JSValue value)
 {
     toObject(exec)->put(exec, identifier, value);
 }
@@ -197,9 +197,9 @@
     return 0;
 }
 
-JSValuePtr JSCell::getJSNumber()
+JSValue JSCell::getJSNumber()
 {
-    return noValue();
+    return JSValue();
 }
 
 bool JSCell::isGetterSetter() const
diff --git a/JavaScriptCore/runtime/JSCell.h b/JavaScriptCore/runtime/JSCell.h
index 1973c54..e0a9b4d 100644
--- a/JavaScriptCore/runtime/JSCell.h
+++ b/JavaScriptCore/runtime/JSCell.h
@@ -39,7 +39,7 @@
         friend class JSObject;
         friend class JSPropertyNameIterator;
         friend class JSString;
-        friend class JSValuePtr;
+        friend class JSValue;
         friend class VPtrSet;
 
     private:
@@ -66,14 +66,14 @@
         virtual ConstructType getConstructData(ConstructData&);
 
         // Extracting integer values.
-        // FIXME: remove these methods, can check isNumberCell in JSValuePtr && then call asNumberCell::*.
+        // FIXME: remove these methods, can check isNumberCell in JSValue && then call asNumberCell::*.
         virtual bool getUInt32(uint32_t&) const;
         virtual bool getTruncatedInt32(int32_t&) const;
         virtual bool getTruncatedUInt32(uint32_t&) const;
 
         // Basic conversions.
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const = 0;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr&) = 0;
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const = 0;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&) = 0;
         virtual bool toBoolean(ExecState*) const = 0;
         virtual double toNumber(ExecState*) const = 0;
         virtual UString toString(ExecState*) const = 0;
@@ -88,15 +88,15 @@
 
         // Object operations, with the toObject operation included.
         virtual const ClassInfo* classInfo() const;
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
         virtual JSObject* toThisObject(ExecState*) const;
         virtual UString toThisString(ExecState*) const;
         virtual JSString* toThisJSString(ExecState*);
-        virtual JSValuePtr getJSNumber();
+        virtual JSValue getJSNumber();
         void* vptr() { return *reinterpret_cast<void**>(this); }
 
     private:
@@ -108,9 +108,9 @@
         Structure* m_structure;
     };
 
-    JSCell* asCell(JSValuePtr);
+    JSCell* asCell(JSValue);
 
-    inline JSCell* asCell(JSValuePtr value)
+    inline JSCell* asCell(JSValue value)
     {
         return value.asCell();
     }
@@ -154,7 +154,7 @@
         return Heap::markCell(this);
     }
 
-    ALWAYS_INLINE JSCell* JSValuePtr::asCell() const
+    ALWAYS_INLINE JSCell* JSValue::asCell() const
     {
         ASSERT(isCell());
         return m_ptr;
@@ -171,77 +171,77 @@
 
     // --- JSValue inlines ----------------------------
 
-    inline bool JSValuePtr::isString() const
+    inline bool JSValue::isString() const
     {
         return !JSImmediate::isImmediate(asValue()) && asCell()->isString();
     }
 
-    inline bool JSValuePtr::isGetterSetter() const
+    inline bool JSValue::isGetterSetter() const
     {
         return !JSImmediate::isImmediate(asValue()) && asCell()->isGetterSetter();
     }
 
-    inline bool JSValuePtr::isObject() const
+    inline bool JSValue::isObject() const
     {
         return !JSImmediate::isImmediate(asValue()) && asCell()->isObject();
     }
 
-    inline bool JSValuePtr::getString(UString& s) const
+    inline bool JSValue::getString(UString& s) const
     {
         return !JSImmediate::isImmediate(asValue()) && asCell()->getString(s);
     }
 
-    inline UString JSValuePtr::getString() const
+    inline UString JSValue::getString() const
     {
         return JSImmediate::isImmediate(asValue()) ? UString() : asCell()->getString();
     }
 
-    inline JSObject* JSValuePtr::getObject() const
+    inline JSObject* JSValue::getObject() const
     {
         return JSImmediate::isImmediate(asValue()) ? 0 : asCell()->getObject();
     }
 
-    inline CallType JSValuePtr::getCallData(CallData& callData)
+    inline CallType JSValue::getCallData(CallData& callData)
     {
         return JSImmediate::isImmediate(asValue()) ? CallTypeNone : asCell()->getCallData(callData);
     }
 
-    inline ConstructType JSValuePtr::getConstructData(ConstructData& constructData)
+    inline ConstructType JSValue::getConstructData(ConstructData& constructData)
     {
         return JSImmediate::isImmediate(asValue()) ? ConstructTypeNone : asCell()->getConstructData(constructData);
     }
 
-    ALWAYS_INLINE bool JSValuePtr::getUInt32(uint32_t& v) const
+    ALWAYS_INLINE bool JSValue::getUInt32(uint32_t& v) const
     {
         return JSImmediate::isImmediate(asValue()) ? JSImmediate::getUInt32(asValue(), v) : asCell()->getUInt32(v);
     }
 
-    ALWAYS_INLINE bool JSValuePtr::getTruncatedInt32(int32_t& v) const
+    ALWAYS_INLINE bool JSValue::getTruncatedInt32(int32_t& v) const
     {
         return JSImmediate::isImmediate(asValue()) ? JSImmediate::getTruncatedInt32(asValue(), v) : asCell()->getTruncatedInt32(v);
     }
 
-    inline bool JSValuePtr::getTruncatedUInt32(uint32_t& v) const
+    inline bool JSValue::getTruncatedUInt32(uint32_t& v) const
     {
         return JSImmediate::isImmediate(asValue()) ? JSImmediate::getTruncatedUInt32(asValue(), v) : asCell()->getTruncatedUInt32(v);
     }
 
-    inline void JSValuePtr::mark()
+    inline void JSValue::mark()
     {
         asCell()->mark(); // callers should check !marked() before calling mark(), so this should only be called with cells
     }
 
-    inline bool JSValuePtr::marked() const
+    inline bool JSValue::marked() const
     {
         return JSImmediate::isImmediate(asValue()) || asCell()->marked();
     }
 
-    inline JSValuePtr JSValuePtr::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+    inline JSValue JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
     {
         return JSImmediate::isImmediate(asValue()) ? asValue() : asCell()->toPrimitive(exec, preferredType);
     }
 
-    inline bool JSValuePtr::getPrimitiveNumber(ExecState* exec, double& number, JSValuePtr& value)
+    inline bool JSValue::getPrimitiveNumber(ExecState* exec, double& number, JSValue& value)
     {
         if (JSImmediate::isImmediate(asValue())) {
             number = JSImmediate::toDouble(asValue());
@@ -251,48 +251,48 @@
         return asCell()->getPrimitiveNumber(exec, number, value);
     }
 
-    inline bool JSValuePtr::toBoolean(ExecState* exec) const
+    inline bool JSValue::toBoolean(ExecState* exec) const
     {
         return JSImmediate::isImmediate(asValue()) ? JSImmediate::toBoolean(asValue()) : asCell()->toBoolean(exec);
     }
 
-    ALWAYS_INLINE double JSValuePtr::toNumber(ExecState* exec) const
+    ALWAYS_INLINE double JSValue::toNumber(ExecState* exec) const
     {
         return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : asCell()->toNumber(exec);
     }
 
-    inline UString JSValuePtr::toString(ExecState* exec) const
+    inline UString JSValue::toString(ExecState* exec) const
     {
         return JSImmediate::isImmediate(asValue()) ? JSImmediate::toString(asValue()) : asCell()->toString(exec);
     }
 
-    inline JSObject* JSValuePtr::toObject(ExecState* exec) const
+    inline JSObject* JSValue::toObject(ExecState* exec) const
     {
         return JSImmediate::isImmediate(asValue()) ? JSImmediate::toObject(asValue(), exec) : asCell()->toObject(exec);
     }
 
-    inline JSObject* JSValuePtr::toThisObject(ExecState* exec) const
+    inline JSObject* JSValue::toThisObject(ExecState* exec) const
     {
         if (UNLIKELY(JSImmediate::isImmediate(asValue())))
             return JSImmediate::toThisObject(asValue(), exec);
         return asCell()->toThisObject(exec);
     }
 
-    inline bool JSValuePtr::needsThisConversion() const
+    inline bool JSValue::needsThisConversion() const
     {
         if (UNLIKELY(JSImmediate::isImmediate(asValue())))
             return true;
         return asCell()->structure()->typeInfo().needsThisConversion();
     }
 
-    inline UString JSValuePtr::toThisString(ExecState* exec) const
+    inline UString JSValue::toThisString(ExecState* exec) const
     {
         return JSImmediate::isImmediate(asValue()) ? JSImmediate::toString(asValue()) : asCell()->toThisString(exec);
     }
 
-    inline JSValuePtr JSValuePtr::getJSNumber()
+    inline JSValue JSValue::getJSNumber()
     {
-        return JSImmediate::isNumber(asValue()) ? asValue() : JSImmediate::isImmediate(asValue()) ? noValue() : asCell()->getJSNumber();
+        return JSImmediate::isNumber(asValue()) ? asValue() : JSImmediate::isImmediate(asValue()) ? JSValue() : asCell()->getJSNumber();
     }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSFunction.cpp b/JavaScriptCore/runtime/JSFunction.cpp
index cb18115..f456451 100644
--- a/JavaScriptCore/runtime/JSFunction.cpp
+++ b/JavaScriptCore/runtime/JSFunction.cpp
@@ -45,11 +45,29 @@
 
 const ClassInfo JSFunction::info = { "Function", &InternalFunction::info, 0, 0 };
 
+JSFunction::JSFunction(ExecState* exec, PassRefPtr<Structure> structure, int length, const Identifier& name, NativeFunction func)
+    : Base(&exec->globalData(), structure, name)
+#if ENABLE(JIT)
+    , m_body(exec->globalData().nativeFunctionThunk())
+#else
+    , m_body(0)
+#endif
+{
+#if ENABLE(JIT)
+    setNativeFunction(func);
+    putDirect(exec->propertyNames().length, jsNumber(exec, length), DontDelete | ReadOnly | DontEnum);
+#else
+    UNUSED_PARAM(length);
+    UNUSED_PARAM(func);
+    ASSERT_NOT_REACHED();
+#endif
+}
+
 JSFunction::JSFunction(ExecState* exec, const Identifier& name, FunctionBodyNode* body, ScopeChainNode* scopeChainNode)
     : Base(&exec->globalData(), exec->lexicalGlobalObject()->functionStructure(), name)
     , m_body(body)
-    , m_scopeChain(scopeChainNode)
 {
+    setScopeChain(scopeChainNode);
 }
 
 JSFunction::~JSFunction()
@@ -58,55 +76,72 @@
     // JIT code for other functions may have had calls linked directly to the code for this function; these links
     // are based on a check for the this pointer value for this JSFunction - which will no longer be valid once
     // this memory is freed and may be reused (potentially for another, different JSFunction).
-    if (m_body && m_body->isGenerated())
-        m_body->generatedBytecode().unlinkCallers();
+    if (!isHostFunction()) {
+        if (m_body && m_body->isGenerated())
+            m_body->generatedBytecode().unlinkCallers();
+        scopeChain().~ScopeChain();
+    }
+    
 #endif
 }
 
 void JSFunction::mark()
 {
     Base::mark();
-    m_body->mark();
-    m_scopeChain.mark();
+    if (!isHostFunction()) {
+        m_body->mark();
+        scopeChain().mark();
+    }
 }
 
 CallType JSFunction::getCallData(CallData& callData)
 {
+    if (isHostFunction()) {
+        callData.native.function = nativeFunction();
+        return CallTypeHost;
+    }
     callData.js.functionBody = m_body.get();
-    callData.js.scopeChain = m_scopeChain.node();
+    callData.js.scopeChain = scopeChain().node();
     return CallTypeJS;
 }
 
-JSValuePtr JSFunction::call(ExecState* exec, JSValuePtr thisValue, const ArgList& args)
+JSValue JSFunction::call(ExecState* exec, JSValue thisValue, const ArgList& args)
 {
-    return exec->interpreter()->execute(m_body.get(), exec, this, thisValue.toThisObject(exec), args, m_scopeChain.node(), exec->exceptionSlot());
+    ASSERT(!isHostFunction());
+    return exec->interpreter()->execute(m_body.get(), exec, this, thisValue.toThisObject(exec), args, scopeChain().node(), exec->exceptionSlot());
 }
 
-JSValuePtr JSFunction::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFunction* thisObj = asFunction(slot.slotBase());
+    ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveArguments(exec, thisObj);
 }
 
-JSValuePtr JSFunction::callerGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::callerGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFunction* thisObj = asFunction(slot.slotBase());
+    ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveCaller(exec, thisObj);
 }
 
-JSValuePtr JSFunction::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFunction* thisObj = asFunction(slot.slotBase());
+    ASSERT(!thisObj->isHostFunction());
     return jsNumber(exec, thisObj->m_body->parameterCount());
 }
 
 bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
+    if (isHostFunction())
+        return Base::getOwnPropertySlot(exec, propertyName, slot);
+
     if (propertyName == exec->propertyNames().prototype) {
-        JSValuePtr* location = getDirectLocation(propertyName);
+        JSValue* location = getDirectLocation(propertyName);
 
         if (!location) {
-            JSObject* prototype = new (exec) JSObject(m_scopeChain.globalObject()->emptyObjectStructure());
+            JSObject* prototype = new (exec) JSObject(scopeChain().globalObject()->emptyObjectStructure());
             prototype->putDirect(exec->propertyNames().constructor, this, DontEnum);
             putDirect(exec->propertyNames().prototype, prototype, DontDelete);
             location = getDirectLocation(propertyName);
@@ -133,8 +168,12 @@
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
+    if (isHostFunction()) {
+        Base::put(exec, propertyName, value, slot);
+        return;
+    }
     if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length)
         return;
     Base::put(exec, propertyName, value, slot);
@@ -142,6 +181,8 @@
 
 bool JSFunction::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
+    if (isHostFunction())
+        return Base::deleteProperty(exec, propertyName);
     if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length)
         return false;
     return Base::deleteProperty(exec, propertyName);
@@ -150,22 +191,25 @@
 // ECMA 13.2.2 [[Construct]]
 ConstructType JSFunction::getConstructData(ConstructData& constructData)
 {
+    if (isHostFunction())
+        return ConstructTypeNone;
     constructData.js.functionBody = m_body.get();
-    constructData.js.scopeChain = m_scopeChain.node();
+    constructData.js.scopeChain = scopeChain().node();
     return ConstructTypeJS;
 }
 
 JSObject* JSFunction::construct(ExecState* exec, const ArgList& args)
 {
+    ASSERT(!isHostFunction());
     Structure* structure;
-    JSValuePtr prototype = get(exec, exec->propertyNames().prototype);
+    JSValue prototype = get(exec, exec->propertyNames().prototype);
     if (prototype.isObject())
         structure = asObject(prototype)->inheritorID();
     else
         structure = exec->lexicalGlobalObject()->emptyObjectStructure();
     JSObject* thisObj = new (exec) JSObject(structure);
 
-    JSValuePtr result = exec->interpreter()->execute(m_body.get(), exec, this, thisObj, args, m_scopeChain.node(), exec->exceptionSlot());
+    JSValue result = exec->interpreter()->execute(m_body.get(), exec, this, thisObj, args, scopeChain().node(), exec->exceptionSlot());
     if (exec->hadException() || !result.isObject())
         return thisObj;
     return asObject(result);
diff --git a/JavaScriptCore/runtime/JSFunction.h b/JavaScriptCore/runtime/JSFunction.h
index 87ca2a2..b27e515 100644
--- a/JavaScriptCore/runtime/JSFunction.h
+++ b/JavaScriptCore/runtime/JSFunction.h
@@ -39,30 +39,30 @@
 
     class JSFunction : public InternalFunction {
         friend class JIT;
-        friend class JITStubs;
         friend class VPtrSet;
 
         typedef InternalFunction Base;
 
         JSFunction(PassRefPtr<Structure> structure)
             : InternalFunction(structure)
-            , m_scopeChain(NoScopeChain())
         {
+            clearScopeChain();
         }
 
     public:
+        JSFunction(ExecState*, PassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
         JSFunction(ExecState*, const Identifier&, FunctionBodyNode*, ScopeChainNode*);
         ~JSFunction();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
 
         JSObject* construct(ExecState*, const ArgList&);
-        JSValuePtr call(ExecState*, JSValuePtr thisValue, const ArgList&);
+        JSValue call(ExecState*, JSValue thisValue, const ArgList&);
 
-        void setScope(const ScopeChain& scopeChain) { m_scopeChain = scopeChain; }
-        ScopeChain& scope() { return m_scopeChain; }
+        void setScope(const ScopeChain& scopeChain) { setScopeChain(scopeChain); }
+        ScopeChain& scope() { return scopeChain(); }
 
         void setBody(FunctionBodyNode* body) { m_body = body; }
         void setBody(PassRefPtr<FunctionBodyNode> body) { m_body = body; }
@@ -70,30 +70,64 @@
 
         virtual void mark();
 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype) 
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
             return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance)); 
         }
 
-    private:
-        virtual const ClassInfo* classInfo() const { return &info; }
+#if ENABLE(JIT)
+        bool isHostFunction() const { return m_body && m_body->isHostFunction(); }
+#else
+        bool isHostFunction() const { return false; }
+#endif
+        NativeFunction nativeFunction()
+        {
+            return *reinterpret_cast<NativeFunction*>(m_data);
+        }
 
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
 
-        static JSValuePtr argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValuePtr callerGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    private:
+        virtual const ClassInfo* classInfo() const { return &info; }
+
+        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue callerGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
 
         RefPtr<FunctionBodyNode> m_body;
-        ScopeChain m_scopeChain;
+        ScopeChain& scopeChain()
+        {
+            ASSERT(!isHostFunction());
+            return *reinterpret_cast<ScopeChain*>(m_data);
+        }
+        void clearScopeChain()
+        {
+            ASSERT(!isHostFunction());
+            new (m_data) ScopeChain(NoScopeChain());
+        }
+        void setScopeChain(ScopeChainNode* sc)
+        {
+            ASSERT(!isHostFunction());
+            new (m_data) ScopeChain(sc);
+        }
+        void setScopeChain(const ScopeChain& sc)
+        {
+            ASSERT(!isHostFunction());
+            *reinterpret_cast<ScopeChain*>(m_data) = sc;
+        }
+        void setNativeFunction(NativeFunction func)
+        {
+            *reinterpret_cast<NativeFunction*>(m_data) = func;
+        }
+        unsigned char m_data[sizeof(void*)];
     };
 
-    JSFunction* asFunction(JSValuePtr);
+    JSFunction* asFunction(JSValue);
 
-    inline JSFunction* asFunction(JSValuePtr value)
+    inline JSFunction* asFunction(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&JSFunction::info));
         return static_cast<JSFunction*>(asObject(value));
diff --git a/JavaScriptCore/runtime/JSGlobalData.cpp b/JavaScriptCore/runtime/JSGlobalData.cpp
index 3a2f7c0..1594848 100644
--- a/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -38,6 +38,7 @@
 #include "JSArray.h"
 #include "JSByteArray.h"
 #include "JSClassRef.h"
+#include "JSFunction.h"
 #include "JSLock.h"
 #include "JSNotAnObject.h"
 #include "JSStaticScopeObject.h"
@@ -102,13 +103,13 @@
 JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
     : isSharedInstance(isShared)
     , clientData(0)
-    , arrayTable(new HashTable(JSC::arrayTable))
-    , dateTable(new HashTable(JSC::dateTable))
-    , mathTable(new HashTable(JSC::mathTable))
-    , numberTable(new HashTable(JSC::numberTable))
-    , regExpTable(new HashTable(JSC::regExpTable))
-    , regExpConstructorTable(new HashTable(JSC::regExpConstructorTable))
-    , stringTable(new HashTable(JSC::stringTable))
+    , arrayTable(fastNew<HashTable>(JSC::arrayTable))
+    , dateTable(fastNew<HashTable>(JSC::dateTable))
+    , mathTable(fastNew<HashTable>(JSC::mathTable))
+    , numberTable(fastNew<HashTable>(JSC::numberTable))
+    , regExpTable(fastNew<HashTable>(JSC::regExpTable))
+    , regExpConstructorTable(fastNew<HashTable>(JSC::regExpConstructorTable))
+    , stringTable(fastNew<HashTable>(JSC::stringTable))
     , activationStructure(JSActivation::createStructure(jsNull()))
     , interruptedExecutionErrorStructure(JSObject::createStructure(jsNull()))
     , staticScopeStructure(JSStaticScopeObject::createStructure(jsNull()))
@@ -124,7 +125,7 @@
     , jsFunctionVPtr(vptrSet.jsFunctionVPtr)
     , identifierTable(createIdentifierTable())
     , propertyNames(new CommonIdentifiers(this))
-    , emptyList(new ArgList)
+    , emptyList(new MarkedArgumentBuffer)
     , lexer(new Lexer(this))
     , parser(new Parser)
     , interpreter(new Interpreter)
@@ -132,10 +133,7 @@
     , jitStubs(this)
 #endif
     , heap(this)
-    , exception(noValue())
     , initializingLazyNumericCompareFunction(false)
-    , newParserObjects(0)
-    , parserObjectExtraRefCounts(0)
     , head(0)
     , dynamicGlobalObject(0)
     , scopeNodeBeingReparsed(0)
@@ -162,13 +160,17 @@
     regExpTable->deleteTable();
     regExpConstructorTable->deleteTable();
     stringTable->deleteTable();
-    delete arrayTable;
-    delete dateTable;
-    delete mathTable;
-    delete numberTable;
-    delete regExpTable;
-    delete regExpConstructorTable;
-    delete stringTable;
+#if ENABLE(JIT)
+    lazyNativeFunctionThunk.clear();
+#endif
+
+    fastDelete(const_cast<HashTable*>(arrayTable));
+    fastDelete(const_cast<HashTable*>(dateTable));
+    fastDelete(const_cast<HashTable*>(mathTable));
+    fastDelete(const_cast<HashTable*>(numberTable));
+    fastDelete(const_cast<HashTable*>(regExpTable));
+    fastDelete(const_cast<HashTable*>(regExpConstructorTable));
+    fastDelete(const_cast<HashTable*>(stringTable));
 
     delete parser;
     delete lexer;
@@ -180,9 +182,6 @@
     delete propertyNames;
     deleteIdentifierTable(identifierTable);
 
-    delete newParserObjects;
-    delete parserObjectExtraRefCounts;
-    
     delete clientData;
 }
 
@@ -193,14 +192,10 @@
 
 PassRefPtr<JSGlobalData> JSGlobalData::createLeaked()
 {
-#ifndef NDEBUG
     Structure::startIgnoringLeaks();
     RefPtr<JSGlobalData> data = create();
     Structure::stopIgnoringLeaks();
     return data.release();
-#else
-    return create();
-#endif
 }
 
 bool JSGlobalData::sharedInstanceExists()
@@ -227,6 +222,15 @@
     return sharedInstance;
 }
 
+#if ENABLE(JIT)
+
+void JSGlobalData::createNativeThunk()
+{
+    lazyNativeFunctionThunk = FunctionBodyNode::createNativeThunk(this);
+}
+
+#endif
+
 // FIXME: We can also detect forms like v1 < v2 ? -1 : 0, reverse comparison, etc.
 const Vector<Instruction>& JSGlobalData::numericCompareFunction(ExecState* exec)
 {
diff --git a/JavaScriptCore/runtime/JSGlobalData.h b/JavaScriptCore/runtime/JSGlobalData.h
index 1936f1f..e53746b 100644
--- a/JavaScriptCore/runtime/JSGlobalData.h
+++ b/JavaScriptCore/runtime/JSGlobalData.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,9 +44,8 @@
 
 namespace JSC {
 
-    class ArgList;
     class CommonIdentifiers;
-    class Heap;
+    class FunctionBodyNode;
     class IdentifierTable;
     class Instruction;
     class Interpreter;
@@ -54,7 +53,6 @@
     class JSObject;
     class Lexer;
     class Parser;
-    class ParserRefCounted;
     class ScopeNode;
     class Structure;
     class UString;
@@ -107,7 +105,7 @@
 
         IdentifierTable* identifierTable;
         CommonIdentifiers* propertyNames;
-        const ArgList* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
+        const MarkedArgumentBuffer* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
         SmallStrings smallStrings;
 
 #if ENABLE(ASSEMBLER)
@@ -118,12 +116,19 @@
         Parser* parser;
         Interpreter* interpreter;
 #if ENABLE(JIT)
-        JITStubs jitStubs;
+        JITThunks jitStubs;
+        FunctionBodyNode* nativeFunctionThunk()
+        {
+            if (!lazyNativeFunctionThunk)
+                createNativeThunk();
+            return lazyNativeFunctionThunk.get();
+        }
+        RefPtr<FunctionBodyNode> lazyNativeFunctionThunk;
 #endif
         TimeoutChecker timeoutChecker;
         Heap heap;
 
-        JSValuePtr exception;
+        JSValue exception;
 #if ENABLE(JIT)
         void* exceptionLocation;
 #endif
@@ -134,9 +139,6 @@
 
         HashMap<OpaqueJSClass*, OpaqueJSClassContextData*> opaqueJSClassData;
 
-        HashSet<ParserRefCounted*>* newParserObjects;
-        HashCountedSet<ParserRefCounted*>* parserObjectExtraRefCounts;
-
         JSGlobalObject* head;
         JSGlobalObject* dynamicGlobalObject;
 
@@ -147,7 +149,9 @@
     private:
         JSGlobalData(bool isShared, const VPtrSet&);
         static JSGlobalData*& sharedInstanceInternal();
+        void createNativeThunk();
     };
+
 } // namespace JSC
 
 #endif // JSGlobalData_h
diff --git a/JavaScriptCore/runtime/JSGlobalObject.cpp b/JavaScriptCore/runtime/JSGlobalObject.cpp
index d6ad295..1e9f670 100644
--- a/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -47,6 +47,7 @@
 #include "FunctionConstructor.h"
 #include "FunctionPrototype.h"
 #include "GlobalEvalFunction.h"
+#include "JSFunction.h"
 #include "JSGlobalObjectFunctions.h"
 #include "JSLock.h"
 #include "Interpreter.h"
@@ -78,7 +79,7 @@
 // Preferred number of milliseconds between each timeout check
 static const int preferredScriptCheckTimeInterval = 1000;
 
-static inline void markIfNeeded(JSValuePtr v)
+static inline void markIfNeeded(JSValue v)
 {
     if (v && !v.marked())
         v.mark();
@@ -147,7 +148,7 @@
     reset(prototype());
 }
 
-void JSGlobalObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSGlobalObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -156,20 +157,20 @@
     JSVariableObject::put(exec, propertyName, value, slot);
 }
 
-void JSGlobalObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSGlobalObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
     if (symbolTablePutWithAttributes(propertyName, value, attributes))
         return;
 
-    JSValuePtr valueBefore = getDirect(propertyName);
+    JSValue valueBefore = getDirect(propertyName);
     PutPropertySlot slot;
     JSVariableObject::put(exec, propertyName, value, slot);
     if (!valueBefore) {
-        JSValuePtr valueAfter = getDirect(propertyName);
+        JSValue valueAfter = getDirect(propertyName);
         if (valueAfter)
-            putDirect(propertyName, valueAfter, attributes);
+            JSObject::putWithAttributes(exec, propertyName, valueAfter, attributes);
     }
 }
 
@@ -195,7 +196,7 @@
     return o;
 }
 
-void JSGlobalObject::reset(JSValuePtr prototype)
+void JSGlobalObject::reset(JSValue prototype)
 {
     ExecState* exec = JSGlobalObject::globalExec();
 
@@ -203,7 +204,11 @@
 
     d()->functionPrototype = new (exec) FunctionPrototype(exec, FunctionPrototype::createStructure(jsNull())); // The real prototype will be set once ObjectPrototype is created.
     d()->prototypeFunctionStructure = PrototypeFunction::createStructure(d()->functionPrototype);
-    d()->functionPrototype->addFunctionProperties(exec, d()->prototypeFunctionStructure.get());
+    NativeFunctionWrapper* callFunction = 0;
+    NativeFunctionWrapper* applyFunction = 0;
+    d()->functionPrototype->addFunctionProperties(exec, d()->prototypeFunctionStructure.get(), &callFunction, &applyFunction);
+    d()->callFunction = callFunction;
+    d()->applyFunction = applyFunction;
     d()->objectPrototype = new (exec) ObjectPrototype(exec, ObjectPrototype::createStructure(jsNull()), d()->prototypeFunctionStructure.get());
     d()->functionPrototype->structure()->setPrototypeWithoutTransition(d()->objectPrototype);
 
@@ -234,6 +239,8 @@
     d()->regExpPrototype = new (exec) RegExpPrototype(exec, RegExpPrototype::createStructure(d()->objectPrototype), d()->prototypeFunctionStructure.get());
     d()->regExpStructure = RegExpObject::createStructure(d()->regExpPrototype);
 
+    d()->methodCallDummy = constructEmptyObject(exec);
+
     ErrorPrototype* errorPrototype = new (exec) ErrorPrototype(exec, ErrorPrototype::createStructure(d()->objectPrototype), d()->prototypeFunctionStructure.get());
     d()->errorStructure = ErrorInstance::createStructure(errorPrototype);
 
@@ -248,13 +255,13 @@
 
     // Constructors
 
-    JSValuePtr objectConstructor = new (exec) ObjectConstructor(exec, ObjectConstructor::createStructure(d()->functionPrototype), d()->objectPrototype);
-    JSValuePtr functionConstructor = new (exec) FunctionConstructor(exec, FunctionConstructor::createStructure(d()->functionPrototype), d()->functionPrototype);
-    JSValuePtr arrayConstructor = new (exec) ArrayConstructor(exec, ArrayConstructor::createStructure(d()->functionPrototype), d()->arrayPrototype);
-    JSValuePtr stringConstructor = new (exec) StringConstructor(exec, StringConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->stringPrototype);
-    JSValuePtr booleanConstructor = new (exec) BooleanConstructor(exec, BooleanConstructor::createStructure(d()->functionPrototype), d()->booleanPrototype);
-    JSValuePtr numberConstructor = new (exec) NumberConstructor(exec, NumberConstructor::createStructure(d()->functionPrototype), d()->numberPrototype);
-    JSValuePtr dateConstructor = new (exec) DateConstructor(exec, DateConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->datePrototype);
+    JSCell* objectConstructor = new (exec) ObjectConstructor(exec, ObjectConstructor::createStructure(d()->functionPrototype), d()->objectPrototype);
+    JSCell* functionConstructor = new (exec) FunctionConstructor(exec, FunctionConstructor::createStructure(d()->functionPrototype), d()->functionPrototype);
+    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, ArrayConstructor::createStructure(d()->functionPrototype), d()->arrayPrototype);
+    JSCell* stringConstructor = new (exec) StringConstructor(exec, StringConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->stringPrototype);
+    JSCell* booleanConstructor = new (exec) BooleanConstructor(exec, BooleanConstructor::createStructure(d()->functionPrototype), d()->booleanPrototype);
+    JSCell* numberConstructor = new (exec) NumberConstructor(exec, NumberConstructor::createStructure(d()->functionPrototype), d()->numberPrototype);
+    JSCell* dateConstructor = new (exec) DateConstructor(exec, DateConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->datePrototype);
 
     d()->regExpConstructor = new (exec) RegExpConstructor(exec, RegExpConstructor::createStructure(d()->functionPrototype), d()->regExpPrototype);
 
@@ -269,15 +276,15 @@
     d()->typeErrorConstructor = new (exec) NativeErrorConstructor(exec, nativeErrorStructure, typeErrorPrototype);
     d()->URIErrorConstructor = new (exec) NativeErrorConstructor(exec, nativeErrorStructure, URIErrorPrototype);
 
-    d()->objectPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, objectConstructor, DontEnum);
-    d()->functionPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, functionConstructor, DontEnum);
-    d()->arrayPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, arrayConstructor, DontEnum);
-    d()->booleanPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, booleanConstructor, DontEnum);
-    d()->stringPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, stringConstructor, DontEnum);
-    d()->numberPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, numberConstructor, DontEnum);
-    d()->datePrototype->putDirectWithoutTransition(exec->propertyNames().constructor, dateConstructor, DontEnum);
-    d()->regExpPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, d()->regExpConstructor, DontEnum);
-    errorPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, d()->errorConstructor, DontEnum);
+    d()->objectPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, objectConstructor, DontEnum);
+    d()->functionPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, functionConstructor, DontEnum);
+    d()->arrayPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, arrayConstructor, DontEnum);
+    d()->booleanPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, booleanConstructor, DontEnum);
+    d()->stringPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, stringConstructor, DontEnum);
+    d()->numberPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, numberConstructor, DontEnum);
+    d()->datePrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, dateConstructor, DontEnum);
+    d()->regExpPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, d()->regExpConstructor, DontEnum);
+    errorPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, d()->errorConstructor, DontEnum);
 
     evalErrorPrototype->putDirect(exec->propertyNames().constructor, d()->evalErrorConstructor, DontEnum);
     rangeErrorPrototype->putDirect(exec->propertyNames().constructor, d()->rangeErrorConstructor, DontEnum);
@@ -290,21 +297,21 @@
 
     // FIXME: These properties could be handled by a static hash table.
 
-    putDirectWithoutTransition(Identifier(exec, "Object"), objectConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Function"), functionConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Array"), arrayConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Boolean"), booleanConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "String"), stringConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Number"), numberConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Date"), dateConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "RegExp"), d()->regExpConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Error"), d()->errorConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "EvalError"), d()->evalErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "RangeError"), d()->rangeErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "TypeError"), d()->typeErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "URIError"), d()->URIErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Object"), objectConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Function"), functionConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Array"), arrayConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Boolean"), booleanConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "String"), stringConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Number"), numberConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Date"), dateConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "RegExp"), d()->regExpConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Error"), d()->errorConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "EvalError"), d()->evalErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "RangeError"), d()->rangeErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "TypeError"), d()->typeErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "URIError"), d()->URIErrorConstructor);
 
     // Set global values.
     GlobalPropertyInfo staticGlobals[] = {
@@ -320,25 +327,25 @@
 
     d()->evalFunction = new (exec) GlobalEvalFunction(exec, GlobalEvalFunction::createStructure(d()->functionPrototype), 1, exec->propertyNames().eval, globalFuncEval, this);
     putDirectFunctionWithoutTransition(exec, d()->evalFunction, DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 2, Identifier(exec, "parseInt"), globalFuncParseInt), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "parseFloat"), globalFuncParseFloat), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isNaN"), globalFuncIsNaN), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isFinite"), globalFuncIsFinite), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "escape"), globalFuncEscape), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "unescape"), globalFuncUnescape), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURI"), globalFuncDecodeURI), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURIComponent"), globalFuncDecodeURIComponent), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURI"), globalFuncEncodeURI), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURIComponent"), globalFuncEncodeURIComponent), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 2, Identifier(exec, "parseInt"), globalFuncParseInt), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "parseFloat"), globalFuncParseFloat), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isNaN"), globalFuncIsNaN), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isFinite"), globalFuncIsFinite), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "escape"), globalFuncEscape), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "unescape"), globalFuncUnescape), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURI"), globalFuncDecodeURI), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURIComponent"), globalFuncDecodeURIComponent), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURI"), globalFuncEncodeURI), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURIComponent"), globalFuncEncodeURIComponent), DontEnum);
 #ifndef NDEBUG
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
 #endif
 
     resetPrototype(prototype);
 }
 
 // Set prototype, and also insert the object prototype at the end of the chain.
-void JSGlobalObject::resetPrototype(JSValuePtr prototype)
+void JSGlobalObject::resetPrototype(JSValue prototype)
 {
     setPrototype(prototype);
 
@@ -370,6 +377,8 @@
     markIfNeeded(d()->URIErrorConstructor);
 
     markIfNeeded(d()->evalFunction);
+    markIfNeeded(d()->callFunction);
+    markIfNeeded(d()->applyFunction);
 
     markIfNeeded(d()->objectPrototype);
     markIfNeeded(d()->functionPrototype);
@@ -380,6 +389,8 @@
     markIfNeeded(d()->datePrototype);
     markIfNeeded(d()->regExpPrototype);
 
+    markIfNeeded(d()->methodCallDummy);
+
     markIfNeeded(d()->errorStructure);
 
     // No need to mark the other structures, because their prototypes are all
diff --git a/JavaScriptCore/runtime/JSGlobalObject.h b/JavaScriptCore/runtime/JSGlobalObject.h
index da8b7bf..da9a819 100644
--- a/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/JavaScriptCore/runtime/JSGlobalObject.h
@@ -24,6 +24,7 @@
 
 #include "JSGlobalData.h"
 #include "JSVariableObject.h"
+#include "NativeFunctionWrapper.h"
 #include "NumberPrototype.h"
 #include "StringPrototype.h"
 #include <wtf/HashSet.h>
@@ -40,6 +41,7 @@
     class GlobalEvalFunction;
     class NativeErrorConstructor;
     class ProgramCodeBlock;
+    class PrototypeFunction;
     class RegExpConstructor;
     class RegExpPrototype;
     class RegisterFile;
@@ -67,6 +69,8 @@
                 , typeErrorConstructor(0)
                 , URIErrorConstructor(0)
                 , evalFunction(0)
+                , callFunction(0)
+                , applyFunction(0)
                 , objectPrototype(0)
                 , functionPrototype(0)
                 , arrayPrototype(0)
@@ -75,6 +79,7 @@
                 , numberPrototype(0)
                 , datePrototype(0)
                 , regExpPrototype(0)
+                , methodCallDummy(0)
             {
             }
             
@@ -104,6 +109,8 @@
             NativeErrorConstructor* URIErrorConstructor;
 
             GlobalEvalFunction* evalFunction;
+            NativeFunctionWrapper* callFunction;
+            NativeFunctionWrapper* applyFunction;
 
             ObjectPrototype* objectPrototype;
             FunctionPrototype* functionPrototype;
@@ -114,6 +121,8 @@
             DatePrototype* datePrototype;
             RegExpPrototype* regExpPrototype;
 
+            JSObject* methodCallDummy;
+
             RefPtr<Structure> argumentsStructure;
             RefPtr<Structure> arrayStructure;
             RefPtr<Structure> booleanObjectStructure;
@@ -161,8 +170,8 @@
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&, bool& slotIsWriteable);
-        virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
-        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes);
+        virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes);
 
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunc);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunc);
@@ -195,6 +204,8 @@
         DatePrototype* datePrototype() const { return d()->datePrototype; }
         RegExpPrototype* regExpPrototype() const { return d()->regExpPrototype; }
 
+        JSObject* methodCallDummy() const { return d()->methodCallDummy; }
+
         Structure* argumentsStructure() const { return d()->argumentsStructure.get(); }
         Structure* arrayStructure() const { return d()->arrayStructure.get(); }
         Structure* booleanObjectStructure() const { return d()->booleanObjectStructure.get(); }
@@ -240,19 +251,19 @@
         void copyGlobalsFrom(RegisterFile&);
         void copyGlobalsTo(RegisterFile&);
         
-        void resetPrototype(JSValuePtr prototype);
+        void resetPrototype(JSValue prototype);
 
         JSGlobalData* globalData() { return d()->globalData.get(); }
         JSGlobalObjectData* d() const { return static_cast<JSGlobalObjectData*>(JSVariableObject::d); }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
 
     protected:
         struct GlobalPropertyInfo {
-            GlobalPropertyInfo(const Identifier& i, JSValuePtr v, unsigned a)
+            GlobalPropertyInfo(const Identifier& i, JSValue v, unsigned a)
                 : identifier(i)
                 , value(v)
                 , attributes(a)
@@ -260,7 +271,7 @@
             }
 
             const Identifier identifier;
-            JSValuePtr value;
+            JSValue value;
             unsigned attributes;
         };
         void addStaticGlobals(GlobalPropertyInfo*, int count);
@@ -268,16 +279,16 @@
     private:
         // FIXME: Fold reset into init.
         void init(JSObject* thisValue);
-        void reset(JSValuePtr prototype);
+        void reset(JSValue prototype);
 
         void setRegisters(Register* registers, Register* registerArray, size_t count);
 
         void* operator new(size_t); // can only be allocated with JSGlobalData
     };
 
-    JSGlobalObject* asGlobalObject(JSValuePtr);
+    JSGlobalObject* asGlobalObject(JSValue);
 
-    inline JSGlobalObject* asGlobalObject(JSValuePtr value)
+    inline JSGlobalObject* asGlobalObject(JSValue value)
     {
         ASSERT(asObject(value)->isGlobalObject());
         return static_cast<JSGlobalObject*>(asObject(value));
@@ -329,7 +340,7 @@
         return asGlobalObject(n->object);
     }
 
-    inline JSValuePtr Structure::prototypeForLookup(ExecState* exec)
+    inline JSValue Structure::prototypeForLookup(ExecState* exec) const
     {
         if (typeInfo().type() == ObjectType)
             return m_prototype;
@@ -341,6 +352,32 @@
         return exec->lexicalGlobalObject()->numberPrototype();
     }
 
+    inline StructureChain* Structure::prototypeChain(ExecState* exec) const
+    {
+        // We cache our prototype chain so our clients can share it.
+        if (!isValid(exec, m_cachedPrototypeChain.get())) {
+            JSValue prototype = prototypeForLookup(exec);
+            m_cachedPrototypeChain = StructureChain::create(prototype.isNull() ? 0 : asObject(prototype)->structure());
+        }
+        return m_cachedPrototypeChain.get();
+    }
+
+    inline bool Structure::isValid(ExecState* exec, StructureChain* cachedPrototypeChain) const
+    {
+        if (!cachedPrototypeChain)
+            return false;
+
+        JSValue prototype = prototypeForLookup(exec);
+        RefPtr<Structure>* cachedStructure = cachedPrototypeChain->head();
+        while(*cachedStructure && !prototype.isNull()) {
+            if (asObject(prototype)->structure() != *cachedStructure)
+                return false;
+            ++cachedStructure;
+            prototype = asObject(prototype)->prototype();
+        }
+        return prototype.isNull() && !*cachedStructure;
+    }
+
     inline JSGlobalObject* ExecState::dynamicGlobalObject()
     {
         if (this == lexicalGlobalObject()->globalExec())
diff --git a/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index 91ea130..b013957 100644
--- a/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -28,6 +28,7 @@
 #include "CallFrame.h"
 #include "GlobalEvalFunction.h"
 #include "JSGlobalObject.h"
+#include "LiteralParser.h"
 #include "JSString.h"
 #include "Interpreter.h"
 #include "Parser.h"
@@ -47,9 +48,9 @@
 
 namespace JSC {
 
-static JSValuePtr encode(ExecState* exec, const ArgList& args, const char* doNotEscape)
+static JSValue encode(ExecState* exec, const ArgList& args, const char* doNotEscape)
 {
-    UString str = args.at(exec, 0).toString(exec);
+    UString str = args.at(0).toString(exec);
     CString cstr = str.UTF8String(true);
     if (!cstr.c_str())
         return throwError(exec, URIError, "String contained an illegal UTF-16 sequence.");
@@ -69,10 +70,10 @@
     return jsString(exec, result);
 }
 
-static JSValuePtr decode(ExecState* exec, const ArgList& args, const char* doNotUnescape, bool strict)
+static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUnescape, bool strict)
 {
     UString result = "";
-    UString str = args.at(exec, 0).toString(exec);
+    UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
     const UChar* d = str.data();
@@ -268,19 +269,23 @@
     return s.toDouble(true /*tolerant*/, false /* NaN for empty string */);
 }
 
-JSValuePtr globalFuncEval(ExecState* exec, JSObject* function, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEval(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     JSObject* thisObject = thisValue.toThisObject(exec);
     JSObject* unwrappedObject = thisObject->unwrappedObject();
     if (!unwrappedObject->isGlobalObject() || static_cast<JSGlobalObject*>(unwrappedObject)->evalFunction() != function)
         return throwError(exec, EvalError, "The \"this\" value passed to eval must be the global object from which eval originated");
 
-    JSValuePtr x = args.at(exec, 0);
+    JSValue x = args.at(0);
     if (!x.isString())
         return x;
 
     UString s = x.toString(exec);
 
+    LiteralParser preparser(exec, s);
+    if (JSValue parsedObject = preparser.tryLiteralParse())
+        return parsedObject;
+
     int errLine;
     UString errMsg;
 
@@ -293,42 +298,42 @@
     return exec->interpreter()->execute(evalNode.get(), exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node(), exec->exceptionSlot());
 }
 
-JSValuePtr globalFuncParseInt(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    JSValuePtr value = args.at(exec, 0);
-    int32_t radix = args.at(exec, 1).toInt32(exec);
+    JSValue value = args.at(0);
+    int32_t radix = args.at(1).toInt32(exec);
 
     if (value.isNumber() && (radix == 0 || radix == 10)) {
         if (value.isInt32Fast())
             return value;
         double d = value.uncheckedGetNumber();
         if (isfinite(d))
-            return jsNumber(exec, floor(d));
+            return jsNumber(exec, (d > 0) ? floor(d) : ceil(d));
         if (isnan(d) || isinf(d))
             return jsNaN(&exec->globalData());
-        return js0();
+        return jsNumber(exec, 0);
     }
 
     return jsNumber(exec, parseInt(value.toString(exec), radix));
 }
 
-JSValuePtr globalFuncParseFloat(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncParseFloat(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, parseFloat(args.at(exec, 0).toString(exec)));
+    return jsNumber(exec, parseFloat(args.at(0).toString(exec)));
 }
 
-JSValuePtr globalFuncIsNaN(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncIsNaN(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsBoolean(isnan(args.at(exec, 0).toNumber(exec)));
+    return jsBoolean(isnan(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr globalFuncIsFinite(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncIsFinite(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    double n = args.at(exec, 0).toNumber(exec);
+    double n = args.at(0).toNumber(exec);
     return jsBoolean(!isnan(n) && !isinf(n));
 }
 
-JSValuePtr globalFuncDecodeURI(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncDecodeURI(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_unescape_when_decoding_URI[] =
         "#$&+,/:;=?@";
@@ -336,12 +341,12 @@
     return decode(exec, args, do_not_unescape_when_decoding_URI, true);
 }
 
-JSValuePtr globalFuncDecodeURIComponent(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncDecodeURIComponent(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return decode(exec, args, "", true);
 }
 
-JSValuePtr globalFuncEncodeURI(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEncodeURI(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_escape_when_encoding_URI[] =
         "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -352,7 +357,7 @@
     return encode(exec, args, do_not_escape_when_encoding_URI);
 }
 
-JSValuePtr globalFuncEncodeURIComponent(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEncodeURIComponent(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_escape_when_encoding_URI_component[] =
         "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -363,7 +368,7 @@
     return encode(exec, args, do_not_escape_when_encoding_URI_component);
 }
 
-JSValuePtr globalFuncEscape(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_escape[] =
         "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -373,7 +378,7 @@
 
     UString result = "";
     UString s;
-    UString str = args.at(exec, 0).toString(exec);
+    UString str = args.at(0).toString(exec);
     const UChar* c = str.data();
     for (int k = 0; k < str.size(); k++, c++) {
         int u = c[0];
@@ -394,22 +399,22 @@
     return jsString(exec, result);
 }
 
-JSValuePtr globalFuncUnescape(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     UString result = "";
-    UString str = args.at(exec, 0).toString(exec);
+    UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
     while (k < len) {
         const UChar* c = str.data() + k;
         UChar u;
         if (c[0] == '%' && k <= len - 6 && c[1] == 'u') {
-            if (Lexer::isHexDigit(c[2]) && Lexer::isHexDigit(c[3]) && Lexer::isHexDigit(c[4]) && Lexer::isHexDigit(c[5])) {
+            if (isASCIIHexDigit(c[2]) && isASCIIHexDigit(c[3]) && isASCIIHexDigit(c[4]) && isASCIIHexDigit(c[5])) {
                 u = Lexer::convertUnicode(c[2], c[3], c[4], c[5]);
                 c = &u;
                 k += 5;
             }
-        } else if (c[0] == '%' && k <= len - 3 && Lexer::isHexDigit(c[1]) && Lexer::isHexDigit(c[2])) {
+        } else if (c[0] == '%' && k <= len - 3 && isASCIIHexDigit(c[1]) && isASCIIHexDigit(c[2])) {
             u = UChar(Lexer::convertHex(c[1], c[2]));
             c = &u;
             k += 2;
@@ -422,10 +427,10 @@
 }
 
 #ifndef NDEBUG
-JSValuePtr globalFuncJSCPrint(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncJSCPrint(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     CStringBuffer string;
-    args.at(exec, 0).toString(exec).getCString(string);
+    args.at(0).toString(exec).getCString(string);
     puts(string.data());
     return jsUndefined();
 }
diff --git a/JavaScriptCore/runtime/JSGlobalObjectFunctions.h b/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
index 0929b17..b1046f2 100644
--- a/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
+++ b/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
@@ -31,24 +31,24 @@
     class ArgList;
     class ExecState;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
 
     // FIXME: These functions should really be in JSGlobalObject.cpp, but putting them there
     // is a 0.5% reduction.
 
-    JSValuePtr globalFuncEval(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncParseInt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncParseFloat(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncIsNaN(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncIsFinite(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncDecodeURI(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncDecodeURIComponent(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncEncodeURI(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncEncodeURIComponent(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncEscape(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncUnescape(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEval(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncParseInt(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncParseFloat(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncIsNaN(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncIsFinite(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncDecodeURI(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncDecodeURIComponent(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEncodeURI(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEncodeURIComponent(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEscape(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncUnescape(ExecState*, JSObject*, JSValue, const ArgList&);
 #ifndef NDEBUG
-    JSValuePtr globalFuncJSCPrint(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncJSCPrint(ExecState*, JSObject*, JSValue, const ArgList&);
 #endif
 
     static const double mantissaOverflowLowerBound = 9007199254740992.0;
diff --git a/JavaScriptCore/runtime/JSImmediate.cpp b/JavaScriptCore/runtime/JSImmediate.cpp
index a407ec3..201e56c 100644
--- a/JavaScriptCore/runtime/JSImmediate.cpp
+++ b/JavaScriptCore/runtime/JSImmediate.cpp
@@ -32,7 +32,7 @@
 
 namespace JSC {
 
-JSObject* JSImmediate::toThisObject(JSValuePtr v, ExecState* exec)
+JSObject* JSImmediate::toThisObject(JSValue v, ExecState* exec)
 {
     ASSERT(isImmediate(v));
     if (isNumber(v))
@@ -43,7 +43,7 @@
     return exec->globalThisValue();
 }
 
-JSObject* JSImmediate::toObject(JSValuePtr v, ExecState* exec)
+JSObject* JSImmediate::toObject(JSValue v, ExecState* exec)
 {
     ASSERT(isImmediate(v));
     if (isNumber(v))
@@ -56,7 +56,7 @@
     return new (exec) JSNotAnObject(exec, exception);
 }
 
-JSObject* JSImmediate::prototype(JSValuePtr v, ExecState* exec)
+JSObject* JSImmediate::prototype(JSValue v, ExecState* exec)
 {
     ASSERT(isImmediate(v));
     if (isNumber(v))
@@ -69,7 +69,7 @@
     return new (exec) JSNotAnObject(exec, exception);
 }
 
-UString JSImmediate::toString(JSValuePtr v)
+UString JSImmediate::toString(JSValue v)
 {
     ASSERT(isImmediate(v));
     if (isIntegerNumber(v))
diff --git a/JavaScriptCore/runtime/JSImmediate.h b/JavaScriptCore/runtime/JSImmediate.h
index 3a44825..706396e 100644
--- a/JavaScriptCore/runtime/JSImmediate.h
+++ b/JavaScriptCore/runtime/JSImmediate.h
@@ -42,32 +42,6 @@
     class JSObject;
     class UString;
 
-    JSValuePtr js0();
-    JSValuePtr jsNull();
-    JSValuePtr jsBoolean(bool b);
-    JSValuePtr jsUndefined();
-    JSValuePtr jsImpossibleValue();
-    JSValuePtr jsNumber(ExecState* exec, double d);
-    JSValuePtr jsNumber(ExecState*, char i);
-    JSValuePtr jsNumber(ExecState*, unsigned char i);
-    JSValuePtr jsNumber(ExecState*, short i);
-    JSValuePtr jsNumber(ExecState*, unsigned short i);
-    JSValuePtr jsNumber(ExecState* exec, int i);
-    JSValuePtr jsNumber(ExecState* exec, unsigned i);
-    JSValuePtr jsNumber(ExecState* exec, long i);
-    JSValuePtr jsNumber(ExecState* exec, unsigned long i);
-    JSValuePtr jsNumber(ExecState* exec, long long i);
-    JSValuePtr jsNumber(ExecState* exec, unsigned long long i);
-    JSValuePtr jsNumber(JSGlobalData* globalData, double d);
-    JSValuePtr jsNumber(JSGlobalData* globalData, short i);
-    JSValuePtr jsNumber(JSGlobalData* globalData, unsigned short i);
-    JSValuePtr jsNumber(JSGlobalData* globalData, int i);
-    JSValuePtr jsNumber(JSGlobalData* globalData, unsigned i);
-    JSValuePtr jsNumber(JSGlobalData* globalData, long i);
-    JSValuePtr jsNumber(JSGlobalData* globalData, unsigned long i);
-    JSValuePtr jsNumber(JSGlobalData* globalData, long long i);
-    JSValuePtr jsNumber(JSGlobalData* globalData, unsigned long long i);
-
 #if USE(ALTERNATE_JSIMMEDIATE)
     inline intptr_t reinterpretDoubleToIntptr(double value)
     {
@@ -158,33 +132,28 @@
     class JSImmediate {
     private:
         friend class JIT;
-        friend class JSValuePtr;
+        friend class JSValue;
         friend class JSFastMath;
-        friend JSValuePtr js0();
-        friend JSValuePtr jsNull();
-        friend JSValuePtr jsBoolean(bool b);
-        friend JSValuePtr jsUndefined();
-        friend JSValuePtr jsImpossibleValue();
-        friend JSValuePtr jsNumber(ExecState* exec, double d);
-        friend JSValuePtr jsNumber(ExecState*, char i);
-        friend JSValuePtr jsNumber(ExecState*, unsigned char i);
-        friend JSValuePtr jsNumber(ExecState*, short i);
-        friend JSValuePtr jsNumber(ExecState*, unsigned short i);
-        friend JSValuePtr jsNumber(ExecState* exec, int i);
-        friend JSValuePtr jsNumber(ExecState* exec, unsigned i);
-        friend JSValuePtr jsNumber(ExecState* exec, long i);
-        friend JSValuePtr jsNumber(ExecState* exec, unsigned long i);
-        friend JSValuePtr jsNumber(ExecState* exec, long long i);
-        friend JSValuePtr jsNumber(ExecState* exec, unsigned long long i);
-        friend JSValuePtr jsNumber(JSGlobalData* globalData, double d);
-        friend JSValuePtr jsNumber(JSGlobalData* globalData, short i);
-        friend JSValuePtr jsNumber(JSGlobalData* globalData, unsigned short i);
-        friend JSValuePtr jsNumber(JSGlobalData* globalData, int i);
-        friend JSValuePtr jsNumber(JSGlobalData* globalData, unsigned i);
-        friend JSValuePtr jsNumber(JSGlobalData* globalData, long i);
-        friend JSValuePtr jsNumber(JSGlobalData* globalData, unsigned long i);
-        friend JSValuePtr jsNumber(JSGlobalData* globalData, long long i);
-        friend JSValuePtr jsNumber(JSGlobalData* globalData, unsigned long long i);
+        friend JSValue jsNumber(ExecState* exec, double d);
+        friend JSValue jsNumber(ExecState*, char i);
+        friend JSValue jsNumber(ExecState*, unsigned char i);
+        friend JSValue jsNumber(ExecState*, short i);
+        friend JSValue jsNumber(ExecState*, unsigned short i);
+        friend JSValue jsNumber(ExecState* exec, int i);
+        friend JSValue jsNumber(ExecState* exec, unsigned i);
+        friend JSValue jsNumber(ExecState* exec, long i);
+        friend JSValue jsNumber(ExecState* exec, unsigned long i);
+        friend JSValue jsNumber(ExecState* exec, long long i);
+        friend JSValue jsNumber(ExecState* exec, unsigned long long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, double d);
+        friend JSValue jsNumber(JSGlobalData* globalData, short i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned short i);
+        friend JSValue jsNumber(JSGlobalData* globalData, int i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned i);
+        friend JSValue jsNumber(JSGlobalData* globalData, long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, long long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned long long i);
 
 #if USE(ALTERNATE_JSIMMEDIATE)
         // If all bits in the mask are set, this indicates an integer number,
@@ -219,17 +188,17 @@
 
         static const int32_t signBit = 0x80000000;
  
-        static ALWAYS_INLINE bool isImmediate(JSValuePtr v)
+        static ALWAYS_INLINE bool isImmediate(JSValue v)
         {
             return rawValue(v) & TagMask;
         }
         
-        static ALWAYS_INLINE bool isNumber(JSValuePtr v)
+        static ALWAYS_INLINE bool isNumber(JSValue v)
         {
             return rawValue(v) & TagTypeNumber;
         }
 
-        static ALWAYS_INLINE bool isIntegerNumber(JSValuePtr v)
+        static ALWAYS_INLINE bool isIntegerNumber(JSValue v)
         {
 #if USE(ALTERNATE_JSIMMEDIATE)
             return (rawValue(v) & TagTypeNumber) == TagTypeNumber;
@@ -239,53 +208,53 @@
         }
 
 #if USE(ALTERNATE_JSIMMEDIATE)
-        static ALWAYS_INLINE bool isDoubleNumber(JSValuePtr v)
+        static ALWAYS_INLINE bool isDoubleNumber(JSValue v)
         {
             return isNumber(v) && !isIntegerNumber(v);
         }
 #endif
 
-        static ALWAYS_INLINE bool isPositiveIntegerNumber(JSValuePtr v)
+        static ALWAYS_INLINE bool isPositiveIntegerNumber(JSValue v)
         {
             // A single mask to check for the sign bit and the number tag all at once.
             return (rawValue(v) & (signBit | TagTypeNumber)) == TagTypeNumber;
         }
         
-        static ALWAYS_INLINE bool isBoolean(JSValuePtr v)
+        static ALWAYS_INLINE bool isBoolean(JSValue v)
         {
             return (rawValue(v) & FullTagTypeMask) == FullTagTypeBool;
         }
         
-        static ALWAYS_INLINE bool isUndefinedOrNull(JSValuePtr v)
+        static ALWAYS_INLINE bool isUndefinedOrNull(JSValue v)
         {
             // Undefined and null share the same value, bar the 'undefined' bit in the extended tag.
             return (rawValue(v) & ~ExtendedTagBitUndefined) == FullTagTypeNull;
         }
 
-        static JSValuePtr from(char);
-        static JSValuePtr from(signed char);
-        static JSValuePtr from(unsigned char);
-        static JSValuePtr from(short);
-        static JSValuePtr from(unsigned short);
-        static JSValuePtr from(int);
-        static JSValuePtr from(unsigned);
-        static JSValuePtr from(long);
-        static JSValuePtr from(unsigned long);
-        static JSValuePtr from(long long);
-        static JSValuePtr from(unsigned long long);
-        static JSValuePtr from(double);
+        static JSValue from(char);
+        static JSValue from(signed char);
+        static JSValue from(unsigned char);
+        static JSValue from(short);
+        static JSValue from(unsigned short);
+        static JSValue from(int);
+        static JSValue from(unsigned);
+        static JSValue from(long);
+        static JSValue from(unsigned long);
+        static JSValue from(long long);
+        static JSValue from(unsigned long long);
+        static JSValue from(double);
 
-        static ALWAYS_INLINE bool isEitherImmediate(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE bool isEitherImmediate(JSValue v1, JSValue v2)
         {
             return (rawValue(v1) | rawValue(v2)) & TagMask;
         }
 
-        static ALWAYS_INLINE bool areBothImmediate(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE bool areBothImmediate(JSValue v1, JSValue v2)
         {
             return isImmediate(v1) & isImmediate(v2);
         }
 
-        static ALWAYS_INLINE bool areBothImmediateIntegerNumbers(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE bool areBothImmediateIntegerNumbers(JSValue v1, JSValue v2)
         {
 #if USE(ALTERNATE_JSIMMEDIATE)
             return (rawValue(v1) & rawValue(v2) & TagTypeNumber) == TagTypeNumber;
@@ -294,29 +263,27 @@
 #endif
         }
 
-        static double toDouble(JSValuePtr);
-        static bool toBoolean(JSValuePtr);
-        static JSObject* toObject(JSValuePtr, ExecState*);
-        static JSObject* toThisObject(JSValuePtr, ExecState*);
-        static UString toString(JSValuePtr);
+        static double toDouble(JSValue);
+        static bool toBoolean(JSValue);
+        static JSObject* toObject(JSValue, ExecState*);
+        static JSObject* toThisObject(JSValue, ExecState*);
+        static UString toString(JSValue);
 
-        static bool getUInt32(JSValuePtr, uint32_t&);
-        static bool getTruncatedInt32(JSValuePtr, int32_t&);
-        static bool getTruncatedUInt32(JSValuePtr, uint32_t&);
+        static bool getUInt32(JSValue, uint32_t&);
+        static bool getTruncatedInt32(JSValue, int32_t&);
+        static bool getTruncatedUInt32(JSValue, uint32_t&);
 
-        static int32_t getTruncatedInt32(JSValuePtr);
-        static uint32_t getTruncatedUInt32(JSValuePtr);
+        static int32_t getTruncatedInt32(JSValue);
+        static uint32_t getTruncatedUInt32(JSValue);
 
-        static JSValuePtr trueImmediate();
-        static JSValuePtr falseImmediate();
-        static JSValuePtr undefinedImmediate();
-        static JSValuePtr nullImmediate();
-        static JSValuePtr zeroImmediate();
-        static JSValuePtr oneImmediate();
+        static JSValue trueImmediate();
+        static JSValue falseImmediate();
+        static JSValue undefinedImmediate();
+        static JSValue nullImmediate();
+        static JSValue zeroImmediate();
+        static JSValue oneImmediate();
 
-        static JSValuePtr impossibleValue();
-        
-        static JSObject* prototype(JSValuePtr, ExecState*);
+        static JSObject* prototype(JSValue, ExecState*);
 
     private:
 #if USE(ALTERNATE_JSIMMEDIATE)
@@ -328,71 +295,71 @@
 #endif
         static const unsigned maxImmediateUInt = maxImmediateInt;
 
-        static ALWAYS_INLINE JSValuePtr makeValue(intptr_t integer)
+        static ALWAYS_INLINE JSValue makeValue(intptr_t integer)
         {
-            return JSValuePtr::makeImmediate(integer);
+            return JSValue::makeImmediate(integer);
         }
 
         // With USE(ALTERNATE_JSIMMEDIATE) we want the argument to be zero extended, so the
         // integer doesn't interfere with the tag bits in the upper word.  In the default encoding,
         // if intptr_t id larger then int32_t we sign extend the value through the upper word.
 #if USE(ALTERNATE_JSIMMEDIATE)
-        static ALWAYS_INLINE JSValuePtr makeInt(uint32_t value)
+        static ALWAYS_INLINE JSValue makeInt(uint32_t value)
 #else
-        static ALWAYS_INLINE JSValuePtr makeInt(int32_t value)
+        static ALWAYS_INLINE JSValue makeInt(int32_t value)
 #endif
         {
             return makeValue((static_cast<intptr_t>(value) << IntegerPayloadShift) | TagTypeNumber);
         }
         
 #if USE(ALTERNATE_JSIMMEDIATE)
-        static ALWAYS_INLINE JSValuePtr makeDouble(double value)
+        static ALWAYS_INLINE JSValue makeDouble(double value)
         {
             return makeValue(reinterpretDoubleToIntptr(value) + DoubleEncodeOffset);
         }
 #endif
         
-        static ALWAYS_INLINE JSValuePtr makeBool(bool b)
+        static ALWAYS_INLINE JSValue makeBool(bool b)
         {
             return makeValue((static_cast<intptr_t>(b) << ExtendedPayloadShift) | FullTagTypeBool);
         }
         
-        static ALWAYS_INLINE JSValuePtr makeUndefined()
+        static ALWAYS_INLINE JSValue makeUndefined()
         {
             return makeValue(FullTagTypeUndefined);
         }
         
-        static ALWAYS_INLINE JSValuePtr makeNull()
+        static ALWAYS_INLINE JSValue makeNull()
         {
             return makeValue(FullTagTypeNull);
         }
 
         template<typename T>
-        static JSValuePtr fromNumberOutsideIntegerRange(T);
+        static JSValue fromNumberOutsideIntegerRange(T);
 
 #if USE(ALTERNATE_JSIMMEDIATE)
-        static ALWAYS_INLINE double doubleValue(JSValuePtr v)
+        static ALWAYS_INLINE double doubleValue(JSValue v)
         {
             return reinterpretIntptrToDouble(rawValue(v) - DoubleEncodeOffset);
         }
 #endif
 
-        static ALWAYS_INLINE int32_t intValue(JSValuePtr v)
+        static ALWAYS_INLINE int32_t intValue(JSValue v)
         {
             return static_cast<int32_t>(rawValue(v) >> IntegerPayloadShift);
         }
         
-        static ALWAYS_INLINE uint32_t uintValue(JSValuePtr v)
+        static ALWAYS_INLINE uint32_t uintValue(JSValue v)
         {
             return static_cast<uint32_t>(rawValue(v) >> IntegerPayloadShift);
         }
         
-        static ALWAYS_INLINE bool boolValue(JSValuePtr v)
+        static ALWAYS_INLINE bool boolValue(JSValue v)
         {
             return rawValue(v) & ExtendedPayloadBitBoolValue;
         }
         
-        static ALWAYS_INLINE intptr_t rawValue(JSValuePtr v)
+        static ALWAYS_INLINE intptr_t rawValue(JSValue v)
         {
             return v.immediateValue();
         }
@@ -400,15 +367,12 @@
         static double nonInlineNaN();
     };
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::trueImmediate() { return makeBool(true); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::falseImmediate() { return makeBool(false); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::undefinedImmediate() { return makeUndefined(); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::nullImmediate() { return makeNull(); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::zeroImmediate() { return makeInt(0); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::oneImmediate() { return makeInt(1); }
-
-    // This value is impossible because 0x4 is not a valid pointer but a tag of 0 would indicate non-immediate
-    ALWAYS_INLINE JSValuePtr JSImmediate::impossibleValue() { return makeValue(0x4); }
+    ALWAYS_INLINE JSValue JSImmediate::trueImmediate() { return makeBool(true); }
+    ALWAYS_INLINE JSValue JSImmediate::falseImmediate() { return makeBool(false); }
+    ALWAYS_INLINE JSValue JSImmediate::undefinedImmediate() { return makeUndefined(); }
+    ALWAYS_INLINE JSValue JSImmediate::nullImmediate() { return makeNull(); }
+    ALWAYS_INLINE JSValue JSImmediate::zeroImmediate() { return makeInt(0); }
+    ALWAYS_INLINE JSValue JSImmediate::oneImmediate() { return makeInt(1); }
 
 #if USE(ALTERNATE_JSIMMEDIATE)
     inline bool doubleToBoolean(double value)
@@ -416,21 +380,21 @@
         return value < 0.0 || value > 0.0;
     }
 
-    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValuePtr v)
+    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValue v)
     {
         ASSERT(isImmediate(v));
         return isNumber(v) ? isIntegerNumber(v) ? v != zeroImmediate()
             : doubleToBoolean(doubleValue(v)) : v == trueImmediate();
     }
 #else
-    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValuePtr v)
+    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValue v)
     {
         ASSERT(isImmediate(v));
         return isIntegerNumber(v) ? v != zeroImmediate() : v == trueImmediate();
     }
 #endif
 
-    ALWAYS_INLINE uint32_t JSImmediate::getTruncatedUInt32(JSValuePtr v)
+    ALWAYS_INLINE uint32_t JSImmediate::getTruncatedUInt32(JSValue v)
     {
         // FIXME: should probably be asserting isPositiveIntegerNumber here.
         ASSERT(isIntegerNumber(v));
@@ -439,44 +403,44 @@
 
 #if USE(ALTERNATE_JSIMMEDIATE)
     template<typename T>
-    inline JSValuePtr JSImmediate::fromNumberOutsideIntegerRange(T value)
+    inline JSValue JSImmediate::fromNumberOutsideIntegerRange(T value)
     {
         return makeDouble(static_cast<double>(value));
     }
 #else
     template<typename T>
-    inline JSValuePtr JSImmediate::fromNumberOutsideIntegerRange(T)
+    inline JSValue JSImmediate::fromNumberOutsideIntegerRange(T)
     {
-        return noValue();
+        return JSValue();
     }
 #endif
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(char i)
+    ALWAYS_INLINE JSValue JSImmediate::from(char i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(signed char i)
+    ALWAYS_INLINE JSValue JSImmediate::from(signed char i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned char i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned char i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(short i)
+    ALWAYS_INLINE JSValue JSImmediate::from(short i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned short i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned short i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(int i)
+    ALWAYS_INLINE JSValue JSImmediate::from(int i)
     {
 #if !USE(ALTERNATE_JSIMMEDIATE)
         if ((i < minImmediateInt) | (i > maxImmediateInt))
@@ -485,42 +449,42 @@
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned i)
     {
         if (i > maxImmediateUInt)
             return fromNumberOutsideIntegerRange(i);
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(long i)
     {
         if ((i < minImmediateInt) | (i > maxImmediateInt))
             return fromNumberOutsideIntegerRange(i);
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned long i)
     {
         if (i > maxImmediateUInt)
             return fromNumberOutsideIntegerRange(i);
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(long long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(long long i)
     {
         if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return noValue();
+            return JSValue();
         return makeInt(static_cast<intptr_t>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned long long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned long long i)
     {
         if (i > maxImmediateUInt)
             return fromNumberOutsideIntegerRange(i);
         return makeInt(static_cast<intptr_t>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(double d)
+    ALWAYS_INLINE JSValue JSImmediate::from(double d)
     {
         const int intVal = static_cast<int>(d);
 
@@ -531,13 +495,13 @@
         return from(intVal);
     }
 
-    ALWAYS_INLINE int32_t JSImmediate::getTruncatedInt32(JSValuePtr v)
+    ALWAYS_INLINE int32_t JSImmediate::getTruncatedInt32(JSValue v)
     {
         ASSERT(isIntegerNumber(v));
         return intValue(v);
     }
 
-    ALWAYS_INLINE double JSImmediate::toDouble(JSValuePtr v)
+    ALWAYS_INLINE double JSImmediate::toDouble(JSValue v)
     {
         ASSERT(isImmediate(v));
 
@@ -560,75 +524,60 @@
         return rawValue(v) >> ExtendedPayloadShift;
     }
 
-    ALWAYS_INLINE bool JSImmediate::getUInt32(JSValuePtr v, uint32_t& i)
+    ALWAYS_INLINE bool JSImmediate::getUInt32(JSValue v, uint32_t& i)
     {
         i = uintValue(v);
         return isPositiveIntegerNumber(v);
     }
 
-    ALWAYS_INLINE bool JSImmediate::getTruncatedInt32(JSValuePtr v, int32_t& i)
+    ALWAYS_INLINE bool JSImmediate::getTruncatedInt32(JSValue v, int32_t& i)
     {
         i = intValue(v);
         return isIntegerNumber(v);
     }
 
-    ALWAYS_INLINE bool JSImmediate::getTruncatedUInt32(JSValuePtr v, uint32_t& i)
+    ALWAYS_INLINE bool JSImmediate::getTruncatedUInt32(JSValue v, uint32_t& i)
     {
         return getUInt32(v, i);
     }
 
-    inline JSValuePtr js0()
-    {
-        return JSImmediate::zeroImmediate();
-    }
-
-    inline JSValuePtr jsNull()
-    {
-        return JSImmediate::nullImmediate();
-    }
-
-    inline JSValuePtr jsBoolean(bool b)
-    {
-        return b ? JSImmediate::trueImmediate() : JSImmediate::falseImmediate();
-    }
-
-    inline JSValuePtr jsUndefined()
-    {
-        return JSImmediate::undefinedImmediate();
-    }
-
-    inline JSValuePtr jsImpossibleValue()
-    {
-        return JSImmediate::impossibleValue();
-    }
-
     // These are identical logic to the JSValue functions above, and faster than jsNumber(number).toInt32().
     int32_t toInt32(double);
     uint32_t toUInt32(double);
     int32_t toInt32SlowCase(double, bool& ok);
     uint32_t toUInt32SlowCase(double, bool& ok);
 
-    inline bool JSValuePtr::isUndefined() const
+    inline JSValue::JSValue(JSNullTag)
     {
-        return asValue() == jsUndefined();
+        *this = JSImmediate::nullImmediate();
+    }
+    
+    inline JSValue::JSValue(JSUndefinedTag)
+    {
+        *this = JSImmediate::undefinedImmediate();
     }
 
-    inline bool JSValuePtr::isNull() const
+    inline JSValue::JSValue(JSTrueTag)
     {
-        return asValue() == jsNull();
+        *this = JSImmediate::trueImmediate();
     }
 
-    inline bool JSValuePtr::isUndefinedOrNull() const
+    inline JSValue::JSValue(JSFalseTag)
+    {
+        *this = JSImmediate::falseImmediate();
+    }
+
+    inline bool JSValue::isUndefinedOrNull() const
     {
         return JSImmediate::isUndefinedOrNull(asValue());
     }
 
-    inline bool JSValuePtr::isBoolean() const
+    inline bool JSValue::isBoolean() const
     {
         return JSImmediate::isBoolean(asValue());
     }
 
-    inline bool JSValuePtr::getBoolean(bool& v) const
+    inline bool JSValue::getBoolean(bool& v) const
     {
         if (JSImmediate::isBoolean(asValue())) {
             v = JSImmediate::toBoolean(asValue());
@@ -638,12 +587,12 @@
         return false;
     }
 
-    inline bool JSValuePtr::getBoolean() const
+    inline bool JSValue::getBoolean() const
     {
         return asValue() == jsBoolean(true);
     }
 
-    ALWAYS_INLINE int32_t JSValuePtr::toInt32(ExecState* exec) const
+    ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
     {
         int32_t i;
         if (getTruncatedInt32(i))
@@ -652,7 +601,7 @@
         return toInt32SlowCase(toNumber(exec), ignored);
     }
 
-    inline uint32_t JSValuePtr::toUInt32(ExecState* exec) const
+    inline uint32_t JSValue::toUInt32(ExecState* exec) const
     {
         uint32_t i;
         if (getTruncatedUInt32(i))
@@ -679,7 +628,7 @@
         return static_cast<uint32_t>(val);
     }
 
-    inline int32_t JSValuePtr::toInt32(ExecState* exec, bool& ok) const
+    inline int32_t JSValue::toInt32(ExecState* exec, bool& ok) const
     {
         int32_t i;
         if (getTruncatedInt32(i)) {
@@ -689,7 +638,7 @@
         return toInt32SlowCase(toNumber(exec), ok);
     }
 
-    inline uint32_t JSValuePtr::toUInt32(ExecState* exec, bool& ok) const
+    inline uint32_t JSValue::toUInt32(ExecState* exec, bool& ok) const
     {
         uint32_t i;
         if (getTruncatedUInt32(i)) {
@@ -699,91 +648,91 @@
         return toUInt32SlowCase(toNumber(exec), ok);
     }
 
-    inline bool JSValuePtr::isCell() const
+    inline bool JSValue::isCell() const
     {
         return !JSImmediate::isImmediate(asValue());
     }
 
-    inline bool JSValuePtr::isInt32Fast() const
+    inline bool JSValue::isInt32Fast() const
     {
         return JSImmediate::isIntegerNumber(asValue());
     }
 
-    inline int32_t JSValuePtr::getInt32Fast() const
+    inline int32_t JSValue::getInt32Fast() const
     {
         ASSERT(isInt32Fast());
         return JSImmediate::getTruncatedInt32(asValue());
     }
 
-    inline bool JSValuePtr::isUInt32Fast() const
+    inline bool JSValue::isUInt32Fast() const
     {
         return JSImmediate::isPositiveIntegerNumber(asValue());
     }
 
-    inline uint32_t JSValuePtr::getUInt32Fast() const
+    inline uint32_t JSValue::getUInt32Fast() const
     {
         ASSERT(isUInt32Fast());
         return JSImmediate::getTruncatedUInt32(asValue());
     }
 
-    inline JSValuePtr JSValuePtr::makeInt32Fast(int32_t i)
+    inline JSValue JSValue::makeInt32Fast(int32_t i)
     {
         return JSImmediate::from(i);
     }
 
-    inline bool JSValuePtr::areBothInt32Fast(JSValuePtr v1, JSValuePtr v2)
+    inline bool JSValue::areBothInt32Fast(JSValue v1, JSValue v2)
     {
         return JSImmediate::areBothImmediateIntegerNumbers(v1, v2);
     }
 
     class JSFastMath {
     public:
-        static ALWAYS_INLINE bool canDoFastBitwiseOperations(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE bool canDoFastBitwiseOperations(JSValue v1, JSValue v2)
         {
             return JSImmediate::areBothImmediateIntegerNumbers(v1, v2);
         }
 
-        static ALWAYS_INLINE JSValuePtr equal(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE JSValue equal(JSValue v1, JSValue v2)
         {
             ASSERT(canDoFastBitwiseOperations(v1, v2));
             return jsBoolean(v1 == v2);
         }
 
-        static ALWAYS_INLINE JSValuePtr notEqual(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE JSValue notEqual(JSValue v1, JSValue v2)
         {
             ASSERT(canDoFastBitwiseOperations(v1, v2));
             return jsBoolean(v1 != v2);
         }
 
-        static ALWAYS_INLINE JSValuePtr andImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE JSValue andImmediateNumbers(JSValue v1, JSValue v2)
         {
             ASSERT(canDoFastBitwiseOperations(v1, v2));
             return JSImmediate::makeValue(JSImmediate::rawValue(v1) & JSImmediate::rawValue(v2));
         }
 
-        static ALWAYS_INLINE JSValuePtr xorImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE JSValue xorImmediateNumbers(JSValue v1, JSValue v2)
         {
             ASSERT(canDoFastBitwiseOperations(v1, v2));
             return JSImmediate::makeValue((JSImmediate::rawValue(v1) ^ JSImmediate::rawValue(v2)) | JSImmediate::TagTypeNumber);
         }
 
-        static ALWAYS_INLINE JSValuePtr orImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE JSValue orImmediateNumbers(JSValue v1, JSValue v2)
         {
             ASSERT(canDoFastBitwiseOperations(v1, v2));
             return JSImmediate::makeValue(JSImmediate::rawValue(v1) | JSImmediate::rawValue(v2));
         }
 
-        static ALWAYS_INLINE bool canDoFastRshift(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE bool canDoFastRshift(JSValue v1, JSValue v2)
         {
             return JSImmediate::areBothImmediateIntegerNumbers(v1, v2);
         }
 
-        static ALWAYS_INLINE bool canDoFastUrshift(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE bool canDoFastUrshift(JSValue v1, JSValue v2)
         {
             return JSImmediate::areBothImmediateIntegerNumbers(v1, v2) && !(JSImmediate::rawValue(v1) & JSImmediate::signBit);
         }
 
-        static ALWAYS_INLINE JSValuePtr rightShiftImmediateNumbers(JSValuePtr val, JSValuePtr shift)
+        static ALWAYS_INLINE JSValue rightShiftImmediateNumbers(JSValue val, JSValue shift)
         {
             ASSERT(canDoFastRshift(val, shift) || canDoFastUrshift(val, shift));
 #if USE(ALTERNATE_JSIMMEDIATE)
@@ -793,39 +742,39 @@
 #endif
         }
 
-        static ALWAYS_INLINE bool canDoFastAdditiveOperations(JSValuePtr v)
+        static ALWAYS_INLINE bool canDoFastAdditiveOperations(JSValue v)
         {
             // Number is non-negative and an operation involving two of these can't overflow.
             // Checking for allowed negative numbers takes more time than it's worth on SunSpider.
             return (JSImmediate::rawValue(v) & (JSImmediate::TagTypeNumber + (JSImmediate::signBit | (JSImmediate::signBit >> 1)))) == JSImmediate::TagTypeNumber;
         }
 
-        static ALWAYS_INLINE bool canDoFastAdditiveOperations(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE bool canDoFastAdditiveOperations(JSValue v1, JSValue v2)
         {
             // Number is non-negative and an operation involving two of these can't overflow.
             // Checking for allowed negative numbers takes more time than it's worth on SunSpider.
             return canDoFastAdditiveOperations(v1) && canDoFastAdditiveOperations(v2);
         }
 
-        static ALWAYS_INLINE JSValuePtr addImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE JSValue addImmediateNumbers(JSValue v1, JSValue v2)
         {
             ASSERT(canDoFastAdditiveOperations(v1, v2));
             return JSImmediate::makeValue(JSImmediate::rawValue(v1) + JSImmediate::rawValue(v2) - JSImmediate::TagTypeNumber);
         }
 
-        static ALWAYS_INLINE JSValuePtr subImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE JSValue subImmediateNumbers(JSValue v1, JSValue v2)
         {
             ASSERT(canDoFastAdditiveOperations(v1, v2));
             return JSImmediate::makeValue(JSImmediate::rawValue(v1) - JSImmediate::rawValue(v2) + JSImmediate::TagTypeNumber);
         }
 
-        static ALWAYS_INLINE JSValuePtr incImmediateNumber(JSValuePtr v)
+        static ALWAYS_INLINE JSValue incImmediateNumber(JSValue v)
         {
             ASSERT(canDoFastAdditiveOperations(v));
             return JSImmediate::makeValue(JSImmediate::rawValue(v) + (1 << JSImmediate::IntegerPayloadShift));
         }
 
-        static ALWAYS_INLINE JSValuePtr decImmediateNumber(JSValuePtr v)
+        static ALWAYS_INLINE JSValue decImmediateNumber(JSValue v)
         {
             ASSERT(canDoFastAdditiveOperations(v));
             return JSImmediate::makeValue(JSImmediate::rawValue(v) - (1 << JSImmediate::IntegerPayloadShift));
diff --git a/JavaScriptCore/runtime/JSNotAnObject.cpp b/JavaScriptCore/runtime/JSNotAnObject.cpp
index 67edfd1..937dc2b 100644
--- a/JavaScriptCore/runtime/JSNotAnObject.cpp
+++ b/JavaScriptCore/runtime/JSNotAnObject.cpp
@@ -37,13 +37,13 @@
 ASSERT_CLASS_FITS_IN_CELL(JSNotAnObject);
 
 // JSValue methods
-JSValuePtr JSNotAnObject::toPrimitive(ExecState* exec, PreferredPrimitiveType) const
+JSValue JSNotAnObject::toPrimitive(ExecState* exec, PreferredPrimitiveType) const
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
     return m_exception;
 }
 
-bool JSNotAnObject::getPrimitiveNumber(ExecState* exec, double&, JSValuePtr&)
+bool JSNotAnObject::getPrimitiveNumber(ExecState* exec, double&, JSValue&)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
     return false;
@@ -94,12 +94,12 @@
     return false;
 }
 
-void JSNotAnObject::put(ExecState* exec, const Identifier& , JSValuePtr, PutPropertySlot&)
+void JSNotAnObject::put(ExecState* exec, const Identifier& , JSValue, PutPropertySlot&)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
 }
 
-void JSNotAnObject::put(ExecState* exec, unsigned, JSValuePtr)
+void JSNotAnObject::put(ExecState* exec, unsigned, JSValue)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
 }
diff --git a/JavaScriptCore/runtime/JSNotAnObject.h b/JavaScriptCore/runtime/JSNotAnObject.h
index c69593f..a8e36bd 100644
--- a/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/JavaScriptCore/runtime/JSNotAnObject.h
@@ -60,15 +60,15 @@
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
 
      private:
         // JSValue methods
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr&);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -81,8 +81,8 @@
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
 
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue);
 
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
diff --git a/JavaScriptCore/runtime/JSNumberCell.cpp b/JavaScriptCore/runtime/JSNumberCell.cpp
index dd965d5..669440b 100644
--- a/JavaScriptCore/runtime/JSNumberCell.cpp
+++ b/JavaScriptCore/runtime/JSNumberCell.cpp
@@ -30,12 +30,12 @@
 
 #if !USE(ALTERNATE_JSIMMEDIATE)
 
-JSValuePtr JSNumberCell::toPrimitive(ExecState*, PreferredPrimitiveType) const
+JSValue JSNumberCell::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     return const_cast<JSNumberCell*>(this);
 }
 
-bool JSNumberCell::getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value)
+bool JSNumberCell::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
 {
     number = m_value;
     value = this;
@@ -98,27 +98,38 @@
     return true;
 }
 
-JSValuePtr JSNumberCell::getJSNumber()
+JSValue JSNumberCell::getJSNumber()
 {
     return this;
 }
 
-JSValuePtr jsNumberCell(ExecState* exec, double d)
+JSValue jsNumberCell(ExecState* exec, double d)
 {
     return new (exec) JSNumberCell(exec, d);
 }
 
-JSValuePtr jsNumberCell(JSGlobalData* globalData, double d)
+JSValue jsNumberCell(JSGlobalData* globalData, double d)
 {
     return new (globalData) JSNumberCell(globalData, d);
 }
 
+JSValue jsAPIMangledNumber(ExecState* exec, double d)
+{
+    return new (exec) JSNumberCell(JSNumberCell::APIMangled, d);
+}
+
 #else
 
-JSValuePtr jsNumberCell(ExecState*, double)
+JSValue jsNumberCell(ExecState*, double)
 {
     ASSERT_NOT_REACHED();
-    return noValue();
+    return JSValue();
+}
+
+JSValue jsAPIMangledNumber(ExecState*, double)
+{
+    ASSERT_NOT_REACHED();
+    return JSValue();
 }
 
 #endif
diff --git a/JavaScriptCore/runtime/JSNumberCell.h b/JavaScriptCore/runtime/JSNumberCell.h
index d2377aa..a35e210 100644
--- a/JavaScriptCore/runtime/JSNumberCell.h
+++ b/JavaScriptCore/runtime/JSNumberCell.h
@@ -35,7 +35,8 @@
     extern const double NaN;
     extern const double Inf;
 
-    JSValuePtr jsNumberCell(ExecState*, double);
+    JSValue jsNumberCell(ExecState*, double);
+    JSValue jsAPIMangledNumber(ExecState*, double);
 
 #if !USE(ALTERNATE_JSIMMEDIATE)
 
@@ -50,13 +51,14 @@
 
     class JSNumberCell : public JSCell {
         friend class JIT;
-        friend JSValuePtr jsNumberCell(JSGlobalData*, double);
-        friend JSValuePtr jsNumberCell(ExecState*, double);
+        friend JSValue jsNumberCell(JSGlobalData*, double);
+        friend JSValue jsNumberCell(ExecState*, double);
+        friend JSValue jsAPIMangledNumber(ExecState*, double);
     public:
         double value() const { return m_value; }
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -64,7 +66,10 @@
 
         virtual UString toThisString(ExecState*) const;
         virtual JSObject* toThisObject(ExecState*) const;
-        virtual JSValuePtr getJSNumber();
+        virtual JSValue getJSNumber();
+
+        static const uintptr_t JSAPIMangledMagicNumber = 0xbbadbeef;
+        bool isAPIMangledNumber() const { return m_structure == reinterpret_cast<Structure*>(JSAPIMangledMagicNumber); }
 
         void* operator new(size_t size, ExecState* exec)
         {
@@ -84,7 +89,7 @@
     #endif
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion)); }
 
     private:
         JSNumberCell(JSGlobalData* globalData, double value)
@@ -99,6 +104,13 @@
         {
         }
 
+        enum APIMangledTag { APIMangled };
+        JSNumberCell(APIMangledTag, double value)
+            : JSCell(reinterpret_cast<Structure*>(JSAPIMangledMagicNumber))
+            , m_value(value)
+        {
+        }
+
         virtual bool getUInt32(uint32_t&) const;
         virtual bool getTruncatedInt32(int32_t&) const;
         virtual bool getTruncatedUInt32(uint32_t&) const;
@@ -106,240 +118,247 @@
         double m_value;
     };
 
-    JSValuePtr jsNumberCell(JSGlobalData*, double);
+    JSValue jsNumberCell(JSGlobalData*, double);
 
-    inline bool isNumberCell(JSValuePtr v)
+    inline bool isNumberCell(JSValue v)
     {
         return v.isCell() && v.asCell()->isNumber();
     }
 
-    inline JSNumberCell* asNumberCell(JSValuePtr v)
+    inline JSNumberCell* asNumberCell(JSValue v)
     {
         ASSERT(isNumberCell(v));
         return static_cast<JSNumberCell*>(v.asCell());
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, double d)
+
+    inline JSValue::JSValue(ExecState* exec, double d)
     {
-        JSValuePtr v = JSImmediate::from(d);
-        return v ? v : jsNumberCell(exec, d);
+        JSValue v = JSImmediate::from(d);
+        *this = v ? v : jsNumberCell(exec, d);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, int i)
+    inline JSValue::JSValue(ExecState* exec, int i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, unsigned i)
+    inline JSValue::JSValue(ExecState* exec, unsigned i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, long i)
+    inline JSValue::JSValue(ExecState* exec, long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, unsigned long i)
+    inline JSValue::JSValue(ExecState* exec, unsigned long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, long long i)
+    inline JSValue::JSValue(ExecState* exec, long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, static_cast<double>(i));
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, static_cast<double>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, unsigned long long i)
+    inline JSValue::JSValue(ExecState* exec, unsigned long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, static_cast<double>(i));
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, static_cast<double>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, double d)
+    inline JSValue::JSValue(JSGlobalData* globalData, double d)
     {
-        JSValuePtr v = JSImmediate::from(d);
-        return v ? v : jsNumberCell(globalData, d);
+        JSValue v = JSImmediate::from(d);
+        *this = v ? v : jsNumberCell(globalData, d);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, int i)
+    inline JSValue::JSValue(JSGlobalData* globalData, int i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, unsigned i)
+    inline JSValue::JSValue(JSGlobalData* globalData, unsigned i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, long i)
+    inline JSValue::JSValue(JSGlobalData* globalData, long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, unsigned long i)
+    inline JSValue::JSValue(JSGlobalData* globalData, unsigned long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, long long i)
+    inline JSValue::JSValue(JSGlobalData* globalData, long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, static_cast<double>(i));
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, static_cast<double>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, unsigned long long i)
+    inline JSValue::JSValue(JSGlobalData* globalData, unsigned long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, static_cast<double>(i));
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, static_cast<double>(i));
     }
 
-    inline bool JSValuePtr::isDoubleNumber() const
+    inline bool JSValue::isDoubleNumber() const
     {
         return isNumberCell(asValue());
     }
 
-    inline double JSValuePtr::getDoubleNumber() const
+    inline double JSValue::getDoubleNumber() const
     {
         return asNumberCell(asValue())->value();
     }
 
-    inline bool JSValuePtr::isNumber() const
+    inline bool JSValue::isNumber() const
     {
         return JSImmediate::isNumber(asValue()) || isDoubleNumber();
     }
 
-    inline double JSValuePtr::uncheckedGetNumber() const
+    inline double JSValue::uncheckedGetNumber() const
     {
         ASSERT(isNumber());
         return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : getDoubleNumber();
     }
 
+    inline bool JSValue::isAPIMangledNumber()
+    {
+        ASSERT(isNumber());
+        return JSImmediate::isImmediate(asValue()) ? false : asNumberCell(asValue())->isAPIMangledNumber();
+    }
+
 #else
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState*, double d)
+    inline JSValue::JSValue(ExecState*, double d)
     {
-        JSValuePtr v = JSImmediate::from(d);
+        JSValue v = JSImmediate::from(d);
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState*, int i)
+    inline JSValue::JSValue(ExecState*, int i)
     {
-        JSValuePtr v = JSImmediate::from(i);
+        JSValue v = JSImmediate::from(i);
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState*, unsigned i)
+    inline JSValue::JSValue(ExecState*, unsigned i)
     {
-        JSValuePtr v = JSImmediate::from(i);
+        JSValue v = JSImmediate::from(i);
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState*, long i)
+    inline JSValue::JSValue(ExecState*, long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
+        JSValue v = JSImmediate::from(i);
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState*, unsigned long i)
+    inline JSValue::JSValue(ExecState*, unsigned long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
+        JSValue v = JSImmediate::from(i);
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState*, long long i)
+    inline JSValue::JSValue(ExecState*, long long i)
     {
-        JSValuePtr v = JSImmediate::from(static_cast<double>(i));
+        JSValue v = JSImmediate::from(static_cast<double>(i));
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState*, unsigned long long i)
+    inline JSValue::JSValue(ExecState*, unsigned long long i)
     {
-        JSValuePtr v = JSImmediate::from(static_cast<double>(i));
+        JSValue v = JSImmediate::from(static_cast<double>(i));
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData*, double d)
+    inline JSValue::JSValue(JSGlobalData*, double d)
     {
-        JSValuePtr v = JSImmediate::from(d);
+        JSValue v = JSImmediate::from(d);
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData*, int i)
+    inline JSValue::JSValue(JSGlobalData*, int i)
     {
-        JSValuePtr v = JSImmediate::from(i);
+        JSValue v = JSImmediate::from(i);
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData*, unsigned i)
+    inline JSValue::JSValue(JSGlobalData*, unsigned i)
     {
-        JSValuePtr v = JSImmediate::from(i);
+        JSValue v = JSImmediate::from(i);
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData*, long i)
+    inline JSValue::JSValue(JSGlobalData*, long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
+        JSValue v = JSImmediate::from(i);
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData*, unsigned long i)
+    inline JSValue::JSValue(JSGlobalData*, unsigned long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
+        JSValue v = JSImmediate::from(i);
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData*, long long i)
+    inline JSValue::JSValue(JSGlobalData*, long long i)
     {
-        JSValuePtr v = JSImmediate::from(static_cast<double>(i));
+        JSValue v = JSImmediate::from(static_cast<double>(i));
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData*, unsigned long long i)
+    inline JSValue::JSValue(JSGlobalData*, unsigned long long i)
     {
-        JSValuePtr v = JSImmediate::from(static_cast<double>(i));
+        JSValue v = JSImmediate::from(static_cast<double>(i));
         ASSERT(v);
-        return v;
+        *this = v;
     }
 
-    inline bool JSValuePtr::isDoubleNumber() const
+    inline bool JSValue::isDoubleNumber() const
     {
         return JSImmediate::isDoubleNumber(asValue());
     }
 
-    inline double JSValuePtr::getDoubleNumber() const
+    inline double JSValue::getDoubleNumber() const
     {
         return JSImmediate::doubleValue(asValue());
     }
 
-    inline bool JSValuePtr::isNumber() const
+    inline bool JSValue::isNumber() const
     {
         return JSImmediate::isNumber(asValue());
     }
 
-    inline double JSValuePtr::uncheckedGetNumber() const
+    inline double JSValue::uncheckedGetNumber() const
     {
         ASSERT(isNumber());
         return JSImmediate::toDouble(asValue());
@@ -347,60 +366,72 @@
 
 #endif
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState*, char i)
+    inline JSValue::JSValue(ExecState*, char i)
     {
         ASSERT(JSImmediate::from(i));
-        return JSImmediate::from(i);
+        *this = JSImmediate::from(i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState*, unsigned char i)
+    inline JSValue::JSValue(ExecState*, unsigned char i)
     {
         ASSERT(JSImmediate::from(i));
-        return JSImmediate::from(i);
+        *this = JSImmediate::from(i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState*, short i)
+    inline JSValue::JSValue(ExecState*, short i)
     {
         ASSERT(JSImmediate::from(i));
-        return JSImmediate::from(i);
+        *this = JSImmediate::from(i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState*, unsigned short i)
+    inline JSValue::JSValue(ExecState*, unsigned short i)
     {
         ASSERT(JSImmediate::from(i));
-        return JSImmediate::from(i);
+        *this = JSImmediate::from(i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData*, short i)
+    inline JSValue::JSValue(JSGlobalData*, char i)
     {
         ASSERT(JSImmediate::from(i));
-        return JSImmediate::from(i);
+        *this = JSImmediate::from(i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData*, unsigned short i)
+    inline JSValue::JSValue(JSGlobalData*, unsigned char i)
     {
         ASSERT(JSImmediate::from(i));
-        return JSImmediate::from(i);
+        *this = JSImmediate::from(i);
     }
 
-    inline JSValuePtr jsNaN(ExecState* exec)
+    inline JSValue::JSValue(JSGlobalData*, short i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, unsigned short i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue jsNaN(ExecState* exec)
     {
         return jsNumber(exec, NaN);
     }
 
-    inline JSValuePtr jsNaN(JSGlobalData* globalData)
+    inline JSValue jsNaN(JSGlobalData* globalData)
     {
         return jsNumber(globalData, NaN);
     }
 
     // --- JSValue inlines ----------------------------
 
-    ALWAYS_INLINE JSValuePtr JSValuePtr::toJSNumber(ExecState* exec) const
+    ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
     {
         return isNumber() ? asValue() : jsNumber(exec, this->toNumber(exec));
     }
 
-    inline bool JSValuePtr::getNumber(double &result) const
+    inline bool JSValue::getNumber(double &result) const
     {
         if (isInt32Fast())
             result = getInt32Fast();
@@ -413,7 +444,7 @@
         return true;
     }
 
-    inline bool JSValuePtr::numberToInt32(int32_t& arg)
+    inline bool JSValue::numberToInt32(int32_t& arg)
     {
         if (isInt32Fast())
             arg = getInt32Fast();
@@ -426,7 +457,7 @@
         return true;
     }
 
-    inline bool JSValuePtr::numberToUInt32(uint32_t& arg)
+    inline bool JSValue::numberToUInt32(uint32_t& arg)
     {
         if (isUInt32Fast())
             arg = getUInt32Fast();
diff --git a/JavaScriptCore/runtime/JSObject.cpp b/JavaScriptCore/runtime/JSObject.cpp
index e9e95f6..415c25d 100644
--- a/JavaScriptCore/runtime/JSObject.cpp
+++ b/JavaScriptCore/runtime/JSObject.cpp
@@ -69,9 +69,11 @@
     JSCell::mark();
     m_structure->mark();
 
+    PropertyStorage storage = propertyStorage();
+
     size_t storageSize = m_structure->propertyStorageSize();
     for (size_t i = 0; i < storageSize; ++i) {
-        JSValuePtr v = m_propertyStorage[i];
+        JSValue v = JSValue::decode(storage[i]);
         if (!v.marked())
             v.mark();
     }
@@ -98,7 +100,7 @@
 }
 
 // ECMA 8.6.2.2
-void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
@@ -108,7 +110,7 @@
         if (!value.isObject() && !value.isNull())
             return;
 
-        JSValuePtr nextPrototypeValue = value;
+        JSValue nextPrototypeValue = value;
         while (nextPrototypeValue && nextPrototypeValue.isObject()) {
             JSObject* nextPrototype = asObject(nextPrototypeValue)->unwrappedObject();
             if (nextPrototype == this) {
@@ -123,21 +125,22 @@
     }
 
     // Check if there are any setters or getters in the prototype chain
-    JSValuePtr prototype;
+    JSValue prototype;
     for (JSObject* obj = this; !obj->structure()->hasGetterSetterProperties(); obj = asObject(prototype)) {
         prototype = obj->prototype();
         if (prototype.isNull()) {
-            putDirect(propertyName, value, 0, true, slot);
+            putDirectInternal(exec->globalData(), propertyName, value, 0, true, slot);
             return;
         }
     }
     
     unsigned attributes;
-    if ((m_structure->get(propertyName, attributes) != WTF::notFound) && attributes & ReadOnly)
+    JSCell* specificValue;
+    if ((m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) && attributes & ReadOnly)
         return;
 
     for (JSObject* obj = this; ; obj = asObject(prototype)) {
-        if (JSValuePtr gs = obj->getDirect(propertyName)) {
+        if (JSValue gs = obj->getDirect(propertyName)) {
             if (gs.isGetterSetter()) {
                 JSObject* setterFunc = asGetterSetter(gs)->setter();        
                 if (!setterFunc) {
@@ -147,7 +150,7 @@
                 
                 CallData callData;
                 CallType callType = setterFunc->getCallData(callData);
-                ArgList args;
+                MarkedArgumentBuffer args;
                 args.append(value);
                 call(exec, setterFunc, callType, callData, this, args);
                 return;
@@ -163,22 +166,27 @@
             break;
     }
 
-    putDirect(propertyName, value, 0, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, value, 0, true, slot);
     return;
 }
 
-void JSObject::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+void JSObject::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     PutPropertySlot slot;
     put(exec, Identifier::from(exec, propertyName), value, slot);
 }
 
-void JSObject::putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
-    putDirect(propertyName, value, attributes);
+    putDirectInternal(exec->globalData(), propertyName, value, attributes, checkReadOnly, slot);
 }
 
-void JSObject::putWithAttributes(ExecState* exec, unsigned propertyName, JSValuePtr value, unsigned attributes)
+void JSObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    putDirectInternal(exec->globalData(), propertyName, value, attributes);
+}
+
+void JSObject::putWithAttributes(ExecState* exec, unsigned propertyName, JSValue value, unsigned attributes)
 {
     putWithAttributes(exec, Identifier::from(exec, propertyName), value, attributes);
 }
@@ -199,7 +207,8 @@
 bool JSObject::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     unsigned attributes;
-    if (m_structure->get(propertyName, attributes) != WTF::notFound) {
+    JSCell* specificValue;
+    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) {
         if ((attributes & DontDelete))
             return false;
         removeDirect(propertyName);
@@ -226,9 +235,9 @@
     return deleteProperty(exec, Identifier::from(exec, propertyName));
 }
 
-static ALWAYS_INLINE JSValuePtr callDefaultValueFunction(ExecState* exec, const JSObject* object, const Identifier& propertyName)
+static ALWAYS_INLINE JSValue callDefaultValueFunction(ExecState* exec, const JSObject* object, const Identifier& propertyName)
 {
-    JSValuePtr function = object->get(exec, propertyName);
+    JSValue function = object->get(exec, propertyName);
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
@@ -239,16 +248,16 @@
     if (exec->hadException())
         return exec->exception();
 
-    JSValuePtr result = call(exec, function, callType, callData, const_cast<JSObject*>(object), exec->emptyList());
+    JSValue result = call(exec, function, callType, callData, const_cast<JSObject*>(object), exec->emptyList());
     ASSERT(!result.isGetterSetter());
     if (exec->hadException())
         return exec->exception();
     if (result.isObject())
-        return noValue();
+        return JSValue();
     return result;
 }
 
-bool JSObject::getPrimitiveNumber(ExecState* exec, double& number, JSValuePtr& result)
+bool JSObject::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result)
 {
     result = defaultValue(exec, PreferNumber);
     number = result.toNumber(exec);
@@ -256,18 +265,18 @@
 }
 
 // ECMA 8.6.2.6
-JSValuePtr JSObject::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue JSObject::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     // Must call toString first for Date objects.
     if ((hint == PreferString) || (hint != PreferNumber && prototype() == exec->lexicalGlobalObject()->datePrototype())) {
-        JSValuePtr value = callDefaultValueFunction(exec, this, exec->propertyNames().toString);
+        JSValue value = callDefaultValueFunction(exec, this, exec->propertyNames().toString);
         if (value)
             return value;
         value = callDefaultValueFunction(exec, this, exec->propertyNames().valueOf);
         if (value)
             return value;
     } else {
-        JSValuePtr value = callDefaultValueFunction(exec, this, exec->propertyNames().valueOf);
+        JSValue value = callDefaultValueFunction(exec, this, exec->propertyNames().valueOf);
         if (value)
             return value;
         value = callDefaultValueFunction(exec, this, exec->propertyNames().toString);
@@ -293,7 +302,7 @@
 
 void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
 {
-    JSValuePtr object = getDirect(propertyName);
+    JSValue object = getDirect(propertyName);
     if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
         asGetterSetter(object)->setGetter(getterFunction);
@@ -302,7 +311,7 @@
 
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter;
-    putDirect(propertyName, getterSetter, None, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, getterSetter, Getter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
@@ -320,7 +329,7 @@
 
 void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
 {
-    JSValuePtr object = getDirect(propertyName);
+    JSValue object = getDirect(propertyName);
     if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
         asGetterSetter(object)->setSetter(setterFunction);
@@ -329,7 +338,7 @@
 
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter;
-    putDirect(propertyName, getterSetter, None, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, getterSetter, Setter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
@@ -345,11 +354,11 @@
     getterSetter->setSetter(setterFunction);
 }
 
-JSValuePtr JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
+JSValue JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
 {
     JSObject* object = this;
     while (true) {
-        if (JSValuePtr value = object->getDirect(propertyName)) {
+        if (JSValue value = object->getDirect(propertyName)) {
             if (!value.isGetterSetter())
                 return jsUndefined();
             JSObject* functionObject = asGetterSetter(value)->getter();
@@ -364,11 +373,11 @@
     }
 }
 
-JSValuePtr JSObject::lookupSetter(ExecState*, const Identifier& propertyName)
+JSValue JSObject::lookupSetter(ExecState*, const Identifier& propertyName)
 {
     JSObject* object = this;
     while (true) {
-        if (JSValuePtr value = object->getDirect(propertyName)) {
+        if (JSValue value = object->getDirect(propertyName)) {
             if (!value.isGetterSetter())
                 return jsUndefined();
             JSObject* functionObject = asGetterSetter(value)->setter();
@@ -383,16 +392,16 @@
     }
 }
 
-bool JSObject::hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr proto)
+bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue proto)
 {
+    if (!value.isObject())
+        return false;
+
     if (!proto.isObject()) {
         throwError(exec, TypeError, "instanceof called on an object with an invalid prototype property.");
         return false;
     }
 
-    if (!value.isObject())
-        return false;
-
     JSObject* object = asObject(value);
     while ((object = object->prototype().getObject())) {
         if (proto == object)
@@ -411,7 +420,8 @@
 
 bool JSObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
 {
-    if (m_structure->get(propertyName, attributes) != WTF::notFound)
+    JSCell* specificValue;
+    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
         return true;
     
     // Look in the static hashtable of properties
@@ -424,6 +434,19 @@
     return false;
 }
 
+bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyName, JSCell*& specificValue) const
+{
+    unsigned attributes;
+    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
+        return true;
+
+    // This could be a function within the static table? - should probably
+    // also look in the hash?  This currently should not be a problem, since
+    // we've currently always call 'get' first, which should have populated
+    // the normal storage.
+    return false;
+}
+
 void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     m_structure->getEnumerablePropertyNames(exec, propertyNames, this);
@@ -436,7 +459,7 @@
 
 double JSObject::toNumber(ExecState* exec) const
 {
-    JSValuePtr primitive = toPrimitive(exec, PreferNumber);
+    JSValue primitive = toPrimitive(exec, PreferNumber);
     if (exec->hadException()) // should be picked up soon in Nodes.cpp
         return 0.0;
     return primitive.toNumber(exec);
@@ -444,7 +467,7 @@
 
 UString JSObject::toString(ExecState* exec) const
 {
-    JSValuePtr primitive = toPrimitive(exec, PreferString);
+    JSValue primitive = toPrimitive(exec, PreferString);
     if (exec->hadException())
         return "";
     return primitive.toString(exec);
@@ -471,27 +494,27 @@
     if (m_structure->isDictionary()) {
         offset = m_structure->removePropertyWithoutTransition(propertyName);
         if (offset != WTF::notFound)
-            m_propertyStorage[offset] = jsUndefined();
+            putDirectOffset(offset, jsUndefined());
         return;
     }
 
     RefPtr<Structure> structure = Structure::removePropertyTransition(m_structure, propertyName, offset);
-    if (offset != WTF::notFound)
-        m_propertyStorage[offset] = jsUndefined();
     setStructure(structure.release());
+    if (offset != WTF::notFound)
+        putDirectOffset(offset, jsUndefined());
 }
 
 void JSObject::putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirect(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunction(Identifier(exec, function->name(&exec->globalData())), function, attr);
 }
 
 void JSObject::putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectWithoutTransition(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunctionWithoutTransition(Identifier(exec, function->name(&exec->globalData())), function, attr);
 }
 
-NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValuePtr* location)
+NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValue* location)
 {
     if (JSObject* getterFunction = asGetterSetter(*location)->getter())
         slot.setGetterSlot(getterFunction);
diff --git a/JavaScriptCore/runtime/JSObject.h b/JavaScriptCore/runtime/JSObject.h
index 20242ce..54805f2 100644
--- a/JavaScriptCore/runtime/JSObject.h
+++ b/JavaScriptCore/runtime/JSObject.h
@@ -32,9 +32,17 @@
 #include "PutPropertySlot.h"
 #include "ScopeChain.h"
 #include "Structure.h"
+#include "JSGlobalData.h"
 
 namespace JSC {
 
+    inline JSCell* getJSFunction(JSGlobalData& globalData, JSValue value)
+    {
+        if (value.isCell() && (value.asCell()->vptr() == globalData.jsFunctionVPtr))
+            return value.asCell();
+        return 0;
+    }
+
     class InternalFunction;
     class PropertyNameArray;
     class Structure;
@@ -49,9 +57,12 @@
         DontEnum     = 1 << 2,  // property doesn't appear in (for .. in ..)
         DontDelete   = 1 << 3,  // property can't be deleted
         Function     = 1 << 4,  // property is a function - only used by static hashtables
+        Getter       = 1 << 5,  // property is a getter
+        Setter       = 1 << 6   // property is a setter
     };
 
-    typedef JSValuePtr* PropertyStorage;
+    typedef EncodedJSValue* PropertyStorage;
+    typedef const EncodedJSValue* ConstPropertyStorage;
 
     class JSObject : public JSCell {
         friend class BatchedTransitionOptimizer;
@@ -69,18 +80,16 @@
 
         bool inherits(const ClassInfo* classInfo) const { return JSCell::isObject(classInfo); }
 
-        JSValuePtr prototype() const;
-        void setPrototype(JSValuePtr prototype);
+        JSValue prototype() const;
+        void setPrototype(JSValue prototype);
         
         void setStructure(PassRefPtr<Structure>);
         Structure* inheritorID();
 
-        PropertyStorage& propertyStorage() { return m_propertyStorage; }
-
         virtual UString className() const;
 
-        JSValuePtr get(ExecState*, const Identifier& propertyName) const;
-        JSValuePtr get(ExecState*, unsigned propertyName) const;
+        JSValue get(ExecState*, const Identifier& propertyName) const;
+        JSValue get(ExecState*, unsigned propertyName) const;
 
         bool getPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         bool getPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
@@ -88,11 +97,12 @@
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
 
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr value);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue value);
 
-        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes);
-        virtual void putWithAttributes(ExecState*, unsigned propertyName, JSValuePtr value, unsigned attributes);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes);
+        virtual void putWithAttributes(ExecState*, unsigned propertyName, JSValue value, unsigned attributes);
 
         bool propertyIsEnumerable(ExecState*, const Identifier& propertyName) const;
 
@@ -103,14 +113,14 @@
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
-        virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+        virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-        virtual bool hasInstance(ExecState*, JSValuePtr, JSValuePtr prototypeProperty);
+        virtual bool hasInstance(ExecState*, JSValue, JSValue prototypeProperty);
 
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -120,34 +130,31 @@
         virtual JSObject* unwrappedObject();
 
         virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
+        bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
 
         // This get function only looks at the property map.
-        JSValuePtr getDirect(const Identifier& propertyName) const
+        JSValue getDirect(const Identifier& propertyName) const
         {
             size_t offset = m_structure->get(propertyName);
-            return offset != WTF::notFound ? m_propertyStorage[offset] : noValue();
+            return offset != WTF::notFound ? getDirectOffset(offset) : JSValue();
         }
 
-        JSValuePtr* getDirectLocation(const Identifier& propertyName)
+        JSValue* getDirectLocation(const Identifier& propertyName)
         {
             size_t offset = m_structure->get(propertyName);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
-        JSValuePtr* getDirectLocation(const Identifier& propertyName, unsigned& attributes)
+        JSValue* getDirectLocation(const Identifier& propertyName, unsigned& attributes)
         {
-            size_t offset = m_structure->get(propertyName, attributes);
+            JSCell* specificFunction;
+            size_t offset = m_structure->get(propertyName, attributes, specificFunction);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
-        size_t offsetForLocation(JSValuePtr* location)
+        size_t offsetForLocation(JSValue* location) const
         {
-            return location - m_propertyStorage;
-        }
-
-        JSValuePtr* locationForOffset(size_t offset)
-        {
-            return &m_propertyStorage[offset];
+            return location - reinterpret_cast<const JSValue*>(propertyStorage());
         }
 
         void transitionTo(Structure*);
@@ -156,22 +163,27 @@
         bool hasCustomProperties() { return !m_structure->isEmpty(); }
         bool hasGetterSetterProperties() { return m_structure->hasGetterSetterProperties(); }
 
-        void putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attr = 0);
-        void putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        void putDirect(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        void putDirect(const Identifier& propertyName, JSValue value, unsigned attr = 0);
+
+        void putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr = 0);
+        void putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
         void putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr = 0);
-        void putDirectWithoutTransition(const Identifier& propertyName, JSValuePtr value, unsigned attr = 0);
+
+        void putDirectWithoutTransition(const Identifier& propertyName, JSValue value, unsigned attr = 0);
+        void putDirectFunctionWithoutTransition(const Identifier& propertyName, JSCell* value, unsigned attr = 0);
         void putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr = 0);
 
         // Fast access to known property offsets.
-        JSValuePtr getDirectOffset(size_t offset) { return m_propertyStorage[offset]; }
-        void putDirectOffset(size_t offset, JSValuePtr value) { m_propertyStorage[offset] = value; }
+        JSValue getDirectOffset(size_t offset) const { return JSValue::decode(propertyStorage()[offset]); }
+        void putDirectOffset(size_t offset, JSValue value) { propertyStorage()[offset] = JSValue::encode(value); }
 
-        void fillGetterPropertySlot(PropertySlot&, JSValuePtr* location);
+        void fillGetterPropertySlot(PropertySlot&, JSValue* location);
 
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction);
-        virtual JSValuePtr lookupGetter(ExecState*, const Identifier& propertyName);
-        virtual JSValuePtr lookupSetter(ExecState*, const Identifier& propertyName);
+        virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
+        virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
 
         virtual bool isGlobalObject() const { return false; }
         virtual bool isVariableObject() const { return false; }
@@ -181,12 +193,12 @@
 
         void allocatePropertyStorage(size_t oldSize, size_t newSize);
         void allocatePropertyStorageInline(size_t oldSize, size_t newSize);
-        bool usingInlineStorage() const { return m_propertyStorage == m_inlineStorage; }
+        bool isUsingInlineStorage() const { return m_structure->isUsingInlineStorage(); }
 
-        static const size_t inlineStorageCapacity = 2;
+        static const size_t inlineStorageCapacity = 3;
         static const size_t nonInlineBaseStorageCapacity = 16;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
         }
@@ -195,6 +207,23 @@
         bool getOwnPropertySlotForWrite(ExecState*, const Identifier&, PropertySlot&, bool& slotIsWriteable);
 
     private:
+        ConstPropertyStorage propertyStorage() const { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
+        PropertyStorage propertyStorage() { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
+
+        const JSValue* locationForOffset(size_t offset) const
+        {
+            return reinterpret_cast<const JSValue*>(&propertyStorage()[offset]);
+        }
+
+        JSValue* locationForOffset(size_t offset)
+        {
+            return reinterpret_cast<JSValue*>(&propertyStorage()[offset]);
+        }
+
+        void putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot, JSCell*);
+        void putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        void putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue value, unsigned attr = 0);
+
         bool inlineGetOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 
         const HashEntry* findPropertyHashEntry(ExecState*, const Identifier& propertyName) const;
@@ -202,15 +231,17 @@
 
         RefPtr<Structure> m_inheritorID;
 
-        PropertyStorage m_propertyStorage;        
-        JSValuePtr m_inlineStorage[inlineStorageCapacity];
+        union {
+            PropertyStorage m_externalStorage;
+            EncodedJSValue m_inlineStorage[inlineStorageCapacity];
+        };
     };
 
-    JSObject* asObject(JSValuePtr);
+    JSObject* asObject(JSValue);
 
     JSObject* constructEmptyObject(ExecState*);
 
-inline JSObject* asObject(JSValuePtr value)
+inline JSObject* asObject(JSValue value)
 {
     ASSERT(asCell(value)->isObject());
     return static_cast<JSObject*>(asCell(value));
@@ -218,7 +249,6 @@
 
 inline JSObject::JSObject(PassRefPtr<Structure> structure)
     : JSCell(structure.releaseRef()) // ~JSObject balances this ref()
-    , m_propertyStorage(m_inlineStorage)
 {
     ASSERT(m_structure);
     ASSERT(m_structure->propertyStorageCapacity() == inlineStorageCapacity);
@@ -229,17 +259,17 @@
 inline JSObject::~JSObject()
 {
     ASSERT(m_structure);
-    if (m_propertyStorage != m_inlineStorage)
-        delete [] m_propertyStorage;
+    if (!isUsingInlineStorage())
+        delete [] m_externalStorage;
     m_structure->deref();
 }
 
-inline JSValuePtr JSObject::prototype() const
+inline JSValue JSObject::prototype() const
 {
     return m_structure->storedPrototype();
 }
 
-inline void JSObject::setPrototype(JSValuePtr prototype)
+inline void JSObject::setPrototype(JSValue prototype)
 {
     ASSERT(prototype);
     RefPtr<Structure> newStructure = Structure::changePrototypeTransition(m_structure, prototype);
@@ -259,6 +289,11 @@
     return createInheritorID();
 }
 
+inline bool Structure::isUsingInlineStorage() const
+{
+    return (propertyStorageCapacity() == JSObject::inlineStorageCapacity);
+}
+
 inline bool JSCell::isObject(const ClassInfo* info) const
 {
     for (const ClassInfo* ci = classInfo(); ci; ci = ci->parentClass) {
@@ -269,14 +304,14 @@
 }
 
 // this method is here to be after the inline declaration of JSCell::isObject
-inline bool JSValuePtr::isObject(const ClassInfo* classInfo) const
+inline bool JSValue::isObject(const ClassInfo* classInfo) const
 {
     return isCell() && asCell()->isObject(classInfo);
 }
 
 ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (JSValuePtr* location = getDirectLocation(propertyName)) {
+    if (JSValue* location = getDirectLocation(propertyName)) {
         if (m_structure->hasGetterSetterProperties() && location[0].isGetterSetter())
             fillGetterPropertySlot(slot, location);
         else
@@ -296,7 +331,7 @@
 ALWAYS_INLINE bool JSObject::getOwnPropertySlotForWrite(ExecState* exec, const Identifier& propertyName, PropertySlot& slot, bool& slotIsWriteable)
 {
     unsigned attributes;
-    if (JSValuePtr* location = getDirectLocation(propertyName, attributes)) {
+    if (JSValue* location = getDirectLocation(propertyName, attributes)) {
         if (m_structure->hasGetterSetterProperties() && location[0].isGetterSetter()) {
             slotIsWriteable = false;
             fillGetterPropertySlot(slot, location);
@@ -340,7 +375,7 @@
     while (true) {
         if (object->fastGetOwnPropertySlot(exec, propertyName, slot))
             return true;
-        JSValuePtr prototype = object->prototype();
+        JSValue prototype = object->prototype();
         if (!prototype.isObject())
             return false;
         object = asObject(prototype);
@@ -353,14 +388,14 @@
     while (true) {
         if (object->getOwnPropertySlot(exec, propertyName, slot))
             return true;
-        JSValuePtr prototype = object->prototype();
+        JSValue prototype = object->prototype();
         if (!prototype.isObject())
             return false;
         object = asObject(prototype);
     }
 }
 
-inline JSValuePtr JSObject::get(ExecState* exec, const Identifier& propertyName) const
+inline JSValue JSObject::get(ExecState* exec, const Identifier& propertyName) const
 {
     PropertySlot slot(this);
     if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
@@ -369,7 +404,7 @@
     return jsUndefined();
 }
 
-inline JSValuePtr JSObject::get(ExecState* exec, unsigned propertyName) const
+inline JSValue JSObject::get(ExecState* exec, unsigned propertyName) const
 {
     PropertySlot slot(this);
     if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
@@ -378,80 +413,139 @@
     return jsUndefined();
 }
 
-inline void JSObject::putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attr)
+inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot, JSCell* specificFunction)
 {
-    PutPropertySlot slot;
-    putDirect(propertyName, value, attr, false, slot);
-}
-
-inline void JSObject::putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
-{
+    ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
     if (m_structure->isDictionary()) {
         unsigned currentAttributes;
-        size_t offset = m_structure->get(propertyName, currentAttributes);
+        JSCell* currentSpecificFunction;
+        size_t offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
         if (offset != WTF::notFound) {
+            if (currentSpecificFunction && (specificFunction != currentSpecificFunction))
+                m_structure->despecifyDictionaryFunction(propertyName);
             if (checkReadOnly && currentAttributes & ReadOnly)
                 return;
-            m_propertyStorage[offset] = value;
-            slot.setExistingProperty(this, offset);
+            putDirectOffset(offset, value);
+            if (!specificFunction && !currentSpecificFunction)
+                slot.setExistingProperty(this, offset);
             return;
         }
 
         size_t currentCapacity = m_structure->propertyStorageCapacity();
-        offset = m_structure->addPropertyWithoutTransition(propertyName, attributes);
+        offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, specificFunction);
         if (currentCapacity != m_structure->propertyStorageCapacity())
             allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
 
         ASSERT(offset < m_structure->propertyStorageCapacity());
-        m_propertyStorage[offset] = value;
-        slot.setNewProperty(this, offset);
+        putDirectOffset(offset, value);
+        // See comment on setNewProperty call below.
+        if (!specificFunction)
+            slot.setNewProperty(this, offset);
         return;
     }
 
     size_t offset;
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    if (RefPtr<Structure> structure = Structure::addPropertyTransitionToExistingStructure(m_structure, propertyName, attributes, offset)) {
+    if (RefPtr<Structure> structure = Structure::addPropertyTransitionToExistingStructure(m_structure, propertyName, attributes, specificFunction, offset)) {    
         if (currentCapacity != structure->propertyStorageCapacity())
             allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
         ASSERT(offset < structure->propertyStorageCapacity());
-        m_propertyStorage[offset] = value;
-        slot.setNewProperty(this, offset);
-        slot.setWasTransition(true);
         setStructure(structure.release());
+        putDirectOffset(offset, value);
+        // See comment on setNewProperty call below.
+        if (!specificFunction)
+            slot.setNewProperty(this, offset);
         return;
     }
 
     unsigned currentAttributes;
-    offset = m_structure->get(propertyName, currentAttributes);
+    JSCell* currentSpecificFunction;
+    offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
     if (offset != WTF::notFound) {
         if (checkReadOnly && currentAttributes & ReadOnly)
             return;
-        m_propertyStorage[offset] = value;
+
+        if (currentSpecificFunction && (specificFunction != currentSpecificFunction)) {
+            setStructure(Structure::despecifyFunctionTransition(m_structure, propertyName));
+            putDirectOffset(offset, value);
+            // Function transitions are not currently cachable, so leave the slot in an uncachable state.
+            return;
+        }
+        putDirectOffset(offset, value);
         slot.setExistingProperty(this, offset);
         return;
     }
 
-    RefPtr<Structure> structure = Structure::addPropertyTransition(m_structure, propertyName, attributes, offset);
+    RefPtr<Structure> structure = Structure::addPropertyTransition(m_structure, propertyName, attributes, specificFunction, offset);
     if (currentCapacity != structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
     ASSERT(offset < structure->propertyStorageCapacity());
-    m_propertyStorage[offset] = value;
-    slot.setNewProperty(this, offset);
-    slot.setWasTransition(true);
     setStructure(structure.release());
+    putDirectOffset(offset, value);
+    // Function transitions are not currently cachable, so leave the slot in an uncachable state.
+    if (!specificFunction)
+        slot.setNewProperty(this, offset);
 }
 
-inline void JSObject::putDirectWithoutTransition(const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+{
+    ASSERT(value);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
+
+    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, getJSFunction(globalData, value));
+}
+
+inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    PutPropertySlot slot;
+    putDirectInternal(propertyName, value, attributes, false, slot, getJSFunction(globalData, value));
+}
+
+inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+{
+    ASSERT(value);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
+
+    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, 0);
+}
+
+inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    PutPropertySlot slot;
+    putDirectInternal(propertyName, value, attributes, false, slot, 0);
+}
+
+inline void JSObject::putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+{
+    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, value);
+}
+
+inline void JSObject::putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr)
+{
+    PutPropertySlot slot;
+    putDirectInternal(propertyName, value, attr, false, slot, value);
+}
+
+inline void JSObject::putDirectWithoutTransition(const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes);
+    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, 0);
     if (currentCapacity != m_structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
-    m_propertyStorage[offset] = value;
+    putDirectOffset(offset, value);
+}
+
+inline void JSObject::putDirectFunctionWithoutTransition(const Identifier& propertyName, JSCell* value, unsigned attributes)
+{
+    size_t currentCapacity = m_structure->propertyStorageCapacity();
+    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, value);
+    if (currentCapacity != m_structure->propertyStorageCapacity())
+        allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
+    putDirectOffset(offset, value);
 }
 
 inline void JSObject::transitionTo(Structure* newStructure)
@@ -461,21 +555,23 @@
     setStructure(newStructure);
 }
 
-inline JSValuePtr JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+inline JSValue JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
 {
     return defaultValue(exec, preferredType);
 }
 
-inline JSValuePtr JSValuePtr::get(ExecState* exec, const Identifier& propertyName) const
+inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName) const
 {
     PropertySlot slot(asValue());
     return get(exec, propertyName, slot);
 }
 
-inline JSValuePtr JSValuePtr::get(ExecState* exec, const Identifier& propertyName, PropertySlot& slot) const
+inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName, PropertySlot& slot) const
 {
     if (UNLIKELY(!isCell())) {
         JSObject* prototype = JSImmediate::prototype(asValue(), exec);
+        if (propertyName == exec->propertyNames().underscoreProto)
+            return prototype;
         if (!prototype->getPropertySlot(exec, propertyName, slot))
             return jsUndefined();
         return slot.getValue(exec, propertyName);
@@ -485,20 +581,20 @@
         if (cell->fastGetOwnPropertySlot(exec, propertyName, slot))
             return slot.getValue(exec, propertyName);
         ASSERT(cell->isObject());
-        JSValuePtr prototype = static_cast<JSObject*>(cell)->prototype();
+        JSValue prototype = static_cast<JSObject*>(cell)->prototype();
         if (!prototype.isObject())
             return jsUndefined();
         cell = asObject(prototype);
     }
 }
 
-inline JSValuePtr JSValuePtr::get(ExecState* exec, unsigned propertyName) const
+inline JSValue JSValue::get(ExecState* exec, unsigned propertyName) const
 {
     PropertySlot slot(asValue());
     return get(exec, propertyName, slot);
 }
 
-inline JSValuePtr JSValuePtr::get(ExecState* exec, unsigned propertyName, PropertySlot& slot) const
+inline JSValue JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot& slot) const
 {
     if (UNLIKELY(!isCell())) {
         JSObject* prototype = JSImmediate::prototype(asValue(), exec);
@@ -511,14 +607,14 @@
         if (cell->getOwnPropertySlot(exec, propertyName, slot))
             return slot.getValue(exec, propertyName);
         ASSERT(cell->isObject());
-        JSValuePtr prototype = static_cast<JSObject*>(cell)->prototype();
+        JSValue prototype = static_cast<JSObject*>(cell)->prototype();
         if (!prototype.isObject())
             return jsUndefined();
         cell = prototype.asCell();
     }
 }
 
-inline void JSValuePtr::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+inline void JSValue::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (UNLIKELY(!isCell())) {
         JSImmediate::toObject(asValue(), exec)->put(exec, propertyName, value, slot);
@@ -527,7 +623,7 @@
     asCell()->put(exec, propertyName, value, slot);
 }
 
-inline void JSValuePtr::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+inline void JSValue::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     if (UNLIKELY(!isCell())) {
         JSImmediate::toObject(asValue(), exec)->put(exec, propertyName, value);
@@ -540,14 +636,20 @@
 {
     ASSERT(newSize > oldSize);
 
-    JSValuePtr* oldPropertyStorage = m_propertyStorage;
-    m_propertyStorage = new JSValuePtr[newSize];
+    // It's important that this function not rely on m_structure, since
+    // we might be in the middle of a transition.
+    bool wasInline = (oldSize == JSObject::inlineStorageCapacity);
+
+    PropertyStorage oldPropertyStorage = (wasInline ? m_inlineStorage : m_externalStorage);
+    PropertyStorage newPropertyStorage = new EncodedJSValue[newSize];
 
     for (unsigned i = 0; i < oldSize; ++i)
-        m_propertyStorage[i] = oldPropertyStorage[i];
+       newPropertyStorage[i] = oldPropertyStorage[i];
 
-    if (oldPropertyStorage != m_inlineStorage)
+    if (!wasInline)
         delete [] oldPropertyStorage;
+
+    m_externalStorage = newPropertyStorage;
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index ec8efea..8c7b53d 100644
--- a/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -37,13 +37,13 @@
 {
 }
 
-JSValuePtr JSPropertyNameIterator::toPrimitive(ExecState*, PreferredPrimitiveType) const
+JSValue JSPropertyNameIterator::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     ASSERT_NOT_REACHED();
-    return noValue();
+    return JSValue();
 }
 
-bool JSPropertyNameIterator::getPrimitiveNumber(ExecState*, double&, JSValuePtr&)
+bool JSPropertyNameIterator::getPrimitiveNumber(ExecState*, double&, JSValue&)
 {
     ASSERT_NOT_REACHED();
     return false;
diff --git a/JavaScriptCore/runtime/JSPropertyNameIterator.h b/JavaScriptCore/runtime/JSPropertyNameIterator.h
index a6d6cd2..9817c07 100644
--- a/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -40,12 +40,12 @@
 
     class JSPropertyNameIterator : public JSCell {
     public:
-        static JSPropertyNameIterator* create(ExecState*, JSValuePtr);
+        static JSPropertyNameIterator* create(ExecState*, JSValue);
 
         virtual ~JSPropertyNameIterator();
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double&, JSValuePtr&);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double&, JSValue&);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -53,7 +53,7 @@
 
         virtual void mark();
 
-        JSValuePtr next(ExecState*);
+        JSValue next(ExecState*);
         void invalidate();
 
     private:
@@ -83,7 +83,7 @@
 {
 }
 
-inline JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSValuePtr v)
+inline JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSValue v)
 {
     if (v.isUndefinedOrNull())
         return new (exec) JSPropertyNameIterator;
@@ -94,12 +94,12 @@
     return new (exec) JSPropertyNameIterator(o, propertyNames.releaseData());
 }
 
-inline JSValuePtr JSPropertyNameIterator::next(ExecState* exec)
+inline JSValue JSPropertyNameIterator::next(ExecState* exec)
 {
     if (m_position == m_end)
-        return noValue();
+        return JSValue();
 
-    if (m_data->cachedStructure() == m_object->structure() && structureChainsAreEqual(m_data->cachedPrototypeChain(), m_object->structure()->cachedPrototypeChain()))
+    if (m_data->cachedStructure() == m_object->structure() && m_data->cachedPrototypeChain() == m_object->structure()->prototypeChain(exec))
         return jsOwnedString(exec, (*m_position++).ustring());
 
     do {
@@ -108,7 +108,7 @@
         m_position++;
     } while (m_position != m_end);
 
-    return noValue();
+    return JSValue();
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSStaticScopeObject.cpp b/JavaScriptCore/runtime/JSStaticScopeObject.cpp
index 4196822..0253fdd 100644
--- a/JavaScriptCore/runtime/JSStaticScopeObject.cpp
+++ b/JavaScriptCore/runtime/JSStaticScopeObject.cpp
@@ -44,7 +44,7 @@
     return exec->globalThisValue();
 }
 
-void JSStaticScopeObject::put(ExecState*, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&)
+void JSStaticScopeObject::put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     if (symbolTablePut(propertyName, value))
         return;
@@ -52,7 +52,7 @@
     ASSERT_NOT_REACHED();
 }
 
-void JSStaticScopeObject::putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSStaticScopeObject::putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     if (symbolTablePutWithAttributes(propertyName, value, attributes))
         return;
diff --git a/JavaScriptCore/runtime/JSStaticScopeObject.h b/JavaScriptCore/runtime/JSStaticScopeObject.h
index e1400b7..7e7ce65 100644
--- a/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -43,7 +43,7 @@
         };
         
     public:
-        JSStaticScopeObject(ExecState* exec, const Identifier& ident, JSValuePtr value, unsigned attributes)
+        JSStaticScopeObject(ExecState* exec, const Identifier& ident, JSValue value, unsigned attributes)
             : JSVariableObject(exec->globalData().staticScopeStructure, new JSStaticScopeObjectData())
         {
             d()->registerStore = value;
@@ -55,10 +55,10 @@
         virtual JSObject* toThisObject(ExecState*) const;
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&, bool& slotIsWriteable);
-        virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
-        void putWithAttributes(ExecState*, const Identifier&, JSValuePtr, unsigned attributes);
+        virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+        void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
 
     private:
         JSStaticScopeObjectData* d() { return static_cast<JSStaticScopeObjectData*>(JSVariableObject::d); }
diff --git a/JavaScriptCore/runtime/JSString.cpp b/JavaScriptCore/runtime/JSString.cpp
index 48391de..86f95e0 100644
--- a/JavaScriptCore/runtime/JSString.cpp
+++ b/JavaScriptCore/runtime/JSString.cpp
@@ -30,12 +30,12 @@
 
 namespace JSC {
 
-JSValuePtr JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
+JSValue JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     return const_cast<JSString*>(this);
 }
 
-bool JSString::getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value)
+bool JSString::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
 {
     value = this;
     number = m_value.toDouble();
@@ -88,9 +88,13 @@
     // This function should only be called by JSValue::get.
     if (getStringPropertySlot(exec, propertyName, slot))
         return true;
+    if (propertyName == exec->propertyNames().underscoreProto) {
+        slot.setValue(exec->lexicalGlobalObject()->stringPrototype());
+        return true;
+    }
     slot.setBase(this);
     JSObject* object;
-    for (JSValuePtr prototype = exec->lexicalGlobalObject()->stringPrototype(); !prototype.isNull(); prototype = object->prototype()) {
+    for (JSValue prototype = exec->lexicalGlobalObject()->stringPrototype(); !prototype.isNull(); prototype = object->prototype()) {
         object = asObject(prototype);
         if (object->getOwnPropertySlot(exec, propertyName, slot))
             return true;
diff --git a/JavaScriptCore/runtime/JSString.h b/JavaScriptCore/runtime/JSString.h
index 7398d50..900c565 100644
--- a/JavaScriptCore/runtime/JSString.h
+++ b/JavaScriptCore/runtime/JSString.h
@@ -90,7 +90,7 @@
         bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
         JSString* getIndex(JSGlobalData*, unsigned);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion)); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
@@ -99,8 +99,8 @@
         {
         }
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual JSObject* toObject(ExecState*) const;
@@ -117,9 +117,9 @@
         UString m_value;
     };
 
-    JSString* asString(JSValuePtr);
+    JSString* asString(JSValue);
 
-    inline JSString* asString(JSValuePtr value)
+    inline JSString* asString(JSValue value)
     {
         ASSERT(asCell(value)->isString());
         return static_cast<JSString*>(asCell(value));
@@ -202,11 +202,11 @@
         return false;
     }
 
-    inline bool isJSString(JSGlobalData* globalData, JSValuePtr v) { return v.isCell() && v.asCell()->vptr() == globalData->jsStringVPtr; }
+    inline bool isJSString(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsStringVPtr; }
 
     // --- JSValue inlines ----------------------------
 
-    inline JSString* JSValuePtr::toThisJSString(ExecState* exec)
+    inline JSString* JSValue::toThisJSString(ExecState* exec)
     {
         return JSImmediate::isImmediate(asValue()) ? jsString(exec, JSImmediate::toString(asValue())) : asCell()->toThisJSString(exec);
     }
diff --git a/JavaScriptCore/runtime/JSValue.cpp b/JavaScriptCore/runtime/JSValue.cpp
index f549bff..885914d 100644
--- a/JavaScriptCore/runtime/JSValue.cpp
+++ b/JavaScriptCore/runtime/JSValue.cpp
@@ -31,7 +31,7 @@
 static const double D32 = 4294967296.0;
 
 // ECMA 9.4
-double JSValuePtr::toInteger(ExecState* exec) const
+double JSValue::toInteger(ExecState* exec) const
 {
     if (isInt32Fast())
         return getInt32Fast();
@@ -39,7 +39,7 @@
     return isnan(d) ? 0.0 : trunc(d);
 }
 
-double JSValuePtr::toIntegerPreserveNaN(ExecState* exec) const
+double JSValue::toIntegerPreserveNaN(ExecState* exec) const
 {
     if (isInt32Fast())
         return getInt32Fast();
diff --git a/JavaScriptCore/runtime/JSValue.h b/JavaScriptCore/runtime/JSValue.h
index 1172a1b..391425c 100644
--- a/JavaScriptCore/runtime/JSValue.h
+++ b/JavaScriptCore/runtime/JSValue.h
@@ -28,11 +28,15 @@
 
 #include "CallData.h"
 #include "ConstructData.h"
+#include <wtf/HashTraits.h>
+#include <wtf/AlwaysInline.h>
 
 namespace JSC {
 
     class Identifier;
     class JSCell;
+    class JSGlobalData;
+    class JSImmediate;
     class JSObject;
     class JSString;
     class PropertySlot;
@@ -44,15 +48,15 @@
 
     enum PreferredPrimitiveType { NoPreference, PreferNumber, PreferString };
 
-    class JSImmediate;
-    class JSValueEncodedAsPointer;
+    typedef void* EncodedJSValue;
 
-    class JSValuePtr {
+    class JSValue {
         friend class JSImmediate;
+        friend struct JSValueHashTraits;
 
-        static JSValuePtr makeImmediate(intptr_t value)
+        static JSValue makeImmediate(intptr_t value)
         {
-            return JSValuePtr(reinterpret_cast<JSCell*>(value));
+            return JSValue(reinterpret_cast<JSCell*>(value));
         }
 
         intptr_t immediateValue()
@@ -61,45 +65,49 @@
         }
         
     public:
-        JSValuePtr()
-            : m_ptr(0)
-        {
-        }
+        enum JSNullTag { JSNull };
+        enum JSUndefinedTag { JSUndefined };
+        enum JSTrueTag { JSTrue };
+        enum JSFalseTag { JSFalse };
 
-        JSValuePtr(JSCell* ptr)
-            : m_ptr(ptr)
-        {
-        }
+        static EncodedJSValue encode(JSValue value);
+        static JSValue decode(EncodedJSValue ptr);
 
-        JSValuePtr(const JSCell* ptr)
-            : m_ptr(const_cast<JSCell*>(ptr))
-        {
-        }
+        JSValue();
+        JSValue(JSNullTag);
+        JSValue(JSUndefinedTag);
+        JSValue(JSTrueTag);
+        JSValue(JSFalseTag);
+        JSValue(JSCell* ptr);
+        JSValue(const JSCell* ptr);
 
-        operator bool() const
-        {
-            return m_ptr;
-        }
+        // Numbers
+        JSValue(ExecState*, double);
+        JSValue(ExecState*, char);
+        JSValue(ExecState*, unsigned char);
+        JSValue(ExecState*, short);
+        JSValue(ExecState*, unsigned short);
+        JSValue(ExecState*, int);
+        JSValue(ExecState*, unsigned);
+        JSValue(ExecState*, long);
+        JSValue(ExecState*, unsigned long);
+        JSValue(ExecState*, long long);
+        JSValue(ExecState*, unsigned long long);
+        JSValue(JSGlobalData*, double);
+        JSValue(JSGlobalData*, char);
+        JSValue(JSGlobalData*, unsigned char);
+        JSValue(JSGlobalData*, short);
+        JSValue(JSGlobalData*, unsigned short);
+        JSValue(JSGlobalData*, int);
+        JSValue(JSGlobalData*, unsigned);
+        JSValue(JSGlobalData*, long);
+        JSValue(JSGlobalData*, unsigned long);
+        JSValue(JSGlobalData*, long long);
+        JSValue(JSGlobalData*, unsigned long long);
 
-        bool operator==(const JSValuePtr other) const
-        {
-            return m_ptr == other.m_ptr;
-        }
-
-        bool operator!=(const JSValuePtr other) const
-        {
-            return m_ptr != other.m_ptr;
-        }
-
-        static JSValueEncodedAsPointer* encode(JSValuePtr value)
-        {
-            return reinterpret_cast<JSValueEncodedAsPointer*>(value.m_ptr);
-        }
-
-        static JSValuePtr decode(JSValueEncodedAsPointer* ptr)
-        {
-            return JSValuePtr(reinterpret_cast<JSCell*>(ptr));
-        }
+        operator bool() const;
+        bool operator==(const JSValue other) const;
+        bool operator!=(const JSValue other) const;
 
         // Querying the type.
         bool isUndefined() const;
@@ -130,15 +138,15 @@
         bool getTruncatedUInt32(uint32_t&) const;
         
         // Basic conversions.
-        JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
-        bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr&);
+        JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
+        bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
 
         bool toBoolean(ExecState*) const;
 
         // toNumber conversion is expected to be side effect free if an exception has
         // been set in the ExecState already.
         double toNumber(ExecState*) const;
-        JSValuePtr toJSNumber(ExecState*) const; // Fast path for when you expect that the value is an immediate number.
+        JSValue toJSNumber(ExecState*) const; // Fast path for when you expect that the value is an immediate number.
         UString toString(ExecState*) const;
         JSObject* toObject(ExecState*) const;
 
@@ -161,44 +169,50 @@
         int32_t getInt32Fast() const;
         bool isUInt32Fast() const;
         uint32_t getUInt32Fast() const;
-        static JSValuePtr makeInt32Fast(int32_t);
-        static bool areBothInt32Fast(JSValuePtr, JSValuePtr);
+        static JSValue makeInt32Fast(int32_t);
+        static bool areBothInt32Fast(JSValue, JSValue);
 
         // Floating point conversions (this is a convenience method for webcore;
         // signle precision float is not a representation used in JS or JSC).
         float toFloat(ExecState* exec) const { return static_cast<float>(toNumber(exec)); }
 
+        // API Mangled Numbers
+        bool isAPIMangledNumber();
+
         // Garbage collection.
         void mark();
         bool marked() const;
 
         // Object operations, with the toObject operation included.
-        JSValuePtr get(ExecState*, const Identifier& propertyName) const;
-        JSValuePtr get(ExecState*, const Identifier& propertyName, PropertySlot&) const;
-        JSValuePtr get(ExecState*, unsigned propertyName) const;
-        JSValuePtr get(ExecState*, unsigned propertyName, PropertySlot&) const;
-        void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        void put(ExecState*, unsigned propertyName, JSValuePtr);
+        JSValue get(ExecState*, const Identifier& propertyName) const;
+        JSValue get(ExecState*, const Identifier& propertyName, PropertySlot&) const;
+        JSValue get(ExecState*, unsigned propertyName) const;
+        JSValue get(ExecState*, unsigned propertyName, PropertySlot&) const;
+        void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        void put(ExecState*, unsigned propertyName, JSValue);
 
         bool needsThisConversion() const;
         JSObject* toThisObject(ExecState*) const;
         UString toThisString(ExecState*) const;
         JSString* toThisJSString(ExecState*);
 
-        static bool equal(ExecState* exec, JSValuePtr v1, JSValuePtr v2);
-        static bool equalSlowCase(ExecState* exec, JSValuePtr v1, JSValuePtr v2);
-        static bool equalSlowCaseInline(ExecState* exec, JSValuePtr v1, JSValuePtr v2);
-        static bool strictEqual(JSValuePtr v1, JSValuePtr v2);
-        static bool strictEqualSlowCase(JSValuePtr v1, JSValuePtr v2);
-        static bool strictEqualSlowCaseInline(JSValuePtr v1, JSValuePtr v2);
+        static bool equal(ExecState* exec, JSValue v1, JSValue v2);
+        static bool equalSlowCase(ExecState* exec, JSValue v1, JSValue v2);
+        static bool equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2);
+        static bool strictEqual(JSValue v1, JSValue v2);
+        static bool strictEqualSlowCase(JSValue v1, JSValue v2);
+        static bool strictEqualSlowCaseInline(JSValue v1, JSValue v2);
 
-        JSValuePtr getJSNumber(); // noValue() if this is not a JSNumber or number object
+        JSValue getJSNumber(); // JSValue() if this is not a JSNumber or number object
 
         bool isCell() const;
         JSCell* asCell() const;
 
     private:
-        inline const JSValuePtr asValue() const { return *this; }
+        enum HashTableDeletedValueTag { HashTableDeletedValue };
+        JSValue(HashTableDeletedValueTag);
+
+        inline const JSValue asValue() const { return *this; }
 
         bool isDoubleNumber() const;
         double getDoubleNumber() const;
@@ -206,16 +220,200 @@
         JSCell* m_ptr;
     };
 
-    inline JSValuePtr noValue()
+    struct JSValueHashTraits : HashTraits<EncodedJSValue> {
+        static void constructDeletedValue(EncodedJSValue& slot) { slot = JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
+        static bool isDeletedValue(EncodedJSValue value) { return value == JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
+    };
+
+    // Stand-alone helper functions.
+    inline JSValue jsNull()
     {
-        return JSValuePtr();
+        return JSValue(JSValue::JSNull);
     }
 
-    inline bool operator==(const JSValuePtr a, const JSCell* b) { return a == JSValuePtr(b); }
-    inline bool operator==(const JSCell* a, const JSValuePtr b) { return JSValuePtr(a) == b; }
+    inline JSValue jsUndefined()
+    {
+        return JSValue(JSValue::JSUndefined);
+    }
 
-    inline bool operator!=(const JSValuePtr a, const JSCell* b) { return a != JSValuePtr(b); }
-    inline bool operator!=(const JSCell* a, const JSValuePtr b) { return JSValuePtr(a) != b; }
+    inline JSValue jsBoolean(bool b)
+    {
+        return b ? JSValue(JSValue::JSTrue) : JSValue(JSValue::JSFalse);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, double d)
+    {
+        return JSValue(exec, d);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, char i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned char i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, short i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned short i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, int i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, long i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned long i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, long long i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned long long i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, double d)
+    {
+        return JSValue(globalData, d);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, char i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned char i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, short i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned short i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, int i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, long i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned long i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, long long i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned long long i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    inline bool operator==(const JSValue a, const JSCell* b) { return a == JSValue(b); }
+    inline bool operator==(const JSCell* a, const JSValue b) { return JSValue(a) == b; }
+
+    inline bool operator!=(const JSValue a, const JSCell* b) { return a != JSValue(b); }
+    inline bool operator!=(const JSCell* a, const JSValue b) { return JSValue(a) != b; }
+
+    // JSValue member functions.
+    inline EncodedJSValue JSValue::encode(JSValue value)
+    {
+        return reinterpret_cast<EncodedJSValue>(value.m_ptr);
+    }
+
+    inline JSValue JSValue::decode(EncodedJSValue ptr)
+    {
+        return JSValue(reinterpret_cast<JSCell*>(ptr));
+    }
+
+    // 0x0 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x0, which is in the (invalid) zero page.
+    inline JSValue::JSValue()
+        : m_ptr(0)
+    {
+    }
+
+    // 0x4 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x4, which is in the (invalid) zero page.
+    inline JSValue::JSValue(HashTableDeletedValueTag)
+        : m_ptr(reinterpret_cast<JSCell*>(0x4))
+    {
+    }
+
+    inline JSValue::JSValue(JSCell* ptr)
+        : m_ptr(ptr)
+    {
+    }
+
+    inline JSValue::JSValue(const JSCell* ptr)
+        : m_ptr(const_cast<JSCell*>(ptr))
+    {
+    }
+
+    inline JSValue::operator bool() const
+    {
+        return m_ptr;
+    }
+
+    inline bool JSValue::operator==(const JSValue other) const
+    {
+        return m_ptr == other.m_ptr;
+    }
+
+    inline bool JSValue::operator!=(const JSValue other) const
+    {
+        return m_ptr != other.m_ptr;
+    }
+
+    inline bool JSValue::isUndefined() const
+    {
+        return asValue() == jsUndefined();
+    }
+
+    inline bool JSValue::isNull() const
+    {
+        return asValue() == jsNull();
+    }
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/JSVariableObject.h b/JavaScriptCore/runtime/JSVariableObject.h
index 9bf5c4f..b969da5 100644
--- a/JavaScriptCore/runtime/JSVariableObject.h
+++ b/JavaScriptCore/runtime/JSVariableObject.h
@@ -46,7 +46,7 @@
     public:
         SymbolTable& symbolTable() const { return *d->symbolTable; }
 
-        virtual void putWithAttributes(ExecState*, const Identifier&, JSValuePtr, unsigned attributes) = 0;
+        virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes) = 0;
 
         virtual bool deleteProperty(ExecState*, const Identifier&);
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
@@ -90,8 +90,8 @@
 
         bool symbolTableGet(const Identifier&, PropertySlot&);
         bool symbolTableGet(const Identifier&, PropertySlot&, bool& slotIsWriteable);
-        bool symbolTablePut(const Identifier&, JSValuePtr);
-        bool symbolTablePutWithAttributes(const Identifier&, JSValuePtr, unsigned attributes);
+        bool symbolTablePut(const Identifier&, JSValue);
+        bool symbolTablePutWithAttributes(const Identifier&, JSValue, unsigned attributes);
 
         JSVariableObjectData* d;
     };
@@ -117,7 +117,7 @@
         return false;
     }
 
-    inline bool JSVariableObject::symbolTablePut(const Identifier& propertyName, JSValuePtr value)
+    inline bool JSVariableObject::symbolTablePut(const Identifier& propertyName, JSValue value)
     {
         ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -130,7 +130,7 @@
         return true;
     }
 
-    inline bool JSVariableObject::symbolTablePutWithAttributes(const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+    inline bool JSVariableObject::symbolTablePutWithAttributes(const Identifier& propertyName, JSValue value, unsigned attributes)
     {
         ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
diff --git a/JavaScriptCore/runtime/JSWrapperObject.h b/JavaScriptCore/runtime/JSWrapperObject.h
index 7381128..2a2e3c6 100644
--- a/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/JavaScriptCore/runtime/JSWrapperObject.h
@@ -33,22 +33,21 @@
         explicit JSWrapperObject(PassRefPtr<Structure>);
 
     public:
-        JSValuePtr internalValue() const { return m_internalValue; }
-        void setInternalValue(JSValuePtr);
+        JSValue internalValue() const { return m_internalValue; }
+        void setInternalValue(JSValue);
         
         virtual void mark();
         
     private:
-        JSValuePtr m_internalValue;
+        JSValue m_internalValue;
     };
     
     inline JSWrapperObject::JSWrapperObject(PassRefPtr<Structure> structure)
         : JSObject(structure)
-        , m_internalValue(noValue())
     {
     }
     
-    inline void JSWrapperObject::setInternalValue(JSValuePtr value)
+    inline void JSWrapperObject::setInternalValue(JSValue value)
     {
         ASSERT(value);
         ASSERT(!value.isObject());
diff --git a/JavaScriptCore/runtime/LiteralParser.cpp b/JavaScriptCore/runtime/LiteralParser.cpp
new file mode 100644
index 0000000..10f9a13
--- /dev/null
+++ b/JavaScriptCore/runtime/LiteralParser.cpp
@@ -0,0 +1,306 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LiteralParser.h"
+
+#include "JSArray.h"
+#include "JSString.h"
+#include <wtf/ASCIICType.h>
+
+namespace JSC {
+
+class LiteralParser::StackGuard {
+public:
+    StackGuard(LiteralParser* parser) 
+        : m_parser(parser)
+    {
+        m_parser->m_depth++;
+    }
+    ~StackGuard()
+    {
+        m_parser->m_depth--;
+    }
+    bool isSafe() { return m_parser->m_depth < 10; }
+private:
+    LiteralParser* m_parser;
+};
+
+static bool isSafeStringCharacter(UChar c)
+{
+    return (c >= ' ' && c <= 0xff && c != '\\') || c == '\t';
+}
+
+LiteralParser::TokenType LiteralParser::Lexer::lex(LiteralParserToken& token)
+{
+    while (m_ptr < m_end && isASCIISpace(*m_ptr))
+        ++m_ptr;
+
+    ASSERT(m_ptr <= m_end);
+    if (m_ptr >= m_end) {
+        token.type = TokEnd;
+        token.start = token.end = m_ptr;
+        return TokEnd;
+    }
+    token.type = TokError;
+    token.start = m_ptr;
+    switch (*m_ptr) {
+        case '[':
+            token.type = TokLBracket;
+            token.end = ++m_ptr;
+            return TokLBracket;
+        case ']':
+            token.type = TokRBracket;
+            token.end = ++m_ptr;
+            return TokRBracket;
+        case '(':
+            token.type = TokLParen;
+            token.end = ++m_ptr;
+            return TokLBracket;
+        case ')':
+            token.type = TokRParen;
+            token.end = ++m_ptr;
+            return TokRBracket;
+        case '{':
+            token.type = TokLBrace;
+            token.end = ++m_ptr;
+            return TokLBrace;
+        case '}':
+            token.type = TokRBrace;
+            token.end = ++m_ptr;
+            return TokRBrace;
+        case ',':
+            token.type = TokComma;
+            token.end = ++m_ptr;
+            return TokComma;
+        case ':':
+            token.type = TokColon;
+            token.end = ++m_ptr;
+            return TokColon;
+        case '"':
+            return lexString(token);
+
+        case '-':
+        case '0':
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9':
+            return lexNumber(token);
+    }
+    return TokError;
+}
+
+LiteralParser::TokenType LiteralParser::Lexer::lexString(LiteralParserToken& token)
+{
+    ++m_ptr;
+    while (m_ptr < m_end && isSafeStringCharacter(*m_ptr) && *m_ptr != '"')
+        ++m_ptr;
+    if (m_ptr >= m_end || *m_ptr != '"') {
+        token.type = TokError;
+        token.end = ++m_ptr;
+        return TokError;
+    }
+    token.type = TokString;
+    token.end = ++m_ptr;
+    return TokString;
+}
+
+LiteralParser::TokenType LiteralParser::Lexer::lexNumber(LiteralParserToken& token)
+{
+    // ES5 and json.org define numbers as
+    // number
+    //     int
+    //     int frac? exp?
+    //
+    // int
+    //     -? 0
+    //     -? digit1-9 digits?
+    //
+    // digits
+    //     digit digits?
+    //
+    // -?(0 | [1-9][0-9]*) ('.' [0-9]+)? ([eE][+-]? [0-9]+)?
+
+    if (m_ptr < m_end && *m_ptr == '-') // -?
+        ++m_ptr;
+    
+    // (0 | [1-9][0-9]*)
+    if (m_ptr < m_end && *m_ptr == '0') // 0
+        ++m_ptr;
+    else if (m_ptr < m_end && *m_ptr >= '1' && *m_ptr <= '9') { // [1-9]
+        ++m_ptr;
+        // [0-9]*
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    } else
+        return TokError;
+
+    // ('.' [0-9]+)?
+    if (m_ptr < m_end && *m_ptr == '.') {
+        ++m_ptr;
+        // [0-9]+
+        if (m_ptr >= m_end && !isASCIIDigit(*m_ptr))
+            return TokError;
+
+        ++m_ptr;
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    }
+
+    //  ([eE][+-]? [0-9]+)?
+    if (m_ptr < m_end && (*m_ptr == 'e' || *m_ptr == 'E')) { // [eE]
+        ++m_ptr;
+
+        // [-+]?
+        if (m_ptr < m_end && (*m_ptr == '-' || *m_ptr == '+'))
+            ++m_ptr;
+
+        // [0-9]+
+        if (m_ptr >= m_end && !isASCIIDigit(*m_ptr))
+            return TokError;
+        
+        ++m_ptr;
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    }
+    
+    token.type = TokNumber;
+    token.end = m_ptr;
+    return TokNumber;
+}
+
+JSValue LiteralParser::parseStatement()
+{
+    StackGuard guard(this);
+    if (!guard.isSafe())
+        return abortParse();
+
+    switch (m_lexer.currentToken().type) {
+        case TokLBracket:
+        case TokNumber:
+        case TokString:
+            return parseExpression();
+        case TokLParen: {
+            m_lexer.next();
+            JSValue result = parseExpression();
+            if (m_aborted || m_lexer.currentToken().type != TokRParen)
+                return abortParse();
+            m_lexer.next();
+            return result;
+        }
+        default:
+            return abortParse();
+    }
+}
+
+JSValue LiteralParser::parseExpression()
+{
+    StackGuard guard(this);
+    if (!guard.isSafe())
+        return abortParse();
+    switch (m_lexer.currentToken().type) {
+        case TokLBracket:
+            return parseArray();
+        case TokLBrace:
+            return parseObject();
+        case TokString: {
+            Lexer::LiteralParserToken stringToken = m_lexer.currentToken();
+            m_lexer.next();
+            return jsString(m_exec, UString(stringToken.start + 1, stringToken.end - stringToken.start - 2));
+        }
+        case TokNumber: {
+            Lexer::LiteralParserToken numberToken = m_lexer.currentToken();
+            m_lexer.next();
+            return jsNumber(m_exec, UString(numberToken.start, numberToken.end - numberToken.start).toDouble());
+        }
+        default:
+            return JSValue();
+    }
+}
+
+JSValue LiteralParser::parseArray()
+{
+    StackGuard guard(this);
+    if (!guard.isSafe())
+        return abortParse();
+    JSArray* array = constructEmptyArray(m_exec);
+    while (true) {
+        m_lexer.next();
+        JSValue value = parseExpression();
+        if (m_aborted)
+            return JSValue();
+        if (!value)
+            break;
+        array->push(m_exec, value);
+
+        if (m_lexer.currentToken().type != TokComma)
+            break;
+    }
+    if (m_lexer.currentToken().type != TokRBracket)
+        return abortParse();
+
+    m_lexer.next();
+    return array;
+}
+
+JSValue LiteralParser::parseObject()
+{
+    StackGuard guard(this);
+    if (!guard.isSafe())
+        return abortParse();
+    JSObject* object = constructEmptyObject(m_exec);
+    
+    while (m_lexer.next() == TokString) {
+        Lexer::LiteralParserToken identifierToken = m_lexer.currentToken();
+        
+        // Check for colon
+        if (m_lexer.next() != TokColon)
+            return abortParse();
+        m_lexer.next();
+        
+        JSValue value = parseExpression();
+        if (!value || m_aborted)
+            return abortParse();
+        
+        Identifier ident(m_exec, identifierToken.start + 1, identifierToken.end - identifierToken.start - 2);
+        object->putDirect(ident, value);
+        
+        if (m_lexer.currentToken().type != TokComma)
+            break;
+    }
+    
+    if (m_lexer.currentToken().type != TokRBrace)
+        return abortParse();
+    m_lexer.next();
+    return object;
+}
+
+}
diff --git a/JavaScriptCore/runtime/LiteralParser.h b/JavaScriptCore/runtime/LiteralParser.h
new file mode 100644
index 0000000..a72e3d0
--- /dev/null
+++ b/JavaScriptCore/runtime/LiteralParser.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LiteralParser_h
+#define LiteralParser_h
+
+#include "JSGlobalObjectFunctions.h"
+#include "JSValue.h"
+#include "UString.h"
+
+namespace JSC {
+
+    class LiteralParser {
+    public:
+        LiteralParser(ExecState* exec, const UString& s)
+            : m_exec(exec)
+            , m_lexer(s)
+            , m_depth(0)
+            , m_aborted(false)
+        {
+        }
+        
+        JSValue tryLiteralParse()
+        {
+            m_lexer.next();
+            JSValue result = parseStatement();
+            if (m_aborted || m_lexer.currentToken().type != TokEnd)
+                return JSValue();
+            return result;
+        }
+    private:
+        
+        enum TokenType { TokLBracket, TokRBracket, TokLBrace, TokRBrace, 
+                         TokString, TokIdentifier, TokNumber, TokColon, 
+                         TokLParen, TokRParen, TokComma, TokEnd, TokError };
+
+        class Lexer {
+        public:
+            struct LiteralParserToken {
+                TokenType type;
+                const UChar* start;
+                const UChar* end;
+            };
+            Lexer(const UString& s)
+                : m_string(s)
+                , m_ptr(s.data())
+                , m_end(s.data() + s.size())
+            {
+            }
+            
+            TokenType next()
+            {
+                return lex(m_currentToken);
+            }
+            
+            const LiteralParserToken& currentToken()
+            {
+                return m_currentToken;
+            }
+            
+        private:
+            TokenType lex(LiteralParserToken&);
+            TokenType lexString(LiteralParserToken&);
+            TokenType lexNumber(LiteralParserToken&);
+            LiteralParserToken m_currentToken;
+            UString m_string;
+            const UChar* m_ptr;
+            const UChar* m_end;
+        };
+        
+        class StackGuard;
+        JSValue parseStatement();
+        JSValue parseExpression();
+        JSValue parseArray();
+        JSValue parseObject();
+
+        JSValue abortParse()
+        {
+            m_aborted = true;
+            return JSValue();
+        }
+
+        ExecState* m_exec;
+        LiteralParser::Lexer m_lexer;
+        int m_depth;
+        bool m_aborted;
+    };
+}
+
+#endif
diff --git a/JavaScriptCore/runtime/Lookup.cpp b/JavaScriptCore/runtime/Lookup.cpp
index 98133a8..8359ff7 100644
--- a/JavaScriptCore/runtime/Lookup.cpp
+++ b/JavaScriptCore/runtime/Lookup.cpp
@@ -20,25 +20,13 @@
 #include "config.h"
 #include "Lookup.h"
 
+#include "JSFunction.h"
 #include "PrototypeFunction.h"
 
 namespace JSC {
 
 void HashTable::createTable(JSGlobalData* globalData) const
 {
-#if ENABLE(PERFECT_HASH_SIZE)
-    ASSERT(!table);
-    HashEntry* entries = new HashEntry[hashSizeMask + 1];
-    for (int i = 0; i <= hashSizeMask; ++i)
-        entries[i].setKey(0);
-    for (int i = 0; values[i].key; ++i) {
-        UString::Rep* identifier = Identifier::add(globalData, values[i].key).releaseRef();
-        int hashIndex = identifier->computedHash() & hashSizeMask;
-        ASSERT(!entries[hashIndex].key());
-        entries[hashIndex].initialize(identifier, values[i].attributes, values[i].value1, values[i].value2);
-    }
-    table = entries;
-#else
     ASSERT(!table);
     int linkIndex = compactHashSizeMask + 1;
     HashEntry* entries = new HashEntry[compactSize];
@@ -61,17 +49,12 @@
         entry->initialize(identifier, values[i].attributes, values[i].value1, values[i].value2);
     }
     table = entries;
-#endif
 }
 
 void HashTable::deleteTable() const
 {
     if (table) {
-#if ENABLE(PERFECT_HASH_SIZE)
-        int max = hashSizeMask + 1;
-#else
         int max = compactSize;
-#endif
         for (int i = 0; i != max; ++i) {
             if (UString::Rep* key = table[i].key())
                 key->deref();
@@ -84,11 +67,12 @@
 void setUpStaticFunctionSlot(ExecState* exec, const HashEntry* entry, JSObject* thisObj, const Identifier& propertyName, PropertySlot& slot)
 {
     ASSERT(entry->attributes() & Function);
-    JSValuePtr* location = thisObj->getDirectLocation(propertyName);
+    JSValue* location = thisObj->getDirectLocation(propertyName);
 
     if (!location) {
-        PrototypeFunction* function = new (exec) PrototypeFunction(exec, entry->functionLength(), propertyName, entry->function());
-        thisObj->putDirect(propertyName, function, entry->attributes());
+        InternalFunction* function = new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), entry->functionLength(), propertyName, entry->function());
+
+        thisObj->putDirectFunction(propertyName, function, entry->attributes());
         location = thisObj->getDirectLocation(propertyName);
     }
 
diff --git a/JavaScriptCore/runtime/Lookup.h b/JavaScriptCore/runtime/Lookup.h
index 55c3221..3b7353d 100644
--- a/JavaScriptCore/runtime/Lookup.h
+++ b/JavaScriptCore/runtime/Lookup.h
@@ -23,17 +23,12 @@
 
 #include "CallFrame.h"
 #include "Identifier.h"
-#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
 #include "PropertySlot.h"
 #include <stdio.h>
 #include <wtf/Assertions.h>
 
-// Set ENABLE_PERFECT_HASH_SIZE to 0 to save memory at the
-// cost of speed.  Test your platform as results may vary.
-#define ENABLE_PERFECT_HASH_SIZE 1
-
 namespace JSC {
 
     // Hash table generated by the create_hash_table script.
@@ -45,9 +40,9 @@
     };
 
     // FIXME: There is no reason this get function can't be simpler.
-    // ie. typedef JSValuePtr (*GetFunction)(ExecState*, JSObject* baseObject)
+    // ie. typedef JSValue (*GetFunction)(ExecState*, JSObject* baseObject)
     typedef PropertySlot::GetValueFunc GetFunction;
-    typedef void (*PutFunction)(ExecState*, JSObject* baseObject, JSValuePtr value);
+    typedef void (*PutFunction)(ExecState*, JSObject* baseObject, JSValue value);
 
     class HashEntry {
     public:
@@ -57,9 +52,7 @@
             m_attributes = attributes;
             m_u.store.value1 = v1;
             m_u.store.value2 = v2;
-#if !ENABLE(PERFECT_HASH_SIZE)
             m_next = 0;
-#endif
         }
 
         void setKey(UString::Rep* key) { m_key = key; }
@@ -75,10 +68,8 @@
 
         intptr_t lexerValue() const { ASSERT(!m_attributes); return m_u.lexer.value; }
 
-#if !ENABLE(PERFECT_HASH_SIZE)
         void setNext(HashEntry *next) { m_next = next; }
         HashEntry* next() const { return m_next; }
-#endif
 
     private:
         UString::Rep* m_key;
@@ -103,18 +94,14 @@
             } lexer;
         } m_u;
 
-#if !ENABLE(PERFECT_HASH_SIZE)
         HashEntry* m_next;
-#endif
     };
 
     struct HashTable {
-#if ENABLE(PERFECT_HASH_SIZE)
-        int hashSizeMask; // Precomputed size for the hash table (minus 1).
-#else
+
         int compactSize;
         int compactHashSizeMask;
-#endif
+
         const HashTableValue* values; // Fixed values generated by script.
         mutable const HashEntry* table; // Table allocated at runtime.
 
@@ -148,13 +135,6 @@
     private:
         ALWAYS_INLINE const HashEntry* entry(const Identifier& identifier) const
         {
-#if ENABLE(PERFECT_HASH_SIZE)
-            ASSERT(table);
-            const HashEntry* entry = &table[identifier.ustring().rep()->computedHash() & hashSizeMask];
-            if (entry->key() != identifier.ustring().rep())
-                return 0;
-            return entry;
-#else
             ASSERT(table);
 
             const HashEntry* entry = &table[identifier.ustring().rep()->computedHash() & compactHashSizeMask];
@@ -169,7 +149,6 @@
             } while (entry);
 
             return 0;
-#endif
         }
 
         // Convert the hash table keys to identifiers.
@@ -243,16 +222,19 @@
      * is found it sets the value and returns true, else it returns false.
      */
     template <class ThisImp>
-    inline bool lookupPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, const HashTable* table, ThisImp* thisObj)
+    inline bool lookupPut(ExecState* exec, const Identifier& propertyName, JSValue value, const HashTable* table, ThisImp* thisObj)
     {
         const HashEntry* entry = table->entry(exec, propertyName);
 
         if (!entry)
             return false;
 
-        if (entry->attributes() & Function) // function: put as override property
-            thisObj->putDirect(propertyName, value);
-        else if (!(entry->attributes() & ReadOnly))
+        if (entry->attributes() & Function) { // function: put as override property
+            if (LIKELY(value.isCell()))
+                thisObj->putDirectFunction(propertyName, value.asCell());
+            else
+                thisObj->putDirect(propertyName, value);
+        } else if (!(entry->attributes() & ReadOnly))
             entry->propertyPutter()(exec, thisObj, value);
 
         return true;
@@ -265,7 +247,7 @@
      * then it calls put() on the ParentImp class.
      */
     template <class ThisImp, class ParentImp>
-    inline void lookupPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, const HashTable* table, ThisImp* thisObj, PutPropertySlot& slot)
+    inline void lookupPut(ExecState* exec, const Identifier& propertyName, JSValue value, const HashTable* table, ThisImp* thisObj, PutPropertySlot& slot)
     {
         if (!lookupPut<ThisImp>(exec, propertyName, value, table, thisObj))
             thisObj->ParentImp::put(exec, propertyName, value, slot); // not found: forward to parent
diff --git a/JavaScriptCore/runtime/MathObject.cpp b/JavaScriptCore/runtime/MathObject.cpp
index f9b7653..2572bc9 100644
--- a/JavaScriptCore/runtime/MathObject.cpp
+++ b/JavaScriptCore/runtime/MathObject.cpp
@@ -33,24 +33,24 @@
 
 ASSERT_CLASS_FITS_IN_CELL(MathObject);
 
-static JSValuePtr mathProtoFuncAbs(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncACos(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncASin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncATan(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncATan2(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncCeil(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncCos(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncExp(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncFloor(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncLog(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncMax(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncMin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncPow(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncRandom(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncRound(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncSin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncSqrt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncTan(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncACos(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncASin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncATan(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncCos(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncExp(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncLog(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncMax(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncMin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncPow(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncSin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncTan(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -115,62 +115,62 @@
 
 // ------------------------------ Functions --------------------------------
 
-JSValuePtr mathProtoFuncAbs(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, fabs(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, fabs(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncACos(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncACos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, acos(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, acos(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncASin(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncASin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, asin(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, asin(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncATan(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncATan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, atan(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncATan2(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan2(args.at(exec, 0).toNumber(exec), args.at(exec, 1).toNumber(exec)));
+    return jsNumber(exec, atan2(args.at(0).toNumber(exec), args.at(1).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncCeil(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, ceil(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, ceil(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncCos(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncCos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, cos(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, cos(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncExp(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncExp(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, exp(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, exp(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncFloor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, floor(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, floor(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncLog(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncLog(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, log(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, log(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncMax(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncMax(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     unsigned argsCount = args.size();
     double result = -Inf;
     for (unsigned k = 0; k < argsCount; ++k) {
-        double val = args.at(exec, k).toNumber(exec);
+        double val = args.at(k).toNumber(exec);
         if (isnan(val)) {
             result = NaN;
             break;
@@ -181,12 +181,12 @@
     return jsNumber(exec, result);
 }
 
-JSValuePtr mathProtoFuncMin(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncMin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     unsigned argsCount = args.size();
     double result = +Inf;
     for (unsigned k = 0; k < argsCount; ++k) {
-        double val = args.at(exec, k).toNumber(exec);
+        double val = args.at(k).toNumber(exec);
         if (isnan(val)) {
             result = NaN;
             break;
@@ -197,12 +197,12 @@
     return jsNumber(exec, result);
 }
 
-JSValuePtr mathProtoFuncPow(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncPow(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     // ECMA 15.8.2.1.13
 
-    double arg = args.at(exec, 0).toNumber(exec);
-    double arg2 = args.at(exec, 1).toNumber(exec);
+    double arg = args.at(0).toNumber(exec);
+    double arg2 = args.at(1).toNumber(exec);
 
     if (isnan(arg2))
         return jsNaN(exec);
@@ -211,32 +211,32 @@
     return jsNumber(exec, pow(arg, arg2));
 }
 
-JSValuePtr mathProtoFuncRandom(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     return jsNumber(exec, WTF::weakRandomNumber());
 }
 
-JSValuePtr mathProtoFuncRound(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    double arg = args.at(exec, 0).toNumber(exec);
+    double arg = args.at(0).toNumber(exec);
     if (signbit(arg) && arg >= -0.5)
          return jsNumber(exec, -0.0);
     return jsNumber(exec, floor(arg + 0.5));
 }
 
-JSValuePtr mathProtoFuncSin(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncSin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sin(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, sin(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncSqrt(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sqrt(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, sqrt(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncTan(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncTan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, tan(args.at(exec, 0).toNumber(exec)));
+    return jsNumber(exec, tan(args.at(0).toNumber(exec)));
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/MathObject.h b/JavaScriptCore/runtime/MathObject.h
index d6163fd..3557d1e 100644
--- a/JavaScriptCore/runtime/MathObject.h
+++ b/JavaScriptCore/runtime/MathObject.h
@@ -34,7 +34,7 @@
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
diff --git a/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index eee9890..0205fc5 100644
--- a/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -43,8 +43,8 @@
 ErrorInstance* NativeErrorConstructor::construct(ExecState* exec, const ArgList& args)
 {
     ErrorInstance* object = new (exec) ErrorInstance(m_errorStructure);
-    if (!args.at(exec, 0).isUndefined())
-        object->putDirect(exec->propertyNames().message, jsString(exec, args.at(exec, 0).toString(exec)));
+    if (!args.at(0).isUndefined())
+        object->putDirect(exec->propertyNames().message, jsString(exec, args.at(0).toString(exec)));
     return object;
 }
 
@@ -58,8 +58,8 @@
     constructData.native.function = constructWithNativeErrorConstructor;
     return ConstructTypeHost;
 }
-
-static JSValuePtr callNativeErrorConstructor(ExecState* exec, JSObject* constructor, JSValuePtr, const ArgList& args)
+    
+static JSValue JSC_HOST_CALL callNativeErrorConstructor(ExecState* exec, JSObject* constructor, JSValue, const ArgList& args)
 {
     return static_cast<NativeErrorConstructor*>(constructor)->construct(exec, args);
 }
diff --git a/WebCore/platform/network/cf/ResourceResponseCFNet.h b/JavaScriptCore/runtime/NativeFunctionWrapper.h
similarity index 69%
copy from WebCore/platform/network/cf/ResourceResponseCFNet.h
copy to JavaScriptCore/runtime/NativeFunctionWrapper.h
index 27144c6..d4eeb3b 100644
--- a/WebCore/platform/network/cf/ResourceResponseCFNet.h
+++ b/JavaScriptCore/runtime/NativeFunctionWrapper.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,10 +10,10 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef ResourceResponseCFNet_h
-#define ResourceResponseCFNet_h
+#ifndef NativeFunctionWrapper_h
+#define NativeFunctionWrapper_h
 
-typedef struct _CFURLResponse* CFURLResponseRef;
-
-namespace WebCore {
-
-    class ResourceResponse;
-
-    void getResourceResponse(ResourceResponse& response, CFURLResponseRef cfResponse);
-
+namespace JSC {
+#if ENABLE(JIT) && ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
+    class JSFunction;
+    typedef JSFunction NativeFunctionWrapper;
+#else
+    class PrototypeFunction;
+    typedef PrototypeFunction NativeFunctionWrapper;
+#endif
 }
 
-#endif // ResourceResponseCFNet_h
+#endif
diff --git a/JavaScriptCore/runtime/NumberConstructor.cpp b/JavaScriptCore/runtime/NumberConstructor.cpp
index 8bd424d..2840bf0 100644
--- a/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -29,11 +29,11 @@
 
 ASSERT_CLASS_FITS_IN_CELL(NumberConstructor);
 
-static JSValuePtr numberConstructorNaNValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorNegInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorPosInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorMaxValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorMinValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorNaNValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorNegInfinity(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorPosInfinity(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorMaxValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorMinValue(ExecState*, const Identifier&, const PropertySlot&);
 
 } // namespace JSC
 
@@ -68,27 +68,27 @@
     return getStaticValueSlot<NumberConstructor, InternalFunction>(exec, ExecState::numberTable(exec), this, propertyName, slot);
 }
 
-static JSValuePtr numberConstructorNaNValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNaNValue(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNaN(exec);
 }
 
-static JSValuePtr numberConstructorNegInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNegInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, -Inf);
 }
 
-static JSValuePtr numberConstructorPosInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorPosInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, Inf);
 }
 
-static JSValuePtr numberConstructorMaxValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMaxValue(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, 1.7976931348623157E+308);
 }
 
-static JSValuePtr numberConstructorMinValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMinValue(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, 5E-324);
 }
@@ -97,7 +97,7 @@
 static JSObject* constructWithNumberConstructor(ExecState* exec, JSObject*, const ArgList& args)
 {
     NumberObject* object = new (exec) NumberObject(exec->lexicalGlobalObject()->numberObjectStructure());
-    double n = args.isEmpty() ? 0 : args.at(exec, 0).toNumber(exec);
+    double n = args.isEmpty() ? 0 : args.at(0).toNumber(exec);
     object->setInternalValue(jsNumber(exec, n));
     return object;
 }
@@ -109,9 +109,9 @@
 }
 
 // ECMA 15.7.2
-static JSValuePtr callNumberConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callNumberConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, args.isEmpty() ? 0 : args.at(exec, 0).toNumber(exec));
+    return jsNumber(exec, args.isEmpty() ? 0 : args.at(0).toNumber(exec));
 }
 
 CallType NumberConstructor::getCallData(CallData& callData)
diff --git a/JavaScriptCore/runtime/NumberConstructor.h b/JavaScriptCore/runtime/NumberConstructor.h
index 070be5f..b1224ec 100644
--- a/JavaScriptCore/runtime/NumberConstructor.h
+++ b/JavaScriptCore/runtime/NumberConstructor.h
@@ -32,11 +32,11 @@
         NumberConstructor(ExecState*, PassRefPtr<Structure>, NumberPrototype*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-        JSValuePtr getValueProperty(ExecState*, int token) const;
+        JSValue getValueProperty(ExecState*, int token) const;
 
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+        static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
             return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
         }
diff --git a/JavaScriptCore/runtime/NumberObject.cpp b/JavaScriptCore/runtime/NumberObject.cpp
index dc10d8f..0e8df17 100644
--- a/JavaScriptCore/runtime/NumberObject.cpp
+++ b/JavaScriptCore/runtime/NumberObject.cpp
@@ -36,12 +36,12 @@
 {
 }
 
-JSValuePtr NumberObject::getJSNumber()
+JSValue NumberObject::getJSNumber()
 {
     return internalValue();
 }
 
-NumberObject* constructNumber(ExecState* exec, JSValuePtr number)
+NumberObject* constructNumber(ExecState* exec, JSValue number)
 {
     NumberObject* object = new (exec) NumberObject(exec->lexicalGlobalObject()->numberObjectStructure());
     object->setInternalValue(number);
diff --git a/JavaScriptCore/runtime/NumberObject.h b/JavaScriptCore/runtime/NumberObject.h
index 285421d..d354b9b 100644
--- a/JavaScriptCore/runtime/NumberObject.h
+++ b/JavaScriptCore/runtime/NumberObject.h
@@ -34,10 +34,10 @@
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
 
-        virtual JSValuePtr getJSNumber();
+        virtual JSValue getJSNumber();
     };
 
-    NumberObject* constructNumber(ExecState*, JSValuePtr);
+    NumberObject* constructNumber(ExecState*, JSValue);
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/NumberPrototype.cpp b/JavaScriptCore/runtime/NumberPrototype.cpp
index 3e5ac91..947324c 100644
--- a/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -23,6 +23,7 @@
 #include "NumberPrototype.h"
 
 #include "Error.h"
+#include "JSFunction.h"
 #include "JSString.h"
 #include "PrototypeFunction.h"
 #include "dtoa.h"
@@ -35,12 +36,12 @@
 
 ASSERT_CLASS_FITS_IN_CELL(NumberPrototype);
 
-static JSValuePtr numberProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToFixed(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToExponential(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToPrecision(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.7.4
 
@@ -51,12 +52,12 @@
 
     // The constructor will be added later, after NumberConstructor has been constructed
 
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toString, numberProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, numberProtoFuncToLocaleString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, numberProtoFuncValueOf), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toFixed, numberProtoFuncToFixed), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toExponential, numberProtoFuncToExponential), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toPrecision, numberProtoFuncToPrecision), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toString, numberProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, numberProtoFuncToLocaleString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, numberProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toFixed, numberProtoFuncToFixed), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toExponential, numberProtoFuncToExponential), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toPrecision, numberProtoFuncToPrecision), DontEnum);
 }
 
 // ------------------------------ Functions ---------------------------
@@ -67,7 +68,8 @@
 {
     int decimalPoint;
     int sign;
-    char* result = WTF::dtoa(d, 0, &decimalPoint, &sign, NULL);
+    char result[80];
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
     bool resultIsInfOrNan = (decimalPoint == 9999);
     size_t length = strlen(result);
 
@@ -80,17 +82,16 @@
         Vector<char, 1024> buf(decimalPoint + 1);
 
         if (static_cast<int>(length) <= decimalPoint) {
-            strcpy(buf.data(), result);
+            ASSERT(decimalPoint < 1024);
+            memcpy(buf.data(), result, length);
             memset(buf.data() + length, '0', decimalPoint - length);
         } else
             strncpy(buf.data(), result, decimalPoint);
-
         buf[decimalPoint] = '\0';
+
         str.append(buf.data());
     }
 
-    WTF::freedtoa(result);
-
     return str;
 }
 
@@ -133,14 +134,14 @@
     return static_cast<double>(result);
 }
 
-JSValuePtr numberProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue.getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    double radixAsDouble = args.at(exec, 0).toInteger(exec); // nan -> 0
-    if (radixAsDouble == 10 || args.at(exec, 0).isUndefined())
+    double radixAsDouble = args.at(0).toInteger(exec); // nan -> 0
+    if (radixAsDouble == 10 || args.at(0).isUndefined())
         return jsString(exec, v.toString(exec));
 
     if (radixAsDouble < 2 || radixAsDouble > 36)
@@ -197,33 +198,33 @@
     return jsString(exec, startOfResultString);
 }
 
-JSValuePtr numberProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL numberProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     // FIXME: Not implemented yet.
 
-    JSValuePtr v = thisValue.getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
     return jsString(exec, v.toString(exec));
 }
 
-JSValuePtr numberProtoFuncValueOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSValuePtr v = thisValue.getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
     return v;
 }
 
-JSValuePtr numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue.getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    JSValuePtr fractionDigits = args.at(exec, 0);
+    JSValue fractionDigits = args.at(0);
     double df = fractionDigits.toInteger(exec);
     if (!(df >= 0 && df <= 20))
         return throwError(exec, RangeError, "toFixed() digits argument must be between 0 and 20");
@@ -277,7 +278,8 @@
             strncpy(buf + i, result + 1, fractionalDigits);
             i += fractionalDigits;
         } else {
-            strcpy(buf + i, result + 1);
+            ASSERT(i + resultLength - 1 < 80);
+            memcpy(buf + i, result + 1, resultLength - 1);
             i += static_cast<int>(resultLength) - 1;
         }
     }
@@ -302,9 +304,9 @@
     buf[i++] = static_cast<char>('0' + exponential % 10);
 }
 
-JSValuePtr numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue.getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
@@ -313,7 +315,7 @@
     if (isnan(x) || isinf(x))
         return jsString(exec, UString::from(x));
 
-    JSValuePtr fractionalDigitsValue = args.at(exec, 0);
+    JSValue fractionalDigitsValue = args.at(0);
     double df = fractionalDigitsValue.toInteger(exec);
     if (!(df >= 0 && df <= 20))
         return throwError(exec, RangeError, "toExponential() argument must between 0 and 20");
@@ -344,7 +346,8 @@
 
     int decimalPoint;
     int sign;
-    char* result = WTF::dtoa(x, 0, &decimalPoint, &sign, NULL);
+    char result[80];
+    WTF::dtoa(result, x, 0, &decimalPoint, &sign, NULL);
     size_t resultLength = strlen(result);
     decimalPoint += decimalAdjust;
 
@@ -353,9 +356,12 @@
     if (sign)
         buf[i++] = '-';
 
-    if (decimalPoint == 999) // ? 9999 is the magical "result is Inf or NaN" value.  what's 999??
-        strcpy(buf + i, result);
-    else {
+    // ? 9999 is the magical "result is Inf or NaN" value.  what's 999??
+    if (decimalPoint == 999) {
+        ASSERT(i + resultLength < 80);
+        memcpy(buf + i, result, resultLength);
+        buf[i + resultLength] = '\0';
+    } else {
         buf[i++] = result[0];
 
         if (includeAllDigits)
@@ -367,20 +373,18 @@
     }
     ASSERT(i <= 80);
 
-    WTF::freedtoa(result);
-
     return jsString(exec, buf);
 }
 
-JSValuePtr numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue.getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    double doublePrecision = args.at(exec, 0).toIntegerPreserveNaN(exec);
+    double doublePrecision = args.at(0).toIntegerPreserveNaN(exec);
     double x = v.uncheckedGetNumber();
-    if (args.at(exec, 0).isUndefined() || isnan(x) || isinf(x))
+    if (args.at(0).isUndefined() || isnan(x) || isinf(x))
         return jsString(exec, v.toString(exec));
 
     UString s;
diff --git a/JavaScriptCore/runtime/ObjectConstructor.cpp b/JavaScriptCore/runtime/ObjectConstructor.cpp
index 2d61127..cf1790f 100644
--- a/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ObjectConstructor.h"
 
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "ObjectPrototype.h"
 
@@ -41,7 +42,7 @@
 // ECMA 15.2.2
 static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr arg = args.at(exec, 0);
+    JSValue arg = args.at(0);
     if (arg.isUndefinedOrNull())
         return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
     return arg.toObject(exec);
@@ -58,7 +59,7 @@
     return ConstructTypeHost;
 }
 
-static JSValuePtr callObjectConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callObjectConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructObject(exec, args);
 }
diff --git a/JavaScriptCore/runtime/ObjectPrototype.cpp b/JavaScriptCore/runtime/ObjectPrototype.cpp
index 4b776a7..98e4713 100644
--- a/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -22,6 +22,7 @@
 #include "ObjectPrototype.h"
 
 #include "Error.h"
+#include "JSFunction.h"
 #include "JSString.h"
 #include "PrototypeFunction.h"
 
@@ -29,55 +30,55 @@
 
 ASSERT_CLASS_FITS_IN_CELL(ObjectPrototype);
 
-static JSValuePtr objectProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncHasOwnProperty(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncIsPrototypeOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncDefineGetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncDefineSetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncLookupGetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncLookupSetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncPropertyIsEnumerable(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncValueOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncHasOwnProperty(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncIsPrototypeOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncDefineGetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncDefineSetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncLookupGetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncLookupSetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncPropertyIsEnumerable(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 ObjectPrototype::ObjectPrototype(ExecState* exec, PassRefPtr<Structure> stucture, Structure* prototypeFunctionStructure)
     : JSObject(stucture)
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, objectProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, objectProtoFuncToLocaleString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, objectProtoFuncValueOf), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().hasOwnProperty, objectProtoFuncHasOwnProperty), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().propertyIsEnumerable, objectProtoFuncPropertyIsEnumerable), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().isPrototypeOf, objectProtoFuncIsPrototypeOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, objectProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, objectProtoFuncToLocaleString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, objectProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().hasOwnProperty, objectProtoFuncHasOwnProperty), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().propertyIsEnumerable, objectProtoFuncPropertyIsEnumerable), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().isPrototypeOf, objectProtoFuncIsPrototypeOf), DontEnum);
 
     // Mozilla extensions
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineGetter__, objectProtoFuncDefineGetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineSetter__, objectProtoFuncDefineSetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupGetter__, objectProtoFuncLookupGetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupSetter__, objectProtoFuncLookupSetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineGetter__, objectProtoFuncDefineGetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineSetter__, objectProtoFuncDefineSetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupGetter__, objectProtoFuncLookupGetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupSetter__, objectProtoFuncLookupSetter), DontEnum);
 }
 
 // ------------------------------ Functions --------------------------------
 
 // ECMA 15.2.4.2, 15.2.4.4, 15.2.4.5, 15.2.4.7
 
-JSValuePtr objectProtoFuncValueOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL objectProtoFuncValueOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     return thisValue.toThisObject(exec);
 }
 
-JSValuePtr objectProtoFuncHasOwnProperty(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncHasOwnProperty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return jsBoolean(thisValue.toThisObject(exec)->hasOwnProperty(exec, Identifier(exec, args.at(exec, 0).toString(exec))));
+    return jsBoolean(thisValue.toThisObject(exec)->hasOwnProperty(exec, Identifier(exec, args.at(0).toString(exec))));
 }
 
-JSValuePtr objectProtoFuncIsPrototypeOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncIsPrototypeOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
 
-    if (!args.at(exec, 0).isObject())
+    if (!args.at(0).isObject())
         return jsBoolean(false);
 
-    JSValuePtr v = asObject(args.at(exec, 0))->prototype();
+    JSValue v = asObject(args.at(0))->prototype();
 
     while (true) {
         if (!v.isObject())
@@ -88,45 +89,45 @@
     }
 }
 
-JSValuePtr objectProtoFuncDefineGetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncDefineGetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
-    if (args.at(exec, 1).getCallData(callData) == CallTypeNone)
+    if (args.at(1).getCallData(callData) == CallTypeNone)
         return throwError(exec, SyntaxError, "invalid getter usage");
-    thisValue.toThisObject(exec)->defineGetter(exec, Identifier(exec, args.at(exec, 0).toString(exec)), asObject(args.at(exec, 1)));
+    thisValue.toThisObject(exec)->defineGetter(exec, Identifier(exec, args.at(0).toString(exec)), asObject(args.at(1)));
     return jsUndefined();
 }
 
-JSValuePtr objectProtoFuncDefineSetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncDefineSetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
-    if (args.at(exec, 1).getCallData(callData) == CallTypeNone)
+    if (args.at(1).getCallData(callData) == CallTypeNone)
         return throwError(exec, SyntaxError, "invalid setter usage");
-    thisValue.toThisObject(exec)->defineSetter(exec, Identifier(exec, args.at(exec, 0).toString(exec)), asObject(args.at(exec, 1)));
+    thisValue.toThisObject(exec)->defineSetter(exec, Identifier(exec, args.at(0).toString(exec)), asObject(args.at(1)));
     return jsUndefined();
 }
 
-JSValuePtr objectProtoFuncLookupGetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncLookupGetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return thisValue.toThisObject(exec)->lookupGetter(exec, Identifier(exec, args.at(exec, 0).toString(exec)));
+    return thisValue.toThisObject(exec)->lookupGetter(exec, Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr objectProtoFuncLookupSetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncLookupSetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return thisValue.toThisObject(exec)->lookupSetter(exec, Identifier(exec, args.at(exec, 0).toString(exec)));
+    return thisValue.toThisObject(exec)->lookupSetter(exec, Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr objectProtoFuncPropertyIsEnumerable(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncPropertyIsEnumerable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return jsBoolean(thisValue.toThisObject(exec)->propertyIsEnumerable(exec, Identifier(exec, args.at(exec, 0).toString(exec))));
+    return jsBoolean(thisValue.toThisObject(exec)->propertyIsEnumerable(exec, Identifier(exec, args.at(0).toString(exec))));
 }
 
-JSValuePtr objectProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     return thisValue.toThisJSString(exec);
 }
 
-JSValuePtr objectProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL objectProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     return jsNontrivialString(exec, "[object " + thisValue.toThisObject(exec)->className() + "]");
 }
diff --git a/JavaScriptCore/runtime/ObjectPrototype.h b/JavaScriptCore/runtime/ObjectPrototype.h
index 1c432fe..7790ae0 100644
--- a/JavaScriptCore/runtime/ObjectPrototype.h
+++ b/JavaScriptCore/runtime/ObjectPrototype.h
@@ -30,7 +30,7 @@
         ObjectPrototype(ExecState*, PassRefPtr<Structure>, Structure* prototypeFunctionStructure);
     };
 
-    JSValuePtr objectProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    JSValue JSC_HOST_CALL objectProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/Operations.cpp b/JavaScriptCore/runtime/Operations.cpp
index fe516fe..093bbec 100644
--- a/JavaScriptCore/runtime/Operations.cpp
+++ b/JavaScriptCore/runtime/Operations.cpp
@@ -35,28 +35,28 @@
 
 namespace JSC {
 
-bool JSValuePtr::equalSlowCase(ExecState* exec, JSValuePtr v1, JSValuePtr v2)
+bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
 {
     return equalSlowCaseInline(exec, v1, v2);
 }
 
-bool JSValuePtr::strictEqualSlowCase(JSValuePtr v1, JSValuePtr v2)
+bool JSValue::strictEqualSlowCase(JSValue v1, JSValue v2)
 {
     return strictEqualSlowCaseInline(v1, v2);
 }
 
-NEVER_INLINE JSValuePtr throwOutOfMemoryError(ExecState* exec)
+NEVER_INLINE JSValue throwOutOfMemoryError(ExecState* exec)
 {
     JSObject* error = Error::create(exec, GeneralError, "Out of memory");
     exec->setException(error);
     return error;
 }
 
-NEVER_INLINE JSValuePtr jsAddSlowCase(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
+NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
 {
     // exception for the Date exception in defaultValue()
-    JSValuePtr p1 = v1.toPrimitive(callFrame);
-    JSValuePtr p2 = v2.toPrimitive(callFrame);
+    JSValue p1 = v1.toPrimitive(callFrame);
+    JSValue p2 = v2.toPrimitive(callFrame);
 
     if (p1.isString() || p2.isString()) {
         RefPtr<UString::Rep> value = concatenate(p1.toString(callFrame).rep(), p2.toString(callFrame).rep());
@@ -68,7 +68,7 @@
     return jsNumber(callFrame, p1.toNumber(callFrame) + p2.toNumber(callFrame));
 }
 
-JSValuePtr jsTypeStringForValue(CallFrame* callFrame, JSValuePtr v)
+JSValue jsTypeStringForValue(CallFrame* callFrame, JSValue v)
 {
     if (v.isUndefined())
         return jsNontrivialString(callFrame, "undefined");
@@ -90,7 +90,7 @@
     return jsNontrivialString(callFrame, "object");
 }
 
-bool jsIsObjectType(JSValuePtr v)
+bool jsIsObjectType(JSValue v)
 {
     if (!v.isCell())
         return v.isNull();
@@ -108,7 +108,7 @@
     return true;
 }
 
-bool jsIsFunctionType(JSValuePtr v)
+bool jsIsFunctionType(JSValue v)
 {
     if (v.isObject()) {
         CallData callData;
diff --git a/JavaScriptCore/runtime/Operations.h b/JavaScriptCore/runtime/Operations.h
index 85dee99..acfc6c2 100644
--- a/JavaScriptCore/runtime/Operations.h
+++ b/JavaScriptCore/runtime/Operations.h
@@ -29,14 +29,14 @@
 
 namespace JSC {
 
-    NEVER_INLINE JSValuePtr throwOutOfMemoryError(ExecState*);
-    NEVER_INLINE JSValuePtr jsAddSlowCase(CallFrame*, JSValuePtr, JSValuePtr);
-    JSValuePtr jsTypeStringForValue(CallFrame*, JSValuePtr);
-    bool jsIsObjectType(JSValuePtr);
-    bool jsIsFunctionType(JSValuePtr);
+    NEVER_INLINE JSValue throwOutOfMemoryError(ExecState*);
+    NEVER_INLINE JSValue jsAddSlowCase(CallFrame*, JSValue, JSValue);
+    JSValue jsTypeStringForValue(CallFrame*, JSValue);
+    bool jsIsObjectType(JSValue);
+    bool jsIsFunctionType(JSValue);
 
     // ECMA 11.9.3
-    inline bool JSValuePtr::equal(ExecState* exec, JSValuePtr v1, JSValuePtr v2)
+    inline bool JSValue::equal(ExecState* exec, JSValue v1, JSValue v2)
     {
         if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
             return v1 == v2;
@@ -44,7 +44,7 @@
         return equalSlowCase(exec, v1, v2);
     }
 
-    ALWAYS_INLINE bool JSValuePtr::equalSlowCaseInline(ExecState* exec, JSValuePtr v1, JSValuePtr v2)
+    ALWAYS_INLINE bool JSValue::equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2)
     {
         ASSERT(!JSImmediate::areBothImmediateIntegerNumbers(v1, v2));
 
@@ -74,7 +74,7 @@
             if (v1.isObject()) {
                 if (v2.isObject())
                     return v1 == v2;
-                JSValuePtr p1 = v1.toPrimitive(exec);
+                JSValue p1 = v1.toPrimitive(exec);
                 if (exec->hadException())
                     return false;
                 v1 = p1;
@@ -84,7 +84,7 @@
             }
 
             if (v2.isObject()) {
-                JSValuePtr p2 = v2.toPrimitive(exec);
+                JSValue p2 = v2.toPrimitive(exec);
                 if (exec->hadException())
                     return false;
                 v2 = p2;
@@ -112,7 +112,17 @@
     }
 
     // ECMA 11.9.3
-    inline bool JSValuePtr::strictEqual(JSValuePtr v1, JSValuePtr v2)
+    ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(JSValue v1, JSValue v2)
+    {
+        ASSERT(!JSImmediate::isEitherImmediate(v1, v2));
+
+        if (v1.asCell()->isString() && v2.asCell()->isString())
+            return asString(v1)->value() == asString(v2)->value();
+
+        return v1 == v2;
+    }
+
+    inline bool JSValue::strictEqual(JSValue v1, JSValue v2)
     {
         if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
             return v1 == v2;
@@ -123,22 +133,12 @@
         if (JSImmediate::isEitherImmediate(v1, v2))
             return v1 == v2;
 
-        return strictEqualSlowCase(v1, v2);
+        return strictEqualSlowCaseInline(v1, v2);
     }
 
-    ALWAYS_INLINE bool JSValuePtr::strictEqualSlowCaseInline(JSValuePtr v1, JSValuePtr v2)
+    inline bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
-        ASSERT(!JSImmediate::isEitherImmediate(v1, v2));
-
-        if (v1.asCell()->isString() && v2.asCell()->isString())
-            return asString(v1)->value() == asString(v2)->value();
-
-        return v1 == v2;
-    }
-
-    inline bool jsLess(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
-    {
-        if (JSValuePtr::areBothInt32Fast(v1, v2))
+        if (JSValue::areBothInt32Fast(v1, v2))
             return v1.getInt32Fast() < v2.getInt32Fast();
 
         double n1;
@@ -150,8 +150,8 @@
         if (isJSString(globalData, v1) && isJSString(globalData, v2))
             return asString(v1)->value() < asString(v2)->value();
 
-        JSValuePtr p1;
-        JSValuePtr p2;
+        JSValue p1;
+        JSValue p2;
         bool wasNotString1 = v1.getPrimitiveNumber(callFrame, n1, p1);
         bool wasNotString2 = v2.getPrimitiveNumber(callFrame, n2, p2);
 
@@ -161,9 +161,9 @@
         return asString(p1)->value() < asString(p2)->value();
     }
 
-    inline bool jsLessEq(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
+    inline bool jsLessEq(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
-        if (JSValuePtr::areBothInt32Fast(v1, v2))
+        if (JSValue::areBothInt32Fast(v1, v2))
             return v1.getInt32Fast() <= v2.getInt32Fast();
 
         double n1;
@@ -175,8 +175,8 @@
         if (isJSString(globalData, v1) && isJSString(globalData, v2))
             return !(asString(v2)->value() < asString(v1)->value());
 
-        JSValuePtr p1;
-        JSValuePtr p2;
+        JSValue p1;
+        JSValue p2;
         bool wasNotString1 = v1.getPrimitiveNumber(callFrame, n1, p1);
         bool wasNotString2 = v2.getPrimitiveNumber(callFrame, n2, p2);
 
@@ -195,7 +195,7 @@
     //    13962   Add case: 5 3
     //    4000    Add case: 3 5
 
-    ALWAYS_INLINE JSValuePtr jsAdd(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
+    ALWAYS_INLINE JSValue jsAdd(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
         double left;
         double right = 0.0;
@@ -226,13 +226,13 @@
         return jsAddSlowCase(callFrame, v1, v2);
     }
 
-    inline size_t countPrototypeChainEntriesAndCheckForProxies(CallFrame* callFrame, JSValuePtr baseValue, const PropertySlot& slot)
+    inline size_t countPrototypeChainEntriesAndCheckForProxies(CallFrame* callFrame, JSValue baseValue, const PropertySlot& slot)
     {
         JSCell* cell = asCell(baseValue);
         size_t count = 0;
 
         while (slot.slotBase() != cell) {
-            JSValuePtr v = cell->structure()->prototypeForLookup(callFrame);
+            JSValue v = cell->structure()->prototypeForLookup(callFrame);
 
             // If we didn't find slotBase in baseValue's prototype chain, then baseValue
             // must be a proxy for another object.
@@ -254,7 +254,7 @@
         return count;
     }
 
-    ALWAYS_INLINE JSValuePtr resolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain)
+    ALWAYS_INLINE JSValue resolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain)
     {
         ScopeChainIterator iter = scopeChain->begin();
         ScopeChainIterator next = iter;
@@ -274,7 +274,59 @@
         }
 
         ASSERT_NOT_REACHED();
-        return noValue();
+        return JSValue();
+    }
+
+    ALWAYS_INLINE JSValue concatenateStrings(CallFrame* callFrame, Register* strings, unsigned count)
+    {
+        ASSERT(count >= 3);
+
+        // Estimate the amount of space required to hold the entire string.  If all
+        // arguments are strings, we can easily calculate the exact amount of space
+        // required.  For any other arguments, for now let's assume they may require
+        // 11 UChars of storage.  This is enouch to hold any int, and likely is also
+        // reasonable for the other immediates.  We may want to come back and tune
+        // this value at some point.
+        unsigned bufferSize = 0;
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                bufferSize += asString(v)->value().size();
+            else
+                bufferSize += 11;
+        }
+
+        // Allocate an output string to store the result.
+        // If the first argument is a String, and if it has the capacity (or can grow
+        // its capacity) to hold the entire result then use this as a base to concatenate
+        // onto.  Otherwise, allocate a new empty output buffer.
+        JSValue firstValue = strings[0].jsValue();
+        RefPtr<UString::Rep> resultRep;
+        if (firstValue.isString() && (resultRep = asString(firstValue)->value().rep())->reserveCapacity(bufferSize)) {
+            // We're going to concatenate onto the first string - remove it from the list of items to be appended.
+            ++strings;
+            --count;
+        } else
+            resultRep = UString::Rep::createEmptyBuffer(bufferSize);
+        UString result(resultRep);
+
+        // Loop over the openards, writing them into the output buffer.
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                result.append(asString(v)->value());
+            else if (v.isInt32Fast())
+                result.appendNumeric(v.getInt32Fast());
+            else {
+                double d;
+                if (v.getNumber(d))
+                    result.appendNumeric(d);
+                else
+                    result.append(v.toString(callFrame));
+            }
+        }
+
+        return jsString(callFrame, result);
     }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/PropertyMapHashTable.h b/JavaScriptCore/runtime/PropertyMapHashTable.h
index 935df68..44dc2b8 100644
--- a/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -30,20 +30,23 @@
         UString::Rep* key;
         unsigned offset;
         unsigned attributes;
+        JSCell* specificValue;
         unsigned index;
 
-        PropertyMapEntry(UString::Rep* key, unsigned attributes)
+        PropertyMapEntry(UString::Rep* key, unsigned attributes, JSCell* specificValue)
             : key(key)
             , offset(0)
             , attributes(attributes)
+            , specificValue(specificValue)
             , index(0)
         {
         }
 
-        PropertyMapEntry(UString::Rep* key, unsigned offset, unsigned attributes, unsigned index)
+        PropertyMapEntry(UString::Rep* key, unsigned offset, unsigned attributes, JSCell* specificValue, unsigned index)
             : key(key)
             , offset(offset)
             , attributes(attributes)
+            , specificValue(specificValue)
             , index(index)
         {
         }
diff --git a/JavaScriptCore/runtime/PropertyNameArray.h b/JavaScriptCore/runtime/PropertyNameArray.h
index 7dc14fe..b4382f4 100644
--- a/JavaScriptCore/runtime/PropertyNameArray.h
+++ b/JavaScriptCore/runtime/PropertyNameArray.h
@@ -65,14 +65,14 @@
         PropertyNameArray(JSGlobalData* globalData)
             : m_data(PropertyNameArrayData::create())
             , m_globalData(globalData)
-            , m_cacheable(true)
+            , m_shouldCache(true)
         {
         }
 
         PropertyNameArray(ExecState* exec)
             : m_data(PropertyNameArrayData::create())
             , m_globalData(&exec->globalData())
-            , m_cacheable(true)
+            , m_shouldCache(true)
         {
         }
 
@@ -95,8 +95,8 @@
 
         PassRefPtr<PropertyNameArrayData> releaseData() { return m_data.release(); }
 
-        void setCacheable(bool cacheable) { m_cacheable = cacheable; }
-        bool cacheable() const { return m_cacheable; }
+        void setShouldCache(bool shouldCache) { m_shouldCache = shouldCache; }
+        bool shouldCache() const { return m_shouldCache; }
 
     private:
         typedef HashSet<UString::Rep*, PtrHash<UString::Rep*> > IdentifierSet;
@@ -104,7 +104,7 @@
         RefPtr<PropertyNameArrayData> m_data;
         IdentifierSet m_set;
         JSGlobalData* m_globalData;
-        bool m_cacheable;
+        bool m_shouldCache;
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/PropertySlot.cpp b/JavaScriptCore/runtime/PropertySlot.cpp
index 175f271..36fa5d8 100644
--- a/JavaScriptCore/runtime/PropertySlot.cpp
+++ b/JavaScriptCore/runtime/PropertySlot.cpp
@@ -27,7 +27,7 @@
 
 namespace JSC {
 
-JSValuePtr PropertySlot::functionGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue PropertySlot::functionGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     // Prevent getter functions from observing execution if an exception is pending.
     if (exec->hadException())
diff --git a/JavaScriptCore/runtime/PropertySlot.h b/JavaScriptCore/runtime/PropertySlot.h
index 1dd1afa..7af60ce 100644
--- a/JavaScriptCore/runtime/PropertySlot.h
+++ b/JavaScriptCore/runtime/PropertySlot.h
@@ -45,30 +45,30 @@
             clearValue();
         }
 
-        explicit PropertySlot(const JSValuePtr base)
+        explicit PropertySlot(const JSValue base)
             : m_slotBase(base)
             , m_offset(WTF::notFound)
         {
             clearValue();
         }
 
-        typedef JSValuePtr (*GetValueFunc)(ExecState*, const Identifier&, const PropertySlot&);
+        typedef JSValue (*GetValueFunc)(ExecState*, const Identifier&, const PropertySlot&);
 
-        JSValuePtr getValue(ExecState* exec, const Identifier& propertyName) const
+        JSValue getValue(ExecState* exec, const Identifier& propertyName) const
         {
             if (m_getValue == JSC_VALUE_SLOT_MARKER)
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
-                return (*m_data.registerSlot).jsValue(exec);
+                return (*m_data.registerSlot).jsValue();
             return m_getValue(exec, propertyName, *this);
         }
 
-        JSValuePtr getValue(ExecState* exec, unsigned propertyName) const
+        JSValue getValue(ExecState* exec, unsigned propertyName) const
         {
             if (m_getValue == JSC_VALUE_SLOT_MARKER)
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
-                return (*m_data.registerSlot).jsValue(exec);
+                return (*m_data.registerSlot).jsValue();
             return m_getValue(exec, Identifier::from(exec, propertyName), *this);
         }
 
@@ -79,17 +79,17 @@
             return m_offset;
         }
 
-        void putValue(JSValuePtr value)
+        void putValue(JSValue value)
         { 
             if (m_getValue == JSC_VALUE_SLOT_MARKER) {
                 *m_data.valueSlot = value;
                 return;
             }
             ASSERT(m_getValue == JSC_REGISTER_SLOT_MARKER);
-            *m_data.registerSlot = JSValuePtr(value);
+            *m_data.registerSlot = JSValue(value);
         }
 
-        void setValueSlot(JSValuePtr* valueSlot) 
+        void setValueSlot(JSValue* valueSlot) 
         {
             ASSERT(valueSlot);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -97,7 +97,7 @@
             m_data.valueSlot = valueSlot;
         }
         
-        void setValueSlot(JSValuePtr slotBase, JSValuePtr* valueSlot)
+        void setValueSlot(JSValue slotBase, JSValue* valueSlot)
         {
             ASSERT(valueSlot);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -105,7 +105,7 @@
             m_data.valueSlot = valueSlot;
         }
         
-        void setValueSlot(JSValuePtr slotBase, JSValuePtr* valueSlot, size_t offset)
+        void setValueSlot(JSValue slotBase, JSValue* valueSlot, size_t offset)
         {
             ASSERT(valueSlot);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -114,7 +114,7 @@
             m_offset = offset;
         }
         
-        void setValue(JSValuePtr value)
+        void setValue(JSValue value)
         {
             ASSERT(value);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -131,7 +131,7 @@
             m_data.registerSlot = registerSlot;
         }
 
-        void setCustom(JSValuePtr slotBase, GetValueFunc getValue)
+        void setCustom(JSValue slotBase, GetValueFunc getValue)
         {
             ASSERT(slotBase);
             ASSERT(getValue);
@@ -139,7 +139,7 @@
             m_slotBase = slotBase;
         }
 
-        void setCustomIndex(JSValuePtr slotBase, unsigned index, GetValueFunc getValue)
+        void setCustomIndex(JSValue slotBase, unsigned index, GetValueFunc getValue)
         {
             ASSERT(slotBase);
             ASSERT(getValue);
@@ -161,13 +161,13 @@
             setValue(jsUndefined());
         }
 
-        JSValuePtr slotBase() const
+        JSValue slotBase() const
         {
             ASSERT(m_slotBase);
             return m_slotBase;
         }
 
-        void setBase(JSValuePtr base)
+        void setBase(JSValue base)
         {
             ASSERT(m_slotBase);
             ASSERT(base);
@@ -177,33 +177,33 @@
         void clearBase()
         {
 #ifndef NDEBUG
-            m_slotBase = noValue();
+            m_slotBase = JSValue();
 #endif
         }
 
         void clearValue()
         {
 #ifndef NDEBUG
-            m_value = noValue();
+            m_value = JSValue();
 #endif
         }
 
         unsigned index() const { return m_data.index; }
 
     private:
-        static JSValuePtr functionGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue functionGetter(ExecState*, const Identifier&, const PropertySlot&);
 
         GetValueFunc m_getValue;
         
-        JSValuePtr m_slotBase;
+        JSValue m_slotBase;
         union {
             JSObject* getterFunc;
-            JSValuePtr* valueSlot;
+            JSValue* valueSlot;
             Register* registerSlot;
             unsigned index;
         } m_data;
 
-        JSValuePtr m_value;
+        JSValue m_value;
 
         size_t m_offset;
     };
diff --git a/JavaScriptCore/runtime/Protect.h b/JavaScriptCore/runtime/Protect.h
index c7f6b2d..224164d 100644
--- a/JavaScriptCore/runtime/Protect.h
+++ b/JavaScriptCore/runtime/Protect.h
@@ -49,13 +49,13 @@
             gcUnprotect(val);
     }
     
-    inline void gcProtect(JSValuePtr value)
+    inline void gcProtect(JSValue value)
     {
         if (value && value.isCell())
             gcProtect(asCell(value));
     }
 
-    inline void gcUnprotect(JSValuePtr value)
+    inline void gcUnprotect(JSValue value)
     {
         if (value && value.isCell())
             gcUnprotect(asCell(value));
@@ -74,7 +74,7 @@
         
         T* get() const { return m_ptr; }
         operator T*() const { return m_ptr; }
-        operator JSValuePtr() const { return JSValuePtr(m_ptr); }
+        operator JSValue() const { return JSValue(m_ptr); }
         T* operator->() const { return m_ptr; }
         
         operator bool() const { return m_ptr; }
@@ -87,27 +87,27 @@
         T* m_ptr;
     };
 
-    class ProtectedJSValuePtr {
+    class ProtectedJSValue {
     public:
-        ProtectedJSValuePtr() {}
-        ProtectedJSValuePtr(JSValuePtr value);
-        ProtectedJSValuePtr(const ProtectedJSValuePtr&);
-        ~ProtectedJSValuePtr();
+        ProtectedJSValue() {}
+        ProtectedJSValue(JSValue value);
+        ProtectedJSValue(const ProtectedJSValue&);
+        ~ProtectedJSValue();
 
-        template <class U> ProtectedJSValuePtr(const ProtectedPtr<U>&);
+        template <class U> ProtectedJSValue(const ProtectedPtr<U>&);
         
-        JSValuePtr get() const { return m_value; }
-        operator JSValuePtr() const { return m_value; }
-        JSValuePtr operator->() const { return m_value; }
+        JSValue get() const { return m_value; }
+        operator JSValue() const { return m_value; }
+        JSValue operator->() const { return m_value; }
         
         operator bool() const { return m_value; }
         bool operator!() const { return !m_value; }
 
-        ProtectedJSValuePtr& operator=(const ProtectedJSValuePtr&);
-        ProtectedJSValuePtr& operator=(JSValuePtr);
+        ProtectedJSValue& operator=(const ProtectedJSValue&);
+        ProtectedJSValue& operator=(JSValue);
         
     private:
-        JSValuePtr m_value;
+        JSValue m_value;
     };
 
     template <class T> inline ProtectedPtr<T>::ProtectedPtr(T* ptr)
@@ -150,39 +150,39 @@
         return *this;
     }
 
-    inline ProtectedJSValuePtr::ProtectedJSValuePtr(JSValuePtr value)
+    inline ProtectedJSValue::ProtectedJSValue(JSValue value)
         : m_value(value)
     {
         gcProtect(m_value);
     }
 
-    inline ProtectedJSValuePtr::ProtectedJSValuePtr(const ProtectedJSValuePtr& o)
+    inline ProtectedJSValue::ProtectedJSValue(const ProtectedJSValue& o)
         : m_value(o.get())
     {
         gcProtect(m_value);
     }
 
-    inline ProtectedJSValuePtr::~ProtectedJSValuePtr()
+    inline ProtectedJSValue::~ProtectedJSValue()
     {
         gcUnprotect(m_value);
     }
 
-    template <class U> ProtectedJSValuePtr::ProtectedJSValuePtr(const ProtectedPtr<U>& o)
+    template <class U> ProtectedJSValue::ProtectedJSValue(const ProtectedPtr<U>& o)
         : m_value(o.get())
     {
         gcProtect(m_value);
     }
 
-    inline ProtectedJSValuePtr& ProtectedJSValuePtr::operator=(const ProtectedJSValuePtr& o) 
+    inline ProtectedJSValue& ProtectedJSValue::operator=(const ProtectedJSValue& o) 
     {
-        JSValuePtr ovalue = o.m_value;
+        JSValue ovalue = o.m_value;
         gcProtect(ovalue);
         gcUnprotect(m_value);
         m_value = ovalue;
         return *this;
     }
 
-    inline ProtectedJSValuePtr& ProtectedJSValuePtr::operator=(JSValuePtr ovalue)
+    inline ProtectedJSValue& ProtectedJSValue::operator=(JSValue ovalue)
     {
         gcProtect(ovalue);
         gcUnprotect(m_value);
@@ -198,17 +198,17 @@
     template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const T* b) { return a.get() != b; }
     template <class T> inline bool operator!=(const T* a, const ProtectedPtr<T>& b) { return a != b.get(); }
 
-    inline bool operator==(const ProtectedJSValuePtr& a, const ProtectedJSValuePtr& b) { return a.get() == b.get(); }
-    inline bool operator==(const ProtectedJSValuePtr& a, const JSValuePtr b) { return a.get() == b; }
-    template <class T> inline bool operator==(const ProtectedJSValuePtr& a, const ProtectedPtr<T>& b) { return a.get() == JSValuePtr(b.get()); }
-    inline bool operator==(const JSValuePtr a, const ProtectedJSValuePtr& b) { return a == b.get(); }
-    template <class T> inline bool operator==(const ProtectedPtr<T>& a, const ProtectedJSValuePtr& b) { return JSValuePtr(a.get()) == b.get(); }
+    inline bool operator==(const ProtectedJSValue& a, const ProtectedJSValue& b) { return a.get() == b.get(); }
+    inline bool operator==(const ProtectedJSValue& a, const JSValue b) { return a.get() == b; }
+    template <class T> inline bool operator==(const ProtectedJSValue& a, const ProtectedPtr<T>& b) { return a.get() == JSValue(b.get()); }
+    inline bool operator==(const JSValue a, const ProtectedJSValue& b) { return a == b.get(); }
+    template <class T> inline bool operator==(const ProtectedPtr<T>& a, const ProtectedJSValue& b) { return JSValue(a.get()) == b.get(); }
 
-    inline bool operator!=(const ProtectedJSValuePtr& a, const ProtectedJSValuePtr& b) { return a.get() != b.get(); }
-    inline bool operator!=(const ProtectedJSValuePtr& a, const JSValuePtr b) { return a.get() != b; }
-    template <class T> inline bool operator!=(const ProtectedJSValuePtr& a, const ProtectedPtr<T>& b) { return a.get() != JSValuePtr(b.get()); }
-    inline bool operator!=(const JSValuePtr a, const ProtectedJSValuePtr& b) { return a != b.get(); }
-    template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const ProtectedJSValuePtr& b) { return JSValuePtr(a.get()) != b.get(); }
+    inline bool operator!=(const ProtectedJSValue& a, const ProtectedJSValue& b) { return a.get() != b.get(); }
+    inline bool operator!=(const ProtectedJSValue& a, const JSValue b) { return a.get() != b; }
+    template <class T> inline bool operator!=(const ProtectedJSValue& a, const ProtectedPtr<T>& b) { return a.get() != JSValue(b.get()); }
+    inline bool operator!=(const JSValue a, const ProtectedJSValue& b) { return a != b.get(); }
+    template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const ProtectedJSValue& b) { return JSValue(a.get()) != b.get(); }
  
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/PutPropertySlot.h b/JavaScriptCore/runtime/PutPropertySlot.h
index 1e2dfe9..eb8ea8a 100644
--- a/JavaScriptCore/runtime/PutPropertySlot.h
+++ b/JavaScriptCore/runtime/PutPropertySlot.h
@@ -32,15 +32,15 @@
 namespace JSC {
     
     class JSObject;
+    class JSFunction;
     
     class PutPropertySlot {
     public:
-        enum Type { Invalid, ExistingProperty, NewProperty };
+        enum Type { Uncachable, ExistingProperty, NewProperty };
 
         PutPropertySlot()
-            : m_type(Invalid)
+            : m_type(Uncachable)
             , m_base(0)
-            , m_wasTransition(false)
         {
         }
 
@@ -61,18 +61,14 @@
         Type type() const { return m_type; }
         JSObject* base() const { return m_base; }
 
-        bool isCacheable() const { return m_type != Invalid; }
+        bool isCacheable() const { return m_type != Uncachable; }
         size_t cachedOffset() const {
             ASSERT(isCacheable());
             return m_offset;
         }
-        
-        bool wasTransition() const { return m_wasTransition; }
-        void setWasTransition(bool wasTransition) { m_wasTransition = wasTransition; }
     private:
         Type m_type;
         JSObject* m_base;
-        bool m_wasTransition;
         size_t m_offset;
     };
 
diff --git a/JavaScriptCore/runtime/RegExp.cpp b/JavaScriptCore/runtime/RegExp.cpp
index 5d05f11..857a316 100644
--- a/JavaScriptCore/runtime/RegExp.cpp
+++ b/JavaScriptCore/runtime/RegExp.cpp
@@ -20,17 +20,33 @@
 
 #include "config.h"
 #include "RegExp.h"
-
-#include "JIT.h"
 #include "Lexer.h"
-#include "WRECGenerator.h"
-#include <pcre/pcre.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <wtf/Assertions.h>
 #include <wtf/OwnArrayPtr.h>
 
+
+#if ENABLE(YARR)
+
+#include "yarr/RegexCompiler.h"
+#if ENABLE(YARR_JIT)
+#include "yarr/RegexJIT.h"
+#else
+#include "yarr/RegexInterpreter.h"
+#endif
+
+#else
+
+#if ENABLE(WREC)
+#include "JIT.h"
+#include "WRECGenerator.h"
+#endif
+#include <pcre/pcre.h>
+
+#endif
+
 namespace JSC {
 
 #if ENABLE(WREC)
@@ -40,32 +56,16 @@
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern)
     : m_pattern(pattern)
     , m_flagBits(0)
-    , m_regExp(0)
     , m_constructionError(0)
     , m_numSubpatterns(0)
 {
-#if ENABLE(WREC)
-    m_wrecFunction = Generator::compileRegExp(globalData, pattern, &m_numSubpatterns, &m_constructionError, m_executablePool);
-    if (m_wrecFunction || m_constructionError)
-        return;
-    // Fall through to non-WREC case.
-#else
-    UNUSED_PARAM(globalData);
-#endif
-    m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(pattern.data()), pattern.size(),
-        JSRegExpDoNotIgnoreCase, JSRegExpSingleLine, &m_numSubpatterns, &m_constructionError);
-}
-
-PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& pattern)
-{
-    return adoptRef(new RegExp(globalData, pattern));
+    compile(globalData);
 }
 
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags)
     : m_pattern(pattern)
     , m_flags(flags)
     , m_flagBits(0)
-    , m_regExp(0)
     , m_constructionError(0)
     , m_numSubpatterns(0)
 {
@@ -73,30 +73,24 @@
     // String::match and RegExpObject::match.
     if (flags.find('g') != -1)
         m_flagBits |= Global;
-
-    // FIXME: Eliminate duplication by adding a way ask a JSRegExp what its flags are?
-    JSRegExpIgnoreCaseOption ignoreCaseOption = JSRegExpDoNotIgnoreCase;
-    if (flags.find('i') != -1) {
+    if (flags.find('i') != -1)
         m_flagBits |= IgnoreCase;
-        ignoreCaseOption = JSRegExpIgnoreCase;
-    }
-
-    JSRegExpMultilineOption multilineOption = JSRegExpSingleLine;
-    if (flags.find('m') != -1) {
+    if (flags.find('m') != -1)
         m_flagBits |= Multiline;
-        multilineOption = JSRegExpMultiline;
-    }
 
-#if ENABLE(WREC)
-    m_wrecFunction = Generator::compileRegExp(globalData, pattern, &m_numSubpatterns, &m_constructionError, m_executablePool, (m_flagBits & IgnoreCase), (m_flagBits & Multiline));
-    if (m_wrecFunction || m_constructionError)
-        return;
-    // Fall through to non-WREC case.
-#else
-    UNUSED_PARAM(globalData);
+    compile(globalData);
+}
+
+#if !ENABLE(YARR)
+RegExp::~RegExp()
+{
+    jsRegExpFree(m_regExp);
+}
 #endif
-    m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(pattern.data()), pattern.size(),
-        ignoreCaseOption, multilineOption, &m_numSubpatterns, &m_constructionError);
+
+PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& pattern)
+{
+    return adoptRef(new RegExp(globalData, pattern));
 }
 
 PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& pattern, const UString& flags)
@@ -104,9 +98,83 @@
     return adoptRef(new RegExp(globalData, pattern, flags));
 }
 
-RegExp::~RegExp()
+#if ENABLE(YARR)
+
+void RegExp::compile(JSGlobalData* globalData)
 {
-    jsRegExpFree(m_regExp);
+#if ENABLE(YARR_JIT)
+    Yarr::jitCompileRegex(globalData, m_regExpJITCode, m_pattern, m_numSubpatterns, m_constructionError, ignoreCase(), multiline());
+#else
+    UNUSED_PARAM(globalData);
+    m_regExpBytecode.set(Yarr::byteCompileRegex(m_pattern, m_numSubpatterns, m_constructionError, ignoreCase(), multiline()));
+#endif
+}
+
+int RegExp::match(const UString& s, int startOffset, OwnArrayPtr<int>* ovector)
+{
+    if (startOffset < 0)
+        startOffset = 0;
+    if (ovector)
+        ovector->clear();
+
+    if (startOffset > s.size() || s.isNull())
+        return -1;
+
+#if ENABLE(YARR_JIT)
+    if (!!m_regExpJITCode) {
+#else
+    if (m_regExpBytecode) {
+#endif
+        int offsetVectorSize = (m_numSubpatterns + 1) * 3; // FIXME: should be 2 - but adding temporary fallback to pcre.
+        int* offsetVector = new int [offsetVectorSize];
+        ASSERT(offsetVector);
+        for (int j = 0; j < offsetVectorSize; ++j)
+            offsetVector[j] = -1;
+
+        OwnArrayPtr<int> nonReturnedOvector;
+        if (!ovector)
+            nonReturnedOvector.set(offsetVector);
+        else
+            ovector->set(offsetVector);
+
+#if ENABLE(YARR_JIT)
+        int result = Yarr::executeRegex(m_regExpJITCode, s.data(), startOffset, s.size(), offsetVector, offsetVectorSize);
+#else
+        int result = Yarr::interpretRegex(m_regExpBytecode.get(), s.data(), startOffset, s.size(), offsetVector);
+#endif
+
+        if (result < 0) {
+#ifndef NDEBUG
+            // TODO: define up a symbol, rather than magic -1
+            if (result != -1)
+                fprintf(stderr, "jsRegExpExecute failed with result %d\n", result);
+#endif
+            if (ovector)
+                ovector->clear();
+        }
+        return result;
+    }
+
+    return -1;
+}
+
+#else
+
+void RegExp::compile(JSGlobalData* globalData)
+{
+    m_regExp = 0;
+#if ENABLE(WREC)
+    m_wrecFunction = Generator::compileRegExp(globalData, m_pattern, &m_numSubpatterns, &m_constructionError, m_executablePool, ignoreCase(), multiline());
+    if (m_wrecFunction || m_constructionError)
+        return;
+    // Fall through to non-WREC case.
+#else
+    UNUSED_PARAM(globalData);
+#endif
+
+    JSRegExpIgnoreCaseOption ignoreCaseOption = ignoreCase() ? JSRegExpIgnoreCase : JSRegExpDoNotIgnoreCase;
+    JSRegExpMultilineOption multilineOption = multiline() ? JSRegExpMultiline : JSRegExpSingleLine;
+    m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(m_pattern.data()), m_pattern.size(), ignoreCaseOption, multilineOption, &m_numSubpatterns, &m_constructionError);
 }
 
 int RegExp::match(const UString& s, int startOffset, OwnArrayPtr<int>* ovector)
@@ -180,4 +248,6 @@
     return -1;
 }
 
+#endif
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/RegExp.h b/JavaScriptCore/runtime/RegExp.h
index 139c754..f3be656 100644
--- a/JavaScriptCore/runtime/RegExp.h
+++ b/JavaScriptCore/runtime/RegExp.h
@@ -26,6 +26,8 @@
 #include "ExecutableAllocator.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
+#include "yarr/RegexJIT.h"
+#include "yarr/RegexInterpreter.h"
 
 struct JSRegExp;
 
@@ -37,7 +39,9 @@
     public:
         static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern);
         static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern, const UString& flags);
+#if !ENABLE(YARR)
         ~RegExp();
+#endif
 
         bool global() const { return m_flagBits & Global; }
         bool ignoreCase() const { return m_flagBits & IgnoreCase; }
@@ -56,21 +60,27 @@
         RegExp(JSGlobalData* globalData, const UString& pattern);
         RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags);
 
-        void compile();
+        void compile(JSGlobalData*);
 
         enum FlagBits { Global = 1, IgnoreCase = 2, Multiline = 4 };
 
         UString m_pattern; // FIXME: Just decompile m_regExp instead of storing this.
         UString m_flags; // FIXME: Just decompile m_regExp instead of storing this.
         int m_flagBits;
-        JSRegExp* m_regExp;
         const char* m_constructionError;
         unsigned m_numSubpatterns;
 
+#if ENABLE(YARR_JIT)
+        Yarr::RegexCodeBlock m_regExpJITCode;
+#elif ENABLE(YARR)
+        OwnPtr<Yarr::BytecodePattern> m_regExpBytecode;
+#else
 #if ENABLE(WREC)
         WREC::CompiledRegExp m_wrecFunction;
         RefPtr<ExecutablePool> m_executablePool;
 #endif
+        JSRegExp* m_regExp;
+#endif
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/RegExpConstructor.cpp b/JavaScriptCore/runtime/RegExpConstructor.cpp
index bff51e0..bcd0d07 100644
--- a/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -33,24 +33,24 @@
 
 namespace JSC {
 
-static JSValuePtr regExpConstructorInput(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorLastMatch(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorLastParen(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorLeftContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorRightContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar1(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar2(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar3(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar4(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar5(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar6(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar7(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar8(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar9(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorInput(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorLastMatch(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorLastParen(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorLeftContext(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorRightContext(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar1(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar2(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar3(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar4(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar5(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar6(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar7(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar8(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar9(ExecState*, const Identifier&, const PropertySlot&);
 
-static void setRegExpConstructorInput(ExecState*, JSObject*, JSValuePtr);
-static void setRegExpConstructorMultiline(ExecState*, JSObject*, JSValuePtr);
+static void setRegExpConstructorInput(ExecState*, JSObject*, JSValue);
+static void setRegExpConstructorMultiline(ExecState*, JSObject*, JSValue);
 
 } // namespace JSC
 
@@ -185,7 +185,7 @@
     return new (exec) RegExpMatchesArray(exec, d.get());
 }
 
-JSValuePtr RegExpConstructor::getBackref(ExecState* exec, unsigned i) const
+JSValue RegExpConstructor::getBackref(ExecState* exec, unsigned i) const
 {
     if (d->lastOvector && i <= d->lastNumSubPatterns) {
         int start = d->lastOvector[2 * i];
@@ -195,7 +195,7 @@
     return jsEmptyString(exec);
 }
 
-JSValuePtr RegExpConstructor::getLastParen(ExecState* exec) const
+JSValue RegExpConstructor::getLastParen(ExecState* exec) const
 {
     unsigned i = d->lastNumSubPatterns;
     if (i > 0) {
@@ -207,14 +207,14 @@
     return jsEmptyString(exec);
 }
 
-JSValuePtr RegExpConstructor::getLeftContext(ExecState* exec) const
+JSValue RegExpConstructor::getLeftContext(ExecState* exec) const
 {
     if (d->lastOvector)
         return jsSubstring(exec, d->lastInput, 0, d->lastOvector[0]);
     return jsEmptyString(exec);
 }
 
-JSValuePtr RegExpConstructor::getRightContext(ExecState* exec) const
+JSValue RegExpConstructor::getRightContext(ExecState* exec) const
 {
     if (d->lastOvector)
         return jsSubstring(exec, d->lastInput, d->lastOvector[1], d->lastInput.size() - d->lastOvector[1]);
@@ -226,92 +226,92 @@
     return getStaticValueSlot<RegExpConstructor, InternalFunction>(exec, ExecState::regExpConstructorTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr regExpConstructorDollar1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 1);
 }
 
-JSValuePtr regExpConstructorDollar2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 2);
 }
 
-JSValuePtr regExpConstructorDollar3(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar3(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 3);
 }
 
-JSValuePtr regExpConstructorDollar4(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar4(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 4);
 }
 
-JSValuePtr regExpConstructorDollar5(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar5(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 5);
 }
 
-JSValuePtr regExpConstructorDollar6(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar6(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 6);
 }
 
-JSValuePtr regExpConstructorDollar7(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar7(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 7);
 }
 
-JSValuePtr regExpConstructorDollar8(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar8(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 8);
 }
 
-JSValuePtr regExpConstructorDollar9(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar9(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 9);
 }
 
-JSValuePtr regExpConstructorInput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorInput(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return jsString(exec, asRegExpConstructor(slot.slotBase())->input());
 }
 
-JSValuePtr regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
 {
     return jsBoolean(asRegExpConstructor(slot.slotBase())->multiline());
 }
 
-JSValuePtr regExpConstructorLastMatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastMatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 0);
 }
 
-JSValuePtr regExpConstructorLastParen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastParen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getLastParen(exec);
 }
 
-JSValuePtr regExpConstructorLeftContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLeftContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getLeftContext(exec);
 }
 
-JSValuePtr regExpConstructorRightContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorRightContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getRightContext(exec);
 }
 
-void RegExpConstructor::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RegExpConstructor::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<RegExpConstructor, InternalFunction>(exec, propertyName, value, ExecState::regExpConstructorTable(exec), this, slot);
 }
 
-void setRegExpConstructorInput(ExecState* exec, JSObject* baseObject, JSValuePtr value)
+void setRegExpConstructorInput(ExecState* exec, JSObject* baseObject, JSValue value)
 {
     asRegExpConstructor(baseObject)->setInput(value.toString(exec));
 }
 
-void setRegExpConstructorMultiline(ExecState* exec, JSObject* baseObject, JSValuePtr value)
+void setRegExpConstructorMultiline(ExecState* exec, JSObject* baseObject, JSValue value)
 {
     asRegExpConstructor(baseObject)->setMultiline(value.toBoolean(exec));
 }
@@ -319,8 +319,8 @@
 // ECMA 15.10.4
 JSObject* constructRegExp(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr arg0 = args.at(exec, 0);
-    JSValuePtr arg1 = args.at(exec, 1);
+    JSValue arg0 = args.at(0);
+    JSValue arg1 = args.at(1);
 
     if (arg0.isObject(&RegExpObject::info)) {
         if (!arg1.isUndefined())
@@ -349,7 +349,7 @@
 }
 
 // ECMA 15.10.3
-static JSValuePtr callRegExpConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callRegExpConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructRegExp(exec, args);
 }
diff --git a/JavaScriptCore/runtime/RegExpConstructor.h b/JavaScriptCore/runtime/RegExpConstructor.h
index f8c4366..6823f3f 100644
--- a/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/JavaScriptCore/runtime/RegExpConstructor.h
@@ -34,12 +34,12 @@
     public:
         RegExpConstructor(ExecState*, PassRefPtr<Structure>, RegExpPrototype*);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance));
         }
 
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 
         static const ClassInfo info;
@@ -53,10 +53,10 @@
         void setMultiline(bool);
         bool multiline() const;
 
-        JSValuePtr getBackref(ExecState*, unsigned) const;
-        JSValuePtr getLastParen(ExecState*) const;
-        JSValuePtr getLeftContext(ExecState*) const;
-        JSValuePtr getRightContext(ExecState*) const;
+        JSValue getBackref(ExecState*, unsigned) const;
+        JSValue getLastParen(ExecState*) const;
+        JSValue getLeftContext(ExecState*) const;
+        JSValue getRightContext(ExecState*) const;
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
@@ -67,11 +67,11 @@
         OwnPtr<RegExpConstructorPrivate> d;
     };
 
-    RegExpConstructor* asRegExpConstructor(JSValuePtr);
+    RegExpConstructor* asRegExpConstructor(JSValue);
 
     JSObject* constructRegExp(ExecState*, const ArgList&);
 
-    inline RegExpConstructor* asRegExpConstructor(JSValuePtr value)
+    inline RegExpConstructor* asRegExpConstructor(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&RegExpConstructor::info));
         return static_cast<RegExpConstructor*>(asObject(value));
diff --git a/JavaScriptCore/runtime/RegExpMatchesArray.h b/JavaScriptCore/runtime/RegExpMatchesArray.h
index 3583941..9ae18b9 100644
--- a/JavaScriptCore/runtime/RegExpMatchesArray.h
+++ b/JavaScriptCore/runtime/RegExpMatchesArray.h
@@ -44,14 +44,14 @@
             return JSArray::getOwnPropertySlot(exec, propertyName, slot);
         }
 
-        virtual void put(ExecState* exec, const Identifier& propertyName, JSValuePtr v, PutPropertySlot& slot)
+        virtual void put(ExecState* exec, const Identifier& propertyName, JSValue v, PutPropertySlot& slot)
         {
             if (lazyCreationData())
                 fillArrayInstance(exec);
             JSArray::put(exec, propertyName, v, slot);
         }
 
-        virtual void put(ExecState* exec, unsigned propertyName, JSValuePtr v)
+        virtual void put(ExecState* exec, unsigned propertyName, JSValue v)
         {
             if (lazyCreationData())
                 fillArrayInstance(exec);
diff --git a/JavaScriptCore/runtime/RegExpObject.cpp b/JavaScriptCore/runtime/RegExpObject.cpp
index f8e0522..687844e 100644
--- a/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/JavaScriptCore/runtime/RegExpObject.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "RegExpObject.h"
 
+#include "Error.h"
 #include "JSArray.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
@@ -29,12 +30,12 @@
 
 namespace JSC {
 
-static JSValuePtr regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectSource(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectLastIndex(ExecState*, const Identifier&, const PropertySlot&);
-static void setRegExpObjectLastIndex(ExecState*, JSObject*, JSValuePtr);
+static JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectSource(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectLastIndex(ExecState*, const Identifier&, const PropertySlot&);
+static void setRegExpObjectLastIndex(ExecState*, JSObject*, JSValue);
 
 } // namespace JSC
 
@@ -71,54 +72,54 @@
     return getStaticValueSlot<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot& slot)
 {
     return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->global());
 }
 
-JSValuePtr regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot& slot)
 {
     return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->ignoreCase());
 }
  
-JSValuePtr regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
 {            
     return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->multiline());
 }
 
-JSValuePtr regExpObjectSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return jsString(exec, asRegExpObject(slot.slotBase())->regExp()->pattern());
 }
 
-JSValuePtr regExpObjectLastIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectLastIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return jsNumber(exec, asRegExpObject(slot.slotBase())->lastIndex());
 }
 
-void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<RegExpObject, JSObject>(exec, propertyName, value, ExecState::regExpTable(exec), this, slot);
 }
 
-void setRegExpObjectLastIndex(ExecState* exec, JSObject* baseObject, JSValuePtr value)
+void setRegExpObjectLastIndex(ExecState* exec, JSObject* baseObject, JSValue value)
 {
     asRegExpObject(baseObject)->setLastIndex(value.toInteger(exec));
 }
 
-JSValuePtr RegExpObject::test(ExecState* exec, const ArgList& args)
+JSValue RegExpObject::test(ExecState* exec, const ArgList& args)
 {
     return jsBoolean(match(exec, args));
 }
 
-JSValuePtr RegExpObject::exec(ExecState* exec, const ArgList& args)
+JSValue RegExpObject::exec(ExecState* exec, const ArgList& args)
 {
     if (match(exec, args))
         return exec->lexicalGlobalObject()->regExpConstructor()->arrayOfMatches(exec);
     return jsNull();
 }
 
-static JSValuePtr callRegExpObject(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callRegExpObject(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     return asRegExpObject(function)->exec(exec, args);
 }
@@ -134,7 +135,7 @@
 {
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
 
-    UString input = args.isEmpty() ? regExpConstructor->input() : args.at(exec, 0).toString(exec);
+    UString input = args.isEmpty() ? regExpConstructor->input() : args.at(0).toString(exec);
     if (input.isNull()) {
         throwError(exec, GeneralError, "No input to " + toString(exec) + ".");
         return false;
diff --git a/JavaScriptCore/runtime/RegExpObject.h b/JavaScriptCore/runtime/RegExpObject.h
index 4c99c30..fac9978 100644
--- a/JavaScriptCore/runtime/RegExpObject.h
+++ b/JavaScriptCore/runtime/RegExpObject.h
@@ -37,16 +37,16 @@
         void setLastIndex(double lastIndex) { d->lastIndex = lastIndex; }
         double lastIndex() const { return d->lastIndex; }
 
-        JSValuePtr test(ExecState*, const ArgList&);
-        JSValuePtr exec(ExecState*, const ArgList&);
+        JSValue test(ExecState*, const ArgList&);
+        JSValue exec(ExecState*, const ArgList&);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
@@ -70,9 +70,9 @@
         OwnPtr<RegExpObjectData> d;
     };
 
-    RegExpObject* asRegExpObject(JSValuePtr);
+    RegExpObject* asRegExpObject(JSValue);
 
-    inline RegExpObject* asRegExpObject(JSValuePtr value)
+    inline RegExpObject* asRegExpObject(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&RegExpObject::info));
         return static_cast<RegExpObject*>(asObject(value));
diff --git a/JavaScriptCore/runtime/RegExpPrototype.cpp b/JavaScriptCore/runtime/RegExpPrototype.cpp
index 73787bc..b1ab889 100644
--- a/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -23,6 +23,7 @@
 
 #include "ArrayPrototype.h"
 #include "JSArray.h"
+#include "JSFunction.h"
 #include "JSObject.h"
 #include "JSString.h"
 #include "JSValue.h"
@@ -35,10 +36,10 @@
 
 ASSERT_CLASS_FITS_IN_CELL(RegExpPrototype);
 
-static JSValuePtr regExpProtoFuncTest(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr regExpProtoFuncExec(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr regExpProtoFuncCompile(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr regExpProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncTest(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.10.5
 
@@ -47,36 +48,36 @@
 RegExpPrototype::RegExpPrototype(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
     : JSObject(structure)
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().exec, regExpProtoFuncExec), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().test, regExpProtoFuncTest), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, regExpProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().exec, regExpProtoFuncExec), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().test, regExpProtoFuncTest), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, regExpProtoFuncToString), DontEnum);
 }
 
 // ------------------------------ Functions ---------------------------
     
-JSValuePtr regExpProtoFuncTest(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL regExpProtoFuncTest(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (!thisValue.isObject(&RegExpObject::info))
         return throwError(exec, TypeError);
     return asRegExpObject(thisValue)->test(exec, args);
 }
 
-JSValuePtr regExpProtoFuncExec(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (!thisValue.isObject(&RegExpObject::info))
         return throwError(exec, TypeError);
     return asRegExpObject(thisValue)->exec(exec, args);
 }
 
-JSValuePtr regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (!thisValue.isObject(&RegExpObject::info))
         return throwError(exec, TypeError);
 
     RefPtr<RegExp> regExp;
-    JSValuePtr arg0 = args.at(exec, 0);
-    JSValuePtr arg1 = args.at(exec, 1);
+    JSValue arg0 = args.at(0);
+    JSValue arg1 = args.at(1);
     
     if (arg0.isObject(&RegExpObject::info)) {
         if (!arg1.isUndefined())
@@ -96,7 +97,7 @@
     return jsUndefined();
 }
 
-JSValuePtr regExpProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (!thisValue.isObject(&RegExpObject::info)) {
         if (thisValue.isObject(&RegExpPrototype::info))
diff --git a/JavaScriptCore/runtime/ScopeChain.h b/JavaScriptCore/runtime/ScopeChain.h
index 32b5e92..6f1560a 100644
--- a/JavaScriptCore/runtime/ScopeChain.h
+++ b/JavaScriptCore/runtime/ScopeChain.h
@@ -41,6 +41,18 @@
         {
             ASSERT(globalData);
         }
+#ifndef NDEBUG
+        // Due to the number of subtle and timing dependent bugs that have occurred due
+        // to deleted but still "valid" ScopeChainNodes we now deliberately clobber the
+        // contents in debug builds.
+        ~ScopeChainNode()
+        {
+            next = 0;
+            object = 0;
+            globalData = 0;
+            globalThis = 0;
+        }
+#endif
 
         ScopeChainNode* next;
         JSObject* object;
@@ -171,6 +183,9 @@
         {
             if (m_node)
                 m_node->deref();
+#ifndef NDEBUG
+            m_node = 0;
+#endif
         }
 
         void swap(ScopeChain&);
diff --git a/JavaScriptCore/runtime/SmallStrings.cpp b/JavaScriptCore/runtime/SmallStrings.cpp
index 6c73df2..87b49f0 100644
--- a/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/JavaScriptCore/runtime/SmallStrings.cpp
@@ -47,25 +47,17 @@
 };
 
 SmallStringsStorage::SmallStringsStorage()
+    : m_base(m_characters, numCharactersToStore)
 {
-    for (unsigned i = 0; i < numCharactersToStore; ++i)
-        m_characters[i] = i;
-
     m_base.rc = numCharactersToStore + 1;
-    m_base.buf = m_characters;
-    m_base.len = numCharactersToStore;
-    m_base.offset = 0;
-    m_base._hash = 0;
-    m_base.m_baseString = 0;
-    m_base.preCapacity = 0;
-    m_base.usedPreCapacity = 0;
-    m_base.reportedCost = 0;
-
     // make sure UString doesn't try to reuse the buffer by pretending we have one more character in it
     m_base.usedCapacity = numCharactersToStore + 1;
     m_base.capacity = numCharactersToStore + 1;
     m_base.checkConsistency();
 
+    for (unsigned i = 0; i < numCharactersToStore; ++i)
+        m_characters[i] = i;
+
     memset(&m_reps, 0, sizeof(m_reps));
     for (unsigned i = 0; i < numCharactersToStore; ++i) {
         m_reps[i].offset = i;
diff --git a/JavaScriptCore/runtime/StringConstructor.cpp b/JavaScriptCore/runtime/StringConstructor.cpp
index dc1d60f..6380445 100644
--- a/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/JavaScriptCore/runtime/StringConstructor.cpp
@@ -21,26 +21,27 @@
 #include "config.h"
 #include "StringConstructor.h"
 
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "PrototypeFunction.h"
 #include "StringPrototype.h"
 
 namespace JSC {
 
-static NEVER_INLINE JSValuePtr stringFromCharCodeSlowCase(ExecState* exec, const ArgList& args)
+static NEVER_INLINE JSValue stringFromCharCodeSlowCase(ExecState* exec, const ArgList& args)
 {
     UChar* buf = static_cast<UChar*>(fastMalloc(args.size() * sizeof(UChar)));
     UChar* p = buf;
     ArgList::const_iterator end = args.end();
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        *p++ = static_cast<UChar>((*it).jsValue(exec).toUInt32(exec));
+        *p++ = static_cast<UChar>((*it).toUInt32(exec));
     return jsString(exec, UString(buf, p - buf, false));
 }
 
-static JSValuePtr stringFromCharCode(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL stringFromCharCode(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (LIKELY(args.size() == 1))
-        return jsSingleCharacterString(exec, args.at(exec, 0).toUInt32(exec));
+        return jsSingleCharacterString(exec, args.at(0).toUInt32(exec));
     return stringFromCharCodeSlowCase(exec, args);
 }
 
@@ -53,7 +54,7 @@
     putDirectWithoutTransition(exec->propertyNames().prototype, stringPrototype, ReadOnly | DontEnum | DontDelete);
 
     // ECMA 15.5.3.2 fromCharCode()
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().fromCharCode, stringFromCharCode), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().fromCharCode, stringFromCharCode), DontEnum);
 
     // no. of arguments for constructor
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontEnum | DontDelete);
@@ -64,7 +65,7 @@
 {
     if (args.isEmpty())
         return new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure());
-    return new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure(), args.at(exec, 0).toString(exec));
+    return new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure(), args.at(0).toString(exec));
 }
 
 ConstructType StringConstructor::getConstructData(ConstructData& constructData)
@@ -74,11 +75,11 @@
 }
 
 // ECMA 15.5.1
-static JSValuePtr callStringConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callStringConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (args.isEmpty())
         return jsEmptyString(exec);
-    return jsString(exec, args.at(exec, 0).toString(exec));
+    return jsString(exec, args.at(0).toString(exec));
 }
 
 CallType StringConstructor::getCallData(CallData& callData)
diff --git a/JavaScriptCore/runtime/StringObject.cpp b/JavaScriptCore/runtime/StringObject.cpp
index 093f5de..fb44498 100644
--- a/JavaScriptCore/runtime/StringObject.cpp
+++ b/JavaScriptCore/runtime/StringObject.cpp
@@ -61,7 +61,7 @@
     return JSObject::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-void StringObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void StringObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().length)
         return;
diff --git a/JavaScriptCore/runtime/StringObject.h b/JavaScriptCore/runtime/StringObject.h
index 540c576..ea3a045 100644
--- a/JavaScriptCore/runtime/StringObject.h
+++ b/JavaScriptCore/runtime/StringObject.h
@@ -36,16 +36,16 @@
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
 
-        virtual void put(ExecState* exec, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
-        static const ClassInfo info;
+        static const JS_EXPORTDATA ClassInfo info;
 
         JSString* internalValue() const { return asString(JSWrapperObject::internalValue());}
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
@@ -59,9 +59,9 @@
         virtual JSString* toThisJSString(ExecState*);
   };
 
-    StringObject* asStringObject(JSValuePtr);
+    StringObject* asStringObject(JSValue);
 
-    inline StringObject* asStringObject(JSValuePtr value)
+    inline StringObject* asStringObject(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&StringObject::info));
         return static_cast<StringObject*>(asObject(value));
diff --git a/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index 72c0f47..bc5c0a5 100644
--- a/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -42,7 +42,7 @@
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+        static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
             return Structure::create(proto, TypeInfo(ObjectType, MasqueradesAsUndefined)); 
         }
diff --git a/JavaScriptCore/runtime/StringPrototype.cpp b/JavaScriptCore/runtime/StringPrototype.cpp
index 9c58f85..d6939cb 100644
--- a/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/JavaScriptCore/runtime/StringPrototype.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "StringPrototype.h"
 
+#include "CachedCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "ObjectPrototype.h"
@@ -37,36 +38,36 @@
 
 ASSERT_CLASS_FITS_IN_CELL(StringPrototype);
 
-static JSValuePtr stringProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncCharAt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncCharCodeAt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncConcat(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncLastIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncMatch(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncReplace(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSearch(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSlice(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSplit(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSubstr(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSubstring(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncToLowerCase(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncToUpperCase(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncLocaleCompare(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState*, JSObject*, JSValue, const ArgList&);
 
-static JSValuePtr stringProtoFuncBig(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSmall(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncBlink(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncBold(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncFixed(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncItalics(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncStrike(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSub(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSup(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncFontcolor(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncFontsize(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncAnchor(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncLink(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncBig(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncBold(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSub(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSup(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -204,14 +205,14 @@
     return Collator::userDefault()->collate(reinterpret_cast<const ::UChar*>(a.data()), a.size(), reinterpret_cast<const ::UChar*>(b.data()), b.size());
 }
 
-JSValuePtr stringProtoFuncReplace(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSString* sourceVal = thisValue.toThisJSString(exec);
     const UString& source = sourceVal->value();
 
-    JSValuePtr pattern = args.at(exec, 0);
+    JSValue pattern = args.at(0);
 
-    JSValuePtr replacement = args.at(exec, 1);
+    JSValue replacement = args.at(1);
     UString replacementString;
     CallData callData;
     CallType callType = replacement.getCallData(callData);
@@ -231,71 +232,120 @@
         Vector<UString, 16> replacements;
 
         // This is either a loop (if global is set) or a one-way (if not).
-        do {
-            int matchIndex;
-            int matchLen;
-            int* ovector;
-            regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
-            if (matchIndex < 0)
-                break;
+        if (global && callType == CallTypeJS) {
+            // reg->numSubpatterns() + 1 for pattern args, + 2 for match start and sourceValue
+            int argCount = reg->numSubpatterns() + 1 + 2;
+            JSFunction* func = asFunction(replacement);
+            CachedCall cachedCall(exec, func, argCount, exec->exceptionSlot());
+            if (exec->hadException())
+                return jsNull();
+            while (true) {
+                int matchIndex;
+                int matchLen;
+                int* ovector;
+                regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
+                if (matchIndex < 0)
+                    break;
+                
+                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
 
-            sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
-
-            if (callType != CallTypeNone) {
                 int completeMatchStart = ovector[0];
-                ArgList args;
-
-                for (unsigned i = 0; i < reg->numSubpatterns() + 1; ++i) {
+                unsigned i = 0;
+                for (; i < reg->numSubpatterns() + 1; ++i) {
                     int matchStart = ovector[i * 2];
                     int matchLen = ovector[i * 2 + 1] - matchStart;
 
                     if (matchStart < 0)
-                        args.append(jsUndefined());
+                        cachedCall.setArgument(i, jsUndefined());
                     else
-                        args.append(jsSubstring(exec, source, matchStart, matchLen));
+                        cachedCall.setArgument(i, jsSubstring(exec, source, matchStart, matchLen));
                 }
 
-                args.append(jsNumber(exec, completeMatchStart));
-                args.append(sourceVal);
-
-                replacements.append(call(exec, replacement, callType, callData, exec->globalThisValue(), args).toString(exec));
+                cachedCall.setArgument(i++, jsNumber(exec, completeMatchStart));
+                cachedCall.setArgument(i++, sourceVal);
+                
+                cachedCall.setThis(exec->globalThisValue());
+                replacements.append(cachedCall.call().toString(cachedCall.newCallFrame()));
                 if (exec->hadException())
                     break;
-            } else
-                replacements.append(substituteBackreferences(replacementString, source, ovector, reg));
 
-            lastIndex = matchIndex + matchLen;
-            startPosition = lastIndex;
+                lastIndex = matchIndex + matchLen;
+                startPosition = lastIndex;
 
-            // special case of empty match
-            if (matchLen == 0) {
-                startPosition++;
-                if (startPosition > source.size())
+                // special case of empty match
+                if (matchLen == 0) {
+                    startPosition++;
+                    if (startPosition > source.size())
+                        break;
+                }
+            }            
+        } else {
+            do {
+                int matchIndex;
+                int matchLen;
+                int* ovector;
+                regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
+                if (matchIndex < 0)
                     break;
-            }
-        } while (global);
+
+                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
+
+                if (callType != CallTypeNone) {
+                    int completeMatchStart = ovector[0];
+                    MarkedArgumentBuffer args;
+
+                    for (unsigned i = 0; i < reg->numSubpatterns() + 1; ++i) {
+                        int matchStart = ovector[i * 2];
+                        int matchLen = ovector[i * 2 + 1] - matchStart;
+
+                        if (matchStart < 0)
+                            args.append(jsUndefined());
+                        else
+                            args.append(jsSubstring(exec, source, matchStart, matchLen));
+                    }
+
+                    args.append(jsNumber(exec, completeMatchStart));
+                    args.append(sourceVal);
+
+                    replacements.append(call(exec, replacement, callType, callData, exec->globalThisValue(), args).toString(exec));
+                    if (exec->hadException())
+                        break;
+                } else
+                    replacements.append(substituteBackreferences(replacementString, source, ovector, reg));
+
+                lastIndex = matchIndex + matchLen;
+                startPosition = lastIndex;
+
+                // special case of empty match
+                if (matchLen == 0) {
+                    startPosition++;
+                    if (startPosition > source.size())
+                        break;
+                }
+            } while (global);
+        }
+
+        if (!lastIndex && replacements.isEmpty())
+            return sourceVal;
 
         if (lastIndex < source.size())
             sourceRanges.append(UString::Range(lastIndex, source.size() - lastIndex));
 
-        UString result = source.spliceSubstringsWithSeparators(sourceRanges.data(), sourceRanges.size(), replacements.data(), replacements.size());
-
-        if (result == source)
-            return sourceVal;
-
-        return jsString(exec, result);
+        return jsString(exec, source.spliceSubstringsWithSeparators(sourceRanges.data(), sourceRanges.size(),
+            replacements.data(), replacements.size()));
     }
 
-    // First arg is a string
+    // Not a regular expression, so treat the pattern as a string.
+
     UString patternString = pattern.toString(exec);
     int matchPos = source.find(patternString);
-    int matchLen = patternString.size();
-    // Do the replacement
+
     if (matchPos == -1)
         return sourceVal;
 
+    int matchLen = patternString.size();
     if (callType != CallTypeNone) {
-        ArgList args;
+        MarkedArgumentBuffer args;
         args.append(jsSubstring(exec, source, matchPos, matchLen));
         args.append(jsNumber(exec, matchPos));
         args.append(sourceVal);
@@ -304,12 +354,10 @@
     }
 
     int ovector[2] = { matchPos, matchPos + matchLen };
-    return jsString(exec, source.substr(0, matchPos)
-        + substituteBackreferences(replacementString, source, ovector, 0)
-        + source.substr(matchPos + matchLen));
+    return jsString(exec, source.replaceRange(matchPos, matchLen, substituteBackreferences(replacementString, source, ovector, 0)));
 }
 
-JSValuePtr stringProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     // Also used for valueOf.
 
@@ -322,11 +370,11 @@
     return throwError(exec, TypeError);
 }
 
-JSValuePtr stringProtoFuncCharAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     unsigned len = s.size();
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
     if (a0.isUInt32Fast()) {
         uint32_t i = a0.getUInt32Fast();
         if (i < len)
@@ -339,11 +387,11 @@
     return jsEmptyString(exec);
 }
 
-JSValuePtr stringProtoFuncCharCodeAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     unsigned len = s.size();
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
     if (a0.isUInt32Fast()) {
         uint32_t i = a0.getUInt32Fast();
         if (i < len)
@@ -356,23 +404,23 @@
     return jsNaN(exec);
 }
 
-JSValuePtr stringProtoFuncConcat(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
 
     ArgList::const_iterator end = args.end();
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        s += (*it).jsValue(exec).toString(exec);
+        s += (*it).toString(exec);
     return jsString(exec, s);
 }
 
-JSValuePtr stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
     UString u2 = a0.toString(exec);
     int pos;
     if (a1.isUndefined())
@@ -391,13 +439,13 @@
     return jsNumber(exec, s.find(u2, pos));
 }
 
-JSValuePtr stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
     UString u2 = a0.toString(exec);
     double dpos = a1.toIntegerPreserveNaN(exec);
@@ -408,11 +456,11 @@
     return jsNumber(exec, s.rfind(u2, static_cast<int>(dpos)));
 }
 
-JSValuePtr stringProtoFuncMatch(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
 
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
 
     UString u = s;
     RefPtr<RegExp> reg;
@@ -439,7 +487,7 @@
     }
 
     // return array of matches
-    ArgList list;
+    MarkedArgumentBuffer list;
     int lastIndex = 0;
     while (pos >= 0) {
         list.append(jsSubstring(exec, u, pos, matchLength));
@@ -459,11 +507,11 @@
     return constructArray(exec, list);
 }
 
-JSValuePtr stringProtoFuncSearch(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
 
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
 
     UString u = s;
     RefPtr<RegExp> reg;
@@ -484,13 +532,13 @@
     return jsNumber(exec, pos);
 }
 
-JSValuePtr stringProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
     // The arg processing is very much like ArrayProtoFunc::Slice
     double start = a0.toInteger(exec);
@@ -508,12 +556,12 @@
     return jsEmptyString(exec);
 }
 
-JSValuePtr stringProtoFuncSplit(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
     JSArray* result = constructEmptyArray(exec);
     unsigned i = 0;
@@ -570,13 +618,13 @@
     return result;
 }
 
-JSValuePtr stringProtoFuncSubstr(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
     double start = a0.toInteger(exec);
     double length = a1.isUndefined() ? len : a1.toInteger(exec);
@@ -592,13 +640,13 @@
     return jsSubstring(exec, s, static_cast<unsigned>(start), static_cast<unsigned>(length));
 }
 
-JSValuePtr stringProtoFuncSubstring(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
     double start = a0.toNumber(exec);
     double end = a1.toNumber(exec);
@@ -624,7 +672,7 @@
     return jsSubstring(exec, s, static_cast<unsigned>(start), static_cast<unsigned>(end) - static_cast<unsigned>(start));
 }
 
-JSValuePtr stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSString* sVal = thisValue.toThisJSString(exec);
     const UString& s = sVal->value();
@@ -658,7 +706,7 @@
     return jsString(exec, UString(buffer.releaseBuffer(), length, false));
 }
 
-JSValuePtr stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSString* sVal = thisValue.toThisJSString(exec);
     const UString& s = sVal->value();
@@ -692,81 +740,81 @@
     return jsString(exec, UString(buffer.releaseBuffer(), length, false));
 }
 
-JSValuePtr stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (args.size() < 1)
       return jsNumber(exec, 0);
 
     UString s = thisValue.toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
     return jsNumber(exec, localeCompare(s, a0.toString(exec)));
 }
 
-JSValuePtr stringProtoFuncBig(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
     return jsNontrivialString(exec, "<big>" + s + "</big>");
 }
 
-JSValuePtr stringProtoFuncSmall(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
     return jsNontrivialString(exec, "<small>" + s + "</small>");
 }
 
-JSValuePtr stringProtoFuncBlink(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
     return jsNontrivialString(exec, "<blink>" + s + "</blink>");
 }
 
-JSValuePtr stringProtoFuncBold(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncBold(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
     return jsNontrivialString(exec, "<b>" + s + "</b>");
 }
 
-JSValuePtr stringProtoFuncFixed(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
     return jsString(exec, "<tt>" + s + "</tt>");
 }
 
-JSValuePtr stringProtoFuncItalics(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
     return jsNontrivialString(exec, "<i>" + s + "</i>");
 }
 
-JSValuePtr stringProtoFuncStrike(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
     return jsNontrivialString(exec, "<strike>" + s + "</strike>");
 }
 
-JSValuePtr stringProtoFuncSub(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncSub(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
     return jsNontrivialString(exec, "<sub>" + s + "</sub>");
 }
 
-JSValuePtr stringProtoFuncSup(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncSup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
     return jsNontrivialString(exec, "<sup>" + s + "</sup>");
 }
 
-JSValuePtr stringProtoFuncFontcolor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
     return jsNontrivialString(exec, "<font color=\"" + a0.toString(exec) + "\">" + s + "</font>");
 }
 
-JSValuePtr stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
 
     uint32_t smallInteger;
     if (a0.getUInt32(smallInteger) && smallInteger <= 9) {
@@ -804,17 +852,17 @@
     return jsNontrivialString(exec, "<font size=\"" + a0.toString(exec) + "\">" + s + "</font>");
 }
 
-JSValuePtr stringProtoFuncAnchor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
     return jsNontrivialString(exec, "<a name=\"" + a0.toString(exec) + "\">" + s + "</a>");
 }
 
-JSValuePtr stringProtoFuncLink(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
     UString linkText = a0.toString(exec);
 
     unsigned linkTextSize = linkText.size();
diff --git a/JavaScriptCore/runtime/Structure.cpp b/JavaScriptCore/runtime/Structure.cpp
index f702221..3597a5c 100644
--- a/JavaScriptCore/runtime/Structure.cpp
+++ b/JavaScriptCore/runtime/Structure.cpp
@@ -120,12 +120,10 @@
 #endif
 }
 
-Structure::Structure(JSValuePtr prototype, const TypeInfo& typeInfo)
+Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
     : m_typeInfo(typeInfo)
     , m_prototype(prototype)
-    , m_cachedPrototypeChain(0)
-    , m_previous(0)
-    , m_nameInPrevious(0)
+    , m_specificValueInPrevious(0)
     , m_propertyTable(0)
     , m_propertyStorageCapacity(JSObject::inlineStorageCapacity)
     , m_offset(noOffset)
@@ -161,8 +159,8 @@
         if (m_previous->m_usingSingleTransitionSlot) {
             m_previous->m_transitions.singleTransition = 0;
         } else {
-            ASSERT(m_previous->m_transitions.table->contains(make_pair(m_nameInPrevious.get(), m_attributesInPrevious)));
-            m_previous->m_transitions.table->remove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious));
+            ASSERT(m_previous->m_transitions.table->contains(make_pair(m_nameInPrevious.get(), make_pair(m_attributesInPrevious, m_specificValueInPrevious))));
+            m_previous->m_transitions.table->remove(make_pair(m_nameInPrevious.get(), make_pair(m_attributesInPrevious, m_specificValueInPrevious)));
         }
     }
 
@@ -282,59 +280,34 @@
     for (ptrdiff_t i = structures.size() - 2; i >= 0; --i) {
         structure = structures[i];
         structure->m_nameInPrevious->ref();
-        PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, ++m_propertyTable->lastIndexUsed); 
+        PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
         insertIntoPropertyMapHashTable(entry);
     }
 }
 
 void Structure::getEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
 {
-    bool shouldCache = propertyNames.cacheable() && !(propertyNames.size() || m_isDictionary);
+    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || m_isDictionary);
 
-    if (shouldCache) {
-        if (m_cachedPropertyNameArrayData) {
-            if (structureChainsAreEqual(m_cachedPropertyNameArrayData->cachedPrototypeChain(), cachedPrototypeChain())) {
-                propertyNames.setData(m_cachedPropertyNameArrayData);
-                return;
-            }
+    if (shouldCache && m_cachedPropertyNameArrayData) {
+        if (m_cachedPropertyNameArrayData->cachedPrototypeChain() == prototypeChain(exec)) {
+            propertyNames.setData(m_cachedPropertyNameArrayData);
+            return;
         }
-        propertyNames.setCacheable(false);
+        clearEnumerationCache();
     }
 
-    getEnumerablePropertyNamesInternal(propertyNames);
+    getEnumerableNamesFromPropertyTable(propertyNames);
+    getEnumerableNamesFromClassInfoTable(exec, baseObject->classInfo(), propertyNames);
 
-    // Add properties from the static hashtables of properties
-    for (const ClassInfo* info = baseObject->classInfo(); info; info = info->parentClass) {
-        const HashTable* table = info->propHashTable(exec);
-        if (!table)
-            continue;
-        table->initializeIfNeeded(exec);
-        ASSERT(table->table);
-#if ENABLE(PERFECT_HASH_SIZE)
-        int hashSizeMask = table->hashSizeMask;
-#else
-        int hashSizeMask = table->compactSize - 1;
-#endif
-        const HashEntry* entry = table->table;
-        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
-            if (entry->key() && !(entry->attributes() & DontEnum))
-                propertyNames.add(entry->key());
-        }
-    }
-
-    if (m_prototype.isObject())
+    if (m_prototype.isObject()) {
+        propertyNames.setShouldCache(false); // No need for our prototypes to waste memory on caching, since they're not being enumerated directly.
         asObject(m_prototype)->getPropertyNames(exec, propertyNames);
+    }
 
     if (shouldCache) {
-        if (m_cachedPropertyNameArrayData)
-            m_cachedPropertyNameArrayData->setCachedStructure(0);
-
         m_cachedPropertyNameArrayData = propertyNames.data();
-
-        StructureChain* chain = cachedPrototypeChain();
-        if (!chain)
-            chain = createCachedPrototypeChain();
-        m_cachedPropertyNameArrayData->setCachedPrototypeChain(chain);
+        m_cachedPropertyNameArrayData->setCachedPrototypeChain(prototypeChain(exec));
         m_cachedPropertyNameArrayData->setCachedStructure(this);
     }
 }
@@ -354,20 +327,69 @@
         m_propertyStorageCapacity *= 2;
 }
 
-PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, size_t& offset)
+void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
+{
+    const UString::Rep* rep = propertyName._ustring.rep();
+
+    materializePropertyMapIfNecessary();
+
+    ASSERT(m_isDictionary);
+    ASSERT(m_propertyTable);
+
+    unsigned i = rep->computedHash();
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numProbes;
+#endif
+
+    unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+    ASSERT(entryIndex != emptyEntryIndex);
+
+    if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+        m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+        return;
+    }
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numCollisions;
+#endif
+
+    unsigned k = 1 | doubleHash(rep->computedHash());
+
+    while (1) {
+        i += k;
+
+#if DUMP_PROPERTYMAP_STATS
+        ++numRehashes;
+#endif
+
+        entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+        ASSERT(entryIndex != emptyEntryIndex);
+
+        if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+            m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+            return;
+        }
+    }
+}
+
+PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
     ASSERT(!structure->m_isDictionary);
     ASSERT(structure->typeInfo().type() == ObjectType);
 
     if (structure->m_usingSingleTransitionSlot) {
         Structure* existingTransition = structure->m_transitions.singleTransition;
-        if (existingTransition && existingTransition->m_nameInPrevious.get() == propertyName.ustring().rep() && existingTransition->m_attributesInPrevious == attributes) {
+        if (existingTransition && existingTransition->m_nameInPrevious.get() == propertyName.ustring().rep()
+            && existingTransition->m_attributesInPrevious == attributes
+            && existingTransition->m_specificValueInPrevious == specificValue) {
+
             ASSERT(structure->m_transitions.singleTransition->m_offset != noOffset);
             offset = structure->m_transitions.singleTransition->m_offset;
             return existingTransition;
         }
     } else {
-        if (Structure* existingTransition = structure->m_transitions.table->get(make_pair(propertyName.ustring().rep(), attributes))) {
+        if (Structure* existingTransition = structure->m_transitions.table->get(make_pair(propertyName.ustring().rep(), make_pair(attributes, specificValue)))) {
             ASSERT(existingTransition->m_offset != noOffset);
             offset = existingTransition->m_offset;
             return existingTransition;
@@ -377,25 +399,27 @@
     return 0;
 }
 
-PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, const Identifier& propertyName, unsigned attributes, size_t& offset)
+PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
     ASSERT(!structure->m_isDictionary);
     ASSERT(structure->typeInfo().type() == ObjectType);
-    ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, offset));
+    ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
 
     if (structure->transitionCount() > s_maxTransitionLength) {
         RefPtr<Structure> transition = toDictionaryTransition(structure);
-        offset = transition->put(propertyName, attributes);
+        offset = transition->put(propertyName, attributes, specificValue);
         if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
             transition->growPropertyStorageCapacity();
         return transition.release();
     }
 
     RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+
     transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
     transition->m_previous = structure;
     transition->m_nameInPrevious = propertyName.ustring().rep();
     transition->m_attributesInPrevious = attributes;
+    transition->m_specificValueInPrevious = specificValue;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
 
@@ -413,7 +437,7 @@
             transition->createPropertyMapHashTable();
     }
 
-    offset = transition->put(propertyName, attributes);
+    offset = transition->put(propertyName, attributes, specificValue);
     if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
         transition->growPropertyStorageCapacity();
 
@@ -429,9 +453,9 @@
         structure->m_usingSingleTransitionSlot = false;
         StructureTransitionTable* transitionTable = new StructureTransitionTable;
         structure->m_transitions.table = transitionTable;
-        transitionTable->add(make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition);
+        transitionTable->add(make_pair(existingTransition->m_nameInPrevious.get(), make_pair(existingTransition->m_attributesInPrevious, existingTransition->m_specificValueInPrevious)), existingTransition);
     }
-    structure->m_transitions.table->add(make_pair(propertyName.ustring().rep(), attributes), transition.get());
+    structure->m_transitions.table->add(make_pair(propertyName.ustring().rep(), make_pair(attributes, specificValue)), transition.get());
     return transition.release();
 }
 
@@ -446,7 +470,7 @@
     return transition.release();
 }
 
-PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValuePtr prototype)
+PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValue prototype)
 {
     RefPtr<Structure> transition = create(prototype, structure->typeInfo());
 
@@ -462,6 +486,25 @@
     return transition.release();
 }
 
+PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structure, const Identifier& replaceFunction)
+{
+    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+
+    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
+    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+
+    // Don't set m_offset, as one can not transition to this.
+
+    structure->materializePropertyMapIfNecessary();
+    transition->m_propertyTable = structure->copyPropertyTable();
+    transition->m_isPinnedPropertyTable = true;
+
+    bool removed = transition->despecifyFunction(replaceFunction);
+    ASSERT_UNUSED(removed, removed);
+
+    return transition.release();
+}
+
 PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
 {
     RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
@@ -509,14 +552,14 @@
     return structure;
 }
 
-size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes)
+size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!m_transitions.singleTransition);
 
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
-    size_t offset = put(propertyName, attributes);
+    size_t offset = put(propertyName, attributes, specificValue);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
     clearEnumerationCache();
@@ -536,20 +579,6 @@
     return offset;
 }
 
-StructureChain* Structure::createCachedPrototypeChain()
-{
-    ASSERT(typeInfo().type() == ObjectType);
-    ASSERT(!m_cachedPrototypeChain);
-
-    JSValuePtr prototype = storedPrototype();
-    if (!prototype.isCell())
-        return 0;
-
-    RefPtr<StructureChain> chain = StructureChain::create(asObject(prototype)->structure());
-    setCachedPrototypeChain(chain.release());
-    return cachedPrototypeChain();
-}
-
 #if DUMP_PROPERTYMAP_STATS
 
 static int numProbes;
@@ -606,16 +635,12 @@
     return newTable;
 }
 
-size_t Structure::get(const Identifier& propertyName, unsigned& attributes)
+size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& specificValue)
 {
-    ASSERT(!propertyName.isNull());
-
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
         return notFound;
 
-    UString::Rep* rep = propertyName._ustring.rep();
-
     unsigned i = rep->computedHash();
 
 #if DUMP_PROPERTYMAP_STATS
@@ -628,6 +653,7 @@
 
     if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
         attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
+        specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
         return m_propertyTable->entries()[entryIndex - 1].offset;
     }
 
@@ -650,12 +676,64 @@
 
         if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
             attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
+            specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
             return m_propertyTable->entries()[entryIndex - 1].offset;
         }
     }
 }
 
-size_t Structure::put(const Identifier& propertyName, unsigned attributes)
+bool Structure::despecifyFunction(const Identifier& propertyName)
+{
+    ASSERT(!propertyName.isNull());
+
+    materializePropertyMapIfNecessary();
+    if (!m_propertyTable)
+        return false;
+
+    UString::Rep* rep = propertyName._ustring.rep();
+
+    unsigned i = rep->computedHash();
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numProbes;
+#endif
+
+    unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+    if (entryIndex == emptyEntryIndex)
+        return false;
+
+    if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+        ASSERT(m_propertyTable->entries()[entryIndex - 1].specificValue);
+        m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+        return true;
+    }
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numCollisions;
+#endif
+
+    unsigned k = 1 | doubleHash(rep->computedHash());
+
+    while (1) {
+        i += k;
+
+#if DUMP_PROPERTYMAP_STATS
+        ++numRehashes;
+#endif
+
+        entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+        if (entryIndex == emptyEntryIndex)
+            return false;
+
+        if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+            ASSERT(m_propertyTable->entries()[entryIndex - 1].specificValue);
+            m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+            return true;
+        }
+    }
+}
+
+size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!propertyName.isNull());
     ASSERT(get(propertyName) == notFound);
@@ -725,6 +803,7 @@
     rep->ref();
     m_propertyTable->entries()[entryIndex - 1].key = rep;
     m_propertyTable->entries()[entryIndex - 1].attributes = attributes;
+    m_propertyTable->entries()[entryIndex - 1].specificValue = specificValue;
     m_propertyTable->entries()[entryIndex - 1].index = ++m_propertyTable->lastIndexUsed;
 
     unsigned newOffset;
@@ -797,6 +876,7 @@
     key->deref();
     m_propertyTable->entries()[entryIndex - 1].key = 0;
     m_propertyTable->entries()[entryIndex - 1].attributes = 0;
+    m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
     m_propertyTable->entries()[entryIndex - 1].offset = 0;
 
     if (!m_propertyTable->deletedOffsets)
@@ -924,7 +1004,7 @@
     return 0;
 }
 
-void Structure::getEnumerablePropertyNamesInternal(PropertyNameArray& propertyNames)
+void Structure::getEnumerableNamesFromPropertyTable(PropertyNameArray& propertyNames)
 {
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
@@ -981,6 +1061,25 @@
     }
 }
 
+void Structure::getEnumerableNamesFromClassInfoTable(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
+{
+    // Add properties from the static hashtables of properties
+    for (; classInfo; classInfo = classInfo->parentClass) {
+        const HashTable* table = classInfo->propHashTable(exec);
+        if (!table)
+            continue;
+        table->initializeIfNeeded(exec);
+        ASSERT(table->table);
+
+        int hashSizeMask = table->compactSize - 1;
+        const HashEntry* entry = table->table;
+        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
+            if (entry->key() && !(entry->attributes() & DontEnum))
+                propertyNames.add(entry->key());
+        }
+    }
+}
+
 #if DO_PROPERTYMAP_CONSTENCY_CHECK
 
 void Structure::checkConsistency()
diff --git a/JavaScriptCore/runtime/Structure.h b/JavaScriptCore/runtime/Structure.h
index 569738b..866999d 100644
--- a/JavaScriptCore/runtime/Structure.h
+++ b/JavaScriptCore/runtime/Structure.h
@@ -51,7 +51,7 @@
     class Structure : public RefCounted<Structure> {
     public:
         friend class JIT;
-        static PassRefPtr<Structure> create(JSValuePtr prototype, const TypeInfo& typeInfo)
+        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo)
         {
             return adoptRef(new Structure(prototype, typeInfo));
         }
@@ -61,10 +61,11 @@
 
         static void dumpStatistics();
 
-        static PassRefPtr<Structure> addPropertyTransition(Structure*, const Identifier& propertyName, unsigned attributes, size_t& offset);
-        static PassRefPtr<Structure> addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, size_t& offset);
+        static PassRefPtr<Structure> addPropertyTransition(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
+        static PassRefPtr<Structure> addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
         static PassRefPtr<Structure> removePropertyTransition(Structure*, const Identifier& propertyName, size_t& offset);
-        static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValuePtr prototype);
+        static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValue prototype);
+        static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);        
         static PassRefPtr<Structure> getterSetterTransition(Structure*);
         static PassRefPtr<Structure> toDictionaryTransition(Structure*);
         static PassRefPtr<Structure> fromDictionaryTransition(Structure*);
@@ -78,29 +79,33 @@
         }
 
         // These should be used with caution.  
-        size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes);
+        size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t removePropertyWithoutTransition(const Identifier& propertyName);
-        void setPrototypeWithoutTransition(JSValuePtr prototype) { m_prototype = prototype; }
+        void setPrototypeWithoutTransition(JSValue prototype) { m_prototype = prototype; }
 
         bool isDictionary() const { return m_isDictionary; }
 
         const TypeInfo& typeInfo() const { return m_typeInfo; }
 
-        JSValuePtr storedPrototype() const { return m_prototype; }
-        JSValuePtr prototypeForLookup(ExecState*); 
+        JSValue storedPrototype() const { return m_prototype; }
+        JSValue prototypeForLookup(ExecState*) const;
+        StructureChain* prototypeChain(ExecState*) const;
 
         Structure* previousID() const { return m_previous.get(); }
 
-        StructureChain* createCachedPrototypeChain();
-        void setCachedPrototypeChain(PassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
-        StructureChain* cachedPrototypeChain() const { return m_cachedPrototypeChain.get(); }
-
         void growPropertyStorageCapacity();
         size_t propertyStorageCapacity() const { return m_propertyStorageCapacity; }
         size_t propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
+        bool isUsingInlineStorage() const;
 
         size_t get(const Identifier& propertyName);
-        size_t get(const Identifier& propertyName, unsigned& attributes);
+        size_t get(const UString::Rep* rep, unsigned& attributes, JSCell*& specificValue);
+        size_t get(const Identifier& propertyName, unsigned& attributes, JSCell*& specificValue)
+        {
+            ASSERT(!propertyName.isNull());
+            return get(propertyName._ustring.rep(), attributes, specificValue);
+        }
+
         void getEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
 
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
@@ -108,12 +113,16 @@
 
         bool isEmpty() const { return m_propertyTable ? !m_propertyTable->keyCount : m_offset == noOffset; }
 
-    private:
-        Structure(JSValuePtr prototype, const TypeInfo&);
+        JSCell* specificValue() { return m_specificValueInPrevious; }
+        void despecifyDictionaryFunction(const Identifier& propertyName);
 
-        size_t put(const Identifier& propertyName, unsigned attributes);
+    private:
+        Structure(JSValue prototype, const TypeInfo&);
+
+        size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
-        void getEnumerablePropertyNamesInternal(PropertyNameArray&);
+        void getEnumerableNamesFromPropertyTable(PropertyNameArray&);
+        void getEnumerableNamesFromClassInfoTable(ExecState*, const ClassInfo*, PropertyNameArray&);
 
         void expandPropertyMapHashTable();
         void rehashPropertyMapHashTable();
@@ -123,6 +132,8 @@
         void insertIntoPropertyMapHashTable(const PropertyMapEntry&);
         void checkConsistency();
 
+        bool despecifyFunction(const Identifier&);
+
         PropertyMapHashTable* copyPropertyTable();
         void materializePropertyMap();
         void materializePropertyMapIfNecessary()
@@ -134,16 +145,13 @@
 
         void clearEnumerationCache();
 
-        void* addressOfCount()
-        {
-            return &m_refCount;
-        }
-
         signed char transitionCount() const
         {
             // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
             return m_offset == noOffset ? 0 : m_offset + 1;
         }
+        
+        bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
 
         static const unsigned emptyEntryIndex = 0;
     
@@ -153,8 +161,8 @@
 
         TypeInfo m_typeInfo;
 
-        JSValuePtr m_prototype;
-        RefPtr<StructureChain> m_cachedPrototypeChain;
+        JSValue m_prototype;
+        mutable RefPtr<StructureChain> m_cachedPrototypeChain;
 
         RefPtr<Structure> m_previous;
         RefPtr<UString::Rep> m_nameInPrevious;
@@ -163,6 +171,7 @@
             Structure* singleTransition;
             StructureTransitionTable* table;
         } m_transitions;
+        JSCell* m_specificValueInPrevious;
 
         RefPtr<PropertyNameArrayData> m_cachedPropertyNameArrayData;
 
@@ -175,7 +184,7 @@
         bool m_isPinnedPropertyTable : 1;
         bool m_hasGetterSetterProperties : 1;
         bool m_usingSingleTransitionSlot : 1;
-        unsigned m_attributesInPrevious : 5;
+        unsigned m_attributesInPrevious : 7;
     };
 
     inline size_t Structure::get(const Identifier& propertyName)
diff --git a/JavaScriptCore/runtime/StructureChain.cpp b/JavaScriptCore/runtime/StructureChain.cpp
index 4d00263..085876c 100644
--- a/JavaScriptCore/runtime/StructureChain.cpp
+++ b/JavaScriptCore/runtime/StructureChain.cpp
@@ -32,42 +32,18 @@
 
 namespace JSC {
 
-StructureChain::StructureChain(Structure* structure)
+StructureChain::StructureChain(Structure* head)
 {
-    size_t size = 1;
-
-    Structure* tmp = structure;
-    while (!tmp->storedPrototype().isNull()) {
+    size_t size = 0;
+    for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
         ++size;
-        tmp = asCell(tmp->storedPrototype())->structure();
-    }
     
     m_vector.set(new RefPtr<Structure>[size + 1]);
 
-    size_t i;
-    for (i = 0; i < size - 1; ++i) {
-        m_vector[i] = structure;
-        structure = asObject(structure->storedPrototype())->structure();
-    }
-    m_vector[i] = structure;
-    m_vector[i + 1] = 0;
-}
-
-bool structureChainsAreEqual(StructureChain* chainA, StructureChain* chainB)
-{
-    if (!chainA || !chainB)
-        return false;
-
-    RefPtr<Structure>* a = chainA->head();
-    RefPtr<Structure>* b = chainB->head();
-    while (1) {
-        if (*a != *b)
-            return false;
-        if (!*a)
-            return true;
-        a++;
-        b++;
-    }
+    size_t i = 0;
+    for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
+        m_vector[i++] = current;
+    m_vector[i] = 0;
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/StructureChain.h b/JavaScriptCore/runtime/StructureChain.h
index a3a1be2..795e649 100644
--- a/JavaScriptCore/runtime/StructureChain.h
+++ b/JavaScriptCore/runtime/StructureChain.h
@@ -37,18 +37,15 @@
 
     class StructureChain : public RefCounted<StructureChain> {
     public:
-        static PassRefPtr<StructureChain> create(Structure* structure) { return adoptRef(new StructureChain(structure)); }
-
+        static PassRefPtr<StructureChain> create(Structure* head) { return adoptRef(new StructureChain(head)); }
         RefPtr<Structure>* head() { return m_vector.get(); }
 
     private:
-        StructureChain(Structure* structure);
+        StructureChain(Structure* head);
 
         OwnArrayPtr<RefPtr<Structure> > m_vector;
     };
 
-    bool structureChainsAreEqual(StructureChain*, StructureChain*);
-
 } // namespace JSC
 
 #endif // StructureChain_h
diff --git a/JavaScriptCore/runtime/StructureTransitionTable.h b/JavaScriptCore/runtime/StructureTransitionTable.h
index 1543049..804cbeb 100644
--- a/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -37,7 +37,7 @@
     class Structure;
 
     struct StructureTransitionTableHash {
-        typedef std::pair<RefPtr<UString::Rep>, unsigned> Key;
+        typedef std::pair<RefPtr<UString::Rep>, std::pair<unsigned, JSCell*> > Key;
         static unsigned hash(const Key& p)
         {
             return p.first->computedHash();
@@ -53,13 +53,14 @@
 
     struct StructureTransitionTableHashTraits {
         typedef WTF::HashTraits<RefPtr<UString::Rep> > FirstTraits;
-        typedef WTF::GenericHashTraits<unsigned> SecondTraits;
-        typedef std::pair<FirstTraits::TraitType, SecondTraits::TraitType> TraitType;
+        typedef WTF::GenericHashTraits<unsigned> SecondFirstTraits;
+        typedef WTF::GenericHashTraits<JSCell*> SecondSecondTraits;
+        typedef std::pair<FirstTraits::TraitType, std::pair<SecondFirstTraits::TraitType, SecondSecondTraits::TraitType> > TraitType;
 
-        static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondTraits::emptyValueIsZero;
-        static TraitType emptyValue() { return std::make_pair(FirstTraits::emptyValue(), SecondTraits::emptyValue()); }
+        static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondFirstTraits::emptyValueIsZero && SecondSecondTraits::emptyValueIsZero;
+        static TraitType emptyValue() { return std::make_pair(FirstTraits::emptyValue(), std::make_pair(SecondFirstTraits::emptyValue(), SecondSecondTraits::emptyValue())); }
 
-        static const bool needsDestruction = FirstTraits::needsDestruction || SecondTraits::needsDestruction;
+        static const bool needsDestruction = FirstTraits::needsDestruction || SecondFirstTraits::needsDestruction || SecondSecondTraits::needsDestruction;
 
         static void constructDeletedValue(TraitType& slot) { FirstTraits::constructDeletedValue(slot.first); }
         static bool isDeletedValue(const TraitType& value) { return FirstTraits::isDeletedValue(value.first); }
diff --git a/JavaScriptCore/runtime/TypeInfo.h b/JavaScriptCore/runtime/TypeInfo.h
index 52da347..70aeed3 100644
--- a/JavaScriptCore/runtime/TypeInfo.h
+++ b/JavaScriptCore/runtime/TypeInfo.h
@@ -35,13 +35,22 @@
     static const unsigned MasqueradesAsUndefined = 1;
     static const unsigned ImplementsHasInstance = 1 << 1;
     static const unsigned OverridesHasInstance = 1 << 2;
-    static const unsigned NeedsThisConversion = 1 << 3;
-    static const unsigned HasStandardGetOwnPropertySlot = 1 << 4;
+    static const unsigned ImplementsDefaultHasInstance = 1 << 3;
+    static const unsigned NeedsThisConversion = 1 << 4;
+    static const unsigned HasStandardGetOwnPropertySlot = 1 << 5;
 
     class TypeInfo {
         friend class JIT;
     public:
-        TypeInfo(JSType type, unsigned flags = 0) : m_type(type), m_flags(flags) { }
+        TypeInfo(JSType type, unsigned flags = 0)
+            : m_type(type)
+        {
+            // ImplementsDefaultHasInstance means (ImplementsHasInstance & !OverridesHasInstance)
+            if ((flags & (ImplementsHasInstance | OverridesHasInstance)) == ImplementsHasInstance)
+                m_flags = flags | ImplementsDefaultHasInstance;
+            else
+                m_flags = flags;
+        }
 
         JSType type() const { return m_type; }
 
diff --git a/JavaScriptCore/runtime/UString.cpp b/JavaScriptCore/runtime/UString.cpp
index 024d6a1..0eb46da 100644
--- a/JavaScriptCore/runtime/UString.cpp
+++ b/JavaScriptCore/runtime/UString.cpp
@@ -1,8 +1,8 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
- *  Copyright (c) 2009, Google Inc. All rights reserved.
+ *  Copyright (C) 2009 Google Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -62,6 +62,9 @@
 extern const double NaN;
 extern const double Inf;
 
+// This number must be at least 2 to avoid sharing empty, null as well as 1 character strings from SmallStrings.
+static const int minLengthToShare = 30;
+
 static inline size_t overflowIndicator() { return std::numeric_limits<size_t>::max(); }
 static inline size_t maxUChars() { return std::numeric_limits<size_t>::max() / sizeof(UChar); }
 
@@ -191,30 +194,20 @@
 UString::BaseString* UString::Rep::emptyBaseString;
 UString* UString::nullUString;
 
-static void initializeStaticBaseString(int len, UChar* buf, UString::BaseString& base)
+static void initializeStaticBaseString(UString::BaseString& base)
 {
-    base.offset = 0;
-    base.len = len;
     base.rc = INT_MAX / 2;
-    base._hash = 0;
     base.m_identifierTableAndFlags.setFlag(UString::Rep::StaticFlag);
-    base.m_baseString = 0;
-    base.buf = buf;
-    base.preCapacity = 0;
-    base.usedPreCapacity = 0;
-    base.capacity = 0;
-    base.usedCapacity = 0;
-    base.reportedCost = 0;
     base.checkConsistency();
 }
 
 void initializeUString()
 {
-    UString::Rep::nullBaseString = new UString::BaseString;
-    initializeStaticBaseString(0, 0, *UString::Rep::nullBaseString);
+    UString::Rep::nullBaseString = new UString::BaseString(0, 0);
+    initializeStaticBaseString(*UString::Rep::nullBaseString);
 
-    UString::Rep::emptyBaseString = new UString::BaseString;
-    initializeStaticBaseString(0, &sharedEmptyChar, *UString::Rep::emptyBaseString);
+    UString::Rep::emptyBaseString = new UString::BaseString(&sharedEmptyChar, 0);
+    initializeStaticBaseString(*UString::Rep::emptyBaseString);
 
     UString::nullUString = new UString;
 }
@@ -228,52 +221,6 @@
     return create(copyD, l);
 }
 
-PassRefPtr<UString::Rep> UString::Rep::create(UChar* d, int l)
-{
-    BaseString* r = new BaseString;
-    r->offset = 0;
-    r->len = l;
-    r->rc = 1;
-    r->_hash = 0;
-    r->m_baseString = 0;
-    r->reportedCost = 0;
-    r->buf = d;
-    r->usedCapacity = l;
-    r->capacity = l;
-    r->usedPreCapacity = 0;
-    r->preCapacity = 0;
-
-    r->checkConsistency();
-
-    // steal the single reference this Rep was created with
-    return adoptRef(r);
-}
-
-PassRefPtr<UString::Rep> UString::Rep::create(PassRefPtr<Rep> rep, int offset, int length)
-{
-    ASSERT(rep);
-    rep->checkConsistency();
-
-    int repOffset = rep->offset;
-
-    PassRefPtr<BaseString> base = rep->baseString();
-
-    ASSERT(-(offset + repOffset) <= base->usedPreCapacity);
-    ASSERT(offset + repOffset + length <= base->usedCapacity);
-
-    Rep* r = new Rep;
-    r->offset = repOffset + offset;
-    r->len = length;
-    r->rc = 1;
-    r->_hash = 0;
-    r->setBaseString(base);
-
-    r->checkConsistency();
-
-    // steal the single reference this Rep was created with
-    return adoptRef(r);
-}
-
 PassRefPtr<UString::Rep> UString::Rep::createFromUTF8(const char* string)
 {
     if (!string)
@@ -288,6 +235,14 @@
     return UString::Rep::createCopying(buffer.data(), p - buffer.data());
 }
 
+PassRefPtr<UString::Rep> UString::Rep::create(UChar* string, int length, PassRefPtr<UString::SharedUChar> sharedBuffer)
+{
+    PassRefPtr<UString::Rep> rep = create(string, length);
+    rep->baseString()->setSharedBuffer(sharedBuffer);
+    rep->checkConsistency();
+    return rep;
+}
+
 void UString::Rep::destroy()
 {
     checkConsistency();
@@ -297,10 +252,14 @@
     if (!isStatic()) {
         if (identifierTable())
             Identifier::remove(this);
+
         UString::BaseString* base = baseString();
-        if (base == this)
-            fastFree(base->buf);
-        else
+        if (base == this) {
+            if (m_sharedBuffer)
+                m_sharedBuffer->deref();
+            else
+                fastFree(base->buf);
+        } else
             base->deref();
 
         delete this;
@@ -424,25 +383,92 @@
 }
 #endif
 
-// put these early so they can be inlined
-static inline size_t expandedSize(size_t size, size_t otherSize)
+UString::SharedUChar* UString::BaseString::sharedBuffer()
 {
-    // Do the size calculation in two parts, returning overflowIndicator if
-    // we overflow the maximum value that we can handle.
 
-    if (size > maxUChars())
+    if (len < minLengthToShare)
+        return 0;
+
+    if (!m_sharedBuffer)
+        setSharedBuffer(SharedUChar::create(new OwnFastMallocPtr<UChar>(buf)));
+    return m_sharedBuffer;
+}
+
+void UString::BaseString::setSharedBuffer(PassRefPtr<UString::SharedUChar> sharedBuffer)
+{
+    // The manual steps below are because m_sharedBuffer can't be a RefPtr. m_sharedBuffer
+    // is in a union with another variable to avoid making BaseString any larger.
+    if (m_sharedBuffer)
+        m_sharedBuffer->deref();
+    m_sharedBuffer = sharedBuffer.releaseRef();
+}
+
+bool UString::BaseString::slowIsBufferReadOnly()
+{
+    // The buffer may not be modified as soon as the underlying data has been shared with another class.
+    if (m_sharedBuffer->isShared())
+        return true;
+
+    // At this point, we know it that the underlying buffer isn't shared outside of this base class,
+    // so get rid of m_sharedBuffer.
+    OwnPtr<OwnFastMallocPtr<UChar> > mallocPtr(m_sharedBuffer->release());
+    UChar* unsharedBuf = const_cast<UChar*>(mallocPtr->release());
+    setSharedBuffer(0);
+    preCapacity += (buf - unsharedBuf);
+    buf = unsharedBuf;
+    return false;
+}
+
+// Put these early so they can be inlined.
+static inline size_t expandedSize(size_t capacitySize, size_t precapacitySize)
+{
+    // Combine capacitySize & precapacitySize to produce a single size to allocate,
+    // check that doing so does not result in overflow.
+    size_t size = capacitySize + precapacitySize;
+    if (size < capacitySize)
         return overflowIndicator();
 
-    size_t expandedSize = ((size + 10) / 10 * 11) + 1;
-    if (maxUChars() - expandedSize < otherSize)
-        return overflowIndicator();
+    // Small Strings (up to 4 pages):
+    // Expand the allocation size to 112.5% of the amount requested.  This is largely sicking
+    // to our previous policy, however 112.5% is cheaper to calculate.
+    if (size < 0x4000) {
+        size_t expandedSize = ((size + (size >> 3)) | 15) + 1;
+        // Given the limited range within which we calculate the expansion in this
+        // fashion the above calculation should never overflow.
+        ASSERT(expandedSize >= size);
+        ASSERT(expandedSize < maxUChars());
+        return expandedSize;
+    }
 
-    return expandedSize + otherSize;
+    // Medium Strings (up to 128 pages):
+    // For pages covering multiple pages over-allocation is less of a concern - any unused
+    // space will not be paged in if it is not used, so this is purely a VM overhead.  For
+    // these strings allocate 2x the requested size.
+    if (size < 0x80000) {
+        size_t expandedSize = ((size + size) | 0xfff) + 1;
+        // Given the limited range within which we calculate the expansion in this
+        // fashion the above calculation should never overflow.
+        ASSERT(expandedSize >= size);
+        ASSERT(expandedSize < maxUChars());
+        return expandedSize;
+    }
+
+    // Large Strings (to infinity and beyond!):
+    // Revert to our 112.5% policy - probably best to limit the amount of unused VM we allow
+    // any individual string be responsible for.
+    size_t expandedSize = ((size + (size >> 3)) | 0xfff) + 1;
+
+    // Check for overflow - any result that is at least as large as requested (but
+    // still below the limit) is okay.
+    if ((expandedSize >= size) && (expandedSize < maxUChars()))
+        return expandedSize;
+    return overflowIndicator();
 }
 
 static inline bool expandCapacity(UString::Rep* rep, int requiredLength)
 {
     rep->checkConsistency();
+    ASSERT(!rep->baseString()->isBufferReadOnly());
 
     UString::BaseString* base = rep->baseString();
 
@@ -463,6 +489,35 @@
     return true;
 }
 
+bool UString::Rep::reserveCapacity(int capacity)
+{
+    // If this is an empty string there is no point 'growing' it - just allocate a new one.
+    // If the BaseString is shared with another string that is using more capacity than this
+    // string is, then growing the buffer won't help.
+    // If the BaseString's buffer is readonly, then it isn't allowed to grow.
+    UString::BaseString* base = baseString();
+    if (!base->buf || !base->capacity || (offset + len) != base->usedCapacity || base->isBufferReadOnly())
+        return false;
+    
+    // If there is already sufficient capacity, no need to grow!
+    if (capacity <= base->capacity)
+        return true;
+
+    checkConsistency();
+
+    size_t newCapacity = expandedSize(capacity, base->preCapacity);
+    UChar* oldBuf = base->buf;
+    base->buf = reallocChars(base->buf, newCapacity);
+    if (!base->buf) {
+        base->buf = oldBuf;
+        return false;
+    }
+    base->capacity = newCapacity - base->preCapacity;
+
+    checkConsistency();
+    return true;
+}
+
 void UString::expandCapacity(int requiredLength)
 {
     if (!JSC::expandCapacity(m_rep.get(), requiredLength))
@@ -472,6 +527,7 @@
 void UString::expandPreCapacity(int requiredPreCap)
 {
     m_rep->checkConsistency();
+    ASSERT(!m_rep->baseString()->isBufferReadOnly());
 
     BaseString* base = m_rep->baseString();
 
@@ -547,6 +603,17 @@
         m_rep = Rep::createCopying(buffer.data(), buffer.size());
 }
 
+static ALWAYS_INLINE int newCapacityWithOverflowCheck(const int currentCapacity, const int extendLength, const bool plusOne = false)
+{
+    ASSERT_WITH_MESSAGE(extendLength >= 0, "extendedLength = %d", extendLength);
+
+    const int plusLength = plusOne ? 1 : 0;
+    if (currentCapacity > std::numeric_limits<int>::max() - extendLength - plusLength)
+        CRASH();
+
+    return currentCapacity + extendLength + plusLength;
+}
+
 static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const UChar* tData, int tSize)
 {
     RefPtr<UString::Rep> rep = r;
@@ -564,25 +631,25 @@
     } else if (thisSize == 0) {
         // this is empty
         rep = UString::Rep::createCopying(tData, tSize);
-    } else if (rep == base && rep->rc == 1) {
+    } else if (rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        if (!expandCapacity(rep.get(), thisOffset + length))
+        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
             rep = &UString::Rep::null();
         if (rep->data()) {
             copyChars(rep->data() + thisSize, tData, tSize);
             rep->len = length;
             rep->_hash = 0;
         }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize) {
+    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
         // this reaches the end of the buffer - extend it if it's long enough to append to
-        if (!expandCapacity(rep.get(), thisOffset + length))
+        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
             rep = &UString::Rep::null();
         if (rep->data()) {
             copyChars(rep->data() + thisSize, tData, tSize);
             rep = UString::Rep::create(rep, 0, length);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
@@ -618,9 +685,9 @@
         rep = createRep(t);
     } else if (tSize == 0) {
         // t is empty, we'll just return *this below.
-    } else if (rep == base && rep->rc == 1) {
+    } else if (rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(rep.get(), thisOffset + length);
+        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
         UChar* d = rep->data();
         if (d) {
             for (int i = 0; i < tSize; ++i)
@@ -628,9 +695,9 @@
             rep->len = length;
             rep->_hash = 0;
         }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize) {
+    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
         // this string reaches the end of the buffer - extend it
-        expandCapacity(rep.get(), thisOffset + length);
+        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
         UChar* d = rep->data();
         if (d) {
             for (int i = 0; i < tSize; ++i)
@@ -638,7 +705,7 @@
             rep = UString::Rep::create(rep, 0, length);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
@@ -663,13 +730,19 @@
     b->checkConsistency();
 
     int aSize = a->size();
-    int aOffset = a->offset;
     int bSize = b->size();
-    int bOffset = b->offset;
-    int length = aSize + bSize;
+    int aOffset = a->offset;
 
     // possible cases:
 
+    UString::BaseString* aBase = a->baseString();
+    if (bSize == 1 && aOffset + aSize == aBase->usedCapacity && aOffset + aSize < aBase->capacity && !aBase->isBufferReadOnly()) {
+        // b is a single character (common fast case)
+        ++aBase->usedCapacity;
+        a->data()[aSize] = b->data()[0];
+        return UString::Rep::create(a, 0, aSize + 1);
+    }
+
     // a is empty
     if (aSize == 0)
         return b;
@@ -677,23 +750,19 @@
     if (bSize == 0)
         return a;
 
-    UString::BaseString* aBase = a->baseString();
-    if (bSize == 1 && aOffset + aSize == aBase->usedCapacity && aOffset + length <= aBase->capacity) {
-        // b is a single character (common fast case)
-        aBase->usedCapacity = aOffset + length;
-        a->data()[aSize] = b->data()[0];
-        return UString::Rep::create(a, 0, length);
-    }
+    int bOffset = b->offset;
+    int length = aSize + bSize;
 
     UString::BaseString* bBase = b->baseString();
     if (aOffset + aSize == aBase->usedCapacity && aSize >= minShareSize && 4 * aSize >= bSize
-        && (-bOffset != bBase->usedPreCapacity || aSize >= bSize)) {
+        && (-bOffset != bBase->usedPreCapacity || aSize >= bSize) && !aBase->isBufferReadOnly()) {
         // - a reaches the end of its buffer so it qualifies for shared append
         // - also, it's at least a quarter the length of b - appending to a much shorter
         //   string does more harm than good
         // - however, if b qualifies for prepend and is longer than a, we'd rather prepend
+        
         UString x(a);
-        x.expandCapacity(aOffset + length);
+        x.expandCapacity(newCapacityWithOverflowCheck(aOffset, length));
         if (!a->data() || !x.data())
             return 0;
         copyChars(a->data() + aSize, b->data(), bSize);
@@ -706,7 +775,7 @@
         return result;
     }
 
-    if (-bOffset == bBase->usedPreCapacity && bSize >= minShareSize && 4 * bSize >= aSize) {
+    if (-bOffset == bBase->usedPreCapacity && bSize >= minShareSize && 4 * bSize >= aSize && !bBase->isBufferReadOnly()) {
         // - b reaches the beginning of its buffer so it qualifies for shared prepend
         // - also, it's at least a quarter the length of a - prepending to a much shorter
         //   string does more harm than good
@@ -784,7 +853,8 @@
     int decimalPoint;
     int sign;
 
-    char* result = WTF::dtoa(d, 0, &decimalPoint, &sign, NULL);
+    char result[80];
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
     int length = static_cast<int>(strlen(result));
   
     int i = 0;
@@ -835,9 +905,7 @@
         buf[i++] = '\0';
     }
     
-  WTF::freedtoa(result);
-
-  return concatenate(rep, buf);
+    return concatenate(rep, buf);
 }
 
 UString UString::from(int i)
@@ -925,8 +993,9 @@
     char buf[80];
     int decimalPoint;
     int sign;
-
-    char* result = WTF::dtoa(d, 0, &decimalPoint, &sign, NULL);
+    
+    char result[80];
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
     int length = static_cast<int>(strlen(result));
   
     int i = 0;
@@ -977,9 +1046,7 @@
         buf[i++] = '\0';
     }
     
-  WTF::freedtoa(result);
-
-  return UString(buf);
+    return UString(buf);
 }
 
 UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const
@@ -1024,6 +1091,28 @@
     return UString::Rep::create(buffer, totalLength);
 }
 
+UString UString::replaceRange(int rangeStart, int rangeLength, const UString& replacement) const
+{
+    m_rep->checkConsistency();
+
+    int replacementLength = replacement.size();
+    int totalLength = size() - rangeLength + replacementLength;
+    if (totalLength == 0)
+        return "";
+
+    UChar* buffer = allocChars(totalLength);
+    if (!buffer)
+        return null();
+
+    copyChars(buffer, data(), rangeStart);
+    copyChars(buffer + rangeStart, replacement.data(), replacementLength);
+    int rangeEnd = rangeStart + rangeLength;
+    copyChars(buffer + rangeStart + replacementLength, data() + rangeEnd, size() - rangeEnd);
+
+    return UString::Rep::create(buffer, totalLength);
+}
+
+
 UString& UString::append(const UString &t)
 {
     m_rep->checkConsistency();
@@ -1041,23 +1130,23 @@
         *this = t;
     } else if (tSize == 0) {
         // t is empty
-    } else if (m_rep == base && m_rep->rc == 1) {
+    } else if (m_rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(thisOffset + length);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
         if (data()) {
             copyChars(m_rep->data() + thisSize, t.data(), tSize);
             m_rep->len = length;
             m_rep->_hash = 0;
         }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize) {
+    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
         // this reaches the end of the buffer - extend it if it's long enough to append to
-        expandCapacity(thisOffset + length);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
         if (data()) {
             copyChars(m_rep->data() + thisSize, t.data(), tSize);
             m_rep = Rep::create(m_rep, 0, length);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
@@ -1082,6 +1171,18 @@
     return *this;
 }
 
+UString& UString::appendNumeric(int i)
+{
+    m_rep = concatenate(rep(), i);
+    return *this;
+}
+
+UString& UString::appendNumeric(double d)
+{
+    m_rep = concatenate(rep(), d);
+    return *this;
+}
+
 UString& UString::append(const char* t)
 {
     m_rep = concatenate(m_rep.release(), t);
@@ -1108,25 +1209,25 @@
             m_rep = Rep::create(d, 1);
             m_rep->baseString()->capacity = newCapacity;
         }
-    } else if (m_rep == base && m_rep->rc == 1) {
+    } else if (m_rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(thisOffset + length + 1);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
         UChar* d = m_rep->data();
         if (d) {
             d[length] = c;
             m_rep->len = length + 1;
             m_rep->_hash = 0;
         }
-    } else if (thisOffset + length == base->usedCapacity && length >= minShareSize) {
+    } else if (thisOffset + length == base->usedCapacity && length >= minShareSize && !base->isBufferReadOnly()) {
         // this reaches the end of the string - extend it and share
-        expandCapacity(thisOffset + length + 1);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
         UChar* d = m_rep->data();
         if (d) {
             d[length] = c;
             m_rep = Rep::create(m_rep, 0, length + 1);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length + 1, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
@@ -1202,7 +1303,7 @@
     int l = static_cast<int>(strlen(c));
     UChar* d;
     BaseString* base = m_rep->baseString();
-    if (m_rep->rc == 1 && l <= base->capacity && m_rep == base && m_rep->offset == 0 && base->preCapacity == 0) {
+    if (!base->isShared() && l <= base->capacity && m_rep == base && m_rep->offset == 0 && base->preCapacity == 0) {
         d = base->buf;
         m_rep->_hash = 0;
         m_rep->len = l;
@@ -1520,19 +1621,6 @@
     return UString(Rep::create(m_rep, pos, len));
 }
 
-bool operator==(const UString& s1, const UString& s2)
-{
-    int size = s1.size();
-    switch (size) {
-        case 0:
-            return !s2.size();
-        case 1:
-            return s2.size() == 1 && s1.data()[0] == s2.data()[0];
-        default:
-            return s2.size() == size && memcmp(s1.data(), s2.data(), size * sizeof(UChar)) == 0;
-    }
-}
-
 bool operator==(const UString& s1, const char *s2)
 {
     if (s2 == 0)
diff --git a/JavaScriptCore/runtime/UString.h b/JavaScriptCore/runtime/UString.h
index 59a7665..6852d91 100644
--- a/JavaScriptCore/runtime/UString.h
+++ b/JavaScriptCore/runtime/UString.h
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- *  Copyright (c) 2009, Google Inc. All rights reserved.
+ *  Copyright (C) 2009 Google Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -27,6 +27,8 @@
 #include <stdint.h>
 #include <string.h>
 #include <wtf/Assertions.h>
+#include <wtf/CrossThreadRefCounted.h>
+#include <wtf/OwnFastMallocPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/PtrAndFlags.h>
 #include <wtf/RefPtr.h>
@@ -75,11 +77,26 @@
         friend class JIT;
 
     public:
+        typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
         struct BaseString;
         struct Rep : Noncopyable {
             friend class JIT;
 
-            static PassRefPtr<Rep> create(UChar*, int);
+            static PassRefPtr<Rep> create(UChar* buffer, int length)
+            {
+                return adoptRef(new BaseString(buffer, length));
+            }
+
+            static PassRefPtr<Rep> createEmptyBuffer(size_t size)
+            {
+                // Guard against integer overflow
+                if (size < (std::numeric_limits<size_t>::max() / sizeof(UChar))) {
+                    if (void * buf = tryFastMalloc(size * sizeof(UChar)))
+                        return adoptRef(new BaseString(static_cast<UChar*>(buf), 0, size));
+                }
+                return adoptRef(new BaseString(0, 0, 0));
+            }
+
             static PassRefPtr<Rep> createCopying(const UChar*, int);
             static PassRefPtr<Rep> create(PassRefPtr<Rep> base, int offset, int length);
 
@@ -87,6 +104,9 @@
             // Returns UString::Rep::null for null input or conversion failure.
             static PassRefPtr<Rep> createFromUTF8(const char*);
 
+            // Uses SharedUChar to have joint ownership over the UChar*.
+            static PassRefPtr<Rep> create(UChar*, int, PassRefPtr<SharedUChar>);
+
             void destroy();
 
             bool baseIsSelf() const { return m_identifierTableAndFlags.isFlagSet(BaseStringFlag); }
@@ -124,21 +144,61 @@
             int rc; // For null and empty static strings, this field does not reflect a correct count, because ref/deref are not thread-safe. A special case in destroy() guarantees that these do not get deleted.
             mutable unsigned _hash;
             PtrAndFlags<IdentifierTable, UStringFlags> m_identifierTableAndFlags;
-            void* m_baseString; // If "this" is a BaseString instance, it is 0. BaseString* otherwise.
 
             static BaseString& null() { return *nullBaseString; }
             static BaseString& empty() { return *emptyBaseString; }
 
+            bool reserveCapacity(int capacity);
+
+        protected:
+            // Constructor for use by BaseString subclass; they use the union with m_baseString for another purpose.
+            Rep(int length)
+                : offset(0)
+                , len(length)
+                , rc(1)
+                , _hash(0)
+                , m_baseString(0)
+            {
+            }
+
+            Rep(PassRefPtr<BaseString> base, int offsetInBase, int length)
+                : offset(offsetInBase)
+                , len(length)
+                , rc(1)
+                , _hash(0)
+                , m_baseString(base.releaseRef())
+            {
+                checkConsistency();
+            }
+
+            union {
+                // If !baseIsSelf()
+                BaseString* m_baseString;
+                // If baseIsSelf()
+                SharedUChar* m_sharedBuffer;
+            };
+
         private:
+            // For SmallStringStorage which allocates an array and does initialization manually.
+            Rep() { }
+
+            friend class SmallStringsStorage;
             friend void initializeUString();
-            static BaseString* nullBaseString;
-            static BaseString* emptyBaseString;
+            JS_EXPORTDATA static BaseString* nullBaseString;
+            JS_EXPORTDATA static BaseString* emptyBaseString;
         };
 
+
         struct BaseString : public Rep {
-            BaseString()
+            bool isShared() { return rc != 1 || isBufferReadOnly(); }
+            void setSharedBuffer(PassRefPtr<SharedUChar>);
+            SharedUChar* sharedBuffer();
+
+            bool isBufferReadOnly()
             {
-                m_identifierTableAndFlags.setFlag(BaseStringFlag);
+                if (!m_sharedBuffer)
+                    return false;
+                return slowIsBufferReadOnly();
             }
 
             // potentially shared data.
@@ -149,6 +209,26 @@
             int usedCapacity;
 
             size_t reportedCost;
+
+        private:
+            BaseString(UChar* buffer, int length, int additionalCapacity = 0)
+                : Rep(length)
+                , buf(buffer)
+                , preCapacity(0)
+                , usedPreCapacity(0)
+                , capacity(length + additionalCapacity)
+                , usedCapacity(length)
+                , reportedCost(0)
+            {
+                m_identifierTableAndFlags.setFlag(BaseStringFlag);
+                checkConsistency();
+            }
+
+            bool slowIsBufferReadOnly();
+
+            friend struct Rep;
+            friend class SmallStringsStorage;
+            friend void initializeUString();
         };
 
     public:
@@ -197,11 +277,15 @@
 
         UString spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const;
 
+        UString replaceRange(int rangeStart, int RangeEnd, const UString& replacement) const;
+
         UString& append(const UString&);
         UString& append(const char*);
         UString& append(UChar);
         UString& append(char c) { return append(static_cast<UChar>(static_cast<unsigned char>(c))); }
         UString& append(const UChar*, int size);
+        UString& appendNumeric(int);
+        UString& appendNumeric(double);
 
         bool getCString(CStringBuffer&) const;
 
@@ -265,6 +349,17 @@
 
         size_t cost() const;
 
+        // Attempt to grow this string such that it can grow to a total length of 'capacity'
+        // without reallocation.  This may fail a number of reasons - if the BasicString is
+        // shared and another string is using part of the capacity beyond our end point, if
+        // the realloc fails, or if this string is empty and has no storage.
+        //
+        // This method returns a boolean indicating success.
+        bool reserveCapacity(int capacity)
+        {
+            return m_rep->reserveCapacity(capacity);
+        }
+
     private:
         void expandCapacity(int requiredLength);
         void expandPreCapacity(int requiredPreCap);
@@ -281,7 +376,26 @@
     PassRefPtr<UString::Rep> concatenate(UString::Rep*, int);
     PassRefPtr<UString::Rep> concatenate(UString::Rep*, double);
 
-    bool operator==(const UString&, const UString&);
+    inline bool operator==(const UString& s1, const UString& s2)
+    {
+        int size = s1.size();
+        switch (size) {
+        case 0:
+            return !s2.size();
+        case 1:
+            return s2.size() == 1 && s1.data()[0] == s2.data()[0];
+        case 2: {
+            if (s2.size() != 2)
+                return false;
+            const UChar* d1 = s1.data();
+            const UChar* d2 = s2.data();
+            return (d1[0] == d2[0]) & (d1[1] == d2[1]);
+        }
+        default:
+            return s2.size() == size && memcmp(s1.data(), s2.data(), size * sizeof(UChar)) == 0;
+        }
+    }
+
 
     inline bool operator!=(const UString& s1, const UString& s2)
     {
@@ -320,6 +434,22 @@
 
     bool equal(const UString::Rep*, const UString::Rep*);
 
+    inline PassRefPtr<UString::Rep> UString::Rep::create(PassRefPtr<UString::Rep> rep, int offset, int length)
+    {
+        ASSERT(rep);
+        rep->checkConsistency();
+
+        int repOffset = rep->offset;
+
+        PassRefPtr<BaseString> base = rep->baseString();
+
+        ASSERT(-(offset + repOffset) <= base->usedPreCapacity);
+        ASSERT(offset + repOffset + length <= base->usedCapacity);
+
+        // Steal the single reference this Rep was created with.
+        return adoptRef(new Rep(base, repOffset + offset, length));
+    }
+
     inline UChar* UString::Rep::data() const
     {
         const BaseString* base = baseString();
@@ -338,17 +468,18 @@
     inline void UString::Rep::setBaseString(PassRefPtr<BaseString> base)
     {
         ASSERT(base != this);
+        ASSERT(!baseIsSelf());
         m_baseString = base.releaseRef();
     }
 
     inline UString::BaseString* UString::Rep::baseString()
     {
-        return reinterpret_cast<BaseString*>(baseIsSelf() ? this : m_baseString);
+        return !baseIsSelf() ? m_baseString : reinterpret_cast<BaseString*>(this) ;
     }
 
     inline const UString::BaseString* UString::Rep::baseString() const
     {
-        return const_cast<const BaseString*>(const_cast<Rep*>(this)->baseString());
+        return const_cast<Rep*>(this)->baseString();
     }
 
 #ifdef NDEBUG
diff --git a/JavaScriptCore/tests/mozilla/ecma_2/instanceof/instanceof-003.js b/JavaScriptCore/tests/mozilla/ecma_2/instanceof/instanceof-003.js
index 1b0a01b..c8f84ba 100644
--- a/JavaScriptCore/tests/mozilla/ecma_2/instanceof/instanceof-003.js
+++ b/JavaScriptCore/tests/mozilla/ecma_2/instanceof/instanceof-003.js
@@ -16,6 +16,19 @@
 
     Author:             christine@netscape.com
     Date:               12 november 1997
+
+
+The test case described above is correct, however the second test case in this file is not,
+'o instanceof o' should thow an exception.  According to ECMA-262:
+
+    8.6.2 Internal Properties and Methods:
+        "... only Function objects implement [[HasInstance]]"
+    11.8.6 The instanceof operator:
+        "6.If Result(4) does not have a [[HasInstance]] method, throw a TypeError exception."
+
+{} does not implement [[HasInstance]] (since it is not a function), so passing it as the
+constructor to be tested to instanceof should result in a TypeError being thrown.
+
 */
     var SECTION = "instanceof-003";
     var VERSION = "ECMA_2";
@@ -35,12 +48,10 @@
         theproto instanceof Foo );
 
 
-    var o = {};
-
     AddTestCase(
         "o = {}; o instanceof o",
-        false,
-        o instanceof o );
+        "EXCEPTION",
+        (function(){ try { var o = {}; o instanceof o; return "no exception"; } catch (e) { return "EXCEPTION"; } } )() );
 
 
     test();
diff --git a/JavaScriptCore/tests/mozilla/ecma_2/instanceof/regress-7635.js b/JavaScriptCore/tests/mozilla/ecma_2/instanceof/regress-7635.js
index 4ccb9d4..cab6ed9 100644
--- a/JavaScriptCore/tests/mozilla/ecma_2/instanceof/regress-7635.js
+++ b/JavaScriptCore/tests/mozilla/ecma_2/instanceof/regress-7635.js
@@ -26,49 +26,45 @@
  *  Author:             
  */
 
-    var SECTION = "instanceof";       // provide a document reference (ie, ECMA section)
-    var VERSION = "ECMA_2"; // Version of JavaScript or ECMA
-    var TITLE   = "Regression test for Bugzilla #7635";       // Provide ECMA section title or a description
-    var BUGNUMBER = "http://bugzilla.mozilla.org/show_bug.cgi?id=7635";     // Provide URL to bugsplat or bugzilla report
+var SECTION = "instanceof";       // provide a document reference (ie, ECMA section)
+var VERSION = "ECMA_2"; // Version of JavaScript or ECMA
+var TITLE   = "Regression test for Bugzilla #7635";       // Provide ECMA section title or a description
+var BUGNUMBER = "http://bugzilla.mozilla.org/show_bug.cgi?id=7635";     // Provide URL to bugsplat or bugzilla report
 
-    startTest();               // leave this alone
+startTest();               // leave this alone
 
-    /*
-     * Calls to AddTestCase here. AddTestCase is a function that is defined
-     * in shell.js and takes three arguments:
-     * - a string representation of what is being tested
-     * - the expected result
-     * - the actual result
-     *
-     * For example, a test might look like this:
-     *
-     * var zip = /[\d]{5}$/;
-     *
-     * AddTestCase(
-     * "zip = /[\d]{5}$/; \"PO Box 12345 Boston, MA 02134\".match(zip)",   // description of the test
-     *  "02134",                                                           // expected result
-     *  "PO Box 12345 Boston, MA 02134".match(zip) );                      // actual result
-     *
-     */
+/*
+ * Calls to AddTestCase here. AddTestCase is a function that is defined
+ * in shell.js and takes three arguments:
+ * - a string representation of what is being tested
+ * - the expected result
+ * - the actual result
+ *
+ * For example, a test might look like this:
+ *
+ * var zip = /[\d]{5}$/;
+ *
+ * AddTestCase(
+ * "zip = /[\d]{5}$/; \"PO Box 12345 Boston, MA 02134\".match(zip)",   // description of the test
+ *  "02134",                                                           // expected result
+ *  "PO Box 12345 Boston, MA 02134".match(zip) );                      // actual result
+ *
+ */
 
-	function Foo() {}
-	theproto = {};
-	Foo.prototype = theproto
-	theproto instanceof Foo
+function Foo() {}
+theproto = {};
+Foo.prototype = theproto
+theproto instanceof Foo
 
 
-	AddTestCase( "function Foo() {}; theproto = {}; Foo.prototype = theproto; theproto instanceof Foo",
-			false,
-			theproto instanceof Foo );
-	
-	var o  = {};
+AddTestCase( "function Foo() {}; theproto = {}; Foo.prototype = theproto; theproto instanceof Foo",
+        false,
+        theproto instanceof Foo );
 
-	AddTestCase( "var o = {}; o instanceof o", false, o instanceof o );
+var f = new Function();
 
-	var f = new Function();
-
-	AddTestCase( "var f = new Function(); f instanceof f", false, f instanceof f );
+AddTestCase( "var f = new Function(); f instanceof f", false, f instanceof f );
 
 
-    test();       // leave this alone.  this executes the test cases and
-                  // displays results.
+test();       // leave this alone.  this executes the test cases and
+              // displays results.
diff --git a/JavaScriptCore/tests/mozilla/expected.html b/JavaScriptCore/tests/mozilla/expected.html
index e51c4d1..fdcb4e9 100644
--- a/JavaScriptCore/tests/mozilla/expected.html
+++ b/JavaScriptCore/tests/mozilla/expected.html
@@ -6,12 +6,12 @@
 <h2>Test results, squirrelfish</h2><br>
 <p class='results_summary'>
 Test List: All tests<br>
-Skip List: (none)<br>
-1135 test(s) selected, 1127 test(s) completed, 50 failures reported (4.43% failed)<br>
-Engine command line: "/Users/Cameron/WebKit/WebKitBuild/Debug/jsc" <br>
-OS type: Darwin d141-97-200.home.cgocable.net 9.5.0 Darwin Kernel Version 9.5.0: Wed Sep  3 11:29:43 PDT 2008; root:xnu-1228.7.58~1/RELEASE_I386 i386<br>
-Testcase execution time: 1 minutes, 10 seconds.<br>
-Tests completed on Thu Sep 18 02:24:54 2008.<br><br>
+Skip List: ecma/Date/15.9.2.1.js, ecma/Date/15.9.2.2-1.js, ecma/Date/15.9.2.2-2.js, ecma/Date/15.9.2.2-3.js, ecma/Date/15.9.2.2-4.js, ecma/Date/15.9.2.2-5.js, ecma/Date/15.9.2.2-6.js, ecma_3/Date/15.9.5.7.js<br>
+1127 test(s) selected, 1119 test(s) completed, 49 failures reported (4.37% failed)<br>
+Engine command line: "/Volumes/Big/ggaren/build/Debug/jsc" <br>
+OS type: Darwin il0301a-dhcp53.apple.com 9.7.0 Darwin Kernel Version 9.7.0: Tue Mar 31 22:52:17 PDT 2009; root:xnu-1228.12.14~1/RELEASE_I386 i386<br>
+Testcase execution time: 3 minutes, 18 seconds.<br>
+Tests completed on Tue Apr 21 12:56:28 2009.<br><br>
 [ <a href='#fail_detail'>Failure Details</a> | <a href='#retest_list'>Retest List</a> | <a href='menu.html'>Test Selection Page</a> ]<br>
 <hr>
 <a name='fail_detail'></a>
@@ -30,33 +30,16 @@
 Failure messages were:<br>
 eval("function f(){}function g(){}") (threw no exception thrown = fail FAILED! expected: pass<br>
 </tt><br>
-<a name='failure3'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/Date/15.9.5.7.js'>ecma_3/Date/15.9.5.7.js</a> failed</b> <br>
+<a name='failure3'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/FunExpr/fe-001.js'>ecma_3/FunExpr/fe-001.js</a> failed</b> <br>
  [ <a href='#failure2'>Previous Failure</a> | <a href='#failure4'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt><br>
+<tt>STATUS: Function Expression Statements basic test.<br>
 Failure messages were:<br>
-(Wed Dec 31 1969 16:00:00 GMT-0800 (PST)).toLocaleTimeString() = 4:00:00 PM PST FAILED! expected: 16:00:00<br>
-(Wed Dec 31 1969 08:00:00 GMT-0800 (PST)).toLocaleTimeString() = 8:00:00 AM PST FAILED! expected: 08:00:00<br>
-(Sun Dec 31 1899 16:00:00 GMT-0800 (PST)).toLocaleTimeString() = 5:00:00 PM PDT FAILED! expected: 16:00:00<br>
-(Mon Jan 01 1900 00:00:00 GMT-0800 (PST)).toLocaleTimeString() = 1:00:00 AM PDT FAILED! expected: 00:00:00<br>
-(Fri Dec 31 1999 16:00:00 GMT-0800 (PST)).toLocaleTimeString() = 4:00:00 PM PST FAILED! expected: 16:00:00<br>
-(Sat Jan 01 2000 00:00:00 GMT-0800 (PST)).toLocaleTimeString() = 12:00:00 AM PST FAILED! expected: 00:00:00<br>
-(Mon Feb 28 2000 16:00:00 GMT-0800 (PST)).toLocaleTimeString() = 4:00:00 PM PST FAILED! expected: 16:00:00<br>
-(Mon Feb 28 2000 15:59:59 GMT-0800 (PST)).toLocaleTimeString() = 3:59:59 PM PST FAILED! expected: 15:59:59<br>
-(Tue Feb 29 2000 00:00:00 GMT-0800 (PST)).toLocaleTimeString() = 12:00:00 AM PST FAILED! expected: 00:00:00<br>
-(Thu Sep 18 2008 02:24:30 GMT-0700 (PDT)).toLocaleTimeString() = 2:24:30 AM PDT FAILED! expected: 02:24:30<br>
-(Thu Sep 18 2008 10:24:30 GMT-0700 (PDT)).toLocaleTimeString() = 10:24:30 AM PDT FAILED! expected: 10:24:30<br>
-(Fri Dec 31 2004 16:00:00 GMT-0800 (PST)).toLocaleTimeString() = 4:00:00 PM PST FAILED! expected: 16:00:00<br>
-(Fri Dec 31 2004 15:59:59 GMT-0800 (PST)).toLocaleTimeString() = 3:59:59 PM PST FAILED! expected: 15:59:59<br>
-(Sat Jan 01 2005 00:00:00 GMT-0800 (PST)).toLocaleTimeString() = 12:00:00 AM PST FAILED! expected: 00:00:00<br>
+FAILED!: [reported from test()] Both functions were defined.<br>
+FAILED!: [reported from test()] Expected value '1', Actual value '0'<br>
+FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure4'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/FunExpr/fe-001.js'>ecma_3/FunExpr/fe-001.js</a> failed</b> <br>
+<a name='failure4'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/RegExp/15.10.2-1.js'>ecma_3/RegExp/15.10.2-1.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=(none)' target='other_window'>Bug Number (none)</a><br>
  [ <a href='#failure3'>Previous Failure</a> | <a href='#failure5'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt>Expected exit code 0, got 3<br>
-Testcase terminated with signal 0<br>
-Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure5'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/RegExp/15.10.2-1.js'>ecma_3/RegExp/15.10.2-1.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=(none)' target='other_window'>Bug Number (none)</a><br>
- [ <a href='#failure4'>Previous Failure</a> | <a href='#failure6'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: RegExp conformance test<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Section 7 of test -<br>
@@ -81,8 +64,8 @@
 FAILED!: [reported from test()] Actual: ["baaabaac", "ba", "aa", "abaac"]<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure6'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/RegExp/perlstress-001.js'>ecma_3/RegExp/perlstress-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=85721' target='other_window'>Bug Number 85721</a><br>
- [ <a href='#failure5'>Previous Failure</a> | <a href='#failure7'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure5'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/RegExp/perlstress-001.js'>ecma_3/RegExp/perlstress-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=85721' target='other_window'>Bug Number 85721</a><br>
+ [ <a href='#failure4'>Previous Failure</a> | <a href='#failure6'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Testing regular expression edge cases<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Section 218 of test -<br>
@@ -121,8 +104,8 @@
 FAILED!: [reported from test()] Actual: ["aabbaa", "aa", "bb"]<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure7'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/RegExp/regress-209919.js'>ecma_3/RegExp/regress-209919.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=209919' target='other_window'>Bug Number 209919</a><br>
- [ <a href='#failure6'>Previous Failure</a> | <a href='#failure8'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure6'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/RegExp/regress-209919.js'>ecma_3/RegExp/regress-209919.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=209919' target='other_window'>Bug Number 209919</a><br>
+ [ <a href='#failure5'>Previous Failure</a> | <a href='#failure7'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Testing regexp submatches with quantifiers<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Section 1 of test -<br>
@@ -161,44 +144,54 @@
 FAILED!: [reported from test()] Actual: ["1.000,00", "", ",00"]<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure8'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/Statements/regress-194364.js'>ecma_3/Statements/regress-194364.js</a> failed</b> <br>
- [ <a href='#failure7'>Previous Failure</a> | <a href='#failure9'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure7'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/Statements/regress-194364.js'>ecma_3/Statements/regress-194364.js</a> failed</b> <br>
+ [ <a href='#failure6'>Previous Failure</a> | <a href='#failure8'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure9'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/Unicode/uc-001.js'>ecma_3/Unicode/uc-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=23610' target='other_window'>Bug Number 23610</a><br>
- [ <a href='#failure8'>Previous Failure</a> | <a href='#failure10'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure8'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/Unicode/uc-001.js'>ecma_3/Unicode/uc-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=23610' target='other_window'>Bug Number 23610</a><br>
+ [ <a href='#failure7'>Previous Failure</a> | <a href='#failure9'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Unicode format-control character (Category Cf) test.<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Unicode format-control character test (Category Cf.)<br>
 FAILED!: [reported from test()] Expected value 'no error', Actual value 'no‎ error'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure10'></a><dd><b>Testcase <a target='other_window' href='./js1_2/Objects/toString-001.js'>js1_2/Objects/toString-001.js</a> failed</b> <br>
- [ <a href='#failure9'>Previous Failure</a> | <a href='#failure11'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure9'></a><dd><b>Testcase <a target='other_window' href='./js1_2/Objects/toString-001.js'>js1_2/Objects/toString-001.js</a> failed</b> <br>
+ [ <a href='#failure8'>Previous Failure</a> | <a href='#failure10'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 var o = new Object(); o.toString() = [object Object] FAILED! expected: {}<br>
 o = {}; o.toString() = [object Object] FAILED! expected: {}<br>
 o = { name:"object", length:0, value:"hello" }; o.toString() = false FAILED! expected: true<br>
 </tt><br>
-<a name='failure11'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/Function_object.js'>js1_2/function/Function_object.js</a> failed</b> <br>
- [ <a href='#failure10'>Previous Failure</a> | <a href='#failure12'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure10'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/Function_object.js'>js1_2/function/Function_object.js</a> failed</b> <br>
+ [ <a href='#failure9'>Previous Failure</a> | <a href='#failure11'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 f.arity = undefined FAILED! expected: 3<br>
-(new Function()).toString() = function anonymous() {} FAILED! expected: <br>
+} FAILED! expected: <br>
 </tt><br>
-<a name='failure12'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/function-001-n.js'>js1_2/function/function-001-n.js</a> failed</b> <br>
- [ <a href='#failure11'>Previous Failure</a> | <a href='#failure13'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure11'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/function-001-n.js'>js1_2/function/function-001-n.js</a> failed</b> <br>
+ [ <a href='#failure10'>Previous Failure</a> | <a href='#failure12'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 3, got 0<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 function-001.js functions not separated by semicolons are errors in version 120 and higher<br>
 eval("function f(){}function g(){}") = undefined FAILED! expected: error<br>
 </tt><br>
-<a name='failure13'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/tostring-1.js'>js1_2/function/tostring-1.js</a> failed</b> <br>
+<a name='failure12'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/tostring-1.js'>js1_2/function/tostring-1.js</a> failed</b> <br>
+ [ <a href='#failure11'>Previous Failure</a> | <a href='#failure13'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt><br>
+Failure messages were:<br>
+} FAILED! expected: <br>
+} FAILED! expected: <br>
+} FAILED! expected: <br>
+} FAILED! expected: <br>
+} FAILED! expected: <br>
+</tt><br>
+<a name='failure13'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/tostring-2.js'>js1_2/function/tostring-2.js</a> failed</b> <br>
  [ <a href='#failure12'>Previous Failure</a> | <a href='#failure14'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
@@ -206,38 +199,28 @@
 } FAILED! expected: <br>
 } FAILED! expected: <br>
 } FAILED! expected: <br>
-f.toString() = function anonymous() {return "hello!"} FAILED! expected: <br>
+} FAILED! expected: <br>
+} FAILED! expected: <br>
+} FAILED! expected: <br>
+} FAILED! expected: <br>
+} FAILED! expected: <br>
 </tt><br>
-<a name='failure14'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/tostring-2.js'>js1_2/function/tostring-2.js</a> failed</b> <br>
+<a name='failure14'></a><dd><b>Testcase <a target='other_window' href='./js1_2/operator/equality.js'>js1_2/operator/equality.js</a> failed</b> <br>
  [ <a href='#failure13'>Previous Failure</a> | <a href='#failure15'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-</tt><br>
-<a name='failure15'></a><dd><b>Testcase <a target='other_window' href='./js1_2/operator/equality.js'>js1_2/operator/equality.js</a> failed</b> <br>
- [ <a href='#failure14'>Previous Failure</a> | <a href='#failure16'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt><br>
-Failure messages were:<br>
 (new String('x') == 'x')                  = true FAILED! expected: false<br>
 ('x' == new String('x'))                  = true FAILED! expected: false<br>
 </tt><br>
-<a name='failure16'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_lastIndex.js'>js1_2/regexp/RegExp_lastIndex.js</a> failed</b> <br>
- [ <a href='#failure15'>Previous Failure</a> | <a href='#failure17'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure15'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_lastIndex.js'>js1_2/regexp/RegExp_lastIndex.js</a> failed</b> <br>
+ [ <a href='#failure14'>Previous Failure</a> | <a href='#failure16'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 re=/x./g; re.lastIndex=4; re.exec('xyabcdxa') = xa FAILED! expected: ["xa"]<br>
 re.exec('xyabcdef') = xy FAILED! expected: ["xy"]<br>
 </tt><br>
-<a name='failure17'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_multiline.js'>js1_2/regexp/RegExp_multiline.js</a> failed</b> <br>
- [ <a href='#failure16'>Previous Failure</a> | <a href='#failure18'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure16'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_multiline.js'>js1_2/regexp/RegExp_multiline.js</a> failed</b> <br>
+ [ <a href='#failure15'>Previous Failure</a> | <a href='#failure17'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 (multiline == true) '123\n456'.match(/^4../) = null FAILED! expected: 456<br>
@@ -246,8 +229,8 @@
 (multiline == true) 'a11\na22\na23\na24'.match(/a..$/g) = a24 FAILED! expected: a11,a22,a23,a24<br>
 (multiline == true) 'a11\na22\na23\na24'.match(new RegExp('a..$','g')) = a24 FAILED! expected: a11,a22,a23,a24<br>
 </tt><br>
-<a name='failure18'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_multiline_as_array.js'>js1_2/regexp/RegExp_multiline_as_array.js</a> failed</b> <br>
- [ <a href='#failure17'>Previous Failure</a> | <a href='#failure19'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure17'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_multiline_as_array.js'>js1_2/regexp/RegExp_multiline_as_array.js</a> failed</b> <br>
+ [ <a href='#failure16'>Previous Failure</a> | <a href='#failure18'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 (['$*'] == true) '123\n456'.match(/^4../) = null FAILED! expected: 456<br>
@@ -256,20 +239,20 @@
 (['$*'] == true) 'a11\na22\na23\na24'.match(/a..$/g) = a24 FAILED! expected: a11,a22,a23,a24<br>
 (['$*'] == true) 'a11\na22\na23\na24'.match(new RegExp('a..$','g')) = a24 FAILED! expected: a11,a22,a23,a24<br>
 </tt><br>
-<a name='failure19'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/beginLine.js'>js1_2/regexp/beginLine.js</a> failed</b> <br>
- [ <a href='#failure18'>Previous Failure</a> | <a href='#failure20'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure18'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/beginLine.js'>js1_2/regexp/beginLine.js</a> failed</b> <br>
+ [ <a href='#failure17'>Previous Failure</a> | <a href='#failure19'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 123xyz'.match(new RegExp('^\d+')) = null FAILED! expected: 123<br>
 </tt><br>
-<a name='failure20'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/endLine.js'>js1_2/regexp/endLine.js</a> failed</b> <br>
- [ <a href='#failure19'>Previous Failure</a> | <a href='#failure21'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure19'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/endLine.js'>js1_2/regexp/endLine.js</a> failed</b> <br>
+ [ <a href='#failure18'>Previous Failure</a> | <a href='#failure20'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 xyz'.match(new RegExp('\d+$')) = null FAILED! expected: 890<br>
 </tt><br>
-<a name='failure21'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/string_split.js'>js1_2/regexp/string_split.js</a> failed</b> <br>
- [ <a href='#failure20'>Previous Failure</a> | <a href='#failure22'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure20'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/string_split.js'>js1_2/regexp/string_split.js</a> failed</b> <br>
+ [ <a href='#failure19'>Previous Failure</a> | <a href='#failure21'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 'abc'.split(/[a-z]/) = ,,, FAILED! expected: ,,<br>
@@ -277,22 +260,22 @@
 'abc'.split(new RegExp('[a-z]')) = ,,, FAILED! expected: ,,<br>
 'abc'.split(new RegExp('[a-z]')) = ,,, FAILED! expected: ,,<br>
 </tt><br>
-<a name='failure22'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/boolean-001.js'>js1_2/version120/boolean-001.js</a> failed</b> <br>
- [ <a href='#failure21'>Previous Failure</a> | <a href='#failure23'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure21'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/boolean-001.js'>js1_2/version120/boolean-001.js</a> failed</b> <br>
+ [ <a href='#failure20'>Previous Failure</a> | <a href='#failure22'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 new Boolean(false) = true FAILED! expected: false<br>
 </tt><br>
-<a name='failure23'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/regress-99663.js'>js1_2/version120/regress-99663.js</a> failed</b> <br>
- [ <a href='#failure22'>Previous Failure</a> | <a href='#failure24'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure22'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/regress-99663.js'>js1_2/version120/regress-99663.js</a> failed</b> <br>
+ [ <a href='#failure21'>Previous Failure</a> | <a href='#failure23'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Regression test for Bugzilla bug 99663<br>
 Failure messages were:<br>
 Section 1 of test - got Error: Can't find variable: it FAILED! expected: a "read-only" error<br>
 Section 2 of test - got Error: Can't find variable: it FAILED! expected: a "read-only" error<br>
 Section 3 of test - got Error: Can't find variable: it FAILED! expected: a "read-only" error<br>
 </tt><br>
-<a name='failure24'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/function-001-n.js'>js1_3/Script/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
- [ <a href='#failure23'>Previous Failure</a> | <a href='#failure25'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure23'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/function-001-n.js'>js1_3/Script/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
+ [ <a href='#failure22'>Previous Failure</a> | <a href='#failure24'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 3, got 0<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
@@ -300,15 +283,15 @@
 function-001.js functions not separated by semicolons are errors in version 120 and higher<br>
 eval("function f(){}function g(){}") = undefined FAILED! expected: error<br>
 </tt><br>
-<a name='failure25'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/script-001.js'>js1_3/Script/script-001.js</a> failed</b> <br>
- [ <a href='#failure24'>Previous Failure</a> | <a href='#failure26'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure24'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/script-001.js'>js1_3/Script/script-001.js</a> failed</b> <br>
+ [ <a href='#failure23'>Previous Failure</a> | <a href='#failure25'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 script-001 NativeScript<br>
 </tt><br>
-<a name='failure26'></a><dd><b>Testcase <a target='other_window' href='./js1_3/regress/function-001-n.js'>js1_3/regress/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
- [ <a href='#failure25'>Previous Failure</a> | <a href='#failure27'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure25'></a><dd><b>Testcase <a target='other_window' href='./js1_3/regress/function-001-n.js'>js1_3/regress/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
+ [ <a href='#failure24'>Previous Failure</a> | <a href='#failure26'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 3, got 0<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
@@ -316,90 +299,90 @@
 function-001.js functions not separated by semicolons are errors in version 120 and higher<br>
 eval("function f(){}function g(){}") = undefined FAILED! expected: error<br>
 </tt><br>
-<a name='failure27'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-001.js'>js1_5/Exceptions/catchguard-001.js</a> failed</b> <br>
+<a name='failure26'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-001.js'>js1_5/Exceptions/catchguard-001.js</a> failed</b> <br>
+ [ <a href='#failure25'>Previous Failure</a> | <a href='#failure27'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+Testcase produced no output!</tt><br>
+<a name='failure27'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-002.js'>js1_5/Exceptions/catchguard-002.js</a> failed</b> <br>
  [ <a href='#failure26'>Previous Failure</a> | <a href='#failure28'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure28'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-002.js'>js1_5/Exceptions/catchguard-002.js</a> failed</b> <br>
+<a name='failure28'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-003.js'>js1_5/Exceptions/catchguard-003.js</a> failed</b> <br>
  [ <a href='#failure27'>Previous Failure</a> | <a href='#failure29'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure29'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-003.js'>js1_5/Exceptions/catchguard-003.js</a> failed</b> <br>
+<a name='failure29'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/errstack-001.js'>js1_5/Exceptions/errstack-001.js</a> failed</b> <br>
  [ <a href='#failure28'>Previous Failure</a> | <a href='#failure30'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure30'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/errstack-001.js'>js1_5/Exceptions/errstack-001.js</a> failed</b> <br>
+<a name='failure30'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/regress-50447.js'>js1_5/Exceptions/regress-50447.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=50447' target='other_window'>Bug Number 50447</a><br>
  [ <a href='#failure29'>Previous Failure</a> | <a href='#failure31'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure31'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/regress-50447.js'>js1_5/Exceptions/regress-50447.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=50447' target='other_window'>Bug Number 50447</a><br>
- [ <a href='#failure30'>Previous Failure</a> | <a href='#failure32'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt>Expected exit code 0, got 3<br>
-Testcase terminated with signal 0<br>
-Complete testcase output was:<br>
 BUGNUMBER: 50447<br>
 STATUS: Test (non-ECMA) Error object properties fileName, lineNumber<br>
 </tt><br>
-<a name='failure32'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-001.js'>js1_5/GetSet/getset-001.js</a> failed</b> <br>
+<a name='failure31'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-001.js'>js1_5/GetSet/getset-001.js</a> failed</b> <br>
+ [ <a href='#failure30'>Previous Failure</a> | <a href='#failure32'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+Testcase produced no output!</tt><br>
+<a name='failure32'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-002.js'>js1_5/GetSet/getset-002.js</a> failed</b> <br>
  [ <a href='#failure31'>Previous Failure</a> | <a href='#failure33'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure33'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-002.js'>js1_5/GetSet/getset-002.js</a> failed</b> <br>
+<a name='failure33'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-003.js'>js1_5/GetSet/getset-003.js</a> failed</b> <br>
  [ <a href='#failure32'>Previous Failure</a> | <a href='#failure34'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure34'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-003.js'>js1_5/GetSet/getset-003.js</a> failed</b> <br>
+<a name='failure34'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-001.js'>js1_5/Object/regress-90596-001.js</a> failed</b> <br>
  [ <a href='#failure33'>Previous Failure</a> | <a href='#failure35'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure35'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-001.js'>js1_5/Object/regress-90596-001.js</a> failed</b> <br>
+<a name='failure35'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-002.js'>js1_5/Object/regress-90596-002.js</a> failed</b> <br>
  [ <a href='#failure34'>Previous Failure</a> | <a href='#failure36'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure36'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-002.js'>js1_5/Object/regress-90596-002.js</a> failed</b> <br>
+<a name='failure36'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-001.js'>js1_5/Object/regress-96284-001.js</a> failed</b> <br>
  [ <a href='#failure35'>Previous Failure</a> | <a href='#failure37'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure37'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-001.js'>js1_5/Object/regress-96284-001.js</a> failed</b> <br>
+<a name='failure37'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-002.js'>js1_5/Object/regress-96284-002.js</a> failed</b> <br>
  [ <a href='#failure36'>Previous Failure</a> | <a href='#failure38'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure38'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-002.js'>js1_5/Object/regress-96284-002.js</a> failed</b> <br>
+<a name='failure38'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-44009.js'>js1_5/Regress/regress-44009.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=44009' target='other_window'>Bug Number 44009</a><br>
  [ <a href='#failure37'>Previous Failure</a> | <a href='#failure39'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure39'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-44009.js'>js1_5/Regress/regress-44009.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=44009' target='other_window'>Bug Number 44009</a><br>
- [ <a href='#failure38'>Previous Failure</a> | <a href='#failure40'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt>Expected exit code 0, got 3<br>
-Testcase terminated with signal 0<br>
-Complete testcase output was:<br>
 BUGNUMBER: 44009<br>
 STATUS: Testing that we don't crash on obj.toSource()<br>
 </tt><br>
-<a name='failure40'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-103602.js'>js1_5/Regress/regress-103602.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=103602' target='other_window'>Bug Number 103602</a><br>
- [ <a href='#failure39'>Previous Failure</a> | <a href='#failure41'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure39'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-103602.js'>js1_5/Regress/regress-103602.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=103602' target='other_window'>Bug Number 103602</a><br>
+ [ <a href='#failure38'>Previous Failure</a> | <a href='#failure40'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Reassignment to a const is NOT an error per ECMA<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Section 1 of test -<br>
@@ -409,26 +392,26 @@
 FAILED!: [reported from test()] Expected value '1', Actual value '2'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure41'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-104077.js'>js1_5/Regress/regress-104077.js</a> failed</b> <br>
+<a name='failure40'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-104077.js'>js1_5/Regress/regress-104077.js</a> failed</b> <br>
+ [ <a href='#failure39'>Previous Failure</a> | <a href='#failure41'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+Testcase produced no output!</tt><br>
+<a name='failure41'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-127557.js'>js1_5/Regress/regress-127557.js</a> failed</b> <br>
  [ <a href='#failure40'>Previous Failure</a> | <a href='#failure42'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure42'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-127557.js'>js1_5/Regress/regress-127557.js</a> failed</b> <br>
+<a name='failure42'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-172699.js'>js1_5/Regress/regress-172699.js</a> failed</b> <br>
  [ <a href='#failure41'>Previous Failure</a> | <a href='#failure43'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure43'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-172699.js'>js1_5/Regress/regress-172699.js</a> failed</b> <br>
+<a name='failure43'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-179524.js'>js1_5/Regress/regress-179524.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=179524' target='other_window'>Bug Number 179524</a><br>
  [ <a href='#failure42'>Previous Failure</a> | <a href='#failure44'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt>Expected exit code 0, got 3<br>
-Testcase terminated with signal 0<br>
-Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure44'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-179524.js'>js1_5/Regress/regress-179524.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=179524' target='other_window'>Bug Number 179524</a><br>
- [ <a href='#failure43'>Previous Failure</a> | <a href='#failure45'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Don't crash on extraneous arguments to str.match(), etc.<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Section 14 of test -<br>
@@ -478,14 +461,14 @@
 FAILED!: [reported from test()] Expected value 'SHOULD HAVE FALLEN INTO CATCH-BLOCK!', Actual value 'ABC Zbc'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure45'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/regress-220584.js'>js1_5/Scope/regress-220584.js</a> failed</b> <br>
- [ <a href='#failure44'>Previous Failure</a> | <a href='#failure46'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure44'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/regress-220584.js'>js1_5/Scope/regress-220584.js</a> failed</b> <br>
+ [ <a href='#failure43'>Previous Failure</a> | <a href='#failure45'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure46'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/scope-001.js'>js1_5/Scope/scope-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=53268' target='other_window'>Bug Number 53268</a><br>
- [ <a href='#failure45'>Previous Failure</a> | <a href='#failure47'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure45'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/scope-001.js'>js1_5/Scope/scope-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=53268' target='other_window'>Bug Number 53268</a><br>
+ [ <a href='#failure44'>Previous Failure</a> | <a href='#failure46'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Testing scope after changing obj.__proto__<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Step 1:  setting obj.__proto__ = global object<br>
@@ -496,8 +479,8 @@
 FAILED!: [reported from test()] Expected value 'undefined', Actual value '1'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure47'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-301574.js'>js1_6/Regress/regress-301574.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=301574' target='other_window'>Bug Number 301574</a><br>
- [ <a href='#failure46'>Previous Failure</a> | <a href='#failure48'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure46'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-301574.js'>js1_6/Regress/regress-301574.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=301574' target='other_window'>Bug Number 301574</a><br>
+ [ <a href='#failure45'>Previous Failure</a> | <a href='#failure47'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: E4X should be enabled even when e4x=1 not specified<br>
 Failure messages were:<br>
 FAILED!: E4X should be enabled even when e4x=1 not specified: XML()<br>
@@ -507,23 +490,23 @@
 FAILED!: Expected value 'No error', Actual value 'error: ReferenceError: Can't find variable: XML'<br>
 FAILED!: <br>
 </tt><br>
-<a name='failure48'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-309242.js'>js1_6/Regress/regress-309242.js</a> failed</b> <br>
+<a name='failure47'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-309242.js'>js1_6/Regress/regress-309242.js</a> failed</b> <br>
+ [ <a href='#failure46'>Previous Failure</a> | <a href='#failure48'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+Testcase produced no output!</tt><br>
+<a name='failure48'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-314887.js'>js1_6/Regress/regress-314887.js</a> failed</b> <br>
  [ <a href='#failure47'>Previous Failure</a> | <a href='#failure49'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure49'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-314887.js'>js1_6/Regress/regress-314887.js</a> failed</b> <br>
+<a name='failure49'></a><dd><b>Testcase <a target='other_window' href='./js1_6/String/regress-306591.js'>js1_6/String/regress-306591.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=306591' target='other_window'>Bug Number 306591</a><br>
  [ <a href='#failure48'>Previous Failure</a> | <a href='#failure50'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure50'></a><dd><b>Testcase <a target='other_window' href='./js1_6/String/regress-306591.js'>js1_6/String/regress-306591.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=306591' target='other_window'>Bug Number 306591</a><br>
- [ <a href='#failure49'>Previous Failure</a> | <a href='#failure51'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt>Expected exit code 0, got 3<br>
-Testcase terminated with signal 0<br>
-Complete testcase output was:<br>
 BUGNUMBER: 306591<br>
 STATUS: String static methods<br>
 STATUS: See https://bugzilla.mozilla.org/show_bug.cgi?id=304828<br>
@@ -534,12 +517,11 @@
 <pre>
 <a name='retest_list'></a>
 <h2>Retest List</h2><br>
-# Retest List, squirrelfish, generated Thu Sep 18 02:24:54 2008.
+# Retest List, squirrelfish, generated Tue Apr 21 12:56:28 2009.
 # Original test base was: All tests.
-# 1127 of 1135 test(s) were completed, 50 failures reported.
+# 1119 of 1127 test(s) were completed, 49 failures reported.
 ecma/TypeConversion/9.3.1-3.js
 ecma_2/Exceptions/function-001.js
-ecma_3/Date/15.9.5.7.js
 ecma_3/FunExpr/fe-001.js
 ecma_3/RegExp/15.10.2-1.js
 ecma_3/RegExp/perlstress-001.js
@@ -586,4 +568,4 @@
 js1_6/Regress/regress-301574.js
 js1_6/Regress/regress-309242.js
 js1_6/Regress/regress-314887.js
-js1_6/String/regress-306591.js
+js1_6/String/regress-306591.js
\ No newline at end of file
diff --git a/JavaScriptCore/wtf/ASCIICType.h b/JavaScriptCore/wtf/ASCIICType.h
index 0c2ca70..0c3c29f 100644
--- a/JavaScriptCore/wtf/ASCIICType.h
+++ b/JavaScriptCore/wtf/ASCIICType.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -149,4 +149,18 @@
     inline bool isASCIIPrintable(int c) { return c >= ' ' && c <= '~'; }
 }
 
+using WTF::isASCII;
+using WTF::isASCIIAlpha;
+using WTF::isASCIIAlphanumeric;
+using WTF::isASCIIDigit;
+using WTF::isASCIIHexDigit;
+using WTF::isASCIILower;
+using WTF::isASCIIOctalDigit;
+using WTF::isASCIIPrintable;
+using WTF::isASCIISpace;
+using WTF::isASCIIUpper;
+using WTF::toASCIIHexValue;
+using WTF::toASCIILower;
+using WTF::toASCIIUpper;
+
 #endif
diff --git a/JavaScriptCore/wtf/AVLTree.h b/JavaScriptCore/wtf/AVLTree.h
index 18db8ff..d7470e7 100644
--- a/JavaScriptCore/wtf/AVLTree.h
+++ b/JavaScriptCore/wtf/AVLTree.h
@@ -764,7 +764,7 @@
 
     handle h = abs.root;
     handle parent = null(), child;
-    int cmp, cmp_shortened_sub_with_path;
+    int cmp, cmp_shortened_sub_with_path = 0;
 
     for (;;) {
         if (h == null())
diff --git a/JavaScriptCore/wtf/CrossThreadRefCounted.h b/JavaScriptCore/wtf/CrossThreadRefCounted.h
index 82f1ba1..281dfa6 100644
--- a/JavaScriptCore/wtf/CrossThreadRefCounted.h
+++ b/JavaScriptCore/wtf/CrossThreadRefCounted.h
@@ -35,7 +35,6 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Threading.h>
-#include <wtf/TypeTraits.h>
 
 namespace WTF {
 
@@ -66,6 +65,11 @@
         void deref();
         T* release();
 
+        bool isShared() const
+        {
+            return !m_refCounter.hasOneRef() || (m_threadSafeRefCounter && !m_threadSafeRefCounter->hasOneRef());
+        }
+
 #ifndef NDEBUG
         bool mayBePassedToAnotherThread() const { ASSERT(!m_threadId); return m_refCounter.hasOneRef(); }
 #endif
diff --git a/JavaScriptCore/wtf/CurrentTime.h b/JavaScriptCore/wtf/CurrentTime.h
index f70f98f..436e054 100644
--- a/JavaScriptCore/wtf/CurrentTime.h
+++ b/JavaScriptCore/wtf/CurrentTime.h
@@ -36,7 +36,7 @@
 
     // Returns the current system (UTC) time in seconds, starting January 1, 1970.
     // Precision varies depending on a platform but usually is as good or better 
-    // then a millisecond.
+    // than a millisecond.
     double currentTime();
 
 #if PLATFORM(ANDROID)
diff --git a/JavaScriptCore/runtime/DateMath.cpp b/JavaScriptCore/wtf/DateMath.cpp
similarity index 93%
rename from JavaScriptCore/runtime/DateMath.cpp
rename to JavaScriptCore/wtf/DateMath.cpp
index 356d7a1..3d3ede2 100644
--- a/JavaScriptCore/runtime/DateMath.cpp
+++ b/JavaScriptCore/wtf/DateMath.cpp
@@ -1,7 +1,8 @@
 /*
  * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
- * 
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
  * The Original Code is Mozilla Communicator client code, released
  * March 31, 1998.
  *
@@ -42,15 +43,18 @@
 #include "config.h"
 #include "DateMath.h"
 
-#include "JSNumberCell.h"
-#include <math.h>
+#include "Assertions.h"
+#include "ASCIICType.h"
+#include "CurrentTime.h"
+#include "MathExtras.h"
+#include "StringExtras.h"
+
+#include <algorithm>
+#include <limits.h>
+#include <limits>
 #include <stdint.h>
 #include <time.h>
-#include <wtf/ASCIICType.h>
-#include <wtf/Assertions.h>
-#include <wtf/CurrentTime.h>
-#include <wtf/MathExtras.h>
-#include <wtf/StringExtras.h>
+
 
 #if HAVE(ERRNO_H)
 #include <errno.h>
@@ -68,13 +72,9 @@
 #include <sys/timeb.h>
 #endif
 
-#if HAVE(STRINGS_H)
-#include <strings.h>
-#endif
+#define NaN std::numeric_limits<double>::quiet_NaN()
 
-using namespace WTF;
-
-namespace JSC {
+namespace WTF {
 
 /* Constants */
 
@@ -500,7 +500,7 @@
     tm.timeZone = NULL;
 }
 
-void initDateMath()
+void initializeDates()
 {
 #ifndef NDEBUG
     static bool alreadyInitialized;
@@ -596,7 +596,7 @@
     return true;
 }
 
-double parseDate(const UString &date)
+double parseDateFromNullTerminatedCharacters(const char* dateString)
 {
     // This parses a date in the form:
     //     Tuesday, 09-Nov-99 23:12:40 GMT
@@ -611,9 +611,6 @@
     //     [Wednesday] January 09 23:12:40 GMT 1999
     //
     // We ignore the weekday.
-
-    CString dateCString = date.UTF8String();
-    const char *dateString = dateCString.c_str();
      
     // Skip leading space
     skipSpacesAndComments(dateString);
@@ -719,7 +716,7 @@
         if (!parseLong(dateString, &newPosStr, 10, &year))
             return NaN;
     }
-    
+
     // Don't fail if the time is missing.
     long hour = 0;
     long minute = 0;
@@ -776,7 +773,7 @@
                 if (!parseLong(dateString, &newPosStr, 10, &second))
                     return NaN;
                 dateString = newPosStr;
-            
+
                 if (second < 0 || second > 59)
                     return NaN;
             }
@@ -852,9 +849,9 @@
             return NaN;
         dateString = newPosStr;
     }
-     
+
     skipSpacesAndComments(dateString);
-     
+
     // Trailing garbage
     if (*dateString)
         return NaN;
@@ -894,46 +891,5 @@
     return trunc(t);
 }
 
-UString formatDate(const GregorianDateTime &t)
-{
-    char buffer[100];
-    snprintf(buffer, sizeof(buffer), "%s %s %02d %04d",
-        weekdayName[(t.weekDay + 6) % 7],
-        monthName[t.month], t.monthDay, t.year + 1900);
-    return buffer;
-}
 
-UString formatDateUTCVariant(const GregorianDateTime &t)
-{
-    char buffer[100];
-    snprintf(buffer, sizeof(buffer), "%s, %02d %s %04d",
-        weekdayName[(t.weekDay + 6) % 7],
-        t.monthDay, monthName[t.month], t.year + 1900);
-    return buffer;
-}
-
-UString formatTime(const GregorianDateTime &t, bool utc)
-{
-    char buffer[100];
-    if (utc) {
-        snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
-    } else {
-        int offset = abs(gmtoffset(t));
-        char timeZoneName[70];
-        struct tm gtm = t;
-        strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
-
-        if (timeZoneName[0]) {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d (%s)",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
-        } else {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
-        }
-    }
-    return UString(buffer);
-}
-
-} // namespace JSC
+} // namespace WTF
diff --git a/JavaScriptCore/runtime/DateMath.h b/JavaScriptCore/wtf/DateMath.h
similarity index 95%
rename from JavaScriptCore/runtime/DateMath.h
rename to JavaScriptCore/wtf/DateMath.h
index 8a15c80..8690a49 100644
--- a/JavaScriptCore/runtime/DateMath.h
+++ b/JavaScriptCore/wtf/DateMath.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -45,12 +46,11 @@
 #include <string.h>
 #include <wtf/Noncopyable.h>
 
-namespace JSC {
+namespace WTF {
 
-class UString;
 struct GregorianDateTime;
 
-void initDateMath();
+void initializeDates();
 void msToGregorianDateTime(double, bool outputIsUTC, GregorianDateTime&);
 double gregorianDateTimeToMS(const GregorianDateTime&, double, bool inputIsUTC);
 double getUTCOffset();
@@ -60,12 +60,8 @@
 void getLocalTime(const time_t*, tm*);
 
 // Not really math related, but this is currently the only shared place to put these.  
-double parseDate(const UString&);
+double parseDateFromNullTerminatedCharacters(const char*);
 double timeClip(double);
-UString formatDate(const GregorianDateTime&);
-UString formatDateUTCVariant(const GregorianDateTime&);
-UString formatTime(const GregorianDateTime&, bool inputIsUTC);
-
 
 const char * const weekdayName[7] = { "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" };
 const char * const monthName[12] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
@@ -186,6 +182,6 @@
     return t.utcOffset;
 }
 
-} // namespace JSC
+} // namespace WTF
 
 #endif // DateMath_h
diff --git a/JavaScriptCore/wtf/FastAllocBase.h b/JavaScriptCore/wtf/FastAllocBase.h
new file mode 100644
index 0000000..71e6bfa
--- /dev/null
+++ b/JavaScriptCore/wtf/FastAllocBase.h
@@ -0,0 +1,400 @@
+/*
+ * Copyright (C) 2008, 2009 Paul Pedriana <ppedriana@ea.com>. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FastAllocBase_h
+#define FastAllocBase_h
+
+// Provides customizable overrides of fastMalloc/fastFree and operator new/delete
+//
+// Provided functionality:
+//    namespace WTF {
+//        class FastAllocBase;
+//
+//        T*    fastNew<T>();
+//        T*    fastNew<T>(arg);
+//        T*    fastNew<T>(arg, arg);
+//        T*    fastNewArray<T>(count);
+//        void  fastDelete(T* p);
+//        void  fastDeleteArray(T* p);
+//        void  fastNonNullDelete(T* p);
+//        void  fastNonNullDeleteArray(T* p);
+//    }
+//
+// FastDelete assumes that the underlying
+//
+// Example usage:
+//    class Widget : public FastAllocBase { ... };
+//
+//    char* charPtr = fastNew<char>();
+//    fastDelete(charPtr);
+//
+//    char* charArrayPtr = fastNewArray<char>(37);
+//    fastDeleteArray(charArrayPtr);
+//
+//    void** voidPtrPtr = fastNew<void*>();
+//    fastDelete(voidPtrPtr);
+//
+//    void** voidPtrArrayPtr = fastNewArray<void*>(37);
+//    fastDeleteArray(voidPtrArrayPtr);
+//
+//    POD* podPtr = fastNew<POD>();
+//    fastDelete(podPtr);
+//
+//    POD* podArrayPtr = fastNewArray<POD>(37);
+//    fastDeleteArray(podArrayPtr);
+//
+//    Object* objectPtr = fastNew<Object>();
+//    fastDelete(objectPtr);
+//
+//    Object* objectArrayPtr = fastNewArray<Object>(37);
+//    fastDeleteArray(objectArrayPtr);
+//
+
+#include <new>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include "FastMalloc.h"
+#include "TypeTraits.h"
+#include <wtf/Assertions.h>
+
+namespace WTF {
+
+    class FastAllocBase {
+    public:
+        // Placement operator new.
+        void* operator new(size_t, void* p) { return p; }
+        void* operator new[](size_t, void* p) { return p; }
+
+        void* operator new(size_t size)
+        {
+            void* p = fastMalloc(size);
+            fastMallocMatchValidateMalloc(p, Internal::AllocTypeClassNew);
+            return p;
+        }
+
+        void operator delete(void* p)
+        {
+            fastMallocMatchValidateFree(p, Internal::AllocTypeClassNew);
+            fastFree(p);
+        }
+
+        void* operator new[](size_t size)
+        {
+            void* p = fastMalloc(size);
+            fastMallocMatchValidateMalloc(p, Internal::AllocTypeClassNewArray);
+            return p;
+        }
+
+        void operator delete[](void* p)
+        {
+            fastMallocMatchValidateFree(p, Internal::AllocTypeClassNewArray);
+            fastFree(p);
+        }
+    };
+
+    // fastNew / fastDelete
+
+    template <typename T>
+    inline T* fastNew()
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T;
+    }
+
+    template <typename T, typename Arg1>
+    inline T* fastNew(Arg1 arg1)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1);
+    }
+
+    template <typename T, typename Arg1, typename Arg2>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2);
+    }
+
+    template <typename T, typename Arg1, typename Arg2, typename Arg3>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2, Arg3 arg3)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2, arg3);
+    }
+
+    template <typename T, typename Arg1, typename Arg2, typename Arg3, typename Arg4>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2, Arg3 arg3, Arg4 arg4)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2, arg3, arg4);
+    }
+
+    template <typename T, typename Arg1, typename Arg2, typename Arg3, typename Arg4, typename Arg5>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2, Arg3 arg3, Arg4 arg4, Arg5 arg5)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2, arg3, arg4, arg5);
+    }
+
+    namespace Internal {
+
+        // We define a union of pointer to an integer and pointer to T.
+        // When non-POD arrays are allocated we add a few leading bytes to tell what
+        // the size of the array is. We return to the user the pointer to T.
+        // The way to think of it is as if we allocate a struct like so:
+        //    struct Array {
+        //        AllocAlignmentInteger m_size;
+        //        T m_T[array count];
+        //    };
+
+        template <typename T>
+        union ArraySize {
+            AllocAlignmentInteger* size;
+            T* t;
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a trivial ctor and a trivial dtor.
+        template <typename T, bool trivialCtor, bool trivialDtor>
+        struct NewArrayImpl {
+            static T* fastNewArray(size_t count)
+            {
+                T* p = static_cast<T*>(fastMalloc(sizeof(T) * count));
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+                return p;
+            }
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a non-trivial ctor and a trivial dtor.
+        template <typename T>
+        struct NewArrayImpl<T, false, true> {
+            static T* fastNewArray(size_t count)
+            {
+                T* p = static_cast<T*>(fastMalloc(sizeof(T) * count));
+
+                if (!p)
+                    return 0;
+
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+
+                for (T* pObject = p, *pObjectEnd = pObject + count; pObject != pObjectEnd; ++pObject)
+                    ::new(pObject) T;
+
+                return p;
+            }
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a trivial ctor and a non-trivial dtor.
+        template <typename T>
+        struct NewArrayImpl<T, true, false> {
+            static T* fastNewArray(size_t count)
+            {
+                void* p = fastMalloc(sizeof(AllocAlignmentInteger) + (sizeof(T) * count));
+                ArraySize<T> a = { static_cast<AllocAlignmentInteger*>(p) };
+
+                if (!p)
+                    return 0;
+
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+                *a.size++ = count;
+                // No need to construct the objects in this case.
+
+                return a.t;
+            }
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a non-trivial ctor and a non-trivial dtor.
+        template <typename T>
+        struct NewArrayImpl<T, false, false> {
+            static T* fastNewArray(size_t count)
+            {
+                void* p = fastMalloc(sizeof(AllocAlignmentInteger) + (sizeof(T) * count));
+                ArraySize<T> a = { static_cast<AllocAlignmentInteger*>(p) };
+
+                if (!p)
+                    return 0;
+
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+                *a.size++ = count;
+
+                for (T* pT = a.t, *pTEnd = pT + count; pT != pTEnd; ++pT)
+                    ::new(pT) T;
+
+                return a.t;
+            }
+        };
+    } // namespace Internal
+
+    template <typename T>
+    inline T* fastNewArray(size_t count)
+    {
+        return Internal::NewArrayImpl<T, WTF::HasTrivialConstructor<T>::value, WTF::HasTrivialDestructor<T>::value>::fastNewArray(count);
+    }
+
+    template <typename T>
+    inline void fastDelete(T* p)
+    {
+        if (!p)
+            return;
+
+        fastMallocMatchValidateFree(p, Internal::AllocTypeFastNew);
+        p->~T();
+        fastFree(p);
+    }
+
+    namespace Internal {
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a trivial dtor.
+        template <typename T, bool trivialDtor>
+        struct DeleteArrayImpl {
+            static void fastDeleteArray(void* p)
+            {
+                // No need to destruct the objects in this case.
+                // We expect that fastFree checks for null.
+                fastMallocMatchValidateFree(p, Internal::AllocTypeFastNewArray);
+                fastFree(p);
+            }
+        };
+
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a non-trivial dtor.
+        template <typename T>
+        struct DeleteArrayImpl<T, false> {
+            static void fastDeleteArray(T* p)
+            {
+                if (!p)
+                    return;
+
+                ArraySize<T> a;
+                a.t = p;
+                a.size--; // Decrement size pointer
+
+                T* pEnd = p + *a.size;
+                while (pEnd-- != p)
+                    pEnd->~T();
+
+                fastMallocMatchValidateFree(a.size, Internal::AllocTypeFastNewArray);
+                fastFree(a.size);
+            }
+        };
+
+    } // namespace Internal
+
+    template <typename T>
+    void fastDeleteArray(T* p)
+    {
+        Internal::DeleteArrayImpl<T, WTF::HasTrivialDestructor<T>::value>::fastDeleteArray(p);
+    }
+
+
+    template <typename T>
+    inline void fastNonNullDelete(T* p)
+    {
+        fastMallocMatchValidateFree(p, Internal::AllocTypeFastNew);
+        p->~T();
+        fastFree(p);
+    }
+
+    namespace Internal {
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a trivial dtor.
+        template <typename T, bool trivialDtor>
+        struct NonNullDeleteArrayImpl {
+            static void fastNonNullDeleteArray(void* p)
+            {
+                fastMallocMatchValidateFree(p, Internal::AllocTypeFastNewArray);
+                // No need to destruct the objects in this case.
+                fastFree(p);
+            }
+        };
+
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a non-trivial dtor.
+        template <typename T>
+        struct NonNullDeleteArrayImpl<T, false> {
+            static void fastNonNullDeleteArray(T* p)
+            {
+                ArraySize<T> a;
+                a.t = p;
+                a.size--;
+
+                T* pEnd = p + *a.size;
+                while (pEnd-- != p)
+                    pEnd->~T();
+
+                fastMallocMatchValidateFree(a.size, Internal::AllocTypeFastNewArray);
+                fastFree(a.size);
+            }
+        };
+
+    } // namespace Internal
+
+    template <typename T>
+    void fastNonNullDeleteArray(T* p)
+    {
+        Internal::NonNullDeleteArrayImpl<T, WTF::HasTrivialDestructor<T>::value>::fastNonNullDeleteArray(p);
+    }
+
+
+} // namespace WTF
+
+#endif // FastAllocBase_h
diff --git a/JavaScriptCore/wtf/FastMalloc.cpp b/JavaScriptCore/wtf/FastMalloc.cpp
index bcac242..c65ba85 100644
--- a/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/JavaScriptCore/wtf/FastMalloc.cpp
@@ -1,4 +1,4 @@
-// Copyright (c) 2005, 2007, The Android Open Source Project
+// Copyright (c) 2005, 2007, Google Inc.
 // All rights reserved.
 // Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
 // 
@@ -78,6 +78,7 @@
 #include "FastMalloc.h"
 
 #include "Assertions.h"
+#include <limits>
 #if ENABLE(JSC_MULTIPLE_THREADS)
 #include <pthread.h>
 #endif
@@ -151,6 +152,19 @@
 
 namespace WTF {
 
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+
+namespace Internal {
+
+void fastMallocMatchFailed(void*)
+{
+    CRASH();
+}
+
+} // namespace Internal
+
+#endif
+
 void* fastZeroedMalloc(size_t n) 
 {
     void* result = fastMalloc(n);
@@ -183,13 +197,34 @@
 void* tryFastMalloc(size_t n) 
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= n)  // If overflow would occur...
+        return 0;
+
+    void* result = malloc(n + sizeof(AllocAlignmentInteger));
+    if (!result)
+        return 0;
+
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+
+    return result;
+#else
     return malloc(n);
+#endif
 }
 
 void* fastMalloc(size_t n) 
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = tryFastMalloc(n);
+#else
     void* result = malloc(n);
+#endif
+
     if (!result)
         CRASH();
     return result;
@@ -198,13 +233,36 @@
 void* tryFastCalloc(size_t n_elements, size_t element_size)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    size_t totalBytes = n_elements * element_size;
+    if (n_elements > 1 && element_size && (totalBytes / element_size) != n_elements || (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= totalBytes))
+        return 0;
+
+    totalBytes += sizeof(AllocAlignmentInteger);
+    void* result = malloc(totalBytes);
+    if (!result)
+        return 0;
+
+    memset(result, 0, totalBytes);
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+    return result;
+#else
     return calloc(n_elements, element_size);
+#endif
 }
 
 void* fastCalloc(size_t n_elements, size_t element_size)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = tryFastCalloc(n_elements, element_size);
+#else
     void* result = calloc(n_elements, element_size);
+#endif
+
     if (!result)
         CRASH();
     return result;
@@ -213,19 +271,57 @@
 void fastFree(void* p)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (!p)
+        return;
+
+    AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(p);
+    if (*header != Internal::AllocTypeMalloc)
+        Internal::fastMallocMatchFailed(p);
+    free(header);
+#else
     free(p);
+#endif
 }
 
 void* tryFastRealloc(void* p, size_t n)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (p) {
+        if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= n)  // If overflow would occur...
+            return 0;
+        AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(p);
+        if (*header != Internal::AllocTypeMalloc)
+            Internal::fastMallocMatchFailed(p);
+        void* result = realloc(header, n + sizeof(AllocAlignmentInteger));
+        if (!result)
+            return 0;
+
+        // This should not be needed because the value is already there:
+        // *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+        result = static_cast<AllocAlignmentInteger*>(result) + 1;
+        return result;
+    } else {
+        return fastMalloc(n);
+    }
+#else
     return realloc(p, n);
+#endif
 }
 
 void* fastRealloc(void* p, size_t n)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = tryFastRealloc(p, n);
+#else
     void* result = realloc(p, n);
+#endif
+
     if (!result)
         CRASH();
     return result;
@@ -265,6 +361,7 @@
 #include "TCSystemAlloc.h"
 #include <algorithm>
 #include <errno.h>
+#include <limits>
 #include <new>
 #include <pthread.h>
 #include <stdarg.h>
@@ -3294,7 +3391,20 @@
 ALWAYS_INLINE
 #endif
 void* malloc(size_t size) {
-  void* result = do_malloc(size);
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= size)  // If overflow would occur...
+        return 0;
+    size += sizeof(AllocAlignmentInteger);
+    void* result = do_malloc(size);
+    if (!result)
+        return 0;
+
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+#else
+    void* result = do_malloc(size);
+#endif
+
 #ifndef WTF_CHANGES
   MallocHook::InvokeNewHook(result, size);
 #endif
@@ -3308,7 +3418,18 @@
 #ifndef WTF_CHANGES
   MallocHook::InvokeDeleteHook(ptr);
 #endif
-  do_free(ptr);
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (!ptr)
+        return;
+
+    AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(ptr);
+    if (*header != Internal::AllocTypeMalloc)
+        Internal::fastMallocMatchFailed(ptr);
+    do_free(header);
+#else
+    do_free(ptr);
+#endif
 }
 
 #ifndef WTF_CHANGES
@@ -3331,16 +3452,31 @@
 ALWAYS_INLINE
 #endif
 void* calloc(size_t n, size_t elem_size) {
-  const size_t totalBytes = n * elem_size;
+  size_t totalBytes = n * elem_size;
     
   // Protect against overflow
   if (n > 1 && elem_size && (totalBytes / elem_size) != n)
     return 0;
-    
-  void* result = do_malloc(totalBytes);
-  if (result != NULL) {
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= totalBytes)  // If overflow would occur...
+        return 0;
+
+    totalBytes += sizeof(AllocAlignmentInteger);
+    void* result = do_malloc(totalBytes);
+    if (!result)
+        return 0;
+
     memset(result, 0, totalBytes);
-  }
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+#else
+    void* result = do_malloc(totalBytes);
+    if (result != NULL) {
+        memset(result, 0, totalBytes);
+    }
+#endif
+
 #ifndef WTF_CHANGES
   MallocHook::InvokeNewHook(result, totalBytes);
 #endif
@@ -3381,10 +3517,14 @@
 #endif
 void* realloc(void* old_ptr, size_t new_size) {
   if (old_ptr == NULL) {
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = malloc(new_size);
+#else
     void* result = do_malloc(new_size);
 #ifndef WTF_CHANGES
     MallocHook::InvokeNewHook(result, new_size);
 #endif
+#endif
     return result;
   }
   if (new_size == 0) {
@@ -3395,6 +3535,16 @@
     return NULL;
   }
 
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= new_size)  // If overflow would occur...
+        return 0;
+    new_size += sizeof(AllocAlignmentInteger);
+    AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(old_ptr);
+    if (*header != Internal::AllocTypeMalloc)
+        Internal::fastMallocMatchFailed(old_ptr);
+    old_ptr = header;
+#endif
+
   // Get the size of the old entry
   const PageID p = reinterpret_cast<uintptr_t>(old_ptr) >> kPageShift;
   size_t cl = pageheap->GetSizeClassIfCached(p);
@@ -3431,8 +3581,14 @@
     // that we already know the sizeclass of old_ptr.  The benefit
     // would be small, so don't bother.
     do_free(old_ptr);
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    new_ptr = static_cast<AllocAlignmentInteger*>(new_ptr) + 1;
+#endif
     return new_ptr;
   } else {
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    old_ptr = pByte + sizeof(AllocAlignmentInteger);  // Set old_ptr back to the user pointer.
+#endif
     return old_ptr;
   }
 }
@@ -3933,7 +4089,7 @@
 malloc_introspection_t jscore_fastmalloc_introspection = { &FastMallocZone::enumerate, &FastMallocZone::goodSize, &FastMallocZone::check, &FastMallocZone::print,
     &FastMallocZone::log, &FastMallocZone::forceLock, &FastMallocZone::forceUnlock, &FastMallocZone::statistics
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
     , 0 // zone_locked will not be called on the zone unless it advertises itself as version five or higher.
 #endif
 
diff --git a/JavaScriptCore/wtf/FastMalloc.h b/JavaScriptCore/wtf/FastMalloc.h
index f1264ac..9e13cf9 100644
--- a/JavaScriptCore/wtf/FastMalloc.h
+++ b/JavaScriptCore/wtf/FastMalloc.h
@@ -56,6 +56,95 @@
     };
     FastMallocStatistics fastMallocStatistics();
 
+    // This defines a type which holds an unsigned integer and is the same
+    // size as the minimally aligned memory allocation.
+    typedef unsigned long long AllocAlignmentInteger;
+
+    namespace Internal {
+        enum AllocType {                    // Start with an unusual number instead of zero, because zero is common.
+            AllocTypeMalloc = 0x375d6750,   // Encompasses fastMalloc, fastZeroedMalloc, fastCalloc, fastRealloc.
+            AllocTypeClassNew,              // Encompasses class operator new from FastAllocBase.
+            AllocTypeClassNewArray,         // Encompasses class operator new[] from FastAllocBase.
+            AllocTypeFastNew,               // Encompasses fastNew.
+            AllocTypeFastNewArray,          // Encompasses fastNewArray.
+            AllocTypeNew,                   // Encompasses global operator new.
+            AllocTypeNewArray               // Encompasses global operator new[].
+        };
+    }
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+
+    // Malloc validation is a scheme whereby a tag is attached to an
+    // allocation which identifies how it was originally allocated.
+    // This allows us to verify that the freeing operation matches the
+    // allocation operation. If memory is allocated with operator new[]
+    // but freed with free or delete, this system would detect that.
+    // In the implementation here, the tag is an integer prepended to
+    // the allocation memory which is assigned one of the AllocType
+    // enumeration values. An alternative implementation of this
+    // scheme could store the tag somewhere else or ignore it.
+    // Users of FastMalloc don't need to know or care how this tagging
+    // is implemented.
+
+    namespace Internal {
+
+        // Return the AllocType tag associated with the allocated block p.
+        inline AllocType fastMallocMatchValidationType(const void* p)
+        {
+            const AllocAlignmentInteger* type = static_cast<const AllocAlignmentInteger*>(p) - 1;
+            return static_cast<AllocType>(*type);
+        }
+
+        // Return the address of the AllocType tag associated with the allocated block p.
+        inline AllocAlignmentInteger* fastMallocMatchValidationValue(void* p)
+        {
+            return reinterpret_cast<AllocAlignmentInteger*>(static_cast<char*>(p) - sizeof(AllocAlignmentInteger));
+        }
+
+        // Set the AllocType tag to be associaged with the allocated block p.
+        inline void setFastMallocMatchValidationType(void* p, AllocType allocType)
+        {
+            AllocAlignmentInteger* type = static_cast<AllocAlignmentInteger*>(p) - 1;
+            *type = static_cast<AllocAlignmentInteger>(allocType);
+        }
+
+        // Handle a detected alloc/free mismatch. By default this calls CRASH().
+        void fastMallocMatchFailed(void* p);
+
+    } // namespace Internal
+
+    // This is a higher level function which is used by FastMalloc-using code.
+    inline void fastMallocMatchValidateMalloc(void* p, Internal::AllocType allocType)
+    {
+        if (!p)
+            return;
+
+        Internal::setFastMallocMatchValidationType(p, allocType);
+    }
+
+    // This is a higher level function which is used by FastMalloc-using code.
+    inline void fastMallocMatchValidateFree(void* p, Internal::AllocType allocType)
+    {
+        if (!p)
+            return;
+
+        if (Internal::fastMallocMatchValidationType(p) != allocType)
+            Internal::fastMallocMatchFailed(p);
+        Internal::setFastMallocMatchValidationType(p, Internal::AllocTypeMalloc);  // Set it to this so that fastFree thinks it's OK.
+    }
+
+#else
+
+    inline void fastMallocMatchValidateMalloc(void*, Internal::AllocType)
+    {
+    }
+
+    inline void fastMallocMatchValidateFree(void*, Internal::AllocType)
+    {
+    }
+
+#endif
+
 } // namespace WTF
 
 using WTF::fastMalloc;
diff --git a/JavaScriptCore/wtf/GOwnPtr.cpp b/JavaScriptCore/wtf/GOwnPtr.cpp
index 58869f4..432885f 100644
--- a/JavaScriptCore/wtf/GOwnPtr.cpp
+++ b/JavaScriptCore/wtf/GOwnPtr.cpp
@@ -56,4 +56,10 @@
         g_dir_close(ptr);
 }
 
+template <> void freeOwnedGPtr<GHashTable>(GHashTable* ptr)
+{
+    if (ptr)
+        g_hash_table_unref(ptr);
+}
+
 } // namespace WTF
diff --git a/JavaScriptCore/wtf/GOwnPtr.h b/JavaScriptCore/wtf/GOwnPtr.h
index bbb793a..8d03ff2 100644
--- a/JavaScriptCore/wtf/GOwnPtr.h
+++ b/JavaScriptCore/wtf/GOwnPtr.h
@@ -35,6 +35,7 @@
     template<> void freeOwnedGPtr<GMutex>(GMutex*);
     template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
     template<> void freeOwnedGPtr<GDir>(GDir*);
+    template<> void freeOwnedGPtr<GHashTable>(GHashTable*);
 
     template <typename T> class GOwnPtr : Noncopyable {
     public:
diff --git a/JavaScriptCore/wtf/NotFound.h b/JavaScriptCore/wtf/NotFound.h
index f0bb866..4263bce 100644
--- a/JavaScriptCore/wtf/NotFound.h
+++ b/JavaScriptCore/wtf/NotFound.h
@@ -32,4 +32,6 @@
 
 } // namespace WTF
 
+using WTF::notFound;
+
 #endif // NotFound_h
diff --git a/JavaScriptCore/wtf/OwnFastMallocPtr.h b/JavaScriptCore/wtf/OwnFastMallocPtr.h
new file mode 100644
index 0000000..5c0d064
--- /dev/null
+++ b/JavaScriptCore/wtf/OwnFastMallocPtr.h
@@ -0,0 +1,52 @@
+/*
+ *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef OwnFastMallocPtr_h
+#define OwnFastMallocPtr_h
+
+#include "FastMalloc.h"
+#include "Noncopyable.h"
+
+namespace WTF {
+
+    template<class T> class OwnFastMallocPtr : Noncopyable {
+    public:
+        explicit OwnFastMallocPtr(T* ptr) : m_ptr(ptr)
+        {
+        }
+
+        ~OwnFastMallocPtr()
+        {
+            fastFree(m_ptr);
+        }
+
+        T* get() const { return m_ptr; }
+        T* release() { T* ptr = m_ptr; m_ptr = 0; return ptr; }
+
+    private:
+        T* m_ptr;
+    };
+
+} // namespace WTF
+
+using WTF::OwnFastMallocPtr;
+
+#endif // OwnFastMallocPtr_h
diff --git a/JavaScriptCore/wtf/OwnPtr.h b/JavaScriptCore/wtf/OwnPtr.h
index af939e7..9e4bd32 100644
--- a/JavaScriptCore/wtf/OwnPtr.h
+++ b/JavaScriptCore/wtf/OwnPtr.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -23,40 +23,16 @@
 
 #include "Assertions.h"
 #include "Noncopyable.h"
+#include "OwnPtrCommon.h"
 #include "TypeTraits.h"
 #include <algorithm>
 #include <memory>
 
-#if PLATFORM(WIN)
-
-typedef struct HBITMAP__* HBITMAP;
-typedef struct HBRUSH__* HBRUSH;
-typedef struct HFONT__* HFONT;
-typedef struct HPALETTE__* HPALETTE;
-typedef struct HPEN__* HPEN;
-typedef struct HRGN__* HRGN;
-
-#endif
-
 namespace WTF {
 
     // Unlike most of our smart pointers, OwnPtr can take either the pointer type or the pointed-to type.
 
-    template <typename T> inline void deleteOwnedPtr(T* ptr)
-    {
-        typedef char known[sizeof(T) ? 1 : -1];
-        if (sizeof(known))
-            delete ptr;
-    }
-
-#if PLATFORM(WIN)
-    void deleteOwnedPtr(HBITMAP);
-    void deleteOwnedPtr(HBRUSH);
-    void deleteOwnedPtr(HFONT);
-    void deleteOwnedPtr(HPALETTE);
-    void deleteOwnedPtr(HPEN);
-    void deleteOwnedPtr(HRGN);
-#endif
+    template <typename T> class PassOwnPtr;
 
     template <typename T> class OwnPtr : Noncopyable {
     public:
@@ -65,6 +41,15 @@
 
         explicit OwnPtr(PtrType ptr = 0) : m_ptr(ptr) { }
         OwnPtr(std::auto_ptr<ValueType> autoPtr) : m_ptr(autoPtr.release()) { }
+        // See comment in PassOwnPtr.h for why this takes a const reference.
+        template <typename U> OwnPtr(const PassOwnPtr<U>& o);
+
+        // This copy constructor is used implicitly by gcc when it generates
+        // transients for assigning a PassOwnPtr<T> object to a stack-allocated
+        // OwnPtr<T> object.  It should never be called explicitly and gcc
+        // should optimize away the constructor when generating code.
+        OwnPtr(const OwnPtr<ValueType>& o);
+
         ~OwnPtr() { deleteOwnedPtr(m_ptr); }
 
         PtrType get() const { return m_ptr; }
@@ -86,19 +71,50 @@
         typedef PtrType OwnPtr::*UnspecifiedBoolType;
         operator UnspecifiedBoolType() const { return m_ptr ? &OwnPtr::m_ptr : 0; }
 
+        OwnPtr& operator=(const PassOwnPtr<T>&);
+        template <typename U> OwnPtr& operator=(const PassOwnPtr<U>&);
+
         void swap(OwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
 
     private:
         PtrType m_ptr;
     };
-    
-    template <typename T> inline void swap(OwnPtr<T>& a, OwnPtr<T>& b) { a.swap(b); }
+
+    template <typename T> template <typename U> inline OwnPtr<T>::OwnPtr(const PassOwnPtr<U>& o)
+        : m_ptr(o.release())
+    {
+    }
+
+    template <typename T> inline OwnPtr<T>& OwnPtr<T>::operator=(const PassOwnPtr<T>& o)
+    {
+        T* ptr = m_ptr;
+        m_ptr = o.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> template <typename U> inline OwnPtr<T>& OwnPtr<T>::operator=(const PassOwnPtr<U>& o)
+    {
+        T* ptr = m_ptr;
+        m_ptr = o.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> inline void swap(OwnPtr<T>& a, OwnPtr<T>& b)
+    {
+        a.swap(b);
+    }
 
     template <typename T, typename U> inline bool operator==(const OwnPtr<T>& a, U* b)
-    { 
+    {
         return a.get() == b; 
     }
-    
+
     template <typename T, typename U> inline bool operator==(T* a, const OwnPtr<U>& b) 
     {
         return a == b.get(); 
@@ -110,10 +126,10 @@
     }
 
     template <typename T, typename U> inline bool operator!=(T* a, const OwnPtr<U>& b)
-    { 
+    {
         return a != b.get(); 
     }
-    
+
     template <typename T> inline typename OwnPtr<T>::PtrType getPtr(const OwnPtr<T>& p)
     {
         return p.get();
diff --git a/WebCore/page/chromium/AXObjectCacheChromium.cpp b/JavaScriptCore/wtf/OwnPtrCommon.h
similarity index 61%
copy from WebCore/page/chromium/AXObjectCacheChromium.cpp
copy to JavaScriptCore/wtf/OwnPtrCommon.h
index bbaf21d..6cd8bdd 100644
--- a/WebCore/page/chromium/AXObjectCacheChromium.cpp
+++ b/JavaScriptCore/wtf/OwnPtrCommon.h
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- * Copyright (C) 2008 Google Inc.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,35 +23,36 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "config.h"
-#include "AXObjectCache.h"
+#ifndef WTF_OwnPtrCommon_h
+#define WTF_OwnPtrCommon_h
 
-#include "AccessibilityObject.h"
+#if PLATFORM(WIN)
+typedef struct HBITMAP__* HBITMAP;
+typedef struct HBRUSH__* HBRUSH;
+typedef struct HFONT__* HFONT;
+typedef struct HPALETTE__* HPALETTE;
+typedef struct HPEN__* HPEN;
+typedef struct HRGN__* HRGN;
+#endif
 
-namespace WebCore {
+namespace WTF {
 
-void AXObjectCache::detachWrapper(AccessibilityObject* obj)
-{
-    // In Chromium, AccessibilityObjects are wrapped lazily.
-    if (AccessibilityObjectWrapper* wrapper = obj->wrapper())
-        wrapper->detach();
-}
+    template <typename T> inline void deleteOwnedPtr(T* ptr)
+    {
+        typedef char known[sizeof(T) ? 1 : -1];
+        if (sizeof(known))
+            delete ptr;
+    }
 
-void AXObjectCache::attachWrapper(AccessibilityObject*)
-{
-    // In Chromium, AccessibilityObjects are wrapped lazily.
-}
+#if PLATFORM(WIN)
+    void deleteOwnedPtr(HBITMAP);
+    void deleteOwnedPtr(HBRUSH);
+    void deleteOwnedPtr(HFONT);
+    void deleteOwnedPtr(HPALETTE);
+    void deleteOwnedPtr(HPEN);
+    void deleteOwnedPtr(HRGN);
+#endif
 
-void AXObjectCache::postNotification(RenderObject*, const String&)
-{
-}
+} // namespace WTF
 
-void AXObjectCache::postNotificationToElement(RenderObject*, const String&)
-{
-}
-
-void AXObjectCache::handleFocusedUIElementChanged()
-{
-}
-
-} // namespace WebCore
+#endif // WTF_OwnPtrCommon_h
diff --git a/JavaScriptCore/wtf/PassOwnPtr.h b/JavaScriptCore/wtf/PassOwnPtr.h
new file mode 100644
index 0000000..ae70457
--- /dev/null
+++ b/JavaScriptCore/wtf/PassOwnPtr.h
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WTF_PassOwnPtr_h
+#define WTF_PassOwnPtr_h
+
+#include "Assertions.h"
+#include "OwnPtrCommon.h"
+#include "TypeTraits.h"
+
+namespace WTF {
+
+    // Unlike most of our smart pointers, PassOwnPtr can take either the pointer type or the pointed-to type.
+
+    template <typename T> class OwnPtr;
+
+    template <typename T> class PassOwnPtr {
+    public:
+        typedef typename RemovePointer<T>::Type ValueType;
+        typedef ValueType* PtrType;
+
+        PassOwnPtr(PtrType ptr = 0) : m_ptr(ptr) { }
+        // It somewhat breaks the type system to allow transfer of ownership out of
+        // a const PassOwnPtr. However, it makes it much easier to work with PassOwnPtr
+        // temporaries, and we don't really have a need to use real const PassOwnPtrs 
+        // anyway.
+        PassOwnPtr(const PassOwnPtr& o) : m_ptr(o.release()) { }
+        template <typename U> PassOwnPtr(const PassOwnPtr<U>& o) : m_ptr(o.release()) { }
+
+        ~PassOwnPtr() { deleteOwnedPtr(m_ptr); }
+
+        PtrType get() const { return m_ptr; }
+
+        void clear() { m_ptr = 0; }
+        PtrType release() const { PtrType ptr = m_ptr; m_ptr = 0; return ptr; }
+
+        ValueType& operator*() const { ASSERT(m_ptr); return *m_ptr; }
+        PtrType operator->() const { ASSERT(m_ptr); return m_ptr; }
+
+        bool operator!() const { return !m_ptr; }
+
+        // This conversion operator allows implicit conversion to bool but not to other integer types.
+        typedef PtrType PassOwnPtr::*UnspecifiedBoolType;
+        operator UnspecifiedBoolType() const { return m_ptr ? &PassOwnPtr::m_ptr : 0; }
+
+        PassOwnPtr& operator=(T*);
+        PassOwnPtr& operator=(const PassOwnPtr<T>&);
+        template <typename U> PassOwnPtr& operator=(const PassOwnPtr<U>&);
+
+    private:
+        mutable PtrType m_ptr;
+    };
+
+    template <typename T> inline PassOwnPtr<T>& PassOwnPtr<T>::operator=(T* optr)
+    {
+        T* ptr = m_ptr;
+        m_ptr = optr;
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> inline PassOwnPtr<T>& PassOwnPtr<T>::operator=(const PassOwnPtr<T>& optr)
+    {
+        T* ptr = m_ptr;
+        m_ptr = optr.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> template <typename U> inline PassOwnPtr<T>& PassOwnPtr<T>::operator=(const PassOwnPtr<U>& optr)
+    {
+        T* ptr = m_ptr;
+        m_ptr = optr.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T, typename U> inline bool operator==(const PassOwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() == b.get(); 
+    }
+
+    template <typename T, typename U> inline bool operator==(const PassOwnPtr<T>& a, const OwnPtr<U>& b) 
+    {
+        return a.get() == b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator==(const OwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() == b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator==(const PassOwnPtr<T>& a, U* b) 
+    {
+        return a.get() == b; 
+    }
+    
+    template <typename T, typename U> inline bool operator==(T* a, const PassOwnPtr<U>& b) 
+    {
+        return a == b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const PassOwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() != b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const PassOwnPtr<T>& a, const OwnPtr<U>& b) 
+    {
+        return a.get() != b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const OwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() != b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const PassOwnPtr<T>& a, U* b)
+    {
+        return a.get() != b; 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(T* a, const PassOwnPtr<U>& b) 
+    {
+        return a != b.get(); 
+    }
+
+    template <typename T, typename U> inline PassOwnPtr<T> static_pointer_cast(const PassOwnPtr<U>& p) 
+    {
+        return PassOwnPtr<T>(static_cast<T*>(p.release())); 
+    }
+
+    template <typename T, typename U> inline PassOwnPtr<T> const_pointer_cast(const PassOwnPtr<U>& p) 
+    {
+        return PassOwnPtr<T>(const_cast<T*>(p.release())); 
+    }
+
+    template <typename T> inline T* getPtr(const PassOwnPtr<T>& p)
+    {
+        return p.get();
+    }
+
+} // namespace WTF
+
+using WTF::PassOwnPtr;
+using WTF::const_pointer_cast;
+using WTF::static_pointer_cast;
+
+#endif // WTF_PassOwnPtr_h
diff --git a/JavaScriptCore/wtf/PassRefPtr.h b/JavaScriptCore/wtf/PassRefPtr.h
index c1dc309..d80ed62 100644
--- a/JavaScriptCore/wtf/PassRefPtr.h
+++ b/JavaScriptCore/wtf/PassRefPtr.h
@@ -40,7 +40,7 @@
         PassRefPtr(const PassRefPtr& o) : m_ptr(o.releaseRef()) {}
         template <typename U> PassRefPtr(const PassRefPtr<U>& o) : m_ptr(o.releaseRef()) { }
 
-        ALWAYS_INLINE ~PassRefPtr() { if (T* ptr = m_ptr) ptr->deref(); }
+        ALWAYS_INLINE ~PassRefPtr() { if (UNLIKELY(m_ptr != 0)) m_ptr->deref(); }
         
         template <class U> 
         PassRefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { if (T* ptr = m_ptr) ptr->ref(); }
diff --git a/JavaScriptCore/wtf/Platform.h b/JavaScriptCore/wtf/Platform.h
index 23e6c8b..e34f7c3 100644
--- a/JavaScriptCore/wtf/Platform.h
+++ b/JavaScriptCore/wtf/Platform.h
@@ -46,6 +46,7 @@
 #elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
 #define BUILDING_ON_LEOPARD 1
 #endif
+#include <TargetConditionals.h>
 #endif
 
 /* PLATFORM(WIN_OS) */
@@ -63,6 +64,13 @@
 #define WTF_PLATFORM_WIN_CE 1
 #endif
 
+/* PLATFORM(LINUX) */
+/* Operating system level dependencies for Linux-like systems that */
+/* should be used regardless of operating environment */
+#ifdef __linux__
+#define WTF_PLATFORM_LINUX 1
+#endif
+
 /* PLATFORM(FREEBSD) */
 /* Operating system level dependencies for FreeBSD-like systems that */
 /* should be used regardless of operating environment */
@@ -142,11 +150,30 @@
 #define WTF_PLATFORM_WIN 1
 #endif
 
+/* PLATFORM(IPHONE) */
+#if (defined(TARGET_OS_EMBEDDED) && TARGET_OS_EMBEDDED) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)
+#define WTF_PLATFORM_IPHONE 1
+#endif
+
+/* PLATFORM(IPHONE_SIMULATOR) */
+#if defined(TARGET_IPHONE_SIMULATOR) && TARGET_IPHONE_SIMULATOR
+#define WTF_PLATFORM_IPHONE 1
+#define WTF_PLATFORM_IPHONE_SIMULATOR 1
+#else
+#define WTF_PLATFORM_IPHONE_SIMULATOR 0
+#endif
+
+#if !defined(WTF_PLATFORM_IPHONE)
+#define WTF_PLATFORM_IPHONE 0
+#endif
+
 /* Graphics engines */
 
 /* PLATFORM(CG) and PLATFORM(CI) */
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || PLATFORM(IPHONE)
 #define WTF_PLATFORM_CG 1
+#endif
+#if PLATFORM(MAC) && !PLATFORM(IPHONE)
 #define WTF_PLATFORM_CI 1
 #endif
 
@@ -189,9 +216,7 @@
 // Prevents Webkit from drawing the caret in textfields and textareas
 // This prevents unnecessary invals.
 #define ENABLE_TEXT_CARET 1
-#if WTF_USE_V8
 #define ENABLE_JAVASCRIPT_DEBUGGER 0
-#endif
 #endif // ANDROID
 
 /* CPU */
@@ -230,6 +255,9 @@
 #define WTF_PLATFORM_FORCE_PACK 1
 #endif
 #endif
+#if defined(__ARM_ARCH_7A__)
+#define WTF_PLATFORM_ARM_V7 1
+#endif
 
 /* PLATFORM(X86) */
 #if   defined(__i386__) \
@@ -242,7 +270,6 @@
 
 /* PLATFORM(X86_64) */
 #if   defined(__x86_64__) \
-   || defined(__ia64__) \
    || defined(_M_X64)
 #define WTF_PLATFORM_X86_64 1
 #endif
@@ -315,7 +342,7 @@
 #define WTF_COMPILER_WINSCW 1
 #endif
 
-#if (PLATFORM(MAC) || PLATFORM(WIN)) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
+#if (PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN)) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
 #define ENABLE_JSC_MULTIPLE_THREADS 1
 #endif
 
@@ -330,7 +357,7 @@
 #define WTF_USE_ICU_UNICODE 1
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !PLATFORM(IPHONE)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
 #if !defined(ENABLE_MAC_JAVA_BRIDGE)
@@ -348,11 +375,24 @@
 #define WTF_USE_PTHREADS 1
 #endif
 
+#if PLATFORM(IPHONE)
+#define WTF_PLATFORM_CF 1
+#define WTF_USE_PTHREADS 1
+#define ENABLE_FTPDIR 1
+#define ENABLE_MAC_JAVA_BRIDGE 0
+#define ENABLE_ICONDATABASE 0
+#define ENABLE_GEOLOCATION 1
+#define ENABLE_NETSCAPE_PLUGIN_API 0
+#define HAVE_READLINE 1
+#define ENABLE_REPAINT_THROTTLING 1
+#endif
+
 #if PLATFORM(WIN)
 #define WTF_USE_WININET 1
 #endif
 
 #if PLATFORM(WX)
+#define ENABLE_ASSEMBLER 1
 #define WTF_USE_CURL 1
 #define WTF_USE_PTHREADS 1
 #endif
@@ -364,15 +404,11 @@
 #endif
 
 #if !defined(HAVE_ACCESSIBILITY)
-#if PLATFORM(MAC) || PLATFORM(WIN) || PLATFORM(GTK) || PLATFORM(CHROMIUM)
+#if PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN) || PLATFORM(GTK) || PLATFORM(CHROMIUM)
 #define HAVE_ACCESSIBILITY 1
 #endif
 #endif /* !defined(HAVE_ACCESSIBILITY) */
 
-#if COMPILER(GCC)
-#define HAVE_COMPUTED_GOTO 1
-#endif
-
 #if PLATFORM(DARWIN)
 
 #define HAVE_ERRNO_H 1
@@ -385,8 +421,13 @@
 #define HAVE_SYS_TIME_H 1
 #define HAVE_SYS_TIMEB_H 1
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
 #define HAVE_MADV_FREE_REUSE 1
+#define HAVE_MADV_FREE 1
+#endif
+
+#if PLATFORM(IPHONE)
+#define HAVE_MADV_FREE 1
 #endif
 
 #elif PLATFORM(WIN_OS)
@@ -438,6 +479,12 @@
 
 /* ENABLE macro defaults */
 
+/* fastMalloc match validation allows for runtime verification that
+   new is matched by delete, fastMalloc is matched by fastFree, etc. */
+#if !defined(ENABLE_FAST_MALLOC_MATCH_VALIDATION)
+#define ENABLE_FAST_MALLOC_MATCH_VALIDATION 0
+#endif
+
 #if !defined(ENABLE_ICONDATABASE)
 #define ENABLE_ICONDATABASE 1
 #endif
@@ -470,16 +517,15 @@
 #define ENABLE_OPCODE_STATS 0
 #endif
 
-#if !defined(ENABLE_CODEBLOCK_SAMPLING)
-#define ENABLE_CODEBLOCK_SAMPLING 0
-#endif
-
-#if ENABLE(CODEBLOCK_SAMPLING) && !defined(ENABLE_OPCODE_SAMPLING)
-#define ENABLE_OPCODE_SAMPLING 1
-#endif
-
-#if !defined(ENABLE_OPCODE_SAMPLING)
+#define ENABLE_SAMPLING_COUNTERS 0
+#define ENABLE_SAMPLING_FLAGS 0
 #define ENABLE_OPCODE_SAMPLING 0
+#define ENABLE_CODEBLOCK_SAMPLING 0
+#if ENABLE(CODEBLOCK_SAMPLING) && !ENABLE(OPCODE_SAMPLING)
+#error "CODEBLOCK_SAMPLING requires OPCODE_SAMPLING"
+#endif
+#if ENABLE(OPCODE_SAMPLING) || ENABLE(SAMPLING_FLAGS)
+#define ENABLE_SAMPLING_THREAD 1
 #endif
 
 #if !defined(ENABLE_GEOLOCATION)
@@ -511,41 +557,79 @@
 /* The JIT is tested & working on x86_64 Mac */
 #if PLATFORM(X86_64) && PLATFORM(MAC)
     #define ENABLE_JIT 1
-    #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
 /* The JIT is tested & working on x86 Mac */
 #elif PLATFORM(X86) && PLATFORM(MAC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
+#elif PLATFORM(ARM_V7) && PLATFORM(IPHONE) 
+    /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */
+    #define ENABLE_JIT 0
+    #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
 /* The JIT is tested & working on x86 Windows */
 #elif PLATFORM(X86) && PLATFORM(WIN)
     #define ENABLE_JIT 1
-    #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
-#endif
-    #define ENABLE_JIT_OPTIMIZE_CALL 1
-    #define ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS 1
-    #define ENABLE_JIT_OPTIMIZE_ARITHMETIC 1
-#endif
-
-#if ENABLE(JIT)
-#if !(USE(JIT_STUB_ARGUMENT_VA_LIST) || USE(JIT_STUB_ARGUMENT_REGISTER) || USE(JIT_STUB_ARGUMENT_STACK))
-#error Please define one of the JIT_STUB_ARGUMENT settings.
-#elif (USE(JIT_STUB_ARGUMENT_VA_LIST) && USE(JIT_STUB_ARGUMENT_REGISTER)) \
-   || (USE(JIT_STUB_ARGUMENT_VA_LIST) && USE(JIT_STUB_ARGUMENT_STACK)) \
-   || (USE(JIT_STUB_ARGUMENT_REGISTER) && USE(JIT_STUB_ARGUMENT_STACK))
-#error Please do not define more than one of the JIT_STUB_ARGUMENT settings.
 #endif
 #endif
 
-/* WREC supports x86 & x86-64, and has been tested on Mac and Windows ('cept on 64-bit on Mac). */
-#if (!defined(ENABLE_WREC) && PLATFORM(X86) && PLATFORM(MAC)) \
- || (!defined(ENABLE_WREC) && PLATFORM(X86_64) && PLATFORM(MAC)) \
- || (!defined(ENABLE_WREC) && PLATFORM(X86) && PLATFORM(WIN))
-#define ENABLE_WREC 1
+#ifndef ENABLE_JIT_OPTIMIZE_CALL
+#define ENABLE_JIT_OPTIMIZE_CALL 1
+#endif
+#ifndef ENABLE_JIT_OPTIMIZE_NATIVE_CALL
+#define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 1
+#endif
+#ifndef ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS
+#define ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS 1
+#endif
+#ifndef ENABLE_JIT_OPTIMIZE_ARITHMETIC
+#define ENABLE_JIT_OPTIMIZE_ARITHMETIC 1
+#endif
+#ifndef ENABLE_JIT_OPTIMIZE_METHOD_CALLS
+#define ENABLE_JIT_OPTIMIZE_METHOD_CALLS 1
 #endif
 
-#if ENABLE(JIT) || ENABLE(WREC)
+#if PLATFORM(X86) && COMPILER(MSVC)
+#define JSC_HOST_CALL __fastcall
+#elif PLATFORM(X86) && COMPILER(GCC)
+#define JSC_HOST_CALL __attribute__ ((fastcall))
+#else
+#define JSC_HOST_CALL
+#endif
+
+#if COMPILER(GCC) && !ENABLE(JIT)
+#define HAVE_COMPUTED_GOTO 1
+#endif
+
+#if ENABLE(JIT) && defined(COVERAGE)
+    #define WTF_USE_INTERPRETER 0
+#else
+    #define WTF_USE_INTERPRETER 1
+#endif
+
+/* Yet Another Regex Runtime. */
+/* YARR supports x86 & x86-64, and has been tested on Mac and Windows. */
+#if (!defined(ENABLE_YARR_JIT) && PLATFORM(X86) && PLATFORM(MAC)) \
+ || (!defined(ENABLE_YARR_JIT) && PLATFORM(X86_64) && PLATFORM(MAC)) \
+ /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */ \
+ || (!defined(ENABLE_YARR_JIT) && PLATFORM(ARM_V7) && PLATFORM(IPHONE) && 0) \
+ || (!defined(ENABLE_YARR_JIT) && PLATFORM(X86) && PLATFORM(WIN))
+#define ENABLE_YARR 1
+#define ENABLE_YARR_JIT 1
+#endif
+/* Sanity Check */
+#if ENABLE(YARR_JIT) && !ENABLE(YARR)
+#error "YARR_JIT requires YARR"
+#endif
+
+#if ENABLE(JIT) || ENABLE(YARR_JIT)
 #define ENABLE_ASSEMBLER 1
 #endif
+/* Setting this flag prevents the assembler from using RWX memory; this may improve
+   security but currectly comes at a significant performance cost. */
+#if PLATFORM(ARM_V7) && PLATFORM(IPHONE)
+#define ENABLE_ASSEMBLER_WX_EXCLUSIVE 1
+#else
+#define ENABLE_ASSEMBLER_WX_EXCLUSIVE 0
+#endif
 
 #if !defined(ENABLE_PAN_SCROLLING) && PLATFORM(WIN_OS)
 #define ENABLE_PAN_SCROLLING 1
diff --git a/JavaScriptCore/wtf/RefCounted.h b/JavaScriptCore/wtf/RefCounted.h
index 93ee0da..c174145 100644
--- a/JavaScriptCore/wtf/RefCounted.h
+++ b/JavaScriptCore/wtf/RefCounted.h
@@ -57,7 +57,9 @@
     {
     }
 
-    ~RefCountedBase() {}
+    ~RefCountedBase()
+    {
+    }
 
     // Returns whether the pointer should be freed or not.
     bool derefBase()
@@ -75,7 +77,20 @@
         return false;
     }
 
-protected:
+    // Helper for generating JIT code. Please do not use for non-JIT purposes.
+    int* addressOfCount()
+    {
+        return &m_refCount;
+    }
+
+#ifndef NDEBUG
+    bool deletionHasBegun() const
+    {
+        return m_deletionHasBegun;
+    }
+#endif
+
+private:
     template<class T>
     friend class CrossThreadRefCounted;
 
@@ -95,7 +110,9 @@
     }
 
 protected:
-    ~RefCounted() {}
+    ~RefCounted()
+    {
+    }
 };
 
 } // namespace WTF
diff --git a/JavaScriptCore/wtf/StdLibExtras.h b/JavaScriptCore/wtf/StdLibExtras.h
index 14227ab..afc5e8a 100644
--- a/JavaScriptCore/wtf/StdLibExtras.h
+++ b/JavaScriptCore/wtf/StdLibExtras.h
@@ -47,14 +47,14 @@
      * C++'s idea of a reinterpret_cast lacks sufficient cojones.
      */
     template<typename TO, typename FROM>
-    TO bitwise_cast(FROM in)
+    TO bitwise_cast(FROM from)
     {
-        COMPILE_ASSERT(sizeof(TO) == sizeof(FROM), WTF_wtf_reinterpret_cast_sizeof_types_is_equal);
+        COMPILE_ASSERT(sizeof(TO) == sizeof(FROM), WTF_bitwise_cast_sizeof_casted_types_is_equal);
         union {
             FROM from;
             TO to;
         } u;
-        u.from = in;
+        u.from = from;
         return u.to;
     }
 
diff --git a/JavaScriptCore/wtf/StringExtras.h b/JavaScriptCore/wtf/StringExtras.h
index 881b066..926fd61 100644
--- a/JavaScriptCore/wtf/StringExtras.h
+++ b/JavaScriptCore/wtf/StringExtras.h
@@ -29,6 +29,10 @@
 #include <stdarg.h>
 #include <stdio.h>
 
+#if HAVE(STRINGS_H) 
+#include <strings.h> 
+#endif 
+
 #if COMPILER(MSVC)
 
 inline int snprintf(char* buffer, size_t count, const char* format, ...) 
diff --git a/JavaScriptCore/wtf/TCPackedCache.h b/JavaScriptCore/wtf/TCPackedCache.h
index a33cb77..0464f8f 100644
--- a/JavaScriptCore/wtf/TCPackedCache.h
+++ b/JavaScriptCore/wtf/TCPackedCache.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2007, The Android Open Source Project
+// Copyright (c) 2007, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
diff --git a/JavaScriptCore/wtf/TCPageMap.h b/JavaScriptCore/wtf/TCPageMap.h
index 9ffd77b..3f56c24 100644
--- a/JavaScriptCore/wtf/TCPageMap.h
+++ b/JavaScriptCore/wtf/TCPageMap.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2005, The Android Open Source Project
+// Copyright (c) 2005, Google Inc.
 // All rights reserved.
 // 
 // Redistribution and use in source and binary forms, with or without
diff --git a/JavaScriptCore/wtf/TCSpinLock.h b/JavaScriptCore/wtf/TCSpinLock.h
index d651e31..ced2283 100644
--- a/JavaScriptCore/wtf/TCSpinLock.h
+++ b/JavaScriptCore/wtf/TCSpinLock.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2005, 2006, The Android Open Source Project
+// Copyright (c) 2005, 2006, Google Inc.
 // All rights reserved.
 // 
 // Redistribution and use in source and binary forms, with or without
diff --git a/JavaScriptCore/wtf/TCSystemAlloc.cpp b/JavaScriptCore/wtf/TCSystemAlloc.cpp
index bf2dcb1..478ce63 100644
--- a/JavaScriptCore/wtf/TCSystemAlloc.cpp
+++ b/JavaScriptCore/wtf/TCSystemAlloc.cpp
@@ -1,4 +1,4 @@
-// Copyright (c) 2005, 2007, The Android Open Source Project
+// Copyright (c) 2005, 2007, Google Inc.
 // All rights reserved.
 // 
 // Redistribution and use in source and binary forms, with or without
@@ -388,10 +388,17 @@
     while (madvise(start, length, MADV_FREE_REUSABLE) == -1 && errno == EAGAIN) { }
 }
 
-#elif HAVE(MADV_DONTNEED)
+#elif HAVE(MADV_FREE) || HAVE(MADV_DONTNEED)
 
 void TCMalloc_SystemRelease(void* start, size_t length)
 {
+    // MADV_FREE clears the modified bit on pages, which allows
+    // them to be discarded immediately.
+#if HAVE(MADV_FREE)
+    const int advice = MADV_FREE;
+#else
+    const int advice = MADV_DONTNEED;
+#endif
   if (FLAGS_malloc_devmem_start) {
     // It's not safe to use MADV_DONTNEED if we've been mapping
     // /dev/mem for heap memory
@@ -418,7 +425,7 @@
     // Note -- ignoring most return codes, because if this fails it
     // doesn't matter...
     while (madvise(reinterpret_cast<char*>(new_start), new_end - new_start,
-                   MADV_DONTNEED) == -1 &&
+                   advice) == -1 &&
            errno == EAGAIN) {
       // NOP
     }
diff --git a/JavaScriptCore/wtf/TCSystemAlloc.h b/JavaScriptCore/wtf/TCSystemAlloc.h
index f2c915e..8e3a01a 100644
--- a/JavaScriptCore/wtf/TCSystemAlloc.h
+++ b/JavaScriptCore/wtf/TCSystemAlloc.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2005, 2007, The Android Open Source Project
+// Copyright (c) 2005, 2007, Google Inc.
 // All rights reserved.
 // 
 // Redistribution and use in source and binary forms, with or without
diff --git a/JavaScriptCore/wtf/ThreadSpecific.h b/JavaScriptCore/wtf/ThreadSpecific.h
index 8aaaf5f..b07a9a2 100644
--- a/JavaScriptCore/wtf/ThreadSpecific.h
+++ b/JavaScriptCore/wtf/ThreadSpecific.h
@@ -45,13 +45,15 @@
 
 #if USE(PTHREADS)
 #include <pthread.h>
+#elif PLATFORM(QT)
+#include <QThreadStorage>
 #elif PLATFORM(WIN_OS)
 #include <windows.h>
 #endif
 
 namespace WTF {
 
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
 // ThreadSpecificThreadExit should be called each time when a thread is detached.
 // This is done automatically for threads created with WTF::createThread.
 void ThreadSpecificThreadExit();
@@ -66,7 +68,7 @@
     ~ThreadSpecific();
 
 private:
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
     friend void ThreadSpecificThreadExit();
 #endif
     
@@ -74,7 +76,7 @@
     void set(T*);
     void static destroy(void* ptr);
 
-#if USE(PTHREADS) || PLATFORM(WIN_OS)
+#if USE(PTHREADS) || PLATFORM(QT) || PLATFORM(WIN_OS)
     struct Data : Noncopyable {
         Data(T* value, ThreadSpecific<T>* owner) : value(value), owner(owner) {}
 
@@ -88,6 +90,8 @@
 
 #if USE(PTHREADS)
     pthread_key_t m_key;
+#elif PLATFORM(QT)
+    QThreadStorage<Data*> m_key;
 #elif PLATFORM(WIN_OS)
     int m_index;
 #endif
@@ -122,6 +126,37 @@
     pthread_setspecific(m_key, new Data(ptr, this));
 }
 
+#elif PLATFORM(QT)
+
+template<typename T>
+inline ThreadSpecific<T>::ThreadSpecific()
+{
+}
+
+template<typename T>
+inline ThreadSpecific<T>::~ThreadSpecific()
+{
+    Data* data = static_cast<Data*>(m_key.localData());
+    if (data)
+        data->destructor(data);
+}
+
+template<typename T>
+inline T* ThreadSpecific<T>::get()
+{
+    Data* data = static_cast<Data*>(m_key.localData());
+    return data ? data->value : 0;
+}
+
+template<typename T>
+inline void ThreadSpecific<T>::set(T* ptr)
+{
+    ASSERT(!get());
+    Data* data = new Data(ptr, this);
+    data->destructor = &ThreadSpecific<T>::destroy;
+    m_key.setLocalData(data);
+}
+
 #elif PLATFORM(WIN_OS)
 
 // The maximum number of TLS keys that can be created. For simplification, we assume that:
@@ -189,6 +224,8 @@
 
 #if USE(PTHREADS)
     pthread_setspecific(data->owner->m_key, 0);
+#elif PLATFORM(QT)
+    data->owner->m_key.setLocalData(0);
 #elif PLATFORM(WIN_OS)
     TlsSetValue(tlsKeys()[data->owner->m_index], 0);
 #else
diff --git a/JavaScriptCore/wtf/ThreadingNone.cpp b/JavaScriptCore/wtf/ThreadingNone.cpp
index 24431fc..e713102 100644
--- a/JavaScriptCore/wtf/ThreadingNone.cpp
+++ b/JavaScriptCore/wtf/ThreadingNone.cpp
@@ -33,11 +33,11 @@
 namespace WTF {
 
 void initializeThreading() { }
-ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char*) { return 0; }
+ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char*) { return ThreadIdentifier(); }
 void setThreadNameInternal(const char*) { }
 int waitForThreadCompletion(ThreadIdentifier, void**) { return 0; }
 void detachThread(ThreadIdentifier) { }
-ThreadIdentifier currentThread() { return 0; }
+ThreadIdentifier currentThread() { return ThreadIdentifier(); }
 bool isMainThread() { return true; }
 
 Mutex::Mutex() { }
diff --git a/JavaScriptCore/wtf/ThreadingPthreads.cpp b/JavaScriptCore/wtf/ThreadingPthreads.cpp
index ebfd78f..f54dd3f 100644
--- a/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -114,14 +114,14 @@
     static ThreadIdentifier identifierCount = 1;
 
     threadMap().add(identifierCount, pthreadHandle);
-    
+
     return identifierCount++;
 }
 
 static pthread_t pthreadHandleForIdentifier(ThreadIdentifier id)
 {
     MutexLocker locker(threadMapMutex());
-    
+
     return threadMap().get(id);
 }
 
@@ -130,7 +130,7 @@
     MutexLocker locker(threadMapMutex());
 
     ASSERT(threadMap().contains(id));
-    
+
     threadMap().remove(id);
 }
 
@@ -161,7 +161,7 @@
     ThreadData* threadData = new ThreadData();
     threadData->entryPoint = entryPoint;
     threadData->arg = data;
-    
+
     if (pthread_create(&threadHandle, 0, runThreadWithRegistration, static_cast<void*>(threadData))) {
         LOG_ERROR("Failed to create pthread at entry point %p with data %p", entryPoint, data);
         return 0;
@@ -183,7 +183,7 @@
 
 void setThreadNameInternal(const char* threadName)
 {
-#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
     pthread_setname_np(threadName);
 #else
     UNUSED_PARAM(threadName);
@@ -193,13 +193,13 @@
 int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
 {
     ASSERT(threadID);
-    
+
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
- 
+
     int joinResult = pthread_join(pthreadHandle, result);
     if (joinResult == EDEADLK)
         LOG_ERROR("ThreadIdentifier %u was found to be deadlocked trying to quit", threadID);
-        
+
     clearPthreadHandleForIdentifier(threadID);
     return joinResult;
 }
@@ -207,11 +207,11 @@
 void detachThread(ThreadIdentifier threadID)
 {
     ASSERT(threadID);
-    
+
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
-    
+
     pthread_detach(pthreadHandle);
-    
+
     clearPthreadHandleForIdentifier(threadID);
 }
 
@@ -247,11 +247,11 @@
     int result = pthread_mutex_lock(&m_mutex);
     ASSERT_UNUSED(result, !result);
 }
-    
+
 bool Mutex::tryLock()
 {
     int result = pthread_mutex_trylock(&m_mutex);
-    
+
     if (result == 0)
         return true;
     if (result == EBUSY)
@@ -314,7 +314,7 @@
     int result = pthread_cond_broadcast(&m_condition);
     ASSERT_UNUSED(result, !result);
 }
-    
+
 } // namespace WTF
 
 #endif // USE(PTHREADS)
diff --git a/JavaScriptCore/wtf/ThreadingWin.cpp b/JavaScriptCore/wtf/ThreadingWin.cpp
index 415ba53..ea18656 100644
--- a/JavaScriptCore/wtf/ThreadingWin.cpp
+++ b/JavaScriptCore/wtf/ThreadingWin.cpp
@@ -243,7 +243,7 @@
 void detachThread(ThreadIdentifier threadID)
 {
     ASSERT(threadID);
-    
+
     HANDLE threadHandle = threadHandleForIdentifier(threadID);
     if (threadHandle)
         CloseHandle(threadHandle);
diff --git a/JavaScriptCore/wtf/TypeTraits.h b/JavaScriptCore/wtf/TypeTraits.h
index 2aeabcf..6ce6a3e 100644
--- a/JavaScriptCore/wtf/TypeTraits.h
+++ b/JavaScriptCore/wtf/TypeTraits.h
@@ -24,6 +24,10 @@
 
 #include "Platform.h"
 
+#if (defined(__GLIBCXX__) && (__GLIBCXX__ >= 20070724) && defined(__GXX_EXPERIMENTAL_CXX0X__)) || (defined(_MSC_VER) && (_MSC_VER >= 1600))
+#include <type_traits>
+#endif
+
 namespace WTF {
 
     // The following are provided in this file:
@@ -128,6 +132,208 @@
         typedef T Type;
     };
 
+#if (defined(__GLIBCXX__) && (__GLIBCXX__ >= 20070724) && defined(__GXX_EXPERIMENTAL_CXX0X__)) || (defined(_MSC_VER) && (_MSC_VER >= 1600))
+
+    // GCC's libstdc++ 20070724 and later supports C++ TR1 type_traits in the std namespace.
+    // VC10 (VS2010) and later support C++ TR1 type_traits in the std::tr1 namespace.
+    template<typename T> struct HasTrivialConstructor : public std::tr1::has_trivial_constructor<T> { };
+    template<typename T> struct HasTrivialDestructor : public std::tr1::has_trivial_destructor<T> { };
+
+#else
+
+    // This compiler doesn't provide type traits, so we provide basic HasTrivialConstructor
+    // and HasTrivialDestructor definitions. The definitions here include most built-in
+    // scalar types but do not include POD structs and classes. For the intended purposes of
+    // type_traits this results correct but potentially less efficient code.
+    template <typename T, T v>
+    struct IntegralConstant {
+        static const T value = v;
+        typedef T value_type;
+        typedef IntegralConstant<T, v> type;
+    };
+
+    typedef IntegralConstant<bool, true>  true_type;
+    typedef IntegralConstant<bool, false> false_type;
+
+#if defined(_MSC_VER) && (_MSC_VER >= 1400)
+    // VC8 (VS2005) and later have built-in compiler support for HasTrivialConstructor / HasTrivialDestructor,
+    // but for some unexplained reason it doesn't work on built-in types.
+    template <typename T> struct HasTrivialConstructor : public IntegralConstant<bool, __has_trivial_constructor(T)>{ };
+    template <typename T> struct HasTrivialDestructor : public IntegralConstant<bool, __has_trivial_destructor(T)>{ };
+#else
+    template <typename T> struct HasTrivialConstructor : public false_type{ };
+    template <typename T> struct HasTrivialDestructor : public false_type{ };
+#endif
+
+    template <typename T> struct HasTrivialConstructor<T*> : public true_type{ };
+    template <typename T> struct HasTrivialDestructor<T*> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<float> : public true_type{ };
+    template <> struct HasTrivialConstructor<const float> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile float> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile float> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const double> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile double> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<long double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const long double> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile long double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile long double> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned char> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned char> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned short> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned short> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned int> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned int> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned long long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed char> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed char> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed short> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed short> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed int> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed int> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed long long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<bool> : public true_type{ };
+    template <> struct HasTrivialConstructor<const bool> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile bool> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile bool> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const char> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile char> : public true_type{ };
+
+    #if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED)
+        template <> struct HasTrivialConstructor<wchar_t> : public true_type{ };
+        template <> struct HasTrivialConstructor<const wchar_t> : public true_type{ };
+        template <> struct HasTrivialConstructor<volatile wchar_t> : public true_type{ };
+        template <> struct HasTrivialConstructor<const volatile wchar_t> : public true_type{ };
+    #endif
+
+    template <> struct HasTrivialDestructor<float> : public true_type{ };
+    template <> struct HasTrivialDestructor<const float> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile float> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile float> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const double> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile double> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<long double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const long double> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile long double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile long double> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned char> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned char> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned short> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned short> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned int> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned int> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned long long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed char> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed char> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed short> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed short> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed int> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed int> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed long long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<bool> : public true_type{ };
+    template <> struct HasTrivialDestructor<const bool> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile bool> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile bool> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const char> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile char> : public true_type{ };
+
+    #if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED)
+        template <> struct HasTrivialDestructor<wchar_t> : public true_type{ };
+        template <> struct HasTrivialDestructor<const wchar_t> : public true_type{ };
+        template <> struct HasTrivialDestructor<volatile wchar_t> : public true_type{ };
+        template <> struct HasTrivialDestructor<const volatile wchar_t> : public true_type{ };
+    #endif
+
+#endif  // __GLIBCXX__, etc.
+
 } // namespace WTF
 
 #endif // TypeTraits_h
diff --git a/JavaScriptCore/wtf/VMTags.h b/JavaScriptCore/wtf/VMTags.h
new file mode 100644
index 0000000..519f518
--- /dev/null
+++ b/JavaScriptCore/wtf/VMTags.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef VMTags_h
+#define VMTags_h
+
+#include <wtf/Platform.h>
+
+// On Mac OS X, the VM subsystem allows tagging memory requested from mmap and vm_map
+// in order to aid tools that inspect system memory use. 
+#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+
+#include <mach/vm_statistics.h>
+
+#if defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
+#define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_CORE)
+#define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE)
+#define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
+#else
+#define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(63)
+#define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY VM_MAKE_TAG(64)
+#define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(65)
+#endif // defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
+
+#else // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+
+#define VM_TAG_FOR_COLLECTOR_MEMORY -1
+#define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY -1
+#define VM_TAG_FOR_REGISTERFILE_MEMORY -1
+
+#endif // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+
+#endif // VMTags_h
diff --git a/JavaScriptCore/wtf/Vector.h b/JavaScriptCore/wtf/Vector.h
index 190226d..dcfeb29 100644
--- a/JavaScriptCore/wtf/Vector.h
+++ b/JavaScriptCore/wtf/Vector.h
@@ -692,7 +692,7 @@
     }
 
     template<typename T, size_t inlineCapacity>
-    void Vector<T, inlineCapacity>::resize(size_t size)
+    inline void Vector<T, inlineCapacity>::resize(size_t size)
     {
         if (size <= m_size)
             TypeOperations::destruct(begin() + size, end());
@@ -781,6 +781,8 @@
             if (!begin())
                 return;
         }
+        if (newSize < m_size)
+            CRASH();
         T* dest = end();
         for (size_t i = 0; i < dataSize; ++i)
             new (&dest[i]) T(data[i]);
@@ -788,7 +790,7 @@
     }
 
     template<typename T, size_t inlineCapacity> template<typename U>
-    inline void Vector<T, inlineCapacity>::append(const U& val)
+    ALWAYS_INLINE void Vector<T, inlineCapacity>::append(const U& val)
     {
         const U* ptr = &val;
         if (size() == capacity()) {
@@ -842,6 +844,8 @@
             if (!begin())
                 return;
         }
+        if (newSize < m_size)
+            CRASH();
         T* spot = begin() + position;
         TypeOperations::moveOverlapping(spot, end(), spot + dataSize);
         for (size_t i = 0; i < dataSize; ++i)
diff --git a/JavaScriptCore/wtf/dtoa.cpp b/JavaScriptCore/wtf/dtoa.cpp
index c104dad..9509388 100644
--- a/JavaScriptCore/wtf/dtoa.cpp
+++ b/JavaScriptCore/wtf/dtoa.cpp
@@ -150,6 +150,8 @@
 #include <wtf/FastMalloc.h>
 #include <wtf/Threading.h>
 
+#include <stdio.h>
+
 #if COMPILER(MSVC)
 #pragma warning(disable: 4244)
 #pragma warning(disable: 4245)
@@ -189,13 +191,13 @@
 #endif
 #else
 #ifdef IEEE_8087
-#define word0(x) ((U*)&x)->L[1]
-#define word1(x) ((U*)&x)->L[0]
+#define word0(x) (x)->L[1]
+#define word1(x) (x)->L[0]
 #else
-#define word0(x) ((U*)&x)->L[0]
-#define word1(x) ((U*)&x)->L[1]
+#define word0(x) (x)->L[0]
+#define word1(x) (x)->L[1]
 #endif
-#define dval(x) ((U*)&x)->d
+#define dval(x) (x)->d
 #endif
 
 /* The following definition of Storeinc is appropriate for MIPS processors.
@@ -275,32 +277,29 @@
 
 #define Kmax 15
 
-struct Bigint {
-    struct Bigint* next;
-    int k, maxwds, sign, wds;
-    uint32_t x[1];
+struct BigInt {
+    BigInt() : sign(0), wds(0) { }
+    BigInt(const BigInt& other) : sign(other.sign), wds(other.wds) 
+    {
+        for (int i = 0; i < 64; ++i)
+            x[i] = other.x[i];
+    }
+
+    BigInt& operator=(const BigInt& other) 
+    {
+        sign = other.sign;
+        wds = other.wds;
+        for (int i = 0; i < 64; ++i)
+            x[i] = other.x[i];        
+        return *this;
+    }
+    
+    int sign;
+    int wds;
+    uint32_t x[64];
 };
 
-static Bigint* Balloc(int k)
-{
-    int x = 1 << k;
-    Bigint* rv = (Bigint*)fastMalloc(sizeof(Bigint) + (x - 1)*sizeof(uint32_t));
-    rv->k = k;
-    rv->maxwds = x;
-    rv->next = 0;
-    rv->sign = rv->wds = 0;
-
-    return rv;
-}
-
-static void Bfree(Bigint* v)
-{
-    fastFree(v);
-}
-
-#define Bcopy(x, y) memcpy((char*)&x->sign, (char*)&y->sign, y->wds * sizeof(int32_t) + 2 * sizeof(int))
-
-static Bigint* multadd(Bigint* b, int m, int a)    /* multiply by m and add a */
+static void multadd(BigInt& b, int m, int a)    /* multiply by m and add a */
 {
 #ifdef USE_LONG_LONG
     unsigned long long carry;
@@ -308,8 +307,8 @@
     uint32_t carry;
 #endif
 
-    int wds = b->wds;
-    uint32_t* x = b->x;
+    int wds = b.wds;
+    uint32_t* x = b.x;
     int i = 0;
     carry = a;
     do {
@@ -333,19 +332,12 @@
     } while (++i < wds);
 
     if (carry) {
-        if (wds >= b->maxwds) {
-            Bigint* b1 = Balloc(b->k + 1);
-            Bcopy(b1, b);
-            Bfree(b);
-            b = b1;
-        }
-        b->x[wds++] = (uint32_t)carry;
-        b->wds = wds;
+        b.x[wds++] = (uint32_t)carry;
+        b.wds = wds;
     }
-    return b;
 }
 
-static Bigint* s2b(const char* s, int nd0, int nd, uint32_t y9)
+static void s2b(BigInt& b, const char* s, int nd0, int nd, uint32_t y9)
 {
     int k;
     int32_t y;
@@ -353,27 +345,26 @@
 
     for (k = 0, y = 1; x > y; y <<= 1, k++) { }
 #ifdef Pack_32
-    Bigint* b = Balloc(k);
-    b->x[0] = y9;
-    b->wds = 1;
+    b.sign = 0;
+    b.x[0] = y9;
+    b.wds = 1;
 #else
-    Bigint* b = Balloc(k + 1);
-    b->x[0] = y9 & 0xffff;
-    b->wds = (b->x[1] = y9 >> 16) ? 2 : 1;
+    b.sign = 0;
+    b.x[0] = y9 & 0xffff;
+    b.wds = (b->x[1] = y9 >> 16) ? 2 : 1;
 #endif
 
     int i = 9;
     if (9 < nd0) {
         s += 9;
         do {
-            b = multadd(b, 10, *s++ - '0');
+            multadd(b, 10, *s++ - '0');
         } while (++i < nd0);
         s++;
     } else
         s += 10;
     for (; i < nd; i++)
-        b = multadd(b, 10, *s++ - '0');
-    return b;
+        multadd(b, 10, *s++ - '0');
 }
 
 static int hi0bits(uint32_t x)
@@ -446,21 +437,21 @@
     return k;
 }
 
-static Bigint* i2b(int i)
+static void i2b(BigInt& b, int i)
 {
-    Bigint* b;
-
-    b = Balloc(1);
-    b->x[0] = i;
-    b->wds = 1;
-    return b;
+    b.sign = 0;
+    b.x[0] = i;
+    b.wds = 1;
 }
 
-static Bigint* mult(Bigint* a, Bigint* b)
+static void mult(BigInt& aRef, const BigInt& bRef)
 {
-    Bigint* c;
-    int k, wa, wb, wc;
-    uint32_t *x, *xa, *xae, *xb, *xbe, *xc, *xc0;
+    const BigInt* a = &aRef;
+    const BigInt* b = &bRef;
+    BigInt c;
+    int wa, wb, wc;
+    const uint32_t *x = 0, *xa, *xb, *xae, *xbe;
+    uint32_t *xc, *xc0;
     uint32_t y;
 #ifdef USE_LONG_LONG
     unsigned long long carry, z;
@@ -469,24 +460,22 @@
 #endif
 
     if (a->wds < b->wds) {
-        c = a;
+        const BigInt* tmp = a;
         a = b;
-        b = c;
+        b = tmp;
     }
-    k = a->k;
+    
     wa = a->wds;
     wb = b->wds;
     wc = wa + wb;
-    if (wc > a->maxwds)
-        k++;
-    c = Balloc(k);
-    for (x = c->x, xa = x + wc; x < xa; x++)
-        *x = 0;
+
+    for (xc = c.x, xa = xc + wc; xc < xa; xc++)
+        *xc = 0;
     xa = a->x;
     xae = xa + wa;
     xb = b->x;
     xbe = xb + wb;
-    xc0 = c->x;
+    xc0 = c.x;
 #ifdef USE_LONG_LONG
     for (; xb < xbe; xc0++) {
         if ((y = *xb++)) {
@@ -548,33 +537,43 @@
     }
 #endif
 #endif
-    for (xc0 = c->x, xc = xc0 + wc; wc > 0 && !*--xc; --wc) { }
-    c->wds = wc;
-    return c;
+    for (xc0 = c.x, xc = xc0 + wc; wc > 0 && !*--xc; --wc) { }
+    c.wds = wc;
+    aRef = c;
 }
 
-static Bigint* p5s;
+struct P5Node {
+    BigInt val;
+    P5Node* next;
+};
+    
+static P5Node* p5s;
 static int p5s_count;
 
-static Bigint* pow5mult(Bigint* b, int k)
+static ALWAYS_INLINE void pow5mult(BigInt& b, int k)
 {
     static int p05[3] = { 5, 25, 125 };
 
     if (int i = k & 3)
-        b = multadd(b, p05[i - 1], 0);
+        multadd(b, p05[i - 1], 0);
 
     if (!(k >>= 2))
-        return b;
+        return;
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex->lock();
 #endif
-    Bigint* p5 = p5s;
+    P5Node* p5 = p5s;
+
     if (!p5) {
         /* first time */
-        p5 = p5s = i2b(625);
+        p5 = new P5Node;
+        i2b(p5->val, 625);
+        p5->next = 0;
+        p5s = p5;
         p5s_count = 1;
     }
+
     int p5s_count_local = p5s_count;
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex->unlock();
@@ -582,11 +581,9 @@
     int p5s_used = 0;
 
     for (;;) {
-        if (k & 1) {
-            Bigint* b1 = mult(b, p5);
-            Bfree(b);
-            b = b1;
-        }
+        if (k & 1)
+            mult(b, p5->val);
+
         if (!(k >>= 1))
             break;
 
@@ -596,7 +593,10 @@
 #endif
             if (p5s_used == p5s_count) {
                 ASSERT(!p5->next);
-                p5->next = mult(p5, p5);
+                p5->next = new P5Node;
+                p5->next->next = 0;
+                p5->next->val = p5->val;
+                mult(p5->next->val, p5->next->val);
                 ++p5s_count;
             }
             
@@ -607,30 +607,21 @@
         }
         p5 = p5->next;
     }
-
-    return b;
 }
 
-static Bigint* lshift(Bigint* b, int k)
+static ALWAYS_INLINE void lshift(BigInt& b, int k)
 {
-    Bigint* result = b;
-
 #ifdef Pack_32
     int n = k >> 5;
 #else
     int n = k >> 4;
 #endif
 
-    int k1 = b->k;
-    int n1 = n + b->wds + 1;
-    for (int i = b->maxwds; n1 > i; i <<= 1)
-        k1++;
-    if (b->k < k1)
-        result = Balloc(k1);
+    int n1 = n + b.wds + 1;
 
-    const uint32_t* srcStart = b->x;
-    uint32_t* dstStart = result->x;
-    const uint32_t* src = srcStart + b->wds - 1;
+    const uint32_t* srcStart = b.x;
+    uint32_t* dstStart = b.x;
+    const uint32_t* src = srcStart + b.wds - 1;
     uint32_t* dst = dstStart + n1 - 1;
 #ifdef Pack_32
     if (k &= 0x1f) {
@@ -642,7 +633,7 @@
         }
         *dst = hiSubword;
         ASSERT(dst == dstStart + n);
-        result->wds = b->wds + n + (result->x[n1 - 1] != 0);
+        b.wds = b.wds + n + (b.x[n1 - 1] != 0);
     }
 #else
     if (k &= 0xf) {
@@ -661,30 +652,26 @@
         do {
             *--dst = *src--;
         } while (src >= srcStart);
-        result->wds = b->wds + n;
+        b.wds = b.wds + n;
     }
     for (dst = dstStart + n; dst != dstStart; )
         *--dst = 0;
-
-    if (result != b)
-        Bfree(b);
-    return result;
 }
 
-static int cmp(Bigint* a, Bigint* b)
+static int cmp(const BigInt& a, const BigInt& b)
 {
-    uint32_t *xa, *xa0, *xb, *xb0;
+    const uint32_t *xa, *xa0, *xb, *xb0;
     int i, j;
 
-    i = a->wds;
-    j = b->wds;
-    ASSERT(i <= 1 || a->x[i - 1]);
-    ASSERT(j <= 1 || b->x[j - 1]);
+    i = a.wds;
+    j = b.wds;
+    ASSERT(i <= 1 || a.x[i - 1]);
+    ASSERT(j <= 1 || b.x[j - 1]);
     if (i -= j)
         return i;
-    xa0 = a->x;
+    xa0 = a.x;
     xa = xa0 + j;
-    xb0 = b->x;
+    xb0 = b.x;
     xb = xb0 + j;
     for (;;) {
         if (*--xa != *--xb)
@@ -695,35 +682,37 @@
     return 0;
 }
 
-static Bigint* diff(Bigint* a, Bigint* b)
+static ALWAYS_INLINE void diff(BigInt& c, const BigInt& aRef, const BigInt& bRef)
 {
-    Bigint* c;
+    const BigInt* a = &aRef;
+    const BigInt* b = &bRef;
     int i, wa, wb;
-    uint32_t *xa, *xae, *xb, *xbe, *xc;
+    uint32_t *xc;
 
-    i = cmp(a,b);
+    i = cmp(*a, *b);
     if (!i) {
-        c = Balloc(0);
-        c->wds = 1;
-        c->x[0] = 0;
-        return c;
+        c.sign = 0;
+        c.wds = 1;
+        c.x[0] = 0;
+        return;
     }
     if (i < 0) {
-        c = a;
+        const BigInt* tmp = a;
         a = b;
-        b = c;
+        b = tmp;
         i = 1;
     } else
         i = 0;
-    c = Balloc(a->k);
-    c->sign = i;
+
+    c.wds = 0;
+    c.sign = i;
     wa = a->wds;
-    xa = a->x;
-    xae = xa + wa;
+    const uint32_t* xa = a->x;
+    const uint32_t* xae = xa + wa;
     wb = b->wds;
-    xb = b->x;
-    xbe = xb + wb;
-    xc = c->x;
+    const uint32_t* xb = b->x;
+    const uint32_t* xbe = xb + wb;
+    xc = c.x;
 #ifdef USE_LONG_LONG
     unsigned long long borrow = 0;
     do {
@@ -768,14 +757,13 @@
 #endif
     while (!*--xc)
         wa--;
-    c->wds = wa;
-    return c;
+    c.wds = wa;
 }
 
-static double ulp(double x)
+static double ulp(U *x)
 {
     register int32_t L;
-    double a;
+    U u;
 
     L = (word0(x) & Exp_mask) - (P - 1) * Exp_msk1;
 #ifndef Avoid_Underflow
@@ -783,41 +771,41 @@
     if (L > 0) {
 #endif
 #endif
-        word0(a) = L;
-        word1(a) = 0;
+        word0(&u) = L;
+        word1(&u) = 0;
 #ifndef Avoid_Underflow
 #ifndef Sudden_Underflow
     } else {
         L = -L >> Exp_shift;
         if (L < Exp_shift) {
-            word0(a) = 0x80000 >> L;
-            word1(a) = 0;
+            word0(&u) = 0x80000 >> L;
+            word1(&u) = 0;
         } else {
-            word0(a) = 0;
+            word0(&u) = 0;
             L -= Exp_shift;
-            word1(a) = L >= 31 ? 1 : 1 << 31 - L;
+            word1(&u) = L >= 31 ? 1 : 1 << 31 - L;
         }
     }
 #endif
 #endif
-    return dval(a);
+    return dval(&u);
 }
 
-static double b2d(Bigint* a, int* e)
+static double b2d(const BigInt& a, int* e)
 {
-    uint32_t* xa;
-    uint32_t* xa0;
+    const uint32_t* xa;
+    const uint32_t* xa0;
     uint32_t w;
     uint32_t y;
     uint32_t z;
     int k;
-    double d;
+    U d;
 
-#define d0 word0(d)
-#define d1 word1(d)
+#define d0 word0(&d)
+#define d1 word1(&d)
 
-    xa0 = a->x;
-    xa = xa0 + a->wds;
+    xa0 = a.x;
+    xa = xa0 + a.wds;
     y = *--xa;
     ASSERT(y);
     k = hi0bits(y);
@@ -857,12 +845,11 @@
 ret_d:
 #undef d0
 #undef d1
-    return dval(d);
+    return dval(&d);
 }
 
-static Bigint* d2b(double d, int* e, int* bits)
+static ALWAYS_INLINE void d2b(BigInt& b, U* d, int* e, int* bits)
 {
-    Bigint* b;
     int de, k;
     uint32_t *x, y, z;
 #ifndef Sudden_Underflow
@@ -871,12 +858,13 @@
 #define d0 word0(d)
 #define d1 word1(d)
 
+    b.sign = 0;
 #ifdef Pack_32
-    b = Balloc(1);
+    b.wds = 1;
 #else
-    b = Balloc(2);
+    b.wds = 2;
 #endif
-    x = b->x;
+    x = b.x;
 
     z = d0 & Frac_mask;
     d0 &= 0x7fffffff;    /* clear sign bit, which we ignore */
@@ -896,14 +884,14 @@
 #ifndef Sudden_Underflow
         i =
 #endif
-            b->wds = (x[1] = z) ? 2 : 1;
+            b.wds = (x[1] = z) ? 2 : 1;
     } else {
         k = lo0bits(&z);
         x[0] = z;
 #ifndef Sudden_Underflow
         i =
 #endif
-            b->wds = 1;
+            b.wds = 1;
         k += 32;
     }
 #else
@@ -958,30 +946,29 @@
 #endif
     }
 #endif
-    return b;
 }
 #undef d0
 #undef d1
 
-static double ratio(Bigint* a, Bigint* b)
+static double ratio(const BigInt& a, const BigInt& b)
 {
-    double da, db;
+    U da, db;
     int k, ka, kb;
 
-    dval(da) = b2d(a, &ka);
-    dval(db) = b2d(b, &kb);
+    dval(&da) = b2d(a, &ka);
+    dval(&db) = b2d(b, &kb);
 #ifdef Pack_32
-    k = ka - kb + 32 * (a->wds - b->wds);
+    k = ka - kb + 32 * (a.wds - b.wds);
 #else
-    k = ka - kb + 16 * (a->wds - b->wds);
+    k = ka - kb + 16 * (a.wds - b.wds);
 #endif
     if (k > 0)
-        word0(da) += k * Exp_msk1;
+        word0(&da) += k * Exp_msk1;
     else {
         k = -k;
-        word0(db) += k * Exp_msk1;
+        word0(&db) += k * Exp_msk1;
     }
-    return dval(da) / dval(db);
+    return dval(&da) / dval(&db);
 }
 
 static const double tens[] = {
@@ -1031,7 +1018,7 @@
 }
 
 #ifndef No_Hex_NaN
-static void hexnan(double* rvp, const char** sp)
+static void hexnan(U* rvp, const char** sp)
 {
     uint32_t c, x[2];
     const char* s;
@@ -1070,8 +1057,8 @@
         x[1] = (x[1] << 4) | c;
     }
     if ((x[0] &= 0xfffff) || x[1]) {
-        word0(*rvp) = Exp_mask | x[0];
-        word1(*rvp) = x[1];
+        word0(rvp) = Exp_mask | x[0];
+        word1(rvp) = x[1];
     }
 }
 #endif /*No_Hex_NaN*/
@@ -1085,16 +1072,17 @@
     int bb2, bb5, bbe, bd2, bd5, bbbits, bs2, c, dsign,
          e, e1, esign, i, j, k, nd, nd0, nf, nz, nz0, sign;
     const char *s, *s0, *s1;
-    double aadj, aadj1, adj, rv, rv0;
+    double aadj, aadj1;
+    U aadj2, adj, rv, rv0;
     int32_t L;
     uint32_t y, z;
-    Bigint *bb = NULL, *bb1 = NULL, *bd = NULL, *bd0 = NULL, *bs = NULL, *delta = NULL;
+    BigInt bb, bb1, bd, bd0, bs, delta;
 #ifdef SET_INEXACT
     int inexact, oldinexact;
 #endif
 
     sign = nz0 = nz = 0;
-    dval(rv) = 0.;
+    dval(&rv) = 0;
     for (s = s00; ; s++)
         switch (*s) {
             case '-':
@@ -1209,16 +1197,16 @@
                         --s;
                         if (!match(&s,"inity"))
                             ++s;
-                        word0(rv) = 0x7ff00000;
-                        word1(rv) = 0;
+                        word0(&rv) = 0x7ff00000;
+                        word1(&rv) = 0;
                         goto ret;
                     }
                     break;
                 case 'n':
                 case 'N':
                     if (match(&s, "an")) {
-                        word0(rv) = NAN_WORD0;
-                        word1(rv) = NAN_WORD1;
+                        word0(&rv) = NAN_WORD0;
+                        word1(&rv) = NAN_WORD1;
 #ifndef No_Hex_NaN
                         if (*s == '(') /*)*/
                             hexnan(&rv, &s);
@@ -1243,21 +1231,20 @@
     if (!nd0)
         nd0 = nd;
     k = nd < DBL_DIG + 1 ? nd : DBL_DIG + 1;
-    dval(rv) = y;
+    dval(&rv) = y;
     if (k > 9) {
 #ifdef SET_INEXACT
         if (k > DBL_DIG)
             oldinexact = get_inexact();
 #endif
-        dval(rv) = tens[k - 9] * dval(rv) + z;
+        dval(&rv) = tens[k - 9] * dval(&rv) + z;
     }
-    bd0 = 0;
     if (nd <= DBL_DIG && Flt_Rounds == 1) {
         if (!e)
             goto ret;
         if (e > 0) {
             if (e <= Ten_pmax) {
-                /* rv = */ rounded_product(dval(rv), tens[e]);
+                /* rv = */ rounded_product(dval(&rv), tens[e]);
                 goto ret;
             }
             i = DBL_DIG - nd;
@@ -1266,14 +1253,14 @@
                  * this for larger i values.
                  */
                 e -= i;
-                dval(rv) *= tens[i];
-                /* rv = */ rounded_product(dval(rv), tens[e]);
+                dval(&rv) *= tens[i];
+                /* rv = */ rounded_product(dval(&rv), tens[e]);
                 goto ret;
             }
         }
 #ifndef Inaccurate_Divide
         else if (e >= -Ten_pmax) {
-            /* rv = */ rounded_quotient(dval(rv), tens[-e]);
+            /* rv = */ rounded_quotient(dval(&rv), tens[-e]);
             goto ret;
         }
 #endif
@@ -1293,7 +1280,7 @@
 
     if (e1 > 0) {
         if ((i = e1 & 15))
-            dval(rv) *= tens[i];
+            dval(&rv) *= tens[i];
         if (e1 &= ~15) {
             if (e1 > DBL_MAX_10_EXP) {
 ovfl:
@@ -1301,38 +1288,36 @@
                 errno = ERANGE;
 #endif
                 /* Can't trust HUGE_VAL */
-                word0(rv) = Exp_mask;
-                word1(rv) = 0;
+                word0(&rv) = Exp_mask;
+                word1(&rv) = 0;
 #ifdef SET_INEXACT
                 /* set overflow bit */
-                dval(rv0) = 1e300;
-                dval(rv0) *= dval(rv0);
+                dval(&rv0) = 1e300;
+                dval(&rv0) *= dval(&rv0);
 #endif
-                if (bd0)
-                    goto retfree;
                 goto ret;
             }
             e1 >>= 4;
             for (j = 0; e1 > 1; j++, e1 >>= 1)
                 if (e1 & 1)
-                    dval(rv) *= bigtens[j];
+                    dval(&rv) *= bigtens[j];
         /* The last multiplication could overflow. */
-            word0(rv) -= P * Exp_msk1;
-            dval(rv) *= bigtens[j];
-            if ((z = word0(rv) & Exp_mask) > Exp_msk1 * (DBL_MAX_EXP + Bias - P))
+            word0(&rv) -= P * Exp_msk1;
+            dval(&rv) *= bigtens[j];
+            if ((z = word0(&rv) & Exp_mask) > Exp_msk1 * (DBL_MAX_EXP + Bias - P))
                 goto ovfl;
             if (z > Exp_msk1 * (DBL_MAX_EXP + Bias - 1 - P)) {
                 /* set to largest number */
                 /* (Can't trust DBL_MAX) */
-                word0(rv) = Big0;
-                word1(rv) = Big1;
+                word0(&rv) = Big0;
+                word1(&rv) = Big1;
             } else
-                word0(rv) += P * Exp_msk1;
+                word0(&rv) += P * Exp_msk1;
         }
     } else if (e1 < 0) {
         e1 = -e1;
         if ((i = e1 & 15))
-            dval(rv) /= tens[i];
+            dval(&rv) /= tens[i];
         if (e1 >>= 4) {
             if (e1 >= 1 << n_bigtens)
                 goto undfl;
@@ -1341,42 +1326,40 @@
                 scale = 2 * P;
             for (j = 0; e1 > 0; j++, e1 >>= 1)
                 if (e1 & 1)
-                    dval(rv) *= tinytens[j];
-            if (scale && (j = (2 * P) + 1 - ((word0(rv) & Exp_mask) >> Exp_shift)) > 0) {
+                    dval(&rv) *= tinytens[j];
+            if (scale && (j = (2 * P) + 1 - ((word0(&rv) & Exp_mask) >> Exp_shift)) > 0) {
                 /* scaled rv is denormal; zap j low bits */
                 if (j >= 32) {
-                    word1(rv) = 0;
+                    word1(&rv) = 0;
                     if (j >= 53)
-                       word0(rv) = (P + 2) * Exp_msk1;
+                       word0(&rv) = (P + 2) * Exp_msk1;
                     else
-                       word0(rv) &= 0xffffffff << (j - 32);
+                       word0(&rv) &= 0xffffffff << (j - 32);
                 } else
-                    word1(rv) &= 0xffffffff << j;
+                    word1(&rv) &= 0xffffffff << j;
             }
 #else
             for (j = 0; e1 > 1; j++, e1 >>= 1)
                 if (e1 & 1)
-                    dval(rv) *= tinytens[j];
+                    dval(&rv) *= tinytens[j];
             /* The last multiplication could underflow. */
-            dval(rv0) = dval(rv);
-            dval(rv) *= tinytens[j];
-            if (!dval(rv)) {
-                dval(rv) = 2. * dval(rv0);
-                dval(rv) *= tinytens[j];
+            dval(&rv0) = dval(&rv);
+            dval(&rv) *= tinytens[j];
+            if (!dval(&rv)) {
+                dval(&rv) = 2. * dval(&rv0);
+                dval(&rv) *= tinytens[j];
 #endif
-                if (!dval(rv)) {
+                if (!dval(&rv)) {
 undfl:
-                    dval(rv) = 0.;
+                    dval(&rv) = 0.;
 #ifndef NO_ERRNO
                     errno = ERANGE;
 #endif
-                    if (bd0)
-                        goto retfree;
                     goto ret;
                 }
 #ifndef Avoid_Underflow
-                word0(rv) = Tiny0;
-                word1(rv) = Tiny1;
+                word0(&rv) = Tiny0;
+                word1(&rv) = Tiny1;
                 /* The refinement below will clean
                  * this approximation up.
                  */
@@ -1389,13 +1372,12 @@
 
     /* Put digits into bd: true value = bd * 10^e */
 
-    bd0 = s2b(s0, nd0, nd, y);
+    s2b(bd0, s0, nd0, nd, y);
 
     for (;;) {
-        bd = Balloc(bd0->k);
-        Bcopy(bd, bd0);
-        bb = d2b(dval(rv), &bbe, &bbbits);    /* rv = bb * 2^bbe */
-        bs = i2b(1);
+        bd = bd0;
+        d2b(bb, &rv, &bbe, &bbbits);    /* rv = bb * 2^bbe */
+        i2b(bs, 1);
 
         if (e >= 0) {
             bb2 = bb5 = 0;
@@ -1442,33 +1424,31 @@
             bs2 -= i;
         }
         if (bb5 > 0) {
-            bs = pow5mult(bs, bb5);
-            bb1 = mult(bs, bb);
-            Bfree(bb);
-            bb = bb1;
+            pow5mult(bs, bb5);
+            mult(bb, bs);
         }
         if (bb2 > 0)
-            bb = lshift(bb, bb2);
+            lshift(bb, bb2);
         if (bd5 > 0)
-            bd = pow5mult(bd, bd5);
+            pow5mult(bd, bd5);
         if (bd2 > 0)
-            bd = lshift(bd, bd2);
+            lshift(bd, bd2);
         if (bs2 > 0)
-            bs = lshift(bs, bs2);
-        delta = diff(bb, bd);
-        dsign = delta->sign;
-        delta->sign = 0;
+            lshift(bs, bs2);
+        diff(delta, bb, bd);
+        dsign = delta.sign;
+        delta.sign = 0;
         i = cmp(delta, bs);
 
         if (i < 0) {
             /* Error is less than half an ulp -- check for
              * special case of mantissa a power of two.
              */
-            if (dsign || word1(rv) || word0(rv) & Bndry_mask
+            if (dsign || word1(&rv) || word0(&rv) & Bndry_mask
 #ifdef Avoid_Underflow
-             || (word0(rv) & Exp_mask) <= (2 * P + 1) * Exp_msk1
+             || (word0(&rv) & Exp_mask) <= (2 * P + 1) * Exp_msk1
 #else
-             || (word0(rv) & Exp_mask) <= Exp_msk1
+             || (word0(&rv) & Exp_mask) <= Exp_msk1
 #endif
                 ) {
 #ifdef SET_INEXACT
@@ -1477,14 +1457,14 @@
 #endif
                 break;
             }
-            if (!delta->x[0] && delta->wds <= 1) {
+            if (!delta.x[0] && delta.wds <= 1) {
                 /* exact result */
 #ifdef SET_INEXACT
                 inexact = 0;
 #endif
                 break;
             }
-            delta = lshift(delta,Log2P);
+            lshift(delta, Log2P);
             if (cmp(delta, bs) > 0)
                 goto drop_down;
             break;
@@ -1492,26 +1472,26 @@
         if (i == 0) {
             /* exactly half-way between */
             if (dsign) {
-                if ((word0(rv) & Bndry_mask1) == Bndry_mask1
-                 &&  word1(rv) == (
+                if ((word0(&rv) & Bndry_mask1) == Bndry_mask1
+                 &&  word1(&rv) == (
 #ifdef Avoid_Underflow
-            (scale && (y = word0(rv) & Exp_mask) <= 2 * P * Exp_msk1)
+            (scale && (y = word0(&rv) & Exp_mask) <= 2 * P * Exp_msk1)
         ? (0xffffffff & (0xffffffff << (2 * P + 1 - (y >> Exp_shift)))) :
 #endif
                            0xffffffff)) {
                     /*boundary case -- increment exponent*/
-                    word0(rv) = (word0(rv) & Exp_mask) + Exp_msk1;
-                    word1(rv) = 0;
+                    word0(&rv) = (word0(&rv) & Exp_mask) + Exp_msk1;
+                    word1(&rv) = 0;
 #ifdef Avoid_Underflow
                     dsign = 0;
 #endif
                     break;
                 }
-            } else if (!(word0(rv) & Bndry_mask) && !word1(rv)) {
+            } else if (!(word0(&rv) & Bndry_mask) && !word1(&rv)) {
 drop_down:
                 /* boundary case -- decrement exponent */
 #ifdef Sudden_Underflow /*{{*/
-                L = word0(rv) & Exp_mask;
+                L = word0(&rv) & Exp_mask;
 #ifdef Avoid_Underflow
                 if (L <= (scale ? (2 * P + 1) * Exp_msk1 : Exp_msk1))
 #else
@@ -1522,7 +1502,7 @@
 #else /*Sudden_Underflow}{*/
 #ifdef Avoid_Underflow
                 if (scale) {
-                    L = word0(rv) & Exp_mask;
+                    L = word0(&rv) & Exp_mask;
                     if (L <= (2 * P + 1) * Exp_msk1) {
                         if (L > (P + 2) * Exp_msk1)
                             /* round even ==> */
@@ -1533,20 +1513,20 @@
                     }
                 }
 #endif /*Avoid_Underflow*/
-                L = (word0(rv) & Exp_mask) - Exp_msk1;
+                L = (word0(&rv) & Exp_mask) - Exp_msk1;
 #endif /*Sudden_Underflow}}*/
-                word0(rv) = L | Bndry_mask1;
-                word1(rv) = 0xffffffff;
+                word0(&rv) = L | Bndry_mask1;
+                word1(&rv) = 0xffffffff;
                 break;
             }
-            if (!(word1(rv) & LSB))
+            if (!(word1(&rv) & LSB))
                 break;
             if (dsign)
-                dval(rv) += ulp(dval(rv));
+                dval(&rv) += ulp(&rv);
             else {
-                dval(rv) -= ulp(dval(rv));
+                dval(&rv) -= ulp(&rv);
 #ifndef Sudden_Underflow
-                if (!dval(rv))
+                if (!dval(&rv))
                     goto undfl;
 #endif
             }
@@ -1558,9 +1538,9 @@
         if ((aadj = ratio(delta, bs)) <= 2.) {
             if (dsign)
                 aadj = aadj1 = 1.;
-            else if (word1(rv) || word0(rv) & Bndry_mask) {
+            else if (word1(&rv) || word0(&rv) & Bndry_mask) {
 #ifndef Sudden_Underflow
-                if (word1(rv) == Tiny1 && !word0(rv))
+                if (word1(&rv) == Tiny1 && !word0(&rv))
                     goto undfl;
 #endif
                 aadj = 1.;
@@ -1592,23 +1572,23 @@
                 aadj1 += 0.5;
 #endif /*Check_FLT_ROUNDS*/
         }
-        y = word0(rv) & Exp_mask;
+        y = word0(&rv) & Exp_mask;
 
         /* Check for overflow */
 
         if (y == Exp_msk1 * (DBL_MAX_EXP + Bias - 1)) {
-            dval(rv0) = dval(rv);
-            word0(rv) -= P * Exp_msk1;
-            adj = aadj1 * ulp(dval(rv));
-            dval(rv) += adj;
-            if ((word0(rv) & Exp_mask) >= Exp_msk1 * (DBL_MAX_EXP + Bias - P)) {
-                if (word0(rv0) == Big0 && word1(rv0) == Big1)
+            dval(&rv0) = dval(&rv);
+            word0(&rv) -= P * Exp_msk1;
+            adj.d = aadj1 * ulp(&rv);
+            dval(&rv) += adj.d;
+            if ((word0(&rv) & Exp_mask) >= Exp_msk1 * (DBL_MAX_EXP + Bias - P)) {
+                if (word0(&rv0) == Big0 && word1(&rv0) == Big1)
                     goto ovfl;
-                word0(rv) = Big0;
-                word1(rv) = Big1;
+                word0(&rv) = Big0;
+                word1(&rv) = Big1;
                 goto cont;
             } else
-                word0(rv) += P * Exp_msk1;
+                word0(&rv) += P * Exp_msk1;
         } else {
 #ifdef Avoid_Underflow
             if (scale && y <= 2 * P * Exp_msk1) {
@@ -1618,30 +1598,32 @@
                     aadj = z;
                     aadj1 = dsign ? aadj : -aadj;
                 }
-                word0(aadj1) += (2 * P + 1) * Exp_msk1 - y;
+                dval(&aadj2) = aadj1;
+                word0(&aadj2) += (2 * P + 1) * Exp_msk1 - y;
+                aadj1 = dval(&aadj2);
             }
-            adj = aadj1 * ulp(dval(rv));
-            dval(rv) += adj;
+            adj.d = aadj1 * ulp(&rv);
+            dval(&rv) += adj.d;
 #else
 #ifdef Sudden_Underflow
-            if ((word0(rv) & Exp_mask) <= P * Exp_msk1) {
-                dval(rv0) = dval(rv);
-                word0(rv) += P * Exp_msk1;
-                adj = aadj1 * ulp(dval(rv));
-                dval(rv) += adj;
-                if ((word0(rv) & Exp_mask) <= P * Exp_msk1)
+            if ((word0(&rv) & Exp_mask) <= P * Exp_msk1) {
+                dval(&rv0) = dval(&rv);
+                word0(&rv) += P * Exp_msk1;
+                adj.d = aadj1 * ulp(&rv);
+                dval(&rv) += adj.d;
+                if ((word0(&rv) & Exp_mask) <= P * Exp_msk1)
                 {
-                    if (word0(rv0) == Tiny0 && word1(rv0) == Tiny1)
+                    if (word0(&rv0) == Tiny0 && word1(&rv0) == Tiny1)
                         goto undfl;
-                    word0(rv) = Tiny0;
-                    word1(rv) = Tiny1;
+                    word0(&rv) = Tiny0;
+                    word1(&rv) = Tiny1;
                     goto cont;
                 }
                 else
-                    word0(rv) -= P * Exp_msk1;
+                    word0(&rv) -= P * Exp_msk1;
             } else {
-                adj = aadj1 * ulp(dval(rv));
-                dval(rv) += adj;
+                adj.d = aadj1 * ulp(&rv);
+                dval(&rv) += adj.d;
             }
 #else /*Sudden_Underflow*/
             /* Compute adj so that the IEEE rounding rules will
@@ -1656,12 +1638,12 @@
                 if (!dsign)
                     aadj1 = -aadj1;
             }
-            adj = aadj1 * ulp(dval(rv));
-            dval(rv) += adj;
+            adj.d = aadj1 * ulp(&rv);
+            dval(&rv) += adj.d;
 #endif /*Sudden_Underflow*/
 #endif /*Avoid_Underflow*/
         }
-        z = word0(rv) & Exp_mask;
+        z = word0(&rv) & Exp_mask;
 #ifndef SET_INEXACT
 #ifdef Avoid_Underflow
         if (!scale)
@@ -1671,7 +1653,7 @@
             L = (int32_t)aadj;
             aadj -= L;
             /* The tolerances below are conservative. */
-            if (dsign || word1(rv) || word0(rv) & Bndry_mask) {
+            if (dsign || word1(&rv) || word0(&rv) & Bndry_mask) {
                 if (aadj < .4999999 || aadj > .5000001)
                     break;
             } else if (aadj < .4999999 / FLT_RADIX)
@@ -1679,53 +1661,44 @@
         }
 #endif
 cont:
-        Bfree(bb);
-        Bfree(bd);
-        Bfree(bs);
-        Bfree(delta);
+        ;
     }
 #ifdef SET_INEXACT
     if (inexact) {
         if (!oldinexact) {
-            word0(rv0) = Exp_1 + (70 << Exp_shift);
-            word1(rv0) = 0;
-            dval(rv0) += 1.;
+            word0(&rv0) = Exp_1 + (70 << Exp_shift);
+            word1(&rv0) = 0;
+            dval(&rv0) += 1.;
         }
     } else if (!oldinexact)
         clear_inexact();
 #endif
 #ifdef Avoid_Underflow
     if (scale) {
-        word0(rv0) = Exp_1 - 2 * P * Exp_msk1;
-        word1(rv0) = 0;
-        dval(rv) *= dval(rv0);
+        word0(&rv0) = Exp_1 - 2 * P * Exp_msk1;
+        word1(&rv0) = 0;
+        dval(&rv) *= dval(&rv0);
 #ifndef NO_ERRNO
         /* try to avoid the bug of testing an 8087 register value */
-        if (word0(rv) == 0 && word1(rv) == 0)
+        if (word0(&rv) == 0 && word1(&rv) == 0)
             errno = ERANGE;
 #endif
     }
 #endif /* Avoid_Underflow */
 #ifdef SET_INEXACT
-    if (inexact && !(word0(rv) & Exp_mask)) {
+    if (inexact && !(word0(&rv) & Exp_mask)) {
         /* set underflow bit */
-        dval(rv0) = 1e-300;
-        dval(rv0) *= dval(rv0);
+        dval(&rv0) = 1e-300;
+        dval(&rv0) *= dval(&rv0);
     }
 #endif
-retfree:
-    Bfree(bb);
-    Bfree(bd);
-    Bfree(bs);
-    Bfree(bd0);
-    Bfree(delta);
 ret:
     if (se)
         *se = const_cast<char*>(s);
-    return sign ? -dval(rv) : dval(rv);
+    return sign ? -dval(&rv) : dval(&rv);
 }
 
-static int quorem(Bigint* b, Bigint* S)
+static ALWAYS_INLINE int quorem(BigInt& b, BigInt& S)
 {
     int n;
     uint32_t *bx, *bxe, q, *sx, *sxe;
@@ -1738,13 +1711,13 @@
 #endif
 #endif
 
-    n = S->wds;
-    ASSERT_WITH_MESSAGE(b->wds <= n, "oversize b in quorem");
-    if (b->wds < n)
+    n = S.wds;
+    ASSERT_WITH_MESSAGE(b.wds <= n, "oversize b in quorem");
+    if (b.wds < n)
         return 0;
-    sx = S->x;
+    sx = S.x;
     sxe = sx + --n;
-    bx = b->x;
+    bx = b.x;
     bxe = bx + n;
     q = *bxe / (*sxe + 1);    /* ensure q <= true quotient */
     ASSERT_WITH_MESSAGE(q <= 9, "oversized quotient in quorem");
@@ -1779,18 +1752,18 @@
 #endif
         } while (sx <= sxe);
         if (!*bxe) {
-            bx = b->x;
+            bx = b.x;
             while (--bxe > bx && !*bxe)
                 --n;
-            b->wds = n;
+            b.wds = n;
         }
     }
     if (cmp(b, S) >= 0) {
         q++;
         borrow = 0;
         carry = 0;
-        bx = b->x;
-        sx = S->x;
+        bx = b.x;
+        sx = S.x;
         do {
 #ifdef USE_LONG_LONG
             ys = *sx++ + carry;
@@ -1818,68 +1791,17 @@
 #endif
 #endif
         } while (sx <= sxe);
-        bx = b->x;
+        bx = b.x;
         bxe = bx + n;
         if (!*bxe) {
             while (--bxe > bx && !*bxe)
                 --n;
-            b->wds = n;
+            b.wds = n;
         }
     }
     return q;
 }
 
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-static char* dtoa_result;
-#endif
-
-static char* rv_alloc(int i)
-{
-    int k;
-
-    int j = sizeof(uint32_t);
-    for (k = 0;
-        sizeof(Bigint) - sizeof(uint32_t) - sizeof(int) + j <= (unsigned)i;
-        j <<= 1)
-            k++;
-    int* r = (int*)Balloc(k);
-    *r = k;
-    return
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-    dtoa_result =
-#endif
-        (char*)(r + 1);
-}
-
-static char* nrv_alloc(const char* s, char** rve, int n)
-{
-    char* rv = rv_alloc(n);
-    char* t = rv;
-
-    while ((*t = *s++))
-        t++;
-    if (rve)
-        *rve = t;
-    return rv;
-}
-
-/* freedtoa(s) must be used to free values s returned by dtoa
- * when MULTIPLE_THREADS is #defined.  It should be used in all cases,
- * but for consistency with earlier versions of dtoa, it is optional
- * when MULTIPLE_THREADS is not defined.
- */
-
-void freedtoa(char* s)
-{
-    Bigint* b = (Bigint*)((int*)s - 1);
-    b->maxwds = 1 << (b->k = *(int*)b);
-    Bfree(b);
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-    if (s == dtoa_result)
-        dtoa_result = 0;
-#endif
-}
-
 /* dtoa for IEEE arithmetic (dmg): convert double to ASCII string.
  *
  * Inspired by "How to Print Floating-Point Numbers Accurately" by
@@ -1914,7 +1836,7 @@
  *       calculation.
  */
 
-char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
+void dtoa(char* result, double dd, int ndigits, int* decpt, int* sign, char** rve)
 {
     /*
         Arguments ndigits, decpt, sign are similar to those
@@ -1933,38 +1855,37 @@
     int denorm;
     uint32_t x;
 #endif
-    Bigint *b, *b1, *delta, *mlo = NULL, *mhi, *S;
-    double d2, ds, eps;
+    BigInt b, b1, delta, mlo, mhi, S;
+    U d2, eps, u;
+    double ds;
     char *s, *s0;
 #ifdef SET_INEXACT
     int inexact, oldinexact;
 #endif
 
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-    if (dtoa_result) {
-        freedtoa(dtoa_result);
-        dtoa_result = 0;
-    }
-#endif
-
-    if (word0(d) & Sign_bit) {
+    u.d = dd;
+    if (word0(&u) & Sign_bit) {
         /* set sign for everything, including 0's and NaNs */
         *sign = 1;
-        word0(d) &= ~Sign_bit;    /* clear sign bit */
+        word0(&u) &= ~Sign_bit;    /* clear sign bit */
     } else
         *sign = 0;
 
-    if ((word0(d) & Exp_mask) == Exp_mask)
+    if ((word0(&u) & Exp_mask) == Exp_mask)
     {
         /* Infinity or NaN */
         *decpt = 9999;
-        if (!word1(d) && !(word0(d) & 0xfffff))
-            return nrv_alloc("Infinity", rve, 8);
-        return nrv_alloc("NaN", rve, 3);
+        if (!word1(&u) && !(word0(&u) & 0xfffff))
+            strcpy(result, "Infinity");
+        else 
+            strcpy(result, "NaN");
+        return;
     }
-    if (!dval(d)) {
+    if (!dval(&u)) {
         *decpt = 1;
-        return nrv_alloc("0", rve, 1);
+        result[0] = '0';
+        result[1] = '\0';
+        return;
     }
 
 #ifdef SET_INEXACT
@@ -1972,15 +1893,15 @@
     inexact = 1;
 #endif
 
-    b = d2b(dval(d), &be, &bbits);
+    d2b(b, &u, &be, &bbits);
 #ifdef Sudden_Underflow
-    i = (int)(word0(d) >> Exp_shift1 & (Exp_mask >> Exp_shift1));
+    i = (int)(word0(&u) >> Exp_shift1 & (Exp_mask >> Exp_shift1));
 #else
-    if ((i = (int)(word0(d) >> Exp_shift1 & (Exp_mask >> Exp_shift1)))) {
+    if ((i = (int)(word0(&u) >> Exp_shift1 & (Exp_mask >> Exp_shift1)))) {
 #endif
-        dval(d2) = dval(d);
-        word0(d2) &= Frac_mask1;
-        word0(d2) |= Exp_11;
+        dval(&d2) = dval(&u);
+        word0(&d2) &= Frac_mask1;
+        word0(&d2) |= Exp_11;
 
         /* log(x)    ~=~ log(1.5) + (x-1.5)/1.5
          * log10(x)     =  log(x) / log(10)
@@ -2011,21 +1932,21 @@
         /* d is denormalized */
 
         i = bbits + be + (Bias + (P - 1) - 1);
-        x = (i > 32) ? (word0(d) << (64 - i)) | (word1(d) >> (i - 32))
-                : word1(d) << (32 - i);
-        dval(d2) = x;
-        word0(d2) -= 31 * Exp_msk1; /* adjust exponent */
+        x = (i > 32) ? (word0(&u) << (64 - i)) | (word1(&u) >> (i - 32))
+                : word1(&u) << (32 - i);
+        dval(&d2) = x;
+        word0(&d2) -= 31 * Exp_msk1; /* adjust exponent */
         i -= (Bias + (P - 1) - 1) + 1;
         denorm = 1;
     }
 #endif
-    ds = (dval(d2) - 1.5) * 0.289529654602168 + 0.1760912590558 + (i * 0.301029995663981);
+    ds = (dval(&d2) - 1.5) * 0.289529654602168 + 0.1760912590558 + (i * 0.301029995663981);
     k = (int)ds;
     if (ds < 0. && ds != k)
         k--;    /* want k = floor(ds) */
     k_check = 1;
     if (k >= 0 && k <= Ten_pmax) {
-        if (dval(d) < tens[k])
+        if (dval(&u) < tens[k])
             k--;
         k_check = 0;
     }
@@ -2059,14 +1980,14 @@
     ilim = ilim1 = -1;
     i = 18;
     ndigits = 0;
-    s = s0 = rv_alloc(i);
+    s = s0 = result;
 
     if (ilim >= 0 && ilim <= Quick_max && try_quick) {
 
         /* Try to get by with floating-point arithmetic. */
 
         i = 0;
-        dval(d2) = dval(d);
+        dval(&d2) = dval(&u);
         k0 = k;
         ilim0 = ilim;
         ieps = 2; /* conservative */
@@ -2076,7 +1997,7 @@
             if (j & Bletch) {
                 /* prevent overflows */
                 j &= Bletch - 1;
-                dval(d) /= bigtens[n_bigtens - 1];
+                dval(&u) /= bigtens[n_bigtens - 1];
                 ieps++;
             }
             for (; j; j >>= 1, i++) {
@@ -2085,32 +2006,32 @@
                     ds *= bigtens[i];
                 }
             }
-            dval(d) /= ds;
+            dval(&u) /= ds;
         } else if ((j1 = -k)) {
-            dval(d) *= tens[j1 & 0xf];
+            dval(&u) *= tens[j1 & 0xf];
             for (j = j1 >> 4; j; j >>= 1, i++) {
                 if (j & 1) {
                     ieps++;
-                    dval(d) *= bigtens[i];
+                    dval(&u) *= bigtens[i];
                 }
             }
         }
-        if (k_check && dval(d) < 1. && ilim > 0) {
+        if (k_check && dval(&u) < 1. && ilim > 0) {
             if (ilim1 <= 0)
                 goto fast_failed;
             ilim = ilim1;
             k--;
-            dval(d) *= 10.;
+            dval(&u) *= 10.;
             ieps++;
         }
-        dval(eps) = (ieps * dval(d)) + 7.;
-        word0(eps) -= (P - 1) * Exp_msk1;
+        dval(&eps) = (ieps * dval(&u)) + 7.;
+        word0(&eps) -= (P - 1) * Exp_msk1;
         if (ilim == 0) {
-            S = mhi = 0;
-            dval(d) -= 5.;
-            if (dval(d) > dval(eps))
+            S = mhi = BigInt();
+            dval(&u) -= 5.;
+            if (dval(&u) > dval(&eps))
                 goto one_digit;
-            if (dval(d) < -dval(eps))
+            if (dval(&u) < -dval(&eps))
                 goto no_digits;
             goto fast_failed;
         }
@@ -2119,36 +2040,36 @@
             /* Use Steele & White method of only
              * generating digits needed.
              */
-            dval(eps) = (0.5 / tens[ilim - 1]) - dval(eps);
+            dval(&eps) = (0.5 / tens[ilim - 1]) - dval(&eps);
             for (i = 0;;) {
-                L = (long int)dval(d);
-                dval(d) -= L;
+                L = (long int)dval(&u);
+                dval(&u) -= L;
                 *s++ = '0' + (int)L;
-                if (dval(d) < dval(eps))
-                    goto ret1;
-                if (1. - dval(d) < dval(eps))
+                if (dval(&u) < dval(&eps))
+                    goto ret;
+                if (1. - dval(&u) < dval(&eps))
                     goto bump_up;
                 if (++i >= ilim)
                     break;
-                dval(eps) *= 10.;
-                dval(d) *= 10.;
+                dval(&eps) *= 10.;
+                dval(&u) *= 10.;
             }
         } else {
 #endif
             /* Generate ilim digits, then fix them up. */
-            dval(eps) *= tens[ilim - 1];
-            for (i = 1;; i++, dval(d) *= 10.) {
-                L = (int32_t)(dval(d));
-                if (!(dval(d) -= L))
+            dval(&eps) *= tens[ilim - 1];
+            for (i = 1;; i++, dval(&u) *= 10.) {
+                L = (int32_t)(dval(&u));
+                if (!(dval(&u) -= L))
                     ilim = i;
                 *s++ = '0' + (int)L;
                 if (i == ilim) {
-                    if (dval(d) > 0.5 + dval(eps))
+                    if (dval(&u) > 0.5 + dval(&eps))
                         goto bump_up;
-                    else if (dval(d) < 0.5 - dval(eps)) {
+                    else if (dval(&u) < 0.5 - dval(&eps)) {
                         while (*--s == '0') { }
                         s++;
-                        goto ret1;
+                        goto ret;
                     }
                     break;
                 }
@@ -2158,7 +2079,7 @@
 #endif
 fast_failed:
         s = s0;
-        dval(d) = dval(d2);
+        dval(&u) = dval(&d2);
         k = k0;
         ilim = ilim0;
     }
@@ -2169,31 +2090,31 @@
         /* Yes. */
         ds = tens[k];
         if (ndigits < 0 && ilim <= 0) {
-            S = mhi = 0;
-            if (ilim < 0 || dval(d) <= 5 * ds)
+            S = mhi = BigInt();
+            if (ilim < 0 || dval(&u) <= 5 * ds)
                 goto no_digits;
             goto one_digit;
         }
-        for (i = 1;; i++, dval(d) *= 10.) {
-            L = (int32_t)(dval(d) / ds);
-            dval(d) -= L * ds;
+        for (i = 1;; i++, dval(&u) *= 10.) {
+            L = (int32_t)(dval(&u) / ds);
+            dval(&u) -= L * ds;
 #ifdef Check_FLT_ROUNDS
             /* If FLT_ROUNDS == 2, L will usually be high by 1 */
-            if (dval(d) < 0) {
+            if (dval(&u) < 0) {
                 L--;
-                dval(d) += ds;
+                dval(&u) += ds;
             }
 #endif
             *s++ = '0' + (int)L;
-            if (!dval(d)) {
+            if (!dval(&u)) {
 #ifdef SET_INEXACT
                 inexact = 0;
 #endif
                 break;
             }
             if (i == ilim) {
-                dval(d) += dval(d);
-                if (dval(d) > ds || (dval(d) == ds && (L & 1))) {
+                dval(&u) += dval(&u);
+                if (dval(&u) > ds || (dval(&u) == ds && (L & 1))) {
 bump_up:
                     while (*--s == '9')
                         if (s == s0) {
@@ -2206,12 +2127,12 @@
                 break;
             }
         }
-        goto ret1;
+        goto ret;
     }
 
     m2 = b2;
     m5 = b5;
-    mhi = mlo = 0;
+    mhi = mlo = BigInt();
     if (leftright) {
         i =
 #ifndef Sudden_Underflow
@@ -2220,7 +2141,7 @@
             1 + P - bbits;
         b2 += i;
         s2 += i;
-        mhi = i2b(1);
+        i2b(mhi, 1);
     }
     if (m2 > 0 && s2 > 0) {
         i = m2 < s2 ? m2 : s2;
@@ -2231,26 +2152,24 @@
     if (b5 > 0) {
         if (leftright) {
             if (m5 > 0) {
-                mhi = pow5mult(mhi, m5);
-                b1 = mult(mhi, b);
-                Bfree(b);
-                b = b1;
+                pow5mult(mhi, m5);
+                mult(b, mhi);
             }
             if ((j = b5 - m5))
-                b = pow5mult(b, j);
+                pow5mult(b, j);
         } else
-            b = pow5mult(b, b5);
+            pow5mult(b, b5);
         }
-    S = i2b(1);
+    i2b(S, 1);
     if (s5 > 0)
-        S = pow5mult(S, s5);
+        pow5mult(S, s5);
 
     /* Check for special case that d is a normalized power of 2. */
 
     spec_case = 0;
-    if (!word1(d) && !(word0(d) & Bndry_mask)
+    if (!word1(&u) && !(word0(&u) & Bndry_mask)
 #ifndef Sudden_Underflow
-     && word0(d) & (Exp_mask & ~Exp_msk1)
+     && word0(&u) & (Exp_mask & ~Exp_msk1)
 #endif
             ) {
         /* The special case */
@@ -2267,10 +2186,10 @@
      * can do shifts and ors to compute the numerator for q.
      */
 #ifdef Pack_32
-    if ((i = ((s5 ? 32 - hi0bits(S->x[S->wds - 1]) : 1) + s2) & 0x1f))
+    if ((i = ((s5 ? 32 - hi0bits(S.x[S.wds - 1]) : 1) + s2) & 0x1f))
         i = 32 - i;
 #else
-    if ((i = ((s5 ? 32 - hi0bits(S->x[S->wds - 1]) : 1) + s2) & 0xf))
+    if ((i = ((s5 ? 32 - hi0bits(S.x[S.wds - 1]) : 1) + s2) & 0xf))
         i = 16 - i;
 #endif
     if (i > 4) {
@@ -2285,22 +2204,22 @@
         s2 += i;
     }
     if (b2 > 0)
-        b = lshift(b, b2);
+        lshift(b, b2);
     if (s2 > 0)
-        S = lshift(S, s2);
+        lshift(S, s2);
     if (k_check) {
         if (cmp(b,S) < 0) {
             k--;
-            b = multadd(b, 10, 0);    /* we botched the k estimate */
+            multadd(b, 10, 0);    /* we botched the k estimate */
             if (leftright)
-                mhi = multadd(mhi, 10, 0);
+                multadd(mhi, 10, 0);
             ilim = ilim1;
         }
     }
 
     if (leftright) {
         if (m2 > 0)
-            mhi = lshift(mhi, m2);
+            lshift(mhi, m2);
 
         /* Compute mlo -- check for special case
          * that d is a normalized power of 2.
@@ -2308,9 +2227,8 @@
 
         mlo = mhi;
         if (spec_case) {
-            mhi = Balloc(mhi->k);
-            Bcopy(mhi, mlo);
-            mhi = lshift(mhi, Log2P);
+            mhi = mlo;
+            lshift(mhi, Log2P);
         }
 
         for (i = 1;;i++) {
@@ -2319,10 +2237,9 @@
              * that will round to d?
              */
             j = cmp(b, mlo);
-            delta = diff(S, mhi);
-            j1 = delta->sign ? 1 : cmp(b, delta);
-            Bfree(delta);
-            if (j1 == 0 && !(word1(d) & 1)) {
+            diff(delta, S, mhi);
+            j1 = delta.sign ? 1 : cmp(b, delta);
+            if (j1 == 0 && !(word1(&u) & 1)) {
                 if (dig == '9')
                     goto round_9_up;
                 if (j > 0)
@@ -2334,15 +2251,15 @@
                 *s++ = dig;
                 goto ret;
             }
-            if (j < 0 || (j == 0 && !(word1(d) & 1))) {
-                if (!b->x[0] && b->wds <= 1) {
+            if (j < 0 || (j == 0 && !(word1(&u) & 1))) {
+                if (!b.x[0] && b.wds <= 1) {
 #ifdef SET_INEXACT
                     inexact = 0;
 #endif
                     goto accept_dig;
                 }
                 if (j1 > 0) {
-                    b = lshift(b, 1);
+                    lshift(b, 1);
                     j1 = cmp(b, S);
                     if ((j1 > 0 || (j1 == 0 && (dig & 1))) && dig++ == '9')
                         goto round_9_up;
@@ -2363,18 +2280,14 @@
             *s++ = dig;
             if (i == ilim)
                 break;
-            b = multadd(b, 10, 0);
-            if (mlo == mhi)
-                mlo = mhi = multadd(mhi, 10, 0);
-            else {
-                mlo = multadd(mlo, 10, 0);
-                mhi = multadd(mhi, 10, 0);
-            }
+            multadd(b, 10, 0);
+            multadd(mlo, 10, 0);
+            multadd(mhi, 10, 0);
         }
     } else
         for (i = 1;; i++) {
             *s++ = dig = quorem(b,S) + '0';
-            if (!b->x[0] && b->wds <= 1) {
+            if (!b.x[0] && b.wds <= 1) {
 #ifdef SET_INEXACT
                 inexact = 0;
 #endif
@@ -2382,12 +2295,12 @@
             }
             if (i >= ilim)
                 break;
-            b = multadd(b, 10, 0);
+            multadd(b, 10, 0);
         }
 
     /* Round off last digit */
 
-    b = lshift(b, 1);
+    lshift(b, 1);
     j = cmp(b, S);
     if (j > 0 || (j == 0 && (dig & 1))) {
 roundoff:
@@ -2411,29 +2324,20 @@
     k++;
     goto ret;
 ret:
-    Bfree(S);
-    if (mhi) {
-        if (mlo && mlo != mhi)
-            Bfree(mlo);
-        Bfree(mhi);
-    }
-ret1:
 #ifdef SET_INEXACT
     if (inexact) {
         if (!oldinexact) {
-            word0(d) = Exp_1 + (70 << Exp_shift);
-            word1(d) = 0;
-            dval(d) += 1.;
+            word0(&u) = Exp_1 + (70 << Exp_shift);
+            word1(&u) = 0;
+            dval(&u) += 1.;
         }
     } else if (!oldinexact)
         clear_inexact();
 #endif
-    Bfree(b);
     *s = 0;
     *decpt = k + 1;
     if (rve)
         *rve = s;
-    return s0;
 }
 
 } // namespace WTF
diff --git a/JavaScriptCore/wtf/dtoa.h b/JavaScriptCore/wtf/dtoa.h
index ed858c0..cbec7c7 100644
--- a/JavaScriptCore/wtf/dtoa.h
+++ b/JavaScriptCore/wtf/dtoa.h
@@ -30,8 +30,7 @@
     extern WTF::Mutex* s_dtoaP5Mutex;
 
     double strtod(const char* s00, char** se);
-    char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve);
-    void freedtoa(char* s);
+    void dtoa(char* result, double d, int ndigits, int* decpt, int* sign, char** rve);
 
 } // namespace WTF
 
diff --git a/JavaScriptCore/wtf/ThreadingGtk.cpp b/JavaScriptCore/wtf/gtk/ThreadingGtk.cpp
similarity index 100%
rename from JavaScriptCore/wtf/ThreadingGtk.cpp
rename to JavaScriptCore/wtf/gtk/ThreadingGtk.cpp
diff --git a/JavaScriptCore/wtf/ThreadingQt.cpp b/JavaScriptCore/wtf/qt/ThreadingQt.cpp
similarity index 100%
rename from JavaScriptCore/wtf/ThreadingQt.cpp
rename to JavaScriptCore/wtf/qt/ThreadingQt.cpp
diff --git a/JavaScriptCore/wtf/unicode/Unicode.h b/JavaScriptCore/wtf/unicode/Unicode.h
index e6e8f23..f86a9b7 100644
--- a/JavaScriptCore/wtf/unicode/Unicode.h
+++ b/JavaScriptCore/wtf/unicode/Unicode.h
@@ -28,6 +28,8 @@
 #include "qt4/UnicodeQt4.h"
 #elif USE(ICU_UNICODE)
 #include <wtf/unicode/icu/UnicodeIcu.h>
+#elif USE(GLIB_UNICODE)
+#include <wtf/unicode/glib/UnicodeGLib.h>
 #else
 #error "Unknown Unicode implementation"
 #endif
diff --git a/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp b/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
new file mode 100644
index 0000000..a779b36
--- /dev/null
+++ b/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
@@ -0,0 +1,214 @@
+/*
+ *  Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ *  Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "UnicodeGLib.h"
+
+namespace WTF {
+namespace Unicode {
+
+UChar32 foldCase(UChar32 ch)
+{
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8char;
+    utf8char.set(g_ucs4_to_utf8(reinterpret_cast<gunichar*>(&ch), 1, 0, 0, &gerror.outPtr()));
+    if (gerror)
+        return ch;
+
+    GOwnPtr<char> utf8caseFolded;
+    utf8caseFolded.set(g_utf8_casefold(utf8char.get(), -1));
+
+    GOwnPtr<gunichar> ucs4Result;
+    ucs4Result.set(g_utf8_to_ucs4_fast(utf8caseFolded.get(), -1, 0));
+
+    return *ucs4Result;
+}
+
+int foldCase(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error)
+{
+    *error = false;
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8src;
+    utf8src.set(g_utf16_to_utf8(src, srcLength, 0, 0, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    GOwnPtr<char> utf8result;
+    utf8result.set(g_utf8_casefold(utf8src.get(), -1));
+
+    long utf16resultLength = -1;
+    GOwnPtr<UChar> utf16result;
+    utf16result.set(g_utf8_to_utf16(utf8result.get(), -1, 0, &utf16resultLength, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    if (utf16resultLength > resultLength) {
+        *error = true;
+        return utf16resultLength;
+    }
+    memcpy(result, utf16result.get(), utf16resultLength * sizeof(UChar));
+
+    return utf16resultLength;
+}
+
+int toLower(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error)
+{
+    *error = false;
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8src;
+    utf8src.set(g_utf16_to_utf8(src, srcLength, 0, 0, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    GOwnPtr<char> utf8result;
+    utf8result.set(g_utf8_strdown(utf8src.get(), -1));
+
+    long utf16resultLength = -1;
+    GOwnPtr<UChar> utf16result;
+    utf16result.set(g_utf8_to_utf16(utf8result.get(), -1, 0, &utf16resultLength, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    if (utf16resultLength > resultLength) {
+        *error = true;
+        return utf16resultLength;
+    }
+    memcpy(result, utf16result.get(), utf16resultLength * sizeof(UChar));
+
+    return utf16resultLength;
+}
+
+int toUpper(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error)
+{
+    *error = false;
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8src;
+    utf8src.set(g_utf16_to_utf8(src, srcLength, 0, 0, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    GOwnPtr<char> utf8result;
+    utf8result.set(g_utf8_strup(utf8src.get(), -1));
+
+    long utf16resultLength = -1;
+    GOwnPtr<UChar> utf16result;
+    utf16result.set(g_utf8_to_utf16(utf8result.get(), -1, 0, &utf16resultLength, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    if (utf16resultLength > resultLength) {
+        *error = true;
+        return utf16resultLength;
+    }
+    memcpy(result, utf16result.get(), utf16resultLength * sizeof(UChar));
+
+    return utf16resultLength;
+}
+
+Direction direction(UChar32 c)
+{
+    PangoBidiType type = pango_bidi_type_for_unichar(c);
+    switch (type) {
+    case PANGO_BIDI_TYPE_L:
+        return LeftToRight;
+    case PANGO_BIDI_TYPE_R:
+        return RightToLeft;
+    case PANGO_BIDI_TYPE_AL:
+        return RightToLeftArabic;
+    case PANGO_BIDI_TYPE_LRE:
+        return LeftToRightEmbedding;
+    case PANGO_BIDI_TYPE_RLE:
+        return RightToLeftEmbedding;
+    case PANGO_BIDI_TYPE_LRO:
+        return LeftToRightOverride;
+    case PANGO_BIDI_TYPE_RLO:
+        return RightToLeftOverride;
+    case PANGO_BIDI_TYPE_PDF:
+        return PopDirectionalFormat;
+    case PANGO_BIDI_TYPE_EN:
+        return EuropeanNumber;
+    case PANGO_BIDI_TYPE_AN:
+        return ArabicNumber;
+    case PANGO_BIDI_TYPE_ES:
+        return EuropeanNumberSeparator;
+    case PANGO_BIDI_TYPE_ET:
+        return EuropeanNumberTerminator;
+    case PANGO_BIDI_TYPE_CS:
+        return CommonNumberSeparator;
+    case PANGO_BIDI_TYPE_NSM:
+        return NonSpacingMark;
+    case PANGO_BIDI_TYPE_BN:
+        return BoundaryNeutral;
+    case PANGO_BIDI_TYPE_B:
+        return BlockSeparator;
+    case PANGO_BIDI_TYPE_S:
+        return SegmentSeparator;
+    case PANGO_BIDI_TYPE_WS:
+        return WhiteSpaceNeutral;
+    default:
+        return OtherNeutral;
+    }
+}
+
+int umemcasecmp(const UChar* a, const UChar* b, int len)
+{
+    GOwnPtr<char> utf8a;
+    GOwnPtr<char> utf8b;
+
+    utf8a.set(g_utf16_to_utf8(a, len, 0, 0, 0));
+    utf8b.set(g_utf16_to_utf8(b, len, 0, 0, 0));
+
+    GOwnPtr<char> foldedA;
+    GOwnPtr<char> foldedB;
+
+    foldedA.set(g_utf8_casefold(utf8a.get(), -1));
+    foldedB.set(g_utf8_casefold(utf8b.get(), -1));
+
+    // FIXME: umemcasecmp needs to mimic u_memcasecmp of icu
+    // from the ICU docs:
+    // "Compare two strings case-insensitively using full case folding.
+    // his is equivalent to u_strcmp(u_strFoldCase(s1, n, options), u_strFoldCase(s2, n, options))."
+    //
+    // So it looks like we don't need the full g_utf8_collate here,
+    // but really a bitwise comparison of casefolded unicode chars (not utf-8 bytes).
+    // As there is no direct equivalent to this icu function in GLib, for now
+    // we'll use g_utf8_collate():
+
+    return g_utf8_collate(foldedA.get(), foldedB.get());
+}
+
+}
+}
diff --git a/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h b/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
new file mode 100644
index 0000000..c03d3ec
--- /dev/null
+++ b/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
@@ -0,0 +1,238 @@
+/*
+ *  Copyright (C) 2006 George Staikos <staikos@kde.org>
+ *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ *  Copyright (C) 2007 Apple Computer, Inc. All rights reserved.
+ *  Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ *  Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef UnicodeGLib_h
+#define UnicodeGLib_h
+
+#include "UnicodeMacrosFromICU.h"
+#include <wtf/GOwnPtr.h>
+
+#include <glib.h>
+#include <pango/pango.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef uint16_t UChar;
+typedef int32_t UChar32;
+
+namespace WTF {
+namespace Unicode {
+
+enum Direction {
+    LeftToRight,
+    RightToLeft,
+    EuropeanNumber,
+    EuropeanNumberSeparator,
+    EuropeanNumberTerminator,
+    ArabicNumber,
+    CommonNumberSeparator,
+    BlockSeparator,
+    SegmentSeparator,
+    WhiteSpaceNeutral,
+    OtherNeutral,
+    LeftToRightEmbedding,
+    LeftToRightOverride,
+    RightToLeftArabic,
+    RightToLeftEmbedding,
+    RightToLeftOverride,
+    PopDirectionalFormat,
+    NonSpacingMark,
+    BoundaryNeutral
+};
+
+enum DecompositionType {
+    DecompositionNone,
+    DecompositionCanonical,
+    DecompositionCompat,
+    DecompositionCircle,
+    DecompositionFinal,
+    DecompositionFont,
+    DecompositionFraction,
+    DecompositionInitial,
+    DecompositionIsolated,
+    DecompositionMedial,
+    DecompositionNarrow,
+    DecompositionNoBreak,
+    DecompositionSmall,
+    DecompositionSquare,
+    DecompositionSub,
+    DecompositionSuper,
+    DecompositionVertical,
+    DecompositionWide,
+};
+
+enum CharCategory {
+    NoCategory =  0,
+    Other_NotAssigned = U_MASK(G_UNICODE_UNASSIGNED),
+    Letter_Uppercase = U_MASK(G_UNICODE_UPPERCASE_LETTER),
+    Letter_Lowercase = U_MASK(G_UNICODE_LOWERCASE_LETTER),
+    Letter_Titlecase = U_MASK(G_UNICODE_TITLECASE_LETTER),
+    Letter_Modifier = U_MASK(G_UNICODE_MODIFIER_LETTER),
+    Letter_Other = U_MASK(G_UNICODE_OTHER_LETTER),
+
+    Mark_NonSpacing = U_MASK(G_UNICODE_NON_SPACING_MARK),
+    Mark_Enclosing = U_MASK(G_UNICODE_ENCLOSING_MARK),
+    Mark_SpacingCombining = U_MASK(G_UNICODE_COMBINING_MARK),
+
+    Number_DecimalDigit = U_MASK(G_UNICODE_DECIMAL_NUMBER),
+    Number_Letter = U_MASK(G_UNICODE_LETTER_NUMBER),
+    Number_Other = U_MASK(G_UNICODE_OTHER_NUMBER),
+
+    Separator_Space = U_MASK(G_UNICODE_SPACE_SEPARATOR),
+    Separator_Line = U_MASK(G_UNICODE_LINE_SEPARATOR),
+    Separator_Paragraph = U_MASK(G_UNICODE_PARAGRAPH_SEPARATOR),
+
+    Other_Control = U_MASK(G_UNICODE_CONTROL),
+    Other_Format = U_MASK(G_UNICODE_FORMAT),
+    Other_PrivateUse = U_MASK(G_UNICODE_PRIVATE_USE),
+    Other_Surrogate = U_MASK(G_UNICODE_SURROGATE),
+
+    Punctuation_Dash = U_MASK(G_UNICODE_DASH_PUNCTUATION),
+    Punctuation_Open = U_MASK(G_UNICODE_OPEN_PUNCTUATION),
+    Punctuation_Close = U_MASK(G_UNICODE_CLOSE_PUNCTUATION),
+    Punctuation_Connector = U_MASK(G_UNICODE_CONNECT_PUNCTUATION),
+    Punctuation_Other = U_MASK(G_UNICODE_OTHER_PUNCTUATION),
+
+    Symbol_Math = U_MASK(G_UNICODE_MATH_SYMBOL),
+    Symbol_Currency = U_MASK(G_UNICODE_CURRENCY_SYMBOL),
+    Symbol_Modifier = U_MASK(G_UNICODE_MODIFIER_SYMBOL),
+    Symbol_Other = U_MASK(G_UNICODE_OTHER_SYMBOL),
+
+    Punctuation_InitialQuote = U_MASK(G_UNICODE_INITIAL_PUNCTUATION),
+    Punctuation_FinalQuote = U_MASK(G_UNICODE_FINAL_PUNCTUATION)
+};
+
+UChar32 foldCase(UChar32);
+
+int foldCase(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error);
+
+int toLower(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error);
+
+inline UChar32 toLower(UChar32 c)
+{
+    return g_unichar_tolower(c);
+}
+
+inline UChar32 toUpper(UChar32 c)
+{
+    return g_unichar_toupper(c);
+}
+
+int toUpper(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error);
+
+inline UChar32 toTitleCase(UChar32 c)
+{
+    return g_unichar_totitle(c);
+}
+
+inline bool isArabicChar(UChar32 c)
+{
+    return c >= 0x0600 && c <= 0x06FF;
+}
+
+inline bool isFormatChar(UChar32 c)
+{
+    return g_unichar_type(c) == G_UNICODE_FORMAT;
+}
+
+inline bool isSeparatorSpace(UChar32 c)
+{
+    return g_unichar_type(c) == G_UNICODE_SPACE_SEPARATOR;
+}
+
+inline bool isPrintableChar(UChar32 c)
+{
+    return g_unichar_isprint(c);
+}
+
+inline bool isDigit(UChar32 c)
+{
+    return g_unichar_isdigit(c);
+}
+
+inline bool isPunct(UChar32 c)
+{
+    return g_unichar_ispunct(c);
+}
+
+inline bool hasLineBreakingPropertyComplexContext(UChar32 c)
+{
+    // FIXME
+    return false;
+}
+
+inline bool hasLineBreakingPropertyComplexContextOrIdeographic(UChar32 c)
+{
+    // FIXME
+    return false;
+}
+
+inline UChar32 mirroredChar(UChar32 c)
+{
+    gunichar mirror = 0;
+    g_unichar_get_mirror_char(c, &mirror);
+    return mirror;
+}
+
+inline CharCategory category(UChar32 c)
+{
+    if (c > 0xffff)
+        return NoCategory;
+
+    return (CharCategory) U_MASK(g_unichar_type(c));
+}
+
+Direction direction(UChar32);
+
+inline bool isLower(UChar32 c)
+{
+    return g_unichar_islower(c);
+}
+
+inline int digitValue(UChar32 c)
+{
+    return g_unichar_digit_value(c);
+}
+
+inline uint8_t combiningClass(UChar32 c)
+{
+    // FIXME
+    // return g_unichar_combining_class(c);
+    return 0;
+}
+
+inline DecompositionType decompositionType(UChar32 c)
+{
+    // FIXME
+    return DecompositionNone;
+}
+
+int umemcasecmp(const UChar*, const UChar*, int len);
+
+}
+}
+
+#endif
+
diff --git a/JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h b/JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h
new file mode 100644
index 0000000..5d3eca6
--- /dev/null
+++ b/JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h
@@ -0,0 +1,69 @@
+/*
+ *  Copyright (C) 2006 George Staikos <staikos@kde.org>
+ *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ *  Copyright (C) 2007 Apple Computer, Inc. All rights reserved.
+ *  Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ *  Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef UnicodeMacrosFromICU_h
+#define UnicodeMacrosFromICU_h
+
+// some defines from ICU
+
+#define U16_IS_LEAD(c) (((c)&0xfffffc00)==0xd800)
+#define U16_IS_TRAIL(c) (((c)&0xfffffc00)==0xdc00)
+#define U16_SURROGATE_OFFSET ((0xd800<<10UL)+0xdc00-0x10000)
+#define U16_GET_SUPPLEMENTARY(lead, trail) \
+    (((UChar32)(lead)<<10UL)+(UChar32)(trail)-U16_SURROGATE_OFFSET)
+
+#define U16_LEAD(supplementary) (UChar)(((supplementary)>>10)+0xd7c0)
+#define U16_TRAIL(supplementary) (UChar)(((supplementary)&0x3ff)|0xdc00)
+
+#define U_IS_SURROGATE(c) (((c)&0xfffff800)==0xd800)
+#define U16_IS_SINGLE(c) !U_IS_SURROGATE(c)
+#define U16_IS_SURROGATE(c) U_IS_SURROGATE(c)
+#define U16_IS_SURROGATE_LEAD(c) (((c)&0x400)==0)
+
+#define U16_PREV(s, start, i, c) { \
+    (c)=(s)[--(i)]; \
+    if(U16_IS_TRAIL(c)) { \
+        uint16_t __c2; \
+        if((i)>(start) && U16_IS_LEAD(__c2=(s)[(i)-1])) { \
+            --(i); \
+            (c)=U16_GET_SUPPLEMENTARY(__c2, (c)); \
+        } \
+    } \
+}
+
+#define U16_NEXT(s, i, length, c) { \
+    (c)=(s)[(i)++]; \
+    if(U16_IS_LEAD(c)) { \
+        uint16_t __c2; \
+        if((i)<(length) && U16_IS_TRAIL(__c2=(s)[(i)])) { \
+            ++(i); \
+            (c)=U16_GET_SUPPLEMENTARY((c), __c2); \
+        } \
+    } \
+}
+
+#define U_MASK(x) ((uint32_t)1<<(x))
+
+#endif
+
diff --git a/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h b/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
index de5e082..35c6fbf 100644
--- a/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
+++ b/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
@@ -184,6 +184,12 @@
     return u_getIntPropertyValue(c, UCHAR_LINE_BREAK) == U_LB_COMPLEX_CONTEXT;
 }
 
+inline bool hasLineBreakingPropertyComplexContextOrIdeographic(UChar32 c)
+{
+    int32_t prop = u_getIntPropertyValue(c, UCHAR_LINE_BREAK);
+    return prop == U_LB_COMPLEX_CONTEXT || prop == U_LB_IDEOGRAPHIC;
+}
+
 inline UChar32 mirroredChar(UChar32 c)
 {
     return u_charMirror(c);
diff --git a/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index f65e292..1531694 100644
--- a/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -92,6 +92,17 @@
     } \
 }
 
+#define U16_PREV(s, start, i, c) { \
+    (c)=(s)[--(i)]; \
+    if(U16_IS_TRAIL(c)) { \
+        uint16_t __c2; \
+        if((i)>(start) && U16_IS_LEAD(__c2=(s)[(i)-1])) { \
+            --(i); \
+            (c)=U16_GET_SUPPLEMENTARY(__c2, (c)); \
+        } \
+    } \
+}
+
 #define U_MASK(x) ((uint32_t)1<<(x))
 
 namespace WTF {
diff --git a/JavaScriptCore/yarr/RegexCompiler.cpp b/JavaScriptCore/yarr/RegexCompiler.cpp
new file mode 100644
index 0000000..c7b3c81
--- /dev/null
+++ b/JavaScriptCore/yarr/RegexCompiler.cpp
@@ -0,0 +1,728 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegexCompiler.h"
+
+#include "RegexInterpreter.h"
+#include "RegexPattern.h"
+#include <wtf/Vector.h>
+
+#if ENABLE(YARR)
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+class CharacterClassConstructor {
+public:
+    CharacterClassConstructor(bool isCaseInsensitive = false)
+        : m_isCaseInsensitive(isCaseInsensitive)
+    {
+    }
+    
+    void reset()
+    {
+        m_matches.clear();
+        m_ranges.clear();
+        m_matchesUnicode.clear();
+        m_rangesUnicode.clear();
+    }
+
+    void append(const CharacterClass* other)
+    {
+        for (size_t i = 0; i < other->m_matches.size(); ++i)
+            addSorted(m_matches, other->m_matches[i]);
+        for (size_t i = 0; i < other->m_ranges.size(); ++i)
+            addSortedRange(m_ranges, other->m_ranges[i].begin, other->m_ranges[i].end);
+        for (size_t i = 0; i < other->m_matchesUnicode.size(); ++i)
+            addSorted(m_matchesUnicode, other->m_matchesUnicode[i]);
+        for (size_t i = 0; i < other->m_rangesUnicode.size(); ++i)
+            addSortedRange(m_rangesUnicode, other->m_rangesUnicode[i].begin, other->m_rangesUnicode[i].end);
+    }
+
+    void putChar(UChar ch)
+    {
+        if (ch <= 0x7f) {
+            if (m_isCaseInsensitive && isASCIIAlpha(ch)) {
+                addSorted(m_matches, toASCIIUpper(ch));
+                addSorted(m_matches, toASCIILower(ch));
+            } else
+                addSorted(m_matches, ch);
+        } else {
+            UChar upper, lower;
+            if (m_isCaseInsensitive && ((upper = Unicode::toUpper(ch)) != (lower = Unicode::toLower(ch)))) {
+                addSorted(m_matchesUnicode, upper);
+                addSorted(m_matchesUnicode, lower);
+            } else
+                addSorted(m_matchesUnicode, ch);
+        }
+    }
+
+    // returns true if this character has another case, and 'ch' is the upper case form.
+    static inline bool isUnicodeUpper(UChar ch)
+    {
+        return ch != Unicode::toLower(ch);
+    }
+
+    // returns true if this character has another case, and 'ch' is the lower case form.
+    static inline bool isUnicodeLower(UChar ch)
+    {
+        return ch != Unicode::toUpper(ch);
+    }
+
+    void putRange(UChar lo, UChar hi)
+    {
+        if (lo <= 0x7f) {
+            char asciiLo = lo;
+            char asciiHi = std::min(hi, (UChar)0x7f);
+            addSortedRange(m_ranges, lo, asciiHi);
+            
+            if (m_isCaseInsensitive) {
+                if ((asciiLo <= 'Z') && (asciiHi >= 'A'))
+                    addSortedRange(m_ranges, std::max(asciiLo, 'A')+('a'-'A'), std::min(asciiHi, 'Z')+('a'-'A'));
+                if ((asciiLo <= 'z') && (asciiHi >= 'a'))
+                    addSortedRange(m_ranges, std::max(asciiLo, 'a')+('A'-'a'), std::min(asciiHi, 'z')+('A'-'a'));
+            }
+        }
+        if (hi >= 0x80) {
+            uint32_t unicodeCurr = std::max(lo, (UChar)0x80);
+            addSortedRange(m_rangesUnicode, unicodeCurr, hi);
+            
+            if (m_isCaseInsensitive) {
+                while (unicodeCurr <= hi) {
+                    // If the upper bound of the range (hi) is 0xffff, the increments to
+                    // unicodeCurr in this loop may take it to 0x10000.  This is fine
+                    // (if so we won't re-enter the loop, since the loop condition above
+                    // will definitely fail) - but this does mean we cannot use a UChar
+                    // to represent unicodeCurr, we must use a 32-bit value instead.
+                    ASSERT(unicodeCurr <= 0xffff);
+
+                    if (isUnicodeUpper(unicodeCurr)) {
+                        UChar lowerCaseRangeBegin = Unicode::toLower(unicodeCurr);
+                        UChar lowerCaseRangeEnd = lowerCaseRangeBegin;
+                        while ((++unicodeCurr <= hi) && isUnicodeUpper(unicodeCurr) && (Unicode::toLower(unicodeCurr) == (lowerCaseRangeEnd + 1)))
+                            lowerCaseRangeEnd++;
+                        addSortedRange(m_rangesUnicode, lowerCaseRangeBegin, lowerCaseRangeEnd);
+                    } else if (isUnicodeLower(unicodeCurr)) {
+                        UChar upperCaseRangeBegin = Unicode::toUpper(unicodeCurr);
+                        UChar upperCaseRangeEnd = upperCaseRangeBegin;
+                        while ((++unicodeCurr <= hi) && isUnicodeLower(unicodeCurr) && (Unicode::toUpper(unicodeCurr) == (upperCaseRangeEnd + 1)))
+                            upperCaseRangeEnd++;
+                        addSortedRange(m_rangesUnicode, upperCaseRangeBegin, upperCaseRangeEnd);
+                    } else
+                        ++unicodeCurr;
+                }
+            }
+        }
+    }
+
+    CharacterClass* charClass()
+    {
+        CharacterClass* characterClass = new CharacterClass();
+
+        characterClass->m_matches.append(m_matches);
+        characterClass->m_ranges.append(m_ranges);
+        characterClass->m_matchesUnicode.append(m_matchesUnicode);
+        characterClass->m_rangesUnicode.append(m_rangesUnicode);
+
+        reset();
+
+        return characterClass;
+    }
+
+private:
+    void addSorted(Vector<UChar>& matches, UChar ch)
+    {
+        unsigned pos = 0;
+        unsigned range = matches.size();
+
+        // binary chop, find position to insert char.
+        while (range) {
+            unsigned index = range >> 1;
+
+            int val = matches[pos+index] - ch;
+            if (!val)
+                return;
+            else if (val > 0)
+                range = index;
+            else {
+                pos += (index+1);
+                range -= (index+1);
+            }
+        }
+        
+        if (pos == matches.size())
+            matches.append(ch);
+        else
+            matches.insert(pos, ch);
+    }
+
+    void addSortedRange(Vector<CharacterRange>& ranges, UChar lo, UChar hi)
+    {
+        unsigned end = ranges.size();
+        
+        // Simple linear scan - I doubt there are that many ranges anyway...
+        // feel free to fix this with something faster (eg binary chop).
+        for (unsigned i = 0; i < end; ++i) {
+            // does the new range fall before the current position in the array
+            if (hi < ranges[i].begin) {
+                // optional optimization: concatenate appending ranges? - may not be worthwhile.
+                if (hi == (ranges[i].begin - 1)) {
+                    ranges[i].begin = lo;
+                    return;
+                }
+                ranges.insert(i, CharacterRange(lo, hi));
+                return;
+            }
+            // Okay, since we didn't hit the last case, the end of the new range is definitely at or after the begining
+            // If the new range start at or before the end of the last range, then the overlap (if it starts one after the
+            // end of the last range they concatenate, which is just as good.
+            if (lo <= (ranges[i].end + 1)) {
+                // found an intersect! we'll replace this entry in the array.
+                ranges[i].begin = std::min(ranges[i].begin, lo);
+                ranges[i].end = std::max(ranges[i].end, hi);
+
+                // now check if the new range can subsume any subsequent ranges.
+                unsigned next = i+1;
+                // each iteration of the loop we will either remove something from the list, or break the loop.
+                while (next < ranges.size()) {
+                    if (ranges[next].begin <= (ranges[i].end + 1)) {
+                        // the next entry now overlaps / concatenates this one.
+                        ranges[i].end = std::max(ranges[i].end, ranges[next].end);
+                        ranges.remove(next);
+                    } else
+                        break;
+                }
+                
+                return;
+            }
+        }
+
+        // CharacterRange comes after all existing ranges.
+        ranges.append(CharacterRange(lo, hi));
+    }
+
+    bool m_isCaseInsensitive;
+
+    Vector<UChar> m_matches;
+    Vector<CharacterRange> m_ranges;
+    Vector<UChar> m_matchesUnicode;
+    Vector<CharacterRange> m_rangesUnicode;
+};
+
+
+CharacterClass* newlineCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append('\n');
+    characterClass->m_matches.append('\r');
+    characterClass->m_matchesUnicode.append(0x2028);
+    characterClass->m_matchesUnicode.append(0x2029);
+    
+    return characterClass;
+}
+
+CharacterClass* digitsCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_ranges.append(CharacterRange('0', '9'));
+    
+    return characterClass;
+}
+
+CharacterClass* spacesCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append(' ');
+    characterClass->m_ranges.append(CharacterRange('\t', '\r'));
+    characterClass->m_matchesUnicode.append(0x00a0);
+    characterClass->m_matchesUnicode.append(0x1680);
+    characterClass->m_matchesUnicode.append(0x180e);
+    characterClass->m_matchesUnicode.append(0x2028);
+    characterClass->m_matchesUnicode.append(0x2029);
+    characterClass->m_matchesUnicode.append(0x202f);
+    characterClass->m_matchesUnicode.append(0x205f);
+    characterClass->m_matchesUnicode.append(0x3000);
+    characterClass->m_rangesUnicode.append(CharacterRange(0x2000, 0x200a));
+    
+    return characterClass;
+}
+
+CharacterClass* wordcharCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append('_');
+    characterClass->m_ranges.append(CharacterRange('0', '9'));
+    characterClass->m_ranges.append(CharacterRange('A', 'Z'));
+    characterClass->m_ranges.append(CharacterRange('a', 'z'));
+    
+    return characterClass;
+}
+
+CharacterClass* nondigitsCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_ranges.append(CharacterRange(0, '0' - 1));
+    characterClass->m_ranges.append(CharacterRange('9' + 1, 0x7f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x80, 0xffff));
+    
+    return characterClass;
+}
+
+CharacterClass* nonspacesCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_ranges.append(CharacterRange(0, '\t' - 1));
+    characterClass->m_ranges.append(CharacterRange('\r' + 1, ' ' - 1));
+    characterClass->m_ranges.append(CharacterRange(' ' + 1, 0x7f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x0080, 0x009f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x00a1, 0x167f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x1681, 0x180d));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x180f, 0x1fff));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x200b, 0x2027));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x202a, 0x202e));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x2030, 0x205e));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x2060, 0x2fff));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x3001, 0xffff));
+    
+    return characterClass;
+}
+
+CharacterClass* nonwordcharCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append('`');
+    characterClass->m_ranges.append(CharacterRange(0, '0' - 1));
+    characterClass->m_ranges.append(CharacterRange('9' + 1, 'A' - 1));
+    characterClass->m_ranges.append(CharacterRange('Z' + 1, '_' - 1));
+    characterClass->m_ranges.append(CharacterRange('z' + 1, 0x7f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x80, 0xffff));
+
+    return characterClass;
+}
+
+
+class RegexPatternConstructor {
+public:
+    RegexPatternConstructor(RegexPattern& pattern)
+        : m_pattern(pattern)
+        , m_characterClassConstructor(pattern.m_ignoreCase)
+    {
+    }
+
+    ~RegexPatternConstructor()
+    {
+    }
+
+    void reset()
+    {
+        m_pattern.reset();
+        m_characterClassConstructor.reset();
+    }
+    
+    void assertionBOL()
+    {
+        m_alternative->m_terms.append(PatternTerm::BOL());
+    }
+    void assertionEOL()
+    {
+        m_alternative->m_terms.append(PatternTerm::EOL());
+    }
+    void assertionWordBoundary(bool invert)
+    {
+        m_alternative->m_terms.append(PatternTerm::WordBoundary(invert));
+    }
+
+    void atomPatternCharacter(UChar ch)
+    {
+        // We handle case-insensitive checking of unicode characters which do have both
+        // cases by handling them as if they were defined using a CharacterClass.
+        if (m_pattern.m_ignoreCase && !isASCII(ch) && (Unicode::toUpper(ch) != Unicode::toLower(ch))) {
+            atomCharacterClassBegin();
+            atomCharacterClassAtom(ch);
+            atomCharacterClassEnd();
+        } else
+            m_alternative->m_terms.append(PatternTerm(ch));
+    }
+
+    void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert)
+    {
+        switch (classID) {
+        case DigitClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.digitsCharacterClass(), invert));
+            break;
+        case SpaceClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.spacesCharacterClass(), invert));
+            break;
+        case WordClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.wordcharCharacterClass(), invert));
+            break;
+        case NewlineClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.newlineCharacterClass(), invert));
+            break;
+        }
+    }
+
+    void atomCharacterClassBegin(bool invert = false)
+    {
+        m_invertCharacterClass = invert;
+    }
+
+    void atomCharacterClassAtom(UChar ch)
+    {
+        m_characterClassConstructor.putChar(ch);
+    }
+
+    void atomCharacterClassRange(UChar begin, UChar end)
+    {
+        m_characterClassConstructor.putRange(begin, end);
+    }
+
+    void atomCharacterClassBuiltIn(BuiltInCharacterClassID classID, bool invert)
+    {
+        ASSERT(classID != NewlineClassID);
+
+        switch (classID) {
+        case DigitClassID:
+            m_characterClassConstructor.append(invert ? m_pattern.nondigitsCharacterClass() : m_pattern.digitsCharacterClass());
+            break;
+        
+        case SpaceClassID:
+            m_characterClassConstructor.append(invert ? m_pattern.nonspacesCharacterClass() : m_pattern.spacesCharacterClass());
+            break;
+        
+        case WordClassID:
+            m_characterClassConstructor.append(invert ? m_pattern.nonwordcharCharacterClass() : m_pattern.wordcharCharacterClass());
+            break;
+        
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void atomCharacterClassEnd()
+    {
+        CharacterClass* newCharacterClass = m_characterClassConstructor.charClass();
+        m_pattern.m_userCharacterClasses.append(newCharacterClass);
+        m_alternative->m_terms.append(PatternTerm(newCharacterClass, m_invertCharacterClass));
+    }
+
+    void atomParenthesesSubpatternBegin(bool capture = true)
+    {
+        unsigned subpatternId = m_pattern.m_numSubpatterns + 1;
+        if (capture)
+            m_pattern.m_numSubpatterns++;
+
+        PatternDisjunction* parenthesesDisjunction = new PatternDisjunction(m_alternative);
+        m_pattern.m_disjunctions.append(parenthesesDisjunction);
+        m_alternative->m_terms.append(PatternTerm(PatternTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction, capture));
+        m_alternative = parenthesesDisjunction->addNewAlternative();
+    }
+
+    void atomParentheticalAssertionBegin(bool invert = false)
+    {
+        PatternDisjunction* parenthesesDisjunction = new PatternDisjunction(m_alternative);
+        m_pattern.m_disjunctions.append(parenthesesDisjunction);
+        m_alternative->m_terms.append(PatternTerm(PatternTerm::TypeParentheticalAssertion, m_pattern.m_numSubpatterns + 1, parenthesesDisjunction, invert));
+        m_alternative = parenthesesDisjunction->addNewAlternative();
+    }
+
+    void atomParenthesesEnd()
+    {
+        ASSERT(m_alternative->m_parent);
+        ASSERT(m_alternative->m_parent->m_parent);
+        m_alternative = m_alternative->m_parent->m_parent;
+        
+        m_alternative->lastTerm().parentheses.lastSubpatternId = m_pattern.m_numSubpatterns;
+    }
+
+    void atomBackReference(unsigned subpatternId)
+    {
+        ASSERT(subpatternId);
+        m_pattern.m_maxBackReference = std::max(m_pattern.m_maxBackReference, subpatternId);
+
+        if (subpatternId > m_pattern.m_numSubpatterns) {
+            m_alternative->m_terms.append(PatternTerm::ForwardReference());
+            return;
+        }
+
+        PatternAlternative* currentAlternative = m_alternative;
+        ASSERT(currentAlternative);
+
+        // Note to self: if we waited until the AST was baked, we could also remove forwards refs 
+        while ((currentAlternative = currentAlternative->m_parent->m_parent)) {
+            PatternTerm& term = currentAlternative->lastTerm();
+            ASSERT((term.type == PatternTerm::TypeParenthesesSubpattern) || (term.type == PatternTerm::TypeParentheticalAssertion));
+
+            if ((term.type == PatternTerm::TypeParenthesesSubpattern) && term.invertOrCapture && (subpatternId == term.subpatternId)) {
+                m_alternative->m_terms.append(PatternTerm::ForwardReference());
+                return;
+            }
+        }
+
+        m_alternative->m_terms.append(PatternTerm(subpatternId));
+    }
+
+    PatternDisjunction* copyDisjunction(PatternDisjunction* disjunction)
+    {
+        PatternDisjunction* newDisjunction = new PatternDisjunction();
+
+        newDisjunction->m_parent = disjunction->m_parent;
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            PatternAlternative* alternative = disjunction->m_alternatives[alt];
+            PatternAlternative* newAlternative = newDisjunction->addNewAlternative();
+            for (unsigned i = 0; i < alternative->m_terms.size(); ++i)
+                newAlternative->m_terms.append(copyTerm(alternative->m_terms[i]));
+        }
+
+        m_pattern.m_disjunctions.append(newDisjunction);
+        return newDisjunction;
+    }
+
+    PatternTerm copyTerm(PatternTerm& term)
+    {
+        if ((term.type != PatternTerm::TypeParenthesesSubpattern) && (term.type != PatternTerm::TypeParentheticalAssertion))
+            return PatternTerm(term);
+
+        PatternTerm termCopy = term;
+        termCopy.parentheses.disjunction = copyDisjunction(termCopy.parentheses.disjunction);
+        return termCopy;
+    }
+
+    void quantifyAtom(unsigned min, unsigned max, bool greedy)
+    {
+        ASSERT(min <= max);
+        ASSERT(m_alternative->m_terms.size());
+
+        if (!max) {
+            m_alternative->removeLastTerm();
+            return;
+        }
+
+        PatternTerm& term = m_alternative->lastTerm();
+        ASSERT(term.type > PatternTerm::TypeAssertionWordBoundary);
+        ASSERT((term.quantityCount == 1) && (term.quantityType == QuantifierFixedCount));
+
+        // For any assertion with a zero minimum, not matching is valid and has no effect,
+        // remove it.  Otherwise, we need to match as least once, but there is no point
+        // matching more than once, so remove the quantifier.  It is not entirely clear
+        // from the spec whether or not this behavior is correct, but I believe this
+        // matches Firefox. :-/
+        if (term.type == PatternTerm::TypeParentheticalAssertion) {
+            if (!min)
+                m_alternative->removeLastTerm();
+            return;
+        }
+
+        if (min == 0)
+            term.quantify(max, greedy   ? QuantifierGreedy : QuantifierNonGreedy);
+        else if (min == max)
+            term.quantify(min, QuantifierFixedCount);
+        else {
+            term.quantify(min, QuantifierFixedCount);
+            m_alternative->m_terms.append(copyTerm(term));
+            // NOTE: this term is interesting from an analysis perspective, in that it can be ignored.....
+            m_alternative->lastTerm().quantify((max == UINT_MAX) ? max : max - min, greedy ? QuantifierGreedy : QuantifierNonGreedy);
+            if (m_alternative->lastTerm().type == PatternTerm::TypeParenthesesSubpattern)
+                m_alternative->lastTerm().parentheses.isCopy = true;
+        }
+    }
+
+    void disjunction()
+    {
+        m_alternative = m_alternative->m_parent->addNewAlternative();
+    }
+
+    void regexBegin()
+    {
+        m_pattern.m_body = new PatternDisjunction();
+        m_alternative = m_pattern.m_body->addNewAlternative();
+        m_pattern.m_disjunctions.append(m_pattern.m_body);
+    }
+    void regexEnd()
+    {
+    }
+    void regexError()
+    {
+    }
+
+    unsigned setupAlternativeOffsets(PatternAlternative* alternative, unsigned currentCallFrameSize, unsigned initialInputPosition)
+    {
+        alternative->m_hasFixedSize = true;
+        unsigned currentInputPosition = initialInputPosition;
+
+        for (unsigned i = 0; i < alternative->m_terms.size(); ++i) {
+            PatternTerm& term = alternative->m_terms[i];
+
+            switch (term.type) {
+            case PatternTerm::TypeAssertionBOL:
+            case PatternTerm::TypeAssertionEOL:
+            case PatternTerm::TypeAssertionWordBoundary:
+                term.inputPosition = currentInputPosition;
+                break;
+
+            case PatternTerm::TypeBackReference:
+                term.inputPosition = currentInputPosition;
+                term.frameLocation = currentCallFrameSize;
+                currentCallFrameSize += RegexStackSpaceForBackTrackInfoBackReference;
+                alternative->m_hasFixedSize = false;
+                break;
+
+            case PatternTerm::TypeForwardReference:
+                break;
+
+            case PatternTerm::TypePatternCharacter:
+                term.inputPosition = currentInputPosition;
+                if (term.quantityType != QuantifierFixedCount) {
+                    term.frameLocation = currentCallFrameSize;
+                    currentCallFrameSize += RegexStackSpaceForBackTrackInfoPatternCharacter;
+                    alternative->m_hasFixedSize = false;
+                } else
+                    currentInputPosition += term.quantityCount;
+                break;
+
+            case PatternTerm::TypeCharacterClass:
+                term.inputPosition = currentInputPosition;
+                if (term.quantityType != QuantifierFixedCount) {
+                    term.frameLocation = currentCallFrameSize;
+                    currentCallFrameSize += RegexStackSpaceForBackTrackInfoCharacterClass;
+                    alternative->m_hasFixedSize = false;
+                } else
+                    currentInputPosition += term.quantityCount;
+                break;
+
+            case PatternTerm::TypeParenthesesSubpattern:
+                // Note: for fixed once parentheses we will ensure at least the minimum is available; others are on their own.
+                term.frameLocation = currentCallFrameSize;
+                if ((term.quantityCount == 1) && !term.parentheses.isCopy) {
+                    if (term.quantityType == QuantifierFixedCount) {
+                        currentCallFrameSize = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize, currentInputPosition);
+                        currentInputPosition += term.parentheses.disjunction->m_minimumSize;
+                    } else {
+                        currentCallFrameSize += RegexStackSpaceForBackTrackInfoParenthesesOnce;
+                        currentCallFrameSize = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize, currentInputPosition);
+                    }
+                    term.inputPosition = currentInputPosition;
+                } else {
+                    term.inputPosition = currentInputPosition;
+                    setupDisjunctionOffsets(term.parentheses.disjunction, 0, currentInputPosition);
+                    currentCallFrameSize += RegexStackSpaceForBackTrackInfoParentheses;
+                }
+                // Fixed count of 1 could be accepted, if they have a fixed size *AND* if all alternatives are of the same length.
+                alternative->m_hasFixedSize = false;
+                break;
+
+            case PatternTerm::TypeParentheticalAssertion:
+                term.inputPosition = currentInputPosition;
+                term.frameLocation = currentCallFrameSize;
+                currentCallFrameSize = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize + RegexStackSpaceForBackTrackInfoParentheticalAssertion, currentInputPosition);
+                break;
+            }
+        }
+
+        alternative->m_minimumSize = currentInputPosition - initialInputPosition;
+        return currentCallFrameSize;
+    }
+
+    unsigned setupDisjunctionOffsets(PatternDisjunction* disjunction, unsigned initialCallFrameSize, unsigned initialInputPosition)
+    {
+        if ((disjunction != m_pattern.m_body) && (disjunction->m_alternatives.size() > 1))
+            initialCallFrameSize += RegexStackSpaceForBackTrackInfoAlternative;
+
+        unsigned minimumInputSize = UINT_MAX;
+        unsigned maximumCallFrameSize = 0;
+        bool hasFixedSize = true;
+
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            PatternAlternative* alternative = disjunction->m_alternatives[alt];
+            unsigned currentAlternativeCallFrameSize = setupAlternativeOffsets(alternative, initialCallFrameSize, initialInputPosition);
+            minimumInputSize = min(minimumInputSize, alternative->m_minimumSize);
+            maximumCallFrameSize = max(maximumCallFrameSize, currentAlternativeCallFrameSize);
+            hasFixedSize &= alternative->m_hasFixedSize;
+        }
+        
+        ASSERT(minimumInputSize != UINT_MAX);
+        ASSERT(maximumCallFrameSize >= initialCallFrameSize);
+
+        disjunction->m_hasFixedSize = hasFixedSize;
+        disjunction->m_minimumSize = minimumInputSize;
+        disjunction->m_callFrameSize = maximumCallFrameSize;
+        return maximumCallFrameSize;
+    }
+
+    void setupOffsets()
+    {
+        setupDisjunctionOffsets(m_pattern.m_body, 0, 0);
+    }
+
+private:
+    RegexPattern& m_pattern;
+    PatternAlternative* m_alternative;
+    CharacterClassConstructor m_characterClassConstructor;
+    bool m_invertCharacterClass;
+};
+
+
+const char* compileRegex(const UString& patternString, RegexPattern& pattern)
+{
+    RegexPatternConstructor constructor(pattern);
+
+    if (const char* error = parse(constructor, patternString))
+        return error;
+    
+    // If the pattern contains illegal backreferences reset & reparse.
+    // Quoting Netscape's "What's new in JavaScript 1.2",
+    //      "Note: if the number of left parentheses is less than the number specified
+    //       in \#, the \# is taken as an octal escape as described in the next row."
+    if (pattern.containsIllegalBackReference()) {
+        unsigned numSubpatterns = pattern.m_numSubpatterns;
+
+        constructor.reset();
+#ifndef NDEBUG
+        const char* error =
+#endif
+            parse(constructor, patternString, numSubpatterns);
+
+        ASSERT(!error);
+        ASSERT(numSubpatterns == pattern.m_numSubpatterns);
+    }
+
+    constructor.setupOffsets();
+
+    return false;
+};
+
+
+} }
+
+#endif
diff --git a/WebCore/platform/network/cf/ResourceResponseCFNet.h b/JavaScriptCore/yarr/RegexCompiler.h
similarity index 68%
copy from WebCore/platform/network/cf/ResourceResponseCFNet.h
copy to JavaScriptCore/yarr/RegexCompiler.h
index 27144c6..3ed2be9 100644
--- a/WebCore/platform/network/cf/ResourceResponseCFNet.h
+++ b/JavaScriptCore/yarr/RegexCompiler.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,10 +10,10 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -23,17 +23,23 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef ResourceResponseCFNet_h
-#define ResourceResponseCFNet_h
+#ifndef RegexCompiler_h
+#define RegexCompiler_h
 
-typedef struct _CFURLResponse* CFURLResponseRef;
+#include <wtf/Platform.h>
 
-namespace WebCore {
+#if ENABLE(YARR)
 
-    class ResourceResponse;
+#include <wtf/unicode/Unicode.h>
+#include "RegexParser.h"
+#include "RegexPattern.h"
 
-    void getResourceResponse(ResourceResponse& response, CFURLResponseRef cfResponse);
+namespace JSC { namespace Yarr {
 
-}
+const char* compileRegex(const UString& patternString, RegexPattern& pattern);
 
-#endif // ResourceResponseCFNet_h
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexCompiler_h
diff --git a/JavaScriptCore/yarr/RegexInterpreter.cpp b/JavaScriptCore/yarr/RegexInterpreter.cpp
new file mode 100644
index 0000000..b0aae65
--- /dev/null
+++ b/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -0,0 +1,1638 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegexInterpreter.h"
+
+#include "RegexCompiler.h"
+#include "RegexPattern.h"
+
+#ifndef NDEBUG
+#include <stdio.h>
+#endif
+
+#if ENABLE(YARR)
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+class Interpreter {
+public:
+    struct ParenthesesDisjunctionContext;
+
+    struct BackTrackInfoPatternCharacter {
+        uintptr_t matchAmount;
+    };
+    struct BackTrackInfoCharacterClass {
+        uintptr_t matchAmount;
+    };
+    struct BackTrackInfoBackReference {
+        uintptr_t begin; // Not really needed for greedy quantifiers.
+        uintptr_t matchAmount; // Not really needed for fixed quantifiers.
+    };
+    struct BackTrackInfoAlternative {
+        uintptr_t offset;
+    };
+    struct BackTrackInfoParentheticalAssertion {
+        uintptr_t begin;
+    };
+    struct BackTrackInfoParenthesesOnce {
+        uintptr_t inParentheses;
+    };
+    struct BackTrackInfoParentheses {
+        uintptr_t matchAmount;
+        ParenthesesDisjunctionContext* lastContext;
+        uintptr_t prevBegin;
+        uintptr_t prevEnd;
+    };
+
+    static inline void appendParenthesesDisjunctionContext(BackTrackInfoParentheses* backTrack, ParenthesesDisjunctionContext* context)
+    {
+        context->next = backTrack->lastContext;
+        backTrack->lastContext = context;
+        ++backTrack->matchAmount;
+    }
+
+    static inline void popParenthesesDisjunctionContext(BackTrackInfoParentheses* backTrack)
+    {
+        ASSERT(backTrack->matchAmount);
+        ASSERT(backTrack->lastContext);
+        backTrack->lastContext = backTrack->lastContext->next;
+        --backTrack->matchAmount;
+    }
+
+    struct DisjunctionContext
+    {
+        DisjunctionContext()
+            : term(0)
+        {
+        }
+        
+        void* operator new(size_t, void* where)
+        {
+            return where;
+        }
+
+        int term;
+        unsigned matchBegin;
+        unsigned matchEnd;
+        uintptr_t frame[1];
+    };
+
+    DisjunctionContext* allocDisjunctionContext(ByteDisjunction* disjunction)
+    {
+        return new(malloc(sizeof(DisjunctionContext) + (disjunction->m_frameSize - 1) * sizeof(uintptr_t))) DisjunctionContext();
+    }
+
+    void freeDisjunctionContext(DisjunctionContext* context)
+    {
+        free(context);
+    }
+
+    struct ParenthesesDisjunctionContext
+    {
+        ParenthesesDisjunctionContext(int* output, ByteTerm& term)
+            : next(0)
+        {
+            unsigned firstSubpatternId = term.atom.subpatternId;
+            unsigned numNestedSubpatterns = term.atom.parenthesesDisjunction->m_numSubpatterns;
+
+            for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i) {
+                subpatternBackup[i] = output[(firstSubpatternId << 1) + i];
+                output[(firstSubpatternId << 1) + i] = -1;
+            }
+            
+            new(getDisjunctionContext(term)) DisjunctionContext();
+        }
+
+        void* operator new(size_t, void* where)
+        {
+            return where;
+        }
+
+        void restoreOutput(int* output, unsigned firstSubpatternId, unsigned numNestedSubpatterns)
+        {
+            for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i)
+                output[(firstSubpatternId << 1) + i] = subpatternBackup[i];
+        }
+        
+        DisjunctionContext* getDisjunctionContext(ByteTerm& term)
+        {
+            return reinterpret_cast<DisjunctionContext*>(&(subpatternBackup[term.atom.parenthesesDisjunction->m_numSubpatterns << 1]));
+        }
+
+        ParenthesesDisjunctionContext* next;
+        int subpatternBackup[1];
+    };
+
+    ParenthesesDisjunctionContext* allocParenthesesDisjunctionContext(ByteDisjunction* disjunction, int* output, ByteTerm& term)
+    {
+        return new(malloc(sizeof(ParenthesesDisjunctionContext) + (((term.atom.parenthesesDisjunction->m_numSubpatterns << 1) - 1) * sizeof(int)) + sizeof(DisjunctionContext) + (disjunction->m_frameSize - 1) * sizeof(uintptr_t))) ParenthesesDisjunctionContext(output, term);
+    }
+
+    void freeParenthesesDisjunctionContext(ParenthesesDisjunctionContext* context)
+    {
+        free(context);
+    }
+
+    class InputStream {
+    public:
+        InputStream(const UChar* input, unsigned start, unsigned length)
+            : input(input)
+            , pos(start)
+            , length(length)
+        {
+        }
+
+        void next()
+        {
+            ++pos;
+        }
+
+        void rewind(unsigned amount)
+        {
+            ASSERT(pos >= amount);
+            pos -= amount;
+        }
+
+        int read()
+        {
+            ASSERT(pos < length);
+            if (pos < length)
+                return input[pos];
+            return -1;
+        }
+
+        int readChecked(int position)
+        {
+            ASSERT(position < 0);
+            ASSERT((unsigned)-position <= pos);
+            unsigned p = pos + position;
+            ASSERT(p < length);
+            return input[p];
+        }
+
+        int reread(unsigned from)
+        {
+            ASSERT(from < length);
+            return input[from];
+        }
+
+        int prev()
+        {
+            ASSERT(!(pos > length));
+            if (pos && length)
+                return input[pos - 1];
+            return -1;
+        }
+        
+        unsigned getPos()
+        {
+            return pos;
+        }
+
+        void setPos(unsigned p)
+        {
+            pos = p;
+        }
+        
+        bool atStart()
+        {
+            return pos == 0;
+        }
+
+        bool atEnd()
+        {
+            return pos == length;
+        }
+
+        bool checkInput(int count)
+        {
+            if ((pos + count) <= length) {
+                pos += count;
+                return true;
+            } else
+                return false;
+        }
+
+        void uncheckInput(int count)
+        {
+            pos -= count;
+        }
+
+        bool atStart(int position)
+        {
+            return (pos + position) == 0;
+        }
+
+        bool atEnd(int position)
+        {
+            return (pos + position) == length;
+        }
+
+    private:
+        const UChar* input;
+        unsigned pos;
+        unsigned length;
+    };
+
+    bool testCharacterClass(CharacterClass* characterClass, int ch)
+    {
+        if (ch & 0xFF80) {
+            for (unsigned i = 0; i < characterClass->m_matchesUnicode.size(); ++i)
+                if (ch == characterClass->m_matchesUnicode[i])
+                    return true;
+            for (unsigned i = 0; i < characterClass->m_rangesUnicode.size(); ++i)
+                if ((ch >= characterClass->m_rangesUnicode[i].begin) && (ch <= characterClass->m_rangesUnicode[i].end))
+                    return true;
+        } else {
+            for (unsigned i = 0; i < characterClass->m_matches.size(); ++i)
+                if (ch == characterClass->m_matches[i])
+                    return true;
+            for (unsigned i = 0; i < characterClass->m_ranges.size(); ++i)
+                if ((ch >= characterClass->m_ranges[i].begin) && (ch <= characterClass->m_ranges[i].end))
+                    return true;
+        }
+
+        return false;
+    }
+
+    bool tryConsumeCharacter(int testChar)
+    {
+        if (input.atEnd())
+            return false;
+        
+        int ch = input.read();
+
+        if (pattern->m_ignoreCase ? ((Unicode::toLower(testChar) == ch) || (Unicode::toUpper(testChar) == ch)) : (testChar == ch)) {
+            input.next();
+            return true;
+        }
+        return false;
+    }
+
+    bool checkCharacter(int testChar, int inputPosition)
+    {
+        return testChar == input.readChecked(inputPosition);
+    }
+
+    bool checkCasedCharacter(int loChar, int hiChar, int inputPosition)
+    {
+        int ch = input.readChecked(inputPosition);
+        return (loChar == ch) || (hiChar == ch);
+    }
+
+    bool tryConsumeCharacterClass(CharacterClass* characterClass, bool invert)
+    {
+        if (input.atEnd())
+            return false;
+
+        bool match = testCharacterClass(characterClass, input.read());
+
+        if (invert)
+            match = !match;
+
+        if (match) {
+            input.next();
+            return true;
+        }
+        return false;
+    }
+
+    bool checkCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition)
+    {
+        bool match = testCharacterClass(characterClass, input.readChecked(inputPosition));
+        return invert ? !match : match;
+    }
+
+    bool tryConsumeBackReference(int matchBegin, int matchEnd, int inputOffset)
+    {
+        int matchSize = matchEnd - matchBegin;
+
+        if (!input.checkInput(matchSize))
+            return false;
+
+        for (int i = 0; i < matchSize; ++i) {
+            if (!checkCharacter(input.reread(matchBegin + i), inputOffset - matchSize + i)) {
+                input.uncheckInput(matchSize);
+                return false;
+            }
+        }
+        
+        return true;
+    }
+
+    bool matchAssertionBOL(ByteTerm& term)
+    {
+        return (input.atStart(term.inputPosition)) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition - 1)));
+    }
+
+    bool matchAssertionEOL(ByteTerm& term)
+    {
+        if (term.inputPosition)
+            return (input.atEnd(term.inputPosition)) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition)));
+        else
+            return (input.atEnd()) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.read()));
+    }
+
+    bool matchAssertionWordBoundary(ByteTerm& term)
+    {
+        bool prevIsWordchar = !input.atStart(term.inputPosition) && testCharacterClass(pattern->wordcharCharacterClass, input.readChecked(term.inputPosition - 1));
+        bool readIsWordchar;
+        if (term.inputPosition)
+            readIsWordchar = !input.atEnd(term.inputPosition) && testCharacterClass(pattern->wordcharCharacterClass, input.readChecked(term.inputPosition));
+        else
+            readIsWordchar = !input.atEnd() && testCharacterClass(pattern->wordcharCharacterClass, input.read());
+
+        bool wordBoundary = prevIsWordchar != readIsWordchar;
+        return term.invert() ? !wordBoundary : wordBoundary;
+    }
+
+    bool backtrackPatternCharacter(ByteTerm& term, DisjunctionContext* context)
+    {
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.uncheckInput(1);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCharacter(term.atom.patternCharacter, term.inputPosition - 1))
+                    return true;
+            }
+            input.uncheckInput(backTrack->matchAmount);
+            break;
+        }
+
+        return false;
+    }
+
+    bool backtrackPatternCasedCharacter(ByteTerm& term, DisjunctionContext* context)
+    {
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.uncheckInput(1);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCasedCharacter(term.atom.casedCharacter.lo, term.atom.casedCharacter.hi, term.inputPosition - 1))
+                    return true;
+            }
+            input.uncheckInput(backTrack->matchAmount);
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchCharacterClass(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeCharacterClass);
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            for (unsigned matchAmount = 0; matchAmount < term.atom.quantityCount; ++matchAmount) {
+                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition + matchAmount))
+                    return false;
+            }
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            unsigned matchAmount = 0;
+            while ((matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition - 1)) {
+                    input.uncheckInput(1);
+                    break;
+                }
+                ++matchAmount;
+            }
+            backTrack->matchAmount = matchAmount;
+
+            return true;
+        }
+
+        case QuantifierNonGreedy:
+            backTrack->matchAmount = 0;
+            return true;
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool backtrackCharacterClass(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeCharacterClass);
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.uncheckInput(1);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition - 1))
+                    return true;
+            }
+            input.uncheckInput(backTrack->matchAmount);
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchBackReference(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeBackReference);
+        BackTrackInfoBackReference* backTrack = reinterpret_cast<BackTrackInfoBackReference*>(context->frame + term.frameLocation);
+
+        int matchBegin = output[(term.atom.subpatternId << 1)];
+        int matchEnd = output[(term.atom.subpatternId << 1) + 1];
+        ASSERT((matchBegin == -1) == (matchEnd == -1));
+        ASSERT(matchBegin <= matchEnd);
+
+        if (matchBegin == matchEnd)
+            return true;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            backTrack->begin = input.getPos();
+            for (unsigned matchAmount = 0; matchAmount < term.atom.quantityCount; ++matchAmount) {
+                if (!tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition)) {
+                    input.setPos(backTrack->begin);
+                    return false;
+                }
+            }
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            unsigned matchAmount = 0;
+            while ((matchAmount < term.atom.quantityCount) && tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition))
+                ++matchAmount;
+            backTrack->matchAmount = matchAmount;
+            return true;
+        }
+
+        case QuantifierNonGreedy:
+            backTrack->begin = input.getPos();
+            backTrack->matchAmount = 0;
+            return true;
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool backtrackBackReference(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeBackReference);
+        BackTrackInfoBackReference* backTrack = reinterpret_cast<BackTrackInfoBackReference*>(context->frame + term.frameLocation);
+
+        int matchBegin = output[(term.atom.subpatternId << 1)];
+        int matchEnd = output[(term.atom.subpatternId << 1) + 1];
+        ASSERT((matchBegin == -1) == (matchEnd == -1));
+        ASSERT(matchBegin <= matchEnd);
+
+        if (matchBegin == matchEnd)
+            return false;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            // for quantityCount == 1, could rewind.
+            input.setPos(backTrack->begin);
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.rewind(matchEnd - matchBegin);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition)) {
+                ++backTrack->matchAmount;
+                return true;
+            } else
+                input.setPos(backTrack->begin);
+            break;
+        }
+
+        return false;
+    }
+
+    void recordParenthesesMatch(ByteTerm& term, ParenthesesDisjunctionContext* context)
+    {
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = context->getDisjunctionContext(term)->matchBegin + term.inputPosition;
+            output[(subpatternId << 1) + 1] = context->getDisjunctionContext(term)->matchEnd + term.inputPosition;
+        }
+    }
+    void resetMatches(ByteTerm& term, ParenthesesDisjunctionContext* context)
+    {
+        unsigned firstSubpatternId = term.atom.subpatternId;
+        unsigned count = term.atom.parenthesesDisjunction->m_numSubpatterns;
+        context->restoreOutput(output, firstSubpatternId, count);
+    }
+    void resetAssertionMatches(ByteTerm& term)
+    {
+        unsigned firstSubpatternId = term.atom.subpatternId;
+        unsigned count = term.atom.parenthesesDisjunction->m_numSubpatterns;
+        for (unsigned i = 0; i < (count << 1); ++i)
+            output[(firstSubpatternId << 1) + i] = -1;
+    }
+    bool parenthesesDoBacktrack(ByteTerm& term, BackTrackInfoParentheses* backTrack)
+    {
+        while (backTrack->matchAmount) {
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+
+            if (matchDisjunction(term.atom.parenthesesDisjunction, context->getDisjunctionContext(term), true))
+                return true;
+            
+            resetMatches(term, context);
+            freeParenthesesDisjunctionContext(context);
+            popParenthesesDisjunctionContext(backTrack);
+        }
+
+        return false;
+    }
+
+    bool matchParenthesesOnceBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy: {
+            // set this speculatively; if we get to the parens end this will be true.
+            backTrack->inParentheses = 1;
+            break;
+        }
+        case QuantifierNonGreedy: {
+            backTrack->inParentheses = 0;
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        }
+        case QuantifierFixedCount:
+            break;
+        }
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = input.getPos() + term.inputPosition;
+        }
+
+        return true;
+    }
+
+    bool matchParenthesesOnceEnd(ByteTerm& term, DisjunctionContext*)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1) + 1] = input.getPos() + term.inputPosition;
+        }
+        return true;
+    }
+
+    bool backtrackParenthesesOnceBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = -1;
+            output[(subpatternId << 1) + 1] = -1;
+        }
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy:
+            // if we backtrack to this point, there is another chance - try matching nothing.
+            ASSERT(backTrack->inParentheses);
+            backTrack->inParentheses = 0;
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        case QuantifierNonGreedy:
+            ASSERT(backTrack->inParentheses);
+        case QuantifierFixedCount:
+            break;
+        }
+
+        return false;
+    }
+
+    bool backtrackParenthesesOnceEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy:
+            if (!backTrack->inParentheses) {
+                context->term -= term.atom.parenthesesWidth;
+                return false;
+            }
+        case QuantifierNonGreedy:
+            if (!backTrack->inParentheses) {
+                // now try to match the parens; set this speculatively.
+                backTrack->inParentheses = 1;
+                if (term.capture()) {
+                    unsigned subpatternId = term.atom.subpatternId;
+                    output[(subpatternId << 1) + 1] = input.getPos() + term.inputPosition;
+                }
+                context->term -= term.atom.parenthesesWidth;
+                return true;
+            }
+        case QuantifierFixedCount:
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchParentheticalAssertionBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        backTrack->begin = input.getPos();
+        return true;
+    }
+
+    bool matchParentheticalAssertionEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        input.setPos(backTrack->begin);
+
+        // We've reached the end of the parens; if they are inverted, this is failure.
+        if (term.invert()) {
+            context->term -= term.atom.parenthesesWidth;
+            return false;
+        }
+
+        return true;
+    }
+
+    bool backtrackParentheticalAssertionBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        // We've failed to match parens; if they are inverted, this is win!
+        if (term.invert()) {
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        }
+
+        return false;
+    }
+
+    bool backtrackParentheticalAssertionEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        input.setPos(backTrack->begin);
+
+        context->term -= term.atom.parenthesesWidth;
+        return false;
+    }
+
+    bool matchParentheses(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpattern);
+
+        BackTrackInfoParentheses* backTrack = reinterpret_cast<BackTrackInfoParentheses*>(context->frame + term.frameLocation);
+
+        unsigned subpatternId = term.atom.subpatternId;
+        ByteDisjunction* disjunctionBody = term.atom.parenthesesDisjunction;
+
+        backTrack->prevBegin = output[(subpatternId << 1)];
+        backTrack->prevEnd = output[(subpatternId << 1) + 1];
+
+        backTrack->matchAmount = 0;
+        backTrack->lastContext = 0;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            // While we haven't yet reached our fixed limit,
+            while (backTrack->matchAmount < term.atom.quantityCount) {
+                // Try to do a match, and it it succeeds, add it to the list.
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    // The match failed; try to find an alternate point to carry on from.
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                    if (!parenthesesDoBacktrack(term, backTrack))
+                        return false;
+                }
+            }
+
+            ASSERT(backTrack->matchAmount == term.atom.quantityCount);
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+            recordParenthesesMatch(term, context);
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            while (backTrack->matchAmount < term.atom.quantityCount) {
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                    break;
+                }
+            }
+
+            if (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                recordParenthesesMatch(term, context);
+            }
+            return true;
+        }
+
+        case QuantifierNonGreedy:
+            return true;
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    // Rules for backtracking differ depending on whether this is greedy or non-greedy.
+    //
+    // Greedy matches never should try just adding more - you should already have done
+    // the 'more' cases.  Always backtrack, at least a leetle bit.  However cases where
+    // you backtrack an item off the list needs checking, since we'll never have matched
+    // the one less case.  Tracking forwards, still add as much as possible.
+    //
+    // Non-greedy, we've already done the one less case, so don't match on popping.
+    // We haven't done the one more case, so always try to add that.
+    //
+    bool backtrackParentheses(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpattern);
+
+        BackTrackInfoParentheses* backTrack = reinterpret_cast<BackTrackInfoParentheses*>(context->frame + term.frameLocation);
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = backTrack->prevBegin;
+            output[(subpatternId << 1) + 1] = backTrack->prevEnd;
+        }
+
+        ByteDisjunction* disjunctionBody = term.atom.parenthesesDisjunction;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            ASSERT(backTrack->matchAmount == term.atom.quantityCount);
+
+            ParenthesesDisjunctionContext* context = 0;
+
+            if (!parenthesesDoBacktrack(term, backTrack))
+                return false;
+
+            // While we haven't yet reached our fixed limit,
+            while (backTrack->matchAmount < term.atom.quantityCount) {
+                // Try to do a match, and it it succeeds, add it to the list.
+                context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    // The match failed; try to find an alternate point to carry on from.
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                    if (!parenthesesDoBacktrack(term, backTrack))
+                        return false;
+                }
+            }
+
+            ASSERT(backTrack->matchAmount == term.atom.quantityCount);
+            context = backTrack->lastContext;
+            recordParenthesesMatch(term, context);
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            if (!backTrack->matchAmount)
+                return false;
+
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+            if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term), true)) {
+                while (backTrack->matchAmount < term.atom.quantityCount) {
+                    ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                    if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                        appendParenthesesDisjunctionContext(backTrack, context);
+                    else {
+                        resetMatches(term, context);
+                        freeParenthesesDisjunctionContext(context);
+                        break;
+                    }
+                }
+            } else {
+                resetMatches(term, context);
+                freeParenthesesDisjunctionContext(context);
+                popParenthesesDisjunctionContext(backTrack);
+            }
+
+            if (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                recordParenthesesMatch(term, context);
+            }
+            return true;
+        }
+
+        case QuantifierNonGreedy: {
+            // If we've not reached the limit, try to add one more match.
+            if (backTrack->matchAmount < term.atom.quantityCount) {
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term))) {
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                    recordParenthesesMatch(term, context);
+                    return true;
+                } else {
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                }
+            }
+
+            // Nope - okay backtrack looking for an alternative.
+            while (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term), true)) {
+                    // successful backtrack! we're back in the game!
+                    if (backTrack->matchAmount) {
+                        context = backTrack->lastContext;
+                        recordParenthesesMatch(term, context);
+                    }
+                    return true;
+                }
+                
+                // pop a match off the stack
+                resetMatches(term, context);
+                freeParenthesesDisjunctionContext(context);
+                popParenthesesDisjunctionContext(backTrack);
+            }
+
+            return false;
+        }
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+#define MATCH_NEXT() { ++context->term; goto matchAgain; }
+#define BACKTRACK() { --context->term; goto backtrack; }
+#define currentTerm() (disjunction->terms[context->term])
+    bool matchDisjunction(ByteDisjunction* disjunction, DisjunctionContext* context, bool btrack = false)
+    {
+        if (btrack)
+            BACKTRACK();
+
+        context->matchBegin = input.getPos();
+        context->term = 0;
+
+    matchAgain:
+        ASSERT(context->term < static_cast<int>(disjunction->terms.size()));
+
+        switch (currentTerm().type) {
+        case ByteTerm::TypeSubpatternBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeSubpatternEnd:
+            context->matchEnd = input.getPos();
+            return true;
+
+        case ByteTerm::TypeBodyAlternativeBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeBodyAlternativeDisjunction:
+        case ByteTerm::TypeBodyAlternativeEnd:
+            context->matchEnd = input.getPos();
+            return true;
+
+        case ByteTerm::TypeAlternativeBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeAlternativeDisjunction:
+        case ByteTerm::TypeAlternativeEnd: {
+            int offset = currentTerm().alternative.end;
+            BackTrackInfoAlternative* backTrack = reinterpret_cast<BackTrackInfoAlternative*>(context->frame + currentTerm().frameLocation);
+            backTrack->offset = offset;
+            context->term += offset;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypeAssertionBOL:
+            if (matchAssertionBOL(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeAssertionEOL:
+            if (matchAssertionEOL(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeAssertionWordBoundary:
+            if (matchAssertionWordBoundary(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+
+        case ByteTerm::TypePatternCharacterOnce:
+        case ByteTerm::TypePatternCharacterFixed: {
+            for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityCount; ++matchAmount) {
+                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition + matchAmount))
+                    BACKTRACK();
+            }
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCharacterGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            unsigned matchAmount = 0;
+            while ((matchAmount < currentTerm().atom.quantityCount) && input.checkInput(1)) {
+                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition - 1)) {
+                    input.uncheckInput(1);
+                    break;
+                }
+                ++matchAmount;
+            }
+            backTrack->matchAmount = matchAmount;
+
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCharacterNonGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            backTrack->matchAmount = 0;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypePatternCasedCharacterOnce:
+        case ByteTerm::TypePatternCasedCharacterFixed: {
+            for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityCount; ++matchAmount) {
+                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition + matchAmount))
+                    BACKTRACK();
+            }
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCasedCharacterGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            unsigned matchAmount = 0;
+            while ((matchAmount < currentTerm().atom.quantityCount) && input.checkInput(1)) {
+                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition - 1)) {
+                    input.uncheckInput(1);
+                    break;
+                }
+                ++matchAmount;
+            }
+            backTrack->matchAmount = matchAmount;
+
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCasedCharacterNonGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            backTrack->matchAmount = 0;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypeCharacterClass:
+            if (matchCharacterClass(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeBackReference:
+            if (matchBackReference(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpattern:
+            if (matchParentheses(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternOnceBegin:
+            if (matchParenthesesOnceBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternOnceEnd:
+            if (matchParenthesesOnceEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParentheticalAssertionBegin:
+            if (matchParentheticalAssertionBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParentheticalAssertionEnd:
+            if (matchParentheticalAssertionEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+
+        case ByteTerm::TypeCheckInput:
+            if (input.checkInput(currentTerm().checkInputCount))
+                MATCH_NEXT();
+            BACKTRACK();
+        }
+
+        // We should never fall-through to here.
+        ASSERT_NOT_REACHED();
+
+    backtrack:
+        ASSERT(context->term < static_cast<int>(disjunction->terms.size()));
+
+        switch (currentTerm().type) {
+        case ByteTerm::TypeSubpatternBegin:
+            return false;
+        case ByteTerm::TypeSubpatternEnd:
+            ASSERT_NOT_REACHED();
+
+        case ByteTerm::TypeBodyAlternativeBegin:
+        case ByteTerm::TypeBodyAlternativeDisjunction: {
+            int offset = currentTerm().alternative.next;
+            context->term += offset;
+            if (offset > 0)
+                MATCH_NEXT();
+
+            if (input.atEnd())
+                return false;
+
+            input.next();
+            context->matchBegin = input.getPos();
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypeBodyAlternativeEnd:
+            ASSERT_NOT_REACHED();
+
+            case ByteTerm::TypeAlternativeBegin:
+            case ByteTerm::TypeAlternativeDisjunction: {
+                int offset = currentTerm().alternative.next;
+                context->term += offset;
+                if (offset > 0)
+                    MATCH_NEXT();
+                BACKTRACK();
+            }
+            case ByteTerm::TypeAlternativeEnd: {
+                // We should never backtrack back into an alternative of the main body of the regex.
+                BackTrackInfoAlternative* backTrack = reinterpret_cast<BackTrackInfoAlternative*>(context->frame + currentTerm().frameLocation);
+                unsigned offset = backTrack->offset;
+                context->term -= offset;
+                BACKTRACK();
+            }
+
+            case ByteTerm::TypeAssertionBOL:
+            case ByteTerm::TypeAssertionEOL:
+            case ByteTerm::TypeAssertionWordBoundary:
+                BACKTRACK();
+
+            case ByteTerm::TypePatternCharacterOnce:
+            case ByteTerm::TypePatternCharacterFixed:
+            case ByteTerm::TypePatternCharacterGreedy:
+            case ByteTerm::TypePatternCharacterNonGreedy:
+                if (backtrackPatternCharacter(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypePatternCasedCharacterOnce:
+            case ByteTerm::TypePatternCasedCharacterFixed:
+            case ByteTerm::TypePatternCasedCharacterGreedy:
+            case ByteTerm::TypePatternCasedCharacterNonGreedy:
+                if (backtrackPatternCasedCharacter(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeCharacterClass:
+                if (backtrackCharacterClass(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeBackReference:
+                if (backtrackBackReference(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParenthesesSubpattern:
+                if (backtrackParentheses(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParenthesesSubpatternOnceBegin:
+                if (backtrackParenthesesOnceBegin(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParenthesesSubpatternOnceEnd:
+                if (backtrackParenthesesOnceEnd(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParentheticalAssertionBegin:
+                if (backtrackParentheticalAssertionBegin(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParentheticalAssertionEnd:
+                if (backtrackParentheticalAssertionEnd(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+
+            case ByteTerm::TypeCheckInput:
+                input.uncheckInput(currentTerm().checkInputCount);
+                BACKTRACK();
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool matchNonZeroDisjunction(ByteDisjunction* disjunction, DisjunctionContext* context, bool btrack = false)
+    {
+        if (matchDisjunction(disjunction, context, btrack)) {
+            while (context->matchBegin == context->matchEnd) {
+                if (!matchDisjunction(disjunction, context, true))
+                    return false;
+            }
+            return true;
+        }
+
+        return false;
+    }
+
+    int interpret()
+    {
+        for (unsigned i = 0; i < ((pattern->m_body->m_numSubpatterns + 1) << 1); ++i)
+            output[i] = -1;
+
+        DisjunctionContext* context = allocDisjunctionContext(pattern->m_body.get());
+
+        if (matchDisjunction(pattern->m_body.get(), context)) {
+            output[0] = context->matchBegin;
+            output[1] = context->matchEnd;
+        }
+
+        freeDisjunctionContext(context);
+
+        return output[0];
+    }
+
+    Interpreter(BytecodePattern* pattern, int* output, const UChar* inputChar, unsigned start, unsigned length)
+        : pattern(pattern)
+        , output(output)
+        , input(inputChar, start, length)
+    {
+    }
+
+private:
+    BytecodePattern *pattern;
+    int* output;
+    InputStream input;
+};
+
+
+
+class ByteCompiler {
+    struct ParenthesesStackEntry {
+        unsigned beginTerm;
+        unsigned savedAlternativeIndex;
+        ParenthesesStackEntry(unsigned beginTerm, unsigned savedAlternativeIndex/*, unsigned subpatternId, bool capture = false*/)
+            : beginTerm(beginTerm)
+            , savedAlternativeIndex(savedAlternativeIndex)
+        {
+        }
+    };
+
+public:
+    ByteCompiler(RegexPattern& pattern)
+        : m_pattern(pattern)
+    {
+        bodyDisjunction = 0;
+        currentAlternativeIndex = 0;
+    }
+    
+    BytecodePattern* compile()
+    {
+        regexBegin(m_pattern.m_numSubpatterns, m_pattern.m_body->m_callFrameSize);
+        emitDisjunction(m_pattern.m_body);
+        regexEnd();
+
+        return new BytecodePattern(bodyDisjunction, m_allParenthesesInfo, m_pattern);
+    }
+    
+    void checkInput(unsigned count)
+    {
+        bodyDisjunction->terms.append(ByteTerm::CheckInput(count));
+    }
+
+    void assertionBOL(int inputPosition)
+    {
+        bodyDisjunction->terms.append(ByteTerm::BOL(inputPosition));
+    }
+
+    void assertionEOL(int inputPosition)
+    {
+        bodyDisjunction->terms.append(ByteTerm::EOL(inputPosition));
+    }
+
+    void assertionWordBoundary(bool invert, int inputPosition)
+    {
+        bodyDisjunction->terms.append(ByteTerm::WordBoundary(invert, inputPosition));
+    }
+
+    void atomPatternCharacter(UChar ch, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+    {
+        if (m_pattern.m_ignoreCase) {
+            UChar lo = Unicode::toLower(ch);
+            UChar hi = Unicode::toUpper(ch);
+            
+            if (lo != hi) {
+                bodyDisjunction->terms.append(ByteTerm(lo, hi, inputPosition, frameLocation, quantityCount, quantityType));
+                return;
+            }
+        }
+
+        bodyDisjunction->terms.append(ByteTerm(ch, inputPosition, frameLocation, quantityCount, quantityType));
+    }
+    
+    void atomCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+    {
+        bodyDisjunction->terms.append(ByteTerm(characterClass, invert, inputPosition));
+
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+    }
+
+    void atomBackReference(unsigned subpatternId, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+    {
+        ASSERT(subpatternId);
+
+        bodyDisjunction->terms.append(ByteTerm::BackReference(subpatternId, inputPosition));
+
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+    }
+
+    void atomParenthesesSubpatternBegin(unsigned subpatternId, bool capture, int inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
+    {
+        int beginTerm = bodyDisjunction->terms.size();
+
+        bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternOnceBegin, subpatternId, capture, inputPosition));
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, currentAlternativeIndex));
+        currentAlternativeIndex = beginTerm + 1;
+    }
+
+    void atomParentheticalAssertionBegin(unsigned subpatternId, bool invert, unsigned frameLocation, unsigned alternativeFrameLocation)
+    {
+        int beginTerm = bodyDisjunction->terms.size();
+
+        bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParentheticalAssertionBegin, subpatternId, invert, 0));
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, currentAlternativeIndex));
+        currentAlternativeIndex = beginTerm + 1;
+    }
+
+    unsigned popParenthesesStack()
+    {
+        ASSERT(m_parenthesesStack.size());
+        int stackEnd = m_parenthesesStack.size() - 1;
+        unsigned beginTerm = m_parenthesesStack[stackEnd].beginTerm;
+        currentAlternativeIndex = m_parenthesesStack[stackEnd].savedAlternativeIndex;
+        m_parenthesesStack.shrink(stackEnd);
+
+        ASSERT(beginTerm < bodyDisjunction->terms.size());
+        ASSERT(currentAlternativeIndex < bodyDisjunction->terms.size());
+        
+        return beginTerm;
+    }
+
+#ifndef NDEBUG
+    void dumpDisjunction(ByteDisjunction* disjunction)
+    {
+        printf("ByteDisjunction(%p):\n\t", disjunction);
+        for (unsigned i = 0; i < disjunction->terms.size(); ++i)
+            printf("{ %d } ", disjunction->terms[i].type);
+        printf("\n");
+    }
+#endif
+
+    void closeAlternative(int beginTerm)
+    {
+        int origBeginTerm = beginTerm;
+        ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeBegin);
+        int endIndex = bodyDisjunction->terms.size();
+
+        unsigned frameLocation = bodyDisjunction->terms[beginTerm].frameLocation;
+
+        if (!bodyDisjunction->terms[beginTerm].alternative.next)
+            bodyDisjunction->terms.remove(beginTerm);
+        else {
+            while (bodyDisjunction->terms[beginTerm].alternative.next) {
+                beginTerm += bodyDisjunction->terms[beginTerm].alternative.next;
+                ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeDisjunction);
+                bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+                bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+            }
+            
+            bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+            bodyDisjunction->terms.append(ByteTerm::AlternativeEnd());
+            bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+        }
+    }
+
+    void closeBodyAlternative()
+    {
+        int beginTerm = 0;
+        int origBeginTerm = 0;
+        ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeBegin);
+        int endIndex = bodyDisjunction->terms.size();
+
+        unsigned frameLocation = bodyDisjunction->terms[beginTerm].frameLocation;
+
+        while (bodyDisjunction->terms[beginTerm].alternative.next) {
+            beginTerm += bodyDisjunction->terms[beginTerm].alternative.next;
+            ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeDisjunction);
+            bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+            bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+        }
+        
+        bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeEnd());
+        bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+    }
+
+    void atomParenthesesEnd(bool doInline, unsigned lastSubpatternId, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType, unsigned callFrameSize = 0)
+    {
+        unsigned beginTerm = popParenthesesStack();
+        closeAlternative(beginTerm + 1);
+        unsigned endTerm = bodyDisjunction->terms.size();
+
+        bool isAssertion = bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeParentheticalAssertionBegin;
+        bool invertOrCapture = bodyDisjunction->terms[beginTerm].invertOrCapture;
+        unsigned subpatternId = bodyDisjunction->terms[beginTerm].atom.subpatternId;
+
+        bodyDisjunction->terms.append(ByteTerm(isAssertion ? ByteTerm::TypeParentheticalAssertionEnd : ByteTerm::TypeParenthesesSubpatternOnceEnd, subpatternId, invertOrCapture, inputPosition));
+        bodyDisjunction->terms[beginTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        bodyDisjunction->terms[endTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        bodyDisjunction->terms[endTerm].frameLocation = frameLocation;
+
+        if (doInline) {
+            bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
+            bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+            bodyDisjunction->terms[endTerm].atom.quantityCount = quantityCount;
+            bodyDisjunction->terms[endTerm].atom.quantityType = quantityType;
+        } else {
+            ByteTerm& parenthesesBegin = bodyDisjunction->terms[beginTerm];
+            ASSERT(parenthesesBegin.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+
+            bool invertOrCapture = parenthesesBegin.invertOrCapture;
+            unsigned subpatternId = parenthesesBegin.atom.subpatternId;
+
+            unsigned numSubpatterns = lastSubpatternId - subpatternId + 1;
+            ByteDisjunction* parenthesesDisjunction = new ByteDisjunction(numSubpatterns, callFrameSize);
+
+            parenthesesDisjunction->terms.append(ByteTerm::SubpatternBegin());
+            for (unsigned termInParentheses = beginTerm + 1; termInParentheses < endTerm; ++termInParentheses)
+                parenthesesDisjunction->terms.append(bodyDisjunction->terms[termInParentheses]);
+            parenthesesDisjunction->terms.append(ByteTerm::SubpatternEnd());
+
+            bodyDisjunction->terms.shrink(beginTerm);
+
+            m_allParenthesesInfo.append(parenthesesDisjunction);
+            bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction, invertOrCapture, inputPosition));
+
+            bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
+            bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+            bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+        }
+    }
+
+    void regexBegin(unsigned numSubpatterns, unsigned callFrameSize)
+    {
+        bodyDisjunction = new ByteDisjunction(numSubpatterns, callFrameSize);
+        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeBegin());
+        bodyDisjunction->terms[0].frameLocation = 0;
+        currentAlternativeIndex = 0;
+    }
+
+    void regexEnd()
+    {
+        closeBodyAlternative();
+    }
+
+    void alterantiveBodyDisjunction()
+    {
+        int newAlternativeIndex = bodyDisjunction->terms.size();
+        bodyDisjunction->terms[currentAlternativeIndex].alternative.next = newAlternativeIndex - currentAlternativeIndex;
+        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeDisjunction());
+
+        currentAlternativeIndex = newAlternativeIndex;
+    }
+
+    void alterantiveDisjunction()
+    {
+        int newAlternativeIndex = bodyDisjunction->terms.size();
+        bodyDisjunction->terms[currentAlternativeIndex].alternative.next = newAlternativeIndex - currentAlternativeIndex;
+        bodyDisjunction->terms.append(ByteTerm::AlternativeDisjunction());
+
+        currentAlternativeIndex = newAlternativeIndex;
+    }
+
+    void emitDisjunction(PatternDisjunction* disjunction, unsigned inputCountAlreadyChecked = 0, unsigned parenthesesInputCountAlreadyChecked = 0)
+    {
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            unsigned currentCountAlreadyChecked = inputCountAlreadyChecked;
+        
+            if (alt) {
+                if (disjunction == m_pattern.m_body)
+                    alterantiveBodyDisjunction();
+                else
+                    alterantiveDisjunction();
+            }
+
+            PatternAlternative* alternative = disjunction->m_alternatives[alt];
+            unsigned minimumSize = alternative->m_minimumSize;
+
+            ASSERT(minimumSize >= parenthesesInputCountAlreadyChecked);
+            unsigned countToCheck = minimumSize - parenthesesInputCountAlreadyChecked;
+            if (countToCheck)
+                checkInput(countToCheck);
+            currentCountAlreadyChecked += countToCheck;
+
+            for (unsigned i = 0; i < alternative->m_terms.size(); ++i) {
+                PatternTerm& term = alternative->m_terms[i];
+
+                switch (term.type) {
+                case PatternTerm::TypeAssertionBOL:
+                    assertionBOL(term.inputPosition - currentCountAlreadyChecked);
+                    break;
+
+                case PatternTerm::TypeAssertionEOL:
+                    assertionEOL(term.inputPosition - currentCountAlreadyChecked);
+                    break;
+
+                case PatternTerm::TypeAssertionWordBoundary:
+                    assertionWordBoundary(term.invertOrCapture, term.inputPosition - currentCountAlreadyChecked);
+                    break;
+
+                case PatternTerm::TypePatternCharacter:
+                    atomPatternCharacter(term.patternCharacter, term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                    break;
+
+                case PatternTerm::TypeCharacterClass:
+                    atomCharacterClass(term.characterClass, term.invertOrCapture, term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                    break;
+
+                case PatternTerm::TypeBackReference:
+                    atomBackReference(term.subpatternId, term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                        break;
+
+                case PatternTerm::TypeForwardReference:
+                    break;
+
+                case PatternTerm::TypeParenthesesSubpattern: {
+                    unsigned disjunctionAlreadyCheckedCount = 0;
+                    if ((term.quantityCount == 1) && !term.parentheses.isCopy) {
+                        if (term.quantityType == QuantifierFixedCount) {
+                            disjunctionAlreadyCheckedCount = term.parentheses.disjunction->m_minimumSize;
+                            unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
+                            atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.invertOrCapture, delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, term.frameLocation);
+                            emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, term.parentheses.disjunction->m_minimumSize);
+                            atomParenthesesEnd(true, term.parentheses.lastSubpatternId, delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType, term.parentheses.disjunction->m_callFrameSize);
+                        } else {
+                            unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
+                            atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.invertOrCapture, delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, term.frameLocation + RegexStackSpaceForBackTrackInfoParenthesesOnce);
+                            emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
+                            atomParenthesesEnd(true, term.parentheses.lastSubpatternId, delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType, term.parentheses.disjunction->m_callFrameSize);
+                        }
+                    } else {
+                        unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
+                        atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.invertOrCapture, delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, 0);
+                        emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
+                        atomParenthesesEnd(false, term.parentheses.lastSubpatternId, delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType, term.parentheses.disjunction->m_callFrameSize);
+                    }
+                    break;
+                }
+
+                case PatternTerm::TypeParentheticalAssertion: {
+                    unsigned alternativeFrameLocation = term.inputPosition + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
+                    
+                    atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invertOrCapture, term.frameLocation, alternativeFrameLocation);
+                    emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
+                    atomParenthesesEnd(true, term.parentheses.lastSubpatternId, 0, term.frameLocation, term.quantityCount, term.quantityType);
+                    break;
+                }
+                }
+            }
+        }
+    }
+
+private:
+    RegexPattern& m_pattern;
+    ByteDisjunction* bodyDisjunction;
+    unsigned currentAlternativeIndex;
+    Vector<ParenthesesStackEntry> m_parenthesesStack;
+    Vector<ByteDisjunction*> m_allParenthesesInfo;
+};
+
+
+BytecodePattern* byteCompileRegex(const UString& patternString, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline)
+{
+    RegexPattern pattern(ignoreCase, multiline);
+
+    if ((error = compileRegex(patternString, pattern)))
+        return 0;
+
+    numSubpatterns = pattern.m_numSubpatterns;
+
+    return ByteCompiler(pattern).compile();
+}
+
+int interpretRegex(BytecodePattern* regex, const UChar* input, unsigned start, unsigned length, int* output)
+{
+    return Interpreter(regex, output, input, start, length).interpret();
+}
+
+
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoPatternCharacter) == (RegexStackSpaceForBackTrackInfoPatternCharacter * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoPatternCharacter);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoCharacterClass) == (RegexStackSpaceForBackTrackInfoCharacterClass * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoCharacterClass);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoBackReference) == (RegexStackSpaceForBackTrackInfoBackReference * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoBackReference);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoAlternative) == (RegexStackSpaceForBackTrackInfoAlternative * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoAlternative);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoParentheticalAssertion) == (RegexStackSpaceForBackTrackInfoParentheticalAssertion * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoParentheticalAssertion);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoParenthesesOnce) == (RegexStackSpaceForBackTrackInfoParenthesesOnce * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoParenthesesOnce);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoParentheses) == (RegexStackSpaceForBackTrackInfoParentheses * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoParentheses);
+
+
+} }
+
+#endif
diff --git a/JavaScriptCore/yarr/RegexInterpreter.h b/JavaScriptCore/yarr/RegexInterpreter.h
new file mode 100644
index 0000000..a8c122a
--- /dev/null
+++ b/JavaScriptCore/yarr/RegexInterpreter.h
@@ -0,0 +1,337 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexInterpreter_h
+#define RegexInterpreter_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR)
+
+#include <wtf/unicode/Unicode.h>
+#include "RegexParser.h"
+#include "RegexPattern.h"
+
+namespace JSC { namespace Yarr {
+
+class ByteDisjunction;
+
+struct ByteTerm {
+    enum Type {
+        TypeBodyAlternativeBegin,
+        TypeBodyAlternativeDisjunction,
+        TypeBodyAlternativeEnd,
+        TypeAlternativeBegin,
+        TypeAlternativeDisjunction,
+        TypeAlternativeEnd,
+        TypeSubpatternBegin,
+        TypeSubpatternEnd,
+        TypeAssertionBOL,
+        TypeAssertionEOL,
+        TypeAssertionWordBoundary,
+        TypePatternCharacterOnce,
+        TypePatternCharacterFixed,
+        TypePatternCharacterGreedy,
+        TypePatternCharacterNonGreedy,
+        TypePatternCasedCharacterOnce,
+        TypePatternCasedCharacterFixed,
+        TypePatternCasedCharacterGreedy,
+        TypePatternCasedCharacterNonGreedy,
+        TypeCharacterClass,
+        TypeBackReference,
+        TypeParenthesesSubpattern,
+        TypeParenthesesSubpatternOnceBegin,
+        TypeParenthesesSubpatternOnceEnd,
+        TypeParentheticalAssertionBegin,
+        TypeParentheticalAssertionEnd,
+        TypeCheckInput,
+    } type;
+    bool invertOrCapture;
+    union {
+        struct {
+            union {
+                UChar patternCharacter;
+                struct {
+                    UChar lo;
+                    UChar hi;
+                } casedCharacter;
+                CharacterClass* characterClass;
+                unsigned subpatternId;
+            };
+            union {
+                ByteDisjunction* parenthesesDisjunction;
+                unsigned parenthesesWidth;
+            };
+            QuantifierType quantityType;
+            unsigned quantityCount;
+        } atom;
+        struct {
+            int next;
+            int end;
+        } alternative;
+        unsigned checkInputCount;
+    };
+    unsigned frameLocation;
+    int inputPosition;
+
+    ByteTerm(UChar ch, int inputPos, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+        : frameLocation(frameLocation)
+    {
+        switch (quantityType) {
+        case QuantifierFixedCount:
+            type = (quantityCount == 1) ? ByteTerm::TypePatternCharacterOnce : ByteTerm::TypePatternCharacterFixed;
+            break;
+        case QuantifierGreedy:
+            type = ByteTerm::TypePatternCharacterGreedy;
+            break;
+        case QuantifierNonGreedy:
+            type = ByteTerm::TypePatternCharacterNonGreedy;
+            break;
+        }
+
+        atom.patternCharacter = ch;
+        atom.quantityType = quantityType;
+        atom.quantityCount = quantityCount;
+        inputPosition = inputPos;
+    }
+
+    ByteTerm(UChar lo, UChar hi, int inputPos, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+        : frameLocation(frameLocation)
+    {
+        switch (quantityType) {
+        case QuantifierFixedCount:
+            type = (quantityCount == 1) ? ByteTerm::TypePatternCasedCharacterOnce : ByteTerm::TypePatternCasedCharacterFixed;
+            break;
+        case QuantifierGreedy:
+            type = ByteTerm::TypePatternCasedCharacterGreedy;
+            break;
+        case QuantifierNonGreedy:
+            type = ByteTerm::TypePatternCasedCharacterNonGreedy;
+            break;
+        }
+
+        atom.casedCharacter.lo = lo;
+        atom.casedCharacter.hi = hi;
+        atom.quantityType = quantityType;
+        atom.quantityCount = quantityCount;
+        inputPosition = inputPos;
+    }
+
+    ByteTerm(CharacterClass* characterClass, bool invert, int inputPos)
+        : type(ByteTerm::TypeCharacterClass)
+        , invertOrCapture(invert)
+    {
+        atom.characterClass = characterClass;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+        inputPosition = inputPos;
+    }
+
+    ByteTerm(Type type, unsigned subpatternId, ByteDisjunction* parenthesesInfo, bool invertOrCapture, int inputPos)
+        : type(type)
+        , invertOrCapture(invertOrCapture)
+    {
+        atom.subpatternId = subpatternId;
+        atom.parenthesesDisjunction = parenthesesInfo;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+        inputPosition = inputPos;
+    }
+    
+    ByteTerm(Type type, bool invert = false)
+        : type(type)
+        , invertOrCapture(invert)
+    {
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+    }
+
+    ByteTerm(Type type, unsigned subpatternId, bool invertOrCapture, int inputPos)
+        : type(type)
+        , invertOrCapture(invertOrCapture)
+    {
+        atom.subpatternId = subpatternId;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+        inputPosition = inputPos;
+    }
+
+    static ByteTerm BOL(int inputPos)
+    {
+        ByteTerm term(TypeAssertionBOL);
+        term.inputPosition = inputPos;
+        return term;
+    }
+
+    static ByteTerm CheckInput(unsigned count)
+    {
+        ByteTerm term(TypeCheckInput);
+        term.checkInputCount = count;
+        return term;
+    }
+
+    static ByteTerm EOL(int inputPos)
+    {
+        ByteTerm term(TypeAssertionEOL);
+        term.inputPosition = inputPos;
+        return term;
+    }
+
+    static ByteTerm WordBoundary(bool invert, int inputPos)
+    {
+        ByteTerm term(TypeAssertionWordBoundary, invert);
+        term.inputPosition = inputPos;
+        return term;
+    }
+    
+    static ByteTerm BackReference(unsigned subpatternId, int inputPos)
+    {
+        return ByteTerm(TypeBackReference, subpatternId, false, inputPos);
+    }
+
+    static ByteTerm BodyAlternativeBegin()
+    {
+        ByteTerm term(TypeBodyAlternativeBegin);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm BodyAlternativeDisjunction()
+    {
+        ByteTerm term(TypeBodyAlternativeDisjunction);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm BodyAlternativeEnd()
+    {
+        ByteTerm term(TypeBodyAlternativeEnd);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm AlternativeBegin()
+    {
+        ByteTerm term(TypeAlternativeBegin);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm AlternativeDisjunction()
+    {
+        ByteTerm term(TypeAlternativeDisjunction);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm AlternativeEnd()
+    {
+        ByteTerm term(TypeAlternativeEnd);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm SubpatternBegin()
+    {
+        return ByteTerm(TypeSubpatternBegin);
+    }
+
+    static ByteTerm SubpatternEnd()
+    {
+        return ByteTerm(TypeSubpatternEnd);
+    }
+
+    bool invert()
+    {
+        return invertOrCapture;
+    }
+
+    bool capture()
+    {
+        return invertOrCapture;
+    }
+};
+
+class ByteDisjunction {
+public:
+    ByteDisjunction(unsigned numSubpatterns, unsigned frameSize)
+        : m_numSubpatterns(numSubpatterns)
+        , m_frameSize(frameSize)
+    {
+    }
+
+    Vector<ByteTerm> terms;
+    unsigned m_numSubpatterns;
+    unsigned m_frameSize;
+};
+
+struct BytecodePattern {
+    BytecodePattern(ByteDisjunction* body, Vector<ByteDisjunction*> allParenthesesInfo, RegexPattern& pattern)
+        : m_body(body)
+        , m_ignoreCase(pattern.m_ignoreCase)
+        , m_multiline(pattern.m_multiline)
+    {
+        newlineCharacterClass = pattern.newlineCharacterClass();
+        wordcharCharacterClass = pattern.wordcharCharacterClass();
+
+        m_allParenthesesInfo.append(allParenthesesInfo);
+        m_userCharacterClasses.append(pattern.m_userCharacterClasses);
+        // 'Steal' the RegexPattern's CharacterClasses!  We clear its
+        // array, so that it won't delete them on destruction.  We'll
+        // take responsibility for that.
+        pattern.m_userCharacterClasses.clear();
+    }
+
+    ~BytecodePattern()
+    {
+        deleteAllValues(m_allParenthesesInfo);
+        deleteAllValues(m_userCharacterClasses);
+    }
+
+    OwnPtr<ByteDisjunction> m_body;
+    bool m_ignoreCase;
+    bool m_multiline;
+    
+    CharacterClass* newlineCharacterClass;
+    CharacterClass* wordcharCharacterClass;
+private:
+    Vector<ByteDisjunction*> m_allParenthesesInfo;
+    Vector<CharacterClass*> m_userCharacterClasses;
+};
+
+BytecodePattern* byteCompileRegex(const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase = false, bool multiline = false);
+int interpretRegex(BytecodePattern* v_regex, const UChar* input, unsigned start, unsigned length, int* output);
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexInterpreter_h
diff --git a/JavaScriptCore/yarr/RegexJIT.cpp b/JavaScriptCore/yarr/RegexJIT.cpp
new file mode 100644
index 0000000..84b8254
--- /dev/null
+++ b/JavaScriptCore/yarr/RegexJIT.cpp
@@ -0,0 +1,1414 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegexJIT.h"
+
+#include "ASCIICType.h"
+#include "JSGlobalData.h"
+#include "MacroAssembler.h"
+#include "RegexCompiler.h"
+
+#include "pcre.h" // temporary, remove when fallback is removed.
+
+#if ENABLE(YARR_JIT)
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+
+class RegexGenerator : private MacroAssembler {
+    friend void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline);
+
+#if PLATFORM(ARM_V7)
+    static const RegisterID input = ARM::r0;
+    static const RegisterID index = ARM::r1;
+    static const RegisterID length = ARM::r2;
+
+    static const RegisterID output = ARM::r4;
+    static const RegisterID regT0 = ARM::r5;
+    static const RegisterID regT1 = ARM::r6;
+
+    static const RegisterID returnRegister = ARM::r0;
+#endif
+#if PLATFORM(X86)
+    static const RegisterID input = X86::eax;
+    static const RegisterID index = X86::edx;
+    static const RegisterID length = X86::ecx;
+    static const RegisterID output = X86::edi;
+
+    static const RegisterID regT0 = X86::ebx;
+    static const RegisterID regT1 = X86::esi;
+
+    static const RegisterID returnRegister = X86::eax;
+#endif
+#if PLATFORM(X86_64)
+    static const RegisterID input = X86::edi;
+    static const RegisterID index = X86::esi;
+    static const RegisterID length = X86::edx;
+    static const RegisterID output = X86::ecx;
+
+    static const RegisterID regT0 = X86::eax;
+    static const RegisterID regT1 = X86::ebx;
+
+    static const RegisterID returnRegister = X86::eax;
+#endif
+
+    void optimizeAlternative(PatternAlternative* alternative)
+    {
+        if (!alternative->m_terms.size())
+            return;
+
+        for (unsigned i = 0; i < alternative->m_terms.size() - 1; ++i) {
+            PatternTerm& term = alternative->m_terms[i];
+            PatternTerm& nextTerm = alternative->m_terms[i + 1];
+
+            if ((term.type == PatternTerm::TypeCharacterClass)
+                && (term.quantityType == QuantifierFixedCount)
+                && (nextTerm.type == PatternTerm::TypePatternCharacter)
+                && (nextTerm.quantityType == QuantifierFixedCount)) {
+                PatternTerm termCopy = term;
+                alternative->m_terms[i] = nextTerm;
+                alternative->m_terms[i + 1] = termCopy;
+            }
+        }
+    }
+
+    void matchCharacterClassRange(RegisterID character, JumpList& failures, JumpList& matchDest, const CharacterRange* ranges, unsigned count, unsigned* matchIndex, const UChar* matches, unsigned matchCount)
+    {
+        do {
+            // pick which range we're going to generate
+            int which = count >> 1;
+            char lo = ranges[which].begin;
+            char hi = ranges[which].end;
+            
+            // check if there are any ranges or matches below lo.  If not, just jl to failure -
+            // if there is anything else to check, check that first, if it falls through jmp to failure.
+            if ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
+                Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
+                
+                // generate code for all ranges before this one
+                if (which)
+                    matchCharacterClassRange(character, failures, matchDest, ranges, which, matchIndex, matches, matchCount);
+                
+                while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
+                    matchDest.append(branch32(Equal, character, Imm32((unsigned short)matches[*matchIndex])));
+                    ++*matchIndex;
+                }
+                failures.append(jump());
+
+                loOrAbove.link(this);
+            } else if (which) {
+                Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
+
+                matchCharacterClassRange(character, failures, matchDest, ranges, which, matchIndex, matches, matchCount);
+                failures.append(jump());
+
+                loOrAbove.link(this);
+            } else
+                failures.append(branch32(LessThan, character, Imm32((unsigned short)lo)));
+
+            while ((*matchIndex < matchCount) && (matches[*matchIndex] <= hi))
+                ++*matchIndex;
+
+            matchDest.append(branch32(LessThanOrEqual, character, Imm32((unsigned short)hi)));
+            // fall through to here, the value is above hi.
+
+            // shuffle along & loop around if there are any more matches to handle.
+            unsigned next = which + 1;
+            ranges += next;
+            count -= next;
+        } while (count);
+    }
+
+    void matchCharacterClass(RegisterID character, JumpList& matchDest, const CharacterClass* charClass)
+    {
+        Jump unicodeFail;
+        if (charClass->m_matchesUnicode.size() || charClass->m_rangesUnicode.size()) {
+            Jump isAscii = branch32(LessThanOrEqual, character, Imm32(0x7f));
+        
+            if (charClass->m_matchesUnicode.size()) {
+                for (unsigned i = 0; i < charClass->m_matchesUnicode.size(); ++i) {
+                    UChar ch = charClass->m_matchesUnicode[i];
+                    matchDest.append(branch32(Equal, character, Imm32(ch)));
+                }
+            }
+            
+            if (charClass->m_rangesUnicode.size()) {
+                for (unsigned i = 0; i < charClass->m_rangesUnicode.size(); ++i) {
+                    UChar lo = charClass->m_rangesUnicode[i].begin;
+                    UChar hi = charClass->m_rangesUnicode[i].end;
+                    
+                    Jump below = branch32(LessThan, character, Imm32(lo));
+                    matchDest.append(branch32(LessThanOrEqual, character, Imm32(hi)));
+                    below.link(this);
+                }
+            }
+
+            unicodeFail = jump();
+            isAscii.link(this);
+        }
+
+        if (charClass->m_ranges.size()) {
+            unsigned matchIndex = 0;
+            JumpList failures; 
+            matchCharacterClassRange(character, failures, matchDest, charClass->m_ranges.begin(), charClass->m_ranges.size(), &matchIndex, charClass->m_matches.begin(), charClass->m_matches.size());
+            while (matchIndex < charClass->m_matches.size())
+                matchDest.append(branch32(Equal, character, Imm32((unsigned short)charClass->m_matches[matchIndex++])));
+
+            failures.link(this);
+        } else if (charClass->m_matches.size()) {
+            // optimization: gather 'a','A' etc back together, can mask & test once.
+            Vector<char> matchesAZaz;
+
+            for (unsigned i = 0; i < charClass->m_matches.size(); ++i) {
+                char ch = charClass->m_matches[i];
+                if (m_pattern.m_ignoreCase) {
+                    if (isASCIILower(ch)) {
+                        matchesAZaz.append(ch);
+                        continue;
+                    }
+                    if (isASCIIUpper(ch))
+                        continue;
+                }
+                matchDest.append(branch32(Equal, character, Imm32((unsigned short)ch)));
+            }
+
+            if (unsigned countAZaz = matchesAZaz.size()) {
+                or32(Imm32(32), character);
+                for (unsigned i = 0; i < countAZaz; ++i)
+                    matchDest.append(branch32(Equal, character, Imm32(matchesAZaz[i])));
+            }
+        }
+
+        if (charClass->m_matchesUnicode.size() || charClass->m_rangesUnicode.size())
+            unicodeFail.link(this);
+    }
+
+    // Jumps if input not available; will have (incorrectly) incremented already!
+    Jump jumpIfNoAvailableInput(unsigned countToCheck)
+    {
+        add32(Imm32(countToCheck), index);
+        return branch32(Above, index, length);
+    }
+
+    Jump jumpIfAvailableInput(unsigned countToCheck)
+    {
+        add32(Imm32(countToCheck), index);
+        return branch32(BelowOrEqual, index, length);
+    }
+
+    Jump checkInput()
+    {
+        return branch32(BelowOrEqual, index, length);
+    }
+
+    Jump atEndOfInput()
+    {
+        return branch32(Equal, index, length);
+    }
+
+    Jump notAtEndOfInput()
+    {
+        return branch32(NotEqual, index, length);
+    }
+
+    Jump jumpIfCharEquals(UChar ch, int inputPosition)
+    {
+        return branch16(Equal, BaseIndex(input, index, TimesTwo, inputPosition * sizeof(UChar)), Imm32(ch));
+    }
+
+    Jump jumpIfCharNotEquals(UChar ch, int inputPosition)
+    {
+        return branch16(NotEqual, BaseIndex(input, index, TimesTwo, inputPosition * sizeof(UChar)), Imm32(ch));
+    }
+
+    void readCharacter(int inputPosition, RegisterID reg)
+    {
+        load16(BaseIndex(input, index, TimesTwo, inputPosition * sizeof(UChar)), reg);
+    }
+
+    void storeToFrame(RegisterID reg, unsigned frameLocation)
+    {
+        poke(reg, frameLocation);
+    }
+
+    void storeToFrame(Imm32 imm, unsigned frameLocation)
+    {
+        poke(imm, frameLocation);
+    }
+
+    DataLabelPtr storeToFrameWithPatch(unsigned frameLocation)
+    {
+        return storePtrWithPatch(ImmPtr(0), Address(stackPointerRegister, frameLocation * sizeof(void*)));
+    }
+
+    void loadFromFrame(unsigned frameLocation, RegisterID reg)
+    {
+        peek(reg, frameLocation);
+    }
+
+    void loadFromFrameAndJump(unsigned frameLocation)
+    {
+        jump(Address(stackPointerRegister, frameLocation * sizeof(void*)));
+    }
+
+    struct AlternativeBacktrackRecord {
+        DataLabelPtr dataLabel;
+        Label backtrackLocation;
+
+        AlternativeBacktrackRecord(DataLabelPtr dataLabel, Label backtrackLocation)
+            : dataLabel(dataLabel)
+            , backtrackLocation(backtrackLocation)
+        {
+        }
+    };
+
+    struct TermGenerationState {
+        TermGenerationState(PatternDisjunction* disjunction, unsigned checkedTotal)
+            : disjunction(disjunction)
+            , checkedTotal(checkedTotal)
+        {
+        }
+
+        void resetAlternative()
+        {
+            isBackTrackGenerated = false;
+            alt = 0;
+        }
+        bool alternativeValid()
+        {
+            return alt < disjunction->m_alternatives.size();
+        }
+        void nextAlternative()
+        {
+            ++alt;
+        }
+        PatternAlternative* alternative()
+        {
+            return disjunction->m_alternatives[alt];
+        }
+
+        void resetTerm()
+        {
+            ASSERT(alternativeValid());
+            t = 0;
+        }
+        bool termValid()
+        {
+            ASSERT(alternativeValid());
+            return t < alternative()->m_terms.size();
+        }
+        void nextTerm()
+        {
+            ASSERT(alternativeValid());
+            ++t;
+        }
+        PatternTerm& term()
+        {
+            ASSERT(alternativeValid());
+            return alternative()->m_terms[t];
+        }
+
+        PatternTerm& lookaheadTerm()
+        {
+            ASSERT(alternativeValid());
+            ASSERT((t + 1) < alternative()->m_terms.size());
+            return alternative()->m_terms[t + 1];
+        }
+        bool isSinglePatternCharacterLookaheadTerm()
+        {
+            ASSERT(alternativeValid());
+            return ((t + 1) < alternative()->m_terms.size())
+                && (lookaheadTerm().type == PatternTerm::TypePatternCharacter)
+                && (lookaheadTerm().quantityType == QuantifierFixedCount)
+                && (lookaheadTerm().quantityCount == 1);
+        }
+
+        int inputOffset()
+        {
+            return term().inputPosition - checkedTotal;
+        }
+
+        void jumpToBacktrack(Jump jump, MacroAssembler* masm)
+        {
+            if (isBackTrackGenerated)
+                jump.linkTo(backtrackLabel, masm);
+            else
+                backTrackJumps.append(jump);
+        }
+        void jumpToBacktrack(JumpList& jumps, MacroAssembler* masm)
+        {
+            if (isBackTrackGenerated)
+                jumps.linkTo(backtrackLabel, masm);
+            else
+                backTrackJumps.append(jumps);
+        }
+        bool plantJumpToBacktrackIfExists(MacroAssembler* masm)
+        {
+            if (isBackTrackGenerated) {
+                masm->jump(backtrackLabel);
+                return true;
+            }
+            return false;
+        }
+        void addBacktrackJump(Jump jump)
+        {
+            backTrackJumps.append(jump);
+        }
+        void setBacktrackGenerated(Label label)
+        {
+            isBackTrackGenerated = true;
+            backtrackLabel = label;
+        }
+        void linkAlternativeBacktracks(MacroAssembler* masm)
+        {
+            isBackTrackGenerated = false;
+            backTrackJumps.link(masm);
+        }
+        void linkAlternativeBacktracksTo(Label label, MacroAssembler* masm)
+        {
+            isBackTrackGenerated = false;
+            backTrackJumps.linkTo(label, masm);
+        }
+        void propagateBacktrackingFrom(TermGenerationState& nestedParenthesesState, MacroAssembler* masm)
+        {
+            jumpToBacktrack(nestedParenthesesState.backTrackJumps, masm);
+            if (nestedParenthesesState.isBackTrackGenerated)
+                setBacktrackGenerated(nestedParenthesesState.backtrackLabel);
+        }
+
+        PatternDisjunction* disjunction;
+        int checkedTotal;
+    private:
+        unsigned alt;
+        unsigned t;
+        JumpList backTrackJumps;
+        Label backtrackLabel;
+        bool isBackTrackGenerated;
+    };
+
+    void generateAssertionBOL(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+
+        if (m_pattern.m_multiline) {
+            const RegisterID character = regT0;
+
+            JumpList matchDest;
+            if (!term.inputPosition)
+                matchDest.append(branch32(Equal, index, Imm32(state.checkedTotal)));
+
+            readCharacter(state.inputOffset() - 1, character);
+            matchCharacterClass(character, matchDest, m_pattern.newlineCharacterClass());
+            state.jumpToBacktrack(jump(), this);
+
+            matchDest.link(this);
+        } else {
+            // Erk, really should poison out these alternatives early. :-/
+            if (term.inputPosition)
+                state.jumpToBacktrack(jump(), this);
+            else
+                state.jumpToBacktrack(branch32(NotEqual, index, Imm32(state.checkedTotal)), this);
+        }
+    }
+
+    void generateAssertionEOL(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+
+        if (m_pattern.m_multiline) {
+            const RegisterID character = regT0;
+
+            JumpList matchDest;
+            if (term.inputPosition == state.checkedTotal)
+                matchDest.append(atEndOfInput());
+
+            readCharacter(state.inputOffset(), character);
+            matchCharacterClass(character, matchDest, m_pattern.newlineCharacterClass());
+            state.jumpToBacktrack(jump(), this);
+
+            matchDest.link(this);
+        } else {
+            if (term.inputPosition == state.checkedTotal)
+                state.jumpToBacktrack(notAtEndOfInput(), this);
+            // Erk, really should poison out these alternatives early. :-/
+            else
+                state.jumpToBacktrack(jump(), this);
+        }
+    }
+
+    // Also falls though on nextIsNotWordChar.
+    void matchAssertionWordchar(TermGenerationState& state, JumpList& nextIsWordChar, JumpList& nextIsNotWordChar)
+    {
+        const RegisterID character = regT0;
+        PatternTerm& term = state.term();
+
+        if (term.inputPosition == state.checkedTotal)
+            nextIsNotWordChar.append(atEndOfInput());
+
+        readCharacter(state.inputOffset(), character);
+        matchCharacterClass(character, nextIsWordChar, m_pattern.wordcharCharacterClass());
+    }
+
+    void generateAssertionWordBoundary(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        PatternTerm& term = state.term();
+
+        Jump atBegin;
+        JumpList matchDest;
+        if (!term.inputPosition)
+            atBegin = branch32(Equal, index, Imm32(state.checkedTotal));
+        readCharacter(state.inputOffset() - 1, character);
+        matchCharacterClass(character, matchDest, m_pattern.wordcharCharacterClass());
+        if (!term.inputPosition)
+            atBegin.link(this);
+
+        // We fall through to here if the last character was not a wordchar.
+        JumpList nonWordCharThenWordChar;
+        JumpList nonWordCharThenNonWordChar;
+        if (term.invertOrCapture) {
+            matchAssertionWordchar(state, nonWordCharThenNonWordChar, nonWordCharThenWordChar);
+            nonWordCharThenWordChar.append(jump());
+        } else {
+            matchAssertionWordchar(state, nonWordCharThenWordChar, nonWordCharThenNonWordChar);
+            nonWordCharThenNonWordChar.append(jump());
+        }
+        state.jumpToBacktrack(nonWordCharThenNonWordChar, this);
+
+        // We jump here if the last character was a wordchar.
+        matchDest.link(this);
+        JumpList wordCharThenWordChar;
+        JumpList wordCharThenNonWordChar;
+        if (term.invertOrCapture) {
+            matchAssertionWordchar(state, wordCharThenNonWordChar, wordCharThenWordChar);
+            wordCharThenWordChar.append(jump());
+        } else {
+            matchAssertionWordchar(state, wordCharThenWordChar, wordCharThenNonWordChar);
+            // This can fall-though!
+        }
+
+        state.jumpToBacktrack(wordCharThenWordChar, this);
+        
+        nonWordCharThenWordChar.link(this);
+        wordCharThenNonWordChar.link(this);
+    }
+
+    void generatePatternCharacterSingle(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        UChar ch = state.term().patternCharacter;
+
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            readCharacter(state.inputOffset(), character);
+            or32(Imm32(32), character);
+            state.jumpToBacktrack(branch32(NotEqual, character, Imm32(Unicode::toLower(ch))), this);
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            state.jumpToBacktrack(jumpIfCharNotEquals(ch, state.inputOffset()), this);
+        }
+    }
+
+    void generatePatternCharacterPair(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        UChar ch1 = state.term().patternCharacter;
+        UChar ch2 = state.lookaheadTerm().patternCharacter;
+
+        int mask = 0;
+        int chPair = ch1 | (ch2 << 16);
+        
+        if (m_pattern.m_ignoreCase) {
+            if (isASCIIAlpha(ch1))
+                mask |= 32;
+            if (isASCIIAlpha(ch2))
+                mask |= 32 << 16;
+        }
+
+        if (mask) {
+            load32(BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), character);
+            or32(Imm32(mask), character);
+            state.jumpToBacktrack(branch32(NotEqual, character, Imm32(chPair | mask)), this);
+        } else
+            state.jumpToBacktrack(branch32(NotEqual, BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), Imm32(chPair)), this);
+    }
+
+    void generatePatternCharacterFixed(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+        UChar ch = term.patternCharacter;
+
+        move(index, countRegister);
+        sub32(Imm32(term.quantityCount), countRegister);
+
+        Label loop(this);
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            load16(BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), character);
+            or32(Imm32(32), character);
+            state.jumpToBacktrack(branch32(NotEqual, character, Imm32(Unicode::toLower(ch))), this);
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            state.jumpToBacktrack(branch16(NotEqual, BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), Imm32(ch)), this);
+        }
+        add32(Imm32(1), countRegister);
+        branch32(NotEqual, countRegister, index).linkTo(loop, this);
+    }
+
+    void generatePatternCharacterGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+        UChar ch = term.patternCharacter;
+    
+        move(Imm32(0), countRegister);
+
+        JumpList failures;
+        Label loop(this);
+        failures.append(atEndOfInput());
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            readCharacter(state.inputOffset(), character);
+            or32(Imm32(32), character);
+            failures.append(branch32(NotEqual, character, Imm32(Unicode::toLower(ch))));
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            failures.append(jumpIfCharNotEquals(ch, state.inputOffset()));
+        }
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+        branch32(NotEqual, countRegister, Imm32(term.quantityCount)).linkTo(loop, this);
+        failures.append(jump());
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+        state.jumpToBacktrack(branchTest32(Zero, countRegister), this);
+        sub32(Imm32(1), countRegister);
+        sub32(Imm32(1), index);
+
+        failures.link(this);
+
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generatePatternCharacterNonGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+        UChar ch = term.patternCharacter;
+    
+        move(Imm32(0), countRegister);
+
+        Jump firstTimeDoNothing = jump();
+
+        Label hardFail(this);
+        sub32(countRegister, index);
+        state.jumpToBacktrack(jump(), this);
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+
+        atEndOfInput().linkTo(hardFail, this);
+        branch32(Equal, countRegister, Imm32(term.quantityCount), hardFail);
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            readCharacter(state.inputOffset(), character);
+            or32(Imm32(32), character);
+            branch32(NotEqual, character, Imm32(Unicode::toLower(ch))).linkTo(hardFail, this);
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            jumpIfCharNotEquals(ch, state.inputOffset()).linkTo(hardFail, this);
+        }
+
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+
+        firstTimeDoNothing.link(this);
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generateCharacterClassSingle(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        PatternTerm& term = state.term();
+
+        JumpList matchDest;
+        readCharacter(state.inputOffset(), character);
+        matchCharacterClass(character, matchDest, term.characterClass);
+
+        if (term.invertOrCapture)
+            state.jumpToBacktrack(matchDest, this);
+        else {
+            state.jumpToBacktrack(jump(), this);
+            matchDest.link(this);
+        }
+    }
+
+    void generateCharacterClassFixed(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+
+        move(index, countRegister);
+        sub32(Imm32(term.quantityCount), countRegister);
+
+        Label loop(this);
+        JumpList matchDest;
+        load16(BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), character);
+        matchCharacterClass(character, matchDest, term.characterClass);
+
+        if (term.invertOrCapture)
+            state.jumpToBacktrack(matchDest, this);
+        else {
+            state.jumpToBacktrack(jump(), this);
+            matchDest.link(this);
+        }
+
+        add32(Imm32(1), countRegister);
+        branch32(NotEqual, countRegister, index).linkTo(loop, this);
+    }
+
+    void generateCharacterClassGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+    
+        move(Imm32(0), countRegister);
+
+        JumpList failures;
+        Label loop(this);
+        failures.append(atEndOfInput());
+
+        if (term.invertOrCapture) {
+            readCharacter(state.inputOffset(), character);
+            matchCharacterClass(character, failures, term.characterClass);
+        } else {
+            JumpList matchDest;
+            readCharacter(state.inputOffset(), character);
+            matchCharacterClass(character, matchDest, term.characterClass);
+            failures.append(jump());
+            matchDest.link(this);
+        }
+
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+        branch32(NotEqual, countRegister, Imm32(term.quantityCount)).linkTo(loop, this);
+        failures.append(jump());
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+        state.jumpToBacktrack(branchTest32(Zero, countRegister), this);
+        sub32(Imm32(1), countRegister);
+        sub32(Imm32(1), index);
+
+        failures.link(this);
+
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generateCharacterClassNonGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+    
+        move(Imm32(0), countRegister);
+
+        Jump firstTimeDoNothing = jump();
+
+        Label hardFail(this);
+        sub32(countRegister, index);
+        state.jumpToBacktrack(jump(), this);
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+
+        atEndOfInput().linkTo(hardFail, this);
+        branch32(Equal, countRegister, Imm32(term.quantityCount), hardFail);
+
+        JumpList matchDest;
+        readCharacter(state.inputOffset(), character);
+        matchCharacterClass(character, matchDest, term.characterClass);
+
+        if (term.invertOrCapture)
+            matchDest.linkTo(hardFail, this);
+        else {
+            jump(hardFail);
+            matchDest.link(this);
+        }
+
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+
+        firstTimeDoNothing.link(this);
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generateParenthesesDisjunction(PatternTerm& parenthesesTerm, TermGenerationState& state, unsigned alternativeFrameLocation)
+    {
+        ASSERT((parenthesesTerm.type == PatternTerm::TypeParenthesesSubpattern) || (parenthesesTerm.type == PatternTerm::TypeParentheticalAssertion));
+        ASSERT(parenthesesTerm.quantityCount == 1);
+    
+        PatternDisjunction* disjunction = parenthesesTerm.parentheses.disjunction;
+        unsigned preCheckedCount = ((parenthesesTerm.quantityType == QuantifierFixedCount) && (parenthesesTerm.type != PatternTerm::TypeParentheticalAssertion)) ? disjunction->m_minimumSize : 0;
+
+        if (disjunction->m_alternatives.size() == 1) {
+            state.resetAlternative();
+            ASSERT(state.alternativeValid());
+            PatternAlternative* alternative = state.alternative();
+            optimizeAlternative(alternative);
+
+            int countToCheck = alternative->m_minimumSize - preCheckedCount;
+            if (countToCheck) {
+                ASSERT((parenthesesTerm.type == PatternTerm::TypeParentheticalAssertion) || (parenthesesTerm.quantityType != QuantifierFixedCount));
+
+                // FIXME: This is quite horrible.  The call to 'plantJumpToBacktrackIfExists'
+                // will be forced to always trampoline into here, just to decrement the index.
+                // Ick. 
+                Jump skip = jump();
+
+                Label backtrackBegin(this);
+                sub32(Imm32(countToCheck), index);
+                state.addBacktrackJump(jump());
+                
+                skip.link(this);
+
+                state.setBacktrackGenerated(backtrackBegin);
+
+                state.jumpToBacktrack(jumpIfNoAvailableInput(countToCheck), this);
+                state.checkedTotal += countToCheck;
+            }
+
+            for (state.resetTerm(); state.termValid(); state.nextTerm())
+                generateTerm(state);
+
+            state.checkedTotal -= countToCheck;
+        } else {
+            JumpList successes;
+
+            for (state.resetAlternative(); state.alternativeValid(); state.nextAlternative()) {
+
+                PatternAlternative* alternative = state.alternative();
+                optimizeAlternative(alternative);
+
+                ASSERT(alternative->m_minimumSize >= preCheckedCount);
+                int countToCheck = alternative->m_minimumSize - preCheckedCount;
+                if (countToCheck) {
+                    state.addBacktrackJump(jumpIfNoAvailableInput(countToCheck));
+                    state.checkedTotal += countToCheck;
+                }
+
+                for (state.resetTerm(); state.termValid(); state.nextTerm())
+                    generateTerm(state);
+
+                // Matched an alternative.
+                DataLabelPtr dataLabel = storeToFrameWithPatch(alternativeFrameLocation);
+                successes.append(jump());
+
+                // Alternative did not match.
+                Label backtrackLocation(this);
+                
+                // Can we backtrack the alternative? - if so, do so.  If not, just fall through to the next one.
+                state.plantJumpToBacktrackIfExists(this);
+                
+                state.linkAlternativeBacktracks(this);
+
+                if (countToCheck) {
+                    sub32(Imm32(countToCheck), index);
+                    state.checkedTotal -= countToCheck;
+                }
+
+                m_backtrackRecords.append(AlternativeBacktrackRecord(dataLabel, backtrackLocation));
+            }
+            // We fall through to here when the last alternative fails.
+            // Add a backtrack out of here for the parenthese handling code to link up.
+            state.addBacktrackJump(jump());
+
+            // Generate a trampoline for the parens code to backtrack to, to retry the
+            // next alternative.
+            state.setBacktrackGenerated(label());
+            loadFromFrameAndJump(alternativeFrameLocation);
+
+            // FIXME: both of the above hooks are a little inefficient, in that you
+            // may end up trampolining here, just to trampoline back out to the
+            // parentheses code, or vice versa.  We can probably eliminate a jump
+            // by restructuring, but coding this way for now for simplicity during
+            // development.
+
+            successes.link(this);
+        }
+    }
+
+    void generateParenthesesSingle(TermGenerationState& state)
+    {
+        const RegisterID indexTemporary = regT0;
+        PatternTerm& term = state.term();
+        PatternDisjunction* disjunction = term.parentheses.disjunction;
+        ASSERT(term.quantityCount == 1);
+
+        unsigned preCheckedCount = ((term.quantityCount == 1) && (term.quantityType == QuantifierFixedCount)) ? disjunction->m_minimumSize : 0;
+
+        unsigned parenthesesFrameLocation = term.frameLocation;
+        unsigned alternativeFrameLocation = parenthesesFrameLocation;
+        if (term.quantityType != QuantifierFixedCount)
+            alternativeFrameLocation += RegexStackSpaceForBackTrackInfoParenthesesOnce;
+
+        // optimized case - no capture & no quantifier can be handled in a light-weight manner.
+        if (!term.invertOrCapture && (term.quantityType == QuantifierFixedCount)) {
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+            // this expects that any backtracks back out of the parentheses will be in the
+            // parenthesesState's backTrackJumps vector, and that if they need backtracking
+            // they will have set an entry point on the parenthesesState's backtrackLabel.
+            state.propagateBacktrackingFrom(parenthesesState, this);
+        } else {
+            Jump nonGreedySkipParentheses;
+            Label nonGreedyTryParentheses;
+            if (term.quantityType == QuantifierGreedy)
+                storeToFrame(Imm32(1), parenthesesFrameLocation);
+            else if (term.quantityType == QuantifierNonGreedy) {
+                storeToFrame(Imm32(0), parenthesesFrameLocation);
+                nonGreedySkipParentheses = jump();
+                nonGreedyTryParentheses = label();
+                storeToFrame(Imm32(1), parenthesesFrameLocation);
+            }
+
+            // store the match start index
+            if (term.invertOrCapture) {
+                int inputOffset = state.inputOffset() - preCheckedCount;
+                if (inputOffset) {
+                    move(index, indexTemporary);
+                    add32(Imm32(inputOffset), indexTemporary);
+                    store32(indexTemporary, Address(output, (term.parentheses.subpatternId << 1) * sizeof(int)));
+                } else
+                    store32(index, Address(output, (term.parentheses.subpatternId << 1) * sizeof(int)));
+            }
+
+            // generate the body of the parentheses
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+
+            // store the match end index
+            if (term.invertOrCapture) {
+                int inputOffset = state.inputOffset();
+                if (inputOffset) {
+                    move(index, indexTemporary);
+                    add32(Imm32(state.inputOffset()), indexTemporary);
+                    store32(indexTemporary, Address(output, ((term.parentheses.subpatternId << 1) + 1) * sizeof(int)));
+                } else
+                    store32(index, Address(output, ((term.parentheses.subpatternId << 1) + 1) * sizeof(int)));
+            }
+            Jump success = jump();
+
+            // A failure AFTER the parens jumps here
+            Label backtrackFromAfterParens(this);
+
+            if (term.quantityType == QuantifierGreedy) {
+                // If this is zero we have now tested with both with and without the parens.
+                loadFromFrame(parenthesesFrameLocation, indexTemporary);
+                state.jumpToBacktrack(branchTest32(Zero, indexTemporary), this);
+            } else if (term.quantityType == QuantifierNonGreedy) {
+                // If this is zero we have now tested with both with and without the parens.
+                loadFromFrame(parenthesesFrameLocation, indexTemporary);
+                branchTest32(Zero, indexTemporary).linkTo(nonGreedyTryParentheses, this);
+            }
+
+            parenthesesState.plantJumpToBacktrackIfExists(this);
+            // A failure WITHIN the parens jumps here
+            parenthesesState.linkAlternativeBacktracks(this);
+            if (term.invertOrCapture) {
+                store32(Imm32(-1), Address(output, (term.parentheses.subpatternId << 1) * sizeof(int)));
+                store32(Imm32(-1), Address(output, ((term.parentheses.subpatternId << 1) + 1) * sizeof(int)));
+            }
+
+            if (term.quantityType == QuantifierGreedy)
+                storeToFrame(Imm32(0), parenthesesFrameLocation);
+            else
+                state.jumpToBacktrack(jump(), this);
+
+            state.setBacktrackGenerated(backtrackFromAfterParens);
+            if (term.quantityType == QuantifierNonGreedy)
+                nonGreedySkipParentheses.link(this);
+            success.link(this);
+        }
+    }
+
+    void generateParentheticalAssertion(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+        PatternDisjunction* disjunction = term.parentheses.disjunction;
+        ASSERT(term.quantityCount == 1);
+        ASSERT(term.quantityType == QuantifierFixedCount);
+
+        unsigned parenthesesFrameLocation = term.frameLocation;
+        unsigned alternativeFrameLocation = parenthesesFrameLocation + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
+
+        int countCheckedAfterAssertion = state.checkedTotal - term.inputPosition;
+
+        if (term.invertOrCapture) {
+            // Inverted case
+            storeToFrame(index, parenthesesFrameLocation);
+
+            state.checkedTotal -= countCheckedAfterAssertion;
+            if (countCheckedAfterAssertion)
+                sub32(Imm32(countCheckedAfterAssertion), index);
+
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+            // Success! - which means - Fail!
+            loadFromFrame(parenthesesFrameLocation, index);
+            state.jumpToBacktrack(jump(), this);
+
+            // And fail means success.
+            parenthesesState.linkAlternativeBacktracks(this);
+            loadFromFrame(parenthesesFrameLocation, index);
+
+            state.checkedTotal += countCheckedAfterAssertion;
+        } else {
+            // Normal case
+            storeToFrame(index, parenthesesFrameLocation);
+
+            state.checkedTotal -= countCheckedAfterAssertion;
+            if (countCheckedAfterAssertion)
+                sub32(Imm32(countCheckedAfterAssertion), index);
+
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+            // Success! - which means - Success!
+            loadFromFrame(parenthesesFrameLocation, index);
+            Jump success = jump();
+
+            parenthesesState.linkAlternativeBacktracks(this);
+            loadFromFrame(parenthesesFrameLocation, index);
+            state.jumpToBacktrack(jump(), this);
+
+            success.link(this);
+
+            state.checkedTotal += countCheckedAfterAssertion;
+        }
+    }
+
+    void generateTerm(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+
+        switch (term.type) {
+        case PatternTerm::TypeAssertionBOL:
+            generateAssertionBOL(state);
+            break;
+        
+        case PatternTerm::TypeAssertionEOL:
+            generateAssertionEOL(state);
+            break;
+        
+        case PatternTerm::TypeAssertionWordBoundary:
+            generateAssertionWordBoundary(state);
+            break;
+        
+        case PatternTerm::TypePatternCharacter:
+            switch (term.quantityType) {
+            case QuantifierFixedCount:
+                if (term.quantityCount == 1) {
+                    if (state.isSinglePatternCharacterLookaheadTerm() && (state.lookaheadTerm().inputPosition == (term.inputPosition + 1))) {
+                        generatePatternCharacterPair(state);
+                        state.nextTerm();
+                    } else
+                        generatePatternCharacterSingle(state);
+                } else
+                    generatePatternCharacterFixed(state);
+                break;
+            case QuantifierGreedy:
+                generatePatternCharacterGreedy(state);
+                break;
+            case QuantifierNonGreedy:
+                generatePatternCharacterNonGreedy(state);
+                break;
+            }
+            break;
+
+        case PatternTerm::TypeCharacterClass:
+            switch (term.quantityType) {
+            case QuantifierFixedCount:
+                if (term.quantityCount == 1)
+                    generateCharacterClassSingle(state);
+                else
+                    generateCharacterClassFixed(state);
+                break;
+            case QuantifierGreedy:
+                generateCharacterClassGreedy(state);
+                break;
+            case QuantifierNonGreedy:
+                generateCharacterClassNonGreedy(state);
+                break;
+            }
+            break;
+
+        case PatternTerm::TypeBackReference:
+            m_generationFailed = true;
+            break;
+
+        case PatternTerm::TypeForwardReference:
+            break;
+
+        case PatternTerm::TypeParenthesesSubpattern:
+            if ((term.quantityCount == 1) && !term.parentheses.isCopy)
+                generateParenthesesSingle(state);
+            else
+                m_generationFailed = true;
+            break;
+
+        case PatternTerm::TypeParentheticalAssertion:
+            generateParentheticalAssertion(state);
+            break;
+        }
+    }
+
+    void generateDisjunction(PatternDisjunction* disjunction)
+    {
+        TermGenerationState state(disjunction, 0);
+        state.resetAlternative();
+
+        // Plant a check to see if there is sufficient input available to run the first alternative.
+        // Jumping back to the label 'firstAlternative' will get to this check, jumping to
+        // 'firstAlternativeInputChecked' will jump directly to matching the alternative having
+        // skipped this check.
+
+        Label firstAlternative(this);
+
+        // check availability for the next alternative
+        int countCheckedForCurrentAlternative = 0;
+        int countToCheckForFirstAlternative = 0;
+        bool hasShorterAlternatives = false;
+        JumpList notEnoughInputForPreviousAlternative;
+
+        if (state.alternativeValid()) {
+            PatternAlternative* alternative = state.alternative();
+            countToCheckForFirstAlternative = alternative->m_minimumSize;
+            state.checkedTotal += countToCheckForFirstAlternative;
+            if (countToCheckForFirstAlternative)
+                notEnoughInputForPreviousAlternative.append(jumpIfNoAvailableInput(countToCheckForFirstAlternative));
+            countCheckedForCurrentAlternative = countToCheckForFirstAlternative;
+        }
+
+        Label firstAlternativeInputChecked(this);
+
+        while (state.alternativeValid()) {
+            // Track whether any alternatives are shorter than the first one.
+            hasShorterAlternatives = hasShorterAlternatives || (countCheckedForCurrentAlternative < countToCheckForFirstAlternative);
+
+            PatternAlternative* alternative = state.alternative();
+            optimizeAlternative(alternative);
+
+            for (state.resetTerm(); state.termValid(); state.nextTerm())
+                generateTerm(state);
+
+            // If we get here, the alternative matched.
+            if (m_pattern.m_body->m_callFrameSize)
+                addPtr(Imm32(m_pattern.m_body->m_callFrameSize * sizeof(void*)), stackPointerRegister);
+            
+            ASSERT(index != returnRegister);
+            if (m_pattern.m_body->m_hasFixedSize) {
+                move(index, returnRegister);
+                if (alternative->m_minimumSize)
+                    sub32(Imm32(alternative->m_minimumSize), returnRegister);
+            } else
+                pop(returnRegister);
+            store32(index, Address(output, 4));
+            store32(returnRegister, output);
+
+            generateReturn();
+
+            state.nextAlternative();
+
+            // if there are any more alternatives, plant the check for input before looping.
+            if (state.alternativeValid()) {
+                PatternAlternative* nextAlternative = state.alternative();
+                int countToCheckForNextAlternative = nextAlternative->m_minimumSize;
+
+                if (countCheckedForCurrentAlternative > countToCheckForNextAlternative) { // CASE 1: current alternative was longer than the next one.
+                    // If we get here, there the last input checked failed.
+                    notEnoughInputForPreviousAlternative.link(this);
+
+                    // Check if sufficent input available to run the next alternative 
+                    notEnoughInputForPreviousAlternative.append(jumpIfNoAvailableInput(countToCheckForNextAlternative - countCheckedForCurrentAlternative));
+                    // We are now in the correct state to enter the next alternative; this add is only required
+                    // to mirror and revert operation of the sub32, just below.
+                    add32(Imm32(countCheckedForCurrentAlternative - countToCheckForNextAlternative), index);
+
+                    // If we get here, there the last input checked passed.
+                    state.linkAlternativeBacktracks(this);
+                    // No need to check if we can run the next alternative, since it is shorter -
+                    // just update index.
+                    sub32(Imm32(countCheckedForCurrentAlternative - countToCheckForNextAlternative), index);
+                } else if (countCheckedForCurrentAlternative < countToCheckForNextAlternative) { // CASE 2: next alternative is longer than the current one.
+                    // If we get here, there the last input checked failed.
+                    // If there is insufficient input to run the current alternative, and the next alternative is longer,
+                    // then there is definitely not enough input to run it - don't even check. Just adjust index, as if
+                    // we had checked.
+                    notEnoughInputForPreviousAlternative.link(this);
+                    add32(Imm32(countToCheckForNextAlternative - countCheckedForCurrentAlternative), index);
+                    notEnoughInputForPreviousAlternative.append(jump());
+
+                    // The next alternative is longer than the current one; check the difference.
+                    state.linkAlternativeBacktracks(this);
+                    notEnoughInputForPreviousAlternative.append(jumpIfNoAvailableInput(countToCheckForNextAlternative - countCheckedForCurrentAlternative));
+                } else { // CASE 3: Both alternatives are the same length.
+                    ASSERT(countCheckedForCurrentAlternative == countToCheckForNextAlternative);
+
+                    // If the next alterative is the same length as this one, then no need to check the input -
+                    // if there was sufficent input to run the current alternative then there is sufficient
+                    // input to run the next one; if not, there isn't.
+                    state.linkAlternativeBacktracks(this);
+                }
+
+                state.checkedTotal -= countCheckedForCurrentAlternative;
+                countCheckedForCurrentAlternative = countToCheckForNextAlternative;
+                state.checkedTotal += countCheckedForCurrentAlternative;
+            }
+        }
+        
+        // If we get here, all Alternatives failed...
+
+        state.checkedTotal -= countCheckedForCurrentAlternative;
+
+        // How much more input need there be to be able to retry from the first alternative?
+        // examples:
+        //   /yarr_jit/ or /wrec|pcre/
+        //     In these examples we need check for one more input before looping.
+        //   /yarr_jit|pcre/
+        //     In this case we need check for 5 more input to loop (+4 to allow for the first alterative
+        //     being four longer than the last alternative checked, and another +1 to effectively move
+        //     the start position along by one).
+        //   /yarr|rules/ or /wrec|notsomuch/
+        //     In these examples, provided that there was sufficient input to have just been matching for
+        //     the second alternative we can loop without checking for available input (since the second
+        //     alternative is longer than the first).  In the latter example we need to decrement index
+        //     (by 4) so the start position is only progressed by 1 from the last iteration.
+        int incrementForNextIter = (countToCheckForFirstAlternative - countCheckedForCurrentAlternative) + 1;
+
+        // First, deal with the cases where there was sufficient input to try the last alternative.
+        if (incrementForNextIter > 0) // We need to check for more input anyway, fall through to the checking below.
+            state.linkAlternativeBacktracks(this);
+        else if (m_pattern.m_body->m_hasFixedSize && !incrementForNextIter) // No need to update anything, link these backtracks straight to the to pof the loop!
+            state.linkAlternativeBacktracksTo(firstAlternativeInputChecked, this);
+        else { // no need to check the input, but we do have some bookkeeping to do first.
+            state.linkAlternativeBacktracks(this);
+
+            // Where necessary update our preserved start position.
+            if (!m_pattern.m_body->m_hasFixedSize) {
+                move(index, regT0);
+                sub32(Imm32(countCheckedForCurrentAlternative - 1), regT0);
+                poke(regT0, m_pattern.m_body->m_callFrameSize);
+            }
+
+            // Update index if necessary, and loop (without checking).
+            if (incrementForNextIter)
+                add32(Imm32(incrementForNextIter), index);
+            jump().linkTo(firstAlternativeInputChecked, this);
+        }
+
+        notEnoughInputForPreviousAlternative.link(this);
+        // Update our idea of the start position, if we're tracking this.
+        if (!m_pattern.m_body->m_hasFixedSize) {
+            if (countCheckedForCurrentAlternative - 1) {
+                move(index, regT0);
+                sub32(Imm32(countCheckedForCurrentAlternative - 1), regT0);
+                poke(regT0, m_pattern.m_body->m_callFrameSize);
+            } else
+                poke(index, m_pattern.m_body->m_callFrameSize);
+        }
+        // Check if there is sufficent input to run the first alternative again.
+        jumpIfAvailableInput(incrementForNextIter).linkTo(firstAlternativeInputChecked, this);
+        // No - insufficent input to run the first alteranative, are there any other alternatives we
+        // might need to check?  If so, the last check will have left the index incremented by
+        // (countToCheckForFirstAlternative + 1), so we need test whether countToCheckForFirstAlternative
+        // LESS input is available, to have the effect of just progressing the start position by 1
+        // from the last iteration.  If this check passes we can just jump up to the check associated
+        // with the first alternative in the loop.  This is a bit sad, since we'll end up trying the
+        // first alternative again, and this check will fail (otherwise the check planted just above
+        // here would have passed).  This is a bit sad, however it saves trying to do something more
+        // complex here in compilation, and in the common case we should end up coallescing the checks.
+        //
+        // FIXME: a nice improvement here may be to stop trying to match sooner, based on the least
+        // of the minimum-alterantive-lengths.  E.g. if I have two alternatives of length 200 and 150,
+        // and a string of length 100, we'll end up looping index from 0 to 100, checking whether there
+        // is sufficient input to run either alternative (constantly failing).  If there had been only
+        // one alternative, or if the shorter alternative had come first, we would have terminated
+        // immediately. :-/
+        if (hasShorterAlternatives)
+            jumpIfAvailableInput(-countToCheckForFirstAlternative).linkTo(firstAlternative, this);
+        // index will now be a bit garbled (depending on whether 'hasShorterAlternatives' is true,
+        // it has either been incremented by 1 or by (countToCheckForFirstAlternative + 1) ... 
+        // but since we're about to return a failure this doesn't really matter!)
+
+        unsigned frameSize = m_pattern.m_body->m_callFrameSize;
+        if (!m_pattern.m_body->m_hasFixedSize)
+            ++frameSize;
+        if (frameSize)
+            addPtr(Imm32(frameSize * sizeof(void*)), stackPointerRegister);
+
+        move(Imm32(-1), returnRegister);
+
+        generateReturn();
+    }
+
+    void generateEnter()
+    {
+#if PLATFORM(X86_64)
+        push(X86::ebp);
+        move(stackPointerRegister, X86::ebp);
+#elif PLATFORM(X86)
+        push(X86::ebp);
+        move(stackPointerRegister, X86::ebp);
+        // TODO: do we need spill registers to fill the output pointer if there are no sub captures?
+        push(X86::ebx);
+        push(X86::edi);
+        push(X86::esi);
+        // load output into edi (2 = saved ebp + return address).
+    #if COMPILER(MSVC)
+        loadPtr(Address(X86::ebp, 2 * sizeof(void*)), input);
+        loadPtr(Address(X86::ebp, 3 * sizeof(void*)), index);
+        loadPtr(Address(X86::ebp, 4 * sizeof(void*)), length);
+        loadPtr(Address(X86::ebp, 5 * sizeof(void*)), output);
+    #else
+        loadPtr(Address(X86::ebp, 2 * sizeof(void*)), output);
+    #endif
+#elif PLATFORM(ARM_V7)
+        push(ARM::r4);
+        push(ARM::r5);
+        push(ARM::r6);
+        move(ARM::r3, output);
+#endif
+    }
+
+    void generateReturn()
+    {
+#if PLATFORM(X86_64)
+        pop(X86::ebp);
+#elif PLATFORM(X86)
+        pop(X86::esi);
+        pop(X86::edi);
+        pop(X86::ebx);
+        pop(X86::ebp);
+#elif PLATFORM(ARM_V7)
+        pop(ARM::r6);
+        pop(ARM::r5);
+        pop(ARM::r4);
+#endif
+        ret();
+    }
+
+public:
+    RegexGenerator(RegexPattern& pattern)
+        : m_pattern(pattern)
+        , m_generationFailed(false)
+    {
+    }
+
+    void generate()
+    {
+        generateEnter();
+
+        // TODO: do I really want this on the stack?
+        if (!m_pattern.m_body->m_hasFixedSize)
+            push(index);
+
+        if (m_pattern.m_body->m_callFrameSize)
+            subPtr(Imm32(m_pattern.m_body->m_callFrameSize * sizeof(void*)), stackPointerRegister);
+
+        generateDisjunction(m_pattern.m_body);
+    }
+
+    void compile(JSGlobalData* globalData, RegexCodeBlock& jitObject)
+    {
+        generate();
+
+        PatchBuffer patchBuffer(this, globalData->executableAllocator.poolForSize(size()));
+
+        for (unsigned i = 0; i < m_backtrackRecords.size(); ++i)
+            patchBuffer.patch(m_backtrackRecords[i].dataLabel, patchBuffer.locationOf(m_backtrackRecords[i].backtrackLocation));
+
+        jitObject.set(patchBuffer.finalizeCode());
+    }
+
+    bool generationFailed()
+    {
+        return m_generationFailed;
+    }
+
+private:
+    RegexPattern& m_pattern;
+    Vector<AlternativeBacktrackRecord> m_backtrackRecords;
+    bool m_generationFailed;
+};
+
+void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& patternString, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline)
+{
+    RegexPattern pattern(ignoreCase, multiline);
+
+    if ((error = compileRegex(patternString, pattern)))
+        return;
+
+    numSubpatterns = pattern.m_numSubpatterns;
+
+    RegexGenerator generator(pattern);
+    generator.compile(globalData, jitObject);
+
+    if (generator.generationFailed()) {
+        JSRegExpIgnoreCaseOption ignoreCaseOption = ignoreCase ? JSRegExpIgnoreCase : JSRegExpDoNotIgnoreCase;
+        JSRegExpMultilineOption multilineOption = multiline ? JSRegExpMultiline : JSRegExpSingleLine;
+        jitObject.setFallback(jsRegExpCompile(reinterpret_cast<const UChar*>(patternString.data()), patternString.size(), ignoreCaseOption, multilineOption, &numSubpatterns, &error));
+    }
+}
+
+int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize)
+{
+    if (JSRegExp* fallback = jitObject.getFallback())
+        return (jsRegExpExecute(fallback, input, length, start, output, outputArraySize) < 0) ? -1 : output[0];
+
+    return jitObject.execute(input, start, length, output);
+}
+
+}}
+
+#endif
+
+
+
+
+
diff --git a/JavaScriptCore/yarr/RegexJIT.h b/JavaScriptCore/yarr/RegexJIT.h
new file mode 100644
index 0000000..5b0df9d
--- /dev/null
+++ b/JavaScriptCore/yarr/RegexJIT.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexJIT_h
+#define RegexJIT_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR_JIT)
+
+#include "MacroAssembler.h"
+#include "RegexPattern.h"
+#include <UString.h>
+
+#include <pcre.h>
+struct JSRegExp; // temporary, remove when fallback is removed.
+
+#if PLATFORM(X86) && !COMPILER(MSVC)
+#define YARR_CALL __attribute__ ((regparm (3)))
+#else
+#define YARR_CALL
+#endif
+
+namespace JSC {
+
+class JSGlobalData;
+class ExecutablePool;
+
+namespace Yarr {
+
+class RegexCodeBlock {
+    typedef int (*RegexJITCode)(const UChar* input, unsigned start, unsigned length, int* output) YARR_CALL;
+
+public:
+    RegexCodeBlock()
+        : m_fallback(0)
+    {
+    }
+
+    ~RegexCodeBlock()
+    {
+        if (m_fallback)
+            jsRegExpFree(m_fallback);
+    }
+
+    JSRegExp* getFallback() { return m_fallback; }
+    void setFallback(JSRegExp* fallback) { m_fallback = fallback; }
+
+    bool operator!() { return !m_ref.m_code.executableAddress(); }
+    void set(MacroAssembler::CodeRef ref) { m_ref = ref; }
+
+    int execute(const UChar* input, unsigned start, unsigned length, int* output)
+    {
+        return reinterpret_cast<RegexJITCode>(m_ref.m_code.executableAddress())(input, start, length, output);
+    }
+
+private:
+    MacroAssembler::CodeRef m_ref;
+    JSRegExp* m_fallback;
+};
+
+void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase = false, bool multiline = false);
+int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize);
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexJIT_h
diff --git a/JavaScriptCore/yarr/RegexParser.h b/JavaScriptCore/yarr/RegexParser.h
new file mode 100644
index 0000000..64e8463
--- /dev/null
+++ b/JavaScriptCore/yarr/RegexParser.h
@@ -0,0 +1,854 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexParser_h
+#define RegexParser_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR)
+
+#include <UString.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/unicode/Unicode.h>
+#include <limits.h>
+
+namespace JSC { namespace Yarr {
+
+enum BuiltInCharacterClassID {
+    DigitClassID,
+    SpaceClassID,
+    WordClassID,
+    NewlineClassID,
+};
+
+// The Parser class should not be used directly - only via the Yarr::parse() method.
+template<class Delegate>
+class Parser {
+private:
+    template<class FriendDelegate>
+    friend const char* parse(FriendDelegate& delegate, const UString& pattern, unsigned backReferenceLimit);
+
+    enum ErrorCode {
+        NoError,
+        PatternTooLarge,
+        QuantifierOutOfOrder,
+        QuantifierWithoutAtom,
+        MissingParentheses,
+        ParenthesesUnmatched,
+        ParenthesesTypeInvalid,
+        CharacterClassUnmatched,
+        CharacterClassOutOfOrder,
+        EscapeUnterminated,
+        NumberOfErrorCodes
+    };
+
+    /*
+     * CharacterClassParserDelegate:
+     *
+     * The class CharacterClassParserDelegate is used in the parsing of character
+     * classes.  This class handles detection of character ranges.  This class
+     * implements enough of the delegate interface such that it can be passed to
+     * parseEscape() as an EscapeDelegate.  This allows parseEscape() to be reused
+     * to perform the parsing of escape characters in character sets.
+     */
+    class CharacterClassParserDelegate {
+    public:
+        CharacterClassParserDelegate(Delegate& delegate, ErrorCode& err)
+            : m_delegate(delegate)
+            , m_err(err)
+            , m_state(empty)
+        {
+        }
+
+        /*
+         * begin():
+         *
+         * Called at beginning of construction.
+         */
+        void begin(bool invert)
+        {
+            m_delegate.atomCharacterClassBegin(invert);
+        }
+
+        /*
+         * atomPatternCharacterUnescaped():
+         *
+         * This method is called directly from parseCharacterClass(), to report a new
+         * pattern character token.  This method differs from atomPatternCharacter(),
+         * which will be called from parseEscape(), since a hypen provided via this
+         * method may be indicating a character range, but a hyphen parsed by
+         * parseEscape() cannot be interpreted as doing so.
+         */
+        void atomPatternCharacterUnescaped(UChar ch)
+        {
+            switch (m_state) {
+            case empty:
+                m_character = ch;
+                m_state = cachedCharacter;
+                break;
+
+            case cachedCharacter:
+                if (ch == '-')
+                    m_state = cachedCharacterHyphen;
+                else {
+                    m_delegate.atomCharacterClassAtom(m_character);
+                    m_character = ch;
+                }
+                break;
+
+            case cachedCharacterHyphen:
+                if (ch >= m_character)
+                    m_delegate.atomCharacterClassRange(m_character, ch);
+                else
+                    m_err = CharacterClassOutOfOrder;
+                m_state = empty;
+            }
+        }
+
+        /*
+         * atomPatternCharacter():
+         *
+         * Adds a pattern character, called by parseEscape(), as such will not
+         * interpret a hyphen as indicating a character range.
+         */
+        void atomPatternCharacter(UChar ch)
+        {
+            // Flush if a character is already pending to prevent the
+            // hyphen from begin interpreted as indicating a range.
+            if((ch == '-') && (m_state == cachedCharacter))
+                flush();
+
+            atomPatternCharacterUnescaped(ch);
+        }
+
+        /*
+         * atomBuiltInCharacterClass():
+         *
+         * Adds a built-in character class, called by parseEscape().
+         */
+        void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert)
+        {
+            flush();
+            m_delegate.atomCharacterClassBuiltIn(classID, invert);
+        }
+
+        /*
+         * end():
+         *
+         * Called at end of construction.
+         */
+        void end()
+        {
+            flush();
+            m_delegate.atomCharacterClassEnd();
+        }
+
+        // parseEscape() should never call these delegate methods when
+        // invoked with inCharacterClass set.
+        void assertionWordBoundary(bool) { ASSERT_NOT_REACHED(); }
+        void atomBackReference(unsigned) { ASSERT_NOT_REACHED(); }
+
+    private:
+        void flush()
+        {
+            if (m_state != empty) // either cachedCharacter or cachedCharacterHyphen
+                m_delegate.atomCharacterClassAtom(m_character);
+            if (m_state == cachedCharacterHyphen)
+                m_delegate.atomCharacterClassAtom('-');
+            m_state = empty;
+        }
+    
+        Delegate& m_delegate;
+        ErrorCode& m_err;
+        enum CharacterClassConstructionState {
+            empty,
+            cachedCharacter,
+            cachedCharacterHyphen,
+        } m_state;
+        UChar m_character;
+    };
+
+    Parser(Delegate& delegate, const UString& pattern, unsigned backReferenceLimit)
+        : m_delegate(delegate)
+        , m_backReferenceLimit(backReferenceLimit)
+        , m_err(NoError)
+        , m_data(pattern.data())
+        , m_size(pattern.size())
+        , m_index(0)
+        , m_parenthesesNestingDepth(0)
+    {
+    }
+    
+    /*
+     * parseEscape():
+     *
+     * Helper for parseTokens() AND parseCharacterClass().
+     * Unlike the other parser methods, this function does not report tokens
+     * directly to the member delegate (m_delegate), instead tokens are
+     * emitted to the delegate provided as an argument.  In the case of atom
+     * escapes, parseTokens() will call parseEscape() passing m_delegate as
+     * an argument, and as such the escape will be reported to the delegate.
+     *
+     * However this method may also be used by parseCharacterClass(), in which
+     * case a CharacterClassParserDelegate will be passed as the delegate that
+     * tokens should be added to.  A boolean flag is also provided to indicate
+     * whether that an escape in a CharacterClass is being parsed (some parsing
+     * rules change in this context).
+     *
+     * The boolean value returned by this method indicates whether the token
+     * parsed was an atom (outside of a characted class \b and \B will be
+     * interpreted as assertions).
+     */
+    template<bool inCharacterClass, class EscapeDelegate>
+    bool parseEscape(EscapeDelegate& delegate)
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '\\');
+        consume();
+
+        if (atEndOfPattern()) {
+            m_err = EscapeUnterminated;
+            return false;
+        }
+
+        switch (peek()) {
+        // Assertions
+        case 'b':
+            consume();
+            if (inCharacterClass)
+                delegate.atomPatternCharacter('\b');
+            else {
+                delegate.assertionWordBoundary(false);
+                return false;
+            }
+            break;
+        case 'B':
+            consume();
+            if (inCharacterClass)
+                delegate.atomPatternCharacter('B');
+            else {
+                delegate.assertionWordBoundary(true);
+                return false;
+            }
+            break;
+
+        // CharacterClassEscape
+        case 'd':
+            consume();
+            delegate.atomBuiltInCharacterClass(DigitClassID, false);
+            break;
+        case 's':
+            consume();
+            delegate.atomBuiltInCharacterClass(SpaceClassID, false);
+            break;
+        case 'w':
+            consume();
+            delegate.atomBuiltInCharacterClass(WordClassID, false);
+            break;
+        case 'D':
+            consume();
+            delegate.atomBuiltInCharacterClass(DigitClassID, true);
+            break;
+        case 'S':
+            consume();
+            delegate.atomBuiltInCharacterClass(SpaceClassID, true);
+            break;
+        case 'W':
+            consume();
+            delegate.atomBuiltInCharacterClass(WordClassID, true);
+            break;
+
+        // DecimalEscape
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9': {
+            // To match Firefox, we parse an invalid backreference in the range [1-7] as an octal escape.
+            // First, try to parse this as backreference.
+            if (!inCharacterClass) {
+                ParseState state = saveState();
+
+                unsigned backReference = consumeNumber();
+                if (backReference <= m_backReferenceLimit) {
+                    delegate.atomBackReference(backReference);
+                    break;
+                }
+
+                restoreState(state);
+            }
+            
+            // Not a backreference, and not octal.
+            if (peek() >= '8') {
+                delegate.atomPatternCharacter('\\');
+                break;
+            }
+
+            // Fall-through to handle this as an octal escape.
+        }
+
+        // Octal escape
+        case '0':
+            delegate.atomPatternCharacter(consumeOctal());
+            break;
+
+        // ControlEscape
+        case 'f':
+            consume();
+            delegate.atomPatternCharacter('\f');
+            break;
+        case 'n':
+            consume();
+            delegate.atomPatternCharacter('\n');
+            break;
+        case 'r':
+            consume();
+            delegate.atomPatternCharacter('\r');
+            break;
+        case 't':
+            consume();
+            delegate.atomPatternCharacter('\t');
+            break;
+        case 'v':
+            consume();
+            delegate.atomPatternCharacter('\v');
+            break;
+
+        // ControlLetter
+        case 'c': {
+            ParseState state = saveState();
+            consume();
+            if (!atEndOfPattern()) {
+                int control = consume();
+
+                // To match Firefox, inside a character class, we also accept numbers and '_' as control characters.
+                if (inCharacterClass ? WTF::isASCIIAlphanumeric(control) || (control == '_') : WTF::isASCIIAlpha(control)) {
+                    delegate.atomPatternCharacter(control & 0x1f);
+                    break;
+                }
+            }
+            restoreState(state);
+            delegate.atomPatternCharacter('\\');
+            break;
+        }
+
+        // HexEscape
+        case 'x': {
+            consume();
+            int x = tryConsumeHex(2);
+            if (x == -1)
+                delegate.atomPatternCharacter('x');
+            else
+                delegate.atomPatternCharacter(x);
+            break;
+        }
+
+        // UnicodeEscape
+        case 'u': {
+            consume();
+            int u = tryConsumeHex(4);
+            if (u == -1)
+                delegate.atomPatternCharacter('u');
+            else
+                delegate.atomPatternCharacter(u);
+            break;
+        }
+
+        // IdentityEscape
+        default:
+            delegate.atomPatternCharacter(consume());
+        }
+        
+        return true;
+    }
+
+    /*
+     * parseAtomEscape(), parseCharacterClassEscape():
+     *
+     * These methods alias to parseEscape().
+     */
+    bool parseAtomEscape()
+    {
+        return parseEscape<false>(m_delegate);
+    }
+    void parseCharacterClassEscape(CharacterClassParserDelegate& delegate)
+    {
+        parseEscape<true>(delegate);
+    }
+
+    /*
+     * parseCharacterClass():
+     *
+     * Helper for parseTokens(); calls dirctly and indirectly (via parseCharacterClassEscape)
+     * to an instance of CharacterClassParserDelegate, to describe the character class to the
+     * delegate.
+     */
+    void parseCharacterClass()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '[');
+        consume();
+
+        CharacterClassParserDelegate characterClassConstructor(m_delegate, m_err);
+
+        characterClassConstructor.begin(tryConsume('^'));
+
+        while (!atEndOfPattern()) {
+            switch (peek()) {
+            case ']':
+                consume();
+                characterClassConstructor.end();
+                return;
+
+            case '\\':
+                parseCharacterClassEscape(characterClassConstructor);
+                break;
+
+            default:
+                characterClassConstructor.atomPatternCharacterUnescaped(consume());
+            }
+
+            if (m_err)
+                return;
+        }
+
+        m_err = CharacterClassUnmatched;
+    }
+
+    /*
+     * parseParenthesesBegin():
+     *
+     * Helper for parseTokens(); checks for parentheses types other than regular capturing subpatterns.
+     */
+    void parseParenthesesBegin()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '(');
+        consume();
+
+        if (tryConsume('?')) {
+            if (atEndOfPattern()) {
+                m_err = ParenthesesTypeInvalid;
+                return;
+            }
+
+            switch (consume()) {
+            case ':':
+                m_delegate.atomParenthesesSubpatternBegin(false);
+                break;
+            
+            case '=':
+                m_delegate.atomParentheticalAssertionBegin();
+                break;
+
+            case '!':
+                m_delegate.atomParentheticalAssertionBegin(true);
+                break;
+            
+            default:
+                m_err = ParenthesesTypeInvalid;
+            }
+        } else
+            m_delegate.atomParenthesesSubpatternBegin();
+
+        ++m_parenthesesNestingDepth;
+    }
+
+    /*
+     * parseParenthesesEnd():
+     *
+     * Helper for parseTokens(); checks for parse errors (due to unmatched parentheses).
+     */
+    void parseParenthesesEnd()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == ')');
+        consume();
+
+        if (m_parenthesesNestingDepth > 0)
+            m_delegate.atomParenthesesEnd();
+        else
+            m_err = ParenthesesUnmatched;
+
+        --m_parenthesesNestingDepth;
+    }
+
+    /*
+     * parseQuantifier():
+     *
+     * Helper for parseTokens(); checks for parse errors and non-greedy quantifiers.
+     */
+    void parseQuantifier(bool lastTokenWasAnAtom, unsigned min, unsigned max)
+    {
+        ASSERT(!m_err);
+        ASSERT(min <= max);
+
+        if (lastTokenWasAnAtom)
+            m_delegate.quantifyAtom(min, max, !tryConsume('?'));
+        else
+            m_err = QuantifierWithoutAtom;
+    }
+
+    /*
+     * parseTokens():
+     *
+     * This method loops over the input pattern reporting tokens to the delegate.
+     * The method returns when a parse error is detected, or the end of the pattern
+     * is reached.  One piece of state is tracked around the loop, which is whether
+     * the last token passed to the delegate was an atom (this is necessary to detect
+     * a parse error when a quantifier provided without an atom to quantify).
+     */
+    void parseTokens()
+    {
+        bool lastTokenWasAnAtom = false;
+
+        while (!atEndOfPattern()) {
+            switch (peek()) {
+            case '|':
+                consume();
+                m_delegate.disjunction();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '(':
+                parseParenthesesBegin();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case ')':
+                parseParenthesesEnd();
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '^':
+                consume();
+                m_delegate.assertionBOL();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '$':
+                consume();
+                m_delegate.assertionEOL();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '.':
+                consume();
+                m_delegate.atomBuiltInCharacterClass(NewlineClassID, true);
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '[':
+                parseCharacterClass();
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '\\':
+                lastTokenWasAnAtom = parseAtomEscape();
+                break;
+
+            case '*':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 0, UINT_MAX);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '+':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 1, UINT_MAX);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '?':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 0, 1);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '{': {
+                ParseState state = saveState();
+
+                consume();
+                if (peekIsDigit()) {
+                    unsigned min = consumeNumber();
+                    unsigned max = min;
+                    
+                    if (tryConsume(','))
+                        max = peekIsDigit() ? consumeNumber() : UINT_MAX;
+
+                    if (tryConsume('}')) {
+                        if (min <= max)
+                            parseQuantifier(lastTokenWasAnAtom, min, max);
+                        else
+                            m_err = QuantifierOutOfOrder;
+                        lastTokenWasAnAtom = false;
+                        break;
+                    }
+                }
+
+                restoreState(state);
+            } // if we did not find a complete quantifer, fall through to the default case.
+
+            default:
+                m_delegate.atomPatternCharacter(consume());
+                lastTokenWasAnAtom = true;
+            }
+
+            if (m_err)
+                return;
+        }
+
+        if (m_parenthesesNestingDepth > 0)
+            m_err = MissingParentheses;
+    }
+
+    /*
+     * parse():
+     *
+     * This method calls regexBegin(), calls parseTokens() to parse over the input
+     * patterns, calls regexEnd() or regexError() as appropriate, and converts any
+     * error code to a const char* for a result.
+     */
+    const char* parse()
+    {
+        m_delegate.regexBegin();
+
+        if (m_size > MAX_PATTERN_SIZE)
+            m_err = PatternTooLarge;
+        else
+            parseTokens();
+        ASSERT(atEndOfPattern() || m_err);
+
+        if (m_err)
+            m_delegate.regexError();
+        else
+            m_delegate.regexEnd();
+
+        // The order of this array must match the ErrorCode enum.
+        static const char* errorMessages[NumberOfErrorCodes] = {
+            0, // NoError
+            "regular expression too large",
+            "numbers out of order in {} quantifier",
+            "nothing to repeat",
+            "missing )",
+            "unmatched parentheses",
+            "unrecognized character after (?",
+            "missing terminating ] for character class",
+            "range out of order in character class",
+            "\\ at end of pattern"
+        };
+
+        return errorMessages[m_err];
+    }
+
+
+    // Misc helper functions:
+
+    typedef unsigned ParseState;
+    
+    ParseState saveState()
+    {
+        return m_index;
+    }
+
+    void restoreState(ParseState state)
+    {
+        m_index = state;
+    }
+
+    bool atEndOfPattern()
+    {
+        ASSERT(m_index <= m_size);
+        return m_index == m_size;
+    }
+
+    int peek()
+    {
+        ASSERT(m_index < m_size);
+        return m_data[m_index];
+    }
+
+    bool peekIsDigit()
+    {
+        return !atEndOfPattern() && WTF::isASCIIDigit(peek());
+    }
+
+    unsigned peekDigit()
+    {
+        ASSERT(peekIsDigit());
+        return peek() - '0';
+    }
+
+    int consume()
+    {
+        ASSERT(m_index < m_size);
+        return m_data[m_index++];
+    }
+
+    unsigned consumeDigit()
+    {
+        ASSERT(peekIsDigit());
+        return consume() - '0';
+    }
+
+    unsigned consumeNumber()
+    {
+        unsigned n = consumeDigit();
+        // check for overflow.
+        for (unsigned newValue; peekIsDigit() && ((newValue = n * 10 + peekDigit()) >= n); ) {
+            n = newValue;
+            consume();
+        }
+        return n;
+    }
+
+    unsigned consumeOctal()
+    {
+        ASSERT(WTF::isASCIIOctalDigit(peek()));
+
+        unsigned n = consumeDigit();
+        while (n < 32 && !atEndOfPattern() && WTF::isASCIIOctalDigit(peek()))
+            n = n * 8 + consumeDigit();
+        return n;
+    }
+
+    bool tryConsume(UChar ch)
+    {
+        if (atEndOfPattern() || (m_data[m_index] != ch))
+            return false;
+        ++m_index;
+        return true;
+    }
+
+    int tryConsumeHex(int count)
+    {
+        ParseState state = saveState();
+
+        int n = 0;
+        while (count--) {
+            if (atEndOfPattern() || !WTF::isASCIIHexDigit(peek())) {
+                restoreState(state);
+                return -1;
+            }
+            n = (n << 4) | WTF::toASCIIHexValue(consume());
+        }
+        return n;
+    }
+
+    Delegate& m_delegate;
+    unsigned m_backReferenceLimit;
+    ErrorCode m_err;
+    const UChar* m_data;
+    unsigned m_size;
+    unsigned m_index;
+    unsigned m_parenthesesNestingDepth;
+
+    // Derived by empirical testing of compile time in PCRE and WREC.
+    static const unsigned MAX_PATTERN_SIZE = 1024 * 1024;
+};
+
+/*
+ * Yarr::parse():
+ *
+ * The parse method is passed a pattern to be parsed and a delegate upon which
+ * callbacks will be made to record the parsed tokens forming the regex.
+ * Yarr::parse() returns null on success, or a const C string providing an error
+ * message where a parse error occurs.
+ *
+ * The Delegate must implement the following interface:
+ *
+ *    void assertionBOL();
+ *    void assertionEOL();
+ *    void assertionWordBoundary(bool invert);
+ *
+ *    void atomPatternCharacter(UChar ch);
+ *    void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert);
+ *    void atomCharacterClassBegin(bool invert)
+ *    void atomCharacterClassAtom(UChar ch)
+ *    void atomCharacterClassRange(UChar begin, UChar end)
+ *    void atomCharacterClassBuiltIn(BuiltInCharacterClassID classID, bool invert)
+ *    void atomCharacterClassEnd()
+ *    void atomParenthesesSubpatternBegin(bool capture = true);
+ *    void atomParentheticalAssertionBegin(bool invert = false);
+ *    void atomParenthesesEnd();
+ *    void atomBackReference(unsigned subpatternId);
+ *
+ *    void quantifyAtom(unsigned min, unsigned max, bool greedy);
+ *
+ *    void disjunction();
+ *
+ *    void regexBegin();
+ *    void regexEnd();
+ *    void regexError();
+ *
+ * Before any call recording tokens are made, regexBegin() will be called on the
+ * delegate once.  Once parsing is complete either regexEnd() or regexError() will
+ * be called, as appropriate.
+ *
+ * The regular expression is described by a sequence of assertion*() and atom*()
+ * callbacks to the delegate, describing the terms in the regular expression.
+ * Following an atom a quantifyAtom() call may occur to indicate that the previous
+ * atom should be quantified.  In the case of atoms described across multiple
+ * calls (parentheses and character classes) the call to quantifyAtom() will come
+ * after the call to the atom*End() method, never after atom*Begin().
+ *
+ * Character classes may either be described by a single call to
+ * atomBuiltInCharacterClass(), or by a sequence of atomCharacterClass*() calls.
+ * In the latter case, ...Begin() will be called, followed by a sequence of
+ * calls to ...Atom(), ...Range(), and ...BuiltIn(), followed by a call to ...End().
+ *
+ * Sequences of atoms and assertions are broken into alternatives via calls to
+ * disjunction().  Assertions, atoms, and disjunctions emitted between calls to
+ * atomParenthesesBegin() and atomParenthesesEnd() form the body of a subpattern.
+ * atomParenthesesBegin() is passed a subpatternId.  In the case of a regular
+ * capturing subpattern, this will be the subpatternId associated with these
+ * parentheses, and will also by definition be the lowest subpatternId of these
+ * parentheses and of any nested paretheses.  The atomParenthesesEnd() method
+ * is passed the subpatternId of the last capturing subexpression nested within
+ * these paretheses.  In the case of a capturing subpattern with no nested
+ * capturing subpatterns, the same subpatternId will be passed to the begin and
+ * end functions.  In the case of non-capturing subpatterns the subpatternId
+ * passed to the begin method is also the first possible subpatternId that might
+ * be nested within these paretheses.  If a set of non-capturing parentheses does
+ * not contain any capturing subpatterns, then the subpatternId passed to begin
+ * will be greater than the subpatternId passed to end.
+ */
+
+template<class Delegate>
+const char* parse(Delegate& delegate, const UString& pattern, unsigned backReferenceLimit = UINT_MAX)
+{
+    return Parser<Delegate>(delegate, pattern, backReferenceLimit).parse();
+}
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexParser_h
diff --git a/JavaScriptCore/yarr/RegexPattern.h b/JavaScriptCore/yarr/RegexPattern.h
new file mode 100644
index 0000000..fb1b0ab
--- /dev/null
+++ b/JavaScriptCore/yarr/RegexPattern.h
@@ -0,0 +1,356 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexPattern_h
+#define RegexPattern_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR)
+
+#include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
+
+
+namespace JSC { namespace Yarr {
+
+#define RegexStackSpaceForBackTrackInfoPatternCharacter 1 // Only for !fixed quantifiers.
+#define RegexStackSpaceForBackTrackInfoCharacterClass 1 // Only for !fixed quantifiers.
+#define RegexStackSpaceForBackTrackInfoBackReference 2
+#define RegexStackSpaceForBackTrackInfoAlternative 1 // One per alternative.
+#define RegexStackSpaceForBackTrackInfoParentheticalAssertion 1
+#define RegexStackSpaceForBackTrackInfoParenthesesOnce 1 // Only for !fixed quantifiers.
+#define RegexStackSpaceForBackTrackInfoParentheses 4
+
+struct PatternDisjunction;
+
+struct CharacterRange {
+    UChar begin;
+    UChar end;
+
+    CharacterRange(UChar begin, UChar end)
+        : begin(begin)
+        , end(end)
+    {
+    }
+};
+
+struct CharacterClass {
+    Vector<UChar> m_matches;
+    Vector<CharacterRange> m_ranges;
+    Vector<UChar> m_matchesUnicode;
+    Vector<CharacterRange> m_rangesUnicode;
+};
+
+enum QuantifierType {
+    QuantifierFixedCount,
+    QuantifierGreedy,
+    QuantifierNonGreedy,
+};
+
+struct PatternTerm {
+    enum Type {
+        TypeAssertionBOL,
+        TypeAssertionEOL,
+        TypeAssertionWordBoundary,
+        TypePatternCharacter,
+        TypeCharacterClass,
+        TypeBackReference,
+        TypeForwardReference,
+        TypeParenthesesSubpattern,
+        TypeParentheticalAssertion,
+    } type;
+    bool invertOrCapture;
+    union {
+        UChar patternCharacter;
+        CharacterClass* characterClass;
+        unsigned subpatternId;
+        struct {
+            PatternDisjunction* disjunction;
+            unsigned subpatternId;
+            unsigned lastSubpatternId;
+            bool isCopy;
+        } parentheses;
+    };
+    QuantifierType quantityType;
+    unsigned quantityCount;
+    int inputPosition;
+    unsigned frameLocation;
+
+    PatternTerm(UChar ch)
+        : type(PatternTerm::TypePatternCharacter)
+    {
+        patternCharacter = ch;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    PatternTerm(CharacterClass* charClass, bool invert)
+        : type(PatternTerm::TypeCharacterClass)
+        , invertOrCapture(invert)
+    {
+        characterClass = charClass;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    PatternTerm(Type type, unsigned subpatternId, PatternDisjunction* disjunction, bool invertOrCapture)
+        : type(type)
+        , invertOrCapture(invertOrCapture)
+    {
+        parentheses.disjunction = disjunction;
+        parentheses.subpatternId = subpatternId;
+        parentheses.isCopy = false;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+    
+    PatternTerm(Type type, bool invert = false)
+        : type(type)
+        , invertOrCapture(invert)
+    {
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    PatternTerm(unsigned spatternId)
+        : type(TypeBackReference)
+        , invertOrCapture(invertOrCapture)
+    {
+        subpatternId = spatternId;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    static PatternTerm ForwardReference()
+    {
+        return PatternTerm(TypeForwardReference);
+    }
+
+    static PatternTerm BOL()
+    {
+        return PatternTerm(TypeAssertionBOL);
+    }
+
+    static PatternTerm EOL()
+    {
+        return PatternTerm(TypeAssertionEOL);
+    }
+
+    static PatternTerm WordBoundary(bool invert)
+    {
+        return PatternTerm(TypeAssertionWordBoundary, invert);
+    }
+    
+    bool invert()
+    {
+        return invertOrCapture;
+    }
+
+    bool capture()
+    {
+        return invertOrCapture;
+    }
+    
+    void quantify(unsigned count, QuantifierType type)
+    {
+        quantityCount = count;
+        quantityType = type;
+    }
+};
+
+struct PatternAlternative {
+    PatternAlternative(PatternDisjunction* disjunction)
+        : m_parent(disjunction)
+    {
+    }
+
+    PatternTerm& lastTerm()
+    {
+        ASSERT(m_terms.size());
+        return m_terms[m_terms.size() - 1];
+    }
+    
+    void removeLastTerm()
+    {
+        ASSERT(m_terms.size());
+        m_terms.shrink(m_terms.size() - 1);
+    }
+
+    Vector<PatternTerm> m_terms;
+    PatternDisjunction* m_parent;
+    unsigned m_minimumSize;
+    bool m_hasFixedSize;
+};
+
+struct PatternDisjunction {
+    PatternDisjunction(PatternAlternative* parent = 0)
+        : m_parent(parent)
+    {
+    }
+    
+    ~PatternDisjunction()
+    {
+        deleteAllValues(m_alternatives);
+    }
+
+    PatternAlternative* addNewAlternative()
+    {
+        PatternAlternative* alternative = new PatternAlternative(this);
+        m_alternatives.append(alternative);
+        return alternative;
+    }
+
+    Vector<PatternAlternative*> m_alternatives;
+    PatternAlternative* m_parent;
+    unsigned m_minimumSize;
+    unsigned m_callFrameSize;
+    bool m_hasFixedSize;
+};
+
+// You probably don't want to be calling these functions directly
+// (please to be calling newlineCharacterClass() et al on your
+// friendly neighborhood RegexPattern instance to get nicely
+// cached copies).
+CharacterClass* newlineCreate();
+CharacterClass* digitsCreate();
+CharacterClass* spacesCreate();
+CharacterClass* wordcharCreate();
+CharacterClass* nondigitsCreate();
+CharacterClass* nonspacesCreate();
+CharacterClass* nonwordcharCreate();
+
+struct RegexPattern {
+    RegexPattern(bool ignoreCase, bool multiline)
+        : m_ignoreCase(ignoreCase)
+        , m_multiline(multiline)
+        , m_numSubpatterns(0)
+        , m_maxBackReference(0)
+        , newlineCached(0)
+        , digitsCached(0)
+        , spacesCached(0)
+        , wordcharCached(0)
+        , nondigitsCached(0)
+        , nonspacesCached(0)
+        , nonwordcharCached(0)
+    {
+    }
+
+    ~RegexPattern()
+    {
+        deleteAllValues(m_disjunctions);
+        deleteAllValues(m_userCharacterClasses);
+    }
+
+    void reset()
+    {
+        m_numSubpatterns = 0;
+        m_maxBackReference = 0;
+
+        newlineCached = 0;
+        digitsCached = 0;
+        spacesCached = 0;
+        wordcharCached = 0;
+        nondigitsCached = 0;
+        nonspacesCached = 0;
+        nonwordcharCached = 0;
+
+        deleteAllValues(m_disjunctions);
+        m_disjunctions.clear();
+        deleteAllValues(m_userCharacterClasses);
+        m_userCharacterClasses.clear();
+    }
+
+    bool containsIllegalBackReference()
+    {
+        return m_maxBackReference > m_numSubpatterns;
+    }
+
+    CharacterClass* newlineCharacterClass()
+    {
+        if (!newlineCached)
+            m_userCharacterClasses.append(newlineCached = newlineCreate());
+        return newlineCached;
+    }
+    CharacterClass* digitsCharacterClass()
+    {
+        if (!digitsCached)
+            m_userCharacterClasses.append(digitsCached = digitsCreate());
+        return digitsCached;
+    }
+    CharacterClass* spacesCharacterClass()
+    {
+        if (!spacesCached)
+            m_userCharacterClasses.append(spacesCached = spacesCreate());
+        return spacesCached;
+    }
+    CharacterClass* wordcharCharacterClass()
+    {
+        if (!wordcharCached)
+            m_userCharacterClasses.append(wordcharCached = wordcharCreate());
+        return wordcharCached;
+    }
+    CharacterClass* nondigitsCharacterClass()
+    {
+        if (!nondigitsCached)
+            m_userCharacterClasses.append(nondigitsCached = nondigitsCreate());
+        return nondigitsCached;
+    }
+    CharacterClass* nonspacesCharacterClass()
+    {
+        if (!nonspacesCached)
+            m_userCharacterClasses.append(nonspacesCached = nonspacesCreate());
+        return nonspacesCached;
+    }
+    CharacterClass* nonwordcharCharacterClass()
+    {
+        if (!nonwordcharCached)
+            m_userCharacterClasses.append(nonwordcharCached = nonwordcharCreate());
+        return nonwordcharCached;
+    }
+
+    bool m_ignoreCase;
+    bool m_multiline;
+    unsigned m_numSubpatterns;
+    unsigned m_maxBackReference;
+    PatternDisjunction* m_body;
+    Vector<PatternDisjunction*, 4> m_disjunctions;
+    Vector<CharacterClass*> m_userCharacterClasses;
+
+private:
+    CharacterClass* newlineCached;
+    CharacterClass* digitsCached;
+    CharacterClass* spacesCached;
+    CharacterClass* wordcharCached;
+    CharacterClass* nondigitsCached;
+    CharacterClass* nonspacesCached;
+    CharacterClass* nonwordcharCached;
+};
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexPattern_h
diff --git a/WebCore/Android.derived.mk b/WebCore/Android.derived.mk
index 24c271f..1c5aad5 100644
--- a/WebCore/Android.derived.mk
+++ b/WebCore/Android.derived.mk
@@ -25,8 +25,6 @@
 #	dom/EventTarget.idl \
 #	dom/Worker*.idl \
 #	html/CanvasPixelArray.idl \
-#	html/HTMLAudioElement.idl \
-#	html/HTMLMediaElement.idl \
 #	page/AbstractView.idl \
 #	page/PositionCallback.idl \
 #	page/Worker*.idl \
@@ -217,7 +215,7 @@
 			bindings/scripts/generate-bindings.pl \
 		)
 
-FEATURE_DEFINES := ANDROID_ORIENTATION_SUPPORT ENABLE_TOUCH_EVENTS=1 ENABLE_DATABASE=1 ENABLE_OFFLINE_WEB_APPLICATIONS=1
+FEATURE_DEFINES := ANDROID_ORIENTATION_SUPPORT ENABLE_TOUCH_EVENTS=1 ENABLE_DATABASE=1 ENABLE_OFFLINE_WEB_APPLICATIONS=1 ENABLE_VIDEO=0
 
 GEN := \
     $(intermediates)/css/JSCSSCharsetRule.h \
@@ -329,6 +327,7 @@
     $(intermediates)/html/JSHTMLAnchorElement.h \
     $(intermediates)/html/JSHTMLAppletElement.h \
     $(intermediates)/html/JSHTMLAreaElement.h \
+    $(intermediates)/html/JSHTMLAudioElement.h \
     $(intermediates)/html/JSHTMLBRElement.h \
     $(intermediates)/html/JSHTMLBaseElement.h \
     $(intermediates)/html/JSHTMLBaseFontElement.h \
@@ -362,6 +361,7 @@
     $(intermediates)/html/JSHTMLLinkElement.h \
     $(intermediates)/html/JSHTMLMapElement.h \
     $(intermediates)/html/JSHTMLMarqueeElement.h \
+    $(intermediates)/html/JSHTMLMediaElement.h \
     $(intermediates)/html/JSHTMLMenuElement.h \
     $(intermediates)/html/JSHTMLMetaElement.h \
     $(intermediates)/html/JSHTMLModElement.h \
@@ -369,7 +369,7 @@
     $(intermediates)/html/JSHTMLObjectElement.h \
     $(intermediates)/html/JSHTMLOptGroupElement.h \
     $(intermediates)/html/JSHTMLOptionElement.h \
-	$(intermediates)/html/JSHTMLOptionsCollection.h \
+    $(intermediates)/html/JSHTMLOptionsCollection.h \
     $(intermediates)/html/JSHTMLParagraphElement.h \
     $(intermediates)/html/JSHTMLParamElement.h \
     $(intermediates)/html/JSHTMLPreElement.h \
diff --git a/WebCore/Android.mk b/WebCore/Android.mk
index d1f0930..bcb8b58 100644
--- a/WebCore/Android.mk
+++ b/WebCore/Android.mk
@@ -22,11 +22,10 @@
 # LOCAL_SRC_FILES_EXCLUDED := \
 #	DerivedSources.cpp \
 #	WebCorePrefix.cpp \
-#	bindings/js/JSCustomSQL*.cpp \
+# accessibility/*.cpp \
 #	bindings/js/JSCustomVersionChangeCallback.cpp \
-#	bindings/js/JSDatabaseCustom.cpp \
 #	bindings/js/JSHTMLAudioElementConstructor.cpp \
-#	bindings/js/JSSQL*.cpp \
+#	bindings/js/JSInspectorControllerCustom.cpp \
 #	bindings/js/JSStorageCustom.cpp \
 #	bindings/js/JSXSLTProcessor*.cpp \
 #	bindings/js/JSWorker*.cpp \
@@ -43,6 +42,7 @@
 #	editing/SmartReplace*.cpp \
 #	history/BackForwardListChromium.cpp \
 #	html/FileList.cpp \
+# html/HTMLElementsAllInOne.cpp \
 #	html/HTMLAudioElement.cpp \
 #	html/HTMLMediaElement.cpp \
 #	html/HTMLSourceElement.cpp \
@@ -86,7 +86,6 @@
 #	/image-decoders/* \
 #	^inspector/* \
 #	^ksvg2/* \
-#	^loader\/appcache/* \
 #	^loader\/archive/* \
 #	/mac/* \
 #	^manual-tests/* \
@@ -125,6 +124,7 @@
 	bindings/js/JSCanvasRenderingContext2DCustom.cpp \
 	bindings/js/JSClipboardCustom.cpp \
 	bindings/js/JSConsoleCustom.cpp \
+  bindings/js/JSCoordinatesCustom.cpp \
 	bindings/js/JSCustomPositionCallback.cpp \
 	bindings/js/JSCustomPositionErrorCallback.cpp \
 	bindings/js/JSCustomSQLStatementCallback.cpp \
@@ -133,14 +133,14 @@
 	bindings/js/JSCustomSQLTransactionErrorCallback.cpp \
 	bindings/js/JSCustomVoidCallback.cpp \
 	bindings/js/JSCustomXPathNSResolver.cpp \
+  bindings/js/JSDOMApplicationCacheCustom.cpp \
+  bindings/js/JSDOMBinding.cpp \
+  bindings/js/JSDOMGlobalObject.cpp \
+  bindings/js/JSDOMStringListCustom.cpp \
+  bindings/js/JSDOMWindowBase.cpp \
+  bindings/js/JSDOMWindowCustom.cpp \
+  bindings/js/JSDOMWindowShell.cpp \
 	bindings/js/JSDatabaseCustom.cpp \
-	bindings/js/JSDOMApplicationCacheCustom.cpp \
-	bindings/js/JSDOMBinding.cpp \
-	bindings/js/JSDOMGlobalObject.cpp \
-	bindings/js/JSDOMStringListCustom.cpp \
-	bindings/js/JSDOMWindowBase.cpp \
-	bindings/js/JSDOMWindowCustom.cpp \
-	bindings/js/JSDOMWindowShell.cpp \
 	bindings/js/JSDocumentCustom.cpp \
 	bindings/js/JSDocumentFragmentCustom.cpp \
 	bindings/js/JSElementCustom.cpp \
@@ -189,7 +189,7 @@
 	bindings/js/JSQuarantinedObjectWrapper.cpp \
 	bindings/js/JSRGBColor.cpp \
 	bindings/js/JSSQLResultSetRowListCustom.cpp \
-	bindings/js/JSSQLTransactionCustom.cpp \
+	bindings/js/JSSQLTransactionCustom.cpp
     
 ifeq ($(ENABLE_SVG), true)
 LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
@@ -218,8 +218,11 @@
 	bindings/js/ScriptCallStack.cpp \
 	bindings/js/ScriptController.cpp \
 	bindings/js/ScriptControllerAndroid.cpp \
+  bindings/js/ScriptEventListener.cpp \
 	bindings/js/ScriptFunctionCall.cpp \
 	bindings/js/ScriptObject.cpp \
+  bindings/js/ScriptObjectQuarantine.cpp \
+  bindings/js/ScriptState.cpp \
 	bindings/js/ScriptValue.cpp \
 	\
 	bridge/IdentifierRep.cpp \
@@ -315,6 +318,7 @@
 	dom/CDATASection.cpp \
 	dom/CSSMappedAttributeDeclaration.cpp \
 	dom/CharacterData.cpp \
+  dom/CheckedRadioButtons.cpp \
 	dom/ChildNodeList.cpp \
 	dom/ClassNames.cpp \
 	dom/ClassNodeList.cpp \
@@ -339,8 +343,6 @@
 	dom/EventTarget.cpp \
 	dom/ExceptionBase.cpp \
 	dom/ExceptionCode.cpp \
-	dom/FormControlElement.cpp \
-	dom/FormControlElementWithState.cpp \
 	dom/InputElement.cpp \
 	dom/KeyboardEvent.cpp \
 	dom/MappedAttribute.cpp \
@@ -370,6 +372,7 @@
 	dom/RegisteredEventListener.cpp \
 	dom/ScriptElement.cpp \
 	dom/ScriptExecutionContext.cpp \
+  dom/SelectElement.cpp \
 	dom/SelectorNodeList.cpp \
 	dom/StaticNodeList.cpp \
 	dom/StaticStringList.cpp \
@@ -390,6 +393,7 @@
 	dom/WheelEvent.cpp \
 	dom/XMLTokenizer.cpp \
 	dom/XMLTokenizerLibxml2.cpp \
+  dom/XMLTokenizerScope.cpp \
 	\
 	editing/AppendNodeCommand.cpp \
 	editing/ApplyStyleCommand.cpp \
@@ -420,6 +424,7 @@
 	editing/RemoveFormatCommand.cpp \
 	editing/RemoveNodeCommand.cpp \
 	editing/RemoveNodePreservingChildrenCommand.cpp \
+  editing/ReplaceNodeWithSpanCommand.cpp \
 	editing/ReplaceSelectionCommand.cpp \
 	editing/SelectionController.cpp \
 	editing/SetNodeAttributeCommand.cpp \
@@ -449,6 +454,7 @@
 	html/CanvasPixelArray.cpp \
 	html/CanvasRenderingContext2D.cpp \
 	html/CanvasStyle.cpp \
+  html/CollectionCache.cpp \
 	html/File.cpp \
 	html/FormDataList.cpp \
 	html/HTMLAnchorElement.cpp \
@@ -497,6 +503,7 @@
 	html/HTMLMetaElement.cpp \
 	html/HTMLModElement.cpp \
 	html/HTMLNameCollection.cpp \
+  html/HTMLNoScriptElement.cpp \
 	html/HTMLOListElement.cpp \
 	html/HTMLObjectElement.cpp \
 	html/HTMLOptGroupElement.cpp \
@@ -597,6 +604,7 @@
 	page/NavigatorBase.cpp \
 	page/Page.cpp \
 	page/PageGroup.cpp \
+  page/PageGroupLoadDeferrer.cpp \
 	page/PrintContext.cpp \
 	page/Screen.cpp \
 	page/SecurityOrigin.cpp \
@@ -817,7 +825,6 @@
 	rendering/InlineFlowBox.cpp \
 	rendering/InlineTextBox.cpp \
 	rendering/LayoutState.cpp \
-	rendering/ListMarkerBox.cpp \
 	rendering/MediaControlElements.cpp \
 	rendering/PointerEventsHitRules.cpp \
 	rendering/RenderApplet.cpp \
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 164a9fd..c132fb9 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,24496 @@
+2009-06-09  Darin Fisher  <darin@chromium.org>
+
+        Fix Chromium build bustage.
+        
+        CachedResource.cpp no longer compiles if USE(JSC) is not defined.  The
+        problem is that this file is using a macro from StdLibExtras.h without
+        including that file.  It just happenes to get that file via a JSC
+        specific include.
+
+        * loader/CachedResource.cpp:
+
+2009-06-09  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Make sure the graphics backends are in sync with the canvas lineWidth state.
+        https://bugs.webkit.org/show_bug.cgi?id=26187
+
+        Test: fast/canvas/canvas-line-width.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+
+2009-06-09  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Proactively cancel pending requests at DocLoader dtor time,
+        otherwise crashes can occur. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=26230
+        http://code.google.com/p/chromium/issues/detail?id=12161
+
+        Test: fast/frames/javascript-url-as-framesrc-crash.html
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::~DocLoader):
+
+2009-06-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix ASSERT seen in shadow tree testing
+        https://bugs.webkit.org/show_bug.cgi?id=25092
+
+        Test: svg/custom/use-mutation-event-crash.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::instanceForShadowTreeElement):
+
+2009-06-09  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=22891
+        Scrolling in Windows Cairo Broken if no background color set.
+
+        * platform/graphics/cairo/GradientCairo.cpp:
+        (WebCore::Gradient::fill):  Use the GraphicsContext save and restore
+          methods (rather than the Cairo-only functions) so that the Windows
+          device context is kept in sync.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::GraphicsContext): Add new constructor call
+          to sync Windows HDC with Cairo surface.
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::syncContext): Provide
+          declaration for Windows HDC sync method (and stub for non-Windows
+          Cairo implementations).
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw): Use GraphicsContext save and restore
+          methods (rather than the Cairo-only functions) so that the Windows
+          device context is kept in sync.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::CairoContextWithHDC): New method to create a valid Cairo
+          context for a given HDC.
+        (WebCore::GraphicsContext::GraphicsContext): Modify constructor to
+          use new CairoContextWithHDC call.
+        (WebCore::GraphicsContext::getWindowsContext): Revise to match
+          behavior of CG implementation.
+        (WebCore::GraphicsContext::releaseWindowsContext): Revise to match
+          behavior of CG implementation.
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM): Get rid of
+          incorrect new HDC, and use object's HDC member for dealing with
+          concatCTM operations.
+        (WebCore::GraphicsContextPlatformPrivate::syncContext): New method
+          to sync Windows HDC with Cairo context.
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize): Revise implementation to
+          match CG behavior.
+
+2009-06-09  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 26196: Fix the problem that worker's importScripts fails if the
+        script URL is redirected from different origin.
+        https://bugs.webkit.org/show_bug.cgi?id=26196
+
+        Test: http/tests/workers/worker-importScripts.html
+
+        The fix is to pass an additional enum parameter to the loader in
+        order to tell it to perform the redirect origin check or not.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::create):
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::willSendRequest):
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoader.h:
+        (WebCore::):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+
+2009-06-09  Anand K. Mistry  <amistry@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Paint bitmaps with the alpha channel in Skia.
+        https://bugs.webkit.org/show_bug.cgi?id=26037
+
+        Test: fast/canvas/drawImage-with-globalAlpha.html
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::getAlpha):
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2009-06-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26104
+        [GTK] Make NetworkRequest a proper GObject and expose SoupMessage
+
+        Refactor how SoupMessage is handled, so that our ResourceRequest
+        object doesn't have to store it as a member, which complicates
+        managing ResourceRequest's lifetime.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2009-06-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, the time functions moved into the WTF namespace.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-06-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        <rdar://problem/6727495> Repro crash in WebCore::Loader::Host::servePendingRequests() and dupes.
+
+        Test: http/tests/loading/deleted-host-in-resource-load-delegate-callback.html
+
+        Loader::Host objects were manually managed via new/delete.
+        There's a variety of circumstances where a Host might've been deleted while it was still in the middle
+        of a resource load delegate callback.
+        Changing them to be RefCounted then adding protectors in the callbacks makes this possibility disappear.
+
+        At the same time, remove ProcessingResource which was an earlier fix for this same problem that wasn't
+        fully implemented.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        (WebCore::Loader::load):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::resumePendingRequests):
+        (WebCore::Loader::cancelRequests):
+        (WebCore::Loader::Host::didFinishLoading):
+        (WebCore::Loader::Host::didFail):
+        (WebCore::Loader::Host::didReceiveResponse):
+        (WebCore::Loader::Host::didReceiveData):
+        * loader/loader.h:
+        (WebCore::Loader::Host::create):
+
+2009-06-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26126
+        Refactor methods of WorkerMessagingProxy used to talk to main-thread loader into new interface.
+
+        Split a couple of methods used to schedule cross-thread tasks between worker thread and loader thread
+        implemented on WorkerMessagingProxy into a separate interface so the loading can be implemented in
+        Chromium's workers.
+
+        No changes in functionality so no tests added.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added WorkerLoaderProxy.h to the bulid.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate): WorkerThread::workerObjectProxy() now returns & instead of *
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate): same.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext): same.
+        (WebCore::WorkerContext::reportException): same.
+        (WebCore::WorkerContext::addMessage): same.
+        (WebCore::WorkerContext::postMessage): same.
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::destroy):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didSendData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFinishLoading):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveAuthenticationCancellation):
+        Use WorkerLoaderProxy instead of WorkerMessagingProxy for the MainThreadBridge.
+        Mostly rename.
+
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        In addition to using WorkerLoaderProxy instead of WorkerMessagingProxy, the check for
+        AskedToTerminate is removed. It seems to be an optimization for a very small number of cases
+        when worker termination is requested a very short time before the request to load something
+        (XHR or importScript) was dispatched on the main thread.
+
+        * loader/WorkerThreadableLoader.h:
+        Now keeps a pointer to WorkerLoaderProxy rather then to a WorkerMessagingProxy. This allows
+        to implement WorkerThreadableLoader for Chromium.
+
+        * workers/WorkerLoaderProxy.h: Added.
+        (WebCore::WorkerLoaderProxy::~WorkerLoaderProxy):
+
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        (WebCore::WorkerMessagingProxy::postTaskToLoader): Added ASSERT since this needs to be implemented for nested workers.
+        * workers/WorkerMessagingProxy.h:
+        Derived from WorkerLoaderProxy, the methods for posting tasks cross-thread are now virtual.
+        Removed unused postTaskToWorkerContext() method.
+
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::create):
+        (WebCore::WorkerThread::WorkerThread):
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerLoaderProxy):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::create):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::workerThread):
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerLoaderProxy):
+        (WebCore::WorkerThread::workerObjectProxy):
+        WorkerThread gets a new member of type WorkerLoaderProxy&, and accessor.
+        Also, existing WorkerObjectProxy* member is now WorkerObjectProxy& because it can't be null.
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26238
+        Add parseDate helper to HTTPParsers, which uses WTF::parseDateFromNullTerminatedCharacters.
+
+        * ForwardingHeaders/runtime/DateMath.h: Removed.
+        * ForwardingHeaders/wtf/DateMath.h: Copied from WebCore/ForwardingHeaders/runtime/DateMath.h.
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Added.
+        * platform/network/HTTPParsers.h:
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::parseDateValueInHeader): Changed to use the new helper.
+
+2009-06-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Siedel.
+
+        Chromium Linux ignored the background color on <select>s. Rather
+        than encode magic colours, we start with a base color (specified
+        via CSS) and derive the other colors from it. Thus, setting the
+        CSS background-color now correctly changes the colour of the
+        control.
+
+        This should not change the appearence controls without
+        background-colors. However, <select>s with a background-color
+        will now renderer correctly, which may require rebaselining
+        pixel tests in the Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26030
+        http://code.google.com/p/chromium/issues/detail?id=12596
+
+        * platform/graphics/Color.cpp:
+        (WebCore::Color::getHSL): new member
+        * platform/graphics/Color.h:
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::systemColor):
+        (WebCore::brightenColor):
+        (WebCore::paintButtonLike):
+
+2009-06-08  Victor Wang <victorw@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26087
+        Bug 26087: Removing element in JS crashes Chrome tab if it fired the change event
+
+        Fix tab crash caused by destroying the popup list that fired the change event on abandon.
+
+        If a popup list is abandoned (press a key to jump to an item
+        and then use tab or mouse to get away from the select box),
+        the current code fires a change event in PopupListBox::updateFromElemt().
+        The JS that listens to this event may destroy the object and cause the
+        rest of popup list code crashes.
+
+        The updateFromElement() is called before abandon() and this causes
+        the selected index to be discarded after updateFromElement(). From
+        the code comments, this appears to be the reason why valueChanged is
+        called in updateFromElement.
+
+        Fix the issue by removing the valueChanged call in updateFromElement,
+        saving the selected index that we should accept on abandon and pass
+        it to the valueChange in abandon().
+
+        A manual test has been added.
+
+        * manual-tests/chromium: Added.
+        * manual-tests/chromium/onchange-reload-popup.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::PopupListBox):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::updateFromElement):
+
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Disable a few warnings on Windows
+
+        * WebCore.pro:
+
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Don't enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH on Windows
+        
+        This define was brought in after refactoring some code from
+        PluginPackage(Qt|Gtk).cpp into the shared PluginPackage.cpp.
+
+        * WebCore.pro:
+
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $QMAKE_PATH_SEP instead of hardcoded / to fix Windows build
+
+        * WebCore.pro:
+
+2009-06-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Build fix when NETSCAPE_PLUGIN_API support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=26244
+
+        * WebCore.pro: Define PLUGIN_PACKAGE_SIMPLE_HASH only if
+        NETSCAPE_PLUGIN_API is turned on
+        * plugins/PluginPackage.cpp: Guard initializeBrowserFuncs()
+        * plugins/PluginViewNone.cpp: Match guards with PluginView.h
+
+2009-06-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6931661> -[WebView _selectionIsAll] returns YES
+          when the selection is inside a text field.
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::isAll): Return false if the selection is in
+        a shadow tree.
+
+2009-06-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26106
+        [GTK] Crashes when you keep a combo open during a page transition, then close it
+
+        Hide the combo popup and disconnect from its signals during
+        PopupMenu destruction to handle this exceptional case with no
+        crash.
+
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::menuUnmapped):
+
+2009-06-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6930540>
+        REGRESSION (r43797): Serif and fantasy font-family names are wrong in result of getComputedStyle
+
+        Test: fast/css/font-family-builtins.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::identifierForFamily): Fix typo. Fantasy family should be
+        -webkit-fantasy not, -webkit-serif.
+
+2009-06-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/6936235>
+        Need to support StorageEvent.storageArea to meet the Web Storage spec
+
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::dispatchStorageEvent): Pass the localStorage for
+        the frame being dispatched to.
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::dispatchStorageEvent): Ditto, only for sessionStorage.
+
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::StorageEvent):
+        (WebCore::StorageEvent::initStorageEvent):
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::storageArea):
+        * storage/StorageEvent.idl:
+        Add storageArea member.
+
+2009-06-05  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix WMLInputElement initialization code. Don't call initialize() on attach(), let
+        WMLCardElement handle initialization once, after the document has been parsed.
+
+        To keep layout tests working introduce a new function in Document.idl: initializeWMLPageState().
+        WMLTestCase.js (the wml/ layout test framework) will use it to simulate a regular WML document,
+        whose variable state gets initialized on WMLDocument::finishedParsing(). Force initialization
+        of the WML variable state, right after the dynamically created elements have been inserted into the tree.
+
+        * dom/Document.cpp:
+        (WebCore::Document::initializeWMLPageState):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::WMLDocument::initialize):
+        * wml/WMLDocument.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::initialize):
+        * wml/WMLInputElement.h:
+
+2009-06-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add ononline and onoffline attributes for the <body> element. 
+
+        * html/HTMLAttributeNames.in: Added ononlineAttr and onofflineAttr.
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute): Map ononlineAttr
+        and onofflineAttr to window event listeners.
+
+2009-06-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add missing includes of config.h
+
+        * platform/qt/QWebPopup.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+
+2009-06-05  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26215
+        Try to fix the Chromium build.
+
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs):
+        (WebCore::fillNonBMPGlyphs):
+
+2009-06-05  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Bug 26160: Compile fails in MacOSX when GNU fileutils are installed
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26160>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use /bin/ln instead of ln for cases where this command is used with -h option.
+        As this option is not supported by GNU fileutils, this change helps users 
+        who have GNU fileutils in their PATH.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-06-03  Ben Murdoch  <benm@google.com>
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25710> HTML5 Database stops executing transactions if the URL hash changes while a transaction is open and an XHR is in progress.
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix a bug that causes database transactions to fail if a history navigation to a hash fragment of the same document is made while resources (e.g. an XHR) are loading
+
+        Test: storage/hash-change-with-xhr.html
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::stopLoading):
+        * loader/DocumentLoader.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::stopAllLoaders):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+        * WebCore.base.exp:
+
+2009-06-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make sure the correct config.h is included when shadowbuilding
+
+        * WebCore.pro:
+
+2009-06-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix Qt build after r44452
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-06-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove some dead code (MenuEventProxy)
+
+        * WebCore.pro:
+        * platform/ContextMenu.h:
+        * platform/qt/ContextMenuQt.cpp:
+        * platform/qt/MenuEventProxy.h: Removed.
+
+2009-06-05  Xan Lopez  <xlopez@igalia.com>
+
+        More build fixes.
+
+        * platform/graphics/gtk/GlyphPageTreeNodePango.cpp:
+        (WebCore::GlyphPage::fill):
+
+2009-06-05  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the GTK+ build.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/FontCacheGtk.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        * platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp:
+        (WebCore::GlyphPage::fill):
+
+2009-06-05  Antti Koivisto  <antti@apple.com>
+
+        Try to fix Windows (and possibly other platforms) build.
+
+        Restore ResourceResponseBase::lastModifiedDate() and setLastModifiedDate() removed in previous commit.
+        for now since PluginStream used on some platforms expects them and calculations differ from plain 
+        Last-modified header value.
+        
+        Also include <wtf/MathExtras.h> to get isfinite().
+
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        (WebCore::ResourceResponseBase::setLastModifiedDate):
+        (WebCore::ResourceResponseBase::lastModifiedDate):
+        * platform/network/ResourceResponseBase.h:
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2009-06-03  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13128
+        Safari not obeying cache header
+        
+        Implement RFC 2616 cache expiration calculations in WebKit instead of
+        relying on the networking layer.
+
+        * ForwardingHeaders/runtime/DateMath.h: Added.
+        * WebCore.base.exp:
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidationSucceeded):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::isExpired):
+        (WebCore::CachedResource::currentAge):
+        (WebCore::CachedResource::freshnessLifetime):
+        (WebCore::CachedResource::setResponse):
+        (WebCore::CachedResource::updateResponseAfterRevalidation):
+        (WebCore::CachedResource::mustRevalidate):
+        * loader/CachedResource.h:
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::ResourceResponseBase):
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        (WebCore::ResourceResponseBase::setHTTPHeaderField):
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
+        (WebCore::ResourceResponseBase::cacheControlContainsNoCache):
+        (WebCore::ResourceResponseBase::cacheControlContainsMustRevalidate):
+        (WebCore::ResourceResponseBase::cacheControlMaxAge):
+        (WebCore::parseDateValueInHeader):
+        (WebCore::ResourceResponseBase::date):
+        (WebCore::ResourceResponseBase::age):
+        (WebCore::ResourceResponseBase::expires):
+        (WebCore::ResourceResponseBase::lastModified):
+        (WebCore::ResourceResponseBase::isAttachment):
+        (WebCore::ResourceResponseBase::compare):
+        * platform/network/ResourceResponseBase.h:
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::platformLazyInit):
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26201: Remove superfluous 'if' statements in RenderTable::addChild
+        https://bugs.webkit.org/show_bug.cgi?id=26201
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild): remove superfluous 'if' statements
+       
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26202: add macros for primitive values to simplify CSSStyleSelector::applyProperty
+        https://bugs.webkit.org/show_bug.cgi?id=26202
+
+        * css/CSSStyleSelector.cpp: add HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE[_WITH_VALUE] macros
+        (WebCore::CSSStyleSelector::applyProperty): use new macros
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel
+
+        Bug 26203: Move parsing of 'attr(X)' values to own method
+        https://bugs.webkit.org/show_bug.cgi?id=26203
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAttr): new method
+        (WebCore::CSSParser::parseContent): use new parseAttr method
+        * css/CSSParser.h:
+        (WebCore::CSSParser::parseAttr): new method
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26205: RenderTableSection::addChild : correct comment
+        https://bugs.webkit.org/show_bug.cgi?id=26205
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild): correct comment
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26204: RenderBlock : simplify handleSpecialChild, comment correction
+        https://bugs.webkit.org/show_bug.cgi?id=26204
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleSpecialChild): simplify usage
+        (WebCore::RenderBlock::handlePositionedChild): simplify usage
+        (WebCore::RenderBlock::handleFloatingChild): simplify usage
+        (WebCore::RenderBlock::handleRunInChild): simplify usage
+        (WebCore::RenderBlock::layoutBlock): correct comment
+        (WebCore::RenderBlock::layoutBlockChildren): simplify loop, change call to handleSpecialChild
+        * rendering/RenderBlock.h: 
+        (WebCore::RenderBlock::handleSpecialChild): change signature
+        (WebCore::RenderBlock::handlePositionedChild): change signature
+        (WebCore::RenderBlock::handleFloatingChild): change signature
+        (WebCore::RenderBlock::handleRunInChild): change signature
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - retry to fix the Tiger build
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::initFontData):
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Tiger build
+
+        * platform/graphics/SimpleFontData.h:
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Leopard and Tiger builds
+
+        * platform/graphics/SimpleFontData.h:
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Windows build
+
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::shapeAndPlaceItem):
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - make SimpleFontData's data members private
+        - rename SimpleFontData's m_font member to m_platformData
+
+        * platform/graphics/Font.h:
+        (WebCore::Font::spaceWidth):
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::platformData):
+        (WebCore::SimpleFontData::spaceWidth):
+        (WebCore::SimpleFontData::adjustedSpaceWidth):
+        (WebCore::SimpleFontData::syntheticBoldOffset):
+        (WebCore::SimpleFontData::spaceGlyph):
+        (WebCore::SimpleFontData::getNSFont):
+        (WebCore::SimpleFontData::getQtFont):
+        (WebCore::SimpleFontData::getWxFont):
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::advance):
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::setPangoAttributes):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::setFont):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::setFont):
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::adjustGlyphsAndAdvances):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::initializeATSUStyle):
+        (WebCore::overrideLayoutOperation):
+        (WebCore::ATSULayoutParameters::initialize):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::initFontData):
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::checkShapesArabic):
+        (WebCore::SimpleFontData::getCTFont):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::drawGDIGlyphs):
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::setFont):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::initGDIFont):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::widthForGDIGlyph):
+        (WebCore::SimpleFontData::scriptFontProperties):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-06-04  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize the width of PopupMenuListBox properly for Mac Chromium.
+
+        Added a test that works only with this patch applied. The test is
+        a manual one, since the hit testing infrastructure in the layout
+        tests sends keyboard and mouse events to the main window and not
+        the cocoa control that implements the popup up, which means we can't
+        select items from the popup up.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25904
+
+
+        * manual-tests/select-narrow-width.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::PopupListBox):
+        (WebCore::PopupContainer::showExternal):
+
+2009-06-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed Windows build correction.
+
+        * WebCore.vcproj/WebCore.vcproj: Add missing 'ReplaceNodeWithSpanCommand.cpp'
+          and 'ReplaceNodeWithSpanCommand.h'
+
+2009-02-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Make sure execCommand("bold") on <b style="text-decoration: underline">test</b>
+        only removes the bold and not the underline.
+        https://bugs.webkit.org/show_bug.cgi?id=23496
+
+        Test: editing/execCommand/convert-style-elements-to-spans.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleDeclaration.h:
+        (WebCore::CSSStyleDeclaration::isEmpty):
+        * dom/NamedAttrMap.h:
+        (WebCore::NamedAttrMap::isEmpty):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::isUnstyledStyleSpan):
+        (WebCore::isSpanWithoutAttributesOrUnstyleStyleSpan):
+        (WebCore::ApplyStyleCommand::applyBlockStyle):
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle):
+        (WebCore::ApplyStyleCommand::replaceWithSpanOrRemoveIfWithoutAttributes):
+        (WebCore::ApplyStyleCommand::removeCSSStyle):
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/ApplyStyleCommand.h:
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::replaceNodeWithSpanPreservingChildrenAndAttributes):
+        * editing/CompositeEditCommand.h:
+        * editing/RemoveNodePreservingChildrenCommand.cpp:
+        (WebCore::RemoveNodePreservingChildrenCommand::RemoveNodePreservingChildrenCommand):
+        * editing/ReplaceNodeWithSpanCommand.cpp: Added.
+        (WebCore::ReplaceNodeWithSpanCommand::ReplaceNodeWithSpanCommand):
+        (WebCore::swapInNodePreservingAttributesAndChildren):
+        (WebCore::ReplaceNodeWithSpanCommand::doApply):
+        (WebCore::ReplaceNodeWithSpanCommand::doUnapply):
+        * editing/ReplaceNodeWithSpanCommand.h: Added.
+        (WebCore::ReplaceNodeWithSpanCommand::create):
+
+2009-06-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows Cairo target.
+
+        Add missing post-build command to copy history/cf contents
+        to output directory.
+
+        * WebCore.vcproj/WebCore.vcproj: Update Debug_Cairo and Release_Cairo
+          target post-build steps with copy commands.
+
+2009-06-04  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6854695> Movie controller thumb fails to scale with full page zoom
+        
+        Account for zoom level when drawing media controller thumb on Windows.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::adjustMediaSliderThumbSize):
+
+2009-06-04  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Move DOM window focus/blur out of SelectionController and into FocusController.  Make sure it
+        fires on the focused frame when the page activation state changes also.  This is covered by an existing
+        layout test (albeit badly).  I have modified the test to be correct.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setFocused):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setFocusedFrame):
+        (WebCore::FocusController::setActive):
+
+2009-06-04  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Adding in empty files to stage the extract of RenderThemeChromiumSkia
+        from RenderThemeChromiumLinux and RenderThemeChromiumWindows.
+
+        * rendering/RenderThemeChromiumSkia.cpp: Added.
+        * rendering/RenderThemeChromiumSkia.h: Added.
+
+2009-06-04  Andrei Popescu <andreip@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25562
+        Potential crash after ApplicationCacheStorage::storeNewestCache() fails
+
+              Fix the crash by checking the return value of cacheStorage().storeNewestCache(this)
+              in WebCore::ApplicationCacheGroup::checkIfLoadIsComplete. If storeNewestCache failed,
+              we run the cache failure steps:
+
+        1. Fire the error events to all pending master entries, as well any other cache hosts
+           currently associated with a cache in this group.
+        2. Disassociate the pending master entries from the failed new cache.
+        3. Reinstate the old "newest cache", if there was one.
+
+        We also introduce two other changes:
+
+        1. a mechanism to rollback storageID changes to the in-memory resource
+           objects when the storing of an ApplicationCache object fails.
+
+        2. defer removing the pending master entries from the list of pending master entries
+           until the entire load is complete. This matches the HTML 5 spec better. To track
+           if the load is complete we now introduce a counter for those pending master entries
+           that haven't yet finshed downloading.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::ApplicationCacheGroup): initializes the new counter to 0
+        (WebCore::ApplicationCacheGroup::selectCache): increments the counter when a new pending
+        master entry is added.
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource): decrements the counter
+        instead of removing the pending master entry.
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource): decrements the counter
+        instead of removing the pending master entry.
+        (WebCore::ApplicationCacheGroup::setNewestCache): removes an assertion that no longer
+        holds true. In particular, the newest cache is not necessarily new anymore. We can
+        set an old cache as the new cache. This can happen if we failed to store a newly
+        downloaded cache to the database and we are now reinstating the former newest cache.
+        (WebCore::ApplicationCacheGroup::manifestNotFound): resets the counter to 0.
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): check if the loading is complete
+        based on the counter instead of the list of pending master entries. Empty the list of
+        master entries if the load is complete.
+        * loader/appcache/ApplicationCacheGroup.h: add the new counter.
+        * loader/appcache/ApplicationCacheStorage.cpp: introduce the journaling mechanism for
+        in-memory resource objects.
+        (WebCore::ResourceStorageIDJournal::~ResourceStorageIDJournal):
+        (WebCore::ResourceStorageIDJournal::add):
+        (WebCore::ResourceStorageIDJournal::commit):
+        (WebCore::ResourceStorageIDJournal::Record::Record):
+        (WebCore::ResourceStorageIDJournal::Record::restore):
+        (WebCore::ApplicationCacheStorage::store): log the changes to the in-memory resource
+        objects.
+        (WebCore::ApplicationCacheStorage::storeNewestCache): create the journal object.
+        * loader/appcache/ApplicationCacheStorage.h:  modify the signature of
+        bool store(ApplicationCache*) to add a pointer to the logger object used to
+        trace the changes to the storageID of the resource objects.
+
+2009-06-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26154
+        Allow underscores in the hostnames we parse out of databaseIdentifiers.
+        This code is used for HTML 5 database support.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+
+2009-06-04  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 26084: Multiple missing images in webkit-mask-image prevent rendering
+        https://bugs.webkit.org/show_bug.cgi?id=26084
+
+        When painting multiple images, make sure that at least one image is valid before pushing a transparency layer.
+
+        Added a manual test.
+
+        * manual-tests/mask-composite-missing-images.html: Added.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages):
+
+2009-06-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26180
+        Add a fast path for SecurityOrigin::equal. If "other == this" (where
+        other is the other security origin), then we really don't need to do
+        all the other (expensive) comparisons. We know it's equal.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::equal):
+
+2009-06-03  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Improvements in how selection behaves with focus/activation and a reversion back to using isActive
+        in the scrollbar theme code to remove a Chromium ifdef.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        Make the controller set its focused state correctly upon initial creation.
+
+        (WebCore::SelectionController::setSelection):
+        Make selection willing to shift the focus node if the selection is focused even if the
+        selection is not active.  Whether or not the Page is active is irrelevant to focus changes.
+
+        (WebCore::SelectionController::setFocused):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::isFocused):
+        Add a new isFocused() method so that code can check if the Selection is focused without caring
+        about the active state.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setFocusedNodeIfNeeded):
+        Allow focus shifts even when the selection is not active.
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        Revert Dan's change to directly talk to AppKit for checking active state.  Now that the WebCore isActive
+        method works, ditch the Chromium-specific #ifdef and go back to the original code.
+
+2009-06-04  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Test: media/before-load-member-access.html
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26081
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::played): Ensure that if m_playedTimeRanges,
+        is not initialized we return a valid range, and don't attempt to use it.
+
+2009-06-03  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement a way to invalidate the FontCache used by the Qt port.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::invalidate):
+
+2009-06-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26015
+
+        [Qt] Single-threaded QtWebKit configuration
+
+        Turn off Database, DOM storage, icon database and Web Workers support
+        when ENABLE_SINGLE_THREADED is turned on.
+
+        Set SQLITE_THREADSAFE to false to turn off SQLite mutexes
+        when ENABLE_SINGLE_THREADED is turned on.
+
+        * WebCore.pro:
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - add some assertions that Font methods are used on the main thread
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::setShouldUseSmoothing):
+        * platform/graphics/Font.h:
+        (WebCore::Font::primaryFont):
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        Rolled out apparently-accidental changes to config.h from r44398. These
+        were not part of the patch as reviewed.
+
+        * config.h:
+
+2009-06-03  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26177
+        Reverting 'private' to 'protected' on 2 classes.
+        Chromium glue layer (not yet in Webkit tree) relies on ability to derive
+        Chromium-specific platform classes and access the data members.
+        See bug for more details.
+
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+
+2009-06-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser <simonfr@apple.com>.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=26162
+
+        This corrects an error when destroying an animation
+        or transition where endAnimation was never getting
+        called and therefore the hardware animation was never
+        getting removed.
+
+        This includes a manual-test since it's really impossible
+        to make a meaningful automatic test for an animation
+        bug like this.
+
+        This has no effect unless accelerated compositing is 
+        enabled.
+
+        * manual-tests/interrupted-compound-transform.html: Added.
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::~ImplicitAnimation):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::~KeyframeAnimation):
+
+2009-06-03  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Make the scrollbar thumb size twice the width for Chromium Linux. This
+        matches Firefox on Linux.
+
+        This will need layout test pixel results to be rebaselined in the
+        Chromium tree.
+
+        http://code.google.com/p/chromium/issues/detail?id=12602
+        https://bugs.webkit.org/show_bug.cgi?id=26176
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::minimumThumbLength):
+        * platform/chromium/ScrollbarThemeChromiumLinux.h:
+
+2009-06-03  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Change Chromium scrollbar theme code to use different classes on
+        Windows and Linux rather than suppling symbols. The ScrollbarTheme
+        class is already using virtual dispatch, so there's no reason not to.
+
+        This should not affect any layout tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26174
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        * platform/chromium/ScrollbarThemeChromium.h:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeChromiumLinux::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumLinux::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumLinux::paintButton):
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+        (WebCore::ScrollbarThemeChromiumLinux::buttonSize):
+        * platform/chromium/ScrollbarThemeChromiumLinux.h: Added.
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeChromiumWin::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit):
+        (WebCore::ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin):
+        (WebCore::ScrollbarThemeChromiumWin::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumWin::paintButton):
+        (WebCore::ScrollbarThemeChromiumWin::paintThumb):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeArrowState):
+        (WebCore::ScrollbarThemeChromiumWin::getClassicThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::buttonSize):
+        * platform/chromium/ScrollbarThemeChromiumWin.h: Added.
+
+2009-06-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enabling debugger requires that Scripts panel is already attached to the
+        render tree. The reason is that recompile events result in script sources
+        being added into the source frames. Prior to the global options introduced,
+        debugger was enabled from the Scripts panel, so that it was guaranteed to
+        exist. The InspectorController::enableDebugger API calls with no inspector
+        frontend showing were failing though.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26145
+
+        * WebCore.base.exp:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::enableDebugger):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::attachDebuggerWhenShown):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.attachDebuggerWhenShown):
+        * inspector/front-end/inspector.js:
+        (WebInspector.attachDebuggerWhenShown):
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - fix a regression from the previous patch
+
+        * platform/graphics/Font.cpp: Initialize shouldUseFontSmoothing to true.
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - eliminate WebCoreTextRenderer
+
+        * WebCore.base.exp: Updated.
+        * WebCore.xcodeproj/project.pbxproj: Removed WebCoreTextRenderer.{h,mm}
+            and promoted WebFontCache.h to private.
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::setShouldUseSmoothing): Added this static setter for
+            a new file-static boolean.
+        (WebCore::Font::shouldUseSmoothing): Added this static getter.
+        * platform/graphics/Font.h: Decleared setShouldUseSmoothing() and
+            shouldUseSmoothing().
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs): Use Font::shouldUseSmoothing() instead of
+        WebCoreShouldUseFontSmoothing().
+        * platform/graphics/mac/WebLayer.mm: Removed unneeded #import.
+        * platform/mac/WebCoreTextRenderer.h: Removed.
+        * platform/mac/WebCoreTextRenderer.mm: Removed.
+
+2009-06-03  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        v8's ScriptController::evaluate should protect the Frame like the jsc version.
+        https://bugs.webkit.org/show_bug.cgi?id=26172
+
+        This change is simply copying protections done for Frame in the method
+        WebCore::ScriptController::evaluate in the file js/ScriptController.cpp.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix <rdar://problem/6841120> Use CTFontManager notifications instead
+          of ATS notifications
+
+        * platform/graphics/FontCache.h: Made it an error to destroy a
+        FontCache instance.
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::fontCacheRegisteredFontsChangedNotificationCallback): Added
+        this notification callback for the
+        kCTFontManagerRegisteredFontsChangedNotification, which calls
+        invalidate().
+        (WebCore::FontCache::platformInit): Register for
+        kCTFontManagerRegisteredFontsChangedNotification.
+
+2009-06-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Use CGContextShowGlyphsWithAdvances to get more accurate text rendering on Mac.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26161
+
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+
+2009-06-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Reorder ResourcesPanel components initialization to unfreeze resource list scroller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26159
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+
+2009-06-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        - Fix for crash (preceded by assertion) in InspectorController::didCommitLoad
+          when reloading or navigating with the Inspector open.
+        - Fix for Inspector's Elements panel being empty when Inspector first appears.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26134
+        https://bugs.webkit.org/show_bug.cgi?id=26135
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::ensureResourceTrackingSettingsLoaded):
+        * inspector/InspectorController.h:
+
+2009-06-03  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r44379
+
+        * svg/graphics/SVGImage.cpp: Move EmptyClients.h back down below the
+        other #includes to fix a compiler warning on Windows.
+
+2009-06-02  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add workaround for crash in Linux Flash Player when hosted by
+        another toolkit than GTK+. Bug fixed at the Flash Player bugzilla,
+        issue (FP-2140).
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-06-01  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor the Qt plugin code to use NPP_SetWindow correctly,
+        to make resizing of plugins work.
+
+        Attention was paid to make sure that the windowed plugins scroll
+        synchronized with the page view. A manual test has been added.
+
+        * manual-tests/qt/plugin-iframe.html: Added.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::frameRectsChanged):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::PluginContainerQt):
+        * plugins/qt/PluginContainerQt.h:
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::init):
+
+2009-06-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Bug 26112: viewless WebKit -- make events work
+        https://bugs.webkit.org/show_bug.cgi?id=26112
+
+        The main fix here is to make mouse and wheel event coordinates in the coordinate
+        system of the top level NSView rather than the NSWindow when in the viewless mode.
+        This is the design Hyatt chose, but the event part of it wasn't done yet.
+
+        Also fix FrameView to do normal reference counting instead of a strange model with
+        an explicit deref near creation time.
+
+        * WebCore.base.exp: Updated.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::eventLoopHandleMouseUp): Moved this function into the file
+        to reduce conditionals in the header.
+        (WebCore::EventHandler::eventLoopHandleMouseDragged): Ditto.
+
+        * page/EventHandler.h: Reduced includes. Fixed formatting of Objective-C types.
+        Made currentNSEvent a static member function. Added sendContextMenuEvent and
+        eventMayStartDrag functions that takes NSEvent * so the conversion to PlatformMouseEvent
+        can be done here rather than in WebKit. Reduced #if by making eventLoopHandleMouseUp and
+        eventLoopHandleMouseDragged unconditional.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setView): Made this take a PassRefPtr since it takes ownership.
+        (WebCore::Frame::createView): Changed to use RefPtr and FrameView::create and remove
+        the explicit deref.
+
+        * page/Frame.h: Changed setView to take a PassRefPtr.
+
+        * page/FrameTree.cpp: Added newly-needed include.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView): Got rid of one of the two constructors, and removed
+        the initialization of m_refCount and call to show from the reamining one.
+        (WebCore::FrameView::create): Added two create functions that do what the two
+        constructors did before, except that they return a PassRefPtr to make sure the
+        reference counting is handled correctly.
+        (WebCore::FrameView::~FrameView): Removed assertion from when FrameView implemented
+        its own reference counting.
+
+        * page/FrameView.h: Inherit from RefCounted for reference counting. Made the
+        constructor private and added create functions. Got rid of the hand-implemented
+        reference counting in this class.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::currentNSEventSlot): Renamed currentEvent to currentNSEventSlot to
+        make it more clear how it relates to currentNSEvent.
+        (WebCore::EventHandler::currentNSEvent): Updated.
+        (WebCore::CurrentEventScope::CurrentEventScope): Added. Use to set/reset the
+        current event in a foolproof way.
+        (WebCore::CurrentEventScope::~CurrentEventScope): Ditto.
+        (WebCore::EventHandler::wheelEvent): Use CurrentEventScope. Pass the platform
+        window in when constructing the PlatformWheelEvent.
+        (WebCore::EventHandler::keyEvent): Use CurrentEventScope.
+        (WebCore::lastEventIsMouseUp): Use currentNSEvent.
+        (WebCore::EventHandler::passMouseDownEventToWidget): Ditto.
+        (WebCore::EventHandler::eventLoopHandleMouseDragged): Ditto.
+        (WebCore::EventHandler::eventLoopHandleMouseUp): Ditto.
+        (WebCore::EventHandler::passSubframeEventToSubframe): Use
+        currentPlatformMouseEvent to get a mouse event that has the appropriate
+        platform window passed to create it.
+        (WebCore::EventHandler::passWheelEventToWidget): Ditto.
+        (WebCore::EventHandler::mouseDown): Ditto.
+        (WebCore::EventHandler::mouseDragged): Ditto.
+        (WebCore::EventHandler::mouseUp): Ditto.
+        (WebCore::EventHandler::mouseMoved): Ditto.
+        (WebCore::EventHandler::currentPlatformMouseEvent): Added. Passes the
+        platform window that's now needed to create a PlatformMouseEvent.
+        (WebCore::EventHandler::sendContextMenuEvent): Added.
+        (WebCore::EventHandler::eventMayStartDrag): Added.
+
+        * platform/HostWindow.h: Removed unneeded includes and constructor definition.
+
+        * platform/PlatformMouseEvent.h: Sorted things in alphabetical order.
+        Changed Mac constructor to take a windowView as well as the event. This is
+        needed in viewless mode, since the "window" is actually an NSView, so the
+        event has to know which view to compute the coordinates with. Made the
+        same change to pointForEvent.
+        * platform/PlatformWheelEvent.h: Ditto.
+
+        * platform/mac/PlatformMouseEventMac.mm:
+        (WebCore::pointForEvent): Convert point from window coordinates to view
+        coordinates if a windowView is passed in. This is used in viewless mode.
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent): Ditto.
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Ditto.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::convertFromContainingWindow): Fixed case where there
+        is no platform widget and no parent. Before it would yield unpredictable
+        results because of dispatching to a nil object and returning a structure.
+        Now it returns the point without changing coordinates at all, which is what
+        we need for this case in viewless mode.
+
+        * rendering/RenderApplet.cpp: Removed unneeded includes.
+        (WebCore::RenderApplet::intrinsicSize): Use widget function.
+        (WebCore::RenderApplet::createWidgetIfNecessary): Ditto.
+
+        * rendering/RenderApplet.h: Make more things private. Get rid of unneeded
+        explicit destructor.
+
+        * rendering/RenderFrame.cpp: Removed unneeded includes.
+        (WebCore::RenderFrame::edgeInfo): Updated to use node function so header
+        doesn't have to define element function.
+        (WebCore::RenderFrame::viewCleared): Ditto. Also changed to use widget
+        function.
+
+        * rendering/RenderFrame.h: Removed unneeded includes. Made some things
+        private. Got rid of element function.
+
+        * rendering/RenderPart.cpp: Removed unneeded includes.
+        (WebCore::RenderPart::~RenderPart): Changed to use clearWidget function.
+        (WebCore::RenderPart::setWidget): Changed to use widget function.
+        (WebCore::RenderPart::deleteWidget): Changed to use passed-in widget.
+        This is now only called by the clearWidget function.
+
+        * rendering/RenderPart.h: Removed unneeded forward declarations.
+        Made more functions private. Updated deleteWidget to take widget argument.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::~RenderPartObject): use frameView function
+        instead of getting at m_view directly.
+        (WebCore::RenderPartObject::updateWidget): Ditto.
+        (WebCore::RenderPartObject::layout): Ditto. Same for widget and m_widget.
+        (WebCore::RenderPartObject::viewCleared): Ditto.
+
+        * rendering/RenderPartObject.h: Made some functions private.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::RenderWidget): Initialize m_frameView with
+        construction syntax instead of assignment.
+        (WebCore::RenderWidget::destroy): Updated for name change of m_view
+        to m_frameView.
+        (WebCore::RenderWidget::~RenderWidget): Use clearWidget to delete
+        the widget.
+        (WebCore::RenderWidget::setWidget): Use clearWidget.
+        (WebCore::RenderWidget::paint): Updated for name change of m_view
+        to m_frameView.
+        (WebCore::RenderWidget::deleteWidget): Changed to use passed-in widget.
+
+        * rendering/RenderWidget.h: Made many functions protected, others
+        private and made all data members private.
+
+        * svg/animation/SMILTime.h: Removed unhelpful max and min functions. These
+        just do what std::max and std::min will already do automatically for this
+        type, so they are not helpful.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::SVGImage): Removed unneeded initial values for types
+        that initialize to zero without anything explicit.
+        (WebCore::SVGImage::~SVGImage): Update since m_frame and m_frameView are
+        no longer stored.
+        (WebCore::SVGImage::setContainerSize): Ditto.
+        (WebCore::SVGImage::usesContainerSize): Ditto.
+        (WebCore::SVGImage::size): Ditto.
+        (WebCore::SVGImage::hasRelativeWidth): Ditto.
+        (WebCore::SVGImage::hasRelativeHeight): Ditto.
+        (WebCore::SVGImage::draw): Ditto.
+        (WebCore::SVGImage::nativeImageForCurrentFrame): Ditto.
+        (WebCore::SVGImage::dataChanged): Ditto.
+
+        * svg/graphics/SVGImage.h: Removed unneeded includes and unneeded data
+        members m_document, m_frame, m_frameView, and m_minSize.
+
+2009-06-02  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        The previous code was assuming that we'll be painting buttons on the scrollbar
+        which isn't true on Linux. To reproduce, resize a page with scrollbars until
+        they are less than two widths high.
+
+        This will need pixel test baselines to be updated in the Chromium tree.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp: move this function...
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromium::trackRect): ... to here
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::trackRect): add an alternative which
+        doesn't remove the track when the scrollbar is less than two widths
+        high.
+
+2009-06-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove workaround that was added to address <rdar://problem/5488678> as it no longer affects our Tiger builds.
+
+        * Configurations/Base.xcconfig:
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Insert*List on an stand-alone image in a content editable region ASSERTS
+        ASSERTION FAILED: isStartOfParagraph(startOfParagraphToMove)
+        https://bugs.webkit.org/show_bug.cgi?id=19066
+
+        Attempt to fix this by noticing that we inserted the list inside
+        the selection which includes the image, and re-adjust the selection
+        to not include the list before trying to move the image into
+        the list item.
+        
+        Test: editing/execCommand/list-wrapping-image-crash.html
+
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename PositionIterator members in hope of further clarity
+        https://bugs.webkit.org/show_bug.cgi?id=24854
+
+        Rename m_parent to m_anchorNode (since although it's always the parent
+        of the previous m_child member, it is not always the parent of the effective position)
+        Rename m_child to m_nodeAfterPositionInAnchor to make clear that it's the node
+        directly following the position.  This member is often NULL, but is always
+        a child of m_parent, now m_anchorNode if set.
+        Rename m_offset to m_offsetInAnchor (since it's interpreted relative to m_anchorNode)
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        (WebCore::PositionIterator::increment):
+        (WebCore::PositionIterator::decrement):
+        (WebCore::PositionIterator::atStart):
+        (WebCore::PositionIterator::atEnd):
+        (WebCore::PositionIterator::atStartOfNode):
+        (WebCore::PositionIterator::atEndOfNode):
+        (WebCore::PositionIterator::isCandidate):
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator):
+        (WebCore::PositionIterator::node):
+        (WebCore::PositionIterator::offsetInLeafNode):
+
+2009-06-02  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 17167: Failures in fast/dom/Node/initial-values.html
+
+        This partly solve a compatibility issue with other browsers. It will also
+        make us more consistent while handling XHTML element.
+
+        The issue is that when we create an XHTML element inside an HTML document
+        (as it is the case when calling createElementNS), we default to the HTML
+        behaviour in nodeName. As we cannot test if an HTMLElement is an XHTML
+        element, our fix is to check whether it has a prefix and then default
+        to XML behaviour for nodeName.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::nodeName): Add a prefix check before
+        returning the uppercase tagName (HTML behaviour).
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a compareBoundaryPoints which takes RangeBoundaryPoints
+        https://bugs.webkit.org/show_bug.cgi?id=25500
+
+        I noticed the need for this function when removing compareBoundaryPoints(Position, Position)
+        This patch is almost entirely minus lines.
+
+        No functional changes, thus no tests.
+
+        * dom/Range.cpp:
+        (WebCore::Range::setStart):
+        (WebCore::Range::setEnd):
+        (WebCore::Range::compareBoundaryPoints):
+        (WebCore::Range::boundaryPointsValid):
+        * dom/Range.h:
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove Range::compareBoundaryPoints(Position, Position) per Darin's suggestion in bug 25056
+        https://bugs.webkit.org/show_bug.cgi?id=25500
+
+        Darin indicated the Range should deal only with primitive DOM node/offset
+        pairs, and that Position (which is a more robust editing construct) should have
+        its own comparison functions and that Range.h should not mention Position at all.
+
+        Turns out that Position already has a comparePositions() function (which knows
+        how to additionally handled positions in shadow trees).  So I've just changed
+        all callers of compareBoundaryPoints(Position, Position) to use the existing
+        comparePositions() function.  I've also added a comparePositions which takes
+        VisiblePositions for convenience.
+
+        * dom/Range.cpp:
+        * dom/Range.h:
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::updateStartEnd):
+        (WebCore::ApplyStyleCommand::applyBlockStyle):
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::nodeFullySelected):
+        (WebCore::ApplyStyleCommand::nodeFullyUnselected):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::mergeParagraphs):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::toNormalizedRange):
+        * editing/htmlediting.cpp:
+        (WebCore::comparePositions):
+        * editing/htmlediting.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+
+2009-06-02  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26122
+        Upstream v8_utility.h functions into V8Utilities.h.  This patch has
+        some transitional code to make upstreaming easier.  This code will
+        be deleted in a few days.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct): NewInstance -> newInstance.
+        * bindings/v8/V8Utilities.h:
+        (WebCore::AllowAllocation::AllowAllocation): Function added.
+        (WebCore::AllowAllocation::~AllowAllocation): Function added.
+        (WebCore::SafeAllocation::NewInstance): Function added.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        NewInstance -> newInstance.
+        (WebCore::WorkerContextExecutionProxy::toV8): NewInstance ->
+        newInstance.
+
+2009-06-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix <rdar://problem/6940747> Search field’s focus ring is outset
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::adjustSearchFieldStyle): Set the focused
+        search field outline offset to -2.
+
+2009-06-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add list of unimplemented event handlers to DOMWindow.
+
+        * page/DOMWindow.idl:
+
+2009-06-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26133
+        Adapt and import py-dom-xpath tests
+
+        Tests: fast/xpath/py-dom-xpath/abbreviations.html
+               fast/xpath/py-dom-xpath/axes.html
+               fast/xpath/py-dom-xpath/data.html
+               fast/xpath/py-dom-xpath/expressions.html
+               fast/xpath/py-dom-xpath/functions.html
+               fast/xpath/py-dom-xpath/nodetests.html
+               fast/xpath/py-dom-xpath/paths.html
+               fast/xpath/py-dom-xpath/predicates.html
+
+        Fix bugs found with this test suite:
+        - name and local-name were incorrect for processing instructions (XPath expanded-name
+        doesn't match DOM exactly);
+        - name, local-name and namespace functions should crash on attribute nodes;
+        - attemps to make node sets from other types were not detected as errors.
+
+        No performance impact.
+
+        * xml/XPathExpressionNode.h: Track type conversion errors that happen during evaluation.
+        An error won't stop evaluation, but an exception will be raised afterwards. We could also
+        detect conversion errors at compile time, but not if we're going to support XPath variables
+        (which is unnecessary for XPathEvaluator, but will be necessary if we decide to make our own
+        XSLT one day).
+
+        * xml/XPathExpression.cpp: (WebCore::XPathExpression::evaluate): Check whether a type
+        conversion exception occurred during evaluation, and raise an excpetion if it did.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::expandedNameLocalPart):
+        (WebCore::XPath::expandedName):
+        XPath name(), local-name() and namespace-uri() functions are defined in terms of expanded-name,
+        which doesn't match anything available via DOM exactly. Calculate the expanded name properly.
+        (WebCore::XPath::FunNamespaceURI::evaluate): This function could crash if used with an
+        attribute node, because it released what was possibly the only reference to attribute node
+        before using it. Changed the function to avoid such situation.
+        (WebCore::XPath::FunLocalName::evaluate): Ditto. Also, used the new expandedNameLocalPart()
+        to work properly with processing instruction nodes.
+        (WebCore::XPath::FunName::evaluate): Ditto (using expandedName()).
+        (WebCore::XPath::FunCount::evaluate): Signal an error if the argument is not a node-set
+        (by using toNodeSet unconditionally, which will raise an error, and return an empty set).
+
+        * xml/XPathPath.cpp: (WebCore::XPath::Filter::evaluate): Signal an error if the expression
+        evaluation result is not a node-set.
+
+        * xml/XPathPath.h: (WebCore::XPath::Filter::resultType): A Filter's result is actually
+        always a node-set (this is not so for FilterExpr production in the spec, but is for us,
+        because we don't naively map BNF productions to classes).
+
+        * xml/XPathPredicate.cpp: (WebCore::XPath::Union::evaluate): Signal an error if either side
+        is not a node-set.
+
+        * xml/XPathStep.cpp: Removed an unnecesary include.
+
+        * xml/XPathValue.cpp:
+        (WebCore::XPath::Value::toNodeSet): Signal an error if conversion fails.
+        (WebCore::XPath::Value::modifiableNodeSet): Ditto.
+        (WebCore::XPath::Value::toNumber): Don't allow inputs that don't match XPath Number production
+        (in particular, those using exponential notation).
+
+2009-06-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Part of https://bugs.webkit.org/show_bug.cgi?id=26100
+        Add missing event handler properties to the DOMWindow
+
+        Added oncontextmenu, oninput, and onmessage event handlers to
+        the DOMWindow. Aditionally, the onloadstart, onprogress, onstalled,
+        and onsuspend event handlers were implemented but not added to
+        DOMWindow.idl.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::oninput):
+        (WebCore::DOMWindow::setOninput):
+        (WebCore::DOMWindow::onmessage):
+        (WebCore::DOMWindow::setOnmessage):
+        (WebCore::DOMWindow::oncontextmenu):
+        (WebCore::DOMWindow::setOncontextmenu):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-06-01  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26123
+
+        Remove a redundant checkEncodedString call when constructing a
+        KURL object from a string.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL):
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Reposition platform guard, improperly placed by http://trac.webkit.org/changeset/44340
+        Bad Dimitri.
+
+        * platform/KeyboardCodes.h: Repositioned the guard to avoid nested
+            WebCore namespace declarations.
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        * platform/KeyboardCodes.h: Integrated contents of platform/chromium/KeyboardCodes.h
+            with a stern FIXME.
+        * platform/chromium/KeyboardCodes.h: Removed.
+
+2009-06-01  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix assertion error in --filters enabled debug builds.
+        Instead of using RefPtr<AtomicStringImpl> as keys for the hash maps in SVGFilterBuilder, just use AtomicString objects.
+
+        * svg/graphics/filters/SVGFilterBuilder.cpp:
+        (WebCore::SVGFilterBuilder::SVGFilterBuilder):
+        (WebCore::SVGFilterBuilder::add):
+        (WebCore::SVGFilterBuilder::getEffectById):
+        * svg/graphics/filters/SVGFilterBuilder.h:
+
+2009-06-01  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix --filters enabled build on Mac.
+        Remove unnecessary 'boundingBox' parameter from finishRenderSVGContent() method.
+        Kill several warnings, to make build pass.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkEndCallback):
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::setStdDeviation):
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix Chromium build by adding an #ifdef, restoring the code path to that
+        before http://trac.webkit.org/changeset/44287.
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint): Added an #ifdef.
+
+2009-06-01  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Remove last pieces of the old SVG filter system. They are not
+        usable with our current filter system. The new filter effects
+        will replace the functionality step by step.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/graphics/cairo: Removed.
+        * svg/graphics/cairo/SVGResourceFilterCairo.cpp: Removed.
+        * svg/graphics/cg: Removed.
+        * svg/graphics/cg/SVGResourceFilterCg.cpp: Removed.
+        * svg/graphics/cg/SVGResourceFilterCg.mm: Removed.
+        * svg/graphics/filters/SVGFilterEffect.cpp: Removed.
+        * svg/graphics/filters/SVGFilterEffect.h: Removed.
+        * svg/graphics/filters/cg: Removed.
+        * svg/graphics/filters/cg/SVGFEHelpersCg.h: Removed.
+        * svg/graphics/filters/cg/SVGFEHelpersCg.mm: Removed.
+        * svg/graphics/filters/cg/SVGFilterEffectCg.mm: Removed.
+        * svg/graphics/filters/cg/WKArithmeticFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKArithmeticFilter.h: Removed.
+        * svg/graphics/filters/cg/WKArithmeticFilter.m: Removed.
+        * svg/graphics/filters/cg/WKComponentMergeFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKComponentMergeFilter.h: Removed.
+        * svg/graphics/filters/cg/WKComponentMergeFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDistantLightFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDistantLightFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDistantLightFilter.m: Removed.
+        * svg/graphics/filters/cg/WKGammaTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKGammaTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKGammaTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKLinearTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKLinearTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKLinearTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKNormalMapFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKNormalMapFilter.h: Removed.
+        * svg/graphics/filters/cg/WKNormalMapFilter.m: Removed.
+        * svg/graphics/filters/cg/WKPointLightFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKPointLightFilter.h: Removed.
+        * svg/graphics/filters/cg/WKPointLightFilter.m: Removed.
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.h: Removed.
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.m: Removed.
+        * svg/graphics/filters/cg/WKSpotLightFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKSpotLightFilter.h: Removed.
+        * svg/graphics/filters/cg/WKSpotLightFilter.m: Removed.
+        * svg/graphics/filters/cg/WKTableTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKTableTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKTableTransferFilter.m: Removed.
+        * svg/graphics/mac: Removed.
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.h: Removed.
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.mm: Removed.
+        * svg/graphics/qt: Removed.
+        * svg/graphics/qt/SVGResourceFilterQt.cpp: Removed.
+        * svg/graphics/skia: Removed.
+        * svg/graphics/skia/SVGResourceFilterSkia.cpp: Removed.
+
+2009-06-01  Dmitry Titov  <dimich@chromium.org>
+
+        Fix the previous checkin (ttp://trac.webkit.org/changeset/44327).
+        This adds a comment suggested during review.
+
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::~ThreadGlobalData): Add comment clarifying the change.
+
+2009-06-01  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25973
+        Avoid calling CurrentThread() in thread-specific destructors in OSX Chromium.
+        Pthreads invoke thread-specific destructors after WTF::detachThread() is called and ThreadIdentifier
+        for the thread removed from the WTF thread map. Calling CurrentThread() in such destructor causes
+        the ThreadIdentifier to be re-created and inserted into the map again. Since Pthreads on OSX reuse
+        the pthread_t between threads, the next created thread will have the same pthread_t and cause an assert
+        in establishIdentifierForPthreadHandle() since the id is already in the map.
+
+        The behavior is covered by existing test LayoutTests/fast/workers/worker-terminate.html, which currently fails
+        on OSX Chromium and will stop failing after this change.
+
+        * platform/ThreadGlobalData.h:
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        Store the result of "isMainThread()" in a member variable during construction of thread-specific data
+        to avoid calling IsMainThread() in destructor, since the latter calls CurrentThread() in OSX Chromium.
+
+2009-06-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Alder and Maciej Stachowiak.
+
+        Bug 26057: StringImpl should share buffers with UString.
+        https://bugs.webkit.org/show_bug.cgi?id=26057
+
+        This change results in the following performance improvements:
+        On http://www.hixie.ch/tests/adhoc/perf/dom/artificial/core/001.html
+        the time went from 78ms to 40ms for append (other times remained constant).
+
+        On http://www.hixie.ch/tests/adhoc/perf/dom/artificial/core/002.html,
+        the time went from 3900ms to 2600ms.
+
+        For http://dromaeo.com/?dom, the time for DomModification improved by ~6%.
+        Other tests in dom seemed to be faster across several runs but within the
+        margin of error (except DOM Attributes which was slightly ~1.5% worse).
+
+        Existing tests cover this code and there is no new functionality
+        that is exposed to test.
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        * platform/text/String.cpp:
+        (WebCore::String::String):
+        (WebCore::String::operator UString):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create): Consumes a shared buffer.
+        (WebCore::StringImpl::ustring): Shares the StringImpl's buffer with the UString.
+        (WebCore::StringImpl::sharedBuffer): Exposes the buffer that may be shared.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable): Converted the bools to be inside of PtrAndFlags
+        to avoid growing StringImpl in size.
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        V8 bindings follow-up to to DOMWindow-related cleanup:
+        http://trac.webkit.org/changeset/44215
+
+        * bindings/v8/ScriptController.cpp: Removed disconnectFrame(), relocated
+            its body to destructor.
+        * bindings/v8/ScriptController.h: Removed disconnectFrame() decl.
+
+2009-05-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        - Add panel enabler to the resources panel.
+        - Add session / always options into the panel enabler.
+        - Make enabled status for three panels sticky (globally).
+        - Persist enabled status using InspectorController::Settings
+        - Make InspectorController produce no network-related overhead when
+          resources panel is not enabled.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26046
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::enableResourceTracking):
+        (WebCore::InspectorController::disableResourceTracking):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::disableDebugger):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::Setting::Setting):
+        (WebCore::InspectorController::resourceTrackingEnabled):
+        * inspector/InspectorController.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::resourceTrackingWasEnabled):
+        (WebCore::InspectorFrontend::resourceTrackingWasDisabled):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/PanelEnablerView.js:
+        (WebInspector.PanelEnablerView.enableOption):
+        (WebInspector.PanelEnablerView):
+        (WebInspector.PanelEnablerView.prototype._windowResized):
+        (WebInspector.PanelEnablerView.prototype.alwaysWasChosen):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._enableProfiling):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasEnabled):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasDisabled):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateSidebarWidth):
+        (WebInspector.ResourcesPanel.prototype._enableResourceTracking):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._enableDebugging):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.resourceTrackingWasEnabled):
+        (WebInspector.resourceTrackingWasDisabled):
+
+2009-06-01  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.  Landed (and tweaked) by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25902
+
+        Added WorkerContext.close()
+
+        Test: fast/workers/worker-close.html
+
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::close):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::workerContextDestroyedInternal):
+
+2009-06-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=12471
+        XPathResult not invalidated for documents retrieved via XMLHttpRequest
+
+        Test: fast/xpath/detached-subtree-invalidate-iterator.html and existing tests in dom/svg/level3/xpath.
+
+        Use DOM tree version instead of DOMSubtreeModified events to invalidate, which is more
+        reliable and much faster.
+
+        * xml/XPathExpression.cpp:
+        (WebCore::XPathExpression::evaluate):
+        * xml/XPathResult.cpp:
+        (WebCore::XPathResult::XPathResult):
+        (WebCore::XPathResult::~XPathResult):
+        (WebCore::XPathResult::invalidIteratorState):
+        (WebCore::XPathResult::iterateNext):
+        * xml/XPathResult.h:
+        (WebCore::XPathResult::create):
+
+2009-06-01  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Darin Adler.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25750
+
+        Test: fast/transforms/bounding-rect-zoom.html
+
+        Make getClientRects and getBoundingClientRect account for ther zoom
+        factor.
+
+        * dom/Element.cpp:
+        (WebCore::adjustFloatPointForAbsoluteZoom):
+        (WebCore::adjustFloatQuadForAbsoluteZoom):
+        (WebCore::adjustIntRectForAbsoluteZoom):
+        (WebCore::Element::getClientRects):
+        (WebCore::Element::getBoundingClientRect):
+
+2009-06-01  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Dimitri Glazkov.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26026
+
+        Fix an infinite loop when using the keyboard in Chromium select
+        popups.
+
+        Not testable since it involves sending a keyboard event to
+        the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        * platform/chromium/PopupMenuChromium.cpp:
+
+2009-06-01  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.  Landed by Adam Barth.
+
+        If a url with an anchor is being loaded, ensure that the anchor remains locked in view until the page
+        has finished loading compeltely or the user has manually scrolled.  Refreshing an anchor url after
+        scrolling to a new location on the page will still result in jumping to the new location.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26034
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::gotoAnchor): Set anchor lock after navigating to anchor.
+        (WebCore::FrameLoader::completed): Release anchor lock.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView): Ensure anchor lock starts unset.
+        (WebCore::FrameView::reset): Ensure anchor lock starts unset.
+        (WebCore::FrameView::layout): If anchor lock is set, force a gotoAnchor() after layout.
+        (WebCore::FrameView::scrollRectIntoViewRecursively): Release anchor lock if a programmatic scroll begins.
+        (WebCore::FrameView::setWasScrolledByUser): Release anchor lock if user manually scrolls.
+        (WebCore::FrameView::setScrollPosition): Release anchor lock if a programmatic scroll begins.
+        * page/FrameView.h:
+        (WebCore::FrameView::lockedToAnchor): Added.
+        (WebCore::FrameView::setLockedToAnchor): Added.
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        A short clean-up. FilterBuilder is SVG specific. Move it
+        to svg/graphics/filters and rename it to SVGFilterBuilder. 
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/FilterBuilder.cpp: Removed.
+        * svg/FilterBuilder.h: Removed.
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::builder):
+        * svg/graphics/filters/SVGFilterBuilder.cpp: Added.
+        (WebCore::SVGFilterBuilder::SVGFilterBuilder):
+        (WebCore::SVGFilterBuilder::add):
+        (WebCore::SVGFilterBuilder::getEffectById):
+        (WebCore::SVGFilterBuilder::clearEffects):
+        * svg/graphics/filters/SVGFilterBuilder.h: Added.
+        (WebCore::SVGFilterBuilder::lastEffect):
+
+2009-05-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13233
+        Need to implement an optimizing XPath evaluator
+
+        Avoid sorting results of hierarchical paths that are naturally sorted. On a flat data structure
+        with 128K nodes and a simple XPath expression, this changes evaluation time from 1.5 minutes
+        to 33 ms.
+
+        * xml/XPathNodeSet.h: Keep track of whether subtrees rooted at nodes in set are disjoint,
+        which is useful for optimization.
+        (WebCore::XPath::NodeSet::NodeSet): Removed, it was identical to compiler generated one.
+        (WebCore::XPath::NodeSet::operator=): Ditto.
+        (WebCore::XPath::NodeSet::swap): Ditto.
+        (WebCore::XPath::NodeSet::isSorted): Single element sets are always sorted, even if sort()
+        was never called.
+        (WebCore::XPath::NodeSet::markSubtreesDisjoint): Just like being sorted, the new flag is
+        maintained by callers.
+        (WebCore::XPath::NodeSet::subtreesAreDisjoint): A single element set only has one subtree.
+        Currently, the only way for a set to gain this flag is to be produced from a single element
+        set with a hierarchical location path.
+
+        * xml/XPathPath.cpp: (WebCore::XPath::LocationPath::evaluate): Use the new flag to avoid
+        maintaining a set of unique nodes, and to avoid sorting the result.
+
+2009-05-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13233
+        Need to implement an optimizing XPath evaluator
+
+        This patch adds some infrastructure and simple optimizations. Namely,
+        - we now avoid building a full NodeSet just to evaluate a predicate in some cases;
+        - "/descendant-or-self::node()/child::" is optimized to iterate the tree once when possible;
+
+        * xml/XPathExpressionNode.cpp:
+        (WebCore::XPath::Expression::Expression):
+        * xml/XPathExpressionNode.h:
+        (WebCore::XPath::Expression::addSubExpression):
+        (WebCore::XPath::Expression::isContextNodeSensitive):
+        (WebCore::XPath::Expression::isContextPositionSensitive):
+        (WebCore::XPath::Expression::isContextSizeSensitive):
+        (WebCore::XPath::Expression::setIsContextNodeSensitive):
+        (WebCore::XPath::Expression::setIsContextPositionSensitive):
+        (WebCore::XPath::Expression::setIsContextSizeSensitive):
+        XPath expression now knows its result type, and whether evaluation depends on context.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLast::resultType):
+        (WebCore::XPath::FunLast::FunLast):
+        (WebCore::XPath::FunPosition::resultType):
+        (WebCore::XPath::FunPosition::FunPosition):
+        (WebCore::XPath::FunCount::resultType):
+        (WebCore::XPath::FunId::resultType):
+        (WebCore::XPath::FunLocalName::resultType):
+        (WebCore::XPath::FunLocalName::FunLocalName):
+        (WebCore::XPath::FunNamespaceURI::resultType):
+        (WebCore::XPath::FunNamespaceURI::FunNamespaceURI):
+        (WebCore::XPath::FunName::resultType):
+        (WebCore::XPath::FunName::FunName):
+        (WebCore::XPath::FunString::resultType):
+        (WebCore::XPath::FunString::FunString):
+        (WebCore::XPath::FunConcat::resultType):
+        (WebCore::XPath::FunStartsWith::resultType):
+        (WebCore::XPath::FunContains::resultType):
+        (WebCore::XPath::FunSubstringBefore::resultType):
+        (WebCore::XPath::FunSubstringAfter::resultType):
+        (WebCore::XPath::FunSubstring::resultType):
+        (WebCore::XPath::FunStringLength::resultType):
+        (WebCore::XPath::FunStringLength::FunStringLength):
+        (WebCore::XPath::FunNormalizeSpace::resultType):
+        (WebCore::XPath::FunNormalizeSpace::FunNormalizeSpace):
+        (WebCore::XPath::FunTranslate::resultType):
+        (WebCore::XPath::FunBoolean::resultType):
+        (WebCore::XPath::FunNot::resultType):
+        (WebCore::XPath::FunTrue::resultType):
+        (WebCore::XPath::FunFalse::resultType):
+        (WebCore::XPath::FunLang::resultType):
+        (WebCore::XPath::FunLang::FunLang):
+        (WebCore::XPath::FunNumber::resultType):
+        (WebCore::XPath::FunNumber::FunNumber):
+        (WebCore::XPath::FunSum::resultType):
+        (WebCore::XPath::FunFloor::resultType):
+        (WebCore::XPath::FunCeiling::resultType):
+        (WebCore::XPath::FunRound::resultType):
+        (WebCore::XPath::Function::setArguments):
+        Set optimization details for the expression. Normally, a function does not introduce context
+        node set dependency, but some use context node as default argument, or otherwise use the context.
+
+        * xml/XPathFunctions.h: Tweaked style.
+
+        * xml/XPathPath.cpp:
+        (WebCore::XPath::Filter::Filter): A filter is as context node set sensitive as its expression is.
+        (WebCore::XPath::LocationPath::LocationPath): A location path can only be context node sensitive,
+        and only if the path relative.
+        (WebCore::XPath::LocationPath::appendStep): Invoke compile-time Step optimizations.
+        (WebCore::XPath::LocationPath::insertFirstStep): Ditto.
+        (WebCore::XPath::Path::Path): A path is as context node set sensitive as its filter is.
+
+        * xml/XPathPath.h:
+        (WebCore::XPath::Filter::resultType): Result type of a filter is the same as of its expression
+        (useful filters return NodeSets, of course).
+        (WebCore::XPath::LocationPath::setAbsolute): An absolute location path if context node set
+        insensitive.
+        (WebCore::XPath::LocationPath::resultType): A path's result is always a node set.
+        (WebCore::XPath::Path::resultType): Ditto.
+
+        * xml/XPathPredicate.h:
+        (WebCore::XPath::Number::resultType): Return a proper result type.
+        (WebCore::XPath::StringExpression::resultType): Ditto.
+        (WebCore::XPath::Negative::resultType): Ditto.
+        (WebCore::XPath::NumericOp::resultType): Ditto.
+        (WebCore::XPath::EqTestOp::resultType): Ditto.
+        (WebCore::XPath::LogicalOp::resultType): Ditto.
+        (WebCore::XPath::Union::resultType): Ditto.
+        (WebCore::XPath::Predicate::isContextPositionSensitive): A predicate can be context position
+        sensitive even if its expression is not, because e.g. [5] is a shortcut for [position()=5].
+        (WebCore::XPath::Predicate::isContextSizeSensitive): This matches expression result.
+
+        * xml/XPathStep.h:
+        (WebCore::XPath::Step::NodeTest::Kind): Removed unused ElementNodeTest, which was previously
+        borrowed from XPath 2.0 to express some optimizations.
+        (WebCore::XPath::Step::NodeTest::mergedPredicates): To avoid building a huge node set and
+        filtering it with predicates, we now try to apply predicates while enumerating an axis.
+        (WebCore::XPath::Step::nodeTest): Expose m_nodeTest.
+
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::Step::~Step): The step owns NodeTest merged predicates, so it is still
+        possible to copy NodeTests.
+        (WebCore::XPath::Step::optimize): Merge predicates into NodeTest if possible.
+        (WebCore::XPath::optimizeStepPair): Optimize some expressions containing "//".
+        (WebCore::XPath::Step::predicatesAreContextListInsensitive): The above optimization is only
+        possible if there are no context sensitive predicates for "//".
+        (WebCore::XPath::Step::evaluate): Track context position for the first merged predicate.
+        (WebCore::XPath::nodeMatchesBasicTest): Check whether the node matches node test, ignoring
+        merged predicates.
+        (WebCore::XPath::nodeMatches): Additionally check merged predicates, and update position.
+        (WebCore::XPath::Step::nodesInAxis): Check merged predicates in optimized attribute code
+        path.
+
+        * xml/XPathVariableReference.h: (WebCore::XPath::VariableReference::resultType): Variable
+        references are not used with XPathEvaluator, so we'll only need them if we decide to
+        reimplement XSLT. The type of variable reference is not known at compile time.
+
+2009-05-31  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Remove unused JSEventTargetBase.h
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventTargetBase.h: Removed.
+
+2009-05-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Part of https://bugs.webkit.org/show_bug.cgi?id=26100
+        Add missing event handler properties to the DOMWindow
+
+        Add missing oncanplay, oncanplaythrough, ondurationchange, onemptied,
+        onended, onloadeddata, onloadedmetadata, onpause, onplay, onplaying,
+        onratechange, onseeked, onseeking, ontimeupdate, onvolumechange,
+        onwaiting, onloadstart, onprogress, onstalled, onsuspend, ondrag,
+        ondragend, ondragenter, ondragleave, ondragover, ondragstart and 
+        ondrop event handlers to the DOMWindow.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::ondrag):
+        (WebCore::DOMWindow::setOndrag):
+        (WebCore::DOMWindow::ondragend):
+        (WebCore::DOMWindow::setOndragend):
+        (WebCore::DOMWindow::ondragenter):
+        (WebCore::DOMWindow::setOndragenter):
+        (WebCore::DOMWindow::ondragleave):
+        (WebCore::DOMWindow::setOndragleave):
+        (WebCore::DOMWindow::ondragover):
+        (WebCore::DOMWindow::setOndragover):
+        (WebCore::DOMWindow::ondragstart):
+        (WebCore::DOMWindow::setOndragstart):
+        (WebCore::DOMWindow::ondrop):
+        (WebCore::DOMWindow::setOndrop):
+        (WebCore::DOMWindow::oncanplay):
+        (WebCore::DOMWindow::setOncanplay):
+        (WebCore::DOMWindow::oncanplaythrough):
+        (WebCore::DOMWindow::setOncanplaythrough):
+        (WebCore::DOMWindow::ondurationchange):
+        (WebCore::DOMWindow::setOndurationchange):
+        (WebCore::DOMWindow::onemptied):
+        (WebCore::DOMWindow::setOnemptied):
+        (WebCore::DOMWindow::onended):
+        (WebCore::DOMWindow::setOnended):
+        (WebCore::DOMWindow::onloadeddata):
+        (WebCore::DOMWindow::setOnloadeddata):
+        (WebCore::DOMWindow::onloadedmetadata):
+        (WebCore::DOMWindow::setOnloadedmetadata):
+        (WebCore::DOMWindow::onpause):
+        (WebCore::DOMWindow::setOnpause):
+        (WebCore::DOMWindow::onplay):
+        (WebCore::DOMWindow::setOnplay):
+        (WebCore::DOMWindow::onplaying):
+        (WebCore::DOMWindow::setOnplaying):
+        (WebCore::DOMWindow::onratechange):
+        (WebCore::DOMWindow::setOnratechange):
+        (WebCore::DOMWindow::onseeked):
+        (WebCore::DOMWindow::setOnseeked):
+        (WebCore::DOMWindow::onseeking):
+        (WebCore::DOMWindow::setOnseeking):
+        (WebCore::DOMWindow::ontimeupdate):
+        (WebCore::DOMWindow::setOntimeupdate):
+        (WebCore::DOMWindow::onvolumechange):
+        (WebCore::DOMWindow::setOnvolumechange):
+        (WebCore::DOMWindow::onwaiting):
+        (WebCore::DOMWindow::setOnwaiting):
+        (WebCore::DOMWindow::onloadstart):
+        (WebCore::DOMWindow::setOnloadstart):
+        (WebCore::DOMWindow::onprogress):
+        (WebCore::DOMWindow::setOnprogress):
+        (WebCore::DOMWindow::onstalled):
+        (WebCore::DOMWindow::setOnstalled):
+        (WebCore::DOMWindow::onsuspend):
+        (WebCore::DOMWindow::setOnsuspend):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-05-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Part of https://bugs.webkit.org/show_bug.cgi?id=26100
+        Add missing event handler properties to the DOMWindow
+
+        Add missing onstorage event handler to the DOMWindow.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onstorage):
+        (WebCore::DOMWindow::setOnstorage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-05-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26110
+        Update online/offline events to match the current spec.
+        - Also adds window.ononline and window.onoffline event handler
+          properties.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onoffline):
+        (WebCore::DOMWindow::setOnoffline):
+        (WebCore::DOMWindow::ononline):
+        (WebCore::DOMWindow::setOnonline):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Make use of the new filter system in WebCore for SVG. Deleted Mac bindings
+        and replace it by a platform independent code. Calculation of subRegions
+        is missing but needed for a first filter effect.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/Filter.h:
+        (WebCore::Filter::~Filter):
+        (WebCore::Filter::setSourceImage):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        * svg/FilterBuilder.h:
+        (WebCore::FilterBuilder::lastEffect):
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::SVGFEBlendElement):
+        (WebCore::SVGFEBlendElement::build):
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::SVGFEColorMatrixElement):
+        (WebCore::SVGFEColorMatrixElement::build):
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::SVGFEComponentTransferElement):
+        (WebCore::SVGFEComponentTransferElement::build):
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::SVGFECompositeElement):
+        (WebCore::SVGFECompositeElement::build):
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::SVGFEDiffuseLightingElement):
+        (WebCore::SVGFEDiffuseLightingElement::build):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::SVGFEDisplacementMapElement):
+        (WebCore::SVGFEDisplacementMapElement::build):
+        * svg/SVGFEDisplacementMapElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::SVGFEGaussianBlurElement):
+        (WebCore::SVGFEGaussianBlurElement::build):
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        (WebCore::SVGFEImageElement::notifyFinished):
+        (WebCore::SVGFEImageElement::build):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::SVGFEMergeElement):
+        (WebCore::SVGFEMergeElement::build):
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::SVGFEOffsetElement):
+        (WebCore::SVGFEOffsetElement::build):
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::SVGFESpecularLightingElement):
+        (WebCore::SVGFESpecularLightingElement::build):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::SVGFETileElement):
+        (WebCore::SVGFETileElement::build):
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        (WebCore::SVGFETurbulenceElement::SVGFETurbulenceElement):
+        (WebCore::SVGFETurbulenceElement::build):
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::contextElement):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::SVGResourceFilter::addFilterEffect):
+        (WebCore::SVGResourceFilter::filterBBoxForItemBBox):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        (WebCore::SVGResourceFilter::externalRepresentation):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::filterBoundingBox):
+        (WebCore::SVGResourceFilter::setFilterBoundingBox):
+        (WebCore::SVGResourceFilter::itemBoundingBox):
+        (WebCore::SVGResourceFilter::setItemBoundingBox):
+        (WebCore::SVGResourceFilter::builder):
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Adding 'in1' attribute support for <feFlood>, as specified in SVG 1.1.
+        This change helps creating test cases, once filters are activated.
+
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::parseMappedAttribute):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+        (WebCore::FEFlood::create):
+        * svg/graphics/filters/SVGFEFlood.h:
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Replace all occurrences of SVGResourceFilter by Filter. This is the last 
+        step for a SVG independent filter system. Every other part of WebCore can
+        use the filter system by creating a new Filter object.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEColorMatrix.h:
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::FEComponentTransfer::apply):
+        * platform/graphics/filters/FEComponentTransfer.h:
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/FEComposite.h:
+        * platform/graphics/filters/Filter.h: Added.
+        (WebCore::Filter::setSourceImage):
+        (WebCore::Filter::sourceImage):
+        * platform/graphics/filters/FilterEffect.h:
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceAlpha.h:
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * platform/graphics/filters/SourceGraphic.h:
+        * svg/Filter.cpp: Removed.
+        * svg/Filter.h: Removed.
+        * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+        (WebCore::FEConvolveMatrix::apply):
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::apply):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply):
+        * svg/graphics/filters/SVGFEDisplacementMap.h:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * svg/graphics/filters/SVGFEFlood.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h:
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFEOffset.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::apply):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+        * svg/graphics/filters/SVGFETile.h:
+        * svg/graphics/filters/SVGFETurbulence.cpp:
+        (WebCore::FETurbulence::apply):
+        * svg/graphics/filters/SVGFETurbulence.h:
+        * svg/graphics/filters/SVGFilter.cpp: Added.
+        (WebCore::SVGFilter::SVGFilter):
+        (WebCore::SVGFilter::calculateEffectSubRegion):
+        (WebCore::SVGFilter::create):
+        * svg/graphics/filters/SVGFilter.h: Added.
+
+2009-05-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for platforms without plugins support.
+
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::userAgentStatic):
+        (WebCore::PluginView::getValueStatic):
+
+2009-05-30  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=25979
+
+        Fix regression, local WML files won't load anymore, as the mimetype isn't correctly detected.    
+        Bug filed at <rdar://problem/6917571> to cover this CFNetwork limitation.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+
+2009-05-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26091
+        Make storage events match the current spec.
+        - Storage event listeners are added to the window.
+        - Storage events are dispatched to the window.
+
+        Updated existing tests.
+
+        * dom/Document.cpp:
+        (WebCore::Document::dispatchWindowEvent):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+
+2009-05-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 26097: REGRESSION (r44283): Tab key doesn't work when focus is on a <select> element
+
+        Test: fast/forms/focus-control-to-page.html
+
+        * dom/SelectElement.h: Made destructor protected. Tweaked a bit.
+
+        * html/HTMLSelectElement.cpp: Removed unneeded includes.
+        (WebCore::HTMLSelectElement::remove): Removed unneeded range check of the
+        result of optionToListIndex.
+        (WebCore::HTMLSelectElement::parseMappedAttribute): Removed code to set the
+        unused attribute, m_minwidth.
+        (WebCore::HTMLSelectElement::defaultEventHandler): The actual bug fix.
+        Call through to the base class defaultEventHandler if the event hasn't
+        been handled yet.
+
+        * html/HTMLSelectElement.h: Removed unneeded includes. Made a lot more functions
+        private. Removed unused minWidth function and m_minwidth data member.
+
+2009-05-30  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Holger Freyther.
+
+        The two KeyboardCodes.h files are basically identical and the
+        qt one is properly #ifdef-ed for different win32 systems. Share
+        them between Qt and Gtk implementations.
+
+        * GNUmakefile.am:
+        * platform/KeyboardCodes.h: Copied from WebCore/platform/qt/KeyboardCodes.h.
+        * platform/gtk/KeyboardCodes.h: Removed.
+        * platform/qt/KeyboardCodes.h: Removed.
+
+2009-05-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        LocalStorage and SessionStorage's implicit setters do not correctly 
+        handle null.  The custom JS bindings should convert to strings
+        unconditionally and not try to handle null specially.
+        https://bugs.webkit.org/show_bug.cgi?id=25970
+
+        Tests: storage/domstorage/localstorage/string-conversion.html
+               storage/domstorage/sessionstorage/string-conversion.html
+
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::customPut):
+
+2009-05-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6935192> REGRESSION (Safari 3-TOT): Scroll
+          bars in key window draw as inactive if the WebView is not active
+
+        Test: platform/mac/scrollbars/key-window-not-first-responder.html
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint): Use the window's key state instead
+        of the WebView's first responder state to switch between active and
+        inactive state.
+
+2009-05-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=18445
+          <rdar://problem/5931174> Assertion failure in CSSGradientValue::image
+          with -webkit-gradient as body's background
+
+        Test: fast/backgrounds/body-generated-image-propagated-to-root.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Check if this
+        is the root element painting a background layer propagated from the
+        body, and if it is, use the body's renderer as the client to
+        StyleImage::image().
+
+2009-05-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix for AXObjectCache.
+
+        For !HAVE(ACCESSIBILITY) postNotification was defined twice. Move
+        that into the #ifdef.
+
+        * accessibility/AXObjectCache.cpp:
+
+2009-05-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26072
+
+        Add support for the last missing WML element: <select>. This patch adds WMLSelectElement, providing
+        the same functionality HTMLSelectElement has. The WML specific features will follow soon.
+    
+        Add simple testcase covering <select> element rendering: fast/wml/select.wml
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::optionIndex):
+        (WebCore::isOptionElement):
+        * dom/OptionElement.h:
+        * dom/OptionGroupElement.cpp:
+        (WebCore::isOptionGroupElement):
+        * dom/OptionGroupElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::accessKeySetSelectedIndex):
+        (WebCore::toSelectElement):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::index):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::accessKeySetSelectedIndex):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemIsEnabled):
+        (WebCore::RenderMenuList::itemIsLabel):
+        * wml/WMLFormControlElement.cpp:
+        (WebCore::WMLFormControlElement::attach):
+        (WebCore::WMLFormControlElement::recalcStyle):
+        * wml/WMLFormControlElement.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::attach):
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::insertBefore):
+        (WebCore::WMLOptGroupElement::replaceChild):
+        (WebCore::WMLOptGroupElement::removeChild):
+        (WebCore::WMLOptGroupElement::appendChild):
+        (WebCore::WMLOptGroupElement::removeChildren):
+        (WebCore::ownerSelectElement):
+        (WebCore::WMLOptGroupElement::accessKeyAction):
+        (WebCore::WMLOptGroupElement::childrenChanged):
+        (WebCore::WMLOptGroupElement::parseMappedAttribute):
+        (WebCore::WMLOptGroupElement::attach):
+        (WebCore::WMLOptGroupElement::detach):
+        (WebCore::WMLOptGroupElement::recalcSelectOptions):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::ownerSelectElement):
+        (WebCore::WMLOptionElement::accessKeyAction):
+        (WebCore::WMLOptionElement::childrenChanged):
+        (WebCore::WMLOptionElement::parseMappedAttribute):
+        (WebCore::WMLOptionElement::attach):
+        (WebCore::WMLOptionElement::detach):
+        (WebCore::WMLOptionElement::insertedIntoDocument):
+        * wml/WMLSelectElement.cpp: Added.
+        (WebCore::WMLSelectElement::WMLSelectElement):
+        (WebCore::WMLSelectElement::~WMLSelectElement):
+        (WebCore::WMLSelectElement::formControlType):
+        (WebCore::WMLSelectElement::isKeyboardFocusable):
+        (WebCore::WMLSelectElement::isMouseFocusable):
+        (WebCore::WMLSelectElement::selectAll):
+        (WebCore::WMLSelectElement::recalcStyle):
+        (WebCore::WMLSelectElement::dispatchFocusEvent):
+        (WebCore::WMLSelectElement::dispatchBlurEvent):
+        (WebCore::WMLSelectElement::selectedIndex):
+        (WebCore::WMLSelectElement::setSelectedIndex):
+        (WebCore::WMLSelectElement::saveFormControlState):
+        (WebCore::WMLSelectElement::restoreFormControlState):
+        (WebCore::WMLSelectElement::childrenChanged):
+        (WebCore::WMLSelectElement::parseMappedAttribute):
+        (WebCore::WMLSelectElement::createRenderer):
+        (WebCore::WMLSelectElement::appendFormData):
+        (WebCore::WMLSelectElement::optionToListIndex):
+        (WebCore::WMLSelectElement::listToOptionIndex):
+        (WebCore::WMLSelectElement::reset):
+        (WebCore::WMLSelectElement::defaultEventHandler):
+        (WebCore::WMLSelectElement::accessKeyAction):
+        (WebCore::WMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::WMLSelectElement::setActiveSelectionEndIndex):
+        (WebCore::WMLSelectElement::updateListBoxSelection):
+        (WebCore::WMLSelectElement::listBoxOnChange):
+        (WebCore::WMLSelectElement::menuListOnChange):
+        (WebCore::WMLSelectElement::activeSelectionStartListIndex):
+        (WebCore::WMLSelectElement::activeSelectionEndListIndex):
+        (WebCore::WMLSelectElement::accessKeySetSelectedIndex):
+        (WebCore::WMLSelectElement::setRecalcListItems):
+        (WebCore::WMLSelectElement::scrollToSelection):
+        (WebCore::WMLSelectElement::insertedIntoTree):
+        * wml/WMLSelectElement.h: Added.
+        (WebCore::WMLSelectElement::canSelectAll):
+        (WebCore::WMLSelectElement::canStartSelection):
+        (WebCore::WMLSelectElement::size):
+        (WebCore::WMLSelectElement::multiple):
+        (WebCore::WMLSelectElement::listItems):
+        * wml/WMLTagNames.in:
+
+2009-05-29  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix for windows).
+
+        http://trac.webkit.org/changeset/44279 left in a "Vector<WCHAR> localeNameBuf"
+        that it was trying to replace.  Resulting in this variable being defined twice (and
+        the second time incorrectly).
+
+        * platform/win/Language.cpp:
+        (WebCore::localeInfo):
+
+2009-05-29  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Darin Alder.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26018
+
+        Fix behavior of the Element View of the Web Inspector for double
+        clicking the element outline tree.
+
+        Double clicking the element outline tree should
+        1) on attribute: enter attribute editing mode
+        2) on text: enter text editing mode
+        3) otherwise: change root node to the parent element of double clicked
+           element.
+
+        Now, 3) is broken. For example, clicking <html> clears the element
+        outline view.
+
+        rootDOMNode should be updated to this.representedObject.parentNode, not
+        this.parent.representedObject which is parent inside the element
+        outline tree itself.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+
+2009-05-29  David Moore  <davemoore@google.com>
+
+        Reviewed by Darin Alder.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26001
+        Change many of the uses of String::adopt() to String::createUninitialized().
+        This allows those strings to use an inlined buffer for their characters.
+
+        * dom/StyleElement.cpp:
+        Loop over nodes to precompute length of string and then
+        write the characters into the allocated inline buffer
+        (WebCore::StyleElement::process):
+        * dom/Text.cpp:
+        Loop over nodes to precompute length of string and then
+        write the characters into the allocated inline buffer
+        (WebCore::Text::wholeText):
+        (WebCore::Text::rendererIsNeeded):
+        (WebCore::Text::createRenderer):
+        (WebCore::Text::createWithLengthLimit):
+        (WebCore::Text::formatForDebugger):
+        * platform/text/String.cpp:
+        (WebCore::String::append):
+        (WebCore::String::insert):
+        (WebCore::String::truncate):
+        (WebCore::String::remove):
+        * platform/text/StringBuilder.cpp:
+        (WebCore::StringBuilder::toString):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::lower):
+        (WebCore::StringImpl::upper):
+        (WebCore::StringImpl::secure):
+        (WebCore::StringImpl::foldCase):
+        (WebCore::StringImpl::replace):
+        * platform/text/TextCodecLatin1.cpp:
+        (WebCore::TextCodecLatin1::decode):
+        * platform/text/TextCodecUserDefined.cpp:
+        (WebCore::TextCodecUserDefined::decode):
+        * platform/win/Language.cpp:
+        (WebCore::localeInfo):
+
+2009-05-29  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Darin Alder.
+
+        Bug 25911: Apply href in base elements to anchors shown on the source viewer
+        https://bugs.webkit.org/show_bug.cgi?id=25911
+
+        In rendering HTML sources, parse base elements to apply the base URI to
+        anchors shown on the source viewer.
+
+        This issue was originally reported to the Chromium issue tracker.
+        http://code.google.com/p/chromium/issues/detail?id=2418
+
+        Test: fast/frames/viewsource-link-on-href-value.html
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addViewSourceToken):
+
+2009-05-29  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22429
+        document.styleSheets collection ignores media=presentation
+
+        Ensure that stylesheets though <link> show up in document.styleSheets regardless of media attribute.
+
+        Test: fast/css/sheet-collection-link.html
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+
+2009-05-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26069
+        Fix a crash in custom V8 bindings code for XMLHttpRequest.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-29  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 26074: SQLTransaction::executeSQL does an unnecessary call to String::copy.
+        https://bugs.webkit.org/show_bug.cgi?id=26074
+
+        The constructor for SQLStatement already does a copy for this string.
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL):
+
+2009-05-29  Darin Adler  <darin@apple.com>
+
+        Fix build; the new Cairo code compiled on Windows only.
+
+        * platform/graphics/gtk/FontPlatformData.h: Added syntheticBold
+        and syntheticOblique functions as in the Windows version to make it
+        easier to use this cross-platform. Later we can make data members
+        private as in the Windows version.
+        * platform/graphics/mac/FontPlatformData.h: Ditto.
+
+2009-05-29  Alexander Macdonald  <alexmac@adobe.com>
+
+        Reviewed by Darin Adler.
+
+        Added support for synthetic bold/oblique font rendering
+        on platforms that use cairo.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-05-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 26024: AX: possible to fail assertion because AXPostNotification calls accessibilityIsIgnored
+        https://bugs.webkit.org/show_bug.cgi?id=26024
+
+        AX notifications are posted after a one shot timer so that notifications are not performed mid-layout.
+        Consolidated postNotification and postNotificationToElement into one method.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+        (WebCore::AXObjectCache::notificationPostTimerFired):
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedContents):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-05-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Build fix for Windows Cairo target.
+        https://bugs.webkit.org/show_bug.cgi?id=25972
+
+        Compiler mistakenly selects SMILTime min/max instead of STL version,
+        resulting in a build error.  This change makes the meaning of the
+        min/max explicit and avoids the problem.
+
+        * html/TimeRanges.h:
+        (WebCore::TimeRanges::Range::unionWithOverlappingOrContiguousRange):
+
+2009-05-29  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Make SoupMessage a member of ResourceRequest, instead of creating
+        it in startHttp. Implement updating of ResourceRequest from
+        SoupMessage, and vice versa.
+
+        * GNUmakefile.am:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::gotHeadersCallback):
+        (WebCore::ResourceHandle::startHttp):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::~ResourceRequest):
+        * platform/network/soup/ResourceRequestSoup.cpp: Added.
+        (WTF::SoupURI):
+        (WebCore::ResourceRequest::soupMessage):
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+
+2009-05-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26068
+        V8: Remove the remaining b8::Locker usage in worker code.
+        This completes the fix for https://bugs.webkit.org/show_bug.cgi?id=25944,
+        since the patches for enabling timers and that bug have "crossed in the queue".
+        Existing LayoutTests/fast/workers/worker-timeout.html covers this fix (will start work in Chromium).
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-05-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Simplify the Accept-Encoding header we are sending out, for it
+        seems some servers do not enjoy parsing the full, explicit
+        version.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-05-28  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Added a new build flag --filters. This replaces the old --svg-filters and enables
+        other parts of WebKit to use some basic filters of platform/graphics/filters if needed.
+        This patch also fixes a bug in dom/DOMImplementation.cpp where we used SVG_FILTER. This flag
+        doesn't exist and was replaced by FILTERS as well as all SVG_FILTERS occurrences.
+        Filters are not working yet. This patch is just a preperation. Filters are deactivated by
+        default. 
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * dom/DOMImplementation.cpp:
+        (WebCore::isSVG10Feature):
+        (WebCore::isSVG11Feature):
+        * page/DOMWindow.idl:
+        * platform/graphics/filters/FEBlend.cpp:
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        * platform/graphics/filters/FEColorMatrix.h:
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        * platform/graphics/filters/FEComponentTransfer.h:
+        * platform/graphics/filters/FEComposite.cpp:
+        * platform/graphics/filters/FEComposite.h:
+        * platform/graphics/filters/FilterEffect.cpp:
+        * platform/graphics/filters/FilterEffect.h:
+        * platform/graphics/filters/SourceAlpha.cpp:
+        * platform/graphics/filters/SourceAlpha.h:
+        * platform/graphics/filters/SourceGraphic.cpp:
+        * platform/graphics/filters/SourceGraphic.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::selfWillPaint):
+        * rendering/RenderSVGModelObject.cpp:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::selfWillPaint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * svg/Filter.cpp:
+        * svg/Filter.h:
+        * svg/FilterBuilder.cpp:
+        * svg/FilterBuilder.h:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGComponentTransferFunctionElement.idl:
+        * svg/SVGFEBlendElement.cpp:
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEBlendElement.idl:
+        * svg/SVGFEColorMatrixElement.cpp:
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEColorMatrixElement.idl:
+        * svg/SVGFEComponentTransferElement.cpp:
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFEComponentTransferElement.idl:
+        * svg/SVGFECompositeElement.cpp:
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDiffuseLightingElement.idl:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        * svg/SVGFEDisplacementMapElement.h:
+        * svg/SVGFEDisplacementMapElement.idl:
+        * svg/SVGFEDistantLightElement.cpp:
+        * svg/SVGFEDistantLightElement.h:
+        * svg/SVGFEDistantLightElement.idl:
+        * svg/SVGFEFloodElement.cpp:
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/SVGFEFuncAElement.cpp:
+        * svg/SVGFEFuncAElement.h:
+        * svg/SVGFEFuncAElement.idl:
+        * svg/SVGFEFuncBElement.cpp:
+        * svg/SVGFEFuncBElement.h:
+        * svg/SVGFEFuncBElement.idl:
+        * svg/SVGFEFuncGElement.cpp:
+        * svg/SVGFEFuncGElement.h:
+        * svg/SVGFEFuncGElement.idl:
+        * svg/SVGFEFuncRElement.cpp:
+        * svg/SVGFEFuncRElement.h:
+        * svg/SVGFEFuncRElement.idl:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEGaussianBlurElement.idl:
+        * svg/SVGFEImageElement.cpp:
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFEImageElement.idl:
+        * svg/SVGFELightElement.cpp:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeElement.cpp:
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEMergeElement.idl:
+        * svg/SVGFEMergeNodeElement.cpp:
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFEMergeNodeElement.idl:
+        * svg/SVGFEOffsetElement.cpp:
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFEOffsetElement.idl:
+        * svg/SVGFEPointLightElement.cpp:
+        * svg/SVGFEPointLightElement.h:
+        * svg/SVGFEPointLightElement.idl:
+        * svg/SVGFESpecularLightingElement.cpp:
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFESpecularLightingElement.idl:
+        * svg/SVGFESpotLightElement.cpp:
+        * svg/SVGFESpotLightElement.h:
+        * svg/SVGFESpotLightElement.idl:
+        * svg/SVGFETileElement.cpp:
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETileElement.idl:
+        * svg/SVGFETurbulenceElement.cpp:
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFETurbulenceElement.idl:
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterElement.idl:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/cairo/SVGResourceFilterCairo.cpp:
+        * svg/graphics/cg/SVGResourceFilterCg.cpp:
+        * svg/graphics/cg/SVGResourceFilterCg.mm:
+        * svg/graphics/filters/SVGDistantLightSource.h:
+        * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        * svg/graphics/filters/SVGFEDisplacementMap.h:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        * svg/graphics/filters/SVGFEFlood.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        * svg/graphics/filters/SVGFEGaussianBlur.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        * svg/graphics/filters/SVGFEImage.h:
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        * svg/graphics/filters/SVGFEMorphology.h:
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        * svg/graphics/filters/SVGFEOffset.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGFETile.cpp:
+        * svg/graphics/filters/SVGFETile.h:
+        * svg/graphics/filters/SVGFETurbulence.cpp:
+        * svg/graphics/filters/SVGFETurbulence.h:
+        * svg/graphics/filters/SVGFilterEffect.cpp:
+        * svg/graphics/filters/SVGFilterEffect.h:
+        * svg/graphics/filters/SVGLightSource.cpp:
+        * svg/graphics/filters/SVGLightSource.h:
+        * svg/graphics/filters/SVGPointLightSource.h:
+        * svg/graphics/filters/SVGSpotLightSource.h:
+        * svg/graphics/filters/cg/SVGFEHelpersCg.h:
+        * svg/graphics/filters/cg/SVGFEHelpersCg.mm:
+        * svg/graphics/filters/cg/SVGFilterEffectCg.mm:
+        * svg/graphics/filters/cg/WKArithmeticFilter.h:
+        * svg/graphics/filters/cg/WKArithmeticFilter.m:
+        * svg/graphics/filters/cg/WKComponentMergeFilter.h:
+        * svg/graphics/filters/cg/WKComponentMergeFilter.m:
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.h:
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.m:
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.h:
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.m:
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.h:
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.m:
+        * svg/graphics/filters/cg/WKDistantLightFilter.h:
+        * svg/graphics/filters/cg/WKDistantLightFilter.m:
+        * svg/graphics/filters/cg/WKGammaTransferFilter.h:
+        * svg/graphics/filters/cg/WKGammaTransferFilter.m:
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.h:
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.m:
+        * svg/graphics/filters/cg/WKLinearTransferFilter.h:
+        * svg/graphics/filters/cg/WKLinearTransferFilter.m:
+        * svg/graphics/filters/cg/WKNormalMapFilter.h:
+        * svg/graphics/filters/cg/WKNormalMapFilter.m:
+        * svg/graphics/filters/cg/WKPointLightFilter.h:
+        * svg/graphics/filters/cg/WKPointLightFilter.m:
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.h:
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.m:
+        * svg/graphics/filters/cg/WKSpotLightFilter.h:
+        * svg/graphics/filters/cg/WKSpotLightFilter.m:
+        * svg/graphics/filters/cg/WKTableTransferFilter.h:
+        * svg/graphics/filters/cg/WKTableTransferFilter.m:
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.h:
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.mm:
+        * svg/graphics/qt/SVGResourceFilterQt.cpp:
+        * svg/graphics/skia/SVGResourceFilterSkia.cpp:
+        * svg/svgtags.in:
+
+2009-05-28  Brett Wilson  <brettw@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26067
+
+        Add casts for scale function to make more explicit what is happening
+        and fix a compiler warning.
+
+        * platform/graphics/IntSize.h:
+        (WebCore::IntSize::scale):
+
+2009-05-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove the returnValueSlot concept from JSDOMWindowBase. Now that windows
+        are not cleared on navigation it is no longer necessary.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        (WebCore::JSDOMWindowBase::willRemoveFromWindowShell):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog):
+
+2009-05-19  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo and Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Implement atk_text_get_text_{at,after,before}_offset.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove unnecessary destructor from InputElementData/OptionElementData.
+
+        * dom/InputElement.cpp:
+        * dom/InputElement.h:
+        * dom/OptionElement.cpp:
+        * dom/OptionElement.h:
+
+2009-05-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26062
+
+        Refactor code from all virtual methods in HTMLSelectElement (that are also needed for WMLSelectElement)
+        in the recently introduced SelectElement abstract base class. Follow the same design sheme that InputElement uses.
+
+        A follow-up patch can now easily add WMLSelectElement.
+
+        * dom/OptionElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::selectAll):
+        (WebCore::SelectElement::saveLastSelection):
+        (WebCore::isOptionElement):
+        (WebCore::isOptionGroupElement):
+        (WebCore::SelectElement::nextSelectableListIndex):
+        (WebCore::SelectElement::previousSelectableListIndex):
+        (WebCore::SelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElement::setActiveSelectionEndIndex):
+        (WebCore::SelectElement::updateListBoxSelection):
+        (WebCore::SelectElement::listBoxOnChange):
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::scrollToSelection):
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::selectedIndex):
+        (WebCore::SelectElement::setSelectedIndex):
+        (WebCore::SelectElement::optionToListIndex):
+        (WebCore::SelectElement::listToOptionIndex):
+        (WebCore::SelectElement::dispatchFocusEvent):
+        (WebCore::SelectElement::dispatchBlurEvent):
+        (WebCore::SelectElement::deselectItems):
+        (WebCore::SelectElement::saveFormControlState):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::parseMultipleAttribute):
+        (WebCore::SelectElement::appendFormData):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        (WebCore::SelectElement::defaultEventHandler):
+        (WebCore::SelectElement::lastSelectedListIndex):
+        (WebCore::stripLeadingWhiteSpace):
+        (WebCore::SelectElement::typeAheadFind):
+        (WebCore::SelectElement::insertedIntoTree):
+        (WebCore::SelectElementData::SelectElementData):
+        (WebCore::SelectElementData::checkListItems):
+        (WebCore::SelectElementData::listItems):
+        * dom/SelectElement.h:
+        (WebCore::SelectElementData::multiple):
+        (WebCore::SelectElementData::setMultiple):
+        (WebCore::SelectElementData::size):
+        (WebCore::SelectElementData::setSize):
+        (WebCore::SelectElementData::usesMenuList):
+        (WebCore::SelectElementData::lastOnChangeIndex):
+        (WebCore::SelectElementData::setLastOnChangeIndex):
+        (WebCore::SelectElementData::lastOnChangeSelection):
+        (WebCore::SelectElementData::activeSelectionState):
+        (WebCore::SelectElementData::setActiveSelectionState):
+        (WebCore::SelectElementData::activeSelectionAnchorIndex):
+        (WebCore::SelectElementData::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElementData::activeSelectionEndIndex):
+        (WebCore::SelectElementData::setActiveSelectionEndIndex):
+        (WebCore::SelectElementData::cachedStateForActiveSelection):
+        (WebCore::SelectElementData::shouldRecalcListItems):
+        (WebCore::SelectElementData::setShouldRecalcListItems):
+        (WebCore::SelectElementData::rawListItems):
+        (WebCore::SelectElementData::repeatingChar):
+        (WebCore::SelectElementData::setRepeatingChar):
+        (WebCore::SelectElementData::lastCharTime):
+        (WebCore::SelectElementData::setLastCharTime):
+        (WebCore::SelectElementData::typedString):
+        (WebCore::SelectElementData::setTypedString):
+        * html/HTMLOptionElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::HTMLSelectElement):
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::formControlType):
+        (WebCore::HTMLSelectElement::selectedIndex):
+        (WebCore::HTMLSelectElement::deselectItems):
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::activeSelectionStartListIndex):
+        (WebCore::HTMLSelectElement::activeSelectionEndListIndex):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        (WebCore::HTMLSelectElement::canSelectAll):
+        (WebCore::HTMLSelectElement::selectAll):
+        (WebCore::HTMLSelectElement::createRenderer):
+        (WebCore::HTMLSelectElement::appendFormData):
+        (WebCore::HTMLSelectElement::optionToListIndex):
+        (WebCore::HTMLSelectElement::listToOptionIndex):
+        (WebCore::HTMLSelectElement::recalcListItems):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::dispatchFocusEvent):
+        (WebCore::HTMLSelectElement::dispatchBlurEvent):
+        (WebCore::HTMLSelectElement::defaultEventHandler):
+        (WebCore::HTMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::HTMLSelectElement::setActiveSelectionEndIndex):
+        (WebCore::HTMLSelectElement::updateListBoxSelection):
+        (WebCore::HTMLSelectElement::menuListOnChange):
+        (WebCore::HTMLSelectElement::listBoxOnChange):
+        (WebCore::HTMLSelectElement::saveLastSelection):
+        (WebCore::HTMLSelectElement::setOption):
+        (WebCore::HTMLSelectElement::scrollToSelection):
+        (WebCore::HTMLSelectElement::insertedIntoTree):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::size):
+        (WebCore::HTMLSelectElement::multiple):
+        (WebCore::HTMLSelectElement::listItems):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::text):
+        * wml/WMLOptionElement.h:
+
+
+        * dom/OptionElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::selectAll):
+        (WebCore::SelectElement::saveLastSelection):
+        (WebCore::isOptionElement):
+        (WebCore::isOptionGroupElement):
+        (WebCore::SelectElement::nextSelectableListIndex):
+        (WebCore::SelectElement::previousSelectableListIndex):
+        (WebCore::SelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElement::setActiveSelectionEndIndex):
+        (WebCore::SelectElement::updateListBoxSelection):
+        (WebCore::SelectElement::listBoxOnChange):
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::scrollToSelection):
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::selectedIndex):
+        (WebCore::SelectElement::setSelectedIndex):
+        (WebCore::SelectElement::optionToListIndex):
+        (WebCore::SelectElement::listToOptionIndex):
+        (WebCore::SelectElement::dispatchFocusEvent):
+        (WebCore::SelectElement::dispatchBlurEvent):
+        (WebCore::SelectElement::deselectItems):
+        (WebCore::SelectElement::saveFormControlState):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::parseMultipleAttribute):
+        (WebCore::SelectElement::appendFormData):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        (WebCore::SelectElement::defaultEventHandler):
+        (WebCore::SelectElement::lastSelectedListIndex):
+        (WebCore::stripLeadingWhiteSpace):
+        (WebCore::SelectElement::typeAheadFind):
+        (WebCore::SelectElement::insertedIntoTree):
+        (WebCore::SelectElementData::SelectElementData):
+        (WebCore::SelectElementData::~SelectElementData):
+        (WebCore::SelectElementData::checkListItems):
+        (WebCore::SelectElementData::listItems):
+        * dom/SelectElement.h:
+        (WebCore::SelectElementData::multiple):
+        (WebCore::SelectElementData::setMultiple):
+        (WebCore::SelectElementData::size):
+        (WebCore::SelectElementData::setSize):
+        (WebCore::SelectElementData::usesMenuList):
+        (WebCore::SelectElementData::lastOnChangeIndex):
+        (WebCore::SelectElementData::setLastOnChangeIndex):
+        (WebCore::SelectElementData::lastOnChangeSelection):
+        (WebCore::SelectElementData::activeSelectionState):
+        (WebCore::SelectElementData::setActiveSelectionState):
+        (WebCore::SelectElementData::activeSelectionAnchorIndex):
+        (WebCore::SelectElementData::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElementData::activeSelectionEndIndex):
+        (WebCore::SelectElementData::setActiveSelectionEndIndex):
+        (WebCore::SelectElementData::cachedStateForActiveSelection):
+        (WebCore::SelectElementData::shouldRecalcListItems):
+        (WebCore::SelectElementData::setShouldRecalcListItems):
+        (WebCore::SelectElementData::rawListItems):
+        (WebCore::SelectElementData::repeatingChar):
+        (WebCore::SelectElementData::setRepeatingChar):
+        (WebCore::SelectElementData::lastCharTime):
+        (WebCore::SelectElementData::setLastCharTime):
+        (WebCore::SelectElementData::typedString):
+        (WebCore::SelectElementData::setTypedString):
+        * html/HTMLOptionElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::HTMLSelectElement):
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::formControlType):
+        (WebCore::HTMLSelectElement::selectedIndex):
+        (WebCore::HTMLSelectElement::deselectItems):
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::activeSelectionStartListIndex):
+        (WebCore::HTMLSelectElement::activeSelectionEndListIndex):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        (WebCore::HTMLSelectElement::canSelectAll):
+        (WebCore::HTMLSelectElement::selectAll):
+        (WebCore::HTMLSelectElement::createRenderer):
+        (WebCore::HTMLSelectElement::appendFormData):
+        (WebCore::HTMLSelectElement::optionToListIndex):
+        (WebCore::HTMLSelectElement::listToOptionIndex):
+        (WebCore::HTMLSelectElement::recalcListItems):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::dispatchFocusEvent):
+        (WebCore::HTMLSelectElement::dispatchBlurEvent):
+        (WebCore::HTMLSelectElement::defaultEventHandler):
+        (WebCore::HTMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::HTMLSelectElement::setActiveSelectionEndIndex):
+        (WebCore::HTMLSelectElement::updateListBoxSelection):
+        (WebCore::HTMLSelectElement::menuListOnChange):
+        (WebCore::HTMLSelectElement::listBoxOnChange):
+        (WebCore::HTMLSelectElement::saveLastSelection):
+        (WebCore::HTMLSelectElement::setOption):
+        (WebCore::HTMLSelectElement::scrollToSelection):
+        (WebCore::HTMLSelectElement::insertedIntoTree):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::size):
+        (WebCore::HTMLSelectElement::multiple):
+        (WebCore::HTMLSelectElement::listItems):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::text):
+        * wml/WMLOptionElement.h:
+
+2009-05-28  Adam Roben  <aroben@apple.com>
+
+        Don't try to use the new combobox parts on Vista in Classic mode
+
+        Fixes:
+        <rdar://problem/6929277> REGRESSION (r42289+r42350): Windows Classic
+        theme: drop down lists in Preferences get a line/square
+        <rdar://problem/6929298> REGRESSION (r42289): Windows Classic: drop
+        down lists are black with a circle on many sites
+
+        Reviewed by Steve Falkenburg.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintMenuList): Only use the new combobox
+        parts when we have a theme (i.e., when we're not in Classic mode).
+        When we don't have a theme, fall back to the pre-r42289 code.
+
+2009-05-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25659
+        Avoid calling frameCount() unnecessarily (which could lead to extra
+        GIF decoding).
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyDecodedDataIfNecessary):
+
+2009-05-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=8736
+
+        Tests: fast/borders/border-radius-constraints.html
+               fast/borders/border-radius-split-inline.html
+               
+        When the sum of the corner radii on a side exceed the length of the side,
+        reduce the radii according to CSS 3 rules.
+        
+        Add RenderStyle::getBorderRadiiForRect() to fetch corner radii, applying
+        the constraints. Use that for painting borders, box-shadow, clipping replaced
+        elements
+
+        * platform/graphics/IntSize.h:
+        (WebCore::IntSize::scale):
+        Add a scale method that scales by a float (using C rounding rules, like IntRect::scale()).
+
+        * platform/graphics/Path.cpp:
+        Make the QUARTER const static.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::pushContentsClip):
+        Use getBorderRadiiForRect to fetch border radii.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        Use getBorderRadiiForRect to fetch border radii.
+
+        (WebCore::RenderBoxModelObject::paintBorder):
+        Use getBorderRadiiForRect to fetch border radii, and fix a bug when drawing
+        borders for split inlines, which used to apply the radii for each segment,
+        and no longer does.
+
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        Use getBorderRadiiForRect to fetch border radii.
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        Use getBorderRadiiForRect to fetch border radii for clipping.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        Use getBorderRadiiForRect to fetch border radii for clipping.
+
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getBorderRadiiForRect):
+        New bottleneck method to fetch corner radiil given a rect, applying the constraint
+        rules.
+
+2009-05-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26005
+        Optimization for XPath //* does not preserve context size
+
+        Test: fast/xpath/position.html
+
+        Fixed the bug by removing the incorrect optimization, and made enough micro-optimizations to
+        get a performance progression on my tests.
+
+        * xml/XPathPath.h: Removed broken optimizeStepPair().
+
+        * xml/XPathPath.cpp:
+        (WebCore::XPath::LocationPath::evaluate): Style fix.
+        (WebCore::XPath::LocationPath::appendStep): Don't call optimizeStepPair().
+        (WebCore::XPath::LocationPath::insertFirstStep): Ditto.
+        (WebCore::XPath::Path::Path): Style fix.
+
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::primaryNodeType): Turned this member function into a static inline helper.
+        (WebCore::XPath::nodeMatches): Ditto. Don't check for namespace axis, which is unsupported
+        (and might never be).
+        (WebCore::XPath::Step::nodesInAxis): Updated for the new nodeMatches() signature.
+
+        * xml/XPathStep.h:
+        (WebCore::XPath::Step::NodeTest::data):
+        (WebCore::XPath::Step::NodeTest::namespaceURI):
+        Made these data members AtomicString to avoid repeated conversions. This is the biggest
+        performance win here.
+
+        * xml/XPathUtil.cpp: (WebCore::XPath::stringValue): Reserve some capacity upfront.
+
+2009-05-28  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        When creating a linear or radial gradient with a single stop
+        at offset 1.0, the Skia layer was allocating 3 stops, but only
+        filling 2, leaving one uninitialized.  Only 2 stops are necessary
+        in this case, at offsets (0.0, 1.0).
+
+        http://bugs.webkit.org/show_bug.cgi?id=26063
+
+        Covered by: LayoutTests/svg/W3C-SVG-1.1/pservers-grad-16-b.svg
+                    LayoutTests/svg/custom/gradient-stop-corner-cases.svg
+                    LayoutTests/svg/custom/js-late-gradient-and-object-creation.svg
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::totalStopsNeeded):
+
+2009-05-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26041
+        Allow adding resource source to WebInspector.SourceFrame asynchronously.
+
+        Provide common implementation for InspectorController::addResourceSourceToFrame and
+        InspectorController::addSourceToFrame methods.
+
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addResourceSourceToFrame):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.idl:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._isContentLoaded):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+2009-05-28  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        After r44177 we had a problem when increasing the size
+        of the window the scrollbars stayed and were not hidden.
+        This was due WebCore giving up on the Scrollbar as it became
+        unnecessary but the GtkAdjustment remained unchanged.
+        So from the point of view of the GtkScrolledWindow scrolling
+        was still necessary and the GtkScrollbar kept being displayed.
+
+        Solve the issue by resetting the GtkAdjustment in the
+        destructor of ScrollbarGtk.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::~ScrollbarGtk):
+
+2009-05-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Clean up window.open()'s use of lexical and dynamic scope.
+
+        (Added one unreviewed tweak: use dynamicFrame instead of lexicalFrame
+        for DOMWindow::allowPopUp.)
+
+        Test: http/tests/security/frameNavigation/context-for-window-open.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::toDynamicFrame):
+        (WebCore::processingUserGesture):
+        (WebCore::completeURL):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::createWindow):
+
+2009-05-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26056
+        XPath string() function can be very slow
+
+        * xml/XPathUtil.cpp: (WebCore::XPath::stringValue): Use an intermediate Vector when appending.
+
+2009-05-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6927761> <isindex> placeholder text is unstylable
+          and initially not visible
+
+        Test: fast/forms/isindex-placeholder.html
+
+        * css/html4.css: Added a default style for <isindex> placeholder text.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Changed to call
+        the new protected function updatePlaceholderVisibility().
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility): Added this
+        protected function to allow HTMLIsIndexElement::parseMappedAttribute()
+        to invoke InputElement::updatePlaceholderVisibility().
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::parseMappedAttribute): Call
+        updatePlaceholderVisibility() when parsing the placeholder attribute.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle): If there
+        is no placeholder pseudo-element style, use the normal style.
+
+2009-05-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        More cleanup of DOMWindow related functions.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::willRemoveFromWindowShell): Renamed from JSDOMWindowBase::clear()
+        * bindings/js/JSDOMWindowBase.h:
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog): Update Comment.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        Remove JSDOMWindowShell::clear().  It was unused.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell):
+
+2009-05-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Miscellaneous cleanup of DOMWindow related functions.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject): Fix poorly named variables.
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::supportsProfiling): Don't jump through hoops
+        checking for null frames if the build does not support profiling.
+        (WebCore::JSDOMWindowBase::clear): Use setCurrentEvent(0) instead of calling
+        clearHelperObjectProperties().  It is clearer.
+        * bindings/js/JSDOMWindowBase.h:
+        Removed now unused clearHelperObjectProperties() function, empty disconnectFrame()
+        function, and the empty destructor.
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        Remove disconnectFrame() which only called JSDOMWindowBase::disconnectFrame(), which
+        is a no-op.
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame):
+        (WebCore::Frame::pageDestroyed):
+        Remove calls to JSDOMWindowShell::disconnectFrame() which only called
+        JSDOMWindowBase::disconnectFrame(), which is a no-op.
+
+2009-05-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25974
+        Remove extra qualifiers from the ScheduledAction decl.
+
+        * bindings/v8/ScheduledAction.h: Removed extraneous class qualifiers.
+
+2009-05-27  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make distcheck fix. One more missing file.
+
+        * GNUmakefile.am:
+
+2009-05-27  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fixed trunk build on Linux after r44126.
+
+        * WebCore.pro:
+
+2009-05-27  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6926046> REGRESSION (r43972): http://www.youtube.com/html5 crashes on open
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load): Don't look for a media engine based on an empty MIME type.
+
+2009-05-27  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26029: FrameLoader::canLoad should allow calls with just a security origin
+        https://bugs.webkit.org/show_bug.cgi?id=26029
+
+        No functional changes, so no tests.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canLoad):
+        * loader/FrameLoader.h:
+
+2009-05-27  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix.
+
+        Remove file that does not exist from the build.
+
+        * GNUmakefile.am:
+
+2009-05-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Remove two unneeded protected constructors, these classes have pure-virtual functions, and can't be constructed anyway.
+
+        * dom/InputElement.h:
+        * dom/OptionGroupElement.h:
+
+2009-05-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17725
+        XPath should be case insensitive for HTML
+
+        Test: fast/xpath/node-name-case-sensitivity.html
+
+        * xml/XPathStep.cpp: (WebCore::XPath::Step::nodeMatches): Made node name check case insensitive
+        for HTML elements in HTML documents.
+
+2009-05-27  John Sullivan  <sullivan@apple.com>
+
+        fixed <rdar://problem/6925482> repro crash in WebCore::DragController::dragExited dropping 
+        bookmarks (at least) over Top Sites (at least)
+
+        Reviewed by Kevin Decker
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragExited):
+        nil check m_documentUnderMouse and take the "local file" case if it's nil
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gustavo Noronha.
+
+        When building on window, consider Windows specific files.
+
+        * GNUmakefile.am:
+
+2009-05-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26031
+
+        InputElementData is too heavy, save storing two pointers by passing them
+        directly to the static helper functions (the only place which needs them). 
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        (WebCore::InputElement::updateFocusAppearance):
+        (WebCore::InputElement::updateSelectionRange):
+        (WebCore::InputElement::aboutToUnload):
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElement::constrainValue):
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        (WebCore::InputElement::parseSizeAttribute):
+        (WebCore::InputElement::parseMaxLengthAttribute):
+        (WebCore::InputElement::updateValueIfNeeded):
+        (WebCore::InputElement::notifyFormStateChanged):
+        (WebCore::InputElementData::InputElementData):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::updateFocusAppearance):
+        (WebCore::HTMLInputElement::aboutToUnload):
+        (WebCore::HTMLInputElement::dispatchFocusEvent):
+        (WebCore::HTMLInputElement::dispatchBlurEvent):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::setSelectionRange):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::constrainValue):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::WMLInputElement::dispatchFocusEvent):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::updateFocusAppearance):
+        (WebCore::WMLInputElement::aboutToUnload):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::setValueFromRenderer):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        (WebCore::WMLInputElement::defaultEventHandler):
+        (WebCore::WMLInputElement::constrainValue):
+
+2009-05-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26033
+
+        OptionElementData saves an Element pointer, which is unnessary.
+        Just pass it to the static function calls directly.
+
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::setSelectedState):
+        (WebCore::OptionElement::collectOptionText):
+        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
+        (WebCore::OptionElement::collectOptionValue):
+        (WebCore::OptionElementData::OptionElementData):
+        * dom/OptionElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::HTMLOptionElement):
+        (WebCore::HTMLOptionElement::text):
+        (WebCore::HTMLOptionElement::value):
+        (WebCore::HTMLOptionElement::setSelected):
+        (WebCore::HTMLOptionElement::setSelectedState):
+        (WebCore::HTMLOptionElement::textIndentedToRespectGroupLabel):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::WMLOptionElement):
+        (WebCore::WMLOptionElement::setSelectedState):
+        (WebCore::WMLOptionElement::value):
+        (WebCore::WMLOptionElement::textIndentedToRespectGroupLabel):
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        When building with MinGW, don't use the __declspec(dl{import,export})
+        decorations and rely on the linker to use its nifty auto-import feature.
+        It is extremely hard to get the decorations right with MinGW in general
+        and impossible in WebKit, where the resulting shared library is linking 
+        together some static libraries.
+
+        * config.h:
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25613
+
+        Add a WebCore::Widget that can embed GtkWidget with and
+        without a GdkWindow. This can be used to embed any GtkWidget.
+
+        Some bits are directly copied from the Scrollbar implementation
+        but can not be easily shared here.
+
+        * GNUmakefile.am:
+        * platform/gtk/GtkPluginWidget.cpp: Added.
+        (WebCore::GtkPluginWidget::GtkPluginWidget):
+        (WebCore::GtkPluginWidget::invalidateRect):
+        (WebCore::GtkPluginWidget::frameRectsChanged):
+        (WebCore::GtkPluginWidget::paint):
+        * platform/gtk/GtkPluginWidget.h: Added.
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25613.
+
+        Implement Widget::setIsSelected for Gtk+ by searching
+        for a property of the name "webkit-widget-is-selected" and if
+        such property exists we are going to set it. We expect
+        the property to take a boolean.
+
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setIsSelected):
+
+2009-05-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/6916371>
+        iWeb 'Announce' button does nothing after publishing to MobileMe
+
+        Add ability to force content sniffing for all urls (including file: urls)
+
+        * WebCore.base.exp:
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniffURL):
+        (WebCore::ResourceHandle::forceContentSniffing):
+        * platform/network/ResourceHandle.h:
+
+2009-05-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25996
+
+        [Qt] Dead-code stripping for unix
+
+        * WebCore.pro: Turn on GCC dead-code stripping flags for Unix
+
+2009-05-10  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25646
+
+        [GTK] Send onscroll events for the main FrameView
+
+        WebKit/GTK+ is currently not sending any onscroll
+        events for a frame with external adjustments. This is
+        due the fact that the value-changed signal of the GtkAdjustment
+        is handled by WebCore::ScrollView directly and is not going through
+        the WebCore::Scrollbar -> WebCore::ScrollbarClient ->
+        WebCore::FrameView::valueChanged -> WebCore::ScrollView::valueChanged
+        path.
+
+        Fix the above problem by wrapping the GtkAdjustment we get
+        assigned from GTK+ in a ScrollbarGtk that will not have any
+        visual appearance. Remove code from ScrollView that knows
+        about adjustments and create a special case for
+        WebCore::ScrollView::createScrollbar that will create such
+        a special WebCore::ScrollbarGtk.
+
+        * platform/ScrollView.cpp: Remove adjustment code
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h: Remove adjustment code
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformDestroy):
+        (WebCore::ScrollView::createScrollbar):
+        (WebCore::ScrollView::setGtkAdjustments):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::createScrollbar): Special case.
+        (ScrollbarGtk::ScrollbarGtk):  New ctor and work on the adjustment
+        (ScrollbarGtk::~ScrollbarGtk): Disconnect signal
+        (ScrollbarGtk::frameRectsChanged): Do nothing when we lack a platformWidget
+        * platform/gtk/ScrollbarGtk.h:
+
+2009-05-26  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26035: Make ImageSource::frameHasAlphaAtIndex() return false for JPEGs with CG
+        <https://bugs.webkit.org/show_bug.cgi?id=26035>
+        <rdar://problem/6924087>
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::frameHasAlphaAtIndex): return false if the image
+        is JPEG, there is no image type, or m_decoder is null.
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix for the JPEGImageDecoder.
+
+        Revision 44167 removed stdio.h from the included headers and
+        this will lead to an error that FILE is not known inside the
+        jpeglib.h Put back the stdio.h include.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+
+2009-05-26  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix the crash issue while running layout tests after enalbed XHTMLMP
+        https://bugs.webkit.org/show_bug.cgi?id=26017
+
+        * dom/Document.cpp:
+        (WebCore::Document::isXHTMLMPDocument):
+
+2009-05-26  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6901751> 
+        REGRESSION (r35515): Tiger crash painting the selection on registration page of car2go.com
+        
+        Don't use the WKCGContextIsSafeToClip function; it wasn't working correctly. Instead, just disable
+        the improved selection drawing on Tiger.
+        
+        * WebCore.Tiger.exp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::fillSelectionGaps):
+
+2009-05-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part two
+        Mostly cosmetic changes, mainly to get image decoders for Cairo build to
+        comply with WebKit style guidelines:
+        * Fix header guard names
+        * Fix initializer list wrapping
+        * Fix class/function "{" wrapping
+        * Fix wrapping of long boolean expressions
+        * Fix whitespace around operators
+        * Eliminate whitespace on otherwise-blank lines
+        * No {} on single-line conditional arms
+        * Use 0 instead of NULL
+        * Don't #include "config.h" in headers
+
+        Also a few non-cosmetic changes:
+        * Remove unneeded #ifdef protecting the contents of these files.  The
+          platforms listed don't match who uses these files anymore (even
+          without considering Skia), and platforms which don't use them at all
+          (like CG) aren't harmed by the files, since they don't have
+          equivalently-named classes.  It's simpler to just ditch these.
+        * Convert a use of Vector<>& into SharedBuffer*, since that's how the
+          data is really stored anyway.
+        * Use size() instead of m_size, for consistency with Skia code, and
+          future-proofing (if a particular decoder wants to specialize this).
+        * Move an ASSERT that was slightly more aggressive than necessary.
+        * Change variable names/types for clarity/accuracy and to match Skia.
+        * Remove unnecessary macro magic to work around a problem which no
+          longer exists in the third-party JPEG headers.
+        * Stop silencing a portability warning about setjmp (the vcproj/vsprops
+          are the right place for this)
+        * In Skia code, don't explicitly check |m_failed| before calling
+          isSizeAvailable(), which itself checks |m_failed|.
+
+        * platform/image-decoders/ImageDecoder.h: Fix header guards, "{" wrapping.
+        (WebCore::RGBA32Buffer::):
+        (WebCore::RGBA32Buffer::RGBA32Buffer): Fix initializer list wrapping.
+        (WebCore::ImageDecoder::ImageDecoder): Fix initializer list wrapping.
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp: Remove unneeded #ifdef.
+        * platform/image-decoders/bmp/BMPImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp: Remove unneeded #ifdef, fix "{" wrapping.
+        (WebCore::GIFImageDecoderPrivate::GIFImageDecoderPrivate): Use an initializer instead of a block-level statement.
+        (WebCore::GIFImageDecoderPrivate::decode): Expect a SharedBuffer.
+        (WebCore::GIFImageDecoderPrivate::getColorMap):
+        (WebCore::GIFImageDecoder::GIFImageDecoder): Fix initializer list wrapping.
+        (WebCore::GIFImageDecoder::frameCount): Add comment.
+        (WebCore::GIFImageDecoder::frameBufferAtIndex): Explicitly cast, fix whitespace around operators.
+        (WebCore::GIFImageDecoder::decode): Pass a SharedBuffer.
+        (WebCore::GIFImageDecoder::initFrameBuffer): Use size() instead of m_size, move ASSERT, fix boolean wrapping, fix indenting.
+        (WebCore::GIFImageDecoder::prepEmptyFrameBuffer): Use size() instead of m_size.
+        (WebCore::GIFImageDecoder::haveDecodedRow): Use size() instead of m_size, eliminate unneeded whitespace, change variable name.
+        (WebCore::GIFImageDecoder::frameComplete): Use size() instead of m_size, no {} on single-line conditional arms, fix boolean wrapping.
+        * platform/image-decoders/gif/GIFImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/gif/GIFImageReader.cpp: Remove unneeded #ifdef.
+        (GIFImageReader::read):
+        * platform/image-decoders/gif/GIFImageReader.h: Fix header guards, change variable type.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp: Remove unneeded #ifdef.
+        * platform/image-decoders/ico/ICOImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Remove unneeded #ifdef, macro magic, silencing of warning.
+        (WebCore::JPEGImageDecoder::outputScanlines): Use size() instead of m_size, change variable name.
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/png/PNGImageDecoder.cpp: Remove unneeded #ifdef, silencing of warning, change variable type.
+        (WebCore::PNGImageReader::PNGImageReader): Fix initializer list wrapping.
+        (WebCore::PNGImageReader::close): Add comment, zero another member for consistency.
+        (WebCore::PNGImageDecoder::PNGImageDecoder): Fix indenting.
+        (WebCore::PNGImageDecoder::decodingFailed): Define in .cpp, not .h.
+        (WebCore::PNGImageDecoder::rowAvailable):
+        * platform/image-decoders/png/PNGImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/skia/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::isSizeAvailable): Don't check m_failed unnecessarily.
+        (WebCore::GIFImageDecoder::frameBufferAtIndex): Fix whitespace around operators.
+        * platform/image-decoders/skia/GIFImageReader.h: "unsigned" is sufficient to convey "unsigned int".
+        * platform/image-decoders/skia/ImageDecoder.h: Remove unnecessary #includes.
+        (WebCore::ImageDecoder::ImageDecoder): Fix initializer list wrapping.
+        * platform/image-decoders/skia/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::JPEGImageReader): Use 0 instead of NULL.
+        (WebCore::JPEGImageDecoder::isSizeAvailable): Don't check m_failed unnecessarily.
+        * platform/image-decoders/skia/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::PNGImageReader): Fix initializer list wrapping.
+        (WebCore::PNGImageDecoder::PNGImageDecoder): Fix indenting.
+        (WebCore::PNGImageDecoder::isSizeAvailable): Don't check m_failed unnecessarily.
+        (WebCore::rowAvailable):
+        * platform/image-decoders/skia/XBMImageDecoder.h: Don't #include config.h.
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp: Remove unneeded #ifdef.
+        * platform/image-decoders/xbm/XBMImageDecoder.h: Fix header guards, "{" wrapping.
+
+2009-05-26  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25944
+        Remove the uses of V8 Locker in worker execution code. No additional test is needed.
+        The normal WebKit layout tests should cover it. However, layout tests that start
+        multiple workers will fail to pass due to test shell limitation in Chromium. To cover
+        this, UI tests will be added (http://code.google.com/p/chromium/issues/detail?id=12554).
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListenerHelper):
+        (WebCore::WorkerContextExecutionProxy::RemoveEventListener):
+
+2009-05-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25974
+        Enable timers in Chromuim workers.
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): Added function which can execute a callback using WorkerContext.
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction): added url parameter to capture the worker's location.
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval): replaced NotImplemented with code to create ScheduledAction and DOMTimer.
+        Also, removed declarations for clearTimeout/clearInterval callbacks since they are now directly generated from IDL.
+
+2009-05-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23649
+        Update V8 bindings to match SQLTransactionErrorCallback change.
+
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent): Changed to return void.
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h: Ditto.
+
+2009-05-26  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Move FilterEffect to platform/graphics/filters. First step to get an
+        SVG independent filter system.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FilterEffect.cpp: Added.
+        (WebCore::FilterEffect::FilterEffect):
+        (WebCore::FilterEffect::~FilterEffect):
+        (WebCore::FilterEffect::externalRepresentation):
+        * platform/graphics/filters/FilterEffect.h: Added.
+        (WebCore::FilterEffect::xBoundingBoxMode):
+        (WebCore::FilterEffect::setXBoundingBoxMode):
+        (WebCore::FilterEffect::yBoundingBoxMode):
+        (WebCore::FilterEffect::setYBoundingBoxMode):
+        (WebCore::FilterEffect::widthBoundingBoxMode):
+        (WebCore::FilterEffect::setWidthBoundingBoxMode):
+        (WebCore::FilterEffect::heightBoundingBoxMode):
+        (WebCore::FilterEffect::setHeightBoundingBoxMode):
+        (WebCore::FilterEffect::subRegion):
+        (WebCore::FilterEffect::setSubRegion):
+        (WebCore::FilterEffect::resultImage):
+        (WebCore::FilterEffect::setEffectBuffer):
+        * svg/FilterEffect.cpp: Removed.
+        * svg/FilterEffect.h: Removed.
+
+2009-05-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23649
+        Update SQLTransactionErrorCallback to not return a value per changes in
+        HTML5 spec.
+
+        Test: storage/transaction-error-callback.html
+
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        (WebCore::SQLTransaction::handleTransactionError):
+        (WebCore::SQLTransaction::deliverTransactionErrorCallback):
+        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionErrorCallback.h:
+
+2009-05-26  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25969
+
+        Detect the case where we can fit without scrollbars when the view shrinks, so that we don't mistakenly
+        continue to show scrollbars.
+
+        Added two tests in fast/dynamic.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-05-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 25801: change AccessibilityAria -> AccessibilityARIA
+        https://bugs.webkit.org/show_bug.cgi?id=25801
+
+        * GNUmakefile.am:
+        * WebCore.order:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.cpp: Copied from WebCore/accessibility/AccessibilityAriaGrid.cpp.
+        (WebCore::AccessibilityARIAGrid::AccessibilityARIAGrid):
+        (WebCore::AccessibilityARIAGrid::~AccessibilityARIAGrid):
+        (WebCore::AccessibilityARIAGrid::create):
+        (WebCore::AccessibilityARIAGrid::addChild):
+        (WebCore::AccessibilityARIAGrid::addChildren):
+        (WebCore::AccessibilityARIAGrid::cellForColumnAndRow):
+        * accessibility/AccessibilityARIAGrid.h: Copied from WebCore/accessibility/AccessibilityAriaGrid.h.
+        * accessibility/AccessibilityARIAGridCell.cpp: Copied from WebCore/accessibility/AccessibilityAriaGridCell.cpp.
+        (WebCore::AccessibilityARIAGridCell::AccessibilityARIAGridCell):
+        (WebCore::AccessibilityARIAGridCell::~AccessibilityARIAGridCell):
+        (WebCore::AccessibilityARIAGridCell::create):
+        (WebCore::AccessibilityARIAGridCell::parentTable):
+        (WebCore::AccessibilityARIAGridCell::rowIndexRange):
+        (WebCore::AccessibilityARIAGridCell::columnIndexRange):
+        * accessibility/AccessibilityARIAGridCell.h: Copied from WebCore/accessibility/AccessibilityAriaGridCell.h.
+        * accessibility/AccessibilityARIAGridRow.cpp: Copied from WebCore/accessibility/AccessibilityAriaGridRow.cpp.
+        (WebCore::AccessibilityARIAGridRow::AccessibilityARIAGridRow):
+        (WebCore::AccessibilityARIAGridRow::~AccessibilityARIAGridRow):
+        (WebCore::AccessibilityARIAGridRow::create):
+        (WebCore::AccessibilityARIAGridRow::parentTable):
+        (WebCore::AccessibilityARIAGridRow::headerObject):
+        * accessibility/AccessibilityARIAGridRow.h: Copied from WebCore/accessibility/AccessibilityAriaGridRow.h.
+        * accessibility/AccessibilityAriaGrid.cpp: Removed.
+        * accessibility/AccessibilityAriaGrid.h: Removed.
+        * accessibility/AccessibilityAriaGridCell.cpp: Removed.
+        * accessibility/AccessibilityAriaGridCell.h: Removed.
+        * accessibility/AccessibilityAriaGridRow.cpp: Removed.
+        * accessibility/AccessibilityAriaGridRow.h: Removed.
+
+2009-05-26  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26012
+
+        Fix the Skia path to normalize the given source rect when
+        drawing patterns, so it accepts negative width/height (as CG does).
+        Fixes Chromium bug http://www.crbug.com/6167.
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-05-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Serialize calls to WebInspector. This is the first step where method 
+        calls are being serialized to arrays (not yet JSON stringified ones) and 
+        are being dispatched on the client. This change also allows client to override 
+        InspectorFrontend, so that the serialized calls can be made on a given object
+        instead of in-process WebInspector global. This will be the main control flow
+        when InspectorController is decoupled from the in-process frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26010
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::overrideFrontendObject):
+        (WebCore::InspectorController::show):
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorFrontend::showPanel):
+        (WebCore::InspectorFrontend::populateInterface):
+        (WebCore::InspectorFrontend::reset):
+        (WebCore::InspectorFrontend::debuggerWasEnabled):
+        (WebCore::InspectorFrontend::debuggerWasDisabled):
+        (WebCore::InspectorFrontend::profilerWasEnabled):
+        (WebCore::InspectorFrontend::profilerWasDisabled):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfile):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::resumedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        (WebCore::InspectorFrontend::newFunctionCall):
+        (WebCore::InspectorFrontend::callSimpleFunction):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.dispatch):
+
+2009-05-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6918671> REGRESSION (r41700): Crashes in debug DumpRenderTree at RefCountedBase::ref().
+
+        * dom/QualifiedName.cpp: (WebCore::QualifiedName::QualifiedName):
+        * dom/QualifiedName.h: (WebCore::QualifiedName::QualifiedNameImpl::QualifiedNameImpl):
+        Adjust empty namespace before QNameComponentsTranslator black magic, not after.
+
+2009-05-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak and Oliver Hunt.
+
+        Added forwarding headers.
+
+        * ForwardingHeaders/wtf/CrossThreadRefCounted.h: Added.
+        * ForwardingHeaders/wtf/OwnFastMallocPtr.h: Added.
+
+2009-05-25  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - WebCore side of <rdar://problem/6914001>.
+
+        Add a new m_allowPopupsFromPlugin flag.
+        
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::processingUserGesture):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::setAllowPopupsFromPlugin):
+        (WebCore::ScriptController::allowPopupsFromPlugin):
+
+2009-05-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26006
+
+        Sort out our use of dynamicGlobalObject and lexicalGlobalObject for
+        window.location.  The correct use appears to be as follows:
+
+        1) Use dynamicGlobalObject to find the user gesture.
+        2) Use dynamicGlobalObject to complete URLs.
+        3) Use lexicalGlobalObject to find the referrer.
+        4) Use lexicalGlobalObject for the frame navigation checks.
+        5) Use lexicalGlobalObject for the XSS checks.
+
+        Tests: http/tests/security/frameNavigation/context-for-location-assign.html
+               http/tests/security/frameNavigation/context-for-location-href.html
+               http/tests/security/frameNavigation/context-for-location.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::shouldAllowNavigation):
+        (WebCore::toLexicalFrame):
+        (WebCore::processingUserGesture):
+        (WebCore::completeURL):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::reload):
+        (WebCore::JSLocation::assign):
+        (WebCore::JSLocation::toString):
+        (WebCore::JSLocationPrototype::customPut):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::processingUserGesture):
+        (WebCore::shouldAllowNavigation):
+        (WebCore::completeURL):
+        (WebCore::navigateIfAllowed):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetLocation):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-25  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        With Windows compilers older then MSVC 2005, the functions
+        gmtime_s and localtime_s don't exist. The gmtime and localtime are
+        on Windows always thread safe. So use them in the cases where
+        gmtime_s and localtime_s are not present.
+
+        * loader/FTPDirectoryDocument.cpp:
+        * loader/FTPDirectoryParser.cpp:
+
+2009-05-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        Follow up on r44120. PluginPackageMac.cpp is used
+        by Qt on Mac and contained a copy of the m_browserFunc
+        assignments and ::equal, ::hash and ::compareFileVersion.
+        Change it to use the ones from PluginPackage.cpp as well.
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::load):
+
+2009-05-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25612
+
+        Support conditionals in the tag factories, by placing
+        feature #ifdefs around the individual factory functions
+        and the registration.
+
+        Made the Audio and Video elements conditional in the tag factories
+
+        * html/HTMLTagNames.in:
+        * dom/make_names.pl:
+
+2009-05-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Gtk build when video is disabled.
+
+        * GNUmakefile.am: Always generate and compile the IDL files for the media
+        elements. They contain proper feature #ifdefs.
+
+2009-05-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build when video is disabled.
+
+        * WebCore.pro: Always generate the IDL files for the media elements. They
+        contain proper ENABLE(VIDEO) #ifdefs.
+
+2009-05-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26004
+
+        The origin for postMessage should follow lexical scope, not dynamic
+        scope.  Yes, this is a super-obscure corner case.
+
+        Test: http/tests/security/postMessage/origin-follows-lexical-scope.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix build bustage related to PassOwnPtr changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25999
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+
+2009-05-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25988
+
+        Minor cleanup in PluginPackage::hash. Let the compiler
+        figure out the size of the array. Do not have it in the
+        definition and specially not the in the call to
+        StringImpl::hash.
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::hash):
+
+2009-05-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25988
+
+        Move ::hash, ::equal and ::compareFileVersion from
+        the duplicated copies in PluginPackageQt.cpp and
+        PluginPackageGtk to PluginPackage.cpp. We need to #ifdef
+        this for the PluginPackageWin version. Use the new style
+        ENABLE() for this feature/policy and enable it in the Gtk+
+        and Qt buildsystem.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::hash):
+        (WebCore::PluginPackage::equal):
+        (WebCore::PluginPackage::compareFileVersion):
+        * plugins/gtk/PluginPackageGtk.cpp:
+        * plugins/qt/PluginPackageQt.cpp:
+
+2009-05-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25988
+
+        So far the initialization of the browserfuncs struct
+        is done in PluginPackageQt, PluginPackageGtk and
+        PluginPackageWin there is no need for this duplication.
+
+        The PluginPackageWin version got copied to PluginPackage
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::initializeBrowserFuncs):
+        * plugins/PluginPackage.h:
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+
+2009-05-24  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Added standard input for filter system.
+
+        No testcases were added. Filter system is still off.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/SourceAlpha.cpp: Added.
+        (WebCore::SourceAlpha::create):
+        (WebCore::SourceAlpha::effectName):
+        (WebCore::SourceAlpha::apply):
+        (WebCore::SourceAlpha::dump):
+        * platform/graphics/filters/SourceAlpha.h: Added.
+        (WebCore::SourceAlpha::SourceAlpha):
+        * platform/graphics/filters/SourceGraphic.cpp: Added.
+        (WebCore::SourceGraphic::create):
+        (WebCore::SourceGraphic::effectName):
+        (WebCore::SourceGraphic::apply):
+        (WebCore::SourceGraphic::dump):
+        * platform/graphics/filters/SourceGraphic.h: Added.
+        (WebCore::SourceGraphic::SourceGraphic):
+        * svg/FilterBuilder.cpp: Added.
+        (WebCore::FilterBuilder::FilterBuilder):
+        (WebCore::FilterBuilder::add):
+        (WebCore::FilterBuilder::getEffectById):
+        (WebCore::FilterBuilder::clearEffects):
+        * svg/FilterBuilder.h:
+
+2009-05-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25612
+
+        Add support conditionals in the JSC bindings generator code for attributes,
+        by placing feature #ifdefs around the setters/getters.
+
+        Made the audio and video element specific DOM attributes conditional
+        in the generated code, by moving the #ifdefs from the IDL files into
+        the generated code. This allows for re-using the same generated code
+        with or without ENABLE(VIDEO).
+
+        * page/DOMWindow.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-05-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix for Qt. Change signature to have PassOwnPtr.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::newTextCodecQt):
+
+2009-05-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - clean up ColorMac a little
+
+        * platform/graphics/mac/ColorMac.h: Whitespace change.
+        * platform/graphics/mac/ColorMac.mm: Removed redundant #import
+        statements and sorted the remaining ones.
+        (WebCore::makeRGBAFromNSColor): Replaced four Objective-C method calls
+        with a single call and removed redundant casts to int.
+        (WebCore::nsColor): Removed ".0f" from number literals used as CGFloats.
+        In one case, this avoids an intermediate conversion to float before
+        conversion to double on 64-bit.
+        (WebCore::CGColorFromNSColor): Replaced four Objective-C method calls
+        with a single call.
+        (WebCore::focusRingColor):
+        (+[WebCoreControlTintObserver controlTintDidChange]): Whitespace change.
+
+2009-05-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] ROLE_ROW_HEADER should not be used for list item bullets/numbers
+        https://bugs.webkit.org/show_bug.cgi?id=25900
+
+        Use ATK_ROLE_TEXT for ListMarkerRole.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole):
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Reformat WebCore::requiresContextForWordBoundary()
+
+        * platform/text/TextBoundaries.h:
+        (WebCore::requiresContextForWordBoundary):
+
+2009-05-23  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Roll out ResourceHandle patch, that I accidently included in my last commit.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniffURL):
+
+2009-05-23  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23808
+
+        After a long journey, add the last missing ABC to share form control element support with HTMLSelectElement.
+        RenderListBox/RenderMenuList operates on SelectElement instead of HTMLSelectElement now, querying selected index etc.
+        This makes it possible to use these render objects for ie. WML, as it's done before for input & option elements.
+
+        WMLSelectElement will be created soon, in a follow-up patch, adding more methods to SelectElement, sharing code between
+        HTMLSelectElement/WMLSelectElement.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::addChildren):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::listBoxOptionIndex):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::actionElement):
+        * dom/Element.h:
+        (WebCore::Element::isFormControlElement):
+        (WebCore::Element::dispatchFormControlChangeEvent):
+        * dom/SelectElement.cpp: Added.
+        (WebCore::toSelectElement):
+        * dom/SelectElement.h: Added.
+        (WebCore::SelectElement::~SelectElement):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::index):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::selectedIndex):
+        (WebCore::HTMLSelectElement::lastSelectedListIndex):
+        (WebCore::HTMLSelectElement::deselectItems):
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::length):
+        (WebCore::HTMLSelectElement::remove):
+        (WebCore::HTMLSelectElement::value):
+        (WebCore::HTMLSelectElement::setValue):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        (WebCore::HTMLSelectElement::selectAll):
+        (WebCore::HTMLSelectElement::appendFormData):
+        (WebCore::HTMLSelectElement::optionToListIndex):
+        (WebCore::HTMLSelectElement::listToOptionIndex):
+        (WebCore::HTMLSelectElement::recalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::dispatchFocusEvent):
+        (WebCore::HTMLSelectElement::dispatchBlurEvent):
+        (WebCore::HTMLSelectElement::menuListDefaultEventHandler):
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        (WebCore::HTMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::HTMLSelectElement::updateListBoxSelection):
+        (WebCore::HTMLSelectElement::menuListOnChange):
+        (WebCore::HTMLSelectElement::listBoxOnChange):
+        (WebCore::HTMLSelectElement::saveLastSelection):
+        (WebCore::HTMLSelectElement::typeAheadFind):
+        (WebCore::HTMLSelectElement::nextSelectableListIndex):
+        (WebCore::HTMLSelectElement::previousSelectableListIndex):
+        (WebCore::HTMLSelectElement::setLength):
+        (WebCore::HTMLSelectElement::checkListItems):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::size):
+        (WebCore::HTMLSelectElement::multiple):
+        (WebCore::HTMLSelectElement::listItems):
+        (WebCore::HTMLSelectElement::setActiveSelectionEndIndex):
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniffURL):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::valueChanged):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::scrollToRevealSelection):
+        (WebCore::RenderListBox::size):
+        (WebCore::RenderListBox::numItems):
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        (WebCore::RenderListBox::panScroll):
+        (WebCore::RenderListBox::autoscroll):
+        (WebCore::RenderListBox::stopAutoscroll):
+        (WebCore::RenderListBox::valueChanged):
+        (WebCore::RenderListBox::nodeAtPoint):
+        * rendering/RenderListBox.h:
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::RenderMenuList):
+        (WebCore::RenderMenuList::updateOptionsWidth):
+        (WebCore::RenderMenuList::updateFromElement):
+        (WebCore::RenderMenuList::setTextFromOption):
+        (WebCore::RenderMenuList::showPopup):
+        (WebCore::RenderMenuList::valueChanged):
+        (WebCore::RenderMenuList::itemText):
+        (WebCore::RenderMenuList::itemIsEnabled):
+        (WebCore::RenderMenuList::itemStyle):
+        (WebCore::RenderMenuList::itemBackgroundColor):
+        (WebCore::RenderMenuList::listSize):
+        (WebCore::RenderMenuList::selectedIndex):
+        (WebCore::RenderMenuList::itemIsSeparator):
+        (WebCore::RenderMenuList::itemIsLabel):
+        (WebCore::RenderMenuList::itemIsSelected):
+        (WebCore::RenderMenuList::setTextFromItem):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::setValueForPosition):
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Fix Gtk/Qt builds for PassOwnPtr
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern): Use an OwnPtr<ImageBuffer>
+        instead of an std::auto_ptr<ImageBuffer> to store the result of
+        ImageBuffer::create() now that it returns a
+        PassOwnPtr<ImageBuffer>.
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeContains): Ditto.
+        (WebCore::Path::strokeBoundingRect): Ditto.
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: Bug 25495: Implement PassOwnPtr and replace uses of std::auto_ptr
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25495>
+
+        Reviewed by Oliver Hunt.
+
+        No test cases added since there is no change in behavior.
+
+        * WebCore.base.exp: Updated export for
+        HistoryItem::setRedirectURLs() which now takes a PassOwnPtr.
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes): Use NodeListsNodeData::create()
+        instead of new NodeListsNodeData.
+        (WebCore::Node::registerDynamicNodeList): Ditto.
+        (WebCore::Node::getElementsByTagNameNS): Ditto.
+        (WebCore::Node::getElementsByName): Ditto.
+        (WebCore::Node::getElementsByClassName): Ditto.
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::create): Added.  Implements
+        create() pattern popularized by RefCounted classes.
+        (WebCore::NodeListsNodeData::NodeListsNodeData): Declared
+        private constructor.
+        (WebCore::NodeRareData::setNodeLists): Now takes a PassOwnPtr<>
+        instead of an auto_ptr<>.
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::setRedirectURLs): Ditto.
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::setRedirectURLs): Ditto.
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal): Use
+        OwnPtr<> instead of auto_ptr<> for stack variable.
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer): Updated to use
+        assignment operator now that ImageBuffer::create() returns a
+        PassOwnPtr<>.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::createHTMLParserQuirks): Return a
+        PassOwnPtr<> instead of a raw HTMLParserQuirks pointer.
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::createHTMLParserQuirks): Ditto.
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern): Use OwnPtr<> instead of
+        auto_ptr<> for stack variable.
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::create): Return PassOwnPtr<> instead of
+        auto_ptr<>.  Use OwnPtr<> instead of auto_ptr<> for stack
+        variable.
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint): Use OwnPtr<> instead of
+        auto_ptr<> for stack variable.
+        * platform/text/TextCodec.h:
+        (WebCore::NewTextCodecFunction): Return PassOwnPtr<> instead of
+        auto_ptr<>.
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::newTextCodecICU): Ditto.
+        * platform/text/TextCodecLatin1.cpp:
+        (WebCore::newStreamingTextDecoderWindowsLatin1): Ditto.
+        * platform/text/TextCodecUTF16.cpp:
+        (WebCore::newStreamingTextDecoderUTF16LE): Ditto.
+        (WebCore::newStreamingTextDecoderUTF16BE): Ditto.
+        * platform/text/TextCodecUserDefined.cpp:
+        (WebCore::newStreamingTextDecoderUserDefined): Ditto.
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::newTextCodec): Ditto.
+        * platform/text/TextEncodingRegistry.h:
+        (WebCore::newTextCodec): Ditto.
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::newTextCodecMac): Ditto.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Use
+        OwnPtr<> instead of auto_ptr<> for stack variable.
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent): Ditto.  Return
+        OwnPtr<> instead of auto_ptr<>.
+        * svg/SVGMaskElement.h:
+        (WebCore::SVGMaskElement::drawMaskerContent): Return OwnPtr<>
+        instead of auto_ptr<>.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern): Use OwnPtr<> instead
+        of auto_ptr<> for stack variable.
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame): Updated to use
+        assignment operator now that ImageBuffer::create() returns a
+        PassOwnPtr<>.
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient): Use OwnPtr<>
+        instead of auto_ptr<> for stack variable.
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setTile): Updated to take a
+        PassOwnPtr<> instead of an auto_ptr<>.
+        (WebCore::SVGPaintServerPattern::setup): Use OwnPtr<> instead of
+        auto_ptr<> for stack variable.
+        * svg/graphics/SVGPaintServerPattern.h:
+        (WebCore::SVGPaintServerPattern::setTile): Updated to take a
+        PassOwnPtr<> instead of an auto_ptr<>.
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask): Updated to use
+        assignment operator now that SVGMaskElement::drawMaskerContent()
+        returns a PassOwnPtr<>.  Use OwnPtr<> instead of auto_ptr<> for
+        stack variable.
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: Bug 25495: Implement PassOwnPtr and replace uses of std::auto_ptr
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25495>
+
+        Reviewed by Oliver Hunt.
+
+        * ForwardingHeaders/wtf/OwnPtrCommon.h: Added.
+        * ForwardingHeaders/wtf/PassOwnPtr.h: Added.
+        * WebCore.vcproj/WebCore.vcproj: Added OwnPtrCommon.h and
+        PassOwnPtr.h.
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Fix Mac builds by backing out r44093
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSGeolocationCustom.cpp:
+        * page/Geolocation.cpp:
+        * page/Geolocation.idl:
+        * page/Geoposition.cpp:
+        * page/Geoposition.h:
+        * page/Geoposition.idl:
+        * page/Navigator.cpp:
+        (WebCore::Navigator::disconnectFrame):
+        (WebCore::Navigator::geolocation):
+        * page/PositionError.idl:
+        * platform/GeolocationService.cpp:
+        (WebCore::GeolocationService::create):
+
+2009-05-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Add GEOLOCATION guards around Geolocation API code
+        https://bugs.webkit.org/show_bug.cgi?id=25756
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSGeolocationCustom.cpp:
+        * page/Geolocation.cpp:
+        * page/Geolocation.idl:
+        * page/Geoposition.cpp:
+        * page/Geoposition.h:
+        * page/Geoposition.idl:
+        * page/Navigator.cpp:
+        (WebCore::Navigator::disconnectFrame):
+        (WebCore::Navigator::geolocation):
+        * page/PositionError.idl:
+        * platform/GeolocationService.cpp:
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Rename startupdateStyleIfNeededDispatcher to startUpdateStyleIfNeededDispatcher
+
+        In r42377, startUpdateRenderingDispatcher() was renamed to
+        startupdateStyleIfNeededDispatcher(), but the camelCase "U" was
+        dropped.  This change restores it.
+
+        * WebCore.order:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::startUpdateStyleIfNeededDispatcher):
+        (WebCore::AnimationControllerPrivate::addEventToDispatch):
+        (WebCore::AnimationControllerPrivate::addNodeChangeToDispatch):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        * page/animation/AnimationControllerPrivate.h:
+
+2009-05-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build-fix for Qt. Disable SVG Filters.
+
+        SVG Filters can not be built right now and Qt should not have
+        them enabled anyway as they do not carry out any filtering.
+
+        * WebCore.pro:
+
+2009-05-23  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed build-fix for gtk. Remove source input files
+        for SVG filter system from the build for the moment and
+        add them later again.
+
+        * GNUmakefile.am:
+
+2009-05-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Preparing Filter primitves for the new filter system.
+
+        No testcases were added. SVG filters are off by default.
+
+        * GNUmakefile.am:
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEColorMatrix.h:
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::FEComponentTransfer::apply):
+        * platform/graphics/filters/FEComponentTransfer.h:
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/FEComposite.h:
+        * svg/Filter.h:
+        * svg/FilterBuilder.h:
+        (WebCore::FilterBuilder::lastFilter):
+        * svg/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * svg/FilterEffect.h:
+        (WebCore::FilterEffect::xBoundingBoxMode):
+        (WebCore::FilterEffect::setXBoundingBoxMode):
+        (WebCore::FilterEffect::yBoundingBoxMode):
+        (WebCore::FilterEffect::setYBoundingBoxMode):
+        (WebCore::FilterEffect::widthBoundingBoxMode):
+        (WebCore::FilterEffect::setWidthBoundingBoxMode):
+        (WebCore::FilterEffect::heightBoundingBoxMode):
+        (WebCore::FilterEffect::setHeightBoundingBoxMode):
+        (WebCore::FilterEffect::subRegion):
+        (WebCore::FilterEffect::setSubRegion):
+        (WebCore::FilterEffect::resultImage):
+        (WebCore::FilterEffect::setEffectBuffer):
+        * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+        (WebCore::FEConvolveMatrix::apply):
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::apply):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply):
+        * svg/graphics/filters/SVGFEDisplacementMap.h:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * svg/graphics/filters/SVGFEFlood.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h:
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFEOffset.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::apply):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+        * svg/graphics/filters/SVGFETile.h:
+        * svg/graphics/filters/SVGFETurbulence.cpp:
+        (WebCore::FETurbulence::apply):
+        * svg/graphics/filters/SVGFETurbulence.h:
+
+2009-05-22  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed build-fix for gtk. Breakage caused by a wrong call of ImageBuffer.
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-05-22  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Eric Seidel.
+
+        Added the use of tileRect() for a correct drawing of
+        border-images.
+
+        Testcases for border-image are in fast/borders like
+        border-image-01.html and will be activated for cairo, once
+        gtk supports pixel tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19652
+        [CAIRO] wrong drawing of border-image
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-05-22  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25684
+
+        Ask the Scrollbar for the orientation.
+
+        Use Scrollbar::orientation to figure out the
+        direction of scrolling.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::valueChanged):
+
+2009-05-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6916082> Incorrect handling of % as CSS value.
+
+        Test: fast/css/percent-character-as-value.html
+
+        * css/CSSGrammar.y: Make a stray % character reliably cause
+        CSS parsing to succeed, but the CSS value to be ignored because
+        of incorrect type. A type of 0 has this effect.
+
+2009-05-22  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25971
+        Correct a handful of build errors in the Windows Cairo variant
+        due to missing VIDEO support.
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude RenderMediaControls for
+          the Cairo-based Windows target.
+        * rendering/RenderThemeWin.cpp: Avoid #include of RenderMediaControls
+          for non-VIDEO builds.
+
+2009-05-22  David Kilzer  <ddkilzer@apple.com>
+
+        One <limits> is enough
+
+        * html/HTMLMediaElement.cpp: Removed duplicate #include <limits>.
+
+2009-05-22  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/6915957> REGRESSION: Hang when leaving page with VLC
+        plug-in
+
+        Reviewed by Steve Falkenburg.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        Look for the VLC plug-in's new name.
+
+2009-05-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25966
+
+        Remove redudant member from Chromium's ResourceRequest.  We already
+        have this data in the cross-platform ResourceRequestBase.  Also, rename
+        ChromiumBridge parameter to be consistant with the new name for this
+        piece of data.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/network/chromium/ResourceRequest.h:
+
+2009-05-22  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Only account for overhang for multi-character strings.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25961
+
+        * platform/wx/wxcode/win/fontprops.cpp:
+        (GetTextExtent):
+
+2009-05-22  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switch to CURL cookies so we can benefit from API updates.
+
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * webcore-wx.bkl:
+
+2009-05-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part one
+        Indent contents of namespaces in header files, to comply with the
+        style guide.  No functional change.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::):
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::bytes):
+        (WebCore::RGBA32Buffer::rect):
+        (WebCore::RGBA32Buffer::height):
+        (WebCore::RGBA32Buffer::status):
+        (WebCore::RGBA32Buffer::duration):
+        (WebCore::RGBA32Buffer::disposalMethod):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setRect):
+        (WebCore::RGBA32Buffer::ensureHeight):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::setDuration):
+        (WebCore::RGBA32Buffer::setDisposalMethod):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setRGBA):
+        (WebCore::ImageDecoder::m_failed):
+        (WebCore::ImageDecoder::~ImageDecoder):
+        (WebCore::ImageDecoder::setData):
+        (WebCore::ImageDecoder::size):
+        (WebCore::ImageDecoder::frameCount):
+        (WebCore::ImageDecoder::repetitionCount):
+        (WebCore::ImageDecoder::supportsAlpha):
+        (WebCore::ImageDecoder::failed):
+        (WebCore::ImageDecoder::setFailed):
+        (WebCore::ImageDecoder::clearFrameBufferCache):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::filenameExtension):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        (WebCore::GIFImageDecoder::filenameExtension):
+        (WebCore::GIFImageDecoder::frameDurationAtIndex):
+        (WebCore::GIFImageDecoder::):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::filenameExtension):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::filenameExtension):
+        (WebCore::JPEGImageDecoder::supportsAlpha):
+        (WebCore::JPEGImageDecoder::reader):
+        (WebCore::JPEGImageDecoder::setSize):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+        (WebCore::PNGImageDecoder::filenameExtension):
+        (WebCore::PNGImageDecoder::reader):
+        (WebCore::PNGImageDecoder::decodingFailed):
+        * platform/image-decoders/xbm/XBMImageDecoder.h:
+        (WebCore::XBMImageDecoder::filenameExtension):
+
+2009-05-22  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Minor changes that allow building a hybrid version of WebKit
+        that has WTF Unicode backend based on GLib functions while
+        text codecs and TextBreakIterator remain based on ICU.
+
+        Fixed some includes that were assuming a WTF ICU backend and
+        introduced temporary usage of WTF_USE_GLIB_ICU_UNICODE_HYBRID
+        macro.
+
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/ThreadGlobalData.h:
+        * platform/text/TextBoundariesICU.cpp:
+        * platform/text/TextCodecICU.h:
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-05-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25955
+
+        Remove the policyBaseURL parameter from setCookie.  This parameter is
+        redundant with the document parameter.
+
+        * WebCore.base.exp:
+        * WebCore.order:
+        * dom/Document.cpp:
+        (WebCore::Document::setCookie):
+        * platform/CookieJar.h:
+        * platform/mac/CookieJar.mm:
+        (WebCore::setCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::setCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::setCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies):
+
+2009-05-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25955
+
+        Rename policyBaseURL and mainDocumentURL to firstPartyForCookies.  The
+        previous names were confusing and inaccurate.
+
+        * WebCore.order:
+        * dom/Document.cpp:
+        (WebCore::Document::setCookie):
+        * dom/Document.h:
+        (WebCore::Document::firstPartyForCookies):
+        (WebCore::Document::setFirstPartyForCookies):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::updateFirstPartyForCookies):
+        (WebCore::FrameLoader::setFirstPartyForCookies):
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        (WebCore::ResourceRequestBase::firstPartyForCookies):
+        (WebCore::ResourceRequestBase::setFirstPartyForCookies):
+        (WebCore::equalIgnoringHeaderFields):
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::firstPartyForCookies):
+        (WebCore::ResourceRequestBase::setFirstPartyForCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::setCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::setCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies):
+
+2009-05-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Fix the call to editingCancelled to be this._editingCancelled, since
+        editingCancelled doesn't exist and throws an exception.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=24881>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+
+2009-05-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25928
+        Several errors detected by cppcheck
+
+        Fix all (the only one) problem in cross-platform code found by the tool. Port maintainers
+        should take a look at other reports.
+
+        * css/CSSParser.cpp: (WebCore::CSSParser::addProperty): Don't leak the property even if there
+        are billions of those.
+
+2009-05-22  Shinichiro Hamaji  <hamaji@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove optimization path alpha=0 case from GraphicContext(CG|Skia).
+        This optimization doesn't make sense for some composite mode (e.g., 'copy' operation).
+
+        https://bugs.webkit.org/show_bug.cgi?id=25956
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-05-22  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Revert the whole thing, since we can't figure out a way to make it
+        work in all platforms.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-05-22  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix Windows build.
+
+        Apparently it can't tell if '1.0f' is float or double, so cast to
+        float.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+
+2009-05-22  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix breakage from the previous patch.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-05-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25805
+        In debug build, mingw win32 build has problems with powf
+
+        Change C-style calls to powf and sqrtf to C++-style calls to
+        overloaded pow and sqrt. This solves also a problem with mingw
+        compiler during the debug build.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-05-21  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6913680> Update image caching options.
+        Disable extra ImageIO cache because we already handle caching decoded image data.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+
+2009-05-21  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 25903: Create a default UI theme for media controls in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=25903
+
+        Implement a default UI for chromium.  Add a style sheet for Chromium
+        media controls with good defaults and implemented basic draw functions
+        for play/pause & mute buttons.
+
+        * css/mediaControlsChromium.css: Added.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumWin::extraMediaControlsStyleSheet): Export
+        our custom media controls style sheet.
+        (WebCore::RenderThemeChromiumLinux::paintMediaButtonInternal): Paint
+        buttons respecting chromium media controls color scheme.
+        (WebCore::RenderThemeChromiumLinux::paintMediaPlayButton): Paint logic
+        specific to play/pause button.
+        (WebCore::RenderThemeChromiumLinux::paintMediaMuteButton): Paint
+        specific to mute button.
+        * rendering/RenderThemeChromiumLinux.h: Appropriate header changes.
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::extraMediaControlsStyleSheet): Export
+        our custom media controls style sheet.
+        (WebCore::RenderThemeChromiumWin::paintMediaButtonInternal): Paint
+        buttons respecting chromium media controls color scheme.
+        (WebCore::RenderThemeChromiumWin::paintMediaPlayButton): Paint logic
+        specific to play/pause button.
+        (WebCore::RenderThemeChromiumWin::paintMediaMuteButton): Paint specific
+        to mute button.
+        (WebCore::RenderThemeChromiumWin::setDefaultFontSize): Appropriate
+        header changes.
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-05-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        When stripping the query from a file:// URL, do not leave a trailing question mark.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25940
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
+
+2009-05-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Notify ImageObserver::didDraw to help the cache purge alive resources.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25942
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+2009-05-21  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Flesh out font fallback for Chromium's Skia port.
+        getLastResortFallbackFont should fall back on well-known fonts.
+        https://bugs.webkit.org/show_bug.cgi?id=25860
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont): try known font names.
+
+2009-05-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - speculative fix for <rdar://problem/6890716> crash at
+          FontCache::purgeInactiveFontData + 199
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::purgeInactiveFontData): Deleting a SimpleFontData
+        can cause releaseFontData() to be called, which modifies
+        gInactiveFontData. Therefore, avoid deleting SimpleFontData instances
+        while iterating over gInactiveFontData and delete them afterwards.
+
+2009-05-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Test for <rdar://problem/6910832> | https://bugs.webkit.org/show_bug.cgi?id=25907
+        Incorrect URL returned to the DOM while the user drags a file
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::tryDHTMLDrag): Don't base our decision on KURL,
+        since that only looks at the text of the document's URL. Do base our
+        decision on the securityOrigin(), which knows more about the document's
+        actual origin.
+
+2009-05-21  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25947
+          Assertion failure in FrameLoader::transitionToCommitted on launch in
+          Safari with r43985
+
+        Rolled out r43979.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+
+2009-05-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson and Mark Rowe.
+
+        Fix for <rdar://problem/6901522>
+        REGRESSION: Office 2008: Preview with browser is not shown, and Finder window is in the front of Safari
+
+        If the NSURLRequest is annotated with a "ForceHTMLMIMEType" property, force
+        the MIME type to be text/html.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+
+2009-05-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Blind windows fix after last commit.
+
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+
+2009-05-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Use an environment variable to control which logs are on and off.
+        Also, make a generic function for translating channel name to its log.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25936
+
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+        * platform/Logging.h:
+        * platform/wx/LoggingWx.cpp:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2009-05-21  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Bug 25946: Chromium needs MIMETypeRegistry::getMediaMIMETypeForExtension implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=25946
+
+        A very simple implementation to keep it working.  A bug has been filed in the chromium db
+        (http://code.google.com/p/chromium/issues/detail?id=12441) to investigate doing something more
+        complete.
+
+        * platform/chromium/MimeTypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
+
+2009-05-20  Siddhartha Chattopadhyaya  <sidchat@google.com>
+
+        Reviewed by Justin Garcia.
+        
+        Add automatic spell correction support in WebKit
+
+        https://bugs.webkit.org/show_bug.cgi?id=24953
+
+        * editing/Editor.cpp:
+        (WebCore::findFirstMisspellingInRange):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        (WebCore::markAllMisspellingsInRange):
+        (WebCore::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::markMisspellings):
+        (WebCore::Editor::markBadGrammar):
+        (WebCore::Editor::markMisspellingsAndBadGrammar):
+        * editing/Editor.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::getAutoCorrectSuggestionForMisspelledWord):
+        * page/EditorClient.h:
+
+2009-05-21  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Darin Adler.
+
+        Text files which have sub MIME types are treated as not displayable
+        http://bugs.webkit.org/show_bug.cgi?id=24903
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType): Regard any
+        MIME type beginning with "text/" as supported and remove all "text/"
+        types from the list.
+
+2009-05-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25890
+        Implement Network logging channel on Mac
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::setDefersLoading):
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        (-[WebCoreResourceHandleAsDelegate connectionShouldUseCredentialStorage:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didCancelAuthenticationChallenge:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:]):
+        (-[WebCoreResourceHandleAsDelegate connection:willStopBufferingData:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]):
+        (-[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didFailWithError:]):
+        (-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]):
+        Added logging for async requests (as these are most interesting).
+
+2009-05-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/6902197> WebCore doesn't know about all of the MIME types supported by QTKit
+        
+        Add a static table to map from some common file extensions to their MIME types so it
+        is possible to detect support even when the platform mapping is incomplete. Use the
+        table to lookup types not found by UTI on the OSX, and when looking for a media engine
+        with a generic or missing type.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeMediaTypeMaps): New, initialize the mediaMIMETypeForExtensionMap.
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension): New. Look for the specified
+        MIME type in the static mapping table if the platform specific getMIMETypeForExtension
+        doesn't find a match.
+        * platform/MIMETypeRegistry.h: Declare getMediaMIMETypeForExtension.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load): When the type passed is empty, "application/octet-stream", or
+        "text/plain", try to look it up based on the file extension with getMediaMIMETypeForExtension.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::addFileTypesToCache): See if getMediaMIMETypeForExtension can map from file extension
+        to MIME type if UTI fails.
+
+2009-05-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Clean up DragController
+        https://bugs.webkit.org/show_bug.cgi?id=25926
+
+        I renamed m_document to m_documentUnderMouse to better document what it does
+        I could call it m_lastDocumentUnderMouse to be most-accurate, but this seemed
+        long enough.
+
+        I also saw copy/paste code involving clearing the selection when moving out of
+        one document and into another.  I moved that code into a function called
+        mouseMovedIntoDocument.
+
+        I also got rid of a couple needless null-checks after confirming via source
+        inspection they were not ever possible.
+        In Mac WebKit it's not possible to have a Page that doesn't have a mainFrame()
+        I left an ASSERT(m_page->mainFrame()) in case some other port ever violates this.
+        It's also not possible to return a document from documentAtPoint that is not
+        in a frame (as such a document would not be rendered).
+
+        No functional changes, thus no tests.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+        (WebCore::DragController::dragIsMove):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::performDrag):
+        (WebCore::DragController::mouseMovedIntoDocument):
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::operationForLoad):
+        (WebCore::DragController::concludeEditDrag):
+        (WebCore::DragController::canProcessDrag):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::placeDragCaret):
+        * page/DragController.h:
+        (WebCore::DragController::documentUnderMouse):
+
+2009-05-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Rename DragController::dragOperation() to sourceDragOperation() for clarity
+        Remove unused setDragOperation()
+
+        There are two times DragOperation is used.  The source specifies
+        what drag operations it supports (in a mask) and the destination
+        picks a subset of those as DragOperations it supports if a drop were
+        to occur.  I was confused when I first saw this accessor as to which
+        it meant.  It turns out that this is only used when WebKit starts a
+        drag, and we keep it around so that we can provide this information
+        to other Mac OS X applications when they ask.  I've renamed the method
+        for clarity so the next person in this code will be less confused.
+
+        No functional changes, thus no tests.
+
+        * page/DragController.h:
+        (WebCore::DragController::sourceDragOperation):
+
+2009-05-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - WebCore part of <rdar://problem/6901751> REGRESSION (r35515): Tiger
+          crash painting the selection on registration page of car2go.com
+
+        A bug in old versions of Core Graphics causes memory corruption to occur
+        when clipping under certain conditions. Make the clipping functions
+        fail silently under those conditions.
+
+        Test: fast/block/float/selection-gap-clip-out-tiger-crash.html
+
+        * WebCore.Tiger.exp: Added wkCGContextIsSafeToClip
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::safeCGContextClip): Added a wrapper around CGContextClip that,
+        on Tiger, bails out if wkCGContextIsSafeToClip() returns false.
+        (WebCore::safeCGContextEOClip): Ditto for CGContextEOClip.
+        (WebCore::safeCGContextClipToRect): Ditto for CGContextClipToRect.
+        (WebCore::GraphicsContext::fillPath): Changed to call the safe variants
+        of CGContextClip, CGContextEOClip and CGContextClipToRect.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+        (WebCore::GraphicsContext::clip): Ditto.
+        (WebCore::GraphicsContext::clipOut): Ditto.
+        (WebCore::GraphicsContext::clipOutEllipseInRect): Ditto.
+        (WebCore::GraphicsContext::clipPath): Ditto.
+        (WebCore::GraphicsContext::addInnerRoundedRectClip): Ditto.
+        (WebCore::GraphicsContext::strokeRect): Ditto.
+        * platform/mac/WebCoreSystemInterface.h: Added wkCGContextIsSafeToClip.
+        * platform/mac/WebCoreSystemInterface.mm: Added wkCGContextIsSafeToClip.
+
+2009-05-21  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25910
+        WebkitGTK r43960 cannot compile
+
+        Do not include local copy of guriescape header, which was
+        removed. We now use the copy in glib.
+
+        * platform/gtk/FileSystemGtk.cpp:
+
+2009-05-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25706
+
+        It turns out the CurrentContext wasn't currect either because it gave
+        us the frame for the write() function itself.  We actually want the
+        *calling* context.
+
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Implement Image::loadPlatformResource.
+
+        Install the four resources we are using. For the icons
+        where an icon name is specified by freedeskop.org try to
+        map the WebCore name to that name and fallback to the
+        internal icon. For everything else use the internal icon
+        name. Remove the temporary link stub as this is not
+        required any more.
+
+        * GNUmakefile.am: Install the png files, set DATA_DIR again
+        * Resources/panIcon.png: Copied from WebKit/win/WebKit.vcproj/panIcon.png.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WTF::GtkIconInfo): Add template specialization for GtkIconInfo
+        (WebCore::getIconFileNameOrFallback): Use GtkIconTheme to get the icon
+        (WebCore::loadResourceIntoSharedBuffer):
+        (WebCore::Image::loadPlatformResource): Implement
+        * platform/gtk/TemporaryLinkStubs.cpp: Remove link stub
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19357
+
+        [GTK] The Gtk+ port wants to have a themable
+        urlIcon too.
+
+        * loader/icon/IconDatabase.cpp:
+
+2009-05-20  Stephanie Lewis  <slewis@apple.com>
+
+        Update the order files.  <rdar://problem/6881750> Generate new order files.
+
+        * WebCore.order:
+
+2009-05-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix some assertion failures in plug-in tests on the Windows debug build bot.
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::startStream): Switch to using protocolIsJavaScript.
+        * plugins/PluginView.cpp:
+        (WebCore::scriptStringIfJavaScriptURL): Ditto.
+
+2009-05-20  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More protocolInHTTPFamily() cleanup.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6905475>
+        Office 2008: Entourage: Crash when you switch to "My Day" view
+
+        The host function callback callObjCFallbackObject was not annotated
+        with JSC_HOST_CALL which meant that when it was called by the JIT, which
+        expects the JSC_HOST_CALL calling convention, the arguments are not in the
+        expected places.
+
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject): Added missing JSC_HOST_CALL
+        annotation on callObjCFallbackObject.
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Not Reviewed, build fix.
+
+        Need to disable this assert while the chormium code is fixed for it.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::protocolIs):
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Not Reviewed, build fix.
+
+        Change KURLGoogle.cpp to mirror the KURL.cpp changes done in
+        http://trac.webkit.org/changeset/43929.  Fix assert placement.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::protocolIs):
+        (WebCore::protocolIs):
+
+2009-05-20  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8 bindings for V8DomWindow.
+        https://bugs.webkit.org/show_bug.cgi?id=25869
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl): Moved from v8_custom.cpp.
+        (WebCore::isAscii): Moved from v8_custom.cpp.
+        (WebCore::convertBase64): Moved from v8_custom.cpp.
+        (WebCore::CALLBACK_FUNC_DECL): Moved from v8_custom.cpp.
+        (WebCore::eventNameFromAttributeName): Moved from v8_custom.cpp.
+        (WebCore::ACCESSOR_SETTER): Moved from v8_custom.cpp.
+        (WebCore::ACCESSOR_GETTER): Moved from v8_custom.cpp.
+        (WebCore::NAMED_ACCESS_CHECK): Moved from v8_custom.cpp.
+        (WebCore::INDEXED_ACCESS_CHECK): Moved from v8_custom.cpp.
+
+2009-05-21  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Jan Alonzo.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl): Always use Glib Base64 decoding.
+
+2009-05-21  Christian Dywan  <christian@twotoasts.de>
+
+        Rubberstamped by Gustavo Noronha.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::parseDataUrl): Remove Gtk/ Glib Base64 decoding.
+
+2009-05-20  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha.
+
+        * GNUmakefile.am:
+        * platform/gtk/guriescape.c:
+        * platform/gtk/guriescape.h: Remove copies of g_uri_escape_string and
+        g_uri_unescape_string now that we require Glib 2.16.
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Not Reviewed, build fix.
+
+        Change KURLGoogle.cpp to mirror the KURL.cpp changes done in
+        http://trac.webkit.org/changeset/43929.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::protocolIsJavaScript):
+        (WebCore::protocolIs):
+
+2009-05-20  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig
+
+        At all call sites that check if a KURL has either the http or https protocol,
+        use the KURL::protocolInHTTPFamily() accessor, instead.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::open):
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::requestIsHTTPOrHTTPSGet):
+
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+
+2009-05-20  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <rdar://problem/6904941> and https://bugs.webkit.org/show_bug.cgi?id=25300
+
+        KURL parsing changes back in r30243 and r30815 made javascript urls that use the form
+        "javascript://" be detected as invalid hierarchical URLs.  When a KURL is marked as
+        invalid, you can no longer ask it a question such as "is your protocol javascript?"
+        Therefore FrameLoader wouldn't recognize them as javascript URLs and instead try to
+        navigate to them.
+
+        URL parsing rules aside, such URLs are in use in the wild (Microsoft's Virtual Earth 
+        being a high profile example) and actually represent valid javascript.
+
+        Whenever checking for javascript urls, the new protocolIsJavaScript() should be used
+        as it functions on a String which doesn't have to pass KURLs parsing rules. 
+
+        Test: fast/loader/javascript-url-hierarchical-execution.html
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue): Use protocolIsJavaScript().
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation): Ditto.
+        (WebCore::createWindow): Ditto.
+        (WebCore::JSDOMWindow::open): Ditto.
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::allowSettingSrcToJavascriptURL): Ditto.
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::allowSettingJavascriptURL): Ditto.
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc): Ditto.
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed): Ditto.
+        (WebCore::JSLocation::reload): Ditto.
+        * editing/markup.cpp:
+        (WebCore::appendQuotedURLAttributeValue): Ditto.
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame): Ditto.
+        (WebCore::FrameLoader::submitForm): Ditto.
+        (WebCore::FrameLoader::executeIfJavaScriptURL): Ditto.
+        
+        * platform/KURL.cpp:
+        (WebCore::KURL::init): Use protocolIsJavaScript().
+        (WebCore::KURL::protocolIs): ASSERT that the protocol being asked about is not javascript.
+           Such checks should go through protocolIsJavaScript() instead.
+        (WebCore::encodeRelativeString): Use protocolIsJavaScript().
+        (WebCore::protocolIsJavaScript):
+        * platform/KURL.h:
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24510
+
+        Fix a bug where the browserfuncs were not properly assigned,
+        make hasproperty use _NP_HasProperty and hasmethod _NP_HasMethod.
+
+        Test: plugins/netscape-invoke-browserfuncs.html
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::load): Fix assignment
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load): Fix assignment
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Make absoluteRectsForRange and absoluteQuadsForRange non-virtual
+        and only exist on RenderText.
+
+        * dom/Range.cpp:
+        (WebCore::Range::textRects):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::drawNodeHighlight): Use absoluteQuads instead
+        of absoluteQuadsForRange since no range is being specifiec.
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderText.h:
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Implement AtkObject::focus-event and
+        AtkObject::state-changed:focused signal emission.
+
+        Adds a new handleFocusedUIElementChangedWithRenderers, only in the
+        GTK port, called at the same point than
+        handleFocusedUIElementChanged but with two parameters, the old and
+        the newly focused RenderObjects. We need this, since the ATK
+        signals require us to pass the objects involved in the focus
+        change as arguments.
+
+        * accessibility/AXObjectCache.h:
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChangedWithRenderers):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25834
+
+        Make ChromeClient a interface again
+
+        With recent additions to ChromeClient.h empty defaults were
+        added. This is bad for porters as these changes go unnoticed
+        and at runtime no notImplemented warning is logged and grepping
+        for notImplemented will not show anything. Change this Client
+        to be like the other Clients again and always have pure virtuals
+        (but for stuff inside #ifdef PLATFORM(MAC)).
+
+        Update the various WebKit/* implementations to compile again.
+
+        * loader/EmptyClients.h: Add empty defaults
+        (WebCore::EmptyChromeClient::setCursor):
+        (WebCore::EmptyChromeClient::scrollRectIntoView):
+        (WebCore::EmptyChromeClient::requestGeolocationPermissionForFrame):
+        * page/ChromeClient.h: Make methods pure virtual
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix a bug where a non visible plugin would show it self in a
+        sibling frame. The problem was due to our clipping. In Qt,
+        if setMask is set with an empty QRegion, no clipping will
+        be performed, so in that case we hide the PluginContainer
+
+        Added manual test.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::adjustGeometry):
+        * manual-tests/qt/plugin-sibling-frame-include.html
+        * manual-tests/qt/plugin-sibling-frame.html
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Do not call the parent implementation (Widget::) in show() and hide()
+        of the PluginViewQt, as it always changes the visible state of the
+        platformWidget (equal to the platformPluginWidget in the Qt port),
+        thus ignoring the isParentVisible() test.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+
+2009-05-20  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+        Change the implementation of HTMLNoScriptElement to avoid the pain of 
+        adding virtual function for XHTMLMP support
+
+        Includes changes suggested by Simon Fraser.
+
+        * dom/Node.cpp:
+        (WebCore::Node::styleForRenderer):
+        * dom/Node.h:
+        * html/HTMLNoScriptElement.cpp:
+        * html/HTMLNoScriptElement.h:
+
+2009-05-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL backend build fix. Make sure URL is always set.
+        
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::downloadTimerCallback):
+
+2009-05-20  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by George Staikos.
+
+        Fix Qt WebKit build break in Mac OS.
+
+        * platform/FileSystem.h:
+
+2009-05-20  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Eric Seidel.
+
+        Enable code that was commented out waiting for a way to get a
+        GdkPixbuf from an image, effectively enabling copying images to
+        the clipboard.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeImage):
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25414
+        [GTK] ROLE_PANEL should not be used for paragraphs and list items.
+
+        Implement Atk list item role for list items.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25414
+        [GTK] ROLE_PANEL should not be used for paragraphs and list items.
+
+        Implement Atk paragraph role for paragraph elements.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-05-20  Eric Seidel  <eric@webkit.org>
+
+        Fix bug URL in ChangeLogs in r43903.
+        https://bugs.webkit.org/show_bug.cgi?id=25742
+
+2009-05-20  Takeshi Yoshino <tyoshino@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 24539: Fix RenderThemeChromiumWin::paintTextFieldInternal() not to hide background image.
+        https://bugs.webkit.org/show_bug.cgi?id=25742
+
+        Fix RenderThemeChromiumWin::paintTextFieldInternal().
+
+        We shouldn't paint the content area of text fields when o->style() has
+        background image or transparent background color. paintTextFieldInternal() is
+        used for painting inner area of HTML option elements by Chromium.
+
+        When we pass fillContentArea = true to ChromiumBridge::paintTextField, it hides
+        the background image rendered by RenderBoxModelObject. So, we should set
+        fillContentArea = false in such case.
+
+        Besides, when background-color:transparent is specified for CSS property,
+        o->style().backgroundColor returns black color with alpha channel == 0. But
+        since ThemeEngine for Windows behind ChromiumBridge::paintTextField cannot
+        recognize alpha channel, it fills the rect with black. I made workaround to set
+        fillContentArea = false when alpha channel == 0 to avoid this.
+
+        And more, I'd like to fallback the color passed to ChromiumBridge to white when
+        o->style()->backgroundColor() is invalid.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
+
+2009-05-20  Shinichiro Hamaji  <hamaji@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25417
+        Map CompositeCopy to Skia's kSrc_Mode composite operation.
+
+        Test: fast/canvas/canvas-composite-alpha.html
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::):
+
+2009-05-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubber-stamped by Xan Lopez.
+
+        Remove misplaced extern "C"
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Expose password field with role of PASSWORD_TEXT
+        https://bugs.webkit.org/show_bug.cgi?id=25682
+
+        Check if input type is a password field and return
+        ATK_ROLE_PASSWORD_TEXT if it is.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        BUG 25845: [Qt] Fix QtWebKit pkgconfig dependencies
+        <https://bugs.webkit.org/show_bug.cgi?id=25845>
+
+        * WebCore.pro: Remove QtDBus; remove QtXml if Qt >= 4.4
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        BUG 25843: [Qt] Remove qt-port build flag
+        <https://bugs.webkit.org/show_bug.cgi?id=25843>
+
+        * bridge/testbindings.pro:
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25824
+
+        [Qt] Cleanup - move files exclusive to JAVASCRIPT_DEBUGGER
+        and WORKERS under the appropriate build section
+
+        * WebCore.pro:
+
+2009-05-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed Qt build fix, after r43892.
+
+        * platform/graphics/qt/ImageQt.cpp: included ImageObservser.h
+
+2009-05-20  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25856
+        [Qt] notify an image has been drawn, to help Cache purge alive decoded data.
+
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY, layout tests fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23727
+        This reverts commit r43888.
+
+        Once that change was checked in many of the fast/flexbox0*.html        
+        tests (and others) started failing.
+
+        * WebCore.pro:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::updateMarqueePosition):
+        (WebCore::RenderMarquee::timerFired):
+
+2009-05-19  Yichao Yin <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Add XHTMLMP support to Webkit
+        Update the configure files for building XHTMLMP-enabled WebKit on different platform
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+
+2009-05-19  Antti Koivisto  <antti@apple.com>
+
+        I can't figure out how to make this not timing dependent, making it manual test instead.
+
+        * manual-tests/preload-scanner-entities.html: Added.
+
+2009-05-19  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Antti Koivisto. 
+
+        <rdar://problem/6886382> REGRESSION (Safari 4PB -> ToT): HTTP cache revalidation broken.
+
+        This was caused in http://trac.webkit.org/changeset/41425, which fixed an image caching bug
+        in QuickLooks (rdar://problem/6619630).
+
+        We need to respect the DocumentLoader's request cache policy when deciding the cache policy
+        for subresources, but the check (originally removed in r39304 and added back in in the same
+        place in r41424) needs to be tweaked and relocated a bit.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::subresourceCachePolicy): Renamed from cachePolicy().  Move checking
+          the DocumentLoader's request to a more appropriate place. Add code to handle the recently 
+          added FIXME regarding POSTs. Add a new FIXME describing a great way to make this code 
+          cleaner in the future.
+        * loader/FrameLoader.h:
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::cachePolicy): Calls the newly renamed subresourceCachePolicy().
+
+2009-05-19  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25872: aria-labeledby appends all siblings instead of all children to aria name
+        https://bugs.webkit.org/show_bug.cgi?id=25872
+
+        When setting the aria-labeledby text it should stay within the element identified by the id
+        when searching through the sibling list.
+  
+        This also removes an outdated assert in getDocumentLinks. Its possible for the document to
+        think an element is a link, but accessibility can treat it differently (eg. its ARIA role is different).
+
+        Test: accessibility/aria-labelledby-stay-within.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaAccessiblityName):
+        (WebCore::AccessibilityRenderObject::getDocumentLinks):
+
+2009-05-19  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler).
+        
+        <rdar://problem/6902674> REGRESSION: Query parameters are sometimes incorrect in URL (23135)
+        
+        Push characters back in correct order when entity parsing fails after 3 characters.
+
+        Test: fast/tokenizer/preload-scanner-entities.html
+
+        * html/PreloadScanner.cpp:
+        (WebCore::PreloadScanner::consumeEntity):
+
+2009-05-19  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a crash in Mac Chromium when displaying an HTML select element
+        with no items.
+        https://bugs.webkit.org/show_bug.cgi?id=25874
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showExternal):
+
+2009-05-19  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8 bindings for CanvasRenderingContext2D.
+        https://bugs.webkit.org/show_bug.cgi?id=25858
+
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp: Moved bindings from v8_custom.cpp.
+
+2009-05-19  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Windows Build Fix.
+
+        * WebCore.vcproj/WebCore.vcproj: Copy accessibility headers from WebCore.
+
+2009-05-19  Timothy Hatcher  <timothy@apple.com>
+
+        <rdar://problem/6889218> REGRESSION: Some iChat transcript resources are not
+        loaded because willSendRequest doesn't happen immediately
+
+        Reviewed by Antti Koivisto.
+
+        * WebCore.base.exp: Export Loader::servePendingRequests().
+
+2009-05-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 25859: Need to upstream ScriptController.* for v8.
+        https://bugs.webkit.org/show_bug.cgi?id=25859
+
+        Fixing the header file (which I accidentally made identical to the cpp file).
+
+        * bindings/v8/ScriptController.h:
+
+2009-05-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler and Brady Eidson.
+
+        <rdar://problem/6900582> REGRESSION (r42446?): UA Profiler in http://stevesouders.com/ua/ stalls
+
+        The problem was that Document::removeAllEventListeners() was called for a wrong document
+        when a CachedFrame was destroyed.
+
+        Cannot be tested automatically, because DRT doesn't have a b/f cache.
+
+        * dom/Document.cpp: (WebCore::Document::domWindow): Make sure that this doesn't return an
+        unrelated window even if document's m_frame pointer is stale.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::clear): Added a FIXME about strange behavior.
+
+2009-05-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Split InspectorController into InspectorController and InspectorFrontend. Latter encapsulates all frontend interaction and is the only entity allowed to make ScriptFunctionCalls. The further plan is to serialize these script function calls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25419
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspect):
+        (WebCore::InspectorController::focusNode):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::setAttachedWindow):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::showPanel):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::addScriptProfile):
+        (WebCore::InspectorController::toggleRecordButton):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::disableDebugger):
+        (WebCore::InspectorController::didParseSource):
+        (WebCore::InspectorController::failedToParseSource):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::didContinue):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDOMStorageResource.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorDatabaseResource.h:
+        * inspector/InspectorFrontend.cpp: Added.
+        (WebCore::callSimpleFunction):
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::~InspectorFrontend):
+        (WebCore::InspectorFrontend::newJSONObject):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorFrontend::showPanel):
+        (WebCore::InspectorFrontend::populateInterface):
+        (WebCore::InspectorFrontend::reset):
+        (WebCore::InspectorFrontend::debuggerWasEnabled):
+        (WebCore::InspectorFrontend::debuggerWasDisabled):
+        (WebCore::InspectorFrontend::profilerWasEnabled):
+        (WebCore::InspectorFrontend::profilerWasDisabled):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfile):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::resumedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h: Added.
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::releaseScriptObject):
+        * inspector/InspectorResource.h:
+
+2009-05-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Introduce JSONObject that wraps ScriptObject and ScriptState* for further serialization
+
+        https://bugs.webkit.org/show_bug.cgi?id=25419
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorResource.cpp:
+        (WebCore::populateHeadersObject):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/JSONObject.cpp: Added.
+        (WebCore::JSONObject::JSONObject):
+        (WebCore::JSONObject::set):
+        (WebCore::JSONObject::scriptObject):
+        (WebCore::JSONObject::createNew):
+        * inspector/JSONObject.h: Added.
+
+2009-05-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Refactor InpectorController so that it does not instantiate resource/console/database/domresource javascript objects. Move instantiation into the javascript.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25419
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorDOMStorageResource::bind):
+        (WebCore::InspectorDOMStorageResource::unbind):
+        * inspector/InspectorDOMStorageResource.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind):
+        (WebCore::InspectorDatabaseResource::unbind):
+        * inspector/InspectorDatabaseResource.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::populateHeadersObject):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::releaseScriptObject):
+        * inspector/InspectorResource.h:
+        * inspector/front-end/Console.js:
+        (WebInspector.ConsoleMessage):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.updateResource):
+        (WebInspector.removeResource):
+        (WebInspector.addDatabase):
+        (WebInspector.addDOMStorage):
+        (WebInspector.reset):
+        (WebInspector.addMessageToConsole):
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        The Qt port has code that disables scrolling optimizations
+        when the root contains native windows, such as windowed plugins.
+
+        This code broke when detaching iframes containing windowed
+        plugins.
+
+        Each ScrollView now knows how many native windows it and its
+        children contain, and when it is detached, that number is
+        substracted from its old parents.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::setParent):
+        * platform/ScrollView.h:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::adjustWidgetsPreventingBlittingCount):
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+
+2009-05-18  David Kilzer  <ddkilzer@apple.com>
+
+        Tiger build fix for r43850
+
+        * platform/mac/ClipboardMac.mm: Added typedef for NSUinteger
+        when building on Tiger.
+
+2009-05-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        ClipboardMac cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=25847
+
+        I'm mostly just moving code, however there are 3 changes I made while moving, detailed below.
+
+        No functional changes, so no tests.
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::clearData):
+        (WebCore::absoluteURLsFromPasteboardFilenames):
+          Broke out logic for filenames into its own function to make the caller more readable.
+        (WebCore::absoluteURLsFromPasteboard):
+          Broke out logic from getData into absoluteURLsFromPasteboard. This returns an NSArray
+          so that we can use -[NSArray componentsJoinedByString] in the caller (which is
+          cleaner than the manual "\n" addition before).
+          This also access to the full list of file urls for future callers.
+        (WebCore::ClipboardMac::getData):
+          unsigned count = (type == "URL") ? 1 : [fileList count]; is now an
+          explicit check for "URL", before it was a check for != "text/uri-list" which
+          was much more confusing in my opinion.  text/uri-list and URL are the only
+          two types which map to NSURLPboardType in cocoaTypeFromMIMEType().
+        (WebCore::ClipboardMac::types):
+          I removed an extra if (!types) check, right before [types count].  In Obj-C
+          messaging nil will return 0 (size of a pointer), so it's safe to message nil
+          here and expect it to return 0.
+
+2009-05-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Bug 25859: Need to upstream ScriptController.* for v8.
+        https://bugs.webkit.org/show_bug.cgi?id=25859
+
+        * bindings/v8/ScriptController.cpp: Added.
+        * bindings/v8/ScriptController.h: Added.
+
+2009-05-18  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Change ScriptElement to support XHTMLMP in a better way
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+
+        * dom/ScriptElement.h:
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.h:
+        (WebCore::SVGScriptElement::shouldExecuteAsJavaScript):
+
+2009-05-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, finish up changes after the accessibility dir split.
+
+        * webcore-base.bkl:
+
+2009-05-18  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos (and others).
+
+        Add XHTMLMP support to Webkit
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+        XHTMLMP is a strict subset of XHTML 1.1. It extends XHTML Basic and add enhanced
+        functionality. Most of the functionalities have already been implemented by Webkit.
+        
+        The changes include:
+        1) Adding <noscript> support
+        2) Document conformance validation
+        3) User Agent conformance validation
+ 
+        refer to the specification: OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf
+
+        Tests: fast/xhtmlmp/check-doctype-declaration.xhtml
+               fast/xhtmlmp/check-rootelement.xhtml
+               fast/xhtmlmp/noscript-in-multiscripts.xhtml
+               fast/xhtmlmp/noscript-nested.xhtml
+               fast/xhtmlmp/noscript.xhtml
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::isXHTMLMPDocument):
+        * dom/Document.h:
+        (WebCore::Document::shouldProcessNoscriptElement):
+        (WebCore::Document::setShouldProcessNoscriptElement):
+        * dom/Node.cpp:
+        (WebCore::Node::createRendererIfNeeded):
+        * dom/Node.h:
+        * dom/XMLTokenizer.h:
+        (WebCore::XMLTokenizer::setIsXHTMLMPDocument):
+        (WebCore::XMLTokenizer::isXHTMLMPDocument):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::startElementNs):
+        (WebCore::XMLTokenizer::endElementNs):
+        (WebCore::XMLTokenizer::endDocument):
+        (WebCore::XMLTokenizer::internalSubset):
+        (WebCore::getEntityHandler):
+        (WebCore::externalSubsetHandler):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::parse):
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+        (WebCore::):
+        * dom/make_names.pl:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::rendererIsNeeded):
+        * html/HTMLNoScriptElement.cpp: Added.
+        (WebCore::HTMLNoScriptElement::HTMLNoScriptElement):
+        (WebCore::HTMLNoScriptElement::~HTMLNoScriptElement):
+        (WebCore::HTMLNoScriptElement::checkDTD):
+        (WebCore::HTMLNoScriptElement::attach):
+        (WebCore::HTMLNoScriptElement::recalcStyle):
+        (WebCore::HTMLNoScriptElement::childShouldCreateRenderer):
+        (WebCore::HTMLNoScriptElement::styleForRenderer):
+        * html/HTMLNoScriptElement.h: Added.
+        (WebCore::HTMLNoScriptElement::rendererIsNeeded):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+        (WebCore::HTMLParser::isInline):
+        * html/HTMLTagNames.in:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+
+2009-05-18  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-05-18  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Fixed build for the Qt port by adding the WebCore/accessibility
+        directory to the includepath.
+
+        * WebCore.pro:
+
+2009-05-18  Chris Fleizach  <cfleizach@apple.com>
+
+        Bug 25776: accessibility should have its own folder in WebCore project
+        https://bugs.webkit.org/show_bug.cgi?id=25776
+   
+        Speculative fix for windows build failure.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-05-18  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 20652: WebKit doesn't display favicons with MIME type image/vnd.microsoft.icon
+
+        <https://bugs.webkit.org/show_bug.cgi?id=20652>
+
+        Reviewed by Darin Adler.
+
+        Test: http/tests/misc/favicon-as-image.html
+
+        * inspector/front-end/inspector.js: Added
+        image/vnd.microsoft.icon to WebInspector.MIMETypes.
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes): Added
+        image/vnd.microsoft.icon to list of supported image and image
+        resource MIME types.
+
+2009-05-18  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25776: accessibility should have its own folder in WebCore project
+        https://bugs.webkit.org/show_bug.cgi?id=25776
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * accessibility: Added.
+        * accessibility/AXObjectCache.cpp: Copied from WebCore/page/AXObjectCache.cpp.
+        * accessibility/AXObjectCache.h: Copied from WebCore/page/AXObjectCache.h.
+        * accessibility/AccessibilityAriaGrid.cpp: Copied from WebCore/page/AccessibilityAriaGrid.cpp.
+        * accessibility/AccessibilityAriaGrid.h: Copied from WebCore/page/AccessibilityAriaGrid.h.
+        * accessibility/AccessibilityAriaGridCell.cpp: Copied from WebCore/page/AccessibilityAriaGridCell.cpp.
+        * accessibility/AccessibilityAriaGridCell.h: Copied from WebCore/page/AccessibilityAriaGridCell.h.
+        * accessibility/AccessibilityAriaGridRow.cpp: Copied from WebCore/page/AccessibilityAriaGridRow.cpp.
+        * accessibility/AccessibilityAriaGridRow.h: Copied from WebCore/page/AccessibilityAriaGridRow.h.
+        * accessibility/AccessibilityImageMapLink.cpp: Copied from WebCore/page/AccessibilityImageMapLink.cpp.
+        * accessibility/AccessibilityImageMapLink.h: Copied from WebCore/page/AccessibilityImageMapLink.h.
+        * accessibility/AccessibilityList.cpp: Copied from WebCore/page/AccessibilityList.cpp.
+        * accessibility/AccessibilityList.h: Copied from WebCore/page/AccessibilityList.h.
+        * accessibility/AccessibilityListBox.cpp: Copied from WebCore/page/AccessibilityListBox.cpp.
+        * accessibility/AccessibilityListBox.h: Copied from WebCore/page/AccessibilityListBox.h.
+        * accessibility/AccessibilityListBoxOption.cpp: Copied from WebCore/page/AccessibilityListBoxOption.cpp.
+        * accessibility/AccessibilityListBoxOption.h: Copied from WebCore/page/AccessibilityListBoxOption.h.
+        * accessibility/AccessibilityObject.cpp: Copied from WebCore/page/AccessibilityObject.cpp.
+        * accessibility/AccessibilityObject.h: Copied from WebCore/page/AccessibilityObject.h.
+        * accessibility/AccessibilityRenderObject.cpp: Copied from WebCore/page/AccessibilityRenderObject.cpp.
+        * accessibility/AccessibilityRenderObject.h: Copied from WebCore/page/AccessibilityRenderObject.h.
+        * accessibility/AccessibilityTable.cpp: Copied from WebCore/page/AccessibilityTable.cpp.
+        * accessibility/AccessibilityTable.h: Copied from WebCore/page/AccessibilityTable.h.
+        * accessibility/AccessibilityTableCell.cpp: Copied from WebCore/page/AccessibilityTableCell.cpp.
+        * accessibility/AccessibilityTableCell.h: Copied from WebCore/page/AccessibilityTableCell.h.
+        * accessibility/AccessibilityTableColumn.cpp: Copied from WebCore/page/AccessibilityTableColumn.cpp.
+        * accessibility/AccessibilityTableColumn.h: Copied from WebCore/page/AccessibilityTableColumn.h.
+        * accessibility/AccessibilityTableHeaderContainer.cpp: Copied from WebCore/page/AccessibilityTableHeaderContainer.cpp.
+        * accessibility/AccessibilityTableHeaderContainer.h: Copied from WebCore/page/AccessibilityTableHeaderContainer.h.
+        * accessibility/AccessibilityTableRow.cpp: Copied from WebCore/page/AccessibilityTableRow.cpp.
+        * accessibility/AccessibilityTableRow.h: Copied from WebCore/page/AccessibilityTableRow.h.
+        * accessibility/chromium: Added.
+        * accessibility/chromium/AXObjectCacheChromium.cpp: Copied from WebCore/page/chromium/AXObjectCacheChromium.cpp.
+        * accessibility/chromium/AccessibilityObjectChromium.cpp: Copied from WebCore/page/chromium/AccessibilityObjectChromium.cpp.
+        * accessibility/chromium/AccessibilityObjectWrapper.h: Copied from WebCore/page/chromium/AccessibilityObjectWrapper.h.
+        * accessibility/gtk: Added.
+        * accessibility/gtk/AXObjectCacheAtk.cpp: Copied from WebCore/page/gtk/AXObjectCacheAtk.cpp.
+        * accessibility/gtk/AccessibilityObjectAtk.cpp: Copied from WebCore/page/gtk/AccessibilityObjectAtk.cpp.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp: Copied from WebCore/page/gtk/AccessibilityObjectWrapperAtk.cpp.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.h: Copied from WebCore/page/gtk/AccessibilityObjectWrapperAtk.h.
+        * accessibility/mac: Added.
+        * accessibility/mac/AXObjectCacheMac.mm: Copied from WebCore/page/mac/AXObjectCacheMac.mm.
+        * accessibility/mac/AccessibilityObjectMac.mm: Copied from WebCore/page/mac/AccessibilityObjectMac.mm.
+        * accessibility/mac/AccessibilityObjectWrapper.h: Copied from WebCore/page/mac/AccessibilityObjectWrapper.h.
+        * accessibility/mac/AccessibilityObjectWrapper.mm: Copied from WebCore/page/mac/AccessibilityObjectWrapper.mm.
+        * accessibility/qt: Added.
+        * accessibility/qt/AccessibilityObjectQt.cpp: Copied from WebCore/page/qt/AccessibilityObjectQt.cpp.
+        * accessibility/win: Added.
+        * accessibility/win/AXObjectCacheWin.cpp: Copied from WebCore/page/win/AXObjectCacheWin.cpp.
+        * accessibility/win/AccessibilityObjectWin.cpp: Copied from WebCore/page/win/AccessibilityObjectWin.cpp.
+        * accessibility/win/AccessibilityObjectWrapperWin.h: Copied from WebCore/page/win/AccessibilityObjectWrapperWin.h.
+        * accessibility/wx: Added.
+        * accessibility/wx/AccessibilityObjectWx.cpp: Copied from WebCore/page/wx/AccessibilityObjectWx.cpp.
+        * page/AXObjectCache.cpp: Removed.
+        * page/AXObjectCache.h: Removed.
+        * page/AccessibilityAriaGrid.cpp: Removed.
+        * page/AccessibilityAriaGrid.h: Removed.
+        * page/AccessibilityAriaGridCell.cpp: Removed.
+        * page/AccessibilityAriaGridCell.h: Removed.
+        * page/AccessibilityAriaGridRow.cpp: Removed.
+        * page/AccessibilityAriaGridRow.h: Removed.
+        * page/AccessibilityImageMapLink.cpp: Removed.
+        * page/AccessibilityImageMapLink.h: Removed.
+        * page/AccessibilityList.cpp: Removed.
+        * page/AccessibilityList.h: Removed.
+        * page/AccessibilityListBox.cpp: Removed.
+        * page/AccessibilityListBox.h: Removed.
+        * page/AccessibilityListBoxOption.cpp: Removed.
+        * page/AccessibilityListBoxOption.h: Removed.
+        * page/AccessibilityObject.cpp: Removed.
+        * page/AccessibilityObject.h: Removed.
+        * page/AccessibilityRenderObject.cpp: Removed.
+        * page/AccessibilityRenderObject.h: Removed.
+        * page/AccessibilityTable.cpp: Removed.
+        * page/AccessibilityTable.h: Removed.
+        * page/AccessibilityTableCell.cpp: Removed.
+        * page/AccessibilityTableCell.h: Removed.
+        * page/AccessibilityTableColumn.cpp: Removed.
+        * page/AccessibilityTableColumn.h: Removed.
+        * page/AccessibilityTableHeaderContainer.cpp: Removed.
+        * page/AccessibilityTableHeaderContainer.h: Removed.
+        * page/AccessibilityTableRow.cpp: Removed.
+        * page/AccessibilityTableRow.h: Removed.
+        * page/chromium/AXObjectCacheChromium.cpp: Removed.
+        * page/chromium/AccessibilityObjectChromium.cpp: Removed.
+        * page/chromium/AccessibilityObjectWrapper.h: Removed.
+        * page/gtk/AXObjectCacheAtk.cpp: Removed.
+        * page/gtk/AccessibilityObjectAtk.cpp: Removed.
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp: Removed.
+        * page/gtk/AccessibilityObjectWrapperAtk.h: Removed.
+        * page/mac/AXObjectCacheMac.mm: Removed.
+        * page/mac/AccessibilityObjectMac.mm: Removed.
+        * page/mac/AccessibilityObjectWrapper.h: Removed.
+        * page/mac/AccessibilityObjectWrapper.mm: Removed.
+        * page/qt/AccessibilityObjectQt.cpp: Removed.
+        * page/win/AXObjectCacheWin.cpp: Removed.
+        * page/win/AccessibilityObjectWin.cpp: Removed.
+        * page/win/AccessibilityObjectWrapperWin.h: Removed.
+        * page/wx/AccessibilityObjectWx.cpp: Removed.
+
+2009-05-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25854
+        [GTK] Should tell servers we only support identity as content encoding
+
+        Let servers know we only support identity as content
+        encoding. We will implement this in libsoup.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-05-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6881160> REGRESSION (r41425): Unable to create battle.net account due to
+        CAPTCHA failure.
+
+        The problem was that after loading and displaying a CAPTCHA image, it was loaded from
+        the server again due to preloading. So, the server expected the last loaded (invisible)
+        CAPTCHA text to be typed and posted back.
+
+        I don't know how to make tests for preloading.
+
+        * loader/DocLoader.cpp: (WebCore::DocLoader::checkForPendingPreloads): There is never a reason
+        to preload after loading for real - and if cache policy is CachePolicyReload, that actually
+        results in another load from network layer.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::cachePolicy): It's not good for cachePolicy()
+        to lie, but I don't know how to re-do r41425 properly. Added a FIXME.
+
+2009-05-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Done together with Balazs Kelemen  <kelemen.balazs@stud.u-szeged.hu>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24551
+
+        [Qt] Reuse FontPlatformData for the same FontDescription.
+        This effectively prevents growing heap usage for loading every web page.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::qHash): Necessary for FontPlatformDataCache.
+        (WebCore::FontCache::getCachedFontPlatformData): Reuse the instance if
+        it exists, otherwise create a new one and insert it in the cache.
+
+2009-05-18  Balazs Kelemen  <kelemen.balazs@stud.u-szeged.hu>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24551
+
+        [Qt] Fix the leak in FontFallbackList::fontDataAt() function.
+        When creating a new instance of SimpleFontData, put it in the font list
+        so that it can deleted later on.
+
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::invalidate):
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::fontDataAt):
+
+2009-05-15  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Style fixes
+
+         * GNUmakefile.am:
+
+2009-05-17  George Staikos  <george.staikos@torchmobile.com>
+
+        Not reviewed - build fix.
+
+        Fix typo: constr -> const.
+
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::setPlaceholder):
+
+2009-05-17  Darin Adler  <darin@apple.com>
+
+        Fix done by Simon Fraser (reviewed by me).
+
+        <rdar://problem/6893775> Page with screen-only stylesheet with overflow and height
+        transitions has bad layout and overlapping garbled text when printing
+
+        * manual-tests/print-with-height-transition-in-screen-stylesheet.html: Added.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationController::updateAnimations): Don't run transitions when printing.
+
+2009-05-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6870241> REGRESSION: Programmatically selected popup menu item not shown
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setSelectedIndex): Added a call to updateFromElement and
+        also a type check on the selected index to avoid a bad cast to HTMLOptionElement.
+
+        * manual-tests/select-option-in-onload.html: Added.
+
+2009-05-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        Rename local variables for readability.
+        
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBorder):
+
+2009-05-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 25840: fix some warnings seen on the GTK bot
+        https://bugs.webkit.org/show_bug.cgi?id=25840
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::platformScrollbarModes): Initialize results here.
+        This is really just to quiet warnings. I think this code is unreachable.
+        Someone could put ASSERT_NOT_REACHED() in here too at some point.
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::startStream): Use proper printf format for int
+        here, %d, not %lu. This could cause a real problem when compiled 64-bit,
+        so it's good to fix.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::getNextSoftBreak): Initialize breakOffset to 0 here. This is
+        really just to quiet the warning, but still seems like a good idea.
+
+2009-05-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25769: Fix accessibility warnings on GTK
+        https://bugs.webkit.org/show_bug.cgi?id=25769
+
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::columnCount): Get rid of excess const.
+        (WebCore::AccessibilityTable::rowCount): Ditto.
+        * page/AccessibilityTable.h: Ditto.
+
+2009-05-17  Kai Brüning  <kai@granus.net>
+
+        Reviewed by Darin Adler.
+
+        bug 25822: DOM normalize does not remove empty text node between element nodes
+        https://bugs.webkit.org/show_bug.cgi?id=25822
+
+        Test: fast/dom/Node/normalize.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::normalize): Changed to remove any empty text nodes.
+
+2009-05-16  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Darin Adler.
+
+        Allow Strings to be created with one malloc node with no copying
+        https://bugs.webkit.org/show_bug.cgi?id=25779
+
+        Add new methods to String and StringImpl, refactoring existing
+        methods in StringImpl to use new createUninitialized() method.
+
+        * platform/text/PlatformString.h:
+        (WebCore::String::createUninitialized):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::createUninitialized):
+        (WebCore::StringImpl::create):
+        * platform/text/StringImpl.h:
+
+2009-05-16  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6827041> WebCore should stop throwing away the CGImageSourceRef to
+        dramatically improve animated GIF decoding performance
+
+        Recent versions of ImageIO discard previously decoded image frames if the client
+        application no longer holds references to them, so there's no need to throw away
+        the decoder unless we're explicitly asked to destroy all of the frames.
+
+        This drops peak CPU usage when displaying <http://www.aintitcool.com/files/HoD2.gif>
+        from over 90% to below 3%.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
+
+2009-05-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        - fix <rdar://problem/6873305> Two distinct characters are not displayed
+          correctly with 2 of the font selections from the stickies widget
+
+        Test: platform/mac/editing/pasteboard/text-precomposed.html
+
+        Ensure that "text/plain" data retrieved from the clipboard is always
+        precomposed. This makes Clipboard::getData() and
+        Pasteboard::documentFragment() consistent with Pasteboard::plainText()
+        and -[WebHTMLView _documentFragmentFromPasteboard:forType:inContext:subresources:].
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::getData):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::documentFragment):
+
+2009-05-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForFamily): Declare valueForFamily as static.
+
+2009-05-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6883872> REGRESSION (r43243): computed style for font-family is returning
+        only the generic font, if any generic font is in the family list
+
+        Test: fast/css/getComputedStyle/computed-style-font-family.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        Sorted computedProperties alphabetically. Added CSSPropertyClip and CSSPropertyWordBreak.
+        (WebCore::identifierForFamily): Added. Maps internal font family names to identifiers.
+        (WebCore::valueForFamily): Added. Creates either an identifier or a string as appropriate.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Implemented the font-family
+        property as specified in the CSS standard. Fixed clip to return "auto" when there is no
+        clip set instead of nothing at all. Gave inheritableProperties and numInheritableProperties
+        internal linkage since there was no reason for them to have external linkage.
+
+2009-05-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25741
+
+        Append instead of throwing when insertItemBefore gets an out-of-bound
+        index.
+
+        Test: svg/dom/svglist-insertItemBefore-appends.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::insertItemBefore):
+
+2009-05-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25829
+        
+        Fix -webkit-background-clip:text when the renderer had a non (0,0) x, y offset.
+
+        Test: fast/backgrounds/background-clip-text.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+
+2009-05-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6888244> REGRESSION: Using the Up or Down keyboard
+          arrows, I can't navigate caret between To Do items in a Note message
+
+        Test: editing/selection/move-by-line-004.html
+
+        * editing/visible_units.cpp:
+        (WebCore::enclosingNodeWithNonInlineRenderer): Added this helper
+        function.
+        (WebCore::previousLinePosition): When advancing to the next candidate
+        node, stop when leaving the closest ancestor of the original node that
+        is not an inline. The code, incorrectly, was trying to exit the closest
+        ancestor of that type which was editable, and therefore missing other
+        blocks in the same editable root.
+        (WebCore::nextLinePosition): Ditto.
+
+2009-05-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Jan Alonzo.
+
+        Converting filename to uri by concatenating strings is broken
+        on Windows. So, don't do it for that platform.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startGio):
+
+2009-05-15  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8 bindings for HTMLOptionsCollection and HTMLSelectElementCollection.
+        https://bugs.webkit.org/show_bug.cgi?id=25739
+
+        * bindings/v8/V8Collection.cpp: Added.
+        (WebCore::toOptionsCollectionSetter): Moved from v8_custom.cpp.
+        * bindings/v8/V8Collection.h: Added prototype for toOptionsCollectionSetter().
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_SETTER): Moved from v8_custom.cpp.
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):  Moved from v8_custom.cpp.
+        (WebCore::INDEXED_PROPERTY_SETTER):  Moved from v8_custom.cpp.
+
+2009-05-15  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6649936> Add *.exp export files to WebCore Xcode project
+
+        Reviewed by Darin Adler and Timothy Hatcher.
+
+        * WebCore.xcodeproj/project.pbxproj: Added Exports group, moved
+        WebCore.base.exp into the group, and added 10 other *.exp files
+        in WebCore.
+
+2009-05-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25826
+        Change type to only have custom getter in JCS.
+
+        * html/HTMLInputElement.idl: Changed CustomGetter attribute to JSCCustomGetter.
+
+2009-05-15  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        Add a settings entry to en/disable web font support
+        https://bugs.webkit.org/show_bug.cgi?id=25239
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+
+2009-05-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        Remove dead youtube site specific hack that was commented out.
+
+        * bindings/js/JSNavigatorCustom.cpp:
+        * page/Navigator.idl:
+
+2009-05-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25826
+        <rdar://problem/6884742> 
+        REGRESSION: In Gmail's Edit Link dialog, I can't type in the Link To: field (due to <input type=url> support)
+
+        Added a site specific quirk for mail.google.com which returns "text" when getting the type of an <input type=url>
+
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::needsGmailQuirk):
+        (WebCore::JSHTMLInputElement::type):
+        * html/HTMLInputElement.idl:
+
+2009-05-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25810
+        Upstream V8 DOM Wrapper map declarations.
+
+        No behavior change, so no tests.
+
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::WeakReferenceMap): Added.
+        (WebCore::WeakReferenceMap::~WeakReferenceMap): Added.
+        (WebCore::WeakReferenceMap::get): Added.
+        (WebCore::WeakReferenceMap::set): Added.
+        (WebCore::WeakReferenceMap::forget): Added.
+        (WebCore::WeakReferenceMap::contains): Added.
+        (WebCore::WeakReferenceMap::impl): Added.
+        (WebCore::DOMWrapperMap::DOMWrapperMap): Added.
+
+2009-05-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25773
+        
+        Rename GraphicsLayer::graphicsContextsFlipped() to 
+        GraphicsLayer::compositingCoordinatesOrientation() in order to clarify the usage.
+
+        Clean up code around the GraphicsLayer "contents" layer that makes use of this
+        flag, by removing the setHasContentsLayer() method, and just using setContentsLayer(),
+        which can then always do the flipping if necessary.
+
+        Only affects ACCELERATED_COMPOSITING builds.
+        
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::contentsLayer):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayer::compositingCoordinatesOrientation):
+        (WebCore::GraphicsLayerCA::setBackgroundColor):
+        (WebCore::GraphicsLayerCA::clearBackgroundColor):
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+        (WebCore::GraphicsLayerCA::clearContents):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setContentsLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+
+2009-05-15  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25765
+
+        Avoid calling setNeedsStyleRecalc() when we are
+        putting an animated page in the cache. This avoids
+        the assert and subsequent problems with a dirty 
+        page going into the cache.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::endAnimation):
+
+2009-05-15  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 25467: JavaScript debugger should use function.displayName as the function's name in the call stack
+        <https://bugs.webkit.org/show_bug.cgi?id=25467>
+        
+        Reviewed by Adam Roben.
+
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::functionName): Use calculatedFunctionName which takes into account displayName
+        * inspector/front-end/CallStackSidebarPane.js: Remove "|| anonymous function" since it is handled internally just like in profiles
+        (WebInspector.CallStackSidebarPane.prototype.update):
+
+2009-05-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix (and a matching Mac change, to avoid unnecessarily diverging the implementations).
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        Check strings with isEmpty(), not relying on any implicit conversions.
+
+2009-05-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler, Brady Eidson and Eric Carlson.
+
+        <rdar://problem/6875643> REGRESSION: Unable to download file with FTP URL that includes
+        username and password (Lightwave 9.6 for Mac from Newtek site)
+
+        CFNetwork only invokes didReceiveAuthenticationChallenge for HTTP requests. Credentials
+        for other protocols (including FTP) should be included as part of the URL.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::WebCoreSynchronousLoader::load):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Put credentials in URL for non-HTTP requests.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::makeSimpleCrossOriginAccessRequest):
+        Bail out quickly if the URL is non-HTTP. Cross-origin requests require specific HTTP
+        headers to be received, so they cannot work with other protocols.
+
+2009-05-15  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] In the image decoder, remove the raw image data represented as QImage
+        once the image is converted to QPixmap and inserted in the pixmap cache.
+        This effectively reduces the heap usage when running on graphics system
+        other than raster (i.e the case where QImage != QPixmap).
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::imageAtIndex): Nullified the image on purpose.
+        * platform/graphics/qt/ImageDecoderQt.h: Made m_imageList mutable.
+
+2009-05-15  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Refactor alpha channel detection the image decoder.
+        Sets the boolean flag as soon as the image is being read.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialized m_hasAlphaChannel.
+        (WebCore::ImageDecoderQt::setData): Set the flag when appropriate.
+        (WebCore::ImageDecoderQt::supportsAlpha): Simplified.
+        (WebCore::ImageDecoderQt::reset): Resetted the flag.
+        * platform/graphics/qt/ImageDecoderQt.h: Added m_hasAlphaChannel.
+
+2009-05-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Finish support for disabling the JavaScript Debugger and Profiler 
+        at compile time in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=24917
+
+        * bindings/js/JSInspectorControllerCustom.cpp: ENABLE_JAVASCRIPT_DEBUGGER guard
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp: Ditto.
+        * inspector/JavaScriptCallFrame.cpp: Ditto.
+        * inspector/JavaScriptCallFrame.h: Ditto.
+        * inspector/JavaScriptCallFrame.idl: Ditto.
+        * inspector/JavaScriptDebugListener.h: Ditto.
+        * inspector/JavaScriptDebugServer.cpp: Ditto.
+        * inspector/JavaScriptDebugServer.h: Ditto.
+        * inspector/JavaScriptProfile.cpp: Ditto.
+        * inspector/JavaScriptProfile.h: Ditto.
+        * inspector/JavaScriptProfileNode.cpp: Ditto.
+        * inspector/JavaScriptProfileNode.h: Ditto.
+        * page/Console.cpp: Use guard ENABLE(JAVASCRIPT_DEBUGGER) instead of USE(JSC)
+        * page/Console.h: Ditto.
+        * page/Console.idl: Use guard ENABLE(JAVASCRIPT_DEBUGGER) instead of !defined(V8_BINDING)
+
+2009-05-15  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Dimitri Glazkov
+
+        http://bugs.webkit.org/show_bug.cgi?id=25464
+
+        Improve the font fallback for characters belonging to 'common' scripts
+        in ChromiumWin port. Make characters like Danda, Double Danda (punctuation
+        marks in North Indian scripts) and currency signs (e.g. Thai Baht)
+        rendered correctly in Chromium on Win. 
+
+        Tests: fast/text/international/danda-space.html
+               fast/text/international/thai-baht-space.html
+
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::FontMap::getScriptBasedOnUnicodeBlock):
+        (WebCore::FontMap::getScript):
+        (WebCore::getFallbackFamily):
+
+2009-05-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25731
+        [Qt] Cleanup - move files exclusive to XPATH and XSLT under the
+        appropriate build section
+
+        * WebCore.pro:
+
+2009-05-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel and Darin Fisher.
+
+        Fix a font-related leak in Chromium's Skia backend found by Valgrind.
+        https://bugs.webkit.org/show_bug.cgi?id=25760
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        Use caches instead of "new" on every call.
+
+2009-05-14  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize m_spreadMethod in the second constructor too. Not sure if
+        a test case can be written, so no test case.
+        https://bugs.webkit.org/show_bug.cgi?id=25814
+
+        No test possible: spreadMethod() is only used by SVG, doesn't seem possible to hit
+        this case, since several other SVG tests already should be calling
+        spreadMethod().
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::Gradient):
+
+2009-05-14  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Fix Windows build after renaming MediaControlElements to MediaControlElementType.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+        * rendering/RenderMediaControls.h:
+
+2009-05-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        <rdar://problem/6739671> Movie controller’s play button does not change into a pause
+        button
+
+        Fix a controls repaint issue when the playing state of a video changes by
+        educating the MediaControlInputElements about the state they are currently
+        displaying, and making them repaint when that state changes. This applies
+        to the play/pause and mute/unmute buttons, which both have two states.
+        
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        Pass in and initialize the MediaControlElementType.
+        
+        (WebCore::MediaControlInputElement::update):
+        Update the display type too
+        
+        (WebCore::MediaControlInputElement::setDisplayType):
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
+        (WebCore::MediaControlMuteButtonElement::updateDisplayType):
+        Choose muted vs. unmuted display.
+        
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
+        (WebCore::MediaControlPlayButtonElement::updateDisplayType):
+        Choose play vs. paused display.
+
+        * rendering/MediaControlElements.h:
+        Renamed the MediaControlElements enum to MediaControlElementType.
+        (WebCore::MediaControlInputElement::updateDisplayType):
+        Add a MediaControlElementType member variable with a setter to allow
+        the element to know what type it is displaying.
+
+2009-05-14  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25197
+
+        Add support for aspect-ratio and orientation
+        media queries.
+
+        Tests: fast/media/mq-aspect-ratio.html
+               fast/media/mq-orientation.html
+
+        * css/MediaFeatureNames.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::orientationMediaFeatureEval):
+        (WebCore::aspect_ratioMediaFeatureEval):
+        (WebCore::min_aspect_ratioMediaFeatureEval):
+        (WebCore::max_aspect_ratioMediaFeatureEval):
+        * css/MediaQueryExp.h:
+        (WebCore::MediaQueryExp::isViewportDependent):
+
+2009-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        - Resubmitting previous patch, correctly this time.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+
+2009-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        - Rolling out to fix a bug and the build
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+
+2009-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6510362> In some situations message content is messed up
+        when indentation is decreased
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode): Calling recursively
+        here served to do nothing because this function will return if the
+        second argument is the parent of the first.  Not only does this now work
+        as intended, but is necessary for the rest of this fix.
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph): To determine if we 
+        are the last node in a <blockquote>, and can therefore remove the
+        <blockquote> we need the endOfEnclosingBlock to extend to the end of
+        the <blockquote> not just the next block, which could be a <div>, for
+        example. 
+        - Also If a <blockquote> is removed, but it's the child of another
+        <blockquote> then its children are now children of the top <blockquote>.
+        In this case we want to split the parent <blockquote> because the next
+        paragraph assumes that it is the first node in its <blockquote> and if
+        that is not true, various bugs arise.
+
+2009-05-14  Brady Eidson  <beidson@apple.com>
+
+        Build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::setDefaultMIMEType):
+
+2009-05-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix http/tests/xmlhttprequest/cache-override.html on Windows
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::setDefaultMIMEType): Modify the previous response so it maintains all of its data.
+        (WebCore::didReceiveResponse): Call setDefaultMIMEType() when needed.
+        (WebCore::WebCoreSynchronousLoader::load): Ditto.
+
+2009-05-14  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug: Mac Chromium popup menus are not positioned correctly
+        on scrolled pages:
+        https://bugs.webkit.org/show_bug.cgi?id=25772
+
+        Fix Mac Chromium popup menu placement by taking into
+        account any scrolling in the current window. This mirrors
+        the positioning done in PopupContainer::show(), which is
+        used on Chromium Windows and linux.
+
+        Also fixed indenting for this method.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showExternal):
+
+2009-05-14  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25774
+        Upstream V8MessagePortCustom.cpp from the chromium repository.
+
+        * bindings/v8/custom/V8MessagePortCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=25777
+        
+        StyleGeneratedImage::imageSize() needs to take zooming into account for
+        fixed-size images (i.e. canvas) so that canvas-as-image-background
+        renders correctly with zooming.
+
+        Test: fast/canvas/canvas-bg-zoom.html
+
+        * rendering/style/StyleGeneratedImage.cpp:
+        (WebCore::StyleGeneratedImage::imageSize):
+
+2009-05-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch originally by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25796
+        <rdar://problem/6886654> Shouldn't set referer and origin in Loader::Host::servePendingRequests().
+
+        Test: http/tests/security/credentials-in-referer.html
+
+        * loader/loader.cpp: (WebCore::Loader::Host::servePendingRequests): This will be done in
+        SubresourceLoader::create() anyway.
+
+2009-05-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25797: Pages with image maps are not properly read with Voiceover
+        https://bugs.webkit.org/show_bug.cgi?id=25797
+
+        * page/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::isEnabled):
+
+2009-05-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6887762> and https://bugs.webkit.org/show_bug.cgi?id=25790 
+
+        Nuke the bogus ASSERT and add a legitimate ASSERT with a little help from a new accessor.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniff):
+        * platform/network/ResourceHandle.h:
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+        (WebCore::didReceiveResponse):
+
+2009-05-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25791
+        Bug 25791: HTMLMediaElement: implement 'startTime' attribute
+        
+        Support the recently added HTMLMediaElement 'startTime' attribute. This is a read-only 
+        value that only the media engine can know, so we just need to add the attribute 
+        to HTMLMediaElement and add methods to MediaPlayer and MediaPlayerPrivateInterface so 
+        the engine can make it available.
+
+        Test: media/media-startTime.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::startTime): New.
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::startTime): New.
+        * platform/graphics/MediaPlayer.h:
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::startTime): New.
+
+2009-05-14  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Only create a QWidget wrapper for the plugin in the case it is not
+        in the Qt window mapper, and thus receiving events from the Qt
+        event system. Native Qt based plugins running in process, will
+        already be in the window mapper, and thus creating a wrapper,
+        stops them from getting events from Qt, as they are redirected
+        to the wrapper.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::on_clientIsEmbedded):
+
+2009-05-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25784
+        Leaks seen on HTTP tests
+
+        We should change ResourceHandleMac.mm to use smart pointers some day, but this is a minimal fix.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::loadResourceSynchronously): Release mutable request copy made for
+        disabling content sniffing, matching the normal code path.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Release m_user
+        and m_pass before overwriting.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
+
+2009-05-14  Yury Semikhatsky <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25418
+        Remove new lines from event handler wrapper to make line numbers
+        in the wrapped script conside with the lines in the original script.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+
+2009-05-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove a JSC-specific include that is already added by including
+        ScriptController.
+
+        No change in behavior, so no tests.
+
+        * dom/Document.cpp: Removed JSDOMBinding include.
+
+2009-05-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/4072827> Downloaded non-ASCII file name becomes garbled
+
+        Hopefully, a final stroke. When updating ResourceRequest from a platform request, a wrong
+        CFString function was used, so a user-friendly name was stored in encoding fallback array.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/mac/ResourceRequestMac.mm: (WebCore::ResourceRequest::doUpdateResourceRequest):
+
+2009-05-14  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Add more ENABLE_DATABASE guards.
+        https://bugs.webkit.org/show_bug.cgi?id=25616
+
+        See also https://bugs.webkit.org/show_bug.cgi?id=24776 (original set of guards)
+
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementCallback.h:
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.h:
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.h:
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * storage/Database.cpp:
+        * storage/DatabaseDetails.h:
+        * storage/OriginUsageRecord.cpp:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLError.h:
+        * storage/SQLError.idl:
+        * storage/SQLResultSet.cpp:
+        * storage/SQLResultSet.h:
+        * storage/SQLResultSet.idl:
+        * storage/SQLResultSetRowList.cpp:
+        * storage/SQLResultSetRowList.h:
+        * storage/SQLResultSetRowList.idl:
+        * storage/SQLStatementCallback.h:
+        * storage/SQLStatementErrorCallback.h:
+        * storage/SQLTransactionCallback.h:
+        * storage/SQLTransactionErrorCallback.h:
+
+2009-05-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25787
+
+        Gtk was the last platform to not unregister plugins when
+        the plugin is stopped. Catch up with r43550.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::stop):
+
+2009-05-14  Adam Roben  <aroben@apple.com>
+
+        Make WebCore.vcproj's pre-build event work again
+
+        * WebCore.vcproj/WebCore.vcproj: Removed empty override of the
+        pre-build event that was accidentally left in when the pre-build event
+        was moved to WebCoreCommon.vsprops.
+
+2009-05-14  Darin Adler  <darin@apple.com>
+
+        * manual-tests/right-click-crash.html: Added.
+
+2009-05-14  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        <rdar://problem/6681868> When building with Xcode 3.1.3 should be using gcc 4.2
+
+        The meaning of XCODE_VERSION_ACTUAL is more sensible in newer versions of Xcode.
+        Update our logic to select the compiler version to use the more appropriate XCODE_VERSION_MINOR
+        if the version of Xcode supports it, and fall back to XCODE_VERSION_ACTUAL if not.
+
+        * Configurations/Base.xcconfig:
+
+2009-05-13  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * WebCore.NPAPI.exp:
+
+2009-05-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix invalid memory write seen in HTMLCanvasElement by Valgrind
+        https://bugs.webkit.org/show_bug.cgi?id=25759
+
+        I can't think of any way to catch this with a layout test, so no test.
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::canvasDestroyed):
+        * css/CSSCanvasValue.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::~HTMLCanvasElement):
+        * html/HTMLCanvasElement.h:
+
+2009-05-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - fix <rdar://problem/5483015> Replies in Mail are drawn first without
+          the user style sheet and then redrawn with the style sheet
+
+        Test: platform/mac/fast/loader/user-stylesheet-fast-path.html
+
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::setUserStyleSheetLocation): For data URLs with
+        base64-encoded UTF-8 data, just decode the style sheet here an apply
+        it synchronously instead of invoking an asynchronous loader.
+
+2009-05-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Bug 25755: Implement ARIA grid role
+        https://bugs.webkit.org/show_bug.cgi?id=25755
+
+        Fix build bustage from last checkin.
+
+        * page/AccessibilityAriaGrid.cpp:
+        (WebCore::AccessibilityAriaGrid::addChild):
+
+2009-05-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25755: Implement ARIA grid role
+        https://bugs.webkit.org/show_bug.cgi?id=25755
+
+        Test: accessibility/aria-tables.html
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::nodeIsAriaType):
+        (WebCore::AXObjectCache::getOrCreate):
+        * page/AXObjectCache.h:
+        * page/AccessibilityAriaGrid.cpp: Added.
+        (WebCore::AccessibilityAriaGrid::AccessibilityAriaGrid):
+        (WebCore::AccessibilityAriaGrid::~AccessibilityAriaGrid):
+        (WebCore::AccessibilityAriaGrid::create):
+        (WebCore::AccessibilityAriaGrid::addChild):
+        (WebCore::AccessibilityAriaGrid::addChildren):
+        (WebCore::AccessibilityAriaGrid::cellForColumnAndRow):
+        * page/AccessibilityAriaGrid.h: Added.
+        (WebCore::AccessibilityAriaGrid::isAriaTable):
+        * page/AccessibilityAriaGridCell.cpp: Added.
+        (WebCore::AccessibilityAriaGridCell::AccessibilityAriaGridCell):
+        (WebCore::AccessibilityAriaGridCell::~AccessibilityAriaGridCell):
+        (WebCore::AccessibilityAriaGridCell::create):
+        (WebCore::AccessibilityAriaGridCell::parentTable):
+        (WebCore::AccessibilityAriaGridCell::rowIndexRange):
+        (WebCore::AccessibilityAriaGridCell::columnIndexRange):
+        * page/AccessibilityAriaGridCell.h: Added.
+        * page/AccessibilityAriaGridRow.cpp: Added.
+        (WebCore::AccessibilityAriaGridRow::AccessibilityAriaGridRow):
+        (WebCore::AccessibilityAriaGridRow::~AccessibilityAriaGridRow):
+        (WebCore::AccessibilityAriaGridRow::create):
+        (WebCore::AccessibilityAriaGridRow::parentTable):
+        (WebCore::AccessibilityAriaGridRow::headerObject):
+        * page/AccessibilityAriaGridRow.h: Added.
+        * page/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * page/AccessibilityList.h:
+        * page/AccessibilityObject.h:
+        (WebCore::):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::AccessibilityTable):
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        * page/AccessibilityTable.h:
+        (WebCore::AccessibilityTable::isAriaTable):
+        * page/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::parentTable):
+        (WebCore::AccessibilityTableCell::isTableCell):
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * page/AccessibilityTableCell.h:
+        * page/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::setParentTable):
+        (WebCore::AccessibilityTableColumn::headerObject):
+        * page/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::isTableRow):
+        (WebCore::AccessibilityTableRow::parentTable):
+        * page/AccessibilityTableRow.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::):
+
+2009-05-13  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 25763: Need to move v8 custom binding to the custom directory.
+        https://bugs.webkit.org/show_bug.cgi?id=25763
+
+        No test due to no change in behavior.
+
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Renamed from WebCore/bindings/v8/V8CanvasPixelArrayCustom.cpp.
+
+2009-05-13  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix LayoutTests/fast/dom/Element/attr-param-typechecking.html crashing with V8.
+        https://bugs.webkit.org/show_bug.cgi?id=25758
+
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): return the result of throwError() if it is called.
+
+2009-05-13  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix a number of bugs relating to RTL and text-overflow:ellipsis.
+        Also refactor the relevant code to make it a little clearer.
+
+        This CL fixes 3 fundamental issues:
+        - Corrects behavior if the truncated InlineTextBox's directionality is
+          different from the overall flow direction - bug 25135.
+        - Make decoration drawing in InlineFlowbox RTL-aware - bug 24206.
+        - Full truncation on InlineBoxes in RTL flow - bug 24186
+        - Add tests for the above + reorder/cleanup tests for easier
+          interpretation of outcome.
+
+        The code for placing ellipsis has been refactored to use
+        left/right notation rather than a single variable whose meaning
+        could differ based on flow directionality.
+
+        To support differing inline directionality vs flow directionality,
+        different variables are now used in InlineTextBox::placeEllipsisBox to
+        track the two.
+
+        The drawing mode for underlines in standards mode now correctly handles
+        RTL truncation and relevant test where added.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24186
+        https://bugs.webkit.org/show_bug.cgi?id=25135
+        https://bugs.webkit.org/show_bug.cgi?id=24206
+
+        Tests: fast/css/text-overflow-ellipsis-bidi.html
+               fast/css/text-overflow-ellipsis-strict.html
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::placeEllipsisBox):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        (WebCore::InlineFlowBox::placeEllipsisBox):
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::placeEllipsisBox):
+        (WebCore::InlineTextBox::paint):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::placeEllipsis):
+        (WebCore::RootInlineBox::placeEllipsisBox):
+        * rendering/RootInlineBox.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::checkLinesForTextOverflow):
+
+2009-05-13  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25746
+        Revert http://trac.webkit.org/changeset/43507 which caused crash in PPC nightlies with Safari 4.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::matchFunc):
+        (WebCore::openFunc):
+        (WebCore::createStringParser):
+        (WebCore::createMemoryParser):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::localStorageThread):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Fix for <rdar://problem/6872894> REGRESSION (r41896-42143): First letter cut off in styled select menus
+        
+        Make sure to do rounded clipping for overflow and controls relative to the border box and not to the overflow/control clip rect
+        (which is typically clipped to the padding or content box).  Doing so was causing rounded clips to be incorrectly applied to padding and
+        content.
+    
+        Added fast/overflow/border-radius-clipping.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::pushContentsClip):
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Revert the parser arena change. It was a slowdown, not a speedup.
+        Better luck next time (I'll break it up into pieces).
+
+2009-05-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin and Darin Adler.
+
+        Fix for <rdar://problem/6869687> REGRESSION (r41203): Facebook friend suggestions disappear on update.
+        
+        Make sure that renderers are marked for layout if a style change causes them to switch from having a self-painting layer
+        to a non-self-painting layer (and vice versa).
+        
+        Move misplaced layer repainting code that was in RenderBox up into RenderBoxModelObject so that inlines with layers
+        repaint properly on opacity changes, etc.
+
+        Added fast/repaint/opacity-change-on-overflow-float.html.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        * rendering/RenderBoxModelObject.h:
+
+2009-05-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Not reviewed, build fix.
+
+        Move an include, needed by Debugger under the corresponding guard.
+
+        * inspector/InspectorController.cpp: Moved parser/SourceCode under JAVASCRIPT_DEBUGGER
+            guard.
+
+2009-05-13  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 25394: REGRESSION: crash in DocumentLoader::addResponse due to bad |this| pointer
+        https://bugs.webkit.org/show_bug.cgi?id=25394
+
+        Test: http/tests/xmlhttprequest/frame-unload-abort-crash.html
+
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        Add another check to subresource loader to avoid doing any loads in frames
+        when the loaders are being stopped.
+
+2009-05-13  Stephan Haller  <nomad@froevel.de>
+
+        Reviewed by Gustavo Noronha.
+
+        Wrong handling of file upload if no file selected
+        https://bugs.webkit.org/show_bug.cgi?id=25649
+
+        Fixed returned path if path is empty
+
+        * WebCore/platform/gtk/FileSystemGtk.cpp:
+
+2009-05-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6805567> REGRESSION (r42348): Notes flicker white
+          when loading
+
+        Tests: fast/frames/content-opacity-1.html
+               fast/frames/content-opacity-2.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset): Reset m_contentIsOpaque to false.
+        (WebCore::FrameView::useSlowRepaints): Use slow repaints if the content
+        is not known to be opaque.
+        (WebCore::FrameView::setContentIsOpaque): Added. Sets m_contentIsOpaque
+        and enables or disables fast repaints accordingly.
+        * page/FrameView.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Removed the
+        document()->haveStylesheetsLoaded() condition in determining whether the
+        root is opaque. This is what was causing the bug, as iframes were
+        considered to be opaque, and thus painted an opaque white background,
+        whenever they were pending a style sheet load.
+        Changed to call FrameView::setContentIsOpaqe() instead of
+        setUseSlowRepaints(), which allows the frame to go back to fast repaints
+        if the content becomes opaque.
+        Corrected the check for background color opacity: any alpha value other
+        than 255--not just zero--is not opaque.
+
+2009-05-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Sam Weinig.
+
+        [Qt] Fix "lighther" composition mode.
+        QPainter::CompositionMode_Plus is the right match.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        * bindings/js/JSDOMBinding.h: Removed include of JSFunction.h.
+        We don't want the entire DOM binding to depend on that file.
+
+        * bindings/js/JSAudioConstructor.cpp: Added include of Error.h.
+        Before we inherited this automatically because JDDOMBinding.h
+        included JSFunction.h, but that was excessive.
+        * bindings/js/JSDOMWindowCustom.cpp: Ditto.
+        * bindings/js/JSHTMLInputElementCustom.cpp: Ditto.
+        * bindings/js/JSImageConstructor.cpp: Ditto.
+        * bindings/js/JSLazyEventListener.cpp: Ditto, but for JSFunction.h.
+        * bindings/js/JSMessageChannelConstructor.cpp: Ditto.
+        * bindings/js/JSOptionConstructor.cpp: Ditto.
+        * bindings/js/JSWorkerConstructor.cpp: Ditto.
+        * bindings/js/JSXMLHttpRequestConstructor.cpp: Ditto.
+        * bridge/jni/jni_jsobject.mm: Ditto, but for SourceCode.h.
+        * inspector/InspectorController.cpp: Ditto.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        Moved mose of this function into the base class in JavaScriptCore,
+        so the details of compilation don't have to be exposed.
+
+2009-05-13  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6879145>
+        Generate a contextual menu item allowing autocorrections to
+        easily be changed back.  Refrain from re-correcting items
+        that have already been autocorrected once.
+
+        * dom/DocumentMarker.h:
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::changeBackToReplacedString):
+        * editing/Editor.h:
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/mac/WebCoreViewFactory.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::contextMenuItemTagChangeBack):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::replacedString):
+        * rendering/HitTestResult.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::computeRectForReplacementMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        * rendering/InlineTextBox.h:
+
+2009-05-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber Stamped by Oliver Hunt.
+
+        [GTK] Fix Gtk+/X11 build on OSX
+
+        Including the CoreFoundation header here and X11 headers
+        later will result in different definitions of Boolean. The
+        CoreFoundation include does not seem to be necessary here
+        and my mac build was successfull without it. I will remove
+        it for now. If the build bots disagree this will be replaced
+        by a #if PLATFORM(CF).
+
+        * platform/FileSystem.h:
+
+2009-05-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber Stamped by Gustavo Noronha.
+
+        [GTK] Move the #ifdef around for a buildfix for Gtk+ on OSX
+
+        When building Gtk+ on OSX we ended up declaring
+        setNPWindowIfNeeded twice. Fix that by moving
+        the #if PLATFORM(GTK) up and using elif instead of
+        else.
+
+        * plugins/PluginView.h:
+
+2009-05-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25685
+        [GTK] Middle click paste form the pasteboard
+
+        The kit wants to paste from at least two different
+        clipboards. By introducing getCurrentTarget to the
+        PasteboardHelper interface we can make this decision
+        in the kit.
+        Use the new method in PasteboardGtk to get the right
+        GdkClipboard for the paste operation.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        (WebCore::Pasteboard::plainText):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-05-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6438177> QTMoviePreferredTransformAttribute only supported on SnowLeopard
+        <rdar://problem/6872468> QTMovieOpenForPlaybackAttribute only supported on SnowLeopard
+
+        QTMoviePreferredTransformAttribute and QTMovieOpenForPlaybackAttribute are not supported
+        on Tiger or Leopard.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState): Remove invalid ASSERT.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie): Only request QTMoviePreferredTransformAttribute
+        when !BUILDING_ON_TIGER and !BUILDING_ON_LEOPARD.
+        (WebCore::MediaPlayerPrivate::cacheMovieScale): Only ask for QTMovieOpenForPlaybackAttribute 
+        when !BUILDING_ON_TIGER and !BUILDING_ON_LEOPARD,
+
+2009-05-12  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 25738: Skia: CSS border style not cleared for SVG object
+        https://bugs.webkit.org/show_bug.cgi?id=25738
+
+        If no dashing is set, this change reverts to solid stroke
+        (previously the code bailed and left the old setting, whatever it was)
+
+        Test case listed in above bug entry.
+        (Additional complications due to each platform rendering dotted lines differently -
+        c.f. https://bugs.webkit.org/show_bug.cgi?id=25737)
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setLineDash):
+
+2009-05-11  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 21903: Adds DOM bindings for the placeholder property of the
+        HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=21903
+
+        Test: fast/forms/placeholder-dom-property.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::placeholder):
+        (WebCore::HTMLInputElement::setPlaceholder):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::placeholder):
+        (WebCore::WMLInputElement::setPlaceholder):
+
+2009-05-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25706
+
+        Change V8 bindings to match JSC bindings with respect to using
+        the lexical or dynamic global object.
+
+        Tests: http/tests/security/aboutBlank/security-context-grandchildren-lexical.html
+               http/tests/security/aboutBlank/security-context-grandchildren-write-lexical.html
+               http/tests/security/aboutBlank/security-context-grandchildren-writeln-lexical.html
+
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-03-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6702386> Incorrect bound check in SVGList::insertItemBefore
+
+        SVGList::insertItemBefore would not perform a bounds check on the
+        index it was provided, potentially leading to a buffer overflow. 
+
+        Test: svg/dom/svglist-exception-on-out-bounds-error.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::insertItemBefore):
+
+2009-05-12  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 25708: Cannot choose menu items in popups with many entries in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=25708
+
+        This change sets the window size for popups on Mac to include all items
+        in the menu. This is required for hit testing on Mac, where we use native
+        controls to manage the popups and don't want to artificially limit the
+        valid hit testing region to a limited scroll window.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::layout):
+
+2009-05-12  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixes to build with latest skia:  SkTypeface::Create() is now
+        SkTypeface::CreateFromName(); computeBounds() has been reworked
+        as getBounds().  The changes are placed behind an #ifdef for now,
+        so that we can roll back the skia version in Chromium if necessary
+        without having to roll back this change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25705
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::boundingRect):
+        (WebCore::boundingBoxForCurrentStroke):
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-05-12  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25732
+        Update V8ElementCustom.cpp to match the current API of V8Proxy.
+
+        (WebCore::ACCESSOR_SETTER): Change retrieveActiveFrame() to retrieveFrameForEnteredContext().
+
+2009-05-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25694
+        HTMLParser::createHead() ASSERT: Creating an element, calling  document.open() and writing
+        to the document NULL ptr
+
+        Test: fast/parser/implicit-head-in-fragment-crash.html
+
+        * html/HTMLParser.cpp: (WebCore::HTMLParser::bodyCreateErrorCheck): Do not try to implicitly
+        create <head> when parsing a fragment.
+
+2009-05-12  Soren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25687
+        Missing check for valid function in V8 bindings for toString function for event listeners.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction): Added empty handle checks.
+
+2009-05-11  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Change Qt port to match the mac and windows ports, and unregister plugins when plugins are stopped.
+        Not doing that can cause assersion failure.
+        https://bugs.webkit.org/show_bug.cgi?id=25702
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::stop):
+
+2009-05-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Bug 25714: [Qt] Decouple HTML5 Database support from the
+        SQLite/generic database support in the Qt port
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25714>
+
+        * WebCore.pro:
+
+2009-05-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25713: AX: Control Elements not identified in HTML content
+        https://bugs.webkit.org/show_bug.cgi?id=25713
+
+        Test: accessibility/onclick-handlers.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+
+2009-05-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6276843> REGRESSION: TextIterator generates
+        an extra newline for ranges that start outside of body
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::shouldRepresentNodeOffsetZero):
+        Check startPos for null, not just currPos.
+
+2009-05-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25700: Regression:WebKit:cmd-left and cmd-right use to go to the beginning and end of a line in Mail
+        https://bugs.webkit.org/show_bug.cgi?id=25700
+
+        Keyboard selection movement handlers need to also watch for the Cmd key when Accessibility is enabled.
+        Note: This code is only used when accessibility is enabled.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleKeyboardSelectionMovement):
+
+2009-05-11  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 25087: Test for ENABLE_FOO macros consistently in IDL files
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25087>
+
+        Reviewed by Timothy Hatcher.
+
+        Change tests for ENABLE macros to check for both existence and
+        value:
+
+        - Negative:  #if !defined(ENABLE_FOO) || !ENABLE_FOO
+        - Positive:  #if defined(ENABLE_FOO) && ENABLE_FOO
+
+        * css/CSSCharsetRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/RGBColor.idl:
+        * dom/Attr.idl:
+        * dom/DOMCoreException.idl:
+        * dom/DOMImplementation.idl:
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Event.idl:
+        * dom/EventException.idl:
+        * dom/KeyboardEvent.idl:
+        * dom/MessagePort.idl:
+        * dom/MouseEvent.idl:
+        * dom/Node.idl:
+        * dom/ProcessingInstruction.idl:
+        * dom/Range.idl:
+        * dom/RangeException.idl:
+        * dom/WheelEvent.idl:
+        * html/CanvasPixelArray.idl:
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.idl:
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLImageElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLLinkElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLStyleElement.idl:
+        * html/ImageData.idl:
+        * inspector/InspectorController.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/Console.idl:
+        * page/Coordinates.idl:
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+        * page/Geoposition.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * page/Navigator.idl:
+        * svg/SVGElementInstance.idl:
+        * svg/SVGException.idl:
+        * workers/WorkerContext.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XPathException.idl:
+
+2009-05-11  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 24538: class/struct mixup in forward declarations
+        https://bugs.webkit.org/show_bug.cgi?id=24538
+
+        * inspector/InspectorResource.h:
+        * loader/CachedFont.h:
+        * loader/appcache/ApplicationCache.h:
+        * rendering/RenderBlock.h:
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineTextBox.h:
+        * svg/SVGGlyphElement.h:
+        * svg/SVGHKernElement.h:
+
+2009-05-11  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 24539: Unresolved CSSMutableStyleDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=24539
+
+        The Symbian tools can't compile and link this without this include.
+        It's not clear why this is different from other toolsets or why it affects
+        only this header file, but adding the include for now.
+
+        * editing/RemoveCSSPropertyCommand.h: Added include of CSSMutableStyleDeclaration.h.
+
+2009-05-11  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25701
+        REGRESSION(r38788 & r42020): styled searchfields look wrong on Windows, affects Facebook
+
+        Test: fast/forms/search-styled.html
+
+        * css/themeWin.css:
+        Remove the overriding of -webkit-appearance for searchfields. This will cause background
+        images to not be honored when styling searchfields
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::adjustSearchFieldStyle):
+        * rendering/RenderThemeWin.h:
+        Re-instate final adjustments to searchfield styling that were removed in r42020
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Fix Windows build
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+
+2009-05-11  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25626
+        Update V8ElementCustom.cpp to match the current API of Node.
+
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Changed a couple of method names to match current names.
+        (WebCore::ACCESSOR_GETTER): Changed a method name to match current name.
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Fix Windows build
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Fix Windows build
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+
+2009-05-11  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8CustomBinding.cpp is missing a header file
+
+        https://bugs.webkit.org/show_bug.cgi?id=25644
+
+        * bindings/v8/custom/V8CustomBinding.cpp: Added #include "V8Proxy.h".
+
+2009-05-11  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25634
+        Change V8Proxy::retrieveActiveFrame() call sites to V8Proxy::retrieveFrameForEnteredContext().
+
+        Also, change instances of ScriptController::retrieveActiveFrame() to
+        V8::retrieveFrameForEnteredContext() for consistency.
+
+
+        See http://codereview.chromium.org/113085 for the corresponding Chromium change.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetLocation):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/5972751> Local image files (BMP, ico) can be misidentified as HTML.
+
+        First part of the fix - Disable content sniffing for file resources which never should've been happening anyways.
+        Second part of the fix - If the networking layer doesn't give us back a MIME type default to "application/octet-stream".
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::defaultMIMEType): "application/octet-stream"
+        * platform/MIMETypeRegistry.h:
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::create): If content sniffing is true, double check with "shouldContentSniffRequest()" which
+          might override it to false.
+        (WebCore::ResourceHandle::shouldContentSniffURL): Return false for file:// urls, true for everything else.
+        * platform/network/ResourceHandle.h:
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType): Create a copy of the CFURLRequest with the default MIME type instead
+          of null.
+        (WebCore::didReceiveResponse): If the MIME type for the response is null, create a copy with the default MIME type.
+        (WebCore::WebCoreSynchronousLoader::load): Use shouldContentSniffRequest() to make synchronous loads have the same 
+          sniffing policy as asynchronous loads.  Also, correct a null MIME type by creating a copy with the default type.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::loadResourceSynchronously): Use shouldContentSniffRequest() to make synchronous loads have the
+          same sniffing policy as asynchronous loads.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Set up the [NSURLResponse MIMEType] swizzling if
+          it hasn't been set up yet.
+        (_web_NSURLResponse_MIMEType): Either return the actual MIME type of the response, or the default MIME type if it's nil.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Remove the workaround added in r29370 as it will now be covered by
+          the new mechanism.
+
+2009-05-11  David Kilzer  <ddkilzer@apple.com>
+
+        Fix typo "APPLICATION_CAHE_DYNAMIC_ENTRIES" to "APPLICATION_CACHE_DYNAMIC_ENTRIES"
+
+        This was added in r39816 to disable dynamic entries.  They are
+        still disabled after fixing the typo since this feature define
+        is never set anywhere.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * loader/appcache/DOMApplicationCache.idl:
+
+2009-05-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        Most of the change is in WTF.
+        Unless noted, all the following files changed to use the new ThreadIdentifier::isValid()
+        method instead of just doing 'if(m_threadID)' kind of checks, since ThreadIdentifier
+        is now a class rather then an integer.
+        Also, there is no need to initialize threadID in constructors to 0 now.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::libxmlLoaderThread): use DEFINE_STATIC_LOCAL and accessor function for static thread id,
+        since now ThreadIdentifier needs construction and we avoid having global initializers.
+        (WebCore::matchFunc): use the new accessor function.
+        (WebCore::openFunc): ditto.
+        (WebCore::createStringParser): ditto.
+        (WebCore::createMemoryParser): ditto.
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread): remove m_threadID from debug output.
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::start):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unused header that declared one function which was never defined anywhere.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/network/cf/ResourceResponseCFNet.cpp: Change to include ResourceResponse.h (which really means
+          platform/network/cf/ResourceResponse.h)
+        * platform/network/cf/ResourceResponseCFNet.h: Removed.
+
+2009-05-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25213
+        Fix assert during Inspector destruction.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed): Moved closing
+            inspector above removing InspectorController object to fix JS errors,
+            added clearing inspector page ptr.
+
+2009-05-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Make sure that public APIs are properly exported on all Qt platforms
+        https://bugs.webkit.org/show_bug.cgi?id=25601
+
+        * WebCore.pro: Define QT_MAKEDLL for all non-static builds, not just for win
+
+2009-05-11  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24284
+
+        * WebCore.pro: duplicated values removed from INCLUDEPATH
+
+2009-05-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix Symbian; clean Up WebKit/Qt if ENABLE_NETSCAPE_PLUGIN_API=0
+        https://bugs.webkit.org/show_bug.cgi?id=24688
+
+        * WebCore.pro: Use platform independent plugin stubs if ENABLE_NETSCAPE_PLUGIN_API=0
+        * platform/qt/TemporaryLinkStubs.cpp: Remove stub functions for plugins
+
+2009-05-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix a crash when deactivating a document that had adopted a <form>
+          element
+
+        Test: fast/dom/HTMLFormElement/document-deactivation-callback-crash.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::didMoveToNewOwnerDocument): Corrected the
+        logic here: <form> elements should be registered for document activation
+        callbacks if and only if autocomplete is off.
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6867598> REGRESSION (r42483): Have to enter credentials twice when trying
+        to view protected MobileMe video
+
+        Add a temporary workaround.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        Added an m_useSiteSpecificQuirks boolean (Mac-only). A Frame pointer is only available when
+        starting a request, so we need to store this data for later use.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start): Initialize m_useSiteSpecificQuirks.
+        (WebCore::ResourceHandle::receivedCredential): Use per-session credentials with gallery.me.com.
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6870383> Have to enter credentials twice when downloading from a protected page
+
+        * platform/network/cf/AuthenticationCF.cpp:
+        * platform/network/cf/AuthenticationCF.h:
+        (WebCore::WebCoreCredentialStorage::set):
+        (WebCore::WebCoreCredentialStorage::get):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        Move WebCore credential storage to AuthenticationCF, so that WebKit could use it (macthing
+        an earlier Mac change).
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Match newer XMLHttpRequest draft and make withCredential setter raise an exception when
+        called at a wrong time.
+
+        No test, because we are waiting for a newer version of system frameworks to test the attribute.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::setWithCredentials):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        Raise INVALID_STATE_ERR if the state is not OPENED, or if the send() flag is true.
+
+2009-05-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25602
+          REGRESSION: fast/overflow/overflow-focus-ring.html seems double-drawn
+          on ToT
+
+        Test: fast/layers/self-painting-outline.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer): Paint the layer's own outline only
+        if it is a self-painting layer.
+
+2009-05-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen and Mark Rowe.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25666
+          Assertion failure in Node::setDocument()
+          (willMoveToNewOwnerDocumentWasCalled) when adopting a <form> element
+
+        Test: fast/dom/HTMLFormElement/adopt-assertion.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::willMoveToNewOwnerDocument): Overrides of
+        this method are required to call the base class implementation. Do it.
+        (WebCore::HTMLFormElement::didMoveToNewOwnerDocument): Ditto.
+
+2009-03-29  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebCore::DocumentLoader::mainReceivedError now asserts if error.isNull(), so
+        make sure CURL does not create empty ResourceError() objects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24927
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::downloadTimerCallback):
+
+2009-05-09  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Build fix, adding missing files to make dist.
+
+        * GNUmakefile.am:
+
+2009-05-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25656
+        
+        Reduce the inline capacity of CSSParserValueList's m_values
+        vector to reduce the size of CSSParserValueList from 544 to 160 bytes in 64-bit.
+
+        * css/CSSParserValues.h:
+
+2009-05-08  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Used sort-Xcode-project-file to sort the XCode project file - it hasn't been done for a while.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-05-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6864786> REGRESSION: Crash below
+          ApplyStyleCommand::applyInlineStyleToRange when reviewing a patch in
+          Bugzilla
+
+        Test: editing/style/apply-through-end-of-document.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange): Added a null
+        check for the case of a range extending through the end of the document,
+        in which pastEndNode is 0.
+
+2009-05-08  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/6857446> REGRESSION (Safari 3-4): Contraction base 
+        marked as misspelled even though contraction is a word
+        Make sure spelling underline does not persist on words like 
+        <doesn't>.  
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+
+2009-05-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Make sure the path's refdata isn't deleted before we're done with the object.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25652
+
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::~Path):
+        (WebCore::Path::Path):
+        (WebCore::Path::translate):
+
+2009-05-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for memory leak on Mac.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25650
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+
+2009-05-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6857446> REGRESSION (r37591): Cannot print or 
+        preview from maps.yandex.ru
+
+        We need to fall into the stretchesToViewHeight() quirk when we are 
+        printing and we are the root and the root has percentage height OR 
+        when we are the body and the root has percentage height. Otherwise 
+        we have a height of 0 and can run into painting troubles.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight):
+
+2009-05-08  Douglas Davidson  <ddavidso@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes for <rdar://problem/6852771>.
+        Prevent text checking replacement immediately after an apostrophe
+        and automatic link addition except immediately after typing.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+
+2009-05-08  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25627
+        Bug 25627: HTMLMediaElement: some errors should fire on <source> elements
+
+        Update for HTML5 spec change to fire 'error' events on <source> element
+        when there is a failure while processing/loading a <source>.
+
+        Test: media/video-source-error.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::enqueueEvent): Remove white-space.
+        (WebCore::HTMLMediaElement::loadInternal): Call cancelPendingEventsAndCallbacks instead
+        of just calling m_pendingEvents.clear() as we now also need to cancel pending errors on
+        all <source> element. 
+        (WebCore::HTMLMediaElement::selectMediaResource): Call isSafeToLoadURL() here instead of in
+        loadResource() as we need to report errors differently depending on the type of failure. Use
+        KURL instead of String.
+        (WebCore::HTMLMediaElement::loadNextSourceChild): nextSourceChild -> selectNextSourceChild.
+        Fail silently when there are no more <source> canditates because that is what spec mandates.
+        Keep url as KURL instead of converting to String.
+        (WebCore::HTMLMediaElement::loadResource): ASSERT that the URL is safe to load as we now 
+        assume the safety check now done before this function. Takes KURL instead of String.
+        (WebCore::HTMLMediaElement::isSafeToLoadURL): New, checks to see if a url is safe to load, logs
+        failure if not.
+        (WebCore::HTMLMediaElement::noneSupported): MEDIA_ERR_NONE_SUPPORTED -> MEDIA_ERR_SRC_NOT_SUPPORTED
+        (WebCore::HTMLMediaElement::cancelPendingEventsAndCallbacks): New, clear all events pending on
+        the media and all source elements.
+        (WebCore::HTMLMediaElement::setNetworkState): Fire an error on the source element when the 
+        the failure happened while processing one. Only call nonSupported() when the failure happened
+        while processing media element 'src' attribute.
+        (WebCore::HTMLMediaElement::havePotentialSourceChild): nextSourceChild -> selectNextSourceChild.
+        Deal with selectNextSourceChild returning a KURL instead of a String.
+        (WebCore::HTMLMediaElement::selectNextSourceChild): Renamed from nextSourceChild, add optional
+        param to control whether or not errors are fired on a source element when it will not be used.
+        Check safety of url here instead of waiting until loadResource(). Return a KURL instead of a
+        String.
+        (WebCore::HTMLMediaElement::initialURL): nextSourceChild -> selectNextSourceChild. Keep url as
+        a KURL instead of a String.
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::):
+
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::HTMLSourceElement): Initialize timer related variables.
+        (WebCore::HTMLSourceElement::scheduleErrorEvent): New, start one-shot timer to fire an error
+        event ASAP.
+        (WebCore::HTMLSourceElement::cancelPendingErrorEvent): New, cancel pending error event.
+        (WebCore::HTMLSourceElement::errorEventTimerFired): New, fire error event if it has not been
+        cancelled.
+        * html/HTMLSourceElement.h:
+
+        * html/MediaError.h: 
+        (WebCore::MediaError::): MEDIA_ERR_NONE_SUPPORTED -> MEDIA_ERR_SRC_NOT_SUPPORTED
+        * html/MediaError.idl: Ditto
+
+2009-05-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - fix <rdar://problem/6859955> Undoing typed text after selecting all
+          leaves non-text areas highlighted
+
+        Test: fast/repaint/selection-clear.html
+
+        When RenderView::clearSelection() is called from
+        SelectionController::nodeWillBeRemoved(), selected renderers may already
+        be marked for layout, which means that they can no longer compute
+        their selection repaint info. Instead, an empty IntRect (or GapRects) is
+        returned, leading to incomplete repaint.
+
+        The fix is not to rely on individual renderers when clearing the
+        selection, but instead, cache the bounding rectangle of the selected
+        blocks' GapRects when setting the selection, and invalidate that
+        entire rectangle when clearing it.
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Added a parameter saying whether
+        the repainting of selected blocks should include both
+        previously-selected areas and newly-selected areas or only
+        newly-selected areas. The default is both. Also compute
+        m_cachedSelectionBounds to be the bounding rectangle of the
+        new selection's BlockSelectionInfos' GapRects.
+        (WebCore::RenderView::clearSelection): Repaint m_cachedSelectionBounds,
+        and tell setSelection() that it should not paint areas that were in
+        the old selection's BlockSelectionInfos' GapRects.
+        * rendering/RenderView.h:
+        (WebCore::RenderView::):
+
+2009-05-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/6868773> NPN_GetAuthenticationInfo does not work with non-permanent credentials
+
+        * WebCore.base.exp:
+        * platform/network/mac/AuthenticationMac.h:
+        (WebCore::WebCoreCredentialStorage::set):
+        (WebCore::WebCoreCredentialStorage::get):
+        * platform/network/mac/AuthenticationMac.mm:
+        * platform/network/mac/ResourceHandleMac.mm:
+        Moved WebCoreCredentialStorage to AuthenticationMac, so that it could be used from WebKit.
+
+2009-05-08  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build, add missing JSC_HOST_CALL macros to the runtime
+        call methods.
+
+        * bridge/qt/qt_runtime.h:
+
+2009-05-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add missing strings to localizedStrings.js
+        https://bugs.webkit.org/show_bug.cgi?id=25635
+
+        Add the strings "Delete", "Key", "Refresh" and "Value".
+
+        * English.lproj/localizedStrings.js:
+
+2009-05-08  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed, tweaked and landed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24992
+        [Qt] crash at http://browserspy.dk/browser.php
+
+        This cannot be easily tested in DRT, because it relies on interaction with QApplication,
+        but the added assertions guard against re-introducing this issue.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::didOpenURL): Don't make client calls
+        while the frame is being constructed, because the intermediate state without a document
+        is something we don't want to expose.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setJSStatusBarText): Assert that the frame has a document, which is an
+        approximation of it being in a consistent state for client calls.
+        (WebCore::Frame::setJSDefaultStatusBarText): Ditto.
+
+2009-05-07  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25640>.
+        Bug 25640: Crash on quit in r43384 nightly build on Leopard w/ Safari 4 beta installed
+        
+        Roll out r43366 as it removed symbols that Safari 4 Beta uses.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::matchFunc):
+        (WebCore::openFunc):
+        (WebCore::createStringParser):
+        (WebCore::createMemoryParser):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::localStorageThread):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Unify scrolling code via adjustments and keys. Use the WebCore
+        defined constants, since that's what people are most used to at
+        this point.
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformHandleHorizontalAdjustment):
+        (WebCore::ScrollView::platformHandleVerticalAdjustment):
+
+2009-05-07  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+        Suggested by Oliver Hunt.
+
+        Rolling back http://trac.webkit.org/changeset/43385
+        because we have to use mac artwork for the underline on OSX.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::createPatternColor):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::setCGStrokeColor):
+        (WebCore::spellingPatternColor):
+        (WebCore::grammarPatternColor):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+
+2009-05-07  John Grabowski  <jrg@chromium.org>
+
+        Reviewed by Simon Fraser.
+  
+        https://bugs.webkit.org/show_bug.cgi?id=25573
+        Unify use of CG-common routine for drawLineForMisspellingOrBadGrammar.
+        Cleanup for WebKit, but required for Chromium happiness.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::spellingPatternColor):
+        (WebCore::grammarPatternColor):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Bug 25575: Registered mutation event listener crashes HTMLMediaElement
+        https://bugs.webkit.org/show_bug.cgi?id=25575
+
+        Test: fast/media/video-controls-with-mutation-event-handler.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement): Don't call setAttribute.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createTimeline): Call setAttribute here.
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber Stamped by Dave Hyatt
+        
+        Shuffle the data members to minimize padding.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        * rendering/RenderTableSection.h:
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber Stamped by Dave Hyatt
+        
+        Shuffle the data members to make Events 8 bytes smaller in 64-bit.
+
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+
+2009-05-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Fix regression caused by r41469, add test case to prevent it from 
+        happening again.
+        https://bugs.webkit.org/show_bug.cgi?id=25252
+  
+        hasLayer() was true during removeOnlyThisLayer()/
+        updateLayerPositions()
+        which caused updateLayerPosition()'s walk up the render tree to 
+        include offsets from the layer we were about to remove.
+  
+        I'm not 100% convinced that this wasn't a bug in 
+        updateLayerPosition() or in RenderBoxModelObject::styleDidChange, 
+        because the layer in question is not the containing block for the 
+        block which gets laid out wrong. But this restores the previous 
+        behavior and adds a test.  So the next time someone is in here re-
+        factoring, they will at least know if they break something.
+  
+        Test: fast/layers/remove-only-this-layer-update.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::destroyLayer):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Attempt to fix GTK build.
+
+        * platform/graphics/GlyphPageTreeNode.h: add #include <string.h> to ensure memcpy and memset are defined.
+
+2009-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve native call performance
+
+        Add calling convention declarations where necessary, and update bindings
+        script to generate them as well.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::callPlugin):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::callRuntimeObject):
+
+2009-05-07  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=25617
+
+        Fix memory/performance regression because of too much form control related abstraction just for WMLs sake.
+
+        Remove FormControlElement and FormControlElementWithState base classes, as the overhead is too high for the
+        gain. HTML has no benefit of that kind of abstraction, so we're going to move the functionality to Element directly.
+
+        The functions now living in FormControlElement(WithState) lived in Node/Element/HTMLFormControlElement before.
+        This patches moves all of them in a central place in Element.h, as virtual functions with an inline default implementation.
+        To avoid confusion like isEnabled() living on Node, before the creation of the FormControlElement abstraction layer, all
+        methods are renamed to clarify where they belong to. All renames are listed here:
+
+        From FormControlElement:
+        - isEnabled() -> isEnabledFormControl()
+        - isReadOnly() -> isReadOnlyFormControl()
+        - isTextControl() -> isTextFormControl()
+        - valueMatchesRenderer() -> formControlValueMatchesRenderer()
+        - setValueMatchesRenderer() -> setFormControlValueMatchesRenderer()
+        - name() -> formControlName()
+        - type() -> formControlType()
+
+        From FormControlElementWithState:
+        - saveState() -> saveFormControlState()
+        - restoreState() -> restoreFormControlState()
+
+        A lot of Element -> FormControlElement(WithState) casting is gone again, so it's not only a memory, but also a performance progression.
+
+        No testcases affected, no new tests needed.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * dom/Document.cpp:
+        (WebCore::Document::formElementsState):
+        * dom/Document.h:
+        (WebCore::Document::registerFormElementWithState):
+        (WebCore::Document::unregisterFormElementWithState):
+        * dom/Element.h:
+        (WebCore::Element::isFormControlElement):
+        (WebCore::Element::isEnabledFormControl):
+        (WebCore::Element::isReadOnlyFormControl):
+        (WebCore::Element::isTextFormControl):
+        (WebCore::Element::formControlValueMatchesRenderer):
+        (WebCore::Element::setFormControlValueMatchesRenderer):
+        (WebCore::Element::formControlName):
+        (WebCore::Element::formControlType):
+        (WebCore::Element::saveFormControlState):
+        (WebCore::Element::restoreFormControlState):
+        * dom/FormControlElement.cpp: Removed.
+        * dom/FormControlElement.h: Removed.
+        * dom/FormControlElementWithState.cpp: Removed.
+        * dom/FormControlElementWithState.h: Removed.
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::formControlType):
+        * html/HTMLButtonElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::formControlType):
+        * html/HTMLFieldSetElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::attach):
+        (WebCore::HTMLFormControlElement::formControlName):
+        (WebCore::HTMLFormControlElement::willValidate):
+        (WebCore::HTMLFormControlElementWithState::HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::~HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::willMoveToNewOwnerDocument):
+        (WebCore::HTMLFormControlElementWithState::didMoveToNewOwnerDocument):
+        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::isTextFormControl):
+        (WebCore::HTMLFormControlElement::isEnabledFormControl):
+        (WebCore::HTMLFormControlElement::formControlValueMatchesRenderer):
+        (WebCore::HTMLFormControlElement::setFormControlValueMatchesRenderer):
+        (WebCore::HTMLFormControlElement::isReadOnlyFormControl):
+        (WebCore::HTMLFormControlElement::type):
+        (WebCore::HTMLFormControlElement::name):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formControlName):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::detach):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::readOnly):
+        (WebCore::HTMLInputElement::isTextFormControl):
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::formControlType):
+        * html/HTMLKeygenElement.h:
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::formControlType):
+        * html/HTMLLegendElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::formControlType):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::formControlType):
+        * html/HTMLOptionElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::formControlType):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        * html/HTMLSelectElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::formControlType):
+        (WebCore::HTMLTextAreaElement::saveFormControlState):
+        (WebCore::HTMLTextAreaElement::restoreFormControlState):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::setValue):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::readOnly):
+        (WebCore::HTMLTextAreaElement::isTextFormControl):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemIsEnabled):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::updateUserModifyProperty):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isEnabled):
+        (WebCore::RenderTheme::isReadOnlyControl):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustMenuListStyle):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustMenuListStyle):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::adjustMenuListStyle):
+        * wml/WMLFormControlElement.cpp:
+        * wml/WMLFormControlElement.h:
+        (WebCore::WMLFormControlElement::isReadOnlyFormControl):
+        (WebCore::WMLFormControlElement::isTextFormControl):
+        (WebCore::WMLFormControlElement::formControlValueMatchesRenderer):
+        (WebCore::WMLFormControlElement::setFormControlValueMatchesRenderer):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::WMLInputElement::isKeyboardFocusable):
+        (WebCore::WMLInputElement::isMouseFocusable):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::formControlType):
+        (WebCore::WMLInputElement::formControlName):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::saveFormControlState):
+        (WebCore::WMLInputElement::restoreFormControlState):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        (WebCore::WMLInputElement::detach):
+        (WebCore::WMLInputElement::appendFormData):
+        (WebCore::WMLInputElement::init):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::isTextFormControl):
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::formControlType):
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::formControlType):
+        * wml/WMLOptionElement.h:
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        Most of the change is in WTF.
+        Unless noted, all the following files changed to use the new ThreadIdentifier::isValid()
+        method instead of just doing 'if(m_threadID)' kind of checks, since ThreadIdentifier
+        is now a class rather then an integer.
+        Also, there is no need to initialize threadID in constructors to 0 now.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::libxmlLoaderThread): use DEFINE_STATIC_LOCAL and accessor function for static thread id,
+        since now ThreadIdentifier needs construction and we avoid having global initializers.
+        (WebCore::matchFunc): use the new accessor function.
+        (WebCore::openFunc): ditto.
+        (WebCore::createStringParser): ditto.
+        (WebCore::createMemoryParser): ditto.
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread): remove m_threadID from debug output.
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::start):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber Stamped by Dave Hyatt
+        
+        Shuffle the data members to minimize padding.
+
+        * dom/ClassNames.h:
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6864062> Shrink GlyphPage from 4112 to 2576 bytes in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=25605
+
+        Shrink GlyphPage by splitting the array of GlyphData, which has lots
+        of padding, into separate Glyph and SimpleFontData* arrays.
+
+        * platform/graphics/Font.h:
+        glyphDataForCharacter has to return a GlyphData by value now.
+        
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        Return GlyphData by value.
+        
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage):
+        Better encapsulation of GlyphPage, using the new methods.
+
+        * platform/graphics/Font.h:
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage):
+        * platform/graphics/GlyphPageTreeNode.h:
+        (WebCore::GlyphData::GlyphData):
+        (WebCore::GlyphPage::indexForCharacter):
+        (WebCore::GlyphPage::glyphDataForCharacter):
+        (WebCore::GlyphPage::glyphDataForIndex):
+        (WebCore::GlyphPage::glyphAt):
+        (WebCore::GlyphPage::fontDataForCharacter):
+        (WebCore::GlyphPage::setGlyphDataForCharacter):
+        (WebCore::GlyphPage::setGlyphDataForIndex):
+        (WebCore::GlyphPage::copyFrom):
+        (WebCore::GlyphPage::clear):
+
+2009-05-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25625
+        Implement Image/Option constructors in V8 bindings.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): Removed old JS-based code.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp: Added.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp: Added.
+
+2009-05-07  Brady Eidson  <beidson@apple.com>
+
+        I hate myself for doing this, but need to fix that ChangeLog entry.
+
+        * ChangeLog:
+
+2009-05-07  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Darin Adler
+
+        * html/HTMLParser.cpp: Use the correct style of BUILDING_ON_* for WebCore.
+        * html/HTMLParser.h: Ditto
+
+2009-05-07  David Hyatt  <hyatt@apple.com>
+
+        Restore intrinsic margins to all form controls on Mac and Windows.  Some of this regressed in 43007
+        when textareas were given explicit margins.  Some of it had already regressed earlier whenever intrinsic
+        margins were turned off in themeWin.css.
+
+        Reviewed by Beth Dakin.
+
+        * css/html4.css:
+        * css/themeWin.css:
+
+2009-05-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler and Alexey Proskuryakov.
+
+        <rdar://problem/6863795> Exception occurs in Mail when attempting to create signatures due to <head> element creation
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): Check shouldCreateImplicitHead() before creating it.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Check shouldCreateImplicitHead() before creating it.
+        (WebCore::HTMLParser::bodyCreateErrorCheck): Ditto.
+        (WebCore::shouldCreateImplicitHead): For Tiger/Leopard when running under Mail, the implicit <head> shouldn't be created.
+        * html/HTMLParser.h:
+        (WebCore::shouldCreateImplicitHead): Inline implementation for non-Tiger/Leopard platforms
+
+2009-05-07  Antony Sargent  <asargent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a memory leak in V8EventListenerList::remove.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25618
+
+        No new functionality so no new tests. 
+
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::remove):
+
+2009-05-07  Darin Fisher  <darin@chromium.org>
+
+        Fix Chromium build bustage.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp: Add missing
+        HTMLCollection.h include.
+
+2009-05-07  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25598: AX: if a radio button has a label and a title, the label is not exposed
+        https://bugs.webkit.org/show_bug.cgi?id=25598
+
+        Test: accessibility/radio-button-title-label.html
+
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::exposesTitleUIElement):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::exposesTitleUIElement):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * page/AccessibilityRenderObject.h:
+
+2009-05-07  Darin Fisher  <darin@chromium.org>
+
+        Fix Chromium build bustage.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER): ":" should be "::"
+
+2009-05-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25610
+        [GTK] text.caretOffset is reportedly always 0
+
+        Use the right function to get the caret offset in an
+        element. selectionStart() would only work for text
+        controls (there's even an ASSERT when calculating the selected
+        text range). Instead just get the selection and get the offset of
+        the start position.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix support for antialiased CSS border-radius
+        
+        WebKit implements border-radius by drawing a double-size border,
+        and then letting the clip constrain the border to the right width
+        and position. This requires support for antialiased clipping, as
+        well as painting, to get a nice smooth border.
+        
+        Qt only does antialiased clipping if the anti-alias flag is set
+        at the time of clipping, so we have to enable this in the method
+        addInnerRoundedRectClip(), as well as when we draw the border.
+        
+        Currently the raster-engine is the only Qt paint engine to support
+        anti-aliased clipping, but the OpenGL and Mac paint engines could
+        potentially support this in the future.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+
+2009-05-07  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Render empty optgroup elements.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24900
+
+        Currently, optgroup elements which are empty are not rendered. The
+        HTML specification gives no guidance on this situation.
+
+        However, the test for being empty is that they have no children, thus
+        this will not render:
+          <optgroup label="test"></optgroup>
+        while this /will/ render (because of the text node child):
+          <optgroup label="test"> </optgroup>
+
+        This patch will cause both cases to render which matches IE's and
+        Firefox's behaviour.
+
+        The difference only appears when opening the select element and does
+        not appear in the render tree. Thus, a manual layout-test is required.
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcListItems):
+        * manual-tests/optgroup-empty-and-nested.html: Added.
+
+2009-05-06  Julie Parent  <jparent@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 25608: Unused m_frame in ChromiumClipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=25608
+
+        * platform/chromium/ClipboardChromium.h:
+        
+        No tests added as this is only removing dead code, no functional changes.
+
+2009-05-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser and Justin Garcia.
+
+        - fix another part of <rdar://problem/6703873> Triple-click quoted line
+          and type Return creates an extra quoted blank line
+
+        Test: editing/inserting/6703873-2.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Corrected the logic for
+        determining the first node that should go into the new blockquote
+        given the split position: if it is at the end of a container, use the
+        next node after the container. Otherwise, use the child at the
+        position's offset.
+
+2009-05-06  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, fixes for wx trunk builds.
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/wx/RenderThemeWx.cpp:
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+
+2009-05-06  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25597
+        Fix API drift compile errors that occurred while this was ifdef-ed out.
+        The two big issues were that RenderObject::element() became
+        RenderObject::node() and some of the wk* drawing functions had
+        an extra theme parameter added to the argument list.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+
+2009-05-06  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25385
+        Upstream changes to V8 bindings for supporting nested workers.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER WorkerOnmessage):
+        (WebCore::CALLBACK_FUNC_DECL WorkerAddEventListener):
+
+2009-05-06  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25513
+        The V8 bindings convert every javascript property to its associated css style
+        name. It then calls functions that convert that name to an id. This makes
+        getting or setting css styles on elements slow.
+        
+        The patch fixes this by caching the results of the transformation, mapping a
+        javascript property name to its css property id. It then calls the already
+        public webkit methods that take the id in place of the string property names.
+
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+
+2009-05-06  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25591
+        Upstream V8HTMLFormElement from the Chromium repository.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER HTMLFormElement): Upstreamed from Chromium repository
+        (WebCore::NAMED_PROPERTY_GETTER HTMLFormElement): Changed empty element return case to return notHandledByInterceptor();
+        (WebCore::CALLBACK_FUNC_DECL HTMLFormElementSubmit): Upstreamed from Chromium repository
+
+2009-05-06  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25595
+        Upstream V8CanvasPixelArrayCustom from chromium port tree.
+
+        * bindings/v8/V8CanvasPixelArrayCustom.cpp: Added.
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber-stampted by Eric Seidel
+
+        Add braces to clarify logic flow in RenderObject::adjustStyleDifference.
+        Only affects ACCELERATED_COMPOSITING builds.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::adjustStyleDifference):
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        <rdar://problem/6862550> Reduce size of RenderText in 64-bit
+        
+        Rearrange data members of RenderText so that an int comes
+        first, to minimize padding.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        * rendering/RenderText.h:
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        <rdar://problem/6862823> Reduce size of RenderStyle in 64-bit
+        
+        Rearrange data members of RenderStyle to minimize padding
+        when building for 64-bit.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::RenderStyle):
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+
+2009-05-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25596
+
+        Fixes Chromium build bustage caused by r43317 (making
+        RefCountedBase::m_refCount private)
+
+        * page/chromium/AccessibilityObjectWrapper.h:
+        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper):
+
+2009-05-06  Hin-Chung Lam  <hclam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25593
+
+        Refactor for MediaPlayerPrivate for Chromium port. Remove
+        the implementation of MediaPlayerPrivateInferface from it.
+
+        * platform\graphics\chromium\MediaPlayerPrivateChromium.h:
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt, Dan Bernstein
+        
+        <rdar://problem/6860197> Reduce the size of FontFallbackList in 64-bit
+
+        Re-order the data members of FontFallbackList to save 8 bytes when building 64-bit.
+
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontFallbackList::FontFallbackList):
+        * platform/graphics/FontFallbackList.h:
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler, Dan Bernstein
+
+        <rdar://problem/6860068> Reduce size of InlineBox in 64-bit
+
+        Re-order the data members of InlineBox to save 8 bytes when building 64-bit.
+
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+
+2009-05-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25588
+        Adding the custom v8 bindings Document.location.
+
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp: Added.
+
+2009-05-06  Kevin McCullough  <kmccullough@apple.com>
+
+        -Clarified a comment
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+
+2009-05-06  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix WML enabled builds by including "MappedAttribute.h" in several places.
+
+        * wml/WMLAElement.cpp:
+        * wml/WMLAccessElement.cpp:
+        * wml/WMLBRElement.cpp:
+        * wml/WMLCardElement.cpp:
+        * wml/WMLDoElement.cpp:
+        * wml/WMLElement.cpp:
+        * wml/WMLFieldSetElement.cpp:
+        * wml/WMLGoElement.cpp:
+        * wml/WMLImageElement.cpp:
+        * wml/WMLInputElement.cpp:
+        * wml/WMLMetaElement.cpp:
+        * wml/WMLOnEventElement.cpp:
+        * wml/WMLOptGroupElement.cpp:
+        * wml/WMLOptionElement.cpp:
+        * wml/WMLPElement.cpp:
+        * wml/WMLPostfieldElement.cpp:
+        * wml/WMLSetvarElement.cpp:
+        * wml/WMLTableElement.cpp:
+        * wml/WMLTemplateElement.cpp:
+        * wml/WMLTimerElement.cpp:
+
+2009-05-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Emit AtkText::text-selection-changed when the selection changes
+        and the current selection is of Range (ie, the start and end
+        positions are different) type. This seems to match what Gecko
+        does.
+
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-05-05  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Emit AtkText::text-caret-moved when selection changes.
+
+        * GNUmakefile.am:
+        * editing/SelectionController.h:
+        * editing/gtk/SelectionController.cpp: Added.
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Use mozilla cursors for the previously not implemented
+        cursors. The manual-tests/cursor.html is looking complete
+        now.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::cellCursor):
+        (WebCore::noDropCursor):
+        (WebCore::progressCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::grabCursor):
+        (WebCore::grabbingCursor):
+        * platform/gtk/CursorGtk.h:
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        Properly indent the header file.
+
+        * platform/gtk/CursorGtk.h:
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Use the mozilla copyright header. Use MPL1.1/GPL2.0
+        and LGPL2.1 as the license compared to LGPL2.0.
+
+        * platform/gtk/CursorGtk.h:
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Move PluginView::invalidateRegion from the
+        TemporaryLinkStubs to PluginViewGtk.cpp and implement
+        it with a call to Widget::invalidate() just like
+        mac is doing. Optimisations would have to be window
+        system specific.
+
+        * platform/gtk/TemporaryLinkStubs.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::invalidateRegion):
+
+2009-05-06  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        Misc fixes to InspectorClientGtk.
+
+        * GNUmakefile.am: Add localizedStrings.js to webinspector_DATA.
+        This prevents copious amounts "Localized string not found" errors
+        in the console
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix the Qt build on Windows.
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::shouldIncludeChildWindows): Implemented dummy accessor.
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Tweak WebCore.pro for being able to override the generated sources dir for the
+        generated_files target.
+
+        * WebCore.pro:
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix the Qt/Windows build, use iface instead of interface to avoid conflict
+        with VS2005 headers.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState):
+
+2009-05-06  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        We need to include StringExtras.h on Windows CE to access the strdup function.
+
+        * plugins/PluginStream.cpp:
+
+2009-05-06  Soren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Changed the toString behaviour for non document dom node event handlers in the V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25544
+
+        In the V8 bindings non document dom node event handlers are wrapped in a number of with blocks and uses an inner
+        function. This causes the default toString on such a handler to return all this wrapper code. As some web sites
+        use the source of an event handler to create new functions this wrapper code causes compatibility problems.
+
+        Create a specific toString function for these handlers which will return a function source compatible with the
+        source returned by the JSC bindings and other browsers.
+
+        Test: fast/events/event-function-toString.html
+
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListenerToString):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create):
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build QtWebKit as a framework on Mac
+
+        This implies both debug and release build by default, unless
+        one of the --debug or --release config options are passed to
+        the build-webkit script.
+
+        Frameworks can be disabled by passing CONFIG+=webkit_no_framework
+        to the build-webkit script.
+
+        To be able to build both debug and release targets in parallel
+        we have to use separate output directories for the generated
+        sources, which is not optimal, but required to avoid race conditions.
+
+        An optimization would be to only require this spit-up on Mac.
+
+        * WebCore.pro:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $$GENERATED_SOURCES_DIR as output when running bison
+
+        A couple of the generators left the bison output file in the source
+        tree, and then moved it into $$GENERATED_SOURCES_DIR, which did not
+        work well when building release and debug configurations in parallel.
+
+        * WebCore.pro:
+
+2009-05-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        - fix an assertion failure in RemoveNodeCommand() when deleting a <br>
+          between a block and a mail blockquote
+
+        Test: editing/deleting/removeNodeCommand-assert.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Pass the start block
+        to prune() instead of passing m_upstreamStart.node(), because the latter
+        may have been removed already.
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        No review, roll out only.
+
+        Roll out r23072 since it broke layout tests
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2009-05-05  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+        
+        Add #if ENABLE(DATABASE) guards around database code so toggling ENABLE_DATABASE off does not break builds.
+        https://bugs.webkit.org/show_bug.cgi?id=24776
+
+        No functional changes, thus no tests.
+
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSDatabaseCustom.cpp:
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        * loader/EmptyClients.h:
+        * page/ChromeClient.h:
+        * storage/ChangeVersionWrapper.cpp:
+        * storage/ChangeVersionWrapper.h:
+        * storage/Database.cpp:
+        (WebCore::Database::databaseInfoTableName):
+        * storage/Database.h:
+        * storage/Database.idl:
+        * storage/DatabaseTask.cpp:
+        * storage/DatabaseTask.h:
+        * storage/DatabaseThread.cpp:
+        * storage/DatabaseThread.h:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/DatabaseTrackerClient.h:
+        * storage/OriginQuotaManager.cpp:
+        * storage/OriginQuotaManager.h:
+        * storage/SQLStatement.cpp:
+        * storage/SQLStatement.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransaction.h:
+        * storage/SQLTransaction.idl:
+
+2009-05-05  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add some documentation to InlineBox::x(),y().
+        https://bugs.webkit.org/show_bug.cgi?id=25378
+
+        * rendering/InlineBox.h:
+
+2009-05-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Disable all the SVG features for WebKit/Qt if ENABLE_SVG=0 
+        https://bugs.webkit.org/show_bug.cgi?id=24693
+
+        * WebCore.pro:
+
+2009-05-05  Sankar Aditya Tanguturi  <sankaraditya@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Anonymous blocks should not be exposed in accessibility tree.
+        Part of https://bugs.webkit.org/show_bug.cgi?id=23072
+
+        Tests: accessibility/ignore-anonymous-block.html
+               platform/win/accessibility/document-role.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):Return
+        true for Anonymous blocks. Matching Firefox 2.0.0.14
+
+2009-05-05  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        http://bugs.webkit.org/show_bug.cgi?id=25487
+
+        For euc-kr and other 8bit Korean encodings
+        (similar to euc-kr/windows-949), make document.charset return
+        EUC-KR instead of windows-949. The latter is not recognized by
+        Korean web servers.
+
+        Add domName method to TextEncoding to deal with cases where
+        our internal encoding name does not match what's widely recognized
+        by web servers. Currently, the only case is 'windows-949' (internal
+        name) vs 'EUC-KR'.
+
+        Test: fast/encoding/euckr-name.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::encoding): Call TextEncoding.domName() instead
+        of TextEncoding.name().
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::domName): For the canonical name 'windows-949',
+        return 'EUC-KR'. Otherwise, just return the canonical name.
+        * platform/text/TextEncoding.h:
+
+2009-05-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Adler.
+
+        Rendering fix for <select> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=25558
+
+        When switching a <select> element from display:none to default
+        display, we would fail to invalidate the parent's pref widths in some
+        situations:
+
+        When attaching the element, RenderMenuList::updateOptionsWidth would
+        call setNeedsLayoutAndPrefWidthsRecalc before the parent pointer was
+        set. This would mark the pref widths as dirty, but not for any parent
+        objects.
+
+        When RenderObjectChildList::appendChildNode later calls
+        setNeedsLayoutAndPrefWidthsRecalc again, with a valid parent pointer,
+        nothing would be done because the pref widths were already dirty for.
+        the RenderMenuList.
+
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth):
+
+2009-05-05  Antony Sargent  <asargent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Switch V8EventListenerList to use HashTable<T>.
+        https://bugs.webkit.org/show_bug.cgi?id=25496
+        
+        This avoids some tricky issues with event listener removal in the 
+        current implementation and has slightly better performance.
+
+        No new functionality so no new tests.
+
+        * bindings/v8/V8EventListenerList.cpp: Added V8EventListenerListIterator.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::size):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+
+2009-05-05  Darin Fisher  <darin@chromium.org>
+
+        Fixing build bustage.
+
+        Add some missing includes to fix the Chromium build.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+
+2009-05-05  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25570
+
+        history.{back,forward,go} should always be dispatched asynchronously,
+        even when the history navigation would just result in scrolling the
+        page.  This matches the behavior of other browsers like IE and FF.
+
+        Test: fast/history/back-forward-is-asynchronous.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::scheduleHistoryNavigation):
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add an ASSERT(useTransforms) to mapLocalToContainer implementations in SVG.
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+        https://bugs.webkit.org/show_bug.cgi?id=25568
+
+        Adding this ASSERT exposed a bug in SVGPaintServerPattern::setup
+        which was causing transformed SVG text when filled/stroked with a
+        pattern using patternUnits=objectBoundingBox to draw incorrectly.
+
+        I fixed the incorrect drawing (by removing the broken code) and added
+        two test cases to test the fix:
+        * svg/transforms/text-with-pattern-inside-transformed-html.xhtml
+        * svg/transforms/text-with-pattern-with-svg-transform.svg
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-05-05  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25554
+        
+        Support HTML5 text control input types: email, number, tel, url
+
+        Test: fast/html/text-field-input-types.html
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isTextField]): Call HTMLInputElement::isTextField directly.
+        * html/HTMLInputElement.cpp: Use the new types where appropriate.
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::type):
+        (WebCore::HTMLInputElement::saveState):
+        (WebCore::HTMLInputElement::restoreState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLInputElement.h: Ditto.
+        (WebCore::HTMLInputElement::):
+        (WebCore::HTMLInputElement::isTextField):
+
+2009-04-01  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Mouse wheel scrolling and keyboard shortcut support for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24797
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/wx/KeyboardEventWx.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformSetScrollPosition):
+
+2009-05-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for Windows, add missing include.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24798
+
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+
+2009-05-05  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25574: AXImageMap children links don't respond properly to accessibilityHitTest:
+        https://bugs.webkit.org/show_bug.cgi?id=25574
+
+        Enable accessibility hit-testing for image map links. 
+        Allow image map links to return AXURLs and AXAccessKey information.
+
+        Test: platform/mac/accessibility/imagemap-hittest.html
+
+        * page/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::url):
+        * page/AccessibilityImageMapLink.h:
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::minValueForRange):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * page/AccessibilityRenderObject.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-05-05  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6552129> Select a quote line and paste elsewhere, you
+        get that line and an extra quoted blank line
+        <rdar://problem/6609308> Triple-click a quoted header line, copy, paste
+        onto an empty line makes an extra quoted line
+
+        - When pasting a blockquote with a newline, make sure we put the newline
+        outside of the blockquote so that it is not quoted.
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+
+2009-05-05  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Call moz_gtk_shutdown on RenderThemeGtk destruction.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        * platform/gtk/RenderThemeGtk.h:
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        <rdar://problem/6858340> REGRESSION: can't drag local HTML files into Safari because CFURLCreateWithFileSystemPath inserts "localhost"
+
+        * platform/win/ClipboardUtilitiesWin.cpp: (WebCore::urlFromPath): Remove localhost.
+
+2009-05-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Brady Eidson.
+
+        Safety-check m_documentLoader before dereferencing.  While it seems
+        unlikely this could fail (as Safari 3 shipped without this),
+        technically almost any call can change or reset m_documentLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::receivedFirstData):
+
+2009-05-05  Dan Bernstein  <mitz@apple.com>
+
+        - Tiger build fix
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::toCSSIdentifier):
+
+2009-05-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25303
+        No need to ref the internal buffer inside the Skia ImageDecoder.
+
+        * platform/image-decoders/skia/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::bitmap):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setRGBA):
+
+2009-05-05  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=24192
+          <rdar://problem/5760774> Replying to a Mail message that contains
+          fixed width text can change the size of the text
+
+        Covered by existing tests: editing/pasteboard/5027857.html
+                                   editing/pasteboard/paste-pre-002.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getFontSizeCSSValuePreferringKeyword):
+        Added. If the font-size is keyword-based, returns the keyword value
+        instead of the pixel size.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): If
+        font-family is a generic family, return the generic family instead of
+        the the internal string -webkit-[serif|sans-serif|cursive|fantasy
+        |monospace].
+        (WebCore::CSSComputedStyleDeclaration::copyInheritableProperties):
+        For the font-size property, prefer a keyword value over a pixel size.
+        * css/CSSComputedStyleDeclaration.h:
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::currentlyHasStyle): For the font-size property,
+        call getFontSizeCSSValuePreferringKeyword().
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::keywordSize): Changed the return type to
+        unsigned.
+        (WebCore::FontDescription::setKeywordSize): Changed the parameter type
+        to unsigned.
+        (WebCore::FontDescription::m_keywordSize): Changed the type of this
+        4-bit field to unsigned, because it takes values as high as 8.
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix http/tests/misc/DOMContentLoaded-event.html
+
+        The native call performance improvement removed a few places where we
+        unintentionally performed a toThisObject conversion.  This patch updates
+        the bindings codegen to not rely on this bug.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-05-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez and Gustavo Noronha.
+
+        Implement WebCore::directoryName for Gtk+.
+
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::directoryName):
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Fix mappedAttributes() access without NULL check
+        https://bugs.webkit.org/show_bug.cgi?id=25553
+
+        SVGStyledElement::getPresentationAttribute was using mappedAttributes()
+        without checking for NULL.
+
+        HTMLInputElement::setInputType also doesn't NULL check, but I was not
+        able to get it to crash with a test case so I just added an ASSERT.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute):
+
+2009-05-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        Implement WebCore::imageTitle for Gtk+.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::imageTitle):
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25559: Improve native function call performance
+        <https://bugs.webkit.org/show_bug.cgi?id=25559>
+
+        Add forwarding header necessary for compilation, and fix debugger
+        to correctly account for change in JSFunction behaviour.
+
+        * ForwardingHeaders/jit/JITCode.h: Added.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+
+2009-05-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Make convertValueToQVariant more robust against null JSValues.
+
+        Don't require the caller to do the null check.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        No review, just a revert.
+
+        Roll out http://trac.webkit.org/changeset/43213 as it caused 4 tests to crash.
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+
+2009-05-04  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/6576889> REGRESSION (r35185): Cannot watch Flash movies on omg.yahoo.com
+
+        The problem was caused by missing <head> element - we used to create it when moving a
+        misplaced <style> element, but we now handle those in place. Other browsers always create
+        a <head> element.
+
+        There is no guarantee that a <head> element always exists - first, it can be removed with
+        removeChild or innerHTML, and also, we don't currently create it for frameset documents, or
+        for manually created ones (e.g. ImageDocument).
+
+        Test: fast/parser/head-element-for-yahoo-player.html
+
+        * dom/Document.cpp: (WebCore::Document::implicitClose): Create a <head> element for about:blank.
+        A removed comment talked about rdar://3758785, but that problem doesn't re-occur even if this
+        code is removed completely.
+
+        * html/HTMLHtmlElement.cpp: (WebCore::HTMLHtmlElement::checkDTD): No longer allow <script>
+        elements as children of <html>. This isn't directly related to this bug, but it was easier
+        to fix both at once (IE and Firefox both don't allow such mispositioned <script> elements).
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Move <script> to <head> if <body> hasn't been created yet.
+        Create a <head> it a <body> is created implicitly to contain some other element.
+        (WebCore::HTMLParser::bodyCreateErrorCheck): Ensure that a <head> exists when <body> is
+        explicitly present in source.
+        (WebCore::HTMLParser::createHead): Do the work even if <html> element hasn't been created yet.
+
+2009-05-04  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        As Qtish implementation of MIMETypeRegistry::getMIMETypeForExtension()
+        returns the application/octet-stream mimetype when it can't associate
+        extension with any mimetype, it can happen that the application/octet-stream
+        mimetype will hit the list of supported image formats. For instance,
+        it is possible when QImageReader or QImageWriter support an extension
+        that is not in the extensions map.
+
+        Make sure that this mimetype is not treated as displayable image type.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        ASSERT(useTransforms) in SVG mapLocalToContainer implementations
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove m_absoluteBounds hack from RenderSVGText
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        No functional changes (SVGs inside CSS transformed HTML should theoretically repaint better)
+
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+        * rendering/RenderSVGText.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove the vestigial calculateLocalTransform()
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        RenderSVGContainer is now the only render which needs this
+        function, but it no longer returns the unused bool.
+
+        calculateLocalTransform() previously was called by the DOM before
+        transform updates were part of layout().
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::layout):
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::localTransform):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::layout):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::calculateLocalTransform):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Move more code into SVGRenderBase
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        clippedOverflowRectForRepaint, computeRectForRepaint and mapLocalToContainer
+        are now all shared via SVGRenderBase.
+
+        RenderForeignObject should also be sharing this code, but I've left it
+        alone for now, as changing that would likely cause test changes.
+
+        No test changes.  It's possible that transformed <svg:image> elements will
+        now show up with better metrics in the inspector.
+
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        (WebCore::RenderSVGImage::mapLocalToContainer):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        (WebCore::RenderSVGModelObject::mapLocalToContainer):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        (WebCore::RenderSVGText::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::clippedOverflowRectForRepaint):
+        (WebCore::SVGRenderBase::computeRectForRepaint):
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+        * rendering/SVGRenderSupport.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add SVGRenderBase to share logic between SVG renderers
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        I've added an SVGRenderBase base class which is shared by
+        all of the SVG renders now.  This patch is just moving code
+        there are no functional changes in this patch.
+
+        Currently I've left these functions in SVGRenderSupport.h
+        In a later patch I will rename SVGRenderSupport.* to SVGRenderBase.*
+
+        clampImageBufferSizeToViewport now takes a FrameView* which makes some code easier to read.
+
+        * rendering/RenderSVGBlock.h:
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        (WebCore::clampImageBufferSizeToViewport):
+        (WebCore::SVGRenderBase::computeContainerBoundingBox):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkStartCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkEndCallback):
+        (WebCore::SVGRootInlineBox::paint):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        (WebCore::clipToTextMask):
+
+2009-05-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed SVG build fix.
+
+        Include MappedAttribute.h after r43187.
+
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        * svg/SVGFEBlendElement.cpp:
+        * svg/SVGFEColorMatrixElement.cpp:
+        * svg/SVGFEComponentTransferElement.cpp:
+        * svg/SVGFECompositeElement.cpp:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        * svg/SVGFEImageElement.cpp:
+        * svg/SVGFELightElement.cpp:
+        * svg/SVGFEMergeNodeElement.cpp:
+        * svg/SVGFEOffsetElement.cpp:
+        * svg/SVGFESpecularLightingElement.cpp:
+        * svg/SVGFETileElement.cpp:
+        * svg/SVGFETurbulenceElement.cpp:
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+
+2009-05-04  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam 'The Belly' Weinig
+
+        <rdar://problem/6828894> - Facebook photo uploader applet broken on Leopard only
+
+        In r41568 we started adding a default codebase attribute to <applet> tags if they didn't specify one
+        themselves.  Leopard's Java plug-in mishandles this case and fails to load code for the applet.
+
+        The spirit of r41568 can be maintained by removing the "default codebase" piece and only performing
+        the canLoad() check if a codebase was actually set on the applet tag.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::createRenderer): Don't create a default codebase attribute.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::createJavaAppletWidget): Only perform the canLoad() check if the codebase was set.
+
+2009-05-04  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * html/HTMLCollection.h:
+        * html/HTMLFormElement.h:
+        Declare CollectionCache as a struct, not a class, to match its
+        definition.
+
+2009-05-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin, Oliver Hunt.
+
+        Bug 25557: REGRESSION: Canvas elements are ignored instead of being exposed as AXImage
+        https://bugs.webkit.org/show_bug.cgi?id=25557
+
+        Test: accessibility/canvas.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::roleValue):
+
+2009-05-04  Brady Eidson  <beidson@apple.com>
+
+        Fix an ancient Changelog entry where Sam Weinig flat out lied and confused my exploration of a bug.
+
+        * ChangeLog
+
+2009-05-04  Kai Brüning  <kai@granus.net>
+
+        Reviewed by Eric Seidel.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24883
+        24883: Bad success test in parseXMLDocumentFragment in XMLTokenizerLibxml2.cpp
+        
+        Fixed test whether all the chunk has been processed to correctly count utf8 bytes.
+
+        Test: fast/innerHTML/innerHTML-nbsp.xhtml
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::parseXMLDocumentFragment):
+
+2009-05-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 24924: remove Document.h include of Attr.h and HTMLCollection.h,
+        and NamedMappedAttrMap.h include of MappedAttribute.h
+        https://bugs.webkit.org/show_bug.cgi?id=24924
+
+        Make compiles faster, and debugging info smaller.
+
+        * GNUmakefile.am: Added new source files.
+        * WebCore.pro: Ditto.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS): Updated for new collection type names.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createAttribute): Added. No longer inline.
+        (WebCore::Document::images): Updated for new collection type names.
+        (WebCore::Document::applets): Ditto.
+        (WebCore::Document::embeds): Ditto.
+        (WebCore::Document::plugins): Ditto.
+        (WebCore::Document::objects): Ditto.
+        (WebCore::Document::scripts): Ditto.
+        (WebCore::Document::links): Ditto.
+        (WebCore::Document::forms): Ditto.
+        (WebCore::Document::anchors): Ditto.
+        (WebCore::Document::all): Ditto.
+        (WebCore::Document::windowNamedItems): Ditto.
+        (WebCore::Document::documentNamedItems): Ditto.
+        (WebCore::Document::nameCollectionInfo): Ditto.
+
+        * dom/Document.h: Changed around includes and forward declarations.
+        Updated for changes to collection types.
+
+        * dom/NamedMappedAttrMap.h: Removed include of MappedAttribute.h.
+
+        * html/CollectionCache.cpp: Copied from WebCore/html/HTMLCollection.cpp.
+        Contains the class that used to be HTMLCollection::CollectionInfo.
+        * html/CollectionCache.h: Copied from WebCore/html/HTMLCollection.h.
+        Ditto.
+
+        * html/CollectionType.h: Copied from WebCore/html/HTMLCollection.h.
+        Has the enum that used to be HTMLCollection::Type.
+
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::HTMLCollection): Update for collection type change.
+        (WebCore::HTMLCollection::create): Ditto.
+        (WebCore::HTMLCollection::resetCollectionInfo): Ditto.
+        (WebCore::HTMLCollection::itemAfter): Ditto.
+        * html/HTMLCollection.h: Ditto.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::children): Updated for new collection type names.
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo): Ditto.
+        (WebCore::HTMLFormCollection::HTMLFormCollection): Ditto.
+        * html/HTMLFormCollection.h: Ditto.
+        * html/HTMLFormElement.h: Ditto.
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::areas): Ditto.
+        * html/HTMLNameCollection.cpp:
+        (WebCore::HTMLNameCollection::HTMLNameCollection): Ditto.
+        * html/HTMLNameCollection.h:
+        (WebCore::HTMLNameCollection::create): Ditto.
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo): Ditto.
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::tBodies):Ditto.
+        * html/HTMLTableRowElement.cpp:
+        (WebCore::HTMLTableRowElement::cells):Ditto.
+        * html/HTMLTableRowsCollection.cpp:
+        (WebCore::HTMLTableRowsCollection::HTMLTableRowsCollection): Ditto.
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::rows): Ditto.
+
+        * bindings/js/JSDOMWindowBase.cpp: Added newly-needed includes.
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp: Ditto.
+        * css/CSSStyleSelector.cpp: Ditto.
+        * dom/Element.cpp: Ditto.
+        * dom/InputElement.cpp: Ditto.
+        * dom/NamedAttrMap.cpp: Ditto.
+        * dom/NamedMappedAttrMap.cpp: Ditto.
+        * dom/Node.cpp: Ditto.
+        * dom/StyledElement.cpp: Ditto.
+        * dom/StyledElement.h: Ditto.
+        * editing/ApplyStyleCommand.cpp: Ditto.
+        * editing/DeleteSelectionCommand.cpp: Ditto.
+        * editing/Editor.cpp: Ditto.
+        * editing/EditorCommand.cpp: Ditto.
+        * editing/InsertParagraphSeparatorCommand.cpp: Ditto.
+        * editing/ReplaceSelectionCommand.cpp: Ditto.
+        * editing/markup.cpp: Ditto.
+        * html/CanvasRenderingContext2D.cpp: Ditto.
+        * html/HTMLAnchorElement.cpp: Ditto.
+        * html/HTMLAppletElement.cpp: Ditto.
+        * html/HTMLAreaElement.cpp: Ditto.
+        * html/HTMLBRElement.cpp: Ditto.
+        * html/HTMLBaseElement.cpp: Ditto.
+        * html/HTMLBodyElement.cpp: Ditto.
+        * html/HTMLButtonElement.cpp: Ditto.
+        * html/HTMLCanvasElement.cpp: Ditto.
+        * html/HTMLDivElement.cpp: Ditto.
+        * html/HTMLEmbedElement.cpp: Ditto.
+        * html/HTMLFontElement.cpp: Ditto.
+        * html/HTMLFormControlElement.cpp: Ditto.
+        * html/HTMLFormElement.cpp: Ditto.
+        * html/HTMLFrameElement.cpp: Ditto.
+        * html/HTMLFrameElementBase.cpp: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        * html/HTMLHRElement.cpp: Ditto.
+        * html/HTMLIFrameElement.cpp: Ditto.
+        * html/HTMLImageElement.cpp: Ditto.
+        * html/HTMLInputElement.cpp: Ditto.
+        * html/HTMLIsIndexElement.cpp: Ditto.
+        * html/HTMLKeygenElement.cpp: Ditto.
+        * html/HTMLLIElement.cpp: Ditto.
+        * html/HTMLLinkElement.cpp: Ditto.
+        * html/HTMLMarqueeElement.cpp: Ditto.
+        * html/HTMLMetaElement.cpp: Ditto.
+        * html/HTMLOListElement.cpp: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLOptionElement.cpp: Ditto.
+        * html/HTMLParagraphElement.cpp: Ditto.
+        * html/HTMLParamElement.cpp: Ditto.
+        * html/HTMLPlugInElement.cpp: Ditto.
+        * html/HTMLPreElement.cpp: Ditto.
+        * html/HTMLScriptElement.cpp: Ditto.
+        * html/HTMLSelectElement.cpp: Ditto.
+        * html/HTMLStyleElement.cpp: Ditto.
+        * html/HTMLTableCaptionElement.cpp: Ditto.
+        * html/HTMLTableCellElement.cpp: Ditto.
+        * html/HTMLTableColElement.cpp: Ditto.
+        * html/HTMLTablePartElement.cpp: Ditto.
+        * html/HTMLTextAreaElement.cpp: Ditto.
+        * html/HTMLTokenizer.cpp: Ditto.
+        * html/HTMLUListElement.cpp: Ditto.
+        * html/HTMLVideoElement.cpp: Ditto.
+        * html/HTMLViewSourceDocument.cpp: Ditto.
+        * loader/ImageDocument.cpp: Ditto.
+        * page/Frame.cpp: Ditto.
+        * rendering/RenderTreeAsText.cpp: Ditto.
+        * svg/SVGAElement.cpp: Ditto.
+        * svg/SVGAnimateMotionElement.cpp: Ditto.
+        * svg/SVGAnimateTransformElement.cpp: Ditto.
+        * svg/SVGAnimationElement.cpp: Ditto.
+        * svg/SVGCircleElement.cpp: Ditto.
+        * svg/SVGClipPathElement.cpp: Ditto.
+        * svg/SVGCursorElement.cpp: Ditto.
+        * svg/SVGElement.cpp: Ditto.
+        * svg/SVGEllipseElement.cpp: Ditto.
+        * svg/SVGExternalResourcesRequired.cpp: Ditto.
+        * svg/SVGFitToViewBox.cpp: Ditto.
+        * svg/SVGFontFaceElement.cpp: Ditto.
+        * svg/SVGFontFaceUriElement.cpp: Ditto.
+        * svg/SVGForeignObjectElement.cpp: Ditto.
+        * svg/SVGGlyphElement.cpp: Ditto.
+        * svg/SVGGradientElement.cpp: Ditto.
+        * svg/SVGImageElement.cpp: Ditto.
+        * svg/SVGLangSpace.cpp: Ditto.
+        * svg/SVGLineElement.cpp: Ditto.
+        * svg/SVGLinearGradientElement.cpp: Ditto.
+        * svg/SVGMarkerElement.cpp: Ditto.
+        * svg/SVGMaskElement.cpp: Ditto.
+        * svg/SVGPathElement.cpp: Ditto.
+        * svg/SVGPatternElement.cpp: Ditto.
+        * svg/SVGPolyElement.cpp: Ditto.
+        * svg/SVGRadialGradientElement.cpp: Ditto.
+        * svg/SVGRectElement.cpp: Ditto.
+        * svg/SVGSVGElement.cpp: Ditto.
+        * svg/SVGScriptElement.cpp: Ditto.
+        * svg/SVGStopElement.cpp: Ditto.
+        * svg/SVGStyleElement.cpp: Ditto.
+        * svg/SVGStyledElement.cpp: Ditto.
+        * svg/SVGStyledTransformableElement.cpp: Ditto.
+        * svg/SVGTests.cpp: Ditto.
+        * svg/SVGTextContentElement.cpp: Ditto.
+        * svg/SVGTextElement.cpp: Ditto.
+        * svg/SVGTextPathElement.cpp: Ditto.
+        * svg/SVGTextPositioningElement.cpp: Ditto.
+        * svg/SVGURIReference.cpp: Ditto.
+        * svg/SVGUseElement.cpp: Ditto.
+        * svg/SVGViewElement.cpp: Ditto.
+        * svg/animation/SVGSMILElement.cpp: Ditto.
+        * xml/XPathStep.cpp: Ditto.
+
+2009-05-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Do not instantiate hidden WebInspector panels. Otherwise they are hitting unimplemented InspectorController methods.
+        https://bugs.webkit.org/show_bug.cgi?id=25520
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-05-04  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6839881> With "Mail Contents of This Page" in Safari images don't appear in the Tiger Mail compose window
+
+        DocumentLoader::subresource() is the implementation for the WebKit API [WebDataSource subresourceForURL:] and has 
+        particularly sticky behavior.  
+
+        If the DocumentLoader represents a WebArchive, this method should return ArchiveResources from that archive.  However, we 
+        prefer CachedResources over ArchiveResources because they might represent fresher data than what was originally loaded 
+        from the WebArchive.
+
+        In some instances, CachedResources are created and associated with the DocumentLoader but not immediately run through the 
+        loading delegate machinery.  This was always a possibility, but the Preload Scanner made this significantly more likely.
+
+        When this happens and someone asks the WebDataSource for a subresource, it would prefer the CachedResource over an 
+        ArchiveResource it has even if the CachedResource hasn't been loaded yet.  The CachedResource has nil data, so no
+        WebResource is returned, and the client thinks the subresource doesn't exist even though it does.
+
+        This broke Tiger Mail and probably various other WebKit applications but has a fairly straightforward fix.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): If there is a CachedResource but it hasn't been loaded yet, fallback to the
+          ArchiveResource.
+
+2009-05-04  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25545
+        Bug 25545: HTMLMediaElement: display anamorphic video correctly
+        
+        Tell QuickTime to use clean aperture mode so movies with non-square pixels are sized
+        and displayed correctly.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie): Ask QuickTime to use clean aperture mode.
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::load): Ditto. Add ASSERT to ensure that static movie property array isn't 
+        filled beyond capacity.
+
+2009-05-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25332>.
+        Bug 25332: Plug-in inserted in to DOM of PluginDocument fails to load
+
+        Only the first plug-in in a PluginDocument can use the main resource data.  For all
+        subsequent plug-ins, such as the plug-in that ClickToFlash inserts when swapping itself
+        out for the real Flash plug-in, we need to load the resource data in the same manner
+        as for other embedded plug-ins.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadPlugin):
+
+2009-05-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Update the qrc file for the Web Inspector in the Qt build
+        with missing files.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Move absoluteRects and absoluteQuads into RenderSVGInline and remove absoluteTransform() usage
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::absoluteRects):
+        (WebCore::RenderSVGInline::absoluteQuads):
+        * rendering/RenderSVGInline.h:
+        * rendering/RenderSVGTSpan.cpp:
+        * rendering/RenderSVGTSpan.h:
+        * rendering/RenderSVGTextPath.cpp:
+        * rendering/RenderSVGTextPath.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Move RenderSVGText off of localToAbsolute()
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Remove broken absoluteTransform() code from RenderSVGInlineText
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        This improved SVG text focus rings.
+        This also improved SVG.getScreenCTM() results.
+
+        SVGSVGElement::getScreenCTM was passing "true" for the second argument in
+        localToAbsolute, which is "fixed" it meant to pass "true" for the
+        third argument (useTransforms).  That change alone caused no layout test changes, however
+        before I fixed this, it was hitting ASSERT(!fixed) in RenderSVGRoot::mapLocalToContainer
+
+        mapLocalToContainer implementations really should be shared,
+        but I'll do that in a later patch.
+
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::styleDidChange):
+        (WebCore::RenderSVGInlineText::absoluteQuads):
+        (WebCore::RenderSVGInlineText::computeRepaintRectForRange):
+        (WebCore::RenderSVGInlineText::computeRepaintQuadForRange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::mapLocalToContainer):
+        * rendering/RenderSVGText.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::getScreenCTM):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Remove dead code from RenderPath
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderPath.cpp:
+        * rendering/RenderPath.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Share layout code between RenderSVGViewportContainer and RenderSVGContainer
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::calcViewport):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::applyViewportClip):
+        * rendering/RenderSVGViewportContainer.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Remove redundant disableLayoutState() calls
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::layout):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Simplify RenderForeignObject::paint and fix a repaint bug.
+        Paint now calls applyTransformToPaintInfo which correctly transforms the damage rect.
+        https://bugs.webkit.org/show_bug.cgi?id=16939
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::paint):
+
+2009-05-03  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Test: editing/spelling/spellcheck-attribute.html
+
+        Bug 14552: Add a way to disable spell checking for specific element
+        https://bugs.webkit.org/show_bug.cgi?id=14552
+
+        For compatibility with Firefox, this code ascends the DOM tree when an element does
+        not have its "spellcheck" attribute.
+
+        * editing/Editor.cpp:
+        (WebCore::markMisspellingsOrBadGrammar): Retrieve the value of the "spellcheck"
+        attribute of an element before calling a spell checker or a grammar checker.
+        * html/HTMLAttributeNames.in: Add a "spellcheck" attribute.
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in one last time (I hope).
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back out. It still breaks windows.
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in.
+
+2009-05-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - another fix for <rdar://problem/6617298> Typing delete on an unquoted
+          blank line unquotes the preceding, quoted blank line
+
+        Test: editing/deleting/type-delete-after-quote-2.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::DeleteSelectionCommand): Initialize
+        m_startsAtEmptyLine.
+        (WebCore::DeleteSelectionCommand::handleSpecialCaseBRDelete): When the
+        selection starts at an empty line, do not prevent the merging of blocks.
+        This is what allows the text after the line break to be merged into the
+        block containing the line break. Also set m_startsAtEmptyLine to true.
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): If
+        m_startsAtEmptyLine is true, create a placeholder BR to serve as the
+        merge destination.
+        * editing/DeleteSelectionCommand.h:
+
+2009-05-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Simplified null-ish JSValues.
+        
+        Replaced calls to noValue() with calls to JSValue() (which is what
+        noValue() returned). Removed noValue().
+        
+        Removed "JSValue()" initialiazers, since default construction happens...
+        by default.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::hasNoValue):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::invokeConstruct):
+
+2009-05-02  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6631735> Crash in WebCore::CSSStyleSelector::applyProperty(int, WebCore::CSSValue*) (RenderStyle.h:454)
+        
+        Avoid re-entering style selector from load delegates by not issuing resource loads synchronously during attach().
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::suspendPostAttachCallbacks):
+        (WebCore::ContainerNode::resumePostAttachCallbacks):
+        (WebCore::ContainerNode::attach):
+        * dom/Element.cpp:
+        (WebCore::Element::attach):
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::suspendPendingRequests):
+        (WebCore::Loader::resumePendingRequests):
+        (WebCore::Loader::Host::servePendingRequests):
+        * loader/loader.h:
+        (WebCore::Loader::isSuspendingPendingRequests):
+
+2009-05-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 25352: REGRESSION(r42322): style isn't applied at bmwusa.com
+        https://bugs.webkit.org/show_bug.cgi?id=25352
+        rdar://problem/6823239
+
+        Test: http/tests/mime/standard-mode-loads-stylesheet-with-text-css-and-invalid-type.html
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::extractMIMETypeFromMediaType): Allow comma as a separator.
+
+2009-05-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Bug 25491: WebFrame leak when a subframe removes itself
+        https://bugs.webkit.org/show_bug.cgi?id=25491
+        rdar://problem/6833859
+
+        Test: fast/loading/subframe-removes-itself.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame): When isStopping is true,
+        treat load as complete, even if isLoadingInAPISense is still returning true.
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Roll out JavaScriptCore API number marshaling.
+
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isEqual):
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::getHeadCallback):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getChildren):
+        (WebCore::getParent):
+        (WebCore::getHead):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix build.
+
+        * workers/WorkerContext.idl:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Cleanup workers code a bit.
+
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::customGetOwnPropertySlot):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::toWorkerContext):
+        (WebCore::WorkerContext::self):
+        (WebCore::WorkerContext::setOnmessage):
+        (WebCore::WorkerContext::onmessage):
+        * workers/WorkerContext.idl:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        A little clean up.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::createJavaAppletWidget):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isEqual):
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::getHeadCallback):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getChildren):
+        (WebCore::getParent):
+        (WebCore::getHead):
+
+2009-05-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Oliver Hunt and Sam "Jon 'The Belly' Honeycutt" Weinig
+
+        Fix <rdar://problem/6848867> Addition of DOCTYPE node breaks Tiger Mail
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLDocument firstChild]): Add a Tiger Mail version of this method that skips DOCTYPE nodes.
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+        
+        Renamed JSValuePtr => JSValue.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue):
+        * bindings/js/JSCDATASectionCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        (WebCore::JSCSSStyleDeclaration::customPut):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toJS):
+        (WebCore::toHTMLCanvasStyle):
+        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::fillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::types):
+        (WebCore::JSClipboard::clearData):
+        (WebCore::JSClipboard::getData):
+        (WebCore::JSClipboard::setData):
+        (WebCore::JSClipboard::setDragImage):
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profiles):
+        * bindings/js/JSCoordinatesCustom.cpp:
+        (WebCore::JSCoordinates::altitude):
+        (WebCore::JSCoordinates::altitudeAccuracy):
+        (WebCore::JSCoordinates::heading):
+        (WebCore::JSCoordinates::speed):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        (WebCore::toVoidCallback):
+        * bindings/js/JSCustomVoidCallback.h:
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSCustomXPathNSResolver.h:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::hasItem):
+        (WebCore::JSDOMApplicationCache::add):
+        (WebCore::JSDOMApplicationCache::remove):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringOrNull):
+        (WebCore::jsOwnedStringOrNull):
+        (WebCore::jsStringOrUndefined):
+        (WebCore::jsStringOrFalse):
+        (WebCore::valueToStringWithNullCheck):
+        (WebCore::valueToStringWithUndefinedOrNullCheck):
+        (WebCore::reportException):
+        (WebCore::reportCurrentException):
+        (WebCore::setDOMException):
+        (WebCore::objectToStringFunctionGetter):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::getDOMNodeWrapper):
+        (WebCore::toJS):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMStringListCustom.cpp:
+        (WebCore::JSDOMStringList::getByIndex):
+        (WebCore::JSDOMStringList::item):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::childFrameGetter):
+        (WebCore::JSDOMWindowBase::indexGetter):
+        (WebCore::JSDOMWindowBase::namedItemGetter):
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
+        (WebCore::JSDOMWindowBase::put):
+        (WebCore::JSDOMWindowBase::setReturnValueSlot):
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindow):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::lookupGetter):
+        (WebCore::JSDOMWindow::lookupSetter):
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::crypto):
+        (WebCore::JSDOMWindow::event):
+        (WebCore::JSDOMWindow::image):
+        (WebCore::JSDOMWindow::option):
+        (WebCore::JSDOMWindow::audio):
+        (WebCore::JSDOMWindow::webKitPoint):
+        (WebCore::JSDOMWindow::webKitCSSMatrix):
+        (WebCore::JSDOMWindow::xmlHttpRequest):
+        (WebCore::JSDOMWindow::xsltProcessor):
+        (WebCore::JSDOMWindow::messageChannel):
+        (WebCore::JSDOMWindow::worker):
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::JSDOMWindow::postMessage):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        (WebCore::toDOMWindow):
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::nonCachingStaticFunctionGetter):
+        (WebCore::JSDOMWindow::customPut):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::put):
+        (WebCore::JSDOMWindowShell::putWithAttributes):
+        (WebCore::JSDOMWindowShell::lookupGetter):
+        (WebCore::JSDOMWindowShell::lookupSetter):
+        (WebCore::toJS):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::JSDatabase::transaction):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::JSDocument::setLocation):
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttribute):
+        (WebCore::JSElement::setAttributeNode):
+        (WebCore::JSElement::setAttributeNS):
+        (WebCore::JSElement::setAttributeNodeNS):
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::JSEvent::clipboardData):
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * bindings/js/JSEventTarget.h:
+        * bindings/js/JSEventTargetBase.h:
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionOptions):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::customPut):
+        (WebCore::JSHTMLAppletElement::nameGetter):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter):
+        (WebCore::JSHTMLDocument::all):
+        (WebCore::JSHTMLDocument::setAll):
+        (WebCore::JSHTMLDocument::open):
+        (WebCore::JSHTMLDocument::write):
+        (WebCore::JSHTMLDocument::writeln):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::customPut):
+        (WebCore::JSHTMLEmbedElement::nameGetter):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        (WebCore::JSHTMLFormElement::submit):
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::JSHTMLFrameElement::setSrc):
+        (WebCore::JSHTMLFrameElement::setLocation):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc):
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::selectionStart):
+        (WebCore::JSHTMLInputElement::setSelectionStart):
+        (WebCore::JSHTMLInputElement::selectionEnd):
+        (WebCore::JSHTMLInputElement::setSelectionEnd):
+        (WebCore::JSHTMLInputElement::setSelectionRange):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::customPut):
+        (WebCore::JSHTMLObjectElement::nameGetter):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::length):
+        (WebCore::JSHTMLOptionsCollection::setLength):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        (WebCore::JSHTMLOptionsCollection::add):
+        (WebCore::JSHTMLOptionsCollection::remove):
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        (WebCore::JSHTMLSelectElement::remove):
+        (WebCore::selectIndexSetter):
+        (WebCore::JSHTMLSelectElement::indexSetter):
+        * bindings/js/JSHTMLSelectElementCustom.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        (WebCore::JSHistory::customPut):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        (WebCore::JSInspectedObjectWrapper::prepareIncomingValue):
+        * bindings/js/JSInspectedObjectWrapper.h:
+        (WebCore::JSInspectedObjectWrapper::wrapOutgoingValue):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+        (WebCore::JSInspectorCallbackWrapper::prepareIncomingValue):
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        (WebCore::JSInspectorCallbackWrapper::wrapOutgoingValue):
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::highlightDOMNode):
+        (WebCore::JSInspectorController::addResourceSourceToFrame):
+        (WebCore::JSInspectorController::addSourceToFrame):
+        (WebCore::JSInspectorController::getResourceDocumentNode):
+        (WebCore::JSInspectorController::search):
+        (WebCore::JSInspectorController::databaseTableNames):
+        (WebCore::JSInspectorController::inspectedWindow):
+        (WebCore::JSInspectorController::setting):
+        (WebCore::JSInspectorController::setSetting):
+        (WebCore::JSInspectorController::wrapCallback):
+        (WebCore::JSInspectorController::currentCallFrame):
+        (WebCore::JSInspectorController::profiles):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        (WebCore::JSJavaScriptCallFrame::thisObject):
+        (WebCore::JSJavaScriptCallFrame::type):
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+        (WebCore::JSLocation::customPut):
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::setProtocol):
+        (WebCore::JSLocation::setHost):
+        (WebCore::JSLocation::setHostname):
+        (WebCore::JSLocation::setPort):
+        (WebCore::JSLocation::setPathname):
+        (WebCore::JSLocation::setSearch):
+        (WebCore::JSLocation::setHash):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::reload):
+        (WebCore::JSLocation::assign):
+        (WebCore::JSLocation::toString):
+        (WebCore::JSLocationPrototype::customPut):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::startConversation):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        (WebCore::JSMimeTypeArray::nameGetter):
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::lengthGetter):
+        (WebCore::JSNamedNodesCollection::indexGetter):
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::createStructure):
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::needsYouTubeQuirk):
+        (WebCore::JSNavigator::appVersion):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::insertBefore):
+        (WebCore::JSNode::replaceChild):
+        (WebCore::JSNode::removeChild):
+        (WebCore::JSNode::appendChild):
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::createWrapper):
+        (WebCore::toJSNewlyCreated):
+        (WebCore::toJS):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::JSNodeFilterCondition):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        (WebCore::JSNodeFilterCondition::create):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::acceptNode):
+        (WebCore::toNodeFilter):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::nextNode):
+        (WebCore::JSNodeIterator::previousNode):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        (WebCore::JSNodeList::nameGetter):
+        * bindings/js/JSPluginArrayCustom.cpp:
+        (WebCore::JSPluginArray::nameGetter):
+        * bindings/js/JSPluginCustom.cpp:
+        (WebCore::JSPlugin::nameGetter):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectGetter):
+        (WebCore::runtimeObjectPropertyGetter):
+        (WebCore::runtimeObjectCustomPut):
+        (WebCore::callPlugin):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::asWrapper):
+        (WebCore::JSQuarantinedObjectWrapper::cachedValueGetter):
+        (WebCore::JSQuarantinedObjectWrapper::transferExceptionToExecState):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertySlot):
+        (WebCore::JSQuarantinedObjectWrapper::put):
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::hasInstance):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/js/JSRGBColor.cpp:
+        (WebCore::getJSRGBColor):
+        (jsRGBColorRed):
+        (jsRGBColorGreen):
+        (jsRGBColorBlue):
+        * bindings/js/JSRGBColor.h:
+        (WebCore::JSRGBColor::createStructure):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        (WebCore::toJS):
+        * bindings/js/JSSVGLengthCustom.cpp:
+        (WebCore::JSSVGLength::value):
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::inverse):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        (WebCore::JSSVGPathSegList::clear):
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::finishGetter):
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        (WebCore::JSSVGPointList::clear):
+        (WebCore::JSSVGPointList::initialize):
+        (WebCore::JSSVGPointList::getItem):
+        (WebCore::JSSVGPointList::insertItemBefore):
+        (WebCore::JSSVGPointList::replaceItem):
+        (WebCore::JSSVGPointList::removeItem):
+        (WebCore::JSSVGPointList::appendItem):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::finishGetter):
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        (WebCore::JSSVGTransformList::clear):
+        (WebCore::JSSVGTransformList::initialize):
+        (WebCore::JSSVGTransformList::getItem):
+        (WebCore::JSSVGTransformList::insertItemBefore):
+        (WebCore::JSSVGTransformList::replaceItem):
+        (WebCore::JSSVGTransformList::removeItem):
+        (WebCore::JSSVGTransformList::appendItem):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::nameGetter):
+        (WebCore::JSStorage::deleteProperty):
+        (WebCore::JSStorage::customPut):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::nameGetter):
+        * bindings/js/JSTextCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::parentNode):
+        (WebCore::JSTreeWalker::firstChild):
+        (WebCore::JSTreeWalker::lastChild):
+        (WebCore::JSTreeWalker::nextSibling):
+        (WebCore::JSTreeWalker::previousSibling):
+        (WebCore::JSTreeWalker::previousNode):
+        (WebCore::JSTreeWalker::nextNode):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::self):
+        (WebCore::JSWorkerContext::setSelf):
+        (WebCore::JSWorkerContext::xmlHttpRequest):
+        (WebCore::JSWorkerContext::importScripts):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
+        (WebCore::JSXMLHttpRequest::setRequestHeader):
+        (WebCore::JSXMLHttpRequest::send):
+        (WebCore::JSXMLHttpRequest::getResponseHeader):
+        (WebCore::JSXMLHttpRequest::overrideMimeType):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        (WebCore::JSXMLHttpRequest::responseText):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        (WebCore::JSXSLTProcessor::setParameter):
+        (WebCore::JSXSLTProcessor::getParameter):
+        (WebCore::JSXSLTProcessor::removeParameter):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptCallStack.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::get):
+        * bindings/js/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::jsValue):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_HasMethod):
+        (_NPN_Construct):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::defaultValue):
+        (JSC::Bindings::CInstance::stringValue):
+        (JSC::Bindings::CInstance::numberValue):
+        (JSC::Bindings::CInstance::booleanValue):
+        (JSC::Bindings::CInstance::valueOf):
+        * bridge/c/c_instance.h:
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_runtime.h:
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/c/c_utility.h:
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::stringValue):
+        (JavaInstance::numberValue):
+        (JavaInstance::booleanValue):
+        (JavaInstance::invokeMethod):
+        (JavaInstance::defaultValue):
+        (JavaInstance::valueOf):
+        * bridge/jni/jni_instance.h:
+        * bridge/jni/jni_jsobject.h:
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaArray::convertJObjectToArray):
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::valueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        (JavaField::setValueToInstance):
+        (JavaArray::setValueAt):
+        (JavaArray::valueAt):
+        * bridge/jni/jni_runtime.h:
+        * bridge/jni/jni_utility.cpp:
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jni_utility.h:
+        * bridge/objc/WebScriptObject.h:
+        * bridge/objc/objc_class.h:
+        * bridge/objc/objc_class.mm:
+        (JSC::Bindings::ObjcClass::fallbackObject):
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        (ObjcInstance::defaultValue):
+        (ObjcInstance::stringValue):
+        (ObjcInstance::numberValue):
+        (ObjcInstance::booleanValue):
+        (ObjcInstance::valueOf):
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::convertValueToObjcObject):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        (JSC::Bindings::ObjcArray::setValueAt):
+        (JSC::Bindings::ObjcArray::valueAt):
+        (JSC::Bindings::ObjcFallbackObjectImp::put):
+        (JSC::Bindings::callObjCFallbackObject):
+        (JSC::Bindings::ObjcFallbackObjectImp::defaultValue):
+        * bridge/objc/objc_utility.h:
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/runtime.h:
+        (JSC::Bindings::Class::fallbackObject):
+        (JSC::Bindings::Instance::setValueOfUndefinedField):
+        (JSC::Bindings::Instance::invokeDefaultMethod):
+        (JSC::Bindings::Instance::invokeConstruct):
+        (JSC::Bindings::Instance::put):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::lengthGetter):
+        (JSC::RuntimeArray::indexGetter):
+        (JSC::RuntimeArray::put):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::lengthGetter):
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::fallbackObjectGetter):
+        (JSC::RuntimeObjectImp::fieldGetter):
+        (JSC::RuntimeObjectImp::methodGetter):
+        (JSC::RuntimeObjectImp::put):
+        (JSC::RuntimeObjectImp::defaultValue):
+        (JSC::callRuntimeObject):
+        (JSC::callRuntimeConstructor):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::toJS):
+        * inspector/JavaScriptProfile.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::toJS):
+        * inspector/JavaScriptProfileNode.h:
+
+2009-05-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25485
+        Only use visitedURL in Qt. This is a follow-up change to http://trac.webkit.org/changeset/43052,
+        which broke Chromium build.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState): Moved guards around to
+            provide separate code paths for Qt and non-Qt ports. Also restored original
+            order of execution.
+
+2009-05-01  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6839222>
+        CrashTracer: Lots of crashes in Safari in hash table remove function inside DocumentLoader::removeSubresourceLoader
+        
+        After calling m_client->didFail(), check if the subresource loader has reached its terminal state. If that's the case,
+        return early to avoid calling removeSubresourceLoader on a null document loader. I don't think this is allowed to happen
+        which is why I've added the ASSERT.
+        
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::didCancel):
+
+2009-05-01  Timothy Hatcher  <timothy@apple.com>
+
+        Disallow the deletion UI for elements that have any overflow clipping.
+        Also disallow the UI for the body element it isn't practical to delete,
+        and the deletion UI would be clipped.
+
+        <rdar://problem/6840161> Deletion UI can be clipped by some
+        elements (with overflow: hidden)
+
+        Reviewed by Darin Adler.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-05-01  Timothy Hatcher  <timothy@apple.com>
+
+        Decrease the minimum height for deleteable elements to 16px, and increase the
+        minimum width to 48px. This allows deleting shorter items like navigation bars.
+
+        <rdar://problem/6840735> Deletion UI does not show up for short
+        elements (22px or less)
+
+        Reviewed by Adele Peterson.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-05-01  Timothy Hatcher  <timothy@apple.com>
+
+        Clean up the comments and logic in the code for picking a
+        deleteable element for the deletion UI.
+
+        Reviewed by Adele Peterson.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-05-01  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adele Peterson and Darin Adler.
+
+        <rdar://problem/4815598> Stuck in double spacing mode after pasting a
+        paragraph with padding/margin (or table mode !)
+
+        A lot of the issues in this bug were resolved on Mail's side by using
+        WebKit to convert to plain text.  This is the final issue, that floating
+        style stays on copied nodes causing them to float when they are pasted
+        which is not what the user intended.
+
+        * editing/markup.cpp:
+        (WebCore::removeExteriorStyles):
+        (WebCore::):
+        (WebCore::appendStartMarkup):
+        (WebCore::getStartMarkup):
+        (WebCore::createMarkup):
+
+2009-05-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a FrameLoaderClient callback for the ResourceRetrievedByXMLHttpRequest.
+        This is the only resource-related information that is available in InspectorController
+        and is missing in the FrameLoaderClient.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25347
+
+        * WebCore.xcodeproj/project.pbxproj: Made ScriptSource private.
+        * dom/Document.cpp: Made a call to a client along with the call to the InspectorController.
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/EmptyClients.h: Added stub implementation.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidLoadResourceByXMLHttpRequest):
+        * loader/FrameLoader.cpp: Call initiating dispatches.
+        (WebCore::FrameLoader::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+
+2009-04-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6841106> REGRESSION: Crash drag selecting 
+        To Do's in a Mail note (excessive recursion in mouse drag tracking)
+
+        Oliver's recent change to dragging seems to have revealed a long-
+        time bug in passSubframeEventToSubframe where we did not set 
+        m_sendingEventToSubview to true before calling 
+        handleMouseMoveEvent() in the NSMouseMoved case. This patch fixes 
+        that and adds ASSERTions around all of the places where 
+        m_sendingEventToSubview is set to true and then false to make sure 
+        we are not trampling its state.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::eventLoopHandleMouseDragged):
+        (WebCore::EventHandler::eventLoopHandleMouseUp):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+
+2009-04-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        MediaDocument falls back to plug-in unnecessarily
+        https://bugs.webkit.org/show_bug.cgi?id=25504
+        <rdar://problem/6844702>
+        
+        Don't allow harmless media types to cause a MediaDocument to fall
+        back to PluginDocument.
+
+        Test: media/video-document-types.html
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks): add timecode, timecode 64,
+        odsm, and sdsm to allowed track types.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::disableUnsupportedTracks): Ditto.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add CHROMIUM guard to unfork Document.cpp
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Added guard.
+
+2009-04-30  David Kilzer  <ddkilzer@apple.com>
+
+        Use OwnPtr<HTMLParserQuirks> for m_parserQuirks
+
+        Reviewed by Geoff Garen.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::~HTMLParser): Removed unneeded code.
+        * html/HTMLParser.h: Made m_parserQuirks an OwnPtr.
+
+2009-04-30  David Kilzer  <ddkilzer@apple.com>
+
+        Provide a mechanism to create a quirks delegate for HTMLParser
+
+        Reviewed by David Hyatt.
+
+        No tests since there is no change in behavior.
+
+        HTMLParserQuirks.h defines an abstract base class that may be
+        extended as needed.  The ChromeClient::createHTMLParserQuirks()
+        factory method should be used to return an HTMLParserQuirks
+        subclassed object when needed.
+
+        * WebCore.xcodeproj/project.pbxproj: Added HTMLParserQuirks.h.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser): Initialize m_parserQuirks
+        using ChromeClient::createHTMLParserQuirks().
+        (WebCore::HTMLParser::~HTMLParser): Delete m_parserQuirks if
+        set.
+        (WebCore::HTMLParser::reset): Call HTMLParserQuirks::reset() if
+        m_parserQuirks is set.
+        (WebCore::HTMLParser::insertNode): Call
+        HTMLParserQuirks::shouldInsertNode() if m_parserQuirks is set,
+        and return early if it returns false.
+        (WebCore::HTMLParser::popBlock): Call
+        HTMLParserQuirks::shouldPopBlock() if m_parserQuirks is set, and
+        return early if it returns false.
+        * html/HTMLParser.h: Added m_parserQuirks.
+        * html/HTMLParserQuirks.h: Added.
+        (WebCore::HTMLParserQuirks::HTMLParserQuirks):
+        (WebCore::HTMLParserQuirks::~HTMLParserQuirks):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::createHTMLParserQuirks): Added.
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::createHTMLParserQuirks): Added.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25492
+        Add JSC guards around node wrapper cache calls. These are not used by V8.
+
+        Also, remove JSDOMBinding include, which is brought in by ScriptController.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document): Added JSC guard.
+        * dom/Node.cpp:
+        (WebCore::Node::setDocument): Ditto and removed JSDOMBinding include.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25493
+        Remove debugger/profiler custom method stubs, catching V8 bindings up to
+        http://trac.webkit.org/changeset/43072.
+
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp: Removed method stubs.
+
+2009-04-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6839338> VoiceOver does not take into account transforms when drawing outlines
+        
+        Use transform-aware quad methods when computing the boundingBoxRect for
+        an AccessibilityRenderObject. The code follows RenderObject::absoluteBoundingBoxRect().
+
+        Test: accessibility/transformed-element.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, Chromium build fix.
+
+        Catch up to ScriptObject changes from http://trac.webkit.org/changeset/42512.
+
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::get): Renamed from getObject.
+        (WebCore::ScriptGlobalObject::remove): Added.
+        * bindings/v8/ScriptObject.h: Ditto.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * WebCore.pro: Fix copy-paste error.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * GNUmakefile.am: Add ENABLE_JAVASCRIPT_DEBUGGER definitions.
+        * WebCore.pro: Ditto.
+
+2009-04-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Change Position to pre-compute the AnchorType and store it.
+        Also store a "legacy editing mode" bit on the Position.
+        https://bugs.webkit.org/show_bug.cgi?id=24763
+
+        The old Postion(node, offset) constructor creates legacy positions
+        but there are new constructors to create explicitly anchored positions
+        which the next patch will use.
+
+        Once we fix all the "position-fixup" functions (like rangeCompliantEquivalent) to
+        only affect legacy positions, we will be able to distinguish
+        between [table, 1] and [table, after] in the code correctly!
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Position.cpp:
+        (WebCore::Position::Position):
+        (WebCore::Position::moveToPosition):
+        (WebCore::Position::moveToOffset):
+        (WebCore::Position::anchorTypeForLegacyEditingPosition):
+        (WebCore::Position::element):
+        * dom/Position.h:
+        (WebCore::Position::):
+        (WebCore::Position::Position):
+        (WebCore::Position::anchorType):
+        (WebCore::Position::deprecatedEditingOffset):
+
+2009-04-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix bug where the WorkerLocation and WorkerNavigator wrappers would be
+        collected even if the WorkerContext is still alive.
+
+        Test: fast/workers/worker-context-gc.html
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        (WebCore::WorkerContext::completeURL):
+        (WebCore::WorkerContext::location):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::optionalNavigator):
+        (WebCore::WorkerContext::optionalLocation):
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * Configurations/FeatureDefines.xcconfig: Added ENABLE_JAVASCRIPT_DEBUGGER.
+        * WebCore.vcproj/build-generated-files.sh: Ditto.
+        * bindings/js/JSConsoleCustom.cpp: Added ENABLE(JAVASCRIPT_DEBUGGER) guard.
+        * bindings/js/JSDOMWindowBase.cpp: Ditto.
+        * bindings/js/JSInspectorControllerCustom.cpp: Ditto.
+        * inspector/InspectorController.cpp: Moved profiler/debugger methods under
+            ENABLE(JAVASCRIPT_DEBUGGER) flag.
+        * inspector/InspectorController.h: Ditto.
+        * inspector/InspectorController.idl: Added ENABLE(JAVASCRIPT_DEBUGGER) guard.
+        * page/Console.cpp: Replaced USE(JSC) with ENABLE(JAVASCRIPT_DEBUGGER) guard.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25275
+        This patch snuck in a re-definition of a local.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): Removed re-definition.
+
+2009-04-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix a leak introduced yesterday.  Don't allocate a ScheduledAction
+        if the toString()ing throws an exception.
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+
+2009-04-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25379
+        <rdar://problem/6809460> REGRESSION (r41772): Selecting a bank in American Express Pay Bill fails
+
+        Test: fast/forms/multiple-selected-options-innerHTML.html
+
+        This problem was caused by an inconsistency at when Node::instertedIntoTree() is called.
+        For normal HTML parsing, it is called immediately after an element is inserted, but for
+        innerHTML, it is only called after the whole subtree is inserted into a document.
+
+        It may make sense to harmonize these cases one day, but for now, I only made the minimal
+        changes necessary to fix the bug.
+
+        * html/HTMLSelectElement.cpp: (WebCore::HTMLSelectElement::insertedIntoTree):
+        * html/HTMLSelectElement.h:
+        Recalculate list items when a SELECT element is inserted. OPTION elements cannot decide
+        which one to keep selected themselves, because their logic assumes normal parsing, with
+        insertedIntoTree() called after each element is inserted.
+
+2009-04-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25342
+        Add MessageSource and MessageLevel parameters to the ChromeClient::addMessageToConsole.
+
+        Chromium async/out-of-process version of WebInspector is currently not based on
+        InspectorController. The reason was that we did not want to interfere with
+        the unforking effort, yet wanted to experiment. So we came up with these
+        agents concept that basically mimic InspectorController, but separating 'agent'
+        nature from the 'transport'. Now that InspectorController is unforked, I am
+        planning to bring these concepts into the WebKit land and use what we have in
+        Chromium as a proof of concept / experimental playground.
+
+        * loader/EmptyClients.h: added MessageSource and MessageLevel parameters.
+        (WebCore::EmptyChromeClient::addMessageToConsole): ditto
+        * page/ChromeClient.h: ditto
+        * page/Console.cpp: Used new method signature.
+        (WebCore::Console::addMessage): ditto
+
+2009-04-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25476
+          <rdar://problem/6841919> REGRESSION (r42987): Welcome to Safari 4
+          animation is jittery
+
+        Reverted r42987.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-04-30  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak
+
+        <rdar://problem/3785248> http://www.greekembassy.org/ gets in an infinite reload loop
+        https://bugs.webkit.org/show_bug.cgi?id=21193
+
+        Some websites use for attributes in script elements to specify events that the script 
+        should be run for.  One example is greekembassy.org which has the following in their <head>:
+
+        <script for=window event=onresize>
+            location.reload(false);
+        </script>
+
+        Since we don't support the full for attribute syntax, we would just blissfully ignore the
+        condition and execute the code unconditionally.  This caused breakage on multiple real-world 
+        sites besides greekembassy.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16915 and <rdar://problem/4471751> track adding full 
+        support for the for attribute in scripts.  In the meantime it's best to not execute them
+        unconditionally.
+
+        Test: fast/dom/HTMLScriptElement/script-for-attribute-unexpected-execution.html
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript): After all other checks have
+          passed, only return true if there is no for attribute in the script element.
+        * dom/ScriptElement.h:
+
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::forAttributeValue): Return the attribute value, if any.
+        * html/HTMLScriptElement.h:
+
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::forAttributeValue): Return an empty string (like the other
+          attribute getters do for SVGScriptElement)
+        * svg/SVGScriptElement.h:
+
+2009-04-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        The Qt API exposes a global history patch CSSStyleSelector to make API consumers work again
+
+        https://bugs.webkit.org/show_bug.cgi?id=20952
+
+        The QtWebKit port made the mistake of exposing a global history. This broke
+        with the addition of PageGroup and LinkHash. This needs to be repaired
+        for Qt4.5.
+
+        Add a function to LinkHash.cpp that is resolving a URL. Use this
+        function from within CSSStyleSelector to forward the url to the
+        QWebHistoryInterface API.
+
+        It is sad that there is a path within visitedLinkHash which is now
+        doing a memcpy, it is sad to add a PLATFORM(QT) define to CSSStyleSelector
+        and using QtWebKit types within WebCore is a layering violation as well.
+
+        PageGroup::setShouldTrackVisitedLinks is currently not enabled. For
+        Qt4.6 a second version of the QWebHistoryInterface is going to be
+        added which will fix things up.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState):
+        * platform/LinkHash.cpp:
+        (WebCore::visitedURL):
+        (WebCore::visitedLinkHash):
+        * platform/LinkHash.h:
+
+2009-04-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * platform/graphics/SimpleFontData.cpp: Don't use initCharWidths() for the Qt build.
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit): Instead initialize the average and
+        max char widths from QFontMetrics.
+
+2009-04-30  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreview build fix after r43037.
+
+        Use MarkedArgumentBuffer instead of ArgList.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtConnectionObject::execute):
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25440
+        setTimeout should stringify non-string/non-function first arguments
+
+        Test: fast/dom/Window/setTimeout-string-argument.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        * bindings/js/ScheduledAction.h:
+
+2009-04-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - WebCore part of <rdar://problem/6609509> Select All and then Delete
+          should put Mail editing back into the same state as a new message
+
+        Test: editing/deleting/in-visibly-empty-root.html
+
+        * WebCore.base.exp: Exported VisibleSelection::isAll(bool).
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::isAll): Added. Calls through to
+        VisibleSelection.
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::makeEditableRootEmpty): Added. Removes all children
+        of the root editable element the selection is in, other than a
+        placeholder. Returns true iff it did anything.
+        (WebCore::TypingCommand::deleteKeyPressed): When there is only a single
+        visible position in the root editable element, but it has children other
+        than a placeholder, remove those children.
+        * editing/TypingCommand.h:
+        * editing/VisiblePosition.h:
+        Added a StayInEditableContent enum and a FIXME.
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::isAll): Added. Returns whether the
+        selection encompasses all visible positions, either in the document or
+        in the editable root.
+        * editing/VisibleSelection.h:
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Fix style nit.
+
+        * editing/visible_units.cpp:
+        (WebCore::getLeafBoxesInLogicalOrder):
+
+2009-04-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        For now just drop the deferred layout on the floor, since it causes an infinite hang in mail.  Even
+        trying to schedule a relayout for later leaves you in a state where you hit the needsLayout painting
+        assertions.
+
+        Basically what Mail is doing is crazy, and we can't support it other than to just drop the last layout
+        and not do it (which is basically what was happening before).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setContentsSize):
+        (WebCore::FrameView::needsLayout):
+
+2009-04-29  Douglas Davidson  <ddavidso@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        <rdar://problem/6836921> Mail exhibits issues with text checking, e.g. menu items not always validated correctly
+        
+        Updates to the text checking code to enable text checking even if spellchecking is turned off 
+        and fix an off-by-one error in selection handling.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::markMisspellingsAndBadGrammar):
+        * editing/Editor.h:
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::markMisspellingsAfterTyping):
+
+2009-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clean up ArgList to be a trivial type
+
+        Start using MarkedArgumentBuffer to create argument lists for function calls
+
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::types):
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profiles):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::profiles):
+        (WebCore::JSInspectorController::search):
+        (WebCore::JSInspectorController::databaseTableNames):
+        (WebCore::JSInspectorController::setting):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/objc/WebScriptObject.mm:
+        (getListFromNSArray):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        * bridge/NP_jsobject.cpp:
+        (getListFromVariantArgs):
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.h:
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::getListFromJArray):
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix m_offset uses added while I wasn't looking.
+
+        * editing/visible_units.cpp:
+        (WebCore::logicalStartPositionForLine):
+        (WebCore::logicalEndPositionForLine):
+
+2009-04-29  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24168
+        RTL: Home/End key does not behave correctly in mixed bidi text in RTL document
+
+        Test: editing/selection/home-end.html
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary
+        (WebCore::SelectionController::modifyExtendingBackward): Change calling 
+        startOfLine() to logicalStartOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingBackward): Change calling startOfLine() 
+        to logicalStartOfLine() when granularity is LineBoundary.
+        * editing/visible_units.cpp:
+        (WebCore::getLeafBoxesInLogicalOrder): Added. Reconstruct leaf boxes in logical order.
+        (WebCore::getLogicalStartBoxAndNode): Added.
+        (WebCore::getLogicalEndBoxAndNode): Added.
+        (WebCore::logicalStartPositionForLine): Added. Similar to startPositionForLine.
+        (WebCore::logicalStartOfLine): Added. Similar to startOfLine.
+        (WebCore::logicalEndPositionForLine): Added. Similar to endPositionForLine.
+        (WebCore::inSameLogicalLine): Added.
+        (WebCore::logicalEndOfLine): Added. Similar to endOfLine.
+        * editing/visible_units.h:
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Make m_offset private and change all callers to use deprecatedEditingOffset().
+        https://bugs.webkit.org/show_bug.cgi?id=25472
+
+        Per Darin's suggestion, this was just a simple search replace
+        of .m_offset with .deprecatedEditingOffset().
+
+        There was one change in InsertParagraphSeparatorCommand::doApply to use
+        Position::moveToOffset(0) instead of .m_offset = 0;
+
+        * dom/Position.cpp:
+        (WebCore::Position::rendersInDifferentPosition):
+        (WebCore::Position::leadingWhitespacePosition):
+        * dom/Position.h:
+        (WebCore::Position::deprecatedEditingOffset):
+        (WebCore::Position::moveToOffset):
+        (WebCore::operator==):
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator):
+        * dom/Range.cpp:
+        (WebCore::Range::create):
+        (WebCore::Range::compareBoundaryPoints):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::nodeFullySelected):
+        (WebCore::ApplyStyleCommand::nodeFullyUnselected):
+        (WebCore::ApplyStyleCommand::splitTextAtStartIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextAtEndIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextElementAtStartIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextElementAtEndIfNeeded):
+        (WebCore::ApplyStyleCommand::mergeStartWithPreviousIfIdentical):
+        (WebCore::ApplyStyleCommand::mergeEndWithNextIfIdentical):
+        (WebCore::ApplyStyleCommand::joinChildTextNodes):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNodeAt):
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt):
+        (WebCore::CompositeEditCommand::prepareWhitespaceAtPositionForSplit):
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::updatePositionForNodeRemoval):
+        (WebCore::updatePositionForTextRemoval):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::fixupWhitespace):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setComposition):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::getCompositionSelection):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::performTrivialReplace):
+        (WebCore::InsertTextCommand::input):
+        (WebCore::InsertTextCommand::insertTab):
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::debugRenderer):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::rangeFromLocationAndLength):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::characterAfter):
+        (WebCore::VisiblePosition::debugPosition):
+        (WebCore::makeRange):
+        (WebCore::setStart):
+        (WebCore::setEnd):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::toNormalizedRange):
+        (WebCore::makeSearchRange):
+        (WebCore::VisibleSelection::debugPosition):
+        (WebCore::VisibleSelection::showTreeForThis):
+        * editing/htmlediting.cpp:
+        (WebCore::comparePositions):
+        (WebCore::rangeCompliantEquivalent):
+        * editing/visible_units.cpp:
+        (WebCore::previousBoundary):
+        (WebCore::nextBoundary):
+        (WebCore::startPositionForLine):
+        (WebCore::startOfLine):
+        (WebCore::endPositionForLine):
+        (WebCore::nextLinePosition):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        (WebCore::logicalStartPositionForLine):
+        (WebCore::logicalEndPositionForLine):
+        * page/AccessibilityObject.cpp:
+        (WebCore::updateAXLineStartForVisiblePosition):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::indexForVisiblePosition):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::baseOffset):
+        (WebCore::DOMSelection::extentOffset):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        (visiblePositionForTextMarker):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::indexForVisiblePosition):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeSelection):
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out a patch.
+
+        Revert http://trac.webkit.org/changeset/43019
+
+        New tests failed because I removed the tabs from them
+        when landing (since we avoid tabs in WebKit files).
+        I couldn't tell if the new results were correct with
+        spaces or not.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingBackward):
+        * editing/visible_units.cpp:
+        * editing/visible_units.h:
+
+2009-04-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6828164>, Mail hits the !root->needsLayout() assert because it re-marks the FrameView for layout
+        when the FrameView is resized.  This bug was exposed by the elimination of the separate WebKit layout
+        flag on Mac.  
+        
+        FrameView now defers setNeedsLayouts during size changes.  Once all of the size changes are finished (including re-entrant ones
+        from WebDynamicScrollbarsView and ScrollView::updateScrollbars) we then do a layout if necessary.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::setContentsSize):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::needsLayout):
+        (WebCore::FrameView::setNeedsLayout):
+        * page/FrameView.h:
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out a patch.
+
+        Revert 43020 as it caused accessibility/lists.html to fail
+        and no one is around to tell me if it's a progression or not.
+
+        * page/AccessibilityObject.h:
+        (WebCore::):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValue):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::):
+
+2009-04-29  Sankar Aditya Tanguturi  <sankaraditya@gmail.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Add a new accessibility role for list items. Part of
+        http://bugs.webkit.org/show_id.cgi?id=20013
+
+        Tests: platform/win/accessibility/listitem-role.html
+
+        * page/AccessibilityObject.h:
+        (WebCore::):  Add ListItemRole to accessibilityRole enum.
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValue):Return
+        listItemRole when rendered object is a list item.
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute): Return
+        true for ListItemRole, matching firefox.
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::): Map ListItemRole with NSAccessibilityGroupRole in
+        MAC.
+
+2009-04-29  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24168
+        RTL: Home/End key does not behave correctly in mixed bidi text in RTL document
+
+        Test: editing/selection/home-end.html
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary
+        (WebCore::SelectionController::modifyExtendingBackward): Change calling 
+        startOfLine() to logicalStartOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingBackward): Change calling startOfLine() 
+        to logicalStartOfLine() when granularity is LineBoundary.
+        * editing/visible_units.cpp:
+        (WebCore::getLeafBoxesInLogicalOrder): Added. Reconstruct leaf boxes in logical order.
+        (WebCore::getLogicalStartBoxAndNode): Added.
+        (WebCore::getLogicalEndBoxAndNode): Added.
+        (WebCore::logicalStartPositionForLine): Added. Similar to startPositionForLine.
+        (WebCore::logicalStartOfLine): Added. Similar to startOfLine.
+        (WebCore::logicalEndPositionForLine): Added. Similar to endPositionForLine.
+        (WebCore::inSameLogicalLine): Added.
+        (WebCore::logicalEndOfLine): Added. Similar to endOfLine.
+        * editing/visible_units.h:
+
+2009-04-29  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Eric Seidel.
+
+        Update location while page is loading.
+        https://bugs.webkit.org/show_bug.cgi?id=21597
+
+        Tested by:
+        - fast/dom/location-new-window-no-crash
+        - fast/dom/Window/window-open-pending-url
+
+        * page/Location.cpp:
+
+2009-04-29  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add Android port files to WebCore/platform.
+        https://bugs.webkit.org/show_bug.cgi?id=23296
+
+        * platform/android: Added.
+        * platform/android/ClipboardAndroid.cpp: Added.
+        * platform/android/ClipboardAndroid.h: Added.
+
+2009-04-29  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add Android-specific files to the WebCore/page directory.
+        https://bugs.webkit.org/show_bug.cgi?id=23295
+
+        * page/android: Added.
+        * page/android/DragControllerAndroid.cpp: Added.
+        * page/android/EventHandlerAndroid.cpp: Added.
+        * page/android/InspectorControllerAndroid.cpp: Added.
+
+2009-04-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Extract PageGroupLoadDeferrer from Chrome.cpp
+
+        * GNUmakefile.am: added PageGroupLoadDeferrer
+        * WebCore.pro: ditto
+        * WebCore.scons: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * WebCoreSources.bkl: ditto
+        * page/Chrome.cpp: PageGroupLoadDeferrer impl moved to a separate class.
+        * page/PageGroupLoadDeferrer.cpp: Added.
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        * page/PageGroupLoadDeferrer.h: Added.
+
+2009-04-24  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Make textarea and text input metrics more closely match IEs.
+
+        This involves:
+        -set text input width to size*avgCharWidth + maxCharWidth - avgCharWidth
+        -set textarea width to cols*avgCharWidth
+        -Make default CSS match IEs
+        -Correctly initializing m_avgCharWidth and m_maxCharWidth for each platform and SVG.
+
+        Those values for textarea and inputs were derived by doing a ton of manual
+        testing of IE's width values for various textareas and fonts. On Windows we match
+        IE exactly except for a couple fonts of the ~12 tested.
+
+        To get the average and max character width of a font, we do the following
+        for each platform:
+        -Win: TextMetrics expose avgCharWidth and maxCharWidth
+        -SVG: avgCharWidth = width of an '0', fallback on width of a space glyph, then m_xHeight
+            maxCharWidth = width of a 'W' for roman fonts, fallback on m_ascent
+        -Linux: avgCharWidth = width of an '0', fallback on m_xHeight
+            maxCharWidth = max of avgCharWidth and m_ascent
+        -Mac: Calculate the avgCharWidth and grab the maxCharWidth off the font.
+            If either one is non-positive, then calculate the value using the Linux approach.
+
+        Tests: fast/forms/text-control-intrinsic-widths.html
+               fast/forms/textarea-metrics.html
+               svg/custom/svg-fonts-in-text-controls.html
+
+        * css/html4.css:
+        * css/themeWin.css:
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        (WebCore::SimpleFontData::initCharWidths):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::maxCharWidth):
+        (WebCore::SimpleFontData::avgCharWidth):
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::initGDIFont):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::calcPrefWidths):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+
+2009-04-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass):  Added CSS_INITIAL to the switch statement, and changed to use the WebCore
+          type and not the binding type.
+
+2009-04-29  John Abd-El-Malek  <jam@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Reverted my previous change to add resetChromiumPluginCache().
+        https://bugs.webkit.org/show_bug.cgi?id=25318
+
+        * plugins/chromium/PluginDataChromium.cpp:
+
+2009-04-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6573742> - Problem dragging standalone images from Safari to Mail
+
+        Roll out trac.webkit.org/changeset/35867 which fixed <rdar://problem/6153432>
+
+        Cloned <rdar://problem/6153432> to <rdar://problem/6839881> to find a better fix for that Tiger Mail bug.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): Remove the preload referenced check.
+
+2009-04-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25430
+
+        Provide style sheet for UI controls of media elements for Chromium port.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::extraMediaControlsStyleSheet):
+
+2009-04-29  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Expose sudden termination to Chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=25457
+
+        * platform/SuddenTermination.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/SuddenTerminationChromium.cpp: Added.
+        (WebCore::disableSuddenTermination):
+        (WebCore::enableSuddenTermination):
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unused EventListeners.
+
+        * page/DOMWindow.idl:
+
+2009-04-29  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reveal current execution line once SourceFrame content is loaded. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=25448
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+
+2009-04-29  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Fraser.
+
+        [Qt] Initialize GraphicsContext's and ImageBuffer's QPainter to match
+        the default values of canvas attributes.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBufferData::ImageBufferData):
+
+2009-04-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::findMethodIndex): Removed exec param from at() call.
+        (JSC::Bindings::QtRuntimeConnectionMethod::call): Ditto.
+
+2009-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Beth Dakin.
+        
+        Missed one.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Beth Dakin.
+        
+        Removed scaffolding supporting dynamically converting between 32bit and
+        64bit value representations. 
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::clearData):
+        (WebCore::JSClipboard::getData):
+        (WebCore::JSClipboard::setData):
+        (WebCore::JSClipboard::setDragImage):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::hasItem):
+        (WebCore::JSDOMApplicationCache::add):
+        (WebCore::JSDOMApplicationCache::remove):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMStringListCustom.cpp:
+        (WebCore::JSDOMStringList::item):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::JSDOMWindow::postMessage):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::JSDatabase::transaction):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttribute):
+        (WebCore::JSElement::setAttributeNode):
+        (WebCore::JSElement::setAttributeNS):
+        (WebCore::JSElement::setAttributeNodeNS):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::documentWrite):
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::setSelectionRange):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::add):
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        (WebCore::JSHTMLSelectElement::remove):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::highlightDOMNode):
+        (WebCore::JSInspectorController::addResourceSourceToFrame):
+        (WebCore::JSInspectorController::addSourceToFrame):
+        (WebCore::JSInspectorController::getResourceDocumentNode):
+        (WebCore::JSInspectorController::search):
+        (WebCore::JSInspectorController::databaseTableNames):
+        (WebCore::JSInspectorController::setting):
+        (WebCore::JSInspectorController::setSetting):
+        (WebCore::JSInspectorController::wrapCallback):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::startConversation):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::insertBefore):
+        (WebCore::JSNode::replaceChild):
+        (WebCore::JSNode::removeChild):
+        (WebCore::JSNode::appendChild):
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::acceptNode):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSSVGLengthCustom.cpp:
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::JSSVGPointList::initialize):
+        (WebCore::JSSVGPointList::getItem):
+        (WebCore::JSSVGPointList::insertItemBefore):
+        (WebCore::JSSVGPointList::replaceItem):
+        (WebCore::JSSVGPointList::removeItem):
+        (WebCore::JSSVGPointList::appendItem):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::JSSVGTransformList::initialize):
+        (WebCore::JSSVGTransformList::getItem):
+        (WebCore::JSSVGTransformList::insertItemBefore):
+        (WebCore::JSSVGTransformList::replaceItem):
+        (WebCore::JSSVGTransformList::removeItem):
+        (WebCore::JSSVGTransformList::appendItem):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::constructWebKitCSSMatrix):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::constructWebKitPoint):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::importScripts):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
+        (WebCore::JSXMLHttpRequest::setRequestHeader):
+        (WebCore::JSXMLHttpRequest::send):
+        (WebCore::JSXMLHttpRequest::getResponseHeader):
+        (WebCore::JSXMLHttpRequest::overrideMimeType):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        (WebCore::JSXSLTProcessor::setParameter):
+        (WebCore::JSXSLTProcessor::getParameter):
+        (WebCore::JSXSLTProcessor::removeParameter):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/js/ScriptCallFrame.h:
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+
+2009-04-28  David Carson  <dacarson@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Restore alignment to device pixel boundaries.
+        https://bugs.webkit.org/show_bug.cgi?id=25458
+
+        Adjust the adjusted destination rect to be device pixel aligned.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-04-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Move unimplemented captureEvents and releaseEvents from JSDOMWindow
+        to DOMWindow.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::captureEvents):
+        (WebCore::DOMWindow::releaseEvents):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-04-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25420
+        <rdar://problem/6829570> REGRESSION: XMLHttpRequest allows loading from another origin
+
+        Test: http/tests/xmlhttprequest/detaching-frame-2.html
+
+        This was caused by faulty DOMWindow::document(), which could return a new document from
+        the window's frame after navigation.
+
+        * bindings/js/JSDOMWindowCustom.h: (WebCore::JSDOMWindowBase::allowsAccessFromPrivate):
+        Removed an obsolete check that allowed access when document was null. Contrary to what a
+        comment said, that can happen for a window that is no longer in frame, not to one whose
+        document is not constructed yet.
+
+        * bindings/js/JSXMLHttpRequestConstructor.cpp: (WebCore::constructXMLHttpRequest): Bail
+        out if context was not found. This currently happens due to a shortcoming in
+        DOMWindow::document() - when it is fixed, the XMLHttpRequest object in included regression
+        test will be constructed successfully, but won't be sent, because its context will be
+        frameless.
+
+        * page/DOMWindow.cpp: (WebCore::DOMWindow::document): Check that the window in frame hasn't
+        been replaced yet. Added FIXME comments about how this may be better fixed in the future.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::document):
+        (WebCore::constructAudio):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::document):
+        (WebCore::constructImage):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::construct):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::document):
+        (WebCore::constructHTMLOptionElement):
+        Make matching changes to other constructors that hold a reference to global object.
+
+2009-04-28  Kevin Ollivier <kevino@theolliviers.com>
+
+        wxMSW build fix. Switch JSCore build back to static.
+
+        * config.h:
+
+2009-04-28  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6834830>
+
+        Make sure we cover the two possible values reported by event.total that are playback engine
+        specific.
+
+        * media/progress-event-total-expected.txt: Match the new test.
+        * media/progress-event-total.html: Test the two values.
+
+2009-04-28  Timothy Hatcher  <timothy@apple.com>
+
+        Rename -[DOMRange lineBoxRects] to -[DOMRange textRects] and change how it
+        collects the individual rects, making sure to only include RenderText.
+
+        <rdar://problem/6810061>
+
+        Reviewed by Sam Weinig.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode textRects]): Added. Make a Range and call textRects.
+        (-[DOMNode lineBoxRects]): Call textRects method.
+        (-[DOMRange textRects]): Call Range::textRects.
+        (-[DOMRange lineBoxRects]): Call textRects method.
+        * bindings/objc/DOMPrivate.h: Add the new methods and a comment
+        about lineBoxRects being deprecated.
+        * dom/Range.cpp:
+        (WebCore::Range::boundingBox): Call textRects (renamed from addLineBoxRects).
+        (WebCore::Range::textRects): Renamed from addLineBoxRects. Iterate over the
+        nodes instead of the RenderObjects to correctly account for offsets. Also
+        only call absoluteRectsForRange on RenderText.
+        * dom/Range.h: Renamed addLineBoxRects to textRects.
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionTextRects): Call textRects (renamed from addLineBoxRects).
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteRectsForRange): Remove if conditions that made this
+        function very specific for the lineBoxRects API. These functions are still used
+        by the InspectorController, and this change improves what the Inspector shows.
+        (WebCore::RenderObject::absoluteQuadsForRange): Ditto.
+
+2009-04-28  Timothy Hatcher  <timothy@apple.com>
+
+        Remove the topLevel boolean argument from absolute{Rects,Quads}.
+        This argument was default to true and no one ever passed false.
+
+        Reviewed by Sam Weinig.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::absoluteRects):
+        (WebCore::RenderBlock::absoluteQuads):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::absoluteRects):
+        (WebCore::RenderBox::absoluteQuads):
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::absoluteRects):
+        (WebCore::RenderObject::absoluteQuads):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::absoluteRects):
+        (WebCore::RenderSVGHiddenContainer::absoluteQuads):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::absoluteRects):
+        (WebCore::RenderSVGImage::absoluteQuads):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::absoluteRects):
+        (WebCore::RenderSVGInlineText::absoluteQuads):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::absoluteRects):
+        (WebCore::RenderSVGModelObject::absoluteQuads):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGTSpan.cpp:
+        (WebCore::RenderSVGTSpan::absoluteRects):
+        (WebCore::RenderSVGTSpan::absoluteQuads):
+        * rendering/RenderSVGTSpan.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::absoluteQuads):
+        * rendering/RenderSVGTextPath.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteRects):
+        * rendering/RenderText.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::absoluteRects):
+        (WebCore::RenderView::absoluteQuads):
+        * rendering/RenderView.h:
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6794691> Media documents and <video controls> never show controls on Windows
+
+        RenderThemeWin doesn't implement the media element controller rendering methods, so media
+        controls stopped rendering when we switched from RenderThemeSafari. Rather than having copies
+        of the code in both places, the logic is in a new class that is called from both.
+
+        * WebCore.vcproj/WebCore.vcproj: Add RenderMediaControls.cpp.
+
+        * rendering/RenderMediaControls.cpp: Added.
+        (WebCore::determineState): Translate renderer state to ThemeControlState.
+        (WebCore::RenderMediaControls::adjustMediaSliderThumbSize): Adjust slider thumb.
+        (WebCore::parentMediaElement): Return the HTMLMediaElement parent of a controller element.
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Paint a media controller part.
+        * rendering/RenderMediaControls.h: Added.
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintSliderTrack): Remove the MediaSliderPart case, it is never
+        called for the media slider.
+        (WebCore::RenderThemeSafari::adjustSliderThumbSize): Call RenderMediaControls function.
+        (WebCore::RenderThemeSafari::paintMediaFullscreenButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSeekBackButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSeekForwardButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSliderThumb): Ditto.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::adjustSliderThumbSize): Ditto.
+        (WebCore::RenderThemeWin::paintMediaFullscreenButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSeekBackButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSeekForwardButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSliderThumb): Ditto.
+        * rendering/RenderThemeWin.h:
+
+2009-04-28  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/6419515> REGRESSION (r31037): Positioned 
+        images with % height are collapsed when printing
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight): Make sure we don't ignore 
+        printing here!
+
+2009-04-28  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6617298> Typing delete on an unquoted blank line unquotes the preceding, quoted blank line
+
+        Test: editing/deleting/type-delete-after-quote.html
+
+        When a selection is deleted that contains a whole number paragraphs plus a line break, we refrain from merging paragraphs after the delete,
+        since it is unclear to most users that such a selection actually ends at the start of the next paragraph.  However, when a user hits delete 
+        with a caret selection, they actually do expect the start of that paragraph to be merged into the paragraph before it.  We can tell that 
+        we're in this state because the TypingCommand creates the selection to delete but it doesn't change the endingSelection.  So we can tell
+        that if we started with a caret selection, then we're not in this special case where we have to protect the user from unexpected behavior 
+        from deleting a range they selected.
+
+        * editing/DeleteSelectionCommand.cpp: (WebCore::DeleteSelectionCommand::initializePositionData):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add missing header to file list.
+
+        * GNUmakefile.am:
+
+2009-04-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix foreignObject transform order
+        https://bugs.webkit.org/show_bug.cgi?id=25433
+
+        Transforms were being applied in the wrong order.
+        When mapping from local to parent, first apply the viewport transform
+        then map from the viewport box to the parent box.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::localToParentTransform):
+
+2009-04-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Simplify nodeAtPoint for SVG
+        https://bugs.webkit.org/show_bug.cgi?id=25432
+
+        Added a new nodeAtFloatPoint method which takes a FloatPoint
+        instead of the *super confusing* x/y tx/ty pairs that HTML uses.
+        Mostly this is just lots of minus-lines as the new code is *much* simpler.
+
+        I made all the SVG renderers use the new nodeAtFloatPoint and ASSERT_NOT_REACHED
+        for the nodeAtPoint HTML/CSS int x/y version.
+
+        Eventually the rest of CSS/HTML render objects will follow suit
+        and move to nodeAtFloatPoint (possibly renamed back to nodeAtPoint), but changing them
+        over was well outside the scope of this change.
+
+        SVG hit testing is not actually floating point precise yet, since its still
+        passed in an integer x/y.  Certain transform hit-test edge cases are likely fixed
+        by moving to FloatPoint here, but I didn't try to find one.
+
+        This should not cause functional changes for common-case hit testing, thus
+        no tests changed, nor should new tests be needed.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::translationForAttributes):
+        (WebCore::RenderForeignObject::paint):
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        (WebCore::RenderForeignObject::localToParentTransform):
+        (WebCore::RenderForeignObject::layout):
+        (WebCore::RenderForeignObject::nodeAtFloatPoint):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::nodeAtFloatPoint):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::nodeAtFloatPoint):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::nodeAtFloatPoint):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::pointIsInsideViewportClip):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::nodeAtFloatPoint):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        (WebCore::RenderSVGImage::nodeAtFloatPoint):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::nodeAtFloatPoint):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::nodeAtFloatPoint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::nodeAtFloatPoint):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip):
+        * rendering/RenderSVGViewportContainer.h:
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+        - fix the Tiger build
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::cacheMovieScale):
+
+2009-04-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Consolidate ScheduleAction creation into ScheduledAction::create.
+        Autogenerate JSWorkerContext.clearTimeout and clearInterval.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScheduledAction.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::DOMWindow::setTimeout):
+        (WebCore::DOMWindow::clearTimeout):
+        (WebCore::DOMWindow::setInterval):
+        (WebCore::DOMWindow::clearInterval):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+
+2009-04-28  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6643219> Crashes after moving nodes between documents with Safari 4 Beta installed
+
+        When moving Nodes between documents we weren't properly updating style declarations.  Certain operations, such
+        as creating webarchives, would tickle this bug.
+
+        Tests: webarchive/adopt-attribute-styled-body-webarchive.html
+               webarchive/adopt-attribute-styled-node-webarchive.html
+               webarchive/adopt-inline-styled-node-webarchive.html
+
+        * dom/Node.cpp:  Add a debug-only mechanism to insure that anyone who overrides (did/will)MoveToNewOwnerDocument
+          calls their parent-class implementation after they've done their own work.
+        (WebCore::setWillMoveToNewOwnerDocumentWasCalled): 
+        (WebCore::setDidMoveToNewOwnerDocumentWasCalled):
+        (WebCore::Node::setDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged): Add a comment explaining why we don't need to walk the nameAttrMap
+          to update style declarations.
+        (WebCore::StyledElement::didMoveToNewOwnerDocument): Update the parent pointer for the inline style declaration.
+        * dom/StyledElement.h:
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::didMoveToNewOwnerDocument): Update the parent pointer for the link declaration.
+        * html/HTMLBodyElement.h:
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+         Reviewed by Darin Adler.
+        
+        <rdar://problem/6834876> Don't use BlockExceptions macros until QTKit supports 
+        QTMoviePreferredTransformAttribute
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::cacheMovieScale): use @try and @catch instead of 
+        BEGIN_BLOCK_OBJC_EXCEPTIONS and END_BLOCK_OBJC_EXCEPTIONS for builds of QTKit 
+        that throw an exception on QTMovieCurrentSizeAttribute but don't support 
+        QTMoviePreferredTransformAttribute
+
+2009-04-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText): Streamline code path to avoid a bit of reference count
+        churn and remove a strange unneeeded PassRefPtr typecast. Also added a comment.
+        (WebCore::RenderText::setTextInternal): Ditto.
+
+2009-04-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Simplify how SVG containers paint
+        https://bugs.webkit.org/show_bug.cgi?id=25431
+
+        Moved filterBoundingBox() from RenderSVGModelObject to SVGRenderSupport to share with other classes.
+        Gave RenderSVGText a modern clippedOverflowRectForRepaint and computeRectForRepaint.
+        RenderSVGText now applies transforms at paint() time instead of during chunk draw time
+        this should be much more efficient.
+
+        Fixed the order in which RenderSVGViewportContainer applied
+        transforms and clips.  We now clip to the viewport first and apply
+        all transforms at once.  Also since the viewport logic is now only
+        inside RenderSVGViewportContainer (instead of inside RenderSVGContainer)
+        we always know we have a viewport.  We now use only viewportSize instead of
+        viewport() since RenderSVGViewportContainers can't have x/y offsets.
+
+        We now correctly transform the PaintInfo::rect (damage rect) when applying transforms.
+        This allowed us to apply the transform during text paint() instead of at chunk paint
+        time. Previously we had to apply the transform during chunk paint time because
+        RenderBlock (superclass of RenderSVGBlock) would check intersection with the damageRect
+        before telling any of the inlines to draw.  Now that we adjust the damage rect correctly
+        we pass the intersection check correctly!  (This probably fixed some <text> redraw bugs
+        but since I still have a bunch of those to fix, I've not tried to write additional tests
+        to cover these potential fixes yet.)
+
+        SVGRootInlineBox no longer needs to deal with transforms at chunk paint time, yay!
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::applyViewportClip):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        (WebCore::RenderSVGImage::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.cpp:
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::selfWillPaint):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::viewportSize):
+        (WebCore::RenderSVGRoot::calcViewport):
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform):
+        (WebCore::RenderSVGRoot::parentOriginToBorderBox):
+        (WebCore::RenderSVGRoot::borderOriginToContentBox):
+        (WebCore::RenderSVGRoot::localToRepaintContainerTransform):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        (WebCore::RenderSVGText::paint):
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::localToParentTransform):
+        (WebCore::RenderSVGText::localTransform):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::applyViewportClip):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::filterBoundingBoxForRenderer):
+        (WebCore::applyTransformToPaintInfo):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkStartCallback):
+        (WebCore::SVGRootInlineBox::paint):
+
+2009-04-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25453: AX: fall back to PLACEHOLDER attr if form element is not labeled
+        https://bugs.webkit.org/show_bug.cgi?id=25453
+
+        Test: accessibility/placeholder.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::title):
+
+2009-04-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25452: AX: Don't create addition space AXStaticText element for every bold or link tag
+        https://bugs.webkit.org/show_bug.cgi?id=25452
+
+        Test: accessibility/ignore-spacer-elements.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2009-04-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Work around <rdar://problem/6833240> by relying on static initialization to zero the entire struct.
+        This removes the need for us to explicitly initialize all of the members, which have a tendency
+        to change in meaning and number between versions of libxml2.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::):
+        (WebCore::sharedXHTMLEntity):
+        (WebCore::getXHTMLEntity):
+
+2009-04-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix linker warning by specifying /NODEFAULTLIB:LIBCMT for QTMovieWin.
+        
+        Reviewed by Mark Rowe.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+
+2009-04-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25449: AX: Respect the alt tag of ARIA button as AXDescription
+        https://bugs.webkit.org/show_bug.cgi?id=25449
+
+        Test: accessibility/img-aria-button-alt-tag.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+
+2009-04-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - formatting cleanup
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight): Corrected indentation and added braces
+        around a multi-line "else" clause.
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben
+        
+        <rdar://problem/6769968> media/video-size-intrinsic-scale.html fails on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=25094
+        
+        Display movies saved with a non-identity matrix at the correct size.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::QTMovieWinPrivate): Initialize m_widthScaleFactor and m_heightScaleFactor.
+        (QTMovieWinPrivate::cacheMovieScale): New, calculate difference between initial
+        size and natural size so naturalSize() accounts for non-identity movie matrix.
+        (QTMovieWinPrivate::task):Call cacheMovieScale when load state reaches
+        kMovieLoadStateLoaded for the first time. kMovieLoadState -> QTMovieLoadState.
+        (QTMovieWinPrivate::drawingComplete): kMovieLoadState -> QTMovieLoadState.
+        (QTMovieWinPrivate::createGWorld): Don't bother creating gworld until load state reaches
+        kMovieLoadStateLoaded because we do not try to draw it before that point.
+        (QTMovieWinPrivate::setSize): Do not change movie box before reaching kMovieLoadStateLoaded
+        because we need to get the movie's initial size in cacheMovieScale.
+        (QTMovieWin::getNaturalSize): Multiply width and height by initial scale.
+
+2009-04-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Move timer code from JSDOMWindow to DOMWindow. clearTimeout and
+        clearInterval can now be autogenerated.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createScheduledAction):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setTimeout):
+        (WebCore::DOMWindow::clearTimeout):
+        (WebCore::DOMWindow::setInterval):
+        (WebCore::DOMWindow::clearInterval):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-04-28  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Small optimization, don't get the widget's handle twice in one method.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25446
+
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        (WebCore::Widget::invalidateRect):
+        (WebCore::Widget::paint):
+
+2009-04-28  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        ScrollView copy and paste typo fix.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25445
+
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformSetScrollbarModes):
+
+2009-04-28  John Sullivan  <sullivan@apple.com>
+
+        <rdar://problem/6820221> REGRESSION: 2-byte character names of images are displayed as %-encoded ASCII
+
+        Reviewed by Adam Roben
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageTokenizer::finish):
+        decode the filename before processing it as part of the image name that's passed to the client
+
+2009-04-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        - fix initialization order to match declaration order to fix release build
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Justin Garcia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16135
+        [GTK] Support caret browsing
+
+        Based on a patch by Alp Toker.
+
+        Implement basic support for caret browsing, active only when the
+        corresponding setting is enabled.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        (WebCore::clearSelectionIfNeeded):
+        (WebCore::FocusController::setFocusedNode):
+        * page/Frame.cpp:
+        (WebCore::Frame::setFocusedNodeIfNeeded):
+        (WebCore::Frame::setSelectionFromNone):
+        (WebCore::Frame::respondToChangedSelection):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintCaret):
+
+2009-04-27  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a compile breakage.
+        <https://bugs.webkit.org/show_bug.cgi?id=25384>
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-04-27  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6822344> Use of QTMovieCurrentSizeAttribute generates exception and will crash
+
+        QTMovieCurrentSizeAttribute generates an exception with some versions of QTKit, so calculate a 
+        multiplier to scale from natural size to current size when a movie is opened and use that to 
+        return the correct value from the naturalSize() method.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_scaleFactor.
+        (WebCore::MediaPlayerPrivate::naturalSize): Return naturalSize transformed by initial scale.
+        (WebCore::MediaPlayerPrivate::cacheMovieScale): New, calculate difference between initial
+        size and natural size so naturalSize() accounts for non-identity movie matrix.
+        (WebCore::MediaPlayerPrivate::updateStates): Call cacheMovieScale when load state reaches
+        QTMovieLoadStateLoaded for the first time.
+
+2009-04-27  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6709057> REGRESSION (4PB-TOT): http://www.winway.com/main3/support/faq.aspx selector doesn't look right or work
+
+        The problem here is that we had a self-painting layer nested inside 
+        a non-self-painting layer. We ended up ignoring the self-painting 
+        layer both during painting and hit-testing. This patch corrects 
+        that. 
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-04-27  Ada Chan  <adachan@apple.com>
+
+        If it has been set to allow any HTTPS certificates for this host, set 
+        kCFStreamSSLAllowsExpiredCertificates to true to allow expired 
+        certificate, and set kCFStreamSSLValidatesCertificateChain false to skip
+        certificate chain validation. (<rdar://problem/6382059>)
+
+        Reviewed by John Sullivan.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::makeFinalRequest):
+
+2009-04-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson
+        
+        <rdar://problem/6822225> Full page zooming of <video> element in the browser window doesn't work well
+        
+        Fix a 'size changed' notification thrash that caused standalone video elements
+        to continually resize after full page zooming, by using the movie's natual size (which is independent
+        of zooming), rather than its current size (which is not).
+        
+        Note that this regresses <https://bugs.webkit.org/show_bug.cgi?id=25029>, so we have to
+        disable the media/video-size-intrinsic-scale.html test. However, we have to stop using
+        QTMovieCurrentSizeAttribute anyway; this will be addressed, and the test re-enabled via
+        <rdar://problem/6822344>.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::naturalSize):
+
+2009-04-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6642221> REGRESSION: With the Movie widget, movie trailer fails to
+        load if movie had been previously viewed
+        
+        Fix the Dashboard quirk for display:none plug-ins by moving the code from HTMLObjectElement
+        to HTMLEmebedElement. It has to be in HTMLEmbedElement because the content we care about uses <embed>.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::rendererIsNeeded):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::rendererIsNeeded):
+
+2009-04-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Move more window event related code into DOMWindow.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::setWindowAttributeEventListener):
+        (WebCore::Document::dispatchWindowEvent):
+        (WebCore::Document::dispatchLoadEvent):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        * dom/Element.h:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
+        (WebCore::DOMWindow::postMessageTimerFired):
+        (WebCore::DOMWindow::dispatchEvent):
+        (WebCore::DOMWindow::dispatchEventWithDocumentAsTarget):
+        (WebCore::DOMWindow::dispatchLoadEvent):
+        (WebCore::DOMWindow::dispatchUnloadEvent):
+        (WebCore::DOMWindow::dispatchBeforeUnloadEvent):
+        * page/DOMWindow.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+
+2009-04-27  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Implement the editing mechanisms and add context menu items for
+        <rdar://problem/6724106> WebViews need to implement text checking
+
+        Reviewed by Justin Garcia.
+
+        * editing/Editor.cpp:
+        * editing/Editor.h:
+        * editing/TypingCommand.cpp:
+        * loader/EmptyClients.h:
+        * page/ContextMenuController.cpp:
+        * page/EditorClient.h:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/ContextMenu.cpp:
+        * platform/ContextMenuItem.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+
+2009-04-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6772944> REGRESSION (r42223): PLT 2% slower, i-Bench 3% slower
+
+        Be slightly less eager in collecting after page close/navigation by increasing
+        the time before collection from 0 seconds to .5 seconds.
+
+        3% speedup on the PLT.
+
+        * bindings/js/GCController.cpp:
+        (WebCore::GCController::garbageCollectSoon):
+
+2009-04-27  David Kilzer  <ddkilzer@apple.com>
+
+        Consolidate runtime application checks for Apple Mail and Safari
+
+        Reviewed by Mark Rowe and Darin Adler.
+
+        * WebCore.base.exp: Added exports.
+        * WebCore.xcodeproj/project.pbxproj: Added
+        RuntimeApplicationChecks.{h|mm} source files to the project.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+        Removed local checkedSafari and isSafari variables and switched
+        to use applicationIsSafari().
+        * platform/mac/RuntimeApplicationChecks.h: Added.
+        * platform/mac/RuntimeApplicationChecks.mm: Added.
+        (WebCore::applicationIsAppleMail): Runtime application check for
+        Apple Mail.
+        (WebCore::applicationIsSafari): Runtime application check for
+        Safari.
+
+2009-04-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25374: AX: No AXValue change sent when text is auto-inserted
+        https://bugs.webkit.org/show_bug.cgi?id=25374
+
+        First patch caused some regression tests to fail. 
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-04-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Cover more WebCore role -> ATK role conversions.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Do not call ATK setters in the getters, just return the
+        value. Among other things calling the setter will emit the notify
+        signal, which is wrong.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Implement AtkImage interface.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed debug build fix.
+
+        * platform/gtk/gtk2drawing.c:
+        (moz_gtk_toggle_paint):
+
+2009-04-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25382
+        Remove direct reference to CallFrame.h include to pacify Win build.
+
+        * bindings/js/JSDOMBinding.h: Removed ScriptState.h include.
+        * bindings/js/ScriptState.h: Replaced CallFrame.h with JSDOMBinding.h
+
+2009-04-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25374: AX: No AXValue change sent when text is auto-inserted
+        https://bugs.webkit.org/show_bug.cgi?id=25374
+
+        When an input's text value is changed through the DOM, no AXValueChange notification is being sent.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-04-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25382
+        Move scriptStateFromNode to ScriptState.
+
+        * bindings/js/JSDOMBinding.cpp: Moved scriptStateFromNode to ScriptState.
+        * bindings/js/JSDOMBinding.h: Ditto.
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode): Added.
+        * bindings/js/ScriptState.h: Ditto.
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromNode): Added.
+        * bindings/v8/ScriptState.h: Ditto.
+        * dom/NodeFilter.h: Removed JSDOMBinding header include.
+        * dom/NodeIterator.h: Ditto.
+        * dom/TreeWalker.h: Ditto.
+
+2009-04-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25428: 5 crashes in DumpRenderTree at com.apple.WebCore • -[AccessibilityObjectWrapper accessibilityAttributeValue:] + 830
+        https://bugs.webkit.org/show_bug.cgi?id=25428
+
+        When marking children as changed in accessibility, we cannot rely on the accessibility parent chain existing.
+        Instead, the render chain needs to be consulted.
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+
+2009-04-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25399
+        <rdar://problem/6633943> REGRESSION: Many crashes reported accessing Lexis/Nexis database,
+        beneath WebCore::Cache::evict
+
+        The crash happened because a cached resource handle was removed from a document's cached
+        resources map twice recursively, so a destructor was called for a value in a deleted bucket.
+        The first call was from Cache::evict, and when destroying CachedResourceHandle destroyed
+        CachedResource, DocLoader::removeCachedResource() was called again, with HashMap being in
+        an inconsistent state.
+
+        I couldn't fully reconstruct the loading sequence to make a test.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource): Assert that the resource being revalidated is in cache
+        (it makes no sense to revalidate one that isn't).
+        (WebCore::Cache::evict): Don't remove the resource from document's map. Removing a resource
+        from the cache in no way implies that documents no longer use the old version. This fixes the
+        crash, and also fixes many cases of resource content being unavailable in Web Inspector.
+
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::setInCache): When bringing a revalidated resource back to cache,
+        reset m_isBeingRevalidated to maintain the invariant of resources being revalidated never
+        being in cache. This fixes another assertion I saw on LexisNexis search: in rare cases,
+        switchClientsToRevalidatedResource() results in the same resource being requested again,
+        but we were only enforcing CachedResource invariants after calling this function.
+        (WebCore::CachedResource::unregisterHandle): Assert that the counter doesn't underflow.
+
+        * loader/DocLoader.cpp: (WebCore::DocLoader::removeCachedResource): Assert that the passed
+        resource is removed, not some other resource that happens to have the same URL (this used to
+        fail on LexisNexis search before this patch).
+
+        * loader/ImageDocument.cpp: (WebCore::ImageTokenizer::write): Replaced ASSERT_NOT_REACHED
+        with notImplemented(). This method can be legally called via document.write(), and should
+        work. LexisNexis takes this code path, but apparently has a fallback for Safari, so it
+        doesn't affect site functionality.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::clearResourceToRevalidate): Don't assert that m_resourceToRevalidate
+        is being revalidated - this may no longer be true, because we now reset this member in
+        CachedResource::setInCache().
+
+2009-04-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - make BidiContext a RefCounted class, starting with a refcount of 1,
+          and share the root BidiContexts.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawBidiText): Use BidiContext::create().
+        * platform/text/BidiContext.cpp:
+        (WebCore::BidiContext::create): Added. For the four "root" contexts,
+        returns a reference to a shared static BidiContext.
+        * platform/text/BidiContext.h:
+        (WebCore::BidiContext::BidiContext):
+        * platform/text/BidiResolver.h:
+        (WebCore::::commitExplicitEmbedding): Use BidiContext::create().
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::determineStartPosition): Ditto.
+
+2009-04-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Build fix for r42893: change GDK_exclaim to GDK_exclam
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-04-27  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Xan Lopez.
+
+        Fix wrong key code conversion.
+
+        Missing conversion for GDK_exlaim ('!').
+        Parens are opposite: GDK_parenleft is open paren '('
+        and GDK_parenright is close paren ')'.
+        https://bugs.webkit.org/show_bug.cgi?id=25367
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-04-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] gtkdrawing update
+        https://bugs.webkit.org/show_bug.cgi?id=25408
+
+        Update to the 25 Apr 2009 version of gtk2drawing.c and
+        gtkdrawing.h from Mozilla (http://hg.mozilla.org/mozilla-central)
+
+        * platform/gtk/gtk2drawing.c:
+        (setup_widget_prototype):
+        (moz_gtk_get_combo_box_entry_arrow):
+        (ensure_toolbar_widget):
+        (ensure_tree_header_cell_widget):
+        (moz_gtk_init):
+        (moz_gtk_button_get_inner_border):
+        (moz_gtk_toggle_paint):
+        (moz_gtk_caret_paint):
+        (moz_gtk_entry_paint):
+        (moz_gtk_tree_header_cell_paint):
+        (moz_gtk_combo_box_paint):
+        (moz_gtk_toolbar_separator_paint):
+        (moz_gtk_menu_separator_paint):
+        (moz_gtk_get_widget_border):
+        (moz_gtk_get_tab_scroll_arrow_size):
+        (moz_gtk_get_toolbar_separator_width):
+        (moz_gtk_get_menu_separator_height):
+        (moz_gtk_widget_paint):
+        (moz_gtk_shutdown):
+        * platform/gtk/gtkdrawing.h:
+
+2009-04-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18475
+
+        [Qt] Widget painting should follow the layout direction (LTR, RTL)
+        of the element style, not the application layout direction.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-04-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25412
+        The Window object should be an EventTarget
+
+        Test: fast/dom/Window/dispatchEvent.html
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS): Add DOMWindow case.
+        (WebCore::toEventTarget): Ditto.
+
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toDOMWindow): Added.
+        * dom/EventTarget.h:
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::scriptExecutionContext): Added. Returns the document.
+        (WebCore::DOMWindow::dispatchEvent): Added.
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::toDOMWindow):
+        (WebCore::DOMWindow::refEventTarget):
+        (WebCore::DOMWindow::derefEventTarget):
+        * page/DOMWindow.idl:
+
+2009-04-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove scons-based build system.
+
+        * WebCore.scons: Removed.
+
+2009-04-26  Darin Adler  <darin@apple.com>
+
+        Suggested by Darin Fisher.
+
+        Improve the fix for bug 25355: Crash when Creating New Tab or New Window when set to open Same Page
+        https://bugs.webkit.org/show_bug.cgi?id=25355
+        rdar://problem/6823543
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Allow shouldScroll to be true even if m_currentHistoryItem is 0.
+        Not sure if when this case can really arise in practice, but it's good to match the original
+        logic more closely.
+
+2009-04-25  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        A width or height of zero for the destination or source rect of an
+        image causes a not invertible pattern matrix.
+        This crahes newer versions of Cairo and give some graphic gliches in
+        Canvas.
+        With this patch we check if there is something to draw and return if not.
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-04-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25390
+        
+        Fix point mapping and hit testing through transforms and perspective
+        with ENABLE_3D_RENDERING. Previously the code did the more efficient
+        move(), rather than getTransformFromContainer(), when the object had
+        no transform. However, this skipped the application of perspective
+        when the immediate child of the perspective element had no transform
+        itself.
+
+        Test: transforms/3d/point-mapping/3d-point-mapping-3.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::createLocalTransformState):
+        Call shouldUseTransformFromContainer() to determine if we need to
+        go through the more expensive getTransformFromContainer() code
+        path.
+
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::shouldUseTransformFromContainer):
+        New method that indicates whether we need use getTransformFromContainer()
+        when mapping points through renderers, and hit testing.
+
+2009-04-25  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6712771> REGRESSION(34681): Text is no longer underlined after delete
+        https://bugs.webkit.org/show_bug.cgi?id=25396
+
+        Test: editing/deleting/delete-br-013.html
+
+        * editing/CompositeEditCommand.cpp: (WebCore::CompositeEditCommand::moveParagraphs):
+         Only preserve an empty paragraph's style when moving paragraphs around if the selection is still 
+         in an empty paragraph after the move occurs.  This was causing the empty paragraph's style to overwrite
+         the previous paragraph's style during a delete of an empty paragraph.
+
+2009-04-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6808171> REGRESSION (3-4): Standalone media documents don't 
+        properly display non-linear media
+
+        If a media engine claims it can support the MIME type, WebCore now creates a <video>
+        element for document mode media files instead of an <embed> element. Because WebCore's 
+        QuickTime backed media players do not support every kind of media the QuickTime plug-in
+        supports, and because it is not always possible to tell what type of media is in a file 
+        without opening and parsing it, some types of media that used to be displayed properly
+        by a plug-in are no longer supported properly. To fix this, if the media engine
+        sees that it can not completely support a media file it now informs the media 
+        document, which replaces the <video> element with an <embed>.
+        
+        r42301 landed support for OSX. This patch modifies those changes slighly and adds support
+        for Windows.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::MediaDocument): Initialize m_replaceMediaElementTimer.
+        (WebCore::MediaDocument::mediaElementSawUnsupportedTracks): Don't replace the <video> 
+        element immediately.
+        (WebCore::MediaDocument::replaceMediaElementTimerFired): Renamed from replaceVideoWithEmbed.
+        Set body margin-width and margin-height to 0 as that is what a PluginDocument uses.
+        * loader/MediaDocument.h:
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::loadStateChanged): Don't do anything if m_hasUnsupportedTracks.
+        (WebCore::MediaPlayerPrivate::rateChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::timeChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::didEnd): Ditto.
+        (WebCore::MediaPlayerPrivate::repaint): Ditto.
+        (WebCore::MediaPlayerPrivate::paint): Ditto.
+        (WebCore::MediaPlayerPrivate::sawUnsupportedTracks): Set m_hasUnsupportedTracks before callback.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_totalTrackCount and m_hasUnsupportedTracks.
+        (WebCore::MediaPlayerPrivate::updateStates): Call sawUnsupportedTracks if the movie has unsupported
+        media type(s) or if it fails completely.
+        (WebCore::MediaPlayerPrivate::sawUnsupportedTracks): New, disable the movie object and tell the
+        media player client we won't play this movie correctly.
+        (WebCore::MediaPlayerPrivate::didEnd): Don't do anything if m_hasUnsupportedTracks.
+        (WebCore::MediaPlayerPrivate::setSize): Ditto.
+        (WebCore::MediaPlayerPrivate::setVisible): Ditto.
+        (WebCore::MediaPlayerPrivate::paint): Ditto.
+        (WebCore::MediaPlayerPrivate::movieEnded): Ditto.
+        (WebCore::MediaPlayerPrivate::movieLoadStateChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::movieTimeChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::movieNewImageAvailable): Ditto.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::task): Stop the task timer if we were disabled during the load state
+        change callback.
+        (QTMovieWinPrivate::drawingComplete): Don't do anything if disabled.
+        (QTMovieWin::QTMovieWin): Initialize m_disabled.
+        (QTMovieWin::disableUnsupportedTracks): Return total number of tracks.
+        (QTMovieWin::setDisabled): New, set m_disabled flag.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-04-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Error reporting
+        https://bugs.webkit.org/show_bug.cgi?id=18344
+
+        Fix the SOUP resource handle to report SOUP_HTTP_ERROR for Soup
+        errors and G_IO_ERROR for gio errors.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+        (WebCore::ResourceHandle::startHttp):
+        (WebCore::ResourceHandle::start):
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+        (WebCore::ResourceHandle::startGio):
+
+2009-04-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Mark Rowe.
+
+        Only set the new URL once for the request. Doing it a second time
+        after the call to willSendRequest was causing crashes when
+        redirected requests got cancelled.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-04-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Adding ScriptEventListener.cpp.
+
+        * WebCoreSources.bkl:
+
+2009-04-24  Sergio García-Cuevas  <sergio_gcg@telefonica.net>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17267
+        [GTK] Primary selection/clipboard support
+
+        Copy the link location to the primary selection as well as the
+        clipboard selection when using the "copy link selection" context
+        menu entry.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeURL):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-04-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25383
+        Changing SVG size via JS does not update CSS width/height
+
+        Add an ugly hack to fix CSS width/height updates from JS.
+
+        We can't easily call setAttribute when width/height changes
+        as that would cause infinite recursion (as we'd try to set
+        the animation storage from the attributes)
+
+        For now, when we get notification that JS changed width/height
+        we copy what parseMappedAttribute does and update the CSS values as well.
+
+        A better fix for this would be:
+        https://bugs.webkit.org/show_bug.cgi?id=25383
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::updateCSSForAttribute):
+        (WebCore::SVGSVGElement::svgAttributeChanged):
+
+2009-04-24  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        We should not show the deletion UI for blockquotes in mail but they do 
+        show now that we only check for one visible border.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-04-24  Dan Bernstein  <mitz@apple.com>
+
+        - address Hyatt's review comments on the last patch
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::performOverlapTests):
+        (WebCore::RenderLayer::paintLayer):
+
+2009-04-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=5909
+          <rdar://problem/5863349> overlapping element leaves trail when
+          scrolling iframe
+
+        * WebCore.xcodeproj/project.pbxproj: Added OverlapTestRequestClient.h.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset): Initialize m_isOverlapped.
+        (WebCore::FrameView::useSlowRepaints): Also check m_isOverlapped.
+        (WebCore::FrameView::removeSlowRepaintObject): Use useSlowRepaints()
+        so overlapping is taken into account.
+        (WebCore::FrameView::setIsOverlapped): Added. Sets m_isOverlapped and
+        enables or disables copy-on-scroll accordingly.
+
+        * page/FrameView.h:
+        Added setIsOverlapped() and m_isOverlapped.
+
+        * rendering/OverlapTestRequestClient.h: Added. During foreground painting,
+        an OverlapTestRequestClient can make a request to test if any subsequently-
+        painted layers overlap a rect. The test result is delivered to the
+        requestClient via setOverlapTestResult().
+        (WebCore::OverlapTestRequestClient::~OverlapTestRequestClient):
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint): Pass an OverlapTestRequestMap to
+        paintLayer(). When done painting, inform any remaining requestClients that
+        they are not overlapped.
+
+        (WebCore::RenderLayer::paintLayer): Take an OverlapTestRequestMap and
+        pass it down to child and reflection layers. Inform requestClients if this
+        layer overlaps their requested rects.
+
+        * rendering/RenderLayer.h:
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::PaintInfo::PaintInfo): Added an
+        OverlapTestRequestMap member.
+
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint): For now, pass a 0 OverlapTestRequestMap
+        to paintLayer().
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): For FrameViews, request an overlap test
+        with the frame.
+        (WebCore::RenderWidget::setOverlapTestResult): Call
+        FrameView::setIsOverlapped() with the result of the overlap test.
+
+        * rendering/RenderWidget.h: Made RenderWidget an OverlapTestRequestClient.
+
+2009-04-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser, Dan Bernstein.
+
+        Speed up the PLT by devirtualizing the height() function on InlineBox.  virtualizing it in order to make the height() computation dynamic caused
+        a ~0.5% slowdown.  This patch does the following to get the speed back:
+        
+        (a) Devirtualizes isText and forces inline box creators to set the bit as needed.  This actually resulted in simplified code, since ListMarkerBox could
+        then be removed.
+        (b) Reduces the height() call count.  In some cases the code was repeatedly calling height(), which used to be fine when the function was just an inline
+        member variable access.  The call sites have been patched to cut down on extra height() calls now that it is more expensive.
+        (c) Devirtualize height() except on SVG boxes.  For all non-SVG, the height() function on InlineBox handles the computation.  For SVG boxes, a new bit has
+        been set on InlineBoxes (isSVG()) that indicates that the virtual svgBoxHeight() function should be called to retrieve the height instead.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::isSVG):
+        (WebCore::InlineBox::setIsSVG):
+        (WebCore::InlineBox::isText):
+        (WebCore::InlineBox::setIsText):
+        (WebCore::InlineBox::svgBoxHeight):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.cpp:
+        * rendering/InlineTextBox.h:
+        * rendering/ListMarkerBox.cpp: Removed.
+        * rendering/ListMarkerBox.h: Removed.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::createInlineBox):
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createFlowBox):
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::createTextBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createRootBox):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::createInlineTextBox):
+        * rendering/RootInlineBox.cpp:
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineFlowBox.h:
+        (WebCore::SVGInlineFlowBox::svgBoxHeight):
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::SVGInlineTextBox::svgBoxHeight):
+        * rendering/SVGRootInlineBox.h:
+        (WebCore::SVGRootInlineBox::svgBoxHeight):
+
+2009-04-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25370
+        Introduce ScriptEventListener to refactor away direct references to
+        JSLazyEventListener in WebCore code.
+
+        * GNUmakefile.am: Added ScriptEventListener to project.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSDOMGlobalObject.cpp: Removed unused JSLazyEventListener include.
+        * bindings/js/JSLazyEventListener.cpp: Moved createAttributeEventListener helpers
+            to ScriptEventListener.
+        * bindings/js/JSLazyEventListener.h: Ditto.
+        * bindings/js/ScriptController.cpp: Removed unused JSLazyEventListener include.
+        * bindings/js/ScriptEventListener.cpp: Added.
+        * bindings/js/ScriptEventListener.h: Added.
+        * bindings/v8/ScriptEventListener.cpp: Added.
+        * bindings/v8/ScriptEventListener.h: Added.
+        * dom/Document.cpp: Renamed JSLazyEventListener include to ScriptEventListener.
+        * html/HTMLBodyElement.cpp: Ditto.
+        * html/HTMLButtonElement.cpp: Ditto.
+        * html/HTMLElement.cpp: Ditto.
+        * html/HTMLFormElement.cpp: Ditto.
+        * html/HTMLFrameElementBase.cpp: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        * html/HTMLImageElement.cpp: Ditto.
+        * html/HTMLInputElement.cpp: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLScriptElement.cpp: Ditto.
+        * html/HTMLSelectElement.cpp: Ditto.
+        * html/HTMLTextAreaElement.cpp: Ditto.
+        * svg/SVGElement.cpp: Ditto.
+        * svg/SVGSVGElement.cpp: Ditto.
+
+2009-04-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25355: Crash when Creating New Tab or New Window when set to open Same Page
+        https://bugs.webkit.org/show_bug.cgi?id=25355
+        rdar://problem/6823543
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Added a null check.
+
+2009-04-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix RenderSVGImage to dump with full bounds and style information.
+        https://bugs.webkit.org/show_bug.cgi?id=25377
+        
+        No functional changes, we're just now including more info in render tree dumps.
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGImage):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::isSVGImage):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::write):
+        * rendering/SVGRenderTreeAsText.h:
+
+2009-04-24  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        Rename "isInline" => "isAttribute" in v8 bindings (jsc was done in r42699).
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::add):
+        (WebCore::V8EventListenerList::remove):
+        (WebCore::V8EventListenerList::clear):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::virtualisAttribute):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+        (WebCore::V8EventListener::virtualisAttribute):
+
+2009-04-24  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25343
+        Fix Chromium/Skia bug where -webkit-box-shadow with 0,0 offset 
+        ignores blur.
+
+        * WebCore\platform\graphics\skia\GraphicsContextSkia.cpp
+         (WebCore::GraphicsContext::setPlatformShadow): Add check against
+         blur before clearing looper.
+
+2009-04-24  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Initialize TextIterator::m_textLength to 0.
+
+        This assures that TextIterator::length() will return 0 for cases when TextIterator's constructor returns early (because there is nothing to iterate over in the range).
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25335>
+
+        Test: editing/selection/doubleclick-whitespace-img-crash.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::TextIterator):
+
+2009-04-24  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25329
+        Add indexed access method in v8 binding of ClientRectList.
+
+        * bindings/v8/custom/V8ClientRectListCustom.cpp: Added.
+
+2009-04-24  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25257
+        Use null for unspecified event listener attributes of XMLHttpRequest
+        and XMLHttpRequestUpload in v8 binding.
+
+        cf. http://www.whatwg.org/specs/web-apps/current-work/#event-handler-attributes
+        An event handler attribute, unless otherwise specified, can either
+        have the value null or be set to a Function object.
+        Initially, an event handler attribute must be set to null.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-default-attributes.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Changed to use v8::Null().
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Ditto.
+
+2009-04-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/6663836> CrashTracer: crashes in Safari at com.apple.WebCore • WebCore::reportException + 1513
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException): Added a null check.
+
+2009-04-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23219
+
+        Add support for transtions and animations of background-position, -webkit-background-size,
+        -webkit-mask-position and -webkit-mask-size.
+
+        Tests: transitions/background-transitions.html
+               transitions/mask-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        Add a blend func for LengthSize.
+        
+        (WebCore::ensurePropertyMap):
+        Add wrappers for the new properties.
+        
+        (WebCore::addShorthandProperties):
+        Add a shorthand property for CSSPropertyBackgroundPosition to map to
+        CSSPropertyBackgroundPositionX and CSSPropertyBackgroundPositionY, 
+        add CSSPropertyWebkitMask for CSSPropertyWebkitMaskPosition, and add
+        CSSPropertyWebkitMaskPosition for CSSPropertyWebkitMaskPositionX and
+        CSSPropertyWebkitMaskPositionY.
+        
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::setBackgroundXPosition):
+        (WebCore::InheritedFlags::setBackgroundYPosition):
+        (WebCore::InheritedFlags::setBackgroundSize):
+        (WebCore::InheritedFlags::setMaskXPosition):
+        (WebCore::InheritedFlags::setMaskYPosition):
+        (WebCore::InheritedFlags::setMaskSize):
+        Add setters for the properties that can be animated now.
+
+2009-04-24  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/5089327> Newline gets stripped when pasting whole lines in certain markup
+
+        Test: editing/pasteboard/paste-blockquote-after-blockquote.html
+
+        When we have matching quote levels, its ok to merge the starts of the inserted and existing blocks more frequently.
+        But we should only merge here if the selection start was inside a mail blockquote.  This prevents against removing a 
+        blockquote from newly pasted quoted content that was pasted into an unquoted position.  If that unquoted position happens 
+        to be right after another blockquote, we don't want to merge and risk stripping a valid block (and newline) from the pasted content.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::shouldMergeStart): Also added an early return to always return false when we're already moving paragraphs.
+        (WebCore::ReplaceSelectionCommand::doApply): Removed redundant check for when we're moving paragraphs.
+        * editing/ReplaceSelectionCommand.h:
+
+2009-04-23  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 24604: WebKit profiler reports incorrect total times
+        <https://bugs.webkit.org/show_bug.cgi?id=24604>
+
+        Reviewed by Timothy Hatcher and Kevin McCullough.
+
+        Made it so that most of the profiler functions now match the behavior of Shark. Most notably, in the
+        heavy view, child nodes now represent the statistics of the root node. Each root node of heavy view
+        displays flattened statistics for a particular function that ran during the profile, and each child
+        of these root nodes represents a callpath that lead to it. Thus, the statistics for each of these child
+        nodes should show how much of the root nodes values came from it. For example, if you had the following to
+        stacks take place during the profile:
+
+        A ->calls 1 times-> B ->calls 2 times-> C
+        D ->calls 4 times-> C
+
+        The tree for the C root node would look like this:
+
+        C -> B -> A
+          -> D
+
+        The number of calls values would look like this:
+
+        C (6) -> B (2) -> A(2)
+              -> D (4)
+
+        What this means is that "2 of the total 6 C calls came from B", "2 of the total C calls came from A", and
+        "4 of the total C calls came from D".  Notice that the "A ->calls 2 time->" is completely ignored. This becomes
+        particularly tricky during recursive calls, because each child note can represent multiple possible paths. This
+        is the reason that we would get things like 40000% previously with recursion.
+
+        This is also the way gprof works, and as close as we can get to Shark's behavior (Shark is not instrumented so it
+        can't know exactly how many calls came from where, etc).
+
+        * English.lproj/localizedStrings.js: Added "Average" for average times in the profile.
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::ProfileClass):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getParent):
+        (WebCore::getHead):
+        (WebCore::getCallUID):
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/BottomUpProfileDataGridTree.js: Added.
+        (WebInspector.BottomUpProfileDataGridTree):
+        (WebInspector.BottomUpProfileDataGridTree.prototype.focus):
+        (WebInspector.BottomUpProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._takePropertiesFromProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._keepOnlyChild):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._exclude):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._merge):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._populate):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.insertChild):
+        (WebInspector.DataGrid.prototype.removeChild):
+        (WebInspector.DataGrid.prototype.removeChildren):
+        (WebInspector.DataGridNode.prototype.set hasChildren):
+        (WebInspector.DataGridNode.prototype.get hasChildren):
+        * inspector/front-end/ProfileDataGridTree.js: Added.
+        (WebInspector.ProfileDataGridNode):
+        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
+        (WebInspector.ProfileDataGridNode.prototype.get data):
+        (WebInspector.ProfileDataGridNode.prototype.createCell):
+        (WebInspector.ProfileDataGridNode.prototype.select):
+        (WebInspector.ProfileDataGridNode.prototype.deselect):
+        (WebInspector.ProfileDataGridNode.prototype.expand):
+        (WebInspector.ProfileDataGridNode.prototype.insertChild):
+        (WebInspector.ProfileDataGridNode.prototype.removeChild):
+        (WebInspector.ProfileDataGridNode.prototype.removeChildren):
+        (WebInspector.ProfileDataGridNode.prototype.findChild):
+        (WebInspector.ProfileDataGridNode.prototype.get averageTime):
+        (WebInspector.ProfileDataGridNode.prototype.get averagePercent):
+        (WebInspector.ProfileDataGridNode.prototype.get selfPercent):
+        (WebInspector.ProfileDataGridNode.prototype.get totalPercent):
+        (WebInspector.ProfileDataGridNode.prototype._save):
+        (WebInspector.ProfileDataGridNode.prototype._restore):
+        (WebInspector.ProfileDataGridNode.prototype._merge):
+        (WebInspector.ProfileDataGridTree):
+        (WebInspector.ProfileDataGridTree.prototype.get expanded):
+        (WebInspector.ProfileDataGridTree.prototype.appendChild):
+        (WebInspector.ProfileDataGridTree.prototype.insertChild):
+        (WebInspector.ProfileDataGridTree.prototype.removeChildren):
+        (WebInspector.ProfileDataGridTree.prototype.findChild.WebInspector.ProfileDataGridNode.prototype.findChild.sort.WebInspector.ProfileDataGridNode.prototype.sort._save):
+        (WebInspector.ProfileDataGridTree.propertyComparator.comparator):
+        (WebInspector.ProfileDataGridTree.propertyComparator.else.comparator):
+        (WebInspector.ProfileDataGridTree.propertyComparator):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype.set profile):
+        (WebInspector.ProfileView.prototype.get bottomUpProfileDataGridTree):
+        (WebInspector.ProfileView.prototype.get topDownProfileDataGridTree):
+        (WebInspector.ProfileView.prototype.get currentTree):
+        (WebInspector.ProfileView.prototype.set currentTree):
+        (WebInspector.ProfileView.prototype.get topDownTree):
+        (WebInspector.ProfileView.prototype.get bottomUpTree):
+        (WebInspector.ProfileView.prototype.refresh):
+        (WebInspector.ProfileView.prototype.refreshVisibleData):
+        (WebInspector.ProfileView.prototype.refreshShowAsPercents):
+        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
+        (WebInspector.ProfileView.prototype.performSearch):
+        (WebInspector.ProfileView.prototype._changeView):
+        (WebInspector.ProfileView.prototype._focusClicked):
+        (WebInspector.ProfileView.prototype._excludeClicked):
+        (WebInspector.ProfileView.prototype._resetClicked):
+        (WebInspector.ProfileView.prototype._sortProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.showView):
+        (WebInspector.ProfilesPanel.prototype.searchMatchFound):
+        * inspector/front-end/TopDownProfileDataGridTree.js: Added.
+        (WebInspector.TopDownProfileDataGridNode):
+        (WebInspector.TopDownProfileDataGridNode.prototype._populate):
+        (WebInspector.TopDownProfileDataGridNode.prototype._exclude):
+        (WebInspector.TopDownProfileDataGridTree):
+        (WebInspector.TopDownProfileDataGridTree.prototype.focus):
+        (WebInspector.TopDownProfileDataGridTree.prototype.exclude):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-04-23  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Use static functions (and a couple templates)
+        to further reduce the amount of copy/paste code in SVGRenderTreeAsText
+
+        No test changes, only code cleanup.
+
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeNameValuePair):
+        (WebCore::writeNameAndQuotedValue):
+        (WebCore::writeIfNotEmpty):
+        (WebCore::writeIfNotDefault):
+        (WebCore::writeStyle):
+        (WebCore::writePositionAndStyle):
+        (WebCore::operator<<):
+
+2009-04-23  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        SVGRenderTreeAsText cleanup/code sharing.
+
+        No test changes, only code cleanup.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::firstRunOrigin):
+        * rendering/RenderText.h:
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeStandardPrefix):
+        (WebCore::writeChildren):
+        (WebCore::write):
+        (WebCore::writeRenderResources):
+
+2009-04-23  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore part of fix for <rdar://problem/6333461> REGRESSION 
+        (r36864-r36869): Dragging stocks widget scrollbar drags the whole 
+        widget
+
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::isScrollbar):
+        * platform/Widget.h:
+        (WebCore::Widget::isScrollbar):
+
+2009-04-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/6808109> "Deletion UI" is not available for many
+        portions of HTML content
+
+        This patch makes the deletion UI show up in some new situations:
+        1) If a block's background color is different from its parent's
+        2) If a block has a background image.
+        3) If a block has a single visible border.
+        However the block must now not only be at least a minimum width and
+        height, but also exceed a minimum area.  In practice this has led to
+        much better element selection. 
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-04-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Adding XMLTokenizerScope.cpp to the build.
+
+        * WebCoreSources.bkl:
+
+2009-04-23  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6788905> REGRESSION (41928?): hang in Position::upstream
+        https://bugs.webkit.org/show_bug.cgi?id=25312
+
+        I was unable to reproduce the problem, but I'm pretty sure this will fix it.
+
+        * rendering/RenderObject.cpp: (WebCore::RenderObject::createVisiblePosition):
+        Since VisiblePosition doesn't ensure the offset is good, we shouldn't pass max int as an offset.
+
+2009-04-23  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25313
+        Missing scroll bars in GMail.
+
+        Test: fast/overflow/overflow-y-scroll.html
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars): Added check for the ScrollbarAlwaysOn
+        scroll mode.
+
+2009-04-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        - fix <rdar://problem/6081309> Mail crash when pressing down arrow in
+          some messages in WebCore::canHaveChildrenForEditing
+
+        Test: editing/selection/extend-by-line-anonymous-content-crash.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition): Null-check node. If p is not an
+        editable position, then closestLeafChildForXPos() may have returned a
+        non-editable box, and in particular one belonging to anonymous content.
+        If node is 0, fall back on RenderObject::positionForPoint, which
+        finds the closest position in non-anonymous content.
+        (WebCore::nextLinePosition): Ditto.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition): Fixed a typo.
+
+2009-04-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6791439> REGRESSION: Get an error page instead of login page navigating back in gmail
+
+        Test: http/tests/history/back-to-post.php
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        Apply a new cache policy if it changed after the platform request was first created.
+        While at it, also made sure to update timeout.
+
+2009-04-23  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        When creating a new drawable object, collect system's
+        information about the best depth it can provide and use it
+        in a new colormap that the new drawable requires.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-04-23  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15654
+        GdkPixbuf support for ImageCairo
+
+        Add support for converting a Cairo surface to a GdkPixbuf.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/Image.h:
+        (WebCore::Image::getGdkPixbuf):
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-04-23  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make windowed plugins (on X11, Qt) behave nicer with wheel scrolling.
+
+        Basically, what we want is to send wheel events to the plugin *only*
+        when it has focus, or else send it to the parent frame.
+
+        This is a work around, and basically what we do, is to steal the
+        wheel events from the plugin, modify the window ID, and put the
+        event back into the Qt event loop.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginClientWrapper::PluginClientWrapper):
+        (PluginClientWrapper::~PluginClientWrapper):
+        (PluginClientWrapper::x11Event):
+        (PluginContainerQt::PluginContainerQt):
+        (PluginContainerQt::~PluginContainerQt):
+        (PluginContainerQt::on_clientClosed):
+        (PluginContainerQt::on_clientIsEmbedded):
+        (PluginContainerQt::redirectWheelEventsToParent):
+        (PluginContainerQt::x11Event):
+        (PluginContainerQt::focusInEvent):
+        * plugins/qt/PluginContainerQt.h:
+
+2009-04-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak
+
+        <rdar://problem/6786961> - "Are you sure you want to resubmit this form?" nag displays twice.
+
+        For most loads, we were consulting the navigation policy delegate twice.  Once from FrameLoader before
+        the load started and once from MainResourceLoader in its willSendRequest callback.
+
+        In the past we tried removing MainResourceLoader's call altogether.  This caused a regression where urls 
+        that redirect to a url handled by an external application would no longer work in Safari.  It probably 
+        also broke other WebKit apps in subtle ways.
+
+        Changing MainResourceLoader to make the check only on redirects fixes both bugs.  We now only call the 
+        policy delegate once for most standard loads, but we do correctly call it a second time for redirects.
+
+        Tests: http/tests/misc/policy-delegate-called-twice.html
+               http/tests/misc/redirect-to-external-url.html
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest): Call the navigation policy delegate only for redirects.
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for <rdar://problem/6800695>
+
+        Add a hack to only allow navigating (via a link from a http page)
+        to feed: urls (same for feeds: and feedsearch:) that map to http:
+        or https: via their nested protocol. This includes both feed://example.com
+        and feed:http://example.com.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::isFeedWithNestedProtocolInHTTPFamily):
+        (WebCore::FrameLoader::loadFrameRequest):
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Autogenerate the XMLHttpRequest constructor getter/setter for the
+        WorkerContext and remove the now no longer needed JSWorkerContextBase.lut.h
+        file.
+
+        * DerivedSources.make: Remove JSWorkerContextBase.lut.h
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/JSWorkerContextBase.h: Remove code to support hand written
+        code for XMLHttpRequest constructor lookup and shadowing.
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::customGetOwnPropertySlot): Remove JSC prefixes.
+        (WebCore::JSWorkerContext::xmlHttpRequest): Added. Custom implementation of
+        cached constructor lookup.
+        * workers/WorkerContext.idl: Make the XMLHttpRequestConstructor accessor not
+        V8 specific.
+
+2009-04-22  Darin Adler  <darin@apple.com>
+
+        * page/Navigator.idl: Touch this file to fix build since Geolocation
+        configuration was recently turned off.
+
+2009-04-22  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25322
+        Can't delete empty paragraph after a block image
+        
+        Empty paragraph removal would have been handled by mergeParagraphs, but we stopped short
+        because of some code that avoided problems that would arise from Positions that would go
+        bad during deletion.  
+        
+        We have several checks that prevent us from using bad Positions, this one in particular
+        was added to avoid bad Positions that result from text removal.  So, I removed the check
+        and started correctly updating m_downstreamEnd during text removal so that it doesn't go
+        bad.  m_upstreamStart doesn't need to be updated during text removal, since only text
+        after it will ever be removed.
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::deleteTextFromNode):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::mergeParagraphs):
+
+2009-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6757346> SAP: Prevent default on mouseDown does not stop iframe from capturing subsequent mouse moves
+
+        Make mouseUp target the correct frame when the original
+        mousedown made the drag non-capturing.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+
+2009-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6757346> SAP: Prevent default on mouseDown does not stop iframe from capturing subsequent mouse moves
+
+        This is the first step of allowing drag events to match the behaviour
+        of mouse move events when the default action of the initial mouse down
+        is prevented.  Remaining issue is that the final mouse up event still
+        targets the original root frame.
+
+        Test: fast/events/mouse-drag-from-frame-to-other-frame.html
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+
+2009-04-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson
+        
+        <rdar://problem/6702882> QT movie's video fails to be displayed after switching between tabs
+        <rdar://problem/6754957> Resizing Web browser window and hitting play will cause video blocks and artifacting
+
+        When in a media document, MediaPlayerPrivateQTKit uses a QTMovieView which may get
+        layer backing under some circumstances. However, drawing the view via
+        displayRectIgnoringOpacity:inContext: bypasses any layer setup that AppKit normally performs.
+        So when in the media document, we draw via displayRectIgnoringOpacity:.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-04-22  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a crash in Mail when forwarding a specific HTML email.
+        Caused by the fix for <rdar://problem/6512520> (r42096).
+        Unable to create a test case that works outside of Mail.
+
+        <rdar://problem/6796069>
+
+        Reviewed by Ada Chan.
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Null check pastEnd before trying to
+        call Range::compareBoundaryPoints.
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Fix for <rdar://problem/6816957>
+        Turn off Geolocation by default
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-04-22  Eric Seidel  <eric@webkit.org>
+
+        Rubber-stamped by David Hyatt.
+
+        Change RenderSVGImage to dump as RenderSVGImage instead of RenderImage
+
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::renderName):
+
+2009-04-21  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a crash on Gmail when they remove a "before unload" event listener when
+        it was never added to the pending map in the first place.
+
+        <rdar://problem/6814144>
+
+        Reviewed by Darin Adler.
+
+        * page/DOMWindow.cpp:
+        (WebCore::allowsPendingBeforeUnloadListeners): Renamed from shouldAddPendingBeforeUnloadListener.
+        (WebCore::DOMWindow::addEventListener): Call allowsPendingBeforeUnloadListeners now.
+        (WebCore::DOMWindow::removeEventListener): Call allowsPendingBeforeUnloadListeners before
+        removing the before unload listener.
+        (WebCore::DOMWindow::clearAttributeEventListener): Ditto.
+
+2009-04-22  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Made windowed plugins move/resize synchronized with the painting, so
+        that windowed plugins are not moved before the rest of the parent
+        frame during scrolling.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::PluginContainerQt):
+        (PluginContainerQt::requestGeometry):
+        (PluginContainerQt::adjustGeometry):
+        * plugins/qt/PluginContainerQt.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+
+2009-04-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix various bugs in the X11 Qt plugin focus handling.
+
+        Notify the focus controller on activation/deactivation of the plugin and
+        set focus on the plugin's element when it receives the window system
+        focus.
+
+        * WebCore.pro: Added PluginContainerQt to the Qt build.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::focusPluginElement): New helper function, moved from PluginViewWin.
+        * plugins/PluginView.h:
+        (WebCore::PluginView::parentFrame): Added parent frame accessor.
+        * plugins/qt/PluginContainerQt.cpp: Added.
+        (PluginContainerQt::PluginContainerQt):
+        (PluginContainerQt::focusInEvent): Set the focus controller active on focus in events.
+        (PluginContainerQt::focusOutEvent): Deactivate the focus controller when loosing the focus.
+        * plugins/qt/PluginContainerQt.h: Added.
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::init): Allocate a PluginContainerQt instead of QX11EmbedContainer.
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::handleMouseEvent): Moved the code to set focus on the plugin element
+        to PluginView::focusPluginElement.
+
+2009-04-22  Tamas Szirbucz  <szirbucz.tamas@stud.u-szeged.hu>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25023
+        Delete reply in QNetworkReplyHandler::abort() to avoid leak.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::abort):
+
+2009-04-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Allow the UI delegate to control cursor-setting.
+
+        Reviewed by Ada Chan.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::setCursor):
+        Pass the call to the client.
+
+        * page/Chrome.h:
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::setCursor):
+        Stubbed; returns false.
+
+        * platform/Cursor.h:
+        Define PlatformCursorHandle for each platform.
+
+        * platform/win/WidgetWin.cpp:
+        Reordered some includes. Added an include of Page.h.
+        (WebCore::Widget::setCursor):
+        Fixed a typo in the comment about ignoreNextSetCursor. Get the Page, and
+        call its Chrome's setCursor() method with the passed cursor. Fall back
+        to SetCursor() if the Page is not available.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::handleMouseEvent):
+        Remove an unused variable. Cleaned up some whitespace.
+
+2009-04-21  John Abd-El-Malek  <jam@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add a method to purge the Chromium plugin list cache.
+        https://bugs.webkit.org/show_bug.cgi?id=25318
+
+        * plugins/chromium/PluginDataChromium.cpp:
+        (WebCore::resetChromiumPluginCache):
+
+2009-04-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25164> / <rdar://problem/6786319>.
+
+        We need to ensure that XMLTokenizer sets the current DocLoader before calling in to
+        any libxml2 methods that may trigger a load.  The presence of a DocLoader indicates
+        that the load was originated by WebCore's use of libxml2 and that we should enforce
+        the same-origin policy on it.  XMLTokenizer::initializeParserContext,
+        XMLTokenizer::doWrite and XMLTokenizer::doEnd were three methods that were not setting
+        the current DocLoader when they should have.
+
+        The XMLTokenizerScope class is introduced to simplify the pattern of saving, setting and
+        restoring the current DocLoader and libxml2 error handlers.  The DocLoader and error handlers
+        are saved and set when the scope is allocated, and restored to their previous values when
+        the scope is exited.
+
+        Test: http/tests/security/xss-DENIED-xml-external-entity.xhtml
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/XMLTokenizer.cpp:
+        * dom/XMLTokenizer.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::matchFunc):
+        (WebCore::shouldAllowExternalLoad):
+        (WebCore::openFunc):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::xmlDocPtrForString):
+        * dom/XMLTokenizerScope.cpp:
+        (WebCore::XMLTokenizerScope::XMLTokenizerScope):
+        (WebCore::XMLTokenizerScope::~XMLTokenizerScope):
+        * dom/XMLTokenizerScope.h:
+        * xml/XSLStyleSheet.cpp:
+        (WebCore::XSLStyleSheet::parseString):
+        * xml/XSLTProcessor.cpp:
+
+2009-04-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/5874009>
+        Add port 3659 (apple-sasl / PasswordServer) to the list of blocked ports.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::portAllowed):
+
+2009-04-21  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25320
+        Crash when changing block styles in a root that contains no visible content (but contains nodes with renderers)
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary): If the enclosing block is the 
+        root editable element and it contains no visible content, create a new block but don't try and move 
+        content into it, since there's nothing for moveParagraphs to move.
+        
+
+2009-04-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 25162: REGRESSION (r41176-r41242): Drag-selection above/below the line does not select to beginning/end
+        https://bugs.webkit.org/show_bug.cgi?id=25162
+        rdar://problem/6764354
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize editing behavior to Mac-style for PLATFORM(MAC).
+        Later we may want to change this default to encompass other versions running on Mac.
+
+        * page/Settings.h: Added EditingBehavior, setEditingBehavior, editingBehavior, and
+        m_editingBehavior. Also moved m_maximumDecodedImageSize out of the middle of all
+        the bit fields.
+
+        * platform/graphics/IntPoint.h: Added a constructor to turn an IntSize into an IntPoint.
+        I'm not sure the distinction here is serving us well at the moment. When converting from
+        global to local coordinates you want to do IntPoint - IntPoint and have the result be
+        another IntPoint, not an IntSize. And so on.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::positionForPointRespectingEditingBoundaries): Changed to use pointers more and
+        separate coordinates less.
+        (WebCore::RenderBlock::positionForPointWithInlineChildren): Turned into a member function.
+        Added separate cases to support the Mac and Windows behavior.
+        (WebCore::RenderBlock::positionForPoint): Updated for the change above. Also moved the
+        computation of pointInContents closer to the place it's used.
+
+        * rendering/RenderBlock.h: Updated for the new private member function.
+
+2009-04-17  Timothy Hatcher  <timothy@apple.com>
+
+        Change pending unload and beforeunload counts to store the listeners
+        in a single data structure that can be quickly iterated for dispatch.
+
+        <rdar://problem/6383352&6383379&6383940>
+
+        Reviewed by Darin Adler.
+
+        * WebCore.base.exp: Change what symbols are exported.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Remove count updating code
+        and move an if inside a block already checking m_frame->document().
+        * page/Chrome.cpp: Remove disableSuddenTermination/enableSuddenTermination.
+        * page/Chrome.h: Ditto.
+        * page/ChromeClient.h: Ditto.
+        * page/DOMWindow.cpp:
+        (WebCore::pendingUnloadEventListenerMap): Create a static map.
+        (WebCore::pendingBeforeUnloadEventListenerMap): Ditto.
+        (WebCore::addPendingEventListener): Add the event listener to the map.
+        (WebCore::removePendingEventListener): Remove the event listener from the map.
+        (WebCore::removePendingEventListeners): Remove all listeners for the window.
+        (WebCore::dispatchWindowEventToListeners): Dispatch the event to the given listeners.
+        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents): Send the beforeunload event.
+        (WebCore::DOMWindow::pendingUnloadEventListeners): Return a count of pending listeners.
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Send the unload event.
+        (WebCore::DOMWindow::~DOMWindow): Remove the window from both event listener maps.
+        (WebCore::DOMWindow::addEventListener): Call addPendingEventListener when needed.
+        (WebCore::DOMWindow::removeEventListener): Call removePendingEventListener when needed.
+        (WebCore::DOMWindow::removeAllEventListeners): Call removePendingEventListeners.
+        (WebCore::DOMWindow::removeInlineEventListenerForType): Call removePendingEventListener when needed.
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::frame): Changed to be const.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler): Remove count tracking code.
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp:
+        (WebCore::Page::Page): Ditto.
+        * page/Page.h: Ditto.
+
+2009-04-21  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19644
+        Text copied with Select All pastes with a indent but shouldn't
+        <rdar://problem/6102483> 
+        Pasting the content of an HTML message in Mail causes addition nested <div> elements to be added
+        
+        To improve selectall/copy/paste fidelity of certain pages, we began wrapping copied content with
+        a div that held properties and attributes from the fully selected body.  To fix the above issues, 
+        only do this if if the body has certain properties or attributes.  We'll begin adding to this list as 
+        necessary.  For now it's just background colors and images.  Tested copy/paste of nytimes, wired,
+        arstechnica, and several others.
+        
+        Massive nesting can still happen, it will just be much less common.
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup): 
+
+2009-04-21  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25250
+        Allow platforms to snap the scroll thumb back to the drag origin
+        during a drag.  Implement functions for Safari/Win and Chromium/Win
+        to do this snapping at distances approximating the native ones.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::Scrollbar):
+        (WebCore::Scrollbar::setValue):
+        (WebCore::Scrollbar::scroll):
+        (WebCore::Scrollbar::moveThumb):
+        (WebCore::Scrollbar::setCurrentPos):
+        (WebCore::Scrollbar::mouseMoved):
+        (WebCore::Scrollbar::mouseDown):
+        * platform/Scrollbar.h:
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::shouldSnapBackToDragOrigin):
+        * platform/chromium/ScrollbarThemeChromium.h:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::shouldSnapBackToDragOrigin):
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromium::shouldSnapBackToDragOrigin):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeWin::shouldSnapBackToDragOrigin):
+        * platform/win/ScrollbarThemeWin.h:
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::eventParameterName): Remove unreachable code when SVG is
+        enabled.
+
+2009-04-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        !ENABLE(SVG) build fix.
+        
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::eventParameterName):
+
+2009-04-21  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25309
+        Better use AtomicStrings when calling from the V8
+        bindings into WebCore code.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+
+2009-04-21  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+ 
+        Bug 25304: AX: Safari not identifying a secure text field
+        https://bugs.webkit.org/show_bug.cgi?id=25304
+
+        Secure text fields need to be able to return AXTitleUIElements.
+
+        Test: accessibility/secure-textfield-title-ui.html
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-04-21  Dan Bernstein  <mitz@apple.com>
+
+        - fix the Tiger build
+
+        * page/mac/EventHandlerMac.mm:
+        (method_setImplementation):
+
+2009-04-21   Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25271
+
+        Fix the build with disabled DOM storage or disabled database support.
+
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        * bindings/js/ScriptObjectQuarantine.h:
+
+2009-04-21  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix.
+
+        Compile fix for r42633. const qualifier does not work
+        on a static method.
+
+        * dom/Document.h:
+        (WebCore::Document::isSVGDocument):
+
+2009-04-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler and John Sullivan.
+
+        - fix <rdar://problem/5914146> Crash at -[NSScrollView scrollWheel:]
+
+        -[NSScrollView scrollWheel:] runs a nested event-tracking run loop
+        in a mode that allows WebCore timers to fire and NSURLConnection
+        callbacks to be dispatched, which can release the NSScrollView and
+        cause it to be deallocated (one example is a DOM timer callback that
+        removes a subframe from the document). This leads to a crash in
+        -scrollView:.
+
+        The fix is to replace the implementation of -[NSScrollView scrollWheel:]
+        with one that optionally retains the receiver for the duration of the
+        call.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::nsScrollViewScrollWheelShouldRetainSelf): Added.
+        (WebCore::setNSScrollViewScrollWheelShouldRetainSelf): Added. Replaces
+        the implementation of -[NSScrollView scrollWheel:] with the
+        self-retaining one, and sets a static boolean that tells it whether to
+        retain the receiver around the call to the original implementation.
+        (WebCore::selfRetainingNSScrollViewScrollWheel): Added. If
+        setNSScrollViewScrollWheelShouldRetainSelf(true) was called and this
+        function is executing on the main thread, it retains the NSScrollView,
+        invokes the original -[NSScrollView scrollWheel:], then releases the
+        view. Otherwise it just calls through to the original implementation.
+        (WebCore::EventHandler::passWheelEventToWidget): Added calls to
+        setNSScrollViewScrollWheelShouldRetainSelf() around the call to
+        -scrollWheel:.
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Tiger crash fix: Put VM tags in their own header file, and fixed up the
+        #ifdefs so they're not used on Tiger.
+
+        * ForwardingHeaders/wtf/VMTags.h: Copied from WebCore/ForwardingHeaders/wtf/HashTraits.h.
+
+2009-04-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Implement AtkComponent interface.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (core):
+
+2009-04-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Only implement AtkAction interface if we actually have an action.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25290
+        REGRESSION(r41732): Crash when constructing XMLHttpRequest in a detached document
+
+        Test: fast/dom/xmlhttprequest-constructor-in-detached-document.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        Avoid accessing JSDOMGlobalObject via ScriptExecutionContext, since it may not
+        work during frame teardown.
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Darin Adler and Sam Weinig.
+
+        Renamed "*InlineEventListener*" => "*AttributeEventListener*", and
+        "isInline" => "isAttribute".
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::virtualisAttribute):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        (WebCore::JSEventListener::isAttribute):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/JSLazyEventListener.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Element.cpp:
+        (WebCore::Element::setWindowAttributeEventListener):
+        * dom/Element.h:
+        * dom/EventListener.h:
+        (WebCore::EventListener::isAttribute):
+        (WebCore::EventListener::virtualisAttribute):
+        * dom/Node.cpp:
+        (WebCore::Node::clearAttributeEventListener):
+        (WebCore::Node::setAttributeEventListener):
+        (WebCore::Node::getAttributeEventListener):
+        (WebCore::Node::onabort):
+        (WebCore::Node::setOnabort):
+        (WebCore::Node::onblur):
+        (WebCore::Node::setOnblur):
+        (WebCore::Node::onchange):
+        (WebCore::Node::setOnchange):
+        (WebCore::Node::onclick):
+        (WebCore::Node::setOnclick):
+        (WebCore::Node::oncontextmenu):
+        (WebCore::Node::setOncontextmenu):
+        (WebCore::Node::ondblclick):
+        (WebCore::Node::setOndblclick):
+        (WebCore::Node::onerror):
+        (WebCore::Node::setOnerror):
+        (WebCore::Node::onfocus):
+        (WebCore::Node::setOnfocus):
+        (WebCore::Node::oninput):
+        (WebCore::Node::setOninput):
+        (WebCore::Node::onkeydown):
+        (WebCore::Node::setOnkeydown):
+        (WebCore::Node::onkeypress):
+        (WebCore::Node::setOnkeypress):
+        (WebCore::Node::onkeyup):
+        (WebCore::Node::setOnkeyup):
+        (WebCore::Node::onload):
+        (WebCore::Node::setOnload):
+        (WebCore::Node::onmousedown):
+        (WebCore::Node::setOnmousedown):
+        (WebCore::Node::onmousemove):
+        (WebCore::Node::setOnmousemove):
+        (WebCore::Node::onmouseout):
+        (WebCore::Node::setOnmouseout):
+        (WebCore::Node::onmouseover):
+        (WebCore::Node::setOnmouseover):
+        (WebCore::Node::onmouseup):
+        (WebCore::Node::setOnmouseup):
+        (WebCore::Node::onmousewheel):
+        (WebCore::Node::setOnmousewheel):
+        (WebCore::Node::onbeforecut):
+        (WebCore::Node::setOnbeforecut):
+        (WebCore::Node::oncut):
+        (WebCore::Node::setOncut):
+        (WebCore::Node::onbeforecopy):
+        (WebCore::Node::setOnbeforecopy):
+        (WebCore::Node::oncopy):
+        (WebCore::Node::setOncopy):
+        (WebCore::Node::onbeforepaste):
+        (WebCore::Node::setOnbeforepaste):
+        (WebCore::Node::onpaste):
+        (WebCore::Node::setOnpaste):
+        (WebCore::Node::ondragenter):
+        (WebCore::Node::setOndragenter):
+        (WebCore::Node::ondragover):
+        (WebCore::Node::setOndragover):
+        (WebCore::Node::ondragleave):
+        (WebCore::Node::setOndragleave):
+        (WebCore::Node::ondrop):
+        (WebCore::Node::setOndrop):
+        (WebCore::Node::ondragstart):
+        (WebCore::Node::setOndragstart):
+        (WebCore::Node::ondrag):
+        (WebCore::Node::setOndrag):
+        (WebCore::Node::ondragend):
+        (WebCore::Node::setOndragend):
+        (WebCore::Node::onreset):
+        (WebCore::Node::setOnreset):
+        (WebCore::Node::onresize):
+        (WebCore::Node::setOnresize):
+        (WebCore::Node::onscroll):
+        (WebCore::Node::setOnscroll):
+        (WebCore::Node::onsearch):
+        (WebCore::Node::setOnsearch):
+        (WebCore::Node::onselect):
+        (WebCore::Node::setOnselect):
+        (WebCore::Node::onselectstart):
+        (WebCore::Node::setOnselectstart):
+        (WebCore::Node::onsubmit):
+        (WebCore::Node::setOnsubmit):
+        (WebCore::Node::onunload):
+        (WebCore::Node::setOnunload):
+        * dom/Node.h:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setAttributeEventListener):
+        (WebCore::DOMWindow::clearAttributeEventListener):
+        (WebCore::DOMWindow::getAttributeEventListener):
+        (WebCore::DOMWindow::onabort):
+        (WebCore::DOMWindow::setOnabort):
+        (WebCore::DOMWindow::onblur):
+        (WebCore::DOMWindow::setOnblur):
+        (WebCore::DOMWindow::onchange):
+        (WebCore::DOMWindow::setOnchange):
+        (WebCore::DOMWindow::onclick):
+        (WebCore::DOMWindow::setOnclick):
+        (WebCore::DOMWindow::ondblclick):
+        (WebCore::DOMWindow::setOndblclick):
+        (WebCore::DOMWindow::onerror):
+        (WebCore::DOMWindow::setOnerror):
+        (WebCore::DOMWindow::onfocus):
+        (WebCore::DOMWindow::setOnfocus):
+        (WebCore::DOMWindow::onkeydown):
+        (WebCore::DOMWindow::setOnkeydown):
+        (WebCore::DOMWindow::onkeypress):
+        (WebCore::DOMWindow::setOnkeypress):
+        (WebCore::DOMWindow::onkeyup):
+        (WebCore::DOMWindow::setOnkeyup):
+        (WebCore::DOMWindow::onload):
+        (WebCore::DOMWindow::setOnload):
+        (WebCore::DOMWindow::onmousedown):
+        (WebCore::DOMWindow::setOnmousedown):
+        (WebCore::DOMWindow::onmousemove):
+        (WebCore::DOMWindow::setOnmousemove):
+        (WebCore::DOMWindow::onmouseout):
+        (WebCore::DOMWindow::setOnmouseout):
+        (WebCore::DOMWindow::onmouseover):
+        (WebCore::DOMWindow::setOnmouseover):
+        (WebCore::DOMWindow::onmouseup):
+        (WebCore::DOMWindow::setOnmouseup):
+        (WebCore::DOMWindow::onmousewheel):
+        (WebCore::DOMWindow::setOnmousewheel):
+        (WebCore::DOMWindow::onreset):
+        (WebCore::DOMWindow::setOnreset):
+        (WebCore::DOMWindow::onresize):
+        (WebCore::DOMWindow::setOnresize):
+        (WebCore::DOMWindow::onscroll):
+        (WebCore::DOMWindow::setOnscroll):
+        (WebCore::DOMWindow::onsearch):
+        (WebCore::DOMWindow::setOnsearch):
+        (WebCore::DOMWindow::onselect):
+        (WebCore::DOMWindow::setOnselect):
+        (WebCore::DOMWindow::onsubmit):
+        (WebCore::DOMWindow::setOnsubmit):
+        (WebCore::DOMWindow::onunload):
+        (WebCore::DOMWindow::setOnunload):
+        (WebCore::DOMWindow::onbeforeunload):
+        (WebCore::DOMWindow::setOnbeforeunload):
+        (WebCore::DOMWindow::onwebkitanimationstart):
+        (WebCore::DOMWindow::setOnwebkitanimationstart):
+        (WebCore::DOMWindow::onwebkitanimationiteration):
+        (WebCore::DOMWindow::setOnwebkitanimationiteration):
+        (WebCore::DOMWindow::onwebkitanimationend):
+        (WebCore::DOMWindow::setOnwebkitanimationend):
+        (WebCore::DOMWindow::onwebkittransitionend):
+        (WebCore::DOMWindow::setOnwebkittransitionend):
+        * page/DOMWindow.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::onabort):
+        (WebCore::SVGElementInstance::setOnabort):
+        (WebCore::SVGElementInstance::onblur):
+        (WebCore::SVGElementInstance::setOnblur):
+        (WebCore::SVGElementInstance::onchange):
+        (WebCore::SVGElementInstance::setOnchange):
+        (WebCore::SVGElementInstance::onclick):
+        (WebCore::SVGElementInstance::setOnclick):
+        (WebCore::SVGElementInstance::oncontextmenu):
+        (WebCore::SVGElementInstance::setOncontextmenu):
+        (WebCore::SVGElementInstance::ondblclick):
+        (WebCore::SVGElementInstance::setOndblclick):
+        (WebCore::SVGElementInstance::onerror):
+        (WebCore::SVGElementInstance::setOnerror):
+        (WebCore::SVGElementInstance::onfocus):
+        (WebCore::SVGElementInstance::setOnfocus):
+        (WebCore::SVGElementInstance::oninput):
+        (WebCore::SVGElementInstance::setOninput):
+        (WebCore::SVGElementInstance::onkeydown):
+        (WebCore::SVGElementInstance::setOnkeydown):
+        (WebCore::SVGElementInstance::onkeypress):
+        (WebCore::SVGElementInstance::setOnkeypress):
+        (WebCore::SVGElementInstance::onkeyup):
+        (WebCore::SVGElementInstance::setOnkeyup):
+        (WebCore::SVGElementInstance::onload):
+        (WebCore::SVGElementInstance::setOnload):
+        (WebCore::SVGElementInstance::onmousedown):
+        (WebCore::SVGElementInstance::setOnmousedown):
+        (WebCore::SVGElementInstance::onmousemove):
+        (WebCore::SVGElementInstance::setOnmousemove):
+        (WebCore::SVGElementInstance::onmouseout):
+        (WebCore::SVGElementInstance::setOnmouseout):
+        (WebCore::SVGElementInstance::onmouseover):
+        (WebCore::SVGElementInstance::setOnmouseover):
+        (WebCore::SVGElementInstance::onmouseup):
+        (WebCore::SVGElementInstance::setOnmouseup):
+        (WebCore::SVGElementInstance::onmousewheel):
+        (WebCore::SVGElementInstance::setOnmousewheel):
+        (WebCore::SVGElementInstance::onbeforecut):
+        (WebCore::SVGElementInstance::setOnbeforecut):
+        (WebCore::SVGElementInstance::oncut):
+        (WebCore::SVGElementInstance::setOncut):
+        (WebCore::SVGElementInstance::onbeforecopy):
+        (WebCore::SVGElementInstance::setOnbeforecopy):
+        (WebCore::SVGElementInstance::oncopy):
+        (WebCore::SVGElementInstance::setOncopy):
+        (WebCore::SVGElementInstance::onbeforepaste):
+        (WebCore::SVGElementInstance::setOnbeforepaste):
+        (WebCore::SVGElementInstance::onpaste):
+        (WebCore::SVGElementInstance::setOnpaste):
+        (WebCore::SVGElementInstance::ondragenter):
+        (WebCore::SVGElementInstance::setOndragenter):
+        (WebCore::SVGElementInstance::ondragover):
+        (WebCore::SVGElementInstance::setOndragover):
+        (WebCore::SVGElementInstance::ondragleave):
+        (WebCore::SVGElementInstance::setOndragleave):
+        (WebCore::SVGElementInstance::ondrop):
+        (WebCore::SVGElementInstance::setOndrop):
+        (WebCore::SVGElementInstance::ondragstart):
+        (WebCore::SVGElementInstance::setOndragstart):
+        (WebCore::SVGElementInstance::ondrag):
+        (WebCore::SVGElementInstance::setOndrag):
+        (WebCore::SVGElementInstance::ondragend):
+        (WebCore::SVGElementInstance::setOndragend):
+        (WebCore::SVGElementInstance::onreset):
+        (WebCore::SVGElementInstance::setOnreset):
+        (WebCore::SVGElementInstance::onresize):
+        (WebCore::SVGElementInstance::setOnresize):
+        (WebCore::SVGElementInstance::onscroll):
+        (WebCore::SVGElementInstance::setOnscroll):
+        (WebCore::SVGElementInstance::onsearch):
+        (WebCore::SVGElementInstance::setOnsearch):
+        (WebCore::SVGElementInstance::onselect):
+        (WebCore::SVGElementInstance::setOnselect):
+        (WebCore::SVGElementInstance::onselectstart):
+        (WebCore::SVGElementInstance::setOnselectstart):
+        (WebCore::SVGElementInstance::onsubmit):
+        (WebCore::SVGElementInstance::setOnsubmit):
+        (WebCore::SVGElementInstance::onunload):
+        (WebCore::SVGElementInstance::setOnunload):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Approved by Mark Rowe, Cameron Zwarich, Oliver Hunt, and Ojan Vafai.
+        
+        Used svn merge to roll out revisions 42678, 42690, 42694, 42697 because
+        they broke the Tiger and Windows buildbots.
+
+        * css/html4.css:
+        * css/themeWin.css:
+        * platform/graphics/SimpleFontData.cpp:
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        * rendering/RenderTextControl.cpp:
+        * rendering/RenderTextControlMultiLine.cpp:
+        * rendering/RenderTextControlSingleLine.cpp:
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+
+        One last loose end, discovered using COLLECT_ON_EVERY_ALLOCATION, for
+        https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark): Don't ASSERT that an ElementInstance's
+        correspondingElement has a JS wrapper. If a GC falls exactly between the
+        allocation of the ElementInstance wrapper and the correspondingElement
+        wrapper, the correspondingElement won't have a wrapper at the time we
+        mark the ElementInstance's wrapper.
+
+2009-04-20  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe
+
+        Clean builds are broken on case-sensitive filesystems.  Let's fix, shall we?
+
+        * platform/graphics/SimpleFontData.cpp: Remove "String.h" include.  Ojan probably intended to include
+          "PlatformString.h" which was unnecessary because it is pulled in through other headers.  This wasn't a 
+          build failure on case-insensitive file systems because those systems would find the system <string.h>, averting
+          the warning.
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Last patch for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Converted "lazy" event listeners to be unprotected, just like all the others.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::virtualIsInline):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::isInline): Merged JSAbstractEventListener
+        into JSEventListener. Now that the only difference between JSEventListener
+        and JSLazyEventListener is that JSLazyEventListener compiles lazily,
+        there's no need for an abstract base class.
+
+        * bindings/js/JSLazyEventListener.cpp: Converted JSLazyEventListener to
+        inherit from JSEventListener and match its un-GC-protected behavior.
+        (WebCore::JSLazyEventListener::JSLazyEventListener): ditto
+        (WebCore::JSLazyEventListener::parseCode): ditto
+        (WebCore::createInlineEventListener): When creating a lazy event listener,
+        ensure that the related node has a JS wrapper to mark the listener. Since
+        the parser makes these listeners, it's possible that no JS reference has
+        been made to the node yet.
+        * bindings/js/JSLazyEventListener.h: ditto
+
+        * dom/EventListener.h:
+        (WebCore::EventListener::clearJSFunction): Removed an usused function.
+
+2009-04-20  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25299
+        Don't bound caret to root line box if it is still inside its containing block
+        
+        Can't yet write tests for behavior of non-standard caret widths.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect):
+
+2009-04-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Separate JavaScriptCore.dll from WebKit.dll.
+        Slight performance improvement or no change on benchmarks.
+        
+        Allows us to break a circular dependency between CFNetwork and WebKit on Windows,
+        and simplifies standalone JavaScriptCore builds.
+
+        Reviewed by Oliver Hunt.
+
+        * config.h: Specify __declspec(dllexport/dllimport) appropriately when exporting data.
+
+2009-04-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6722845> In the Cocoa event model, NPWindow's window field should be null
+
+        * bridge/npapi.h:
+        (_NPCocoaEvent::):
+        Add a CGContextRef member to the draw struct. Add an NPCoordinateSpace enum.
+        
+        * plugins/npfunctions.h:
+        Add a prototype for NPN_ConvertPoint.
+
+2009-04-10  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Make textarea and text input metrics more closely match IEs.
+        https://bugs.webkit.org/show_bug.cgi?id=15312
+
+        This involves:
+        -set text input width to size*avgCharWidth + maxCharWidth - avgCharWidth
+        -set textarea width to cols*avgCharWidth
+        -Make default CSS match IEs
+        -Correctly initializing m_avgCharWidth and m_maxCharWidth for each platform and SVG.
+
+        Those values for textarea and inputs were derived by doing a ton of manual
+        testing of IE's width values for various textareas and fonts.
+
+        To get the average and max character width of a font, we do the following
+        for each platform:
+        -Win: TextMetrics expose avgCharWidth and maxCharWidth
+        -SVG: avgCharWidth = width of an '0', fallback on width of a space glyph, then m_xHeight
+            maxCharWidth = width of a 'W' for roman fonts, fallback on m_ascent
+        -Linux: avgCharWidth = width of an '0', fallback on m_xHeight
+            maxCharWidth = max of avgCharWidth and m_ascent
+        -Mac: look in the OS/2 table for avgCharWidth and grab the maxCharWidth off the font.
+            If either one is not there, then calculate the value using the Linux approach.
+
+        Linux ports could probably dig into the OS/2 table as well, but I'll leave
+        that up to them to implement.
+
+        Tests: fast/forms/text-control-intrinsic-widths.html
+               fast/forms/textarea-metrics.html
+               svg/custom/svg-fonts-in-text-controls.html
+
+        * css/html4.css:
+        * css/themeWin.css:
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        (WebCore::SimpleFontData::initCharWidths):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::maxCharWidth):
+        (WebCore::SimpleFontData::avgCharWidth):
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::initGDIFont):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::calcPrefWidths):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+
+2009-04-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove m_absoluteBounds hack from SVG renderers and move outlineBoundsForRepaint into RenderSVGModelObject
+        https://bugs.webkit.org/show_bug.cgi?id=25276
+
+        This also exposed a buggy paint check in RenderSVGContainer::layout()
+        we should repaint if we are self painting OR if our kids changed, not AND.
+
+        Writing real outlineBoundsForRepaint required writing a mapLocalToContainer() function
+
+        No functional changes, thus no tests.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::localToParentTransform):
+        (WebCore::RenderPath::layout):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::mapLocalToContainer):
+        (WebCore::RenderSVGModelObject::outlineBoundsForRepaint):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::localToParentTransformWithoutCSSParentOffset):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+
+2009-04-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=25282
+        
+        outlineBoundsForRepaint() should compute a quad relative to the
+        repaintContainer. This fixes the repaint issues originally fixed in
+        https://bugs.webkit.org/show_bug.cgi?id=12885 for elements in compositing layers.
+        Failure was only apparent when building with ACCELERATED_COMPOSITING enabled.
+
+        Tests: compositing/repaint/content-into-overflow.html
+               compositing/repaint/overflow-into-content.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::outlineBoundsForRepaint):
+
+2009-04-20  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Tim Hatcher.
+
+        Add licenses for xcconfig files.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+        * Configurations/WebCore.xcconfig:
+
+2009-04-20  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25261
+        Implement the V8 binding for DOMWindow.event similarly to JSC, by using
+        the custom getter boilerplate from the IDL file. 
+        Also, stub out DOMWindow.crypto which is defined by the idl.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-04-20  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25243
+        Crash when data:// loads are cancelled
+
+        Properly handle cancellation of the load for data:// loads. This
+        fixes crashing in the followin test:
+
+        plugins/return-error-from-new-stream-callback-in-full-frame-plugin.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
+
+2009-04-19  Dan Bernstein  <mitz@apple.com>
+
+        - maybe fix release builds
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::notifyFinished):
+
+2009-04-19  Dan Bernstein  <mitz@apple.com>
+
+        - not fix release builds
+
+        * dom/Document.cpp:
+        (WebCore::Document::executeScriptSoonTimerFired):
+
+2009-04-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix <rdar://problem/6734365> REGRESSION eBay "Save this search" link
+          does nothing the second time search results are opened
+
+        Test: fast/dom/HTMLScriptElement/nested-execution.html
+
+        Instead of executing scripts as soon as they finish loading, which may
+        happen synchronously during execution of another script, defer their
+        execution until the next run loop iteration, using a queue that is
+        similar to the HTML5 notion of the "list of scripts that will execute as
+        soon as possible", and in my testing was consistent with how Firefox
+        behaved.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Initialize m_executeScriptSoonTimer.
+        (WebCore::Document::~Document): deref() script elements in
+        m_scriptsToExecuteSoon.
+        (WebCore::Document::executeScriptSoonTimerFired): Added. Executes the
+        scripts in m_scriptsToExecuteSoon and deref()s them.
+        (WebCore::Document::executeScriptSoon): Added. Appends to
+        m_scriptsToExecuteSoon and ref()s the script element, which keeps the
+        ScriptElementData alive as well.
+        * dom/Document.h:
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::ScriptElementData): Initialize m_requested.
+        (WebCore::ScriptElementData::requestScript): Set m_requested to true, to
+        prevent further load requests.
+        (WebCore::ScriptElementData::execute): Added. Moved the code from
+        notifyFinished() which should not execute synchronously here, to be
+        called by the Document on a 0-interval timer.
+        (WebCore::ScriptElementData::notifyFinished): Moved the code to
+        dispatch events and evaluate the script, which should not execute
+        synchronously, out of here.
+        (WebCore::ScriptElementData::ignoresLoadRequest): Changed to test for
+        m_requested instead of m_cachedScript, because the latter is cleared
+        before the script is evaluated.
+        * dom/ScriptElement.h:
+
+2009-04-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Antti Koivisto and Darin Adler.
+
+        <rdar://problem/6127705> Excessive memory consumption on image load failure
+
+        When we fail to decode an image we clear most of the image data, but not the
+        input data itself, which can be backed by a CFData object that itself holds onto
+        a few hundred Kbs of memory.  This patch merely ensures that this buffer gets
+        cleared.
+
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::error):
+
+2009-04-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add hooks so sudden termination will not cause loss of icons or local storage.
+        rdar://problem/5951701
+
+        * loader/icon/IconDatabase.cpp: Marked various constants static to give them
+        internal linkage.
+        (WebCore::IconDatabase::IconDatabase): Added initial value for m_syncTimer.
+        Removed unneeded initial value for m_defaultIconRecord. Changed assertion to
+        work cross-platform.
+        (WebCore::IconDatabase::wakeSyncThread): Added disableSuddenTermination, so
+        we won't terminate until the sync thread has done its thing.
+        (WebCore::IconDatabase::scheduleOrDeferSyncTimer): Added disableSuddenTermination,
+        so we won't terminate if we have an outstanding sync timer.
+        (WebCore::IconDatabase::syncTimerFired): Added enableSuddenTermination, to
+        balance the one in scheduleOrDeferSyncTimer.
+        (WebCore::IconDatabase::syncThreadMainLoop): Added enableSuddenTermination, to
+        balance the one in wakeSyncThread.
+        (WebCore::IconDatabase::deleteAllPreparedStatements): Use clear() instead of set(0).
+
+        * loader/icon/IconDatabase.h: Use a Timer instead of an OwnPtr<Timer>.
+
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::scheduleFinalSync): Added disableSuddenTermination.
+        (WebCore::LocalStorageArea::scheduleItemForSync): Ditto.
+        (WebCore::LocalStorageArea::scheduleClear): Ditto.
+        (WebCore::LocalStorageArea::syncTimerFired): Added a disableSuddenTermination if
+        we schedule a performSync callback for later and an unconditional
+        enableSuddenTermination to balance the ones in the schedule calls above.
+        (WebCore::LocalStorageArea::sync): Factored out the work of the sync function so it
+        can continue to use early return idiom.
+        (WebCore::LocalStorageArea::performSync): Added a call to enableSuddenTermination.
+
+        * storage/LocalStorageArea.h: Added declaration of the sync function.
+
+2009-04-19  David Kilzer  <ddkilzer@apple.com>
+
+        Make FEATURE_DEFINES completely dynamic
+
+        Reviewed by Darin Adler.
+
+        Make FEATURE_DEFINES depend on individual ENABLE_FEATURE_NAME
+        variables for each feature, making it possible to remove all
+        knowledge of FEATURE_DEFINES from build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig: Extract a variable
+        from FEATURE_DEFINES for each feature setting.
+
+2009-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Removed a little more complexity from event handler creation and destruction.
+        
+        Removed the jsProtectedEventListeners, jsProtectedInlineEventListeners,
+        and jsInlineEventListeners maps, and all the code for managing them.
+        
+        ProtectedEventListeners don't exist anymore, so they're easy to nix.
+        
+        Inline EventListeners do still exist, but there's no reason to track
+        them in a map. The map exists to enable 'removeEventListener' to associate
+        a unique JSEventListener with a given JavaScript function. But the
+        'removeEventListener' API only works with non-inline event listeners!
+        
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::createJSInlineEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::clearJSFunctionInline):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::~JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-18  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Windows build
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::characterAfter):
+
+2009-04-18  Dan Bernstein  <mitz@apple.com>
+
+        - revert the previous change, which was to a file that the Windows
+          port does not even use
+
+        * icu/unicode/utf16.h:
+
+2009-04-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        - try to fix the Windows build
+
+        * icu/unicode/utf16.h:
+
+2009-04-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25066
+        
+        When a <video> element gained a RenderLayer via opacity, reflection etc., the
+        layer hierarchy was not correctly updated because RenderMedia skipped a level
+        when asked for its children; it skipped m_controlsShadowRoot's renderer, which
+        actually has a layer.
+
+        Test: fast/layers/video-layer.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlShadowRootElement::MediaControlShadowRootElement):
+        Don't manually call setParent() on the renderer. It will happen later
+        as a result of addChild().
+        
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createControlsShadowRoot):
+        Add m_controlsShadowRoot's renderer as a child. 
+
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::children):
+        Now maintain a RenderObjectChildList, m_children, and remove the unneeded
+        removeChild() method. Make the two children() methods inline.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::moveLayers):
+        Assert if moveLayers() is called with an oldParent that is not the
+        layer's actual parent (which would have revealed this bug).
+
+2009-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixed a layout test failure, caused by my last check-in
+        (fast/dom/script-element-gc.html).
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        * html/HTMLScriptElement.h:
+        (WebCore::HTMLScriptElement::haveFiredLoadEvent): Treat script elements
+        just like image elements: if a script element is loading, mark its JS
+        wrapper, even if the element is not in the document.
+
+2009-04-18  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25170
+        Upstream V8WorkerCustom.cpp and V8WorkerContextCustom.cpp for V8 bindings.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp: Added.
+        * bindings/v8/custom/V8WorkerCustom.cpp: Added.
+
+2009-04-18  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/post_bug.cg://bugs.webkit.org/show_bug.cgi?id=25167 
+        Change createHiddenXHRDependency and removeHiddenXHRDependency so that they can be used by other custom code in V8 bindings.
+
+        * bindings/v8/V8Utilities.cpp: Renamed from WebCore/bindings/v8/V8XMLHttpRequestUtilities.cpp.
+        (WebCore::createHiddenDependency):
+        (WebCore::removeHiddenDependency):
+        * bindings/v8/V8Utilities.h: Renamed from WebCore/bindings/v8/V8XMLHttpRequestUtilities.h.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-04-18  Drew Wilson  <amw@apple.com>
+
+        <rdar://problem/6781407> VisiblePosition.characterAfter should return UChar32
+
+        Reviewed by Dan Bernstein.
+
+        No test case since there is no change in behavior.
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::characterAfter): Now handles surrogate
+        pairs correctly and returns a UChar32.
+        * editing/VisiblePosition.h:
+        (WebCore::VisiblePosition::characterBefore): Now returns a UChar32.
+        * editing/visible_units.cpp:
+        (WebCore::endOfFirstWordBoundaryContext): Renamed
+        firstNonComplexContextLineBreak() to this. Changed it to use the
+        generic requiresContextForWordBoundary() instead of
+        hasLineBreakingPropertyComplexContext().
+        (WebCore::startOfLastWordBoundaryContext): Replaces
+        lastNonComplexContextLineBreak(), but returns the offset of
+        the character after the last character that does not require
+        context for word breaking. Also changed to use
+        requiresContextForWordBoundary().
+        (WebCore::previousBoundary): Updated for the above changes in
+        names and semantics, and changed to use
+        requiresContextForWordBoundary().
+        (WebCore::nextBoundary): Ditto.
+        (WebCore::startWordBoundary): Ditto.
+        (WebCore::endWordBoundary): Ditto.
+        (WebCore::previousWordPositionBoundary): Ditto.
+        (WebCore::nextWordPositionBoundary): Ditto.
+        * platform/text/TextBoundaries.h:
+        (WebCore::requiresContextForWordBoundary): Added.
+        * platform/text/mac/TextBoundaries.mm:
+
+2009-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixed <rdar://problem/6797442> | https://bugs.webkit.org/show_bug.cgi?id=25285
+        REGRESSION (r42569): Profiles cannot be selected in inspector profiler
+        
+        EventListeners are shared; RegisteredEventListeners are not. Therefore,
+        when a node wrapper needs to invalidate the node's JS event listeners,
+        it should invalidate its RegisteredEventListeners, not its EventListeners.
+        Otherwise, it might invalidate an EventListener shared by another node.
+
+        * dom/RegisteredEventListener.h:
+        (WebCore::invalidateEventListeners): ditto
+
+2009-04-18  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6781295> video.buffered and video.seekable are not
+        the same. video.buffered should return only what is buffered and
+        not what is seekable
+
+        * WebCore.base.exp: Added wkQTMovieMaxTimeSeekable.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Return wkQTMovieMaxTimeSeekable.
+
+        * platform/mac/WebCoreSystemInterface.h: Add wkQTMovieMaxTimeSeekable.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+2009-04-18  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6747241> work around QTKit no longer reaching
+        QTMovieLoadStateComplete
+
+        * WebCore.base.exp: Export wkQTMovieMaxTimeLoadedChangeNotification.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie): observe QTMovieMaxTimeLoadedChangeNotification.
+        (WebCore::MediaPlayerPrivate::updateStates): compare duuration() with maxTimeLoaded() instead of
+        using QTMovieLoadStateComplete to determine if a movie are fully loaded.
+
+        * platform/mac/WebCoreSystemInterface.h: Add wkQTMovieMaxTimeLoadedChangeNotification.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+2009-04-18  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Make WML work again, most regressions test were failing.
+
+        * dom/Document.cpp: Be sure to create WML elements in WML namespace. Otherwhise hasTagName() comparisions fail.
+        (WebCore::Document::createElement):
+        * wml/WMLCardElement.cpp: Add ASSERT(hasTagName(cardTag)) to catch errors like this in future.
+        (WebCore::WMLCardElement::WMLCardElement):
+        * wml/WMLTagNames.in: Wrap comment in #if 0/#endif blocks, to silence the generation script.
+
+2009-04-17  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25277
+        If there is no line wrapping, a caret can leave its containing block but it shouldn't leave its root line box
+        
+        Also added code to handle a caret wider than one pixel.
+        
+        Added fast/inline/25277.html and fast/inline/25277-2.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect): Distribute a caret's width to either side of the offset,
+        so that a caret between two characters doesn't hang over one character more than the other.
+        If there is no wrapping, the caret can leave its containing block, but not its root line box.
+
+2009-04-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Some refactoring of "inline" event listeners.
+        
+        Renames:
+            dispatchEventForType => dispatchEvent
+            setWindowInlineEventListenerForTypeAndAttribute => setWindowInlineEventListener
+            removeInlineEventListenerForType => clearInlineEventListener
+            setInlineEventListenerForType => setInlineEventListener
+            inlineEventListenerForType => getInlineEventListener
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::eventParameterName):
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::createInlineEventListener):
+        * bindings/js/JSLazyEventListener.h: Added two helper functions for
+        creating "inline" event listeners. These replace Document::createEventListener,
+        and abstract the creation of JS event listeners for DOM attributes out
+        of the DOM. Removed legacy JSProtectedEventListener constructor code for
+        adding the event listener's function to a map, since lazy event listeners
+        don't have functions at construction time.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Document.h:
+        (WebCore::Document::isSVGDocument):
+        * dom/Element.cpp:
+        (WebCore::Element::setWindowInlineEventListener):
+        * dom/Element.h: Updated for renames. Nixed Document::createEventListener,
+        mentioned above. Moved setWindowInlineEventListenerForTypeAndAttribute
+        to Element, for simplicity.
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::clearInlineEventListener):
+        (WebCore::Node::setInlineEventListener):
+        (WebCore::Node::getInlineEventListener):
+        (WebCore::Node::onabort):
+        (WebCore::Node::setOnabort):
+        (WebCore::Node::etc.):
+        * dom/Node.h: Updated for renames.
+        
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment): Updated for renames.
+        
+        Updated these files for renames, and to use the new createInlineEventListener
+        helper function:
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::onChange):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::reset):
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadInternal):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        * page/DOMWindow.cpp:
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::eventListeners):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::sendScrollEvent):
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
+        * svg/SVGElementInstance.cpp:
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchErrorEvent):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        Simplify FEATURE_DEFINES definition
+
+        Reviewed by Darin Adler.
+
+        This moves FEATURE_DEFINES and its related ENABLE_FEATURE_NAME
+        variables to their own FeatureDefines.xcconfig file.  It also
+        extracts a new ENABLE_GEOLOCATION variable so that
+        FEATURE_DEFINES only needs to be defined once.
+
+        * Configurations/FeatureDefines.xcconfig: Added.
+        * Configurations/WebCore.xcconfig: Removed definition of
+        ENABLE_SVG_DOM_OBJC_BINDINGS and FEATURE_DEFINES.  Added include
+        of FeatureDefines.xcconfig.
+        * WebCore.xcodeproj/project.pbxproj: Added
+        FeatureDefines.xcconfig file.
+        * bindings/scripts/CodeGeneratorObjC.pm: When creating a list of
+        command-line macro definitions, split on one-or-more spaces
+        instead of a single space since the FEATURE_DEFINES macro may
+        now contain more than one space between macros if some macros
+        aren't defined.
+
+2009-04-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mark Rowe
+
+        <rdar://problem/6786999> Tiger WebKit shouldn't try to POST on back/forward without nagging.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::willLoadFromCache):
+
+2009-04-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Added sudden termination functions that can be called without involving
+        the page or client.
+
+        * GNUmakefile.am: Added SuddenTermination.h.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto. Also added SuddenTermination.mm.
+
+        * platform/SuddenTermination.h: Added.
+        * platform/mac/SuddenTermination.mm: Added.
+
+2009-04-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Move more code into RenderSVGModelObject
+
+        needsLayer() already returns false from RenderSVGModelObject
+        lineHeight and baselinePosition are from days of RenderPath having RenderBox parents.
+
+        I also added comments to explain how focus rings work (now that I understand)
+        I got rid of two more uses of m_absoluteBounds (nearly dead!)
+
+        * rendering/RenderPath.cpp:
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::addFocusRingRects):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::absoluteRects):
+        (WebCore::RenderSVGModelObject::absoluteQuads):
+        * rendering/RenderSVGModelObject.h:
+
+2009-04-16  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25238
+        Invalidate the hovered scrollbar part when resetting the pressed part,
+        since once there is no pressed part we can draw a hovered state.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setHoveredPart):
+        (WebCore::Scrollbar::setPressedPart):
+
+2009-04-16  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25223
+        REGRESSION: Back button after form submission to the same URL fails to navigate.
+
+        Test: http/tests/navigation/post-goback-same-url.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Check if the page we are leaving has
+        FormData.
+
+2009-04-17  Nikolas Zimmermann  <nikolas.zimmerman@torchmobile.com>
+
+        Not reviewed. Fix WML enabled builds.
+
+        * rendering/RenderTableRow.cpp: Remove dead code, which is no longer necessary.
+        (WebCore::RenderTableRow::addChild):
+        * wml/WMLInputElement.cpp: Apply same fix HTMLInputElement received. Covert RenderObject's to RenderTextControl where needed.
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-04-17  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24849
+
+        Add support for the media element 'played' attribute.
+        This involves support of "normalized TimeRanges" as described by
+        the spec.
+
+        Test: media/video-played.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Renamed 
+        m_currentTimeDuringSeek->m_lastSeekTime. Added m_playing and m_playedTimeRanges.
+        (WebCore::HTMLMediaElement::loadInternal): Reset m_playing, m_lastSeekTime, and
+        m_playedTimeRanges
+        (WebCore::HTMLMediaElement::seek): Set current time to m_playedTimeRanges
+        (WebCore::HTMLMediaElement::currentTime): m_currentTimeDuringSeek -> m_lastSeekTime
+        (WebCore::HTMLMediaElement::played): Returns m_playedTimeRanges.
+        (WebCore::HTMLMediaElement::updatePlayState): Add the new played time ranges when pausing. 
+        Set the m_playing flag.
+        * html/HTMLMediaElement.h:
+
+        * html/TimeRanges.cpp:
+        (TimeRanges::add): Merge range(s) if overlap.
+        * html/TimeRanges.h: Add various helpers (below).
+        (WebCore::TimeRanges::Range::isPointInRange): Added.
+        (WebCore::TimeRanges::Range::isOverlappingRange): Ditto.
+        (WebCore::TimeRanges::Range::unionWithOverlappingRange): Ditto.
+        (WebCore::TimeRanges::Range::isBeforeRange): Ditto.
+
+2009-04-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Bug 25210: don't use ObjC methods to wrap/unwrap DOM objects with ObjC
+        https://bugs.webkit.org/show_bug.cgi?id=25210
+
+        * WebCore.base.exp: Export the core and kit function overloads that are used
+        in WebKit. Also resorted this file.
+
+        * WebCore.xcodeproj/project.pbxproj: Re-added DOMHTMLCanvasElement.h to fix
+        a strange problem with the file type.
+
+        * bindings/objc/DOM.mm: Removed the many extraneous includes. Added new includes
+        so we can use and implement the new core and kit functions. Import DOMInternal.h
+        first so it can do its public/private magic.
+        (-[DOMNode _rootObject]): Changed to use early-return style.
+        (kitClass): Added. Tells the wrapper generator what kind of node class to create
+        to wrap DOM nodes. This has the code that used to be in the _wrapNode method.
+        (kit): Added. Takes an EventTarget and makes the appropriate type of wrapper,
+        dpending on whether it's a Node or an SVGElementInstance. This replace methods
+        that used to be on both of those classes.
+        (-[DOMNode boundingBox]): Changed to use early return, and the core function.
+        (-[DOMNode lineBoxRects]): Ditto.
+        (-[DOMNode renderedImage]): Ditto.
+        (-[DOMRange boundingBox]): Ditto.
+        (-[DOMRange lineBoxRects]): Ditto.
+        (-[DOMElement image]): Ditto.
+        (-[DOMElement _font]): Ditto.
+        (-[DOMElement _imageTIFFRepresentation]): Ditto.
+        (-[DOMElement _getURLAttribute:]): Ditto.
+        (-[DOMElement isFocused]): Ditto.
+        (kit): Hand-wrote the version of this for NodeFilter, since it's a protocol,
+        not a class in the binding.
+        (core): Ditto.
+        (-[DOMNodeFilter acceptNode:]): Use core.
+
+        * bindings/objc/DOMAbstractView.mm:
+        (-[DOMAbstractView document]): Use kit.
+        (-[DOMAbstractView _disconnectFrame]): Call removeDOMWrapper, which is no longer
+        in the WebCore namespace, since it's headed for WebKit in the future.
+        (core): Hand-wrote the version of this for DOMAbstractView.mm, since we store
+        a pointer to the Frame, not the DMWindow.
+        (kit): Ditto.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass): Added. Tells the wrapper generator what kind of node class to create
+        to wrap CSS objects. This has the code that used to be in the _wrapStyleSheet,
+        _wrapCSSRule, and _wrapCSSValue methods.
+
+        * bindings/objc/DOMEvents.mm:
+        (kitClass): Added. Tells the wrapper generator what kind of node class to create
+        to wrap event objects. This has the code that used to be in the _wrapEvent methods.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLDocument createDocumentFragmentWithMarkupString:baseURL:]): Use kit and core.
+        (-[DOMHTMLDocument createDocumentFragmentWithText:]): Ditto.
+        (-[DOMHTMLDocument _createDocumentFragmentWithMarkupString:baseURLString:]): Ditto.
+        (-[DOMHTMLInputElement _rectOnScreen]): Ditto.
+        (-[DOMHTMLInputElement _replaceCharactersInRange:withString:selectingFromIndex:]): Ditto.
+        (-[DOMHTMLInputElement _selectedRange]): Ditto.
+        (-[DOMHTMLInputElement _setAutofilled:]): Ditto.
+        (-[DOMHTMLSelectElement _activateItemAtIndex:]): Ditto.
+        (-[DOMHTMLInputElement _isEdited]): Ditto.
+        (-[DOMHTMLTextAreaElement _isEdited]): Ditto.
+        (kitClass): Added. Gives HTMLOptionCollection objects an appropriate wrapper.
+
+        * bindings/objc/DOMInternal.h: Removed most of the imports. There's no reason
+        to have this header include all the other internal DOM headers. Removed unneeded
+        interfaces, including the redeclaration of _init in DOMObject, since it's already
+        inherited from WebScriptObject. Moved all the functions out of the WebCore
+        namespace since this code is destined for WebKit, which doesn't use a namespace.
+        Added kit and core functions for the two classes that live in this header.
+
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]): Use core.
+
+        * bindings/objc/DOMObject.h: Made the _internal field be private instead of
+        protected. This also allows the "#define private public" trick to be used to
+        make the field accessible inside the bindings code.
+
+        * bindings/objc/DOMObject.mm:
+        (-[DOMObject dealloc]): Updated for namespace change.
+        (-[DOMObject sheet]): Use core and kit functions.
+
+        * bindings/objc/DOMRGBColor.mm:
+        (-[DOMRGBColor dealloc]): Updated for namespace change.
+        (-[DOMRGBColor red]): Use kit function.
+        (-[DOMRGBColor green]): Ditto.
+        (-[DOMRGBColor blue]): Ditto.
+        (-[DOMRGBColor alpha]): Ditto.
+        (core): Added. Replaces the _RGBColor method.
+        (kit): Added. Replaces the _wrapRGBColor method.
+
+        * bindings/objc/DOMSVGPathSegInternal.mm:
+        (kitClass): Added. Replaces the _wrapSVGPathSeg method.
+
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper): Use kit function.
+        (createDOMWrapper): Ditto.
+
+        * bindings/objc/DOMXPath.mm:
+        (core): Added. Replaces the _xpathNSResolver method.
+        (kit): Added. Replaces the _wrapXPathNSResolver method.
+
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::find): Changed to use early return.
+        (WebCore::ObjCEventListener::handleEvent): Use kit function.
+
+        * bindings/objc/ObjCNodeFilterCondition.mm:
+        (WebCore::ObjCNodeFilterCondition::acceptNode): Use kit function.
+
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject scriptObjectForJSObject:originRootObject:rootObject:]):
+        Updated for namespace change.
+
+        * bindings/scripts/CodeGeneratorObjC.pm: Changed spelling of "license"
+        to U.S. spelling. Removed GetObjCTypeMaker, GetObjCTypeGetterName,
+        GetInternalTypeGetterSignature, and GetInternalTypeMakerSignature.
+        Changed includes to conform to new scheme. Generate core and kit
+        functions instead of methods and calls to those functions. Added a new
+        attribute, Polymorphic, to indicate classes that have derived subclasses.
+        Removed the old ObjCCustomInternalImpl attribute.
+
+        * css/CSSRule.idl: Use Polymorphic attribute, so core and kit functions
+        will be generated, with kit calling kitClass. This requires less hand-
+        written code than the old ObjCCustomInternalImpl.
+        * css/CSSValue.idl: Ditto.
+        * css/StyleSheet.idl: Ditto.
+        * dom/Event.idl: Ditto.
+        * dom/Node.idl: Ditto.
+        * html/HTMLCollection.idl: Ditto.
+        * svg/SVGPathSeg.idl: Ditto.
+
+        * editing/TextAffinity.h: Moved kit and core functions out of the
+        WebCore namespace since this code is destined for WebKit, which
+        doesn't use a namespace
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::declareAndWriteDragImage): Use kit function.
+
+        * platform/mac/DragDataMac.mm:
+        (WebCore::DragData::asFragment): Use core function.
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection): Use kit function.
+
+        * svg/SVGElementInstance.idl: Removed now-unneeded ObjCCustomInternalImpl
+        function. This can be generated in a standard way now.
+        * svg/SVGViewSpec.idl: Ditto.
+
+2009-04-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak
+
+        <rdar://problem/5753299> "Private Browsing" doesn't affect HTML 5 Database storage
+
+        If the Page is in private browsing mode when a statement is queued up, flag that 
+        statement as read-only.
+
+        It would be better to set the read-only flag on the database thread when it actually
+        executes, but that would either require making Settings access a lock-protected operation
+        or involve a synchronous callback to the WebCore thread, neither of which seem worth it.
+        If it becomes an issue in practice, we can revisit this later.
+
+        Test: storage/private-browsing-readonly.html
+
+        * storage/Database.cpp:
+        (WebCore::Database::setAuthorizerReadOnly):
+        * storage/Database.h:
+
+        * storage/DatabaseAuthorizer.cpp:  For all action types that would alter the database,
+          deny when in read-only mode.
+        (WebCore::DatabaseAuthorizer::reset):
+        (WebCore::DatabaseAuthorizer::createTable):
+        (WebCore::DatabaseAuthorizer::dropTable):
+        (WebCore::DatabaseAuthorizer::allowAlterTable):
+        (WebCore::DatabaseAuthorizer::createIndex):
+        (WebCore::DatabaseAuthorizer::dropIndex):
+        (WebCore::DatabaseAuthorizer::createTrigger):
+        (WebCore::DatabaseAuthorizer::dropTrigger):
+        (WebCore::DatabaseAuthorizer::createVTable):
+        (WebCore::DatabaseAuthorizer::dropVTable):
+        (WebCore::DatabaseAuthorizer::allowDelete):
+        (WebCore::DatabaseAuthorizer::allowInsert):
+        (WebCore::DatabaseAuthorizer::allowUpdate):
+        (WebCore::DatabaseAuthorizer::setReadOnly):
+        * storage/DatabaseAuthorizer.h:
+
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::create): Add a m_readOnly flag.
+        (WebCore::SQLStatement::SQLStatement): Ditto.
+        (WebCore::SQLStatement::execute): If m_readOnly is set, tell the authorizer to change
+          to read-only mode.
+        * storage/SQLStatement.h:
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL): Flag the statement as read-only if the Page is
+          currently in private browsing mode.
+
+2009-04-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        Move RenderPath and RenderSVGContainer onto a unified clippedOverflowRectForRepaint
+        https://bugs.webkit.org/show_bug.cgi?id=25268
+
+        Lots of minus lines.  Now we're sharing more sane code
+        (which will respect -webkit-transforms! and scroll offsets correctly)
+
+        Which means this fixes:
+        https://bugs.webkit.org/show_bug.cgi?id=20769 and
+        https://bugs.webkit.org/show_bug.cgi?id=21968 too!
+
+        We're no longer expanding the paint rect "for anti-aliasing", since
+        I can't find a case where that's required.  If it is, repaintRectInLocalCoordinates()
+        should be fixed to handle those cases instead of here.
+
+        This fixes svg/custom/scroll-hit-test (now that we respect scroll offsets when repainting)
+        as well as improves our focus ring drawing seen in svg/custom/focus-ring
+        focus rings are now closer to transformed content by a couple pixels (they were needlessly outset by the antialiasing hack)
+        Also, it fixes the dumped rects for markers, causing a progression in svg/custom/marker-overflow-clip
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+
+2009-04-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25259: AX: VoiceOver cmd-cntl-space does not follow the google.com->more link
+        https://bugs.webkit.org/show_bug.cgi?id=25259
+  
+        When a node becomes visible or hidden, accessibility needs to be told to update.
+
+        Test: accessibility/visible-elements.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+
+2009-04-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, added missing header.
+
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+
+2009-04-17  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix.
+
+        Fix the build with enabled SVG filters
+
+        * rendering/RenderSVGModelObject.cpp: Include SVGResourceFilter.h.
+
+2009-04-16  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25196
+        Add a missing V8DOMMap include.
+
+        * bindings/v8/WorkerScriptController.cpp: Included V8DOMMap.h.
+
+2009-04-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25260
+        Finish V8 custom bindings for InspectorController.
+
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added.
+
+2009-04-16  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Switch to wxGraphicsBitmap when using wxGraphicsContext so that we're not doing
+        unnecessary conversions internally when drawing bitmaps.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25248
+
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+2009-04-16  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Performing a block style change in an editable root that contains only a br adds a newline
+        https://bugs.webkit.org/show_bug.cgi?id=25256
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary): Fix a bad check for an root
+        block that didn't handle a root that contained a placeholder.
+
+2009-04-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix computeContainerBoundingBox to respect viewport translations
+        https://bugs.webkit.org/show_bug.cgi?id=25254
+
+        Previously computeContainerBoundingBox was just adding the viewportTranslation.
+        Which, although it has a confusing name, only contains the scale and translation
+        for the viewBox/preserveAspectRatio adjustment.  It does not contain the
+        translation for the x/y offset of the viewport.
+        localToParentTransform() does contain this offset, so we use that instead
+        of the previous hacky code.
+
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::computeContainerBoundingBox):
+
+2009-04-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add a localToParentTransform() method which includes the
+        full transform between local and parent local coordinates.
+        https://bugs.webkit.org/show_bug.cgi?id=25226
+
+        Moved m_localTransform up into RenderSVGTransformableContainer
+        and added a comment to RenderSVGViewportContainer to make it more
+        clear that it does not have a localTransform().
+
+        This patch reveals two more failed design decisions:
+        1.  Use of RenderBox::absoluteTransform() to mean "absoluteTransform()
+            including only my localTransform()" callers are probably using it
+            incorrectly anyway and are just masking bugs in the confused code.
+        2.  computeContainerBoundingBox does not include viewport translations in
+            its computed bounding box, so bounding boxes will be off for parents of
+            inner <svg> elements.  I'll fix this an updated the results in a separate change.
+
+        No functional changes, thus no tests.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToParentTransform):
+        (WebCore::RenderObject::absoluteTransform):
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::viewportTransform):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.h:
+        (WebCore::RenderSVGHiddenContainer::absoluteTransform):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::localToParentTransform):
+        (WebCore::RenderSVGTransformableContainer::localTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        (WebCore::RenderSVGViewportContainer::absoluteTransform):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::computeContainerBoundingBox):
+
+2009-04-16  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Fix Chromium's rendering of <option> elements inside of <optgroups>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25244
+
+        Test (will included as a manual test by https://bugs.webkit.org/show_bug.cgi?id=24900):
+
+        <select>
+          <optgroup label="Should be bold">
+            <option>Should not be bold</option>
+          </optgroup>
+        </select>
+
+        * css/themeWin.css: adding comments
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::getRowFont): use menuStyle() rather than the item's style
+
+2009-04-16  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25218
+
+        Make DOMWindow::inlineEventListenerForType not have the "inline"
+        keyword. As this method gets used outside of DOMWindow.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::inlineEventListenerForType):
+
+2009-04-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fix <rdar://problem/6766969>
+        
+        When deferred repaints are enabled and being reset and there is a active
+        timer, stop the timer and do the deferred repaints immediately.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::resetDeferredRepaintDelay):
+
+2009-04-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25241
+        Remove superfluous NotImplemented.h includes.
+
+        * html/CanvasRenderingContext2D.cpp:
+        * html/CanvasStyle.cpp:
+        * page/AccessibilityRenderObject.cpp:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        * platform/graphics/cairo/PathCairo.cpp:
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        * platform/graphics/gtk/FontGtk.cpp:
+        * platform/graphics/gtk/IconGtk.cpp:
+        * platform/graphics/qt/IconQt.cpp:
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        * platform/graphics/skia/ImageSkia.cpp:
+        * platform/graphics/win/ColorSafari.cpp:
+        * platform/graphics/win/FontWin.cpp:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        * platform/graphics/wx/ImageWx.cpp:
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        * platform/gtk/PopupMenuGtk.cpp:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/gtk/ScrollbarGtk.cpp:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        * platform/posix/FileSystemPOSIX.cpp:
+        * platform/qt/DragDataQt.cpp:
+        * platform/qt/FileSystemQt.cpp:
+        * platform/qt/Localizations.cpp:
+        * platform/qt/PopupMenuQt.cpp:
+        * platform/win/EditorWin.cpp:
+        * platform/win/PasteboardWin.cpp:
+        * platform/wx/KeyboardEventWx.cpp:
+        * platform/wx/PopupMenuWx.cpp:
+        * platform/wx/SharedTimerWx.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+        * plugins/qt/PluginPackageQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * svg/graphics/SVGImage.cpp:
+
+2009-04-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Some cleanup in event handling code.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h: Removed findJSProtectedEventListener
+        and findJSProtectedEventListener because they are now unused.
+
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::clearGlobalObject):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::~JSLazyEventListener):
+        (WebCore::JSLazyEventListener::globalObject):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::clearGlobalObject): Nixed JSProtectedEventListener,
+        and merged it with JSLazyEventListener, the only remaining event listener
+        that still GC-protects its function and global object.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::setEventHandlerLineNumber):
+        (WebCore::ScriptController::eventHandlerLineNumber): Renamed handlerLineno =>
+        handlerLineNumber, because anything less would be uncivilized. Removed
+        createInlineEventListener because it mostly did irrelevent work, so it
+        just got in the way of understanding how event handler creation works.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createEventListener):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::processToken): Ditto.
+
+2009-04-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20765 Website 
+        crashes on load due to messy HTML in search form
+        -and corresponding-
+        <rdar://problem/6210633>
+
+        Before this patch, <form>s were allowed to sit inside tables 
+        without being wrapped by anonymous table parts. There was also a 
+        concept that such a form could be "demoted" and would not be 
+        allowed to have any children. This patch has the HTML parser mark 
+        form elements that have been demoted as such, and then the demoted 
+        forms are not given renderers. I also removed the code that allowed 
+        forms to sit in tables without anonymous table sections. So now any 
+        forms that do manage to get a renderer inside a table will also be 
+        wrapped with appropriate table parts.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::HTMLFormElement):
+        (WebCore::HTMLFormElement::rendererIsNeeded):
+        * html/HTMLFormElement.h:
+        (WebCore::HTMLFormElement::setDemoted):
+        (WebCore::HTMLFormElement::isDemoted):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::insertNode):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+
+2009-04-16  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24527
+        caret does not paint the first time you focus on a 0px right padding RTL div
+
+        Test: fast/forms/caret-rtl.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::localCaretRect): When calculating x-axis if 
+        alignment is alignRight, we need to subtract the caretWidth so that the
+        caret at IntRect(x, y, caretWidth, height) is inside the block.
+
+2009-04-16  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25228
+        SelectionController::absoluteCaretBounds returns an inflated caret (the caret repaint rect)
+        
+        Return the bounds of the transformed caret, not the transformed repaint rect for the caret (which is inflated).
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::localCaretRect):
+        (WebCore::SelectionController::absoluteBoundsForLocalRect):
+        (WebCore::SelectionController::caretRepaintRect):
+        (WebCore::SelectionController::recomputeCaretRect):
+        * editing/SelectionController.h:
+
+2009-04-16  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25187
+        Bug 25187: <video> may not be rendered upon certain racy conditions
+
+        Always create the video renderer when the load state reaches QTMovieLoadStateLoaded and
+        the element is visible, not just when the movie has just been opened.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates): Make sure we do not make false
+        assumption on the state changes order. Create the renderer if none is present,
+        when movie is loaded instead.
+
+2009-04-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add filterBoundingBox() to RenderSVGModelObject to share a tiny bit of code
+
+        RenderSVGModelObject has much more interesting code it can share,
+        but I'm just trying to get the commits out of my local branch and into
+        the repository in any order I can. :)  This one was small.
+
+        This will be used by the unified RenderSVGModelObject
+        clippedOverflowRectForRepaint patch coming soon.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::filterBoundingBox):
+        * rendering/RenderSVGModelObject.h:
+
+2009-04-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Eric Seidel and Adam Roben.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Simplified some EventHandler creation code.
+        
+        Removed a pile of code whose sole purpose was to allow SVG event handlers
+        to supply a parameter named "evt" instead of the normal "event", and
+        replaced it with a single parameter to JSLazyEventListener's constructor
+        specifying the parameter name to use.
+
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::createInlineEventListener):
+        * bindings/js/ScriptController.h:
+        * dom/Document.cpp:
+        (WebCore::Document::createEventListener):
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Split out objectBoundingBox and repaintRectInLocalCoordinates from relativeBBox
+        in preparation for simplifying (and fixing) repaint logic in the SVG rendering tree.
+        https://bugs.webkit.org/show_bug.cgi?id=25224
+
+        objectBoundingBox() matches the SVG 1.1 concept of a "bounding box"
+
+        repaintRectInLocalCoordinates() should return the a rect covering all painted content.
+        However, repaintRectInLocalCoordinates() still only returns the "stroke bounding box"
+        in this patch.  In a future patch, repaintRectInLocalCoordinates will be fixed to return
+        a rect covering all painted content.  In order to avoid changing several hundred layout test results, I've left
+        the behavior as-is for now.  The returned rect is used by various repaintRectInLocalCoordinates
+        implementations and sometimes adjusted to include all painted content, but not always, and
+        the places where the adjustments are made are sometimes wrong.  Again, will be fixed in
+        an upcoming patch.
+
+        This patch discovered a bug in Font::drawTextUsingSVGFont, which is probably causing
+        bounding-box relative gradients on SVGFont glyphs to not paint correctly.
+        I chose not to try and fix the bug in this patch and instead left a FIXME.
+
+        This patch also discovered that at least tspan.getBBox() is broken.  This
+        along with the foreignObject.getBBox() change will be tested (and fixed) in a
+        later patch.  https://bugs.webkit.org/show_bug.cgi?id=25225
+
+        No change in behavior (besides the above mentioned foreignObject.getBBox()), thus no tests.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::objectBoundingBox): this is a behavior improvement for getBBox() test case coming in a later patch
+        (WebCore::RenderForeignObject::repaintRectInLocalCoordinates): only really used for layout test results, might some day be used for repaint.
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::objectBoundingBox): new methods, ASSERT if used but not implemented.
+        (WebCore::RenderObject::repaintRectInLocalCoordinates):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::objectBoundingBox):
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::clippedOverflowRectForRepaint):
+        (WebCore::RenderPath::lineHeight):
+        (WebCore::RenderPath::baselinePosition):
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::addFocusRingRects):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::objectBoundingBox):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGGradientStop.h:
+        (WebCore::RenderSVGGradientStop::objectBoundingBox):
+        (WebCore::RenderSVGGradientStop::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::objectBoundingBox):
+        (WebCore::RenderSVGHiddenContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::objectBoundingBox):
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        (WebCore::RenderSVGImage::calculateAbsoluteBounds):
+        (WebCore::RenderSVGImage::addFocusRingRects):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::objectBoundingBox):
+        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTSpan.h:
+        (WebCore::RenderSVGTSpan::objectBoundingBox):
+        (WebCore::RenderSVGTSpan::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        (WebCore::RenderSVGText::objectBoundingBox):
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::viewportTransform):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::computeContainerBoundingBox):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * svg/SVGFont.cpp:
+        (WebCore::Font::drawTextUsingSVGFont):
+        * svg/SVGLocatable.cpp:
+        (WebCore::SVGLocatable::getBBox):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-04-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6032139> Table cell widths calculated
+          incorrectly on table that uses table-layout:fixed, colspans, and a mix
+          of percentage and pixel widths
+
+        Test: fast/table/fixed-granular-cols.html
+
+        The incorrect widths resulted from incorrect handling of the case where
+        the <col> elements are more granular than the table cells.
+
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray): When processing <col>
+        elements, append effective columns or split existing effective columns
+        as needed.
+
+2009-04-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        <rdar://problem/6795285> Infinite recursion in ResourceHandle::receivedRequestToContinueWithoutCredential
+
+        Rolled out <http://trac.webkit.org/projects/webkit/changeset/42536> - the two instances of
+        authentication challenge are different, after all. Added a FIXME comment about a possible
+        future improvement.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::clearAuthentication):
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+
+2009-04-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        Also fixed <rdar://problem/6792909> WebInspector crashes when reloading
+        a page with breakpoints set
+        
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::clearJSFunctionInline):
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h: Actually clear our function and global
+        object pointers when our client instructs us to. (Oops!) Also, mark
+        our global object while we still intend to use it.
+
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark):
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * svg/SVGElementInstance.idl: For every SVGElementInstance wrapper, ensure
+        that the corresponding element also has a wrapper, to keep its event
+        listeners alive.
+
+2009-04-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25201
+        Add ScriptFunctionCall/ScriptObject for V8.
+
+        * bindings/v8/ScriptFunctionCall.cpp: Added.
+        * bindings/v8/ScriptFunctionCall.h: Added.
+        * bindings/v8/ScriptObject.cpp: Added.
+        * bindings/v8/ScriptObject.h: Added.
+        * bindings/v8/ScriptObjectQuarantine.cpp: Added.
+        * bindings/v8/ScriptObjectQuarantine.h: Added.
+        * bindings/v8/ScriptScope.cpp: Added.
+        * bindings/v8/ScriptScope.h: Added.
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::ScriptState): Added new constructors.
+        (WebCore::ScriptState::frame): Added Frame ptr accessor.
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString): Added default constructor.
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::isEqual): Added.
+
+2009-04-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Add RenderSVGModelObject.* to GTK+'s build.
+
+        * GNUmakefile.am:
+
+2009-04-15  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6785760> WebCore should use a maximum of 6 connections per host, not 4
+
+        Reviewed by Adam Roben.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-04-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add special casing to bindings generator so that custom functions
+        starting with xml or xslt conform to WebKit style guidelines.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::xmlHttpRequest):
+        (WebCore::JSDOMWindow::xsltProcessor):
+        * bindings/scripts/CodeGenerator.pm:
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add minimal RenderSVGModelObject and make RenderPath and RenderSVGContainer use it.
+        https://bugs.webkit.org/show_bug.cgi?id=25221
+        
+        RenderSVGModelObject is the base rendering class for things which live
+        in the SVG rendering tree.  Not all SVG renders are RenderSVGModelObjects yet.
+        
+        More patches coming.  This is just adding the class, future patches
+        will pull more logic out of RenderPath and RenderSVGContainer into RenderSVGModelObject.
+
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::RenderPath):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::RenderSVGContainer):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp: Added.
+        (WebCore::RenderSVGModelObject::RenderSVGModelObject):
+        * rendering/RenderSVGModelObject.h: Added.
+        (WebCore::RenderSVGModelObject::requiresLayer):
+        * rendering/RenderTreeAsText.cpp:
+        * rendering/SVGRenderTreeAsText.cpp:
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove more dead code from RenderSVGHiddenContainer.
+
+        lineHeight and baselinePosition used to be on RenderSVGContainer
+        (of which this is a subclass) because RenderSVGContainer used
+        to be a RenderBox and always the renderer for <svg>
+        Now <svg> uses RenderSVGRoot when needing a RenderBox (inside HTML)
+        and RenderSVGViewportContainer (when inside SVG content)
+        so there is no need for RenderSVGHiddenContainer to have these HTML-specific methods.
+
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.h:
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove unneeded (broken) code from SVG renderers
+        https://bugs.webkit.org/show_bug.cgi?id=25214
+
+        Mostly due to my historical confusions about the render tree
+        and some methods not being removed after classes were split.
+
+        RenderSVGRoot is an RenderBox and should just use all the
+        standard RenderBox methods for inspector and repaint rects.
+
+        RenderSVGContainer is *not* a RenderBox (any more) and thus
+        doesn't need lineHeight or width/height or calcBounds.
+
+        RenderSVGViewportContainer had some broken code which tried
+        to see if the click was inside the container at all, but it
+        was using width/height metrics based off of the containing
+        block (from calcWidth) which is wrong (since its real
+        width/height are from its containing viewport not containing block).
+
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::RenderSVGContainer):
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGRoot.cpp:
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+        (WebCore::RenderSVGViewportContainer::nodeAtPoint):
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser and Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25217
+        Simplify nearestViewportElement and farthestViewportElement using isViewportElement and a for loop
+        Add ASSERT(element) to all these functions since they should never be passed a null element.
+
+        * svg/SVGLocatable.cpp:
+        (WebCore::isViewportElement):
+        (WebCore::SVGLocatable::nearestViewportElement):
+        (WebCore::SVGLocatable::farthestViewportElement):
+        (WebCore::SVGLocatable::getBBox):
+        (WebCore::SVGLocatable::getCTM):
+        (WebCore::SVGLocatable::getScreenCTM):
+
+2009-04-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove support for the ObjCIvar extended attribute from the Objective-C
+        bindings generator.  It is not used anymore.
+
+        * bindings/scripts/CodeGeneratorObjC.pm:
+
+2009-04-15  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25204
+        Create a fast path for ReplaceSelectionCommand that merges text nodes
+        
+        During simple pastes, where we're just pasting a text node into a run of text, we would split the current
+        text and insert the new node in between.  This is slow and we hit this bug:
+
+        https://bugs.webkit.org/show_bug.cgi?id=6148
+
+        in the layout and rendering code where adjacent text nodes don't shape correctly in Arabic.
+        
+        This change creates a fast path for ReplaceSelectionCommand that inserts text directly into the
+        text node that holds the selection (very similar to the fast path we wrote for InsertTextCommand).
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::performTrivialReplace):
+        * editing/ReplaceSelectionCommand.h:
+        * editing/TextIterator.cpp:
+
+2009-04-15  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Move VDMX parsing into the Chromium Linux port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25116
+
+        VDMX tables are optional tables in TrueType fonts which contain the
+        exact pixel height of a given font at a given pel size. In order to
+        match Windows font metrics we have to use these numbers.
+
+        Previously, the parsing was performed in Skia. As part of the merge
+        with upstream Skia, an interface for getting table data from a font
+        has been added to Skia and we're moving the parsing into WebKit.
+
+        This does not change any layout tests.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::uniqueID):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        * platform/graphics/chromium/FontTrueTypeLinux.cpp: Added.
+        * platform/graphics/chromium/FontTrueTypeLinux.h: Added.
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-04-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25180
+
+        Restore stroked outlines to PlatformContextSkia::drawRect().
+        These were removed inadvertently in r41805, aka
+        https://bugs.webkit.org/show_bug.cgi?id=24662.
+        SkRect is { left, top, right, bottom }, not { left, top, width, height }.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+
+2009-04-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6777374> Generated content with display: run-in
+          causes a crash
+
+        Test: fast/runin/generated.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild): Check if the run-in block is
+        generated, and if so, make the RenderInline anonymous instead of passing
+        a 0 node to the RenderInline constructor. If the run-in itself is
+        generated, do move :before and :after children from the block into the
+        inline, as they will not be regenerated. Changed nested ifs into early
+        returns.
+
+2009-04-15  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25192
+
+        Expose DOMWindow::removeInlineEventListenerForType and
+        DOMWindow::inlineEventListenerForType as public.
+
+        * page/DOMWindow.h:
+
+2009-04-14  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25198
+
+        Wrap RegisteredEventListener's markEventListeners and invalidateEventListeners
+        in a USE(JSC), since it doesn't compile with V8 bindings.
+
+        * dom/RegisteredEventListener.h:
+
+2009-04-15  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25194
+
+        Fix a caller of Settings::javaScriptCanOpenWindowsAutomatically() to
+        use the new name.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Don't keep platform objects for authentication challenge in ResourceHandleInternal.
+        We already have a copy in AuthenticationChallenge object.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::clearAuthentication):
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Nixed some now-defunct autogeneration code.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        Fix <rdar://problem/6755724> <audio> and <video> elements can reference local 
+        file:/// URLs from remote in Safari
+
+        Tests: http/tests/security/local-video-poster-from-remote.html
+               http/tests/security/local-video-source-from-remote.html
+               http/tests/security/local-video-src-from-remote.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): Don't pass url to media engine unless loader->canLoad()
+        says it is OK.
+
+2009-04-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Part of <rdar://problem/6150868>
+        Fix incorrect handling of content that needs to go into the head element
+        once the head element has been removed.
+
+        Test: fast/parser/head-content-after-head-removal.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser): Remove unneeded initializer of m_head.
+        (WebCore::HTMLParser::handleError): Update since m_head is now a RefPtr.
+        (WebCore::HTMLParser::createHead): Ditto.
+        * html/HTMLParser.h: Make m_head a RefPtr.
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Used svn merge -r42529:42528 to roll out my last patch because it broke
+        the build.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::findJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::jsProtectedEventListeners):
+        (WebCore::JSDOMGlobalObject::jsProtectedInlineEventListeners):
+        * bindings/js/JSDOMGlobalObject.h:
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Nixed some now-dead code related to protected event listeners.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        Stop using protected event listeners on SVGElementInstance.
+
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark): Mark our event listeners, since
+        they're not protected anymore.
+
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener): Make unprotected
+        event listeners, since we mark them now.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Autogenerate event listener
+        invalidation for SVGElementInstance.
+
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::eventListeners): Added an accessor, for
+        the sake of autogenerated code.
+
+        * svg/SVGElementInstance.idl: Removed the ProtectedEventListener attribute
+        from event listener properties. Added a CustomMarkFunction attribute,
+        since we need to mark our event listeners.
+
+2009-04-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-04-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Add header guards to WebCore forwarding headers.
+        
+        Speeds up WebCore debug build on Windows by 12% on my system,
+        since Visual Studio appears to not optimize for standard header
+        guards in included files.
+        
+        Rubber stamped by Ada Chan.
+
+        * ForwardingHeaders/debugger/Debugger.h:
+        * ForwardingHeaders/debugger/DebuggerActivation.h:
+        * ForwardingHeaders/debugger/DebuggerCallFrame.h:
+        * ForwardingHeaders/interpreter/CallFrame.h:
+        * ForwardingHeaders/interpreter/Interpreter.h:
+        * ForwardingHeaders/masm/X86Assembler.h:
+        * ForwardingHeaders/parser/Parser.h:
+        * ForwardingHeaders/parser/SourceCode.h:
+        * ForwardingHeaders/parser/SourceProvider.h:
+        * ForwardingHeaders/pcre/pcre.h:
+        * ForwardingHeaders/profiler/Profile.h:
+        * ForwardingHeaders/profiler/ProfileNode.h:
+        * ForwardingHeaders/profiler/Profiler.h:
+        * ForwardingHeaders/runtime/ArgList.h:
+        * ForwardingHeaders/runtime/ArrayPrototype.h:
+        * ForwardingHeaders/runtime/BooleanObject.h:
+        * ForwardingHeaders/runtime/CallData.h:
+        * ForwardingHeaders/runtime/Collector.h:
+        * ForwardingHeaders/runtime/CollectorHeapIterator.h:
+        * ForwardingHeaders/runtime/Completion.h:
+        * ForwardingHeaders/runtime/ConstructData.h:
+        * ForwardingHeaders/runtime/DateInstance.h:
+        * ForwardingHeaders/runtime/Error.h:
+        * ForwardingHeaders/runtime/FunctionConstructor.h:
+        * ForwardingHeaders/runtime/FunctionPrototype.h:
+        * ForwardingHeaders/runtime/Identifier.h:
+        * ForwardingHeaders/runtime/InitializeThreading.h:
+        * ForwardingHeaders/runtime/InternalFunction.h:
+        * ForwardingHeaders/runtime/JSArray.h:
+        * ForwardingHeaders/runtime/JSByteArray.h:
+        * ForwardingHeaders/runtime/JSFunction.h:
+        * ForwardingHeaders/runtime/JSGlobalData.h:
+        * ForwardingHeaders/runtime/JSGlobalObject.h:
+        * ForwardingHeaders/runtime/JSLock.h:
+        * ForwardingHeaders/runtime/JSNumberCell.h:
+        * ForwardingHeaders/runtime/JSObject.h:
+        * ForwardingHeaders/runtime/JSString.h:
+        * ForwardingHeaders/runtime/JSValue.h:
+        * ForwardingHeaders/runtime/Lookup.h:
+        * ForwardingHeaders/runtime/ObjectPrototype.h:
+        * ForwardingHeaders/runtime/Operations.h:
+        * ForwardingHeaders/runtime/PropertyMap.h:
+        * ForwardingHeaders/runtime/PropertyNameArray.h:
+        * ForwardingHeaders/runtime/Protect.h:
+        * ForwardingHeaders/runtime/PrototypeFunction.h:
+        * ForwardingHeaders/runtime/StringObject.h:
+        * ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h:
+        * ForwardingHeaders/runtime/StringPrototype.h:
+        * ForwardingHeaders/runtime/Structure.h:
+        * ForwardingHeaders/runtime/SymbolTable.h:
+        * ForwardingHeaders/runtime/UString.h:
+        * ForwardingHeaders/wrec/WREC.h:
+        * ForwardingHeaders/wtf/ASCIICType.h:
+        * ForwardingHeaders/wtf/AlwaysInline.h:
+        * ForwardingHeaders/wtf/Assertions.h:
+        * ForwardingHeaders/wtf/ByteArray.h:
+        * ForwardingHeaders/wtf/CurrentTime.h:
+        * ForwardingHeaders/wtf/Deque.h:
+        * ForwardingHeaders/wtf/DisallowCType.h:
+        * ForwardingHeaders/wtf/FastMalloc.h:
+        * ForwardingHeaders/wtf/Forward.h:
+        * ForwardingHeaders/wtf/GetPtr.h:
+        * ForwardingHeaders/wtf/HashCountedSet.h:
+        * ForwardingHeaders/wtf/HashFunctions.h:
+        * ForwardingHeaders/wtf/HashMap.h:
+        * ForwardingHeaders/wtf/HashSet.h:
+        * ForwardingHeaders/wtf/HashTable.h:
+        * ForwardingHeaders/wtf/HashTraits.h:
+        * ForwardingHeaders/wtf/ListHashSet.h:
+        * ForwardingHeaders/wtf/ListRefPtr.h:
+        * ForwardingHeaders/wtf/Locker.h:
+        * ForwardingHeaders/wtf/MainThread.h:
+        * ForwardingHeaders/wtf/MathExtras.h:
+        * ForwardingHeaders/wtf/MessageQueue.h:
+        * ForwardingHeaders/wtf/Noncopyable.h:
+        * ForwardingHeaders/wtf/NotFound.h:
+        * ForwardingHeaders/wtf/OwnArrayPtr.h:
+        * ForwardingHeaders/wtf/OwnPtr.h:
+        * ForwardingHeaders/wtf/PassRefPtr.h:
+        * ForwardingHeaders/wtf/Platform.h:
+        * ForwardingHeaders/wtf/PtrAndFlags.h:
+        * ForwardingHeaders/wtf/RandomNumber.h:
+        * ForwardingHeaders/wtf/RefCounted.h:
+        * ForwardingHeaders/wtf/RefCountedLeakCounter.h:
+        * ForwardingHeaders/wtf/RefPtr.h:
+        * ForwardingHeaders/wtf/RetainPtr.h:
+        * ForwardingHeaders/wtf/StdLibExtras.h:
+        * ForwardingHeaders/wtf/StringExtras.h:
+        * ForwardingHeaders/wtf/ThreadSpecific.h:
+        * ForwardingHeaders/wtf/Threading.h:
+        * ForwardingHeaders/wtf/TypeTraits.h:
+        * ForwardingHeaders/wtf/UnusedParam.h:
+        * ForwardingHeaders/wtf/Vector.h:
+        * ForwardingHeaders/wtf/VectorTraits.h:
+        * ForwardingHeaders/wtf/dtoa.h:
+        * ForwardingHeaders/wtf/unicode/Collator.h:
+        * ForwardingHeaders/wtf/unicode/UTF8.h:
+        * ForwardingHeaders/wtf/unicode/Unicode.h:
+        * ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h:
+
+2009-04-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Use a template function to generalize the way we create non-caching
+        JS function getters.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::nonCachingStaticFunctionGetter):
+        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
+
+2009-04-14  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25099
+
+        When creating a QNetworkRequest make sure to populate the
+        CacheLoadControlAttribute with the value set by the ResourceRequest::cachePolicy() so that the cache will be used as WebKit expects.
+
+        * WebKit/qt/tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::requestCache):
+
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-04-14  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a world leak caused by opening the Web Inspector. This was
+        a regression caused by the InspectorController becoming refcounted.
+
+        <rdar://problem/6782944>
+
+        Reviewed by Darin Adler.
+
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::get): Renamed to better match the
+        other functions.
+        (WebCore::ScriptGlobalObject::remove): Added. Deletes the property.
+        * bindings/js/ScriptObject.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController): Do less work
+        at destruction time since the object lifetime is tied to JS GC.
+        Assert that inspectedPageDestroyed cleared everything needed.
+        (WebCore::InspectorController::inspectedPageDestroyed): Do most
+        of the work that ~InspectorController was doing.
+        (WebCore::InspectorController::scriptObjectReady): Renamed getObject.
+
+2009-04-14  Antony Sargent  <asargent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        This is some cleanup motivated by the crash in http://crbug.com/9775 , which 
+        happens because of calling window.open inside a window.onload handler. 
+
+        These changes are just part of the fix, along with some asserts to help prevent
+        breakage on future changes. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=25132
+
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::add):
+        (WebCore::V8EventListenerList::remove):
+        (WebCore::V8EventListenerList::clear):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::size):
+
+2009-04-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25142
+        Fix a race that can occur between flex and the perl script that parses
+        its output.
+
+        * css/maketokenizer: Consume all input.
+
+2009-04-14  Rohit Rao  <rohitrao@google.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25184
+        Do not change the text color for selected text in Mac Chromium.
+
+        * rendering/RenderThemeChromiumMac.h:
+        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
+        Now returns false, matching the behavior of Safari on Mac.
+
+2009-04-14  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25172
+        Extra partial layout during the first keypress in an empty block
+        
+        Determining if a placeholder needs to be removed requires the creation of a VisiblePosition 
+        which was triggering layout before we were finished modifying the DOM for the insert operation.
+        
+        Find out if we need to remove a placeholder near the start of the operation, and if we do remember 
+        where it's located.  Then, later, remove it along with all of the other DOM operations we perform.
+        
+        Renamed lineBreakExistsAtPosition to lineBreakExistsAtVisiblePosition and added a lineBreakExistsAtPosition
+        that takes in a Position.  In InsertTextCommand, we can use the latter, since we normalize manually.
+        
+        removePlaceholderAt now takes in a Position that it assumes has already been checked for a placeholder.
+        
+        No test added as this only effects performance.
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::removePlaceholderAt):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/CompositeEditCommand.h:
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete):
+        (WebCore::DeleteSelectionCommand::doApply):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::doApply):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+        * editing/htmlediting.cpp:
+        (WebCore::lineBreakExistsAtVisiblePosition):
+        (WebCore::lineBreakExistsAtPosition):
+        * editing/htmlediting.h:
+
+2009-04-14  Adam Roben  <aroben@apple.com>
+
+        Remove support for profile-guided optimization on Windows
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * WebCore.vcproj/WebCore.vcproj: Removed the Release_PGO
+        configuration.
+
+2009-04-14  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25163
+        Upstream fix for releasing v8 objects on worker thread termination in Chromium.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::domDataList): Now uses Vector instead of HashMap.
+        (WebCore::domDataListMutex):
+        (WebCore::ThreadSpecificDOMData::ThreadSpecificDOMData):  remove usage of currentThread();
+        (WebCore::ThreadSpecificDOMData::~ThreadSpecificDOMData): ditto.
+        (WebCore::NonMainThreadSpecificDOMData::~NonMainThreadSpecificDOMData): moved call to removeAllDOMObjectsInCurrentThread() to ~WorkerScriptController.
+        (WebCore::handleWeakObjectInOwningThread):
+        (WebCore::derefDelayedObjects):
+        (WebCore::removeAllDOMObjectsInCurrentThread): not static anymore.
+        * bindings/v8/V8DOMMap.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose): removed code that avoided dual-dereference of WorkerContext.
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded): this ref() is countered in removeAllDOMObjectsInCurrentThread(), when the WorkerContext is removed from the v8 map.
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+
+2009-04-14  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 25183: Split up WebCore.vcproj's settings into vsprops files
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25183>
+
+        WebCore.vcproj now uses a set of .vsprops files to store most of its
+        settings.
+
+        Reviewed by Darin Adler.
+
+        * WebCore.vcproj/WebCore.vcproj: Moved settings from here into the new
+        .vsprops files.
+
+        * WebCore.vcproj/WebCoreCFNetwork.vsprops: Added. Contains settings
+        for ports that build against CFNetwork.
+        * WebCore.vcproj/WebCoreCG.vsprops: Added. Contains settings for ports
+        that build against CoreGraphics.
+        * WebCore.vcproj/WebCoreCURL.vsprops: Added. Contains settings for
+        ports that build against libcurl.
+        * WebCore.vcproj/WebCoreCairo.vsprops: Added. Contains settings for
+        ports that build against Cairo.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Added. Contains settings
+        shared by all ports.
+        * WebCore.vcproj/WebCoreMediaQT.vsprops: Added. Contains settings for
+        ports that use QTMovieWin to implement the MediaPlayerPrivate
+        interface.
+        * WebCore.vcproj/WebCorePthreads.vsprops: Added. Contains settings for
+        ports that build against pthreads.
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        http/tests/xmlhttprequest/basic-auth.html fails on Tiger.
+
+        Turns out that NSURLCredentialPersistenceNone doesn't work on Tiger, so we have to use
+        session persistence.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Route the credential through
+        receivedCredential(), ensuring that the Tiger-specific need to use session credentials
+        is honored.
+        (WebCore::ResourceHandle::receivedCredential): On Tiger, change PersistenceNone to
+        PersistenceForSession, because the former doesn't work.
+
+2009-04-14  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6703873> Triple-click quoted line and type Return creates an extra quoted blank line
+
+        Test: editing/inserting/6703873.html
+
+        * editing/BreakBlockquoteCommand.cpp: (WebCore::BreakBlockquoteCommand::doApply):
+        If the startNode's original parent is now empty, we can remove it.  Its already been cloned and copied with the startNode,
+        so we only need to keep it around if it actually holds some original content, otherwise it will look like an extra empty 
+        container in the document.
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Add a proper implementation of AtkText::get_text and
+        AtkText::get_character_count, which takes into account non
+        TextControl text. With this the 'Text' field in Accerciser's
+        Interface Viewer is filled correctly.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Remove some dead code and g_return_if_fail from static functions.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Also implement text interface for StaticTextRole, which covers
+        most of the text in web pages.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Another Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+
+2009-04-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6698851> Implement XMLHttpRequest withCredentials attribute
+
+        * WebCore.xcodeproj/project.pbxproj: Made ThreadableLoader.h private, as enum definitions
+        from it are now used in otehr private headers.
+
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        Added withCredentials attribute. When it is false (default), neither credentials nor cookies
+        are sent with cross origin requests, When it is true, those are sent, but the server needs
+        to allow handling results via Access-Control-Allow-Credentials header. It was always possible
+        to send a cross-site request with credentials via IFRAME or IMG, so this just adds a way to
+        read results, as long as the server reports that it's allowed.
+        Having the default set to false ensures that requests won't fail unexpectedly because of
+        stored credentials and cookies for other resources in the target protection space.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestSynchronously): Allow stored credentials for same origin
+        requests, and for cross origin ones that have withCredentials attribute set. Such code already
+        existed for cookies (but it's simpler, because we could just set a ResourceRequest flag).
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Ditto.
+
+        * platform/network/ResourceHandle.h: Added willSendRequest() - just like for other callbacks,
+        is is easier to have code in the class. Also, loadResourceSynchronously() now takes a
+        StoredCredentials option, matching async case.
+
+        * platform/network/ResourceHandleClient.h:
+        (WebCore::ResourceHandleClient::receivedCredential): Removed. This method could never be
+        called, and no client used it.
+        (WebCore::ResourceHandleClient::receivedRequestToContinueWithoutCredential): Ditto.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal): Split username and password out
+        of request URL. We want to always get a callback for credentials to manage them in WebCore,
+        so network back-end shouldn't see them too early.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::removeCredentials):
+        * platform/network/ResourceRequestBase.h:
+        Added a removeCredentials() method that removes login and password parts from request URL.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCoreCredentialStorage): Added a simple storage class for per-session credentials.
+        (WebCore::ResourceHandle::loadResourceSynchronously): Pass allowStoredCredentials through.
+        (WebCore::ResourceHandle::willSendRequest): On a redirect, credentials should be replaced.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Try credentials from the URL
+        and per-session credentials. Code was partially moved from Obj-C callback.
+        (WebCore::ResourceHandle::receivedCredential): Intercept per-session credentials and store
+        them in WebCore storage.
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): Don't
+        store the redirected URL - we only needed credentials, which are now stored separately.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]): Removed
+        code that was setting credentials from URL. First, the code is now in ResourceHandle, and
+        also, it wasn't actually needed in Leopard release before this patch, see <rdar://problem/5298142>.
+        (-[WebCoreSynchronousLoader dealloc]): Release credentials. Note that unlike ResourceHandle,
+        this class still needs to track URL for checking whether a redirect is allowed. This is
+        not a great solution, and we should unify client code to use the same checks in sync and
+        async cases.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Just like in
+        async case, put credentials aside to ensure that network back-end asks for them.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Use credentials
+        from URL, or from WebCore storage.
+        (-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]): Don't use stored
+        credentials when not allowed to.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Put credentials aside to ensure that network back-end asks for them.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreCredentialStorage::set):
+        (WebCore::WebCoreCredentialStorage::get):
+        (WebCore::willSendRequest):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::willSendRequest):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::shouldUseCredentialStorage):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Same changes as in Mac case.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        Trying not to break the build.
+
+        * dom/XMLTokenizerLibxml2.cpp: (WebCore::openFunc):
+        * xml/XSLTProcessor.cpp: (WebCore::docLoaderFunc):
+        Unconditionally allow stored credentials for these, as they only support same origin loads.
+
+        * workers/WorkerContext.cpp: (WebCore::WorkerContext::importScripts):
+        WorkerContext.importScripts() can be cross-origin, but sending credentials with it is no worse
+        than sending them with <script src=...>, so this is also unconditionally allowed.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Pass through storedCredentials.
+        (WebCore::DocumentThreadableLoader::create): Ditto.
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Save storedCredentials and
+        sameOrigin flags foruse in callbacks.
+        (WebCore::DocumentThreadableLoader::willSendRequest): Assert that loaders aren't all confused.
+        (WebCore::DocumentThreadableLoader::didSendData): Ditto.
+        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
+        (WebCore::DocumentThreadableLoader::didReceiveData): Ditto.
+        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
+        (WebCore::DocumentThreadableLoader::didFail): Ditto.
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Don't use credential
+        storage if that's not allowed by the code that invoked DocumentThreadableLoader.
+        (WebCore::DocumentThreadableLoader::didReceiveAuthenticationChallenge): Simulate a failure
+        and cancel the request if we are about to ask the user for credentials for a cross-origin
+        request, which is forbidden by CORS (and would have been very confusing if allowed).
+        (WebCore::DocumentThreadableLoader::receivedCancellation): Assert that loaders aren't all confused.
+
+        * loader/DocumentThreadableLoader.h: Updated for the new flags (storedCredentials and
+        sameOrigin) that affect the loader. Eventually, we need to move all CORS logic from XHR here.
+
+        * loader/ThreadableLoader.h: (StoredCredentials): Added another flag that affects loader
+        behavior. We should combine all of these into a structure, and use it for sync requests, too.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/FrameLoader.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+        Pass through storedCredentials.
+
+2009-04-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Remove an outdated comment in ScrollView.h
+
+        * platform/ScrollView.h:
+
+2009-04-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25177
+
+        QTTrack's -media method always return NULL in 64-bit QTKit, so
+        MediaPlayerPrivate::disableUnsupportedTracks should use 
+        QTTrackMediaTypeAttribute to get a track's type.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        Stop using protected event listeners on the window object.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::mark): Mark our event listeners, since they're
+        no longer protected.
+
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener): Create unprotected event
+        listeners, since we mark them now.
+
+        * bindings/js/JSEventListener.h: Made some functions public so
+        DOMWindow could call them.
+
+        * bindings/js/JSNodeCustom.cpp: Moved markEventListeners to a header,
+        so it could be shared.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Generate event listener marking
+        and invalidating code for the DOMWindow.
+
+        * dom/RegisteredEventListener.h:
+        (WebCore::markEventListeners):
+        (WebCore::invalidateEventListeners): Added helper functions.
+
+        * page/DOMWindow.idl: Make the window's event listener attributes not
+        protected.
+
+2009-04-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25155
+
+        OS X standalone media documents should not switch from <video> to <embed> when 
+        QTKit load state is QTMovieLoadStateLoading as that happens frequently when a loading
+        with a slow network connection or when a movie is not saved fast-start.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates): Don't open movie with plug-in when QTKit's
+        loadstate is QTMovieLoadStateLoading, wait until it drops below QTMovieLoadStateError.
+
+2009-04-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24453
+        REGRESSION: If setTimeout is called on a iframe's window, the DOM changes to
+        the main document that timer callback makes are not flushed.
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        Use Document::updateStyleForAllDocuments() instead of document->updateStyleIfNeeded()
+        since timers may affect documents other then their own.
+
+2009-04-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by David Hyatt.
+
+        Check document for nullity to avoid crashing on GTK+, when
+        creating the WebView.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout):
+
+2009-04-13  Ada Chan  <adachan@apple.com>
+
+        Forgot to capitalize the "US".
+
+        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
+        (WebCore::currentTextBreakLocaleID):
+
+2009-04-13  Ada Chan  <adachan@apple.com>
+
+        <rdar://problem/6564956> URL field double-click selects entire domain, rather than single word or entire URL
+        Revert back to the old word breaking behavior by using en_US_POSIX locale.        
+
+        Reviewed by Steve Falkenburg.
+
+        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
+        (WebCore::currentTextBreakLocaleID):
+
+2009-04-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        * platform/cf/BinaryPropertyList.cpp: Added comment.
+        * platform/cf/BinaryPropertyList.h: Fixed mistakes in comments.
+
+2009-04-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 25158: hit testing doesn't work right in some cases involving anonymous blocks
+        https://bugs.webkit.org/show_bug.cgi?id=25158
+        rdar://problem/6769693
+
+        Test: editing/selection/click-after-nested-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::isChildHitTestCandidate): Added. Helper so the two loops in positionForPoint
+        can share code.
+        (WebCore::RenderBlock::positionForPoint): Removed unneeded special case for first
+        child box. Changed special case for last child box to propertly handle the various
+        types of child box that are not hit test candidates (the same ones already handled
+        by the hit test loop below), adding in a loop so we find the last candidate.
+
+2009-04-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25125.  Rework scrolling so that a layout happens first when
+        it's already needed so that the code doesn't end up making bad decisions based off invalid document sizes.
+
+        * WebCore.base.exp:
+        * page/FrameView.h:
+        (WebCore::FrameView::visibleContentsResized):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollView.h:
+
+2009-04-13  Adam Roben  <aroben@apple.com>
+
+        Add SharedBuffer::wrapCFData
+
+        This is the CF-equivalent of wrapNSData.
+
+        Reviewed by Brady Eidson.
+
+        * platform/SharedBuffer.h:
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::wrapCFData):
+
+2009-04-13  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * page/EventHandler.cpp:
+        (WebCore::documentPointForWindowPoint):
+
+2009-04-13  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6740294> Increase the connection count per host
+        
+        Try to use six connections per host if possible.
+
+        * WebCore.base.exp:
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::initMaximumHTTPConnectionCountPerHost):
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::initMaximumHTTPConnectionCountPerHost):
+
+2009-04-13  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25153
+        Can't place the caret into text field that scrolls the window on focus
+        
+        We refetch the target node in the shadow node case, and when we do so the window coordinate for the mouse event may
+        be invalid because of scrolling that the focus handler did.  Cache the document point (that we derived from the window
+        coordinate) and use that any time we refetch.
+
+        * page/EventHandler.cpp:
+        (WebCore::documentPointForWindowPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::prepareMouseEvent):
+
+2009-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Rename JavaScriptCanOpenWindowsAutomatically to javaScriptCanOpenWindowsAutomatically
+        to conform to our style guidelines.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::allowPopUp):
+        * page/Settings.h:
+        (WebCore::Settings::javaScriptCanOpenWindowsAutomatically):
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Mac build fix: Made another header private.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-04-13  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25121
+        Upstream changes to handle error messages from V8 when running worker script.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::reportFatalErrorInV8):
+        (WebCore::handleConsoleMessage):
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Made setInlineEventListenerForType not inline, since Document
+        calls it now. Made RegisteredEventListener.h a private header on Mac,
+        so WebKit can use it.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setInlineEventListenerForType):
+
+2009-04-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6404439> REGRESSION: Overlapping text and other
+          layout issues in View Sample feature of MYOB FIrstEdge v3
+
+        * page/Navigator.cpp:
+        (WebCore::shouldHideFourDot): Added "tdqm_loader.js" to the list of
+        JavaScript files this quirk applies to.
+
+2009-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Move open and showModalDialog functions out of JSDOMWindowBase
+        and into JSDOMWindow by partially generating them.
+
+        This slightly changes the behavior of getting window.showModalDialog
+        when the embedding app does not support it to return undefined regardless
+        of shadowing.  This should not be an issue in a practice, but will be addressed
+        when we add a generic way to handle runtime specialization of property
+        access.
+
+        * DerivedSources.make: Remove JSDOMWindowBase.lut.h
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::):
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot): Move canShowModalDialog check from
+        here to JSDOMWindow::customGetOwnPropertySlot.
+        (WebCore::JSDOMWindowBase::put): Remove dead code.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::parseModalDialogFeatures): Move from JSDOMWindowBase.
+        (WebCore::DOMWindow::allowPopUp): Ditto.
+        (WebCore::DOMWindow::canShowModalDialog): Ditto.
+        (WebCore::DOMWindow::canShowModalDialogNow): Ditto.
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Moved storage for window event listeners into the window object.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener): Add / remove window event
+        listeners to / from the window object.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        (WebCore::Document::clear):
+        (WebCore::Document::setWindowInlineEventListenerForTypeAndAttribute): Moved
+        a bunch of code to the DOMWindow class, and left behind a few calls through
+        to DOMWindow, to support legacy clients. (Eventually, these will go away, too.)
+
+        * dom/Document.h: ditto.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchWindowEvent): Dipatch window events on the window
+        object, not the document.
+
+        * dom/Node.h:
+        * dom/RegisteredEventListener.h: Moved RegisteredEventListenerVector
+        declaration, since it's required in more places now.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::clear): Updated for rename. Also, remove event
+        listeners before detaching and clearing the document's window pointer,
+        since the the document needs its window pointer in order to tell the window
+        to clear its event listeners.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision): Updated for rename, and
+        movement of window event listeners into the window.
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageDocument::createDocumentStructure): Updated for movement
+        of window event listeners into the window.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::handleEvent):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        (WebCore::DOMWindow::hasEventListener):
+        (WebCore::DOMWindow::setInlineEventListenerForType):
+        (WebCore::DOMWindow::removeInlineEventListenerForType):
+        (WebCore::DOMWindow::inlineEventListenerForType):
+        (WebCore::DOMWindow::addPendingFrameUnloadEventCount):
+        (WebCore::DOMWindow::removePendingFrameUnloadEventCount):
+        (WebCore::DOMWindow::addPendingFrameBeforeUnloadEventCount):
+        (WebCore::DOMWindow::removePendingFrameBeforeUnloadEventCount):
+        * page/DOMWindow.h: Moved a bunch of code to the DOMWindow class, from the Document.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose): Updated for movement of window event listeners into the window.
+
+2009-04-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25149
+
+        The Geolocation timer needs to start after the UA has granted permission.
+
+        * bindings/js/JSGeolocationCustom.cpp: Use PassRefPtr<PositionOptions>
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * page/Geolocation.cpp: Add a RefPtr<PositionOptions> so it can be used
+        later when the timer is started. Change PositionOptions* to PassRefPtr<PositionOptions>
+        where needed.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier):
+        (WebCore::Geolocation::GeoNotifier::startTimer):
+        (WebCore::Geolocation::getCurrentPosition):
+        (WebCore::Geolocation::watchPosition):
+        (WebCore::Geolocation::setIsAllowed): Start the timer is the UA allows
+        (WebCore::Geolocation::startTimer):
+        (WebCore::Geolocation::startTimersForOneShots):
+        (WebCore::Geolocation::startTimersForWatchers):
+        (WebCore::Geolocation::startTimers):
+        * page/Geolocation.h:
+        (WebCore::Geolocation::GeoNotifier::create):
+
+2009-04-13  Pamela Greene  <pam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix Chromium (V8) build by renaming methods to match changes
+        in http://trac.webkit.org/changeset/42377.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25141
+
+        * bindings/v8/ScheduledAction.cpp:
+     (WebCore::ScheduledAction::execute): updateRendering() -> updateStyleIfNeeded()
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent): updateDocumentsRendering() -> updateStyleForAllDocuments()
+
+2009-04-13  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25136
+        CRASH in DocumentLoader::removeSubresourceLoader due to null m_frame
+
+        Test: fast/frames/frame-unload-crash.html
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::updateLoading): Added null check of m_frame.
+
+2009-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Tim Hatcher.
+
+        Put the MessagePort constructor back in ENABLE_CHANNEL_MESSAGING.
+
+        * page/DOMWindow.idl:
+
+2009-04-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Fix GTK build break.
+
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::updatePosition):
+
+2009-04-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        Assertion in updateStyleForAllDocuments.  Make sure to unscheduleStyleRecalc when an object goes into
+        the page cache.  Disallow scheduling of style recalcs on a document that is already in the page cache.
+        Schedule a style recalc if needed when an object comes out of the page cache.
+
+        * dom/Document.cpp:
+        (WebCore::Document::scheduleStyleRecalc):
+        (WebCore::Document::setInPageCache):
+
+2009-04-13  Timothy Hatcher  <timothy@apple.com>
+
+        Correctly sort (program) scripts in the Scripts panel popup menu.
+
+        Reviewed by Ada Chan.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu): Refactor the code
+        and sort "(program)" options by the sourceID to maintain some order.
+        * inspector/front-end/utilities.js:
+        (indexOfObjectInListSortedByFunction): Fix a bug where identical objects would cause
+        an incorrect return value that confuses insertionIndexForObjectInListSortedByFunction.
+        Just set 'first' and break so the correct result will be returned.
+
+2009-04-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24770
+        
+        Add custom code for Coordinates that returns null when required by the
+        Geolocation spec.
+        
+        http://dev.w3.org/geo/api/spec-source.html#coordinates
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCoordinatesCustom.cpp: Added.
+        (WebCore::JSCoordinates::altitude): returns null if the value cannot be provided.
+        (WebCore::JSCoordinates::altitudeAccuracy): Ditto
+        (WebCore::JSCoordinates::heading): Ditto
+        (WebCore::JSCoordinates::speed): Ditto
+        * page/Coordinates.h:
+        (WebCore::Coordinates::create): Add 'canProvide' parameters and values
+        (WebCore::Coordinates::canProvideAltitude):
+        (WebCore::Coordinates::canProvideAltitudeAccuracy):
+        (WebCore::Coordinates::canProvideHeading):
+        (WebCore::Coordinates::canProvideSpeed):
+        (WebCore::Coordinates::Coordinates):
+        * page/Coordinates.idl: specify custom getters
+        * platform/mac/GeolocationServiceMac.mm: Set the values correctly if they cannot be provided.
+        (-[WebCoreCoreLocationObserver locationManager:didUpdateToLocation:fromLocation:]):
+
+2009-04-13  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/5510537> Typing return at start of block quote yields empty quoted line
+
+        Test: editing/inserting/5510537.html
+
+        * editing/BreakBlockquoteCommand.cpp: (WebCore::BreakBlockquoteCommand::doApply): If the break insertion position
+        is at the beginning of the topmost quote, then just insert the <br> before the blockquote.  Otherwise, if the break
+        insertion position is at the beginning of any quote, adjust the position so the break comes before the current quote level
+        so we don't end up with an empty line in that quote in addition to the new line we're adding with the <br>.
+
+2009-04-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix problem when encoding history files with duplicate integer arrays near the end of the file.
+        This results in an assertion failure, and if assertions are turned off, corrupted output.
+
+        When writing an integer array it's important not to add an object reference to the
+        aggregate buffer. The writing of the array does not depend on the aggregate buffer. But,
+        more importantly, it's possible this instance integer array is a duplicate and won't be
+        written out. If so, there's no guarantee there's enough space in the aggregate buffer to
+        store the object references (the references will be ignored). In some cases the aggregate
+        buffer can then overrun the data being written; normally this is prevented by the fact that
+        the data being written will include a copy of the aggregate buffer.
+
+        Also removed a bit of unneeded dead code to handle the integer -1.
+
+        * platform/cf/BinaryPropertyList.cpp:
+        (WebCore::BinaryPropertyListPlan::BinaryPropertyListPlan): Removed unneeded
+        m_integerNegativeOneObjectReference, since property lists support only non-negative integers.
+        (WebCore::BinaryPropertyListPlan::writeInteger): Removed support for
+        m_integerNegativeOneObjectReference.
+        (WebCore::BinaryPropertyListPlan::integerObjectReference): Ditto.
+        (WebCore::BinaryPropertyListSerializer::writeIntegerWithoutAddingAggregateObjectReference):
+        Added. Factored out most of writeInteger, for use in writeIntegerArray, without calling
+        addAggregateObjectReference.
+        (WebCore::BinaryPropertyListSerializer::writeInteger): Changed to call the new
+        writeIntegerWithoutAddingAggregateObjectReference function.
+        (WebCore::BinaryPropertyListSerializer::writeIntegerArray): Call the new
+        writeIntegerWithoutAddingAggregateObjectReference function and therefore remove the
+        code to save and restore m_currentAggregateBufferByte, which is no longer needed.
+
+2009-04-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed Qt build fix.
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
+
+2009-04-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Move the event and crypto attributes and the captureEvents and releaseEvents
+        functions out of JSDOMWindowBase by partially generating them.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::currentEvent): Make const.
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::crypto): Not implemented.
+        (WebCore::JSDOMWindow::event):
+        (WebCore::JSDOMWindow::captureEvents): Not implemented.
+        (WebCore::JSDOMWindow::releaseEvents): Ditto.
+        * page/DOMWindow.idl:
+
+2009-04-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Move more attributes out of JSDOMWindowBase by
+        partially generating them.
+
+        - Expose the MessagePort constructor.
+
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (setJSDOMWindowBaseEvent):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::image):
+        (WebCore::JSDOMWindow::option):
+        (WebCore::JSDOMWindow::audio):
+        (WebCore::JSDOMWindow::webKitPoint):
+        (WebCore::JSDOMWindow::webKitCSSMatrix):
+        (WebCore::JSDOMWindow::xMLHttpRequest):
+        (WebCore::JSDOMWindow::xSLTProcessor):
+        (WebCore::JSDOMWindow::messageChannel):
+        (WebCore::JSDOMWindow::worker):
+        * page/DOMWindow.idl:
+
+2009-04-12  Timothy Hatcher  <timothy@apple.com>
+
+        A resource's filename is not correct after a redirect in the Inspector.
+
+        Reviewed by Dan Bernstein.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateScriptObject): Fix a typo in the
+        lastPathComponent property name.
+
+2009-04-12  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Test: editing/inserting/6609479-1.html
+
+        Follow-up to <rdar://problem/6609479>.
+
+        Before my last change, a Mail blockquote would've been broken up earlier, and you would've been guaranteed that the inserted content
+        was at the start of a paragraph.  Now we need to check for that explicitly, and only merge the start of the inserted content if it is 
+        at the start of a paragraph.
+
+        * editing/ReplaceSelectionCommand.cpp: (WebCore::ReplaceSelectionCommand::shouldMergeStart):
+
+2009-04-11  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6609479> Pressing return inside a table cell that's inside quoted content will split the table
+
+        Test: editing/inserting/6609479.html
+
+        Don't break a blockquote if pasting or inserting into a table.
+
+        * editing/ReplaceSelectionCommand.cpp: (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/TypingCommand.cpp: (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
+
+2009-04-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6643103> Unscaled values from body.scrollHeight
+
+        Test: fast/css/zoom-body-scroll.html
+
+        Adjust scroll{Left,Top,Width,Height} values for zoom in getters and
+        setters.
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::adjustForZoom):
+        (WebCore::HTMLBodyElement::scrollLeft):
+        (WebCore::HTMLBodyElement::setScrollLeft):
+        (WebCore::HTMLBodyElement::scrollTop):
+        (WebCore::HTMLBodyElement::setScrollTop):
+        (WebCore::HTMLBodyElement::scrollHeight):
+        (WebCore::HTMLBodyElement::scrollWidth):
+
+2009-04-10  Timothy Hatcher  <timothy@apple.com>
+
+        Allow page navigation and reload while stopped at a breakpoint.
+
+        <rdar://problem/6781108> Having a breakpoint active prevents page reload
+
+        Reviewed by Darin Adler.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didContinue): Call the resumedScript function.
+        * inspector/InspectorController.h: Added didContinue.
+        * inspector/JavaScriptDebugListener.h: Ditto.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::pauseIfNeeded): Call didContinue on the listeners.
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.debuggerResumed): Update the interface and state.
+        * inspector/front-end/inspector.js:
+        (WebInspector.resumedScript): Call ScriptsPanel.debuggerResumed.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Call resumeDebugger.
+
+2009-04-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Remove unused include for JSLock.
+
+        * page/mac/FrameMac.mm:
+
+2009-04-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add back the keepAlive timer for after the script execution to
+        protect the callers of evaluate, as was part of the original intent
+        of timer.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * page/mac/FrameMac.mm:
+
+2009-04-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=25137
+
+        If we reload, the animation controller sticks around and has
+        a stale animation time. So the needed delay is computed wrong.
+        I added a reset of the animation timer on load.
+
+        I did not do a test case because this only happens on reload so I
+        couldn't make an automated test. I tried using an iframe and using
+        reload() but that doesn't tickle the bug.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitOpen):
+
+2009-04-10  Grace Kloba  <klobag@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Move WORKERS header files inside ENABLE(WORKERS).
+        So if WORKERS is not enabled and the generated files are not generated, the build is still working.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        * bindings/js/ScheduledAction.cpp:
+
+2009-04-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6773515> crash in push_heap inside WebCore when printing
+
+        The crash was due to manipulating a timer on a different thread than the one it was created on.
+        This adds some diagnostics so we'll catch that kind of mistake immediately.
+
+        * platform/Timer.cpp:
+        (WebCore::TimerBase::TimerBase): Store the thread identifier in debug versions.
+        (WebCore::TimerBase::start): Assert it's the same thread the timer was created on.
+        (WebCore::TimerBase::stop): Ditto.
+        (WebCore::TimerBase::isActive): Ditto.
+        (WebCore::TimerBase::setNextFireTime): Ditto.
+
+        * platform/Timer.h: Added the thread identifier data member.
+
+2009-04-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=25108
+
+        If you remove a class with a transition while that transition is running
+        the animation timer will continue to fire after the transition is finished.
+        This has no visual indication, but it does drain the processor. And in some
+        cases it might even cause a glitch in future animations. Unfortunately there
+        is no way to test this without putting in printfs.
+
+        This happens because the animation logic is never traversed after a transition
+        is removed, so we never get a chance to cleanup. So I added cleanup in the logic
+        that fires the dispatch of the last style change when the animation finishes.
+
+        Test: transitions/remove-transition-style.html
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
+        * page/animation/CompositeAnimation.h:
+
+2009-04-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6648858>
+        CrashTracer: [REGRESSION(Safari 4)] 60 crashes in Safari at com.apple.WebCore • WebCore::ScriptController::evaluate + 241
+
+        The Frame (and therefore ScriptController) were being destroyed
+        during JavaScript execution causing the JSDOMWindowShell to become
+        null.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Use a RefPtr to protect the Frame
+        instead of the keep-alive timer, since a nested event loop used from with-in 
+        JavaScript execution could cause the timer to fire before returning.
+
+2009-04-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25133
+        Fix an error in InspectorController's bindings, clean up a few header
+        includes, make empty object construction in ScriptObject less ambiguous.
+
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::setSetting): Send correct argument from
+            the bindings.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::createNew): Added.
+        * bindings/js/ScriptObject.h: Removed constructor, added decl for createNew.
+        * inspector/ConsoleMessage.cpp: Remove unused header.
+        * inspector/ConsoleMessage.h: Ditto.
+        * inspector/InspectorResource.cpp:
+        (WebCore::createHeadersObject): Changed to use ScriptObject::createNew.
+
+2009-04-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=25134
+
+        This both fixes a bug where I was not sending in the right time
+        to continue the animation and was not recomputing current time
+        when coming out of suspend.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::suspendAnimations):
+        (WebCore::AnimationControllerPrivate::resumeAnimations):
+
+2009-04-10  Adam Roben  <aroben@apple.com>
+
+        Give Windows's <select> popup menus drop shadows
+
+        Rubber-stamped by Steve Falkenburg.
+
+        No test possible.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::registerPopup): Use the CS_DROPSHADOW window class style.
+
+2009-04-10  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a bug in the Web Inspector where it would show scripts
+        from previous pages when toggling the debugger off and back on.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25095
+        rdar://problem/6769970
+
+        Reviewed by John Sullivan.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData): Null out the
+        debugger for the scriptController. This balances the attachDebugger
+        that was already in ScriptCachedFrameData::restore.
+        (WebCore::ScriptCachedFrameData::restore): Clean up an if statement.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell): Clear the debugger from
+        the current window before setting the new window.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions): Only accumulate
+        source providers for code associated this as the debugger.
+
+2009-04-10  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6646998> Avoid starting QTKitServer if possible
+        When possible avoid asking QTKit for the MIME types that require QTKitServer
+        when running 64-bit.
+
+        * WebCore.base.exp: Added new entry point.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::addFileTypesToCache): Add an NSArray of types to the cache.
+        (WebCore::mimeCommonTypesCache): Add all "common" QTKit types to the cache.
+        (WebCore::mimeModernTypesCache): Add only "modern" QTKit types to the cache (this list does 
+        not start QTKitServer if it is not already running).
+        (WebCore::MediaPlayerPrivate::getSupportedTypes): Refactored.
+        (WebCore::MediaPlayerPrivate::supportsType): Look in list of "modern" types first to avoid
+        starting QTKitServer if possible.
+
+        * platform/mac/WebCoreSystemInterface.h: Add wkQTIncludeOnlyModernMediaFileTypes.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+2009-04-10  Adam Roben  <aroben@apple.com>
+
+        Turn on window animations for <select> popup menus
+
+        We turned these off back when <select> popup menus were partially
+        transparent. Now that they're opaque, there's no reason not to
+        animate them.
+
+        Reviewed by Steve Falkenburg.
+
+        No test possible.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show): Remove the #ifdef that was disabling the
+        window animation.
+
+2009-04-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix a regression from r42379 which made zero-width characters affect
+          line height
+
+        Test: fixes fast/text/wide-zero-width-space.html
+
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::overrideLayoutOperation): Add to the fallback font list set
+        here, and only if the glyph is not zero-width...
+        (WebCore::ATSULayoutParameters::initialize): ...instead of doing it
+        here. This matches WidthIterator's behavior.
+
+2009-04-10  Darin Fisher  <darin@chromium.org>
+
+        Fixing build bustage caused by warnings being treated as errors.
+        1- A local variable was only be used inside a debug assertion, which
+           caused grief for the release build.
+        2- Missing initializer for member 'DocumentMarker::activeMatch'
+
+        * dom/Document.cpp:
+        (WebCore::Document::addMarker):
+        (WebCore::Document::setMarkersActive):
+
+2009-04-10  Finnur Thorarinsson  <finnur.webkit@gmail.com>
+
+        Reviewed by John Sullivan.
+
+        Fixing: https://bugs.webkit.org/show_bug.cgi?id=25117
+        (TextMatches don't have a concept of active match)
+
+        For the ports that use the DocumentMarker as highlighting for FindInPage it is
+        useful to have a flag that specifies which marker is active, so it can be drawn
+        in a different color.
+
+        This allows me to remove the hack to use the SelectionController to highlight
+        the active match (in the ChromiumWin port).
+
+        * dom/Document.cpp:
+        (WebCore::Document::setMarkersActive):
+        * dom/Document.h:
+        * dom/DocumentMarker.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::platformActiveTextSearchHighlightColor):
+        (WebCore::RenderTheme::platformInactiveTextSearchHighlightColor):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumWin::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumWin::platformActiveTextSearchHighlightColor):
+        (WebCore::RenderThemeChromiumWin::platformInactiveTextSearchHighlightColor):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-04-10  Pamela Greene  <pam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Build fix for Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=12440
+
+        * page/chromium/FrameChromium.cpp:
+        (WebCore::computePageRectsForFrame): change docWidth() to overflowWidth()
+
+2009-04-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt
+
+        Add a timer for style recalc (similar to the one used for scheduling layouts).  For now in order
+        to reduce the risk of regressions, I have left in all the synchronous machinery for updating style
+        following DOM events and JavaScript timeouts.  Eventually these calls will be removed.
+
+        Where the timer will really kick in and be useful is for clients that do style changes from
+        Objective-C DOM bindings or that execute JavaScript to manipulate style from the JavaScriptCore C API.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::removeChild):
+        (WebCore::ContainerNode::appendChild):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::scheduleStyleRecalc):
+        (WebCore::Document::unscheduleStyleRecalc):
+        (WebCore::Document::styleRecalcTimerFired):
+        (WebCore::Document::updateStyleForAllDocuments):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::setNeedsStyleRecalc):
+        (WebCore::Node::lazyAttach):
+
+2009-04-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6586787> JS debugger does not work in 64-bit
+
+        Don't truncate the source id in JSCallFrame
+
+        * inspector/JavaScriptCallFrame.h:
+
+2009-04-09  Adam Roben  <aroben@apple.com>
+
+        Start compiling HistoryPropertyList on Windows
+
+        Reviewed by Darin Adler.
+
+        * WebCore.vcproj/WebCore.vcproj: Added HistoryPropertyList and its
+        dependencies to the project. Copy headers from history/cf to
+        $WebKitOutputDir.
+        * history/cf/HistoryPropertyList.cpp: Added StringExtras.h so that
+        this file will compile on Windows.
+
+2009-04-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6166612> Text boxes' metrics should be based on
+          the actual fonts used in them, not just the primary font
+
+        Covered by many existing layout tests
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::floatWidth): Added a fallbackFonts parameter. If the
+        platform supports collecting fallback fonts in its complex font path
+        and fallbackFonts is not null, all fallback fonts used for the text run
+        will be added to it.
+
+        * platform/graphics/Font.h:
+        (WebCore::Font::width): Ditto.
+
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter): Removed an unnecessary namespace
+        qualifier.
+        (WebCore::Font::floatWidthForSimpleText): Added a fallbackFonts
+        parameter, which is passed down to WidthIterator.
+
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::WidthIterator): Added a fallbackFonts parameter
+        and used it to initialize the m_fallbackFonts member.
+        (WebCore::WidthIterator::advance): Track the fonts being used and add
+        any fallback fonts to the m_fallbackFonts set. Make sure to only add
+        non-small-caps fonts.
+
+        * platform/graphics/WidthIterator.h:
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns false, meaning this platform's
+        implementation of floatWidthForComplexText() does not populate the
+        fallbackFonts set.
+        (WebCore::Font::floatWidthForComplexText): Updated for the new
+        prototype.
+
+        * platform/graphics/chromium/FontLinux.cpp: Ditto.
+
+        * platform/graphics/gtk/FontGtk.cpp: Ditto.
+
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::CoreTextController): Added a fallbackFonts
+        parameter and used it to initialize the m_fallbackFonts member.
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters): Add
+        fallback fonts to m_fallbackFonts.
+
+        * platform/graphics/mac/CoreTextController.h:
+
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns true, indicating that the Mac
+        implementations of floatWidthForComplexText() populate the fallbackFonts
+        set.
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::ATSULayoutParameters::ATSULayoutParameters): Added a
+        fallbackFonts parameter and used it to initialize the m_fallbackFonts
+        member.
+        (WebCore::ATSULayoutParameters::initialize): Add fallback fonts to
+        m_fallbackFonts.
+        (WebCore::Font::floatWidthForComplexText): Added a fallbackFonts
+        parameter, which is passed down to ATSULayoutParameters.
+
+        * platform/graphics/mac/FontMacCoreText.cpp:
+        (WebCore::Font::floatWidthForComplexText): Added a fallbackFonts
+        parameter, which is passed down to CoreTextController.
+
+        * platform/graphics/win/FontWin.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns true, indicating that the
+        UniscribeController-based implementations of floatWidthForComplexText()
+        populate the fallbackFonts set.
+        (WebCore::Font::floatWidthForComplexText): Added a fallbackFonts
+        parameter, which is passed down to UniscribeController.
+
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::UniscribeController): Added a
+        fallbackfonts parameter and used it to initialize m_fallbackFonts.
+        (WebCore::UniscribeController::advance): Add fallback fonts to
+        m_fallbackFonts.
+
+        * platform/graphics/win/UniscribeController.h:
+        
+        * platform/graphics/wx/FontWx.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns false, meaning this platform's
+        implementation of floatWidthForComplexText() does not populate the
+        fallbackFonts set.
+        (WebCore::Font::floatWidthForComplexText): Updated for the new
+        prototype.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights): For an InlineTextBox
+        with multiple fonts, compute a common baseline and line height by
+        considering all fonts' ascents and descents (and line spacing, if
+        applicable).
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::setFallbackFonts): Added. Temporarily stores
+        the set of fallback fonts in a vector.
+        (WebCore::InlineTextBox::takeFallbackFonts): Added. Returns the fallback
+        fonts previously stored and removes them from storage.
+
+        * rendering/InlineTextBox.h:
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText): Initialized the
+        m_knownNotToUseFallbackFonts to false.
+        (WebCore::RenderText::styleDidChange): Reset
+        m_knownNotToUseFallbackFonts to false if the style difference is such that
+        affects layout.
+        (WebCore::RenderText::widthFromCache): Added a fallbackFonts parameter,
+        which is passed down to Font::width().
+        (WebCore::RenderText::trimmedPrefWidths): Updated for the change to
+        widthFromCache().
+        (WebCore::RenderText::calcPrefWidths): Made this call a private version
+        of calcPrefWidths() that takes a fallbackFonts parameter and set the
+        m_knownNotToUseFallbackFonts to true if the set comes back empty.
+        The private version passes the fallbackFonts set to widthFromCache().
+        (WebCore::RenderText::setText): Reset m_knownNotToUseFallbackFonts to
+        false.
+        (WebCore::RenderText::createFallbackFontMetricsBox): Added.
+        (WebCore::RenderText::width): Added a fallbackFonts parameter, which is
+        passed down to calcPrefWidths(), widthFromCache() and Font::width().
+        Set m_knownNotToUseFallbackFonts to true when appropriate.
+
+        * rendering/RenderText.h:
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::constructLine): Added an assertion and a continue
+        statement to remove one level of indentation.
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine): Temporarily
+        store the set of fallback fonts in the InlineTextBox.
+        (WebCore::RenderBlock::computeVerticalPositionsForLine): Added an
+        assertion.
+
+2009-04-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben
+
+        Rename all of the changed()/setChanged()/setDocumentChanged() methods to mention style recalc
+        explicitly instead.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::updateStyleIfNeededForBindings):
+        (WebCore::ScriptController::initJavaJSBindings):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removeProperty):
+        (WebCore::CSSMutableStyleDeclaration::setNeedsStyleRecalc):
+        (WebCore::CSSMutableStyleDeclaration::setProperty):
+        (WebCore::CSSMutableStyleDeclaration::setStringProperty):
+        (WebCore::CSSMutableStyleDeclaration::setImageProperty):
+        (WebCore::CSSMutableStyleDeclaration::parseDeclaration):
+        (WebCore::CSSMutableStyleDeclaration::addParsedProperties):
+        (WebCore::CSSMutableStyleDeclaration::setCssText):
+        (WebCore::CSSMutableStyleDeclaration::merge):
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        * css/CSSMutableStyleDeclaration.h:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::allVisitedStateChanged):
+        (WebCore::CSSStyleSelector::SelectorChecker::visitedStateChanged):
+        * css/CSSVariablesDeclaration.cpp:
+        (WebCore::CSSVariablesDeclaration::removeVariable):
+        (WebCore::CSSVariablesDeclaration::setVariable):
+        (WebCore::CSSVariablesDeclaration::setNeedsStyleRecalc):
+        * css/CSSVariablesDeclaration.h:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::removeChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::ContainerNode::detach):
+        (WebCore::ContainerNode::setFocus):
+        (WebCore::ContainerNode::setActive):
+        (WebCore::ContainerNode::setHovered):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::scheduleStyleRecalc):
+        (WebCore::Document::unscheduleStyleRecalc):
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::updateStyleIfNeeded):
+        (WebCore::Document::updateStyleForAllDocuments):
+        (WebCore::Document::updateLayout):
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::prepareMouseEvent):
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::setCSSTarget):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        (WebCore::checkForSiblingStyleChanges):
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::parseMaxLengthAttribute):
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        * dom/Node.cpp:
+        (WebCore::Node::Node):
+        (WebCore::Node::setNeedsStyleRecalc):
+        (WebCore::Node::lazyAttach):
+        (WebCore::Node::dispatchGenericEvent):
+        * dom/Node.h:
+        (WebCore::Node::needsStyleRecalc):
+        (WebCore::Node::childNeedsStyleRecalc):
+        (WebCore::Node::setChildNeedsStyleRecalc):
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::setSelectedState):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::evaluateScript):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+        (WebCore::StyledElement::classAttributeChanged):
+        (WebCore::StyledElement::parseMappedAttribute):
+        * dom/Text.cpp:
+        (WebCore::Text::recalcStyle):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::insertErrorMessageBlock):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::enable):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setBaseWritingDirection):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        (WebCore::SelectionController::layout):
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::setInnerText):
+        (WebCore::HTMLElement::isContentEditable):
+        (WebCore::HTMLElement::isContentRichlyEditable):
+        (WebCore::HTMLElement::contentEditable):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::recalcStyle):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::setIndeterminate):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setAutofilled):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::finishParsingChildren):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateWidget):
+        (WebCore::HTMLObjectElement::finishParsingChildren):
+        (WebCore::HTMLObjectElement::childrenChanged):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::restoreState):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::typeAheadFind):
+        * html/HTMLTableElement.cpp:
+        (WebCore::setTableCellsChanged):
+        (WebCore::HTMLTableElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::executeScript):
+        (WebCore::FrameLoader::gotoAnchor):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::alert):
+        (WebCore::DOMWindow::confirm):
+        (WebCore::DOMWindow::prompt):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hoverTimerFired):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::needsLayout):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::setNeedsStyleRecalc):
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationBase.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::clear):
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        (WebCore::AnimationControllerPrivate::startupdateStyleIfNeededDispatcher):
+        (WebCore::AnimationControllerPrivate::addEventToDispatch):
+        (WebCore::AnimationControllerPrivate::addNodeChangeToDispatch):
+        (WebCore::AnimationControllerPrivate::animationTimerFired):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
+        (WebCore::AnimationController::cancelAnimations):
+        * page/animation/AnimationControllerPrivate.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::endAnimation):
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateDragState):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionBounds):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::svgAttributeChanged):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue):
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::svgAttributeChanged):
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::setNeedsUpdate):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::addCSSPropertyAndNotifyAttributeMap):
+        * svg/SVGStopElement.cpp:
+        (WebCore::SVGStopElement::parseMappedAttribute):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::parseMappedAttribute):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::svgAttributeChanged):
+        (WebCore::SVGUseElement::childrenChanged):
+        (WebCore::SVGUseElement::recalcStyle):
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::updateAnimations):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::parseMappedAttribute):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+
+2009-04-09  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        When there is a shadow set but it specifies "no shadow", clear the
+        shadow shader. This will prevent Chromium from thinking there's a
+        shadow and using the Skia codepath rather than Windows.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-04-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Crash when accessing svg.viewport on a detached SVGSVGElement
+        https://bugs.webkit.org/show_bug.cgi?id=25105
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::isOutermostSVG): return "true" that we are the "outermost" SVG element if we have no parent.  (The spec is unclear as to what behavior we should have in this case, and I doubt anyone cares for now).
+
+2009-04-09  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25084
+        Upstream changes to V8 bindings for XHR so that it can work under either DOMWindow or WorkerContext.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListenerHelper):
+        (WebCore::WorkerContextExecutionProxy::FindOrCreateEventListener):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateObjectEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-04-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson and Sam Weinig.
+
+        Part of <rdar://problem/5438063> Saving history containing 100,000 entries causes pauses of 2s while browsing
+
+        Longer term solution is to change the design so Safari doesn't read and write all of history.
+        This patch is step one: Do the serializing, which is done on the main thread, much faster.
+
+        * WebCore.base.exp: Added new entry points.
+        * WebCore.xcodeproj/project.pbxproj: Added new source files.
+
+        * history/cf: Added.
+
+        * history/cf/HistoryPropertyList.cpp: Added.
+        * history/cf/HistoryPropertyList.h: Added. Code to write history files. In the future we'll also
+        have code for reading here too.
+
+        * platform/cf/BinaryPropertyList.cpp: Added.
+        * platform/cf/BinaryPropertyList.h: Added. Code to write binary property list files.
+
+2009-04-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        https://bugs.webkit.org/show_bug.cgi?id=25122
+
+        If deferred repainting is active, we need to ensure that there are no repaints
+        pending at the end of layoutIfNeededRecursive, which is called just before
+        painting via -viewWillDraw.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+
+2009-04-09  John Grabowski  <jrg@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25117
+        Fix Mac Chromium form controls.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        When rendering native controls in Mac Chromium, use a clean NSGraphicsContext.
+        Properly save and restore native graphics context.
+        (WebCore::RenderThemeChromiumMac::paintCheckbox):
+        (WebCore::RenderThemeChromiumMac::paintRadio):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+
+2009-04-09  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25030
+        Refactor MessagePort code to enable Chrome to use a MessagePortProxy object
+        instead of a real MessagePort for the entangledPort, since it could
+        theoretically live in a separate process.
+
+        The goal of this refactoring is to remove all assumptions that the object
+        representing the entangled port is actually of type MessagePort. All
+        operations that were previously directly modifying private MessagePort member
+        variables in the entangled port (i.e. entangle(), postMessage()) have been changed
+        to invoke functions in the  MessagePortProxy interface instead which will allow
+        the Chrome bindings to proxy these calls to another process.
+
+        No new layout tests, as this is just a refactoring with no bug fixes
+        or new functionality.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::clone):
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::deliverMessage):
+        (WebCore::MessagePort::startConversation):
+        (WebCore::MessagePort::close):
+        (WebCore::MessagePort::entangle):
+        (WebCore::MessagePort::unentangle):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::entangledPort):
+        * dom/MessagePortProxy.h: Added.
+        (WebCore::MessagePortProxy::~MessagePortProxy):
+
+2009-04-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Big Boy" Garen.
+
+        Fix for <rdar://problem/5745677> Possible to stop load during an unload event
+        Also fixes https://bugs.webkit.org/show_bug.cgi?id=20605
+
+        Tests: fast/events/stop-load-in-unload-handler-using-document-write.html
+               fast/events/stop-load-in-unload-handler-using-window-stop.html
+
+        Don't allow calling methods that would stop the new load inside the unload
+        event.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::stopAllLoaders):
+        * loader/FrameLoader.h:
+
+2009-04-09  David Kilzer  <ddkilzer@apple.com>
+
+        Reinstating <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Rolled r42345 back in.  The build failure was caused by an
+        internal script which had not been updated the same way that
+        build-webkit was updated.
+
+        * Configurations/WebCore.xcconfig:
+        * DerivedSources.make:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        (+[DOMNode _wrapNode:WebCore::]):
+        * bindings/objc/DOMCSS.mm:
+        (+[DOMCSSValue _wrapCSSValue:WebCore::]):
+        * bindings/objc/DOMEvents.mm:
+        (+[DOMEvent _wrapEvent:WebCore::]):
+        * bindings/objc/DOMInternal.h:
+        * bindings/objc/ExceptionHandlers.mm:
+        (WebCore::raiseDOMException):
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLObjectElement.idl:
+
+2009-04-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=25109
+
+        Eliminate CompositeAnimationPrivate, which was a needless level
+        of abstraction. Remove the methods like addToStyleAvailableWaitList()
+        that simply turn around and call the animation controller.
+        
+        Rename animationControllerPriv() to animationController().
+        Rename willNeedService() to timeToNextService().
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::~AnimationBase):
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::timeToNextService):
+        (WebCore::AnimationBase::beginAnimationUpdateTime):
+        * page/animation/AnimationBase.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::~CompositeAnimation):
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::overrideImplicitAnimations):
+        (WebCore::CompositeAnimation::resumeOverriddenImplicitAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::pauseTransitionAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        * page/animation/CompositeAnimation.h:
+        (WebCore::CompositeAnimation::animationController):
+        (WebCore::CompositeAnimation::isSuspended):
+        (WebCore::CompositeAnimation::hasAnimations):
+        (WebCore::CompositeAnimation::CompositeAnimation):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        (WebCore::ImplicitAnimation::timeToNextService):
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        (WebCore::KeyframeAnimation::timeToNextService):
+        * page/animation/KeyframeAnimation.h:
+
+2009-04-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reverting <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings.
+        It broke Mac build, and I don't know how to fix it.
+
+        * Configurations/WebCore.xcconfig:
+        * DerivedSources.make:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        (+[DOMNode _wrapNode:WebCore::]):
+        * bindings/objc/DOMCSS.mm:
+        (+[DOMCSSValue _wrapCSSValue:WebCore::]):
+        * bindings/objc/DOMEvents.mm:
+        (+[DOMEvent _wrapEvent:WebCore::]):
+        * bindings/objc/DOMInternal.h:
+        * bindings/objc/ExceptionHandlers.mm:
+        (WebCore::raiseDOMException):
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLObjectElement.idl:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        RenderView::docWidth() was made private by r42334. That commit
+        changes its usage for overflowWidth(), so do that here too.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::computePageRects):
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Implement AtkObject::ref_state_set. Still quite a few states not
+        implemented.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Move fallback object creation to its own function, as it will be
+        used in several places.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject):
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Move AccessibilityObject methods to their file.
+
+        * page/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::wrapper):
+        (WebCore::AccessibilityObject::setWrapper):
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Rework accessibility type generation code, based on Mozilla a11y
+        implementation.
+
+        Have one base a11y type, and generate derived types that implement
+        only the necessary interfaces at runtime, based on the specific
+        object we are wrapping. This allows to save a lot of code while
+        covering all possible cases.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix document.implementation.createDocument(null, "a:b") not to crash!
+        https://bugs.webkit.org/show_bug.cgi?id=25096
+
+        Test: fast/dom/DOMImplementation/createDocument-namespace-err.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::addChild): add ASSERT() to give a better crash next time
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument): check the exception code before using the result
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Make <select>s in application chrome documents match the Vista system
+        dialog look
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::documentIsInApplicationChromeMode): Added this simple helper
+        function.
+        (WebCore::RenderThemeWin::getThemeData): In application chrome mode,
+        the drop down button never uses any look but the "normal" look.
+        (WebCore::RenderThemeWin::paintMenuList): In application chrome mode,
+        use the "readonly" style to match system dialogs.
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Fix <rdar://6592515> Crash closing tab with Top Sites or Cover Flow
+        showing after clicking "Go Back" in phishing alert
+
+        RenderButton's m_timer is not stopped when its Document enters the
+        page cache. When the WebView was torn down, the timer would fire after
+        the Frame's Page had been destroyed, leading to a crash. This patch
+        just makes the timer do nothing when it fires. Making the timer not
+        fire when in the page cache is covered by bug 25110.
+
+        Reviewed by Dave Hyatt.
+
+        No test possible.
+
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::timerFired): Do nothing when we're in the page
+        cache.
+
+2009-04-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben
+
+        Fix bugs where we would mistakenly turn off blitting for iframes if an external paint
+        caused the checks to be triggered too early in the loading process of the frame.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+
+2009-04-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Cameron Zwarich
+
+        https://bugs.webkit.org/show_bug.cgi?id=25106
+        
+        Fix signature of virtual function on AnimationBase so that it matches
+        those in the derived classes, by removing unused parameter.
+        
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::endAnimation):
+
+2009-04-08  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Reviewed by Darin Adler and Maciej Stachowiak.
+
+        Introduce the ENABLE_SVG_DOM_OBJC_BINDINGS feature define so
+        that SVG DOM Objective-C bindings may be optionally disabled.
+
+        * Configurations/WebCore.xcconfig: Added
+        ENABLE_SVG_DOM_OBJC_BINDINGS variable and use it in
+        FEATURE_DEFINES and EXCLUDED_SOURCE_FILE_NAMES.  When SVG DOM
+        Objective-C bindings are disabled, two generated header files no
+        longer exist and none of the generated DOMSVG*.mm files should
+        be compiled.
+        * DerivedSources.make: All of the WebCore.SVG*.exp files contain
+        SVG DOM Objective-C bindings classes, so exclude them unless
+        ENABLE_SVG_DOM_OBJC_BINDINGS is set.
+        * bindings/objc/DOM.mm: Switched from using ENABLE(SVG) to using
+        ENABLE(SVG_DOM_OBJC_BINDINGS).
+        (WebCore::createElementClassMap):
+        (+[DOMNode _wrapNode:WebCore::]):
+        * bindings/objc/DOMCSS.mm: Ditto.
+        (+[DOMCSSValue _wrapCSSValue:WebCore::]):
+        * bindings/objc/DOMEvents.mm: Ditto.
+        (+[DOMEvent _wrapEvent:WebCore::]):
+        * bindings/objc/DOMInternal.h: Ditto.
+        * bindings/objc/ExceptionHandlers.mm: Added use of
+        ENABLE(SVG_DOM_OBJC_BINDINGS).
+        (WebCore::raiseDOMException):
+        * html/HTMLEmbedElement.idl: Excluded -getSVGDocument method
+        in generated Objective-C DOM classes if SVG DOM Objective-C
+        bindings are disabled.
+        * html/HTMLFrameElement.idl: Ditto.
+        * html/HTMLIFrameElement.idl: Ditto.
+        * html/HTMLObjectElement.idl: Ditto.
+
+2009-04-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - limit the workaround for <rdar://problem/5781372> to Mac OS X versions
+          that need it
+
+        * platform/mac/WebFontCache.mm:
+        (fixUpWeight): Changed this function to be a no-op post-Leopard.
+
+2009-04-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6771547> Appending to a RenderText causes all its
+          lines to be dirtied
+
+        Test: fast/repaint/text-append-dirty-lines.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setTextWithOffset): If no text boxes intersected
+        with or came after the new text, dirty the last root box, since the new
+        text may begin there. Having at least one dirty line prevents the
+        incorrect dirtying of all lines later during layoutInlineChildren().
+
+2009-04-08  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25100
+
+        Fixes a Chromium-specific crash in WebCore::ImageBuffer::context that
+        occurs when rendering semi-transparent RTL text.
+
+        Test: fast/text/complex-text-opacity.html
+
+        * platform/graphics/chromium/FontChromiumWin.cpp: Handle RTL when computing text bounds.
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::estimateTextBounds):
+
+2009-04-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin
+
+        Fix a porting error in my previous patch.  A != was supposed to be an ==.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-04-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben and Darin Adler
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=12440, repaints inconsistent for
+        fixed positioned elements.
+
+        Rewrite the updateScrollers method to be more correct in its results.
+
+        Test: fast/block/positioning/fixed-positioning-scrollbar-bug.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::implicitClose):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::adjustPageHeight):
+        * page/FrameView.h:
+        * page/win/FrameWin.cpp:
+        (WebCore::computePageRectsForFrame):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollView.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        (WebCore::RenderView::docHeight):
+        (WebCore::RenderView::docWidth):
+        * rendering/RenderView.h:
+
+2009-04-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/6226200> Implement Microsoft's X-FRAME-OPTIONS anti-framing defense
+
+        Tests: http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html
+               http/tests/security/XFrameOptions/x-frame-options-deny.html
+               http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-allow.html
+               http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv): Stop the current load and redirect to about:blank
+        if an X-FRAME-OPTIONS <meta> tag http-equiq dictates we should.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldInterruptLoadForXFrameOptions): Add logic to parse
+        the X-FRAME-OPTIONS parameter.
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse): Stop the current load if framed and
+        a X-FRAME-OPTIONS header and its parameter dictate that we should.
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Fix http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect.html on Windows
+
+        Reviewed by Sam Weinig.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously): Mimic the
+        ResourceHandleMac code by propagating the CFError's error code for
+        kCFErrorDomainCFNetwork errors to the ResourceResponse.
+
+2009-04-08  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the PPC build.
+        
+        * plugins/npfunctions.h:
+
+2009-04-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/5908616> tokenizer resizer should handle edge cases consistently
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::enlargeBuffer): Handle edge cases the same way as a failed fastMalloc.
+        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Ditto.
+
+2009-04-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler
+
+        Make sure that cloneNode works with SVG attributes that require synchronization.  This fixes
+        issues with <use> element shadow tree cloning where the clones can end up not obtaining the
+        correct attribute values.
+
+        A subsequent patch of mine will expose this problem and cause it to be covered by existing
+        layout tests, so no test is required at this time for this problem.
+
+        * dom/Element.cpp:
+        (WebCore::Element::cloneElementWithoutChildren):
+
+2009-04-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25093
+        REGRESSION: some scripts are showing in the Inspector with only "true"
+        as the source.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didParseSource): Fixed conversion issue.
+        (WebCore::InspectorController::failedToParseSource): Ditto.
+
+2009-04-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24904
+
+        Verify the MIME type of stylesheets (in standards mode) by looking
+        at the Content-Type header directly.  This bypasses any content
+        sniffing that might be confusing the issue.
+
+        Test: http/tests/mime/standard-mode-loads-stylesheet-without-content-type-header.html
+
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::canUseSheet):
+
+2009-04-08  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25041
+        <rdar://problem/6697754>
+        Bug 25041: HTMLMediaElement: OSX autoplay broken by r41907
+        
+        OSX media player should set readyState to HAVE_ENOUGH_DATA when the movie's load state
+        reaches QTMovieLoadStatePlaythroughOK, not when the entire file has been downloaded,
+        so autoplay can begin when it should.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates): Set readState to 
+        HAVE_ENOUGH_DATA when QTMovie load state reaches QTMovieLoadStatePlaythroughOK.
+        (WebCore::MediaPlayerPrivate::paint): Add braces missed in r42203.
+
+2009-04-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Kilzer. Based on a patch by Grace Kloba.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24656
+        cacheControlContainsNoCache() in ResourceResponseBase.h is wrong
+
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives): Removed misused code for
+        parsing directive values, fixing parsing of directives that we care about.
+
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::cacheControlContainsNoCache): Fixed a copy/paste mistake,
+        m_cacheControlContainsMustRevalidate was returned instead of m_cacheControlContainsNoCache.
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Make text fields match the system look on Vista
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::getThemeData): Use the new-to-Vista
+        EP_EDITBORDER_NOSCROLL part for text fields.
+
+2009-04-07  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24957
+        REGRESSION: Google calendar widget no longer shows upcoming events
+
+        Test: http/tests/xmlhttprequest/authorization-header.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequestStaticData::XMLHttpRequestStaticData): Removed Authorization from
+        the list of forbidden headers.
+
+2009-04-07  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Remove no longer needed debug warning and Windows-specific codepaths
+        (as we now use the Safari/Win port's timer there)
+
+        https://bugs.webkit.org/show_bug.cgi?id=25070
+
+        * platform/wx/SharedTimerWx.cpp:
+        (WebCore::setSharedTimerFireTime):
+
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Fix many <video> regression tests on Windows
+
+        Reviewed by Dave Hyatt.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::getNaturalSize): Call GetMovieNaturalBoundsRect, which
+        returns the movie's natural bounds (duh), rather than GetMovieBox,
+        which returns the movie's current displayed size/position.
+
+2009-04-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig
+
+        <rdar://problem/5968249> "Private Browsing" doesn't affect HTML 5 LocalStorage
+
+        The expected behavior for persistent storage when private browsing mode is undefined by the spec.
+        For now we're going with a "read-only when in private browsing" policy until we can get feedback
+        and/or get the behavior specified in the spec.
+
+        Note that I purposefully made the change to restrict SessionStorage to read-only, also, with the
+        understanding that the spec allows for SessionStorage to persist across relaunches, even though
+        our implementation currently doesn't do this.
+
+        * dom/DOMCoreException.idl: Add some new ExceptionCodes defined in HTML5, one of which is needed
+          for LocalStorage changes (QUOTA_EXCEEDED_ERR)
+        * dom/ExceptionCode.cpp: 
+        * dom/ExceptionCode.h:
+
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::internalSetItem): If private browsing is enabled, throw the QUOTA_EXCEEDED_ERR
+          exception as the spec allows.
+        (WebCore::StorageArea::internalRemoveItem): If private browsing is enabled, silently fail to remove
+          the item.
+        (WebCore::StorageArea::internalClear): If private browsing is enabled, silently fail to clear the area.
+
+2009-04-07  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6148255>
+
+        Standalone media documents can not always handle everything
+        using a <video> element. In these cases switch to an <embed>
+        element that uses the QuickTime plugin, in the hope that it
+        will have more luck. Typical media types that trigger this
+        are streamed media and QTVR.
+
+        Equivalent Windows fix to come once reviewed. Note also that
+        this area of code needs a cleanup:
+        https://bugs.webkit.org/show_bug.cgi?id=25085
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerSawUnsupportedTracks):
+        * html/HTMLMediaElement.h:
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::mediaElementSawUnsupportedTracks):
+        (WebCore::MediaDocument::replaceVideoWithEmbed):
+        * loader/MediaDocument.h:
+            - removes the <video> element and puts in an <embed>
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerSawUnsupportedTracks):
+            - new internal method for flagging a problem
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::updateStates):
+            - looks for the types of content we don't handle
+        (WebCore::MediaPlayerPrivate::rateChanged):
+        (WebCore::MediaPlayerPrivate::sizeChanged):
+        (WebCore::MediaPlayerPrivate::timeChanged):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+        (WebCore::MediaPlayerPrivate::sawUnsupportedTracks):
+            - inform the MediaClient that we have a potential problem
+
+2009-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6767428> Resurrect
+          +[WebFontCache fontWithFamily:traits:size:] for clients that call it
+          directly
+
+        WebFontCache is a class in the WebCore framework and is not WebKit API,
+        but apparently (perhaps mistakenly) some clients call this private
+        interface.
+
+        This change resurrects the interface and gives it reasonable behavior
+        (however, note that WebCore will not call the old interface, so hacks that
+        override it will have no effect on WebKit clients).
+
+        * platform/mac/WebFontCache.h:
+        * platform/mac/WebFontCache.mm:
+        (+[WebFontCache fontWithFamily:traits:size:]): Added. Call through to
+        +fontWithFamily:traits:weight:size:.
+
+2009-04-07  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben
+
+        Fix ScrollView's algorithm that determines whether or not to show scrollbars.  There was a bug
+        with the method mainly because RenderView will size itself to the viewport's size, making it
+        impossible to really know the document's "true" size.
+
+        In order to solve this problem ScrollView now has a minimumContentsSize method.  This method
+        returns the document size excluding the RenderView from the calculation.  This width/height
+        is now cached on RenderView in m_docWidth/m_docHeight member variables.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustPageHeight):
+        (WebCore::FrameView::minimumContentsSize):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::minimumContentsSize):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        (WebCore::RenderView::calcDocHeight):
+        (WebCore::RenderView::calcDocWidth):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::docWidth):
+        (WebCore::RenderView::docHeight):
+
+2009-04-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Build fix, not reviewed.
+
+        * WebCore.xcodeproj/project.pbxproj: Made ScriptObject.h private.
+
+2009-04-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25063
+        Refactor InspectorController to use ScriptObject/State.
+
+        * GNUmakefile.am: Added ScriptState.cpp.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::addSourceToFrame): Fixed argument index typo.
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call): Added reportExceptions parameter.
+        (WebCore::ScriptFunctionCall::construct): Ditto.
+        * bindings/js/ScriptFunctionCall.h: Ditto.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::handleException): Added exception-reporting heloper.
+        (WebCore::ScriptObject::set): Changed to use handleException.
+        (WebCore::ScriptGlobalObject::set): Ditto,
+        * bindings/js/ScriptObject.cpp: Added ScriptGlobalObject.
+        (WebCore::ScriptGlobalObject::set): Added.
+        (WebCore::ScriptGlobalObject::getObject): Added.
+        * bindings/js/ScriptObject.h: Added ScriptGlobalObject decls.
+        (WebCore::ScriptGlobalObject::ScriptGlobalObject): Added.
+        * bindings/js/ScriptState.cpp: Added.
+        * bindings/js/ScriptState.h: Added scriptStateFromPage decl.
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole): Changed to not report exceptions
+            to avoid re-entrancy.
+        * inspector/InspectorController.cpp: Refactored to use ScriptState/Object.
+        * inspector/InspectorController.h: Ditto.
+
+2009-04-07  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25083
+
+        Skia was previously calculating the leading value incorrectly, leading
+        us to add fHeight to get the height of a line of text. Now that Skia
+        is calculating fLeading correctly, we can remove fHeight.
+
+        This doesn't affect any layout tests.
+
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-04-07  Brian Weinstein  <bweinstein@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24851
+
+        This fix removes the status code from the status message in a ResourceResponse, which allows a few more tests in http to pass.
+
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2009-04-07  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25081
+
+        Skia is changing from reporting the XRange to reporting the XMin and
+        XMax.  Obviously these are equivalent, but other users of the metrics
+        need the two numbers to be separate.
+
+        This doesn't affect any layout tests.
+
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Make the look of <select>s match the system look on Vista
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderThemeWin.cpp: Added new constants.
+        (WebCore::RenderThemeWin::getThemeData): On Vista, use the
+        CP_DROPDOWNBUTTONRIGHT part for drop down buttons.
+        (WebCore::RenderThemeWin::paintMenuList): On Vista, use the CP_BORDER
+        part to draw the border of <select>s.
+        (WebCore::RenderThemeWin::paintMenuListButton): On Vista, outset the
+        drop down button to make its border coincide with the <select>'s
+        border.
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Move isRunningOnVistaOrLater to a shared location
+
+        Rubber-stamped in advance by Dave Hyatt.
+
+        * WebCore.vcproj/WebCore.vcproj: Added SystemInfo.{cpp,h}, and let VS
+        have its way with the rest of the file.
+        * platform/win/ScrollbarThemeWin.cpp: Moved isRunningOnVistaOrLater
+        from here...
+        * platform/win/SystemInfo.cpp: Added.
+        (WebCore::isRunningOnVistaOrLater): ...to here.
+        * platform/win/SystemInfo.h: Added.
+
+2009-04-07  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24692
+        Enable PopupMenuChromium to handle HTML select popups using native
+        cocoa controls on the Mac, all other platforms are unchanged.
+
+        We also split out the storage container for the popup menu items
+        so that ChromeClientChromium can access them for forwarding to
+        the embedding host (Chromium.app or test_shell).
+
+        * page/chromium/ChromeClientChromium.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::items):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::~PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::showExternal):
+        (WebCore::PopupContainer::menuItemHeight):
+        (WebCore::popupData):
+        (WebCore::PopupListBox::pointToRowIndex):
+        (WebCore::PopupListBox::getRowBounds):
+        (WebCore::PopupListBox::isSelectableItem):
+        (WebCore::PopupListBox::updateFromElement):
+        (WebCore::PopupListBox::layout):
+        (WebCore::PopupListBox::clear):
+        (WebCore::PopupMenu::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (WebCore::PopupItem::):
+        (WebCore::PopupItem::PopupItem):
+
+2009-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Added some double-checking to event handler marking. Now, when the
+        wrapper that's responsible for marking an event handler's JavaScript
+        function gets collected, it clears the event handler's JavaScript function
+        so we won't dereference it after it's collected.
+        
+        In theory, we would never dereference a JavaScript event handler after
+        its node's wrapper was collected anyway, but it's nice to be safe.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::invalidateJSFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::markEventListeners):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::mark):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::mark):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::mark):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::invalidateJSFunction):
+        (WebCore::EventListener::markJSFunction):
+        (WebCore::markIfNotNull):
+
+2009-04-07  David Levin  <levin@chromium.org>
+
+        Build fix.
+
+        r44280 undid the change in r42268 that made CookieJar.h private.
+        This redoes the change.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-04-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream changes to WorkerContextExecutionProxy for enabling V8 preemption.
+        https://bugs.webkit.org/show_bug.cgi?id=25034
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+
+2009-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6764359> Thai word selection misbehaves for the
+          last sentence in the document
+
+        Test: editing/selection/thai-word-at-document-end.html
+
+        * editing/visible_units.cpp:
+            - Added a BoundarySearchContextAvailability enum used to indicate
+            whether the caller to a boundary search function may be able to provide
+            additional text in the search direction and call again.
+            - Added a named type for the boundary search function signature. Changed
+            the signature to take a context availability parameter and a boolean
+            out parameter indicating whether more context is needed to perform
+            the search.
+        (WebCore::previousBoundary): If the beginning of the range was reached
+            but the last search wanted more context, perform the search again, this
+            time indicating that there is no earlier text.
+        (WebCore::nextBoundary): Similarly, in the other direction.
+        (WebCore::startWordBoundary): Check whether more context may be available
+            and ask for more context if needed.
+        (WebCore::endWordBoundary): Ditto.
+        (WebCore::previousWordPositionBoundary): Ditto.
+        (WebCore::nextWordPositionBoundary): Ditto.
+        (WebCore::startSentenceBoundary):  Updated signature.
+        (WebCore::endSentenceBoundary): Ditto.
+        (WebCore::previousSentencePositionBoundary): Ditto.
+        (WebCore::nextSentencePositionBoundary): Ditto.
+
+2009-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Sam Weinig.
+        
+        A little renaming:
+        
+        function => jsFunction
+        listener => jsFunction
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::mark):
+        (WebCore::JSProtectedEventListener::JSProtectedEventListener):
+        (WebCore::JSProtectedEventListener::~JSProtectedEventListener):
+        (WebCore::JSProtectedEventListener::jsFunction):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSProtectedEventListener::create):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::jsFunction):
+        (WebCore::JSLazyEventListener::parseCode):
+        * dom/EventListener.h:
+        (WebCore::EventListener::jsFunction):
+
+2009-04-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        While working on <rdar://problem/5968249>, noticed some glaring problems with LocalStorage.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage): Return the cached m_localStorage object if it exists to 
+          avoid creating multiple representations for the same underlying StorageArea.
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::optionalLocalStorage): Return m_localStorage, not m_sessionStorage.
+
+2009-04-07  Darin Adler  <darin@apple.com>
+
+        Roll out incorrect build fix.
+
+        * WebCore.NPAPI.exp: Reverted.
+
+2009-04-07  Darin Adler  <darin@apple.com>
+
+        Another build fix.
+
+        * WebCore.NPAPI.exp: Added new functions.
+
+2009-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Another build fix.
+        
+        * plugins/npfunctions.h:
+
+2009-04-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Fix non-Mac builds.
+
+        * bridge/npapi.h:
+
+2009-04-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=25082
+        
+        Clean up repaint logic when RenderLayers become and stop being composited.
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        (WebCore::RenderLayer::repaintIncludingNonCompositingDescendants):
+        New compositing-only method that repaints a layer and all its non-composited descendants.
+        Takes a repaintContainer for performance; all the repaints necessarily share the same
+        repaintContainer.
+
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        Rather than use calculateCompositedBounds() to compute the repaint rect (which gave
+        the wrong answer when the composited layer tree was in flux), use the new
+        repaintOnCompositingChange() method.
+        
+        (WebCore::RenderLayerCompositor::repaintOnCompositingChange):
+        Call repaintIncludingNonCompositingDescendants(), and if necessary make sure
+        that the view/layer drawing synchronization happens.
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Do a repaintOnCompositingChange() when a layer is going to be composited. This is
+        a good place because we haven't started to change the compositing tree.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        After we've finished updating all the descendant layers, we can do a repaint for
+        layers that ceased compositing.
+
+2009-04-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25069
+        
+        Clean up the accelerated compositing code that determines the format of
+        the GraphicsLayer hierarchy, being more explicit about which parts have
+        to happen before and after descendant layers have been updated. Also remove
+        some unhelpful caching of state.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        Only call updateCompositingLayers() if we know we're not going to be
+        doing a layout soon.
+        
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setDrawsContent):
+        Toggling drawsContent from false to true should do a setNeedsDisplay().
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+        updateLayerCompositingState() no longer updates the layer geometry, so
+        do that here if we're not going to rebuild layers anyway.
+        Also, updateLayerCompositingState() no longer does a setContentsNeedDisplay,
+        so do that if the style change indicates that a repaint is required.
+        
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        The 'drawing optimizations' logic has been rolled into updateGraphicsLayerConfiguration()
+        and updateGraphicsLayerGeometry().
+        
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        Group that code that decides what GraphicsLayers are needed into this method,
+        which deals with clipping layers and 'direct compositing': images that can be
+        rendered via the compositor.
+        
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        Call setDrawsContent() if updateGraphicsLayerConfiguration() didn't already
+        figure it out for image layers.
+        
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+        Remove the m_simpleCompositingLayerStatusDirty cache indicator, since we just
+        computed it every time anyway.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        updateGraphicsLayers() was renamed to updateGraphicsLayerConfiguration(),
+        which calls clippedByAncestor() etc. itself rather than having everything passed in.
+        Repaints are taken care of by styleChanged() and setDrawsContent().
+        
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        !layer->isComposited() && layer->transform() is a synonym for paintsWithTransform().
+        
+        (WebCore::RenderLayerCompositor::setCompositingParent):
+        No need to call updateGraphicsLayerGeometry() here, because we're going to
+        rebuild layers anyway.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        Add comments, and test layerBacking instead of layer->isComposited().
+
+2009-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+        
+        * WebCore.base.exp:
+
+2009-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6667001> NPAPI: need NPN_Get/SetValueForURL() and NPN_GetAuthenticationInfo()
+        
+        * WebCore.base.exp:
+        Add symbols needed by WebKit.
+        
+        * WebCore.xcodeproj/project.pbxproj:
+        Make CookieJar a private header.
+        
+        * bridge/npapi.h:
+        Add function definitions.
+        
+        * plugins/npfunctions.h:
+        Fix the NPN_SetValueForURLProcPtr signature.
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Fix <rdar://6520933> REGRESSION (3.2.1-ToT): Scroll bar disappears in
+        WebView and Bookmarks view after switching theme or turning on High
+        Contrast mode
+
+        Reviewed by Dave Hyatt.
+
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::themeChanged): Null out scrollbarTheme
+        after closing it so that we'll re-open the theme next time we paint.
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Small cleanup/correctness fix in ScrollbarThemeWin
+
+        Reviewed by Dave Hyatt.
+
+        * platform/win/ScrollbarThemeWin.cpp: Removed the now-unused
+        haveTheme boolean.
+        (WebCore::checkAndInitScrollbarTheme): Check IsThemeActive() before
+        calling OpenThemeData. This seems to be what MSDN recommends.
+        (WebCore::ScrollbarThemeWin::themeChanged): Null-check scrollbarTheme
+        before closing it, rather than indirectly null-checking it via
+        checking haveTheme.
+
+2009-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - when -webkit-line-break: after-white-space is specified but the text
+          does not auto-wrap, do not shrink the trailing space to fit in the
+          available width
+
+        Test: fast/text/whitespace/nowrap-line-break-after-white-space.html
+
+        - when shrinking such trailing space, do not shrink below zero
+
+        Covered by existing tests
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-04-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move RangeBoundaryPoint off of Position, per Darin's suggestion
+        https://bugs.webkit.org/show_bug.cgi?id=24966
+
+        Rename setToChild to setToBeforeChild (since that's what the method does)
+
+        * dom/Position.h:
+        (WebCore::Position::offsetInContainerNode):
+        * dom/Range.cpp:
+        (WebCore::Range::insertNode):
+        (WebCore::Range::selectNodeContents):
+        (WebCore::boundaryNodeWillBeRemoved):
+        * dom/Range.h:
+        (WebCore::Range::startPosition):
+        (WebCore::Range::endPosition):
+        * dom/RangeBoundaryPoint.h:
+        (WebCore::RangeBoundaryPoint::RangeBoundaryPoint):
+        (WebCore::RangeBoundaryPoint::container):
+        (WebCore::RangeBoundaryPoint::childBefore):
+        (WebCore::RangeBoundaryPoint::position):
+        (WebCore::RangeBoundaryPoint::offset):
+        (WebCore::RangeBoundaryPoint::clear):
+        (WebCore::RangeBoundaryPoint::set):
+        (WebCore::RangeBoundaryPoint::setOffset):
+        (WebCore::RangeBoundaryPoint::setToBeforeChild):
+        (WebCore::RangeBoundaryPoint::setToStartOfNode):
+        (WebCore::RangeBoundaryPoint::setToEndOfNode):
+        (WebCore::RangeBoundaryPoint::childBeforeWillBeRemoved):
+        (WebCore::RangeBoundaryPoint::invalidateOffset):
+
+2009-04-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add containerNode(), computeOffsetInContainerNode(),
+        computeNodeBeforePosition() and computeNodeAfterPosition().
+        https://bugs.webkit.org/show_bug.cgi?id=24763
+
+        These functions will replace uses of rangeCompliantPosition()
+        in future patches.
+
+        No changes in behavior, thus no tests.
+
+        * dom/Position.cpp:
+        (WebCore::Position::containerNode):
+        (WebCore::Position::computeOffsetInContainerNode):
+        (WebCore::Position::computeNodeBeforePosition):
+        (WebCore::Position::computeNodeAfterPosition):
+        (WebCore::Position::anchorType):
+        * dom/Position.h:
+        (WebCore::Position::):
+
+2009-04-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Bottleneck dispatching mutation events in a new dispatchMutationEvent
+        function.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchMutationEvent):
+        * dom/Node.h:
+
+2009-04-06  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25059
+        Remove references to dominantScript, getGenericFontForScript.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp: Removed references
+            to getGenericFontForScript.
+        (WebCore::FontCache::getLastResortFallbackFont): Removed calls to dominantScript.
+        * platform/graphics/chromium/FontCacheLinux.cpp: Ditto.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::defaultGUIFont): Removed Document* arg.
+        (WebCore::RenderThemeChromiumLinux::systemFont): Ditto.
+        * rendering/RenderThemeChromiumLinux.h: Ditto.
+        * rendering/RenderThemeChromiumMac.h: Ditto.
+        * rendering/RenderThemeChromiumMac.mm: Ditto.
+        (WebCore::RenderThemeChromiumMac::systemFont): Ditto.
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::defaultGUIFont): Ditto.
+        (WebCore::RenderThemeChromiumWin::systemFont): Ditto.
+        * rendering/RenderThemeChromiumWin.h: Ditto.
+
+2009-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        The problem was that a protected event listener's scope chain would end
+        up with a reference to the Node protecting it, causing a cycle. The
+        solution is to stop protecting event listeners and rely on marking instead.
+
+        This patch converts most Node event listeners to use marking instead of
+        GC protection.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument): Refactored the test for whether a Node
+        needs marking, and added a case for marking the node in order to mark its
+        event listeners.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::markEventListeners):
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::mark): Added code to mark a Node's event listeners when
+        marking the Node. Changed code using protected event listeners to use event
+        listeners.
+
+        * dom/Node.idl: Changed code using protected event listeners to use event
+        listeners.
+
+2009-04-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove unchecked bool return values for some dispatch event functions.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchWebKitAnimationEvent):
+        (WebCore::Node::dispatchWebKitTransitionEvent):
+        (WebCore::Node::dispatchProgressEvent):
+        * dom/Node.h:
+
+2009-04-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25058
+        Fix chromium build bustage caused by r42216
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/DOMWindow.idl:
+
+2009-04-06  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20575
+        No localization in WebKitGtk
+
+        * platform/gtk/FileChooserGtk.cpp: Remove usage of glib/gi18n.h,
+        since there are not translatable strings.
+        * platform/gtk/LocalizedStringsGtk.cpp: Use the glib i18n header
+        that is specific for libraries.
+
+2009-04-06  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24978
+        Use custom implementations of a few Node methods so that
+        we don't over-aggressively create JS wrappers here.
+
+        * bindings/v8/custom/V8NodeCustom.cpp: Added custom implementations.
+        * dom/Node.idl: Removed JSC-specifier, making impl custom for V8 as well.
+
+2009-04-06  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25031
+        Make the V8 element collections check for named properties *before*
+        checking if there are any elements with the same name. Otherwise
+        it is both incorrect and slow.
+
+        Test: fast/dom/HTMLSelectElement/length-not-overridden.html
+
+        Both of these interceptors were attempting to find an element in the
+        collection that had a name or id of the property name before checking
+        for a JS property with that name.
+        * bindings/v8/V8Collection.h:
+        (WebCore::collectionNamedPropertyGetter):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+
+2009-04-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=25052
+        
+        Pull the call to updateGraphicsLayerGeometry() out of updateGraphicsLayers(),
+        because we need to call it at the end of rebuildCompositingLayerTree() once
+        we've determined which descendant layers are composited, otherwise
+        calculateCompositedBounds() can give the wrong answer.
+        
+        Now that updateLayerCompositingState() doesn't end up calling updateGraphicsLayerGeometry(),
+        call that explicitly from styleChanged(), if we know a layer update is not pending,
+        and similarly from updateAfterLayout().
+
+        Test: compositing/overflow/overflow-positioning.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        (WebCore::RenderLayerBacking::updateGraphicsLayers):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-04-06  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add accessors to AtomicString which take String/const char* arguments
+        so that we don't accidentally thrash the AtomicString table.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24979
+
+        * platform/text/AtomicString.h:
+
+2009-04-03  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make col and row work in WebCore/manual-tests/cursor.html. The issue
+        was spotted in the WebKit inspector.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+
+2009-04-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Don't show and hide the platformPluginWidget, as it's our QWebView
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::setParentVisible):
+
+2009-04-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add new files to the Qt build.
+        Export helper function from the Qt JSC binding, needed in WebKit/qt.
+
+        * WebCore.pro: Add new files.
+        * bridge/qt/qt_runtime.h: Declare convertQVariantToValue.
+
+2009-04-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Changed ScriptFunctionCall's last argument from a const char* as the function name to a String.
+
+        Internally the function name is stored as a WebCore::String and the Qt port wants to use this
+        constructor programmatically where the function name is also a WebCore::String.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::ScriptFunctionCall):
+        * bindings/js/ScriptFunctionCall.h:
+
+2009-04-06  Mike Belshe <mike@belshe.com>
+
+        Reviewed by Eric Seidel.
+
+        HTMLCanvasElement crash when ImageBuffer creation fails.
+        https://bugs.webkit.org/show_bug.cgi?id=23212
+
+        Check for NULL before using the ImageBuffer as we might
+        be low on memory and creation may have failed.
+
+        Test case creation blocked by:
+        https://bugs.webkit.org/show_bug.cgi?id=25055
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+
+2009-04-05  Geoffrey Garen  <ggaren@apple.com>
+
+        [Originally] Reviewed by Sam Weinig.
+
+        Rolled back in r42214 with crashes fixed.
+
+        [Removed irrelevant ExecState* parameter from event handler registration code.]
+        
+        [No change in behavior.]
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-05  Erik L. Bunce  <elbunce@xendom.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25050
+
+        Fix an assert failure when dropping an 'empty' text/uri-list on a QWebView. 
+
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+
+2009-04-05  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build.
+
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createPrototype): Take the JSGlobalObject
+        as second argument.
+
+2009-04-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for wxMac/Tiger.
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+        * rendering/break_lines.cpp:
+        (WebCore::nextBreakablePosition):
+        * webcore-wx.bkl:
+
+2009-04-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Cameron Zwarich
+
+        https://bugs.webkit.org/show_bug.cgi?id=24648
+        
+        Ensure that mapPoint(const IntPoint&) calls the FloatPoint
+        version to avoid infinite recursion.
+        
+        No test because mapPoint(const IntPoint&) isn't ever called
+        on Mac, so I can't reproduce.
+        
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::mapPoint):
+
+2009-04-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix <rdar://problem/6757862> REGRESSION: Cannot use the mouse to place
+          the insertion point inside a Thai character
+
+        Test: fast/text/international/thai-offsetForPosition-inside-character.html
+
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::offsetForPosition): Changed to use
+        cursorMovementIterator instead of characterBreakIterator, allowing this
+        function to return a valid cursor position even if it is not at
+        a character boundary.
+
+2009-04-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix an assertion failure when clicking at the beginning of a
+          glyph cluster at the beginning of a text run
+
+        Test: fast/text/offsetForPosition-cluster-at-zero.html
+
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::offsetForPosition): Corrected the bound
+        check on firstGlyphBeforeCluster, letting it be 0 or -1, but not less
+        than -1.
+
+2009-04-03  Brian Weinstein  <bweinstein@gmail.com>
+
+        Allows 16 HTML/CSS standard colors to be shown as swatch backgrounds
+        when the names are given.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25044
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+2009-04-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6330929>
+        https://bugs.webkit.org/show_bug.cgi?id=21456
+
+        Don't update the document pointer for all inactive windows on navigations.
+        This change causes us to differ slightly from Firefox when accessing the
+        document from within a closure tied to a navigated context, but as all
+        browsers differ on this edge case, I don't foresee compatibility issues.
+
+        Test: http/tests/security/cross-frame-access-document-direct.html
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptController.h:
+
+2009-04-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Test: transitions/bad-transition-shorthand-crash.html
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=24787.
+
+        We were starting transitions with 0 duration and delay, which is 
+        useless. With accelerated compositing on, this went through a code
+        path that tried to use m_toStyle, which never got set because the 
+        transitions was short circuited before it had a chance to. So I
+        both protect against using that null pointer and avoid starting
+        the transition in the first place.
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::blendPropertyValueInStyle):
+
+2009-04-03  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug where you could not type any more in the Web Inspector's
+        search field after the first match is selected in the Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23982
+        rdar://problem/6592367
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._jumpToSearchResult): Use the
+        window object of the frame to set the selection, not the main window.
+
+2009-04-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22081
+        <rdar://problem/6346030>
+        Don't allow overriding the return value of window.location.
+
+        Tests: fast/dom/Window/Location/location-override-toString-on-proto-using-defineGetter.html
+               fast/dom/Window/Location/location-override-toString-on-proto-using-with.html
+               fast/dom/Window/Location/location-override-toString-on-proto.html
+               fast/dom/Window/Location/location-override-toString-using-defineGetter.html
+               fast/dom/Window/Location/location-override-toString-using-with.html
+               fast/dom/Window/Location/location-override-toString.html
+               fast/dom/Window/Location/location-override-valueOf-on-proto-using-defineGetter.html
+               fast/dom/Window/Location/location-override-valueOf-on-proto-using-with.html
+               fast/dom/Window/Location/location-override-valueOf-on-proto.html
+               fast/dom/Window/Location/location-override-valueOf-using-defineGetter.html
+               fast/dom/Window/Location/location-override-valueOf-using-with.html
+               fast/dom/Window/Location/location-override-valueOf.html
+               fast/dom/Window/Location/window-override-location-using-defineGetter.html
+               fast/dom/Window/Location/window-override-window-using-defineGetter.html
+               fast/dom/Window/Location/window-shadow-location-using-js-object-with-toString.html
+               fast/dom/Window/Location/window-shadow-location-using-string.html
+               fast/dom/Window/Location/window-shadow-window-using-js-object-with-location-field.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::defineGetter):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::customPut):
+        (WebCore::JSLocation::defineGetter):
+        (WebCore::JSLocationPrototype::customPut):
+        (WebCore::JSLocationPrototype::defineGetter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/Location.idl:
+
+2009-04-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out r42214 since it seems to have caused crashes on the buildbot.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6476356>
+        https://bugs.webkit.org/show_bug.cgi?id=23148
+
+        - Use the window object the Location and History objects are directly associated with
+          instead of the lexical global object to pick the object prototype to serve as the
+          base of the their respective prototype chains.
+        - Re-factor as necessary to allow passing the correct global object to the createPrototype
+          functions.
+
+        Tests: http/tests/security/cross-frame-access-history-prototype.html
+               http/tests/security/cross-frame-access-location-prototype.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::getCachedDOMStructure):
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getDOMStructure):
+        (WebCore::getDOMPrototype):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::createPrototype):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSRGBColor.h:
+        (WebCore::JSRGBColor::createPrototype):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createPrototype):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createPrototype):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createPrototype):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createPrototype):
+        * page/DOMWindow.idl:
+
+2009-04-03  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25009
+        Upstream changes to WorkerContextExecutionProxy for V8 bindings in order to use V8EventListenerList as container.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::FindOrCreateEventListener):
+        (WebCore::WorkerContextExecutionProxy::RemoveEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-04-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed irrelevant ExecState* parameter from event handler registration code.
+        
+        No change in behavior.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix <rdar://problem/6634771> Under full-page zoom, cannot scroll
+          MobileMe contact list
+
+        Test: fast/css/zoom-in-length-round-trip.html
+
+        * dom/Element.cpp:
+        (WebCore::adjustForLocalZoom): For zoom factors greater than 1, ensure
+        that the returned value is equal to the original unscaled value.
+        (WebCore::adjustForAbsoluteZoom): Ditto.
+
+2009-04-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=24941
+
+        This fix essentially does a -viewWillDraw call for layout. It adds 
+        a CFRunLoopObserver which performs layout just before drawing on the 
+        Mac platform. This makes sure layout is complete before rendering and 
+        avoids a flash.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::scheduleViewUpdate):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingLayersNeedUpdate):
+        (WebCore::RenderLayerCompositor::scheduleViewUpdate):
+        * rendering/RenderLayerCompositor.h:
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=24648
+
+        Optimize mapPoint(), mapRect() and mapQuad() for identity matrix and translations.
+        
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::mapPoint):
+        (WebCore::TransformationMatrix::mapRect):
+        (WebCore::TransformationMatrix::mapQuad):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::mapPoint):
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=25018
+        
+        Add containsPoint() and containsQuad() methods to FloatQuad.
+
+        * platform/graphics/FloatQuad.cpp:
+        (WebCore::dot):
+        (WebCore::isPointInTriangle):
+        (WebCore::FloatQuad::containsPoint):
+        (WebCore::FloatQuad::containsQuad):
+        * platform/graphics/FloatQuad.h:
+
+2009-04-03  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Darin.
+
+        *  loader/ProgressTracker.cpp: Included DocumentLoader.h
+        (WebCore::ProgressTracker::incrementProgress): Limit the 50%-clamp rule to 
+        documents that use WebCore's layout system.
+
+2009-04-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25029
+        <rdar://problem/6336092> REGRESSION: movie does not resize correctly
+
+        Test: media/video-size-intrinsic-scale.html
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::naturalSize): Use QTMovieCurrentSizeAttribute instead 
+        of QTMovieNaturalSizeAttribute so we return the correct size for movies saved
+        with a non-default matrix.
+        (WebCore::MediaPlayerPrivate::setSize): Don't resize the QTMovieView
+        because [QTMovieView setFrame] also resizes the movie itself, and as
+        the renderer calls setSize immediately when a movie reports a size change
+        (QTMovieSizeDidChangeNotification) we can get into a feedback loop
+        observing the size change and resetting the size, and this can cause
+        QuickTime to miss correctly setting a movie's size when the media size
+        changes after opening (as happens with an rtsp movie once the server sends
+        the track sizes). Instead, remember the size passed to paint() and 
+        resize the view when it changes.
+        (WebCore::MediaPlayerPrivate::paint): Resize the view when passed a new size.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::getNaturalSize): Use GetMovieBox instead of GetMovieNaturalBoundsRect
+        so we return the correct size for movies saved with non-default matrix.
+
+2009-04-03  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Restore FrameLoader::policyDocumentLoader to fix the Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=25028
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::policyDocumentLoader):
+
+2009-04-02  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use long long, not int64, when working in webcore (sorry).
+        https://bugs.webkit.org/show_bug.cgi?id=25011
+
+        No change in functionality, so no tests.
+
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::getAppCacheID):
+        (WebCore::ResourceResponse::setAppCacheID):
+
+2009-04-03  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        Remove pre-processor checks for GTK+ >= 2.10, since we now require
+        at least that version.
+
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::gtkStockIDFromContextMenuAction):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::contextMenuItemTagSelectAll):
+        * platform/gtk/MouseEventGtk.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25021
+        
+        Fix repainting an element with a reflection and transform after layout.
+        Telling the reflection to repaint directly is wrong, because, with
+        LayoutState enabled, it only takes the reflection's transform into account,
+        not that of the element. We can fix this, and keep the benefits of LayoutState,
+        by computing the reflected repaint rect, and repainting that using the original
+        renderer.
+
+        Test: fast/repaint/reflection-repaint-test.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23307
+        
+        When repainting during layout (when LayoutState is enabled), we need
+        to apply the transform to the dirty rect, before applying x(), y() and
+        the offset storted in the LayoutState.
+        
+        Also bypass LayoutState in mapLocalToContainer() if we have a repaintContainer,
+        since LayoutState is always root-relative.
+
+        Test: fast/repaint/transform-layout-repaint.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+
+2009-04-02  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build after r42191.
+
+        * WebCore.base.exp:
+
+2009-04-02  Mark Rowe  <mrowe@apple.com>
+
+        Fix Windows build after r42190.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::keyEvent):  Update to use the new name of the constant.
+
+2009-04-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6625840> Previous Page isn't loaded after hitting back button at http://www.breakingnews.ie/
+
+        Test: http/tests/navigation/onload-navigation-iframe-2.html
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement): Removed unneeded createdByParser flag.
+        * html/HTMLFrameElement.h: Ditto.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Ditto.
+        * html/HTMLFrameElementBase.h: Ditto.
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Ditto.
+        * html/HTMLFrameOwnerElement.h: Ditto.
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::HTMLIFrameElement): Ditto.
+        * html/HTMLIFrameElement.h: Ditto.
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::HTMLPlugInElement): Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm): Removed unneeded check of the createdByParser flag.
+        The original change that introduced this, http://trac.webkit.org/changeset/25410, does
+        not make it clear why this check was needed. And it seems it is not needed.
+
+2009-04-02  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add a way to get a list of focusable nodes.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::getFocusableNodes):
+        * dom/Document.h:
+
+2009-04-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6654255> crash due to null FrameView in EventHandler
+
+        Lots of code was added to EventHandler that used view() and page() without
+        null checking, but both of those can become null due to the frame lifetime.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::eventMayStartDrag):
+        (WebCore::EventHandler::handleAutoscroll):
+        (WebCore::EventHandler::autoscrollTimerFired):
+        (WebCore::EventHandler::setPanScrollCursor):
+        (WebCore::EventHandler::allowDHTMLDrag):
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::stopAutoscrollTimer):
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::dispatchDragEvent):
+        (WebCore::EventHandler::prepareMouseEvent):
+        (WebCore::EventHandler::dispatchMouseEvent):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::hoverTimerFired):
+        (WebCore::EventHandler::keyEvent):
+        (WebCore::EventHandler::dragHysteresisExceeded):
+        (WebCore::EventHandler::shouldDragAutoNode):
+        (WebCore::EventHandler::handleDrag):
+        (WebCore::EventHandler::handleTextInputEvent):
+        (WebCore::EventHandler::addPendingFrameUnloadEventCount):
+        (WebCore::EventHandler::removePendingFrameUnloadEventCount):
+        (WebCore::EventHandler::clearPendingFrameUnloadEventCount):
+        (WebCore::EventHandler::addPendingFrameBeforeUnloadEventCount):
+        (WebCore::EventHandler::removePendingFrameBeforeUnloadEventCount):
+        (WebCore::EventHandler::clearPendingFrameBeforeUnloadEventCount):
+        Added null checks for view() and page(). Made minor code cleanups.
+
+2009-04-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix regression in <object> layout test.  Make sure that even though a 404 image loads, that <object>
+        still considers it an error for the purposes of firing onerror.
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+
+2009-04-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25010
+        Refactor InspectorController to replace all JS function invocations with
+        ScriptFunctionCall.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Added int, UString,
+            and JSValuePtr methods.
+        (WebCore::ScriptFunctionCall::call): Added simplified, exception-eating
+            method.
+        * bindings/js/ScriptFunctionCall.h: Decls for above.
+        * bindings/js/ScriptObjectQuarantine.cpp: Added helper for Node and DOMWindow.
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptObjectQuarantine.h: Decls for above.
+        * inspector/InspectorController.cpp:
+        (WebCore::callSimpleFunction): Made into a static.
+        (WebCore::InspectorController::focusNode): Refactored to use ScriptFunctionCall.
+        (WebCore::InspectorController::toggleRecordButton): Ditto.
+        (WebCore::InspectorController::startGroup): Ditto.
+        (WebCore::InspectorController::setAttachedWindow): Ditto.
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared): Ditto.
+        (WebCore::InspectorController::addScriptProfile): Ditto.
+        (WebCore::InspectorController::didParseSource): Ditto.
+        (WebCore::InspectorController::failedToParseSource): Ditto.
+        (WebCore::InspectorController::didPause): Ditto.
+        * inspector/InspectorController.h: Removed callFunction and callSimpleFunction
+            decls.
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream changes to V8WorkerContextEventListener for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25007
+
+        * bindings/v8/V8ObjectEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8WorkerContextObjectEventListener for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25005
+
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Added.
+        * bindings/v8/V8WorkerContextObjectEventListener.h: Added.
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8EventListenerList for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25004
+
+        * bindings/v8/V8EventListenerList.cpp: Added.
+        * bindings/v8/V8EventListenerList.h: Added.
+
+2009-04-02  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium's ResourceRequest and ResourceResponse structs need some new data members.
+        https://bugs.webkit.org/show_bug.cgi?id=24897
+
+        These fields are needed to facilitate Chromium's implementation of the HTML5
+        ApplicationCache feature. We need to know what frame (or context) is doing the
+        requesting, and from what cache the resulting resource was retrieved.
+
+        No change in functionality, so no tests.
+
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::appCacheContextID):
+        (WebCore::ResourceRequest::setAppCacheContextID):
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::getAppCacheID):
+        (WebCore::ResourceResponse::setAppCacheID):
+
+2009-04-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24643.
+        
+        Make sure images just ignore HTTP error codes and keep loading anyway.  Only <object> checks http error codes and falls back.  Everyone
+        else just ignores it and displays the image anyway.
+
+        Added http/tests/misc/image-error.html
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::CachedImage):
+        * loader/CachedImage.h:
+        (WebCore::CachedImage::httpStatusCodeError):
+        (WebCore::CachedImage::httpStatusCodeErrorOccurred):
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::httpStatusCodeError):
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didReceiveData):
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add XHR constructor in WorkerContext.idl for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=24962
+
+        * workers/WorkerContext.idl:
+
+2009-04-02  Ben Murdoch  <benm@google.com>
+
+        Fix Bug 19743: Release build fails on 32-bit Windows
+
+        <https://bugs.webkit.org/show_bug.cgi?id=19743>
+
+        Combines all the HTML element cpp files into one to help reduce the
+        size of WebCore.lib so we can build in release mode on 32bit Windows.
+
+        Reviewed by Adam Roben.
+
+        * WebCore.vcproj/WebCore.vcproj: Excluded all the separate
+        HTML*Element.cpp files from the build. Added HTMLElementsAllInOne.cpp
+        to the build.
+        * html/HTMLElementsAllInOne.cpp: Added.
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24999
+        
+        Optimize hit testing with transforms.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        getTransformFromContainer() change to return the matrix by reference.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::update3DTransformedDescendantStatus):
+        The method failed to set m_3DTransformedDescendantStatusDirty to false,
+        so did the work every time.
+
+        (WebCore::RenderLayer::createLocalTransformState):
+        Only call the expensive getTransformFromContainer() if there is a transform,
+        otherwise we just have a translation.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTransformFromContainer):
+        * rendering/RenderObject.h:
+        Change transformFromContainer() to getTransformFromContainer(), and return
+        the matrix by reference to reduce copying.
+        New enum values for arguments for readability.
+
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::move):
+        (WebCore::TransformState::applyTransform):
+        (WebCore::HitTestingTransformState::translate):
+        New method that adds a translation to the accumulated matrix, optionally
+        without flattening. Cheaper than applyTransform().
+
+        (WebCore::HitTestingTransformState::applyTransform):
+        (WebCore::HitTestingTransformState::flatten):
+        (WebCore::HitTestingTransformState::flattenWithTransform):
+        Add flattenWithTransform(), which is a helper that allows us to
+        avoid doing the inverse() twice.
+
+        * rendering/TransformState.h:
+        (WebCore::TransformState::):
+        (WebCore::TransformState::move):
+        (WebCore::HitTestingTransformState::):
+        New method on HitTestingTransformState that adds a translation to the
+        accumulated matrix, optionally without flattening. Cheaper than applyTransform().
+        New enum values for arguments for readability.
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24648
+        
+        Optimize common code paths in TransformationMatrix.
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::translate):
+        (WebCore::TransformationMatrix::translate3d):
+        Optimize to avoid matrix copy.
+        
+        (WebCore::TransformationMatrix::isInvertible):
+        Test for identity and translation matrices before computing
+        the determinant.
+        
+        (WebCore::TransformationMatrix::inverse):
+        Optimize for identity matrix and translations.
+        
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        Utility method.
+
+2009-04-02  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24930
+        [Gtk] ISO files content is displayed inside the webview instead of being downloaded
+
+        Also sniff content of types declared as text/plain. This is
+        justified by the fact that it is common to have Apache HTTP
+        servers configured to send text/plain as Content-Type by default.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+
+2009-04-02  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Protect the handle when notifying the client that the response was
+        received also in gotChunkCallback, or we crash in didReceiveData
+        when the load is cancelled in didReceiveResponse.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotChunkCallback):
+
+2009-04-02  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25001
+        Crash when content type parameters have no value
+
+        Handle the case where a Content-Type header parameter has no
+        value (i.e. no = character), to work-around a bug in libsoup.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-04-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24490
+
+        Enable web workers in Qt.
+
+        * WebCore.pro:
+
+2009-04-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler. Based on work of Julien Chaffraix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22475
+        REGRESSION: Async XMLHttpRequest never finishes on nonexistent files anymore
+
+        https://bugs.webkit.org/show_bug.cgi?id=24886
+        XHR requests opened when offline never return
+
+        Tests: fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html
+               http/tests/xmlhttprequest/state-after-network-error.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener): Only dispatch load event if this
+        wasn't an error.
+        (WebCore::XMLHttpRequest::abort): Fixed formatting.
+        (WebCore::XMLHttpRequest::genericError): Change state to DONE and dispatch readystatechange.
+        The comment saying that this doesn't match Firefox was added in r33559 without explanation
+        or tests, and I don't think that it's accurate. Also, Firefox and Safari 3 both change state
+        to HEADERS_RECEIVED before DONE on error - this doesn't match the spec, and I doubt
+        that any code depends on this, so I went with the spec here.
+
+2009-04-01  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=24997
+        Race conditions in icon database threading code
+        
+        m_syncThreadRunning set was mistakenly eliminated in r27717.
+        This reintroduces it.
+
+        Reviewed by Oliver Hunt.
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open): Set m_syncThreadRunning.
+
+2009-04-01  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6748609> Use ActiveDOMObject to suspend marquees
+        
+        Make marquees ActiveDOMObjects, get rid of the special suspension code.
+
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::HTMLMarqueeElement):
+        (WebCore::HTMLMarqueeElement::canSuspend):
+        (WebCore::HTMLMarqueeElement::suspend):
+        (WebCore::HTMLMarqueeElement::resume):
+        * html/HTMLMarqueeElement.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::clearTimers):
+        * rendering/RenderLayer.cpp:
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::marquee):
+
+2009-04-01  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Darin Adler
+
+        Make constant values static in previous commit, as suggested
+        by Darin.
+
+        * rendering/RenderVideo.cpp:
+
+2009-04-01  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=24993
+
+        Standalone media should have a smaller instrinsic
+        height.
+
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::RenderVideo):
+
+2009-04-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 22378: Crash submitting a form when parsing an XHTML document
+        https://bugs.webkit.org/show_bug.cgi?id=22378
+        rdar://problem/6388377
+
+        Tests: fast/loader/submit-form-while-parsing-1.xhtml
+               fast/loader/submit-form-while-parsing-2.html
+
+        * WebCore.base.exp: Updated.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem): Renamed m_subItems to m_children.
+        Used uncheckedAppend because we reserveInitialCapacity.
+        (WebCore::HistoryItem::addChildItem): Renamed m_subItems to m_children.
+        Added an assertion that this is only used to add items that don't have
+        duplicate frame names.
+        (WebCore::HistoryItem::setChildItem): Added. Replaces an existing item
+        if any, preserving the isTargetItem flag.
+        (WebCore::HistoryItem::childItemWithTarget): Renamed from childItemWithName
+        for consistency with the other functions here that all call the frame name the
+        "target". Also updated for rename of m_subItems to m_children.
+        (WebCore::HistoryItem::findTargetItem): Renamed from recurseToFindTargetItem.
+        Removed unneeded size check.
+        (WebCore::HistoryItem::targetItem): Changed to always return the top item
+        if no item has the isTargetItem flag set. The old version would instead return
+        0 in some cases, but return the top item if it had no children.
+        (WebCore::HistoryItem::children): Renamed m_subItems to m_children.
+        (WebCore::HistoryItem::hasChildren): Ditto.
+        (WebCore::HistoryItem::showTreeWithIndent): Ditto.
+
+        * history/HistoryItem.h: Name changes.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::submit): Create and pass a FormState instead of
+        attaching "recorded form values" and "form about to be submitted" to the frame
+        loader. Parameter work fine for this; there's no need to store state on the
+        FrameLoader.
+
+        * loader/FormState.cpp:
+        (WebCore::FormState::FormState): Adopt a vector instead of copying a hash map.
+        (WebCore::FormState::create): Ditto.
+        * loader/FormState.h: Update to use a vector that we adopt instead of hash map
+        that we copy for auto-fill text field values.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a new case for
+        form submissions and turned the "wasDuringLoad" state into a separate boolean
+        instead of using a special redirection type to track it.
+        (WebCore::FrameLoader::createWindow): Updated for name and argument change of
+        loadFrameRequest.
+        (WebCore::FrameLoader::urlSelected): Ditto.
+        (WebCore::FrameLoader::submitForm): Removed the "deferred form submission"
+        machinery, replacing it with the "scheduled redirection" mechanism, shared
+        with other kinds of redirection and navigation. Moved frame targeting here
+        so we can schedule the redirection on the right frame. Moved the multiple
+        form submission protection here. Moved the code to implement the rule that
+        m_navigationDuringLoad was used for here too.
+        (WebCore::FrameLoader::didOpenURL): Use the new wasDuringLoad flag instead
+        of the locationChangeDuringLoad type to detect location change during a load.
+        (WebCore::FrameLoader::executeScript): Removed call to now-obsolete function,
+        submitFormAgain.
+        (WebCore::FrameLoader::scheduleLocationChange): Moved the code to stop loading
+        out of this function into scheduleRedirection, so it can be shared with the
+        new scheduleFormSubmission function.
+        (WebCore::FrameLoader::scheduleFormSubmission): Added. Almost the same as
+        scheduleLocationChange, but with the arguments for a form submission.
+        (WebCore::FrameLoader::scheduleRefresh): Updated for the change to the
+        duringLoad flag.
+        (WebCore::FrameLoader::isLocationChange): Added case for formSubmission
+        and removed case for locationChangeDuringLoad.
+        (WebCore::FrameLoader::redirectionTimerFired): Ditto. Also removed unneeded
+        completeURL call and just use KURL constructor to match the other cases.
+        (WebCore::FrameLoader::provisionalLoadStarted): Removed the code to set up
+        the m_navigationDuringLoad, which is no longer needed. The new version of
+        this is in the submitForm function and sets the lockHistory boolean.
+        (WebCore::FrameLoader::scheduleRedirection): Moved the code to stop a load
+        in here that used to be in scheduleLocationChange.
+        (WebCore::FrameLoader::startRedirectionTimer): Added case for formSubmission
+        and removed case for locationChangeDuringLoad.
+        (WebCore::FrameLoader::stopRedirectionTimer): Ditto.
+        (WebCore::FrameLoader::completed): Removed call to now-obsolete function,
+        submitFormAgain.
+        (WebCore::FrameLoader::loadFrameRequest): Renamed from
+        loadFrameRequestWithFormAndValues. Replaced form element and form values
+        argument with a single FormState argument. Changed frame targeting code
+        to use the source frame in the case of a form submission to better match
+        the actual target frame.
+        (WebCore::FrameLoader::loadURL): Don't search for existing frames in the
+        form submission case since we already did that in the submitForm function.
+        (WebCore::FrameLoader::clientRedirected): Changed to work with the
+        m_isExecutingJavaScriptFormAction data member directly instead of taking
+        it as a function parameter.
+        (WebCore::FrameLoader::loadPostRequest): Don't search for existing frames
+        in the form submission case since we already did that in the submitForm
+        function.
+        (WebCore::FrameLoader::addBackForwardItemClippedAtTarget): Moved comment
+        in here that was misplaced elsewhere in the file.
+        (WebCore::FrameLoader::findFrameForNavigation): Changed to use the early
+        return idiom.
+        (WebCore::FrameLoader::recursiveGoToItem): Updated for HistoryItem changes.
+        (WebCore::FrameLoader::childFramesMatchItem): Ditto.
+        (WebCore::FrameLoader::updateHistoryForStandardLoad): Removed the
+        m_navigationDuringLoad logic; that's now handled by setting lockHistory
+        to true in the submitForm function.
+        (WebCore::FrameLoader::updateHistoryForRedirectWithLockedBackForwardList):
+        Use the new setChildItem function so we don't get multiple items for the
+        same frame name in the history item tree in the back/forward list.
+
+        * loader/FrameLoader.h: Renamed loadFrameRequestWithFormAndValues to
+        loadFrameRequest and made it take a form state object instead of the
+        form element and form values. Removed the unused functions
+        loadEmptyDocumentSynchronously, provisionalDocumentLoader,
+        notifyIconChnaged, and updateBaseURLForEmptyDocument. Changed the
+        submitForm function to take a form state argument. Eliminated the
+        clearRecordedFormValues, setFormAboutToBeSubmitted, and recordFormValue
+        functions, which are replaced by the form state arguments to submitForm
+        and loadFrameRequest. Removed the isJavaScriptFormAction argument from
+        the clientRedirected function; instead it looks at a data member directly.
+        Eliminated the submitFormAgain and overload of the submitForm function;
+        these are now subsumed into the remaining submitForm function and the
+        scheduleFormSubmission function. Removed unused and obsolete data
+        members m_navigationDuringLoad, m_deferredFormSubmission,
+        m_formAboutToBeSubmitted and m_formValuesAboutToBeSubmitted.
+
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        Updated for name and argument change of loadFrameRequest.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame): Removed call to the now-unneeded
+        clearRecordedFormValues function.
+
+2009-04-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, fixing previous commit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24994
+        Revert V8DOMMap.cpp change which accidentally snuck into the previous
+        commit.
+
+        * bindings/v8/V8DOMMap.cpp: Revert change in previous commit.
+
+2009-04-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24994
+        Fix miscellaneous merge/upstreaming divergencies in Chromium port.
+
+        * bindings/v8/V8Collection.h: Added an include.
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::baseAsString): Added to match KURL.cpp.
+        * platform/chromium/ClipboardChromium.cpp: Added an include.
+
+2009-04-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24989
+        Refactor InspectorResource to use ScriptObject/FunctionCall.
+
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::addResourceSourceToFrame): Tweaked to use
+            a more appropriate type conversion.
+        (WebCore::JSInspectorController::getResourceDocumentNode): Tweaked to
+            accommodate for InspectorResource refactoring.
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Added long long type to match
+            existing jsNumber call signature.
+        * bindings/js/ScriptFunctionCall.h: Declaration for above.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::createEmptyObject): Added.
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore::ScriptObject::set): Added a bunch of property setters.
+        * bindings/js/ScriptObject.h: Declarations for above.
+        * inspector/InspectorController.cpp: Moved all InspectorResource-managing code
+            to InspectorResource.cpp
+        (WebCore::InspectorController::populateScriptObjects): Changed to use
+            refactored InspectorResource.
+        (WebCore::InspectorController::resetScriptObjects): Ditto.
+        (WebCore::InspectorController::pruneResources): Ditto.
+        (WebCore::InspectorController::didCommitLoad): Ditto.
+        (WebCore::InspectorController::addResource): Ditto.
+        (WebCore::InspectorController::removeResource): Ditto.
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache): Ditto.
+        (WebCore::InspectorController::identifierForInitialRequest): Ditto.
+        (WebCore::InspectorController::willSendRequest): Ditto.
+        (WebCore::InspectorController::didReceiveResponse): Ditto.
+        (WebCore::InspectorController::didReceiveContentLength): Ditto.
+        (WebCore::InspectorController::didFinishLoading): Ditto.
+        (WebCore::InspectorController::didFailLoading): Ditto,
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest): Ditto.
+        (WebCore::InspectorController::scriptImported): Ditto.
+        * inspector/InspectorController.h: Removed InspectorResource-managing code decls
+            and tweaked some signatures to use ScriptString and long long for identifier.
+        * inspector/InspectorController.idl: Changed to use long long for identifier.
+        * inspector/InspectorResource.cpp: Refactored to use ScriptObject/FunctionCall.
+        (WebCore::InspectorResource::InspectorResource): Ditto.
+        (WebCore::InspectorResource::~InspectorResource): Ditto.
+        (WebCore::InspectorResource::createCached): Added.
+        (WebCore::InspectorResource::updateRequest): Added.
+        (WebCore::InspectorResource::updateResponse): Added.
+        (WebCore::createHeadersObject): Added.
+        (WebCore::InspectorResource::createScriptObject): Added.
+        (WebCore::InspectorResource::updateScriptObject): Added.
+        (WebCore::InspectorResource::releaseScriptObject): Added.
+        (WebCore::InspectorResource::type): Tweaked to use ScriptString.
+        (WebCore::InspectorResource::setXMLHttpResponseText): Added.
+        (WebCore::InspectorResource::sourceString): Tweaked to use ScriptString.
+        (WebCore::InspectorResource::startTiming): Added.
+        (WebCore::InspectorResource::markResponseReceivedTime): Added.
+        (WebCore::InspectorResource::endTiming): Added.
+        (WebCore::InspectorResource::markFailed): Added.
+        (WebCore::InspectorResource::addLength): Added.
+        * inspector/InspectorResource.h: Added decls for newly refactored-in methods.
+        (WebCore::InspectorResource::create): Added.
+        (WebCore::InspectorResource::isSameLoader): Added.
+        (WebCore::InspectorResource::markMainResource): Added.
+        (WebCore::InspectorResource::identifier): Added.
+        (WebCore::InspectorResource::requestURL): Added.
+        (WebCore::InspectorResource::frame): Added.
+        (WebCore::InspectorResource::mimeType): Added.
+        (WebCore::InspectorResource::Changes::Changes): Added new class to track
+            resource changes.
+        (WebCore::InspectorResource::Changes::hasChange): Added.
+        (WebCore::InspectorResource::Changes::set): Added.
+        (WebCore::InspectorResource::Changes::clear): Added.
+        (WebCore::InspectorResource::Changes::setAll): Added.
+        (WebCore::InspectorResource::Changes::clearAll): Added.
+
+2009-04-01  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Ensure the right click doesn't deselect text under it.  This was
+        happening in the Chromium and GTK+ ports because they don't select
+        the text under the cursor on right click.
+        
+        This was regressed in r41715, https://bugs.webkit.org/show_bug.cgi?id=19737
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24946
+
+        Test: fast/events/context-no-deselect.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+
+2009-04-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24991
+        
+        Need to use toRenderBoxModelObject(), not toRenderBox(), to test for layer()
+        when getting the transform.
+        
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::transformFromContainer):
+
+2009-03-31  Darin Adler  <darin@apple.com>
+
+        Rolled out that last change until I can investigate the regression test failures it seems
+        to have caused.
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::decrement):
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator):
+
+2009-03-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 24621: PositionIterator doesn't iterate "after last child" positions when going backwards
+        https://bugs.webkit.org/show_bug.cgi?id=24621
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::decrement): Make sure that when the parent has no children, we
+        don't ever use Position::uncheckedPreviousOffset. This is consistent with the forward
+        iterator, but also should never arise because of the fix below.
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator): Fixed so m_offset will always be 0 when
+        the passed-in node has no children. Like the change above, this is consistent with the rest
+        of the class, although in the long run I think it's a bit strange to treat a <p> element
+        with no children differently than a <p> element with children.
+
+2009-03-31  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24965
+        Bug 24965: HTMLMediaElement: network state changes can be missed
+        
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState): Always update m_networkState when the
+        state changes, even when no event needs to be fired.
+
+2009-03-31  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24964
+        Bug 24964: HTMLMediaElement: 'waiting' event may fire twice
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): Only fire 'waiting' event once when ready state
+        drops below HAVE_FUTURE_DATA.
+
+2009-03-31  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24846
+        Bug 24846: HTMLMediaElement should implement 'autobuffer' attribute
+
+        Add 'autobuffer' attrubute to media element. 'autobuffer' is a hint that
+        the author recommends downloading the entire resource optimistically, so the
+        attribute is made available to the media engine to use if it is able.
+
+        Test: media/video-dom-autobuffer.html
+
+        * html/HTMLAttributeNames.in: Add autobuffer.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): New.
+        (WebCore::HTMLMediaElement::autobuffer): Ditto.
+        (WebCore::HTMLMediaElement::setAutobuffer): Ditto.
+
+        * html/HTMLMediaElement.h: Declare autobuffer and setAutobuffer.
+
+        * html/HTMLMediaElement.idl: Add autobuffer.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer): Initialize m_autobuffer.
+        (WebCore::MediaPlayer::autobuffer): New.
+        (WebCore::MediaPlayer::setAutobuffer): Ditto.
+        * platform/graphics/MediaPlayer.h: Declare m_autobuffer, autobuffer and setAutobuffer
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::setAutobuffer): Declare setAutobuffer.
+
+2009-03-31  Craig Schlenter  <craig.schlenter@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24550
+        Check return value of vasprintf. This should keep gcc 4.3.3
+        happy rather than have it complain about attribute warn_unused_result.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-03-31  Dean Jackson  <dino@apple.com>
+
+        Style guide violation!
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+
+2009-03-31  Dean Jackson  <dino@apple.com>
+
+        Fix Tiger build.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+
+2009-03-31  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8DOMMap for v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=24951
+
+        * bindings/v8/V8DOMMap.cpp: Added.
+        * bindings/v8/V8DOMMap.h: Added.
+
+2009-03-31  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24955
+
+        Spacebar didn't play/pause in standalone MediaDocument
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+
+2009-03-31  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24901
+        Added the following methods to MediaPlayerPrivate for Chromium port.
+        void sizeChanged();
+        void rateChanged();
+        void durationChanged();
+
+        The above changes are to reflect changes in MediaPlayer.cpp.
+        More details can be found in the original changeset.
+        http://trac.webkit.org/changeset/41907
+
+        * platform/graphics/chromium/MediaPlayerPrivateChromium.h:
+
+2009-03-31  Rafael Weinstein  <rafaelw@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24947
+
+        Special-case drawing text-shadow on win32, to let GDI draw in cases
+        when both fill & shadow color are opaque and the shadow has no blur.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleDrawTextShadow):
+        (WebCore::windowsCanHandleTextDrawing):
+        * platform/graphics/skia/SkiaFontWin.h:
+
+2009-03-31  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        r42055 removed some functions in FrameLoader used by Chrome,
+        this CL backs out some of those changes to unbreak the Chrome build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24949
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+
+2009-03-31  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Build fixes for Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24945
+
+        * dom/Document.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::imageToMarkup):
+
+2009-03-31  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer): Use NamedNodeMap instead of NamedAttrMap.
+
+2009-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Don't create CFDataRef with a fixed size.
+        Fixes synchronous XMLHTTPRequests on Windows.
+        
+        Reviewed by Ada Chan.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+
+2009-03-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 24594: PolicyDelegate NavigationAction is WebNavigationTypeOther instead of WebNavigationTypeReload
+        https://bugs.webkit.org/show_bug.cgi?id=24594
+        rdar://problem/6682110
+
+        Test: fast/loader/reload-policy-delegate.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadWithDocumentLoader): Set the triggering action here where we know it's
+        the policy loader and can use m_policyLoadType rather than letting it get set inside
+        checkNavigationPolicy.
+
+2009-03-30  Timothy Hatcher  <timothy@apple.com>
+
+        <rdar://problem/5838871> CrashTracer: 1483 crashes Quicklooking
+        in Finder (painting without up to date layout)
+
+        Reviewed by Dan Bernstein.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents): Add an early return when
+        painting is attempted when layout is needed.
+
+2009-03-30  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24938
+        
+        Sort alphabetically.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2009-03-30  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24938
+        
+        Build fixes for building --3d-rendering and --no-svg
+
+        * rendering/RenderLayerBacking.cpp:
+
+2009-03-30  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24938
+
+        Build fixes when building --no-svg
+        
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Add missing CSS properties
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::CSSCursorImageValue::updateIfSVGCursorIsUsed): Handle unused param
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Add missing CSS properties
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Add missing CSS properties
+        * dom/Node.cpp:
+        (WebCore::updateSVGElementInstancesAfterEventListenerChange): Handle unused param
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::floatWidth): Handle unused param
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): Handle unused param
+
+2009-03-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Bug 24916: REGRESSION: NavigationAction policy dispatch broken
+        https://bugs.webkit.org/show_bug.cgi?id=24916
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL): Rearrange the code so that the "event" PassRefPtr
+        is not used twice. This also optimizes the case where a frame name is specified,
+        but it's the name of the frame being loaded. Also called release in all the final
+        uses of FormState.
+
+2009-03-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Bug 24937: NamedNodeMap and NamedAttrMap should not be separate classes
+        https://bugs.webkit.org/show_bug.cgi?id=24937
+
+        Also should fix the Windows COM bindings build.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Removed special case for NamedNodeMap.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+
+        * dom/NamedAttrMap.h: Renamed class from NamedAttrMap to
+        NamedNodeMap and removed NamedNodeMap base class. Made the NamedNodeMap
+        functions all public and non-virtual. Removed virtualLength.
+
+        * dom/NamedNodeMap.h: Replaced file with just an include
+        of NamedAttrMap.h. As a follow up we will rename the NamedAttrMap
+        files and remove this file.
+
+        * bindings/js/JSNamedNodesCollection.cpp: Renamed from NamedAttrMap to NamedNodeMap.
+        * dom/Attr.h: Ditto.
+        * dom/Attribute.h: Ditto.
+        * dom/Document.cpp:
+        (WebCore::Document::importNode): Ditto.
+        * dom/Element.cpp:
+        (WebCore::Element::attributes): Ditto.
+        (WebCore::Element::setAttributeMap): Ditto.
+        (WebCore::Element::createAttributeMap): Ditto.
+        (WebCore::Element::insertedIntoDocument): Ditto.
+        (WebCore::Element::removedFromDocument): Ditto.
+        (WebCore::Element::openTagStartToString): Ditto.
+        (WebCore::Element::removeAttributeNode): Ditto.
+        (WebCore::Element::getAttributeNode): Ditto.
+        (WebCore::Element::getAttributeNodeNS): Ditto.
+        (WebCore::Element::hasAttribute): Ditto.
+        (WebCore::Element::hasAttributeNS): Ditto.
+        (WebCore::Element::normalizeAttributes): Ditto.
+        * dom/Element.h: Ditto.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::detachAttributesFromElement): Ditto.
+        (WebCore::NamedNodeMap::~NamedNodeMap): Ditto.
+        (WebCore::NamedNodeMap::isMappedAttributeMap): Ditto.
+        (WebCore::NamedNodeMap::getNamedItem): Ditto.
+        (WebCore::NamedNodeMap::getNamedItemNS): Ditto.
+        (WebCore::NamedNodeMap::removeNamedItem): Ditto.
+        (WebCore::NamedNodeMap::removeNamedItemNS): Ditto.
+        (WebCore::NamedNodeMap::setNamedItem): Ditto.
+        (WebCore::NamedNodeMap::item): Ditto.
+        (WebCore::NamedNodeMap::getAttributeItem): Ditto.
+        (WebCore::NamedNodeMap::clearAttributes): Ditto.
+        (WebCore::NamedNodeMap::detachFromElement): Ditto.
+        (WebCore::NamedNodeMap::setAttributes): Ditto.
+        (WebCore::NamedNodeMap::addAttribute): Ditto.
+        (WebCore::NamedNodeMap::removeAttribute): Ditto.
+        (WebCore::NamedNodeMap::mapsEquivalent): Ditto.
+        * dom/NamedMappedAttrMap.cpp:
+        (WebCore::NamedMappedAttrMap::clearAttributes): Ditto.
+        * dom/NamedMappedAttrMap.h:
+        (WebCore::NamedMappedAttrMap::NamedMappedAttrMap): Ditto.
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics): Ditto.
+        (WebCore::Node::isEqualNode): Ditto.
+        (WebCore::Node::isDefaultNamespace): Ditto.
+        (WebCore::Node::lookupNamespaceURI): Ditto.
+        (WebCore::Node::lookupNamespacePrefix): Ditto.
+        (WebCore::Node::compareDocumentPosition): Ditto.
+        * dom/Node.h: Ditto.
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer): Ditto.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::isSpanWithoutAttributesOrUnstyleStyleSpan): Ditto.
+        (WebCore::isEmptyFontTag): Ditto.
+        (WebCore::areIdenticalElements): Ditto.
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup): Ditto.
+        (WebCore::completeURLs): Ditto.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Ditto.
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Ditto.
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::synchronizeProperty): Ditto.
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLang::evaluate): Ditto.
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::Step::nodesInAxis): Ditto.
+
+2009-03-30  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24750
+        [GTK] requests download instead of displaying page
+
+        Use soup facilities to append parameters to the content type, to
+        make that more robust;
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-03-30  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6735683> Move SECTORDER_FLAGS from Xcode project to WebCore.xcconfig
+
+        Reviewed by Timothy Hatcher, Mark Rowe and Darin Adler.
+
+        * Configurations/Base.xcconfig: Moved Production definition of
+        SECTORDER_FLAGS to here from Xcode project file.
+        * Configurations/DebugRelease.xcconfig: Override SECTORDER_FLAGS
+        in Base.xcconfig to the empty string since it is not used for
+        Debug and Release configurations.
+        * WebCore.xcodeproj/project.pbxproj: Removed SECTORDER_FLAGS.
+
+2009-03-30  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after recent Node.idl changes
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Touched this to force sources
+        of classes that derive from Node to rebuild.
+
+2009-03-30  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * svg/graphics/SVGImage.cpp: Added a missing #include.
+
+2009-03-30  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24879
+        Add frame accessor to Screen, Console, and BarInfo objects. Add type 
+        accessor to BarInfo objects.
+
+        In the V8 JavaScript bindings, we need access to the frame and
+        type for already created Screen, Console, and BarInfo objects in
+        order to keep their wrappers alive across GCs.
+
+        * page/BarInfo.cpp:
+        (WebCore::BarInfo::frame): Added.
+        (WebCore::BarInfo::type): Added.
+        * page/BarInfo.h:
+        * page/Console.cpp:
+        (WebCore::Console::frame): Added.
+        * page/Console.h:
+        * page/Screen.cpp:
+        (WebCore::Screen::frame): Added.
+        * page/Screen.h:
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Requested by Antti Koivisto.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): Tweaked code to be a little clearer and added
+        a better comment.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23445: Copying certain hidden text causes a crash
+        https://bugs.webkit.org/show_bug.cgi?id=23445
+        rdar://problem/6512520
+
+        Test: editing/pasteboard/copy-display-none.html
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Added a check for the case where adjusting the start node moves
+        the start of the selection past the end of the range entirely. If we try to iterate we'll
+        never hit the end of the range and will probably crash iterating the rest of the document.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 24672: ASSERTION FAILURE: !m_purgeableData in WebCore::CachedResource::data() saving a WebArchive
+        https://bugs.webkit.org/show_bug.cgi?id=24672
+        rdar://problem/6574263
+
+        I couldn't create a test case for this. In fact, the case in the bug doesn't exist any more,
+        but there is an Apple-internal website I was able to use to reproduce and fix.
+
+        * loader/CachedResource.h: Made makePurgeable public.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): Call makePurgeable to make the resource non-purgeable
+        so we can get its data if it hasn't yet been purged.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Fix build again.
+
+        * loader/EmptyClients.h: Fix typo in name of FormState.h.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Try to fix the release build.
+
+        * history/CachedPage.cpp: Make include unconditional, not debug-only.
+
+2009-03-29  Greg Bolsinga  <bolsinga@apple.com>
+
+        Undo that last build fix, since it turned out the file wasn't deleted.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-03-29  Greg Bolsinga  <bolsinga@apple.com>
+
+        Fix build break by removing references to deleted header files.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Try to fix the Windows build.
+
+        * loader/EmptyClients.h: Added include of FormState.h.
+        * loader/MainResourceLoader.cpp: Ditto.
+
+2009-03-29  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24926
+        Fix Chromium build break.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL(DOMWindowShowModalDialog)): renamed 'features' into 'windowFeatures'.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Another attempt to fix the Qt build.
+
+        * WebCore.pro: Added CheckedRadioButtons.cpp.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 24921: remove include of HTMLFormElement.h from Document.h
+        https://bugs.webkit.org/show_bug.cgi?id=24921
+
+        * GNUmakefile.am: Added CheckedRadioButtons source files.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/objc/PublicDOMInterfaces.h: Changed type of parentElement to Element.
+
+        * dom/CheckedRadioButtons.cpp: Copied from WebCore/html/HTMLFormElement.cpp.
+        Removed all the code except for CheckedRadioButtons, and moved that out to be
+        a namespace-level class instead of a member of HTMLFormElement.
+
+        * dom/CheckedRadioButtons.h: Copied from WebCore/html/HTMLFormElement.h.
+        Removed all the code except for CheckedRadioButtons, and moved that out to be
+        a namespace-level class instead of a member of HTMLFormElement.
+
+        * dom/Document.h: Removed unneeded includes, including HTMLFormElement.h.
+        Added include of CheckedRadioButtons.h. Changed uses of CheckedRadioButtons
+        class to use a namespace-level class instead of a member of HTMLFormElement.
+
+        * dom/Node.idl: Changed the type of parentElement from Node to Element for
+        two reasons. 1) Node was incorrect, since parentElement returns an Element.
+        2) The bindings won't compile any more unless they know parentElement's
+        return value is an Element due to include changes.
+
+        * html/HTMLFormElement.cpp: Moved definitions of the functions in the
+        CheckedRadioButtons class to the new CheckedRadioButtons.cpp.
+
+        * html/HTMLFormElement.h: Moved definition of the CheckedRadioButtons
+        class to the new CheckedRadioButtons.h.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::checkedRadioButtons): Changed use of CheckedRadioButtons
+        class to use a namespace-level class instead of a member of HTMLFormElement.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::createWindow): Tweaked formatting.
+
+        * css/CSSGrammar.y: Added newly-needed include.
+        * dom/Range.cpp: Ditto.
+        * editing/BreakBlockquoteCommand.cpp: Ditto.
+        * editing/CompositeEditCommand.cpp: Ditto.
+        * editing/InsertLineBreakCommand.cpp: Ditto.
+        * editing/ModifySelectionListLevel.cpp: Ditto.
+        * editing/RemoveFormatCommand.cpp: Ditto.
+        * editing/TextIterator.cpp: Ditto.
+        * editing/VisiblePosition.cpp: Ditto.
+        * loader/DocLoader.cpp: Ditto.
+        * page/AccessibilityRenderObject.cpp: Ditto.
+        * page/Page.cpp: Ditto.
+        * rendering/RenderBlock.cpp: Ditto.
+        * rendering/RenderLayer.cpp: Ditto.
+        * rendering/RenderObject.h: Ditto.
+        * storage/LocalStorageArea.cpp: Ditto.
+        * storage/SessionStorageArea.cpp: Ditto.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6015407> attr parsing should allow only identifiers
+
+        Test: fast/css/attr-parsing.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseContent): Allow only CSS_IDENT, and filter out
+        identifiers that start with "-".
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText): Added a case for CSS_ATTR so the test
+        case works. This has the pleasant side effect of fixing a bug too.
+
+2009-03-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        <rdar://problem/6492712> Cross-origin redirects are not handled correctly.
+
+        Forgot to save the file after applying changes for review comments.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        (WebCore::didReceiveResponse):
+        (WebCore::didReceiveData):
+        (WebCore::didSendBodyData):
+        (WebCore::didFinishLoading):
+        (WebCore::didFail):
+        (WebCore::willCacheResponse):
+        (WebCore::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+
+2009-03-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6492712> Cross-origin redirects are not handled correctly.
+
+        Test: http/tests/xmlhttprequest/redirect-cross-origin-tripmine.html
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Match Mac behavior more closely - we shouldn't rely on underlying library handling of
+        synchronous requests.
+
+        * loader/DocumentThreadableLoader.cpp: (WebCore::DocumentThreadableLoader::willSendRequest):
+        -[NSURLConnection cancel] doesn't fully cancel the connection if called from willSendRequest
+        delegate method for a redirect.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]):
+        Match async behavior more closely.
+
+2009-03-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 24914: empty-string assertion crash when running storage tests
+        https://bugs.webkit.org/show_bug.cgi?id=24914
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify): Don't store empty version strings
+        in the map, since empty strings are per-thread.
+
+2009-03-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24910
+        Fixes for Chromium build.
+
+        * bindings/v8/V8LazyEventListener.h: renamed IsInline() into virtualIsInline()
+        * bindings/v8/custom/V8CustomEventListener.h: ditto.
+        * dom/EventListener.h: used #if USE(JSC) to fix the build on non-JSC platform.
+
+2009-03-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Not reviewed, correcting landing error.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24812
+        Custom bindings should be in v8/custom, not v8.
+
+        * bindings/v8/V8HTMLDocumentCustom.cpp: Removed.
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp: Moved from parent dir.
+
+2009-03-28  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24616
+        Add V8 custom bindings for DOMWindow.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Added.
+
+2009-03-28  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24812
+        Add V8 custom bindings for HTMLDocument.
+
+        * bindings/v8/V8HTMLDocumentCustom.cpp: Added.
+
+2009-03-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix two SVG test failures in 64-bit.
+
+        getSubStringLength's arguments were declared as unsigned in the IDL and as signed long in the implementation.
+        This led to a value of -1 in JavaScript being converted to MAX_UINT in the bindings.  In 32-bit this was
+        identical to -1 when interpeted as signed long, but in 64-bit it was still equal to MAX_UINT.
+
+        The solution for this is to use the IsIndex attribute on arguments that the SVG spec declares as "unsigned long"
+        but requires an exception be thrown when a negative value is passed.  This results in the JS bindings handling the
+        check for a negative value and lets the implementation treat the arguments purely as unsigned values.
+
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::getNumberOfChars):
+        (WebCore::SVGTextContentElement::getSubStringLength):
+        (WebCore::SVGTextContentElement::getStartPositionOfChar):
+        (WebCore::SVGTextContentElement::getEndPositionOfChar):
+        (WebCore::SVGTextContentElement::getExtentOfChar):
+        (WebCore::SVGTextContentElement::getRotationOfChar):
+        (WebCore::SVGTextContentElement::getCharNumAtPosition):
+        (WebCore::SVGTextContentElement::selectSubString):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGTextContentElement.idl:
+
+2009-03-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Get mailto code out of FrameLoader.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::transferMailtoPostFormDataToURL): Added. Factored out the mailto
+        logic so HTMLFormElement::submit isn't full of ugly bits. This includes the
+        part of the logic that involves transformeing the URL that was previously
+        inside FrameLoader.
+        (WebCore::HTMLFormElement::submit): Call transferMailtoPostFormDataToURL and
+        also release the data for slightly less refcount churn.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm): Removed all the special casing for mailto,
+        since HTMLFormElement now properly prepares both the URL and the form data.
+
+2009-03-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix <rdar://problem/6724514> A bit of OpenTypeUtilities cleanup
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::EOTStream::EOTStream): Changed to use EOTHeader.
+        (WebCore::createFontCustomPlatformData): Ditto.
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::EOTHeader::EOTHeader): Added. Initializes the buffer size to
+        the size of an EOTPrefix.
+        (WebCore::EOTHeader::updateEOTSize): Added. Updates the size field in
+        the prefix.
+        (WebCore::EOTHeader::appendBigEndianString): Changed the static
+        appendBigEndianStringToEOTHeader() into this member function.
+        (WebCore::EOTHeader::appendPaddingShort): Added.
+        (WebCore::getEOTHeader): Changed to use EOTHeader.
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        (WebCore::EOTHeader::size):
+        (WebCore::EOTHeader::data):
+        (WebCore::EOTHeader::prefix):
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::EOTStream::EOTStream): Changed to use EOTHeader.
+        (WebCore::createFontCustomPlatformData): Ditto.
+
+2009-03-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        To prepare for work on a form loading fix, remove some unused functions,
+        consolidate some functions, and make many more functions private in
+        FrameLoader.
+
+        * WebCore.base.exp: Remove some unused entry points, update another.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Clear m_frame directly instead of using
+        clearFramePointer.
+        * dom/Document.h: Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::urlSelected): Consolidate the two functions
+        of this name into a single function. Also changed the event argument
+        to be PassRefPtr<Event>.
+        (WebCore::FrameLoader::submitForm): Changed the event argument to
+        be PassRefPtr<Event>.
+        (WebCore::FrameLoader::scheduleLocationChange): Call completeURL
+        explicitly so we can remove the version of changeLocation that does
+        completeURL for us.
+        (WebCore::FrameLoader::redirectionTimerFired): Ditto.
+        (WebCore::FrameLoader::loadURLIntoChildFrame): Set m_provisionalHistoryItem
+        directly so we don't need a setProvisionalHistoryItem function.
+        (WebCore::FrameLoader::canCachePageContainingThisFrame): Get at
+        m_quickRedirectComing directly so we don't need a isQuickRedirectComing
+        function.
+        (WebCore::FrameLoader::logCanCacheFrameDecision): Ditto.
+        (WebCore::FrameLoader::loadFrameRequestWithFormAndValues): Changed the
+        event argument to be PassRefPtr<Event>.
+        (WebCore::FrameLoader::loadURL): Move the logic of the continueLoadWithData
+        function here because this is the only caller. If we want to make the
+        resulting function smaller we should refactor some other way. Also
+        streamlined the user-chosen encoding logic, but did not change what it does.
+        (WebCore::FrameLoader::finishedLoadingDocument): Changed the event argument
+        to be PassRefPtr<Event>.
+        (WebCore::FrameLoader::loadPostRequest): Ditto.
+        (WebCore::FrameLoader::receivedMainResourceError): Moved the logic from
+        the didNotOpenURL function here, since this was the only caller.
+
+        * loader/FrameLoader.h: Removed include of FormState.h and used a forward
+        declaration instead. Removed unneeded forward declation of Element.
+        Moved many functions into the private section, and removed some other
+        unused or uneeded functions.
+
+2009-03-27  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24303
+        Using keyboard select RTL text, Highlights goes to opposite direction from Firefox and IE.
+
+        Test: editing/selection/extend-selection.html
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::directionOfEnclosingBlock): Added
+        (WebCore::SelectionController::modifyExtendingRight): Added. Currenctly 
+        implemented for character and word granularity, all other granularities
+        are treated as "forward".
+        (WebCore::SelectionController::modifyExtendingForward): Renamed 
+        modifyExtendingRightForward() to this.
+        (WebCore::SelectionController::modifyExtendingLeft): Added. Currenctly
+        implemented for character and word granularity, all other granularities
+        are treated as "backward".
+        (WebCore::SelectionController::modifyExtendingBackward): Renamed
+        modifyExtendingLeftBackward() to this.
+        (WebCore::SelectionController::modify): Change to call either the 
+        left/right or backward/forward methods depending on the 'dir' argument
+        for extends.
+        * editing/SelectionController.h:
+
+2009-03-27  John Abd-El-Malek  <jam@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24836
+        Fix navigator.plugins.refresh(false) in Chromium.
+
+        * plugins/chromium/PluginDataChromium.cpp:
+        (WebCore::PluginData::refresh):
+
+2009-03-27  Timothy Hatcher  <timothy@apple.com>
+
+        Make scrollLeft, scrollTop, scrollWidth, and scrollHeight
+        virtual to fix the broken layout tests from my last commit.
+
+        Reviewed by Mark Rowe.
+
+        * dom/Element.cpp:
+        (WebCore::Element::scrollLeft):
+        (WebCore::Element::scrollTop):
+        (WebCore::Element::scrollWidth):
+        (WebCore::Element::scrollHeight):
+        * dom/Element.h:
+        * html/HTMLBodyElement.h:
+
+2009-03-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=24876>.
+        Bug 24876: fast/forms/select-max-length.html times out in debug builds due to HTMLSelectElement::setLength being O(N^2)
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setLength): Repeatedly calling remove to remove elements causes us to recalculate the list
+        items after each node is removed, leading to O(N^2) behaviour.  By inlining the batch removal in to setLength we can avoid
+        this gratuitous recalcuation.
+
+2009-03-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        We don't support images for GtkCursors yet. We need a  placeholder to avoid crashes.
+        I took crosshair to have a common behavior with firefox.
+
+        [GTK] SVG - Crash on setting the cursor icon
+        https://bugs.webkit.org/show_bug.cgi?id=24565
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-03-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove redundant attributes and functions from IDL files that have the
+        same attributes and functions defined in the super class.
+
+        Reviewed by Simon Fraser.
+
+        * WebCore.xcodeproj/project.pbxproj: Remove DOMHTMLBodyElementPrivate.h.
+        * bindings/objc/PublicDOMInterfaces.h: Remove focus and blur from DOMHTMLElement.
+        * html/HTMLBodyElement.idl: Remove scrollLeft, scrollTop, scrollWidth
+        and scrollHeight.
+        * html/HTMLElement.idl: Remove blur and focus.
+
+2009-03-27  Adam Roben  <aroben@apple.com>
+
+        Don't include substitute data URLs in global history redirect chains
+
+        <rdar://6690169>
+
+        Reviewed by Darin Adler.
+
+        This might be testable if:
+          - support were added to DRT for providing substitute data on failed
+            loads
+          - support were added to DRT for dumping redirect chains
+
+        I tried doing the above and was still unable to make a test.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::updateHistoryForStandardLoad):
+        (WebCore::FrameLoader::updateHistoryForRedirectWithLockedBackForwardList):
+        Call updateGlobalHistoryRedirectLinks only if the load succeeded
+        (i.e., there is no unreachableURL). Previous the FrameLoaderClient
+        implementations were unconditionally calling
+        updateGlobalHistoryRedirectLinks from within updateGlobalHistory.
+
+2009-03-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24861
+        Chromium port did not render decorations for <input type="search">.
+        This copies RenderThemeWin.*.
+
+        * css/themeChromiumWin.css: Removed.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumLinux::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumLinux::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumLinux::paintSearchFieldResultsButton):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::paintSearchField):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::RenderThemeChromiumWin::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumWin::paintSearchFieldResultsButton):
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::paintSearchField):
+
+2009-03-27  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        If an object has a self-painting layer, don't count it as part of a block's visual overflow.
+        This fix has only been made for block-level children.   The inline-level case is still broken
+        (and covered by an existing bug).
+
+        Added fast/block/positioning/negative-rel-position.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+
+2009-03-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6642221>
+        REGRESSION: With the Movie widget, movie trailer fails to load if movie had been previously viewed
+        
+        Add a dashboard specific workaround so that we always create renderers for object elements, even if display:none is set.
+        
+        I've filed <rdar://problem/6731022> against the Movies widget.
+        
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::rendererIsNeeded):
+
+2009-03-25  Timothy Hatcher  <timothy@apple.com>
+
+        Expose new DOM methods as public Objective-C API.
+
+        <rdar://problem/5837350> Expose new DOM classes and methods
+        as public API (match the additions to the JavaScript DOM)
+
+        Reviewed by Mark Rowe and Darin Adler.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOMHTML.h:
+        * bindings/objc/DOMPrivate.h:
+        * bindings/objc/PublicDOMInterfaces.h:
+
+2009-03-27  Zack Rusin <zack@kde.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24280
+
+        Fix propagation of fill rules when rendering paths in the Qt build.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtFillRule):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+
+2009-03-27  Zack Rusin <zack@kde.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24275
+
+        Fix text field theming in the Qt build with the KDE 4 Oxygen
+        style by adjusting the size vertically and horizontally to
+        set padding on the element equal to the width of the style painted border.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::adjustTextFieldStyle):
+        (WebCore::RenderThemeQt::paintTextField):
+        * platform/qt/RenderThemeQt.h:
+
+2009-03-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24852
+        Build fix for GNU mode RVCT compilation
+
+        * html/PreloadScanner.cpp:
+
+2009-03-27  Erik L. Bunce  <elbunce@xendom.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24868
+
+        Make text of the writing direction items more user friendly.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+
+2009-03-27  Erik L. Bunce  <elbunce@xendom.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24274
+
+        Fixed the Qt 4.4 Mac build with netscape plugins enabled.
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-03-26  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Qt build.
+
+        * platform/text/TextEncodingDetectorNone.cpp:
+        (WebCore::detectTextEncoding):
+
+2009-03-26  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24874
+        24874: HTMLMediaElement: 'duration' defaults to NaN, deal with it
+        
+        The 'duration' attribute is NaN when no media is available, so the
+        media element should take care when comparing with duration().
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Don't compare with duration when
+        it is NaN.
+        (WebCore::HTMLMediaElement::endedPlayback): Ditto.
+
+2009-03-26  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * platform/text/TextEncodingDetectorICU.cpp:
+        * platform/text/TextEncodingDetectorNone.cpp:
+
 2009-03-26  Jungshik Shin  <jshin@chromium.org>
 
         Reviewed by Cameron Zwarich.
@@ -4840,7 +29333,7 @@
         * html/HTMLAppletElement.cpp:
         (WebCore::HTMLAppletElement::createRenderer):
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadItem):
+        (WebCore::FrameLoader::createJavaAppletWidget):
 
 2009-03-10  Justin Garcia  <justin.garcia@apple.com>
 
diff --git a/WebCore/Configurations/Base.xcconfig b/WebCore/Configurations/Base.xcconfig
index d33943d..b8a5970 100644
--- a/WebCore/Configurations/Base.xcconfig
+++ b/WebCore/Configurations/Base.xcconfig
@@ -1,3 +1,26 @@
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
 DEBUG_INFORMATION_FORMAT = dwarf;
 GCC_C_LANGUAGE_STANDARD = gnu99;
 GCC_DEBUGGING_SYMBOLS = default;
@@ -8,6 +31,7 @@
 GCC_ENABLE_OBJC_GC = supported;
 GCC_ENABLE_SYMBOL_SEPARATION = NO;
 GCC_FAST_OBJC_DISPATCH = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS = YES;
 GCC_MODEL_TUNING = G5;
 GCC_OBJC_CALL_CXX_CDTORS = YES;
 GCC_PRECOMPILE_PREFIX_HEADER = YES;
@@ -53,6 +77,7 @@
 DEAD_CODE_STRIPPING_normal = YES;
 DEAD_CODE_STRIPPING = $(DEAD_CODE_STRIPPING_$(CURRENT_VARIANT));
 
+SECTORDER_FLAGS = -sectorder __TEXT __text WebCore.order;
 
 WEBCORE_SQLITE3_HEADER_SEARCH_PATHS = $(NEXT_ROOT)/usr/local/include/WebCoreSQLite3;
 SQLITE3_HEADER_SEARCH_PATHS = $(SQLITE3_HEADER_SEARCH_PATHS_$(MAC_OS_X_VERSION_MAJOR));
@@ -61,21 +86,11 @@
 SQLITE3_HEADER_SEARCH_PATHS_1050 = $(WEBCORE_SQLITE3_HEADER_SEARCH_PATHS);
 SQLITE3_HEADER_SEARCH_PATHS_1060 = ;
 
-GCC_VERSION = $(GCC_VERSION_$(XCODE_VERSION_ACTUAL));
+
+// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
+// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
+// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
+// XCODE_VERSION_ACTUAL for the full version number.
+GCC_VERSION = $(GCC_VERSION_$(XCODE_VERSION_MINOR));
+GCC_VERSION_ = $(GCC_VERSION_$(XCODE_VERSION_ACTUAL));
 GCC_VERSION_0310 = 4.2;
-
-
-// <rdar://problem/5488678>: Production builds on 10.4 PowerPC need to have debugging symbols disabled to prevent a huge STABS section being generated.
-//                           Xcode on 10.4 does not define MAC_OS_X_VERSION_MAJOR, so the default Mac OS X version is treated as 10.4.
-GCC_GENERATE_DEBUGGING_SYMBOLS = $(GCC_GENERATE_DEBUGGING_SYMBOLS_$(CURRENT_ARCH));
-GCC_GENERATE_DEBUGGING_SYMBOLS_i386 = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_x86_64 = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc64 = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc = $(GCC_GENERATE_DEBUGGING_SYMBOLS_$(CURRENT_ARCH)_$(CONFIGURATION));
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Debug = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Release = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Production = $(GCC_GENERATE_DEBUGGING_SYMBOLS_$(CURRENT_ARCH)_$(CONFIGURATION)_$(MAC_OS_X_VERSION_MAJOR));
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Production_ = NO;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Production_1040 = NO;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Production_1050 = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_ppc_Production_1060 = YES;
diff --git a/WebCore/Configurations/DebugRelease.xcconfig b/WebCore/Configurations/DebugRelease.xcconfig
index ae4a229..53264bc 100644
--- a/WebCore/Configurations/DebugRelease.xcconfig
+++ b/WebCore/Configurations/DebugRelease.xcconfig
@@ -1,3 +1,26 @@
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
 #include "Base.xcconfig"
 
 ARCHS = $(ARCHS_$(MAC_OS_X_VERSION_MAJOR));
@@ -16,4 +39,6 @@
 
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = YES;
 
+SECTORDER_FLAGS = ;
+
 WEBCORE_SQLITE3_HEADER_SEARCH_PATHS = $(BUILT_PRODUCTS_DIR)/WebCoreSQLite3;
diff --git a/WebCore/Configurations/FeatureDefines.xcconfig b/WebCore/Configurations/FeatureDefines.xcconfig
new file mode 100644
index 0000000..95fb0c6
--- /dev/null
+++ b/WebCore/Configurations/FeatureDefines.xcconfig
@@ -0,0 +1,52 @@
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+// The contents of this file must be kept in sync with FeatureDefines.xcconfig in JavaScriptCore,
+// WebCore and WebKit.  Also the default values of the ENABLE_FEATURE_NAME macros in build-webkit
+// should match the values below, but they do not need to be in the same order.
+
+// Set any ENABLE_FEATURE_NAME macro to an empty string to disable that feature.
+
+ENABLE_3D_RENDERING = ;
+ENABLE_CHANNEL_MESSAGING = ;
+ENABLE_DATABASE = ENABLE_DATABASE;
+ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
+ENABLE_FILTERS = ;
+ENABLE_GEOLOCATION = ;
+ENABLE_ICONDATABASE = ENABLE_ICONDATABASE;
+ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
+ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
+ENABLE_SVG = ENABLE_SVG;
+ENABLE_SVG_ANIMATION = ENABLE_SVG_ANIMATION;
+ENABLE_SVG_AS_IMAGE = ENABLE_SVG_AS_IMAGE;
+ENABLE_SVG_DOM_OBJC_BINDINGS = ENABLE_SVG_DOM_OBJC_BINDINGS;
+ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
+ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
+ENABLE_SVG_USE = ENABLE_SVG_USE;
+ENABLE_VIDEO = ENABLE_VIDEO;
+ENABLE_WML = ;
+ENABLE_WORKERS = ENABLE_WORKERS;
+ENABLE_XPATH = ENABLE_XPATH;
+ENABLE_XSLT = ENABLE_XSLT;
+
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DOM_STORAGE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/WebCore/Configurations/Version.xcconfig b/WebCore/Configurations/Version.xcconfig
index ab0aa9b..cc515f2 100644
--- a/WebCore/Configurations/Version.xcconfig
+++ b/WebCore/Configurations/Version.xcconfig
@@ -1,5 +1,28 @@
-MAJOR_VERSION = 530;
-MINOR_VERSION = 5;
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+MAJOR_VERSION = 531;
+MINOR_VERSION = 0;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/WebCore/Configurations/WebCore.xcconfig b/WebCore/Configurations/WebCore.xcconfig
index 99b987d..4ea0097 100644
--- a/WebCore/Configurations/WebCore.xcconfig
+++ b/WebCore/Configurations/WebCore.xcconfig
@@ -1,4 +1,29 @@
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+#include "FeatureDefines.xcconfig"
 #include "Version.xcconfig"
+
 EXPORTED_SYMBOLS_FILE = $(EXPORTED_SYMBOLS_FILE_$(CURRENT_ARCH));
 EXPORTED_SYMBOLS_FILE_ = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
 EXPORTED_SYMBOLS_FILE_i386 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
@@ -22,14 +47,9 @@
 JAVASCRIPTCORE_PRIVATE_HEADERS_DIR_macosx_Production = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks/JavaScriptCore.framework/PrivateHeaders;
 JAVASCRIPTCORE_PRIVATE_HEADERS_engineering = $(BUILT_PRODUCTS_DIR)/JavaScriptCore.framework/PrivateHeaders;
 
-// This needs to be kept sorted, and in sync with FEATURE_DEFINES in JavaScriptCore.xcconfig, WebKit.xcconfig and
-// the default settings of build-webkit to prevent needless rebuilding when using both Xcode and build-webkit.
-FEATURE_DEFINES = $(FEATURE_DEFINES_$(MAC_OS_X_VERSION_MAJOR));
-FEATURE_DEFINES_BASE = ENABLE_DATABASE ENABLE_DOM_STORAGE ENABLE_ICONDATABASE ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT;
-FEATURE_DEFINES_ = $(FEATURE_DEFINES_1040);
-FEATURE_DEFINES_1040 = $(FEATURE_DEFINES_BASE);
-FEATURE_DEFINES_1050 = $(FEATURE_DEFINES_BASE);
-FEATURE_DEFINES_1060 = $(FEATURE_DEFINES_BASE) ENABLE_GEOLOCATION;
+EXCLUDED_SOURCE_FILE_NAMES = $(EXCLUDED_SOURCE_FILE_NAMES_$(ENABLE_SVG_DOM_OBJC_BINDINGS))
+EXCLUDED_SOURCE_FILE_NAMES_ = DOMSVG*.* DOMHTMLFrameElementPrivate.h DOMHTMLIFrameElementPrivate.h;
+EXCLUDED_SOURCE_FILE_NAMES_ENABLE_SVG_DOM_OBJC_BINDINGS = ;
 
 SQLITE3_LIBRARY = $(SQLITE3_LIBRARY_$(MAC_OS_X_VERSION_MAJOR));
 SQLITE3_LIBRARY_ = WebCoreSQLite3;
diff --git a/WebCore/DerivedSources.make b/WebCore/DerivedSources.make
index c26b459..f1c3058 100644
--- a/WebCore/DerivedSources.make
+++ b/WebCore/DerivedSources.make
@@ -386,9 +386,7 @@
 all : \
     $(filter-out JSEventListener.h JSEventTarget.h JSRGBColor.h,$(DOM_CLASSES:%=JS%.h)) \
     \
-    JSDOMWindowBase.lut.h \
     JSRGBColor.lut.h \
-    JSWorkerContextBase.lut.h \
     \
     JSJavaScriptCallFrame.h \
     \
@@ -577,7 +575,9 @@
 
 ifeq ($(findstring ENABLE_SVG,$(FEATURE_DEFINES)), ENABLE_SVG)
 
-WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.SVG.exp
+ifeq ($(findstring ENABLE_SVG_DOM_OBJC_BINDINGS,$(FEATURE_DEFINES)), ENABLE_SVG_DOM_OBJC_BINDINGS)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.SVG.exp
+endif
 
 ifeq ($(findstring ENABLE_SVG_USE,$(FEATURE_DEFINES)), ENABLE_SVG_USE)
     SVG_FLAGS := $(SVG_FLAGS) ENABLE_SVG_USE=1
@@ -587,10 +587,12 @@
     SVG_FLAGS := $(SVG_FLAGS) ENABLE_SVG_FONTS=1
 endif
 
-ifeq ($(findstring ENABLE_SVG_FILTERS,$(FEATURE_DEFINES)), ENABLE_SVG_FILTERS)
-    SVG_FLAGS := $(SVG_FLAGS) ENABLE_SVG_FILTERS=1
+ifeq ($(findstring ENABLE_FILTERS,$(FEATURE_DEFINES)), ENABLE_FILTERS)
+    SVG_FLAGS := $(SVG_FLAGS) ENABLE_FILTERS=1
+ifeq ($(findstring ENABLE_SVG_DOM_OBJC_BINDINGS,$(FEATURE_DEFINES)), ENABLE_SVG_DOM_OBJC_BINDINGS)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.SVG.Filters.exp
 endif
+endif
 
 ifeq ($(findstring ENABLE_SVG_AS_IMAGE,$(FEATURE_DEFINES)), ENABLE_SVG_AS_IMAGE)
     SVG_FLAGS := $(SVG_FLAGS) ENABLE_SVG_AS_IMAGE=1
@@ -598,13 +600,17 @@
 
 ifeq ($(findstring ENABLE_SVG_ANIMATION,$(FEATURE_DEFINES)), ENABLE_SVG_ANIMATION)
     SVG_FLAGS := $(SVG_FLAGS) ENABLE_SVG_ANIMATION=1
+ifeq ($(findstring ENABLE_SVG_DOM_OBJC_BINDINGS,$(FEATURE_DEFINES)), ENABLE_SVG_DOM_OBJC_BINDINGS)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.SVG.Animation.exp
 endif
+endif
 
 ifeq ($(findstring ENABLE_SVG_FOREIGN_OBJECT,$(FEATURE_DEFINES)), ENABLE_SVG_FOREIGN_OBJECT)
     SVG_FLAGS := $(SVG_FLAGS) ENABLE_SVG_FOREIGN_OBJECT=1
+ifeq ($(findstring ENABLE_SVG_DOM_OBJC_BINDINGS,$(FEATURE_DEFINES)), ENABLE_SVG_DOM_OBJC_BINDINGS)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.SVG.ForeignObject.exp
 endif
+endif
 
 # SVG tag and attribute names (need to pass an extra flag if svg experimental features are enabled)
 
diff --git a/WebCore/English.lproj/localizedStrings.js b/WebCore/English.lproj/localizedStrings.js
index 20db8ab..a1797c7 100644
--- a/WebCore/English.lproj/localizedStrings.js
+++ b/WebCore/English.lproj/localizedStrings.js
Binary files differ
diff --git a/WebCore/ForwardingHeaders/debugger/Debugger.h b/WebCore/ForwardingHeaders/debugger/Debugger.h
index 69b7bae..e6cfede 100644
--- a/WebCore/ForwardingHeaders/debugger/Debugger.h
+++ b/WebCore/ForwardingHeaders/debugger/Debugger.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Debugger_h
+#define WebCore_FWD_Debugger_h
 #include <JavaScriptCore/Debugger.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h b/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h
index 8a7b880..c241bb7 100644
--- a/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h
+++ b/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_DebuggerActivation_h
+#define WebCore_FWD_DebuggerActivation_h
 #include <JavaScriptCore/DebuggerActivation.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h b/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h
index 474fec0..4a23742 100644
--- a/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h
+++ b/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_DebuggerCallFrame_h
+#define WebCore_FWD_DebuggerCallFrame_h
 #include <JavaScriptCore/DebuggerCallFrame.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/interpreter/CallFrame.h b/WebCore/ForwardingHeaders/interpreter/CallFrame.h
index c8c60d4..8c3acee 100644
--- a/WebCore/ForwardingHeaders/interpreter/CallFrame.h
+++ b/WebCore/ForwardingHeaders/interpreter/CallFrame.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_CallFrame_h
+#define WebCore_FWD_CallFrame_h
 #include <JavaScriptCore/CallFrame.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/interpreter/Interpreter.h b/WebCore/ForwardingHeaders/interpreter/Interpreter.h
index 175ddce..1235c21 100644
--- a/WebCore/ForwardingHeaders/interpreter/Interpreter.h
+++ b/WebCore/ForwardingHeaders/interpreter/Interpreter.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Interpreter_h
+#define WebCore_FWD_Interpreter_h
 #include <JavaScriptCore/Interpreter.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/jit/JITCode.h b/WebCore/ForwardingHeaders/jit/JITCode.h
new file mode 100644
index 0000000..b996615
--- /dev/null
+++ b/WebCore/ForwardingHeaders/jit/JITCode.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_JITCode_h
+#define WebCore_FWD_JITCode_h
+#include <JavaScriptCore/JITCode.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/masm/X86Assembler.h b/WebCore/ForwardingHeaders/masm/X86Assembler.h
index e1f0b4d..2b7dd6c 100644
--- a/WebCore/ForwardingHeaders/masm/X86Assembler.h
+++ b/WebCore/ForwardingHeaders/masm/X86Assembler.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_X86Assembler_h
+#define WebCore_FWD_X86Assembler_h
 #include <JavaScriptCore/X86Assembler.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/parser/Parser.h b/WebCore/ForwardingHeaders/parser/Parser.h
index 10a2775..863df59 100644
--- a/WebCore/ForwardingHeaders/parser/Parser.h
+++ b/WebCore/ForwardingHeaders/parser/Parser.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Parser_h
+#define WebCore_FWD_Parser_h
 #include <JavaScriptCore/Parser.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/parser/SourceCode.h b/WebCore/ForwardingHeaders/parser/SourceCode.h
index 17a5069..0a1079b 100644
--- a/WebCore/ForwardingHeaders/parser/SourceCode.h
+++ b/WebCore/ForwardingHeaders/parser/SourceCode.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_SourceCode_h
+#define WebCore_FWD_SourceCode_h
 #include <JavaScriptCore/SourceCode.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/parser/SourceProvider.h b/WebCore/ForwardingHeaders/parser/SourceProvider.h
index 487aae9..0eb078b 100644
--- a/WebCore/ForwardingHeaders/parser/SourceProvider.h
+++ b/WebCore/ForwardingHeaders/parser/SourceProvider.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_SourceProvider_h
+#define WebCore_FWD_SourceProvider_h
 #include <JavaScriptCore/SourceProvider.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/pcre/pcre.h b/WebCore/ForwardingHeaders/pcre/pcre.h
index 47c0d3d..198acc9 100644
--- a/WebCore/ForwardingHeaders/pcre/pcre.h
+++ b/WebCore/ForwardingHeaders/pcre/pcre.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_pcre_h
+#define WebCore_FWD_pcre_h
 #include <JavaScriptCore/pcre.h>
+#endif
+
diff --git a/WebCore/ForwardingHeaders/profiler/Profile.h b/WebCore/ForwardingHeaders/profiler/Profile.h
index b591262..d26bafd 100644
--- a/WebCore/ForwardingHeaders/profiler/Profile.h
+++ b/WebCore/ForwardingHeaders/profiler/Profile.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_Profile_h
+#define WebCore_FWD_Profile_h
 #include <JavaScriptCore/Profile.h>
+#endif
+
diff --git a/WebCore/ForwardingHeaders/profiler/ProfileNode.h b/WebCore/ForwardingHeaders/profiler/ProfileNode.h
index 488449f..a19a07e 100644
--- a/WebCore/ForwardingHeaders/profiler/ProfileNode.h
+++ b/WebCore/ForwardingHeaders/profiler/ProfileNode.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_ProfileNode_h
+#define WebCore_FWD_ProfileNode_h
 #include <JavaScriptCore/ProfileNode.h>
+#endif
+
diff --git a/WebCore/ForwardingHeaders/profiler/Profiler.h b/WebCore/ForwardingHeaders/profiler/Profiler.h
index 56c6e0e..06139ff 100644
--- a/WebCore/ForwardingHeaders/profiler/Profiler.h
+++ b/WebCore/ForwardingHeaders/profiler/Profiler.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_Profiler_h
+#define WebCore_FWD_Profiler_h
 #include <JavaScriptCore/Profiler.h>
+#endif
+
diff --git a/WebCore/ForwardingHeaders/runtime/ArgList.h b/WebCore/ForwardingHeaders/runtime/ArgList.h
index 02955d4..ce334d4 100644
--- a/WebCore/ForwardingHeaders/runtime/ArgList.h
+++ b/WebCore/ForwardingHeaders/runtime/ArgList.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ArgList_h
+#define WebCore_FWD_ArgList_h
 #include <JavaScriptCore/ArgList.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h b/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h
index 9719fb0..51b7996 100644
--- a/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h
+++ b/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ArrayPrototype_h
+#define WebCore_FWD_ArrayPrototype_h
 #include <JavaScriptCore/ArrayPrototype.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/BooleanObject.h b/WebCore/ForwardingHeaders/runtime/BooleanObject.h
index 3cea7c6..49d6fc3 100644
--- a/WebCore/ForwardingHeaders/runtime/BooleanObject.h
+++ b/WebCore/ForwardingHeaders/runtime/BooleanObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_BooleanObject_h
+#define WebCore_FWD_BooleanObject_h
 #include <JavaScriptCore/BooleanObject.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/CallData.h b/WebCore/ForwardingHeaders/runtime/CallData.h
index 15a6028..03ecef8 100644
--- a/WebCore/ForwardingHeaders/runtime/CallData.h
+++ b/WebCore/ForwardingHeaders/runtime/CallData.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_CallData_h
+#define WebCore_FWD_CallData_h
 #include <JavaScriptCore/CallData.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/Collector.h b/WebCore/ForwardingHeaders/runtime/Collector.h
index 6d8b5cd..d133a27 100644
--- a/WebCore/ForwardingHeaders/runtime/Collector.h
+++ b/WebCore/ForwardingHeaders/runtime/Collector.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Collector_h
+#define WebCore_FWD_Collector_h
 #include <JavaScriptCore/Collector.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h b/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
index 98166ab..fcfe26d 100644
--- a/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
+++ b/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_CollectorHeapIterator_h
+#define WebCore_FWD_CollectorHeapIterator_h
 #include <JavaScriptCore/CollectorHeapIterator.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/Completion.h b/WebCore/ForwardingHeaders/runtime/Completion.h
index d6a081f..9dd6291 100644
--- a/WebCore/ForwardingHeaders/runtime/Completion.h
+++ b/WebCore/ForwardingHeaders/runtime/Completion.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Completion_h
+#define WebCore_FWD_Completion_h
 #include <JavaScriptCore/Completion.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/ConstructData.h b/WebCore/ForwardingHeaders/runtime/ConstructData.h
index f8d3d3c..bd04e51 100644
--- a/WebCore/ForwardingHeaders/runtime/ConstructData.h
+++ b/WebCore/ForwardingHeaders/runtime/ConstructData.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ConstructData_h
+#define WebCore_FWD_ConstructData_h
 #include <JavaScriptCore/ConstructData.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/DateInstance.h b/WebCore/ForwardingHeaders/runtime/DateInstance.h
index 2429283..c75cfed 100644
--- a/WebCore/ForwardingHeaders/runtime/DateInstance.h
+++ b/WebCore/ForwardingHeaders/runtime/DateInstance.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_DateInstance_h
+#define WebCore_FWD_DateInstance_h
 #include <JavaScriptCore/DateInstance.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/Error.h b/WebCore/ForwardingHeaders/runtime/Error.h
index 4fbaabd..7ddeab1 100644
--- a/WebCore/ForwardingHeaders/runtime/Error.h
+++ b/WebCore/ForwardingHeaders/runtime/Error.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Error_h
+#define WebCore_FWD_Error_h
 #include <JavaScriptCore/Error.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h b/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h
index bc49dca..a1962ed 100644
--- a/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h
+++ b/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_FunctionConstructor_h
+#define WebCore_FWD_FunctionConstructor_h
 #include <JavaScriptCore/FunctionConstructor.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h b/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h
index 3f71e8e..1db3b83 100644
--- a/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h
+++ b/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_FunctionPrototype_h
+#define WebCore_FWD_FunctionPrototype_h
 #include <JavaScriptCore/FunctionPrototype.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/Identifier.h b/WebCore/ForwardingHeaders/runtime/Identifier.h
index 5c925eb..63f1e42 100644
--- a/WebCore/ForwardingHeaders/runtime/Identifier.h
+++ b/WebCore/ForwardingHeaders/runtime/Identifier.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Identifier_h
+#define WebCore_FWD_Identifier_h
 #include <JavaScriptCore/Identifier.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/InitializeThreading.h b/WebCore/ForwardingHeaders/runtime/InitializeThreading.h
index 835097b..bd4f735 100644
--- a/WebCore/ForwardingHeaders/runtime/InitializeThreading.h
+++ b/WebCore/ForwardingHeaders/runtime/InitializeThreading.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_InitializeThreadingn_h
+#define WebCore_FWD_InitializeThreading_h
 #include <JavaScriptCore/InitializeThreading.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/InternalFunction.h b/WebCore/ForwardingHeaders/runtime/InternalFunction.h
index f447f78..78df9aa 100644
--- a/WebCore/ForwardingHeaders/runtime/InternalFunction.h
+++ b/WebCore/ForwardingHeaders/runtime/InternalFunction.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_InternalFunction_h
+#define WebCore_FWD_InternalFunction_h
 #include <JavaScriptCore/InternalFunction.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/JSArray.h b/WebCore/ForwardingHeaders/runtime/JSArray.h
index 9d70688..5271c27 100644
--- a/WebCore/ForwardingHeaders/runtime/JSArray.h
+++ b/WebCore/ForwardingHeaders/runtime/JSArray.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSArray_h
+#define WebCore_FWD_JSArray_h
 #include <JavaScriptCore/JSArray.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/JSByteArray.h b/WebCore/ForwardingHeaders/runtime/JSByteArray.h
index 9e13ace..ce5140f 100644
--- a/WebCore/ForwardingHeaders/runtime/JSByteArray.h
+++ b/WebCore/ForwardingHeaders/runtime/JSByteArray.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSByteArray_h
+#define WebCore_FWD_JSByteArray_h
 #include <JavaScriptCore/JSByteArray.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/JSFunction.h b/WebCore/ForwardingHeaders/runtime/JSFunction.h
index 396407d..614b3da 100644
--- a/WebCore/ForwardingHeaders/runtime/JSFunction.h
+++ b/WebCore/ForwardingHeaders/runtime/JSFunction.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSFunction_h
+#define WebCore_FWD_JSFunction_h
 #include <JavaScriptCore/JSFunction.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/JSGlobalData.h b/WebCore/ForwardingHeaders/runtime/JSGlobalData.h
index e5f143a..3f98c22 100644
--- a/WebCore/ForwardingHeaders/runtime/JSGlobalData.h
+++ b/WebCore/ForwardingHeaders/runtime/JSGlobalData.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSGlobalData_h
+#define WebCore_FWD_JSGlobalData_h
 #include <JavaScriptCore/JSGlobalData.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h b/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h
index 915d87a..47e78b2 100644
--- a/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h
+++ b/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSGlobalObject_h
+#define WebCore_FWD_JSGlobalObject_h
 #include <JavaScriptCore/JSGlobalObject.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/JSLock.h b/WebCore/ForwardingHeaders/runtime/JSLock.h
index 70ad81d..8e6a629 100644
--- a/WebCore/ForwardingHeaders/runtime/JSLock.h
+++ b/WebCore/ForwardingHeaders/runtime/JSLock.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSLock_h
+#define WebCore_FWD_JSLock_h
 #include <JavaScriptCore/JSLock.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/JSNumberCell.h b/WebCore/ForwardingHeaders/runtime/JSNumberCell.h
index 3c68938..e8d3227 100644
--- a/WebCore/ForwardingHeaders/runtime/JSNumberCell.h
+++ b/WebCore/ForwardingHeaders/runtime/JSNumberCell.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSNumberCell_h
+#define WebCore_FWD_JSNumberCell_h
 #include <JavaScriptCore/JSNumberCell.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/JSObject.h b/WebCore/ForwardingHeaders/runtime/JSObject.h
index 45133f3..6c79855 100644
--- a/WebCore/ForwardingHeaders/runtime/JSObject.h
+++ b/WebCore/ForwardingHeaders/runtime/JSObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSObject_h
+#define WebCore_FWD_JSObject_h
 #include <JavaScriptCore/JSObject.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/JSString.h b/WebCore/ForwardingHeaders/runtime/JSString.h
index 195ed21..6409607 100644
--- a/WebCore/ForwardingHeaders/runtime/JSString.h
+++ b/WebCore/ForwardingHeaders/runtime/JSString.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSString_h
+#define WebCore_FWD_JSString_h
 #include <JavaScriptCore/JSString.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/JSValue.h b/WebCore/ForwardingHeaders/runtime/JSValue.h
index ebbed6c..d4c21ca 100644
--- a/WebCore/ForwardingHeaders/runtime/JSValue.h
+++ b/WebCore/ForwardingHeaders/runtime/JSValue.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSValue_h
+#define WebCore_FWD_JSValue_h
 #include <JavaScriptCore/JSValue.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/Lookup.h b/WebCore/ForwardingHeaders/runtime/Lookup.h
index 0622dca..99936d9 100644
--- a/WebCore/ForwardingHeaders/runtime/Lookup.h
+++ b/WebCore/ForwardingHeaders/runtime/Lookup.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Lookup_h
+#define WebCore_FWD_Lookup_h
 #include <JavaScriptCore/Lookup.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h b/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h
index 54e60b7..f890af1 100644
--- a/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h
+++ b/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ObjectPrototype_h
+#define WebCore_FWD_ObjectPrototype_h
 #include <JavaScriptCore/ObjectPrototype.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/Operations.h b/WebCore/ForwardingHeaders/runtime/Operations.h
index ab763a6..95ed34c 100644
--- a/WebCore/ForwardingHeaders/runtime/Operations.h
+++ b/WebCore/ForwardingHeaders/runtime/Operations.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Operations_h
+#define WebCore_FWD_Operations_h
 #include <JavaScriptCore/Operations.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/PropertyMap.h b/WebCore/ForwardingHeaders/runtime/PropertyMap.h
index d9348b4..fc40963 100644
--- a/WebCore/ForwardingHeaders/runtime/PropertyMap.h
+++ b/WebCore/ForwardingHeaders/runtime/PropertyMap.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_PropertyMap_h
+#define WebCore_FWD_PropertyMap_h
 #include <JavaScriptCore/PropertyMap.h>
+#endif
+
diff --git a/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h b/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h
index 0840208..2fdf2d0 100644
--- a/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h
+++ b/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_PropertyNameArray_h
+#define WebCore_FWD_PropertyNameArray_h
 #include <JavaScriptCore/PropertyNameArray.h>
+#endif
+
diff --git a/WebCore/ForwardingHeaders/runtime/Protect.h b/WebCore/ForwardingHeaders/runtime/Protect.h
index 0ba5798..76dc11c 100644
--- a/WebCore/ForwardingHeaders/runtime/Protect.h
+++ b/WebCore/ForwardingHeaders/runtime/Protect.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_Protect_h
+#define WebCore_FWD_Protect_h
 #include <JavaScriptCore/Protect.h>
+#endif
+
diff --git a/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h b/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h
index c3f3ea5..9a46fd7 100644
--- a/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h
+++ b/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_PrototypeFunction_h
+#define WebCore_FWD_PrototypeFunction_h
 #include <JavaScriptCore/PrototypeFunction.h>
+#endif
+
diff --git a/WebCore/ForwardingHeaders/runtime/StringObject.h b/WebCore/ForwardingHeaders/runtime/StringObject.h
index ca73cc0..0b9a23b 100644
--- a/WebCore/ForwardingHeaders/runtime/StringObject.h
+++ b/WebCore/ForwardingHeaders/runtime/StringObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringObject_h
+#define WebCore_FWD_StringObject_h
 #include <JavaScriptCore/StringObject.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h b/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h
index 9fd9612..6faa056 100644
--- a/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringObjectThatMasqueradesAsUndefined_h
+#define WebCore_FWD_StringObjectThatMasqueradesAsUndefined_h
 #include <JavaScriptCore/StringObjectThatMasqueradesAsUndefined.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/StringPrototype.h b/WebCore/ForwardingHeaders/runtime/StringPrototype.h
index ece7fdb..f0786d4 100644
--- a/WebCore/ForwardingHeaders/runtime/StringPrototype.h
+++ b/WebCore/ForwardingHeaders/runtime/StringPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringPrototype_h
+#define WebCore_FWD_StringPrototype_h
 #include <JavaScriptCore/StringPrototype.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/Structure.h b/WebCore/ForwardingHeaders/runtime/Structure.h
index 81853f3..2333978 100644
--- a/WebCore/ForwardingHeaders/runtime/Structure.h
+++ b/WebCore/ForwardingHeaders/runtime/Structure.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Structure_h
+#define WebCore_FWD_Structure_h
 #include <JavaScriptCore/Structure.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/SymbolTable.h b/WebCore/ForwardingHeaders/runtime/SymbolTable.h
index 0868c02..cb099a0 100644
--- a/WebCore/ForwardingHeaders/runtime/SymbolTable.h
+++ b/WebCore/ForwardingHeaders/runtime/SymbolTable.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_SymbolTable_h
+#define WebCore_FWD_SymbolTable_h
 #include <JavaScriptCore/SymbolTable.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/UString.h b/WebCore/ForwardingHeaders/runtime/UString.h
index 7a36767..d985aa5 100644
--- a/WebCore/ForwardingHeaders/runtime/UString.h
+++ b/WebCore/ForwardingHeaders/runtime/UString.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UString_h
+#define WebCore_FWD_UString_h
 #include <JavaScriptCore/UString.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wrec/WREC.h b/WebCore/ForwardingHeaders/wrec/WREC.h
index cfc4aff..5749ed9 100644
--- a/WebCore/ForwardingHeaders/wrec/WREC.h
+++ b/WebCore/ForwardingHeaders/wrec/WREC.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_WREC_h
+#define WebCore_FWD_WREC_h
 #include <JavaScriptCore/WREC.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/ASCIICType.h b/WebCore/ForwardingHeaders/wtf/ASCIICType.h
index f2258d2..5851cc6 100644
--- a/WebCore/ForwardingHeaders/wtf/ASCIICType.h
+++ b/WebCore/ForwardingHeaders/wtf/ASCIICType.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ASCIICType_h
+#define WebCore_FWD_ASCIICType_h
 #include <JavaScriptCore/ASCIICType.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/AlwaysInline.h b/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
index e591f71..e234162 100644
--- a/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
+++ b/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_AlwaysInline_h
+#define WebCore_FWD_AlwaysInline_h
 #include <JavaScriptCore/AlwaysInline.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/Assertions.h b/WebCore/ForwardingHeaders/wtf/Assertions.h
index 2144410..5445be4 100644
--- a/WebCore/ForwardingHeaders/wtf/Assertions.h
+++ b/WebCore/ForwardingHeaders/wtf/Assertions.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Assertions_h
+#define WebCore_FWD_Assertions_h
 #include <JavaScriptCore/Assertions.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/ByteArray.h b/WebCore/ForwardingHeaders/wtf/ByteArray.h
index f4f40dc..9c078c9 100644
--- a/WebCore/ForwardingHeaders/wtf/ByteArray.h
+++ b/WebCore/ForwardingHeaders/wtf/ByteArray.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ByteArray_h
+#define WebCore_FWD_ByteArray_h
 #include <JavaScriptCore/ByteArray.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/CrossThreadRefCounted.h b/WebCore/ForwardingHeaders/wtf/CrossThreadRefCounted.h
new file mode 100644
index 0000000..26987ef
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/CrossThreadRefCounted.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/CrossThreadRefCounted.h>
diff --git a/WebCore/ForwardingHeaders/wtf/CurrentTime.h b/WebCore/ForwardingHeaders/wtf/CurrentTime.h
index a31a23d..0070915 100644
--- a/WebCore/ForwardingHeaders/wtf/CurrentTime.h
+++ b/WebCore/ForwardingHeaders/wtf/CurrentTime.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_CurrentTime_h
+#define WebCore_FWD_CurrentTime_h
 #include <JavaScriptCore/CurrentTime.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/DateMath.h b/WebCore/ForwardingHeaders/wtf/DateMath.h
new file mode 100644
index 0000000..4135742
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/DateMath.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_DateMath_h
+#define WebCore_FWD_DateMath_h
+#include <JavaScriptCore/DateMath.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/Deque.h b/WebCore/ForwardingHeaders/wtf/Deque.h
index 81bd70a..a4eee78 100644
--- a/WebCore/ForwardingHeaders/wtf/Deque.h
+++ b/WebCore/ForwardingHeaders/wtf/Deque.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Deque_h
+#define WebCore_FWD_Deque_h
 #include <JavaScriptCore/Deque.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/DisallowCType.h b/WebCore/ForwardingHeaders/wtf/DisallowCType.h
index 445944b..c4d59ac 100644
--- a/WebCore/ForwardingHeaders/wtf/DisallowCType.h
+++ b/WebCore/ForwardingHeaders/wtf/DisallowCType.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_DisallowCType_h
+#define WebCore_FWD_DisallowCType_h
 #include <JavaScriptCore/DisallowCType.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/FastMalloc.h b/WebCore/ForwardingHeaders/wtf/FastMalloc.h
index 1701231..b883c0b 100644
--- a/WebCore/ForwardingHeaders/wtf/FastMalloc.h
+++ b/WebCore/ForwardingHeaders/wtf/FastMalloc.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_FastMalloc_h
+#define WebCore_FWD_FastMalloc_h
 #include <JavaScriptCore/FastMalloc.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/Forward.h b/WebCore/ForwardingHeaders/wtf/Forward.h
index 2d707ec..3e6b8c8 100644
--- a/WebCore/ForwardingHeaders/wtf/Forward.h
+++ b/WebCore/ForwardingHeaders/wtf/Forward.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Forward_h
+#define WebCore_FWD_Forward_h
 #include <JavaScriptCore/Forward.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/GetPtr.h b/WebCore/ForwardingHeaders/wtf/GetPtr.h
index aedd784..5a36ce2 100644
--- a/WebCore/ForwardingHeaders/wtf/GetPtr.h
+++ b/WebCore/ForwardingHeaders/wtf/GetPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_GetPtr_h
+#define WebCore_FWD_GetPtr_h
 #include <JavaScriptCore/GetPtr.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/HashCountedSet.h b/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
index 7388f5a..c92e9f0 100644
--- a/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
+++ b/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashCountedSet_h
+#define WebCore_FWD_HashCountedSet_h
 #include <JavaScriptCore/HashCountedSet.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/HashFunctions.h b/WebCore/ForwardingHeaders/wtf/HashFunctions.h
index 0fa568a..65e110d 100644
--- a/WebCore/ForwardingHeaders/wtf/HashFunctions.h
+++ b/WebCore/ForwardingHeaders/wtf/HashFunctions.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashFunctions_h
+#define WebCore_FWD_HashFunctions_h
 #include <JavaScriptCore/HashFunctions.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/HashMap.h b/WebCore/ForwardingHeaders/wtf/HashMap.h
index 9f262e2..68ea68e 100644
--- a/WebCore/ForwardingHeaders/wtf/HashMap.h
+++ b/WebCore/ForwardingHeaders/wtf/HashMap.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashMap_h
+#define WebCore_FWD_HashMap_h
 #include <JavaScriptCore/HashMap.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/HashSet.h b/WebCore/ForwardingHeaders/wtf/HashSet.h
index cfe2d80..a4cf32b 100644
--- a/WebCore/ForwardingHeaders/wtf/HashSet.h
+++ b/WebCore/ForwardingHeaders/wtf/HashSet.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashSet_h
+#define WebCore_FWD_HashSet_h
 #include <JavaScriptCore/HashSet.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/HashTable.h b/WebCore/ForwardingHeaders/wtf/HashTable.h
index a5e4d57..5975685 100644
--- a/WebCore/ForwardingHeaders/wtf/HashTable.h
+++ b/WebCore/ForwardingHeaders/wtf/HashTable.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashTable_h
+#define WebCore_FWD_HashTable_h
 #include <JavaScriptCore/HashTable.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/HashTraits.h b/WebCore/ForwardingHeaders/wtf/HashTraits.h
index 412fa98..3cf24cb 100644
--- a/WebCore/ForwardingHeaders/wtf/HashTraits.h
+++ b/WebCore/ForwardingHeaders/wtf/HashTraits.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashTraits_h
+#define WebCore_FWD_HashTraits_h
 #include <JavaScriptCore/HashTraits.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/ListHashSet.h b/WebCore/ForwardingHeaders/wtf/ListHashSet.h
index 4aef773..c528b78 100644
--- a/WebCore/ForwardingHeaders/wtf/ListHashSet.h
+++ b/WebCore/ForwardingHeaders/wtf/ListHashSet.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ListHashSet_h
+#define WebCore_FWD_ListHashSet_h
 #include <JavaScriptCore/ListHashSet.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/ListRefPtr.h b/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
index b766736..379adfb 100644
--- a/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
+++ b/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ListRefPtr_h
+#define WebCore_FWD_ListRefPtr_h
 #include <JavaScriptCore/ListRefPtr.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/Locker.h b/WebCore/ForwardingHeaders/wtf/Locker.h
index 75b0acd..4dbe13e 100644
--- a/WebCore/ForwardingHeaders/wtf/Locker.h
+++ b/WebCore/ForwardingHeaders/wtf/Locker.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Locker_h
+#define WebCore_FWD_Locker_h
 #include <JavaScriptCore/Locker.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/MainThread.h b/WebCore/ForwardingHeaders/wtf/MainThread.h
index ff75971..2d8e280 100644
--- a/WebCore/ForwardingHeaders/wtf/MainThread.h
+++ b/WebCore/ForwardingHeaders/wtf/MainThread.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_MainThread_h
+#define WebCore_FWD_MainThread_h
 #include <JavaScriptCore/MainThread.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/MathExtras.h b/WebCore/ForwardingHeaders/wtf/MathExtras.h
index 2955786..8594e64 100644
--- a/WebCore/ForwardingHeaders/wtf/MathExtras.h
+++ b/WebCore/ForwardingHeaders/wtf/MathExtras.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_MathExtras_h
+#define WebCore_FWD_MathExtras_h
 #include <JavaScriptCore/MathExtras.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/MessageQueue.h b/WebCore/ForwardingHeaders/wtf/MessageQueue.h
index 986cca5..c597e08 100644
--- a/WebCore/ForwardingHeaders/wtf/MessageQueue.h
+++ b/WebCore/ForwardingHeaders/wtf/MessageQueue.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_MessageQueue_h
+#define WebCore_FWD_MessageQueue_h
 #include <JavaScriptCore/MessageQueue.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/Noncopyable.h b/WebCore/ForwardingHeaders/wtf/Noncopyable.h
index f8484d2..c512677 100644
--- a/WebCore/ForwardingHeaders/wtf/Noncopyable.h
+++ b/WebCore/ForwardingHeaders/wtf/Noncopyable.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Noncopyable_h
+#define WebCore_FWD_Noncopyable_h
 #include <JavaScriptCore/Noncopyable.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/NotFound.h b/WebCore/ForwardingHeaders/wtf/NotFound.h
index cfe1896..1757683 100644
--- a/WebCore/ForwardingHeaders/wtf/NotFound.h
+++ b/WebCore/ForwardingHeaders/wtf/NotFound.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_NotFound_h
+#define WebCore_FWD_NotFound_h
 #include <JavaScriptCore/NotFound.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h b/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
index 595817d..7700641 100644
--- a/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
+++ b/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_OwnArrayPtr_h
+#define WebCore_FWD_OwnArrayPtr_h
 #include <JavaScriptCore/OwnArrayPtr.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/OwnFastMallocPtr.h b/WebCore/ForwardingHeaders/wtf/OwnFastMallocPtr.h
new file mode 100644
index 0000000..036d801
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/OwnFastMallocPtr.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/OwnFastMallocPtr.h>
diff --git a/WebCore/ForwardingHeaders/wtf/OwnPtr.h b/WebCore/ForwardingHeaders/wtf/OwnPtr.h
index 9211d38..977382d 100644
--- a/WebCore/ForwardingHeaders/wtf/OwnPtr.h
+++ b/WebCore/ForwardingHeaders/wtf/OwnPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_OwnPtr_h
+#define WebCore_FWD_OwnPtr_h
 #include <JavaScriptCore/OwnPtr.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h b/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h
new file mode 100644
index 0000000..5826031
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_PassOwnPtr_h
+#define WebCore_FWD_PassOwnPtr_h
+#include <JavaScriptCore/PassOwnPtr.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h b/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h
new file mode 100644
index 0000000..5826031
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_PassOwnPtr_h
+#define WebCore_FWD_PassOwnPtr_h
+#include <JavaScriptCore/PassOwnPtr.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/PassRefPtr.h b/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
index aafd1a2..ef57e5f 100644
--- a/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
+++ b/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_PassRefPtr_h
+#define WebCore_FWD_PassRefPtr_h
 #include <JavaScriptCore/PassRefPtr.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/Platform.h b/WebCore/ForwardingHeaders/wtf/Platform.h
index 3b22955..9f2bb3a 100644
--- a/WebCore/ForwardingHeaders/wtf/Platform.h
+++ b/WebCore/ForwardingHeaders/wtf/Platform.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Platform_h
+#define WebCore_FWD_Platform_h
 #include <JavaScriptCore/Platform.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h b/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
index 38bdfb4..bb6ed9a 100644
--- a/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
+++ b/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_PtrAndFlags_h
+#define WebCore_FWD_PtrAndFlags_h
 #include <JavaScriptCore/PtrAndFlags.h>
+#endif
+
diff --git a/WebCore/ForwardingHeaders/wtf/RandomNumber.h b/WebCore/ForwardingHeaders/wtf/RandomNumber.h
index 42e148a..cb156d2 100644
--- a/WebCore/ForwardingHeaders/wtf/RandomNumber.h
+++ b/WebCore/ForwardingHeaders/wtf/RandomNumber.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_RandomNumber_h
+#define WebCore_FWD_RandomNumber_h
 #include <JavaScriptCore/RandomNumber.h>
+#endif
+
diff --git a/WebCore/ForwardingHeaders/wtf/RefCounted.h b/WebCore/ForwardingHeaders/wtf/RefCounted.h
index 628a63b..c6b2dee 100644
--- a/WebCore/ForwardingHeaders/wtf/RefCounted.h
+++ b/WebCore/ForwardingHeaders/wtf/RefCounted.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_RefCounted_h
+#define WebCore_FWD_RefCounted_h
 #include <JavaScriptCore/RefCounted.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h b/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
index 3f229d1..2abe37e 100644
--- a/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
+++ b/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
@@ -1,2 +1,5 @@
+#ifndef WebCore_FWD_RefCountedLeakCounter_h
+#define WebCore_FWD_RefCountedLeakCounter_h
 #include <JavaScriptCore/RefCountedLeakCounter.h>
+#endif
 
diff --git a/WebCore/ForwardingHeaders/wtf/RefPtr.h b/WebCore/ForwardingHeaders/wtf/RefPtr.h
index 0ff6213..594929d 100644
--- a/WebCore/ForwardingHeaders/wtf/RefPtr.h
+++ b/WebCore/ForwardingHeaders/wtf/RefPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_RefPtr_h
+#define WebCore_FWD_RefPtr_h
 #include <JavaScriptCore/RefPtr.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/RetainPtr.h b/WebCore/ForwardingHeaders/wtf/RetainPtr.h
index 65fc27b..1352bd8 100644
--- a/WebCore/ForwardingHeaders/wtf/RetainPtr.h
+++ b/WebCore/ForwardingHeaders/wtf/RetainPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_RetainPtr_h
+#define WebCore_FWD_RetainPtr_h
 #include <JavaScriptCore/RetainPtr.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/StdLibExtras.h b/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
index 3222ec1..2003295 100644
--- a/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
+++ b/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StdLibExtras_h
+#define WebCore_FWD_StdLibExtras_h
 #include <JavaScriptCore/StdLibExtras.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/StringExtras.h b/WebCore/ForwardingHeaders/wtf/StringExtras.h
index 063d500..d89f238 100644
--- a/WebCore/ForwardingHeaders/wtf/StringExtras.h
+++ b/WebCore/ForwardingHeaders/wtf/StringExtras.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringExtras_h
+#define WebCore_FWD_StringExtras_h
 #include <JavaScriptCore/StringExtras.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h b/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
index 48f1db5..1e5474f 100644
--- a/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
+++ b/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ThreadSpecific_h
+#define WebCore_FWD_ThreadSpecific_h
 #include <JavaScriptCore/ThreadSpecific.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/Threading.h b/WebCore/ForwardingHeaders/wtf/Threading.h
index 17359e5..ad29847 100644
--- a/WebCore/ForwardingHeaders/wtf/Threading.h
+++ b/WebCore/ForwardingHeaders/wtf/Threading.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Threading_h
+#define WebCore_FWD_Threading_h
 #include <JavaScriptCore/Threading.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/TypeTraits.h b/WebCore/ForwardingHeaders/wtf/TypeTraits.h
index f82507e..a4ae09f 100644
--- a/WebCore/ForwardingHeaders/wtf/TypeTraits.h
+++ b/WebCore/ForwardingHeaders/wtf/TypeTraits.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_TypeTraits_h
+#define WebCore_FWD_TypeTraits_h
 #include <JavaScriptCore/TypeTraits.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/UnusedParam.h b/WebCore/ForwardingHeaders/wtf/UnusedParam.h
index aa3d3d0..5202740 100644
--- a/WebCore/ForwardingHeaders/wtf/UnusedParam.h
+++ b/WebCore/ForwardingHeaders/wtf/UnusedParam.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UnusedParam_h
+#define WebCore_FWD_UnusedParam_h
 #include <JavaScriptCore/UnusedParam.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/VMTags.h b/WebCore/ForwardingHeaders/wtf/VMTags.h
new file mode 100644
index 0000000..ffd1e12
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/VMTags.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_VMTags_h
+#define WebCore_FWD_VMTags_h
+#include <JavaScriptCore/VMTags.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/Vector.h b/WebCore/ForwardingHeaders/wtf/Vector.h
index c6d15fd..2c1cf7b 100644
--- a/WebCore/ForwardingHeaders/wtf/Vector.h
+++ b/WebCore/ForwardingHeaders/wtf/Vector.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Vector_h
+#define WebCore_FWD_Vector_h
 #include <JavaScriptCore/Vector.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/VectorTraits.h b/WebCore/ForwardingHeaders/wtf/VectorTraits.h
index 2fc1158..87a3822 100644
--- a/WebCore/ForwardingHeaders/wtf/VectorTraits.h
+++ b/WebCore/ForwardingHeaders/wtf/VectorTraits.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_VectorTraits_h
+#define WebCore_FWD_VectorTraits_h
 #include <JavaScriptCore/VectorTraits.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/dtoa.h b/WebCore/ForwardingHeaders/wtf/dtoa.h
index 887fdfa..7fd9265 100644
--- a/WebCore/ForwardingHeaders/wtf/dtoa.h
+++ b/WebCore/ForwardingHeaders/wtf/dtoa.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_dtoa_h
+#define WebCore_FWD_dtoa_h
 #include <JavaScriptCore/dtoa.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/unicode/Collator.h b/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
index 8f341a1..f28a117 100644
--- a/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
+++ b/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Collator_h
+#define WebCore_FWD_Collator_h
 #include <JavaScriptCore/Collator.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h b/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
index c7d9e92..b9daa43 100644
--- a/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
+++ b/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UTF8_h
+#define WebCore_FWD_UTF8_h
 #include <JavaScriptCore/UTF8.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h b/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
index 623917f..9f06747 100644
--- a/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
+++ b/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Unicode_h
+#define WebCore_FWD_Unicode_h
 #include <JavaScriptCore/Unicode.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h b/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
index 6b64eb5..4819f47 100644
--- a/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
+++ b/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UnicodeIcu_h
+#define WebCore_FWD_UnicodeIcu_h
 #include <JavaScriptCore/UnicodeIcu.h>
+#endif
diff --git a/WebCore/GNUmakefile.am b/WebCore/GNUmakefile.am
index 2a25e6a..151c01a 100644
--- a/WebCore/GNUmakefile.am
+++ b/WebCore/GNUmakefile.am
@@ -10,6 +10,7 @@
 
 webcore_cppflags += \
 	-I$(srcdir)/WebCore \
+	-I$(srcdir)/WebCore/accessibility \
 	-I$(srcdir)/WebCore/bindings/js \
 	-I$(srcdir)/WebCore/bridge \
 	-I$(srcdir)/WebCore/bridge/c \
@@ -44,14 +45,19 @@
 	-I$(srcdir)/WebCore/rendering/style \
 	-I$(srcdir)/WebCore/workers \
 	-I$(srcdir)/WebCore/xml \
-	-I$(top_builddir)/WebCore/bindings/js
+	-I$(top_builddir)/WebCore/bindings/js \
+	-DDATA_DIR=\"${datadir}\"
 
 webcoregtk_cppflags += \
+	-DWTF_USE_SOUP=1 \
+        -DENABLE_PLUGIN_PACKAGE_SIMPLE_HASH=1 \
+	-I$(srcdir)/WebCore/accessibility/gtk \
 	-I$(srcdir)/WebCore/loader/gtk \
 	-I$(srcdir)/WebCore/page/gtk \
 	-I$(srcdir)/WebCore/platform/graphics/cairo \
 	-I$(srcdir)/WebCore/platform/graphics/gtk \
-	-I$(srcdir)/WebCore/platform/gtk
+	-I$(srcdir)/WebCore/platform/gtk \
+	-I$(srcdir)/WebCore/platform/network/soup
 
 webcore_built_nosources += \
 	DerivedSources/DocTypeStrings.cpp \
@@ -152,6 +158,7 @@
 	WebCore/html/HTMLAnchorElement.idl \
 	WebCore/html/HTMLAppletElement.idl \
 	WebCore/html/HTMLAreaElement.idl \
+	WebCore/html/HTMLAudioElement.idl \
 	WebCore/html/HTMLBRElement.idl \
 	WebCore/html/HTMLBaseElement.idl \
 	WebCore/html/HTMLBaseFontElement.idl \
@@ -185,6 +192,8 @@
 	WebCore/html/HTMLLinkElement.idl \
 	WebCore/html/HTMLMapElement.idl \
 	WebCore/html/HTMLMarqueeElement.idl \
+	WebCore/html/HTMLMediaElement.idl \
+	WebCore/html/MediaError.idl \
 	WebCore/html/HTMLMenuElement.idl \
 	WebCore/html/HTMLMetaElement.idl \
 	WebCore/html/HTMLModElement.idl \
@@ -199,6 +208,7 @@
 	WebCore/html/HTMLQuoteElement.idl \
 	WebCore/html/HTMLScriptElement.idl \
 	WebCore/html/HTMLSelectElement.idl \
+	WebCore/html/HTMLSourceElement.idl \
 	WebCore/html/HTMLStyleElement.idl \
 	WebCore/html/HTMLTableCaptionElement.idl \
 	WebCore/html/HTMLTableCellElement.idl \
@@ -209,8 +219,10 @@
 	WebCore/html/HTMLTextAreaElement.idl \
 	WebCore/html/HTMLTitleElement.idl \
 	WebCore/html/HTMLUListElement.idl \
+	WebCore/html/HTMLVideoElement.idl \
 	WebCore/html/ImageData.idl \
 	WebCore/html/TextMetrics.idl \
+	WebCore/html/VoidCallback.idl \
 	WebCore/inspector/JavaScriptCallFrame.idl \
 	WebCore/inspector/InspectorController.idl \
 	WebCore/page/BarInfo.idl \
@@ -244,6 +256,36 @@
 
 webcore_sources += \
 	WebCore/WebCorePrefix.h \
+        WebCore/accessibility/AXObjectCache.cpp \
+	WebCore/accessibility/AXObjectCache.h \
+	WebCore/accessibility/AccessibilityARIAGrid.cpp \
+	WebCore/accessibility/AccessibilityARIAGrid.h \
+	WebCore/accessibility/AccessibilityARIAGridCell.cpp \
+	WebCore/accessibility/AccessibilityARIAGridCell.h \
+	WebCore/accessibility/AccessibilityARIAGridRow.cpp \
+	WebCore/accessibility/AccessibilityARIAGridRow.h \
+	WebCore/accessibility/AccessibilityImageMapLink.cpp \
+	WebCore/accessibility/AccessibilityImageMapLink.h \
+	WebCore/accessibility/AccessibilityList.cpp \
+	WebCore/accessibility/AccessibilityList.h \
+	WebCore/accessibility/AccessibilityListBox.cpp \
+	WebCore/accessibility/AccessibilityListBox.h \
+	WebCore/accessibility/AccessibilityListBoxOption.cpp \
+	WebCore/accessibility/AccessibilityListBoxOption.h \
+	WebCore/accessibility/AccessibilityObject.cpp \
+	WebCore/accessibility/AccessibilityObject.h \
+	WebCore/accessibility/AccessibilityRenderObject.cpp \
+	WebCore/accessibility/AccessibilityRenderObject.h \
+	WebCore/accessibility/AccessibilityTable.cpp \
+	WebCore/accessibility/AccessibilityTable.h \
+	WebCore/accessibility/AccessibilityTableCell.cpp \
+	WebCore/accessibility/AccessibilityTableCell.h \
+	WebCore/accessibility/AccessibilityTableColumn.cpp \
+	WebCore/accessibility/AccessibilityTableColumn.h \
+	WebCore/accessibility/AccessibilityTableHeaderContainer.cpp \
+	WebCore/accessibility/AccessibilityTableHeaderContainer.h \
+	WebCore/accessibility/AccessibilityTableRow.cpp \
+	WebCore/accessibility/AccessibilityTableRow.h \
 	WebCore/bindings/js/CachedScriptSourceProvider.h \
 	WebCore/bindings/js/GCController.cpp \
 	WebCore/bindings/js/GCController.h \
@@ -256,6 +298,7 @@
 	WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp \
 	WebCore/bindings/js/JSClipboardCustom.cpp \
 	WebCore/bindings/js/JSConsoleCustom.cpp \
+	WebCore/bindings/js/JSCoordinatesCustom.cpp \
 	WebCore/bindings/js/JSCustomPositionCallback.cpp \
 	WebCore/bindings/js/JSCustomPositionCallback.h \
 	WebCore/bindings/js/JSCustomPositionErrorCallback.cpp \
@@ -283,7 +326,6 @@
 	WebCore/bindings/js/JSEventListener.h \
 	WebCore/bindings/js/JSEventTarget.cpp \
 	WebCore/bindings/js/JSEventTarget.h \
-	WebCore/bindings/js/JSEventTargetBase.h \
 	WebCore/bindings/js/JSGeolocationCustom.cpp \
 	WebCore/bindings/js/JSHTMLAllCollection.cpp \
 	WebCore/bindings/js/JSHTMLAllCollection.h \
@@ -371,6 +413,8 @@
 	WebCore/bindings/js/ScriptCallStack.h \
 	WebCore/bindings/js/ScriptController.cpp \
 	WebCore/bindings/js/ScriptController.h \
+	WebCore/bindings/js/ScriptEventListener.cpp \
+	WebCore/bindings/js/ScriptEventListener.h \
 	WebCore/bindings/js/ScriptFunctionCall.cpp \
 	WebCore/bindings/js/ScriptFunctionCall.h \
 	WebCore/bindings/js/ScriptInstance.h \
@@ -379,6 +423,7 @@
 	WebCore/bindings/js/ScriptObjectQuarantine.cpp \
 	WebCore/bindings/js/ScriptObjectQuarantine.h \
 	WebCore/bindings/js/ScriptSourceCode.h \
+	WebCore/bindings/js/ScriptState.cpp \
 	WebCore/bindings/js/ScriptState.h \
 	WebCore/bindings/js/ScriptString.h \
 	WebCore/bindings/js/ScriptValue.cpp \
@@ -560,6 +605,8 @@
 	WebCore/dom/CSSMappedAttributeDeclaration.h \
 	WebCore/dom/CharacterData.cpp \
 	WebCore/dom/CharacterData.h \
+	WebCore/dom/CheckedRadioButtons.cpp \
+	WebCore/dom/CheckedRadioButtons.h \
 	WebCore/dom/ChildNodeList.cpp \
 	WebCore/dom/ChildNodeList.h \
 	WebCore/dom/ClassNames.cpp \
@@ -616,10 +663,6 @@
 	WebCore/dom/ExceptionBase.h \
 	WebCore/dom/ExceptionCode.cpp \
 	WebCore/dom/ExceptionCode.h \
-	WebCore/dom/FormControlElementWithState.cpp \
-	WebCore/dom/FormControlElementWithState.h \
-	WebCore/dom/FormControlElement.cpp \
-	WebCore/dom/FormControlElement.h \
 	WebCore/dom/InputElement.cpp \
 	WebCore/dom/InputElement.h \
 	WebCore/dom/KeyboardEvent.cpp \
@@ -633,6 +676,7 @@
 	WebCore/dom/MessageEvent.h \
 	WebCore/dom/MessagePort.cpp \
 	WebCore/dom/MessagePort.h \
+	WebCore/dom/MessagePortProxy.h \
 	WebCore/dom/MouseEvent.cpp \
 	WebCore/dom/MouseEvent.h \
 	WebCore/dom/MouseRelatedEvent.cpp \
@@ -686,6 +730,8 @@
 	WebCore/dom/ScriptElement.h \
 	WebCore/dom/ScriptExecutionContext.cpp \
 	WebCore/dom/ScriptExecutionContext.h \
+	WebCore/dom/SelectElement.cpp \
+	WebCore/dom/SelectElement.h \
 	WebCore/dom/SelectorNodeList.cpp \
 	WebCore/dom/SelectorNodeList.h \
 	WebCore/dom/StaticNodeList.cpp \
@@ -720,6 +766,8 @@
 	WebCore/dom/XMLTokenizer.cpp \
 	WebCore/dom/XMLTokenizer.h \
 	WebCore/dom/XMLTokenizerLibxml2.cpp \
+	WebCore/dom/XMLTokenizerScope.cpp \
+	WebCore/dom/XMLTokenizerScope.h \
 	WebCore/editing/AppendNodeCommand.cpp \
 	WebCore/editing/AppendNodeCommand.h \
 	WebCore/editing/ApplyStyleCommand.cpp \
@@ -780,6 +828,8 @@
 	WebCore/editing/RemoveNodeCommand.h \
 	WebCore/editing/RemoveNodePreservingChildrenCommand.cpp \
 	WebCore/editing/RemoveNodePreservingChildrenCommand.h \
+	WebCore/editing/ReplaceNodeWithSpanCommand.cpp \
+	WebCore/editing/ReplaceNodeWithSpanCommand.h \
 	WebCore/editing/ReplaceSelectionCommand.cpp \
 	WebCore/editing/ReplaceSelectionCommand.h \
 	WebCore/editing/SelectionController.cpp \
@@ -815,6 +865,7 @@
 	WebCore/editing/markup.h \
 	WebCore/editing/visible_units.cpp \
 	WebCore/editing/visible_units.h \
+	WebCore/editing/gtk/SelectionControllerGtk.cpp \
 	WebCore/history/BackForwardList.cpp \
 	WebCore/history/BackForwardList.h \
 	WebCore/history/CachedFrame.cpp \
@@ -836,6 +887,9 @@
 	WebCore/html/CanvasRenderingContext2D.h \
 	WebCore/html/CanvasStyle.cpp \
 	WebCore/html/CanvasStyle.h \
+	WebCore/html/CollectionCache.cpp \
+	WebCore/html/CollectionCache.h \
+	WebCore/html/CollectionType.h \
 	WebCore/html/File.cpp \
 	WebCore/html/File.h \
 	WebCore/html/FileList.cpp \
@@ -952,6 +1006,7 @@
 	WebCore/html/HTMLParser.h \
 	WebCore/html/HTMLParserErrorCodes.cpp \
 	WebCore/html/HTMLParserErrorCodes.h \
+	WebCore/html/HTMLParserQuirks.h \
 	WebCore/html/HTMLPlugInElement.cpp \
 	WebCore/html/HTMLPlugInElement.h \
 	WebCore/html/HTMLPlugInImageElement.cpp \
@@ -962,6 +1017,8 @@
 	WebCore/html/HTMLQuoteElement.h \
 	WebCore/html/HTMLScriptElement.cpp \
 	WebCore/html/HTMLScriptElement.h \
+	WebCore/html/HTMLNoScriptElement.cpp \
+	WebCore/html/HTMLNoScriptElement.h \
 	WebCore/html/HTMLSelectElement.cpp \
 	WebCore/html/HTMLSelectElement.h \
 	WebCore/html/HTMLStyleElement.cpp \
@@ -1035,6 +1092,8 @@
 	WebCore/inspector/InspectorClient.h \
 	WebCore/inspector/InspectorController.cpp \
 	WebCore/inspector/InspectorController.h \
+	WebCore/inspector/InspectorFrontend.cpp \
+	WebCore/inspector/InspectorFrontend.h \
 	WebCore/inspector/InspectorResource.cpp \
 	WebCore/inspector/InspectorResource.h \
 	WebCore/inspector/JavaScriptCallFrame.cpp \
@@ -1046,6 +1105,8 @@
 	WebCore/inspector/JavaScriptProfile.h \
 	WebCore/inspector/JavaScriptProfileNode.cpp \
 	WebCore/inspector/JavaScriptProfileNode.h \
+	WebCore/inspector/JSONObject.cpp \
+	WebCore/inspector/JSONObject.h \
 	WebCore/loader/Cache.cpp \
 	WebCore/loader/Cache.h \
 	WebCore/loader/CachePolicy.h \
@@ -1135,30 +1196,6 @@
 	WebCore/loader/icon/IconLoader.h \
 	WebCore/loader/loader.cpp \
 	WebCore/loader/loader.h \
-	WebCore/page/AXObjectCache.cpp \
-	WebCore/page/AXObjectCache.h \
-	WebCore/page/AccessibilityImageMapLink.cpp \
-	WebCore/page/AccessibilityImageMapLink.h \
-	WebCore/page/AccessibilityList.cpp \
-	WebCore/page/AccessibilityList.h \
-	WebCore/page/AccessibilityListBox.cpp \
-	WebCore/page/AccessibilityListBox.h \
-	WebCore/page/AccessibilityListBoxOption.cpp \
-	WebCore/page/AccessibilityListBoxOption.h \
-	WebCore/page/AccessibilityObject.cpp \
-	WebCore/page/AccessibilityObject.h \
-	WebCore/page/AccessibilityRenderObject.cpp \
-	WebCore/page/AccessibilityRenderObject.h \
-	WebCore/page/AccessibilityTable.cpp \
-	WebCore/page/AccessibilityTable.h \
-	WebCore/page/AccessibilityTableCell.cpp \
-	WebCore/page/AccessibilityTableCell.h \
-	WebCore/page/AccessibilityTableColumn.cpp \
-	WebCore/page/AccessibilityTableColumn.h \
-	WebCore/page/AccessibilityTableHeaderContainer.cpp \
-	WebCore/page/AccessibilityTableHeaderContainer.h \
-	WebCore/page/AccessibilityTableRow.cpp \
-	WebCore/page/AccessibilityTableRow.h \
 	WebCore/page/BarInfo.cpp \
 	WebCore/page/BarInfo.h \
 	WebCore/page/Chrome.cpp \
@@ -1212,6 +1249,8 @@
 	WebCore/page/Page.h \
 	WebCore/page/PageGroup.cpp \
 	WebCore/page/PageGroup.h \
+  WebCore/page/PageGroupLoadDeferrer.cpp \
+  WebCore/page/PageGroupLoadDeferrer.h \
 	WebCore/page/PositionCallback.h \
 	WebCore/page/PositionError.h \
 	WebCore/page/PositionErrorCallback.h \
@@ -1266,6 +1305,7 @@
 	WebCore/platform/GeolocationService.cpp \
 	WebCore/platform/GeolocationService.h \
 	WebCore/platform/HostWindow.h \
+	WebCore/platform/KeyboardCodes.h \
 	WebCore/platform/KURL.cpp \
 	WebCore/platform/KURL.h \
 	WebCore/platform/KURLHash.h \
@@ -1308,6 +1348,7 @@
 	WebCore/platform/SharedTimer.h \
 	WebCore/platform/Sound.h \
 	WebCore/platform/StaticConstructors.h \
+	WebCore/platform/SuddenTermination.h \
 	WebCore/platform/SystemTime.h \
 	WebCore/platform/ThemeTypes.h \
 	WebCore/platform/ThreadCheck.h \
@@ -1402,10 +1443,6 @@
 	WebCore/platform/graphics/UnitBezier.h \
 	WebCore/platform/graphics/WidthIterator.cpp \
 	WebCore/platform/graphics/WidthIterator.h \
-	WebCore/platform/graphics/filters/FEBlend.h \
-	WebCore/platform/graphics/filters/FEColorMatrix.h \
-	WebCore/platform/graphics/filters/FEComponentTransfer.h \
-	WebCore/platform/graphics/filters/FEComposite.h \
 	WebCore/platform/graphics/transforms/IdentityTransformOperation.h \
 	WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp \
 	WebCore/platform/graphics/transforms/MatrixTransformOperation.h \
@@ -1551,9 +1588,8 @@
 	WebCore/rendering/InlineTextBox.h \
 	WebCore/rendering/LayoutState.cpp \
 	WebCore/rendering/LayoutState.h \
-	WebCore/rendering/ListMarkerBox.cpp \
-	WebCore/rendering/ListMarkerBox.h \
 	WebCore/rendering/MediaControlElements.h \
+	WebCore/rendering/OverlapTestRequestClient.h \
 	WebCore/rendering/RenderApplet.cpp \
 	WebCore/rendering/RenderApplet.h \
 	WebCore/rendering/RenderArena.cpp \
@@ -1624,6 +1660,8 @@
 	WebCore/rendering/RenderSelectionInfo.h \
 	WebCore/rendering/RenderSlider.cpp \
 	WebCore/rendering/RenderSlider.h \
+	WebCore/rendering/RenderSVGModelObject.cpp \
+	WebCore/rendering/RenderSVGModelObject.h \
 	WebCore/rendering/RenderTable.cpp \
 	WebCore/rendering/RenderTable.h \
 	WebCore/rendering/RenderTableCell.cpp \
@@ -1745,11 +1783,18 @@
 	WebCore/plugins/gtk/xembed.h
 endif
 
+if TARGET_WIN32
+webcore_sources += \
+	WebCore/plugins/win/PluginDatabaseWin.cpp \
+	WebCore/plugins/win/PluginMessageThrottlerWin.cpp \
+	WebCore/plugins/win/PluginMessageThrottlerWin.h
+endif
+
 webcoregtk_sources += \
-	WebCore/page/gtk/AXObjectCacheAtk.cpp \
-	WebCore/page/gtk/AccessibilityObjectAtk.cpp \
-	WebCore/page/gtk/AccessibilityObjectWrapperAtk.cpp \
-	WebCore/page/gtk/AccessibilityObjectWrapperAtk.h \
+	WebCore/accessibility/gtk/AXObjectCacheAtk.cpp \
+	WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp \
+	WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp \
+	WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.h \
 	WebCore/page/gtk/DragControllerGtk.cpp \
 	WebCore/page/gtk/EventHandlerGtk.cpp \
 	WebCore/page/gtk/FrameGtk.cpp \
@@ -1785,9 +1830,10 @@
 	WebCore/platform/gtk/EventLoopGtk.cpp \
 	WebCore/platform/gtk/FileChooserGtk.cpp \
 	WebCore/platform/gtk/FileSystemGtk.cpp \
+	WebCore/platform/gtk/GtkPluginWidget.cpp \
+	WebCore/platform/gtk/GtkPluginWidget.h \
 	WebCore/platform/gtk/KURLGtk.cpp \
 	WebCore/platform/gtk/KeyEventGtk.cpp \
-	WebCore/platform/gtk/KeyboardCodes.h \
 	WebCore/platform/gtk/Language.cpp \
 	WebCore/platform/gtk/LocalizedStringsGtk.cpp \
 	WebCore/platform/gtk/LoggingGtk.cpp \
@@ -1813,8 +1859,6 @@
 	WebCore/platform/gtk/WidgetGtk.cpp \
 	WebCore/platform/gtk/gtk2drawing.c \
 	WebCore/platform/gtk/gtkdrawing.h \
-	WebCore/platform/gtk/guriescape.c \
-	WebCore/platform/gtk/guriescape.h \
 	WebCore/platform/image-decoders/ImageDecoder.h \
 	WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp \
 	WebCore/platform/image-decoders/bmp/BMPImageDecoder.h \
@@ -1830,26 +1874,16 @@
 	WebCore/platform/image-decoders/png/PNGImageDecoder.h \
 	WebCore/platform/image-decoders/xbm/XBMImageDecoder.cpp \
 	WebCore/platform/image-decoders/xbm/XBMImageDecoder.h \
-	WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp
-
-webcore_cppflags += \
-	-DWTF_USE_SOUP=1 \
-	-I$(srcdir)/WebCore/platform/network/soup
-
-webcore_sources += \
 	WebCore/platform/network/soup/AuthenticationChallenge.h \
 	WebCore/platform/network/soup/CookieJarSoup.cpp \
 	WebCore/platform/network/soup/CookieJarSoup.h \
 	WebCore/platform/network/soup/DNSSoup.cpp \
 	WebCore/platform/network/soup/ResourceError.h \
 	WebCore/platform/network/soup/ResourceHandleSoup.cpp \
+	WebCore/platform/network/soup/ResourceRequestSoup.cpp \
 	WebCore/platform/network/soup/ResourceRequest.h \
-	WebCore/platform/network/soup/ResourceResponse.h
-
-if USE_GNOMEKEYRING
-webcore_cppflags += \
-	-DWTF_USE_GNOMEKEYRING=1
-endif
+	WebCore/platform/network/soup/ResourceResponse.h \
+	WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp
 
 # ---
 # Freetype font backend
@@ -1880,6 +1914,17 @@
 endif # END USE_PANGO
 
 # ----
+# JavaScript Debugger/Profiler
+# ----
+if ENABLE_JAVASCRIPT_DEBUGGER
+FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
+
+webcore_cppflags += \
+	-DENABLE_JAVASCRIPT_DEBUGGER=1
+
+endif # END ENABLE_JAVASCRIPT_DEBUGGER
+
+# ----
 # Offline Web Applications
 # ----
 if ENABLE_OFFLINE_WEB_APPLICATIONS
@@ -1991,6 +2036,9 @@
 	WebCore/storage/SQLTransactionCallback.h \
 	WebCore/storage/SQLTransactionErrorCallback.h
 
+else
+webcore_cppflags += -DENABLE_DATABASE=0
+
 endif # END ENABLE_DATABASE
 
 # ----
@@ -2050,6 +2098,8 @@
 webcore_sources += \
 	WebCore/loader/icon/IconDatabaseNone.cpp
 
+webcore_cppflags += -DENABLE_ICONDATABASE=0
+
 endif # END ENABLE_ICONDATABASE
 
 # ----
@@ -2066,13 +2116,7 @@
 endif # END ENABLE_DEBUG
 
 IDL_BINDINGS += \
-	WebCore/html/HTMLAudioElement.idl \
-	WebCore/html/HTMLMediaElement.idl \
-	WebCore/html/HTMLSourceElement.idl \
-	WebCore/html/HTMLVideoElement.idl \
-	WebCore/html/MediaError.idl \
-	WebCore/html/TimeRanges.idl \
-	WebCore/html/VoidCallback.idl
+	WebCore/html/TimeRanges.idl
 
 webcore_sources += \
 	WebCore/bindings/js/JSAudioConstructor.cpp \
@@ -2101,6 +2145,10 @@
 	WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp \
 	WebCore/platform/graphics/gtk/VideoSinkGStreamer.h
 
+webcore_libadd += \
+	-lgstinterfaces-0.10 \
+	-lgstvideo-0.10
+
 endif # END ENABLE_VIDEO
 
 # ----
@@ -2223,6 +2271,7 @@
 	WebCore/workers/WorkerContext.cpp \
 	WebCore/workers/WorkerContext.h \
 	WebCore/workers/WorkerContextProxy.h \
+	WebCore/workers/WorkerLoaderProxy.h \
 	WebCore/workers/WorkerLocation.cpp \
 	WebCore/workers/WorkerLocation.h \
 	WebCore/workers/WorkerMessagingProxy.cpp \
@@ -2248,7 +2297,7 @@
 
 webcore_cppflags += \
 	-DENABLE_WML=1 \
-	-I\$(top_srcdir)/WebCore/wml
+	-I$(top_srcdir)/WebCore/wml
 
 webcore_sources += \
 	WebCore/wml/WMLAElement.cpp \
@@ -2280,6 +2329,7 @@
 	WebCore/wml/WMLPostfieldElement.cpp \
 	WebCore/wml/WMLPrevElement.cpp \
 	WebCore/wml/WMLRefreshElement.cpp \
+	WebCore/wml/WMLSelectElement.cpp \
 	WebCore/wml/WMLSetvarElement.cpp \
 	WebCore/wml/WMLTableElement.cpp \
 	WebCore/wml/WMLTaskElement.cpp \
@@ -2295,6 +2345,37 @@
 endif # END ENABLE_WML
 
 # ----
+# Filters
+# ----
+if ENABLE_FILTERS
+
+FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
+webcore_cppflags += -DENABLE_FILTERS=1
+
+webcore_sources += \
+	WebCore/platform/graphics/filters/FEBlend.cpp \
+	WebCore/platform/graphics/filters/FEBlend.h \
+	WebCore/platform/graphics/filters/FEColorMatrix.cpp \
+	WebCore/platform/graphics/filters/FEColorMatrix.h \
+	WebCore/platform/graphics/filters/FEComponentTransfer.cpp \
+	WebCore/platform/graphics/filters/FEComponentTransfer.h \
+	WebCore/platform/graphics/filters/FEComposite.cpp \
+	WebCore/platform/graphics/filters/FEComposite.h \
+	WebCore/platform/graphics/filters/Filter.h \
+	WebCore/platform/graphics/filters/FilterEffect.cpp \
+	WebCore/platform/graphics/filters/FilterEffect.h \
+	WebCore/platform/graphics/filters/SourceAlpha.cpp \
+	WebCore/platform/graphics/filters/SourceAlpha.h \
+	WebCore/platform/graphics/filters/SourceGraphic.cpp \
+	WebCore/platform/graphics/filters/SourceGraphic.h
+
+if ENABLE_SVG
+SVG_FEATURES += ENABLE_FILTERS=1
+endif
+
+endif # END ENABLE_FILTERS
+
+# ----
 # Geolocation
 # ----
 if ENABLE_GEOLOCATION
@@ -2320,9 +2401,6 @@
 WEBCORE_CSS_PROPERTY_NAMES += $(WebCore)/css/SVGCSSPropertyNames.in 
 WEBCORE_CSS_VALUE_KEYWORDS += $(WebCore)/css/SVGCSSValueKeywords.in
 
-webcoregtk_cppflags += \
-	-I$(srcdir)/WebCore/svg/graphics/cairo
-
 webcore_built_sources += \
 	DerivedSources/JSSVGElementWrapperFactory.cpp \
 	DerivedSources/SVGElementFactory.cpp \
@@ -2480,10 +2558,10 @@
 
 webcore_cppflags += \
 	-DENABLE_SVG=1 \
-	-I\$(top_srcdir)/WebCore/svg \
-	-I\$(top_srcdir)/WebCore/svg/animation \
-	-I\$(top_srcdir)/WebCore/svg/graphics \
-	-I\$(top_srcdir)/WebCore/svg/graphics/filters
+	-I$(top_srcdir)/WebCore/svg \
+	-I$(top_srcdir)/WebCore/svg/animation \
+	-I$(top_srcdir)/WebCore/svg/graphics \
+	-I$(top_srcdir)/WebCore/svg/graphics/filters
 
 webcore_sources += \
 	WebCore/bindings/js/JSSVGElementInstanceCustom.cpp \
@@ -2497,10 +2575,6 @@
 	WebCore/css/SVGCSSComputedStyleDeclaration.cpp \
 	WebCore/css/SVGCSSParser.cpp \
 	WebCore/css/SVGCSSStyleSelector.cpp \
-	WebCore/platform/graphics/filters/FEBlend.cpp \
-	WebCore/platform/graphics/filters/FEColorMatrix.cpp \
-	WebCore/platform/graphics/filters/FEComponentTransfer.cpp \
-	WebCore/platform/graphics/filters/FEComposite.cpp \
 	WebCore/rendering/PointerEventsHitRules.cpp \
 	WebCore/rendering/PointerEventsHitRules.h \
 	WebCore/rendering/RenderForeignObject.cpp \
@@ -2552,11 +2626,6 @@
 	WebCore/svg/ColorDistance.cpp \
 	WebCore/svg/ColorDistance.h \
 	WebCore/svg/ElementTimeControl.h \
-	WebCore/svg/Filter.cpp \
-	WebCore/svg/Filter.h \
-	WebCore/svg/FilterBuilder.h \
-	WebCore/svg/FilterEffect.cpp \
-	WebCore/svg/FilterEffect.h \
 	WebCore/svg/GradientAttributes.h \
 	WebCore/svg/LinearGradientAttributes.h \
 	WebCore/svg/PatternAttributes.h \
@@ -2886,17 +2955,15 @@
 	WebCore/svg/graphics/filters/SVGFETile.h \
 	WebCore/svg/graphics/filters/SVGFETurbulence.cpp \
 	WebCore/svg/graphics/filters/SVGFETurbulence.h \
-	WebCore/svg/graphics/filters/SVGFilterEffect.cpp \
-	WebCore/svg/graphics/filters/SVGFilterEffect.h \
+	WebCore/svg/graphics/filters/SVGFilter.cpp \
+	WebCore/svg/graphics/filters/SVGFilter.h \
+	WebCore/svg/graphics/filters/SVGFilterBuilder.h \
+	WebCore/svg/graphics/filters/SVGFilterBuilder.cpp \
 	WebCore/svg/graphics/filters/SVGLightSource.cpp \
 	WebCore/svg/graphics/filters/SVGLightSource.h \
 	WebCore/svg/graphics/filters/SVGPointLightSource.h \
 	WebCore/svg/graphics/filters/SVGSpotLightSource.h
 
-webcoregtk_sources += \
-	WebCore/svg/graphics/cairo/SVGResourceFilterCairo.cpp
-
-
 # SVG Features
 if ENABLE_SVG_USE
 FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG_USE=1
@@ -2916,12 +2983,6 @@
 webcore_cppflags += -DENABLE_SVG_FONTS=1
 endif
 
-if ENABLE_SVG_FILTERS
-FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG_FILTERS=1
-SVG_FEATURES += ENABLE_SVG_FILTERS=1
-webcore_cppflags += -DENABLE_SVG_FILTERS=1
-endif
-
 if ENABLE_SVG_AS_IMAGE
 FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG_AS_IMAGE=1
 SVG_FEATURES += ENABLE_SVG_AS_IMAGE=1
@@ -3156,16 +3217,24 @@
 	WebCore/xml/XPathGrammar.y
 
 # Installing web inspector files
-webcore_cppflags += -DDATA_DIR=\"${datadir}\"
-
 webinspectordir = ${datadir}/webkit-1.0/webinspector
 dist_webinspector_DATA = \
+	$(WebCore)/English.lproj/localizedStrings.js \
 	$(shell ls $(WebCore)/inspector/front-end/*.{js,html,css})
 
 webinspectorimagesdir = ${datadir}/webkit-1.0/webinspector/Images
 dist_webinspectorimages_DATA = \
 	$(shell ls $(WebCore)/inspector/front-end/Images/*.png)
 
+webresourcesdir = ${datadir}/webkit-1.0/images
+dist_webresources_DATA = \
+	$(WebCore)/Resources/textAreaResizeCorner.png \
+	$(WebCore)/Resources/nullPlugin.png \
+	$(WebCore)/Resources/urlIcon.png \
+	$(WebCore)/Resources/missingImage.png \
+	$(WebCore)/Resources/panIcon.png \
+	$(WebCore)/Resources/deleteButton.png
+
 # Clean rules for WebCore
 
 CLEANFILES += \
diff --git a/WebCore/Resources/panIcon.png b/WebCore/Resources/panIcon.png
new file mode 100644
index 0000000..4ca8d70
--- /dev/null
+++ b/WebCore/Resources/panIcon.png
Binary files differ
diff --git a/WebCore/WebCore.NPAPI.exp b/WebCore/WebCore.NPAPI.exp
index 9eb8056..d487ade 100644
--- a/WebCore/WebCore.NPAPI.exp
+++ b/WebCore/WebCore.NPAPI.exp
@@ -21,5 +21,10 @@
 __NPN_UTF8FromIdentifier
 __ZN7WebCore16ScriptController20windowScriptNPObjectEv
 __ZN7WebCore16ScriptController29cleanupScriptObjectsForPluginEPv
-__ZNK7WebCore9FrameView22windowClipRectForLayerEPKNS_11RenderLayerEb
+__ZN7WebCore6String8fromUTF8EPKc
+__ZN7WebCoreplERKNS_6StringEPKc
 __ZNK7WebCore12RenderObject4viewEv
+__ZNK7WebCore14SecurityOrigin9canAccessEPKS0_
+__ZNK7WebCore4KURL7hasPathEv
+__ZNK7WebCore4KURL9prettyURLEv
+__ZNK7WebCore9FrameView22windowClipRectForLayerEPKNS_11RenderLayerEb
diff --git a/WebCore/WebCore.base.exp b/WebCore/WebCore.base.exp
index 65fffc1..1ce477e 100644
--- a/WebCore/WebCore.base.exp
+++ b/WebCore/WebCore.base.exp
@@ -107,6 +107,7 @@
 .objc_class_name_DOMWheelEvent
 .objc_class_name_WebCoreKeyGenerator
 .objc_class_name_WebCoreViewFactory
+.objc_class_name_WebFontCache
 .objc_class_name_WebScriptObject
 .objc_class_name_WebScriptObjectPrivate
 .objc_class_name_WebUndefined
@@ -114,16 +115,24 @@
 _DOMException
 _DOMRangeException
 _DOMXPathException
-_WebCoreAlwaysUsesComplexTextCodePath
-_WebCoreDrawTextAtPoint
-_WebCoreFindFont
 _WebCoreObjCFinalizeOnMainThread
 _WebCoreObjCScheduleDeallocateOnMainThread
-_WebCoreSetAlwaysUsesComplexTextCodePath
-_WebCoreSetShouldUseFontSmoothing
-_WebCoreShouldUseFontSmoothing
-_WebCoreTextFloatWidth
 __Z26ReportBlockedObjCExceptionP11NSException
+__Z3kitPN7WebCore11HTMLElementE
+__Z3kitPN7WebCore16DocumentFragmentE
+__Z3kitPN7WebCore16HTMLInputElementE
+__Z3kitPN7WebCore19CSSStyleDeclarationE
+__Z3kitPN7WebCore19HTMLTextAreaElementE
+__Z3kitPN7WebCore4NodeE
+__Z3kitPN7WebCore5RangeE
+__Z3kitPN7WebCore7ElementE
+__Z3kitPN7WebCore8DocumentE
+__Z4coreP10DOMElement
+__Z4coreP11DOMDocument
+__Z4coreP19DOMDocumentFragment
+__Z4coreP22DOMCSSStyleDeclaration
+__Z4coreP7DOMNode
+__Z4coreP8DOMRange
 __ZN7WebCore10MouseEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9ClipboardEEEb
 __ZN7WebCore10ScrollView17setScrollbarModesENS_13ScrollbarModeES1_
 __ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
@@ -134,6 +143,7 @@
 __ZN7WebCore10StringImplcvP8NSStringEv
 __ZN7WebCore10StringImpldlEPv
 __ZN7WebCore10handCursorEv
+__ZN7WebCore10setCookiesEPNS_8DocumentERKNS_4KURLERKNS_6StringE
 __ZN7WebCore11CachedFrame23cachedFramePlatformDataEv
 __ZN7WebCore11CachedFrame26setCachedFramePlatformDataEPNS_23CachedFramePlatformDataE
 __ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
@@ -152,20 +162,18 @@
 __ZN7WebCore11FrameLoader14scrollToAnchorERKNS_4KURLE
 __ZN7WebCore11FrameLoader14stopAllLoadersENS_14DatabasePolicyE
 __ZN7WebCore11FrameLoader16detachFromParentEv
+__ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEE
 __ZN7WebCore11FrameLoader17stopForUserCancelEb
 __ZN7WebCore11FrameLoader18currentHistoryItemEv
 __ZN7WebCore11FrameLoader18setLocalLoadPolicyENS0_15LocalLoadPolicyE
 __ZN7WebCore11FrameLoader18shouldHideReferrerERKNS_4KURLERKNS_6StringE
-__ZN7WebCore11FrameLoader20continueLoadWithDataEPNS_12SharedBufferERKNS_6StringES5_RKNS_4KURLE
 __ZN7WebCore11FrameLoader21loadURLIntoChildFrameERKNS_4KURLERKNS_6StringEPNS_5FrameE
 __ZN7WebCore11FrameLoader21setCurrentHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
 __ZN7WebCore11FrameLoader22findFrameForNavigationERKNS_12AtomicStringE
 __ZN7WebCore11FrameLoader23timeOfLastCompletedLoadEv
 __ZN7WebCore11FrameLoader24registerURLSchemeAsLocalERKNS_6StringE
-__ZN7WebCore11FrameLoader25setProvisionalHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
 __ZN7WebCore11FrameLoader26reloadWithOverrideEncodingERKNS_6StringE
 __ZN7WebCore11FrameLoader26saveDocumentAndScrollStateEv
-__ZN7WebCore11FrameLoader33loadFrameRequestWithFormAndValuesERKNS_16FrameLoadRequestEbbPNS_5EventEPNS_15HTMLFormElementERKN3WTF7HashMapINS_6StringESA_NS_10StringHashENS8_10HashTraitsISA_EESD_EE
 __ZN7WebCore11FrameLoader36saveScrollPositionAndViewStateToItemEPNS_11HistoryItemE
 __ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_14SubstituteDataEb
 __ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_6StringEb
@@ -174,6 +182,7 @@
 __ZN7WebCore11FrameLoader7addDataEPKci
 __ZN7WebCore11FrameLoader7canLoadERKNS_4KURLERKNS_6StringEPKNS_8DocumentE
 __ZN7WebCore11Geolocation12setIsAllowedEb
+__ZN7WebCore11HistoryItem10targetItemEv
 __ZN7WebCore11HistoryItem11setReferrerERKNS_6StringE
 __ZN7WebCore11HistoryItem12addChildItemEN3WTF10PassRefPtrIS0_EE
 __ZN7WebCore11HistoryItem12setURLStringERKNS_6StringE
@@ -182,7 +191,7 @@
 __ZN7WebCore11HistoryItem14addRedirectURLERKNS_6StringE
 __ZN7WebCore11HistoryItem14setScrollPointERKNS_8IntPointE
 __ZN7WebCore11HistoryItem15setIsTargetItemEb
-__ZN7WebCore11HistoryItem15setRedirectURLsESt8auto_ptrIN3WTF6VectorINS_6StringELm0EEEE
+__ZN7WebCore11HistoryItem15setRedirectURLsEN3WTF10PassOwnPtrINS1_6VectorINS_6StringELm0EEEEE
 __ZN7WebCore11HistoryItem16adoptVisitCountsERN3WTF6VectorIiLm0EEES4_
 __ZN7WebCore11HistoryItem17setAlternateTitleERKNS_6StringE
 __ZN7WebCore11HistoryItem18recordInitialVisitEv
@@ -190,13 +199,11 @@
 __ZN7WebCore11HistoryItem20setOriginalURLStringERKNS_6StringE
 __ZN7WebCore11HistoryItem20setTransientPropertyERKNS_6StringEP11objc_object
 __ZN7WebCore11HistoryItem22mergeAutoCompleteHintsEPS0_
-__ZN7WebCore11HistoryItem23recurseToFindTargetItemEv
 __ZN7WebCore11HistoryItem6setURLERKNS_4KURLE
 __ZN7WebCore11HistoryItem7visitedERKNS_6StringEd
 __ZN7WebCore11HistoryItem8formDataEv
 __ZN7WebCore11HistoryItem8setTitleERKNS_6StringE
 __ZN7WebCore11HistoryItem9setParentERKNS_6StringE
-__ZN7WebCore11HistoryItem9setTargetERKNS_6StringE
 __ZN7WebCore11HistoryItemC1ERKNS_4KURLERKNS_6StringES6_S6_
 __ZN7WebCore11HistoryItemC1ERKNS_6StringES3_S3_d
 __ZN7WebCore11HistoryItemC1ERKNS_6StringES3_d
@@ -219,11 +226,11 @@
 __ZN7WebCore12EventHandler15sendScrollEventEv
 __ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
 __ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
+__ZN7WebCore12EventHandler17eventMayStartDragEP7NSEvent
 __ZN7WebCore12EventHandler20handleTextInputEventERKNS_6StringEPNS_5EventEbb
 __ZN7WebCore12EventHandler20hitTestResultAtPointERKNS_8IntPointEbb
-__ZN7WebCore12EventHandler20sendContextMenuEventERKNS_18PlatformMouseEventE
+__ZN7WebCore12EventHandler20sendContextMenuEventEP7NSEvent
 __ZN7WebCore12EventHandler27capsLockStateMayHaveChangedEv
-__ZN7WebCore12EventHandler28pendingFrameUnloadEventCountEv
 __ZN7WebCore12EventHandler7mouseUpEP7NSEvent
 __ZN7WebCore12EventHandler8keyEventEP7NSEvent
 __ZN7WebCore12EventHandler8keyEventERKNS_21PlatformKeyboardEventE
@@ -298,6 +305,7 @@
 __ZN7WebCore14DragController14placeDragCaretERKNS_8IntPointE
 __ZN7WebCore14DragController9dragEndedEv
 __ZN7WebCore14ResourceHandle12releaseProxyEv
+__ZN7WebCore14ResourceHandle20forceContentSniffingEv
 __ZN7WebCore14ResourceLoader14cancelledErrorEv
 __ZN7WebCore14ResourceLoader19setShouldBufferDataEb
 __ZN7WebCore14SecurityOrigin6createERKNS_4KURLE
@@ -342,6 +350,7 @@
 __ZN7WebCore15FocusController15setInitialFocusENS_14FocusDirectionEPNS_13KeyboardEventE
 __ZN7WebCore15FocusController18focusedOrMainFrameEv
 __ZN7WebCore15FocusController9setActiveEb
+__ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorE
 __ZN7WebCore15GraphicsContextC1EP9CGContext
 __ZN7WebCore15GraphicsContextD1Ev
 __ZN7WebCore15JSDOMWindowBase18commonJSGlobalDataEv
@@ -382,7 +391,6 @@
 __ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
 __ZN7WebCore17GlyphPageTreeNode18treeGlyphPageCountEv
 __ZN7WebCore17equalIgnoringCaseEPNS_10StringImplES1_
-__ZN7WebCore18PlatformMouseEventC1EP7NSEvent
 __ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
 __ZN7WebCore19AnimationController20pauseAnimationAtTimeEPNS_12RenderObjectERKNS_6StringEd
 __ZN7WebCore19AnimationController21pauseTransitionAtTimeEPNS_12RenderObjectERKNS_6StringEd
@@ -390,9 +398,9 @@
 __ZN7WebCore19InspectorController12attachWindowEv
 __ZN7WebCore19InspectorController12detachWindowEv
 __ZN7WebCore19InspectorController14enableDebuggerEv
-__ZN7WebCore19InspectorController14enableProfilerEb
-__ZN7WebCore19InspectorController15disableDebuggerEv
-__ZN7WebCore19InspectorController15disableProfilerEv
+__ZN7WebCore19InspectorController14enableProfilerEbb
+__ZN7WebCore19InspectorController15disableDebuggerEb
+__ZN7WebCore19InspectorController15disableProfilerEb
 __ZN7WebCore19InspectorController16setWindowVisibleEbb
 __ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
 __ZN7WebCore19InspectorController27startUserInitiatedProfilingEPNS_5TimerIS0_EE
@@ -411,7 +419,9 @@
 __ZN7WebCore19TextResourceDecoder6decodeEPKcm
 __ZN7WebCore19TextResourceDecoderC1ERKNS_6StringERKNS_12TextEncodingEb
 __ZN7WebCore19TextResourceDecoderD1Ev
+__ZN7WebCore19applicationIsSafariEv
 __ZN7WebCore20ResourceResponseBase24setExpectedContentLengthEx
+__ZN7WebCore20ResourceResponseBaseC2Ev
 __ZN7WebCore21ContextMenuController16clearContextMenuEv
 __ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
 __ZN7WebCore21JavaScriptDebugServer6sharedEv
@@ -421,6 +431,7 @@
 __ZN7WebCore21findEventWithKeyStateEPNS_5EventE
 __ZN7WebCore21isBackForwardLoadTypeENS_13FrameLoadTypeE
 __ZN7WebCore21reportThreadViolationEPKcNS_20ThreadViolationRoundE
+__ZN7WebCore22applicationIsAppleMailEv
 __ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
 __ZN7WebCore22externalRepresentationEPNS_12RenderObjectE
 __ZN7WebCore23ApplicationCacheStorage16storeCopyOfCacheERKNS_6StringEPNS_16ApplicationCacheE
@@ -428,10 +439,17 @@
 __ZN7WebCore23ApplicationCacheStorage5emptyEv
 __ZN7WebCore23ReplaceSelectionCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
 __ZN7WebCore23createFragmentFromNodesEPNS_8DocumentERKN3WTF6VectorIPNS_4NodeELm0EEE
+__ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
+__ZN7WebCore24WebCoreCredentialStorage9m_storageE
 __ZN7WebCore24createFragmentFromMarkupEPNS_8DocumentERKNS_6StringES4_
 __ZN7WebCore24decodeURLEscapeSequencesERKNS_6StringE
 __ZN7WebCore24notifyHistoryItemChangedE
 __ZN7WebCore24rangeCompliantEquivalentERKNS_8PositionE
+__ZN7WebCore25HistoryPropertyListWriter11releaseDataEv
+__ZN7WebCore25HistoryPropertyListWriter12writeObjectsERNS_30BinaryPropertyListObjectStreamE
+__ZN7WebCore25HistoryPropertyListWriter16writeHistoryItemERNS_30BinaryPropertyListObjectStreamEPNS_11HistoryItemE
+__ZN7WebCore25HistoryPropertyListWriter6bufferEm
+__ZN7WebCore25HistoryPropertyListWriterC2Ev
 __ZN7WebCore25PluginMainThreadScheduler12scheduleCallEP4_NPPPFvPvES3_
 __ZN7WebCore25PluginMainThreadScheduler14registerPluginEP4_NPP
 __ZN7WebCore25PluginMainThreadScheduler16unregisterPluginEP4_NPP
@@ -447,6 +465,9 @@
 __ZN7WebCore33setDefaultThreadViolationBehaviorENS_23ThreadViolationBehaviorENS_20ThreadViolationRoundE
 __ZN7WebCore36InitializeLoggingChannelsIfNecessaryEv
 __ZN7WebCore3macERKNS_23AuthenticationChallengeE
+__ZN7WebCore4Font11setCodePathENS0_8CodePathE
+__ZN7WebCore4Font18shouldUseSmoothingEv
+__ZN7WebCore4Font21setShouldUseSmoothingEb
 __ZN7WebCore4FontC1ERKNS_16FontPlatformDataEb
 __ZN7WebCore4FontC1Ev
 __ZN7WebCore4FontD1Ev
@@ -465,7 +486,7 @@
 __ZN7WebCore4Page17willMoveOffscreenEv
 __ZN7WebCore4Page18removeSchedulePairEN3WTF10PassRefPtrINS_12SchedulePairEEE
 __ZN7WebCore4Page23clearUndoRedoOperationsEv
-__ZN7WebCore4Page23pendingUnloadEventCountEv
+__ZN7WebCore4Page27setJavaScriptURLsAreAllowedEb
 __ZN7WebCore4Page31setCustomHTMLTokenizerChunkSizeEi
 __ZN7WebCore4Page31setCustomHTMLTokenizerTimeDelayEd
 __ZN7WebCore4Page32setMemoryCacheClientCallsEnabledEb
@@ -480,7 +501,7 @@
 __ZN7WebCore5Cache13getStatisticsEv
 __ZN7WebCore5Cache13setCapacitiesEjjj
 __ZN7WebCore5Frame10findStringERKNS_6StringEbbbb
-__ZN7WebCore5Frame11shouldCloseEv
+__ZN7WebCore5Frame11shouldCloseEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
 __ZN7WebCore5Frame13reapplyStylesEv
 __ZN7WebCore5Frame13setZoomFactorEfb
 __ZN7WebCore5Frame14frameForWidgetEPKNS_6WidgetE
@@ -497,7 +518,7 @@
 __ZN7WebCore5Frame34setMarkedTextMatchesAreHighlightedEb
 __ZN7WebCore5Frame4initEv
 __ZN7WebCore5Frame6scriptEv
-__ZN7WebCore5Frame7setViewEPNS_9FrameViewE
+__ZN7WebCore5Frame7setViewEN3WTF10PassRefPtrINS_9FrameViewEEE
 __ZN7WebCore5FrameC1EPNS_4PageEPNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
 __ZN7WebCore5FrameD1Ev
 __ZN7WebCore5Image12supportsTypeERKNS_6StringE
@@ -547,8 +568,12 @@
 __ZN7WebCore6Editor7commandERKNS_6StringENS_19EditorCommandSourceE
 __ZN7WebCore6Editor7copyURLERKNS_4KURLERKNS_6StringE
 __ZN7WebCore6Editor7outdentEv
+__ZN7WebCore6Loader20servePendingRequestsENS0_8PriorityE
 __ZN7WebCore6String6appendERKS0_
 __ZN7WebCore6String6appendEc
+__ZN7WebCore6String6numberEi
+__ZN7WebCore6String6numberEl
+__ZN7WebCore6String8fromUTF8EPKcm
 __ZN7WebCore6StringC1EP8NSString
 __ZN7WebCore6StringC1EPK10__CFString
 __ZN7WebCore6StringC1EPKc
@@ -566,13 +591,16 @@
 __ZN7WebCore6WidgetC1EP6NSView
 __ZN7WebCore6WidgetC2EP6NSView
 __ZN7WebCore6WidgetD2Ev
+__ZN7WebCore7CStringC1EPKc
 __ZN7WebCore7Console21shouldPrintExceptionsEv
 __ZN7WebCore7Console24setShouldPrintExceptionsEb
 __ZN7WebCore7IntSizeC1ERK7_NSSize
+__ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
 __ZN7WebCore7nsColorERKNS_5ColorE
 __ZN7WebCore8Document11createRangeEv
 __ZN7WebCore8Document13removeMarkersENS_14DocumentMarker10MarkerTypeE
 __ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore8Document17getFocusableNodesERN3WTF6VectorINS1_6RefPtrINS_4NodeEEELm0EEE
 __ZN7WebCore8Document22createDocumentFragmentEv
 __ZN7WebCore8Document23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
 __ZN7WebCore8Document24setShouldCreateRenderersEb
@@ -581,6 +609,7 @@
 __ZN7WebCore8DragDataC1EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
 __ZN7WebCore8FormDataD1Ev
 __ZN7WebCore8IntPointC1ERK8_NSPoint
+__ZN7WebCore8PositionC1EN3WTF10PassRefPtrINS_4NodeEEEi
 __ZN7WebCore8Settings14setJavaEnabledEb
 __ZN7WebCore8Settings16setUsesPageCacheEb
 __ZN7WebCore8Settings16setZoomsTextOnlyEb
@@ -621,6 +650,7 @@
 __ZN7WebCore8Settings29setWebArchiveDebugModeEnabledEb
 __ZN7WebCore8Settings31setShrinksStandaloneImagesToFitEb
 __ZN7WebCore8Settings32setNeedsAdobeFrameReloadingQuirkEb
+__ZN7WebCore8Settings33setDownloadableBinaryFontsEnabledEb
 __ZN7WebCore8Settings33setEnforceCSSMIMETypeInStrictModeEb
 __ZN7WebCore8Settings35setAllowUniversalAccessFromFileURLsEb
 __ZN7WebCore8Settings36setOfflineWebApplicationCacheEnabledEb
@@ -628,7 +658,10 @@
 __ZN7WebCore8Settings40setTextDirectionSubmenuInclusionBehaviorENS_37TextDirectionSubmenuInclusionBehaviorE
 __ZN7WebCore8Settings41setNeedsKeyboardEventDisambiguationQuirksEb
 __ZN7WebCore8blankURLEv
+__ZN7WebCore8makeRGBAEiiii
 __ZN7WebCore8parseURLERKNS_6StringE
+__ZN7WebCore9DOMWindow30dispatchAllPendingUnloadEventsEv
+__ZN7WebCore9DOMWindow36dispatchAllPendingBeforeUnloadEventsEv
 __ZN7WebCore9FloatRectC1ERK7_NSRect
 __ZN7WebCore9FontCache13fontDataCountEv
 __ZN7WebCore9FontCache21inactiveFontDataCountEv
@@ -641,6 +674,7 @@
 __ZN7WebCore9FrameView14adjustViewSizeEv
 __ZN7WebCore9FrameView14initScrollbarsEv
 __ZN7WebCore9FrameView14setMarginWidthEi
+__ZN7WebCore9FrameView14setNeedsLayoutEv
 __ZN7WebCore9FrameView14setTransparentEb
 __ZN7WebCore9FrameView15setMarginHeightEi
 __ZN7WebCore9FrameView16adjustPageHeightEPffff
@@ -649,9 +683,10 @@
 __ZN7WebCore9FrameView23layoutIfNeededRecursiveEv
 __ZN7WebCore9FrameView29forceLayoutWithPageWidthRangeEffb
 __ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
-__ZN7WebCore9FrameViewC1EPNS_5FrameE
-__ZN7WebCore9FrameViewC1EPNS_5FrameERKNS_7IntSizeE
+__ZN7WebCore9FrameView6createEPNS_5FrameE
+__ZN7WebCore9FrameView6createEPNS_5FrameERKNS_7IntSizeE
 __ZN7WebCore9HTMLNames10listingTagE
+__ZN7WebCore9HTMLNames11textareaTagE
 __ZN7WebCore9HTMLNames13blockquoteTagE
 __ZN7WebCore9HTMLNames4aTagE
 __ZN7WebCore9HTMLNames4initEv
@@ -698,6 +733,7 @@
 __ZN7WebCore9pageCacheEv
 __ZN7WebCoreeqERKNS_12AtomicStringEPKc
 __ZN7WebCoreeqERKNS_19ResourceRequestBaseES2_
+__ZN7WebCoreplEPKcRKNS_6StringE
 __ZN7WebCoreplERKNS_6StringES2_
 __ZNK3JSC8Bindings10RootObject12globalObjectEv
 __ZNK7WebCore10FloatPointcv8_NSPointEv
@@ -717,7 +753,6 @@
 __ZNK7WebCore11FrameLoader16outgoingReferrerEv
 __ZNK7WebCore11FrameLoader16responseMIMETypeEv
 __ZNK7WebCore11FrameLoader20activeDocumentLoaderEv
-__ZNK7WebCore11FrameLoader21isQuickRedirectComingEv
 __ZNK7WebCore11FrameLoader27numPendingOrLoadingRequestsEb
 __ZNK7WebCore11FrameLoader8loadTypeEv
 __ZNK7WebCore11HistoryItem10visitCountEv
@@ -727,7 +762,6 @@
 __ZNK7WebCore11HistoryItem12redirectURLsEv
 __ZNK7WebCore11HistoryItem14alternateTitleEv
 __ZNK7WebCore11HistoryItem15lastVisitedTimeEv
-__ZNK7WebCore11HistoryItem17childItemWithNameERKNS_6StringE
 __ZNK7WebCore11HistoryItem17originalURLStringEv
 __ZNK7WebCore11HistoryItem20getTransientPropertyERKNS_6StringE
 __ZNK7WebCore11HistoryItem3urlEv
@@ -739,7 +773,6 @@
 __ZNK7WebCore11HistoryItem8referrerEv
 __ZNK7WebCore11HistoryItem9urlStringEv
 __ZNK7WebCore11HistoryItem9viewStateEv
-__ZNK7WebCore12EventHandler17eventMayStartDragERKNS_18PlatformMouseEventE
 __ZNK7WebCore12EventHandler20currentKeyboardEventEv
 __ZNK7WebCore12IconDatabase12databasePathEv
 __ZNK7WebCore12IconDatabase24shouldStopThreadActivityEv
@@ -799,6 +832,7 @@
 __ZNK7WebCore16VisibleSelection17toNormalizedRangeEv
 __ZNK7WebCore16VisibleSelection19rootEditableElementEv
 __ZNK7WebCore16VisibleSelection23isContentRichlyEditableEv
+__ZNK7WebCore16VisibleSelection5isAllENS_21StayInEditableContentE
 __ZNK7WebCore17ResourceErrorBase8lazyInitEv
 __ZNK7WebCore19AnimationController24numberOfActiveAnimationsEv
 __ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
@@ -815,7 +849,9 @@
 __ZNK7WebCore20ResourceResponseBase3urlEv
 __ZNK7WebCore20ResourceResponseBase8mimeTypeEv
 __ZNK7WebCore26NetscapePlugInStreamLoader6isDoneEv
+__ZNK7WebCore4Font10floatWidthERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS4_7PtrHashIS8_EENS4_10HashTraitsIS8_EEEE
 __ZNK7WebCore4Font16cachePrimaryFontEv
+__ZNK7WebCore4Font8drawTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
 __ZNK7WebCore4KURL11isLocalFileEv
 __ZNK7WebCore4KURL17lastPathComponentEv
 __ZNK7WebCore4KURL4hostEv
@@ -855,6 +891,7 @@
 __ZNK7WebCore5Frame8documentEv
 __ZNK7WebCore5Frame8settingsEv
 __ZNK7WebCore5Frame9animationEv
+__ZNK7WebCore5Frame9domWindowEv
 __ZNK7WebCore5Frame9selectionEv
 __ZNK7WebCore5Range11startOffsetERi
 __ZNK7WebCore5Range12endContainerERi
@@ -883,13 +920,17 @@
 __ZNK7WebCore6Editor9canDeleteEv
 __ZNK7WebCore6String10charactersEv
 __ZNK7WebCore6String14createCFStringEv
+__ZNK7WebCore6String4utf8Ev
 __ZNK7WebCore6String6lengthEv
 __ZNK7WebCore6String7isEmptyEv
 __ZNK7WebCore6String9substringEjj
 __ZNK7WebCore6StringcvN3JSC7UStringEEv
 __ZNK7WebCore6Widget9frameRectEv
+__ZNK7WebCore7CString4dataEv
+__ZNK7WebCore7CString6lengthEv
 __ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
 __ZNK7WebCore7IntRectcv7_NSRectEv
+__ZNK7WebCore7IntSizecv7_NSSizeEv
 __ZNK7WebCore8Document11completeURLERKNS_6StringE
 __ZNK7WebCore8Document13axObjectCacheEv
 __ZNK7WebCore8Document20cacheDocumentElementEv
@@ -901,6 +942,7 @@
 __ZNK7WebCore8Position25leadingWhitespacePositionENS_9EAffinityEb
 __ZNK7WebCore8Position26trailingWhitespacePositionENS_9EAffinityEb
 __ZNK7WebCore8Position8upstreamEv
+__ZNK7WebCore9DOMWindow27pendingUnloadEventListenersEv
 __ZNK7WebCore9FloatRectcv7_NSRectEv
 __ZNK7WebCore9FrameTree12traverseNextEPKNS_5FrameE
 __ZNK7WebCore9FrameTree14isDescendantOfEPKNS_5FrameE
@@ -914,6 +956,7 @@
 __ZTVN7WebCore12ChromeClientE
 __ZTVN7WebCore17FileChooserClientE
 __ZTVN7WebCore17FrameLoaderClientE
+__ZTVN7WebCore25HistoryPropertyListWriterE
 _filenameByFixingIllegalCharacters
 _hasCaseInsensitiveSubstring
 _hasCaseInsensitiveSuffix
@@ -945,10 +988,14 @@
 _wkGetPreferredExtensionForMIMEType
 _wkGetWheelEventDeltas
 _wkHitTestMediaUIPart
+_wkInitializeMaximumHTTPConnectionCountPerHost
 _wkMeasureMediaUIPart
 _wkPopupMenu
+_wkQTIncludeOnlyModernMediaFileTypes
 _wkQTMovieDataRate
 _wkQTMovieMaxTimeLoaded
+_wkQTMovieMaxTimeLoadedChangeNotification
+_wkQTMovieMaxTimeSeekable
 _wkQTMovieViewSetDrawSynchronously
 _wkSetCGFontRenderingMode
 _wkSetDragImage
diff --git a/WebCore/WebCore.order b/WebCore/WebCore.order
index 164e74d..ddce440 100644
--- a/WebCore/WebCore.order
+++ b/WebCore/WebCore.order
@@ -1,14 +1,21 @@
 __ZN7WebCore12IconDatabase20delayDatabaseCleanupEv
-__ZN7WebCore21reportThreadViolationEPKc
+__ZN7WebCore21reportThreadViolationEPKcNS_20ThreadViolationRoundE
+__ZN7WebCoreL43readThreadViolationBehaviorFromUserDefaultsEv
 __ZN7WebCore12iconDatabaseEv
 __ZN7WebCore12IconDatabaseC1Ev
+__ZN7WebCore12IconDatabaseC2Ev
+__ZN7WebCore9TimerBaseC2Ev
 __ZN7WebCoreL13defaultClientEv
+__ZN7WebCore14SQLiteDatabaseC1Ev
 __ZN7WebCore14SQLiteDatabaseC2Ev
 __ZN7WebCore12IconDatabase10setEnabledEb
 __ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
 __ZN7WebCore12IconDatabase25setPrivateBrowsingEnabledEb
 __ZN7WebCore6StringC1EP8NSString
+__ZN7WebCore6StringC2EP8NSString
 __ZN7WebCore10StringImpl6createEPKtj
+__ZN7WebCore10StringImpl19createUninitializedEjRPt
+__ZN7WebCore10StringImplnwEmPv
 __ZN3WTF6VectorItLm1024EE6shrinkEm
 __ZN7WebCore12IconDatabase4openERKNS_6StringE
 __ZNK7WebCore12IconDatabase6isOpenEv
@@ -16,11 +23,15 @@
 __ZN7WebCore10StringImpl4copyEv
 __ZN7WebCore12IconDatabase23defaultDatabaseFilenameEv
 __ZN7WebCore6StringC1EPKc
+__ZN7WebCore6StringC2EPKc
 __ZN7WebCore10StringImpl6createEPKc
+__ZN7WebCore10StringImpl6createEPKcj
 __ZN7WebCore24pathByAppendingComponentERKNS_6StringES2_
 __ZN7WebCore10StringImpl8endsWithEPS0_b
 __ZN7WebCore10StringImpl4findEPS0_ib
 __ZN7WebCore10StringImplD1Ev
+__ZN7WebCore10StringImplD2Ev
+__ZN7WebCore10StringImpldlEPv
 __ZN7WebCoreplERKNS_6StringEPKc
 __ZN7WebCoreplERKNS_6StringES2_
 __ZNK7WebCore6String7isEmptyEv
@@ -28,6 +39,7 @@
 __ZNK7WebCore6String6lengthEv
 __ZNK7WebCore6String10charactersEv
 __ZN7WebCore10StringImpl5adoptERNS_12StringBufferE
+__ZN7WebCore10StringImplnwEm
 __ZN7WebCore12IconDatabase27iconDatabaseSyncThreadStartEPv
 __ZN7WebCore12IconDatabase22iconDatabaseSyncThreadEv
 __ZN7WebCore18makeAllDirectoriesERKNS_6StringE
@@ -38,348 +50,207 @@
 __ZNK7WebCore7CString4dataEv
 __ZN3WTF6VectorIcLm0EE6shrinkEm
 __ZN7WebCore15AutodrainedPoolC1Ei
+__ZN7WebCore15AutodrainedPoolC2Ei
 __ZN7WebCore10fileExistsERKNS_6StringE
 __ZN7WebCore15AutodrainedPoolD1Ev
+__ZN7WebCore15AutodrainedPoolD2Ev
 __ZN7WebCore14SQLiteDatabase4openERKNS_6StringE
 __ZN7WebCore14SQLiteDatabase5closeEv
 __ZN7WebCore6String29charactersWithNullTerminationEv
 __ZN7WebCore10StringImpl34createWithTerminatingNullCharacterERKS0_
-sqlite3_open16
-sqlite3VdbeMemSetStr
-sqlite3VdbeMemRelease
-sqlite3ValueText
-sqlite3VdbeMemTranslate
-sqlite3VdbeMemNulTerminate
-openDatabase
-createCollation
-findCollSeqEntry
-sqlite3HashInsert
-strHash
-WebCoreObjCFinalizeOnMainThread
-__ZN7WebCore16MIMETypeRegistry29getSupportedNonImageMIMETypesEv
-__ZN7WebCoreL26initializeMIMETypeRegistryEv
-__ZN7WebCoreL38initializeSupportedJavaScriptMIMETypesEv
-sqlite3MallocX
-rehash
-sqlite3Error
-strCompare
-sqlite3BtreeOpen
-sqlite3UnixThreadSpecificData
-sqlite3UnixEnterMutex
-sqlite3UnixFullPathname
-sqlite3SetString
-allocateUnixFile
-findLockInfo
-threadLockingTest
-binHash
-__ZN3WTF7HashSetIN7WebCore6StringENS1_10StringHashENS_10HashTraitsIS2_EEE3addERKS2_
-__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS2_
-__ZN7WebCore5equalEPNS_10StringImplES1_
-__ZN7WebCoreL36initializeSupportedNonImageMimeTypesEv
-__ZN7WebCore14ArchiveFactory29registerKnownArchiveMIMETypesEv
-__ZN7WebCoreL16archiveMIMETypesEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEEENS_18PairFirstExtractorISB_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSG_ISA_EEEESH_E6expandEv
-unixSectorSize
-unixSeek
-unixRead
-sqlite3Realloc
-sqlite3SchemaGet
-sqlite3RegisterBuiltinFunctions
-sqlite3CreateFunc
-sqlite3FindFunction
-sqlite3FreeX
-sqlite3ApiExit
-sqlite3RegisterLikeFunctions
-sqlite3_exec
-sqlite3Prepare
-sqlite3RunParser
-getToken
-sqlite3Parser
-yy_find_shift_action
-yy_reduce
-sqlite3Pragma
-sqlite3VdbeAddOp
-sqlite3VdbeChangeP3
-freeP3
-sqlite3VdbeMakeReady
-yy_destructor
-sqlite3DeleteTable
-sqlite3DeleteTrigger
-sqlite3Step
-sqlite3VdbeExec
-sqlite3VdbeHalt
-sqlite3VdbeFreeCursor
-sqlite3BtreeCommitPhaseTwo
-sqlite3VdbeReset
-Cleanup
-sqlite3VdbeDelete
+__ZN7WebCore15SQLiteStatementC1ERNS_14SQLiteDatabaseERKNS_6StringE
 __ZN7WebCore15SQLiteStatementC2ERNS_14SQLiteDatabaseERKNS_6StringE
 __ZN7WebCore15SQLiteStatement14executeCommandEv
 __ZN7WebCore15SQLiteStatement7prepareEv
-sqlite3_prepare16_v2
-sqlite3Prepare16
+_WebCoreObjCFinalizeOnMainThread
+__ZN7WebCore16MIMETypeRegistry29getSupportedNonImageMIMETypesEv
+__ZN7WebCoreL26initializeMIMETypeRegistryEv
+__ZN7WebCoreL38initializeSupportedJavaScriptMIMETypesEv
+__ZN3WTF7HashSetIN7WebCore6StringENS1_10StringHashENS_10HashTraitsIS2_EEE3addERKS2_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E6expandEv
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E6rehashEi
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E13allocateTableEi
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E15deallocateTableE
+__ZN7WebCore5equalEPNS_10StringImplES1_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_EC1ERKS8_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_EC2ERKS8_
+__ZN7WebCoreL36initializeSupportedNonImageMimeTypesEv
+__ZN7WebCore14ArchiveFactory29registerKnownArchiveMIMETypesEv
+__ZN7WebCoreL16archiveMIMETypesEv
+__ZN3WTF7HashMapIN7WebCore6StringEPFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEENS1_15CaseFoldingHashENS_10HashTraitsIS
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEEENS_18PairFirstExtractorIS
 __ZN7WebCore15SQLiteStatement4stepEv
-sqlite3_step
 __ZN7WebCore15SQLiteStatement8finalizeEv
-sqlite3_finalize
+__ZN7WebCore15SQLiteStatementD1Ev
 __ZN7WebCore15SQLiteStatementD2Ev
 __ZNK7WebCore12IconDatabase24shouldStopThreadActivityEv
 __ZN7WebCore12IconDatabase25performOpenInitializationEv
 __ZN7WebCoreL21databaseVersionNumberERNS_14SQLiteDatabaseE
 __ZN7WebCore15SQLiteStatement12getColumnIntEi
-sqlite3Expr
-heightOfSelect
-sqlite3ExprListAppend
-sqlite3SrcListAppendFromTerm
-sqlite3SrcListAppend
-sqlite3SelectNew
-sqlite3Select
-sqlite3SelectResolve
-prepSelectStmt
-sqlite3Init
-sqlite3InitOne
-sqlite3InitCallback
-sqlite3StartTable
-sqlite3FindTable
-sqlite3EndTable
-sqlite3BtreeCursor
-sqlite3BtreeBeginTrans
-sqlite3PagerAcquire
-unixLock
-unixFileSize
-sqlite3PagerUnref
-pageDestructor
-unixUnlock
-sqlite3ErrorMsg
-base_vprintf
-mout
-printf_realloc
-clearSelect
-sqlite3ExprDelete
-sqlite3SrcListDelete
 __ZN7WebCore14SQLiteDatabase11tableExistsERKNS_6StringE
 __ZN7WebCoreplEPKcRKNS_6StringE
-walkExprTree
-nameResolverStep
-lookupName
-processOrderGroupBy
-simpleMinMaxQuery
-computeLimitRegisters
-sqlite3WhereBegin
-whereSplit
-whereClauseInsert
-exprNodeIsConstant
-exprAnalyze
-exprTableUsage
-exprSelectTableUsage
-findTerm
-sqlite3OpenTable
-sqlite3TableLock
-sqlite3ExprIfFalse
-sqlite3ExprCode
-sqlite3ExprCodeGetColumn
-sqlite3ValueFromExpr
-codeCompare
-sqlite3GetCollSeq
-selectInnerLoop
-codeOffset
-sqlite3WhereEnd
-generateColumnNames
-columnType
-sqlite3BtreeGetMeta
-sqlite3VdbeIntValue
 __ZN7WebCore14SQLiteDatabase14clearAllTablesEv
 __ZN7WebCore15SQLiteStatement17returnTextResultsEiRN3WTF6VectorINS_6StringELm0EEE
 __ZN3WTF6VectorIN7WebCore6StringELm0EE14shrinkCapacityEm
 __ZN7WebCore14SQLiteDatabase9lastErrorEv
-sqlite3_errcode
 __ZN7WebCoreL20createDatabaseTablesERNS_14SQLiteDatabaseE
 __ZN7WebCore14SQLiteDatabase14executeCommandERKNS_6StringE
-sqlite3BeginWriteOperation
-sqlite3OpenMasterTable
-sqlite3CreateIndex
-sqlite3_snprintf
-sqlite3LocateCollSeq
-sqlite3NestedParse
-sqlite3Insert
-sqlite3ViewGetColumnNames
-autoIncBegin
-sqlite3OpenTableAndIndices
-sqlite3GenerateConstraintChecks
-sqlite3CompleteInsertion
-autoIncEnd
-sqlite3MPrintf
-sqlite3Update
-codeEqualityTerm
-sqliteResetColumnNames
-sqlite3PagerBegin
-pager_open_journal
-unixSetFullSync
-unixOpenDirectory
-writeJournalHdr
-sqlite3UnixRandomSeed
-unixWrite
-sqlite3PagerWrite
-pager_write
-zeroPage
-sqlite3BtreeCreateTable
-allocateBtreePage
-moveToRoot
-sqlite3BtreeInsert
-sqlite3BtreeMoveto
-fillInCell
-sqlite3BtreeParseCellPtr
-insertCell
-allocateSpace
-sqlite3BtreeCloseCursor
-sqlite3MallocRaw
-applyAffinity
-applyNumericAffinity
-sqlite3VdbeSerialPut
-clearCell
-freeSpace
-sqlite3VdbeSerialGet
-sqlite3MemCompare
-binCollFunc
-sqlite3_value_text
-sqlite3BtreeCommitStmt
-sqlite3BtreeNext
-sqlite3PagerCommitPhaseOne
-syncJournal
-unixSync
-pager_write_pagelist
-pager_end_transaction
-unixClose
-binCompare
-sqlite3FixSrcList
-sqlite3FixSelect
-sqlite3RefillIndex
-sqlite3GenerateIndexKey
-sqlite3BtreeInitPage
-sqlite3AddPrimaryKey
-sqlite3FindDb
-balance_deeper
-balance_nonroot
-reparentChildPages
-reparentPage
 __ZN7WebCore6String6numberEi
 __ZN7WebCore6String6formatEPKcz
 __ZN3WTF6VectorIcLm256EE4growEm
-__ZN7WebCore10StringImpl6createEPKcj
 __ZN3WTF6VectorIcLm256EE6shrinkEm
-codeInteger
-sqlite3GenerateRowDelete
 __ZN7WebCore12IconDatabase8importedEv
-codeAllEqualityTerms
-sqlite3VdbeRecordCompare
-sqlite3VdbeIdxKeyCompare
-sqlite3VdbeMemFromBtree
+__ZN7WebCore17SQLiteTransactionC1ERNS_14SQLiteDatabaseE
 __ZN7WebCore17SQLiteTransactionC2ERNS_14SQLiteDatabaseE
 __ZN7WebCore17SQLiteTransaction5beginEv
 __ZNK7WebCore12IconDatabase12databasePathEv
-__ZN7WebCore10StringImplcvP8NSStringEv
 __ZN7WebCore12IconDatabase11setImportedEb
-sqlite3IdListAppend
 __ZN7WebCore17SQLiteTransaction6commitEv
+__ZN7WebCore17SQLiteTransactionD1Ev
 __ZN7WebCore17SQLiteTransactionD2Ev
 __ZN7WebCore12IconDatabase16performURLImportEv
-sqlite3JoinType
-setJoinExpr
-sqlite3ExprDup
-sqlite3ExprListDup
-sqlite3SelectDup
-disableTerm
-__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIS2_S2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EESB_EES2_EEEEvT_SE_
+__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIS2_S2_NS_17IdentityExtractorIS2
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E5clearEv
 __ZN7WebCore12IconDatabase18syncThreadMainLoopEv
 __ZN7WebCore12IconDatabase15writeToDatabaseEv
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableINS1_6StringESt4pairIS7_S2_ENS_18PairFirstExtractorIS9_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS7_EENSE_IS2_EEEESF_EES7_S2_EEEEvT_SK_
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableINS1_6StringESt4pairIS7_S2_ENS_18PairFirstExtractorIS9_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS7_EENSE_IS2_EEEESF_EES7_S2_EEEEvT_SK_
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableINS1_6StringESt4pairIS7_S2
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_12IconSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashT
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableINS1_6StringESt4pairIS7
 __ZN7WebCore12IconDatabase16readFromDatabaseEv
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EESD_EES3_EEEEvT_SG_
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtrac
 __ZN7WebCore6StringC1EPK10__CFString
+__ZN7WebCore6StringC2EPK10__CFString
 __ZN7WebCore26MIMETypeForImageSourceTypeERKNS_6StringE
-__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E4findIS2_NS_22IdentityHashTranslatorIS2_S2_S5_EEEENS_17HashTableIteratorIS2_S2_S4_S5_S7_S7_EERKT_
+__ZN7WebCore24StringWrapperCFAllocatorL9allocatorEv
+__ZN7WebCore24StringWrapperCFAllocatorL6retainEPKv
+__ZN7WebCore24StringWrapperCFAllocatorL8allocateElmPv
+__ZN7WebCore24StringWrapperCFAllocatorL10deallocateEPvS1_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E4findIS2_NS_22Iden
+__ZN7WebCore10StringImplcvP8NSStringEv
 __ZNK7WebCore12IconDatabase9isEnabledEv
 __ZN7WebCore12IconDatabase20retainIconForPageURLERKNS_6StringE
-__ZN7WebCore13PageURLRecordC1ERKNS_6StringE
 __ZNK3WTF7HashMapIN7WebCore6StringEPNS1_13PageURLRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_13PageURLRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E6expandEv
-__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IS4_EEEESB_E8containsIS2_NS_22IdentityHashTranslatorIS2_S5_S8_EEEEbRKT_
-__ZN7WebCore9PageGroup26setShouldTrackVisitedLinksEb
-__ZN7WebCore9PageGroup21removeAllVisitedLinksEv
-__ZN7WebCore4Page21removeAllVisitedLinksEv
+__ZN7WebCore13PageURLRecordC1ERKNS_6StringE
+__ZN7WebCore13PageURLRecordC2ERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_13PageURLRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_13PageURLRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHas
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairH
 __ZN7WebCore11FrameLoader24registerURLSchemeAsLocalERKNS_6StringE
 __ZN7WebCoreL12localSchemesEv
 __ZN3WTF7HashSetIN7WebCore6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EEE3addERKS2_
-__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E5clearEv
-stringIsCaseInsensitiveEqualToString
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E6expandEv
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E6rehashEi
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E13allocateTab
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E15deallocateT
 +[WebCoreViewFactory sharedFactory]
 -[WebCoreViewFactory init]
 +[WebCoreKeyGenerator sharedGenerator]
 -[WebCoreKeyGenerator init]
 __ZN7WebCore36InitializeLoggingChannelsIfNecessaryEv
 __ZN7WebCore15DatabaseTracker7trackerEv
+__ZN7WebCore15DatabaseTrackerC1Ev
 __ZN7WebCore15DatabaseTrackerC2Ev
 __ZN7WebCore15DatabaseTracker24setDatabaseDirectoryPathERKNS_6StringE
 __ZN7WebCore15DatabaseTracker9setClientEPNS_21DatabaseTrackerClientE
 __ZN7WebCore12cacheStorageEv
 __ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKNS_6StringE
 __ZN7WebCore4PageC1EPNS_12ChromeClientEPNS_17ContextMenuClientEPNS_12EditorClientEPNS_10DragClientEPNS_15InspectorClientE
+__ZN7WebCore4PageC2EPNS_12ChromeClientEPNS_17ContextMenuClientEPNS_12EditorClientEPNS_10DragClientEPNS_15InspectorClientE
 __ZN7WebCore6ChromeC1EPNS_4PageEPNS_12ChromeClientE
+__ZN7WebCore6ChromeC2EPNS_4PageEPNS_12ChromeClientE
 __ZN7WebCore19SelectionControllerC1EPNS_5FrameEb
-__ZN7WebCore9SelectionC1Ev
+__ZN7WebCore19SelectionControllerC2EPNS_5FrameEb
+__ZN7WebCore16VisibleSelectionC1Ev
+__ZN7WebCore16VisibleSelectionC2Ev
 __ZN7WebCore14DragControllerC1EPNS_4PageEPNS_10DragClientE
+__ZN7WebCore14DragControllerC2EPNS_4PageEPNS_10DragClientE
 __ZN7WebCore4KURL10invalidateEv
 __ZN7WebCore15FocusControllerC1EPNS_4PageE
+__ZN7WebCore15FocusControllerC2EPNS_4PageE
 __ZN7WebCore21ContextMenuControllerC1EPNS_4PageEPNS_17ContextMenuClientE
+__ZN7WebCore21ContextMenuControllerC2EPNS_4PageEPNS_17ContextMenuClientE
 __ZN7WebCore19InspectorControllerC1EPNS_4PageEPNS_15InspectorClientE
-__ZN7WebCore9TimerBaseC2Ev
-__ZN7WebCore27setSharedTimerFiredFunctionEPFvvE
+__ZN7WebCore19InspectorControllerC2EPNS_4PageEPNS_15InspectorClientE
 __ZN7WebCore8SettingsC1EPNS_4PageE
+__ZN7WebCore8SettingsC2EPNS_4PageE
 __ZN7WebCore12AtomicString4initEv
 __ZN7WebCore12AtomicString3addEPKc
 __ZN7WebCore10StringImpl5emptyEv
 __ZN7WebCore16threadGlobalDataEv
 __ZN7WebCore16ThreadGlobalDataC1Ev
+__ZN7WebCore16ThreadGlobalDataC2Ev
 __ZN7WebCore10StringImplC1Ev
+__ZN7WebCore10StringImplC2Ev
 __ZN7WebCore10EventNamesC1Ev
+__ZN7WebCore10EventNamesC2Ev
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addIPKcNS1_17CStringTranslatorEEESt4pairINS_24H
 __ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E13allocateTa
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E15deallocate
+__ZN7WebCore10StringImplC1EPKcjj
 __ZN7WebCore10StringImplC2EPKcjj
-__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E4findINS1_17HashAndCharactersENS_24HashSetTranslatorAdapterIS3_S8_SB_NS1_27HashAndCharactersTranslatorEEEEENS_17HashTableIteratorIS3_S3_S5_S6_S8_S8_EERKT_
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E4findIS3_NS_
 __ZN7WebCore12AtomicStringC2EPKc
+__ZN7WebCore12ThreadTimersC1Ev
+__ZN7WebCore12ThreadTimersC2Ev
+__ZN7WebCoreL21mainThreadSharedTimerEv
+__ZN7WebCore12ThreadTimers14setSharedTimerEPNS_11SharedTimerE
+__ZN7WebCore21MainThreadSharedTimer16setFiredFunctionEPFvvE
+__ZN7WebCore27setSharedTimerFiredFunctionEPFvvE
+__ZN7WebCore12ThreadTimers17updateSharedTimerEv
+__ZN7WebCore21MainThreadSharedTimer4stopEv
+__ZN7WebCore15stopSharedTimerEv
 __ZN7WebCore15ProgressTrackerC1Ev
+__ZN7WebCore15ProgressTrackerC2Ev
 __ZN7WebCore15BackForwardListC1EPNS_4PageE
+__ZN7WebCore15BackForwardListC2EPNS_4PageE
 __ZN7WebCore20networkStateNotifierEv
 __ZN7WebCore20NetworkStateNotifierC1Ev
+__ZN7WebCore20NetworkStateNotifierC2Ev
 __ZN7WebCore20NetworkStateNotifier11updateStateEv
 __ZN7WebCore20NetworkStateNotifier30setNetworkStateChangedFunctionEPFvvE
 __ZN3WTF7HashSetIPN7WebCore4PageENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableEP
 __ZN7WebCore21JavaScriptDebugServer6sharedEv
 __ZN7WebCore21JavaScriptDebugServerC1Ev
+__ZN7WebCore21JavaScriptDebugServerC2Ev
 __ZN7WebCore21JavaScriptDebugServer11pageCreatedEPNS_4PageE
 __ZN7WebCore21JavaScriptDebugServer28hasListenersInterestedInPageEPNS_4PageE
-__ZNK3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEEENS_18PairFirstExtractorISE_EENS8_IS3_EENS_14PairHashTraitsINSA_IS3_EENSA_ISD_EEEESJ_E8containsIS3_NS_22IdentityHashTranslatorIS3_SE_SH_EEEEbRKT_
+__ZNK3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_
 __ZN7WebCore8Settings27setLocalStorageDatabasePathERKNS_6StringE
 __ZN7WebCore5FrameC1EPNS_4PageEPNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
+__ZN7WebCore5FrameC2EPNS_4PageEPNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
 __ZN7WebCore11FrameLoaderC1EPNS_5FrameEPNS_17FrameLoaderClientE
+__ZN7WebCore11FrameLoaderC2EPNS_5FrameEPNS_17FrameLoaderClientE
 __ZN7WebCore11PolicyCheckC1Ev
+__ZN7WebCore11PolicyCheckC2Ev
+__ZN3WTF6RefPtrIN7WebCore10StringImplEED2Ev
 __ZN7WebCore16ScriptControllerC1EPNS_5FrameE
+__ZN7WebCore16ScriptControllerC2EPNS_5FrameE
 __ZN7WebCore16ScriptController18initJavaJSBindingsEv
 __ZN3JSC8Bindings12JavaJSObject22initializeJNIThreadingEv
 __ZN3JSC8Bindings8Instance21setDidExecuteFunctionEPFvPNS_9ExecStateEPNS_8JSObjectEE
 __ZN7WebCore6EditorC1EPNS_5FrameE
+__ZN7WebCore6EditorC2EPNS_5FrameE
 __ZN7WebCore22DeleteButtonControllerC1EPNS_5FrameE
+__ZN7WebCore22DeleteButtonControllerC2EPNS_5FrameE
 __ZN7WebCore12EventHandlerC1EPNS_5FrameE
+__ZN7WebCore12EventHandlerC2EPNS_5FrameE
+__ZN7WebCore19AnimationControllerC1EPNS_5FrameE
 __ZN7WebCore19AnimationControllerC2EPNS_5FrameE
+__ZN7WebCore26AnimationControllerPrivateC1EPNS_5FrameE
 __ZN7WebCore26AnimationControllerPrivateC2EPNS_5FrameE
 __ZN7WebCore9HTMLNames4initEv
 __ZN7WebCore13QualifiedNameC1ERKNS_12AtomicStringES3_S3_
-__ZN3WTF7HashSetIPN7WebCore13QualifiedName17QualifiedNameImplENS1_17QualifiedNameHashENS_10HashTraitsIS4_EEE3addINS1_23QualifiedNameComponentsENS1_25QNameComponentsTranslatorEEESt4pairINS_24HashTableIteratorAdapterINS_9HashTableIS4_S4_NS_17IdentityExtractorIS4_EES5_S7_S7_EES4_EEbERKT_
-__ZN3WTF9HashTableIPN7WebCore13QualifiedName17QualifiedNameImplES4_NS_17IdentityExtractorIS4_EENS1_17QualifiedNameHashENS_10HashTraitsIS4_EES9_E6expandEv
+__ZN7WebCore13QualifiedNameC2ERKNS_12AtomicStringES3_S3_
+__ZN3WTF7HashSetIPN7WebCore13QualifiedName17QualifiedNameImplENS1_17QualifiedNameHashENS_10HashTraitsIS4_EEE3addINS1_23Qualifie
+__ZN3WTF9HashTableIPN7WebCore13QualifiedName17QualifiedNameImplES4_NS_17IdentityExtractorIS4_EENS1_17QualifiedNameHashENS_10Has
 __ZN7WebCore12AtomicString3addEPNS_10StringImplE
 __ZN3WTF10RefCountedIN7WebCore10StringImplEE5derefEv
-__ZN3WTF9HashTableIPN7WebCore13QualifiedName17QualifiedNameImplES4_NS_17IdentityExtractorIS4_EENS1_17QualifiedNameHashENS_10HashTraitsIS4_EES9_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S7_EEEENS_17HashTableIteratorIS4_S4_S6_S7_S9_S9_EERKT_
 __ZN7WebCore13QualifiedName4initEv
 __ZN7WebCore17MediaFeatureNames4initEv
 __ZN7WebCore8SVGNames4initEv
@@ -392,29 +263,31 @@
 __ZN7WebCore5Frame4initEv
 __ZN7WebCore11FrameLoader4initEv
 __ZN7WebCore4KURLC1EPKc
+__ZN7WebCore4KURLC2EPKc
 __ZN7WebCore4KURL5parseEPKcPKNS_6StringE
 __ZN7WebCore14DocumentLoaderC2ERKNS_15ResourceRequestERKNS_14SubstituteDataE
 __ZN3WTF6VectorIN7WebCore6StringELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore6StringELm0EEC2ERKS3_
 __ZN7WebCore16NavigationActionC1Ev
+__ZN7WebCore16NavigationActionC2Ev
 __ZNK7WebCore5Frame4pageEv
 __ZN7WebCore11FrameLoader23setPolicyDocumentLoaderEPNS_14DocumentLoaderE
 __ZN7WebCore14DocumentLoader8setFrameEPNS_5FrameE
 __ZN7WebCore14DocumentLoader13attachToFrameEv
-__ZN3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS1_6StringEENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IS4_EEEESB_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS5_
-__ZN3WTF6RefPtrIN7WebCore10StringImplEED2Ev
 __ZN7WebCore11FrameLoader28setProvisionalDocumentLoaderEPNS_14DocumentLoaderE
 __ZN7WebCore11FrameLoader8setStateENS_10FrameStateE
 __ZN7WebCore11FrameLoader22provisionalLoadStartedEv
-__ZNK7WebCore5Frame8documentEv
-__ZNK7WebCore5Frame6loaderEv
-__ZNK7WebCore11FrameLoader10isCompleteEv
 __ZN7WebCore11FrameLoader17cancelRedirectionEb
 __ZN7WebCore11FrameLoader20stopRedirectionTimerEv
 __ZNK7WebCore9TimerBase8isActiveEv
+__ZN7WebCoreL17timersReadyToFireEv
+__ZNK3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8containsIS4
 __ZN7WebCore14DocumentLoader15finishedLoadingEv
 __ZN7WebCore14DocumentLoader13commitIfReadyEv
 __ZNK7WebCore14DocumentLoader11frameLoaderEv
+__ZNK7WebCore5Frame6loaderEv
 __ZN7WebCore11FrameLoader21commitProvisionalLoadEN3WTF10PassRefPtrINS_10CachedPageEEE
+__ZN7WebCore11FrameLoader23cachePageForHistoryItemEPNS_11HistoryItemE
 __ZN7WebCore11FrameLoader12canCachePageEv
 __ZNK7WebCore11FrameLoader8loadTypeEv
 __ZN7WebCore11FrameLoader31canCachePageContainingThisFrameEv
@@ -423,14 +296,12 @@
 __ZN7WebCore11FrameLoader22updateHistoryForCommitEv
 __ZN7WebCore21isBackForwardLoadTypeENS_13FrameLoadTypeE
 __ZN7WebCore11FrameLoader17setDocumentLoaderEPNS_14DocumentLoaderE
-__ZNK7WebCore11FrameLoader14documentLoaderEv
 __ZN7WebCore11FrameLoader14detachChildrenEv
 __ZN7WebCore11FrameLoader28updateHistoryForStandardLoadEv
 __ZNK7WebCore5Frame8settingsEv
 __ZNK7WebCore14DocumentLoader13urlForHistoryEv
 __ZNK7WebCore19ResourceRequestBase3urlEv
 __ZNK7WebCore19ResourceRequestBase21updateResourceRequestEv
-__ZNK7WebCore5Frame12ownerElementEv
 __ZNK7WebCore5Frame4viewEv
 __ZNK7WebCore16ResourceResponse13nsURLResponseEv
 __ZNK7WebCore4KURLcvP5NSURLEv
@@ -441,13 +312,17 @@
 __ZN7WebCore12EventHandler5clearEv
 __ZN7WebCore9TimerBase4stopEv
 __ZN7WebCore9TimerBase15setNextFireTimeEd
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_2
 __ZN7WebCore11FrameLoader37resetMultipleFormSubmissionProtectionEv
 __ZN7WebCore9FrameViewC1EPNS_5FrameE
+__ZN7WebCore9FrameViewC2EPNS_5FrameE
 __ZN7WebCore10ScrollViewC2Ev
+__ZN7WebCore6WidgetC2EP6NSView
 __ZN7WebCore6Widget4initEP6NSView
 __ZN7WebCore9FrameView4initEv
 __ZN7WebCore9FrameView5resetEv
 __ZN3WTF6VectorIN7WebCore7IntRectELm0EE14shrinkCapacityEm
+__ZNK7WebCore5Frame8documentEv
 __ZN7WebCore10ScrollView4showEv
 __ZN7WebCore6Widget4showEv
 __ZN7WebCore9FrameView14setTransparentEb
@@ -465,6 +340,7 @@
 __ZNK7WebCore10ScrollView22platformScrollbarModesERNS_13ScrollbarModeES2_
 __ZN7WebCore10ScrollView17setScrollbarModesENS_13ScrollbarModeES1_
 __ZN7WebCore10ScrollView16setParentVisibleEb
+__ZNK7WebCore5Frame12ownerElementEv
 __ZNK7WebCore14DocumentLoader16responseMIMETypeEv
 __ZNK7WebCore20ResourceResponseBase8mimeTypeEv
 __ZNK7WebCore20ResourceResponseBase8lazyInitEv
@@ -476,6 +352,7 @@
 __ZN7WebCore8blankURLEv
 __ZN7WebCoreL22appendEscapingBadCharsERPcPKcm
 __ZN7WebCore6StringC1EPKcj
+__ZN7WebCore6StringC2EPKcj
 __ZN3WTF6VectorIcLm4096EE6shrinkEm
 __ZN7WebCore11FrameLoader10didOpenURLERKNS_4KURLE
 __ZNK7WebCore5Frame6editorEv
@@ -485,62 +362,45 @@
 __ZN7WebCore11FrameLoader11stopLoadingEb
 __ZN7WebCore6Editor23clearUndoRedoOperationsEv
 __ZNK7WebCore6Editor6clientEv
-__ZN7WebCore5Frame18setJSStatusBarTextERKNS_6StringE
-__ZN7WebCore6Chrome16setStatusbarTextEPNS_5FrameERKNS_6StringE
-__ZN7WebCore5Frame25setJSDefaultStatusBarTextERKNS_6StringE
 __ZNK7WebCore4KURL10protocolIsEPKc
 __ZNK7WebCore6StringixEj
 __ZN7WebCore11FrameLoader7startedEv
-__ZN7WebCore11FrameLoader6openedEv
 __ZN7WebCore11FrameLoader23finishedLoadingDocumentEPNS_14DocumentLoaderE
 __ZN7WebCore14ArchiveFactory17isArchiveMimeTypeERKNS_6StringE
-__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEEENS_18PairFirstExtractorISB_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSG_ISA_EEEESH_E8containsIS2_NS_22IdentityHashTranslatorIS2_SB_SE_EEEEbRKT_
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEEENS_18PairFirstExtractorI
 __ZN7WebCore11FrameLoader3endEv
 __ZN7WebCore11FrameLoader27endIfNotLoadingMainResourceEv
-__ZN7WebCore11FrameLoader14checkCompletedEv
-__ZN7WebCore11FrameLoader22checkCallImplicitCloseEv
-__ZN7WebCore11FrameLoader9completedEv
-__ZN7WebCore11FrameLoader15submitFormAgainEv
-__ZN7WebCore11FrameLoader17checkLoadCompleteEv
-__ZN7WebCore11FrameLoader26recursiveCheckLoadCompleteEv
-__ZN7WebCore11FrameLoader29checkLoadCompleteForThisFrameEv
-__ZNK7WebCore14DocumentLoader19isLoadingInAPISenseEv
-__ZNK7WebCore11FrameLoader5stateEv
-__ZNK7WebCore11FrameLoader17subframeIsLoadingEv
-__ZN7WebCore11FrameLoader16markLoadCompleteEv
-__ZN7WebCore11FrameLoader18frameLoadCompletedEv
-__ZN7WebCore14DocumentLoader22stopRecordingResponsesEv
 __ZN7WebCore11FrameLoader5beginERKNS_4KURLEbPNS_14SecurityOriginE
-__ZN7WebCore11FrameLoader5clearEbb
-__ZN7WebCore6Editor5clearEv
-__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EE14shrinkCapacityEm
-__ZN7WebCore5Frame6scriptEv
-__ZN7WebCore16ScriptController27updatePlatformScriptObjectsEv
-__ZN7WebCore4KURL7setUserERKNS_6StringE
-__ZN7WebCore4KURL7setPassERKNS_6StringE
-__ZN7WebCore4KURL6setRefERKNS_6StringE
 __ZNK7WebCore5Frame16inViewSourceModeEv
 __ZN7WebCore17DOMImplementation14createDocumentERKNS_6StringEPNS_5FrameEb
 __ZN7WebCore5equalEPNS_10StringImplEPKc
 __ZN7WebCore12HTMLDocumentC1EPNS_5FrameE
-__ZN7WebCore8DocumentC1EPNS_5FrameEb
-__ZN7WebCore13ContainerNodeC2EPNS_8DocumentEb
-__ZN7WebCore15EventTargetNodeC2EPNS_8DocumentEbbb
+__ZN7WebCore12HTMLDocumentC2EPNS_5FrameE
+__ZN7WebCore8DocumentC2EPNS_5FrameEb
 __ZN7WebCore4NodeC2EPNS_8DocumentEbbb
 __ZN7WebCore22ScriptExecutionContextC2Ev
+__ZN7WebCore14StyleSheetListC1EPNS_8DocumentE
 __ZN7WebCore14StyleSheetListC2EPNS_8DocumentE
-__ZN7WebCore14HTMLCollection14CollectionInfoC1Ev
-__ZN7WebCore14HTMLCollection14CollectionInfo5resetEv
-__ZN3WTF20deleteAllPairSecondsIPNS_6VectorIPN7WebCore7ElementELm0EEEKNS_7HashMapIPNS2_16AtomicStringImplES6_NS_7PtrHashIS9_EENS_10HashTraitsIS9_EENSC_IS6_EEEEEEvRT0_
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS_6VectorIPNS1_7ElementELm0EEEENS_18PairFirstExtractorISA_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSG_IS9_EEEESH_E6expandEv
+__ZN7WebCore15CollectionCacheC1Ev
+__ZN7WebCore15CollectionCacheC2Ev
+__ZN7WebCore15CollectionCache5resetEv
+__ZN3WTF20deleteAllPairSecondsIPNS_6VectorIPN7WebCore7ElementELm0EEEKNS_7HashMapIPNS2_16AtomicStringImplES6_NS_7PtrHashIS9_EENS
 __ZN7WebCore9DocLoaderC1EPNS_8DocumentE
+__ZN7WebCore9DocLoaderC2EPNS_8DocumentE
 __ZN7WebCore5cacheEv
 __ZN7WebCore5CacheC1Ev
+__ZN7WebCore5CacheC2Ev
 __ZN7WebCore6LoaderC1Ev
+__ZN7WebCore6LoaderC2Ev
 __ZN7WebCore6Loader4HostC1ERKNS_12AtomicStringEj
+__ZN7WebCore6Loader4HostC2ERKNS_12AtomicStringEj
+__ZN7WebCore43initializeMaximumHTTPConnectionCountPerHostEv
 __ZN7WebCore5Cache12addDocLoaderEPNS_9DocLoaderE
 __ZN3WTF7HashSetIPN7WebCore9DocLoaderENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
 __ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
 __ZN7WebCore8Document14resetLinkColorEv
 __ZN7WebCore7makeRGBEiii
 __ZN7WebCore8Document21resetVisitedLinkColorEv
@@ -549,22 +409,28 @@
 __ZN7WebCore8Document19initSecurityContextEv
 __ZN7WebCore14SecurityOrigin6createERKNS_4KURLE
 __ZN7WebCore14SecurityOriginC1ERKNS_4KURLE
+__ZN7WebCore14SecurityOriginC2ERKNS_4KURLE
 __ZNK7WebCore4KURL8protocolEv
 __ZNK7WebCore6String9substringEjj
+__ZN7WebCore10StringImpl9substringEjj
+__ZNK7WebCore6String5lowerEv
+__ZN7WebCore10StringImpl5lowerEv
 __ZNK7WebCore4KURL4hostEv
 __ZN7WebCore24decodeURLEscapeSequencesERKNS_6StringE
 __ZN7WebCore12UTF8EncodingEv
 __ZN7WebCore12TextEncodingC1EPKc
+__ZN7WebCore12TextEncodingC2EPKc
 __ZN7WebCore31atomicCanonicalTextEncodingNameEPKc
 __ZN7WebCore15TextCodecLatin121registerEncodingNamesEPFvPKcS2_E
 __ZN7WebCoreL24addToTextEncodingNameMapEPKcS1_
+__ZNK3WTF7HashMapIPKcS2_N7WebCore20TextEncodingNameHashENS_10HashTraitsIS2_EES6_E3getERKS2_
 __ZN3WTF7HashMapIPKcS2_N7WebCore20TextEncodingNameHashENS_10HashTraitsIS2_EES6_E3addERKS2_S9_
-__ZN3WTF9HashTableIPKcSt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EEN7WebCore20TextEncodingNameHashENS_14PairHashTraitsINS_10HashTraitsIS2_EESB_EESB_E6expandEv
+__ZN3WTF9HashTableIPKcSt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EEN7WebCore20TextEncodingNameHashENS_14PairHashTraitsINS_10Hash
 __ZN7WebCore15TextCodecLatin114registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
 __ZN7WebCoreL17addToTextCodecMapEPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvES9_
-__ZN3WTF9HashTableIPKcSt4pairIS2_N7WebCore16TextCodecFactoryEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS5_EEEESD_E6expandEv
+__ZN3WTF7HashMapIPKcN7WebCore16TextCodecFactoryENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS7_IS4_EEE3addERKS2_RKS4_
+__ZN3WTF9HashTableIPKcSt4pairIS2_N7WebCore16TextCodecFactoryEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS2_EENS_14PairHashTraits
 __ZN7WebCore14TextCodecUTF1621registerEncodingNamesEPFvPKcS2_E
-__ZN3WTF9HashTableIPKcSt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EEN7WebCore20TextEncodingNameHashENS_14PairHashTraitsINS_10HashTraitsIS2_EESB_EESB_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S8_EEEENS_17HashTableIteratorIS2_S4_S6_S8_SC_SB_EERKT_
 __ZN7WebCore14TextCodecUTF1614registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
 __ZN7WebCore20TextCodecUserDefined21registerEncodingNamesEPFvPKcS2_E
 __ZN7WebCore20TextCodecUserDefined14registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
@@ -574,61 +440,84 @@
 __ZNK7WebCore12TextEncoding25backslashAsCurrencySymbolEv
 __ZN7WebCore30noExtendedTextEncodingNameUsedEv
 __ZN7WebCore24decodeURLEscapeSequencesERKNS_6StringERKNS_12TextEncodingE
+__ZN7WebCore10StringImpl4findEti
 __ZN3WTF6VectorItLm0EE6appendItEEvPKT_m
 __ZN7WebCore10StringImpl5adoptERN3WTF6VectorItLm0EEE
-__ZNK7WebCore6String5lowerEv
-__ZN7WebCore10StringImpl5lowerEv
 __ZNK7WebCore4KURL4portEv
+__ZN7WebCore11FrameLoader30shouldTreatURLSchemeAsNoAccessERKNS_6StringE
+__ZN7WebCoreL15noAccessSchemesEv
+__ZNK3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E8containsIS2
 __ZNK7WebCore14SecurityOrigin7isLocalEv
-__ZN7WebCore11FrameLoader24shouldTreatSchemeAsLocalERKNS_6StringE
+__ZN7WebCore11FrameLoader27shouldTreatURLSchemeAsLocalERKNS_6StringE
 __ZN7WebCoreL24isDefaultPortForProtocolEtRKNS_6StringE
 __ZN7WebCore22ScriptExecutionContext17setSecurityOriginEN3WTF10PassRefPtrINS_14SecurityOriginEEE
 __ZN7WebCore11FrameLoader32allowSubstituteDataAccessToLocalEv
+__ZNK7WebCore8Document8settingsEv
 __ZNK7WebCore14SecurityOrigin7isEmptyEv
 __ZN7WebCore11FrameLoader6openerEv
 __ZN7WebCore8Document15initDNSPrefetchEv
 __ZNK7WebCore8Document14parentDocumentEv
+__ZN7WebCore11FrameLoader5clearEbb
+__ZN7WebCore6Editor5clearEv
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EE14shrinkCapacityEm
+__ZN7WebCore5Frame6scriptEv
+__ZN7WebCore16ScriptController27updatePlatformScriptObjectsEv
+__ZN7WebCore4KURL7setUserERKNS_6StringE
+__ZN7WebCore4KURL7setPassERKNS_6StringE
+__ZN7WebCore4KURL6setRefERKNS_6StringE
 __ZN7WebCore5Frame11setDocumentEN3WTF10PassRefPtrINS_8DocumentEEE
 __ZNK7WebCore5Frame9selectionEv
 __ZNK7WebCore19SelectionController18isFocusedAndActiveEv
 __ZN7WebCore8Document6attachEv
 __ZN7WebCore11RenderArenaC1Ej
+__ZN7WebCore11RenderArenaC2Ej
 __ZN7WebCore13InitArenaPoolEPNS_9ArenaPoolEPKcjj
 __ZNK7WebCore8Document4viewEv
 __ZN7WebCore12RenderObjectnwEmPNS_11RenderArenaE
 __ZN7WebCore11RenderArena8allocateEm
 __ZN7WebCore13ArenaAllocateEPNS_9ArenaPoolEj
 __ZN7WebCore10RenderViewC1EPNS_4NodeEPNS_9FrameViewE
-__ZN7WebCore11RenderBlockC1EPNS_4NodeE
-__ZN7WebCore15RenderContainerC2EPNS_4NodeE
+__ZN7WebCore10RenderViewC2EPNS_4NodeEPNS_9FrameViewE
+__ZN7WebCore11RenderBlockC2EPNS_4NodeE
 __ZN7WebCore9RenderBoxC2EPNS_4NodeE
+__ZN7WebCore20RenderBoxModelObjectC2EPNS_4NodeE
 __ZN7WebCore12RenderObjectC2EPNS_4NodeE
 __ZN7WebCore12RenderObject18setPrefWidthsDirtyEbb
 __ZN7WebCore11RenderLayernwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderLayerC1EPNS_9RenderBoxE
-__ZNK7WebCore11RenderLayer20shouldBeOverflowOnlyEv
-__ZNK7WebCore15RenderContainer10firstChildEv
-__ZNK7WebCore8Document8settingsEv
+__ZN7WebCore11RenderLayerC1EPNS_20RenderBoxModelObjectE
+__ZN7WebCore11RenderLayerC2EPNS_20RenderBoxModelObjectE
+__ZNK7WebCore11RenderLayer22shouldBeNormalFlowOnlyEv
+__ZNK7WebCore11RenderBlock15virtualChildrenEv
 __ZNK7WebCore8Document14userStyleSheetEv
+__ZN7WebCore16CSSStyleSelectorC1EPNS_8DocumentERKNS_6StringEPNS_14StyleSheetListEPNS_13CSSStyleSheetEbb
 __ZN7WebCore16CSSStyleSelectorC2EPNS_8DocumentERKNS_6StringEPNS_14StyleSheetListEPNS_13CSSStyleSheetEbb
 __ZN7WebCore9FillLayerC1ENS_14EFillLayerTypeE
+__ZN7WebCore9FillLayerC2ENS_14EFillLayerTypeE
 __ZN7WebCore16CSSStyleSelector15SelectorCheckerC1EPNS_8DocumentEb
+__ZN7WebCore16CSSStyleSelector15SelectorCheckerC2EPNS_8DocumentEb
 __ZNK7WebCore12HTMLDocument14isHTMLDocumentEv
+__ZN7WebCore15CSSFontSelectorC1EPNS_8DocumentE
 __ZN7WebCore15CSSFontSelectorC2EPNS_8DocumentE
 __ZN7WebCore9fontCacheEv
 __ZN7WebCore9FontCache9addClientEPNS_12FontSelectorE
 __ZN3WTF7HashSetIPN7WebCore12FontSelectorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
 __ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
 __ZN7WebCore16CSSStyleSelector4initEv
 __ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE14shrinkCapacityEm
 __ZNK7WebCore8Document20cacheDocumentElementEv
 __ZN7WebCore10CSSRuleSetC1Ev
+__ZN7WebCore10CSSRuleSetC2Ev
 __ZN7WebCoreL12parseUASheetEPKcj
 __ZN7WebCoreL12parseUASheetERKNS_6StringE
 __ZN7WebCore13CSSStyleSheetC1EPS0_RKNS_6StringES4_
+__ZN7WebCore13CSSStyleSheetC2EPS0_RKNS_6StringES4_
 __ZN7WebCore10StyleSheetC2EPS0_RKNS_6StringE
 __ZN7WebCore13CSSStyleSheet11parseStringERKNS_6StringEb
 __ZN7WebCore9CSSParserC1Eb
+__ZN7WebCore9CSSParserC2Eb
 __ZN7WebCore9CSSParser10parseSheetEPNS_13CSSStyleSheetERKNS_6StringE
 __ZN7WebCore9CSSParser11setupParserEPKcRKNS_6StringES2_
 __Z10cssyyparsePv
@@ -638,18 +527,20 @@
 __ZNK7WebCore9CSSParser8documentEv
 __ZNK7WebCore13CSSStyleSheet15isCSSStyleSheetEv
 __ZN7WebCore9CSSParser22createFloatingSelectorEv
-__ZN7WebCore13QualifiedNameC1ERKS0_
 __ZN3WTF7HashSetIPN7WebCore11CSSSelectorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
 __ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateT
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocat
 __ZN7WebCore12AtomicString3addEPKti
-__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addIPKcNS1_17CStringTranslatorEEESt4pairINS_24HashTableIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EES4_S6_S6_EES3_EEbERKT_
-__ZN7WebCore13QualifiedNameaSERKS0_
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addINS1_11UCharBufferENS1_21UCharBufferTranslat
 __ZN7WebCore13QualifiedName5derefEv
-__ZN7WebCore13QualifiedNameD1Ev
 __ZN3WTF15deleteAllValuesIPN7WebCore11CSSSelectorELm0EEEvRKNS_6VectorIT_XT0_EEE
 __ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE6shrinkEm
 __ZN7WebCore9CSSParser20sinkFloatingSelectorEPNS_11CSSSelectorE
-__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAnd
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3
 __ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE14expandCapacityEmPKS3_
 __ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE14expandCapacityEm
 __ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE15reserveCapacityEm
@@ -658,27 +549,35 @@
 __ZN7WebCore17cssValueKeywordIDERKNS_15CSSParserStringE
 __ZN7WebCore9CSSParser23createFloatingValueListEv
 __ZN3WTF7HashSetIPN7WebCore18CSSParserValueListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6exp
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reh
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13al
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15de
 __ZN7WebCore9CSSParser17sinkFloatingValueERNS_14CSSParserValueE
 __ZN7WebCore18CSSParserValueList8addValueERKNS_14CSSParserValueE
 __ZN7WebCore9CSSParser21sinkFloatingValueListEPNS_18CSSParserValueListE
-__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4fin
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47re
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rem
 __ZN7WebCore9CSSParser10parseValueEib
 __ZN7WebCore9CSSParser21checkForOrphanedUnitsEv
 __ZN7WebCore9CSSParser17checkForVariablesEPNS_18CSSParserValueListE
 __ZN7WebCore17CSSPrimitiveValue16createIdentifierEi
 __ZN7WebCore17CSSPrimitiveValueC1Ei
+__ZN7WebCore17CSSPrimitiveValueC2Ei
 __ZN7WebCore9CSSParser11addPropertyEiN3WTF10PassRefPtrINS_8CSSValueEEEb
 __ZN7WebCore18CSSParserValueListD1Ev
-__ZN3WTF6VectorIN7WebCore14CSSParserValueELm16EE6shrinkEm
+__ZN7WebCore18CSSParserValueListD2Ev
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE6shrinkEm
 __ZN7WebCore9CSSParser15createStyleRuleEPN3WTF6VectorIPNS_11CSSSelectorELm0EEE
 __ZN7WebCore12CSSStyleRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore12CSSStyleRuleC2EPNS_13CSSStyleSheetE
 __ZN7WebCore15CSSSelectorList19adoptSelectorVectorERN3WTF6VectorIPNS_11CSSSelectorELm0EEE
 __ZN7WebCore15CSSSelectorList15deleteSelectorsEv
 __ZN7WebCore26CSSMutableStyleDeclarationC1EPNS_7CSSRuleEPKPKNS_11CSSPropertyEi
+__ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleEPKPKNS_11CSSPropertyEi
 __ZN7WebCore19CSSStyleDeclarationC2EPNS_7CSSRuleE
 __ZNK7WebCore9StyleBase16useStrictParsingEv
-__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EE15reserveCapacityEm
 __ZNK7WebCore8CSSValue24isVariableDependentValueEv
 __ZN7WebCore12CSSStyleRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE14expandCapacityEm
@@ -691,66 +590,109 @@
 __ZN7WebCore9CSSParser9validUnitEPNS_14CSSParserValueENS0_5UnitsEb
 __ZN7WebCore17CSSPrimitiveValue6createEdNS0_9UnitTypesE
 __ZN7WebCore17CSSPrimitiveValueC1EdNS0_9UnitTypesE
+__ZN7WebCore17CSSPrimitiveValueC2EdNS0_9UnitTypesE
 __ZN7WebCore15CSSParserString5lowerEv
 __ZNK7WebCore11CSSSelector17extractPseudoTypeEv
 __ZN7WebCoreL9hasPrefixEPKcjS1_
 __ZN7WebCore9CSSParser14parseShorthandEiPKiib
+__ZN7WebCore12CSSValueListC1Eb
+__ZN7WebCore12CSSValueListC2Eb
+__ZN7WebCore12CSSValueList6appendEN3WTF10PassRefPtrINS_8CSSValueEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE15reserveCapacityEm
+__ZN7WebCore11CSSSelector13setTagHistoryEPS0_
 __ZN7WebCore9CSSParserD1Ev
+__ZN7WebCore9CSSParserD2Ev
 __ZN7WebCore9CSSParser14clearVariablesEv
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE14shrinkCapacityEm
-__ZN3WTF15deleteAllValuesIPN7WebCore11CSSSelectorEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EESA_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore18CSSParserValueListEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EESA_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore17CSSParserFunctionEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EESA_EEEEvRT0_
-__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF15deleteAllValuesIPN7WebCore11CSSSelectorEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTr
+__ZN3WTF15deleteAllValuesIPN7WebCore18CSSParserValueListEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_1
+__ZN3WTF15deleteAllValuesIPN7WebCore17CSSParserFunctionEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dea
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE6shrinkEm
 __ZN7WebCoreL10screenEvalEv
 __ZN7WebCore19MediaQueryEvaluatorC1EPKcb
+__ZN7WebCore19MediaQueryEvaluatorC2EPKcb
 __ZN7WebCore10CSSRuleSet17addRulesFromSheetEPNS_13CSSStyleSheetERKNS_19MediaQueryEvaluatorEPNS_16CSSStyleSelectorE
 __ZN7WebCore12CSSStyleRule11isStyleRuleEv
 __ZN7WebCore10CSSRuleSet7addRuleEPNS_12CSSStyleRuleEPNS_11CSSSelectorE
-__ZN7WebCore10CSSRuleSet12addToRuleSetEPNS_16AtomicStringImplERN3WTF7HashMapIS2_PNS_15CSSRuleDataListENS3_7PtrHashIS2_EENS3_10HashTraitsIS2_EENS9_IS6_EEEEPNS_12CSSStyleRuleEPNS_11CSSSelectorE
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CSSRuleDataListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_15CSSRuleDataListEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6expandEv
+__ZN7WebCore10CSSRuleSet12addToRuleSetEPNS_16AtomicStringImplERN3WTF7HashMapIS2_PNS_15CSSRuleDataListENS3_7PtrHashIS2_EENS3_10H
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CSSRuleDataListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CSSRuleDataListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_15CSSRuleDataListEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
 __ZNK7WebCore9FrameView9mediaTypeEv
 __ZN7WebCore19MediaQueryEvaluatorC1ERKNS_6StringEb
+__ZN7WebCore19MediaQueryEvaluatorC2ERKNS_6StringEb
 __ZNK7WebCore14StyleSheetList6lengthEv
 __ZN7WebCore8Document11recalcStyleENS_4Node11StyleChangeE
 __ZNK7WebCore9FrameView10isPaintingEv
 __ZN7WebCore13ContainerNode26suspendPostAttachCallbacksEv
+__ZNK7WebCore8Document4pageEv
+__ZN7WebCore4Page32setMemoryCacheClientCallsEnabledEb
+__ZN7WebCore6Loader22suspendPendingRequestsEv
+__ZN7WebCore9FrameView20pauseScheduledEventsEv
 __ZN7WebCore11RenderStyle6createEv
 __ZN7WebCore11RenderStyleC1Ev
+__ZN7WebCore11RenderStyleC2Ev
 __ZN7WebCore11RenderStyle18createDefaultStyleEv
 __ZN7WebCore11RenderStyleC1Eb
+__ZN7WebCore11RenderStyleC2Eb
 __ZN7WebCore12StyleBoxDataC1Ev
+__ZN7WebCore12StyleBoxDataC2Ev
 __ZN7WebCore15StyleVisualDataC1Ev
+__ZN7WebCore15StyleVisualDataC2Ev
 __ZN7WebCore19StyleBackgroundDataC1Ev
+__ZN7WebCore19StyleBackgroundDataC2Ev
 __ZN7WebCore17StyleSurroundDataC1Ev
+__ZN7WebCore17StyleSurroundDataC2Ev
 __ZN7WebCore25StyleRareNonInheritedDataC1Ev
+__ZN7WebCore25StyleRareNonInheritedDataC2Ev
 __ZN7WebCore20StyleFlexibleBoxDataC1Ev
+__ZN7WebCore20StyleFlexibleBoxDataC2Ev
 __ZN7WebCore16StyleMarqueeDataC1Ev
+__ZN7WebCore16StyleMarqueeDataC2Ev
 __ZN7WebCore17StyleMultiColDataC1Ev
+__ZN7WebCore17StyleMultiColDataC2Ev
+__ZN7WebCore18StyleTransformDataC1Ev
 __ZN7WebCore18StyleTransformDataC2Ev
 __ZN7WebCore19TransformOperationsC1Eb
+__ZN7WebCore19TransformOperationsC2Eb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEC1ERKS5_
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEC2ERKS5_
 __ZN7WebCore22StyleRareInheritedDataC1Ev
+__ZN7WebCore22StyleRareInheritedDataC2Ev
 __ZN7WebCore18StyleInheritedDataC1Ev
+__ZN7WebCore18StyleInheritedDataC2Ev
 __ZN7WebCore4FontC1Ev
+__ZN7WebCore4FontC2Ev
 __ZN7WebCore14SVGRenderStyleC1Ev
+__ZN7WebCore14SVGRenderStyleC2Ev
 __ZN7WebCore14SVGRenderStyleC1ENS0_17CreateDefaultTypeE
+__ZN7WebCore14SVGRenderStyleC2ENS0_17CreateDefaultTypeE
 __ZN7WebCore13StyleFillDataC1Ev
+__ZN7WebCore13StyleFillDataC2Ev
 __ZN7WebCore8SVGPaint11defaultFillEv
 __ZN7WebCore8SVGPaintC1ERKNS_5ColorE
-__ZN7WebCore8SVGColorC1ERKNS_5ColorE
+__ZN7WebCore8SVGPaintC2ERKNS_5ColorE
+__ZN7WebCore8SVGColorC2ERKNS_5ColorE
 __ZN7WebCore15StyleStrokeDataC1Ev
+__ZN7WebCore15StyleStrokeDataC2Ev
 __ZN7WebCore8SVGPaint13defaultStrokeEv
 __ZN7WebCore8SVGPaintC1ENS0_12SVGPaintTypeE
+__ZN7WebCore8SVGPaintC2ENS0_12SVGPaintTypeE
 __ZN7WebCore8SVGColorC2Ev
 __ZN7WebCore13StyleTextDataC1Ev
+__ZN7WebCore13StyleTextDataC2Ev
 __ZN7WebCore13StyleStopDataC1Ev
+__ZN7WebCore13StyleStopDataC2Ev
 __ZN7WebCore13StyleClipDataC1Ev
+__ZN7WebCore13StyleClipDataC2Ev
 __ZN7WebCore13StyleMaskDataC1Ev
+__ZN7WebCore13StyleMaskDataC2Ev
 __ZN7WebCore13StyleMiscDataC1Ev
+__ZN7WebCore13StyleMiscDataC2Ev
 __ZN7WebCore15StyleMarkerDataC1Ev
+__ZN7WebCore15StyleMarkerDataC2Ev
 __ZNK7WebCore5Frame19shouldApplyPageZoomEv
 __ZNK7WebCore8Settings17fontRenderingModeEv
 __ZNK7WebCore16CSSStyleSelector18fontSizeForKeywordEibb
@@ -759,107 +701,140 @@
 __ZNK7WebCore5Frame19shouldApplyTextZoomEv
 __ZN7WebCoreeqERKNS_10FontFamilyES2_
 __ZN7WebCore4FontC1ERKNS_15FontDescriptionEss
+__ZN7WebCore4FontC2ERKNS_15FontDescriptionEss
 __ZN7WebCore10FontFamilyC1ERKS0_
+__ZN7WebCore10FontFamilyC2ERKS0_
 __ZN7WebCore18StyleInheritedDataC1ERKS0_
+__ZN7WebCore18StyleInheritedDataC2ERKS0_
 __ZN7WebCore4FontC1ERKS0_
+__ZN7WebCore4FontC2ERKS0_
 __ZN7WebCore4FontaSERKS0_
 __ZN7WebCore10FontFamilyaSERKS0_
-__ZN3WTF9HashTableIiSt4pairIiPN7WebCore17GlyphPageTreeNodeEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSB_IS4_EEEESC_EaSERKSF_
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore17GlyphPageTreeNodeEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_
 __ZN7WebCore4FontD1Ev
+__ZN7WebCore4FontD2Ev
 __ZNK7WebCore4Font6updateEN3WTF10PassRefPtrINS_12FontSelectorEEE
 __ZN7WebCore16FontFallbackListC1Ev
+__ZN7WebCore16FontFallbackListC2Ev
 __ZN7WebCore9FontCache10generationEv
 __ZN7WebCore16FontFallbackList10invalidateEN3WTF10PassRefPtrINS_12FontSelectorEEE
 __ZN7WebCore16FontFallbackList15releaseFontDataEv
 __ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE14shrinkCapacityEm
 __ZN7WebCore4Node4diffEPNS_11RenderStyleES2_
-__ZNK7WebCore11RenderStyle14hasPseudoStyleENS0_8PseudoIdE
+__ZNK7WebCore11RenderStyle14hasPseudoStyleENS_8PseudoIdE
 __ZN7WebCore12RenderObject8setStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
-__ZN7WebCore11RenderBlock15styleWillChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore9RenderBox15styleWillChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore12RenderObject15styleWillChangeENS_11RenderStyle4DiffEPKS1_
+__ZNK7WebCore12RenderObject21adjustStyleDifferenceENS_15StyleDifferenceEj
+__ZN7WebCore11RenderBlock15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore9RenderBox15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore20RenderBoxModelObject15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore11RenderLayer19isSelfPaintingLayerEv
+__ZN7WebCore12RenderObject15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZNK7WebCore12RenderObject4viewEv
 __ZN7WebCore12RenderObject16updateFillImagesEPKNS_9FillLayerES3_
 __ZN7WebCore12RenderObject11updateImageEPNS_10StyleImageES2_
-__ZN7WebCore11RenderBlock14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore9RenderBox14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore12RenderObject14styleDidChangeENS_11RenderStyle4DiffEPKS1_
+__ZN7WebCore11RenderBlock14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore9RenderBox14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore20RenderBoxModelObject14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderObject14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore9RenderBox27updateBoxModelInfoFromStyleEv
+__ZN7WebCore20RenderBoxModelObject27updateBoxModelInfoFromStyleEv
 __ZNK7WebCore10RenderView12isRenderViewEv
-__ZNK7WebCore9RenderBox13requiresLayerEv
-__ZN7WebCore11RenderLayer12styleChangedENS_11RenderStyle4DiffEPKS1_
+__ZNK7WebCore20RenderBoxModelObject13requiresLayerEv
+__ZN7WebCore11RenderLayer12styleChangedENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZN7WebCore11RenderLayer23updateScrollCornerStyleEv
+__ZN7WebCore4Node18shadowAncestorNodeEv
+__ZNK7WebCore4Node12isSVGElementEv
+__ZN7WebCore4Node18shadowTreeRootNodeEv
+__ZNK7WebCore4Node12isShadowNodeEv
 __ZN7WebCore11RenderLayer18updateResizerStyleEv
 __ZNK7WebCore12RenderObject6isBodyEv
 __ZN7WebCore11RenderBlock17updateFirstLetterEv
-__ZN7WebCore4Node10setChangedENS_15StyleChangeTypeE
-__ZN7WebCore8Document18setDocumentChangedEb
+__ZN7WebCore4Node19setNeedsStyleRecalcENS_15StyleChangeTypeE
+__ZN7WebCore8Document21unscheduleStyleRecalcEv
+__ZN7WebCore9FrameView21resumeScheduledEventsEv
+__ZN7WebCore9FrameView23dispatchScheduledEventsEv
 __ZN7WebCore13ContainerNode25resumePostAttachCallbacksEv
+__ZN7WebCore11FrameLoader35tellClientAboutPastMemoryCacheLoadsEv
+__ZN7WebCore6Loader21resumePendingRequestsEv
+__ZNK7WebCore6Loader4Host11hasRequestsEv
 __ZN7WebCore13ContainerNode6attachEv
 __ZN7WebCore4Node6attachEv
 __ZN7WebCore16ScriptController14updateDocumentEv
 __ZN7WebCore8Document6setURLERKNS_4KURLE
 __ZN7WebCore8Document13updateBaseURLEv
 __ZN7WebCore4KURLC1ERKS0_RKNS_6StringE
+__ZN7WebCore4KURLC2ERKS0_RKNS_6StringE
 __ZN7WebCore4KURL4initERKS0_RKNS_6StringERKNS_12TextEncodingE
-__ZN7WebCore10StringImpl4findEti
-__ZN3WTF6VectorIcLm512EE6resizeEm
 __ZN7WebCoreL9copyASCIIEPKtiPc
 __ZN7WebCore17equalIgnoringCaseEPNS_10StringImplES1_
 __ZN3WTF6VectorIcLm512EE6shrinkEm
 __ZNK7WebCore5Frame9domWindowEv
 __ZN7WebCore9DOMWindowC1EPNS_5FrameE
-__ZN7WebCore11FrameLoader19updatePolicyBaseURLEv
-__ZN7WebCore11FrameLoader16setPolicyBaseURLERKNS_4KURLE
+__ZN7WebCore9DOMWindowC2EPNS_5FrameE
+__ZN7WebCore11FrameLoader26updateFirstPartyForCookiesEv
+__ZN7WebCore11FrameLoader23setFirstPartyForCookiesERKNS_4KURLE
 __ZN7WebCore9DocLoader17setAutoLoadImagesEb
 __ZNK7WebCore20ResourceResponseBase15httpHeaderFieldERKNS_12AtomicStringE
+__ZNK3WTF7HashMapIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3getERKS2_
 __ZN7WebCore12AtomicString6removeEPNS_10StringImplE
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E47removeAndI
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E6removeEPS3_
 __ZN7WebCore11FrameLoader20restoreDocumentStateEv
 __ZN7WebCore8Document12implicitOpenEv
 __ZN7WebCore8Document13cancelParsingEv
 __ZN7WebCore8Document5clearEv
 __ZN7WebCore13ContainerNode14removeChildrenEv
+__ZNK7WebCore8Document9domWindowEv
+__ZN7WebCore9DOMWindow23removeAllEventListenersEv
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE14shrinkCapacityEm
+__ZN7WebCoreL29pendingUnloadEventListenerMapEv
+__ZN7WebCoreL27removePendingEventListenersERN3WTF7HashMapIPNS_9DOMWindowEPNS0_6VectorINS0_6RefPtrINS_23RegisteredEventListenerE
+__ZN3WTF7HashMapIPN7WebCore9DOMWindowEPNS_6VectorINS_6RefPtrINS1_23RegisteredEventListenerEEELm0EEENS_7PtrHashIS3_EENS_10HashTr
+__ZN7WebCoreL35pendingBeforeUnloadEventListenerMapEv
 __ZN7WebCore12HTMLDocument15createTokenizerEv
 __ZN7WebCore19InspectorController13windowVisibleEv
 __ZN7WebCore13HTMLTokenizerC1EPNS_12HTMLDocumentEb
+__ZN7WebCore13HTMLTokenizerC2EPNS_12HTMLDocumentEb
 __ZN7WebCore10HTMLParserC1EPNS_12HTMLDocumentEb
+__ZN7WebCore10HTMLParserC2EPNS_12HTMLDocumentEb
 __ZN7WebCore13HTMLTokenizer5beginEv
 __ZN7WebCore13HTMLTokenizer5resetEv
 __ZN3WTF6VectorItLm0EE14shrinkCapacityEm
 __ZN7WebCore15SegmentedString5clearEv
-__ZNK7WebCore8Document4pageEv
 __ZN7WebCore8Document10setParsingEb
+__ZNK7WebCore5Frame9animationEv
+__ZN7WebCore19AnimationController20beginAnimationUpdateEv
 __ZN7WebCore9FrameView15setContentsSizeERKNS_7IntSizeE
 __ZN7WebCore10ScrollView15setContentsSizeERKNS_7IntSizeE
 __ZNK7WebCore10ScrollView12contentsSizeEv
 __ZNK7WebCore10ScrollView20platformContentsSizeEv
 __ZNK7WebCore10ScrollView12documentViewEv
-__ZN7WebCore16enclosingIntRectERK7_NSRect
+__ZN7WebCore16enclosingIntRectERK6CGRect
 __ZNK7WebCore6Chrome19contentsSizeChangedEPNS_5FrameERKNS_7IntSizeE
 __ZN7WebCore11FrameLoader5writeEPKcib
 __ZNK7WebCore9Tokenizer12wantsRawDataEv
 __ZN7WebCore12TextEncodingC1ERKNS_6StringE
+__ZN7WebCore12TextEncodingC2ERKNS_6StringE
 __ZN7WebCore31atomicCanonicalTextEncodingNameEPKtm
-__ZN7WebCore19TextResourceDecoderC1ERKNS_6StringERKNS_12TextEncodingE
+__ZN7WebCore19TextResourceDecoderC1ERKNS_6StringERKNS_12TextEncodingEb
+__ZN7WebCore19TextResourceDecoderC2ERKNS_6StringERKNS_12TextEncodingEb
 __ZN7WebCore19TextResourceDecoder20determineContentTypeERKNS_6StringE
 __ZN7WebCore17equalIgnoringCaseEPNS_10StringImplEPKc
 __ZN7WebCore19TextResourceDecoder15defaultEncodingENS0_11ContentTypeERKNS_12TextEncodingE
 __ZN7WebCore14Latin1EncodingEv
-__ZN7WebCore11TextDecoderC1ERKNS_12TextEncodingE
 __ZN7WebCore8Document10setDecoderEN3WTF10PassRefPtrINS_19TextResourceDecoderEEE
 __ZN7WebCore19TextResourceDecoder6decodeEPKcm
 __ZN7WebCore19TextResourceDecoder11checkForBOMEPKcm
 __ZN7WebCore19TextResourceDecoder19checkForHeadCharsetEPKcmRb
 __ZN3WTF6VectorIcLm0EE4growEm
 __ZN7WebCore19TextResourceDecoder5flushEv
-__ZN7WebCore11TextDecoder11checkForBOMEPKcmbbRb
 __ZN7WebCore12newTextCodecERKNS_12TextEncodingE
-__ZN3WTF7HashMapIPKcN7WebCore16TextCodecFactoryENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS7_IS4_EEE3addERKS2_RKS4_
+__ZNK3WTF7HashMapIPKcN7WebCore16TextCodecFactoryENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS7_IS4_EEE3getERKS2_
 __ZN7WebCoreL36newStreamingTextDecoderWindowsLatin1ERKNS_12TextEncodingEPKv
 __ZN7WebCore15TextCodecLatin16decodeEPKcmbbRb
 __ZN3WTF6VectorIcLm0EE14shrinkCapacityEm
-__ZN7WebCore11TextDecoder5resetERKNS_12TextEncodingE
-__ZN7WebCore9TextCodecD0Ev
+__ZN7WebCore15TextCodecLatin1D0Ev
+__ZN7WebCore9TextCodecD2Ev
 __ZN7WebCore8Document13finishParsingEv
 __ZN7WebCore13HTMLTokenizer6finishEv
 __ZN7WebCore13HTMLTokenizer3endEv
@@ -867,9 +842,10 @@
 __ZN7WebCore16ScriptController9isEnabledEv
 __ZN7WebCore10HTMLParser8finishedEv
 __ZN7WebCore15HTMLHtmlElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore11HTMLElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLHtmlElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore11HTMLElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore13StyledElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore7ElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore7ElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore10HTMLParser10insertNodeEPNS_4NodeEb
 __ZNK7WebCore7Element16virtualLocalNameEv
 __ZNK7WebCore11HTMLElement13isHTMLElementEv
@@ -880,9 +856,8 @@
 __ZN7WebCore15HTMLHtmlElement20insertedIntoDocumentEv
 __ZN7WebCore7Element20insertedIntoDocumentEv
 __ZN7WebCore13ContainerNode20insertedIntoDocumentEv
-__ZN7WebCore15EventTargetNode20insertedIntoDocumentEv
-__ZNK7WebCore15EventTargetNode14eventListenersEv
 __ZN7WebCore4Node20insertedIntoDocumentEv
+__ZNK7WebCore4Node14eventListenersEv
 __ZN7WebCore13ContainerNode16insertedIntoTreeEb
 __ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
 __ZN7WebCore21ApplicationCacheGroup29selectCacheWithoutManifestURLEPNS_5FrameE
@@ -894,7 +869,7 @@
 __ZN7WebCore7Element6attachEv
 __ZN7WebCore4Node22createRendererIfNeededEv
 __ZN7WebCore8Document21shouldCreateRenderersEv
-__ZNK7WebCore15RenderContainer15canHaveChildrenEv
+__ZNK7WebCore12RenderObject15canHaveChildrenEv
 __ZNK7WebCore4Node25childShouldCreateRendererEPS0_
 __ZN7WebCore4Node16styleForRendererEv
 __ZN7WebCore16CSSStyleSelector15styleForElementEPNS_7ElementEPNS_11RenderStyleEbb
@@ -902,18 +877,17 @@
 __ZNK7WebCore13StyledElement15isStyledElementEv
 __ZN7WebCore16CSSStyleSelector17locateSharedStyleEv
 __ZN7WebCore16CSSStyleSelector16locateCousinListEPNS_7ElementEj
-__ZN7WebCore16CSSStyleSelector19initForStyleResolveEPNS_7ElementEPNS_11RenderStyleENS3_8PseudoIdE
+__ZN7WebCore16CSSStyleSelector19initForStyleResolveEPNS_7ElementEPNS_11RenderStyleENS_8PseudoIdE
 __ZN7WebCore11RenderStyle11inheritFromEPKS0_
 __ZN7WebCoreL31elementCanUseSimpleDefaultStyleEPNS_7ElementE
-__ZNK7WebCore4Node12isSVGElementEv
 __ZN7WebCore16CSSStyleSelector12matchUARulesERiS1_
 __ZNK7WebCore19MediaQueryEvaluator22mediaTypeMatchSpecificEPKc
 __ZN7WebCore16CSSStyleSelector10matchRulesEPNS_10CSSRuleSetERiS3_
 __ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE14shrinkCapacityEm
 __ZN7WebCore16CSSStyleSelector17matchRulesForListEPNS_15CSSRuleDataListERiS3_
 __ZN7WebCore16CSSStyleSelector13checkSelectorEPNS_11CSSSelectorE
-__ZNK7WebCore16CSSStyleSelector15SelectorChecker13checkSelectorEPNS_11CSSSelectorEPNS_7ElementEPN3WTF7HashSetIPNS_16AtomicStringImplENS6_7PtrHashIS9_EENS6_10HashTraitsIS9_EEEERNS_11RenderStyle8PseudoIdEbbPSG_SJ_
-__ZNK7WebCore16CSSStyleSelector15SelectorChecker16checkOneSelectorEPNS_11CSSSelectorEPNS_7ElementEPN3WTF7HashSetIPNS_16AtomicStringImplENS6_7PtrHashIS9_EENS6_10HashTraitsIS9_EEEERNS_11RenderStyle8PseudoIdEbbPSG_SJ_
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker13checkSelectorEPNS_11CSSSelectorEPNS_7ElementEPN3WTF7HashSetIPNS_16AtomicStrin
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker16checkOneSelectorEPNS_11CSSSelectorEPNS_7ElementEPN3WTF7HashSetIPNS_16AtomicSt
 __ZNK7WebCore26CSSMutableStyleDeclaration6lengthEv
 __ZN7WebCore16CSSStyleSelector16sortMatchedRulesEjj
 __ZN7WebCore16CSSStyleSelector21addMatchedDeclarationEPNS_26CSSMutableStyleDeclarationE
@@ -926,54 +900,49 @@
 __ZN7WebCore16CSSStyleSelector24cacheBorderAndBackgroundEv
 __ZN7WebCore16CSSStyleSelector17adjustRenderStyleEPNS_11RenderStyleEPNS_7ElementE
 __ZN7WebCore12StyleBoxDataC1ERKS0_
+__ZN7WebCore12StyleBoxDataC2ERKS0_
 __ZN7WebCore11RenderStyle16adjustAnimationsEv
 __ZN7WebCore11RenderStyle17adjustTransitionsEv
-__ZNK7WebCore4Node9isControlEv
+__ZNK7WebCore7Element20isFormControlElementEv
 __ZN7WebCore11HTMLElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore4Node16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore11HTMLElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
 __ZN7WebCore12RenderObject12createObjectEPNS_4NodeEPNS_11RenderStyleE
+__ZN7WebCore11RenderBlockC1EPNS_4NodeE
 __ZNK7WebCore12RenderObject14isChildAllowedEPS0_PNS_11RenderStyleE
 __ZN7WebCore12RenderObject18setAnimatableStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
 __ZNK7WebCore12RenderObject9animationEv
-__ZNK7WebCore5Frame9animationEv
 __ZN7WebCore19AnimationController16updateAnimationsEPNS_12RenderObjectEPNS_11RenderStyleE
 __ZNK7WebCore12RenderObject12isRenderViewEv
 __ZN7WebCore11RenderLayer19insertOnlyThisLayerEv
 __ZN7WebCore11RenderLayer34clearClipRectsIncludingDescendantsEv
-__ZN7WebCore4Node18shadowAncestorNodeEv
-__ZN7WebCore4Node18shadowTreeRootNodeEv
-__ZNK7WebCore4Node12isShadowNodeEv
 __ZN7WebCore4Node12nextRendererEv
-__ZN7WebCore10RenderFlow8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore11RenderBlock14addChildToFlowEPNS_12RenderObjectES2_
-__ZNK7WebCore15RenderContainer9lastChildEv
-__ZNK7WebCore15RenderContainer14isAfterContentEPNS_12RenderObjectE
+__ZN7WebCore11RenderBlock8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore9RenderBox14isAfterContentEPNS_12RenderObjectE
 __ZN7WebCore11RenderBlock21makeChildrenNonInlineEPNS_12RenderObjectE
-__ZN7WebCore15RenderContainer8addChildEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderObject8addChildEPS0_S1_
+__ZN7WebCore11RenderBlock15virtualChildrenEv
 __ZNK7WebCore12RenderObject10isListItemEv
 __ZNK7WebCore12RenderObject10isTableColEv
 __ZNK7WebCore11RenderBlock13isRenderBlockEv
 __ZNK7WebCore12RenderObject14isTableSectionEv
 __ZNK7WebCore12RenderObject10isTableRowEv
 __ZNK7WebCore12RenderObject11isTableCellEv
-__ZN7WebCore15RenderContainer15insertChildNodeEPNS_12RenderObjectES2_b
-__ZN7WebCore15RenderContainer15appendChildNodeEPNS_12RenderObjectEb
+__ZN7WebCore21RenderObjectChildList15insertChildNodeEPNS_12RenderObjectES2_S2_b
+__ZN7WebCore21RenderObjectChildList15appendChildNodeEPNS_12RenderObjectES2_b
 __ZNK7WebCore12RenderObject14enclosingLayerEv
 __ZN7WebCore12RenderObject9addLayersEPNS_11RenderLayerEPS0_
 __ZN7WebCoreL9addLayersEPNS_12RenderObjectEPNS_11RenderLayerERS1_RS3_
 __ZN7WebCore12RenderObject13findNextLayerEPNS_11RenderLayerEPS0_b
 __ZN7WebCore11RenderLayer8addChildEPS0_S1_
+__ZN7WebCore11RenderLayer9setParentEPS0_
 __ZN7WebCore11RenderLayer31dirtyStackingContextZOrderListsEv
 __ZNK7WebCore11RenderLayer15stackingContextEv
 __ZN7WebCore11RenderLayer16dirtyZOrderListsEv
 __ZN7WebCore11RenderLayer22updateVisibilityStatusEv
 __ZN7WebCore11RenderLayer22childVisibilityChangedEb
-__ZNK7WebCore11RenderBlock14childrenInlineEv
-__ZN7WebCore12RenderObject14setNeedsLayoutEbb
-__ZN7WebCore12RenderObject29markContainingBlocksForLayoutEbPS0_
 __ZNK7WebCore12RenderObject9containerEv
-__ZNK7WebCore12RenderObject11isTextFieldEv
-__ZNK7WebCore12RenderObject10isTextAreaEv
+__ZNK7WebCore12RenderObject13isTextControlEv
 __ZNK7WebCore12RenderObject9isSVGRootEv
 __ZN7WebCore12RenderObject16scheduleRelayoutEv
 __ZN7WebCore9FrameView16scheduleRelayoutEv
@@ -981,8 +950,10 @@
 __ZNK7WebCore5Frame15contentRendererEv
 __ZNK7WebCore9FrameView13layoutPendingEv
 __ZN7WebCore8Document20shouldScheduleLayoutEv
-__ZN7WebCore8Document4bodyEv
+__ZNK7WebCore8Document4bodyEv
+__ZN7WebCore12RenderObject24setLayerNeedsFullRepaintEv
 __ZN7WebCore12RenderObject29invalidateContainerPrefWidthsEv
+__ZN7WebCore11FrameLoader32dispatchDocumentElementAvailableEv
 __ZN7WebCore10HTMLParser9freeBlockEv
 __ZN7WebCore10HTMLParser11popOneBlockEv
 __ZN7WebCore7Element21finishParsingChildrenEv
@@ -990,65 +961,87 @@
 __ZN7WebCore10HTMLParser10setCurrentEPNS_4NodeE
 __ZN7WebCore8Document15finishedParsingEv
 __ZN7WebCore5EventC1ERKNS_12AtomicStringEbb
-__ZN7WebCore15EventTargetNode13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
-__ZThn32_N7WebCore15EventTargetNode14refEventTargetEv
-__ZN7WebCore15EventTargetNode14refEventTargetEv
+__ZN7WebCore5EventC2ERKNS_12AtomicStringEbb
+__ZN7WebCore4Node13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore4Node14refEventTargetEv
 __ZN7WebCore5Event9setTargetEN3WTF10PassRefPtrINS_11EventTargetEEE
 __ZN7WebCore5Event14receivedTargetEv
-__ZN7WebCore15EventTargetNode20dispatchGenericEventEN3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore4Node20dispatchGenericEventEN3WTF10PassRefPtrINS_5EventEEE
 __ZN7WebCore4Node15eventParentNodeEv
 __ZN7WebCore11EventTarget23preDispatchEventHandlerEPNS_5EventE
-__ZN7WebCore8Document17handleWindowEventEPNS_5EventEb
-__ZN7WebCore15EventTargetNode17handleLocalEventsEPNS_5EventEb
-__ZNK7WebCore15EventTargetNode8disabledEv
+__ZNK7WebCore9DOMWindow8documentEv
+__ZN7WebCore9DOMWindow11handleEventEPNS_5EventEbPN3WTF6VectorINS3_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
+__ZN7WebCore4Node17handleLocalEventsEPNS_5EventEb
+__ZNK7WebCore4Node8disabledEv
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EEC2ERKS5_
 __ZN7WebCore11EventTarget24postDispatchEventHandlerEPNS_5EventEPv
-__ZN7WebCore15EventTargetNode19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore8Document24updateDocumentsRenderingEv
-__ZThn32_N7WebCore15EventTargetNode16derefEventTargetEv
-__ZN7WebCore15EventTargetNode16derefEventTargetEv
+__ZN7WebCore4Node19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore8Document26updateStyleForAllDocumentsEv
+__ZN7WebCore5EventD0Ev
+__ZN7WebCore4Node16derefEventTargetEv
 __ZN7WebCore11FrameLoader15finishedParsingEv
-__ZN7WebCore10HTMLParserD1Ev
+__ZN7WebCore13HTMLTokenizerD0Ev
+__ZN7WebCore10HTMLParserD0Ev
+__ZN7WebCore9TimerBaseD2Ev
 __ZN7WebCore8Document5closeEv
+__ZN7WebCore11FrameLoader14checkCompletedEv
+__ZN7WebCore9FrameView33checkStopDelayingDeferredRepaintsEv
 __ZN7WebCoreL11numRequestsEPNS_8DocumentE
 __ZN7WebCore9DocLoader12requestCountEv
+__ZN7WebCore11FrameLoader22checkCallImplicitCloseEv
 __ZN7WebCore8Document13implicitCloseEv
+__ZN7WebCore11FrameLoader9completedEv
+__ZN7WebCore11FrameLoader17checkLoadCompleteEv
+__ZN7WebCore11FrameLoader26recursiveCheckLoadCompleteEv
+__ZN7WebCore11FrameLoader29checkLoadCompleteForThisFrameEv
+__ZNK7WebCore14DocumentLoader19isLoadingInAPISenseEv
+__ZNK7WebCore11FrameLoader17subframeIsLoadingEv
+__ZN7WebCore11FrameLoader16markLoadCompleteEv
+__ZN7WebCore11FrameLoader18frameLoadCompletedEv
+__ZN7WebCore14DocumentLoader22stopRecordingResponsesEv
 __ZN7WebCore8Settings16setZoomsTextOnlyEb
 __ZN7WebCore5Frame13setZoomFactorEfb
 __ZNK7WebCore5Frame20isZoomFactorTextOnlyEv
 __ZN7WebCore12SchedulePairC1EP9NSRunLoopPK10__CFString
+__ZN7WebCore12SchedulePairC2EP9NSRunLoopPK10__CFString
 __ZN7WebCore4Page15addSchedulePairEN3WTF10PassRefPtrINS_12SchedulePairEEE
 __ZN3WTF7HashSetINS_6RefPtrIN7WebCore12SchedulePairEEENS2_16SchedulePairHashENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore12SchedulePairEEES4_NS_17IdentityExtractorIS4_EENS2_16SchedulePairHashENS_10HashTraitsIS4_EES9_E6expandEv
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore12SchedulePairEEES4_NS_17IdentityExtractorIS4_EENS2_16SchedulePairHashENS_10HashTraitsIS
 __ZN7WebCore14DocumentLoader8scheduleEPNS_12SchedulePairE
-__ZN7WebCoreL11scheduleAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEEPNS_12SchedulePairE
-__ZNK7WebCore11FrameLoader25provisionalDocumentLoaderEv
+__ZN7WebCoreL11scheduleAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEEPNS_12Sc
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14ResourceLoaderEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EE
 __ZN7WebCore4Page12setGroupNameERKNS_6StringE
 __ZN7WebCore9PageGroup9pageGroupERKNS_6StringE
 __ZN3WTF7HashMapIN7WebCore6StringEPNS1_9PageGroupENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3addERKS2_RKS4_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_9PageGroupEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E6expandEv
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_9PageGroupEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTrai
 __ZN7WebCore9PageGroupC1ERKNS_6StringE
+__ZN7WebCore9PageGroupC2ERKNS_6StringE
 __ZN7WebCoreL19getUniqueIdentifierEv
 __ZN7WebCore9PageGroup7addPageEPNS_4PageE
 __ZN7WebCore12LocalStorage12localStorageERKNS_6StringE
 __ZN7WebCoreL15localStorageMapEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_12LocalStorageEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E4findIS2_NS_22IdentityHashTranslatorIS2_S6_S9_EEEENS_17HashTableIteratorIS2_S6_S8_S9_SE_SC_EERKT_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_12LocalStorageEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHash
 __ZN7WebCore12LocalStorageC1ERKNS_6StringE
+__ZN7WebCore12LocalStorageC2ERKNS_6StringE
 __ZN7WebCore18LocalStorageThread6createEv
 __ZN7WebCore18LocalStorageThreadC1Ev
+__ZN7WebCore18LocalStorageThreadC2Ev
 __ZN7WebCore18LocalStorageThread5startEv
 __ZN7WebCore18LocalStorageThread14scheduleImportEN3WTF10PassRefPtrINS_12LocalStorageEEE
-__ZN7WebCore18LocalStorageThread23localStorageThreadStartEPv
 __ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEN3WTF10PassRefPtrINS_12LocalStorageEEE
-__ZN7WebCore18LocalStorageThread18localStorageThreadEv
+__ZN7WebCore16LocalStorageTaskC2ENS0_4TypeEN3WTF10PassRefPtrINS_12LocalStorageEEE
+__ZN7WebCore18LocalStorageThread23localStorageThreadStartEPv
 __ZN3WTF5DequeINS_6RefPtrIN7WebCore16LocalStorageTaskEEEE14expandCapacityEv
+__ZN7WebCore18LocalStorageThread18localStorageThreadEv
 __ZN3WTF7HashMapIN7WebCore6StringEPNS1_12LocalStorageENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF12MessageQueueINS_6RefPtrIN7WebCore16LocalStorageTaskEEEE19alwaysTruePredicateERS4_
 __ZN7WebCore16LocalStorageTask11performTaskEv
 __ZN7WebCore12LocalStorage13performImportEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_12LocalStorageEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E6expandEv
 __ZN7WebCore5Cache13setCapacitiesEjjj
 __ZN7WebCore9pageCacheEv
 __ZN7WebCore9PageCacheC1Ev
+__ZN7WebCore9PageCacheC2Ev
 __ZN7WebCore9PageCache11setCapacityEi
 __ZN7WebCore9PageCache5pruneEv
 __ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addERKS3_
@@ -1058,12 +1051,15 @@
 __ZN7WebCore8Settings23setDefaultFixedFontSizeEi
 __ZN7WebCore8Settings18setDefaultFontSizeEi
 __ZN7WebCore8Settings26setDefaultTextEncodingNameERKNS_6StringE
+__ZN7WebCore8Settings23setUsesEncodingDetectorEb
 __ZN7WebCore8Settings20setFantasyFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings18setFixedFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings28setForceFTPDirectoryListingsEb
 __ZN7WebCore8Settings27setFTPDirectoryTemplatePathERKNS_6StringE
 __ZN7WebCore8Settings14setJavaEnabledEb
 __ZN7WebCore8Settings20setJavaScriptEnabledEb
+__ZN7WebCore8Settings21setWebSecurityEnabledEb
+__ZN7WebCore8Settings35setAllowUniversalAccessFromFileURLsEb
 __ZN7WebCore8Settings40setJavaScriptCanOpenWindowsAutomaticallyEb
 __ZN7WebCore8Settings18setMinimumFontSizeEi
 __ZN7WebCore8Settings25setMinimumLogicalFontSizeEi
@@ -1087,31 +1083,37 @@
 __ZN7WebCore8Settings29setAuthorAndUserStylesEnabledEb
 __ZN7WebCore8Settings24setApplicationChromeModeEb
 __ZN7WebCore4KURLC1EP5NSURL
+__ZN7WebCore4KURLC2EP5NSURL
 __ZN7WebCore8Settings25setUserStyleSheetLocationERKNS_4KURLE
 __ZN7WebCore4Page29userStyleSheetLocationChangedEv
 __ZN7WebCore8Settings32setNeedsAdobeFrameReloadingQuirkEb
 __ZN7WebCore8Settings41setNeedsKeyboardEventDisambiguationQuirksEb
+__ZN7WebCore8Settings25setNeedsLeopardMailQuirksEb
+__ZN7WebCore8Settings23setNeedsTigerMailQuirksEb
 __ZN7WebCore8Settings26setNeedsSiteSpecificQuirksEb
 __ZN7WebCore8Settings29setWebArchiveDebugModeEnabledEb
-__ZN7WebCore8Settings35disableRangeMutationForOldAppleMailEb
 __ZN7WebCore8Settings36setOfflineWebApplicationCacheEnabledEb
 __ZN7WebCore8Settings33setEnforceCSSMIMETypeInStrictModeEb
 __ZN7WebCore4Page15backForwardListEv
 __ZN7WebCore15BackForwardList10setEnabledEb
-__ZN7WebCore4Page32setMemoryCacheClientCallsEnabledEb
 __ZN7WebCore15BackForwardList7enabledEv
 __ZN7WebCore15BackForwardList11setCapacityEi
-__ZN7WebCore7IntSizeC1ERK7_NSSize
+__ZN7WebCore7IntSizeC1ERK6CGSize
+__ZN7WebCore7IntSizeC2ERK6CGSize
 __ZN7WebCore12IconDatabase11defaultIconERKNS_7IntSizeE
 __ZN7WebCore10IconRecordC1ERKNS_6StringE
+__ZN7WebCore10IconRecordC2ERKNS_6StringE
 __ZN7WebCore12SharedBufferC1EPKhi
+__ZN7WebCore12SharedBufferC2EPKhi
 __ZN3WTF6VectorIcLm0EE6appendIhEEvPKT_m
 __ZN3WTF6VectorIcLm0EE14expandCapacityEm
 __ZN3WTF6VectorIcLm0EE15reserveCapacityEm
 __ZN7WebCore10IconRecord12setImageDataEN3WTF10PassRefPtrINS_12SharedBufferEEE
 __ZN7WebCore11BitmapImageC1EPNS_13ImageObserverE
+__ZN7WebCore11BitmapImageC2EPNS_13ImageObserverE
 __ZN7WebCore5ImageC2EPNS_13ImageObserverE
 __ZN7WebCore11ImageSourceC1Ev
+__ZN7WebCore11ImageSourceC2Ev
 __ZN7WebCore11BitmapImage16initPlatformDataEv
 __ZN7WebCore5Image7setDataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
 __ZNK7WebCore12SharedBuffer4sizeEv
@@ -1123,6 +1125,7 @@
 __ZN7WebCore11ImageSource7setDataEPNS_12SharedBufferEb
 __ZN7WebCore12SharedBuffer12createCFDataEv
 +[WebCoreSharedBufferData initialize]
+-[WebCoreSharedBufferData .cxx_construct]
 -[WebCoreSharedBufferData initWithSharedBuffer:]
 -[WebCoreSharedBufferData length]
 __ZN7WebCore11BitmapImage15isSizeAvailableEv
@@ -1151,72 +1154,84 @@
 __ZN3WTF6VectorIP7CGImageLm0EE14expandCapacityEm
 __ZN3WTF6VectorIP7CGImageLm0EE15reserveCapacityEm
 __ZN3WTF6VectorIP7CGImageLm0EE6shrinkEm
-__ZNK7WebCore11FrameLoader14frameHasLoadedEv
-WebCoreTextFloatWidth
 __ZN7WebCore16FontPlatformDataC1EP6NSFontbb
+__ZN7WebCore16FontPlatformDataC2EP6NSFontbb
 __ZN7WebCore4FontC1ERKNS_16FontPlatformDataEb
+__ZN7WebCore4FontC2ERKNS_16FontPlatformDataEb
 __ZN7WebCore16FontFallbackList15setPlatformFontERKNS_16FontPlatformDataE
 __ZN7WebCore9FontCache17getCachedFontDataEPKNS_16FontPlatformDataE
-__ZN3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_S3_IPNS1_14SimpleFontDataEjEENS_18PairFirstExtractorIS7_EENS1_20FontDataCacheKeyHashENS_14PairHashTraitsINS1_22FontDataCacheKeyTraitsENS_10HashTraitsIS6_EEEESC_E4findIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEENS_17HashTableIteratorIS2_S7_S9_SA_SF_SC_EERKT_
+__ZN3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_S3_IPNS1_14SimpleFontDataEjEENS_18PairFirstExtractorIS7_EENS1_20FontD
+__ZN7WebCore14SimpleFontDataC1ERKNS_16FontPlatformDataEbbPNS_11SVGFontDataE
 __ZN7WebCore14SimpleFontDataC2ERKNS_16FontPlatformDataEbbPNS_11SVGFontDataE
 __ZN7WebCore16FontPlatformDataC1ERKS0_
+__ZN7WebCore16FontPlatformDataC2ERKS0_
 __ZN7WebCore14SimpleFontData12platformInitEv
 __ZN7WebCoreL12initFontDataEPNS_14SimpleFontDataE
 __ZN7WebCore17GlyphPageTreeNode7getRootEj
 __ZN7WebCore17GlyphPageTreeNode8getChildEPKNS_8FontDataEj
-__ZN3WTF7HashMapIPKN7WebCore8FontDataEPNS1_17GlyphPageTreeNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
+__ZNK3WTF7HashMapIPKN7WebCore8FontDataEPNS1_17GlyphPageTreeNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
 __ZNK7WebCore14SimpleFontData12isCustomFontEv
-__ZN3WTF9HashTableIPKN7WebCore8FontDataESt4pairIS4_PNS1_17GlyphPageTreeNodeEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E6expandEv
+__ZN3WTF7HashMapIPKN7WebCore8FontDataEPNS1_17GlyphPageTreeNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore8FontDataESt4pairIS4_PNS1_17GlyphPageTreeNodeEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_1
 __ZN7WebCore17GlyphPageTreeNode14initializePageEPKNS_8FontDataEj
 __ZNK7WebCore14SimpleFontData11isSegmentedEv
 __ZN7WebCore9GlyphPage4fillEjjPtjPKNS_14SimpleFontDataE
 __ZN3WTF6VectorItLm512EE6shrinkEm
 __ZN7WebCore14SimpleFontData17platformGlyphInitEv
-__ZNK7WebCore14SimpleFontData13widthForGlyphEt
-__ZN7WebCore13GlyphWidthMap13widthForGlyphEt
+__ZN7WebCore13GlyphWidthMap18locatePageSlowCaseEj
 __ZNK7WebCore14SimpleFontData21platformWidthForGlyphEt
-__ZN7WebCore13GlyphWidthMap16setWidthForGlyphEtf
 __ZN7WebCore14SimpleFontData14determinePitchEv
-__ZN3WTF9HashTableIiSt4pairIiPN7WebCore13GlyphWidthMap14GlyphWidthPageEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSC_IS5_EEEESD_E6expandEv
-__ZN3WTF7HashMapIN7WebCore16FontPlatformDataESt4pairIPNS1_14SimpleFontDataEjENS1_20FontDataCacheKeyHashENS1_22FontDataCacheKeyTraitsENS_10HashTraitsIS6_EEE3setERKS2_RKS6_
-__ZN3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_S3_IPNS1_14SimpleFontDataEjEENS_18PairFirstExtractorIS7_EENS1_20FontDataCacheKeyHashENS_14PairHashTraitsINS1_22FontDataCacheKeyTraitsENS_10HashTraitsIS6_EEEESC_E6expandEv
+__ZN3WTF7HashMapIiPN7WebCore13GlyphWidthMap14GlyphWidthPageENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3setERKiRKS4_
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore13GlyphWidthMap14GlyphWidthPageEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHa
+__ZN7WebCore14SimpleFontData21platformCharWidthInitEv
+__ZN7WebCore14SimpleFontData14initCharWidthsEv
+__ZN3WTF7HashMapIN7WebCore16FontPlatformDataESt4pairIPNS1_14SimpleFontDataEjENS1_20FontDataCacheKeyHashENS1_22FontDataCacheKeyT
 __ZN7WebCore16FontPlatformDataaSERKS0_
-__ZNK7WebCore4Font10floatWidthERKNS_7TextRunE
+__ZN7WebCore16FontPlatformDataD1Ev
+__ZN7WebCore16FontPlatformDataD2Ev
+__ZN7WebCore15StringTruncator14centerTruncateERKNS_6StringEfRKNS_4FontEb
+__ZN7WebCoreL14truncateStringERKNS_6StringEfRKNS_4FontEPFjS2_jjPtEb
+__ZNK7WebCore11FrameLoader14frameHasLoadedEv
+__ZN7WebCore9FrameView14setNeedsLayoutEv
+__ZN7WebCore4Page15didMoveOnscreenEv
+__ZN7WebCore9FrameView15didMoveOnscreenEv
+__ZN7WebCore10RenderView15didMoveOnscreenEv
+_WebCoreTextFloatWidth
+__ZNK7WebCore4Font10floatWidthERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS4_7PtrHashIS8_EENS4_10HashTraitsIS8_EEEE
 __ZNK7WebCore4Font16cachePrimaryFontEv
 __ZNK7WebCore16FontFallbackList10fontDataAtEPKNS_4FontEj
 __ZNK7WebCore14SimpleFontData20fontDataForCharacterEi
 __ZNK7WebCore4Font16canUseGlyphCacheERKNS_7TextRunE
-__ZNK7WebCore4Font23floatWidthForSimpleTextERKNS_7TextRunEPNS_11GlyphBufferE
-__ZN7WebCore13WidthIteratorC2EPKNS_4FontERKNS_7TextRunE
+__ZN7WebCore4Font36canReturnFallbackFontsForComplexTextEv
+__ZNK7WebCore4Font23floatWidthForSimpleTextERKNS_7TextRunEPNS_11GlyphBufferEPN3WTF7HashSetIPKNS_14SimpleFontDataENS6_7PtrHashIS
+__ZN7WebCore13WidthIteratorC1EPKNS_4FontERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashTraitsI
+__ZN7WebCore13WidthIteratorC2EPKNS_4FontERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashTraitsI
 __ZN7WebCore13WidthIterator7advanceEiPNS_11GlyphBufferE
 __ZNK7WebCore4Font21glyphDataForCharacterEibb
 __ZNK7WebCore4Font10fontDataAtEj
 __ZN7WebCore9FontCache15releaseFontDataEPKNS_14SimpleFontDataE
 __ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE3addERKS4_
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPKN7WebCore14SimpleFontDataEEES7_NS_17IdentityExtractorIS7_EENS_28ListHashSetNodeHashFunctionsIS5_NS_7PtrHashIS5_EEEENS_10HashTraitsIS7_EESF_E6expandEv
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPKN7WebCore14SimpleFontDataEEES7_NS_17IdentityExtractorIS7_EENS_28ListHashSetNodeHashF
 __ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE10appendNodeEPNS_15ListHashSetNodeIS4_EE
 __ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE6shrinkEm
-__ZN7WebCore16FontPlatformDataD1Ev
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPKN7WebCore14SimpleFontDataEEES7_NS_17IdentityExtractorIS7_EENS_28ListHashSetNodeHashFunctionsIS5_NS_7PtrHashIS5_EEEENS_10HashTraitsIS7_EESF_E4findIS7_NS_22IdentityHashTranslatorIS7_S7_SD_EEEENS_17HashTableIteratorIS7_S7_S9_SD_SF_SF_EERKT_
 __ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS4_EE
 __ZN7WebCore12IconDatabase14iconForPageURLERKNS_6StringERKNS_7IntSizeE
-__ZN7WebCore15StringTruncator14centerTruncateERKNS_6StringEfRKNS_4FontEb
-__ZN7WebCoreL14truncateStringERKNS_6StringEfRKNS_4FontEPFjS2_jjPtEb
 __ZN7WebCoreL11stringWidthERKNS_4FontEPKtjb
 __ZNK3WTF7HashMapIiPN7WebCore17GlyphPageTreeNodeENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3getERKi
-__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_14SubstituteDataE
+__ZN3WTF7HashMapIiPN7WebCore17GlyphPageTreeNodeENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
+__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestEb
+__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_14SubstituteDataEb
 __ZN7WebCore11FrameLoader4loadEPNS_14DocumentLoaderE
 __ZN7WebCore14DocumentLoader7requestEv
 __ZN7WebCore11FrameLoader35addExtraFieldsToMainResourceRequestERNS_15ResourceRequestE
 __ZN7WebCore11FrameLoader23addExtraFieldsToRequestERNS_15ResourceRequestENS_13FrameLoadTypeEbb
-__ZN7WebCore11FrameLoader14applyUserAgentERNS_15ResourceRequestE
+__ZNK7WebCore19ResourceRequestBase20firstPartyForCookiesEv
 __ZN7WebCore15ResourceRequest23doUpdateResourceRequestEv
-__ZN7WebCore19ResourceRequestBase18setHTTPHeaderFieldERKNS_12AtomicStringERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3addERKS2_RKS3_
-__ZNK7WebCore19ResourceRequestBase15mainDocumentURLEv
 __ZNK7WebCore11FrameLoader18isLoadingMainFrameEv
-__ZN7WebCore19ResourceRequestBase18setMainDocumentURLERKNS_4KURLE
+__ZN7WebCore19ResourceRequestBase23setFirstPartyForCookiesERKNS_4KURLE
+__ZN7WebCore11FrameLoader14applyUserAgentERNS_15ResourceRequestE
+__ZN7WebCore19ResourceRequestBase18setHTTPHeaderFieldERKNS_12AtomicStringERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
 __ZN7WebCore11FrameLoader21addHTTPOriginIfNeededERNS_15ResourceRequestENS_6StringE
 __ZNK7WebCore19ResourceRequestBase15httpHeaderFieldERKNS_12AtomicStringE
 __ZNK7WebCore19ResourceRequestBase10httpMethodEv
@@ -1237,8 +1252,11 @@
 __ZN7WebCore11PolicyCheck12clearRequestEv
 __ZN3WTF6VectorIN7WebCore6StringELm0EEaSERKS3_
 __ZN7WebCore11PolicyCheck6cancelEv
-__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPNS_14DocumentLoaderEN3WTF10PassRefPtrINS_9FormStateEEEPFvPvS3_S9_bESA_
-__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_14NavigationTypeE
+__ZN7WebCore15ResourceRequestD2Ev
+__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEb
+__ZN7WebCore16NavigationActionC2ERKNS_4KURLENS_13FrameLoadTypeEb
+__ZN7WebCoreL14navigationTypeENS_13FrameLoadTypeEbb
+__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPNS_14DocumentLoaderEN3WTF10PassRefPtrINS_9FormStateEEE
 __ZN7WebCore25equalIgnoringHeaderFieldsERKNS_19ResourceRequestBaseES2_
 __ZNK7WebCore19ResourceRequestBase6isNullEv
 __ZN7WebCore11PolicyCheck3setERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEPFvPvS3_S7_bES8_
@@ -1258,13 +1276,14 @@
 __ZN7WebCore11PolicyCheck4callEb
 __ZN7WebCore11FrameLoader37callContinueLoadAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
 __ZN7WebCore11FrameLoader33continueLoadAfterNavigationPolicyERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
-__ZN7WebCore5Frame11shouldCloseEv
+__ZN7WebCore5Frame11shouldCloseEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
 __ZN7WebCore6Chrome30canRunBeforeUnloadConfirmPanelEv
 __ZN7WebCore11FrameLoader14stopAllLoadersEv
 __ZN7WebCore11FrameLoader20stopLoadingSubframesEv
 __ZN7WebCore14DocumentLoader11stopLoadingEv
 __ZN7WebCoreL9cancelAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEE
 __ZN7WebCore14DocumentLoader21clearArchiveResourcesEv
+__ZN7WebCore19InspectorController14resumeDebuggerEv
 __ZN7WebCore11FrameLoader31continueLoadAfterWillSubmitFormENS_12PolicyActionE
 __ZN7WebCore14DocumentLoader19prepareForLoadStartEv
 __ZN7WebCore14DocumentLoader22setPrimaryLoadCompleteEb
@@ -1273,8 +1292,12 @@
 __ZN7WebCore15ProgressTracker15progressStartedEPNS_5FrameE
 __ZN7WebCore15ProgressTracker5resetEv
 __ZN3WTF20deleteAllPairSecondsIPN7WebCore12ProgressItemEKNS_7HashMapImS3_NS_7IntHashImEENS_10HashTraitsImEENS7_IS3_EEEEEEvRT0_
-__ZN3WTF9HashTableImSt4pairImPN7WebCore12ProgressItemEENS_18PairFirstExtractorIS5_EENS_7IntHashImEENS_14PairHashTraitsINS_10HashTraitsImEENSB_IS4_EEEESC_E6expandEv
+_stringIsCaseInsensitiveEqualToString
 __ZN7WebCore15BackForwardList11currentItemEv
+__ZN7WebCore4Page16setDefersLoadingEb
+__ZN7WebCore11FrameLoader16setDefersLoadingEb
+__ZN7WebCore14DocumentLoader16setDefersLoadingEb
+__ZN7WebCoreL19setAllDefersLoadingERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEE
 __ZNK7WebCore11FrameLoader20activeDocumentLoaderEv
 __ZNK7WebCore14DocumentLoader21isLoadingMainResourceEv
 __ZN7WebCore15ProgressTracker22createUniqueIdentifierEv
@@ -1284,14 +1307,67 @@
 __ZN7WebCore14DocumentLoader24startLoadingMainResourceEm
 __ZN7WebCore18MainResourceLoader6createEPNS_5FrameE
 __ZN7WebCore18MainResourceLoaderC1EPNS_5FrameE
+__ZN7WebCore18MainResourceLoaderC2EPNS_5FrameE
 __ZN7WebCore14ResourceLoaderC2EPNS_5FrameEbb
 __ZN7WebCore18MainResourceLoader4loadERKNS_15ResourceRequestERKNS_14SubstituteDataE
 __ZNK7WebCore14ResourceLoader11frameLoaderEv
 __ZN7WebCore21ApplicationCacheGroup19cacheForMainRequestERKNS_15ResourceRequestEPNS_14DocumentLoaderE
 __ZN7WebCore16ApplicationCache23requestIsHTTPOrHTTPSGetERKNS_15ResourceRequestE
-__ZN7WebCore18MainResourceLoader7loadNowERNS_15ResourceRequestE
+__ZN7WebCore23ApplicationCacheStorage16cacheGroupForURLERKNS_4KURLE
+__ZN7WebCore23ApplicationCacheStorage22loadManifestHostHashesEv
+__ZN7WebCore23ApplicationCacheStorage12openDatabaseEb
+__ZN7WebCoreL11urlHostHashERKNS_4KURLE
+__ZNK3WTF9HashTableIjSt4pairIjjENS_18PairFirstExtractorIS2_EEN7WebCore13AlreadyHashedENS_14PairHashTraitsINS_10HashTraitsIjEES9
 __ZN7WebCoreL25shouldLoadAsEmptyDocumentERKNS_4KURLE
-__ZN7WebCore10StringImpl9substringEjj
+_WebCoreObjCScheduleDeallocateOnMainThread
+__ZN7WebCore15BackForwardList8backItemEv
+__ZN7WebCore15BackForwardList11forwardItemEv
+__ZN7WebCore15FocusController18focusedOrMainFrameEv
+__ZN7WebCore19SelectionController10setFocusedEb
+__ZN7WebCore19SelectionController27focusedOrActiveStateChangedEv
+__ZNK7WebCore5Frame15selectionBoundsEb
+__ZNK7WebCore10RenderView15selectionBoundsEb
+__ZN7WebCore8Document19updateStyleIfNeededEv
+__ZN7WebCoreL21rendererAfterPositionEPNS_12RenderObjectEj
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_PNS1_19RenderSelectionInfoEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
+__ZNK7WebCore10ScrollView18visibleContentRectEb
+__ZNK7WebCore10ScrollView26platformVisibleContentRectEb
+__ZN7WebCore7IntRect9intersectERKS0_
+__ZN7WebCore9FloatRectC1ERKNS_7IntRectE
+__ZN7WebCore9FloatRectC2ERKNS_7IntRectE
+__ZN7WebCore10FloatPointC1ERKNS_8IntPointE
+__ZN7WebCore10FloatPointC2ERKNS_8IntPointE
+__ZN7WebCore9FloatSizeC1ERKNS_7IntSizeE
+__ZN7WebCore9FloatSizeC2ERKNS_7IntSizeE
+__ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
+__ZN7WebCore10RenderView41repaintRectangleInViewAndCompositedLayersERKNS_7IntRectEb
+__ZNK7WebCore10RenderView13shouldRepaintERKNS_7IntRectE
+__ZNK7WebCore10RenderView8printingEv
+__ZN7WebCore5Frame15setCaretVisibleEb
+__ZN7WebCore12EventHandler27capsLockStateMayHaveChangedEv
+__ZNK7WebCore8Document32useSecureKeyboardEntryWhenActiveEv
+__ZN7WebCore8Document19dispatchWindowEventERKNS_12AtomicStringEbb
+__ZN7WebCore9DOMWindow13dispatchEventERKNS_12AtomicStringEbb
+__ZN7WebCore9DOMWindow13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore9DOMWindow14refEventTargetEv
+__ZN7WebCore9DOMWindow16derefEventTargetEv
+__ZN7WebCore9FrameView18updateControlTintsEv
+__ZN7WebCore9PageGroup26setShouldTrackVisitedLinksEb
+__ZN7WebCore9PageGroup21removeAllVisitedLinksEv
+__ZN7WebCore4Page21removeAllVisitedLinksEv
+__ZN3WTF7HashSetIPN7WebCore9PageGroupENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZN7WebCore9PageGroup18removeVisitedLinksEv
+__ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
+__ZN7WebCore12IconDatabase38notifyPendingLoadDecisionsOnMainThreadEPv
+__ZN7WebCore12IconDatabase26notifyPendingLoadDecisionsEv
+__ZN7WebCore14DocumentLoader36deliverSubstituteResourcesAfterDelayEv
+__ZN7WebCore18MainResourceLoader16setDefersLoadingEb
+__ZN7WebCore14ResourceLoader16setDefersLoadingEb
+__ZN7WebCore18MainResourceLoader7loadNowERNS_15ResourceRequestE
 __ZN7WebCore18MainResourceLoader15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
 __ZN7WebCore18MainResourceLoader25isPostOrRedirectAfterPostERKNS_15ResourceRequestERKNS_16ResourceResponseE
 __ZNK7WebCore20ResourceResponseBase14httpStatusCodeEv
@@ -1300,350 +1376,117 @@
 __ZN7WebCore11FrameLoader23dispatchWillSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceResponseE
 __ZN7WebCore19InspectorController15willSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceResponseE
 __ZN7WebCore14DocumentLoader10setRequestERKNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPFvPvS3_N3WTF10PassRefPtrINS_9FormStateEEEbES4_
-__ZN7WebCore18MainResourceLoader33callContinueAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
-__ZN7WebCore18MainResourceLoader29continueAfterNavigationPolicyERKNS_15ResourceRequestEb
 __ZN7WebCore11FrameLoader32representationExistsForURLSchemeERKNS_6StringE
 __ZN7WebCore14ResourceHandle6createERKNS_15ResourceRequestEPNS_20ResourceHandleClientEPNS_5FrameEbbb
+__ZN7WebCore14ResourceHandle21shouldContentSniffURLERKNS_4KURLE
 __ZN7WebCore14ResourceHandleC1ERKNS_15ResourceRequestEPNS_20ResourceHandleClientEbbb
+__ZN7WebCore14ResourceHandleC2ERKNS_15ResourceRequestEPNS_20ResourceHandleClientEbbb
 __ZN7WebCore27AuthenticationChallengeBaseC2Ev
 __ZN7WebCore15ProtectionSpaceC1Ev
+__ZN7WebCore15ProtectionSpaceC2Ev
 __ZN7WebCore10CredentialC1Ev
+__ZN7WebCore10CredentialC2Ev
+__ZNK7WebCore4KURL4userEv
+__ZNK7WebCore4KURL4passEv
+__ZN7WebCore19ResourceRequestBase17removeCredentialsEv
+__ZN7WebCore4KURL5parseERKNS_6StringE
 __ZN7WebCoreL11portAllowedERKNS_15ResourceRequestE
 __ZN7WebCore14ResourceHandle5startEPNS_5FrameE
 __ZN7WebCore14ResourceHandle8delegateEv
 -[WebCoreResourceHandleAsDelegate initWithHandle:]
 __ZN7WebCore14ResourceHandle29didSendBodyDataDelegateExistsEv
-WebCoreObjCScheduleDeallocateOnMainThread
-__ZN7WebCore15BackForwardList8backItemEv
-__ZN7WebCore15BackForwardList11forwardItemEv
-__ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore10CachedPageEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandEv
-__ZN7WebCore11FrameLoader13executeScriptERKNS_6StringEb
-__ZNK7WebCore6StringcvN3JSC7UStringEEv
-__ZNK7WebCore20StringSourceProvider6lengthEv
-__ZN7WebCore11FrameLoader13executeScriptERKNS_16ScriptSourceCodeE
-__ZN7WebCore16ScriptController8evaluateERKNS_16ScriptSourceCodeE
-__ZN7WebCore16ScriptController10initScriptEv
-__ZN7WebCore16JSDOMWindowShellnwEm
-__ZN7WebCore15JSDOMWindowBase18commonJSGlobalDataEv
-__ZN7WebCore16JSDOMWindowShellC1EN3WTF10PassRefPtrINS_9DOMWindowEEE
-__ZN7WebCore16JSDOMWindowShell9setWindowEN3WTF10PassRefPtrINS_9DOMWindowEEE
-__ZN7WebCore20JSDOMWindowPrototypenwEm
-__ZN7WebCore11JSDOMWindowC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMWindowEEEPNS_16JSDOMWindowShellE
-__ZN7WebCore15JSDOMWindowBaseC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMWindowEEEPNS_16JSDOMWindowShellE
-__ZN7WebCore15JSDOMWindowBase19JSDOMWindowBaseDataC1EN3WTF10PassRefPtrINS_9DOMWindowEEEPNS_16JSDOMWindowShellE
-__ZN7WebCore17JSDOMGlobalObject21JSDOMGlobalObjectDataC1Ev
-__ZN7WebCore17JSDOMGlobalObjectC2EN3WTF10PassRefPtrIN3JSC9StructureEEEPNS0_21JSDOMGlobalObjectDataEPNS3_8JSObjectE
-__ZN7WebCore15JSDOMWindowBase10globalExecEv
-__ZN7WebCore5Frame9keepAliveEv
-__ZN7WebCore9TimerBase5startEdd
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE15reserveCapacityEm
-__ZN7WebCore9TimerBase15heapDecreaseKeyEv
-__ZSt11__push_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
-__ZN7WebCore17updateSharedTimerEv
-__ZN7WebCore22setSharedTimerFireTimeEd
--[WebCorePowerNotifier init]
-__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS2_16SymbolTableEntryENS2_17IdentifierRepHashENS_10HashTraitsIS5_EENS2_26SymbolTableIndexHashTraitsEE3addEPS4_RKS6_
-__ZN7WebCore15JSDOMWindowBase14updateDocumentEv
-__ZNK7WebCore9DOMWindow8documentEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8DocumentE
-__ZN7WebCore25getCachedDOMObjectWrapperERN3JSC12JSGlobalDataEPv
-__ZNK3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3getERKS1_
-__ZN7WebCore21getCachedDOMStructureEPN3JSC9ExecStateEPKNS0_9ClassInfoE
-__ZN3WTF7HashMapIPKN3JSC9ClassInfoENS_6RefPtrINS1_9StructureEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENSA_IS7_EEE3setERKS4_RKS7_
-__ZN7WebCore14JSHTMLDocument15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSDocumentPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore10JSDocument15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore26JSEventTargetNodePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore17JSEventTargetNode15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSNodePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore6JSNode15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17cacheDOMStructureEPN3JSC9ExecStateEN3WTF10PassRefPtrINS0_9StructureEEEPKNS0_9ClassInfoE
-__ZN3WTF9HashTableIPKN3JSC9ClassInfoESt4pairIS4_NS_6RefPtrINS1_9StructureEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSF_IS8_EEEESG_E6expandEv
-__ZN7WebCore14JSHTMLDocumentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12HTMLDocumentEEE
-__ZN7WebCore10JSDocumentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DocumentEEE
-__ZN7WebCore17JSEventTargetNodeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15EventTargetNodeEEE
-__ZN7WebCore6JSNodeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4NodeEEE
-__ZN7WebCore21cacheDOMObjectWrapperERN3JSC12JSGlobalDataEPvPNS_9DOMObjectE
-__ZN3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3setERKS1_RKS4_
-__ZN3WTF9HashTableIPvSt4pairIS1_PN7WebCore9DOMObjectEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS1_EENS_14PairHashTraitsINS_10HashTraitsIS1_EENSC_IS5_EEEESD_E6expandEv
-__ZN7WebCore16ScriptController14attachDebuggerEPN3JSC8DebuggerE
-__ZN7WebCore4Page9initGroupEv
-__ZN7WebCore9PageGroupC1EPNS_4PageE
-__ZN7WebCore11FrameLoader29dispatchWindowObjectAvailableEv
-__ZN7WebCore19InspectorController34inspectedWindowScriptObjectClearedEPNS_5FrameE
-__ZN7WebCore6StringC1ERKN3JSC7UStringE
-__ZNK7WebCore20StringSourceProvider4dataEv
-__ZNK7WebCore15JSDOMWindowBase17supportsProfilingEv
-__ZN7WebCore11FrameLoader16detachFromParentEv
-__ZN7WebCore15EventTargetNode19dispatchWindowEventERKNS_12AtomicStringEbb
-__ZN7WebCore15EventTargetNode19dispatchWindowEventEN3WTF10PassRefPtrINS_5EventEEE
-__ZN7WebCore8Document15updateRenderingEv
-__ZN7WebCore12EventHandler28pendingFrameUnloadEventCountEv
-__ZN7WebCore12EventHandler34pendingFrameBeforeUnloadEventCountEv
-__ZN7WebCore8Document35removeAllEventListenersFromAllNodesEv
-__ZN7WebCore8Document39removeAllDisconnectedNodeEventListenersEv
-__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZNK7WebCore15EventTargetNode17isEventTargetNodeEv
-__ZN7WebCore15EventTargetNode23removeAllEventListenersEv
-__ZNK7WebCore4Node16traverseNextNodeEPKS0_
-__ZN7WebCore6Loader14cancelRequestsEPNS_9DocLoaderE
-__ZNK7WebCore6Loader4Host11hasRequestsEv
-__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE6resizeEm
-__ZN7WebCore6Loader28scheduleServePendingRequestsEv
-__ZN7WebCore8Document13stopDatabasesEv
-__ZN7WebCore11FrameLoader18currentHistoryItemEv
-__ZN7WebCore11FrameLoader36saveScrollPositionAndViewStateToItemEPNS_11HistoryItemE
-__ZN7WebCore19InspectorController23frameDetachedFromParentEPNS_5FrameE
-__ZN7WebCore14DocumentLoader15detachFromFrameEv
-__ZN7WebCore8Document6detachEv
-__ZN7WebCore8Document18clearAXObjectCacheEv
-__ZNK7WebCore8Document11topDocumentEv
-__ZNK7WebCore8Document12ownerElementEv
-__ZN7WebCore22ScriptExecutionContext20stopActiveDOMObjectsEv
-__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14shrinkCapacityEm
-__ZN7WebCore13ContainerNode6detachEv
-__ZN7WebCore7Element6detachEv
-__ZN7WebCore7Element27cancelFocusAppearanceUpdateEv
-__ZN7WebCore4Node6detachEv
-__ZN7WebCore10RenderFlow7destroyEv
-__ZN7WebCore15RenderContainer23destroyLeftoverChildrenEv
-__ZNK7WebCore12RenderObject22documentBeingDestroyedEv
-__ZN7WebCore10RenderFlow15deleteLineBoxesEv
-__ZN7WebCore15RenderContainer7destroyEv
-__ZN7WebCore9RenderBox7destroyEv
-__ZN7WebCore11RenderLayer14clearClipRectsEv
-__ZN7WebCore12RenderObject7destroyEv
-__ZNK7WebCore12EventHandler18autoscrollRendererEv
-__ZN7WebCore19AnimationController16cancelAnimationsEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock11removeChildEPNS_12RenderObjectE
-__ZN7WebCore15RenderContainer11removeChildEPNS_12RenderObjectE
-__ZN7WebCore12RenderObject21removeFromObjectListsEv
-__ZN7WebCore15RenderContainer15removeChildNodeEPNS_12RenderObjectEb
-__ZN7WebCore9RenderBox20deleteLineBoxWrapperEv
-__ZN7WebCore11RenderLayer7destroyEPNS_11RenderArenaE
-__ZN7WebCore11RenderLayer16destroyScrollbarENS_20ScrollbarOrientationE
-__ZN7WebCore11RenderLayerdlEPvm
-__ZN7WebCore11RenderArena4freeEmPv
-__ZN7WebCore12RenderObject11arenaDeleteEPNS_11RenderArenaEPv
-__ZN7WebCore11RenderBlockD1Ev
-__ZN7WebCore11RenderStyleD1Ev
-__ZN7WebCore12RenderObjectdlEPvm
-__ZN7WebCore10RenderViewD1Ev
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore18StyleInheritedDataD1Ev
-__ZN7WebCore8Document17clearFramePointerEv
-__ZN7WebCore11RenderArenaD1Ev
-__ZN7WebCore15FinishArenaPoolEPNS_9ArenaPoolE
-__ZN7WebCoreL13FreeArenaListEPNS_9ArenaPoolEPNS_5ArenaEb
-__ZN7WebCore9FrameView18unscheduleRelayoutEv
-__ZN7WebCore9FrameView15resetScrollbarsEv
-__ZN7WebCore10ScrollView23setScrollbarsSuppressedEbb
-__ZN7WebCore10ScrollView31platformSetScrollbarsSuppressedEb
-__ZN7WebCore10ScrollView25setHasHorizontalScrollbarEb
-__ZN7WebCore10ScrollView23setHasVerticalScrollbarEb
-__ZN7WebCore5Frame13pageDestroyedEv
-__ZN7WebCore16ScriptController16clearWindowShellEv
-__ZN7WebCore15JSDOMWindowBase5clearEv
-__ZN7WebCore15JSDOMWindowBase27clearHelperObjectPropertiesEv
-__ZN7WebCore17JSDOMGlobalObject15setCurrentEventEPNS_5EventE
-__ZN3WTF7HashSetIPN7WebCore11JSDOMWindowENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore11JSDOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore12gcControllerEv
-__ZN7WebCore12GCControllerC1Ev
-__ZN7WebCore12GCController18garbageCollectSoonEv
-__ZN7WebCore16JSDOMWindowShell15disconnectFrameEv
-__ZN7WebCore15JSDOMWindowBase15disconnectFrameEv
-__ZN7WebCore16ScriptController18clearScriptObjectsEv
-__ZN7WebCore14DragController9dragEndedEv
-__ZN7WebCore19SelectionController5clearEv
-__ZN7WebCore19SelectionController12setSelectionERKNS_9SelectionEbbb
-__ZN7WebCore19SelectionController19invalidateCaretRectEv
-__ZN7WebCore4PageD1Ev
-__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore8Document26documentWillBecomeInactiveEv
-__ZN7WebCore19InspectorController22inspectedPageDestroyedEv
-__ZN7WebCore19InspectorController5closeEv
-__ZN7WebCore15BackForwardList5closeEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14shrinkCapacityEm
-__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E5clearEv
-__ZN7WebCore15BackForwardListD1Ev
-__ZN7WebCore15ProgressTrackerD1Ev
-__ZN3WTF20deleteAllPairSecondsIPNS_7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS8_IS5_EEEEKNS1_INS2_INS3_5FrameEEESC_NS_7PtrHashISE_EENS8_ISE_EENS8_ISC_EEEEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore14ConsoleMessageELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_dENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENS9_IdEEEESA_E6expandEv
-__ZN7WebCore21ContextMenuControllerD1Ev
-__ZN7WebCore14DragControllerD1Ev
-__ZN7WebCore12IconDatabase38notifyPendingLoadDecisionsOnMainThreadEPv
-__ZN7WebCore12IconDatabase26notifyPendingLoadDecisionsEv
--[WebCoreResourceHandleAsDelegate connection:didFailWithError:]
+-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]
 __ZNK7WebCore14ResourceHandle6clientEv
-__ZN7WebCore14ResourceLoader7didFailEPNS_14ResourceHandleERKNS_13ResourceErrorE
-__ZN7WebCore14DocumentLoader48scheduleLoadFallbackResourceFromApplicationCacheEPNS_14ResourceLoaderERKNS_15ResourceRequestEPNS_16ApplicationCacheE
-__ZN7WebCore14DocumentLoader35getApplicationCacheFallbackResourceERKNS_15ResourceRequestERPNS_24ApplicationCacheResourceEPNS_16ApplicationCacheE
-__ZN7WebCore18MainResourceLoader7didFailERKNS_13ResourceErrorE
-__ZN7WebCore21ApplicationCacheGroup27fallbackCacheForMainRequestERKNS_15ResourceRequestEPNS_14DocumentLoaderE
-__ZN7WebCore14ResourceLoader48scheduleLoadFallbackResourceFromApplicationCacheEPNS_16ApplicationCacheE
-__ZN7WebCore18MainResourceLoader13receivedErrorERKNS_13ResourceErrorE
-__ZN7WebCore11FrameLoader25receivedMainResourceErrorERKNS_13ResourceErrorEb
-__ZN7WebCore11FrameLoader4stopEv
-__ZNK7WebCore17ResourceErrorBase8lazyInitEv
-__ZN7WebCore13ResourceError16platformLazyInitEv
-__ZN7WebCore11FrameLoader21handleFallbackContentEv
-__ZNK7WebCore14DocumentLoader19originalRequestCopyEv
-__ZN7WebCore11FrameLoader13didNotOpenURLERKNS_4KURLE
-__ZN7WebCore11FrameLoader31invalidateCurrentItemCachedPageEv
-__ZN7WebCore14DocumentLoader17mainReceivedErrorERKNS_13ResourceErrorEb
-__ZN7WebCore14DocumentLoader20setMainDocumentErrorERKNS_13ResourceErrorE
-__ZN7WebCore11FrameLoader20setMainDocumentErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
-__ZNK7WebCore13ResourceErrorcvP7NSErrorEv
-__ZN7WebCore11FrameLoader25mainReceivedCompleteErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceLoader12resourceDataEv
-__ZN7WebCore14ResourceHandle20supportsBufferedDataEv
-__ZN7WebCore14ResourceHandle12bufferedDataEv
-__ZN7WebCore12SharedBuffer10wrapNSDataEP6NSData
-__ZN7WebCore12SharedBufferC1EPK8__CFData
-__ZN7WebCore14DocumentLoader13updateLoadingEv
-__ZNK7WebCore11FrameLoader9isLoadingEv
-__ZNK7WebCore14DocumentLoader21isLoadingSubresourcesEv
-__ZNK7WebCore14DocumentLoader16isLoadingPlugInsEv
-__ZN7WebCore18MainResourceLoader18handleDataLoadSoonERNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader13didFailToLoadEPNS_14ResourceLoaderERKNS_13ResourceErrorE
-__ZN7WebCore15ProgressTracker16completeProgressEm
-__ZN3WTF7HashMapImPN7WebCore12ProgressItemENS_7IntHashImEENS_10HashTraitsImEENS6_IS3_EEE3setERKmRKS3_
-__ZN7WebCore14ResourceLoader16releaseResourcesEv
-__ZN7WebCore14DocumentLoaderD2Ev
-__ZN7WebCore12SharedBufferD1Ev
-__ZN7WebCore14ResourceHandle9setClientEPNS_20ResourceHandleClientE
-__ZN7WebCore14ResourceHandleD1Ev
-__ZN7WebCore14ResourceHandle15releaseDelegateEv
--[WebCoreResourceHandleAsDelegate detachHandle]
--[WebCoreResourceHandleAsDelegate dealloc]
-__ZN7WebCore22ResourceHandleInternalD1Ev
+-[WebCoreResourceHandleAsDelegate connectionShouldUseCredentialStorage:]
+__ZN7WebCore14ResourceHandle26shouldUseCredentialStorageEv
+__ZN7WebCore14ResourceLoader26shouldUseCredentialStorageEPNS_14ResourceHandleE
+__ZN7WebCore14ResourceLoader26shouldUseCredentialStorageEv
+__ZN7WebCore11FrameLoader26shouldUseCredentialStorageEPNS_14ResourceLoaderE
 __ZNK7WebCore15ProgressTracker17estimatedProgressEv
-__ZN7WebCore15FocusController18focusedOrMainFrameEv
-__ZN7WebCore19SelectionController10setFocusedEb
-__ZN7WebCoreL10timerFiredEP16__CFRunLoopTimerPv
-__ZN7WebCore9TimerBase16sharedTimerFiredEv
-__ZN7WebCore9TimerBase19collectFiringTimersEdRN3WTF6VectorIPS0_Lm0EEE
-__ZN3WTF7HashSetIPKN7WebCore9TimerBaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandEv
-__ZN7WebCore9TimerBase10heapPopMinEv
-__ZSt13__adjust_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE6shrinkEm
-__ZN7WebCore9TimerBase10fireTimersEdRKN3WTF6VectorIPS0_Lm0EEE
-__ZNK3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8containsIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEEbRKT_
-__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEENS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EERKT_
-__ZN7WebCore5TimerINS_5FrameEE5firedEv
-__ZN7WebCore5Frame21lifeSupportTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore5FrameD1Ev
-__ZN7WebCore11FrameLoader23clearRecordedFormValuesEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EESA_EESA_EaSERKSC_
-__ZN7WebCore11FrameLoader14cancelAndClearEv
-__ZN7WebCore13TypingCommand11closeTypingEPNS_11EditCommandE
-__ZN7WebCore13TypingCommand26isOpenForMoreTypingCommandEPKNS_11EditCommandE
-__ZN7WebCore5Frame16clearTypingStyleEv
-__ZN7WebCore5Frame23setSelectionGranularityENS_15TextGranularityE
-__ZN7WebCore5Frame22disconnectOwnerElementEv
-__ZN7WebCore9DOMWindow15disconnectFrameEv
-__ZN7WebCore9DOMWindow5clearEv
-__ZN7WebCore19AnimationControllerD2Ev
-__ZN7WebCore26AnimationControllerPrivateD2Ev
-__ZN7WebCore12EventHandlerD1Ev
-__ZN7WebCore6EditorD1Ev
-__ZN7WebCore16ScriptControllerD1Ev
-__ZN7WebCore16ScriptController31disconnectPlatformScriptObjectsEv
-__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore11FrameLoaderD1Ev
-__ZN7WebCore11FrameLoader9setOpenerEPNS_5FrameE
-__ZN7WebCore17FrameLoaderClientD2Ev
-__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore9FrameTreeD1Ev
-__ZN7WebCore5TimerINS_6LoaderEE5firedEv
-__ZN7WebCore6Loader17requestTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore6Loader20servePendingRequestsENS0_8PriorityE
-__ZN7WebCore6Loader4Host20servePendingRequestsENS0_8PriorityE
-__ZN7WebCore6Loader4Host20servePendingRequestsERN3WTF5DequeIPNS_7RequestEEERb
-__ZN7WebCore5TimerINS_12GCControllerEE5firedEv
-__ZN7WebCore12GCController12gcTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore20JSDOMWindowPrototypeD0Ev
-__ZN7WebCore11JSDOMWindowD0Ev
-__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore26JSUnprotectedEventListenerEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E6expandEv
-__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore15JSEventListenerEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E6expandEv
-__ZN3WTF9HashTableIPKN3JSC9ClassInfoESt4pairIS4_PNS1_8JSObjectEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E6expandEv
-__ZN3JSC14JSGlobalObject18JSGlobalObjectDataD0Ev
-__ZN3WTF9HashTableIPN3JSC16ProgramCodeBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableEPS3_i
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS2_16SymbolTableEntryEENS_18PairFirstExtractorIS8_EENS2_17IdentifierRepHashENS_14PairHashTraitsINS_10HashTraitsIS5_EENS2_26SymbolTableIndexHashTraitsEEESE_E6expandEv
-__ZN7WebCore26JSEventTargetNodePrototypeD0Ev
-__ZN7WebCore19JSDocumentPrototypeD0Ev
-__ZN7WebCore14JSHTMLDocumentD0Ev
-__ZN7WebCore10JSDocumentD0Ev
-__ZN7WebCore15forgetDOMObjectERN3JSC12JSGlobalDataEPv
-__ZN3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE4takeERKS1_
-__ZN3WTF9HashTableIPvSt4pairIS1_PN7WebCore9DOMObjectEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS1_EENS_14PairHashTraitsINS_10HashTraitsIS1_EENSC_IS5_EEEESD_E4findIS1_NS_22IdentityHashTranslatorIS1_S6_SA_EEEENS_17HashTableIteratorIS1_S6_S8_SA_SF_SD_EERKT_
-__ZN7WebCore6JSNodeD0Ev
-__ZN7WebCore13forgetDOMNodeEPNS_8DocumentEPNS_4NodeE
-__ZN3WTF9HashTableIPN7WebCore4NodeESt4pairIS3_PNS1_6JSNodeEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SB_EEEENS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCore8Document14removedLastRefEv
-__ZN7WebCore13ContainerNode17removeAllChildrenEv
-__ZN7WebCore28removeAllChildrenInContainerINS_4NodeENS_13ContainerNodeEEEvPT0_
-__ZN7WebCore7Private28addChildNodesToDeletionQueueINS_4NodeENS_13ContainerNodeEEEvRPT_S6_PT0_
-__ZN7WebCore15HTMLHtmlElementD1Ev
-__ZN7WebCore13StyledElement22destroyInlineStyleDeclEv
-__ZN7WebCore15EventTargetNodeD0Ev
-__ZN3WTF20deleteAllPairSecondsIPSt4pairINS_6VectorIN7WebCore14DocumentMarkerELm0EEENS2_INS3_7IntRectELm0EEEEKNS_7HashMapINS_6RefPtrINS3_4NodeEEES9_NS_7PtrHashISD_EENS_10HashTraitsISD_EENSG_IS9_EEEEEEvRT0_
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IiEEEESC_E6expandEv
-__ZN7WebCore8DocumentD0Ev
-__ZN7WebCore28forgetAllDOMNodesForDocumentEPNS_8DocumentE
-__ZN7WebCore16CSSStyleSelectorD1Ev
-__ZN7WebCore19MediaQueryEvaluatorD1Ev
-__ZN7WebCore10CSSRuleSetD1Ev
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore15CSSRuleDataListEKNS_7HashMapIPNS1_16AtomicStringImplES3_NS_7PtrHashIS6_EENS_10HashTraitsIS6_EENS9_IS3_EEEEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore16MediaQueryResultELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore9FontCache12removeClientEPNS_12FontSelectorE
-__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN3WTF20deleteAllPairSecondsIPNS_6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EEEKNS_7HashMapINS3_6StringES7_NS3_15CaseFoldingHashENS_10HashTraitsIS9_EENSB_IS7_EEEEEEvRT0_
-__ZN3WTF20deleteAllPairSecondsIPNS_7HashMapIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS8_IS5_EEEEKNS1_INS3_6StringESC_NS3_15CaseFoldingHashENS8_ISD_EENS8_ISC_EEEEEEvRT0_
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE6shrinkEm
-__ZN7WebCore9FillLayerD1Ev
-__ZN7WebCore9DocLoaderD1Ev
-__ZN7WebCore9DocLoader13clearPreloadsEv
-__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE14deleteAllNodesEv
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore14CachedResourceEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E6expandEv
-__ZN7WebCore5Cache15removeDocLoaderEPNS_9DocLoaderE
-__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore19TextResourceDecoderD1Ev
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore14HTMLCollection14CollectionInfoEKNS_7HashMapIPNS1_16AtomicStringImplES4_NS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSA_IS4_EEEEEEvRT0_
-__ZN7WebCore14StyleSheetList17documentDestroyedEv
-__ZN3WTF9HashTableIiSt4pairIiPN7WebCore8DOMTimerEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSB_IS4_EEEESC_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore4NodeESt4pairIS3_PNS1_6JSNodeEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_14HTMLCollection14CollectionInfoEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCore14HTMLCollection14CollectionInfoD1Ev
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_14HTMLMapElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6expandEv
-__ZN3WTF11ListHashSetIPN7WebCore27FormControlElementWithStateENS_7PtrHashIS3_EEE14deleteAllNodesEv
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore27FormControlElementWithStateEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E6expandEv
-__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE14deleteAllNodesEv
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore4NodeEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E6expandEv
-__ZN7WebCore14StyleSheetListD1Ev
-__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore22ScriptExecutionContextD0Ev
-__ZN3WTF9HashTableIPN7WebCore15ActiveDOMObjectESt4pairIS3_PvENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS5_EEEESD_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore11MessagePortES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore9DOMWindowD1Ev
-__ZN7WebCore5TimerINS_18MainResourceLoaderEE5firedEv
-__ZN7WebCore18MainResourceLoader17handleDataLoadNowEPNS_5TimerIS0_EE
-__ZNK7WebCore12SharedBuffer16platformDataSizeEv
+__ZN7WebCore12IconDatabase24getOrCreatePageURLRecordERKNS_6StringE
+_WebCoreShouldUseFontSmoothing
+_WebCoreSetShouldUseFontSmoothing
+_WebCoreDrawTextAtPoint
+__ZN7WebCore15GraphicsContextC1EP9CGContext
+__ZN7WebCore15GraphicsContextC2EP9CGContext
+__ZN7WebCore15GraphicsContext28createGraphicsContextPrivateEv
+__ZN7WebCore15GraphicsContext19setPaintingDisabledEb
+__ZNK7WebCore15GraphicsContext9fillColorEv
+__ZN7WebCore15GraphicsContext20setPlatformFillColorERKNS_5ColorE
+__ZNK7WebCore15GraphicsContext16paintingDisabledEv
+__ZNK7WebCore15GraphicsContext15platformContextEv
+__ZN7WebCoreL14setCGFillColorEP9CGContextRKNS_5ColorE
+__ZNK7WebCore5Color7getRGBAERdS1_S1_S1_
+__ZNK7WebCore15GraphicsContext11strokeColorEv
+__ZN7WebCore15GraphicsContext22setPlatformStrokeColorERKNS_5ColorE
+__ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorE
+__ZNK7WebCore4Font8drawTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZNK7WebCore4Font14drawSimpleTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZNK7WebCore4Font15drawGlyphBufferEPNS_15GraphicsContextERKNS_11GlyphBufferERKNS_7TextRunERKNS_10FloatPointE
+__ZNK7WebCore4Font10drawGlyphsEPNS_15GraphicsContextEPKNS_14SimpleFontDataERKNS_11GlyphBufferEiiRKNS_10FloatPointE
+__ZNK7WebCore15GraphicsContext9getShadowERNS_7IntSizeERiRNS_5ColorE
+__ZN7WebCore15GraphicsContext15textDrawingModeEv
+__ZN3WTF6VectorI6CGSizeLm2048EE6shrinkEm
+__ZN3WTF6VectorItLm2048EE6shrinkEm
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE6shrinkEm
+__ZN7WebCore15GraphicsContextD1Ev
+__ZN7WebCore15GraphicsContextD2Ev
+__ZN7WebCore15GraphicsContext29destroyGraphicsContextPrivateEPNS_22GraphicsContextPrivateE
+__ZN7WebCore15SQLiteStatement11columnCountEv
+__ZN7WebCore15SQLiteStatement13getColumnTextEi
+__ZN7WebCore6StringC1EPKt
+__ZN7WebCore6StringC2EPKt
+__ZN7WebCore12IconDatabase21getOrCreateIconRecordERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_10IconRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_10IconRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_10IconRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTr
+__ZN7WebCore13PageURLRecord13setIconRecordEN3WTF10PassRefPtrINS_10IconRecordEEE
+__ZNK3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E8containsIS2_NS_2
+__ZN7WebCore11HistoryItemC1ERKNS_6StringES3_S3_d
+__ZN7WebCore11HistoryItemC2ERKNS_6StringES3_S3_d
+__ZN7WebCore11HistoryItem13setVisitCountEi
+__ZN7WebCore11HistoryItem16adoptVisitCountsERN3WTF6VectorIiLm0EEES4_
+__ZN3WTF6VectorIiLm0EE14shrinkCapacityEm
+__ZNK7WebCore11HistoryItem9urlStringEv
+__ZNK7WebCore11HistoryItem15lastVisitedTimeEv
+__ZN7WebCore11HistoryItem15setRedirectURLsESt8auto_ptrIN3WTF6VectorINS_6StringELm0EEEE
+__ZN7WebCore7Console24setShouldPrintExceptionsEb
+__ZN7WebCore10IconRecord15imageDataStatusEv
+__ZN3WTF7HashSetIPN7WebCore10IconRecordENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTa
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocate
+__ZN7WebCore12IconDatabase14wakeSyncThreadEv
+__ZN7WebCore24disableSuddenTerminationEv
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE15reserveCapacityEm
+__ZN7WebCore12IconDatabase37getImageDataForIconURLFromSQLDatabaseERKNS_6StringE
+__ZN7WebCore15SQLiteStatement8bindTextEiRKNS_6StringE
+__ZN7WebCore15SQLiteStatement21getColumnBlobAsVectorEiRN3WTF6VectorIcLm0EEE
+__ZN7WebCore12SharedBufferC1EPKci
+__ZN7WebCore12SharedBufferC2EPKci
+__ZN3WTF6VectorIcLm0EE6appendIcEEvPKT_m
+__ZN3WTF6VectorIcLm0EE14expandCapacityEmPKc
+__ZN7WebCore15SQLiteStatement5resetEv
+__ZNK3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndI
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore15AutodrainedPool5cycleEv
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE6shrinkEm
+__ZN7WebCore23enableSuddenTerminationEv
+-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]
+__ZN7WebCore14ResourceLoader18didReceiveResponseEPNS_14ResourceHandleERKNS_16ResourceResponseE
+-[NSHTTPURLResponse(WebCoreURLResponse) _webcore_MIMEType]
+__ZL24webNSURLResponseMIMETypeP11objc_objectP13objc_selector
 __ZN7WebCore18MainResourceLoader18didReceiveResponseERKNS_16ResourceResponseE
+__ZNK7WebCore20ResourceResponseBase16httpHeaderFieldsEv
 __ZN7WebCore11FrameLoader18checkContentPolicyERKNS_6StringEPFvPvNS_12PolicyActionEES4_
+__ZN7WebCore11PolicyCheck3setEPFvPvNS_12PolicyActionEES1_
+__ZN7WebCore11FrameLoader26continueAfterContentPolicyENS_12PolicyActionE
+__ZN7WebCore11PolicyCheck4callENS_12PolicyActionE
 __ZN7WebCore18MainResourceLoader30callContinueAfterContentPolicyEPvNS_12PolicyActionE
 __ZN7WebCore18MainResourceLoader26continueAfterContentPolicyENS_12PolicyActionE
 __ZNK7WebCore11FrameLoader10isStoppingEv
@@ -1658,30 +1501,57 @@
 __ZN3WTF6VectorIN7WebCore16ResourceResponseELm0EE15reserveCapacityEm
 __ZN7WebCore15ProgressTracker17incrementProgressEmRKNS_16ResourceResponseE
 __ZNK7WebCore20ResourceResponseBase21expectedContentLengthEv
+__ZNK3WTF7HashMapImPN7WebCore12ProgressItemENS_7IntHashImEENS_10HashTraitsImEENS6_IS3_EEE3getERKm
+__ZN3WTF7HashMapImPN7WebCore12ProgressItemENS_7IntHashImEENS_10HashTraitsImEENS6_IS3_EEE3setERKmRKS3_
+__ZN3WTF9HashTableImSt4pairImPN7WebCore12ProgressItemEENS_18PairFirstExtractorIS5_EENS_7IntHashImEENS_14PairHashTraitsINS_10Has
 __ZN7WebCore11FrameLoader26dispatchDidReceiveResponseEPNS_14DocumentLoaderEmRKNS_16ResourceResponseE
 __ZN7WebCore19InspectorController18didReceiveResponseEPNS_14DocumentLoaderEmRKNS_16ResourceResponseE
-__ZNK7WebCore12SharedBuffer12platformDataEv
+__ZN7WebCore20ResourceResponseBaseD2Ev
+-[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:]
+__ZN7WebCore14ResourceLoader14didReceiveDataEPNS_14ResourceHandleEPKcii
 __ZN7WebCore18MainResourceLoader14didReceiveDataEPKcixb
 __ZN7WebCore14ResourceLoader14didReceiveDataEPKcixb
 __ZN7WebCore18MainResourceLoader7addDataEPKcib
 __ZN7WebCore14ResourceLoader7addDataEPKcib
-__ZN7WebCore12SharedBufferC1EPKci
-__ZN3WTF6VectorIcLm0EE6appendIcEEvPKT_m
-__ZN3WTF6VectorIcLm0EE14expandCapacityEmPKc
+__ZN7WebCore14ResourceHandle20supportsBufferedDataEv
 __ZN7WebCore11FrameLoader12receivedDataEPKci
 __ZN7WebCore14DocumentLoader12receivedDataEPKci
 __ZNK7WebCore14DocumentLoader19doesProgressiveLoadERKNS_6StringE
 __ZNK7WebCore11FrameLoader11isReplacingEv
 __ZN7WebCore14DocumentLoader10commitLoadEPKci
-__ZN7WebCore8Document22hasWindowEventListenerERKNS_12AtomicStringE
-__ZN7WebCore15stopSharedTimerEv
+__ZN7WebCore9DOMWindow16hasEventListenerERKNS_12AtomicStringE
+__ZN7WebCore9DOMWindow19dispatchUnloadEventEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
+__ZN7WebCore8Document23removeAllEventListenersEv
+__ZN7WebCore8Document39removeAllDisconnectedNodeEventListenersEv
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableEP
+__ZNK7WebCore4Node16traverseNextNodeEPKS0_
+__ZN7WebCore6Loader14cancelRequestsEPNS_9DocLoaderE
+__ZN7WebCore9DocLoader20clearPendingPreloadsEv
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14shrinkCapacityEm
+__ZN7WebCore6Loader28scheduleServePendingRequestsEv
+__ZN7WebCore9TimerBase5startEdd
+__ZN7WebCoreL9timerHeapEv
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE15reserveCapacityEm
+__ZN7WebCore9TimerBase15heapDecreaseKeyEv
+__ZSt11__push_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
+__ZN7WebCore21MainThreadSharedTimer11setFireTimeEd
+__ZN7WebCore22setSharedTimerFireTimeEd
+-[WebCorePowerNotifier init]
+__ZN7WebCore8Document13stopDatabasesEv
 __ZN7WebCore14DocumentLoader23stopLoadingSubresourcesEv
 __ZN7WebCore14DocumentLoader18stopLoadingPlugInsEv
+__ZN7WebCore14DocumentLoader15detachFromFrameEv
 __ZN7WebCore11FrameLoader33addBackForwardItemClippedAtTargetEb
 __ZN7WebCore15BackForwardList7entriesEv
 __ZN7WebCore11FrameLoader21createHistoryItemTreeEPNS_5FrameEb
 __ZN7WebCore11FrameLoader17createHistoryItemEb
+__ZNK7WebCore14DocumentLoader11originalURLEv
+__ZNK7WebCore14DocumentLoader10requestURLEv
 __ZN7WebCore11HistoryItemC1ERKNS_4KURLERKNS_6StringES6_S6_
+__ZN7WebCore11HistoryItemC2ERKNS_4KURLERKNS_6StringES6_S6_
 __ZN7WebCore11HistoryItem20setOriginalURLStringERKNS_6StringE
 __ZN7WebCore11HistoryItem22setFormInfoFromRequestERKNS_15ResourceRequestE
 __ZN7WebCore11HistoryItem15setIsTargetItemEb
@@ -1689,1290 +1559,224 @@
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE15reserveCapacityEm
 __ZN3WTF7HashSetINS_6RefPtrIN7WebCore11HistoryItemEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore11HistoryItemEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandEv
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore11HistoryItemEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_
 __ZNK7WebCore14DocumentLoader28urlForHistoryReflectsFailureEv
-__ZN7WebCore11HistoryItemC1ERKNS_6StringES3_d
-__ZN7WebCore11HistoryItem13setVisitCountEi
-__ZNK7WebCore11HistoryItem15lastVisitedTimeEv
-__ZNK7WebCore11HistoryItem9urlStringEv
+__ZNK7WebCore14DocumentLoader19originalRequestCopyEv
+__ZN7WebCore11HistoryItem7visitedERKNS_6StringEd
+__ZN7WebCore11HistoryItem17recordVisitAtTimeEd
+__ZN7WebCore11HistoryItem25padDailyCountsForNewVisitEd
+__ZN3WTF6VectorIiLm0EE4fillERKim
+__ZSt4fillIPiiEvT_S1_RKT0_
+__ZN3WTF6VectorIiLm0EE6insertIiEEvmPKT_m
+__ZN7WebCore11HistoryItem27collapseDailyVisitsToWeeklyEv
+__ZNK7WebCore11HistoryItem17originalURLStringEv
 __ZN7WebCore4Page20setGlobalHistoryItemEPNS_11HistoryItemE
 __ZN7WebCore9PageGroup14addVisitedLinkERKNS_4KURLE
 __ZN7WebCore15visitedLinkHashEPKtj
 __ZN3WTF7HashSetIyN7WebCore12LinkHashHashENS_10HashTraitsIyEEE3addERKy
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E6expandEv
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E6rehashEi
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E13allocateTableEi
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E15deallocateTableEPyi
 __ZN7WebCore4Page19visitedStateChangedEPNS_9PageGroupEy
 __ZN7WebCore16CSSStyleSelector15SelectorChecker19visitedStateChangedEy
-__ZNK3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E8containsIyNS_22IdentityHashTranslatorIyyS4_EEEEbRKT_
+__ZNK3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E8containsIyNS_22IdentityHashTran
+__ZN7WebCore10ScrollView23setScrollbarsSuppressedEbb
+__ZN7WebCore10ScrollView31platformSetScrollbarsSuppressedEb
+__ZN7WebCore14DocumentLoaderD2Ev
 __ZNK7WebCore11HistoryItem17isCurrentDocumentEPNS_8DocumentE
+__ZN7WebCore5Frame18setJSStatusBarTextERKNS_6StringE
+__ZN7WebCore6Chrome16setStatusbarTextEPNS_5FrameERKNS_6StringE
+__ZNK7WebCore8Document31displayStringModifiedByEncodingERKNS_6StringE
+__ZN7WebCore5Frame25setJSDefaultStatusBarTextERKNS_6StringE
+__ZN3WTF6VectorItLm0EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm0EE14expandCapacityEm
+__ZN3WTF6VectorItLm0EE15reserveCapacityEm
+__ZNK7WebCore4KURL4pathEv
 __ZN7WebCore11FrameLoader13committedLoadEPNS_14DocumentLoaderEPKci
 __ZN7WebCore11FrameLoader11setEncodingERKNS_6StringEb
 __ZN7WebCore11FrameLoader17receivedFirstDataEv
+__ZN3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3setERKS2_RKj
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTra
+__ZNK3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3getERKS2_
 __ZNK7WebCore14SecurityOrigin20isSecureTransitionToERKNS_4KURLE
+__ZN7WebCore22ScriptExecutionContext20stopActiveDOMObjectsEv
 __ZN7WebCore13ContainerNode10willRemoveEv
 __ZN7WebCore4Node10willRemoveEv
+__ZN7WebCore8Document6detachEv
+__ZN7WebCore8Document18clearAXObjectCacheEv
+__ZNK7WebCore8Document11topDocumentEv
+__ZNK7WebCore8Document12ownerElementEv
+__ZN7WebCore8Document26documentWillBecomeInactiveEv
+__ZN7WebCore13ContainerNode6detachEv
+__ZN7WebCore7Element6detachEv
+__ZN7WebCore7Element27cancelFocusAppearanceUpdateEv
+__ZN7WebCore4Node6detachEv
+__ZN7WebCore11RenderBlock7destroyEv
+__ZN7WebCore21RenderObjectChildList23destroyLeftoverChildrenEv
+__ZN7WebCore17RenderLineBoxList15deleteLineBoxesEPNS_11RenderArenaE
+__ZN7WebCore9RenderBox7destroyEv
+__ZN7WebCore20RenderBoxModelObject7destroyEv
+__ZN7WebCore11RenderLayer14clearClipRectsEv
+__ZN7WebCore12RenderObject7destroyEv
+__ZNK7WebCore12EventHandler18autoscrollRendererEv
+__ZN7WebCore19AnimationController16cancelAnimationsEPNS_12RenderObjectE
+__ZN7WebCore11RenderBlock11removeChildEPNS_12RenderObjectE
+__ZN7WebCore12RenderObject11removeChildEPS0_
+__ZN7WebCore21RenderObjectChildList15removeChildNodeEPNS_12RenderObjectES2_b
+__ZN7WebCore9RenderBox20deleteLineBoxWrapperEv
+__ZN7WebCore20RenderBoxModelObject12destroyLayerEv
+__ZN7WebCore11RenderLayer7destroyEPNS_11RenderArenaE
+__ZN7WebCore11RenderLayerD0Ev
+__ZN7WebCore11RenderLayer16destroyScrollbarENS_20ScrollbarOrientationE
+__ZN7WebCore11RenderLayerdlEPvm
+__ZN7WebCore11RenderArena4freeEmPv
+__ZN7WebCore12RenderObject11arenaDeleteEPNS_11RenderArenaEPv
+__ZN7WebCore11RenderBlockD0Ev
+__ZN7WebCore9RenderBoxD2Ev
+__ZN7WebCore20RenderBoxModelObjectD2Ev
+__ZN7WebCore12RenderObjectD2Ev
+__ZN7WebCore11RenderStyleD1Ev
+__ZN7WebCore11RenderStyleD2Ev
+__ZN7WebCore12RenderObjectdlEPvm
+__ZN7WebCore10RenderViewD0Ev
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN7WebCore11RenderBlockD2Ev
+__ZN7WebCore18StyleInheritedDataD1Ev
+__ZN7WebCore18StyleInheritedDataD2Ev
+__ZN7WebCore11RenderArenaD1Ev
+__ZN7WebCore11RenderArenaD2Ev
+__ZN7WebCore15FinishArenaPoolEPNS_9ArenaPoolE
+__ZN7WebCoreL13FreeArenaListEPNS_9ArenaPoolEPNS_5ArenaEb
 __ZN7WebCore8Document26removeFocusedNodeOfSubtreeEPNS_4NodeEb
+__ZN7WebCore19SelectionController5clearEv
+__ZN7WebCore19SelectionController12setSelectionERKNS_16VisibleSelectionEbbb
+__ZN7WebCore13TypingCommand11closeTypingEPNS_11EditCommandE
+__ZN7WebCore13TypingCommand26isOpenForMoreTypingCommandEPKNS_11EditCommandE
+__ZN7WebCore5Frame16clearTypingStyleEv
 __ZN7WebCore9FrameView5clearEv
 __ZN7WebCore10ScrollView18setCanBlitOnScrollEb
 __ZN7WebCore10ScrollView26platformSetCanBlitOnScrollEb
-__ZN7WebCore4KURL5parseERKNS_6StringE
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENS9_IjEEEESA_E6expandEv
-__ZN3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3setERKS2_RKj
+__ZN7WebCore5Frame23setSelectionGranularityENS_15TextGranularityE
+__ZThn8_N7WebCore8Document14removedLastRefEv
+__ZN7WebCore8Document14removedLastRefEv
+__ZN7WebCore13ContainerNode17removeAllChildrenEv
+__ZN7WebCore28removeAllChildrenInContainerINS_4NodeENS_13ContainerNodeEEEvPT0_
+__ZN7WebCore7Private28addChildNodesToDeletionQueueINS_4NodeENS_13ContainerNodeEEEvRPT_S6_PT0_
+__ZN7WebCore15HTMLHtmlElementD0Ev
+__ZN7WebCore11HTMLElementD2Ev
+__ZN7WebCore13StyledElementD2Ev
+__ZN7WebCore13StyledElement22destroyInlineStyleDeclEv
+__ZN7WebCore7ElementD2Ev
+__ZN7WebCore13ContainerNodeD2Ev
+__ZN7WebCore4NodeD2Ev
+__ZN7WebCore11EventTargetD2Ev
+__ZN3WTF20deleteAllPairSecondsIPSt4pairINS_6VectorIN7WebCore14DocumentMarkerELm0EEENS2_INS3_7IntRectELm0EEEEKNS_7HashMapINS_6Re
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_17HTMLCanvasElementEEEENS_18PairFirstExtractorIS7_EENS1_10StringH
+__ZN7WebCore12HTMLDocumentD0Ev
+__ZN7WebCore8DocumentD2Ev
+__ZN7WebCore28forgetAllDOMNodesForDocumentEPNS_8DocumentE
+__ZN7WebCore16CSSStyleSelectorD1Ev
+__ZN7WebCore16CSSStyleSelectorD2Ev
+__ZN7WebCore19MediaQueryEvaluatorD1Ev
+__ZN7WebCore19MediaQueryEvaluatorD2Ev
+__ZN7WebCore10CSSRuleSetD1Ev
+__ZN7WebCore10CSSRuleSetD2Ev
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15CSSRuleDataListEKNS_7HashMapIPNS1_16AtomicStringImplES3_NS_7PtrHashIS6_EENS_10HashTr
+__ZN3WTF15deleteAllValuesIPN7WebCore16MediaQueryResultELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEEENS_18PairFirstExtractorIS
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZN7WebCore15CSSFontSelectorD0Ev
+__ZN7WebCore9FontCache12removeClientEPNS_12FontSelectorE
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN3WTF20deleteAllPairSecondsIPNS_6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EEEKNS_7HashMapINS3_6StringES7_NS3_15CaseFold
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashMapIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS8
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE6shrinkEm
+__ZN7WebCore9FillLayerD1Ev
+__ZN7WebCore9FillLayerD2Ev
+__ZN7WebCore9DocLoaderD1Ev
+__ZN7WebCore9DocLoaderD2Ev
+__ZN7WebCore9DocLoader13clearPreloadsEv
+__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN7WebCore5Cache15removeDocLoaderEPNS_9DocLoaderE
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15CollectionCacheEKNS_7HashMapIPNS1_16AtomicStringImplES3_NS_7PtrHashIS6_EENS_10HashTr
+__ZN7WebCore14StyleSheetList17documentDestroyedEv
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTabl
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_15CollectionCacheEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
+__ZN7WebCore15CollectionCacheD1Ev
+__ZN7WebCore15CollectionCacheD2Ev
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore7ElementEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsI
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN7WebCore14StyleSheetListD1Ev
+__ZN7WebCore14StyleSheetListD2Ev
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableE
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN7WebCore22ScriptExecutionContextD2Ev
+__ZN3WTF9HashTableIPN7WebCore11MessagePortES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocat
+__ZN7WebCore19TextResourceDecoderD1Ev
+__ZN7WebCore19TextResourceDecoderD2Ev
 __ZNK7WebCore11HistoryItem13documentStateEv
 __ZN7WebCore8Document26setStateForNewFormElementsERKN3WTF6VectorINS_6StringELm0EEE
 __ZN7WebCore11FrameLoader21dispatchDidCommitLoadEv
+__ZN7WebCore4Page27setJavaScriptURLsAreAllowedEb
 __ZN7WebCore15FocusController9setActiveEb
+__ZN7WebCore19SelectionController21pageActivationChangedEv
+__ZN7WebCore5Frame20setSelectionFromNoneEv
+__ZNK7WebCore5Frame17isContentEditableEv
+__ZNK7WebCore6Editor16clientIsEditableEv
+__ZNK7WebCore8Document12inDesignModeEv
+__ZN7WebCore5Frame22clearCaretRectIfNeededEv
+__ZN7WebCore19SelectionController19invalidateCaretRectEv
+__ZN7WebCore5Frame22selectionLayoutChangedEv
+__ZN7WebCore19SelectionController18recomputeCaretRectEv
+__ZNK7WebCore19SelectionController14localCaretRectEv
+__ZN7WebCore19SelectionController6layoutEv
+__ZNK7WebCore19SelectionController26absoluteBoundsForLocalRectERKNS_7IntRectE
+__ZNK7WebCore19SelectionController13caretRendererEv
+__ZN7WebCore10RenderView14clearSelectionEv
+__ZN7WebCore10RenderView20repaintViewRectangleERKNS_7IntRectEb
+__ZN7WebCore10RenderView12setSelectionEPNS_12RenderObjectEiS2_iNS0_20SelectionRepaintModeE
 __ZNK7WebCore6Editor7canEditEv
-__ZNK7WebCore9Selection17isContentEditableEv
+__ZNK7WebCore16VisibleSelection17isContentEditableEv
 __ZN7WebCore18isEditablePositionERKNS_8PositionE
 __ZN7WebCore19InspectorController13didCommitLoadEPNS_14DocumentLoaderE
+__ZN7WebCore11FrameLoader29dispatchWindowObjectAvailableEv
 __ZN7WebCore16parseHTTPRefreshERKNS_6StringEbRdRS0_
 __ZN7WebCore8Document24setShouldCreateRenderersEb
 __ZN7WebCore11FrameLoader7addDataEPKci
 __ZN7WebCore19TextResourceDecoder11setEncodingERKNS_12TextEncodingENS0_14EncodingSourceE
 __ZNK7WebCore12TextEncoding10isJapaneseEv
+__ZNK7WebCore19TextResourceDecoder16shouldAutoDetectEv
 __ZN7WebCoreL15newTextCodecICUERKNS_12TextEncodingEPKv
 __ZN7WebCore12TextCodecICUC1ERKNS_12TextEncodingE
+__ZN7WebCore12TextCodecICUC2ERKNS_12TextEncodingE
 __ZN7WebCore12TextCodecICU6decodeEPKcmbbRb
 __ZNK7WebCore12TextCodecICU18createICUConverterEv
 __ZN7WebCoreL18cachedConverterICUEv
 __ZN7WebCore12TextCodecICU14decodeToBufferEPtS1_RPKcS3_PibR10UErrorCode
-__ZN3WTF6VectorItLm0EE14expandCapacityEmPKt
-__ZN3WTF6VectorItLm0EE14expandCapacityEm
-__ZN3WTF6VectorItLm0EE15reserveCapacityEm
-__ZN7WebCore12TextCodecICU29registerExtendedEncodingNamesEPFvPKcS2_E
-__ZN7WebCore12TextCodecICU22registerExtendedCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZN3WTF9HashTableIPKcSt4pairIS2_N7WebCore16TextCodecFactoryEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS5_EEEESD_E4findIS2_NS_22IdentityHashTranslatorIS2_S6_SA_EEEENS_17HashTableIteratorIS2_S6_S8_SA_SF_SD_EERKT_
-__ZN7WebCore12TextCodecMac21registerEncodingNamesEPFvPKcS2_E
-__ZN7WebCore12TextCodecMac14registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
 __ZNK7WebCore12TextEncoding18usesVisualOrderingEv
-__ZNK7WebCore11RenderStyle21contentDataEquivalentEPKS0_
+__ZNK7WebCore25StyleRareNonInheritedData21contentDataEquivalentERKS0_
 __ZNK7WebCore11RenderStyleeqERKS0_
 __ZNK7WebCore18StyleInheritedDataeqERKS0_
 __ZNK7WebCore4FonteqERKS0_
 __ZN7WebCore13HTMLTokenizer5writeERKNS_15SegmentedStringEb
 __ZN7WebCore15SegmentedStringC1ERKS0_
+__ZN7WebCore15SegmentedStringC2ERKS0_
 __ZN7WebCore13HTMLTokenizer6setSrcERKNS_15SegmentedStringE
 __ZN7WebCore15SegmentedStringaSERKS0_
 __ZN7WebCore13HTMLTokenizer8parseTagERNS_15SegmentedStringENS0_5StateE
-__ZN7WebCore13HTMLTokenizer12parseCommentERNS_15SegmentedStringENS0_5StateE
-__ZNK7WebCore15SegmentedString6lengthEv
-__ZN7WebCore13HTMLTokenizer19enlargeScriptBufferEi
-__ZN7WebCore13HTMLTokenizer14processListingENS_15SegmentedStringENS0_5StateE
-__ZN7WebCore15SegmentedString15advanceSlowCaseEv
-__ZN7WebCore15SegmentedString16advanceSubstringEv
-__ZN7WebCore10StringImpl29createStrippingNullCharactersEPKtj
-__ZN7WebCore10HTMLParser10parseTokenEPNS_5TokenE
-__ZN7WebCore10HTMLParser7getNodeEPNS_5TokenE
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_MNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEEENS_18PairFirstExtractorISE_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSK_ISD_EEEESL_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_MNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEEENS_18PairFirstExtractorISE_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSK_ISD_EEEESL_E4findIS3_NS_22IdentityHashTranslatorIS3_SE_SI_EEEENS_17HashTableIteratorIS3_SE_SG_SI_SN_SL_EERKT_
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEMNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSF_ISC_EEE3setERKS3_RKSC_
-__ZN7WebCore10HTMLParser23commentCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore7CommentC1EPNS_8DocumentERKNS_6StringE
-__ZN7WebCore13CharacterDataC2EPNS_8DocumentERKNS_6StringEb
-__ZNK7WebCore4Node13isHTMLElementEv
-__ZNK7WebCore4Node16virtualLocalNameEv
-__ZNK7WebCore7Comment13isCommentNodeEv
-__ZN7WebCore4Node16insertedIntoTreeEb
-__ZN7WebCore4Node21finishParsingChildrenEv
-__ZN7WebCore10HTMLParser15processCloseTagEPNS_5TokenE
-__ZN7WebCore4Text21createWithLengthLimitEPNS_8DocumentERKNS_6StringERjj
-__ZN7WebCore4TextC1EPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore4Node13isCommentNodeEv
-__ZNK7WebCore4Text8nodeTypeEv
-__ZN7WebCore10HTMLParser11handleErrorEPNS_4NodeEbRKNS_12AtomicStringEi
-__ZNK7WebCore13CharacterData22containsOnlyWhitespaceEv
-__ZN7WebCore10StringImpl22containsOnlyWhitespaceEv
-__ZN7WebCore10TreeSharedINS_4NodeEE14removedLastRefEv
-__ZN7WebCore12AtomicString3addEPKt
-__ZN7WebCore18HTMLElementFactory17createHTMLElementERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCoreL6addTagERKNS_13QualifiedNameEPFN3WTF10PassRefPtrINS_11HTMLElementEEES2_PNS_8DocumentEPNS_15HTMLFormElementEbE
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEPNS1_15HTMLFormElementEbEENS_18PairFirstExtractorISH_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSN_ISG_EEEESO_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEPNS1_15HTMLFormElementEbEENS_18PairFirstExtractorISH_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSN_ISG_EEEESO_E4findIS3_NS_22IdentityHashTranslatorIS3_SH_SL_EEEENS_17HashTableIteratorIS3_SH_SJ_SL_SQ_SO_EERKT_
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEPNS1_15HTMLFormElementEbENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSI_ISF_EEE3setERKS3_RKSF_
-__ZN7WebCoreL15htmlConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore7Element15setAttributeMapEN3WTF10PassRefPtrINS_12NamedAttrMapEEE
-__ZNK7WebCore15HTMLHtmlElement17endTagRequirementEv
-__ZNK7WebCore14DocumentLoader28mainResourceApplicationCacheEv
-__ZN7WebCore11HTMLElement12childAllowedEPNS_4NodeE
-__ZN7WebCore4Node12childAllowedEPS0_
-__ZN7WebCore7Element16childTypeAllowedENS_4Node8NodeTypeE
-__ZN7WebCore15HTMLHtmlElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore10HTMLParser20headCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore15HTMLHeadElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore15HTMLHeadElement17endTagRequirementEv
-__ZN7WebCore10HTMLParser8popBlockERKNS_12AtomicStringEb
-__ZNK7WebCore15HTMLHeadElement11tagPriorityEv
-__ZNK7WebCore7Element8nodeTypeEv
-__ZN7WebCore7Element15childrenChangedEbPNS_4NodeES2_i
-__ZNK7WebCore4Node22nonRendererRenderStyleEv
-__ZN7WebCoreL20loadFullDefaultStyleEv
-__ZN7WebCore11CSSRuleDataD2Ev
-__ZN7WebCore13CSSStyleSheetD1Ev
-__ZN7WebCore15CSSSelectorListD1Ev
-__ZN7WebCore26CSSMutableStyleDeclarationD1Ev
-__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EE6shrinkEm
-__ZN7WebCore5themeEv
-__ZN7WebCore14RenderThemeMacC1Ev
-__ZN7WebCore11RenderThemeC2Ev
-__ZN7WebCore13platformThemeEv
--[WebCoreRenderThemeNotificationObserver initWithTheme:]
-__ZN7WebCore11RenderTheme22extraDefaultStyleSheetEv
-__ZN7WebCore13CSSStyleSheet12addNamespaceEPNS_9CSSParserERKNS_12AtomicStringES5_
-__ZN7WebCore9CSSParser12parseContentEib
-__ZN7WebCore12CSSValueListC1Eb
-__ZN7WebCore6StringC1EPKtj
-__ZN7WebCore17CSSPrimitiveValue6createERKNS_6StringENS0_9UnitTypesE
-__ZN7WebCore17CSSPrimitiveValueC1ERKNS_6StringENS0_9UnitTypesE
-__ZN7WebCore12CSSValueList6appendEN3WTF10PassRefPtrINS_8CSSValueEEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE15reserveCapacityEm
-__ZN7WebCore9CSSParser15parseFontWeightEb
-__ZN7WebCore11CSSSelector13setTagHistoryEPS0_
-__ZN7WebCore11CSSSelector12setAttributeERKNS_13QualifiedNameE
-__ZN7WebCore10StringImplC2EPKtjj
-__ZN7WebCore9CSSParser10parseColorEPNS_14CSSParserValueE
-__ZN7WebCore9CSSParser19parseColorFromValueEPNS_14CSSParserValueERjb
-__ZN7WebCore9CSSParser10parseColorERKNS_6StringERjb
-__ZN7WebCore17CSSPrimitiveValue11createColorEj
-__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3addERKjRKS4_
-__ZN7WebCore17CSSPrimitiveValueC1Ej
-__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSC_IS5_EEEESD_E5clearEv
-__ZN7WebCore5Color13parseHexColorERKNS_6StringERj
-__ZN7WebCore9CSSParser17parseFillPropertyEiRiS1_RN3WTF6RefPtrINS_8CSSValueEEES6_
-__ZN7WebCore9CSSParser14parseFillImageERN3WTF6RefPtrINS_8CSSValueEEE
-__ZN7WebCore13CSSImageValueC1Ev
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4PairEEE
-__ZN7WebCore9CSSParser14parseFontStyleEb
-__ZN7WebCore9CSSParser15parseFontFamilyEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_15CSSRuleDataListEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SB_EEEENS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCoreL9printEvalEv
-__ZN7WebCore11RenderTheme21extraQuirksStyleSheetEv
-__ZN7WebCore9CSSParser16parseFontVariantEb
-__ZN7WebCore11CSSSelector17setSimpleSelectorEPS0_
-__ZN7WebCore15HTMLHeadElement12childAllowedEPNS_4NodeE
-__ZN7WebCore4Text6attachEv
-__ZN7WebCore5Token12addAttributeERNS_12AtomicStringERKS1_b
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE15reserveCapacityEm
-__ZNK7WebCore12NamedAttrMap16getAttributeItemERKNS_13QualifiedNameE
-__ZNK7WebCore12NamedAttrMap6lengthEv
-__ZN7WebCore12NamedAttrMap12addAttributeEN3WTF10PassRefPtrINS_9AttributeEEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14shrinkCapacityEm
-__ZN7WebCoreL15linkConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLLinkElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
-__ZN7WebCore13StyledElement16attributeChangedEPNS_9AttributeEb
-__ZN7WebCore15MappedAttribute17isMappedAttributeEv
-__ZNK7WebCore11HTMLElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZNK7WebCore13StyledElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore15HTMLLinkElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLLinkElement20tokenizeRelAttributeERKNS_12AtomicStringERbS4_S4_S4_
-__ZN7WebCore15HTMLLinkElement7processEv
-__ZNK7WebCore4Node13ownerDocumentEv
-__ZN7WebCore16CSSStyleSelector23hasSelectorForAttributeERKNS_12AtomicStringE
-__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEEbRKT_
-__ZN7WebCore7Element16attributeChangedEPNS_9AttributeEb
-__ZNK7WebCore8Document13axObjectCacheEv
-__ZN7WebCore8parseURLERKNS_6StringE
-__ZN3WTF6VectorItLm2048EE6shrinkEm
-__ZNK7WebCore8Document11completeURLERKNS_6StringE
-__ZN7WebCore4KURLC1ERKS0_RKNS_6StringERKNS_12TextEncodingE
-__ZNK7WebCore12TextEncoding25encodingForFormSubmissionEv
-__ZNK7WebCore12TextEncoding22isNonByteBasedEncodingEv
-__ZN7WebCore25UTF16LittleEndianEncodingEv
-__ZN7WebCore22UTF16BigEndianEncodingEv
-__ZN7WebCore22UTF32BigEndianEncodingEv
-__ZN7WebCore25UTF32LittleEndianEncodingEv
-__ZN7WebCoreL12UTF7EncodingEv
-__ZNK7WebCore4KURL14isHierarchicalEv
-__ZN7WebCoreL20copyPathRemovingDotsEPcPKcii
-__ZNK7WebCore15HTMLLinkElement17endTagRequirementEv
-__ZNK7WebCore15HTMLLinkElement11tagPriorityEv
-__ZN7WebCore15HTMLHeadElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore15HTMLLinkElement20insertedIntoDocumentEv
-__ZN7WebCore8Document26addStyleSheetCandidateNodeEPNS_4NodeEb
-__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE3addERKS3_
-__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore19MediaQueryEvaluatorC1Eb
-__ZN7WebCore9MediaListC1EPNS_13CSSStyleSheetERKNS_6StringEb
-__ZN7WebCore9MediaList12setMediaTextERKNS_6StringERi
-__ZN7WebCore9MediaListC1EPNS_13CSSStyleSheetEb
-__ZNK7WebCore6String5splitEtRN3WTF6VectorIS0_Lm0EEE
-__ZNK7WebCore6String5splitERKS0_bRN3WTF6VectorIS0_Lm0EEE
-__ZN3WTF15deleteAllValuesIPN7WebCore10MediaQueryELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EEaSERKS4_
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14shrinkCapacityEm
-__ZN7WebCore9MediaList13notifyChangedEv
-__ZN7WebCore9MediaListD1Ev
-__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_9MediaListEPNS_16CSSStyleSelectorE
-__ZNK7WebCore11FrameLoader8encodingEv
-__ZN7WebCore9DocLoader20requestCSSStyleSheetERKNS_6StringES3_
-__ZN7WebCore9DocLoader15requestResourceENS_14CachedResource4TypeERKNS_6StringES5_b
-__ZN7WebCore9DocLoader10canRequestENS_14CachedResource4TypeERKNS_4KURLE
-__ZN7WebCore9DocLoader14checkForReloadERKNS_4KURLE
-__ZNK3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E8containsIS2_NS_22IdentityHashTranslatorIS2_S2_S5_EEEEbRKT_
-__ZN7WebCore5Cache14resourceForURLERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore6StringEPNS1_14CachedResourceENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
-__ZN7WebCore5Cache15requestResourceEPNS_9DocLoaderENS_14CachedResource4TypeERKNS_4KURLERKNS_6StringEb
-__ZN7WebCore11FrameLoader21restrictAccessToLocalEv
-__ZN7WebCore11FrameLoader7canLoadERKNS_4KURLERKNS_6StringEPKNS_8DocumentE
-__ZN7WebCore11FrameLoader21shouldTreatURLAsLocalERKNS_6StringE
-__ZN7WebCoreL14createResourceENS_14CachedResource4TypeERKNS_4KURLERKNS_6StringE
-__ZN7WebCore19CachedCSSStyleSheetC1ERKNS_6StringES3_
-__ZN7WebCore14CachedResourceC2ERKNS_6StringENS0_4TypeE
-__ZN7WebCore14CachedResource4loadEPNS_9DocLoaderE
-__ZN7WebCore14CachedResource4loadEPNS_9DocLoaderEbbb
-__ZN7WebCore6Loader4loadEPNS_9DocLoaderEPNS_14CachedResourceEbbb
-__ZN7WebCore7RequestC1EPNS_9DocLoaderEPNS_14CachedResourceEbbb
-__ZN7WebCore14CachedResource10setRequestEPNS_7RequestE
-__ZN7WebCore4KURLC1ERKNS_6StringE
-__ZNK7WebCore6Loader17determinePriorityEPKNS_14CachedResourceE
-__ZN7WebCore6Loader4Host10addRequestEPNS_7RequestENS0_8PriorityE
-__ZN3WTF5DequeIPN7WebCore7RequestEE14expandCapacityEv
-__ZN7WebCore9DocLoader21incrementRequestCountEv
-__ZNK7WebCore14SecurityOrigin8toStringEv
-__ZN7WebCore17SubresourceLoader6createEPNS_5FrameEPNS_23SubresourceLoaderClientERKNS_15ResourceRequestEbbb
-__ZNK7WebCore11FrameLoader16outgoingReferrerEv
-__ZN7WebCore11FrameLoader18shouldHideReferrerERKNS_4KURLERKNS_6StringE
-__ZN7WebCore10protocolIsERKNS_6StringEPKc
-__ZN3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS1_6StringEENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IS4_EEEESB_E4findIS2_NS_22IdentityHashTranslatorIS2_S5_S8_EEEENS_17HashTableIteratorIS2_S5_S7_S8_SD_SB_EERKT_
-__ZNK7WebCore11FrameLoader14outgoingOriginEv
-__ZNK7WebCore19ResourceRequestBase13isConditionalEv
-__ZNK3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS1_6StringEENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IS4_EEEESB_E8containsIS2_NS_22IdentityHashTranslatorIS2_S5_S8_EEEEbRKT_
-__ZNK7WebCore11FrameLoader15originalRequestEv
-__ZN7WebCore19ResourceRequestBase14setCachePolicyENS_26ResourceRequestCachePolicyE
-__ZN7WebCore11FrameLoader34addExtraFieldsToSubresourceRequestERNS_15ResourceRequestE
-__ZN7WebCore17SubresourceLoaderC1EPNS_5FrameEPNS_23SubresourceLoaderClientEbb
-__ZN7WebCore14DocumentLoader20addSubresourceLoaderEPNS_14ResourceLoaderE
-__ZN3WTF7HashSetINS_6RefPtrIN7WebCore14ResourceLoaderEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14ResourceLoaderEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_EC1ERKSB_
-__ZN7WebCore14ResourceLoader4loadERKNS_15ResourceRequestE
-__ZN7WebCore17SubresourceLoader15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore11FrameLoader32assignIdentifierToInitialRequestEmRKNS_15ResourceRequestE
-__ZN7WebCore14DocumentLoader19scheduleArchiveLoadEPNS_14ResourceLoaderERKNS_15ResourceRequestERKNS_4KURLE
-__ZNK7WebCore14DocumentLoader21archiveResourceForURLERKNS_4KURLE
-__ZN7WebCore14DocumentLoader28scheduleApplicationCacheLoadEPNS_14ResourceLoaderERKNS_15ResourceRequestERKNS_4KURLE
-__ZN7WebCore14DocumentLoader38shouldLoadResourceFromApplicationCacheERKNS_15ResourceRequestERPNS_24ApplicationCacheResourceE
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore17SubresourceLoaderEEESt4pairIS4_PNS2_7RequestEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E6expandEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_14CachedResourceEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E6expandEv
-__ZN7WebCore5Cache16resourceAccessedEPNS_14CachedResourceE
-__ZN7WebCore5Cache17removeFromLRUListEPNS_14CachedResourceE
-__ZNK7WebCore14CachedResource12overheadSizeEv
-__ZN7WebCore5Cache10adjustSizeEbi
-__ZN7WebCore5Cache15insertInLRUListEPNS_14CachedResourceE
-__ZN7WebCore5Cache10lruListForEPNS_14CachedResourceE
-__ZN3WTF6VectorIN7WebCore5Cache7LRUListELm32EE4growEm
-__ZNK3WTF7HashMapIN7WebCore6StringENS1_20CachedResourceHandleINS1_14CachedResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_20CachedResourceHandleINS1_14CachedResourceEEEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6expandEv
-__ZN7WebCore24CachedResourceHandleBase11setResourceEPNS_14CachedResourceE
-__ZN7WebCore9DocLoader22checkCacheObjectStatusEPNS_14CachedResourceE
-__ZNK7WebCore9DocLoader5frameEv
-__ZN7WebCore19CachedCSSStyleSheet9addClientEPNS_20CachedResourceClientE
-__ZN7WebCore10HTMLParser20bodyCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore10HTMLParser9startBodyEv
-__ZN7WebCoreL15bodyConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLBodyElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore15HTMLBodyElement17endTagRequirementEv
-__ZNK7WebCore15HTMLBodyElement11tagPriorityEv
-__ZN7WebCore15HTMLBodyElement20insertedIntoDocumentEv
-__ZN7WebCore11HTMLElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore11HTMLElement15inEitherTagListEPKNS_4NodeE
-__ZN7WebCore10HTMLParser23pCloserCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCoreL14divConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore14HTMLDivElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore14HTMLDivElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore14HTMLDivElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore11HTMLElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore13StyledElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore13StyledElement21classAttributeChangedERKNS_12AtomicStringE
-__ZN7WebCore18NamedMappedAttrMap8setClassERKNS_6StringE
-__ZN7WebCore15EventTargetNode28dispatchSubtreeModifiedEventEv
-__ZN7WebCore4Node31notifyNodeListsAttributeChangedEv
-__ZN7WebCore4Node36notifyLocalNodeListsAttributeChangedEv
-__ZNK7WebCore14HTMLDivElement17endTagRequirementEv
-__ZNK7WebCore14HTMLDivElement11tagPriorityEv
-__ZN7WebCoreL13inlineTagListEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCoreL12blockTagListEv
-__ZN7WebCoreL16imageConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore15HTMLImageLoaderC1EPNS_7ElementE
-__ZN7WebCore11ImageLoaderC2EPNS_7ElementE
-__ZNK7WebCore16HTMLImageElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLImageElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore11ImageLoader38updateFromElementIgnoringPreviousErrorEv
-__ZN7WebCore11ImageLoader17updateFromElementEv
-__ZNK7WebCore7Element24imageSourceAttributeNameEv
-__ZNK7WebCore15HTMLImageLoader9sourceURIERKNS_12AtomicStringE
-__ZN7WebCore9DocLoader12requestImageERKNS_6StringE
-__ZN7WebCore11CachedImageC1ERKNS_6StringE
-__ZN7WebCore11CachedImage4loadEPNS_9DocLoaderE
-__ZN7WebCore11ImageLoader15setLoadingImageEPNS_11CachedImageE
-__ZN7WebCore11CachedImage9addClientEPNS_20CachedResourceClientE
-__ZNK7WebCore16HTMLImageElement17endTagRequirementEv
-__ZNK7WebCore16HTMLImageElement11tagPriorityEv
-__ZN7WebCore16HTMLImageElement20insertedIntoDocumentEv
-__ZN7WebCore12HTMLDocument12addNamedItemERKNS_12AtomicStringE
-__ZN7WebCoreL12addItemToMapERN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiEEEERKNS_12AtomicStringE
-__ZN7WebCore12HTMLDocument17addExtraNamedItemERKNS_12AtomicStringE
-__ZN7WebCore16HTMLImageElement6attachEv
-__ZN7WebCoreL20paragraphConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore20HTMLParagraphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore20HTMLParagraphElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore20HTMLParagraphElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore20HTMLParagraphElement17endTagRequirementEv
-__ZNK7WebCore20HTMLParagraphElement11tagPriorityEv
-__ZN7WebCore20HTMLParagraphElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore11HTMLElement15inInlineTagListEPKNS_4NodeE
-__ZN7WebCore10HTMLParser22nestedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCoreL17anchorConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLAnchorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17HTMLAnchorElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLAnchorElement17endTagRequirementEv
-__ZNK7WebCore17HTMLAnchorElement11tagPriorityEv
-__ZN7WebCore15SegmentedString15advanceSlowCaseERi
-__ZNK7WebCore8Document15isMediaDocumentEv
-__ZN7WebCore11FrameLoader14didReceiveDataEPNS_14ResourceLoaderEPKcii
-__ZN7WebCore15ProgressTracker17incrementProgressEmPKci
-__ZNK7WebCore11FrameLoader27numPendingOrLoadingRequestsEb
-__ZNK7WebCore11FrameLoader15firstLayoutDoneEv
-__ZN7WebCore11FrameLoader31dispatchDidReceiveContentLengthEPNS_14DocumentLoaderEmi
-__ZN7WebCore19InspectorController23didReceiveContentLengthEPNS_14DocumentLoaderEmi
-__ZN7WebCore18MainResourceLoader16didFinishLoadingEv
-__ZN7WebCore11FrameLoader15finishedLoadingEv
-__ZN7WebCoreL15addEncodingNameERN3WTF7HashSetIPKcNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEES3_
-__ZN3WTF7HashSetIPKcNS_7PtrHashIS2_EENS_10HashTraitsIS2_EEE3addERKS2_
-__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E6expandEv
-__ZNK3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E8containsIS2_NS_22IdentityHashTranslatorIS2_S2_S6_EEEEbRKT_
-__ZN7WebCore12TextCodecICUD1Ev
-__ZNK7WebCore12TextCodecICU19releaseICUConverterEv
-__ZN7WebCore9FrameView16restoreScrollbarEv
-__ZN7WebCore11FrameLoader10gotoAnchorEv
-__ZNK7WebCore8Document12getCSSTargetEv
-__ZN7WebCore14ResourceLoader16didFinishLoadingEv
-__ZN7WebCore14ResourceLoader23didFinishLoadingOnePartEv
-__ZN7WebCore11FrameLoader13didFinishLoadEPNS_14ResourceLoaderE
-__ZN3WTF9HashTableImSt4pairImPN7WebCore12ProgressItemEENS_18PairFirstExtractorIS5_EENS_7IntHashImEENS_14PairHashTraitsINS_10HashTraitsImEENSB_IS4_EEEESC_E4findImNS_22IdentityHashTranslatorImS5_S9_EEEENS_17HashTableIteratorImS5_S7_S9_SE_SC_EERKT_
-__ZN7WebCore11FrameLoader24dispatchDidFinishLoadingEPNS_14DocumentLoaderEm
-__ZN7WebCore19InspectorController16didFinishLoadingEPNS_14DocumentLoaderEm
-__ZN7WebCore6Loader4Host14cancelRequestsEPNS_9DocLoaderE
-__ZN7WebCore6Loader4Host21cancelPendingRequestsERN3WTF5DequeIPNS_7RequestEEEPNS_9DocLoaderE
-__ZN7WebCore14CachedResource13makePurgeableEb
-__ZNK7WebCore9DocLoader11cachePolicyEv
-__ZNK7WebCore11FrameLoader11cachePolicyEv
-__ZNK7WebCore14CachedResource14mustRevalidateENS_11CachePolicyE
-__ZNK7WebCore9Tokenizer10wellFormedEv
-__ZN7WebCore11FrameLoader15startIconLoaderEv
-__ZN7WebCore11FrameLoader7iconURLEv
-__ZN7WebCore19AnimationController16resumeAnimationsEPNS_8DocumentE
-__ZN7WebCore26AnimationControllerPrivate16resumeAnimationsEPNS_8DocumentE
-__ZN7WebCore26AnimationControllerPrivate20updateAnimationTimerEb
-__ZN7WebCore8Document26dispatchImageLoadEventsNowEv
-__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EEaSERKS4_
-__ZN7WebCore11FrameLoader19handledOnloadEventsEv
-__ZN7WebCore9FrameView6layoutEb
-__ZNK7WebCore16CSSStyleSelector24affectedByViewportChangeEv
-__ZNK7WebCore5Frame18needsReapplyStylesEv
-__ZN7WebCore5Frame13reapplyStylesEv
-__ZN7WebCore5Frame17setUserStyleSheetERKNS_6StringE
-__ZN7WebCore8Document17setUserStyleSheetERKNS_6StringE
-__ZN7WebCore9FrameView23applyOverflowToViewportEPNS_12RenderObjectERNS_13ScrollbarModeES4_
-__ZNK7WebCore6Widget9frameRectEv
-__ZNK7WebCore6Widget12getOuterViewEv
-__ZN7WebCore10ScrollView25platformSetScrollbarModesEv
-__ZNK7WebCore10ScrollView12layoutHeightEv
-__ZNK7WebCore10ScrollView18visibleContentRectEb
-__ZNK7WebCore10ScrollView26platformVisibleContentRectEb
-__ZNK7WebCore10ScrollView11layoutWidthEv
-__ZN7WebCore9FrameView20pauseScheduledEventsEv
-__ZN7WebCore9FrameView21beginDeferredRepaintsEv
-__ZN7WebCore10RenderView6layoutEv
-__ZNK7WebCore10RenderView8printingEv
-__ZNK7WebCore10RenderView9viewWidthEv
-__ZNK7WebCore10ScrollView14useFixedLayoutEv
-__ZN7WebCore12RenderObject19setChildNeedsLayoutEbb
-__ZN7WebCore11RenderBlock6layoutEv
-__ZN7WebCore11RenderBlock11layoutBlockEb
-__ZN7WebCore11RenderBlock27layoutOnlyPositionedObjectsEv
-__ZNK7WebCore11RenderBlock18desiredColumnWidthEv
-__ZNK7WebCore9RenderBox11clientWidthEv
-__ZNK7WebCore12RenderObject14isRenderInlineEv
-__ZNK7WebCore9RenderBox10borderLeftEv
-__ZNK7WebCore9RenderBox11borderRightEv
-__ZNK7WebCore9RenderBox22verticalScrollbarWidthEv
-__ZNK7WebCore9RenderBox11paddingLeftEb
-__ZNK7WebCore9RenderBox12paddingRightEb
-__ZN7WebCore10RenderView9calcWidthEv
-__ZN7WebCore11RenderBlock15calcColumnWidthEv
-__ZN7WebCore11RenderBlock29setDesiredColumnCountAndWidthEii
-__ZN7WebCore11RenderBlock11clearFloatsEv
-__ZNK7WebCore11RenderBlock12avoidsFloatsEv
-__ZNK7WebCore12RenderObject12avoidsFloatsEv
-__ZNK7WebCore12RenderObject4isHREv
-__ZN7WebCore11RenderBlock19layoutBlockChildrenEbRi
-__ZNK7WebCore9RenderBox9borderTopEv
-__ZNK7WebCore9RenderBox10paddingTopEb
-__ZNK7WebCore9RenderBox12borderBottomEv
-__ZNK7WebCore9RenderBox13paddingBottomEb
-__ZNK7WebCore9RenderBox25horizontalScrollbarHeightEv
-__ZN7WebCore11RenderBlock10MarginInfoC1EPS0_ii
-__ZN7WebCore11RenderBlock12layoutLegendEb
-__ZN7WebCore11RenderBlock18handleSpecialChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
-__ZN7WebCore11RenderBlock21handlePositionedChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
-__ZN7WebCore11RenderBlock19handleFloatingChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
-__ZN7WebCore11RenderBlock16handleRunInChildEPNS_9RenderBoxERb
-__ZN7WebCore9RenderBox19calcVerticalMarginsEv
-__ZNK7WebCore12RenderObject15containingBlockEv
-__ZNK7WebCore12RenderObject10isFrameSetEv
-__ZNK7WebCore12RenderObject7isMediaEv
-__ZNK7WebCore12RenderObject14isSVGContainerEv
-__ZN7WebCore11RenderBlock24estimateVerticalPositionEPNS_9RenderBoxERKNS0_10MarginInfoE
-__ZNK7WebCore11RenderBlock11floatBottomEv
-__ZN7WebCore9RenderBox9calcWidthEv
-__ZNK7WebCore9FrameView10layoutRootEb
-__ZNK7WebCore12RenderObject13isFlexibleBoxEv
-__ZNK7WebCore9RenderBox29shouldCalculateSizeAsReplacedEv
-__ZNK7WebCore9RenderBox20containingBlockWidthEv
-__ZNK7WebCore12RenderObject19shrinkToAvoidFloatsEv
-__ZNK7WebCore11RenderBlock14availableWidthEv
-__ZN7WebCore9RenderBox14calcWidthUsingENS_9WidthTypeEi
-__ZNK7WebCore9RenderBox21sizesToIntrinsicWidthENS_9WidthTypeE
-__ZNK7WebCore11RenderBlock26isInlineBlockOrInlineTableEv
-__ZNK7WebCore9RenderBox18calcBorderBoxWidthEi
-__ZNK7WebCore9RenderBox28stretchesToMinIntrinsicWidthEv
-__ZN7WebCore11RenderBlock20layoutInlineChildrenEbRiS1_
-__ZN7WebCore11RenderBlock21checkLinesForOverflowEv
-__ZNK7WebCore11RenderBlock14hasLineIfEmptyEv
-__ZNK7WebCore11HTMLElement17isContentEditableEv
-__ZNK7WebCore5Frame17isContentEditableEv
-__ZNK7WebCore6Editor16clientIsEditableEv
-__ZNK7WebCore8Document12inDesignModeEv
-__ZN7WebCore11RenderBlock13layoutColumnsEi
-__ZN7WebCore9RenderBox10calcHeightEv
-__ZNK7WebCore12RenderObject7isTableEv
-__ZN7WebCore9RenderBox15calcHeightUsingERKNS_6LengthE
-__ZNK7WebCore9RenderBox19calcBorderBoxHeightEi
-__ZNK7WebCore11RenderBlock12maxTopMarginEb
-__ZNK7WebCore11RenderBlock15maxBottomMarginEb
-__ZNK7WebCore10RenderView10viewHeightEv
-__ZNK7WebCore12RenderObject14hasControlClipEv
-__ZNK7WebCore11RenderBlock9floatRectEv
-__ZN7WebCore11RenderBlock17addVisualOverflowERKNS_7IntRectE
-__ZN7WebCore11RenderBlock23layoutPositionedObjectsEb
-__ZN7WebCore11RenderBlock18positionListMarkerEv
-__ZN7WebCore11RenderBlock15collapseMarginsEPNS_9RenderBoxERNS0_10MarginInfoEi
-__ZNK7WebCore11RenderBlock21isSelfCollapsingBlockEv
-__ZNK7WebCore11RenderBlock16isTopMarginQuirkEv
-__ZN7WebCore11RenderBlock19clearFloatsIfNeededEPNS_9RenderBoxERNS0_10MarginInfoEii
-__ZN7WebCore11RenderBlock13getClearDeltaEPNS_9RenderBoxE
-__ZN7WebCore11RenderBlock14containsFloatsEv
-__ZN7WebCore11RenderBlock27determineHorizontalPositionEPNS_9RenderBoxE
-__ZN7WebCore11RenderBlock20addOverhangingFloatsEPS0_iib
-__ZNK7WebCore11RenderBlock11overflowTopEb
-__ZNK7WebCore11RenderBlock14overflowHeightEb
-__ZNK7WebCore11RenderBlock13overflowWidthEb
-__ZNK7WebCore11RenderBlock12overflowLeftEb
-__ZNK7WebCore12RenderObject27checkForRepaintDuringLayoutEv
-__ZN7WebCore11RenderBlock19handleBottomOfBlockEiiRNS0_10MarginInfoE
-__ZN7WebCore11RenderBlock24setCollapsedBottomMarginERKNS0_10MarginInfoE
-__ZN7WebCore10RenderView10calcHeightEv
-__ZN7WebCore11RenderBlock16setOverflowWidthEi
-__ZN7WebCore11RenderBlock17setOverflowHeightEi
-__ZNK7WebCore10RenderView8docWidthEv
-__ZNK7WebCore11RenderBlock17rightmostPositionEbb
-__ZNK7WebCore10RenderFlow10hasColumnsEv
-__ZNK7WebCore10RenderView9docHeightEv
-__ZThn268_N7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
-__ZN7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
-__ZN7WebCore14CachedResource14setDecodedSizeEj
-__ZN7WebCore5Cache32insertInLiveDecodedResourcesListEPNS_14CachedResourceE
-__ZNK7WebCore11BitmapImage21mayFillWithSolidColorEv
-__ZNK7WebCore11BitmapImage16currentFrameSizeEv
-__ZThn268_N7WebCore11CachedImage7didDrawEPKNS_5ImageE
-__ZN7WebCore11CachedImage7didDrawEPKNS_5ImageE
-__ZN7WebCore14CachedResource20didAccessDecodedDataEd
-__ZN7WebCore5Cache34removeFromLiveDecodedResourcesListEPNS_14CachedResourceE
-__ZNK7WebCore16StyleCachedImage9canRenderEf
-__ZN3WTF7HashMapIPN7WebCore11RenderImageEPNS1_20RenderImageScaleDataENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
-__ZN7WebCore9RenderBox12imageChangedEPvPKNS_7IntRectE
-__ZN7WebCore9RenderBox25repaintLayerRectsForImageEPvPKNS_9FillLayerEb
-__ZN7WebCore9RenderBox32calculateBackgroundImageGeometryEPKNS_9FillLayerEiiiiRNS_7IntRectERNS_8IntPointERNS_7IntSizeE
-__ZNK7WebCore9RenderBox23calculateBackgroundSizeEPKNS_9FillLayerEii
-__ZN7WebCore16StyleCachedImage21setImageContainerSizeERKNS_7IntSizeE
-__ZN7WebCore11CachedImage21setImageContainerSizeERKNS_7IntSizeE
-__ZN7WebCore5Image16setContainerSizeERKNS_7IntSizeE
-__ZNK7WebCore16StyleCachedImage9imageSizeEPKNS_12RenderObjectEf
-__ZN7WebCore12RenderObject16repaintRectangleERKNS_7IntRectEb
-__ZNK7WebCore11RenderLayer11boundingBoxEPKS0_
-__ZNK7WebCore14RenderReplaced12overflowRectEb
-__ZNK7WebCore16StyleCachedImage5imageEPNS_12RenderObjectERKNS_7IntSizeE
-__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectERKNS_8IntPointERKNS_7IntSizeENS_17CompositeOperatorE
-__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectERKNS_10FloatPointERKNS_9FloatSizeENS_17CompositeOperatorE
-__ZNK7WebCore5Image17hasRelativeHeightEv
-__ZN7WebCore20TransformationMatrixC1Ev
-__ZN7WebCore20TransformationMatrix5scaleEdd
-__ZNK7WebCore9FloatRect8containsERKS0_
-__ZN7WebCore12EventHandler10mouseMovedEP7NSEvent
-__ZN7WebCoreL12currentEventEv
-__ZN7WebCore18PlatformMouseEventC1EP7NSEvent
-__ZN7WebCore13pointForEventEP7NSEvent
-__ZN7WebCore8IntPointC1ERK8_NSPoint
-__ZN7WebCore19globalPointForEventEP7NSEvent
-__ZN7WebCore11globalPointERK8_NSPointP8NSWindow
-__ZN7WebCore15screenForWindowEP8NSWindow
-__ZN7WebCore15flipScreenPointERK8_NSPointP8NSScreen
-__ZN7WebCore12EventHandler10mouseMovedERKNS_18PlatformMouseEventE
-__ZN7WebCore13HitTestResultC1ERKNS_8IntPointE
-__ZN7WebCore12EventHandler20handleMouseMoveEventERKNS_18PlatformMouseEventEPNS_13HitTestResultE
-__ZN7WebCore12EventHandler17prepareMouseEventERKNS_14HitTestRequestERKNS_18PlatformMouseEventE
-__ZNK7WebCore10ScrollView16windowToContentsERKNS_8IntPointE
-__ZNK7WebCore6Widget27convertFromContainingWindowERKNS_8IntPointE
-__ZNK7WebCore8IntPointcv8_NSPointEv
-__ZN7WebCore8Document17prepareMouseEventERKNS_14HitTestRequestERKNS_8IntPointERKNS_18PlatformMouseEventE
-__ZNK7WebCore8Document10renderViewEv
-__ZN7WebCore11RenderLayer7hitTestERKNS_14HitTestRequestERNS_13HitTestResultE
-__ZN7WebCore8Document12updateLayoutEv
-__ZN7WebCore11RenderLayer12hitTestLayerEPS0_RKNS_14HitTestRequestERNS_13HitTestResultERKNS_7IntRectERKNS_8IntPointEb
-__ZN7WebCore12RenderObject7hitTestERKNS_14HitTestRequestERNS_13HitTestResultERKNS_8IntPointEiiNS_13HitTestFilterE
-__ZN7WebCore11RenderBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore11RenderImage11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore9RenderBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore12RenderObject9lastChildEv
-__ZN7WebCore11RenderBlock24isPointInOverflowControlERNS_13HitTestResultEiiii
-__ZN7WebCore11RenderBlock15hitTestContentsERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore12RenderObject19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
-__ZN7WebCore13HitTestResult12setInnerNodeEPNS_4NodeE
-__ZN7WebCore13HitTestResult21setInnerNonSharedNodeEPNS_4NodeE
-__ZN7WebCore11RenderLayer22updateHoverActiveStateERKNS_14HitTestRequestERNS_13HitTestResultE
-__ZN7WebCore8Document12setHoverNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore13ContainerNode9setActiveEbb
-__ZN7WebCore13ContainerNode10setHoveredEb
-__ZNK7WebCore12RenderObject13hoverAncestorEv
-__ZN7WebCore28MouseEventWithHitTestResultsC1ERKNS_18PlatformMouseEventERKNS_13HitTestResultE
-__ZN7WebCore13HitTestResultC1ERKS0_
-__ZN7WebCore13HitTestResultD1Ev
-__ZN7WebCore13HitTestResultaSERKS0_
-__ZN7WebCore10ScrollView19scrollbarUnderMouseERKNS_18PlatformMouseEventE
-__ZNK7WebCore28MouseEventWithHitTestResults9scrollbarEv
-__ZN7WebCoreL24subframeForHitTestResultERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore12EventHandler12selectCursorERKNS_28MouseEventWithHitTestResultsEPNS_9ScrollbarE
-__ZNK7WebCore28MouseEventWithHitTestResults10targetNodeEv
-__ZNK7WebCore28MouseEventWithHitTestResults10isOverLinkEv
-__ZNK7WebCore11RenderLayer22isPointInResizeControlERKNS_8IntPointE
-__ZN7WebCore13pointerCursorEv
-__ZN7WebCore6CursorC1EP8NSCursor
-__ZN7WebCore6CursorC1ERKS0_
-__ZN7WebCore6Widget9setCursorERKNS_6CursorE
-__ZN7WebCore6CursorD1Ev
-__ZN7WebCore12EventHandler18dispatchMouseEventERKNS_12AtomicStringEPNS_4NodeEbiRKNS_18PlatformMouseEventEb
-__ZN7WebCore12EventHandler26updateMouseEventTargetNodeEPNS_4NodeERKNS_18PlatformMouseEventEb
-__ZN7WebCore15EventTargetNode18dispatchMouseEventERKNS_18PlatformMouseEventERKNS_12AtomicStringEiPNS_4NodeE
-__ZN7WebCore15EventTargetNode18dispatchMouseEventERKNS_12AtomicStringEiiiiiibbbbbPNS_4NodeEN3WTF10PassRefPtrINS_5EventEEE
-__ZNK7WebCore8Document9domWindowEv
-__ZN7WebCore10MouseEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_15EventTargetNodeEEENS5_INS_9ClipboardEEEb
-__ZN7WebCore17MouseRelatedEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbb
-__ZN7WebCore7UIEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEi
-__ZN7WebCoreL9contentsXEPNS_9DOMWindowE
-__ZN7WebCoreL9contentsYEPNS_9DOMWindowE
-__ZN7WebCore17MouseRelatedEvent15initCoordinatesEv
-__ZN7WebCore5Event18setUnderlyingEventEN3WTF10PassRefPtrIS0_EE
-__ZN7WebCore17MouseRelatedEvent14receivedTargetEv
-__ZThn32_N7WebCore15EventTargetNode6toNodeEv
-__ZN7WebCore15EventTargetNode6toNodeEv
-__ZNK7WebCore9RenderBox15absoluteToLocalENS_10FloatPointEbb
-__ZNK7WebCore10RenderView15absoluteToLocalENS_10FloatPointEbb
-__ZN7WebCore12EventHandler23handleMouseDraggedEventERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore12EventHandler10handleDragERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore13HitTestResult22setToNonShadowAncestorEv
-__ZN7WebCore6Chrome23mouseDidMoveOverElementERKNS_13HitTestResultEj
-__ZNK7WebCore13HitTestResult15absoluteLinkURLEv
-__ZN7WebCore19InspectorController23mouseDidMoveOverElementERKNS_13HitTestResultEj
-__ZN7WebCore6Chrome10setToolTipERKNS_13HitTestResultE
-__ZNK7WebCore13HitTestResult15spellingToolTipEv
-__ZN7WebCore8Document21markerContainingPointERKNS_8IntPointENS_14DocumentMarker10MarkerTypeE
-__ZNK7WebCore13HitTestResult5titleEv
-__ZNK7WebCore11HistoryItem17originalURLStringEv
-__ZN7WebCore5TimerINS_8DocumentEE5firedEv
-__ZN7WebCore8Document24imageLoadEventTimerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore11HistoryItem5titleEv
-__ZN7WebCore12EventHandler20hitTestResultAtPointERKNS_8IntPointEb
-__ZNK7WebCore13HitTestResult10isSelectedEv
-__ZN7WebCore19SelectionController8containsERKNS_8IntPointE
-__ZN7WebCore9FrameView18updateControlTintsEv
-__ZNK7WebCore14RenderThemeMac20supportsControlTintsEv
-__ZN7WebCore15GraphicsContext23setUpdatingControlTintsEb
-__ZN7WebCore19SelectionController27focusedOrActiveStateChangedEv
-__ZNK7WebCore5Frame15selectionBoundsEb
-__ZNK7WebCore10RenderView15selectionBoundsEb
-__ZN7WebCoreL21rendererAfterPositionEPNS_12RenderObjectEj
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_PNS2_13SelectionInfoEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6expandEv
-__ZN7WebCore5Frame15setCaretVisibleEb
-__ZN7WebCore12EventHandler27capsLockStateMayHaveChangedEv
-__ZNK7WebCore8Document32useSecureKeyboardEntryWhenActiveEv
-__ZN7WebCore10RenderFlow12hitTestLinesERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore13RootInlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore13InlineFlowBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore13InlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZNK7WebCore4Node17isContentEditableEv
-__ZNK7WebCore4Node17canStartSelectionEv
-__ZN7WebCore11iBeamCursorEv
-__ZN7WebCore15BackForwardList16forwardListCountEv
-__ZN7WebCore15BackForwardList13backListCountEv
-__ZN7WebCore15BackForwardList11itemAtIndexEi
-__ZN7WebCore17BeforeUnloadEventC1Ev
-__ZN7WebCore4Page23clearUndoRedoOperationsEv
-__ZN7WebCore11HistoryItem14setScrollPointERKNS_8IntPointE
-__ZN3WTF6VectorIN7WebCore16ResourceResponseELm0EE6shrinkEm
-__ZN7WebCore13AXObjectCacheD1Ev
-__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E6expandEv
-__ZN7WebCore14CachedResource12removeClientEPNS_20CachedResourceClientE
-__ZN3WTF9HashTableIPN7WebCore20CachedResourceClientESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E4findIS3_NS_22IdentityHashTranslatorIS3_S5_S9_EEEENS_17HashTableIteratorIS3_S5_S7_S9_SE_SC_EERKT_
-__ZN3WTF9HashTableIPN7WebCore11RenderImageESt4pairIS3_PNS1_20RenderImageScaleDataEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SB_EEEENS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCore14RenderReplacedD0Ev
-__ZN7WebCore10RenderText7destroyEv
-__ZN7WebCore12RenderObject20deleteLineBoxWrapperEv
-__ZN7WebCore10RenderTextD1Ev
-__ZN7WebCore16StyleCachedImage12removeClientEPNS_12RenderObjectE
-__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE6shrinkEm
-__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE14deleteAllNodesEv
-__ZN7WebCore9PageGroup10removePageEPNS_4PageE
-__ZN7WebCore9PageCache6removeEPNS_11HistoryItemE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE6shrinkEm
-__ZN7WebCore7CommentD1Ev
-__ZN7WebCore15HTMLHeadElementD1Ev
-__ZN7WebCore15HTMLBodyElementD1Ev
-__ZN7WebCore12NamedAttrMap17detachFromElementEv
-__ZN7WebCore18NamedMappedAttrMap15clearAttributesEv
-__ZN7WebCore12NamedAttrMap15clearAttributesEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE6shrinkEm
-__ZN7WebCore18NamedMappedAttrMapD1Ev
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE6shrinkEm
-__ZN7WebCore15HTMLImageLoaderD2Ev
-__ZN7WebCore11ImageLoaderD0Ev
-__ZN7WebCore8Document11removeImageEPNS_11ImageLoaderE
-__ZN7WebCore17CSSPrimitiveValue7cleanupEv
-__ZN7WebCore11CSSSelectorD2Ev
-__ZN7WebCore16StyleCachedImageD1Ev
-__ZN7WebCore17CSSPrimitiveValueD1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE6shrinkEm
-__ZN7WebCore15FontFamilyValueD1Ev
-__ZN3WTF9HashTableIPKN7WebCore4NodeESt4pairIS4_PNS1_12NodeRareDataEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E4findIS4_NS_22IdentityHashTranslatorIS4_S8_SC_EEEENS_17HashTableIteratorIS4_S8_SA_SC_SH_SF_EERKT_
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore15DynamicNodeList6CachesEKNS_7HashMapINS1_6StringES4_NS1_10StringHashENS_10HashTraitsIS6_EENS8_IS4_EEEEEEvRT0_
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore15DynamicNodeList6CachesEKNS_7HashMapINS1_13QualifiedNameES4_NS1_17QualifiedNameHashENS_10HashTraitsIS6_EENS8_IS4_EEEEEEvRT0_
-__ZN3WTF9HashTableIPN7WebCore15DynamicNodeListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore11HistoryItemD1Ev
-__ZN7WebCore12IconDatabase21releaseIconForPageURLERKNS_6StringE
-__ZNK7WebCore11HistoryItem14alternateTitleEv
-__ZNK7WebCore11HistoryItem10visitCountEv
-__ZNK7WebCore11HistoryItem8childrenEv
-__ZN7WebCore5Cache27removeFromLiveResourcesSizeEPNS_14CachedResourceE
-__ZN7WebCore19CachedCSSStyleSheet17allClientsRemovedEv
-__ZNK7WebCore14CachedResource21isSafeToMakePurgeableEv
-__ZN7WebCore11CachedImage17allClientsRemovedEv
-__ZN7WebCore11BitmapImage14resetAnimationEv
-__ZN7WebCore11BitmapImage13stopAnimationEv
-__ZN7WebCore11BitmapImage29destroyDecodedDataIfNecessaryEb
-__ZN7WebCore14CachedResource16deleteIfPossibleEv
-sqlite3AnalysisLoad
-sqlite3VdbeIdxRowid
-__ZN7WebCore15SQLiteStatement11columnCountEv
-sqlite3_data_count
-sqlite3_column_int
-__ZN7WebCore11HistoryItemC1ERKNS_6StringES3_S3_d
-__ZN7WebCore11HistoryItem7visitedERKNS_6StringEd
-__ZNK7WebCore11RenderBlock14lowestPositionEbb
-__ZN7WebCore9FrameView19endDeferredRepaintsEv
-__ZN7WebCore5Frame19invalidateSelectionEv
-__ZN7WebCore19SelectionController14setNeedsLayoutEb
-__ZN7WebCore5Frame22selectionLayoutChangedEv
-__ZN7WebCore19SelectionController18recomputeCaretRectEv
-__ZNK7WebCore19SelectionController14localCaretRectEv
-__ZN7WebCore19SelectionController6layoutEv
-__ZNK7WebCore19SelectionController16caretRepaintRectEv
-__ZNK7WebCore19SelectionController13caretRendererEv
-__ZN7WebCore10RenderView14clearSelectionEv
-__ZN7WebCore10RenderView12setSelectionEPNS_12RenderObjectEiS2_i
-__ZN7WebCore9FrameView14adjustViewSizeEv
-__ZN7WebCore10ScrollView23platformSetContentsSizeEv
-__ZN7WebCore5Frame11forceLayoutEb
-__ZN7WebCore11RenderLayer20updateLayerPositionsEbb
-__ZN7WebCore12RenderObject7repaintEb
-__ZN7WebCore9RenderBox29clippedOverflowRectForRepaintEPS0_
-__ZNK7WebCore11RenderBlock12overflowRectEb
-__ZN7WebCore10RenderView21computeRectForRepaintEPNS_9RenderBoxERNS_7IntRectEb
-__ZN7WebCore10RenderView20repaintViewRectangleERKNS_7IntRectEb
-__ZN7WebCore9FrameView23repaintContentRectangleERKNS_7IntRectEb
-__ZN7WebCore7IntRect9intersectERKS0_
-__ZN7WebCore7IntRect5uniteERKS0_
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE15reserveCapacityEm
-__ZN7WebCore11RenderLayer19updateLayerPositionEv
-__ZNK7WebCore11RenderLayer20convertToLayerCoordsEPKS0_RiS3_
-__ZN7WebCore11RenderLayer24positionOverflowControlsEii
-__ZN7WebCore11RenderLayer15updateTransformEv
-__ZNK7WebCore9RenderBox23outlineBoundsForRepaintEPS0_
-__ZNK7WebCore9RenderBox17borderBoundingBoxEv
-__ZNK7WebCore12RenderObject29adjustRectForOutlineAndShadowERNS_7IntRectE
--[DOMHTMLCollection dealloc]
-__ZN7WebCore14HTMLCollectionD1Ev
--[DOMObject dealloc]
-__ZN7WebCore16removeDOMWrapperEP17DOMObjectInternal
--[WebScriptObject dealloc]
--[DOMNode dealloc]
-__ZN7WebCore4AttrD1Ev
--[DOMNamedNodeMap dealloc]
--[DOMNodeList dealloc]
-__ZN7WebCore4Node25unregisterDynamicNodeListEPNS_15DynamicNodeListE
-__ZN7WebCore15GraphicsContextC1EP9CGContext
-__ZN7WebCore15GraphicsContext28createGraphicsContextPrivateEv
-__ZN7WebCore15GraphicsContext19setPaintingDisabledEb
-__ZNK7WebCore15GraphicsContext9fillColorEv
-__ZN7WebCore15GraphicsContext20setPlatformFillColorERKNS_5ColorE
-__ZNK7WebCore15GraphicsContext16paintingDisabledEv
-__ZNK7WebCore15GraphicsContext15platformContextEv
-__ZN7WebCoreL14setCGFillColorEP9CGContextRKNS_5ColorE
-__ZNK7WebCore5Color7getRGBAERfS1_S1_S1_
-__ZNK7WebCore15GraphicsContext11strokeColorEv
-__ZN7WebCore15GraphicsContext22setPlatformStrokeColorERKNS_5ColorE
-__ZN7WebCore9FrameView13paintContentsEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore8Document39invalidateRenderedRectsForMarkersInRectERKNS_7IntRectE
-__ZN7WebCore11RenderLayer5paintEPNS_15GraphicsContextERKNS_7IntRectENS_16PaintRestrictionEPNS_12RenderObjectE
-__ZN7WebCore11RenderLayer10paintLayerEPS0_PNS_15GraphicsContextERKNS_7IntRectEbNS_16PaintRestrictionEPNS_12RenderObjectEbb
-__ZNK7WebCore11RenderLayer13isTransparentEv
-__ZNK7WebCore4Node19virtualNamespaceURIEv
-__ZNK7WebCore11RenderLayer14calculateRectsEPKS0_RKNS_7IntRectERS3_S6_S6_S6_b
-__ZN7WebCore11RenderLayer17updateZOrderListsEv
-__ZN7WebCore11RenderLayer13collectLayersERPN3WTF6VectorIPS0_Lm0EEES6_
-__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE15reserveCapacityEm
-__ZNSt17_Temporary_bufferIPPN7WebCore11RenderLayerES2_EC1ES3_S3_
-__ZSt22__get_temporary_bufferIPN7WebCore11RenderLayerEESt4pairIPT_iEiS5_
-__ZSt22__stable_sort_adaptiveIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
-__ZSt24__merge_sort_with_bufferIPPN7WebCore11RenderLayerES3_PFbS2_S2_EEvT_S6_T0_T1_
-__ZSt22__chunk_insertion_sortIPPN7WebCore11RenderLayerEiPFbS2_S2_EEvT_S6_T0_T1_
-__ZSt16__insertion_sortIPPN7WebCore11RenderLayerEPFbS2_S2_EEvT_S6_T0_
-__ZSt16__merge_adaptiveIPPN7WebCore11RenderLayerEiS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
-__ZSt16__merge_backwardIPPN7WebCore11RenderLayerES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
-__ZSt23return_temporary_bufferIPN7WebCore11RenderLayerEEvPT_
-__ZN7WebCore11RenderLayer18updateOverflowListEv
-__ZNK7WebCore11RenderLayer20intersectsDamageRectERKNS_7IntRectES3_PKS0_
-__ZN7WebCoreL7setClipEPNS_15GraphicsContextERKNS_7IntRectES4_
-__ZN7WebCore10RenderView5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore11RenderBlock11paintObjectERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore10RenderView19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore11RenderLayer21paintOverflowControlsEPNS_15GraphicsContextEiiRKNS_7IntRectE
-__ZN7WebCoreL11restoreClipEPNS_15GraphicsContextERKNS_7IntRectES4_
-__ZN7WebCore11RenderBlock13paintContentsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore11RenderBlock13paintChildrenERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore11RenderBlock14paintSelectionERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore11RenderBlock24shouldPaintSelectionGapsEv
-__ZN7WebCore11RenderBlock11paintFloatsERNS_12RenderObject9PaintInfoEiib
-__ZN7WebCore11RenderBlock10paintCaretERNS_12RenderObject9PaintInfoEiiNS_9CaretTypeE
-__ZNK7WebCore5Frame19dragCaretControllerEv
-__ZN7WebCore11RenderBlock25paintContinuationOutlinesERNS_12RenderObject9PaintInfoEii
-__ZN7WebCoreL24continuationOutlineTableEv
-__ZNK7WebCore12RenderObject20hasOutlineAnnotationEv
-__ZNK7WebCore7Element19virtualNamespaceURIEv
-__ZN7WebCore11RenderLayer15updateClipRectsEPKS0_
-__ZNK7WebCore11RenderLayer18calculateClipRectsEPKS0_RNS_9ClipRectsEb
-__ZN7WebCore9ClipRectsnwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderBlock5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore9RenderBox19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore9RenderBox23paintRootBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore9RenderBox15paintFillLayersERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOperatorE
-__ZN7WebCore9RenderBox14paintFillLayerERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOperatorE
-__ZN7WebCore9RenderBox22paintFillLayerExtendedERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiPNS_13InlineFlowBoxENS_17CompositeOperatorE
-__ZNK7WebCore9FrameView13isTransparentEv
-__ZNK7WebCore9FrameView19baseBackgroundColorEv
-__ZN7WebCore15GraphicsContext4saveEv
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE15reserveCapacityEm
-__ZN7WebCore15GraphicsContext17savePlatformStateEv
-__ZN7WebCore15GraphicsContext21setCompositeOperationENS_17CompositeOperatorE
-__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERKNS_5ColorE
-__ZNK7WebCore9FloatRectcv6CGRectEv
-__ZN7WebCore15GraphicsContext7restoreEv
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE6shrinkEm
-__ZN7WebCore15GraphicsContext20restorePlatformStateEv
-__ZN7WebCore10RenderFlow10paintLinesERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore15GraphicsContextD1Ev
-__ZN7WebCore15GraphicsContext29destroyGraphicsContextPrivateEPNS_22GraphicsContextPrivateE
--[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]
-__ZN7WebCore14ResourceLoader18didReceiveResponseEPNS_14ResourceHandleERKNS_16ResourceResponseE
-__ZNK7WebCore4KURL11isLocalFileEv
-__ZN7WebCore17SubresourceLoader18didReceiveResponseERKNS_16ResourceResponseE
-__ZN7WebCore6Loader4Host18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore17SubresourceLoaderEEEPNS2_7RequestENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
-__ZN7WebCore14CachedResource11setResponseERKNS_16ResourceResponseE
-__ZNK7WebCore20ResourceResponseBase14expirationDateEv
-__ZNK7WebCore20ResourceResponseBase16textEncodingNameEv
--[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:]
-__ZN7WebCore14ResourceLoader14didReceiveDataEPNS_14ResourceHandleEPKcii
-__ZN7WebCore17SubresourceLoader14didReceiveDataEPKcixb
-__ZN7WebCore6Loader4Host14didReceiveDataEPNS_17SubresourceLoaderEPKci
-__ZN7WebCore11CachedImage4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
--[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]
-__ZN7WebCore14ResourceLoader16didFinishLoadingEPNS_14ResourceHandleE
-__ZN7WebCore17SubresourceLoader16didFinishLoadingEv
-__ZN7WebCore6Loader4Host16didFinishLoadingEPNS_17SubresourceLoaderE
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore17SubresourceLoaderEEESt4pairIS4_PNS2_7RequestEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E4findIS4_NS_22IdentityHashTranslatorIS4_S8_SC_EEEENS_17HashTableIteratorIS4_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore9DocLoader21decrementRequestCountEv
-__ZN7WebCore9DocLoader17setLoadInProgressEb
-__ZN7WebCore19CachedCSSStyleSheet4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
-__ZN7WebCore14CachedResource14setEncodedSizeEj
-__ZN7WebCore19TextResourceDecoder18checkForCSSCharsetEPKcmRb
-__ZN7WebCore19CachedCSSStyleSheet11checkNotifyEv
-__ZN7WebCore26CachedResourceClientWalkerC1ERKN3WTF14HashCountedSetIPNS_20CachedResourceClientENS1_7PtrHashIS4_EENS1_10HashTraitsIS4_EEEE
-__ZN7WebCore26CachedResourceClientWalker4nextEv
-__ZNK3WTF9HashTableIPN7WebCore20CachedResourceClientESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E8containsIS3_NS_22IdentityHashTranslatorIS3_S5_S9_EEEEbRKT_
-__ZThn56_N7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZNK7WebCore19CachedCSSStyleSheet9sheetTextEb
-__ZNK7WebCore19CachedCSSStyleSheet11canUseSheetEb
-__ZNK7WebCore13CSSStyleSheet11completeURLERKNS_6StringE
-__ZNK7WebCore9StyleBase7baseURLEv
-__ZN7WebCore9StyleBase10stylesheetEv
-__ZNK7WebCore10StyleSheet12isStyleSheetEv
-__ZN7WebCore13CSSImageValueC1ERKNS_6StringE
-__ZN7WebCore15HTMLLinkElement11sheetLoadedEv
-__ZNK7WebCore15HTMLLinkElement9isLoadingEv
-__ZN7WebCore8Document19recalcStyleSelectorEv
-__ZNK7WebCore15HTMLLinkElement5sheetEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE15reserveCapacityEm
-__ZN7WebCore16HTMLStyleElement5sheetEv
-__ZN7WebCore19MediaQueryEvaluatorC1ERKNS_6StringEPNS_5FrameEPNS_11RenderStyleE
-__ZN7WebCore14StyleSheetList4itemEj
-__ZNK7WebCore11RenderStyle17inheritedNotEqualEPS0_
-__ZNK7WebCore11RenderStyle4diffEPKS0_
-__ZNK7WebCore19TransformOperationseqERKS0_
-__ZN7WebCore4Node11recalcStyleENS0_11StyleChangeE
-__ZN7WebCore7Element11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore12StyleBoxDataeqERKS0_
-__ZN7WebCore4Node14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
-__ZN7WebCore8Document18minimumLayoutDelayEv
-__ZNK7WebCore8Document11elapsedTimeEv
-__ZN7WebCore16CSSStyleSelector24canShareStyleWithElementEPNS_4NodeE
-__ZNK7WebCore8CSSValue16isPrimitiveValueEv
-__ZNK7WebCore12CSSValueList12cssValueTypeEv
-__ZNK7WebCore12CSSValueList11isValueListEv
-__ZN7WebCore11RenderStyle18setFontDescriptionERKNS_15FontDescriptionE
-__ZN7WebCore16CSSStyleSelector10updateFontEv
-__ZN7WebCore16CSSStyleSelector22checkForTextSizeAdjustEv
-__ZN7WebCore16CSSStyleSelector27checkForGenericFamilyChangeEPNS_11RenderStyleES2_
-__ZN7WebCore16CSSStyleSelector18checkForZoomChangeEPNS_11RenderStyleES2_
-__ZN7WebCore17CSSPrimitiveValue8getIdentEv
-__ZN7WebCore17CSSPrimitiveValue12isQuirkValueEv
-__ZN7WebCore17CSSPrimitiveValue25computeLengthIntForLengthEPNS_11RenderStyleEd
-__ZN7WebCore17CSSPrimitiveValue19computeLengthDoubleEPNS_11RenderStyleEdb
-__ZN7WebCore7DataRefINS_17StyleSurroundDataEE6accessEv
-__ZN7WebCore17StyleSurroundDataC1ERKS0_
-__ZN7WebCore4Text16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore13CharacterData16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore4Node16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore4Node16previousRendererEv
-__ZN7WebCore14ClassNamesData12createVectorEv
-__ZNK7WebCore18NamedMappedAttrMap19hasMappedAttributesEv
-__ZN7WebCore7DataRefINS_12StyleBoxDataEE6accessEv
-__ZN7WebCore17CSSPrimitiveValue18computeLengthShortEPNS_11RenderStyleEd
-__ZN7WebCore16CSSStyleSelector26getColorFromPrimitiveValueEPNS_17CSSPrimitiveValueE
-__ZN7WebCore17CSSPrimitiveValue16computeLengthIntEPNS_11RenderStyleEd
-__ZNK7WebCore11CSSSelector9attributeEv
-__ZN7WebCore16HTMLImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore11RenderImageC1EPNS_4NodeE
-__ZN7WebCore14RenderReplacedC2EPNS_4NodeERKNS_7IntSizeE
-__ZN7WebCore11RenderImage13updateAltTextEv
-__ZNK7WebCore16HTMLImageElement7altTextEv
-__ZN7WebCore14RenderReplaced14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZNK7WebCore12RenderObject10firstChildEv
-__ZNK7WebCore12RenderObject13isRenderBlockEv
-__ZNK7WebCore12RenderObject10hasStaticYEv
-__ZNK7WebCore11RenderImage7isImageEv
-__ZNK7WebCore11RenderImage8hasImageEv
-__ZN7WebCore11RenderImage14setCachedImageEPNS_11CachedImageE
-__ZN7WebCoreeqINS_11CachedImageES1_EEbRKNS_20CachedResourceHandleIT_EEPKT0_
-__ZNK7WebCore11BitmapImage4sizeEv
-__ZNK7WebCore12RenderObject4isBREv
-__ZN7WebCore17CSSPrimitiveValue18computeLengthFloatEPNS_11RenderStyleEb
-__ZN7WebCore22CSSQuirkPrimitiveValue12isQuirkValueEv
-__ZN7WebCore11RenderBlock17deleteLineBoxTreeEv
-__ZN7WebCore4Text14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore10RenderTextC1EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
-__ZN7WebCore10RenderText15styleWillChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore10RenderText14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore10RenderFlow26dirtyLinesFromChangedChildEPNS_12RenderObjectE
-__ZNK7WebCore4Node15isIndeterminateEv
-__ZNK7WebCore4Node9isCheckedEv
-__ZNK7WebCore4Node12isAutofilledEv
-__ZN7WebCore7DataRefINS_25StyleRareNonInheritedDataEE6accessEv
-__ZN7WebCore25StyleRareNonInheritedDataC1ERKS0_
-__ZN7WebCore9FillLayerC1ERKS0_
-__ZNK7WebCore12RenderObject22getUncachedPseudoStyleENS_11RenderStyle8PseudoIdEPS1_
-__ZN7WebCore16CSSStyleSelector21pseudoStyleForElementENS_11RenderStyle8PseudoIdEPNS_7ElementEPS1_
-__ZN7WebCore11RenderLayer17dirtyOverflowListEv
-__ZNK7WebCore16CSSStyleSelector15SelectorChecker16checkPseudoStateEPNS_7ElementEb
-__ZN7WebCore15visitedLinkHashERKNS_4KURLERKNS_12AtomicStringE
-__ZN3WTF6VectorItLm512EE6appendItEEvPKT_m
-__ZN7WebCore9PageGroup13isLinkVisitedEy
-__ZN7WebCore9PageGroup14addVisitedLinkEPKtm
-__ZN7WebCore15StyleVisualDataC1ERKS0_
-__ZN7WebCore11RenderStyle15clearCursorListEv
-__ZNK7WebCore8CSSValue11isValueListEv
-__ZN7WebCore7DataRefINS_19StyleBackgroundDataEE6accessEv
-__ZN7WebCore19StyleBackgroundDataC1ERKS0_
-__ZN7WebCore16CSSStyleSelector12mapFillImageEPNS_9FillLayerEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector10styleImageEPNS_8CSSValueE
-__ZNK7WebCore13CSSImageValue12isImageValueEv
-__ZN7WebCore13CSSImageValue11cachedImageEPNS_9DocLoaderE
-__ZNK7WebCore17CSSPrimitiveValue14getStringValueEv
-__ZN7WebCore13CSSImageValue11cachedImageEPNS_9DocLoaderERKNS_6StringE
-__ZN7WebCore16StyleCachedImage9addClientEPNS_12RenderObjectE
-__ZN7WebCore13HTMLTokenizer35executeScriptsWaitingForStylesheetsEv
-__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE6shrinkEm
-__ZN7WebCore14CachedResource6finishEv
-__ZN7WebCore7RequestD1Ev
-__ZN7WebCore11FrameLoader8loadDoneEv
-__ZN7WebCore9DocLoader23checkForPendingPreloadsEv
-__ZN7WebCore14DocumentLoader23removeSubresourceLoaderEPNS_14ResourceLoaderE
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14ResourceLoaderEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEENS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EERKT_
-__ZN7WebCore17SubresourceLoaderD1Ev
-__ZN7WebCore11LayoutStatenwEmPNS_11RenderArenaE
-__ZN7WebCore11LayoutStateC1EPS0_PNS_9RenderBoxERKNS_7IntSizeE
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_PNS1_11RenderBlock14FloatingObjectEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCore9RenderBox21calcHorizontalMarginsERKNS_6LengthES3_i
-__ZN7WebCore11RenderBlock22insertPositionedObjectEPNS_9RenderBoxE
-__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore9RenderBoxEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E6expandEv
-__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore11RenderBlock21adjustPositionedBlockEPNS_9RenderBoxERKNS0_10MarginInfoE
-__ZNK7WebCore12RenderObject10hasStaticXEv
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore11RenderBlock14FloatingObjectEKNS_7HashMapIPNS1_12RenderObjectES4_NS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSA_IS4_EEEEEEvRT0_
-__ZN7WebCore11RenderBlock29markLinesDirtyInVerticalRangeEii
-__ZN7WebCoreL9bidiFirstEPNS_11RenderBlockEPNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEb
-__ZN7WebCore10RenderText14dirtyLineBoxesEbb
-__ZN7WebCore10RenderText15deleteTextBoxesEv
-__ZN7WebCore11RenderBlock22determineStartPositionERbRNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERN3WTF6VectorINS0_13FloatWithRectELm0EEERj
-__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE23commitExplicitEmbeddingEv
-__ZN3WTF6VectorINS_7Unicode9DirectionELm8EE14shrinkCapacityEm
-__ZN7WebCore11RenderBlock17findNextLineBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEPNS_6EClearE
-__ZN7WebCore11RenderBlock21skipLeadingWhitespaceERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEE
-__ZNK7WebCore11RenderBlock9lineWidthEi
-__ZNK7WebCore11RenderBlock11rightOffsetEv
-__ZNK7WebCore11RenderBlock14rightRelOffsetEiibPi
-__ZNK7WebCore11RenderBlock10leftOffsetEv
-__ZNK7WebCore11RenderBlock13leftRelOffsetEiibPi
-__ZNK7WebCore12RenderObject9isSVGTextEv
-__ZNK7WebCore12RenderObject14firstLineStyleEv
-__ZN7WebCoreL11inlineWidthEPNS_12RenderObjectEbb
-__ZNK7WebCore10RenderText11isWordBreakEv
-__ZN7WebCore21nextBreakablePositionEPKtiib
-__ZNK7WebCore10RenderText5widthEjjRKNS_4FontEi
-__ZNK7WebCore4Font12isFixedPitchEv
-__ZNK7WebCore16FontFallbackList14determinePitchEPKNS_4FontE
-__ZN7WebCore9FontCache11getFontDataERKNS_4FontERiPNS_12FontSelectorE
-__ZN7WebCore15CSSFontSelector11getFontDataERKNS_15FontDescriptionERKNS_12AtomicStringE
-__ZN7WebCore10StringImpl11reverseFindEPS0_ib
-__ZN7WebCore9FontCache25getCachedFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringEb
-__ZN7WebCore9FontCache12platformInitEv
-__ZN3WTF9HashTableIN7WebCore24FontPlatformDataCacheKeyESt4pairIS2_PNS1_16FontPlatformDataEENS_18PairFirstExtractorIS6_EENS1_28FontPlatformDataCacheKeyHashENS_14PairHashTraitsINS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIS5_EEEESB_E4findIS2_NS_22IdentityHashTranslatorIS2_S6_S9_EEEENS_17HashTableIteratorIS2_S6_S8_S9_SE_SB_EERKT_
-__ZN7WebCore9FontCache22createFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringE
-__ZN7WebCoreL18toAppKitFontWeightENS_10FontWeightE
-+[WebFontCache fontWithFamily:traits:weight:size:]
-+[WebFontCache internalFontWithFamily:traits:weight:size:]
-__ZL16acceptableChoicejj
-__ZL12betterChoicejijiji
-__ZN7WebCore16FontPlatformData7setFontEP6NSFont
-__ZN3WTF7HashMapIN7WebCore24FontPlatformDataCacheKeyEPNS1_16FontPlatformDataENS1_28FontPlatformDataCacheKeyHashENS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIS4_EEE4takeERKS2_
-__ZN3WTF9HashTableIN7WebCore24FontPlatformDataCacheKeyESt4pairIS2_PNS1_16FontPlatformDataEENS_18PairFirstExtractorIS6_EENS1_28FontPlatformDataCacheKeyHashENS_14PairHashTraitsINS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIS5_EEEESB_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS6_
-__ZNK7WebCore14SimpleFontData9isLoadingEv
-__ZN7WebCore17lineBreakIteratorEPKti
-__ZN7WebCoreL13setUpIteratorERbRPNS_17TextBreakIteratorE18UBreakIteratorTypePKti
-__ZN7WebCore24currentTextBreakLocaleIDEv
-__ZN7WebCore18textBreakFollowingEPNS_17TextBreakIteratorEi
-__ZN7WebCoreL14checkMidpointsERNS_14InlineIteratorE
-__ZN7WebCore11RenderBlock15bidiReorderLineERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS2_
-__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE21createBidiRunsForLineERKS1_bb
-__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE9appendRunEv
-__ZNK7WebCore10RenderText6lengthEv
-__ZN7WebCoreL19appendRunsForObjectEiiPNS_12RenderObjectERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEE
-__ZN7WebCore7BidiRunnwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderBlock13constructLineEjPNS_7BidiRunES2_bPNS_12RenderObjectE
-__ZN7WebCore10RenderText15createInlineBoxEbbb
-__ZN7WebCore10RenderText19createInlineTextBoxEv
-__ZN7WebCore9InlineBoxnwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderBlock15createLineBoxesEPNS_12RenderObjectE
-__ZN7WebCore10RenderFlow15createInlineBoxEbbb
-__ZN7WebCore13InlineFlowBox9addToLineEPNS_9InlineBoxE
-__ZNK7WebCore13InlineTextBox6isTextEv
-__ZNK7WebCore10RenderText14selectionStateEv
-__ZN7WebCore13InlineTextBox15isInlineTextBoxEv
-__ZN7WebCore13InlineFlowBox28determineSpacingForFlowBoxesEbPNS_12RenderObjectE
-__ZN7WebCore9InlineBox15isInlineFlowBoxEv
-__ZN7WebCore13InlineFlowBox14setConstructedEv
-__ZN7WebCore9InlineBox14setConstructedEv
-__ZN7WebCore11RenderBlock33computeHorizontalPositionsForLineEPNS_13RootInlineBoxEPNS_7BidiRunES4_b
-__ZN7WebCore13InlineFlowBox19getFlowSpacingWidthEv
-__ZN7WebCore13InlineFlowBox23marginBorderPaddingLeftEv
-__ZN7WebCore13InlineFlowBox10marginLeftEv
-__ZN7WebCore13InlineFlowBox24marginBorderPaddingRightEv
-__ZN7WebCore13InlineFlowBox11marginRightEv
-__ZNK7WebCore13InlineTextBox11isLineBreakEv
-__ZNK7WebCore10RenderText5widthEjjib
-__ZNK7WebCore10RenderText12maxPrefWidthEv
-__ZN7WebCore10RenderText14calcPrefWidthsEi
-__ZN7WebCore13InlineFlowBox22placeBoxesHorizontallyEiRiS1_Rb
-__ZN7WebCore11RenderBlock31computeVerticalPositionsForLineEPNS_13RootInlineBoxEPNS_7BidiRunE
-__ZN7WebCore13InlineFlowBox20verticallyAlignBoxesEi
-__ZN7WebCore13InlineFlowBox24computeLogicalBoxHeightsERiS1_S1_S1_b
-__ZN7WebCore13RootInlineBox15isRootInlineBoxEv
-__ZNK7WebCore11RenderBlock10lineHeightEbb
-__ZNK7WebCore10RenderFlow10lineHeightEbb
-__ZNK7WebCore12RenderObject10lineHeightEbb
-__ZNK7WebCore11RenderBlock16baselinePositionEbb
-__ZNK7WebCore12RenderObject16baselinePositionEbb
-__ZNK7WebCore10RenderText10lineHeightEbb
-__ZNK7WebCore10RenderText20verticalPositionHintEb
-__ZNK7WebCore12RenderObject20verticalPositionHintEb
-__ZNK7WebCore12RenderObject19getVerticalPositionEb
-__ZN7WebCore13InlineFlowBox20placeBoxesVerticallyEiiibRiS1_S1_S1_
-__ZN7WebCore13RootInlineBox28setVerticalOverflowPositionsEii
-__ZN7WebCore13RootInlineBox29setVerticalSelectionPositionsEii
-__ZN7WebCore13InlineFlowBox29shrinkBoxesWithNoTextChildrenEii
-__ZN7WebCore13RootInlineBox14bottomOverflowEv
-__ZN7WebCore10RenderText8positionEPNS_9InlineBoxE
-__ZN7WebCore13RootInlineBox36computePerCharacterLayoutInformationEv
-__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE10deleteRunsEv
-__ZN7WebCore7BidiRun7destroyEv
-__ZN7WebCore7BidiRundlEPvm
-__ZN7WebCore13RootInlineBox16setLineBreakInfoEPNS_12RenderObjectEjRKNS_10BidiStatusE
-__ZN7WebCore11RenderBlock7newLineENS_6EClearE
-__ZN7WebCore11RenderBlock17positionNewFloatsEv
-__ZN7WebCore13RootInlineBox12leftOverflowEv
-__ZN7WebCore13RootInlineBox11topOverflowEv
-__ZN7WebCore13RootInlineBox13rightOverflowEv
-__ZN7WebCore11LayoutState7destroyEPNS_11RenderArenaE
-__ZN7WebCore11LayoutStatedlEPvm
-__ZNK7WebCore11RenderBlock19isBottomMarginQuirkEv
-__ZN7WebCore11RenderBlock23deleteEllipsisLineBoxesEv
-__ZNK7WebCore12RenderObject12isListMarkerEv
-__ZNK7WebCore12RenderObject6lengthEv
-__ZN7WebCore11RenderBlock25checkLinesForTextOverflowEv
-__ZN7WebCore11RenderLayer27updateScrollInfoAfterLayoutEv
-__ZN7WebCore11RenderLayer23computeScrollDimensionsEPbS1_
-__ZNK7WebCore9RenderBox12clientHeightEv
-__ZN7WebCore11RenderLayer11scrollWidthEv
-__ZN7WebCore11RenderLayer12scrollHeightEv
-__ZN7WebCore14RenderReplaced6layoutEv
-__ZNK7WebCore11RenderImage21minimumReplacedHeightEv
-__ZNK7WebCore11RenderImage13errorOccurredEv
-__ZN7WebCore9RenderBox22calcAbsoluteHorizontalEv
-__ZN7WebCore9RenderBox30calcAbsoluteHorizontalReplacedEv
-__ZNK7WebCore9RenderBox33containingBlockWidthForPositionedEPKNS_12RenderObjectE
-__ZNK7WebCore11RenderImage17calcReplacedWidthEb
-__ZNK7WebCore11RenderImage21imageHasRelativeWidthEv
-__ZNK7WebCore11CachedImage21imageHasRelativeWidthEv
-__ZNK7WebCore5Image16hasRelativeWidthEv
-__ZNK7WebCore11RenderImage16isWidthSpecifiedEv
-__ZNK7WebCore9RenderBox22calcReplacedWidthUsingENS_6LengthE
-__ZNK7WebCore9RenderBox19calcContentBoxWidthEi
-__ZN7WebCore9RenderBox20calcAbsoluteVerticalEv
-__ZN7WebCore9RenderBox28calcAbsoluteVerticalReplacedEv
-__ZNK7WebCore9RenderBox34containingBlockHeightForPositionedEPKNS_12RenderObjectE
-__ZNK7WebCore11RenderImage18calcReplacedHeightEv
-__ZNK7WebCore11RenderImage17isHeightSpecifiedEv
-__ZNK7WebCore9RenderBox23calcReplacedHeightUsingENS_6LengthE
-__ZNK7WebCore9RenderBox20calcContentBoxHeightEi
-__ZN7WebCore14RenderReplaced26adjustOverflowForBoxShadowEv
-__ZNK7WebCore9RenderBox30offsetForPositionedInContainerEPNS_12RenderObjectE
-__ZN7WebCore9RenderBox28calcAbsoluteHorizontalValuesENS_6LengthEPKS0_NS_13TextDirectionEiiS1_S1_S1_S1_RiS5_S5_S5_
-__ZN7WebCore9RenderBox26calcAbsoluteVerticalValuesENS_6LengthEPKS0_iiS1_S1_S1_S1_RiS4_S4_S4_
-__ZN7WebCore11RenderBlock16setMaxTopMarginsEii
-__ZN7WebCore11RenderBlock19setMaxBottomMarginsEii
-__ZNK7WebCore9RenderBox23relativePositionOffsetXEv
-__ZNK7WebCore9RenderBox17rightmostPositionEbb
-__ZNK7WebCore9RenderBox23relativePositionOffsetYEv
-__ZNK7WebCore9RenderBox14lowestPositionEbb
-__ZN7WebCore9ClipRects7destroyEPNS_11RenderArenaE
-__ZN7WebCore9ClipRectsdlEPvm
-__ZNK7WebCore11RenderLayer27enclosingPositionedAncestorEv
-__ZNK7WebCore14RenderReplaced13overflowWidthEb
-__ZNK7WebCore14RenderReplaced14overflowHeightEb
-__ZN7WebCore14RenderReplaced29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZNK7WebCore14RenderReplaced18localSelectionRectEb
-__ZNK7WebCore12RenderObject19virtualContinuationEv
-__ZN7WebCore11FrameLoader30didFirstVisuallyNonEmptyLayoutEv
-__ZN7WebCoreL13compareZIndexEPNS_11RenderLayerES1_
-__ZSt25__unguarded_linear_insertIPPN7WebCore11RenderLayerES2_PFbS2_S2_EEvT_T0_T1_
-__ZNK7WebCore12RenderObject18maximalOutlineSizeENS_10PaintPhaseE
-__ZNK7WebCore7IntRect10intersectsERKS0_
-__ZNK7WebCore11RenderBlock15borderFitAdjustERiS1_
-__ZN7WebCore12RenderObject14paintBoxShadowEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
-__ZN7WebCore15GraphicsContext18addRoundedRectClipERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_
-__ZN7WebCore4Path22createRoundedRectangleERKNS_9FloatRectERKNS_9FloatSizeES6_S6_S6_
-__ZN7WebCore4PathC1Ev
-__ZN7WebCore4Path6moveToERKNS_10FloatPointE
-__ZN7WebCore4Path9addLineToERKNS_10FloatPointE
-__ZN7WebCore4Path16addBezierCurveToERKNS_10FloatPointES3_S3_
-__ZN7WebCore4Path12closeSubpathEv
-__ZN7WebCore4PathC1ERKS0_
-__ZN7WebCore4PathD1Ev
-__ZN7WebCore15GraphicsContext4clipERKNS_4PathE
-__ZN7WebCore12RenderObject11paintBorderEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
-__ZN7WebCore12RenderObject19paintNinePieceImageEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleERKNS_14NinePieceImageENS_17CompositeOperatorE
-__ZN7WebCore12RenderObject10drawBorderEPNS_15GraphicsContextEiiiiNS0_10BorderSideENS_5ColorERKS4_NS_12EBorderStyleEii
-__ZN7WebCore15GraphicsContext14setStrokeStyleERKNS_11StrokeStyleE
-__ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorE
-__ZN7WebCore15GraphicsContext8drawRectERKNS_7IntRectE
-__ZNK7WebCore7IntRectcv6CGRectEv
-__ZNK7WebCore15GraphicsContext11strokeStyleEv
-__ZN7WebCore15GraphicsContext23addInnerRoundedRectClipERKNS_7IntRectEi
-__ZN7WebCore15GraphicsContext4clipERKNS_9FloatRectE
-__ZN7WebCore12RenderObject13drawBorderArcEPNS_15GraphicsContextEiifNS_7IntSizeEiiNS0_10BorderSideENS_5ColorERKS5_NS_12EBorderStyleEb
-__ZN7WebCore15GraphicsContext14setStrokeColorERKNS_5ColorE
-__ZN7WebCore15GraphicsContext18setStrokeThicknessEf
-__ZN7WebCore15GraphicsContext26setPlatformStrokeThicknessEf
-__ZN7WebCore15GraphicsContext9strokeArcERKNS_7IntRectEii
-__ZNK7WebCore15GraphicsContext15strokeThicknessEv
-__ZN7WebCore9InlineBox4rootEv
-__ZN7WebCore13RootInlineBox12selectionTopEv
-__ZN7WebCore13RootInlineBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13InlineFlowBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13InlineFlowBox19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13InlineFlowBox20paintTextDecorationsERNS_12RenderObject9PaintInfoEiib
-__ZN7WebCore13InlineTextBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13InlineTextBox14selectionStateEv
-__ZN7WebCore13InlineTextBox20paintDocumentMarkersEPNS_15GraphicsContextEiiPNS_11RenderStyleERKNS_4FontEb
-__ZN7WebCore8Document14markersForNodeEPNS_4NodeE
-__ZNK7WebCore13InlineTextBox7textPosEv
-__ZN7WebCore21updateGraphicsContextEPNS_15GraphicsContextERKNS_5ColorES4_f
-__ZN7WebCore15GraphicsContext15textDrawingModeEv
-__ZN7WebCoreL20paintTextWithShadowsEPNS_15GraphicsContextERKNS_4FontERKNS_7TextRunEiiRKNS_8IntPointEiiiiPNS_10ShadowDataEb
-__ZN7WebCore15GraphicsContext8drawTextERKNS_4FontERKNS_7TextRunERKNS_8IntPointEii
-__ZNK7WebCore4Font8drawTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZNK7WebCore4Font14drawSimpleTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZNK7WebCore4Font15drawGlyphBufferEPNS_15GraphicsContextERKNS_11GlyphBufferERKNS_7TextRunERKNS_10FloatPointE
-__ZNK7WebCore4Font10drawGlyphsEPNS_15GraphicsContextEPKNS_14SimpleFontDataERKNS_11GlyphBufferEiiRKNS_10FloatPointE
-WebCoreShouldUseFontSmoothing
-__ZNK7WebCore15GraphicsContext9getShadowERNS_7IntSizeERiRNS_5ColorE
-__ZN3WTF6VectorI6CGSizeLm2048EE6shrinkEm
-__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE6shrinkEm
-__ZNK7WebCore13RootInlineBox16paintEllipsisBoxERNS_12RenderObject9PaintInfoEii
-__ZN3WTF11ListHashSetIPN7WebCore10RenderFlowENS_7PtrHashIS3_EEE14deleteAllNodesEv
-__ZN7WebCore9RenderBox19getOverflowClipRectEii
-__ZNK7WebCore11RenderLayer22verticalScrollbarWidthEv
-__ZNK7WebCore11RenderLayer25horizontalScrollbarHeightEv
-__ZN7WebCore11RenderLayer17paintScrollCornerEPNS_15GraphicsContextEiiRKNS_7IntRectE
-__ZN7WebCoreL16scrollCornerRectEPKNS_11RenderLayerERKNS_7IntRectE
-__ZN7WebCore11RenderLayer12paintResizerEPNS_15GraphicsContextEiiRKNS_7IntRectE
-__ZN7WebCore14RenderReplaced5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore14RenderReplaced11shouldPaintERNS_12RenderObject9PaintInfoERiS4_
-__ZNK7WebCore14RenderReplaced11overflowTopEb
-__ZNK7WebCore14RenderReplaced10isSelectedEv
-__ZNK7WebCore14RenderReplaced14selectionStateEv
-__ZNK7WebCore14RenderReplaced12overflowLeftEb
-__ZN7WebCore11RenderImage13paintReplacedERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore11RenderImage5imageEii
-__ZNK7WebCore11CachedImage5imageEv
-__ZNK7WebCore11CachedImage9imageSizeEf
-__ZN7WebCore11CachedImage23maximumDecodedImageSizeEv
-__ZNK7WebCore11ImageSource4sizeEv
-__ZNK7WebCore11ImageSource16frameSizeAtIndexEm
-__ZN7WebCore11CachedImage15notifyObserversEPKNS_7IntRectE
-__ZN7WebCore12RenderObject12imageChangedEPNS_11CachedImageEPKNS_7IntRectE
-__ZN7WebCore11RenderImage12imageChangedEPvPKNS_7IntRectE
-__ZNK7WebCore11RenderImage8imagePtrEv
-__ZNK7WebCore14RenderReplaced13intrinsicSizeEv
-__ZNK7WebCore11RenderImage9imageSizeEf
-__ZN7WebCore14RenderReplaced16setIntrinsicSizeERKNS_7IntSizeE
-__ZN7WebCore20CachedResourceClient12imageChangedEPNS_11CachedImageEPKNS_7IntRectE
-__ZN7WebCore11CachedImage11checkNotifyEv
-__ZN7WebCore20CachedResourceClient14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore15HTMLImageLoader14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore11ImageLoader14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore8Document26dispatchImageLoadEventSoonEPNS_11ImageLoaderE
-__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE6shrinkEm
-__ZN7WebCore15HTMLImageLoader17dispatchLoadEventEv
-__ZN7WebCore15EventTargetNode20dispatchEventForTypeERKNS_12AtomicStringEbb
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE6shrinkEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE6shrinkEm
-__ZNK7WebCore17StyleSurroundDataeqERKS0_
-__ZNK7WebCore14NinePieceImageeqERKS0_
-__ZN7WebCore4Text11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore25StyleRareNonInheritedDataeqERKS0_
-__ZN3WTFeqIN7WebCore20StyleDashboardRegionELm0EEEbRKNS_6VectorIT_XT0_EEES7_
-__ZNK7WebCore25StyleRareNonInheritedData20shadowDataEquivalentERKS0_
-__ZNK7WebCore25StyleRareNonInheritedData24reflectionDataEquivalentERKS0_
-__ZNK7WebCore25StyleRareNonInheritedData23animationDataEquivalentERKS0_
-__ZNK7WebCore25StyleRareNonInheritedData24transitionDataEquivalentERKS0_
-__ZNK7WebCore9FillLayereqERKS0_
-__ZN7WebCore25StyleRareNonInheritedDataD1Ev
-__ZNK7WebCore19StyleBackgroundDataeqERKS0_
-__ZNK7WebCore9FillLayer13containsImageEPNS_10StyleImageE
-__ZNK7WebCore16StyleCachedImage4dataEv
-__ZN7WebCore15StyleVisualDataD1Ev
-__ZN7WebCore13RootInlineBox7destroyEPNS_11RenderArenaE
-__ZN7WebCore13RootInlineBox17detachEllipsisBoxEPNS_11RenderArenaE
-__ZN7WebCore9InlineBox7destroyEPNS_11RenderArenaE
-__ZN7WebCore13RootInlineBoxD1Ev
-__ZN7WebCore9InlineBoxdlEPvm
-__ZN7WebCore24RenderImageScaleObserver28shouldImagePaintAtLowQualityEPNS_11RenderImageERKNS_7IntSizeE
-__ZNK7WebCore11BitmapImage13isBitmapImageEv
-__ZNK7WebCore4Page34inLowQualityImageInterpolationModeEv
-__ZN3WTF9HashTableIPN7WebCore11RenderImageESt4pairIS3_PNS1_20RenderImageScaleDataEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6expandEv
-__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_7IntRectENS_17CompositeOperatorEb
-__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_7IntRectES5_NS_17CompositeOperatorEb
-__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_9FloatRectES5_NS_17CompositeOperatorEb
-__ZN7WebCore11BitmapImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
-__ZN7WebCore11BitmapImage14startAnimationEb
-__ZN7WebCore11BitmapImage13shouldAnimateEv
-__ZN7WebCore18MainResourceLoader15handleEmptyLoadERKNS_4KURLEb
-__ZN7WebCore11FrameLoader29generatedMIMETypeForURLSchemeERKNS_6StringE
-__ZN7WebCore11PolicyCheck3setEPFvPvNS_12PolicyActionEES1_
-__ZN7WebCore11FrameLoader26continueAfterContentPolicyENS_12PolicyActionE
-__ZN7WebCore11PolicyCheck4callENS_12PolicyActionE
-__ZNK7WebCore14DocumentLoader11originalURLEv
-__ZNK7WebCore14DocumentLoader10requestURLEv
-WebCoreSetShouldUseFontSmoothing
-__ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
-__ZN7WebCore12IconDatabase14checkIntegrityEv
-sqlite3VdbeAddOpList
-sqlite3OpenTempDatabase
-sqlite3BtreeIntegrityCheck
-checkList
-checkTreePage
-__ZN7WebCore15SQLiteStatement13getColumnTextEi
-sqlite3_column_text16
-__ZN7WebCore6StringC1EPKt
-__ZN7WebCore4Page16setDefersLoadingEb
-__ZN7WebCore11FrameLoader16setDefersLoadingEb
-__ZN7WebCore14DocumentLoader16setDefersLoadingEb
-__ZN7WebCoreL19setAllDefersLoadingERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEEb
-__ZN7WebCore23ApplicationCacheStorage16cacheGroupForURLERKNS_4KURLE
-__ZN7WebCore23ApplicationCacheStorage22loadManifestHostHashesEv
-__ZN7WebCore23ApplicationCacheStorage12openDatabaseEb
-__ZN7WebCoreL11urlHostHashERKNS_4KURLE
-__ZNK3WTF9HashTableIjSt4pairIjjENS_18PairFirstExtractorIS2_EEN7WebCore13AlreadyHashedENS_14PairHashTraitsINS_10HashTraitsIjEES9_EES9_E8containsIjNS_22IdentityHashTranslatorIjS2_S6_EEEEbRKT_
-__ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
-__ZN7WebCore14DocumentLoader36deliverSubstituteResourcesAfterDelayEv
-__ZN7WebCore18MainResourceLoader16setDefersLoadingEb
-__ZN7WebCore14ResourceLoader16setDefersLoadingEb
--[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]
-__ZN7WebCore12IconDatabase24getOrCreatePageURLRecordERKNS_6StringE
--[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]
-__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleEP19NSCachedURLResponse
-__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleERNS_18CacheStoragePolicyE
--[NSHTTPURLResponse(WebCoreURLResponse) _webcore_MIMEType]
-__ZNK7WebCore4KURL4pathEv
 __ZN7WebCore13HTMLTokenizer12parseDoctypeERNS_15SegmentedStringENS0_5StateE
 __ZN7WebCore13HTMLTokenizer19processDoctypeTokenEv
 __ZN7WebCore10HTMLParser17parseDoctypeTokenEPNS_12DoctypeTokenE
 __ZN7WebCore12DocumentTypeC1EPNS_8DocumentERKNS_6StringES5_S5_
+__ZN7WebCore12DocumentTypeC2EPNS_8DocumentERKNS_6StringES5_S5_
+__ZNK7WebCore4Node13isCommentNodeEv
 __ZNK7WebCore12DocumentType8nodeTypeEv
 __ZN7WebCore12DocumentType20insertedIntoDocumentEv
 __ZN7WebCore8Document10setDocTypeEN3WTF10PassRefPtrINS_12DocumentTypeEEE
@@ -2983,18 +1787,169 @@
 __ZN7WebCore15TextCodecLatin16encodeEPKtmNS_19UnencodableHandlingE
 __ZNK7WebCore7CString6lengthEv
 __ZN7WebCore8Document19updateStyleSelectorEv
-__ZN7WebCoreL15metaConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLMetaElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15HTMLMetaElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLMetaElement7processEv
-__ZNK7WebCore15HTMLMetaElement17endTagRequirementEv
-__ZNK7WebCore15HTMLMetaElement11tagPriorityEv
-__ZN7WebCore15HTMLMetaElement20insertedIntoDocumentEv
-__ZN7WebCore8Document16processHttpEquivERKNS_6StringES3_
+__ZN7WebCore8Document19recalcStyleSelectorEv
+__ZNK7WebCore11RenderStyle17inheritedNotEqualEPS0_
+__ZNK7WebCore11RenderStyle4diffEPKS0_Rj
+__ZNK7WebCore19TransformOperationseqERKS0_
+__ZN7WebCore4Node11recalcStyleENS0_11StyleChangeE
+__ZN7WebCore10HTMLParser10parseTokenEPNS_5TokenE
+__ZNK7WebCore4Node16virtualLocalNameEv
+__ZN7WebCore4Text21createWithLengthLimitEPNS_8DocumentERKNS_6StringERjj
+__ZN7WebCore4TextC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore4TextC2EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore13CharacterDataC2EPNS_8DocumentERKNS_6StringEb
+__ZNK7WebCore4Node13isHTMLElementEv
+__ZNK7WebCore4Text8nodeTypeEv
+__ZN7WebCore10HTMLParser11handleErrorEPNS_4NodeEbRKNS_12AtomicStringEi
+__ZNK7WebCore13CharacterData22containsOnlyWhitespaceEv
+__ZN7WebCore10StringImpl22containsOnlyWhitespaceEv
+__ZN7WebCore10TreeSharedINS_4NodeEE14removedLastRefEv
+__ZThn8_N7WebCore4TextD0Ev
+__ZN7WebCore4TextD0Ev
+__ZN7WebCore13CharacterDataD2Ev
+__ZN7WebCore13HTMLTokenizer12parseCommentERNS_15SegmentedStringENS0_5StateE
+__ZNK7WebCore15SegmentedString6lengthEv
+__ZN7WebCore13HTMLTokenizer19enlargeScriptBufferEi
+__ZN7WebCore13HTMLTokenizer14processListingENS_15SegmentedStringENS0_5StateE
+__ZN7WebCore15SegmentedString15advanceSlowCaseEv
+__ZN7WebCore15SegmentedString16advanceSubstringEv
+__ZN7WebCore10HTMLParser7getNodeEPNS_5TokenE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEMNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEENS_7PtrHashIS3_EENS_10Ha
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_MNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEEENS_18PairF
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEMNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEENS_7PtrHashIS3_EENS_10H
+__ZN7WebCore10HTMLParser23commentCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore7CommentC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore7CommentC2EPNS_8DocumentERKNS_6StringE
+__ZNK7WebCore7Comment13isCommentNodeEv
+__ZN7WebCore4Node21finishParsingChildrenEv
+__ZN7WebCore10HTMLParser15processCloseTagEPNS_5TokenE
+__ZN7WebCore12AtomicString3addEPKt
+__ZN7WebCore10StringImplC1EPKtjj
+__ZN7WebCore10StringImplC2EPKtjj
+__ZN7WebCore5Token12addAttributeERNS_12AtomicStringERKS1_b
+__ZNK7WebCore12NamedNodeMap16getAttributeItemERKNS_13QualifiedNameE
+__ZN7WebCore12NamedNodeMap12addAttributeEN3WTF10PassRefPtrINS_9AttributeEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14shrinkCapacityEm
+__ZN7WebCore18HTMLElementFactory17createHTMLElementERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCoreL6addTagERKNS_13QualifiedNameEPFN3WTF10PassRefPtrINS_11HTMLElementEEES2_PNS_8DocumentEPNS_15HTMLFormElementEbE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEPNS1_1
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8Do
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEPNS1_
+__ZN7WebCoreL15htmlConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore7Element15setAttributeMapEN3WTF10PassRefPtrINS_12NamedNodeMapEEE
+__ZN7WebCore13StyledElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore15MappedAttribute17isMappedAttributeEv
+__ZNK7WebCore11HTMLElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZNK7WebCore13StyledElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore11HTMLElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore4Node13ownerDocumentEv
+__ZN7WebCore16CSSStyleSelector23hasSelectorForAttributeERKNS_12AtomicStringE
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN7WebCore7Element16attributeChangedEPNS_9AttributeEb
+__ZNK7WebCore8Document13axObjectCacheEv
+__ZN7WebCore13StyledElement22getMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeE
+__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEiRKNS_6StringE
+__ZN7WebCore13StyledElement16createMappedDeclEPNS_15MappedAttributeE
+__ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleE
+__ZN7WebCore8Document12elementSheetEv
+__ZN7WebCore13CSSStyleSheetC1EPNS_4NodeERKNS_6StringES5_
+__ZN7WebCore13CSSStyleSheetC2EPNS_4NodeERKNS_6StringES5_
+__ZN7WebCore10StyleSheetC2EPNS_4NodeERKNS_6StringE
+__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbb
+__ZN7WebCore9CSSParser10parseValueEPNS_26CSSMutableStyleDeclarationEiRKNS_6StringEb
+__ZN7WebCore9StyleBase10stylesheetEv
+__ZNK7WebCore9StyleBase12isStyleSheetEv
+__ZNK7WebCore10StyleSheet12isStyleSheetEv
+__ZN7WebCore26CSSMutableStyleDeclaration19addParsedPropertiesEPKPKNS_11CSSPropertyEi
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE15reserveCapacityEm
+__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyPriorityEi
+__ZNK7WebCore26CSSMutableStyleDeclaration18findPropertyWithIdEi
+__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEibb
+__ZN7WebCore26CSSMutableStyleDeclaration23removeShorthandPropertyEib
+__ZN7WebCore19longhandForPropertyEi
+__ZN7WebCoreL16initShorthandMapERN3WTF7HashMapIiNS_19CSSPropertyLonghandENS0_7IntHashIjEENS0_10HashTraitsIiEENS5_IS2_EEEE
+__ZN3WTF7HashMapIiN7WebCore19CSSPropertyLonghandENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
+__ZN3WTF9HashTableIiSt4pairIiN7WebCore19CSSPropertyLonghandEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS
+__ZNK3WTF7HashMapIiN7WebCore19CSSPropertyLonghandENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
+__ZN7WebCore26CSSMutableStyleDeclaration18findPropertyWithIdEi
+__ZN7WebCore26CSSMutableStyleDeclaration19setNeedsStyleRecalcEv
+__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEii
+__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiibb
+__ZN7WebCore26CSSMutableStyleDeclaration19setPropertyInternalERKNS_11CSSPropertyEPS1_
+__ZN7WebCore13StyledElement22setMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeEPNS_29CSSMappedAttributeDeclaratio
+__ZN3WTF7HashMapIN7WebCore18MappedAttributeKeyEPNS1_29CSSMappedAttributeDeclarationENS1_19MappedAttributeHashENS1_24MappedAttri
+__ZN3WTF9HashTableIN7WebCore18MappedAttributeKeyESt4pairIS2_PNS1_29CSSMappedAttributeDeclarationEENS_18PairFirstExtractorIS6_EE
+__ZN7WebCore19MappedAttributeHash4hashERKNS_18MappedAttributeKeyE
+__ZNK7WebCore15HTMLHtmlElement17endTagRequirementEv
+__ZNK7WebCore14DocumentLoader28mainResourceApplicationCacheEv
+__ZN7WebCore11HTMLElement12childAllowedEPNS_4NodeE
+__ZN7WebCore4Node12childAllowedEPS0_
+__ZN7WebCore7Element16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore15HTMLHtmlElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore10HTMLParser20headCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore15HTMLHeadElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLHeadElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore15HTMLHeadElement17endTagRequirementEv
+__ZN7WebCore10HTMLParser8popBlockERKNS_12AtomicStringEb
+__ZNK7WebCore15HTMLHeadElement11tagPriorityEv
+__ZNK7WebCore7Element8nodeTypeEv
+__ZN7WebCore7Element15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore4Node22nonRendererRenderStyleEv
+__ZN7WebCoreL20loadFullDefaultStyleEv
+__ZN7WebCore13CSSStyleSheetD0Ev
+__ZN7WebCore10StyleSheetD2Ev
+__ZN7WebCore12CSSStyleRuleD0Ev
+__ZN7WebCore15CSSSelectorListD1Ev
+__ZN7WebCore15CSSSelectorListD2Ev
+__ZN7WebCore26CSSMutableStyleDeclarationD0Ev
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE6shrinkEm
+__ZN7WebCore12CSSValueListD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE6shrinkEm
+__ZN7WebCore11CSSSelectorD2Ev
+__ZN7WebCore5themeEv
+__ZN7WebCore14RenderThemeMacC1Ev
+__ZN7WebCore14RenderThemeMacC2Ev
+__ZN7WebCore11RenderThemeC2Ev
+__ZN7WebCore13platformThemeEv
+-[WebCoreRenderThemeNotificationObserver initWithTheme:]
+__ZN7WebCore11RenderTheme22extraDefaultStyleSheetEv
+__ZN7WebCore13CSSStyleSheet12addNamespaceEPNS_9CSSParserERKNS_12AtomicStringES5_
+__ZN7WebCore9CSSParser12parseContentEib
+__ZN7WebCore6StringC1EPKtj
+__ZN7WebCore6StringC2EPKtj
+__ZN7WebCore17CSSPrimitiveValue6createERKNS_6StringENS0_9UnitTypesE
+__ZN7WebCore17CSSPrimitiveValueC1ERKNS_6StringENS0_9UnitTypesE
+__ZN7WebCore17CSSPrimitiveValueC2ERKNS_6StringENS0_9UnitTypesE
+__ZN7WebCore9CSSParser15parseFontWeightEb
+__ZN7WebCore11CSSSelector12setAttributeERKNS_13QualifiedNameE
+__ZN7WebCore9CSSParser10parseColorEPNS_14CSSParserValueE
+__ZN7WebCore9CSSParser19parseColorFromValueEPNS_14CSSParserValueERjb
+__ZN7WebCore9CSSParser10parseColorERKNS_6StringERjb
+__ZN7WebCore17CSSPrimitiveValue11createColorEj
+__ZNK3WTF7HashMapIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3getERKj
+__ZN7WebCore17CSSPrimitiveValueC1Ej
+__ZN7WebCore17CSSPrimitiveValueC2Ej
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3addERKjRKS4_
+__ZN7WebCore5Color13parseHexColorERKNS_6StringERj
+__ZN7WebCore9CSSParser17parseFillPropertyEiRiS1_RN3WTF6RefPtrINS_8CSSValueEEES6_
+__ZN7WebCore9CSSParser14parseFillImageERN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCore13CSSImageValueC1Ev
+__ZN7WebCore13CSSImageValueC2Ev
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4PairEEE
+__ZN7WebCore9CSSParser14parseFontStyleEb
+__ZN7WebCore9CSSParser15parseFontFamilyEv
+__ZN7WebCoreL9printEvalEv
+__ZN7WebCore11RenderTheme21extraQuirksStyleSheetEv
+__ZN7WebCore9CSSParser16parseFontVariantEb
+__ZN7WebCore11CSSSelector17setSimpleSelectorEPS0_
+__ZN7WebCore15HTMLHeadElement12childAllowedEPNS_4NodeE
+__ZN7WebCore4Text6attachEv
 __ZN7WebCoreL16titleConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
 __ZN7WebCore16HTMLTitleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLTitleElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore11HTMLElement17endTagRequirementEv
 __ZNK7WebCore11HTMLElement11tagPriorityEv
+__ZN7WebCore15HTMLHeadElement8checkDTDEPKNS_4NodeE
 __ZN7WebCore16HTMLTitleElement20insertedIntoDocumentEv
 __ZN7WebCore8Document8setTitleERKNS_6StringEPNS_7ElementE
 __ZN7WebCore13HTMLTokenizer12parseSpecialERNS_15SegmentedStringENS0_5StateE
@@ -3004,24 +1959,230 @@
 __ZN7WebCore8Document11updateTitleEv
 __ZN7WebCore11FrameLoader8setTitleERKNS_6StringE
 __ZN7WebCore14DocumentLoader8setTitleERKNS_6StringE
+__ZNK7WebCore8Document31displayBufferModifiedByEncodingEPtj
 __ZN7WebCore11FrameLoader15willChangeTitleEPNS_14DocumentLoaderE
 __ZN7WebCore11FrameLoader14didChangeTitleEPNS_14DocumentLoaderE
 __ZN7WebCore11HistoryItem8setTitleERKNS_6StringE
 __ZN7WebCore10HTMLParser25isAffectedByResidualStyleERKNS_12AtomicStringE
 __ZN3WTF7HashSetIPN7WebCore16AtomicStringImplENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
 __ZN7WebCore10HTMLParser23reopenResidualStyleTagsEPNS_13HTMLStackElemEPNS_4NodeE
+__ZN7WebCoreL15metaConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLMetaElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLMetaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLMetaElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLMetaElement7processEv
+__ZNK7WebCore15HTMLMetaElement17endTagRequirementEv
+__ZNK7WebCore15HTMLMetaElement11tagPriorityEv
+__ZN7WebCore15HTMLMetaElement20insertedIntoDocumentEv
+__ZN7WebCore8Document16processHttpEquivERKNS_6StringES3_
+__ZN7WebCoreL15linkConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLLinkElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15HTMLLinkElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15HTMLLinkElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLLinkElement20tokenizeRelAttributeERKNS_12AtomicStringERbS4_S4_S4_
+__ZN7WebCore15HTMLLinkElement7processEv
+__ZN7WebCore8parseURLERKNS_6StringE
+__ZNK7WebCore8Document11completeURLERKNS_6StringE
+__ZN7WebCore4KURLC1ERKS0_RKNS_6StringERKNS_12TextEncodingE
+__ZN7WebCore4KURLC2ERKS0_RKNS_6StringERKNS_12TextEncodingE
+__ZNK7WebCore12TextEncoding25encodingForFormSubmissionEv
+__ZNK7WebCore12TextEncoding22isNonByteBasedEncodingEv
+__ZN7WebCore25UTF16LittleEndianEncodingEv
+__ZN7WebCore22UTF16BigEndianEncodingEv
+__ZNK7WebCore12TextEncoding14isUTF7EncodingEv
+__ZNK7WebCore15HTMLLinkElement17endTagRequirementEv
+__ZNK7WebCore15HTMLLinkElement11tagPriorityEv
+__ZN7WebCore15HTMLLinkElement20insertedIntoDocumentEv
+__ZN7WebCore8Document26addStyleSheetCandidateNodeEPNS_4NodeEb
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore4NodeEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore8Document10setIconURLERKNS_6StringES3_
+__ZN7WebCore15HTMLLinkElement21finishParsingChildrenEv
+__ZN7WebCore10StringImpl7replaceEtt
+__ZNK7WebCore6String5splitEtRN3WTF6VectorIS0_Lm0EEE
+__ZNK7WebCore6String5splitERKS0_bRN3WTF6VectorIS0_Lm0EEE
+__ZN7WebCore4Node23compareDocumentPositionEPS0_
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE6shrinkEm
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE12insertBeforeERKS3_S8_
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE12insertBeforeENS_19ListHashSetIteratorIS3_S5_EERKS3_
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE16insertNodeBeforeEPNS_15ListHashSetNodeIS3_EES9_
+__ZN7WebCoreL16styleConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLStyleElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16HTMLStyleElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore12StyleElementC2Ev
+__ZN7WebCore16HTMLStyleElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLStyleElement17endTagRequirementEv
+__ZNK7WebCore16HTMLStyleElement11tagPriorityEv
+__ZN7WebCore16HTMLStyleElement20insertedIntoDocumentEv
+__ZN7WebCore16HTMLStyleElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore16HTMLStyleElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore16HTMLStyleElement21finishParsingChildrenEv
+__ZN7WebCore12StyleElement7processEPNS_7ElementE
+__ZN7WebCore12StyleElement11createSheetEPNS_7ElementERKNS_6StringE
+__ZThn112_NK7WebCore16HTMLStyleElement4typeEv
+__ZNK7WebCore16HTMLStyleElement4typeEv
+__ZThn112_NK7WebCore16HTMLStyleElement5mediaEv
+__ZNK7WebCore16HTMLStyleElement5mediaEv
+__ZN7WebCore9MediaListC1EPNS_13CSSStyleSheetERKNS_6StringEb
+__ZN7WebCore9MediaListC2EPNS_13CSSStyleSheetERKNS_6StringEb
+__ZN7WebCore9MediaList12setMediaTextERKNS_6StringERi
+__ZN7WebCore9MediaListC1EPNS_13CSSStyleSheetEb
+__ZN7WebCore9MediaListC2EPNS_13CSSStyleSheetEb
 __ZNK7WebCore6String15stripWhiteSpaceEv
 __ZN7WebCore10StringImpl15stripWhiteSpaceEv
-__ZNK7WebCore6String8toDoubleEPb
-__ZN7WebCore10StringImpl8toDoubleEPb
-__ZN7WebCore10StringImpl4findEPKcib
-__ZN7WebCoreL11appendASCIIERKNS_6StringEPKcmRN3WTF6VectorIcLm512EEE
-__ZN7WebCore11FrameLoader23scheduleHTTPRedirectionEdRKNS_6StringE
-__ZN7WebCore11FrameLoader19scheduleRedirectionEPNS_20ScheduledRedirectionE
-__ZN7WebCore11FrameLoader16isLocationChangeERKNS_20ScheduledRedirectionE
+__ZN7WebCore9CSSParser15parseMediaQueryEPNS_9MediaListERKNS_6StringE
+__ZN7WebCore9CSSParser31createFloatingMediaQueryExpListEv
+__ZN7WebCore9CSSParser29sinkFloatingMediaQueryExpListEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCore9CSSParser24createFloatingMediaQueryENS_10MediaQuery10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0
+__ZN7WebCore10MediaQueryC1ENS0_10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCore10MediaQueryC2ENS0_10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCore9CSSParser22sinkFloatingMediaQueryEPNS_10MediaQueryE
+__ZN7WebCore9MediaList16appendMediaQueryEPNS_10MediaQueryE
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE15reserveCapacityEm
+__ZN3WTF15deleteAllValuesIPN7WebCore10MediaQueryELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EEaSERKS4_
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE6shrinkEm
+__ZN7WebCore9MediaList13notifyChangedEv
+__ZN7WebCore9MediaListD0Ev
+__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_9MediaListEPNS_16CSSStyleSelectorE
+__ZNK7WebCore19MediaQueryEvaluator14mediaTypeMatchERKNS_6StringE
+__ZN7WebCoreL15applyRestrictorENS_10MediaQuery10RestrictorEb
+__ZThn112_N7WebCore16HTMLStyleElement10setLoadingEb
+__ZN7WebCore16HTMLStyleElement10setLoadingEb
+__ZNK7WebCore8Document8encodingEv
+__ZNK7WebCore12TextEncoding7domNameEv
+__ZN7WebCore9CSSParser15createMediaListEv
+__ZN7WebCore9CSSParser16createImportRuleERKNS_15CSSParserStringEPNS_9MediaListE
+__ZN7WebCore13CSSImportRuleC1EPNS_13CSSStyleSheetERKNS_6StringEN3WTF10PassRefPtrINS_9MediaListEEE
+__ZN7WebCore13CSSImportRuleC2EPNS_13CSSStyleSheetERKNS_6StringEN3WTF10PassRefPtrINS_9MediaListEEE
+__ZN7WebCore13CSSImportRule18insertedIntoParentEv
+__ZNK7WebCore7CSSRule16parentStyleSheetEv
+__ZN7WebCore9DocLoader20requestCSSStyleSheetERKNS_6StringES3_
+__ZN7WebCore9DocLoader15requestResourceENS_14CachedResource4TypeERKNS_6StringES5_b
+__ZN7WebCore9DocLoader10canRequestENS_14CachedResource4TypeERKNS_4KURLE
+__ZN7WebCore9DocLoader14checkForReloadERKNS_4KURLE
+__ZN7WebCore5Cache14resourceForURLERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_14CachedResourceENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
+__ZN7WebCore5Cache15requestResourceEPNS_9DocLoaderENS_14CachedResource4TypeERKNS_4KURLERKNS_6StringEb
+__ZN7WebCore11FrameLoader21restrictAccessToLocalEv
+__ZN7WebCore11FrameLoader7canLoadERKNS_4KURLERKNS_6StringEPKNS_8DocumentE
+__ZN7WebCore11FrameLoader21shouldTreatURLAsLocalERKNS_6StringE
+__ZN7WebCoreL14createResourceENS_14CachedResource4TypeERKNS_4KURLERKNS_6StringE
+__ZN7WebCore19CachedCSSStyleSheetC1ERKNS_6StringES3_
+__ZN7WebCore19CachedCSSStyleSheetC2ERKNS_6StringES3_
+__ZN7WebCore14CachedResourceC2ERKNS_6StringENS0_4TypeE
+__ZN7WebCore14CachedResource4loadEPNS_9DocLoaderE
+__ZN7WebCore14CachedResource4loadEPNS_9DocLoaderEbbb
+__ZN7WebCore6Loader4loadEPNS_9DocLoaderEPNS_14CachedResourceEbbb
+__ZN7WebCore7RequestC1EPNS_9DocLoaderEPNS_14CachedResourceEbbb
+__ZN7WebCore7RequestC2EPNS_9DocLoaderEPNS_14CachedResourceEbbb
+__ZN7WebCore14CachedResource10setRequestEPNS_7RequestE
+__ZN7WebCore4KURLC1ERKNS_6StringE
+__ZN7WebCore4KURLC2ERKNS_6StringE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_6Loader4HostENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getERKS3_
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_6Loader4HostENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3addERKS3_RKS6
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_6Loader4HostEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_
+__ZNK7WebCore6Loader17determinePriorityEPKNS_14CachedResourceE
+__ZN7WebCore6Loader4Host10addRequestEPNS_7RequestENS0_8PriorityE
+__ZN3WTF5DequeIPN7WebCore7RequestEE14expandCapacityEv
+__ZN7WebCore9DocLoader21incrementRequestCountEv
+__ZN7WebCore6Loader4Host20servePendingRequestsENS0_8PriorityE
+__ZN7WebCore6Loader4Host20servePendingRequestsERN3WTF5DequeIPNS_7RequestEEERb
+__ZN7WebCore17SubresourceLoader6createEPNS_5FrameEPNS_23SubresourceLoaderClientERKNS_15ResourceRequestEbbb
+__ZNK7WebCore11FrameLoader16outgoingReferrerEv
+__ZN7WebCore11FrameLoader18shouldHideReferrerERKNS_4KURLERKNS_6StringE
+__ZN7WebCore10protocolIsERKNS_6StringEPKc
+__ZNK7WebCore11FrameLoader14outgoingOriginEv
+__ZNK7WebCore14SecurityOrigin8toStringEv
+__ZNK7WebCore19ResourceRequestBase13isConditionalEv
+__ZNK3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS1_6StringEENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_14Pai
+__ZNK7WebCore11FrameLoader15originalRequestEv
+__ZN7WebCore19ResourceRequestBase14setCachePolicyENS_26ResourceRequestCachePolicyE
+__ZN7WebCore11FrameLoader34addExtraFieldsToSubresourceRequestERNS_15ResourceRequestE
+__ZNK7WebCore11FrameLoader8encodingEv
+__ZN7WebCore17SubresourceLoaderC1EPNS_5FrameEPNS_23SubresourceLoaderClientEbb
+__ZN7WebCore17SubresourceLoaderC2EPNS_5FrameEPNS_23SubresourceLoaderClientEbb
+__ZN7WebCore14DocumentLoader20addSubresourceLoaderEPNS_14ResourceLoaderE
+__ZN3WTF7HashSetINS_6RefPtrIN7WebCore14ResourceLoaderEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN7WebCore14ResourceLoader4loadERKNS_15ResourceRequestE
+__ZN7WebCore17SubresourceLoader15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore11FrameLoader32assignIdentifierToInitialRequestEmRKNS_15ResourceRequestE
+__ZN7WebCore14DocumentLoader19scheduleArchiveLoadEPNS_14ResourceLoaderERKNS_15ResourceRequestERKNS_4KURLE
+__ZNK7WebCore14DocumentLoader21archiveResourceForURLERKNS_4KURLE
+__ZN7WebCore14DocumentLoader28scheduleApplicationCacheLoadEPNS_14ResourceLoaderERKNS_15ResourceRequestERKNS_4KURLE
+__ZN7WebCore14DocumentLoader38shouldLoadResourceFromApplicationCacheERKNS_15ResourceRequestERPNS_24ApplicationCacheResourceE
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore17SubresourceLoaderEEEPNS2_7RequestENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addE
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore17SubresourceLoaderEEESt4pairIS4_PNS2_7RequestEENS_18PairFirstExtractorIS8_EENS_7PtrHash
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_14CachedResourceENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_14CachedResourceEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHa
+__ZN7WebCore5Cache16resourceAccessedEPNS_14CachedResourceE
+__ZN7WebCore5Cache17removeFromLRUListEPNS_14CachedResourceE
+__ZNK7WebCore14CachedResource12overheadSizeEv
+__ZN7WebCore5Cache10adjustSizeEbi
+__ZN7WebCore5Cache15insertInLRUListEPNS_14CachedResourceE
+__ZN7WebCore5Cache10lruListForEPNS_14CachedResourceE
+__ZN3WTF6VectorIN7WebCore5Cache7LRUListELm32EE4growEm
+__ZN3WTF7HashMapIN7WebCore6StringENS1_20CachedResourceHandleINS1_14CachedResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_I
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_20CachedResourceHandleINS1_14CachedResourceEEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore24CachedResourceHandleBase11setResourceEPNS_14CachedResourceE
+__ZN7WebCore9DocLoader22checkCacheObjectStatusEPNS_14CachedResourceE
+__ZNK7WebCore9DocLoader5frameEv
+__ZN7WebCore19CachedCSSStyleSheet9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore14CachedResource9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore5Cache22addToLiveResourcesSizeEPNS_14CachedResourceE
+__ZN3WTF7HashMapIPN7WebCore20CachedResourceClientEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN7WebCore10StyleSheet8setMediaEN3WTF10PassRefPtrINS_9MediaListEEE
+__ZNK7WebCore11HTMLElement5titleEv
+__ZN7WebCore13CSSStyleSheet11checkLoadedEv
+__ZN7WebCore13CSSStyleSheet9isLoadingEv
+__ZN7WebCore13CSSImportRule12isImportRuleEv
+__ZNK7WebCore13CSSImportRule9isLoadingEv
+__ZN7WebCore12StyleElement5sheetEPNS_7ElementE
+__ZN7WebCore9CSSParser18parseFillShorthandEiPKiib
+__ZN7WebCore9CSSParser12addFillValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
+__ZN7WebCore9CSSParser17parseFillPositionERN3WTF6RefPtrINS_8CSSValueEEES5_
+__ZN7WebCore9CSSParser19parseFillPositionXYERbS1_
+__ZN7WebCore9CSSParser20parseBackgroundColorEv
+__ZN7WebCore9StyleBase12isImportRuleEv
+__ZN7WebCore16HTMLStyleElement11sheetLoadedEv
+__ZNK7WebCore16HTMLStyleElement9isLoadingEv
+__ZN7WebCore8Document18removePendingSheetEv
+__ZNK7WebCore15HTMLLinkElement9isLoadingEv
+__ZNK7WebCore15HTMLLinkElement5sheetEv
+__ZN7WebCore16HTMLStyleElement5sheetEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE15reserveCapacityEm
+__ZN7WebCore19MediaQueryEvaluatorC1ERKNS_6StringEPNS_5FrameEPNS_11RenderStyleE
+__ZN7WebCore19MediaQueryEvaluatorC2ERKNS_6StringEPNS_5FrameEPNS_11RenderStyleE
+__ZN7WebCore14StyleSheetList4itemEj
+__ZN7WebCore9StyleBase11isStyleRuleEv
+__ZN7WebCore7Element11recalcStyleENS_4Node11StyleChangeE
+__ZNK7WebCore12StyleBoxDataeqERKS0_
+__ZN7WebCore4Node14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN7WebCore12RenderObject7repaintEb
+__ZN7WebCore12RenderObject8isRootedEPPNS_10RenderViewE
+__ZNK7WebCore12RenderObject19containerForRepaintEv
+__ZN7WebCore9RenderBox29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore11RenderBlock12overflowRectEb
+__ZNK7WebCore11RenderBlock12overflowLeftEb
+__ZNK7WebCore11RenderBlock11overflowTopEb
+__ZNK7WebCore11RenderBlock14overflowHeightEb
+__ZNK7WebCore11RenderBlock13overflowWidthEb
+__ZN7WebCore10RenderView21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZN7WebCore12RenderObject21repaintUsingContainerEPNS_20RenderBoxModelObjectERKNS_7IntRectEb
+__ZNK7WebCore7Comment8nodeTypeEv
 __ZN7WebCoreL17scriptConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
 __ZN7WebCore17HTMLScriptElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17HTMLScriptElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore17ScriptElementDataC1EPNS_13ScriptElementEPNS_7ElementE
+__ZN7WebCore17ScriptElementDataC2EPNS_13ScriptElementEPNS_7ElementE
 __ZN7WebCore17HTMLScriptElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZNK7WebCore17HTMLScriptElement17endTagRequirementEv
 __ZNK7WebCore17HTMLScriptElement11tagPriorityEv
@@ -3030,14 +2191,15 @@
 __ZN7WebCore13ScriptElement20insertedIntoDocumentERNS_17ScriptElementDataERKNS_6StringE
 __ZNK7WebCore17HTMLScriptElement13scriptCharsetEv
 __ZNK7WebCore17ScriptElementData13scriptCharsetEv
-__ZThn56_NK7WebCore17HTMLScriptElement21charsetAttributeValueEv
+__ZThn112_NK7WebCore17HTMLScriptElement21charsetAttributeValueEv
 __ZNK7WebCore17HTMLScriptElement21charsetAttributeValueEv
 __ZN7WebCore13HTMLTokenizer13scriptHandlerENS0_5StateE
 __ZNK7WebCore17HTMLScriptElement25shouldExecuteAsJavaScriptEv
 __ZNK7WebCore17ScriptElementData25shouldExecuteAsJavaScriptEv
-__ZThn56_NK7WebCore17HTMLScriptElement18typeAttributeValueEv
+__ZThn112_NK7WebCore17HTMLScriptElement18typeAttributeValueEv
 __ZNK7WebCore17HTMLScriptElement18typeAttributeValueEv
 __ZN7WebCore16MIMETypeRegistry29isSupportedJavaScriptMIMETypeERKNS_6StringE
+__ZN7WebCore13HTMLTokenizer13enlargeBufferEi
 __ZN7WebCore10HTMLParser20textCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
 __ZN7WebCore17HTMLScriptElement8checkDTDEPKNS_4NodeE
 __ZN7WebCore17HTMLScriptElement15childrenChangedEbPNS_4NodeES2_i
@@ -3052,1377 +2214,783 @@
 __ZNK7WebCore17ScriptElementData13scriptContentEv
 __ZN7WebCore15SegmentedString7prependERKS0_
 __ZN7WebCore15SegmentedString7prependERKNS_18SegmentedSubstringE
+__ZNK7WebCore6StringcvN3JSC7UStringEEv
+__ZNK7WebCore20StringSourceProvider6lengthEv
 __ZN7WebCore13HTMLTokenizer15scriptExecutionERKNS_16ScriptSourceCodeENS0_5StateE
+__ZN7WebCore11FrameLoader13executeScriptERKNS_16ScriptSourceCodeE
+__ZN7WebCore16ScriptController8evaluateERKNS_16ScriptSourceCodeE
+__ZN7WebCore16ScriptController10initScriptEv
+__ZN7WebCore16JSDOMWindowShellnwEm
+__ZN7WebCore15JSDOMWindowBase18commonJSGlobalDataEv
+__ZN7WebCore16JSDOMWindowShellC1EN3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore16JSDOMWindowShellC2EN3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore16JSDOMWindowShell9setWindowEN3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore20JSDOMWindowPrototypenwEm
+__ZN7WebCore11JSDOMWindowC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore11JSDOMWindowC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore15JSDOMWindowBaseC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore15JSDOMWindowBase19JSDOMWindowBaseDataC1EN3WTF10PassRefPtrINS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore15JSDOMWindowBase19JSDOMWindowBaseDataC2EN3WTF10PassRefPtrINS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore17JSDOMGlobalObject21JSDOMGlobalObjectDataC2Ev
+__ZN7WebCore17JSDOMGlobalObjectC2EN3WTF10PassRefPtrIN3JSC9StructureEEEPNS0_21JSDOMGlobalObjectDataEPNS3_8JSObjectE
+__ZN7WebCore15JSDOMWindowBase10globalExecEv
+__ZN7WebCore5Frame9keepAliveEv
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS2_16SymbolTableEntryENS2_17IdentifierRepHashENS_10HashTraitsIS5_EENS2_26Symbo
+__ZN7WebCore15JSDOMWindowBase14updateDocumentEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore23getCachedDOMNodeWrapperEPNS_8DocumentEPNS_4NodeE
+__ZNK3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZNK7WebCore8Document8nodeTypeEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8DocumentE
+__ZN7WebCore25getCachedDOMObjectWrapperERN3JSC12JSGlobalDataEPv
+__ZNK3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3getERKS1_
+__ZN7WebCore21getCachedDOMStructureEPNS_17JSDOMGlobalObjectEPKN3JSC9ClassInfoE
+__ZNK3WTF7HashMapIPKN3JSC9ClassInfoENS_6RefPtrINS1_9StructureEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENSA_IS7_EEE3getERKS4_
+__ZN7WebCore14JSHTMLDocument15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSDocumentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSDocument15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSNodePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSNode15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEN3WTF10PassRefPtrIN3JSC9StructureEEEPKNS4_9ClassInfoE
+__ZN3WTF7HashMapIPKN3JSC9ClassInfoENS_6RefPtrINS1_9StructureEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENSA_IS7_EEE3setERKS4_RKS7_
+__ZN3WTF9HashTableIPKN3JSC9ClassInfoESt4pairIS4_NS_6RefPtrINS1_9StructureEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS4_EENS_1
+__ZN7WebCore14JSHTMLDocumentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12HTMLDocumentEEE
+__ZN7WebCore14JSHTMLDocumentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12HTMLDocumentEEE
+__ZN7WebCore10JSDocumentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DocumentEEE
+__ZN7WebCore6JSNodeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4NodeEEE
+__ZN7WebCore21cacheDOMObjectWrapperERN3JSC12JSGlobalDataEPvPNS_9DOMObjectE
+__ZN3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3setERKS1_RKS4_
+__ZN3WTF9HashTableIPvSt4pairIS1_PN7WebCore9DOMObjectEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS1_EENS_14PairHashTraitsINS_10Ha
+__ZN7WebCore16ScriptController14attachDebuggerEPN3JSC8DebuggerE
 __ZN7WebCore16ScriptController18windowScriptObjectEv
 __ZN7WebCore16ScriptController17bindingRootObjectEv
 __ZN3JSC8Bindings10RootObject6createEPKvPNS_14JSGlobalObjectE
 __ZN3JSC8Bindings10RootObjectC1EPKvPNS_14JSGlobalObjectE
+__ZN3JSC8Bindings10RootObjectC2EPKvPNS_14JSGlobalObjectE
 __ZN3JSC8BindingsL13rootObjectSetEv
 __ZN3WTF7HashSetIPN3JSC8Bindings10RootObjectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandEv
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expand
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehash
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13alloc
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deall
 +[WebScriptObject initialize]
 +[WebScriptObject scriptObjectForJSObject:originRootObject:rootObject:]
-__ZN7WebCore16createDOMWrapperEPN3JSC8JSObjectEN3WTF10PassRefPtrINS0_8Bindings10RootObjectEEES7_
+__Z16createDOMWrapperPN3JSC8JSObjectEN3WTF10PassRefPtrINS_8Bindings10RootObjectEEES6_
 __ZNK7WebCore16JSDOMWindowShell9classInfoEv
 __ZNK7WebCore16JSDOMWindowShell4implEv
-+[DOMAbstractView(WebCoreInternal) _wrapAbstractView:]
-__ZN7WebCore13getDOMWrapperEP17DOMObjectInternal
--[DOMAbstractView(WebCoreInternal) _initWithFrame:]
--[DOMObject(WebCoreInternal) _init]
+__Z3kitPN7WebCore9DOMWindowE
+__Z13getDOMWrapperP17DOMObjectInternal
 -[WebScriptObject(WebScriptObjectInternal) _init]
-__ZN7WebCore13addDOMWrapperEP8NSObjectP17DOMObjectInternal
-__ZN7WebCore18createWrapperCacheEv
+__Z13addDOMWrapperP8NSObjectP17DOMObjectInternal
+__Z18createWrapperCachev
 -[WebScriptObject _hasImp]
 -[WebScriptObject _setImp:originRootObject:rootObject:]
 __ZN7WebCore12addJSWrapperEP8NSObjectPN3JSC8JSObjectE
 __ZN3JSC8Bindings10RootObject9gcProtectEPNS_8JSObjectE
-__ZNK3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E8containsIS3_NS_22IdentityHashTranslatorIS3_S5_S9_EEEEbRKT_
-__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E6expandEv
-__ZN7WebCore15SegmentedString6appendERKS0_
-__ZN7WebCore15SegmentedString6appendERKNS_18SegmentedSubstringE
-__ZNK7WebCore15HTMLBodyElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore15HTMLBodyElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore8Document47setWindowInlineEventListenerForTypeAndAttributeERKNS_12AtomicStringEPNS_9AttributeE
-__ZN7WebCore8Document19createEventListenerERKNS_6StringES3_PNS_4NodeE
-__ZNK7WebCore8Document13isSVGDocumentEv
-__ZN7WebCore16ScriptController25createInlineEventListenerERKNS_6StringES3_PNS_4NodeE
-__ZN7WebCore19JSLazyEventListenerC1ENS0_21LazyEventListenerTypeERKNS_6StringES4_PNS_17JSDOMGlobalObjectEPNS_4NodeEi
+__ZNK3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTra
+__ZN3WTF7HashMapIPN3JSC8JSObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTrai
+__ZN7WebCore19InspectorController34inspectedWindowScriptObjectClearedEPNS_5FrameE
+__ZN7WebCore6StringC1ERKN3JSC7UStringE
+__ZN7WebCore6StringC2ERKN3JSC7UStringE
+__ZNK7WebCore20StringSourceProvider4dataEv
+__ZNK7WebCore15JSDOMWindowBase17supportsProfilingEv
+__ZN7WebCore16JSDOMWindowShell18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11JSDOMWindow18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSDOMWindowBase18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12AtomicString3addERKN3JSC10IdentifierE
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addINS1_17HashAndCharactersENS1_27HashAndCharac
+__ZNK7WebCore9FrameTree5childERKNS_12AtomicStringE
+__ZN7WebCore20JSDOMWindowPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSDOMWindowBase12toThisObjectEPN3JSC9ExecStateE
+__ZNK7WebCore15JSDOMWindowBase5shellEv
+__ZN7WebCore44jsDOMWindowPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13toJSDOMWindowEN3JSC7JSValueE
+__ZN7WebCore11JSDOMWindow16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore17JSDOMGlobalObject27findOrCreateJSEventListenerEN3JSC7JSValueE
+__ZN7WebCore17JSDOMGlobalObject19findJSEventListenerEN3JSC7JSValueE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore15JSEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getERKS3_
 __ZN7WebCore15JSEventListenerC1EPN3JSC8JSObjectEPNS_17JSDOMGlobalObjectEb
-__ZN7WebCore8Document35setWindowInlineEventListenerForTypeERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore8Document38removeWindowInlineEventListenerForTypeERKNS_12AtomicStringE
-__ZN7WebCore8Document22addWindowEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCore8Document25removeWindowEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore15JSEventListenerC2EPN3JSC8JSObjectEPNS_17JSDOMGlobalObjectEb
+__ZN7WebCore17JSDOMGlobalObject16jsEventListenersEv
+__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore15JSEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore15JSEventListenerEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14P
+__ZN7WebCore12AtomicString3addERKN3JSC7UStringE
+__ZN7WebCore9DOMWindow16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore9DOMWindow19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
 __ZN7WebCore8Document23addListenerTypeIfNeededERKNS_12AtomicStringE
 __ZN7WebCore23RegisteredEventListenerC1ERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore23RegisteredEventListenerC2ERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE14expandCapacityEmPKS4_
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE6shrinkEm
-__ZN7WebCore4KURL11setProtocolERKNS_6StringE
-__ZN7WebCore4KURL7setHostERKNS_6StringE
-__ZN7WebCore4KURL7setPathERKNS_6StringE
-__ZN7WebCore28encodeWithURLEscapeSequencesERKNS_6StringE
-__ZNK7WebCore6String4utf8Ev
-__ZN7WebCore12TextCodecICU6encodeEPKtmNS_19UnencodableHandlingE
-__ZN7WebCore14ResourceLoader6cancelEv
-__ZN7WebCore14ResourceLoader6cancelERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceLoader14cancelledErrorEv
-__ZN7WebCore17SubresourceLoader9didCancelERKNS_13ResourceErrorE
-__ZN7WebCore10IconLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZNK7WebCore14ResourceHandle7requestEv
-__ZN7WebCore10IconLoader13finishLoadingERKNS_4KURLEN3WTF10PassRefPtrINS_12SharedBufferEEE
-__ZN7WebCore12IconDatabase21setIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_6StringE
-__ZN7WebCore12IconDatabase21getOrCreateIconRecordERKNS_6StringE
-__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_10IconRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_10IconRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E6expandEv
-__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_29HashTableConstIteratorAdapterINS_9HashTableIS2_S2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EESB_EES2_EEEEvT_SE_
-__ZNK7WebCore10IconRecord8snapshotEb
-__ZN3WTF7HashMapIN7WebCore6StringENS1_12IconSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_12IconSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IS4_EEEESB_E5clearEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_10IconRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E4findIS2_NS_22IdentityHashTranslatorIS2_S6_S9_EEEENS_17HashTableIteratorIS2_S6_S8_S9_SE_SC_EERKT_
-__ZN7WebCore10IconRecordD1Ev
-__ZN7WebCore11ImageSourceD1Ev
-__ZN7WebCore11ImageSource5clearEbmPNS_12SharedBufferEb
-__ZN7WebCore12IconDatabase24scheduleOrDeferSyncTimerEv
-__ZN7WebCore11FrameLoader27commitIconURLToIconDatabaseERKNS_4KURLE
-__ZN7WebCore12IconDatabase20setIconURLForPageURLERKNS_6StringES3_
-__ZN7WebCore13PageURLRecord13setIconRecordEN3WTF10PassRefPtrINS_10IconRecordEEE
-__ZNK7WebCore13PageURLRecord8snapshotEb
-__ZN3WTF7HashMapIN7WebCore6StringENS1_15PageURLSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IS4_EEEESB_E6expandEv
-__ZNK7WebCore11FrameLoader18originalRequestURLEv
-__ZN7WebCore10IconRecord15imageDataStatusEv
-__ZN3WTF7HashSetIPN7WebCore10IconRecordENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore12IconDatabase14wakeSyncThreadEv
-__ZN7WebCore10IconLoader17clearLoadingStateEv
-__ZNK7WebCore8Document16isPluginDocumentEv
-__ZNK7WebCore8Document15isImageDocumentEv
-+[DOMDocument(WebCoreInternal) _wrapDocument:]
-+[DOMNode(WebCoreInternal) _wrapNode:]
-__ZNK7WebCore8Document8nodeTypeEv
--[DOMNode(WebCoreInternal) _initWithNode:]
--[DOMDocument getElementsByTagName:]
-__ZN7WebCore4Node20getElementsByTagNameERKNS_6StringE
-__ZN7WebCore4Node22getElementsByTagNameNSERKNS_12AtomicStringERKNS_6StringE
-__ZN7WebCore4Node14ensureRareDataEv
-__ZN7WebCore4Node14createRareDataEv
-__ZN3WTF9HashTableIPKN7WebCore4NodeESt4pairIS4_PNS1_12NodeRareDataEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCore15DynamicNodeList6CachesC2Ev
-__ZN3WTF7HashMapIN7WebCore13QualifiedNameEPNS1_15DynamicNodeList6CachesENS1_17QualifiedNameHashENS_10HashTraitsIS2_EENS7_IS5_EEE3addERKS2_RKS5_
-__ZN3WTF9HashTableIN7WebCore13QualifiedNameESt4pairIS2_PNS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_17QualifiedNameHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6expandEv
-__ZN7WebCore11TagNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_12AtomicStringES7_PNS_15DynamicNodeList6CachesE
-__ZN7WebCore15DynamicNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEPNS0_6CachesE
-__ZN7WebCore4Node23registerDynamicNodeListEPNS_15DynamicNodeListE
-__ZNK7WebCore4Node8rareDataEv
-__ZN3WTF7HashMapIPKN7WebCore4NodeEPNS1_12NodeRareDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
-+[DOMNodeList(WebCoreInternal) _wrapNodeList:]
--[DOMNodeList(WebCoreInternal) _initWithNodeList:]
--[DOMNodeList length]
-__ZNK7WebCore15DynamicNodeList6lengthEv
-__ZNK7WebCore11TagNodeList11nodeMatchesEPNS_7ElementE
-__ZN7WebCore15ProgressTracker17progressCompletedEPNS_5FrameE
-__ZN7WebCore15ProgressTracker21finalProgressCompleteEv
-__ZN7WebCore14ResourceLoader9didCancelERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceHandle19clearAuthenticationEv
-__ZN7WebCore27AuthenticationChallengeBase7nullifyEv
-__ZN7WebCore14DocumentLoader27cancelPendingSubstituteLoadEPNS_14ResourceLoaderE
-__ZN7WebCore14ResourceHandle6cancelEv
-__ZNK7WebCore8Document17formElementsStateEv
-__ZN7WebCore11HistoryItem16setDocumentStateERKN3WTF6VectorINS_6StringELm0EEE
-__ZN7WebCore15JSEventListenerD0Ev
-__ZNK7WebCore23JSAbstractEventListener8isInlineEv
-__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore15JSEventListenerEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SC_EEEENS_17HashTableIteratorIS3_S8_SA_SC_SH_SF_EERKT_
-__ZNK7WebCore4Node17isEventTargetNodeEv
-__ZN7WebCore11FrameLoader41updateHistoryForRedirectWithLockedHistoryEv
-__ZN7WebCore11HistoryItem6setURLERKNS_4KURLE
-__ZN7WebCore11HistoryItem12setURLStringERKNS_6StringE
-__ZN7WebCore11HistoryItem18clearDocumentStateEv
-__ZN7WebCore13ScriptElement21handleSourceAttributeERNS_17ScriptElementDataERKNS_6StringE
-__ZNK7WebCore17ScriptElementData18ignoresLoadRequestEv
-__ZN7WebCore9DocLoader13requestScriptERKNS_6StringES3_
-__ZN7WebCore12CachedScriptC1ERKNS_6StringES3_
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_6Loader4HostENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3addERKS3_RKS6_
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_6Loader4HostEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E6expandEv
-__ZN3WTF5DequeIN7WebCore20CachedResourceHandleINS1_12CachedScriptEEEE14expandCapacityEv
-__ZN7WebCore12CachedScript9addClientEPNS_20CachedResourceClientE
-__ZN7WebCore14CachedResource9addClientEPNS_20CachedResourceClientE
-__ZN7WebCore5Cache22addToLiveResourcesSizeEPNS_14CachedResourceE
-__ZN3WTF7HashMapIPN7WebCore20CachedResourceClientEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
-__ZN3WTF9HashTableIPN7WebCore20CachedResourceClientESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E6expandEv
-__ZN7WebCore14PreloadScannerC1EPNS_8DocumentE
-__ZN7WebCore14PreloadScanner5beginEv
-__ZN7WebCore14PreloadScanner5resetEv
-__ZN3WTF6VectorItLm32EE14shrinkCapacityEm
-__ZN3WTF6VectorItLm16EE14shrinkCapacityEm
-__ZN7WebCore14PreloadScanner5writeERKNS_15SegmentedStringE
-__ZN7WebCore14PreloadScanner8tokenizeERKNS_15SegmentedStringE
-__ZN7WebCore14PreloadScanner16processAttributeEv
-__ZN3WTF6VectorItLm32EE6shrinkEm
-__ZN3WTF6VectorItLm0EE6shrinkEm
-__ZN7WebCore14PreloadScanner7emitTagEv
-__ZNK7WebCore14PreloadScanner12scanningBodyEv
-__ZN7WebCore9DocLoader7preloadENS_14CachedResource4TypeERKNS_6StringES5_b
-__ZN7WebCore9DocLoader14requestPreloadENS_14CachedResource4TypeERKNS_6StringES5_
-__ZNK3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore14CachedResourceEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E8containsIS4_NS_21ListHashSetTranslatorIS4_SB_EEEEbRKT_
-__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE3addERKS3_
-__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
-__ZN3WTF5DequeIN7WebCore18SegmentedSubstringEE14expandCapacityEv
-__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE15reserveCapacityEm
-__ZN7WebCore14PreloadScanner13consumeEntityERNS_15SegmentedStringERb
-__ZN3WTF6VectorIcLm10EE6shrinkEm
-__ZN3WTF6VectorItLm10EE6shrinkEm
-__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE6shrinkEm
-__ZN7WebCore16JSDOMWindowShell4markEv
-__ZN7WebCore11JSDOMWindow4markEv
-__ZN7WebCore17JSDOMGlobalObject4markEv
-__ZN7WebCore10JSDocument4markEv
-__ZN7WebCore6JSNode4markEv
-__ZN7WebCore23markDOMNodesForDocumentEPNS_8DocumentE
-__ZN7WebCore27markActiveObjectsForContextERN3JSC12JSGlobalDataEPNS_22ScriptExecutionContextE
-__ZN7WebCore20markDOMObjectWrapperERN3JSC12JSGlobalDataEPv
-__ZN3WTF9HashTableIPN7WebCore11JSDOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore5Frame20clearFormerDOMWindowEPNS_9DOMWindowE
-__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZThn8_N7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZNK7WebCore26CachedScriptSourceProvider4dataEv
-__ZN7WebCore20jsDOMWindowNavigatorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow9navigatorEv
-__ZN7WebCore9NavigatorC1EPNS_5FrameE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9NavigatorE
-__ZN7WebCore11JSNavigator15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore11JSNavigatorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9NavigatorEEE
-__ZN7WebCore11JSNavigator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20jsNavigatorUserAgentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9Navigator9userAgentEv
-__ZNK7WebCore11FrameLoader9userAgentERKNS_4KURLE
-__ZN7WebCore14JSHTMLDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore14JSHTMLDocument18canGetItemsForNameEPN3JSC9ExecStateEPNS_12HTMLDocumentERKNS1_10IdentifierE
-__ZN7WebCore17JSEventTargetNode18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSHTMLDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33jsDOMWindowHTMLElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13JSHTMLElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore23getCachedDOMConstructorEPN3JSC9ExecStateEPKNS0_9ClassInfoE
-__ZN3WTF7HashMapIPKN3JSC9ClassInfoEPNS1_8JSObjectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
-__ZN7WebCore22JSHTMLElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore13JSHTMLElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore19cacheDOMConstructorEPN3JSC9ExecStateEPKNS0_9ClassInfoEPNS0_8JSObjectE
-__ZN7WebCore40jsDocumentPrototypeFunctionCreateElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore14JSHTMLDocument9classInfoEv
-__ZN7WebCore26valueToStringWithNullCheckEPN3JSC9ExecStateENS0_10JSValuePtrE
-__ZN7WebCore12AtomicString3addERKN3JSC7UStringE
-__ZN7WebCore12HTMLDocument13createElementERKNS_12AtomicStringERi
-__ZN7WebCore8Document11isValidNameERKNS_6StringE
-__ZN7WebCore10StringImpl7isLowerEv
-__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_7ElementE
-__ZN7WebCore19createJSHTMLWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEEENS_18PairFirstExtractorISF_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSL_ISE_EEEESM_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEEENS_18PairFirstExtractorISF_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSL_ISE_EEEESM_E4findIS3_NS_22IdentityHashTranslatorIS3_SF_SJ_EEEENS_17HashTableIteratorIS3_SF_SH_SJ_SO_SM_EERKT_
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSG_ISD_EEE3setERKS3_RKSD_
-__ZN7WebCoreL27createHTMLDivElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore16JSHTMLDivElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSHTMLDivElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLDivElementEEE
-__ZN7WebCore13JSHTMLElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11HTMLElementEEE
-__ZN7WebCore9JSElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ElementEEE
-__ZN7WebCore19cacheDOMNodeWrapperEPNS_8DocumentEPNS_4NodeEPNS_6JSNodeE
-__ZN7WebCore15setDOMExceptionEPN3JSC9ExecStateEi
-__ZN7WebCore16JSHTMLDivElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore13JSHTMLElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCoreL15formConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLFormElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15FormDataBuilderC1Ev
-__ZN7WebCoreL28createHTMLFormElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLFormElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSHTMLFormElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFormElementEEE
-__ZN7WebCore17JSHTMLFormElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSHTMLFormElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_15HTMLFormElementERKNS1_10IdentifierE
-__ZN7WebCore15HTMLFormElement16getNamedElementsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
-__ZN7WebCore15HTMLFormElement8elementsEv
-__ZN7WebCore18HTMLFormCollection6createEN3WTF10PassRefPtrINS_15HTMLFormElementEEE
-__ZN7WebCore18HTMLFormCollectionC2EN3WTF10PassRefPtrINS_15HTMLFormElementEEE
-__ZN7WebCore14HTMLCollectionC2EN3WTF10PassRefPtrINS_4NodeEEENS0_4TypeEPNS0_14CollectionInfoE
-__ZNK7WebCore14HTMLCollection10namedItemsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
-__ZNK7WebCore14HTMLCollection19resetCollectionInfoEv
-__ZNK7WebCore18HTMLFormCollection15updateNameCacheEv
-__ZN7WebCore18HTMLFormCollectionD1Ev
-__ZN7WebCore15HTMLFormElement15elementForAliasERKNS_12AtomicStringE
-stringEncodingForResource
-__ZN7WebCore16MIMETypeRegistry26getSupportedImageMIMETypesEv
-__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE15reserveCapacityEm
-__ZN7WebCore13JSPluginArray18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZN7WebCore13JSPluginArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore11PluginArray4itemEj
-__ZN7WebCore6PluginC1EPNS_10PluginDataEj
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_6PluginE
-__ZN7WebCore8JSPlugin15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore8JSPluginC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6PluginEEE
-__ZN7WebCore8JSPlugin18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12jsPluginNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Plugin4nameEv
-__ZN7WebCore19jsNavigatorPlatformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13NavigatorBase8platformEv
-__ZNK3JSC8JSObject11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
-__ZN7WebCore35jsLocationPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore10JSLocation8toStringEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore21allowsAccessFromFrameEPN3JSC9ExecStateEPNS_5FrameE
-__ZNK7WebCore8Location8toStringEv
-__ZNK7WebCore4KURL7hasPathEv
-__ZNK7WebCore4KURL9prettyURLEv
-__ZN7WebCore18jsDocumentReferrerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Document8referrerEv
-__ZNK7WebCore11FrameLoader8referrerEv
-__ZN7WebCore20jsNavigatorMimeTypesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9Navigator9mimeTypesEv
-__ZN7WebCore13MimeTypeArrayC1EPNS_5FrameE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13MimeTypeArrayE
-__ZN7WebCore15JSMimeTypeArray15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSMimeTypeArrayC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MimeTypeArrayEEE
-__ZN7WebCore13JSPluginArray18canGetItemsForNameEPN3JSC9ExecStateEPNS_11PluginArrayERKNS1_10IdentifierE
-__ZN7WebCore11PluginArray18canGetItemsForNameERKNS_12AtomicStringE
-__ZN7WebCore22JSPluginArrayPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore13JSPluginArray10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore11PluginArray9namedItemERKNS_12AtomicStringE
-__ZN7WebCore19jsPluginDescriptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Plugin11descriptionEv
-__ZN7WebCore14jsLocationHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Location4hrefEv
-__ZN7WebCore6PluginD1Ev
-__ZN7WebCore12CachedScript17allClientsRemovedEv
-__ZN7WebCore16jsDocumentImagesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore8Document6imagesEv
-__ZN7WebCore14HTMLCollection6createEN3WTF10PassRefPtrINS_4NodeEEENS0_4TypeE
-__ZN7WebCore14HTMLCollectionC2EN3WTF10PassRefPtrINS_4NodeEEENS0_4TypeE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14HTMLCollectionE
-__ZN7WebCore16JSHTMLCollection15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSHTMLCollectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLCollectionEEE
-__ZL20jsDOMWindowBaseImagePN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore18JSImageConstructorC1EPN3JSC9ExecStateEPNS_22ScriptExecutionContextE
-__ZN7WebCore18JSImageConstructor16getConstructDataERN3JSC13ConstructDataE
-__ZN7WebCoreL14constructImageEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
-__ZN7WebCoreL29createHTMLImageElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLImageElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLImageElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLImageElementEEE
-__ZN7WebCore18JSHTMLImageElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore13JSHTMLElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore9JSElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore26setJSEventTargetNodeOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode9setOnloadEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore15EventTargetNode29setInlineEventListenerForTypeERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore15EventTargetNode32removeInlineEventListenerForTypeERKNS_12AtomicStringE
-__ZN7WebCore8Document42registerDisconnectedNodeWithEventListenersEPNS_4NodeE
-__ZN3WTF7HashSetIPN7WebCore4NodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore24setJSHTMLImageElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement6setSrcERKNS_6StringE
-__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameERKNS_12AtomicStringERi
-__ZNK7WebCore13StyledElement18createAttributeMapEv
-__ZN7WebCore13StyledElement15createAttributeERKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorIcLm512EE14expandCapacityEm
-__ZN3WTF6VectorIcLm512EE15reserveCapacityEm
-__ZN7WebCore7Element25dispatchAttrAdditionEventEPNS_9AttributeE
-__ZN7WebCore5TimerINS_9FrameViewEE5firedEv
-__ZN7WebCore9FrameView16layoutTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore10RenderFlow14dirtyLineBoxesEbb
-__ZN7WebCore10RenderFlow11calcMarginsEi
-__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE15reserveCapacityEm
-__ZN7WebCore13RootInlineBox8OverflownwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderBlock20insertFloatingObjectEPNS_9RenderBoxE
-__ZN7WebCore21DeprecatedPtrListImplC1EPFvPvE
-__ZN7WebCore21DeprecatedPtrListImpl6appendEPKv
-__ZN7WebCore21DeprecatedPtrListImpl6insertEjPKv
-__ZN7WebCore21DeprecatedPtrListImpl4lastEv
-__ZNK7WebCore21DeprecatedPtrListImpl7currentEv
-__ZNK7WebCore21DeprecatedPtrListImpl7getPrevEv
-__ZN7WebCore29DeprecatedPtrListImplIteratorC1ERKNS_21DeprecatedPtrListImplE
-__ZNK7WebCore21DeprecatedPtrListImpl11addIteratorEPNS_29DeprecatedPtrListImplIteratorE
-__ZNK7WebCore29DeprecatedPtrListImplIterator7currentEv
-__ZN7WebCore29DeprecatedPtrListImplIteratorppEv
-__ZN7WebCore29DeprecatedPtrListImplIteratorD1Ev
-__ZNK7WebCore21DeprecatedPtrListImpl14removeIteratorEPNS_29DeprecatedPtrListImplIteratorE
-__ZN7WebCore21DeprecatedPtrListImpl4nextEv
-__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE6shrinkEm
-__ZNK7WebCore11RenderBlock33expandsToEncloseOverhangingFloatsEv
-__ZNK7WebCore12RenderObject10isFieldsetEv
-__ZN7WebCore11RenderBlock13containsFloatEPNS_12RenderObjectE
-__ZN7WebCoreL25inlineFlowRequiresLineBoxEPNS_9RenderBoxE
-__ZN7WebCore9RenderBox14dirtyLineBoxesEbb
-__ZN7WebCore27RenderTextControlSingleLine6layoutEv
-__ZN7WebCore17RenderTextControl10calcHeightEv
-__ZNK7WebCore4Node9renderBoxEv
-__ZN7WebCore27RenderTextControlSingleLine36adjustControlHeightBasedOnLineHeightEi
-__ZNK7WebCore12RenderObject13isHTMLMarqueeEv
-__ZNK7WebCore17RenderTextControl16innerTextElementEv
-__ZNK7WebCore17RenderTextControl15textBlockHeightEv
-__ZNK7WebCore27RenderTextControlSingleLine14textBlockWidthEv
-__ZNK7WebCore17RenderTextControl14textBlockWidthEv
-__ZNK7WebCore17RenderTextControl12avoidsFloatsEv
-__ZNK7WebCore4Node19rootEditableElementEv
-__ZNK7WebCore12RenderObject7isImageEv
-__ZN7WebCore12RenderObject15createInlineBoxEbbb
-__ZNK7WebCore9InlineBox6isTextEv
-__ZNK7WebCore11RenderBlock14selectionStateEv
-__ZN7WebCore9InlineBox15isInlineTextBoxEv
-__ZNK7WebCore9InlineBox11isLineBreakEv
-__ZNK7WebCore11RenderTheme18isControlContainerENS_11ControlPartE
-__ZNK7WebCore11RenderBlock24getBaselineOfLastLineBoxEv
-__ZN7WebCore9RenderBox8positionEPNS_9InlineBoxE
-__ZNK7WebCore27RenderTextControlSingleLine14hasControlClipEv
-__ZNK7WebCore12RenderObject26isInlineBlockOrInlineTableEv
-__ZN7WebCoreL22getBorderPaddingMarginEPNS_9RenderBoxEb
-__ZN7WebCoreL11addMidpointERKNS_14InlineIteratorE
-__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE4growEm
-__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE15reserveCapacityEm
-__ZN7WebCore13InlineFlowBox15isInlineFlowBoxEv
-__ZN7WebCore9InlineBox15isRootInlineBoxEv
-__ZNK7WebCore9RenderBox12maxPrefWidthEv
-__ZN7WebCore11RenderBlock14calcPrefWidthsEv
-__ZN7WebCore11RenderBlock20calcInlinePrefWidthsEv
-__ZN7WebCore20InlineMinMaxIterator4nextEv
-__ZNK7WebCore9RenderBox12minPrefWidthEv
-__ZN7WebCore9RenderBox10setStaticXEi
-__ZNK7WebCore9RenderBox7staticXEv
-__ZN7WebCore21DeprecatedPtrListImpl5clearEb
-__ZN7WebCore17DeprecatedPtrListINS_11RenderBlock14FloatingObjectEE10deleteFuncEPv
-__ZNK7WebCore12RenderObject11isBlockFlowEv
-__ZN7WebCore5TimerINS_13HTMLTokenizerEE5firedEv
-__ZN7WebCore13HTMLTokenizer10timerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore14PreloadScanner3endEv
-__ZN7WebCore11RenderStyle17setHasPseudoStyleENS0_8PseudoIdE
-__ZNK7WebCore8CSSValue21isImageGeneratorValueEv
-__ZN7WebCore11RenderStyle10setContentEPNS_10StringImplEb
-__ZN7WebCore18RenderTextFragmentC1EPNS_4NodeEPNS_10StringImplE
-__ZN7WebCore13StyledElement22getMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeE
+__ZN7WebCore15SegmentedString6appendERKS0_
+__ZN7WebCore15SegmentedString6appendERKNS_18SegmentedSubstringE
+__ZN7WebCore10HTMLParser20bodyCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser10createHeadEv
+__ZN7WebCore10HTMLParser9startBodyEv
+__ZN7WebCoreL15bodyConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLBodyElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLBodyElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore15HTMLBodyElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore15HTMLBodyElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore13StyledElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore13StyledElement18getInlineStyleDeclEv
+__ZN7WebCore13StyledElement21createInlineStyleDeclEv
+__ZN7WebCore26CSSMutableStyleDeclarationC1Ev
+__ZN7WebCore26CSSMutableStyleDeclarationC2Ev
+__ZN7WebCore26CSSMutableStyleDeclaration16parseDeclarationERKNS_6StringE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE14shrinkCapacityEm
+__ZN7WebCore9CSSParser16parseDeclarationEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
+__ZN7WebCore13StyledElement24invalidateStyleAttributeEv
+__ZNK7WebCore15HTMLBodyElement17endTagRequirementEv
+__ZNK7WebCore15HTMLBodyElement11tagPriorityEv
+__ZN7WebCore15HTMLBodyElement20insertedIntoDocumentEv
+__ZN7WebCore11HTMLElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore11HTMLElement15inEitherTagListEPKNS_4NodeE
+__ZN7WebCore10HTMLParser23pCloserCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL14divConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore14HTMLDivElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLDivElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore7Element8updateIdERKNS_12AtomicStringES3_
+__ZNK7WebCore14HTMLDivElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore14HTMLDivElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14HTMLDivElement17endTagRequirementEv
+__ZNK7WebCore14HTMLDivElement11tagPriorityEv
+__ZN7WebCoreL13inlineTagListEv
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN7WebCoreL12blockTagListEv
+__ZN7WebCore8Document14addElementByIdERKNS_12AtomicStringEPNS_7ElementE
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraits
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14Pa
+__ZN7WebCore13StyledElement21classAttributeChangedERKNS_12AtomicStringE
+__ZN7WebCore18NamedMappedAttrMap8setClassERKNS_6StringE
+__ZN7WebCore4Node28dispatchSubtreeModifiedEventEv
+__ZN7WebCore4Node31notifyNodeListsAttributeChangedEv
+__ZN7WebCore4Node36notifyLocalNodeListsAttributeChangedEv
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE15reserveCapacityEm
+__ZN7WebCore15FontFamilyValueC1ERKNS_6StringE
+__ZN7WebCore15FontFamilyValueC2ERKNS_6StringE
+__ZN7WebCore6String8truncateEj
+__ZN7WebCoreL16imageConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore16HTMLImageElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore15HTMLImageLoaderC1EPNS_7ElementE
+__ZN7WebCore15HTMLImageLoaderC2EPNS_7ElementE
+__ZN7WebCore11ImageLoaderC2EPNS_7ElementE
+__ZNK7WebCore16HTMLImageElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLImageElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11ImageLoader38updateFromElementIgnoringPreviousErrorEv
+__ZN7WebCore11ImageLoader17updateFromElementEv
+__ZNK7WebCore7Element24imageSourceAttributeNameEv
+__ZNK7WebCore15HTMLImageLoader9sourceURIERKNS_12AtomicStringE
+__ZN7WebCore9DocLoader12requestImageERKNS_6StringE
+__ZN7WebCore11CachedImageC1ERKNS_6StringE
+__ZN7WebCore11CachedImageC2ERKNS_6StringE
+__ZN7WebCore11CachedImage4loadEPNS_9DocLoaderE
+__ZN7WebCore11ImageLoader15setLoadingImageEPNS_11CachedImageE
+__ZN7WebCore11CachedImage9addClientEPNS_20CachedResourceClientE
+__ZNK3WTF7HashMapIN7WebCore18MappedAttributeKeyEPNS1_29CSSMappedAttributeDeclarationENS1_19MappedAttributeHashENS1_24MappedAttr
 __ZN7WebCore13StyledElement12addCSSLengthEPNS_15MappedAttributeEiRKNS_6StringE
-__ZN7WebCore13StyledElement16createMappedDeclEPNS_15MappedAttributeE
-__ZN7WebCore26CSSMutableStyleDeclarationC1EPNS_7CSSRuleE
-__ZN7WebCore8Document12elementSheetEv
 __ZN7WebCore26CSSMutableStyleDeclaration17setLengthPropertyEiRKNS_6StringEbb
-__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbb
-__ZN7WebCore9CSSParser10parseValueEPNS_26CSSMutableStyleDeclarationEiRKNS_6StringEb
-__ZNK7WebCore9StyleBase12isStyleSheetEv
-__ZN7WebCore26CSSMutableStyleDeclaration19addParsedPropertiesEPKPKNS_11CSSPropertyEi
-__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyPriorityEi
-__ZNK7WebCore26CSSMutableStyleDeclaration18findPropertyWithIdEi
-__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEibb
-__ZN7WebCore26CSSMutableStyleDeclaration23removeShorthandPropertyEib
-__ZN7WebCore19longhandForPropertyEi
-__ZN7WebCoreL16initShorthandMapERN3WTF7HashMapIiNS_19CSSPropertyLonghandENS0_7IntHashIjEENS0_10HashTraitsIiEENS5_IS2_EEEE
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore19CSSPropertyLonghandEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E6expandEv
-__ZN3WTF7HashMapIiN7WebCore19CSSPropertyLonghandENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
-__ZN7WebCore26CSSMutableStyleDeclaration18findPropertyWithIdEi
-__ZN7WebCore26CSSMutableStyleDeclaration10setChangedEv
-__ZN7WebCore13StyledElement22setMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeEPNS_29CSSMappedAttributeDeclarationE
-__ZN3WTF9HashTableIN7WebCore18MappedAttributeKeyESt4pairIS2_PNS1_29CSSMappedAttributeDeclarationEENS_18PairFirstExtractorIS6_EENS1_19MappedAttributeHashENS_14PairHashTraitsINS1_24MappedAttributeKeyTraitsENS_10HashTraitsIS5_EEEESB_E6expandEv
-__ZN7WebCore19MappedAttributeHash4hashERKNS_18MappedAttributeKeyE
-__ZN3WTF7HashMapIN7WebCore18MappedAttributeKeyEPNS1_29CSSMappedAttributeDeclarationENS1_19MappedAttributeHashENS1_24MappedAttributeKeyTraitsENS_10HashTraitsIS4_EEE3setERKS2_RKS4_
+__ZNK7WebCore16HTMLImageElement17endTagRequirementEv
+__ZNK7WebCore16HTMLImageElement11tagPriorityEv
+__ZN7WebCore16HTMLImageElement20insertedIntoDocumentEv
+__ZN7WebCore12HTMLDocument12addNamedItemERKNS_12AtomicStringE
+__ZN7WebCoreL12addItemToMapERN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiEEEERKNS_12Ato
+__ZN7WebCore12HTMLDocument17addExtraNamedItemERKNS_12AtomicStringE
+__ZN7WebCore16HTMLImageElement6attachEv
+__ZN7WebCore10HTMLParser22nestedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL17anchorConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLAnchorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLAnchorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLAnchorElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11prefetchDNSERKNS_6StringE
+__ZNK7WebCore4Page24javaScriptURLsAreAllowedEv
+__ZNK7WebCore17HTMLAnchorElement17endTagRequirementEv
+__ZNK7WebCore17HTMLAnchorElement11tagPriorityEv
+__ZN7WebCore10HTMLParser27nestedStyleCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser23allowNestedRedundantTagERKNS_12AtomicStringE
+__ZN7WebCore11HTMLElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL13brConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore13HTMLBRElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13HTMLBRElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore13HTMLBRElement17endTagRequirementEv
+__ZNK7WebCore13HTMLBRElement11tagPriorityEv
+__ZN7WebCore13HTMLTokenizer11parseEntityERNS_15SegmentedStringERPtNS0_5StateERjbb
+__ZN7WebCoreL20encodeRelativeStringERKNS_6StringERKNS_12TextEncodingERN3WTF6VectorIcLm512EEE
+__ZN3WTF6VectorItLm512EE14shrinkCapacityEm
+__ZN7WebCoreL11findFirstOfEPKtiiPKc
+__ZN3WTF6VectorItLm512EE6appendItEEvPKT_m
+__ZN7WebCoreL21appendEncodedHostnameERN3WTF6VectorItLm512EEEPKtj
+__ZN7WebCore12TextCodecICU6encodeEPKtmNS_19UnencodableHandlingE
+__ZN7WebCore7CStringC1EPKcj
+__ZN7WebCore7CStringC2EPKcj
+__ZN7WebCore7CString4initEPKcj
+__ZN7WebCore12TextCodecICUD0Ev
+__ZNK7WebCore12TextCodecICU19releaseICUConverterEv
+__ZN7WebCoreL18headingConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore18HTMLHeadingElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18HTMLHeadingElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore18HTMLHeadingElement17endTagRequirementEv
+__ZNK7WebCore18HTMLHeadingElement11tagPriorityEv
+__ZN7WebCoreL16labelConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLLabelElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLLabelElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLLabelElement11tagPriorityEv
+__ZN7WebCore18HTMLHeadingElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore10HTMLParser20formCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore15HTMLFormElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLFormElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15FormDataBuilderC1Ev
+__ZN7WebCore15FormDataBuilderC2Ev
+__ZN7WebCore15HTMLFormElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore15HTMLFormElement17endTagRequirementEv
+__ZNK7WebCore15HTMLFormElement11tagPriorityEv
+__ZN7WebCore15HTMLFormElement20insertedIntoDocumentEv
+__ZN7WebCore15HTMLFormElement6attachEv
+__ZN7WebCoreL19fieldsetConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLFieldSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLFieldSetElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore22HTMLFormControlElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore15HTMLFormElement19registerFormElementEPNS_22HTMLFormControlElementE
+__ZN7WebCore19CheckedRadioButtons12removeButtonEPNS_22HTMLFormControlElementE
+__ZNK7WebCore22HTMLFormControlElement15formControlNameEv
+__ZN7WebCore19CheckedRadioButtons9addButtonEPNS_22HTMLFormControlElementE
+__ZNK7WebCore22HTMLFormControlElement13isRadioButtonEv
+__ZN7WebCore15HTMLFormElement16formElementIndexEPNS_22HTMLFormControlElementE
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE15reserveCapacityEm
+__ZN7WebCore22HTMLFormControlElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore22HTMLFormControlElement17endTagRequirementEv
+__ZNK7WebCore19HTMLFieldSetElement11tagPriorityEv
+__ZN7WebCore22HTMLFormControlElement16insertedIntoTreeEb
+__ZN7WebCore22HTMLFormControlElement6attachEv
+__ZNK7WebCore22HTMLFormControlElement9autofocusEv
+__ZNK7WebCore7Element12hasAttributeERKNS_13QualifiedNameE
+__ZNK7WebCore7Element14hasAttributeNSERKNS_6StringES3_
+__ZNK7WebCore7Element10attributesEb
+__ZN7WebCore19HTMLFieldSetElement8checkDTDEPKNS_4NodeE
+__ZN7WebCoreL16inputConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLInputElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore16HTMLInputElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore31HTMLFormControlElementWithStateC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore16InputElementDataC1EPNS_12InputElementEPNS_7ElementE
+__ZN7WebCore16InputElementDataC2EPNS_12InputElementEPNS_7ElementE
+__ZNK7WebCore16HTMLInputElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLInputElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16HTMLInputElement12setInputTypeERKNS_6StringE
+__ZNK7WebCore16HTMLInputElement15formControlNameEv
+__ZNK7WebCore16InputElementData4nameEv
+__ZNK7WebCore16HTMLInputElement13isRadioButtonEv
+__ZN7WebCore12InputElement18parseSizeAttributeERNS_16InputElementDataEPNS_15MappedAttributeE
 __ZNK7WebCore6String5toIntEPb
 __ZN7WebCore10StringImpl5toIntEPb
 __ZN7WebCore15charactersToIntEPKtmPb
 __ZN7WebCoreL27lengthOfCharactersAsIntegerEPKtm
 __ZN7WebCoreL24isCharacterAllowedInBaseEti
-__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEii
-__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiibb
-__ZN7WebCore26CSSMutableStyleDeclaration19setPropertyInternalERKNS_11CSSPropertyEPS1_
-__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EE14expandCapacityEm
-__ZN7WebCoreL18headingConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore18HTMLHeadingElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore18HTMLHeadingElement17endTagRequirementEv
-__ZNK7WebCore18HTMLHeadingElement11tagPriorityEv
-__ZN7WebCore18HTMLHeadingElement8checkDTDEPKNS_4NodeE
-__ZN7WebCoreL13brConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore13HTMLBRElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore13HTMLBRElement17endTagRequirementEv
-__ZNK7WebCore13HTMLBRElement11tagPriorityEv
-__ZN7WebCore13HTMLBRElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore8RenderBRC1EPNS_4NodeE
-__ZN7WebCore8RenderBR14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore13HTMLTokenizer11parseEntityERNS_15SegmentedStringERPtNS0_5StateERjbb
-__ZN7WebCore15RenderContainer13moveChildNodeEPNS_12RenderObjectE
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
-__ZN7WebCoreL19valueOrPropertyNameEi
-__Z12getValueNamet
-__ZN7WebCoreleERNS_11CSSRuleDataES1_
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE6shrinkEm
-__ZN7WebCoreL13olConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLOListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16HTMLOListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLOListElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLOListElement17endTagRequirementEv
-__ZNK7WebCore16HTMLOListElement11tagPriorityEv
-__ZN7WebCore14RenderListItemC1EPNS_4NodeE
-__ZN7WebCore14RenderListItem14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZNK7WebCore14RenderListItem10isListItemEv
-__ZN7WebCoreL23updateListMarkerNumbersEPNS_12RenderObjectE
-__ZN7WebCore14RenderListItem18clearExplicitValueEv
-__ZN7WebCore14RenderListItem11updateValueEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SB_EEEENS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCore13StyledElement18getInlineStyleDeclEv
-__ZN7WebCore13StyledElement21createInlineStyleDeclEv
-__ZN7WebCore26CSSMutableStyleDeclarationC1Ev
-__ZN7WebCore26CSSMutableStyleDeclaration16parseDeclarationERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EE14shrinkCapacityEm
-__ZN7WebCore9CSSParser16parseDeclarationEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
-__ZN7WebCore13StyledElement24invalidateStyleAttributeEv
-__ZNK7WebCore15FontDescription12bolderWeightEv
-__ZNK7WebCore4Node15isStyledElementEv
-__ZNK7WebCore18NamedMappedAttrMap14mapsEquivalentEPKS0_
-__ZNK7WebCore18NamedMappedAttrMap9declCountEv
-__ZN3WTF9HashTableIN7WebCore18MappedAttributeKeyESt4pairIS2_PNS1_29CSSMappedAttributeDeclarationEENS_18PairFirstExtractorIS6_EENS1_19MappedAttributeHashENS_14PairHashTraitsINS1_24MappedAttributeKeyTraitsENS_10HashTraitsIS5_EEEESB_E4findIS2_NS_22IdentityHashTranslatorIS2_S6_S9_EEEENS_17HashTableIteratorIS2_S6_S8_S9_SE_SB_EERKT_
-__ZNK7WebCore15JSEventListener11listenerObjEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11EventTargetE
-__ZN7WebCore11EventTarget20toSVGElementInstanceEv
-__ZN7WebCore41jsDOMWindowPrototypeFunctionClearIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11JSDOMWindow13clearIntervalEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore15JSDOMWindowBase13removeTimeoutEi
-__ZN7WebCore8DOMTimer10removeByIdEPNS_22ScriptExecutionContextEi
-__ZN7WebCore8Document11findTimeoutEi
-__ZN3WTF7HashMapIiPN7WebCore8DOMTimerENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
-__ZN7WebCore16jsNodeListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL29createHTMLInputElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLInputElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLInputElementEEE
-__ZN7WebCore18JSHTMLInputElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSHTMLInputElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22jsHTMLElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11HTMLElement9classNameEv
-__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore4Node22getElementsByClassNameERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore6StringEPNS1_15DynamicNodeList6CachesENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3addERKS2_RKS5_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6expandEv
-__ZN7WebCore13ClassNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
-__ZN7WebCore10JSNodeList11getCallDataERN3JSC8CallDataE
-__ZNK7WebCore10JSNodeList9classInfoEv
-__ZNK7WebCore13ClassNodeList11nodeMatchesEPNS_7ElementE
-__ZN7WebCore14ClassNamesData11containsAllERS0_
-__ZN7WebCoreL31createHTMLHeadingElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore20JSHTMLHeadingElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore20JSHTMLHeadingElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLHeadingElementEEE
-__ZNK7WebCore15DynamicNodeList24itemBackwardsFromCurrentEPNS_4NodeEji
-__ZNK7WebCore4Node20traversePreviousNodeEPKS0_
-__ZN7WebCoreL33createHTMLParagraphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore22JSHTMLParagraphElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore22JSHTMLParagraphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLParagraphElementEEE
-__ZN7WebCore14jsElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13StyledElement5styleEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19CSSStyleDeclarationE
-__ZN7WebCore21JSCSSStyleDeclaration15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSCSSStyleDeclarationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19CSSStyleDeclarationEEE
-__ZN7WebCore21JSCSSStyleDeclaration3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore21JSCSSStyleDeclaration9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCoreL17isCSSPropertyNameERKN3JSC10IdentifierE
-__ZN7WebCoreL15cssPropertyNameERKN3JSC10IdentifierEPb
-__ZN7WebCoreL24hasCSSPropertyNamePrefixERKN3JSC10IdentifierEPKc
-__ZN7WebCore19CSSStyleDeclaration14isPropertyNameERKNS_6StringE
-__ZN7WebCore13cssPropertyIDERKNS_6StringE
-__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_Ri
-__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_S3_Ri
-__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbRi
-__ZN7WebCore22JSHTMLParagraphElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSHTMLHeadingElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33jsDOMWindowXPathResultConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13JSXPathResult14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore24JSXPathResultConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore22JSXPathResultPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore13JSXPathResult15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore24JSXPathResultConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore39jsXPathResultORDERED_NODE_SNAPSHOT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsDocumentPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore17toXPathNSResolverEN3JSC10JSValuePtrE
-__ZN7WebCore23JSCustomXPathNSResolver6createEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore13toXPathResultEN3JSC10JSValuePtrE
-__ZN7WebCore8Document8evaluateERKNS_6StringEPNS_4NodeEPNS_15XPathNSResolverEtPNS_11XPathResultERi
-__ZN7WebCore14XPathEvaluator8evaluateERKNS_6StringEPNS_4NodeEPNS_15XPathNSResolverEtPNS_11XPathResultERi
-__ZN7WebCore5XPath18isValidContextNodeEPNS_4NodeE
-__ZN7WebCore14XPathEvaluator16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
-__ZN7WebCore15XPathExpression16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
-__ZN7WebCore5XPath6ParserC1Ev
-__ZN7WebCore5XPath6Parser5resetERKNS_6StringE
-__ZN7WebCore5XPath6Parser14parseStatementERKNS_6StringEN3WTF10PassRefPtrINS_15XPathNSResolverEEERi
-__Z12xpathyyparsePv
-__ZN7WebCore5XPath6Parser3lexEPv
-__ZN7WebCore5XPath6Parser9nextTokenEv
-__ZN7WebCore5XPath6Parser17nextTokenInternalEv
-__ZN7WebCore5XPath6Parser6skipWSEv
-__ZN7WebCore5XPath6Parser13peekCurHelperEv
-__ZN7WebCore5XPath6Parser15peekAheadHelperEv
-__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEii
-__ZN7WebCore5XPath4StepC1ENS1_4AxisERKNS1_8NodeTestERKN3WTF6VectorIPNS0_9PredicateELm0EEE
-__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EEC1ERKS5_
-__ZN7WebCore5XPath6Parser17registerParseNodeEPNS0_9ParseNodeE
-__ZN3WTF7HashSetIPN7WebCore5XPath9ParseNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E5clearEv
-__ZN7WebCore5XPath12LocationPathC1Ev
-__ZN7WebCore5XPath10ExpressionC2Ev
-__ZN7WebCore5XPath12LocationPath10appendStepEPNS0_4StepE
-__ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE15reserveCapacityEm
-__ZN7WebCore5XPath6Parser19unregisterParseNodeEPNS0_9ParseNodeE
-__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEENS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EERKT_
-__ZNK7WebCore5XPath6Parser17isOperatorContextEv
-__ZN7WebCore5XPath6Parser14registerStringEPNS_6StringE
-__ZN3WTF7HashSetIPN7WebCore6StringENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
-__ZN7WebCore5XPath6Parser9lexNCNameERNS_6StringE
-__ZN7WebCore5XPathL7charCatEt
-__ZN7WebCore5XPathL14isNodeTypeNameERKNS_6StringE
-__ZN7WebCore5XPath6Parser9lexStringEv
-__ZN7WebCore5XPath16StringExpressionC1ERKNS_6StringE
-__ZN7WebCore5XPath6Parser12deleteStringEPNS_6StringE
-__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE15reserveCapacityEm
-__ZN7WebCore5XPath6Parser24registerExpressionVectorEPN3WTF6VectorIPNS0_10ExpressionELm0EEE
-__ZN3WTF7HashSetIPNS_6VectorIPN7WebCore5XPath10ExpressionELm0EEENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEE3addERKS7_
-__ZN3WTF9HashTableIPNS_6VectorIPN7WebCore5XPath10ExpressionELm0EEES7_NS_17IdentityExtractorIS7_EENS_7PtrHashIS7_EENS_10HashTraitsIS7_EESD_E5clearEv
-__ZN7WebCore5XPath6Parser11expandQNameERKNS_6StringERS2_S5_
-__ZN7WebCore5XPath14createFunctionERKNS_6StringERKN3WTF6VectorIPNS0_10ExpressionELm0EEE
-__ZN7WebCore5XPathL17createFunctionMapEv
-__ZN3WTF7HashMapIN7WebCore6StringENS1_5XPath11FunctionRecENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_5XPath11FunctionRecEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E6expandEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_5XPath11FunctionRecEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E4findIS2_NS_22IdentityHashTranslatorIS2_S6_S9_EEEENS_17HashTableIteratorIS2_S6_S8_S9_SE_SC_EERKT_
-__ZN7WebCore5XPathL15createFunConcatEv
-__ZN7WebCore5XPath8Function12setArgumentsERKN3WTF6VectorIPNS0_10ExpressionELm0EEE
-__ZN7WebCore5XPath6Parser22deleteExpressionVectorEPN3WTF6VectorIPNS0_10ExpressionELm0EEE
-__ZN3WTF9HashTableIPNS_6VectorIPN7WebCore5XPath10ExpressionELm0EEES7_NS_17IdentityExtractorIS7_EENS_7PtrHashIS7_EENS_10HashTraitsIS7_EESD_E4findIS7_NS_22IdentityHashTranslatorIS7_S7_SB_EEEENS_17HashTableIteratorIS7_S7_S9_SB_SD_SD_EERKT_
-__ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE6shrinkEm
-__ZN7WebCore5XPathL17createFunContainsEv
-__ZN7WebCore5XPath9PredicateC1EPNS0_10ExpressionE
-__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE15reserveCapacityEm
-__ZN7WebCore5XPath6Parser23registerPredicateVectorEPN3WTF6VectorIPNS0_9PredicateELm0EEE
-__ZN3WTF7HashSetIPNS_6VectorIPN7WebCore5XPath9PredicateELm0EEENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEE3addERKS7_
-__ZN3WTF9HashTableIPNS_6VectorIPN7WebCore5XPath9PredicateELm0EEES7_NS_17IdentityExtractorIS7_EENS_7PtrHashIS7_EENS_10HashTraitsIS7_EESD_E5clearEv
-__ZN7WebCore5XPath6Parser21deletePredicateVectorEPN3WTF6VectorIPNS0_9PredicateELm0EEE
-__ZN3WTF9HashTableIPNS_6VectorIPN7WebCore5XPath9PredicateELm0EEES7_NS_17IdentityExtractorIS7_EENS_7PtrHashIS7_EENS_10HashTraitsIS7_EESD_E4findIS7_NS_22IdentityHashTranslatorIS7_S7_SB_EEEENS_17HashTableIteratorIS7_S7_S9_SB_SD_SD_EERKT_
-__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE6shrinkEm
-__ZN7WebCore5XPath12LocationPath16optimizeStepPairEj
-__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E5clearEv
-__ZN7WebCore15XPathExpression8evaluateEPNS_4NodeEtPNS_11XPathResultERi
-__ZN7WebCore5XPath10Expression17evaluationContextEv
-__ZNK7WebCore5XPath12LocationPath8evaluateEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE15reserveCapacityEm
-__ZNK7WebCore5XPath12LocationPath8evaluateERNS0_7NodeSetE
-__ZNK7WebCore5XPath4Step8evaluateEPNS_4NodeERNS0_7NodeSetE
-__ZNK7WebCore5XPath4Step11nodesInAxisEPNS_4NodeERNS0_7NodeSetE
-__ZNK7WebCore5XPath4Step11nodeMatchesEPNS_4NodeE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE6shrinkEm
-__ZNK7WebCore4Node15isAttributeNodeEv
-__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZNK7WebCore5XPath9Predicate8evaluateEv
-__ZNK7WebCore5XPath11FunContains8evaluateEv
-__ZNK7WebCore5XPath9FunConcat8evaluateEv
-__ZNK7WebCore5XPath16StringExpression8evaluateEv
-__ZNK7WebCore5XPath5Value8toStringEv
-__ZN3WTF6VectorItLm1024EE6appendItEEvPKT_m
-__ZN7WebCore7Element18getAttributeNodeNSERKNS_6StringES3_
-__ZNK7WebCore5XPath5Value9toBooleanEv
-__ZNK7WebCore12NamedAttrMap12getNamedItemERKNS_13QualifiedNameE
-__ZN7WebCore9Attribute18createAttrIfNeededEPNS_7ElementE
-__ZN7WebCore4AttrC2EPNS_7ElementEPNS_8DocumentEN3WTF10PassRefPtrINS_9AttributeEEE
-__ZN7WebCore4Attr15createTextChildEv
-__ZNK7WebCore4Attr19virtualNamespaceURIEv
-__ZNK7WebCore4Attr12namespaceURIEv
-__ZNK7WebCore5XPath7NodeSet9firstNodeEv
-__ZNK7WebCore5XPath7NodeSet4sortEv
-__ZN7WebCore5XPath11stringValueEPNS_4NodeE
-__ZNK7WebCore4Attr8nodeTypeEv
-__ZNK7WebCore4Attr9nodeValueEv
-__ZNK7WebCore13StyledElement20updateStyleAttributeEv
-__ZNK7WebCore26CSSMutableStyleDeclaration7cssTextEv
-__ZNK7WebCore11CSSProperty7cssTextEv
-__ZNK7WebCore17CSSPrimitiveValue7cssTextEv
-__Z15getPropertyName13CSSPropertyID
-__ZN7WebCore11XPathResultC1EPNS_15EventTargetNodeERKNS_5XPath5ValueE
-__ZNK7WebCore5XPath5Value9toNodeSetEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEaSERKS5_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE14shrinkCapacityEm
-__ZN7WebCore11XPathResult9convertToEtRi
-__ZN3WTF6VectorIPN7WebCore4NodeELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore4NodeELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore4NodeELm0EE15reserveCapacityEm
-__ZN7WebCore5XPathL9sortBlockEjjRN3WTF6VectorINS2_IPNS_4NodeELm0EEELm0EEEb
-__ZNK3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEEbRKT_
-__ZN3WTF6VectorINS0_IPN7WebCore4NodeELm0EEELm0EE6shrinkEm
-__ZN3WTF6VectorIPN7WebCore4NodeELm0EE6shrinkEm
-__ZN7WebCore15XPathExpressionD1Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore5XPath4StepELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN3WTF15deleteAllValuesIPN7WebCore5XPath9PredicateELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore5XPath9PredicateD1Ev
-__ZN7WebCore5XPath11FunContainsD1Ev
-__ZN7WebCore5XPath10ExpressionD0Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore5XPath10ExpressionELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore5XPath9FunConcatD1Ev
-__ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE6shrinkEm
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11XPathResultE
-__ZN7WebCore13JSXPathResultC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11XPathResultEEE
-__ZN7WebCore13JSXPathResult18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27jsXPathResultSnapshotLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11XPathResult14snapshotLengthERi
-__ZNK7WebCore11XPathResult10resultTypeEv
-__ZN7WebCore22JSXPathResultPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsXPathResultPrototypeFunctionSnapshotItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore13JSXPathResult9classInfoEv
-__ZN7WebCore11XPathResult12snapshotItemEmRi
-__ZN7WebCore16JSHTMLDivElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore25setJSHTMLElementInnerHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11HTMLElement12setInnerHTMLERKNS_6StringERi
-__ZN7WebCore11HTMLElement24createContextualFragmentERKNS_6StringE
-__ZN7WebCore16DocumentFragmentC1EPNS_8DocumentE
-__ZN7WebCore25parseHTMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentE
-__ZN7WebCore13HTMLTokenizerC1EPNS_16DocumentFragmentE
-__ZN7WebCore10HTMLParserC1EPNS_16DocumentFragmentE
-__ZN7WebCore13HTMLTokenizer19setForceSynchronousEb
-__ZN7WebCore16DocumentFragment16childTypeAllowedENS_4Node8NodeTypeE
-__ZN7WebCore13HTMLTokenizerD0Ev
-__ZN7WebCoreL27replaceChildrenWithFragmentEPNS_11HTMLElementEN3WTF10PassRefPtrINS_16DocumentFragmentEEERi
-__ZNK7WebCore16DocumentFragment8nodeTypeEv
-__ZN7WebCore13ContainerNode11removeChildEPNS_4NodeERi
-__ZN7WebCoreL15willRemoveChildEPNS_4NodeE
-__ZN7WebCore8Document17nodeWillBeRemovedEPNS_4NodeE
-__ZN7WebCore19SelectionController17nodeWillBeRemovedEPNS_4NodeE
-__ZN7WebCore13MutationEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringESA_SA_t
-__ZN7WebCore19AnimationController20beginAnimationUpdateEv
-__ZN7WebCore11RenderBlock22removePositionedObjectEPNS_9RenderBoxE
-__ZN7WebCore12RenderObject12removeLayersEPNS_11RenderLayerE
-__ZN7WebCore11RenderLayer11removeChildEPS0_
-__ZN7WebCore11RenderLayer28dirtyVisibleDescendantStatusEv
-__ZN7WebCore11RenderBlock37markAllDescendantsWithFloatsForLayoutEPNS_9RenderBoxEb
-__ZN7WebCore11RenderBlock20removeFloatingObjectEPNS_9RenderBoxE
-__ZN7WebCore14RenderListItem7destroyEv
-__ZN7WebCore14RenderListItemD1Ev
-__ZN7WebCore18RenderTextFragment7destroyEv
-__ZN7WebCore11ContentData5clearEv
+__ZNK7WebCore16HTMLInputElement17endTagRequirementEv
+__ZNK7WebCore16HTMLInputElement11tagPriorityEv
+__ZN7WebCore16HTMLInputElement6attachEv
+__ZNK7WebCore16HTMLInputElement17isInputTypeHiddenEv
+__ZN7WebCore31HTMLFormControlElementWithState21finishParsingChildrenEv
+__ZNK7WebCore8Document26hasStateForNewFormElementsEv
+__ZN7WebCore10HTMLParser22selectCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL17selectConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLSelectElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLSelectElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLSelectElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore28createAttributeEventListenerEPNS_4NodeEPNS_9AttributeE
+__ZN7WebCore19createJSHTMLWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEEENS_7PtrHashI
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEEENS_7PtrHash
+__ZN7WebCoreL30createHTMLSelectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLSelectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSHTMLElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSHTMLElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLSelectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSelectElementEEE
+__ZN7WebCore19JSHTMLSelectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSelectElementEEE
+__ZN7WebCore13JSHTMLElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11HTMLElementEEE
+__ZN7WebCore9JSElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ElementEEE
+__ZN7WebCore19cacheDOMNodeWrapperEPNS_8DocumentEPNS_4NodeEPNS_6JSNodeE
+__ZN3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN7WebCoreL18eventParameterNameEb
+__ZN7WebCore19JSLazyEventListenerC1ERKNS_6StringES3_S3_PNS_17JSDOMGlobalObjectEPNS_4NodeEi
+__ZN7WebCore19JSLazyEventListenerC2ERKNS_6StringES3_S3_PNS_17JSDOMGlobalObjectEPNS_4NodeEi
+__ZN7WebCore4Node25setAttributeEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore4Node27clearAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore4Node16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore4Node14ensureRareDataEv
+__ZN7WebCore7Element14createRareDataEv
+__ZN3WTF7HashMapIPKN7WebCore4NodeEPNS1_12NodeRareDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
+__ZN7WebCore4Node19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZNK7WebCore4Node8rareDataEv
+__ZNK3WTF7HashMapIPKN7WebCore4NodeEPNS1_12NodeRareDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore8Document42registerDisconnectedNodeWithEventListenersEPNS_4NodeE
+__ZN3WTF7HashSetIPN7WebCore4NodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZNK7WebCore17HTMLSelectElement11tagPriorityEv
+__ZN7WebCore8Document44unregisterDisconnectedNodeWithEventListenersEPNS_4NodeE
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ident
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalida
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore17HTMLSelectElement16insertedIntoTreeEb
+__ZNK7WebCore17HTMLSelectElement15recalcListItemsEb
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14shrinkCapacityEm
+__ZN7WebCore17HTMLSelectElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore17HTMLSelectElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore17HTMLSelectElement18setRecalcListItemsEv
+__ZN7WebCore8Document19scheduleStyleRecalcEv
+__ZN3WTF7HashSetIPN7WebCore8DocumentENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTable
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTab
+__ZN7WebCoreL17optionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLOptionElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLOptionElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17OptionElementDataC1EPNS_7ElementE
+__ZN7WebCore17OptionElementDataC2EPNS_7ElementE
+__ZN7WebCore17HTMLOptionElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore17HTMLOptionElement17endTagRequirementEv
+__ZNK7WebCore17HTMLOptionElement11tagPriorityEv
+__ZN7WebCore17HTMLOptionElement16insertedIntoTreeEb
+__ZNK7WebCore17HTMLOptionElement18ownerSelectElementEv
+__ZNK7WebCore17HTMLOptionElement8selectedEv
+__ZN7WebCore17HTMLSelectElement17scrollToSelectionEv
+__ZN7WebCore17HTMLOptionElement6attachEv
+__ZN7WebCore17HTMLOptionElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore17HTMLOptionElement15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore17HTMLOptionElement22nonRendererRenderStyleEv
+__ZNK7WebCore17HTMLOptionElement5indexEv
+__ZNK7WebCore4Node19traverseNextSiblingEPKS0_
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE15reserveCapacityEm
+__ZN7WebCore17HTMLOptionElement16setSelectedStateEb
+__ZN7WebCore13OptionElement16setSelectedStateERNS_17OptionElementDataEb
+__ZN7WebCore17HTMLSelectElement16setSelectedIndexEibb
+__ZNK7WebCore17HTMLSelectElement17optionToListIndexEi
+__ZN7WebCore17HTMLSelectElement29setActiveSelectionAnchorIndexEi
+__ZN3WTF6VectorIbLm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIbLm0EE14expandCapacityEmPKb
+__ZN3WTF6VectorIbLm0EE14expandCapacityEm
+__ZN3WTF6VectorIbLm0EE15reserveCapacityEm
+__ZN7WebCore17HTMLSelectElement13deselectItemsEPNS_17HTMLOptionElementE
+__ZNK7WebCore16HTMLInputElement32storesValueSeparateFromAttributeEv
+__ZN7WebCore12InputElement19updateValueIfNeededERNS_16InputElementDataE
+__ZThn128_NK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
+__ZNK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
+__ZN7WebCore12InputElement14constrainValueERKNS_16InputElementDataERKNS_6StringEi
+__ZThn128_NK7WebCore16HTMLInputElement11isTextFieldEv
+__ZNK7WebCore16HTMLInputElement11isTextFieldEv
+__ZN7WebCore12InputElement22notifyFormStateChangedERNS_16InputElementDataEPNS_8DocumentE
+__ZN7WebCore22HTMLFormControlElement34setFormControlValueMatchesRendererEb
+__ZN7WebCoreL13hrConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore13HTMLHRElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13HTMLHRElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore13HTMLHRElement17endTagRequirementEv
+__ZNK7WebCore13HTMLHRElement11tagPriorityEv
+__ZN7WebCore14CachedResource13makePurgeableEb
+__ZNK7WebCore9DocLoader11cachePolicyEv
+__ZNK7WebCore11FrameLoader11cachePolicyEv
+__ZNK7WebCore14CachedResource14mustRevalidateENS_11CachePolicyE
+__ZN3WTF6VectorItLm0EE4growEm
+__ZN3WTF6VectorItLm0EE6shrinkEm
+__ZN3WTF9HashTableIPN7WebCore20CachedResourceClientESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTra
+__ZNK7WebCore13HTMLBRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore13HTMLBRElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SegmentedString15advanceSlowCaseERi
+__ZNK7WebCore8Document15isMediaDocumentEv
+__ZN7WebCore11FrameLoader14didReceiveDataEPNS_14ResourceLoaderEPKcii
+__ZN7WebCore15ProgressTracker17incrementProgressEmPKci
+__ZNK7WebCore11FrameLoader27numPendingOrLoadingRequestsEb
+__ZNK7WebCore11FrameLoader15firstLayoutDoneEv
+__ZN7WebCore11FrameLoader31dispatchDidReceiveContentLengthEPNS_14DocumentLoaderEmi
+__ZN7WebCore19InspectorController23didReceiveContentLengthEPNS_14DocumentLoaderEmi
+-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]
+__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleEP19NSCachedURLResponse
+__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleERNS_18CacheStoragePolicyE
+-[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]
+__ZN7WebCore14ResourceLoader16didFinishLoadingEPNS_14ResourceHandleE
+__ZN7WebCore18MainResourceLoader16didFinishLoadingEv
+__ZN7WebCore11FrameLoader15finishedLoadingEv
+__ZN7WebCoreL24urlEscapedEntityCallbackEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE6shrinkEm
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22I
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInva
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore4Text11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore22HTMLFormControlElement11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore17HTMLSelectElement11recalcStyleENS_4Node11StyleChangeE
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE6shrinkEm
+__ZN7WebCore9TimerBase10heapPopMinEv
+__ZSt13__adjust_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE6shrinkEm
 __ZN7WebCore19AnimationController18endAnimationUpdateEv
 __ZN7WebCore26AnimationControllerPrivate14styleAvailableEv
-__ZN7WebCore13ContainerNode15removedFromTreeEb
-__ZN7WebCore16jsNodeFirstChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL30createHTMLAnchorElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLAnchorElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSHTMLAnchorElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAnchorElementEEE
-__ZN7WebCore19JSHTMLAnchorElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16jsElementTagNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11HTMLElement8nodeNameEv
-__ZNK7WebCore6String5upperEv
-__ZN7WebCore10StringImpl5upperEv
-__ZN7WebCore17HTMLAnchorElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore13ContainerNode12replaceChildEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
-__ZN7WebCore4Node17checkReplaceChildEPS0_S1_Ri
-__ZN7WebCore4Node15canReplaceChildEPS0_S1_
-__ZN7WebCore28JSHTMLAnchorElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLAnchorElement9classInfoEv
-__ZN7WebCore19JSHTMLAnchorElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore4Node15removedFromTreeEb
-__ZN7WebCore18JSHTMLImageElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLImageElement9classInfoEv
-__ZN7WebCore4Node10lazyAttachEv
-__ZN7WebCore4Node13canLazyAttachEv
-__ZN7WebCore25InvalidatingEventListener11handleEventEPNS_5EventEb
-__ZN7WebCore11XPathResult23invalidateIteratorStateEv
-__ZN7WebCore8Document44unregisterDisconnectedNodeWithEventListenersEPNS_4NodeE
-__ZNK7WebCore4Node15rareDataFocusedEv
-__ZN7WebCore20jsElementOffsetWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element11offsetWidthEv
-__ZN7WebCore8Document36updateLayoutIgnorePendingStylesheetsEv
-__ZNK7WebCore8RenderBR4isBREv
-__ZN7WebCore8RenderBR15createInlineBoxEbbb
-__ZNK7WebCore8RenderBR10lineHeightEbb
-__ZNK7WebCore8RenderBR16baselinePositionEbb
-__ZN7WebCore14RenderListItem6layoutEv
-__ZN7WebCore14RenderListItem20updateMarkerLocationEv
-__ZN7WebCore14RenderListItem18positionListMarkerEv
-__ZN7WebCore11RenderImage14calcPrefWidthsEv
-__ZN7WebCore12RenderObject26repaintAfterLayoutIfNeededERKNS_7IntRectES3_
-__ZNK7WebCore14RenderReplaced10lineHeightEbb
-__ZNK7WebCore14RenderReplaced16baselinePositionEbb
-__ZN7WebCore11RenderBlock19adjustFloatingBlockERKNS0_10MarginInfoE
-__ZN7WebCore10RenderText17trimmedPrefWidthsEiRiRbS1_S2_S2_S2_S1_S1_S1_S1_S2_
-__ZN7WebCore9RenderBox26repaintDuringLayoutIfMovedERKNS_7IntRectE
-__ZN7WebCore11RenderBlock24repaintOverhangingFloatsEb
-__ZN7WebCore11RenderBlock20hasOverhangingFloatsEv
-__ZN7WebCore21DeprecatedPtrListImpl5firstEv
-__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE15reserveCapacityEm
-__ZN7WebCore11RenderBlock18addIntrudingFloatsEPS0_ii
-__ZN3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_11RenderBlock14FloatingObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3addERKS3_RKS6_
-__ZN7WebCore21DeprecatedPtrListImpl4takeEv
-__ZN7WebCore21DeprecatedPtrListImpl6removeEb
-__ZN7WebCore11RenderBlock20determineEndPositionEPNS_13RootInlineBoxERNS_14InlineIteratorERNS_10BidiStatusERi
-__ZN7WebCore13InlineFlowBox10deleteLineEPNS_11RenderArenaE
-__ZN7WebCore13InlineTextBox10deleteLineEPNS_11RenderArenaE
-__ZN7WebCore10RenderText13removeTextBoxEPNS_13InlineTextBoxE
-__ZN7WebCore10RenderFlow13removeLineBoxEPNS_13InlineFlowBoxE
-__ZN7WebCore13RootInlineBox8Overflow7destroyEPNS_11RenderArenaE
-__ZN7WebCore13RootInlineBox8OverflowdlEPvm
-__ZNK7WebCore12RenderObject29mustRepaintBackgroundOrBorderEv
-__ZN7WebCore11RenderBlock14fitBelowFloatsEiRi
-__ZNK7WebCore11RenderBlock20nextFloatBottomBelowEi
-__ZNK7WebCore9InlineBox16nextOnLineExistsEv
-__ZN7WebCore13InlineFlowBox10onEndChainEPNS_12RenderObjectE
-__ZN7WebCore9RenderBox20calcPercentageHeightERKNS_6LengthE
-__ZN7WebCoreL8bidiNextEPNS_11RenderBlockEPNS_12RenderObjectEPNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEbPb
-__ZN7WebCore11RenderBlock19calcBlockPrefWidthsEv
-__ZN7WebCoreL11getBPMWidthEiNS_6LengthE
-__ZN7WebCoreL21mustRepaintFillLayersEPKNS_12RenderObjectEPKNS_9FillLayerE
-__ZNK7WebCore9RenderBox15availableHeightEv
-__ZNK7WebCore9RenderBox20availableHeightUsingERKNS_6LengthE
-__ZN7WebCore9InlineBox14dirtyLineBoxesEv
-__ZN7WebCore9InlineBox10deleteLineEPNS_11RenderArenaE
-__ZN7WebCore9RenderBox19setInlineBoxWrapperEPNS_9InlineBoxE
-__ZNK7WebCore12RenderInline16linesBoundingBoxEv
-__ZN7WebCore12RenderInline29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZNK7WebCore12RenderInline17borderBoundingBoxEv
-__ZNK7WebCore12RenderObject21containingBlockHeightEv
-__ZNK7WebCore9RenderBox11offsetWidthEv
-__ZN7WebCoreL21adjustForAbsoluteZoomEiPNS_12RenderObjectE
-__ZN7WebCore21JSCSSStyleDeclaration18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSCSSStyleDeclaration18canGetItemsForNameEPN3JSC9ExecStateEPNS_19CSSStyleDeclarationERKNS1_10IdentifierE
-__ZN7WebCore21JSCSSStyleDeclaration10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore19CSSStyleDeclaration19getPropertyCSSValueERKNS_6StringE
-__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyCSSValueEi
-__ZN7WebCore19CSSStyleDeclaration16getPropertyValueERKNS_6StringE
-__ZNK7WebCore26CSSMutableStyleDeclaration16getPropertyValueEi
-__ZN7WebCore44jsDOMWindowPrototypeFunctionGetComputedStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9toElementEN3JSC10JSValuePtrE
-__ZNK7WebCore9DOMWindow16getComputedStyleEPNS_7ElementERKNS_6StringE
-__ZN7WebCore27CSSComputedStyleDeclarationC1EN3WTF10PassRefPtrINS_4NodeEEE
-__ZNK7WebCore27CSSComputedStyleDeclaration19getPropertyCSSValueEi
-__ZNK7WebCore27CSSComputedStyleDeclaration19getPropertyCSSValueEiNS_13EUpdateLayoutE
-__ZN7WebCore7Element13computedStyleEv
-__ZN7WebCore21jsElementOffsetHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element12offsetHeightEv
-__ZNK7WebCore9RenderBox12offsetHeightEv
-__ZN7WebCore5XPathL18createFunLocalNameEv
-__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEiNS0_8EqTestOp6OpcodeEi
-__ZN7WebCore5XPath8EqTestOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
-__ZN7WebCore5XPath9LogicalOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
-__ZNK7WebCore5XPath9LogicalOp8evaluateEv
-__ZNK7WebCore5XPath8EqTestOp8evaluateEv
-__ZNK7WebCore5XPath12FunLocalName8evaluateEv
-__ZNK7WebCore5XPath8EqTestOp7compareERKNS0_5ValueES4_
-__ZNK7WebCore5XPath9LogicalOp14shortCircuitOnEv
-__ZN7WebCore5XPath12FunLocalNameD1Ev
-__ZN7WebCore23jsHTMLAnchorElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement4hrefEv
-__ZN7WebCore21jsHTMLImageElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement3altEv
-__ZN7WebCore21setJSHTMLElementTitleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11HTMLElement8setTitleERKNS_6StringE
-__ZN7WebCore22jsHTMLElementInnerHTMLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11HTMLElement9innerHTMLEv
-__ZN7WebCore12createMarkupEPKNS_4NodeENS_13EChildrenOnlyEPN3WTF6VectorIPS0_Lm0EEE
-__ZN7WebCore22DeleteButtonController7disableEv
-__ZN7WebCore22DeleteButtonController4hideEv
-__ZN7WebCoreL12appendMarkupERN3WTF6VectorItLm0EEEPNS_4NodeEbPNS1_IS5_Lm0EEEPKNS0_7HashMapIPNS_16AtomicStringImplESA_NS0_7PtrHashISA_EENS0_10HashTraitsISA_EESE_EE
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_S3_ENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EESC_EESC_EaSERKSE_
-__ZN7WebCoreL17appendStartMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPNS0_7HashMapIPNS_16AtomicStringImplESD_NS0_7PtrHashISD_EENS0_10HashTraitsISD_EESH_EE
-__ZN7WebCoreL20appendEscapedContentERN3WTF6VectorItLm0EEESt4pairIPKtmEb
-__ZN7WebCoreL15appendEndMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeE
-__ZN7WebCore22DeleteButtonController6enableEv
-__ZN7WebCoreL25enclosingDeletableElementERKNS_9SelectionE
-__ZN7WebCore22DeleteButtonController4showEPNS_11HTMLElementE
-__ZN7WebCore14jsLocationHashEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Location4hashEv
-__ZNK7WebCore4KURL3refEv
-__ZSt17__merge_sort_loopIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
-__ZSt5mergeIPPN7WebCore11RenderLayerES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
-__ZN7WebCore11ImageSource20frameDurationAtIndexEm
-__ZNK7WebCore13RootInlineBox5blockEv
-__ZN7WebCore12RenderInline5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCoreL9nullImageEv
-__ZN7WebCore14RenderListItem5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore9InlineBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore27RenderTextControlSingleLine5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore11RenderTheme5paintEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore15GraphicsContext20updatingControlTintsEv
-__ZN7WebCore14RenderThemeMac16paintSearchFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac6searchEv
-__ZN7WebCore27LocalCurrentGraphicsContextC1EPNS_15GraphicsContextE
-__ZN7WebCore14RenderThemeMac18setSearchCellStateEPNS_12RenderObjectERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac18updateEnabledStateEP6NSCellPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme9isEnabledEPKNS_12RenderObjectE
-__ZN7WebCore14RenderThemeMac18updateFocusedStateEP6NSCellPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme9isFocusedEPKNS_12RenderObjectE
-__ZN7WebCore27LocalCurrentGraphicsContextD1Ev
-__ZNK7WebCore17RenderTextControl15controlClipRectEii
-__ZN7WebCore14RenderThemeMac26paintSearchFieldDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14ResourceLoader15willSendRequestEPNS_14ResourceHandleERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore27protocolHostAndPortAreEqualERKNS_4KURLES2_
-__ZN7WebCore23SubresourceLoaderClient15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore38jsDocumentPrototypeFunctionCreateEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document11createEventERKNS_6StringERi
-__ZN7WebCore5EventC1Ev
-__ZN7WebCore7JSEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCoreL15getJSEventTableEPN3JSC9ExecStateE
-__ZN7WebCore25getHashTableForGlobalDataERN3JSC12JSGlobalDataEPKNS0_9HashTableE
-__ZN7WebCore21DOMObjectHashTableMap6mapForERN3JSC12JSGlobalDataE
-__ZN3WTF9HashTableIPKN3JSC9HashTableESt4pairIS4_S2_ENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSC_IS2_EEEESD_E4findIS4_NS_22IdentityHashTranslatorIS4_S6_SA_EEEENS_17HashTableIteratorIS4_S6_S8_SA_SF_SD_EERKT_
-__ZN3WTF7HashMapIPKN3JSC9HashTableES2_NS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IS2_EEE3setERKS4_RS3_
-__ZN3WTF9HashTableIPKN3JSC9HashTableESt4pairIS4_S2_ENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSC_IS2_EEEESD_E6expandEv
-__ZN7WebCore16JSEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCoreL24getJSEventPrototypeTableEPN3JSC9ExecStateE
-__ZN7WebCore33jsEventPrototypeFunctionInitEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore7JSEvent9classInfoEv
-__ZN7WebCore5Event9initEventERKNS_12AtomicStringEbb
-__ZN7WebCore7JSEvent3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore47jsEventTargetNodePrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7toEventEN3JSC10JSValuePtrE
-__ZN7WebCore12RenderObject12imageChangedEPvPKNS_7IntRectE
-__ZZN7WebCore5Image11drawPatternEPNS_15GraphicsContextERKNS_9FloatRectERKNS_20TransformationMatrixERKNS_10FloatPointENS_17CompositeOperatorES5_E16patternCallbacks
-__ZN7WebCore11BitmapImage26nativeImageForCurrentFrameEv
-__ZNK7WebCore20TransformationMatrix12isInvertibleEv
-__ZNK7WebCore20TransformationMatrix3detEv
-__ZNK7WebCore20TransformationMatrix1dEv
-__ZNK7WebCore20TransformationMatrix1aEv
--[DOMDocument forms]
-__ZN7WebCore8Document5formsEv
-+[DOMHTMLCollection(WebCoreInternal) _wrapHTMLCollection:]
--[DOMHTMLCollection(WebCoreInternal) _initWithHTMLCollection:]
--[DOMHTMLCollection length]
-__ZNK7WebCore14HTMLCollection6lengthEv
-__ZNK7WebCore14HTMLCollection10calcLengthEv
-__ZNK7WebCore14HTMLCollection9itemAfterEPNS_7ElementE
-__ZN7WebCoreL17nextNodeOrSiblingEPNS_4NodeES1_b
--[DOMHTMLCollection item:]
-__ZNK7WebCore14HTMLCollection4itemEj
-__ZN7WebCoreL12elementClassERKNS_13QualifiedNameEP10objc_class
-__ZN7WebCoreL15addElementClassERKNS_13QualifiedNameEP10objc_class
-__ZN3WTF9HashTableIPKN7WebCore13QualifiedName17QualifiedNameImplESt4pairIS5_P10objc_classENS_18PairFirstExtractorIS9_EENS_7PtrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSF_IS8_EEEESG_E6expandEv
-__ZN3WTF9HashTableIPKN7WebCore13QualifiedName17QualifiedNameImplESt4pairIS5_P10objc_classENS_18PairFirstExtractorIS9_EENS_7PtrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSF_IS8_EEEESG_E4findIS5_NS_22IdentityHashTranslatorIS5_S9_SD_EEEENS_17HashTableIteratorIS5_S9_SB_SD_SI_SG_EERKT_
-__ZN7WebCoreL18lookupElementClassERKNS_13QualifiedNameE
-__ZN3WTF7HashMapIPKN7WebCore13QualifiedName17QualifiedNameImplEP10objc_classNS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3setERKS5_RKS7_
--[DOMHTMLFormElement elements]
-__ZNK7WebCore18HTMLFormCollection10calcLengthEv
-__ZNK7WebCore15HTMLFormElement6lengthEv
-__ZNK7WebCore16HTMLInputElement14isEnumeratableEv
-__ZNK7WebCore18HTMLFormCollection4itemEj
--[DOMHTMLInputElement(FormAutoFillTransition) _isTextField]
--[DOMHTMLInputElement type]
-__ZNK7WebCore16HTMLInputElement4typeEv
-__ZN7WebCore14PreloadScannerD1Ev
-__ZN7WebCore41jsDocumentPrototypeFunctionGetElementByIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore25setJSHTMLElementClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11HTMLElement12setClassNameERKNS_6StringE
-__ZN7WebCore12RenderObject16setStyleInternalEN3WTF10PassRefPtrINS_11RenderStyleEEE
-__ZN7WebCoreL21findBeforeAfterParentEPNS_12RenderObjectE
-__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14shrinkCapacityEm
-__ZN7WebCoreL26createHTMLLIElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore15JSHTMLLIElement15createPrototypeEPN3JSC9ExecStateE
-__ZN3WTF9HashTableIPKN3JSC9ClassInfoESt4pairIS4_NS_6RefPtrINS1_9StructureEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSF_IS8_EEEESG_E4findIS4_NS_22IdentityHashTranslatorIS4_S9_SD_EEEENS_17HashTableIteratorIS4_S9_SB_SD_SI_SG_EERKT_
-__ZN7WebCore15JSHTMLLIElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLLIElementEEE
-__ZN7WebCore15JSHTMLLIElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15JSHTMLLIElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZNK7WebCore15JSHTMLLIElement9classInfoEv
-__ZN7WebCore38jsElementPrototypeFunctionSetAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore18JSHTMLInputElement9classInfoEv
-__ZN7WebCore9JSElement12setAttributeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore7Element12setAttributeERKNS_12AtomicStringES3_Ri
+__ZN7WebCore26AnimationControllerPrivate24beginAnimationUpdateTimeEv
+__ZN7WebCore26AnimationControllerPrivate17startTimeResponseEd
+__ZN7WebCore9FrameView16restoreScrollbarEv
+__ZN7WebCore11FrameLoader10gotoAnchorEv
+__ZN7WebCore14ResourceLoader12resourceDataEv
+__ZN7WebCore14DocumentLoader13updateLoadingEv
+__ZNK7WebCore11FrameLoader9isLoadingEv
+__ZNK7WebCore14DocumentLoader21isLoadingSubresourcesEv
+__ZN7WebCore14ResourceLoader16didFinishLoadingEv
+__ZN7WebCore14ResourceLoader23didFinishLoadingOnePartEv
+__ZN7WebCore11FrameLoader13didFinishLoadEPNS_14ResourceLoaderE
+__ZN7WebCore15ProgressTracker16completeProgressEm
+__ZN7WebCore11FrameLoader24dispatchDidFinishLoadingEPNS_14DocumentLoaderEm
+__ZN7WebCore19InspectorController16didFinishLoadingEPNS_14DocumentLoaderEm
+__ZN7WebCore14ResourceLoader16releaseResourcesEv
+__ZN7WebCore14ResourceHandle9setClientEPNS_20ResourceHandleClientE
+__ZN7WebCore14ResourceHandleD1Ev
+__ZN7WebCore14ResourceHandleD2Ev
+__ZN7WebCore14ResourceHandle15releaseDelegateEv
+-[WebCoreResourceHandleAsDelegate detachHandle]
+__ZN7WebCore22ResourceHandleInternalD1Ev
+__ZN7WebCore22ResourceHandleInternalD2Ev
+__ZN7WebCore27AuthenticationChallengeBaseD2Ev
+__ZN7WebCore19ResourceRequestBaseD2Ev
+__ZN7WebCore18MainResourceLoaderD0Ev
+__ZN7WebCore16RunLoopTimerBaseD2Ev
+__ZN7WebCore16RunLoopTimerBase4stopEv
+__ZN7WebCore14ResourceLoaderD2Ev
+__ZN7WebCore12ThreadTimers16sharedTimerFiredEv
+__ZN7WebCore12ThreadTimers24sharedTimerFiredInternalEv
+__ZN7WebCore12ThreadTimers19collectFiringTimersEdRN3WTF6VectorIPNS_9TimerBaseELm0EEE
+__ZN3WTF7HashSetIPKN7WebCore9TimerBaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandEv
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashEi
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13allocateTab
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deallocateT
+__ZN7WebCore9TimerBase13heapDeleteMinEv
+__ZN7WebCore12ThreadTimers10fireTimersEdRKN3WTF6VectorIPNS_9TimerBaseELm0EEE
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47removeAndIn
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6removeEPS4_
+__ZN7WebCore5TimerINS_6LoaderEE5firedEv
+__ZN7WebCore6Loader17requestTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore6Loader20servePendingRequestsENS0_8PriorityE
+__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE6shrinkEm
+__ZN7WebCore5TimerINS_5FrameEE5firedEv
+__ZN7WebCore5Frame21lifeSupportTimerFiredEPNS_5TimerIS0_EE
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E5clearEv
+__ZN7WebCore17SubresourceLoader26shouldUseCredentialStorageEv
+__ZN7WebCore23SubresourceLoaderClient29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZN7WebCore17SubresourceLoader18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore6Loader4Host18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore17SubresourceLoaderEEEPNS2_7RequestENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3get
+__ZN7WebCore14CachedResource11setResponseERKNS_16ResourceResponseE
+__ZNK7WebCore20ResourceResponseBase14expirationDateEv
+__ZNK7WebCore20ResourceResponseBase16textEncodingNameEv
+__ZN7WebCore17SubresourceLoader14didReceiveDataEPKcixb
+__ZN7WebCore6Loader4Host14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZN7WebCore17SubresourceLoader16didFinishLoadingEv
+__ZN7WebCore6Loader4Host16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZN7WebCore9DocLoader21decrementRequestCountEv
+__ZN7WebCore9DocLoader17setLoadInProgressEb
+__ZN7WebCore19CachedCSSStyleSheet4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore14CachedResource14setEncodedSizeEj
+__ZN7WebCore19TextResourceDecoder18checkForCSSCharsetEPKcmRb
+__ZN7WebCore19CachedCSSStyleSheet11checkNotifyEv
+__ZN7WebCore26CachedResourceClientWalkerC1ERKN3WTF14HashCountedSetIPNS_20CachedResourceClientENS1_7PtrHashIS4_EENS1_10HashTrait
+__ZN7WebCore26CachedResourceClientWalkerC2ERKN3WTF14HashCountedSetIPNS_20CachedResourceClientENS1_7PtrHashIS4_EENS1_10HashTrait
+__ZN7WebCore26CachedResourceClientWalker4nextEv
+__ZNK3WTF9HashTableIPN7WebCore20CachedResourceClientESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTr
+__ZThn24_N7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore13CSSStyleSheetC1EPNS_7CSSRuleERKNS_6StringES5_
+__ZN7WebCore13CSSStyleSheetC2EPNS_7CSSRuleERKNS_6StringES5_
+__ZN7WebCore10StyleSheetC2EPNS_9StyleBaseERKNS_6StringE
+__ZNK7WebCore19CachedCSSStyleSheet9sheetTextEb
+__ZNK7WebCore19CachedCSSStyleSheet11canUseSheetEb
+__ZN7WebCore28extractMIMETypeFromMediaTypeERKNS_6StringE
+__ZN3WTF6VectorItLm64EE15reserveCapacityEm
+__ZN3WTF6VectorItLm64EE6shrinkEm
+__ZN7WebCore9CSSParser9parseFontEb
+__ZNK7WebCore13CSSStyleSheet11completeURLERKNS_6StringE
+__ZNK7WebCore9StyleBase7baseURLEv
+__ZNK7WebCore4KURL14isHierarchicalEv
+__ZN7WebCoreL20copyPathRemovingDotsEPcPKcii
+__ZN7WebCore13CSSImageValueC1ERKNS_6StringE
+__ZN7WebCore13CSSImageValueC2ERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE6shrinkEm
+__ZN7WebCore11RenderBlock24updateBeforeAfterContentENS_8PseudoIdE
+__ZN7WebCore21RenderObjectChildList24updateBeforeAfterContentEPNS_12RenderObjectENS_8PseudoIdES2_
+__ZNK7WebCore12RenderObject20getCachedPseudoStyleENS_8PseudoIdEPNS_11RenderStyleE
+__ZN7WebCoreL20beforeAfterContainerEPNS_12RenderObjectENS_8PseudoIdE
+__ZNK7WebCore12RenderObject12isListMarkerEv
+__ZNK7WebCore12RenderObject23createsAnonymousWrapperEv
+__ZNK7WebCore8CSSValue16isPrimitiveValueEv
+__ZNK7WebCore8CSSValue12cssValueTypeEv
+__ZNK7WebCore9FontValue11isFontValueEv
+__ZN7WebCore17CSSPrimitiveValue8getIdentEv
+__ZN7WebCore11RenderStyle18setFontDescriptionERKNS_15FontDescriptionE
+__ZNK7WebCore12CSSValueList12cssValueTypeEv
+__ZNK7WebCore12CSSValueList11isValueListEv
+__ZN7WebCore16CSSStyleSelector26getColorFromPrimitiveValueEPNS_17CSSPrimitiveValueE
+__ZN7WebCoreL16colorForCSSValueEi
+__ZN7WebCore16CSSStyleSelector10updateFontEv
+__ZN7WebCore16CSSStyleSelector22checkForTextSizeAdjustEv
+__ZN7WebCore16CSSStyleSelector27checkForGenericFamilyChangeEPNS_11RenderStyleES2_
+__ZN7WebCore16CSSStyleSelector18checkForZoomChangeEPNS_11RenderStyleES2_
+__ZN7WebCore17CSSPrimitiveValue12isQuirkValueEv
+__ZN7WebCore17CSSPrimitiveValue25computeLengthIntForLengthEPNS_11RenderStyleEd
+__ZN7WebCore17CSSPrimitiveValue19computeLengthDoubleEPNS_11RenderStyleEdb
+__ZN7WebCore7DataRefINS_17StyleSurroundDataEE6accessEv
+__ZN7WebCore17StyleSurroundDataC1ERKS0_
+__ZN7WebCore17StyleSurroundDataC2ERKS0_
+__ZN7WebCore7DataRefINS_19StyleBackgroundDataEE6accessEv
+__ZN7WebCore19StyleBackgroundDataC1ERKS0_
+__ZN7WebCore19StyleBackgroundDataC2ERKS0_
+__ZN7WebCore9FillLayerC1ERKS0_
+__ZN7WebCore9FillLayerC2ERKS0_
+__ZNK7WebCore8CSSValue11isValueListEv
+__ZN7WebCore16CSSStyleSelector12mapFillImageEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector10styleImageEPNS_8CSSValueE
+__ZNK7WebCore13CSSImageValue12isImageValueEv
+__ZN7WebCore13CSSImageValue11cachedImageEPNS_9DocLoaderE
+__ZNK7WebCore17CSSPrimitiveValue14getStringValueEv
+__ZN7WebCore13CSSImageValue11cachedImageEPNS_9DocLoaderERKNS_6StringE
+__ZN7WebCore16CSSStyleSelector13mapFillRepeatEPNS_9FillLayerEPNS_8CSSValueE
+__ZNK7WebCore15CSSInitialValue12cssValueTypeEv
+__ZN7WebCore16CSSStyleSelector16mapFillXPositionEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector16mapFillYPositionEPNS_9FillLayerEPNS_8CSSValueE
 __ZN7WebCore16HTMLInputElement6detachEv
-__ZN7WebCore14RenderThemeMac17adjustRepaintRectEPKNS_12RenderObjectERNS_7IntRectE
-__ZN7WebCore9InlineBox6removeEv
-__ZN7WebCore13InlineFlowBox11removeChildEPNS_9InlineBoxE
-__ZN7WebCore13RootInlineBox12childRemovedEPNS_9InlineBoxE
-__ZN7WebCore27RenderTextControlInnerBlockD1Ev
-__ZN7WebCore7Element19removedFromDocumentEv
-__ZN7WebCore13ContainerNode19removedFromDocumentEv
-__ZN7WebCore15EventTargetNode19removedFromDocumentEv
-__ZN7WebCore4Node19removedFromDocumentEv
-__ZN7WebCore31SearchFieldResultsButtonElementD1Ev
-__ZN7WebCore30SearchFieldCancelButtonElementD1Ev
-__ZN7WebCore27TextControlInnerTextElementD1Ev
-__ZNK7WebCore14RenderThemeMac39adjustSearchFieldResultsDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZThn32_N7WebCore16HTMLInputElement23preDispatchEventHandlerEPNS_5EventE
-__ZN7WebCore16HTMLInputElement23preDispatchEventHandlerEPNS_5EventE
-__ZN7WebCore15HTMLFormElement17handleLocalEventsEPNS_5EventEb
-__ZThn32_N7WebCore16HTMLInputElement24postDispatchEventHandlerEPNS_5EventEPv
-__ZN7WebCore16HTMLInputElement24postDispatchEventHandlerEPNS_5EventEPv
-__ZN7WebCore16HTMLInputElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore5Event25isBeforeTextInsertedEventEv
-__ZNK7WebCore5Event12isMouseEventEv
-__ZNK7WebCore5Event11isDragEventEv
-__ZNK7WebCore5Event12isWheelEventEv
-__ZN7WebCore16HTMLLabelElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore22HTMLFormControlElement11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore22StyleRareInheritedDataeqERKS0_
-__ZNK7WebCore22StyleRareInheritedData20shadowDataEquivalentERKS0_
-__ZN7WebCore12InputElement27updatePlaceholderVisibilityERNS_16InputElementDataEPNS_8DocumentEb
-__ZThn72_NK7WebCore16HTMLInputElement16placeholderValueEv
-__ZNK7WebCore16HTMLInputElement16placeholderValueEv
-__ZN7WebCore27RenderTextControlSingleLine27updatePlaceholderVisibilityEv
-__ZN7WebCore23TextControlInnerElement16shadowParentNodeEv
-__ZN7WebCoreL23replaceChildrenWithTextEPNS_11HTMLElementERKNS_6StringERi
-__ZN7WebCore27TextControlInnerTextElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore13CharacterData7setDataERKNS_6StringERi
-__ZN7WebCore18JSHTMLInputElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore26setJSEventTargetNodeOnblurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode9setOnblurEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS_6VectorIPNS1_7ElementELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS8_EEE3getERKS3_
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE15reserveCapacityEm
-__ZN7WebCore26JSHTMLFormElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSHTMLFormElement9classInfoEv
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE6shrinkEm
-__ZN7WebCore16jsNodeParentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsNodePrototypeFunctionRemoveChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore6JSNode11removeChildEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore8Document17removeElementByIdERKNS_12AtomicStringEPNS_7ElementE
-__ZN7WebCore22HTMLFormControlElement15removedFromTreeEb
-__ZN7WebCore15HTMLFormElement17removeFormElementEPNS_22HTMLFormControlElementE
-__ZN7WebCore26setJSHTMLImageElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement8setWidthEi
-__ZN7WebCore27setJSHTMLImageElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement9setHeightEi
-__ZN7WebCore27setJSHTMLImageElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement9setBorderERKNS_6StringE
-__ZN7WebCore24setJSHTMLImageElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement6setAltERKNS_6StringE
-__ZN7WebCore18setJSHTMLElementIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11HTMLElement5setIdERKNS_6StringE
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IiEEEESC_E4findIS3_NS_22IdentityHashTranslatorIS3_S5_S9_EEEENS_17HashTableIteratorIS3_S5_S7_S9_SE_SC_EERKT_
-__ZN7WebCore17JSHTMLFormElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore28setJSEventTargetNodeOnsubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode11setOnsubmitEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore29setJSEventTargetNodeOnkeydownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode12setOnkeydownEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore27setJSEventTargetNodeOnkeyupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode10setOnkeyupEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore15jsDocumentLinksEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore8Document5linksEv
-__ZN7WebCore16JSHTMLCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSHTMLCollectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22jsHTMLCollectionLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSHTMLCollection18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZN7WebCore16JSHTMLCollection11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore24jsEventTargetNodeOnclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode7onclickEv
-__ZNK7WebCore15EventTargetNode26inlineEventListenerForTypeERKNS_12AtomicStringE
-__ZN7WebCore15EventTargetNode41setInlineEventListenerForTypeAndAttributeERKNS_12AtomicStringEPNS_9AttributeE
-__ZN7WebCore27setJSEventTargetNodeOnclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode10setOnclickEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore5Event20storesResultAsStringEv
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_PNS1_11RenderBlock14FloatingObjectEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SC_EEEENS_17HashTableIteratorIS3_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore14RenderThemeMac33paintSearchFieldResultsDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac21convertToPaintingRectEPKNS_12RenderObjectES3_RKNS_9FloatRectERKNS_7IntRectE
-__ZNK7WebCore9FloatRectcv7_NSRectEv
-__ZN7WebCore10IconLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
-__ZN7WebCore10IconLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
-__ZN7WebCore10IconLoader16didFinishLoadingEPNS_17SubresourceLoaderE
-__ZNK7WebCore12SharedBuffer4copyEv
--[DOMNodeList item:]
--[DOMNode attributes]
-__ZNK7WebCore7Element10attributesEv
-+[DOMNamedNodeMap(WebCoreInternal) _wrapNamedNodeMap:]
--[DOMNamedNodeMap(WebCoreInternal) _initWithNamedNodeMap:]
--[DOMNamedNodeMap getNamedItem:]
-__ZNK7WebCore12NamedAttrMap12getNamedItemERKNS_6StringE
--[DOMNode nodeValue]
-__ZNK7WebCore11HistoryItem20getTransientPropertyERKNS_6StringE
-__ZN7WebCore13InlineFlowBox15paintFillLayersERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOperatorE
-__ZN7WebCore13InlineFlowBox14paintFillLayerERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOperatorE
-__ZN7WebCore15GraphicsContext9setShadowERKNS_7IntSizeEiRKNS_5ColorE
-__ZN7WebCore15GraphicsContext17setPlatformShadowERKNS_7IntSizeEiRKNS_5ColorE
-__ZNK7WebCore7IntSizecv6CGSizeEv
-__ZN7WebCore7cgColorERKNS_5ColorE
-__ZN7WebCore7nsColorERKNS_5ColorE
-__ZN7WebCoreL18CGColorFromNSColorEP7NSColor
-__ZN7WebCore15GraphicsContext11clearShadowEv
-__ZN7WebCore15GraphicsContext19clearPlatformShadowEv
-__ZNK7WebCore14RenderThemeMac20controlSupportsTintsEPKNS_12RenderObjectE
-__ZNK7WebCore4Node9isEnabledEv
-__ZN7WebCore19SelectionController21pageActivationChangedEv
-__ZN7WebCore5Frame20setSelectionFromNoneEv
-__ZN7WebCore5Frame22clearCaretRectIfNeededEv
-__ZNK7WebCore5Frame10isFrameSetEv
--[DOMDocument documentElement]
-+[DOMElement(WebCoreInternal) _wrapElement:]
--[DOMDocument createRange]
-__ZN7WebCore8Document11createRangeEv
-__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEE
-__ZN7WebCore8Document11attachRangeEPNS_5RangeE
-__ZN3WTF7HashSetIPN7WebCore5RangeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-+[DOMRange(WebCoreInternal) _wrapRange:]
--[DOMRange(WebCoreInternal) _initWithRange:]
--[DOMRange selectNode:]
--[DOMNode(WebCoreInternal) _node]
-__ZN7WebCore5Range10selectNodeEPNS_4NodeERi
-__ZN7WebCore5Range14setStartBeforeEPNS_4NodeERi
-__ZNK7WebCore5Range11checkNodeBAEPNS_4NodeERi
-__ZNK7WebCore4Node9nodeIndexEv
-__ZN7WebCore5Range8setStartEN3WTF10PassRefPtrINS_4NodeEEEiRi
-__ZNK7WebCore5Range16checkNodeWOffsetEPNS_4NodeEiRi
-__ZNK7WebCore13ContainerNode9childNodeEj
-__ZN7WebCore5Range21compareBoundaryPointsEPNS_4NodeEiS2_i
-__ZN7WebCore5Range8collapseEbRi
-__ZN7WebCore5Range11setEndAfterEPNS_4NodeERi
-__ZN7WebCore5Range6setEndEN3WTF10PassRefPtrINS_4NodeEEEiRi
--[DOMRange(WebCoreInternal) _range]
-__ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERjb
-__ZN7WebCore12TextIteratorC1EPKNS_5RangeEbb
-__ZNK7WebCore5Range9firstNodeEv
-__ZNK7WebCore4Node18offsetInCharactersEv
-__ZNK7WebCore5Range12pastLastNodeEv
-__ZNK7WebCore4Node19traverseNextSiblingEPKS0_
-__ZN7WebCore12TextIterator7advanceEv
-__ZNK7WebCore12RenderObject8isWidgetEv
-__ZN7WebCore12TextIterator17handleNonTextNodeEv
-__ZN7WebCoreL24shouldEmitNewlineForNodeEPNS_4NodeE
-__ZN7WebCore12TextIterator23representNodeOffsetZeroEv
-__ZN7WebCoreL23shouldEmitTabBeforeNodeEPNS_4NodeE
-__ZN7WebCore11isTableCellEPKNS_4NodeE
-__ZN7WebCoreL27shouldEmitNewlineBeforeNodeEPNS_4NodeE
-__ZN7WebCoreL36shouldEmitNewlinesBeforeAndAfterNodeEPNS_4NodeE
-__ZN7WebCore12TextIterator29shouldRepresentNodeOffsetZeroEv
-__ZN7WebCore15VisiblePositionC1EPNS_4NodeEiNS_9EAffinityE
-__ZN7WebCore15VisiblePosition4initERKNS_8PositionENS_9EAffinityE
-__ZN7WebCore15VisiblePosition17canonicalPositionERKNS_8PositionE
-__ZNK7WebCore8Position8upstreamEv
-__ZN7WebCoreL23enclosingVisualBoundaryEPNS_4NodeE
-__ZN7WebCoreL38endsOfNodeAreVisuallyDistinctPositionsEPNS_4NodeE
-__ZNK7WebCore16PositionIterator7atStartEv
-__ZN7WebCoreL10isStreamerERKNS_16PositionIteratorE
-__ZN7WebCore12isAtomicNodeEPKNS_4NodeE
-__ZN7WebCore21editingIgnoresContentEPKNS_4NodeE
-__ZN7WebCore25canHaveChildrenForEditingEPKNS_4NodeE
-__ZNK7WebCore16PositionIterator13atStartOfNodeEv
-__ZN7WebCore14isTableElementEPNS_4NodeE
-__ZN7WebCore16PositionIterator9decrementEv
-__ZN7WebCore13maxDeepOffsetEPKNS_4NodeE
-__ZNK7WebCore16PositionIteratorcvNS_8PositionEEv
-__ZNK7WebCore8Position11isCandidateEv
-__ZN7WebCore8Position44hasRenderedNonAnonymousDescendantsWithHeightEPNS_12RenderObjectE
-__ZNK7WebCore12RenderObject27nextInPreOrderAfterChildrenEv
-__ZNK7WebCore8Position10downstreamEv
-__ZNK7WebCore16PositionIterator5atEndEv
-__ZN7WebCore16PositionIterator9incrementEv
-__ZN7WebCore13nextCandidateERKNS_8PositionE
-__ZNK7WebCore16PositionIterator11isCandidateEv
-__ZNK7WebCore13CharacterData18offsetInCharactersEv
-__ZNK7WebCore13CharacterData18maxCharacterOffsetEv
-__ZN7WebCore8Position19uncheckedNextOffsetEPKNS_4NodeEi
-__ZNK7WebCore12RenderObject14nextInPreOrderEv
-__ZNK7WebCore10RenderText16linesBoundingBoxEv
-__ZNK7WebCore8Position14inRenderedTextEv
-__ZNK7WebCore13InlineTextBox19containsCaretOffsetEi
-__ZN7WebCore8Position20nodeIsUserSelectNoneEPNS_4NodeE
-__ZN7WebCoreL21canonicalizeCandidateERKNS_8PositionE
-__ZN7WebCore17previousCandidateERKNS_8PositionE
-__ZN7WebCore23editableRootForPositionERKNS_8PositionE
-__ZNK7WebCore16PositionIterator11atEndOfNodeEv
-__ZN7WebCore10inSameLineERKNS_15VisiblePositionES2_
-__ZN7WebCore11startOfLineERKNS_15VisiblePositionE
-__ZN7WebCoreL20startPositionForLineERKNS_15VisiblePositionE
-__ZN7WebCoreL14rootBoxForLineERKNS_15VisiblePositionE
-__ZNK7WebCore8Position21getInlineBoxAndOffsetENS_9EAffinityERPNS_9InlineBoxERi
-__ZNK7WebCore8Position21getInlineBoxAndOffsetENS_9EAffinityENS_13TextDirectionERPNS_9InlineBoxERi
-__ZNK7WebCore13InlineTextBox14caretMinOffsetEv
-__ZNK7WebCore13InlineTextBox14caretMaxOffsetEv
-__ZN7WebCore9InlineBox13prevLeafChildEv
-__ZN7WebCore13InlineFlowBox22lastLeafChildBeforeBoxEPNS_9InlineBoxE
-__ZN7WebCore13InlineFlowBox14firstLeafChildEv
-__ZN7WebCore13InlineFlowBox22firstLeafChildAfterBoxEPNS_9InlineBoxE
-__ZN7WebCore9InlineBox14firstLeafChildEv
-__ZN7WebCoreL36positionAvoidingFirstPositionInTableERKNS_15VisiblePositionE
-__ZNK7WebCore15VisiblePosition8previousEb
-__ZN7WebCore33previousVisuallyDistinctCandidateERKNS_8PositionE
-__ZNK7WebCore8Position7atStartEv
-__ZNK7WebCore8Position8previousENS_24EUsingComposedCharactersE
-__ZN7WebCore8Position23uncheckedPreviousOffsetEPKNS_4NodeEi
-__ZNK7WebCore13ContainerNode14childNodeCountEv
-__ZN7WebCore25isLastPositionBeforeTableERKNS_15VisiblePositionE
-__ZNK7WebCore15VisiblePosition30honorEditableBoundaryAtOrAfterERKS0_
-__ZN7WebCore19highestEditableRootERKNS_8PositionE
-__ZN7WebCore12TextIterator33shouldEmitSpaceBeforeAndAfterNodeEPNS_4NodeE
-__ZN7WebCore12TextIterator14handleTextNodeEv
-__ZN7WebCore12TextIterator13handleTextBoxEv
-__ZN7WebCore12TextIterator8emitTextEPNS_4NodeEii
-__ZN7WebCore12TextIterator8exitNodeEv
-__ZN7WebCoreL26shouldEmitNewlineAfterNodeEPNS_4NodeE
-__ZN7WebCore12TextIterator13emitCharacterEtPNS_4NodeES2_ii
-__ZN7WebCore12TextIterator21handleReplacedElementEv
--[DOMRange dealloc]
-__ZN7WebCore5RangeD1Ev
-__ZN7WebCore8Document11detachRangeEPNS_5RangeE
-__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore5Frame34setMarkedTextMatchesAreHighlightedEb
-__ZN7WebCore5Frame21markAllMatchesForTextERKNS_6StringEbj
-__ZN7WebCore15rangeOfContentsEPNS_4NodeE
-__ZN7WebCore5Range18selectNodeContentsEPNS_4NodeERi
-__ZN7WebCore13findPlainTextEPKNS_5RangeERKNS_6StringEbb
-__ZN7WebCore17CharacterIteratorC1EPKNS_5RangeEbb
-__ZN7WebCoreL8searcherEv
-__ZN7WebCore17CharacterIterator7advanceEi
-__ZN7WebCoreL17characterSubrangeERNS_17CharacterIteratorEii
-__ZNK7WebCore17CharacterIterator5rangeEv
-__ZNK7WebCore12TextIterator5rangeEv
-__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEENS2_INS_4NodeEEEiS6_i
-__ZNK7WebCore5Range9collapsedERi
-__ZN7WebCore18endVisiblePositionEPKNS_5RangeENS_9EAffinityE
-__ZNK7WebCore5Range9endOffsetERi
-__ZNK7WebCore5Range12endContainerERi
-__ZNK7WebCore10RenderText14previousOffsetEi
-__ZN7WebCore22characterBreakIteratorEPKti
-__ZN7WebCore18textBreakPrecedingEPNS_17TextBreakIteratorEi
-__ZNK7WebCore10RenderText10nextOffsetEi
-__ZN7WebCore20startVisiblePositionEPKNS_5RangeENS_9EAffinityE
-__ZNK7WebCore5Range11startOffsetERi
-__ZNK7WebCore5Range14startContainerERi
-__ZNK7WebCore6Editor17insideVisibleAreaEPNS_5RangeE
-__ZNK7WebCore5Frame21excludeFromTextSearchEv
-__ZNK7WebCore9FrameTree3topEb
-__ZN7WebCore8Document9addMarkerEPNS_5RangeENS_14DocumentMarker10MarkerTypeENS_6StringE
-__ZN7WebCore8Document9addMarkerEPNS_4NodeENS_14DocumentMarkerE
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE15reserveCapacityEm
-__ZN7WebCoreL24placeholderRectForMarkerEv
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore4NodeEEEPSt4pairINS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENSF_ISC_EEE3getEPS3_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore4NodeEEESt4pairIS4_PS5_INS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEEENS_18PairFirstExtractorISD_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSJ_ISC_EEEESK_EC1ERKSN_
-__ZN7WebCore10RenderText29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZN7WebCore8setStartEPNS_5RangeERKNS_15VisiblePositionE
-__ZN7WebCore24rangeCompliantEquivalentERKNS_15VisiblePositionE
-__ZN7WebCore24rangeCompliantEquivalentERKNS_8PositionE
-__ZNK7WebCore5Range18shadowTreeRootNodeEv
-__ZN7WebCoreL19collapsedToBoundaryEPKNS_5RangeEb
-__ZNK7WebCore5Range10cloneRangeERi
-__ZN7WebCore4Node14isInShadowTreeEv
-__ZN7WebCore5Range13setStartAfterEPNS_4NodeERi
-__ZNK7WebCore12RenderObject14previousOffsetEi
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore4NodeEEESt4pairIS4_PS5_INS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEEENS_18PairFirstExtractorISD_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSJ_ISC_EEEESK_E4findIPS3_NS_29RefPtrHashMapRawKeyTranslatorISP_SD_SM_SH_EEEENS_17HashTableIteratorIS4_SD_SF_SH_SM_SK_EERKT_
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EEC1ERKS3_
-__ZN7WebCore13InlineTextBox20paintTextMatchMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleERKNS_4FontE
-__ZN7WebCore13InlineTextBox12selectionTopEv
-__ZN7WebCore13InlineTextBox15selectionHeightEv
-__ZNK7WebCore4Font20selectionRectForTextERKNS_7TextRunERKNS_8IntPointEiii
-__ZNK7WebCore4Font26selectionRectForSimpleTextERKNS_7TextRunERKNS_8IntPointEiii
-__ZN7WebCore8Document24setRenderedRectForMarkerEPNS_4NodeENS_14DocumentMarkerERKNS_7IntRectE
-__ZNK7WebCore5Frame31markedTextMatchesAreHighlightedEv
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE6shrinkEm
-__ZNK7WebCore9FrameTree20traverseNextWithWrapEb
-__ZN7WebCore8Document13removeMarkersENS_14DocumentMarker10MarkerTypeE
-__ZNK7WebCore11FrameLoader14initialRequestEv
-__ZN7WebCore11FrameLoader50didReceiveServerRedirectForProvisionalLoadForFrameEv
-__ZNK7WebCore11FrameLoader21isQuickRedirectComingEv
-__ZN7WebCore22ScriptExecutionContext26canSuspendActiveDOMObjectsEv
-__ZN7WebCore15BackForwardList8capacityEv
-__ZN7WebCore22ScriptExecutionContext23suspendActiveDOMObjectsEv
-__ZN7WebCore11FrameLoader23cachePageForHistoryItemEPNS_11HistoryItemE
-__ZN7WebCore10CachedPage6createEPNS_4PageE
-__ZN7WebCore10CachedPageC1EPNS_4PageE
-__ZN7WebCore11CachedFrameC1EPNS_5FrameE
-__ZNK7WebCore12EventHandler14mousePressNodeEv
-__ZN7WebCore21ScriptCachedFrameDataC1EPNS_5FrameE
-__ZN7WebCore5Frame11clearTimersEv
-__ZN7WebCore5Frame11clearTimersEPNS_9FrameViewEPNS_8DocumentE
-__ZN7WebCore11RenderLayer15suspendMarqueesEv
-__ZN7WebCore19AnimationController17suspendAnimationsEPNS_8DocumentE
-__ZN7WebCore26AnimationControllerPrivate17suspendAnimationsEPNS_8DocumentE
-__ZN7WebCore12EventHandler19stopAutoscrollTimerEb
-__ZN7WebCore8Document14setInPageCacheEb
-__ZN7WebCore11CachedFrame26setCachedFramePlatformDataEPNS_23CachedFramePlatformDataE
-__ZN7WebCore9PageCache3addEN3WTF10PassRefPtrINS_11HistoryItemEEENS2_INS_10CachedPageEEE
-__ZN7WebCore9PageCache12addToLRUListEPNS_11HistoryItemE
-__ZThn68_NK7WebCore16HTMLInputElement9saveStateERNS_6StringE
-__ZNK7WebCore16HTMLInputElement9saveStateERNS_6StringE
-__ZNK7WebCore16HTMLInputElement12autoCompleteEv
-__ZThn68_N7WebCore31HTMLFormControlElementWithState20toFormControlElementEv
-__ZN7WebCore31HTMLFormControlElementWithState20toFormControlElementEv
-__ZThn56_NK7WebCore16HTMLInputElement4nameEv
-__ZThn56_NK7WebCore16HTMLInputElement4typeEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_13PageURLRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E4findIS2_NS_22IdentityHashTranslatorIS2_S6_S9_EEEENS_17HashTableIteratorIS2_S6_S8_S9_SE_SC_EERKT_
-__ZN7WebCore6Screen15disconnectFrameEv
-__ZN7WebCore9Navigator15disconnectFrameEv
-__ZN7WebCore13MimeTypeArrayD1Ev
-__ZN7WebCore5Frame25setUseSecureKeyboardEntryEb
-__ZThn56_NK7WebCore17HTMLScriptElement22languageAttributeValueEv
-__ZNK7WebCore17HTMLScriptElement22languageAttributeValueEv
-__ZNK7WebCore11CSSRuleList6lengthEv
-__ZN7WebCore11CSSRuleList4itemEj
-__ZN7WebCoreL19textareaConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLTextAreaElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZNK7WebCore11HTMLElement16findFormAncestorEv
-__ZN7WebCore19HTMLTextAreaElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore22HTMLFormControlElement17endTagRequirementEv
-__ZNK7WebCore22HTMLFormControlElement11tagPriorityEv
-__ZN7WebCore20StyleFlexibleBoxDataC1ERKS0_
-__ZN7WebCore7DataRefINS_22StyleRareInheritedDataEE6accessEv
-__ZNK7WebCore14RenderThemeMac19adjustTextAreaStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore10HTMLParser27nestedStyleCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore10HTMLParser23allowNestedRedundantTagERKNS_12AtomicStringE
-__ZNK7WebCore17CSSInheritedValue12cssValueTypeEv
+__ZN7WebCore17HTMLOptionElement6detachEv
+__ZN7WebCore4Text16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore13CharacterData16rendererIsNeededEPNS_11RenderStyleE
+__ZNK7WebCore12RenderObject7isTableEv
+__ZNK7WebCore12RenderObject10isFrameSetEv
+__ZN7WebCore4Node16previousRendererEv
+__ZNK7WebCore12RenderObject14isRenderInlineEv
+__ZNK7WebCore7Element14getIDAttributeEv
+__ZN7WebCore7DataRefINS_12StyleBoxDataEE6accessEv
+__ZN7WebCore14ClassNamesData12createVectorEv
+__ZN7WebCore17CSSPrimitiveValue18computeLengthFloatEPNS_11RenderStyleEb
+__ZN7WebCore7DataRefINS_18StyleInheritedDataEE6accessEv
+__ZN7WebCore16HTMLImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderImageC1EPNS_4NodeE
+__ZN7WebCore11RenderImageC2EPNS_4NodeE
+__ZN7WebCore14RenderReplacedC2EPNS_4NodeERKNS_7IntSizeE
+__ZN7WebCore11RenderImage13updateAltTextEv
+__ZNK7WebCore16HTMLImageElement7altTextEv
+__ZN7WebCore14RenderReplaced14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore12RenderObject13isRenderBlockEv
+__ZNK7WebCore12RenderObject15virtualChildrenEv
+__ZN7WebCore11RenderBlock26dirtyLinesFromChangedChildEPNS_12RenderObjectE
+__ZN7WebCore17RenderLineBoxList26dirtyLinesFromChangedChildEPNS_12RenderObjectES2_
+__ZNK7WebCore11RenderImage7isImageEv
+__ZNK7WebCore11RenderImage8hasImageEv
+__ZN7WebCore11RenderImage14setCachedImageEPNS_11CachedImageE
+__ZN7WebCoreeqINS_11CachedImageES1_EEbRKNS_20CachedResourceHandleIT_EEPKT0_
+__ZNK7WebCore12RenderObject4isBREv
+__ZN7WebCore4Text14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore10RenderTextC1EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore10RenderTextC2EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZNK7WebCore8Document31displayStringModifiedByEncodingEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore10RenderText15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore10RenderText14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker16checkPseudoStateEPNS_7ElementEb
+__ZN7WebCore15visitedLinkHashERKNS_4KURLERKNS_12AtomicStringE
+__ZN7WebCore10visitedURLERKNS_4KURLERKNS_12AtomicStringERN3WTF6VectorItLm512EEE
+__ZN7WebCore9PageGroup13isLinkVisitedEy
+__ZN7WebCore9PageGroup14addVisitedLinkEPKtm
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E4findIyNS_22IdentityHashTranslato
+__ZNK7WebCore11CSSSelector9attributeEv
+__ZN7WebCoreL36htmlAttributeHasCaseInsensitiveValueERKNS_13QualifiedNameE
+__ZN7WebCoreL17addLocalNameToSetEPN3WTF7HashSetIPNS_16AtomicStringImplENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEERKNS_13Qualifi
+__ZN7WebCore10StringImpl11reverseFindEPS0_ib
+__ZN7WebCoregtERNS_11CSSRuleDataES1_
+__ZN7WebCore11CSSSelector11specificityEv
+__ZN7WebCore15StyleVisualDataC1ERKS0_
+__ZN7WebCore15StyleVisualDataC2ERKS0_
+__ZN7WebCore11RenderStyle15clearCursorListEv
+__ZN7WebCoreL19valueOrPropertyNameEi
+__Z12getValueNamet
+__ZN7WebCore12RenderInlineC1EPNS_4NodeE
+__ZN7WebCore12RenderInlineC2EPNS_4NodeE
+__ZN7WebCore12RenderInline14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderInline27updateBoxModelInfoFromStyleEv
+__ZNK7WebCore12RenderInline13requiresLayerEv
+__ZNK7WebCore12RenderInline18inlineContinuationEv
+__ZNK7WebCore12RenderInline15virtualChildrenEv
+__ZNK7WebCore16CSSStyleSelector14largerFontSizeEfb
+__ZN7WebCore12RenderInline8addChildEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderInline28addChildIgnoringContinuationEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderInline15virtualChildrenEv
+__ZN7WebCore12RenderInline26dirtyLinesFromChangedChildEPNS_12RenderObjectE
+__ZNK7WebCore15FontDescription12bolderWeightEv
+__ZN7WebCore16CSSStyleSelector24canShareStyleWithElementEPNS_4NodeE
+__ZN7WebCore13HTMLBRElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore8RenderBRC1EPNS_4NodeE
+__ZN7WebCore8RenderBRC2EPNS_4NodeE
+__ZN7WebCore8RenderBR14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore8RenderBR4isBREv
 __ZNK7WebCore16CSSStyleSelector15smallerFontSizeEfb
-__ZN7WebCore10HTMLParser29pCloserStrictCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCoreL16tableConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLTableElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16HTMLTableElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLTableElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLTableElement11cellBordersEv
-__ZNK7WebCore16HTMLTableElement17endTagRequirementEv
-__ZNK7WebCore16HTMLTableElement11tagPriorityEv
-__ZN7WebCore16HTMLTableElement6attachEv
-__ZNK7WebCore16HTMLTableElement36canHaveAdditionalAttributeStyleDeclsEv
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14shrinkCapacityEm
-__ZN7WebCore16HTMLTableElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore11RenderTableC1EPNS_4NodeE
-__ZN3WTF6VectorIiLm0EE4fillERKim
-__ZN3WTF6VectorIiLm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIiLm0EE15reserveCapacityEm
-__ZSt4fillIPiiEvT_S1_RKT0_
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4fillERKS3_m
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE15reserveCapacityEm
-__ZSt4fillIPN7WebCore11RenderTable12ColumnStructES2_EvT_S4_RKT0_
-__ZN7WebCore11RenderTable14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore11RenderTable17updateFirstLetterEv
-__ZN7WebCore15AutoTableLayoutC1EPNS_11RenderTableE
-__ZN7WebCoreL19tableRowConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLTableRowElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore20HTMLTablePartElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore20HTMLTablePartElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEiRKNS_6StringE
-__ZNK7WebCore19HTMLTableRowElement17endTagRequirementEv
-__ZNK7WebCore19HTMLTableRowElement11tagPriorityEv
-__ZN7WebCore16HTMLTableElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore16HTMLTableElement8checkDTDEPKNS_4NodeE
-__ZN7WebCoreL14isTableSectionEPNS_4NodeE
-__ZN7WebCore23HTMLTableSectionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore23HTMLTableSectionElement11tagPriorityEv
-__ZNK7WebCore23HTMLTableSectionElement36canHaveAdditionalAttributeStyleDeclsEv
-__ZN7WebCore23HTMLTableSectionElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore16HTMLTableElement19addSharedGroupDeclsEbRN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore18RenderTableSectionC1EPNS_4NodeE
-__ZN7WebCore11RenderTable8addChildEPNS_12RenderObjectES2_
-__ZNK7WebCore18RenderTableSection14isTableSectionEv
-__ZNK7WebCore11RenderTable7isTableEv
-__ZN7WebCore23HTMLTableSectionElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
-__ZNK7WebCore23HTMLTableSectionElement17endTagRequirementEv
-__ZN7WebCore23HTMLTableSectionElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore14RenderTableRowC1EPNS_4NodeE
-__ZN7WebCore14RenderTableRow15styleWillChangeENS_11RenderStyle4DiffEPKS1_
-__ZNK7WebCore14RenderTableRow13requiresLayerEv
-__ZN7WebCore18RenderTableSection8addChildEPNS_12RenderObjectES2_
-__ZNK7WebCore14RenderTableRow10isTableRowEv
-__ZN7WebCore18RenderTableSection10ensureRowsEi
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE4growEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE4fillERKS3_m
-__ZSt4fillIPN7WebCore18RenderTableSection10CellStructES2_EvT_S4_RKT0_
-__ZNK7WebCore12RenderObject14childrenInlineEv
-__ZN7WebCore10HTMLParser25tableCellCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCoreL20tableCellConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore20HTMLTableCellElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore20HTMLTableCellElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore20HTMLTableCellElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore20HTMLTableCellElement17endTagRequirementEv
-__ZNK7WebCore20HTMLTableCellElement11tagPriorityEv
-__ZN7WebCore19HTMLTableRowElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore19HTMLTableRowElement8checkDTDEPKNS_4NodeE
-__ZNK7WebCore20HTMLTableCellElement36canHaveAdditionalAttributeStyleDeclsEv
-__ZN7WebCore20HTMLTableCellElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore16HTMLTableElement18addSharedCellDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore16HTMLTableElement24addSharedCellBordersDeclERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore13StyledElement22getMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore13StyledElement22setMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringEPNS_29CSSMappedAttributeDeclarationE
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE15reserveCapacityEm
-__ZN7WebCore16HTMLTableElement24addSharedCellPaddingDeclERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore15RenderTableCellC1EPNS_4NodeE
-__ZN7WebCore15RenderTableCell17updateFromElementEv
-__ZN7WebCore15RenderTableCell15styleWillChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore15RenderTableCell14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZNK7WebCore15RenderTableCell13requiresLayerEv
-__ZN7WebCore14RenderTableRow8addChildEPNS_12RenderObjectES2_
-__ZNK7WebCore15RenderTableCell11isTableCellEv
-__ZN7WebCore18RenderTableSection7addCellEPNS_15RenderTableCellEPNS_14RenderTableRowE
-__ZN7WebCore15HTMLFormElement18registerImgElementEPNS_16HTMLImageElementE
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE6shrinkEm
-__ZN7WebCore11RenderTable12appendColumnEi
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4growEm
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE14expandCapacityEm
-__ZN7WebCore18RenderTableSection12appendColumnEi
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE6resizeEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIiLm0EE4growEm
-__ZN3WTF6VectorIiLm0EE14expandCapacityEm
-__ZN7WebCore10HTMLParser18isResidualStyleTagERKNS_12AtomicStringE
-__ZN7WebCore12InputElement18parseSizeAttributeERNS_16InputElementDataEPNS_15MappedAttributeE
-__ZN7WebCore12InputElement23parseMaxLengthAttributeERNS_16InputElementDataEPNS_15MappedAttributeE
-__ZNK7WebCore14RenderThemeMac20adjustTextFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore10StringImpl7replaceEPS0_S1_
-__ZN7WebCore10StringImpl7replaceEtt
-__ZN7WebCore13textBreakNextEPNS_17TextBreakIteratorE
-__ZNK7WebCore16HTMLInputElement17isInputTypeHiddenEv
+__ZNK7WebCore12RenderObject22getUncachedPseudoStyleENS_8PseudoIdEPNS_11RenderStyleE
+__ZN7WebCore16CSSStyleSelector21pseudoStyleForElementENS_8PseudoIdEPNS_7ElementEPNS_11RenderStyleE
+__ZN7WebCore22CSSQuirkPrimitiveValue12isQuirkValueEv
+__ZN7WebCore17CSSPrimitiveValue18computeLengthShortEPNS_11RenderStyleEd
+__ZNK7WebCore12RenderInline14isRenderInlineEv
+__ZNK7WebCore10RenderText12originalTextEv
+__ZN7WebCore10RenderText7setTextEN3WTF10PassRefPtrINS_10StringImplEEEb
+__ZN7WebCore10RenderText15setTextInternalEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZNK7WebCore12RenderObject9isSVGTextEv
+__ZN7WebCore15HTMLFormElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore11RenderBlock17deleteLineBoxTreeEv
+__ZN7WebCore17RenderLineBoxList17deleteLineBoxTreeEPNS_11RenderArenaE
+__ZNK7WebCore11RenderBlock20createAnonymousBlockEv
+__ZN7WebCoreL9moveChildEPNS_12RenderObjectEPNS_21RenderObjectChildListES1_S3_S1_
+__ZNK7WebCore12RenderObject17isSelectionBorderEv
+__ZN7WebCore9RenderBox21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore11RenderBlock11isBlockFlowEv
 __ZNK7WebCore14RenderThemeMac11systemColorEi
-__ZNK3WTF9HashTableIiSt4pairIijENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IjEEEES9_E8containsIiNS_22IdentityHashTranslatorIiS2_S6_EEEEbRKT_
-__ZN7WebCoreL21convertNSColorToColorEP7NSColor
+__ZNK3WTF9HashTableIiSt4pairIijENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IjEEEES9
 __ZN3WTF7HashMapIijNS_7IntHashIjEENS_10HashTraitsIiEENS3_IjEEE3setERKiRKj
-__ZN3WTF9HashTableIiSt4pairIijENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IjEEEES9_E6expandEv
+__ZN3WTF9HashTableIiSt4pairIijENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IjEEEES9_
 __ZNK3WTF7HashMapIijNS_7IntHashIjEENS_10HashTraitsIiEENS3_IjEEE3getERKi
+__ZNK7WebCore22HTMLFormControlElement20isFormControlElementEv
+__ZN7WebCore19HTMLFieldSetElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderFieldsetC1EPNS_4NodeE
+__ZN7WebCore14RenderFieldsetC2EPNS_4NodeE
+__ZN7WebCore14RenderFieldset14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore14toInputElementEPNS_7ElementE
+__ZThn128_NK7WebCore16HTMLInputElement12isAutofilledEv
+__ZNK7WebCore16HTMLInputElement12isAutofilledEv
+__ZNK7WebCore14RenderThemeMac10systemFontEiRNS_15FontDescriptionE
+__ZN7WebCoreL12toFontWeightEl
+__ZN7WebCore11RenderStyle13setTextShadowEPNS_10ShadowDataEb
+__ZN7WebCore22StyleRareInheritedDataC1ERKS0_
+__ZN7WebCore22StyleRareInheritedDataC2ERKS0_
+__ZN7WebCore7DataRefINS_25StyleRareNonInheritedDataEE6accessEv
+__ZN7WebCore25StyleRareNonInheritedDataC1ERKS0_
+__ZN7WebCore25StyleRareNonInheritedDataC2ERKS0_
+__ZN7WebCore9FillLayeraSERKS0_
+__ZN7WebCore11RenderTheme11adjustStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementEbRKNS_10BorderDataERKNS_9FillLayer
+__ZNK7WebCore14RenderThemeMac15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_9FillLayerERKNS_5ColorE
+__ZNK7WebCore14NinePieceImageeqERKS0_
+__ZN7WebCore11RenderStyle12setBoxShadowEPNS_10ShadowDataEb
+__ZNK7WebCore14RenderThemeMac20adjustTextFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore16HTMLInputElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore16HTMLInputElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore27RenderTextControlSingleLineC1EPNS_4NodeE
+__ZN7WebCore27RenderTextControlSingleLineC2EPNS_4NodeE
+__ZN7WebCore17RenderTextControlC2EPNS_4NodeE
+__ZN7WebCore27RenderTextControlSingleLine14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore17RenderTextControl14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore17RenderTextControl15canHaveChildrenEv
+__ZN7WebCore27RenderTextControlSingleLine17updateFromElementEv
+__ZN7WebCore27RenderTextControlSingleLine21createSubtreeIfNeededEv
+__ZNK7WebCore27RenderTextControlSingleLine12inputElementEv
+__ZThn128_NK7WebCore16HTMLInputElement13isSearchFieldEv
+__ZNK7WebCore16HTMLInputElement13isSearchFieldEv
+__ZN7WebCore17RenderTextControl21createSubtreeIfNeededEPNS_23TextControlInnerElementE
+__ZN7WebCore27TextControlInnerTextElementC1EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore27TextControlInnerTextElementC2EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore23TextControlInnerElementC2EPNS_8DocumentEPNS_4NodeE
+__ZNK7WebCore27RenderTextControlSingleLine20createInnerTextStyleEPKNS_11RenderStyleE
+__ZNK7WebCore27RenderTextControlSingleLine26placeholderShouldBeVisibleEv
+__ZThn128_NK7WebCore16HTMLInputElement26placeholderShouldBeVisibleEv
+__ZNK7WebCore16HTMLInputElement26placeholderShouldBeVisibleEv
+__ZNK7WebCore17RenderTextControl20adjustInnerTextStyleEPKNS_11RenderStyleEPS1_
+__ZNK7WebCore22HTMLFormControlElement20isEnabledFormControlEv
+__ZNK7WebCore22HTMLFormControlElement8disabledEv
+__ZNK7WebCore22HTMLFormControlElement21isReadOnlyFormControlEv
+__ZN7WebCore9FontCache11getFontDataERKNS_4FontERiPNS_12FontSelectorE
+__ZN7WebCore15CSSFontSelector11getFontDataERKNS_15FontDescriptionERKNS_12AtomicStringE
+__ZN7WebCore9FontCache25getCachedFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringEb
+__ZN7WebCore9FontCache12platformInitEv
+__ZN3WTF9HashTableIN7WebCore24FontPlatformDataCacheKeyESt4pairIS2_PNS1_16FontPlatformDataEENS_18PairFirstExtractorIS6_EENS1_28F
+__ZN7WebCore9FontCache22createFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringE
+__ZN7WebCoreL18toAppKitFontWeightENS_10FontWeightE
++[WebFontCache fontWithFamily:traits:weight:size:]
++[WebFontCache internalFontWithFamily:traits:weight:size:]
+__ZL16acceptableChoicemm
+__ZNK7WebCore14SimpleFontData9isLoadingEv
+__ZNK7WebCore11RenderBlock10lineHeightEbb
+__ZN7WebCore23TextControlInnerElement18attachInnerElementEPNS_4NodeEN3WTF10PassRefPtrINS_11RenderStyleEEEPNS_11RenderArenaE
+__ZN7WebCore27TextControlInnerTextElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore23TextControlInnerElement12isShadowNodeEv
+__ZN7WebCore23TextControlInnerElement16shadowParentNodeEv
+__ZNK7WebCore12RenderObject10isTextAreaEv
+__ZNK7WebCore11RenderLayer13isTransparentEv
+__ZNK7WebCore7Element19virtualNamespaceURIEv
+__ZN7WebCore11RenderLayer19dirtyNormalFlowListEv
+__ZNK7WebCore17RenderTextControl13isTextControlEv
+__ZN7WebCore9FrameView25scheduleRelayoutOfSubtreeEPNS_12RenderObjectE
+__ZN7WebCore17RenderTextControl17updateFromElementEv
+__ZNK7WebCore22HTMLFormControlElement31formControlValueMatchesRendererEv
+__ZThn128_NK7WebCore16HTMLInputElement5valueEv
+__ZNK7WebCore16HTMLInputElement5valueEv
+__ZN7WebCore17RenderTextControl17setInnerTextValueERKNS_6StringE
+__ZN7WebCore17RenderTextControl4textEv
+__ZNK7WebCore17RenderTextControl10finishTextERN3WTF6VectorItLm0EEE
+__ZN7WebCore11HTMLElement12setInnerTextERKNS_6StringERi
+__ZNK7WebCore4Node15rareDataFocusedEv
+__ZN7WebCore20StyleFlexibleBoxDataC1ERKS0_
+__ZN7WebCore20StyleFlexibleBoxDataC2ERKS0_
+__ZN7WebCore17CSSPrimitiveValue16computeLengthIntEPNS_11RenderStyleEd
+__ZNK7WebCore11RenderTheme15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_9FillLayerERKNS_5ColorE
+__ZNK7WebCore9FillLayereqERKS0_
+__ZNK7WebCore14RenderThemeMac19adjustMenuListStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac18controlSizeForFontEPNS_11RenderStyleE
+__ZN7WebCore11RenderStyle11resetBorderEv
+__ZN7WebCoreL19menuListButtonSizesEv
+__ZNK7WebCore14RenderThemeMac15setSizeFromFontEPNS_11RenderStyleEPKNS_7IntSizeE
+__ZNK7WebCore14RenderThemeMac11sizeForFontEPNS_11RenderStyleEPKNS_7IntSizeE
+__ZNK7WebCore14RenderThemeMac22setFontFromControlSizeEPNS_16CSSStyleSelectorEPNS_11RenderStyleEm
+__ZN7WebCore10FontFamilyD2Ev
+__ZN7WebCore17HTMLSelectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderMenuListC1EPNS_17HTMLSelectElementE
+__ZN7WebCore14RenderMenuListC2EPNS_17HTMLSelectElementE
+__ZN7WebCore17RenderFlexibleBoxC2EPNS_4NodeE
+__ZN7WebCore14RenderMenuList14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderMenuList15canHaveChildrenEv
+__ZN7WebCore14RenderMenuList18updateOptionsWidthEv
+__ZN7WebCore15toOptionElementEPNS_7ElementE
+__ZThn128_NK7WebCore17HTMLOptionElement31textIndentedToRespectGroupLabelEv
+__ZNK7WebCore17HTMLOptionElement31textIndentedToRespectGroupLabelEv
+__ZN7WebCore13OptionElement37collectOptionTextRespectingGroupLabelERKNS_17OptionElementDataEPNS_8DocumentE
+__ZN7WebCore20toOptionGroupElementEPNS_7ElementE
+__ZN7WebCore13OptionElement17collectOptionTextERKNS_17OptionElementDataEPNS_8DocumentE
+__ZNK7WebCore6String18simplifyWhiteSpaceEv
+__ZN7WebCore10StringImpl18simplifyWhiteSpaceEv
+__ZNK7WebCore11RenderTheme29popupOptionSupportsTextIndentEv
+__ZN7WebCore9FontCache24getFontDataForCharactersERKNS_4FontEPKti
+__ZNK3WTF7HashMapIiPN7WebCore13GlyphWidthMap14GlyphWidthPageENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3getERKi
+__ZNK7WebCore17HTMLOptionElement8disabledEv
+__ZN7WebCore17HTMLOptionElement14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN7WebCore14RenderMenuList17updateFromElementEv
+__ZNK7WebCore17HTMLSelectElement13selectedIndexEv
+__ZN7WebCore14RenderMenuList17setTextFromOptionEi
+__ZN7WebCore14RenderMenuList7setTextERKNS_6StringE
+__ZN7WebCore14RenderMenuList8addChildEPNS_12RenderObjectES2_
+__ZN7WebCore14RenderMenuList16createInnerBlockEv
+__ZN7WebCore14RenderMenuList16adjustInnerStyleEv
+__ZNK7WebCore14RenderThemeMac24popupInternalPaddingLeftEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac18popupButtonPaddingEm
+__ZNK7WebCore14RenderThemeMac25popupInternalPaddingRightEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac23popupInternalPaddingTopEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac26popupInternalPaddingBottomEPNS_11RenderStyleE
+__ZN7WebCore9PopupMenu29itemWritingDirectionIsNaturalEv
+__ZN7WebCore10StringImpl23defaultWritingDirectionEv
+__ZThn128_NK7WebCore16HTMLInputElement17isInputTypeHiddenEv
+__ZN7WebCoreL21convertNSColorToColorEP7NSColor
 __ZNK7WebCore8ThemeMac13controlBorderENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
 __ZNK7WebCore5Theme13controlBorderENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
 __ZNK7WebCore8ThemeMac14controlPaddingENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
@@ -4434,42 +3002,1800 @@
 __ZNK7WebCore8ThemeMac18minimumControlSizeENS_11ControlPartERKNS_4FontEf
 __ZNK7WebCore8ThemeMac11controlFontENS_11ControlPartERKNS_4FontEf
 __ZN7WebCore12RenderButtonC1EPNS_4NodeE
-__ZN7WebCore17RenderFlexibleBoxC1EPNS_4NodeE
-__ZN7WebCore12RenderButton15styleWillChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore12RenderButton14styleDidChangeENS_11RenderStyle4DiffEPKS1_
+__ZN7WebCore12RenderButtonC2EPNS_4NodeE
+__ZN7WebCore12RenderButton15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderButton14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore12RenderButton15canHaveChildrenEv
 __ZNK7WebCore11RenderTheme9isDefaultEPKNS_12RenderObjectE
 __ZN7WebCore12RenderButton17updateFromElementEv
 __ZNK7WebCore16HTMLInputElement16valueWithDefaultEv
 __ZN7WebCore12RenderButton7setTextERKNS_6StringE
+__ZN7WebCore18RenderTextFragmentC1EPNS_4NodeEPNS_10StringImplE
+__ZN7WebCore18RenderTextFragmentC2EPNS_4NodeEPNS_10StringImplE
 __ZN7WebCore12RenderButton8addChildEPNS_12RenderObjectES2_
 __ZN7WebCore12RenderButton15setupInnerStyleEPNS_11RenderStyleE
-__ZNK7WebCore11RenderTheme22adjustButtonInnerStyleEPNS_11RenderStyleE
-__ZN7WebCore18JSImageConstructor4markEv
-__ZN7WebCore22JSHTMLParagraphElementD0Ev
-__ZN7WebCore20JSHTMLHeadingElementD0Ev
-__ZN7WebCore18JSHTMLInputElementD0Ev
-__ZN7WebCore16HTMLInputElement23needsActivationCallbackEv
-__ZN7WebCore22HTMLFormControlElement14removeFromFormEv
-__ZN7WebCore16InputElementDataD1Ev
-__ZN7WebCore27FormControlElementWithState37unregisterFormControlElementWithStateEPS0_PNS_8DocumentE
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore27FormControlElementWithStateEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E4findIS6_NS_22IdentityHashTranslatorIS6_S6_SC_EEEENS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EERKT_
-__ZN3WTF11ListHashSetIPN7WebCore27FormControlElementWithStateENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore16JSHTMLCollectionD0Ev
-__ZN7WebCore11XPathResultD1Ev
-__ZN7WebCore10FontFamilyD2Ev
+__ZNK7WebCore11RenderTheme24buttonInternalPaddingTopEv
+__ZNK7WebCore11RenderTheme26buttonInternalPaddingRightEv
+__ZNK7WebCore11RenderTheme27buttonInternalPaddingBottomEv
+__ZNK7WebCore11RenderTheme25buttonInternalPaddingLeftEv
+__ZN7WebCore22StyleRareInheritedDataD1Ev
+__ZN7WebCore22StyleRareInheritedDataD2Ev
+__ZN7WebCore25StyleRareNonInheritedDataD1Ev
+__ZN7WebCore25StyleRareNonInheritedDataD2Ev
+__ZN7WebCore12RenderObject17updateFromElementEv
+__ZNK7WebCore18NamedMappedAttrMap14mapsEquivalentEPKS0_
+__ZNK7WebCore18NamedMappedAttrMap9declCountEv
+__ZN7WebCore8Document18minimumLayoutDelayEv
+__ZNK7WebCore8Document11elapsedTimeEv
+__ZN7WebCore13HTMLTokenizer35executeScriptsWaitingForStylesheetsEv
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE6shrinkEm
+__ZN7WebCore14CachedResource6finishEv
+__ZN7WebCore7RequestD1Ev
+__ZN7WebCore7RequestD2Ev
+__ZN7WebCore11FrameLoader8loadDoneEv
+__ZN7WebCore9DocLoader23checkForPendingPreloadsEv
+__ZN7WebCore14DocumentLoader23removeSubresourceLoaderEPNS_14ResourceLoaderE
+__ZN7WebCore17SubresourceLoaderD0Ev
+__ZN7WebCore11CachedImage4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore11CachedImage23maximumDecodedImageSizeEv
+__ZNK7WebCore11CachedImage9imageSizeEf
+__ZNK7WebCore11BitmapImage4sizeEv
+__ZNK7WebCore11ImageSource4sizeEv
+__ZNK7WebCore11ImageSource16frameSizeAtIndexEm
+__ZN7WebCore11CachedImage15notifyObserversEPKNS_7IntRectE
+__ZN7WebCore12RenderObject12imageChangedEPNS_11CachedImageEPKNS_7IntRectE
+__ZN7WebCore11RenderImage12imageChangedEPvPKNS_7IntRectE
+__ZNK7WebCore11RenderImage8imagePtrEv
+__ZNK7WebCore11RenderImage13errorOccurredEv
+__ZNK7WebCore14RenderReplaced13intrinsicSizeEv
+__ZNK7WebCore11RenderImage9imageSizeEf
+__ZN7WebCore14RenderReplaced16setIntrinsicSizeERKNS_7IntSizeE
+__ZNK7WebCore12RenderObject15containingBlockEv
+__ZNK7WebCore12RenderObject7isMediaEv
+__ZNK7WebCore12RenderObject14isSVGContainerEv
+__ZN7WebCore9RenderBox9calcWidthEv
+__ZNK7WebCore9FrameView10layoutRootEb
+__ZNK7WebCore12RenderObject13isFlexibleBoxEv
+__ZNK7WebCore9RenderBox29shouldCalculateSizeAsReplacedEv
+__ZNK7WebCore12RenderObject26isInlineBlockOrInlineTableEv
+__ZNK7WebCore11RenderImage17calcReplacedWidthEb
+__ZNK7WebCore11RenderImage21imageHasRelativeWidthEv
+__ZNK7WebCore11CachedImage21imageHasRelativeWidthEv
+__ZNK7WebCore5Image16hasRelativeWidthEv
+__ZNK7WebCore11RenderImage16isWidthSpecifiedEv
+__ZNK7WebCore9RenderBox22calcReplacedWidthUsingENS_6LengthE
+__ZNK7WebCore9RenderBox19calcContentBoxWidthEi
+__ZNK7WebCore9RenderBox30containingBlockWidthForContentEv
+__ZNK7WebCore9RenderBox19shrinkToAvoidFloatsEv
+__ZNK7WebCore12RenderObject13isHTMLMarqueeEv
+__ZNK7WebCore11RenderBlock14availableWidthEv
+__ZNK7WebCore9RenderBox11clientWidthEv
+__ZNK7WebCore20RenderBoxModelObject10borderLeftEv
+__ZNK7WebCore20RenderBoxModelObject11borderRightEv
+__ZNK7WebCore9RenderBox22verticalScrollbarWidthEv
+__ZNK7WebCore20RenderBoxModelObject11paddingLeftEb
+__ZNK7WebCore20RenderBoxModelObject12paddingRightEb
+__ZNK7WebCore9RenderBox12minPrefWidthEv
+__ZN7WebCore11RenderImage14calcPrefWidthsEv
+__ZN7WebCore9RenderBox10calcHeightEv
+__ZN7WebCore9RenderBox19calcVerticalMarginsEv
+__ZNK7WebCore11RenderImage18calcReplacedHeightEv
+__ZNK7WebCore11RenderImage17isHeightSpecifiedEv
+__ZNK7WebCore9RenderBox23calcReplacedHeightUsingENS_6LengthE
+__ZNK7WebCore9RenderBox20calcContentBoxHeightEi
+__ZNK7WebCore20RenderBoxModelObject9borderTopEv
+__ZNK7WebCore20RenderBoxModelObject12borderBottomEv
+__ZNK7WebCore20RenderBoxModelObject10paddingTopEb
+__ZNK7WebCore20RenderBoxModelObject13paddingBottomEb
+__ZN7WebCore20CachedResourceClient12imageChangedEPNS_11CachedImageEPKNS_7IntRectE
+-[WebCoreSharedBufferData dealloc]
+-[WebCoreSharedBufferData .cxx_destruct]
+__ZNK7WebCore9RenderBox12clientHeightEv
+__ZNK7WebCore9RenderBox25horizontalScrollbarHeightEv
+__ZN7WebCore12RenderObject16repaintRectangleERKNS_7IntRectEb
+__ZNK7WebCore12RenderObject11isBlockFlowEv
+__ZN7WebCore12RenderInline21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZN7WebCore11CachedImage11checkNotifyEv
+__ZN7WebCore11RenderImage14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore15HTMLImageLoader14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore11ImageLoader14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCoreL15loadEventSenderEv
+__ZN7WebCore20ImageLoadEventSenderC1Ev
+__ZN7WebCore20ImageLoadEventSenderC2Ev
+__ZN7WebCore20ImageLoadEventSender21dispatchLoadEventSoonEPNS_11ImageLoaderE
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE15reserveCapacityEm
+__ZN7WebCore5TimerINS_9FrameViewEE5firedEv
+__ZN7WebCore9FrameView16layoutTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore9FrameView6layoutEb
+__ZNK7WebCore16CSSStyleSelector24affectedByViewportChangeEv
+__ZNK7WebCore5Frame18needsReapplyStylesEv
+__ZN7WebCore5Frame13reapplyStylesEv
+__ZN7WebCore5Frame17setUserStyleSheetERKNS_6StringE
+__ZN7WebCore8Document17setUserStyleSheetERKNS_6StringE
+__ZN7WebCore11CSSRuleDataD2Ev
+__ZNK7WebCore19StyleBackgroundDataeqERKS0_
+__ZNK7WebCore17StyleSurroundDataeqERKS0_
+__ZN7WebCore15StyleVisualDataD1Ev
+__ZNK7WebCore25StyleRareNonInheritedDataeqERKS0_
+__ZN3WTFeqIN7WebCore20StyleDashboardRegionELm0EEEbRKNS_6VectorIT_XT0_EEES7_
+__ZNK7WebCore25StyleRareNonInheritedData20shadowDataEquivalentERKS0_
+__ZNK7WebCore25StyleRareNonInheritedData24reflectionDataEquivalentERKS0_
+__ZNK7WebCore25StyleRareNonInheritedData23animationDataEquivalentERKS0_
+__ZNK7WebCore25StyleRareNonInheritedData24transitionDataEquivalentERKS0_
+__ZNK7WebCore22StyleRareInheritedDataeqERKS0_
+__ZNK7WebCore22StyleRareInheritedData20shadowDataEquivalentERKS0_
 __ZNK7WebCore20StyleFlexibleBoxDataeqERKS0_
-__ZN7WebCore10RenderText7setTextEN3WTF10PassRefPtrINS_10StringImplEEEb
-__ZN7WebCore10HTMLParser25checkIfHasPElementInScopeEv
-__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E4findIyNS_22IdentityHashTranslatorIyyS4_EEEENS_17HashTableIteratorIyyS2_S4_S6_S6_EERKT_
-__ZN7WebCoreL23tableCaptionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore23HTMLTableCaptionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore23HTMLTableCaptionElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore23HTMLTableCaptionElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore23HTMLTableCaptionElement17endTagRequirementEv
-__ZNK7WebCore23HTMLTableCaptionElement11tagPriorityEv
-__ZN7WebCore6String6numberEt
-__ZNK7WebCore13HTMLBRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore13HTMLBRElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore9FrameView23applyOverflowToViewportEPNS_12RenderObjectERNS_13ScrollbarModeES4_
+__ZNK7WebCore6Widget9frameRectEv
+__ZNK7WebCore6Widget12getOuterViewEv
+__ZN7WebCore10ScrollView25platformSetScrollbarModesEv
+__ZNK7WebCore10ScrollView12layoutHeightEv
+__ZNK7WebCore10ScrollView11layoutWidthEv
+__ZN7WebCore9FrameView21beginDeferredRepaintsEv
+__ZN7WebCore10RenderView6layoutEv
+__ZNK7WebCore10RenderView9viewWidthEv
+__ZNK7WebCore10ScrollView14useFixedLayoutEv
+__ZN7WebCore11RenderBlock6layoutEv
+__ZN7WebCore11RenderBlock11layoutBlockEb
+__ZN7WebCore11RenderBlock27layoutOnlyPositionedObjectsEv
+__ZNK7WebCore11RenderBlock18desiredColumnWidthEv
+__ZN7WebCore10RenderView9calcWidthEv
+__ZN7WebCore11RenderBlock15calcColumnWidthEv
+__ZN7WebCore11RenderBlock29setDesiredColumnCountAndWidthEii
+__ZN7WebCore11RenderBlock11clearFloatsEv
+__ZNK7WebCore11RenderBlock12avoidsFloatsEv
+__ZNK7WebCore9RenderBox12avoidsFloatsEv
+__ZNK7WebCore12RenderObject4isHREv
+__ZN7WebCore11RenderBlock19layoutBlockChildrenEbRi
+__ZN7WebCore11RenderBlock10MarginInfoC1EPS0_ii
+__ZN7WebCore11RenderBlock10MarginInfoC2EPS0_ii
+__ZN7WebCore11RenderBlock12layoutLegendEb
+__ZNK7WebCore9RenderBox9marginTopEv
+__ZN7WebCore11RenderBlock18handleSpecialChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
+__ZN7WebCore11RenderBlock21handlePositionedChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
+__ZN7WebCore11RenderBlock19handleFloatingChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
+__ZN7WebCore11RenderBlock16handleRunInChildEPNS_9RenderBoxERb
+__ZN7WebCore11RenderBlock24estimateVerticalPositionEPNS_9RenderBoxERKNS0_10MarginInfoE
+__ZN7WebCore11RenderBlock13getClearDeltaEPNS_9RenderBoxEi
+__ZNK7WebCore11RenderBlock11floatBottomEv
+__ZN7WebCore9RenderBox14calcWidthUsingENS_9WidthTypeEi
+__ZNK7WebCore9RenderBox21sizesToIntrinsicWidthENS_9WidthTypeE
+__ZNK7WebCore11RenderBlock26isInlineBlockOrInlineTableEv
+__ZNK7WebCore9RenderBox18calcBorderBoxWidthEi
+__ZNK7WebCore9RenderBox28stretchesToMinIntrinsicWidthEv
+__ZNK7WebCore11RenderBlock12maxTopMarginEb
+__ZN7WebCore9RenderBox21calcHorizontalMarginsERKNS_6LengthES3_i
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore11RenderBlock14FloatingObjectEKNS_7HashMapIPNS1_12RenderObjectES4_NS_7PtrHashIS7_EENS_
+__ZN7WebCore11RenderBlock29markLinesDirtyInVerticalRangeEii
+__ZN7WebCore11RenderBlock20layoutInlineChildrenEbRiS1_
+__ZN7WebCoreL9bidiFirstEPNS_11RenderBlockEPNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEb
+__ZNK7WebCore9RenderBox12marginBottomEv
+__ZNK7WebCore9RenderBox10marginLeftEv
+__ZNK7WebCore9RenderBox11marginRightEv
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE15reserveCapacityEm
+__ZN7WebCore9RenderBox14dirtyLineBoxesEb
+__ZN7WebCore14RenderReplaced6layoutEv
+__ZNK7WebCore12RenderObject27checkForRepaintDuringLayoutEv
+__ZNK7WebCore11RenderImage21minimumReplacedHeightEv
+__ZN7WebCore14RenderReplaced36adjustOverflowForBoxShadowAndReflectEv
+__ZNK7WebCore12RenderObject9isCounterEv
+__ZN7WebCore10RenderText14dirtyLineBoxesEb
+__ZN7WebCore10RenderText15deleteTextBoxesEv
+__ZN7WebCore11RenderBlock22determineStartPositionERbS1_RNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERN3WTF6VectorINS0_1
+__ZN7WebCore11BidiContext6createEhN3WTF7Unicode9DirectionEbPS0_
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE23commitExplicitEmbeddingEv
+__ZN3WTF6VectorINS_7Unicode9DirectionELm8EE14shrinkCapacityEm
+__ZN7WebCore11RenderBlock17findNextLineBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEbPNS_6EClearE
+__ZN7WebCore11RenderBlock21skipLeadingWhitespaceERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEb
+__ZNK7WebCore11RenderBlock9lineWidthEib
+__ZNK7WebCore11RenderBlock11rightOffsetEv
+__ZNK7WebCore11RenderBlock14rightRelOffsetEiibPi
+__ZNK7WebCore11RenderBlock10leftOffsetEv
+__ZNK7WebCore11RenderBlock13leftRelOffsetEiibPi
+__ZN7WebCoreL11inlineWidthEPNS_12RenderObjectEbb
+__ZNK7WebCore4Font12isFixedPitchEv
+__ZNK7WebCore16FontFallbackList14determinePitchEPKNS_4FontE
+__ZNK7WebCore10RenderText11isWordBreakEv
+__ZNK7WebCore10RenderText5widthEjjRKNS_4FontEiPN3WTF7HashSetIPKNS_14SimpleFontDataENS4_7PtrHashIS8_EENS4_10HashTraitsIS8_EEEE
+__ZNK7WebCore10RenderText12maxPrefWidthEv
+__ZN7WebCore10RenderText14calcPrefWidthsEi
+__ZN7WebCore10RenderText14calcPrefWidthsEiRN3WTF7HashSetIPKNS_14SimpleFontDataENS1_7PtrHashIS5_EENS1_10HashTraitsIS5_EEEE
+__ZN7WebCore21nextBreakablePositionEPKtiib
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deall
+__ZN7WebCoreL14checkMidpointsERNS_14InlineIteratorE
+__ZN7WebCoreL11addMidpointERKNS_14InlineIteratorE
+__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE15reserveCapacityEm
+__ZN7WebCore11RenderBlock15bidiReorderLineERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS2_
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE21createBidiRunsForLineERKS1_bb
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE9appendRunEv
+__ZNK7WebCore12RenderObject6lengthEv
+__ZN7WebCoreL19appendRunsForObjectEiiPNS_12RenderObjectERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEE
+__ZN7WebCore7BidiRunnwEmPNS_11RenderArenaE
+__ZNK7WebCore10RenderText6lengthEv
+__ZN7WebCore11RenderBlock13constructLineEjPNS_7BidiRunES2_bbPNS_12RenderObjectE
+__ZN7WebCore9RenderBox15createInlineBoxEv
+__ZN7WebCore9InlineBoxnwEmPNS_11RenderArenaE
+__ZN7WebCore11RenderBlock15createLineBoxesEPNS_12RenderObjectEb
+__ZN7WebCore11RenderBlock19createRootInlineBoxEv
+__ZN7WebCore11RenderBlock13createRootBoxEv
+__ZN7WebCore17RenderLineBoxList13appendLineBoxEPNS_13InlineFlowBoxE
+__ZN7WebCore13InlineFlowBox9addToLineEPNS_9InlineBoxE
+__ZN7WebCore9InlineBox15isInlineTextBoxEv
+__ZN7WebCore13InlineFlowBox28determineSpacingForFlowBoxesEbPNS_12RenderObjectE
+__ZNK7WebCore9InlineBox15isInlineFlowBoxEv
+__ZN7WebCore13InlineFlowBox14setConstructedEv
+__ZN7WebCore9InlineBox14setConstructedEv
+__ZN7WebCore11RenderBlock33computeHorizontalPositionsForLineEPNS_13RootInlineBoxEbPNS_7BidiRunES4_b
+__ZN7WebCore13InlineFlowBox19getFlowSpacingWidthEv
+__ZNK7WebCore9InlineBox11isLineBreakEv
+__ZN7WebCore13InlineFlowBox22placeBoxesHorizontallyEiRiS1_Rb
+__ZNK7WebCore14RenderReplaced12overflowLeftEb
+__ZNK7WebCore14RenderReplaced13overflowWidthEb
+__ZN7WebCore11RenderBlock31computeVerticalPositionsForLineEPNS_13RootInlineBoxEPNS_7BidiRunE
+__ZN7WebCore13InlineFlowBox20verticallyAlignBoxesEi
+__ZN7WebCore13InlineFlowBox24computeLogicalBoxHeightsERiS1_S1_S1_b
+__ZNK7WebCore13RootInlineBox15isRootInlineBoxEv
+__ZNK7WebCore11RenderBlock16baselinePositionEbb
+__ZNK7WebCore12RenderObject16baselinePositionEbb
+__ZNK7WebCore14RenderReplaced10lineHeightEbb
+__ZNK7WebCore14RenderReplaced16baselinePositionEbb
+__ZNK7WebCore20RenderBoxModelObject16verticalPositionEb
+__ZN7WebCore13InlineFlowBox20placeBoxesVerticallyEiiibRiS1_S1_S1_
+__ZNK7WebCore14RenderReplaced11overflowTopEb
+__ZNK7WebCore14RenderReplaced14overflowHeightEb
+__ZNK7WebCore9InlineBox6heightEv
+__ZN7WebCore13RootInlineBox28setVerticalOverflowPositionsEii
+__ZN7WebCore13RootInlineBox8OverflownwEmPNS_11RenderArenaE
+__ZN7WebCore13RootInlineBox29setVerticalSelectionPositionsEii
+__ZNK7WebCore13RootInlineBox14bottomOverflowEv
+__ZN7WebCore9RenderBox15positionLineBoxEPNS_9InlineBoxE
+__ZN7WebCore13RootInlineBox36computePerCharacterLayoutInformationEv
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE10deleteRunsEv
+__ZN7WebCore7BidiRun7destroyEv
+__ZN7WebCore7BidiRundlEPvm
+__ZN7WebCore13RootInlineBox16setLineBreakInfoEPNS_12RenderObjectEjRKNS_10BidiStatusE
+__ZN7WebCore11RenderBlock7newLineENS_6EClearE
+__ZN7WebCore11RenderBlock17positionNewFloatsEv
+__ZN7WebCore11RenderBlock21checkLinesForOverflowEv
+__ZNK7WebCore13RootInlineBox12leftOverflowEv
+__ZNK7WebCore13RootInlineBox11topOverflowEv
+__ZNK7WebCore13RootInlineBox13rightOverflowEv
+__ZN7WebCore11RenderBlock13layoutColumnsEi
+__ZN7WebCore9RenderBox15calcHeightUsingERKNS_6LengthE
+__ZNK7WebCore9RenderBox19calcBorderBoxHeightEi
+__ZN7WebCore11RenderBlock23layoutPositionedObjectsEb
+__ZN7WebCore11RenderBlock18positionListMarkerEv
+__ZNK7WebCore9RenderBox14hasControlClipEv
+__ZN7WebCore11RenderBlock15collapseMarginsEPNS_9RenderBoxERNS0_10MarginInfoE
+__ZNK7WebCore11RenderBlock21isSelfCollapsingBlockEv
+__ZN7WebCore11RenderBlock16setMaxTopMarginsEii
+__ZNK7WebCore11RenderBlock15maxBottomMarginEb
+__ZN7WebCore11RenderBlock19clearFloatsIfNeededEPNS_9RenderBoxERNS0_10MarginInfoEiii
+__ZN7WebCore11RenderBlock27determineHorizontalPositionEPNS_9RenderBoxE
+__ZNK7WebCore20RenderBoxModelObject20hasSelfPaintingLayerEv
+__ZN7WebCore11RenderBlock22insertPositionedObjectEPNS_9RenderBoxE
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore9RenderBoxEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunction
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZNK7WebCore11RenderBlock14hasLineIfEmptyEv
+__ZNK7WebCore11HTMLElement17isContentEditableEv
+__ZN7WebCore9RenderBox22calcAbsoluteHorizontalEv
+__ZNK7WebCore9RenderBox33containingBlockWidthForPositionedEPKNS_20RenderBoxModelObjectE
+__ZN7WebCore9RenderBox28calcAbsoluteHorizontalValuesENS_6LengthEPKNS_20RenderBoxModelObjectENS_13TextDirectionEiiS1_S1_S1_S1_Ri
+__ZN7WebCoreL24fontDataForGenericFamilyEPNS_8DocumentERKNS_15FontDescriptionERKNS_12AtomicStringE
+__ZN7WebCoreeqERKNS_12AtomicStringEPKc
+__ZN7WebCore11RenderBlock19handleBottomOfBlockEiiRNS0_10MarginInfoE
+__ZN7WebCore11RenderBlock24setCollapsedBottomMarginERKNS0_10MarginInfoE
+__ZN7WebCore9RenderBox20calcAbsoluteVerticalEv
+__ZNK7WebCore9RenderBox34containingBlockHeightForPositionedEPKNS_20RenderBoxModelObjectE
+__ZN7WebCore9RenderBox26calcAbsoluteVerticalValuesENS_6LengthEPKNS_20RenderBoxModelObjectEiiS1_S1_S1_S1_RiS5_S5_S5_
+__ZNK7WebCore11RenderBlock9floatRectEv
+__ZN7WebCore11RenderBlock17addVisualOverflowERKNS_7IntRectE
+__ZNK7WebCore9RenderBox12maxPrefWidthEv
+__ZN7WebCore11RenderBlock14calcPrefWidthsEv
+__ZN7WebCore11RenderBlock20calcInlinePrefWidthsEv
+__ZN7WebCore20InlineMinMaxIterator4nextEv
+__ZNK7WebCore12RenderInline10marginLeftEv
+__ZN7WebCoreL11getBPMWidthEiNS_6LengthE
+__ZN7WebCore10RenderText17trimmedPrefWidthsEiRiRbS1_S2_S2_S2_S1_S1_S1_S1_S2_
+__ZL12betterChoicemimimi
+__ZNK7WebCore12RenderInline11marginRightEv
+__ZN7WebCore12RenderInline14dirtyLineBoxesEb
+__ZN7WebCoreL22getBorderPaddingMarginEPNS_20RenderBoxModelObjectEb
+__ZN7WebCore10RenderText19createInlineTextBoxEv
+__ZN7WebCore10RenderText13createTextBoxEv
+__ZN7WebCore12RenderInline19createInlineFlowBoxEv
+__ZN7WebCore12RenderInline13createFlowBoxEv
+__ZN7WebCore13InlineTextBox15isInlineTextBoxEv
+__ZNK7WebCore13InlineFlowBox15isInlineFlowBoxEv
+__ZNK7WebCore13InlineFlowBox17rendererLineBoxesEv
+__ZNK7WebCore9InlineBox16nextOnLineExistsEv
+__ZNK7WebCore13InlineTextBox11isLineBreakEv
+__ZNK7WebCore10RenderText5widthEjjibPN3WTF7HashSetIPKNS_14SimpleFontDataENS1_7PtrHashIS5_EENS1_10HashTraitsIS5_EEEE
+__ZNK7WebCore12RenderInline10lineHeightEbb
+__ZNK7WebCore12RenderInline25verticalPositionFromCacheEb
+__ZNK7WebCore9InlineBox15isRootInlineBoxEv
+__ZN7WebCore13InlineTextBox17takeFallbackFontsERN3WTF6VectorIPKNS_14SimpleFontDataELm0EEE
+__ZNK7WebCore10RenderText10lineHeightEbb
+__ZNK7WebCore8RenderBR10lineHeightEbb
+__ZNK7WebCore12RenderObject10lineHeightEbb
+__ZNK7WebCore8RenderBR16baselinePositionEbb
+__ZN7WebCore10RenderText15positionLineBoxEPNS_9InlineBoxE
+__ZN7WebCore17lineBreakIteratorEPKti
+__ZN7WebCoreL13setUpIteratorERbRPNS_17TextBreakIteratorE18UBreakIteratorTypePKti
+__ZN7WebCore24currentTextBreakLocaleIDEv
+__ZN7WebCore18textBreakFollowingEPNS_17TextBreakIteratorEi
+__ZN7WebCore9FontCache26getSimilarFontPlatformDataERKNS_4FontE
+__ZN3WTF7HashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expand
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehash
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13alloc
+__ZN7WebCore13WidthIterator21normalizeVoicingMarksEi
+__ZN7WebCore13InlineTextBox16setFallbackFontsERKN3WTF7HashSetIPKNS_14SimpleFontDataENS1_7PtrHashIS5_EENS1_10HashTraitsIS5_EEEE
+__ZN3WTF7HashMapIPN7WebCore13InlineTextBoxENS_6VectorIPKNS1_14SimpleFontDataELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EEC1ERKS5_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EEC2ERKS5_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EEaSERKS5_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EE15reserveCapacityEm
+__ZN3WTF9HashTableIPN7WebCore13InlineTextBoxESt4pairIS3_NS_6VectorIPKNS1_14SimpleFontDataELm0EEEENS_18PairFirstExtractorISA_EEN
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EE6shrinkEm
+__ZN7WebCore13InlineFlowBox10onEndChainEPNS_12RenderObjectE
+__ZNK7WebCore14RenderFieldset12avoidsFloatsEv
+__ZNK7WebCore14RenderFieldset28stretchesToMinIntrinsicWidthEv
+__ZN7WebCore14RenderFieldset14calcPrefWidthsEv
+__ZN7WebCore17RenderTextControl14calcPrefWidthsEv
+__ZNK7WebCore12RenderObject7isImageEv
+__ZN7WebCore14RenderMenuList14calcPrefWidthsEv
+__ZNK7WebCore14RenderThemeMac19minimumMenuListSizeEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac13menuListSizesEv
+__ZNK7WebCore14RenderThemeMac17sizeForSystemFontEPNS_11RenderStyleEPKNS_7IntSizeE
+__ZNK7WebCore14RenderThemeMac24controlSizeForSystemFontEPNS_11RenderStyleE
+__ZN7WebCore17RenderFlexibleBox14calcPrefWidthsEv
+__ZN7WebCore17RenderFlexibleBox24calcHorizontalPrefWidthsEv
+__ZNK7WebCore14RenderFieldset10findLegendEv
+__ZN7WebCore27RenderTextControlSingleLine6layoutEv
+__ZN7WebCore17RenderTextControl10calcHeightEv
+__ZNK7WebCore4Node9renderBoxEv
+__ZN7WebCore27RenderTextControlSingleLine36adjustControlHeightBasedOnLineHeightEi
+__ZNK7WebCore17RenderTextControl16innerTextElementEv
+__ZNK7WebCore17RenderTextControl15textBlockHeightEv
+__ZNK7WebCore27RenderTextControlSingleLine14textBlockWidthEv
+__ZNK7WebCore17RenderTextControl14textBlockWidthEv
+__ZNK7WebCore17RenderTextControl12avoidsFloatsEv
+__ZNK7WebCore4Node19rootEditableElementEv
+__ZN7WebCore11RenderLayer27updateScrollInfoAfterLayoutEv
+__ZN7WebCore11RenderLayer23computeScrollDimensionsEPbS1_
+__ZNK7WebCore11RenderBlock17rightmostPositionEbb
+__ZNK7WebCore11RenderBlock14lowestPositionEbb
+__ZN7WebCore11RenderLayer11scrollWidthEv
+__ZN7WebCore11RenderLayer12scrollHeightEv
+__ZNK7WebCore27RenderTextControlSingleLine14hasControlClipEv
+__ZN7WebCore17RenderFlexibleBox11layoutBlockEb
+__ZN7WebCore17RenderFlexibleBox19layoutHorizontalBoxEb
+__ZN7WebCore9RenderBox15setOverrideSizeEi
+__ZNK7WebCore17RenderFlexibleBox13isFlexibleBoxEv
+__ZNK7WebCore17RenderFlexibleBox20isStretchingChildrenEv
+__ZN7WebCore15FlexBoxIterator4nextEv
+__ZN7WebCore17RenderFlexibleBox10placeChildEPNS_9RenderBoxEii
+__ZN7WebCore17RenderFlexibleBox16allowedChildFlexEPNS_9RenderBoxEbj
+__ZNK7WebCore9RenderBox13overrideWidthEv
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEiNS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IiEEE3setERKS4_RKi
+__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10Ha
+__ZNK7WebCore17RenderFlexibleBox17isFlexingChildrenEv
+__ZNK7WebCore9RenderBox12overrideSizeEv
+__ZNK3WTF7HashMapIPKN7WebCore9RenderBoxEiNS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IiEEE3getERKS4_
+__ZN7WebCore13RootInlineBox7destroyEPNS_11RenderArenaE
+__ZN7WebCore13RootInlineBox17detachEllipsisBoxEPNS_11RenderArenaE
+__ZN7WebCore9InlineBox7destroyEPNS_11RenderArenaE
+__ZN7WebCore13RootInlineBoxD0Ev
+__ZN7WebCore9InlineBoxdlEPvm
+__ZN7WebCore13InlineTextBoxD0Ev
+__ZNK7WebCore14RenderMenuList14hasControlClipEv
+__ZNK7WebCore12RenderButton14hasControlClipEv
+__ZNK7WebCore11RenderTheme18isControlContainerENS_11ControlPartE
+__ZNK7WebCore11RenderBlock19lastLineBoxBaselineEv
+__ZN7WebCore13InlineFlowBox25adjustMaxAscentAndDescentERiS1_ii
+__ZN7WebCore11RenderBlock19setMaxBottomMarginsEii
+__ZNK7WebCore9RenderBox17rightmostPositionEbb
+__ZNK7WebCore20RenderBoxModelObject23relativePositionOffsetXEv
+__ZNK7WebCore9RenderBox14lowestPositionEbb
+__ZNK7WebCore20RenderBoxModelObject23relativePositionOffsetYEv
+__ZNK7WebCore4Font24floatWidthForComplexTextERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS4_7PtrHashIS8_EENS4_10HashTra
+__ZN7WebCore18CoreTextControllerC1EPKNS_4FontERKNS_7TextRunEbPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashT
+__ZN7WebCore18CoreTextControllerC2EPKNS_4FontERKNS_7TextRunEbPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashT
+__ZN7WebCore18CoreTextController19collectCoreTextRunsEv
+__ZN7WebCore18CoreTextController32collectCoreTextRunsForCharactersEPKtjjPKNS_14SimpleFontDataE
+__ZNK7WebCore14SimpleFontData21getCFStringAttributesEv
+__ZNK7WebCore14SimpleFontData9getCTFontEv
+__ZNK7WebCore16FontPlatformData15allowsLigaturesEv
+__ZN7WebCore18CoreTextController11CoreTextRunC1EPK7__CTRunPKNS_14SimpleFontDataEPKtjm
+__ZN7WebCore18CoreTextController11CoreTextRunC2EPK7__CTRunPKNS_14SimpleFontDataEPKtjm
+__ZN7WebCore18CoreTextController23adjustGlyphsAndAdvancesEv
+__ZNK7WebCore16FontPlatformData19roundsGlyphAdvancesEv
+__ZN3WTF6VectorItLm256EE6shrinkEm
+__ZN3WTF6VectorI6CGSizeLm256EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE6shrinkEm
+__ZN7WebCore18CoreTextController11CoreTextRunC1EPKNS_14SimpleFontDataEPKtjmb
+__ZN7WebCore18CoreTextController11CoreTextRunC2EPKNS_14SimpleFontDataEPKtjmb
+__ZN3WTF6VectorIlLm16EE6shrinkEm
+__ZN3WTF6VectorItLm256EE4fillERKtm
+__ZSt4fillIPttEvT_S1_RKT0_
+__ZN3WTF6VectorI6CGSizeLm256EE4fillERKS1_m
+__ZSt4fillIP6CGSizeS0_EvT_S2_RKT0_
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE5embedEN3WTF7Unicode9DirectionE
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE27raiseExplicitEmbeddingLevelEN3WTF7Unicode9DirectionES6_
+__ZN3WTF6VectorINS_7Unicode9DirectionELm8EE6shrinkEm
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE27lowerExplicitEmbeddingLevelEN3WTF7Unicode9DirectionE
+__ZN3WTF10RefCountedIN7WebCore11BidiContextEE5derefEv
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE11reverseRunsEjj
+__ZNK7WebCore9InlineBox16prevOnLineExistsEv
+__ZN7WebCore11RenderBlock20insertFloatingObjectEPNS_9RenderBoxE
+__ZN7WebCore21DeprecatedPtrListImplC1EPFvPvE
+__ZN7WebCore21DeprecatedPtrListImplC2EPFvPvE
+__ZN7WebCore21DeprecatedPtrListImpl6appendEPKv
+__ZN7WebCore21DeprecatedPtrListImpl6insertEjPKv
+__ZN7WebCore21DeprecatedPtrListImpl4lastEv
+__ZNK7WebCore21DeprecatedPtrListImpl7currentEv
+__ZNK7WebCore21DeprecatedPtrListImpl7getPrevEv
+__ZN7WebCore29DeprecatedPtrListImplIteratorC1ERKNS_21DeprecatedPtrListImplE
+__ZN7WebCore29DeprecatedPtrListImplIteratorC2ERKNS_21DeprecatedPtrListImplE
+__ZNK7WebCore21DeprecatedPtrListImpl11addIteratorEPNS_29DeprecatedPtrListImplIteratorE
+__ZNK7WebCore29DeprecatedPtrListImplIterator7currentEv
+__ZN7WebCore29DeprecatedPtrListImplIteratorppEv
+__ZN7WebCore29DeprecatedPtrListImplIteratorD1Ev
+__ZN7WebCore29DeprecatedPtrListImplIteratorD2Ev
+__ZNK7WebCore21DeprecatedPtrListImpl14removeIteratorEPNS_29DeprecatedPtrListImplIteratorE
+__ZN7WebCore21DeprecatedPtrListImpl4nextEv
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE6shrinkEm
+__ZNK7WebCore11RenderBlock33expandsToEncloseOverhangingFloatsEv
+__ZNK7WebCore12RenderObject10isFieldsetEv
+__ZN7WebCore11RenderBlock20addOverhangingFloatsEPS0_iib
+__ZN7WebCore11RenderBlock13containsFloatEPNS_12RenderObjectE
+__ZNK7WebCore12RenderObject26enclosingSelfPaintingLayerEv
+__ZN7WebCore11RenderBlock37markAllDescendantsWithFloatsForLayoutEPNS_9RenderBoxEb
+__ZN7WebCore11RenderBlock18addIntrudingFloatsEPS0_ii
+__ZN7WebCore21DeprecatedPtrListImpl5firstEv
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_11RenderBlock14FloatingObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE
+__ZN7WebCore7IntRect5uniteERKS0_
+__ZN7WebCore10RenderView10calcHeightEv
+__ZNK7WebCore10RenderView10viewHeightEv
+__ZN7WebCore11RenderBlock16setOverflowWidthEi
+__ZN7WebCore11RenderBlock17setOverflowHeightEi
+__ZNK7WebCore10RenderView8docWidthEv
+__ZNK7WebCore10RenderView9docHeightEv
+__ZNK7WebCore9RenderBox15availableHeightEv
+__ZNK7WebCore9RenderBox20availableHeightUsingERKNS_6LengthE
+__ZN7WebCore9FrameView19endDeferredRepaintsEv
+__ZNK7WebCore9FrameView28adjustedDeferredRepaintDelayEv
+__ZN7WebCore9FrameView18doDeferredRepaintsEv
+__ZNK7WebCore10ScrollView11isOffscreenEv
+__ZNK7WebCore10ScrollView19platformIsOffscreenEv
+__ZN7WebCore9FrameView26updateDeferredRepaintDelayEv
+__ZN7WebCore5Frame19invalidateSelectionEv
+__ZN7WebCore19SelectionController14setNeedsLayoutEb
+__ZN7WebCore9FrameView14adjustViewSizeEv
+__ZN7WebCore10ScrollView23platformSetContentsSizeEv
+__ZN7WebCore11RenderLayer20updateLayerPositionsEbb
+__ZN7WebCore9FrameView23repaintContentRectangleERKNS_7IntRectEb
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE15reserveCapacityEm
+__ZN7WebCore11RenderLayer19updateLayerPositionEv
+__ZNK7WebCore11RenderLayer20convertToLayerCoordsEPKS0_RiS3_
+__ZN7WebCore11RenderLayer24positionOverflowControlsEii
+__ZN7WebCore11RenderLayer15updateTransformEv
+__ZNK7WebCore9RenderBox23outlineBoundsForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore9RenderBox17borderBoundingBoxEv
+__ZNK7WebCore12RenderObject29adjustRectForOutlineAndShadowERNS_7IntRectE
+__ZNK7WebCore11RenderBlock22outlineStyleForRepaintEv
+__ZNK7WebCore12RenderObject20localToContainerQuadERKNS_9FloatQuadEPNS_20RenderBoxModelObjectEb
+__ZNK7WebCore10RenderView19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore14TransformState7flattenEv
+__ZNK7WebCore9FloatQuad11boundingBoxEv
+__ZNK7WebCore11RenderLayer29subtractScrolledContentOffsetERiS1_
+__ZNK7WebCore9RenderBox19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZNK7WebCore9RenderBox19offsetFromContainerEPNS_12RenderObjectE
+__ZNK7WebCore12RenderObject31shouldUseTransformFromContainerEPKS0_
+__ZN7WebCore14TransformState4moveEiiNS0_21TransformAccumulationE
+__ZNK7WebCore11RenderLayer27enclosingPositionedAncestorEv
+__ZN7WebCore10ScrollView23repaintContentRectangleERKNS_7IntRectEb
+__ZN7WebCore10ScrollView31platformRepaintContentRectangleERKNS_7IntRectEb
+__ZNK7WebCore7IntRectcv6CGRectEv
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE6shrinkEm
+__ZN7WebCore9FrameView22updateDashboardRegionsEv
+__ZNK7WebCore9FrameView15useSlowRepaintsEv
+__ZN7WebCore9FrameView22performPostLayoutTasksEv
+__ZN7WebCore11FrameLoader14didFirstLayoutEv
+__ZN7WebCore11FrameLoader30didFirstVisuallyNonEmptyLayoutEv
+__ZN7WebCore10RenderView21updateWidgetPositionsEv
+__ZN7WebCore9FrameView13updateWidgetsEv
+__ZN7WebCore5TimerINS_20ImageLoadEventSenderEE5firedEv
+__ZN7WebCore20ImageLoadEventSender10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore20ImageLoadEventSender25dispatchPendingLoadEventsEv
+__ZN7WebCore11ImageLoader24dispatchPendingLoadEventEv
+__ZN7WebCore15HTMLImageLoader17dispatchLoadEventEv
+__ZN7WebCore4Node13dispatchEventERKNS_12AtomicStringEbb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE6shrinkEm
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE6shrinkEm
+__ZN7WebCore9FrameView13paintContentsEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore8Document39invalidateRenderedRectsForMarkersInRectERKNS_7IntRectE
+__ZN7WebCore11RenderLayer5paintEPNS_15GraphicsContextERKNS_7IntRectENS_16PaintRestrictionEPNS_12RenderObjectE
+__ZN7WebCore11RenderLayer10paintLayerEPS0_PNS_15GraphicsContextERKNS_7IntRectEbNS_16PaintRestrictionEPNS_12RenderObjectEPN3WTF7
+__ZNK7WebCore4Node19virtualNamespaceURIEv
+__ZNK7WebCore11RenderLayer14calculateRectsEPKS0_RKNS_7IntRectERS3_S6_S6_S6_b
+__ZN7WebCore11RenderLayer24updateLayerListsIfNeededEv
+__ZN7WebCore11RenderLayer17updateZOrderListsEv
+__ZN7WebCore11RenderLayer13collectLayersERPN3WTF6VectorIPS0_Lm0EEES6_
+__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE15reserveCapacityEm
+__ZNSt17_Temporary_bufferIPPN7WebCore11RenderLayerES2_EC1ES3_S3_
+__ZNSt17_Temporary_bufferIPPN7WebCore11RenderLayerES2_EC2ES3_S3_
+__ZSt22__get_temporary_bufferIPN7WebCore11RenderLayerEESt4pairIPT_lElS5_
+__ZSt22__stable_sort_adaptiveIPPN7WebCore11RenderLayerES3_lPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt24__merge_sort_with_bufferIPPN7WebCore11RenderLayerES3_PFbS2_S2_EEvT_S6_T0_T1_
+__ZSt22__chunk_insertion_sortIPPN7WebCore11RenderLayerElPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt16__insertion_sortIPPN7WebCore11RenderLayerEPFbS2_S2_EEvT_S6_T0_
+__ZSt16__merge_adaptiveIPPN7WebCore11RenderLayerElS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
+__ZSt16__merge_backwardIPPN7WebCore11RenderLayerES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
+__ZSt23return_temporary_bufferIPN7WebCore11RenderLayerEEvPT_
+__ZN7WebCore11RenderLayer20updateNormalFlowListEv
+__ZNK7WebCore11RenderLayer20intersectsDamageRectERKNS_7IntRectES3_PKS0_
+__ZN7WebCoreL7setClipEPNS_15GraphicsContextERKNS_7IntRectES4_
+__ZN7WebCore10RenderView5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderBlock11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore10RenderView19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZN7WebCoreL11restoreClipEPNS_15GraphicsContextERKNS_7IntRectES4_
+__ZN7WebCore11RenderBlock13paintContentsERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderBlock13paintChildrenERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderBlock14paintSelectionERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore11RenderBlock24shouldPaintSelectionGapsEv
+__ZN7WebCore11RenderBlock11paintFloatsERNS_12RenderObject9PaintInfoEiib
+__ZN7WebCore11RenderBlock10paintCaretERNS_12RenderObject9PaintInfoEiiNS_9CaretTypeE
+__ZNK7WebCore5Frame19dragCaretControllerEv
+__ZN7WebCore11RenderBlock25paintContinuationOutlinesERNS_12RenderObject9PaintInfoEii
+__ZN7WebCoreL24continuationOutlineTableEv
+__ZNK7WebCore12RenderObject20hasOutlineAnnotationEv
+__ZNK7WebCore11RenderLayer15parentClipRectsEPKS0_RNS_9ClipRectsEb
+__ZN7WebCore11RenderLayer15updateClipRectsEPKS0_
+__ZNK7WebCore11RenderLayer18calculateClipRectsEPKS0_RNS_9ClipRectsEb
+__ZN7WebCore9ClipRectsnwEmPNS_11RenderArenaE
+__ZN7WebCoreL13compareZIndexEPNS_11RenderLayerES1_
+__ZSt25__unguarded_linear_insertIPPN7WebCore11RenderLayerES2_PFbS2_S2_EEvT_T0_T1_
+__ZSt17__merge_sort_loopIPPN7WebCore11RenderLayerES3_lPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt5mergeIPPN7WebCore11RenderLayerES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
+__ZN7WebCore11RenderBlock5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9RenderBox16pushContentsClipERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9RenderBox19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9RenderBox23paintRootBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9RenderBox15paintFillLayersERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOperatorE
+__ZN7WebCore9RenderBox14paintFillLayerERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOperatorE
+__ZN7WebCore20RenderBoxModelObject22paintFillLayerExtendedERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiPNS_
+__ZN7WebCore9FrameView18setContentIsOpaqueEb
+__ZNK7WebCore9FrameView19baseBackgroundColorEv
+__ZN7WebCore15GraphicsContext4saveEv
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE15reserveCapacityEm
+__ZN7WebCore15GraphicsContext17savePlatformStateEv
+__ZN7WebCore15GraphicsContext21setCompositeOperationENS_17CompositeOperatorE
+__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERKNS_5ColorE
+__ZNK7WebCore9FloatRectcv6CGRectEv
+__ZN7WebCore15GraphicsContext7restoreEv
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE6shrinkEm
+__ZN7WebCore15GraphicsContext20restorePlatformStateEv
+__ZNK7WebCore12RenderObject18maximalOutlineSizeENS_10PaintPhaseE
+__ZNK7WebCore7IntRect10intersectsERKS0_
+__ZNK7WebCore17RenderLineBoxList5paintEPNS_20RenderBoxModelObjectERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9InlineBox4rootEv
+__ZN7WebCore13RootInlineBox12selectionTopEv
+__ZN7WebCore13RootInlineBox5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineFlowBox5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineFlowBox19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineFlowBox20paintTextDecorationsERNS_12RenderObject9PaintInfoEiib
+__ZN7WebCore9InlineBox5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderReplaced5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderReplaced11shouldPaintERNS_12RenderObject9PaintInfoERiS4_
+__ZNK7WebCore14RenderReplaced10isSelectedEv
+__ZN7WebCore11RenderImage13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderImage5imageEii
+__ZNK7WebCore11CachedImage5imageEv
+__ZN7WebCore24RenderImageScaleObserver28shouldImagePaintAtLowQualityEPNS_11RenderImageERKNS_7IntSizeE
+__ZNK7WebCore11BitmapImage13isBitmapImageEv
+__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_7IntRectENS_17CompositeOperatorEb
+__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_7IntRectES5_NS_17CompositeOperatorEb
+__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_9FloatRectES5_NS_17CompositeOperatorEb
+__ZN7WebCore11BitmapImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
+__ZN7WebCore11BitmapImage14startAnimationEb
+__ZN7WebCore11BitmapImage13shouldAnimateEv
+__ZThn392_N7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
+__ZN7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
+__ZN7WebCore14CachedResource14setDecodedSizeEj
+__ZN7WebCore5Cache32insertInLiveDecodedResourcesListEPNS_14CachedResourceE
+__ZN7WebCore11BitmapImage21mayFillWithSolidColorEv
+__ZNK7WebCore11BitmapImage16currentFrameSizeEv
+__ZThn392_N7WebCore11CachedImage7didDrawEPKNS_5ImageE
+__ZN7WebCore11CachedImage7didDrawEPKNS_5ImageE
+__ZN7WebCore14CachedResource20didAccessDecodedDataEd
+__ZN7WebCore5Cache34removeFromLiveDecodedResourcesListEPNS_14CachedResourceE
+__ZNK7WebCore13RootInlineBox16paintEllipsisBoxERNS_12RenderObject9PaintInfoEii
+__ZN3WTF11ListHashSetIPN7WebCore12RenderInlineENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN7WebCore9RenderBox16overflowClipRectEii
+__ZNK7WebCore11RenderLayer22verticalScrollbarWidthEv
+__ZNK7WebCore11RenderLayer25horizontalScrollbarHeightEv
+__ZNK7WebCore11RenderLayer11boundingBoxEPKS0_
+__ZNK7WebCore11RenderLayer16localBoundingBoxEv
+__ZN7WebCore13InlineTextBox5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineTextBox14selectionStateEv
+__ZN7WebCore13InlineTextBox20paintDocumentMarkersEPNS_15GraphicsContextEiiPNS_11RenderStyleERKNS_4FontEb
+__ZN7WebCore8Document14markersForNodeEPNS_4NodeE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore4NodeEEEPSt4pairINS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEENS_7PtrHa
+__ZNK7WebCore13InlineTextBox7textPosEv
+__ZN7WebCore21updateGraphicsContextEPNS_15GraphicsContextERKNS_5ColorES4_f
+__ZN7WebCoreL20paintTextWithShadowsEPNS_15GraphicsContextERKNS_4FontERKNS_7TextRunEiiRKNS_8IntPointEiiiiPNS_10ShadowDataEb
+__ZN7WebCore15GraphicsContext8drawTextERKNS_4FontERKNS_7TextRunERKNS_8IntPointEii
+__ZNK7WebCore13RootInlineBox5blockEv
+__ZN7WebCore15GraphicsContext4clipERKNS_9FloatRectE
+__ZN7WebCore11RenderLayer21paintOverflowControlsEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore11RenderLayer17paintScrollCornerEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCoreL16scrollCornerRectEPKNS_11RenderLayerERKNS_7IntRectE
+__ZN7WebCore11RenderLayer12paintResizerEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore14RenderFieldset19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore11RenderBlock15borderFitAdjustERiS1_
+__ZN7WebCore20RenderBoxModelObject14paintBoxShadowEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
+__ZN7WebCore20RenderBoxModelObject11paintBorderEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
+__ZN7WebCore20RenderBoxModelObject19paintNinePieceImageEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleERKNS_14NinePieceImageENS_1
+__ZN7WebCore12RenderObject18drawLineForBoxSideEPNS_15GraphicsContextEiiiiNS_7BoxSideENS_5ColorERKS4_NS_12EBorderStyleEii
+__ZN7WebCore15GraphicsContext14setStrokeStyleERKNS_11StrokeStyleE
+__ZN7WebCore15GraphicsContext8drawRectERKNS_7IntRectE
+__ZNK7WebCore15GraphicsContext11strokeStyleEv
+__ZN7WebCore27RenderTextControlSingleLine5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderTheme5paintEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore15GraphicsContext20updatingControlTintsEv
+__ZN7WebCore11RenderTheme16paintDecorationsEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore11RenderTheme15paintBorderOnlyEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac14paintTextFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore27LocalCurrentGraphicsContextC1EPNS_15GraphicsContextE
+__ZN7WebCore27LocalCurrentGraphicsContextC2EPNS_15GraphicsContextE
+__ZNK7WebCore11RenderTheme9isEnabledEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme17isReadOnlyControlEPKNS_12RenderObjectE
+__ZN7WebCore27LocalCurrentGraphicsContextD1Ev
+__ZN7WebCore27LocalCurrentGraphicsContextD2Ev
+__ZN7WebCore9RenderBox15popContentsClipERNS_12RenderObject9PaintInfoENS_10PaintPhaseEii
+__ZN7WebCore14RenderThemeMac13paintMenuListEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac23setPopupButtonCellStateEPKNS_12RenderObjectERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac11popupButtonEv
+__ZNK7WebCore14RenderThemeMac16popupButtonSizesEv
+__ZN7WebCore14RenderThemeMac14setControlSizeEP6NSCellPKNS_7IntSizeERS4_f
+__ZN7WebCore14RenderThemeMac18updateCheckedStateEP6NSCellPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme15isIndeterminateEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isCheckedEPKNS_12RenderObjectE
+__ZN7WebCore14RenderThemeMac18updateEnabledStateEP6NSCellPKNS_12RenderObjectE
+__ZN7WebCore14RenderThemeMac18updatePressedStateEP6NSCellPKNS_12RenderObjectE
+__ZN7WebCore14RenderThemeMac18updateFocusedStateEP6NSCellPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isFocusedEPKNS_12RenderObjectE
+__ZNK7WebCore14RenderThemeMac18popupButtonMarginsEv
+__ZNK7WebCore14RenderThemeMac11inflateRectERKNS_7IntRectERKNS_7IntSizeEPKif
+__ZNK7WebCore14RenderMenuList15controlClipRectEii
+__ZNK7WebCore11RenderTheme24controlStatesForRendererEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isHoveredEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isPressedEPKNS_12RenderObjectE
+__ZThn128_NK7WebCore16HTMLInputElement9isCheckedEv
+__ZNK7WebCore16HTMLInputElement9isCheckedEv
+__ZNK7WebCore11RenderTheme8isActiveEPKNS_12RenderObjectE
+__ZThn128_NK7WebCore16HTMLInputElement15isIndeterminateEv
+__ZNK7WebCore16HTMLInputElement15isIndeterminateEv
+__ZNK7WebCore8ThemeMac5paintENS_11ControlPartEjPNS_15GraphicsContextERKNS_7IntRectEfPNS_10ScrollViewE
+__ZN7WebCoreL6buttonENS_11ControlPartEjRKNS_7IntRectEf
+__ZN7WebCoreL14setControlSizeEP6NSCellPKNS_7IntSizeERS3_f
+__ZN7WebCoreL12updateStatesEP6NSCellj
+__ZN7WebCoreL13buttonMarginsEm
+__ZN7WebCoreL11inflateRectERKNS_7IntRectERKNS_7IntSizeEPKif
+__ZNK7WebCore12RenderButton15controlClipRectEii
+__ZN7WebCore20CachedResourceClient14notifyFinishedEPNS_14CachedResourceE
+__ZNK7WebCore9Tokenizer10wellFormedEv
+__ZN7WebCore11FrameLoader15startIconLoaderEv
+__ZN7WebCore11FrameLoader7iconURLEv
+__ZN7WebCore12IconDatabase22loadDecisionForIconURLERKNS_6StringEPNS_14DocumentLoaderE
+__ZN7WebCore11FrameLoader27commitIconURLToIconDatabaseERKNS_4KURLE
+__ZN7WebCore12IconDatabase20setIconURLForPageURLERKNS_6StringES3_
+__ZNK7WebCore11FrameLoader18originalRequestURLEv
+__ZN7WebCore12IconDatabase23iconDataKnownForIconURLERKNS_6StringE
+__ZN7WebCore19AnimationController16resumeAnimationsEPNS_8DocumentE
+__ZN7WebCore26AnimationControllerPrivate16resumeAnimationsEPNS_8DocumentE
+__ZN7WebCore26AnimationControllerPrivate20updateAnimationTimerEb
+__ZN7WebCore11ImageLoader25dispatchPendingLoadEventsEv
+__ZN7WebCore8Document17dispatchLoadEventEv
+__ZN7WebCore9DOMWindow17dispatchLoadEventEv
+__ZN7WebCore15JSEventListener11handleEventEPNS_5EventEb
+__ZNK7WebCore15JSEventListener10jsFunctionEv
+__ZNK7WebCore15JSDOMWindowBase22scriptExecutionContextEv
+__ZThn88_NK7WebCore8Document10isDocumentEv
+__ZNK7WebCore8Document10isDocumentEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_5EventE
+__ZNK7WebCore5Event9isUIEventEv
+__ZNK7WebCore5Event15isMutationEventEv
+__ZNK7WebCore5Event15isOverflowEventEv
+__ZNK7WebCore5Event14isMessageEventEv
+__ZNK7WebCore5Event15isProgressEventEv
+__ZNK7WebCore5Event14isStorageEventEv
+__ZNK7WebCore5Event22isWebKitAnimationEventEv
+__ZNK7WebCore5Event23isWebKitTransitionEventEv
+__ZN7WebCore7JSEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN3JSC9Structure6createENS_7JSValueERKNS_8TypeInfoE
+__ZN7WebCore7JSEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5EventEEE
+__ZN7WebCore7JSEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5EventEEE
+__ZNK7WebCore17JSDOMGlobalObject12currentEventEv
+__ZN7WebCore17JSDOMGlobalObject15setCurrentEventEPNS_5EventE
+__ZN7WebCore14JSHTMLDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14JSHTMLDocument18canGetItemsForNameEPN3JSC9ExecStateEPNS_12HTMLDocumentERKNS1_10IdentifierE
+__ZN7WebCore12AtomicString4findERKN3JSC10IdentifierE
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E4findINS1_17
+__ZN7WebCore23JSHTMLDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsDocumentPrototypeFunctionGetElementByIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK3JSC6JSCell8isObjectEPKNS_9ClassInfoE
+__ZNK7WebCore14JSHTMLDocument9classInfoEv
+__ZNK7WebCore8Document14getElementByIdERKNS_12AtomicStringE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN7WebCoreL29createHTMLInputElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLInputElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLInputElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLInputElementEEE
+__ZN7WebCore18JSHTMLInputElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLInputElementEEE
+__ZN7WebCore18JSHTMLInputElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13JSHTMLElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSHTMLInputElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSHTMLElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore31jsElementPrototypeFunctionFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSHTMLInputElement9classInfoEv
+__ZN7WebCore7Element5focusEb
+__ZN7WebCore8Document36updateLayoutIgnorePendingStylesheetsEv
+__ZN7WebCore8Document12updateLayoutEv
+__ZNK7WebCore22HTMLFormControlElement13supportsFocusEv
+__ZNK7WebCore22HTMLFormControlElement11isFocusableEv
+__ZN7WebCore15FocusController14setFocusedNodeEPNS_4NodeEN3WTF10PassRefPtrINS_5FrameEEE
+__ZN7WebCore15FocusController15setFocusedFrameEN3WTF10PassRefPtrINS_5FrameEEE
+__ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore16HTMLInputElement18dispatchFocusEventEv
+__ZN7WebCore12InputElement18dispatchFocusEventERNS_16InputElementDataEPNS_8DocumentE
+__ZN7WebCore12InputElement27updatePlaceholderVisibilityERNS_16InputElementDataEPNS_8DocumentEb
+__ZThn128_NK7WebCore16HTMLInputElement15isPasswordFieldEv
+__ZNK7WebCore16HTMLInputElement15isPasswordFieldEv
+__ZN7WebCore4Node18dispatchFocusEventEv
+__ZN7WebCore16HTMLInputElement23preDispatchEventHandlerEPNS_5EventE
+__ZN7WebCore15HTMLFormElement17handleLocalEventsEPNS_5EventEb
+__ZN7WebCore4Node6toNodeEv
+__ZN7WebCore16HTMLInputElement24postDispatchEventHandlerEPNS_5EventEPv
+__ZN7WebCore16HTMLInputElement19defaultEventHandlerEPNS_5EventE
+__ZNK7WebCore5Event25isBeforeTextInsertedEventEv
+__ZNK7WebCore5Event12isMouseEventEv
+__ZNK7WebCore5Event11isDragEventEv
+__ZNK7WebCore5Event12isWheelEventEv
+__ZN7WebCore27RenderTextControlSingleLine12forwardEventEPNS_5EventE
+__ZN7WebCore27RenderTextControlSingleLine27capsLockStateMayHaveChangedEv
+__ZN7WebCore17RenderTextControl12forwardEventEPNS_5EventE
+__ZN7WebCore4Node15dispatchUIEventERKNS_12AtomicStringEiN3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore7UIEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEi
+__ZN7WebCore7UIEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEi
+__ZN7WebCore5Event18setUnderlyingEventEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCore7UIEventD0Ev
+__ZN7WebCore5EventD2Ev
+__ZN7WebCore13ContainerNode8setFocusEb
+__ZN7WebCore4Node8setFocusEb
+__ZN7WebCore14focusRingColorEv
++[WebCoreControlTintObserver controlTintDidChange]
+__ZN7WebCore26usesTestModeFocusRingColorEv
+__ZNK7WebCore14SVGRenderStyle17inheritedNotEqualEPKS0_
+__ZN7WebCore14RenderThemeMac17adjustRepaintRectEPKNS_12RenderObjectERNS_7IntRectE
+__ZN7WebCoreL13widgetForNodeEPNS_4NodeE
+__ZNK7WebCore12RenderObject8isWidgetEv
+__ZN7WebCore6Widget8setFocusEv
+__ZN7WebCore5Frame14frameForWidgetEPKNS_6WidgetE
+__ZN7WebCore12RenderWidget4findEPKNS_6WidgetE
+__ZN7WebCoreL17widgetRendererMapEv
+__ZNK3WTF7HashMapIPKN7WebCore6WidgetEPNS1_12RenderWidgetENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+-[NSScrollView(WebCoreView) _webcore_effectiveFirstResponder]
+-[NSClipView(WebCoreView) _webcore_effectiveFirstResponder]
+-[NSView(WebCoreView) _webcore_effectiveFirstResponder]
+__ZN7WebCore6Chrome11focusNSViewEP6NSView
+__ZNK7WebCore16HTMLInputElement20shouldUseInputMethodEv
+__ZN7WebCore8Document27cancelFocusAppearanceUpdateEv
+__ZN7WebCore16HTMLInputElement21updateFocusAppearanceEb
+__ZN7WebCore12InputElement21updateFocusAppearanceERNS_16InputElementDataEPNS_8DocumentEb
+__ZThn128_N7WebCore16HTMLInputElement6selectEv
+__ZN7WebCore16HTMLInputElement6selectEv
+__ZN7WebCore17RenderTextControl6selectEv
+__ZN7WebCore17RenderTextControl17setSelectionRangeEii
+__ZN7WebCore17RenderTextControl23visiblePositionForIndexEi
+__ZN7WebCore15VisiblePositionC1EPNS_4NodeEiNS_9EAffinityE
+__ZN7WebCore15VisiblePositionC2EPNS_4NodeEiNS_9EAffinityE
+__ZN7WebCore8PositionC1EN3WTF10PassRefPtrINS_4NodeEEEi
+__ZN7WebCore8PositionC2EN3WTF10PassRefPtrINS_4NodeEEEi
+__ZN7WebCore8Position34anchorTypeForLegacyEditingPositionEPNS_4NodeEi
+__ZN7WebCore21editingIgnoresContentEPKNS_4NodeE
+__ZN7WebCore25canHaveChildrenForEditingEPKNS_4NodeE
+__ZN7WebCore15VisiblePosition4initERKNS_8PositionENS_9EAffinityE
+__ZN7WebCore15VisiblePosition17canonicalPositionERKNS_8PositionE
+__ZNK7WebCore8Position8upstreamEv
+__ZN7WebCoreL23enclosingVisualBoundaryEPNS_4NodeE
+__ZN7WebCoreL38endsOfNodeAreVisuallyDistinctPositionsEPNS_4NodeE
+__ZNK7WebCore13ContainerNode9childNodeEj
+__ZNK7WebCore16PositionIterator7atStartEv
+__ZNK7WebCore16PositionIteratorcvNS_8PositionEEv
+__ZNK7WebCore8Position11isCandidateEv
+__ZN7WebCore14isTableElementEPNS_4NodeE
+__ZN7WebCore8Position44hasRenderedNonAnonymousDescendantsWithHeightEPNS_12RenderObjectE
+__ZNK7WebCore12RenderObject27nextInPreOrderAfterChildrenEv
+__ZNK7WebCore8Position29atFirstEditingPositionForNodeEv
+__ZN7WebCore8Position20nodeIsUserSelectNoneEPNS_4NodeE
+__ZN7WebCore16VisibleSelectionC1ERKNS_15VisiblePositionES3_
+__ZN7WebCore16VisibleSelectionC2ERKNS_15VisiblePositionES3_
+__ZN7WebCore16VisibleSelection8validateEv
+__ZN7WebCore16VisibleSelection33setBaseAndExtentToDeepEquivalentsEv
+__ZN7WebCore15VisiblePositionC1ERKNS_8PositionENS_9EAffinityE
+__ZN7WebCore15VisiblePositionC2ERKNS_8PositionENS_9EAffinityE
+__ZN7WebCore16comparePositionsERKNS_8PositionES2_
+__ZN7WebCore5Range21compareBoundaryPointsEPNS_4NodeEiS2_i
+__ZN7WebCore16VisibleSelection52setStartAndEndFromBaseAndExtentRespectingGranularityEv
+__ZN7WebCore16VisibleSelection47adjustSelectionToAvoidCrossingEditingBoundariesEv
+__ZN7WebCore19highestEditableRootERKNS_8PositionE
+__ZN7WebCore23editableRootForPositionERKNS_8PositionE
+__ZN7WebCore22lowestEditableAncestorEPNS_4NodeE
+__ZN7WebCore16VisibleSelection19updateSelectionTypeEv
+__ZN7WebCore5Frame22setFocusedNodeIfNeededEv
+__ZNK7WebCore16VisibleSelection19rootEditableElementEv
+__ZNK7WebCore23TextControlInnerElement16isMouseFocusableEv
+__ZNK7WebCore16HTMLInputElement16isMouseFocusableEv
+__ZNK7WebCore15VisiblePosition14localCaretRectERPNS_12RenderObjectE
+__ZNK7WebCore8Position21getInlineBoxAndOffsetENS_9EAffinityERPNS_9InlineBoxERi
+__ZNK7WebCore8Position21getInlineBoxAndOffsetENS_9EAffinityENS_13TextDirectionERPNS_9InlineBoxERi
+__ZN7WebCore11RenderBlock14localCaretRectEPNS_9InlineBoxEiPi
+__ZNK7WebCore19SelectionController22caretRendersInsideNodeEPNS_4NodeE
+__ZNK7WebCore19SelectionController16caretRepaintRectEv
+__ZNK7WebCore11RenderTheme18caretBlinkIntervalEv
+__ZN7WebCore19SelectionController41selectFrameElementInParentIfFullySelectedEv
+__ZN7WebCore5Frame31notifyRendererOfSelectionChangeEb
+__ZN7WebCore17RenderTextControl16selectionChangedEb
+__ZN7WebCore17RenderTextControl12selectionEndEv
+__ZN7WebCore17RenderTextControl23indexForVisiblePositionERKNS_15VisiblePositionE
+__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEE
+__ZN7WebCore8Document11attachRangeEPNS_5RangeE
+__ZN3WTF7HashSetIPN7WebCore5RangeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN7WebCore5Range8setStartEN3WTF10PassRefPtrINS_4NodeEEEiRi
+__ZNK7WebCore5Range16checkNodeWOffsetEPNS_4NodeEiRi
+__ZN7WebCore5Range8collapseEbRi
+__ZN7WebCore5Range6setEndEN3WTF10PassRefPtrINS_4NodeEEEiRi
+__ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
+__ZN7WebCore12TextIteratorC1EPKNS_5RangeEbb
+__ZN7WebCore12TextIteratorC2EPKNS_5RangeEbb
+__ZNK7WebCore5Range9firstNodeEv
+__ZNK7WebCore4Node18offsetInCharactersEv
+__ZNK7WebCore5Range12pastLastNodeEv
+__ZN7WebCore12TextIterator7advanceEv
+__ZN7WebCore12TextIterator23representNodeOffsetZeroEv
+__ZN7WebCoreL23shouldEmitTabBeforeNodeEPNS_4NodeE
+__ZN7WebCore11isTableCellEPKNS_4NodeE
+__ZN7WebCoreL27shouldEmitNewlineBeforeNodeEPNS_4NodeE
+__ZN7WebCoreL36shouldEmitNewlinesBeforeAndAfterNodeEPNS_4NodeE
+__ZN7WebCore12TextIterator29shouldRepresentNodeOffsetZeroEv
+__ZN7WebCore5RangeD1Ev
+__ZN7WebCore5RangeD2Ev
+__ZN7WebCore8Document11detachRangeEPNS_5RangeE
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Iden
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalid
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore17RenderTextControl14selectionStartEv
+__ZN7WebCore27RenderTextControlSingleLine14cacheSelectionEii
+__ZThn128_N7WebCore16HTMLInputElement14cacheSelectionEii
+__ZN7WebCore16HTMLInputElement14cacheSelectionEii
+__ZN7WebCore5Frame25respondToChangedSelectionERKNS_16VisibleSelectionEb
+__ZN7WebCore6Editor32isContinuousSpellCheckingEnabledEv
+__ZN7WebCore6Editor24isGrammarCheckingEnabledEv
+__ZN7WebCore9endOfWordERKNS_15VisiblePositionENS_9EWordSideE
+__ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCore14endOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCoreL28renderedAsNonInlineTableOrHREPNS_12RenderObjectE
+__ZN7WebCore14enclosingBlockEPNS_4NodeE
+__ZN7WebCore19enclosingNodeOfTypeERKNS_8PositionEPFbPKNS_4NodeEEb
+__ZN7WebCore17isContentEditableEPKNS_4NodeE
+__ZN7WebCore7isBlockEPKNS_4NodeE
+__ZN7WebCore11startOfWordERKNS_15VisiblePositionENS_9EWordSideE
+__ZN7WebCoreL16previousBoundaryERKNS_15VisiblePositionEPFjPKtjjNS_33BoundarySearchContextAvailabilityERbE
+__ZNK7WebCore4Node25enclosingBlockFlowElementEv
+__ZNK7WebCore4Node11isBlockFlowEv
+__ZN7WebCore24rangeCompliantEquivalentERKNS_8PositionE
+__ZNK7WebCore15VisiblePosition8previousEb
+__ZN7WebCore33previousVisuallyDistinctCandidateERKNS_8PositionE
+__ZNK7WebCore8Position10downstreamEv
+__ZNK7WebCore16PositionIterator5atEndEv
+__ZN7WebCore20lastOffsetForEditingEPKNS_4NodeE
+__ZNK7WebCore8Position13atStartOfTreeEv
+__ZNK7WebCore15VisiblePosition14characterAfterEv
+__ZN7WebCore31SimplifiedBackwardsTextIteratorC1EPKNS_5RangeE
+__ZN7WebCore31SimplifiedBackwardsTextIteratorC2EPKNS_5RangeE
+__ZNK7WebCore13ContainerNode14childNodeCountEv
+__ZN7WebCore31SimplifiedBackwardsTextIterator7advanceEv
+__ZNK7WebCore31SimplifiedBackwardsTextIterator5rangeEv
+__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEENS2_INS_4NodeEEEiS6_i
+__ZNK7WebCore16VisibleSelection17toNormalizedRangeEv
+__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEERKNS_8PositionES7_
+__ZN7WebCore8Document13removeMarkersEPNS_5RangeENS_14DocumentMarker10MarkerTypeE
+__ZN7WebCore8Document13removeMarkersENS_14DocumentMarker10MarkerTypeE
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore4NodeEEESt4pairIS4_PS5_INS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEEE
+__ZN7WebCore6Editor25respondToChangedSelectionERKNS_16VisibleSelectionE
+__ZNK7WebCore6Editor16fontForSelectionERb
+__ZNK7WebCore5Frame22styleForSelectionStartERPNS_4NodeE
+__ZN7WebCore22DeleteButtonController25respondToChangedSelectionERKNS_16VisibleSelectionE
+__ZN7WebCoreL25enclosingDeletableElementERKNS_16VisibleSelectionE
+__ZNK7WebCore5Range23commonAncestorContainerERi
+__ZN7WebCore5Range23commonAncestorContainerEPNS_4NodeES2_
+__ZN7WebCoreL18isDeletableElementEPKNS_4NodeE
+__ZN7WebCore19SelectionController37notifyAccessibilityForSelectionChangeEv
+__ZN7WebCore5Frame15revealSelectionERKNS_15ScrollAlignmentEb
+__ZN7WebCore19SelectionController19absoluteCaretBoundsEv
+__ZN7WebCore11RenderLayer19scrollRectToVisibleERKNS_7IntRectEbRKNS_15ScrollAlignmentES6_
+__ZNK7WebCore12RenderObject15localToAbsoluteENS_10FloatPointEbb
+__ZN7WebCore11RenderLayer15getRectToExposeERKNS_7IntRectES3_RKNS_15ScrollAlignmentES6_
+__ZNK7WebCore9RenderBox28canBeProgramaticallyScrolledEb
+__ZN7WebCore9FrameView29scrollRectIntoViewRecursivelyERKNS_7IntRectE
+__ZN7WebCore10ScrollView29scrollRectIntoViewRecursivelyERKNS_7IntRectE
+__ZN7WebCore10ScrollView17setScrollPositionERKNS_8IntPointE
+__ZN7WebCore10ScrollView25platformSetScrollPositionERKNS_8IntPointE
+__ZN7WebCore12EventHandler15sendScrollEventEv
+__ZN7WebCore9FrameView20setWasScrolledByUserEb
+__ZNK7WebCore11RenderBlock17offsetForContentsERiS1_
+__ZNK7WebCore11RenderLayer24addScrolledContentOffsetERiS1_
+__ZNK7WebCore5Frame10paintCaretEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore19SelectionController10paintCaretEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore12RenderObject12paintOutlineEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleE
+__ZNK7WebCore11RenderTheme17supportsFocusRingEPKNS_11RenderStyleE
+__ZN7WebCore15GraphicsContext13initFocusRingEii
+__ZN7WebCore15GraphicsContext14clearFocusRingEv
+__ZN7WebCore17RenderTextControl17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore15GraphicsContext16addFocusRingRectERKNS_7IntRectE
+__ZN7WebCore15GraphicsContext13drawFocusRingERKNS_5ColorE
+__ZNK7WebCore15GraphicsContext14focusRingWidthEv
+__ZNK7WebCore15GraphicsContext15focusRingOffsetEv
+__ZN7WebCore13createCGColorERKNS_5ColorE
+__ZN7WebCore7nsColorERKNS_5ColorE
+__ZN7WebCoreL18CGColorFromNSColorEP7NSColor
+__ZNK7WebCore15GraphicsContext14focusRingRectsEv
+__ZNK7WebCore9FrameView10hostWindowEv
+__ZNK7WebCore6Chrome18scrollRectIntoViewERKNS_7IntRectEPKNS_10ScrollViewE
+__ZN3WTF6VectorIN3JSC8RegisterELm8EE6shrinkEm
+__ZN7WebCore20jsDOMWindowNavigatorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9navigatorEv
+__ZN7WebCore9NavigatorC1EPNS_5FrameE
+__ZN7WebCore9NavigatorC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9NavigatorE
+__ZN7WebCore11JSNavigator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSNavigatorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9NavigatorEEE
+__ZN7WebCore11JSNavigatorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9NavigatorEEE
+__ZN7WebCore11JSNavigator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsNavigatorLanguageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator8languageEv
+__ZN7WebCore15defaultLanguageEv
+__ZN7WebCore16jsDocumentCookieEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document6cookieEv
+__ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
+__ZN7WebCoreL13filterCookiesEP7NSArray
+__ZN7WebCore19JSHTMLSelectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore27setJSHTMLSelectElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26valueToStringWithNullCheckEPN3JSC9ExecStateENS0_7JSValueE
+__ZN7WebCore17HTMLSelectElement8setValueERKNS_6StringE
+__ZNK7WebCore17HTMLOptionElement5valueEv
+__ZN7WebCore13OptionElement18collectOptionValueERKNS_17OptionElementDataEPNS_8DocumentE
+__ZN3WTF6VectorIbLm0EE6shrinkEm
+__ZN7WebCore11FrameLoader19handledOnloadEventsEv
+__ZN7WebCore8Document13svgExtensionsEv
+__ZNK7WebCore14DocumentLoader16isLoadingPlugInsEv
+__ZNK7WebCore8Document16isPluginDocumentEv
+__ZNK7WebCore8Document15isImageDocumentEv
+__Z3kitPN7WebCore8DocumentE
+__Z3kitPN7WebCore4NodeE
+__Z8kitClassPN7WebCore4NodeE
+-[DOMDocument getElementsByTagName:]
+__ZN7WebCore4Node20getElementsByTagNameERKNS_6StringE
+__ZN7WebCore4Node22getElementsByTagNameNSERKNS_12AtomicStringERKNS_6StringE
+__ZN7WebCore4Node14createRareDataEv
+__ZN7WebCore15DynamicNodeList6CachesC1Ev
+__ZN7WebCore15DynamicNodeList6CachesC2Ev
+__ZN3WTF7HashMapIN7WebCore13QualifiedNameEPNS1_15DynamicNodeList6CachesENS1_17QualifiedNameHashENS_10HashTraitsIS2_EENS7_IS5_EE
+__ZN3WTF9HashTableIN7WebCore13QualifiedNameESt4pairIS2_PNS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_17Qualif
+__ZN7WebCore11TagNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_12AtomicStringES7_PNS_15DynamicNodeList6CachesE
+__ZN7WebCore11TagNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_12AtomicStringES7_PNS_15DynamicNodeList6CachesE
+__ZN7WebCore15DynamicNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEPNS0_6CachesE
+__ZN7WebCore4Node23registerDynamicNodeListEPNS_15DynamicNodeListE
+__Z3kitPN7WebCore8NodeListE
+-[DOMNodeList length]
+__ZNK7WebCore15DynamicNodeList6lengthEv
+__ZNK7WebCore11TagNodeList11nodeMatchesEPNS_7ElementE
+-[DOMNodeList item:]
+__ZNK7WebCore15DynamicNodeList4itemEj
+__ZNK7WebCore15DynamicNodeList23itemForwardsFromCurrentEPNS_4NodeEji
+__ZN7WebCoreL12elementClassERKNS_13QualifiedNameEP10objc_class
+__ZN7WebCoreL15addElementClassERKNS_13QualifiedNameEP10objc_class
+__ZN3WTF7HashMapIPKN7WebCore13QualifiedName17QualifiedNameImplEP10objc_classNS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3s
+__ZN3WTF9HashTableIPKN7WebCore13QualifiedName17QualifiedNameImplESt4pairIS5_P10objc_classENS_18PairFirstExtractorIS9_EENS_7PtrH
+__ZN7WebCoreL18lookupElementClassERKNS_13QualifiedNameE
+__ZNK3WTF7HashMapIPKN7WebCore13QualifiedName17QualifiedNameImplEP10objc_classNS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3
+-[DOMNode attributes]
+__ZNK7WebCore7Element10attributesEv
+__Z3kitPN7WebCore12NamedNodeMapE
+-[DOMNamedNodeMap getNamedItem:]
+__ZNK7WebCore12NamedNodeMap12getNamedItemERKNS_6StringE
+__ZNK7WebCore12NamedNodeMap16getAttributeItemERKNS_6StringEb
+__ZNK7WebCore13QualifiedName8toStringEv
+__ZN7WebCore9Attribute18createAttrIfNeededEPNS_7ElementE
+__ZN7WebCore4AttrC1EPNS_7ElementEPNS_8DocumentEN3WTF10PassRefPtrINS_9AttributeEEE
+__ZN7WebCore4AttrC2EPNS_7ElementEPNS_8DocumentEN3WTF10PassRefPtrINS_9AttributeEEE
+__ZN7WebCore4Attr15createTextChildEv
+__ZN7WebCore8Document14createTextNodeERKNS_6StringE
+__ZNK7WebCore4Attr8nodeTypeEv
+-[DOMNode nodeValue]
+__ZNK7WebCore4Attr9nodeValueEv
+__ZNK7WebCore11HistoryItem20getTransientPropertyERKNS_6StringE
+__ZN7WebCore15ProgressTracker17progressCompletedEPNS_5FrameE
+__ZN7WebCore15ProgressTracker21finalProgressCompleteEv
+-[DOMNode dealloc]
+__ZThn8_N7WebCore4AttrD0Ev
+__ZN7WebCore4AttrD0Ev
+-[DOMObject dealloc]
+__Z16removeDOMWrapperP17DOMObjectInternal
+-[WebScriptObject dealloc]
+-[DOMNamedNodeMap dealloc]
+-[DOMNodeList dealloc]
+__ZN7WebCore11TagNodeListD0Ev
+__ZN7WebCore15DynamicNodeListD2Ev
+__ZN7WebCore4Node25unregisterDynamicNodeListEPNS_15DynamicNodeListE
+__ZNK7WebCore19SelectionController17isInPasswordFieldEv
+__ZN7WebCore6Loader4HostD0Ev
+-[DOMDocument forms]
+__ZN7WebCore8Document5formsEv
+__ZN7WebCore14HTMLCollection6createEN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeE
+__ZN7WebCore14HTMLCollectionC1EN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeE
+__ZN7WebCore14HTMLCollectionC2EN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeE
+__Z3kitPN7WebCore14HTMLCollectionE
+__Z8kitClassPN7WebCore14HTMLCollectionE
+-[DOMHTMLCollection length]
+__ZNK7WebCore14HTMLCollection6lengthEv
+__ZNK7WebCore14HTMLCollection19resetCollectionInfoEv
+__ZNK7WebCore14HTMLCollection10calcLengthEv
+__ZNK7WebCore14HTMLCollection9itemAfterEPNS_7ElementE
+__ZN7WebCoreL17nextNodeOrSiblingEPNS_4NodeES1_b
+-[DOMHTMLCollection item:]
+__ZNK7WebCore14HTMLCollection4itemEj
+-[DOMHTMLFormElement elements]
+__ZN7WebCore15HTMLFormElement8elementsEv
+__ZN7WebCore18HTMLFormCollection6createEN3WTF10PassRefPtrINS_15HTMLFormElementEEE
+__ZN7WebCore18HTMLFormCollectionC1EN3WTF10PassRefPtrINS_15HTMLFormElementEEE
+__ZN7WebCore18HTMLFormCollectionC2EN3WTF10PassRefPtrINS_15HTMLFormElementEEE
+__ZN7WebCore14HTMLCollectionC2EN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeEPNS_15CollectionCacheE
+__ZNK7WebCore18HTMLFormCollection10calcLengthEv
+__ZNK7WebCore15HTMLFormElement6lengthEv
+__ZNK7WebCore22HTMLFormControlElement14isEnumeratableEv
+__ZNK7WebCore16HTMLInputElement14isEnumeratableEv
+__ZNK7WebCore17HTMLSelectElement14isEnumeratableEv
+__ZNK7WebCore18HTMLFormCollection4itemEj
+-[DOMHTMLInputElement(FormAutoFillTransition) _isTextField]
+__Z4coreP19DOMHTMLInputElement
+__ZNK7WebCore5Frame11currentFormEv
+__Z3kitPN7WebCore7ElementE
+__Z4coreP10DOMElement
+-[DOMElement offsetWidth]
+__ZN7WebCore7Element11offsetWidthEv
+__ZNK7WebCore4Node20renderBoxModelObjectEv
+__ZNK7WebCore20RenderBoxModelObject16isBoxModelObjectEv
+__ZNK7WebCore9RenderBox11offsetWidthEv
+__ZN7WebCoreL21adjustForAbsoluteZoomEiPNS_12RenderObjectE
+-[DOMElement offsetHeight]
+__ZN7WebCore7Element12offsetHeightEv
+__ZNK7WebCore9RenderBox12offsetHeightEv
+-[DOMNode ownerDocument]
+-[DOMDocument getComputedStyle:pseudoElement:]
+__ZNK7WebCore9DOMWindow16getComputedStyleEPNS_7ElementERKNS_6StringE
+__ZN7WebCore27CSSComputedStyleDeclarationC1EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore27CSSComputedStyleDeclarationC2EN3WTF10PassRefPtrINS_4NodeEEE
+__Z3kitPN7WebCore19CSSStyleDeclarationE
+-[DOMCSSStyleDeclaration getPropertyValue:]
+__ZN7WebCore19CSSStyleDeclaration16getPropertyValueERKNS_6StringE
+__ZN7WebCore13cssPropertyIDERKNS_6StringE
+__ZNK7WebCore27CSSComputedStyleDeclaration16getPropertyValueEi
+__ZNK7WebCore27CSSComputedStyleDeclaration19getPropertyCSSValueEi
+__ZNK7WebCore27CSSComputedStyleDeclaration19getPropertyCSSValueEiNS_13EUpdateLayoutE
+__ZN7WebCore7Element13computedStyleEv
+__ZNK7WebCore17CSSPrimitiveValue7cssTextEv
+__ZN7WebCore17CSSPrimitiveValueD0Ev
+__ZN7WebCore17CSSPrimitiveValue7cleanupEv
+__ZNK7WebCore16HTMLInputElement12autoCompleteEv
+-[DOMHTMLCollection dealloc]
+__ZN7WebCore14HTMLCollectionD0Ev
+-[DOMCSSStyleDeclaration dealloc]
+__ZN7WebCore27CSSComputedStyleDeclarationD0Ev
+__ZN7WebCore18HTMLFormCollectionD0Ev
+__ZN7WebCore14HTMLCollectionD2Ev
+__ZNK7WebCore4Font15drawComplexTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZN7WebCore18CoreTextController7advanceEjPNS_11GlyphBufferE
+__ZN7WebCore5Frame20caretBlinkTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore11HistoryItemC1ERKNS_6StringES3_d
+__ZN7WebCore11HistoryItemC2ERKNS_6StringES3_d
+__ZN7WebCore11HistoryItem18recordInitialVisitEv
+__ZN3WTF6VectorIiLm0EE14expandCapacityEmPKi
+__ZN3WTF6VectorIiLm0EE14expandCapacityEm
+__ZN3WTF6VectorIiLm0EE15reserveCapacityEm
+__ZNK7WebCore11HistoryItem10visitCountEv
+__ZN7WebCore13ScriptElement21handleSourceAttributeERNS_17ScriptElementDataERKNS_6StringE
+__ZNK7WebCore17ScriptElementData18ignoresLoadRequestEv
+__ZN7WebCore9DocLoader13requestScriptERKNS_6StringES3_
+__ZN7WebCore12CachedScriptC1ERKNS_6StringES3_
+__ZN7WebCore12CachedScriptC2ERKNS_6StringES3_
+__ZN7WebCore17DOMImplementation13isXMLMIMETypeERKNS_6StringE
+__ZN7WebCore17RegularExpressionC1ERKNS_6StringENS_19TextCaseSensitivityE
+__ZN7WebCore17RegularExpressionC2ERKNS_6StringENS_19TextCaseSensitivityE
+__ZNK7WebCore17RegularExpression5matchERKNS_6StringEiPi
+__ZN3WTF5DequeIN7WebCore20CachedResourceHandleINS1_12CachedScriptEEEE14expandCapacityEv
+__ZN7WebCore12CachedScript9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore14PreloadScannerC1EPNS_8DocumentE
+__ZN7WebCore14PreloadScannerC2EPNS_8DocumentE
+__ZN7WebCore14PreloadScanner5beginEv
+__ZN7WebCore14PreloadScanner5resetEv
+__ZN3WTF6VectorItLm32EE14shrinkCapacityEm
+__ZN3WTF6VectorItLm16EE14shrinkCapacityEm
+__ZN7WebCore14PreloadScanner5writeERKNS_15SegmentedStringE
+__ZN7WebCore14PreloadScanner8tokenizeERKNS_15SegmentedStringE
+__ZN7WebCore14PreloadScanner16processAttributeEv
+__ZN3WTF6VectorItLm32EE6shrinkEm
+__ZN7WebCore14PreloadScanner7emitTagEv
+__ZNK7WebCore14PreloadScanner12scanningBodyEv
+__ZN7WebCore9DocLoader7preloadENS_14CachedResource4TypeERKNS_6StringES5_b
+__ZN7WebCore9DocLoader14requestPreloadENS_14CachedResource4TypeERKNS_6StringES5_
+__ZNK3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore14CachedResourceEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashF
+__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore14CachedResourceEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFu
+__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN3WTF5DequeIN7WebCore18SegmentedSubstringEE14expandCapacityEv
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE15reserveCapacityEm
+__ZN7WebCore14PreloadScanner13consumeEntityERNS_15SegmentedStringERb
+__ZN3WTF6VectorIcLm10EE6shrinkEm
+__ZN3WTF6VectorItLm10EE6shrinkEm
+__ZNK7WebCore12HTMLDocument10isFrameSetEv
+-[DOMDocument documentElement]
+-[DOMDocument createRange]
+__ZN7WebCore8Document11createRangeEv
+__Z3kitPN7WebCore5RangeE
+-[DOMRange selectNode:]
+__Z4coreP7DOMNode
+__ZN7WebCore5Range10selectNodeEPNS_4NodeERi
+__ZN7WebCore5Range14setStartBeforeEPNS_4NodeERi
+__ZNK7WebCore5Range11checkNodeBAEPNS_4NodeERi
+__ZNK7WebCore4Node9nodeIndexEv
+__ZN7WebCore5Range11setEndAfterEPNS_4NodeERi
+__Z4coreP8DOMRange
+__ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERjb
+__ZN7WebCore12TextIterator17handleNonTextNodeEv
+__ZN7WebCoreL24shouldEmitNewlineForNodeEPNS_4NodeE
+__ZNK7WebCore4Node14isDescendantOfEPKS0_
+__ZNK7WebCore4Node17isContentEditableEv
+__ZN7WebCoreL10isStreamerERKNS_16PositionIteratorE
+__ZN7WebCore12isAtomicNodeEPKNS_4NodeE
+__ZNK7WebCore16PositionIterator13atStartOfNodeEv
+__ZN7WebCore16PositionIterator9decrementEv
+__ZNK7WebCore13CharacterData18offsetInCharactersEv
+__ZNK7WebCore13CharacterData18maxCharacterOffsetEv
+__ZN7WebCore8Position23uncheckedPreviousOffsetEPKNS_4NodeEi
+__ZN7WebCore18positionBeforeNodeEPKNS_4NodeE
+__ZNK7WebCore12RenderObject14nextInPreOrderEv
+__ZN7WebCore16PositionIterator9incrementEv
+__ZN7WebCore13nextCandidateERKNS_8PositionE
+__ZNK7WebCore16PositionIterator11isCandidateEv
+__ZN7WebCore8Position19uncheckedNextOffsetEPKNS_4NodeEi
+__ZN7WebCoreL21canonicalizeCandidateERKNS_8PositionE
+__ZNK7WebCore16PositionIterator11atEndOfNodeEv
+__ZN7WebCore17previousCandidateERKNS_8PositionE
+__ZN7WebCore10inSameLineERKNS_15VisiblePositionES2_
+__ZN7WebCore11startOfLineERKNS_15VisiblePositionE
+__ZN7WebCoreL20startPositionForLineERKNS_15VisiblePositionE
+__ZN7WebCoreL14rootBoxForLineERKNS_15VisiblePositionE
+__ZNK7WebCore9InlineBox14caretMinOffsetEv
+__ZNK7WebCore12RenderObject14caretMinOffsetEv
+__ZNK7WebCore9InlineBox14caretMaxOffsetEv
+__ZNK7WebCore12RenderObject14caretMaxOffsetEv
+__ZN7WebCore9InlineBox13prevLeafChildEv
+__ZN7WebCore13InlineFlowBox22lastLeafChildBeforeBoxEPNS_9InlineBoxE
+__ZN7WebCore13InlineFlowBox14firstLeafChildEv
+__ZN7WebCore13InlineFlowBox22firstLeafChildAfterBoxEPNS_9InlineBoxE
+__ZN7WebCore9InlineBox14firstLeafChildEv
+__ZN7WebCoreL36positionAvoidingFirstPositionInTableERKNS_15VisiblePositionE
+__ZNK7WebCore8Position8previousENS_16PositionMoveTypeE
+__ZN7WebCore30lastDeepEditingPositionForNodeEPNS_4NodeE
+__ZN7WebCore25isLastPositionBeforeTableERKNS_15VisiblePositionE
+__ZNK7WebCore15VisiblePosition30honorEditableBoundaryAtOrAfterERKS0_
+__ZN7WebCore12TextIterator33shouldEmitSpaceBeforeAndAfterNodeEPNS_4NodeE
+__ZN7WebCore12TextIterator21handleReplacedElementEv
+__ZN7WebCore12TextIterator14handleTextNodeEv
+__ZN7WebCore12TextIterator8exitNodeEv
+__ZN7WebCoreL26shouldEmitNewlineAfterNodeEPNS_4NodeE
+__ZN7WebCore12TextIterator13emitCharacterEtPNS_4NodeES2_ii
+__ZN7WebCore12TextIterator13handleTextBoxEv
+__ZN7WebCore12TextIterator8emitTextEPNS_4NodeEii
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE15reserveCapacityEm
+__ZSt16__introsort_loopIPPN7WebCore13InlineTextBoxElPFbPKS1_S5_EEvT_S8_T0_T1_
+__ZSt22__final_insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
+__ZSt16__insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE6shrinkEm
+-[DOMRange dealloc]
+__ZN7WebCore12CachedScript4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore12CachedScript11checkNotifyEv
+__ZThn16_N7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZNK7WebCore26CachedScriptSourceProvider6lengthEv
+__ZN7WebCore12CachedScript6scriptEv
+__ZN7WebCore14CachedResource12removeClientEPNS_20CachedResourceClientE
+__ZNK7WebCore26CachedScriptSourceProvider4dataEv
+__ZN7WebCoreL23addPendingEventListenerERN3WTF7HashMapIPNS_9DOMWindowEPNS0_6VectorINS0_6RefPtrINS_23RegisteredEventListenerEEELm
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowESt4pairIS3_PNS_6VectorINS_6RefPtrINS1_23RegisteredEventListenerEEELm0EEEENS_18PairFirst
+__ZN7WebCore19MediaQueryEvaluatorC1Eb
+__ZN7WebCore19MediaQueryEvaluatorC2Eb
+__ZN7WebCore11FrameLoader29loadedResourceFromMemoryCacheEPKNS_14CachedResourceE
+__ZN7WebCore19InspectorController30didLoadResourceFromMemoryCacheEPNS_14DocumentLoaderEPKNS_14CachedResourceE
+__ZThn112_N7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore9CSSParser22createFloatingFunctionEv
+__ZN3WTF7HashSetIPN7WebCore17CSSParserFunctionENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expa
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reha
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13all
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4find
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47rem
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remo
+__ZN7WebCore9CSSParser13parseSVGValueEib
+__ZN7WebCore9CSSParser22rollbackLastPropertiesEi
+__ZN7WebCore9CSSParser12parseReflectEib
+__ZN7WebCore9CSSParser16parseBorderImageEibRN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCoreL17equalIgnoringCaseERKNS_15CSSParserStringEPKc
+__ZN7WebCore9CSSParser13parseGradientERN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCore22CSSImageGeneratorValueC2Ev
+__ZN7WebCoreL18parseGradientPointEPNS_14CSSParserValueEb
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE15reserveCapacityEm
+__ZN7WebCore9CSSParser20parseColorParametersEPNS_14CSSParserValueEPib
+__ZN7WebCore23BorderImageParseContext17commitBorderImageEPNS_9CSSParserEb
+__ZN7WebCore19CSSBorderImageValueC1EN3WTF10PassRefPtrINS_8CSSValueEEENS2_INS_4RectEEEii
+__ZN7WebCore19CSSBorderImageValueC2EN3WTF10PassRefPtrINS_8CSSValueEEENS2_INS_4RectEEEii
+__ZN7WebCore9CSSParser19createKeyframesRuleEv
+__ZN7WebCore22WebKitCSSKeyframesRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore22WebKitCSSKeyframesRuleC2EPNS_13CSSStyleSheetE
+__ZN7WebCore11CSSRuleListC1Ev
+__ZN7WebCore11CSSRuleListC2Ev
+__ZN7WebCore9CSSParser14parseTransformEv
+__ZN7WebCore22TransformOperationInfoC2ERKNS_15CSSParserStringE
+__ZN7WebCore23WebKitCSSTransformValueC1ENS0_22TransformOperationTypeE
+__ZN7WebCore23WebKitCSSTransformValueC2ENS0_22TransformOperationTypeE
+__ZN7WebCore9CSSParser22parseAnimationPropertyEiRN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCore9CSSParser28parseAnimationTimingFunctionEv
+__ZN7WebCore9CSSParser18createKeyframeRuleEPNS_18CSSParserValueListE
+__ZN7WebCore6String6numberEd
+__ZN7WebCore21WebKitCSSKeyframeRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore21WebKitCSSKeyframeRuleC2EPNS_13CSSStyleSheetE
+__ZN7WebCore21WebKitCSSKeyframeRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
+__ZN7WebCore22WebKitCSSKeyframesRule6appendEPNS_21WebKitCSSKeyframeRuleE
+__ZN7WebCore11CSSRuleList6appendEPNS_7CSSRuleE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE15reserveCapacityEm
+__ZN7WebCore9CSSParser19parseAnimationDelayEv
+__ZN7WebCore9CSSParser22parseAnimationDurationEv
+__ZN7WebCore9CSSParser18parseAnimationNameEv
+__ZN7WebCore15HTMLLinkElement11sheetLoadedEv
+__ZN7WebCore9StyleBase11isMediaRuleEv
+__ZN7WebCore9StyleBase14isFontFaceRuleEv
+__ZN7WebCore9StyleBase15isVariablesRuleEv
+__ZN7WebCore22WebKitCSSKeyframesRule15isKeyframesRuleEv
+__ZN7WebCore16CSSStyleSelector16addKeyframeStyleEN3WTF10PassRefPtrINS_22WebKitCSSKeyframesRuleEEE
+__ZNK7WebCore22WebKitCSSKeyframesRule4nameEv
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEN
+__ZN7WebCore10HTMLParser24noscriptCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore18NamedMappedAttrMapD0Ev
+__ZN7WebCore12NamedNodeMapD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE6shrinkEm
+__ZN7WebCore15MappedAttributeD0Ev
+__ZN7WebCoreL16audioConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore11MediaPlayer11isAvailableEv
+__ZN7WebCoreL21installedMediaEnginesEv
+__ZN7WebCore18MediaPlayerPrivate19registerMediaEngineEPFvPFPNS_27MediaPlayerPrivateInterfaceEPNS_11MediaPlayerEEPFvRN3WTF7HashS
+__ZN7WebCore18MediaPlayerPrivate11isAvailableEv
+__ZL12QTKitLibraryv
+__ZN7WebCoreL14addMediaEngineEPFPNS_27MediaPlayerPrivateInterfaceEPNS_11MediaPlayerEEPFvRN3WTF7HashSetINS_6StringENS_10StringHa
+__ZN3WTF6VectorIPN7WebCore18MediaPlayerFactoryELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore18MediaPlayerFactoryELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore18MediaPlayerFactoryELm0EE15reserveCapacityEm
+__ZN7WebCore16HTMLAudioElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLAudioElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLMediaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore8Document38registerForDocumentActivationCallbacksEPNS_7ElementE
+__ZN3WTF7HashSetIPN7WebCore7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableE
+__ZN7WebCore8Document31registerForMediaVolumeCallbacksEPNS_7ElementE
+__ZN7WebCore16HTMLMediaElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore16HTMLMediaElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLAudioElement11tagPriorityEv
+__ZN7WebCore16HTMLMediaElement20insertedIntoDocumentEv
+__ZNK7WebCore16HTMLMediaElement3srcEv
+__ZN7WebCore16HTMLMediaElement12scheduleLoadEv
+__ZN7WebCore16HTMLMediaElement6attachEv
+__ZN7WebCore14RenderThemeMac28extraMediaControlsStyleSheetEv
+__ZN7WebCoreL20mediaControllerThemeEv
+__ZN7WebCore16HTMLMediaElement16rendererIsNeededEPNS_11RenderStyleE
+__ZNK7WebCore16HTMLMediaElement8controlsEv
+__ZN7WebCore16CSSStyleSelector17mapNinePieceImageEPNS_8CSSValueERNS_14NinePieceImageE
+__ZNK7WebCore8CSSValue12isImageValueEv
+__ZNK7WebCore22CSSImageGeneratorValue21isImageGeneratorValueEv
+__ZN7WebCore22CSSImageGeneratorValue14generatedImageEv
+__ZNK7WebCore22CSSImageGeneratorValue11isFixedSizeEv
+__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEt
+__ZN7WebCore16StyleCachedImage9addClientEPNS_12RenderObjectE
+__ZN7WebCore11RenderLayer16createReflectionEv
+__ZN7WebCore13RenderReplicaC1EPNS_4NodeE
+__ZN7WebCore13RenderReplicaC2EPNS_4NodeE
+__ZN7WebCore11RenderLayer21updateReflectionStyleEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE6shrinkEm
+__ZN7WebCore18StyleTransformDataC1ERKS0_
+__ZN7WebCore18StyleTransformDataC2ERKS0_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEaSERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14shrinkCapacityEm
+__ZN7WebCore19StyleGeneratedImage9addClientEPNS_12RenderObjectE
+__ZN7WebCore22CSSImageGeneratorValue9addClientEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectENS1_7IntSizeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3addERKS3_RKS4_
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_NS1_7IntSizeEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EENS_14PairHas
+__ZNK7WebCore13RenderReplica13requiresLayerEv
+__ZNK7WebCore11RenderLayer15reflectionLayerEv
+__ZNK7WebCore9RenderBox13overflowWidthEb
+__ZNK7WebCore9RenderBox14overflowHeightEb
+__ZNK7WebCore11RenderStyle14applyTransformERNS_20TransformationMatrixERKNS_7IntSizeENS0_20ApplyTransformOriginE
+__ZNK7WebCore27TranslateTransformOperation16getOperationTypeEv
+__ZNK7WebCore23ScaleTransformOperation16getOperationTypeEv
+__ZN7WebCore20TransformationMatrix11translate3dEddd
+__ZNK7WebCore27TranslateTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZNK7WebCore23ScaleTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore20TransformationMatrix7scale3dEddd
+__ZN7WebCore20TransformationMatrix8multLeftERKS0_
+__ZN7WebCore20TransformationMatrix10makeAffineEv
+__ZNK7WebCore9RenderBox12overflowRectEb
+__ZNK7WebCore20TransformationMatrix7mapRectERKNS_7IntRectE
+__ZNK7WebCore20TransformationMatrix7mapRectERKNS_9FloatRectE
+__ZNK7WebCore20TransformationMatrix7mapQuadERKNS_9FloatQuadE
+__ZNK7WebCore20TransformationMatrix8mapPointERKNS_10FloatPointE
+__ZNK7WebCore20TransformationMatrix13multVecMatrixEddRdS1_
+__ZNK7WebCore9RenderBox13reflectedRectERKNS_7IntRectE
+__ZNK7WebCore9RenderBox16reflectionOffsetEv
+__ZNK7WebCore12RenderObject22outlineStyleForRepaintEv
+__ZNK7WebCore12RenderObject25getTransformFromContainerEPKS0_RKNS_7IntSizeERNS_20TransformationMatrixE
+__ZN7WebCore20TransformationMatrix9translateEdd
+__ZNK7WebCore11RenderLayer16currentTransformEv
+__ZN7WebCore14TransformState14applyTransformERKNS_20TransformationMatrixENS0_21TransformAccumulationE
+__ZN7WebCore14TransformState20flattenWithTransformERKNS_20TransformationMatrixE
+__ZN7WebCore12RenderObject26repaintAfterLayoutIfNeededEPNS_20RenderBoxModelObjectERKNS_7IntRectES5_
+__ZNK7WebCore12RenderObject29mustRepaintBackgroundOrBorderEv
+__ZN7WebCoreL21mustRepaintFillLayersEPKNS_12RenderObjectEPKNS_9FillLayerE
+__ZN7WebCore12RenderObject29markContainingBlocksForLayoutEbPS0_
+__ZN7WebCoreL16videoConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLVideoElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLVideoElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLVideoElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLVideoElement11tagPriorityEv
+__ZN7WebCore16HTMLVideoElement6attachEv
+__ZN7WebCore16HTMLVideoElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore16HTMLVideoElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderVideoC1EPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderVideoC2EPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderMediaC2EPNS_16HTMLMediaElementE
+__ZN7WebCore14RenderReplacedC2EPNS_4NodeE
+__ZN7WebCore11RenderMedia14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore11RenderMedia15virtualChildrenEv
+__ZN7WebCore11RenderVideo17updateFromElementEv
+__ZN7WebCore11RenderMedia17updateFromElementEv
+__ZN7WebCore11RenderMedia14updateControlsEv
+__ZNK7WebCore11RenderMedia12mediaElementEv
+__ZN7WebCore11RenderVideo12updatePlayerEv
+__ZNK7WebCore11RenderMedia6playerEv
+__ZN7WebCore16HTMLMediaElement8checkDTDEPKNS_4NodeE
+__ZNK7WebCore14RenderReplaced15canHaveChildrenEv
+__ZNK3WTF7HashMapIN7WebCore6StringENS1_20CachedResourceHandleINS1_14CachedResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE6shrinkEm
+__ZN7WebCore5TimerINS_12CachedScriptEE5firedEv
+__ZN7WebCore12CachedScript29decodedDataDeletionTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore12CachedScript18destroyDecodedDataEv
+__ZNK7WebCore14CachedResource21isSafeToMakePurgeableEv
+__ZN7WebCore16HTMLMediaElement11recalcStyleENS_4Node11StyleChangeE
+__ZNK7WebCore9FillLayer13containsImageEPNS_10StyleImageE
+__ZNK7WebCore16StyleCachedImage4dataEv
+__ZNK7WebCore18StyleTransformDataeqERKS0_
+__ZNK7WebCore27TranslateTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore27TranslateTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZNK7WebCore23ScaleTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore23ScaleTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore27TranslateTransformOperationD0Ev
+__ZN7WebCore23ScaleTransformOperationD0Ev
+__ZN7WebCore11RenderBlock29removePercentHeightDescendantEPNS_9RenderBoxE
+__ZNK7WebCore11RenderImage22usesImageContainerSizeEv
+__ZNK7WebCore11CachedImage22usesImageContainerSizeEv
+__ZNK7WebCore11RenderImage20calcAspectRatioWidthEv
+__ZNK7WebCore11RenderImage22imageHasRelativeHeightEv
+__ZNK7WebCore11CachedImage22imageHasRelativeHeightEv
+__ZNK7WebCore11RenderImage21calcAspectRatioHeightEv
+__ZN7WebCore9RenderBox20calcPercentageHeightERKNS_6LengthE
+__ZNK7WebCore9RenderBox13reflectionBoxEv
+__ZN7WebCore11RenderLayer10setStaticYEi
+__ZN7WebCore11RenderBlock19calcBlockPrefWidthsEv
+__ZN7WebCore11RenderVideo6layoutEv
+__ZN7WebCore11RenderMedia6layoutEv
+__ZNK7WebCore14RenderReplaced21minimumReplacedHeightEv
+__ZNK7WebCore11RenderVideo17calcReplacedWidthEb
+__ZNK7WebCore11RenderVideo16isWidthSpecifiedEv
+__ZN7WebCore11RenderVideo14calcPrefWidthsEv
+__ZNK7WebCore11RenderVideo18calcReplacedHeightEv
+__ZNK7WebCore11RenderVideo17isHeightSpecifiedEv
+__ZNK7WebCore11RenderMedia17rightmostPositionEbb
+__ZNK7WebCore11RenderMedia14lowestPositionEbb
+__ZN7WebCore13RenderReplica6layoutEv
+__ZN7WebCore14RenderReplaced29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore14RenderReplaced12overflowRectEb
+__ZNK7WebCore14RenderReplaced18localSelectionRectEb
+__ZN7WebCore5TimerINS_16HTMLMediaElementEE5firedEv
+__ZN7WebCore16HTMLMediaElement14loadTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore16HTMLMediaElement12loadInternalEv
+__ZN7WebCore16HTMLMediaElement18stopPeriodicTimersEv
+__ZN7WebCore16HTMLMediaElement31cancelPendingEventsAndCallbacksEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE14shrinkCapacityEm
+__ZNK7WebCore16HTMLMediaElement19defaultPlaybackRateEv
+__ZN7WebCore16HTMLMediaElement15setPlaybackRateEf
+__ZN7WebCore16HTMLMediaElement19selectMediaResourceEv
+__ZN7WebCore16HTMLMediaElement21scheduleProgressEventERKNS_12AtomicStringE
+__ZN7WebCore13ProgressEventC1ERKNS_12AtomicStringEbjj
+__ZN7WebCore13ProgressEventC2ERKNS_12AtomicStringEbjj
+__ZN7WebCore16HTMLMediaElement12enqueueEventEN3WTF6RefPtrINS_5EventEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE15reserveCapacityEm
+__ZN7WebCore11ContentTypeC1ERKNS_6StringE
+__ZN7WebCore11ContentTypeC2ERKNS_6StringE
+__ZN7WebCore16HTMLMediaElement15isSafeToLoadURLERKNS_4KURLENS0_19InvalidSourceActionE
+__ZN7WebCore16HTMLMediaElement12loadResourceERKNS_4KURLERNS_11ContentTypeE
+__ZN7WebCore16HTMLMediaElement23startProgressEventTimerEv
+__ZN7WebCore11MediaPlayerC1EPNS_17MediaPlayerClientE
+__ZN7WebCore11MediaPlayerC2EPNS_17MediaPlayerClientE
+__ZN7WebCoreL21createNullMediaPlayerEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement12updateVolumeEv
+__ZN7WebCore11MediaPlayer9setVolumeEf
+__ZN7WebCore22NullMediaPlayerPrivate9setVolumeEf
+__ZN7WebCore11MediaPlayer4loadERKNS_6StringERKNS_11ContentTypeE
+__ZNK7WebCore11ContentType4typeEv
+__ZNK7WebCore11ContentType9parameterERKNS_6StringE
+__ZN7WebCore16MIMETypeRegistry18getMIMETypeForPathERKNS_6StringE
+__ZN7WebCore10StringImpl11reverseFindEti
+__ZN7WebCore16MIMETypeRegistry23getMIMETypeForExtensionERKNS_6StringE
+__ZN7WebCoreL32chooseBestEngineForTypeAndCodecsERKNS_6StringES2_
+__ZN7WebCore18MediaPlayerPrivate12supportsTypeERKNS_6StringES3_
+__ZN7WebCoreL20mimeModernTypesCacheEv
+__ZL11initQTMoviev
+__ZN7WebCoreL19addFileTypesToCacheEP7NSArrayRN3WTF7HashSetINS_6StringENS_10StringHashENS2_10HashTraitsIS4_EEEE
+__ZN7WebCore22NullMediaPlayerPrivateD0Ev
+__ZN7WebCore18MediaPlayerPrivate6createEPNS_11MediaPlayerE
+__ZN7WebCore18MediaPlayerPrivateC1EPNS_11MediaPlayerE
+__ZN7WebCore18MediaPlayerPrivateC2EPNS_11MediaPlayerE
+-[WebCoreMovieObserver initWithCallback:]
+__ZN7WebCore18MediaPlayerPrivate4loadERKNS_6StringE
+__ZN7WebCore11MediaPlayer19networkStateChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore11MediaPlayer12networkStateEv
+__ZNK7WebCore18MediaPlayerPrivate12networkStateEv
+__ZN7WebCore16HTMLMediaElement15setNetworkStateENS_11MediaPlayer12NetworkStateE
+__ZN7WebCore18MediaPlayerPrivate10cancelSeekEv
+-[WebCoreMovieObserver setDelayCallbacks:]
+__ZN7WebCore18MediaPlayerPrivate13createQTMovieERKNS_6StringE
+__ZL32initQTMovieApertureModeAttributev
+__ZL28initQTMovieApertureModeCleanv
+__ZL41initQTMovieAskUnresolvedDataRefsAttributev
+__ZL40initQTSecurityPolicyNoCrossSiteAttributev
+__ZL43initQTMoviePreventExternalURLLinksAttributev
+__ZL23initQTMovieURLAttributev
+__ZL15QTMovieFunctionv
+__ZNK7WebCore11MediaPlayer6volumeEv
+__ZL41initQTMovieLoadStateDidChangeNotificationv
+__ZL36initQTMovieRateDidChangeNotificationv
+__ZL36initQTMovieSizeDidChangeNotificationv
+__ZL36initQTMovieTimeDidChangeNotificationv
+__ZL29initQTMovieDidEndNotificationv
+-[WebCoreMovieObserver loadStateChanged:]
+__ZNK7WebCore11RenderVideo8videoBoxEv
+__ZN7WebCore11MediaPlayer7setSizeERKNS_7IntSizeE
+__ZN7WebCore22NullMediaPlayerPrivate7setSizeERKNS_7IntSizeE
+__ZN7WebCore11MediaPlayer10setVisibleEb
+__ZN7WebCore22NullMediaPlayerPrivate10setVisibleEb
+__ZL36QTMovieApertureModeAttributeFunctionv
+__ZL32QTMovieApertureModeCleanFunctionv
+__ZL45QTMovieAskUnresolvedDataRefsAttributeFunctionv
+__ZL44QTSecurityPolicyNoCrossSiteAttributeFunctionv
+__ZL47QTMoviePreventExternalURLLinksAttributeFunctionv
+__ZL27QTMovieURLAttributeFunctionv
+__ZL45QTMovieLoadStateDidChangeNotificationFunctionv
+__ZL40QTMovieRateDidChangeNotificationFunctionv
+__ZL40QTMovieSizeDidChangeNotificationFunctionv
+__ZL40QTMovieTimeDidChangeNotificationFunctionv
+__ZL33QTMovieDidEndNotificationFunctionv
+__ZN7WebCore18MediaPlayerPrivate7setSizeERKNS_7IntSizeE
+__ZN7WebCore18MediaPlayerPrivate10setVisibleEb
+__ZNK7WebCore20TransformationMatrix12isInvertibleEv
+__ZN7WebCoreL14determinant4x4ERA4_A4_Kd
+__ZN7WebCoreL14determinant3x3Eddddddddd
+__ZN7WebCoreL14determinant2x2Edddd
+__ZN7WebCore11RenderLayer23beginTransparencyLayersEPNS_15GraphicsContextEPKS0_
+__ZN7WebCore11RenderLayer27transparentPaintingAncestorEv
+__ZN7WebCore15GraphicsContext9concatCTMERKNS_20TransformationMatrixE
+__ZNK7WebCore20TransformationMatrixcv17CGAffineTransformEv
+__ZNK7WebCore20TransformationMatrix7inverseEv
+__ZN7WebCoreL7inverseERA4_A4_KdRA4_A4_d
+__ZN7WebCoreL19transparencyClipBoxERKNS_20TransformationMatrixEPKNS_11RenderLayerES5_
+__ZN7WebCore9RenderBox12maskClipRectEv
+__ZN7WebCore15GraphicsContext22beginTransparencyLayerEf
+__ZN7WebCore13RenderReplica5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9RenderBox9paintMaskERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore9RenderBox15borderFitAdjustERiS1_
+__ZN7WebCore9RenderBox15paintMaskImagesERKNS_12RenderObject9PaintInfoEiiiiii
+__ZNK7WebCore10StyleImage8isLoadedEv
+__ZNK7WebCore10StyleImage9canRenderEf
+__ZN7WebCore19StyleGeneratedImage21setImageContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore19StyleGeneratedImage9imageSizeEPKNS_12RenderObjectEf
+__ZNK7WebCore19StyleGeneratedImage5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore16CSSGradientValue5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore22CSSImageGeneratorValue8getImageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectENS1_7IntSizeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3getERKS3_
+__ZN7WebCore22CSSImageGeneratorValue12removeClientEPNS_12RenderObjectE
+__ZN3WTF7HashMapIN7WebCore7IntSizeEjNS_7IntHashIS2_EENS_10HashTraitsIS2_EENS5_IjEEE3addERKS2_RKj
+__ZN3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7IntHashIS2_EENS_14PairHashTraitsINS_10HashTr
+__ZNK3WTF7HashMapIN7WebCore7IntSizeENS_6RefPtrINS1_5ImageEEENS_7IntHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3getERKS2_
+__ZN7WebCore16CSSGradientValue14createGradientEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore16CSSGradientValue12resolvePointEPNS_17CSSPrimitiveValueES2_RKNS_7IntSizeEf
+__ZN7WebCore8GradientC1ERKNS_10FloatPointES3_
+__ZN7WebCore8GradientC2ERKNS_10FloatPointES3_
+__ZN7WebCore16CSSGradientValue17sortStopsIfNeededEv
+__ZNSt17_Temporary_bufferIPN7WebCore20CSSGradientColorStopES1_EC1ES2_S2_
+__ZNSt17_Temporary_bufferIPN7WebCore20CSSGradientColorStopES1_EC2ES2_S2_
+__ZSt22__get_temporary_bufferIN7WebCore20CSSGradientColorStopEESt4pairIPT_lElS4_
+__ZSt26__uninitialized_fill_n_auxIPN7WebCore20CSSGradientColorStopElS1_EvT_T0_RKT1_St12__false_type
+__ZSt22__stable_sort_adaptiveIPN7WebCore20CSSGradientColorStopES2_lPFbRKS1_S4_EEvT_S7_T0_T1_T2_
+__ZSt24__merge_sort_with_bufferIPN7WebCore20CSSGradientColorStopES2_PFbRKS1_S4_EEvT_S7_T0_T1_
+__ZSt22__chunk_insertion_sortIPN7WebCore20CSSGradientColorStopElPFbRKS1_S4_EEvT_S7_T0_T1_
+__ZSt16__insertion_sortIPN7WebCore20CSSGradientColorStopEPFbRKS1_S4_EEvT_S7_T0_
+__ZN7WebCoreL12compareStopsERKNS_20CSSGradientColorStopES2_
+__ZSt25__unguarded_linear_insertIPN7WebCore20CSSGradientColorStopES1_PFbRKS1_S4_EEvT_T0_T1_
+__ZSt16__merge_adaptiveIPN7WebCore20CSSGradientColorStopElS2_PFbRKS1_S4_EEvT_S7_S7_T0_S8_T1_S8_T2_
+__ZSt16__merge_backwardIPN7WebCore20CSSGradientColorStopES2_S2_PFbRKS1_S4_EET1_T_S8_T0_S9_S7_T2_
+__ZSt23return_temporary_bufferIN7WebCore20CSSGradientColorStopEEvPT_
+__ZN7WebCore8Gradient12addColorStopEfRKNS_5ColorE
+__ZNK7WebCore5Color7getRGBAERfS1_S1_S1_
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE15reserveCapacityEm
+__ZN7WebCore8Gradient15platformDestroyEv
+__ZN7WebCore22CSSImageGeneratorValue8putImageERKNS_7IntSizeEN3WTF10PassRefPtrINS_5ImageEEE
+__ZN3WTF7HashMapIN7WebCore7IntSizeENS_6RefPtrINS1_5ImageEEENS_7IntHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3addERKS2_RKS5_
+__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectES5_NS1_8TileRuleES6_NS_17CompositeOperatorE
+__ZN7WebCore14GeneratedImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
+__ZN7WebCore15GraphicsContext9translateEff
+__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERNS_9GeneratorE
+__ZN7WebCore8Gradient4fillEPNS_15GraphicsContextERKNS_9FloatRectE
+__ZN7WebCore8Gradient16platformGradientEv
+__ZNK7WebCore10FloatPointcv7CGPointEv
+__ZN7WebCoreL16gradientCallbackEPvPKdPd
+__ZNK7WebCore8Gradient8getColorEfPfS1_S1_S1_
+__ZNK7WebCore8Gradient8findStopEf
+__ZN7WebCore15GraphicsContext20endTransparencyLayerEv
+__ZN7WebCore9RenderBox12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore9RenderBox25repaintLayerRectsForImageEPvPKNS_9FillLayerEb
+__ZNK7WebCore16StyleCachedImage9canRenderEf
+__ZN7WebCore20RenderBoxModelObject32calculateBackgroundImageGeometryEPKNS_9FillLayerEiiiiRNS_7IntRectERNS_8IntPointERNS_7IntSiz
+__ZNK7WebCore20RenderBoxModelObject23calculateBackgroundSizeEPKNS_9FillLayerEii
+__ZN7WebCore16StyleCachedImage21setImageContainerSizeERKNS_7IntSizeE
+__ZN7WebCore11CachedImage21setImageContainerSizeERKNS_7IntSizeE
+__ZN7WebCore5Image16setContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore16StyleCachedImage9imageSizeEPKNS_12RenderObjectEf
+__ZN7WebCore12RenderObject12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore14ResourceHandle15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore14ResourceLoader15willSendRequestEPNS_14ResourceHandleERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore27protocolHostAndPortAreEqualERKNS_4KURLES2_
+__ZN7WebCore23SubresourceLoaderClient15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore18MediaPlayerPrivate16loadStateChangedEv
+__ZN7WebCore18MediaPlayerPrivate12updateStatesEv
+__ZL29initQTMovieLoadStateAttributev
+__ZNK7WebCore18MediaPlayerPrivate7seekingEv
+__ZL33QTMovieLoadStateAttributeFunctionv
+__ZN7WebCore16HTMLMediaElement20asyncEventTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore16HTMLMediaElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore13ProgressEventD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE6shrinkEm
+__ZNK7WebCore11RenderMedia7isMediaEv
+__ZN7WebCore11RenderMedia12forwardEventEPNS_5EventE
+__ZNK7WebCore5Image17usesContainerSizeEv
+__ZNK7WebCore9RenderBox18calcReplacedHeightEv
+__ZNK7WebCore5Image17hasRelativeHeightEv
+__ZNK7WebCore9RenderBox17calcReplacedWidthEb
+__ZN7WebCore14PreloadScannerD1Ev
+__ZN7WebCore14PreloadScannerD2Ev
+__ZN7WebCore4KURL11setProtocolERKNS_6StringE
+__ZN7WebCore4KURL7setHostERKNS_6StringE
+__ZN7WebCore4KURL7setPathERKNS_6StringE
+__ZN7WebCore28encodeWithURLEscapeSequencesERKNS_6StringE
+__ZNK7WebCore6String4utf8Ev
+__ZN7WebCore10IconLoader6createEPNS_5FrameE
+__ZN7WebCore10IconLoaderC1EPNS_5FrameE
+__ZN7WebCore10IconLoaderC2EPNS_5FrameE
+__ZN7WebCore10IconLoader12startLoadingEv
+__ZN7WebCore20jsNavigatorUserAgentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator9userAgentEv
+__ZNK7WebCore11FrameLoader9userAgentERKNS_4KURLE
+__ZN7WebCoreL29createHTMLAudioElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLAudioElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSHTMLMediaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLMediaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLAudioElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLAudioElementEEE
+__ZN7WebCore18JSHTMLAudioElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLAudioElementEEE
+__ZN7WebCore18JSHTMLMediaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLMediaElementEEE
+__ZN7WebCoreL29createHTMLVideoElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLVideoElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLVideoElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLVideoElementEEE
+__ZN7WebCore18JSHTMLVideoElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLVideoElementEEE
+__ZN7WebCore18JSHTMLAudioElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLMediaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSHTMLMediaElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSNodePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsNodePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSHTMLAudioElement9classInfoEv
+__ZN7WebCore6JSNode16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore4Node22scriptExecutionContextEv
+__ZN7WebCore19toJSDOMGlobalObjectEPNS_22ScriptExecutionContextE
+__ZN7WebCore13toJSDOMWindowEPNS_5FrameE
+__ZN7WebCore47jsDocumentPrototypeFunctionGetElementsByTagNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8NodeListE
+__ZN7WebCore10JSNodeList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSNodeListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8NodeListEEE
+__ZN7WebCore10JSNodeListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8NodeListEEE
+__ZN7WebCore10JSNodeList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsNodeListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSNodeList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore10JSNodeList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLMediaElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionLoadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLMediaElement4loadERi
+__ZN7WebCore11MediaPlayer15totalBytesKnownEv
+__ZNK7WebCore18MediaPlayerPrivate15totalBytesKnownEv
+__ZNK7WebCore18MediaPlayerPrivate10totalBytesEv
+__ZN7WebCore11MediaPlayer11bytesLoadedEv
+__ZNK7WebCore18MediaPlayerPrivate11bytesLoadedEv
+__ZNK7WebCore18MediaPlayerPrivate8durationEv
+__ZN7WebCore11MediaPlayer10totalBytesEv
+__ZN7WebCore4Node21dispatchProgressEventERKNS_12AtomicStringEbjj
+__ZNK7WebCore16HTMLMediaElement18potentiallyPlayingEv
+__ZNK7WebCore16HTMLMediaElement6pausedEv
+__ZN7WebCore11MediaPlayer5pauseEv
+__ZN7WebCore18MediaPlayerPrivate5pauseEv
+__ZN7WebCore11MediaPlayer4seekEf
+__ZN7WebCore18MediaPlayerPrivate4seekEf
+__ZN7WebCore11MediaPlayerD0Ev
+__ZN7WebCore18MediaPlayerPrivateD0Ev
+__ZN7WebCore18MediaPlayerPrivate22tearDownVideoRenderingEv
+__ZN7WebCore18MediaPlayerPrivate22destroyQTVideoRendererEv
+-[WebCoreMovieObserver disconnect]
+__ZN7WebCore15setDOMExceptionEPN3JSC9ExecStateEi
+__ZN7WebCore18JSHTMLVideoElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLVideoElement9classInfoEv
+__ZN7WebCore21jsDocumentStyleSheetsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document11styleSheetsEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14StyleSheetListE
+__ZN7WebCore16JSStyleSheetList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSStyleSheetListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14StyleSheetListEEE
+__ZN7WebCore16JSStyleSheetListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14StyleSheetListEEE
+__ZN7WebCore16JSStyleSheetList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore16JSStyleSheetList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10StyleSheetE
+__ZN7WebCore15JSCSSStyleSheet15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSStyleSheetPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSStyleSheet15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCSSStyleSheetC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSStyleSheetEEE
+__ZN7WebCore15JSCSSStyleSheetC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSStyleSheetEEE
+__ZN7WebCore12JSStyleSheetC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10StyleSheetEEE
+__ZN7WebCore15JSCSSStyleSheet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsCSSStyleSheetRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13CSSStyleSheet8cssRulesEb
+__ZN7WebCore11CSSRuleListC1EPNS_9StyleListEb
+__ZN7WebCore11CSSRuleListC2EPNS_9StyleListEb
+__ZN7WebCore7CSSRule6isRuleEv
+__ZN7WebCore9StyleBase13isCharsetRuleEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11CSSRuleListE
+__ZN7WebCore13JSCSSRuleList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSCSSRuleListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11CSSRuleListEEE
+__ZN7WebCore13JSCSSRuleListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11CSSRuleListEEE
+__ZN7WebCore13JSCSSRuleList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsCSSRuleListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11CSSRuleList6lengthEv
+__ZN7WebCore13JSCSSRuleList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore13JSCSSRuleList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore11CSSRuleList4itemEj
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7CSSRuleE
+__ZNK7WebCore12CSSStyleRule4typeEv
+__ZN7WebCore14JSCSSStyleRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSCSSRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSCSSRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSCSSStyleRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSStyleRuleEEE
+__ZN7WebCore14JSCSSStyleRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSStyleRuleEEE
+__ZN7WebCore9JSCSSRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CSSRuleEEE
+__ZN7WebCore14JSCSSStyleRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSCSSRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsCSSRuleCssTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12CSSStyleRule7cssTextEv
+__ZNK7WebCore12CSSStyleRule12selectorTextEv
+__ZNK7WebCore11CSSSelector12selectorTextEv
+__ZNK7WebCore26CSSMutableStyleDeclaration7cssTextEv
+__ZNK7WebCore11CSSProperty7cssTextEv
+__Z15getPropertyName13CSSPropertyID
+__ZNK7WebCore15CSSInitialValue7cssTextEv
+__ZN7WebCore14jsStringOrNullEPN3JSC9ExecStateERKNS_6StringE
+__ZNK7WebCore9FontValue7cssTextEv
+__ZNK7WebCore12CSSValueList7cssTextEv
+__ZNK7WebCore15FontFamilyValue7cssTextEv
+__ZN7WebCore10StringImpl7replaceEtPS0_
+__ZN7WebCore27jsDOMWindowImageConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15JSDOMWindowBase16allowsAccessFromEPN3JSC9ExecStateE
+__ZNK7WebCore11JSDOMWindow5imageEPN3JSC9ExecStateE
+__ZNK3WTF7HashMapIPKN3JSC9ClassInfoEPNS1_8JSObjectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore18JSImageConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore18JSImageConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore27JSHTMLImageElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLImageElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN3WTF7HashMapIPKN3JSC9ClassInfoEPNS1_8JSObjectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
+__ZN3WTF9HashTableIPKN3JSC9ClassInfoESt4pairIS4_PNS1_8JSObjectEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTrai
+__ZN7WebCore18JSImageConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL14constructImageEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore18JSImageConstructor8documentEv
+__ZN7WebCoreL29createHTMLImageElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLImageElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLImageElementEEE
+__ZN7WebCore18JSHTMLImageElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLImageElementEEE
+__ZN7WebCore18JSHTMLImageElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLImageElement9classInfoEv
+__ZN7WebCore18JSHTMLImageElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSHTMLImageElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement6setSrcERKNS_6StringE
+__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameERKNS_12AtomicStringERi
+__ZNK7WebCore13StyledElement18createAttributeMapEv
+__ZN7WebCore13StyledElement15createAttributeERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE15reserveCapacityEm
 __ZNK7WebCore14CachedResource9isExpiredEv
 __ZNK7WebCore20ResourceResponseBase27parseCacheControlDirectivesEv
 __ZN7WebCoreL16parseCacheHeaderERKNS_6StringERN3WTF6VectorISt4pairIS0_S0_ELm0EEE
@@ -4482,266 +4808,910 @@
 __ZN3WTF6VectorISt4pairIN7WebCore6StringES3_ELm0EE14expandCapacityEm
 __ZN3WTF6VectorISt4pairIN7WebCore6StringES3_ELm0EE15reserveCapacityEm
 __ZN3WTF6VectorISt4pairIN7WebCore6StringES3_ELm0EE6shrinkEm
-__ZN3WTF7HashMapIiPN7WebCore13GlyphWidthMap14GlyphWidthPageENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3setERKiRKS4_
-__ZNK7WebCore11RenderTable12avoidsFloatsEv
-__ZN7WebCore11RenderTable6layoutEv
-__ZN7WebCore11RenderTable9calcWidthEv
-__ZN7WebCore11RenderTable14calcPrefWidthsEv
-__ZN7WebCore11RenderTable23recalcHorizontalBordersEv
-__ZNK7WebCore11RenderTable14calcBorderLeftEv
-__ZNK7WebCore11RenderTable15calcBorderRightEv
-__ZN7WebCore15AutoTableLayout14calcPrefWidthsERiS1_
-__ZN7WebCore15AutoTableLayout10fullRecalcEv
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE6resizeEm
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE4fillERKS3_m
-__ZSt4fillIPN7WebCore15AutoTableLayout6LayoutES2_EvT_S4_RKT0_
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4fillERKS3_m
-__ZSt4fillIPPN7WebCore15RenderTableCellES2_EvT_S4_RKT0_
-__ZN7WebCore15AutoTableLayout12recalcColumnEi
-__ZN7WebCore15RenderTableCell14calcPrefWidthsEv
-__ZNK7WebCore15RenderTableCell15styleOrColWidthEv
-__ZNK7WebCore11RenderTable10colElementEiPbS1_
-__ZNK7WebCore15RenderTableCell10borderLeftEv
-__ZNK7WebCore15RenderTableCell11borderRightEv
-__ZNK7WebCore11RenderTable10borderLeftEv
-__ZNK7WebCore11RenderTable11borderRightEv
-__ZN7WebCore17RenderTextControl14calcPrefWidthsEv
-__ZNK7WebCore27RenderTextControlSingleLine21preferredContentWidthEf
-__ZThn72_NK7WebCore16HTMLInputElement4sizeEv
-__ZNK7WebCore16HTMLInputElement4sizeEv
-__ZN7WebCore17RenderFlexibleBox14calcPrefWidthsEv
-__ZN7WebCore17RenderFlexibleBox24calcHorizontalPrefWidthsEv
-__ZN7WebCore15AutoTableLayout18calcEffectiveWidthEv
-__ZN7WebCore15AutoTableLayout6layoutEv
-__ZN7WebCore11RenderTable13setCellWidthsEv
-__ZN7WebCore18RenderTableSection13setCellWidthsEv
-__ZN7WebCore15RenderTableCell11updateWidthEi
-__ZN7WebCore15RenderContainer6layoutEv
-__ZN7WebCore14RenderTableRow6layoutEv
-__ZN7WebCore15RenderTableCell6layoutEv
-__ZN7WebCore15RenderTableCell9calcWidthEv
-__ZNK7WebCore15RenderTableCell9borderTopEv
-__ZNK7WebCore15RenderTableCell10paddingTopEb
-__ZNK7WebCore15RenderTableCell12borderBottomEv
-__ZNK7WebCore15RenderTableCell13paddingBottomEb
-__ZN7WebCore17RenderFlexibleBox11layoutBlockEb
-__ZN7WebCore17RenderFlexibleBox19layoutHorizontalBoxEb
-__ZN7WebCore9RenderBox15setOverrideSizeEi
-__ZNK7WebCore17RenderFlexibleBox13isFlexibleBoxEv
-__ZNK7WebCore17RenderFlexibleBox20isStretchingChildrenEv
-__ZN7WebCore17RenderFlexibleBox10placeChildEPNS_9RenderBoxEii
-__ZNK7WebCore12RenderButton14hasControlClipEv
-__ZN7WebCore18RenderTableSection13calcRowHeightEv
-__ZN3WTF6VectorIiLm0EE6resizeEm
-__ZNK7WebCore9RenderBox12overrideSizeEv
-__ZNK7WebCore11RenderTable9borderTopEv
-__ZNK7WebCore11RenderTable12borderBottomEv
-__ZN7WebCore18RenderTableSection10layoutRowsEi
-__ZNK7WebCore18RenderTableSection12overflowLeftEb
-__ZNK7WebCore18RenderTableSection13overflowWidthEb
-__ZNK7WebCore18RenderTableSection11overflowTopEb
-__ZNK7WebCore18RenderTableSection14overflowHeightEb
-__ZNK7WebCore11RenderTable12sectionBelowEPKNS_18RenderTableSectionEb
-__ZN7WebCoreL24fontDataForGenericFamilyEPNS_8DocumentERKNS_15FontDescriptionERKNS_12AtomicStringE
-__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE14expandCapacityEmPKS6_
-__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE14expandCapacityEm
-__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE15reserveCapacityEm
-__ZN7WebCore9FontCache26getSimilarFontPlatformDataERKNS_4FontE
-__ZN7WebCore9FontCache24getFontDataForCharactersERKNS_4FontEPKti
-__ZNK7WebCore15RenderTableCell14borderHalfLeftEb
-__ZNK7WebCore15RenderTableCell19collapsedLeftBorderEb
-__ZNK7WebCore11RenderTable10cellBeforeEPKNS_15RenderTableCellE
-__ZN7WebCoreL14compareBordersERKNS_20CollapsedBorderValueES2_
-__ZNK7WebCore15RenderTableCell15borderHalfRightEb
-__ZNK7WebCore15RenderTableCell20collapsedRightBorderEb
-__ZNK7WebCore11RenderTable9cellAfterEPKNS_15RenderTableCellE
-__ZNK7WebCore15RenderTableCell13borderHalfTopEb
-__ZNK7WebCore15RenderTableCell18collapsedTopBorderEv
-__ZNK7WebCore11RenderTable9cellAboveEPKNS_15RenderTableCellE
-__ZNK7WebCore11RenderTable12sectionAboveEPKNS_18RenderTableSectionEb
-__ZNK7WebCore15RenderTableCell16borderHalfBottomEb
-__ZNK7WebCore15RenderTableCell21collapsedBottomBorderEv
-__ZNK7WebCore11RenderTable9cellBelowEPKNS_15RenderTableCellE
-__ZN7WebCore18RenderTableSection17recalcOuterBorderEv
-__ZNK7WebCore18RenderTableSection18calcOuterBorderTopEv
-__ZNK7WebCore18RenderTableSection21calcOuterBorderBottomEv
-__ZNK7WebCore18RenderTableSection19calcOuterBorderLeftEb
-__ZNK7WebCore18RenderTableSection20calcOuterBorderRightEb
-__ZNK7WebCore11RenderTable16outerBorderRightEv
-__ZNK7WebCore11RenderTable15outerBorderLeftEv
-__ZNK7WebCore11RenderTable14outerBorderTopEv
-__ZNK7WebCore11RenderTable17outerBorderBottomEv
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE15reserveCapacityEm
-__ZNK7WebCore18RenderTableSection17rightmostPositionEbb
-__ZNK7WebCore18RenderTableSection14lowestPositionEbb
-__ZN7WebCore15RenderTableCell21computeRectForRepaintEPNS_9RenderBoxERNS_7IntRectEb
-__ZNK7WebCore15RenderTableCell20localToContainerQuadERKNS_9FloatQuadEPNS_9RenderBoxEb
-__ZN7WebCore11RenderTable5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore18RenderTableSection5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore15RenderTableCell26paintBackgroundsBehindCellERNS_12RenderObject9PaintInfoEiiPS1_
-__ZN7WebCore15RenderTableCell5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore15RenderTableCell19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore13RootInlineBox11ellipsisBoxEv
-__ZN7WebCore15GraphicsContext15drawLineForTextERKNS_8IntPointEib
-__ZN7WebCore15GraphicsContext19roundToDevicePixelsERKNS_9FloatRectE
-__ZNK7WebCore15GraphicsContext15shouldAntialiasEv
-__ZN7WebCore11RenderTheme16paintDecorationsEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore11RenderTheme15paintBorderOnlyEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac14paintTextFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore11RenderTheme17isReadOnlyControlEPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme24controlStatesForRendererEPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme9isHoveredEPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme9isPressedEPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme9isCheckedEPKNS_12RenderObjectE
-__ZNK7WebCore16HTMLInputElement9isCheckedEv
-__ZNK7WebCore11RenderTheme8isActiveEPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme15isIndeterminateEPKNS_12RenderObjectE
-__ZNK7WebCore16HTMLInputElement15isIndeterminateEv
-__ZNK7WebCore8ThemeMac5paintENS_11ControlPartEjPNS_15GraphicsContextERKNS_7IntRectEfPNS_10ScrollViewE
-__ZN7WebCoreL6buttonENS_11ControlPartEjRKNS_7IntRectEf
-__ZN7WebCoreL14setControlSizeEP6NSCellPKNS_7IntSizeERS3_f
-__ZN7WebCoreL12updateStatesEP6NSCellj
-__ZN7WebCoreL13buttonMarginsEj
-__ZN7WebCoreL11inflateRectERKNS_7IntRectERKNS_7IntSizeEPKif
-__ZNK7WebCore12RenderButton15controlClipRectEii
-__ZN7WebCore12RenderObject23getTextDecorationColorsEiRNS_5ColorES2_S2_b
-__ZN7WebCoreL15decorationColorEPNS_11RenderStyleE
-__ZN7WebCoreL30createHTMLScriptElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLScriptElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSHTMLScriptElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLScriptElementEEE
-__ZN7WebCore19JSHTMLScriptElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore25setJSHTMLScriptElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLScriptElement6setSrcERKNS_6StringE
-__ZN7WebCore17JSHTMLHeadElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSHTMLHeadElement9classInfoEv
-__ZNK7WebCore19JSHTMLScriptElement9classInfoEv
-__ZN7WebCore17ScriptElementData13requestScriptERKNS_6StringE
-__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore5TimerINS_12IconDatabaseEE5firedEv
-__ZN7WebCore12IconDatabase14syncTimerFiredEPNS_5TimerIS0_EE
-sqlite3BtreeDelete
-balance_shallower
-__ZN7WebCore15SQLiteStatement8bindBlobEiPKvi
-sqlite3_bind_blob
--[WebCoreSharedBufferData dealloc]
-__ZN7WebCore12CachedScript11setEncodingERKNS_6StringE
-__ZN7WebCore17ScriptElementData14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore17ScriptElementData14evaluateScriptERKNS_16ScriptSourceCodeE
-__ZN7WebCoreL32createHTMLTextAreaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLTextAreaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTextAreaElementEEE
-__ZN7WebCore21JSHTMLTextAreaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26jsHTMLTextAreaElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTextAreaElement5valueEv
-__ZNK7WebCore19HTMLTextAreaElement11updateValueEv
-__ZN7WebCore21JSHTMLTextAreaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore29setJSHTMLTextAreaElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTextAreaElement8setValueERKNS_6StringE
-__ZThn56_N7WebCore17HTMLScriptElement17dispatchLoadEventEv
-__ZN7WebCore17HTMLScriptElement17dispatchLoadEventEv
-accessPayload
-sqlite3_column_bytes
-__ZN3WTF6VectorIcLm0EE6resizeEm
-__ZN7WebCore11CachedImage5errorEv
-__ZN7WebCore11CachedImage5clearEv
-__ZN7WebCore11CachedImage18destroyDecodedDataEv
-__ZN7WebCore11BitmapImage18destroyDecodedDataEb
-__ZN7WebCore5Cache5evictEPNS_14CachedResourceE
-__ZNK7WebCore9DocLoader20removeCachedResourceEPNS_14CachedResourceE
-__ZNK7WebCore15RenderTableCell19collectBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
-__ZN7WebCoreL14addBorderStyleERN3WTF6VectorINS_20CollapsedBorderValueELm100EEES2_
-__ZN7WebCore15RenderTableCell16sortBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
-__ZN7WebCoreL27compareBorderStylesForQSortEPKvS1_
-__ZN7WebCore15RenderTableCell20paintCollapsedBorderEPNS_15GraphicsContextEiiii
-__ZN7WebCoreL20collapsedBorderStyleENS_12EBorderStyleE
-__ZN3WTF6VectorIN7WebCore20CollapsedBorderValueELm100EE6shrinkEm
+__ZN7WebCore7Element25dispatchAttrAdditionEventEPNS_9AttributeE
+__ZNK7WebCore15CSSReflectValue7cssTextEv
+__ZNK7WebCore19CSSBorderImageValue7cssTextEv
+__ZNK7WebCore16CSSGradientValue7cssTextEv
+__ZNK7WebCore22WebKitCSSKeyframesRule4typeEv
+__ZN7WebCore24JSWebKitCSSKeyframesRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSWebKitCSSKeyframesRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22WebKitCSSKeyframesRuleEEE
+__ZN7WebCore24JSWebKitCSSKeyframesRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22WebKitCSSKeyframesRuleEEE
+__ZN7WebCore24JSWebKitCSSKeyframesRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22WebKitCSSKeyframesRule7cssTextEv
+__ZNK7WebCore21WebKitCSSKeyframeRule7cssTextEv
+__ZNK7WebCore23WebKitCSSTransformValue7cssTextEv
+__ZN7WebCoreL19quoteStringIfNeededERKNS_6StringE
+__ZN7WebCore11LayoutStatenwEmPNS_11RenderArenaE
+__ZN7WebCore11LayoutStateC1EPS0_PNS_9RenderBoxERKNS_7IntSizeE
+__ZN7WebCore11LayoutStateC2EPS0_PNS_9RenderBoxERKNS_7IntSizeE
+__ZN7WebCore9InlineBox14dirtyLineBoxesEv
+__ZN7WebCore11RenderBlock20determineEndPositionEPNS_13RootInlineBoxERNS_14InlineIteratorERNS_10BidiStatusERi
+__ZN7WebCore13InlineFlowBox10deleteLineEPNS_11RenderArenaE
+__ZN7WebCore9InlineBox10deleteLineEPNS_11RenderArenaE
+__ZN7WebCore9InlineBoxD0Ev
+__ZN7WebCore13RootInlineBox29removeLineBoxFromRenderObjectEv
+__ZN7WebCore17RenderLineBoxList13removeLineBoxEPNS_13InlineFlowBoxE
+__ZN7WebCore13RootInlineBox8Overflow7destroyEPNS_11RenderArenaE
+__ZN7WebCore13RootInlineBox8OverflowdlEPvm
+__ZN7WebCore11LayoutState7destroyEPNS_11RenderArenaE
+__ZN7WebCore11LayoutStatedlEPvm
+__ZN7WebCore9ClipRects7destroyEPNS_11RenderArenaE
+__ZN7WebCore9ClipRectsdlEPvm
+__ZN7WebCore11ImageSource20frameDurationAtIndexEm
+__ZN7WebCore10IconLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZN7WebCore10IconLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZN7WebCore10IconLoader16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZNK7WebCore14ResourceHandle7requestEv
+__ZN7WebCore10IconLoader13finishLoadingERKNS_4KURLEN3WTF10PassRefPtrINS_12SharedBufferEEE
+__ZNK7WebCore13PageURLRecord8snapshotEb
+__ZN3WTF7HashMapIN7WebCore6StringENS1_15PageURLSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHa
+__ZN7WebCore12IconDatabase24scheduleOrDeferSyncTimerEv
+__ZN7WebCore12IconDatabase21setIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_6StringE
+__ZNK7WebCore12SharedBuffer4copyEv
+__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_29HashTableConstIteratorAdapterINS_9HashTableIS2_S2_NS_17IdentityExtract
+__ZNK7WebCore10IconRecord8snapshotEb
+__ZN3WTF7HashMapIN7WebCore6StringENS1_12IconSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
+__ZN7WebCore10IconLoader17clearLoadingStateEv
+__ZN7WebCore12SharedBufferD1Ev
+__ZN7WebCore12SharedBufferD2Ev
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11EventTargetE
+__ZN7WebCore11EventTarget20toSVGElementInstanceEv
+__ZN7WebCore18MediaPlayerPrivate24disableUnsupportedTracksEv
+__ZL20initQTMediaTypeVideov
+__ZL20initQTMediaTypeSoundv
+__ZL19initQTMediaTypeTextv
+__ZL19initQTMediaTypeBasev
+__ZL19initQTMediaTypeMPEGv
+__ZL29initQTTrackMediaTypeAttributev
+__ZN7WebCore11MediaPlayer15inMediaDocumentEv
+__ZN7WebCore18MediaPlayerPrivate15cacheMovieScaleEv
+__ZL31initQTMovieNaturalSizeAttributev
+__ZNK7WebCore18MediaPlayerPrivate11currentTimeEv
+__ZNK7WebCore18MediaPlayerPrivate13maxTimeLoadedEv
+__ZN7WebCore11MediaPlayer17readyStateChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore11MediaPlayer10readyStateEv
+__ZNK7WebCore18MediaPlayerPrivate10readyStateEv
+__ZN7WebCore16HTMLMediaElement13setReadyStateENS_11MediaPlayer10ReadyStateE
+__ZN7WebCore16HTMLMediaElement13scheduleEventERKNS_12AtomicStringE
+__ZN7WebCore11RenderVideo16videoSizeChangedEv
+__ZN7WebCore11MediaPlayer11naturalSizeEv
+__ZNK7WebCore18MediaPlayerPrivate11naturalSizeEv
+__ZL35QTMovieNaturalSizeAttributeFunctionv
+__ZN7WebCore18MediaPlayerPrivate6doSeekEv
+__ZNK7WebCore18MediaPlayerPrivate12createQTTimeEf
+__ZL29initQTMovieTimeScaleAttributev
+__ZL14initQTMakeTimexl
+__ZN7WebCore16HTMLMediaElement15updatePlayStateEv
+__ZNK7WebCore11MediaPlayer6pausedEv
+__ZNK7WebCore18MediaPlayerPrivate6pausedEv
+__ZNK7WebCore11MediaPlayer7visibleEv
+__ZN7WebCore18MediaPlayerPrivate19setUpVideoRenderingEv
+__ZN7WebCoreL20QTVideoRendererClassEv
+__ZN7WebCore18MediaPlayerPrivate21createQTVideoRendererEv
+__ZL58initQTVideoRendererWebKitOnlyNewImageAvailableNotificationv
+-[WebCoreMovieObserver timeChanged:]
+__ZN7WebCore18MediaPlayerPrivate11timeChangedEv
+__ZNK7WebCore16HTMLMediaElement8autoplayEv
+__ZNK7WebCore16HTMLVideoElement7isVideoEv
+__ZN7WebCore16HTMLVideoElement17updatePosterImageEv
+__ZNK7WebCore16HTMLVideoElement6posterEv
+__ZL28initQTMovieDataSizeAttributev
+__ZL32QTMovieDataSizeAttributeFunctionv
+__ZN7WebCore11MediaPlayer11timeChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
+__ZNK7WebCore16HTMLMediaElement11currentTimeEv
+__ZNK7WebCore11MediaPlayer11currentTimeEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
+__ZNK7WebCore11MediaPlayer8durationEv
+__ZN7WebCore16HTMLMediaElement23progressEventTimerFiredEPNS_5TimerIS0_EE
+__ZNK7WebCore13ProgressEvent15isProgressEventEv
+__ZNK7WebCore5Event29isXMLHttpRequestProgressEventEv
+__ZN7WebCore15JSProgressEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSProgressEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13ProgressEventEEE
+__ZN7WebCore15JSProgressEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13ProgressEventEEE
+__ZNK7WebCore10RenderText16linesBoundingBoxEv
+__ZNK7WebCore8Position14inRenderedTextEv
+__ZNK7WebCore13InlineTextBox19containsCaretOffsetEi
+__ZNK7WebCore13InlineTextBox14caretMinOffsetEv
+__ZNK7WebCore13InlineTextBox14caretMaxOffsetEv
+__ZNK7WebCore10RenderText14caretMinOffsetEv
+-[WebCoreMovieObserver newImageAvailable:]
+-[WebCoreMovieObserver repaint]
+__ZN7WebCore18MediaPlayerPrivate7repaintEv
+__ZN7WebCore11MediaPlayer7repaintEv
+__ZThn112_N7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
+__ZN7WebCore12EventHandler10mouseMovedEP7NSEvent
+__ZN7WebCoreL12currentEventEv
+__ZN7WebCore18PlatformMouseEventC1EP7NSEvent
+__ZN7WebCore18PlatformMouseEventC2EP7NSEvent
+__ZN7WebCore13pointForEventEP7NSEvent
+__ZN7WebCore8IntPointC1ERK7CGPoint
+__ZN7WebCore8IntPointC2ERK7CGPoint
+__ZN7WebCore19globalPointForEventEP7NSEvent
+__ZN7WebCore11globalPointERK7CGPointP8NSWindow
+__ZN7WebCore15screenForWindowEP8NSWindow
+__ZN7WebCore15flipScreenPointERK7CGPointP8NSScreen
+__ZN7WebCore12EventHandler10mouseMovedERKNS_18PlatformMouseEventE
+__ZN7WebCore13HitTestResultC1ERKNS_8IntPointE
+__ZN7WebCore13HitTestResultC2ERKNS_8IntPointE
+__ZN7WebCore12EventHandler20handleMouseMoveEventERKNS_18PlatformMouseEventEPNS_13HitTestResultE
+__ZN7WebCore12EventHandler17prepareMouseEventERKNS_14HitTestRequestERKNS_18PlatformMouseEventE
+__ZN7WebCoreL27documentPointForWindowPointEPNS_5FrameERKNS_8IntPointE
+__ZNK7WebCore10ScrollView16windowToContentsERKNS_8IntPointE
+__ZNK7WebCore6Widget27convertFromContainingWindowERKNS_8IntPointE
+__ZNK7WebCore8IntPointcv7CGPointEv
+__ZN7WebCore8Document17prepareMouseEventERKNS_14HitTestRequestERKNS_8IntPointERKNS_18PlatformMouseEventE
+__ZNK7WebCore8Document10renderViewEv
+__ZN7WebCore11RenderLayer7hitTestERKNS_14HitTestRequestERNS_13HitTestResultE
+__ZN7WebCore11RenderLayer12hitTestLayerEPS0_S1_RKNS_14HitTestRequestERNS_13HitTestResultERKNS_7IntRectERKNS_8IntPointEbPKNS_24H
+__ZN7WebCore11RenderLayer35update3DTransformedDescendantStatusEv
+__ZN7WebCoreL14isHitCandidateEPKNS_11RenderLayerEbPdPKNS_24HitTestingTransformStateE
+__ZN7WebCore13HitTestResultD1Ev
+__ZN7WebCore13HitTestResultD2Ev
+__ZNK7WebCore11RenderLayer15hitTestContentsERKNS_14HitTestRequestERNS_13HitTestResultERKNS_7IntRectERKNS_8IntPointENS_13HitTest
+__ZN7WebCore12RenderObject7hitTestERKNS_14HitTestRequestERNS_13HitTestResultERKNS_8IntPointEiiNS_13HitTestFilterE
+__ZN7WebCore11RenderBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore11RenderBlock15hitTestContentsERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
 __ZN7WebCore29DeprecatedPtrListImplIterator6toLastEv
 __ZN7WebCore29DeprecatedPtrListImplIteratormmEv
-__ZN7WebCore18RenderTableSection11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore14RenderTableRow11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore15RenderTableCell15absoluteToLocalENS_10FloatPointEbb
-__ZN7WebCore9InlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZNK7WebCore11RenderTheme12stateChangedEPNS_12RenderObjectENS_12ControlStateE
-__ZNK7WebCore11RenderTheme13supportsHoverEPKNS_11RenderStyleE
-__ZN7WebCore27RenderTextControlInnerBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore10MouseEvent12isMouseEventEv
-__ZN7WebCore27RenderTextControlSingleLine12forwardEventEPNS_5EventE
+__ZN7WebCore11RenderBlock24isPointInOverflowControlERNS_13HitTestResultEiiii
+__ZN7WebCore11RenderBlock19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore13HitTestResult12setInnerNodeEPNS_4NodeE
+__ZN7WebCore13HitTestResult21setInnerNonSharedNodeEPNS_4NodeE
+__ZN7WebCore13HitTestResultaSERKS0_
+__ZN7WebCore11RenderLayer22updateHoverActiveStateERKNS_14HitTestRequestERNS_13HitTestResultE
+__ZN7WebCore8Document12setHoverNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore13ContainerNode9setActiveEbb
+__ZN7WebCore13ContainerNode10setHoveredEb
+__ZNK7WebCore11RenderBlock13hoverAncestorEv
+__ZN7WebCore28MouseEventWithHitTestResultsC1ERKNS_18PlatformMouseEventERKNS_13HitTestResultE
+__ZN7WebCore28MouseEventWithHitTestResultsC2ERKNS_18PlatformMouseEventERKNS_13HitTestResultE
+__ZN7WebCore13HitTestResultC1ERKS0_
+__ZN7WebCore13HitTestResultC2ERKS0_
+__ZN7WebCore10ScrollView19scrollbarUnderMouseERKNS_18PlatformMouseEventE
+__ZNK7WebCore28MouseEventWithHitTestResults9scrollbarEv
+__ZN7WebCoreL24subframeForHitTestResultERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler12selectCursorERKNS_28MouseEventWithHitTestResultsEPNS_9ScrollbarE
+__ZNK7WebCore28MouseEventWithHitTestResults10targetNodeEv
+__ZNK7WebCore28MouseEventWithHitTestResults10isOverLinkEv
+__ZNK7WebCore11RenderLayer22isPointInResizeControlERKNS_8IntPointE
+__ZN7WebCore13pointerCursorEv
+__ZN7WebCore6CursorC1EP8NSCursor
+__ZN7WebCore6CursorC2EP8NSCursor
+__ZN7WebCore6CursorC1ERKS0_
+__ZN7WebCore6CursorC2ERKS0_
+__ZN7WebCore6Widget9setCursorERKNS_6CursorE
+__ZN7WebCore6CursorD1Ev
+__ZN7WebCore6CursorD2Ev
+__ZN7WebCore12EventHandler18dispatchMouseEventERKNS_12AtomicStringEPNS_4NodeEbiRKNS_18PlatformMouseEventEb
+__ZN7WebCore9FrameView25resetDeferredRepaintDelayEv
+__ZN7WebCore12EventHandler26updateMouseEventTargetNodeEPNS_4NodeERKNS_18PlatformMouseEventEb
+__ZN7WebCore4Node18dispatchMouseEventERKNS_18PlatformMouseEventERKNS_12AtomicStringEiPS0_
+__ZN7WebCore4Node18dispatchMouseEventERKNS_12AtomicStringEiiiiiibbbbbPS0_N3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore10MouseEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9C
+__ZN7WebCore10MouseEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9C
+__ZN7WebCore17MouseRelatedEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbb
+__ZN7WebCoreL9contentsXEPNS_9DOMWindowE
+__ZN7WebCoreL9contentsYEPNS_9DOMWindowE
+__ZN7WebCore17MouseRelatedEvent15initCoordinatesEv
+__ZN7WebCore17MouseRelatedEvent19computePageLocationEv
 __ZNK7WebCore17MouseRelatedEvent5pageYEv
 __ZNK7WebCore17MouseRelatedEvent5pageXEv
-__ZN7WebCore17RenderTextControl12forwardEventEPNS_5EventE
-__ZN7WebCore13HitTestResult13setURLElementEPNS_7ElementE
-__ZN7WebCore17HTMLAnchorElement9setActiveEbb
-__ZN7WebCore10handCursorEv
-__ZN7WebCoreL15leakNamedCursorEPKcii
--[DOMNode ownerDocument]
--[DOMDocument(WebCoreInternal) _document]
-__ZNK7WebCore13HitTestResult11targetFrameEv
-__ZNK7WebCore17HTMLAnchorElement6targetEv
+__ZN7WebCore17MouseRelatedEvent14receivedTargetEv
+__ZNK7WebCore12RenderObject15absoluteToLocalENS_10FloatPointEbb
+__ZNK7WebCore9RenderBox23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZNK7WebCore10RenderView23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZN7WebCore10MouseEventD0Ev
+__ZN7WebCore7UIEventD2Ev
+__ZN7WebCore12EventHandler23handleMouseDraggedEventERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler10handleDragERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore13HitTestResult22setToNonShadowAncestorEv
+__ZN7WebCore6Chrome23mouseDidMoveOverElementERKNS_13HitTestResultEj
+__ZNK7WebCore13HitTestResult15absoluteLinkURLEv
+__ZN7WebCore19InspectorController23mouseDidMoveOverElementERKNS_13HitTestResultEj
+__ZN7WebCore6Chrome10setToolTipERKNS_13HitTestResultE
+__ZNK7WebCore13HitTestResult15spellingToolTipEv
+__ZN7WebCore8Document21markerContainingPointERKNS_8IntPointENS_14DocumentMarker10MarkerTypeE
+__ZNK7WebCore13HitTestResult5titleEv
+__ZNK7WebCore17RenderLineBoxList7hitTestEPNS_20RenderBoxModelObjectERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestA
+__ZN7WebCore13RootInlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore13InlineFlowBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore9InlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore11RenderImage11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore9RenderBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZL33QTTrackMediaTypeAttributeFunctionv
+__ZL33QTMovieTimeScaleAttributeFunctionv
+__ZNK7WebCore16HTMLMediaElement7isVideoEv
+__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionPlayEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLMediaElement4playEv
+__ZN7WebCore16HTMLMediaElement12playInternalEv
+__ZNK7WebCore16HTMLMediaElement13endedPlaybackEv
+__ZNK7WebCore16HTMLMediaElement18stoppedDueToErrorsEv
+__ZNK7WebCore16HTMLMediaElement24pausedForUserInteractionEv
+__ZN7WebCore11MediaPlayer7setRateEf
+__ZN7WebCore18MediaPlayerPrivate7setRateEf
+__ZN7WebCore11MediaPlayer4playEv
+__ZN7WebCore18MediaPlayerPrivate4playEv
+__ZNK7WebCore11MediaPlayer4rateEv
+__ZN7WebCore16HTMLMediaElement26startPlaybackProgressTimerEv
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraits
+__ZN7WebCore14jsDocumentBodyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL28createHTMLBodyElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLBodyElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLBodyElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBodyElementEEE
+__ZN7WebCore17JSHTMLBodyElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBodyElementEEE
+__ZN7WebCore17JSHTMLBodyElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore13JSHTMLElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLElementClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setClassNameERKNS_6StringE
+__ZN7WebCore17NodeListsNodeData38invalidateCachesThatDependOnAttributesEv
+__ZNK7WebCore17NodeListsNodeData7isEmptyEv
+__ZN7WebCore12RenderObject16setStyleInternalEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN7WebCore11RenderStyle16accessAnimationsEv
+__ZN7WebCore9Animation6createEv
+__ZN7WebCore9AnimationC1Ev
+__ZN7WebCore9AnimationC2Ev
+__ZN7WebCore13AnimationList6appendEN3WTF10PassRefPtrINS_9AnimationEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE15reserveCapacityEm
+__ZN7WebCore16CSSStyleSelector17mapAnimationDelayEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector20mapAnimationDurationEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector16mapAnimationNameEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore13AnimationList19fillUnsetPropertiesEv
+__ZN7WebCore26AnimationControllerPrivate24accessCompositeAnimationEPNS_12RenderObjectE
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectENS_6RefPtrINS1_18CompositeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectENS_6RefPtrINS1_18CompositeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_E
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_NS_6RefPtrINS1_18CompositeAnimationEEEENS_18PairFirstExtractorIS8_EENS_7
+__ZN7WebCore18CompositeAnimation7animateEPNS_12RenderObjectEPNS_11RenderStyleES4_
+__ZN7WebCore18CompositeAnimation24updateKeyframeAnimationsEPNS_12RenderObjectEPNS_11RenderStyleES4_
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE14shrinkCapacityEm
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6RefPtrINS1_17KeyframeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_I
+__ZN7WebCore17KeyframeAnimationC1EPKNS_9AnimationEPNS_12RenderObjectEiPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN7WebCore17KeyframeAnimationC2EPKNS_9AnimationEPNS_12RenderObjectEiPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN7WebCore13AnimationBaseC2EPKNS_9AnimationEPNS_12RenderObjectEPNS_18CompositeAnimationE
+__ZN7WebCore12KeyframeList6insertEfN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE15reserveCapacityEm
+__ZN7WebCore16CSSStyleSelector26keyframeStylesForAnimationEPNS_7ElementEPKNS_11RenderStyleERNS_12KeyframeListE
+__ZN7WebCore12KeyframeList5clearEv
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE6shrinkEm
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E5clearEv
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E15deallocateTableEPii
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEEENS_18PairFirstExtractorI
+__ZNK7WebCore22WebKitCSSKeyframesRule6lengthEv
+__ZNK7WebCore22WebKitCSSKeyframesRule4itemEj
+__ZN7WebCore21WebKitCSSKeyframeRule14isKeyframeRuleEv
+__ZN7WebCore11RenderStyle5cloneEPKS0_
+__ZN7WebCore11RenderStyleC1ERKS0_
+__ZN7WebCore11RenderStyleC2ERKS0_
+__ZN7WebCore16CSSStyleSelector25createTransformOperationsEPNS_8CSSValueEPNS_11RenderStyleERNS_19TransformOperationsE
+__ZN7WebCoreL25getTransformOperationTypeENS_23WebKitCSSTransformValue22TransformOperationTypeE
+__ZN7WebCore16CSSStyleSelector26mapAnimationTimingFunctionEPNS_9AnimationEPNS_8CSSValueE
+__ZN3WTF7HashSetIiNS_7IntHashIjEENS_10HashTraitsIiEEE3addERKi
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E6expandEv
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E6rehashEi
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E13allocateTableEi
+__ZN7WebCore21WebKitCSSKeyframeRule14parseKeyStringERKNS_6StringERN3WTF6VectorIfLm0EEE
+__ZN3WTF6VectorIfLm0EE14shrinkCapacityEm
+__ZNK7WebCore6String7toFloatEPb
+__ZN7WebCore10StringImpl7toFloatEPb
+__ZN7WebCore17charactersToFloatEPKtmPb
+__ZN3WTF6VectorIfLm0EE14expandCapacityEmPKf
+__ZN3WTF6VectorIfLm0EE14expandCapacityEm
+__ZN3WTF6VectorIfLm0EE15reserveCapacityEm
+__ZN3WTF6VectorIfLm0EE6shrinkEm
+__ZN7WebCore17KeyframeAnimation29validateTransformFunctionListEv
+__ZNK3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E8containsIiNS_22IdentityHashTranslatorIii
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6RefPtrINS1_17KeyframeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE15reserveCapacityEm
+__ZN7WebCore18CompositeAnimation17updateTransitionsEPNS_12RenderObjectEPNS_11RenderStyleES4_
+__ZN7WebCore17KeyframeAnimation7animateEPNS_18CompositeAnimationEPNS_12RenderObjectEPKNS_11RenderStyleEPS5_RN3WTF6RefPtrIS5_EE
+__ZN7WebCore13AnimationBase27fireAnimationEventsIfNeededEv
+__ZN7WebCore13AnimationBase18updateStateMachineENS0_14AnimStateInputEd
+__ZNK7WebCore13AnimationBase24beginAnimationUpdateTimeEv
+__ZN7WebCore18CompositeAnimation25cleanupFinishedAnimationsEv
+__ZNK7WebCore18CompositeAnimation17timeToNextServiceEv
+__ZN7WebCore17KeyframeAnimation17timeToNextServiceEv
+__ZN7WebCore13AnimationBase17timeToNextServiceEv
+__ZN7WebCoreL15convertToLengthEPNS_17CSSPrimitiveValueEPNS_11RenderStyleEdPb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE6shrinkEm
+__ZN7WebCore9AnimationD1Ev
+__ZN7WebCore9AnimationD2Ev
+-[WebCoreMovieObserver rateChanged:]
+__ZN7WebCore18MediaPlayerPrivate11rateChangedEv
+__ZN7WebCore11MediaPlayer11rateChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement22mediaPlayerRateChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement22mediaPlayerRateChangedEPNS_11MediaPlayerE
+__ZN7WebCore12EventHandler20hitTestResultAtPointERKNS_8IntPointEbb
+__ZNK7WebCore13HitTestResult10isSelectedEv
+__ZN7WebCore19SelectionController8containsERKNS_8IntPointE
 __ZN7WebCore12EventHandler9mouseDownEP7NSEvent
 __ZN7WebCore12EventHandler21handleMousePressEventERKNS_18PlatformMouseEventE
 __ZN7WebCore8Document13setActiveNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZNK7WebCore13JSHTMLElement21pushEventHandlerScopeEPN3JSC9ExecStateERNS1_10ScopeChainE
-__ZNK7WebCore11HTMLElement11virtualFormEv
-__ZNK7WebCore7UIEvent9isUIEventEv
-__ZNK7WebCore5Event15isKeyboardEventEv
-__ZNK7WebCore5Event11isTextEventEv
-__ZN7WebCore12JSMouseEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSUIEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore9JSUIEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore12JSMouseEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MouseEventEEE
-__ZN7WebCore9JSUIEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7UIEventEEE
-__ZNK3JSC8JSObject16isVariableObjectEv
-__ZNK7WebCore17HTMLAnchorElement11isFocusableEv
-__ZNK7WebCore17HTMLAnchorElement16isMouseFocusableEv
-__ZN7WebCore15FocusController14setFocusedNodeEPNS_4NodeEN3WTF10PassRefPtrINS_5FrameEEE
+__ZNK7WebCore11HTMLElement11isFocusableEv
+__ZNK7WebCore4Node11isFocusableEv
+__ZNK7WebCore4Node16isMouseFocusableEv
+__ZNK7WebCore12EventHandler14mousePressNodeEv
+__ZNK7WebCore4Node17canStartSelectionEv
+__ZN7WebCore6Editor29markMisspellingsAndBadGrammarERKNS_16VisibleSelectionEbS3_
+__ZN7WebCore6Editor40markAllMisspellingsAndBadGrammarInRangesEbPNS_5RangeEbS2_b
+__ZN7WebCoreL29paragraphAlignedRangeForRangeEPNS_5RangeERiRNS_6StringE
+__ZNK7WebCore5Range10cloneRangeERi
+__ZN7WebCore16startOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCore8setStartEPNS_5RangeERKNS_15VisiblePositionE
+__ZN7WebCore24rangeCompliantEquivalentERKNS_15VisiblePositionE
+__ZN7WebCore6setEndEPNS_5RangeERKNS_15VisiblePositionE
+__ZNK7WebCore5Range14startContainerERi
+__ZN7WebCore9plainTextEPKNS_5RangeE
+__ZN7WebCore16HTMLInputElement17dispatchBlurEventEv
+__ZN7WebCore12InputElement17dispatchBlurEventERNS_16InputElementDataEPNS_8DocumentE
+__ZThn128_NK7WebCore16HTMLInputElement11placeholderEv
+__ZNK7WebCore16HTMLInputElement11placeholderEv
+__ZN7WebCore5Frame22textFieldDidEndEditingEPNS_7ElementE
+__Z3kitPN7WebCore16HTMLInputElementE
+__ZN7WebCore4Node17dispatchBlurEventEv
+__ZN7WebCore11RenderLayer14scrollToOffsetEiibb
 __ZN7WebCore12EventHandler21handleMousePressEventERKNS_28MouseEventWithHitTestResultsE
 __ZN7WebCore12EventHandler9dragStateEv
 __ZN7WebCore12EventHandler23canMouseDownStartSelectEPNS_4NodeE
-__ZNK7WebCore17HTMLAnchorElement17canStartSelectionEv
+__ZNK7WebCore8Document13isSVGDocumentEv
 __ZN7WebCore12EventHandler17focusDocumentViewEv
-__ZN7WebCore6Chrome11focusNSViewEP6NSView
-__ZN7WebCore15FocusController15setFocusedFrameEN3WTF10PassRefPtrINS_5FrameEEE
 __ZN7WebCore12EventHandler32handleMousePressEventSingleClickERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore14CachedResource11setEncodingERKNS_6StringE
+__ZNK7WebCore28MouseEventWithHitTestResults10localPointEv
+__ZN7WebCore11RenderBlock16positionForPointERKNS_8IntPointE
+__ZN7WebCore11RenderBlock34positionForPointWithInlineChildrenERKNS_8IntPointE
+__ZN7WebCore12RenderObject21createVisiblePositionEiNS_9EAffinityE
+__ZNK7WebCore10RenderText14previousOffsetEi
+__ZN7WebCore22cursorMovementIteratorEPKti
+__ZN7WebCore18textBreakPrecedingEPNS_17TextBreakIteratorEi
+__ZNK7WebCore8Position28atLastEditingPositionForNodeEv
+__ZN7WebCore16VisibleSelectionC1ERKNS_15VisiblePositionE
+__ZN7WebCore16VisibleSelectionC2ERKNS_15VisiblePositionE
+__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_16VisibleSelectionE
+__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_16VisibleSelectionES3_NS_9EAffinityEb
+__ZN7WebCore9RenderBox14localCaretRectEPNS_9InlineBoxEiPi
+__ZN7WebCore12EventHandler12mouseDraggedEP7NSEvent
+__ZN7WebCore11iBeamCursorEv
+__ZN7WebCore12EventHandler27eventLoopHandleMouseDraggedERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler24mouseDownViewIfStillGoodEv
+__ZNK7WebCore12EventHandler14allowDHTMLDragERbS1_
+__ZNK7WebCore10ScrollView16contentsToWindowERKNS_8IntPointE
+__ZNK7WebCore6Widget25convertToContainingWindowERKNS_8IntPointE
+__ZN7WebCore14DragController24delegateDragSourceActionERKNS_8IntPointE
+__ZNK7WebCore12RenderObject13draggableNodeEbbiiRb
+__ZNK7WebCore12EventHandler18shouldDragAutoNodeEPNS_4NodeERKNS_8IntPointE
+__ZN7WebCore12EventHandler16handleAutoscrollEPNS_12RenderObjectE
+__ZN7WebCore12EventHandler21setAutoscrollRendererEPNS_12RenderObjectE
+__ZN7WebCore12EventHandler20startAutoscrollTimerEv
+__ZN7WebCore12EventHandler27updateSelectionForMouseDragEPNS_4NodeERKNS_8IntPointE
+__ZN7WebCore12EventHandler24canMouseDragExtendSelectEPNS_4NodeE
+__ZN7WebCore16VisibleSelection9setExtentERKNS_15VisiblePositionE
+__ZNK7WebCore5Frame20selectionGranularityEv
+__ZN7WebCore5TimerINS_12EventHandlerEE5firedEv
+__ZN7WebCore12EventHandler20autoscrollTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore9RenderBox10autoscrollEv
+__ZN7WebCore11RenderLayer10autoscrollEv
+__ZN7WebCore12EventHandler27updateSelectionForMouseDragEv
+__ZNK7WebCore12EventHandler20currentMousePositionEv
 __ZN7WebCore12EventHandler7mouseUpEP7NSEvent
 __ZN7WebCore12EventHandler23handleMouseReleaseEventERKNS_18PlatformMouseEventE
-__ZN7WebCore15EventTargetNode15dispatchUIEventERKNS_12AtomicStringEiN3WTF10PassRefPtrINS_5EventEEE
-__ZN7WebCore7UIEventD1Ev
+__ZNK7WebCore7UIEvent9isUIEventEv
 __ZN7WebCore12EventHandler23handleMouseReleaseEventERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler19stopAutoscrollTimerEb
+__ZN7WebCore9RenderBox14stopAutoscrollEv
 __ZN7WebCore12EventHandler13handleMouseUpERKNS_28MouseEventWithHitTestResultsE
 __ZN7WebCore12EventHandler22eventLoopHandleMouseUpERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore12EventHandler24mouseDownViewIfStillGoodEv
 __ZNK7WebCore12EventHandler18eventActivatedViewERKNS_18PlatformMouseEventE
-__ZN7WebCore5Frame31notifyRendererOfSelectionChangeEb
-__ZNK7WebCore9Selection19rootEditableElementEv
-__ZN7WebCore19SelectionController41selectFrameElementInParentIfFullySelectedEv
 __ZN7WebCore12EventHandler15invalidateClickEv
-__ZN7WebCore14ResourceHandle16setDefersLoadingEb
-__ZThn68_NK7WebCore19HTMLTextAreaElement9saveStateERNS_6StringE
-__ZNK7WebCore19HTMLTextAreaElement9saveStateERNS_6StringE
-__ZThn56_NK7WebCore22HTMLFormControlElement4nameEv
-__ZThn56_NK7WebCore19HTMLTextAreaElement4typeEv
-__ZNK7WebCore19HTMLTextAreaElement4typeEv
-__ZN7WebCore14CachedResourceD0Ev
-__ZN3WTF9HashTableIPN7WebCore24CachedResourceHandleBaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
-__ZN7WebCore12JSMouseEventD0Ev
-__ZN7WebCore21JSHTMLTextAreaElementD0Ev
-__ZN7WebCore17JSHTMLHeadElementD0Ev
-__ZN7WebCore19JSHTMLScriptElementD0Ev
-__ZN7WebCoreL13dlConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLDListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16HTMLDListElement17endTagRequirementEv
-__ZNK7WebCore16HTMLDListElement11tagPriorityEv
-__ZN7WebCore10HTMLParser18dtCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore10HTMLParser18ddCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE6shrinkEm
+__ZN7WebCore16HTMLMediaElement26playbackProgressTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore16HTMLMediaElement23scheduleTimeupdateEventEb
+__ZN7WebCore5TimerINS_26AnimationControllerPrivateEE5firedEv
+__ZN7WebCore26AnimationControllerPrivate19animationTimerFiredEPNS_5TimerIS0_EE
+__ZNK7WebCore13AnimationListeqERKS0_
+__ZNK7WebCore9Animation15animationsMatchEPKS0_b
+__ZN7WebCore26AnimationControllerPrivate27addToStyleAvailableWaitListEPNS_13AnimationBaseE
+__ZN7WebCore26AnimationControllerPrivate23addNodeChangeToDispatchEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE15reserveCapacityEm
+__ZN7WebCore26AnimationControllerPrivate34startUpdateStyleIfNeededDispatcherEv
+__ZNK7WebCore17KeyframeAnimation28getKeyframeAnimationIntervalERPKNS_11RenderStyleES4_Rd
+__ZNK7WebCore13AnimationBase14getElapsedTimeEv
+__ZNK7WebCore13AnimationBase8progressEddPKNS_14TimingFunctionE
+__ZN7WebCore13AnimationBase15blendPropertiesEPKS0_iPNS_11RenderStyleEPKS3_S6_d
+__ZN7WebCoreL17ensurePropertyMapEv
+__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE15reserveCapacityEm
+__ZN7WebCoreL22addShorthandPropertiesEv
+__ZN7WebCoreL18wrapperForPropertyEi
+__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE14expandCapacityEmPKS3_
+__ZN7WebCoreL18addPropertyWrapperEiPNS_19PropertyWrapperBaseE
+__ZNK7WebCore15PropertyWrapperIRKNS_19TransformOperationsEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
+__ZNK7WebCore11RenderStyle9transformEv
+__ZN7WebCore23ScaleTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEmPKS4_
+__ZN7WebCore11RenderStyle12setTransformERKNS_19TransformOperationsE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EEC2ERKS5_
+__ZNK7WebCore15PropertyWrapperIfE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
+__ZNK7WebCore11RenderStyle7opacityEv
+__ZN7WebCore11RenderStyle10setOpacityEf
+__ZN7WebCore11RenderLayer27repaintIncludingDescendantsEv
+__ZN7WebCore20TransformationMatrix5blendERKS0_d
+__ZNK7WebCore20TransformationMatrix9decomposeERNS0_14DecomposedTypeE
+__ZN7WebCoreL8v3LengthEPd
+__ZN7WebCoreL7v3ScaleEPdd
+__ZN7WebCoreL5v3DotEPKdS1_
+__ZN7WebCoreL9v3CombineEPKdS1_Pddd
+__ZN7WebCore20TransformationMatrix9recomposeERKNS0_14DecomposedTypeE
+__ZN7WebCore17KeyframeAnimation18overrideAnimationsEv
+__ZN7WebCore18CompositeAnimation26overrideImplicitAnimationsEi
+__ZN7WebCore17KeyframeAnimation16onAnimationStartEd
+__ZN7WebCore17KeyframeAnimation18sendAnimationEventERKNS_12AtomicStringEd
+__ZNK7WebCore17KeyframeAnimation26shouldSendEventForListenerENS_8Document12ListenerTypeE
+__ZN7WebCore26AnimationControllerPrivate18addEventToDispatchEN3WTF10PassRefPtrINS_7ElementEEERKNS_12AtomicStringERKNS_6StringEd
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE15reserveCapacityEm
+__ZNK7WebCore13AnimationBase10overriddenEv
+__ZN7WebCore17KeyframeAnimation14startAnimationEd
+__ZN7WebCore26AnimationControllerPrivate30addToStartTimeResponseWaitListEPNS_13AnimationBaseEb
+__ZN7WebCore13AnimationBase26goIntoEndingOrLoopingStateEv
+__ZNK7WebCore13AnimationBase18getTimeToNextEventERdRb
+__ZN7WebCore9FrameView11forceLayoutEb
+__ZNK7WebCore26Matrix3DTransformOperation16getOperationTypeEv
+__ZNK7WebCore26Matrix3DTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore26AnimationControllerPrivate34updateStyleIfNeededDispatcherFiredEPNS_5TimerIS0_EE
+__ZN7WebCore4Node28dispatchWebKitAnimationEventERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore20WebKitAnimationEventC1ERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore20WebKitAnimationEventC2ERKNS_12AtomicStringERKNS_6StringEd
+__ZNK7WebCore20WebKitAnimationEvent22isWebKitAnimationEventEv
+__ZN7WebCore22JSWebKitAnimationEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSWebKitAnimationEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20WebKitAnimationEventEEE
+__ZN7WebCore22JSWebKitAnimationEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20WebKitAnimationEventEEE
+__ZN7WebCore22JSWebKitAnimationEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsWebKitAnimationEventAnimationNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20WebKitAnimationEvent13animationNameEv
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE6shrinkEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE6shrinkEm
+__ZNK7WebCore26Matrix3DTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore26Matrix3DTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore26Matrix3DTransformOperationD0Ev
+__ZNK7WebCore16StyleCachedImage5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectERKNS_8IntPointERKNS_7IntSizeENS_17CompositeOperatorE
+__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectERKNS_10FloatPointERKNS_9FloatSizeENS_17CompositeOperatorE
+__ZN7WebCore20TransformationMatrix15scaleNonUniformEdd
+__ZNK7WebCore9FloatRect8containsERKS0_
+__ZNK7WebCore11HistoryItem5titleEv
+__ZN7WebCore24StringWrapperCFAllocatorL22deallocateOnMainThreadEPv
+__ZNK7WebCore24RotateTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore20TransformationMatrix8rotate3dEdddd
+__ZNK7WebCore13ResourceErrorcvP7NSErrorEv
+__ZN7WebCore13InlineTextBox10deleteLineEPNS_11RenderArenaE
+__ZN7WebCore10RenderText13removeTextBoxEPNS_13InlineTextBoxE
+__ZN7WebCore5TimerINS_12IconDatabaseEE5firedEv
+__ZN7WebCore12IconDatabase14syncTimerFiredEPNS_5TimerIS0_EE
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE15reserveCapacityEm
+__ZN7WebCore12IconDatabase30writeIconSnapshotToSQLDatabaseERKNS_12IconSnapshotE
+__ZN7WebCore12IconDatabase34getIconIDForIconURLFromSQLDatabaseERKNS_6StringE
+__ZN7WebCore15SQLiteStatement9bindInt64Eix
+__ZN7WebCore14SQLiteDatabase15lastInsertRowIDEv
+__ZN7WebCore15SQLiteStatement8bindBlobEiPKvi
+__ZN7WebCore12IconDatabase33setIconURLForPageURLInSQLDatabaseERKNS_6StringES3_
+__ZN7WebCore15SQLiteStatement9isExpiredEv
+__ZN7WebCore15SQLiteStatement14getColumnInt64Ei
+__ZN7WebCore12IconDatabase32setIconIDForPageURLInSQLDatabaseExRKNS_6StringE
+__ZN7WebCore12IconDatabase24checkForDanglingPageURLsEb
+__ZN7WebCore15SQLiteStatement23returnsAtLeastOneResultEv
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE6shrinkEm
+__ZN7WebCore12IconDatabase20pruneUnretainedIconsEv
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_13PageURLRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHa
+__ZN7WebCore17KeyframeAnimation14onAnimationEndEd
+__ZN7WebCore17KeyframeAnimation12endAnimationEb
+__ZN7WebCore13AnimationBase19setNeedsStyleRecalcEPNS_4NodeE
+__ZN7WebCore17KeyframeAnimation26resumeOverriddenAnimationsEv
+__ZN7WebCore18CompositeAnimation34resumeOverriddenImplicitAnimationsEi
+__ZN7WebCore17KeyframeAnimationD0Ev
+__ZN7WebCore12KeyframeListD1Ev
+__ZN7WebCore12KeyframeListD2Ev
+__ZN7WebCore13AnimationBaseD2Ev
+__ZN7WebCore26AnimationControllerPrivate32removeFromStyleAvailableWaitListEPNS_13AnimationBaseE
+__ZN7WebCore26AnimationControllerPrivate35removeFromStartTimeResponseWaitListEPNS_13AnimationBaseE
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE6shrinkEm
+__ZN7WebCore24RotateTransformOperationD0Ev
+__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE6shrinkEm
+__ZN7WebCore11RenderVideo13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11MediaPlayer5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore18MediaPlayerPrivate5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore15GraphicsContext5scaleERKNS_9FloatSizeE
+__ZN7WebCore15GraphicsContext28setImageInterpolationQualityENS_20InterpolationQualityE
+__ZN7WebCore11RenderLayer19removeOnlyThisLayerEv
+__ZN7WebCore11RenderLayer11removeChildEPS0_
+__ZN7WebCore11RenderLayer28dirtyVisibleDescendantStatusEv
+__ZSt21__inplace_stable_sortIPPN7WebCore11RenderLayerEPFbS2_S2_EEvT_S6_T0_
+__ZN7WebCore12RenderObject19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore11RenderImage8imageMapEv
+__ZNK7WebCore16HTMLImageElement6useMapEv
+__ZNK7WebCore8Document11getImageMapERKNS_6StringE
+-[DOMNode(DOMNodeExtensions) boundingBox]
+__ZN7WebCore12RenderObject23absoluteBoundingBoxRectEb
+__ZN7WebCore9RenderBox13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+-[DOMNode parentNode]
+__ZN7WebCore11RenderBlock13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+__Z4coreP11DOMDocument
+__ZN7WebCore25HistoryPropertyListWriterC2Ev
+__ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
+__ZN7WebCore28BinaryPropertyListSerializerC1ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore28BinaryPropertyListSerializerC2ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore22BinaryPropertyListPlanC1ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore22BinaryPropertyListPlanC2ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore25HistoryPropertyListWriter12writeObjectsERNS_30BinaryPropertyListObjectStreamE
+__ZN7WebCore22BinaryPropertyListPlan20writeDictionaryStartEv
+__ZN7WebCore22BinaryPropertyListPlan11writeStringERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringEmNS1_10StringHashENS_10HashTraitsIS2_EENS4_ImEEE3addERKS2_RKm
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_mENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTra
+__ZN7WebCore22BinaryPropertyListPlan17writeStringObjectERKNS_6StringE
+__ZN7WebCoreL25markerPlusLengthByteCountEm
+__ZN7WebCore22BinaryPropertyListPlan12writeIntegerEi
+__ZN3WTF7HashMapIimNS_7IntHashIjEENS_10HashTraitsIiEENS3_ImEEE3addERKiRKm
+__ZN3WTF9HashTableIiSt4pairIimENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_ImEEEES9_
+__ZN7WebCore22BinaryPropertyListPlan15writeArrayStartEv
+__ZN7WebCore25HistoryPropertyListWriter16writeHistoryItemERNS_30BinaryPropertyListObjectStreamEPNS_11HistoryItemE
+__ZNK7WebCore11HistoryItem14alternateTitleEv
+__ZNK7WebCore11HistoryItem12redirectURLsEv
+__ZN7WebCore22BinaryPropertyListPlan17writeUniqueStringERKNS_6StringE
+__ZN7WebCore22BinaryPropertyListPlan17writeUniqueStringEPKc
+__ZN7WebCore22BinaryPropertyListPlan17writeStringObjectEPKc
+__ZN7WebCore22BinaryPropertyListPlan17writeIntegerArrayEPKim
+__ZN3WTF7HashMapIN7WebCore12IntegerArrayEmNS1_16IntegerArrayHashENS1_22IntegerArrayHashTraitsENS_10HashTraitsImEEE3addERKS2_RKm
+__ZN3WTF9HashTableIN7WebCore12IntegerArrayESt4pairIS2_mENS_18PairFirstExtractorIS4_EENS1_16IntegerArrayHashENS_14PairHashTraits
+__ZN7WebCore16IntegerArrayHash4hashERKNS_12IntegerArrayE
+__ZN7WebCore22BinaryPropertyListPlan16writeArrayObjectEm
+__ZN7WebCore22BinaryPropertyListPlan18writeDictionaryEndEm
+__ZN7WebCore22BinaryPropertyListPlan21writeDictionaryObjectEm
+__ZN7WebCore16IntegerArrayHash5equalERKNS_12IntegerArrayES3_
+__ZN7WebCore22BinaryPropertyListPlan16writeBooleanTrueEv
+__ZN7WebCore22BinaryPropertyListPlan13writeArrayEndEm
+__ZN7WebCoreL11bytesNeededEm
+__ZN7WebCore25HistoryPropertyListWriter6bufferEm
+__ZN7WebCore28BinaryPropertyListSerializer20writeDictionaryStartEv
+__ZN7WebCore28BinaryPropertyListSerializer11writeStringERKNS_6StringE
+__ZNK7WebCore22BinaryPropertyListPlan21stringObjectReferenceERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEmNS1_10StringHashENS_10HashTraitsIS2_EENS4_ImEEE3getERKS2_
+__ZN7WebCore28BinaryPropertyListSerializer18appendStringObjectERKNS_6StringE
+__ZN7WebCore28BinaryPropertyListSerializer11startObjectEv
+__ZN7WebCore28BinaryPropertyListSerializer13appendIntegerEm
+__ZN7WebCore28BinaryPropertyListSerializer27addAggregateObjectReferenceEm
+__ZN7WebCore28BinaryPropertyListSerializer12writeIntegerEi
+__ZNK7WebCore22BinaryPropertyListPlan22integerObjectReferenceEi
+__ZNK3WTF7HashMapIimNS_7IntHashIjEENS_10HashTraitsIiEENS3_ImEEE3getERKi
+__ZN7WebCore28BinaryPropertyListSerializer19appendIntegerObjectEi
+__ZN7WebCore28BinaryPropertyListSerializer15writeArrayStartEv
+__ZN7WebCore28BinaryPropertyListSerializer17writeUniqueStringERKNS_6StringE
+__ZN7WebCore28BinaryPropertyListSerializer17writeUniqueStringEPKc
+__ZN7WebCore28BinaryPropertyListSerializer18appendStringObjectEPKc
+__ZN7WebCore28BinaryPropertyListSerializer17writeIntegerArrayEPKim
+__ZNK7WebCore22BinaryPropertyListPlan27integerArrayObjectReferenceEPKim
+__ZNK3WTF7HashMapIN7WebCore12IntegerArrayEmNS1_16IntegerArrayHashENS1_22IntegerArrayHashTraitsENS_10HashTraitsImEEE3getERKS2_
+__ZN7WebCore28BinaryPropertyListSerializer24appendIntegerArrayObjectEPKim
+__ZN7WebCore28BinaryPropertyListSerializer21appendObjectReferenceEm
+__ZN7WebCore28BinaryPropertyListSerializer18writeDictionaryEndEm
+__ZN7WebCoreL19moveAndReverseBytesEPhPKhm
+__ZN7WebCore28BinaryPropertyListSerializer16writeBooleanTrueEv
+__ZNK7WebCore22BinaryPropertyListPlan26booleanTrueObjectReferenceEv
+__ZN7WebCore28BinaryPropertyListSerializer13writeArrayEndEm
+__ZN7WebCore25HistoryPropertyListWriter11releaseDataEv
+__ZN7WebCore13InlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore12RenderInline19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore13HitTestResult13setURLElementEPNS_7ElementE
+__ZNK7WebCore12RenderObject19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore12RenderInline13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+-[WebCoreMovieObserver didEnd:]
+__ZN7WebCore18MediaPlayerPrivate6didEndEv
+__ZNK7WebCore16HTMLMediaElement4loopEv
+__ZN7WebCore10TimeRanges3addEff
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE15reserveCapacityEm
+-[DOMHTMLElement idName]
+__ZNK7WebCore11HTMLElement2idEv
+-[DOMHTMLElement className]
+__ZNK7WebCore11HTMLElement9classNameEv
+-[DOMElement tagName]
+__ZNK7WebCore11HTMLElement8nodeNameEv
+__ZNK7WebCore6String5upperEv
+__ZN7WebCore10StringImpl5upperEv
+-[DOMNode firstChild]
+-[DOMNode nextSibling]
+-[DOMNode previousSibling]
+__ZN7WebCore14JSHTMLDocument3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSDocument3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21setJSDocumentLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSDocument11setLocationEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK7WebCore16ScriptController21processingUserGestureEv
+__ZNK7WebCore16ScriptController26processingUserGestureEventEv
+__ZNK7WebCore16ScriptController28isJavaScriptAnchorNavigationEv
+__ZNK7WebCore16ScriptController30anyPageIsProcessingUserGestureEv
+__ZN7WebCore11FrameLoader22scheduleLocationChangeERKNS_6StringES3_bbb
+__ZN7WebCore11FrameLoader19scheduleRedirectionEPNS_20ScheduledRedirectionE
+__ZN7WebCore11FrameLoader21startRedirectionTimerEv
+__ZNK7WebCore9TimerBase16nextFireIntervalEv
+__ZN7WebCore11FrameLoader16clientRedirectedERKNS_4KURLEddb
+__ZN7WebCore5TimerINS_11FrameLoaderEE5firedEv
+__ZN7WebCore11FrameLoader21redirectionTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore11FrameLoader14changeLocationERKNS_4KURLERKNS_6StringEbbbb
+__ZN7WebCore11FrameLoader22executeIfJavaScriptURLERKNS_4KURLEbb
+__ZN7WebCore11FrameLoader11urlSelectedERKNS_15ResourceRequestERKNS_6StringEN3WTF10PassRefPtrINS_5EventEEEbbb
+__ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEE
+__ZN7WebCore11FrameLoader7loadURLERKNS_4KURLERKNS_6StringES6_bNS_13FrameLoadTypeEN3WTF10PassRefPtrINS_5EventEEENS9_INS_9FormSta
+__ZN7WebCore14SecurityOrigin16createFromStringERKNS_6StringE
+__ZN7WebCore11FrameLoader22findFrameForNavigationERKNS_12AtomicStringE
+__ZNK7WebCore9FrameTree4findERKNS_12AtomicStringE
+__ZNK7WebCore11FrameLoader21shouldAllowNavigationEPNS_5FrameE
+__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEbN3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore16NavigationActionC2ERKNS_4KURLENS_13FrameLoadTypeEbN3WTF10PassRefPtrINS_5EventEEE
+__ZNK7WebCore11HistoryItem3urlEv
+__ZNK7WebCore11HistoryItem11originalURLEv
+__ZN7WebCore11FrameLoader24loadWithNavigationActionERKNS_15ResourceRequestERKNS_16NavigationActionEbNS_13FrameLoadTypeEN3WTF10P
+__ZN7WebCore9DOMWindow25dispatchBeforeUnloadEventEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
+__ZN7WebCore17BeforeUnloadEventC1Ev
+__ZN7WebCore17BeforeUnloadEventC2Ev
+__ZN7WebCore17BeforeUnloadEventD0Ev
+__ZN7WebCore18MainResourceLoader15handleEmptyLoadERKNS_4KURLEb
+__ZN7WebCore11FrameLoader29generatedMIMETypeForURLSchemeERKNS_6StringE
+__ZNK7WebCore8Document17formElementsStateEv
+__ZN7WebCore11HistoryItem16setDocumentStateERKN3WTF6VectorINS_6StringELm0EEE
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE6shrinkEm
+__ZN7WebCore15JSEventListenerD0Ev
+__ZN7WebCore4Node31removeAllEventListenersSlowCaseEv
+__ZN7WebCore11FrameLoader36saveScrollPositionAndViewStateToItemEPNS_11HistoryItemE
+__ZN7WebCore11HistoryItem14setScrollPointERKNS_8IntPointE
+__ZN7WebCore11HistoryItem14addRedirectURLERKNS_6StringE
+__ZN7WebCore13AXObjectCacheD1Ev
+__ZN7WebCore13AXObjectCacheD2Ev
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E15deallocateTableEPji
+__ZN7WebCore16HTMLMediaElement26documentWillBecomeInactiveEv
+__ZN7WebCore16HTMLMediaElement17userCancelledLoadEv
+__ZN7WebCore16HTMLMediaElement17setPausedInternalEb
+__ZL62QTVideoRendererWebKitOnlyNewImageAvailableNotificationFunctionv
+__ZN7WebCore10RenderText7destroyEv
+__ZN7WebCore12RenderObject15virtualChildrenEv
+__ZN7WebCore26AnimationControllerPrivate5clearEPNS_12RenderObjectE
+__ZN7WebCore16StyleCachedImage12removeClientEPNS_12RenderObjectE
+__ZN7WebCore10RenderTextD0Ev
+__ZN7WebCore19StyleGeneratedImage12removeClientEPNS_12RenderObjectE
+__ZNK3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7IntHashIS2_EENS_14PairHashTraitsINS_10HashT
+__ZN3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_NS_6RefPtrINS1_5ImageEEEENS_18PairFirstExtractorIS7_EENS_7IntHashIS2_EENS_14Pai
+__ZN7WebCore14GeneratedImageD0Ev
+__ZN7WebCore8GradientD0Ev
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE6shrinkEm
+__ZN7WebCore5ImageD2Ev
+__ZN7WebCore13RenderReplicaD0Ev
+__ZN7WebCore18CompositeAnimation13clearRendererEv
+__ZN7WebCore18CompositeAnimationD1Ev
+__ZN7WebCore18CompositeAnimationD2Ev
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_17KeyframeAnimationEEEENS_18PairFirstExtractorIS8_EEN
+__ZN7WebCore9RenderBox45removeFloatingOrPositionedChildFromBlockListsEv
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN7WebCore16HTMLVideoElement6detachEv
+__ZN7WebCore11RenderMedia7destroyEv
+__ZN7WebCore11RenderMedia15virtualChildrenEv
+__ZN7WebCore11RenderVideoD0Ev
+__ZN7WebCore11RenderMediaD2Ev
+__ZN7WebCore14RenderReplacedD2Ev
+__ZN7WebCore11RenderImageD0Ev
+__ZN7WebCore9FrameView18unscheduleRelayoutEv
+__ZN7WebCore9FrameViewD0Ev
+__ZN7WebCore9FrameView15resetScrollbarsEv
+__ZN7WebCore10ScrollView25setHasHorizontalScrollbarEb
+__ZN7WebCore10ScrollView23setHasVerticalScrollbarEb
+__ZN7WebCore10ScrollViewD2Ev
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTable
+__ZN7WebCore6WidgetD2Ev
+__ZN7WebCore11FrameLoader33clientRedirectCancelledOrFinishedEb
+__ZN3WTF6VectorIN7WebCore16ResourceResponseELm0EE6shrinkEm
+__ZNK7WebCore12RenderObject13hoverAncestorEv
+__ZN7WebCore17HTMLAnchorElement9setActiveEbb
+__ZN7WebCore12RenderInline29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore12RenderInline16linesBoundingBoxEv
+__ZN7WebCore10handCursorEv
+__ZN7WebCoreL15leakNamedCursorEPKcii
+__ZNK7WebCore12RenderObject23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZN7WebCore17HTMLAnchorElement19defaultEventHandlerEPNS_5EventE
+__ZNK7WebCore13HitTestResult11targetFrameEv
+__ZNK7WebCore17HTMLAnchorElement6targetEv
+__ZNK7WebCore13RootInlineBox11ellipsisBoxEv
+__ZN7WebCore15GraphicsContext18setStrokeThicknessEf
+__ZN7WebCore15GraphicsContext26setPlatformStrokeThicknessEf
+__ZN7WebCore15GraphicsContext14setStrokeColorERKNS_5ColorE
+__ZN7WebCore15GraphicsContext15drawLineForTextERKNS_8IntPointEib
+__ZNK7WebCore15GraphicsContext15strokeThicknessEv
+__ZN7WebCore15GraphicsContext19roundToDevicePixelsERKNS_9FloatRectE
+__ZNK7WebCore15GraphicsContext15shouldAntialiasEv
+__ZN7WebCoreL32fontCacheATSNotificationCallbackEP27ATSFontNotificationInfoRef_Pv
+__ZN7WebCore9FontCache10invalidateEv
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore16FontPlatformDataEKNS_7HashMapINS1_24FontPlatformDataCacheKeyES3_NS1_28FontPlatformDa
+__ZN7WebCore15CSSFontSelector20fontCacheInvalidatedEv
+__ZN7WebCore9FontCache21purgeInactiveFontDataEi
+__ZN7WebCore14SimpleFontDataD0Ev
+__ZN7WebCore14SimpleFontData15platformDestroyEv
+__ZN7WebCore17GlyphPageTreeNode17pruneTreeFontDataEPKNS_14SimpleFontDataE
+__ZN7WebCore17GlyphPageTreeNode13pruneFontDataEPKNS_14SimpleFontDataEj
+__ZN7WebCore17GlyphPageTreeNodeD1Ev
+__ZN7WebCore17GlyphPageTreeNodeD2Ev
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore17GlyphPageTreeNodeEKNS_7HashMapIPKNS1_8FontDataES3_NS_7PtrHashIS7_EENS_10HashTraitsIS
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore13GlyphWidthMap14GlyphWidthPageEKNS_7HashMapIiS4_NS_7IntHashIjEENS_10HashTraitsIiEENS8
+__ZN7WebCore8FontDataD2Ev
+__ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE14deleteAllNodesEv
+__ZNK3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_S3_IPNS1_14SimpleFontDataEjEENS_18PairFirstExtractorIS7_EENS1_20Font
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore12FontSelectorEEELm0EE6shrinkEm
+__ZN7WebCore21DeprecatedPtrListImpl5clearEb
+__ZN7WebCore17DeprecatedPtrListINS_11RenderBlock14FloatingObjectEE10deleteFuncEPv
+__ZN7WebCore21DeprecatedPtrListImpl4takeEv
+__ZN7WebCore21DeprecatedPtrListImpl6removeEb
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_11RenderBlock14FloatingObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_PNS1_11RenderBlock14FloatingObjectEENS_18PairFirstExtractorIS8_EENS_7Ptr
+__ZN7WebCore13InlineFlowBoxD0Ev
+__ZN7WebCore11RenderTheme17adjustRepaintRectEPKNS_12RenderObjectERNS_7IntRectE
+__ZNK7WebCore8ThemeMac23inflateControlPaintRectENS_11ControlPartEjRNS_7IntRectEf
+__ZN7WebCore9RenderBox26repaintDuringLayoutIfMovedERKNS_7IntRectE
+__ZN7WebCore11HistoryItemD1Ev
+__ZN7WebCore11HistoryItemD2Ev
+__ZN7WebCore12IconDatabase21releaseIconForPageURLERKNS_6StringE
+__ZN3WTF6VectorIiLm0EE6shrinkEm
+__ZNK7WebCore14RenderThemeMac20supportsControlTintsEv
+__ZN7WebCore15GraphicsContext23setUpdatingControlTintsEb
+__ZNK7WebCore14RenderThemeMac20controlSupportsTintsEPKNS_12RenderObjectE
+__ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
+__ZN7WebCore22ScriptExecutionContext26canSuspendActiveDOMObjectsEv
+__ZN7WebCore5Frame14clearDOMWindowEv
+__ZN3WTF7HashSetIPN7WebCore9DOMWindowENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZN7WebCore9DOMWindow5clearEv
+__ZN7WebCore9Navigator15disconnectFrameEv
+__ZN7WebCore16ScriptController16clearWindowShellEv
+__ZN7WebCore15JSDOMWindowBase5clearEv
+__ZN7WebCore15JSDOMWindowBase27clearHelperObjectPropertiesEv
+__ZN7WebCore12gcControllerEv
+__ZN7WebCore12GCControllerC1Ev
+__ZN7WebCore12GCControllerC2Ev
+__ZN7WebCore12GCController18garbageCollectSoonEv
+__ZN7WebCore16ScriptController18clearScriptObjectsEv
+__ZN3JSC8Bindings10RootObject10invalidateEv
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47remov
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6remove
+-[WebScriptObject _setOriginRootObject:andRootObject:]
+__ZN3JSC8Bindings10RootObjectD1Ev
+__ZN3JSC8Bindings10RootObjectD2Ev
+__ZN7WebCore5Frame25setUseSecureKeyboardEntryEb
+__ZN7WebCore12SharedBuffer6appendEPKci
+__ZN7WebCore12SharedBuffer25maybeTransferPlatformDataEv
+__ZN7WebCore9CSSParser11parseShadowEib
+__ZN7WebCore18ShadowParseContext11commitValueEv
+__ZN7WebCore11ShadowValueC1EN3WTF10PassRefPtrINS_17CSSPrimitiveValueEEES4_S4_S4_
+__ZN7WebCore11ShadowValueC2EN3WTF10PassRefPtrINS_17CSSPrimitiveValueEEES4_S4_S4_
+__ZN7WebCore9CSSParser14createRuleListEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE15reserveCapacityEm
+__ZN7WebCore9CSSParser15createMediaRuleEPNS_9MediaListEPNS_11CSSRuleListE
+__ZN7WebCore12CSSMediaRuleC1EPNS_13CSSStyleSheetEN3WTF10PassRefPtrINS_9MediaListEEENS4_INS_11CSSRuleListEEE
+__ZN7WebCore12CSSMediaRuleC2EPNS_13CSSStyleSheetEN3WTF10PassRefPtrINS_9MediaListEEENS4_INS_11CSSRuleListEEE
+__ZN7WebCore9CSSParser27createFloatingMediaQueryExpERKNS_12AtomicStringEPNS_18CSSParserValueListE
+__ZN7WebCore13MediaQueryExpC1ERKNS_12AtomicStringEPNS_18CSSParserValueListE
+__ZN7WebCore13MediaQueryExpC2ERKNS_12AtomicStringEPNS_18CSSParserValueListE
+__ZN7WebCore9CSSParser25sinkFloatingMediaQueryExpEPNS_13MediaQueryExpE
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE6shrinkEm
+__ZN7WebCore12CSSMediaRule11isMediaRuleEv
+__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_13MediaQueryExpE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_5FrameENS1_18MediaFeaturePrefixEENS_7Pt
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_5FrameENS1_18MediaFeatureP
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_5FrameENS1_18MediaFeaturePrefixEENS_7P
+__ZN7WebCoreL32max_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore10screenRectEPNS_6WidgetE
+__ZN7WebCore11toUserSpaceERK6CGRectP8NSWindow
+__ZN7WebCore9FloatRectC1ERK6CGRect
+__ZN7WebCore9FloatRectC2ERK6CGRect
+__ZN7WebCore10FloatPointC1ERK7CGPoint
+__ZN7WebCore10FloatPointC2ERK7CGPoint
+__ZN7WebCore9FloatSizeC1ERK6CGSize
+__ZN7WebCore9FloatSizeC2ERK6CGSize
+__ZN7WebCore9FloatRect5scaleEf
+__ZN7WebCore17CSSPrimitiveValue16computeLengthIntEPNS_11RenderStyleE
+__ZN7WebCore12compareValueIiEEbT_S1_NS_18MediaFeaturePrefixE
+__ZN7WebCore17jsDOMWindowOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6onloadEv
+__ZNK7WebCore9DOMWindow25getAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore16JSDOMWindowShell3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore11JSDOMWindow3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20setJSDOMWindowOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17JSDOMGlobalObject30createJSAttributeEventListenerEN3JSC7JSValueE
+__ZN7WebCore9DOMWindow9setOnloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore9DOMWindow25setAttributeEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore9DOMWindow27clearAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore20StringSourceProviderD0Ev
+__ZN7WebCoreL16ulistConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLUListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLUListElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLUListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLUListElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLUListElement17endTagRequirementEv
+__ZNK7WebCore16HTMLUListElement11tagPriorityEv
+__ZN7WebCore10HTMLParser29nestedPCloserCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL13liConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore13HTMLLIElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13HTMLLIElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore13HTMLLIElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore13HTMLLIElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore13HTMLLIElement17endTagRequirementEv
+__ZNK7WebCore13HTMLLIElement11tagPriorityEv
+__ZN7WebCore13HTMLLIElement6attachEv
+__ZN7WebCore15FormDataBuilder15parseMethodTypeERKNS_6StringE
+__ZN7WebCore12RenderInline9splitFlowEPNS_12RenderObjectEPNS_11RenderBlockES2_PNS_20RenderBoxModelObjectE
+__ZN7WebCore12RenderInline12splitInlinesEPNS_11RenderBlockES2_S2_PNS_12RenderObjectEPNS_20RenderBoxModelObjectE
+__ZN7WebCore12RenderInline11cloneInlineEPS0_
+__ZNK7WebCore14RenderThemeMac22adjustSearchFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac18setSearchFieldSizeEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac16searchFieldSizesEv
+__ZN7WebCore12RenderInline22addChildToContinuationEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderInline18continuationBeforeEPNS_12RenderObjectE
+__ZN7WebCoreL16nextContinuationEPNS_12RenderObjectE
+__ZN7WebCore23TextControlInnerElementC1EPNS_8DocumentEPNS_4NodeE
+__ZNK7WebCore27RenderTextControlSingleLine21createInnerBlockStyleEPKNS_11RenderStyleE
+__ZN7WebCore31SearchFieldResultsButtonElementC1EPNS_8DocumentE
+__ZN7WebCore31SearchFieldResultsButtonElementC2EPNS_8DocumentE
+__ZNK7WebCore27RenderTextControlSingleLine24createResultsButtonStyleEPKNS_11RenderStyleE
+__ZN7WebCore11RenderStyle20getCachedPseudoStyleENS_8PseudoIdE
+__ZNK7WebCore14RenderThemeMac32adjustSearchFieldDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac18resultsButtonSizesEv
+__ZN7WebCore11RenderStyle20addCachedPseudoStyleEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCore30SearchFieldCancelButtonElementC1EPNS_8DocumentE
+__ZN7WebCore30SearchFieldCancelButtonElementC2EPNS_8DocumentE
+__ZNK7WebCore27RenderTextControlSingleLine23createCancelButtonStyleEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac34adjustSearchFieldCancelButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac17cancelButtonSizesEv
+__ZNK7WebCore27RenderTextControlSingleLine25visibilityForCancelButtonEv
+__ZNK7WebCore27RenderTextControlSingleLine28updateCancelButtonVisibilityEv
+__ZN7WebCore11RenderStyle17setHasPseudoStyleENS_8PseudoIdE
+__ZNK7WebCore8CSSValue21isImageGeneratorValueEv
+__ZN7WebCore11RenderStyle10setContentEN3WTF10PassRefPtrINS_10StringImplEEEb
+__ZN7WebCore11ContentData13deleteContentEv
 __ZN7WebCoreL17iframeConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLIFrameElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
-__ZN7WebCore20HTMLFrameElementBaseC2ERKNS_13QualifiedNameEPNS_8DocumentEb
-__ZN7WebCore21HTMLFrameOwnerElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17HTMLIFrameElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLIFrameElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20HTMLFrameElementBaseC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21HTMLFrameOwnerElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore17HTMLIFrameElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore17HTMLIFrameElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore20HTMLFrameElementBase20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore20HTMLFrameElementBase11setLocationERKNS_6StringE
 __ZNK7WebCore17HTMLIFrameElement17endTagRequirementEv
 __ZNK7WebCore17HTMLIFrameElement11tagPriorityEv
 __ZN7WebCore17HTMLIFrameElement20insertedIntoDocumentEv
@@ -4754,1413 +5724,324 @@
 __ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE15reserveCapacityEm
 __ZN7WebCore17HTMLIFrameElement16rendererIsNeededEPNS_11RenderStyleE
 __ZNK7WebCore20HTMLFrameElementBase12isURLAllowedERKNS_12AtomicStringE
+__ZN7WebCore16equalIgnoringRefERKNS_4KURLES2_
 __ZN7WebCore17HTMLIFrameElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16RenderPartObjectC1EPNS_21HTMLFrameOwnerElementE
-__ZN7WebCore10RenderPartC2EPNS_21HTMLFrameOwnerElementE
+__ZN7WebCore16RenderPartObjectC1EPNS_7ElementE
+__ZN7WebCore16RenderPartObjectC2EPNS_7ElementE
+__ZN7WebCore10RenderPartC2EPNS_7ElementE
 __ZN7WebCore12RenderWidgetC2EPNS_4NodeE
-__ZN7WebCore14RenderReplacedC2EPNS_4NodeE
-__ZN7WebCore10RenderView9addWidgetEPNS_12RenderObjectE
-__ZN3WTF7HashSetIPN7WebCore12RenderObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore12RenderWidget14styleDidChangeENS_11RenderStyle4DiffEPKS1_
+__ZN7WebCore10RenderView9addWidgetEPNS_12RenderWidgetE
+__ZN3WTF7HashSetIPN7WebCore12RenderWidgetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__ZN7WebCore12RenderWidget14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZN7WebCore13ContainerNode27dispatchPostAttachCallbacksEv
 __ZN7WebCore20HTMLFrameElementBase25setNameAndOpenURLCallbackEPNS_4NodeE
 __ZN7WebCore20HTMLFrameElementBase17setNameAndOpenURLEv
 __ZNK7WebCore9FrameTree15uniqueChildNameERKNS_12AtomicStringE
 __ZN7WebCore20HTMLFrameElementBase7openURLEv
 __ZN7WebCore11FrameLoader12requestFrameEPNS_21HTMLFrameOwnerElementERKNS_6StringERKNS_12AtomicStringE
+__ZN7WebCore11FrameLoader11completeURLERKNS_6StringE
 __ZN7WebCore11FrameLoader12loadSubframeEPNS_21HTMLFrameOwnerElementERKNS_4KURLERKNS_6StringES8_
 __ZNK7WebCore20HTMLFrameElementBase13scrollingModeEv
-__ZNK3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E8containsIS2_NS_22IdentityHashTranslatorIS2_S2_S5_EEEEbRKT_
 __ZN7WebCore9FrameTree11appendChildEN3WTF10PassRefPtrINS_5FrameEEE
 __ZNK7WebCore10RenderPart12isRenderPartEv
 __ZN7WebCore10RenderPart9setWidgetEPNS_6WidgetE
 __ZNK7WebCore9FrameView11isFrameViewEv
 __ZN7WebCore12RenderWidget9setWidgetEPNS_6WidgetE
-__ZN7WebCoreL17widgetRendererMapEv
-__ZN3WTF9HashTableIPKN7WebCore6WidgetESt4pairIS4_PNS1_12RenderWidgetEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E6expandEv
+__ZN3WTF7HashMapIPKN7WebCore6WidgetEPNS1_12RenderWidgetENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore6WidgetESt4pairIS4_PNS1_12RenderWidgetEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHa
 __ZN7WebCore10ScrollView8addChildEPNS_6WidgetE
 __ZN7WebCore10ScrollView9setParentEPS0_
 __ZN7WebCore6Widget9setParentEPNS_10ScrollViewE
 __ZN3WTF7HashSetIPN7WebCore6WidgetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
 __ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
 __ZN7WebCore10ScrollView16platformAddChildEPNS_6WidgetE
 __ZN7WebCore16RenderPartObject11viewClearedEv
 __ZN7WebCore9FrameView20setCanHaveScrollbarsEb
 __ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE6shrinkEm
 __ZNK7WebCore14SecurityOrigin9canAccessEPKS0_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE6shrinkEm
 __ZN7WebCore11FrameLoader21loadURLIntoChildFrameERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZN7WebCore11FrameLoader18currentHistoryItemEv
+__ZNK7WebCore11HistoryItem8childrenEv
 __ZN7WebCore14DocumentLoader21popArchiveForSubframeERKNS_6StringE
-__ZN7WebCore11HistoryItem12addChildItemEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCore14ResourceHandle16setDefersLoadingEb
 __ZNK7WebCore12RenderWidget8isWidgetEv
 __ZN7WebCore5Frame19setInViewSourceModeEb
 __ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE14shrinkCapacityEm
 __ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE6shrinkEm
 __ZN7WebCore16RenderPartObject12updateWidgetEb
-__ZNK7WebCore12RenderObject15canHaveChildrenEv
-__ZN7WebCore16RenderPartObject6layoutEv
-__ZNK7WebCore9RenderBox17calcReplacedWidthEb
-__ZN7WebCore14RenderReplaced14calcPrefWidthsEv
-__ZNK7WebCore9RenderBox18calcReplacedHeightEv
-__ZN7WebCore12RenderWidget6layoutEv
-__ZN7WebCore10RenderPart20updateWidgetPositionEv
-__ZNK7WebCore9RenderBox15localToAbsoluteENS_10FloatPointEbb
-__ZNK7WebCore10RenderView15localToAbsoluteENS_10FloatPointEbb
-__ZN7WebCore10ScrollView12setFrameRectERKNS_7IntRectE
-__ZN7WebCore6Widget12setFrameRectERKNS_7IntRectE
-__ZN7WebCore12RenderWidget5derefEPNS_11RenderArenaE
-__ZNK7WebCore10RenderView8viewRectEv
-__ZN7WebCore11FrameLoader15parentCompletedEv
-__ZN7WebCore12RenderWidget5paintERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore9RenderBox15borderFitAdjustERiS1_
-__ZN7WebCore10ScrollView5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore6Widget5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZNK7WebCore11RenderLayer20requiresSlowRepaintsEv
-__ZN7WebCore9FrameView18setUseSlowRepaintsEv
-__ZN7WebCore12RenderWidget11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN3WTF6VectorIN7WebCore9FrameDataELm0EE6shrinkEm
-__ZN7WebCore9FrameData5clearEb
-__ZN7WebCoreL21subframeForTargetNodeEPNS_4NodeE
-__ZN7WebCore12EventHandler28passMouseMoveEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
-__ZN7WebCore12EventHandler27passSubframeEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
-__ZNK7WebCore9FrameTree14isDescendantOfEPKNS_5FrameE
-__ZNK7WebCore6Editor17insideVisibleAreaERKNS_8IntPointE
-__ZN7WebCoreL30createHTMLIFrameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLIFrameElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSHTMLIFrameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLIFrameElementEEE
-__ZN7WebCore19JSHTMLIFrameElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore25setJSHTMLIFrameElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19JSHTMLIFrameElement6setSrcEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore20HTMLFrameElementBase6setSrcERKNS_6StringE
-__ZN7WebCore20HTMLFrameElementBase11setLocationERKNS_6StringE
-__ZN7WebCore16equalIgnoringRefERKNS_4KURLES2_
-__ZN7WebCore11FrameLoader15userGestureHintEv
-__ZN7WebCore13PageURLRecordD1Ev
-__ZN7WebCore6Widget16removeFromParentEv
-__ZN7WebCore10ScrollView11removeChildEPNS_6WidgetE
-__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore10ScrollView19platformRemoveChildEPNS_6WidgetE
-__ZN7WebCore6Widget19removeFromSuperviewEv
-__ZN7WebCoreL23safeRemoveFromSuperviewEP6NSView
-__ZN3WTF9HashTableIPKN7WebCore6WidgetESt4pairIS4_PNS1_12RenderWidgetEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E4findIS4_NS_22IdentityHashTranslatorIS4_S8_SC_EEEENS_17HashTableIteratorIS4_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore10RenderPart12deleteWidgetEv
-__ZNK7WebCore9RenderBox18absoluteContentBoxEv
-__ZN7WebCore12RenderWidget17setWidgetGeometryERKNS_7IntRectE
-__ZN7WebCore13CharacterData21dispatchModifiedEventEPNS_10StringImplE
-__ZN7WebCore8Document11textRemovedEPNS_4NodeEjj
-__ZN7WebCore8Document13removeMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
-__ZN7WebCore8Document12shiftMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
-__ZN7WebCore18setJSDOMWindowNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow7setNameERKNS_6StringE
-__ZN7WebCore15jsDOMWindowNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow4nameEv
-__ZN7WebCore22setJSDOMWindowLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11JSDOMWindow11setLocationEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore9FrameTree11removeChildEPNS_5FrameE
-__ZN7WebCore11FrameLoader22scheduleCheckCompletedEv
-__ZN7WebCore21DeprecatedPtrListImplD1Ev
-__ZN7WebCore12RenderWidget7destroyEv
-__ZN7WebCore16RenderPartObjectD1Ev
-__ZN7WebCore9FrameView20removeWidgetToUpdateEPNS_16RenderPartObjectE
-__ZN7WebCore12RenderWidget12deleteWidgetEv
-__ZN7WebCoreL14preConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore14HTMLPreElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore14HTMLPreElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore14HTMLPreElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore14HTMLPreElement17endTagRequirementEv
-__ZNK7WebCore14HTMLPreElement11tagPriorityEv
-__ZN7WebCore26setJSHTMLInputElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement8setValueERKNS_6StringE
-__ZN7WebCore16HTMLInputElement14cacheSelectionEii
-__ZNK7WebCore11JSDOMWindow9classInfoEv
--[DOMAbstractView(Frame) _disconnectFrame]
--[DOMAbstractView dealloc]
-__ZN7WebCore15removeJSWrapperEPN3JSC8JSObjectE
-__ZN7WebCoreL27createHTMLPreElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore16JSHTMLPreElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSHTMLPreElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLPreElementEEE
-__ZN7WebCore16JSHTMLPreElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSHTMLPreElement9classInfoEv
-__ZN7WebCoreL26createHTMLBRElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore15JSHTMLBRElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSHTMLBRElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLBRElementEEE
-__ZNK7WebCore15JSHTMLBRElement9classInfoEv
-__ZN7WebCore12IconDatabase23iconDataKnownForIconURLERKNS_6StringE
-__ZN7WebCore27RenderTextControlSingleLine11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore17RenderTextControl17hitInnerTextBlockERNS_13HitTestResultEiiii
-__ZNK7WebCore22HTMLFormControlElement11isFocusableEv
-__ZNK7WebCore16HTMLInputElement16isMouseFocusableEv
-__ZN7WebCore16HTMLInputElement18dispatchFocusEventEv
-__ZN7WebCore12InputElement18dispatchFocusEventERNS_16InputElementDataEPNS_8DocumentE
-__ZThn72_NK7WebCore16HTMLInputElement15isPasswordFieldEv
-__ZNK7WebCore16HTMLInputElement15isPasswordFieldEv
-__ZN7WebCore15EventTargetNode18dispatchFocusEventEv
-__ZN7WebCore27RenderTextControlSingleLine27capsLockStateMayHaveChangedEv
-__ZN7WebCore13ContainerNode8setFocusEb
-__ZN7WebCore4Node8setFocusEb
-__ZN7WebCore14focusRingColorEv
-+[WebCoreControlTintObserver controlTintDidChange]
-__ZN7WebCore26usesTestModeFocusRingColorEv
-__ZNK7WebCore14SVGRenderStyle17inheritedNotEqualEPKS0_
-__ZN7WebCoreL13widgetForNodeEPNS_4NodeE
-__ZN7WebCore6Widget8setFocusEv
-__ZN7WebCore5Frame14frameForWidgetEPKNS_6WidgetE
-__ZN7WebCore12RenderWidget4findEPKNS_6WidgetE
-__ZN3WTF7HashMapIPKN7WebCore6WidgetEPNS1_12RenderWidgetENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
--[NSScrollView(WebCoreView) _webcore_effectiveFirstResponder]
--[NSClipView(WebCoreView) _webcore_effectiveFirstResponder]
--[NSView(WebCoreView) _webcore_effectiveFirstResponder]
-__ZNK7WebCore16HTMLInputElement20shouldUseInputMethodEv
-__ZNK7WebCore28MouseEventWithHitTestResults10localPointEv
-__ZN7WebCore12RenderObject16positionForPointERKNS_8IntPointE
-__ZN7WebCore11RenderBlock22positionForCoordinatesEii
-__ZNK7WebCore11RenderBlock17offsetForContentsERiS1_
-__ZNK7WebCore11RenderLayer24addScrolledContentOffsetERiS1_
-__ZN7WebCore13RootInlineBox23closestLeafChildForXPosEib
-__ZN7WebCore9InlineBox13lastLeafChildEv
-__ZN7WebCore10RenderText22positionForCoordinatesEii
-__ZNK7WebCore13InlineTextBox17offsetForPositionEib
-__ZNK7WebCore4Font17offsetForPositionERKNS_7TextRunEib
-__ZNK7WebCore4Font30offsetForPositionForSimpleTextERKNS_7TextRunEib
-__ZN7WebCore13WidthIterator19advanceOneCharacterERfPNS_11GlyphBufferE
-__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE14shrinkCapacityEm
-__ZN3WTF6VectorItLm2048EE14shrinkCapacityEm
-__ZN3WTF6VectorI6CGSizeLm2048EE14shrinkCapacityEm
-__ZN7WebCore15VisiblePositionC1ERKNS_8PositionENS_9EAffinityE
-__ZN7WebCore9SelectionC1ERKNS_15VisiblePositionE
-__ZN7WebCore9Selection8validateEv
-__ZN7WebCore16comparePositionsERKNS_8PositionES2_
-__ZN7WebCore9Selection24adjustForEditableContentEv
-__ZN7WebCore22lowestEditableAncestorEPNS_4NodeE
-__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_9SelectionE
-__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_9SelectionES3_NS_9EAffinityEb
-__ZNK7WebCore9Selection7toRangeEv
-__ZN7WebCore5Frame22setFocusedNodeIfNeededEv
-__ZNK7WebCore15VisiblePosition14localCaretRectERPNS_12RenderObjectE
-__ZN7WebCore10RenderText14localCaretRectEPNS_9InlineBoxEiPi
-__ZNK7WebCore13InlineTextBox17positionForOffsetEi
-__ZNK7WebCore12RenderObject19offsetFromContainerEPS0_
-__ZN7WebCore5Frame25respondToChangedSelectionERKNS_9SelectionEb
-__ZN7WebCore6Editor32isContinuousSpellCheckingEnabledEv
-__ZN7WebCore6Editor24isGrammarCheckingEnabledEv
-__ZN7WebCore6Editor25respondToChangedSelectionERKNS_9SelectionE
-__ZN7WebCore22DeleteButtonController25respondToChangedSelectionERKNS_9SelectionE
-__ZN7WebCore19SelectionController37notifyAccessibilityForSelectionChangeEv
-__ZN7WebCore12EventHandler32handleMousePressEventDoubleClickERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore12EventHandler31selectClosestWordFromMouseEventERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore9Selection22expandUsingGranularityENS_15TextGranularityE
-__ZN7WebCore15isEndOfDocumentERKNS_15VisiblePositionE
-__ZNK7WebCore15VisiblePosition4nextEb
-__ZN7WebCore29nextVisuallyDistinctCandidateERKNS_8PositionE
-__ZNK7WebCore8Position5atEndEv
-__ZNK7WebCore8Position4nextENS_24EUsingComposedCharactersE
-__ZN7WebCore11isEndOfLineERKNS_15VisiblePositionE
-__ZN7WebCore9endOfLineERKNS_15VisiblePositionE
-__ZN7WebCoreL18endPositionForLineERKNS_15VisiblePositionE
-__ZN7WebCore13InlineFlowBox13lastLeafChildEv
-__ZN7WebCore9InlineBox13nextLeafChildEv
-__ZNK7WebCore12RenderObject14nextInPreOrderEPS0_
-__ZNK7WebCore12RenderObject27nextInPreOrderAfterChildrenEPS0_
-__ZNK7WebCore15VisiblePosition31honorEditableBoundaryAtOrBeforeERKS0_
-__ZN7WebCore11startOfWordERKNS_15VisiblePositionENS_9EWordSideE
-__ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionE
-__ZN7WebCore14endOfParagraphERKNS_15VisiblePositionE
-__ZN7WebCore14enclosingBlockEPNS_4NodeE
-__ZN7WebCore19enclosingNodeOfTypeERKNS_8PositionEPFbPKNS_4NodeEEb
-__ZN7WebCore7isBlockEPKNS_4NodeE
-__ZNK7WebCore10RenderText22caretMaxRenderedOffsetEv
-__ZNK7WebCore10RenderText14caretMaxOffsetEv
-__ZN7WebCoreL16previousBoundaryERKNS_15VisiblePositionEPFjPKtjE
-__ZNK7WebCore4Node25enclosingBlockFlowElementEv
-__ZNK7WebCore4Node11isBlockFlowEv
-__ZN7WebCore31SimplifiedBackwardsTextIteratorC1EPKNS_5RangeE
-__ZN7WebCore31SimplifiedBackwardsTextIterator7advanceEv
-__ZN7WebCore31SimplifiedBackwardsTextIterator14handleTextNodeEv
-__ZN3WTF6VectorItLm1024EE7prependItEEvPKT_m
-__ZN3WTF6VectorItLm1024EE6insertItEEvmPKT_m
-__ZN7WebCoreL17startWordBoundaryEPKtj
-__ZN7WebCore16findWordBoundaryEPKtiiPiS2_
-__ZNK7WebCore31SimplifiedBackwardsTextIterator5rangeEv
-__ZN7WebCore9endOfWordERKNS_15VisiblePositionENS_9EWordSideE
-__ZN7WebCoreL12nextBoundaryERKNS_15VisiblePositionEPFjPKtjE
-__ZN3WTF6VectorItLm1024EE14expandCapacityEmPKt
-__ZN3WTF6VectorItLm1024EE14expandCapacityEm
-__ZN3WTF6VectorItLm1024EE15reserveCapacityEm
-__ZN7WebCoreL15endWordBoundaryEPKtj
-__ZN7WebCore6Editor33isSelectTrailingWhitespaceEnabledEv
-__ZN7WebCore10RenderText17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZNK7WebCore12RenderObject17selectionStartEndERiS1_
-__ZNK7WebCore10RenderView17selectionStartEndERiS1_
-__ZNK7WebCore13InlineTextBox10isSelectedEii
-__ZN7WebCore13RootInlineBox22setHasSelectedChildrenEb
-__ZN7WebCore11RenderBlock17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZNK7WebCore12RenderObject7childAtEj
-__ZNK7WebCore10RenderText18canBeSelectionLeafEv
-__ZN7WebCore10RenderText13selectionRectEb
-__ZN7WebCore13InlineTextBox13selectionRectEiiii
-__ZN7WebCore12RenderObject21computeRectForRepaintEPNS_9RenderBoxERNS_7IntRectEb
-__ZN3WTF7HashMapIPN7WebCore11RenderBlockEPNS2_18BlockSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
-__ZN7WebCore11RenderBlock17selectionGapRectsEv
-__ZNK7WebCore11RenderBlock15isSelectionRootEv
-__ZN7WebCore11RenderBlock19leftSelectionOffsetEPS0_i
-__ZN7WebCore11RenderBlock20rightSelectionOffsetEPS0_i
-__ZN7WebCore11RenderBlock17fillSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
-__ZN7WebCore11RenderBlock23fillInlineSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
-__ZN7WebCore13RootInlineBox20fillLineSelectionGapEiiPNS_11RenderBlockEiiiiPKNS_12RenderObject9PaintInfoE
-__ZN7WebCore13RootInlineBox14selectionStateEv
-__ZN7WebCore11RenderBlock29getHorizontalSelectionGapInfoENS_12RenderObject14SelectionStateERbS3_
-__ZN7WebCore13RootInlineBox16firstSelectedBoxEv
-__ZN7WebCore13RootInlineBox15lastSelectedBoxEv
-__ZN3WTF9HashTableIPN7WebCore11RenderBlockESt4pairIS3_PNS2_18BlockSelectionInfoEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6expandEv
-__ZN7WebCore11RenderBlock22fillBlockSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
-__ZNK7WebCore10RenderView14selectionStartEv
-__ZNK7WebCore12RenderObject18canBeSelectionLeafEv
-__ZN7WebCoreL24clipOutPositionedObjectsEPKNS_12RenderObject9PaintInfoEiiPN3WTF11ListHashSetIPNS_9RenderBoxENS4_7PtrHashIS7_EEEE
-__ZN7WebCore13InlineTextBox14paintSelectionEPNS_15GraphicsContextEiiPNS_11RenderStyleERKNS_4FontE
-__ZN7WebCore13InlineTextBox17selectionStartEndERiS1_
-__ZNK7WebCore12RenderObject24selectionBackgroundColorEv
-__ZNK7WebCore11RenderTheme30activeSelectionBackgroundColorEv
-__ZNK7WebCore14RenderThemeMac38platformActiveSelectionBackgroundColorEv
-__ZNK7WebCore5Color14blendWithWhiteEv
-__ZN7WebCoreL14blendComponentEii
-__ZN7WebCore15GraphicsContext20drawHighlightForTextERKNS_4FontERKNS_7TextRunERKNS_8IntPointEiRKNS_5ColorEii
-__ZNK7WebCore12RenderObject24selectionForegroundColorEv
-__ZNK7WebCore11RenderTheme30activeSelectionForegroundColorEv
-__ZNK7WebCore14RenderThemeMac33supportsSelectionForegroundColorsEv
-__ZN7WebCore12EventHandler27handleMouseDoubleClickEventERKNS_18PlatformMouseEventE
-__ZN7WebCore5Range11compareNodeEPNS_4NodeERi
-__ZN7WebCore5Range12comparePointEPNS_4NodeEiRi
-__ZN7WebCore5Range23commonAncestorContainerEPNS_4NodeES2_
-__ZN7WebCore12EventHandler32handleMousePressEventTripleClickERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore13isStartOfLineERKNS_15VisiblePositionE
-__ZN7WebCore16startOfParagraphERKNS_15VisiblePositionE
-__ZNK7WebCore4Node29traversePreviousNodePostOrderEPKS0_
-__ZN7WebCore25isFirstPositionAfterTableERKNS_15VisiblePositionE
-__ZN3WTF7HashMapIPN7WebCore12RenderObjectEPNS2_13SelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_PNS2_13SelectionInfoEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SB_EEEENS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCore21PlatformKeyboardEventC1EP7NSEvent
-__ZN7WebCore12EventHandler8keyEventERKNS_21PlatformKeyboardEventE
-__ZN7WebCoreL26eventTargetNodeForDocumentEPNS_8DocumentE
-__ZN7WebCore12EventHandler15handleAccessKeyERKNS_21PlatformKeyboardEventE
-__ZN7WebCore12EventHandler18accessKeyModifiersEv
-__ZNK7WebCore12EventHandler38needsKeyboardEventDisambiguationQuirksEv
-__ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS0_4TypeEb
-__ZN7WebCore13KeyboardEventC1ERKNS_21PlatformKeyboardEventEPNS_9DOMWindowE
-__ZN7WebCore6Editor24handleInputMethodKeydownEPNS_13KeyboardEventE
-__ZNK7WebCore13KeyboardEvent15isKeyboardEventEv
-__ZN7WebCore5Frame27doTextFieldCommandFromEventEPNS_7ElementEPNS_13KeyboardEventE
-+[DOMHTMLInputElement(WebCoreInternal) _wrapHTMLInputElement:]
-__ZN7WebCore12EventHandler27defaultKeyboardEventHandlerEPNS_13KeyboardEventE
-__ZN7WebCore6Editor19handleKeyboardEventEPNS_13KeyboardEventE
-__ZN7WebCore6Editor7commandERKNS_6StringE
-__ZN7WebCore6Editor7commandERKNS_6StringENS_19EditorCommandSourceE
-__ZN7WebCoreL16createCommandMapEv
-__ZNK3WTF7HashMapIN7WebCore6StringEPKNS1_21EditorInternalCommandENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_21EditorInternalCommandEENS_18PairFirstExtractorIS7_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6expandEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_21EditorInternalCommandEENS_18PairFirstExtractorIS7_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E4findIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEENS_17HashTableIteratorIS2_S7_S9_SA_SF_SD_EERKT_
-__ZN7WebCore6Editor7CommandC2EN3WTF10PassRefPtrINS_5FrameEEEPKNS_21EditorInternalCommandENS_19EditorCommandSourceE
-__ZNK7WebCore6Editor7Command11isSupportedEv
-__ZN7WebCoreL9supportedEPNS_5FrameENS_19EditorCommandSourceE
-__ZNK7WebCore6Editor7Command5stateEPNS_5EventE
-__ZN7WebCoreL9stateNoneEPNS_5FrameEPNS_5EventE
-__ZNK7WebCore6Editor7Command9isEnabledEPNS_5EventE
-__ZN7WebCoreL11enabledCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore6Editor12canDHTMLCopyEv
-__ZNK7WebCore19SelectionController17isInPasswordFieldEv
-__ZN7WebCore6Editor16dispatchCPPEventERKNS_12AtomicStringENS_21ClipboardAccessPolicyE
-__ZNK7WebCore8Position7elementEv
-__ZN7WebCore6Editor19newGeneralClipboardENS_21ClipboardAccessPolicyE
-__ZN7WebCore12ClipboardMacC1EbP12NSPasteboardNS_21ClipboardAccessPolicyEPNS_5FrameE
-__ZN7WebCore9ClipboardC2ENS_21ClipboardAccessPolicyEb
-__ZN7WebCore14ClipboardEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9ClipboardEEE
-__ZN7WebCore9Clipboard15setAccessPolicyENS_21ClipboardAccessPolicyE
-__ZN7WebCore14ClipboardEventD1Ev
-__ZNK7WebCore6Editor7canCopyEv
-__ZN7WebCoreL29imageElementFromImageDocumentEPNS_8DocumentE
-__ZN7WebCore12EventHandler8keyEventEP7NSEvent
-__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EEaSERKS3_
-__ZNK7WebCore13KeyboardEvent8charCodeEv
-__ZNK7WebCore6String19characterStartingAtEj
-__ZN7WebCore10StringImpl19characterStartingAtEj
-__ZNK7WebCore6Editor7Command7executeERKNS_6StringEPNS_5EventE
-__ZN7WebCoreL11executeCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore6Editor4copyEv
-__ZN7WebCore6Editor12tryDHTMLCopyEv
-__ZN7WebCore10Pasteboard17generalPasteboardEv
-__ZN7WebCore10PasteboardC1EP12NSPasteboard
-__ZN7WebCore10Pasteboard5clearEv
-__ZN7WebCore6Editor20canSmartCopyOrDeleteEv
-__ZNK7WebCore5Frame20selectionGranularityEv
-__ZN7WebCore6Editor13selectedRangeEv
-__ZN7WebCore10Pasteboard14writeSelectionEPNS_5RangeEbPNS_5FrameE
-__ZN7WebCore10Pasteboard14writeSelectionEP12NSPasteboardPNS_5RangeEbPNS_5FrameE
--[DOMRange commonAncestorContainer]
-__ZNK7WebCore5Range23commonAncestorContainerERi
--[DOMRange startContainer]
--[DOMNode nodeType]
--[DOMNode firstChild]
--[DOMRange startOffset]
--[DOMRange endContainer]
--[DOMRange endOffset]
--[DOMCharacterData data]
--[DOMObject copyWithZone:]
--[DOMNode parentNode]
--[DOMDocument getComputedStyle:pseudoElement:]
--[DOMElement(WebCoreInternal) _element]
-+[DOMCSSStyleDeclaration(WebCoreInternal) _wrapCSSStyleDeclaration:]
--[DOMCSSStyleDeclaration(WebCoreInternal) _initWithCSSStyleDeclaration:]
--[DOMCSSStyleDeclaration getPropertyCSSValue:]
-+[DOMCSSValue(WebCoreInternal) _wrapCSSValue:]
--[DOMCSSValue(WebCoreInternal) _initWithCSSValue:]
--[DOMCSSValue cssValueType]
--[DOMCSSPrimitiveValue primitiveType]
--[DOMCSSPrimitiveValue getStringValue]
-__ZNK7WebCore17CSSPrimitiveValue14getStringValueERi
--[DOMElement style]
-__ZN7WebCoreL14valueForShadowEPKNS_10ShadowDataE
--[DOMElement(WebPrivate) _font]
--[DOMCSSPrimitiveValue getRGBColorValue]
-__ZNK7WebCore17CSSPrimitiveValue16getRGBColorValueERi
-+[DOMRGBColor initialize]
-+[DOMRGBColor(WebCoreInternal) _wrapRGBColor:]
--[DOMRGBColor(WebCoreInternal) _initWithRGB:]
-__ZN7WebCore33createWrapperCacheWithIntegerKeysEv
--[DOMRGBColor(WebPrivate) _color]
--[DOMRGBColor color]
--[DOMElement tagName]
--[DOMCSSPrimitiveValue getFloatValue:]
-__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEtRi
-__ZN7WebCore16LegacyWebArchive19createFromSelectionEPNS_5FrameE
-__ZN7WebCore12createMarkupEPKNS_5RangeEPN3WTF6VectorIPNS_4NodeELm0EEENS_23EAnnotateForInterchangeEb
-__ZN7WebCore25avoidIntersectionWithNodeEPKNS_5RangeEPNS_4NodeE
-__ZN7WebCoreL27needInterchangeNewlineAfterERKNS_15VisiblePositionE
-__ZN7WebCoreL14getStartMarkupEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPN3WTF7HashMapIPNS_16AtomicStringImplESA_NS7_7PtrHashISA_EENS7_10HashTraitsISA_EESE_EE
-__ZN7WebCore20enclosingNodeWithTagERKNS_8PositionERKNS_13QualifiedNameE
-__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEERKNS_8PositionES7_
-__ZN7WebCore9plainTextEPKNS_5RangeE
-__ZN7WebCoreL17escapeContentTextERKNS_6StringEb
-__ZN7WebCore34convertHTMLTextToInterchangeFormatERKNS_6StringEPKNS_4TextE
-__ZN7WebCoreL12getEndMarkupEPKNS_4NodeE
-__ZN7WebCore16isMailBlockquoteEPKNS_4NodeE
-__ZNK7WebCore27CSSComputedStyleDeclaration25copyInheritablePropertiesEv
-__ZNK7WebCore19CSSStyleDeclaration19copyPropertiesInSetEPKij
-__ZN7WebCore4Node13computedStyleEv
-__ZN7WebCore17CSSPrimitiveValueC2ERKNS_6LengthE
-__ZN7WebCoreL24currentColorOrValidColorEPNS_11RenderStyleERKNS_5ColorE
-__ZN7WebCore26CSSMutableStyleDeclarationC1EPNS_7CSSRuleERKN3WTF6VectorINS_11CSSPropertyELm0EEEj
-__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EEC1ERKS3_
-__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEiRi
-__ZN3WTF6VectorItLm0EE4growEm
-__ZNK7WebCore9StyleBase15isCSSStyleSheetEv
-__ZN7WebCoreL28propertyMissingOrEqualToNoneEPNS_26CSSMutableStyleDeclarationEi
-__ZN7WebCore17isTabSpanTextNodeEPKNS_4NodeE
-__ZN7WebCore13isTabSpanNodeEPKNS_4NodeE
-__ZN7WebCore21nearestMailBlockquoteEPKNS_4NodeE
-__ZNK7WebCore19CSSStyleDeclaration4diffEPNS_26CSSMutableStyleDeclarationE
-__ZN3WTF6VectorIiLm0EE14expandCapacityEmPKi
-__ZN7WebCoreL19quoteStringIfNeededERKNS_6StringE
-__ZN7WebCoreL11quoteStringERKNS_6StringE
-__ZN7WebCore10StringImpl7replaceEtPS0_
-__ZN7WebCore6String6numberEd
-__ZN3WTF6VectorIiLm0EE6shrinkEm
-__ZN7WebCoreL20appendAttributeValueERN3WTF6VectorItLm0EEERKNS_6StringEb
-__ZNK7WebCore5Frame18documentTypeStringEv
-__ZN7WebCoreL18appendDocumentTypeERN3WTF6VectorItLm0EEEPKNS_12DocumentTypeE
-__ZN7WebCore16LegacyWebArchive6createERKNS_6StringEPNS_5FrameERN3WTF6VectorIPNS_4NodeELm0EEE
-__ZN7WebCore10utf8BufferERKNS_6StringE
-__ZN7WebCore12SharedBuffer11adoptVectorERN3WTF6VectorIcLm0EEE
-__ZN7WebCore12SharedBufferC1Ev
-__ZNK7WebCore4Node18getSubresourceURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZNK7WebCore4Node27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE14deleteAllNodesEv
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIN7WebCore4KURLEEES5_NS_17IdentityExtractorIS5_EENS_28ListHashSetNodeHashFunctionsIS3_NS2_8KURLHashEEENS_10HashTraitsIS5_EESC_E6expandEv
-__ZN7WebCore12IconDatabase17iconURLForPageURLERKNS_6StringE
-__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE15reserveCapacityEm
-__ZN7WebCore16LegacyWebArchive6createEN3WTF10PassRefPtrINS_15ArchiveResourceEEERNS1_6VectorIS4_Lm0EEERNS5_INS2_IS0_EELm0EEE
-__ZN7WebCore16LegacyWebArchive6createEv
-__ZN7WebCore16LegacyWebArchiveC1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE6shrinkEm
-__ZN7WebCore16LegacyWebArchive21rawDataRepresentationEv
-__ZN7WebCoreL21createPropertyListRepEPNS_7ArchiveE
-__ZN7WebCoreL44createPropertyListRepresentationFromResourceEPNS_15ArchiveResourceEb
-__ZN7WebCore36propertyListDataFromResourceResponseERKNS_16ResourceResponseE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE6shrinkEm
-__ZNK7WebCore5Range4textEv
-__ZN7WebCore6Editor29didWriteSelectionToPasteboardEv
--[DOMCSSValue dealloc]
--[DOMRGBColor dealloc]
--[DOMCSSStyleDeclaration dealloc]
-__ZN7WebCore15EventTargetNode16dispatchKeyEventERKNS_21PlatformKeyboardEventE
-__ZN7WebCore12IconDatabase28removePageURLFromSQLDatabaseERKNS_6StringE
-getOverflowPage
-__ZNK7WebCore17RenderTextControl8isEditedEv
-__ZN7WebCore16HTMLInputElement17dispatchBlurEventEv
-__ZN7WebCore12InputElement17dispatchBlurEventERNS_16InputElementDataEPNS_8DocumentE
-__ZN7WebCore5Frame22textFieldDidEndEditingEPNS_7ElementE
-__ZN7WebCore15EventTargetNode17dispatchBlurEventEv
-__ZN7WebCore11RenderLayer14scrollToOffsetEiibb
-__ZN7WebCore15JSHTMLBRElementD0Ev
-__ZN7WebCore16JSHTMLPreElementD0Ev
-__ZNK7WebCore23TextControlInnerElement16isMouseFocusableEv
-__ZNK7WebCore9RenderBox16inlineBoxWrapperEv
-__ZN7WebCore10RenderFlow14localCaretRectEPNS_9InlineBoxEiPi
-__ZNK7WebCore19SelectionController22caretRendersInsideNodeEPNS_4NodeE
-__ZNK7WebCore11RenderTheme18caretBlinkIntervalEv
-__ZN7WebCore17RenderTextControl16selectionChangedEb
-__ZN7WebCore17RenderTextControl12selectionEndEv
-__ZN7WebCore17RenderTextControl23indexForVisiblePositionERKNS_15VisiblePositionE
-__ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
-__ZN7WebCore17RenderTextControl14selectionStartEv
-__ZN7WebCore27RenderTextControlSingleLine14cacheSelectionEii
-__ZThn72_N7WebCore16HTMLInputElement14cacheSelectionEii
-__ZN7WebCore17isContentEditableEPKNS_4NodeE
-__ZN7WebCore9SelectionC1ERKNS_15VisiblePositionES3_
-__ZN7WebCore8Document13removeMarkersEPNS_5RangeENS_14DocumentMarker10MarkerTypeE
-__ZNK7WebCore6Editor16fontForSelectionERb
-__ZNK7WebCore5Frame22styleForSelectionStartERPNS_4NodeE
-__ZN7WebCoreL18isDeletableElementEPKNS_4NodeE
-__ZN7WebCore12RenderObject12paintOutlineEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleE
-__ZNK7WebCore11RenderTheme17supportsFocusRingEPKNS_11RenderStyleE
-__ZN7WebCore15GraphicsContext13initFocusRingEii
-__ZN7WebCore15GraphicsContext14clearFocusRingEv
-__ZN7WebCore17RenderTextControl17addFocusRingRectsEPNS_15GraphicsContextEii
-__ZN7WebCore15GraphicsContext16addFocusRingRectERKNS_7IntRectE
-__ZN7WebCore15GraphicsContext13drawFocusRingERKNS_5ColorE
-__ZNK7WebCore15GraphicsContext14focusRingWidthEv
-__ZNK7WebCore15GraphicsContext15focusRingOffsetEv
-__ZNK7WebCore15GraphicsContext14focusRingRectsEv
-__ZNK7WebCore5Frame10paintCaretEPNS_15GraphicsContextEiiRKNS_7IntRectE
-__ZN7WebCore19SelectionController10paintCaretEPNS_15GraphicsContextEiiRKNS_7IntRectE
-__ZN7WebCore5Frame20caretBlinkTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore6Editor13canDHTMLPasteEv
-__ZNK7WebCore6Editor8canPasteEv
-__ZN7WebCore6Editor13tryDHTMLPasteEv
-__ZNK7WebCore9Selection23isContentRichlyEditableEv
-__ZN7WebCore24isRichlyEditablePositionERKNS_8PositionE
-__ZNK7WebCore11HTMLElement23isContentRichlyEditableEv
-__ZN7WebCore6Editor16pasteAsPlainTextEv
-__ZN7WebCore6Editor30pasteAsPlainTextWithPasteboardEPNS_10PasteboardE
-__ZN7WebCore10Pasteboard9plainTextEPNS_5FrameE
-__ZN7WebCore6Editor29canSmartReplaceWithPasteboardEPNS_10PasteboardE
-__ZN7WebCore10Pasteboard15canSmartReplaceEv
-__ZN7WebCore6Editor24replaceSelectionWithTextERKNS_6StringEbb
-__ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
-__ZN7WebCore8Document22createDocumentFragmentEv
-__ZN7WebCore5Range19nodeChildrenChangedEPNS_13ContainerNodeE
-__ZN7WebCore6Editor28replaceSelectionWithFragmentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbb
-__ZN7WebCore23ReplaceSelectionCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
-__ZN7WebCore20CompositeEditCommandC2EPNS_8DocumentE
-__ZN7WebCore11EditCommandC2EPNS_8DocumentE
-__ZN7WebCore25avoidIntersectionWithNodeERKNS_9SelectionEPNS_4NodeE
-__ZN7WebCore11EditCommand20setStartingSelectionERKNS_9SelectionE
-__ZN7WebCore11EditCommand18setEndingSelectionERKNS_9SelectionE
-__ZN7WebCore12applyCommandEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCore11EditCommand5applyEv
-__ZNK7WebCore23ReplaceSelectionCommand13editingActionEv
-__ZNK7WebCore11EditCommand12updateLayoutEv
-__ZN7WebCore23ReplaceSelectionCommand7doApplyEv
-__ZN7WebCore19ReplacementFragmentC1EPNS_8DocumentEPNS_16DocumentFragmentEbRKNS_9SelectionE
-__ZN7WebCore19ReplacementFragment30insertFragmentForTestRenderingEPNS_4NodeE
-__ZN7WebCore29createDefaultParagraphElementEPNS_8DocumentE
-__ZNK7WebCore27CSSComputedStyleDeclaration16getPropertyValueEi
-__ZN7WebCore5Range17nodeWillBeRemovedEPNS_4NodeE
-__ZN7WebCore15highestAncestorEPNS_4NodeE
-__ZN7WebCore9Selection27selectionFromContentsOfNodeEPNS_4NodeE
-__ZN7WebCore9SelectionC1ERKNS_8PositionES3_NS_9EAffinityE
-__ZNK7WebCore10RenderText14caretMinOffsetEv
-__ZN7WebCore23BeforeTextInsertedEventC1ERKNS_6StringE
-__ZNK7WebCore23BeforeTextInsertedEvent25isBeforeTextInsertedEventEv
-__ZN7WebCore12InputElement29handleBeforeTextInsertedEventERNS_16InputElementDataEPNS_8DocumentEPNS_5EventE
-__ZN7WebCoreL19numGraphemeClustersEPNS_10StringImplE
-__ZN7WebCore19ReplacementFragment35restoreTestRenderingNodesToFragmentEPNS_4NodeE
-__ZN7WebCoreL27removingNodeRemovesPositionEPNS_4NodeERKNS_8PositionE
-__ZN7WebCore5Range21compareBoundaryPointsERKNS_8PositionES3_
-__ZN7WebCore19ReplacementFragment10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZNK7WebCore4Node8containsEPKS0_
-__ZN7WebCore19ReplacementFragment22removeInterchangeNodesEPNS_4NodeE
-__ZN7WebCoreL24isInterchangeNewlineNodeEPKNS_4NodeE
-__ZN7WebCoreL31isInterchangeConvertedSpaceSpanEPKNS_4NodeE
-__ZN7WebCore19ReplacementFragment21removeUnrenderedNodesEPNS_4NodeE
-__ZN7WebCore14isNodeRenderedEPKNS_4NodeE
-__ZN7WebCore23BeforeTextInsertedEventD1Ev
-__ZN7WebCore11EditCommand15styleAtPositionERKNS_8PositionE
-__ZN7WebCore21positionBeforeTabSpanERKNS_8PositionE
-__ZNK7WebCore8Position13computedStyleEv
-__ZNK7WebCore5Frame11typingStyleEv
-__ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
-__ZN7WebCore20CompositeEditCommand35prepareWhitespaceAtPositionForSplitERNS_8PositionE
-__ZN7WebCore20CompositeEditCommand22positionOutsideTabSpanERKNS_8PositionE
-__ZN7WebCore20CompositeEditCommand38positionAvoidingSpecialElementBoundaryERKNS_8PositionE
-__ZN7WebCore22enclosingAnchorElementERKNS_8PositionE
-__ZNK7WebCore19ReplacementFragment10firstChildEv
-__ZN7WebCoreL26isMailPasteAsQuotationNodeEPKNS_4NodeE
-__ZN7WebCore11isStyleSpanEPKNS_4NodeE
-__ZNK7WebCore19ReplacementFragment7isEmptyEv
-__ZN7WebCore23ReplaceSelectionCommand34insertNodeAtAndUpdateNodesInsertedEN3WTF10PassRefPtrINS_4NodeEEERKNS_8PositionE
-__ZN7WebCore20CompositeEditCommand12insertNodeAtEN3WTF10PassRefPtrINS_4NodeEEERKNS_8PositionE
-__ZN7WebCore20CompositeEditCommand10appendNodeEN3WTF10PassRefPtrINS_4NodeEEENS2_INS_7ElementEEE
-__ZN7WebCore17AppendNodeCommandC1EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
-__ZN7WebCore20CompositeEditCommand23applyCommandToCompositeEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCore11EditCommand9setParentEPNS_20CompositeEditCommandE
-__ZN7WebCore17AppendNodeCommand7doApplyEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE15reserveCapacityEm
-__ZN7WebCore23ReplaceSelectionCommand19updateNodesInsertedEPNS_4NodeE
-__ZNK7WebCore4Node14lastDescendantEv
-__ZN7WebCore23ReplaceSelectionCommand31removeUnrenderedTextNodesAtEndsEv
-__ZN7WebCore10RenderView15pushLayoutStateEPNS_12RenderObjectE
-__ZN7WebCore11LayoutStateC1EPNS_12RenderObjectE
-__ZN7WebCore23ReplaceSelectionCommand36negateStyleRulesThatAffectAppearanceEv
-__ZN7WebCore23ReplaceSelectionCommand16handleStyleSpansEv
-__ZN7WebCore23ReplaceSelectionCommand30positionAtEndOfInsertedContentEv
-__ZN7WebCore23ReplaceSelectionCommand32positionAtStartOfInsertedContentEv
-__ZN7WebCore18positionBeforeNodeEPKNS_4NodeE
-__ZN7WebCore23ReplaceSelectionCommand17shouldRemoveEndBREPNS_4NodeERKNS_15VisiblePositionE
-__ZN7WebCore23ReplaceSelectionCommand14shouldMergeEndEb
-__ZN7WebCore23ReplaceSelectionCommand16shouldMergeStartEbb
-__ZN7WebCore23ReplaceSelectionCommand16mergeEndIfNeededEv
-__ZN7WebCore23ReplaceSelectionCommand26handlePasteAsQuotationNodeEv
-__ZN7WebCore23ReplaceSelectionCommand23completeHTMLReplacementERKNS_8PositionE
-__ZN7WebCore20CompositeEditCommand21rebalanceWhitespaceAtERKNS_8PositionE
-__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationERKNS_8PositionES5_NS_10EditActionE
-__ZN7WebCore17ApplyStyleCommandC1EPNS_8DocumentEPNS_19CSSStyleDeclarationERKNS_8PositionES7_NS_10EditActionENS0_14EPropertyLevelE
-__ZN7WebCore26CSSMutableStyleDeclaration11makeMutableEv
-__ZN7WebCore17ApplyStyleCommand7doApplyEv
-__ZNK7WebCore26CSSMutableStyleDeclaration19copyBlockPropertiesEv
-__ZN7WebCore17ApplyStyleCommand15applyBlockStyleEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore17ApplyStyleCommand13startPositionEv
-__ZN7WebCore17ApplyStyleCommand11endPositionEv
-__ZN7WebCore11StyleChange21styleModeForParseModeEb
-__ZN7WebCore11StyleChangeC1EPNS_19CSSStyleDeclarationERKNS_8PositionENS0_17ELegacyHTMLStylesE
-__ZN7WebCore11StyleChange4initEN3WTF10PassRefPtrINS_19CSSStyleDeclarationEEERKNS_8PositionE
-__ZN7WebCore11StyleChange17currentlyHasStyleERKNS_8PositionEPKNS_11CSSPropertyE
-__ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
-__ZN7WebCore17ApplyStyleCommand14updateStartEndERKNS_8PositionES3_
-__ZNK7WebCore26CSSMutableStyleDeclaration4copyEv
-__ZN7WebCore17ApplyStyleCommand28applyRelativeFontStyleChangeEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore17ApplyStyleCommand16applyInlineStyleEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore17ApplyStyleCommand31splitTextElementAtStartIfNeededERKNS_8PositionES3_
-__ZN7WebCore14caretMinOffsetEPKNS_4NodeE
-__ZN7WebCore17ApplyStyleCommand29splitTextElementAtEndIfNeededERKNS_8PositionES3_
-__ZN7WebCore14caretMaxOffsetEPKNS_4NodeE
-__ZN7WebCore17ApplyStyleCommand17removeInlineStyleEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEERKNS_8PositionES7_
-__ZN7WebCore17ApplyStyleCommand39pushDownTextDecorationStyleAtBoundariesERKNS_8PositionES3_
-__ZN7WebCore17ApplyStyleCommand37pushDownTextDecorationStyleAroundNodeEPNS_4NodeEb
-__ZN7WebCore17ApplyStyleCommand23applyInlineStyleToRangeEPNS_26CSSMutableStyleDeclarationERKNS_8PositionES5_
-__ZNK7WebCore4Node23isContentRichlyEditableEv
-__ZN7WebCore17ApplyStyleCommand22addInlineStyleIfNeededEPNS_26CSSMutableStyleDeclarationEPNS_4NodeES4_
-__ZN7WebCore17ApplyStyleCommand30cleanupUnstyledAppleStyleSpansEPNS_4NodeE
-__ZN7WebCore9SelectionC1ERKNS_8PositionENS_9EAffinityE
-__ZN7WebCore6Editor14appliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCoreL36dispatchEditableContentChangedEventsERKNS_11EditCommandE
-__ZN7WebCore27RenderTextControlSingleLine17subtreeHasChangedEv
-__ZN7WebCore17RenderTextControl17subtreeHasChangedEv
-__ZThn72_N7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
-__ZN7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
-__ZN7WebCore12InputElement20setValueFromRendererERNS_16InputElementDataEPNS_8DocumentERKNS_6StringE
-__ZThn72_NK7WebCore16HTMLInputElement30searchEventsShouldBeDispatchedEv
-__ZNK7WebCore16HTMLInputElement30searchEventsShouldBeDispatchedEv
-__ZN7WebCore5Frame24textFieldDidBeginEditingEPNS_7ElementE
--[DOMHTMLInputElement value]
-+[DOMHTMLElement(WebCoreInternal) _wrapHTMLElement:]
--[DOMElement offsetWidth]
--[DOMElement offsetHeight]
--[DOMCSSStyleDeclaration getPropertyValue:]
--[DOMElement getAttribute:]
-__ZN7WebCore5Frame24textDidChangeInTextFieldEPNS_7ElementE
--[DOMHTMLInputElement form]
-+[DOMHTMLFormElement(WebCoreInternal) _wrapHTMLFormElement:]
--[DOMHTMLFormElement action]
-__ZNK7WebCore15HTMLFormElement6actionEv
--[DOMHTMLFormElement method]
-__ZNK7WebCore15HTMLFormElement6methodEv
-__ZNK7WebCore11EditCommand20preservesTypingStyleEv
-__ZN7WebCore5Frame14setTypingStyleEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore6Editor24respondToChangedContentsERKNS_9SelectionE
-__ZN7WebCore6Editor36revealSelectionAfterEditingOperationEv
-__ZNK7WebCore5Frame15revealSelectionERKNS_11RenderLayer15ScrollAlignmentE
-__ZN7WebCore19SelectionController19absoluteCaretBoundsEv
-__ZN7WebCore11RenderLayer19scrollRectToVisibleERKNS_7IntRectEbRKNS0_15ScrollAlignmentES6_
-__ZN7WebCore11RenderLayer15getRectToExposeERKNS_7IntRectES3_RKNS0_15ScrollAlignmentES6_
-__ZN7WebCore9FrameView13scheduleEventEN3WTF10PassRefPtrINS_5EventEEENS2_INS_15EventTargetNodeEEE
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE15reserveCapacityEm
-__ZNK7WebCore9RenderBox28canBeProgramaticallyScrolledEb
-__ZN7WebCore9FrameView29scrollRectIntoViewRecursivelyERKNS_7IntRectE
-__ZN7WebCore10ScrollView29scrollRectIntoViewRecursivelyERKNS_7IntRectE
-__ZN7WebCore10ScrollView17setScrollPositionERKNS_8IntPointE
-__ZN7WebCore10ScrollView25platformSetScrollPositionERKNS_8IntPointE
-__ZNK7WebCore6Chrome18scrollRectIntoViewERKNS_7IntRectEPKNS_10ScrollViewE
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EEC1ERKS4_
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE6shrinkEm
--[DOMHTMLInputElement disabled]
-__ZN7WebCore5Frame25matchLabelsAgainstElementEP7NSArrayPNS_7ElementE
-__ZN7WebCore17RegularExpressionC1ERKNS_6StringENS_19TextCaseSensitivityE
-__ZN7WebCore7replaceERNS_6StringERKNS_17RegularExpressionERKS0_
-__ZNK7WebCore17RegularExpression5matchERKNS_6StringEiPi
-__ZN7WebCore17RegularExpressionD1Ev
-__ZN7WebCore17RegularExpression7PrivateD1Ev
-__ZN7WebCoreL15regExpForLabelsEP7NSArray
-__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE15reserveCapacityEm
-__ZN7WebCore5Frame28searchForLabelsBeforeElementEP7NSArrayPNS_7ElementE
-__ZNK7WebCore7Element20isFormControlElementEv
-__ZNK7WebCore17RegularExpression9searchRevERKNS_6StringE
-__ZNK7WebCore6Editor7Command15isTextInsertionEv
-__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE15reserveCapacityEm
-__ZN7WebCoreL29supportedFromMenuOrKeyBindingEPNS_5FrameENS_19EditorCommandSourceE
-__ZNK7WebCore6Editor7Command7executeEPNS_5EventE
-__ZN7WebCoreL21enabledInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore6Editor19selectionForCommandEPNS_5EventE
-__ZN7WebCoreL20executeInsertNewlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCoreL11targetFrameEPNS_5FrameEPNS_5EventE
-__ZNK7WebCore6Editor13canEditRichlyEv
-__ZN7WebCore12EventHandler20handleTextInputEventERKNS_6StringEPNS_5EventEbb
-__ZN7WebCore9TextEventC1EN3WTF10PassRefPtrINS_9DOMWindowEEERKNS_6StringE
-__ZThn32_N7WebCore15EventTargetNode13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
-__ZNK7WebCore9TextEvent11isTextEventEv
-__ZN7WebCore22HTMLFormControlElement8onChangeEv
-__ZN7WebCore17RenderTextControl9setEditedEb
-__ZN7WebCore15HTMLFormElement11submitClickEPNS_5EventE
-__ZNK7WebCore16HTMLInputElement24isSuccessfulSubmitButtonEv
-__ZN7WebCore15HTMLFormElement13prepareSubmitEPNS_5EventE
-__ZN7WebCore38jsEventPrototypeFunctionPreventDefaultEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore15HTMLFormElement15addElementAliasEPNS_22HTMLFormControlElementERKNS_12AtomicStringE
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS1_INS2_22HTMLFormControlElementEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCore17JSHTMLFormElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS1_INS2_22HTMLFormControlElementEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setEPS3_RKS6_
-__ZN7WebCore23jsHTMLInputElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSHTMLPreElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore13HTMLBRElementD1Ev
-__ZN7WebCore9TextEventD1Ev
-__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE6shrinkEm
-__ZNK7WebCore11EditCommand15isTypingCommandEv
-__ZN7WebCore6Editor16markMisspellingsERKNS_9SelectionE
-__ZN7WebCoreL28markMisspellingsOrBadGrammarEPNS_6EditorERKNS_9SelectionEb
-__ZN7WebCoreL27findFirstMisspellingInRangeEPNS_12EditorClientEPNS_5RangeERib
-__ZN7WebCore17WordAwareIteratorC1EPKNS_5RangeE
-__ZN7WebCore17WordAwareIterator7advanceEv
-__ZNK7WebCore17WordAwareIterator10charactersEv
-__ZNK7WebCore17WordAwareIterator6lengthEv
-__ZN7WebCore9PageCache11autoreleaseEN3WTF10PassRefPtrINS_10CachedPageEEE
-__ZN3WTF7HashSetINS_6RefPtrIN7WebCore10CachedPageEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN7WebCore9PageCache17removeFromLRUListEPNS_11HistoryItemE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE6shrinkEm
-__ZN7WebCore17AppendNodeCommandD1Ev
-__ZNK7WebCore11HTMLElement2idEv
-__ZN7WebCore10HTMLParser24noscriptCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZNK7WebCore15RenderTableCell16baselinePositionEbb
-__ZNK7WebCore11RenderBlock25getBaselineOfFirstLineBoxEv
-__ZN7WebCore17jsHTMLDocumentAllEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore14JSHTMLDocument3allEPN3JSC9ExecStateE
-__ZN7WebCore8Document3allEv
-__ZNK7WebCore19JSHTMLAllCollection9toBooleanEPN3JSC9ExecStateE
-__ZN7WebCore9CSSParser20parseColorParametersEPNS_14CSSParserValueEPib
+__ZN7WebCore14RenderListItemC1EPNS_4NodeE
+__ZN7WebCore14RenderListItemC2EPNS_4NodeE
+__ZN7WebCore14RenderListItem14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderListItem10isListItemEv
+__ZN7WebCore14RenderListItem18clearExplicitValueEv
+__ZN7WebCoreL20paragraphConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore20HTMLParagraphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20HTMLParagraphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore20HTMLParagraphElement17endTagRequirementEv
+__ZNK7WebCore20HTMLParagraphElement11tagPriorityEv
+__ZN7WebCore20HTMLParagraphElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore11HTMLElement15inInlineTagListEPKNS_4NodeE
+__ZN7WebCore14RenderListItem11updateValueEv
+__ZNK7WebCore20HTMLParagraphElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore20HTMLParagraphElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreleERNS_11CSSRuleDataES1_
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE6shrinkEm
+__ZN7WebCore10StringImpl7replaceEPS0_S1_
+__ZN7WebCore22characterBreakIteratorEPKti
+__ZN7WebCoreL16olistConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLOListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLOListElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLOListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLOListElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLOListElement17endTagRequirementEv
+__ZNK7WebCore16HTMLOListElement11tagPriorityEv
 __ZN7WebCore16RenderListMarkerC1EPNS_14RenderListItemE
-__ZN7WebCore16RenderListMarker15styleWillChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore16RenderListMarker14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore10RenderText15setTextInternalEN3WTF10PassRefPtrINS_10StringImplEEE
-__ZN7WebCore14RenderListItem14calcPrefWidthsEv
-__ZN7WebCoreL23getParentOfFirstLineBoxEPNS_11RenderBlockEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock32generatesLineBoxesForInlineChildEPNS_12RenderObjectE
-__ZN7WebCore16RenderListMarker14calcPrefWidthsEv
-__ZNK7WebCore16RenderListMarker7isImageEv
-__ZN7WebCore14listMarkerTextENS_14EListStyleTypeEi
-__ZN7WebCore16RenderListMarker13updateMarginsEv
-__ZNK7WebCore16RenderListMarker8isInsideEv
-__ZN7WebCore16RenderListMarker6layoutEv
-__ZNK7WebCore16RenderListMarker12isListMarkerEv
-__ZN7WebCoreL36shouldSkipWhitespaceAfterStartObjectEPNS_11RenderBlockEPNS_12RenderObjectE
-__ZN7WebCore16RenderListMarker15createInlineBoxEbbb
-__ZN7WebCore13ListMarkerBoxC1EPNS_12RenderObjectE
-__ZNK7WebCore13ListMarkerBox6isTextEv
-__ZNK7WebCore16RenderListMarker14selectionStateEv
-__ZNK7WebCore9RenderBox13intrinsicSizeEv
-__ZNK7WebCore16RenderListMarker10lineHeightEbb
-__ZNK7WebCore16RenderListMarker16baselinePositionEbb
-__ZN7WebCore9InlineBox14adjustPositionEii
-__ZN7WebCore13InlineTextBox15paintDecorationEPNS_15GraphicsContextEiiiPNS_10ShadowDataE
-__ZN7WebCore16RenderListMarker5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore16RenderListMarker21getRelativeMarkerRectEv
-__ZN7WebCore15GraphicsContext11drawEllipseERKNS_7IntRectE
-__ZN7WebCore15GraphicsContext8drawPathEv
-freePage
-__ZN7WebCore15RenderTableCell29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZN7WebCore5TimerINS_9PageCacheEE5firedEv
-__ZN7WebCore9PageCache39releaseAutoreleasedPagesNowOrRescheduleEPNS_5TimerIS0_EE
-__ZN7WebCore11FrameLoader23timeOfLastCompletedLoadEv
-__ZN7WebCore12userIdleTimeEv
-__ZNK7WebCore7Element22nodeNamePreservingCaseEv
-__ZN7WebCore10CachedPage5clearEv
-__ZN7WebCore11CachedFrame5clearEv
-__ZN7WebCore15RenderTableCell7destroyEv
-__ZN7WebCore15RenderTableCellD1Ev
-__ZN7WebCore12RenderButton11removeChildEPNS_12RenderObjectE
-__ZN7WebCore12RenderButtonD1Ev
-__ZN7WebCore14RenderTableRow7destroyEv
-__ZN7WebCore18RenderTableSection15removeChildNodeEPNS_12RenderObjectEb
-__ZN7WebCore14RenderTableRowD1Ev
-__ZN7WebCore18RenderTableSection7destroyEv
-__ZN7WebCore11RenderTable15removeChildNodeEPNS_12RenderObjectEb
-__ZN7WebCore18RenderTableSectionD1Ev
-__ZN7WebCore18RenderTableSection9clearGridEv
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE6shrinkEm
-__ZN7WebCore8Document19hoveredNodeDetachedEPNS_4NodeE
-__ZN7WebCore9FrameView10clearFrameEv
-__ZN7WebCore21ScriptCachedFrameData5clearEv
-__ZN7WebCore11RenderBlock29removePercentHeightDescendantEPNS_9RenderBoxE
-__ZN7WebCore10CachedPageD1Ev
-__ZN7WebCore11CachedFrameD1Ev
-__ZN7WebCore21ScriptCachedFrameDataD1Ev
-__ZN7WebCore26JSHTMLFormElementPrototypeD0Ev
-__ZN7WebCore9NavigatorD1Ev
-__ZN7WebCore13NavigatorBaseD0Ev
-__ZN7WebCore11PluginArrayD1Ev
-__ZN7WebCore24JSCharacterDataPrototypeD0Ev
-__ZN7WebCore17JSPluginPrototypeD0Ev
-__ZN7WebCore19JSNodeListPrototypeD0Ev
-__ZN7WebCore17JSHTMLBodyElementD0Ev
-__ZN7WebCore17JSNodeConstructorD0Ev
-__ZN7WebCore27JSHTMLInputElementPrototypeD0Ev
-__ZN7WebCore24JSXPathResultConstructorD0Ev
-__ZN7WebCore15JSHTMLLIElementD0Ev
-__ZN7WebCore15PurgeableBuffer6createEPKcm
-__ZN7WebCore15PurgeableBufferC1EPcm
-__ZN7WebCore15PurgeableBuffer13makePurgeableEb
-__ZN7WebCore16HTMLImageElement19removedFromDocumentEv
-__ZN7WebCore12HTMLDocument15removeNamedItemERKNS_12AtomicStringE
-__ZN7WebCoreL17removeItemFromMapERN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiEEEERKNS_12AtomicStringE
-__ZN7WebCore12HTMLDocument20removeExtraNamedItemERKNS_12AtomicStringE
-__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE6shrinkEm
-__ZN7WebCore13StyledElement25removeMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore9FontValueD1Ev
-__ZN7WebCore11CSSRuleListD1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE6shrinkEm
-__ZN7WebCore13MediaQueryExpD1Ev
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE6shrinkEm
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE6shrinkEm
-__ZN7WebCore11FrameLoader22updateHistoryForReloadEv
-__ZN7WebCore23ApplicationCacheStorage24fallbackCacheGroupForURLERKNS_4KURLE
-__ZNK7WebCore11FrameLoader23isHostedByObjectElementEv
-__ZN7WebCoreL16findTextEncodingEPKci
-__ZN3WTF6VectorIcLm64EE6shrinkEm
-__ZNK7WebCore12TextEncoding26closestByteBasedEquivalentEv
-__ZN7WebCore13StyledElement11addCSSColorEPNS_15MappedAttributeEiRKNS_6StringE
-__ZN7WebCoreL15fontConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore15HTMLFontElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore15HTMLFontElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore15HTMLFontElement17endTagRequirementEv
-__ZNK7WebCore15HTMLFontElement11tagPriorityEv
-__ZN7WebCoreL13hrConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore13HTMLHRElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore13HTMLHRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore13HTMLHRElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore13HTMLHRElement17endTagRequirementEv
-__ZNK7WebCore13HTMLHRElement11tagPriorityEv
-__ZN7WebCore36jsHTMLDocumentPrototypeFunctionWriteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14JSHTMLDocument5writeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCoreL11writeHelperEPN3JSC9ExecStateERKNS0_7ArgListE
-__ZN7WebCore8Document5writeERKNS_6StringEPS0_
-__ZN7WebCore15SegmentedString21setExcludeLineNumbersEv
-__ZN7WebCore15AutoTableLayout14insertSpanCellEPNS_15RenderTableCellE
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4growEm
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE15reserveCapacityEm
-__ZN3WTF9HashTableIPKN7WebCore8FontDataESt4pairIS4_PNS1_17GlyphPageTreeNodeEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E4findIS4_NS_22IdentityHashTranslatorIS4_S8_SC_EEEENS_17HashTableIteratorIS4_S8_SA_SC_SH_SF_EERKT_
-__ZNK7WebCore12RenderObject14caretMinOffsetEv
-__ZN3WTF10RefCountedIN7WebCore16SharedFontFamilyEE5derefEv
-__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEt
-__ZN7WebCore38jsHTMLDocumentPrototypeFunctionWritelnEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14JSHTMLDocument7writelnEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZNK7WebCore5Theme14controlPaddingENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
-__ZN7WebCoreL13checkboxSizesEv
-__ZN7WebCore12RenderObject17updateFromElementEv
-__ZN7WebCore13ContainerNode12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
-__ZN7WebCore11RenderTable11splitColumnEii
-__ZN7WebCore18RenderTableSection11splitColumnEii
-__ZN7WebCore11HTMLElement16addHTMLAlignmentEPNS_15MappedAttributeE
-__ZN7WebCore11HTMLElement31addHTMLAlignmentToStyledElementEPNS_13StyledElementEPNS_15MappedAttributeE
-__ZNK7WebCore11RenderImage22usesImageContainerSizeEv
-__ZNK7WebCore11CachedImage22usesImageContainerSizeEv
-__ZNK7WebCore5Image17usesContainerSizeEv
-__ZNK7WebCore11RenderImage20calcAspectRatioWidthEv
-__ZNK7WebCore11RenderImage22imageHasRelativeHeightEv
-__ZNK7WebCore11CachedImage22imageHasRelativeHeightEv
-__ZNK7WebCore11RenderImage21calcAspectRatioHeightEv
-__ZNK7WebCore11RenderTheme16baselinePositionEPKNS_12RenderObjectE
-__ZNK7WebCore8ThemeMac26baselinePositionAdjustmentENS_11ControlPartE
-__ZN7WebCore11RenderLayer25setHasHorizontalScrollbarEb
-__ZN7WebCore11RenderLayer23setHasVerticalScrollbarEb
-__ZN7WebCore11RenderLayer15createScrollbarENS_20ScrollbarOrientationE
-__ZN7WebCore9Scrollbar21createNativeScrollbarEPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeE
-__ZN7WebCore9ScrollbarC1EPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeEPNS_14ScrollbarThemeE
-__ZN7WebCore14ScrollbarTheme11nativeThemeEv
-__ZN7WebCore17ScrollbarThemeMacC1Ev
-+[ScrollbarPrefsObserver registerAsObserver]
-__ZN7WebCore17ScrollbarThemeMac18preferencesChangedEv
-__ZN7WebCore17ScrollbarThemeMac17registerScrollbarEPNS_9ScrollbarE
-__ZN3WTF7HashSetIPN7WebCore9ScrollbarENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore17ScrollbarThemeMac18scrollbarThicknessENS_20ScrollbarControlSizeE
-__ZN7WebCore9Scrollbar9setParentEPNS_10ScrollViewE
-__ZN7WebCore6Widget16setParentVisibleEb
-__ZN7WebCore9Scrollbar12styleChangedEv
-__ZN7WebCore9Scrollbar10setEnabledEb
-__ZN7WebCore9Scrollbar8setStepsEiii
-__ZN7WebCore9Scrollbar13setProportionEii
-__ZN7WebCore9Scrollbar21updateThumbProportionEv
-__ZN7WebCore23ScrollbarThemeComposite14invalidatePartEPNS_9ScrollbarENS_13ScrollbarPartE
-__ZN7WebCore17ScrollbarThemeMac9trackRectEPNS_9ScrollbarEb
-__ZN7WebCore17ScrollbarThemeMac10hasButtonsEPNS_9ScrollbarE
-__ZN7WebCore23ScrollbarThemeComposite10splitTrackEPNS_9ScrollbarERKNS_7IntRectERS3_S6_S6_
-__ZN7WebCore23ScrollbarThemeComposite31constrainTrackRectToTrackPiecesEPNS_9ScrollbarERKNS_7IntRectE
-__ZN7WebCore23ScrollbarThemeComposite13thumbPositionEPNS_9ScrollbarE
-__ZN7WebCore23ScrollbarThemeComposite11trackLengthEPNS_9ScrollbarE
-__ZN7WebCore23ScrollbarThemeComposite11thumbLengthEPNS_9ScrollbarE
-__ZN7WebCore17ScrollbarThemeMac18minimumThumbLengthEPNS_9ScrollbarE
-__ZN7WebCore9Scrollbar14invalidateRectERKNS_7IntRectE
-__ZN7WebCore11RenderLayer23invalidateScrollbarRectEPNS_9ScrollbarERKNS_7IntRectE
-__ZN7WebCore9Scrollbar12setFrameRectERKNS_7IntRectE
-__ZNK7WebCore9FrameView17windowResizerRectEv
-__ZNK7WebCore6Chrome17windowResizerRectEv
-__ZNK7WebCore6Widget27convertFromContainingWindowERKNS_7IntRectE
-__ZNK7WebCore5Color4darkEv
-__ZN7WebCore15GraphicsContext17drawConvexPolygonEmPKNS_10FloatPointEb
-__ZN7WebCore9Scrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore17ScrollbarThemeMac5paintEPNS_9ScrollbarEPNS_15GraphicsContextERKNS_7IntRectE
-__ZNK7WebCore11RenderLayer8isActiveEv
-__ZN7WebCore17ScrollbarThemeMac8hasThumbEPNS_9ScrollbarE
-__ZN7WebCoreL8checkboxEjRKNS_7IntRectEf
-__ZN7WebCoreL15checkboxMarginsEj
-__ZN7WebCore11RenderImage8imageMapEv
-__ZNK7WebCore16HTMLImageElement6useMapEv
-__ZNK7WebCore8Document11getImageMapERKNS_6StringE
-__ZN7WebCore11RenderLayer23hitTestOverflowControlsERNS_13HitTestResultE
-__ZN7WebCore21setJSDocumentLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10JSDocument11setLocationEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore10HTMLParser28tableSectionCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCoreL23tableSectionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore10HTMLParser22selectCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCoreL17selectConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLSelectElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17HTMLSelectElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLSelectElement11tagPriorityEv
-__ZN7WebCore17HTMLSelectElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17HTMLSelectElement15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCore17HTMLSelectElement18setRecalcListItemsEv
-__ZN7WebCoreL17optionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLOptionElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17OptionElementDataC1EPNS_7ElementE
-__ZN7WebCore17HTMLOptionElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLOptionElement17endTagRequirementEv
-__ZNK7WebCore17HTMLOptionElement11tagPriorityEv
-__ZN7WebCore17HTMLOptionElement20insertedIntoDocumentEv
-__ZNK7WebCore17HTMLOptionElement8selectedEv
-__ZNK7WebCore17HTMLOptionElement18ownerSelectElementEv
-__ZN7WebCore17HTMLSelectElement17scrollToSelectionEv
-__ZN7WebCore17HTMLOptionElement6attachEv
-__ZN7WebCore17HTMLOptionElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17HTMLOptionElement15childrenChangedEbPNS_4NodeES2_i
-__ZNK7WebCore17HTMLOptionElement22nonRendererRenderStyleEv
-__ZN7WebCore11HTMLElement19isRecognizedTagNameERKNS_13QualifiedNameE
-__ZN7WebCore9HTMLNames11getHTMLTagsEPm
-__ZN7WebCore13StyledElement19addCSSImagePropertyEPNS_15MappedAttributeEiRKNS_6StringE
-__ZN7WebCore26CSSMutableStyleDeclaration16setImagePropertyEiRKNS_6StringEb
-__ZN7WebCore16HTMLInputElement10setCheckedEbb
-__ZN7WebCore15HTMLFontElement26cssValueFromFontSizeNumberERKNS_6StringERi
-__ZN3WTF6VectorIPN7WebCore5FrameELm16EE6shrinkEm
-__ZN7WebCore17HTMLSelectElement11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore17HTMLSelectElement15recalcListItemsEb
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE15reserveCapacityEm
-__ZN7WebCore17HTMLOptionElement16setSelectedStateEb
-__ZN7WebCore13OptionElement16setSelectedStateERNS_17OptionElementDataEb
-__ZN7WebCoreL21blockquoteConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore21HTMLBlockquoteElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore21HTMLBlockquoteElement17endTagRequirementEv
-__ZNK7WebCore21HTMLBlockquoteElement11tagPriorityEv
-__ZN7WebCore17HTMLOptionElement6detachEv
-__ZNK7WebCore7Element17isInputTypeHiddenEv
-__ZNK7WebCore14RenderThemeMac19adjustMenuListStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCoreL19menuListButtonSizesEv
-__ZN7WebCore17HTMLSelectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderMenuListC1EPNS_17HTMLSelectElementE
-__ZN7WebCore14RenderMenuList14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore14RenderMenuList18updateOptionsWidthEv
-__ZN7WebCore15toOptionElementEPNS_7ElementE
-__ZThn68_NK7WebCore17HTMLOptionElement31textIndentedToRespectGroupLabelEv
-__ZNK7WebCore17HTMLOptionElement31textIndentedToRespectGroupLabelEv
-__ZN7WebCore13OptionElement37collectOptionTextRespectingGroupLabelERKNS_17OptionElementDataEPNS_8DocumentE
-__ZN7WebCore20toOptionGroupElementEPNS_7ElementE
-__ZN7WebCore13OptionElement17collectOptionTextERKNS_17OptionElementDataEPNS_8DocumentE
-__ZNK7WebCore6String18simplifyWhiteSpaceEv
-__ZN7WebCore10StringImpl18simplifyWhiteSpaceEv
-__ZNK7WebCore14RenderMenuList15canHaveChildrenEv
-__ZNK7WebCore17HTMLOptionElement8disabledEv
-__ZN7WebCore17HTMLOptionElement14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
-__ZN7WebCore14RenderMenuList17updateFromElementEv
-__ZNK7WebCore17HTMLSelectElement13selectedIndexEv
-__ZN7WebCore14RenderMenuList17setTextFromOptionEi
-__ZNK7WebCore17HTMLSelectElement17optionToListIndexEi
-__ZN7WebCore14RenderMenuList7setTextERKNS_6StringE
-__ZN7WebCore14RenderMenuList8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore14RenderMenuList16createInnerBlockEv
-__ZN7WebCore14RenderMenuList16adjustInnerStyleEv
-__ZNK7WebCore14RenderThemeMac24popupInternalPaddingLeftEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac18popupButtonPaddingEj
-__ZNK7WebCore14RenderThemeMac25popupInternalPaddingRightEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac23popupInternalPaddingTopEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac26popupInternalPaddingBottomEPNS_11RenderStyleE
-__ZN7WebCore9PopupMenu29itemWritingDirectionIsNaturalEv
-__ZN7WebCore10StringImpl23defaultWritingDirectionEv
-__ZN7WebCoreL10radioSizesEv
-__ZNK7WebCore16HTMLInputElement7altTextEv
-__ZN7WebCore19inputElementAltTextEv
-__ZN7WebCore11RenderImage14resetAnimationEv
-__ZN7WebCore9FrameView14setMarginWidthEi
-__ZN7WebCore9FrameView15setMarginHeightEi
-__ZN7WebCore14RenderMenuList14calcPrefWidthsEv
-__ZNK7WebCore14RenderThemeMac19minimumMenuListSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac13menuListSizesEv
-__ZNK7WebCore14RenderMenuList14hasControlClipEv
-__ZNK7WebCore15RenderTableCell15localToAbsoluteENS_10FloatPointEbb
-__ZN7WebCore11RenderTable19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore14RenderThemeMac13paintMenuListEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac23setPopupButtonCellStateEPKNS_12RenderObjectERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac11popupButtonEv
-__ZNK7WebCore14RenderThemeMac16popupButtonSizesEv
-__ZN7WebCore14RenderThemeMac14setControlSizeEP6NSCellPKNS_7IntSizeERS4_f
-__ZN7WebCore14RenderThemeMac18updateCheckedStateEP6NSCellPKNS_12RenderObjectE
-__ZN7WebCore14RenderThemeMac18updatePressedStateEP6NSCellPKNS_12RenderObjectE
-__ZNK7WebCore14RenderThemeMac18popupButtonMarginsEv
-__ZNK7WebCore14RenderThemeMac11inflateRectERKNS_7IntRectERKNS_7IntSizeEPKif
-__ZNK7WebCore14RenderMenuList15controlClipRectEii
-__ZNK7WebCore11BitmapImage10solidColorEv
-__ZN7WebCore5Image18fillWithSolidColorEPNS_15GraphicsContextERKNS_9FloatRectERKNS_5ColorENS_17CompositeOperatorE
-__ZN7WebCoreL5radioEjRKNS_7IntRectEf
-__ZN7WebCoreL12radioMarginsEj
-__ZN7WebCore11BitmapImage20frameDurationAtIndexEm
-__ZN7WebCoreL22centerTruncateToBufferERKNS_6StringEjjPt
-__ZN7WebCore11isTextBreakEPNS_17TextBreakIteratorEi
-__ZN7WebCore15jsDOMWindowSelfEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow4selfEv
-__ZN7WebCore18jsElementOffsetTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element9offsetTopEv
-__ZNK7WebCore9RenderBox9offsetTopEv
-__ZNK7WebCore9RenderBox12offsetParentEv
-__ZN7WebCoreL18adjustForLocalZoomEiPNS_12RenderObjectE
-__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9DOMWindow8scrollToEii
-__ZN7WebCore9FrameView17setScrollPositionERKNS_8IntPointE
-__ZN7WebCore5Frame15sendScrollEventEv
-__ZN7WebCore9FrameView20setWasScrolledByUserEb
-__ZThn68_NK7WebCore17HTMLSelectElement9saveStateERNS_6StringE
-__ZNK7WebCore17HTMLSelectElement9saveStateERNS_6StringE
-__ZN3WTF6VectorIcLm1024EE6shrinkEm
-__ZThn56_NK7WebCore17HTMLSelectElement4typeEv
-__ZNK7WebCore17HTMLSelectElement4typeEv
-__ZN7WebCore14RenderMenuList11removeChildEPNS_12RenderObjectE
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE6shrinkEm
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE6shrinkEm
-__ZN7WebCore17OptionElementDataD1Ev
-__ZN7WebCore21HTMLBlockquoteElementD1Ev
-__ZN7WebCoreL29isSupportedJavaScriptLanguageERKNS_6StringE
-__ZNK7WebCore13HTMLTokenizer14processingDataEv
-__ZN7WebCore10HTMLParser39handleResidualStyleCloseTagAcrossBlocksEPNS_13HTMLStackElemE
-__ZN7WebCore11HTMLElement9cloneNodeEb
-__ZN7WebCore12NamedAttrMap13setAttributesERKS0_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE6resizeEm
-__ZNK7WebCore15MappedAttribute5cloneEv
-__ZN7WebCore13StyledElement26copyNonAttributePropertiesEPKNS_7ElementE
-__ZN7WebCore17RenderFlexibleBox16allowedChildFlexEPNS_9RenderBoxEbj
-__ZNK7WebCore9RenderBox13overrideWidthEv
-__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSC_IiEEEESD_E6expandEv
-__ZNK7WebCore17RenderFlexibleBox17isFlexingChildrenEv
-__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEiNS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IiEEE3setERKS4_RKi
-__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSC_IiEEEESD_E4findIS4_NS_22IdentityHashTranslatorIS4_S6_SA_EEEENS_17HashTableIteratorIS4_S6_S8_SA_SF_SD_EERKT_
-__ZN7WebCore10HTMLParser19moveOneBlockToStackERPNS_13HTMLStackElemE
-__ZN7WebCoreL14isTableRelatedEPNS_4NodeE
-__ZN7WebCoreL11isTablePartEPNS_4NodeE
-__ZNK7WebCore6String11toIntStrictEPbi
-__ZN7WebCore10StringImpl11toIntStrictEPbi
-__ZN7WebCore21charactersToIntStrictEPKtmPbi
-__ZN7WebCore4Node21setTabIndexExplicitlyEs
-__ZN7WebCore13InlineFlowBox25adjustMaxAscentAndDescentERiS1_ii
-__ZN7WebCore21DeprecatedPtrListImpl4prevEv
-__ZNK7WebCore9RenderBox12overflowLeftEb
-__ZNK7WebCore9RenderBox13overflowWidthEb
-__ZNK7WebCore6String8foldCaseEv
-__ZN7WebCore10StringImpl8foldCaseEv
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore11HistoryItemEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEENS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EERKT_
-__ZNK7WebCore13RootInlineBox19lineBreakBidiStatusEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IS4_EEEESB_E4findIS2_NS_22IdentityHashTranslatorIS2_S5_S8_EEEENS_17HashTableIteratorIS2_S5_S7_S8_SD_SB_EERKT_
-__ZN7WebCore14JSHTMLDocument10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore6StringC1ERKN3JSC10IdentifierE
-__ZN7WebCore8Document18documentNamedItemsERKNS_6StringE
-__ZN7WebCore18HTMLNameCollectionC2EN3WTF10PassRefPtrINS_8DocumentEEENS_14HTMLCollection4TypeERKNS_6StringE
-__ZN7WebCore8Document18nameCollectionInfoENS_14HTMLCollection4TypeERKNS_12AtomicStringE
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_14HTMLCollection14CollectionInfoEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SC_EEEENS_17HashTableIteratorIS3_S8_SA_SC_SH_SF_EERKT_
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLCollection14CollectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3addERKS3_RKS6_
-__ZNK7WebCore18HTMLNameCollection9itemAfterEPNS_7ElementE
-__ZNK7WebCore14HTMLCollection9firstItemEv
-__ZN7WebCore40jsHTMLFormElementPrototypeFunctionSubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore15HTMLFormElement6submitEv
-__ZN7WebCore15HTMLFormElement6submitEPNS_5EventEb
-__ZN7WebCore11FrameLoader25setFormAboutToBeSubmittedEN3WTF10PassRefPtrINS_15HTMLFormElementEEE
-__ZN7WebCore15HTMLFormElement14createFormDataERKNS_7CStringE
-__ZNK7WebCore15HTMLFormElement12dataEncodingEv
-__ZNK7WebCore15HTMLFormElement12isMailtoFormEv
-__ZNK7WebCore15FormDataBuilder12dataEncodingEPNS_8DocumentE
-__ZN7WebCore8FormData6createEv
-__ZN7WebCore12FormDataListC1ERKNS_12TextEncodingE
-__ZN7WebCore16HTMLInputElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore12FormDataList12appendStringERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE15reserveCapacityEm
-__ZN7WebCore7CStringC1EPKc
-__ZN7WebCoreeqERKNS_7CStringES2_
-__ZN7WebCore15FormDataBuilder25addKeyValuePairAsFormDataERN3WTF6VectorIcLm0EEERKNS_7CStringES7_
-__ZN7WebCore15FormDataBuilder22encodeStringAsFormDataERN3WTF6VectorIcLm0EEERKNS_7CStringE
-__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE6shrinkEm
-__ZN7WebCore8FormData10appendDataEPKvm
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIcLm0EEC1ERKS1_
-__ZN7WebCore11FrameLoader10submitFormEPKcRKNS_6StringEN3WTF10PassRefPtrINS_8FormDataEEES5_S5_S5_PNS_5EventE
-__ZN7WebCore8FormData13generateFilesEPNS_12ChromeClientE
-__ZN7WebCore19ResourceRequestBase11setHTTPBodyEN3WTF10PassRefPtrINS_8FormDataEEE
-__ZN7WebCore19ResourceRequestBase13setHTTPMethodERKNS_6StringE
-__ZN7WebCore19ResourceRequestBase6setURLERKNS_4KURLE
-__ZN7WebCore11FrameLoader10submitFormERKNS_16FrameLoadRequestEPNS_5EventE
-__ZN7WebCore9FormState6createEN3WTF10PassRefPtrINS_15HTMLFormElementEEERKNS1_7HashMapINS_6StringES6_NS_10StringHashENS1_10HashTraitsIS6_EES9_EENS2_INS_5FrameEEE
-__ZN7WebCore9FormStateC2EN3WTF10PassRefPtrINS_15HTMLFormElementEEERKNS1_7HashMapINS_6StringES6_NS_10StringHashENS1_10HashTraitsIS6_EES9_EENS2_INS_5FrameEEE
-__ZN7WebCore11FrameLoader15loadPostRequestERKNS_15ResourceRequestERKNS_6StringES6_PNS_5EventEN3WTF10PassRefPtrINS_9FormStateEEE
-__ZN7WebCore11setHTTPBodyEP19NSMutableURLRequestN3WTF10PassRefPtrINS_8FormDataEEE
-__ZN7WebCore18MainResourceLoader9didCancelERKNS_13ResourceErrorE
-__ZN7WebCore10IconLoader11stopLoadingEv
-__ZN7WebCore8FormData6createEPKvm
--[WebCoreResourceHandleAsDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]
-__ZN7WebCore14ResourceLoader11didSendDataEPNS_14ResourceHandleEyy
-__ZN7WebCore14ResourceLoader11didSendDataEyy
-__ZN7WebCore8FormData28removeGeneratedFilesIfNeededEv
-__ZN7WebCore26setJSHTMLFormElementActionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLFormElement9setActionERKNS_6StringE
-__ZN7WebCore11FrameLoader10gotoAnchorERKNS_6StringE
-__ZN7WebCore8Document10findAnchorERKNS_6StringE
-__ZNK7WebCore17HTMLAnchorElement4nameEv
-__ZN7WebCore8Document12setCSSTargetEPNS_4NodeE
-__ZNK7WebCore13ContainerNode7getRectEv
-__ZNK7WebCore13ContainerNode18getUpperLeftCornerERNS_10FloatPointE
-__ZNK7WebCore13ContainerNode19getLowerRightCornerERNS_10FloatPointE
-__ZN7WebCore9Scrollbar8setValueEi
-__ZN7WebCore9Scrollbar19updateThumbPositionEv
-__ZNK7WebCore17ScrollbarThemeMac16buttonsPlacementEv
-__ZN7WebCore11RenderLayer12valueChangedEPNS_9ScrollbarE
-__ZN7WebCore5TimerINS_11CachedImageEE5firedEv
-__ZN7WebCore11CachedImage29decodedDataDeletionTimerFiredEPNS_5TimerIS0_EE
-defragmentPage
-__ZN7WebCore11RenderTheme17adjustRepaintRectEPKNS_12RenderObjectERNS_7IntRectE
-__ZNK7WebCore8ThemeMac23inflateControlPaintRectENS_11ControlPartEjRNS_7IntRectEf
-__ZN7WebCore21ContextMenuController16clearContextMenuEv
-__ZN7WebCore12EventHandler20sendContextMenuEventERKNS_18PlatformMouseEventE
-__ZN7WebCore12EventHandler37selectClosestWordOrLinkFromMouseEventERKNS_28MouseEventWithHitTestResultsE
-__ZNK7WebCore13HitTestResult10isLiveLinkEv
-__ZNK7WebCore17HTMLAnchorElement10isLiveLinkEv
-__ZN7WebCore9InlineBox14selectionStateEv
-__ZN7WebCore21ContextMenuController22handleContextMenuEventEPNS_5EventE
-__ZN7WebCore11ContextMenuC1ERKNS_13HitTestResultE
-+[WebCoreMenuTarget sharedMenuTarget]
-__ZNK7WebCore11ContextMenu10controllerEv
--[WebCoreMenuTarget setMenuController:]
-__ZN7WebCore11ContextMenu8populateEv
-__ZN7WebCore26contextMenuItemTagOpenLinkEv
-__ZN7WebCore15ContextMenuItemC1ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKNS_6StringEPNS_11ContextMenuE
-__ZN7WebCore37contextMenuItemTagOpenLinkInNewWindowEv
-__ZN7WebCore36contextMenuItemTagDownloadLinkToDiskEv
-__ZN7WebCore37contextMenuItemTagCopyLinkToClipboardEv
-__ZN7WebCore38contextMenuItemTagOpenImageInNewWindowEv
-__ZN7WebCore37contextMenuItemTagDownloadImageToDiskEv
-__ZN7WebCore38contextMenuItemTagCopyImageToClipboardEv
-__ZN7WebCore35contextMenuItemTagSearchInSpotlightEv
-__ZN7WebCore36contextMenuItemTagLookUpInDictionaryEv
-__ZN7WebCore27contextMenuItemTagSearchWebEv
-__ZN7WebCore22contextMenuItemTagCopyEv
-__ZN7WebCore24contextMenuItemTagGoBackEv
-__ZN7WebCore27contextMenuItemTagGoForwardEv
-__ZN7WebCore22contextMenuItemTagStopEv
-__ZN7WebCore24contextMenuItemTagReloadEv
-__ZN7WebCore38contextMenuItemTagOpenFrameInNewWindowEv
-__ZN7WebCore32contextMenuItemTagNoGuessesFoundEv
-__ZN7WebCore32contextMenuItemTagIgnoreSpellingEv
-__ZN7WebCore31contextMenuItemTagLearnSpellingEv
-__ZN7WebCore31contextMenuItemTagIgnoreGrammarEv
-__ZN7WebCore21contextMenuItemTagCutEv
-__ZN7WebCore23contextMenuItemTagPasteEv
-__ZNK7WebCore13HitTestResult17isContentEditableEv
-__ZN7WebCore11FrameLoader16canHandleRequestERKNS_15ResourceRequestE
-__ZN7WebCore11ContextMenu10appendItemERNS_15ContextMenuItemE
-__ZNK7WebCore11ContextMenu21checkOrEnableIfNeededERNS_15ContextMenuItemE
-__ZNK7WebCore15ContextMenuItem4typeEv
-__ZNK7WebCore15ContextMenuItem6actionEv
-__ZN7WebCore15ContextMenuItem10setCheckedEb
-__ZN7WebCore15ContextMenuItem10setEnabledEb
-__ZN7WebCore15ContextMenuItem26releasePlatformDescriptionEv
-__ZN7WebCoreL17setMenuItemTargetEP10NSMenuItem
-__ZNK7WebCore13HitTestResult16absoluteImageURLEv
-__ZN7WebCore15ContextMenuItemD1Ev
-__ZNK7WebCore11ContextMenu19platformDescriptionEv
-__ZNK7WebCore14DocumentLoader11subresourceERKNS_4KURLE
-__ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
-__ZN7WebCore13AXObjectCache3getEPNS_12RenderObjectE
-__ZN3WTF7HashMapIPN7WebCore12RenderObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3setERKS3_RKj
-__ZNK7WebCore12RenderObject9isListBoxEv
-__ZN7WebCore25AccessibilityRenderObject6createEPNS_12RenderObjectE
-__ZN7WebCore25AccessibilityRenderObjectC1EPNS_12RenderObjectE
-__ZN7WebCore19AccessibilityObjectC2Ev
-__ZN7WebCore25AccessibilityRenderObject11setAriaRoleEv
-__ZNK7WebCore25AccessibilityRenderObject26determineAriaRoleAttributeEv
-__ZNK7WebCore25AccessibilityRenderObject12getAttributeERKNS_13QualifiedNameE
-__ZN7WebCore13AXObjectCache7getAXIDEPNS_19AccessibilityObjectE
-__ZNK7WebCore19AccessibilityObject10axObjectIDEv
-__ZNK3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E8containsIjNS_22IdentityHashTranslatorIjjS4_EEEEbRKT_
-__ZN3WTF7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEE3addERKj
-__ZN7WebCore19AccessibilityObject13setAXObjectIDEj
-__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSC_IS5_EEEESD_E6expandEv
-__ZN7WebCore13AXObjectCache13attachWrapperEPNS_19AccessibilityObjectE
-+[AccessibilityObjectWrapper initialize]
--[AccessibilityObjectWrapper initWithAccessibilityObject:]
--[AccessibilityObjectWrapper accessibilityIsIgnored]
-__ZN7WebCore25AccessibilityRenderObject18updateBackingStoreEv
-__ZNK7WebCore25AccessibilityRenderObject12isAttachmentEv
-__ZNK7WebCore25AccessibilityRenderObject22accessibilityIsIgnoredEv
-__ZNK7WebCore25AccessibilityRenderObject31isPresentationalChildOfAriaRoleEv
-__ZNK7WebCore25AccessibilityRenderObject12parentObjectEv
-__ZNK7WebCore25AccessibilityRenderObject21labelElementContainerEv
-__ZNK7WebCore25AccessibilityRenderObject9isControlEv
-__ZNK7WebCore25AccessibilityRenderObject17ariaRoleAttributeEv
-__ZN7WebCore19AccessibilityObject13isARIAControlENS_17AccessibilityRoleE
-__ZN7WebCore19AccessibilityObject11isARIAInputENS_17AccessibilityRoleE
-__ZNK7WebCore25AccessibilityRenderObject9isHeadingEv
-__ZNK7WebCore25AccessibilityRenderObject9roleValueEv
-__ZNK7WebCore25AccessibilityRenderObject6isLinkEv
-__ZNK7WebCore25AccessibilityRenderObject7isImageEv
-__ZNK7WebCore25AccessibilityRenderObject9isWebAreaEv
--[AccessibilityObjectWrapper accessibilityAttributeNames]
-__ZNK7WebCore25AccessibilityRenderObject15isPasswordFieldEv
--[AccessibilityObjectWrapper accessibilityAttributeValue:]
-__ZNK7WebCore25AccessibilityRenderObject13isTextControlEv
-__ZNK7WebCore25AccessibilityRenderObject17documentFrameViewEv
--[AccessibilityObjectWrapper accessibilityShouldUseUniqueId]
--[WebCoreMenuTarget validateMenuItem:]
-__ZN7WebCore15ContextMenuItemC1EP10NSMenuItem
-__ZNK7WebCore15ContextMenuItem7enabledEv
-__ZN7WebCore13AXObjectCache15childrenChangedEPNS_12RenderObjectE
-__ZN7WebCore13AXObjectCache6removeEPNS_12RenderObjectE
-__ZN7WebCore13AXObjectCache6removeEj
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E4findIS3_NS_22IdentityHashTranslatorIS3_S5_S9_EEEENS_17HashTableIteratorIS3_S5_S7_S9_SE_SC_EERKT_
-__ZN7WebCore13HTMLHRElementD1Ev
-__ZN7WebCore9ScrollbarD1Ev
-__ZN7WebCore9Scrollbar17stopTimerIfNeededEv
-__ZN7WebCore17ScrollbarThemeMac19unregisterScrollbarEPNS_9ScrollbarE
-__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore16HTMLDListElementD1Ev
-__ZN7WebCore8FormDataD1Ev
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE6shrinkEm
-__ZNK7WebCore12EventHandler17eventMayStartDragERKNS_18PlatformMouseEventE
-__ZNK7WebCore12EventHandler14allowDHTMLDragERbS1_
-__ZNK7WebCore10ScrollView16contentsToWindowERKNS_8IntPointE
-__ZNK7WebCore6Widget25convertToContainingWindowERKNS_8IntPointE
-__ZN7WebCore14DragController24delegateDragSourceActionERKNS_8IntPointE
-__ZNK7WebCore12RenderObject13draggableNodeEbbiiRb
-__ZNK7WebCore12EventHandler18shouldDragAutoNodeEPNS_4NodeERKNS_8IntPointE
-__ZN7WebCore14DragController27mayStartDragAtEventLocationEPKNS_5FrameERKNS_8IntPointE
-__ZNK7WebCore13HitTestResult5imageEv
-__ZN7WebCore11ContextMenuD1Ev
-__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE4takeERKj
--[WebCoreMenuTarget forwardContextMenuAction:]
-__ZN7WebCore21ContextMenuController23contextMenuItemSelectedEPNS_15ContextMenuItemE
-__ZNK7WebCore13HitTestResult11textContentEv
-__ZN7WebCore6Editor7copyURLERKNS_4KURLERKNS_6StringE
-__ZN7WebCore10Pasteboard8writeURLERKNS_4KURLERKNS_6StringEPNS_5FrameE
-__ZN7WebCore10Pasteboard8writeURLEP12NSPasteboardP7NSArrayRKNS_4KURLERKNS_6StringEPNS_5FrameE
-__ZN7WebCoreL19writableTypesForURLEv
-__ZN7WebCore15HTMLFormElement19removedFromDocumentEv
-__ZN7WebCore17HTMLScriptElement19removedFromDocumentEv
-__ZN7WebCore13ScriptElement19removedFromDocumentERNS_17ScriptElementDataE
-__ZN7WebCore13AXObjectCache25postNotificationToElementEPNS_12RenderObjectERKNS_6StringE
-__ZN7WebCore13AXObjectCache13detachWrapperEPNS_19AccessibilityObjectE
--[AccessibilityObjectWrapper detach]
--[AccessibilityObjectWrapper unregisterUniqueIdForUIElement]
-__ZN7WebCore25AccessibilityRenderObject6detachEv
-__ZN7WebCore19AccessibilityObject13clearChildrenEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE14shrinkCapacityEm
-__ZN7WebCore19AccessibilityObject6detachEv
-__ZN7WebCore25AccessibilityRenderObject16removeAXObjectIDEv
-__ZN7WebCore13AXObjectCache10removeAXIDEPNS_19AccessibilityObjectE
-__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E4findIjNS_22IdentityHashTranslatorIjjS4_EEEENS_17HashTableIteratorIjjS2_S4_S6_S6_EERKT_
-__ZN7WebCore25AccessibilityRenderObjectD1Ev
-__ZN7WebCore19AccessibilityObjectD0Ev
-__ZN7WebCore8Document23activeChainNodeDetachedEPNS_4NodeE
-__ZN7WebCore10HTMLParser24framesetCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCoreL19framesetConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLFrameSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore19HTMLFrameSetElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore19HTMLFrameSetElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14newLengthArrayERKNS_6StringERi
-__ZN7WebCoreL14countCharacterEPKtjt
-__ZN7WebCoreL11parseLengthEPKtj
-__ZNK7WebCore19HTMLFrameSetElement17endTagRequirementEv
-__ZNK7WebCore19HTMLFrameSetElement11tagPriorityEv
-__ZN7WebCore19HTMLFrameSetElement6attachEv
-__ZN7WebCore19HTMLFrameSetElement16rendererIsNeededEPNS_11RenderStyleE
-__ZNK7WebCore11RenderStyle16isStyleAvailableEv
-__ZN7WebCore19HTMLFrameSetElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderFrameSetC1EPNS_19HTMLFrameSetElementE
-__ZN7WebCore14RenderFrameSet8GridAxisC1Ev
-__ZN7WebCore19HTMLFrameSetElement8checkDTDEPKNS_4NodeE
-__ZNK7WebCore14RenderFrameSet10isFrameSetEv
-__ZN7WebCoreL16frameConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLFrameElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
-__ZN7WebCore16HTMLFrameElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLFrameElement17endTagRequirementEv
-__ZNK7WebCore16HTMLFrameElement11tagPriorityEv
-__ZN7WebCore16HTMLFrameElement6attachEv
-__ZN7WebCore16HTMLFrameElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore16HTMLFrameElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore11RenderFrameC1EPNS_16HTMLFrameElementE
-__ZNK7WebCore14RenderFrameSet14isChildAllowedEPNS_12RenderObjectEPNS_11RenderStyleE
-__ZNK7WebCore11RenderFrame7isFrameEv
-__ZN7WebCore11RenderFrame11viewClearedEv
-__ZN7WebCore10HTMLParser24noframesCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore16RenderListMarkerC2EPNS_14RenderListItemE
+__ZN7WebCore16RenderListMarker15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore16RenderListMarker14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZN7WebCore26CSSMutableStyleDeclaration21removePropertiesInSetEPKijb
-__ZN3WTF7HashSetIiNS_7IntHashIjEENS_10HashTraitsIiEEE3addERKi
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E5clearEv
-__ZNK3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E8containsIiNS_22IdentityHashTranslatorIiiS4_EEEEbRKT_
-__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EEaSERKS3_
-__ZN7WebCore14RenderFrameSet6layoutEv
-__ZN7WebCore14RenderFrameSet8GridAxis6resizeEi
-__ZN3WTF6VectorIbLm0EE6resizeEm
-__ZN3WTF6VectorIbLm0EE14expandCapacityEm
-__ZN3WTF6VectorIbLm0EE15reserveCapacityEm
-__ZN7WebCore14RenderFrameSet10layOutAxisERNS0_8GridAxisEPKNS_6LengthEi
-__ZN7WebCore14RenderFrameSet14positionFramesEv
-__ZN7WebCore14RenderFrameSet15computeEdgeInfoEv
-__ZN3WTF6VectorIbLm0EE4fillERKbm
-__ZSt4fillIPbbEvT_S1_RKT0_
-__ZNK7WebCore11RenderFrame8edgeInfoEv
-__ZN3WTF6VectorIbLm0EEaSERKS1_
-__ZN3WTF6VectorIbLm0EE6shrinkEm
-__ZN7WebCore14RenderFrameSet16fillFromEdgeInfoERKNS_13FrameEdgeInfoEii
-__ZNK7WebCore9RenderBox12maxTopMarginEb
-__ZNK7WebCore9RenderBox21isSelfCollapsingBlockEv
-__ZNK7WebCore9RenderBox16isTopMarginQuirkEv
-__ZNK7WebCore9RenderBox15maxBottomMarginEb
-__ZN7WebCore12RenderObject14containsFloatsEv
-__ZNK7WebCore9RenderBox11overflowTopEb
-__ZNK7WebCore9RenderBox14overflowHeightEb
-__ZN7WebCore14RenderFrameSet5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore14RenderFrameSet11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore19HTMLFrameSetElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore14RenderFrameSet10userResizeEPNS_10MouseEventE
-__ZN7WebCore17jsDOMWindowFramesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSDOMWindowBase11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore9FrameTree5childEj
-__ZN7WebCoreL17canAccessAncestorEPKNS_14SecurityOriginEPNS_5FrameE
-__ZN7WebCore25AccessibilityRenderObject15childrenChangedEv
-__ZN7WebCoreL27isObjectAncestorContainerOfEPNS_12RenderObjectES1_
-__ZN7WebCore24setJSHTMLDocumentBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore12HTMLDocument10setBgColorERKNS_6StringE
-__ZN7WebCore15HTMLBodyElement10setBgColorERKNS_6StringE
-__ZN7WebCore24setJSHTMLDocumentFgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore12HTMLDocument10setFgColorERKNS_6StringE
-__ZN7WebCore15HTMLBodyElement7setTextERKNS_6StringE
-__ZN7WebCore26setJSHTMLDocumentLinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore12HTMLDocument12setLinkColorERKNS_6StringE
-__ZNK7WebCore15HTMLBodyElement4linkEv
-__ZN7WebCore15HTMLBodyElement7setLinkERKNS_6StringE
-__ZN7WebCore15HTMLBodyElement14createLinkDeclEv
-__ZN7WebCore27setJSHTMLDocumentVlinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore12HTMLDocument13setVlinkColorERKNS_6StringE
-__ZNK7WebCore15HTMLBodyElement5vLinkEv
-__ZN7WebCore15HTMLBodyElement8setVLinkERKNS_6StringE
-__ZN7WebCore22jsDocumentLastModifiedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Document12lastModifiedEv
-__ZN7WebCore11RenderFrameD1Ev
-__ZN7WebCore14RenderFrameSetD1Ev
-__ZN7WebCore11HistoryItem17setAlternateTitleERKNS_6StringE
-__ZNK7WebCore11FrameLoader16responseMIMETypeEv
-__ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
-__ZN7WebCore5Image12supportsTypeERKNS_6StringE
-__ZN7WebCore16MIMETypeRegistry32isSupportedImageResourceMIMETypeERKNS_6StringE
-__ZNK7WebCore10PluginData16supportsMimeTypeERKNS_6StringE
-__ZN7WebCore12SharedBuffer20adoptPurgeableBufferEPNS_15PurgeableBufferE
-__ZN7WebCore5Cache18revalidateResourceEPNS_14CachedResourceEPNS_9DocLoaderE
-__ZNK7WebCore14CachedResource20canUseCacheValidatorEv
-__ZNK7WebCore19CachedCSSStyleSheet8encodingEv
-__ZN7WebCore14CachedResource23setResourceToRevalidateEPS0_
-__ZN3WTF7HashSetIPN7WebCore24CachedResourceHandleBaseENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore24CachedResourceHandleBaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZNK7WebCore12CachedScript8encodingEv
-__ZN7WebCore5Cache21revalidationSucceededEPNS_14CachedResourceERKNS_16ResourceResponseE
-__ZN7WebCore14CachedResource34switchClientsToRevalidatedResourceEv
-__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE15reserveCapacityEm
-__ZNK7WebCore15PurgeableBuffer4dataEv
-__ZN7WebCore14CachedResource25clearResourceToRevalidateEv
-__ZN7WebCore19CachedCSSStyleSheetD1Ev
-__ZN7WebCore12CachedScriptD1Ev
-__ZN7WebCore9CSSParser16createImportRuleERKNS_15CSSParserStringEPNS_9MediaListE
-__ZN7WebCore13CSSImportRuleC1EPNS_13CSSStyleSheetERKNS_6StringEN3WTF10PassRefPtrINS_9MediaListEEE
-__ZN7WebCore13CSSImportRule18insertedIntoParentEv
-__ZNK7WebCore7CSSRule16parentStyleSheetEv
-__ZThn12_N7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore13CSSStyleSheetC1EPNS_7CSSRuleERKNS_6StringES5_
-__ZN7WebCore10StyleSheetC2EPNS_9StyleBaseERKNS_6StringE
-__ZN7WebCore13CSSImportRule12isImportRuleEv
-__ZNK7WebCore13CSSImportRule9isLoadingEv
-__ZN7WebCore46jsElementPrototypeFunctionGetElementsByTagNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore15jsHTMLElementIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EEaSERKS3_
+__ZN7WebCoreL30createHTMLIFrameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLIFrameElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLIFrameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLIFrameElementEEE
+__ZN7WebCore19JSHTMLIFrameElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLIFrameElementEEE
+__ZN7WebCore19JSHTMLIFrameElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore6JSNode3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15setJSNodeOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOnloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14P
+__ZN7WebCore20JSNavigatorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsDocumentLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10JSDocument8locationEPN3JSC9ExecStateE
+__ZNK7WebCore9DOMWindow8locationEv
+__ZN7WebCore8LocationC1EPNS_5FrameE
+__ZN7WebCore8LocationC2EPNS_5FrameE
+__ZN7WebCore10JSLocation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSLocationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8LocationEEE
+__ZN7WebCore10JSLocationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8LocationEEE
+__ZN7WebCore10JSLocation18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10JSLocation24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21allowsAccessFromFrameEPN3JSC9ExecStateEPNS_5FrameERNS_6StringE
+__ZN7WebCore16jsLocationSearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location6searchEv
+__ZNK7WebCore4KURL5queryEv
+__ZN7WebCore21jsNavigatorAppVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator10appVersionEv
+__ZNK7WebCore13NavigatorBase10appVersionEv
+__ZN7WebCore15JSDOMWindowBase3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore11JSDOMWindow4markEv
+__ZN7WebCore17JSDOMGlobalObject4markEv
+__ZN7WebCore16JSDOMWindowShell4markEv
+__ZN7WebCore10JSDocument4markEv
+__ZN7WebCore6JSNode4markEv
+__ZN7WebCore23markDOMNodesForDocumentEPNS_8DocumentE
+__ZN7WebCore15JSEventListener14markJSFunctionEv
+__ZN7WebCore27markActiveObjectsForContextERN3JSC12JSGlobalDataEPNS_22ScriptExecutionContextE
+__ZN7WebCore20markDOMObjectWrapperERN3JSC12JSGlobalDataEPv
+__ZN7WebCore11JSNavigator4markEv
+__ZN7WebCore20JSDOMWindowPrototypeD1Ev
+__ZN7WebCore11JSDOMWindowD1Ev
+__ZN7WebCore11JSDOMWindowD2Ev
+__ZN7WebCore15JSDOMWindowBaseD2Ev
+__ZN7WebCore17JSDOMGlobalObjectD2Ev
+__ZN7WebCore15JSDOMWindowBase19JSDOMWindowBaseDataD0Ev
+__ZN7WebCore9DOMWindowD0Ev
+__ZN7WebCore5Frame20clearFormerDOMWindowEPNS_9DOMWindowE
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN3JSC14JSGlobalObject18JSGlobalObjectDataD2Ev
+__ZN3WTF9HashTableIPN3JSC16ProgramCodeBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN7WebCore15JSNodePrototypeD1Ev
+__ZN7WebCore19JSDocumentPrototypeD1Ev
+__ZN7WebCore23JSHTMLDocumentPrototypeD1Ev
+__ZN7WebCore14JSHTMLDocumentD1Ev
+__ZN7WebCore10JSDocumentD2Ev
+__ZN7WebCore15forgetDOMObjectERN3JSC12JSGlobalDataEPv
+__ZN3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE4takeERKS1_
+__ZN7WebCore6JSNodeD2Ev
+__ZN7WebCore13forgetDOMNodeEPNS_8DocumentEPNS_4NodeE
+__ZN3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE4takeERKS3_
+__ZN3WTF9HashTableIPN7WebCore4NodeESt4pairIS3_PNS1_6JSNodeEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsIN
+__ZN7WebCore16JSEventPrototypeD1Ev
+__ZN7WebCore7JSEventD1Ev
+__ZN7WebCore7JSEventD2Ev
+__ZN7WebCore20JSNavigatorPrototypeD1Ev
+__ZN7WebCore11JSNavigatorD1Ev
+__ZN7WebCore11JSNavigatorD2Ev
+__ZN7WebCore9NavigatorD0Ev
+__ZN7WebCore13NavigatorBaseD2Ev
+__ZN7WebCore18JSElementPrototypeD1Ev
+__ZN7WebCore22JSHTMLElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLMediaElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLAudioElementPrototypeD1Ev
+__ZN7WebCore18JSHTMLAudioElementD1Ev
+__ZN7WebCore27JSHTMLVideoElementPrototypeD1Ev
+__ZN7WebCore18JSHTMLVideoElementD1Ev
+__ZN7WebCore26CachedScriptSourceProviderD0Ev
+__ZN7WebCore5Cache27removeFromLiveResourcesSizeEPNS_14CachedResourceE
+__ZN7WebCore12CachedScript17allClientsRemovedEv
+__ZN7WebCore19JSNodeListPrototypeD1Ev
+__ZN7WebCore10JSNodeListD1Ev
+__ZN7WebCore10JSNodeListD2Ev
+__ZN7WebCore25JSStyleSheetListPrototypeD1Ev
+__ZN7WebCore16JSStyleSheetListD1Ev
+__ZN7WebCore16JSStyleSheetListD2Ev
+__ZN7WebCore21JSStyleSheetPrototypeD1Ev
+__ZN7WebCore24JSCSSStyleSheetPrototypeD1Ev
+__ZN7WebCore15JSCSSStyleSheetD1Ev
+__ZN7WebCore12JSStyleSheetD2Ev
+__ZN7WebCore22JSCSSRuleListPrototypeD1Ev
+__ZN7WebCore13JSCSSRuleListD1Ev
+__ZN7WebCore13JSCSSRuleListD2Ev
+__ZN7WebCore11CSSRuleListD1Ev
+__ZN7WebCore11CSSRuleListD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE6shrinkEm
+__ZN7WebCore18JSCSSRulePrototypeD1Ev
+__ZN7WebCore23JSCSSStyleRulePrototypeD1Ev
+__ZN7WebCore14JSCSSStyleRuleD1Ev
+__ZN7WebCore9JSCSSRuleD2Ev
+__ZN7WebCore18JSImageConstructorD1Ev
+__ZN7WebCore27JSHTMLImageElementPrototypeD1Ev
+__ZN7WebCore18JSHTMLImageElementD1Ev
+__ZN7WebCore33JSWebKitCSSKeyframesRulePrototypeD1Ev
+__ZN7WebCore24JSWebKitCSSKeyframesRuleD1Ev
+__ZThn8_N7WebCore16HTMLImageElementD0Ev
+__ZN7WebCore16HTMLImageElementD0Ev
+__ZN7WebCore15HTMLImageLoaderD1Ev
+__ZN7WebCore15HTMLImageLoaderD2Ev
+__ZN7WebCore11ImageLoaderD2Ev
+__ZN7WebCore20ImageLoadEventSender15cancelLoadEventEPNS_11ImageLoaderE
+__ZN7WebCore12NamedNodeMap17detachFromElementEv
+__ZN3WTF9HashTableIPKN7WebCore4NodeESt4pairIS4_PNS1_12NodeRareDataEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHash
+__ZN7WebCore24JSProgressEventPrototypeD1Ev
+__ZN7WebCore15JSProgressEventD1Ev
+__ZN7WebCore26JSHTMLBodyElementPrototypeD1Ev
+__ZN7WebCore17JSHTMLBodyElementD1Ev
+__ZN7WebCore31JSWebKitAnimationEventPrototypeD1Ev
+__ZN7WebCore22JSWebKitAnimationEventD1Ev
+__ZN7WebCore20WebKitAnimationEventD0Ev
+__ZN7WebCore12DocumentTypeD0Ev
+__ZN7WebCore15HTMLHeadElementD0Ev
+__ZN7WebCore15HTMLBodyElementD0Ev
+__ZN7WebCore15HTMLMetaElementD0Ev
+__ZN7WebCore16HTMLTitleElementD0Ev
+__ZN7WebCore17HTMLScriptElementD0Ev
+__ZN7WebCore17ScriptElementDataD1Ev
+__ZN7WebCore17ScriptElementDataD2Ev
+__ZN7WebCore17ScriptElementData15stopLoadRequestEv
+__ZN7WebCore15HTMLLinkElementD0Ev
+__ZN7WebCore19CachedCSSStyleSheet17allClientsRemovedEv
+__ZN7WebCore11HTMLElementD0Ev
+__ZN7WebCore16HTMLAudioElementD0Ev
+__ZN7WebCore16HTMLMediaElementD2Ev
+__ZN7WebCore8Document40unregisterForDocumentActivationCallbacksEPNS_7ElementE
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Id
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInval
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore8Document33unregisterForMediaVolumeCallbacksEPNS_7ElementE
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE6shrinkEm
+__ZN7WebCore14HTMLDivElementD0Ev
+__ZN7WebCore11CachedImage17allClientsRemovedEv
+__ZN7WebCore11BitmapImage14resetAnimationEv
+__ZN7WebCore11BitmapImage13stopAnimationEv
+__ZN7WebCore11BitmapImage29destroyDecodedDataIfNecessaryEb
+__ZN7WebCore18HTMLHeadingElementD0Ev
+__ZN7WebCore16HTMLVideoElementD0Ev
+__ZN7WebCore29CSSMappedAttributeDeclarationD0Ev
+__ZN7WebCore13StyledElement25removeMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore14CachedResource16deleteIfPossibleEv
+__ZN7WebCore9FontValueD0Ev
+__ZN7WebCore15FontFamilyValueD0Ev
+__ZN7WebCore17CSSPrimitiveValueD2Ev
+__ZN7WebCore13CSSImageValueD0Ev
+__ZN7WebCore16StyleCachedImageD0Ev
+__ZN7WebCore15CSSReflectValueD0Ev
+__ZN7WebCore19CSSBorderImageValueD0Ev
+__ZN7WebCore16CSSGradientValueD0Ev
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE6shrinkEm
+__ZN7WebCore22CSSImageGeneratorValueD2Ev
+__ZN7WebCore19StyleGeneratedImageD0Ev
+__ZN7WebCore22WebKitCSSKeyframesRuleD0Ev
+__ZN7WebCore21WebKitCSSKeyframeRuleD0Ev
+__ZN7WebCore23WebKitCSSTransformValueD0Ev
+__ZN7WebCore12CSSValueListD2Ev
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15DynamicNodeList6CachesEKNS_7HashMapINS1_6StringES4_NS1_10StringHashENS_10HashTraitsI
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15DynamicNodeList6CachesEKNS_7HashMapINS1_13QualifiedNameES4_NS1_17QualifiedNameHashEN
+__ZN3WTF9HashTableIPN7WebCore15DynamicNodeListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deall
+__ZN7WebCore19jsDOMWindowLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow8locationEPN3JSC9ExecStateE
+__ZN7WebCore18jsLocationProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location8protocolEv
+__ZN7WebCoreL28createHTMLHeadElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLHeadElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLHeadElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHeadElementEEE
+__ZN7WebCore17JSHTMLHeadElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHeadElementEEE
+__ZN7WebCore18jsNavigatorAppNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase7appNameEv
+__ZN7WebCore17JSHTMLBodyElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSHTMLBodyElement9classInfoEv
+__ZN7WebCore13jsDocumentURLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsDocumentPrototypeFunctionCreateElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12HTMLDocument13createElementERKNS_12AtomicStringERi
+__ZN7WebCore8Document11isValidNameERKNS_6StringE
+__ZN7WebCore10StringImpl7isLowerEv
 __ZN7WebCoreL17objectConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
 __ZN7WebCore17HTMLObjectElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17HTMLObjectElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore22HTMLPlugInImageElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore17HTMLPlugInElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_7ElementE
 __ZN7WebCoreL30createHTMLObjectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLObjectElement15createPrototypeEPN3JSC9ExecStateE
+__ZN7WebCore19JSHTMLObjectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore19JSHTMLObjectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLObjectElementEEE
+__ZN7WebCore19JSHTMLObjectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLObjectElementEEE
 __ZN7WebCore19JSHTMLObjectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCore19JSHTMLObjectElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_17HTMLObjectElementERKNS1_10IdentifierE
 __ZN7WebCore19JSHTMLObjectElement24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore37runtimeObjectCustomGetOwnPropertySlotEPN3JSC9ExecStateERKNS0_10IdentifierERNS0_12PropertySlotEPNS_13JSHTMLElementE
+__ZN7WebCore37runtimeObjectCustomGetOwnPropertySlotEPN3JSC9ExecStateERKNS0_10IdentifierERNS0_12PropertySlotEPNS_13JSHTMLElement
 __ZN7WebCoreL16getRuntimeObjectEPN3JSC9ExecStateEPNS_4NodeE
 __ZN7WebCoreL14pluginInstanceEPNS_4NodeE
 __ZNK7WebCore17HTMLPlugInElement11getInstanceEv
 __ZNK7WebCore17HTMLObjectElement25renderWidgetForJSBindingsEv
 __ZN7WebCore28JSHTMLObjectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsElementPrototypeFunctionSetAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore19JSHTMLObjectElement9classInfoEv
+__ZN7WebCore9JSElement12setAttributeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore7Element12setAttributeERKNS_12AtomicStringES3_Ri
 __ZNK7WebCore17HTMLPlugInElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore17HTMLObjectElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore17HTMLPlugInElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore19JSHTMLObjectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore19JSHTMLObjectElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore22runtimeObjectCustomPutEPN3JSC9ExecStateERKNS0_10IdentifierENS0_10JSValuePtrEPNS_11HTMLElementERNS0_15PutPropertySlotE
+__ZN7WebCore19JSHTMLObjectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19JSHTMLObjectElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore22runtimeObjectCustomPutEPN3JSC9ExecStateERKNS0_10IdentifierENS0_7JSValueEPNS_11HTMLElementERNS0_15PutPropertySlotE
+__ZN7WebCore18setJSHTMLElementIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement5setIdERKNS_6StringE
+__ZN7WebCore17JSHTMLHeadElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsNodePrototypeFunctionAppendChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17JSHTMLHeadElement9classInfoEv
+__ZN7WebCore6JSNode11appendChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore6toNodeEN3JSC7JSValueE
+__ZN7WebCore13ContainerNode11appendChildEN3WTF10PassRefPtrINS_4NodeEEERib
+__ZN7WebCore4Node13checkAddChildEPS0_Ri
+__ZN7WebCore8Document19nodeChildrenChangedEPNS_13ContainerNodeE
+__ZN7WebCoreL20disableRangeMutationEPNS_4PageE
+__ZN7WebCore4Node30notifyNodeListsChildrenChangedEv
+__ZN7WebCore4Node35notifyLocalNodeListsChildrenChangedEv
+__ZN7WebCore17NodeListsNodeData16invalidateCachesEv
+__ZN7WebCore15DynamicNodeList6Caches5resetEv
+__ZN7WebCoreL28dispatchChildInsertionEventsEPNS_4NodeERi
 __ZN7WebCore17HTMLObjectElement20insertedIntoDocumentEv
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEiNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IiEEE3setERKS3_RKi
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCore4Node10lazyAttachEv
 __ZN7WebCore17HTMLObjectElement13canLazyAttachEv
 __ZN7WebCore17HTMLObjectElement6detachEv
 __ZN7WebCore17HTMLPlugInElement6detachEv
@@ -6168,43 +6049,172 @@
 __ZN7WebCore22HTMLPlugInImageElement11isImageTypeEv
 __ZN7WebCore17HTMLPlugInElement20updateWidgetCallbackEPNS_4NodeE
 __ZN7WebCore17HTMLObjectElement12updateWidgetEv
-__ZN7WebCoreL29createHTMLLabelElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLLabelElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLLabelElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLLabelElementEEE
-__ZN7WebCore18JSHTMLLabelElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore48jsElementPrototypeFunctionGetElementsByClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore18JSHTMLLabelElement9classInfoEv
-__ZN7WebCore6JSText18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15JSCharacterData18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15jsNodeNodeValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSCharacterData3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore18setJSNodeNodeValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore13CharacterData12setNodeValueERKNS_6StringERi
-__ZN7WebCore26setJSHTMLAnchorElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAnchorElement7setHrefERKNS_12AtomicStringE
-__ZN7WebCore16jsNodeChildNodesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4Node10childNodesEv
-__ZN7WebCore13ChildNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEPNS_15DynamicNodeList6CachesE
-__ZNK7WebCore13ChildNodeList6lengthEv
-__ZL29jsDOMWindowBaseXMLHttpRequestPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore27JSXMLHttpRequestConstructorC1EPN3JSC9ExecStateEPNS_22ScriptExecutionContextE
-__ZN7WebCore25JSXMLHttpRequestPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore16JSXMLHttpRequest15createPrototypeEPN3JSC9ExecStateE
+__ZN7WebCoreL10isHTTPOnlyEP12NSHTTPCookie
+__ZN7WebCore33jsDOMWindowHTMLElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSHTMLElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23getCachedDOMConstructorEPN3JSC9ExecStateEPKNS0_9ClassInfoE
+__ZN7WebCore19cacheDOMConstructorEPN3JSC9ExecStateEPKNS0_9ClassInfoEPNS0_8JSObjectE
+__ZN7WebCoreL27createHTMLDivElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLDivElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLDivElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLDivElementEEE
+__ZN7WebCore16JSHTMLDivElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLDivElementEEE
+__ZN7WebCore16JSHTMLDivElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL15formConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCoreL28createHTMLFormElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLFormElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLFormElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFormElementEEE
+__ZN7WebCore17JSHTMLFormElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFormElementEEE
+__ZN7WebCore17JSHTMLFormElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSHTMLFormElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_15HTMLFormElementERKNS1_10IdentifierE
+__ZN7WebCore15HTMLFormElement16getNamedElementsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZNK7WebCore14HTMLCollection10namedItemsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZNK7WebCore18HTMLFormCollection15updateNameCacheEv
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS_6VectorIPNS1_7ElementELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS8_EE
+__ZN7WebCore15HTMLFormElement15elementForAliasERKNS_12AtomicStringE
+__ZN7WebCore41jsDocumentPrototypeFunctionCreateTextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_4TextE
+__ZN7WebCore6JSText15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSCharacterDataPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCharacterData15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSTextC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4TextEEE
+__ZN7WebCore6JSTextC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4TextEEE
+__ZN7WebCore15JSCharacterDataC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CharacterDataEEE
+__ZNK7WebCore16JSHTMLDivElement9classInfoEv
+__ZNK7WebCore6JSText9classInfoEv
+__ZN7WebCore4Node16insertedIntoTreeEb
+__ZN7WebCore16JSHTMLDivElementD1Ev
+__ZThn8_N7WebCore14HTMLDivElementD0Ev
+__ZN7WebCore17JSHTMLFormElementD1Ev
+__ZThn8_N7WebCore15HTMLFormElementD0Ev
+__ZN7WebCore15HTMLFormElementD0Ev
+__ZN7WebCore15FormDataBuilderD1Ev
+__ZN7WebCore15FormDataBuilderD2Ev
+__ZNK7WebCore26CachedScriptSourceProvider8getRangeEii
+__ZN7WebCore26jsDOMWindowNodeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSNode14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSNodeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsNodeELEMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMWindowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32setJSDOMWindowElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN3JSC8JSObject9putDirectERKNS_10IdentifierENS_7JSValueEj
+__ZNK7WebCore20JSElementConstructor9classInfoEv
+__ZN7WebCore20JSElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsDOMWindowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7JSEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore18JSEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSHTMLElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsDOMWindowPrototypeFunctionSetIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow11setIntervalEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15ScheduledAction6createEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15ScheduledActionC1EN3JSC7JSValueERKNS1_7ArgListE
+__ZN7WebCore15ScheduledActionC2EN3JSC7JSValueERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow11setIntervalEPNS_15ScheduledActionEi
+__ZNK7WebCore9DOMWindow22scriptExecutionContextEv
+__ZN7WebCore8DOMTimer7installEPNS_22ScriptExecutionContextEPNS_15ScheduledActionEib
+__ZN7WebCore8DOMTimerC1EPNS_22ScriptExecutionContextEPNS_15ScheduledActionEib
+__ZN7WebCore8DOMTimerC2EPNS_22ScriptExecutionContextEPNS_15ScheduledActionEib
+__ZN7WebCore15ActiveDOMObjectC2EPNS_22ScriptExecutionContextEPv
+__ZN7WebCore22ScriptExecutionContext22createdActiveDOMObjectEPNS_15ActiveDOMObjectEPv
+__ZN3WTF7HashMapIPN7WebCore15ActiveDOMObjectEPvNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3addERKS3_RKS4_
+__ZN3WTF9HashTableIPN7WebCore15ActiveDOMObjectESt4pairIS3_PvENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCore22ScriptExecutionContext10addTimeoutEiPNS_8DOMTimerE
+__ZN3WTF7HashMapIiPN7WebCore8DOMTimerENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore8DOMTimerEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTrai
+__ZN7WebCore37jsDOMWindowHTMLFormElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLFormElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLFormElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLFormElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsDOMWindowHTMLInputElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLInputElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLInputElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLInputElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsDOMWindowHTMLSelectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLSelectElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLSelectElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLSelectElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsDOMWindowHTMLTextAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLTextAreaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLTextAreaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLTextAreaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLTextAreaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsDocumentDefaultViewEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9DOMWindowE
+__ZN7WebCore18jsLocationHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location8hostnameEv
+__ZN7WebCore19setJSDocumentCookieEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document9setCookieERKNS_6StringE
+__ZN7WebCore10setCookiesEPNS_8DocumentERKNS_4KURLERKNS_6StringE
+__ZThn32_NK7WebCore8DOMTimer18hasPendingActivityEv
+__ZNK7WebCore8DOMTimer18hasPendingActivityEv
+__ZN7WebCore14jsLocationHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location4hrefEv
+__ZNK7WebCore4KURL7hasPathEv
+__ZNK7WebCore4KURL9prettyURLEv
+__ZN7WebCore16jsDocumentImagesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document6imagesEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14HTMLCollectionE
+__ZN7WebCore16JSHTMLCollection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLCollectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLCollectionEEE
+__ZN7WebCore16JSHTMLCollectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLCollectionEEE
+__ZN7WebCore16JSHTMLCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSHTMLCollectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsHTMLCollectionLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLCollection18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore16JSHTMLCollection11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLImageElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement3srcEv
+__ZN7WebCoreL28createHTMLLinkElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLLinkElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLLinkElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLLinkElementEEE
+__ZN7WebCore17JSHTMLLinkElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLLinkElementEEE
+__ZN7WebCore17JSHTMLLinkElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLLinkElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement4hrefEv
+__ZNK7WebCore17JSHTMLLinkElement9classInfoEv
+__ZN7WebCore19JSHTMLIFrameElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsHTMLIFrameElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase3srcEv
+__ZN7WebCore28JSHTMLIFrameElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSHTMLIFrameElement9classInfoEv
+__ZN7WebCore10JSNodeList18canGetItemsForNameEPN3JSC9ExecStateEPNS_8NodeListERKNS1_10IdentifierE
+__ZNK7WebCore15DynamicNodeList12itemWithNameERKNS_12AtomicStringE
+__ZN7WebCore19JSNodeListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14jsLocationHostEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location4hostEv
+__ZN7WebCore22jsHTMLElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLDivElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore36jsDOMWindowXMLHttpRequestConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow14xmlHttpRequestEPN3JSC9ExecStateE
+__ZN7WebCore27JSXMLHttpRequestConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore27JSXMLHttpRequestConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore25JSXMLHttpRequestPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSXMLHttpRequest15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore27JSXMLHttpRequestConstructor16getConstructDataERN3JSC13ConstructDataE
 __ZN7WebCoreL23constructXMLHttpRequestEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore27JSXMLHttpRequestConstructor22scriptExecutionContextEv
 __ZN7WebCore14XMLHttpRequestC1EPNS_22ScriptExecutionContextE
+__ZN7WebCore14XMLHttpRequestC2EPNS_22ScriptExecutionContextE
 __ZN7WebCoreL34initializeXMLHttpRequestStaticDataEv
 __ZN7WebCore24XMLHttpRequestStaticDataC1Ev
+__ZN7WebCore24XMLHttpRequestStaticDataC2Ev
 __ZN7WebCore16JSXMLHttpRequestC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XMLHttpRequestEEE
+__ZN7WebCore16JSXMLHttpRequestC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XMLHttpRequestEEE
 __ZN7WebCore16JSXMLHttpRequest18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL24getJSXMLHttpRequestTableEPN3JSC9ExecStateE
+__ZN7WebCore25getHashTableForGlobalDataERN3JSC12JSGlobalDataEPKNS0_9HashTableE
+__ZN7WebCore21DOMObjectHashTableMap6mapForERN3JSC12JSGlobalDataE
+__ZN3WTF9HashTableIPKN3JSC9HashTableESt4pairIS4_S2_ENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10Hash
+__ZN3WTF7HashMapIPKN3JSC9HashTableES2_NS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IS2_EEE3setERKS4_RS3_
 __ZN7WebCore26jsXMLHttpRequestReadyStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore14XMLHttpRequest10readyStateEv
 __ZN7WebCore25JSXMLHttpRequestPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore37jsXMLHttpRequestPrototypeFunctionOpenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCoreL33getJSXMLHttpRequestPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore37jsXMLHttpRequestPrototypeFunctionOpenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore16JSXMLHttpRequest9classInfoEv
 __ZN7WebCore16JSXMLHttpRequest4openEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZNK7WebCore14XMLHttpRequest22scriptExecutionContextEv
-__ZThn44_NK7WebCore8Document18virtualCompleteURLERKNS_6StringE
+__ZThn88_NK7WebCore8Document18virtualCompleteURLERKNS_6StringE
 __ZNK7WebCore8Document18virtualCompleteURLERKNS_6StringE
 __ZN7WebCore14XMLHttpRequest4openERKNS_6StringERKNS_4KURLEbRi
 __ZN7WebCore14XMLHttpRequest13internalAbortEv
@@ -6215,20 +6225,19 @@
 __ZN7WebCore14XMLHttpRequest28callReadyStateChangeListenerEv
 __ZN7WebCore14XMLHttpRequest29dispatchReadyStateChangeEventEv
 __ZN7WebCore14XMLHttpRequest13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
-__ZN3WTF7HashMapIN7WebCore12AtomicStringENS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEENS1_16AtomicStringHashENS_10HashTraitsIS2_EENS9_IS7_EEE3addERKS2_RKS7_
-__ZN7WebCore16JSXMLHttpRequest3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore37setJSXMLHttpRequestOnreadystatechangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17JSDOMGlobalObject38findOrCreateJSUnprotectedEventListenerEPN3JSC9ExecStateENS1_10JSValuePtrEb
-__ZN7WebCore17JSDOMGlobalObject30findJSUnprotectedEventListenerEPN3JSC9ExecStateENS1_10JSValuePtrEb
-__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore26JSUnprotectedEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
-__ZN7WebCore26JSUnprotectedEventListenerC1EPN3JSC8JSObjectEPNS_17JSDOMGlobalObjectEb
-__ZN7WebCore17JSDOMGlobalObject33jsUnprotectedInlineEventListenersEv
-__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionSetRequestHeaderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZNK3WTF7HashMapIN7WebCore12AtomicStringENS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEENS1_16AtomicStringHashENS_10HashTra
+__ZN7WebCore38jsDOMWindowPrototypeFunctionSetTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow10setTimeoutEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow10setTimeoutEPNS_15ScheduledActionEi
+__ZN7WebCore16JSXMLHttpRequest3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore37setJSXMLHttpRequestOnreadystatechangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionSetRequestHeaderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore16JSXMLHttpRequest16setRequestHeaderEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZN7WebCore14XMLHttpRequest16setRequestHeaderERKNS_12AtomicStringERKNS_6StringERi
 __ZNK7WebCore14XMLHttpRequest19isSafeRequestHeaderERKNS_6StringE
 __ZN7WebCore14XMLHttpRequest24setRequestHeaderInternalERKNS_12AtomicStringERKNS_6StringE
-__ZN7WebCore37jsXMLHttpRequestPrototypeFunctionSendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN3WTF7HashMapIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3addERKS2_RKS3_
+__ZN7WebCore37jsXMLHttpRequestPrototypeFunctionSendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore16JSXMLHttpRequest4sendEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZN7WebCore14XMLHttpRequest4sendERi
 __ZN7WebCore14XMLHttpRequest4sendERKNS_6StringERi
@@ -6236,372 +6245,2094 @@
 __ZN7WebCore14XMLHttpRequest13createRequestERi
 __ZN7WebCore14XMLHttpRequest22dispatchLoadStartEventEv
 __ZN7WebCore14XMLHttpRequest35dispatchXMLHttpRequestProgressEventEPNS_13EventListenerERKNS_12AtomicStringEbjj
-__ZN7WebCore27XMLHttpRequestProgressEventD1Ev
+__ZN7WebCore27XMLHttpRequestProgressEventD0Ev
 __ZNK7WebCore14SecurityOrigin10canRequestERKNS_4KURLE
 __ZNK7WebCore14SecurityOrigin20isSameSchemeHostPortEPKS0_
 __ZN7WebCore14XMLHttpRequest21makeSameOriginRequestERi
+__ZN7WebCore19ResourceRequestBase13setHTTPMethodERKNS_6StringE
 __ZN7WebCore19ResourceRequestBase19addHTTPHeaderFieldsERKNS_13HTTPHeaderMapE
 __ZN7WebCore19ResourceRequestBase18addHTTPHeaderFieldERKNS_12AtomicStringERKNS_6StringE
 __ZN7WebCore14XMLHttpRequest25loadRequestAsynchronouslyERNS_15ResourceRequestE
-__ZN7WebCore16ThreadableLoader6createEPNS_22ScriptExecutionContextEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallbacksENS_12ContentSniffE
-__ZN7WebCore24DocumentThreadableLoader6createEPNS_8DocumentEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallbacksENS_12ContentSniffE
-__ZN7WebCore24DocumentThreadableLoaderC1EPNS_8DocumentEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallbacksENS_12ContentSniffE
+__ZN7WebCore16ThreadableLoader6createEPNS_22ScriptExecutionContextEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13Loa
+__ZNK7WebCore22ScriptExecutionContext15isWorkerContextEv
+__ZN7WebCore24DocumentThreadableLoader6createEPNS_8DocumentEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallba
+__ZN7WebCore24DocumentThreadableLoaderC1EPNS_8DocumentEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallbacksEN
+__ZN7WebCore24DocumentThreadableLoaderC2EPNS_8DocumentEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallbacksEN
+__ZNK7WebCore11ContentData14dataEquivalentERKS0_
+__ZN7WebCoreL21findBeforeAfterParentEPNS_12RenderObjectE
+__ZN7WebCore11ContentData5clearEv
+__ZN7WebCore41jsDOMWindowPrototypeFunctionClearIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow13clearIntervalEi
+__ZN7WebCore8DOMTimer10removeByIdEPNS_22ScriptExecutionContextEi
+__ZN7WebCore22ScriptExecutionContext11findTimeoutEi
+__ZNK3WTF7HashMapIiPN7WebCore8DOMTimerENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3getERKi
+__ZN7WebCore8DOMTimerD0Ev
+__ZN7WebCore22ScriptExecutionContext13removeTimeoutEi
+__ZN7WebCore15ActiveDOMObjectD2Ev
+__ZN7WebCore22ScriptExecutionContext24destroyedActiveDOMObjectEPNS_15ActiveDOMObjectE
+__ZN7WebCore16jsNodeParentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL29createHTMLLabelElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLLabelElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLLabelElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLLabelElementEEE
+__ZN7WebCore18JSHTMLLabelElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLLabelElementEEE
+__ZN7WebCore18JSHTMLLabelElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsElementTagNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsElementPrototypeFunctionGetElementsByClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSHTMLLabelElement9classInfoEv
+__ZN7WebCore4Node22getElementsByClassNameERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_15DynamicNodeList6CachesENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3addERKS2_RKS5
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_
+__ZN7WebCore13ClassNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZN7WebCore13ClassNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZNK7WebCore13ClassNodeList11nodeMatchesEPNS_7ElementE
+__ZN7WebCore14ClassNamesData11containsAllERS0_
+__ZN7WebCore16jsNodeFirstChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSText18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSCharacterData18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15jsNodeNodeValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCharacterData3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18setJSNodeNodeValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13CharacterData12setNodeValueERKNS_6StringERi
+__ZN7WebCore13CharacterData7setDataERKNS_6StringERi
+__ZN7WebCore13CharacterData21dispatchModifiedEventEPNS_10StringImplE
+__ZN7WebCore8Document11textRemovedEPNS_4NodeEjj
+__ZN7WebCore8Document13removeMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
+__ZN7WebCore8Document12shiftMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
+__ZN7WebCore12RenderObject12removeLayersEPNS_11RenderLayerE
+__ZN7WebCore27RenderTextControlInnerBlockD0Ev
+__ZN7WebCore27RenderTextControlSingleLineD0Ev
+__ZN7WebCore17RenderTextControlD2Ev
+__ZThn8_N7WebCore27TextControlInnerTextElementD0Ev
+__ZN7WebCore27TextControlInnerTextElementD0Ev
+__ZN7WebCore14HTMLDivElementD2Ev
+__ZN3WTF10RefCountedIN7WebCore16SharedFontFamilyEE5derefEv
+__ZN7WebCore38jsElementPrototypeFunctionGetAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element12getAttributeERKNS_6StringE
+__ZThn8_N7WebCore23TextControlInnerElementD0Ev
+__ZN7WebCore23TextControlInnerElementD0Ev
+__ZN7WebCore7Element19removedFromDocumentEv
+__ZN7WebCore13ContainerNode19removedFromDocumentEv
+__ZN7WebCore4Node19removedFromDocumentEv
+__ZN7WebCore13ContainerNode15removedFromTreeEb
+__ZN7WebCore31SearchFieldResultsButtonElementD0Ev
+__ZN7WebCore30SearchFieldCancelButtonElementD0Ev
+__ZNK7WebCore14RenderThemeMac39adjustSearchFieldResultsDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore27RenderTextControlSingleLine27updatePlaceholderVisibilityEv
+__ZN7WebCoreL23replaceChildrenWithTextEPNS_11HTMLElementERKNS_6StringERi
+__ZN7WebCoreL30createHTMLAnchorElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLAnchorElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLAnchorElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAnchorElementEEE
+__ZN7WebCore19JSHTMLAnchorElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAnchorElementEEE
+__ZN7WebCore19JSHTMLAnchorElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore26setJSHTMLAnchorElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement7setHrefERKNS_12AtomicStringE
+__ZN7WebCore19JSHTMLAnchorElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSHTMLAnchorElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSHTMLAnchorElement9classInfoEv
+__ZN7WebCore25setJSHTMLElementInnerHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setInnerHTMLERKNS_6StringERi
+__ZN7WebCore11HTMLElement24createContextualFragmentERKNS_6StringE
+__ZN7WebCore16DocumentFragmentC1EPNS_8DocumentE
+__ZN7WebCore16DocumentFragmentC2EPNS_8DocumentE
+__ZN7WebCore25parseHTMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentE
+__ZN7WebCore13HTMLTokenizerC1EPNS_16DocumentFragmentE
+__ZN7WebCore13HTMLTokenizerC2EPNS_16DocumentFragmentE
+__ZN7WebCore10HTMLParserC1EPNS_16DocumentFragmentE
+__ZN7WebCore10HTMLParserC2EPNS_16DocumentFragmentE
+__ZN7WebCore13HTMLTokenizer19setForceSynchronousEb
+__ZN7WebCore16DocumentFragment16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore13HTMLTokenizerD1Ev
+__ZN7WebCore13HTMLTokenizerD2Ev
+__ZN7WebCoreL27replaceChildrenWithFragmentEPNS_11HTMLElementEN3WTF10PassRefPtrINS_16DocumentFragmentEEERi
+__ZNK7WebCore16DocumentFragment8nodeTypeEv
+__ZN7WebCore13ContainerNode11removeChildEPNS_4NodeERi
+__ZN7WebCoreL15willRemoveChildEPNS_4NodeE
+__ZN7WebCore8Document17nodeWillBeRemovedEPNS_4NodeE
+__ZN7WebCore19SelectionController17nodeWillBeRemovedEPNS_4NodeE
+__ZThn8_N7WebCore16DocumentFragmentD0Ev
+__ZN7WebCore16DocumentFragmentD0Ev
+__ZN7WebCore13ContainerNode12replaceChildEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
+__ZN7WebCore4Node17checkReplaceChildEPS0_S1_Ri
+__ZN7WebCore4Node15canReplaceChildEPS0_S1_
+__ZN7WebCoreL11appendASCIIERKNS_6StringEPKcmRN3WTF6VectorIcLm512EEE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE14expandCapacityEm
+__ZN7WebCore16jsNodeChildNodesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4Node10childNodesEv
+__ZN7WebCore13ChildNodeListC1EN3WTF10PassRefPtrINS_4NodeEEEPNS_15DynamicNodeList6CachesE
+__ZN7WebCore13ChildNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEPNS_15DynamicNodeList6CachesE
+__ZNK7WebCore13ChildNodeList6lengthEv
+__ZN7WebCore14jsLocationHashEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location4hashEv
+__ZNK7WebCore4KURL3refEv
+__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node13canLazyAttachEv
+__ZN7WebCore18jsLocationPathnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location8pathnameEv
+__ZN7WebCore33jsDOMWindowXPathResultConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSXPathResult14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSXPathResultConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSXPathResultPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSXPathResult15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSXPathResultConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsXPathResultORDERED_NODE_SNAPSHOT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsDocumentPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17toXPathNSResolverEN3JSC7JSValueE
+__ZN7WebCore23JSCustomXPathNSResolver6createEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore13toXPathResultEN3JSC7JSValueE
+__ZN7WebCore8Document8evaluateERKNS_6StringEPNS_4NodeEPNS_15XPathNSResolverEtPNS_11XPathResultERi
+__ZN7WebCore14XPathEvaluator8evaluateERKNS_6StringEPNS_4NodeEPNS_15XPathNSResolverEtPNS_11XPathResultERi
+__ZN7WebCore5XPath18isValidContextNodeEPNS_4NodeE
+__ZN7WebCore14XPathEvaluator16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
+__ZN7WebCore15XPathExpression16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
+__ZN7WebCore5XPath6ParserC1Ev
+__ZN7WebCore5XPath6ParserC2Ev
+__ZN7WebCore5XPath6Parser5resetERKNS_6StringE
+__ZN7WebCore5XPath6Parser14parseStatementERKNS_6StringEN3WTF10PassRefPtrINS_15XPathNSResolverEEERi
+__Z12xpathyyparsePv
+__ZN7WebCore5XPath6Parser3lexEPv
+__ZN7WebCore5XPath6Parser9nextTokenEv
+__ZN7WebCore5XPath6Parser17nextTokenInternalEv
+__ZN7WebCore5XPath6Parser6skipWSEv
+__ZN7WebCore5XPath6Parser13peekCurHelperEv
+__ZN7WebCore5XPath6Parser15peekAheadHelperEv
+__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEii
+__ZN7WebCore5XPath4StepC1ENS1_4AxisERKNS1_8NodeTestERKN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZN7WebCore5XPath4StepC2ENS1_4AxisERKNS1_8NodeTestERKN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EEC1ERKS5_
+__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EEC2ERKS5_
+__ZN7WebCore5XPath6Parser17registerParseNodeEPNS0_9ParseNodeE
+__ZN3WTF7HashSetIPN7WebCore5XPath9ParseNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandE
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashE
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13alloca
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deallo
+__ZN7WebCore5XPath12LocationPathC1Ev
+__ZN7WebCore5XPath12LocationPathC2Ev
+__ZN7WebCore5XPath10ExpressionC2Ev
+__ZN7WebCore5XPath12LocationPath10appendStepEPNS0_4StepE
+__ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE15reserveCapacityEm
+__ZN7WebCore5XPath6Parser19unregisterParseNodeEPNS0_9ParseNodeE
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47remove
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6removeE
+__ZNK7WebCore5XPath6Parser17isOperatorContextEv
+__ZN7WebCore5XPath6Parser14registerStringEPNS_6StringE
+__ZN3WTF7HashSetIPN7WebCore6StringENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTable
+__ZN7WebCore5XPath6Parser9lexNCNameERNS_6StringE
+__ZN7WebCore5XPathL7charCatEt
+__ZN7WebCore5XPathL14isNodeTypeNameERKNS_6StringE
+__ZN7WebCore5XPath6Parser9lexStringEv
+__ZN7WebCore5XPath16StringExpressionC1ERKNS_6StringE
+__ZN7WebCore5XPath16StringExpressionC2ERKNS_6StringE
+__ZN7WebCore5XPath6Parser12deleteStringEPNS_6StringE
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ide
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvali
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE15reserveCapacityEm
+__ZN7WebCore5XPath6Parser24registerExpressionVectorEPN3WTF6VectorIPNS0_10ExpressionELm0EEE
+__ZN3WTF7HashSetIPNS_6VectorIPN7WebCore5XPath10ExpressionELm0EEENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEE3addERKS7_
+__ZN7WebCore5XPath6Parser11expandQNameERKNS_6StringERS2_S5_
+__ZN7WebCore5XPath14createFunctionERKNS_6StringERKN3WTF6VectorIPNS0_10ExpressionELm0EEE
+__ZN7WebCore5XPathL17createFunctionMapEv
+__ZN3WTF7HashMapIN7WebCore6StringENS1_5XPath11FunctionRecENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_5XPath11FunctionRecEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14Pair
+__ZN7WebCore5XPathL15createFunConcatEv
+__ZN7WebCore5XPath8Function12setArgumentsERKN3WTF6VectorIPNS0_10ExpressionELm0EEE
+__ZN7WebCore5XPath6Parser22deleteExpressionVectorEPN3WTF6VectorIPNS0_10ExpressionELm0EEE
+__ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE6shrinkEm
+__ZN7WebCore5XPathL17createFunContainsEv
+__ZN7WebCore5XPath9PredicateC1EPNS0_10ExpressionE
+__ZN7WebCore5XPath9PredicateC2EPNS0_10ExpressionE
+__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE15reserveCapacityEm
+__ZN7WebCore5XPath6Parser23registerPredicateVectorEPN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZN3WTF7HashSetIPNS_6VectorIPN7WebCore5XPath9PredicateELm0EEENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEE3addERKS7_
+__ZN7WebCore5XPath6Parser21deletePredicateVectorEPN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE6shrinkEm
+__ZN7WebCore5XPath12LocationPath16optimizeStepPairEj
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E5clearEv
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E15de
+__ZN7WebCore15XPathExpression8evaluateEPNS_4NodeEtPNS_11XPathResultERi
+__ZN7WebCore5XPath10Expression17evaluationContextEv
+__ZNK7WebCore5XPath12LocationPath8evaluateEv
+__ZNK7WebCore5XPath12LocationPath8evaluateERNS0_7NodeSetE
+__ZNK7WebCore5XPath4Step8evaluateEPNS_4NodeERNS0_7NodeSetE
+__ZNK7WebCore5XPath4Step11nodesInAxisEPNS_4NodeERNS0_7NodeSetE
+__ZNK7WebCore5XPath4Step11nodeMatchesEPNS_4NodeE
+__ZNK7WebCore4Node15isAttributeNodeEv
+__ZNK7WebCore5XPath9Predicate8evaluateEv
+__ZNK7WebCore5XPath11FunContains8evaluateEv
+__ZNK7WebCore5XPath9FunConcat8evaluateEv
+__ZNK7WebCore5XPath16StringExpression8evaluateEv
+__ZNK7WebCore5XPath5Value8toStringEv
+__ZN3WTF6VectorItLm1024EE6appendItEEvPKT_m
+__ZN7WebCore7Element18getAttributeNodeNSERKNS_6StringES3_
+__ZNK7WebCore12NamedNodeMap12getNamedItemERKNS_13QualifiedNameE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashT
+__ZNK7WebCore5XPath5Value9toBooleanEv
+__ZNK7WebCore4Attr19virtualNamespaceURIEv
+__ZNK7WebCore4Attr12namespaceURIEv
+__ZNK7WebCore5XPath7NodeSet9firstNodeEv
+__ZNK7WebCore5XPath7NodeSet4sortEv
+__ZN7WebCore5XPath11stringValueEPNS_4NodeE
+__ZN7WebCore11XPathResultC1EPNS_4NodeERKNS_5XPath5ValueE
+__ZN7WebCore11XPathResultC2EPNS_4NodeERKNS_5XPath5ValueE
+__ZNK7WebCore5XPath5Value9toNodeSetEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEaSERKS5_
+__ZN7WebCore11XPathResult9convertToEtRi
+__ZN3WTF6VectorIPN7WebCore4NodeELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore4NodeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore4NodeELm0EE15reserveCapacityEm
+__ZN7WebCore5XPathL9sortBlockEjjRN3WTF6VectorINS2_IPNS_4NodeELm0EEELm0EEEb
+__ZNK3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS3_NS_22
+__ZN3WTF6VectorINS0_IPN7WebCore4NodeELm0EEELm0EE6shrinkEm
+__ZN3WTF6VectorIPN7WebCore4NodeELm0EE6shrinkEm
+__ZN7WebCore15XPathExpressionD1Ev
+__ZN7WebCore15XPathExpressionD2Ev
+__ZN7WebCore5XPath12LocationPathD0Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore5XPath4StepELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore5XPath4StepD0Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore5XPath9PredicateELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore5XPath9PredicateD1Ev
+__ZN7WebCore5XPath9PredicateD2Ev
+__ZN7WebCore5XPath11FunContainsD0Ev
+__ZN7WebCore5XPath10ExpressionD2Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore5XPath10ExpressionELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore5XPath9FunConcatD0Ev
+__ZN7WebCore5XPath16StringExpressionD0Ev
+__ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE6shrinkEm
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11XPathResultE
+__ZN7WebCore13JSXPathResultC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11XPathResultEEE
+__ZN7WebCore13JSXPathResultC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11XPathResultEEE
+__ZN7WebCore13JSXPathResult18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsXPathResultSnapshotLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult14snapshotLengthERi
+__ZNK7WebCore11XPathResult10resultTypeEv
+__ZN7WebCore22JSXPathResultPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsXPathResultPrototypeFunctionSnapshotItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore13JSXPathResult9classInfoEv
+__ZN7WebCore11XPathResult12snapshotItemEmRi
+__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionOverrideMimeTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest16overrideMimeTypeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest16overrideMimeTypeERKNS_6StringE
+__ZN7WebCore5XPathL18createFunLocalNameEv
+__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEiNS0_8EqTestOp6OpcodeEi
+__ZN7WebCore5XPath8EqTestOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath8EqTestOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9LogicalOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9LogicalOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZNK7WebCore5XPath9LogicalOp8evaluateEv
+__ZNK7WebCore5XPath8EqTestOp8evaluateEv
+__ZNK7WebCore5XPath12FunLocalName8evaluateEv
+__ZNK7WebCore5XPath8EqTestOp7compareERKNS0_5ValueES4_
+__ZNK7WebCore5XPath9LogicalOp14shortCircuitOnEv
+__ZN7WebCore5XPath9LogicalOpD0Ev
+__ZN7WebCore5XPath8EqTestOpD0Ev
+__ZN7WebCore5XPath12FunLocalNameD0Ev
+__ZN7WebCoreL26createHTMLLIElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore15JSHTMLLIElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSHTMLLIElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLLIElementEEE
+__ZN7WebCore15JSHTMLLIElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLLIElementEEE
+__ZN7WebCore15JSHTMLLIElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCore14jsNodeNodeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCoreL29createHTMLUListElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLUListElement15createPrototypeEPN3JSC9ExecStateE
+__ZN7WebCore18JSHTMLUListElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore18JSHTMLUListElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLUListElementEEE
+__ZN7WebCore18JSHTMLUListElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLUListElementEEE
 __ZN7WebCore18JSHTMLUListElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCoreL28createHTMLHtmlElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLHtmlElement15createPrototypeEPN3JSC9ExecStateE
+__ZN7WebCore17JSHTMLHtmlElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore17JSHTMLHtmlElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHtmlElementEEE
+__ZN7WebCore17JSHTMLHtmlElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHtmlElementEEE
 __ZN7WebCore17JSHTMLHtmlElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLUListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLUListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore14jsElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13StyledElement5styleEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19CSSStyleDeclarationE
+__ZN7WebCore21JSCSSStyleDeclaration15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSCSSStyleDeclarationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19CSSStyleDeclarationEEE
+__ZN7WebCore21JSCSSStyleDeclarationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19CSSStyleDeclarationEEE
+__ZN7WebCore21JSCSSStyleDeclaration3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCoreL17isCSSPropertyNameERKN3JSC10IdentifierE
+__ZN7WebCoreL15cssPropertyNameERKN3JSC10IdentifierEPb
+__ZN7WebCoreL24hasCSSPropertyNamePrefixERKN3JSC10IdentifierEPKc
+__ZN7WebCore19CSSStyleDeclaration14isPropertyNameERKNS_6StringE
+__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_Ri
+__ZN7WebCore10StringImpl4findEPKcib
+__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_S3_Ri
+__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbRi
+__ZN7WebCore34jsNodePrototypeFunctionRemoveChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode11removeChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12RenderInline7destroyEv
+__ZN7WebCore12RenderInlineD0Ev
+__ZN7WebCore8RenderBRD0Ev
+__ZN7WebCore14RenderListItem7destroyEv
+__ZN7WebCore16RenderListMarkerD0Ev
+__ZN7WebCore14RenderListItemD0Ev
+__ZN7WebCore11RenderBlock20removeFloatingObjectEPNS_9RenderBoxE
+__ZN7WebCore11RenderBlock22removePositionedObjectEPNS_9RenderBoxE
+__ZN7WebCore4Node21dispatchMutationEventERKNS_12AtomicStringEbN3WTF10PassRefPtrIS0_EERKNS_6StringES9_Ri
+__ZN7WebCore13MutationEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringESA_SA_t
+__ZN7WebCore13MutationEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringESA_SA_t
+__ZN7WebCore25InvalidatingEventListener11handleEventEPNS_5EventEb
+__ZN7WebCore11XPathResult23invalidateIteratorStateEv
+__ZN7WebCore13MutationEventD0Ev
+__ZN7WebCore8Document17removeElementByIdERKNS_12AtomicStringEPNS_7ElementE
+__ZN7WebCore16HTMLImageElement19removedFromDocumentEv
+__ZN7WebCore12HTMLDocument15removeNamedItemERKNS_12AtomicStringE
+__ZN7WebCoreL17removeItemFromMapERN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiEEEERKNS_
+__ZN7WebCore12HTMLDocument20removeExtraNamedItemERKNS_12AtomicStringE
+__ZN7WebCore23jsHTMLAnchorElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4hrefEv
+__ZN7WebCore15jsHTMLElementIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13StyledElement20updateStyleAttributeEv
+__ZN7WebCore38jsDocumentPrototypeFunctionCreateEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document11createEventERKNS_6StringERi
+__ZN7WebCore5EventC1Ev
+__ZN7WebCore5EventC2Ev
+__ZN7WebCore7JSEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL15getJSEventTableEPN3JSC9ExecStateE
+__ZN7WebCore16JSEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL24getJSEventPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore33jsEventPrototypeFunctionInitEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7JSEvent9classInfoEv
+__ZN7WebCore5Event9initEventERKNS_12AtomicStringEbb
+__ZN7WebCore7JSEvent3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore36jsNodePrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7toEventEN3JSC7JSValueE
 __ZNK7WebCore13ChildNodeList4itemEj
-__ZN7WebCore32jsNodePrototypeFunctionCloneNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore15JSHTMLLIElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32jsNodePrototypeFunctionCloneNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore18JSHTMLUListElement9classInfoEv
+__ZN7WebCore7Element9cloneNodeEb
+__ZN7WebCore7Element27cloneElementWithoutChildrenEv
+__ZN7WebCore8Document13createElementERKNS_13QualifiedNameEb
+__ZN7WebCore13StyledElement26copyNonAttributePropertiesEPKNS_7ElementE
 __ZN7WebCoreL29createHTMLOListElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLOListElement15createPrototypeEPN3JSC9ExecStateE
+__ZN7WebCore18JSHTMLOListElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore18JSHTMLOListElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLOListElementEEE
-__ZN7WebCore20JSHTMLHeadingElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLOListElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLOListElementEEE
+__ZN7WebCore4Node15removedFromTreeEb
+__ZNK7WebCore15ActiveDOMObject18hasPendingActivityEv
+__ZN7WebCore16JSXMLHttpRequest4markEv
+__ZN7WebCore27JSXMLHttpRequestConstructor4markEv
+__ZN7WebCore16JSHTMLCollectionD1Ev
+__ZN7WebCore16JSHTMLCollectionD2Ev
+__ZN7WebCore18JSHTMLInputElementD1Ev
+__ZN7WebCore19JSHTMLAnchorElementD1Ev
+__ZN7WebCore13ClassNodeListD0Ev
+__ZN7WebCore13ChildNodeListD0Ev
+__ZN7WebCore6JSTextD1Ev
+__ZN7WebCore18JSHTMLLabelElementD1Ev
+__ZN7WebCore13JSXPathResultD1Ev
+__ZN7WebCore13JSXPathResultD2Ev
+__ZN7WebCore11XPathResultD1Ev
+__ZN7WebCore11XPathResultD2Ev
+__ZN7WebCore25InvalidatingEventListenerD0Ev
+__ZN7WebCore17JSHTMLHtmlElementD1Ev
+__ZN7WebCore21JSCSSStyleDeclarationD1Ev
+__ZN7WebCore21JSCSSStyleDeclarationD2Ev
+__ZN7WebCore18JSHTMLUListElementD1Ev
+__ZThn8_N7WebCore16HTMLUListElementD0Ev
+__ZN7WebCore16HTMLUListElementD0Ev
+__ZN7WebCoreL31createHTMLHeadingElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore20JSHTMLHeadingElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSHTMLHeadingElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLHeadingElementEEE
+__ZN7WebCore20JSHTMLHeadingElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLHeadingElementEEE
+__ZN7WebCore20JSHTMLHeadingElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
 __ZN7WebCore18JSHTMLOListElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore18JSHTMLOListElement9classInfoEv
 __ZNK7WebCore5XPath4Step15primaryNodeTypeENS1_4AxisE
-__ZN7WebCore19HTMLTextAreaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore26RenderTextControlMultiLineC1EPNS_4NodeE
-__ZN7WebCore26RenderTextControlMultiLine17updateFromElementEv
-__ZNK7WebCore26RenderTextControlMultiLine20createInnerTextStyleEPKNS_11RenderStyleE
-__ZNK7WebCore26RenderTextControlMultiLine10isTextAreaEv
-__ZThn8_N7WebCore24DocumentThreadableLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZN7WebCore13JSHTMLElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11HTMLElementEEE
+__ZN7WebCore22jsHTMLElementInnerHTMLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement9innerHTMLEv
+__ZN7WebCore12createMarkupEPKNS_4NodeENS_13EChildrenOnlyEPN3WTF6VectorIPS0_Lm0EEE
+__ZN7WebCore17MarkupAccumulator12appendMarkupEPNS_4NodeENS_13EChildrenOnlyEPKN3WTF7HashMapIPNS_16AtomicStringImplES7_NS4_7PtrHa
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_S3_ENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTrait
+__ZN7WebCoreL17appendStartMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPNS0_7HashMapIPNS_16
+__ZN7WebCoreL20appendEscapedContentERN3WTF6VectorItLm0EEESt4pairIPKtmEb
+__ZN7WebCoreL15appendEndMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeE
+__ZNK7WebCore13JSHTMLElement9classInfoEv
+__ZN7WebCore20jsElementOffsetWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11RenderBlock21adjustPositionedBlockEPNS_9RenderBoxERKNS0_10MarginInfoE
+__ZN7WebCoreL25inlineFlowRequiresLineBoxEPNS_12RenderInlineE
+__ZNK7WebCore9InlineBox4rootEv
+__ZN7WebCore14RenderListItem6layoutEv
+__ZN7WebCore14RenderListItem20updateMarkerLocationEv
+__ZN7WebCore14RenderListItem18positionListMarkerEv
+__ZN7WebCore11RenderBlock19adjustFloatingBlockERKNS0_10MarginInfoE
+__ZN7WebCore14RenderListItem14calcPrefWidthsEv
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE15reserveCapacityEm
+__ZN7WebCoreL8bidiNextEPNS_11RenderBlockEPNS_12RenderObjectEPNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEbPb
+__ZN7WebCoreL23getParentOfFirstLineBoxEPNS_11RenderBlockEPNS_12RenderObjectE
+__ZN7WebCore11RenderBlock32generatesLineBoxesForInlineChildEPNS_12RenderObjectE
+__ZN7WebCore16RenderListMarker14calcPrefWidthsEv
+__ZNK7WebCore16RenderListMarker7isImageEv
+__ZNK7WebCore14RenderListItem14updateValueNowEv
+__ZN7WebCoreL13enclosingListEPNS_4NodeE
+__ZNK7WebCore4Node20traversePreviousNodeEPKS0_
+__ZN7WebCore14listMarkerTextENS_14EListStyleTypeEi
+__ZN7WebCore16RenderListMarker13updateMarginsEv
+__ZNK7WebCore16RenderListMarker8isInsideEv
+__ZN7WebCore16RenderListMarker6layoutEv
+__ZNK7WebCore16RenderListMarker12isListMarkerEv
+__ZN7WebCoreL36shouldSkipWhitespaceAfterStartObjectEPNS_11RenderBlockEPNS_12RenderObjectE
+__ZN7WebCore16RenderListMarker15createInlineBoxEv
+__ZNK7WebCore9RenderBox13intrinsicSizeEv
+__ZNK7WebCore16RenderListMarker10lineHeightEbb
+__ZNK7WebCore16RenderListMarker16baselinePositionEbb
+__ZN7WebCore9InlineBox14adjustPositionEii
+__ZN7WebCore16RenderPartObject6layoutEv
+__ZN7WebCore9RenderBox30calcAbsoluteHorizontalReplacedEv
+__ZN7WebCore9RenderBox28calcAbsoluteVerticalReplacedEv
+__ZN7WebCore12RenderWidget6layoutEv
+__ZN7WebCore11RenderBlock14fitBelowFloatsEibRi
+__ZNK7WebCore11RenderBlock20nextFloatBottomBelowEi
+__ZN7WebCore12RenderWidget20updateWidgetPositionEv
+__ZN7WebCore10ScrollView12setFrameRectERKNS_7IntRectE
+__ZN7WebCore6Widget12setFrameRectERKNS_7IntRectE
+__ZN7WebCore12RenderWidget5derefEPNS_11RenderArenaE
+__ZNK7WebCore12RenderInline11offsetWidthEv
+__ZN7WebCore9InlineBox6removeEv
+__ZN7WebCore13InlineFlowBox11removeChildEPNS_9InlineBoxE
+__ZN7WebCore13RootInlineBox12childRemovedEPNS_9InlineBoxE
+__ZN7WebCore10RenderText29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore21jsCharacterDataLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13RootInlineBox19lineBreakBidiStatusEv
+__ZN7WebCore13InlineFlowBox11extractLineEv
+__ZN7WebCore13RootInlineBox30extractLineBoxFromRenderObjectEv
+__ZN7WebCore17RenderLineBoxList14extractLineBoxEPNS_13InlineFlowBoxE
+__ZN7WebCore13InlineFlowBox30extractLineBoxFromRenderObjectEv
+__ZN7WebCore9InlineBox11extractLineEv
+__ZN7WebCore13InlineFlowBox29removeLineBoxFromRenderObjectEv
+__ZN7WebCore13InlineFlowBox13lastLeafChildEv
+__ZN7WebCore9InlineBox13lastLeafChildEv
+__ZN7WebCore11RenderBlock14matchedEndLineERKNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS2_RKNS_10BidiStatusERPNS_13R
+__ZN7WebCoreeqERKNS_11BidiContextES2_
+__ZN7WebCore13InlineFlowBox10attachLineEv
+__ZN7WebCore13RootInlineBox27attachLineBoxToRenderObjectEv
+__ZN7WebCore17RenderLineBoxList13attachLineBoxEPNS_13InlineFlowBoxE
+__ZN7WebCore13InlineFlowBox27attachLineBoxToRenderObjectEv
+__ZN7WebCore9InlineBox10attachLineEv
+__ZN7WebCore13RootInlineBox14adjustPositionEii
+__ZN7WebCore13InlineFlowBox14adjustPositionEii
+__ZN7WebCore17RenderLineBoxList14dirtyLineBoxesEv
+__ZN7WebCore11RenderBlock24repaintOverhangingFloatsEb
+__ZN7WebCore15JSTextPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSCharacterDataPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsCharacterDataPrototypeFunctionDeleteDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CharacterData10deleteDataEjjRi
+__ZN7WebCore13CharacterData22checkCharDataOperationEjRi
+__ZN7WebCore6String6removeEji
+__ZN7WebCore10RenderText17setTextWithOffsetEN3WTF10PassRefPtrINS_10StringImplEEEjjb
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS_6VectorIPNS1_7ElementELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS8_EEE
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS_6VectorIPNS1_7ElementELm0EEEENS_18PairFirstExtractorISA_EENS_7Pt
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE15reserveCapacityEm
+__ZN7WebCore26JSHTMLFormElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSHTMLFormElement9classInfoEv
+__ZN7WebCore17JSHTMLFormElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore12RenderWidget5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderListItem5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineFlowBox15paintFillLayersERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOper
+__ZN7WebCore13InlineFlowBox14paintFillLayerERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOpera
+__ZN7WebCoreL9nullImageEv
+__ZN7WebCore14RenderThemeMac16paintSearchFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac6searchEv
+__ZN7WebCore14RenderThemeMac18setSearchCellStateEPNS_12RenderObjectERKNS_7IntRectE
+__ZNK7WebCore17RenderTextControl15controlClipRectEii
+__ZN7WebCore14RenderThemeMac33paintSearchFieldResultsDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac21convertToPaintingRectEPKNS_12RenderObjectES3_RKNS_9FloatRectERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac26paintSearchFieldDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore8DOMTimer5firedEv
+__ZN7WebCore15ScheduledAction7executeEPNS_22ScriptExecutionContextE
+__ZN7WebCore15ScheduledAction7executeEPNS_8DocumentE
+__ZN7WebCore15ScheduledAction24executeFunctionInContextEPN3JSC14JSGlobalObjectENS1_7JSValueE
+__ZN7WebCore20jsDocumentReadyStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document10readyStateEv
+__ZNK7WebCore11FrameLoader10isCompleteEv
+__ZN7WebCore19jsStringOrUndefinedEPN3JSC9ExecStateERKNS_6StringE
+__ZN7WebCore11FrameLoader13executeScriptERKNS_6StringEb
+__ZThn16_N7WebCore24DocumentThreadableLoader29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZN7WebCore24DocumentThreadableLoader29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZN7WebCore12RenderInline12imageChangedEPvPKNS_7IntRectE
+__ZThn16_N7WebCore24DocumentThreadableLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
 __ZN7WebCore24DocumentThreadableLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
-__ZThn8_N7WebCore14XMLHttpRequest18didReceiveResponseERKNS_16ResourceResponseE
+__ZThn16_N7WebCore14XMLHttpRequest18didReceiveResponseERKNS_16ResourceResponseE
 __ZN7WebCore14XMLHttpRequest18didReceiveResponseERKNS_16ResourceResponseE
 __ZN7WebCore27extractCharsetFromMediaTypeERKNS_6StringE
-__ZThn8_N7WebCore24DocumentThreadableLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZThn16_N7WebCore24DocumentThreadableLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
 __ZN7WebCore24DocumentThreadableLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
-__ZThn8_N7WebCore14XMLHttpRequest14didReceiveDataEPKci
+__ZThn16_N7WebCore14XMLHttpRequest14didReceiveDataEPKci
 __ZN7WebCore14XMLHttpRequest14didReceiveDataEPKci
 __ZN7WebCore14XMLHttpRequest14refEventTargetEv
-__ZNK7WebCore26JSUnprotectedEventListener11listenerObjEv
-__ZNK7WebCore26JSUnprotectedEventListener12globalObjectEv
 __ZN7WebCore11EventTarget6toNodeEv
+__ZN7WebCore11EventTarget11toDOMWindowEv
 __ZN7WebCore14XMLHttpRequest16toXMLHttpRequestEv
-__ZN7WebCore17DOMImplementation13isXMLMIMETypeERKNS_6StringE
 __ZN7WebCore14XMLHttpRequest27updateAndDispatchOnProgressEj
 __ZN7WebCore14XMLHttpRequest21dispatchProgressEventEx
 __ZN7WebCore22jsXMLHttpRequestStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore14XMLHttpRequest6statusERi
 __ZN7WebCore26jsXMLHttpRequestStatusTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore14XMLHttpRequest10statusTextERi
+__ZNK7WebCore20ResourceResponseBase14httpStatusTextEv
 __ZN7WebCore28jsXMLHttpRequestResponseTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore16JSXMLHttpRequest12responseTextEPN3JSC9ExecStateE
 __ZNK7WebCore14XMLHttpRequest12responseTextEv
 __ZN7WebCore19jsOwnedStringOrNullEPN3JSC9ExecStateERKNS0_7UStringE
-__ZN7WebCore50jsXMLHttpRequestPrototypeFunctionGetResponseHeaderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore50jsXMLHttpRequestPrototypeFunctionGetResponseHeaderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore16JSXMLHttpRequest17getResponseHeaderEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZNK7WebCore14XMLHttpRequest17getResponseHeaderERKNS_12AtomicStringERi
 __ZN7WebCoreL17isSetCookieHeaderERKNS_12AtomicStringE
-__ZThn8_N7WebCore24DocumentThreadableLoader16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZThn16_N7WebCore24DocumentThreadableLoader16didFinishLoadingEPNS_17SubresourceLoaderE
 __ZN7WebCore24DocumentThreadableLoader16didFinishLoadingEPNS_17SubresourceLoaderE
-__ZThn8_N7WebCore14XMLHttpRequest16didFinishLoadingEm
+__ZThn16_N7WebCore14XMLHttpRequest16didFinishLoadingEm
 __ZN7WebCore14XMLHttpRequest16didFinishLoadingEm
-__ZThn44_N7WebCore8Document33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZThn88_N7WebCore8Document33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
 __ZN7WebCore8Document33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
-__ZN7WebCore19InspectorController33resourceRetrievedByXMLHttpRequestEmRKN3JSC7UStringE
-__ZThn44_N7WebCore8Document10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
+__ZN7WebCore19InspectorController33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZN7WebCore11FrameLoader31didLoadResourceByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZThn88_N7WebCore8Document10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
 __ZN7WebCore8Document10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
 __ZN7WebCore19InspectorController19addMessageToConsoleENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_
 __ZN7WebCore24DocumentThreadableLoader21derefThreadableLoaderEv
-__ZN7WebCore24DocumentThreadableLoaderD1Ev
+__ZN7WebCore24DocumentThreadableLoaderD0Ev
 __ZN7WebCore27jsXMLHttpRequestResponseXMLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore14XMLHttpRequest11responseXMLEv
 __ZNK7WebCore14XMLHttpRequest13responseIsXMLEv
 __ZNK7WebCore14XMLHttpRequest16responseMIMETypeEv
-__ZN7WebCore28extractMIMETypeFromMediaTypeERKNS_6StringE
-__ZN7WebCore26JSUnprotectedEventListenerD1Ev
-__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore26JSUnprotectedEventListenerEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SC_EEEENS_17HashTableIteratorIS3_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore14XMLHttpRequest17dispatchLoadEventEv
-__ZN7WebCore14XMLHttpRequest14dropProtectionEv
-__ZN7WebCore22jsHTMLInputElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12AtomicStringcvN3JSC7UStringEEv
-__ZN7WebCore25jsHTMLLabelElementHtmlForEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLLabelElement7htmlForEv
-__ZN7WebCore22jsHTMLInputElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLTextAreaElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLTextAreaElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9RenderBox10setStaticYEi
-__ZNK7WebCore9RenderBox7staticYEv
-__ZNK7WebCore14RenderListItem14updateValueNowEv
-__ZN7WebCoreL13enclosingListEPNS_4NodeE
-__ZN7WebCore26RenderTextControlMultiLine6layoutEv
-__ZN7WebCore26RenderTextControlMultiLine36adjustControlHeightBasedOnLineHeightEi
-__ZNK7WebCore17RenderTextControl14hasControlClipEv
-__ZNK7WebCore26RenderTextControlMultiLine16baselinePositionEbb
-__ZNK7WebCore15ActiveDOMObject18hasPendingActivityEv
-__ZN7WebCore27JSXMLHttpRequestConstructor4markEv
-__ZN7WebCore18JSHTMLLabelElementD0Ev
-__ZN7WebCore17JSHTMLHtmlElementD0Ev
-__ZN7WebCore16JSXMLHttpRequestD0Ev
-__ZN7WebCore18JSHTMLOListElementD0Ev
-__ZN7WebCore18JSHTMLUListElementD0Ev
-__ZN7WebCore14XMLHttpRequest16derefEventTargetEv
-__ZN3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEEENS_18PairFirstExtractorIS9_EENS1_16AtomicStringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSE_IS8_EEEESF_E6expandEv
-__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionOverrideMimeTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16JSXMLHttpRequest16overrideMimeTypeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore14XMLHttpRequest16overrideMimeTypeERKNS_6StringE
-__ZNK7WebCore22ScriptExecutionContext15isWorkerContextEv
-__ZNK7WebCore14XMLHttpRequest8documentEv
-__ZNK7WebCore8Document14implementationEv
-__ZN7WebCore17DOMImplementation14createDocumentEPNS_5FrameE
-__ZN7WebCore14SecurityOrigin11createEmptyEv
-__ZN7WebCore8Document4openEPS0_
-__ZN7WebCore8Document15createTokenizerEv
-__ZN7WebCore12XMLTokenizerC1EPNS_8DocumentEPNS_9FrameViewE
-__ZN7WebCore12XMLTokenizer5writeERKNS_15SegmentedStringEb
-__ZNK7WebCore15SegmentedString8toStringEv
-__ZN7WebCore12XMLTokenizer7doWriteERKNS_6StringE
-__ZN7WebCore12XMLTokenizer23initializeParserContextEPKc
-__ZN7WebCoreL18createStringParserEP14_xmlSAXHandlerPv
-__ZN7WebCoreL20startDocumentHandlerEPv
-__ZN7WebCore12XMLTokenizer13startDocumentEPKhS2_i
-__ZN7WebCore8Document13setXMLVersionERKNS_6StringERi
-__ZN7WebCore17DOMImplementation10hasFeatureERKNS_6StringES3_
-__ZN7WebCore8Document16setXMLStandaloneEbRi
-__ZN7WebCoreL21internalSubsetHandlerEPvPKhS2_S2_
-__ZN7WebCore12XMLTokenizer14internalSubsetEPKhS2_S2_
-__ZNK7WebCore8Document14isHTMLDocumentEv
-__ZN7WebCore8Document18determineParseModeEv
-__ZN7WebCoreL21externalSubsetHandlerEPvPKhS2_S2_
-__ZN7WebCoreL21startElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
-__ZN7WebCore12XMLTokenizer14startElementNsEPKhS2_S2_iPS2_iiS3_
-__ZN7WebCore12XMLTokenizer8exitTextEv
-__ZN7WebCore8Document13createElementERKNS_13QualifiedNameEbRi
-__ZN7WebCore7Element14setAttributeNSERKNS_12AtomicStringES3_S3_Ri
-__ZN7WebCore8Document18parseQualifiedNameERKNS_6StringERS1_S4_Ri
-__ZN7WebCoreL23handleElementAttributesEPNS_7ElementEPPKhiRi
-__ZN7WebCore15toScriptElementEPNS_7ElementE
-__ZN7WebCore12XMLTokenizer14setCurrentNodeEPNS_4NodeE
-__ZN7WebCoreL17charactersHandlerEPvPKhi
-__ZN7WebCore12XMLTokenizer10charactersEPKhi
-__ZN7WebCore12XMLTokenizer9enterTextEv
-__ZN3WTF6VectorIhLm0EE6appendIhEEvPKT_m
-__ZN3WTF6VectorIhLm0EE14expandCapacityEmPKh
-__ZN3WTF6VectorIhLm0EE14expandCapacityEm
-__ZN3WTF6VectorIhLm0EE15reserveCapacityEm
-__ZN7WebCore13CharacterData10appendDataERKNS_6StringERi
-__ZN3WTF6VectorIhLm0EE6shrinkEm
-__ZN7WebCoreL15headConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCoreL19endElementNsHandlerEPvPKhS2_S2_
-__ZN7WebCore12XMLTokenizer12endElementNsEv
-__ZN7WebCoreL16getEntityHandlerEPvPKh
-__ZN7WebCore12XMLTokenizer6finishEv
-__ZN7WebCore12XMLTokenizer3endEv
-__ZN7WebCore12XMLTokenizer5doEndEv
-__ZN7WebCoreL18endDocumentHandlerEPv
-__ZN7WebCore12XMLTokenizer11endDocumentEv
-__ZNK7WebCore12XMLTokenizer10wellFormedEv
-__ZN3WTF15deleteAllValuesIPN7WebCore16PendingCallbacks15PendingCallbackEEEvRKNS_5DequeIT_EE
-__ZN7WebCore10JSDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25jsDocumentDocumentElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore49jsDocumentPrototypeFunctionCreateDocumentFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore18JSDocumentFragment15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSDocumentFragmentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DocumentFragmentEEE
-__ZNK7WebCore17JSHTMLHtmlElement9classInfoEv
-__ZN7WebCore19JSHTMLScriptElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore38jsElementPrototypeFunctionHasAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore7Element12hasAttributeERKNS_6StringE
-__ZN7WebCore21jsNodeListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10JSNodeList14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore21JSNodeListConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore19JSNodeListPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCoreL28createHTMLLinkElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLLinkElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSHTMLLinkElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLLinkElementEEE
-__ZN7WebCore17JSHTMLLinkElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSHTMLLinkElement9classInfoEv
-__ZN7WebCore21jsHTMLLinkElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLLinkElement4typeEv
-__ZN7WebCore32jsNodePrototypeFunctionNormalizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore4Node9normalizeEv
-__ZNK7WebCore4Node25traverseNextNodePostOrderEv
-__ZN7WebCore7Element19normalizeAttributesEv
-__ZN7WebCore17jsNodeNextSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14jsNodeNodeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7Element8nodeNameEv
-__ZN7WebCore16jsNodeAttributesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12NamedNodeMapE
-__ZN7WebCore14JSNamedNodeMap15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore14JSNamedNodeMapC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NamedNodeMapEEE
-__ZN7WebCore14JSNamedNodeMap18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSNamedNodeMapPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20jsNamedNodeMapLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSNamedNodeMap18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZN7WebCore14JSNamedNodeMap11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore12NamedAttrMap4itemEj
-__ZN7WebCore6JSAttr15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore6JSAttrC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4AttrEEE
-__ZN7WebCore6JSAttr18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore4Attr8nodeNameEv
-__ZN7WebCore15jsNodeTEXT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20JSHTMLHeadingElement9classInfoEv
-__ZNK7WebCore13JSHTMLElement9classInfoEv
-__ZN7WebCore15JSHTMLBRElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore41jsElementPrototypeFunctionRemoveAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Element15removeAttributeERKNS_6StringERi
-__ZN7WebCore12NamedAttrMap15removeNamedItemERKNS_6StringERi
-__ZN7WebCore12NamedAttrMap15removeNamedItemERKNS_13QualifiedNameERi
-__ZN7WebCore12NamedAttrMap15removeAttributeERKNS_13QualifiedNameE
-__ZN7WebCore7Element24dispatchAttrRemovalEventEPNS_9AttributeE
-__ZN7WebCore18JSDocumentFragment18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore40jsDOMWindowPrototypeFunctionClearTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11JSDOMWindow12clearTimeoutEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZNK7WebCore18JSDocumentFragment9classInfoEv
 __ZN7WebCore16jsDocumentDomainEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore8Document6domainEv
 __ZN7WebCore14jsLocationPortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore8Location4portEv
-__ZN7WebCore11RenderLayer27repaintIncludingDescendantsEv
-__ZN7WebCore11RenderLayer23beginTransparencyLayersEPNS_15GraphicsContextEPKS0_
-__ZN7WebCore11RenderLayer19transparentAncestorEv
-__ZN7WebCoreL19transparencyClipBoxERKNS_20TransformationMatrixEPKNS_11RenderLayerES5_
-__ZNK7WebCore20TransformationMatrix7mapRectERKNS_7IntRectE
-__ZN7WebCore16enclosingIntRectERK6CGRect
-__ZN7WebCore15GraphicsContext22beginTransparencyLayerEf
-__ZN7WebCore15GraphicsContext20endTransparencyLayerEv
-__ZN7WebCore11RenderLayer19removeOnlyThisLayerEv
-__ZNK7WebCore9RenderBox12overflowRectEb
-__ZN7WebCore21DeprecatedPtrListImpl9removeRefEPKvb
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore9RenderBoxEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E4findIS4_NS_21ListHashSetTranslatorIS4_SB_EEEENS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EERKT_
-__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore16JSXMLHttpRequest4markEv
-__ZN7WebCore26JSUnprotectedEventListener4markEv
-__ZN7WebCore17JSHTMLLinkElementD0Ev
-__ZN7WebCore18JSDocumentFragmentD0Ev
-__ZNK7WebCore11RenderLayer15reflectionLayerEv
-__ZN7WebCore12RenderObject10moveLayersEPNS_11RenderLayerES2_
+__ZN7WebCore14XMLHttpRequest17dispatchLoadEventEv
+__ZN7WebCore14XMLHttpRequest14dropProtectionEv
+__ZNK7WebCore14XMLHttpRequest8documentEv
+__ZNK7WebCore8Document14implementationEv
+__ZN7WebCore17DOMImplementation14createDocumentEPNS_5FrameE
+__ZN7WebCore8DocumentC1EPNS_5FrameEb
+__ZN7WebCore14SecurityOrigin11createEmptyEv
+__ZN7WebCore8Document4openEPS0_
+__ZN7WebCore8Document15createTokenizerEv
+__ZN7WebCore12XMLTokenizerC1EPNS_8DocumentEPNS_9FrameViewE
+__ZN7WebCore12XMLTokenizerC2EPNS_8DocumentEPNS_9FrameViewE
+__ZN7WebCore8Document5writeERKNS_6StringEPS0_
+__ZN7WebCore8Document5writeERKNS_15SegmentedStringEPS0_
+__ZN7WebCore12XMLTokenizer5writeERKNS_15SegmentedStringEb
+__ZNK7WebCore15SegmentedString8toStringEv
+__ZN7WebCore12XMLTokenizer7doWriteERKNS_6StringE
+__ZN7WebCore12XMLTokenizer23initializeParserContextEPKc
+__ZN7WebCore17XMLTokenizerScopeC1EPNS_9DocLoaderE
+__ZN7WebCore17XMLTokenizerScopeC2EPNS_9DocLoaderE
+__ZN7WebCoreL18createStringParserEP14_xmlSAXHandlerPv
+__ZN7WebCore17XMLTokenizerScopeD1Ev
+__ZN7WebCore17XMLTokenizerScopeD2Ev
+__ZN7WebCoreL20startDocumentHandlerEPv
+__ZN7WebCore12XMLTokenizer13startDocumentEPKhS2_i
+__ZNK7WebCore12TextEncoding6decodeEPKcmbRb
+__ZN7WebCore8Document13setXMLVersionERKNS_6StringERi
+__ZN7WebCore17DOMImplementation10hasFeatureERKNS_6StringES3_
+__ZN7WebCore8Document16setXMLStandaloneEbRi
+__ZN7WebCoreL18normalErrorHandlerEPvPKcz
+__ZN7WebCore12XMLTokenizer5errorENS0_9ErrorTypeEPKcP13__va_list_tag
+__ZNK7WebCore12XMLTokenizer12columnNumberEv
+__ZNK7WebCore12XMLTokenizer10lineNumberEv
+__ZN7WebCore12XMLTokenizer11handleErrorENS0_9ErrorTypeEPKcii
+__ZN7WebCoreL18endDocumentHandlerEPv
+__ZN7WebCore12XMLTokenizer11endDocumentEv
+__ZN7WebCore12XMLTokenizer8exitTextEv
+__ZN7WebCore12XMLTokenizer6finishEv
+__ZN7WebCore12XMLTokenizer3endEv
+__ZN7WebCore12XMLTokenizer5doEndEv
+__ZN7WebCore12XMLTokenizer23insertErrorMessageBlockEv
+__ZN7WebCore8Document16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore13ContainerNode12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
+__ZN7WebCore12XMLTokenizer14setCurrentNodeEPNS_4NodeE
+__ZNK7WebCore12XMLTokenizer10wellFormedEv
+__ZN7WebCore12XMLTokenizerD0Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore16PendingCallbacks15PendingCallbackEEEvRKNS_5DequeIT_EE
+__ZN7WebCore16jsDOMWindowEventEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow5eventEPN3JSC9ExecStateE
+__ZN7WebCore20jsEventCurrentTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8DocumentD0Ev
+__ZN7WebCore20JSHTMLHeadingElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSHTMLHeadingElement9classInfoEv
+__ZN7WebCoreL33createHTMLParagraphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore22JSHTMLParagraphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSHTMLParagraphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLParagraphElementEEE
+__ZN7WebCore22JSHTMLParagraphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLParagraphElementEEE
+__ZN7WebCore22JSHTMLParagraphElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSHTMLParagraphElement9classInfoEv
+__ZN7WebCore22JSHTMLParagraphElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSNodeList11getCallDataERN3JSC8CallDataE
+__ZNK3JSC8JSObject11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK7WebCore10JSNodeList9classInfoEv
+__ZN7WebCore20JSHTMLHeadingElementD1Ev
+__ZN7WebCore13JSHTMLElementD1Ev
+__ZThn8_N7WebCore11HTMLElementD0Ev
+__ZN7WebCore16JSXMLHttpRequestD1Ev
+__ZN7WebCore16JSXMLHttpRequestD2Ev
+__ZN7WebCore18JSHTMLOListElementD1Ev
+__ZN7WebCore14XMLHttpRequest16derefEventTargetEv
+__ZN7WebCore14XMLHttpRequestD0Ev
+__ZN7WebCore41jsElementPrototypeFunctionRemoveAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element15removeAttributeERKNS_6StringERi
+__ZN7WebCore12NamedNodeMap15removeNamedItemERKNS_6StringERi
+__ZNK7WebCore4Node15isStyledElementEv
+__ZN7WebCoreL28createHTMLMetaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLMetaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLMetaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMetaElementEEE
+__ZN7WebCore17JSHTMLMetaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMetaElementEEE
+__ZN7WebCore17JSHTMLMetaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSHTMLMetaElement9classInfoEv
+__ZN7WebCore6Loader4Host14cancelRequestsEPNS_9DocLoaderE
+__ZN7WebCore6Loader4Host21cancelPendingRequestsERN3WTF5DequeIPNS_7RequestEEEPNS_9DocLoaderE
+__ZN7WebCore11FrameLoader49updateHistoryForRedirectWithLockedBackForwardListEv
+__ZN7WebCore11HistoryItem12setChildItemEN3WTF10PassRefPtrIS0_EE
+__ZNK7WebCore10RenderView8viewRectEv
+__ZNK7WebCore9RenderBox12maxTopMarginEb
+__ZNK7WebCore9RenderBox21isSelfCollapsingBlockEv
+__ZNK7WebCore9RenderBox15maxBottomMarginEb
+__ZN7WebCore5TimerINS_12GCControllerEE5firedEv
+__ZN7WebCore12GCController12gcTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore22JSHTMLParagraphElementD1Ev
+__ZN7WebCore17JSHTMLMetaElementD1Ev
+__ZN7WebCore16HTMLLabelElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore27TextControlInnerTextElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore18JSHTMLInputElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15setJSNodeOnblurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOnblurEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE6shrinkEm
+__ZN7WebCore22HTMLFormControlElement15removedFromTreeEb
+__ZN7WebCore15HTMLFormElement17removeFormElementEPNS_22HTMLFormControlElementE
+__ZN7WebCore26setJSHTMLImageElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement8setWidthEi
+__ZN7WebCore27setJSHTMLImageElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setHeightEi
+__ZN7WebCore27setJSHTMLImageElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setBorderERKNS_6StringE
+__ZN7WebCore24setJSHTMLImageElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement6setAltERKNS_6StringE
+__ZN7WebCore17setJSNodeOnsubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnsubmitEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18setJSNodeOnkeydownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node12setOnkeydownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnkeyupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnkeyupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17jsDOMWindowParentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6parentEv
+__ZNK7WebCore5Frame14isDisconnectedEv
+__ZN7WebCore17jsDOMWindowScreenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6screenEv
+__ZN7WebCore6ScreenC1EPNS_5FrameE
+__ZN7WebCore6ScreenC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_6ScreenE
+__ZN7WebCore8JSScreen15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSScreenC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6ScreenEEE
+__ZN7WebCore8JSScreenC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6ScreenEEE
+__ZN7WebCore8JSScreen18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13jsScreenWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen5widthEv
+__ZN7WebCore14jsScreenHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen6heightEv
+__ZN7WebCore39jsNavigatorPrototypeFunctionJavaEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSNavigator9classInfoEv
+__ZNK7WebCore9Navigator11javaEnabledEv
+__ZN7WebCore18jsScreenPixelDepthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen10pixelDepthEv
+__ZN7WebCore11screenDepthEPNS_6WidgetE
+__ZN7WebCore21jsDOMWindowInnerWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10innerWidthEv
+__ZN7WebCore22jsDOMWindowInnerHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11innerHeightEv
+__ZN7WebCore18jsNavigatorPluginsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator7pluginsEv
+__ZN7WebCore11PluginArrayC1EPNS_5FrameE
+__ZN7WebCore11PluginArrayC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11PluginArrayE
+__ZN7WebCore13JSPluginArray15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSPluginArrayC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11PluginArrayEEE
+__ZN7WebCore13JSPluginArrayC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11PluginArrayEEE
+__ZN7WebCore13JSPluginArray18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsPluginArrayLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11PluginArray6lengthEv
+__ZNK7WebCore11PluginArray13getPluginDataEv
+__ZNK7WebCore4Page10pluginDataEv
+__ZN7WebCore10PluginDataC1EPKNS_4PageE
+__ZN7WebCore10PluginDataC2EPKNS_4PageE
+__ZN7WebCore10PluginData11initPluginsEv
+_stringEncodingForResource
+__ZN7WebCore16MIMETypeRegistry26getSupportedImageMIMETypesEv
+__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE15reserveCapacityEm
+__ZN7WebCore13JSPluginArray18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore13JSPluginArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore11PluginArray4itemEj
+__ZN7WebCore6PluginC1EPNS_10PluginDataEj
+__ZN7WebCore6PluginC2EPNS_10PluginDataEj
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_6PluginE
+__ZN7WebCore8JSPlugin15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSPluginC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6PluginEEE
+__ZN7WebCore8JSPluginC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6PluginEEE
+__ZN7WebCore8JSPlugin18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12jsPluginNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin4nameEv
+__ZN7WebCore19jsNavigatorPlatformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase8platformEv
+__ZN7WebCore19JSLocationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsLocationPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore10JSLocation9classInfoEv
+__ZN7WebCore10JSLocation8toStringEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore21allowsAccessFromFrameEPN3JSC9ExecStateEPNS_5FrameE
+__ZNK7WebCore8Location8toStringEv
+__ZN7WebCore18jsDocumentReferrerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document8referrerEv
+__ZNK7WebCore11FrameLoader8referrerEv
+__ZN7WebCore20jsNavigatorMimeTypesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator9mimeTypesEv
+__ZN7WebCore13MimeTypeArrayC1EPNS_5FrameE
+__ZN7WebCore13MimeTypeArrayC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13MimeTypeArrayE
+__ZN7WebCore15JSMimeTypeArray15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSMimeTypeArrayC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MimeTypeArrayEEE
+__ZN7WebCore15JSMimeTypeArrayC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MimeTypeArrayEEE
+__ZN7WebCore13JSPluginArray18canGetItemsForNameEPN3JSC9ExecStateEPNS_11PluginArrayERKNS1_10IdentifierE
+__ZN7WebCore11PluginArray18canGetItemsForNameERKNS_12AtomicStringE
+__ZN7WebCore22JSPluginArrayPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13JSPluginArray10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore11PluginArray9namedItemERKNS_12AtomicStringE
+__ZN7WebCore19jsPluginDescriptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin11descriptionEv
+__ZN3WTF6VectorIcLm512EE14expandCapacityEm
+__ZN3WTF6VectorIcLm512EE15reserveCapacityEm
+__ZN7WebCore11FrameLoader15parentCompletedEv
+__ZN7WebCore14ResourceLoader48scheduleLoadFallbackResourceFromApplicationCacheEPNS_16ApplicationCacheE
+__ZN7WebCore14DocumentLoader48scheduleLoadFallbackResourceFromApplicationCacheEPNS_14ResourceLoaderERKNS_15ResourceRequestEPNS_
+__ZN7WebCore14DocumentLoader35getApplicationCacheFallbackResourceERKNS_15ResourceRequestERPNS_24ApplicationCacheResourceEPNS_16
+__ZN7WebCore15defaultMIMETypeEv
+__ZN7WebCore15GraphicsContext9setShadowERKNS_7IntSizeEiRKNS_5ColorE
+__ZN7WebCore15GraphicsContext17setPlatformShadowERKNS_7IntSizeEiRKNS_5ColorE
+__ZNK7WebCore7IntSizecv6CGSizeEv
+__ZN7WebCore15GraphicsContext11clearShadowEv
+__ZN7WebCore15GraphicsContext19clearPlatformShadowEv
+__ZN7WebCore15GraphicsContext18addRoundedRectClipERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_
+__ZN7WebCore4Path22createRoundedRectangleERKNS_9FloatRectERKNS_9FloatSizeES6_S6_S6_
+__ZN7WebCore4PathC1Ev
+__ZN7WebCore4PathC2Ev
+__ZN7WebCore4Path6moveToERKNS_10FloatPointE
+__ZN7WebCore4Path9addLineToERKNS_10FloatPointE
+__ZN7WebCore4Path16addBezierCurveToERKNS_10FloatPointES3_S3_
+__ZN7WebCore4Path12closeSubpathEv
+__ZN7WebCore4PathC1ERKS0_
+__ZN7WebCore4PathC2ERKS0_
+__ZN7WebCore4PathD1Ev
+__ZN7WebCore4PathD2Ev
+__ZN7WebCore15GraphicsContext4clipERKNS_4PathE
+__ZN7WebCore5Image11drawPatternEPNS_15GraphicsContextERKNS_9FloatRectERKNS_20TransformationMatrixERKNS_10FloatPointENS_17Compos
+__ZN7WebCore11BitmapImage26nativeImageForCurrentFrameEv
+__ZN7WebCore16RenderListMarker5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore16RenderListMarker21getRelativeMarkerRectEv
+__ZNK7WebCore4Page34inLowQualityImageInterpolationModeEv
+__ZN3WTF7HashMapIPN7WebCore11RenderImageEPNS1_20RenderImageScaleDataENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3
+__ZNK3WTF7HashMapIPN7WebCore11RenderImageEPNS1_20RenderImageScaleDataENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS
+__ZN7WebCore12RenderWidget11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore7Element20isEnabledFormControlEv
+__ZNK7WebCore4KURL11isLocalFileEv
+__ZN7WebCore14SecurityOrigin20grantUniversalAccessEv
+__ZN7WebCore13StyledElement11addCSSColorEPNS_15MappedAttributeEiRKNS_6StringE
+__ZN7WebCore10HTMLParser29pCloserStrictCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL16tableConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLTableElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLTableElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLTableElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLTableElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLTableElement11cellBordersEv
+__ZNK7WebCore16HTMLTableElement17endTagRequirementEv
+__ZNK7WebCore16HTMLTableElement11tagPriorityEv
+__ZN7WebCore16HTMLTableElement6attachEv
+__ZNK7WebCore16HTMLTableElement36canHaveAdditionalAttributeStyleDeclsEv
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14shrinkCapacityEm
+__ZN7WebCore16HTMLTableElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore11RenderTableC1EPNS_4NodeE
+__ZN7WebCore11RenderTableC2EPNS_4NodeE
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4fillERKS3_m
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE15reserveCapacityEm
+__ZSt4fillIPN7WebCore11RenderTable12ColumnStructES2_EvT_S4_RKT0_
+__ZN7WebCore11RenderTable14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore11RenderTable17updateFirstLetterEv
+__ZN7WebCore15AutoTableLayoutC1EPNS_11RenderTableE
+__ZN7WebCore15AutoTableLayoutC2EPNS_11RenderTableE
+__ZN7WebCore16HTMLTableElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore16HTMLTableElement8checkDTDEPKNS_4NodeE
+__ZNK7WebCore11RenderTable7isTableEv
+__ZN7WebCoreL19tablerowConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLTableRowElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLTableRowElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore19HTMLTableRowElement17endTagRequirementEv
+__ZNK7WebCore19HTMLTableRowElement11tagPriorityEv
+__ZN7WebCoreL14isTableSectionEPKNS_4NodeE
+__ZN7WebCore23HTMLTableSectionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23HTMLTableSectionElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore23HTMLTableSectionElement11tagPriorityEv
+__ZNK7WebCore23HTMLTableSectionElement36canHaveAdditionalAttributeStyleDeclsEv
+__ZN7WebCore23HTMLTableSectionElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore16HTMLTableElement19addSharedGroupDeclsEbRN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZNK7WebCore17CSSInheritedValue12cssValueTypeEv
+__ZN7WebCore18RenderTableSectionC1EPNS_4NodeE
+__ZN7WebCore18RenderTableSectionC2EPNS_4NodeE
+__ZN7WebCore11RenderTable8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore18RenderTableSection14isTableSectionEv
+__ZNK7WebCore18RenderTableSection15virtualChildrenEv
+__ZN7WebCore23HTMLTableSectionElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
+__ZNK7WebCore23HTMLTableSectionElement17endTagRequirementEv
+__ZN7WebCore23HTMLTableSectionElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore14RenderTableRowC1EPNS_4NodeE
+__ZN7WebCore14RenderTableRowC2EPNS_4NodeE
+__ZN7WebCore14RenderTableRow15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderTableRow13requiresLayerEv
+__ZN7WebCore18RenderTableSection8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore14RenderTableRow10isTableRowEv
+__ZN7WebCore18RenderTableSection10ensureRowsEi
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE4fillERKS3_m
+__ZSt4fillIPN7WebCore18RenderTableSection10CellStructES2_EvT_S4_RKT0_
+__ZN7WebCore18RenderTableSection15virtualChildrenEv
+__ZNK7WebCore14RenderTableRow15virtualChildrenEv
+__ZN7WebCore19HTMLTableRowElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore19HTMLTableRowElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore10HTMLParser25tableCellCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL20tablecellConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore20HTMLTableCellElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20HTMLTableCellElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore20HTMLTableCellElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore20HTMLTableCellElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore20HTMLTablePartElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore20HTMLTablePartElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore13StyledElement19addCSSImagePropertyEPNS_15MappedAttributeEiRKNS_6StringE
+__ZN7WebCore26CSSMutableStyleDeclaration16setImagePropertyEiRKNS_6StringEb
+__ZNK7WebCore20HTMLTableCellElement17endTagRequirementEv
+__ZNK7WebCore20HTMLTableCellElement11tagPriorityEv
+__ZNK7WebCore20HTMLTableCellElement36canHaveAdditionalAttributeStyleDeclsEv
+__ZN7WebCore20HTMLTableCellElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore16HTMLTableElement18addSharedCellDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore16HTMLTableElement24addSharedCellBordersDeclERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore13StyledElement22getMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore13StyledElement22setMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringEPNS_29CS
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE15reserveCapacityEm
+__ZN7WebCore16HTMLTableElement24addSharedCellPaddingDeclERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore15RenderTableCellC1EPNS_4NodeE
+__ZN7WebCore15RenderTableCellC2EPNS_4NodeE
+__ZN7WebCore15RenderTableCell17updateFromElementEv
+__ZN7WebCore15RenderTableCell15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore15RenderTableCell14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore15RenderTableCell13requiresLayerEv
+__ZN7WebCore14RenderTableRow8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore15RenderTableCell11isTableCellEv
+__ZN7WebCore18RenderTableSection7addCellEPNS_15RenderTableCellEPNS_14RenderTableRowE
+__ZN7WebCore14RenderTableRow15virtualChildrenEv
+__ZN7WebCore11HTMLElement16addHTMLAlignmentEPNS_15MappedAttributeE
+__ZN7WebCore11HTMLElement31addHTMLAlignmentToStyledElementEPNS_13StyledElementEPNS_15MappedAttributeE
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE6shrinkEm
+__ZN7WebCore11RenderTable12appendColumnEi
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE14expandCapacityEm
+__ZN7WebCore18RenderTableSection12appendColumnEi
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIiLm0EE4growEm
+__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyCSSValueEi
+__ZN7WebCore10HTMLParser18isResidualStyleTagERKNS_12AtomicStringE
+__ZThn112_NK7WebCore17HTMLScriptElement22languageAttributeValueEv
+__ZNK7WebCore17HTMLScriptElement22languageAttributeValueEv
+__ZN7WebCoreL29isSupportedJavaScriptLanguageERKNS_6StringE
+__ZN7WebCore15jsDocumentTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_7JSValueE
+__ZThn88_N7WebCore8Document15reportExceptionERKNS_6StringEiS3_
+__ZN7WebCore8Document15reportExceptionERKNS_6StringEiS3_
+__ZNK7WebCore9DOMWindow7consoleEv
+__ZN7WebCore7ConsoleC1EPNS_5FrameE
+__ZN7WebCore7ConsoleC2EPNS_5FrameE
+__ZN7WebCore7Console10addMessageENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_
+__ZN7WebCore7Console21shouldPrintExceptionsEv
+__ZN7WebCoreL15fontConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLFontElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore15HTMLFontElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore15HTMLFontElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLFontElement26cssValueFromFontSizeNumberERKNS_6StringERi
+__ZN7WebCore15FontFamilyValue20appendSpaceSeparatedEPKtj
+__ZN7WebCore6String6appendEc
+__ZN7WebCore6String6appendEPKtj
+__ZNK7WebCore15HTMLFontElement17endTagRequirementEv
+__ZNK7WebCore15HTMLFontElement11tagPriorityEv
+__ZNK7WebCore6String8foldCaseEv
+__ZN7WebCore10StringImpl8foldCaseEv
+__ZN7WebCore10HTMLParser25checkIfHasPElementInScopeEv
+__ZN7WebCore6String6numberEt
+__ZNK7WebCore16HTMLInputElement7altTextEv
+__ZN7WebCore11RenderImage14resetAnimationEv
+__ZNK7WebCore15RenderTableCell10borderLeftEv
+__ZNK7WebCore15RenderTableCell11borderRightEv
+__ZN7WebCore15RenderTableCell21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore15RenderTableCell9borderTopEv
+__ZNK7WebCore15RenderTableCell12borderBottomEv
+-[WebCoreResourceHandleAsDelegate connection:didFailWithError:]
+__ZN7WebCore14ResourceLoader7didFailEPNS_14ResourceHandleERKNS_13ResourceErrorE
+__ZN7WebCore17SubresourceLoader7didFailERKNS_13ResourceErrorE
+__ZN7WebCore6Loader4Host7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore6Loader4Host7didFailEPNS_17SubresourceLoaderEb
+__ZN7WebCore11CachedImage5errorEv
+__ZN7WebCore11CachedImage5clearEv
+__ZN7WebCore11CachedImage18destroyDecodedDataEv
+__ZN7WebCore11RenderImage22setImageSizeForAltTextEPNS_11CachedImageE
+__ZN7WebCoreL11brokenImageEv
+__ZN7WebCore5Image20loadPlatformResourceEPKc
+__ZN7WebCore12SharedBuffer10wrapNSDataEP6NSData
+__ZN7WebCore12SharedBufferC1EPK8__CFData
+__ZN7WebCore12SharedBufferC2EPK8__CFData
+__ZNK7WebCore12SharedBuffer16platformDataSizeEv
+__ZN7WebCore5Cache5evictEPNS_14CachedResourceE
+__ZN7WebCore14ResourceLoader7didFailERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader13didFailToLoadEPNS_14ResourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore17ResourceErrorBaseD2Ev
+__ZNK7WebCore11RenderTable12avoidsFloatsEv
+__ZN7WebCore11RenderTable6layoutEv
+__ZN7WebCore11RenderTable9calcWidthEv
+__ZN7WebCore11RenderTable14calcPrefWidthsEv
+__ZN7WebCore11RenderTable23recalcHorizontalBordersEv
+__ZNK7WebCore11RenderTable14calcBorderLeftEv
+__ZNK7WebCore11RenderTable15calcBorderRightEv
+__ZN7WebCore15AutoTableLayout14calcPrefWidthsERiS1_
+__ZN7WebCore15AutoTableLayout10fullRecalcEv
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE4fillERKS3_m
+__ZSt4fillIPN7WebCore15AutoTableLayout6LayoutES2_EvT_S4_RKT0_
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4fillERKS3_m
+__ZSt4fillIPPN7WebCore15RenderTableCellES2_EvT_S4_RKT0_
+__ZN7WebCore15AutoTableLayout12recalcColumnEi
+__ZN7WebCore15RenderTableCell14calcPrefWidthsEv
+__ZNK7WebCore11RenderTable10borderLeftEv
+__ZNK7WebCore11RenderTable11borderRightEv
+__ZNK7WebCore15RenderTableCell15styleOrColWidthEv
+__ZN7WebCore15AutoTableLayout18calcEffectiveWidthEv
+__ZN7WebCore15AutoTableLayout6layoutEv
+__ZN7WebCore11RenderTable13setCellWidthsEv
+__ZN7WebCore18RenderTableSection13setCellWidthsEv
+__ZN7WebCore15RenderTableCell11updateWidthEi
+__ZN7WebCore18RenderTableSection6layoutEv
+__ZN7WebCore14RenderTableRow6layoutEv
+__ZN7WebCore15RenderTableCell6layoutEv
+__ZN7WebCore15RenderTableCell9calcWidthEv
+__ZNK7WebCore15RenderTableCell10paddingTopEb
+__ZNK7WebCore15RenderTableCell13paddingBottomEb
+__ZNK7WebCore15RenderTableCell16baselinePositionEbb
+__ZN7WebCore18RenderTableSection13calcRowHeightEv
+__ZNK7WebCore11RenderTable9borderTopEv
+__ZNK7WebCore11RenderTable12borderBottomEv
+__ZN7WebCore18RenderTableSection10layoutRowsEi
+__ZNK7WebCore11RenderBlock24percentHeightDescendantsEv
+__ZNK7WebCore18RenderTableSection12overflowLeftEb
+__ZNK7WebCore18RenderTableSection13overflowWidthEb
+__ZNK7WebCore18RenderTableSection11overflowTopEb
+__ZNK7WebCore18RenderTableSection14overflowHeightEb
+__ZNK7WebCore11RenderTable12sectionBelowEPKNS_18RenderTableSectionEb
+__ZNK7WebCore11RenderTable10colElementEiPbS1_
+__ZNK7WebCore27RenderTextControlSingleLine21preferredContentWidthEf
+__ZThn128_NK7WebCore16HTMLInputElement4sizeEv
+__ZNK7WebCore16HTMLInputElement4sizeEv
+__ZN7WebCore15AutoTableLayout14insertSpanCellEPNS_15RenderTableCellE
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4growEm
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE15reserveCapacityEm
+__ZNK7WebCore18RenderTableSection17rightmostPositionEbb
+__ZNK7WebCore18RenderTableSection14lowestPositionEbb
+__ZNK7WebCore15RenderTableCell19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore11RenderTable5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderTable11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore18RenderTableSection5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore18RenderTableSection11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore15RenderTableCell26paintBackgroundsBehindCellERNS_12RenderObject9PaintInfoEiiPS1_
+__ZN7WebCore15RenderTableCell5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore15RenderTableCell19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineTextBox15paintDecorationEPNS_15GraphicsContextEiiiPNS_10ShadowDataE
+__ZN7WebCore12RenderObject23getTextDecorationColorsEiRNS_5ColorES2_S2_b
+__ZN7WebCoreL15decorationColorEPNS_11RenderStyleE
+__ZNK7WebCore11RenderTable10cellBeforeEPKNS_15RenderTableCellE
+__ZNK7WebCore11RenderTable9cellAboveEPKNS_15RenderTableCellE
+__ZNK7WebCore11RenderTable12sectionAboveEPKNS_18RenderTableSectionEb
+__ZN7WebCore11HistoryItem17setAlternateTitleERKNS_6StringE
+__ZN7WebCore11RenderTable11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore18RenderTableSection11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore14RenderTableRow11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore15RenderTableCell23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZN7WebCore15BackForwardList16forwardListCountEv
+__ZN7WebCore15BackForwardList13backListCountEv
+__ZN7WebCore15BackForwardList11itemAtIndexEi
+__ZN7WebCore9DOMWindow36dispatchAllPendingBeforeUnloadEventsEv
 __ZN7WebCore12IconDatabase5closeEv
-sqlite3_close
-sqlite3ResetInternalSchema
-sqlite3SchemaFree
+__ZN7WebCore12IconDatabase17cleanupSyncThreadEv
+__ZN7WebCore12IconDatabase27deleteAllPreparedStatementsEv
+__ZN7WebCore9DOMWindow30dispatchAllPendingUnloadEventsEv
+__ZN7WebCore4Page23clearUndoRedoOperationsEv
 __ZN7WebCore9PageGroup17closeLocalStorageEv
 __ZN7WebCore9PageGroup12localStorageEv
 __ZN7WebCore12LocalStorage5closeEv
 __ZN7WebCore18LocalStorageThread9terminateEv
 __ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEN3WTF10PassRefPtrINS_18LocalStorageThreadEEE
+__ZN7WebCore16LocalStorageTaskC2ENS0_4TypeEN3WTF10PassRefPtrINS_18LocalStorageThreadEEE
 __ZN7WebCore18LocalStorageThread16performTerminateEv
 __ZN3WTF16ThreadSafeSharedIN7WebCore18LocalStorageThreadEE5derefEv
-__ZN7WebCore4Page23pendingUnloadEventCountEv
-WebCoreDrawTextAtPoint
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE15reserveCapacityEm
-__ZN7WebCore12IconDatabase37getImageDataForIconURLFromSQLDatabaseERKNS_6StringE
-sqlite3CodeSubselect
-__ZN7WebCore15SQLiteStatement8bindTextEiRKNS_6StringE
-sqlite3_bind_text16
-bindText
-vdbeUnbind
-__ZN7WebCore15SQLiteStatement21getColumnBlobAsVectorEiRN3WTF6VectorIcLm0EEE
-sqlite3_column_blob
-__ZN7WebCore15SQLiteStatement5resetEv
-sqlite3_reset
-sqlite3BtreeClose
-sqlite3BtreeRollback
-sqlite3PagerRollback
-pageReinit
-pager_truncate_cache
-sqlite3PagerClose
-__ZNK3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEEbRKT_
-__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore15AutodrainedPool5cycleEv
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE6shrinkEm
-__ZN7WebCore15SQLiteStatement9isExpiredEv
-sqlite3_expired
-__ZN3WTF7HashSetIPN7WebCore9PageGroupENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore9PageGroup18removeVisitedLinksEv
-__ZNK7WebCore12TextEncoding6decodeEPKcmbRb
-__ZN7WebCoreL16styleConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLStyleElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
-__ZN7WebCore12StyleElementC2Ev
-__ZN7WebCore16HTMLStyleElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLStyleElement17endTagRequirementEv
-__ZNK7WebCore16HTMLStyleElement11tagPriorityEv
-__ZN7WebCore16HTMLStyleElement20insertedIntoDocumentEv
-__ZN7WebCore13HTMLTokenizer13enlargeBufferEi
-__ZN7WebCore16HTMLStyleElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore16HTMLStyleElement15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCore16HTMLStyleElement21finishParsingChildrenEv
-__ZN7WebCore12StyleElement7processEPNS_7ElementE
-__ZN7WebCore12StyleElement11createSheetEPNS_7ElementERKNS_6StringE
-__ZThn56_NK7WebCore16HTMLStyleElement4typeEv
-__ZNK7WebCore16HTMLStyleElement4typeEv
-__ZThn56_NK7WebCore16HTMLStyleElement5mediaEv
-__ZNK7WebCore16HTMLStyleElement5mediaEv
-__ZThn56_N7WebCore16HTMLStyleElement10setLoadingEb
-__ZN7WebCore16HTMLStyleElement10setLoadingEb
-__ZNK7WebCore8Document13inputEncodingEv
-__ZN7WebCore13CSSStyleSheetC1EPNS_4NodeERKNS_6StringES5_
-__ZN7WebCore10StyleSheetC2EPNS_4NodeERKNS_6StringE
-__ZN7WebCore9CSSParser18parseFillShorthandEiPKiib
-__ZN7WebCore9CSSParser17parseFillPositionERN3WTF6RefPtrINS_8CSSValueEEES5_
-__ZN7WebCore9CSSParser19parseFillPositionXYERbS1_
-__ZN7WebCore9CSSParser20parseBackgroundColorEv
-__ZN7WebCore9CSSParser12addFillValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
-__ZN7WebCore9CSSParser9parseFontEb
-__ZN7WebCore15FontFamilyValueC1ERKNS_6StringE
-__ZN7WebCore6String8truncateEj
-__ZN7WebCore10StyleSheet8setMediaEN3WTF10PassRefPtrINS_9MediaListEEE
-__ZNK7WebCore11HTMLElement5titleEv
-__ZN7WebCore13CSSStyleSheet11checkLoadedEv
-__ZN7WebCore13CSSStyleSheet9isLoadingEv
-__ZN7WebCore9StyleBase12isImportRuleEv
-__ZN7WebCore16HTMLStyleElement11sheetLoadedEv
-__ZNK7WebCore16HTMLStyleElement9isLoadingEv
-__ZN7WebCore8Document18removePendingSheetEv
-__ZN7WebCore12StyleElement5sheetEPNS_7ElementE
-__ZNK7WebCore8CSSValue12cssValueTypeEv
-__ZNK7WebCore9FontValue11isFontValueEv
-__ZNK7WebCore15CSSInitialValue12cssValueTypeEv
-__ZNK7WebCore7Comment8nodeTypeEv
-__ZN7WebCore7DataRefINS_18StyleInheritedDataEE6accessEv
-__ZN7WebCoreL16colorForCSSValueEi
-__ZN3WTF7HashSetIPN7WebCore8DocumentENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore12RenderObject20createAnonymousBlockEv
-__ZNK7WebCore14RenderThemeMac18controlSizeForFontEPNS_11RenderStyleE
-__ZN7WebCore11RenderStyle11resetBorderEv
-__ZNK7WebCore14RenderThemeMac15setSizeFromFontEPNS_11RenderStyleEPKNS_7IntSizeE
-__ZNK7WebCore14RenderThemeMac11sizeForFontEPNS_11RenderStyleEPKNS_7IntSizeE
-__ZNK7WebCore14RenderThemeMac22setFontFromControlSizeEPNS_16CSSStyleSelectorEPNS_11RenderStyleEj
-__ZNK7WebCore12RenderObject17isSelectionBorderEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_20CachedResourceHandleINS1_14CachedResourceEEEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E4findIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEENS_17HashTableIteratorIS2_S7_S9_SA_SF_SD_EERKT_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_14CachedResourceEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E4findIS2_NS_22IdentityHashTranslatorIS2_S6_S9_EEEENS_17HashTableIteratorIS2_S6_S8_S9_SE_SC_EERKT_
-__ZN7WebCore14ResourceLoader7didFailERKNS_13ResourceErrorE
-__ZNK7WebCore12RenderObject14selectionStateEv
-__ZNK7WebCore11RenderBlock11isBlockFlowEv
-__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointENS_17CompositeOperatorE
-__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointERKNS_7IntRectENS_17CompositeOperatorE
-__ZNK7WebCore4Node14isDescendantOfEPKS0_
-__ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore7Console24setShouldPrintExceptionsEb
-__ZN7WebCoreL36htmlAttributeHasCaseInsensitiveValueERKNS_13QualifiedNameE
-__ZN7WebCoreL17addLocalNameToSetEPN3WTF7HashSetIPNS_16AtomicStringImplENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEERKNS_13QualifiedNameE
+__ZNK7WebCore10MouseEvent12isMouseEventEv
+__ZN7WebCore5Frame34setMarkedTextMatchesAreHighlightedEb
+__ZN7WebCore5Frame21markAllMatchesForTextERKNS_6StringEbj
+__ZN7WebCore15rangeOfContentsEPNS_4NodeE
+__ZN7WebCore5Range18selectNodeContentsEPNS_4NodeERi
+__ZN7WebCore13findPlainTextEPKNS_5RangeERKNS_6StringEbb
+__ZN7WebCore17CharacterIteratorC1EPKNS_5RangeEbb
+__ZN7WebCore17CharacterIteratorC2EPKNS_5RangeEbb
+__ZN7WebCoreL8searcherEv
+__ZN7WebCore17CharacterIterator7advanceEi
+__ZN7WebCoreL17characterSubrangeERNS_17CharacterIteratorEii
+__ZNK7WebCore17CharacterIterator5rangeEv
+__ZNK7WebCore12TextIterator5rangeEv
+__ZNK7WebCore5Range9collapsedERi
+__ZN7WebCore18endVisiblePositionEPKNS_5RangeENS_9EAffinityE
+__ZNK7WebCore5Range9endOffsetERi
+__ZNK7WebCore5Range12endContainerERi
+__ZNK7WebCore10RenderText10nextOffsetEi
+__ZN7WebCore20startVisiblePositionEPKNS_5RangeENS_9EAffinityE
+__ZNK7WebCore5Range11startOffsetERi
+__ZNK7WebCore6Editor17insideVisibleAreaEPNS_5RangeE
+__ZNK7WebCore5Frame21excludeFromTextSearchEv
+__ZNK7WebCore9FrameTree3topEb
+__ZN7WebCore8Document9addMarkerEPNS_5RangeENS_14DocumentMarker10MarkerTypeENS_6StringE
+__ZN7WebCore8Document9addMarkerEPNS_4NodeENS_14DocumentMarkerE
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE15reserveCapacityEm
+__ZN7WebCoreL24placeholderRectForMarkerEv
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore4NodeEEEPSt4pairINS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEENS_7PtrHas
+__ZNK7WebCore5Range18shadowTreeRootNodeEv
+__ZN7WebCoreL19collapsedToBoundaryEPKNS_5RangeEb
+__ZN7WebCore4Node14isInShadowTreeEv
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EEC2ERKS3_
+__ZN7WebCore13InlineTextBox20paintTextMatchMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleERKNS_4FontE
+__ZN7WebCore13InlineTextBox12selectionTopEv
+__ZN7WebCore13InlineTextBox15selectionHeightEv
+__ZNK7WebCore4Font20selectionRectForTextERKNS_7TextRunERKNS_8IntPointEiii
+__ZNK7WebCore4Font26selectionRectForSimpleTextERKNS_7TextRunERKNS_8IntPointEiii
+__ZN7WebCore8Document24setRenderedRectForMarkerEPNS_4NodeENS_14DocumentMarkerERKNS_7IntRectE
+__ZNK7WebCore5Frame31markedTextMatchesAreHighlightedEv
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE6shrinkEm
+__ZNK7WebCore9FrameTree20traverseNextWithWrapEb
+__ZNK7WebCore11FrameLoader14initialRequestEv
+__ZN7WebCore11FrameLoader50didReceiveServerRedirectForProvisionalLoadForFrameEv
+__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPFvPvS3_N3WTF10PassRefPtrINS_9FormStateEEEbES4_
+__ZN7WebCore18MainResourceLoader33callContinueAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEE
+__ZN7WebCore18MainResourceLoader29continueAfterNavigationPolicyERKNS_15ResourceRequestEb
+__ZN7WebCore15BackForwardList8capacityEv
+__ZN7WebCore10CachedPage6createEPNS_4PageE
+__ZN7WebCore10CachedPageC1EPNS_4PageE
+__ZN7WebCore10CachedPageC2EPNS_4PageE
+__ZN7WebCore11CachedFrameC1EPNS_5FrameE
+__ZN7WebCore11CachedFrameC2EPNS_5FrameE
+__ZN7WebCore22ScriptExecutionContext23suspendActiveDOMObjectsEv
+__ZN7WebCore21ScriptCachedFrameDataC1EPNS_5FrameE
+__ZN7WebCore21ScriptCachedFrameDataC2EPNS_5FrameE
+__ZN7WebCore5Frame11clearTimersEv
+__ZN7WebCore5Frame11clearTimersEPNS_9FrameViewEPNS_8DocumentE
+__ZN7WebCore19AnimationController17suspendAnimationsEPNS_8DocumentE
+__ZN7WebCore26AnimationControllerPrivate17suspendAnimationsEPNS_8DocumentE
+__ZN7WebCore8Document14setInPageCacheEb
+__ZN7WebCore11CachedFrame26setCachedFramePlatformDataEPNS_23CachedFramePlatformDataE
+__ZN7WebCore9PageCache3addEN3WTF10PassRefPtrINS_11HistoryItemEEENS2_INS_10CachedPageEEE
+__ZN7WebCore9PageCache12addToLRUListEPNS_11HistoryItemE
+__ZNK7WebCore16HTMLInputElement20saveFormControlStateERNS_6StringE
+__ZNK7WebCore16HTMLInputElement15formControlTypeEv
+__ZNK7WebCore17HTMLSelectElement20saveFormControlStateERNS_6StringE
+__ZN3WTF6VectorIcLm1024EE6shrinkEm
+__ZNK7WebCore17HTMLSelectElement15formControlTypeEv
+__ZN7WebCore7Console15disconnectFrameEv
+__ZThn112_NK7WebCore17HTMLScriptElement17forAttributeValueEv
+__ZNK7WebCore17HTMLScriptElement17forAttributeValueEv
+__ZN7WebCoreL19textareaConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLTextAreaElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLTextAreaElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZNK7WebCore11HTMLElement16findFormAncestorEv
+__ZN7WebCore19HTMLTextAreaElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore22HTMLFormControlElement11tagPriorityEv
+__ZNK7WebCore14RenderThemeMac19adjustTextAreaStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore11RenderBlock23removePositionedObjectsEPS0_
+__ZN7WebCore15HTMLFormElement18registerImgElementEPNS_16HTMLImageElementE
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE15reserveCapacityEm
+__ZN7WebCore12InputElement23parseMaxLengthAttributeERNS_16InputElementDataEPNS_15MappedAttributeE
+__ZN7WebCore13textBreakNextEPNS_17TextBreakIteratorE
+__ZN7WebCore5TimerINS_8DocumentEE5firedEv
+__ZN7WebCore8Document21styleRecalcTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCoreL23tablecaptionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore23HTMLTableCaptionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23HTMLTableCaptionElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore23HTMLTableCaptionElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore23HTMLTableCaptionElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore23HTMLTableCaptionElement17endTagRequirementEv
+__ZNK7WebCore23HTMLTableCaptionElement11tagPriorityEv
+__ZN7WebCoreL30createHTMLScriptElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLScriptElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLScriptElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLScriptElementEEE
+__ZN7WebCore19JSHTMLScriptElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLScriptElementEEE
+__ZN7WebCore19JSHTMLScriptElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLScriptElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement6setSrcERKNS_6StringE
+__ZNK7WebCore19JSHTMLScriptElement9classInfoEv
+__ZN7WebCore17ScriptElementData13requestScriptERKNS_6StringE
+__ZN7WebCore12CachedScript11setEncodingERKNS_6StringE
+__ZN7WebCore17ScriptElementData14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore8Document17executeScriptSoonEPNS_17ScriptElementDataENS_20CachedResourceHandleINS_12CachedScriptEEE
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE14expandCapacityEmP
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE15reserveCapacityEm
+__ZN7WebCore8Document27executeScriptSoonTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore17ScriptElementData7executeEPNS_12CachedScriptE
+__ZN7WebCore17ScriptElementData14evaluateScriptERKNS_16ScriptSourceCodeE
+__ZN7WebCore17jsHTMLDocumentAllEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14JSHTMLDocument3allEPN3JSC9ExecStateE
+__ZN7WebCore8Document3allEv
+__ZNK7WebCore19JSHTMLAllCollection9toBooleanEPN3JSC9ExecStateE
+__ZN7WebCoreL32createHTMLTextAreaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLTextAreaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTextAreaElementEEE
+__ZN7WebCore21JSHTMLTextAreaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTextAreaElementEEE
+__ZN7WebCoreL29createHTMLStyleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLStyleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLStyleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLStyleElementEEE
+__ZN7WebCore18JSHTMLStyleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLStyleElementEEE
+__ZNK7WebCore18JSHTMLStyleElement9classInfoEv
+__ZN7WebCore12StyleElement20insertedIntoDocumentEPNS_8DocumentEPNS_7ElementE
+__ZN7WebCore18JSHTMLStyleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsHTMLStyleElementSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn112_N7WebCore17HTMLScriptElement17dispatchLoadEventEv
+__ZN7WebCore17HTMLScriptElement17dispatchLoadEventEv
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE6shrinkEm
+__ZN7WebCore21JSHTMLTextAreaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsHTMLTextAreaElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTextAreaElement5valueEv
+__ZNK7WebCore19HTMLTextAreaElement11updateValueEv
+__ZN7WebCore21JSHTMLTextAreaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLTextAreaElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement8setValueERKNS_6StringE
+__ZN7WebCore16setJSNodeOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnerrorEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore15RenderTableCell14borderHalfLeftEb
+__ZNK7WebCore15RenderTableCell19collapsedLeftBorderEb
+__ZN7WebCoreL14compareBordersERKNS_20CollapsedBorderValueES2_
+__ZNK7WebCore15RenderTableCell15borderHalfRightEb
+__ZNK7WebCore15RenderTableCell20collapsedRightBorderEb
+__ZNK7WebCore11RenderTable9cellAfterEPKNS_15RenderTableCellE
+__ZNK7WebCore15RenderTableCell13borderHalfTopEb
+__ZNK7WebCore15RenderTableCell18collapsedTopBorderEv
+__ZNK7WebCore15RenderTableCell16borderHalfBottomEb
+__ZNK7WebCore15RenderTableCell21collapsedBottomBorderEv
+__ZNK7WebCore11RenderTable9cellBelowEPKNS_15RenderTableCellE
+__ZN7WebCore18RenderTableSection17recalcOuterBorderEv
+__ZNK7WebCore18RenderTableSection18calcOuterBorderTopEv
+__ZNK7WebCore18RenderTableSection21calcOuterBorderBottomEv
+__ZNK7WebCore18RenderTableSection19calcOuterBorderLeftEb
+__ZNK7WebCore18RenderTableSection20calcOuterBorderRightEb
+__ZNK7WebCore11RenderTable16outerBorderRightEv
+__ZNK7WebCore11RenderTable15outerBorderLeftEv
+__ZNK7WebCore11RenderTable14outerBorderTopEv
+__ZNK7WebCore11RenderTable17outerBorderBottomEv
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE15reserveCapacityEm
+__ZNK7WebCore15RenderTableCell19collectBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
+__ZN7WebCoreL14addBorderStyleERN3WTF6VectorINS_20CollapsedBorderValueELm100EEES2_
+__ZN7WebCore15RenderTableCell16sortBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
+__ZN7WebCore15RenderTableCell20paintCollapsedBorderEPNS_15GraphicsContextEiiii
+__ZN7WebCoreL20collapsedBorderStyleENS_12EBorderStyleE
+__ZN3WTF6VectorIN7WebCore20CollapsedBorderValueELm100EE6shrinkEm
+__ZN7WebCore12JSStyleSheet4markEv
+__ZN7WebCore18JSImageConstructor4markEv
+__ZN7WebCore19JSHTMLScriptElementD1Ev
+__ZN7WebCore17JSHTMLHeadElementD1Ev
+__ZN7WebCore11BitmapImage18destroyDecodedDataEb
+__ZN7WebCore11ImageSource5clearEbmPNS_12SharedBufferEb
+__ZN7WebCore11BitmapImageD0Ev
+__ZN7WebCore11ImageSourceD1Ev
+__ZN7WebCore11ImageSourceD2Ev
+__ZN7WebCoreL27compareBorderStylesForQSortEPKvS1_
+__ZNK7WebCore19JSLazyEventListener10jsFunctionEv
+__ZNK7WebCore19JSLazyEventListener9parseCodeEv
+__ZThn88_NK7WebCore8Document10virtualURLEv
+__ZNK7WebCore8Document10virtualURLEv
+__ZNK7WebCore13JSHTMLElement21pushEventHandlerScopeEPN3JSC9ExecStateERNS1_10ScopeChainE
+__ZNK7WebCore11HTMLElement11virtualFormEv
+__ZNK7WebCore5Event15isKeyboardEventEv
+__ZNK7WebCore5Event11isTextEventEv
+__ZN7WebCore15getDOMStructureINS_12JSMouseEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore12JSMouseEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSUIEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSUIEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSMouseEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MouseEventEEE
+__ZN7WebCore12JSMouseEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MouseEventEEE
+__ZN7WebCore9JSUIEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7UIEventEEE
+__ZNK3JSC8JSObject16isVariableObjectEv
+__ZNK7WebCore5Event20storesResultAsStringEv
+__ZNK7WebCore17HTMLAnchorElement11isFocusableEv
+__ZNK7WebCore17HTMLAnchorElement16isMouseFocusableEv
+__ZNK7WebCore17HTMLAnchorElement17canStartSelectionEv
+__ZN7WebCore14CachedResource11setEncodingERKNS_6StringE
+__ZNK7WebCore19HTMLTextAreaElement20saveFormControlStateERNS_6StringE
+__ZNK7WebCore19HTMLTextAreaElement15formControlTypeEv
+__ZN7WebCore8Location15disconnectFrameEv
+__ZN7WebCoreL16dlistConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLDListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLDListElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLDListElement17endTagRequirementEv
+__ZNK7WebCore16HTMLDListElement11tagPriorityEv
+__ZN7WebCore10HTMLParser18dtCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser18ddCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE6shrinkEm
+__ZN7WebCore10JSLocationD1Ev
+__ZN7WebCore10JSLocationD2Ev
+__ZN7WebCore21JSHTMLTextAreaElementD1Ev
+__ZN7WebCore12JSMouseEventD1Ev
+__ZN7WebCore10RenderView19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore28createAttributeEventListenerEPNS_5FrameEPNS_9AttributeE
+__ZN7WebCore8Document31setWindowAttributeEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore8Document4headEv
+__ZN7WebCore14RenderReplaced14calcPrefWidthsEv
+__ZN7WebCoreL21subframeForTargetNodeEPNS_4NodeE
+__ZN7WebCore12EventHandler28passMouseMoveEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
+__ZN7WebCore12EventHandler27passSubframeEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
+__ZN7WebCore10ScrollView5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore6Widget5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZNK7WebCore11RenderLayer20requiresSlowRepaintsEv
+__ZNK7WebCore9FrameTree14isDescendantOfEPKNS_5FrameE
+__ZN7WebCore25setJSHTMLIFrameElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19JSHTMLIFrameElement6setSrcEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase6setSrcERKNS_6StringE
+__ZN7WebCore11FrameLoader15userGestureHintEv
+__ZN7WebCore11HistoryItem6setURLERKNS_4KURLE
+__ZN7WebCore9PageCache6removeEPNS_11HistoryItemE
+__ZN7WebCore11HistoryItem12setURLStringERKNS_6StringE
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E47removeAndInvalid
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E6removeEPS2_
+__ZN7WebCore13PageURLRecordD1Ev
+__ZN7WebCore13PageURLRecordD2Ev
+__ZN7WebCore11HistoryItem18clearDocumentStateEv
+__ZN7WebCore6Widget16removeFromParentEv
+__ZN7WebCore10ScrollView11removeChildEPNS_6WidgetE
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ide
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvali
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore10ScrollView19platformRemoveChildEPNS_6WidgetE
+__ZN7WebCore6Widget19removeFromSuperviewEv
+__ZN7WebCoreL23safeRemoveFromSuperviewEP6NSView
+__ZN7WebCore10RenderPart12deleteWidgetEv
+__ZNK7WebCore9RenderBox18absoluteContentBoxEv
+__ZN7WebCore12RenderWidget17setWidgetGeometryERKNS_7IntRectE
+__ZN3WTF7HashMapIPN7WebCore24OverlapTestRequestClientENS1_7IntRectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3setERKS3_R
+__ZThn120_N7WebCore12RenderWidget20setOverlapTestResultEb
+__ZN7WebCore12RenderWidget20setOverlapTestResultEb
+__ZN7WebCore9FrameView15setIsOverlappedEb
+__ZN7WebCore19JSHTMLIFrameElementD1Ev
+__ZN7WebCore7CommentD0Ev
+__ZN7WebCore25JSHTMLDivElementPrototypeD1Ev
+__ZN7WebCore18setJSDOMWindowNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow7setNameERKNS_6StringE
+__ZN7WebCore15jsDOMWindowNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow4nameEv
+__ZN7WebCore5TimerINS_11CachedImageEE5firedEv
+__ZN7WebCore11CachedImage29decodedDataDeletionTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore22setJSDOMWindowLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11JSDOMWindow11setLocationEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore19JSLazyEventListenerD0Ev
+__ZN7WebCore15JSEventListenerD2Ev
+__ZN7WebCore11FrameLoader16detachFromParentEv
+__ZN7WebCore19InspectorController23frameDetachedFromParentEPNS_5FrameE
+__ZN7WebCore11FrameLoader19closeAndRemoveChildEPNS_5FrameE
+__ZN7WebCore5Frame13pageDestroyedEv
+__ZN7WebCore16JSDOMWindowShell15disconnectFrameEv
+__ZN7WebCore15JSDOMWindowBase15disconnectFrameEv
+__ZN7WebCore9FrameTree11removeChildEPNS_5FrameE
+__ZN7WebCore11FrameLoader22scheduleCheckCompletedEv
+__ZN7WebCore21DeprecatedPtrListImplD1Ev
+__ZN7WebCore21DeprecatedPtrListImplD2Ev
+__ZN7WebCore12RenderWidget7destroyEv
+__ZN7WebCore16RenderPartObjectD0Ev
+__ZN7WebCore9FrameView20removeWidgetToUpdateEPNS_16RenderPartObjectE
+__ZN7WebCore10RenderPartD2Ev
+__ZN7WebCore12RenderWidgetD2Ev
+__ZN7WebCore12RenderWidget12deleteWidgetEv
+__ZN7WebCoreL14preConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore14HTMLPreElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLPreElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore14HTMLPreElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore14HTMLPreElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14HTMLPreElement17endTagRequirementEv
+__ZNK7WebCore14HTMLPreElement11tagPriorityEv
+__ZN7WebCore26setJSHTMLInputElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement8setValueERKNS_6StringE
+__ZN7WebCore5FrameD1Ev
+__ZN7WebCore5FrameD2Ev
+__ZN7WebCore11FrameLoader14cancelAndClearEv
+__ZN7WebCore5Frame22disconnectOwnerElementEv
+__ZN7WebCore9DOMWindow15disconnectFrameEv
+__ZN7WebCore19AnimationControllerD1Ev
+__ZN7WebCore19AnimationControllerD2Ev
+__ZN7WebCore26AnimationControllerPrivateD1Ev
+__ZN7WebCore26AnimationControllerPrivateD2Ev
+__ZN7WebCore12EventHandlerD1Ev
+__ZN7WebCore12EventHandlerD2Ev
+__ZN7WebCore6EditorD1Ev
+__ZN7WebCore6EditorD2Ev
+__ZN7WebCore16ScriptControllerD1Ev
+__ZN7WebCore16ScriptControllerD2Ev
+__ZN7WebCore16ScriptController31disconnectPlatformScriptObjectsEv
+-[DOMAbstractView(Frame) _disconnectFrame]
+-[DOMAbstractView dealloc]
+__ZN7WebCore15removeJSWrapperEPN3JSC8JSObjectE
+__ZN7WebCore11FrameLoaderD1Ev
+__ZN7WebCore11FrameLoaderD2Ev
+__ZN7WebCore11FrameLoader9setOpenerEPNS_5FrameE
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableE
+__ZN7WebCore9FrameTreeD1Ev
+__ZN7WebCore9FrameTreeD2Ev
+__ZN7WebCoreL27createHTMLPreElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLPreElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLPreElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLPreElementEEE
+__ZN7WebCore16JSHTMLPreElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLPreElementEEE
+__ZN7WebCore16JSHTMLPreElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSHTMLPreElement9classInfoEv
+__ZN7WebCoreL26createHTMLBRElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore15JSHTMLBRElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSHTMLBRElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLBRElementEEE
+__ZN7WebCore15JSHTMLBRElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLBRElementEEE
+__ZNK7WebCore15JSHTMLBRElement9classInfoEv
+__ZN7WebCore17HTMLIFrameElementD0Ev
+__ZN7WebCore21HTMLFrameOwnerElementD2Ev
+__ZN7WebCore28JSHTMLIFrameElementPrototypeD1Ev
+__ZN7WebCore16JSDOMWindowShellD1Ev
+__ZN7WebCore16JSDOMWindowShellD2Ev
+__ZN7WebCore15JSHTMLBRElementD1Ev
+__ZN7WebCore16JSHTMLPreElementD1Ev
+__ZN7WebCore12IconDatabase28removePageURLFromSQLDatabaseERKNS_6StringE
+__ZN7WebCore27RenderTextControlSingleLine11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore27RenderTextControlInnerBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore27RenderTextControlSingleLine11isTextFieldEv
+__ZNK7WebCore11RenderTheme12stateChangedEPNS_12RenderObjectENS_12ControlStateE
+__ZNK7WebCore11RenderTheme13supportsHoverEPKNS_11RenderStyleE
+__ZN7WebCore17RenderTextControl19hitInnerTextElementERNS_13HitTestResultEiiii
+__ZN7WebCoreL22centerTruncateToBufferERKNS_6StringEjjPt
+__ZN7WebCore11isTextBreakEPNS_17TextBreakIteratorEi
+__ZSt13binary_searchIPKttEbT_S2_RKT0_
+__ZSt11lower_boundIPKttET_S2_S2_RKT0_
+__ZN7WebCoreL16findTextEncodingEPKci
+__ZN7WebCore12TextCodecICU29registerExtendedEncodingNamesEPFvPKcS2_E
+__ZN7WebCore12TextCodecICU22registerExtendedCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN7WebCore12TextCodecMac21registerEncodingNamesEPFvPKcS2_E
+__ZN7WebCore12TextCodecMac14registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN3WTF6VectorIcLm64EE6shrinkEm
+__ZNK7WebCore12TextEncoding26closestByteBasedEquivalentEv
+__ZN7WebCore22UTF32BigEndianEncodingEv
+__ZN7WebCore25UTF32LittleEndianEncodingEv
+__ZN7WebCoreL15addEncodingNameERN3WTF7HashSetIPKcNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEES3_
+__ZN3WTF7HashSetIPKcNS_7PtrHashIS2_EENS_10HashTraitsIS2_EEE3addERKS2_
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E6expandEv
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E6rehashEi
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E13allocateTableEi
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E15deallocateTableEPS2_i
+__ZNK3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E8containsIS2_NS_22IdentityHashT
+__ZN3WTF6VectorItLm512EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm512EE14expandCapacityEm
+__ZN3WTF6VectorItLm512EE15reserveCapacityEm
+__ZN7WebCore4KURL7setPortEt
+__ZNK7WebCore9FrameView13isTransparentEv
+__ZN7WebCore15GraphicsContext11drawEllipseERKNS_7IntRectE
+__ZN7WebCore15GraphicsContext8drawPathEv
+__ZN7WebCoreL12UTF7EncodingEv
+__ZN7WebCore15HTMLBodyElement14createLinkDeclEv
+__ZN7WebCore8DragDataC1EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
+__ZN7WebCore8DragDataC2EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
+__ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
+__ZN7WebCore14DragController20dragEnteredOrUpdatedEPNS_8DragDataE
+__ZN7WebCore5Frame15documentAtPointERKNS_8IntPointE
+__ZN7WebCore14DragController15tryDocumentDragEPNS_8DragDataENS_21DragDestinationActionE
+__ZN7WebCore14DragController12tryDHTMLDragEPNS_8DragDataE
+__ZNK7WebCore11FrameLoader7baseURLEv
+__ZNK7WebCore8DragData15createClipboardENS_21ClipboardAccessPolicyE
+__ZN7WebCore12ClipboardMacC1EbP12NSPasteboardNS_21ClipboardAccessPolicyEPNS_5FrameE
+__ZN7WebCore12ClipboardMacC2EbP12NSPasteboardNS_21ClipboardAccessPolicyEPNS_5FrameE
+__ZN7WebCore9ClipboardC2ENS_21ClipboardAccessPolicyEb
+__ZN7WebCore9Clipboard18setSourceOperationENS_13DragOperationE
+__ZN7WebCoreL14IEOpFromDragOpENS_13DragOperationE
+__ZN7WebCoreL16createMouseEventEPNS_8DragDataE
+__ZN7WebCore12EventHandler17updateDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
+__ZN7WebCore12EventHandler17dispatchDragEventERKNS_12AtomicStringEPNS_4NodeERKNS_18PlatformMouseEventEPNS_9ClipboardE
+__ZN7WebCore12ClipboardMacD0Ev
+__ZN7WebCore9ClipboardD2Ev
+__ZN7WebCore14DragController14canProcessDragEPNS_8DragDataE
+__ZNK7WebCore8DragData25containsCompatibleContentEv
+__ZNK7WebCore8DragData13containsFilesEv
+__ZN7WebCoreL11asFileInputEPNS_4NodeE
+__ZN7WebCore14DragController16operationForLoadEPNS_8DragDataE
+__ZN7WebCore14DragController13dragOperationEPNS_8DragDataE
+__ZNK7WebCore8DragData11containsURLEv
+__ZNK7WebCore8DragData5asURLEPNS_6StringE
+__ZN7WebCore14DragController11dragUpdatedEPNS_8DragDataE
+__ZN7WebCore14DragController11performDragEPNS_8DragDataE
+__ZN7WebCore14DragController16concludeEditDragEPNS_8DragDataE
+__ZNK7WebCore8Document16elementFromPointEii
+__ZNK7WebCore8DragData13containsColorEv
+__ZN7WebCore15SQLiteStatement8bindNullEi
+__ZN7WebCore12EventHandler10wheelEventEP7NSEvent
+__ZN7WebCore18PlatformWheelEventC1EP7NSEvent
+__ZN7WebCore18PlatformWheelEventC2EP7NSEvent
+__ZN7WebCore12EventHandler16handleWheelEventERNS_18PlatformWheelEventE
+__ZN7WebCore4Node18dispatchWheelEventERNS_18PlatformWheelEventE
+__ZN7WebCore10WheelEventC1EffN3WTF10PassRefPtrINS_9DOMWindowEEEiiiibbbb
+__ZN7WebCore10WheelEventC2EffN3WTF10PassRefPtrINS_9DOMWindowEEEiiiibbbb
+__ZN7WebCore10WheelEventD0Ev
+__ZNK7WebCore12RenderObject12enclosingBoxEv
+__ZN7WebCore9RenderBox6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore11RenderLayer6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore10ScrollView10wheelEventERNS_18PlatformWheelEventE
+__ZN7WebCore16LegacyWebArchive6createEPNS_4NodeE
+__ZN7WebCoreL18appendDocumentTypeERN3WTF6VectorItLm0EEEPKNS_12DocumentTypeE
+__ZNK7WebCore7Element22nodeNamePreservingCaseEv
+__ZNK7WebCore7Element14isURLAttributeEPNS_9AttributeE
+__ZN7WebCoreL20appendAttributeValueERN3WTF6VectorItLm0EEERKNS_6StringEb
+__ZNK7WebCore17HTMLAnchorElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCoreL29appendQuotedURLAttributeValueERN3WTF6VectorItLm0EEERKNS_6StringE
+__ZN7WebCore16LegacyWebArchive6createERKNS_6StringEPNS_5FrameERKN3WTF6VectorIPNS_4NodeELm0EEE
+__ZN7WebCore10utf8BufferERKNS_6StringE
+__ZN7WebCore12SharedBuffer11adoptVectorERN3WTF6VectorIcLm0EEE
+__ZN7WebCore12SharedBufferC1Ev
+__ZN7WebCore12SharedBufferC2Ev
+__ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_
+__ZN7WebCore15ArchiveResourceC1EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_
+__ZN7WebCore15ArchiveResourceC2EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_
+__ZNK7WebCore4Node18getSubresourceURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore4Node27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE14deleteAllNodesEv
+__ZNK7WebCore13StyledElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore16HTMLStyleElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore13CSSStyleSheet23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN3WTF5DequeIPN7WebCore13CSSStyleSheetEE14expandCapacityEv
+__ZN7WebCore12CSSStyleRule23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore26CSSMutableStyleDeclaration23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore17CSSPrimitiveValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZNK7WebCore15HTMLBodyElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore15HTMLBodyElement10backgroundEv
+__ZN7WebCore12IconDatabase17iconURLForPageURLERKNS_6StringE
+__ZN7WebCore16LegacyWebArchive6createEN3WTF10PassRefPtrINS_15ArchiveResourceEEERNS1_6VectorIS4_Lm0EEERNS5_INS2_IS0_EELm0EEE
+__ZN7WebCore16LegacyWebArchive6createEv
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E15deallocateTableEPS2_i
+__ZN7WebCore16LegacyWebArchive21rawDataRepresentationEv
+__ZN7WebCore16LegacyWebArchive32createPropertyListRepresentationEPNS_7ArchiveE
+__ZN7WebCore16LegacyWebArchive32createPropertyListRepresentationEPNS_15ArchiveResourceENS0_18MainResourceStatusE
+__ZN7WebCore15ArchiveResourceD0Ev
+__ZN7WebCore5Cache11setDisabledEb
+__ZN7WebCore5Cache18pruneDeadResourcesEv
+__ZNK7WebCore5Cache12deadCapacityEv
+__ZN7WebCore5Cache18pruneLiveResourcesEv
+__ZNK7WebCore5Cache12liveCapacityEv
+__ZN7WebCore18MainResourceLoader18handleDataLoadSoonERNS_15ResourceRequestE
+__ZN7WebCore18MainResourceLoader18startDataLoadTimerEv
+__ZN7WebCore16RunLoopTimerBase5startEdd
+__ZN7WebCore16RunLoopTimerBase8scheduleERKN3WTF7HashSetINS1_6RefPtrINS_12SchedulePairEEENS_16SchedulePairHashENS1_10HashTraitsI
+__ZN7WebCore16RunLoopTimerBase8scheduleEPKNS_12SchedulePairE
+__ZN7WebCoreL10timerFiredEP16__CFRunLoopTimerPv
+__ZN7WebCore12RunLoopTimerINS_18MainResourceLoaderEE5firedEv
+__ZN7WebCore18MainResourceLoader17handleDataLoadNowEPNS_12RunLoopTimerIS0_EE
+__ZNK7WebCore12SharedBuffer12platformDataEv
+__ZN7WebCore4Page9initGroupEv
+__ZN7WebCore9PageGroupC1EPNS_4PageE
+__ZN7WebCore9PageGroupC2EPNS_4PageE
 __ZNK7WebCore9FrameView26shouldUpdateWhileOffscreenEv
-__ZN7WebCore15FormDataBuilderD1Ev
-__ZN7WebCore9CSSParser22rollbackLastPropertiesEi
+-[DOMNode nodeName]
+__ZNK7WebCore8Document8nodeNameEv
+-[DOMNode nodeType]
+__ZNK7WebCore4Text8nodeNameEv
+-[DOMElement getAttribute:]
+__ZN7WebCore11FrameLoader17stopForUserCancelEb
+__ZN7WebCore15RenderTableCell7destroyEv
+__ZN7WebCore15RenderTableCellD0Ev
+__ZN7WebCore14RenderTableRow7destroyEv
+__ZN7WebCore18RenderTableSection11removeChildEPNS_12RenderObjectE
+__ZN7WebCore14RenderTableRowD0Ev
+__ZN7WebCore18RenderTableSection7destroyEv
+__ZN7WebCore11RenderTable11removeChildEPNS_12RenderObjectE
+__ZN7WebCore18RenderTableSectionD0Ev
+__ZN7WebCore18RenderTableSection9clearGridEv
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE6shrinkEm
+__ZN7WebCore11RenderTableD0Ev
+__ZN7WebCore15AutoTableLayoutD0Ev
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE6shrinkEm
+__ZN7WebCore16HTMLStyleElementD0Ev
+__ZN7WebCore16HTMLTableElementD0Ev
+__ZN7WebCore23HTMLTableSectionElementD0Ev
+__ZN7WebCore19HTMLTableRowElementD0Ev
+__ZN7WebCore20HTMLTableCellElementD0Ev
+__ZN7WebCore11CachedImageD0Ev
+__ZN7WebCore14CachedResourceD2Ev
+__ZN7WebCore17HTMLAnchorElementD0Ev
+__ZN7WebCore13HTMLBRElementD0Ev
+__ZN7WebCore13HTMLLIElementD0Ev
+__ZN7WebCore12EventHandler15sendResizeEventEv
+__ZN7WebCore5Frame25setUserStyleSheetLocationERKNS_4KURLE
+__ZN7WebCore12base64DecodeERKN3WTF6VectorIcLm0EEERS2_
+__ZN7WebCore12base64DecodeEPKcjRN3WTF6VectorIcLm0EEE
+__ZN7WebCore6String8fromUTF8EPKc
+__ZNK7WebCore10StyleSheet11completeURLERKNS_6StringE
+__ZN7WebCore7DataRefINS_22StyleRareInheritedDataEE6accessEv
+__ZN7WebCore15RenderTableCell29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore5Frame23visiblePositionForPointERKNS_8IntPointE
+__ZN7WebCoreL43positionForPointRespectingEditingBoundariesEPNS_9RenderBoxES1_RKNS_8IntPointE
+__ZN7WebCore9RenderBox16positionForPointERKNS_8IntPointE
+__ZN7WebCore12RenderObject21createVisiblePositionERKNS_8PositionE
+__ZN7WebCore31firstDeepEditingPositionForNodeEPNS_4NodeE
+__ZN7WebCore17positionAfterNodeEPKNS_4NodeE
+-[DOMRange endOffset]
+-[DOMRange startOffset]
+-[DOMRange startContainer]
+-[DOMNode childNodes]
+-[DOMCharacterData data]
+-[DOMDocument createTextNode:]
+__Z3kitPN7WebCore4TextE
+-[DOMNode insertBefore:refChild:]
+-[DOMDocument createElement:]
+-[DOMHTMLAnchorElement setHref:]
+-[DOMNode appendChild:]
+-[DOMCharacterData setData:]
+-[DOMRange setStart:offset:]
+-[DOMRange setEnd:offset:]
+-[DOMRange(DOMRangeExtensions) lineBoxRects]
+-[DOMRange(DOMRangeExtensions) textRects]
+__ZN7WebCore13InlineTextBox11extractLineEv
+__ZN7WebCore10RenderText14extractTextBoxEPNS_13InlineTextBoxE
+__ZN7WebCore13InlineTextBox10attachLineEv
+__ZN7WebCore10RenderText13attachTextBoxEPNS_13InlineTextBoxE
+__ZN7WebCore5Range9textRectsERN3WTF6VectorINS_7IntRectELm0EEEb
+__ZN7WebCore10RenderText21absoluteRectsForRangeERN3WTF6VectorINS_7IntRectELm0EEEjjb
+__ZN7WebCore13InlineTextBox13selectionRectEiiii
+__ZN7WebCoreL3kitERKN3WTF6VectorINS_7IntRectELm0EEE
+__ZN7WebCore4Page17willMoveOffscreenEv
+__ZN7WebCore9FrameView17willMoveOffscreenEv
+__ZN7WebCore10RenderView17willMoveOffscreenEv
+__ZN3WTF7HashMapIPN7WebCore11RenderImageEPNS1_20RenderImageScaleDataENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE4takeERKS
+__ZN3WTF9HashTableIPN7WebCore11RenderImageESt4pairIS3_PNS1_20RenderImageScaleDataEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
+__ZN7WebCore14DragController9dragEndedEv
+__ZN7WebCore4PageD1Ev
+__ZN7WebCore4PageD2Ev
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ident
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalida
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore19InspectorController22inspectedPageDestroyedEv
+__ZN7WebCore19InspectorController5closeEv
+__ZN7WebCore15BackForwardList5closeEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore9FrameDataELm0EE6shrinkEm
+__ZN7WebCore9FrameData5clearEb
+__ZN7WebCore15BackForwardListD1Ev
+__ZN7WebCore15BackForwardListD2Ev
+__ZN7WebCore15ProgressTrackerD1Ev
+__ZN7WebCore15ProgressTrackerD2Ev
+__ZN7WebCore19InspectorControllerD0Ev
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS8_IS
+__ZN3WTF15deleteAllValuesIPN7WebCore14ConsoleMessageELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore21ContextMenuControllerD1Ev
+__ZN7WebCore21ContextMenuControllerD2Ev
+__ZN7WebCore14DragControllerD1Ev
+__ZN7WebCore14DragControllerD2Ev
+__ZN7WebCore6ChromeD0Ev
+__ZN7WebCore5Range19nodeChildrenChangedEPNS_13ContainerNodeE
+-[DOMRange endContainer]
+__ZN7WebCore5Range11textRemovedEPNS_4NodeEjj
+-[DOMRange setStartBefore:]
+-[DOMRange setEndAfter:]
+__ZN7WebCore16LegacyWebArchive6createEPNS_5RangeE
+__ZN7WebCore12createMarkupEPKNS_5RangeEPN3WTF6VectorIPNS_4NodeELm0EEENS_23EAnnotateForInterchangeEb
+__ZN7WebCore25avoidIntersectionWithNodeEPKNS_5RangeEPNS_4NodeE
+__ZN7WebCore22DeleteButtonController7disableEv
+__ZN7WebCore22DeleteButtonController4hideEv
+__ZNK7WebCore12RenderObject14previousOffsetEi
+__ZN7WebCoreL27needInterchangeNewlineAfterERKNS_15VisiblePositionE
+__ZNK7WebCore15VisiblePosition4nextEb
+__ZN7WebCore29nextVisuallyDistinctCandidateERKNS_8PositionE
+__ZNK7WebCore8Position11atEndOfTreeEv
+__ZNK7WebCore8Position4nextENS_16PositionMoveTypeE
+__ZN7WebCoreL14getStartMarkupEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPN3WTF7HashMapIPNS_16AtomicStringImplESA_NS7
+__ZNK7WebCore15HTMLBodyElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore26CSSMutableStyleDeclaration4copyEv
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EEC1ILm4EEERKNS0_IS2_XT_EEE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EEC2ILm4EEERKNS0_IS2_XT_EEE
+__ZN7WebCore26CSSMutableStyleDeclarationC1EPNS_7CSSRuleERKN3WTF6VectorINS_11CSSPropertyELm0EEEj
+__ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleERKN3WTF6VectorINS_11CSSPropertyELm0EEEj
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EEC1ILm0EEERKNS0_IS2_XT_EEE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EEC2ILm0EEERKNS0_IS2_XT_EEE
+__ZN7WebCoreL31styleFromMatchedRulesForElementEPNS_7ElementEb
+__ZN7WebCore16CSSStyleSelector20styleRulesForElementEPNS_7ElementEb
+__ZN7WebCore26CSSMutableStyleDeclaration5mergeEPS0_b
+__ZN7WebCore20enclosingNodeWithTagERKNS_8PositionERKNS_13QualifiedNameE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EE6shrinkEm
+__ZNK7WebCore16HTMLTableElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore20HTMLTableCellElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore34convertHTMLTextToInterchangeFormatERKNS_6StringEPKNS_4TextE
+__ZN7WebCoreL12getEndMarkupEPKNS_4NodeE
+__ZNK7WebCore16HTMLImageElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore12_GLOBAL__N_120convertedSpaceStringEv
+__ZN7WebCore6String6appendEt
+__ZN7WebCore16isMailBlockquoteEPKNS_4NodeE
+__ZNK7WebCore27CSSComputedStyleDeclaration25copyInheritablePropertiesEv
+__ZNK7WebCore19CSSStyleDeclaration19copyPropertiesInSetEPKij
+__ZN7WebCoreL14valueForFamilyERKNS_12AtomicStringE
+__ZN7WebCoreL19identifierForFamilyERKNS_12AtomicStringE
+__ZN7WebCore17CSSPrimitiveValueC1ERKNS_6LengthE
+__ZN7WebCore17CSSPrimitiveValueC2ERKNS_6LengthE
+__ZN7WebCoreL24currentColorOrValidColorEPNS_11RenderStyleERKNS_5ColorE
+__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEiRi
+__ZNK7WebCore9StyleBase15isCSSStyleSheetEv
+__ZN7WebCoreL31cssIdentifierForFontSizeKeywordEi
+__ZN7WebCoreL28propertyMissingOrEqualToNoneEPNS_26CSSMutableStyleDeclarationEi
+__ZN7WebCore17isTabSpanTextNodeEPKNS_4NodeE
+__ZN7WebCore13isTabSpanNodeEPKNS_4NodeE
+__ZN7WebCore21nearestMailBlockquoteEPKNS_4NodeE
+__ZNK7WebCore19CSSStyleDeclaration4diffEPNS_26CSSMutableStyleDeclarationE
+__ZNK7WebCore10RenderText22caretMaxRenderedOffsetEv
+__ZNK7WebCore10RenderText14caretMaxOffsetEv
+__ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCore22DeleteButtonController6enableEv
+__ZN7WebCore22DeleteButtonController4showEPNS_11HTMLElementE
+__ZNK7WebCore5Frame18documentTypeStringEv
+__ZNK7WebCore16HTMLTableElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore20HTMLTableCellElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore12CSSValueList23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZNK7WebCore16HTMLImageElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE3addERKS2_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIN7WebCore4KURLEEES5_NS_17IdentityExtractorIS5_EENS_28ListHashSetNodeHashFunctionsIS3_N
+__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE10appendNodeEPNS_15ListHashSetNodeIS2_EE
+__ZNK3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E8containsIS2_NS_22Iden
+__ZN3WTF7HashSetIN7WebCore4KURLENS1_8KURLHashENS_10HashTraitsIS2_EEE3addERKS2_
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E6expandEv
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E6rehashEi
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E13allocateTableEi
+__ZNK7WebCore14DocumentLoader11subresourceERKNS_4KURLE
+__ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_16ResourceResponseE
+__ZN7WebCore15ArchiveResourceC1EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_16ResourceResponseE
+__ZN7WebCore15ArchiveResourceC2EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_16ResourceResponseE
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE6shrinkEm
+__ZN7WebCore12SharedBuffer12createNSDataEv
+-[DOMRange commonAncestorContainer]
+-[DOMRange collapsed]
+-[DOMRange intersectsNode:]
+__ZN7WebCore5Range14intersectsNodeEPNS_4NodeERi
+__ZN7WebCore5Range12comparePointEPNS_4NodeEiRi
+-[DOMNode isSameNode:]
+__ZN7WebCoreL15baseConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLBaseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLBaseElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLBaseElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLBaseElement7processEv
+__ZNK7WebCore15HTMLBaseElement17endTagRequirementEv
+__ZNK7WebCore15HTMLBaseElement11tagPriorityEv
+__ZN7WebCore15HTMLBaseElement20insertedIntoDocumentEv
+__ZN7WebCore8Document17setBaseElementURLERKNS_4KURLE
+-[DOMDocument body]
+__Z3kitPN7WebCore11HTMLElementE
+-[DOMHTMLElement setClassName:]
+-[DOMHTMLDocument(DOMHTMLDocumentExtensions) createDocumentFragmentWithText:]
+__Z4coreP15DOMHTMLDocument
+__ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
+__ZN7WebCore8Document22createDocumentFragmentEv
+__ZNK7WebCore6String5splitEtbRN3WTF6VectorIS0_Lm0EEE
+__ZN7WebCore29createDefaultParagraphElementEPNS_8DocumentE
+__ZN7WebCoreL23fillContainerFromStringEPNS_13ContainerNodeERKNS_6StringE
+__ZN7WebCore30stringWithRebalancedWhitespaceERKNS_6StringEbb
+__ZN7WebCore18createBreakElementEPNS_8DocumentE
+__Z3kitPN7WebCore16DocumentFragmentE
+__ZN7WebCoreL21blockquoteConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore21HTMLBlockquoteElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21HTMLBlockquoteElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+-[DOMElement setAttribute:value:]
+-[DOMHTMLDocument(DOMHTMLDocumentExtensions) createDocumentFragmentWithMarkupString:baseURL:]
+__ZN7WebCore24createFragmentFromMarkupEPNS_8DocumentERKNS_6StringES4_
+__ZN7WebCore10HTMLParser28tableSectionCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL23tablesectionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+-[DOMElement hasAttribute:]
+__ZNK7WebCore7Element12hasAttributeERKNS_6StringE
+-[DOMElement style]
+-[DOMCSSStyleDeclaration getPropertyCSSValue:]
+__ZN7WebCore19CSSStyleDeclaration19getPropertyCSSValueERKNS_6StringE
+__Z3kitPN7WebCore8CSSValueE
+__Z8kitClassPN7WebCore8CSSValueE
+-[DOMCSSValue cssValueType]
+-[DOMCSSPrimitiveValue primitiveType]
+-[DOMCSSPrimitiveValue getRGBColorValue]
+__ZNK7WebCore17CSSPrimitiveValue16getRGBColorValueERi
+__Z3kitj
++[DOMRGBColor initialize]
+__Z33createWrapperCacheWithIntegerKeysv
+-[DOMRGBColor red]
+__Z3kitPN7WebCore17CSSPrimitiveValueE
+-[DOMCSSPrimitiveValue getFloatValue:]
+__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEtRi
+-[DOMRGBColor blue]
+-[DOMRGBColor green]
+-[DOMCSSStyleDeclaration removeProperty:]
+__ZN7WebCore19CSSStyleDeclaration14removePropertyERKNS_6StringERi
+__ZN7WebCore17CSSPrimitiveValue18computeLengthFloatEPNS_11RenderStyleEdb
+-[DOMHTMLImageElement src]
+-[DOMDocument getElementById:]
+-[DOMDocument createNodeIterator:whatToShow:filter:expandEntityReferences:]
+__ZN7WebCore8Document18createNodeIteratorEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
+__ZN7WebCore12NodeIteratorC1EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore12NodeIteratorC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore9TraversalC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore12NodeIterator11NodePointerC1EN3WTF10PassRefPtrINS_4NodeEEEb
+__ZN7WebCore12NodeIterator11NodePointerC2EN3WTF10PassRefPtrINS_4NodeEEEb
+__ZN7WebCore12NodeIterator11NodePointerC1Ev
+__ZN7WebCore12NodeIterator11NodePointerC2Ev
+__ZN7WebCore8Document18attachNodeIteratorEPNS_12NodeIteratorE
+__ZN3WTF7HashSetIPN7WebCore12NodeIteratorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__Z3kitPN7WebCore12NodeIteratorE
+-[DOMNodeIterator nextNode]
+__ZN7WebCore19scriptStateFromNodeEPNS_4NodeE
+__ZN7WebCore12NodeIterator8nextNodeEPN3JSC9ExecStateERi
+__ZN7WebCore12NodeIterator11NodePointer10moveToNextEPNS_4NodeE
+__ZNK7WebCore9Traversal10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore12NodeIterator11NodePointer5clearEv
+-[DOMElement removeAttribute:]
+__ZNK7WebCore5Frame30applyEditingStyleToBodyElementEv
+__ZNK7WebCore5Frame26applyEditingStyleToElementEPNS_7ElementE
+__ZN7WebCore16VisibleSelectionC1ERKNS_8PositionENS_9EAffinityE
+__ZN7WebCore16VisibleSelectionC2ERKNS_8PositionENS_9EAffinityE
+__ZNK7WebCore8RenderBR14caretMinOffsetEv
+__ZN7WebCore6Editor18shouldBeginEditingEPNS_5RangeE
+__ZN7WebCore6Editor15didBeginEditingEv
+__ZNK7WebCore4Node20shouldUseInputMethodEv
+__ZN7WebCore10RenderText14localCaretRectEPNS_9InlineBoxEiPi
+__ZNK7WebCore13InlineTextBox17positionForOffsetEi
+__ZNK7WebCore12RenderObject19offsetFromContainerEPS0_
+__ZN7WebCore31SimplifiedBackwardsTextIterator8exitNodeEv
+__ZN7WebCore14caretMaxOffsetEPKNS_4NodeE
+__ZN7WebCore31SimplifiedBackwardsTextIterator17handleNonTextNodeEv
+__ZN7WebCore31SimplifiedBackwardsTextIterator13emitCharacterEtPNS_4NodeEii
+__ZN3WTF6VectorItLm1024EE7prependItEEvPKT_m
+__ZN3WTF6VectorItLm1024EE6insertItEEvmPKT_m
+__ZN7WebCoreL17startWordBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCoreL30startOfLastWordBoundaryContextEPKti
+__ZN7WebCore16findWordBoundaryEPKtiiPiS2_
+__ZN7WebCore26BackwardsCharacterIteratorC1EPKNS_5RangeE
+__ZN7WebCore26BackwardsCharacterIteratorC2EPKNS_5RangeE
+__ZN7WebCore26BackwardsCharacterIterator7advanceEi
+__ZNK7WebCore26BackwardsCharacterIterator5rangeEv
+-[DOMDocument styleSheets]
+__Z3kitPN7WebCore14StyleSheetListE
+-[DOMStyleSheetList length]
+-[DOMElement getAttributeNode:]
+__ZN7WebCore7Element16getAttributeNodeERKNS_6StringE
+__Z3kitPN7WebCore4AttrE
+-[DOMCSSStyleDeclaration length]
+-[DOMCSSStyleDeclaration item:]
+__ZNK7WebCore26CSSMutableStyleDeclaration4itemEj
+-[DOMNode hasChildNodes]
+-[DOMStyleSheetList dealloc]
+-[DOMNodeIterator dealloc]
+-[DOMNodeIterator detach]
+__ZN7WebCore12NodeIterator6detachEv
+__ZN7WebCore8Document18detachNodeIteratorEPNS_12NodeIteratorE
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN7WebCore12NodeIteratorD1Ev
+__ZN7WebCore12NodeIteratorD2Ev
+-[DOMCSSValue dealloc]
+-[DOMRGBColor dealloc]
+__ZN7WebCore12EventHandler8keyEventEP7NSEvent
+__ZN7WebCore21PlatformKeyboardEventC1EP7NSEvent
+__ZN7WebCore21PlatformKeyboardEventC2EP7NSEvent
+__ZN7WebCoreL24keyIdentifierForKeyEventEP7NSEvent
+__ZN7WebCore12EventHandler8keyEventERKNS_21PlatformKeyboardEventE
+__ZN7WebCoreL26eventTargetNodeForDocumentEPNS_8DocumentE
+__ZN7WebCore12EventHandler15handleAccessKeyERKNS_21PlatformKeyboardEventE
+__ZN7WebCore12EventHandler18accessKeyModifiersEv
+__ZNK7WebCore12EventHandler38needsKeyboardEventDisambiguationQuirksEv
+__ZN7WebCore19applicationIsSafariEv
+__ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS0_4TypeEb
+__ZN7WebCore13KeyboardEventC1ERKNS_21PlatformKeyboardEventEPNS_9DOMWindowE
+__ZN7WebCore13KeyboardEventC2ERKNS_21PlatformKeyboardEventEPNS_9DOMWindowE
+__ZN7WebCore6Editor24handleInputMethodKeydownEPNS_13KeyboardEventE
+__ZNK7WebCore13KeyboardEvent15isKeyboardEventEv
+__ZN7WebCore12EventHandler27defaultKeyboardEventHandlerEPNS_13KeyboardEventE
+__ZN7WebCore6Editor19handleKeyboardEventEPNS_13KeyboardEventE
+__ZN7WebCore6Editor7commandERKNS_6StringE
+__ZN7WebCore6Editor7commandERKNS_6StringENS_19EditorCommandSourceE
+__ZN7WebCoreL16createCommandMapEv
+__ZN3WTF7HashMapIN7WebCore6StringEPKNS1_21EditorInternalCommandENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_21EditorInternalCommandEENS_18PairFirstExtractorIS7_EENS1_15CaseFoldingHas
+__ZNK3WTF7HashMapIN7WebCore6StringEPKNS1_21EditorInternalCommandENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS
+__ZN7WebCore6Editor7CommandC1EN3WTF10PassRefPtrINS_5FrameEEEPKNS_21EditorInternalCommandENS_19EditorCommandSourceE
+__ZN7WebCore6Editor7CommandC2EN3WTF10PassRefPtrINS_5FrameEEEPKNS_21EditorInternalCommandENS_19EditorCommandSourceE
+__ZNK7WebCore6Editor7Command15isTextInsertionEv
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EEaSERKS3_
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE15reserveCapacityEm
+__ZN7WebCore6Editor10insertTextERKNS_6StringEPNS_5EventE
+__ZN7WebCore12EventHandler20handleTextInputEventERKNS_6StringEPNS_5EventEbb
+__ZN7WebCore9TextEventC1EN3WTF10PassRefPtrINS_9DOMWindowEEERKNS_6StringE
+__ZN7WebCore9TextEventC2EN3WTF10PassRefPtrINS_9DOMWindowEEERKNS_6StringE
+__ZNK7WebCore9TextEvent11isTextEventEv
+__ZN7WebCore12EventHandler28defaultTextInputEventHandlerEPNS_9TextEventE
+__ZN7WebCore6Editor33insertTextWithoutSendingTextEventERKNS_6StringEbPNS_5EventE
+__ZN7WebCore6Editor19selectionForCommandEPNS_5EventE
+__ZNK7WebCore6Editor16shouldInsertTextERKNS_6StringEPNS_5RangeENS_18EditorInsertActionE
+__ZNK7WebCore5Frame11typingStyleEv
+__ZN7WebCore13TypingCommand10insertTextEPNS_8DocumentERKNS_6StringERKNS_16VisibleSelectionEbb
+__ZN7WebCore23BeforeTextInsertedEventC1ERKNS_6StringE
+__ZN7WebCore23BeforeTextInsertedEventC2ERKNS_6StringE
+__ZN7WebCore23BeforeTextInsertedEventD0Ev
+__ZN7WebCore13TypingCommandC1EPNS_8DocumentENS0_14ETypingCommandERKNS_6StringEbNS_15TextGranularityEb
+__ZN7WebCore13TypingCommandC2EPNS_8DocumentENS0_14ETypingCommandERKNS_6StringEbNS_15TextGranularityEb
+__ZN7WebCore20CompositeEditCommandC2EPNS_8DocumentE
+__ZN7WebCore11EditCommandC2EPNS_8DocumentE
+__ZN7WebCore25avoidIntersectionWithNodeERKNS_16VisibleSelectionEPNS_4NodeE
+__ZN7WebCore11EditCommand20setStartingSelectionERKNS_16VisibleSelectionE
+__ZN7WebCore11EditCommand18setEndingSelectionERKNS_16VisibleSelectionE
+__ZN7WebCore12applyCommandEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore11EditCommand5applyEv
+__ZNK7WebCore16VisibleSelection23isContentRichlyEditableEv
+__ZN7WebCore24isRichlyEditablePositionERKNS_8PositionE
+__ZNK7WebCore11HTMLElement23isContentRichlyEditableEv
+__ZNK7WebCore11EditCommand12updateLayoutEv
+__ZN7WebCore13TypingCommand7doApplyEv
+__ZN7WebCore13TypingCommand10insertTextERKNS_6StringEb
+__ZN7WebCore13TypingCommand28insertTextRunWithoutNewlinesERKNS_6StringEb
+__ZN7WebCore17InsertTextCommandC1EPNS_8DocumentE
+__ZN7WebCore17InsertTextCommandC2EPNS_8DocumentE
+__ZN7WebCore20CompositeEditCommand23applyCommandToCompositeEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore11EditCommand9setParentEPNS_20CompositeEditCommandE
+__ZN7WebCore17InsertTextCommand7doApplyEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE15reserveCapacityEm
+__ZN7WebCore17InsertTextCommand5inputERKNS_6StringEb
+__ZN7WebCore25lineBreakExistsAtPositionERKNS_8PositionE
+__ZN7WebCore12isEndOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore10endOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextERKNS_8PositionES3_
+__ZN7WebCore5Range21compareBoundaryPointsERKNS_8PositionES3_
+__ZN7WebCore20CompositeEditCommand38positionAvoidingSpecialElementBoundaryERKNS_8PositionE
+__ZN7WebCore22enclosingAnchorElementERKNS_8PositionE
+__ZN7WebCore17InsertTextCommand23prepareForTextInsertionERKNS_8PositionE
+__ZN7WebCore8Document21createEditingTextNodeERKNS_6StringE
+__ZN7WebCore11EditingTextC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore11EditingTextC2EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore20CompositeEditCommand12insertNodeAtEN3WTF10PassRefPtrINS_4NodeEEERKNS_8PositionE
+__ZN7WebCore20CompositeEditCommand16insertNodeBeforeEN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore23InsertNodeBeforeCommandC1EN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore23InsertNodeBeforeCommandC2EN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore23InsertNodeBeforeCommand7doApplyEv
+__ZN7WebCore11EditingText16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore20CompositeEditCommand18insertTextIntoNodeEN3WTF10PassRefPtrINS_4TextEEEjRKNS_6StringE
+__ZN7WebCore25InsertIntoTextNodeCommandC1EN3WTF10PassRefPtrINS_4TextEEEjRKNS_6StringE
+__ZN7WebCore25InsertIntoTextNodeCommandC2EN3WTF10PassRefPtrINS_4TextEEEjRKNS_6StringE
+__ZN7WebCore25InsertIntoTextNodeCommand7doApplyEv
+__ZN7WebCore13CharacterData10insertDataEjRKNS_6StringERi
+__ZN7WebCore6String6insertERKS0_j
+__ZN7WebCore6String6insertEPKtjj
+__ZN7WebCore8Document12textInsertedEPNS_4NodeEjj
+__ZN7WebCore5Range12textInsertedEPNS_4NodeEjj
+__ZN7WebCore20CompositeEditCommand21rebalanceWhitespaceAtERKNS_8PositionE
+__ZN7WebCore16VisibleSelection20setWithoutValidationERKNS_8PositionES3_
+__ZNK7WebCore8Position13computedStyleEv
+__ZNK7WebCore8Position7elementEv
+__ZNK7WebCore12RenderObject14nextInPreOrderEPS0_
+__ZNK7WebCore12RenderObject27nextInPreOrderAfterChildrenEPS0_
+__ZN7WebCore9InlineBox13nextLeafChildEv
+__ZN7WebCore13TypingCommand24typingAddedToOpenCommandEv
+__ZN7WebCore6Editor14appliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCoreL36dispatchEditableContentChangedEventsERKNS_11EditCommandE
+__ZN7WebCore6Editor27changeSelectionAfterCommandERKNS_16VisibleSelectionEbbPNS_11EditCommandE
+__ZN7WebCore31SimplifiedBackwardsTextIterator14handleTextNodeEv
+__ZNK7WebCore13TypingCommand20preservesTypingStyleEv
+__ZN7WebCore5Frame14setTypingStyleEPNS_26CSSMutableStyleDeclarationE
+__ZNK7WebCore13TypingCommand13editingActionEv
+__ZN7WebCore6Editor24respondToChangedContentsERKNS_16VisibleSelectionE
+__ZN7WebCore13TypingCommand27markMisspellingsAfterTypingEv
+__ZNK7WebCore13TypingCommand15isTypingCommandEv
+__ZN7WebCore9TextEventD0Ev
+__ZN7WebCore13KeyboardEventD0Ev
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE6shrinkEm
+__ZNK7WebCore17InsertTextCommand19isInsertTextCommandEv
+__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextEN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCore4Node16dispatchKeyEventERKNS_21PlatformKeyboardEventE
+__ZNK7WebCore4Node29traversePreviousNodePostOrderEPKS0_
+__ZN7WebCore10StringImpl7replaceEjjPS0_
+__ZN7WebCore6Editor37markMisspellingsAfterTypingToPositionERKNS_15VisiblePositionE
+__ZN7WebCore6Editor35isAutomaticQuoteSubstitutionEnabledEv
+__ZN7WebCore6Editor31isAutomaticLinkDetectionEnabledEv
+__ZN7WebCore6Editor34isAutomaticDashSubstitutionEnabledEv
+__ZN7WebCore6Editor33isAutomaticTextReplacementEnabledEv
+__ZN7WebCore6Editor36isAutomaticSpellingCorrectionEnabledEv
+__ZN7WebCoreL12nextBoundaryERKNS_15VisiblePositionEPFjPKtjjNS_33BoundarySearchContextAvailabilityERbE
+__ZN7WebCoreL15endWordBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCoreL29endOfFirstWordBoundaryContextEPKti
+__ZNK7WebCore12RenderObject11isTextFieldEv
+__ZN7WebCore6Editor13didEndEditingEv
+__ZN7WebCore13TypingCommandD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE6shrinkEm
+__ZN7WebCore17InsertTextCommandD0Ev
+__ZN7WebCore23InsertNodeBeforeCommandD0Ev
+__ZN7WebCore11EditCommandD2Ev
+__ZN7WebCore25InsertIntoTextNodeCommandD0Ev
+__ZN7WebCore15HTMLBaseElementD0Ev
+__ZN7WebCore11EditingTextD0Ev
+__ZN7WebCore4TextD2Ev
+__ZN7WebCore21HTMLBlockquoteElementD0Ev
+__ZN7WebCore13RootInlineBox23closestLeafChildForXPosEib
+__ZN7WebCore10RenderText16positionForPointERKNS_8IntPointE
+__ZNK7WebCore13InlineTextBox17offsetForPositionEib
+__ZNK7WebCore4Font17offsetForPositionERKNS_7TextRunEib
+__ZNK7WebCore4Font30offsetForPositionForSimpleTextERKNS_7TextRunEib
+__ZN7WebCore13WidthIterator19advanceOneCharacterERfPNS_11GlyphBufferE
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE14shrinkCapacityEm
+__ZN3WTF6VectorItLm2048EE14shrinkCapacityEm
+__ZN3WTF6VectorI6CGSizeLm2048EE14shrinkCapacityEm
+__ZN7WebCore20UserStyleSheetLoaderC1EN3WTF10PassRefPtrINS_8DocumentEEERKNS_6StringE
+__ZN7WebCore20UserStyleSheetLoaderC2EN3WTF10PassRefPtrINS_8DocumentEEERKNS_6StringE
+__ZN7WebCore9DocLoader24requestUserCSSStyleSheetERKNS_6StringES3_
+__ZN7WebCore5Cache24requestUserCSSStyleSheetEPNS_9DocLoaderERKNS_6StringES5_
+-[WebScriptObject callWebScriptMethod:withArguments:]
+-[WebScriptObject _isSafeScript]
+-[WebScriptObject _rootObject]
+__ZNK3JSC8Bindings10RootObject12globalObjectEv
+__ZNK7WebCore15JSDOMWindowBase16allowsAccessFromEPKN3JSC14JSGlobalObjectE
+-[WebScriptObject _imp]
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE6shrinkEm
+__ZNK7WebCore11FrameLoader14cancelledErrorERKNS_15ResourceRequestE
+__ZN7WebCore14DocumentLoader20setMainDocumentErrorERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader20setMainDocumentErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceLoader6cancelEv
+__ZN7WebCore14ResourceLoader6cancelERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceLoader14cancelledErrorEv
+__ZN7WebCore17SubresourceLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceHandle19clearAuthenticationEv
+__ZN7WebCore27AuthenticationChallengeBase7nullifyEv
+__ZN7WebCore14DocumentLoader27cancelPendingSubstituteLoadEPNS_14ResourceLoaderE
+__ZN7WebCore14ResourceHandle6cancelEv
+__ZN7WebCore20UserStyleSheetLoaderD0Ev
+__ZN7WebCore19CachedCSSStyleSheetD0Ev
+__ZN7WebCoreL30newStreamingTextDecoderUTF16BEERKNS_12TextEncodingEPKv
+__ZN7WebCore14TextCodecUTF166decodeEPKcmbbRb
+__ZN7WebCore14TextCodecUTF16D0Ev
+__ZN7WebCore20UserStyleSheetLoader16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore9CSSParser17createCharsetRuleERKNS_15CSSParserStringE
+__ZN7WebCore14CSSCharsetRuleC1EPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore14CSSCharsetRuleC2EPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore9StyleBase15isKeyframesRuleEv
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE6shrinkEm
+__ZN7WebCore14RenderMenuList11removeChildEPNS_12RenderObjectE
+__ZN7WebCore14RenderMenuListD0Ev
+__ZN7WebCore17RenderFlexibleBoxD2Ev
+__ZN7WebCore9PageGroup10removePageEPNS_4PageE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE6shrinkEm
+__ZN7WebCore15HTMLFontElementD0Ev
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE6shrinkEm
+__ZN7WebCore16HTMLInputElementD0Ev
+__ZN7WebCore16HTMLInputElement23needsActivationCallbackEv
+__ZN7WebCore22HTMLFormControlElement14removeFromFormEv
+__ZN7WebCore16InputElementDataD1Ev
+__ZN7WebCore16InputElementDataD2Ev
+__ZN7WebCore31HTMLFormControlElementWithStateD2Ev
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore22HTMLFormControlElementD2Ev
+__ZN7WebCore15HTMLImageLoaderD0Ev
+__ZN7WebCore28JSHTMLAnchorElementPrototypeD1Ev
+__ZThn8_N7WebCore17HTMLAnchorElementD0Ev
+__ZN7WebCore28JSHTMLSelectElementPrototypeD1Ev
+__ZN7WebCore19JSHTMLSelectElementD1Ev
+__ZThn8_N7WebCore17HTMLSelectElementD0Ev
+__ZN7WebCore17HTMLSelectElementD0Ev
+__ZN7WebCore17HTMLOptionElementD0Ev
+__ZN7WebCore17OptionElementDataD1Ev
+__ZN7WebCore17OptionElementDataD2Ev
+-[DOMNode hasAttributes]
+__ZNK7WebCore7Element13hasAttributesEv
+__ZN7WebCore20HTMLParagraphElementD0Ev
+__ZN7WebCore14CSSCharsetRuleD0Ev
+__ZN7WebCore8Document19hoveredNodeDetachedEPNS_4NodeE
+__ZN7WebCore11HTMLElement19isRecognizedTagNameERKNS_13QualifiedNameE
+__ZN7WebCore9HTMLNames11getHTMLTagsEPm
 __ZN7WebCore13RenderListBoxC1EPNS_17HTMLSelectElementE
-__ZN7WebCore13RenderListBox14styleDidChangeENS_11RenderStyle4DiffEPKS1_
+__ZN7WebCore13RenderListBoxC2EPNS_17HTMLSelectElementE
+__ZN7WebCore13RenderListBox14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZN7WebCore13RenderListBox17updateFromElementEv
 __ZNK7WebCore13RenderListBox8numItemsEv
 __ZN7WebCore13RenderListBox23setHasVerticalScrollbarEb
 __ZN7WebCore13RenderListBox15createScrollbarEv
+__ZN7WebCore14RenderThemeMac27scrollbarControlSizeForPartENS_11ControlPartE
+__ZN7WebCore9Scrollbar21createNativeScrollbarEPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeE
+__ZN7WebCore9ScrollbarC1EPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeEPNS_14ScrollbarThemeE
+__ZN7WebCore9ScrollbarC2EPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeEPNS_14ScrollbarThemeE
+__ZN7WebCore14ScrollbarTheme11nativeThemeEv
+__ZN7WebCore17ScrollbarThemeMacC1Ev
+__ZN7WebCore17ScrollbarThemeMacC2Ev
++[ScrollbarPrefsObserver registerAsObserver]
+__ZN7WebCore17ScrollbarThemeMac18preferencesChangedEv
+__ZN7WebCore17ScrollbarThemeMac17registerScrollbarEPNS_9ScrollbarE
+__ZN3WTF7HashSetIPN7WebCore9ScrollbarENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZN7WebCore17ScrollbarThemeMac18scrollbarThicknessENS_20ScrollbarControlSizeE
+__ZN7WebCore9Scrollbar9setParentEPNS_10ScrollViewE
+__ZN7WebCore6Widget16setParentVisibleEb
+__ZN7WebCore9Scrollbar12styleChangedEv
 __ZNK7WebCore13RenderListBox15canHaveChildrenEv
 __ZN7WebCore13RenderListBox16selectionChangedEv
-__ZN7WebCore13ContainerNode11appendChildEN3WTF10PassRefPtrINS_4NodeEEERib
-__ZN7WebCore4Node13checkAddChildEPS0_Ri
-__ZN7WebCoreL28dispatchChildInsertionEventsEPNS_4NodeERi
-__ZN7WebCore8Document19nodeChildrenChangedEPNS_13ContainerNodeE
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_16HTMLInputElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6expandEv
+__ZN7WebCore16HTMLInputElement10setCheckedEbb
+__ZNK7WebCore5Theme14controlPaddingENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
+__ZN7WebCoreL13checkboxSizesEv
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_16HTMLInputElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_16HTMLInputElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3
+__ZN7WebCoreL10radioSizesEv
 __ZN7WebCore13RenderListBox14calcPrefWidthsEv
 __ZN7WebCore13RenderListBox6layoutEv
 __ZNK7WebCore13RenderListBox22verticalScrollbarWidthEv
@@ -6609,27 +8340,48 @@
 __ZNK7WebCore13RenderListBox10itemHeightEv
 __ZNK7WebCore13RenderListBox4sizeEv
 __ZNK7WebCore13RenderListBox15numVisibleItemsEv
-__ZThn136_N7WebCore13RenderListBox23invalidateScrollbarRectEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore9Scrollbar10setEnabledEb
+__ZN7WebCore9Scrollbar14invalidateRectERKNS_7IntRectE
+__ZThn200_N7WebCore13RenderListBox23invalidateScrollbarRectEPNS_9ScrollbarERKNS_7IntRectE
 __ZN7WebCore13RenderListBox23invalidateScrollbarRectEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore9Scrollbar8setStepsEiii
+__ZN7WebCore9Scrollbar13setProportionEii
+__ZN7WebCore9Scrollbar21updateThumbProportionEv
+__ZN7WebCore23ScrollbarThemeComposite14invalidatePartEPNS_9ScrollbarENS_13ScrollbarPartE
+__ZN7WebCore17ScrollbarThemeMac9trackRectEPNS_9ScrollbarEb
+__ZN7WebCore17ScrollbarThemeMac10hasButtonsEPNS_9ScrollbarE
+__ZN7WebCore23ScrollbarThemeComposite10splitTrackEPNS_9ScrollbarERKNS_7IntRectERS3_S6_S6_
+__ZN7WebCore23ScrollbarThemeComposite31constrainTrackRectToTrackPiecesEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore23ScrollbarThemeComposite13thumbPositionEPNS_9ScrollbarE
+__ZN7WebCore23ScrollbarThemeComposite11thumbLengthEPNS_9ScrollbarE
 __ZNK7WebCore13RenderListBox14hasControlClipEv
 __ZN7WebCore13RenderListBox23scrollToRevealSelectionEv
 __ZNK7WebCore17HTMLSelectElement29activeSelectionStartListIndexEv
 __ZNK7WebCore17HTMLSelectElement27activeSelectionEndListIndexEv
-__ZNK7WebCore17HTMLSelectElement21lastSelectedListIndexEv
 __ZN7WebCore13RenderListBox18listIndexIsVisibleEi
 __ZNK7WebCore13RenderListBox16baselinePositionEbb
-__ZNK7WebCore11HistoryItem3urlEv
-__ZNK7WebCore11HistoryItem11originalURLEv
-__ZNK7WebCore9FrameTree4findERKNS_12AtomicStringE
-__ZN7WebCoreeqERKNS_12AtomicStringEPKc
+__ZN7WebCore23ScrollbarThemeComposite11trackLengthEPNS_9ScrollbarE
+__ZN7WebCore17ScrollbarThemeMac18minimumThumbLengthEPNS_9ScrollbarE
+__ZNK7WebCore11RenderTheme16baselinePositionEPKNS_12RenderObjectE
+__ZNK7WebCore8ThemeMac26baselinePositionAdjustmentENS_11ControlPartE
+__ZN7WebCore11RenderTable19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore15GraphicsContext17drawConvexPolygonEmPKNS_10FloatPointEb
+__ZNK7WebCore5Color4darkEv
 __ZN7WebCore13RenderListBox11paintObjectERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore14RenderThemeMac13paintTextAreaEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
 __ZN7WebCore13RenderListBox14paintScrollbarERNS_12RenderObject9PaintInfoEii
-__ZThn136_NK7WebCore13RenderListBox8isActiveEv
+__ZN7WebCore9Scrollbar12setFrameRectERKNS_7IntRectE
+__ZNK7WebCore9FrameView17windowResizerRectEv
+__ZNK7WebCore6Chrome17windowResizerRectEv
+__ZNK7WebCore6Widget27convertFromContainingWindowERKNS_7IntRectE
+__ZN7WebCore9Scrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore17ScrollbarThemeMac5paintEPNS_9ScrollbarEPNS_15GraphicsContextERKNS_7IntRectE
+__ZThn200_NK7WebCore13RenderListBox8isActiveEv
 __ZNK7WebCore13RenderListBox8isActiveEv
+__ZN7WebCore17ScrollbarThemeMac8hasThumbEPNS_9ScrollbarE
 __ZNK7WebCore13RenderListBox15controlClipRectEii
 __ZN7WebCore13RenderListBox19paintItemBackgroundERNS_12RenderObject9PaintInfoEiii
-__ZThn68_NK7WebCore17HTMLOptionElement8selectedEv
+__ZThn128_NK7WebCore17HTMLOptionElement8selectedEv
 __ZN7WebCore13RenderListBox19itemBoundingBoxRectEiii
 __ZNK7WebCore11RenderTheme39inactiveListBoxSelectionBackgroundColorEv
 __ZNK7WebCore14RenderThemeMac47platformInactiveListBoxSelectionBackgroundColorEv
@@ -6642,178 +8394,186 @@
 __ZNK7WebCore11RenderTheme39inactiveListBoxSelectionForegroundColorEv
 __ZNK7WebCore11RenderTheme40supportsListBoxSelectionForegroundColorsEv
 __ZNK7WebCore14RenderThemeMac47platformInactiveListBoxSelectionForegroundColorEv
-__ZN7WebCore5Frame14clearDOMWindowEv
-__ZN3WTF7HashSetIPN7WebCore9DOMWindowENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore11JSDOMWindow18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSDOMWindowBase16allowsAccessFromEPN3JSC9ExecStateE
-__ZN7WebCore18jsNavigatorAppNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13NavigatorBase7appNameEv
-__ZN7WebCore11JSDOMWindow3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore15JSDOMWindowBase3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore12AtomicString4findERKN3JSC10IdentifierE
-__ZNK3JSC6JSCell8isObjectEPKNS_9ClassInfoE
-__ZN7WebCore15HTMLLinkElement21finishParsingChildrenEv
-__ZN7WebCore16JSDOMWindowShell3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore15JSDOMWindowBase18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12AtomicString3addERKN3JSC10IdentifierE
-__ZNK7WebCore9FrameTree5childERKNS_12AtomicStringE
-__ZN7WebCore20JSDOMWindowPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore7Element8updateIdERKNS_12AtomicStringES3_
-__ZN7WebCore8Document14addElementByIdERKNS_12AtomicStringEPNS_7ElementE
-__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E8containsIS3_NS_22IdentityHashTranslatorIS3_S5_S9_EEEEbRKT_
-__ZN7WebCore15EventTargetNode16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCore7Element14createRareDataEv
-__ZN7WebCore15EventTargetNode19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCoreL8checkboxEjRKNS_7IntRectEf
+__ZN7WebCoreL15checkboxMarginsEm
+__ZN7WebCore36jsHTMLDocumentPrototypeFunctionWriteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSHTMLDocument5writeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL13documentWriteEPN3JSC9ExecStateERKNS0_7ArgListEPNS_12HTMLDocumentENS_18NewlineRequirementE
+__ZN7WebCore15SegmentedString21setExcludeLineNumbersEv
 __ZN7WebCore10HTMLParser11isHeaderTagERKNS_12AtomicStringE
 __ZNK7WebCore10HTMLParser8isInlineEPNS_4NodeE
-__ZN7WebCore11FrameLoader11completeURLERKNS_6StringE
-__ZN7WebCore11FrameLoader7loadURLERKNS_4KURLERKNS_6StringES6_NS_13FrameLoadTypeEPNS_5EventEN3WTF10PassRefPtrINS_9FormStateEEE
-__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEbN3WTF10PassRefPtrINS_5EventEEE
-__ZN7WebCoreL14navigationTypeENS_13FrameLoadTypeEbb
-__ZN7WebCore11FrameLoader24loadWithNavigationActionERKNS_15ResourceRequestERKNS_16NavigationActionENS_13FrameLoadTypeEN3WTF10PassRefPtrINS_9FormStateEEE
-__ZNK7WebCore7Element14getIDAttributeEv
-__ZN7WebCore12RenderInline9splitFlowEPNS_12RenderObjectEPNS_11RenderBlockES2_PNS_10RenderFlowE
-__ZN7WebCore11RenderBlock17setChildrenInlineEb
-__ZN7WebCore12RenderInline12splitInlinesEPNS_11RenderBlockES2_S2_PNS_12RenderObjectEPNS_10RenderFlowE
-__ZN7WebCore12RenderInline11cloneInlineEPNS_10RenderFlowE
-__ZN7WebCore10RenderFlow24addChildWithContinuationEPNS_12RenderObjectES2_
-__ZN7WebCore10RenderFlow18continuationBeforeEPNS_12RenderObjectE
-__ZNK7WebCore12RenderObject23createsAnonymousWrapperEv
+__ZThn8_N7WebCore20HTMLTableCellElementD0Ev
+__ZN7WebCore11RenderTable11splitColumnEii
+__ZN7WebCore18RenderTableSection11splitColumnEii
+__ZN7WebCore9FrameView14setMarginWidthEi
+__ZN7WebCore9FrameView15setMarginHeightEi
+__ZN7WebCore12RenderObject28addChildIgnoringContinuationEPS0_S1_
+__ZNK7WebCore11HistoryItem6targetEv
+__ZNK7WebCore13HTMLTokenizer14processingDataEv
 __ZN7WebCoreL19alternateFamilyNameERKNS_12AtomicStringE
-__ZN3JSC8Bindings10RootObject10invalidateEv
-__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEENS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EERKT_
--[WebScriptObject _setOriginRootObject:andRootObject:]
-__ZN3JSC8Bindings10RootObjectD1Ev
-__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSC_IS5_EEEESD_E4findIjNS_22IdentityHashTranslatorIjS6_SA_EEEENS_17HashTableIteratorIjS6_S8_SA_SF_SD_EERKT_
+__ZN7WebCore11BitmapImage20frameDurationAtIndexEm
+__ZN7WebCore18RenderTextFragment7destroyEv
+__ZN7WebCore18RenderTextFragmentD0Ev
+__ZN7WebCore12RenderButton11removeChildEPNS_12RenderObjectE
+__ZN7WebCore12RenderButtonD0Ev
+__ZNK7WebCore6String8toDoubleEPb
+__ZN7WebCore10StringImpl8toDoubleEPb
+__ZN7WebCore11FrameLoader23scheduleHTTPRedirectionEdRKNS_6StringE
+__ZN7WebCore11FrameLoader16isLocationChangeERKNS_20ScheduledRedirectionE
+__ZN7WebCore19inputElementAltTextEv
+__ZNK7WebCore13HTMLHRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore13HTMLHRElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore10HTMLParser19mapCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
 __ZN7WebCore14HTMLMapElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLMapElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore14HTMLMapElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore8Document14removeImageMapEPNS_14HTMLMapElementE
 __ZN7WebCore8Document11addImageMapEPNS_14HTMLMapElementE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLMapElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_14HTMLMapElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_E
 __ZNK7WebCore14HTMLMapElement17endTagRequirementEv
 __ZNK7WebCore14HTMLMapElement11tagPriorityEv
 __ZN7WebCore14HTMLMapElement8checkDTDEPKNS_4NodeE
 __ZN7WebCoreL15areaConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
 __ZN7WebCore15HTMLAreaElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLAreaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore15HTMLAreaElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore14newCoordsArrayERKNS_6StringERi
+__ZN7WebCoreL14countCharacterEPKtjt
+__ZN7WebCoreL11parseLengthEPKtj
+__ZN7WebCore21charactersToIntStrictEPKtmPbi
 __ZNK7WebCore15HTMLAreaElement17endTagRequirementEv
 __ZNK7WebCore15HTMLAreaElement11tagPriorityEv
-__ZN7WebCore17ScriptElementData15stopLoadRequestEv
-__ZN7WebCore15HTMLFormElement16removeImgElementEPNS_16HTMLImageElementE
-__ZN7WebCore11FrameLoader21startRedirectionTimerEv
-__ZNK7WebCore9TimerBase16nextFireIntervalEv
-__ZN7WebCore11FrameLoader16clientRedirectedERKNS_4KURLEddbb
-__ZNK7WebCore15DynamicNodeList4itemEj
-__ZNK7WebCore15DynamicNodeList23itemForwardsFromCurrentEPNS_4NodeEji
-__ZNK7WebCore12NamedAttrMap16getAttributeItemERKNS_6StringEb
-__ZNK7WebCore13QualifiedName8toStringEv
-__ZN7WebCore8Document14createTextNodeERKNS_6StringE
-__ZN7WebCore11FrameLoader33clientRedirectCancelledOrFinishedEb
+__ZNK7WebCore11BitmapImage10solidColorEv
+__ZN7WebCore5Image18fillWithSolidColorEPNS_15GraphicsContextERKNS_9FloatRectERKNS_5ColorENS_17CompositeOperatorE
+__ZN7WebCoreL5radioEjRKNS_7IntRectEf
+__ZN7WebCoreL12radioMarginsEm
 __ZN7WebCore5TimerINS_11BitmapImageEE5firedEv
 __ZN7WebCore11BitmapImage16advanceAnimationEPNS_5TimerIS0_EE
 __ZN7WebCore11BitmapImage24internalAdvanceAnimationEb
-__ZThn268_N7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
+__ZN7WebCore5TimerINS_11BitmapImageEED0Ev
+__ZThn392_N7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
 __ZN7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
 __ZN7WebCore20CachedResourceClient15willRenderImageEPNS_11CachedImageE
+__ZN7WebCore10HTMLParser24framesetCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL19framesetConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLFrameSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLFrameSetElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore19HTMLFrameSetElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore19HTMLFrameSetElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14newLengthArrayERKNS_6StringERi
+__ZNK7WebCore19HTMLFrameSetElement17endTagRequirementEv
+__ZNK7WebCore19HTMLFrameSetElement11tagPriorityEv
+__ZN7WebCore19HTMLFrameSetElement6attachEv
+__ZN7WebCore19HTMLFrameSetElement16rendererIsNeededEPNS_11RenderStyleE
+__ZNK7WebCore11RenderStyle16isStyleAvailableEv
+__ZN7WebCore19HTMLFrameSetElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderFrameSetC1EPNS_19HTMLFrameSetElementE
+__ZN7WebCore14RenderFrameSetC2EPNS_19HTMLFrameSetElementE
+__ZN7WebCore14RenderFrameSet8GridAxisC1Ev
+__ZN7WebCore14RenderFrameSet8GridAxisC2Ev
+__ZNK7WebCore14RenderFrameSet15virtualChildrenEv
+__ZN7WebCore19HTMLFrameSetElement8checkDTDEPKNS_4NodeE
+__ZNK7WebCore14RenderFrameSet10isFrameSetEv
+__ZN7WebCoreL16frameConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLFrameElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLFrameElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLFrameElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLFrameElement17endTagRequirementEv
+__ZNK7WebCore16HTMLFrameElement11tagPriorityEv
+__ZN7WebCore16HTMLFrameElement6attachEv
+__ZN7WebCore16HTMLFrameElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore16HTMLFrameElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderFrameC1EPNS_16HTMLFrameElementE
+__ZN7WebCore11RenderFrameC2EPNS_16HTMLFrameElementE
+__ZNK7WebCore14RenderFrameSet14isChildAllowedEPNS_12RenderObjectEPNS_11RenderStyleE
+__ZNK7WebCore11RenderFrame7isFrameEv
+__ZN7WebCore14RenderFrameSet15virtualChildrenEv
+__ZN3WTF6VectorIPN7WebCore5FrameELm16EE6shrinkEm
+__ZN7WebCore11RenderFrame11viewClearedEv
+__ZN7WebCore14RenderFrameSet6layoutEv
+__ZN7WebCore14RenderFrameSet8GridAxis6resizeEi
+__ZN7WebCore14RenderFrameSet10layOutAxisERNS0_8GridAxisEPKNS_6LengthEi
+__ZN7WebCore14RenderFrameSet14positionFramesEv
+__ZN7WebCore9RenderBox6layoutEv
+__ZN7WebCore14RenderFrameSet15computeEdgeInfoEv
+__ZN3WTF6VectorIbLm0EE4fillERKbm
+__ZSt4fillIPbbEvT_S1_RKT0_
+__ZNK7WebCore11RenderFrame8edgeInfoEv
+__ZN3WTF6VectorIbLm0EEaSERKS1_
+__ZN7WebCore14RenderFrameSet16fillFromEdgeInfoERKNS_13FrameEdgeInfoEii
+__ZNK7WebCore9RenderBox11overflowTopEb
+__ZNK7WebCore9RenderBox12overflowLeftEb
+__ZN7WebCore14RenderFrameSet5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore6Editor17insideVisibleAreaERKNS_8IntPointE
+__ZN7WebCore14RenderFrameSet11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore19HTMLFrameSetElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore14RenderFrameSet10userResizeEPNS_10MouseEventE
+__ZN7WebCore11RenderFrameD0Ev
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE6shrinkEm
+__ZN7WebCore14RenderFrameSetD0Ev
 __ZN7WebCore12RenderObject15willRenderImageEPNS_11CachedImageE
-__ZNK7WebCore15JSDOMWindowBase22scriptExecutionContextEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_4NodeE
-__ZN7WebCore23getCachedDOMNodeWrapperEPNS_8DocumentEPNS_4NodeE
-__ZN3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
-__ZN7WebCore9JSElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore12CachedScript4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
-__ZN7WebCore12CachedScript11checkNotifyEv
-__ZNK7WebCore26CachedScriptSourceProvider6lengthEv
-__ZN7WebCore12CachedScript6scriptEv
-__ZNK7WebCore15JSDOMWindowBase12toThisObjectEPN3JSC9ExecStateE
-__ZNK7WebCore15JSDOMWindowBase5shellEv
-__ZN7WebCore21jsNavigatorAppVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11JSNavigator10appVersionEPN3JSC9ExecStateE
-__ZNK7WebCore9Navigator10appVersionEv
-__ZNK7WebCore13NavigatorBase10appVersionEv
-__ZN7WebCore10HTMLParser29nestedPCloserCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCoreL13liConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore13HTMLLIElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore13HTMLLIElement17endTagRequirementEv
-__ZNK7WebCore13HTMLLIElement11tagPriorityEv
-__ZN7WebCore13HTMLLIElement6attachEv
-__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IiEEEESC_E8containsIS3_NS_22IdentityHashTranslatorIS3_S5_S9_EEEEbRKT_
-__ZN7WebCore18JSHTMLInputElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16jsDocumentCookieEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Document6cookieEv
-__ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
-__ZN7WebCoreL13filterCookiesEP7NSArray
-__ZN7WebCore14JSHTMLDocument3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore10JSDocument3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore17JSEventTargetNode3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore6JSNode3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
+__ZThn8_N7WebCore15HTMLHtmlElementD0Ev
+__ZThn8_N7WebCore15HTMLBodyElementD0Ev
+__ZN7WebCore10HTMLParser39handleResidualStyleCloseTagAcrossBlocksEPNS_13HTMLStackElemE
+__ZN7WebCore10HTMLParser19moveOneBlockToStackERPNS_13HTMLStackElemE
+__ZN7WebCore12NamedNodeMap13setAttributesERKS0_
+__ZN7WebCore18NamedMappedAttrMap15clearAttributesEv
+__ZN7WebCore12NamedNodeMap15clearAttributesEv
+__ZNK7WebCore15MappedAttribute5cloneEv
+__ZN7WebCore14JSHTMLDocument10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore6StringC1ERKN3JSC10IdentifierE
+__ZN7WebCore6StringC2ERKN3JSC10IdentifierE
+__ZN7WebCore8Document18documentNamedItemsERKNS_6StringE
+__ZN7WebCore18HTMLNameCollectionC1EN3WTF10PassRefPtrINS_8DocumentEEENS_14CollectionTypeERKNS_6StringE
+__ZN7WebCore18HTMLNameCollectionC2EN3WTF10PassRefPtrINS_8DocumentEEENS_14CollectionTypeERKNS_6StringE
+__ZN7WebCore8Document18nameCollectionInfoENS_14CollectionTypeERKNS_12AtomicStringE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CollectionCacheENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3
+__ZNK7WebCore18HTMLNameCollection9itemAfterEPNS_7ElementE
+__ZNK7WebCore14HTMLCollection9firstItemEv
+__ZN7WebCore18HTMLNameCollectionD0Ev
+__ZN7WebCore15HTMLFormElement15addElementAliasEPNS_22HTMLFormControlElementERKNS_12AtomicStringE
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS1_INS2_22HTMLFormControlElementEEENS_7PtrHashIS4_EENS_10HashTraitsI
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS1_INS2_22HTMLFormControlElementEEEENS_18PairFirstExtra
+__ZN7WebCore17JSHTMLFormElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS1_INS2_22HTMLFormControlElementEEENS_7PtrHashIS4_EENS_10HashTraits
 __ZN7WebCore15FormDataBuilder17parseEncodingTypeERKNS_6StringE
-__ZN7WebCore5TimerINS_12CachedScriptEE5firedEv
-__ZN7WebCore12CachedScript29decodedDataDeletionTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore12CachedScript18destroyDecodedDataEv
-__ZN7WebCoreL13ulConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLUListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16HTMLUListElement17endTagRequirementEv
-__ZNK7WebCore16HTMLUListElement11tagPriorityEv
+__ZN7WebCore15HTMLFormElement19removedFromDocumentEv
+__ZN7WebCore15HTMLFormElement16removeImgElementEPNS_16HTMLImageElementE
+__ZN7WebCore26JSHTMLFormElementPrototypeD1Ev
+__ZN7WebCore19HTMLFrameSetElementD0Ev
+__ZN7WebCore16HTMLFrameElementD0Ev
+__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointENS_17CompositeOperatorE
+__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointERKNS_7IntRectENS_17CompositeOperatorE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLMapElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3
+__ZN7WebCore14HTMLMapElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
+__ZN7WebCore15HTMLAreaElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
+__ZNK7WebCore15HTMLAreaElement9getRegionERKNS_7IntSizeE
+__ZN7WebCore4Path10addEllipseERKNS_9FloatRectE
+__ZNK7WebCore4Path8containsERKNS_10FloatPointENS_8WindRuleE
+__ZNK7WebCore4Path12boundingRectEv
+__ZN7WebCoreL34copyClosingSubpathsApplierFunctionEPvPK13CGPathElement
+__ZN7WebCore9PageCache11autoreleaseEN3WTF10PassRefPtrINS_10CachedPageEEE
+__ZN3WTF7HashSetINS_6RefPtrIN7WebCore10CachedPageEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore10CachedPageEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E
+__ZN7WebCore9PageCache17removeFromLRUListEPNS_11HistoryItemE
 __ZN7WebCore16HTMLInputElement37registerForActivationCallbackIfNeededEv
-__ZN7WebCore8Document38registerForDocumentActivationCallbacksEPNS_7ElementE
-__ZN3WTF7HashSetIPN7WebCore7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
 __ZNK7WebCore13HTMLTokenizer15isHTMLTokenizerEv
 __ZN7WebCore7Element26documentWillBecomeInactiveEv
-__ZN7WebCore11FrameLoader29loadedResourceFromMemoryCacheEPKNS_14CachedResourceE
-__ZN7WebCore19InspectorController30didLoadResourceFromMemoryCacheEPNS_14DocumentLoaderEPKNS_14CachedResourceE
-__ZN7WebCore4Node23compareDocumentPositionEPS0_
-__ZN3WTF6VectorIPN7WebCore4NodeELm16EE6shrinkEm
-__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE12insertBeforeERKS3_S8_
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore4NodeEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E4findIS6_NS_22IdentityHashTranslatorIS6_S6_SC_EEEENS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EERKT_
-__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE12insertBeforeENS_19ListHashSetIteratorIS3_S5_EERKS3_
-__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE16insertNodeBeforeEPNS_15ListHashSetNodeIS3_EES9_
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_14HTMLMapElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SB_EEEENS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCore8Document40unregisterForDocumentActivationCallbacksEPNS_7ElementE
-__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore20JSNavigatorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19setJSDocumentCookieEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore8Document9setCookieERKNS_6StringE
-__ZN7WebCore10setCookiesEPNS_8DocumentERKNS_4KURLES4_RKNS_6StringE
-__ZN7WebCoreL10isHTTPOnlyEP12NSHTTPCookie
-__ZNK7WebCore16HTMLUListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLUListElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE6shrinkEm
-__ZN7WebCore21setJSDOMWindowOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17JSDOMGlobalObject27findOrCreateJSEventListenerEPN3JSC9ExecStateENS1_10JSValuePtrEb
-__ZN7WebCore17JSDOMGlobalObject19findJSEventListenerEN3JSC10JSValuePtrEb
-__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore15JSEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
-__ZN7WebCore17JSDOMGlobalObject22jsInlineEventListenersEv
+__ZN7WebCore21DeprecatedPtrListImpl4prevEv
+__ZN7WebCore21setJSDOMWindowOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore9DOMWindow10setOnerrorEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN3WTF6VectorItLm512EE14expandCapacityEmPKt
-__ZN3WTF6VectorItLm512EE14expandCapacityEm
-__ZN3WTF6VectorItLm512EE15reserveCapacityEm
-__ZN7WebCore26JSEventTargetNodePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15JSNodePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore38jsDOMWindowPrototypeFunctionSetTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13toJSDOMWindowEN3JSC10JSValuePtrE
-__ZN7WebCore11JSDOMWindow10setTimeoutEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCoreL20setTimeoutOrIntervalEPN3JSC9ExecStateEPNS_11JSDOMWindowERKNS0_7ArgListEb
-__ZN7WebCore15JSDOMWindowBase14installTimeoutERKN3JSC7UStringEib
-__ZN7WebCore15JSDOMWindowBase14installTimeoutEPNS_15ScheduledActionEib
-__ZN7WebCore8DOMTimer7installEPNS_22ScriptExecutionContextEPNS_15ScheduledActionEib
-__ZN7WebCore8DOMTimerC1EPNS_22ScriptExecutionContextEPNS_15ScheduledActionEib
-__ZN7WebCore15ActiveDOMObjectC2EPNS_22ScriptExecutionContextEPv
-__ZN7WebCore22ScriptExecutionContext22createdActiveDOMObjectEPNS_15ActiveDOMObjectEPv
-__ZN3WTF7HashMapIPN7WebCore15ActiveDOMObjectEPvNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3addERKS3_RKS4_
-__ZN7WebCore8Document10addTimeoutEiPNS_8DOMTimerE
-__ZThn28_NK7WebCore8DOMTimer18hasPendingActivityEv
-__ZNK7WebCore8DOMTimer18hasPendingActivityEv
-__ZN7WebCore11JSNavigator4markEv
-__ZThn28_NK7WebCore8DOMTimer10canSuspendEv
+__ZThn8_N7WebCore19HTMLTableRowElementD0Ev
+__ZN7WebCore14HTMLMapElementD0Ev
+__ZN7WebCore15HTMLAreaElementD0Ev
+__ZN7WebCore17HTMLAnchorElementD2Ev
+__ZThn32_NK7WebCore8DOMTimer10canSuspendEv
 __ZNK7WebCore8DOMTimer10canSuspendEv
-__ZThn28_N7WebCore8DOMTimer7suspendEv
+__ZThn32_N7WebCore8DOMTimer7suspendEv
 __ZN7WebCore8DOMTimer7suspendEv
 __ZN7WebCoreL19basefontConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
 __ZN7WebCore19HTMLBaseFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLBaseFontElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore19HTMLBaseFontElement17endTagRequirementEv
 __ZNK7WebCore19HTMLBaseFontElement11tagPriorityEv
 __ZNK7WebCore18RenderTextFragment12originalTextEv
@@ -6824,111 +8584,56 @@
 __ZN7WebCore10StringImpl10capitalizeEt
 __ZN7WebCore17wordBreakIteratorEPKti
 __ZN7WebCore14textBreakFirstEPNS_17TextBreakIteratorE
+__ZNK7WebCore11RenderBlock20firstLineBoxBaselineEv
 __ZN7WebCore15RenderTableCell15setOverrideSizeEi
-__ZNK7WebCore13HTMLLIElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore13HTMLLIElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E8containsIS3_NS_22IdentityHashTranslatorIS3_S7_SB_EEEEbRKT_
-__ZN7WebCore16JSDOMWindowShell18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19jsDOMWindowLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow8locationEv
-__ZN7WebCore8LocationC1EPNS_5FrameE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8LocationE
-__ZN7WebCore10JSLocation15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore10JSLocationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8LocationEEE
-__ZN7WebCore10JSLocation18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore10JSLocation24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21allowsAccessFromFrameEPN3JSC9ExecStateEPNS_5FrameERNS_6StringE
-__ZN7WebCore13toJSDOMWindowEPNS_5FrameE
-__ZN7WebCore18jsLocationHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Location8hostnameEv
-__ZN7WebCore18jsLocationPathnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Location8pathnameEv
-__ZN7WebCore16jsLocationSearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Location6searchEv
-__ZNK7WebCore4KURL5queryEv
-__ZN7WebCore8Location15disconnectFrameEv
-__ZN7WebCore13jsDocumentURLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12NamedAttrMap14mapsEquivalentEPKS0_
-__ZN7WebCoreL16labelConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLLabelElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16HTMLLabelElement11tagPriorityEv
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9DOMWindowE
+__ZNK7WebCore6String11toIntStrictEPbi
+__ZN7WebCore10StringImpl11toIntStrictEPbi
+__ZN7WebCore4Node21setTabIndexExplicitlyEs
+__ZNK7WebCore12NamedNodeMap14mapsEquivalentEPKS0_
+__ZN7WebCore17HTMLScriptElement19removedFromDocumentEv
+__ZN7WebCore13ScriptElement19removedFromDocumentERNS_17ScriptElementDataE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCoreL28createHTMLAreaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLAreaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLAreaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLAreaElementEEE
+__ZN7WebCore17JSHTMLAreaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLAreaElementEEE
+__ZN7WebCoreL14isTableRelatedEPKNS_4NodeE
+__ZN7WebCoreL11isTablePartEPKNS_4NodeE
+__ZN7WebCore16HTMLLabelElementD0Ev
+__ZN7WebCore15jsDOMWindowSelfEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow4selfEv
 __ZNK7WebCore14RenderThemeMac25adjustMenuListButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
 __ZN7WebCore14RenderThemeMac19paintMenuListButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
 __ZN7WebCore14RenderThemeMac28paintMenuListButtonGradientsEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCoreL23MainGradientInterpolateEPvPKfPf
-__ZN7WebCoreL22TopGradientInterpolateEPvPKfPf
-__ZN7WebCoreL25BottomGradientInterpolateEPvPKfPf
+__ZN7WebCoreL23MainGradientInterpolateEPvPKdPd
+__ZN7WebCoreL22TopGradientInterpolateEPvPKdPd
+__ZN7WebCoreL25BottomGradientInterpolateEPvPKdPd
 __ZN7WebCore15GraphicsContext8drawLineERKNS_8IntPointES3_
-__ZN7WebCore6String6removeEji
-__ZN7WebCore19jsNavigatorLanguageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9Navigator8languageEv
-__ZN7WebCore15defaultLanguageEv
-__ZN7WebCore18jsNavigatorPluginsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9Navigator7pluginsEv
-__ZN7WebCore11PluginArrayC1EPNS_5FrameE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11PluginArrayE
-__ZN7WebCore13JSPluginArray15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore13JSPluginArrayC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11PluginArrayEEE
-__ZN7WebCore13JSPluginArray18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19jsPluginArrayLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11PluginArray6lengthEv
-__ZNK7WebCore11PluginArray13getPluginDataEv
-__ZNK7WebCore4Page10pluginDataEv
-__ZN7WebCore10PluginDataC1EPKNS_4PageE
-__ZN7WebCore10PluginData11initPluginsEv
-__ZN7WebCore39jsNavigatorPrototypeFunctionJavaEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore11JSNavigator9classInfoEv
-__ZNK7WebCore9Navigator11javaEnabledEv
-__ZN7WebCore17jsDOMWindowScreenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow6screenEv
-__ZN7WebCore6ScreenC1EPNS_5FrameE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_6ScreenE
-__ZN7WebCore8JSScreen15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore8JSScreenC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6ScreenEEE
-__ZN7WebCore8JSScreen18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore13jsScreenWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Screen5widthEv
-__ZN7WebCore10screenRectEPNS_6WidgetE
-__ZN7WebCore11toUserSpaceERK7_NSRectP8NSWindow
-__ZN7WebCore9FloatRectC1ERK7_NSRect
-__ZN7WebCore10FloatPointC1ERK8_NSPoint
-__ZN7WebCore9FloatSizeC1ERK7_NSSize
-__ZN7WebCore9FloatRect5scaleEf
-__ZN7WebCore14jsScreenHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Screen6heightEv
-__ZN7WebCore18jsScreenPixelDepthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Screen10pixelDepthEv
-__ZN7WebCore11screenDepthEPNS_6WidgetE
-__ZN7WebCore9CSSParser31createFloatingMediaQueryExpListEv
-__ZN7WebCore9CSSParser29sinkFloatingMediaQueryExpListEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
-__ZN7WebCore9CSSParser24createFloatingMediaQueryENS_10MediaQuery10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
-__ZN7WebCore10MediaQueryC1ENS0_10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
-__ZN7WebCore9CSSParser15createMediaListEv
-__ZN7WebCore9CSSParser22sinkFloatingMediaQueryEPNS_10MediaQueryE
-__ZN7WebCore9MediaList16appendMediaQueryEPNS_10MediaQueryE
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE15reserveCapacityEm
-__ZN7WebCore9CSSParser14createRuleListEv
-__ZN7WebCore11CSSRuleListC1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE15reserveCapacityEm
-__ZN7WebCore11CSSRuleList6appendEPNS_7CSSRuleE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE15reserveCapacityEm
-__ZN7WebCore9CSSParser15createMediaRuleEPNS_9MediaListEPNS_11CSSRuleListE
-__ZN7WebCore12CSSMediaRuleC1EPNS_13CSSStyleSheetEN3WTF10PassRefPtrINS_9MediaListEEENS4_INS_11CSSRuleListEEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE6shrinkEm
-__ZN7WebCore9StyleBase11isStyleRuleEv
-__ZN7WebCore12CSSMediaRule11isMediaRuleEv
-__ZNK7WebCore19MediaQueryEvaluator14mediaTypeMatchERKNS_6StringE
-__ZN7WebCoreL15applyRestrictorENS_10MediaQuery10RestrictorEb
-__ZN7WebCore16CSSStyleSelector16mapFillXPositionEPNS_9FillLayerEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector16mapFillYPositionEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore15GraphicsContext23addInnerRoundedRectClipERKNS_7IntRectEi
+__ZN7WebCore12RenderObject17drawArcForBoxSideEPNS_15GraphicsContextEiifNS_7IntSizeEiiNS_7BoxSideENS_5ColorERKS5_NS_12EBorderSty
+__ZN7WebCore15GraphicsContext9strokeArcERKNS_7IntRectEii
+__ZN7WebCore27JSHTMLInputElementPrototypeD1Ev
+__ZN7WebCore25JSHTMLCollectionPrototypeD1Ev
+__ZN7WebCore19JSHTMLAllCollectionD1Ev
+__ZN7WebCore5TimerINS_9PageCacheEE5firedEv
+__ZN7WebCore9PageCache39releaseAutoreleasedPagesNowOrRescheduleEPNS_5TimerIS0_EE
+__ZN7WebCore11FrameLoader23timeOfLastCompletedLoadEv
+__ZN7WebCore12userIdleTimeEv
+__ZN7WebCore38jsHTMLDocumentPrototypeFunctionWritelnEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSHTMLDocument7writelnEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore21HTMLBlockquoteElement17endTagRequirementEv
+__ZNK7WebCore21HTMLBlockquoteElement11tagPriorityEv
+__ZN7WebCore13HTMLHRElementD0Ev
+__ZN7WebCore13JSPluginArrayD1Ev
+__ZN7WebCore13JSPluginArrayD2Ev
+__ZN7WebCore8JSPluginD1Ev
+__ZN7WebCore8JSPluginD2Ev
+__ZN7WebCore6PluginD1Ev
+__ZN7WebCore6PluginD2Ev
+__ZN7WebCore6Screen15disconnectFrameEv
+__ZN7WebCore11PluginArrayD1Ev
 __ZN7WebCore16CSSStyleSelector17mapFillAttachmentEPNS_9FillLayerEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector13mapFillRepeatEPNS_9FillLayerEPNS_8CSSValueE
 __ZN7WebCore9FrameView20addSlowRepaintObjectEv
 __ZNK7WebCore12RenderObject8viewRectEv
 __ZN7WebCore14RenderFrameSet17paintColumnBorderERKNS_12RenderObject9PaintInfoERKNS_7IntRectE
@@ -6936,668 +8641,2037 @@
 __ZN7WebCoreL15borderFillColorEv
 __ZN7WebCoreL20borderStartEdgeColorEv
 __ZN7WebCoreL18borderEndEdgeColorEv
-__ZN7WebCore13RenderListBoxD1Ev
+__ZN7WebCore13RenderListBoxD0Ev
 __ZN7WebCore13RenderListBox16destroyScrollbarEv
-__ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_10JSValuePtrE
-__ZThn44_N7WebCore8Document15reportExceptionERKNS_6StringEiS3_
-__ZN7WebCore8Document15reportExceptionERKNS_6StringEiS3_
-__ZNK7WebCore9DOMWindow7consoleEv
-__ZN7WebCore7ConsoleC2EPNS_5FrameE
-__ZN7WebCore7Console10addMessageENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_
-__ZN7WebCore7Console21shouldPrintExceptionsEv
-__ZN7WebCore7Console15disconnectFrameEv
-__ZN7WebCore18jsDocumentLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore10JSDocument8locationEPN3JSC9ExecStateE
-__ZN7WebCore19JSLocationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore10JSLocation9classInfoEv
-__ZN7WebCore19HTMLBaseFontElementD1Ev
-__ZThn28_N7WebCore8DOMTimer4stopEv
+__ZN7WebCore9ScrollbarD0Ev
+__ZN7WebCore9Scrollbar17stopTimerIfNeededEv
+__ZN7WebCore17ScrollbarThemeMac19unregisterScrollbarEPNS_9ScrollbarE
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore8JSScreenD1Ev
+__ZN7WebCore8JSScreenD2Ev
+__ZN7WebCore10CachedPage5clearEv
+__ZN7WebCore11CachedFrameD1Ev
+__ZN7WebCore11CachedFrameD2Ev
+__ZN7WebCore11CachedFrame5clearEv
+__ZN7WebCore9FrameView10clearFrameEv
+__ZN7WebCore21ScriptCachedFrameDataD1Ev
+__ZN7WebCore21ScriptCachedFrameDataD2Ev
+__ZN7WebCore21ScriptCachedFrameData5clearEv
+__ZThn32_N7WebCore8DOMTimer4stopEv
 __ZN7WebCore8DOMTimer4stopEv
-__ZThn28_N7WebCore8DOMTimer16contextDestroyedEv
-__ZN7WebCore8DOMTimer16contextDestroyedEv
-__ZN7WebCore15ActiveDOMObject16contextDestroyedEv
-__ZN7WebCore8DOMTimerD1Ev
+__ZN7WebCore10CachedPageD1Ev
+__ZN7WebCore10CachedPageD2Ev
 __ZN7WebCore10PluginDataD1Ev
+__ZN7WebCore10PluginDataD2Ev
 __ZN3WTF15deleteAllValuesIPN7WebCore10PluginInfoELm0EEEvRKNS_6VectorIT_XT0_EEE
 __ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE6shrinkEm
 __ZN3WTF15deleteAllValuesIPN7WebCore13MimeClassInfoELm0EEEvRKNS_6VectorIT_XT0_EEE
 __ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE6shrinkEm
+__ZN7WebCore14HTMLPreElementD0Ev
+__ZThn8_N7WebCore16HTMLInputElementD0Ev
+__ZThn32_N7WebCore8DOMTimer16contextDestroyedEv
+__ZN7WebCore8DOMTimer16contextDestroyedEv
+__ZN7WebCore15ActiveDOMObject16contextDestroyedEv
+__ZN7WebCore19HTMLBaseFontElementD0Ev
+__ZN7WebCore19JSLocationPrototypeD1Ev
+__ZN7WebCore16HTMLDListElementD0Ev
+__ZN7WebCore12CSSMediaRuleD0Ev
 __ZN7WebCore10MediaQueryD1Ev
+__ZN7WebCore10MediaQueryD2Ev
 __ZN3WTF15deleteAllValuesIPN7WebCore13MediaQueryExpELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE6shrinkEm
-__ZN7WebCore12SharedBuffer22releasePurgeableBufferEv
-__ZNK7WebCore5Frame14isDisconnectedEv
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLMapElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
-__ZN7WebCore14HTMLMapElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
-__ZN7WebCore15HTMLAreaElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
-__ZNK7WebCore15HTMLAreaElement9getRegionERKNS_7IntSizeE
-__ZN7WebCore4Path10addEllipseERKNS_9FloatRectE
-__ZN7WebCore4PathaSERKS0_
-__ZNK7WebCore4Path8containsERKNS_10FloatPointENS_8WindRuleE
-__ZNK7WebCore4Path12boundingRectEv
-__ZN7WebCore9FloatRectC1ERK6CGRect
-__ZN7WebCore10FloatPointC1ERK7CGPoint
-__ZN7WebCore9FloatSizeC1ERK6CGSize
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE15reserveCapacityEm
-sqlite3DeleteFrom
-__ZN7WebCore12IconDatabase24checkForDanglingPageURLsEb
-__ZN7WebCore15SQLiteStatement23returnsAtLeastOneResultEv
-sqlite3ExprIfTrue
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE6shrinkEm
-__ZN7WebCore12IconDatabase20pruneUnretainedIconsEv
-__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_13PageURLRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E8containsIS2_NS_22IdentityHashTranslatorIS2_S6_S9_EEEEbRKT_
-__ZThn268_N7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
+__ZN7WebCore26JSHTMLAreaElementPrototypeD1Ev
+__ZN7WebCore17JSHTMLAreaElementD1Ev
+__ZThn8_N7WebCore15HTMLAreaElementD0Ev
+__ZN7WebCore22JSPluginArrayPrototypeD1Ev
+__ZN7WebCore17JSPluginPrototypeD1Ev
+__ZN7WebCore17JSScreenPrototypeD1Ev
+__ZN7WebCore15PurgeableBuffer6createEPKcm
+__ZN7WebCore15PurgeableBufferC1EPcm
+__ZN7WebCore15PurgeableBufferC2EPcm
+__ZN7WebCore15PurgeableBuffer13makePurgeableEb
+__ZN7WebCore12SharedBuffer20adoptPurgeableBufferEPNS_15PurgeableBufferE
+__ZNK7WebCore15PurgeableBuffer4dataEv
+__ZThn392_N7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
 __ZN7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
+__ZN7WebCore12SharedBuffer22releasePurgeableBufferEv
+__ZN7WebCore4Path7addRectERKNS_9FloatRectE
 __ZN7WebCore11BitmapImage22frameIsCompleteAtIndexEm
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore10CachedPageEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEENS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EERKT_
-__ZN7WebCore12RenderInlineC1EPNS_4NodeE
-__ZN7WebCore12RenderInline14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZNK7WebCore12RenderInline13requiresLayerEv
-__ZNK7WebCore12RenderInline14isRenderInlineEv
-__ZN7WebCore12RenderInline14addChildToFlowEPNS_12RenderObjectES2_
-__ZN7WebCore17SubresourceLoader7didFailERKNS_13ResourceErrorE
-__ZN7WebCore6Loader4Host7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZN7WebCore6Loader4Host7didFailEPNS_17SubresourceLoaderEb
-__ZN7WebCore11RenderImage22setImageSizeForAltTextEPNS_11CachedImageE
-__ZN7WebCoreL11brokenImageEv
-__ZN7WebCore5Image20loadPlatformResourceEPKc
-__ZNK7WebCore14RenderThemeMac17sizeForSystemFontEPNS_11RenderStyleEPKNS_7IntSizeE
-__ZNK7WebCore14RenderThemeMac24controlSizeForSystemFontEPNS_11RenderStyleE
-__ZNK7WebCore10RenderFlow19virtualContinuationEv
-__ZN7WebCore9FloatRectC1ERKNS_7IntRectE
-__ZN7WebCore10FloatPointC1ERKNS_8IntPointE
-__ZN7WebCore9FloatSizeC1ERKNS_7IntSizeE
-__ZNK7WebCore10RenderView20localToContainerQuadERKNS_9FloatQuadEPNS_9RenderBoxEb
-__ZNK7WebCore9FloatQuad11boundingBoxEv
-__ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
-__ZNK7WebCore11RenderLayer29subtractScrolledContentOffsetERiS1_
-__ZN7WebCore9RenderBox21computeRectForRepaintEPS0_RNS_7IntRectEb
-__ZNK7WebCore9RenderBox20localToContainerQuadERKNS_9FloatQuadEPS0_b
-__ZNK7WebCore9RenderBox19offsetFromContainerEPNS_12RenderObjectE
-__ZNK7WebCore10ScrollView11isOffscreenEv
-__ZNK7WebCore10ScrollView19platformIsOffscreenEv
-__ZN7WebCore10ScrollView23repaintContentRectangleERKNS_7IntRectEb
-__ZN7WebCore10ScrollView31platformRepaintContentRectangleERKNS_7IntRectEb
-__ZNK7WebCore7IntRectcv7_NSRectEv
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE6shrinkEm
-__ZN7WebCore9FrameView22updateDashboardRegionsEv
-__ZNK7WebCore9FrameView15useSlowRepaintsEv
-__ZN7WebCore9FrameView22performPostLayoutTasksEv
-__ZN7WebCore11FrameLoader14didFirstLayoutEv
-__ZN7WebCore10RenderView21updateWidgetPositionsEv
-__ZN7WebCore9FrameView21resumeScheduledEventsEv
-__ZN7WebCore9FrameView23dispatchScheduledEventsEv
-__ZNK7WebCore9FrameView10hostWindowEv
-__ZN7WebCore6Chrome7repaintERKNS_7IntRectEbbb
-__ZN7WebCore8Document13svgExtensionsEv
-__ZN7WebCore11FrameLoader17stopForUserCancelEb
-__ZN7WebCore15RenderContainer24updateBeforeAfterContentENS_11RenderStyle8PseudoIdE
-__ZN7WebCore15RenderContainer36updateBeforeAfterContentForContainerENS_11RenderStyle8PseudoIdEPS0_
-__ZNK7WebCore12RenderObject20getCachedPseudoStyleENS_11RenderStyle8PseudoIdEPS1_
-__ZN7WebCore15RenderContainer20beforeAfterContainerENS_11RenderStyle8PseudoIdE
-__ZNK7WebCore16JSDOMWindowShell9classNameEv
-__ZN7WebCore17jsDOMWindowLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow6lengthEv
-__ZN7WebCore44jsDOMWindowPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11JSDOMWindow16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore17JSDOMGlobalObject16jsEventListenersEv
-__ZN7WebCore8Document31addPendingFrameUnloadEventCountEv
-__ZN7WebCore12EventHandler31addPendingFrameUnloadEventCountEv
-__ZN7WebCore4Page29changePendingUnloadEventCountEi
-__ZN7WebCore6Chrome24disableSuddenTerminationEv
-__ZN7WebCore20jsDocumentReadyStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Document10readyStateEv
-__ZN7WebCore19jsStringOrUndefinedEPN3JSC9ExecStateERKNS_6StringE
-__ZN7WebCore15JSDOMWindowBase14installTimeoutEPN3JSC9ExecStateENS1_10JSValuePtrERKNS1_7ArgListEib
-__ZN7WebCore15ScheduledActionC1EPN3JSC9ExecStateENS1_10JSValuePtrERKNS1_7ArgListE
-__ZN7WebCore12RenderObject24repaintOverhangingFloatsEb
-__ZN7WebCore14jsEventKEYDOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12jsEventFOCUSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15jsEventDBLCLICKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12jsEventCLICKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16jsEventMOUSEOVEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15jsEventMOUSEOUTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15jsEventKEYPRESSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16jsEventMOUSEDRAGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16jsEventMOUSEDOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13jsEventSELECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsEventBUBBLING_PHASEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15jsEventDRAGDROPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore11jsEventBLUREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14jsEventMOUSEUPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16jsEventMOUSEMOVEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsEventCAPTURING_PHASEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13jsEventCHANGEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16jsEventAT_TARGETEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12jsEventKEYUPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15SQLiteStatement9bindInt64Eix
-sqlite3_bind_int64
-__ZN7WebCore14SQLiteDatabase15lastInsertRowIDEv
-sqlite3_last_insert_rowid
-__ZN7WebCore12IconDatabase33setIconURLForPageURLInSQLDatabaseERKNS_6StringES3_
-__ZN7WebCore15SQLiteStatement14getColumnInt64Ei
-sqlite3_column_int64
-__ZN7WebCore12IconDatabase32setIconIDForPageURLInSQLDatabaseExRKNS_6StringE
-__ZNK7WebCore9InlineBox14caretMinOffsetEv
-__ZNK7WebCore9InlineBox14caretMaxOffsetEv
-__ZNK7WebCore12RenderObject14caretMaxOffsetEv
-__ZN7WebCore11FrameLoader11urlSelectedERKNS_15ResourceRequestERKNS_6StringEPNS_5EventEbb
-__ZN7WebCore11FrameLoader22executeIfJavaScriptURLERKNS_4KURLEbb
-__ZN7WebCore11FrameLoader11urlSelectedERKNS_16FrameLoadRequestEPNS_5EventEb
-__ZN7WebCore11FrameLoader33loadFrameRequestWithFormAndValuesERKNS_16FrameLoadRequestEbPNS_5EventEPNS_15HTMLFormElementERKN3WTF7HashMapINS_6StringESA_NS_10StringHashENS8_10HashTraitsISA_EESD_EE
-__ZN7WebCore11FrameLoader22findFrameForNavigationERKNS_12AtomicStringE
-__ZNK7WebCore11FrameLoader21shouldAllowNavigationEPNS_5FrameE
-__ZN7WebCore14SecurityOrigin16createFromStringERKNS_6StringE
-__ZN7WebCore47jsDOMWindowPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11JSDOMWindow19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore8Document34removePendingFrameUnloadEventCountEv
-__ZN7WebCore12EventHandler34removePendingFrameUnloadEventCountEv
-__ZN7WebCore6Chrome23enableSuddenTerminationEv
-__ZNK7WebCore8Document8nodeNameEv
-__ZN7WebCore47jsDocumentPrototypeFunctionGetElementsByTagNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8NodeListE
-__ZN7WebCore10JSNodeList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore10JSNodeListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8NodeListEEE
-__ZN7WebCore10JSNodeList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZN7WebCore10JSNodeList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCoreL28createHTMLHeadElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLHeadElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSHTMLHeadElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHeadElementEEE
-__ZN7WebCoreL28createHTMLMetaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLMetaElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSHTMLMetaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMetaElementEEE
-__ZN7WebCoreL29createHTMLTitleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLTitleElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLTitleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTitleElementEEE
-__ZN7WebCoreL28createHTMLBodyElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLBodyElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSHTMLBodyElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBodyElementEEE
-__ZN7WebCore10JSNodeList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore10JSNodeList18canGetItemsForNameEPN3JSC9ExecStateEPNS_8NodeListERKNS1_10IdentifierE
-__ZNK7WebCore15DynamicNodeList12itemWithNameERKNS_12AtomicStringE
-__ZN7WebCore19JSNodeListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25jsHTMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSHTMLDocument14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore23JSHTMLDocumentPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore17JSHTMLHtmlElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore17JSHTMLHeadElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore17JSHTMLMetaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSHTMLMetaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore18JSHTMLTitleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLTitleElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore17JSHTMLLinkElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore17JSHTMLBodyElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSHTMLBodyElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore15JSHTMLBRElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore22jsHTMLUListElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLUListElement4typeEv
-__ZN7WebCore39jsDOMWindowPrototypeFunctionSetIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11JSDOMWindow11setIntervalEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore6Loader4HostD1Ev
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_6Loader4HostEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SC_EEEENS_17HashTableIteratorIS3_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore10JSNodeListD0Ev
-__ZN7WebCore16HTMLTitleElement19removedFromDocumentEv
-__ZN7WebCore8Document11removeTitleEPNS_7ElementE
-__ZN7WebCore15HTMLLinkElement19removedFromDocumentEv
-__ZN7WebCore18JSHTMLTitleElementD0Ev
-__ZN7WebCore16JSHTMLDivElementD0Ev
-__ZN7WebCore25JSHTMLDocumentConstructorD0Ev
-__ZN7WebCore19jsNodeOwnerDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4Node30notifyNodeListsChildrenChangedEv
-__ZN7WebCore4Node35notifyLocalNodeListsChildrenChangedEv
-__ZN7WebCore34jsNodePrototypeFunctionAppendChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore16JSHTMLDivElement9classInfoEv
-__ZN7WebCore6JSNode11appendChildEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore6toNodeEN3JSC10JSValuePtrE
-__ZN7WebCore17NodeListsNodeData16invalidateCachesEv
-__ZN7WebCore15DynamicNodeList6Caches5resetEv
-__ZN7WebCore17NodeListsNodeData38invalidateCachesThatDependOnAttributesEv
-__ZNK7WebCore17NodeListsNodeData7isEmptyEv
-__ZN7WebCore6JSText15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore24JSCharacterDataPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore15JSCharacterData15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore6JSTextC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4TextEEE
-__ZN7WebCore15JSCharacterDataC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CharacterDataEEE
-__ZNK7WebCore4Text8nodeNameEv
-__ZNK7WebCore6JSText9classInfoEv
-__ZNK7WebCore22JSHTMLParagraphElement9classInfoEv
-__ZN7WebCore27jsHTMLDivElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSHTMLDivElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSHTMLDivElementPrototype4selfEPN3JSC9ExecStateE
-__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN7WebCore19JSHTMLIFrameElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore14jsDocumentBodyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17JSHTMLBodyElement9classInfoEv
-__ZNK7WebCore19JSHTMLIFrameElement9classInfoEv
-__ZN7WebCore20HTMLFrameElementBase13canLazyAttachEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE15reserveCapacityEm
-__ZN7WebCore14jsDOMWindowTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow3topEv
-__ZN7WebCore20setJSDOMWindowOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow9setOnloadEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore7Element14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore17HTMLAnchorElement14isURLAttributeEPNS_9AttributeE
-__ZN7WebCoreL29appendQuotedURLAttributeValueERN3WTF6VectorItLm0EEERKNS_6StringE
-__ZNK7WebCore16HTMLImageElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore16HTMLTableElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore20HTMLTableCellElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore16HTMLInputElement14isURLAttributeEPNS_9AttributeE
-__ZN7WebCore29jsDOMWindowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9JSElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore20JSElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore37jsDOMWindowHTMLFormElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSHTMLFormElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSHTMLFormElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLInputElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLInputElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLInputElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore41jsDOMWindowHTMLTextAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21JSHTMLTextAreaElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore30JSHTMLTextAreaElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore21JSHTMLTextAreaElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore39jsDOMWindowHTMLSelectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLSelectElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSHTMLSelectElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore19JSHTMLSelectElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore27jsDOMWindowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7JSEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore16JSEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore24JSHTMLElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20StringSourceProvider8getRangeEii
-__ZN7WebCore28JSHTMLFormElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLInputElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSHTMLTextAreaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSHTMLSelectElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30jsDOMWindowDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10JSDocument14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore21JSDocumentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33setJSDOMWindowDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN3JSC8JSObject9putDirectERKNS_10IdentifierENS_10JSValuePtrEj
-__ZN7WebCore30setJSDOMWindowEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore32setJSDOMWindowElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore41jsDocumentPrototypeFunctionCreateTextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_4TextE
-__ZN7WebCore26jsDOMWindowNodeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore6JSNode14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore17JSNodeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18jsNodeELEMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20JSElementConstructor9classInfoEv
-__ZN7WebCore18JSEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24jsHTMLDocumentCompatModeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12HTMLDocument10compatModeEv
-__ZN7WebCore18jsDOMWindowConsoleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7ConsoleE
-__ZN7WebCore9JSConsole15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore9JSConsoleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ConsoleEEE
-__ZN7WebCore9JSConsole18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSConsolePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore38jsElementPrototypeFunctionGetAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore7Element12getAttributeERKNS_6StringE
-__ZN7WebCore25jsDOMWindowOnbeforeunloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow14onbeforeunloadEv
-__ZN7WebCore8Document32windowInlineEventListenerForTypeERKNS_12AtomicStringE
-__ZN7WebCore28setJSDOMWindowOnbeforeunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow17setOnbeforeunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore8Document37addPendingFrameBeforeUnloadEventCountEv
-__ZN7WebCore12EventHandler37addPendingFrameBeforeUnloadEventCountEv
-__ZN7WebCore4Page35changePendingBeforeUnloadEventCountEi
-__ZN7WebCore19jsDOMWindowOnunloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow8onunloadEv
-__ZN7WebCore22setJSDOMWindowOnunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow11setOnunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore38jsDocumentPrototypeFunctionExecCommandEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore37valueToStringWithUndefinedOrNullCheckEPN3JSC9ExecStateENS0_10JSValuePtrE
-__ZN7WebCore8Document11execCommandERKNS_6StringEbS3_
-__ZN7WebCoreL7commandEPNS_8DocumentERKNS_6StringEb
-__ZN7WebCore6Editor7CommandC1Ev
-__ZN7WebCore21jsHTMLElementChildrenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore11HTMLElement8childrenEv
-__ZNK7WebCore22HTMLFormControlElement16isMouseFocusableEv
-__ZNK7WebCore16HTMLInputElement17canStartSelectionEv
-__ZN7WebCore12EventHandler12mouseDraggedEP7NSEvent
-__ZN7WebCore12EventHandler27eventLoopHandleMouseDraggedERKNS_28MouseEventWithHitTestResultsE
-__ZNK7WebCore12JSMouseEvent9classInfoEv
-__ZNK7WebCore21JSMouseEventPrototype9classInfoEv
-__ZNK7WebCore18JSUIEventPrototype9classInfoEv
-__ZN7WebCore12JSMouseEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21jsMouseEventToElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore10MouseEvent9toElementEv
-__ZN7WebCore18jsMouseEventButtonEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13jsMouseEventYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17MouseRelatedEvent1yEv
-__ZN7WebCore25jsMouseEventRelatedTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsMouseEventClientXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsMouseEventOffsetXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsMouseEventAltKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsMouseEventScreenXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsMouseEventShiftKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsMouseEventClientYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13jsMouseEventXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17MouseRelatedEvent1xEv
-__ZN7WebCore19jsMouseEventCtrlKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsMouseEventScreenYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsMouseEventMetaKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsMouseEventOffsetYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsMouseEventFromElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore10MouseEvent11fromElementEv
-__ZN7WebCore24jsMouseEventDataTransferEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore10MouseEvent11isDragEventEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9ClipboardE
-__ZN7WebCore9JSUIEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore14jsUIEventWhichEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore10MouseEvent5whichEv
-__ZN7WebCore15jsUIEventLayerXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17MouseRelatedEvent6layerXEv
-__ZN7WebCore16jsUIEventKeyCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7UIEvent7keyCodeEv
-__ZN7WebCore17jsUIEventCharCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7UIEvent8charCodeEv
-__ZN7WebCore13jsUIEventViewEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14jsUIEventPageYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15jsUIEventLayerYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17MouseRelatedEvent6layerYEv
-__ZN7WebCore14jsUIEventPageXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15jsUIEventDetailEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21JSMouseEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSUIEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24jsHTMLElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsHTMLParagraphElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22JSHTMLParagraphElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore31JSHTMLParagraphElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore22JSHTMLParagraphElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore29jsHTMLOListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLOListElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLOListElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLOListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore39jsElementPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore4Page18removeSchedulePairEN3WTF10PassRefPtrINS_12SchedulePairEEE
+__ZN7WebCore14DocumentLoader10unscheduleEPNS_12SchedulePairE
+__ZN7WebCoreL13unscheduleAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEEPNS_12
+-[DOMStyleSheetList item:]
+__Z3kitPN7WebCore10StyleSheetE
+__Z8kitClassPN7WebCore10StyleSheetE
+-[DOMCSSStyleSheet cssRules]
+__Z3kitPN7WebCore11CSSRuleListE
+-[DOMCSSRuleList length]
+-[DOMCSSStyleSheet insertRule:index:]
+__ZN7WebCore13CSSStyleSheet10insertRuleERKNS_6StringEjRi
+__ZN7WebCore9CSSParser9parseRuleEPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore9StyleList6insertEjN3WTF10PassRefPtrINS_9StyleBaseEEE
+__ZN7WebCore13CSSStyleSheet17styleSheetChangedEv
+-[DOMCSSRuleList item:]
+__Z3kitPN7WebCore7CSSRuleE
+__Z8kitClassPN7WebCore7CSSRuleE
+-[DOMCSSStyleRule style]
+-[DOMCSSStyleDeclaration setCssText:]
+__ZN7WebCore26CSSMutableStyleDeclaration10setCssTextERKNS_6StringERi
+-[DOMElement clientHeight]
+__ZN7WebCore7Element12clientHeightEv
+-[DOMDocument createDocumentFragment]
+-[DOMNode lastChild]
+-[DOMElement getElementsByTagName:]
+-[DOMHTMLElement setInnerHTML:]
+-[DOMStyleSheet ownerNode]
+-[DOMNode setTextContent:]
+__ZN7WebCore4Node14setTextContentERKNS_6StringERi
+-[DOMCSSStyleRule selectorText]
+__ZNK7WebCore11RenderTable20firstLineBoxBaselineEv
+__ZNK7WebCore18RenderTableSection20firstLineBoxBaselineEv
+__ZN7WebCore16MIMETypeRegistry24isSupportedImageMIMETypeERKNS_6StringE
+-[DOMNode replaceChild:oldChild:]
+__ZN7WebCore17HTMLObjectElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore17HTMLObjectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore16MIMETypeRegistry20isJavaAppletMIMETypeERKNS_6StringE
+__ZNK3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E8conta
+__ZN7WebCoreL12isURLAllowedEPNS_8DocumentERKNS_6StringE
+__ZNK7WebCore17HTMLPlugInElement4nameEv
+__ZN7WebCore11FrameLoader13requestObjectEPNS_10RenderPartERKNS_6StringERKNS_12AtomicStringES5_RKN3WTF6VectorIS3_Lm0EEESD_
+__ZN7WebCore11FrameLoader15shouldUsePluginERKNS_4KURLERKNS_6StringEbRb
+__ZN7WebCore11FrameLoader10loadPluginEPNS_10RenderPartERKNS_4KURLERKNS_6StringERKN3WTF6VectorIS6_Lm0EEESD_b
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E15deall
+__ZNK7WebCore14CachedResource9wasPurgedEv
+-[DOMCSSRuleList dealloc]
+-[DOMCSSRule dealloc]
+-[DOMStyleSheet dealloc]
+__ZN7WebCore4PairD0Ev
+__ZN7WebCore11ShadowValueD0Ev
+-[DOMHTMLElement innerHTML]
+__ZN7WebCore21HTMLFrameOwnerElement10willRemoveEv
+__ZN7WebCore10RenderView12removeWidgetEPNS_12RenderWidgetE
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN7WebCore16ScriptController29cleanupScriptObjectsForPluginEPv
+__ZN3WTF9HashTableIPvSt4pairIS1_NS_6RefPtrIN3JSC8Bindings10RootObjectEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS1_EENS_14Pai
+__ZN7WebCore17HTMLObjectElement19removedFromDocumentEv
+-[DOMNode removeChild:]
+__ZN7WebCore14RenderTableRow29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore17HTMLObjectElementD0Ev
+__ZN7WebCore22HTMLPlugInImageElementD2Ev
+__ZN7WebCore17HTMLPlugInElementD2Ev
+__ZN7WebCore33setDefaultThreadViolationBehaviorENS_23ThreadViolationBehaviorENS_20ThreadViolationRoundE
+__ZN7WebCore11FrameLoader18setLocalLoadPolicyENS0_15LocalLoadPolicyE
+__ZN7WebCore18MainResourceLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader25receivedMainResourceErrorERKNS_13ResourceErrorEb
+__ZN7WebCore11FrameLoader4stopEv
+__ZNK7WebCore17ResourceErrorBase8lazyInitEv
+__ZN7WebCore13ResourceError16platformLazyInitEv
+__ZN7WebCore11FrameLoader31invalidateCurrentItemCachedPageEv
+__ZN7WebCore14DocumentLoader17mainReceivedErrorERKNS_13ResourceErrorEb
+__ZN7WebCore11FrameLoader25mainReceivedCompleteErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader20clearProvisionalLoadEv
+-[DOMNode finalize]
+-[WebScriptObject finalize]
+__ZN7WebCore13HTMLTokenizer26parseProcessingInstructionERNS_15SegmentedStringENS0_5StateE
+__ZN7WebCore9CSSParser24parseTransitionShorthandEb
+__ZN7WebCore9CSSParser22parseAnimationPropertyEv
+__ZN7WebCore9CSSParser17addAnimationValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
+__ZN7WebCore11FrameLoader10gotoAnchorERKNS_6StringE
+__ZN7WebCore8Document10findAnchorERKNS_6StringE
+__ZNK7WebCore17HTMLAnchorElement4nameEv
+__ZN7WebCore8Document12setCSSTargetEPNS_7ElementE
+__ZNK7WebCore13ContainerNode7getRectEv
+__ZNK7WebCore13ContainerNode18getUpperLeftCornerERNS_10FloatPointE
+__ZNK7WebCore13ContainerNode19getLowerRightCornerERNS_10FloatPointE
+__ZN7WebCore39jsElementPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore4Node13querySelectorERKNS_6StringERi
 __ZN7WebCore9CSSParser13parseSelectorERKNS_6StringEPNS_8DocumentERNS_15CSSSelectorListE
 __ZN7WebCoreL32selectorNeedsNamespaceResolutionERKNS_15CSSSelectorListE
 __ZN7WebCoreL18forEachTagSelectorINS_39SelectorNeedsNamespaceResolutionFunctorEEEbRT_PNS_11CSSSelectorE
-__ZN7WebCore43jsDocumentPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore43jsDocumentPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore4Node16querySelectorAllERKNS_6StringERi
 __ZN7WebCore22createSelectorNodeListEPNS_4NodeERKNS_15CSSSelectorListE
 __ZNK7WebCore16CSSStyleSelector15SelectorChecker13checkSelectorEPNS_11CSSSelectorEPNS_7ElementE
 __ZNK7WebCore14StaticNodeList6lengthEv
 __ZNK7WebCore14StaticNodeList12itemWithNameERKNS_12AtomicStringE
+-[DOMHTMLElement innerText]
+__ZNK7WebCore7Element9innerTextEv
+-[DOMDocument createExpression:resolver:]
+__ZN7WebCore8Document16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
+__ZN7WebCore5XPath12LocationPath15insertFirstStepEPNS0_4StepE
+__Z3kitPN7WebCore15XPathExpressionE
+-[DOMXPathExpression evaluate:type:inResult:]
+__Z4coreP14DOMXPathResult
+__Z3kitPN7WebCore11XPathResultE
+-[DOMXPathResult iterateNext]
+__ZN7WebCore11XPathResult11iterateNextERi
+-[WebCoreSharedBufferData finalize]
+-[DOMXPathExpression finalize]
+-[DOMXPathResult finalize]
+-[DOMNodeList finalize]
+__ZNK7WebCore13HitTestResult16absoluteImageURLEv
+__ZNK7WebCore13HitTestResult17isContentEditableEv
+__ZNK7WebCore13HitTestResult5imageEv
+__ZNK7WebCore13HitTestResult18titleDisplayStringEv
+__ZN7WebCore13displayStringERKNS_6StringEPKNS_4NodeE
+__ZNK7WebCore13HitTestResult11textContentEv
+__ZNK7WebCore13HitTestResult9imageRectEv
+__ZNK7WebCore13HitTestResult16altDisplayStringEv
+__ZNK7WebCore13HitTestResult10isLiveLinkEv
+__ZNK7WebCore17HTMLAnchorElement10isLiveLinkEv
+__ZN7WebCore11FrameLoader19requestFromDelegateERNS_15ResourceRequestERmRNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader29sendRemainingDelegateMessagesEmRKNS_16ResourceResponseEiRKNS_13ResourceErrorE
+__ZN7WebCore14StaticNodeListD0Ev
+__ZNK7WebCore16StyleCachedImage13errorOccurredEv
+__ZN7WebCore16RenderListMarker12imageChangedEPvPKNS_7IntRectE
 __ZNK7WebCore14StaticNodeList4itemEj
-__ZN7WebCore14StaticNodeListD1Ev
-__ZN7WebCore53jsEventTargetNodePrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore17JSEventTargetNode19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore28setJSHTMLAnchorElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement9setTargetERKNS_12AtomicStringE
+__ZN7WebCore15GraphicsContext15fillRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_RKNS_5ColorE
+__ZN7WebCore15GraphicsContext7addPathERKNS_4PathE
+__ZN7WebCore15GraphicsContext8fillPathEv
+__ZNK7WebCore15GraphicsContext8fillRuleEv
+__ZN7WebCore24JSHTMLElementConstructorD1Ev
+__ZN7WebCore24JSCharacterDataPrototypeD1Ev
+__ZN7WebCore15JSTextPrototypeD1Ev
+__ZN7WebCore17JSNodeConstructorD1Ev
+__ZN7WebCore20JSElementConstructorD1Ev
+__ZN7WebCore18JSEventConstructorD1Ev
+__ZN7WebCore28JSHTMLFormElementConstructorD1Ev
+__ZN7WebCore29JSHTMLInputElementConstructorD1Ev
+__ZN7WebCore30JSHTMLSelectElementConstructorD1Ev
+__ZN7WebCore32JSHTMLTextAreaElementConstructorD1Ev
+__ZN7WebCore30JSHTMLTextAreaElementPrototypeD1Ev
+__ZN7WebCore30JSCSSStyleDeclarationPrototypeD1Ev
+__ZN7WebCore15JSHTMLLIElementD1Ev
+__ZN7WebCore11FrameLoader20checkNewWindowPolicyERKNS_16NavigationActionERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateE
+__ZN7WebCore11PolicyCheck3setERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEPFvPvS3_S7_SA_bESB_
+__ZN7WebCore11FrameLoader28continueAfterNewWindowPolicyENS_12PolicyActionE
+__ZN7WebCore11FrameLoader36callContinueLoadAfterNewWindowPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS
+__ZN7WebCore11FrameLoader32continueLoadAfterNewWindowPolicyERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6Stri
+__ZN7WebCore11RenderStyle17accessTransitionsEv
+__ZN7WebCore16CSSStyleSelector20mapAnimationPropertyEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore24JSHTMLLIElementPrototypeD1Ev
+__ZN7WebCore29JSHTMLHeadingElementPrototypeD1Ev
+-[DOMRange finalize]
+__ZN7WebCore11FrameLoader47callContinueFragmentScrollAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormS
+__ZN7WebCore11FrameLoader43continueFragmentScrollAfterNavigationPolicyERKNS_15ResourceRequestEb
+__ZN7WebCore14DocumentLoader32replaceRequestURLForAnchorScrollERKNS_4KURLE
+__ZN7WebCore19ResourceRequestBase6setURLERKNS_4KURLE
+__ZN7WebCore11FrameLoader31addHistoryItemForFragmentScrollEv
+__ZN7WebCore11FrameLoader14scrollToAnchorERKNS_4KURLE
+__ZN7WebCore11FrameLoader28updateHistoryForAnchorScrollEv
+__ZNK7WebCore6Editor7Command11isSupportedEv
+__ZN7WebCoreL9supportedEPNS_5FrameENS_19EditorCommandSourceE
+__ZNK7WebCore6Editor7Command5stateEPNS_5EventE
+__ZN7WebCoreL9stateNoneEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor7Command9isEnabledEPNS_5EventE
+__ZN7WebCoreL10enabledCutEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore6Editor11canDHTMLCutEv
+__ZN7WebCore6Editor16dispatchCPPEventERKNS_12AtomicStringENS_21ClipboardAccessPolicyE
+__ZN7WebCore6Editor19newGeneralClipboardENS_21ClipboardAccessPolicyE
+__ZN7WebCore14ClipboardEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9ClipboardEEE
+__ZN7WebCore14ClipboardEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9ClipboardEEE
+__ZN7WebCore9Clipboard15setAccessPolicyENS_21ClipboardAccessPolicyE
+__ZN7WebCore14ClipboardEventD0Ev
+__ZNK7WebCore6Editor6canCutEv
+__ZNK7WebCore6Editor7canCopyEv
+__ZN7WebCoreL29imageElementFromImageDocumentEPNS_8DocumentE
+__ZN7WebCoreL11enabledCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore6Editor12canDHTMLCopyEv
+__ZN7WebCore6Editor13canDHTMLPasteEv
+__ZNK7WebCore6Editor8canPasteEv
+__ZN7WebCoreL13enabledDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL7enabledEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL14stateUnderlineEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL10stateStyleEPNS_5FrameEiPKc
+__ZNK7WebCore6Editor17selectionHasStyleEPNS_19CSSStyleDeclarationE
+__ZN7WebCore26CSSMutableStyleDeclaration11makeMutableEv
+__ZNK7WebCore5Frame22selectionComputedStyleERPNS_4NodeE
+__ZNK7WebCore5Range20editingStartPositionEv
+__ZN7WebCoreL11updateStateEPNS_26CSSMutableStyleDeclarationEPNS_27CSSComputedStyleDeclarationERbRNS_8TriStateE
+__ZNK7WebCore26CSSMutableStyleDeclaration16getPropertyValueEi
+__ZN7WebCoreL27enabledInRichlyEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZNK7WebCore4Node23isContentRichlyEditableEv
+__ZN7WebCoreL29supportedFromMenuOrKeyBindingEPNS_5FrameENS_19EditorCommandSourceE
+__ZN7WebCoreL16stateSuperscriptEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL14stateSubscriptEPNS_5FrameEPNS_5EventE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9DOMWindowEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9DOMWindowEEELm0EE15reserveCapacityEm
+__ZNK3WTF7HashMapIPN7WebCore9DOMWindowEPNS_6VectorINS_6RefPtrINS1_23RegisteredEventListenerEEELm0EEENS_7PtrHashIS3_EENS_10HashT
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9DOMWindowEEELm0EE6shrinkEm
+__ZN7WebCore16enclosingIntRectERK7_NSRect
+__ZN7WebCore7IntSizeC1ERK7_NSSize
+__ZN7WebCore7IntSizeC2ERK7_NSSize
+__ZThn4_N7WebCore8Document14removedLastRefEv
+__ZThn4_N7WebCore4TextD0Ev
+__ZThn56_NK7WebCore16HTMLStyleElement4typeEv
+__ZThn56_NK7WebCore16HTMLStyleElement5mediaEv
+__ZThn56_N7WebCore16HTMLStyleElement10setLoadingEb
+__ZThn56_NK7WebCore17HTMLScriptElement21charsetAttributeValueEv
+__ZThn56_NK7WebCore17HTMLScriptElement18typeAttributeValueEv
+__ZThn64_NK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
+__ZThn64_NK7WebCore16HTMLInputElement11isTextFieldEv
+__ZThn12_N7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZThn64_NK7WebCore16HTMLInputElement12isAutofilledEv
+__ZN7WebCoreL12toFontWeightEi
+__ZThn64_NK7WebCore16HTMLInputElement13isSearchFieldEv
+__ZThn64_NK7WebCore16HTMLInputElement26placeholderShouldBeVisibleEv
+__ZL16acceptableChoicejj
+__ZThn64_NK7WebCore16HTMLInputElement5valueEv
+__ZN7WebCore7DataRefINS_20StyleFlexibleBoxDataEE6accessEv
+__ZNK7WebCore14RenderThemeMac22setFontFromControlSizeEPNS_16CSSStyleSelectorEPNS_11RenderStyleEj
+__ZThn64_NK7WebCore17HTMLOptionElement31textIndentedToRespectGroupLabelEv
+__ZNK7WebCore14RenderThemeMac18popupButtonPaddingEj
+__ZThn64_NK7WebCore16HTMLInputElement17isInputTypeHiddenEv
+__ZThn44_NK7WebCore8Document10isDocumentEv
+__ZL12betterChoicejijiji
+__ZNK7WebCore7IntRectcv7_NSRectEv
+__ZThn64_NK7WebCore16HTMLInputElement15isPasswordFieldEv
+__ZThn64_N7WebCore16HTMLInputElement6selectEv
+__ZThn64_N7WebCore16HTMLInputElement14cacheSelectionEii
+__ZThn4_N7WebCore4AttrD0Ev
+__ZSt22__get_temporary_bufferIPN7WebCore11RenderLayerEESt4pairIPT_iEiS5_
+__ZSt22__stable_sort_adaptiveIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt22__chunk_insertion_sortIPPN7WebCore11RenderLayerEiPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt16__merge_adaptiveIPPN7WebCore11RenderLayerEiS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
+__ZSt17__merge_sort_loopIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZThn268_N7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
+__ZThn268_N7WebCore11CachedImage7didDrawEPKNS_5ImageE
+__ZThn64_NK7WebCore16HTMLInputElement9isCheckedEv
+__ZThn64_NK7WebCore16HTMLInputElement15isIndeterminateEv
+__ZN7WebCoreL13buttonMarginsEj
+__ZN3WTF9HashTableIPN7WebCore24OverlapTestRequestClientESt4pairIS3_NS1_7IntRectEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EE
+__ZSt16__introsort_loopIPPN7WebCore13InlineTextBoxEiPFbPKS1_S5_EEvT_S8_T0_T1_
+__ZN7WebCore11RenderLayer25setHasHorizontalScrollbarEb
+__ZN7WebCore11RenderLayer23setHasVerticalScrollbarEb
+__ZN7WebCore11RenderLayer15createScrollbarENS_20ScrollbarOrientationE
+__ZN7WebCore11RenderLayer23invalidateScrollbarRectEPNS_9ScrollbarERKNS_7IntRectE
+__ZNK7WebCore11RenderLayer8isActiveEv
+__ZN7WebCore11RenderLayer23hitTestOverflowControlsERNS_13HitTestResultE
+__ZN7WebCore18jsElementOffsetTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element9offsetTopEv
+__ZNK7WebCore20RenderBoxModelObject9offsetTopEv
+__ZNK7WebCore12RenderObject12offsetParentEv
+__ZN7WebCoreL18adjustForLocalZoomEiPNS_12RenderObjectE
+__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8scrollToEii
+__ZN7WebCore9FrameView17setScrollPositionERKNS_8IntPointE
+__ZN7WebCore40jsHTMLFormElementPrototypeFunctionSubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17JSHTMLFormElement6submitEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15HTMLFormElement6submitEPNS_5EventEbbb
+__ZN7WebCore9FormState6createEN3WTF10PassRefPtrINS_15HTMLFormElementEEERNS1_6VectorISt4pairINS_6StringES7_ELm0EEENS2_INS_5Frame
+__ZN7WebCore15HTMLFormElement14createFormDataERKNS_7CStringE
+__ZNK7WebCore15HTMLFormElement12dataEncodingEv
+__ZNK7WebCore15HTMLFormElement12isMailtoFormEv
+__ZNK7WebCore15FormDataBuilder12dataEncodingEPNS_8DocumentE
+__ZN7WebCore8FormData6createEv
+__ZN7WebCore12FormDataListC1ERKNS_12TextEncodingE
+__ZN7WebCore12FormDataListC2ERKNS_12TextEncodingE
+__ZN7WebCore16HTMLInputElement14appendFormDataERNS_12FormDataListEb
+__ZN7WebCore12FormDataList12appendStringERKNS_6StringE
+__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE15reserveCapacityEm
+__ZN7WebCore7CStringC1EPKc
+__ZN7WebCore7CStringC2EPKc
+__ZN7WebCoreeqERKNS_7CStringES2_
+__ZN7WebCore15FormDataBuilder25addKeyValuePairAsFormDataERN3WTF6VectorIcLm0EEERKNS_7CStringES7_
+__ZN7WebCore15FormDataBuilder22encodeStringAsFormDataERN3WTF6VectorIcLm0EEERKNS_7CStringE
+__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE6shrinkEm
+__ZN7WebCore8FormData10appendDataEPKvm
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIcLm0EEC1ERKS1_
+__ZN3WTF6VectorIcLm0EEC2ERKS1_
+__ZN7WebCoreL26generateFormDataIdentifierEv
+__ZN7WebCore11FrameLoader10submitFormEPKcRKNS_6StringEN3WTF10PassRefPtrINS_8FormDataEEES5_S5_S5_bbNS7_INS_5EventEEENS7_INS_9For
+__ZN7WebCore8FormData13generateFilesEPNS_12ChromeClientE
+__ZN7WebCore19ResourceRequestBase11setHTTPBodyEN3WTF10PassRefPtrINS_8FormDataEEE
+__ZN7WebCore11FrameLoader22scheduleFormSubmissionERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEE
+__ZN7WebCore11FrameLoader15loadPostRequestERKNS_15ResourceRequestERKNS_6StringES6_bNS_13FrameLoadTypeEN3WTF10PassRefPtrINS_5Eve
+__ZN7WebCore11setHTTPBodyEP19NSMutableURLRequestN3WTF10PassRefPtrINS_8FormDataEEE
+__ZN7WebCore8FormData6createEPKvm
+__ZN3WTF10RefCountedIN7WebCore9FormStateEE5derefEv
+-[WebCoreResourceHandleAsDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]
+__ZN7WebCore14ResourceLoader11didSendDataEPNS_14ResourceHandleEyy
+__ZN7WebCore14ResourceLoader11didSendDataEyy
+__ZN7WebCore8FormData28removeGeneratedFilesIfNeededEv
+__ZN7WebCore26setJSHTMLFormElementActionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement9setActionERKNS_6StringE
+__ZN7WebCore14PreloadScanner3endEv
+__ZN7WebCore9Scrollbar8setValueEi
+__ZN7WebCore9Scrollbar13setCurrentPosEf
+__ZNK7WebCore17ScrollbarThemeMac16buttonsPlacementEv
+__ZN7WebCore9Scrollbar19updateThumbPositionEv
+__ZN7WebCore11RenderLayer12valueChangedEPNS_9ScrollbarE
+__ZN7WebCore9FrameView13scheduleEventEN3WTF10PassRefPtrINS_5EventEEENS2_INS_4NodeEEE
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EEC1ERKS4_
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EEC2ERKS4_
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE6shrinkEm
+__ZN7WebCore10HTMLParser24noframesCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore16HTMLInputElement13aboutToUnloadEv
+__ZN7WebCore12InputElement13aboutToUnloadERNS_16InputElementDataEPNS_8DocumentE
+__ZThn8_N7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZThn56_NK7WebCore17HTMLScriptElement22languageAttributeValueEv
+__ZThn56_NK7WebCore17HTMLScriptElement17forAttributeValueEv
+__ZThn56_N7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore14jsNodeNodeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSHTMLDocument14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSHTMLDocumentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore17HTMLPlugInElement17endTagRequirementEv
+__ZNK7WebCore17HTMLObjectElement11tagPriorityEv
+__ZN7WebCore17HTMLPlugInElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore17HTMLObjectElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore17HTMLObjectElement18updateDocNamedItemEv
+__ZN7WebCoreL16paramConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLParamElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLParamElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLParamElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLParamElement17endTagRequirementEv
+__ZNK7WebCore16HTMLParamElement11tagPriorityEv
+__ZN7WebCoreL16embedConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLEmbedElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLEmbedElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLEmbedElement16attributeChangedEPNS_9AttributeEb
+__ZNK7WebCore16HTMLEmbedElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLEmbedElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore17jsDOMWindowFramesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSDOMWindowBase11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore9FrameTree5childEj
+__ZN7WebCoreL17canAccessAncestorEPKNS_14SecurityOriginEPNS_5FrameE
+__ZN7WebCore11HistoryItem12addChildItemEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCoreL27isObjectAncestorContainerOfEPNS_12RenderObjectES1_
+__ZNK7WebCore16HTMLEmbedElement17endTagRequirementEv
+__ZNK7WebCore16HTMLEmbedElement11tagPriorityEv
+__ZN7WebCore16HTMLEmbedElement20insertedIntoDocumentEv
+__ZN7WebCore16HTMLEmbedElement6attachEv
+__ZN7WebCore16HTMLEmbedElement12updateWidgetEv
+__ZN7WebCore17HTMLObjectElement11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore17HTMLObjectElement21finishParsingChildrenEv
+__ZN7WebCore9FrameView17addWidgetToUpdateEPNS_16RenderPartObjectE
+__ZN3WTF7HashSetIPN7WebCore16RenderPartObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE15reserveCapacityEm
+__ZNK7WebCore9FrameView22windowClipRectForLayerEPKNS_11RenderLayerEb
+__ZNK7WebCore11RenderLayer16childrenClipRectEv
+__ZNK7WebCore10ScrollView16contentsToWindowERKNS_7IntRectE
+__ZNK7WebCore6Widget25convertToContainingWindowERKNS_7IntRectE
+__ZN7WebCore9FloatRectC1ERK7_NSRect
+__ZN7WebCore9FloatRectC2ERK7_NSRect
+__ZN7WebCore10FloatPointC1ERK8_NSPoint
+__ZN7WebCore10FloatPointC2ERK8_NSPoint
+__ZN7WebCore9FloatSizeC1ERK7_NSSize
+__ZN7WebCore9FloatSizeC2ERK7_NSSize
+__ZN7WebCore7IntRectC1ERKNS_9FloatRectE
+__ZN7WebCore7IntRectC2ERKNS_9FloatRectE
+__ZNK7WebCore9FrameView14windowClipRectEb
+__ZN7WebCore25PluginMainThreadScheduler9schedulerEv
+__ZN7WebCore25PluginMainThreadSchedulerC1Ev
+__ZN7WebCore25PluginMainThreadSchedulerC2Ev
+__ZN7WebCore25PluginMainThreadScheduler14registerPluginEP4_NPP
+__ZN3WTF7HashMapIP4_NPPNS_5DequeIN7WebCore25PluginMainThreadScheduler4CallEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENSA_IS7_EEE3
+__ZN7WebCore16ScriptController20windowScriptNPObjectEv
+__Z23_NPN_CreateScriptObjectP4_NPPPN3JSC8JSObjectEN3WTF10PassRefPtrINS1_8Bindings10RootObjectEEE
+__NPN_CreateObject
+__ZL10jsAllocateP4_NPPP7NPClass
+__NPN_RetainObject
+__NPN_Evaluate
+__ZN3JSC8Bindings22convertNPStringToUTF16EPK9_NPString
+__ZN7WebCore6String26fromUTF8WithLatin1FallbackEPKcm
+__ZN7WebCore6String8fromUTF8EPKcm
+__ZN3JSC8Bindings23convertValueToNPVariantEPNS_9ExecStateENS_7JSValueEP10_NPVariant
+__NPN_GetStringIdentifier
+__ZN7WebCore13IdentifierRep3getEPKc
+__ZN7WebCoreL19stringIdentifierMapEv
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPN7WebCore13IdentifierRepENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3add
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PN7WebCore13IdentifierRepEENS_18PairFirstExtractorISA_EENS_7StrHas
+__ZN7WebCoreL13identifierSetEv
+__ZN3WTF7HashSetIPN7WebCore13IdentifierRepENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocat
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloc
+__NPN_Invoke
+__ZN3JSC8Bindings26identifierFromNPIdentifierEPKc
+__ZL22getListFromVariantArgsPN3JSC9ExecStateEPK10_NPVariantjPNS_8Bindings10RootObjectERNS_20MarkedArgumentBufferE
+__ZN3JSC8Bindings14findRootObjectEPNS_14JSGlobalObjectE
+__NPN_ReleaseVariantValue
+__Z35NPN_InitializeVariantWithStringCopyP10_NPVariantPK9_NPString
+__NPN_ReleaseObject
+__NPN_DeallocateObject
+__ZL12jsDeallocateP8NPObject
+__ZN3JSC8Bindings10RootObject11gcUnprotectEPNS_8JSObjectE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3getERKS3_
+__ZN7WebCore14jsDOMWindowTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow3topEv
+__ZN7WebCore26NetscapePlugInStreamLoader6createEPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
+__ZN7WebCore26NetscapePlugInStreamLoaderC1EPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
+__ZN7WebCore26NetscapePlugInStreamLoaderC2EPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
+__ZN7WebCore14ResourceLoader19setShouldBufferDataEb
+__ZN7WebCore14DocumentLoader21addPlugInStreamLoaderEPNS_14ResourceLoaderE
+__ZNK3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remo
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remov
+__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE6shrinkEm
+__ZThn28_NK7WebCore8DOMTimer18hasPendingActivityEv
+__ZN7WebCore5TimerINS_13HTMLTokenizerEE5firedEv
+__ZN7WebCore13HTMLTokenizer10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore26NetscapePlugInStreamLoader18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore26NetscapePlugInStreamLoader14didReceiveDataEPKcixb
+__ZN7WebCore26NetscapePlugInStreamLoader16didFinishLoadingEv
+__ZN7WebCore14DocumentLoader24removePlugInStreamLoaderEPNS_14ResourceLoaderE
+__ZN7WebCore26NetscapePlugInStreamLoader16releaseResourcesEv
+__ZN7WebCore26NetscapePlugInStreamLoaderD0Ev
+__ZN7WebCore18jsDOMWindowHistoryEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow7historyEPN3JSC9ExecStateE
+__ZNK7WebCore9DOMWindow7historyEv
+__ZN7WebCore7HistoryC1EPNS_5FrameE
+__ZN7WebCore7HistoryC2EPNS_5FrameE
+__ZN7WebCore9JSHistory15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSHistoryC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7HistoryEEE
+__ZN7WebCore9JSHistoryC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7HistoryEEE
+__ZN7WebCore9JSHistory18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSHistory24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore7History5frameEv
+__ZN7WebCore15jsHistoryLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7History6lengthEv
+__ZN7WebCore11FrameLoader16getHistoryLengthEv
+__ZN7WebCore11toUserSpaceERK7_NSRectP8NSWindow
+__ZN7WebCore18jsScreenColorDepthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen10colorDepthEv
+__ZN7WebCore22jsDocumentCharacterSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNavigatorCookieEnabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator13cookieEnabledEv
+__ZN7WebCore14cookiesEnabledEPKNS_8DocumentE
+__ZN7WebCoreL29createHTMLTitleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLTitleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLTitleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTitleElementEEE
+__ZN7WebCore18JSHTMLTitleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTitleElementEEE
+__ZN7WebCoreL29createHTMLParamElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLParamElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLParamElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLParamElementEEE
+__ZN7WebCore18JSHTMLParamElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLParamElementEEE
+__ZN7WebCoreL29createHTMLEmbedElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLEmbedElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLEmbedElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLEmbedElementEEE
+__ZN7WebCore18JSHTMLEmbedElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLEmbedElementEEE
+__ZN7WebCore19JSHTMLScriptElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLTitleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSHTMLBRElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16ScriptController29createScriptInstanceForWidgetEPNS_6WidgetE
+__ZN7WebCore16ScriptController16createRootObjectEPv
+__ZN3WTF7HashMapIPvNS_6RefPtrIN3JSC8Bindings10RootObjectEEENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS9_IS6_EEE3setERKS1_RKS6_
+__ZN3JSC8Bindings9CInstanceC1EP8NPObjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings9CInstanceC2EP8NPObjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings8InstanceC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZNK3JSC8Bindings8Instance10rootObjectEv
+__ZN3JSC8Bindings8Instance19createRuntimeObjectEPNS_9ExecStateE
+__ZN3JSC16RuntimeObjectImpC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_8Bindings8InstanceEEE
+__ZN3JSC16RuntimeObjectImpC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_8Bindings8InstanceEEE
+__ZN3JSC8Bindings10RootObject16addRuntimeObjectEPNS_16RuntimeObjectImpE
+__ZN3WTF7HashSetIPN3JSC16RuntimeObjectImpENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__ZN3JSC16RuntimeObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC8Bindings8Instance5beginEv
+__ZN3JSC8Bindings8Instance12virtualBeginEv
+__ZNK3JSC8Bindings9CInstance8getClassEv
+__ZN3JSC8Bindings6CClass11classForIsAEP7NPClass
+__ZNK3WTF7HashMapIP7NPClassPN3JSC8Bindings6CClassENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3getERKS2_
+__ZN3JSC8Bindings6CClassC1EP7NPClass
+__ZN3JSC8Bindings6CClassC2EP7NPClass
+__ZN3WTF7HashMapIP7NPClassPN3JSC8Bindings6CClassENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3setERKS2_RKS6_
+__ZN3WTF9HashTableIP7NPClassSt4pairIS2_PN3JSC8Bindings6CClassEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS2_EENS_14PairHashTrait
+__ZNK3JSC8Bindings6CClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings5FieldENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3getEPS4
+__ZNK3JSC8Bindings6CClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings6MethodENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3getEPS
+__NPN_UTF8FromIdentifier
+__ZN3JSC8Bindings5Class14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
+__ZN3JSC8Bindings8Instance3endEv
+__ZN3JSC8Bindings8Instance10virtualEndEv
+__ZN3JSC8Bindings8Instance18getOwnPropertySlotEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN7WebCore18JSHTMLParamElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_16HTMLEmbedElementERKNS1_10IdentifierE
+__ZN7WebCore18JSHTMLEmbedElement24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement25renderWidgetForJSBindingsEv
+__ZN7WebCore13jsEventTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11jsEventTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12AtomicStringcvN3JSC7UStringEEv
+__ZN7WebCore8FormDataD1Ev
+__ZN7WebCore8FormDataD2Ev
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE6shrinkEm
+__ZN7WebCore21JSMouseEventPrototypeD1Ev
+__ZN7WebCore18JSUIEventPrototypeD1Ev
+__ZN7WebCore12CachedScriptD0Ev
+__ZN7WebCore17JSHTMLLinkElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSHTMLLinkElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement7setHrefERKNS_6StringE
+__ZThn4_N7WebCore7CommentD0Ev
+__ZN7WebCore10ScrollView4hideEv
+__ZN7WebCore6Widget4hideEv
+__ZThn4_N7WebCore16DocumentFragmentD0Ev
+__ZN7WebCore11RenderLayer20setHasVisibleContentEb
+__ZN7WebCore24setJSHTMLDocumentBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12HTMLDocument10setBgColorERKNS_6StringE
+__ZN7WebCore15HTMLBodyElement10setBgColorERKNS_6StringE
+__ZN7WebCore24setJSHTMLDocumentFgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12HTMLDocument10setFgColorERKNS_6StringE
+__ZN7WebCore15HTMLBodyElement7setTextERKNS_6StringE
+__ZN7WebCore26setJSHTMLDocumentLinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12HTMLDocument12setLinkColorERKNS_6StringE
+__ZNK7WebCore15HTMLBodyElement4linkEv
+__ZN7WebCore15HTMLBodyElement7setLinkERKNS_6StringE
+__ZN7WebCore27setJSHTMLDocumentVlinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12HTMLDocument13setVlinkColorERKNS_6StringE
+__ZNK7WebCore15HTMLBodyElement5vLinkEv
+__ZN7WebCore15HTMLBodyElement8setVLinkERKNS_6StringE
+__ZN7WebCore22jsDocumentLastModifiedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document12lastModifiedEv
+__ZThn84_N7WebCore12RenderWidget20setOverlapTestResultEb
+__ZN7WebCore11RenderLayer25dirtyVisibleContentStatusEv
+__ZN7WebCore23jsHTMLInputElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore13HTMLBRElementD0Ev
+__ZN7WebCore11FrameLoader22updateHistoryForReloadEv
 __ZN7WebCoreL29createHTMLTableElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLTableElement15createPrototypeEPN3JSC9ExecStateE
+__ZN7WebCore18JSHTMLTableElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore18JSHTMLTableElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTableElementEEE
-__ZN7WebCoreL32createHTMLTableRowElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLTableRowElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSHTMLTableRowElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableRowElementEEE
-__ZN7WebCoreL30createHTMLSelectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLSelectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSelectElementEEE
-__ZN7WebCore19JSHTMLSelectElementD0Ev
-__ZN7WebCore18JSHTMLTableElementD0Ev
-__ZN7WebCore14RenderTableRow29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZN7WebCoreL29createHTMLDListElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLDListElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLDListElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLDListElementEEE
-__ZN7WebCore9JSComment15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore9JSCommentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CommentEEE
-__ZN7WebCore15JSTextPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSCharacterDataPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore4Text9cloneNodeEb
-__ZN7WebCore13ContainerNode15cloneChildNodesEPS0_
-__ZN7WebCore18JSHTMLTableElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSHTMLTableElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLTableElement9classInfoEv
-__ZN7WebCore7Comment9cloneNodeEb
-__ZN7WebCore8Document13createCommentERKNS_6StringE
-__ZN7WebCore18JSHTMLDListElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLDListElement9classInfoEv
-__ZN7WebCore9JSComment18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore9JSComment9classInfoEv
-__ZN7WebCore16HTMLInputElement26copyNonAttributePropertiesEPKNS_7ElementE
-__ZN7WebCore18JSHTMLDListElementD0Ev
-__ZN7WebCore35jsNodePrototypeFunctionInsertBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore6JSNode12insertBeforeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore13InlineFlowBox11extractLineEv
-__ZN7WebCore10RenderFlow14extractLineBoxEPNS_13InlineFlowBoxE
-__ZN7WebCore13InlineTextBox11extractLineEv
-__ZN7WebCore10RenderText14extractTextBoxEPNS_13InlineTextBoxE
-__ZN7WebCore11RenderBlock14matchedEndLineERKNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS2_RKNS_10BidiStatusERPNS_13RootInlineBoxERiSF_SF_
-__ZN7WebCoreeqERKNS_11BidiContextES2_
-__ZN7WebCore13InlineFlowBox10attachLineEv
-__ZN7WebCore10RenderFlow13attachLineBoxEPNS_13InlineFlowBoxE
-__ZN7WebCore13InlineTextBox10attachLineEv
-__ZN7WebCore10RenderText13attachTextBoxEPNS_13InlineTextBoxE
-__ZN7WebCore13RootInlineBox14adjustPositionEii
-__ZN7WebCore13InlineFlowBox14adjustPositionEii
-__ZN7WebCore44jsDocumentPrototypeFunctionGetElementsByNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore4Node17getElementsByNameERKNS_6StringE
-__ZN7WebCore12NameNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
-__ZNK7WebCore12NameNodeList11nodeMatchesEPNS_7ElementE
-__ZN7WebCore20jsDocumentXMLVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLDListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCoreL26createHTMLHRElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore15JSHTMLHRElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSHTMLHRElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLHRElementEEE
-__ZN7WebCore15JSHTMLHRElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15JSHTMLHRElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore18JSHTMLTableElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCoreL36createHTMLTableSectionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore25JSHTMLTableSectionElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore25JSHTMLTableSectionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableSectionElementEEE
-__ZN7WebCore25JSHTMLTableSectionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34JSHTMLTableSectionElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSHTMLTableSectionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore21JSHTMLTableRowElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSHTMLTableRowElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSHTMLTableRowElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLTableElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTableElementEEE
 __ZN7WebCoreL33createHTMLTableCellElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore22JSHTMLTableCellElement15createPrototypeEPN3JSC9ExecStateE
+__ZN7WebCore22JSHTMLTableCellElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore22JSHTMLTableCellElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLTableCellElementEEE
+__ZN7WebCore22JSHTMLTableCellElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLTableCellElementEEE
+__ZN7WebCore44jsDOMWindowPrototypeFunctionGetComputedStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9toElementEN3JSC7JSValueE
+__ZNK7WebCore22JSHTMLTableCellElement9classInfoEv
+__ZN7WebCore21JSCSSStyleDeclaration18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration18canGetItemsForNameEPN3JSC9ExecStateEPNS_19CSSStyleDeclarationERKNS1_10IdentifierE
+__ZN7WebCore30JSCSSStyleDeclarationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore54jsCSSStyleDeclarationPrototypeFunctionGetPropertyValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZNK7WebCore21JSCSSStyleDeclaration9classInfoEv
+__ZN7WebCoreL9sizingBoxEPNS_12RenderObjectE
 __ZN7WebCore22JSHTMLTableCellElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSHTMLTableCellElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore21jsNodePreviousSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHistoryPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSHistory3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSHistory9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore46jsElementPrototypeFunctionGetElementsByTagNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21setJSHTMLElementTitleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement8setTitleERKNS_6StringE
+__ZN7WebCore20setJSNodeOnmousedownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOnmousedownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore15JSEventListener18virtualisAttributeEv
+__ZNK7WebCore11RenderTable14recalcSectionsEv
+__ZN7WebCore18RenderTableSection11recalcCellsEv
+__ZNK7WebCore18RenderTableSection10numColumnsEv
+__ZN7WebCore22JSHTMLTableCellElementD1Ev
+__ZN7WebCore18JSHTMLTableElementD1Ev
+__ZN7WebCore12JSMouseEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSUIEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13jsNodeOnclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onclickEv
+__ZNK7WebCore4Node25getAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore7History15disconnectFrameEv
+__ZNK7WebCore11JSDOMWindow9classInfoEv
+__ZNK7WebCore16JSDOMWindowShell9classNameEv
+__ZN7WebCore17jsDOMWindowLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6lengthEv
+__ZN7WebCoreL26createHTMLHRElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore15JSHTMLHRElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSHTMLHRElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLHRElementEEE
+__ZN7WebCore15JSHTMLHRElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLHRElementEEE
+__ZN7WebCore15JSHTMLHRElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17jsNodeNextSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsNodePrototypeFunctionInsertBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode12insertBeforeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore15JSHTMLLIElement9classInfoEv
+__ZN7WebCore9JSHistoryD1Ev
+__ZN7WebCore9JSHistoryD2Ev
+__ZN7WebCore15JSHTMLHRElementD1Ev
+__ZN7WebCore18JSHTMLStyleElementD1Ev
+__ZN7WebCore17JSHTMLLinkElementD1Ev
+__ZN7WebCore18JSHTMLTitleElementD1Ev
+__ZN7WebCore19jsNodeOwnerDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsHTMLElementTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLAnchorElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLAnchorElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLAnchorElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22setJSCharacterDataDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11FrameLoader6reloadEb
+__ZN7WebCore11FrameLoader33restoreScrollPositionAndViewStateEv
+__ZNK7WebCore9FrameView17wasScrolledByUserEv
+__ZNK7WebCore11HistoryItem11scrollPointEv
+__ZN7WebCore25JSHTMLPreElementPrototypeD1Ev
+__ZThn8_N7WebCore14HTMLPreElementD0Ev
+__ZN7WebCore17HTMLSelectElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore17HTMLSelectElement27menuListDefaultEventHandlerEPNS_5EventE
+__ZN7WebCore21JSCSSStyleDeclaration10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore21DeprecatedPtrListImpl9removeRefEPKvb
+__ZN7WebCore12RenderObject24repaintOverhangingFloatsEb
+__ZNK7WebCore16JSEventPrototype9classInfoEv
+__ZN7WebCore18jsEventReturnValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventTimeStampEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF12bitwise_castIldEET_T0_
+__ZN7WebCore17jsEventEventPhaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsEventSrcElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsEventClipboardDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7JSEvent13clipboardDataEPN3JSC9ExecStateE
+__ZNK7WebCore5Event16isClipboardEventEv
+__ZN7WebCore17jsEventCancelableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9DOMWindow11toDOMWindowEv
+__ZN7WebCore14jsEventBubblesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsEventCancelBubbleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventMOUSEOUTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsEventFOCUSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13jsEventCHANGEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEMOVEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventAT_TARGETEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13jsEventSELECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11jsEventBLUREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsEventKEYUPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEDOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEDRAGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsEventBUBBLING_PHASEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsEventMOUSEUPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsEventCAPTURING_PHASEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEOVEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsEventCLICKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventDBLCLICKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsEventKEYDOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventKEYPRESSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventDRAGDROPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsDOMWindowPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL26removePendingEventListenerERN3WTF7HashMapIPNS_9DOMWindowEPNS0_6VectorINS0_6RefPtrINS_23RegisteredEventListenerEE
+__ZNK3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE4findIPS3_EEmRKT_
+__ZN7WebCore17JSHTMLHtmlElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17JSHTMLHeadElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17JSHTMLMetaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLTitleElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15JSHTMLBRElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore22jsHTMLUListElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLUListElement4typeEv
+__ZN7WebCore27jsHTMLDivElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLDivElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLDivElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN7WebCore20HTMLFrameElementBase13canLazyAttachEv
+__ZN7WebCore27JSHTMLUListElementPrototypeD1Ev
+__ZN7WebCore24JSHTMLBRElementPrototypeD1Ev
+__ZN7WebCore28JSHTMLScriptElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLLinkElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLTitleElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLMetaElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLHeadElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLHtmlElementPrototypeD1Ev
+__ZThn8_N7WebCore18HTMLHeadingElementD0Ev
+__ZN7WebCore25JSHTMLDocumentConstructorD1Ev
+__ZThn8_N7WebCore13HTMLLIElementD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE15reserveCapacityEm
+__ZNK7WebCore16HTMLInputElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore20StringSourceProvider8getRangeEii
+__ZN7WebCore11CachedImage19httpStatusCodeErrorEv
+__ZNK7WebCore22HTMLFormControlElement16isMouseFocusableEv
+__ZNK7WebCore16HTMLInputElement17canStartSelectionEv
+__ZNK7WebCore12JSMouseEvent9classInfoEv
+__ZNK7WebCore21JSMouseEventPrototype9classInfoEv
+__ZNK7WebCore18JSUIEventPrototype9classInfoEv
+__ZN7WebCore20jsMouseEventShiftKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsMouseEventToElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent9toElementEv
+__ZN7WebCore19jsMouseEventClientYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13jsMouseEventYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17MouseRelatedEvent1yEv
+__ZN7WebCore13jsMouseEventXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17MouseRelatedEvent1xEv
+__ZN7WebCore19jsMouseEventCtrlKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsMouseEventRelatedTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventClientXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventScreenYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventMetaKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventOffsetXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsMouseEventAltKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventOffsetYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsMouseEventFromElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent11fromElementEv
+__ZN7WebCore19jsMouseEventScreenXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsMouseEventDataTransferEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent11isDragEventEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9ClipboardE
+__ZN7WebCore18jsMouseEventButtonEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsUIEventPageYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsUIEventLayerYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17MouseRelatedEvent6layerYEv
+__ZN7WebCore14jsUIEventPageXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsUIEventCharCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7UIEvent8charCodeEv
+__ZN7WebCore13jsUIEventViewEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsUIEventWhichEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent5whichEv
+__ZN7WebCore16jsUIEventKeyCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7UIEvent7keyCodeEv
+__ZN7WebCore15jsUIEventDetailEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsUIEventLayerXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17MouseRelatedEvent6layerXEv
+__ZN7WebCore21JSMouseEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSUIEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24jsHTMLElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsHTMLParagraphElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSHTMLParagraphElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLParagraphElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29jsHTMLOListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLOListElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLOListElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLOListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore8IntPointC1ERK8_NSPoint
+__ZN7WebCore8IntPointC2ERK8_NSPoint
+__ZN7WebCore11globalPointERK8_NSPointP8NSWindow
+__ZN7WebCore15flipScreenPointERK8_NSPointP8NSScreen
+__ZNK7WebCore8IntPointcv8_NSPointEv
+__ZN7WebCore17HTMLPlugInElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore12EventHandler14currentNSEventEv
+__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler26passMouseDownEventToWidgetEPNS_6WidgetE
+__ZN7WebCoreL18lastEventIsMouseUpEv
+__ZN7WebCoreL18findViewInSubviewsEP6NSViewS1_
+__ZN7WebCore11FrameLoader13frameDetachedEv
+__ZN7WebCore17HTMLIFrameElement19removedFromDocumentEv
+__ZN7WebCore20HTMLFrameElementBase19removedFromDocumentEv
+__ZThn4_N7WebCore17HTMLIFrameElementD0Ev
+__ZN7WebCore10RenderView15pushLayoutStateEPNS_12RenderObjectE
+__ZN7WebCore11LayoutStateC1EPNS_12RenderObjectE
+__ZN7WebCore11LayoutStateC2EPNS_12RenderObjectE
+__ZN7WebCore11FrameLoader24checkCompletedTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore5Cache18revalidateResourceEPNS_14CachedResourceEPNS_9DocLoaderE
+__ZNK7WebCore14CachedResource20canUseCacheValidatorEv
+__ZNK7WebCore19CachedCSSStyleSheet8encodingEv
+__ZN7WebCore14CachedResource23setResourceToRevalidateEPS0_
+__ZN3WTF7HashSetIPN7WebCore24CachedResourceHandleBaseENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZNK7WebCore14CachedResource8encodingEv
+__ZN7WebCore5Cache21revalidationSucceededEPNS_14CachedResourceERKNS_16ResourceResponseE
+__ZN7WebCore14CachedResource34switchClientsToRevalidatedResourceEv
+__ZN3WTF9HashTableIPN7WebCore24CachedResourceHandleBaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE15reserveCapacityEm
+__ZN7WebCore14CachedResource25clearResourceToRevalidateEv
+__ZN7WebCore19JSHTMLObjectElementD1Ev
+__ZN7WebCore18JSHTMLParamElementD1Ev
+__ZN7WebCore18JSHTMLEmbedElementD1Ev
+__ZN3JSC16RuntimeObjectImpD1Ev
+__ZN3JSC16RuntimeObjectImpD2Ev
+__ZN3JSC8Bindings10RootObject19removeRuntimeObjectEPNS_16RuntimeObjectImpE
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN3JSC8Bindings9CInstanceD0Ev
+__ZN3JSC8Bindings8InstanceD2Ev
+__ZThn4_N7WebCore16HTMLImageElementD0Ev
+__ZNK7WebCore13KeyboardEvent8charCodeEv
+__ZNK7WebCore6String19characterStartingAtEj
+__ZN7WebCore10StringImpl19characterStartingAtEj
+__ZN7WebCoreL5equalERKNS_15CSSParserStringEPKc
+__ZN7WebCore18CSSParserValueList13deleteValueAtEj
+__ZNK7WebCore14CSSParserValue10isVariableEv
+__ZN7WebCore19setJSDOMWindowEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14PreloadScanner11emitCSSRuleEv
+__ZN3WTF6VectorItLm16EE6shrinkEm
+__ZN7WebCore24jsHTMLDocumentCompatModeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12HTMLDocument10compatModeEv
+__ZN7WebCore25jsDocumentDocumentElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn4_N7WebCore11HTMLElementD0Ev
+__ZThn64_NK7WebCore16HTMLInputElement4sizeEv
+__ZNK7WebCore15JSDOMWindowBase29crossDomainAccessErrorMessageEPKN3JSC14JSGlobalObjectE
+__ZN3WTF6VectorIcLm256EE14expandCapacityEm
+__ZN3WTF6VectorIcLm256EE15reserveCapacityEm
+__ZN7WebCore25printErrorMessageForFrameEPNS_5FrameERKNS_6StringE
+__ZNK7WebCore15JSDOMWindowBase17printErrorMessageERKNS_6StringE
+__ZN7WebCore26setJSHTMLScriptElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement7setTypeERKNS_6StringE
+__ZN7WebCore21jsNavigatorProductSubEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase10productSubEv
+__ZN7WebCore17jsNavigatorVendorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase6vendorEv
+__ZN7WebCore18jsNavigatorProductEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase7productEv
+__ZThn56_N7WebCore17HTMLScriptElement17dispatchLoadEventEv
+__ZNK7WebCore12RenderObject14isDescendantOfEPKS0_
+__ZN7WebCore7Element24cloneElementWithChildrenEv
+__ZN7WebCore13ContainerNode15cloneChildNodesEPS0_
+__ZN7WebCore4Text9cloneNodeEb
+__ZN7WebCore40jsDOMWindowPrototypeFunctionClearTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow12clearTimeoutEi
+__ZN7WebCore16jsHTMLElementDirEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement3dirEv
+__ZN7WebCore17jsHTMLDocumentDirEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument3dirEv
+__ZN7WebCore25PluginMainThreadScheduler16unregisterPluginEP4_NPP
+__ZN7WebCore16HTMLParamElementD0Ev
+__ZN7WebCore16HTMLEmbedElementD0Ev
+__ZNK7WebCore16RunLoopTimerBase8isActiveEv
+__ZN7WebCore4Page6goBackEv
+__ZN7WebCore4Page8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
+__ZN7WebCore11FrameLoader8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
+__ZN7WebCore15BackForwardList8goToItemEPNS_11HistoryItemE
+__ZN7WebCore11FrameLoader17recursiveGoToItemEPNS_11HistoryItemES2_NS_13FrameLoadTypeE
+__ZNK7WebCore11HistoryItem12isTargetItemEv
+__ZN7WebCore11FrameLoader8loadItemEPNS_11HistoryItemENS_13FrameLoadTypeE
+__ZN7WebCore11HistoryItem8formDataEv
+__ZNK7WebCore11FrameLoader13urlsMatchItemEPNS_11HistoryItemE
+__ZN7WebCore11FrameLoader33loadProvisionalItemFromCachedPageEv
+__ZN7WebCore14DocumentLoader18loadFromCachedPageEN3WTF10PassRefPtrINS_10CachedPageEEE
+__ZN7WebCore11FrameLoader37updateHistoryForBackForwardNavigationEv
+__ZN7WebCore11CachedFrame23cachedFramePlatformDataEv
+__ZN7WebCore11FrameLoader4openERNS_10CachedPageE
+__ZN7WebCore11FrameLoader4openERNS_11CachedFrameE
+__ZThn4_N7WebCore27TextControlInnerTextElementD0Ev
+__ZNK7WebCore21ScriptCachedFrameData9domWindowEv
+__ZN7WebCore5Frame12setDOMWindowEPNS_9DOMWindowE
+__ZN7WebCore11CachedFrame7restoreEv
+__ZN7WebCore21ScriptCachedFrameData7restoreEPNS_5FrameE
+__ZN7WebCore12EventHandler17setMousePressNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore22ScriptExecutionContext22resumeActiveDOMObjectsEv
+__ZN7WebCore8Document23documentDidBecomeActiveEv
+__ZN7WebCore9FrameView12setMediaTypeERKNS_6StringE
+__ZThn4_N7WebCore17HTMLAnchorElementD0Ev
+__ZThn4_N7WebCore20HTMLParagraphElementD0Ev
+__ZThn4_N7WebCore20HTMLTableCellElementD0Ev
+__ZThn4_N7WebCore14HTMLDivElementD0Ev
+__ZN7WebCore18jsDOMWindowConsoleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7ConsoleE
+__ZN7WebCore9JSConsole15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSConsoleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ConsoleEEE
+__ZN7WebCore9JSConsoleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ConsoleEEE
+__ZN7WebCore9JSConsole18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSConsolePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsNodeAttributesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12NamedNodeMapE
+__ZN7WebCore14JSNamedNodeMap15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSNamedNodeMapC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NamedNodeMapEEE
+__ZN7WebCore14JSNamedNodeMapC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NamedNodeMapEEE
+__ZN7WebCore14JSNamedNodeMap18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSNamedNodeMapPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap18canGetItemsForNameEPN3JSC9ExecStateEPNS_12NamedNodeMapERKNS1_10IdentifierE
+__ZN7WebCore17CSSInheritedValueD0Ev
+__ZThn4_N7WebCore15HTMLFormElementD0Ev
+__ZN7WebCore14JSNamedNodeMapD1Ev
+__ZN7WebCore14JSNamedNodeMapD2Ev
+__ZN7WebCore25jsDOMWindowOnbeforeunloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow14onbeforeunloadEv
+__ZN7WebCore28setJSDOMWindowOnbeforeunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow17setOnbeforeunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCoreL34allowsPendingBeforeUnloadListenersEPNS_9DOMWindowE
+__ZN7WebCore15JSMimeTypeArray18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsMimeTypeArrayLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13MimeTypeArray6lengthEv
+__ZNK7WebCore13MimeTypeArray13getPluginDataEv
+__ZN7WebCore19jsScreenAvailHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen11availHeightEv
+__ZN7WebCore19screenAvailableRectEPNS_6WidgetE
+__ZN7WebCore18jsScreenAvailWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen10availWidthEv
+__ZThn4_N7WebCore15HTMLBodyElementD0Ev
+__ZN7WebCoreL17buttonConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLButtonElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLButtonElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLButtonElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore17HTMLButtonElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore12RenderButton24updateBeforeAfterContentENS_8PseudoIdE
+__ZN7WebCore22jsHTMLInputElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement14isEnumeratableEv
+__ZN7WebCore16HTMLEmbedElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore16HTMLEmbedElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN7WebCore43jsNamedNodeMapPrototypeFunctionGetNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSNamedNodeMap9classInfoEv
+__ZN7WebCore6JSAttr15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSAttrC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4AttrEEE
+__ZN7WebCore6JSAttrC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4AttrEEE
+__ZNK7WebCore10RenderText22containsOnlyWhitespaceEjj
+__ZNK7WebCore12RenderObject23outlineBoundsForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore17jsDOMWindowOpenerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6openerEv
+__ZN7WebCore15JSMimeTypeArrayD1Ev
+__ZN7WebCore15JSMimeTypeArrayD2Ev
+__ZN7WebCore15jsDocumentFormsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore16JSHTMLCollection18canGetItemsForNameEPN3JSC9ExecStateEPNS_14HTMLCollectionERKNS1_10IdentifierE
 __ZN7WebCoreL13getNamedItemsEPN3JSC9ExecStateEPNS_14HTMLCollectionERKNS0_10IdentifierE
 __ZNK7WebCore14HTMLCollection15updateNameCacheEv
-__ZN7WebCore22JSHTMLTableCellElementD0Ev
-__ZN7WebCore11CSSSelector11setArgumentERKNS_12AtomicStringE
-__ZN7WebCore11CSSSelector8parseNthEv
-__ZN7WebCore11CSSSelector8RareData8parseNthEv
-__ZN7WebCore11CSSSelector8matchNthEi
-__ZN7WebCore11CSSSelector8RareData8matchNthEi
-__ZNK7WebCore15JSHTMLHRElement9classInfoEv
-__ZNK7WebCore25JSHTMLTableSectionElement9classInfoEv
-__ZNK7WebCore21JSHTMLTableRowElement9classInfoEv
-__ZNK7WebCore22JSHTMLTableCellElement9classInfoEv
+__ZN7WebCore16JSHTMLCollection10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore16HTMLInputElement26copyNonAttributePropertiesEPKNS_7ElementE
+__ZN7WebCore16JSDOMWindowShell16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore11JSDOMWindow16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore11JSDOMWindow22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore20JSDOMWindowPrototype9classInfoEv
+__ZN7WebCore9DOMWindow18canShowModalDialogEPKNS_5FrameE
+__ZNK7WebCore6Chrome11canRunModalEv
+__ZN7WebCore22jsHTMLInputElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSHTMLInputElement4typeEPN3JSC9ExecStateE
+__ZN3WTF10RefCountedIN7WebCore5XPath9ValueDataEE5derefEv
+__ZN7WebCoreL30createHTMLButtonElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLButtonElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLButtonElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLButtonElementEEE
+__ZN7WebCore19JSHTMLButtonElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLButtonElementEEE
+__ZN7WebCore19JSHTMLButtonElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSHTMLButtonElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLButtonElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore19JSHTMLButtonElement9classInfoEv
+__ZN7WebCoreL29createHTMLDListElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLDListElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLDListElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLDListElementEEE
+__ZN7WebCore18JSHTMLDListElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLDListElementEEE
+__ZN7WebCore21jsElementOffsetHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsElementOffsetLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element10offsetLeftEv
+__ZNK7WebCore20RenderBoxModelObject10offsetLeftEv
+__ZN7WebCore21jsElementOffsetParentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element12offsetParentEv
+__ZN7WebCore18JSHTMLDListElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLDListElement9classInfoEv
+__ZNK7WebCore15DynamicNodeList24itemBackwardsFromCurrentEPNS_4NodeEji
+__ZN7WebCore30jsDOMWindowDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSDocument14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSDocumentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore33setJSDOMWindowDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSDOMWindowEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12RenderInline5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCoreL22getPositionOffsetValueEPNS_11RenderStyleEi
+__ZN7WebCore12RenderObject10moveLayersEPNS_11RenderLayerES2_
+__ZNK7WebCore8Document7baseURIEv
+__ZN7WebCore10JSLocation3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSLocation9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17setJSLocationHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setHrefEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCoreL17navigateIfAllowedEPN3JSC9ExecStateEPNS_5FrameERKNS_4KURLEbb
+__ZNK7WebCore17RenderFlexibleBox12avoidsFloatsEv
+__ZN7WebCore13HTMLTokenizer11stopParsingEv
+__ZN7WebCore11FrameLoader22tokenizerProcessedDataEv
+__ZN7WebCore18JSHTMLDListElementD1Ev
+__ZN7WebCore21jsNodePreviousSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSStyleSheetList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsStyleSheetListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSStyleSheet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17jsStyleSheetTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsCSSStyleSheetCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSStyleRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsConsolePrototypeFunctionLogEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9JSConsole9classInfoEv
+__ZN7WebCore15ScriptCallStackC1EPN3JSC9ExecStateERKNS1_7ArgListEj
+__ZN7WebCore15ScriptCallStackC2EPN3JSC9ExecStateERKNS1_7ArgListEj
+__ZN7WebCore15ScriptCallFrameC1ERKN3JSC7UStringES4_iRKNS1_7ArgListEj
+__ZN7WebCore15ScriptCallFrameC2ERKN3JSC7UStringES4_iRKNS1_7ArgListEj
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EEC2ERKS3_
+__ZN7WebCore15ScriptCallFrameD1Ev
+__ZN7WebCore15ScriptCallFrameD2Ev
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE6shrinkEm
+__ZN7WebCore11ScriptValueD1Ev
+__ZN7WebCore7Console3logEPNS_15ScriptCallStackE
+__ZN7WebCore7Console10addMessageENS_12MessageLevelEPNS_15ScriptCallStackEb
+__ZN7WebCore15ScriptCallStack2atEj
+__ZN7WebCoreL24getFirstArgumentAsStringEPN3JSC9ExecStateERKNS_15ScriptCallFrameERNS_6StringEb
+__ZNK7WebCore15ScriptCallFrame10argumentAtEj
+__ZN7WebCore19InspectorController19addMessageToConsoleENS_13MessageSourceENS_12MessageLevelEPNS_15ScriptCallStackE
+__ZN7WebCore15ScriptCallStackD1Ev
+__ZN7WebCore15ScriptCallStackD2Ev
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE6shrinkEm
+__ZNK7WebCore26CSSMutableStyleDeclaration14getCommonValueEPKii
+__ZNK7WebCore26CSSMutableStyleDeclaration18isPropertyImplicitEi
+__ZN7WebCore24jsHTMLImageElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6heightEb
+__ZN7WebCore19JSHTMLSelectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL30createHTMLOptionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLOptionElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLOptionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLOptionElementEEE
+__ZN7WebCore19JSHTMLOptionElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLOptionElementEEE
+__ZN7WebCore19JSHTMLOptionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsHTMLAnchorElementSearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement6searchEv
+__ZN7WebCore10JSLocation16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore10JSLocation22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore19JSLocationPrototype9classInfoEv
+__ZNK7WebCore21HTMLFrameOwnerElement15contentDocumentEv
+__ZN7WebCore17checkNodeSecurityEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore33setJSHTMLIFrameElementFrameBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase14setFrameBorderERKNS_6StringE
+__ZN7WebCore18JSHTMLDListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore22reportCurrentExceptionEPN3JSC9ExecStateE
+__ZThn44_N7WebCore8Document15reportExceptionERKNS_6StringEiS3_
+__ZThn4_N7WebCore17HTMLScriptElementD0Ev
+__ZN7WebCore19jsDOMWindowOnresizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onresizeEv
+__ZN7WebCore22setJSDOMWindowOnresizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnresizeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore19JSHTMLOptionElementD1Ev
+__ZN7WebCore15jsDocumentLinksEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document5linksEv
+__ZN7WebCore23jsHTMLAnchorElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9RenderBox36tryLayoutDoingPositionedMovementOnlyEv
+__ZThn4_N7WebCore18HTMLHeadingElementD0Ev
+__ZThn4_N7WebCore13HTMLBRElementD0Ev
+__ZN7WebCore18jsDOMWindowOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onerrorEv
+__ZN7WebCore22jsHTMLEmbedElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSHTMLEmbedElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14DragController27mayStartDragAtEventLocationEPKNS_5FrameERKNS_8IntPointE
+__ZNK7WebCore12EventHandler22dragHysteresisExceededERKNS_8IntPointE
+__ZN7WebCore47jsElementPrototypeFunctionGetBoundingClientRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element21getBoundingClientRectEv
+__ZN7WebCore11RenderBlock13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE15reserveCapacityEm
+__ZN7WebCore10ClientRectC1ERKNS_7IntRectE
+__ZN7WebCore10ClientRectC2ERKNS_7IntRectE
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE6shrinkEm
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10ClientRectE
+__ZN7WebCore12JSClientRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSClientRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10ClientRectEEE
+__ZN7WebCore12JSClientRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10ClientRectEEE
+__ZN7WebCore12JSClientRect18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsClientRectLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsElementScrollLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element10scrollLeftEv
+__ZNK7WebCore9RenderBox10scrollLeftEv
+__ZNK7WebCore15HTMLBodyElement10scrollLeftEv
+__ZN7WebCoreL13adjustForZoomEiPNS_9FrameViewE
+__ZNK7WebCore5Frame10zoomFactorEv
+__ZN7WebCore15jsClientRectTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsElementScrollTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element9scrollTopEv
+__ZNK7WebCore9RenderBox9scrollTopEv
+__ZNK7WebCore15HTMLBodyElement9scrollTopEv
+__ZN7WebCore19jsElementClientLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element10clientLeftEv
+__ZN7WebCore18jsElementClientTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element9clientTopEv
+__ZNK7WebCore17JSHTMLHtmlElement9classInfoEv
+__ZN7WebCore40jsDocumentPrototypeFunctionCreateCommentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document13createCommentERKNS_6StringE
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore9JSComment15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSCommentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CommentEEE
+__ZN7WebCore9JSCommentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CommentEEE
+__ZNK7WebCore9JSComment9classInfoEv
+__ZN7WebCore42jsElementPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore15jsNodeLastChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsCSSStyleDeclarationCssTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore31setJSCSSStyleDeclarationCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore26CSSMutableStyleDeclaration10setCssTextERKNS_6StringERi
-__ZN7WebCore29jsHTMLInputElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore14XMLHttpRequest16getRequestHeaderERKNS_12AtomicStringE
-__ZN7WebCore8FormData6createERKNS_7CStringE
-__ZNK7WebCore12RenderObject14isDescendantOfEPKS0_
-__ZN7WebCore17SubresourceLoader11didSendDataEyy
-__ZThn8_N7WebCore24DocumentThreadableLoader11didSendDataEPNS_17SubresourceLoaderEyy
-__ZN7WebCore24DocumentThreadableLoader11didSendDataEPNS_17SubresourceLoaderEyy
-__ZThn8_N7WebCore14XMLHttpRequest11didSendDataEyy
-__ZN7WebCore14XMLHttpRequest11didSendDataEyy
-__ZN7WebCore28JSHTMLIFrameElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12EventHandler33clearPendingFrameUnloadEventCountEv
-__ZN7WebCore12EventHandler39clearPendingFrameBeforeUnloadEventCountEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E4findIS3_NS_22IdentityHashTranslatorIS3_S5_S9_EEEENS_17HashTableIteratorIS3_S5_S7_S9_SE_SC_EERKT_
-__ZN7WebCore17HTMLIFrameElement19removedFromDocumentEv
-__ZN7WebCore20HTMLFrameElementBase19removedFromDocumentEv
-__ZN7WebCore27JSXMLHttpRequestConstructorD0Ev
-__ZN7WebCore21JSDocumentConstructorD0Ev
-__ZN7WebCore18JSConsolePrototypeD0Ev
+__ZN7WebCore16JSDOMWindowShell14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore11JSDOMWindow14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore19setJSDocumentDomainEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document9setDomainERKNS_6StringE
+__ZN7WebCore14SecurityOrigin16setDomainFromDOMERKNS_6StringE
+__ZN7WebCore16ScriptController20updateSecurityOriginEv
+__ZN7WebCore12JSClientRectD1Ev
+__ZN7WebCore12JSClientRectD2Ev
+__ZN7WebCore9JSCommentD1Ev
+__ZN7WebCore19jsDOMWindowOnunloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onunloadEv
+__ZN7WebCore22setJSDOMWindowOnunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore38jsDocumentPrototypeFunctionExecCommandEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore37valueToStringWithUndefinedOrNullCheckEPN3JSC9ExecStateENS0_7JSValueE
+__ZN7WebCore8Document11execCommandERKNS_6StringEbS3_
+__ZN7WebCoreL7commandEPNS_8DocumentERKNS_6StringEb
+__ZN7WebCore6Editor7CommandC1Ev
+__ZN7WebCore6Editor7CommandC2Ev
+__ZNK7WebCore6Editor7Command7executeERKNS_6StringEPNS_5EventE
+__ZN7WebCore49jsDocumentPrototypeFunctionCreateDocumentFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18JSDocumentFragment15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSDocumentFragmentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DocumentFragmentEEE
+__ZN7WebCore18JSDocumentFragmentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DocumentFragmentEEE
+__ZN7WebCore18JSDocumentFragment18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSDocumentFragmentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSDocumentFragment9classInfoEv
+__ZN7WebCore19setJSNodeOnkeypressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node13setOnkeypressEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18JSHTMLTableElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL36createHTMLTableSectionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore25JSHTMLTableSectionElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSHTMLTableSectionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableSectionElementEEE
+__ZN7WebCore25JSHTMLTableSectionElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableSectionElementEEE
+__ZN7WebCore25JSHTMLTableSectionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL32createHTMLTableRowElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLTableRowElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLTableRowElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableRowElementEEE
+__ZN7WebCore21JSHTMLTableRowElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableRowElementEEE
+__ZN7WebCore21JSHTMLTableRowElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSHTMLTableRowElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSHTMLTableRowElement9classInfoEv
+__ZN7WebCore46jsNodePrototypeFunctionCompareDocumentPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12RenderObject32handleDynamicFloatPositionChangeEv
+__ZN7WebCore11RenderBlock20childBecameNonInlineEPNS_12RenderObjectE
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE15reserveCapacityEm
+__ZN7WebCore22jsHTMLAnchorElementRelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement3relEv
+__ZN7WebCore18JSDocumentFragmentD1Ev
+__ZN7WebCore21JSHTMLTableRowElementD1Ev
+__ZN7WebCore25JSHTMLTableSectionElementD1Ev
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE15reserveCapacityEm
+__ZNK7WebCore15FontDescription13lighterWeightEv
+__ZN7WebCore32jsDOMWindowPrototypeFunctionOpenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow4openEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow10allowPopUpEPNS_5FrameE
+__ZN7WebCore42jsNodePrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15JSMimeTypeArray18canGetItemsForNameEPN3JSC9ExecStateEPNS_13MimeTypeArrayERKNS1_10IdentifierE
+__ZN7WebCore13MimeTypeArray18canGetItemsForNameERKNS_12AtomicStringE
+__ZN7WebCore15JSMimeTypeArray10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore13MimeTypeArray9namedItemERKNS_12AtomicStringE
+__ZN7WebCore8MimeTypeC1EN3WTF10PassRefPtrINS_10PluginDataEEEj
+__ZN7WebCore8MimeTypeC2EN3WTF10PassRefPtrINS_10PluginDataEEEj
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8MimeTypeE
+__ZN7WebCore10JSMimeType15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSMimeTypeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8MimeTypeEEE
+__ZN7WebCore10JSMimeTypeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8MimeTypeEEE
+__ZN7WebCore10JSMimeType18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsMimeTypeEnabledPluginEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType13enabledPluginEv
+__ZNK7WebCore18JSHTMLParamElement9classInfoEv
+__ZN7WebCore35jsNodePrototypeFunctionReplaceChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode12replaceChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_15CaseFoldingHashENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E6expand
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E6rehash
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E13alloc
+__ZN7WebCore20setJSNodeOnmouseoverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOnmouseoverEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore19setJSNodeOnmouseoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node13setOnmouseoutEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSNodeOnmousewheelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node15setOnmousewheelEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18jsNodeOnmousewheelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node12onmousewheelEv
+__ZN7WebCore20jsElementClientWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element11clientWidthEv
+__ZN7WebCore21jsElementClientHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Comment9cloneNodeEb
+__ZN7WebCore10JSMimeTypeD1Ev
+__ZN7WebCore10JSMimeTypeD2Ev
+__ZN7WebCore8MimeTypeD1Ev
+__ZN7WebCore8MimeTypeD2Ev
+__ZN7WebCore22jsDOMWindowPageXOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7scrollXEv
+__ZN7WebCore22jsDOMWindowPageYOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7scrollYEv
+__ZN7WebCore21jsElementScrollHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement12scrollHeightEv
+__ZNK7WebCore7Element12scrollHeightEv
+__ZNK7WebCore9RenderBox12scrollHeightEv
+__ZThn4_N7WebCore23TextControlInnerElementD0Ev
+__ZThn64_NK7WebCore16HTMLInputElement11placeholderEv
+__ZN7WebCore22JSHTMLTableCellElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore31jsNodeListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL21imgToimageConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZThn44_NK7WebCore8Document10virtualURLEv
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE6shrinkEm
+__ZN7WebCore32jsHTMLSelectElementSelectedIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn44_NK7WebCore8Document18virtualCompleteURLERKNS_6StringE
+__ZN7WebCore19CSSCursorImageValueC1ERKNS_6StringERKNS_8IntPointE
+__ZN7WebCore19CSSCursorImageValueC2ERKNS_6StringERKNS_8IntPointE
+__ZN7WebCore19CSSCursorImageValue23updateIfSVGCursorIsUsedEPNS_7ElementE
+__ZN7WebCore19CSSCursorImageValue11cachedImageEPNS_9DocLoaderE
+__ZN7WebCore11RenderStyle9addCursorEPNS_11CachedImageERKNS_8IntPointE
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE15reserveCapacityEm
+__ZThn8_N7WebCore24DocumentThreadableLoader29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZThn8_N7WebCore24DocumentThreadableLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZThn8_N7WebCore14XMLHttpRequest18didReceiveResponseERKNS_16ResourceResponseE
+__ZThn8_N7WebCore24DocumentThreadableLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZThn8_N7WebCore14XMLHttpRequest14didReceiveDataEPKci
+__ZThn8_N7WebCore24DocumentThreadableLoader16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZThn8_N7WebCore14XMLHttpRequest16didFinishLoadingEm
+__ZThn44_N7WebCore8Document33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZThn44_N7WebCore8Document10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
+__ZN7WebCoreL10cornerRectEPKNS_11RenderLayerERKNS_7IntRectE
+__ZN7WebCoreL14modConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore14HTMLModElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLModElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore14HTMLModElement17endTagRequirementEv
+__ZNK7WebCore14HTMLModElement11tagPriorityEv
+__ZN7WebCore24jsHTMLIFrameElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLIFrameElement5widthEv
+__ZN7WebCore25jsHTMLIFrameElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLIFrameElement6heightEv
+__ZN7WebCore32jsHTMLIFrameElementContentWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21HTMLFrameOwnerElement13contentWindowEv
+__ZN7WebCore39jsDOMWindowPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow11postMessageEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow11postMessageERKNS_6StringEPNS_11MessagePortES3_PS0_Ri
+__ZN7WebCore12MessageEventC1ERKNS_6StringES3_S3_N3WTF10PassRefPtrINS_9DOMWindowEEENS5_INS_11MessagePortEEE
+__ZN7WebCore12MessageEventC2ERKNS_6StringES3_S3_N3WTF10PassRefPtrINS_9DOMWindowEEENS5_INS_11MessagePortEEE
+__ZN7WebCore26jsHTMLSelectElementOptionsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement7optionsEv
+__ZN7WebCore21HTMLOptionsCollection6createEN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
+__ZN7WebCore21HTMLOptionsCollectionC1EN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
+__ZN7WebCore21HTMLOptionsCollectionC2EN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
+__ZN7WebCore23JSHTMLOptionsCollection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSHTMLCollectionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSHTMLOptionsCollectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLOptionsCollectionEEE
+__ZN7WebCore23JSHTMLOptionsCollectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLOptionsCollectionEEE
+__ZN7WebCore23JSHTMLOptionsCollection3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSHTMLOptionsCollectionLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23JSHTMLOptionsCollection9setLengthEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore21HTMLOptionsCollection9setLengthEjRi
+__ZN7WebCore17HTMLSelectElement9setLengthEjRi
+__ZNK7WebCore17HTMLSelectElement6lengthEv
+__ZThn4_N7WebCore17HTMLOptionElementD0Ev
+__ZN7WebCore25jsHTMLSelectElementLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsDOMWindowOptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow6optionEPN3JSC9ExecStateE
+__ZN7WebCore19JSOptionConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore19JSOptionConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore28JSHTMLOptionElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSOptionConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL26constructHTMLOptionElementEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore19JSOptionConstructor8documentEv
+__ZN7WebCore17HTMLOptionElement8setValueERKNS_6StringE
+__ZN7WebCore17HTMLOptionElement18setDefaultSelectedEb
+__ZN7WebCore17HTMLOptionElement11setSelectedEb
+__ZN7WebCore23JSHTMLOptionsCollection3putEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore23JSHTMLOptionsCollection11indexSetterEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore17selectIndexSetterEPNS_17HTMLSelectElementEPN3JSC9ExecStateEjNS2_7JSValueE
+__ZN7WebCore19toHTMLOptionElementEN3JSC7JSValueE
+__ZNK7WebCore19JSHTMLOptionElement9classInfoEv
+__ZN7WebCore17HTMLSelectElement9setOptionEjPNS_17HTMLOptionElementERi
+__ZN7WebCore17HTMLSelectElement3addEPNS_11HTMLElementES2_Ri
+__ZN7WebCore19JSOptionConstructor4markEv
+__ZThn4_N7WebCore16HTMLInputElementD0Ev
+__ZN7WebCore23JSHTMLOptionsCollectionD1Ev
+__ZN7WebCore21HTMLOptionsCollectionD0Ev
+__ZN7WebCore19jsNodeOnselectstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node13onselectstartEv
+__ZN7WebCore22setJSNodeOnselectstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node16setOnselectstartEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore44jsHTMLDocumentPrototypeFunctionCaptureEventsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12HTMLDocument13captureEventsEv
+__ZN7WebCore41jsDOMWindowPrototypeFunctionCaptureEventsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow13captureEventsEv
+__ZN7WebCore20setJSNodeOnmousemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOnmousemoveEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18setJSNodeOnmouseupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node12setOnmouseupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowScrollXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN3WTFeqIN7WebCore10CursorDataELm0EEEbRKNS_6VectorIT_XT0_EEES7_
+__ZN7WebCore16PostMessageTimer5firedEv
+__ZN7WebCore9DOMWindow21postMessageTimerFiredEPNS_16PostMessageTimerE
+__ZN7WebCore16PostMessageTimerD0Ev
+__ZN7WebCore12MessageEventD0Ev
+__ZN7WebCore22setJSElementScrollLeftEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore7Element13setScrollLeftEi
+__ZN7WebCore9RenderBox13setScrollLeftEi
+__ZN7WebCore18jsDOMWindowScrollYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25setJSXMLHttpRequestOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSXMLHttpRequestOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore9FloatRectcv7_NSRectEv
+__ZN7WebCore23jsDOMWindowFrameElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow12frameElementEv
+__ZN7WebCore22jsHTMLScriptElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement3srcEv
+__ZNK7WebCore27XMLHttpRequestProgressEvent29isXMLHttpRequestProgressEventEv
+__ZN7WebCore15getDOMStructureINS_29JSXMLHttpRequestProgressEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore29JSXMLHttpRequestProgressEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSProgressEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSXMLHttpRequestProgressEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27XMLHttpRequestProgressEventEEE
+__ZN7WebCore29JSXMLHttpRequestProgressEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27XMLHttpRequestProgressEventEEE
+__ZN7WebCore35setJSHTMLSelectElementSelectedIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9JSComment18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSHTMLTableElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLTableElement9classInfoEv
+__ZN7WebCore34JSHTMLTableSectionElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSHTMLTableSectionElement9classInfoEv
+__ZN7WebCore28JSHTMLSelectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSHTMLSelectElement9classInfoEv
+__ZNK7WebCore18JSHTMLEmbedElement9classInfoEv
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_39jsDOMWindowPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS1_8JSObject
+__ZN7WebCore18JSHTMLStyleElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLStyleElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLStyleElement7setTypeERKNS_12AtomicStringE
+__ZN7WebCore25setJSHTMLElementInnerTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSCSSStyleDeclarationCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16jsNodeOnmouseoutEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node10onmouseoutEv
+__ZN7WebCore26setJSHTMLIFrameElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase7setNameERKNS_6StringE
+__ZN7WebCore31setJSHTMLIFrameElementScrollingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase12setScrollingERKNS_6StringE
+__ZNK7WebCore12RenderInline30relativePositionedInlineOffsetEPKNS_9RenderBoxE
+__ZNK7WebCore12RenderInline9offsetTopEv
+__ZNK7WebCore12RenderInline10offsetLeftEv
+__ZN7WebCore16FixedTableLayoutC1EPNS_11RenderTableE
+__ZN7WebCore16FixedTableLayoutC2EPNS_11RenderTableE
+__ZN7WebCore16FixedTableLayout14calcPrefWidthsERiS1_
+__ZN7WebCore16FixedTableLayout14calcWidthArrayEi
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE4fillERKS2_m
+__ZSt4fillIPN7WebCore6LengthES1_EvT_S3_RKT0_
+__ZN7WebCore16FixedTableLayout6layoutEv
+__ZN7WebCore29JSXMLHttpRequestProgressEventD1Ev
+__ZThn268_N7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
+__ZN7WebCore23jsHTMLImageElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement5widthEb
+__ZN7WebCore22jsHTMLParamElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLParamElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsDOMWindowDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21ApplicationCacheGroup27fallbackCacheForMainRequestERKNS_15ResourceRequestEPNS_14DocumentLoaderE
+__ZN7WebCore23ApplicationCacheStorage24fallbackCacheGroupForURLERKNS_4KURLE
+__ZNK7WebCore11FrameLoader23isHostedByObjectElementEv
+__ZN7WebCore11FrameLoader21handleFallbackContentEv
+__ZN7WebCoreL12radioMarginsEj
+__ZN7WebCore5Image12supportsTypeERKNS_6StringE
+__ZN7WebCore16MIMETypeRegistry32isSupportedImageResourceMIMETypeERKNS_6StringE
+__ZN7WebCore13ImageDocumentC1EPNS_5FrameE
+__ZN7WebCore13ImageDocumentC2EPNS_5FrameE
+__ZNK7WebCore13ImageDocument17shouldShrinkToFitEv
+__ZN7WebCore13ImageDocument15createTokenizerEv
+__ZNK7WebCore14ImageTokenizer12wantsRawDataEv
+__ZN7WebCore14ImageTokenizer12writeRawDataEPKci
+__ZN7WebCore13ImageDocument11cachedImageEv
+__ZN7WebCore13ImageDocument23createDocumentStructureEv
+__ZNK7WebCore14DocumentLoader16mainResourceDataEv
+__ZN7WebCore13ImageDocument12imageChangedEv
+__ZN7WebCore14ImageTokenizer6finishEv
+__ZNK7WebCore14DocumentLoader25isLoadingMultipartContentEv
+__ZNK7WebCore4KURL17lastPathComponentEv
+__ZN7WebCore10imageTitleERKNS_6StringERKNS_7IntSizeE
+__ZN7WebCore14ImageTokenizerD0Ev
+__ZN7WebCore20jsNamedNodeMapLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore12NamedNodeMap4itemEj
+__ZN7WebCore6JSAttr18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10jsAttrNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11jsAttrValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLAreaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSHTMLAreaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore23jsHTMLIFrameElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase4nameEv
+__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHa
+__ZN7WebCore17jsHTMLElementLangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement4langEv
+__ZN7WebCore20jsHTMLLinkElementRelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement3relEv
+__ZN7WebCore11RenderTable16overflowClipRectEii
+__ZN7WebCore6JSAttrD1Ev
+__ZN7WebCore40jsDocumentPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19jsCharacterDataDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsHTMLMetaElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement4nameEv
+__ZN7WebCore21jsHTMLFormElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFormElement4nameEv
+__ZN7WebCore16JSDOMWindowShell15unwrappedObjectEv
+__ZNK3JSC14JSGlobalObject14isGlobalObjectEv
+__ZN7WebCore16HTMLEmbedElement13canLazyAttachEv
+__ZN7WebCore18MainResourceLoader7didFailERKNS_13ResourceErrorE
+__ZN7WebCore18MainResourceLoader13receivedErrorERKNS_13ResourceErrorE
+__ZN7WebCore23setJSHTMLLinkElementRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement6setRelERKNS_6StringE
+__ZN7WebCore24setJSHTMLLinkElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement7setTypeERKNS_6StringE
+__ZN7WebCore25setJSHTMLLinkElementMediaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement8setMediaERKNS_6StringE
+__ZN7WebCore27setJSHTMLIFrameElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLIFrameElement8setWidthERKNS_6StringE
+__ZN7WebCore28setJSHTMLIFrameElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLIFrameElement9setHeightERKNS_6StringE
+__ZN7WebCore33setJSHTMLIFrameElementMarginWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase14setMarginWidthERKNS_6StringE
+__ZN7WebCore34setJSHTMLIFrameElementMarginHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase15setMarginHeightERKNS_6StringE
+__ZThn4_N7WebCore15HTMLHtmlElementD0Ev
+__ZN7WebCore11FrameLoader15didExplicitOpenEv
+__ZN7WebCore36jsHTMLDocumentPrototypeFunctionCloseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26setJSHTMLObjectElementDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement7setDataERKNS_6StringE
+__ZN7WebCore26setJSHTMLObjectElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement7setTypeERKNS_6StringE
+__ZN7WebCore18JSHTMLParamElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLParamElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLParamElement7setNameERKNS_6StringE
+__ZN7WebCore26setJSHTMLParamElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLParamElement8setValueERKNS_6StringE
+__ZN7WebCore27RenderTextControlInnerBlock16positionForPointERKNS_8IntPointE
+__ZN7WebCore5Frame27doTextFieldCommandFromEventEPNS_7ElementEPNS_13KeyboardEventE
+__ZNK7WebCore23BeforeTextInsertedEvent25isBeforeTextInsertedEventEv
+__ZN7WebCore12InputElement29handleBeforeTextInsertedEventERNS_16InputElementDataEPNS_8DocumentEPNS_5EventE
+__ZN7WebCoreL19numGraphemeClustersEPNS_10StringImplE
+__ZN7WebCore20CompositeEditCommand10appendNodeEN3WTF10PassRefPtrINS_4NodeEEENS2_INS_7ElementEEE
+__ZN7WebCore17AppendNodeCommandC1EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore17AppendNodeCommandC2EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore17AppendNodeCommand7doApplyEv
+__ZN7WebCore27RenderTextControlSingleLine17subtreeHasChangedEv
+__ZN7WebCore17RenderTextControl17subtreeHasChangedEv
+__ZThn64_N7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
+__ZN7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
+__ZN7WebCore12InputElement20setValueFromRendererERNS_16InputElementDataEPNS_8DocumentERKNS_6StringE
+__ZThn64_NK7WebCore16HTMLInputElement30searchEventsShouldBeDispatchedEv
+__ZNK7WebCore16HTMLInputElement30searchEventsShouldBeDispatchedEv
+__ZN7WebCore5Frame24textFieldDidBeginEditingEPNS_7ElementE
+-[DOMHTMLInputElement value]
+__ZN7WebCore5Frame24textDidChangeInTextFieldEPNS_7ElementE
+-[DOMHTMLInputElement form]
+__Z3kitPN7WebCore15HTMLFormElementE
+-[DOMHTMLFormElement action]
+__ZNK7WebCore15HTMLFormElement6actionEv
+-[DOMHTMLInputElement(FormPromptAdditions) _isEdited]
+-[DOMHTMLInputElement disabled]
+__ZN7WebCore5Frame25matchLabelsAgainstElementEP7NSArrayPNS_7ElementE
+__ZN7WebCore7replaceERNS_6StringERKNS_17RegularExpressionERKS0_
+__ZN7WebCore17RegularExpressionD1Ev
+__ZN7WebCore17RegularExpressionD2Ev
+__ZN7WebCore17RegularExpression7PrivateD1Ev
+__ZN7WebCore17RegularExpression7PrivateD2Ev
+__ZN7WebCoreL15regExpForLabelsEP7NSArray
+__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE15reserveCapacityEm
+__ZN7WebCore5Frame28searchForLabelsBeforeElementEP7NSArrayPNS_7ElementE
+__ZNK7WebCore17RegularExpression9searchRevERKNS_6StringE
+__ZNK7WebCore17RegularExpression13matchedLengthEv
+__ZNK7WebCore6Editor7Command7executeEPNS_5EventE
+__ZN7WebCoreL21enabledInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL20executeInsertNewlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL11targetFrameEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor13canEditRichlyEv
+__ZN7WebCore22HTMLFormControlElement8onChangeEv
+__ZN7WebCore15HTMLFormElement11submitClickEPNS_5EventE
+__ZNK7WebCore16HTMLInputElement24isSuccessfulSubmitButtonEv
+__ZN7WebCore4Node22dispatchSimulatedClickEN3WTF10PassRefPtrINS_5EventEEEbb
+__ZN7WebCore4Node27dispatchSimulatedMouseEventERKNS_12AtomicStringEN3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore15HTMLFormElement13prepareSubmitEPNS_5EventE
+__ZNK7WebCore16HTMLInputElement17isActivatedSubmitEv
+-[DOMDocument URL]
+__ZN7WebCore27runtimeObjectPropertyGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings6MethodENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3setEPS4
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS2_8Bindings6MethodEENS_18PairFirstExtractorISA_EENS_7StrHashIS5
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE6shrinkEm
+__ZN3JSC16RuntimeObjectImp12methodGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC13RuntimeMethodC1EPNS_9ExecStateERKNS_10IdentifierERN3WTF6VectorIPNS_8Bindings6MethodELm0EEE
+__ZN3JSC13RuntimeMethodC2EPNS_9ExecStateERKNS_10IdentifierERN3WTF6VectorIPNS_8Bindings6MethodELm0EEE
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EEC1ERKS5_
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EEC2ERKS5_
+__ZN3JSC13RuntimeMethod11getCallDataERNS_8CallDataE
+__ZN3JSCL17callRuntimeMethodEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN7WebCore18JSHTMLEmbedElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore19runtimeObjectGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3JSC16RuntimeObjectImp9classInfoEv
+__ZN3JSC8Bindings9CInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListE
+__ZN3JSC8Bindings9CInstance30moveGlobalExceptionToExecStateEPNS_9ExecStateE
+__ZN3JSC8BindingsL21globalExceptionStringEv
+__ZN3JSC8Bindings23convertNPVariantToValueEPNS_9ExecStateEPK10_NPVariantPNS0_10RootObjectE
+__ZN3WTF6VectorI10_NPVariantLm8EE6shrinkEm
+__ZN7WebCore18JSHTMLEmbedElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLLabelElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLTableElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25JSHTMLTableSectionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21JSHTMLTableRowElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN3JSC16RuntimeObjectImp10invalidateEv
+__ZN7WebCore17AppendNodeCommandD0Ev
+__ZN7WebCore13MimeTypeArrayD1Ev
+__ZThn4_N7WebCore11EditingTextD0Ev
+__ZN3JSC13RuntimeMethodD1Ev
+__ZN7WebCore15HTMLLinkElement19removedFromDocumentEv
+__ZN7WebCore16HTMLEmbedElement19removedFromDocumentEv
+__ZThn4_N7WebCore15HTMLLinkElementD0Ev
+__ZN7WebCore21JSClientRectPrototypeD1Ev
+__ZN7WebCore24JSMimeTypeArrayPrototypeD1Ev
+__ZN7WebCore18JSHistoryPrototypeD1Ev
+__ZN7WebCore27JSHTMLStyleElementPrototypeD1Ev
+__ZThn4_N7WebCore16HTMLUListElementD0Ev
+__ZN7WebCore28JSHTMLObjectElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLParamElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLEmbedElementPrototypeD1Ev
+__ZN7WebCore31JSHTMLParagraphElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLLabelElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLTableElementPrototypeD1Ev
+__ZN7WebCore34JSHTMLTableSectionElementPrototypeD1Ev
+__ZN7WebCore30JSHTMLTableRowElementPrototypeD1Ev
+__ZN7WebCore31JSHTMLTableCellElementPrototypeD1Ev
+__ZN7WebCore16HTMLLabelElement9setActiveEbb
+__ZN7WebCore16HTMLLabelElement10setHoveredEb
+__ZN7WebCore16HTMLLabelElement20correspondingControlEv
+__ZN7WebCore26CSSMutableStyleDeclarationaSERKS0_
+__ZThn4_N7WebCore17HTMLObjectElementD0Ev
+__ZN7WebCore19JSHTMLOptionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15PurgeableBufferD1Ev
+__ZN7WebCore15PurgeableBufferD2Ev
+__ZN7WebCore30JSHTMLAnchorElementConstructorD1Ev
+__ZN7WebCore27JSHTMLDivElementConstructorD1Ev
+__ZN7WebCore27JSHTMLDListElementPrototypeD1Ev
+__ZN7WebCore28JSHTMLOptionElementPrototypeD1Ev
+__ZNK7WebCore16HTMLImageElement17canStartSelectionEv
+__ZN7WebCoreL17appletConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLAppletElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLAppletElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLAppletElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore17HTMLAppletElement11tagPriorityEv
+__ZN7WebCore17HTMLAppletElement20insertedIntoDocumentEv
+__ZN7WebCore17HTMLAppletElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore17HTMLAppletElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3setERKS2_S8_
+__ZN7WebCore12RenderAppletC1EPNS_17HTMLAppletElementERKN3WTF7HashMapINS_6StringES5_NS_10StringHashENS3_10HashTraitsIS5_EES8_EE
+__ZN7WebCore12RenderAppletC2EPNS_17HTMLAppletElementERKN3WTF7HashMapINS_6StringES5_NS_10StringHashENS3_10HashTraitsIS5_EES8_EE
+__ZN7WebCore17HTMLAppletElement21finishParsingChildrenEv
+__ZN7WebCore12RenderApplet6layoutEv
+__ZN7WebCore12RenderApplet23createWidgetIfNecessaryEv
+__ZN7WebCore11FrameLoader22createJavaAppletWidgetERKNS_7IntSizeEPNS_17HTMLAppletElementERKN3WTF7HashMapINS_6StringES8_NS_10Stri
+__ZN7WebCore17jsDocumentAppletsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7appletsEv
+__ZN7WebCoreL30createHTMLAppletElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLAppletElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLAppletElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAppletElementEEE
+__ZN7WebCore19JSHTMLAppletElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAppletElementEEE
+__ZN7WebCore19JSHTMLAppletElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLAppletElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_17HTMLAppletElementERKNS1_10IdentifierE
+__ZN7WebCore19JSHTMLAppletElement24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement25renderWidgetForJSBindingsEv
+__ZN3JSC8Bindings12JavaInstanceC1EP8_jobjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings12JavaInstanceC2EP8_jobjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings14JObjectWrapperC1EP8_jobject
+__ZN3JSC8Bindings14JObjectWrapperC2EP8_jobject
+__ZN3JSC8Bindings9getJNIEnvEv
+__ZN3JSC8Bindings9getJavaVMEv
+__ZN3JSC8BindingsL21KJS_GetCreatedJavaVMsEPP7JavaVM_lPl
+__ZN3JSC8Bindings12JavaInstance12virtualBeginEv
+__ZNK3JSC8Bindings12JavaInstance8getClassEv
+__ZN3JSC8Bindings9JavaClassC1EP8_jobject
+__ZN3JSC8Bindings9JavaClassC2EP8_jobject
+__ZN3JSC8Bindings13callJNIMethodIP8_jobjectEET_S3_PKcS6_z
+__ZN3JSC8BindingsL14callJNIMethodVIP8_jobjectEET_S3_PKcS6_Pc
+__ZN3JSC8Bindings24getCharactersFromJStringEP8_jstring
+__ZN3JSC8Bindings29getCharactersFromJStringInEnvEP7JNIEnv_P8_jstring
+__ZN3JSC8Bindings27releaseCharactersForJStringEP8_jstringPKc
+__ZN3JSC8Bindings32releaseCharactersForJStringInEnvEP7JNIEnv_P8_jstringPKc
+__ZN3JSC8Bindings9JavaFieldC1EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings9JavaFieldC2EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings30getUCharactersFromJStringInEnvEP7JNIEnv_P8_jstring
+__ZN3JSC8Bindings33releaseUCharactersForJStringInEnvEP7JNIEnv_P8_jstringPKt
+__ZN3JSC8Bindings20JNITypeFromClassNameEPKc
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings5FieldENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3setEPS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS2_8Bindings5FieldEENS_18PairFirstExtractorISA_EENS_7StrHashIS5_
+__ZN3JSC8Bindings10JavaMethodC1EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings10JavaMethodC2EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings13callJNIMethodIlEET_P8_jobjectPKcS6_z
+__ZN3JSC8BindingsL14callJNIMethodVIlEET_P8_jobjectPKcS6_Pc
+__ZN3JSC8Bindings19callJNIStaticMethodIhEET_P7_jclassPKcS6_z
+__ZN7JNIEnv_23CallStaticBooleanMethodEP7_jclassP10_jmethodIDz
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS_6VectorIPNS2_8Bindings6MethodELm0EEENS_7StrHashIS5_EENS_10HashTraitsIS5_EE
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS_6VectorIPNS2_8Bindings6MethodELm0EEENS_7StrHashIS5_EENS_10HashTraitsIS5_EEN
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS_6VectorIPNS2_8Bindings6MethodELm0EEEENS_18PairFirstExtractorIS
+__ZN3JSC8Bindings13JavaParameterC1EP7JNIEnv_P8_jstring
+__ZN3JSC8Bindings13JavaParameterC2EP7JNIEnv_P8_jstring
+__ZNK3JSC8Bindings9JavaClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3JSC8Bindings9JavaClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZN3JSC8Bindings12JavaInstance10virtualEndEv
+__ZNK7WebCore19JSHTMLAppletElement9classInfoEv
+__ZN7WebCore19JSHTMLAppletElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN3JSC8Bindings12JavaInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListE
+__ZNK3JSC8Bindings10JavaMethod13numParametersEv
+__ZN3JSC8Bindings20convertValueToJValueEPNS_9ExecStateENS_7JSValueE7JNITypePKc
+__ZNK3JSC8Bindings10RootObject12nativeHandleEv
+__ZNK3JSC8Bindings10JavaMethod8methodIDEP8_jobject
+__ZNK3JSC8Bindings10JavaMethod9signatureEv
+__ZN3JSC8Bindings26signatureFromPrimitiveTypeE7JNIType
+__ZL15appendClassNameRN3JSC7UStringEPKc
+__ZN3JSC8Bindings11getMethodIDEP8_jobjectPKcS4_
+__ZNK3JSC8Bindings10JavaMethod13JNIReturnTypeEv
+__ZN3JSC8Bindings15dispatchJNICallEPNS_9ExecStateEPKvP8_jobjectb7JNITypeP10_jmethodIDP6jvalueRSA_PKcRNS_7JSValueE
+__ZN7WebCoreL27createHTMLModElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLModElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLModElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLModElementEEE
+__ZN7WebCore16JSHTMLModElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLModElementEEE
+__ZN7WebCore16JSHTMLModElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore10ShadowDataeqERKS0_
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE6shrinkEm
+__ZN7WebCoreL15checkboxMarginsEj
+__ZN7WebCore21jsHTMLEmbedElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement3srcEv
+__ZN7WebCore19jsNodeParentElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11FrameLoader21fileDoesNotExistErrorERKNS_16ResourceResponseE
+__ZN7WebCore26NetscapePlugInStreamLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore10IconLoaderD0Ev
+__ZN7WebCore19JSHTMLAppletElementD1Ev
+__ZN7WebCore16JSHTMLModElementD1Ev
+__ZThn4_N7WebCore16HTMLEmbedElementD0Ev
+__ZN7WebCore16HTMLTitleElement19removedFromDocumentEv
+__ZN7WebCore8Document11removeTitleEPNS_7ElementE
+__ZN7WebCore16HTMLStyleElement19removedFromDocumentEv
+__ZN7WebCore12StyleElement19removedFromDocumentEPNS_8DocumentE
+__ZN7WebCore5XPathL10isAxisNameERKNS_6StringERNS0_4Step4AxisE
+__ZN7WebCore5XPathL17setUpAxisNamesMapERN3WTF7HashMapINS_6StringENS0_4Step4AxisENS_10StringHashENS1_10HashTraitsIS3_EENS7_IS5_E
+__ZN3WTF7HashMapIN7WebCore6StringENS1_5XPath4Step4AxisENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_5XPath4Step4AxisEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHas
+__ZN7WebCore5XPathL13createFunLastEv
+__ZN7WebCore5XPath6FilterC1EPNS0_10ExpressionERKN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZN7WebCore5XPath6FilterC2EPNS0_10ExpressionERKN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZNK7WebCore5XPath6Filter8evaluateEv
+__ZN7WebCore5XPath5Value17modifiableNodeSetEv
+__ZNK7WebCore5XPath7FunLast8evaluateEv
+__ZNK7WebCore5XPath5Value8toNumberEv
+__ZN7WebCore5XPath6NumberC1Ed
+__ZN7WebCore5XPath6NumberC2Ed
+__ZN7WebCore5XPathL17createFunPositionEv
+__ZNK7WebCore5XPath11FunPosition8evaluateEv
+__ZNK7WebCore5XPath6Number8evaluateEv
+__ZN7WebCore5XPath11FunPositionD0Ev
+__ZN7WebCore5XPath6NumberD0Ev
+__ZN7WebCore5XPath6FilterD0Ev
+__ZN7WebCore5XPath7FunLastD0Ev
+__ZN7WebCore23jsHTMLAnchorElementHostEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4hostEv
+__ZN7WebCore5XPath6Parser9lexNumberEv
+__ZN7WebCore5XPath9NumericOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9NumericOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9NumericOpD0Ev
+__ZNK7WebCore5XPath9NumericOp8evaluateEv
+__ZN7WebCore11FrameLoader14setOpenedByDOMEv
+__ZN3WTF7HashSetIPN7WebCore5FrameENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN7WebCore13EventListener14markJSFunctionEv
+__ZN7WebCore12NamedNodeMap15removeAttributeERKNS_13QualifiedNameE
+__ZN7WebCore7Element24dispatchAttrRemovalEventEPNS_9AttributeE
+__ZN7WebCore12RenderInline11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Iden
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalid
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore22JSXPathResultPrototypeD1Ev
+__ZN7WebCore24JSXPathResultConstructorD1Ev
+__ZN7WebCore16HTMLOListElementD0Ev
+__ZN7WebCore13MediaQueryExpD1Ev
+__ZN7WebCore13MediaQueryExpD2Ev
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE6shrinkEm
+__ZN7WebCore13CSSImportRuleD0Ev
 __ZThn12_N7WebCore14XMLHttpRequest4stopEv
 __ZN7WebCore14XMLHttpRequest4stopEv
-__ZN7WebCore15FontFamilyValue20appendSpaceSeparatedEPKtj
-__ZN7WebCore6String6appendEc
-__ZN7WebCore6String6appendEPKtj
-__ZNK7WebCore12RenderInline14childrenInlineEv
-__ZN7WebCore10HTMLParser20formCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore15HTMLFormElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15FormDataBuilder15parseMethodTypeERKNS_6StringE
-__ZNK7WebCore15HTMLFormElement17endTagRequirementEv
-__ZNK7WebCore15HTMLFormElement11tagPriorityEv
-__ZN7WebCore15HTMLFormElement20insertedIntoDocumentEv
-__ZN7WebCore15HTMLFormElement6attachEv
-__ZN7WebCoreL16inputConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLInputElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore31HTMLFormControlElementWithStateC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore22HTMLFormControlElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore15HTMLFormElement19registerFormElementEPNS_22HTMLFormControlElementE
-__ZN7WebCore15HTMLFormElement19CheckedRadioButtons12removeButtonEPNS_22HTMLFormControlElementE
-__ZNK7WebCore22HTMLFormControlElement4nameEv
-__ZN7WebCore15HTMLFormElement19CheckedRadioButtons9addButtonEPNS_22HTMLFormControlElementE
-__ZNK7WebCore22HTMLFormControlElement13isRadioButtonEv
-__ZN7WebCore15HTMLFormElement16formElementIndexEPNS_22HTMLFormControlElementE
-__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE15reserveCapacityEm
-__ZN7WebCore27FormControlElementWithState35registerFormControlElementWithStateEPS0_PNS_8DocumentE
-__ZN3WTF11ListHashSetIPN7WebCore27FormControlElementWithStateENS_7PtrHashIS3_EEE3addERKS3_
-__ZN3WTF11ListHashSetIPN7WebCore27FormControlElementWithStateENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore16InputElementDataC1EPNS_12InputElementEPNS_7ElementE
-__ZNK7WebCore16HTMLInputElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLInputElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLInputElement4nameEv
-__ZNK7WebCore16InputElementData4nameEv
-__ZNK7WebCore16HTMLInputElement13isRadioButtonEv
-__ZN7WebCore16HTMLInputElement12setInputTypeERKNS_6StringE
-__ZNK7WebCore16HTMLInputElement32storesValueSeparateFromAttributeEv
-__ZN7WebCore12InputElement19updateValueIfNeededERNS_16InputElementDataE
-__ZThn72_NK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
-__ZNK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
-__ZN7WebCore12InputElement14constrainValueERKNS_16InputElementDataERKNS_6StringEi
-__ZThn72_NK7WebCore16HTMLInputElement11isTextFieldEv
-__ZNK7WebCore16HTMLInputElement11isTextFieldEv
-__ZN7WebCore12InputElement22notifyFormStateChangedERNS_16InputElementDataEPNS_8DocumentE
-__ZN7WebCore22HTMLFormControlElement23setValueMatchesRendererEb
-__ZNK7WebCore16HTMLInputElement17endTagRequirementEv
-__ZNK7WebCore16HTMLInputElement11tagPriorityEv
-__ZN7WebCore22HTMLFormControlElement16insertedIntoTreeEb
-__ZN7WebCore16HTMLInputElement6attachEv
-__ZN7WebCore22HTMLFormControlElement6attachEv
-__ZNK7WebCore16HTMLInputElement12isAutofilledEv
-__ZN7WebCoregtERNS_11CSSRuleDataES1_
-__ZN7WebCore11CSSSelector11specificityEv
-__ZNK7WebCore14RenderThemeMac10systemFontEiRNS_15FontDescriptionE
-__ZN7WebCoreL12toFontWeightEi
-__ZN7WebCore11RenderStyle13setTextShadowEPNS_10ShadowDataEb
-__ZN7WebCore22StyleRareInheritedDataC1ERKS0_
-__ZNK7WebCore22HTMLFormControlElement9isControlEv
-__ZN7WebCore16HTMLInputElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore22StyleRareInheritedDataD1Ev
-__ZNK7WebCore22HTMLFormControlElement9autofocusEv
-__ZNK7WebCore7Element12hasAttributeERKNS_13QualifiedNameE
-__ZNK7WebCore7Element14hasAttributeNSERKNS_6StringES3_
-__ZNK7WebCore7Element10attributesEb
-__ZN7WebCore31HTMLFormControlElementWithState21finishParsingChildrenEv
-__ZNK7WebCore8Document26hasStateForNewFormElementsEv
-__ZN7WebCore9FillLayeraSERKS0_
-__ZN7WebCore11RenderTheme11adjustStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementEbRKNS_10BorderDataERKNS_9FillLayerERKNS_5ColorE
-__ZNK7WebCore14RenderThemeMac15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_9FillLayerERKNS_5ColorE
-__ZN7WebCore11RenderStyle12setBoxShadowEPNS_10ShadowDataEb
-__ZN7WebCore16HTMLInputElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore27RenderTextControlSingleLineC1EPNS_4NodeE
-__ZN7WebCore17RenderTextControlC2EPNS_4NodeE
-__ZN7WebCore27RenderTextControlSingleLine14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore17RenderTextControl14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore27RenderTextControlSingleLine17updateFromElementEv
-__ZN7WebCore27RenderTextControlSingleLine21createSubtreeIfNeededEv
-__ZNK7WebCore27RenderTextControlSingleLine12inputElementEv
-__ZN7WebCore14toInputElementEPNS_7ElementE
-__ZThn72_NK7WebCore16HTMLInputElement13isSearchFieldEv
-__ZNK7WebCore16HTMLInputElement13isSearchFieldEv
-__ZN7WebCore17RenderTextControl21createSubtreeIfNeededEPNS_23TextControlInnerElementE
-__ZN7WebCore27TextControlInnerTextElementC1EPNS_8DocumentEPNS_4NodeE
-__ZN7WebCore23TextControlInnerElementC1EPNS_8DocumentEPNS_4NodeE
-__ZNK7WebCore27RenderTextControlSingleLine20createInnerTextStyleEPKNS_11RenderStyleE
-__ZNK7WebCore27RenderTextControlSingleLine26placeholderShouldBeVisibleEv
-__ZThn72_NK7WebCore16HTMLInputElement26placeholderShouldBeVisibleEv
-__ZNK7WebCore16HTMLInputElement26placeholderShouldBeVisibleEv
-__ZNK7WebCore17RenderTextControl20adjustInnerTextStyleEPKNS_11RenderStyleEPS1_
-__ZNK7WebCore22HTMLFormControlElement17isReadOnlyControlEv
-__ZNK7WebCore22HTMLFormControlElement9isEnabledEv
-__ZNK7WebCore22HTMLFormControlElement8disabledEv
-__ZN7WebCore23TextControlInnerElement18attachInnerElementEPNS_4NodeEN3WTF10PassRefPtrINS_11RenderStyleEEEPNS_11RenderArenaE
-__ZN7WebCore27TextControlInnerTextElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore23TextControlInnerElement12isShadowNodeEv
-__ZNK7WebCore27RenderTextControlSingleLine11isTextFieldEv
-__ZN7WebCore9FrameView25scheduleRelayoutOfSubtreeEPNS_12RenderObjectE
-__ZN7WebCore17RenderTextControl17updateFromElementEv
-__ZNK7WebCore17RenderTextControl18formControlElementEv
-__ZN7WebCore20toFormControlElementEPNS_7ElementE
-__ZNK7WebCore22HTMLFormControlElement20isFormControlElementEv
-__ZThn56_NK7WebCore22HTMLFormControlElement20valueMatchesRendererEv
-__ZNK7WebCore22HTMLFormControlElement20valueMatchesRendererEv
-__ZThn72_NK7WebCore16HTMLInputElement5valueEv
-__ZNK7WebCore16HTMLInputElement5valueEv
-__ZN7WebCore17RenderTextControl17setInnerTextValueERKNS_6StringE
-__ZN7WebCore17RenderTextControl4textEv
-__ZNK7WebCore17RenderTextControl10finishTextERN3WTF6VectorItLm0EEE
-__ZN7WebCore11HTMLElement12setInnerTextERKNS_6StringERi
-__ZThn56_N7WebCore22HTMLFormControlElement23setValueMatchesRendererEb
-__ZN7WebCore22HTMLFormControlElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore11RenderTheme15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_9FillLayerERKNS_5ColorE
-__ZN7WebCore7CStringC1EPKcj
-__ZN7WebCore7CString4initEPKcj
-__ZN7WebCore12IconDatabase22loadDecisionForIconURLERKNS_6StringEPNS_14DocumentLoaderE
-__ZN7WebCore10IconLoader6createEPNS_5FrameE
-__ZN7WebCore10IconLoaderC1EPNS_5FrameE
-__ZN7WebCore10IconLoader12startLoadingEv
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE15reserveCapacityEm
-__ZN7WebCore12IconDatabase30writeIconSnapshotToSQLDatabaseERKNS_12IconSnapshotE
-__ZN7WebCore12IconDatabase34getIconIDForIconURLFromSQLDatabaseERKNS_6StringE
-__ZN7WebCore15SQLiteStatement8bindNullEi
-sqlite3_bind_null
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE6shrinkEm
-__ZN7WebCore11prefetchDNSERKNS_6StringE
-__ZN7WebCore23JSAbstractEventListener11handleEventEPNS_5EventEb
-__ZNK7WebCore19JSLazyEventListener11listenerObjEv
-__ZNK7WebCore19JSLazyEventListener9parseCodeEv
-__ZNK7WebCore15JSEventListener12globalObjectEv
-__ZThn44_NK7WebCore8Document10isDocumentEv
-__ZNK7WebCore8Document10isDocumentEv
-__ZThn44_NK7WebCore8Document10virtualURLEv
-__ZNK7WebCore8Document10virtualURLEv
-__ZN3WTF6VectorIN3JSC8RegisterELm8EE6shrinkEm
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_5EventE
-__ZNK7WebCore5Event9isUIEventEv
-__ZNK7WebCore5Event15isMutationEventEv
-__ZNK7WebCore5Event15isOverflowEventEv
-__ZNK7WebCore5Event14isMessageEventEv
-__ZNK7WebCore5Event15isProgressEventEv
-__ZNK7WebCore5Event14isStorageEventEv
-__ZNK7WebCore5Event22isWebKitAnimationEventEv
-__ZNK7WebCore5Event23isWebKitTransitionEventEv
-__ZN7WebCore7JSEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN3JSC9Structure6createENS_10JSValuePtrERKNS_8TypeInfoE
-__ZN7WebCore7JSEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5EventEEE
-__ZN7WebCore17JSDOMGlobalObject12currentEventEv
-__ZNK7WebCore22HTMLFormControlElement11virtualFormEv
-__ZN7WebCore22JSHTMLElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore8Document14getElementByIdERKNS_12AtomicStringE
-__ZL19windowProtoFuncOpenPN3JSC9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN7WebCoreL10allowPopUpEPN3JSC9ExecStateE
-__ZNK7WebCore16ScriptController21processingUserGestureEv
+__ZN7WebCore21JSDocumentConstructorD1Ev
+__ZN7WebCore25JSXMLHttpRequestPrototypeD1Ev
+__ZN7WebCore27JSXMLHttpRequestConstructorD1Ev
+__ZN7WebCore9JSConsoleD1Ev
+__ZN7WebCore9JSConsoleD2Ev
+__ZN7WebCore18JSConsolePrototypeD1Ev
+__ZThn4_N7WebCore13HTMLLIElementD0Ev
+__ZThn4_N7WebCore17HTMLSelectElementD0Ev
+__ZThn4_N7WebCore16HTMLDListElementD0Ev
+__ZN7WebCore23jsHTMLAnchorElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4typeEv
+__ZNK7WebCore11RenderBlock14positionForBoxEPNS_9InlineBoxEb
+__ZN7WebCore20jsHTMLLIElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLLIElement5valueEv
+__ZN7WebCore26jsHTMLLIElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSHTMLLIElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSHTMLLIElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19jsHTMLLIElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLLIElement4typeEv
+__ZNK7WebCore26CSSMutableStyleDeclaration24getLayeredShorthandValueEPKij
+__ZNK7WebCore8CSSValue22isImplicitInitialValueEv
+__ZN7WebCore29jsHTMLUListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLUListElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLUListElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore38jsEventPrototypeFunctionPreventDefaultEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21setJSEventReturnValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39jsEventPrototypeFunctionStopPropagationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore22setJSEventCancelBubbleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore27jsHTMLAnchorElementProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8protocolEv
+__ZN7WebCore25jsHTMLAnchorElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsAttrSpecifiedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLImageElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLImageElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLLIElementConstructorD1Ev
+__ZN7WebCore33JSHTMLParagraphElementConstructorD1Ev
+__ZN7WebCore29JSHTMLUListElementConstructorD1Ev
+__ZN7WebCore14WindowFeaturesC1ERKNS_6StringE
 __ZN7WebCore14WindowFeaturesC2ERKNS_6StringE
+__ZN7WebCore9DOMWindow16adjustWindowRectERKNS_9FloatRectERS1_S3_
+__ZN7WebCoreL12createWindowEPN3JSC9ExecStateEPNS_5FrameES4_RKNS_6StringES7_RKNS_14WindowFeaturesENS0_7JSValueE
+__ZN7WebCore11FrameLoader12createWindowEPS0_RKNS_16FrameLoadRequestERKNS_14WindowFeaturesERb
+__ZNK7WebCore6Chrome5focusEv
+__ZN7WebCore15JSDOMWindowBase16childFrameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore15JSDOMWindowBase15namedItemGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore8Document16windowNamedItemsERKNS_6StringE
+__ZN7WebCore18JSCommentPrototypeD1Ev
+__ZN7WebCore15JSAttrPrototypeD1Ev
+__ZN7WebCore23JSNamedNodeMapPrototypeD1Ev
+__ZN7WebCore29JSHTMLImageElementConstructorD1Ev
+__ZN7WebCore18setJSDocumentTitleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTitleElement7setTextERKNS_6StringE
+__ZN7WebCore34jsDOMWindowPrototypeFunctionScrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12EventHandler29passMousePressEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
+__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetEPNS_12RenderWidgetE
+__ZNK7WebCore12MessageEvent14isMessageEventEv
+__ZN7WebCore15getDOMStructureINS_14JSMessageEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore14JSMessageEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSMessageEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12MessageEventEEE
+__ZN7WebCore14JSMessageEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12MessageEventEEE
+__ZN7WebCore14JSMessageEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL22getJSMessageEventTableEPN3JSC9ExecStateE
+__ZN7WebCore20jsMessageEventSourceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsMessageEventDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsElementScrollWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element11scrollWidthEv
+__ZNK7WebCore9RenderBox11scrollWidthEv
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_
+__ZN7WebCore19JSHTMLObjectElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore14JSMessageEventD1Ev
+__ZN7WebCore20setJSDOMWindowStatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow9setStatusERKNS_6StringE
+__ZN7WebCoreL27createHTMLMapElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLMapElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLMapElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLMapElementEEE
+__ZN7WebCore16JSHTMLMapElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLMapElementEEE
+__ZN7WebCore16JSHTMLMapElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16JSHTMLMapElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore16JSHTMLModElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20ImageDocumentElementD0Ev
+__ZN7WebCore16HTMLImageElementD2Ev
+__ZN7WebCore13ImageDocumentD0Ev
+__ZN7WebCore12HTMLDocumentD2Ev
+__ZN7WebCore16FixedTableLayoutD0Ev
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE6shrinkEm
+__ZThn28_N7WebCore8DOMTimer4stopEv
+__ZN7WebCore23JSMessageEventPrototypeD1Ev
+__ZN7WebCore38JSXMLHttpRequestProgressEventPrototypeD1Ev
+__ZN7WebCore19CSSCursorImageValueD0Ev
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocate
+__ZN7WebCore13CSSImageValueD2Ev
+__ZN7WebCore32JSHTMLOptionsCollectionPrototypeD1Ev
+__ZN7WebCore19JSOptionConstructorD1Ev
+__ZN7WebCore12NamedNodeMap15removeNamedItemERKNS_13QualifiedNameERi
+__ZN7WebCore27JSHTMLOListElementPrototypeD1Ev
+__ZN7WebCore16JSHTMLMapElementD1Ev
+__ZN7WebCore25JSHTMLMapElementPrototypeD1Ev
+__ZN7WebCore25JSHTMLModElementPrototypeD1Ev
+__ZN7WebCore14HTMLModElementD0Ev
+__ZThn4_N7WebCore15HTMLAreaElementD0Ev
+__ZThn28_N7WebCore8DOMTimer16contextDestroyedEv
+__ZNK7WebCore20RenderBoxModelObject30containingBlockWidthForContentEv
+__ZN7WebCore28setJSHTMLInputElementCheckedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23JSHTMLOptionsCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLOptionsCollectionLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23JSHTMLOptionsCollection6lengthEPN3JSC9ExecStateE
+__ZN7WebCore24jsHTMLOptionElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30setJSHTMLSelectElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement11setDisabledEb
+__ZN7WebCore11RenderBlock26addPercentHeightDescendantEPNS_9RenderBoxE
+__ZNK3WTF7HashMapIPKN7WebCore11RenderBlockEPNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_I
+__ZN3WTF9HashTableIPKN7WebCore11RenderBlockESt4pairIS4_PNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEEENS
+__ZN3WTF7HashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZNK3WTF7HashMapIPKN7WebCore9RenderBoxEPNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_I
+__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_PNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEEENS
+__ZN3WTF7HashSetIPN7WebCore11RenderBlockENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateT
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocat
+__ZN7WebCore25jsHTMLInputElementCheckedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLSelectElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement5valueEv
+__ZN7WebCore19JSHTMLSelectElement18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLSelectElement11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement4itemEj
+__ZN7WebCore27setJSHTMLOptionElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSHTMLOptionElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLOptionElement7setTextERKNS_6StringERi
+__ZN3WTF7HashMapIPKN7WebCore11RenderBlockEPNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_IS
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_IS
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZThn4_N7WebCore16HTMLTableElementD0Ev
+__ZN7WebCore30jsElementPrototypeFunctionBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element4blurEv
+__ZNK7WebCore15HTMLBodyElement11scrollWidthEv
+__ZN7WebCore23JSMessageEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL31getJSMessageEventPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore13HitTestResult12setScrollbarEPNS_9ScrollbarE
+__ZN7WebCore9Scrollbar14transformEventERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar10mouseMovedERKNS_18PlatformMouseEventE
+__ZN7WebCore23ScrollbarThemeComposite7hitTestEPNS_9ScrollbarERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar14setHoveredPartENS_13ScrollbarPartE
+__ZN7WebCore14ScrollbarTheme26invalidateOnMouseEnterExitEv
+__ZN7WebCore9Scrollbar11mouseExitedEv
+__ZN7WebCoreL28createHTMLFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLFontElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFontElementEEE
+__ZN7WebCore17JSHTMLFontElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFontElementEEE
+__ZN7WebCore17JSHTMLFontElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSHTMLFontElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17JSHTMLFontElementD1Ev
+__ZN7WebCore26JSHTMLFontElementPrototypeD1Ev
+__ZThn4_N7WebCore19HTMLTableRowElementD0Ev
+__ZThn4_N7WebCore15HTMLFontElementD0Ev
+__ZN7WebCore44jsDocumentPrototypeFunctionGetElementsByNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node17getElementsByNameERKNS_6StringE
+__ZN7WebCore12NameNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZN7WebCore12NameNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZNK7WebCore12NameNodeList11nodeMatchesEPNS_7ElementE
+__ZN7WebCore12NameNodeListD0Ev
+__ZN7WebCore27JSDocumentFragmentPrototypeD1Ev
+__ZThn4_N7WebCore15HTMLHeadElementD0Ev
+__ZN7WebCore19JSMimeTypePrototypeD1Ev
+__ZN7WebCore19setJSNodeOndblclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node13setOndblclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnfocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnfocusEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSNodeOncontextmenuEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node16setOncontextmenuEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17setJSNodeOnchangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnchangeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnresetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnresetEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17setJSNodeOnselectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnselectEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZThn268_N7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
+__ZN7WebCore12EventHandler13freeClipboardEv
+__ZNK7WebCore12EventHandler23createDraggingClipboardEv
+__ZN7WebCore12EventHandler20dispatchDragSrcEventERKNS_12AtomicStringERKNS_18PlatformMouseEventE
+__ZNK7WebCore9Clipboard15sourceOperationERNS_13DragOperationE
+__ZN7WebCore14DragController9startDragEPNS_5FrameEPNS_9ClipboardENS_13DragOperationERKNS_18PlatformMouseEventERKNS_8IntPointEb
+__ZN7WebCoreL8getImageEPNS_7ElementE
+__ZN7WebCore12ClipboardMac7hasDataEv
+__ZNK7WebCore16HTMLImageElement3altEv
+__ZN7WebCore16VisibleSelectionC1EPKNS_5RangeENS_9EAffinityE
+__ZN7WebCore16VisibleSelectionC2EPKNS_5RangeENS_9EAffinityE
+__ZN7WebCore14RenderReplaced17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZNK7WebCore12RenderObject17selectionStartEndERiS1_
+__ZNK7WebCore10RenderView17selectionStartEndERiS1_
+__ZN7WebCore13RootInlineBox22setHasSelectedChildrenEb
+__ZN7WebCore11RenderBlock17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZNK7WebCore12RenderObject7childAtEj
+__ZNK7WebCore14RenderReplaced18canBeSelectionLeafEv
+__ZN7WebCore14RenderReplaced23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_19RenderSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3
+__ZNK3WTF7HashMapIPN7WebCore11RenderBlockEPNS1_24RenderBlockSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3get
+__ZN7WebCore11RenderBlock27selectionGapRectsForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore11RenderBlock15isSelectionRootEv
+__ZN3WTF7HashMapIPN7WebCore11RenderBlockEPNS1_24RenderBlockSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setE
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockESt4pairIS3_PNS1_24RenderBlockSelectionInfoEENS_18PairFirstExtractorIS7_EENS_7PtrHash
+__ZN7WebCore11RenderBlock19leftSelectionOffsetEPS0_i
+__ZN7WebCore11RenderBlock20rightSelectionOffsetEPS0_i
+__ZN7WebCore11RenderBlock17fillSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
+__ZN7WebCore11RenderBlock22fillBlockSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
+__ZNK7WebCore12RenderObject18canBeSelectionLeafEv
+__ZN7WebCore11RenderBlock23fillInlineSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
+__ZN7WebCore13RootInlineBox20fillLineSelectionGapEiiPNS_11RenderBlockEiiiiPKNS_12RenderObject9PaintInfoE
+__ZN7WebCore13RootInlineBox14selectionStateEv
+__ZN7WebCore9InlineBox14selectionStateEv
+__ZN7WebCore11RenderBlock29getHorizontalSelectionGapInfoENS_12RenderObject14SelectionStateERbS3_
+__ZN7WebCore13RootInlineBox16firstSelectedBoxEv
+__ZN7WebCore13RootInlineBox15lastSelectedBoxEv
+__ZNK7WebCore10RenderView14selectionStartEv
+__ZN7WebCore12ClipboardMac24declareAndWriteDragImageEPNS_7ElementERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZNK7WebCore11BitmapImage17filenameExtensionEv
+__ZNK7WebCore11ImageSource17filenameExtensionEv
+__ZN7WebCore36preferredExtensionForImageSourceTypeERKNS_6StringE
+__ZN7WebCore16LegacyWebArchive32createPropertyListRepresentationERKNS_16ResourceResponseE
+__ZN7WebCore14DragController11doImageDragEPNS_7ElementERKNS_8IntPointERKNS_7IntRectEPNS_9ClipboardEPNS_5FrameERS3_
+__ZN7WebCore24createDragImageFromImageEPNS_5ImageE
+__ZNK7WebCore7IntSizecv7_NSSizeEv
+__ZN7WebCore14DragController16maxDragImageSizeEv
+__ZN7WebCore21fitDragImageToMaxSizeEN3WTF9RetainPtrI7NSImageEERKNS_7IntSizeES6_
+__ZN7WebCore13dragImageSizeEN3WTF9RetainPtrI7NSImageEE
+__ZN7WebCore27dissolveDragImageToFractionEN3WTF9RetainPtrI7NSImageEEf
+__ZN7WebCore14DragController12doSystemDragEN3WTF9RetainPtrI7NSImageEERKNS_8IntPointES7_PNS_9ClipboardEPNS_5FrameEb
+__ZN7WebCoreL24clipOutPositionedObjectsEPKNS_12RenderObject9PaintInfoEiiPN3WTF11ListHashSetIPNS_9RenderBoxENS4_7PtrHashIS7_EEEE
+__ZN7WebCore15GraphicsContext7clipOutERKNS_7IntRectE
+__ZNK7WebCore12RenderObject24selectionBackgroundColorEv
+__ZNK7WebCore11RenderTheme30activeSelectionBackgroundColorEv
+__ZNK7WebCore14RenderThemeMac38platformActiveSelectionBackgroundColorEv
+__ZNK7WebCore5Color14blendWithWhiteEv
+__ZN7WebCoreL14blendComponentEii
+__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
+__ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
+__ZN7WebCore12EventHandler17cancelDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
+__ZN7WebCore12EventHandler14clearDragStateEv
+__ZN7WebCore14DragController10cancelDragEv
+__ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
+__ZN7WebCore9Clipboard23setDestinationOperationENS_13DragOperationE
+__ZN7WebCore14DragController22cleanupAfterSystemDragEv
+__ZN7WebCore15deleteDragImageEN3WTF9RetainPtrI7NSImageEE
+__ZN7WebCore15highestAncestorEPNS_4NodeE
+__ZN7WebCoreL27removingNodeRemovesPositionEPNS_4NodeERKNS_8PositionE
+__ZNK7WebCore4Node8containsEPKS0_
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_19RenderSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS
+__ZN7WebCore15jsNodeTEXT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn28_NK7WebCore8DOMTimer10canSuspendEv
+__ZThn28_N7WebCore8DOMTimer7suspendEv
+__ZN7WebCore30JSHTMLTextAreaElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSHTMLTextAreaElement9classInfoEv
+__ZNK7WebCore19HTMLTextAreaElement14isEnumeratableEv
+__ZN7WebCore16JSStyleSheetList18canGetItemsForNameEPN3JSC9ExecStateEPNS_14StyleSheetListERKNS1_10IdentifierE
+__ZNK7WebCore14StyleSheetList12getNamedItemERKNS_6StringE
+__ZN7WebCore25JSStyleSheetListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSCSSRuleListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL11quoteStringERKNS_6StringE
+__ZN7WebCore21jsHTMLImageElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL21serviceTypeForClassIdERKNS_6StringEPKNS_10PluginDataE
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_15CaseFoldingHashENS_10HashTraitsIS2_EES5_E3addERKS2_S8_
+__ZNK3WTF7HashMapIN7WebCore6StringES2_NS1_15CaseFoldingHashENS_10HashTraitsIS2_EES5_E3getERKS2_
+__ZN7WebCoreL11activeXTypeEv
+__ZNK7WebCore10PluginData16supportsMimeTypeERKNS_6StringE
+__NPN_GetProperty
+__ZThn8_N7WebCore16HTMLTableElementD0Ev
+__ZN7WebCore17HTMLPlugInElement11getNPObjectEv
+__ZN7WebCore16ScriptController34createScriptObjectForPluginElementEPNS_17HTMLPlugInElementE
+__ZN7WebCore16ScriptController24jsObjectForPluginElementEPNS_17HTMLPlugInElementE
+__NPN_GetStringIdentifiers
+__ZThn8_N7WebCore20HTMLParagraphElementD0Ev
+__ZThn8_N7WebCore16HTMLDListElementD0Ev
+__ZThn8_N7WebCore7CommentD0Ev
+__ZThn8_N7WebCore16HTMLOListElementD0Ev
+__ZN7WebCore4Path15createRectangleERKNS_9FloatRectE
+__ZN7WebCore5TimerINS_11RenderImageEE5firedEv
+__ZN7WebCore11RenderImage28highQualityRepaintTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore28jsCSSStyleDeclarationCssTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn28_N7WebCore8DOMTimer6resumeEv
+__ZN7WebCore8DOMTimer6resumeEv
+__ZN7WebCore19HTMLTextAreaElementD0Ev
 __ZN7WebCoreL11isSeparatorEt
 __ZN7WebCore14WindowFeatures16setWindowFeatureERKNS_6StringES3_
-__ZN7WebCore19screenAvailableRectEPNS_6WidgetE
-__ZN7WebCore9DOMWindow16adjustWindowRectERKNS_9FloatRectERS1_S3_
-__ZN7WebCoreL12createWindowEPN3JSC9ExecStateEPNS_5FrameERKNS_6StringES7_RKNS_14WindowFeaturesENS0_10JSValuePtrE
-__ZN7WebCore11FrameLoader12createWindowEPS0_RKNS_16FrameLoadRequestERKNS_14WindowFeaturesERb
 __ZNK7WebCore6Chrome12createWindowEPNS_5FrameERKNS_16FrameLoadRequestERKNS_14WindowFeaturesE
 __ZNK7WebCore19ResourceRequestBase7isEmptyEv
 __ZN7WebCore4Page14sessionStorageEb
@@ -7611,1497 +10685,190 @@
 __ZNK7WebCore6Chrome13setWindowRectERKNS_9FloatRectE
 __ZN7WebCore13toDeviceSpaceERKNS_9FloatRectEP8NSWindow
 __ZNK7WebCore6Chrome4showEv
-__ZN3WTF7HashSetIPN7WebCore5FrameENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore11FrameLoader14setOpenedByDOMEv
-__ZN7WebCore11FrameLoader14changeLocationERKNS_4KURLERKNS_6StringEbbb
-__ZN7WebCore18setJSDocumentTitleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLTitleElement7setTextERKNS_6StringE
-__ZN7WebCore8DOMTimer5firedEv
-__ZN7WebCore8Document13removeTimeoutEi
-__ZN3WTF9HashTableIiSt4pairIiPN7WebCore8DOMTimerEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSB_IS4_EEEESC_E4findIiNS_22IdentityHashTranslatorIiS5_S9_EEEENS_17HashTableIteratorIiS5_S7_S9_SE_SC_EERKT_
-__ZN7WebCore22ScriptExecutionContext24destroyedActiveDOMObjectEPNS_15ActiveDOMObjectE
-__ZN3WTF9HashTableIPN7WebCore15ActiveDOMObjectESt4pairIS3_PvENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS5_EEEESD_E4findIS3_NS_22IdentityHashTranslatorIS3_S6_SA_EEEENS_17HashTableIteratorIS3_S6_S8_SA_SF_SD_EERKT_
-__ZN7WebCore15ScheduledAction7executeEPNS_22ScriptExecutionContextE
-__ZN7WebCore15ScheduledAction7executeEPNS_8DocumentE
-__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore8Document10setIconURLERKNS_6StringES3_
-__ZN7WebCore9CSSParser22createFloatingFunctionEv
-__ZN3WTF7HashSetIPN7WebCore17CSSParserFunctionENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCoreL17equalIgnoringCaseERKNS_15CSSParserStringEPKc
-__ZN7WebCore50jsEventTargetNodePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore17JSEventTargetNode16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZNK7WebCore15EventTargetNode22scriptExecutionContextEv
-__ZN7WebCore19toJSDOMGlobalObjectEPNS_22ScriptExecutionContextE
-__ZN7WebCore11RenderStyle20getCachedPseudoStyleENS0_8PseudoIdE
-__ZN7WebCore11RenderStyle20addCachedPseudoStyleEN3WTF10PassRefPtrIS0_EE
-__ZNK7WebCore17RenderTextControl15canHaveChildrenEv
-__ZNK7WebCore12RenderButton15canHaveChildrenEv
-__ZN7WebCore18jsLocationProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Location8protocolEv
-__ZN7WebCore15ScheduledAction24executeFunctionInContextEPN3JSC14JSGlobalObjectENS1_10JSValuePtrE
-__ZN7WebCore18jsDOMWindowHistoryEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7historyEv
-__ZN7WebCore7HistoryC1EPNS_5FrameE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7HistoryE
-__ZN7WebCore9JSHistory15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore9JSHistoryC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7HistoryEEE
-__ZN7WebCore9JSHistory18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore9JSHistory24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore7History5frameEv
-__ZN7WebCore15jsHistoryLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7History6lengthEv
-__ZN7WebCore11FrameLoader16getHistoryLengthEv
-__ZN7WebCore18jsScreenColorDepthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Screen10colorDepthEv
-__ZN7WebCore22jsDocumentCharacterSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14jsStringOrNullEPN3JSC9ExecStateERKNS_6StringE
-__ZN7WebCore15jsDocumentTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL34createHTMLBlockquoteElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore23JSHTMLBlockquoteElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore23JSHTMLBlockquoteElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLBlockquoteElementEEE
-__ZN7WebCore23JSHTMLBlockquoteElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21jsDocumentDefaultViewEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30JSCSSStyleDeclarationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore54jsCSSStyleDeclarationPrototypeFunctionGetPropertyValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21JSCSSStyleDeclaration9classInfoEv
-__ZNK7WebCore16JSEventPrototype9classInfoEv
-__ZN7WebCore16jsEventTimeStampEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14jsEventBubblesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsEventCancelBubbleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17jsEventSrcElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17jsEventCancelableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17jsEventEventPhaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsEventClipboardDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7JSEvent13clipboardDataEPN3JSC9ExecStateE
-__ZNK7WebCore5Event16isClipboardEventEv
-__ZN7WebCore18jsEventReturnValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13jsEventTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore11jsEventTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsEventCurrentTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23JSHTMLBlockquoteElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore18JSHTMLLabelElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore23JSHTMLBlockquoteElementD0Ev
-__ZN7WebCore7History15disconnectFrameEv
-__ZN7WebCore9JSHistoryD0Ev
-__ZN7WebCore9CSSParser15parseMediaQueryEPNS_9MediaListERKNS_6StringE
-__ZN7WebCore19CachedCSSStyleSheet11setEncodingERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore14CSSParserValueELm16EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore14CSSParserValueELm16EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore14CSSParserValueELm16EE15reserveCapacityEm
-__ZN7WebCore17jsNavigatorVendorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13NavigatorBase6vendorEv
-__ZN7WebCoreL29createHTMLStyleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLStyleElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLStyleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLStyleElementEEE
-__ZN7WebCore18JSHTMLStyleElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore25setJSHTMLStyleElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLStyleElement7setTypeERKNS_12AtomicStringE
-__ZN7WebCore18JSHTMLStyleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLStyleElement9classInfoEv
-__ZN7WebCore12StyleElement20insertedIntoDocumentEPNS_8DocumentEPNS_7ElementE
-__ZNK7WebCore10RenderText12originalTextEv
-__ZNK7WebCore10StyleSheet11completeURLERKNS_6StringE
-__ZN7WebCore17jsNodeTextContentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20setJSNodeTextContentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore4Node14setTextContentERKNS_6StringERi
-__ZNK7WebCore15HTMLFormElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore26CSSMutableStyleDeclaration14getCommonValueEPKii
-__ZNK7WebCore26CSSMutableStyleDeclaration18isPropertyImplicitEi
-__ZN3WTF9HashTableIiSt4pairIiPN7WebCore17GlyphPageTreeNodeEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSB_IS4_EEEESC_E4findIiNS_22IdentityHashTranslatorIiS5_S9_EEEENS_17HashTableIteratorIiS5_S7_S9_SE_SC_EERKT_
-__ZNK7WebCore16StyleCachedImage13errorOccurredEv
-__ZN3WTF9HashTableIiSt4pairIiPN7WebCore13GlyphWidthMap14GlyphWidthPageEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSC_IS5_EEEESD_E4findIiNS_22IdentityHashTranslatorIiS6_SA_EEEENS_17HashTableIteratorIiS6_S8_SA_SF_SD_EERKT_
-__ZNK7WebCore4Font24floatWidthForComplexTextERKNS_7TextRunE
-__ZN7WebCore20ATSULayoutParameters10initializeEPKNS_4FontEPKNS_15GraphicsContextE
-__ZN7WebCoreL19initializeATSUStyleEPKNS_14SimpleFontDataE
-__ZNK7WebCore16FontPlatformData15allowsLigaturesEv
-__ZNK7WebCore4Font21fontDataForCharactersEPKti
-__ZNK7WebCore16FontFallbackList21fontDataForCharactersEPKNS_4FontEPKti
-__ZNK7WebCore14SimpleFontData18containsCharactersEPKti
-__ZNK7WebCore14SimpleFontData17checkShapesArabicEv
-__ZN7WebCoreL23overrideLayoutOperationEmP14ATSGlyphVectormPvPm
-__ZNK7WebCore16FontPlatformData19roundsGlyphAdvancesEv
-__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE11reverseRunsEjj
-__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE5embedEN3WTF7Unicode9DirectionE
-__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE27raiseExplicitEmbeddingLevelEN3WTF7Unicode9DirectionES6_
-__ZN3WTF6VectorINS_7Unicode9DirectionELm8EE6shrinkEm
-__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE27lowerExplicitEmbeddingLevelEN3WTF7Unicode9DirectionE
-__ZNK7WebCore11BidiContext5derefEv
-__ZNK7WebCore4Font15drawComplexTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZN7WebCoreL40copyRunForDirectionalOverrideIfNecessaryERKNS_7TextRunERN3WTF11OwnArrayPtrItEE
-__ZN7WebCore16RenderListMarker12imageChangedEPvPKNS_7IntRectE
-__ZN7WebCore14jsLocationHostEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Location4hostEv
-__ZN7WebCore13WidthIterator21normalizeVoicingMarksEi
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE15reserveCapacityEm
-__ZSt16__introsort_loopIPPN7WebCore13InlineTextBoxEiPFbPKS1_S5_EEvT_S8_T0_T1_
-__ZSt22__final_insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
-__ZSt16__insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE6shrinkEm
-__ZNSt4pairIN7WebCore6StringES1_ED2Ev
-__ZN7WebCore11RenderBlock23removePositionedObjectsEPS0_
-__ZN7WebCore14PreloadScanner11emitCSSRuleEv
-__ZN3WTF6VectorItLm16EE6shrinkEm
-__ZN7WebCore19CachedCSSStyleSheet5errorEv
-__ZN7WebCore17jsDOMWindowOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow6onloadEv
-__ZN7WebCoreL20encodeRelativeStringERKNS_6StringERKNS_12TextEncodingERN3WTF6VectorIcLm512EEE
-__ZN3WTF6VectorItLm512EE14shrinkCapacityEm
-__ZN7WebCoreL11findFirstOfEPKtiiPKc
-__ZN7WebCoreL21appendEncodedHostnameERN3WTF6VectorItLm512EEEPKtj
-__ZN3WTF6VectorIcLm512EE14expandCapacityEmPKc
-__ZNK7WebCore16CSSStyleSelector14largerFontSizeEfb
-__ZNK7WebCore9InlineBox16prevOnLineExistsEv
-__ZNK7WebCore11RenderBlock16leftmostPositionEbb
-__ZNK7WebCore9RenderBox16leftmostPositionEbb
-__ZN7WebCoreL15compareBoxStartEPKNS_13InlineTextBoxES2_
-__ZSt25__unguarded_linear_insertIPPN7WebCore13InlineTextBoxES2_PFbPKS1_S5_EEvT_T0_T1_
-__ZN7WebCore21jsHTMLLinkElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLLinkElement4hrefEv
-__ZNK7WebCore17JSHTMLMetaElement9classInfoEv
-__ZN7WebCore18jsDOMWindowOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7onerrorEv
-__ZN7WebCore15JSMimeTypeArray18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21jsMimeTypeArrayLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13MimeTypeArray6lengthEv
-__ZNK7WebCore13MimeTypeArray13getPluginDataEv
-__ZN7WebCore19jsScreenAvailHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Screen11availHeightEv
-__ZN7WebCore18jsScreenAvailWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Screen10availWidthEv
-__ZN7WebCore17jsDocumentAnchorsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore8Document7anchorsEv
-__ZN7WebCore23jsHTMLAnchorElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsElementOffsetParentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element12offsetParentEv
-__ZN3WTF6VectorISt4pairIPtjELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorISt4pairIPtjELm0EE14expandCapacityEm
-__ZN3WTF6VectorISt4pairIPtjELm0EE15reserveCapacityEm
-__ZN3WTF6VectorISt4pairIPtjELm0EE6shrinkEm
-__ZNK7WebCore26CachedScriptSourceProvider8getRangeEii
-__ZN7WebCore22jsHTMLScriptElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLScriptElement3srcEv
-__ZN7WebCoreL16embedConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLEmbedElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16HTMLEmbedElement16attributeChangedEPNS_9AttributeEb
-__ZNK7WebCore16HTMLEmbedElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLEmbedElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16MIMETypeRegistry24isSupportedImageMIMETypeERKNS_6StringE
-__ZNK7WebCore16HTMLEmbedElement17endTagRequirementEv
-__ZNK7WebCore16HTMLEmbedElement11tagPriorityEv
-__ZN7WebCore16HTMLEmbedElement20insertedIntoDocumentEv
-__ZN7WebCore16HTMLEmbedElement6attachEv
-__ZN7WebCore16HTMLEmbedElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore16HTMLEmbedElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16HTMLEmbedElement12updateWidgetEv
-__ZN7WebCoreL12isURLAllowedEPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore17HTMLPlugInElement17endTagRequirementEv
-__ZNK7WebCore17HTMLObjectElement11tagPriorityEv
-__ZN7WebCore17HTMLObjectElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore17HTMLObjectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCoreL16paramConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLParamElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16HTMLParamElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLParamElement17endTagRequirementEv
-__ZNK7WebCore16HTMLParamElement11tagPriorityEv
-__ZN7WebCore17HTMLPlugInElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17HTMLObjectElement15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCore17HTMLObjectElement18updateDocNamedItemEv
-__ZN7WebCore17HTMLObjectElement11recalcStyleENS_4Node11StyleChangeE
-__ZN7WebCore10RenderView12removeWidgetEPNS_12RenderObjectE
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore17HTMLObjectElement21finishParsingChildrenEv
-__ZN7WebCoreL11activeXTypeEv
-__ZSt13binary_searchIPKttEbT_S2_RKT0_
-__ZSt11lower_boundIPKttET_S2_S2_RKT0_
-__ZNK7WebCore17RenderFlexibleBox12avoidsFloatsEv
-__ZN7WebCore9FrameView17addWidgetToUpdateEPNS_16RenderPartObjectE
-__ZN3WTF7HashSetIPN7WebCore16RenderPartObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZNK7WebCore9RenderBox19isBottomMarginQuirkEv
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE6resizeEm
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE15reserveCapacityEm
-__ZNK7WebCore17HTMLPlugInElement4nameEv
-__ZN7WebCore11FrameLoader13requestObjectEPNS_10RenderPartERKNS_6StringERKNS_12AtomicStringES5_RKN3WTF6VectorIS3_Lm0EEESD_
-__ZN7WebCore11FrameLoader15shouldUsePluginERKNS_4KURLERKNS_6StringEbRb
-__ZN7WebCore11FrameLoader10loadPluginEPNS_10RenderPartERKNS_4KURLERKNS_6StringERKN3WTF6VectorIS6_Lm0EEESD_b
--[DOMElement(WebPrivate) _windowClipRect]
-__ZNK7WebCore9FrameView22windowClipRectForLayerEPKNS_11RenderLayerEb
-__ZNK7WebCore11RenderLayer16childrenClipRectEv
-__ZNK7WebCore10ScrollView16contentsToWindowERKNS_7IntRectE
-__ZNK7WebCore6Widget25convertToContainingWindowERKNS_7IntRectE
-__ZN7WebCore7IntRectC1ERKNS_9FloatRectE
-__ZNK7WebCore9FrameView14windowClipRectEb
-__ZN7WebCore25PluginMainThreadScheduler9schedulerEv
-__ZN7WebCore25PluginMainThreadSchedulerC1Ev
-__ZN7WebCore25PluginMainThreadScheduler14registerPluginEP4_NPP
-__ZN3WTF7HashMapIP4_NPPNS_5DequeIN7WebCore25PluginMainThreadScheduler4CallEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENSA_IS7_EEE3setERKS2_RKS7_
-__ZN3WTF9HashTableIP4_NPPSt4pairIS2_NS_5DequeIN7WebCore25PluginMainThreadScheduler4CallEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSF_IS8_EEEESG_EC1ERKSJ_
-__ZN7WebCore16ScriptController20windowScriptNPObjectEv
-__Z23_NPN_CreateScriptObjectP4_NPPPN3JSC8JSObjectEN3WTF10PassRefPtrINS1_8Bindings10RootObjectEEE
-_NPN_CreateObject
-__ZL10jsAllocateP4_NPPP7NPClass
-_NPN_RetainObject
-_NPN_Evaluate
-__ZNK3JSC8Bindings10RootObject12globalObjectEv
-__ZN3JSC8Bindings22convertNPStringToUTF16EPK9_NPString
-__ZN3JSC8BindingsL36convertUTF8ToUTF16WithLatin1FallbackEPKci
-__ZN7WebCore6String8fromUTF8EPKcm
-__ZN3JSC8Bindings23convertValueToNPVariantEPNS_9ExecStateENS_10JSValuePtrEP10_NPVariant
-_NPN_GetStringIdentifier
-__ZN3JSC8Bindings26identifierFromNPIdentifierEPKc
-__ZL22getStringIdentifierMapv
-__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings17PrivateIdentifierENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3getEPS4_
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS2_8Bindings17PrivateIdentifierEENS_18PairFirstExtractorISA_EENS_7StrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSG_IS9_EEEESH_E6expandEv
-_NPN_Invoke
-__ZL22getListFromVariantArgsPN3JSC9ExecStateEPK10_NPVariantjPNS_8Bindings10RootObjectERNS_7ArgListE
-__ZN3JSC8Bindings14findRootObjectEPNS_14JSGlobalObjectE
-_NPN_ReleaseVariantValue
-__Z35NPN_InitializeVariantWithStringCopyP10_NPVariantPK9_NPString
-_NPN_ReleaseObject
-_NPN_DeallocateObject
-__ZL12jsDeallocateP8NPObject
-__ZN3JSC8Bindings10RootObject11gcUnprotectEPNS_8JSObjectE
-__ZN3WTF7HashMapIPN3JSC8JSObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
-__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E4findIS3_NS_22IdentityHashTranslatorIS3_S5_S9_EEEENS_17HashTableIteratorIS3_S5_S7_S9_SE_SC_EERKT_
-__ZN7WebCore26NetscapePlugInStreamLoader6createEPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
-__ZN7WebCore26NetscapePlugInStreamLoaderC2EPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
-__ZN7WebCore14ResourceLoader19setShouldBufferDataEb
-__ZN7WebCore14DocumentLoader21addPlugInStreamLoaderEPNS_14ResourceLoaderE
-__ZNK3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEEbRKT_
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE6shrinkEm
-__ZN7WebCore13HTMLTokenizer26parseProcessingInstructionERNS_15SegmentedStringENS0_5StateE
-__ZN7WebCore26NetscapePlugInStreamLoader18didReceiveResponseERKNS_16ResourceResponseE
-__ZN7WebCore26NetscapePlugInStreamLoader14didReceiveDataEPKcixb
-__ZN7WebCore26NetscapePlugInStreamLoader16didFinishLoadingEv
-__ZN7WebCore14DocumentLoader24removePlugInStreamLoaderEPNS_14ResourceLoaderE
-__ZN7WebCore26NetscapePlugInStreamLoader16releaseResourcesEv
-__ZN7WebCore26NetscapePlugInStreamLoaderD1Ev
-__ZN7WebCore24jsNavigatorCookieEnabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9Navigator13cookieEnabledEv
-__ZN7WebCore14cookiesEnabledEPKNS_8DocumentE
-__ZN7WebCoreL29createHTMLEmbedElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLEmbedElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLEmbedElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLEmbedElementEEE
-__ZN7WebCore18JSHTMLEmbedElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLEmbedElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_16HTMLEmbedElementERKNS1_10IdentifierE
-__ZN7WebCore18JSHTMLEmbedElement24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16HTMLEmbedElement25renderWidgetForJSBindingsEv
-__ZN7WebCore16ScriptController29createScriptInstanceForWidgetEPNS_6WidgetE
-__ZN7WebCore16ScriptController16createRootObjectEPv
-__ZN3WTF9HashTableIPvSt4pairIS1_NS_6RefPtrIN3JSC8Bindings10RootObjectEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS1_EENS_14PairHashTraitsINS_10HashTraitsIS1_EENSE_IS7_EEEESF_E4findIS1_NS_22IdentityHashTranslatorIS1_S8_SC_EEEENS_17HashTableIteratorIS1_S8_SA_SC_SH_SF_EERKT_
-__ZN3WTF7HashMapIPvNS_6RefPtrIN3JSC8Bindings10RootObjectEEENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS9_IS6_EEE3setERKS1_RKS6_
-__ZN3WTF9HashTableIPvSt4pairIS1_NS_6RefPtrIN3JSC8Bindings10RootObjectEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS1_EENS_14PairHashTraitsINS_10HashTraitsIS1_EENSE_IS7_EEEESF_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS8_
-__ZN3JSC8Bindings9CInstanceC1EP8NPObjectN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3JSC8Bindings8InstanceC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZNK3JSC8Bindings8Instance10rootObjectEv
-__ZN3JSC8Bindings8Instance19createRuntimeObjectEPNS_9ExecStateE
-__ZN3JSC16RuntimeObjectImpC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_8Bindings8InstanceEEE
-__ZN3JSC8Bindings10RootObject16addRuntimeObjectEPNS_16RuntimeObjectImpE
-__ZN3WTF7HashSetIPN3JSC16RuntimeObjectImpENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3JSC16RuntimeObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC8Bindings8Instance5beginEv
-__ZN3JSC8Bindings8Instance12virtualBeginEv
-__ZNK3JSC8Bindings9CInstance8getClassEv
-__ZN3JSC8Bindings6CClass11classForIsAEP7NPClass
-__ZN3WTF7HashMapIP7NPClassPN3JSC8Bindings6CClassENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3setERKS2_RKS6_
-__ZN3JSC8Bindings6CClassC1EP7NPClass
-__ZN3WTF9HashTableIP7NPClassSt4pairIS2_PN3JSC8Bindings6CClassEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSE_IS7_EEEESF_E6expandEv
-__ZNK3JSC8Bindings6CClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZNK3JSC8Bindings6CClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings6MethodENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3setEPS4_RKS8_
-_NPN_UTF8FromIdentifier
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS2_8Bindings6MethodEENS_18PairFirstExtractorISA_EENS_7StrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSG_IS9_EEEESH_E6expandEv
-__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE15reserveCapacityEm
-__ZN3JSC8Bindings8Instance3endEv
-__ZN3JSC8Bindings8Instance10virtualEndEv
-__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE6shrinkEm
-__ZN7WebCore27runtimeObjectPropertyGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN3JSC16RuntimeObjectImp12methodGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3JSC13RuntimeMethodC1EPNS_9ExecStateERKNS_10IdentifierERN3WTF6VectorIPNS_8Bindings6MethodELm0EEE
-__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EEC1ERKS5_
-__ZN3JSC13RuntimeMethod11getCallDataERNS_8CallDataE
-__ZN3JSCL17callRuntimeMethodEPNS_9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK7WebCore18JSHTMLEmbedElement9classInfoEv
-__ZN7WebCore18JSHTMLEmbedElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore19runtimeObjectGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK3JSC16RuntimeObjectImp9classInfoEv
-__ZN3JSC8Bindings9CInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListE
-__ZN3JSC8Bindings23convertNPVariantToValueEPNS_9ExecStateEPK10_NPVariantPNS0_10RootObjectE
-__ZN3JSC8Bindings9CInstance30moveGlobalExceptionToExecStateEPNS_9ExecStateE
-__ZN3JSC8BindingsL21globalExceptionStringEv
-__ZN3WTF6VectorI10_NPVariantLm8EE6shrinkEm
-__ZN3JSC8Bindings5Class14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
-__ZN3JSC8Bindings8Instance18getOwnPropertySlotEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN7WebCoreL29createHTMLParamElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLParamElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLParamElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLParamElementEEE
-__ZN7WebCore18JSHTMLParamElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24jsHTMLImageElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement6heightEb
-__ZN7WebCore23jsHTMLImageElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement5widthEb
-__ZN7WebCoreL17canvasConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLCanvasElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL30createHTMLCanvasElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLCanvasElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSHTMLCanvasElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLCanvasElementEEE
-__ZN7WebCore19JSHTMLCanvasElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLCanvasElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore46jsHTMLCanvasElementPrototypeFunctionGetContextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore19JSHTMLCanvasElement9classInfoEv
-__ZN7WebCore17HTMLCanvasElement10getContextERKNS_6StringE
-__ZN7WebCore24CanvasRenderingContext2DC2EPNS_17HTMLCanvasElementE
-__ZN7WebCore24CanvasRenderingContext2D5StateC2Ev
-__ZN7WebCore11CanvasStyleC2ERKNS_6StringE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_24CanvasRenderingContext2DE
-__ZN7WebCore26JSCanvasRenderingContext2D15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore24CanvasRenderingContext2D3refEv
-__ZN7WebCore26JSCanvasRenderingContext2DC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24CanvasRenderingContext2DEEE
-__ZN7WebCore19JSHTMLCanvasElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore28setJSHTMLCanvasElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLCanvasElement9setHeightEi
-__ZN7WebCore17HTMLCanvasElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore17HTMLCanvasElement5resetEv
-__ZN7WebCore24CanvasRenderingContext2D5resetEv
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE6resizeEm
-__ZN7WebCore27setJSHTMLCanvasElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLCanvasElement8setWidthEi
-__ZN7WebCore35jsNodePrototypeFunctionReplaceChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore6JSNode12replaceChildEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore17HTMLCanvasElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16RenderHTMLCanvasC2EPNS_17HTMLCanvasElementE
-__ZN7WebCore26JSCanvasRenderingContext2D18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore35JSCanvasRenderingContext2DPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionSaveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore26JSCanvasRenderingContext2D9classInfoEv
-__ZN7WebCore24CanvasRenderingContext2D4saveEv
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE15reserveCapacityEm
-__ZNK7WebCore24CanvasRenderingContext2D14drawingContextEv
-__ZNK7WebCore17HTMLCanvasElement14drawingContextEv
-__ZNK7WebCore17HTMLCanvasElement6bufferEv
-__ZNK7WebCore17HTMLCanvasElement17createImageBufferEv
-__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_9FloatSizeE
-__ZN7WebCore6Chrome11scaleFactorEv
-__ZN7WebCore11ImageBufferC1ERKNS_7IntSizeEbRb
-__ZN7WebCore15ImageBufferDataC1ERKNS_7IntSizeE
-__ZN7WebCore15GraphicsContext5scaleERKNS_9FloatSizeE
-__ZN7WebCore15GraphicsContext9translateEff
-__ZNK7WebCore11ImageBuffer7contextEv
-__ZN7WebCore15GraphicsContext26setShadowsIgnoreTransformsEb
-__ZNK7WebCore14RenderReplaced21minimumReplacedHeightEv
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D9translateEff
-__ZN7WebCore20TransformationMatrix9translateEdd
-__ZN7WebCore4Path9transformERKNS_20TransformationMatrixE
-__ZNK7WebCore20TransformationMatrixcv17CGAffineTransformEv
-__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionScaleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D5scaleEff
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionDrawImageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26JSCanvasRenderingContext2D9drawImageEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZNK3JSC10JSValuePtr7toFloatEPNS_9ExecStateE
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEffffRi
-__ZN7WebCoreL4sizeEPNS_16HTMLImageElementE
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementERKNS_9FloatRectES5_Ri
-__ZN7WebCore24CanvasRenderingContext2D11checkOriginERKNS_4KURLE
-__ZN7WebCore24CanvasRenderingContext2D8willDrawERKNS_9FloatRectEj
-__ZNK7WebCore20TransformationMatrix7mapRectERKNS_9FloatRectE
-__ZN7WebCore9FloatRect5uniteERKS0_
-__ZN7WebCore17HTMLCanvasElement8willDrawERKNS_9FloatRectE
-__ZN7WebCore7mapRectERKNS_9FloatRectES2_S2_
-__ZN7WebCore9FloatRect9intersectERKS0_
-__ZN7WebCore50jsCanvasRenderingContext2DPrototypeFunctionRestoreEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D7restoreEv
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE6shrinkEm
-__ZNK7WebCore20TransformationMatrix7inverseEv
-__ZN7WebCore20TransformationMatrixC1ERK17CGAffineTransform
-__ZN7WebCore26JSCanvasRenderingContext2D3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore53setJSCanvasRenderingContext2DGlobalCompositeOperationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24CanvasRenderingContext2D27setGlobalCompositeOperationERKNS_6StringE
-__ZN7WebCore22parseCompositeOperatorERKNS_6StringERNS_17CompositeOperatorE
-__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradientEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D20createLinearGradientEffffRi
-__ZN7WebCore14CanvasGradientC2ERKNS_10FloatPointES3_
-__ZN7WebCore8GradientC1ERKNS_10FloatPointES3_
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14CanvasGradientE
-__ZN7WebCore16JSCanvasGradient15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSCanvasGradientC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CanvasGradientEEE
-__ZN7WebCore25JSCanvasGradientPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore45jsCanvasGradientPrototypeFunctionAddColorStopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore16JSCanvasGradient9classInfoEv
-__ZN7WebCore14CanvasGradient12addColorStopEfRKNS_6StringERi
-__ZN7WebCore9CSSParser10parseColorERjRKNS_6StringEb
-__ZN7WebCore9CSSParser10parseColorEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
-__ZN7WebCore8Gradient12addColorStopEfRKNS_5ColorE
-__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE15reserveCapacityEm
-__ZN7WebCore8Gradient15platformDestroyEv
-__ZN7WebCore38setJSCanvasRenderingContext2DFillStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore26JSCanvasRenderingContext2D12setFillStyleEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCoreL17toHTMLCanvasStyleEPN3JSC9ExecStateENS0_10JSValuePtrE
-__ZN7WebCore11CanvasStyleC2EN3WTF10PassRefPtrINS_14CanvasGradientEEE
-__ZN7WebCore24CanvasRenderingContext2D12setFillStyleEN3WTF10PassRefPtrINS_11CanvasStyleEEE
-__ZN7WebCore11CanvasStyle14applyFillColorEPNS_15GraphicsContextE
-__ZN7WebCore15GraphicsContext15setFillGradientEN3WTF10PassRefPtrINS_8GradientEEE
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionFillEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D4fillEv
-__ZNK7WebCore4Path7isEmptyEv
-__ZN7WebCore24CanvasRenderingContext2D46clearPathForDashboardBackwardCompatibilityModeEv
-__ZN7WebCore16RenderHTMLCanvas13paintReplacedERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore17HTMLCanvasElement5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZNK7WebCore11ImageBuffer5imageEv
-__ZN7WebCore11BitmapImageC1EP7CGImagePNS_13ImageObserverE
-__ZN7WebCore10jsAttrNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore11jsAttrValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsHTMLIFrameElementContentWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21HTMLFrameOwnerElement13contentWindowEv
-__ZN7WebCore35jsHTMLDocumentPrototypeFunctionOpenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14JSHTMLDocument4openEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore11FrameLoader15didExplicitOpenEv
-__ZN7WebCore36jsHTMLDocumentPrototypeFunctionCloseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCoreL17buttonConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLButtonElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17HTMLButtonElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCoreL19fieldsetConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLFieldSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZNK7WebCore19HTMLFieldSetElement11tagPriorityEv
+__ZNK7WebCore11ScriptValue9getStringERNS_6StringE
+__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8resizeToEff
+__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow6moveToEff
+__ZN7WebCore16JSHTMLPreElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore38jsElementPrototypeFunctionHasAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12CachedScript8encodingEv
+__ZN7WebCore44jsHTMLAnchorElementPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17HTMLAnchorElement8toStringEv
+__ZN7WebCore15JSHTMLHRElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+_KJS_JSCreateNativeJSObject
+__ZN3JSC8Bindings12JavaJSObject6invokeEPNS0_19JSObjectCallContextE
+__ZN3JSC8Bindings12JavaJSObject12createNativeEx
+__ZN3JSC8Bindings24findProtectingRootObjectEPNS_8JSObjectE
+__ZN3JSC8Bindings10RootObject13gcIsProtectedEPNS_8JSObjectE
+_KJS_JSObject_JSObjectCall
+__ZN3JSC8Bindings12JavaJSObjectC1Ex
+__ZN3JSC8Bindings12JavaJSObjectC2Ex
+__ZNK3JSC8Bindings12JavaJSObject4callEP8_jstringP13_jobjectArray
+__ZNK3JSC8Bindings12JavaJSObject10rootObjectEv
+__ZNK3JSC8Bindings12JavaJSObject17getListFromJArrayEPNS_9ExecStateEP13_jobjectArrayRNS_20MarkedArgumentBufferE
+__ZNK3JSC8Bindings12JavaJSObject21convertJObjectToValueEPNS_9ExecStateEP8_jobject
+__ZNK3JSC16RuntimeObjectImp12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8Bindings12JavaInstance12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8Bindings12JavaInstance11stringValueEPNS_9ExecStateE
+__ZNK3JSC8Bindings12JavaJSObject21convertValueToJObjectENS_7JSValueE
+__ZN7JNIEnv_9NewObjectEP7_jclassP10_jmethodIDz
+_KJS_JSObject_JSFinalize
+__ZNK3JSC8Bindings12JavaJSObject8finalizeEv
+__ZN7WebCore19JSHTMLAppletElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19JSHTMLAppletElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore12RenderAppletD0Ev
+__ZN3JSC8Bindings12JavaInstanceD0Ev
+__ZN3JSC8Bindings14JObjectWrapperD1Ev
+__ZN3JSC8Bindings14JObjectWrapperD2Ev
+__ZN3JSC8Bindings9JavaClassD0Ev
+__ZN3WTF20deleteAllPairSecondsIPN3JSC8Bindings5FieldEKNS_7HashMapINS_6RefPtrINS1_7UString3RepEEES4_NS_7StrHashIS9_EENS_10HashTr
+__ZN3JSC8Bindings9JavaFieldD0Ev
+__ZN3WTF15deleteAllValuesIPN3JSC8Bindings6MethodELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3JSC8Bindings10JavaMethodD0Ev
+__ZN3JSC8Bindings13JavaParameterD1Ev
+__ZN7WebCore17HTMLAppletElementD0Ev
+__ZN7WebCore28JSHTMLAppletElementPrototypeD1Ev
+__ZThn4_N7WebCore19HTMLTextAreaElementD0Ev
+__ZN7WebCore12EventHandler31passMouseReleaseEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
+__ZN7WebCore17setJSLocationHashEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setHashEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore12EventHandler22passWheelEventToWidgetERNS_18PlatformWheelEventEPNS_6WidgetE
+__ZN7WebCoreL42setNSScrollViewScrollWheelShouldRetainSelfEb
+__ZN7WebCoreL36selfRetainingNSScrollViewScrollWheelEP12NSScrollViewP13objc_selectorP7NSEvent
+__ZN7WebCore11RenderStyle10setContentEN3WTF10PassRefPtrINS_10StyleImageEEEb
+__ZN7WebCore27RenderImageGeneratedContentC1EPNS_4NodeE
+__ZN7WebCore27RenderImageGeneratedContentC2EPNS_4NodeE
+__ZN7WebCore27RenderImageGeneratedContent13setStyleImageEPNS_10StyleImageE
+__ZNK7WebCore16StyleCachedImage13isCachedImageEv
+__ZNK7WebCore27RenderImageGeneratedContent13errorOccurredEv
+__ZNK7WebCore27RenderImageGeneratedContent21imageHasRelativeWidthEv
+__ZNK7WebCore16StyleCachedImage21imageHasRelativeWidthEv
+__ZNK7WebCore27RenderImageGeneratedContent22usesImageContainerSizeEv
+__ZNK7WebCore16StyleCachedImage22usesImageContainerSizeEv
+__ZNK7WebCore27RenderImageGeneratedContent22imageHasRelativeHeightEv
+__ZNK7WebCore16StyleCachedImage22imageHasRelativeHeightEv
+__ZNK7WebCore27RenderImageGeneratedContent8imagePtrEv
+__ZNK7WebCore27RenderImageGeneratedContent9imageSizeEf
+__ZNK7WebCore27RenderImageGeneratedContent8hasImageEv
+__ZN7WebCore27RenderImageGeneratedContentD0Ev
+__ZN7WebCore11RenderImageD2Ev
+__ZN7WebCore27RenderImageGeneratedContent5imageEii
+__ZN7WebCore19JSHTMLButtonElementD1Ev
+__ZN7WebCore28JSHTMLButtonElementPrototypeD1Ev
+__ZN7WebCore17HTMLButtonElementD0Ev
 __ZN7WebCoreL17legendConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
 __ZN7WebCore17HTMLLegendElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore19HTMLFieldSetElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore19JSHTMLSelectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32jsHTMLSelectElementSelectedIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLSelectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore29setJSHTMLInputElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore22HTMLFormControlElement11setDisabledEb
-__ZN7WebCore19jsCharacterDataDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22setJSCharacterDataDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLButtonElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore12RenderButton24updateBeforeAfterContentENS_11RenderStyle8PseudoIdE
-__ZN7WebCore19HTMLFieldSetElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderFieldsetC1EPNS_4NodeE
-__ZN7WebCore14RenderFieldset14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore17HTMLLegendElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore12RenderLegendC1EPNS_4NodeE
-__ZNK7WebCore14RenderFieldset12avoidsFloatsEv
-__ZNK7WebCore14RenderFieldset28stretchesToMinIntrinsicWidthEv
-__ZN7WebCore14RenderFieldset14calcPrefWidthsEv
-__ZNK7WebCore14RenderFieldset10findLegendEv
+__ZN7WebCore17HTMLLegendElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
 __ZN7WebCore14RenderFieldset12layoutLegendEb
-__ZN7WebCore9CSSParser13parseSVGValueEib
-__ZN3JSC16RuntimeObjectImpD0Ev
-__ZN3JSC8Bindings10RootObject19removeRuntimeObjectEPNS_16RuntimeObjectImpE
-__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore18JSHTMLParamElementD0Ev
-__ZN3JSC13RuntimeMethodD0Ev
-__ZN7WebCore24CanvasRenderingContext2D5derefEv
-__ZN7WebCore19JSHTMLCanvasElementD0Ev
-__ZN7WebCoreL14modConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore14HTMLModElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore14HTMLModElement17endTagRequirementEv
-__ZNK7WebCore14HTMLModElement11tagPriorityEv
-__ZN7WebCore9CSSParser10parseShapeEib
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4RectEEE
-__ZN7WebCoreL15convertToLengthEPNS_17CSSPrimitiveValueEPNS_11RenderStyleEPb
-__ZN7WebCore17CSSPrimitiveValue25computeLengthIntForLengthEPNS_11RenderStyleE
-__ZN7WebCore11RenderStyle7setClipENS_6LengthES1_S1_S1_
-__ZN7WebCore29jsConsolePrototypeFunctionLogEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9JSConsole9classInfoEv
-__ZN7WebCore15ScriptCallStackC1EPN3JSC9ExecStateERKNS1_7ArgListEj
-__ZN7WebCore15ScriptCallFrameC1ERKN3JSC7UStringES4_iPNS1_9ExecStateERKNS1_7ArgListEj
-__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EEC1ERKS3_
-__ZN7WebCore15ScriptCallFrameD1Ev
-__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE6shrinkEm
-__ZN7WebCore7Console3logEPNS_15ScriptCallStackE
-__ZN7WebCore7Console10addMessageENS_12MessageLevelEPNS_15ScriptCallStackEb
-__ZN7WebCore15ScriptCallStack2atEj
-__ZN7WebCoreL24getFirstArgumentAsStringERKNS_15ScriptCallFrameERNS_6StringEb
-__ZNK7WebCore15ScriptCallFrame10argumentAtEj
-__ZNK7WebCore11ScriptValue9getStringERNS_6StringE
-__ZN7WebCore19InspectorController19addMessageToConsoleENS_13MessageSourceENS_12MessageLevelEPNS_15ScriptCallStackE
-__ZN7WebCore15ScriptCallStackD1Ev
-__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE6shrinkEm
-__ZN7WebCore34jsHTMLIFrameElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21HTMLFrameOwnerElement15contentDocumentEv
-__ZN7WebCore17checkNodeSecurityEPN3JSC9ExecStateEPNS_4NodeE
-__ZN7WebCore28setJSEventTargetNodeOnresizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode11setOnresizeEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore9RenderBox11getClipRectEii
-__ZN7WebCore10ScrollView4hideEv
-__ZN7WebCore6Widget4hideEv
-__ZN7WebCore31setJSEventTargetNodeOnmouseoverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode14setOnmouseoverEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore30setJSEventTargetNodeOnmouseoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode13setOnmouseoutEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore12RenderButton14hasLineIfEmptyEv
-__ZNK7WebCore17HTMLScriptElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore17HTMLIFrameElement14isURLAttributeEPNS_9AttributeE
-__ZN7WebCore34jsLocationPrototypeFunctionReplaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore10JSLocation7replaceEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCoreL17navigateIfAllowedEPN3JSC9ExecStateEPNS_5FrameERKNS_4KURLEb
-__ZN7WebCore11FrameLoader22scheduleLocationChangeERKNS_6StringES3_bb
-__ZN7WebCore5TimerINS_11FrameLoaderEE5firedEv
-__ZN7WebCore11FrameLoader21redirectionTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore11FrameLoader14changeLocationERKNS_6StringES3_bbb
-__ZN7WebCore13ImageDocumentC1EPNS_5FrameE
-__ZNK7WebCore13ImageDocument17shouldShrinkToFitEv
-__ZN7WebCore13ImageDocument15createTokenizerEv
-__ZNK7WebCore14ImageTokenizer12wantsRawDataEv
-__ZN7WebCore14ImageTokenizer12writeRawDataEPKci
-__ZN7WebCore13ImageDocument11cachedImageEv
-__ZN7WebCore13ImageDocument23createDocumentStructureEv
-__ZN7WebCore8Document15createElementNSERKNS_6StringES3_Ri
-__ZN7WebCore8Document26hasPrefixNamespaceMismatchERKNS_13QualifiedNameE
-__ZN7WebCore8Document16childTypeAllowedENS_4Node8NodeTypeE
-__ZNK7WebCore14DocumentLoader16mainResourceDataEv
-__ZN7WebCore13ImageDocument12imageChangedEv
-__ZN7WebCore14ImageTokenizer6finishEv
-__ZNK7WebCore14DocumentLoader25isLoadingMultipartContentEv
-__ZNK7WebCore4KURL17lastPathComponentEv
-__ZN7WebCore10StringImpl11reverseFindEti
-__ZN7WebCore10imageTitleERKNS_6StringERKNS_7IntSizeE
-__ZN7WebCore8Document4headEv
-__ZN7WebCore13HTMLTokenizer11stopParsingEv
-__ZN7WebCore11FrameLoader22tokenizerProcessedDataEv
-__ZN7WebCore23jsDOMWindowFrameElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow12frameElementEv
-__ZN7WebCore21jsHTMLMetaElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLMetaElement4nameEv
-__ZN7WebCore24jsHTMLMetaElementContentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLMetaElement7contentEv
-__ZN7WebCore22jsDOMWindowInnerHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow11innerHeightEv
-__ZN7WebCore21jsElementClientHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element12clientHeightEv
-__ZN7WebCore20jsElementClientWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element11clientWidthEv
-__ZN7WebCore19jsElementOffsetLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element10offsetLeftEv
-__ZNK7WebCore9RenderBox10offsetLeftEv
-__ZN7WebCore19jsElementScrollLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element10scrollLeftEv
-__ZNK7WebCore9RenderBox10scrollLeftEv
-__ZN7WebCore18jsElementScrollTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element9scrollTopEv
-__ZNK7WebCore9RenderBox9scrollTopEv
-__ZN7WebCore5Frame15sendResizeEventEv
-__ZN7WebCore29jsHTMLBodyElementScrollHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLBodyElement12scrollHeightEv
-__ZN7WebCore26setJSHTMLIFrameElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLFrameElementBase7setNameERKNS_6StringE
-__ZN7WebCore27setJSHTMLIFrameElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLIFrameElement8setWidthERKNS_6StringE
-__ZN7WebCore28setJSHTMLIFrameElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLIFrameElement9setHeightERKNS_6StringE
-__ZN7WebCore31setJSHTMLIFrameElementScrollingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLFrameElementBase12setScrollingERKNS_6StringE
-__ZN7WebCore33setJSHTMLIFrameElementMarginWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLFrameElementBase14setMarginWidthERKNS_6StringE
-__ZN7WebCore34setJSHTMLIFrameElementMarginHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLFrameElementBase15setMarginHeightERKNS_6StringE
-__ZN7WebCore33setJSHTMLIFrameElementFrameBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLFrameElementBase14setFrameBorderERKNS_6StringE
-__ZNK7WebCore15CSSInitialValue7cssTextEv
-__ZN7WebCore18jsHTMLElementTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore46jsNodePrototypeFunctionCompareDocumentPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore36jsNodePrototypeFunctionHasChildNodesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore31setJSEventTargetNodeOnmousemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode14setOnmousemoveEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore22setJSDOMWindowOnresizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow11setOnresizeEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore12RenderObject10nextOffsetEi
-__ZN7WebCore21jsDOMWindowInnerWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow10innerWidthEv
-__ZN7WebCore10HTMLParser23noembedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZNK7WebCore15JSDOMWindowBase29crossDomainAccessErrorMessageEPKN3JSC14JSGlobalObjectE
-__ZN7WebCore25printErrorMessageForFrameEPNS_5FrameERKNS_6StringE
-__ZNK7WebCore15JSDOMWindowBase17printErrorMessageERKNS_6StringE
-__ZNK7WebCore14SimpleFontData17smallCapsFontDataERKNS_15FontDescriptionE
-__ZNK7WebCore17ScrollbarThemeMac20supportsControlTintsEv
-__ZN7WebCore10RenderFlow19createAnonymousFlowEPNS_8DocumentEN3WTF10PassRefPtrINS_11RenderStyleEEE
-__ZN7WebCore18RenderTextFragmentC2EPNS_4NodeEPNS_10StringImplEii
-__ZN7WebCore17jsDOMWindowParentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow6parentEv
-__ZN7WebCore23jsDOMWindowOnmousewheelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow12onmousewheelEv
+__ZNK7WebCore14RenderFieldset10isFieldsetEv
 __ZN7WebCore10JSNodeList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
 __ZNK7WebCore19JSNodeListPrototype9classInfoEv
-__ZN7WebCore54jsXMLHttpRequestPrototypeFunctionGetAllResponseHeadersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore17jsNodeTextContentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16setJSNodeOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnabortEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16StyleCachedImage8cssValueEv
+__ZNK7WebCore26NetscapePlugInStreamLoader6isDoneEv
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE15reserveCapacityEm
+__ZN7WebCore14RenderFieldsetD0Ev
+__ZN7WebCoreL19tablecolConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLTableColElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLTableColElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore19HTMLTableColElement17endTagRequirementEv
+__ZNK7WebCore19HTMLTableColElement11tagPriorityEv
+__ZNK7WebCore19HTMLTableColElement36canHaveAdditionalAttributeStyleDeclsEv
+__ZN7WebCore19HTMLTableColElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore14RenderTableColC1EPNS_4NodeE
+__ZN7WebCore14RenderTableColC2EPNS_4NodeE
+__ZN7WebCore14RenderTableCol17updateFromElementEv
+__ZNK7WebCore14RenderTableCol13requiresLayerEv
+__ZNK7WebCore14RenderTableCol10isTableColEv
+__ZNK7WebCore14RenderTableCol15virtualChildrenEv
+__ZN7WebCore19HTMLTableColElement8checkDTDEPKNS_4NodeE
+__ZNK7WebCore14RenderTableCol15canHaveChildrenEv
+__ZNK7WebCore19HTMLTableColElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore19HTMLTableColElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14RenderTableCol14isChildAllowedEPNS_12RenderObjectEPNS_11RenderStyleE
+__ZN7WebCore14RenderTableCol15virtualChildrenEv
+__ZN7WebCoreL32createHTMLTableColElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLTableColElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLTableColElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableColElementEEE
+__ZN7WebCore21JSHTMLTableColElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableColElementEEE
+__ZN7WebCore21JSHTMLTableColElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSHTMLTableColElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19HTMLFieldSetElementD0Ev
+__ZN7WebCore17HTMLLegendElementD0Ev
+__ZN7WebCore23jsHTMLTableElementTHeadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5tHeadEv
+__ZN7WebCore29jsHTMLTableSectionElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23HTMLTableSectionElement4rowsEv
+__ZN7WebCore26jsHTMLTableRowElementCellsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19HTMLTableRowElement5cellsEv
+__ZN7WebCore14RenderTableCol29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore54jsXMLHttpRequestPrototypeFunctionGetAllResponseHeadersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
 __ZNK7WebCore14XMLHttpRequest21getAllResponseHeadersERi
-__ZNK7WebCore20ResourceResponseBase16httpHeaderFieldsEv
-__ZNK7WebCore8RenderBR14caretMinOffsetEv
-__ZNK7WebCore14CachedResource8encodingEv
-__ZN7WebCore8Document40removePendingFrameBeforeUnloadEventCountEv
-__ZN7WebCore12EventHandler40removePendingFrameBeforeUnloadEventCountEv
-__ZN7WebCore32setJSDOMWindowCounterConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore31jsDOMWindowDOMParserConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore11JSDOMParser14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore22JSDOMParserConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore20JSDOMParserPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore11JSDOMParser15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore22JSDOMParserConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSDOMParserConstructor16getConstructDataERN3JSC13ConstructDataE
-__ZN7WebCore22JSDOMParserConstructor9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9DOMParserE
-__ZN7WebCore11JSDOMParserC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMParserEEE
-__ZN7WebCore11JSDOMParser18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSDOMParserPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsDOMParserPrototypeFunctionParseFromStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore11JSDOMParser9classInfoEv
-__ZN7WebCore9DOMParser15parseFromStringERKNS_6StringES3_
-__ZN7WebCore11MediaPlayer12supportsTypeERKNS_6StringE
-__ZN7WebCore11MediaPlayer17getSupportedTypesERN3WTF7HashSetINS_6StringENS_10StringHashENS1_10HashTraitsIS3_EEEE
-__ZN7WebCore18MediaPlayerPrivate17getSupportedTypesERN3WTF7HashSetINS_6StringENS_10StringHashENS1_10HashTraitsIS3_EEEE
-__ZL11initQTMoviev
-__ZL12QTKitLibraryv
-__ZN7WebCore16MIMETypeRegistry24isSupportedMediaMIMETypeERKNS_6StringE
-__ZN7WebCoreL33initializeSupportedMediaMIMETypesEv
-__ZL15QTMovieFunctionv
+__ZN7WebCoreL21startElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
+__ZN7WebCore12XMLTokenizer14startElementNsEPKhS2_S2_iPS2_iiS3_
+__ZN7WebCore7ElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL23handleElementAttributesEPNS_7ElementEPPKhiRi
+__ZN7WebCore7Element14setAttributeNSERKNS_12AtomicStringES3_S3_Ri
+__ZN7WebCore8Document18parseQualifiedNameERKNS_6StringERS1_S4_Ri
 __ZNK7WebCore7Element18createAttributeMapEv
 __ZN7WebCore7Element15createAttributeERKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore9JSElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15toScriptElementEPNS_7ElementE
+__ZNK7WebCore8Document14isHTMLDocumentEv
+__ZN7WebCoreL17charactersHandlerEPvPKhi
+__ZN7WebCore12XMLTokenizer10charactersEPKhi
+__ZN7WebCore12XMLTokenizer9enterTextEv
+__ZN3WTF6VectorIhLm0EE6appendIhEEvPKT_m
+__ZN3WTF6VectorIhLm0EE14expandCapacityEmPKh
+__ZN3WTF6VectorIhLm0EE14expandCapacityEm
+__ZN3WTF6VectorIhLm0EE15reserveCapacityEm
+__ZN7WebCore13CharacterData10appendDataERKNS_6StringERi
+__ZN3WTF6VectorIhLm0EE6shrinkEm
+__ZN7WebCoreL19endElementNsHandlerEPvPKhS2_S2_
+__ZN7WebCore12XMLTokenizer12endElementNsEv
+__ZN7WebCoreL14commentHandlerEPvPKh
+__ZN7WebCore12XMLTokenizer7commentEPKh
+__ZN7WebCore10JSDocumentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DocumentEEE
+__ZN7WebCore10JSDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore10JSDocument9classInfoEv
-__ZN7WebCore31jsNodeListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore9JSElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ElementEEE
+__ZN7WebCore9JSElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore9JSElement9classInfoEv
-__ZN3WTF6VectorIcLm256EE14expandCapacityEm
-__ZN3WTF6VectorIcLm256EE15reserveCapacityEm
-__ZN7WebCore9AttributeD1Ev
-__ZN7WebCore35nonCachingStaticCloseFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsDOMWindowPrototypeFunctionCloseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9DOMWindow5closeEv
-__ZN7WebCoreL21serviceTypeForClassIdERKNS_6StringEPKNS_10PluginDataE
-__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_15CaseFoldingHashENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E6rehashEi
-__ZN7WebCore16MIMETypeRegistry20isJavaAppletMIMETypeERKNS_6StringE
-__ZNK3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S6_EEEEbRKT_
-__ZN7WebCore11RenderTable19getOverflowClipRectEii
-__ZN7WebCore23setJSHTMLLinkElementRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLLinkElement6setRelERKNS_6StringE
-__ZN7WebCore24setJSHTMLLinkElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLLinkElement7setTypeERKNS_6StringE
-__ZN7WebCore24setJSHTMLLinkElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLLinkElement7setHrefERKNS_6StringE
-__ZN7WebCore21jsElementScrollHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element12scrollHeightEv
-__ZNK7WebCore9RenderBox12scrollHeightEv
-__ZN3JSC8Bindings9CInstanceD1Ev
-__ZN7WebCore21setJSDOMWindowConsoleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore18jsNavigatorProductEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13NavigatorBase7productEv
-__ZN7WebCore20jsNavigatorVendorSubEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13NavigatorBase9vendorSubEv
-__ZN7WebCore9TextCodec25getUnencodableReplacementEjNS_19UnencodableHandlingEPc
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore14CachedResourceEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E4findIS6_NS_22IdentityHashTranslatorIS6_S6_SC_EEEENS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EERKT_
-__ZN7WebCore27setJSEventTargetNodeOnfocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode10setOnfocusEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCoreL19optgroupConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLOptGroupElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore19HTMLOptGroupElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore19HTMLOptGroupElement19recalcSelectOptionsEv
-__ZN7WebCore19HTMLOptGroupElement6attachEv
-__ZN7WebCore19HTMLOptGroupElement14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
-__ZN7WebCore19HTMLOptGroupElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore19HTMLOptGroupElement15childrenChangedEbPNS_4NodeES2_i
-__ZNK7WebCore19HTMLOptGroupElement22nonRendererRenderStyleEv
-__ZN7WebCore22jsHTMLImageElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement4nameEv
-__ZN7WebCore30setJSEventTargetNodeOnkeypressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode13setOnkeypressEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore31setJSEventTargetNodeOnmousedownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode14setOnmousedownEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore27jsEventTargetNodeOnmouseoutEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode10onmouseoutEv
-__ZN7WebCore16FixedTableLayoutC1EPNS_11RenderTableE
-__ZN7WebCore16FixedTableLayout14calcPrefWidthsERiS1_
-__ZN7WebCore16FixedTableLayout14calcWidthArrayEi
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE6resizeEm
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE4fillERKS2_m
-__ZSt4fillIPN7WebCore6LengthES1_EvT_S3_RKT0_
-__ZN7WebCore16FixedTableLayout6layoutEv
-__ZN7WebCore21jsHTMLImageElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement3srcEv
-__ZNK7WebCore11FrameLoader11openedByDOMEv
-__ZN7WebCore5Frame13scheduleCloseEv
-__ZN7WebCore6Chrome15closeWindowSoonEv
-__ZN7WebCore5Cache18revalidationFailedEPNS_14CachedResourceE
-__ZN7WebCore16HTMLStyleElement19removedFromDocumentEv
-__ZN7WebCore12StyleElement19removedFromDocumentEPNS_8DocumentE
-__ZN7WebCore25PluginMainThreadScheduler16unregisterPluginEP4_NPP
-__ZN3WTF9HashTableIP4_NPPSt4pairIS2_NS_5DequeIN7WebCore25PluginMainThreadScheduler4CallEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSF_IS8_EEEESG_E4findIS2_NS_22IdentityHashTranslatorIS2_S9_SD_EEEENS_17HashTableIteratorIS2_S9_SB_SD_SI_SG_EERKT_
-__ZN7WebCore16ScriptController29cleanupScriptObjectsForPluginEPv
-__ZN7WebCore16RenderHTMLCanvasD1Ev
-__ZN7WebCore11FrameLoader24checkCompletedTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore25JSCanvasGradientPrototypeD0Ev
-__ZN7WebCore35JSCanvasRenderingContext2DPrototypeD0Ev
-__ZN7WebCore28JSHTMLCanvasElementPrototypeD0Ev
-__ZN7WebCore16HTMLEmbedElement19removedFromDocumentEv
-__ZN7WebCore17HTMLObjectElement19removedFromDocumentEv
-__ZN7WebCore11ImageBufferD2Ev
-__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE6shrinkEm
-__ZN7WebCore22HTMLPlugInImageElementD0Ev
-__ZN7WebCore17HTMLPlugInElementD0Ev
-__ZN7WebCore12RenderLegendD1Ev
-__ZN7WebCore14RenderFieldsetD1Ev
-__ZN7WebCore19HTMLFieldSetElementD1Ev
-__ZN7WebCore17HTMLLegendElementD1Ev
-__ZN7WebCore17HTMLButtonElementD1Ev
-__ZN7WebCore14HTMLModElementD1Ev
-__ZN7WebCore16HTMLInputElement39unregisterForActivationCallbackIfNeededEv
-__ZN7WebCore23jsHTMLFormElementLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL30createHTMLOptionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLOptionElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSHTMLOptionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLOptionElementEEE
-__ZN7WebCore28JSHTMLSelectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLOptionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLOptionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCoreL28createHTMLFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLFontElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSHTMLFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFontElementEEE
-__ZN7WebCore17JSHTMLFontElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSHTMLFontElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore22JSDOMParserConstructorD0Ev
-__ZN7WebCore17JSHTMLFontElementD0Ev
-__ZN7WebCore18JSHTMLParamElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore27JSHTMLEmbedElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLEmbedElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore18JSHTMLEmbedElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore19HTMLTextAreaElement23rendererWillBeDestroyedEv
-__ZN7WebCore16FixedTableLayoutD1Ev
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE6shrinkEm
-__ZN7WebCore19HTMLOptGroupElement6detachEv
-__ZN7WebCore19HTMLOptGroupElementD1Ev
-__ZNK7WebCore11FrameLoader21fileDoesNotExistErrorERKNS_16ResourceResponseE
-__ZN7WebCore26NetscapePlugInStreamLoader9didCancelERKNS_13ResourceErrorE
-__ZNK7WebCore12RenderInline10offsetLeftEv
-__ZNK7WebCore12RenderInline9offsetTopEv
-__ZN7WebCore19jsElementClientLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element10clientLeftEv
-__ZN7WebCore18jsElementClientTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element9clientTopEv
-__ZN7WebCore15PurgeableBufferD1Ev
-__ZN7WebCore24jsHTMLIFrameElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLIFrameElement5widthEv
-__ZN7WebCore25jsHTMLIFrameElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLIFrameElement6heightEv
-__ZN7WebCore22jsHTMLIFrameElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLFrameElementBase3srcEv
-__ZN7WebCore39jsDOMWindowPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11JSDOMWindow11postMessageEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore9DOMWindow11postMessageERKNS_6StringEPNS_11MessagePortES3_PS0_Ri
-__ZN7WebCore12MessageEventC1ERKNS_6StringES3_S3_N3WTF10PassRefPtrINS_9DOMWindowEEENS5_INS_11MessagePortEEE
-__ZN7WebCore16PostMessageTimer5firedEv
-__ZN7WebCore9DOMWindow21postMessageTimerFiredEPNS_16PostMessageTimerE
-__ZN7WebCore41nonCachingStaticPostMessageFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore16HTMLParamElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore16HTMLEmbedElement14isURLAttributeEPNS_9AttributeE
-__ZN7WebCoreL27createHTMLModElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore16JSHTMLModElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSHTMLModElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLModElementEEE
-__ZN7WebCore16JSHTMLModElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16JSHTMLModElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZNK7WebCore11FrameLoader14cancelledErrorERKNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader20clearProvisionalLoadEv
-__ZN7WebCore9FontCache21purgeInactiveFontDataEi
-__ZN7WebCore17GlyphPageTreeNode17pruneTreeFontDataEPKNS_14SimpleFontDataE
-__ZN7WebCore17GlyphPageTreeNode13pruneFontDataEPKNS_14SimpleFontDataEj
-__ZN7WebCore17GlyphPageTreeNodeD2Ev
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore17GlyphPageTreeNodeEKNS_7HashMapIPKNS1_8FontDataES3_NS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSA_IS3_EEEEEEvRT0_
-__ZN7WebCore14SimpleFontData15platformDestroyEv
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore13GlyphWidthMap14GlyphWidthPageEKNS_7HashMapIiS4_NS_7IntHashIjEENS_10HashTraitsIiEENS8_IS4_EEEEEEvRT0_
-__ZN7WebCore8FontDataD0Ev
-__ZN3WTF6VectorIN7WebCore24FontPlatformDataCacheKeyELm0EE15reserveCapacityEm
-__ZNK3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_S3_IPNS1_14SimpleFontDataEjEENS_18PairFirstExtractorIS7_EENS1_20FontDataCacheKeyHashENS_14PairHashTraitsINS1_22FontDataCacheKeyTraitsENS_10HashTraitsIS6_EEEESC_E8containsIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEEbRKT_
-__ZN3WTF6VectorIN7WebCore24FontPlatformDataCacheKeyELm0EE6shrinkEm
-__ZN7WebCore5Cache18pruneDeadResourcesEv
-__ZNK7WebCore5Cache12deadCapacityEv
-__ZNK7WebCore14CachedResource9wasPurgedEv
-__ZNK7WebCore15PurgeableBuffer9wasPurgedEv
-__ZN3WTF6VectorIN7WebCore5Cache7LRUListELm32EE6resizeEm
-__ZN7WebCore5Cache18pruneLiveResourcesEv
-__ZNK7WebCore5Cache12liveCapacityEv
-__ZN7WebCore19HTMLFrameSetElement11recalcStyleENS_4Node11StyleChangeE
-__ZN7WebCore17HTMLSelectElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore17HTMLSelectElement27menuListDefaultEventHandlerEPNS_5EventE
-__ZN7WebCore4Path7addRectERKNS_9FloatRectE
-__ZN7WebCoreL34copyClosingSubpathsApplierFunctionEPvPK13CGPathElement
-__ZNK7WebCore10FloatPointcv7CGPointEv
-__ZNK7WebCore15HTMLAreaElement6targetEv
-__ZN7WebCore15jsDocumentFormsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14CachedResource18destroyDecodedDataEv
-__ZN7WebCore13RenderListBox24isPointInOverflowControlERNS_13HitTestResultEiiii
-__ZN7WebCore13HitTestResult12setScrollbarEPNS_9ScrollbarE
-__ZN7WebCore11HistoryItem22mergeAutoCompleteHintsEPS0_
-__ZN7WebCore9CSSParser16parseBorderImageEibRN3WTF6RefPtrINS_8CSSValueEEE
-__ZN7WebCore23BorderImageParseContext17commitBorderImageEPNS_9CSSParserEb
-__ZN7WebCore19CSSBorderImageValueC1EN3WTF10PassRefPtrINS_8CSSValueEEENS2_INS_4RectEEEii
-__ZN7WebCore9CSSParser11parseShadowEib
-__ZN7WebCore18ShadowParseContext11commitValueEv
-__ZN7WebCore11ShadowValueC1EN3WTF10PassRefPtrINS_17CSSPrimitiveValueEEES4_S4_S4_
-__ZN7WebCore9CSSParser27createFloatingMediaQueryExpERKNS_12AtomicStringEPNS_18CSSParserValueListE
-__ZN7WebCore13MediaQueryExpC1ERKNS_12AtomicStringEPNS_18CSSParserValueListE
-__ZN7WebCore9CSSParser25sinkFloatingMediaQueryExpEPNS_13MediaQueryExpE
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE15reserveCapacityEm
-__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_13MediaQueryExpE
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_5FrameENS1_18MediaFeaturePrefixEEENS_18PairFirstExtractorISE_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSK_ISD_EEEESL_E6expandEv
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_5FrameENS1_18MediaFeaturePrefixEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSF_ISC_EEE3setERKS3_RKSC_
-__ZN7WebCoreL32max_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL28device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCore17CSSPrimitiveValue16computeLengthIntEPNS_11RenderStyleE
-__ZN7WebCore12compareValueIiEEbT_S1_NS_18MediaFeaturePrefixE
-__ZNK7WebCore14RenderThemeMac17cancelButtonSizesEv
-__ZN7WebCore11RenderStyle5cloneEPKS0_
-__ZN7WebCore11RenderStyleC1ERKS0_
-__ZNK7WebCore27RenderTextControlSingleLine28updateCancelButtonVisibilityEPNS_11RenderStyleE
-__ZN7WebCore12RenderInline11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore27jsHTMLAnchorElementProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement8protocolEv
-__ZN7WebCore25jsHTMLAnchorElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE6shrinkEm
-__ZN7WebCore26JSUnprotectedEventListener17clearGlobalObjectEv
-__ZN7WebCore24jsDocumentImplementationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17DOMImplementationE
-__ZN7WebCore19JSDOMImplementation15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSDOMImplementationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17DOMImplementationEEE
-__ZN7WebCore19JSDOMImplementation18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSDOMImplementationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore46jsDOMImplementationPrototypeFunctionHasFeatureEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore19JSDOMImplementation9classInfoEv
-__ZN7WebCoreL14isSVG10FeatureERKNS_6StringE
-__ZNK7WebCore18JSEventConstructor9classInfoEv
-__ZN7WebCore19CSSCursorImageValueC1ERKNS_6StringERKNS_8IntPointE
-__ZN7WebCore16JSHTMLCollection10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore15JSDOMWindowBase15namedItemGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore8Document16windowNamedItemsERKNS_6StringE
-__ZN7WebCore10ShadowDataC1ERKS0_
-__ZNK7WebCore14RenderThemeMac35adjustSearchFieldResultsButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore22HTMLFormControlElement14isEnumeratableEv
-__ZNK7WebCore17HTMLButtonElement14isEnumeratableEv
-__ZN7WebCoreL32createHTMLFieldSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLFieldSetElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSHTMLFieldSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFieldSetElementEEE
-__ZN7WebCore21JSHTMLFieldSetElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCoreL30createHTMLLegendElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLLegendElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSHTMLLegendElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLLegendElementEEE
-__ZN7WebCore19JSHTMLLegendElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCoreL30createHTMLButtonElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLButtonElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSHTMLButtonElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLButtonElementEEE
-__ZN7WebCore19JSHTMLButtonElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLButtonElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLButtonElement9classInfoEv
-__ZN7WebCore11JSDOMWindow14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
-__ZN7WebCore27jsHTMLInputElementMaxLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement9maxLengthEv
-__ZN7WebCore30setJSHTMLInputElementMaxLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement12setMaxLengthEi
-__ZN7WebCore16textBreakCurrentEPNS_17TextBreakIteratorE
-__ZN7WebCore14RenderThemeMac29paintSearchFieldResultsButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac18searchMenuTemplateEv
-__ZNK7WebCore13MutationEvent15isMutationEventEv
-__ZN7WebCore15getDOMStructureINS_15JSMutationEventEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore15JSMutationEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSMutationEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MutationEventEEE
-__ZN7WebCore23jsHTMLAnchorElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement4typeEv
-__ZN7WebCore19JSHTMLButtonElementD0Ev
-__ZN7WebCore19JSHTMLLegendElementD0Ev
-__ZN7WebCore21JSHTMLFieldSetElementD0Ev
-__ZN7WebCore15JSMutationEventD0Ev
-__ZN7WebCore28JSDOMImplementationPrototypeD0Ev
-__ZN7WebCore26jsHTMLImageElementCompleteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement8completeEv
-__ZN7WebCore10JSNodeList10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore19jsDOMWindowOnscrollEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow8onscrollEv
-__ZN7WebCore22setJSDOMWindowOnscrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow11setOnscrollEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore27jsHTMLBodyElementScrollLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLBodyElement10scrollLeftEv
-__ZN7WebCore26jsHTMLBodyElementScrollTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLBodyElement9scrollTopEv
-__ZNK7WebCore12EventHandler22dragHysteresisExceededERKNS_8IntPointE
-__ZN7WebCore15getDOMStructureINS_15JSKeyboardEventEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore15JSKeyboardEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSKeyboardEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13KeyboardEventEEE
-__ZN7WebCore5Frame10findStringERKNS_6StringEbbbb
-__ZNK7WebCore9Selection18shadowTreeRootNodeEv
-__ZN7WebCore9SelectionC1EPKNS_5RangeENS_9EAffinityE
-__ZN7WebCoreeqERKNS_5RangeES2_
-__ZNK7WebCore12RenderObject15localToAbsoluteENS_10FloatPointEbb
-__ZN7WebCore11RenderBlock13selectionRectEb
-__ZN7WebCore15GraphicsContext7clipOutERKNS_7IntRectE
-__ZN7WebCore8Document23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
-__ZNK7WebCore5Frame18selectionTextRectsERN3WTF6VectorINS_9FloatRectELm0EEEb
-__ZN7WebCore5Range15addLineBoxRectsERN3WTF6VectorINS_7IntRectELm0EEEb
-__ZN7WebCore10RenderText15addLineBoxRectsERN3WTF6VectorINS_7IntRectELm0EEEjjb
-__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE15reserveCapacityEm
-__ZNK7WebCore5Frame14selectionImageEb
-__ZN7WebCore9FrameView19setPaintRestrictionENS_16PaintRestrictionE
-__ZNK7WebCore5Frame13imageFromRectE7_NSRect
-__ZNK7WebCore5Frame12selectedTextEv
-__ZN7WebCore39jsEventPrototypeFunctionStopPropagationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore10MouseEventC2Ev
-__ZN7WebCore17MouseRelatedEventC2Ev
-__ZN7WebCore43jsMouseEventPrototypeFunctionInitMouseEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11toDOMWindowEN3JSC10JSValuePtrE
-__ZN7WebCore17toEventTargetNodeEN3JSC10JSValuePtrE
-__ZN7WebCore10MouseEvent14initMouseEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_15EventTargetNodeEEE
-__ZN7WebCore7UIEvent11initUIEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEi
-__ZN7WebCore17MouseRelatedEvent15initCoordinatesEii
-__ZN7WebCore24JSKeyboardEventPrototypeD0Ev
-__ZN7WebCore19CSSCursorImageValue23updateIfSVGCursorIsUsedEPNS_7ElementE
-__ZN7WebCore19CSSCursorImageValue11cachedImageEPNS_9DocLoaderE
-__ZN7WebCore11RenderStyle9addCursorEPNS_11CachedImageERKNS_8IntPointE
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE15reserveCapacityEm
-__ZNK7WebCore10ShadowDataeqERKS0_
-__ZN3WTFeqIN7WebCore10CursorDataELm0EEEbRKNS_6VectorIT_XT0_EEES7_
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE6shrinkEm
-__ZN7WebCore39jsHTMLFormElementPrototypeFunctionResetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore15HTMLFormElement5resetEv
-__ZN7WebCore22HTMLFormControlElement5resetEv
-__ZN7WebCore16HTMLInputElement5resetEv
-__ZN7WebCore40jsDocumentPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore42jsElementPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore27setJSEventTargetNodeOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode10setOnerrorEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore8Document7baseURIEv
-__ZNK7WebCore21JSHTMLFieldSetElement9classInfoEv
-__ZNK7WebCore19JSHTMLLegendElement9classInfoEv
-__ZN7WebCore22jsHTMLElementInnerTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7Element9innerTextEv
-__ZN7WebCore14RenderFieldset19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore11RenderLayer20setHasVisibleContentEb
-__ZN7WebCore6CursorC1EPNS_5ImageERKNS_8IntPointE
-__ZN7WebCoreL18createCustomCursorEPNS_5ImageERKNS_8IntPointE
-__ZN7WebCore12EventHandler10wheelEventEP7NSEvent
-__ZN7WebCore18PlatformWheelEventC1EP7NSEvent
-__ZN7WebCore12EventHandler16handleWheelEventERNS_18PlatformWheelEventE
-__ZN7WebCore15EventTargetNode18dispatchWheelEventERNS_18PlatformWheelEventE
-__ZN7WebCore10WheelEventC1EffN3WTF10PassRefPtrINS_9DOMWindowEEEiiiibbbb
-__ZNK7WebCore12RenderObject15absoluteToLocalENS_10FloatPointEbb
-__ZNK7WebCore12RenderObject12enclosingBoxEv
-__ZN7WebCore9RenderBox6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZN7WebCore11RenderLayer6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZN7WebCore10ScrollView10wheelEventERNS_18PlatformWheelEventE
-__ZNK7WebCore17HTMLSelectElement14isEnumeratableEv
-__ZN7WebCore17HTMLSelectElement5resetEv
-__ZN7WebCore29setJSHTMLInputElementReadOnlyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore22HTMLFormControlElement11setReadOnlyEb
-__ZN7WebCore26jsHTMLInputElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsHTMLSelectElementOptionsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17HTMLSelectElement7optionsEv
-__ZN7WebCore21HTMLOptionsCollection6createEN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
-__ZN7WebCore21HTMLOptionsCollectionC2EN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
-__ZN7WebCore23JSHTMLOptionsCollection15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore25JSHTMLCollectionPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore23JSHTMLOptionsCollectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLOptionsCollectionEEE
-__ZN7WebCore23JSHTMLOptionsCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29jsHTMLOptionsCollectionLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore23JSHTMLOptionsCollection6lengthEPN3JSC9ExecStateE
-__ZNK7WebCore19JSHTMLSelectElement9classInfoEv
-__ZN7WebCore19JSHTMLLegendElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore27jsHTMLSelectElementMultipleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLSelectElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30setJSHTMLSelectElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore27jsHTMLSelectElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26setJSHTMLSelectElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore22HTMLFormControlElement7setNameERKNS_12AtomicStringE
-__ZN7WebCore25jsHTMLInputElementCheckedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28setJSHTMLInputElementCheckedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25setJSHTMLInputElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_16HTMLInputElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SB_EEEENS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EERKT_
-__ZNK7WebCore19JSHTMLOptionElement9classInfoEv
-__ZN7WebCore27JSDocumentFragmentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17HTMLSelectElement11appendChildEN3WTF10PassRefPtrINS_4NodeEEERib
-__ZN7WebCore30setJSHTMLOptionElementSelectedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLOptionElement11setSelectedEb
-__ZN7WebCore26setJSHTMLOptionElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLOptionElement7setTextERKNS_6StringERi
-__ZN7WebCore27setJSHTMLOptionElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLOptionElement8setValueERKNS_6StringE
-__ZNK7WebCore26CSSMutableStyleDeclaration24getLayeredShorthandValueEPKij
-__ZNK7WebCore12CSSValueList7cssTextEv
-__ZN7WebCoreL22getPositionOffsetValueEPNS_11RenderStyleEi
-__ZN7WebCore8Document29removeStyleSheetCandidateNodeEPNS_4NodeE
-__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCoreL9sizingBoxEPNS_12RenderObjectE
-__ZN7WebCore23JSHTMLOptionsCollectionD0Ev
-__ZN7WebCore28setJSHTMLAnchorElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAnchorElement9setTargetERKNS_12AtomicStringE
-__ZN7WebCore12EventHandler24scheduleHoverStateUpdateEv
-__ZN7WebCore32JSHTMLOptionsCollectionPrototypeD0Ev
-__ZN7WebCore16HTMLLabelElement9setActiveEbb
-__ZN7WebCore16HTMLLabelElement10setHoveredEb
-__ZN7WebCore16HTMLLabelElement20correspondingControlEv
-__ZN7WebCore4Page6goBackEv
-__ZN7WebCore4Page8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
-__ZN7WebCore11FrameLoader8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
-__ZN7WebCore15BackForwardList8goToItemEPNS_11HistoryItemE
-__ZN7WebCore11FrameLoader17recursiveGoToItemEPNS_11HistoryItemES2_NS_13FrameLoadTypeE
-__ZNK7WebCore11HistoryItem12isTargetItemEv
-__ZN7WebCore11FrameLoader8loadItemEPNS_11HistoryItemENS_13FrameLoadTypeE
-__ZN7WebCore11HistoryItem8formDataEv
-__ZNK7WebCore11FrameLoader13urlsMatchItemEPNS_11HistoryItemE
-__ZNK7WebCore11HistoryItem8referrerEv
-__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEb
-__ZN7WebCore11FrameLoader33loadProvisionalItemFromCachedPageEv
-__ZN7WebCore11FrameLoader37updateHistoryForBackForwardNavigationEv
-__ZN7WebCore14FormElementKeyC1EPNS_16AtomicStringImplES2_
-__ZNK7WebCore14FormElementKey3refEv
-__ZN3WTF9HashTableIN7WebCore14FormElementKeyESt4pairIS2_NS_6VectorINS1_6StringELm0EEEENS_18PairFirstExtractorIS7_EENS1_18FormElementKeyHashENS_14PairHashTraitsINS1_24FormElementKeyHashTraitsENS_10HashTraitsIS6_EEEESC_E4findIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEENS_17HashTableIteratorIS2_S7_S9_SA_SF_SC_EERKT_
-__ZN3WTF7HashMapIN7WebCore14FormElementKeyENS_6VectorINS1_6StringELm0EEENS1_18FormElementKeyHashENS1_24FormElementKeyHashTraitsENS_10HashTraitsIS5_EEE3setERKS2_RKS5_
-__ZN3WTF9HashTableIN7WebCore14FormElementKeyESt4pairIS2_NS_6VectorINS1_6StringELm0EEEENS_18PairFirstExtractorIS7_EENS1_18FormElementKeyHashENS_14PairHashTraitsINS1_24FormElementKeyHashTraitsENS_10HashTraitsIS6_EEEESC_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS7_
-__ZN7WebCore14FormElementKeyC1ERKS0_
-__ZN7WebCore14FormElementKeyD1Ev
-__ZNK7WebCore14FormElementKey5derefEv
-__ZN7WebCore18FormElementKeyHash4hashERKNS_14FormElementKeyE
-__ZN7WebCore14FormElementKeyaSERKS0_
-__ZN7WebCore8Document23takeStateForFormElementEPNS_16AtomicStringImplES2_RNS_6StringE
-__ZThn68_N7WebCore16HTMLInputElement12restoreStateERKNS_6StringE
-__ZN7WebCore16HTMLInputElement12restoreStateERKNS_6StringE
-__ZN7WebCore11FrameLoader33restoreScrollPositionAndViewStateEv
-__ZNK7WebCore9FrameView17wasScrolledByUserEv
-__ZNK7WebCore11HistoryItem11scrollPointEv
-__ZThn68_N7WebCore17HTMLSelectElement12restoreStateERKNS_6StringE
-__ZN7WebCore17HTMLSelectElement12restoreStateERKNS_6StringE
-__ZN7WebCore7Element5focusEb
-__ZNK7WebCore22HTMLFormControlElement13supportsFocusEv
-__ZN7WebCore17HTMLSelectElement18dispatchFocusEventEv
-__ZN7WebCore17HTMLSelectElement17saveLastSelectionEv
-__ZNK7WebCore4Node20shouldUseInputMethodEv
-__ZN7WebCore8Document27cancelFocusAppearanceUpdateEv
-__ZN7WebCore7Element21updateFocusAppearanceEb
-__ZN7WebCore14RenderMenuList9showPopupEv
-__ZN7WebCore9PopupMenuC1EPNS_15PopupMenuClientE
-__ZN7WebCore12RenderObject23absoluteBoundingBoxRectEb
-__ZN7WebCore9RenderBox13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEiib
-__ZN7WebCore9PopupMenu4showERKNS_7IntRectEPNS_9FrameViewEi
-__ZN7WebCore9PopupMenu8populateEv
-__ZThn140_NK7WebCore14RenderMenuList13shouldPopOverEv
-__ZNK7WebCore14RenderMenuList13shouldPopOverEv
-__ZThn140_NK7WebCore14RenderMenuList8listSizeEv
-__ZNK7WebCore14RenderMenuList8listSizeEv
-__ZThn140_NK7WebCore14RenderMenuList15itemIsSeparatorEj
-__ZNK7WebCore14RenderMenuList15itemIsSeparatorEj
-__ZThn140_NK7WebCore14RenderMenuList9itemStyleEj
-__ZNK7WebCore14RenderMenuList9itemStyleEj
-__ZNK7WebCore14RenderMenuList19itemBackgroundColorEj
-__ZNK7WebCore5Color5blendERKS0_
-__ZThn140_NK7WebCore14RenderMenuList8itemTextEj
-__ZNK7WebCore14RenderMenuList8itemTextEj
-__ZThn140_NK7WebCore14RenderMenuList13itemIsEnabledEj
-__ZNK7WebCore14RenderMenuList13itemIsEnabledEj
-__ZThn140_NK7WebCore14RenderMenuList9menuStyleEv
-__ZNK7WebCore14RenderMenuList9menuStyleEv
-__ZN7WebCore12EventHandler14currentNSEventEv
--[AccessibilityObjectWrapper _accessibilityParentForSubview:]
-__ZThn140_N7WebCore14RenderMenuList9hidePopupEv
-__ZN7WebCore14RenderMenuList9hidePopupEv
-__ZN7WebCore9PopupMenu4hideEv
-__ZN7WebCore12EventHandler33sendFakeEventsAfterWidgetTrackingEP7NSEvent
-__ZN7WebCore23jsHTMLSelectElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsHTMLSelectElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17HTMLSelectElement5valueEv
-__ZNK7WebCore17HTMLOptionElement5valueEv
-__ZN7WebCore13OptionElement18collectOptionValueERKNS_17OptionElementDataEPNS_8DocumentE
-__ZN7WebCore19jsNodeParentElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12RenderObject27capsLockStateMayHaveChangedEv
-__ZNK7WebCore13KeyboardEvent7keyCodeEv
-__ZN7WebCore13AXObjectCache16postNotificationEPNS_12RenderObjectERKNS_6StringE
-__ZNK7WebCore25AccessibilityRenderObject16observableObjectEv
-__ZN7WebCore4Node13aboutToUnloadEv
-__ZN7WebCore9PopupMenuD1Ev
-__ZN3WTF10RefCountedIN7WebCore5XPath9ValueDataEE5derefEv
-__ZN7WebCore12RenderObject32setNeedsPositionedMovementLayoutEv
-__ZN7WebCore9RenderBox36tryLayoutDoingPositionedMovementOnlyEv
-__ZNK7WebCore11HTMLElement11isFocusableEv
-__ZNK7WebCore4Node11isFocusableEv
-__ZNK7WebCore16HTMLImageElement17canStartSelectionEv
-__ZNK7WebCore18JSHTMLParamElement9classInfoEv
-__ZN7WebCore17HTMLPlugInElement19defaultEventHandlerEPNS_5EventE
-__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_15CaseFoldingHashENS_10HashTraitsIS2_EES5_E3addERKS2_S8_
-__ZN3JSC8Bindings12ObjcInstanceC1EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3JSC8Bindings12ObjcInstance12virtualBeginEv
-__ZNK3JSC8Bindings12ObjcInstance8getClassEv
-__ZN3JSC8Bindings9ObjcClass11classForIsAEP10objc_class
-__ZN3JSC8Bindings9ObjcClassC1EP10objc_class
-__ZNK3JSC8Bindings9ObjcClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZNK3JSC8Bindings9ObjcClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZN3JSC8Bindings25convertJSMethodNameToObjcEPKcPcm
-__ZN3JSC8Bindings9ObjcClass14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
-__ZN3JSC8Bindings12ObjcInstance10virtualEndEv
-__ZN7WebCore11FrameLoader47callContinueFragmentScrollAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
-__ZN7WebCore11FrameLoader43continueFragmentScrollAfterNavigationPolicyERKNS_15ResourceRequestEb
-__ZN7WebCore14DocumentLoader32replaceRequestURLForAnchorScrollERKNS_4KURLE
-__ZN7WebCore11FrameLoader31addHistoryItemForFragmentScrollEv
-__ZN7WebCore11FrameLoader14scrollToAnchorERKNS_4KURLE
-__ZN7WebCore11FrameLoader28updateHistoryForAnchorScrollEv
--[DOMDocument createEvent:]
-+[DOMEvent(WebCoreInternal) _wrapEvent:]
--[DOMEvent(WebCoreInternal) _initWithEvent:]
--[DOMEvent initEvent:canBubbleArg:cancelableArg:]
--[DOMNode dispatchEvent:]
--[DOMEvent(WebCoreInternal) _event]
--[DOMEvent dealloc]
-__ZNK7WebCore4Node16isMouseFocusableEv
-__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore12EventHandler26passMouseDownEventToWidgetEPNS_6WidgetE
-__ZN7WebCoreL18lastEventIsMouseUpEv
-__ZN7WebCoreL18findViewInSubviewsEP6NSViewS1_
-__ZN3JSC8Bindings10ObjcMethodC1EP10objc_classP13objc_selector
-__ZN7WebCore19JSHTMLObjectElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZZN3JSC8Bindings12ObjcInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListEE19__PRETTY_FUNCTION__
-__ZN3JSC8Bindings12ObjcInstance18setGlobalExceptionEP8NSStringPNS_14JSGlobalObjectE
-__ZNK3JSC8Bindings10ObjcMethod18getMethodSignatureEv
-__ZN3JSC8Bindings20objcValueTypeForTypeEPKc
-__ZN3JSC8Bindings23convertValueToObjcValueEPNS_9ExecStateENS_10JSValuePtrENS0_13ObjcValueTypeE
-__ZN3JSC8Bindings20webScriptObjectClassEv
-+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]
-__ZN3JSC8Bindings23convertObjcValueToValueEPNS_9ExecStateEPvNS0_13ObjcValueTypeEPNS0_10RootObjectE
-__ZN3JSC8Bindings12ObjcInstance30moveGlobalExceptionToExecStateEPNS_9ExecStateE
-__ZN3JSC8Bindings23convertNSStringToStringEPNS_9ExecStateEP8NSString
-__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSC_IS5_EEEESD_E4findIjNS_22IdentityHashTranslatorIjS6_SA_EEEENS_17HashTableIteratorIjS6_S8_SA_SF_SD_EERKT_
-__ZN7WebCore15RenderContainer28removeLeftoverAnonymousBlockEPNS_11RenderBlockE
-__ZN7WebCore17AccessibilityList6createEPNS_12RenderObjectE
-__ZN7WebCore17AccessibilityListC1EPNS_12RenderObjectE
-__ZN7WebCore12EventHandler16handleAutoscrollEPNS_12RenderObjectE
-__ZN7WebCore12EventHandler21setAutoscrollRendererEPNS_12RenderObjectE
-__ZN7WebCore12EventHandler20startAutoscrollTimerEv
-__ZN7WebCore12EventHandler27updateSelectionForMouseDragEPNS_4NodeERKNS_8IntPointE
-__ZN7WebCore12EventHandler24canMouseDragExtendSelectEPNS_4NodeE
-__ZN7WebCore9Selection9setExtentERKNS_15VisiblePositionE
-__ZN7WebCore5TimerINS_12EventHandlerEE5firedEv
-__ZN7WebCore12EventHandler20autoscrollTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore9RenderBox10autoscrollEv
-__ZN7WebCore11RenderLayer10autoscrollEv
-__ZN7WebCore12EventHandler27updateSelectionForMouseDragEv
-__ZNK7WebCore12EventHandler20currentMousePositionEv
-__ZN7WebCore20jsHTMLLIElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13HTMLLIElement5valueEv
-__ZN7WebCore9RenderBox14stopAutoscrollEv
-__ZNK7WebCore11RenderBlock14positionForBoxEPNS_9InlineBoxEb
-__ZNK7WebCore25JSHTMLDivElementPrototype9classInfoEv
-__ZNK7WebCore22JSHTMLElementPrototype9classInfoEv
-__ZNK7WebCore18JSElementPrototype9classInfoEv
-__ZNK7WebCore26JSEventTargetNodePrototype9classInfoEv
-__ZNK7WebCore15JSNodePrototype9classInfoEv
-__ZN7WebCore21jsHTMLDivElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore14HTMLDivElement5alignEv
-__ZN7WebCore30jsHTMLElementIsContentEditableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsHTMLElementContentEditableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11HTMLElement15contentEditableEv
-__ZN7WebCore17jsHTMLElementLangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11HTMLElement4langEv
-__ZN7WebCore22jsHTMLElementOuterTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7Element9outerTextEv
-__ZN7WebCore16jsHTMLElementDirEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11HTMLElement3dirEv
-__ZN7WebCore22jsHTMLElementOuterHTMLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11HTMLElement9outerHTMLEv
-__ZN7WebCore21jsHTMLElementTabIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11HTMLElement8tabIndexEv
-__ZNK7WebCore4Node13supportsFocusEv
-__ZN7WebCore25jsElementLastElementChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7Element16lastElementChildEv
-__ZN7WebCore20jsElementScrollWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7Element11scrollWidthEv
-__ZNK7WebCore9RenderBox11scrollWidthEv
-__ZN7WebCore26jsElementFirstElementChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7Element17firstElementChildEv
-__ZN7WebCore26jsElementChildElementCountEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7Element17childElementCountEv
-__ZN7WebCore31jsElementPreviousElementSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7Element22previousElementSiblingEv
-__ZN7WebCore27jsElementNextElementSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7Element18nextElementSiblingEv
-__ZN7WebCore13jsNodeBaseURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7Element7baseURIEv
-__ZN7WebCore14jsStringOrNullEPN3JSC9ExecStateERKNS_4KURLE
-__ZNK7WebCore4Node9nodeValueEv
-__ZN3WTF6VectorIN7WebCore6StringELm16EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore6StringELm16EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore6StringELm16EE15reserveCapacityEm
-__ZN7WebCore15jsNodeLocalNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsNodeNamespaceURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12jsNodePrefixEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7Element13virtualPrefixEv
-__ZN7WebCore19jsNodeNOTATION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsNodeCOMMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore36jsNodeDOCUMENT_POSITION_CONTAINED_BYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsNodeENTITY_REFERENCE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsNodeDOCUMENT_FRAGMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsNodeDOCUMENT_POSITION_PRECEDINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsNodeDOCUMENT_TYPE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsNodeATTRIBUTE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore36jsNodeDOCUMENT_POSITION_DISCONNECTEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore47jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsNodeCDATA_SECTION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsNodeDOCUMENT_POSITION_CONTAINSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsNodeDOCUMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17jsNodeENTITY_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsNodePROCESSING_INSTRUCTION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsNodeDOCUMENT_POSITION_FOLLOWINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10JSLocation3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore10JSLocation9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore17setJSLocationHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10JSLocation7setHrefEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore18JSHistoryPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30jsHistoryPrototypeFunctionBackEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9JSHistory9classInfoEv
-__ZN7WebCore7History4backEv
-__ZN7WebCore11FrameLoader25scheduleHistoryNavigationEi
-__ZNK7WebCore11FrameLoader18canGoBackOrForwardEi
-__ZN7WebCore11FrameLoader10historyURLEi
-__ZN7WebCore11FrameLoader15goBackOrForwardEi
-__ZN7WebCore14DocumentLoader18loadFromCachedPageEN3WTF10PassRefPtrINS_10CachedPageEEE
-__ZN7WebCore11CachedFrame23cachedFramePlatformDataEv
-__ZN7WebCore11FrameLoader4openERNS_10CachedPageE
-__ZN7WebCore21HTMLFrameOwnerElement10willRemoveEv
-__ZNK7WebCore21ScriptCachedFrameData9domWindowEv
-__ZN7WebCore5Frame12setDOMWindowEPNS_9DOMWindowE
-__ZN7WebCore10CachedPage7restoreEPNS_4PageE
-__ZN7WebCore11CachedFrame7restoreEPNS_5FrameE
-__ZN7WebCore21ScriptCachedFrameData7restoreEPNS_5FrameE
-__ZN7WebCore12EventHandler17setMousePressNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore22ScriptExecutionContext22resumeActiveDOMObjectsEv
-__ZN7WebCore8Document23documentDidBecomeActiveEv
-__ZN7WebCore9FrameView12setMediaTypeERKNS_6StringE
-__ZN7WebCore11FrameLoader19requestFromDelegateERNS_15ResourceRequestERmRNS_13ResourceErrorE
-__ZN7WebCore11FrameLoader29sendRemainingDelegateMessagesEmRKNS_16ResourceResponseEiRKNS_13ResourceErrorE
-__ZN3JSC16RuntimeObjectImp10invalidateEv
-__ZN7WebCore12EventHandler29passMousePressEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
-__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetEPNS_12RenderWidgetE
-__ZN7WebCore12EventHandler31passMouseReleaseEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
-__ZNK7WebCore16HTMLInputElement17isActivatedSubmitEv
-__ZN7WebCore11FrameLoader15recordFormValueERKNS_6StringES3_
--[DOMDocument URL]
-__ZNK7WebCore6Chrome5focusEv
-__ZN7WebCore14ResourceHandle12releaseProxyEv
-__ZNK7WebCore14ResourceHandle10connectionEv
-__ZNK7WebCore18MainResourceLoader32interruptionForPolicyChangeErrorEv
-__ZN7WebCore11FrameLoader32interruptionForPolicyChangeErrorERKNS_15ResourceRequestE
-__ZN7WebCore15StringTruncator5widthERKNS_6StringERKNS_4FontEb
-__ZNK7WebCore11HistoryItem17childItemWithNameERKNS_6StringE
-__ZNK7WebCore11HistoryItem6targetEv
-__ZN7WebCore11FrameLoader25setProvisionalHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
-__ZN7WebCore11FrameLoader13frameDetachedEv
-__ZN7WebCore12RenderObject32handleDynamicFloatPositionChangeEv
-__ZN7WebCore17HTMLSelectElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore22HTMLFormControlElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore25jsHTMLFormElementElementsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10StringImpl7replaceEjjPS0_
-__ZN7WebCore27setJSHTMLBodyElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30setJSHTMLTableCellElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement8setAlignERKNS_6StringE
-__ZNK7WebCore10RenderText22containsOnlyWhitespaceEjj
-__ZNK7WebCore5Color5lightEv
-__ZN7WebCore17differenceSquaredERKNS_5ColorES2_
-__ZN7WebCore24jsHTMLOptionElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17HTMLSelectElement11removeChildEPNS_4NodeERi
-__ZN7WebCoreL17resizerCornerRectEPKNS_11RenderLayerERKNS_7IntRectE
-__ZN7WebCoreL10cornerRectEPKNS_11RenderLayerERKNS_7IntRectE
-__ZN7WebCore15JSKeyboardEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSKeyboardEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31SearchFieldResultsButtonElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCoreL15baseConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLBaseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15HTMLBaseElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLBaseElement7processEv
-__ZNK7WebCore15HTMLBaseElement17endTagRequirementEv
-__ZNK7WebCore15HTMLBaseElement11tagPriorityEv
-__ZN7WebCore15HTMLBaseElement20insertedIntoDocumentEv
-__ZN7WebCore8Document17setBaseElementURLERKNS_4KURLE
-__ZN7WebCore27setJSHTMLImageElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement9setUseMapERKNS_6StringE
-__ZN7WebCore35jsHTMLElementPrototypeFunctionFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore14RenderFieldset10isFieldsetEv
-__ZN7WebCore13AXObjectCache29handleFocusedUIElementChangedEv
-__ZN7WebCore16HTMLInputElement21updateFocusAppearanceEb
-__ZN7WebCore12InputElement21updateFocusAppearanceERNS_16InputElementDataEPNS_8DocumentEb
-__ZThn72_N7WebCore16HTMLInputElement6selectEv
-__ZN7WebCore16HTMLInputElement6selectEv
-__ZN7WebCore17RenderTextControl6selectEv
-__ZN7WebCore17RenderTextControl17setSelectionRangeEii
-__ZN7WebCore17RenderTextControl23visiblePositionForIndexEi
-__ZN7WebCore25jsEventTargetNodeOnsubmitEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode8onsubmitEv
-__ZN7WebCoreL28createHTMLAreaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLAreaElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSHTMLAreaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLAreaElementEEE
-__ZN7WebCore17JSHTMLAreaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSHTMLAreaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZNK7WebCore17JSHTMLAreaElement9classInfoEv
-__ZN7WebCore22jsHTMLInputElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore6Editor10insertTextERKNS_6StringEPNS_5EventE
-__ZN7WebCore12EventHandler28defaultTextInputEventHandlerEPNS_9TextEventE
-__ZN7WebCore6Editor33insertTextWithoutSendingTextEventERKNS_6StringEbPNS_5EventE
-__ZNK7WebCore6Editor16shouldInsertTextERKNS_6StringEPNS_5RangeENS_18EditorInsertActionE
-__ZN7WebCore13TypingCommand10insertTextEPNS_8DocumentERKNS_6StringERKNS_9SelectionEbb
-__ZN7WebCore13TypingCommandC1EPNS_8DocumentENS0_14ETypingCommandERKNS_6StringEbNS_15TextGranularityEb
-__ZNK7WebCore13TypingCommand13editingActionEv
-__ZN7WebCore13TypingCommand7doApplyEv
-__ZN7WebCore13TypingCommand10insertTextERKNS_6StringEb
-__ZN7WebCore13TypingCommand28insertTextRunWithoutNewlinesERKNS_6StringEb
-__ZN7WebCore17InsertTextCommandC1EPNS_8DocumentE
-__ZN7WebCore17InsertTextCommand7doApplyEv
-__ZN7WebCore17InsertTextCommand5inputERKNS_6StringEb
-__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextERKNS_8PositionES3_
-__ZN7WebCore17InsertTextCommand23prepareForTextInsertionERKNS_8PositionE
-__ZN7WebCore8Document21createEditingTextNodeERKNS_6StringE
-__ZN7WebCore11EditingTextC1EPNS_8DocumentERKNS_6StringE
-__ZN7WebCore11EditingText16rendererIsNeededEPNS_11RenderStyleE
-__ZNK7WebCore25AccessibilityRenderObject27isAccessibilityRenderObjectEv
-__ZN7WebCore9RenderBox14localCaretRectEPNS_9InlineBoxEiPi
-__ZN7WebCore20CompositeEditCommand19removePlaceholderAtERKNS_15VisiblePositionE
-__ZN7WebCore12isEndOfBlockERKNS_15VisiblePositionE
-__ZN7WebCore10endOfBlockERKNS_15VisiblePositionE
-__ZN7WebCore25lineBreakExistsAtPositionERKNS_15VisiblePositionE
-__ZNK7WebCore15VisiblePosition14characterAfterEv
-__ZN7WebCore20CompositeEditCommand18insertTextIntoNodeEN3WTF10PassRefPtrINS_4TextEEEjRKNS_6StringE
-__ZN7WebCore25InsertIntoTextNodeCommandC1EN3WTF10PassRefPtrINS_4TextEEEjRKNS_6StringE
-__ZN7WebCore25InsertIntoTextNodeCommand7doApplyEv
-__ZN7WebCore13CharacterData10insertDataEjRKNS_6StringERi
-__ZN7WebCore13CharacterData22checkCharDataOperationEjRi
-__ZN7WebCore6String6insertERKS0_j
-__ZN7WebCore6String6insertEPKtjj
-__ZN7WebCore10RenderText17setTextWithOffsetEN3WTF10PassRefPtrINS_10StringImplEEEjjb
-__ZN7WebCore8Document12textInsertedEPNS_4NodeEjj
-__ZN7WebCore5Range12textInsertedEPNS_4NodeEjj
-__ZN7WebCore9Selection20setWithoutValidationERKNS_8PositionES3_
-__ZN7WebCore13TypingCommand24typingAddedToOpenCommandEv
-__ZN7WebCore13TypingCommand27markMisspellingsAfterTypingEv
-__ZN7WebCore31SimplifiedBackwardsTextIterator8exitNodeEv
-__ZN7WebCore31SimplifiedBackwardsTextIterator13emitCharacterEtPNS_4NodeEii
--[DOMHTMLInputElement(FormPromptAdditions) _isEdited]
-__ZNK7WebCore13TypingCommand20preservesTypingStyleEv
-__ZNK7WebCore13TypingCommand15isTypingCommandEv
-__ZNK7WebCore17InsertTextCommand19isInsertTextCommandEv
-__ZN7WebCore15EventTargetNode22dispatchSimulatedClickEN3WTF10PassRefPtrINS_5EventEEEbb
-__ZN3WTF7HashSetIPN7WebCore15EventTargetNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore15EventTargetNodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore15EventTargetNode27dispatchSimulatedMouseEventERKNS_12AtomicStringEN3WTF10PassRefPtrINS_5EventEEE
-__ZN7WebCore23jsHTMLFormElementActionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZL20jsDOMWindowBaseEventPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore21jsHTMLFormElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLFormElement4nameEv
-__ZNK7WebCore22HTMLFormControlElement17isActivatedSubmitEv
-__ZNK7WebCore22HTMLFormControlElement24isSuccessfulSubmitButtonEv
-__ZNK7WebCore8FormData15flattenToStringEv
-__ZNK7WebCore8FormData7flattenERN3WTF6VectorIcLm0EEE
-__ZN7WebCore4KURL8setQueryERKNS_6StringE
-__ZN3WTF9HashTableIPN7WebCore15EventTargetNodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore26setJSHTMLScriptElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLScriptElement7setTypeERKNS_6StringE
-__ZN7WebCore27setJSHTMLScriptElementDeferEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLScriptElement8setDeferEb
-__ZN7WebCore12CachedScript5errorEv
-__ZN7WebCore16HTMLInputElement13aboutToUnloadEv
-__ZN7WebCore12InputElement13aboutToUnloadERNS_16InputElementDataEPNS_8DocumentE
-__ZN7WebCore13TypingCommandD1Ev
-__ZN7WebCore17JSHTMLAreaElementD0Ev
-__ZN7WebCore12InputElement20updateSelectionRangeERNS_16InputElementDataEii
-__ZN7WebCore12EventHandler22passWheelEventToWidgetERNS_18PlatformWheelEventEPNS_6WidgetE
-__ZN7WebCore9CSSParser17createCharsetRuleERKNS_15CSSParserStringE
-__ZN7WebCore14CSSCharsetRuleC1EPNS_13CSSStyleSheetERKNS_6StringE
-__ZN7WebCore9StyleBase11isMediaRuleEv
-__ZN7WebCore9StyleBase14isFontFaceRuleEv
-__ZN7WebCore9StyleBase15isVariablesRuleEv
-__ZN7WebCore9StyleBase15isKeyframesRuleEv
-__ZN7WebCoreL38min_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL34device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCore12compareValueIfEEbT_S1_NS_18MediaFeaturePrefixE
-__ZN7WebCore12RenderButton28removeLeftoverAnonymousBlockEPNS_11RenderBlockE
-__ZN7WebCore15JSMimeTypeArray18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZN7WebCore15JSMimeTypeArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore13MimeTypeArray4itemEj
-__ZN7WebCore8MimeTypeC1EN3WTF10PassRefPtrINS_10PluginDataEEEj
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8MimeTypeE
-__ZN7WebCore10JSMimeType15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore10JSMimeTypeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8MimeTypeEEE
-__ZN7WebCore10JSMimeType18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18jsMimeTypeSuffixesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8MimeType8suffixesEv
-__ZN7WebCore8MimeTypeD1Ev
-__ZN7WebCore26setJSHTMLScriptElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLScriptElement7setTextERKNS_6StringE
-__ZN7WebCore11RenderBlock26addPercentHeightDescendantEPNS_9RenderBoxE
-__ZN3WTF7HashMapIPKN7WebCore11RenderBlockEPNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_IS4_EENSA_ISD_EEE4takeERKS4_
-__ZN3WTF9HashTableIPKN7WebCore11RenderBlockESt4pairIS4_PNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEEENS_18PairFirstExtractorISF_EENS9_IS4_EENS_14PairHashTraitsINSB_IS4_EENSB_ISE_EEEESK_E6expandEv
-__ZN3WTF7HashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_IS4_EENSA_ISD_EEE4takeERKS4_
-__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_PNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEEENS_18PairFirstExtractorISF_EENS9_IS4_EENS_14PairHashTraitsINSB_IS4_EENSB_ISE_EEEESK_E6expandEv
-__ZN3WTF7HashSetIPN7WebCore11RenderBlockENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN3WTF9HashTableIPKN7WebCore11RenderBlockESt4pairIS4_PNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEEENS_18PairFirstExtractorISF_EENS9_IS4_EENS_14PairHashTraitsINSB_IS4_EENSB_ISE_EEEESK_E4findIS4_NS_22IdentityHashTranslatorIS4_SF_SI_EEEENS_17HashTableIteratorIS4_SF_SH_SI_SM_SK_EERKT_
-__ZN7WebCore15JSMimeTypeArray18canGetItemsForNameEPN3JSC9ExecStateEPNS_13MimeTypeArrayERKNS1_10IdentifierE
-__ZN7WebCore13MimeTypeArray18canGetItemsForNameERKNS_12AtomicStringE
-__ZN7WebCore15JSMimeTypeArray10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore13MimeTypeArray9namedItemERKNS_12AtomicStringE
-__ZN7WebCore23jsMimeTypeEnabledPluginEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8MimeType13enabledPluginEv
-__ZN7WebCore19jsDOMWindowDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_PNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEEENS_18PairFirstExtractorISF_EENS9_IS4_EENS_14PairHashTraitsINSB_IS4_EENSB_ISE_EEEESK_E4findIS4_NS_22IdentityHashTranslatorIS4_SF_SI_EEEENS_17HashTableIteratorIS4_SF_SH_SI_SM_SK_EERKT_
-__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore19JSMimeTypePrototypeD0Ev
-__ZN7WebCore11RenderLayer25dirtyVisibleContentStatusEv
-__ZN7WebCore21jsHTMLInputElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement3srcEv
-__ZN7WebCore34jsHTMLElementPrototypeFunctionBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Element4blurEv
-__ZN7WebCore17setJSLocationHashEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10JSLocation7setHashEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore21setJSEventReturnValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZNK7WebCore12RenderInline11offsetWidthEv
-__ZNK7WebCore12RenderInline12offsetHeightEv
-__ZN7WebCore22AccessibilityTableCell6createEPNS_12RenderObjectE
-__ZN7WebCore22AccessibilityTableCellC1EPNS_12RenderObjectE
-__ZN7WebCore21AccessibilityTableRow6createEPNS_12RenderObjectE
-__ZN7WebCore21AccessibilityTableRowC1EPNS_12RenderObjectE
-__ZN7WebCore18AccessibilityTable6createEPNS_12RenderObjectE
-__ZN7WebCore18AccessibilityTableC1EPNS_12RenderObjectE
+__ZN7WebCore36jsNodePrototypeFunctionHasChildNodesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21JSHTMLTableColElementD1Ev
+__ZN7WebCore9JSElementD1Ev
+__ZN7WebCore10JSDocumentD1Ev
+__ZN7WebCore7ElementD0Ev
+__ZN7WebCore12NamedNodeMapD0Ev
+__ZN7WebCore9AttributeD0Ev
+__ZN7WebCore17HTMLButtonElement19defaultEventHandlerEPNS_5EventE
 __ZN7WebCoreL21executeDeleteBackwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor19deleteWithDirectionENS_19SelectionController10EDirectionENS_15TextGranularityEbb
+__ZN7WebCore6Editor20canSmartCopyOrDeleteEv
 __ZN7WebCore13TypingCommand16deleteKeyPressedEPNS_8DocumentEbNS_15TextGranularityEb
 __ZN7WebCore13TypingCommand16deleteKeyPressedENS_15TextGranularityEb
 __ZN7WebCore20CompositeEditCommand39breakOutOfEmptyMailBlockquotedParagraphEv
 __ZN7WebCore26highestEnclosingNodeOfTypeERKNS_8PositionEPFbPKNS_4NodeEE
 __ZN7WebCore19SelectionController6modifyENS0_11EAlterationENS0_10EDirectionENS_15TextGranularityEb
 __ZN7WebCore19SelectionController14willBeModifiedENS0_11EAlterationENS0_10EDirectionE
-__ZN7WebCore9Selection7setBaseERKNS_8PositionE
-__ZN7WebCore9Selection9setExtentERKNS_8PositionE
-__ZN7WebCore19SelectionController27modifyExtendingLeftBackwardENS_15TextGranularityE
+__ZN7WebCore16VisibleSelection7setBaseERKNS_8PositionE
+__ZN7WebCore16VisibleSelection9setExtentERKNS_8PositionE
+__ZN7WebCore19SelectionController23modifyExtendingBackwardENS_15TextGranularityE
+__ZNK7WebCore15VisiblePosition31honorEditableBoundaryAtOrBeforeERKS0_
 __ZN7WebCore19SelectionController30xPosForVerticalArrowNavigationENS0_13EPositionTypeE
 __ZNK7WebCore15VisiblePosition28xOffsetForVerticalNavigationEv
 __ZN7WebCore19SelectionController9setExtentERKNS_15VisiblePositionEb
-__ZNK7WebCore5Frame21shouldDeleteSelectionERKNS_9SelectionE
-__ZN7WebCore20CompositeEditCommand15deleteSelectionERKNS_9SelectionEbbbb
-__ZN7WebCore22DeleteSelectionCommandC1ERKNS_9SelectionEbbbb
+__ZN7WebCore16VisibleSelectionC1ERKNS_8PositionES3_NS_9EAffinityE
+__ZN7WebCore16VisibleSelectionC2ERKNS_8PositionES3_NS_9EAffinityE
+__ZN7WebCore25isFirstPositionAfterTableERKNS_15VisiblePositionE
+__ZNK7WebCore5Frame21shouldDeleteSelectionERKNS_16VisibleSelectionE
+__ZN7WebCore20CompositeEditCommand15deleteSelectionERKNS_16VisibleSelectionEbbbb
+__ZN7WebCore22DeleteSelectionCommandC1ERKNS_16VisibleSelectionEbbbb
+__ZN7WebCore22DeleteSelectionCommandC2ERKNS_16VisibleSelectionEbbbb
 __ZN7WebCore22DeleteSelectionCommand7doApplyEv
 __ZN7WebCore5Frame28textWillBeDeletedInTextFieldEPNS_7ElementE
 __ZN7WebCore22DeleteSelectionCommand22initializePositionDataEv
@@ -9115,6 +10882,7 @@
 __ZN7WebCore27numEnclosingMailBlockquotesERKNS_8PositionE
 __ZNK7WebCore8Position25leadingWhitespacePositionENS_9EAffinityEb
 __ZNK7WebCore8Position25previousCharacterPositionENS_9EAffinityE
+__ZN7WebCore13isStartOfLineERKNS_15VisiblePositionE
 __ZNK7WebCore8Position26rendersInDifferentPositionERKS0_
 __ZNK7WebCore8Position14renderedOffsetEv
 __ZNK7WebCore4Node12nextEditableEv
@@ -9133,1014 +10901,2097 @@
 __ZN7WebCoreL28updatePositionForTextRemovalEPNS_4NodeEiiRNS_8PositionE
 __ZN7WebCore20CompositeEditCommand18deleteTextFromNodeEN3WTF10PassRefPtrINS_4TextEEEjj
 __ZN7WebCore25DeleteFromTextNodeCommandC1EN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCore25DeleteFromTextNodeCommandC2EN3WTF10PassRefPtrINS_4TextEEEjj
 __ZN7WebCore25DeleteFromTextNodeCommand7doApplyEv
 __ZN7WebCore13CharacterData13substringDataEjjRi
-__ZN7WebCore13CharacterData10deleteDataEjjRi
-__ZN7WebCore5Range11textRemovedEPNS_4NodeEjj
 __ZN7WebCore22DeleteSelectionCommand15fixupWhitespaceEv
 __ZN7WebCore22DeleteSelectionCommand15mergeParagraphsEv
 __ZN7WebCore22DeleteSelectionCommand38removePreviouslySelectedEmptyTableRowsEv
 __ZN7WebCore22DeleteSelectionCommand31calculateTypingStyleAfterDeleteEv
 __ZN7WebCore22DeleteSelectionCommand19clearTransientStateEv
+__ZN7WebCore6Editor36revealSelectionAfterEditingOperationEv
 __ZNK7WebCore11EditCommand19isInsertTextCommandEv
-__ZN7WebCore12EventHandler22defaultTabEventHandlerEPNS_13KeyboardEventE
-__ZN7WebCore15FocusController12advanceFocusENS_14FocusDirectionEPNS_13KeyboardEventEb
-__ZN7WebCore8Document17nextFocusableNodeEPNS_4NodeEPNS_13KeyboardEventE
-__ZNK7WebCore22HTMLFormControlElement8tabIndexEv
-__ZNK7WebCore4Node8tabIndexEv
-__ZN7WebCoreL25nextNodeWithExactTabIndexEPNS_4NodeEiPNS_13KeyboardEventE
-__ZNK7WebCore4Node19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore16HTMLLabelElement11isFocusableEv
-__ZNK7WebCore16HTMLInputElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZN7WebCoreL17deepFocusableNodeENS_14FocusDirectionEPNS_4NodeEPNS_13KeyboardEventE
-__ZNK7WebCore4Node19isFrameOwnerElementEv
-__ZN7WebCore12TextIterator8subrangeEPNS_5RangeEii
-__ZN7WebCore8Document35setUseSecureKeyboardEntryWhenActiveEb
-__ZN7WebCore5Frame33updateSecureKeyboardEntryIfActiveEv
-__ZN7WebCore21PlatformKeyboardEvent20currentCapsLockStateEv
-__ZN7WebCore13InlineTextBox28paintSpellingOrGrammarMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleERKNS_4FontEb
-__ZN7WebCore15GraphicsContext34drawLineForMisspellingOrBadGrammarERKNS_8IntPointEib
-__ZN7WebCoreL18createPatternColorEP8NSStringP7NSColorRb
-__ZNK7WebCore8IntPointcv7CGPointEv
-__ZN7WebCore10StringImpl6secureEt
-__ZNK3WTF9HashTableIPN7WebCore15EventTargetNodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEEbRKT_
-__ZN7WebCore25DeleteFromTextNodeCommandD1Ev
-__ZN7WebCore18AccessibilityTable13clearChildrenEv
-__ZN7WebCore18AccessibilityTableD1Ev
-__ZN7WebCore21AccessibilityTableRowD1Ev
-__ZN7WebCore6Editor37markMisspellingsAfterTypingToPositionERKNS_15VisiblePositionE
-__ZN7WebCore33jsDOMWindowPrototypeFunctionFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZNK7WebCore22HTMLFormControlElement17isActivatedSubmitEv
+__ZNK7WebCore22HTMLFormControlElement24isSuccessfulSubmitButtonEv
+__ZNK7WebCore17HTMLButtonElement17isActivatedSubmitEv
+__ZNK7WebCore17HTMLButtonElement24isSuccessfulSubmitButtonEv
+__ZN7WebCore17HTMLButtonElement18setActivatedSubmitEb
+__ZN7WebCore22HTMLFormControlElement14appendFormDataERNS_12FormDataListEb
+__ZN7WebCore17HTMLButtonElement14appendFormDataERNS_12FormDataListEb
+__ZNK7WebCore8FormData15flattenToStringEv
+__ZNK7WebCore8FormData7flattenERN3WTF6VectorIcLm0EEE
+__ZN7WebCore4KURL8setQueryERKNS_6StringE
+__ZN7WebCore14RenderTableColD0Ev
+__ZN7WebCore22DeleteSelectionCommandD0Ev
+__ZN7WebCore25DeleteFromTextNodeCommandD0Ev
+__ZN7WebCore15RenderWordBreakC1EPNS_11HTMLElementE
+__ZN7WebCore15RenderWordBreakC2EPNS_11HTMLElementE
+__ZN7WebCore15RenderWordBreakD0Ev
+__ZN7WebCore39jsHTMLFormElementPrototypeFunctionResetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15HTMLFormElement5resetEv
+__ZN7WebCore16HTMLInputElement5resetEv
+__ZNK7WebCore15RenderWordBreak11isWordBreakEv
+__ZN7WebCore22jsHTMLInputElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24setJSHTMLElementTabIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement11setTabIndexEi
+__ZN7WebCore23jsHTMLFormElementLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLTableColElementPrototypeD1Ev
+__ZN7WebCore19HTMLTableColElementD0Ev
+__ZN7WebCore22jsNavigatorAppCodeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase11appCodeNameEv
+__ZN7WebCore25setJSHTMLInputElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement7setTypeERKNS_6StringE
+__ZN7WebCore25setJSHTMLInputElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement7setNameERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAnchorElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement7setNameERKNS_12AtomicStringE
+__ZN7WebCore35jsHTMLDocumentPrototypeFunctionOpenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSHTMLDocument4openEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL23MainGradientInterpolateEPvPKfPf
+__ZN7WebCoreL22TopGradientInterpolateEPvPKfPf
+__ZN7WebCoreL25BottomGradientInterpolateEPvPKfPf
+__ZN7WebCore21jsHTMLDocumentScriptsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7scriptsEv
+__ZN7WebCore16JSHTMLCollection11getCallDataERN3JSC8CallDataE
+__ZN7WebCore17jsDocumentCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSHTMLHRElementPrototypeD1Ev
+__ZN7WebCore27jsHTMLAnchorElementPathnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8pathnameEv
+__ZN7WebCore9FrameView18setUseSlowRepaintsEv
+__ZL15deallocCallbackPv
+__ZN7WebCore17jsDOMWindowClosedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6closedEv
+__ZN7WebCore33jsDOMWindowPrototypeFunctionFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore9DOMWindow5focusEv
 __ZN7WebCore5Frame11focusWindowEv
-__ZSt21__inplace_stable_sortIPPN7WebCore11RenderLayerEPFbS2_S2_EEvT_S6_T0_
-__ZN7WebCore15RenderContainer22positionForCoordinatesEii
-__ZN7WebCore17positionAfterNodeEPKNS_4NodeE
-__ZN7WebCore12EventHandler15hoverTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore22setJSElementScrollLeftEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore7Element13setScrollLeftEi
-__ZN7WebCore9RenderBox13setScrollLeftEi
-__ZN7WebCore15RenderWordBreakC1EPNS_11HTMLElementE
-__ZNK7WebCore15RenderWordBreak11isWordBreakEv
-__ZN7WebCore22reportCurrentExceptionEPN3JSC9ExecStateE
-__ZNK7WebCore11RenderTable25getBaselineOfFirstLineBoxEv
-__ZNK7WebCore18RenderTableSection25getBaselineOfFirstLineBoxEv
-__ZN7WebCore16StyleCachedImage8cssValueEv
-__ZNK7WebCore26NetscapePlugInStreamLoader6isDoneEv
-__ZN7WebCore29setJSEventTargetNodeOnmouseupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode12setOnmouseupEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCoreL16quoteConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLQuoteElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16HTMLQuoteElement17endTagRequirementEv
-__ZNK7WebCore16HTMLQuoteElement11tagPriorityEv
-__ZNK7WebCore12RenderInline20isInlineContinuationEv
-__ZN7WebCore15HTMLBaseElement19removedFromDocumentEv
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE15reserveCapacityEm
-__ZN7WebCore10moveCursorEv
-__ZN7WebCore22jsDOMWindowPageYOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7scrollYEv
-__ZN7WebCore16HTMLQuoteElementD1Ev
-__ZN7WebCore16JSHTMLCollection11getCallDataERN3JSC8CallDataE
-__ZN7WebCore44jsHTMLAnchorElementPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore17HTMLAnchorElement8toStringEv
-__ZN7WebCore22jsHTMLParamElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLParamElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17jsDocumentCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLButtonElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore27setJSHTMLButtonElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLButtonElement8setValueERKNS_6StringE
-__ZN7WebCore26setJSHTMLButtonElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29jsHTMLUListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLUListElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLUListElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore29JSHTMLUListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLUListElementConstructor9classInfoEv
-__ZN7WebCoreL19tableColConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLTableColElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore19HTMLTableColElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore19HTMLTableColElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore19HTMLTableColElement17endTagRequirementEv
-__ZNK7WebCore19HTMLTableColElement11tagPriorityEv
-__ZNK7WebCore19HTMLTableColElement36canHaveAdditionalAttributeStyleDeclsEv
-__ZN7WebCore19HTMLTableColElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore14RenderTableColC1EPNS_4NodeE
-__ZN7WebCore14RenderTableCol17updateFromElementEv
-__ZNK7WebCore14RenderTableCol13requiresLayerEv
-__ZNK7WebCore14RenderTableCol10isTableColEv
+__ZN7WebCore28jsHTMLBodyElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLBodyElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLBodyElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17jsNodeOnmouseoverEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node11onmouseoverEv
+__ZN7WebCore13jsNodeOnfocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onfocusEv
+__ZN7WebCore29jsHTMLTableElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLTableElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLTableElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore5Color5lightEv
+__ZN7WebCore17differenceSquaredERKNS_5ColorES2_
+__ZN7WebCore19HTMLTextAreaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore26RenderTextControlMultiLineC1EPNS_4NodeE
+__ZN7WebCore26RenderTextControlMultiLineC2EPNS_4NodeE
+__ZN7WebCore26RenderTextControlMultiLine17updateFromElementEv
+__ZNK7WebCore26RenderTextControlMultiLine20createInnerTextStyleEPKNS_11RenderStyleE
+__ZNK7WebCore26RenderTextControlMultiLine10isTextAreaEv
+__ZN7WebCore26RenderTextControlMultiLine36adjustControlHeightBasedOnLineHeightEi
+__ZNK7WebCore17RenderTextControl14hasControlClipEv
+__ZNK7WebCore26RenderTextControlMultiLine16baselinePositionEbb
+__ZN7WebCoreL17resizerCornerRectEPKNS_11RenderLayerERKNS_7IntRectE
+__ZN7WebCore26RenderTextControlMultiLineD0Ev
+__ZN7WebCore19HTMLTextAreaElement23rendererWillBeDestroyedEv
+__ZN7WebCore28JSHTMLBodyElementConstructorD1Ev
+__ZN7WebCore29JSHTMLTableElementConstructorD1Ev
+__ZNK7WebCore15PurgeableBuffer9wasPurgedEv
+__ZN7WebCore16LegacyWebArchive6createEPNS_12SharedBufferE
+__ZN7WebCore16LegacyWebArchive7extractEPK14__CFDictionary
+__ZN7WebCore16LegacyWebArchive14createResourceEPK14__CFDictionary
+__ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceRespons
+__ZN7WebCore15ArchiveResourceC1EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceResponseE
+__ZN7WebCore15ArchiveResourceC2EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceResponseE
+__ZN7WebCore16LegacyWebArchive42createResourceResponseFromPropertyListDataEPK8__CFDataPK10__CFString
+__ZN7WebCore16LegacyWebArchive41createResourceResponseFromMacArchivedDataEPK8__CFData
+__ZNK7WebCore20ResourceResponseBase17suggestedFilenameEv
+__ZN3WTF7HashMapIN7WebCore24FontPlatformDataCacheKeyEPNS1_16FontPlatformDataENS1_28FontPlatformDataCacheKeyHashENS1_30FontPlatf
+__ZN3WTF6VectorIN7WebCore24FontPlatformDataCacheKeyELm0EE6shrinkEm
+__ZN7WebCore29jsHTMLInputElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14XMLHttpRequest16getRequestHeaderERKNS_12AtomicStringE
+__ZN7WebCore8FormData6createERKNS_7CStringE
+__ZN7WebCore17SubresourceLoader11didSendDataEyy
+__ZThn16_N7WebCore24DocumentThreadableLoader11didSendDataEPNS_17SubresourceLoaderEyy
+__ZN7WebCore24DocumentThreadableLoader11didSendDataEPNS_17SubresourceLoaderEyy
+__ZThn16_N7WebCore14XMLHttpRequest11didSendDataEyy
+__ZN7WebCore14XMLHttpRequest11didSendDataEyy
+__ZThn24_N7WebCore14XMLHttpRequest4stopEv
+__ZN7WebCore27setJSHTMLImageElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setUseMapERKNS_6StringE
+__ZThn8_N7WebCore15HTMLLinkElementD0Ev
+__ZN7WebCore14jsNodeOnsubmitEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onsubmitEv
+__ZNK7WebCore17JSHTMLAreaElement9classInfoEv
+__ZN7WebCoreL32createHTMLFieldSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLFieldSetElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLFieldSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFieldSetElementEEE
+__ZN7WebCore21JSHTMLFieldSetElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFieldSetElementEEE
+__ZN7WebCore21JSHTMLFieldSetElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSHTMLFieldSetElement9classInfoEv
+__ZN7WebCore20jsDOMWindowStatusbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9statusbarEv
+__ZN7WebCore7BarInfoC1EPNS_5FrameENS0_4TypeE
+__ZN7WebCore7BarInfoC2EPNS_5FrameENS0_4TypeE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7BarInfoE
+__ZN7WebCore9JSBarInfo15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSBarInfoC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7BarInfoEEE
+__ZN7WebCore9JSBarInfoC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7BarInfoEEE
+__ZN7WebCore9JSBarInfo18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsBarInfoVisibleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7BarInfo7visibleEv
+__ZNK7WebCore6Chrome16statusbarVisibleEv
+__ZNK7WebCore15HTMLFormElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore21JSHTMLFieldSetElementD1Ev
+__ZN7WebCore30JSHTMLFieldSetElementPrototypeD1Ev
+__ZN7WebCore12InputElement20updateSelectionRangeERNS_16InputElementDataEii
+__ZN7WebCore21setJSElementScrollTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore7Element12setScrollTopEi
+__ZN7WebCore9RenderBox12setScrollTopEi
+__ZN7WebCore8Document29removeStyleSheetCandidateNodeEPNS_4NodeE
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
+__ZThn8_N7WebCore16HTMLStyleElementD0Ev
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm16EE6shrinkEm
+__ZN7WebCore28setJSHTMLLabelElementHtmlForEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLLabelElement10setHtmlForERKNS_6StringE
+__ZN7WebCore7BarInfo15disconnectFrameEv
+__ZNK7WebCore12RenderButton14hasLineIfEmptyEv
+__ZNK7WebCore22HTMLFormControlElement11virtualFormEv
+__ZN7WebCore9JSBarInfoD1Ev
+__ZN7WebCore9JSBarInfoD2Ev
+__ZN7WebCore18JSBarInfoPrototypeD1Ev
+__ZThn8_N7WebCore17HTMLIFrameElementD0Ev
+__ZThn8_N7WebCore17HTMLScriptElementD0Ev
+__ZThn8_N7WebCore16HTMLLabelElementD0Ev
+__ZN7WebCore26setJSHTMLEmbedElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLPlugInElement8setWidthERKNS_6StringE
+__ZN7WebCore27setJSHTMLEmbedElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLPlugInElement9setHeightERKNS_6StringE
+__ZN7WebCore9CSSParser10parseShapeEib
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4RectEEE
+__ZN7WebCore11RenderStyle7setClipENS_6LengthES1_S1_S1_
+__ZN7WebCore9RenderBox8clipRectEii
+__ZN7WebCore9RenderBox13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore23jsHTMLFormElementMethodEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFormElement6methodEv
+__ZN7WebCore25jsHTMLFormElementElementsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsHTMLInputElementSelectionStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSHTMLInputElement14selectionStartEPN3JSC9ExecStateE
+__ZNK7WebCore16HTMLInputElement16canHaveSelectionEv
+__ZNK7WebCore16HTMLInputElement14selectionStartEv
+__ZN7WebCore30jsHTMLInputElementSelectionEndEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSHTMLInputElement12selectionEndEPN3JSC9ExecStateE
+__ZNK7WebCore16HTMLInputElement12selectionEndEv
+__ZN7WebCore32setJSHTMLTableElementCellPaddingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement14setCellPaddingERKNS_6StringE
+__ZN7WebCore32setJSHTMLTableElementCellSpacingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement14setCellSpacingERKNS_6StringE
+__ZN7WebCore11RenderBlock28removeLeftoverAnonymousBlockEPS0_
+__ZN7WebCore24JSCSSStyleSheetPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSCSSStyleSheet9classInfoEv
+__ZN7WebCore29setJSHTMLInputElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore17ScrollbarThemeMac20supportsControlTintsEv
+__ZThn8_N7WebCore17HTMLButtonElementD0Ev
+__ZN7WebCore15jsNodeOnkeydownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node9onkeydownEv
+__ZN7WebCore16jsNodeOnkeypressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node10onkeypressEv
+__ZN7WebCore41jsHTMLInputElementPrototypeFunctionSelectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore25jsHTMLTableElementTBodiesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore16HTMLTableElement7tBodiesEv
-__ZN7WebCore29jsHTMLTableSectionElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23HTMLTableSectionElement4rowsEv
-__ZN7WebCore17HTMLButtonElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore14RenderTableColD1Ev
-__ZN7WebCore24jsHTMLButtonElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLButtonElement5valueEv
-__ZNK7WebCore17HTMLButtonElement17canStartSelectionEv
-__ZN7WebCore23jsHTMLButtonElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLButtonElement4typeEv
-__ZN7WebCore23jsHTMLButtonElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLButtonElement17isActivatedSubmitEv
-__ZN7WebCore17HTMLButtonElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore25jsHTMLSelectElementLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLSelectElement6lengthEv
-__ZN7WebCore28setJSHTMLTextAreaElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30JSHTMLTextAreaElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21JSHTMLTextAreaElement9classInfoEv
-__ZN7WebCore24setJSHTMLElementTabIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11HTMLElement11setTabIndexEi
-__ZNK7WebCore17RenderTextControl12scrollHeightEv
-__ZNK7WebCore19HTMLTextAreaElement14isEnumeratableEv
+__ZN7WebCore38jsXMLHttpRequestPrototypeFunctionAbortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14XMLHttpRequest5abortEv
+__ZN7WebCore14XMLHttpRequest18dispatchAbortEventEv
+__ZN7WebCoreL17reportUnsafeUsageEPNS_22ScriptExecutionContextERKNS_6StringE
+__ZN7WebCore15getDOMStructureINS_15JSKeyboardEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore15JSKeyboardEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSKeyboardEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13KeyboardEventEEE
+__ZN7WebCore15JSKeyboardEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13KeyboardEventEEE
+__ZN7WebCore15JSKeyboardEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13KeyboardEvent7keyCodeEv
+__ZN7WebCore23jsKeyboardEventShiftKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsNodeOnblurEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node6onblurEv
+__ZThn128_N7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
+__ZThn128_NK7WebCore16HTMLInputElement30searchEventsShouldBeDispatchedEv
+__ZN7WebCore17jsClientRectRightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsClientRectBottomEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn16_N7WebCore24DocumentThreadableLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore24DocumentThreadableLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZThn16_N7WebCore14XMLHttpRequest7didFailERKNS_13ResourceErrorE
+__ZN7WebCore14XMLHttpRequest7didFailERKNS_13ResourceErrorE
+__ZN7WebCore14XMLHttpRequest10abortErrorEv
+__ZN7WebCore14XMLHttpRequest12genericErrorEv
+__ZN7WebCore24DocumentThreadableLoader6cancelEv
+__ZThn8_N7WebCore11EditingTextD0Ev
+__ZN7WebCore15JSKeyboardEventD1Ev
+__ZN7WebCore27setJSHTMLTableElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement9setBorderERKNS_6StringE
+__ZN7WebCore42jsElementPrototypeFunctionGetAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21jsHTMLElementTabIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement8tabIndexEv
+__ZNK7WebCore4Node13supportsFocusEv
+__ZNK7WebCore4Node8tabIndexEv
+__ZN7WebCore24JSKeyboardEventPrototypeD1Ev
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E5clearEv
+__ZN7WebCore4Page22allVisitedStateChangedEPNS_9PageGroupE
+__ZN7WebCore16CSSStyleSelector15SelectorChecker22allVisitedStateChangedEv
+__ZN7WebCore23ApplicationCacheStorage5emptyEv
+__ZN7WebCore31CrossOriginPreflightResultCache6sharedEv
+__ZN7WebCore31CrossOriginPreflightResultCache5emptyEv
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore35CrossOriginPreflightResultCacheItemEKNS_7HashMapISt4pairINS1_6StringENS1_4KURLEES3_N
+__ZN7WebCore12IconDatabase14removeAllIconsEv
+__ZN7WebCore10IconRecordD1Ev
+__ZN7WebCore10IconRecordD2Ev
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN7WebCore12IconDatabase22removeAllIconsOnThreadEv
+__ZN7WebCore14SQLiteDatabase16runVacuumCommandEv
+__ZN7WebCore4Page14setMediaVolumeEf
+__ZN7WebCore8Document20mediaVolumeDidChangeEv
+__ZNK7WebCore12EventHandler20currentKeyboardEventEv
+__ZN7WebCore15FocusController15setInitialFocusENS_14FocusDirectionEPNS_13KeyboardEventE
+__ZN7WebCore15FocusController12advanceFocusENS_14FocusDirectionEPNS_13KeyboardEventEb
+__ZN7WebCore8Document17nextFocusableNodeEPNS_4NodeEPNS_13KeyboardEventE
+__ZNK7WebCore4Node19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZN7WebCoreL25nextNodeWithExactTabIndexEPNS_4NodeEiPNS_13KeyboardEventE
+__ZN7WebCoreL17deepFocusableNodeENS_14FocusDirectionEPNS_4NodeEPNS_13KeyboardEventE
+__ZN7WebCore8Settings41setUsesDashboardBackwardCompatibilityModeEb
+__ZN7WebCore9FrameTree9clearNameEv
+__ZN7WebCore19InspectorController15disableProfilerEv
+__ZN7WebCore29setUsesTestModeFocusRingColorEb
+-[WebScriptObject JSObject]
+__ZN7WebCore16JSDOMWindowShell17putWithAttributesEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueEj
+-[WebScriptObject setValue:forKey:]
+__ZN3JSC8Bindings23convertObjcValueToValueEPNS_9ExecStateEPvNS0_13ObjcValueTypeEPNS0_10RootObjectE
+__ZN3JSC8Bindings17webUndefinedClassEv
+__ZN3JSC8Bindings20webScriptObjectClassEv
+__ZN3JSC8Bindings12ObjcInstanceC1EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings12ObjcInstanceC2EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZL11_didExecuteP15WebScriptObject
+__ZN3JSC8Bindings8Instance18didExecuteFunctionEv
+__ZN7WebCoreL30updateStyleIfNeededForBindingsEPN3JSC9ExecStateEPNS0_8JSObjectE
+__ZN7WebCore10RenderText17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZNK7WebCore13InlineTextBox10isSelectedEii
+__ZNK7WebCore10RenderText18canBeSelectionLeafEv
+__ZN7WebCore10RenderText23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN7WebCore12RenderObject21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZN7WebCore11RenderBlock23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN7WebCore13AXObjectCache11getOrCreateEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache3getEPNS_12RenderObjectE
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3getERKS3_
+__ZNK7WebCore12RenderObject9isListBoxEv
+__ZN7WebCore13AXObjectCache14nodeIsAriaTypeEPNS_4NodeENS_6StringE
+__ZN7WebCore25AccessibilityRenderObject6createEPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityRenderObjectC1EPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityRenderObjectC2EPNS_12RenderObjectE
+__ZN7WebCore19AccessibilityObjectC2Ev
+__ZN7WebCore25AccessibilityRenderObject11setAriaRoleEv
+__ZNK7WebCore25AccessibilityRenderObject26determineAriaRoleAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject12getAttributeERKNS_13QualifiedNameE
+__ZN7WebCore13AXObjectCache7getAXIDEPNS_19AccessibilityObjectE
+__ZNK7WebCore19AccessibilityObject10axObjectIDEv
+__ZNK3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E8containsIjNS_22IdentityHashTranslatorIjj
+__ZN3WTF7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEE3addERKj
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E6expandEv
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E6rehashEi
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E13allocateTableEi
+__ZN7WebCore19AccessibilityObject13setAXObjectIDEj
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3setERKS3_RKj
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_1
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3setERKjRKS4_
+__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14Pair
+__ZN7WebCore13AXObjectCache13attachWrapperEPNS_19AccessibilityObjectE
++[AccessibilityObjectWrapper initialize]
+-[AccessibilityObjectWrapper initWithAccessibilityObject:]
+-[AccessibilityObjectWrapper accessibilityFocusedUIElement]
+__ZN7WebCore25AccessibilityRenderObject18updateBackingStoreEv
+__ZNK7WebCore25AccessibilityRenderObject16focusedUIElementEv
+__ZNK7WebCore25AccessibilityRenderObject27shouldFocusActiveDescendantEv
+__ZNK7WebCore25AccessibilityRenderObject17ariaRoleAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject22accessibilityIsIgnoredEv
+__ZNK7WebCore25AccessibilityRenderObject31isPresentationalChildOfAriaRoleEv
+__ZNK7WebCore25AccessibilityRenderObject12parentObjectEv
+__ZNK7WebCore25AccessibilityRenderObject33ariaRoleHasPresentationalChildrenEv
+__ZNK3WTF7HashMapIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3getERKj
+__ZNK7WebCore12RenderObject10isMenuListEv
+__ZNK7WebCore25AccessibilityRenderObject21labelElementContainerEv
+__ZNK7WebCore25AccessibilityRenderObject9isControlEv
+__ZNK7WebCore25AccessibilityRenderObject9isHeadingEv
+__ZNK7WebCore25AccessibilityRenderObject9roleValueEv
+__ZNK7WebCore25AccessibilityRenderObject6isLinkEv
+-[AccessibilityObjectWrapper accessibilityAttributeValue:]
+__ZNK7WebCore25AccessibilityRenderObject9isWebAreaEv
+__ZNK7WebCore25AccessibilityRenderObject13isTextControlEv
+__ZNK7WebCore25AccessibilityRenderObject12isAttachmentEv
+__ZNK7WebCore25AccessibilityRenderObject5titleEv
+__ZNK7WebCore25AccessibilityRenderObject22ariaLabeledByAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject20ariaAccessiblityNameERKNS_6StringE
+__ZN7WebCoreL21accessibleNameForNodeEPNS_4NodeE
+__ZN7WebCore13AXObjectCache15childrenChangedEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache25postNotificationToElementEPNS_12RenderObjectERKNS_6StringE
+__ZNK7WebCore9DOMWindow27pendingUnloadEventListenersEv
+__ZN7WebCore13InlineTextBox14paintSelectionEPNS_15GraphicsContextEiiPNS_11RenderStyleERKNS_4FontE
+__ZN7WebCore13InlineTextBox17selectionStartEndERiS1_
+__ZN7WebCore15GraphicsContext20drawHighlightForTextERKNS_4FontERKNS_7TextRunERKNS_8IntPointEiRKNS_5ColorEii
+__ZNK7WebCore12RenderObject24selectionForegroundColorEv
+__ZNK7WebCore11RenderTheme30activeSelectionForegroundColorEv
+__ZNK7WebCore14RenderThemeMac33supportsSelectionForegroundColorsEv
+__ZNK7WebCore25AccessibilityRenderObject24accessibilityDescriptionEv
+__ZNK7WebCore25AccessibilityRenderObject24ariaDescribedByAttributeEv
+__ZNK7WebCore11HistoryItem8referrerEv
+__ZThn24_NK7WebCore14XMLHttpRequest10canSuspendEv
+__ZNK7WebCore14XMLHttpRequest10canSuspendEv
+__ZThn24_N7WebCore14XMLHttpRequest16contextDestroyedEv
+__ZN7WebCore14XMLHttpRequest16contextDestroyedEv
+__ZThn8_N7WebCore7ElementD0Ev
 __ZN7WebCore19HTMLTextAreaElement8checkDTDEPKNS_4NodeE
 __ZN7WebCore19HTMLTextAreaElement15childrenChangedEbPNS_4NodeES2_i
 __ZNK7WebCore19HTMLTextAreaElement12defaultValueEv
-__ZN7WebCore26RenderTextControlMultiLine11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore27jsHTMLOptionElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26RenderTextControlMultiLine21preferredContentWidthEf
+__ZNK7WebCore17RenderTextControl18scrollbarThicknessEv
+__ZN7WebCore11RenderBlock22skipTrailingWhitespaceERNS_14InlineIteratorE
+__ZThn8_N7WebCore19HTMLTextAreaElementD0Ev
+__ZNK7WebCore16HTMLLabelElement11isFocusableEv
+__ZN7WebCore12RenderInline16positionForPointERKNS_8IntPointE
+__ZN7WebCore10IconLoader11stopLoadingEv
+__ZNK7WebCore10WheelEvent12isWheelEventEv
+__ZN7WebCore15getDOMStructureINS_12JSWheelEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore12JSWheelEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSWheelEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10WheelEventEEE
+__ZN7WebCore12JSWheelEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10WheelEventEEE
+__ZN7WebCore12JSWheelEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsWheelEventClientXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventClientYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventScreenXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventScreenYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventCtrlKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWheelEventAltKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsWheelEventShiftKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventMetaKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsWheelEventWheelDeltaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsWheelEventWheelDeltaXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsElementPrototypeFunctionContainsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13AXObjectCache13detachWrapperEPNS_19AccessibilityObjectE
+-[AccessibilityObjectWrapper detach]
+-[AccessibilityObjectWrapper unregisterUniqueIdForUIElement]
+__ZN7WebCore25AccessibilityRenderObject6detachEv
+__ZN7WebCore19AccessibilityObject13clearChildrenEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE14shrinkCapacityEm
+__ZN7WebCore19AccessibilityObject6detachEv
+__ZN7WebCore13AXObjectCache10removeAXIDEPNS_19AccessibilityObjectE
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E4findIjNS_22IdentityHashTranslatorIjjS4_EE
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E47removeAndInvalidateWithoutEntryConsisten
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E6removeEPj
+__ZN7WebCore25AccessibilityRenderObjectD0Ev
+__ZN7WebCore19AccessibilityObjectD2Ev
+__ZN7WebCore13AXObjectCache6removeEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache6removeEj
+__ZN3JSC8Bindings12ObjcInstanceD0Ev
+__ZN7WebCore13AXObjectCache21handleAriaRoleChangedEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache29handleFocusedUIElementChangedEv
+__ZN7WebCore7Element21updateFocusAppearanceEb
+__ZN7WebCoreL21ariaRoleToWebCoreRoleENS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringENS1_17AccessibilityRoleENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_17AccessibilityRoleEENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_1
+__ZNK3WTF7HashMapIN7WebCore6StringENS1_17AccessibilityRoleENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3getERKS2_
+__ZN7WebCore19AccessibilityObject13isARIAControlENS_17AccessibilityRoleE
+__ZN7WebCore19AccessibilityObject11isARIAInputENS_17AccessibilityRoleE
+-[AccessibilityObjectWrapper accessibilityActionNames]
+__ZNK7WebCore25AccessibilityRenderObject13actionElementEv
+__ZNK7WebCore25AccessibilityRenderObject18isFileUploadButtonEv
+__ZNK7WebCore25AccessibilityRenderObject13isImageButtonEv
+__ZNK7WebCore25AccessibilityRenderObject13isNativeImageEv
+__ZNK7WebCore25AccessibilityRenderObject13anchorElementEv
+__ZNK7WebCore25AccessibilityRenderObject13axObjectCacheEv
+__ZNK7WebCore25AccessibilityRenderObject8isAnchorEv
+__ZN7WebCore11RenderBlock17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore4Node13aboutToUnloadEv
+-[AccessibilityObjectWrapper role]
+__ZL19roleValueToNSStringN7WebCore17AccessibilityRoleE
+__ZL26createAccessibilityRoleMapv
+__ZN3WTF7HashMapIiP8NSStringNS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
+__ZN3WTF9HashTableIiSt4pairIiP8NSStringENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_
+__ZNK3WTF7HashMapIiP8NSStringNS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
+__ZN7WebCore25AccessibilityRenderObject15childrenChangedEv
+__ZNK7WebCore25AccessibilityRenderObject27isAccessibilityRenderObjectEv
+__ZNK7WebCore17HTMLAnchorElement13supportsFocusEv
+__ZN7WebCore13AXObjectCache16postNotificationEPNS_12RenderObjectERKNS_6StringE
+__ZNK7WebCore25AccessibilityRenderObject16observableObjectEv
+__ZNK7WebCore25AccessibilityRenderObject4textEv
+__ZNK7WebCore25AccessibilityRenderObject15isPasswordFieldEv
+__ZNK7WebCore25AccessibilityRenderObject19isNativeTextControlEv
 __ZN7WebCore19HTMLTextAreaElement19defaultEventHandlerEPNS_5EventE
 __ZNK7WebCore19HTMLTextAreaElement20shouldUseInputMethodEv
 __ZN7WebCore19HTMLTextAreaElement21updateFocusAppearanceEb
 __ZN7WebCore19HTMLTextAreaElement17setSelectionRangeEii
 __ZNK7WebCore19HTMLTextAreaElement16isMouseFocusableEv
 __ZN7WebCore26RenderTextControlMultiLine14cacheSelectionEii
-__ZN7WebCore26RenderTextControlMultiLine17subtreeHasChangedEv
-__ZN7WebCore5Frame23textDidChangeInTextAreaEPNS_7ElementE
-+[DOMHTMLTextAreaElement(WebCoreInternal) _wrapHTMLTextAreaElement:]
--[DOMHTMLTextAreaElement form]
--[DOMHTMLTextAreaElement(FormPromptAdditions) _isEdited]
-__ZN7WebCore22DeleteSelectionCommand10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore20isTableStructureNodeEPKNS_4NodeE
-__ZN7WebCoreL28updatePositionForNodeRemovalEPNS_4NodeERNS_8PositionE
-__ZN7WebCore20CompositeEditCommand10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore17RemoveNodeCommandC1EN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore17RemoveNodeCommand7doApplyEv
-__ZN7WebCore4Node6removeERi
-__ZN7WebCore18createBreakElementEPNS_8DocumentE
-__ZN7WebCore20CompositeEditCommand23breakOutOfEmptyListItemEv
-__ZN7WebCore22enclosingEmptyListItemERKNS_15VisiblePositionE
-__ZN7WebCore18enclosingListChildEPNS_4NodeE
-__ZN7WebCore13isListElementEPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand16insertNodeBeforeEN3WTF10PassRefPtrINS_4NodeEEES4_
-__ZN7WebCore23InsertNodeBeforeCommandC1EN3WTF10PassRefPtrINS_4NodeEEES4_
-__ZN7WebCore23InsertNodeBeforeCommand7doApplyEv
-__ZNK7WebCore17HTMLAnchorElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore19HTMLTextAreaElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore22HTMLFormControlElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore12EventHandler17tabsToAllControlsEPNS_13KeyboardEventE
-__ZNK7WebCore17HTMLSelectElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore17HTMLOptionElement11isFocusableEv
-__ZNK7WebCore21HTMLFrameOwnerElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore20HTMLFrameElementBase11isFocusableEv
-__ZNK7WebCore12EventHandler11tabsToLinksEPNS_13KeyboardEventE
-__ZNK7WebCore12EventHandler24invertSenseOfTabsToLinksEPNS_13KeyboardEventE
 __ZN7WebCore26RenderTextControlMultiLine12forwardEventEPNS_5EventE
-__ZNK7WebCore11RenderLayer18absoluteToContentsERKNS_8IntPointE
-__ZN7WebCore25setJSHTMLInputElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement7setTypeERKNS_6StringE
-__ZN7WebCore30setJSHTMLButtonElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23InsertNodeBeforeCommandD1Ev
-__ZNK7WebCore17HTMLButtonElement24isSuccessfulSubmitButtonEv
-__ZN7WebCore19HTMLTextAreaElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore38setJSHTMLTextAreaElementSelectionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTextAreaElement17setSelectionStartEi
-__ZN7WebCore17RenderTextControl17setSelectionStartEi
-__ZN7WebCore36setJSHTMLTextAreaElementSelectionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTextAreaElement15setSelectionEndEi
-__ZN7WebCore17RenderTextControl15setSelectionEndEi
-__ZN7WebCore30jsHTMLAnchorElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLAnchorElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSHTMLAnchorElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore30JSHTMLAnchorElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLAnchorElementConstructor9classInfoEv
-__ZN7WebCore29jsHTMLImageElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLImageElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLImageElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore29JSHTMLImageElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLImageElementConstructor9classInfoEv
-__ZN7WebCore30JSHTMLAnchorElementConstructorD0Ev
-__ZN7WebCore29JSHTMLImageElementConstructorD0Ev
-__ZN7WebCore21setJSDOMWindowOnfocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow10setOnfocusEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore15JSDOMWindowBase16childFrameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore25setJSHTMLImageElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement7setNameERKNS_6StringE
-__ZN7WebCore39jsHTMLDocumentPrototypeFunctionHasFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN3WTF6VectorIPN7WebCore4NodeELm16EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore4NodeELm16EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore4NodeELm16EE15reserveCapacityEm
-__ZN7WebCore30jsHTMLInputElementDefaultValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement12defaultValueEv
-__ZN7WebCore21setJSElementScrollTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore7Element12setScrollTopEi
-__ZN7WebCore9RenderBox12setScrollTopEi
-__ZN7WebCore17HTMLButtonElement18setActivatedSubmitEb
-__ZN7WebCore19setJSDocumentDomainEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore8Document9setDomainERKNS_6StringE
-__ZN7WebCore14SecurityOrigin16setDomainFromDOMERKNS_6StringE
-__ZN7WebCore16ScriptController20updateSecurityOriginEv
-__ZN3WTF6VectorIPN7WebCore9RenderBoxELm16EE6shrinkEm
-__ZN7WebCore22jsHTMLEmbedElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLEmbedElement4typeEv
-__ZN7WebCore18JSHTMLEmbedElement11getCallDataERN3JSC8CallDataE
-__ZN7WebCore24runtimeObjectGetCallDataEPNS_11HTMLElementERN3JSC8CallDataE
-__ZNK3JSC8Bindings9CInstance27supportsInvokeDefaultMethodEv
-__ZN7WebCore27setJSHTMLEmbedElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLPlugInElement9setHeightERKNS_6StringE
-__ZN7WebCore16JSDOMWindowShell15unwrappedObjectEv
-__ZNK3JSC14JSGlobalObject14isGlobalObjectEv
-__ZN7WebCore11RenderBlock24fillVerticalSelectionGapEiiiiPS0_iiPKNS_12RenderObject9PaintInfoE
-__ZN7WebCore11RenderBlock20fillLeftSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
-__ZN3WTF9HashTableIPN7WebCore11RenderBlockESt4pairIS3_PNS2_18BlockSelectionInfoEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SB_EEEENS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCore20jsDOMWindowStatusbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow9statusbarEv
-__ZN7WebCore7BarInfoC1EPNS_5FrameENS0_4TypeE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7BarInfoE
-__ZN7WebCore9JSBarInfo15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore9JSBarInfoC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7BarInfoEEE
-__ZN7WebCore9JSBarInfo18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16jsBarInfoVisibleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore7BarInfo7visibleEv
-__ZNK7WebCore6Chrome16statusbarVisibleEv
-__ZN7WebCore33setJSEventTargetNodeOnselectstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode16setOnselectstartEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore15FontFamilyValue7cssTextEv
-__ZN7WebCore26CSSMutableStyleDeclarationaSERKS0_
-__ZN7WebCore28setJSHTMLLabelElementHtmlForEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLLabelElement10setHtmlForERKNS_6StringE
-__ZN7WebCore22jsKeyboardEventCtrlKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsKeyboardEventAltKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsKeyboardEventMetaKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13KeyboardEvent5whichEv
-__ZNK7WebCore8Position19isRenderedCharacterEv
-__ZN7WebCoreL14mapConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCoreL27createHTMLMapElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore16JSHTMLMapElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSHTMLMapElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLMapElementEEE
-__ZNK7WebCore16JSHTMLMapElement9classInfoEv
-__ZN7WebCore16JSHTMLMapElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22jsDOMWindowPageXOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7scrollXEv
-__ZN7WebCore41jsHTMLInputElementPrototypeFunctionSelectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore17RegularExpression13matchedLengthEv
-__ZN7WebCore23jsHTMLFormElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLFormElement6targetEv
-__ZN7WebCore35setJSHTMLSelectElementSelectedIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLSelectElement16setSelectedIndexEibb
-__ZN7WebCore17HTMLSelectElement29setActiveSelectionAnchorIndexEi
-__ZN3WTF6VectorIbLm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIbLm0EE14expandCapacityEmPKb
-__ZN7WebCore17HTMLSelectElement13deselectItemsEPNS_17HTMLOptionElementE
-__ZN7WebCore17HTMLSelectElement12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
-__ZN7WebCore30setJSHTMLOptionElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionMoveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D6moveToEff
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionLineToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D6lineToEff
-__ZN7WebCore40setJSCanvasRenderingContext2DStrokeStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore26JSCanvasRenderingContext2D14setStrokeStyleEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore24CanvasRenderingContext2D14setStrokeStyleEN3WTF10PassRefPtrINS_11CanvasStyleEEE
-__ZN7WebCore11CanvasStyle16applyStrokeColorEPNS_15GraphicsContextE
-__ZN7WebCore5ColorC1ERKNS_6StringE
-__ZN7WebCore40setJSCanvasRenderingContext2DGlobalAlphaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24CanvasRenderingContext2D14setGlobalAlphaEf
-__ZN7WebCore15GraphicsContext8setAlphaEf
-__ZN7WebCore38setJSCanvasRenderingContext2DLineWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
+__ZNK7WebCore25AccessibilityRenderObject7isImageEv
+__ZN7WebCore25AccessibilityRenderObject12headingLevelEPNS_4NodeE
+__ZNK7WebCore19AccessibilityObject21parentObjectUnignoredEv
+-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]
+__ZN7WebCore25AccessibilityRenderObject8childrenEv
+__ZN7WebCore25AccessibilityRenderObject11addChildrenEv
+__ZNK7WebCore25AccessibilityRenderObject15canHaveChildrenEv
+__ZNK7WebCore25AccessibilityRenderObject10firstChildEv
+__ZNK7WebCore19AccessibilityObject11hasChildrenEv
+__ZN7WebCore21AccessibilityARIAGrid6createEPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityARIAGridC1EPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityARIAGridC2EPNS_12RenderObjectE
+__ZN7WebCore18AccessibilityTableC2EPNS_12RenderObjectE
+__ZN7WebCore18AccessibilityTable36isTableExposableThroughAccessibilityEv
+__ZNK7WebCore18AccessibilityTable22accessibilityIsIgnoredEv
+__ZNK7WebCore18AccessibilityTable11isDataTableEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE15reserveCapacityEm
+__ZNK7WebCore25AccessibilityRenderObject11nextSiblingEv
+__ZNK7WebCore25AccessibilityRenderObject19mouseButtonListenerEv
+__ZNK7WebCore12RenderObject13isRenderImageEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EEC2ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE6shrinkEm
+-[AccessibilityObjectWrapper accessibilityAttributeNames]
+__ZNK7WebCore18AccessibilityTable9roleValueEv
+-[AccessibilityObjectWrapper subrole]
+__ZNK7WebCore19AccessibilityObject6isListEv
+-[AccessibilityObjectWrapper roleDescription]
+__ZN7WebCore18AccessibilityTable13clearChildrenEv
+__ZN7WebCore21AccessibilityARIAGrid11addChildrenEv
+__ZN7WebCore24AccessibilityARIAGridRow6createEPNS_12RenderObjectE
+__ZN7WebCore24AccessibilityARIAGridRowC1EPNS_12RenderObjectE
+__ZN7WebCore24AccessibilityARIAGridRowC2EPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityTableRowC2EPNS_12RenderObjectE
+__ZNK7WebCore21AccessibilityTableRow22accessibilityIsIgnoredEv
+__ZNK7WebCore21AccessibilityTableRow10isTableRowEv
+__ZNK7WebCore24AccessibilityARIAGridRow11parentTableEv
+__ZN7WebCore21AccessibilityARIAGrid8addChildEPNS_19AccessibilityObjectERN3WTF7HashSetIS2_NS3_7PtrHashIS2_EENS3_10HashTraitsIS2_
+__ZNK3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8c
+__ZNK7WebCore21AccessibilityTableRow9roleValueEv
+__ZN7WebCore25AccessibilityARIAGridCell6createEPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityARIAGridCellC1EPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityARIAGridCellC2EPNS_12RenderObjectE
+__ZN7WebCore22AccessibilityTableCellC2EPNS_12RenderObjectE
+__ZNK7WebCore22AccessibilityTableCell22accessibilityIsIgnoredEv
+__ZNK7WebCore22AccessibilityTableCell11isTableCellEv
+__ZNK7WebCore25AccessibilityARIAGridCell11parentTableEv
+__ZN3WTF7HashSetIPN7WebCore19AccessibilityObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6ex
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6re
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13a
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15d
+__ZN7WebCore13AXObjectCache11getOrCreateENS_17AccessibilityRoleE
+__ZN7WebCore24AccessibilityTableColumn6createEv
+__ZN7WebCore24AccessibilityTableColumnC1Ev
+__ZN7WebCore24AccessibilityTableColumnC2Ev
+__ZN7WebCore24AccessibilityTableColumn14setParentTableEPNS_18AccessibilityTableE
+__ZN7WebCore18AccessibilityTable15headerContainerEv
+__ZN7WebCore33AccessibilityTableHeaderContainer6createEv
+__ZN7WebCore33AccessibilityTableHeaderContainerC1Ev
+__ZN7WebCore33AccessibilityTableHeaderContainerC2Ev
+__ZL16convertToNSArrayRKN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EEE
+__ZNK7WebCore19AccessibilityObject12isAttachmentEv
+__ZNK7WebCore25AccessibilityRenderObject8helpTextEv
+__ZNK7WebCore25AccessibilityRenderObject21frameViewIfRenderViewEv
+__ZNK7WebCore18AccessibilityTable5titleEv
+__ZNK7WebCore25AccessibilityRenderObject4sizeEv
+__ZNK7WebCore25AccessibilityRenderObject11elementRectEv
+__ZNK7WebCore25AccessibilityRenderObject17isCheckboxOrRadioEv
+__ZNK7WebCore25AccessibilityRenderObject15boundingBoxRectEv
+__ZNK7WebCore25AccessibilityRenderObject12isInputImageEv
+__ZNK7WebCore25AccessibilityRenderObject19isProgressIndicatorEv
+__ZNK7WebCore25AccessibilityRenderObject8isSliderEv
+__ZNK7WebCore25AccessibilityRenderObject11hasIntValueEv
+__ZNK7WebCore25AccessibilityRenderObject11stringValueEv
+__ZNK7WebCore25AccessibilityRenderObject9isFocusedEv
+__ZNK7WebCore25AccessibilityRenderObject9isEnabledEv
+__ZNK7WebCore25AccessibilityRenderObject17documentFrameViewEv
+__ZNK7WebCore19AccessibilityObject10isTableRowEv
+__ZNK7WebCore19AccessibilityObject13isTableColumnEv
+__ZNK7WebCore19AccessibilityObject11isTableCellEv
+__ZNK7WebCore19AccessibilityObject9isListBoxEv
+-[AccessibilityObjectWrapper textMarkerRangeForSelection]
+__ZNK7WebCore25AccessibilityRenderObject9selectionEv
+__ZN7WebCore15startOfDocumentEPKNS_4NodeE
+__ZL28textMarkerForVisiblePositionRKN7WebCore15VisiblePositionE
+__ZN7WebCore13endOfDocumentEPKNS_4NodeE
+__ZNK7WebCore25AccessibilityRenderObject9isVisitedEv
+__ZNK7WebCore25AccessibilityRenderObject16linkedUIElementsERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZNK7WebCore25AccessibilityRenderObject10isSelectedEv
+__ZL15blockquoteLevelPN7WebCore12RenderObjectE
+__ZN7WebCore18AccessibilityTable4rowsEv
+__ZN7WebCore18AccessibilityTable7columnsEv
+__ZN7WebCore18AccessibilityTable5cellsERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE6appendIS4_EEvPKT_m
+__ZN7WebCore18AccessibilityTable13columnHeadersERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZN7WebCore24AccessibilityTableColumn12headerObjectEv
+__ZNK7WebCore21AccessibilityARIAGrid11isAriaTableEv
+__ZN7WebCore24AccessibilityTableColumn8childrenEv
+__ZN7WebCore24AccessibilityTableColumn11addChildrenEv
+__ZN7WebCore18AccessibilityTable8rowCountEv
+__ZN7WebCore21AccessibilityARIAGrid19cellForColumnAndRowEjj
+__ZN7WebCore18AccessibilityTable11columnCountEv
+__ZNK7WebCore22AccessibilityTableCell9roleValueEv
+__ZN7WebCore18AccessibilityTable10rowHeadersERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZN7WebCore24AccessibilityARIAGridRow12headerObjectEv
+__ZNK7WebCore16HTMLTableElement7captionEv
+-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]
+__ZNK7WebCore19AccessibilityObject11isDataTableEv
+__ZN7WebCore25AccessibilityARIAGridCell13rowIndexRangeERSt4pairIiiE
+__ZN7WebCore25AccessibilityARIAGridCell16columnIndexRangeERSt4pairIiiE
+__ZN7WebCore19AccessibilityObject18updateBackingStoreEv
+__ZNK7WebCore19AccessibilityObject15isPasswordFieldEv
+__ZNK7WebCore19AccessibilityObject9isWebAreaEv
+__ZNK7WebCore19AccessibilityObject13isTextControlEv
+__ZNK7WebCore19AccessibilityObject8isAnchorEv
+__ZNK7WebCore19AccessibilityObject7isImageEv
+__ZNK7WebCore19AccessibilityObject6isLinkEv
+__ZNK7WebCore24AccessibilityTableColumn13isTableColumnEv
+__ZNK7WebCore24AccessibilityTableColumn9roleValueEv
+__ZNK7WebCore19AccessibilityObject8helpTextEv
+__ZNK7WebCore19AccessibilityObject27isAccessibilityRenderObjectEv
+__ZNK7WebCore24AccessibilityTableColumn12parentObjectEv
+__ZNK7WebCore19AccessibilityObject5titleEv
+__ZNK7WebCore24AccessibilityTableColumn4sizeEv
+__ZNK7WebCore24AccessibilityTableColumn11elementRectEv
+__ZNK7WebCore19AccessibilityObject24accessibilityDescriptionEv
+__ZNK7WebCore19AccessibilityObject19isProgressIndicatorEv
+__ZNK7WebCore19AccessibilityObject8isSliderEv
+__ZNK7WebCore19AccessibilityObject11hasIntValueEv
+__ZNK7WebCore19AccessibilityObject11stringValueEv
+__ZNK7WebCore19AccessibilityObject9isFocusedEv
+__ZNK7WebCore19AccessibilityObject9isEnabledEv
+__ZNK7WebCore19AccessibilityObject17documentFrameViewEv
+__ZNK7WebCore19AccessibilityObject9selectionEv
+__ZNK7WebCore19AccessibilityObject9isVisitedEv
+__ZNK7WebCore19AccessibilityObject16linkedUIElementsERN3WTF6VectorINS1_6RefPtrIS0_EELm0EEE
+__ZNK7WebCore19AccessibilityObject10isSelectedEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer9roleValueEv
+__ZNK7WebCore19AccessibilityObject12isInputImageEv
+__ZNK7WebCore19AccessibilityObject9isControlEv
+__ZNK7WebCore19AccessibilityObject7isGroupEv
+__ZNK7WebCore19AccessibilityObject6isMenuEv
+__ZNK7WebCore19AccessibilityObject9isMenuBarEv
+__ZNK7WebCore19AccessibilityObject12isMenuButtonEv
+__ZNK7WebCore19AccessibilityObject10isMenuItemEv
+__ZN7WebCore33AccessibilityTableHeaderContainer8childrenEv
+__ZN7WebCore33AccessibilityTableHeaderContainer11addChildrenEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer12parentObjectEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer4sizeEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer11elementRectEv
+__ZN7WebCore22jsHTMLElementInnerTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21AccessibilityARIAGridD0Ev
+__ZN7WebCore18AccessibilityTableD2Ev
+__ZN7WebCore25AccessibilityRenderObjectD2Ev
+__ZN7WebCore24AccessibilityARIAGridRowD0Ev
+__ZN7WebCore21AccessibilityTableRowD2Ev
+__ZN7WebCore24AccessibilityTableColumnD0Ev
+__ZN7WebCore25AccessibilityARIAGridCellD0Ev
+__ZN7WebCore22AccessibilityTableCellD2Ev
+__ZN7WebCore33AccessibilityTableHeaderContainerD0Ev
+__ZN7WebCoreL17canvasConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLCanvasElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLCanvasElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLCanvasElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore17HTMLCanvasElement5resetEv
+__ZNK7WebCore17HTMLCanvasElement17endTagRequirementEv
+__ZNK7WebCore17HTMLCanvasElement11tagPriorityEv
+__ZN7WebCore17HTMLCanvasElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore16RenderHTMLCanvasC1EPNS_17HTMLCanvasElementE
+__ZN7WebCore16RenderHTMLCanvasC2EPNS_17HTMLCanvasElementE
+-[AccessibilityObjectWrapper renderWidgetChildren]
+__ZNK7WebCore25AccessibilityRenderObject6widgetEv
+__ZNK7WebCore25AccessibilityRenderObject3urlEv
+__ZNK7WebCore25AccessibilityRenderObject9accessKeyEv
+__ZN7WebCoreL30createHTMLCanvasElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLCanvasElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLCanvasElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLCanvasElementEEE
+__ZN7WebCore19JSHTMLCanvasElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLCanvasElementEEE
+__ZN7WebCore19JSHTMLCanvasElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSHTMLCanvasElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore46jsHTMLCanvasElementPrototypeFunctionGetContextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19JSHTMLCanvasElement9classInfoEv
+__ZN7WebCore17HTMLCanvasElement10getContextERKNS_6StringE
+__ZN7WebCore24CanvasRenderingContext2DC1EPNS_17HTMLCanvasElementE
+__ZN7WebCore24CanvasRenderingContext2DC2EPNS_17HTMLCanvasElementE
+__ZN7WebCore24CanvasRenderingContext2D5StateC1Ev
+__ZN7WebCore24CanvasRenderingContext2D5StateC2Ev
+__ZN7WebCore11CanvasStyleC1ERKNS_6StringE
+__ZN7WebCore11CanvasStyleC2ERKNS_6StringE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_24CanvasRenderingContext2DE
+__ZN7WebCore26JSCanvasRenderingContext2D15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24CanvasRenderingContext2D3refEv
+__ZN7WebCore26JSCanvasRenderingContext2DC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24CanvasRenderingContext2DEEE
+__ZN7WebCore26JSCanvasRenderingContext2DC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24CanvasRenderingContext2DEEE
+__ZN7WebCore26JSCanvasRenderingContext2D3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore38setJSCanvasRenderingContext2DLineWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore24CanvasRenderingContext2D12setLineWidthEf
-__ZN7WebCore36setJSCanvasRenderingContext2DLineCapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
+__ZNK7WebCore24CanvasRenderingContext2D14drawingContextEv
+__ZNK7WebCore17HTMLCanvasElement14drawingContextEv
+__ZNK7WebCore17HTMLCanvasElement6bufferEv
+__ZNK7WebCore17HTMLCanvasElement17createImageBufferEv
+__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_9FloatSizeE
+__ZN7WebCore6Chrome11scaleFactorEv
+__ZN7WebCore11ImageBufferC1ERKNS_7IntSizeEbRb
+__ZN7WebCore11ImageBufferC2ERKNS_7IntSizeEbRb
+__ZN7WebCore15ImageBufferDataC1ERKNS_7IntSizeE
+__ZN7WebCore15ImageBufferDataC2ERKNS_7IntSizeE
+__ZNK7WebCore11ImageBuffer7contextEv
+__ZN7WebCore15GraphicsContext26setShadowsIgnoreTransformsEb
+__ZN7WebCore36setJSCanvasRenderingContext2DLineCapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore24CanvasRenderingContext2D10setLineCapERKNS_6StringE
 __ZN7WebCore12parseLineCapERKNS_6StringERNS_7LineCapE
 __ZN7WebCore15GraphicsContext10setLineCapENS_7LineCapE
-__ZN7WebCore37setJSCanvasRenderingContext2DLineJoinEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24CanvasRenderingContext2D11setLineJoinERKNS_6StringE
-__ZN7WebCore13parseLineJoinERKNS_6StringERNS_8LineJoinE
-__ZN7WebCore15GraphicsContext11setLineJoinENS_8LineJoinE
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionStrokeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore26JSCanvasRenderingContext2D18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35JSCanvasRenderingContext2DPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionBeginPathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore26JSCanvasRenderingContext2D9classInfoEv
+__ZN7WebCore24CanvasRenderingContext2D9beginPathEv
+__ZN7WebCore4Path5clearEv
+__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionStrokeRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore26JSCanvasRenderingContext2D10strokeRectEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK3JSC7JSValue7toFloatEPNS_9ExecStateE
+__ZN7WebCore24CanvasRenderingContext2D10strokeRectEffff
+__ZN7WebCoreL21validateRectForCanvasERfS0_S0_S0_
+__ZN7WebCore24CanvasRenderingContext2D10strokeRectEfffff
+__ZN7WebCore24CanvasRenderingContext2D8willDrawERKNS_9FloatRectEj
+__ZN7WebCore9FloatRect5uniteERKS0_
+__ZN7WebCore17HTMLCanvasElement8willDrawERKNS_9FloatRectE
+__ZN7WebCore7mapRectERKNS_9FloatRectES2_S2_
+__ZN7WebCore9FloatRect9intersectERKS0_
+__ZN7WebCore15GraphicsContext10strokeRectERKNS_9FloatRectEf
+__ZN7WebCore40setJSCanvasRenderingContext2DStrokeStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26JSCanvasRenderingContext2D14setStrokeStyleEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCoreL17toHTMLCanvasStyleEPN3JSC9ExecStateENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D14setStrokeStyleEN3WTF10PassRefPtrINS_11CanvasStyleEEE
+__ZN7WebCore11CanvasStyle16applyStrokeColorEPNS_15GraphicsContextE
+__ZN7WebCore5ColorC1ERKNS_6StringE
+__ZN7WebCore5ColorC2ERKNS_6StringE
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionMoveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D6moveToEff
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionLineToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D6lineToEff
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionStrokeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore24CanvasRenderingContext2D6strokeEv
+__ZNK7WebCore4Path7isEmptyEv
 __ZN7WebCore15GraphicsContext9beginPathEv
-__ZN7WebCore15GraphicsContext7addPathERKNS_4PathE
 __ZN7WebCore4Path18strokeBoundingRectEPNS_18StrokeStyleApplierE
 __ZN7WebCoreL20createScratchContextEv
 __ZN7WebCoreL15putBytesNowhereEPvPKvm
 __ZN7WebCore24CanvasStrokeStyleApplier11strokeStyleEPNS_15GraphicsContextE
 __ZNK7WebCore24CanvasRenderingContext2D9lineWidthEv
+__ZN7WebCore15GraphicsContext11setLineJoinENS_8LineJoinE
 __ZNK7WebCore24CanvasRenderingContext2D10miterLimitEv
 __ZN7WebCore15GraphicsContext13setMiterLimitEf
 __ZN7WebCore15GraphicsContext10strokePathEv
-__ZN7WebCore9Scrollbar14transformEventERKNS_18PlatformMouseEventE
-__ZN7WebCore9Scrollbar10mouseMovedERKNS_18PlatformMouseEventE
-__ZN7WebCore23ScrollbarThemeComposite7hitTestEPNS_9ScrollbarERKNS_18PlatformMouseEventE
-__ZN7WebCore9Scrollbar14setHoveredPartENS_13ScrollbarPartE
-__ZN7WebCore14ScrollbarTheme26invalidateOnMouseEnterExitEv
-__ZN7WebCore9Scrollbar11mouseExitedEv
-__ZN7WebCore11RenderBlock21fillRightSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
-__ZN7WebCore11RenderBlock26fillHorizontalSelectionGapEPNS_12RenderObjectEiiiiPKNS1_9PaintInfoE
-__ZN7WebCore14RenderReplaced17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZNK7WebCore14RenderReplaced18canBeSelectionLeafEv
-__ZN7WebCore14RenderReplaced13selectionRectEb
-__ZNK7WebCore5Range20editingStartPositionEv
-__ZN7WebCore16JSDOMWindowShell14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
-__ZN7WebCore7BarInfo15disconnectFrameEv
-__ZN7WebCore32setJSHTMLTableElementCellPaddingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLTableElement14setCellPaddingERKNS_6StringE
-__ZN7WebCore32setJSHTMLTableElementCellSpacingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLTableElement14setCellSpacingERKNS_6StringE
-__ZN7WebCore23jsHTMLStyleElementSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10StyleSheetE
-__ZN7WebCore15JSCSSStyleSheet15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSStyleSheetPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore12JSStyleSheet15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSCSSStyleSheetC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSStyleSheetEEE
-__ZN7WebCore12JSStyleSheetC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10StyleSheetEEE
-__ZN7WebCore15JSCSSStyleSheet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12JSStyleSheet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSCSSStyleSheetPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23jsCSSStyleSheetCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13CSSStyleSheet8cssRulesEb
-__ZN7WebCore11CSSRuleListC1EPNS_9StyleListEb
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11CSSRuleListE
-__ZN7WebCore13JSCSSRuleList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore13JSCSSRuleListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11CSSRuleListEEE
-__ZN7WebCore13JSCSSRuleList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19jsCSSRuleListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore15JSCSSStyleSheet9classInfoEv
-__ZN7WebCore13CSSStyleSheet10insertRuleERKNS_6StringEjRi
-__ZN7WebCore9CSSParser9parseRuleEPNS_13CSSStyleSheetERKNS_6StringE
-__ZN7WebCore9StyleList6insertEjN3WTF10PassRefPtrINS_9StyleBaseEEE
-__ZN7WebCore13CSSStyleSheet17styleSheetChangedEv
-__ZN7WebCore15JSCSSStyleSheetD0Ev
-__ZN7WebCore14RenderReplaced22positionForCoordinatesEii
-__ZN7WebCore44jsHTMLTableElementPrototypeFunctionInsertRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16HTMLTableElement9insertRowEiRi
-__ZN7WebCore23HTMLTableRowsCollection7lastRowEPNS_16HTMLTableElementE
-__ZNK7WebCore16HTMLTableElement8lastBodyEv
-__ZN7WebCore32setJSHTMLTableCellElementColSpanEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement10setColSpanEi
-__ZN7WebCore22jsHTMLTableElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16HTMLTableElement4rowsEv
-__ZN7WebCore23HTMLTableRowsCollection6createEN3WTF10PassRefPtrINS_16HTMLTableElementEEE
-__ZN7WebCore23HTMLTableRowsCollectionC2EN3WTF10PassRefPtrINS_16HTMLTableElementEEE
-__ZNK7WebCore23HTMLTableRowsCollection9itemAfterEPNS_7ElementE
-__ZN7WebCore23HTMLTableRowsCollection8rowAfterEPNS_16HTMLTableElementEPNS_19HTMLTableRowElementE
-__ZN7WebCoreL8isInHeadEPNS_7ElementE
-__ZNK7WebCore11RenderTable14recalcSectionsEv
-__ZN7WebCore18RenderTableSection11recalcCellsEv
-__ZNK7WebCore18RenderTableSection10numColumnsEv
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE6resizeEm
-__ZN7WebCore9JSHistory3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore9JSHistory9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore17InsertTextCommand21performTrivialReplaceERKNS_6StringEb
-__ZN7WebCore20CompositeEditCommand17replaceTextInNodeEN3WTF10PassRefPtrINS_4TextEEEjjRKNS_6StringE
-__ZN7WebCore8RenderBR22positionForCoordinatesEii
-__ZN7WebCore40firstEditablePositionAfterPositionInRootERKNS_8PositionEPNS_4NodeE
-__ZN7WebCore23jsHTMLAnchorElementHostEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement4hostEv
-__ZN7WebCore27jsHTMLAnchorElementHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement8hostnameEv
-__ZN7WebCore23setJSDOMWindowOnkeydownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow12setOnkeydownEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore20setJSDOMWindowOnblurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow9setOnblurEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore26setJSHTMLFormElementMethodEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLFormElement9setMethodERKNS_6StringE
-__ZN7WebCore26setJSHTMLFormElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLFormElement9setTargetERKNS_6StringE
-__ZN7WebCore23jsHTMLObjectElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement4typeEv
-__ZN7WebCore21jsHTMLEmbedElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLEmbedElement3srcEv
-__ZN7WebCore23jsHTMLEmbedElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLPlugInElement5widthEv
-__ZN7WebCore24jsHTMLEmbedElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLPlugInElement6heightEv
-__ZN7WebCore33setJSHTMLFormElementAcceptCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLFormElement16setAcceptCharsetERKNS_6StringE
-__ZThn28_N7WebCore8DOMTimer6resumeEv
-__ZN7WebCore8DOMTimer6resumeEv
-__ZN7WebCore28jsEventTargetNodeOnmouseoverEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode11onmouseoverEv
-__ZN3WTF9HashTableIN7WebCore13QualifiedNameESt4pairIS2_PNS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_17QualifiedNameHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E4findIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEENS_17HashTableIteratorIS2_S7_S9_SA_SF_SD_EERKT_
-__ZN7WebCore48jsHTMLElementPrototypeFunctionInsertAdjacentHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11HTMLElement18insertAdjacentHTMLERKNS_6StringES3_Ri
-__ZN7WebCore11HTMLElement14insertAdjacentERKNS_6StringEPNS_4NodeERi
-__ZN7WebCore22setJSEventCancelBubbleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore26jsHTMLTableRowElementCellsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19HTMLTableRowElement5cellsEv
-__ZN7WebCore29jsHTMLTableCellElementColSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore5Frame24searchForLabelsAboveCellEPNS_17RegularExpressionEPNS_20HTMLTableCellElementE
-__ZN7WebCoreL15executeMoveLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore19SelectionController16modifyMovingLeftENS_15TextGranularityE
-__ZNK7WebCore15VisiblePosition4leftEb
-__ZNK7WebCore15VisiblePosition29leftVisuallyDistinctCandidateEv
-__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionEb
-__ZNK7WebCore5Frame11revealCaretERKNS_11RenderLayer15ScrollAlignmentE
-__ZNK7WebCore15VisiblePosition19absoluteCaretBoundsEv
-__ZNK7WebCore12RenderObject20localToContainerQuadERKNS_9FloatQuadEPNS_9RenderBoxEb
-__ZN7WebCore21jsHTMLDocumentScriptsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore8Document7scriptsEv
-__ZN7WebCore27jsHTMLAnchorElementPathnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement8pathnameEv
--[DOMHTMLInputElement(FormAutoFillTransition) _selectedRange]
--[DOMHTMLInputElement(WebCoreInternal) _HTMLInputElement]
-__ZNK7WebCore16HTMLInputElement14selectionStartEv
-__ZNK7WebCore16HTMLInputElement12selectionEndEv
--[DOMHTMLInputElement(FormAutoFillTransition) _replaceCharactersInRange:withString:selectingFromIndex:]
-__ZN7WebCore16HTMLInputElement17setSelectionRangeEii
-__ZN7WebCore20setJSDOMWindowStatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow9setStatusERKNS_6StringE
-__ZN3WTF6VectorItLm16EE14expandCapacityEmPKt
-__ZN3WTF6VectorItLm16EE14expandCapacityEm
-__ZN3WTF6VectorItLm16EE15reserveCapacityEm
-__ZN7WebCore17jsDOMWindowOpenerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow6openerEv
-__ZN7WebCore8Document29parseDNSPrefetchControlHeaderERKNS_6StringE
-__ZN7WebCore38jsXMLHttpRequestPrototypeFunctionAbortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14XMLHttpRequest5abortEv
-__ZN7WebCore14XMLHttpRequest18dispatchAbortEventEv
-__ZN7WebCore25setJSHTMLElementInnerTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore13AXObjectCache21handleAriaRoleChangedEPNS_12RenderObjectE
-__ZN7WebCore13RootInlineBox22canAccommodateEllipsisEbiii
-__ZN7WebCore13InlineFlowBox22canAccommodateEllipsisEbii
-__ZN7WebCore9InlineBox22canAccommodateEllipsisEbii
-__ZN7WebCore13RootInlineBox13placeEllipsisERKNS_12AtomicStringEbiiPNS_9InlineBoxE
-__ZN3WTF9HashTableIPKN7WebCore13RootInlineBoxESt4pairIS4_PNS1_11EllipsisBoxEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCore13RootInlineBox16placeEllipsisBoxEbiiRb
-__ZN7WebCore13InlineFlowBox16placeEllipsisBoxEbiiRb
-__ZN7WebCore13InlineTextBox16placeEllipsisBoxEbiiRb
-__ZN3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
-__ZN3WTF9HashTableIPKN7WebCore13RootInlineBoxESt4pairIS4_PNS1_11EllipsisBoxEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E4findIS4_NS_22IdentityHashTranslatorIS4_S8_SC_EEEENS_17HashTableIteratorIS4_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore11EllipsisBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore37jsHTMLCollectionPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore16JSHTMLCollection9classInfoEv
-__ZN7WebCore16JSHTMLCollection4itemEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore13RootInlineBox15clearTruncationEv
-__ZN7WebCoreL20setTableCellsChangedEPNS_4NodeE
-__ZN7WebCore16HTMLEmbedElement13canLazyAttachEv
-__ZN7WebCore24JSMimeTypeArrayPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27setJSEventTargetNodeOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode10setOnabortEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCoreL17reportUnsafeUsageEPNS_22ScriptExecutionContextERKNS_6StringE
-__ZN7WebCore11EllipsisBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore17jsDOMWindowClosedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow6closedEv
-__ZN7WebCore14RenderTableCol29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZN7WebCoreL32createHTMLTableColElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLTableColElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSHTMLTableColElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableColElementEEE
-__ZN7WebCore21JSHTMLTableColElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSHTMLTableColElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore10RenderFlow17addFocusRingRectsEPNS_15GraphicsContextEii
-__ZN7WebCore10HTMLParser10createHeadEv
-__ZN7WebCore21JSHTMLTableColElementD0Ev
-__ZN7WebCore34jsElementPrototypeFunctionContainsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore21jsCharacterDataLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore37jsDocumentPrototypeFunctionImportNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document10importNodeEPNS_4NodeEbRi
-__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_4NodeE
-__ZN7WebCore29setJSHTMLBodyElementScrollTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLBodyElement12setScrollTopEi
-__ZN7WebCore13InlineFlowBox10flowObjectEv
-__ZN3WTF11ListHashSetIPN7WebCore10RenderFlowENS_7PtrHashIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore10RenderFlowEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E5clearEv
-__ZN3WTF11ListHashSetIPN7WebCore10RenderFlowENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore10RenderFlow12paintOutlineEPNS_15GraphicsContextEii
-__ZN7WebCore27jsHTMLButtonElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26RenderTextControlMultiLine21preferredContentWidthEf
-__ZNK7WebCore17RenderTextControl18scrollbarThicknessEv
-__ZNK7WebCore7UIEvent6layerXEv
-__ZNK7WebCore7UIEvent6layerYEv
-__ZNK7WebCore7UIEvent5pageXEv
-__ZNK7WebCore7UIEvent5pageYEv
-__ZN7WebCore23jsKeyboardEventShiftKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsKeyboardEventKeyIdentifierEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24CanvasRenderingContext2D46clearPathForDashboardBackwardCompatibilityModeEv
+__ZN7WebCore16RenderHTMLCanvas13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore17HTMLCanvasElement5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZNK7WebCore11ImageBuffer5imageEv
+__ZN7WebCore11BitmapImageC1EP7CGImagePNS_13ImageObserverE
+__ZN7WebCore11BitmapImageC2EP7CGImagePNS_13ImageObserverE
+__ZN7WebCore26JSCanvasRenderingContext2DD1Ev
+__ZN7WebCore26JSCanvasRenderingContext2DD2Ev
+__ZN7WebCore24CanvasRenderingContext2D5derefEv
+__ZN7WebCore19JSHTMLCanvasElementD1Ev
+__ZN7WebCore16RenderHTMLCanvasD0Ev
+__ZNK7WebCore19AccessibilityObject29accessibilityIgnoreAttachmentEv
+-[AccessibilityObjectWrapper attachmentView]
+__ZNK7WebCore25AccessibilityRenderObject23widgetForAttachmentViewEv
+-[AccessibilityObjectWrapper accessibilityIsIgnored]
+-[AccessibilityObjectWrapper _accessibilityParentForSubview:]
+__ZNK7WebCore25AccessibilityRenderObject7isGroupEv
+__ZNK7WebCore25AccessibilityRenderObject14titleUIElementEv
+__ZNK7WebCore25AccessibilityRenderObject10isFieldsetEv
+__ZNK7WebCore25AccessibilityRenderObject21exposesTitleUIElementEv
+__ZN7WebCore13AXWebAreaTextEv
+__ZN7WebCore10RenderView13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore25AccessibilityRenderObject16getDocumentLinksERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZNK7WebCore25AccessibilityRenderObject8isLoadedEv
+__ZNK7WebCore25AccessibilityRenderObject11layoutCountEv
+__ZN7WebCore35JSCanvasRenderingContext2DPrototypeD1Ev
+__ZN7WebCore28JSHTMLCanvasElementPrototypeD1Ev
+__ZN7WebCore17HTMLCanvasElementD0Ev
+__ZN7WebCore11ImageBufferD1Ev
+__ZN7WebCore11ImageBufferD2Ev
+__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE6shrinkEm
+__ZNK7WebCore11RenderImage13isRenderImageEv
+__ZN7WebCore25AccessibilityImageMapLink6createEv
+__ZN7WebCore25AccessibilityImageMapLinkC1Ev
+__ZN7WebCore25AccessibilityImageMapLinkC2Ev
+__ZNK7WebCore25AccessibilityImageMapLink6isLinkEv
+__ZNK7WebCore25AccessibilityImageMapLink9roleValueEv
+__ZN7WebCore10AXLinkTextEv
+__ZN7WebCore19AccessibilityObject8childrenEv
+__ZNK7WebCore19AccessibilityObject6widgetEv
+__ZNK7WebCore25AccessibilityImageMapLink12parentObjectEv
+__ZNK7WebCore25AccessibilityImageMapLink5titleEv
+__ZNK7WebCore25AccessibilityImageMapLink4sizeEv
+__ZNK7WebCore25AccessibilityImageMapLink11elementRectEv
+__ZNK7WebCore15HTMLAreaElement7getRectEPNS_12RenderObjectE
+__ZN7WebCore4Path9translateERKNS_9FloatSizeE
+__ZNK7WebCore25AccessibilityImageMapLink24accessibilityDescriptionEv
+__ZNK7WebCore25AccessibilityImageMapLink9isEnabledEv
+__ZNK7WebCore25AccessibilityImageMapLink3urlEv
+__ZNK7WebCore15HTMLAreaElement4hrefEv
+__ZNK7WebCore19AccessibilityObject9accessKeyEv
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE4takeERKj
+__ZN7WebCore25AccessibilityImageMapLinkD0Ev
+__ZN7WebCoreL15labelForElementEPNS_7ElementE
+__ZNK7WebCore25AccessibilityRenderObject16textUnderElementEv
+__ZNK7WebCore16HTMLInputElement3srcEv
+__ZN7WebCore9RenderBox17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore12RenderInline25rectWithOutlineForRepaintEPNS_20RenderBoxModelObjectEi
+__ZN7WebCore12RenderObject25rectWithOutlineForRepaintEPNS_20RenderBoxModelObjectEi
+__ZNK7WebCore25AccessibilityRenderObject19internalLinkElementEv
+__ZN7WebCore4KURL9removeRefEv
+__ZNK7WebCore25AccessibilityRenderObject6isMenuEv
+__ZNK7WebCore25AccessibilityRenderObject9isMenuBarEv
+__ZNK7WebCore25AccessibilityRenderObject12isMenuButtonEv
+__ZNK7WebCore25AccessibilityRenderObject10isMenuItemEv
+__ZN7WebCore13AXHeadingTextEv
+__ZNK7WebCore25AccessibilityRenderObject8intValueEv
+__ZN7WebCore10RenderText13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore14RenderFieldset22paintBorderMinusLegendEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEiii
+__ZN7WebCore17AccessibilityList6createEPNS_12RenderObjectE
+__ZN7WebCore17AccessibilityListC1EPNS_12RenderObjectE
+__ZN7WebCore17AccessibilityListC2EPNS_12RenderObjectE
+__ZNK7WebCore17AccessibilityList22accessibilityIsIgnoredEv
+__ZNK7WebCore17AccessibilityList9roleValueEv
+__ZNK7WebCore17AccessibilityList6isListEv
+__ZNK7WebCore17AccessibilityList15isUnorderedListEv
+__ZNK7WebCore17AccessibilityList13isOrderedListEv
+__ZNK7WebCore17AccessibilityList16isDefinitionListEv
+__ZN7WebCore24AXDefinitionListTermTextEv
+__ZN7WebCore30AXDefinitionListDefinitionTextEv
+__ZN7WebCore17AccessibilityListD0Ev
+__ZN7WebCore8FileListC1Ev
+__ZN7WebCore8FileListC2Ev
+__ZN7WebCore23RenderFileUploadControlC1EPNS_16HTMLInputElementE
+__ZN7WebCore23RenderFileUploadControlC2EPNS_16HTMLInputElementE
+__ZN7WebCore11FileChooser6createEPNS_17FileChooserClientERKNS_6StringE
+__ZN7WebCore11FileChooser10chooseIconERKNS_6StringE
+__ZN7WebCore4Icon17createIconForFileERKNS_6StringE
+__ZN7WebCore23RenderFileUploadControl14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore23RenderFileUploadControl17updateFromElementEv
+__ZN7WebCore32HTMLFileUploadInnerButtonElementC1EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore32HTMLFileUploadInnerButtonElementC2EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore25fileButtonChooseFileLabelEv
+__ZNK7WebCore23RenderFileUploadControl17createButtonStyleEPKNS_11RenderStyleE
+__ZN7WebCore16HTMLInputElement5filesEv
+__ZN7WebCore11FileChooser5clearEv
+__ZN7WebCore23RenderFileUploadControl14calcPrefWidthsEv
+__ZN7WebCore23RenderFileUploadControl11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore23RenderFileUploadControl16maxFilenameWidthEv
+__ZNK7WebCore11FileChooser16basenameForWidthERKNS_4FontEi
+__ZN7WebCore29fileButtonNoFileSelectedLabelEv
+__ZN7WebCore23RenderFileUploadControlD0Ev
+__ZN7WebCore11FileChooserD1Ev
+__ZN7WebCore11FileChooserD2Ev
+__ZThn8_N7WebCore32HTMLFileUploadInnerButtonElementD0Ev
+__ZN7WebCore32HTMLFileUploadInnerButtonElementD0Ev
+__ZN7WebCore16HTMLInputElementD2Ev
+__ZN7WebCore17FileChooserClientD2Ev
+__ZL35textMarkerRangeFromVisiblePositionsN7WebCore15VisiblePositionES0_
+__ZNK7WebCore25AccessibilityRenderObject10textLengthEv
+__ZNK7WebCore25AccessibilityRenderObject12selectedTextEv
+__ZNK7WebCore25AccessibilityRenderObject17selectedTextRangeEv
+__ZNK7WebCore19AccessibilityObject12selectionEndEv
+__ZNK7WebCore19AccessibilityObject14selectionStartEv
+__ZNK7WebCore25AccessibilityRenderObject23visiblePositionForIndexEjb
+__ZNK7WebCore25AccessibilityRenderObject23visiblePositionForIndexEi
+__ZNK7WebCore19AccessibilityObject15lineForPositionERKNS_15VisiblePositionE
+__ZN7WebCore13IdentifierRep7isValidEPS0_
+__ZNK3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8contain
+__ZNK7WebCore25AccessibilityRenderObject19checkboxOrRadioRectEv
+__ZN7WebCore12RenderInline13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZNK7WebCore25AccessibilityRenderObject26addRadioButtonGroupMembersERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EE
+__ZN7WebCore8Document35setUseSecureKeyboardEntryWhenActiveEb
+__ZN7WebCore5Frame33updateSecureKeyboardEntryIfActiveEv
+__ZN7WebCore21PlatformKeyboardEvent20currentCapsLockStateEv
+__ZN7WebCore18AccessibilityTable6createEPNS_12RenderObjectE
+__ZN7WebCore18AccessibilityTableC1EPNS_12RenderObjectE
+__ZNK7WebCore16HTMLTableElement7summaryEv
+__ZN7WebCore18AccessibilityTable11addChildrenEv
+__ZN7WebCore21AccessibilityTableRow6createEPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityTableRowC1EPNS_12RenderObjectE
+__ZNK7WebCore21AccessibilityTableRow11parentTableEv
+__ZNK7WebCore18AccessibilityTable11isAriaTableEv
+__ZN7WebCore24AccessibilityTableColumn22headerObjectForSectionEPNS_18RenderTableSectionEb
+__ZN7WebCore22AccessibilityTableCell6createEPNS_12RenderObjectE
+__ZN7WebCore22AccessibilityTableCellC1EPNS_12RenderObjectE
+__ZNK7WebCore22AccessibilityTableCell11parentTableEv
+__ZN7WebCore22AccessibilityTableCell13rowIndexRangeERSt4pairIiiE
+__ZN7WebCore22AccessibilityTableCell16columnIndexRangeERSt4pairIiiE
+__ZN7WebCore21AccessibilityTableRow12headerObjectEv
+__ZN7WebCore18AccessibilityTable19cellForColumnAndRowEjj
+__ZN7WebCore22AccessibilityTableCellD0Ev
+__ZN7WebCore21AccessibilityTableRowD0Ev
+__ZN7WebCore18AccessibilityTableD0Ev
+__ZNK7WebCore16HTMLTableElement5tFootEv
+__ZNK7WebCore16HTMLTableElement5rulesEv
+__ZNK7WebCore20HTMLTableCellElement7headersEv
+__ZNK7WebCore20HTMLTableCellElement4abbrEv
+__ZNK7WebCore20HTMLTableCellElement4axisEv
+__ZNK7WebCore20HTMLTableCellElement5scopeEv
+__ZN7WebCore23HTMLTableCaptionElementD0Ev
+__ZNK7WebCore22AccessibilityTableCell14titleUIElementEv
+__ZNK7WebCore25AccessibilityRenderObject17menuButtonForMenuEv
+__ZNK7WebCore25AccessibilityRenderObject22menuItemElementForMenuEv
+__ZN7WebCoreL19siblingWithAriaRoleENS_6StringEPNS_4NodeE
+__ZN7WebCore38setJSHTMLTextAreaElementSelectionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement17setSelectionStartEi
+__ZN7WebCore17RenderTextControl17setSelectionStartEi
+__ZN7WebCore36setJSHTMLTextAreaElementSelectionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement15setSelectionEndEi
+__ZN7WebCore17RenderTextControl15setSelectionEndEi
+__ZN7WebCore20previousLinePositionERKNS_15VisiblePositionEi
+__ZN7WebCoreL34enclosingNodeWithNonInlineRendererEPNS_4NodeE
+__ZN7WebCoreL31previousLeafWithSameEditabilityEPNS_4NodeE
 __ZN7WebCore35jsHTMLTextAreaElementSelectionStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore19HTMLTextAreaElement14selectionStartEv
-__ZNK7WebCore15JSKeyboardEvent9classInfoEv
-__ZN7WebCore11HTMLElement18setContentEditableEPNS_15MappedAttributeE
-__ZN7WebCore40jsDOMWindowPrototypeFunctionGetSelectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9DOMWindow12getSelectionEv
-__ZN7WebCore12DOMSelectionC1EPNS_5FrameE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12DOMSelectionE
-__ZN7WebCore14JSDOMSelection15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore14JSDOMSelectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DOMSelectionEEE
-__ZN7WebCore14JSDOMSelection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSDOMSelectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24jsDOMSelectionRangeCountEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12DOMSelection10rangeCountEv
-__ZN7WebCore30jsHTMLImageElementNaturalWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement12naturalWidthEv
-__ZN7WebCore31jsHTMLImageElementNaturalHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement13naturalHeightEv
-__ZN7WebCore6Editor18shouldBeginEditingEPNS_5RangeE
-__ZN7WebCore6Editor15didBeginEditingEv
-__ZN7WebCore41jsDOMSelectionPrototypeFunctionGetRangeAtEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore14JSDOMSelection9classInfoEv
-__ZN7WebCore12DOMSelection10getRangeAtEiRi
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_5RangeE
-__ZN7WebCore7JSRange15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore7JSRangeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5RangeEEE
-__ZN7WebCore24jsDOMSelectionAnchorNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12DOMSelection10anchorNodeEv
-__ZN7WebCore26jsDOMSelectionAnchorOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12DOMSelection12anchorOffsetEv
-__ZN7WebCore23jsDOMSelectionFocusNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12DOMSelection9focusNodeEv
-__ZN7WebCore25jsDOMSelectionFocusOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12DOMSelection11focusOffsetEv
-__ZN7WebCore7JSRange18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16JSRangePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30jsRangeCommonAncestorContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44jsDocumentPrototypeFunctionQueryCommandStateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document17queryCommandStateERKNS_6StringE
-__ZN7WebCoreL9stateBoldEPNS_5FrameEPNS_5EventE
-__ZN7WebCoreL10stateStyleEPNS_5FrameEiPKc
-__ZNK7WebCore6Editor17selectionHasStyleEPNS_19CSSStyleDeclarationE
-__ZNK7WebCore5Frame22selectionComputedStyleERPNS_4NodeE
-__ZN7WebCoreL11updateStateEPNS_26CSSMutableStyleDeclarationEPNS_27CSSComputedStyleDeclarationERbRNS_8TriStateE
-__ZN7WebCoreL11stateItalicEPNS_5FrameEPNS_5EventE
-__ZN7WebCoreL14stateUnderlineEPNS_5FrameEPNS_5EventE
-__ZN7WebCore44jsDocumentPrototypeFunctionQueryCommandValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document17queryCommandValueERKNS_6StringE
-__ZNK7WebCore6Editor7Command5valueEPNS_5EventE
-__ZN7WebCoreL13valueFontNameEPNS_5FrameEPNS_5EventE
-__ZN7WebCoreL10valueStyleEPNS_5FrameEi
-__ZNK7WebCore5Frame32selectionStartStylePropertyValueEi
-__ZN7WebCore15jsStringOrFalseEPN3JSC9ExecStateERKNS_6StringE
-__ZN7WebCoreL13valueFontSizeEPNS_5FrameEPNS_5EventE
-__ZN7WebCoreL16stateOrderedListEPNS_5FrameEPNS_5EventE
-__ZNK7WebCore6Editor25selectionOrderedListStateEv
-__ZN7WebCoreL18stateUnorderedListEPNS_5FrameEPNS_5EventE
-__ZNK7WebCore6Editor27selectionUnorderedListStateEv
-__ZN7WebCore38jsDocumentPrototypeFunctionCreateRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore32jsRangePrototypeFunctionSetStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore7JSRange9classInfoEv
-__ZN7WebCore30jsRangePrototypeFunctionSetEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore27jsDOMWindowRangeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7JSRange14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore18JSRangeConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore16JSRangePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18JSRangeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19jsRangeEND_TO_STARTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore45jsRangePrototypeFunctionCompareBoundaryPointsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7toRangeEN3JSC10JSValuePtrE
-__ZNK7WebCore5Range21compareBoundaryPointsENS0_10CompareHowEPKS0_Ri
-__ZN7WebCore19jsRangeSTART_TO_ENDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17isStartOfDocumentERKNS_15VisiblePositionE
-__ZN7WebCore21jsRangeStartContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsRangeEndContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsRangeStartOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16jsRangeEndOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL27enabledInRichlyEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCoreL17executeToggleBoldEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCoreL18executeToggleStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiPKcS5_
-__ZNK7WebCore6Editor22selectionStartHasStyleEPNS_19CSSStyleDeclarationE
-__ZN7WebCore6Editor10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCore17ApplyStyleCommandC1EPNS_8DocumentEPNS_19CSSStyleDeclarationENS_10EditActionENS0_14EPropertyLevelE
-__ZNK7WebCore17ApplyStyleCommand17nodeFullySelectedEPNS_4NodeERKNS_8PositionES5_
-__ZN7WebCore17ApplyStyleCommand15isHTMLStyleNodeEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
-__ZN7WebCore17ApplyStyleCommand19removeHTMLFontStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
-__ZN7WebCore17ApplyStyleCommand28removeHTMLBidiEmbeddingStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
-__ZN7WebCore17ApplyStyleCommand14removeCSSStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
-__ZN7WebCore20CompositeEditCommand19removeNodeAttributeEN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameE
-__ZN7WebCore20CompositeEditCommand16setNodeAttributeEN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore23SetNodeAttributeCommandC1EN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore23SetNodeAttributeCommand7doApplyEv
-__ZN7WebCore11StyleChange29checkForLegacyHTMLStyleChangeEPKNS_11CSSPropertyE
-__ZN7WebCore17createHTMLElementEPNS_8DocumentERKNS_13QualifiedNameE
-__ZN7WebCore17ApplyStyleCommand28surroundNodeRangeWithElementEPNS_4NodeES2_N3WTF10PassRefPtrINS_7ElementEEE
-__ZNK7WebCore17ApplyStyleCommand13editingActionEv
-__ZN7WebCoreL19executeToggleItalicEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCoreL16executeUnderlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore22createStyleSpanElementEPNS_8DocumentE
-__ZN7WebCoreL20styleSpanClassStringEv
-__ZN7WebCore42jsElementPrototypeFunctionGetAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Element16getAttributeNodeERKNS_6StringE
-__ZN7WebCore15jsAttrSpecifiedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL15executeFontNameEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCoreL17executeApplyStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
-__ZN7WebCoreL19isUnstyledStyleSpanEPKNS_4NodeE
-__ZN7WebCoreL17createFontElementEPNS_8DocumentE
-__ZNK7WebCore17JSHTMLFontElement9classInfoEv
-__ZN7WebCoreL15executeFontSizeEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCoreL16executeForeColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL14isEditableLeafEPNS_9InlineBoxE
+__ZN7WebCore19AccessibilityObject16doAXLineForIndexEj
+-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]
+__ZN7WebCore25AccessibilityRenderObject20setSelectedTextRangeERKNS_14PlainTextRangeE
+__ZN7WebCore9CSSParser20parseTransformOriginEiRiS1_S1_RN3WTF6RefPtrINS_8CSSValueEEES6_S6_
+__ZN7WebCore9CSSParser29parseTransformOriginShorthandERN3WTF6RefPtrINS_8CSSValueEEES5_S5_
+__ZNK7WebCore24RotateTransformOperation16getOperationTypeEv
+__ZNK7WebCore14HTMLCollection8nextItemEv
+__ZNK7WebCore15PropertyWrapperINS_6LengthEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS6_S9_d
+__ZNK7WebCore11RenderStyle4leftEv
+__ZN7WebCore11RenderStyle7setLeftENS_6LengthE
+__ZN7WebCore18CompositeAnimation16resumeAnimationsEv
+__ZN7WebCore13AnimationBase16getNumPropertiesEv
+__ZNK7WebCore18CompositeAnimation23getAnimationForPropertyEi
+__ZNK7WebCore17KeyframeAnimation23hasAnimationForPropertyEi
+__ZNK3WTF7HashMapIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3getERKi
+__ZN7WebCore13AnimationBase15propertiesEqualEiPKNS_11RenderStyleES3_
+__ZNK7WebCore21PropertyWrapperGetterINS_6LengthEE6equalsEPKNS_11RenderStyleES5_
+__ZNK7WebCore11RenderStyle3topEv
+__ZN7WebCore17ImplicitAnimationC1EPKNS_9AnimationEiPNS_12RenderObjectEPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN7WebCore17ImplicitAnimationC2EPKNS_9AnimationEiPNS_12RenderObjectEPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN3WTF7HashMapIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3setERKiRKS4_
+__ZNK7WebCore11RenderStyle5widthEv
+__ZN7WebCore17ImplicitAnimation7animateEPNS_18CompositeAnimationEPNS_12RenderObjectEPKNS_11RenderStyleEPS5_RN3WTF6RefPtrIS5_EE
+__ZN7WebCore17ImplicitAnimation5resetEPNS_11RenderStyleE
+__ZN7WebCore17ImplicitAnimation12endAnimationEb
+__ZN7WebCore17ImplicitAnimation29validateTransformFunctionListEv
+__ZN7WebCore11RenderStyle8setWidthENS_6LengthE
+__ZN7WebCore11RenderStyle6setTopENS_6LengthE
+__ZN7WebCore17ImplicitAnimation17timeToNextServiceEv
+__ZN7WebCore13AnimationBase18overrideAnimationsEv
+__ZN7WebCore13AnimationBase16onAnimationStartEd
+__ZNK7WebCore17ImplicitAnimation10overriddenEv
+__ZN7WebCore17ImplicitAnimation14startAnimationEd
+__ZN7WebCore17ImplicitAnimation21isTargetPropertyEqualEiPKNS_11RenderStyleE
+__ZNK7WebCore19AnimationController24numberOfActiveAnimationsEv
+__ZNK7WebCore26AnimationControllerPrivate24numberOfActiveAnimationsEv
+__ZNK7WebCore18CompositeAnimation24numberOfActiveAnimationsEv
+__ZNK7WebCore11RenderStyle6heightEv
+__ZN7WebCore11RenderStyle9setHeightENS_6LengthE
+__ZN7WebCore17ImplicitAnimationD0Ev
+__ZN7WebCore29jsDOMWindowCSSRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCSSRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSCSSRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsCSSRuleWEBKIT_KEYFRAMES_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsCSSRuleWEBKIT_KEYFRAME_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19AnimationController20pauseAnimationAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore26AnimationControllerPrivate20pauseAnimationAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore18CompositeAnimation20pauseAnimationAtTimeERKNS_12AtomicStringEd
+__ZNK7WebCore13AnimationBase8durationEv
+__ZN7WebCore13AnimationBase11pauseAtTimeEd
+__ZN7WebCore13AnimationBase15updatePlayStateEb
+__ZN7WebCore22externalRepresentationEPNS_12RenderObjectE
+__ZN7WebCore20writeRenderResourcesERNS_10TextStreamEPNS_4NodeE
+__ZN7WebCoreL11writeLayersERNS_10TextStreamEPKNS_11RenderLayerEPS2_RKNS_7IntRectEi
+__ZN7WebCoreL5writeERNS_10TextStreamERNS_11RenderLayerERKNS_7IntRectES6_S6_S6_ii
+__ZN7WebCoreL11writeIndentERNS_10TextStreamEi
+__ZN7WebCore10TextStreamlsEPKc
+__ZN7WebCorelsERNS_10TextStreamERKNS_7IntRectE
+__ZN7WebCore10TextStreamlsEi
+__ZNK7WebCore7IntRect8containsERKS0_
+__ZN7WebCore5writeERNS_10TextStreamERKNS_12RenderObjectEi
+__ZNK7WebCore12RenderObject12isRenderPathEv
+__ZNK7WebCore12RenderObject10isSVGImageEv
+__ZNK7WebCore10RenderView10renderNameEv
+__ZN7WebCoreL10getTagNameEPNS_4NodeE
+__ZNK7WebCore11RenderBlock10renderNameEv
+__ZN7WebCore10TextStreamlsERKNS_6StringE
+__ZNK7WebCore10RenderText10renderNameEv
+__ZNK7WebCore10RenderText9firstRunYEv
+__ZNK7WebCore10RenderText9firstRunXEv
+__ZN7WebCore27quoteAndEscapeNonPrintablesERKNS_6StringE
 __ZNK7WebCore5Color4nameEv
-__ZN7WebCore16jsRangeCollapsedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL16executeBackColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore7JSRangeD0Ev
-__ZN7WebCore39jsRangePrototypeFunctionExtractContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore5Range15extractContentsERi
-__ZN7WebCore5Range18checkDeleteExtractERi
-__ZNK7WebCore5Range19containedByReadOnlyEv
-__ZN7WebCore5Range15processContentsENS0_10ActionTypeERi
-__ZN7WebCore34jsRangePrototypeFunctionCloneRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore32jsRangePrototypeFunctionCollapseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore34jsRangePrototypeFunctionInsertNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore5Range10insertNodeEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZN7WebCore10TextStream7releaseEv
+__ZN7WebCore20JSCSSRuleConstructorD1Ev
+__ZN7WebCore27TranslateTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZN7WebCore12GCController17garbageCollectNowEv
+__ZN7WebCore20WebKitAnimationEventC1Ev
+__ZN7WebCore20WebKitAnimationEventC2Ev
+__ZN7WebCore33jsWebKitAnimationEventElapsedTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20WebKitAnimationEvent11elapsedTimeEv
+__ZN7WebCore10MouseEventC1Ev
+__ZN7WebCore10MouseEventC2Ev
+__ZN7WebCore17MouseRelatedEventC2Ev
+__ZN7WebCore7UIEventC2Ev
+__ZN7WebCore43jsDocumentPrototypeFunctionElementFromPointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11RenderLayer25createLocalTransformStateEPS0_S1_RKNS_7IntRectERKNS_8IntPointEPKNS_24HitTestingTransformStateE
+__ZN7WebCore24HitTestingTransformState14applyTransformERKNS_20TransformationMatrixENS0_21TransformAccumulationE
+__ZNK7WebCore24HitTestingTransformState11mappedPointEv
+__ZNK7WebCore20TransformationMatrix12projectPointERKNS_10FloatPointE
+__ZNK7WebCore24HitTestingTransformState10mappedQuadEv
+__ZNK7WebCore20TransformationMatrix11projectQuadERKNS_9FloatQuadE
+__ZN7WebCore24HitTestingTransformState7flattenEv
+__ZN7WebCore24HitTestingTransformState20flattenWithTransformERKNS_20TransformationMatrixE
+__ZN7WebCore9CSSParser28parseAnimationIterationCountEv
+__ZN7WebCore16CSSStyleSelector26mapAnimationIterationCountEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore17KeyframeAnimation20onAnimationIterationEd
+__ZNK7WebCore24RotateTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore24RotateTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZNK7WebCore24RotateTransformOperationeqERKNS_18TransformOperationE
+__ZN7WebCore13jsCSSRuleTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsWebKitCSSKeyframesRuleNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSWebKitCSSKeyframesRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore31setJSWebKitCSSKeyframesRuleNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22WebKitCSSKeyframesRule7setNameERKNS_6StringE
+__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8CSSValueE
+__ZNK7WebCore8CSSValue25isWebKitCSSTransformValueEv
+__ZNK7WebCore8CSSValue10isSVGPaintEv
+__ZNK7WebCore8CSSValue10isSVGColorEv
+__ZN7WebCore19JSCSSPrimitiveValue15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSCSSValuePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSCSSValue15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSCSSPrimitiveValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17CSSPrimitiveValueEEE
+__ZN7WebCore19JSCSSPrimitiveValueC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17CSSPrimitiveValueEEE
+__ZN7WebCore10JSCSSValueC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8CSSValueEEE
+__ZN7WebCore19JSCSSPrimitiveValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10JSCSSValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSCSSPrimitiveValuePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsDOMWindowCSSPrimitiveValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSCSSPrimitiveValue14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSCSSPrimitiveValueConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore28JSCSSPrimitiveValuePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSCSSPrimitiveValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsCSSPrimitiveValueCSS_NUMBEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionGetFloatValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19JSCSSPrimitiveValue9classInfoEv
+__ZN7WebCore19JSCSSPrimitiveValueD1Ev
+__ZN7WebCore10JSCSSValueD2Ev
+__ZN7WebCore19JSCSSValuePrototypeD1Ev
+__ZN7WebCore28JSCSSPrimitiveValuePrototypeD1Ev
+__ZN7WebCore30JSCSSPrimitiveValueConstructorD1Ev
+__ZN7WebCore33JSWebKitCSSKeyframesRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore51jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore24JSWebKitCSSKeyframesRule9classInfoEv
+__ZN7WebCore22WebKitCSSKeyframesRule10deleteRuleERKNS_6StringE
+__ZNK7WebCore22WebKitCSSKeyframesRule13findRuleIndexERKNS_6StringE
+__ZN7WebCore11CSSRuleList10deleteRuleEj
+__ZN7WebCore51jsWebKitCSSKeyframesRulePrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore22WebKitCSSKeyframesRule10insertRuleERKNS_6StringE
+__ZN7WebCore9CSSParser17parseKeyframeRuleEPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore9CSSParser23parseAnimationDirectionEv
+__ZN7WebCore16CSSStyleSelector21mapAnimationDirectionEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore37jsDOMWindowWebKitCSSMatrixConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow15webKitCSSMatrixEPN3JSC9ExecStateE
+__ZN7WebCore28JSWebKitCSSMatrixConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore28JSWebKitCSSMatrixConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSWebKitCSSMatrixPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSWebKitCSSMatrix15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSWebKitCSSMatrixConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL24constructWebKitCSSMatrixEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore15WebKitCSSMatrixC1ERKNS_6StringERi
+__ZN7WebCore15WebKitCSSMatrixC2ERKNS_6StringERi
+__ZN7WebCore15WebKitCSSMatrix14setMatrixValueERKNS_6StringERi
+__ZNK7WebCore24MatrixTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore24MatrixTransformOperationD0Ev
+__ZN7WebCore17JSWebKitCSSMatrixC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WebKitCSSMatrixEEE
+__ZN7WebCore17JSWebKitCSSMatrixC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WebKitCSSMatrixEEE
+__ZN7WebCore17JSWebKitCSSMatrix18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixBEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixFEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL16getDurationValueEPKNS_13AnimationListE
+__ZN7WebCoreL22getTimingFunctionValueEPKNS_13AnimationListE
+__ZNK7WebCore22CSSTimingFunctionValue7cssTextEv
+__ZN7WebCore22CSSTimingFunctionValueD0Ev
+__ZN7WebCore17JSWebKitCSSMatrixD1Ev
+__ZN7WebCore17JSWebKitCSSMatrixD2Ev
+__ZN7WebCore15WebKitCSSMatrixD0Ev
+__ZN7WebCore26JSWebKitCSSMatrixPrototypeD1Ev
+__ZN7WebCore28JSWebKitCSSMatrixConstructorD1Ev
+__ZN7WebCoreL13getDelayValueEPKNS_13AnimationListE
+__ZN7WebCore43jsDOMWindowWebKitCSSKeyframeRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSWebKitCSSKeyframeRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSWebKitCSSKeyframeRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSWebKitCSSKeyframeRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore44jsDOMWindowWebKitCSSKeyframesRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSWebKitCSSKeyframesRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore33JSWebKitCSSKeyframesRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37jsStyleSheetListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSStyleSheetList9classInfoEv
+__ZN7WebCore34jsCSSRuleListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore13JSCSSRuleList9classInfoEv
+__ZN7WebCore32jsWebKitCSSKeyframesRuleCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21WebKitCSSKeyframeRule4typeEv
+__ZN7WebCore23JSWebKitCSSKeyframeRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitCSSKeyframeRuleEEE
+__ZN7WebCore23JSWebKitCSSKeyframeRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitCSSKeyframeRuleEEE
+__ZN7WebCore23JSWebKitCSSKeyframeRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsWebKitCSSKeyframeRuleKeyTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsWebKitCSSKeyframeRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsDOMWindowCSSStyleDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSCSSStyleDeclarationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27jsCSSStyleDeclarationLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore49jsWebKitCSSKeyframesRulePrototypeFunctionFindRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore22WebKitCSSKeyframesRule8findRuleERKNS_6StringE
+__ZN7WebCore22WebKitCSSKeyframesRule4itemEj
+__ZN7WebCore23JSWebKitCSSKeyframeRuleD1Ev
+__ZN7WebCore35JSWebKitCSSKeyframesRuleConstructorD1Ev
+__ZN7WebCore32JSWebKitCSSKeyframeRulePrototypeD1Ev
+__ZN7WebCore34JSWebKitCSSKeyframeRuleConstructorD1Ev
+__ZN7WebCore32JSCSSStyleDeclarationConstructorD1Ev
+__ZNK7WebCore11RenderStyle10lineHeightEv
+__ZN7WebCore11RenderStyle13setLineHeightENS_6LengthE
+__ZNK7WebCore24MatrixTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZNK7WebCore24MatrixTransformOperation16getOperationTypeEv
+__ZN7WebCore24MatrixTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZNK7WebCore24MatrixTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore21PropertyWrapperGetterIRKNS_19TransformOperationsEE6equalsEPKNS_11RenderStyleES7_
+__ZN7WebCore17ImplicitAnimation13setOverriddenEb
+__ZN7WebCoreL16printBorderStyleERNS_10TextStreamENS_12EBorderStyleE
+__ZNK7WebCore14RenderListItem10renderNameEv
+__ZNK7WebCore16RenderListMarker10renderNameEv
+__ZNK7WebCore11RenderTable10renderNameEv
+__ZNK7WebCore18RenderTableSection10renderNameEv
+__ZNK7WebCore14RenderTableRow10renderNameEv
+__ZNK7WebCore15RenderTableCell10renderNameEv
+__ZNK7WebCore12RenderInline10renderNameEv
+__ZNK7WebCore11RenderImage10renderNameEv
+__ZNK7WebCore8RenderBR10renderNameEv
+__ZNK7WebCore12RenderObject16isBoxModelObjectEv
+__ZN7WebCoreL12toAlphabeticEiPKti
+__ZN7WebCoreL7toRomanEib
+__ZN7WebCore11CSSSelector11setArgumentERKNS_12AtomicStringE
+__ZNK7WebCore14SimpleFontData17smallCapsFontDataERKNS_15FontDescriptionE
+__ZN7WebCore16FontPlatformData7setFontEP6NSFont
+__ZN7WebCore18RenderTextFragmentC1EPNS_4NodeEPNS_10StringImplEii
+__ZN7WebCore18RenderTextFragmentC2EPNS_4NodeEPNS_10StringImplEii
+__ZNK7WebCore12RenderObject22firstLineStyleSlowCaseEv
+__ZNK7WebCore11RenderBlock14firstLineBlockEv
+__ZN7WebCore15RenderScrollbar24scrollbarForStyleResolveEv
+__ZNK7WebCore17HTMLObjectElement24imageSourceAttributeNameEv
+__ZN7WebCore9CSSParser12parseCounterEiib
+__ZN7WebCore9CSSParser19parseCounterContentEPNS_18CSSParserValueListEb
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_7CounterEEE
+__ZN7WebCoreL16applyCounterListEPNS_11RenderStyleEPNS_12CSSValueListEb
+__ZN7WebCore11RenderStyle23accessCounterDirectivesEv
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS2_17CounterDirectivesEENS_18PairFirstExtractorIS7_EENS
+__ZN7WebCore11RenderStyle10setContentEPNS_14CounterContentEb
+__ZN7WebCore13RenderCounterC1EPNS_8DocumentERKNS_14CounterContentE
+__ZN7WebCore13RenderCounterC2EPNS_8DocumentERKNS_14CounterContentE
+__ZNK7WebCore13RenderCounter9isCounterEv
+__ZN7WebCore13RenderCounter14calcPrefWidthsEi
+__ZNK7WebCore13RenderCounter12originalTextEv
+__ZN7WebCoreL7counterEPNS_12RenderObjectERKNS_12AtomicStringEb
+__ZNK7WebCore11RenderStyle17counterDirectivesEv
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS
+__ZN7WebCore11CounterNodeC1EPNS_12RenderObjectEbi
+__ZN7WebCore11CounterNodeC2EPNS_12RenderObjectEbi
+__ZN7WebCoreL11counterMapsEv
+__ZN3WTF7HashMapIPKN7WebCore12RenderObjectEPNS0_INS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_7PtrHashIS7_EENS_10H
+__ZN3WTF9HashTableIPKN7WebCore12RenderObjectESt4pairIS4_PNS_7HashMapINS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEEPNS2_11CounterNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_PNS2_11CounterNodeEENS_18PairFirstExtractorIS8_EENS_7Ptr
+__ZN7WebCore11CounterNode11insertAfterEPS0_S1_
+__ZNK7WebCore11CounterNode20computeCountInParentEv
+__ZNK3WTF7HashMapIPKN7WebCore12RenderObjectEPNS0_INS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_7PtrHashIS7_EENS_10
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEEPNS2_11CounterNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE
+__ZNK7WebCore13RenderCounter10renderNameEv
+__ZN7WebCore13RenderCounterD0Ev
+__ZN7WebCore13RenderCounter19destroyCounterNodesEPNS_12RenderObjectE
+__ZN7WebCore11CounterNode11removeChildEPS0_
+__ZN7WebCore11CounterNode7recountEv
+__ZN7WebCoreL10toGeorgianEi
+__ZN3WTFeqINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEEEb
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS2_17CounterDirectivesEENS_18PairFirstExtractorIS7_EEN
+__ZN7WebCoreeqERKNS_17CounterDirectivesES2_
+__ZN7WebCore21RenderObjectChildList18invalidateCountersEPNS_12RenderObjectE
+__ZN7WebCoreL29invalidateCountersInContainerEPNS_12RenderObjectE
+__ZN7WebCore13RenderCounter10invalidateEv
+__ZN7WebCore24jsHTMLMetaElementContentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement7contentEv
+__ZN7WebCore9CSSParser13parseFillSizeEv
+__ZN7WebCore16CSSStyleSelector11mapFillSizeEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore17jsDocumentDoctypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTitleElement4textEv
+__ZN7WebCore24jsDocumentImplementationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17DOMImplementationE
+__ZN7WebCore19JSDOMImplementation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSDOMImplementationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17DOMImplementationEEE
+__ZN7WebCore19JSDOMImplementationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17DOMImplementationEEE
+__ZN7WebCore19JSDOMImplementation18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSDOMImplementationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore46jsDOMImplementationPrototypeFunctionHasFeatureEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19JSDOMImplementation9classInfoEv
+__ZN7WebCore48jsDocumentPrototypeFunctionCreateEntityReferenceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document21createEntityReferenceERKNS_6StringERi
+__ZN7WebCore27getExceptionCodeDescriptionEiRNS_24ExceptionCodeDescriptionE
+__ZN7WebCore13ExceptionBaseC2ERKNS_24ExceptionCodeDescriptionE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_16DOMCoreExceptionE
+__ZN7WebCore18JSDOMCoreException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSDOMCoreExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DOMCoreExceptionEEE
+__ZN7WebCore18JSDOMCoreExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DOMCoreExceptionEEE
+__ZNK3JSC8JSObject22isNotAnObjectErrorStubEv
+__ZN7WebCore18JSDOMCoreException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSDOMCoreExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK3JSC8JSObject19isWatchdogExceptionEv
+__ZN7WebCore22jsDOMCoreExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12DocumentType19removedFromDocumentEv
+__ZThn8_N7WebCore12DocumentTypeD0Ev
+__ZN7WebCore18JSDOMCoreExceptionD1Ev
+__ZN7WebCore18JSDOMCoreExceptionD2Ev
+__ZN7WebCore19JSDOMImplementationD1Ev
+__ZN7WebCore19JSDOMImplementationD2Ev
+__ZThn8_N7WebCore16HTMLTitleElementD0Ev
+__ZN7WebCore27JSDOMCoreExceptionPrototypeD1Ev
+__ZN7WebCore28JSDOMImplementationPrototypeD1Ev
+__ZN7WebCore54jsDocumentPrototypeFunctionCreateProcessingInstructionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore8Document27createProcessingInstructionERKNS_6StringES3_Ri
+__ZNK7WebCore6JSAttr9classInfoEv
+__ZN7WebCore4Attr16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore4Attr15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore4Node9nodeValueEv
+__ZN7WebCore45jsDocumentPrototypeFunctionCreateCDATASectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document18createCDATASectionERKNS_6StringERi
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_12CDATASectionE
+__ZN7WebCore8Document9cloneNodeEb
+__ZN7WebCore18jsNodeNamespaceURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore50jsDOMImplementationPrototypeFunctionCreateDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14toDocumentTypeEN3JSC7JSValueE
+__ZN7WebCore17DOMImplementation14createDocumentERKNS_6StringES3_PNS_12DocumentTypeERi
+__ZN7WebCore8Document15createElementNSERKNS_6StringES3_Ri
+__ZN7WebCore8Document26hasPrefixNamespaceMismatchERKNS_13QualifiedNameE
+__ZN7WebCore14JSDocumentType15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSDocumentTypeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DocumentTypeEEE
+__ZN7WebCore14JSDocumentTypeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DocumentTypeEEE
+__ZN7WebCore14JSDocumentType18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore8Document13createElementERKNS_12AtomicStringERi
+__ZN7WebCoreL15headConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore35jsNamedNodeMapPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Attr8nodeNameEv
+__ZNK7WebCore18JSHTMLTitleElement9classInfoEv
+__ZN7WebCore4Node26willMoveToNewOwnerDocumentEv
+__ZN7WebCore21updateDOMNodeDocumentEPNS_4NodeEPNS_8DocumentES3_
+__ZN7WebCore4Node25didMoveToNewOwnerDocumentEv
+__ZN7WebCore14JSDocumentTypeD1Ev
+__ZN7WebCore42jsDocumentPrototypeFunctionCreateAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document15createAttributeERKNS_6StringERi
+__ZN7WebCore8Document17createAttributeNSERKNS_6StringES3_Rib
+__ZN7WebCore23JSDocumentTypePrototypeD1Ev
+__ZN7WebCore4Attr9cloneNodeEb
+__ZN7WebCore6JSAttr3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore4Attr12setNodeValueERKNS_6StringERi
+__ZN7WebCore4Attr8setValueERKNS_6StringERi
+__ZN7WebCore14setJSAttrValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore6JSAttr8setValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore32jsNodePrototypeFunctionNormalizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node9normalizeEv
+__ZNK7WebCore4Node25traverseNextNodePostOrderEv
+__ZN7WebCore7Element19normalizeAttributesEv
+__ZN7WebCore8Document15textNodesMergedEPNS_4TextEj
+__ZN7WebCore4Node6removeERi
+__ZN7WebCore42jsCharacterDataPrototypeFunctionAppendDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore45jsCharacterDataPrototypeFunctionSubstringDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore43jsCharacterDataPrototypeFunctionReplaceDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsCharacterDataPrototypeFunctionInsertDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CharacterData11replaceDataEjjRKNS_6StringERi
+__ZNK7WebCore7Comment8nodeNameEv
+__ZNK7WebCore16DocumentFragment8nodeNameEv
+__ZN7WebCore18jsDocumentTypeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsElementPrototypeFunctionSetAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9JSElement16setAttributeNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore6toAttrEN3JSC7JSValueE
+__ZN7WebCore7Element16setAttributeNodeEPNS_4AttrERi
+__ZN7WebCore12NamedNodeMap12setNamedItemEPNS_4NodeERi
+__ZNK7WebCore4Attr15isAttributeNodeEv
+__ZN7WebCore45jsElementPrototypeFunctionRemoveAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element19removeAttributeNodeEPNS_4AttrERi
+__ZN7WebCore43jsNamedNodeMapPrototypeFunctionSetNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore46jsNamedNodeMapPrototypeFunctionRemoveNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13StyledElement25didMoveToNewOwnerDocumentEv
+__ZNK7WebCore12DocumentType8nodeNameEv
+__ZN7WebCore4Node12setNodeValueERKNS_6StringERi
+__ZN7WebCore32jsTextPrototypeFunctionSplitTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore4Text9splitTextEjRi
 __ZN7WebCore4Text9createNewEN3WTF10PassRefPtrINS_10StringImplEEE
 __ZN7WebCore8Document13textNodeSplitEPNS_4TextE
-__ZN7WebCore5Range13textNodeSplitEPNS_4TextE
-__ZN7WebCore30jsRangePrototypeFunctionDetachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore5Range6detachERi
-__ZN7WebCore46jsDOMSelectionPrototypeFunctionRemoveAllRangesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12DOMSelection15removeAllRangesEv
-__ZN7WebCore47jsDOMSelectionPrototypeFunctionSetBaseAndExtentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12DOMSelection16setBaseAndExtentEPNS_4NodeEiS2_iRi
-__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionES3_b
-__ZN7WebCore31SimplifiedBackwardsTextIterator17handleNonTextNodeEv
-__ZN7WebCore31SimplifiedBackwardsTextIterator21handleReplacedElementEv
-__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionInsertCellEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19HTMLTableRowElement10insertCellEiRi
-__ZN7WebCore25setJSHTMLInputElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement7setSizeEj
-__ZN7WebCore6String6numberEj
-__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionInsertRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore23HTMLTableSectionElement9insertRowEiRi
-__ZN7WebCore36jsDOMSelectionPrototypeFunctionEmptyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12DOMSelection5emptyEv
-__ZN7WebCore23SetNodeAttributeCommandD1Ev
-__ZN7WebCore6Editor16shouldEndEditingEPNS_5RangeE
-__ZN7WebCore6Editor13didEndEditingEv
-__ZN7WebCore32jsHTMLInputElementSelectionStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore18JSHTMLInputElement14selectionStartEPN3JSC9ExecStateE
-__ZNK7WebCore16HTMLInputElement16canHaveSelectionEv
-__ZN7WebCore35setJSHTMLInputElementSelectionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore18JSHTMLInputElement17setSelectionStartEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement17setSelectionStartEi
-__ZN7WebCore33setJSHTMLInputElementSelectionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore18JSHTMLInputElement15setSelectionEndEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement15setSelectionEndEi
-__ZN7WebCore27setJSHTMLTableElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLTableElement9setBorderERKNS_6StringE
-__ZN7WebCore30setJSHTMLTableCellElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement8setWidthERKNS_6StringE
-__ZN7WebCore31setJSHTMLTableCellElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement9setHeightERKNS_6StringE
-__ZN7WebCoreL24executeInsertOrderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17InsertListCommandC1EPNS_8DocumentENS0_4TypeERKNS_6StringE
-__ZN7WebCore17InsertListCommand7doApplyEv
-__ZN7WebCore21createListItemElementEPNS_8DocumentE
-__ZN7WebCore22outermostEnclosingListEPNS_4NodeE
-__ZN7WebCore13enclosingListEPNS_4NodeE
-__ZN7WebCore18enclosingTableCellERKNS_8PositionE
-__ZN7WebCore24createOrderedListElementEPNS_8DocumentE
-__ZN7WebCore20CompositeEditCommand13moveParagraphERKNS_15VisiblePositionES3_S3_bb
-__ZN7WebCore20CompositeEditCommand14moveParagraphsERKNS_15VisiblePositionES3_S3_bb
-__ZN7WebCoreL32elementHasTextDecorationPropertyEPKNS_4NodeE
-__ZN7WebCoreL34styleFromMatchedRulesAndInlineDeclEPKNS_4NodeE
-__ZN7WebCoreL31styleFromMatchedRulesForElementEPNS_7ElementEb
-__ZN7WebCore16CSSStyleSelector20styleRulesForElementEPNS_7ElementEb
-__ZN7WebCore26CSSMutableStyleDeclaration5mergeEPS0_b
-__ZN7WebCore26CSSMutableStyleDeclaration21removeBlockPropertiesEv
-__ZN7WebCore24createFragmentFromMarkupEPNS_8DocumentERKNS_6StringES4_
-__ZN7WebCore20CompositeEditCommand15deleteSelectionEbbbb
-__ZN7WebCore22DeleteSelectionCommandC1EPNS_8DocumentEbbbb
-__ZN7WebCore20CompositeEditCommand27removeNodeAndPruneAncestorsEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore20CompositeEditCommand5pruneEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore17CSSPrimitiveValue18computeLengthFloatEPNS_11RenderStyleEdb
-__ZN7WebCore23ReplaceSelectionCommand28removeNodePreservingChildrenEPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand28removeNodePreservingChildrenEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore35RemoveNodePreservingChildrenCommandC1EN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore35RemoveNodePreservingChildrenCommand7doApplyEv
-__ZN7WebCore23ReplaceSelectionCommand27removeNodeAndPruneAncestorsEPNS_4NodeE
-__ZN7WebCore30stringWithRebalancedWhitespaceERKNS_6StringEbb
-__ZNK7WebCore6Editor25shouldShowDeleteInterfaceEPNS_11HTMLElementE
-__ZNK7WebCore17InsertListCommand20preservesTypingStyleEv
-__ZNK7WebCore17InsertListCommand13editingActionEv
-__ZN7WebCoreL26executeInsertUnorderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20CompositeEditCommand15insertNodeAfterEN3WTF10PassRefPtrINS_4NodeEEES4_
-__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCore26createUnorderedListElementEPNS_8DocumentE
-__ZN7WebCoreL14executeOutdentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20IndentOutdentCommandC1EPNS_8DocumentENS0_11EIndentTypeEi
-__ZN7WebCore20IndentOutdentCommand7doApplyEv
-__ZN7WebCore20IndentOutdentCommand13outdentRegionEv
-__ZN7WebCore20IndentOutdentCommand16outdentParagraphEv
-__ZN7WebCoreL24isListOrIndentBlockquoteEPKNS_4NodeE
-__ZN7WebCoreL18isIndentBlockquoteEPKNS_4NodeE
-__ZNK7WebCore20IndentOutdentCommand20preservesTypingStyleEv
-__ZNK7WebCore20IndentOutdentCommand13editingActionEv
-__ZN7WebCoreL13executeIndentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20IndentOutdentCommand12indentRegionEv
-__ZN7WebCore30selectionForParagraphIterationERKNS_9SelectionE
-__ZN7WebCore23indexForVisiblePositionERNS_15VisiblePositionE
-__ZN7WebCoreL29createIndentBlockquoteElementEPNS_8DocumentE
-__ZN7WebCoreL22indentBlockquoteStringEv
-__ZN7WebCore20CompositeEditCommand15splitTreeToNodeEPNS_4NodeES2_b
-__ZN7WebCore20IndentOutdentCommand34prepareBlockquoteLevelForInsertionERNS_15VisiblePositionERN3WTF6RefPtrINS_7ElementEEE
-__ZN7WebCore12startOfBlockERKNS_15VisiblePositionE
-__ZN7WebCoreL18executeFormatBlockEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore13validBlockTagERKNS_6StringE
-__ZN7WebCore18FormatBlockCommandC1EPNS_8DocumentERKNS_12AtomicStringE
-__ZN7WebCore18FormatBlockCommand7doApplyEv
-__ZN7WebCore25enclosingBlockFlowElementERKNS_15VisiblePositionE
-__ZN7WebCore17createHTMLElementEPNS_8DocumentERKNS_12AtomicStringE
-__ZN7WebCore17ApplyStyleCommand26extractTextDecorationStyleEPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand17removeCSSPropertyEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE13CSSPropertyID
-__ZN7WebCore24RemoveCSSPropertyCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE13CSSPropertyID
-__ZN7WebCore24RemoveCSSPropertyCommand7doApplyEv
-__ZN7WebCore17ApplyStyleCommand24applyTextDecorationStyleEPNS_4NodeEPNS_26CSSMutableStyleDeclarationE
-__ZNK7WebCore18FormatBlockCommand13editingActionEv
-__ZN7WebCoreL18executeJustifyLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCoreL26executeApplyParagraphStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
-__ZN7WebCore6Editor19applyParagraphStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCore20CompositeEditCommand42moveParagraphContentsToNewBlockIfNecessaryERKNS_8PositionE
-__ZN7WebCore20CompositeEditCommand34insertNewDefaultParagraphElementAtERKNS_8PositionE
-__ZN7WebCore17ApplyStyleCommand13addBlockStyleERKNS_11StyleChangeEPNS_11HTMLElementE
-__ZN7WebCoreL20executeJustifyCenterEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCoreL19executeJustifyRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore35jsDOMWindowPrototypeFunctionConfirmEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9DOMWindow7confirmERKNS_6StringE
-__ZN7WebCore6Chrome20runJavaScriptConfirmEPNS_5FrameERKNS_6StringE
-__ZN7WebCore21PageGroupLoadDeferrerC1EPNS_4PageEb
-__ZN7WebCore21PageGroupLoadDeferrerD1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE6shrinkEm
-__ZN7WebCoreL16executeMoveRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore19SelectionController17modifyMovingRightENS_15TextGranularityE
-__ZNK7WebCore15VisiblePosition5rightEb
-__ZNK7WebCore15VisiblePosition30rightVisuallyDistinctCandidateEv
-__ZN7WebCoreL15executeMoveDownEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore19SelectionController19modifyMovingForwardENS_15TextGranularityE
-__ZN7WebCore16nextLinePositionERKNS_15VisiblePositionEi
-__ZN7WebCore32setJSHTMLTextAreaElementReadOnlyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore6Editor15insertLineBreakEv
-__ZN7WebCore13TypingCommand15insertLineBreakEPNS_8DocumentE
-__ZN7WebCore13TypingCommand15insertLineBreakEv
-__ZN7WebCore22InsertLineBreakCommandC1EPNS_8DocumentE
-__ZN7WebCore22InsertLineBreakCommand7doApplyEv
-__ZN7WebCore22InsertLineBreakCommand21shouldUseBreakElementERKNS_8PositionE
-__ZN7WebCore20CompositeEditCommand19rebalanceWhitespaceEv
-__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextEN3WTF10PassRefPtrINS_4TextEEEjj
-__ZN7WebCore29jsHTMLTextAreaElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15FormDataBuilder28generateUniqueBoundaryStringEv
-__ZN7WebCore15FormDataBuilder20beginMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_7CStringES7_
-__ZN7WebCore15FormDataBuilder28addBoundaryToMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_7CStringEb
-__ZN7WebCore15FormDataBuilder21finishMultiPartHeaderERN3WTF6VectorIcLm0EEE
-__ZN7WebCore12DOMSelection15disconnectFrameEv
-__ZN7WebCore44jsHTMLTableElementPrototypeFunctionDeleteRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16HTMLTableElement9deleteRowEiRi
-__ZThn8_N7WebCore24DocumentThreadableLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZN7WebCore24DocumentThreadableLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZThn8_N7WebCore14XMLHttpRequest15didGetCancelledEv
-__ZN7WebCore14XMLHttpRequest15didGetCancelledEv
-__ZN7WebCore14XMLHttpRequest10abortErrorEv
-__ZN7WebCore14XMLHttpRequest12genericErrorEv
-__ZNK7WebCore11FrameLoader20childFramesMatchItemEPNS_11HistoryItemE
-__ZThn68_N7WebCore19HTMLTextAreaElement12restoreStateERKNS_6StringE
-__ZN7WebCore19HTMLTextAreaElement12restoreStateERKNS_6StringE
-__ZN7WebCore19HTMLTextAreaElement15setDefaultValueERKNS_6StringE
-__ZN7WebCore24DocumentThreadableLoader6cancelEv
-__ZN7WebCore23jsHTMLAnchorElementHashEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement4hashEv
-__ZN7WebCore20setJSDOMWindowOpenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11FrameLoader20checkNewWindowPolicyERKNS_16NavigationActionERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringE
-__ZN7WebCore11PolicyCheck3setERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEPFvPvS3_S7_SA_bESB_
-__ZN7WebCore11FrameLoader28continueAfterNewWindowPolicyENS_12PolicyActionE
-__ZN7WebCore11FrameLoader36callContinueLoadAfterNewWindowPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEb
-__ZN7WebCore11FrameLoader32continueLoadAfterNewWindowPolicyERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEb
+__ZN7WebCore44jsDocumentPrototypeFunctionCreateAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateDocumentTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore17DOMImplementation18createDocumentTypeERKNS_6StringES3_S3_Ri
+__ZN7WebCore40jsElementPrototypeFunctionSetAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9JSElement14setAttributeNSEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13MutationEventC1Ev
+__ZN7WebCore13MutationEventC2Ev
+__ZNK7WebCore13MutationEvent15isMutationEventEv
+__ZN7WebCore15getDOMStructureINS_15JSMutationEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore15JSMutationEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSMutationEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MutationEventEEE
+__ZN7WebCore15JSMutationEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MutationEventEEE
+__ZN7WebCore15JSMutationEventD1Ev
+__ZN7WebCore7UIEventC1Ev
+__ZNK7WebCore5Event14isSVGZoomEventEv
+__ZN7WebCore15getDOMStructureINS_9JSUIEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore9JSUIEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7UIEventEEE
+__ZN7WebCore9JSUIEventD1Ev
+__ZN7WebCore24JSMutationEventPrototypeD1Ev
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14EventExceptionE
+__ZN7WebCore16JSEventException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSEventExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14EventExceptionEEE
+__ZN7WebCore16JSEventExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14EventExceptionEEE
+__ZN7WebCore16JSEventException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL24getJSEventExceptionTableEPN3JSC9ExecStateE
+__ZN7WebCore25JSEventExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL33getJSEventExceptionPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore16JSEventExceptionD1Ev
+__ZN7WebCore16JSEventExceptionD2Ev
+__ZN7WebCore20jsEventExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSEventExceptionPrototypeD1Ev
+__ZNK7WebCore15JSMutationEvent9classInfoEv
+__ZNK7WebCore9JSUIEvent9classInfoEv
+__ZN7WebCore15JSMutationEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSMutationEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement18containsJavaAppletEv
+__ZNK7WebCore17HTMLObjectElement4typeEv
+__ZN7WebCore17HTMLObjectElement21renderFallbackContentEv
+__ZN7WebCore28jsHTMLAnchorElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement9accessKeyEv
+__ZN7WebCore26jsHTMLAnchorElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement7charsetEv
+__ZN7WebCore25jsHTMLAnchorElementCoordsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement6coordsEv
+__ZN7WebCore27jsHTMLAnchorElementHreflangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8hreflangEv
+__ZN7WebCore22jsHTMLAnchorElementRevEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement3revEv
+__ZN7WebCore24jsHTMLAnchorElementShapeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement5shapeEv
+__ZNK7WebCore17HTMLAnchorElement8tabIndexEv
+__ZN7WebCore8Document18focusedNodeRemovedEv
+__ZN7WebCore24jsHTMLAppletElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLPlugInElement5alignEv
+__ZN7WebCore17HTMLAppletElement19removedFromDocumentEv
+__ZThn8_N7WebCore17HTMLAppletElementD0Ev
+__ZN7WebCore22jsHTMLAppletElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement3altEv
+__ZN7WebCore26jsHTMLAppletElementArchiveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement7archiveEv
+__ZN7WebCore23jsHTMLAppletElementCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement4codeEv
+__ZN7WebCore27jsHTMLAppletElementCodeBaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement8codeBaseEv
+__ZN7WebCore25jsHTMLAppletElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLPlugInElement6heightEv
+__ZN7WebCore25jsHTMLAppletElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement6hspaceEv
+__ZN7WebCore23jsHTMLAppletElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLAppletElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement6vspaceEv
+__ZN7WebCore24jsHTMLAppletElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLPlugInElement5widthEv
+__ZN7WebCore25jsHTMLAppletElementObjectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement6objectEv
+__ZN7WebCore26jsHTMLAreaElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement9accessKeyEv
+__ZN7WebCore20jsHTMLAreaElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement3altEv
+__ZN7WebCore23jsHTMLAreaElementCoordsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement6coordsEv
+__ZN7WebCore21jsHTMLAreaElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLAreaElementNoHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement6noHrefEv
+__ZN7WebCore22jsHTMLAreaElementShapeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement5shapeEv
+__ZN7WebCore23jsHTMLAreaElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement6targetEv
+__ZN7WebCore20jsHTMLBRElementClearEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLBRElement5clearEv
+__ZN7WebCoreL28createHTMLBaseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLBaseElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLBaseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBaseElementEEE
+__ZN7WebCore17JSHTMLBaseElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBaseElementEEE
+__ZN7WebCore17JSHTMLBaseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLBaseElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15HTMLBaseElement19removedFromDocumentEv
+__ZN7WebCore17JSHTMLBaseElementD1Ev
+__ZThn8_N7WebCore15HTMLBaseElementD0Ev
+__ZNK7WebCore12RenderObject7isFrameEv
+__ZN7WebCore23jsHTMLBaseElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBaseElement6targetEv
+__ZN7WebCore19HTMLFrameSetElement11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore26JSHTMLBaseElementPrototypeD1Ev
+__ZN7WebCoreL32createHTMLBaseFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLBaseFontElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLBaseFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLBaseFontElementEEE
+__ZN7WebCore21JSHTMLBaseFontElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLBaseFontElementEEE
+__ZN7WebCore21JSHTMLBaseFontElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsHTMLBaseFontElementColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLBaseFontElement5colorEv
+__ZN7WebCore21JSHTMLBaseFontElementD1Ev
+__ZThn8_N7WebCore19HTMLBaseFontElementD0Ev
+__ZN7WebCore25jsHTMLBaseFontElementFaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLBaseFontElement4faceEv
+__ZN7WebCore30JSHTMLBaseFontElementPrototypeD1Ev
+__ZN7WebCore25jsHTMLBaseFontElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLBaseFontElement4sizeEv
+__ZN7WebCore22jsHTMLBodyElementALinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement5aLinkEv
+__ZN7WebCore27jsHTMLBodyElementBackgroundEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLBodyElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement7bgColorEv
+__ZN7WebCore21jsHTMLBodyElementLinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14CachedResource18destroyDecodedDataEv
+__ZN7WebCore24JSMimeTypeArrayPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZThn8_N7WebCore17HTMLObjectElementD0Ev
+__ZThn8_N7WebCore16HTMLParamElementD0Ev
+__ZN7WebCore24setJSHTMLMetaElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLMetaElement7setNameERKNS_6StringE
+__ZN7WebCore27setJSHTMLMetaElementContentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLMetaElement10setContentERKNS_6StringE
+__ZN7WebCore26jsHTMLMetaElementHttpEquivEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement9httpEquivEv
+__ZN7WebCore12RenderButton28removeLeftoverAnonymousBlockEPNS_11RenderBlockE
+__ZN7WebCore9FrameView23removeSlowRepaintObjectEv
+__ZN7WebCore5XPathL12createFunNotEv
+__ZNK7WebCore5XPath6FunNot8evaluateEv
+__ZN7WebCore5XPath6FunNotD0Ev
+__ZN7WebCore5XPath8FunctionD2Ev
+__ZN7WebCore21jsHTMLBodyElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement4textEv
+__ZN7WebCore22jsHTMLBodyElementVLinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsNodePrototypeFunctionIsSupportedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node11isSupportedERKNS_6StringES3_
+__ZN3JSC8Bindings12ObjcInstance12virtualBeginEv
+__ZNK3JSC8Bindings12ObjcInstance8getClassEv
+__ZN3JSC8Bindings9ObjcClass11classForIsAEP10objc_class
+__ZN3JSC8Bindings9ObjcClassC1EP10objc_class
+__ZN3JSC8Bindings9ObjcClassC2EP10objc_class
+__ZNK3JSC8Bindings9ObjcClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3JSC8Bindings9ObjcClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZN3JSC8Bindings25convertJSMethodNameToObjcEPKcPcm
+__ZN3JSC8Bindings10ObjcMethodC1EP10objc_classP13objc_selector
+__ZN3JSC8Bindings10ObjcMethodC2EP10objc_classP13objc_selector
+__ZN3JSC8Bindings12ObjcInstance10virtualEndEv
+__ZN3JSC8Bindings12ObjcInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListE
+__ZN3JSC8Bindings12ObjcInstance18setGlobalExceptionEP8NSStringPNS_14JSGlobalObjectE
+__ZNK3JSC8Bindings10ObjcMethod18getMethodSignatureEv
+__ZN3JSC8Bindings20objcValueTypeForTypeEPKc
+__ZN3JSC8Bindings23convertValueToObjcValueEPNS_9ExecStateENS_7JSValueENS0_13ObjcValueTypeE
++[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]
+__ZN3JSC8Bindings23convertNSStringToStringEPNS_9ExecStateEP8NSString
+__ZN3JSC8Bindings12ObjcInstance30moveGlobalExceptionToExecStateEPNS_9ExecStateE
+__ZNK7WebCore14RenderThemeMac22adjustSliderTrackStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore12RenderSliderC1EPNS_16HTMLInputElementE
+__ZN7WebCore12RenderSliderC2EPNS_16HTMLInputElementE
+__ZN7WebCore12RenderSlider14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderSlider17updateFromElementEv
+__ZN7WebCore11SliderRangeC1EPNS_16HTMLInputElementE
+__ZN7WebCore11SliderRangeC2EPNS_16HTMLInputElementE
+__ZN7WebCore11SliderRange16valueFromElementEPNS_16HTMLInputElementEPb
+__ZN7WebCore11SliderRange10clampValueEd
+__ZN7WebCore18SliderThumbElementC1EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore18SliderThumbElementC2EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore12RenderSlider16createThumbStyleEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac22adjustSliderThumbStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore17RenderFlexibleBoxC1EPNS_4NodeE
+__ZN7WebCore11RenderBlock23deleteEllipsisLineBoxesEv
+__ZN7WebCore11RenderBlock25checkLinesForTextOverflowEv
+__ZN7WebCore12RenderSlider6layoutEv
+__ZNK7WebCore14RenderThemeMac21adjustSliderThumbSizeEPNS_12RenderObjectE
+__ZN7WebCore12RenderSlider14calcPrefWidthsEv
+__ZNK7WebCore18SliderThumbElement12isShadowNodeEv
+__ZN7WebCore18SliderThumbElement16shadowParentNodeEv
+__ZNK7WebCore12RenderSlider16baselinePositionEbb
+__ZN7WebCore17RenderFlexibleBox17layoutVerticalBoxEb
+__ZN7WebCore11RenderBlock30markPositionedObjectsForLayoutEv
+__ZN7WebCore11RenderBlock15clearTruncationEv
+__ZN7WebCoreL16shouldCheckLinesEPNS_12RenderObjectE
+__ZN7WebCore13RootInlineBox22canAccommodateEllipsisEbiii
+__ZN7WebCore11RenderBlock9lineCountEv
+__ZN7WebCore13InlineFlowBox22canAccommodateEllipsisEbii
+__ZN7WebCore9InlineBox22canAccommodateEllipsisEbii
+__ZN7WebCore13RootInlineBox13placeEllipsisERKNS_12AtomicStringEbiiiPNS_9InlineBoxE
+__ZN3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore13RootInlineBoxESt4pairIS4_PNS1_11EllipsisBoxEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_1
+__ZN7WebCore13RootInlineBox16placeEllipsisBoxEbiiiRb
+__ZN7WebCore13InlineFlowBox16placeEllipsisBoxEbiiiRb
+__ZN7WebCore13InlineTextBox16placeEllipsisBoxEbiiiRb
+__ZN3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE4takeERKS4_
+__ZN7WebCore11EllipsisBoxD0Ev
 __ZN7WebCore10ScrollView36adjustScrollbarsAvoidingResizerCountEi
 __ZN7WebCore9FrameView14invalidateRectERKNS_7IntRectE
-__ZN7WebCore8Document18focusedNodeRemovedEv
-__ZN7WebCore28jsHTMLBodyElementScrollWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLBodyElement11scrollWidthEv
-__ZN7WebCore12EventHandler30passMousePressEventToScrollbarERNS_28MouseEventWithHitTestResultsEPNS_9ScrollbarE
-__ZN7WebCore9Scrollbar9mouseDownERKNS_18PlatformMouseEventE
-__ZN7WebCore9Scrollbar14setPressedPartENS_13ScrollbarPartE
-__ZN7WebCore17ScrollbarThemeMac27initialAutoscrollTimerDelayEv
-__ZN7WebCore9Scrollbar21autoscrollPressedPartEd
-__ZN7WebCore9Scrollbar9moveThumbEi
-__ZN7WebCore9Scrollbar7mouseUpEv
-__ZN7WebCore26setJSHTMLEmbedElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLPlugInElement8setWidthERKNS_6StringE
-__ZN7WebCore23jsHTMLFormElementMethodEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsDocumentStyleSheetsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore8Document11styleSheetsEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14StyleSheetListE
-__ZN7WebCore16JSStyleSheetList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSStyleSheetListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14StyleSheetListEEE
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS2_8Bindings17PrivateIdentifierEENS_18PairFirstExtractorISA_EENS_7StrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSG_IS9_EEEESH_E4findIS5_NS_22IdentityHashTranslatorIS5_SA_SE_EEEENS_17HashTableIteratorIS5_SA_SC_SE_SJ_SH_EERKT_
--[WebCoreResourceHandleAsDelegate connection:willStopBufferingData:]
-__ZN7WebCore14ResourceLoader21willStopBufferingDataEPNS_14ResourceHandleEPKci
-__ZN7WebCore14ResourceLoader21willStopBufferingDataEPKci
-__ZN7WebCore8FileListC1Ev
-__ZN7WebCoreL24urlEscapedEntityCallbackEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
-__ZN7WebCore27setJSHTMLSelectElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLSelectElement8setValueERKNS_6StringE
-__ZThn12_NK7WebCore14XMLHttpRequest10canSuspendEv
-__ZNK7WebCore14XMLHttpRequest10canSuspendEv
+__ZN7WebCore6Chrome7repaintERKNS_7IntRectEbbb
+__ZN7WebCore14RenderThemeMac16paintSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCoreL24TrackGradientInterpolateEPvPKdPd
+__ZNK7WebCore12RenderSlider8isSliderEv
+__ZN7WebCore14RenderThemeMac16paintSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac21sliderThumbHorizontalEv
+__ZNK7WebCore12RenderSlider10inDragModeEv
 __ZN7WebCore15ActiveDOMObject7suspendEv
-__ZL21jsDOMWindowBaseOptionPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore19JSOptionConstructorC1EPN3JSC9ExecStateEPNS_22ScriptExecutionContextE
-__ZN7WebCore19JSOptionConstructor16getConstructDataERN3JSC13ConstructDataE
-__ZN7WebCoreL26constructHTMLOptionElementEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
-__ZN7WebCore17HTMLOptionElement18setDefaultSelectedEb
-__ZN7WebCore23JSHTMLOptionsCollection3putEPN3JSC9ExecStateEjNS1_10JSValuePtrE
-__ZN7WebCore23JSHTMLOptionsCollection11indexSetterEPN3JSC9ExecStateEjNS1_10JSValuePtrE
-__ZN7WebCore17selectIndexSetterEPNS_17HTMLSelectElementEPN3JSC9ExecStateEjNS2_10JSValuePtrE
-__ZN7WebCore19toHTMLOptionElementEN3JSC10JSValuePtrE
-__ZN7WebCore17HTMLSelectElement9setOptionEjPNS_17HTMLOptionElementERi
-__ZN7WebCore17HTMLSelectElement3addEPNS_11HTMLElementES2_Ri
-__ZN7WebCore28setJSEventTargetNodeOnchangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode11setOnchangeEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore12RenderObject16inlineBoxWrapperEv
-__ZNK7WebCore17RenderTextControl9scrollTopEv
-__ZN7WebCore33jsHTMLTextAreaElementSelectionEndEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19HTMLTextAreaElement12selectionEndEv
-__ZN7WebCore22InsertLineBreakCommandD1Ev
-__ZN7WebCore17RenderTextControl12setScrollTopEi
-__ZNK7WebCore17HTMLSelectElement17canStartSelectionEv
+__ZN7WebCore23jsHTMLButtonElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLButtonElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement9accessKeyEv
+__ZN7WebCore27jsHTMLButtonElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLButtonElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore22HTMLFormControlElement8tabIndexEv
+__ZN7WebCore23jsHTMLButtonElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement15formControlTypeEv
+__ZN7WebCore24jsHTMLButtonElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement5valueEv
+__ZN7WebCore22jsHTMLTableElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16HTMLTableElement4rowsEv
+__ZN7WebCore23HTMLTableRowsCollection6createEN3WTF10PassRefPtrINS_16HTMLTableElementEEE
+__ZN7WebCore23HTMLTableRowsCollectionC1EN3WTF10PassRefPtrINS_16HTMLTableElementEEE
+__ZN7WebCore23HTMLTableRowsCollectionC2EN3WTF10PassRefPtrINS_16HTMLTableElementEEE
+__ZN7WebCore37jsHTMLCollectionPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSHTMLCollection9classInfoEv
+__ZN7WebCore16JSHTMLCollection4itemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore23HTMLTableRowsCollection9itemAfterEPNS_7ElementE
+__ZN7WebCore23HTMLTableRowsCollection8rowAfterEPNS_16HTMLTableElementEPNS_19HTMLTableRowElementE
+__ZN7WebCore29jsHTMLTableRowElementRowIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement8rowIndexEv
+__ZN7WebCore23HTMLTableRowsCollectionD0Ev
+__ZN7WebCore42jsHTMLCollectionPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSHTMLCollection9namedItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL8isInHeadEPNS_7ElementE
+__ZN7WebCore44jsHTMLTableElementPrototypeFunctionInsertRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement9insertRowEiRi
+__ZN7WebCore16textBreakCurrentEPNS_17TextBreakIteratorE
+__ZN7WebCore37jsPluginArrayPrototypeFunctionRefreshEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore13JSPluginArray9classInfoEv
+__ZN7WebCore11PluginArray7refreshEb
+__ZN7WebCore4Page14refreshPluginsEb
+__ZN7WebCore10PluginData7refreshEv
+__ZN7WebCore19CachedCSSStyleSheet11setEncodingERKNS_6StringE
+__ZN7WebCoreL38min_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL34device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore12compareValueIfEEbT_S1_NS_18MediaFeaturePrefixE
+__ZN7WebCoreL20directoryConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore20HTMLDirectoryElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20HTMLDirectoryElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore20HTMLDirectoryElement17endTagRequirementEv
+__ZNK7WebCore20HTMLDirectoryElement11tagPriorityEv
+__ZN7WebCoreL33createHTMLDirectoryElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore22JSHTMLDirectoryElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSHTMLDirectoryElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLDirectoryElementEEE
+__ZN7WebCore22JSHTMLDirectoryElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLDirectoryElementEEE
+__ZN7WebCore22JSHTMLDirectoryElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLDirectoryElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLDirectoryElement7compactEv
+__ZN7WebCore22JSHTMLDirectoryElementD1Ev
+__ZThn8_N7WebCore20HTMLDirectoryElementD0Ev
+__ZN7WebCore20HTMLDirectoryElementD0Ev
+__ZN7WebCore21jsHTMLDivElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLDivElement5alignEv
+__ZN7WebCore31JSHTMLDirectoryElementPrototypeD1Ev
+__ZN7WebCore25jsHTMLDListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLDListElement7compactEv
+__ZN7WebCore30jsHTMLIFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLIFrameElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLIFrameElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23jsHTMLFormElementActionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL30createHTMLLegendElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLLegendElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLLegendElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLLegendElementEEE
+__ZN7WebCore19JSHTMLLegendElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLLegendElementEEE
+__ZN7WebCore19JSHTMLLegendElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLLegendElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore30JSHTMLIFrameElementConstructorD1Ev
+__ZN7WebCore19JSHTMLLegendElementD1Ev
+__ZN7WebCore28JSHTMLLegendElementPrototypeD1Ev
+__ZN7WebCore17jsDocumentAnchorsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7anchorsEv
+__ZNK7WebCore14RenderThemeMac35adjustSearchFieldResultsButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore23jsHTMLSelectElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30setJSHTMLButtonElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26jsHTMLInputElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore14HTMLMapElementD0Ev
+__ZN7WebCore14RenderThemeMac29paintSearchFieldResultsButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac18searchMenuTemplateEv
+__ZNK7WebCore13HTMLTokenizer15executingScriptEv
+__ZN7WebCore22jsHTMLTitleElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsHTMLDocumentHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument6heightEv
+__ZN7WebCore19jsHTMLDocumentWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument5widthEv
+__ZN7WebCore20jsHTMLDocumentEmbedsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document6embedsEv
+__ZN7WebCore26jsHTMLImageElementCompleteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement8completeEv
+__ZN7WebCore30jsHTMLImageElementNaturalWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement12naturalWidthEv
+__ZN7WebCore21jsHTMLDocumentPluginsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7pluginsEv
+__ZN7WebCore20jsNavigatorVendorSubEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase9vendorSubEv
+__ZN7WebCore17jsScreenAvailLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen9availLeftEv
+__ZN7WebCore16jsScreenAvailTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen8availTopEv
+__ZN7WebCore14XMLHttpRequest24loadRequestSynchronouslyERNS_15ResourceRequestERi
+__ZN7WebCore16ThreadableLoader25loadResourceSynchronouslyEPNS_22ScriptExecutionContextERKNS_15ResourceRequestERNS_22ThreadableL
+__ZN7WebCore24DocumentThreadableLoader25loadResourceSynchronouslyEPNS_8DocumentERKNS_15ResourceRequestERNS_22ThreadableLoaderCl
+__ZN7WebCore11FrameLoader25loadResourceSynchronouslyERKNS_15ResourceRequestENS_17StoredCredentialsERNS_13ResourceErrorERNS_16Re
+__ZN7WebCore19ResourceRequestBase18setTimeoutIntervalEd
+__ZN7WebCore14ResourceHandle25loadResourceSynchronouslyERKNS_15ResourceRequestENS_17StoredCredentialsERNS_13ResourceErrorERNS_1
++[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]
+-[WebCoreSynchronousLoader _isDone]
+-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]
+-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]
+-[WebCoreSynchronousLoader connection:didReceiveResponse:]
+-[WebCoreSynchronousLoader connection:didReceiveData:]
+-[WebCoreSynchronousLoader connectionDidFinishLoading:]
+-[WebCoreSynchronousLoader _data]
+-[WebCoreSynchronousLoader _response]
+-[WebCoreSynchronousLoader _error]
+-[WebCoreSynchronousLoader dealloc]
+__ZN3WTF6RefPtrIN7WebCore10StringImplEEaSERKS3_
+__ZN7WebCore16ResourceResponseD2Ev
+__ZN7WebCore29setJSDOMWindowTextConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20jsDOMWindowOnkeydownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9onkeydownEv
+__ZN7WebCore23setJSDOMWindowOnkeydownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow12setOnkeydownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore27jsHTMLInputElementMaxLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement9maxLengthEv
+__ZN7WebCore13jsNodeOnkeyupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onkeyupEv
+__ZN7WebCoreL25min_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL21widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore16CSSStyleSelector36addViewportDependentMediaQueryResultEPKNS_13MediaQueryExpEb
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE15reserveCapacityEm
+__ZThn8_N7WebCore15HTMLHeadElementD0Ev
+__ZN7WebCore21jsHTMLLinkElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement4typeEv
+__ZN7WebCore23jsHTMLScriptElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement4typeEv
+__ZN7WebCore16DocumentFragment9cloneNodeEb
+__ZNK7WebCore26CSSMutableStyleDeclaration10get4ValuesEPKi
+__ZN7WebCore14RenderListItem16setExplicitValueEi
+__ZN7WebCore14RenderListItem20explicitValueChangedEv
+__ZN7WebCore10HTMLParser23noembedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE6shrinkEm
+__ZN7WebCore5Cache18revalidationFailedEPNS_14CachedResourceE
+__ZN7WebCore9FrameView20postLayoutTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore14CachedResource19httpStatusCodeErrorEv
+__ZN7WebCore19CachedCSSStyleSheet5errorEv
+__ZN7WebCore31setJSHTMLAnchorElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement12setAccessKeyERKNS_12AtomicStringE
+__ZN7WebCore21setJSDOMWindowConsoleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL19optgroupConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLOptGroupElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLOptGroupElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLOptGroupElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore19HTMLOptGroupElement19recalcSelectOptionsEv
+__ZN7WebCore19HTMLOptGroupElement6attachEv
+__ZN7WebCore19HTMLOptGroupElement14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN7WebCore19HTMLOptGroupElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore19HTMLOptGroupElement15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore19HTMLOptGroupElement22nonRendererRenderStyleEv
+__ZN7WebCore25jsHTMLFieldSetElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore19HTMLFieldSetElementD0Ev
+__ZN7WebCore22jsHTMLFontElementColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFontElement5colorEv
+__ZN7WebCore12CachedScript5errorEv
+__ZThn8_N7WebCore15HTMLFontElementD0Ev
+__ZN7WebCore21jsHTMLFontElementFaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFontElement4faceEv
+__ZN7WebCore21jsHTMLFontElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFontElement4sizeEv
+__ZN7WebCore10StringImpl37createStrippingNullCharactersSlowCaseEPKtj
+__ZThn112_N7WebCore17HTMLScriptElement18dispatchErrorEventEv
+__ZN7WebCore17HTMLScriptElement18dispatchErrorEventEv
+__ZN7WebCore30jsHTMLFormElementAcceptCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLFormElementEnctypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20setJSNodeTextContentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23jsHTMLFormElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFormElement6targetEv
+__ZN7WebCoreL15compareBoxStartEPKNS_13InlineTextBoxES2_
+__ZSt25__unguarded_linear_insertIPPN7WebCore13InlineTextBoxES2_PFbPKS1_S5_EEvT_T0_T1_
+__ZN7WebCore19HTMLTextAreaElement5resetEv
+__ZN7WebCore19HTMLTextAreaElement14appendFormDataERNS_12FormDataListEb
+__ZN7WebCoreL29createHTMLFrameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLFrameElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLFrameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLFrameElementEEE
+__ZN7WebCore18JSHTMLFrameElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLFrameElementEEE
+__ZN7WebCore18JSHTMLFrameElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLFrameElementFrameBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase11frameBorderEv
+__ZN7WebCore18JSHTMLFrameElementD1Ev
+__ZThn8_N7WebCore16HTMLFrameElementD0Ev
+__ZN7WebCore26jsHTMLFrameElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase8longDescEv
+__ZN7WebCore27JSHTMLFrameElementPrototypeD1Ev
+__ZN7WebCore30jsHTMLFrameElementMarginHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase12marginHeightEv
+__ZN7WebCore29jsHTMLFrameElementMarginWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase11marginWidthEv
+__ZN7WebCore22jsHTMLFrameElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLFrameElementNoResizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLFrameElementScrollingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase9scrollingEv
+__ZN7WebCore21jsHTMLFrameElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsHTMLFrameElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE15reserveCapacityEm
+__ZN7WebCoreL32createHTMLFrameSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLFrameSetElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLFrameSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFrameSetElementEEE
+__ZN7WebCore21JSHTMLFrameSetElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFrameSetElementEEE
+__ZN7WebCore21JSHTMLFrameSetElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSHTMLFrameSetElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_19HTMLFrameSetElementERKNS1_10IdentifierE
+__ZN7WebCore11HTMLElement8childrenEv
+__ZNK7WebCore14HTMLCollection9namedItemERKNS_12AtomicStringE
+__ZNK7WebCore14HTMLCollection17checkForNameMatchEPNS_7ElementEbRKNS_12AtomicStringE
+__ZN7WebCore25jsHTMLFrameSetElementColsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLFrameSetElement4colsEv
+__ZN7WebCore21JSHTMLFrameSetElementD1Ev
+__ZThn8_N7WebCore19HTMLFrameSetElementD0Ev
+__ZN7WebCore25jsHTMLFrameSetElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLFrameSetElement4rowsEv
+__ZN7WebCore30JSHTMLFrameSetElementPrototypeD1Ev
+__ZN7WebCore20jsHTMLHRElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement5alignEv
+__ZThn8_N7WebCore13HTMLHRElementD0Ev
+__ZN7WebCore22jsHTMLHRElementNoShadeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement7noShadeEv
+__ZNK7WebCore11RenderBlock16leftmostPositionEbb
+__ZNK7WebCore9RenderBox16leftmostPositionEbb
+__ZN7WebCore19jsHTMLHRElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement4sizeEv
+__ZSt21__unguarded_partitionIPPN7WebCore13InlineTextBoxES2_PFbPKS1_S5_EET_S8_S8_T0_T1_
+__ZN7WebCore20jsHTMLHRElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement5widthEv
+__ZN7WebCore24jsHTMLHeadElementProfileEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLHeadElement7profileEv
+__ZN7WebCore25jsHTMLHeadingElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18HTMLHeadingElement5alignEv
+__ZN7WebCore24jsHTMLHtmlElementVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLHtmlElement7versionEv
+__ZN7WebCore24jsHTMLIFrameElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLIFrameElement5alignEv
+__ZN3WTF6VectorISt4pairIPtjELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorISt4pairIPtjELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPtjELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIPtjELm0EE6shrinkEm
+__ZN7WebCore30jsHTMLIFrameElementFrameBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLElementOuterHTMLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement9outerHTMLEv
+__ZN7WebCore27jsHTMLIFrameElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLIFrameElementMarginWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLIFrameElementMarginHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLIFrameElementScrollingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLIFrameElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLImageElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement4nameEv
+__ZN7WebCore23jsHTMLImageElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement5alignEv
+__ZN7WebCore24jsHTMLImageElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6borderEv
+__ZN7WebCore24jsHTMLImageElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6hspaceEv
+__ZN7WebCore23jsHTMLImageElementIsMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement5isMapEv
+__ZN7WebCore26jsHTMLImageElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement8longDescEv
+__ZN7WebCore24jsHTMLImageElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLImageElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6vspaceEv
+__ZN7WebCore10StringImpl6secureEt
+__ZN7WebCore30jsHTMLInputElementDefaultValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement12defaultValueEv
+__ZN7WebCore32jsHTMLInputElementDefaultCheckedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement14defaultCheckedEv
+__ZN7WebCore24jsHTMLInputElementAcceptEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement6acceptEv
+__ZN7WebCore27jsHTMLInputElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement9accessKeyEv
+__ZN7WebCore23jsHTMLInputElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement5alignEv
+__ZN7WebCore21jsHTMLInputElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement3altEv
+__ZN7WebCore26jsHTMLInputElementReadOnlyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLInputElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsHTMLInputElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLInputElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement6useMapEv
+__ZN7WebCore40jsHTMLInputElementPrototypeFunctionClickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11HTMLElement5clickEv
+__ZNK7WebCore19CheckedRadioButtons21checkedButtonForGroupERKNS_12AtomicStringE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_16HTMLInputElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERK
+__ZN7WebCore10HTMLParser23isindexCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser13handleIsindexEPNS_5TokenE
+__ZN7WebCore18HTMLIsIndexElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore18HTMLIsIndexElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore16HTMLInputElement14setDefaultNameERKNS_12AtomicStringE
+__ZN7WebCore18HTMLIsIndexElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore27searchableIndexIntroductionEv
+__ZN7WebCoreL31createHTMLIsIndexElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore20JSHTMLIsIndexElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSHTMLIsIndexElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLIsIndexElementEEE
+__ZN7WebCore20JSHTMLIsIndexElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLIsIndexElementEEE
+__ZN7WebCore20JSHTMLIsIndexElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsHTMLIsIndexElementPromptEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18HTMLIsIndexElement6promptEv
+__ZN7WebCore24jsHTMLIsIndexElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18HTMLIsIndexElementD0Ev
+__ZN7WebCore20JSHTMLIsIndexElementD1Ev
+__ZThn8_N7WebCore18HTMLIsIndexElementD0Ev
+__ZN7WebCore29JSHTMLIsIndexElementPrototypeD1Ev
+__ZN7WebCore22jsHTMLLabelElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLLabelElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLLabelElement9accessKeyEv
+__ZN7WebCore33jsDOMWindowPrototypeFunctionCloseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow5closeEv
+__ZNK7WebCore11FrameLoader11openedByDOMEv
+__ZN7WebCore5Frame13scheduleCloseEv
+__ZN7WebCore6Chrome15closeWindowSoonEv
+__ZN7WebCore25jsHTMLLabelElementHtmlForEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLLabelElement7htmlForEv
+__ZN7WebCore23jsHTMLLegendElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore17HTMLLegendElementD0Ev
+__ZN7WebCore28jsHTMLLegendElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLLegendElement9accessKeyEv
+__ZN7WebCore24jsHTMLLegendElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLLegendElement5alignEv
+__ZN7WebCore25jsHTMLLinkElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement8disabledEv
+__ZN7WebCore24jsHTMLLinkElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement7charsetEv
+__ZN7WebCore19HTMLOptGroupElement6detachEv
+__ZN7WebCore25jsHTMLLinkElementHreflangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement8hreflangEv
+__ZN7WebCore19HTMLOptGroupElementD0Ev
+__ZN7WebCore22jsHTMLLinkElementMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement5mediaEv
+__ZN7WebCore20jsHTMLLinkElementRevEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement3revEv
+__ZN7WebCore23jsHTMLLinkElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement6targetEv
+__ZN7WebCore21jsHTMLMapElementAreasEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14HTMLMapElement5areasEv
+__ZN7WebCore20jsHTMLMapElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLMapElement4nameEv
+__ZN7WebCoreL15menuConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLMenuElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLMenuElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore15HTMLMenuElement17endTagRequirementEv
+__ZNK7WebCore15HTMLMenuElement11tagPriorityEv
+__ZN7WebCoreL28createHTMLMenuElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLMenuElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLMenuElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMenuElementEEE
+__ZN7WebCore17JSHTMLMenuElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMenuElementEEE
+__ZN7WebCore17JSHTMLMenuElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24jsHTMLMenuElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMenuElement7compactEv
+__ZN7WebCore17JSHTMLMenuElementD1Ev
+__ZThn8_N7WebCore15HTMLMenuElementD0Ev
+__ZN7WebCore15HTMLMenuElementD0Ev
+__ZThn8_N7WebCore15HTMLMetaElementD0Ev
+__ZN7WebCore26JSHTMLMenuElementPrototypeD1Ev
+__ZN7WebCore23jsHTMLMetaElementSchemeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement6schemeEv
+__ZN7WebCore20jsHTMLModElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLModElement4citeEv
+__ZThn8_N7WebCore14HTMLModElementD0Ev
+__ZN7WebCore24jsHTMLModElementDateTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLModElement8dateTimeEv
+__ZN7WebCore25jsHTMLOListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLOListElement7compactEv
+__ZN7WebCore23jsHTMLOListElementStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLOListElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLOListElement4typeEv
+__ZN7WebCore23jsHTMLObjectElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLObjectElementCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement4codeEv
+__ZN7WebCore24jsHTMLObjectElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLObjectElementArchiveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement7archiveEv
+__ZN7WebCore25jsHTMLObjectElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6borderEv
+__ZN7WebCore27jsHTMLObjectElementCodeBaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement8codeBaseEv
+__ZN7WebCore27jsHTMLObjectElementCodeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement8codeTypeEv
+__ZN7WebCore23jsHTMLObjectElementDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement4dataEv
+__ZN7WebCore26jsHTMLObjectElementDeclareEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement7declareEv
+__ZN7WebCore25jsHTMLObjectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLObjectElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6hspaceEv
+__ZN7WebCore26jsHTMLObjectElementStandbyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement7standbyEv
+__ZN7WebCore23jsHTMLObjectElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLObjectElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6useMapEv
+__ZN7WebCore25jsHTMLObjectElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6vspaceEv
+__ZN7WebCore24jsHTMLObjectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLObjectElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLObjectElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL32createHTMLOptGroupElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLOptGroupElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLOptGroupElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLOptGroupElementEEE
+__ZN7WebCore21JSHTMLOptGroupElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLOptGroupElementEEE
+__ZN7WebCore21JSHTMLOptGroupElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLOptGroupElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLOptGroupElementD1Ev
+__ZThn8_N7WebCore19HTMLOptGroupElementD0Ev
+__ZN7WebCore26jsHTMLOptGroupElementLabelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLOptGroupElement5labelEv
+__ZN7WebCore30JSHTMLOptGroupElementPrototypeD1Ev
+__ZN7WebCore23jsHTMLOptionElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore17HTMLOptionElementD0Ev
+__ZN7WebCore34jsHTMLOptionElementDefaultSelectedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLOptionElement15defaultSelectedEv
+__ZN7WebCore23jsHTMLOptionElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLOptionElement4textEv
+__ZN7WebCore24jsHTMLOptionElementIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLOptionElementLabelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLOptionElement5labelEv
+__ZN7WebCore32JSHTMLOptionsCollectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSHTMLOptionsCollection9classInfoEv
+__ZN7WebCore16HTMLInputElement39unregisterForActivationCallbackIfNeededEv
+__ZN7WebCore27jsHTMLParagraphElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLParagraphElement5alignEv
+__ZN7WebCore27jsHTMLParamElementValueTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLParamElement9valueTypeEv
+__ZN7WebCore22jsHTMLParamElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLParamElement4typeEv
+__ZN7WebCore21jsHTMLPreElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLPreElement5widthEv
+__ZN7WebCoreL16quoteConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLQuoteElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLQuoteElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLQuoteElement17endTagRequirementEv
+__ZNK7WebCore16HTMLQuoteElement11tagPriorityEv
+__ZN7WebCore16HTMLQuoteElement20insertedIntoDocumentEv
+__ZN7WebCoreL29createHTMLQuoteElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLQuoteElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLQuoteElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLQuoteElementEEE
+__ZN7WebCore18JSHTMLQuoteElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLQuoteElementEEE
+__ZN7WebCore18JSHTMLQuoteElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsHTMLQuoteElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLQuoteElement4citeEv
+__ZN7WebCore18JSHTMLQuoteElementD1Ev
+__ZThn8_N7WebCore16HTMLQuoteElementD0Ev
+__ZN7WebCore16HTMLQuoteElementD0Ev
+__ZN7WebCoreL34createHTMLBlockquoteElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore23JSHTMLBlockquoteElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSHTMLBlockquoteElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLBlockquoteElementEEE
+__ZN7WebCore23JSHTMLBlockquoteElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLBlockquoteElementEEE
+__ZN7WebCore23JSHTMLBlockquoteElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsHTMLBlockquoteElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21HTMLBlockquoteElement4citeEv
+__ZN7WebCore23JSHTMLBlockquoteElementD1Ev
+__ZThn8_N7WebCore21HTMLBlockquoteElementD0Ev
+__ZN7WebCore27JSHTMLQuoteElementPrototypeD1Ev
+__ZN7WebCore23jsHTMLScriptElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement4textEv
+__ZN7WebCore32JSHTMLBlockquoteElementPrototypeD1Ev
+__ZN7WebCore26jsHTMLScriptElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement7charsetEv
+__ZN7WebCore24jsHTMLScriptElementDeferEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement5deferEv
+__ZN7WebCore26jsHTMLScriptElementHtmlForEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement7htmlForEv
+__ZN7WebCore24jsHTMLScriptElementEventEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement5eventEv
+__ZN7WebCore23jsHTMLSelectElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLSelectElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLSelectElementMultipleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLSelectElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLSelectElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement18dispatchFocusEventEv
+__ZN7WebCore17HTMLSelectElement26listBoxDefaultEventHandlerEPNS_5EventE
 __ZN7WebCore17HTMLSelectElement17dispatchBlurEventEv
-__ZN7WebCore17HTMLSelectElement16menuListOnChangeEv
-__ZN7WebCore12EventHandler13freeClipboardEv
-__ZNK7WebCore12EventHandler23createDraggingClipboardEv
-__ZN7WebCore12EventHandler20dispatchDragSrcEventERKNS_12AtomicStringERKNS_18PlatformMouseEventE
-__ZN7WebCore12EventHandler17dispatchDragEventERKNS_12AtomicStringEPNS_4NodeERKNS_18PlatformMouseEventEPNS_9ClipboardE
-__ZNK7WebCore9Clipboard15sourceOperationERNS_13DragOperationE
-__ZN7WebCore14DragController9startDragEPNS_5FrameEPNS_9ClipboardENS_13DragOperationERKNS_18PlatformMouseEventERKNS_8IntPointEb
-__ZN7WebCoreL8getImageEPNS_7ElementE
-__ZN7WebCore12ClipboardMac7hasDataEv
-__ZNK7WebCore13HitTestResult16altDisplayStringEv
-__ZN7WebCore13displayStringERKNS_6StringEPKNS_4NodeE
-__ZN7WebCore12ClipboardMac24declareAndWriteDragImageEPNS_7ElementERKNS_4KURLERKNS_6StringEPNS_5FrameE
-__ZN7WebCore16LegacyWebArchive6createEPNS_4NodeE
-__ZNK7WebCore16HTMLImageElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZNK7WebCore13StyledElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZN7WebCore26CSSMutableStyleDeclaration23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZN7WebCore17CSSPrimitiveValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
-__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE3addERKS2_
-__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE10appendNodeEPNS_15ListHashSetNodeIS2_EE
-__ZNK3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E8containsIS2_NS_22IdentityHashTranslatorIS2_S2_S5_EEEEbRKT_
-__ZN3WTF7HashSetIN7WebCore4KURLENS1_8KURLHashENS_10HashTraitsIS2_EEE3addERKS2_
-__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E6expandEv
-__ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_16ResourceResponseE
-__ZN7WebCore15ArchiveResourceC1EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_16ResourceResponseE
-__ZNK7WebCore11BitmapImage17filenameExtensionEv
-__ZNK7WebCore11ImageSource17filenameExtensionEv
-__ZN7WebCore36preferredExtensionForImageSourceTypeERKNS_6StringE
-__ZNK7WebCore13HitTestResult9imageRectEv
-__ZN7WebCore14DragController11doImageDragEPNS_7ElementERKNS_8IntPointERKNS_7IntRectEPNS_9ClipboardEPNS_5FrameERS3_
-__ZN7WebCore24createDragImageFromImageEPNS_5ImageE
-__ZNK7WebCore7IntSizecv7_NSSizeEv
-__ZN7WebCore14DragController16maxDragImageSizeEv
-__ZN7WebCore21fitDragImageToMaxSizeEN3WTF9RetainPtrI7NSImageEERKNS_7IntSizeES6_
-__ZN7WebCore13dragImageSizeEN3WTF9RetainPtrI7NSImageEE
-__ZN7WebCore27dissolveDragImageToFractionEN3WTF9RetainPtrI7NSImageEEf
-__ZN7WebCore14DragController12doSystemDragEN3WTF9RetainPtrI7NSImageEERKNS_8IntPointES7_PNS_9ClipboardEPNS_5FrameEb
-__ZN7WebCore8DragDataC1EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
-__ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
-__ZN7WebCore14DragController20dragEnteredOrUpdatedEPNS_8DragDataE
-__ZN7WebCore5Frame15documentAtPointERKNS_8IntPointE
-__ZN7WebCore14DragController15tryDocumentDragEPNS_8DragDataENS_21DragDestinationActionE
-__ZN7WebCore14DragController12tryDHTMLDragEPNS_8DragDataE
-__ZNK7WebCore11FrameLoader7baseURLEv
-__ZNK7WebCore8DragData15createClipboardENS_21ClipboardAccessPolicyE
-__ZN7WebCore9Clipboard18setSourceOperationENS_13DragOperationE
-__ZN7WebCoreL14IEOpFromDragOpENS_13DragOperationE
-__ZN7WebCoreL16createMouseEventEPNS_8DragDataE
-__ZN7WebCore12EventHandler17updateDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
-__ZN7WebCore14DragController14canProcessDragEPNS_8DragDataE
-__ZNK7WebCore8DragData25containsCompatibleContentEv
-__ZNK7WebCore8DragData13containsFilesEv
-__ZN7WebCore14DragController16operationForLoadEPNS_8DragDataE
-__ZN7WebCore14DragController11dragUpdatedEPNS_8DragDataE
-__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
-__ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
-__ZN7WebCore12EventHandler17cancelDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
-__ZN7WebCore12EventHandler14clearDragStateEv
-__ZN7WebCore14DragController10cancelDragEv
-__ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
-__ZN7WebCore9Clipboard23setDestinationOperationENS_13DragOperationE
-__ZN7WebCore14DragController22cleanupAfterSystemDragEv
-__ZN7WebCore15deleteDragImageEN3WTF9RetainPtrI7NSImageEE
-__ZNK7WebCore10WheelEvent12isWheelEventEv
-__ZN7WebCore17RenderTextControl6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZN7WebCore19JSOptionConstructor4markEv
-__ZN7WebCore7DataRefINS_17StyleMultiColDataEE6accessEv
-__ZN7WebCore17StyleMultiColDataC1ERKS0_
-__ZNK7WebCore11RenderBlock9columnGapEv
-__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_PNS1_10ColumnInfoEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCore10RenderView18setBestTruncatedAtEiPNS_9RenderBoxEb
-__ZNK7WebCore11RenderBlock11columnRectsEv
-__ZNK7WebCore17StyleMultiColDataeqERKS0_
-__ZNK7WebCore11RenderBlock20adjustRectForColumnsERNS_7IntRectE
-__ZN7WebCore16HTMLInputElement23documentDidBecomeActiveEv
-__ZN7WebCore11RenderBlock12paintColumnsERNS_12RenderObject9PaintInfoEiib
-__ZNK7WebCore16RenderListMarker18canBeSelectionLeafEv
-__ZN7WebCore16RenderListMarker17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZN7WebCore16RenderListMarker13selectionRectEb
-__ZN7WebCore8RenderBR13selectionRectEb
-__ZN7WebCore38jsDOMWindowHTMLVideoElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLVideoElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLVideoElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLVideoElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLMediaElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLMediaElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore14jsMimeTypeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8MimeType4typeEv
-__ZN7WebCore16jsPluginFilenameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Plugin8filenameEv
-__ZN7WebCoreL17appletConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLAppletElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17HTMLAppletElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLAppletElement11tagPriorityEv
-__ZN7WebCore17HTMLAppletElement20insertedIntoDocumentEv
-__ZN7WebCore17HTMLAppletElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore17HTMLAppletElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore12RenderAppletC2EPNS_17HTMLAppletElementERKN3WTF7HashMapINS_6StringES5_NS_10StringHashENS3_10HashTraitsIS5_EES8_EE
-__ZN7WebCore17HTMLAppletElement21finishParsingChildrenEv
-__ZN7WebCore32jsDOMWindowPrototypeFunctionStopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9DOMWindow4stopEv
-__ZN7WebCore11FrameLoader25scheduleCheckLoadCompleteEv
-__ZN7WebCore24setJSHTMLDivElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore14HTMLDivElement8setAlignERKNS_6StringE
-__ZN7WebCore12RenderApplet6layoutEv
-__ZN7WebCore12RenderApplet23createWidgetIfNecessaryEv
-__ZN7WebCore11FrameLoader22createJavaAppletWidgetERKNS_7IntSizeEPNS_7ElementERKN3WTF7HashMapINS_6StringES8_NS_10StringHashENS6_10HashTraitsIS8_EESB_EE
-__ZN7WebCore12RenderWidget20updateWidgetPositionEv
-__ZN7WebCore11FrameLoader27checkLoadCompleteTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore17jsDocumentAppletsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore8Document7appletsEv
-__ZN7WebCoreL30createHTMLAppletElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLAppletElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSHTMLAppletElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAppletElementEEE
-__ZN7WebCore19JSHTMLAppletElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLAppletElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_17HTMLAppletElementERKNS1_10IdentifierE
-__ZN7WebCore19JSHTMLAppletElement24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17HTMLAppletElement25renderWidgetForJSBindingsEv
-__ZN3JSC8Bindings12JavaInstanceC1EP8_jobjectN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3JSC8Bindings14JObjectWrapperC1EP8_jobject
-__ZN3JSC8Bindings9getJNIEnvEv
-__ZN3JSC8Bindings9getJavaVMEv
-__ZN3JSC8BindingsL21KJS_GetCreatedJavaVMsEPP7JavaVM_lPl
-__ZN3JSC8Bindings12JavaInstance12virtualBeginEv
-__ZNK3JSC8Bindings12JavaInstance8getClassEv
-__ZN3JSC8Bindings9JavaClassC1EP8_jobject
-__ZN3JSC8Bindings13callJNIMethodIP8_jobjectEET_S3_PKcS6_z
-__ZN3JSC8BindingsL14callJNIMethodVIP8_jobjectEET_S3_PKcS6_Pc
-__ZN3JSC8Bindings24getCharactersFromJStringEP8_jstring
-__ZN3JSC8Bindings29getCharactersFromJStringInEnvEP7JNIEnv_P8_jstring
-__ZN3JSC8Bindings27releaseCharactersForJStringEP8_jstringPKc
-__ZN3JSC8Bindings32releaseCharactersForJStringInEnvEP7JNIEnv_P8_jstringPKc
-__ZN3JSC8Bindings9JavaFieldC1EP7JNIEnv_P8_jobject
-__ZN3JSC8Bindings30getUCharactersFromJStringInEnvEP7JNIEnv_P8_jstring
-__ZN3JSC8Bindings33releaseUCharactersForJStringInEnvEP7JNIEnv_P8_jstringPKt
-__ZN3JSC8Bindings20JNITypeFromClassNameEPKc
-__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings5FieldENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3getEPS4_
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS2_8Bindings5FieldEENS_18PairFirstExtractorISA_EENS_7StrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSG_IS9_EEEESH_E6expandEv
-__ZN3JSC8Bindings10JavaMethodC1EP7JNIEnv_P8_jobject
-__ZN3JSC8Bindings13callJNIMethodIlEET_P8_jobjectPKcS6_z
-__ZN3JSC8BindingsL14callJNIMethodVIlEET_P8_jobjectPKcS6_Pc
-__ZN3JSC8Bindings19callJNIStaticMethodIhEET_P7_jclassPKcS6_z
-__ZN7JNIEnv_23CallStaticBooleanMethodEP7_jclassP10_jmethodIDz
-__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS_6VectorIPNS2_8Bindings6MethodELm0EEENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSE_ISB_EEE3getEPS4_
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS_6VectorIPNS2_8Bindings6MethodELm0EEEENS_18PairFirstExtractorISD_EENS_7StrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSJ_ISC_EEEESK_E6expandEv
-__ZN3JSC8Bindings13JavaParameterC1EP7JNIEnv_P8_jstring
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS_6VectorIPNS2_8Bindings6MethodELm0EEEENS_18PairFirstExtractorISD_EENS_7StrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSJ_ISC_EEEESK_E4findIS5_NS_22IdentityHashTranslatorIS5_SD_SH_EEEENS_17HashTableIteratorIS5_SD_SF_SH_SM_SK_EERKT_
-__ZNK3JSC8Bindings9JavaClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZNK3JSC8Bindings9JavaClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZN3JSC8Bindings12JavaInstance10virtualEndEv
-__ZNK7WebCore19JSHTMLAppletElement9classInfoEv
-__ZN7WebCore26setJSHTMLParamElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLParamElement8setValueERKNS_6StringE
-__ZN7WebCoreL32fontCacheATSNotificationCallbackEP27ATSFontNotificationInfoRef_Pv
-__ZN7WebCore9FontCache10invalidateEv
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore16FontPlatformDataEKNS_7HashMapINS1_24FontPlatformDataCacheKeyES3_NS1_28FontPlatformDataCacheKeyHashENS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIS3_EEEEEEvRT0_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore12FontSelectorEEELm0EE15reserveCapacityEm
-__ZN7WebCore15CSSFontSelector20fontCacheInvalidatedEv
-__ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE14deleteAllNodesEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore12FontSelectorEEELm0EE6shrinkEm
-__ZN3JSC8Bindings9JavaClassD1Ev
-__ZN3WTF20deleteAllPairSecondsIPN3JSC8Bindings5FieldEKNS_7HashMapINS_6RefPtrINS1_7UString3RepEEES4_NS_7StrHashIS9_EENS_10HashTraitsIS9_EENSC_IS4_EEEEEEvRT0_
-__ZN3JSC8Bindings14JObjectWrapperD1Ev
-__ZN3WTF15deleteAllValuesIPN3JSC8Bindings6MethodELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN3JSC8Bindings13JavaParameterD0Ev
-__ZN7WebCore29JSHTMLVideoElementConstructorD0Ev
-__ZN7WebCore19JSOptionConstructorD0Ev
+__ZN7WebCore42jsHTMLSelectElementPrototypeFunctionRemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19JSHTMLSelectElement6removeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13toHTMLElementEN3JSC7JSValueE
+__ZN7WebCore17HTMLSelectElement6removeEi
+__ZN7WebCore39jsHTMLSelectElementPrototypeFunctionAddEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26jsHTMLStyleElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLStyleElement8disabledEv
+__ZN7WebCore23jsHTMLStyleElementMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLStyleElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL36createHTMLTableCaptionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore25JSHTMLTableCaptionElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSHTMLTableCaptionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableCaptionElementEEE
+__ZN7WebCore25JSHTMLTableCaptionElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableCaptionElementEEE
+__ZN7WebCore25JSHTMLTableCaptionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsHTMLTableCaptionElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableCaptionElement5alignEv
+__ZN7WebCore25JSHTMLTableCaptionElementD1Ev
+__ZThn8_N7WebCore23HTMLTableCaptionElementD0Ev
+__ZN7WebCore31jsHTMLTableCellElementCellIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement9cellIndexEv
+__ZN7WebCore34JSHTMLTableCaptionElementPrototypeD1Ev
+__ZN7WebCore26jsHTMLTableCellElementAbbrEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLTableCellElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement5alignEv
+__ZN7WebCore26jsHTMLTableCellElementAxisEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTableCellElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement7bgColorEv
+__ZN7WebCore24jsHTMLTableCellElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement2chEv
+__ZN7WebCore27jsHTMLTableCellElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement5chOffEv
+__ZN7WebCore29jsHTMLTableCellElementColSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTableCellElementHeadersEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLTableCellElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement6heightEv
+__ZN7WebCore28jsHTMLTableCellElementNoWrapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement6noWrapEv
+__ZN7WebCore29jsHTMLTableCellElementRowSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLTableCellElementScopeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLTableCellElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement6vAlignEv
+__ZN7WebCore27jsHTMLTableCellElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement5widthEv
+__ZN7WebCore26jsHTMLTableColElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement5alignEv
+__ZThn8_N7WebCore19HTMLTableColElementD0Ev
+__ZN7WebCore23jsHTMLTableColElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement2chEv
+__ZN7WebCore26jsHTMLTableColElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement5chOffEv
+__ZN7WebCore25jsHTMLTableColElementSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLTableColElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement6vAlignEv
+__ZN7WebCore26jsHTMLTableColElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement5widthEv
+__ZN7WebCore25jsHTMLTableElementCaptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLTableSectionElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement5alignEv
+__ZN7WebCore23jsHTMLTableElementTFootEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLTableElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5alignEv
+__ZN7WebCore25jsHTMLTableElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement7bgColorEv
+__ZN7WebCore24jsHTMLTableElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement6borderEv
+__ZN7WebCore29jsHTMLTableElementCellPaddingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement11cellPaddingEv
+__ZN7WebCore29jsHTMLTableElementCellSpacingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement11cellSpacingEv
+__ZN7WebCore23jsHTMLTableElementFrameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5frameEv
+__ZN7WebCore23jsHTMLTableElementRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTableElementSummaryEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLTableElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5widthEv
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement11createTHeadEv
+__ZN7WebCore16HTMLTableElement8setTHeadEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
+__ZN7WebCore16HTMLTableElement11deleteTHeadEv
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZThn8_N7WebCore23HTMLTableSectionElementD0Ev
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement11createTFootEv
+__ZN7WebCore16HTMLTableElement8setTFootEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
+__ZN7WebCore16HTMLTableElement11deleteTFootEv
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore48jsHTMLTableElementPrototypeFunctionCreateCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement13createCaptionEv
+__ZN7WebCore16HTMLTableElement10setCaptionEN3WTF10PassRefPtrINS_23HTMLTableCaptionElementEEERi
+__ZN7WebCore16HTMLTableElement13deleteCaptionEv
+__ZN7WebCore48jsHTMLTableElementPrototypeFunctionDeleteCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16HTMLTableElement8lastBodyEv
+__ZN7WebCore44jsHTMLTableElementPrototypeFunctionDeleteRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement9deleteRowEiRi
+__ZN7WebCore23HTMLTableRowsCollection7lastRowEPNS_16HTMLTableElementE
+__ZN7WebCore36jsHTMLTableRowElementSectionRowIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement15sectionRowIndexEv
+__ZN7WebCore26jsHTMLTableRowElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement5alignEv
+__ZN7WebCore28jsHTMLTableRowElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement7bgColorEv
+__ZN7WebCore23jsHTMLTableRowElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement2chEv
+__ZN7WebCore26jsHTMLTableRowElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement5chOffEv
+__ZN7WebCore27jsHTMLTableRowElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement6vAlignEv
+__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionInsertCellEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19HTMLTableRowElement10insertCellEiRi
+__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionDeleteCellEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19HTMLTableRowElement10deleteCellEiRi
+__ZN7WebCore27jsHTMLTableSectionElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement2chEv
+__ZN7WebCore30jsHTMLTableSectionElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement5chOffEv
+__ZN7WebCore31jsHTMLTableSectionElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement6vAlignEv
+__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionInsertRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23HTMLTableSectionElement9insertRowEiRi
+__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionDeleteRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23HTMLTableSectionElement9deleteRowEiRi
+__ZN7WebCore33jsHTMLTextAreaElementDefaultValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLTextAreaElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTextAreaElement9accessKeyEv
+__ZN7WebCore25jsHTMLTextAreaElementColsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTextAreaElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTextAreaElementReadOnlyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsHTMLTextAreaElementPrototypeFunctionSelectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19HTMLTextAreaElement6selectEv
+__ZN7WebCore25jsHTMLUListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLUListElement7compactEv
+__ZN7WebCore11MediaPlayer12supportsTypeENS_11ContentTypeE
+__ZN7WebCoreL20mimeCommonTypesCacheEv
+__ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
 __ZN7WebCore11SVGDocumentC1EPNS_5FrameE
+__ZN7WebCore11SVGDocumentC2EPNS_5FrameE
 __ZNK7WebCore11SVGDocument13isSVGDocumentEv
-__ZN7WebCore13JSSVGDocument15createPrototypeEPN3JSC9ExecStateE
+__ZN7WebCore13JSSVGDocument15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore13JSSVGDocumentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGDocumentEEE
-__ZN7WebCoreL14commentHandlerEPvPKh
-__ZN7WebCore12XMLTokenizer7commentEPKh
+__ZN7WebCore13JSSVGDocumentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGDocumentEEE
 __ZN7WebCore17SVGElementFactory16createSVGElementERKNS_13QualifiedNameEPNS_8DocumentEb
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_10SVGElementEEEPNS1_8DocumentEbENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSD_ISA_EEE3getERKS3_
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFNS_10PassRefPtrINS1_10SVGElementEEEPNS1_8DocumentEbEENS_18PairFirstExtractorISC_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSI_ISB_EEEESJ_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFNS_10PassRefPtrINS1_10SVGElementEEEPNS1_8DocumentEbEENS_18PairFirstExtractorISC_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSI_ISB_EEEESJ_E4findIS3_NS_22IdentityHashTranslatorIS3_SC_SG_EEEENS_17HashTableIteratorIS3_SC_SE_SG_SL_SJ_EERKT_
-__ZN7WebCoreL14svgConstructorEPNS_8DocumentEb
+__ZN7WebCoreL6addTagERKNS_13QualifiedNameEPFN3WTF10PassRefPtrINS_10SVGElementEEES2_PNS_8DocumentEbE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_10SVGElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEbENS_7P
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFNS_10PassRefPtrINS1_10SVGElementEEERKNS1_13QualifiedNameEPNS1_8Doc
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_10SVGElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEbENS_7
+__ZN7WebCoreL14svgConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore13SVGSVGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore12SVGLocatableC2Ev
 __ZN7WebCore25SVGStyledLocatableElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore16SVGStyledElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore10SVGElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore11SVGStylableC2Ev
 __ZN7WebCore8SVGTestsC2Ev
 __ZN7WebCore12SVGLangSpaceC2Ev
 __ZN7WebCore28SVGExternalResourcesRequiredC2Ev
 __ZN7WebCore15SVGFitToViewBoxC2Ev
+__ZN7WebCore22SVGPreserveAspectRatioC1Ev
 __ZN7WebCore22SVGPreserveAspectRatioC2Ev
 __ZN7WebCore13SVGZoomAndPanC2Ev
 __ZN7WebCore9SVGLengthC1ENS_13SVGLengthModeERKNS_6StringE
+__ZN7WebCore9SVGLengthC2ENS_13SVGLengthModeERKNS_6StringE
 __ZN7WebCore9SVGLength16setValueAsStringERKNS_6StringE
+__ZN7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrStri
 __ZN7WebCore11parseNumberERPKtS1_Rfb
 __ZN7WebCore18stringToLengthTypeERKNS_6StringE
 __ZN7WebCore17SMILTimeContainerC1EPNS_13SVGSVGElementE
+__ZN7WebCore17SMILTimeContainerC2EPNS_13SVGSVGElementE
 __ZN7WebCore10SVGElement16attributeChangedEPNS_9AttributeEb
 __ZNK7WebCore16SVGStyledElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore16SVGStyledElement32cssPropertyIdForSVGAttributeNameERKNS_13QualifiedNameE
@@ -10159,2023 +13010,244 @@
 __ZNK7WebCore16SVGStyledElement34invalidateResourcesInAncestorChainEv
 __ZN7WebCore18SVGElementInstance31invalidateAllInstancesOfElementEPNS_10SVGElementE
 __ZNK7WebCore10SVGElement19instancesForElementEv
-__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC1ERKSA_
-__ZNK7WebCore12XMLTokenizer10lineNumberEv
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEiNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IiEEE3setERKS3_RKi
-__ZNK7WebCore10SVGElement27accessDocumentSVGExtensionsEv
-__ZN7WebCore8Document19accessSVGExtensionsEv
-__ZN7WebCore21SVGDocumentExtensionsC2EPNS_8DocumentE
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapINS_9SVGLengthEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS4_IPNS_10StringImplET_NS_10StringHashENS3_10HashTraitsIS9_EENSC_ISA_EEEENS3_7PtrHashIS7_EENSC_IS7_EENSC_ISG_EEEEvE14s_baseValueMap
-__ZNK7WebCore10SVGElement28setSynchronizedSVGAttributesEb
-__ZNK7WebCore10SVGElement26updateAnimatedSVGAttributeERKNS_6StringE
-__ZNK7WebCore9SVGLength5valueEPKNS_10SVGElementE
-__ZN7WebCore15SVGFitToViewBox12parseViewBoxERPKtS2_RfS4_S4_S4_b
-__ZThn164_NK7WebCore13SVGSVGElement14contextElementEv
-__ZNK7WebCore13SVGSVGElement14contextElementEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapINS_9FloatRectEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS4_IPNS_10StringImplET_NS_10StringHashENS3_10HashTraitsIS9_EENSC_ISA_EEEENS3_7PtrHashIS7_EENSC_IS7_EENSC_ISG_EEEEvE14s_baseValueMap
-__ZN7WebCore12SVGLangSpace11setXmlspaceERKNS_12AtomicStringE
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC1ER
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC2ER
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15de
 __ZNK7WebCore10SVGElement12isSVGElementEv
 __ZN7WebCore13SVGSVGElement20insertedIntoDocumentEv
+__ZN7WebCore8Document19accessSVGExtensionsEv
+__ZN7WebCore21SVGDocumentExtensionsC1EPNS_8DocumentE
+__ZN7WebCore21SVGDocumentExtensionsC2EPNS_8DocumentE
 __ZN7WebCore21SVGDocumentExtensions16addTimeContainerEPNS_13SVGSVGElementE
 __ZN3WTF7HashSetIPN7WebCore13SVGSVGElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
 __ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocat
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloc
 __ZN7WebCore10SVGElement20insertedIntoDocumentEv
 __ZNK7WebCore10SVGElement2idEv
 __ZN7WebCore15SVGURIReference9getTargetERKNS_6StringE
 __ZNK7WebCore21SVGDocumentExtensions17isPendingResourceERKNS_12AtomicStringE
-__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS_18PairFirstExtractorISD_EENS1_10StringHashENS_14PairHashTraitsINS9_IS2_EENS9_ISC_EEEESI_E8containsIS2_NS_22IdentityHashTranslatorIS2_SD_SG_EEEEbRKT_
 __ZNK7WebCore10SVGElement12isShadowNodeEv
 __ZN7WebCore13SVGSVGElement16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore13SVGSVGElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
 __ZNK7WebCore13SVGSVGElement14isOutermostSVGEv
+__ZN7WebCore13RenderSVGRootC1EPNS_16SVGStyledElementE
 __ZN7WebCore13RenderSVGRootC2EPNS_16SVGStyledElementE
-__ZN7WebCore16SVGStyledElement15childrenChangedEbPNS_4NodeES2_i
-__ZNK7WebCore10SVGElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCoreL15defsConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGDefsElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore13RenderSVGRoot15virtualChildrenEv
+__ZN7WebCoreL15rectConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGRectElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore29SVGStyledTransformableElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore16SVGTransformableC2Ev
+__ZN7WebCore16SVGTransformListC1ERKNS_13QualifiedNameE
 __ZN7WebCore16SVGTransformListC2ERKNS_13QualifiedNameE
-__ZNK7WebCore14SVGDefsElement7isValidEv
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEiNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IiEEE3getERKS3_
+__ZN7WebCore14SVGRectElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore10SVGElement27accessDocumentSVGExtensionsEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplENS1_9SVGLengthENS1_10StringHashENS_10HashTraitsIS6_EENS9_IS7_
+__ZNK7WebCore10SVGElement28setSynchronizedSVGAttributesEb
+__ZN7WebCore14SVGRectElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore10SVGElement26updateAnimatedSVGAttributeERKNS_6StringE
+__ZNK7WebCore9SVGLength5valueEPKNS_10SVGElementE
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_23SVGAnimatedPropertyBaseEENS_18PairFirstExtractorIS7_EENS1_10StringHashE
+__ZN7WebCore16SVGStyledElement15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore10SVGElement25childShouldCreateRendererEPNS_4NodeE
+__ZNK7WebCore14SVGRectElement7isValidEv
 __ZNK7WebCore8SVGTests7isValidEv
 __ZN7WebCore16SVGStyledElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore14SVGDefsElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore24RenderSVGHiddenContainerC2EPNS_16SVGStyledElementE
-__ZNK7WebCore18RenderSVGContainer10firstChildEv
+__ZN7WebCore29SVGStyledTransformableElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore10RenderPathC1EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore10RenderPathC2EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore20RenderSVGModelObjectC2EPNS_16SVGStyledElementE
+__ZN7WebCore13RenderSVGRoot15virtualChildrenEv
 __ZNK7WebCore13RenderSVGRoot9isSVGRootEv
-__ZNK7WebCore18RenderSVGContainer15canHaveChildrenEv
-__ZN7WebCore10SVGElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore10SVGElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore10SVGElement7isValidEv
-__ZN7WebCore10SVGElement16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore10SVGElement21finishParsingChildrenEv
 __ZN7WebCore10SVGElement26sendSVGLoadEventIfPossibleEb
 __ZN7WebCore10SVGElement27haveLoadedRequiredResourcesEv
-__ZN7WebCoreL15pathConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore19SVGAnimatedPathDataC2Ev
-__ZN7WebCore14SVGPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore29SVGStyledTransformableElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGPathElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore14SVGPathElement11pathSegListEv
-__ZN7WebCore14SVGPathSegListC2ERKNS_13QualifiedNameE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14shrinkCapacityEm
-__ZN7WebCore22pathSegListFromSVGDataEPNS_14SVGPathSegListERKNS_6StringEb
-__ZN7WebCore13SVGPathParser8parseSVGERKNS_6StringEb
-__ZN7WebCoreL11parseNumberERPKtS1_Rdb
-__ZN7WebCore21SVGPathSegListBuilder9svgMoveToEddbb
-__ZN7WebCore14SVGPathElement25createSVGPathSegMovetoAbsEff
-__ZN7WebCore19SVGPathSegMovetoAbsC2Eff
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE15reserveCapacityEm
-__ZN7WebCore21SVGPathSegListBuilder15svgCurveToCubicEddddddb
-__ZN7WebCore14SVGPathElement31createSVGPathSegCurvetoCubicAbsEffffff
-__ZN7WebCore25SVGPathSegCurvetoCubicAbsC2Effffff
-__ZN7WebCore21SVGPathSegListBuilder12svgClosePathEv
-__ZN7WebCore14SVGPathElement25createSVGPathSegClosePathEv
-__ZN7WebCore19SVGPathSegClosePathC2Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE6shrinkEm
-__ZNK7WebCore14SVGPathElement7isValidEv
-__ZN7WebCore16CSSStyleSelector16applySVGPropertyEiPNS_8CSSValueE
-__ZN7WebCore14SVGRenderStyleC1ERKS0_
-__ZN7WebCore13StyleMiscDataC2ERKS0_
-__ZN7WebCore29SVGStyledTransformableElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore10RenderPathC1EPNS_29SVGStyledTransformableElementE
-__ZN7WebCoreL25linearGradientConstructorEPNS_8DocumentEb
-__ZN7WebCore24SVGLinearGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore18SVGGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGURIReferenceC2Ev
-__ZN7WebCore24SVGLinearGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore18SVGGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15SVGURIReference20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore24SVGLinearGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore18SVGGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIiEEPN3WTF7HashMapIPKNS_10SVGElementEPNS3_IPNS_10StringImplET_NS_10StringHashENS2_10HashTraitsIS8_EENSB_IS9_EEEENS2_7PtrHashIS6_EENSB_IS6_EENSB_ISF_EEEEvE14s_baseValueMap
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_16SVGTransformListEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERKNS_12AtomicStringE
-__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERPKtS4_
-__ZN7WebCore12SVGTransformC2Ev
-__ZN7WebCore16SVGTransformable19parseTransformValueEjRPKtS2_RNS_12SVGTransformE
-__ZN7WebCore20TransformationMatrixC1Edddddd
-__ZN7WebCore12SVGTransform9setMatrixENS_20TransformationMatrixE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEmPKS6_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE15reserveCapacityEm
-__ZN7WebCore12SVGTransformD0Ev
-__ZN7WebCore18SVGGradientElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore18SVGGradientElement15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCoreL15stopConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGStopElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGStopElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore6String7toFloatEPb
-__ZN7WebCore10StringImpl7toFloatEPb
-__ZN7WebCore17charactersToFloatEPKtmPb
-__ZN7WebCore9CSSParser13parseSVGColorEv
-__ZNK7WebCore8SVGColor9colorTypeEv
-__ZNK7WebCore8SVGColor5colorEv
-__ZN7WebCore13StyleStopDataC2ERKS0_
-__ZN7WebCore14SVGStopElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore21RenderSVGGradientStopC2EPNS_14SVGStopElementE
-__ZN7WebCore21RenderSVGGradientStop14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZNK7WebCore21RenderSVGGradientStop15gradientElementEv
-__ZN7WebCore18SVGGradientElement14canvasResourceEv
-__ZNK7WebCore24SVGLinearGradientElement12gradientTypeEv
-__ZN7WebCore28SVGPaintServerLinearGradientC2EPKNS_18SVGGradientElementE
-__ZN7WebCore22SVGPaintServerGradientC2EPKNS_18SVGGradientElementE
-__ZN7WebCore14SVGPaintServerC2Ev
-__ZN7WebCore11SVGResourceC2Ev
-__ZN7WebCore11SVGResource10invalidateEv
-__ZN7WebCore18RenderSVGContainer8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore18RenderSVGContainer15insertChildNodeEPNS_12RenderObjectES2_b
-__ZN7WebCore18RenderSVGContainer15appendChildNodeEPNS_12RenderObjectEb
-__ZN7WebCore8SVGPaintC2ENS0_12SVGPaintTypeERKNS_6StringES4_S4_
-__ZN7WebCore8SVGColor11setRGBColorERKNS_6StringERi
-__ZN7WebCore8SVGColor23colorFromRGBColorStringERKNS_6StringE
-__ZN7WebCore8SVGPaint6setUriERKNS_6StringE
-__ZN7WebCore21SVGPathSegListBuilder9svgLineToEddb
-__ZN7WebCore14SVGPathElement25createSVGPathSegLinetoAbsEff
-__ZN7WebCore19SVGPathSegLinetoAbsC2Eff
-__ZN7WebCore7DataRefINS_13StyleFillDataEE6accessEv
-__ZN7WebCore13StyleFillDataC2ERKS0_
-__ZN3WTF10RefCountedIN7WebCore8CSSValueEE5derefEv
-__ZN7WebCoreL12gConstructorEPNS_8DocumentEb
-__ZN7WebCore11SVGGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore11SVGGElement7isValidEv
-__ZN7WebCore11SVGGElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore31RenderSVGTransformableContainerC2EPNS_29SVGStyledTransformableElementE
-__ZN7WebCore11SVGGElement15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCore9CSSParser13parseSVGPaintEv
-__ZN7WebCoreL19clipPathConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGClipPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore18SVGClipPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore18SVGClipPathElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore18SVGClipPathElement7isValidEv
-__ZN7WebCore18SVGClipPathElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore18SVGClipPathElement15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCoreL14useConstructorEPNS_8DocumentEb
-__ZN7WebCore13SVGUseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore13SVGUseElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn196_NK7WebCore13SVGUseElement14contextElementEv
-__ZNK7WebCore13SVGUseElement14contextElementEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapINS_6StringEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS4_IPNS_10StringImplET_NS_10StringHashENS3_10HashTraitsIS9_EENSC_ISA_EEEENS3_7PtrHashIS7_EENSC_IS7_EENSC_ISG_EEEEvE14s_baseValueMap
-__ZN7WebCore13SVGUseElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore13SVGUseElement20insertedIntoDocumentEv
-__ZN7WebCore13SVGUseElement20buildPendingResourceEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGURIReferenceENS_6StringEXadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkNames14hrefAttrStringEEEE11synchronizeEv
-__ZN7WebCore18SVGElementInstanceC1EPNS_13SVGUseElementEPNS_10SVGElementE
-__ZN7WebCore10SVGElement20mapInstanceToElementEPNS_18SVGElementInstanceE
-__ZN3WTF7HashSetIPN7WebCore18SVGElementInstanceENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore13SVGUseElement17buildInstanceTreeEPNS_10SVGElementEPNS_18SVGElementInstanceERb
-__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_16heightAttrStringEEEE11synchronizeEv
-__ZN7WebCore13SVGUseElement15buildShadowTreeEPNS_10SVGElementEPNS_18SVGElementInstanceE
-__ZN7WebCoreL19isDisallowedElementEPNS_4NodeE
-__ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
-__ZN7WebCore7Element9cloneNodeEb
-__ZN7WebCoreL32subtreeContainsDisallowedElementEPNS_4NodeE
-__ZN7WebCore13SVGUseElement29expandUseElementsInShadowTreeEPNS_4NodeE
-__ZN7WebCore13SVGUseElement32expandSymbolElementsInShadowTreeEPNS_4NodeE
-__ZN7WebCore13SVGUseElement40associateInstancesWithShadowTreeElementsEPNS_4NodeEPNS_18SVGElementInstanceE
-__ZN7WebCore18SVGElementInstance20setShadowTreeElementEPNS_10SVGElementE
-__ZN7WebCore13SVGUseElement34transferEventListenersToShadowTreeEPNS_18SVGElementInstanceE
-__ZN7WebCore13SVGUseElement16attachShadowTreeEv
-__ZN7WebCore13SVGUseElement6attachEv
-__ZN7WebCoreL18ellipseConstructorEPNS_8DocumentEb
-__ZN7WebCore17SVGEllipseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17SVGEllipseElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore17SVGEllipseElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_23SVGAnimatedPropertyBaseEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E8containsIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEEbRKT_
-__ZNK7WebCore17SVGEllipseElement7isValidEv
-__ZN7WebCore13StyleClipDataC2ERKS0_
-__ZN7WebCore11SVGGElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore11SVGGElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore14SVGRenderStyleeqERKS0_
-__ZNK7WebCore13StyleClipDataeqERKS0_
-__ZN7WebCore14SVGRenderStyle11inheritFromEPKS0_
-__ZNK7WebCore13StyleMiscDataeqERKS0_
-__ZN7WebCore14SVGRenderStyleD1Ev
-__ZNK7WebCore13StyleStopDataeqERKS0_
-__ZNK7WebCore13StyleFillDataeqERKS0_
-__ZNK7WebCore8SVGPaint3uriEv
-__ZN7WebCore16SVGStyledElement6detachEv
-__ZN7WebCore11SVGResource12removeClientEPNS_16SVGStyledElementE
-__ZN7WebCoreL9clientMapEv
-__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementESt4pairIS3_PNS1_11ResourceSetEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SB_EEEENS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCore13SVGUseElement6detachEv
-__ZN7WebCore13RenderSVGRoot6layoutEv
-__ZN7WebCore13RenderSVGRoot12calcViewportEv
-__ZNK7WebCore9SVGLength8unitTypeEv
-__ZN7WebCore13RenderSVGRoot29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZN7WebCore24RenderSVGHiddenContainer29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZN7WebCore10RenderPath29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZNK7WebCore10RenderPath12relativeBBoxEb
-__ZNK7WebCore12RenderObject17absoluteTransformEv
-__ZNK7WebCore13RenderSVGRoot17absoluteTransformEv
-__ZNK7WebCore9RenderBox14localTransformEv
-__ZNK7WebCore13RenderSVGRoot14localTransformEv
-__ZN7WebCore20TransformationMatrixmlERKS0_
-__ZNK7WebCore13SVGSVGElement12currentScaleEv
-__ZNK7WebCore5Frame10zoomFactorEv
-__ZN7WebCore20TransformationMatrix5scaleEd
-__ZNK7WebCore13SVGSVGElement16currentTranslateEv
-__ZNK7WebCore13RenderSVGRoot8viewportEv
-__ZNK7WebCore13SVGSVGElement22viewBoxToViewTransformEff
-__ZNK7WebCore13SVGSVGElement14useCurrentViewEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGFitToViewBoxENS_9FloatRectEXadL_ZNS_25SVGFitToViewBoxIdentifierEEEXadL_ZNS_8SVGNames17viewBoxAttrStringEEEE11synchronizeEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGFitToViewBoxENS_22SVGPreserveAspectRatioEXadL_ZNS_25SVGFitToViewBoxIdentifierEEEXadL_ZNS_8SVGNames29preserveAspectRatioAttrStringEEEE11synchronizeEv
-__ZN7WebCore22SVGPreserveAspectRatio6getCTMEdddddddd
-__ZNK7WebCore22SVGPreserveAspectRatio5alignEv
-__ZNK7WebCore22SVGPreserveAspectRatio11meetOrSliceEv
-__ZNK7WebCore10RenderPath14localTransformEv
-__ZN7WebCore18RenderSVGContainer29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZNK7WebCore18RenderSVGContainer14localTransformEv
-__ZN7WebCore24RenderSVGHiddenContainer6layoutEv
-__ZN7WebCore10RenderPath6layoutEv
-__ZN7WebCore10RenderPath23calculateLocalTransformEv
-__ZNK7WebCore29SVGStyledTransformableElement22animatedLocalTransformEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_29SVGStyledTransformableElementENS_16SVGTransformListEXadL_ZNS_39SVGStyledTransformableElementIdentifierEEEXadL_ZNS_8SVGNames19transformAttrStringEEEE11synchronizeEv
-__ZNK7WebCore16SVGTransformList11concatenateEv
-__ZNK7WebCore12SVGTransform6matrixEv
-__ZNK7WebCore20TransformationMatrixeqERKS0_
-__ZNK7WebCore14SVGPathElement10toPathDataEv
-__ZN7WebCore14SVGPathSegList10toPathDataEv
-__ZNK7WebCore19SVGPathSegMovetoAbs11pathSegTypeEv
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs11pathSegTypeEv
-__ZNK7WebCore19SVGPathSegClosePath11pathSegTypeEv
-__ZN7WebCore10RenderPath7setPathERKNS_4PathE
-__ZN7WebCore21RenderSVGGradientStop6layoutEv
-__ZNK7WebCore19SVGPathSegLinetoAbs11pathSegTypeEv
-__ZN7WebCore18RenderSVGContainer6layoutEv
-__ZN7WebCore31RenderSVGTransformableContainer23calculateLocalTransformEv
-__ZN7WebCore18RenderSVGContainer10calcBoundsEv
-__ZNK7WebCore18RenderSVGContainer17calcReplacedWidthEv
-__ZNK7WebCore18RenderSVGContainer18calcReplacedHeightEv
-__ZNK7WebCore24RenderSVGHiddenContainer17absoluteTransformEv
-__ZNK7WebCore17SVGEllipseElement10toPathDataEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12ryAttrStringEEEE11synchronizeEv
-__ZN7WebCore4Path13createEllipseERKNS_10FloatPointEff
-__ZN7WebCore21SVGDocumentExtensions15startAnimationsEv
-__ZN7WebCore17SMILTimeContainer5beginEv
-__ZN7WebCore17SMILTimeContainer16updateAnimationsENS_8SMILTimeE
-__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE6resizeEm
-__ZN7WebCore17SMILTimeContainer14sortByPriorityERN3WTF6VectorIPNS_14SVGSMILElementELm0EEENS_8SMILTimeE
-__ZN7WebCore17SMILTimeContainer10startTimerENS_8SMILTimeES1_
-__ZNK7WebCore17SMILTimeContainer8isPausedEv
-__ZN7WebCore13RenderSVGRoot5paintERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore13SVGSVGElement17hasRelativeValuesEv
-__ZN7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrStringEEEEC1INS_13SVGLengthModeEA5_cEEPKS1_RKNS_13QualifiedNameERKT_RKT0_
-__ZN7WebCore13RenderSVGRoot22applyContentTransformsERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore20TransformationMatrix1fEv
-__ZNK7WebCore20TransformationMatrix1eEv
-__ZN7WebCore15GraphicsContext9concatCTMERKNS_20TransformationMatrixE
-__ZNK7WebCore13RenderSVGRoot12relativeBBoxEb
-__ZNK7WebCore24RenderSVGHiddenContainer12relativeBBoxEb
-__ZNK7WebCore24RenderSVGHiddenContainer14localTransformEv
-__ZNK7WebCore24RenderSVGHiddenContainer14isSVGContainerEv
-__ZNK7WebCore18RenderSVGContainer17viewportTransformEv
-__ZNK7WebCore18RenderSVGContainer12relativeBBoxEb
-__ZNK7WebCore18RenderSVGContainer14isSVGContainerEv
-__ZN7WebCore9RenderBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore24RenderSVGHiddenContainer5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore10RenderPath5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore18RenderSVGContainer5paintERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore18RenderSVGContainer13drawsContentsEv
-__ZN7WebCore18RenderSVGContainer22applyContentTransformsERNS_12RenderObject9PaintInfoE
-__ZNK7WebCore20TransformationMatrix10isIdentityEv
-__ZN7WebCore18RenderSVGContainer25applyAdditionalTransformsERNS_12RenderObject9PaintInfoE
-__ZN7WebCore25prepareToRenderSVGContentEPNS_12RenderObjectERNS0_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFilterES8_
-__ZN7WebCore14getClipperByIdEPNS_8DocumentERKNS_12AtomicStringE
-__ZN7WebCore15getResourceByIdEPNS_8DocumentERKNS_12AtomicStringE
-__ZN7WebCore13getMaskerByIdEPNS_8DocumentERKNS_12AtomicStringE
-__ZN7WebCore14SVGPaintServer15fillPaintServerEPKNS_11RenderStyleEPKNS_12RenderObjectE
-__ZN7WebCore14SVGPaintServer22sharedSolidPaintServerEv
-__ZN7WebCore19SVGPaintServerSolidC2Ev
-__ZN7WebCore19SVGPaintServerSolid8setColorERKNS_5ColorE
-__ZNK7WebCore19SVGPaintServerSolid5colorEv
-__ZNK7WebCore14SVGPaintServer4drawERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeE
-__ZNK7WebCore19SVGPaintServerSolid5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZN7WebCore15GraphicsContext11setFillRuleENS_8WindRuleE
-__ZNK7WebCore14SVGPaintServer10renderPathERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeE
-__ZN7WebCore15GraphicsContext8fillPathEv
-__ZNK7WebCore15GraphicsContext8fillRuleEv
-__ZNK7WebCore14SVGPaintServer8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZN7WebCore14SVGPaintServer17strokePaintServerEPKNS_11RenderStyleEPKNS_12RenderObjectE
-__ZNK7WebCore14SVGPathElement15supportsMarkersEv
-__ZNK7WebCore10RenderPath19drawMarkersIfNeededEPNS_15GraphicsContextERKNS_9FloatRectERKNS_4PathE
-__ZN7WebCore13getMarkerByIdEPNS_8DocumentERKNS_12AtomicStringE
-__ZN7WebCore22finishRenderSVGContentEPNS_12RenderObjectERNS0_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFilterEPNS_15GraphicsContextE
-__ZN7WebCore18getPaintServerByIdEPNS_8DocumentERKNS_12AtomicStringE
-__ZNK7WebCore16SVGStyledElement8isStyledEv
-__ZNK7WebCore14SVGPaintServer12resourceTypeEv
-__ZNK7WebCore10RenderPath12isRenderPathEv
-__ZN7WebCore11SVGResource9addClientEPNS_16SVGStyledElementE
-__ZNK3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEEbRKT_
-__ZN3WTF7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS3_
-__ZNK3WTF7HashMapIPN7WebCore16SVGStyledElementEPNS1_11ResourceSetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementESt4pairIS3_PNS1_11ResourceSetEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6expandEv
-__ZNK7WebCore22SVGPaintServerGradient5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZNK7WebCore24SVGLinearGradientElement13buildGradientEv
-__ZNK7WebCore24SVGLinearGradientElement25collectGradientPropertiesEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_18SVGGradientElementEiXadL_ZNS_28SVGGradientElementIdentifierEEEXadL_ZNS_8SVGNames23gradientUnitsAttrStringEEEE11synchronizeEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_18SVGGradientElementENS_16SVGTransformListEXadL_ZNS_28SVGGradientElementIdentifierEEEXadL_ZNS_8SVGNames27gradientTransformAttrStringEEEE11synchronizeEv
-__ZN7WebCore16SVGTransformList11consolidateEv
-__ZN7WebCore12SVGTransformC1ERKNS_20TransformationMatrixE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE6shrinkEm
-__ZNK7WebCore18SVGGradientElement10buildStopsEv
-__ZNK7WebCore14SVGStopElement14isGradientStopEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE11synchronizeEv
-__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14expandCapacityEm
-__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EEaSERKS5_
-__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE6shrinkEm
-__ZN7WebCore19SVGAnimatedPropertyINS_24SVGLinearGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23linearGradientTagStringEEEXadL_ZNS3_12y1AttrStringEEEEC1INS_13SVGLengthModeEEEPKS1_RKNS_13QualifiedNameERKT_
-__ZNK7WebCore9SVGLength17valueAsPercentageEv
-__ZNK7WebCore9SVGLength21valueInSpecifiedUnitsEv
-__ZN3WTF7HashSetIPKN7WebCore18SVGGradientElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandEv
-__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EEC2ERKS5_
-__ZN7WebCore10FloatPoint15narrowPrecisionEdd
-__ZN7WebCore8Gradient15setSpreadMethodENS_20GradientSpreadMethodE
-__ZN7WebCore22SVGPaintServerGradient11setGradientEN3WTF10PassRefPtrINS_8GradientEEE
-__ZN7WebCore22SVGPaintServerGradient18setBoundingBoxModeEb
-__ZN7WebCore22SVGPaintServerGradient20setGradientTransformERKNS_20TransformationMatrixE
-__ZN7WebCore28SVGPaintServerLinearGradient16setGradientStartERKNS_10FloatPointE
-__ZN7WebCore28SVGPaintServerLinearGradient14setGradientEndERKNS_10FloatPointE
-__ZNK7WebCore22SVGPaintServerGradient15boundingBoxModeEv
-__ZNK7WebCore22SVGPaintServerGradient17gradientTransformEv
-__ZN7WebCore8Gradient16platformGradientEv
-__ZN7WebCoreL16gradientCallbackEPvPKfPf
-__ZNK7WebCore8Gradient8getColorEfPfS1_S1_S1_
-__ZNSt17_Temporary_bufferIPN7WebCore8Gradient9ColorStopES2_EC1ES3_S3_
-__ZSt22__get_temporary_bufferIN7WebCore8Gradient9ColorStopEESt4pairIPT_iEiS5_
-__ZSt26__uninitialized_fill_n_auxIPN7WebCore8Gradient9ColorStopEiS2_EvT_T0_RKT1_12__false_type
-__ZSt22__stable_sort_adaptiveIPN7WebCore8Gradient9ColorStopES3_iPFbRKS2_S5_EEvT_S8_T0_T1_T2_
-__ZSt24__merge_sort_with_bufferIPN7WebCore8Gradient9ColorStopES3_PFbRKS2_S5_EEvT_S8_T0_T1_
-__ZSt22__chunk_insertion_sortIPN7WebCore8Gradient9ColorStopEiPFbRKS2_S5_EEvT_S8_T0_T1_
-__ZSt16__insertion_sortIPN7WebCore8Gradient9ColorStopEPFbRKS2_S5_EEvT_S8_T0_
-__ZSt16__merge_adaptiveIPN7WebCore8Gradient9ColorStopEiS3_PFbRKS2_S5_EEvT_S8_S8_T0_S9_T1_S9_T2_
-__ZSt5mergeIPN7WebCore8Gradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
-__ZN7WebCoreL12compareStopsERKNS_8Gradient9ColorStopES3_
-__ZSt23return_temporary_bufferIN7WebCore8Gradient9ColorStopEEvPT_
-__ZNK7WebCore8Gradient8findStopEf
-__ZNK7WebCore22SVGPaintServerGradient8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZN7WebCore18SVGClipPathElement14canvasResourceEv
-__ZN7WebCore18SVGResourceClipperC2Ev
-__ZNK7WebCore19SVGAnimatedPropertyINS_18SVGClipPathElementEiXadL_ZNS_8SVGNames17clipPathTagStringEEEXadL_ZNS2_23clipPathUnitsAttrStringEEEE11synchronizeEv
-__ZNK7WebCore29SVGStyledTransformableElement21isStyledTransformableEv
-__ZNK7WebCore13SVGUseElement10toClipPathEv
-__ZNK7WebCore29SVGStyledTransformableElement10toClipPathEv
-__ZN7WebCore18SVGResourceClipper11addClipDataERKNS_4PathENS_8WindRuleEb
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE15reserveCapacityEm
-__ZNK7WebCore18SVGResourceClipper8clipDataEv
-__ZNK7WebCore18SVGResourceClipper12resourceTypeEv
-__ZNK7WebCore18SVGResourceClipper9applyClipEPNS_15GraphicsContextERKNS_9FloatRectE
-__ZN7WebCore15GraphicsContext8clipPathENS_8WindRuleE
-__ZNK7WebCore16SVGStyledElement15supportsMarkersEv
-__ZN7WebCore13RenderSVGRoot11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore20TransformationMatrix3mapEddPdS1_
+__ZThn112_NK7WebCore17HTMLScriptElement20sourceAttributeValueEv
+__ZThn112_NK7WebCore17HTMLScriptElement13scriptCharsetEv
+__ZN7WebCore12XMLTokenizer12pauseParsingEv
+__ZN3WTF5DequeIPN7WebCore16PendingCallbacks15PendingCallbackEE14expandCapacityEv
+__ZThn16_N7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
 __ZN7WebCore10SVGElement15eventParentNodeEv
-__ZNK7WebCore7Element5titleEv
-__ZN7WebCore18RenderSVGContainer11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore18RenderSVGContainer9lastChildEv
-__ZN7WebCore10RenderPath11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore21PointerEventsHitRulesC1ENS0_11EHitTestingENS_14EPointerEventsE
-__ZNK7WebCore10RenderPath23mapAbsolutePointToLocalERKNS_10FloatPointE
-__ZNK7WebCore10RenderPath12fillContainsERKNS_10FloatPointEb
-__ZN7WebCore24RenderSVGHiddenContainer11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore13SVGSVGElement26documentWillBecomeInactiveEv
-__ZN7WebCore13SVGSVGElement15pauseAnimationsEv
-__ZN7WebCore17SMILTimeContainer5pauseEv
-__ZN7WebCore13JSSVGDocumentD0Ev
-__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
-__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_PNS1_10ColumnInfoEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E4findIS4_NS_22IdentityHashTranslatorIS4_S8_SC_EEEENS_17HashTableIteratorIS4_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore27jsHTMLOptionElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22JSNamedNodesCollectionC1EPN3JSC9ExecStateERKN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEC1ERKS5_
-__ZN7WebCore22JSNamedNodesCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSNamedNodesCollection11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore11RenderBlock22skipTrailingWhitespaceERNS_14InlineIteratorE
-__ZN7WebCore22JSNamedNodesCollectionD0Ev
-__ZN7WebCore42jsDocumentPrototypeFunctionCreateElementNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26setJSHTMLObjectElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLObjectElement7setTypeERKNS_6StringE
-__ZN7WebCore26setJSHTMLObjectElementDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLObjectElement7setDataERKNS_6StringE
-__ZN7WebCore27setJSHTMLObjectElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore28setJSHTMLObjectElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25setJSHTMLParamElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLParamElement7setNameERKNS_6StringE
-__ZN7WebCore22jsHTMLTitleElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTitleElement4textEv
-__ZN7WebCore24setJSHTMLMetaElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLMetaElement7setNameERKNS_6StringE
-__ZN7WebCore27setJSHTMLMetaElementContentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLMetaElement10setContentERKNS_6StringE
-__ZN7WebCore26jsHTMLMetaElementHttpEquivEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLMetaElement9httpEquivEv
-__ZN7WebCore5XPathL12createFunNotEv
-__ZNK7WebCore5XPath6FunNot8evaluateEv
-__ZN7WebCore9FrameView23removeSlowRepaintObjectEv
--[WebScriptObject setValue:forKey:]
--[WebScriptObject _isSafeScript]
--[WebScriptObject _rootObject]
-__ZNK7WebCore15JSDOMWindowBase16allowsAccessFromEPKN3JSC14JSGlobalObjectE
--[WebScriptObject _imp]
-__ZN3JSC8Bindings17webUndefinedClassEv
-__ZL11_didExecuteP15WebScriptObject
-__ZN3JSC8Bindings8Instance18didExecuteFunctionEv
-__ZN7WebCoreL26updateRenderingForBindingsEPN3JSC9ExecStateEPNS0_8JSObjectE
-__ZNK7WebCore14RenderThemeMac22adjustSliderTrackStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore12RenderSliderC1EPNS_16HTMLInputElementE
-__ZN7WebCore12RenderSlider14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore12RenderSlider17updateFromElementEv
-__ZN7WebCore22HTMLSliderThumbElementC1EPNS_8DocumentEPNS_4NodeE
-__ZN7WebCore12RenderSlider16createThumbStyleEPKNS_11RenderStyleES3_
-__ZNK7WebCore14RenderThemeMac22adjustSliderThumbStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore22HTMLSliderThumbElement12isShadowNodeEv
-__ZN7WebCore22HTMLSliderThumbElement16shadowParentNodeEv
-__ZN7WebCore12RenderSlider20setPositionFromValueEb
-__ZN7WebCore12RenderSlider6layoutEv
-__ZN7WebCore12RenderSlider14calcPrefWidthsEv
-__ZNK7WebCore14RenderThemeMac21adjustSliderThumbSizeEPNS_12RenderObjectE
-__ZN7WebCore12RenderSlider9trackSizeEv
-__ZN7WebCore12RenderSlider18setCurrentPositionEi
-__ZNK7WebCore12RenderSlider16baselinePositionEbb
-__ZN7WebCore25setJSXMLHttpRequestOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17RenderFlexibleBox17layoutVerticalBoxEb
-__ZN7WebCore14RenderThemeMac16paintSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCoreL24TrackGradientInterpolateEPvPKfPf
-__ZNK7WebCore12RenderSlider8isSliderEv
-__ZN7WebCore14RenderThemeMac16paintSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac21sliderThumbHorizontalEv
-__ZNK7WebCore12RenderSlider10inDragModeEv
-__ZN7WebCore11RenderBlock9lineCountEv
-__ZN7WebCoreL16shouldCheckLinesEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock30markPositionedObjectsForLayoutEv
-__ZN7WebCore11RenderBlock15clearTruncationEv
-__ZNK7WebCore13ProgressEvent15isProgressEventEv
-__ZNK7WebCore27XMLHttpRequestProgressEvent29isXMLHttpRequestProgressEventEv
-__ZN7WebCore15getDOMStructureINS_29JSXMLHttpRequestProgressEventEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore29JSXMLHttpRequestProgressEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore24JSProgressEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore15JSProgressEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore29JSXMLHttpRequestProgressEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27XMLHttpRequestProgressEventEEE
-__ZN7WebCore15JSProgressEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13ProgressEventEEE
-__ZN7WebCore12RenderSlider12forwardEventEPNS_5EventE
-__ZN7WebCore22HTMLSliderThumbElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore12RenderSlider19mouseEventIsInThumbEPNS_10MouseEventE
-__ZN7WebCore12RenderSlider15currentPositionEv
-__ZN7WebCore12EventHandler27setCapturingMouseEventsNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore12RenderSlider17positionForOffsetERKNS_8IntPointE
-__ZN7WebCore12RenderSlider12valueChangedEv
-__ZN7WebCore12RenderSlider19setValueForPositionEi
-__ZN7WebCore11RenderBlock18heightForLineCountEi
-__ZN7WebCoreL21getHeightForLineCountEPNS_11RenderBlockEibRi
-__ZN7WebCore11RenderBlock11lineAtIndexEi
-__ZN7WebCoreL14getLineAtIndexEPNS_11RenderBlockEiRi
-__ZN7WebCore13InlineFlowBox15clearTruncationEv
-__ZN7WebCore13InlineTextBox15clearTruncationEv
-__ZN7WebCore14XMLHttpRequest24loadRequestSynchronouslyERNS_15ResourceRequestERi
-__ZN7WebCore16ThreadableLoader25loadResourceSynchronouslyEPNS_22ScriptExecutionContextERKNS_15ResourceRequestERNS_13ResourceErrorERNS_16ResourceResponseERN3WTF6VectorIcLm0EEE
-__ZN7WebCore11FrameLoader25loadResourceSynchronouslyERKNS_15ResourceRequestERNS_13ResourceErrorERNS_16ResourceResponseERN3WTF6VectorIcLm0EEE
-__ZN7WebCore19ResourceRequestBase18setTimeoutIntervalEd
-__ZN7WebCore14ResourceHandle25loadResourceSynchronouslyERKNS_15ResourceRequestERNS_13ResourceErrorERNS_16ResourceResponseERN3WTF6VectorIcLm0EEEPNS_5FrameE
-+[WebCoreSynchronousLoader loadRequest:returningResponse:error:]
--[WebCoreSynchronousLoader _isDone]
--[WebCoreSynchronousLoader connection:didReceiveResponse:]
--[WebCoreSynchronousLoader connectionDidFinishLoading:]
--[WebCoreSynchronousLoader _data]
--[WebCoreSynchronousLoader _response]
--[WebCoreSynchronousLoader _error]
--[WebCoreSynchronousLoader dealloc]
-__ZN7WebCore14XMLHttpRequest22processSyncLoadResultsEmRKN3WTF6VectorIcLm0EEERKNS_16ResourceResponseERi
--[WebCoreSynchronousLoader connection:didReceiveData:]
-__ZN7WebCore18RenderSVGContainer7destroyEv
-__ZN7WebCore18RenderSVGContainer23destroyLeftoverChildrenEv
-__ZN7WebCore24RenderSVGHiddenContainerD1Ev
-__ZN7WebCore10RenderPathD1Ev
-__ZN7WebCore18RenderSVGContainer11removeChildEPNS_12RenderObjectE
-__ZN7WebCore18RenderSVGContainer15removeChildNodeEPNS_12RenderObjectEb
-__ZN7WebCore21RenderSVGGradientStopD1Ev
-__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore31RenderSVGTransformableContainerD1Ev
-__ZN7WebCore13RenderSVGRootD1Ev
-__ZN7WebCore13SVGSVGElementD1Ev
-__ZN7WebCore21SVGDocumentExtensions19removeTimeContainerEPNS_13SVGSVGElementE
-__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore13SVGZoomAndPanD0Ev
-__ZN7WebCore12SVGLangSpaceD0Ev
-__ZN7WebCore16SVGStyledElementD0Ev
-__ZN7WebCore11SVGStylableD0Ev
-__ZN7WebCore12SVGLocatableD0Ev
-__ZN7WebCore14SVGDefsElementD1Ev
-__ZN7WebCore19SVGPathSegMovetoAbsD1Ev
-__ZN7WebCore25SVGPathSegCurvetoCubicAbsD1Ev
-__ZN7WebCore19SVGAnimatedPathDataD0Ev
-__ZN7WebCore24SVGLinearGradientElementD1Ev
-__ZN7WebCore19SVGPathSegLinetoAbsD1Ev
-__ZN7WebCore8SVGPaintD1Ev
-__ZN7WebCore11SVGGElementD1Ev
-__ZN7WebCore10SVGElementD1Ev
-__ZN7WebCore14SVGStopElementD1Ev
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE6shrinkEm
-__ZN7WebCore17SVGEllipseElementD1Ev
-__ZN7WebCore13SVGUseElementD1Ev
-__ZN7WebCore10TreeSharedINS_18SVGElementInstanceEE14removedLastRefEv
-__ZN7WebCore18SVGElementInstanceD1Ev
-__ZN7WebCore10SVGElement21removeInstanceMappingEPNS_18SVGElementInstanceE
-__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore28removeAllChildrenInContainerINS_18SVGElementInstanceES1_EEvPT0_
-__ZN7WebCore7Private28addChildNodesToDeletionQueueINS_18SVGElementInstanceES2_EEvRPT_S5_PT0_
-__ZN7WebCore11SVGDocumentD1Ev
-__ZN7WebCore21SVGDocumentExtensionsD2Ev
-__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEEKNS_7HashMapINS2_6StringESA_NS2_10StringHashENS7_ISC_EENS7_ISA_EEEEEEvRT0_
-__ZN7WebCore22JSSVGDocumentPrototypeD0Ev
-__ZN7WebCoreL5equalERKNS_15CSSParserStringEPKc
-__ZN7WebCore18CSSParserValueList13deleteValueAtEj
-__ZNK7WebCore14CSSParserValue10isVariableEv
-__ZN7WebCore15ActiveDOMObject6resumeEv
-__ZN7WebCore15HTMLFormElement23documentDidBecomeActiveEv
-__ZN7WebCore33jsLocationPrototypeFunctionReloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore10JSLocation6reloadEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore11FrameLoader15scheduleRefreshEb
-__ZN7WebCore12RenderSliderD1Ev
-__ZN7WebCore22HTMLSliderThumbElementD1Ev
-__ZNK7WebCore7Comment8nodeNameEv
-__ZN7WebCore42jsRangePrototypeFunctionSelectNodeContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore32jsRangePrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore5Range8toStringERi
-__ZN7WebCore38JSXMLHttpRequestProgressEventPrototypeD0Ev
-__ZN7WebCore12IconDatabase25removeIconFromSQLDatabaseERKNS_6StringE
--[DOMDocument getElementById:]
--[DOMElement(WebPrivate) _getURLAttribute:]
-__ZN7WebCore9Scrollbar6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZN7WebCore30SearchFieldCancelButtonElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore27RenderTextControlSingleLine21startSearchEventTimerEv
-__ZN7WebCore14RenderThemeMac28paintSearchFieldCancelButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore5TimerINS_27RenderTextControlSingleLineEE5firedEv
-__ZN7WebCore27RenderTextControlSingleLine21searchEventTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore16HTMLInputElement8onSearchEv
-__ZN7WebCore27RenderTextControlSingleLine20stopSearchEventTimerEv
-__ZN7WebCore15createJSWrapperEPN3JSC8JSObjectEN3WTF10PassRefPtrINS0_8Bindings10RootObjectEEES7_
-__ZN7WebCore12getJSWrapperEPN3JSC8JSObjectE
--[WebScriptObject _initWithJSObject:originRootObject:rootObject:]
--[WebScriptObject valueForKey:]
--[WebScriptObject _originRootObject]
--[WebScriptObject webScriptValueAtIndex:]
-__ZN7WebCore19JSHTMLObjectElement11getCallDataERN3JSC8CallDataE
-__ZN7WebCore24jsHTMLObjectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLObjectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN3WTF6VectorItLm32EE14expandCapacityEmPKt
-__ZN3WTF6VectorItLm32EE14expandCapacityEm
-__ZN3WTF6VectorItLm32EE15reserveCapacityEm
-__ZN7WebCore32jsDOMWindowPrototypeFunctionBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9DOMWindow4blurEv
-__ZN7WebCore5Frame13unfocusWindowEv
-__ZNK7WebCore6Chrome7unfocusEv
-__ZN7WebCore20jsHTMLLinkElementRelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLLinkElement3relEv
-__ZN7WebCore16JSStyleSheetList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22jsStyleSheetListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsHTMLAnchorElementRelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement3relEv
-__ZN7WebCore22jsHTMLEmbedElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsHTMLLIElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13HTMLLIElement4typeEv
-__ZNK7WebCore15FontDescription13lighterWeightEv
-__ZN7WebCore16JSDOMWindowShell16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore11JSDOMWindow16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore11JSDOMWindow22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore20JSDOMWindowPrototype9classInfoEv
-__ZN7WebCore39jsDOMWindowHTMLAppletElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLAppletElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSHTMLAppletElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore20jsDOMWindowOnkeydownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow9onkeydownEv
-__ZN7WebCore36jsDOMWindowHTMLMapElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSHTMLMapElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSHTMLMapElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore29jsDOMWindowCounterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9JSCounter14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore20JSCounterConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore18JSCounterPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore9JSCounter15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore35jsDOMWindowHTMLHRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSHTMLHRElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore24JSHTMLHRElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore40jsDOMWindowSVGTextPathElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20JSSVGTextPathElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore31JSSVGTextPathElementConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore29JSSVGTextPathElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore20JSSVGTextPathElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore32JSSVGTextContentElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore23JSSVGTextContentElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSSVGElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore12JSSVGElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore26jsDOMWindowTextConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore6JSText14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore17JSTextConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore15JSTextPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore37jsDOMWindowHTMLHeadElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSHTMLHeadElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSHTMLHeadElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore30jsDOMWindowMimeTypeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10JSMimeType14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore21JSMimeTypeConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore19JSMimeTypePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore29jsDOMWindowCSSRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9JSCSSRule14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore18JSCSSRulePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore9JSCSSRule15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore31jsDOMWindowClipboardConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore11JSClipboard14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore20JSClipboardPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore11JSClipboard15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore31jsDOMWindowTextEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore11JSTextEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore22JSTextEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore20JSTextEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore11JSTextEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore35jsDOMWindowCharacterDataConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSCharacterData14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore21jsDOMWindowOnmouseoutEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow10onmouseoutEv
-__ZN7WebCore21jsDOMWindowScreenLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7screenXEv
-__ZN7WebCore41jsDOMWindowHTMLTableColElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21JSHTMLTableColElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore30JSHTMLTableColElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore44jsDOMWindowSVGPreserveAspectRatioConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24JSSVGPreserveAspectRatio14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore33JSSVGPreserveAspectRatioPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore24JSSVGPreserveAspectRatio15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore28jsDOMWindowEntityConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore8JSEntity14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore19JSEntityConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore17JSEntityPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore8JSEntity15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLQuoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLQuoteElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLQuoteElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLQuoteElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore23jsDOMWindowLocalStorageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow12localStorageEv
-__ZN7WebCore12LocalStorage11storageAreaEPNS_14SecurityOriginE
-__ZN7WebCore16LocalStorageAreaC1EPNS_14SecurityOriginEPNS_12LocalStorageE
-__ZN7WebCore11StorageAreaC2EPNS_14SecurityOriginE
-__ZN7WebCore10StorageMap6createEv
-__ZN7WebCore10StorageMapC1Ev
-__ZN7WebCore12LocalStorage14scheduleImportEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
-__ZN7WebCore18LocalStorageThread14scheduleImportEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
-__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_16LocalStorageAreaEEENS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS8_IS6_EEE3getEPS3_
-__ZN7WebCore16LocalStorageArea13performImportEv
-__ZN7WebCore12LocalStorage20fullDatabaseFilenameEPNS_14SecurityOriginE
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_NS1_INS2_16LocalStorageAreaEEEENS_18PairFirstExtractorIS8_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSD_IS7_EEEESE_E6expandEv
-__ZN7WebCore7Storage6createEPNS_5FrameEN3WTF10PassRefPtrINS_11StorageAreaEEE
-__ZN7WebCore7StorageC1EPNS_5FrameEN3WTF10PassRefPtrINS_11StorageAreaEEE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7StorageE
-__ZN7WebCore7CString11mutableDataEv
-__ZN7WebCore9JSStorage15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore7CString18copyBufferIfNeededEv
-__ZN7WebCore9JSStorageC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7StorageEEE
-__ZN7WebCore33jsDOMWindowCSSRuleListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13JSCSSRuleList14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore24JSCSSRuleListConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore22JSCSSRuleListPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore30jsDOMWindowCSSValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10JSCSSValue14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore19JSCSSValuePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore10JSCSSValue15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore34jsDOMWindowStorageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSStorageEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSStorageEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore23JSStorageEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore14JSStorageEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore34jsDOMWindowHTMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore45jsDOMWindowHTMLTableCaptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSHTMLTableCaptionElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore34JSHTMLTableCaptionElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore25JSHTMLTableCaptionElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLEmbedElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLEmbedElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLEmbedElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore40jsDOMWindowSVGRenderingIntentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20JSSVGRenderingIntent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore31JSSVGRenderingIntentConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore29JSSVGRenderingIntentPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore20JSSVGRenderingIntent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore34jsDOMWindowCSSValueListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSCSSValueList14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSCSSValueListConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore23JSCSSValueListPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore14JSCSSValueList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore42jsDOMWindowHTMLParagraphElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsDOMWindowDefaultstatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow13defaultStatusEv
-__ZNK7WebCore5Frame22jsDefaultStatusBarTextEv
-__ZN7WebCore42jsDOMWindowXMLHttpRequestUploadConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22JSXMLHttpRequestUpload14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore31JSXMLHttpRequestUploadPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore22JSXMLHttpRequestUpload15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore33jsDOMWindowPluginArrayConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13JSPluginArray14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore24JSPluginArrayConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore22JSPluginArrayPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore34jsDOMWindowCSSStyleRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSCSSStyleRule14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore23JSCSSStyleRulePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore14JSCSSStyleRule15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLParamElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLParamElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLParamElementPrototype4selfEPN3JSC9ExecStateE
-__ZN3WTF9HashTableIPKN3JSC9ClassInfoESt4pairIS4_PNS1_8JSObjectEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E4findIS4_NS_22IdentityHashTranslatorIS4_S8_SC_EEEENS_17HashTableIteratorIS4_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore18jsDOMWindowOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7onabortEv
-__ZN7WebCore26jsDOMWindowFileConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore6JSFile14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore17JSFileConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore15JSFilePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore6JSFile15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17jsDOMWindowStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow6statusEv
-__ZNK7WebCore5Frame15jsStatusBarTextEv
-__ZN7WebCore43jsDOMWindowSVGTextContentElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23JSSVGTextContentElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore40jsDOMWindowHTMLIsIndexElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20JSHTMLIsIndexElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore29JSHTMLIsIndexElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore20JSHTMLIsIndexElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore36jsDOMWindowCSSCharsetRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSCSSCharsetRule14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSCSSCharsetRulePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore16JSCSSCharsetRule15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore37jsDOMWindowHTMLMetaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSHTMLMetaElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSHTMLMetaElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore39jsDOMWindowHTMLButtonElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLButtonElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSHTMLButtonElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLTitleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLTitleElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLTitleElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore21jsDOMWindowScrollbarsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow10scrollbarsEv
-__ZN7WebCore30jsDOMWindowFileListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10JSFileList14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore21JSFileListConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore19JSFileListPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore10JSFileList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore40jsDOMWindowHTMLHeadingElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20JSHTMLHeadingElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore29JSHTMLHeadingElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore17jsDOMWindowOnblurEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow6onblurEv
-__ZN7WebCore37jsDOMWindowHTMLLinkElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSHTMLLinkElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSHTMLLinkElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore24jsDOMWindowDefaultStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsDOMWindowNotationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10JSNotation14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore21JSNotationConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore19JSNotationPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore10JSNotation15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore35jsDOMWindowCSSStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSCSSStyleSheet14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSCSSStyleSheetConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore24JSCSSStyleSheetPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore35jsDOMWindowMimeTypeArrayConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSMimeTypeArray14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSMimeTypeArrayConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore24JSMimeTypeArrayPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowCSSVariablesRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSCSSVariablesRule14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore29JSCSSVariablesRuleConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore27JSCSSVariablesRulePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18JSCSSVariablesRule15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore40jsDOMWindowHTMLMarqueeElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20JSHTMLMarqueeElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore31JSHTMLMarqueeElementConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore29JSHTMLMarqueeElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore20JSHTMLMarqueeElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore34jsDOMWindowMessageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSMessageEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSMessageEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore23JSMessageEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore14JSMessageEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore32jsDOMWindowMediaErrorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12JSMediaError14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore23JSMediaErrorConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore21JSMediaErrorPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore12JSMediaError15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore37jsDOMWindowHTMLMenuElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSHTMLMenuElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSHTMLMenuElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore17JSHTMLMenuElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore45jsDOMWindowXMLHttpRequestExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSXMLHttpRequestException14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore36JSXMLHttpRequestExceptionConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore34JSXMLHttpRequestExceptionPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore25JSXMLHttpRequestException15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore39jsDOMWindowHTMLObjectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLObjectElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSHTMLObjectElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore45jsDOMWindowHTMLTableSectionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSHTMLTableSectionElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore34JSHTMLTableSectionElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore36jsDOMWindowXPathExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSXPathException14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSXPathExceptionConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore25JSXPathExceptionPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore16JSXPathException15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore35jsDOMWindowCSSImportRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSCSSImportRule14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSCSSImportRuleConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore24JSCSSImportRulePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore15JSCSSImportRule15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore32jsDOMWindowMouseEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12JSMouseEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore23JSMouseEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore21JSMouseEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore33jsDOMWindowTextMetricsConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13JSTextMetrics14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore24JSTextMetricsConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore22JSTextMetricsPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore13JSTextMetrics15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore29jsDOMWindowOffscreenBufferingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow18offscreenBufferingEv
-__ZN7WebCore36jsDOMWindowHTMLDivElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore38jsDOMWindowHTMLAudioElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLAudioElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore29JSHTMLAudioElementConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLAudioElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLAudioElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore25jsDOMWindowSessionStorageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow14sessionStorageEv
-__ZN7WebCore14SessionStorage6createEPNS_4PageE
-__ZN7WebCore14SessionStorageC1EPNS_4PageE
-__ZN7WebCore14SessionStorage11storageAreaEPNS_14SecurityOriginE
-__ZN7WebCore18SessionStorageAreaC1EPNS_14SecurityOriginEPNS_4PageE
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_18SessionStorageAreaEEENS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS8_IS6_EEE3getEPS3_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_NS1_INS2_18SessionStorageAreaEEEENS_18PairFirstExtractorIS8_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSD_IS7_EEEESE_E6expandEv
-__ZN7WebCore38jsDOMWindowHTMLStyleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLStyleElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLStyleElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore37jsDOMWindowCSSFontFaceRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSCSSFontFaceRule14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSCSSFontFaceRuleConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore26JSCSSFontFaceRulePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore17JSCSSFontFaceRule15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore30jsDOMWindowNodeListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore36jsDOMWindowRangeExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSRangeException14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSRangeExceptionConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore25JSRangeExceptionPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore16JSRangeException15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore29jsDOMWindowStorageConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9JSStorage14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore20JSStorageConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore18JSStoragePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore32jsDOMWindowSVGPathSegConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12JSSVGPathSeg14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore23JSSVGPathSegConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore21JSSVGPathSegPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore12JSSVGPathSeg15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore41jsDOMWindowHTMLFieldSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21JSHTMLFieldSetElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore32JSHTMLFieldSetElementConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore30JSHTMLFieldSetElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore21jsDOMWindowOnkeypressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow10onkeypressEv
-__ZN7WebCore34jsDOMWindowDocumentTypeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSDocumentType14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSDocumentTypeConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore23JSDocumentTypePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore14JSDocumentType15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore34jsDOMWindowSVGUnitTypesConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSSVGUnitTypes14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSSVGUnitTypesConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore23JSSVGUnitTypesPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore14JSSVGUnitTypes15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore35jsDOMWindowHTMLBRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSHTMLBRElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore24JSHTMLBRElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18jsDOMWindowOnclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7onclickEv
-__ZN7WebCore39jsDOMWindowHTMLOptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLOptionElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSHTMLOptionElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore35jsDOMWindowKeyboardEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSKeyboardEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSKeyboardEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore24JSKeyboardEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore21jsDOMWindowOuterWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow10outerWidthEv
-__ZN7WebCore34jsDOMWindowCDATASectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSCDATASection14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSCDATASectionConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore23JSCDATASectionPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore14JSCDATASection15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore43jsDOMWindowProcessingInstructionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23JSProcessingInstruction14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore32JSProcessingInstructionPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore23JSProcessingInstruction15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore41jsDOMWindowCSSStyleDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21JSCSSStyleDeclaration14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore30JSCSSStyleDeclarationPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18jsDOMWindowScrollXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore37jsDOMWindowHTMLHtmlElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSHTMLHtmlElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSHTMLHtmlElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore30jsDOMWindowSVGAngleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10JSSVGAngle14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore19JSSVGAnglePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore10JSSVGAngle15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore32jsDOMWindowStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12JSStyleSheet14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore34jsDOMWindowDOMExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSDOMCoreException14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore29JSDOMCoreExceptionConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore27JSDOMCoreExceptionPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18JSDOMCoreException15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21jsDOMWindowOndblclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow10ondblclickEv
-__ZN7WebCore18jsDOMWindowScreenYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7screenYEv
-__ZN7WebCore19jsDOMWindowOnchangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow8onchangeEv
-__ZN7WebCore36jsDOMWindowHTMLCollectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSHTMLCollection14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLCollectionConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLOListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsDOMWindowOnfocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7onfocusEv
-__ZN7WebCore35jsDOMWindowXMLSerializerConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSXMLSerializer14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSXMLSerializerConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore24JSXMLSerializerPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore15JSXMLSerializer15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore34jsDOMWindowSVGExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSSVGException14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSSVGExceptionConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore23JSSVGExceptionPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore14JSSVGException15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18jsDOMWindowToolbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7toolbarEv
-__ZN7WebCore18jsDOMWindowScreenXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsDOMWindowOnmouseoverEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow11onmouseoverEv
-__ZN7WebCore19jsDOMWindowOnsubmitEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow8onsubmitEv
-__ZN7WebCore38jsDOMWindowHTMLImageElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsDOMWindowOnsearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow8onsearchEv
-__ZN7WebCore27jsDOMWindowDevicePixelRatioEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow16devicePixelRatioEv
-__ZN7WebCore39jsDOMWindowCSSPrimitiveValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSCSSPrimitiveValue14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore30JSCSSPrimitiveValueConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore28JSCSSPrimitiveValuePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore19JSCSSPrimitiveValue15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore35jsDOMWindowDOMStringListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSDOMStringList14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSDOMStringListConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore24JSDOMStringListPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore15JSDOMStringList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore46jsDOMWindowCanvasRenderingContext2DConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26JSCanvasRenderingContext2D14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore35JSCanvasRenderingContext2DPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore35jsDOMWindowOverflowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSOverflowEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSOverflowEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore24JSOverflowEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore15JSOverflowEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore36jsDOMWindowEventExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSEventException14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSEventExceptionConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore25JSEventExceptionPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore16JSEventException15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore41jsDOMWindowHTMLFrameSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21JSHTMLFrameSetElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore30JSHTMLFrameSetElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore21JSHTMLFrameSetElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore26jsDOMWindowAttrConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore6JSAttr14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore15JSAttrPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore30jsDOMWindowSVGColorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10JSSVGColor14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore21JSSVGColorConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore19JSSVGColorPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore10JSSVGColor15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore37jsDOMWindowHTMLBaseElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSHTMLBaseElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSHTMLBaseElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore17JSHTMLBaseElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore45jsDOMWindowWebKitCSSTransformValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSWebKitCSSTransformValue14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore36JSWebKitCSSTransformValueConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore34JSWebKitCSSTransformValuePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore25JSWebKitCSSTransformValue15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18jsDOMWindowOnresetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7onresetEv
-__ZN7WebCore39jsDOMWindowDOMImplementationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSDOMImplementation14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore30JSDOMImplementationConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore28JSDOMImplementationPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore39jsDOMWindowHTMLLegendElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLLegendElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSHTMLLegendElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore42jsDOMWindowHTMLTableCellElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22JSHTMLTableCellElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore31JSHTMLTableCellElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore43jsDOMWindowWebKitTransitionEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23JSWebKitTransitionEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore34JSWebKitTransitionEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore32JSWebKitTransitionEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore23JSWebKitTransitionEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore20jsDOMWindowOnmouseupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow9onmouseupEv
-__ZN7WebCore31jsDOMWindowSVGLengthConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore11JSSVGLength14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore20JSSVGLengthPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore11JSSVGLength15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19jsDOMWindowOnresizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow8onresizeEv
-__ZN7WebCore40jsDOMWindowSVGGradientElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20JSSVGGradientElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore31JSSVGGradientElementConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore29JSSVGGradientElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore20JSSVGGradientElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore29jsDOMWindowUIEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9JSUIEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore20JSUIEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore31jsDOMWindowOnwebkitanimationendEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow20onwebkitanimationendEv
-__ZN7WebCore45jsDOMWindowCSSVariablesDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSCSSVariablesDeclaration14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore34JSCSSVariablesDeclarationPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore25JSCSSVariablesDeclaration15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18jsDOMWindowOnkeyupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7onkeyupEv
-__ZN7WebCore39jsDOMWindowHTMLScriptElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLScriptElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSHTMLScriptElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore39jsDOMWindowHTMLAnchorElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsDOMWindowHTMLLIElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSHTMLLIElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore24JSHTMLLIElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore36jsDOMWindowHTMLModElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSHTMLModElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSHTMLModElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore37jsDOMWindowHTMLAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSHTMLAreaElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSHTMLAreaElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore20jsDOMWindowScreenTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsDOMWindowOnmousemoveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow11onmousemoveEv
-__ZN7WebCore35jsDOMWindowMutationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSMutationEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSMutationEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore24JSMutationEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore39jsDOMWindowHTMLCanvasElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLCanvasElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSHTMLCanvasElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore36jsDOMWindowXPathEvaluatorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSXPathEvaluator14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSXPathEvaluatorConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore25JSXPathEvaluatorPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore16JSXPathEvaluator15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore43jsDOMWindowHTMLBlockquoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23JSHTMLBlockquoteElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore32JSHTMLBlockquoteElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore32jsDOMWindowWheelEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12JSWheelEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore23JSWheelEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore21JSWheelEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore12JSWheelEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore22jsDOMWindowOnmousedownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow11onmousedownEv
-__ZN7WebCore32jsDOMWindowNodeFilterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12JSNodeFilter14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore23JSNodeFilterConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore21JSNodeFilterPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore12JSNodeFilter15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore37jsDOMWindowOnwebkitanimationiterationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow26onwebkitanimationiterationEv
-__ZN7WebCore18jsDOMWindowScrollYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsDOMWindowPluginConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore8JSPlugin14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore19JSPluginConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore17JSPluginPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLMediaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLMediaElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore33jsDOMWindowXMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore43jsDOMWindowWebKitCSSKeyframeRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23JSWebKitCSSKeyframeRule14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore32JSWebKitCSSKeyframeRulePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore23JSWebKitCSSKeyframeRule15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore31jsDOMWindowMediaListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore11JSMediaList14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore20JSMediaListPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore11JSMediaList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore22jsDOMWindowOuterHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow11outerHeightEv
-__ZN7WebCore36jsDOMWindowStyleSheetListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSStyleSheetList14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSStyleSheetListConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore25JSStyleSheetListPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore34jsDOMWindowCSSMediaRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSCSSMediaRule14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSCSSMediaRuleConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore23JSCSSMediaRulePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore14JSCSSMediaRule15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLFrameElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLFrameElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18JSHTMLFrameElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore29jsDOMWindowCommentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9JSComment14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore20JSCommentConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore18JSCommentPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore39jsDOMWindowHTMLIFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19JSHTMLIFrameElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSHTMLIFrameElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLDListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLDListElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLDListElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore42jsDOMWindowHTMLDirectoryElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22JSHTMLDirectoryElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore31JSHTMLDirectoryElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore22JSHTMLDirectoryElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore28jsDOMWindowClientInformationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsDOMWindowNamedNodeMapConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSNamedNodeMap14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSNamedNodeMapConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore23JSNamedNodeMapPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore37jsDOMWindowHTMLBodyElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSHTMLBodyElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSHTMLBodyElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18jsDOMWindowMenubarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow7menubarEv
-__ZN7WebCore37jsDOMWindowHTMLFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSHTMLFontElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSHTMLFontElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLTableElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLTableElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLTableElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowSVGMarkerElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSSVGMarkerElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSSVGMarkerElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore18JSSVGMarkerElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore44jsDOMWindowWebKitCSSKeyframesRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24JSWebKitCSSKeyframesRule14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore33JSWebKitCSSKeyframesRulePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore24JSWebKitCSSKeyframesRule15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowDocumentFragmentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSDocumentFragment14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore29JSDocumentFragmentConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore27JSDocumentFragmentPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore33jsDOMWindowCSSPageRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13JSCSSPageRule14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore22JSCSSPageRulePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore13JSCSSPageRule15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore41jsDOMWindowHTMLBaseFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21JSHTMLBaseFontElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore30JSHTMLBaseFontElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore21JSHTMLBaseFontElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore41jsDOMWindowHTMLOptGroupElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21JSHTMLOptGroupElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore30JSHTMLOptGroupElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore21JSHTMLOptGroupElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore22jsDOMWindowPersonalbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow11personalbarEv
-__ZN7WebCore41jsDOMWindowHTMLTableRowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21JSHTMLTableRowElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore30JSHTMLTableRowElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore32jsDOMWindowOnwebkittransitionendEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow21onwebkittransitionendEv
-__ZN7WebCore34jsDOMWindowSVGTransformConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSSVGTransform14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSSVGTransformConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore23JSSVGTransformPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore14JSSVGTransform15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLLabelElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLLabelElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSHTMLLabelElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore36jsDOMWindowHTMLPreElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSHTMLPreElement14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSHTMLPreElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore33jsDOMWindowOnwebkitanimationstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow22onwebkitanimationstartEv
-__ZN7WebCore37jsDOMWindowEntityReferenceConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSEntityReference14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSEntityReferenceConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore26JSEntityReferencePrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore17JSEntityReference15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore22jsDOMWindowLocationbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow11locationbarEv
-__ZN7WebCore42jsDOMWindowWebKitAnimationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22JSWebKitAnimationEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore33JSWebKitAnimationEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore31JSWebKitAnimationEventPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore22JSWebKitAnimationEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore30jsDOMWindowSVGPaintConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10JSSVGPaint14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore21JSSVGPaintConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore19JSSVGPaintPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore10JSSVGPaint15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore35jsDOMWindowProgressEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSProgressEvent14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore26JSProgressEventConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore38jsDOMWindowHTMLUListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsDOMWindowRectConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore6JSRect14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore17JSRectConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore15JSRectPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore6JSRect15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore27jsDOMWindowApplicationCacheEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow16applicationCacheEv
-__ZN7WebCore19DOMApplicationCacheC1EPNS_5FrameE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19DOMApplicationCacheE
-__ZN7WebCore21JSDOMApplicationCache15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSDOMApplicationCacheC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19DOMApplicationCacheEEE
-__ZL28jsDOMWindowBaseXSLTProcessorPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore26JSXSLTProcessorConstructorC1EPN3JSC9ExecStateE
-__ZN7WebCore24JSXSLTProcessorPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore15JSXSLTProcessor15createPrototypeEPN3JSC9ExecStateE
-__ZL21jsDOMWindowBaseWorkerPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore19JSWorkerConstructorC1EPN3JSC9ExecStateE
-__ZL29jsDOMWindowBaseMessageChannelPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZL30jsDOMWindowBaseWebKitCSSMatrixPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore28JSWebKitCSSMatrixConstructorC1EPN3JSC9ExecStateEPNS_22ScriptExecutionContextE
-__ZL20jsDOMWindowBaseAudioPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore11MediaPlayer11isAvailableEv
-__ZN7WebCore18MediaPlayerPrivate11isAvailableEv
-__ZN7WebCore18JSAudioConstructorC1EPN3JSC9ExecStateEPNS_22ScriptExecutionContextE
-__ZL21jsDOMWindowBaseCryptoPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore6Chrome11canRunModalEv
-__ZN7WebCore18JSAudioConstructor4markEv
-__ZN7WebCore21JSDOMApplicationCache4markEv
-__ZNK7WebCore14SecurityOrigin18databaseIdentifierEv
-__ZN7WebCore19DOMApplicationCache15disconnectFrameEv
-__ZN7WebCore27JSHTMLMapElementConstructorD0Ev
-__ZN7WebCore30JSHTMLAppletElementConstructorD0Ev
-__ZN7WebCore18JSAudioConstructorD0Ev
-__ZN7WebCore28JSWebKitCSSMatrixConstructorD0Ev
-__ZN7WebCore19JSWorkerConstructorD0Ev
-__ZN7WebCore24JSXSLTProcessorPrototypeD0Ev
-__ZN7WebCore26JSXSLTProcessorConstructorD0Ev
-__ZN7WebCore19JSSVGPaintPrototypeD0Ev
-__ZN7WebCore31JSWebKitAnimationEventPrototypeD0Ev
-__ZN7WebCore33JSWebKitAnimationEventConstructorD0Ev
-__ZN7WebCore28JSEntityReferenceConstructorD0Ev
-__ZN7WebCore29JSDocumentFragmentConstructorD0Ev
-__ZN7WebCore35JSWebKitCSSKeyframesRuleConstructorD0Ev
-__ZN7WebCore28JSHTMLFontElementConstructorD0Ev
-__ZN7WebCore25JSNamedNodeMapConstructorD0Ev
-__ZN7WebCore20JSCommentConstructorD0Ev
-__ZN7WebCore25JSCSSMediaRuleConstructorD0Ev
-__ZN7WebCore20JSMediaListPrototypeD0Ev
-__ZN7WebCore22JSMediaListConstructorD0Ev
-__ZN7WebCore32JSWebKitCSSKeyframeRulePrototypeD0Ev
-__ZN7WebCore19JSPluginConstructorD0Ev
-__ZN7WebCore27JSXPathEvaluatorConstructorD0Ev
-__ZN7WebCore28JSHTMLAreaElementConstructorD0Ev
-__ZN7WebCore30JSHTMLScriptElementConstructorD0Ev
-__ZN7WebCore32JSWebKitTransitionEventPrototypeD0Ev
-__ZN7WebCore34JSWebKitTransitionEventConstructorD0Ev
-__ZN7WebCore33JSHTMLTableCellElementConstructorD0Ev
-__ZN7WebCore30JSDOMImplementationConstructorD0Ev
-__ZN7WebCore28JSHTMLBaseElementConstructorD0Ev
-__ZN7WebCore19JSSVGColorPrototypeD0Ev
-__ZN7WebCore37JSCanvasRenderingContext2DConstructorD0Ev
-__ZN7WebCore26JSDOMStringListConstructorD0Ev
-__ZN7WebCore30JSCSSPrimitiveValueConstructorD0Ev
-__ZN7WebCore27JSHTMLCollectionConstructorD0Ev
-__ZN7WebCore18JSRangeConstructorD0Ev
-__ZN7WebCore32JSCSSStyleDeclarationConstructorD0Ev
-__ZN7WebCore34JSProcessingInstructionConstructorD0Ev
-__ZN7WebCore21JSNodeListConstructorD0Ev
-__ZN7WebCore9JSStorageD0Ev
-__ZN7WebCore24JSTextMetricsConstructorD0Ev
-__ZN7WebCore26JSCSSImportRuleConstructorD0Ev
-__ZN7WebCore30JSHTMLObjectElementConstructorD0Ev
-__ZN7WebCore29JSHTMLMarqueeElementPrototypeD0Ev
-__ZN7WebCore26JSMimeTypeArrayConstructorD0Ev
-__ZN7WebCore21JSNotationConstructorD0Ev
-__ZN7WebCore28JSHTMLLinkElementConstructorD0Ev
-__ZN7WebCore17JSFileConstructorD0Ev
-__ZN7WebCore31JSXMLHttpRequestUploadPrototypeD0Ev
-__ZN7WebCore23JSCSSValueListPrototypeD0Ev
-__ZN7WebCore25JSStorageEventConstructorD0Ev
-__ZN7WebCore24JSCSSRuleListConstructorD0Ev
-__ZN7WebCore33JSSVGPreserveAspectRatioPrototypeD0Ev
-__ZN7WebCore26JSCharacterDataConstructorD0Ev
-__ZN7WebCore20JSTextEventPrototypeD0Ev
-__ZN7WebCore22JSClipboardConstructorD0Ev
-__ZN7WebCore17JSTextConstructorD0Ev
-__ZN7WebCore32JSSVGTextContentElementPrototypeD0Ev
-__ZNK7WebCore26CSSMutableStyleDeclaration10get4ValuesEPKi
-__ZN7WebCore10JSLocation16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore10JSLocation22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore19JSLocationPrototype9classInfoEv
-__ZN7WebCore23jsHTMLSelectElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26setJSHTMLSelectElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLSelectElement7setSizeEi
-__ZNK7WebCore14SecurityOrigin5equalEPKS0_
--[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]
-__ZN7WebCore37jsPluginArrayPrototypeFunctionRefreshEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore13JSPluginArray9classInfoEv
-__ZN7WebCore11PluginArray7refreshEb
-__ZN7WebCore4Page14refreshPluginsEb
-__ZN7WebCore10PluginData7refreshEv
-__ZN7WebCore9InlineBox11extractLineEv
-__ZN7WebCore9InlineBox10attachLineEv
-__ZN7WebCore26jsEventTargetNodeOnkeydownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode9onkeydownEv
-__ZN7WebCore23jsEventTargetNodeOnblurEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode6onblurEv
-__ZN7WebCore24jsEventTargetNodeOnfocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode7onfocusEv
-__ZThn140_N7WebCore14RenderMenuList12valueChangedEjb
-__ZN7WebCore14RenderMenuList12valueChangedEjb
-__ZNK7WebCore17HTMLSelectElement17listToOptionIndexEi
-__ZNK7WebCore19HTMLFieldSetElement11isFocusableEv
-__ZN7WebCore9PopupMenu5clearEv
-__ZN7WebCore17ScrollbarThemeMac14backButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
-__ZN7WebCoreL17buttonRepaintRectERKNS_7IntRectENS_20ScrollbarOrientationENS_20ScrollbarControlSizeEb
-__ZN7WebCore17ScrollbarThemeMac17forwardButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
-__ZN7WebCore9Scrollbar28pressedPartScrollGranularityEv
-__ZN7WebCore9Scrollbar26pressedPartScrollDirectionEv
-__ZN7WebCore9Scrollbar18startTimerIfNeededEd
-__ZN7WebCore16JSStyleSheetList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZN7WebCore16JSStyleSheetList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore13JSCSSRuleList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZN7WebCore13JSCSSRuleList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7CSSRuleE
-__ZNK7WebCore12CSSStyleRule4typeEv
-__ZN7WebCore14JSCSSStyleRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSStyleRuleEEE
-__ZN7WebCore9JSCSSRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CSSRuleEEE
-__ZN7WebCore14JSCSSStyleRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19jsCSSStyleRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26setJSHTMLStyleElementMediaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLStyleElement8setMediaERKNS_12AtomicStringE
-__ZN7WebCore14JSCSSStyleRuleD0Ev
-__ZN7WebCore9JSCSSRuleD0Ev
-__ZN7WebCore19JSHTMLSelectElement18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLSelectElement11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore17HTMLSelectElement4itemEj
-__ZThn56_N7WebCore17HTMLScriptElement18dispatchErrorEventEv
-__ZN7WebCore17HTMLScriptElement18dispatchErrorEventEv
-__ZNK7WebCore13HTMLTokenizer15executingScriptEv
-__ZNK7WebCore15HTMLLinkElement14isURLAttributeEPNS_9AttributeE
-__ZN7WebCore21jsHTMLAreaElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLAreaElement4hrefEv
-__ZNK7WebCore9FontValue7cssTextEv
-__ZN7WebCore20jsHTMLDocumentHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12HTMLDocument6heightEv
-__ZN7WebCore19jsHTMLDocumentWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12HTMLDocument5widthEv
-__ZN7WebCoreL11asFileInputEPNS_4NodeE
-__ZN7WebCore14DragController13dragOperationEPNS_8DragDataE
-__ZNK7WebCore8DragData11containsURLEv
-__ZNK7WebCore8DragData5asURLEPNS_6StringE
-__ZN7WebCore28jsEventTargetNodeOnmousemoveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode11onmousemoveEv
-__ZN7WebCore27jsHTMLTableCellElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement5widthEv
-__ZN7WebCore29setJSHTMLScriptElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLScriptElement10setCharsetERKNS_6StringE
-__ZN7WebCore26setJSHTMLAnchorElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAnchorElement7setNameERKNS_12AtomicStringE
-__ZN7WebCore20jsHTMLMapElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore14HTMLMapElement4nameEv
-__ZN7WebCore16JSHTMLMapElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZNK7WebCore15HTMLFormElement19CheckedRadioButtons21checkedButtonForGroupERKNS_12AtomicStringE
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_16HTMLInputElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS_6VectorIPNS1_7ElementELm0EEEENS_18PairFirstExtractorISA_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSG_IS9_EEEESH_E4findIS3_NS_22IdentityHashTranslatorIS3_SA_SE_EEEENS_17HashTableIteratorIS3_SA_SC_SE_SJ_SH_EERKT_
-__ZN7WebCore27getExceptionCodeDescriptionEiRNS_24ExceptionCodeDescriptionE
-__ZN7WebCore13ExceptionBaseC2ERKNS_24ExceptionCodeDescriptionE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_16DOMCoreExceptionE
-__ZN7WebCore18JSDOMCoreExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DOMCoreExceptionEEE
-__ZNK3JSC8JSObject22isNotAnObjectErrorStubEv
-__ZN7WebCore18JSDOMCoreException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSDOMCoreExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK3JSC8JSObject19isWatchdogExceptionEv
-__ZN7WebCore19HTMLTextAreaElement5resetEv
-__ZN7WebCore8Document17setSecurityOriginEPNS_14SecurityOriginE
-__ZN7WebCore11FrameLoader5writeERKNS_6StringE
-__ZN7WebCore18MainResourceLoader26stopLoadingForPolicyChangeEv
-__ZN7WebCore24jsHTMLTableElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement6borderEv
-__ZNK7WebCore17HTMLObjectElement18containsJavaAppletEv
-__ZN7WebCore20jsHTMLDocumentEmbedsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore8Document6embedsEv
-__ZN7WebCore21jsHTMLDocumentPluginsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore8Document7pluginsEv
-__ZN7WebCore22jsNavigatorAppCodeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13NavigatorBase11appCodeNameEv
-__ZN7WebCore17jsScreenAvailLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Screen9availLeftEv
-__ZN7WebCore16jsScreenAvailTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Screen8availTopEv
-__ZN7WebCore43jsNamedNodeMapPrototypeFunctionGetNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore14JSNamedNodeMap9classInfoEv
-__ZN7WebCore23jsHTMLOptionElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLOptionElement4textEv
-__ZN7WebCore23jsHTMLAnchorElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement4textEv
-__ZN7WebCore25jsHTMLAnchorElementSearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement6searchEv
-__ZN7WebCore27jsEventTargetNodeOnkeypressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode10onkeypressEv
-__ZN7WebCore24jsEventTargetNodeOnkeyupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode7onkeyupEv
-__ZN3WTF6VectorIN3JSC19ProtectedJSValuePtrELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN3JSC19ProtectedJSValuePtrELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN3JSC19ProtectedJSValuePtrELm0EE6shrinkEm
-__ZN7WebCore28jsEventTargetNodeOnmousedownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode11onmousedownEv
-__ZN7WebCore23jsEventTargetNodeOndragEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode6ondragEv
-__ZN7WebCore26setJSEventTargetNodeOndragEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode9setOndragEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore30jsEventTargetNodeOnselectstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode13onselectstartEv
-__ZN7WebCore24setJSDOMWindowOnkeypressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow13setOnkeypressEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore21setJSDOMWindowOnclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow10setOnclickEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore25setJSDOMWindowOnmouseoverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow14setOnmouseoverEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore12MessageEvent14isMessageEventEv
-__ZN7WebCore15getDOMStructureINS_14JSMessageEventEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore14JSMessageEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12MessageEventEEE
-__ZN7WebCore14JSMessageEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCoreL22getJSMessageEventTableEPN3JSC9ExecStateE
-__ZN7WebCore23JSMessageEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCoreL31getJSMessageEventPrototypeTableEPN3JSC9ExecStateE
-__ZN7WebCore20jsMessageEventOriginEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsMessageEventDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSMessageEventD0Ev
-__ZN7WebCore4Node16shadowParentNodeEv
-__ZThn12_N7WebCore14XMLHttpRequest16contextDestroyedEv
-__ZN7WebCore14XMLHttpRequest16contextDestroyedEv
-__ZN7WebCore25setJSHTMLLinkElementMediaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLLinkElement8setMediaERKNS_6StringE
-__ZN7WebCoreL25min_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL21widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCore16CSSStyleSelector36addViewportDependentMediaQueryResultEPKNS_13MediaQueryExpEb
-__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE6shrinkEm
-__ZN7WebCore23jsHTMLScriptElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLScriptElement4typeEv
-__ZN7WebCore14JSNamedNodeMap18canGetItemsForNameEPN3JSC9ExecStateEPNS_12NamedNodeMapERKNS1_10IdentifierE
-__ZN7WebCore14JSNamedNodeMap10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore27jsHTMLOptionElementSelectedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
--[DOMDocument body]
-__ZN7WebCore11FrameLoader6reloadEb
-__ZN7WebCore17jsDocumentDoctypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSDocumentTypeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DocumentTypeEEE
-__ZN7WebCore14JSDocumentType18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22jsDocumentTypeSystemIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSDocumentTypeD0Ev
-__ZN7WebCore4Page9goForwardEv
-__ZN7WebCore14SessionStorage4copyEPNS_4PageE
-__ZN7WebCore18SessionStorageArea4copyEPNS_14SecurityOriginEPNS_4PageE
-__ZN7WebCore18SessionStorageAreaC1EPNS_14SecurityOriginEPNS_4PageEPS0_
-__ZN7WebCore11StorageAreaC2EPNS_14SecurityOriginEPS0_
-__ZN7WebCore4Page17setSessionStorageEN3WTF10PassRefPtrINS_14SessionStorageEEE
-__ZN7WebCore18SessionStorageAreaD1Ev
-__ZN7WebCore11StorageAreaD0Ev
-__ZN7WebCore24setJSHTMLFormElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLFormElement7setNameERKNS_6StringE
-__ZNK7WebCore28JSHTMLAnchorElementPrototype9classInfoEv
-__ZN7WebCore27jsHTMLAnchorElementHreflangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement8hreflangEv
-__ZN7WebCore24jsHTMLAnchorElementShapeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement5shapeEv
-__ZN7WebCore23jsHTMLAnchorElementPortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement4portEv
-__ZN7WebCore28jsHTMLAnchorElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement9accessKeyEv
-__ZN7WebCore22jsHTMLAnchorElementRevEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement3revEv
-__ZN7WebCore26jsHTMLAnchorElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement7charsetEv
-__ZN7WebCore25jsHTMLAnchorElementCoordsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAnchorElement6coordsEv
-__ZNK7WebCore17HTMLAnchorElement8tabIndexEv
-__ZN7WebCore9StyleBase11checkLoadedEv
-__ZN7WebCore32setJSHTMLTextAreaElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23jsHTMLAreaElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLTableElementTHeadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement5tHeadEv
-__ZNK7WebCore7Element13hasAttributesEv
-__ZN7WebCore22JSNamedNodesCollection12lengthGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore19HTMLTableColElement8checkDTDEPKNS_4NodeE
-__ZNK7WebCore14RenderTableCol15canHaveChildrenEv
-__ZNK7WebCore14RenderTableCol14isChildAllowedEPNS_12RenderObjectEPNS_11RenderStyleE
-__ZN7WebCore26setJSHTMLImageElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement8setAlignERKNS_6StringE
-__ZN7WebCore27setJSHTMLImageElementHspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement9setHspaceEi
-__ZN7WebCore27setJSHTMLImageElementVspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement9setVspaceEi
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS2_8Bindings6MethodEENS_18PairFirstExtractorISA_EENS_7StrHashIS5_EENS_14PairHashTraitsINS_10HashTraitsIS5_EENSG_IS9_EEEESH_E4findIS5_NS_22IdentityHashTranslatorIS5_SA_SE_EEEENS_17HashTableIteratorIS5_SA_SC_SE_SJ_SH_EERKT_
-__ZN7WebCore9FrameView20postLayoutTimerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore11RenderTheme32inactiveSelectionBackgroundColorEv
-__ZNK7WebCore11RenderTheme32inactiveSelectionForegroundColorEv
-__ZN7WebCore17jsStyleSheetTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25setJSHTMLAnchorElementRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAnchorElement6setRelERKNS_12AtomicStringE
-__ZN7WebCore28setJSHTMLLinkElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLLinkElement11setDisabledEb
-__ZN7WebCore15HTMLLinkElement16setDisabledStateEb
-__ZN7WebCore16LocalStorageArea17scheduleFinalSyncEv
-__ZN7WebCore16LocalStorageArea14syncTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore12LocalStorage12scheduleSyncEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
-__ZN7WebCore18LocalStorageThread12scheduleSyncEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
-__ZN7WebCore16LocalStorageArea11performSyncEv
-__ZN7WebCore16LegacyWebArchive6createEPNS_12SharedBufferE
-__ZN7WebCore16LegacyWebArchive4initEPNS_12SharedBufferE
-__ZN7WebCore16LegacyWebArchive7extractEPK14__CFDictionary
-__ZN7WebCoreL14createResourceEPK14__CFDictionary
-__ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceResponseE
-__ZN7WebCore15ArchiveResourceC1EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_
-__ZN7WebCore41createResourceResponseFromMacArchivedDataEPK8__CFData
-__ZN7WebCore12SharedBuffer12createNSDataEv
-__ZNK7WebCore20ResourceResponseBase17suggestedFilenameEv
-__ZN7WebCore11FrameLoader26saveDocumentAndScrollStateEv
-__ZNK7WebCore11HistoryItem4copyEv
-__ZNK7WebCore14RenderThemeMac22adjustSearchFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac18setSearchFieldSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac16searchFieldSizesEv
-__ZNK7WebCore27RenderTextControlSingleLine21createInnerBlockStyleEPKNS_11RenderStyleE
-__ZN7WebCore31SearchFieldResultsButtonElementC1EPNS_8DocumentE
-__ZNK7WebCore27RenderTextControlSingleLine24createResultsButtonStyleEPKNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac32adjustSearchFieldDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac18resultsButtonSizesEv
-__ZN7WebCore30SearchFieldCancelButtonElementC1EPNS_8DocumentE
-__ZNK7WebCore27RenderTextControlSingleLine23createCancelButtonStyleEPKNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac34adjustSearchFieldCancelButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore18jsEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsDOMWindowPrototypeFunctionAlertEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9DOMWindow5alertERKNS_6StringE
-__ZN7WebCore6Chrome18runJavaScriptAlertEPNS_5FrameERKNS_6StringE
-__ZN7WebCoreL20executeDeleteForwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedEPNS_8DocumentEbNS_15TextGranularityEb
-__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedENS_15TextGranularityEb
-__ZN7WebCore19SelectionController27modifyExtendingRightForwardENS_15TextGranularityE
-__ZN7WebCore9SelectionD2Ev
-__ZN7WebCoreL13separatorItemEv
-__ZN7WebCore9CSSParser24parseTransitionShorthandEb
-__ZN7WebCore9CSSParser22parseAnimationPropertyEiRN3WTF6RefPtrINS_8CSSValueEEE
-__ZN7WebCore9CSSParser22parseAnimationPropertyEv
-__ZN7WebCore9CSSParser17addAnimationValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
-__ZN7WebCore9CSSParser22parseAnimationDurationEv
-__ZN7WebCore9CSSParser28parseAnimationTimingFunctionEv
-__ZN7WebCore11RenderStyle17accessTransitionsEv
-__ZN7WebCore9Animation6createEv
-__ZN7WebCore9AnimationC1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE6appendINS_10PassRefPtrIS3_EEEEvRKT_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE15reserveCapacityEm
-__ZN7WebCore16CSSStyleSelector20mapAnimationPropertyEPNS_9AnimationEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector20mapAnimationDurationEPNS_9AnimationEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector26mapAnimationTimingFunctionEPNS_9AnimationEPNS_8CSSValueE
-__ZN7WebCore13AnimationList19fillUnsetPropertiesEv
-__ZN7WebCore26AnimationControllerPrivate24accessCompositeAnimationEPNS_12RenderObjectE
-__ZN3WTF7HashMapIPN7WebCore12RenderObjectENS_6RefPtrINS1_18CompositeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
-__ZN7WebCore18CompositeAnimationC1EPNS_19AnimationControllerE
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_NS_6RefPtrINS1_18CompositeAnimationEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCore18CompositeAnimation7animateEPNS_12RenderObjectEPNS_11RenderStyleES4_
-__ZN7WebCore25CompositeAnimationPrivate7animateEPNS_12RenderObjectEPNS_11RenderStyleES4_
-__ZN7WebCore25CompositeAnimationPrivate24updateKeyframeAnimationsEPNS_12RenderObjectEPNS_11RenderStyleES4_
-__ZN7WebCore25CompositeAnimationPrivate17updateTransitionsEPNS_12RenderObjectEPNS_11RenderStyleES4_
-__ZN7WebCore25CompositeAnimationPrivate25cleanupFinishedAnimationsEPNS_12RenderObjectE
-__ZNK7WebCore18CompositeAnimation11isSuspendedEv
-__ZNK7WebCore18CompositeAnimation13hasAnimationsEv
-__ZN7WebCore18CompositeAnimation16resumeAnimationsEv
-__ZN7WebCore25CompositeAnimationPrivate16resumeAnimationsEv
-__ZN7WebCore13AnimationBase16getNumPropertiesEv
-__ZN7WebCoreL17ensurePropertyMapEv
-__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE15reserveCapacityEm
-__ZN7WebCoreL22addShorthandPropertiesEv
-__ZN7WebCoreL18wrapperForPropertyEi
-__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE14expandCapacityEmPKS3_
-__ZN7WebCoreL18addPropertyWrapperEiPNS_19PropertyWrapperBaseE
-__ZN7WebCore25CompositeAnimationPrivate23getAnimationForPropertyEi
-__ZN3WTF7HashMapIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3setERKiRKS4_
-__ZN7WebCore13AnimationBase15propertiesEqualEiPKNS_11RenderStyleES3_
-__ZNK7WebCore21PropertyWrapperGetterIfE6equalsEPKNS_11RenderStyleES4_
-__ZNK7WebCore11RenderStyle7opacityEv
-__ZN7WebCore17ImplicitAnimationC1EPKNS_9AnimationEiPNS_12RenderObjectEPNS_18CompositeAnimationEPNS_11RenderStyleE
-__ZN7WebCore13AnimationBaseC2EPKNS_9AnimationEPNS_12RenderObjectEPNS_18CompositeAnimationE
-__ZN3WTF9HashTableIiSt4pairIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSC_IS5_EEEESD_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS6_
-__ZN7WebCore17ImplicitAnimation7animateEPNS_18CompositeAnimationEPNS_12RenderObjectEPNS_11RenderStyleES6_RN3WTF6RefPtrIS5_EE
-__ZN7WebCore17ImplicitAnimation5resetEPNS_11RenderStyleE
-__ZN7WebCore13AnimationBase18updateStateMachineENS0_14AnimStateInputEd
-__ZN7WebCore13AnimationBase12endAnimationEb
-__ZNK7WebCore13AnimationBase24beginAnimationUpdateTimeEv
-__ZN7WebCore18CompositeAnimation19animationControllerEv
-__ZN7WebCore19AnimationController24beginAnimationUpdateTimeEv
-__ZN7WebCore17ImplicitAnimation29validateTransformFunctionListEv
-__ZNK7WebCore13AnimationBase8progressEddPKNS_14TimingFunctionE
-__ZN7WebCore13AnimationBase15blendPropertiesEPKS0_iPNS_11RenderStyleEPKS3_S6_d
-__ZNK7WebCore15PropertyWrapperIfE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
-__ZN7WebCore11RenderStyle10setOpacityEf
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EEC1ERKS5_
-__ZN7WebCore13AnimationBase27fireAnimationEventsIfNeededEv
-__ZN7WebCore18CompositeAnimation27addToStyleAvailableWaitListEPNS_13AnimationBaseE
-__ZN7WebCore25CompositeAnimationPrivate27addToStyleAvailableWaitListEPNS_13AnimationBaseE
-__ZN7WebCore19AnimationController27addToStyleAvailableWaitListEPNS_13AnimationBaseE
-__ZN7WebCore26AnimationControllerPrivate27addToStyleAvailableWaitListEPNS_13AnimationBaseE
-__ZN7WebCore19AnimationController23addNodeChangeToDispatchEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore26AnimationControllerPrivate23addNodeChangeToDispatchEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore26AnimationControllerPrivate30startUpdateRenderingDispatcherEv
-__ZNK7WebCore18CompositeAnimation15willNeedServiceEv
-__ZNK7WebCore25CompositeAnimationPrivate15willNeedServiceEv
-__ZNK7WebCore13AnimationBase15willNeedServiceEv
-__ZN7WebCore13AnimationBase18overrideAnimationsEv
-__ZN7WebCore13AnimationBase16onAnimationStartEd
-__ZNK7WebCore17ImplicitAnimation10overriddenEv
-__ZN7WebCore13AnimationBase14startAnimationEd
-__ZN7WebCore13AnimationBase26goIntoEndingOrLoopingStateEv
-__ZN7WebCore17ImplicitAnimation21isTargetPropertyEqualEiPKNS_11RenderStyleE
-__ZNK7WebCore13AnimationBase14getElapsedTimeEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE6shrinkEm
-__ZN7WebCore5TimerINS_26AnimationControllerPrivateEE5firedEv
-__ZN7WebCore26AnimationControllerPrivate30updateRenderingDispatcherFiredEPNS_5TimerIS0_EE
-__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE14shrinkCapacityEm
-__ZN7WebCore9AnimationD1Ev
-__ZN7WebCore26AnimationControllerPrivate19animationTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore17ImplicitAnimation14onAnimationEndEd
-__ZN7WebCore18CompositeAnimation23getAnimationForPropertyEi
-__ZN7WebCore17ImplicitAnimation19sendTransitionEventERKNS_12AtomicStringEd
-__ZN7WebCore17ImplicitAnimation26shouldSendEventForListenerENS_8Document12ListenerTypeE
-__ZN7WebCore13AnimationBase26resumeOverriddenAnimationsEv
-__ZN3WTF9HashTableIiSt4pairIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSC_IS5_EEEESD_E4findIiNS_22IdentityHashTranslatorIiS6_SA_EEEENS_17HashTableIteratorIiS6_S8_SA_SF_SD_EERKT_
-__ZN7WebCore13AnimationBaseD0Ev
-__ZNK7WebCore13AnimationListeqERKS0_
-__ZNK7WebCore9Animation15animationsMatchEPKS0_b
-__ZN7WebCore26AnimationControllerPrivate5clearEPNS_12RenderObjectE
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_NS_6RefPtrINS1_18CompositeAnimationEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SC_EEEENS_17HashTableIteratorIS3_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore18CompositeAnimation13clearRendererEv
-__ZN7WebCore25CompositeAnimationPrivate13clearRendererEv
-__ZN7WebCore18CompositeAnimationD1Ev
-__ZN7WebCore25CompositeAnimationPrivateD1Ev
-__ZNK7WebCore11HistoryItem15formContentTypeEv
-__ZN7WebCore14ResourceHandle17willLoadFromCacheERNS_15ResourceRequestE
-__ZN7WebCore15BackForwardList17backListWithLimitEiRN3WTF6VectorINS1_6RefPtrINS_11HistoryItemEEELm0EEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14expandCapacityEmPKS4_
-__ZNK7WebCore17HTMLCanvasElement17endTagRequirementEv
-__ZNK7WebCore17HTMLCanvasElement11tagPriorityEv
-__ZN7WebCore28setJSEventTargetNodeOnscrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode11setOnscrollEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore30JSHTMLAppletElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSHTMLMapElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSCounterConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSHTMLHRElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31JSSVGTextPathElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSTextConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLHeadElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSMimeTypeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSCSSRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSClipboardConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSTextEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSCharacterDataConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSHTMLTableColElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore35JSSVGPreserveAspectRatioConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSEntityConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLQuoteElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSCSSRuleListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSCSSValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSStorageEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSHTMLDocumentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore36JSHTMLTableCaptionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLEmbedElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31JSSVGRenderingIntentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSCSSValueListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33JSHTMLParagraphElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33JSXMLHttpRequestUploadConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSPluginArrayConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSCSSStyleRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLParamElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSFileConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34JSSVGTextContentElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31JSHTMLIsIndexElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSCSSCharsetRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLMetaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSHTMLButtonElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLTitleElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSFileListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31JSHTMLHeadingElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLLinkElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSNotationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSCSSStyleSheetConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSMimeTypeArrayConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSCSSVariablesRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31JSHTMLMarqueeElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSMessageEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSMediaErrorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLMenuElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore36JSXMLHttpRequestExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSHTMLObjectElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore36JSHTMLTableSectionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSXPathExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSCSSImportRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSMouseEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSTextMetricsConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSHTMLDivElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLAudioElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLStyleElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSCSSFontFaceRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSNodeListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSRangeExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSStorageConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSSVGPathSegConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSHTMLFieldSetElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSDocumentTypeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGUnitTypesConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSHTMLBRElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSHTMLOptionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSKeyboardEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSCDATASectionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34JSProcessingInstructionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSCSSStyleDeclarationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLHtmlElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSSVGAngleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSStyleSheetConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSDOMCoreExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSHTMLCollectionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLOListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSXMLSerializerConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSCSSPrimitiveValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSDOMStringListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore37JSCanvasRenderingContext2DConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSOverflowEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSEventExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSHTMLFrameSetElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSAttrConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSSVGColorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLBaseElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore36JSWebKitCSSTransformValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSDOMImplementationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSHTMLLegendElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33JSHTMLTableCellElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34JSWebKitTransitionEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSSVGLengthConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31JSSVGGradientElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSUIEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore36JSCSSVariablesDeclarationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSHTMLScriptElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSHTMLLIElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSHTMLModElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLAreaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSMutationEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSHTMLCanvasElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLVideoElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSXPathEvaluatorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34JSHTMLBlockquoteElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSWheelEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSNodeFilterConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSPluginConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLMediaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34JSWebKitCSSKeyframeRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSMediaListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSStyleSheetListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSCSSMediaRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLFrameElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSCommentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSHTMLIFrameElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLDListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33JSHTMLDirectoryElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSNamedNodeMapConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLBodyElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLFontElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLTableElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSSVGMarkerElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore35JSWebKitCSSKeyframesRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSDocumentFragmentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSCSSPageRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSHTMLBaseFontElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSHTMLOptGroupElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSHTMLTableRowElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGTransformConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLLabelElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSHTMLPreElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSEntityReferenceConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33JSWebKitAnimationEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSSVGPaintConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSProgressEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15GraphicsContext18setTextDrawingModeEi
-__ZN7WebCore15GraphicsContext26setPlatformTextDrawingModeEi
-__ZN7WebCore30setJSEventTargetNodeOndblclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode13setOndblclickEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore11BitmapImage23hasSingleSecurityOriginEv
-__ZN7WebCore51jsCanvasRenderingContext2DPrototypeFunctionFillRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D8fillRectEffff
-__ZN7WebCoreL21validateRectForCanvasERfS0_S0_S0_
-__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectE
-__ZN7WebCore31jsConsolePrototypeFunctionErrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Console5errorEPNS_15ScriptCallStackE
-__ZN7WebCore30jsConsolePrototypeFunctionWarnEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Console4warnEPNS_15ScriptCallStackE
-__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradientEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D20createRadialGradientEffffffRi
-__ZN7WebCore14CanvasGradientC2ERKNS_10FloatPointEfS3_f
-__ZN7WebCore8GradientC1ERKNS_10FloatPointEfS3_f
-__ZN7WebCore24jsHTMLCanvasElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLCanvasElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL14warningHandlerEPvPKcz
-__ZN7WebCore12XMLTokenizer5errorENS0_9ErrorTypeEPKcPc
-__ZNK7WebCore12XMLTokenizer12columnNumberEv
-__ZN7WebCore12XMLTokenizer11handleErrorENS0_9ErrorTypeEPKcii
-__ZN7WebCore7Element9setPrefixERKNS_12AtomicStringERi
-__ZN7WebCore4Node14checkSetPrefixERKNS_12AtomicStringERi
-__ZN7WebCore13QualifiedName9setPrefixERKNS_12AtomicStringE
-__ZN7WebCore23RenderFileUploadControlC1EPNS_16HTMLInputElementE
-__ZN7WebCore11FileChooser6createEPNS_17FileChooserClientERKNS_6StringE
-__ZN7WebCore11FileChooser10chooseIconERKNS_6StringE
-__ZN7WebCore4Icon17createIconForFileERKNS_6StringE
-__ZN7WebCore23RenderFileUploadControl14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore23RenderFileUploadControl17updateFromElementEv
-__ZN7WebCore32HTMLFileUploadInnerButtonElementC1EPNS_8DocumentEPNS_4NodeE
-__ZN7WebCore25fileButtonChooseFileLabelEv
-__ZNK7WebCore23RenderFileUploadControl17createButtonStyleEPKNS_11RenderStyleE
-__ZN7WebCore16HTMLInputElement5filesEv
-__ZN7WebCore11FileChooser5clearEv
-__ZN7WebCore11FileChooserD1Ev
-__ZN7WebCore32HTMLFileUploadInnerButtonElementD1Ev
-__ZN7WebCore17FileChooserClientD0Ev
-__ZNK7WebCore26CSSMutableStyleDeclaration17getShorthandValueEPKii
-__ZNK7WebCore21PropertyWrapperGetterINS_6LengthEE6equalsEPKNS_11RenderStyleES5_
-__ZNK7WebCore11RenderStyle5widthEv
-__ZNK7WebCore15PropertyWrapperINS_6LengthEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS6_S9_d
-__ZN7WebCore11RenderStyle8setWidthENS_6LengthE
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionRotateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D6rotateEf
-__ZN7WebCore20TransformationMatrix6rotateEd
-__ZN7WebCore15GraphicsContext6rotateEf
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE6resizeEm
-__ZN7WebCoreL18normalErrorHandlerEPvPKcz
-__ZN7WebCore12XMLTokenizer23insertErrorMessageBlockEv
-__ZN7WebCoreL28createXHTMLParserErrorHeaderEPNS_8DocumentERKNS_6StringE
-__ZN7WebCore23JSHTMLOptionsCollection3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore32setJSHTMLOptionsCollectionLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23JSHTMLOptionsCollection9setLengthEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore21HTMLOptionsCollection9setLengthEjRi
-__ZN7WebCore17HTMLSelectElement9setLengthEjRi
-__ZN7WebCore19JSHTMLSelectElement3putEPN3JSC9ExecStateEjNS1_10JSValuePtrE
-__ZN7WebCore19JSHTMLSelectElement11indexSetterEPN3JSC9ExecStateEjNS1_10JSValuePtrE
-__ZN7WebCore18columnResizeCursorEv
-__ZN7WebCore23ApplicationCacheStorage5emptyEv
-__ZN7WebCore20NetworkStateNotifier20dynamicStoreCallbackEPK16__SCDynamicStorePK9__CFArrayPv
-__ZN7WebCore5TimerINS_20NetworkStateNotifierEE5firedEv
-__ZN7WebCore20NetworkStateNotifier28networkStateChangeTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCoreL19networkStateChangedEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE6shrinkEm
-__ZN7WebCore14scaleDragImageEN3WTF9RetainPtrI7NSImageEENS_9FloatSizeE
-filenameByFixingIllegalCharacters
-__ZN7WebCore5Image19drawPatternCallbackEPvP9CGContext
-__ZN7WebCore23jsHTMLSelectElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8FormData4copyEv
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EEC1ERKS3_
-__ZN7WebCore14DragController11performDragEPNS_8DragDataE
-__ZN7WebCore14DragController16concludeEditDragEPNS_8DragDataE
-__ZNK7WebCore8Document16elementFromPointEii
-__ZNK7WebCore8DragData13containsColorEv
-__ZN7WebCore13ImageDocument17windowSizeChangedEv
-__ZNK7WebCore13ImageDocument17imageFitsInWindowEv
-__ZN7WebCore13ImageDocument16resizeImageToFitEv
-__ZNK7WebCore13ImageDocument5scaleEv
-__ZNK7WebCore13ImageDocument15isImageDocumentEv
-__ZN7WebCore12zoomInCursorEv
-__ZN7WebCore33createDragImageIconForCachedImageEPNS_11CachedImageE
-__ZN7WebCore18ImageEventListenerD1Ev
-__ZN7WebCore24setJSHTMLInputElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement6setSrcERKNS_6StringE
-__ZN7WebCore26JSXMLSerializerConstructor16getConstructDataERN3JSC13ConstructDataE
-__ZN7WebCore26JSXMLSerializerConstructor9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13XMLSerializerE
-__ZN7WebCore15JSXMLSerializerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XMLSerializerEEE
-__ZN7WebCore15JSXMLSerializer18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSXMLSerializerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore49jsXMLSerializerPrototypeFunctionSerializeToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore15JSXMLSerializer9classInfoEv
-__ZN7WebCore13XMLSerializer17serializeToStringEPNS_4NodeERi
-__ZN7WebCoreL22shouldAddNamespaceElemEPKNS_7ElementE
-__ZN7WebCoreL22shouldAddNamespaceAttrEPKNS_9AttributeERN3WTF7HashMapIPNS_16AtomicStringImplES6_NS3_7PtrHashIS6_EENS3_10HashTraitsIS6_EESA_EE
-__ZN7WebCoreL15appendNamespaceERN3WTF6VectorItLm0EEERKNS_12AtomicStringES6_RNS0_7HashMapIPNS_16AtomicStringImplES9_NS0_7PtrHashIS9_EENS0_10HashTraitsIS9_EESD_EE
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplES3_NS_7PtrHashIS3_EENS_10HashTraitsIS3_EES7_E3setERKS3_SA_
-__ZN7WebCore14RenderListItem16setExplicitValueEi
-__ZN7WebCore14RenderListItem20explicitValueChangedEv
-__ZNK7WebCore21HTMLFrameOwnerElement13scrollingModeEv
-__ZN7WebCore17HTMLObjectElement21renderFallbackContentEv
-__ZN7WebCore12SharedBuffer6appendEPKci
-__ZN7WebCore12SharedBuffer25maybeTransferPlatformDataEv
-__ZN7WebCoreL16styleConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGStyleElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
-__ZN7WebCore15SVGStyleElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15SVGStyleElement20insertedIntoDocumentEv
-__ZN7WebCore15SVGStyleElement15childrenChangedEbPNS_4NodeES2_i
-__ZThn108_NK7WebCore15SVGStyleElement4typeEv
-__ZNK7WebCore15SVGStyleElement4typeEv
-__ZThn108_NK7WebCore15SVGStyleElement5mediaEv
-__ZNK7WebCore15SVGStyleElement5mediaEv
-__ZN7WebCore12StyleElement10setLoadingEb
-__ZNK7WebCore15SVGStyleElement5titleEv
-__ZN7WebCore15SVGStyleElement11sheetLoadedEv
-__ZN7WebCore15SVGStyleElement5sheetEv
-__ZN7WebCore9Tokenizer35executeScriptsWaitingForStylesheetsEv
-__ZN7WebCore15SVGStyleElement21finishParsingChildrenEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGStyledElementENS_6StringEXadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLNames15classAttrStringEEEE11synchronizeEv
-__ZN7WebCore12SVGTransform12setTranslateEff
-__ZN7WebCore20TransformationMatrix5resetEv
-__ZN7WebCoreL15textConstructorEPNS_8DocumentEb
+__ZN7WebCore12XMLTokenizer13resumeParsingEv
+__ZN7WebCore16PendingCallbacks25PendingCharactersCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks25PendingCharactersCallbackD0Ev
+__ZN7WebCore16PendingCallbacks29PendingStartElementNSCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks29PendingStartElementNSCallbackD0Ev
+__ZN7WebCore16PendingCallbacks27PendingEndElementNSCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks27PendingEndElementNSCallbackD0Ev
+__ZN7WebCoreL28processingInstructionHandlerEPvPKhS2_
+__ZN7WebCore12XMLTokenizer21processingInstructionEPKhS2_
+__ZN7WebCore21ProcessingInstructionC1EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCore21ProcessingInstructionC2EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCore21ProcessingInstruction20insertedIntoDocumentEv
+__ZN7WebCore21ProcessingInstruction15checkStyleSheetEv
+__ZN7WebCore21ProcessingInstruction21finishParsingChildrenEv
+__ZN7WebCoreL21internalSubsetHandlerEPvPKhS2_S2_
+__ZN7WebCore12XMLTokenizer14internalSubsetEPKhS2_S2_
+__ZN7WebCore8Document18determineParseModeEv
+__ZN7WebCoreL16getEntityHandlerEPvPKh
+__ZN7WebCoreL21externalSubsetHandlerEPvPKhS2_S2_
+__ZN7WebCoreL17cdataBlockHandlerEPvPKhi
+__ZN7WebCore12XMLTokenizer10cdataBlockEPKhi
+__ZN7WebCore12CDATASectionC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore12CDATASectionC2EPNS_8DocumentERKNS_6StringE
+__ZNK7WebCore21ProcessingInstruction8nodeTypeEv
+__ZN7WebCore43jsDocumentPrototypeFunctionCreateNSResolverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document16createNSResolverEPNS_4NodeE
+__ZN7WebCore14XPathEvaluator16createNSResolverEPNS_4NodeE
+__ZN7WebCore21NativeXPathNSResolverC1EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore21NativeXPathNSResolverC2EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15XPathNSResolverE
+__ZN7WebCore17JSXPathNSResolver15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSXPathNSResolverC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathNSResolverEEE
+__ZN7WebCore17JSXPathNSResolverC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathNSResolverEEE
+__ZNK7WebCore17JSXPathNSResolver9classInfoEv
+__ZNK7WebCore12CDATASection8nodeTypeEv
+__ZN7WebCore41jsXPathResultPrototypeFunctionIterateNextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18jsAttrOwnerElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSSVGDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSSVGDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13JSSVGDocument9classInfoEv
+__ZN7WebCore18createJSSVGWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEENS_7PtrHashIS
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEENS_7PtrHashI
+__ZN7WebCoreL27createSVGRectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGRectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSSVGElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGRectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGRectElementEEE
+__ZN7WebCore16JSSVGRectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGRectElementEEE
+__ZN7WebCore12JSSVGElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10SVGElementEEE
+__ZN7WebCore16JSSVGRectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12JSSVGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGRectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGRectElement9classInfoEv
+__ZN7WebCore29SVGStyledTransformableElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore9CSSParser13parseSVGPaintEv
+__ZNK7WebCore16SVGStyledElement8isStyledEv
+__ZN7WebCore16SVGStyledElement14canvasResourceEv
+__ZN7WebCore8SVGTests16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore12SVGLangSpace16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore28SVGExternalResourcesRequired16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore29SVGStyledTransformableElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore16SVGTransformable16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore16SVGStyledElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore42jsDocumentPrototypeFunctionCreateElementNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL15textConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore14SVGTextElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore25SVGTextPositioningElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore21SVGTextContentElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13SVGLengthListC1ERKNS_13QualifiedNameE
 __ZN7WebCore13SVGLengthListC2ERKNS_13QualifiedNameE
+__ZN7WebCore13SVGNumberListC1ERKNS_13QualifiedNameE
 __ZN7WebCore13SVGNumberListC2ERKNS_13QualifiedNameE
+__ZN7WebCoreL27createSVGTextElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGTextElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSSVGTextPositioningElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSSVGTextPositioningElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSSVGTextContentElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGTextContentElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGTextElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTextElementEEE
+__ZN7WebCore16JSSVGTextElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTextElementEEE
+__ZN7WebCore27JSSVGTextPositioningElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGTextPositioningElementEEE
+__ZN7WebCore23JSSVGTextContentElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGTextContentElementEEE
+__ZN7WebCore16JSSVGTextElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGTextPositioningElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSSVGTextContentElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGTextElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32JSSVGTextContentElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGTextElement9classInfoEv
 __ZN7WebCore14SVGTextElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore25SVGTextPositioningElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_13SVGLengthListEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_13SVGLengthListENS1_10StringHashENS_10HashTraitsIS6_EENS
 __ZN7WebCore13SVGLengthList5parseERKNS_6StringENS_13SVGLengthModeE
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE14shrinkCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE14expandCapacityEmPKS6_
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE15reserveCapacityEm
 __ZN7WebCore14SVGTextElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore12SVGTransform9setRotateEfff
-__ZN7WebCore7DataRefINS_15StyleStrokeDataEE6accessEv
-__ZN7WebCore15StyleStrokeDataC2ERKS0_
+__ZN7WebCoreL26createSVGSVGElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore15JSSVGSVGElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGSVGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSVGElementEEE
+__ZN7WebCore15JSSVGSVGElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSVGElementEEE
+__ZN7WebCore15JSSVGSVGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSSVGSVGElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSSVGSVGElement9classInfoEv
+__ZN7WebCore16CSSStyleSelector16applySVGPropertyEiPNS_8CSSValueE
+__ZN7WebCore14SVGRenderStyleC1ERKS0_
+__ZN7WebCore14SVGRenderStyleC2ERKS0_
+__ZNK7WebCore8SVGPaint10isSVGPaintEv
+__ZN7WebCore7DataRefINS_13StyleFillDataEE6accessEv
+__ZN7WebCore13StyleFillDataC1ERKS0_
+__ZN7WebCore13StyleFillDataC2ERKS0_
+__ZN3WTF10RefCountedIN7WebCore8CSSValueEE5derefEv
+__ZNK7WebCore14SVGRenderStyleeqERKS0_
+__ZNK7WebCore13StyleFillDataeqERKS0_
+__ZNK7WebCore8SVGColor5colorEv
+__ZN7WebCore16SVGStyledElement6detachEv
+__ZN7WebCore11SVGResource12removeClientEPNS_16SVGStyledElementE
+__ZN7WebCoreL9clientMapEv
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementESt4pairIS3_PNS1_11ResourceSetEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS
 __ZNK7WebCore21SVGTextContentElement7isValidEv
 __ZN7WebCore14SVGTextElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore13RenderSVGTextC1EPNS_14SVGTextElementE
 __ZN7WebCore13RenderSVGTextC2EPNS_14SVGTextElementE
 __ZN7WebCore14RenderSVGBlockC2EPNS_10SVGElementE
 __ZN7WebCore14RenderSVGBlock8setStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
 __ZNK7WebCore13RenderSVGText13requiresLayerEv
 __ZNK7WebCore14SVGTextElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore19RenderSVGInlineTextC1EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
 __ZN7WebCore19RenderSVGInlineTextC2EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
-__ZN7WebCore19RenderSVGInlineText14styleDidChangeENS_11RenderStyle4DiffEPKS1_
+__ZN7WebCore19RenderSVGInlineText14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZNK7WebCore19RenderSVGInlineText9isSVGTextEv
-__ZN7WebCore6Widget11handleEventEPNS_5EventE
-__ZN7WebCore13RenderSVGText29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZNK7WebCore13RenderSVGText12relativeBBoxEb
-__ZNK7WebCore13RenderSVGText14localTransformEv
-__ZNK7WebCore18RenderSVGContainer13selfWillPaintEv
-__ZNK7WebCore10RenderPath23outlineBoundsForRepaintEPNS_9RenderBoxE
-__ZN7WebCore30BoundingRectStrokeStyleApplier11strokeStyleEPNS_15GraphicsContextE
-__ZN7WebCore25applyStrokeStyleToContextEPNS_15GraphicsContextEPNS_11RenderStyleEPKNS_12RenderObjectE
-__ZN7WebCore14SVGRenderStyle20cssPrimitiveToLengthEPKNS_12RenderObjectEPNS_8CSSValueEf
-__ZN7WebCore27dashArrayFromRenderingStyleEPKNS_11RenderStyleE
-__ZN7WebCore15GraphicsContext11setLineDashERKN3WTF6VectorIfLm0EEEf
+__ZN7WebCore13RenderSVGRoot6layoutEv
+__ZNK7WebCore13SVGSVGElement12currentScaleEv
+__ZN7WebCore13RenderSVGRoot12calcViewportEv
+__ZN7WebCore10RenderPath6layoutEv
+__ZNK7WebCore29SVGStyledTransformableElement22animatedLocalTransformEv
+__ZNK7WebCore16SVGTransformList11concatenateEv
+__ZN7WebCore12SVGTransformC1Ev
+__ZN7WebCore12SVGTransformC2Ev
+__ZNK7WebCore12SVGTransform6matrixEv
+__ZN7WebCore12SVGTransformD1Ev
+__ZN7WebCore12SVGTransformD2Ev
+__ZNK7WebCore14SVGRectElement10toPathDataEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_16heightAttr
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_15widthAttrS
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11xAttrStrin
+__ZN7WebCore10RenderPath7setPathERKNS_4PathE
+__ZN7WebCore4PathaSERKS0_
 __ZN7WebCore13RenderSVGText6layoutEv
-__ZN7WebCore19SVGAnimatedPropertyINS_25SVGTextPositioningElementENS_13SVGLengthListEXadL_ZNS_35SVGTextPositioningElementIdentifierEEEXadL_ZNS_8SVGNames11yAttrStringEEEED1Ev
-__ZN7WebCore13RenderSVGText23calculateLocalTransformEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_25SVGTextPositioningElementENS_13SVGLengthListEXadL_ZNS_35SVGTextPositioningElementIdenti
 __ZNK7WebCore14SVGTextElement22animatedLocalTransformEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGTextElementENS_16SVGTransformListEXadL_ZNS_8SVGNames13textTagStringEEEXadL_ZNS3_19transformAttrStringEEEE11synchronizeEv
-__ZN7WebCore19RenderSVGInlineText19createInlineTextBoxEv
+__ZN7WebCore19RenderSVGInlineText13createTextBoxEv
+__ZN7WebCore16SVGInlineTextBoxC1EPNS_12RenderObjectE
 __ZN7WebCore16SVGInlineTextBoxC2EPNS_12RenderObjectE
-__ZN7WebCore13RenderSVGText15createInlineBoxEbbb
+__ZN7WebCore13RenderSVGText13createRootBoxEv
 __ZN7WebCore16SVGRootInlineBox22placeBoxesHorizontallyEiRiS1_Rb
 __ZN7WebCore16SVGRootInlineBox20verticallyAlignBoxesEi
+__ZNK7WebCore16SVGRootInlineBox12svgBoxHeightEv
 __ZN7WebCore16SVGRootInlineBox36computePerCharacterLayoutInformationEv
 __ZN3WTF6VectorIN7WebCore7SVGCharELm0EE14shrinkCapacityEm
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE14shrinkCapacityEm
+__ZN7WebCore22SVGCharacterLayoutInfoC1ERN3WTF6VectorINS_7SVGCharELm0EEE
 __ZN7WebCore22SVGCharacterLayoutInfoC2ERN3WTF6VectorINS_7SVGCharELm0EEE
 __ZN7WebCore16SVGRootInlineBox22buildLayoutInformationEPNS_13InlineFlowBoxERNS_22SVGCharacterLayoutInfoE
 __ZN7WebCore22SVGCharacterLayoutInfo20addLayoutInformationEPNS_25SVGTextPositioningElementE
 __ZN7WebCoreL22calculateBaselineShiftEPNS_12RenderObjectE
 __ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeEPNS_13SVGLengthListEPKNS_10SVGElementE
-__ZN3WTF6VectorIfLm0EE14expandCapacityEmPKf
-__ZN3WTF6VectorIfLm0EE14expandCapacityEm
-__ZN3WTF6VectorIfLm0EE15reserveCapacityEm
 __ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeERKNS_21PositionedFloatVectorE
 __ZN3WTF6VectorIN7WebCore21PositionedFloatVectorELm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIN7WebCore21PositionedFloatVectorELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore21PositionedFloatVectorELm0EE15reserveCapacityEm
 __ZN3WTF6VectorIfLm0EEC2ERKS1_
-__ZN3WTF6VectorIfLm0EE6shrinkEm
-__ZNK7WebCore19SVGAnimatedPropertyINS_25SVGTextPositioningElementENS_13SVGNumberListEXadL_ZNS_35SVGTextPositioningElementIdentifierEEEXadL_ZNS_8SVGNames16rotateAttrStringEEEE11synchronizeEv
 __ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeEPNS_13SVGNumberListE
 __ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeEf
-__ZN7WebCore16SVGRootInlineBox32buildLayoutInformationForTextBoxERNS_22SVGCharacterLayoutInfoEPNS_13InlineTextBoxERNS_13LastGlyphInfoE
+__ZN7WebCore16SVGRootInlineBox32buildLayoutInformationForTextBoxERNS_22SVGCharacterLayoutInfoEPNS_13InlineTextBoxERNS_13LastGly
 __ZNK7WebCore22SVGCharacterLayoutInfo12inPathLayoutEv
 __ZNK7WebCore16SVGInlineTextBox19calculateGlyphWidthEPNS_11RenderStyleEiiRiRNS_6StringE
 __ZN7WebCore26svgTextRunForInlineTextBoxEPKtiPNS_11RenderStyleEPKNS_13InlineTextBoxEf
@@ -12201,3154 +13273,184 @@
 __ZN7WebCore22SVGCharacterLayoutInfo11dyStackWalkEv
 __ZN7WebCore22SVGCharacterLayoutInfo14angleStackWalkEv
 __ZN7WebCore22SVGCharacterLayoutInfo22baselineShiftStackWalkEv
-__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEERNS2_INS_12SVGTextChunkELm0EEEPNS_13InlineFlowBoxE
-__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEEPNS_13InlineFlowBoxERNS_22SVGTextChunkLayoutInfoE
+__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEERNS2_INS_12SVGTextChunkELm0EEEPNS_13InlineFlowB
+__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEEPNS_13InlineFlowBoxERNS_22SVGTextChunkLayoutInf
 __ZNK7WebCore21SVGTextContentElement13isTextContentEv
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE15reserveCapacityEm
-__ZNK7WebCore19SVGAnimatedPropertyINS_21SVGTextContentElementENS_9SVGLengthEXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_8SVGNames20textLengthAttrStringEEEE11synchronizeEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_21SVGTextContentElementEiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_8SVGNames22lengthAdjustAttrStringEEEE11synchronizeEv
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EEC1ERKS3_
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EEC2ERKS3_
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE6shrinkEm
 __ZN7WebCore16SVGRootInlineBox16layoutTextChunksEv
 __ZN7WebCoreL41calculateTextLengthCorrectionForTextChunkERNS_12SVGTextChunkENS_21SVGTextContentElement19SVGLengthAdjustTypeERf
-__ZN7WebCoreL36calculateTextAnchorShiftForTextChunkERNS_12SVGTextChunkENS_11ETextAnchorE
-__ZN7WebCoreL26cummulatedWidthOfTextChunkERNS_12SVGTextChunkE
-__ZN7WebCoreL34cummulatedWidthOrHeightOfTextChunkERNS_12SVGTextChunkEb
-__ZN7WebCore40cummulatedWidthOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
 __ZN7WebCore31topLeftPositionOfCharacterRangeEPNS_7SVGCharES1_
 __ZNK7WebCore7SVGChar8isHiddenEv
 __ZN7WebCore16SVGRootInlineBox17layoutInlineBoxesEv
 __ZN7WebCore16SVGRootInlineBox17layoutInlineBoxesEPNS_13InlineFlowBoxERPNS_7SVGCharERiS6_S6_S6_
 __ZNK7WebCore16SVGInlineTextBox24calculateGlyphBoundariesEPNS_11RenderStyleEiRKNS_7SVGCharE
 __ZNK7WebCore7SVGChar18characterTransformEv
+__ZN7WebCore20TransformationMatrix8rotate3dEddd
+__ZN7WebCore16SVGRootInlineBox18isSVGRootInlineBoxEv
+__ZN7WebCore13RenderSVGRoot21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore13RenderSVGRoot25localToBorderBoxTransformEv
+__ZNK7WebCore13RenderSVGRoot24borderOriginToContentBoxEv
+__ZN7WebCore20TransformationMatrix5scaleEd
+__ZNK7WebCore13SVGSVGElement16currentTranslateEv
+__ZNK7WebCore13SVGSVGElement22viewBoxToViewTransformEff
+__ZNK7WebCore13SVGSVGElement14useCurrentViewEv
+__ZNK7WebCore13RenderSVGRoot19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore21SVGDocumentExtensions15startAnimationsEv
+__ZN7WebCore17SMILTimeContainer5beginEv
+__ZN7WebCore17SMILTimeContainer16updateAnimationsENS_8SMILTimeE
+__ZN7WebCore17SMILTimeContainer14sortByPriorityERN3WTF6VectorIPNS_14SVGSMILElementELm0EEENS_8SMILTimeE
+__ZN7WebCore17SMILTimeContainer10startTimerENS_8SMILTimeES1_
+__ZNK7WebCore17SMILTimeContainer8isPausedEv
+__ZN7WebCore13RenderSVGRoot5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore13RenderSVGRoot12viewportSizeEv
+__ZNK7WebCore13RenderSVGRoot32localToRepaintContainerTransformERKNS_8IntPointE
+__ZNK7WebCore13RenderSVGRoot22localToParentTransformEv
+__ZNK7WebCore13RenderSVGRoot23parentOriginToBorderBoxEv
+__ZN7WebCore25applyTransformToPaintInfoERNS_12RenderObject9PaintInfoERKNS_20TransformationMatrixE
+__ZNK7WebCore13RenderSVGRoot29repaintRectInLocalCoordinatesEv
+__ZN7WebCore13SVGRenderBase27computeContainerBoundingBoxEPKNS_12RenderObjectEb
+__ZNK7WebCore10RenderPath29repaintRectInLocalCoordinatesEv
+__ZNK7WebCore10RenderPath17objectBoundingBoxEv
+__ZN7WebCore13SVGRenderBase28filterBoundingBoxForRendererEPKNS_12RenderObjectE
+__ZNK7WebCore10RenderPath22localToParentTransformEv
+__ZNK7WebCore13RenderSVGText29repaintRectInLocalCoordinatesEv
+__ZNK7WebCore13RenderSVGText17objectBoundingBoxEv
+__ZNK7WebCore16SVGInlineTextBox12svgBoxHeightEv
+__ZNK7WebCore13RenderSVGText22localToParentTransformEv
+__ZN7WebCore9RenderBox5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore10RenderPath5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13RenderSVGText5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13SVGRenderBase25prepareToRenderSVGContentEPNS_12RenderObjectERNS1_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFil
+__ZN7WebCore14getClipperByIdEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore15getResourceByIdEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore13getMaskerByIdEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore14SVGPaintServer15fillPaintServerEPKNS_11RenderStyleEPKNS_12RenderObjectE
+__ZN7WebCore14SVGPaintServer22sharedSolidPaintServerEv
+__ZN7WebCore19SVGPaintServerSolidC1Ev
+__ZN7WebCore19SVGPaintServerSolidC2Ev
+__ZN7WebCore14SVGPaintServerC2Ev
+__ZN7WebCore11SVGResourceC2Ev
+__ZN7WebCore19SVGPaintServerSolid8setColorERKNS_5ColorE
+__ZNK7WebCore19SVGPaintServerSolid5colorEv
+__ZNK7WebCore14SVGPaintServer4drawERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeE
+__ZNK7WebCore19SVGPaintServerSolid5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZN7WebCore15GraphicsContext8setAlphaEf
+__ZN7WebCore15GraphicsContext11setFillRuleENS_8WindRuleE
+__ZNK7WebCore14SVGPaintServer10renderPathERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeE
+__ZNK7WebCore14SVGPaintServer8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZN7WebCore14SVGPaintServer17strokePaintServerEPKNS_11RenderStyleEPKNS_12RenderObjectE
+__ZNK7WebCore16SVGStyledElement15supportsMarkersEv
+__ZN7WebCore13SVGRenderBase22finishRenderSVGContentEPNS_12RenderObjectERNS1_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFilter
+__ZN7WebCore16SVGRootInlineBox5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore16SVGRootInlineBox14walkTextChunksEPNS_22SVGTextChunkWalkerBaseEPKNS_16SVGInlineTextBoxE
+__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE5startEPNS_9InlineBoxE
+__ZN7WebCore27SVGRootInlineBoxPaintWalker18chunkStartCallbackEPNS_9InlineBoxE
+__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE9setupFillEPNS_9InlineBoxE
+__ZN7WebCore27SVGRootInlineBoxPaintWalker22chunkSetupFillCallbackEPNS_9InlineBoxE
+__ZN7WebCore15GraphicsContext18setTextDrawingModeEi
+__ZN7WebCore15GraphicsContext26setPlatformTextDrawingModeEi
+__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS
+__ZN7WebCore27SVGRootInlineBoxPaintWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGC
+__ZN7WebCore16SVGInlineTextBox15paintCharactersERNS_12RenderObject9PaintInfoEiiRKNS_7SVGCharEPKtiPNS_14SVGPaintServerE
+__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE11setupStrokeEPNS_9InlineBoxE
+__ZN7WebCore27SVGRootInlineBoxPaintWalker24chunkSetupStrokeCallbackEPNS_9InlineBoxE
+__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE3endEPNS_9InlineBoxE
+__ZN7WebCore27SVGRootInlineBoxPaintWalker16chunkEndCallbackEPNS_9InlineBoxE
+-[DOMElement innerText]
+__ZN7WebCore16JSSVGTextElementD1Ev
+__ZN7WebCore15JSSVGSVGElementD1Ev
+__ZN7WebCore16JSSVGRectElementD1Ev
+__ZN7WebCore17JSXPathNSResolverD1Ev
+__ZN7WebCore17JSXPathNSResolverD2Ev
+__ZN7WebCore21NativeXPathNSResolverD0Ev
+__ZN7WebCore15XPathNSResolverD2Ev
+__ZN7WebCore13SVGSVGElement26documentWillBecomeInactiveEv
+__ZN7WebCore13SVGSVGElement15pauseAnimationsEv
+__ZN7WebCore17SMILTimeContainer5pauseEv
+__ZN7WebCore10RenderPathD0Ev
+__ZN7WebCore14SVGRenderStyleD1Ev
+__ZN7WebCore14SVGRenderStyleD2Ev
 __ZN7WebCore19RenderSVGInlineText7destroyEv
+__ZN7WebCore16SVGInlineTextBoxD0Ev
+__ZN7WebCore19RenderSVGInlineTextD0Ev
+__ZN7WebCore16SVGRootInlineBoxD0Ev
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE6shrinkEm
 __ZN3WTF6VectorIN7WebCore7SVGCharELm0EE6shrinkEm
-__ZN3WTF6RefPtrIN7WebCore11BidiContextEED2Ev
+__ZN7WebCore13RenderSVGTextD0Ev
+__ZN7WebCore13RenderSVGRootD0Ev
+__ZN7WebCore36JSSVGTextPositioningElementPrototypeD1Ev
+__ZN7WebCore32JSSVGTextContentElementPrototypeD1Ev
+__ZN7WebCore24JSSVGSVGElementPrototypeD1Ev
+__ZN7WebCore25JSSVGTextElementPrototypeD1Ev
+__ZN7WebCore25JSSVGRectElementPrototypeD1Ev
+__ZN7WebCore21JSSVGElementPrototypeD1Ev
+__ZN7WebCore26JSXPathNSResolverPrototypeD1Ev
+__ZN7WebCore21ProcessingInstructionD0Ev
+__ZN7WebCore12CDATASectionD0Ev
+__ZN7WebCore13JSSVGDocumentD1Ev
+__ZN7WebCore13SVGSVGElementD0Ev
+__ZN7WebCore21SVGDocumentExtensions19removeTimeContainerEPNS_13SVGSVGElementE
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeA
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEP
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallo
+__ZN7WebCore13SVGZoomAndPanD2Ev
+__ZN7WebCore15SVGFitToViewBoxD2Ev
+__ZN7WebCore22SVGPreserveAspectRatioD0Ev
+__ZN7WebCore28SVGExternalResourcesRequiredD2Ev
+__ZN7WebCore12SVGLangSpaceD2Ev
+__ZN7WebCore8SVGTestsD2Ev
+__ZN7WebCore25SVGStyledLocatableElementD2Ev
+__ZN7WebCore16SVGStyledElementD2Ev
+__ZN7WebCore11SVGStylableD2Ev
+__ZN7WebCore10SVGElementD2Ev
+__ZN7WebCore12SVGLocatableD2Ev
+__ZN7WebCore14SVGRectElementD0Ev
+__ZN7WebCore29SVGStyledTransformableElementD2Ev
+__ZN7WebCore16SVGTransformListD0Ev
+__ZN7WebCore16SVGTransformableD2Ev
+__ZN7WebCore8SVGPaintD0Ev
+__ZN7WebCore8SVGColorD2Ev
+__ZN7WebCore14SVGTextElementD0Ev
+__ZN7WebCore25SVGTextPositioningElementD2Ev
+__ZN7WebCore13SVGNumberListD0Ev
+__ZN7WebCore13SVGLengthListD0Ev
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE6shrinkEm
-__ZNK7WebCore12RenderObject12isRenderPartEv
-__ZN7WebCore12TextDocumentC1EPNS_5FrameE
-__ZN7WebCore12TextDocument15createTokenizerEv
-__ZN7WebCore13TextTokenizerC1EPNS_8DocumentE
-__ZN7WebCore13TextTokenizer6finishEv
-__ZNK7WebCore11RenderLayer16enclosingElementEv
-__ZN7WebCore17raiseDOMExceptionEi
-__ZN7WebCore13TextTokenizer5writeERKNS_15SegmentedStringEb
-__ZN7WebCore25jsEventTargetNodeOnchangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode8onchangeEv
-__ZN7WebCore12ClipboardMac8writeURLERKNS_4KURLERKNS_6StringEPNS_5FrameE
-__ZN7WebCore11RenderStyle10setContentEN3WTF10PassRefPtrINS_10StyleImageEEEb
-__ZNK7WebCore12RenderObject20isInlineContinuationEv
-__ZN7WebCore27RenderImageGeneratedContentC1EPNS_4NodeE
-__ZN7WebCore27RenderImageGeneratedContent13setStyleImageEPNS_10StyleImageE
-__ZNK7WebCore16StyleCachedImage13isCachedImageEv
-__ZN7WebCore5Frame29forceLayoutWithPageWidthRangeEffb
-__ZNK7WebCore27RenderImageGeneratedContent13errorOccurredEv
-__ZNK7WebCore27RenderImageGeneratedContent21imageHasRelativeWidthEv
-__ZNK7WebCore16StyleCachedImage21imageHasRelativeWidthEv
-__ZNK7WebCore27RenderImageGeneratedContent22usesImageContainerSizeEv
-__ZNK7WebCore16StyleCachedImage22usesImageContainerSizeEv
-__ZNK7WebCore27RenderImageGeneratedContent22imageHasRelativeHeightEv
-__ZNK7WebCore16StyleCachedImage22imageHasRelativeHeightEv
-__ZN7WebCore5Frame16adjustPageHeightEPffff
-__ZN7WebCore18correctedTextColorENS_5ColorES0_
-__ZN7WebCore15GraphicsContext21focusRingBoundingRectEv
-__ZN7WebCore12RenderObject13addPDFURLRectEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore9RenderBox17addFocusRingRectsEPNS_15GraphicsContextEii
-__ZNK7WebCore27RenderImageGeneratedContent8imagePtrEv
-__ZNK7WebCore27RenderImageGeneratedContent9imageSizeEf
-__ZNK7WebCore27RenderImageGeneratedContent8hasImageEv
-__ZN7WebCore15GraphicsContext13setURLForRectERKNS_4KURLERKNS_7IntRectE
-__ZN7WebCore27RenderImageGeneratedContent5imageEii
-__ZN7WebCore27RenderImageGeneratedContentD1Ev
-__ZN7WebCore11RenderImageD0Ev
-__ZN7WebCore5XPathL10isAxisNameERKNS_6StringERNS0_4Step4AxisE
-__ZN7WebCore5XPathL17setUpAxisNamesMapERN3WTF7HashMapINS_6StringENS0_4Step4AxisENS_10StringHashENS1_10HashTraitsIS3_EENS7_IS5_EEEE
-__ZN3WTF7HashMapIN7WebCore6StringENS1_5XPath4Step4AxisENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_5XPath4Step4AxisEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6expandEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_5XPath4Step4AxisEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E4findIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEENS_17HashTableIteratorIS2_S7_S9_SA_SF_SD_EERKT_
-__ZN7WebCore5XPathL13createFunLastEv
-__ZN7WebCore5XPath6FilterC2EPNS0_10ExpressionERKN3WTF6VectorIPNS0_9PredicateELm0EEE
-__ZNK7WebCore5XPath6Filter8evaluateEv
-__ZN7WebCore5XPath5Value17modifiableNodeSetEv
-__ZN7WebCore12EventHandler14scrollOverflowENS_15ScrollDirectionENS_17ScrollGranularityE
-__ZN7WebCoreL23enabledVisibleSelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCoreL10enabledCutEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore6Editor11canDHTMLCutEv
-__ZNK7WebCore6Editor6canCutEv
-__ZN7WebCoreL13enabledDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCoreL7enabledEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore11FrameLoader35tellClientAboutPastMemoryCacheLoadsEv
-__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9DOMWindow6moveToEff
-__ZNK7WebCore5XPath7FunLast8evaluateEv
-__ZNK7WebCore5XPath5Value8toNumberEv
-__ZN7WebCore5XPath6NumberC2Ed
-__ZN7WebCore5XPathL17createFunPositionEv
-__ZNK7WebCore5XPath11FunPosition8evaluateEv
-__ZNK7WebCore5XPath6Number8evaluateEv
-__ZN7WebCore5XPath6Parser9lexNumberEv
-__ZN7WebCore5XPath9NumericOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
-__ZNK7WebCore5XPath9NumericOp8evaluateEv
-__ZN7WebCore4Node11appendChildEN3WTF10PassRefPtrIS0_EERib
-__ZN7WebCore43jsDOMCoreExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore18JSDOMCoreException9classInfoEv
-__ZNK7WebCore13ExceptionBase8toStringEv
-__ZN7WebCore22JSCSSRuleListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCoreL29selectionContainsPossibleWordEPNS_5FrameE
--[DOMNode(DOMNodeExtensions) boundingBox]
-__ZN7WebCore12RenderInline13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEiib
-__ZNK7WebCore12EventHandler20currentKeyboardEventEv
-__ZN7WebCore15FocusController15setInitialFocusENS_14FocusDirectionEPNS_13KeyboardEventE
-__ZN7WebCoreL30newStreamingTextDecoderUTF16LEERKNS_12TextEncodingEPKv
-__ZN7WebCore14TextCodecUTF166decodeEPKcmbbRb
-__ZNK7WebCore15HTMLBodyElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore17HTMLScriptElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZNK7WebCore15HTMLLinkElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZN7WebCore13CSSStyleSheet23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZN3WTF5DequeIPN7WebCore13CSSStyleSheetEE14expandCapacityEv
-__ZN7WebCore12CSSStyleRule23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZN7WebCore8CSSValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
-__ZN7WebCore12CSSValueList23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
-__ZN7WebCore7CSSRule23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E4findIS2_NS_22IdentityHashTranslatorIS2_S2_S5_EEEENS_17HashTableIteratorIS2_S2_S4_S5_S7_S7_EERKT_
-__ZNK7WebCore16HTMLStyleElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZNK7WebCore15HTMLBodyElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZNK7WebCore15HTMLBodyElement10backgroundEv
-__ZNK7WebCore17HTMLObjectElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZNK7WebCore17HTMLObjectElement4dataEv
-__ZNK7WebCore17HTMLObjectElement6useMapEv
-__ZNK7WebCore16HTMLParamElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZNK7WebCore16HTMLEmbedElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore7ArchiveEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore7ArchiveEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE6shrinkEm
-__ZNK7WebCore16HTMLTableElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZNK7WebCore20HTMLTableCellElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZNK7WebCore16HTMLInputElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
-__ZN7WebCore15RenderScrollbar24scrollbarForStyleResolveEv
-__ZN7WebCore6Editor9copyImageERKNS_13HitTestResultE
-__ZN7WebCore10Pasteboard10writeImageEPNS_4NodeERKNS_4KURLERKNS_6StringE
-__ZN7WebCoreL21writableTypesForImageEv
-suggestedFilenameWithMIMEType
-__ZN7WebCore16MIMETypeRegistry24getExtensionsForMIMETypeERKNS_6StringE
-__ZN7WebCore10Pasteboard32writeFileWrapperAsRTFDAttachmentEP13NSFileWrapper
-__ZN7WebCore44jsHTMLDocumentPrototypeFunctionCaptureEventsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12HTMLDocument13captureEventsEv
-__ZNK7WebCore18JSHTMLTitleElement9classInfoEv
-__ZN7WebCore11FrameLoader21reportLocalLoadFailedEPNS_5FrameERKNS_6StringE
-__ZN7WebCore14RenderFieldset22paintBorderMinusLegendEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEiii
--[DOMNode nextSibling]
-__ZN7WebCore11HistoryItem20setTransientPropertyERKNS_6StringEP11objc_object
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_9RetainPtrIP11objc_objectEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSD_IS7_EEEESE_E6expandEv
--[WebScriptObject JSObject]
-__ZN7WebCore16CSSStyleSelector16mapFillCompositeEPNS_9FillLayerEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector17mapNinePieceImageEPNS_8CSSValueERNS_14NinePieceImageE
-__ZN3WTF7HashMapIN7WebCore6StringENS_9RetainPtrIP11objc_objectEENS1_10StringHashENS_10HashTraitsIS2_EENS8_IS6_EEE3setERKS2_RKS6_
-__ZN7WebCore52jsCSSStyleDeclarationPrototypeFunctionRemovePropertyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19CSSStyleDeclaration14removePropertyERKNS_6StringERi
-__ZNK7WebCore16StyleCachedImage8isLoadedEv
-__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectES5_NS1_8TileRuleES6_NS_17CompositeOperatorE
-__ZN7WebCore5TimerINS_12RenderButtonEE5firedEv
-__ZN7WebCore12RenderButton10timerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore5TimerINS_12RenderButtonEED1Ev
-__ZN7WebCore11HistoryItem12setViewStateEP11objc_object
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIN7WebCore4KURLEEES5_NS_17IdentityExtractorIS5_EENS_28ListHashSetNodeHashFunctionsIS3_NS2_8KURLHashEEENS_10HashTraitsIS5_EESC_E4findIS5_NS_22IdentityHashTranslatorIS5_S5_SA_EEEENS_17HashTableIteratorIS5_S5_S7_SA_SC_SC_EERKT_
-__ZN7WebCore14ArchiveFactory6createEPNS_12SharedBufferERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore6StringEPFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENSB_IS9_EEE3setERKS2_RKS9_
-__ZN7WebCoreL20archiveFactoryCreateINS_16LegacyWebArchiveEEEN3WTF10PassRefPtrINS_7ArchiveEEEPNS_12SharedBufferE
-__ZN7WebCore14DocumentLoader22addAllArchiveResourcesEPNS_7ArchiveE
-__ZN7WebCore25ArchiveResourceCollectionC1Ev
-__ZN7WebCore25ArchiveResourceCollection15addAllResourcesEPNS_7ArchiveE
-__ZNK3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_15ArchiveResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_15ArchiveResourceEEEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6expandEv
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_15ArchiveResourceEEEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E4findIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEENS_17HashTableIteratorIS2_S7_S9_SA_SF_SD_EERKT_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_7ArchiveEEEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6expandEv
-__ZN7WebCore14DocumentLoader20setParsedArchiveDataEN3WTF10PassRefPtrINS_12SharedBufferEEE
-__ZN7WebCore11FrameLoader20continueLoadWithDataEPNS_12SharedBufferERKNS_6StringES5_RKNS_4KURLE
-__ZN7WebCore25ArchiveResourceCollection18popSubframeArchiveERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_7ArchiveEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_7ArchiveEEEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E4findIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEENS_17HashTableIteratorIS2_S7_S9_SA_SF_SD_EERKT_
-__ZN7WebCore11FrameLoader11loadArchiveEN3WTF10PassRefPtrINS_7ArchiveEEE
-__ZN7WebCore15ResourceRequest26applyWebArchiveHackForMailEv
-__ZN7WebCore25ArchiveResourceCollection21archiveResourceForURLERKNS_4KURLE
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14ResourceLoaderEEENS1_INS2_18SubstituteResourceEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setEPS3_RKS6_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore7ArchiveEEELm0EE6shrinkEm
-__ZN7WebCore5TimerINS_14DocumentLoaderEE5firedEv
-__ZN7WebCore14DocumentLoader36substituteResourceDeliveryTimerFiredEPNS_5TimerIS0_EE
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14ResourceLoaderEEESt4pairIS4_NS1_INS2_18SubstituteResourceEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E6expandEv
--[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]
-__ZN7WebCore4coreEP28NSURLAuthenticationChallenge
-__ZN7WebCore23AuthenticationChallengeC2EP28NSURLAuthenticationChallenge
-__ZN7WebCore4coreEP15NSURLCredential
-__ZN7WebCore10CredentialC2ERKNS_6StringES3_NS_21CredentialPersistenceE
-__ZN7WebCore4coreEP20NSURLProtectionSpace
-__ZN7WebCore15ProtectionSpaceC2ERKNS_6StringEiNS_25ProtectionSpaceServerTypeES3_NS_35ProtectionSpaceAuthenticationSchemeE
-__ZN7WebCore27AuthenticationChallengeBaseC2ERKNS_15ProtectionSpaceERKNS_10CredentialEjRKNS_16ResourceResponseERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceHandle33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
-__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeEPNS_14ResourceHandleERKNS_23AuthenticationChallengeE
-__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
-__ZN7WebCore11FrameLoader33didReceiveAuthenticationChallengeEPNS_14ResourceLoaderERKNS_23AuthenticationChallengeE
-__ZN7WebCore3macERKNS_23AuthenticationChallengeE
--[WebCoreResourceHandleAsDelegate useCredential:forAuthenticationChallenge:]
-__ZN7WebCore14ResourceHandle18receivedCredentialERKNS_23AuthenticationChallengeERKNS_10CredentialE
-__ZN7WebCore27AuthenticationChallengeBase7compareERKNS_23AuthenticationChallengeES3_
-__ZNK7WebCore27AuthenticationChallengeBase6isNullEv
-__ZNK7WebCore27AuthenticationChallengeBase15protectionSpaceEv
-__ZN7WebCoreeqERKNS_15ProtectionSpaceES2_
-__ZNK7WebCore15ProtectionSpace4hostEv
-__ZNK7WebCore15ProtectionSpace4portEv
-__ZNK7WebCore15ProtectionSpace10serverTypeEv
-__ZNK7WebCore15ProtectionSpace5realmEv
-__ZNK7WebCore15ProtectionSpace20authenticationSchemeEv
-__ZNK7WebCore27AuthenticationChallengeBase18proposedCredentialEv
-__ZN7WebCoreeqERKNS_10CredentialES2_
-__ZNK7WebCore10Credential4userEv
-__ZNK7WebCore10Credential8passwordEv
-__ZNK7WebCore10Credential11persistenceEv
-__ZNK7WebCore27AuthenticationChallengeBase20previousFailureCountEv
-__ZNK7WebCore27AuthenticationChallengeBase15failureResponseEv
-__ZN7WebCore20ResourceResponseBase7compareERKNS_16ResourceResponseES3_
-__ZNK7WebCore20ResourceResponseBase14httpStatusTextEv
-__ZN3WTFeqIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEEEbRKNS_7HashMapIT_T0_T1_T2_T3_EESG_
-__ZNK3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS1_6StringEENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IS4_EEEESB_E4findIS2_NS_22IdentityHashTranslatorIS2_S5_S8_EEEENS_22HashTableConstIteratorIS2_S5_S7_S8_SD_SB_EERKT_
-__ZN7WebCore16ResourceResponse15platformCompareERKS0_S2_
-__ZNK7WebCore27AuthenticationChallengeBase5errorEv
-__ZN7WebCore17ResourceErrorBase7compareERKNS_13ResourceErrorES3_
-__ZN7WebCore23AuthenticationChallenge15platformCompareERKS0_S2_
-__ZN7WebCore3macERKNS_10CredentialE
-__ZN7WebCore23AuthenticationChallengeD2Ev
--[WebCoreResourceHandleAsDelegate cancelAuthenticationChallenge:]
-__ZN7WebCore14ResourceHandle20receivedCancellationERKNS_23AuthenticationChallengeE
-__ZN7WebCore14ResourceLoader20receivedCancellationEPNS_14ResourceHandleERKNS_23AuthenticationChallengeE
-__ZN7WebCore14ResourceLoader20receivedCancellationERKNS_23AuthenticationChallengeE
-__ZNK7WebCore17HTMLAnchorElement13supportsFocusEv
-__ZN7WebCore33jsHTMLTableCellElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsHTMLTableRowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore36jsHTMLTableSectionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsHTMLTableElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsHTMLFormElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsHTMLFormElementEnctypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore31jsHTMLHeadingElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsHTMLDListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsHTMLLIElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZL29windowProtoFuncNotImplementedPN3JSC9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZN7WebCore24jsEventTargetNodeOnresetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode7onresetEv
-__ZN7WebCore27setJSEventTargetNodeOnresetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode10setOnresetEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore17HTMLSelectElement13typeAheadFindEPNS_13KeyboardEventE
-__ZN7WebCore6String6appendEt
-__ZN7WebCore15StringTruncator13rightTruncateERKNS_6StringEfRKNS_4FontEb
-__ZN7WebCore12RenderObject25rectWithOutlineForRepaintEPNS_9RenderBoxEi
-__ZNK7WebCore14XMLHttpRequest38usesDashboardBackwardCompatibilityModeEv
-__ZN7WebCore14XMLHttpRequest26makeCrossSiteAccessRequestERi
-__ZNK7WebCore14XMLHttpRequest30isSimpleCrossSiteAccessRequestEv
-__ZN7WebCoreL45isOnAccessControlSimpleRequestHeaderWhitelistERKNS_6StringE
-__ZN7WebCore14XMLHttpRequest32makeSimpleCrossSiteAccessRequestERi
-__ZN7WebCore19ResourceRequestBase19setAllowHTTPCookiesEb
-__ZN7WebCore14XMLHttpRequest18accessControlCheckERKNS_16ResourceResponseE
-__ZN7WebCore14XMLHttpRequest12networkErrorEv
-__ZN7WebCore14XMLHttpRequest18dispatchErrorEventEv
-__ZN7WebCore10HTMLParser15popInlineBlocksEv
-__ZN7WebCore6JSAttr3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore4Attr12setNodeValueERKNS_6StringERi
-__ZN7WebCore4Attr8setValueERKNS_6StringERi
-__ZN7WebCore4Attr15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCore26jsEventTargetNodeOnmouseupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode9onmouseupEv
-__ZN7WebCore14RenderTableRow12imageChangedEPvPKNS_7IntRectE
--[DOMHTMLInputElement(FormAutoFillTransition) _rectOnScreen]
-__ZN7WebCoreL28createHTMLBaseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLBaseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBaseElementEEE
-__ZN7WebCore17JSHTMLBaseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSHTMLBaseElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore17JSHTMLBaseElementD0Ev
-__ZN7WebCore44jsHTMLTextAreaElementPrototypeFunctionSelectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19HTMLTextAreaElement6selectEv
-__ZN7WebCore11RenderStyle13setCursorListEN3WTF10PassRefPtrINS_10CursorListEEE
-__ZN7WebCore33setJSHTMLInputElementDefaultValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement15setDefaultValueERKNS_6StringE
-__ZN7WebCore35setJSHTMLInputElementDefaultCheckedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement17setDefaultCheckedEb
-__ZN7WebCoreL12toAlphabeticEiPKti
-__ZN7WebCore13AXObjectCache23selectedChildrenChangedEPNS_12RenderObjectE
-__ZNK7WebCore13RenderListBox9isListBoxEv
-__ZN7WebCore20AccessibilityListBox6createEPNS_12RenderObjectE
-__ZN7WebCore20AccessibilityListBoxC1EPNS_12RenderObjectE
-__ZN7WebCore20AccessibilityListBoxD1Ev
-__ZN7WebCore17HTMLSelectElement26listBoxDefaultEventHandlerEPNS_5EventE
-__ZThn68_NK7WebCore19HTMLOptGroupElement14groupLabelTextEv
-__ZNK7WebCore19HTMLOptGroupElement14groupLabelTextEv
-__ZN7WebCore16HTMLInputElement15addSearchResultEv
-__ZN7WebCore27RenderTextControlSingleLine15addSearchResultEv
-__ZN7WebCoreL17cdataBlockHandlerEPvPKhi
-__ZN7WebCore12XMLTokenizer10cdataBlockEPKhi
-__ZN7WebCore12CDATASectionC2EPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore12CDATASection8nodeTypeEv
-__ZN7WebCore14JSCDATASectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CDATASectionEEE
-__ZN7WebCore14JSCDATASection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12CDATASectionD1Ev
-__ZNK7WebCore17CSSInheritedValue7cssTextEv
-__ZN7WebCore26setJSXMLHttpRequestOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZSt25__unguarded_linear_insertIPN7WebCore8Gradient9ColorStopES2_PFbRKS2_S5_EEvT_T0_T1_
-__ZSt16__merge_backwardIPN7WebCore8Gradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
-__ZN7WebCore13MediaDocumentC1EPNS_5FrameE
-__ZN7WebCore13MediaDocument15createTokenizerEv
-__ZNK7WebCore14MediaTokenizer12wantsRawDataEv
-__ZN7WebCore14MediaTokenizer12writeRawDataEPKci
-__ZN7WebCore14MediaTokenizer23createDocumentStructureEv
-__ZN7WebCoreL16videoConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLVideoElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16HTMLMediaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore8Document31registerForMediaVolumeCallbacksEPNS_7ElementE
-__ZN7WebCore16HTMLMediaElement16attributeChangedEPNS_9AttributeEb
-__ZN7WebCore16HTMLVideoElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLVideoElement7isVideoEv
-__ZN7WebCore16HTMLMediaElement6setSrcERKNS_6StringE
-__ZN7WebCore16HTMLMediaElement20insertedIntoDocumentEv
-__ZNK7WebCore16HTMLMediaElement3srcEv
-__ZN7WebCore16HTMLMediaElement12scheduleLoadEv
-__ZN7WebCore16HTMLVideoElement6attachEv
-__ZN7WebCore16HTMLMediaElement6attachEv
-__ZN7WebCore14RenderThemeMac28extraMediaControlsStyleSheetEv
-__ZN7WebCoreL20mediaControllerThemeEv
-__ZNK7WebCore13MediaDocument15isMediaDocumentEv
-__ZN7WebCore16HTMLVideoElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore16HTMLVideoElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore11RenderVideoC2EPNS_16HTMLMediaElementE
-__ZN7WebCore11RenderMediaC2EPNS_16HTMLMediaElementERKNS_7IntSizeE
-__ZNK7WebCore11RenderMedia10firstChildEv
-__ZN7WebCore11RenderVideo17updateFromElementEv
-__ZN7WebCore11RenderMedia17updateFromElementEv
-__ZN7WebCore11RenderMedia14updateControlsEv
-__ZNK7WebCore11RenderMedia12mediaElementEv
-__ZNK7WebCore16HTMLMediaElement8controlsEv
-__ZN7WebCore11RenderMedia24createControlsShadowRootEv
-__ZN7WebCore29MediaControlShadowRootElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZNK7WebCore11RenderMedia7isMediaEv
-__ZNK7WebCore29MediaControlShadowRootElement12isShadowNodeEv
-__ZN7WebCore29MediaControlShadowRootElement16shadowParentNodeEv
-__ZN7WebCore11RenderMedia11createPanelEv
-__ZN7WebCore11RenderMedia16createMuteButtonEv
-__ZN7WebCore29MediaControlMuteButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore24MediaControlInputElementC2EPNS_8DocumentENS_11RenderStyle8PseudoIdERKNS_6StringEPNS_16HTMLMediaElementE
-__ZN7WebCore24MediaControlInputElement14attachToParentEPNS_7ElementE
-__ZN7WebCore11RenderMedia16createPlayButtonEv
-__ZN7WebCore29MediaControlPlayButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore11RenderMedia23createTimelineContainerEv
-__ZN7WebCore11RenderMedia14createTimelineEv
-__ZN7WebCore27MediaControlTimelineElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore11RenderMedia20createSeekBackButtonEv
-__ZN7WebCore29MediaControlSeekButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementEb
-__ZN7WebCore11RenderMedia23createSeekForwardButtonEv
-__ZN7WebCore11RenderMedia24createCurrentTimeDisplayEv
-__ZN7WebCore23MediaTimeDisplayElementC1EPNS_8DocumentEPNS_16HTMLMediaElementEb
-__ZN7WebCore23MediaTextDisplayElementC2EPNS_8DocumentENS_11RenderStyle8PseudoIdEPNS_16HTMLMediaElementE
-__ZN7WebCore23MediaTextDisplayElement14attachToParentEPNS_7ElementE
-__ZN7WebCore11RenderMedia26createTimeRemainingDisplayEv
-__ZN7WebCore11RenderMedia22createFullscreenButtonEv
-__ZN7WebCore35MediaControlFullscreenButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZNK7WebCore16HTMLMediaElement6pausedEv
-__ZN7WebCore24MediaControlInputElement6updateEv
-__ZN7WebCore27MediaControlTimelineElement6updateEb
-__ZNK7WebCore16HTMLMediaElement8durationEv
-__ZNK7WebCore16HTMLMediaElement11currentTimeEv
-__ZN7WebCore11RenderVideo6layoutEv
-__ZN7WebCore11RenderMedia6layoutEv
-__ZNK7WebCore11RenderVideo17calcReplacedWidthEb
-__ZNK7WebCore11RenderVideo16isWidthSpecifiedEv
-__ZNK7WebCore11RenderVideo20calcAspectRatioWidthEv
-__ZNK7WebCore11RenderVideo18calcReplacedHeightEv
-__ZNK7WebCore11RenderVideo17isHeightSpecifiedEv
-__ZNK7WebCore11RenderVideo21calcAspectRatioHeightEv
-__ZN7WebCore11RenderVideo12updatePlayerEv
-__ZNK7WebCore11RenderMedia6playerEv
-__ZNK7WebCore11RenderMedia17rightmostPositionEbb
-__ZNK7WebCore11RenderMedia14lowestPositionEbb
-__ZN7WebCore11RenderMedia17updateTimeDisplayEv
-__ZN7WebCore11RenderMedia23updateControlVisibilityEv
-__ZN7WebCore14MediaTokenizer6finishEv
-__ZN7WebCore13MediaDocument19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore14DocumentLoader22cancelMainResourceLoadERKNS_13ResourceErrorE
-__ZN7WebCore11RenderVideo13paintReplacedERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore14RenderThemeMac20paintMediaMuteButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore16HTMLMediaElement5mutedEv
-__ZN7WebCore14RenderThemeMac20paintMediaPlayButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore16HTMLMediaElement7canPlayEv
-__ZN7WebCore14RenderThemeMac21paintMediaSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac21paintMediaSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac24paintMediaSeekBackButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac27paintMediaSeekForwardButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore5TimerINS_16HTMLMediaElementEE5firedEv
-__ZN7WebCore16HTMLMediaElement14loadTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore16HTMLMediaElement4loadERi
-__ZNK7WebCore16HTMLMediaElement19defaultPlaybackRateEv
-__ZN7WebCore16HTMLMediaElement15setPlaybackRateEfRi
-__ZNK7WebCore16HTMLMediaElement12networkStateEv
-__ZN7WebCore16HTMLMediaElement9pickMediaEv
-__ZN7WebCore15EventTargetNode21dispatchProgressEventERKNS_12AtomicStringEbjj
-__ZN7WebCore13ProgressEventC2ERKNS_12AtomicStringEbjj
-__ZN7WebCore16HTMLMediaElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore11RenderMedia12forwardEventEPNS_5EventE
-__ZN7WebCore11MediaPlayerC2EPNS_17MediaPlayerClientE
-__ZN7WebCore18MediaPlayerPrivateC2EPNS_11MediaPlayerE
--[WebCoreMovieObserver initWithCallback:]
-__ZN7WebCore16HTMLMediaElement12updateVolumeEv
-__ZN7WebCore11MediaPlayer9setVolumeEf
-__ZN7WebCore18MediaPlayerPrivate9setVolumeEf
-__ZNK7WebCore11MediaPlayer8durationEv
-__ZNK7WebCore18MediaPlayerPrivate8durationEv
-__ZNK7WebCore11MediaPlayer11currentTimeEv
-__ZNK7WebCore18MediaPlayerPrivate11currentTimeEv
-__ZN7WebCore11MediaPlayer8hasVideoEv
-__ZNK7WebCore18MediaPlayerPrivate8hasVideoEv
-__ZNK7WebCore11RenderVideo8videoBoxEv
-__ZN7WebCore11MediaPlayer7setRectERKNS_7IntRectE
-__ZN7WebCore18MediaPlayerPrivate7setRectERKNS_7IntRectE
-__ZN7WebCore11MediaPlayer10setVisibleEb
-__ZN7WebCore18MediaPlayerPrivate10setVisibleEb
-__ZN7WebCore11MediaPlayer4loadERKNS_6StringE
-__ZN7WebCore18MediaPlayerPrivate4loadERKNS_6StringE
-__ZN7WebCore11MediaPlayer19networkStateChangedEv
-__ZThn56_N7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore11MediaPlayer12networkStateEv
-__ZN7WebCore18MediaPlayerPrivate10cancelSeekEv
--[WebCoreMovieObserver setDelayCallbacks:]
-__ZN7WebCore18MediaPlayerPrivate13createQTMovieERKNS_6StringE
-__ZL41initQTMovieAskUnresolvedDataRefsAttributev
-__ZL40initQTSecurityPolicyNoCrossSiteAttributev
-__ZL43initQTMoviePreventExternalURLLinksAttributev
-__ZL23initQTMovieURLAttributev
-__ZNK7WebCore11MediaPlayer6volumeEv
-__ZL41initQTMovieLoadStateDidChangeNotificationv
-__ZL36initQTMovieRateDidChangeNotificationv
-__ZL36initQTMovieSizeDidChangeNotificationv
-__ZL36initQTMovieTimeDidChangeNotificationv
-__ZL29initQTMovieDidEndNotificationv
--[WebCoreMovieObserver loadStateChanged:]
-__ZL28initQTMovieHasVideoAttributev
-__ZN7WebCore11MediaPlayer15maxTimeBufferedEv
-__ZNK7WebCore18MediaPlayerPrivate15maxTimeBufferedEv
-__ZNK7WebCore18MediaPlayerPrivate13maxTimeLoadedEv
--[WebCoreMovieObserver sizeChanged:]
-__ZN7WebCore11MediaPlayer5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore18MediaPlayerPrivate5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZNK7WebCore11RenderMedia9lastChildEv
-__ZN7WebCore24MediaControlInputElement7hitTestERKNS_8IntPointE
-__ZN7WebCore14RenderThemeMac23hitTestMediaControlPartEPNS_12RenderObjectERKNS_8IntPointE
-__ZN7WebCore11RenderTheme23hitTestMediaControlPartEPNS_12RenderObjectERKNS_8IntPointE
-__ZN7WebCore29MediaControlPlayButtonElement19defaultEventHandlerEPNS_5EventE
-__ZL32QTMovieHasVideoAttributeFunctionv
-__ZN7WebCore18MediaPlayerPrivate16loadStateChangedEv
-__ZN7WebCore18MediaPlayerPrivate12updateStatesEv
-__ZL29initQTMovieLoadStateAttributev
-__ZN7WebCore11MediaPlayer15inMediaDocumentEv
-__ZNK7WebCore18MediaPlayerPrivate7seekingEv
-__ZNK7WebCore16HTMLMediaElement14effectiveStartEv
-__ZNK7WebCore16HTMLMediaElement5startEv
-__ZNK7WebCore16HTMLMediaElement22getTimeOffsetAttributeERKNS_13QualifiedNameEf
-__ZN7WebCore11MediaPlayer4seekEf
-__ZN7WebCore18MediaPlayerPrivate4seekEf
-__ZN7WebCore18MediaPlayerPrivate6doSeekEv
-__ZNK7WebCore18MediaPlayerPrivate12createQTTimeEf
-__ZL29initQTMovieTimeScaleAttributev
-__ZL14initQTMakeTimexl
--[WebCoreMovieObserver rateChanged:]
--[WebCoreMovieObserver timeChanged:]
-__ZN7WebCore16HTMLMediaElement13setReadyStateENS0_10ReadyStateE
-__ZNK7WebCore16HTMLMediaElement15activelyPlayingEv
-__ZN7WebCore16HTMLMediaElement15updatePlayStateEv
-__ZNK7WebCore16HTMLMediaElement11currentLoopEv
-__ZNK7WebCore16HTMLMediaElement9playCountEv
-__ZNK7WebCore6String6toUIntEPb
-__ZNK7WebCore16HTMLMediaElement12effectiveEndEv
-__ZNK7WebCore16HTMLMediaElement9loopStartEv
-__ZNK7WebCore16HTMLMediaElement3endEv
-__ZN7WebCore11MediaPlayer10setEndTimeEf
-__ZN7WebCore18MediaPlayerPrivate10setEndTimeEf
-__ZN7WebCore18MediaPlayerPrivate26startEndPointTimerIfNeededEv
-__ZNK7WebCore11MediaPlayer6pausedEv
-__ZNK7WebCore18MediaPlayerPrivate6pausedEv
-__ZN7WebCore16HTMLVideoElement17updatePosterImageEv
-__ZNK7WebCore16HTMLVideoElement6posterEv
-__ZN7WebCore11RenderVideo16videoSizeChangedEv
-__ZN7WebCore11MediaPlayer11naturalSizeEv
-__ZNK7WebCore18MediaPlayerPrivate11naturalSizeEv
-__ZL31initQTMovieNaturalSizeAttributev
-__ZN7WebCore11MediaPlayer17readyStateChangedEv
-__ZThn56_N7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore11MediaPlayer10readyStateEv
-__ZNK7WebCore11MediaPlayer7visibleEv
-__ZN7WebCore18MediaPlayerPrivate19setUpVideoRenderingEv
-__ZN7WebCore18MediaPlayerPrivate17createQTMovieViewEv
-__ZN7WebCore18MediaPlayerPrivate17detachQTMovieViewEv
-__ZL15initQTMovieViewv
--[WebCoreMovieObserver setView:]
-__ZN7WebCore15GraphicsContext28setImageInterpolationQualityENS_20InterpolationQualityE
-__ZN7WebCore16HTMLMediaElement23progressEventTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore11MediaPlayer11bytesLoadedEv
-__ZNK7WebCore18MediaPlayerPrivate11bytesLoadedEv
-__ZNK7WebCore18MediaPlayerPrivate10totalBytesEv
-__ZL28initQTMovieDataSizeAttributev
-__ZN7WebCore16HTMLMediaElement28initAndDispatchProgressEventERKNS_12AtomicStringE
-__ZN7WebCore11MediaPlayer15totalBytesKnownEv
-__ZNK7WebCore18MediaPlayerPrivate15totalBytesKnownEv
-__ZL32QTMovieDataSizeAttributeFunctionv
-__ZN7WebCore11MediaPlayer10totalBytesEv
-__ZL33QTMovieLoadStateAttributeFunctionv
-__ZN7WebCore29MediaControlSeekButtonElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore16HTMLMediaElement5pauseERi
-__ZN7WebCore18MediaPlayerPrivate11rateChangedEv
-__ZN7WebCore18MediaPlayerPrivate11timeChangedEv
-__ZN7WebCore11MediaPlayer11timeChangedEv
-__ZThn56_N7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
-__ZNK7WebCore16HTMLMediaElement10readyStateEv
-__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
-__ZN7WebCore16HTMLMediaElement4seekEfRi
-__ZNK7WebCore16HTMLMediaElement8seekableEv
-__ZN7WebCore11MediaPlayer15maxTimeSeekableEv
-__ZNK7WebCore18MediaPlayerPrivate15maxTimeSeekableEv
-__ZN7WebCore10TimeRangesC2Eff
-__ZN7WebCore10TimeRanges3addEff
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE15reserveCapacityEm
-__ZNK7WebCore10TimeRanges7containEf
-__ZNK7WebCore10TimeRanges5startEjRi
-__ZNK7WebCore10TimeRanges3endEjRi
-__ZL33QTMovieTimeScaleAttributeFunctionv
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE6shrinkEm
--[WebCoreMovieObserver menuForEventDelegate:]
-__ZN7WebCore27MediaControlTimelineElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore16HTMLMediaElement5endedEv
-__ZNK7WebCore16HTMLMediaElement13endedPlaybackEv
-__ZN7WebCore16HTMLMediaElement17setPausedInternalEb
-__ZN7WebCore16HTMLVideoElement6detachEv
-__ZN7WebCore11RenderMedia7destroyEv
-__ZN7WebCore11RenderMedia11removeChildEPNS_12RenderObjectE
-__ZN7WebCore28RenderMediaControlShadowRootD1Ev
-__ZN7WebCore11RenderVideoD1Ev
-__ZN7WebCore18MediaPlayerPrivate22tearDownVideoRenderingEv
-__ZN7WebCore29MediaControlShadowRootElementD1Ev
-__ZN7WebCore29MediaControlMuteButtonElementD1Ev
-__ZN7WebCore29MediaControlPlayButtonElementD1Ev
-__ZN7WebCore29MediaControlSeekButtonElementD1Ev
-__ZN7WebCore23MediaTimeDisplayElementD1Ev
-__ZN7WebCore8Document33unregisterForMediaVolumeCallbacksEPNS_7ElementE
-__ZN7WebCore18MediaPlayerPrivateD2Ev
-__ZN7WebCore18MediaPlayerPrivate22destroyQTVideoRendererEv
--[WebCoreMovieObserver disconnect]
-__ZN7WebCore27MediaControlTimelineElementD1Ev
-__ZNK7WebCore15HTMLAreaElement11isFocusableEv
-__ZNK7WebCore17HTMLLegendElement11isFocusableEv
-__ZNK7WebCore21HTMLFrameOwnerElement19isFrameOwnerElementEv
-__ZN7WebCore17HTMLSelectElement6removeEi
-__ZN7WebCore21setJSDOMWindowScrollXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore32setJSEventTargetNodeOnmousewheelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode15setOnmousewheelEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore29jsEventTargetNodeOnmousewheelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode12onmousewheelEv
-__ZN7WebCore33setJSEventTargetNodeOncontextmenuEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode16setOncontextmenuEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore28setJSEventTargetNodeOnselectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode11setOnselectEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore6JSAttr9classInfoEv
-__ZNK7WebCore11RenderBlock14firstLineBlockEv
-__ZN7WebCore25jsHTMLLinkElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLLinkElement8disabledEv
-__ZN7WebCore21jsNavigatorProductSubEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13NavigatorBase10productSubEv
-__ZNK7WebCore8CSSValue22isImplicitInitialValueEv
-__ZN7WebCore34jsDOMWindowPrototypeFunctionScrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16JSStyleSheetList18canGetItemsForNameEPN3JSC9ExecStateEPNS_14StyleSheetListERKNS1_10IdentifierE
-__ZNK7WebCore14StyleSheetList12getNamedItemERKNS_6StringE
-__ZN7WebCore25JSStyleSheetListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore9JSCSSRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16jsCSSRuleCssTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12CSSStyleRule7cssTextEv
-__ZNK7WebCore12CSSStyleRule12selectorTextEv
-__ZNK7WebCore11CSSSelector12selectorTextEv
-__ZN7WebCore4Path15createRectangleERKNS_9FloatRectE
-__ZN7WebCore5TimerINS_11RenderImageEE5firedEv
-__ZN7WebCore11RenderImage28highQualityRepaintTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9DOMWindow8resizeToEff
-__ZNK7WebCore12RenderApplet13intrinsicSizeEv
-__ZN7WebCore19JSHTMLAppletElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN3JSC8Bindings12JavaInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListE
-__ZNK3JSC8Bindings10JavaMethod13numParametersEv
-__ZN3JSC8Bindings20convertValueToJValueEPNS_9ExecStateENS_10JSValuePtrE7JNITypePKc
-__ZNK3JSC8Bindings10RootObject12nativeHandleEv
-__ZNK3JSC8Bindings10JavaMethod8methodIDEP8_jobject
-__ZNK3JSC8Bindings10JavaMethod9signatureEv
-__ZN3JSC8Bindings26signatureFromPrimitiveTypeE7JNIType
-__ZL15appendClassNameRN3JSC7UStringEPKc
-__ZN3JSC8Bindings11getMethodIDEP8_jobjectPKcS4_
-__ZNK3JSC8Bindings10JavaMethod13JNIReturnTypeEv
-__ZN3JSC8Bindings15dispatchJNICallEPNS_9ExecStateEPKvP8_jobjectb7JNITypeP10_jmethodIDP6jvalueRSA_PKcRNS_10JSValuePtrE
-KJS_JSCreateNativeJSObject
-__ZN3JSC8Bindings12JavaJSObject6invokeEPNS0_19JSObjectCallContextE
-__ZN3JSC8Bindings12JavaJSObject12createNativeEx
-__ZN3JSC8Bindings24findProtectingRootObjectEPNS_8JSObjectE
-__ZN3JSC8Bindings10RootObject13gcIsProtectedEPNS_8JSObjectE
-KJS_JSObject_JSObjectCall
-__ZN3JSC8Bindings12JavaJSObjectC1Ex
-__ZNK3JSC8Bindings12JavaJSObject4callEP8_jstringP13_jobjectArray
-__ZNK3JSC8Bindings12JavaJSObject10rootObjectEv
-__ZNK3JSC8Bindings12JavaJSObject17getListFromJArrayEPNS_9ExecStateEP13_jobjectArrayRNS_7ArgListE
-__ZNK3JSC8Bindings12JavaJSObject21convertJObjectToValueEPNS_9ExecStateEP8_jobject
-__ZNK3JSC16RuntimeObjectImp12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
-__ZNK3JSC8Bindings12JavaInstance12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
-__ZNK3JSC8Bindings12JavaInstance11stringValueEPNS_9ExecStateE
-__ZNK3JSC8Bindings12JavaJSObject21convertValueToJObjectENS_10JSValuePtrE
-__ZN7JNIEnv_9NewObjectEP7_jclassP10_jmethodIDz
-KJS_JSObject_JSFinalize
-__ZNK3JSC8Bindings12JavaJSObject8finalizeEv
-__ZN7WebCore19JSHTMLAppletElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore19JSHTMLAppletElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore15GraphicsContext15fillRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_RKNS_5ColorE
-__ZN7WebCoreL36createHTMLTableCaptionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore25JSHTMLTableCaptionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableCaptionElementEEE
-__ZN7WebCore25JSHTMLTableCaptionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSHTMLTableCaptionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore25JSHTMLTableCaptionElementD0Ev
-__ZNK7WebCore5Frame11currentFormEv
-__ZN7WebCore15DatabaseTracker7originsERN3WTF6VectorINS1_6RefPtrINS_14SecurityOriginEEELm0EEE
-__ZN7WebCore15DatabaseTracker15populateOriginsEv
-__ZN7WebCore18OriginQuotaManagerC2Ev
-__ZN7WebCore15DatabaseTracker19openTrackerDatabaseEb
-__ZNK7WebCore15DatabaseTracker19trackerDatabasePathEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE6resizeEm
--[DOMHTMLInputElement readOnly]
-__ZN7WebCoreL21updateResourceRequestEPNS_17InspectorResourceERKNS_15ResourceRequestE
-__ZN7WebCore19InspectorController11addResourceEPNS_17InspectorResourceE
-__ZN3WTF9HashTableIxSt4pairIxNS_6RefPtrIN7WebCore17InspectorResourceEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIyEENS_14PairHashTraitsINS_10HashTraitsIxEENSC_IS5_EEEESD_EC1ERKSG_
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore5FrameEEEPNS0_IxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS9_IS6_EEEENS_7PtrHashIS4_EENS9_IS4_EENS9_ISD_EEE3getEPS3_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore5FrameEEESt4pairIS4_PNS_7HashMapIxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENSB_IS8_EEEEENS_18PairFirstExtractorISG_EENS_7PtrHashIS4_EENS_14PairHashTraitsINSB_IS4_EENSB_ISF_EEEESM_E6expandEv
-__ZN3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3setERKxRKS4_
-__ZN7WebCoreL22updateResourceResponseEPNS_17InspectorResourceERKNS_16ResourceResponseE
-__ZN7WebCore19InspectorController20clearConsoleMessagesEv
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE14shrinkCapacityEm
-__ZN7WebCore19InspectorController14pruneResourcesEPN3WTF7HashMapIxNS1_6RefPtrINS_17InspectorResourceEEENS1_7IntHashIyEENS1_10HashTraitsIxEENS8_IS5_EEEEPNS_14DocumentLoaderE
-__ZN7WebCore19InspectorController14removeResourceEPNS_17InspectorResourceE
-__ZN3WTF9HashTableIxSt4pairIxNS_6RefPtrIN7WebCore17InspectorResourceEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIyEENS_14PairHashTraitsINS_10HashTraitsIxEENSC_IS5_EEEESD_E4findIxNS_22IdentityHashTranslatorIxS6_SA_EEEENS_17HashTableIteratorIxS6_S8_SA_SF_SD_EERKT_
-__ZN7WebCore19InspectorController17addConsoleMessageEPN3JSC9ExecStateEPNS_14ConsoleMessageE
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE15reserveCapacityEm
-__ZN7WebCore11RenderImage20intrinsicSizeChangedEv
-__ZN7WebCore14RenderReplaced20intrinsicSizeChangedEv
-__ZNK7WebCore9FrameView14didFirstLayoutEv
-__ZN7WebCore11RenderBlock26addContinuationWithOutlineEPNS_10RenderFlowE
-__ZN3WTF7HashMapIPN7WebCore11RenderBlockEPNS_11ListHashSetIPNS1_10RenderFlowENS_7PtrHashIS6_EEEENS7_IS3_EENS_10HashTraitsIS3_EENSC_ISA_EEE3setERKS3_RKSA_
-__ZN3WTF9HashTableIPN7WebCore11RenderBlockESt4pairIS3_PNS_11ListHashSetIPNS1_10RenderFlowENS_7PtrHashIS7_EEEEENS_18PairFirstExtractorISC_EENS8_IS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSH_ISB_EEEESI_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore11RenderBlockESt4pairIS3_PNS_11ListHashSetIPNS1_10RenderFlowENS_7PtrHashIS7_EEEEENS_18PairFirstExtractorISC_EENS8_IS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSH_ISB_EEEESI_E4findIS3_NS_22IdentityHashTranslatorIS3_SC_SF_EEEENS_17HashTableIteratorIS3_SC_SE_SF_SK_SI_EERKT_
-__ZN7WebCore11FrameLoader23reloadAllowingStaleDataERKNS_6StringE
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE6shrinkEm
-__ZN7WebCoreL15newTextCodecMacERKNS_12TextEncodingEPKv
-__ZN7WebCore12TextCodecMacC2Em
-__ZN7WebCore12TextCodecMac6decodeEPKcmbbRb
-__ZNK7WebCore12TextCodecMac18createTECConverterEv
-__ZN7WebCoreL18cachedConverterTECEv
-__ZN7WebCore12TextCodecMac6decodeEPKhiRiPviS3_
-__ZN7WebCore12TextCodecMacD1Ev
-__ZNK7WebCore12TextCodecMac19releaseTECConverterEv
-__ZN7WebCore11FrameLoader21setCurrentHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
-__ZN7WebCore9FillLayer7setNextEPS0_
-__ZN7WebCore9FillLayer15cullEmptyLayersEv
-__ZN7WebCore9FillLayer19fillUnsetPropertiesEv
-__ZN7WebCore5Frame17setIsDisconnectedEb
-__ZNK7WebCore9FillLayer13hasFixedImageEv
-__ZN7WebCore13endOfSentenceERKNS_15VisiblePositionE
-__ZN7WebCore15startOfSentenceERKNS_15VisiblePositionE
-__ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
-__ZN7WebCore19InspectorController18toggleRecordButtonEb
-__ZN7WebCore19InspectorController15disableDebuggerEv
-__ZN7WebCore21JavaScriptDebugServer14removeListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
-__ZN3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEEENS_18PairFirstExtractorISE_EENS8_IS3_EENS_14PairHashTraitsINSA_IS3_EENSA_ISD_EEEESJ_E4findIS3_NS_22IdentityHashTranslatorIS3_SE_SH_EEEENS_17HashTableIteratorIS3_SE_SG_SH_SL_SJ_EERKT_
-__ZN7WebCore19InspectorController11closeWindowEv
-__ZN7WebCore11ContextMenu21addInspectElementItemEv
-__ZN7WebCore32contextMenuItemTagInspectElementEv
-__ZN7WebCore19InspectorController7inspectEPNS_4NodeE
-__ZN7WebCore19InspectorController4showEv
-__ZN7WebCore9CSSParser13parseGradientERN3WTF6RefPtrINS_8CSSValueEEE
-__ZN7WebCore22CSSImageGeneratorValueC2Ev
-__ZN7WebCoreL18parseGradientPointEPNS_14CSSParserValueEb
-__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE15reserveCapacityEm
-__ZN7WebCore9CSSParser13parseFillSizeEv
-__ZN7WebCore19InspectorController27windowScriptObjectAvailableEv
-__ZN7WebCoreL11jsStringRefEPKc
-__ZNK7WebCore8CSSValue12isImageValueEv
-__ZNK7WebCore22CSSImageGeneratorValue21isImageGeneratorValueEv
-__ZN7WebCore22CSSImageGeneratorValue14generatedImageEv
-__ZNK7WebCore22CSSImageGeneratorValue11isFixedSizeEv
-__ZN7WebCore16CSSStyleSelector13mapFillOriginEPNS_9FillLayerEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector11mapFillClipEPNS_9FillLayerEPNS_8CSSValueE
-__ZN7WebCore19StyleGeneratedImage9addClientEPNS_12RenderObjectE
-__ZN7WebCore22CSSImageGeneratorValue9addClientEPNS_12RenderObjectERKNS_7IntSizeE
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_NS1_7IntSizeEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS5_EEEESD_E6expandEv
-__ZN7WebCore7DataRefINS_20StyleFlexibleBoxDataEE6accessEv
-__ZN7WebCoreL16localizedStringsEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController19localizedStringsURLEv
-__ZN7WebCoreL11jsStringRefERKNS_6StringE
-__ZNK7WebCore19StyleGeneratedImage4dataEv
-__ZN7WebCore17RenderFlexibleBox22calcVerticalPrefWidthsEv
-__ZN7WebCoreL8platformEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCoreL12wrapCallbackEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore26JSInspectorCallbackWrapper4wrapEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore26JSInspectorCallbackWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
-__ZN7WebCore26JSInspectorCallbackWrapperC1EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
-__ZN7WebCore26JSQuarantinedObjectWrapperC2EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
-__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore26JSInspectorCallbackWrapperEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCoreL20hideDOMNodeHighlightEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController13hideHighlightEv
-__ZN7WebCoreL16searchingForNodeEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCoreL15inspectedWindowEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore24JSInspectedObjectWrapper4wrapEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCoreL8wrappersEv
-__ZN7WebCore24JSInspectedObjectWrapperC1EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
-__ZNK3WTF7HashMapIPN3JSC14JSGlobalObjectEPNS0_IPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEEENS9_IS3_EENSB_IS3_EENSB_ISF_EEE3getERKS3_
-__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectESt4pairIS3_PNS_7HashMapIPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSD_ISA_EEEEENS_18PairFirstExtractorISI_EENSB_IS3_EENS_14PairHashTraitsINSD_IS3_EENSD_ISH_EEEESN_E6expandEv
-__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore24JSInspectedObjectWrapperEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCore26JSQuarantinedObjectWrapper18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore24JSInspectedObjectWrapper17allowsGetPropertyEv
-__ZNK7WebCore26JSQuarantinedObjectWrapper18unwrappedExecStateEv
-__ZNK7WebCore24JSInspectedObjectWrapper17wrapOutgoingValueEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
-__ZNK7WebCore23JSHTMLDocumentPrototype9classInfoEv
-__ZNK7WebCore19JSDocumentPrototype9classInfoEv
-__ZNK7WebCore26JSQuarantinedObjectWrapper28transferExceptionToExecStateEPN3JSC9ExecStateE
-__ZN7WebCore26JSQuarantinedObjectWrapper17cachedValueGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore14JSDocumentType9classInfoEv
-__ZNK7WebCore23JSDocumentTypePrototype9classInfoEv
-__ZN7WebCoreL15isWindowVisibleEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19StyleGeneratedImage12removeClientEPNS_12RenderObjectE
-__ZN7WebCore22CSSImageGeneratorValue12removeClientEPNS_12RenderObjectE
-__ZN3WTF7HashMapIPN7WebCore12RenderObjectENS1_7IntSizeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3addERKS3_RKS4_
-__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_NS1_7IntSizeEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS5_EEEESD_E4findIS3_NS_22IdentityHashTranslatorIS3_S6_SA_EEEENS_17HashTableIteratorIS3_S6_S8_SA_SF_SD_EERKT_
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClearRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D9clearRectEffff
-__ZN7WebCore15GraphicsContext9clearRectERKNS_9FloatRectE
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionBeginPathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D9beginPathEv
-__ZN7WebCore4Path5clearEv
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClosePathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D9closePathEv
-__ZN7WebCore39setJSCanvasRenderingContext2DShadowBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24CanvasRenderingContext2D13setShadowBlurEf
-__ZN7WebCore24CanvasRenderingContext2D11applyShadowEv
-__ZN7WebCore40setJSCanvasRenderingContext2DShadowColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24CanvasRenderingContext2D14setShadowColorERKNS_6StringE
-__ZN7WebCore42setJSCanvasRenderingContext2DShadowOffsetXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetXEf
-__ZN7WebCore42setJSCanvasRenderingContext2DShadowOffsetYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetYEf
-__ZN7WebCore59jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D16quadraticCurveToEffff
-__ZN7WebCore4Path14addQuadCurveToERKNS_10FloatPointES3_
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionClipEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D4clipEv
-__ZN7WebCore27setJSHTMLOptionElementLabelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLOptionElement8setLabelERKNS_6StringE
-__ZN7WebCoreL15debuggerEnabledEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCoreL17pauseOnExceptionsEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController17pauseOnExceptionsEv
-__ZN7WebCoreL15profilerEnabledEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore16CSSStyleSelector11mapFillSizeEPNS_9FillLayerEPNS_8CSSValueE
-__ZN7WebCore25jsDOMSelectionIsCollapsedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12DOMSelection11isCollapsedEv
-__ZN7WebCore39jsDOMSelectionPrototypeFunctionAddRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12DOMSelection8addRangeEPNS_5RangeE
-__ZN7WebCoreL6loadedEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController17scriptObjectReadyEv
-__ZNK7WebCore19InspectorController15handleExceptionEPK15OpaqueJSContextPK13OpaqueJSValuej
-__ZN7WebCore19InspectorController10showWindowEv
-__ZN7WebCore19InspectorController16setWindowVisibleEbb
-__ZN7WebCore19InspectorController17setAttachedWindowEb
-__ZNK7WebCore19InspectorController12callFunctionEPK15OpaqueJSContextP13OpaqueJSValuePKcmPKPKS4_RS9_
-__ZN7WebCoreL6attachEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController12attachWindowEv
-__ZN7WebCore19InspectorController21populateScriptObjectsEv
-__ZN7WebCore19InspectorController26addAndUpdateScriptResourceEPNS_17InspectorResourceE
-__ZN7WebCore19InspectorController17addScriptResourceEPNS_17InspectorResourceE
-__ZN7WebCoreL22scriptObjectForRequestEPK15OpaqueJSContextPKNS_17InspectorResourceEPPK13OpaqueJSValue
-__ZN7WebCoreL10addHeadersEPK15OpaqueJSContextP13OpaqueJSValueRKNS_13HTTPHeaderMapEPPKS3_
-__ZN7WebCore19InspectorController28updateScriptResourceResponseEPNS_17InspectorResourceE
-__ZN7WebCore19InspectorController24updateScriptResourceTypeEPNS_17InspectorResourceE
-__ZN7WebCore19InspectorController20updateScriptResourceEPNS_17InspectorResourceEi
-__ZN7WebCore19InspectorController20updateScriptResourceEPNS_17InspectorResourceEddd
-__ZN7WebCore19InspectorController20updateScriptResourceEPNS_17InspectorResourceEbb
-__ZN7WebCore40jsElementPrototypeFunctionScrollIntoViewEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Element14scrollIntoViewEb
-__ZN7WebCore26JSQuarantinedObjectWrapper11getCallDataERN3JSC8CallDataE
-__ZNK7WebCore24JSInspectedObjectWrapper20allowsCallAsFunctionEv
-__ZN7WebCore26JSQuarantinedObjectWrapper4callEPN3JSC9ExecStateEPNS1_8JSObjectENS1_10JSValuePtrERKNS1_7ArgListE
-__ZNK7WebCore24JSInspectedObjectWrapper20prepareIncomingValueEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore26JSQuarantinedObjectWrapper9asWrapperEN3JSC10JSValuePtrE
-__ZNK7WebCore24JSInspectedObjectWrapper9classInfoEv
-__ZNK7WebCore26JSQuarantinedObjectWrapper25allowsUnwrappedAccessFromEPN3JSC9ExecStateE
-__ZN7WebCore26JSQuarantinedObjectWrapper15unwrappedObjectEv
-__ZNK7WebCore26JSInspectorCallbackWrapper9classInfoEv
-__ZNK7WebCore12DocumentType8nodeNameEv
-__ZN7WebCore22jsDocumentTypePublicIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsDocumentTypeInternalSubsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26JSQuarantinedObjectWrapper3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZNK7WebCore24JSInspectedObjectWrapper17allowsSetPropertyEv
-__ZNK7WebCore26JSHTMLHtmlElementPrototype9classInfoEv
-__ZNK7WebCore26JSHTMLHeadElementPrototype9classInfoEv
-__ZN7WebCore36jsNodePrototypeFunctionHasAttributesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore23JSNamedNodeMapPrototype9classInfoEv
-__ZN7WebCore26JSQuarantinedObjectWrapper18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZNK7WebCore15JSAttrPrototype9classInfoEv
-__ZNK7WebCore10StyleImage9canRenderEf
-__ZNK7WebCore26JSHTMLBodyElementPrototype9classInfoEv
-__ZN7WebCore33jsNodePrototypeFunctionIsSameNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore15JSTextPrototype9classInfoEv
-__ZNK7WebCore24JSCharacterDataPrototype9classInfoEv
-__ZNK7WebCore26JSHTMLMetaElementPrototype9classInfoEv
-__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore24JSInspectedObjectWrapperEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SC_EEEENS_17HashTableIteratorIS3_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore48jsElementPrototypeFunctionScrollIntoViewIfNeededEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Element22scrollIntoViewIfNeededEb
-__ZNK7WebCore30JSCSSStyleDeclarationPrototype9classInfoEv
-__ZN7WebCore11jsAttrStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15MappedAttribute5styleEv
-__ZN7WebCore27jsCSSStyleDeclarationLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore46jsDOMWindowPrototypeFunctionGetMatchedCSSRulesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9DOMWindow18getMatchedCSSRulesEPNS_7ElementERKNS_6StringEb
-__ZNK7WebCore13JSCSSRuleList9classInfoEv
-__ZNK7WebCore22JSCSSRuleListPrototype9classInfoEv
-__ZNK7WebCore14JSCSSStyleRule9classInfoEv
-__ZNK7WebCore23JSCSSStyleRulePrototype9classInfoEv
-__ZNK7WebCore18JSCSSRulePrototype9classInfoEv
-__ZN7WebCore26jsCSSStyleRuleSelectorTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsCSSRuleParentStyleSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore24JSCSSStyleSheetPrototype9classInfoEv
-__ZNK7WebCore21JSStyleSheetPrototype9classInfoEv
-__ZN7WebCore21JSCSSStyleDeclaration18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZN7WebCore21JSCSSStyleDeclaration11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore26CSSMutableStyleDeclaration4itemEj
-__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriorityEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19CSSStyleDeclaration19getPropertyPriorityERKNS_6StringE
-__ZN7WebCore58jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthandEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19CSSStyleDeclaration20getPropertyShorthandERKNS_6StringE
-__ZNK7WebCore26CSSMutableStyleDeclaration20getPropertyShorthandEi
-__ZN7WebCore21jsStyleSheetOwnerNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore27JSHTMLStyleElementPrototype9classInfoEv
-__ZN7WebCore16jsStyleSheetHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15CSSInitialValue22isImplicitInitialValueEv
-__ZN7WebCore56jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19CSSStyleDeclaration18isPropertyImplicitERKNS_6StringE
-__ZN7WebCore49jsCSSStyleDeclarationPrototypeFunctionSetPropertyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore26JSHTMLLinkElementPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLScriptElementPrototype9classInfoEv
-__ZN7WebCore9InlineBox16placeEllipsisBoxEbiiRb
-__ZNK7WebCore18JSCommentPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLIFrameElementPrototype9classInfoEv
-__ZN7WebCore19InspectorController23addScriptConsoleMessageEPKNS_14ConsoleMessageE
-__ZN7WebCore26JSQuarantinedObjectWrapper4markEv
-__ZN7WebCore12JSStyleSheet4markEv
-__ZN7WebCore24JSInspectedObjectWrapperD0Ev
-__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectESt4pairIS3_PNS_7HashMapIPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSD_ISA_EEEEENS_18PairFirstExtractorISI_EENSB_IS3_EENS_14PairHashTraitsINSD_IS3_EENSD_ISH_EEEESN_E4findIS3_NS_22IdentityHashTranslatorIS3_SI_SL_EEEENS_17HashTableIteratorIS3_SI_SK_SL_SP_SN_EERKT_
-__ZNK7WebCore19InspectorController18callSimpleFunctionEPK15OpaqueJSContextP13OpaqueJSValuePKc
-__ZN7WebCore19InspectorController9focusNodeEv
-__ZNK7WebCore27JSHTMLImageElementPrototype9classInfoEv
-__ZNK7WebCore29JSHTMLHeadingElementPrototype9classInfoEv
-__ZNK7WebCore31JSHTMLParagraphElementPrototype9classInfoEv
-__ZN7WebCoreL16highlightDOMNodeEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController9highlightEPNS_4NodeE
-__ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
-__ZN7WebCore9RenderBox13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEEb
-__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE6shrinkEm
-__ZN7WebCore12RenderObject27collectAbsoluteLineBoxQuadsERN3WTF6VectorINS_9FloatQuadELm0EEEjjb
-__ZNK7WebCore7IntRect8containsERKS0_
-__ZN7WebCoreL21drawHighlightForBoxesERNS_15GraphicsContextERKN3WTF6VectorINS_9FloatQuadELm0EEERKS4_S9_S9_S9_
-__ZN7WebCoreL16drawOutlinedQuadERNS_15GraphicsContextERKNS_9FloatQuadERKNS_5ColorE
-__ZN7WebCore15GraphicsContext7clipOutERKNS_4PathE
-__ZN7WebCore19InspectorController9showPanelENS0_13SpecialPanelsE
-__ZN7WebCore19StyleGeneratedImage21setImageContainerSizeERKNS_7IntSizeE
-__ZNK7WebCore19StyleGeneratedImage9imageSizeEPKNS_12RenderObjectEf
-__ZNK7WebCore19StyleGeneratedImage5imageEPNS_12RenderObjectERKNS_7IntSizeE
-__ZN7WebCore16CSSGradientValue5imageEPNS_12RenderObjectERKNS_7IntSizeE
-__ZN7WebCore22CSSImageGeneratorValue8getImageEPNS_12RenderObjectERKNS_7IntSizeE
-__ZN3WTF7HashMapIN7WebCore7IntSizeEjNS_7IntHashIS2_EENS_10HashTraitsIS2_EENS5_IjEEE3addERKS2_RKj
-__ZN3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7IntHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IjEEEESB_E6expandEv
-__ZN3WTF7HashMapIN7WebCore7IntSizeENS_6RefPtrINS1_5ImageEEENS_7IntHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3addERKS2_RKS5_
-__ZN7WebCore16CSSGradientValue14createGradientEPNS_12RenderObjectERKNS_7IntSizeE
-__ZN7WebCore16CSSGradientValue12resolvePointEPNS_17CSSPrimitiveValueES2_RKNS_7IntSizeEf
-__ZN7WebCore16CSSGradientValue17sortStopsIfNeededEv
-__ZNSt17_Temporary_bufferIPN7WebCore20CSSGradientColorStopES1_EC1ES2_S2_
-__ZSt22__get_temporary_bufferIN7WebCore20CSSGradientColorStopEESt4pairIPT_iEiS4_
-__ZSt26__uninitialized_fill_n_auxIPN7WebCore20CSSGradientColorStopEiS1_EvT_T0_RKT1_12__false_type
-__ZSt22__stable_sort_adaptiveIPN7WebCore20CSSGradientColorStopES2_iPFbRKS1_S4_EEvT_S7_T0_T1_T2_
-__ZSt24__merge_sort_with_bufferIPN7WebCore20CSSGradientColorStopES2_PFbRKS1_S4_EEvT_S7_T0_T1_
-__ZSt22__chunk_insertion_sortIPN7WebCore20CSSGradientColorStopEiPFbRKS1_S4_EEvT_S7_T0_T1_
-__ZSt16__insertion_sortIPN7WebCore20CSSGradientColorStopEPFbRKS1_S4_EEvT_S7_T0_
-__ZSt16__merge_adaptiveIPN7WebCore20CSSGradientColorStopEiS2_PFbRKS1_S4_EEvT_S7_S7_T0_S8_T1_S8_T2_
-__ZSt5mergeIPN7WebCore20CSSGradientColorStopES2_S2_PFbRKS1_S4_EET1_T_S8_T0_S9_S7_T2_
-__ZN7WebCoreL12compareStopsERKNS_20CSSGradientColorStopES2_
-__ZSt23return_temporary_bufferIN7WebCore20CSSGradientColorStopEEvPT_
-__ZN7WebCore22CSSImageGeneratorValue8putImageERKNS_7IntSizeEN3WTF10PassRefPtrINS_5ImageEEE
-__ZN3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_NS_6RefPtrINS1_5ImageEEEENS_18PairFirstExtractorIS7_EENS_7IntHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSD_IS6_EEEESE_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS7_
-__ZNK7WebCore5Image21mayFillWithSolidColorEv
-__ZNK7WebCore14GeneratedImage4sizeEv
-__ZNK7WebCore14GeneratedImage16hasRelativeWidthEv
-__ZNK7WebCore14GeneratedImage17hasRelativeHeightEv
-__ZN7WebCore14GeneratedImage11drawPatternEPNS_15GraphicsContextERKNS_9FloatRectERKNS_20TransformationMatrixERKNS_10FloatPointENS_17CompositeOperatorES5_
-__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERNS_9GeneratorE
-__ZN7WebCore8Gradient4fillEPNS_15GraphicsContextERKNS_9FloatRectE
-__ZN7WebCore5Image14startAnimationEb
-__ZSt25__unguarded_linear_insertIPN7WebCore20CSSGradientColorStopES1_PFbRKS1_S4_EEvT_T0_T1_
-__ZN7WebCore15rowResizeCursorEv
-__ZN7WebCore43jsDocumentPrototypeFunctionElementFromPointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7IntHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IjEEEESB_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S8_EEEENS_17HashTableIteratorIS2_S4_S6_S8_SD_SB_EERKT_
-__ZNK3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7IntHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IjEEEESB_E8containsIS2_NS_22IdentityHashTranslatorIS2_S4_S8_EEEEbRKT_
-__ZN3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_NS_6RefPtrINS1_5ImageEEEENS_18PairFirstExtractorIS7_EENS_7IntHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSD_IS6_EEEESE_E4findIS2_NS_22IdentityHashTranslatorIS2_S7_SB_EEEENS_17HashTableIteratorIS2_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCore10ShadowDataD2Ev
-__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionStrokeRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26JSCanvasRenderingContext2D10strokeRectEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D10strokeRectEffff
-__ZN7WebCore24CanvasRenderingContext2D10strokeRectEfffff
-__ZN7WebCore15GraphicsContext10strokeRectERKNS_9FloatRectEf
-__ZNK7WebCore26JSQuarantinedObjectWrapper17allowsGetPropertyEv
-__ZNK7WebCore26JSInspectorCallbackWrapper20allowsCallAsFunctionEv
-__ZNK7WebCore26JSInspectorCallbackWrapper20prepareIncomingValueEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZNK7WebCore15JSMutationEvent9classInfoEv
-__ZNK7WebCore24JSMutationEventPrototype9classInfoEv
-__ZN7WebCore15JSMutationEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26jsMutationEventRelatedNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26JSInspectorCallbackWrapper17wrapOutgoingValueEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCoreL19endSentenceBoundaryEPKtj
-__ZN7WebCore21sentenceBreakIteratorEPKti
-__ZN7WebCoreL21startSentenceBoundaryEPKtj
-__ZN7WebCoreL13clearMessagesEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore26JSQuarantinedObjectWrapper16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore24JSInspectedObjectWrapper22allowsGetPropertyNamesEv
-__ZNK7WebCore8JSPlugin9classInfoEv
-__ZNK7WebCore17JSPluginPrototype9classInfoEv
-__ZNK7WebCore30JSHTMLAppletElementConstructor9classInfoEv
-__ZNK7WebCore27JSHTMLMapElementConstructor9classInfoEv
-__ZNK7WebCore20JSCounterConstructor9classInfoEv
-__ZNK7WebCore26JSHTMLHRElementConstructor9classInfoEv
-__ZNK7WebCore31JSSVGTextPathElementConstructor9classInfoEv
-__ZNK7WebCore17JSTextConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLHeadElementConstructor9classInfoEv
-__ZNK7WebCore21JSMimeTypeConstructor9classInfoEv
-__ZNK7WebCore20JSCSSRuleConstructor9classInfoEv
-__ZNK7WebCore22JSClipboardConstructor9classInfoEv
-__ZNK7WebCore22JSTextEventConstructor9classInfoEv
-__ZNK7WebCore26JSCharacterDataConstructor9classInfoEv
-__ZNK7WebCore18JSHistoryPrototype9classInfoEv
-__ZNK7WebCore32JSHTMLTableColElementConstructor9classInfoEv
-__ZNK7WebCore35JSSVGPreserveAspectRatioConstructor9classInfoEv
-__ZNK7WebCore19JSEntityConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLQuoteElementConstructor9classInfoEv
-__ZNK7WebCore9JSStorage9classInfoEv
-__ZNK7WebCore18JSStoragePrototype9classInfoEv
-__ZNK7WebCore24JSCSSRuleListConstructor9classInfoEv
-__ZNK7WebCore21JSCSSValueConstructor9classInfoEv
-__ZNK7WebCore25JSStorageEventConstructor9classInfoEv
-__ZNK7WebCore25JSHTMLDocumentConstructor9classInfoEv
-__ZNK7WebCore36JSHTMLTableCaptionElementConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLEmbedElementConstructor9classInfoEv
-__ZNK7WebCore31JSSVGRenderingIntentConstructor9classInfoEv
-__ZNK7WebCore25JSCSSValueListConstructor9classInfoEv
-__ZNK7WebCore33JSHTMLParagraphElementConstructor9classInfoEv
-__ZNK7WebCore33JSXMLHttpRequestUploadConstructor9classInfoEv
-__ZNK7WebCore24JSPluginArrayConstructor9classInfoEv
-__ZNK7WebCore25JSCSSStyleRuleConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLParamElementConstructor9classInfoEv
-__ZNK7WebCore18JSConsolePrototype9classInfoEv
-__ZNK7WebCore17JSFileConstructor9classInfoEv
-__ZNK7WebCore34JSSVGTextContentElementConstructor9classInfoEv
-__ZNK7WebCore31JSHTMLIsIndexElementConstructor9classInfoEv
-__ZNK7WebCore27JSCSSCharsetRuleConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLMetaElementConstructor9classInfoEv
-__ZNK7WebCore30JSHTMLButtonElementConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLTitleElementConstructor9classInfoEv
-__ZNK7WebCore9JSBarInfo9classInfoEv
-__ZNK7WebCore18JSBarInfoPrototype9classInfoEv
-__ZNK7WebCore21JSFileListConstructor9classInfoEv
-__ZNK7WebCore31JSHTMLHeadingElementConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLLinkElementConstructor9classInfoEv
-__ZNK7WebCore21JSNotationConstructor9classInfoEv
-__ZNK7WebCore26JSCSSStyleSheetConstructor9classInfoEv
-__ZNK7WebCore26JSMimeTypeArrayConstructor9classInfoEv
-__ZNK7WebCore29JSCSSVariablesRuleConstructor9classInfoEv
-__ZNK7WebCore31JSHTMLMarqueeElementConstructor9classInfoEv
-__ZNK7WebCore25JSMessageEventConstructor9classInfoEv
-__ZNK7WebCore30JSHTMLSelectElementConstructor9classInfoEv
-__ZNK7WebCore23JSMediaErrorConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLMenuElementConstructor9classInfoEv
-__ZNK7WebCore36JSXMLHttpRequestExceptionConstructor9classInfoEv
-__ZNK7WebCore30JSHTMLObjectElementConstructor9classInfoEv
-__ZNK7WebCore36JSHTMLTableSectionElementConstructor9classInfoEv
-__ZNK7WebCore27JSXPathExceptionConstructor9classInfoEv
-__ZNK7WebCore26JSCSSImportRuleConstructor9classInfoEv
-__ZNK7WebCore23JSMouseEventConstructor9classInfoEv
-__ZNK7WebCore24JSTextMetricsConstructor9classInfoEv
-__ZNK7WebCore17JSNodeConstructor9classInfoEv
-__ZNK7WebCore27JSHTMLDivElementConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLAudioElementConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLStyleElementConstructor9classInfoEv
-__ZNK7WebCore28JSCSSFontFaceRuleConstructor9classInfoEv
-__ZNK7WebCore21JSNodeListConstructor9classInfoEv
-__ZNK7WebCore20JSNavigatorPrototype9classInfoEv
-__ZNK7WebCore27JSRangeExceptionConstructor9classInfoEv
-__ZNK7WebCore20JSStorageConstructor9classInfoEv
-__ZNK7WebCore23JSSVGPathSegConstructor9classInfoEv
-__ZNK7WebCore32JSHTMLFieldSetElementConstructor9classInfoEv
-__ZNK7WebCore25JSDocumentTypeConstructor9classInfoEv
-__ZNK7WebCore25JSSVGUnitTypesConstructor9classInfoEv
-__ZNK7WebCore26JSHTMLBRElementConstructor9classInfoEv
-__ZNK7WebCore30JSHTMLOptionElementConstructor9classInfoEv
-__ZNK7WebCore26JSKeyboardEventConstructor9classInfoEv
-__ZNK7WebCore25JSCDATASectionConstructor9classInfoEv
-__ZNK7WebCore34JSProcessingInstructionConstructor9classInfoEv
-__ZNK7WebCore32JSCSSStyleDeclarationConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLHtmlElementConstructor9classInfoEv
-__ZNK7WebCore21JSSVGAngleConstructor9classInfoEv
-__ZNK7WebCore23JSStyleSheetConstructor9classInfoEv
-__ZNK7WebCore29JSDOMCoreExceptionConstructor9classInfoEv
-__ZNK7WebCore18JSRangeConstructor9classInfoEv
-__ZNK7WebCore27JSHTMLCollectionConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLOListElementConstructor9classInfoEv
-__ZNK7WebCore26JSXMLSerializerConstructor9classInfoEv
-__ZNK7WebCore25JSSVGExceptionConstructor9classInfoEv
-__ZNK7WebCore24JSXPathResultConstructor9classInfoEv
-__ZNK7WebCore32JSHTMLTextAreaElementConstructor9classInfoEv
-__ZNK7WebCore30JSCSSPrimitiveValueConstructor9classInfoEv
-__ZNK7WebCore26JSDOMStringListConstructor9classInfoEv
-__ZNK7WebCore37JSCanvasRenderingContext2DConstructor9classInfoEv
-__ZNK7WebCore26JSOverflowEventConstructor9classInfoEv
-__ZNK7WebCore27JSEventExceptionConstructor9classInfoEv
-__ZNK7WebCore32JSHTMLFrameSetElementConstructor9classInfoEv
-__ZNK7WebCore17JSAttrConstructor9classInfoEv
-__ZNK7WebCore21JSSVGColorConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLBaseElementConstructor9classInfoEv
-__ZNK7WebCore36JSWebKitCSSTransformValueConstructor9classInfoEv
-__ZNK7WebCore30JSDOMImplementationConstructor9classInfoEv
-__ZNK7WebCore30JSHTMLLegendElementConstructor9classInfoEv
-__ZNK7WebCore33JSHTMLTableCellElementConstructor9classInfoEv
-__ZNK7WebCore34JSWebKitTransitionEventConstructor9classInfoEv
-__ZNK7WebCore22JSSVGLengthConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLFormElementConstructor9classInfoEv
-__ZNK7WebCore31JSSVGGradientElementConstructor9classInfoEv
-__ZNK7WebCore20JSUIEventConstructor9classInfoEv
-__ZNK7WebCore36JSCSSVariablesDeclarationConstructor9classInfoEv
-__ZNK7WebCore30JSHTMLScriptElementConstructor9classInfoEv
-__ZNK7WebCore26JSHTMLLIElementConstructor9classInfoEv
-__ZNK7WebCore27JSHTMLModElementConstructor9classInfoEv
-__ZNK7WebCore8JSScreen9classInfoEv
-__ZNK7WebCore17JSScreenPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLAreaElementConstructor9classInfoEv
-__ZNK7WebCore26JSMutationEventConstructor9classInfoEv
-__ZNK7WebCore30JSHTMLCanvasElementConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLVideoElementConstructor9classInfoEv
-__ZNK7WebCore27JSXPathEvaluatorConstructor9classInfoEv
-__ZNK7WebCore34JSHTMLBlockquoteElementConstructor9classInfoEv
-__ZNK7WebCore23JSWheelEventConstructor9classInfoEv
-__ZNK7WebCore23JSNodeFilterConstructor9classInfoEv
-__ZNK7WebCore19JSPluginConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLMediaElementConstructor9classInfoEv
-__ZNK7WebCore21JSDocumentConstructor9classInfoEv
-__ZNK7WebCore34JSWebKitCSSKeyframeRuleConstructor9classInfoEv
-__ZN7WebCore19jsDOMWindowOnselectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore9DOMWindow8onselectEv
-__ZNK7WebCore22JSMediaListConstructor9classInfoEv
-__ZNK7WebCore27JSStyleSheetListConstructor9classInfoEv
-__ZNK7WebCore25JSCSSMediaRuleConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLFrameElementConstructor9classInfoEv
-__ZNK7WebCore20JSCommentConstructor9classInfoEv
-__ZNK7WebCore30JSHTMLIFrameElementConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLDListElementConstructor9classInfoEv
-__ZNK7WebCore33JSHTMLDirectoryElementConstructor9classInfoEv
-__ZNK7WebCore24JSHTMLElementConstructor9classInfoEv
-__ZNK7WebCore25JSNamedNodeMapConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLBodyElementConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLFontElementConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLTableElementConstructor9classInfoEv
-__ZNK7WebCore29JSSVGMarkerElementConstructor9classInfoEv
-__ZNK7WebCore35JSWebKitCSSKeyframesRuleConstructor9classInfoEv
-__ZNK7WebCore29JSDocumentFragmentConstructor9classInfoEv
-__ZNK7WebCore24JSCSSPageRuleConstructor9classInfoEv
-__ZNK7WebCore32JSHTMLBaseFontElementConstructor9classInfoEv
-__ZNK7WebCore32JSHTMLOptGroupElementConstructor9classInfoEv
-__ZNK7WebCore32JSHTMLTableRowElementConstructor9classInfoEv
-__ZNK7WebCore25JSSVGTransformConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLLabelElementConstructor9classInfoEv
-__ZNK7WebCore27JSHTMLPreElementConstructor9classInfoEv
-__ZNK7WebCore28JSEntityReferenceConstructor9classInfoEv
-__ZNK7WebCore22JSDOMParserConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLInputElementConstructor9classInfoEv
-__ZNK7WebCore33JSWebKitAnimationEventConstructor9classInfoEv
-__ZNK7WebCore21JSSVGPaintConstructor9classInfoEv
-__ZNK7WebCore26JSProgressEventConstructor9classInfoEv
-__ZNK7WebCore17JSRectConstructor9classInfoEv
-__ZNK7WebCore21JSDOMApplicationCache9classInfoEv
-__ZNK7WebCore30JSDOMApplicationCachePrototype9classInfoEv
-__ZNK7WebCore26JSXSLTProcessorConstructor9classInfoEv
-__ZNK7WebCore19JSOptionConstructor9classInfoEv
-__ZNK7WebCore18JSImageConstructor9classInfoEv
-__ZNK7WebCore19JSWorkerConstructor9classInfoEv
-__ZNK7WebCore28JSWebKitCSSMatrixConstructor9classInfoEv
-__ZNK7WebCore27JSXMLHttpRequestConstructor9classInfoEv
-__ZNK7WebCore18JSAudioConstructor9classInfoEv
-__ZN7WebCore6Editor14markBadGrammarERKNS_9SelectionE
-__ZN7WebCoreL26findFirstBadGrammarInRangeEPNS_12EditorClientEPNS_5RangeERNS_13GrammarDetailERib
-__ZN7WebCore6setEndEPNS_5RangeERKNS_15VisiblePositionE
-__ZN3WTF6VectorIN7WebCore13GrammarDetailELm0EE6shrinkEm
-__ZN7WebCore38jsRangePrototypeFunctionDeleteContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore5Range14deleteContentsERi
-__ZN7WebCoreL6detachEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController12detachWindowEv
-__ZN7WebCoreL18moveByUnrestrictedEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZNK7WebCore19InspectorController12moveWindowByEff
-__ZN7WebCore26JSQuarantinedObjectWrapper16getConstructDataERN3JSC13ConstructDataE
-__ZNK7WebCore24JSInspectedObjectWrapper15allowsConstructEv
-__ZN7WebCore26JSQuarantinedObjectWrapper9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
-__ZN7WebCore26JSQuarantinedObjectWrapper14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
-__ZNK7WebCore24JSInspectedObjectWrapper20allowsDeletePropertyEv
-__ZNK7WebCore27CSSComputedStyleDeclaration6lengthEv
-__ZNK7WebCore27CSSComputedStyleDeclaration4itemEj
-__ZNK7WebCore27CSSComputedStyleDeclaration20getPropertyShorthandEi
-__ZNK7WebCore27CSSComputedStyleDeclaration19getPropertyPriorityEi
-__ZN7WebCoreL13getDelayValueEPKNS_13AnimationListE
-__ZNK7WebCore27CSSComputedStyleDeclaration18isPropertyImplicitEi
-__ZN7WebCoreL16getDurationValueEPKNS_13AnimationListE
-__ZN7WebCoreL22getTimingFunctionValueEPKNS_13AnimationListE
-__ZNK7WebCore22CSSTimingFunctionValue7cssTextEv
-__ZN7WebCoreL26getBorderRadiusCornerValueENS_7IntSizeE
-__ZN7WebCoreL22valueForNinePieceImageERKNS_14NinePieceImageE
-__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEC2ERKS3_
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_15DashboardRegionEEE
-__ZNK7WebCore27CSSComputedStyleDeclaration22getSVGPropertyCSSValueEiNS_13EUpdateLayoutE
-__ZNK7WebCore8SVGPaint7cssTextEv
-__ZNK7WebCore8SVGColor7cssTextEv
-__ZN7WebCoreL35glyphOrientationToCSSPrimitiveValueENS_17EGlyphOrientationE
-__ZN7WebCore12RenderInline22positionForCoordinatesEii
-__ZN7WebCore40lastEditablePositionBeforePositionInRootERKNS_8PositionEPNS_4NodeE
-__ZNK7WebCore26JSQuarantinedObjectWrapper9classNameEv
-__ZNK7WebCore25JSHTMLCollectionPrototype9classInfoEv
-__ZN7WebCore14JSNamedNodeMap16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore16JSHTMLCollection16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore25jsHTMLHeadingElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore18HTMLHeadingElement5alignEv
-__ZN7WebCore15jsTextWholeTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore4Text9wholeTextEv
-__ZN7WebCoreL33earliestLogicallyAdjacentTextNodeEPKNS_4TextE
-__ZN7WebCoreL31latestLogicallyAdjacentTextNodeEPKNS_4TextE
-__ZN7WebCore21JSCSSStyleDeclaration16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCoreL9unloadingEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController18resetScriptObjectsEv
-__ZN7WebCore9CSSParser11parseCanvasERN3WTF6RefPtrINS_8CSSValueEEE
-__ZN7WebCore9CSSParser19createKeyframesRuleEv
-__ZN7WebCore22WebKitCSSKeyframesRuleC1EPNS_13CSSStyleSheetE
-__ZN7WebCore9CSSParser18createKeyframeRuleEPNS_18CSSParserValueListE
-__ZN7WebCore21WebKitCSSKeyframeRuleC1EPNS_13CSSStyleSheetE
-__ZN7WebCore21WebKitCSSKeyframeRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
-__ZN7WebCore22WebKitCSSKeyframesRule6appendEPNS_21WebKitCSSKeyframeRuleE
-__ZN7WebCore9CSSParser23parseAnimationShorthandEb
-__ZN7WebCore9CSSParser18parseAnimationNameEv
-__ZN7WebCore9CSSParser19parseAnimationDelayEv
-__ZN7WebCore22WebKitCSSKeyframesRule15isKeyframesRuleEv
-__ZN7WebCore16CSSStyleSelector16addKeyframeStyleEN3WTF10PassRefPtrINS_22WebKitCSSKeyframesRuleEEE
-__ZNK7WebCore22WebKitCSSKeyframesRule4nameEv
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3addERKS3_RKS6_
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E5clearEv
-__ZN7WebCoreL24addResourceSourceToFrameEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZNK7WebCore17InspectorResource12sourceStringEv
-__ZN7WebCoreL16addSourceToFrameERKNS_6StringES2_PNS_4NodeE
-__ZN7WebCore11FrameLoader19setResponseMIMETypeERKNS_6StringE
-__ZN7WebCore11FrameLoader5beginEv
-__ZN7WebCore22HTMLViewSourceDocumentC1EPNS_5FrameERKNS_6StringE
-__ZN7WebCore22HTMLViewSourceDocument15createTokenizerEv
-__ZN7WebCore13HTMLTokenizerC2EPNS_22HTMLViewSourceDocumentE
-__ZN7WebCore22HTMLViewSourceDocument25addViewSourceDoctypeTokenEPNS_12DoctypeTokenE
-__ZN7WebCore22HTMLViewSourceDocument21createContainingTableEv
-__ZN7WebCore9CSSParser12parseCounterEiib
-__ZN7WebCore9CSSParser19parseCounterContentEPNS_18CSSParserValueListEb
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_7CounterEEE
-__ZN7WebCoreL16applyCounterListEPNS_11RenderStyleEPNS_12CSSValueListEb
-__ZN7WebCore11RenderStyle23accessCounterDirectivesEv
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS2_17CounterDirectivesEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSD_IS6_EEEESE_E6expandEv
-__ZN7WebCore22HTMLViewSourceDocument20addSpanWithClassNameERKNS_6StringE
-__ZN7WebCore22HTMLViewSourceDocument7addLineERKNS_6StringE
-__ZN7WebCore11RenderStyle10setContentEPNS_14CounterContentEb
-__ZN7WebCore13RenderCounterC2EPNS_8DocumentERKNS_14CounterContentE
-__ZN7WebCore22HTMLViewSourceDocument7addTextERKNS_6StringES3_
-__ZNK7WebCore6String5splitEtbRN3WTF6VectorIS0_Lm0EEE
-__ZN7WebCore22HTMLViewSourceDocument18addViewSourceTokenEPNS_5TokenE
-__ZN7WebCore22HTMLViewSourceDocument7addLinkERKNS_6StringEb
-__ZN7WebCore13RenderCounter14calcPrefWidthsEi
-__ZNK7WebCore13RenderCounter12originalTextEv
-__ZN7WebCoreL7counterEPNS_12RenderObjectERKNS_12AtomicStringEb
-__ZNK7WebCore11RenderStyle17counterDirectivesEv
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3addEPS3_RKS5_
-__ZN7WebCore11CounterNodeC2EPNS_12RenderObjectEbi
-__ZN7WebCoreL11counterMapsEv
-__ZNK3WTF7HashMapIPKN7WebCore12RenderObjectEPNS0_INS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSC_IS9_EEEENSA_IS4_EENSC_IS4_EENSC_ISG_EEE3getERKS4_
-__ZN3WTF9HashTableIPKN7WebCore12RenderObjectESt4pairIS4_PNS_7HashMapINS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_7PtrHashIS9_EENS_10HashTraitsIS9_EENSE_ISB_EEEEENS_18PairFirstExtractorISJ_EENSC_IS4_EENS_14PairHashTraitsINSE_IS4_EENSE_ISI_EEEESO_E6expandEv
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEEPNS2_11CounterNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getEPS3_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_PNS2_11CounterNodeEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCore11CounterNode11insertAfterEPS0_S1_
-__ZNK7WebCore11CounterNode20computeCountInParentEv
-__ZN3WTF9HashTableIPKN7WebCore12RenderObjectESt4pairIS4_PNS_7HashMapINS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_7PtrHashIS9_EENS_10HashTraitsIS9_EENSE_ISB_EEEEENS_18PairFirstExtractorISJ_EENSC_IS4_EENS_14PairHashTraitsINSE_IS4_EENSE_ISI_EEEESO_E4findIS4_NS_22IdentityHashTranslatorIS4_SJ_SM_EEEENS_17HashTableIteratorIS4_SJ_SL_SM_SQ_SO_EERKT_
-__ZN7WebCore13RenderCounter14dirtyLineBoxesEbb
-__ZN3WTFeqINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEEEbRKNS_7HashMapIT_T0_T1_T2_T3_EESJ_
-__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS2_17CounterDirectivesEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSD_IS6_EEEESE_E4findIS4_NS_22IdentityHashTranslatorIS4_S7_SB_EEEENS_22HashTableConstIteratorIS4_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCoreeqERKNS_17CounterDirectivesES2_
-__ZN7WebCore14CSSCanvasValueD1Ev
-__ZN7WebCore22WebKitCSSKeyframesRuleD1Ev
-__ZN7WebCore21WebKitCSSKeyframeRuleD1Ev
-__ZNK7WebCore14CachedResource11isPurgeableEv
-__ZN7WebCore19createTextTokenizerEPNS_22HTMLViewSourceDocumentE
-__ZN7WebCore13TextTokenizerC2EPNS_22HTMLViewSourceDocumentE
-__ZN7WebCore22HTMLViewSourceDocument17addViewSourceTextERKNS_6StringE
-__ZN7WebCore15EventTargetNode26willMoveToNewOwnerDocumentEv
-__ZN7WebCore21updateDOMNodeDocumentEPNS_4NodeEPNS_8DocumentES3_
-__ZN7WebCore15EventTargetNode25didMoveToNewOwnerDocumentEv
-__ZN3WTF9HashTableIPKN7WebCore14RenderReplacedESt4pairIS4_NS1_7IntRectEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSD_IS6_EEEESE_E6expandEv
-__ZN3WTF7HashMapIPKN7WebCore14RenderReplacedENS1_7IntRectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3setERKS4_RKS5_
-__ZN3WTF9HashTableIPKN7WebCore14RenderReplacedESt4pairIS4_NS1_7IntRectEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EENSD_IS6_EEEESE_E4findIS4_NS_22IdentityHashTranslatorIS4_S7_SB_EEEENS_17HashTableIteratorIS4_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCore12RenderObject22positionForCoordinatesEii
-__ZN7WebCoreL14enableDebuggerEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController14enableDebuggerEv
-__ZN7WebCore21JavaScriptDebugServer11addListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
-__ZN3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEEENS_18PairFirstExtractorISE_EENS8_IS3_EENS_14PairHashTraitsINSA_IS3_EENSA_ISD_EEEESJ_E6expandEv
-__ZN3WTF7HashSetIPN7WebCore23JavaScriptDebugListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore23JavaScriptDebugListenerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore21JavaScriptDebugServer14didAddListenerEPNS_4PageE
-__ZN7WebCore21JavaScriptDebugServer27recompileAllJSFunctionsSoonEv
-__ZN7WebCore4Page11setDebuggerEPN3JSC8DebuggerE
-__ZN7WebCore21JavaScriptDebugServer16clearBreakpointsEv
-__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEEKNS_7HashMapIlS7_NS2_ImEENS4_IlEENS4_IS7_EEEEEEvRT0_
-__ZN3WTF9HashTableIlSt4pairIlPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEEENS_18PairFirstExtractorIS9_EENS3_ImEENS_14PairHashTraitsINS5_IlEENS5_IS8_EEEESE_E6expandEv
-__ZN7WebCore5TimerINS_21JavaScriptDebugServerEE5firedEv
-__ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
-__ZNK3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEdeEv
-__ZN3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEppEv
-__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE15reserveCapacityEm
-__ZNK7WebCore25JSXMLHttpRequestPrototype9classInfoEv
-__ZNK7WebCore22JSPluginArrayPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLTitleElementPrototype9classInfoEv
-__ZNK7WebCore24JSHTMLBRElementPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLObjectElementPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLParamElementPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLEmbedElementPrototype9classInfoEv
-__ZNK7WebCore26JSHTMLFormElementPrototype9classInfoEv
-__ZNK7WebCore24JSMimeTypeArrayPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLInputElementPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLSelectElementPrototype9classInfoEv
-__ZNK7WebCore30JSHTMLTextAreaElementPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLLabelElementPrototype9classInfoEv
-__ZNK7WebCore22JSXPathResultPrototype9classInfoEv
-__ZNK7WebCore24JSHTMLLIElementPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLUListElementPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLOListElementPrototype9classInfoEv
-__ZNK7WebCore31JSHTMLTableCellElementPrototype9classInfoEv
-__ZNK7WebCore30JSHTMLTableRowElementPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLTableElementPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLOptionElementPrototype9classInfoEv
-__ZNK7WebCore25JSCanvasGradientPrototype9classInfoEv
-__ZNK7WebCore35JSCanvasRenderingContext2DPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLCanvasElementPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLButtonElementPrototype9classInfoEv
-__ZNK7WebCore16JSRangePrototype9classInfoEv
-__ZNK7WebCore23JSDOMSelectionPrototype9classInfoEv
-__ZNK7WebCore27JSDocumentFragmentPrototype9classInfoEv
-__ZNK7WebCore24JSXSLTProcessorPrototype9classInfoEv
-__ZNK7WebCore15JSRectPrototype9classInfoEv
-__ZNK7WebCore24JSProgressEventPrototype9classInfoEv
-__ZNK7WebCore19JSSVGPaintPrototype9classInfoEv
-__ZNK7WebCore31JSWebKitAnimationEventPrototype9classInfoEv
-__ZNK7WebCore20JSDOMParserPrototype9classInfoEv
-__ZNK7WebCore26JSEntityReferencePrototype9classInfoEv
-__ZNK7WebCore25JSHTMLPreElementPrototype9classInfoEv
-__ZNK7WebCore23JSSVGTransformPrototype9classInfoEv
-__ZNK7WebCore30JSHTMLOptGroupElementPrototype9classInfoEv
-__ZNK7WebCore30JSHTMLBaseFontElementPrototype9classInfoEv
-__ZNK7WebCore22JSCSSPageRulePrototype9classInfoEv
-__ZNK7WebCore33JSWebKitCSSKeyframesRulePrototype9classInfoEv
-__ZNK7WebCore27JSSVGMarkerElementPrototype9classInfoEv
-__ZNK7WebCore26JSHTMLFontElementPrototype9classInfoEv
-__ZNK7WebCore31JSHTMLDirectoryElementPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLDListElementPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLFrameElementPrototype9classInfoEv
-__ZNK7WebCore23JSCSSMediaRulePrototype9classInfoEv
-__ZNK7WebCore25JSStyleSheetListPrototype9classInfoEv
-__ZNK7WebCore20JSMediaListPrototype9classInfoEv
-__ZNK7WebCore32JSWebKitCSSKeyframeRulePrototype9classInfoEv
-__ZNK7WebCore21JSNodeFilterPrototype9classInfoEv
-__ZNK7WebCore21JSWheelEventPrototype9classInfoEv
-__ZNK7WebCore32JSHTMLBlockquoteElementPrototype9classInfoEv
-__ZNK7WebCore25JSXPathEvaluatorPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLVideoElementPrototype9classInfoEv
-__ZNK7WebCore26JSHTMLAreaElementPrototype9classInfoEv
-__ZNK7WebCore25JSHTMLModElementPrototype9classInfoEv
-__ZNK7WebCore34JSCSSVariablesDeclarationPrototype9classInfoEv
-__ZNK7WebCore29JSSVGGradientElementPrototype9classInfoEv
-__ZNK7WebCore20JSSVGLengthPrototype9classInfoEv
-__ZNK7WebCore32JSWebKitTransitionEventPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLLegendElementPrototype9classInfoEv
-__ZNK7WebCore28JSDOMImplementationPrototype9classInfoEv
-__ZNK7WebCore34JSWebKitCSSTransformValuePrototype9classInfoEv
-__ZNK7WebCore26JSHTMLBaseElementPrototype9classInfoEv
-__ZNK7WebCore19JSSVGColorPrototype9classInfoEv
-__ZNK7WebCore30JSHTMLFrameSetElementPrototype9classInfoEv
-__ZNK7WebCore25JSEventExceptionPrototype9classInfoEv
-__ZNK7WebCore24JSOverflowEventPrototype9classInfoEv
-__ZNK7WebCore24JSDOMStringListPrototype9classInfoEv
-__ZNK7WebCore28JSCSSPrimitiveValuePrototype9classInfoEv
-__ZNK7WebCore23JSSVGExceptionPrototype9classInfoEv
-__ZNK7WebCore24JSXMLSerializerPrototype9classInfoEv
-__ZNK7WebCore27JSDOMCoreExceptionPrototype9classInfoEv
-__ZNK7WebCore19JSSVGAnglePrototype9classInfoEv
-__ZNK7WebCore32JSProcessingInstructionPrototype9classInfoEv
-__ZNK7WebCore23JSCDATASectionPrototype9classInfoEv
-__ZNK7WebCore24JSKeyboardEventPrototype9classInfoEv
-__ZNK7WebCore23JSSVGUnitTypesPrototype9classInfoEv
-__ZNK7WebCore30JSHTMLFieldSetElementPrototype9classInfoEv
-__ZNK7WebCore21JSSVGPathSegPrototype9classInfoEv
-__ZNK7WebCore25JSRangeExceptionPrototype9classInfoEv
-__ZNK7WebCore26JSCSSFontFaceRulePrototype9classInfoEv
-__ZNK7WebCore27JSHTMLAudioElementPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLMediaElementPrototype9classInfoEv
-__ZNK7WebCore22JSTextMetricsPrototype9classInfoEv
-__ZNK7WebCore24JSCSSImportRulePrototype9classInfoEv
-__ZNK7WebCore25JSXPathExceptionPrototype9classInfoEv
-__ZNK7WebCore34JSHTMLTableSectionElementPrototype9classInfoEv
-__ZNK7WebCore34JSXMLHttpRequestExceptionPrototype9classInfoEv
-__ZNK7WebCore26JSHTMLMenuElementPrototype9classInfoEv
-__ZNK7WebCore21JSMediaErrorPrototype9classInfoEv
-__ZNK7WebCore23JSMessageEventPrototype9classInfoEv
-__ZNK7WebCore29JSHTMLMarqueeElementPrototype9classInfoEv
-__ZNK7WebCore27JSCSSVariablesRulePrototype9classInfoEv
-__ZNK7WebCore19JSNotationPrototype9classInfoEv
-__ZNK7WebCore19JSFileListPrototype9classInfoEv
-__ZNK7WebCore25JSCSSCharsetRulePrototype9classInfoEv
-__ZNK7WebCore29JSHTMLIsIndexElementPrototype9classInfoEv
-__ZNK7WebCore15JSFilePrototype9classInfoEv
-__ZNK7WebCore31JSXMLHttpRequestUploadPrototype9classInfoEv
-__ZNK7WebCore23JSCSSValueListPrototype9classInfoEv
-__ZNK7WebCore29JSSVGRenderingIntentPrototype9classInfoEv
-__ZNK7WebCore34JSHTMLTableCaptionElementPrototype9classInfoEv
-__ZNK7WebCore23JSStorageEventPrototype9classInfoEv
-__ZNK7WebCore19JSCSSValuePrototype9classInfoEv
-__ZNK7WebCore27JSHTMLQuoteElementPrototype9classInfoEv
-__ZNK7WebCore17JSEntityPrototype9classInfoEv
-__ZNK7WebCore33JSSVGPreserveAspectRatioPrototype9classInfoEv
-__ZNK7WebCore30JSHTMLTableColElementPrototype9classInfoEv
-__ZNK7WebCore20JSTextEventPrototype9classInfoEv
-__ZNK7WebCore20JSClipboardPrototype9classInfoEv
-__ZNK7WebCore19JSMimeTypePrototype9classInfoEv
-__ZNK7WebCore29JSSVGTextPathElementPrototype9classInfoEv
-__ZNK7WebCore32JSSVGTextContentElementPrototype9classInfoEv
-__ZNK7WebCore21JSSVGElementPrototype9classInfoEv
-__ZNK7WebCore24JSHTMLHRElementPrototype9classInfoEv
-__ZNK7WebCore18JSCounterPrototype9classInfoEv
-__ZNK7WebCore25JSHTMLMapElementPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLAppletElementPrototype9classInfoEv
-__ZN3WTF7HashMapINS_6RefPtrIN3JSC16FunctionBodyNodeEEES4_NS_7PtrHashIS4_EENS_10HashTraitsIS4_EES8_E3addEPS3_RKS4_
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC16FunctionBodyNodeEEESt4pairIS4_S4_ENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EESD_EESD_E6expandEv
-__ZN3JSC6Parser5parseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPiPNS_7UStringE
-__ZN3WTF7HashMapIPN3JSC14SourceProviderEPNS1_9ExecStateENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
-__ZN3WTF9HashTableIPN3JSC14SourceProviderESt4pairIS3_PNS1_9ExecStateEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6expandEv
-__ZN3WTF9HashTableINS_6RefPtrIN3JSC16FunctionBodyNodeEEESt4pairIS4_S4_ENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10HashTraitsIS4_EESD_EESD_E4findIS4_NS_22IdentityHashTranslatorIS4_S6_SA_EEEENS_17HashTableIteratorIS4_S6_S8_SA_SE_SD_EERKT_
-__ZN3WTF9HashTableIPN3JSC14SourceProviderESt4pairIS3_PNS1_9ExecStateEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SB_EEEENS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EERKT_
-__ZN7WebCore21JavaScriptDebugServer12sourceParsedEPN3JSC9ExecStateERKNS1_10SourceCodeEiRKNS1_7UStringE
-__ZN7WebCoreL6toPageEPN3JSC14JSGlobalObjectE
-__ZN3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EENS9_IS3_EENS9_ISC_EEE3addERKS3_RKSC_
-__ZN7WebCoreL22dispatchDidParseSourceERKN3WTF7HashSetIPNS_23JavaScriptDebugListenerENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEEPN3JSC9ExecStateERKNSB_10SourceCodeE
-__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE6resizeEm
-__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE15reserveCapacityEm
-__ZN7WebCore19InspectorController14didParseSourceEPN3JSC9ExecStateERKNS1_10SourceCodeE
-__ZN7WebCoreL11jsStringRefERKN3JSC7UStringE
-__ZN7WebCoreL16addSourceToFrameEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCoreL8toStringEPK15OpaqueJSContextPK13OpaqueJSValuePS5_
-__ZN7WebCore32jsConsolePrototypeFunctionAssertEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Console15assertConditionEbPNS_15ScriptCallStackE
-__ZN7WebCore24jsHTMLOptionElementIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLOptionElement5indexEv
-__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE6shrinkEm
-__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE6shrinkEm
-__ZN7WebCore21JavaScriptDebugServer9callEventERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCore19JavaScriptCallFrameC1ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
-__ZN7WebCore21JavaScriptDebugServer13pauseIfNeededEPNS_4PageE
-__ZNK7WebCore21JavaScriptDebugServer13hasBreakpointElj
-__ZN3WTF7HashMapIlPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEENS2_ImEENS4_IlEENS4_IS7_EEE3setERKlRKS7_
-__ZN7WebCore21JavaScriptDebugServer11atStatementERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCore21JavaScriptDebugServer11returnEventERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCore19JavaScriptCallFrame6callerEv
-__ZN3WTF10RefCountedIN7WebCore19JavaScriptCallFrameEE5derefEv
-__ZN7WebCore21JavaScriptDebugServer18willExecuteProgramERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCore21JavaScriptDebugServer17didExecuteProgramERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCoreL15pauseInDebuggerEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController15pauseInDebuggerEv
-__ZN7WebCore21JavaScriptDebugServer12pauseProgramEv
-__ZN7WebCore21JavaScriptDebugServer27dispatchFunctionToListenersEMNS_23JavaScriptDebugListenerEFvvEPNS_4PageE
-__ZN7WebCoreL27dispatchFunctionToListenersERKN3WTF7HashSetIPNS_23JavaScriptDebugListenerENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEEMS2_FvvE
-__ZN7WebCore19InspectorController8didPauseEv
-__ZN7WebCoreL16currentCallFrameEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZNK7WebCore19InspectorController16currentCallFrameEv
-__ZN7WebCore21JavaScriptDebugServer16currentCallFrameEv
-__ZNK7WebCore19JavaScriptCallFrame10scopeChainEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JavaScriptCallFrameE
-__ZN7WebCore21JSJavaScriptCallFrame15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSJavaScriptCallFrameC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JavaScriptCallFrameEEE
-__ZNK7WebCore21JSJavaScriptCallFrame9classInfoEv
-__ZNK7WebCore30JSJavaScriptCallFramePrototype9classInfoEv
-__ZN7WebCore21JSJavaScriptCallFrame18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25jsJavaScriptCallFrameTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21JSJavaScriptCallFrame4typeEPN3JSC9ExecStateE
-__ZNK7WebCore19JavaScriptCallFrame4typeEv
-__ZN7WebCore33jsJavaScriptCallFrameFunctionNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19JavaScriptCallFrame12functionNameEv
-__ZN7WebCore29jsJavaScriptCallFrameSourceIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsJavaScriptCallFrameLineEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsJavaScriptCallFrameCallerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30JSJavaScriptCallFramePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31jsJavaScriptCallFrameScopeChainEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21JSJavaScriptCallFrame10scopeChainEPN3JSC9ExecStateE
-__ZN7WebCore31jsJavaScriptCallFrameThisObjectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21JSJavaScriptCallFrame10thisObjectEPN3JSC9ExecStateE
-__ZNK7WebCore19JavaScriptCallFrame10thisObjectEv
-__ZN7WebCore13RenderCounter19destroyCounterNodesEPNS_12RenderObjectE
-__ZN7WebCore11CounterNode11removeChildEPS0_
-__ZN7WebCore11CounterNode7recountEv
-__ZNK7WebCore12RenderObject9isCounterEv
-__ZN7WebCore46jsDocumentPrototypeFunctionGetCSSCanvasContextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document19getCSSCanvasContextERKNS_6StringES3_ii
-__ZN7WebCore8Document19getCSSCanvasElementERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_17HTMLCanvasElementEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_17HTMLCanvasElementEEEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E5clearEv
-__ZN7WebCore21JavaScriptDebugServer19setJavaScriptPausedERKNS_9PageGroupEb
-__ZN7WebCore21JavaScriptDebugServer19setJavaScriptPausedEPNS_4PageEb
-__ZN7WebCore21JavaScriptDebugServer19setJavaScriptPausedEPNS_5FrameEb
-__ZN7WebCore9TimerBase27fireTimersInNestedEventLoopEv
-__ZN7WebCore9EventLoop5cycleEv
-__ZNK7WebCore14CSSCanvasValue11isFixedSizeEv
-__ZN7WebCore14CSSCanvasValue9fixedSizeEPKNS_12RenderObjectE
-__ZN7WebCore14CSSCanvasValue7elementEPNS_8DocumentE
-__ZN7WebCore14CSSCanvasValue5imageEPNS_12RenderObjectERKNS_7IntSizeE
-__ZN7WebCoreL14resumeDebuggerEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController14resumeDebuggerEv
-__ZN7WebCore21JavaScriptDebugServer15continueProgramEv
-__ZN7WebCore19InspectorController20removeScriptResourceEPNS_17InspectorResourceE
-__ZN7WebCore21JavaScriptDebugServer9exceptionERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCore26JSInspectorCallbackWrapperD0Ev
-__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore26JSInspectorCallbackWrapperEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SC_EEEENS_17HashTableIteratorIS3_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore19InspectorController27updateScriptResourceRequestEPNS_17InspectorResourceE
-__ZN7WebCore9PopupMenu17updateFromElementEv
-__ZN7WebCoreL8profilesEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCoreL14enableProfilerEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController14enableProfilerEb
-__ZNK7WebCore32JSHTMLOptionsCollectionPrototype9classInfoEv
-__ZN7WebCoreL14startProfilingEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController31startUserInitiatedProfilingSoonEv
-__ZN7WebCore5TimerINS_19InspectorControllerEE5firedEv
-__ZN7WebCore19InspectorController27startUserInitiatedProfilingEPNS_5TimerIS0_EE
-__ZN7WebCoreL15disableProfilerEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController15disableProfilerEv
-__ZNK7WebCore23JSHTMLOptionsCollection9classInfoEv
-__ZN7WebCore34jsHTMLObjectElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore5XPathL13createFunNameEv
-__ZN7WebCore5XPath12LocationPath15insertFirstStepEPNS0_4StepE
-__ZNK7WebCore5XPath7FunName8evaluateEv
-__ZNK7WebCore4Attr15isAttributeNodeEv
+__ZN7WebCore21SVGTextContentElementD2Ev
+__ZN7WebCore11SVGDocumentD0Ev
+__ZN7WebCore21SVGDocumentExtensionsD1Ev
+__ZN7WebCore21SVGDocumentExtensionsD2Ev
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEEKNS_7HashMapIN
+__ZN7WebCore22JSSVGDocumentPrototypeD1Ev
 __ZN7WebCore5XPath6Parser16registerNodeTestEPNS0_4Step8NodeTestE
 __ZN3WTF7HashSetIPN7WebCore5XPath4Step8NodeTestENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEE3addERKS5_
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E6exp
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E6reh
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E13al
 __ZN7WebCore5XPath6Parser14deleteNodeTestEPNS0_4Step8NodeTestE
-__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E4findIS5_NS_22IdentityHashTranslatorIS5_S5_S9_EEEENS_17HashTableIteratorIS5_S5_S7_S9_SB_SB_EERKT_
-__ZNK7WebCore5XPath5Union8evaluateEv
-__ZN7WebCore14jsPluginLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Plugin6lengthEv
-__ZN7WebCore8JSPlugin18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZN7WebCore8JSPlugin11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore6Plugin4itemEj
-__ZN7WebCore21jsMimeTypeDescriptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8MimeType11descriptionEv
-__ZN7WebCore12DocumentType19removedFromDocumentEv
-__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE6shrinkEm
-__ZN7WebCore4Page22allVisitedStateChangedEPNS_9PageGroupE
-__ZN7WebCore16CSSStyleSelector15SelectorChecker22allVisitedStateChangedEv
-__ZN7WebCore12IconDatabase14removeAllIconsEv
-__ZN7WebCore12IconDatabase22removeAllIconsOnThreadEv
-__ZN7WebCore12IconDatabase27deleteAllPreparedStatementsEv
-sqlite3DropTable
-sqlite3BtreeDropTable
-clearDatabasePage
-__ZN7WebCore14SQLiteDatabase16runVacuumCommandEv
-sqlite3RunVacuum
-execSql
-codeAttach
-attachFunc
-sqlite3UnixTempFileName
-execExecSql
-sqlite3VtabOverloadFunction
-likeFunc
-patternCompare
-sqlite3PagerTruncate
-unixTruncate
-__ZN7WebCore9CSSParser18parseHSLParametersEPNS_14CSSParserValueEPdb
-__ZN7WebCore16makeRGBAFromHSLAEdddd
-__ZN7WebCore9CSSParser16parseFontFaceSrcEv
-__ZN7WebCore9CSSParser18createFontFaceRuleEv
-__ZN7WebCore15CSSFontFaceRuleC1EPNS_13CSSStyleSheetE
-__ZN7WebCore15CSSFontFaceRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
-__ZN7WebCore15CSSFontFaceRule14isFontFaceRuleEv
-__ZN7WebCore15CSSFontSelector15addFontFaceRuleEPKNS_15CSSFontFaceRuleE
-__ZNK7WebCore19CSSFontFaceSrcValue16isSVGFontFaceSrcEv
-__ZNK7WebCore19CSSFontFaceSrcValue17isSupportedFormatEv
-__ZN7WebCore9DocLoader11requestFontERKNS_6StringE
-__ZN7WebCore10CachedFontC1ERKNS_6StringE
-__ZN7WebCore10CachedFont4loadEPNS_9DocLoaderE
-__ZN7WebCore17CSSFontFaceSourceC2ERKNS_6StringEPNS_10CachedFontE
-__ZN7WebCore10CachedFont9addClientEPNS_20CachedResourceClientE
-__ZN7WebCore11CSSFontFace9addSourceEPNS_17CSSFontFaceSourceE
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE15reserveCapacityEm
-__ZNK7WebCore11CSSFontFace7isValidEv
-__ZNK7WebCore17CSSFontFaceSource7isValidEv
-__ZN3WTF7HashMapIN7WebCore6StringEPNS_6VectorINS_6RefPtrINS1_11CSSFontFaceEEELm0EEENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENSA_IS8_EEE3setERKS2_RKS8_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_6VectorINS_6RefPtrINS1_11CSSFontFaceEEELm0EEEENS_18PairFirstExtractorISA_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSF_IS9_EEEESG_E6expandEv
-__ZN7WebCore9FontCache17getTraitsInFamilyERKNS_12AtomicStringERN3WTF6VectorIjLm0EEE
-+[WebFontCache getTraits:inFamily:]
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE15reserveCapacityEm
-__ZN3WTF7HashMapIN7WebCore6StringEPNS0_IjNS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS8_IS5_EEEENS1_15CaseFoldingHashENS8_IS2_EENS8_ISC_EEE3setERKS2_RKSC_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashMapIjNS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENSA_IS7_EEEEENS_18PairFirstExtractorISF_EENS1_15CaseFoldingHashENS_14PairHashTraitsINSA_IS2_EENSA_ISE_EEEESK_E6expandEv
-__ZNK7WebCore15FontDescription10traitsMaskEv
-__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3setERKjRKS4_
-__ZN7WebCore20CSSSegmentedFontFaceC2EPNS_15CSSFontSelectorE
-__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSC_IS5_EEEESD_E6expandEv
-__ZNSt17_Temporary_bufferIPPN7WebCore11CSSFontFaceES2_EC1ES3_S3_
-__ZSt22__get_temporary_bufferIPN7WebCore11CSSFontFaceEESt4pairIPT_iEiS5_
-__ZSt22__stable_sort_adaptiveIPPN7WebCore11CSSFontFaceES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
-__ZSt24__merge_sort_with_bufferIPPN7WebCore11CSSFontFaceES3_PFbS2_S2_EEvT_S6_T0_T1_
-__ZSt22__chunk_insertion_sortIPPN7WebCore11CSSFontFaceEiPFbS2_S2_EEvT_S6_T0_T1_
-__ZSt16__insertion_sortIPPN7WebCore11CSSFontFaceEPFbS2_S2_EEvT_S6_T0_
-__ZSt16__merge_adaptiveIPPN7WebCore11CSSFontFaceEiS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
-__ZSt16__merge_backwardIPPN7WebCore11CSSFontFaceES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
-__ZSt23return_temporary_bufferIPN7WebCore11CSSFontFaceEEvPT_
-__ZN7WebCore20CSSSegmentedFontFace14appendFontFaceEN3WTF10PassRefPtrINS_11CSSFontFaceEEE
-__ZN7WebCore20CSSSegmentedFontFace10pruneTableEv
-__ZN7WebCore11CSSFontFace24addedToSegmentedFontFaceEPNS_20CSSSegmentedFontFaceE
-__ZN3WTF7HashSetIPN7WebCore20CSSSegmentedFontFaceENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN3WTF6VectorIPN7WebCore11CSSFontFaceELm32EE6shrinkEm
-__ZN7WebCore20CSSSegmentedFontFace11getFontDataERKNS_15FontDescriptionE
-__ZNK7WebCore20CSSSegmentedFontFace7isValidEv
-__ZN7WebCore11CSSFontFace11getFontDataERKNS_15FontDescriptionEbb
-__ZN7WebCore17CSSFontFaceSource11getFontDataERKNS_15FontDescriptionEbbPNS_15CSSFontSelectorE
-__ZN3WTF7HashMapIjPN7WebCore14SimpleFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
-__ZNK7WebCore17CSSFontFaceSource8isLoadedEv
-__ZNK7WebCore15CSSFontSelector9docLoaderEv
-__ZN7WebCore10CachedFont17beginLoadIfNeededEPNS_9DocLoaderE
-__ZN7WebCore9FontCache25getLastResortFallbackFontERKNS_15FontDescriptionE
-__ZN3WTF9HashTableIjSt4pairIjPN7WebCore14SimpleFontDataEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSB_IS4_EEEESC_E6expandEv
-__ZNK3WTF7HashMapIjPN7WebCore17SegmentedFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3getERKj
-__ZN3WTF9HashTableIjSt4pairIjPN7WebCore17SegmentedFontDataEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSB_IS4_EEEESC_E6expandEv
-__ZNK7WebCore17SegmentedFontData12isCustomFontEv
-__ZNK7WebCore17SegmentedFontData9isLoadingEv
-__ZNK7WebCore17SegmentedFontData11isSegmentedEv
-__ZNK7WebCore17SegmentedFontData20fontDataForCharacterEi
-__ZN7WebCore10helpCursorEv
-__ZN7WebCore45jsDocumentPrototypeFunctionCreateNodeIteratorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12toNodeFilterEN3JSC10JSValuePtrE
-__ZN7WebCore21JSNodeFilterConditionC1EN3JSC10JSValuePtrE
-__ZN7WebCore8Document18createNodeIteratorEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
-__ZN7WebCore12NodeIteratorC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
-__ZN7WebCore9TraversalC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
-__ZN7WebCore12NodeIterator11NodePointerC2EN3WTF10PassRefPtrINS_4NodeEEEb
-__ZN7WebCore12NodeIterator11NodePointerC2Ev
-__ZN7WebCore8Document18attachNodeIteratorEPNS_12NodeIteratorE
-__ZN3WTF7HashSetIPN7WebCore12NodeIteratorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12NodeIteratorE
-__ZN7WebCore14JSNodeIterator15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore14JSNodeIteratorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NodeIteratorEEE
-__ZN7WebCore14JSNodeIterator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSNodeIteratorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore39jsNodeIteratorPrototypeFunctionNextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore14JSNodeIterator9classInfoEv
-__ZN7WebCore14JSNodeIterator8nextNodeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore12NodeIterator8nextNodeEPN3JSC9ExecStateERi
-__ZN7WebCore12NodeIterator11NodePointer10moveToNextEPNS_4NodeE
-__ZNK7WebCore9Traversal10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
-__ZNK7WebCore10NodeFilter10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
-__ZNK7WebCore21JSNodeFilterCondition10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
-__ZN7WebCore12NodeIterator11NodePointer5clearEv
-__ZN7WebCore43jsNodeIteratorPrototypeFunctionPreviousNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14JSNodeIterator12previousNodeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore12NodeIterator12previousNodeEPN3JSC9ExecStateERi
-__ZN7WebCore12NodeIterator11NodePointer14moveToPreviousEPNS_4NodeE
-__ZN7WebCore43jsDocumentPrototypeFunctionCreateTreeWalkerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document16createTreeWalkerEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
-__ZN7WebCore10TreeWalkerC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10TreeWalkerE
-__ZN7WebCore12JSTreeWalker15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore12JSTreeWalkerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TreeWalkerEEE
-__ZN7WebCore12JSTreeWalker18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSTreeWalkerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore37jsTreeWalkerPrototypeFunctionNextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore12JSTreeWalker9classInfoEv
-__ZN7WebCore12JSTreeWalker8nextNodeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore10TreeWalker8nextNodeEPN3JSC9ExecStateE
-__ZN7WebCore41jsTreeWalkerPrototypeFunctionPreviousNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12JSTreeWalker12previousNodeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore10TreeWalker12previousNodeEPN3JSC9ExecStateE
-__ZN7WebCore39jsTreeWalkerPrototypeFunctionFirstChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12JSTreeWalker10firstChildEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore10TreeWalker10firstChildEPN3JSC9ExecStateE
-__ZN7WebCore38jsTreeWalkerPrototypeFunctionLastChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12JSTreeWalker9lastChildEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore10TreeWalker9lastChildEPN3JSC9ExecStateE
-__ZN7WebCore40jsTreeWalkerPrototypeFunctionNextSiblingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12JSTreeWalker11nextSiblingEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore10TreeWalker11nextSiblingEPN3JSC9ExecStateE
-__ZN7WebCore44jsTreeWalkerPrototypeFunctionPreviousSiblingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12JSTreeWalker15previousSiblingEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore10TreeWalker15previousSiblingEPN3JSC9ExecStateE
-__ZN7WebCore39jsTreeWalkerPrototypeFunctionParentNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12JSTreeWalker10parentNodeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore10TreeWalker10parentNodeEPN3JSC9ExecStateE
-__ZN7WebCore10CachedFont4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
-__ZN7WebCore10CachedFont11checkNotifyEv
-__ZN7WebCore17CSSFontFaceSource10fontLoadedEPNS_10CachedFontE
-__ZN7WebCore17CSSFontFaceSource10pruneTableEv
-__ZN7WebCore17GlyphPageTreeNode23pruneTreeCustomFontDataEPKNS_8FontDataE
-__ZN7WebCore17GlyphPageTreeNode19pruneCustomFontDataEPKNS_8FontDataE
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore14SimpleFontDataEKNS_7HashMapIjS3_NS_7IntHashIjEENS_10HashTraitsIjEENS7_IS3_EEEEEEvRT0_
-__ZN7WebCore11CSSFontFace10fontLoadedEPNS_17CSSFontFaceSourceE
-__ZN7WebCore20CSSSegmentedFontFace10fontLoadedEPNS_11CSSFontFaceE
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore17SegmentedFontDataEKNS_7HashMapIjS3_NS_7IntHashIjEENS_10HashTraitsIjEENS7_IS3_EEEEEEvRT0_
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE6shrinkEm
-__ZN7WebCore15CSSFontSelector10fontLoadedEv
-__ZN7WebCore10CachedFont20ensureCustomFontDataEv
-__ZN7WebCore28createFontCustomPlatformDataEPNS_12SharedBufferE
-__ZN7WebCore10CachedFont26platformDataFromCustomDataEfbbNS_17FontRenderingModeE
-__ZN7WebCore22FontCustomPlatformData16fontPlatformDataEibbNS_17FontRenderingModeE
-__ZN7WebCore12NodeIterator17nodeWillBeRemovedEPNS_4NodeE
-__ZNK7WebCore12NodeIterator20updateForNodeRemovalEPNS_4NodeERNS0_11NodePointerE
-__ZN7WebCore23jsTreeWalkerCurrentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore37jsRangePrototypeFunctionCloneContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore5Range13cloneContentsERi
-__ZN7WebCore40jsDocumentPrototypeFunctionCreateCommentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore50jsDOMImplementationPrototypeFunctionCreateDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14toDocumentTypeEN3JSC10JSValuePtrE
-__ZN7WebCore17DOMImplementation14createDocumentERKNS_6StringES3_PNS_12DocumentTypeERi
-__ZN7WebCore8Document13createElementERKNS_12AtomicStringERi
-__ZN7WebCore38jsRangePrototypeFunctionSetStartBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore35jsRangePrototypeFunctionSetEndAfterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore37jsRangePrototypeFunctionSetStartAfterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore36jsRangePrototypeFunctionSetEndBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore5Range12setEndBeforeEPNS_4NodeERi
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14RangeExceptionE
-__ZN7WebCore16JSRangeExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14RangeExceptionEEE
-__ZN7WebCore16JSRangeException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSRangeExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore38jsRangeExceptionBAD_BOUNDARYPOINTS_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore37jsRangeExceptionINVALID_NODE_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsRangeExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsRangePrototypeFunctionSelectNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore40jsRangePrototypeFunctionSurroundContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore5Range16surroundContentsEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZNK7WebCore4Node19isCharacterDataNodeEv
-__ZN7WebCore22jsDOMCoreExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13CharacterData19isCharacterDataNodeEv
-__ZNK7WebCore17HTMLObjectElement24imageSourceAttributeNameEv
-__ZN7WebCore42jsDocumentPrototypeFunctionCreateAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document17createAttributeNSERKNS_6StringES3_Rib
-__ZN7WebCore39jsDOMCoreExceptionHIERARCHY_REQUEST_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateDocumentTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore17DOMImplementation18createDocumentTypeERKNS_6StringES3_S3_Ri
-__ZN7WebCore31jsDOMCoreExceptionNAMESPACE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore36jsDOMCoreExceptionINVALID_ACCESS_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12NodeIteratorD1Ev
-__ZN7WebCore8Document18detachNodeIteratorEPNS_12NodeIteratorE
-__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore7UIEventC2Ev
-__ZNK7WebCore5Event14isSVGZoomEventEv
-__ZN7WebCore15getDOMStructureINS_9JSUIEventEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore37jsUIEventPrototypeFunctionInitUIEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9JSUIEvent9classInfoEv
-__ZN7WebCore40jsHTMLInputElementPrototypeFunctionClickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11HTMLElement5clickEv
-__ZN7WebCore23resetButtonDefaultLabelEv
-__ZN7WebCore39jsTextPrototypeFunctionReplaceWholeTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore4Text16replaceWholeTextERKNS_6StringERi
-__ZN7WebCore7Element14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore23JSHTMLBlockquoteElement9classInfoEv
-__ZN7WebCore9CSSParser24createFloatingMediaQueryEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
-__ZN7WebCoreL25min_colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL21colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCore23screenDepthPerComponentEPNS_6WidgetE
-__ZN7WebCoreL11numberValueEPNS_8CSSValueERf
-__ZN7WebCoreL25max_colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL30min_monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL26monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCore18screenIsMonochromeEPNS_6WidgetE
-__ZN7WebCoreL26min_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL22heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL26max_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL25max_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCore25jsHTMLTableElementCaptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement7captionEv
-__ZN7WebCore23jsHTMLTableElementTFootEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement5tFootEv
-__ZN7WebCore48jsHTMLTableElementPrototypeFunctionCreateCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16HTMLTableElement13createCaptionEv
-__ZN7WebCore16HTMLTableElement10setCaptionEN3WTF10PassRefPtrINS_23HTMLTableCaptionElementEEERi
-__ZN7WebCore16HTMLTableElement13deleteCaptionEv
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16HTMLTableElement11createTHeadEv
-__ZN7WebCore16HTMLTableElement8setTHeadEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
-__ZN7WebCore16HTMLTableElement11deleteTHeadEv
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16HTMLTableElement11createTFootEv
-__ZN7WebCore16HTMLTableElement8setTFootEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
-__ZN7WebCore16HTMLTableElement11deleteTFootEv
-__ZN7WebCore28setJSHTMLTableElementCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25toHTMLTableCaptionElementEN3JSC10JSValuePtrE
-__ZNK7WebCore25JSHTMLTableCaptionElement9classInfoEv
-__ZN7WebCore26setJSHTMLTableElementTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25toHTMLTableSectionElementEN3JSC10JSValuePtrE
-__ZN7WebCore26setJSHTMLTableElementTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore48jsHTMLTableElementPrototypeFunctionDeleteCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore29jsHTMLTableRowElementRowIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableRowElement8rowIndexEv
-__ZN7WebCore36jsHTMLTableRowElementSectionRowIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableRowElement15sectionRowIndexEv
-__ZN7WebCore9JSUIEventD0Ev
-__ZN7WebCore24submitButtonDefaultLabelEv
-__ZN7WebCore39jsHTMLSelectElementPrototypeFunctionAddEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13toHTMLElementEN3JSC10JSValuePtrE
-__ZN7WebCore37setJSHTMLOptionElementDefaultSelectedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore14setJSAttrValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore6JSAttr8setValueEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore18jsAttrOwnerElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore45jsElementPrototypeFunctionRemoveAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore6toAttrEN3JSC10JSValuePtrE
-__ZN7WebCore7Element19removeAttributeNodeEPNS_4AttrERi
-__ZN7WebCore29setJSHTMLMetaElementHttpEquivEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLMetaElement12setHttpEquivERKNS_6StringE
-__ZN7WebCore23jsHTMLObjectElementDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore48jsNamedNodeMapPrototypeFunctionRemoveNamedItemNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12NamedAttrMap17removeNamedItemNSERKNS_6StringES3_Ri
-__ZThn56_NK7WebCore17HTMLScriptElement20sourceAttributeValueEv
-__ZThn56_NK7WebCore17HTMLScriptElement13scriptContentEv
-__ZNK7WebCore17HTMLScriptElement13scriptContentEv
-__ZN7WebCoreL28processingInstructionHandlerEPvPKhS2_
-__ZN7WebCore12XMLTokenizer21processingInstructionEPKhS2_
-__ZN7WebCore8Document27createProcessingInstructionERKNS_6StringES3_Ri
-__ZN7WebCore21ProcessingInstructionC1EPNS_8DocumentERKNS_6StringES5_
-__ZN7WebCore21ProcessingInstruction20insertedIntoDocumentEv
-__ZN7WebCore21ProcessingInstruction15checkStyleSheetEv
-__ZN7WebCore15parseAttributesERKNS_6StringERb
-__ZN7WebCoreL31attributesStartElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
-__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EESA_EESA_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S7_EEEENS_22HashTableConstIteratorIS2_S4_S6_S7_SB_SA_EERKT_
-__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3addERKS2_S8_
-__ZN7WebCore21ProcessingInstruction21finishParsingChildrenEv
-__ZN7WebCoreL20font_faceConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGFontFaceElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore8Document18mappedElementSheetEv
-__ZN7WebCore18SVGFontFaceElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCoreL32cssPropertyIdForSVGAttributeNameERKNS_13QualifiedNameE
-__ZN7WebCoreL25mapAttributeToCSSPropertyEPN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiEEEERKNS_13QualifiedNameE
-__ZN7WebCore18SVGFontFaceElement20insertedIntoDocumentEv
-__ZN7WebCore18SVGFontFaceElement15rebuildFontFaceEv
-__ZN7WebCoreL24font_face_srcConstructorEPNS_8DocumentEb
-__ZN7WebCore21SVGFontFaceSrcElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore18SVGFontFaceElement15childrenChangedEbPNS_4NodeES2_i
-__ZNK7WebCore21SVGFontFaceSrcElement8srcValueEv
-__ZN7WebCoreL24font_face_uriConstructorEPNS_8DocumentEb
-__ZN7WebCore21SVGFontFaceUriElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore21SVGFontFaceUriElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore21SVGFontFaceUriElement20insertedIntoDocumentEv
-__ZN7WebCore21SVGFontFaceUriElement8loadFontEv
-__ZN7WebCore21SVGFontFaceSrcElement15childrenChangedEbPNS_4NodeES2_i
-__ZNK7WebCore21SVGFontFaceUriElement8srcValueEv
-__ZN7WebCore12XMLTokenizer11stopParsingEv
-__ZThn44_N7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore21ProcessingInstruction15parseStyleSheetERKNS_6StringE
-__ZN7WebCore21ProcessingInstruction11sheetLoadedEv
-__ZNK7WebCore21ProcessingInstruction9isLoadingEv
-__ZNK7WebCore21ProcessingInstruction8nodeTypeEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE6shrinkEm
-__ZN7WebCore11CSSFontFaceD2Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore17CSSFontFaceSourceELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE6shrinkEm
-__ZN7WebCore20CachedResourceClient10fontLoadedEPNS_10CachedFontE
-__ZN7WebCore10CachedFont17ensureSVGFontDataEv
-__ZN7WebCoreL15fontConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGFontElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore18SVGFontFaceElement10fontFamilyEv
-__ZN7WebCoreL24missing_glyphConstructorEPNS_8DocumentEb
-__ZN7WebCore22SVGMissingGlyphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL16glyphConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGGlyphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGGlyphElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15SVGGlyphElement20insertedIntoDocumentEv
-__ZN7WebCore15SVGGlyphElement20invalidateGlyphCacheEv
-__ZN7WebCore14SVGFontElement20invalidateGlyphCacheEv
-__ZNK7WebCore10CachedFont14getSVGFontByIdERKNS_6StringE
-__ZN7WebCore11SVGFontDataC2EPNS_18SVGFontFaceElementE
-__ZNK7WebCore18SVGFontFaceElement17horizontalOriginXEv
-__ZNK7WebCore18SVGFontFaceElement17horizontalOriginYEv
-__ZNK7WebCore18SVGFontFaceElement18horizontalAdvanceXEv
-__ZNK7WebCore18SVGFontFaceElement15verticalOriginXEv
-__ZNK7WebCore18SVGFontFaceElement15verticalOriginYEv
-__ZNK7WebCore18SVGFontFaceElement6ascentEv
-__ZNK7WebCore18SVGFontFaceElement16verticalAdvanceYEv
-__ZNK7WebCore18SVGFontFaceElement10unitsPerEmEv
-__ZNK7WebCore18SVGFontFaceElement7descentEv
-__ZNK7WebCore18SVGFontFaceElement7xHeightEv
-__ZNK7WebCore4Font22floatWidthUsingSVGFontERKNS_7TextRunE
-__ZN7WebCoreL33floatWidthOfSubStringUsingSVGFontEPKNS_4FontERKNS_7TextRunEiiiRiRNS_6StringE
-__ZN7WebCore16SVGTextRunWalkerINS_34SVGTextRunWalkerMeasuredLengthDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
-__ZN7WebCoreL24charactersWithArabicFormERKNS_6StringEb
-__ZNK7WebCore14SVGFontElement28getGlyphIdentifiersForStringERKNS_6StringERN3WTF6VectorINS_18SVGGlyphIdentifierELm0EEE
-__ZNK7WebCore14SVGFontElement16ensureGlyphCacheEv
-__ZNK7WebCore15SVGGlyphElement20buildGlyphIdentifierEv
-__ZN7WebCore15SVGGlyphElement27buildGenericGlyphIdentifierEPKNS_10SVGElementE
-__ZN7WebCore15pathFromSVGDataERNS_4PathERKNS_6StringE
-__ZN3WTF7HashMapItNS_6RefPtrIN7WebCore12GlyphMapNodeEEENS_7IntHashIjEENS_10HashTraitsItEENS7_IS4_EEE3setERKtRKS4_
-__ZN3WTF9HashTableItSt4pairItNS_6RefPtrIN7WebCore12GlyphMapNodeEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsItEENSC_IS5_EEEESD_E5clearEv
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE15reserveCapacityEm
-__ZNK7WebCore14SVGFontElement24firstMissingGlyphElementEv
-__ZN7WebCore11PathBuilder9svgMoveToEddbb
-__ZN7WebCore11PathBuilder9svgLineToEddb
-__ZN7WebCore15SVGGlyphElement28inheritUnspecifiedAttributesERNS_18SVGGlyphIdentifierEPKNS_11SVGFontDataE
-__ZN7WebCoreL30floatWidthUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_34SVGTextRunWalkerMeasuredLengthDataE
-__ZNK7WebCore4Font22floatWidthUsingSVGFontERKNS_7TextRunEiRiRNS_6StringE
-__ZNK7WebCore4Font7svgFontEv
-__ZN7WebCore13RenderSVGText11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore13JSSVGDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSSVGDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore13JSSVGDocument9classInfoEv
-__ZN7WebCore18createJSSVGWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSG_ISD_EEE3setERKS3_RKSD_
-__ZN7WebCoreL27createSVGTextElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore16JSSVGTextElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore36JSSVGTextPositioningElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore27JSSVGTextPositioningElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSSVGTextElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTextElementEEE
-__ZN7WebCore27JSSVGTextPositioningElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGTextPositioningElementEEE
-__ZN7WebCore23JSSVGTextContentElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGTextContentElementEEE
-__ZN7WebCore12JSSVGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10SVGElementEEE
-__ZN7WebCore16JSSVGTextElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSSVGTextPositioningElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSSVGTextContentElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12JSSVGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCoreL26createSVGSVGElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore15JSSVGSVGElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSSVGSVGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSVGElementEEE
-__ZN7WebCore15JSSVGSVGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSSVGSVGElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSSVGSVGElement9classInfoEv
-__ZNK7WebCore16JSSVGTextElement9classInfoEv
-__ZN7WebCore18jsDocumentTypeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore50jsHTMLIFrameElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21HTMLFrameOwnerElement14getSVGDocumentERi
-__ZN7WebCore50jsHTMLObjectElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCoreL15rectConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGRectElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL27createSVGRectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore16JSSVGRectElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSSVGRectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGRectElementEEE
-__ZN7WebCore16JSSVGRectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGRectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSSVGRectElement9classInfoEv
-__ZN7WebCore14SVGRectElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGRectElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCoreL14setConstructorEPNS_8DocumentEb
-__ZN7WebCore13SVGSetElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17SVGAnimateElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore19SVGAnimationElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGSMILElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL26createSVGSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore15JSSVGSetElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore30JSSVGAnimationElementPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore21JSSVGAnimationElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSSVGSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSetElementEEE
-__ZN7WebCore21JSSVGAnimationElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimationElementEEE
-__ZN7WebCore21JSSVGAnimationElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSSVGAnimationElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSSVGSetElement9classInfoEv
-__ZN7WebCore19SVGAnimationElement16attributeChangedEPNS_9AttributeEb
-__ZN7WebCore14SVGSMILElement16attributeChangedEPNS_9AttributeEb
-__ZN7WebCore19SVGAnimationElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGSMILElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGSMILElement15parseBeginOrEndERKNS_6StringENS0_10BeginOrEndE
-__ZN7WebCore14SVGSMILElement15parseClockValueERKNS_6StringE
-__ZNK3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E8containsIdNS_22IdentityHashTranslatorIddS4_EEEEbRKT_
-__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE15reserveCapacityEm
-__ZN7WebCoreL12sortTimeListERN3WTF6VectorINS_8SMILTimeELm0EEE
-__ZSt16__introsort_loopIPN7WebCore8SMILTimeEiEvT_S3_T0_
-__ZSt22__final_insertion_sortIPN7WebCore8SMILTimeEEvT_S3_
-__ZSt16__insertion_sortIPN7WebCore8SMILTimeEEvT_S3_
-__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E6expandEv
-__ZN7WebCore14SVGSMILElement20insertedIntoDocumentEv
-__ZNK7WebCore10SVGElement15ownerSVGElementEv
-__ZN7WebCore14SVGSMILElement10rescheduleEv
-__ZN7WebCore17SMILTimeContainer8scheduleEPNS_14SVGSMILElementE
-__ZNK7WebCore14SVGSMILElement16nextProgressTimeEv
-__ZN3WTF7HashSetIPN7WebCore14SVGSMILElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZNK7WebCore17SMILTimeContainer7elapsedEv
-__ZN7WebCoremiERKNS_8SMILTimeES2_
-__ZN7WebCore21jsSVGRectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS6_EEE3setERKS2_RKS6_
-__ZNK3WTF7HashMapIN7WebCore6StringEPKNS1_23SVGAnimatedPropertyBaseENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_23SVGAnimatedPropertyBaseEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6expandEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateINS_9SVGLengthEEEPNS_10SVGElementE
-__ZN7WebCore19JSSVGAnimatedLength15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSSVGAnimatedLengthC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9SVGLengthEEEEEPNS_10SVGElementE
-__ZN7WebCore19JSSVGAnimatedLength18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26jsSVGAnimatedLengthBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK3WTF9HashTableIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_PNS1_26JSSVGDynamicPODTypeWrapperIS3_S5_EEENS_18PairFirstExtractorISB_EENS1_27PODTypeWrapperCacheInfoHashIS3_S5_EENS_14PairHashTraitsINS1_29PODTypeWrapperCacheInfoTraitsIS3_S5_EENS_10HashTraitsISA_EEEESI_E8containsIS6_NS_22IdentityHashTranslatorIS6_SB_SF_EEEEbRKT_
-__ZN3WTF9HashTableIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_PNS1_26JSSVGDynamicPODTypeWrapperIS3_S5_EEENS_18PairFirstExtractorISB_EENS1_27PODTypeWrapperCacheInfoHashIS3_S5_EENS_14PairHashTraitsINS1_29PODTypeWrapperCacheInfoTraitsIS3_S5_EENS_10HashTraitsISA_EEEESI_E47removeAndInvalidateWithoutEntryConsistencyCheckEPSB_
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEPNS_10SVGElementE
-__ZN7WebCore11JSSVGLengthC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEEEPNS_10SVGElementE
-__ZN7WebCore26jsSVGAnimatedLengthAnimValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsSVGLengthSVG_LENGTHTYPE_NUMBEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN3WTF7HashMapIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEEPNS1_26JSSVGDynamicPODTypeWrapperIS3_S5_EENS1_27PODTypeWrapperCacheInfoHashIS3_S5_EENS1_29PODTypeWrapperCacheInfoTraitsIS3_S5_EENS_10HashTraitsIS9_EEE3setERKS6_RKS9_
-__ZN7WebCore11JSSVGLength18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19jsSVGLengthUnitTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEEcvS1_Ev
-__ZN7WebCore32jsSVGLengthValueInSpecifiedUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16jsSVGLengthValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11JSSVGLength5valueEPN3JSC9ExecStateE
-__ZN7WebCore50jsSVGAnimationElementPrototypeFunctionBeginElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19SVGAnimationElement12beginElementERi
-__ZN7WebCore19SVGAnimationElement14beginElementAtEfRi
-__ZNK7WebCore14SVGSMILElement7elapsedEv
-__ZN7WebCoreplERKNS_8SMILTimeES2_
-__ZN7WebCore14SVGSMILElement12addBeginTimeENS_8SMILTimeE
-__ZN7WebCore14SVGSMILElement16beginListChangedEv
-__ZN7WebCore14SVGSMILElement20resolveFirstIntervalEv
-__ZNK7WebCore14SVGSMILElement15resolveIntervalEbRNS_8SMILTimeES2_
-__ZNK7WebCore14SVGSMILElement16findInstanceTimeENS0_10BeginOrEndENS_8SMILTimeEb
-__ZNK7WebCore14SVGSMILElement16resolveActiveEndENS_8SMILTimeES1_
-__ZNK7WebCore14SVGSMILElement3durEv
-__ZNK7WebCore14SVGSMILElement17repeatingDurationEv
-__ZNK7WebCore14SVGSMILElement11repeatCountEv
-__ZNK7WebCore14SVGSMILElement9repeatDurEv
-__ZNK7WebCore14SVGSMILElement14simpleDurationEv
-__ZNK7WebCore14SVGSMILElement8minValueEv
-__ZNK7WebCore14SVGSMILElement8maxValueEv
-__ZN7WebCore14SVGSMILElement31notifyDependentsIntervalChangedENS0_21NewOrExistingIntervalE
-__ZNK3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEEbRKT_
-__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore46jsSVGSVGElementPrototypeFunctionSetCurrentTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13SVGSVGElement14setCurrentTimeEf
-__ZNK7WebCore14SVGRectElement7isValidEv
-__ZNK7WebCore14SVGRectElement10toPathDataEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11yAttrStringEEEE11synchronizeEv
-__ZN7WebCore5TimerINS_17SMILTimeContainerEE5firedEv
-__ZN7WebCore17SMILTimeContainer10timerFiredEPNS_5TimerIS0_EE
-__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE15reserveCapacityEm
-__ZN7WebCore17SMILTimeContainer26updateDocumentOrderIndexesEv
-__ZSt16__introsort_loopIPPN7WebCore14SVGSMILElementEiNS0_15PriorityCompareEEvT_S5_T0_T1_
-__ZSt22__final_insertion_sortIPPN7WebCore14SVGSMILElementENS0_15PriorityCompareEEvT_S5_T0_
-__ZSt16__insertion_sortIPPN7WebCore14SVGSMILElementENS0_15PriorityCompareEEvT_S5_T0_
-__ZNK7WebCore14SVGSMILElement13targetElementEv
-__ZNK7WebCore14SVGSMILElement9xlinkHrefEv
-__ZNK7WebCore14SVGSMILElement13attributeNameEv
-__ZN3WTF7HashMapISt4pairIPN7WebCore10SVGElementENS2_6StringEEPNS2_14SVGSMILElementENS_8PairHashIS4_S5_EENS_10HashTraitsIS6_EENSB_IS8_EEE3addERKS6_RKS8_
-__ZN7WebCore17SMILTimeContainer12baseValueForESt4pairIPNS_10SVGElementENS_6StringEE
-__ZN7WebCore19SVGAnimationElement14attributeIsCSSERKNS_6StringE
-__ZN3WTF7HashMapISt4pairIPN7WebCore10SVGElementENS2_6StringEES5_NS_8PairHashIS4_S5_EENS_10HashTraitsIS6_EENS9_IS5_EEE3addERKS6_RKS5_
-__ZN7WebCore17SVGAnimateElement16resetToBaseValueERKNS_6StringE
-__ZNK7WebCore17SVGAnimateElement21determinePropertyTypeERKNS_6StringE
-__ZN7WebCoreL23parseNumberValueAndUnitERKNS_6StringERdRS0_
-__ZN3WTF9HashTableISt4pairIPN7WebCore10SVGElementENS2_6StringEES1_IS6_S5_ENS_18PairFirstExtractorIS7_EENS_8PairHashIS4_S5_EENS_14PairHashTraitsINS_10HashTraitsIS6_EENSD_IS5_EEEESE_E6expandEv
-__ZN7WebCore14SVGSMILElement8progressENS_8SMILTimeEPS0_
-__ZN7WebCore14SVGSMILElement17connectConditionsEv
-__ZN7WebCore19SVGAnimationElement21startedActiveIntervalEv
-__ZNK7WebCore19SVGAnimationElement14hasValidTargetEv
-__ZNK7WebCore19SVGAnimationElement13animationModeEv
-__ZNK7WebCore19SVGAnimationElement7toValueEv
-__ZN7WebCore17SVGAnimateElement24calculateFromAndToValuesERKNS_6StringES3_
-__ZNK7WebCore14SVGSMILElement34calculateAnimationPercentAndRepeatENS_8SMILTimeERj
-__ZN7WebCore14SVGSMILElement12checkRestartENS_8SMILTimeE
-__ZNK7WebCore14SVGSMILElement7restartEv
-__ZNK7WebCore14SVGSMILElement20determineActiveStateENS_8SMILTimeE
-__ZNK7WebCore14SVGSMILElement14isContributingENS_8SMILTimeE
-__ZNK7WebCore14SVGSMILElement4fillEv
-__ZN7WebCore19SVGAnimationElement15updateAnimationEfjPNS_14SVGSMILElementE
-__ZN7WebCore17SVGAnimateElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
-__ZNK7WebCore19SVGAnimationElement13isAccumulatedEv
-__ZNK7WebCore19SVGAnimationElement10isAdditiveEv
-__ZNK7WebCore14SVGSMILElement25calculateNextProgressTimeENS_8SMILTimeE
-__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE14expandCapacityEmPKS3_
-__ZSt16__introsort_loopIPPN7WebCore14SVGSMILElementEiPFbS2_S2_EEvT_S6_T0_T1_
-__ZSt22__final_insertion_sortIPPN7WebCore14SVGSMILElementEPFbS2_S2_EEvT_S6_T0_
-__ZSt16__insertion_sortIPPN7WebCore14SVGSMILElementEPFbS2_S2_EEvT_S6_T0_
-__ZN7WebCore17SVGAnimateElement20applyResultsToTargetEv
-__ZN7WebCore19SVGAnimationElement31setTargetAttributeAnimatedValueERKNS_6StringE
-__ZN7WebCore16SVGStyledElement25setInstanceUpdatesBlockedEb
-__ZN3WTF7HashSetIPKN7WebCore16SVGStyledElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandEv
-__ZNK7WebCore19SVGAnimationElement20targetAttributeIsCSSEv
-__ZNK7WebCore19SVGAnimationElement13attributeTypeEv
-__ZN7WebCore16SVGStyledElement14canvasResourceEv
-__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEENS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EERKT_
-__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE6shrinkEm
-__ZN7WebCore19synchronizePropertyINS_14SVGRectElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
-__ZNK7WebCore9SVGLength13valueAsStringEv
-__ZN7WebCore25JSSVGTextElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSSVGTextContentElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21SVGTextContentElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore56jsSVGTextContentElementPrototypeFunctionGetNumberOfCharsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21SVGTextContentElement16getNumberOfCharsEv
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE6appendIS2_EEvPKT_m
-__ZSt16__introsort_loopIPN7WebCore18SVGGlyphIdentifierEiPFbRKS1_S4_EEvT_S7_T0_T1_
-__ZSt22__final_insertion_sortIPN7WebCore18SVGGlyphIdentifierEPFbRKS1_S4_EEvT_S7_T0_
-__ZSt16__insertion_sortIPN7WebCore18SVGGlyphIdentifierEPFbRKS1_S4_EEvT_S7_T0_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE6shrinkEm
-__ZNK7WebCore14SVGFontElement43getHorizontalKerningPairForStringsAndGlyphsERKNS_6StringES3_S3_S3_RNS_24SVGHorizontalKerningPairE
-__ZNK7WebCore13RenderSVGText9isSVGTextEv
-__ZNK7WebCore16SVGRootInlineBox13svgTextChunksEv
-__ZN7WebCoreL29findInlineTextBoxInTextChunksEPKNS_21SVGTextContentElementERKN3WTF6VectorINS_12SVGTextChunkELm0EEE
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE15reserveCapacityEm
-__ZN7WebCore16SVGRootInlineBox14walkTextChunksEPNS_22SVGTextChunkWalkerBaseEPKNS_16SVGInlineTextBoxE
-__ZN7WebCore18SVGTextChunkWalkerINS_27SVGInlineTextBoxQueryWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGCharESB_
-__ZN7WebCore27SVGInlineTextBoxQueryWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGCharES9_
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE6shrinkEm
-__ZN7WebCore61jsSVGTextContentElementPrototypeFunctionGetComputedTextLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21SVGTextContentElement21getComputedTextLengthEv
-__ZN7WebCore58jsSVGTextContentElementPrototypeFunctionGetSubStringLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21SVGTextContentElement18getSubStringLengthEllRi
-__ZN7WebCore62jsSVGTextContentElementPrototypeFunctionGetStartPositionOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21SVGTextContentElement22getStartPositionOfCharElRi
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_10FloatPointEEEPNS_10SVGElementE
-__ZN7WebCore10JSSVGPoint15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore10JSSVGPointC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_10FloatPointEEEEEPNS_10SVGElementE
-__ZN7WebCore10JSSVGPoint18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore11jsSVGPointXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_10FloatPointEEcvS1_Ev
-__ZN7WebCore11jsSVGPointYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsDOMCoreExceptionINDEX_SIZE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore60jsSVGTextContentElementPrototypeFunctionGetEndPositionOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21SVGTextContentElement20getEndPositionOfCharElRi
-__ZN7WebCoreL19textPathConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGTextPathElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL31createSVGTextPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore20JSSVGTextPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGTextPathElementEEE
-__ZN7WebCore20JSSVGTextPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSSVGTextPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore40jsElementPrototypeFunctionSetAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore20JSSVGTextPathElement9classInfoEv
-__ZN7WebCore9JSElement14setAttributeNSEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore18SVGTextPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn164_NK7WebCore18SVGTextPathElement14contextElementEv
-__ZNK7WebCore18SVGTextPathElement14contextElementEv
-__ZN7WebCore18SVGTextPathElement20insertedIntoDocumentEv
-__ZN7WebCore57jsSVGTextContentElementPrototypeFunctionGetRotationOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21SVGTextContentElement17getRotationOfCharElRi
-__ZN7WebCore18SVGTextPathElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore18SVGTextPathElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore17RenderSVGTextPathC2EPNS_4NodeE
-__ZNK7WebCore15RenderSVGInline13requiresLayerEv
-__ZNK7WebCore18SVGTextPathElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore15RenderSVGInline15createInlineBoxEbbb
-__ZN7WebCore22SVGCharacterLayoutInfo15setInPathLayoutEb
-__ZN7WebCore22SVGCharacterLayoutInfo20addLayoutInformationEPNS_13InlineFlowBoxEf
-__ZNK7WebCore17RenderSVGTextPath10layoutPathEv
-__ZN7WebCore4Path6lengthEv
-__ZN7WebCore18PathTraversalStateC2ENS0_19PathTraversalActionE
-__ZNK7WebCore4Path5applyEPvPFvS1_PKNS_11PathElementEE
-__ZN7WebCoreL26CGPathApplierToPathApplierEPvPK13CGPathElement
-__ZN7WebCoreL25pathLengthApplierFunctionEPvPKNS_11PathElementE
-__ZN7WebCore18PathTraversalState6moveToERKNS_10FloatPointE
-__ZN7WebCore18PathTraversalState6lineToERKNS_10FloatPointE
-__ZNK7WebCore17RenderSVGTextPath11startOffsetEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_18SVGTextPathElementENS_9SVGLengthEXadL_ZNS_8SVGNames17textPathTagStringEEEXadL_ZNS3_21startOffsetAttrStringEEEE11synchronizeEv
-__ZN7WebCore22SVGCharacterLayoutInfo27nextPathLayoutPointAndAngleEfff
-__ZN7WebCore4Path13pointAtLengthEfRb
-__ZN7WebCore4Path19normalAngleAtLengthEfRb
-__ZN7WebCore22SVGCharacterLayoutInfo14processedChunkEff
-__ZN7WebCore23JSProcessingInstructionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21ProcessingInstructionEEE
-__ZNK7WebCore23JSProcessingInstruction9classInfoEv
-__ZN7WebCore21ProcessingInstruction19removedFromDocumentEv
-__ZN7WebCore13SVGSVGElement19removedFromDocumentEv
-__ZN7WebCore18SVGFontFaceElement19removedFromDocumentEv
-__ZN7WebCore18SVGFontFaceElement28removeFromMappedElementSheetEv
-__ZN7WebCore9StyleList6removeEj
-__ZN7WebCore20CSSSegmentedFontFaceD2Ev
-__ZN7WebCore11CSSFontFace28removedFromSegmentedFontFaceEPNS_20CSSSegmentedFontFaceE
-__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE6shrinkEm
-__ZN7WebCoreL31createSVGFontFaceElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore20JSSVGFontFaceElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore20JSSVGFontFaceElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGFontFaceElementEEE
-__ZNK7WebCore20JSSVGFontFaceElement9classInfoEv
-__ZN7WebCoreL27createSVGPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore16JSSVGPathElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSSVGPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathElementEEE
-__ZN7WebCore16JSSVGPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSSVGPathElement9classInfoEv
-__ZN7WebCoreL35createSVGMissingGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore24JSSVGMissingGlyphElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore24JSSVGMissingGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGMissingGlyphElementEEE
-__ZNK7WebCore24JSSVGMissingGlyphElement9classInfoEv
-__ZN7WebCoreL28createSVGGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore17JSSVGGlyphElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSSVGGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGGlyphElementEEE
-__ZNK7WebCore17JSSVGGlyphElement9classInfoEv
-__ZN7WebCoreL16hkernConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGHKernElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore12JSSVGElement9classInfoEv
-__ZN7WebCoreL27createSVGFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore16JSSVGFontElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSSVGFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGFontElementEEE
-__ZNK7WebCore16JSSVGFontElement9classInfoEv
-__ZN7WebCore14SVGFontElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore15SVGHKernElement20insertedIntoDocumentEv
-__ZN7WebCoreL16tspanConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGTSpanElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL28createSVGTSpanElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore17JSSVGTSpanElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSSVGTSpanElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTSpanElementEEE
-__ZNK7WebCore17JSSVGTSpanElement9classInfoEv
-__ZN7WebCore12SVGLangSpace10setXmllangERKNS_12AtomicStringE
-__ZN7WebCoreL19altGlyphConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGAltGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL31createSVGAltGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore20JSSVGAltGlyphElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore20JSSVGAltGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGAltGlyphElementEEE
-__ZN7WebCore20JSSVGAltGlyphElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20JSSVGAltGlyphElement9classInfoEv
-__ZN7WebCore15SVGTSpanElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderSVGTSpanC2EPNS_4NodeE
-__ZNK7WebCore15SVGTSpanElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore18SVGAltGlyphElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore18SVGAltGlyphElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore9SVGLength20PercentageOfViewportEfPKNS_10SVGElementENS_13SVGLengthModeE
-__ZNK7WebCore10SVGElement15viewportElementEv
-__ZN7WebCore11PathBuilder12svgClosePathEv
-__ZN7WebCore20parseDelimitedStringERKNS_6StringEc
-__ZNK7WebCore15SVGHKernElement26buildHorizontalKerningPairEv
-__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE15reserveCapacityEm
-__ZN7WebCore11SVGGlyphMap20compareGlyphPriorityERKNS_18SVGGlyphIdentifierES3_
-__ZSt25__unguarded_linear_insertIPN7WebCore18SVGGlyphIdentifierES1_PFbRKS1_S4_EEvT_T0_T1_
-__ZN7WebCoreL25stringMatchesUnicodeRangeERKNS_6StringES2_
-__ZN3WTF6VectorISt4pairIjjELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorISt4pairIjjELm0EE14expandCapacityEm
-__ZN3WTF6VectorISt4pairIjjELm0EE15reserveCapacityEm
-__ZN3WTF6VectorISt4pairIjjELm0EE6shrinkEm
-__ZN3WTF6VectorISt4pairIjjELm0EE14expandCapacityEmPKS2_
-__ZNK7WebCore18SVGAltGlyphElement12glyphElementEv
-__ZN7WebCore16SVGInlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore16SVGInlineTextBox13selectionRectEiiii
-__ZNK7WebCore16SVGInlineTextBox16svgRootInlineBoxEv
-__ZN7WebCore16SVGRootInlineBox18isSVGRootInlineBoxEv
-__ZN7WebCore18SVGTextChunkWalkerINS_35SVGInlineTextBoxSelectionRectWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGCharESB_
-__ZN7WebCore35SVGInlineTextBoxSelectionRectWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGCharES9_
-__ZN7WebCore15JSSVGSVGElementD0Ev
-__ZN7WebCore14SVGSMILElement19removedFromDocumentEv
-__ZN7WebCore17SMILTimeContainer10unscheduleEPNS_14SVGSMILElementE
-__ZN7WebCore14SVGSMILElement20disconnectConditionsEv
-__ZN7WebCore10JSSVGPointD0Ev
-__ZN7WebCore20JSSVGAltGlyphElementD0Ev
-__ZN7WebCore16JSSVGPathElementD0Ev
-__ZN7WebCore23JSProcessingInstructionD0Ev
-__ZN7WebCore18SVGTextPathElementD1Ev
-__ZN3WTF9HashTableIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_PNS1_26JSSVGDynamicPODTypeWrapperIS3_S5_EEENS_18PairFirstExtractorISB_EENS1_27PODTypeWrapperCacheInfoHashIS3_S5_EENS_14PairHashTraitsINS1_29PODTypeWrapperCacheInfoTraitsIS3_S5_EENS_10HashTraitsISA_EEEESI_E4findIS6_NS_22IdentityHashTranslatorIS6_SB_SF_EEEENS_17HashTableIteratorIS6_SB_SD_SF_SL_SI_EERKT_
-__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEED1Ev
-__ZN7WebCore19JSSVGAnimatedLengthD0Ev
-__ZN7WebCore14SVGRectElementD1Ev
-__ZN7WebCore17SVGAnimateElementD0Ev
-__ZN7WebCore19SVGAnimationElementD0Ev
-__ZN7WebCore14SVGSMILElementD0Ev
-__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE6shrinkEm
-__ZN7WebCore10CachedFont17allClientsRemovedEv
-__ZN7WebCore4Node26willMoveToNewOwnerDocumentEv
-__ZN7WebCore4Node25didMoveToNewOwnerDocumentEv
-__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE6shrinkEm
-__ZN7WebCore15SVGGlyphElementD1Ev
-__ZN7WebCore15SVGHKernElementD1Ev
-__ZN7WebCore18SVGAltGlyphElementD1Ev
-__ZN7WebCore25JSSVGTextElementPrototypeD0Ev
-__ZN7WebCore29JSSVGAltGlyphElementPrototypeD0Ev
-__ZN7WebCore19JSSVGPointPrototypeD0Ev
-__ZN7WebCore30JSSVGAnimationElementPrototypeD0Ev
-__ZN7WebCore25JSSVGRectElementPrototypeD0Ev
--[DOMElement(WebPrivate) isFocused]
-__ZN7WebCore19mimeTypeFromDataURLERKNS_6StringE
-__ZN7WebCore22FontCustomPlatformDataD2Ev
-__ZN7WebCore4KURL7setPortEt
-__ZN7WebCoreL16executeSelectAllEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore19SelectionController9selectAllEv
-__ZN7WebCore23RenderFileUploadControl14calcPrefWidthsEv
-__ZN7WebCore23RenderFileUploadControl11paintObjectERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore23RenderFileUploadControl16maxFilenameWidthEv
-__ZNK7WebCore11FileChooser16basenameForWidthERKNS_4FontEi
-__ZN7WebCore29fileButtonNoFileSelectedLabelEv
-__ZN7WebCoreL26gbkUrlEscapedEntityCallackEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
-__ZN7WebCore28setJSHTMLSelectElementLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19TextResourceDecoder22detectJapaneseEncodingEPKcm
-__ZN7WebCore9KanjiCode5judgeEPKci
-__ZN7WebCore25setJSHTMLEmbedElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLPlugInElement7setNameERKNS_6StringE
-__ZN7WebCore30jsHTMLInputElementSelectionEndEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore18JSHTMLInputElement12selectionEndEPN3JSC9ExecStateE
-__ZN7WebCore23jsEventTargetNodeOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode6onloadEv
-__ZN7WebCore24jsEventTargetNodeOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode7onerrorEv
-__ZN7WebCore24jsEventTargetNodeOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode7onabortEv
-__ZN7WebCore18setJSDOMWindowSelfEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23jsHTMLIFrameElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLFrameElementBase4nameEv
-__ZN7WebCore28jsHTMLBodyElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsHTMLDocumentActiveElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12HTMLDocument13activeElementEv
-__ZN7WebCore32JSHTMLOptionsCollectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsHTMLOptionsCollectionPrototypeFunctionAddEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore23JSHTMLOptionsCollection3addEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEERi
-__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEEiRi
-__ZN7WebCore13CSSStyleSheet18determineNamespaceERKNS_12AtomicStringE
-__ZN7WebCore27setJSDOMWindowDefaultStatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow16setDefaultStatusERKNS_6StringE
-__ZN7WebCore21jsHTMLInputElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement3altEv
-__ZN7WebCore13JSPluginArray16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE14shrinkCapacityEm
-__ZN7WebCore24jsDocumentDefaultCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Document14defaultCharsetEv
-__ZN7WebCore14XMLHttpRequest4openERKNS_6StringERKNS_4KURLEbS3_S3_Ri
-__ZN7WebCore27jsEventTargetNodeOndblclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode10ondblclickEv
-__ZN7WebCore52jsHTMLInputElementPrototypeFunctionSetSelectionRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore18JSHTMLInputElement17setSelectionRangeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore17JSHTMLFormElement11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore15HTMLFormElement4itemEj
-__ZN7WebCore15BackForwardList10removeItemEPNS_11HistoryItemE
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_12IconSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IS4_EEEESB_E4findIS2_NS_22IdentityHashTranslatorIS2_S5_S8_EEEENS_17HashTableIteratorIS2_S5_S7_S8_SD_SB_EERKT_
-__ZN7WebCore30jsHTMLScriptElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLScriptElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLScriptElement4textEv
-__ZNK7WebCore11RenderTheme11systemColorEi
-__ZN7WebCoreL18marqueeConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore18HTMLMarqueeElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore18HTMLMarqueeElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore18HTMLMarqueeElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore18HTMLMarqueeElement17endTagRequirementEv
-__ZNK7WebCore18HTMLMarqueeElement11tagPriorityEv
-__ZN7WebCore16StyleMarqueeDataC2ERKS0_
-__ZN7WebCore13RenderMarqueeC1EPNS_11RenderLayerE
-__ZN7WebCore13RenderMarquee18updateMarqueeStyleEv
-__ZNK7WebCore13RenderMarquee12isHorizontalEv
-__ZNK7WebCore13RenderMarquee9directionEv
-__ZNK7WebCore13RenderMarquee12marqueeSpeedEv
-__ZN7WebCore13RenderMarquee21updateMarqueePositionEv
-__ZN7WebCore13RenderMarquee15computePositionENS_17EMarqueeDirectionEb
-__ZN7WebCore13RenderMarquee5startEv
-__ZN7WebCore5TimerINS_13RenderMarqueeEE5firedEv
-__ZN7WebCore13RenderMarquee10timerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore32setJSDOMWindowCommentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore41jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23JSCustomXPathNSResolverC1EPN3JSC8JSObjectEPNS_5FrameE
-__ZN7WebCore15XPathNSResolverD0Ev
-__ZN7WebCore28jsHTMLHtmlElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40setJSDOMWindowHTMLHtmlElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore28jsHTMLHeadElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40setJSDOMWindowHTMLHeadElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore28jsHTMLLinkElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40setJSDOMWindowHTMLLinkElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29jsHTMLTitleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41setJSDOMWindowHTMLTitleElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore28jsHTMLMetaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40setJSDOMWindowHTMLMetaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore28jsHTMLBaseElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40setJSDOMWindowHTMLBaseElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCoreL18isindexConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore18HTMLIsIndexElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore16HTMLInputElement14setDefaultNameERKNS_12AtomicStringE
-__ZN7WebCoreL31createHTMLIsIndexElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore20JSHTMLIsIndexElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLIsIndexElementEEE
-__ZN7WebCore20JSHTMLIsIndexElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31jsHTMLIsIndexElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore43setJSDOMWindowHTMLIsIndexElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29jsHTMLStyleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41setJSDOMWindowHTMLStyleElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore40setJSDOMWindowHTMLBodyElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore40setJSDOMWindowHTMLFormElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30jsHTMLSelectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore42setJSDOMWindowHTMLSelectElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCoreL32createHTMLOptGroupElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLOptGroupElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLOptGroupElementEEE
-__ZN7WebCore21JSHTMLOptGroupElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32jsHTMLOptGroupElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44setJSDOMWindowHTMLOptGroupElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30jsHTMLOptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore42setJSDOMWindowHTMLOptionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore41setJSDOMWindowHTMLInputElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore32jsHTMLTextAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44setJSDOMWindowHTMLTextAreaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30jsHTMLButtonElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore42setJSDOMWindowHTMLButtonElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29jsHTMLLabelElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41setJSDOMWindowHTMLLabelElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore32jsHTMLFieldSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44setJSDOMWindowHTMLFieldSetElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30jsHTMLLegendElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore42setJSDOMWindowHTMLLegendElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore41setJSDOMWindowHTMLUListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore41setJSDOMWindowHTMLOListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore41setJSDOMWindowHTMLDListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCoreL14dirConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore20HTMLDirectoryElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL33createHTMLDirectoryElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore22JSHTMLDirectoryElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLDirectoryElementEEE
-__ZN7WebCore22JSHTMLDirectoryElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33jsHTMLDirectoryElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore45setJSDOMWindowHTMLDirectoryElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCoreL15menuConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLMenuElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL28createHTMLMenuElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLMenuElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMenuElementEEE
-__ZN7WebCore17JSHTMLMenuElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28jsHTMLMenuElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40setJSDOMWindowHTMLMenuElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore38setJSDOMWindowHTMLLIElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore39setJSDOMWindowHTMLDivElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore45setJSDOMWindowHTMLParagraphElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore43setJSDOMWindowHTMLHeadingElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCoreL29createHTMLQuoteElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLQuoteElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLQuoteElementEEE
-__ZN7WebCore18JSHTMLQuoteElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29jsHTMLQuoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41setJSDOMWindowHTMLQuoteElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore27jsHTMLPreElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore39setJSDOMWindowHTMLPreElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore26jsHTMLBRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore38setJSDOMWindowHTMLBRElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCoreL32createHTMLBaseFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLBaseFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLBaseFontElementEEE
-__ZN7WebCore21JSHTMLBaseFontElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32jsHTMLBaseFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44setJSDOMWindowHTMLBaseFontElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore28jsHTMLFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40setJSDOMWindowHTMLFontElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore26jsHTMLHRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore38setJSDOMWindowHTMLHRElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore27jsHTMLModElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore39setJSDOMWindowHTMLModElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore42setJSDOMWindowHTMLAnchorElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore41setJSDOMWindowHTMLImageElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30jsHTMLObjectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore42setJSDOMWindowHTMLObjectElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29jsHTMLParamElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41setJSDOMWindowHTMLParamElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30jsHTMLAppletElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore42setJSDOMWindowHTMLAppletElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore27jsHTMLMapElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore39setJSDOMWindowHTMLMapElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore28jsHTMLAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40setJSDOMWindowHTMLAreaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore42setJSDOMWindowHTMLScriptElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore41setJSDOMWindowHTMLTableElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore36jsHTMLTableCaptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore48setJSDOMWindowHTMLTableCaptionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore32jsHTMLTableColElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44setJSDOMWindowHTMLTableColElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore48setJSDOMWindowHTMLTableSectionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore44setJSDOMWindowHTMLTableRowElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore45setJSDOMWindowHTMLTableCellElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCoreL32createHTMLFrameSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLFrameSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFrameSetElementEEE
-__ZN7WebCore21JSHTMLFrameSetElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSHTMLFrameSetElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_19HTMLFrameSetElementERKNS1_10IdentifierE
-__ZNK7WebCore14HTMLCollection9namedItemERKNS_12AtomicStringE
-__ZN7WebCore32jsHTMLFrameSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44setJSDOMWindowHTMLFrameSetElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCoreL29createHTMLFrameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLFrameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLFrameElementEEE
-__ZN7WebCore18JSHTMLFrameElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29jsHTMLFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41setJSDOMWindowHTMLFrameElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30jsHTMLIFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore42setJSDOMWindowHTMLIFrameElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore37setJSDOMWindowHTMLDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore39setJSDOMWindowHTMLCollectionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17jsTextConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29setJSDOMWindowTextConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29setJSDOMWindowNodeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore21JSHTMLOptGroupElementD0Ev
-__ZN7WebCore22JSHTMLDirectoryElementD0Ev
-__ZN7WebCore20HTMLDirectoryElementD1Ev
-__ZN7WebCore17JSHTMLMenuElementD0Ev
-__ZN7WebCore15HTMLMenuElementD1Ev
-__ZN7WebCore18JSHTMLQuoteElementD0Ev
-__ZN7WebCore18JSHTMLFrameElementD0Ev
-__ZNK3JSC38StringObjectThatMasqueradesAsUndefined9toBooleanEPNS_9ExecStateE
-__ZN3JSC38StringObjectThatMasqueradesAsUndefinedD0Ev
-__ZN7WebCore18RenderTableSection12imageChangedEPvPKNS_7IntRectE
-__ZN7WebCore25setJSDOMWindowOnmousemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow14setOnmousemoveEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore23JSCustomXPathNSResolver18lookupNamespaceURIERKNS_6StringE
-__ZN7WebCore24setJSDOMWindowScrollbarsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20setJSDocumentCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore8Document10setCharsetERKNS_6StringE
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore5FrameEEESt4pairIS4_PNS_7HashMapIxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENSB_IS8_EEEEENS_18PairFirstExtractorISG_EENS_7PtrHashIS4_EENS_14PairHashTraitsINSB_IS4_EENSB_ISF_EEEESM_E4findIPS3_NS_29RefPtrHashMapRawKeyTranslatorISR_SG_SO_SK_EEEENS_17HashTableIteratorIS4_SG_SI_SK_SO_SM_EERKT_
-__ZN7WebCore21JSHTMLOptGroupElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore22jsHTMLOListElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLOListElement4typeEv
-__ZN7WebCore18JSHTMLQuoteElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore12RenderInline6layoutEv
-__ZN7WebCore17jsDOMWindowWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34nonCachingStaticBlurFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsHTMLBodyElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLBodyElement7bgColorEv
-__ZN7WebCore17setJSDOMWindowTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore36jsHTMLOptionsCollectionSelectedIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21HTMLOptionsCollection13selectedIndexEv
-__ZN7WebCore13RenderMarquee7suspendEv
-__ZNK7WebCore18RenderTableSection16leftmostPositionEbb
-__ZN7WebCore8Document18setVisuallyOrderedEv
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D4rectEffff
-__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionCreatePatternEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26JSCanvasRenderingContext2D13createPatternEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_16HTMLImageElementERKNS_6StringERi
-__ZN7WebCore13CanvasPattern19parseRepetitionTypeERKNS_6StringERbS4_Ri
-__ZN7WebCore13CanvasPatternC1EPNS_5ImageEbbb
-__ZN7WebCore7PatternC1EPNS_5ImageEbb
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13CanvasPatternE
-__ZN7WebCore15JSCanvasPattern15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSCanvasPatternC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CanvasPatternEEE
-__ZNK7WebCore15JSCanvasPattern9classInfoEv
-__ZN7WebCore11CanvasStyleC2EN3WTF10PassRefPtrINS_13CanvasPatternEEE
-__ZN7WebCore15GraphicsContext14setFillPatternEN3WTF10PassRefPtrINS_7PatternEEE
-__ZN7WebCore15GraphicsContext16applyFillPatternEv
-__ZNK7WebCore15GraphicsContext6getCTMEv
-__ZNK7WebCore7Pattern21createPlatformPatternERKNS_20TransformationMatrixE
-__ZN7WebCoreL15patternCallbackEPvP9CGContext
-__ZN7WebCore11BitmapImage13getCGImageRefEv
-__ZN7WebCore15GraphicsContext16setStrokePatternEN3WTF10PassRefPtrINS_7PatternEEE
-__ZN7WebCore15GraphicsContext18applyStrokePatternEv
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEff
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementEff
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementEffffRi
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementERKNS_9FloatRectES5_Ri
-shapeArabic
-shapeUnicode
-getLink
-__ZN7WebCoreL22patternReleaseCallbackEPv
-__ZN7WebCore10HTMLParser23isindexCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore10HTMLParser13handleIsindexEPNS_5TokenE
-__ZN7WebCore18HTMLIsIndexElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore27searchableIndexIntroductionEv
-__ZN3WTF6VectorIxLm0EE14expandCapacityEmPKx
-__ZN3WTF6VectorIxLm0EE14expandCapacityEm
-__ZN3WTF6VectorIxLm0EE15reserveCapacityEm
-__ZN3WTF6VectorIxLm0EE6shrinkEm
-__ZN7WebCore12ClipboardMac19setDragImageElementEPNS_4NodeERKNS_8IntPointE
-__ZN7WebCore12ClipboardMac12setDragImageEPNS_11CachedImageEPNS_4NodeERKNS_8IntPointE
-__ZN7WebCore11JSClipboardC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ClipboardEEE
-__ZN7WebCore11JSClipboard18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSClipboardPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore35jsClipboardPrototypeFunctionSetDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore11JSClipboard9classInfoEv
-__ZN7WebCore11JSClipboard7setDataEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore12ClipboardMac7setDataERKNS_6StringES3_
-__ZN7WebCoreL21cocoaTypeFromMIMETypeERKNS_6StringE
-__ZN7WebCore11JSClipboard3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore27setJSClipboardEffectAllowedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9Clipboard16setEffectAllowedERKNS_6StringE
-__ZN7WebCore24jsClipboardEffectAllowedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL14dragOpFromIEOpERKNS_6StringE
-__ZNK7WebCore12ClipboardMac15createDragImageERNS_8IntPointE
-__ZNK7WebCore12ClipboardMac11dragNSImageER8_NSPoint
-__ZNK7WebCore5Frame17snapshotDragImageEPNS_4NodeEP7_NSRectS4_
-__ZN7WebCore12RenderObject15updateDragStateEb
-__ZN7WebCore12RenderObject16paintingRootRectERNS_7IntRectE
-__ZN7WebCore12RenderObject23addAbsoluteRectForLayerERNS_7IntRectE
-__ZN7WebCore9FrameView13setNodeToDrawEPNS_4NodeE
-__ZN7WebCore16jsClipboardTypesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11JSClipboard5typesEPN3JSC9ExecStateE
-__ZNK7WebCore12ClipboardMac5typesEv
-__ZN7WebCore26setJSHTMLTableElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLTableElement8setAlignERKNS_6StringE
-__ZN7WebCore28setJSEventTargetNodeOnunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode11setOnunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore16JSHTMLModElement9classInfoEv
-__ZN7WebCore39setJSDOMWindowRangeExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30jsConsolePrototypeFunctionInfoEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Console4infoEPNS_15ScriptCallStackE
-__ZN7WebCore31jsConsolePrototypeFunctionGroupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Console5groupEPNS_15ScriptCallStackE
-__ZN7WebCore19InspectorController10startGroupENS_13MessageSourceEPNS_15ScriptCallStackE
-__ZN7WebCore34jsConsolePrototypeFunctionGroupEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Console8groupEndEv
-__ZN7WebCore19InspectorController8endGroupENS_13MessageSourceEjRKNS_6StringE
-__ZN7WebCore11RenderStyle16accessAnimationsEv
-__ZN7WebCore16CSSStyleSelector16mapAnimationNameEPNS_9AnimationEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector17mapAnimationDelayEPNS_9AnimationEPNS_8CSSValueE
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6RefPtrINS1_17KeyframeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
-__ZN7WebCore17KeyframeAnimationC1EPKNS_9AnimationEPNS_12RenderObjectEiPNS_18CompositeAnimationEPNS_11RenderStyleE
-__ZN7WebCore12KeyframeList6insertEfN3WTF10PassRefPtrINS_11RenderStyleEEE
-__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE15reserveCapacityEm
-__ZN7WebCore16CSSStyleSelector26keyframeStylesForAnimationEPNS_7ElementEPKNS_11RenderStyleERNS_12KeyframeListE
-__ZN7WebCore12KeyframeList5clearEv
-__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE6shrinkEm
-__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E8containsIS3_NS_22IdentityHashTranslatorIS3_S8_SC_EEEEbRKT_
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SC_EEEENS_17HashTableIteratorIS3_S8_SA_SC_SH_SF_EERKT_
-__ZNK7WebCore22WebKitCSSKeyframesRule6lengthEv
-__ZNK7WebCore22WebKitCSSKeyframesRule4itemEj
-__ZN7WebCore21WebKitCSSKeyframeRule14isKeyframeRuleEv
-__ZN7WebCore21WebKitCSSKeyframeRule14parseKeyStringERKNS_6StringERN3WTF6VectorIfLm0EEE
-__ZN3WTF6VectorIfLm0EE14shrinkCapacityEm
-__ZN7WebCore17KeyframeAnimation29validateTransformFunctionListEv
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_17KeyframeAnimationEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E5clearEv
-__ZN7WebCore17KeyframeAnimation7animateEPNS_18CompositeAnimationEPNS_12RenderObjectEPKNS_11RenderStyleES7_RN3WTF6RefPtrIS5_EE
-__ZNK7WebCore11RenderStyle4leftEv
-__ZN7WebCore11RenderStyle7setLeftENS_6LengthE
-__ZNK7WebCore17KeyframeAnimation23hasAnimationForPropertyEi
-__ZNK7WebCore11RenderStyle3topEv
-__ZN7WebCore9CSSParser28parseAnimationIterationCountEv
-__ZN7WebCore9CSSParser23parseAnimationDirectionEv
-__ZN7WebCore9CSSParser14parseTransformEv
-__ZN7WebCore23WebKitCSSTransformValueC2ENS0_22TransformOperationTypeE
-__ZN7WebCore16CSSStyleSelector25createTransformOperationsEPNS_8CSSValueEPNS_11RenderStyleERNS_19TransformOperationsE
-__ZN7WebCoreL25getTransformOperationTypeENS_23WebKitCSSTransformValue22TransformOperationTypeE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEaSERKS5_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE6shrinkEm
-__ZN7WebCore18StyleTransformDataC2ERKS0_
-__ZNK7WebCore27TranslateTransformOperation10isSameTypeERKNS_18TransformOperationE
-__ZNK7WebCore27TranslateTransformOperation16getOperationTypeEv
-__ZNK7WebCore23ScaleTransformOperation10isSameTypeERKNS_18TransformOperationE
-__ZNK7WebCore23ScaleTransformOperation16getOperationTypeEv
-__ZNK7WebCore15PropertyWrapperIRKNS_19TransformOperationsEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
-__ZNK7WebCore11RenderStyle9transformEv
-__ZN7WebCore27TranslateTransformOperation5blendEPKNS_18TransformOperationEdb
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEmPKS4_
-__ZN7WebCore23ScaleTransformOperation5blendEPKNS_18TransformOperationEdb
-__ZN7WebCore11RenderStyle12setTransformERKNS_19TransformOperationsE
-__ZNK7WebCore18StyleTransformDataeqERKS0_
-__ZNK7WebCore27TranslateTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore23ScaleTransformOperationeqERKNS_18TransformOperationE
-__ZN7WebCore27TranslateTransformOperationD1Ev
-__ZNK7WebCore11RenderStyle14applyTransformERNS_20TransformationMatrixERKNS_7IntSizeEb
-__ZNK7WebCore27TranslateTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
-__ZNK7WebCore23ScaleTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
-__ZNK7WebCore20TransformationMatrix7mapQuadERKNS_9FloatQuadE
-__ZNK7WebCore20TransformationMatrix8mapPointERKNS_10FloatPointE
-__ZN7WebCore17KeyframeAnimation12endAnimationEb
-__ZN7WebCore13AnimationBase10setChangedEPNS_4NodeE
-__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE15reserveCapacityEm
-__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_17KeyframeAnimationEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SC_EEEENS_17HashTableIteratorIS3_S8_SA_SC_SH_SF_EERKT_
-__ZN7WebCore12KeyframeListD1Ev
-__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE6shrinkEm
-__ZNK7WebCore11RenderStyle6heightEv
-__ZN7WebCore16CSSStyleSelector26mapAnimationIterationCountEPNS_9AnimationEPNS_8CSSValueE
-__ZN7WebCore9CSSParser23parseAnimationPlayStateEv
-__ZNK7WebCore11RenderStyle10lineHeightEv
-__ZN7WebCore11RenderStyle13setLineHeightENS_6LengthE
-__ZNK7WebCore21PropertyWrapperGetterIRKNS_19TransformOperationsEE6equalsEPKNS_11RenderStyleES7_
-__ZNK7WebCore24MatrixTransformOperation10isSameTypeERKNS_18TransformOperationE
-__ZNK7WebCore24MatrixTransformOperation16getOperationTypeEv
-__ZN7WebCore24MatrixTransformOperation5blendEPKNS_18TransformOperationEdb
-__ZN7WebCore20TransformationMatrix9setMatrixEdddddd
-__ZN7WebCore20TransformationMatrix5blendERKS0_d
-__ZN7WebCoreL24affineTransformDecomposeERKNS_20TransformationMatrixEPd
-__ZNK7WebCore20TransformationMatrix1bEv
-__ZNK7WebCore20TransformationMatrix1cEv
-__ZN7WebCore20TransformationMatrix4setAEd
-__ZN7WebCore20TransformationMatrix4setBEd
-__ZN7WebCore20TransformationMatrix4setCEd
-__ZN7WebCore20TransformationMatrix4setDEd
-__ZN7WebCore20TransformationMatrix4setEEd
-__ZN7WebCore20TransformationMatrix4setFEd
-__ZNK7WebCore24MatrixTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore24MatrixTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
-__ZN7WebCore13AnimationBase15updatePlayStateEb
-__ZNK7WebCore24RotateTransformOperation10isSameTypeERKNS_18TransformOperationE
-__ZNK7WebCore24RotateTransformOperation16getOperationTypeEv
-__ZN7WebCore24RotateTransformOperation5blendEPKNS_18TransformOperationEdb
-__ZNK7WebCore24RotateTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore24RotateTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
-__ZN7WebCore16CSSStyleSelector21mapAnimationDirectionEPNS_9AnimationEPNS_8CSSValueE
-__ZN7WebCore11RenderStyle6setTopENS_6LengthE
-__ZN7WebCore20WebKitAnimationEventC1Ev
-__ZNK7WebCore20WebKitAnimationEvent22isWebKitAnimationEventEv
-__ZN7WebCore22JSWebKitAnimationEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20WebKitAnimationEventEEE
-__ZN7WebCore22JSWebKitAnimationEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore35jsWebKitAnimationEventAnimationNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20WebKitAnimationEvent13animationNameEv
-__ZN7WebCore33jsWebKitAnimationEventElapsedTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20WebKitAnimationEvent11elapsedTimeEv
-__ZN7WebCore29jsCSSRuleWEBKIT_KEYFRAME_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsCSSRuleWEBKIT_KEYFRAMES_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore37jsStyleSheetListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore16JSStyleSheetList9classInfoEv
-__ZN7WebCore34jsCSSRuleListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore22WebKitCSSKeyframesRule4typeEv
-__ZN7WebCore24JSWebKitCSSKeyframesRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22WebKitCSSKeyframesRuleEEE
-__ZN7WebCore24JSWebKitCSSKeyframesRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore13jsCSSRuleTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsWebKitCSSKeyframesRuleNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsWebKitCSSKeyframesRuleCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21WebKitCSSKeyframeRule4typeEv
-__ZN7WebCore23JSWebKitCSSKeyframeRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitCSSKeyframeRuleEEE
-__ZN7WebCore23JSWebKitCSSKeyframeRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21WebKitCSSKeyframeRule7cssTextEv
-__ZN7WebCore33JSWebKitCSSKeyframesRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore51jsWebKitCSSKeyframesRulePrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore24JSWebKitCSSKeyframesRule9classInfoEv
-__ZN7WebCore22WebKitCSSKeyframesRule10insertRuleERKNS_6StringE
-__ZN7WebCore9CSSParser17parseKeyframeRuleEPNS_13CSSStyleSheetERKNS_6StringE
-__ZN7WebCore30jsWebKitCSSKeyframeRuleKeyTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsWebKitCSSKeyframeRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore49jsWebKitCSSKeyframesRulePrototypeFunctionFindRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore22WebKitCSSKeyframesRule8findRuleERKNS_6StringE
-__ZNK7WebCore22WebKitCSSKeyframesRule13findRuleIndexERKNS_6StringE
-__ZN7WebCore22WebKitCSSKeyframesRule4itemEj
-__ZN7WebCore51jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore22WebKitCSSKeyframesRule10deleteRuleERKNS_6StringE
-__ZN7WebCore11CSSRuleList10deleteRuleEj
-__ZN7WebCore16CSSStyleSelector21mapAnimationPlayStateEPNS_9AnimationEPNS_8CSSValueE
-__ZN7WebCore17KeyframeAnimation18overrideAnimationsEv
-__ZN7WebCore18CompositeAnimation26overrideImplicitAnimationsEi
-__ZN7WebCore25CompositeAnimationPrivate26overrideImplicitAnimationsEi
-__ZN7WebCore17KeyframeAnimation16onAnimationStartEd
-__ZN7WebCore17KeyframeAnimation18sendAnimationEventERKNS_12AtomicStringEd
-__ZN7WebCore17KeyframeAnimation26shouldSendEventForListenerENS_8Document12ListenerTypeE
-__ZNK7WebCore13AnimationBase10overriddenEv
-__ZN7WebCore19AnimationController18addEventToDispatchEN3WTF10PassRefPtrINS_7ElementEEERKNS_12AtomicStringERKNS_6StringEd
-__ZN7WebCore26AnimationControllerPrivate18addEventToDispatchEN3WTF10PassRefPtrINS_7ElementEEERKNS_12AtomicStringERKNS_6StringEd
-__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE4growEm
-__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE15reserveCapacityEm
-__ZN7WebCore15EventTargetNode28dispatchWebKitAnimationEventERKNS_12AtomicStringERKNS_6StringEd
-__ZN7WebCore20WebKitAnimationEventC1ERKNS_12AtomicStringERKNS_6StringEd
-__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE6shrinkEm
-__ZN7WebCore11RenderStyle9setHeightENS_6LengthE
-__ZN7WebCore17KeyframeAnimation20onAnimationIterationEd
-__ZN7WebCore17KeyframeAnimation14onAnimationEndEd
-__ZN7WebCore17KeyframeAnimation26resumeOverriddenAnimationsEv
-__ZN7WebCore18CompositeAnimation34resumeOverriddenImplicitAnimationsEi
-__ZN7WebCore25CompositeAnimationPrivate34resumeOverriddenImplicitAnimationsEi
-__ZN7WebCore17ImplicitAnimation13setOverriddenEb
-__ZN7WebCore18CompositeAnimation32removeFromStyleAvailableWaitListEPNS_13AnimationBaseE
-__ZN7WebCore25CompositeAnimationPrivate32removeFromStyleAvailableWaitListEPNS_13AnimationBaseE
-__ZN7WebCore19AnimationController32removeFromStyleAvailableWaitListEPNS_13AnimationBaseE
-__ZN7WebCore26AnimationControllerPrivate32removeFromStyleAvailableWaitListEPNS_13AnimationBaseE
-__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8CSSValueE
-__ZNK7WebCore8CSSValue25isWebKitCSSTransformValueEv
-__ZNK7WebCore8CSSValue10isSVGPaintEv
-__ZNK7WebCore8CSSValue10isSVGColorEv
-__ZN7WebCore19JSCSSPrimitiveValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17CSSPrimitiveValueEEE
-__ZN7WebCore10JSCSSValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8CSSValueEEE
-__ZN7WebCore19JSCSSPrimitiveValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore10JSCSSValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSCSSPrimitiveValuePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29jsCSSPrimitiveValueCSS_NUMBEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionGetFloatValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore19JSCSSPrimitiveValue9classInfoEv
-__ZN7WebCore22JSWebKitAnimationEventD0Ev
-__ZN7WebCore23JSWebKitCSSKeyframeRuleD0Ev
-__ZN7WebCore19JSCSSPrimitiveValueD0Ev
-__ZN7WebCore10JSCSSValueD0Ev
-__ZNK7WebCore23WebKitCSSTransformValue7cssTextEv
-__ZN7WebCore28JSWebKitCSSMatrixConstructor16getConstructDataERN3JSC13ConstructDataE
-__ZN7WebCoreL24constructWebKitCSSMatrixEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
-__ZN7WebCore15WebKitCSSMatrixC1ERKNS_6StringERi
-__ZN7WebCore15WebKitCSSMatrix14setMatrixValueERKNS_6StringERi
-__ZN7WebCore17JSWebKitCSSMatrix15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSWebKitCSSMatrixC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WebKitCSSMatrixEEE
-__ZN7WebCore17JSWebKitCSSMatrix18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18jsWebKitCSSMatrixAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsWebKitCSSMatrixBEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsWebKitCSSMatrixCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsWebKitCSSMatrixDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24JSWebKitCSSKeyframesRuleD0Ev
-__ZN7WebCore17JSWebKitCSSMatrixD0Ev
-__ZN7WebCore15WebKitCSSMatrixD1Ev
-__ZN7WebCoreL7toRomanEib
-__ZN7WebCoreL10toGeorgianEi
-__ZN7WebCore15RenderContainer18invalidateCountersEv
-__ZN7WebCoreL29invalidateCountersInContainerEPNS_12RenderObjectE
-__ZNK7WebCore13RenderCounter9isCounterEv
-__ZN7WebCore13RenderCounter10invalidateEv
-__ZN7WebCore24jsHTMLDocumentDesignModeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12HTMLDocument10designModeEv
-__ZN7WebCore22jsHTMLStyleElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12RenderObject7isFrameEv
-__ZNK7WebCore14RenderFrameSet8edgeInfoEv
-__ZNK7WebCore14CSSCharsetRule4typeEv
-__ZN7WebCore16JSCSSCharsetRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CSSCharsetRuleEEE
-__ZN7WebCore16JSCSSCharsetRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSCSSRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16JSCSSCharsetRuleD0Ev
-__ZNK7WebCore12RenderObject25getBaselineOfFirstLineBoxEv
-__ZN7WebCore26setJSDOMWindowOnmousewheelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow15setOnmousewheelEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore15HTMLMenuElement17endTagRequirementEv
-__ZNK7WebCore15HTMLMenuElement11tagPriorityEv
-__ZN7WebCore39jsDOMSelectionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12DOMSelection8toStringEv
-__ZN7WebCore20setJSHTMLElementLangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11HTMLElement7setLangERKNS_6StringE
-__ZN7WebCore21setJSDOMWindowScrollYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9Tokenizer11stopParsingEv
-__ZNK7WebCore9Tokenizer14processingDataEv
-__ZN7WebCore25jsEventTargetNodeOnscrollEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode8onscrollEv
-__ZN7WebCore16DocumentFragment9cloneNodeEb
-__ZN7WebCore48jsRangePrototypeFunctionCreateContextualFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore5Range24createContextualFragmentERKNS_6StringERi
-__ZN7WebCore35jsNamedNodeMapPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore4Node12setNodeValueERKNS_6StringERi
-__ZN7WebCore8Document9cloneNodeEb
-__ZN7WebCore4Attr16childTypeAllowedENS_4Node8NodeTypeE
-__ZN7WebCore42jsCharacterDataPrototypeFunctionDeleteDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore42jsElementPrototypeFunctionSetAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9JSElement16setAttributeNodeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore7Element16setAttributeNodeEPNS_4AttrERi
-__ZN7WebCore12NamedAttrMap12setNamedItemEPNS_4NodeERi
-__ZN7WebCore8Document15textNodesMergedEPNS_4TextEj
-__ZN7WebCore46jsNamedNodeMapPrototypeFunctionRemoveNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore42jsCharacterDataPrototypeFunctionAppendDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore42jsCharacterDataPrototypeFunctionInsertDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore45jsDocumentPrototypeFunctionCreateCDATASectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document18createCDATASectionERKNS_6StringERi
-__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_12CDATASectionE
-__ZN7WebCore45jsCharacterDataPrototypeFunctionSubstringDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore54jsDocumentPrototypeFunctionCreateProcessingInstructionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore16DocumentFragment8nodeNameEv
-__ZN7WebCore43jsNamedNodeMapPrototypeFunctionSetNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore43jsCharacterDataPrototypeFunctionReplaceDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13CharacterData11replaceDataEjjRKNS_6StringERi
-__ZN7WebCore48jsDocumentPrototypeFunctionCreateEntityReferenceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document21createEntityReferenceERKNS_6StringERi
-__ZN7WebCore32jsTextPrototypeFunctionSplitTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore4Attr9cloneNodeEb
-__ZN7WebCore44jsDocumentPrototypeFunctionCreateAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13MutationEventC2Ev
-__ZN7WebCore24JSMutationEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14EventExceptionE
-__ZN7WebCore16JSEventExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14EventExceptionEEE
-__ZN7WebCore16JSEventException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSEventExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20jsEventExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLBaseElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLBaseElement6targetEv
-__ZN7WebCore21jsHTMLBaseElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsHTMLTableRowElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableRowElement7bgColorEv
-__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionDeleteRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore23HTMLTableSectionElement9deleteRowEiRi
-__ZN7WebCore26jsHTMLObjectElementArchiveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement7archiveEv
-__ZN7WebCore24jsHTMLMenuElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLMenuElement7compactEv
-__ZN7WebCore29jsHTMLTableCellElementHeadersEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement7headersEv
-__ZN7WebCore26jsHTMLTableCellElementAxisEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement4axisEv
-__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionDeleteCellEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19HTMLTableRowElement10deleteCellEiRi
-__ZN7WebCore42jsHTMLCollectionPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16JSHTMLCollection9namedItemEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore23jsHTMLAppletElementCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAppletElement4codeEv
-__ZN7WebCore17HTMLAppletElement19removedFromDocumentEv
-__ZN7WebCore27jsHTMLObjectElementCodeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement8codeTypeEv
-__ZN7WebCore23jsHTMLObjectElementCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement4codeEv
-__ZN7WebCore27jsHTMLTableColElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableColElement6vAlignEv
-__ZN7WebCore25jsHTMLObjectElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement6hspaceEv
-__ZN7WebCore26jsHTMLTableColElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableColElement5alignEv
-__ZN7WebCore26jsHTMLOptGroupElementLabelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLOptGroupElement5labelEv
-__ZN7WebCore23jsHTMLAreaElementNoHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLAreaElement6noHrefEv
-__ZN7WebCore27jsHTMLTableRowElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableRowElement6vAlignEv
-__ZN7WebCore30jsHTMLFormElementAcceptCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsHTMLTableCellElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement6vAlignEv
-__ZN7WebCore26jsHTMLIsIndexElementPromptEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore18HTMLIsIndexElement6promptEv
-__ZN7WebCore24jsHTMLIsIndexElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsHTMLTableCellElementScopeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement5scopeEv
-__ZN7WebCore27jsHTMLObjectElementCodeBaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement8codeBaseEv
-__ZN7WebCore20jsHTMLModElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore14HTMLModElement4citeEv
-__ZN7WebCore25jsHTMLTextAreaElementColsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsHTMLObjectElementStandbyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement7standbyEv
-__ZN7WebCore29jsHTMLFrameElementFrameBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLFrameElementBase11frameBorderEv
-__ZN7WebCore23jsHTMLTableColElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableColElement2chEv
-__ZN7WebCore26jsHTMLFrameElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLFrameElementBase8longDescEv
-__ZN7WebCore34jsNodePrototypeFunctionIsSupportedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore4Node11isSupportedERKNS_6StringES3_
-__ZN7WebCore26jsHTMLImageElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement8longDescEv
-__ZN7WebCore25jsHTMLOListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLOListElement7compactEv
-__ZN7WebCore30jsHTMLTableSectionElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore23HTMLTableSectionElement5chOffEv
-__ZN7WebCore22jsHTMLBodyElementALinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLBodyElement5aLinkEv
-__ZN7WebCore24jsHTMLTableCellElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement2chEv
-__ZN7WebCore26jsHTMLAreaElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLAreaElement9accessKeyEv
-__ZN7WebCore23jsHTMLButtonElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsHTMLFrameElementMarginHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLFrameElementBase12marginHeightEv
-__ZN7WebCore23jsHTMLTableElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement5alignEv
-__ZN7WebCore22jsHTMLParamElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLParamElement4typeEv
-__ZN7WebCore23jsHTMLObjectElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLMetaElementSchemeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLMetaElement6schemeEv
-__ZN7WebCore30jsHTMLIFrameElementMarginWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLFrameElementBase11marginWidthEv
-__ZN7WebCore31jsHTMLIFrameElementMarginHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLAppletElementObjectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAppletElement6objectEv
-__ZN7WebCore24jsHTMLAppletElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsHTMLAreaElementShapeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLAreaElement5shapeEv
-__ZN7WebCore20jsHTMLLinkElementRevEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLLinkElement3revEv
-__ZN7WebCore20jsHTMLAreaElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLAreaElement3altEv
-__ZN7WebCore26jsHTMLTableColElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableColElement5widthEv
-__ZN7WebCore24jsHTMLImageElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement6hspaceEv
-__ZN7WebCore26jsHTMLTableColElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableColElement5chOffEv
-__ZN7WebCore27jsHTMLTableSectionElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore23HTMLTableSectionElement2chEv
-__ZN7WebCore23jsHTMLTableElementFrameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement5frameEv
-__ZN7WebCore23jsHTMLTableRowElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableRowElement2chEv
-__ZN7WebCore23jsHTMLImageElementIsMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement5isMapEv
-__ZN7WebCore26jsHTMLBaseFontElementColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLBaseFontElement5colorEv
-__ZN7WebCore24jsHTMLHeadElementProfileEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLHeadElement7profileEv
-__ZN7WebCore31jsHTMLTableSectionElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore23HTMLTableSectionElement6vAlignEv
-__ZN7WebCore24jsHTMLImageElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement6vspaceEv
-__ZN7WebCore27jsHTMLTableCellElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement5chOffEv
-__ZN7WebCore30jsHTMLTableSectionElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore23HTMLTableSectionElement5alignEv
-__ZN7WebCore34jsHTMLOptionElementDefaultSelectedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLOptionElement15defaultSelectedEv
-__ZN7WebCore25jsHTMLBaseFontElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLBaseFontElement4sizeEv
-__ZN7WebCore23jsHTMLTableElementRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement5rulesEv
-__ZN7WebCore27jsHTMLFrameElementScrollingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLFrameElementBase9scrollingEv
-__ZNK7WebCore14HTMLCollection17checkForNameMatchEPNS_7ElementEbRKNS_12AtomicStringE
-__ZN7WebCore25jsHTMLFrameSetElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLFrameSetElement4rowsEv
-__ZN7WebCore29jsHTMLTableCellElementRowSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLTableElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement7bgColorEv
-__ZN7WebCore25jsHTMLAppletElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAppletElement6hspaceEv
-__ZN7WebCore22jsHTMLInputElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLTextAreaElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsHTMLTableElementCellSpacingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement11cellSpacingEv
-__ZN7WebCore25jsHTMLObjectElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement6vspaceEv
-__ZN7WebCore30jsHTMLTableCaptionElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore23HTMLTableCaptionElement5alignEv
-__ZN7WebCore27jsHTMLLabelElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLLabelElement9accessKeyEv
-__ZN7WebCore21jsHTMLFrameElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLLinkElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLLinkElement6targetEv
-__ZN7WebCore31jsHTMLTableCellElementCellIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement9cellIndexEv
-__ZN7WebCore24jsHTMLModElementDateTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore14HTMLModElement8dateTimeEv
-__ZN7WebCore24jsHTMLObjectElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLPlugInElement5alignEv
-__ZN7WebCore24jsHTMLOptionElementLabelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLOptionElement5labelEv
-__ZN7WebCore24jsHTMLLegendElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLLegendElement5alignEv
-__ZN7WebCore23jsHTMLLegendElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsHTMLTableRowElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableRowElement5chOffEv
-__ZN7WebCore24jsHTMLInputElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement6useMapEv
-__ZN7WebCore25jsHTMLTableElementSummaryEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement7summaryEv
-__ZN7WebCore28jsHTMLButtonElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLButtonElement9accessKeyEv
-__ZN7WebCore28jsHTMLTableCellElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement6heightEv
-__ZN7WebCore25jsHTMLTextAreaElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsHTMLLegendElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLLegendElement9accessKeyEv
-__ZN7WebCore25jsHTMLFrameSetElementColsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLFrameSetElement4colsEv
-__ZN7WebCore25jsHTMLDListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLDListElement7compactEv
-__ZN7WebCore25jsHTMLUListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLUListElement7compactEv
-__ZN7WebCore22jsHTMLAppletElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAppletElement3altEv
-__ZN7WebCore42jsHTMLSelectElementPrototypeFunctionRemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19JSHTMLSelectElement6removeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore24jsHTMLLinkElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLLinkElement7charsetEv
-__ZN7WebCore22jsHTMLQuoteElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLQuoteElement4citeEv
-__ZN7WebCore24jsHTMLIFrameElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLIFrameElement5alignEv
-__ZN7WebCore25jsHTMLObjectElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement6borderEv
-__ZN7WebCore26jsHTMLTableCellElementAbbrEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement4abbrEv
-__ZN7WebCore25jsHTMLObjectElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsHTMLTableCellElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement5alignEv
-__ZN7WebCore26jsHTMLFrameElementNoResizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsHTMLImageElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement6borderEv
-__ZN7WebCore21jsHTMLBodyElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLBodyElement4textEv
-__ZN7WebCore21jsHTMLPreElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore14HTMLPreElement5widthEv
-__ZN7WebCore23jsHTMLAppletElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsHTMLParamElementValueTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLParamElement9valueTypeEv
-__ZN7WebCore28jsHTMLTableCellElementNoWrapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement6noWrapEv
-__ZN7WebCore20jsHTMLHRElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13HTMLHRElement5widthEv
-__ZN7WebCore20jsHTMLHRElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13HTMLHRElement5alignEv
-__ZN7WebCore26jsHTMLStyleElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLStyleElement8disabledEv
-__ZN7WebCore27jsHTMLBodyElementBackgroundEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsHTMLTableCellElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLTableCellElement7bgColorEv
-__ZN7WebCore23jsHTMLOptionElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLAreaElementCoordsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLAreaElement6coordsEv
-__ZN7WebCore22jsHTMLLinkElementMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLLinkElement5mediaEv
-__ZN7WebCore29jsHTMLOptGroupElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsHTMLTableElementCellPaddingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement11cellPaddingEv
-__ZN7WebCore30jsHTMLTextAreaElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTextAreaElement9accessKeyEv
-__ZN7WebCore21jsHTMLBodyElementLinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLImageElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement5alignEv
-__ZN7WebCore24jsHTMLImageElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsHTMLTextAreaElementDefaultValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLDirectoryElement17endTagRequirementEv
-__ZNK7WebCore20HTMLDirectoryElement11tagPriorityEv
-__ZN7WebCore29jsHTMLDirectoryElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLDirectoryElement7compactEv
-__ZN7WebCore22jsHTMLFontElementColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLFontElement5colorEv
-__ZN7WebCore24jsHTMLAppletElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsHTMLBodyElementVLinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLFieldSetElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsHTMLMapElementAreasEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14HTMLMapElement5areasEv
-__ZN7WebCore25jsHTMLBaseFontElementFaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLBaseFontElement4faceEv
-__ZN7WebCore21jsHTMLFontElementFaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLFontElement4faceEv
-__ZN7WebCore23jsHTMLObjectElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLAppletElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAppletElement6vspaceEv
-__ZN7WebCore25jsHTMLLinkElementHreflangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLLinkElement8hreflangEv
-__ZN7WebCore22jsHTMLHRElementNoShadeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13HTMLHRElement7noShadeEv
-__ZN7WebCore22jsHTMLLabelElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLTableColElementSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsHTMLInputElementReadOnlyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsHTMLAppletElementArchiveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAppletElement7archiveEv
-__ZN7WebCore27jsHTMLParagraphElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLParagraphElement5alignEv
-__ZN7WebCore26jsHTMLTableRowElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19HTMLTableRowElement5alignEv
-__ZN7WebCore19jsHTMLHRElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13HTMLHRElement4sizeEv
-__ZN7WebCore22jsHTMLFrameElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsHTMLIFrameElementScrollingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsHTMLFontElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLFontElement4sizeEv
-__ZN7WebCore25jsHTMLAppletElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsHTMLIFrameElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsHTMLAppletElementCodeBaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLAppletElement8codeBaseEv
-__ZN7WebCore30jsHTMLIFrameElementFrameBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsHTMLInputElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement9accessKeyEv
-__ZN7WebCore20jsHTMLBRElementClearEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13HTMLBRElement5clearEv
-__ZN7WebCore27jsHTMLBlockquoteElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21HTMLBlockquoteElement4citeEv
-__ZN7WebCore23jsHTMLTableElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLTableElement5widthEv
-__ZN7WebCore29jsHTMLFrameElementMarginWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLStyleElementMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsHTMLFrameElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLOListElementStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsHTMLInputElementDefaultCheckedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement14defaultCheckedEv
-__ZN7WebCore29jsHTMLTextAreaElementReadOnlyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLInputElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement5alignEv
-__ZN7WebCore24jsHTMLHtmlElementVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15HTMLHtmlElement7versionEv
-__ZN7WebCore24jsHTMLInputElementAcceptEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement6acceptEv
-__ZN7WebCore26jsHTMLObjectElementDeclareEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement7declareEv
-__ZN7WebCore26jsHTMLScriptElementHtmlForEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLScriptElement7htmlForEv
-__ZN7WebCore24jsHTMLScriptElementEventEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLScriptElement5eventEv
-__ZN7WebCore24jsHTMLScriptElementDeferEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLScriptElement5deferEv
-__ZN7WebCore26jsHTMLScriptElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLScriptElement7charsetEv
-__ZThn56_NK7WebCore17HTMLScriptElement13scriptCharsetEv
-__ZN7WebCore12XMLTokenizer12pauseParsingEv
-__ZN3WTF5DequeIPN7WebCore16PendingCallbacks15PendingCallbackEE14expandCapacityEv
-__ZThn8_N7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore12XMLTokenizer13resumeParsingEv
-__ZN7WebCore16PendingCallbacks25PendingCharactersCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore16PendingCallbacks25PendingCharactersCallbackD1Ev
-__ZN7WebCore16PendingCallbacks29PendingStartElementNSCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore16PendingCallbacks27PendingEndElementNSCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore16PendingCallbacks27PendingEndElementNSCallbackD1Ev
-__ZN7WebCore43jsDocumentPrototypeFunctionCreateNSResolverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document16createNSResolverEPNS_4NodeE
-__ZN7WebCore14XPathEvaluator16createNSResolverEPNS_4NodeE
-__ZN7WebCore21NativeXPathNSResolverC2EN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15XPathNSResolverE
-__ZN7WebCore17JSXPathNSResolver15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSXPathNSResolverC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathNSResolverEEE
-__ZNK7WebCore17JSXPathNSResolver9classInfoEv
-__ZN7WebCore28jsXPathResultSingleNodeValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11XPathResult15singleNodeValueERi
-__ZN7WebCore8SVGTests16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore12SVGLangSpace16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore28SVGExternalResourcesRequired16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore29SVGStyledTransformableElement16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore16SVGTransformable16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore16SVGStyledElement16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore5XPath13isRootDomNodeEPNS_4NodeE
-__ZN7WebCore24jsXPathResultStringValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11XPathResult11stringValueERi
-__ZN3WTF15deleteAllValuesIPN7WebCore5XPath9ParseNodeEKNS_9HashTableIS4_S4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESB_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore6StringEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EESA_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore5XPath4Step8NodeTestEKNS_9HashTableIS5_S5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESC_EEEEvRT0_
-__ZN7WebCore43jsDocumentPrototypeFunctionCreateExpressionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E4fin
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E47re
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E6rem
+__ZN7WebCore43jsDocumentPrototypeFunctionCreateExpressionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15XPathExpressionE
-__ZN7WebCore17JSXPathExpression15createPrototypeEPN3JSC9ExecStateE
+__ZN7WebCore17JSXPathExpression15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore17JSXPathExpressionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathExpressionEEE
-__ZN7WebCore17JSXPathExpression18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSXPathExpressionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsXPathExpressionPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore17JSXPathExpression9classInfoEv
-__ZN7WebCore23jsXPathResultResultTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsXPathResultBooleanValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11XPathResult12booleanValueERi
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14XPathExceptionE
-__ZN7WebCore16JSXPathExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathExceptionEEE
-__ZN7WebCore16JSXPathException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSXPathExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20jsXPathExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsXPathResultNumberValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11XPathResult11numberValueERi
-__ZN7WebCore41jsXPathResultPrototypeFunctionIterateNextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11XPathResult11iterateNextERi
-__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByTagNameNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26JSXPathNSResolverPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore52jsXPathNSResolverPrototypeFunctionLookupNamespaceURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore17JSXPathExpressionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathExpressionEEE
 __ZN7WebCore21NativeXPathNSResolver18lookupNamespaceURIERKNS_6StringE
-__ZN7WebCore33jsXPathResultInvalidIteratorStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore11XPathResult20invalidIteratorStateEv
 __ZNK7WebCore4Node18lookupNamespaceURIERKNS_6StringE
 __ZN7WebCore5XPathL14createFunCountEv
 __ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEiNS0_9NumericOp6OpcodeEi
 __ZN7WebCore5XPathL11createFunIdEv
 __ZN7WebCore5XPathL21createFunNamespaceURIEv
+__ZN7WebCore5XPathL13createFunNameEv
 __ZN7WebCore5XPathL15createFunStringEv
 __ZN7WebCore5XPathL19createFunStartsWithEv
 __ZN7WebCore5XPathL24createFunSubstringBeforeEv
@@ -15365,97 +13467,331 @@
 __ZN7WebCore5XPathL14createFunFloorEv
 __ZN7WebCore5XPathL16createFunCeilingEv
 __ZN7WebCore5XPathL14createFunRoundEv
+__ZN7WebCore17JSXPathExpressionD1Ev
+__ZN7WebCore17JSXPathExpressionD2Ev
+__ZN7WebCore5XPath5UnionD0Ev
+__ZN7WebCore5XPath8FunCountD0Ev
+__ZN7WebCore5XPath8NegativeD0Ev
+__ZN7WebCore5XPath5FunIdD0Ev
+__ZN7WebCore5XPath15FunNamespaceURID0Ev
+__ZN7WebCore5XPath7FunNameD0Ev
+__ZN7WebCore5XPath9FunStringD0Ev
+__ZN7WebCore5XPath13FunStartsWithD0Ev
+__ZN7WebCore5XPath18FunSubstringBeforeD0Ev
+__ZN7WebCore5XPath17FunSubstringAfterD0Ev
+__ZN7WebCore5XPath12FunSubstringD0Ev
+__ZN7WebCore5XPath15FunStringLengthD0Ev
+__ZN7WebCore5XPath17FunNormalizeSpaceD0Ev
+__ZN7WebCore5XPath12FunTranslateD0Ev
+__ZN7WebCore5XPath10FunBooleanD0Ev
+__ZN7WebCore5XPath7FunTrueD0Ev
+__ZN7WebCore5XPath8FunFalseD0Ev
+__ZN7WebCore5XPath7FunLangD0Ev
+__ZN7WebCore5XPath9FunNumberD0Ev
+__ZN7WebCore5XPath8FunFloorD0Ev
+__ZN7WebCore5XPath10FunCeilingD0Ev
+__ZN7WebCore5XPath8FunRoundD0Ev
+__ZNK7WebCore5XPath5FunId8evaluateEv
+__ZN7WebCore26JSXPathExpressionPrototypeD1Ev
+__ZN7WebCore23JSProcessingInstruction15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSProcessingInstructionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21ProcessingInstructionEEE
+__ZN7WebCore23JSProcessingInstructionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21ProcessingInstructionEEE
+__ZN7WebCore23JSProcessingInstruction18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSProcessingInstructionD1Ev
+__ZN7WebCore14JSCDATASection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSTextPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSCDATASectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CDATASectionEEE
+__ZN7WebCore14JSCDATASectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CDATASectionEEE
+__ZN7WebCore14JSCDATASectionD1Ev
+__ZN7WebCore32JSProcessingInstructionPrototypeD1Ev
+__ZN7WebCore23JSCDATASectionPrototypeD1Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore5XPath9ParseNodeEKNS_9HashTableIS4_S4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10Has
+__ZN3WTF9HashTableIPNS_6VectorIPN7WebCore5XPath9PredicateELm0EEES7_NS_17IdentityExtractorIS7_EENS_7PtrHashIS7_EENS_10HashTraits
+__ZN3WTF9HashTableIPNS_6VectorIPN7WebCore5XPath10ExpressionELm0EEES7_NS_17IdentityExtractorIS7_EENS_7PtrHashIS7_EENS_10HashTrai
+__ZN3WTF15deleteAllValuesIPN7WebCore6StringEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN3WTF15deleteAllValuesIPN7WebCore5XPath4Step8NodeTestEKNS_9HashTableIS5_S5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_1
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E5cle
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14XPathExceptionE
+__ZN7WebCore16JSXPathException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSXPathExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathExceptionEEE
+__ZN7WebCore16JSXPathExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathExceptionEEE
+__ZN7WebCore16JSXPathException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSXPathExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsXPathExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSXPathExceptionD1Ev
+__ZN7WebCore16JSXPathExceptionD2Ev
+__ZN7WebCore25JSXPathExceptionPrototypeD1Ev
+__ZNK7WebCore4Node15ancestorElementEv
+__ZN7WebCore15EntityReferenceC1EPNS_8DocumentERKNS_6StringE
 __ZN7WebCore15EntityReferenceC2EPNS_8DocumentERKNS_6StringE
 __ZNK7WebCore15EntityReference8nodeTypeEv
+__ZN7WebCore17JSEntityReference15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore17JSEntityReferenceC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15EntityReferenceEEE
+__ZN7WebCore17JSEntityReferenceC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15EntityReferenceEEE
 __ZNK7WebCore17JSEntityReference9classInfoEv
-__ZNK7WebCore5XPath5FunId8evaluateEv
-__ZN7WebCore48jsElementPrototypeFunctionGetElementsByTagNameNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore4Node15ancestorElementEv
+__ZN7WebCore17JSEntityReferenceD1Ev
+__ZThn8_N7WebCore15EntityReferenceD0Ev
+__ZN7WebCore15EntityReferenceD0Ev
 __ZNK7WebCore5XPath9FunString8evaluateEv
-__ZN7WebCore5XPath15FunNamespaceURID1Ev
-__ZN7WebCore17JSEntityReferenceD0Ev
-__ZN7WebCore23JSProcessingInstruction18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore5XPath13isRootDomNodeEPNS_4NodeE
+__ZN7WebCore26JSEntityReferencePrototypeD1Ev
+__ZN7WebCore17JSXPathExpression18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26JSXPathExpressionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsXPathExpressionPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17JSXPathExpression9classInfoEv
+__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByTagNameNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore48jsElementPrototypeFunctionGetElementsByTagNameNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSXPathNSResolverPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore52jsXPathNSResolverPrototypeFunctionLookupNamespaceURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12RenderObject10nextOffsetEi
+__ZN7WebCore12jsNodePrefixEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element13virtualPrefixEv
+__ZN7WebCore23jsXPathResultResultTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsXPathResultBooleanValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult12booleanValueERi
+__ZN7WebCore24jsXPathResultNumberValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult11numberValueERi
+__ZN7WebCore28jsXPathResultSingleNodeValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult15singleNodeValueERi
+__ZN7WebCore24jsXPathResultStringValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult11stringValueERi
+__ZN7WebCore33jsXPathResultInvalidIteratorStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult20invalidIteratorStateEv
 __ZNK7WebCore5XPath18FunSubstringBefore8evaluateEv
-__ZN7WebCore13RenderSVGText5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore16SVGRootInlineBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE5startEPNS_9InlineBoxE
-__ZN7WebCore27SVGRootInlineBoxPaintWalker18chunkStartCallbackEPNS_9InlineBoxE
-__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE9setupFillEPNS_9InlineBoxE
-__ZN7WebCore27SVGRootInlineBoxPaintWalker22chunkSetupFillCallbackEPNS_9InlineBoxE
-__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGCharESB_
-__ZN7WebCore27SVGRootInlineBoxPaintWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGCharES9_
-__ZN7WebCore16SVGInlineTextBox15paintCharactersERNS_12RenderObject9PaintInfoEiiRKNS_7SVGCharEPKtiPNS_14SVGPaintServerE
-__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE11setupStrokeEPNS_9InlineBoxE
-__ZN7WebCore27SVGRootInlineBoxPaintWalker24chunkSetupStrokeCallbackEPNS_9InlineBoxE
-__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE3endEPNS_9InlineBoxE
-__ZN7WebCore27SVGRootInlineBoxPaintWalker16chunkEndCallbackEPNS_9InlineBoxE
 __ZNK7WebCore5XPath7NodeSet7anyNodeEv
-__ZN7WebCore26setJSHTMLTableElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
+__ZN7WebCore15jsNodeLocalNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn112_NK7WebCore17HTMLScriptElement13scriptContentEv
+__ZNK7WebCore17HTMLScriptElement13scriptContentEv
+__ZN7WebCore26setJSHTMLTableElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLTableElement8setWidthERKNS_6StringE
-__ZN7WebCore22jsDocumentTypeEntitiesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore14JSCDATASection9classInfoEv
+__ZThn8_N7WebCore12CDATASectionD0Ev
+__ZNK7WebCore7Element8nodeNameEv
 __ZN7WebCore29jsProcessingInstructionTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore27jsProcessingInstructionDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsDocumentTypeNotationsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23JSProcessingInstruction9classInfoEv
+__ZN7WebCore22jsDocumentTypeEntitiesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore21ProcessingInstruction8nodeNameEv
 __ZN7WebCore17JSEntityReference18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21ProcessingInstruction18offsetInCharactersEv
-__ZNK7WebCore21ProcessingInstruction18maxCharacterOffsetEv
+__ZN7WebCore43jsDOMCoreExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSDOMCoreException9classInfoEv
+__ZNK7WebCore13ExceptionBase8toStringEv
+__ZN7WebCore23jsDocumentTypeNotationsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL14mapConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
 __ZNK7WebCore21JSHTMLFrameSetElement9classInfoEv
-__ZN7WebCore28setJSHTMLFormElementEncodingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLFormElement10setEnctypeERKNS_6StringE
-__ZN7WebCore39jsCSSStyleSheetPrototypeFunctionAddRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_Ri
-__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_iRi
-__ZN7WebCore27setJSEventTargetNodeOnpasteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode10setOnpasteEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore26setJSEventTargetNodeOndropEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15EventTargetNode9setOndropEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9DOMWindow8scrollByEii
+__ZNK7WebCore9Tokenizer14processingDataEv
+__ZN7WebCoreL18isindexConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZNK7WebCore11FrameLoader16responseMIMETypeEv
+__ZN7WebCore13ImageDocument17windowSizeChangedEv
+__ZNK7WebCore13ImageDocument17imageFitsInWindowEv
+__ZN7WebCore13ImageDocument16resizeImageToFitEv
+__ZNK7WebCore13ImageDocument5scaleEv
+__ZNK7WebCore13ImageDocument15isImageDocumentEv
+__ZN7WebCore18ImageEventListenerD0Ev
+__ZN7WebCore12IconDatabase25removeIconFromSQLDatabaseERKNS_6StringE
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE14expandCapacityEm
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE15reserveCapacityEm
+__ZN3WTF6VectorItLm2048EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm2048EE14expandCapacityEm
+__ZN3WTF6VectorItLm2048EE15reserveCapacityEm
+__ZN3WTF6VectorI6CGSizeLm2048EE14expandCapacityEmPKS1_
+__ZN3WTF6VectorI6CGSizeLm2048EE14expandCapacityEm
+__ZN3WTF6VectorI6CGSizeLm2048EE15reserveCapacityEm
+__ZN7WebCore13HTMLTokenizer11parseServerERNS_15SegmentedStringENS0_5StateE
+__ZN7WebCore31jsDOMWindowDOMParserConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSDOMParser14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore22JSDOMParserConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore20JSDOMParserPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSDOMParser15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSDOMParserConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSDOMParserConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCore22JSDOMParserConstructor9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9DOMParserE
+__ZN7WebCore11JSDOMParserC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMParserEEE
+__ZN7WebCore11JSDOMParserC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMParserEEE
+__ZN7WebCore11JSDOMParser18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSDOMParserPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsDOMParserPrototypeFunctionParseFromStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSDOMParser9classInfoEv
+__ZN7WebCore9DOMParser15parseFromStringERKNS_6StringES3_
+__ZN7WebCore9Tokenizer35executeScriptsWaitingForStylesheetsEv
+__ZN7WebCore7Element26copyNonAttributePropertiesEPKS0_
+__ZNK7WebCore9Attribute5cloneEv
+__ZNK7WebCore4Attr13virtualPrefixEv
+__ZNK7WebCore4Attr6prefixEv
+__ZN7WebCore37jsDocumentPrototypeFunctionImportNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document10importNodeEPNS_4NodeEbRi
+__ZNK7WebCore4Attr16virtualLocalNameEv
+__ZNK7WebCore4Attr9localNameEv
+__ZN7WebCore11JSDOMParserD1Ev
+__ZN7WebCore11JSDOMParserD2Ev
+__ZN7WebCore20jsNodeATTRIBUTE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNodeCDATA_SECTION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsNodeCOMMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsNodeDOCUMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsNodeDOCUMENT_FRAGMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSDOMParserPrototypeD1Ev
+__ZN7WebCore22JSDOMParserConstructorD1Ev
+__ZNK7WebCore17HTMLScriptElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore17HTMLIFrameElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore17CSSInheritedValue7cssTextEv
+__ZNK7WebCore17JSHTMLFontElement9classInfoEv
+__ZNK7WebCore15JSHTMLHRElement9classInfoEv
+__ZN7WebCore26setJSHTMLFormElementMethodEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement9setMethodERKNS_6StringE
+__ZN7WebCore26setJSHTMLFormElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement9setTargetERKNS_6StringE
+__ZN7WebCore14jsNodeOnchangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onchangeEv
 __ZN7WebCore21jsHTMLDocumentBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore12HTMLDocument7bgColorEv
-__ZN7WebCore39setJSHTMLOptionsCollectionSelectedIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore21HTMLOptionsCollection16setSelectedIndexEi
-__ZN7WebCore24setJSHTMLAreaElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLAreaElement7setHrefERKNS_6StringE
-__ZN7WebCore23setJSHTMLAreaElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLAreaElement6setAltERKNS_6StringE
-__ZN7WebCore26setJSHTMLOListElementStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLOListElement8setStartEi
-__ZN7WebCore12HTMLDocument8hasFocusEv
-__ZN7WebCore10CachedFontD1Ev
-__ZN7WebCore25jsEventTargetNodeOnresizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode8onresizeEv
+__ZN7WebCore19JSHTMLCanvasElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore28setJSHTMLCanvasElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLCanvasElement9setHeightEi
+__ZN7WebCore27setJSHTMLCanvasElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLCanvasElement8setWidthEi
+__ZN7WebCore24jsHTMLCanvasElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLCanvasElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClearRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9clearRectEffff
+__ZN7WebCore15GraphicsContext9clearRectERKNS_9FloatRectE
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4rectEffff
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClosePathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9closePathEv
+__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradientEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS
+__ZN7WebCore24CanvasRenderingContext2D20createLinearGradientEffffRi
+__ZN7WebCore14CanvasGradientC1ERKNS_10FloatPointES3_
+__ZN7WebCore14CanvasGradientC2ERKNS_10FloatPointES3_
+__ZNK7WebCore24CanvasRenderingContext2D27prepareGradientForDashboardEPNS_14CanvasGradientE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14CanvasGradientE
+__ZN7WebCore16JSCanvasGradient15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSCanvasGradientC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CanvasGradientEEE
+__ZN7WebCore16JSCanvasGradientC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CanvasGradientEEE
+__ZN7WebCore25JSCanvasGradientPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore45jsCanvasGradientPrototypeFunctionAddColorStopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSCanvasGradient9classInfoEv
+__ZN7WebCore14CanvasGradient12addColorStopEfRKNS_6StringERi
+__ZN7WebCore9CSSParser10parseColorERjRKNS_6StringEb
+__ZN7WebCore9CSSParser10parseColorEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
+__ZN3WTF12bitwise_castIdlEET_T0_
+__ZN7WebCore38setJSCanvasRenderingContext2DFillStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26JSCanvasRenderingContext2D12setFillStyleEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore11CanvasStyleC1EN3WTF10PassRefPtrINS_14CanvasGradientEEE
+__ZN7WebCore11CanvasStyleC2EN3WTF10PassRefPtrINS_14CanvasGradientEEE
+__ZN7WebCore24CanvasRenderingContext2D12setFillStyleEN3WTF10PassRefPtrINS_11CanvasStyleEEE
+__ZN7WebCore11CanvasStyle14applyFillColorEPNS_15GraphicsContextE
+__ZN7WebCore15GraphicsContext15setFillGradientEN3WTF10PassRefPtrINS_8GradientEEE
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionFillEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4fillEv
+__ZNSt17_Temporary_bufferIPN7WebCore8Gradient9ColorStopES2_EC1ES3_S3_
+__ZNSt17_Temporary_bufferIPN7WebCore8Gradient9ColorStopES2_EC2ES3_S3_
+__ZSt22__get_temporary_bufferIN7WebCore8Gradient9ColorStopEESt4pairIPT_lElS5_
+__ZSt26__uninitialized_fill_n_auxIPN7WebCore8Gradient9ColorStopElS2_EvT_T0_RKT1_St12__false_type
+__ZSt22__stable_sort_adaptiveIPN7WebCore8Gradient9ColorStopES3_lPFbRKS2_S5_EEvT_S8_T0_T1_T2_
+__ZSt24__merge_sort_with_bufferIPN7WebCore8Gradient9ColorStopES3_PFbRKS2_S5_EEvT_S8_T0_T1_
+__ZSt22__chunk_insertion_sortIPN7WebCore8Gradient9ColorStopElPFbRKS2_S5_EEvT_S8_T0_T1_
+__ZSt16__insertion_sortIPN7WebCore8Gradient9ColorStopEPFbRKS2_S5_EEvT_S8_T0_
+__ZN7WebCoreL12compareStopsERKNS_8Gradient9ColorStopES3_
+__ZSt25__unguarded_linear_insertIPN7WebCore8Gradient9ColorStopES2_PFbRKS2_S5_EEvT_T0_T1_
+__ZSt16__merge_adaptiveIPN7WebCore8Gradient9ColorStopElS3_PFbRKS2_S5_EEvT_S8_S8_T0_S9_T1_S9_T2_
+__ZSt16__merge_backwardIPN7WebCore8Gradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
+__ZSt23return_temporary_bufferIN7WebCore8Gradient9ColorStopEEvPT_
+__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradientEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS
+__ZN7WebCore24CanvasRenderingContext2D20createRadialGradientEffffffRi
+__ZN7WebCore14CanvasGradientC1ERKNS_10FloatPointEfS3_f
+__ZN7WebCore14CanvasGradientC2ERKNS_10FloatPointEfS3_f
+__ZN7WebCore8GradientC1ERKNS_10FloatPointEfS3_f
+__ZN7WebCore8GradientC2ERKNS_10FloatPointEfS3_f
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionSaveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4saveEv
+__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE15reserveCapacityEm
+__ZN7WebCore59jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7A
+__ZN7WebCore24CanvasRenderingContext2D16quadraticCurveToEffff
+__ZN7WebCore4Path14addQuadCurveToERKNS_10FloatPointES3_
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionClipEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4clipEv
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionDrawImageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSCanvasRenderingContext2D9drawImageEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEffffRi
+__ZN7WebCoreL4sizeEPNS_16HTMLImageElementE
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementERKNS_9FloatRectES5_Ri
+__ZN7WebCore24CanvasRenderingContext2D11checkOriginERKNS_4KURLE
+__ZNK7WebCore11BitmapImage23hasSingleSecurityOriginEv
+__ZSt5mergeIPN7WebCore8Gradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
+__ZN7WebCore15GraphicsContext17setStrokeGradientEN3WTF10PassRefPtrINS_8GradientEEE
+__ZN7WebCore16JSCanvasGradientD1Ev
+__ZN7WebCore16JSCanvasGradientD2Ev
+__ZThn8_N7WebCore17HTMLCanvasElementD0Ev
+__ZN7WebCore25JSCanvasGradientPrototypeD1Ev
+__ZN7WebCore33jsDOMWindowXMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsDOMWindowXMLSerializerConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSXMLSerializer14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSXMLSerializerConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSXMLSerializerPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSXMLSerializer15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSXMLSerializerPrototypeD1Ev
+__ZN7WebCore26JSXMLSerializerConstructorD1Ev
+__ZN7WebCore20jsMessageEventOriginEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL25max_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore29setJSHTMLScriptElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement10setCharsetERKNS_6StringE
+__ZN7WebCore26setJSHTMLImageElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement8setAlignERKNS_6StringE
+__ZN7WebCore17jsNodeOnmousedownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node11onmousedownEv
+__ZN7WebCore13jsNodeOnresetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onresetEv
+__ZNK7WebCore26CSSMutableStyleDeclaration17getShorthandValueEPKii
+__ZN7WebCore48jsHTMLElementPrototypeFunctionInsertAdjacentHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11HTMLElement18insertAdjacentHTMLERKNS_6StringES3_Ri
+__ZN7WebCore11HTMLElement14insertAdjacentERKNS_6StringEPNS_4NodeERi
+__ZN7WebCore14RenderTableRow12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore9StyleBase11checkLoadedEv
+__ZN7WebCore10ShadowDataC1ERKS0_
+__ZN7WebCore10ShadowDataC2ERKS0_
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE15reserveCapacityEm
+__ZN7WebCore28jsHTMLHtmlElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLHtmlElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLHtmlElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore16JSHTMLModElement9classInfoEv
+__ZN7WebCore16PendingCallbacks25PendingCDATABlockCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks25PendingCDATABlockCallbackD0Ev
+__ZN7WebCore16PendingCallbacks36PendingProcessingInstructionCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks36PendingProcessingInstructionCallbackD0Ev
+__ZN7WebCore21ProcessingInstruction19removedFromDocumentEv
+__ZN7WebCore28JSHTMLHtmlElementConstructorD1Ev
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9translateEff
+__ZN7WebCore4Path9transformERKNS_20TransformationMatrixE
+__ZN7WebCore50jsCanvasRenderingContext2DPrototypeFunctionRestoreEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D7restoreEv
+__ZN7WebCore37setJSCanvasRenderingContext2DLineJoinEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D11setLineJoinERKNS_6StringE
+__ZN7WebCore13parseLineJoinERKNS_6StringERNS_8LineJoinE
+__ZN7WebCore14JSCDATASection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore12CDATASection8nodeNameEv
-__ZN7WebCore27setJSHTMLDocumentDesignModeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore12HTMLDocument13setDesignModeERKNS_6StringE
-__ZN7WebCore8Document13setDesignModeENS0_13InheritedBoolE
-__ZN7WebCore30jsEventTargetNodeOncontextmenuEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EventTargetNode13oncontextmenuEv
-__ZNK7WebCore21JSHTMLOptGroupElement9classInfoEv
-__ZN7WebCore28setJSHTMLTextAreaElementRowsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTextAreaElement7setRowsEi
-__ZN7WebCore55jsHTMLTextAreaElementPrototypeFunctionSetSelectionRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16RenderHTMLCanvas17canvasSizeChangedEv
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D9transformEffffff
-__ZN7WebCore11crossCursorEv
-__ZN7WebCore37jsCanvasRenderingContext2DShadowColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore24CanvasRenderingContext2D11shadowColorEv
-__ZN7WebCore13RenderListBox32scrollToRevealElementAtListIndexEi
-__ZThn8_N7WebCore14XMLHttpRequest7didFailEv
-__ZN7WebCore14XMLHttpRequest7didFailEv
-__ZN7WebCore31setJSHTMLAnchorElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAnchorElement12setAccessKeyERKNS_12AtomicStringE
-__ZN7WebCoreL9matchFuncEPKc
-__ZN7WebCoreL30newStreamingTextDecoderUTF16BEERKNS_12TextEncodingEPKv
+__ZNK7WebCore12RenderInline12offsetHeightEv
+__ZN7WebCore23setJSDocumentXMLVersionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15parseAttributesERKNS_6StringERb
+__ZN7WebCoreL31attributesStartElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10Hash
+__ZNK3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3getERKS2_
 __ZN7WebCore9DocLoader20requestXSLStyleSheetERKNS_6StringE
 __ZN7WebCore19CachedXSLStyleSheetC1ERKNS_6StringE
+__ZN7WebCore19CachedXSLStyleSheetC2ERKNS_6StringE
 __ZN7WebCore19CachedXSLStyleSheet9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore12XMLTokenizer11stopParsingEv
 __ZN7WebCore18xmlDocPtrForStringEPNS_9DocLoaderERKNS_6StringES4_
-__ZN7WebCore27setLoaderForLibXMLCallbacksEPNS_9DocLoaderE
+__ZN7WebCore17XMLTokenizerScopeC1EPNS_9DocLoaderEPFvPvPKczEPFvS3_P9_xmlErrorES3_
+__ZN7WebCore17XMLTokenizerScopeC2EPNS_9DocLoaderEPFvPvPKczEPFvS3_P9_xmlErrorES3_
+__ZN7WebCoreL9matchFuncEPKc
 __ZN7WebCoreL8openFuncEPKc
 __ZN7WebCoreL23shouldAllowExternalLoadERKNS_4KURLE
 __ZN7WebCoreL8readFuncEPvPci
@@ -15463,95 +13799,448 @@
 __ZN7WebCore8Document18setTransformSourceEPv
 __ZN7WebCore19CachedXSLStyleSheet5errorEv
 __ZN7WebCore19CachedXSLStyleSheet11checkNotifyEv
-__ZThn44_N7WebCore21ProcessingInstruction16setXSLStyleSheetERKNS_6StringES3_
+__ZThn88_N7WebCore21ProcessingInstruction16setXSLStyleSheetERKNS_6StringES3_
 __ZN7WebCore21ProcessingInstruction16setXSLStyleSheetERKNS_6StringES3_
+__ZN7WebCore13XSLStyleSheetC1EPNS_4NodeERKNS_6StringEb
 __ZN7WebCore13XSLStyleSheetC2EPNS_4NodeERKNS_6StringEb
+__ZN7WebCore21ProcessingInstruction15parseStyleSheetERKNS_6StringE
 __ZN7WebCore13XSLStyleSheet11parseStringERKNS_6StringEb
 __ZN7WebCore13XSLStyleSheet9docLoaderEv
 __ZN7WebCore13XSLStyleSheet15loadChildSheetsEv
 __ZN7WebCore13XSLStyleSheet8documentEv
+__ZN7WebCore14CachedResource17allClientsRemovedEv
 __ZN7WebCore13XSLStyleSheet11checkLoadedEv
 __ZN7WebCore13XSLStyleSheet9isLoadingEv
+__ZN7WebCore21ProcessingInstruction11sheetLoadedEv
+__ZNK7WebCore21ProcessingInstruction9isLoadingEv
 __ZN7WebCore8Document17applyXSLTransformEPNS_21ProcessingInstructionE
 __ZN7WebCore13XSLTProcessor17transformToStringEPNS_4NodeERNS_6StringES4_S4_
 __ZL21initxsltSetLoaderFuncPFP7_xmlDocPKhP8_xmlDictiPv12xsltLoadTypeE
-__ZN7WebCore14CachedResource17allClientsRemovedEv
-__ZN7WebCore16PendingCallbacks25PendingCDATABlockCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore16PendingCallbacks25PendingCDATABlockCallbackD1Ev
-__ZN7WebCore36jsDocumentPrototypeFunctionAdoptNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document9adoptNodeEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN7WebCore35jsNodePrototypeFunctionLookupPrefixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore4Node12lookupPrefixERKNS_12AtomicStringE
-__ZNK7WebCore4Node21lookupNamespacePrefixERKNS_12AtomicStringEPKNS_7ElementE
-__ZN7WebCore41jsNodePrototypeFunctionIsDefaultNamespaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore4Node18isDefaultNamespaceERKNS_12AtomicStringE
+__ZN7WebCore13XSLStyleSheetD0Ev
+__ZN7WebCore19CachedXSLStyleSheetD0Ev
+__ZN7WebCore7Element14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore21jsHTMLElementChildrenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26setJSHTMLScriptElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement7setTextERKNS_6StringE
 __ZN7WebCore16PendingCallbacks22PendingCommentCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore16PendingCallbacks22PendingCommentCallbackD1Ev
-__ZN7WebCore34jsNodePrototypeFunctionIsEqualNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore4Node11isEqualNodeEPS0_
-__ZNK7WebCore4Attr16virtualLocalNameEv
-__ZNK7WebCore4Attr9localNameEv
-__ZNK7WebCore4Attr13virtualPrefixEv
-__ZNK7WebCore4Attr6prefixEv
-__ZN7WebCore7Element26copyNonAttributePropertiesEPKS0_
+__ZN7WebCore16PendingCallbacks22PendingCommentCallbackD0Ev
+__ZN7WebCore36jsDocumentPrototypeFunctionAdoptNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document9adoptNodeEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZNK7WebCore15EntityReference8nodeNameEv
+__ZNK7WebCore14JSDocumentType9classInfoEv
+__ZNK7WebCore21ProcessingInstruction9nodeValueEv
+__ZNK7WebCore14RenderFrameSet8edgeInfoEv
+__ZN7WebCore17jsDOMWindowOnblurEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6onblurEv
+__ZN7WebCore20setJSDOMWindowOnblurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow9setOnblurEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17jsTextConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSText14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSTextConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27jsHTMLModElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLModElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLModElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZThn8_N7WebCore21ProcessingInstructionD0Ev
+__ZN7WebCore17JSTextConstructorD1Ev
+__ZN7WebCore27JSHTMLModElementConstructorD1Ev
 __ZN7WebCore8Document15canReplaceChildEPNS_4NodeES2_
-__ZN7WebCore16PendingCallbacks36PendingProcessingInstructionCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore16PendingCallbacks36PendingProcessingInstructionCallbackD1Ev
-__ZNK7WebCore4Node13virtualPrefixEv
-__ZN7WebCore44jsElementPrototypeFunctionSetAttributeNodeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore22jsDocumentTypeSystemIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsDocumentDocumentURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsDocumentInputEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsDocumentXMLEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsDocumentXMLStandaloneEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsDocumentXMLVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10IconLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore23JSHTMLBlockquoteElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSDocumentDocumentURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document14setDocumentURIERKNS_6StringE
+__ZN7WebCore26setJSDocumentXMLStandaloneEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSCustomXPathNSResolverC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore23JSCustomXPathNSResolverC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore23JSCustomXPathNSResolverD0Ev
+__ZN7WebCore40jsElementPrototypeFunctionScrollIntoViewEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element14scrollIntoViewEb
+__ZN7WebCore17JSHTMLBaseElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+-[WebCoreSynchronousLoader connection:didFailWithError:]
+__ZN7WebCore20ResourceResponseBase17setHTTPStatusCodeEi
+__ZN7WebCore40jsElementPrototypeFunctionGetAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element14getAttributeNSERKNS_6StringES3_
+__ZN7WebCore26setJSDOMWindowOnmousewheelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow15setOnmousewheelEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore44jsElementPrototypeFunctionSetAttributeNodeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore9JSElement18setAttributeNodeNSEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZN7WebCore7Element18setAttributeNodeNSEPNS_4AttrERi
-__ZN7WebCore44jsElementPrototypeFunctionGetAttributeNodeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore23setJSDocumentXMLVersionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore4Node11removeChildEPS0_Ri
-__ZN7WebCore24setJSDocumentDocumentURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore8Document14setDocumentURIERKNS_6StringE
-__ZN7WebCore21jsDocumentDocumentURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsNodePrototypeFunctionLookupNamespaceURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16PendingCallbacks20PendingErrorCallback4callEPNS_12XMLTokenizerE
-__ZNK7WebCore21ProcessingInstruction9nodeValueEv
-__ZN7WebCore23jsDocumentXMLStandaloneEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15EntityReference8nodeNameEv
-__ZN7WebCore23jsDocumentInputEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9CSSParser16parseFontFaceSrcEv
+__ZN7WebCore9CSSParser18createFontFaceRuleEv
+__ZN7WebCore15CSSFontFaceRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore15CSSFontFaceRuleC2EPNS_13CSSStyleSheetE
+__ZN7WebCore15CSSFontFaceRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
+__ZN7WebCore15CSSFontFaceRule14isFontFaceRuleEv
+__ZN7WebCore15CSSFontSelector15addFontFaceRuleEPKNS_15CSSFontFaceRuleE
+__ZNK7WebCore19CSSFontFaceSrcValue16isSVGFontFaceSrcEv
+__ZNK7WebCore19CSSFontFaceSrcValue17isSupportedFormatEv
+__ZN7WebCore9DocLoader11requestFontERKNS_6StringE
+__ZN7WebCore10CachedFontC1ERKNS_6StringE
+__ZN7WebCore10CachedFontC2ERKNS_6StringE
+__ZN7WebCore10CachedFont4loadEPNS_9DocLoaderE
+__ZN7WebCore17CSSFontFaceSourceC1ERKNS_6StringEPNS_10CachedFontE
+__ZN7WebCore17CSSFontFaceSourceC2ERKNS_6StringEPNS_10CachedFontE
+__ZN7WebCore10CachedFont9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore11CSSFontFace9addSourceEPNS_17CSSFontFaceSourceE
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE15reserveCapacityEm
+__ZNK7WebCore11CSSFontFace7isValidEv
+__ZNK7WebCore17CSSFontFaceSource7isValidEv
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS_6VectorINS_6RefPtrINS1_11CSSFontFaceEEELm0EEENS1_15CaseFoldingHashENS_10HashTraitsIS2_EE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS_6VectorINS_6RefPtrINS1_11CSSFontFaceEEELm0EEENS1_15CaseFoldingHashENS_10HashTraitsIS2_EEN
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_6VectorINS_6RefPtrINS1_11CSSFontFaceEEELm0EEEENS_18PairFirstExtractorISA_EEN
+__ZN7WebCore9FontCache17getTraitsInFamilyERKNS_12AtomicStringERN3WTF6VectorIjLm0EEE
++[WebFontCache getTraits:inFamily:]
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE15reserveCapacityEm
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS0_IjNS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS8_IS5_EEE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS0_IjNS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS8_IS5_EEEE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashMapIjNS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTr
+__ZNK7WebCore15FontDescription10traitsMaskEv
+__ZNK3WTF7HashMapIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3getERKj
+__ZN7WebCore20CSSSegmentedFontFaceC1EPNS_15CSSFontSelectorE
+__ZN7WebCore20CSSSegmentedFontFaceC2EPNS_15CSSFontSelectorE
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3setERKjRKS4_
+__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14Pai
+__ZNSt17_Temporary_bufferIPPN7WebCore11CSSFontFaceES2_EC1ES3_S3_
+__ZNSt17_Temporary_bufferIPPN7WebCore11CSSFontFaceES2_EC2ES3_S3_
+__ZSt22__get_temporary_bufferIPN7WebCore11CSSFontFaceEESt4pairIPT_lElS5_
+__ZSt22__stable_sort_adaptiveIPPN7WebCore11CSSFontFaceES3_lPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt24__merge_sort_with_bufferIPPN7WebCore11CSSFontFaceES3_PFbS2_S2_EEvT_S6_T0_T1_
+__ZSt22__chunk_insertion_sortIPPN7WebCore11CSSFontFaceElPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt16__insertion_sortIPPN7WebCore11CSSFontFaceEPFbS2_S2_EEvT_S6_T0_
+__ZSt16__merge_adaptiveIPPN7WebCore11CSSFontFaceElS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
+__ZSt5mergeIPPN7WebCore11CSSFontFaceES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
+__ZN7WebCoreL16compareFontFacesEPNS_11CSSFontFaceES1_
+__ZSt23return_temporary_bufferIPN7WebCore11CSSFontFaceEEvPT_
+__ZN7WebCore20CSSSegmentedFontFace14appendFontFaceEN3WTF10PassRefPtrINS_11CSSFontFaceEEE
+__ZN7WebCore20CSSSegmentedFontFace10pruneTableEv
+__ZN7WebCore11CSSFontFace24addedToSegmentedFontFaceEPNS_20CSSSegmentedFontFaceE
+__ZN3WTF7HashSetIPN7WebCore20CSSSegmentedFontFaceENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6e
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6r
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore11CSSFontFaceELm32EE6shrinkEm
+__ZN7WebCore20CSSSegmentedFontFace11getFontDataERKNS_15FontDescriptionE
+__ZNK7WebCore20CSSSegmentedFontFace7isValidEv
+__ZNK3WTF7HashMapIjPN7WebCore17SegmentedFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3getERKj
+__ZN7WebCore11CSSFontFace11getFontDataERKNS_15FontDescriptionEbb
+__ZN7WebCore17CSSFontFaceSource11getFontDataERKNS_15FontDescriptionEbbPNS_15CSSFontSelectorE
+__ZNK3WTF7HashMapIjPN7WebCore14SimpleFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3getERKj
+__ZNK7WebCore17CSSFontFaceSource8isLoadedEv
+__ZNK7WebCore15CSSFontSelector9docLoaderEv
+__ZN7WebCore10CachedFont17beginLoadIfNeededEPNS_9DocLoaderE
+__ZN7WebCore9FontCache25getLastResortFallbackFontERKNS_15FontDescriptionE
+__ZN3WTF7HashMapIjPN7WebCore14SimpleFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
+__ZN3WTF9HashTableIjSt4pairIjPN7WebCore14SimpleFontDataEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10H
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE15reserveCapacityEm
+__ZN3WTF7HashMapIjPN7WebCore17SegmentedFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
+__ZN3WTF9HashTableIjSt4pairIjPN7WebCore17SegmentedFontDataEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_
+__ZNK7WebCore17SegmentedFontData12isCustomFontEv
+__ZNK7WebCore17SegmentedFontData9isLoadingEv
+__ZNK7WebCore17SegmentedFontData20fontDataForCharacterEi
+__ZNK7WebCore17SegmentedFontData11isSegmentedEv
+__ZN7WebCore10CachedFont4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore10CachedFont11checkNotifyEv
+__ZN7WebCore17CSSFontFaceSource10fontLoadedEPNS_10CachedFontE
+__ZN7WebCore17CSSFontFaceSource10pruneTableEv
+__ZN7WebCore17GlyphPageTreeNode23pruneTreeCustomFontDataEPKNS_8FontDataE
+__ZN7WebCore17GlyphPageTreeNode19pruneCustomFontDataEPKNS_8FontDataE
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore14SimpleFontDataEKNS_7HashMapIjS3_NS_7IntHashIjEENS_10HashTraitsIjEENS7_IS3_EEEEEEvRT0
+__ZN7WebCore11CSSFontFace10fontLoadedEPNS_17CSSFontFaceSourceE
+__ZN7WebCore20CSSSegmentedFontFace10fontLoadedEPNS_11CSSFontFaceE
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore17SegmentedFontDataEKNS_7HashMapIjS3_NS_7IntHashIjEENS_10HashTraitsIjEENS7_IS3_EEEEEEv
+__ZN7WebCore17SegmentedFontDataD0Ev
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE6shrinkEm
+__ZN7WebCore15CSSFontSelector10fontLoadedEv
+__ZN7WebCore10CachedFont20ensureCustomFontDataEv
+__ZN7WebCore28createFontCustomPlatformDataEPNS_12SharedBufferE
+__ZN7WebCore10CachedFont26platformDataFromCustomDataEfbbNS_17FontRenderingModeE
+__ZN7WebCore22FontCustomPlatformData16fontPlatformDataEibbNS_17FontRenderingModeE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE6shrinkEm
+__ZN7WebCore20CSSSegmentedFontFaceD1Ev
+__ZN7WebCore20CSSSegmentedFontFaceD2Ev
+__ZN7WebCore11CSSFontFace28removedFromSegmentedFontFaceEPNS_20CSSSegmentedFontFaceE
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4f
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE6shrinkEm
+__ZN7WebCore11CSSFontFaceD1Ev
+__ZN7WebCore11CSSFontFaceD2Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore17CSSFontFaceSourceELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore17CSSFontFaceSourceD0Ev
+__ZN7WebCore10CachedFont17allClientsRemovedEv
+__ZN7WebCore22FontCustomPlatformDataD1Ev
+__ZN7WebCore22FontCustomPlatformDataD2Ev
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE6shrinkEm
+__ZN7WebCore10CachedFontD0Ev
+__ZN7WebCore15CSSFontFaceRuleD0Ev
+__ZN7WebCore19CSSFontFaceSrcValueD0Ev
+__ZN7WebCore13jsNodeBaseURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsStringOrNullEPN3JSC9ExecStateERKNS_4KURLE
 __ZNK7WebCore12DocumentType7baseURIEv
-__ZN7WebCore21jsDocumentXMLEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23JSProcessingInstruction3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
+__ZNK7WebCore7Element7baseURIEv
+__ZN7WebCore27setJSHTMLScriptElementDeferEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement8setDeferEb
+__ZN7WebCore22jsDocumentTypePublicIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsDocumentPrototypeFunctionCreateRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_5RangeE
+__ZN7WebCore7JSRange15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore7JSRangeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5RangeEEE
+__ZN7WebCore7JSRangeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5RangeEEE
+__ZN7WebCore7JSRange18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16JSRangePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32jsRangePrototypeFunctionSetStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7JSRange9classInfoEv
+__ZN7WebCore34jsRangePrototypeFunctionInsertNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range10insertNodeEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZNK7WebCore5Range19containedByReadOnlyEv
+__ZN7WebCore5Range13textNodeSplitEPNS_4TextE
+__ZN7WebCore7JSRangeD1Ev
+__ZN7WebCore7JSRangeD2Ev
+__ZN7WebCore5Range17nodeWillBeRemovedEPNS_4NodeE
+__ZN7WebCore16JSRangePrototypeD1Ev
+__ZN7WebCore15jsNodeOnmouseupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node9onmouseupEv
+__ZN7WebCore44jsElementPrototypeFunctionGetAttributeNodeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23jsHTMLAnchorElementHashEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4hashEv
+__ZN7WebCore17jsDOMWindowStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6statusEv
+__ZNK7WebCore5Frame15jsStatusBarTextEv
+__ZN7WebCore4Node12insertBeforeEN3WTF10PassRefPtrIS0_EEPS0_Rib
+__ZN7WebCore41jsNodePrototypeFunctionIsDefaultNamespaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Node18isDefaultNamespaceERKNS_12AtomicStringE
+__ZN7WebCore34jsNodePrototypeFunctionIsEqualNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Node11isEqualNodeEPS0_
+__ZNK7WebCore4Node13virtualPrefixEv
+__ZN7WebCore33jsNodePrototypeFunctionIsSameNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSNamedNodeMap10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore41jsNodePrototypeFunctionLookupNamespaceURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore35jsNodePrototypeFunctionLookupPrefixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Node12lookupPrefixERKNS_12AtomicStringE
+__ZNK7WebCore4Node21lookupNamespacePrefixERKNS_12AtomicStringEPKNS_7ElementE
+__ZN7WebCore4Node11removeChildEPS0_Ri
+__ZSt16__merge_backwardIPPN7WebCore11CSSFontFaceES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
+__ZN7WebCore24jsDocumentDefaultCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document14defaultCharsetEv
+__ZN7WebCore19TextResourceDecoder22detectJapaneseEncodingEPKcm
+__ZN7WebCore9KanjiCode5judgeEPKci
+__ZN7WebCore23JSProcessingInstruction3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
 __ZN7WebCore21ProcessingInstruction12setNodeValueERKNS_6StringERi
 __ZN7WebCore21ProcessingInstruction7setDataERKNS_6StringERi
-__ZN7WebCore4Node12insertBeforeEN3WTF10PassRefPtrIS0_EEPS0_Rib
-__ZN7WebCore26setJSDocumentXMLStandaloneEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore13XSLStyleSheetD1Ev
-__ZN7WebCore42jsDOMSelectionPrototypeFunctionSetPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore26jsCSSStyleRuleSelectorTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore23JSHTMLBlockquoteElement9classInfoEv
+__ZN7WebCore39jsTextPrototypeFunctionReplaceWholeTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Text16replaceWholeTextERKNS_6StringERi
+__ZN7WebCoreL33earliestLogicallyAdjacentTextNodeEPKNS_4TextE
+__ZN7WebCoreL31latestLogicallyAdjacentTextNodeEPKNS_4TextE
+__ZN7WebCore15jsTextWholeTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Text9wholeTextEv
+__ZN7WebCore21jsNodeListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSNodeList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSNodeListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSNodeListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34jsLocationPrototypeFunctionReplaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10JSLocation7replaceEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore21JSNodeListConstructorD1Ev
+__ZN7WebCore14RenderThemeMac28paintSearchFieldCancelButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore16JSHTMLMapElement9classInfoEv
+__ZN7WebCore24jsHTMLDocumentDesignModeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12HTMLDocument10designModeEv
+__ZN7WebCore31jsHTMLHeadingElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSHTMLHeadingElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLHeadingElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSHTMLHeadingElementConstructorD1Ev
+__ZN7WebCore11HTMLElement18setContentEditableEPNS_15MappedAttributeE
+__ZN7WebCore40jsDOMWindowPrototypeFunctionGetSelectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow12getSelectionEv
+__ZN7WebCore12DOMSelectionC1EPNS_5FrameE
+__ZN7WebCore12DOMSelectionC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12DOMSelectionE
+__ZN7WebCore14JSDOMSelection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSDOMSelectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DOMSelectionEEE
+__ZN7WebCore14JSDOMSelectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DOMSelectionEEE
+__ZN7WebCore14JSDOMSelection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSDOMSelectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsDOMSelectionPrototypeFunctionSetPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSDOMSelection9classInfoEv
 __ZN7WebCore12DOMSelection11setPositionEPNS_4NodeEiRi
-__ZN7WebCore37jsDOMSelectionPrototypeFunctionModifyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12DOMSelection6modifyERKNS_6StringES3_S3_
+__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionEb
+__ZN7WebCore31SimplifiedBackwardsTextIterator21handleReplacedElementEv
 __ZN7WebCoreL13executeDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCoreL11scanForFormEPNS_4NodeE
-__ZN7WebCore14isStartOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore32lineBreakExistsAtVisiblePositionERKNS_15VisiblePositionE
+__ZN7WebCore21positionBeforeTabSpanERKNS_8PositionE
+__ZNK7WebCore4Node14lastDescendantEv
+__ZN7WebCore14caretMinOffsetEPKNS_4NodeE
 __ZN7WebCore20CompositeEditCommand21removeChildrenInRangeEN3WTF10PassRefPtrINS_4NodeEEEjj
-__ZN7WebCore20CompositeEditCommand22insertBlockPlaceholderERKNS_8PositionE
-__ZN7WebCore29createBlockPlaceholderElementEPNS_8DocumentE
-__ZN7WebCoreL15isTableRowEmptyEPNS_4NodeE
+__ZNK7WebCore15VisiblePosition19absoluteCaretBoundsEv
+__ZN7WebCore20CompositeEditCommand13moveParagraphERKNS_15VisiblePositionES3_S3_bb
+__ZN7WebCore20CompositeEditCommand14moveParagraphsERKNS_15VisiblePositionES3_S3_bb
+__ZN7WebCore11EditCommand15styleAtPositionERKNS_8PositionE
+__ZN7WebCore26CSSMutableStyleDeclaration21removeBlockPropertiesEv
+__ZN7WebCore20CompositeEditCommand15deleteSelectionEbbbb
+__ZN7WebCore20CompositeEditCommand27removeNodeAndPruneAncestorsEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore22DeleteSelectionCommand10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore20isTableStructureNodeEPKNS_4NodeE
+__ZN7WebCoreL28updatePositionForNodeRemovalEPNS_4NodeERNS_8PositionE
+__ZN7WebCore20CompositeEditCommand10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore17RemoveNodeCommandC1EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore17RemoveNodeCommandC2EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore17RemoveNodeCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand5pruneEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore14isStartOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore23ReplaceSelectionCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
+__ZN7WebCore23ReplaceSelectionCommandC2EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
+__ZN7WebCore23ReplaceSelectionCommand7doApplyEv
+__ZN7WebCore19ReplacementFragmentC1EPNS_8DocumentEPNS_16DocumentFragmentEbRKNS_16VisibleSelectionE
+__ZN7WebCore19ReplacementFragmentC2EPNS_8DocumentEPNS_16DocumentFragmentEbRKNS_16VisibleSelectionE
+__ZN7WebCore23ReplaceSelectionCommand21performTrivialReplaceERKNS_19ReplacementFragmentE
+__ZNK7WebCore19ReplacementFragment10firstChildEv
+__ZN7WebCore20CompositeEditCommand35prepareWhitespaceAtPositionForSplitERNS_8PositionE
+__ZN7WebCore20CompositeEditCommand22positionOutsideTabSpanERKNS_8PositionE
+__ZN7WebCoreL26isMailPasteAsQuotationNodeEPKNS_4NodeE
+__ZN7WebCore11isStyleSpanEPKNS_4NodeE
+__ZNK7WebCore19ReplacementFragment7isEmptyEv
+__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore17ApplyStyleCommandC1EPNS_8DocumentEPNS_19CSSStyleDeclarationENS_10EditActionENS0_14EPropertyLevelE
+__ZN7WebCore17ApplyStyleCommandC2EPNS_8DocumentEPNS_19CSSStyleDeclarationENS_10EditActionENS0_14EPropertyLevelE
+__ZN7WebCore17ApplyStyleCommand7doApplyEv
+__ZNK7WebCore26CSSMutableStyleDeclaration19copyBlockPropertiesEv
+__ZN7WebCore17ApplyStyleCommand28applyRelativeFontStyleChangeEPNS_26CSSMutableStyleDeclarationE
+__ZN7WebCore17ApplyStyleCommand16applyInlineStyleEPNS_26CSSMutableStyleDeclarationE
+__ZN7WebCore17ApplyStyleCommand13startPositionEv
+__ZN7WebCore17ApplyStyleCommand11endPositionEv
+__ZN7WebCore17ApplyStyleCommand31splitTextElementAtStartIfNeededERKNS_8PositionES3_
+__ZN7WebCore17ApplyStyleCommand29splitTextElementAtEndIfNeededERKNS_8PositionES3_
+__ZN7WebCore17ApplyStyleCommand17removeInlineStyleEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEERKNS_8PositionES7_
+__ZN7WebCore17ApplyStyleCommand39pushDownTextDecorationStyleAtBoundariesERKNS_8PositionES3_
+__ZN7WebCore17ApplyStyleCommand37pushDownTextDecorationStyleAroundNodeEPNS_4NodeEb
+__ZNK7WebCore17ApplyStyleCommand17nodeFullySelectedEPNS_4NodeERKNS_8PositionES5_
+__ZN7WebCore17ApplyStyleCommand14updateStartEndERKNS_8PositionES3_
+__ZN7WebCore17ApplyStyleCommand23applyInlineStyleToRangeEPNS_26CSSMutableStyleDeclarationERKNS_8PositionES5_
+__ZN7WebCore17ApplyStyleCommand30cleanupUnstyledAppleStyleSpansEPNS_4NodeE
+__ZN7WebCore17RemoveNodeCommandD0Ev
+__ZN7WebCore23ReplaceSelectionCommandD0Ev
+__ZN7WebCore17ApplyStyleCommandD0Ev
+__ZN7WebCore12DOMSelection15disconnectFrameEv
+__ZN7WebCore14JSDOMSelectionD1Ev
+__ZN7WebCore14JSDOMSelectionD2Ev
+__ZN7WebCore23JSDOMSelectionPrototypeD1Ev
+__ZN7WebCore4Node13computedStyleEv
+__ZN7WebCore22DeleteSelectionCommandC1EPNS_8DocumentEbbbb
+__ZN7WebCore22DeleteSelectionCommandC2EPNS_8DocumentEbbbb
+__ZN7WebCore17ApplyStyleCommand15isHTMLStyleNodeEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
+__ZN7WebCore17ApplyStyleCommand19removeHTMLFontStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
+__ZN7WebCore17ApplyStyleCommand28removeHTMLBidiEmbeddingStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
+__ZN7WebCore17ApplyStyleCommand14removeCSSStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
+__ZN7WebCore17ApplyStyleCommand22addInlineStyleIfNeededEPNS_26CSSMutableStyleDeclarationEPNS_4NodeES4_
+__ZN7WebCore11StyleChangeC1EPNS_19CSSStyleDeclarationERKNS_8PositionE
+__ZN7WebCore11StyleChangeC2EPNS_19CSSStyleDeclarationERKNS_8PositionE
+__ZN7WebCore11StyleChange4initEN3WTF10PassRefPtrINS_19CSSStyleDeclarationEEERKNS_8PositionE
+__ZN7WebCore11StyleChange17currentlyHasStyleERKNS_8PositionEPKNS_11CSSPropertyE
+__ZNK7WebCore27CSSComputedStyleDeclaration36getFontSizeCSSValuePreferringKeywordEv
+__ZN7WebCore19ReplacementFragment22removeInterchangeNodesEPNS_4NodeE
+__ZN7WebCoreL24isInterchangeNewlineNodeEPKNS_4NodeE
+__ZN7WebCoreL31isInterchangeConvertedSpaceSpanEPKNS_4NodeE
+__ZNK7WebCore19ReplacementFragment9lastChildEv
+__ZN7WebCoreL20styleSpanClassStringEv
+__ZN7WebCore19ReplacementFragment28removeNodePreservingChildrenEPNS_4NodeE
+__ZN7WebCore19ReplacementFragment10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore19ReplacementFragment16insertNodeBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_
+__ZN7WebCore23ReplaceSelectionCommand34insertNodeAtAndUpdateNodesInsertedEN3WTF10PassRefPtrINS_4NodeEEERKNS_8PositionE
+__ZN7WebCore23ReplaceSelectionCommand19updateNodesInsertedEPNS_4NodeE
+__ZN7WebCore23ReplaceSelectionCommand31removeUnrenderedTextNodesAtEndsEv
+__ZN7WebCore23ReplaceSelectionCommand36negateStyleRulesThatAffectAppearanceEv
+__ZN7WebCore23ReplaceSelectionCommand30positionAtEndOfInsertedContentEv
+__ZN7WebCore23ReplaceSelectionCommand32positionAtStartOfInsertedContentEv
+__ZN7WebCore23ReplaceSelectionCommand17shouldRemoveEndBREPNS_4NodeERKNS_15VisiblePositionE
+__ZN7WebCore23ReplaceSelectionCommand14shouldMergeEndEb
+__ZN7WebCore23ReplaceSelectionCommand16shouldMergeStartEbbb
+__ZN7WebCore23ReplaceSelectionCommand16mergeEndIfNeededEv
+__ZN7WebCore23ReplaceSelectionCommand26handlePasteAsQuotationNodeEv
+__ZN7WebCore23ReplaceSelectionCommand23completeHTMLReplacementERKNS_8PositionE
+__ZN7WebCore20setJSNodeOndragstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOndragstartEN3WTF10PassRefPtrINS_13EventListenerEEE
 __ZN7WebCoreL17executeInsertTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore13TypingCommand10insertTextEPNS_8DocumentERKNS_6StringEbb
-__ZN7WebCore22nonBreakingSpaceStringEv
-__ZN7WebCoreL14isEditableLeafEPNS_9InlineBoxE
-__ZN7WebCoreL27nextLeafWithSameEditabilityEPNS_4NodeE
-__ZN7WebCore19ReplacementFragment28removeNodePreservingChildrenEPNS_4NodeE
-__ZN7WebCore19ReplacementFragment16insertNodeBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_
+__ZN7WebCore20CompositeEditCommand19removePlaceholderAtERKNS_8PositionE
+__ZN7WebCore20CompositeEditCommand23breakOutOfEmptyListItemEv
+__ZN7WebCore22enclosingEmptyListItemERKNS_15VisiblePositionE
+__ZN7WebCore18enclosingListChildEPNS_4NodeE
+__ZN7WebCore13isListElementEPNS_4NodeE
+__ZN7WebCore13TypingCommand21makeEditableRootEmptyEv
+__ZNK7WebCore7Element17firstElementChildEv
+__ZN7WebCore37jsDOMSelectionPrototypeFunctionModifyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection6modifyERKNS_6StringES3_S3_
+__ZN7WebCore19SelectionController19modifyMovingForwardENS_15TextGranularityE
+__ZN7WebCore19SelectionController22modifyExtendingForwardENS_15TextGranularityE
 __ZN7WebCore16nextWordPositionERKNS_15VisiblePositionE
-__ZN7WebCoreL24nextWordPositionBoundaryEPKtj
+__ZN7WebCoreL24nextWordPositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
 __ZN7WebCore21findNextWordFromIndexEPKtiib
-__ZN7WebCore20previousWordPositionERKNS_15VisiblePositionE
-__ZN7WebCoreL28previousWordPositionBoundaryEPKtj
-__ZN7WebCore12RenderObject17setSelectionStateENS0_14SelectionStateE
-__ZNK7WebCore4Node12canSelectAllEv
-__ZN7WebCore20setJSDOMWindowParentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
+__ZN7WebCore11RenderBlock26fillHorizontalSelectionGapEPNS_12RenderObjectEiiiiPKNS1_9PaintInfoE
+__ZN7WebCoreL12nodePositionEPNS_4NodeE
+__ZN7WebCore6String6numberEj
+__ZN7WebCore4Node16shadowParentNodeEv
+__ZN7WebCore47jsDOMSelectionPrototypeFunctionSetBaseAndExtentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection16setBaseAndExtentEPNS_4NodeEiS2_iRi
+__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionES3_b
+__ZNK7WebCore6Editor25shouldShowDeleteInterfaceEPNS_11HTMLElementE
+__ZN7WebCore21nextParagraphPositionERKNS_15VisiblePositionEi
+__ZN7WebCore16nextLinePositionERKNS_15VisiblePositionEi
+__ZN7WebCoreL27nextLeafWithSameEditabilityEPNS_4NodeE
+__ZN7WebCore20CompositeEditCommand15insertNodeAfterEN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore11RenderBlock21fillRightSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
+__ZN7WebCore11RenderBlock24fillVerticalSelectionGapEiiiiPS0_iiPKNS_12RenderObject9PaintInfoE
+__ZN7WebCore11RenderBlock20fillLeftSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
+__ZN7WebCore20setJSDOMWindowParentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore25previousParagraphPositionERKNS_15VisiblePositionEi
-__ZN7WebCore20previousLinePositionERKNS_15VisiblePositionEi
-__ZN7WebCoreL31previousLeafWithSameEditabilityEPNS_4NodeE
 __ZN7WebCore15inSameParagraphERKNS_15VisiblePositionES2_
-__ZN7WebCore20CompositeEditCommand22appendBlockPlaceholderEN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore8RenderBR23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN7WebCore11StyleChange29checkForLegacyHTMLStyleChangeEPKNS_11CSSPropertyE
+__ZN7WebCore22createStyleSpanElementEPNS_8DocumentE
+__ZN7WebCore17createHTMLElementEPNS_8DocumentERKNS_13QualifiedNameE
+__ZN7WebCore17ApplyStyleCommand28surroundNodeRangeWithElementEPNS_4NodeES2_N3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore23ReplaceSelectionCommand27removeNodeAndPruneAncestorsEPNS_4NodeE
+__ZN7WebCore16VisibleSelection27selectionFromContentsOfNodeEPNS_4NodeE
+__ZN7WebCoreL16executeSelectAllEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore19SelectionController9selectAllEv
+__ZNK7WebCore4Node12canSelectAllEv
+__ZNK7WebCore8Position19isRenderedCharacterEv
+__ZN7WebCore22nonBreakingSpaceStringEv
+__ZN7WebCore20CompositeEditCommand17replaceTextInNodeEN3WTF10PassRefPtrINS_4TextEEEjjRKNS_6StringE
+__ZN7WebCore23ReplaceSelectionCommand16handleStyleSpansEv
+__ZN7WebCore20CompositeEditCommand16setNodeAttributeEN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore23SetNodeAttributeCommandC1EN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore23SetNodeAttributeCommandC2EN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore23SetNodeAttributeCommand7doApplyEv
+__ZN7WebCore40firstEditablePositionAfterPositionInRootERKNS_8PositionEPNS_4NodeE
+__ZN7WebCore23SetNodeAttributeCommandD0Ev
+__ZN7WebCore12startOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore30jsRangePrototypeFunctionSetEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore39jsDOMSelectionPrototypeFunctionAddRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7toRangeEN3JSC7JSValueE
+__ZN7WebCore12DOMSelection8addRangeEPNS_5RangeE
+__ZN7WebCoreL32elementHasTextDecorationPropertyEPKNS_4NodeE
+__ZN7WebCoreL34styleFromMatchedRulesAndInlineDeclEPKNS_4NodeE
+__ZN3WTF11ListHashSetIPN7WebCore12RenderInlineENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF11ListHashSetIPN7WebCore12RenderInlineENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore12RenderInline12paintOutlineEPNS_15GraphicsContextEii
+__ZN7WebCore12RenderInline17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCoreL15isTableRowEmptyEPNS_4NodeE
 __ZN7WebCore9CSSParser25parseFontFaceUnicodeRangeEv
 __ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE14expandCapacityEmPKS3_
 __ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE14expandCapacityEm
@@ -15559,152 +14248,496 @@
 __ZN3WTF6VectorIjLm0EE14expandCapacityEm
 __ZN3WTF6VectorIjLm0EE15reserveCapacityEm
 __ZN3WTF6VectorIjLm0EE6shrinkEm
-__ZN7WebCoreL16compareFontFacesEPNS_11CSSFontFaceES1_
 __ZSt25__unguarded_linear_insertIPPN7WebCore11CSSFontFaceES2_PFbS2_S2_EEvT_T0_T1_
-__ZSt5mergeIPPN7WebCore11CSSFontFaceES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE15reserveCapacityEm
+__ZN7WebCore19SelectionController20modifyMovingBackwardENS_15TextGranularityE
+__ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE6shrinkEm
+__ZN7WebCore20CSSUnicodeRangeValueD0Ev
+__ZN7WebCore27setJSHTMLDocumentDesignModeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12HTMLDocument13setDesignModeERKNS_6StringE
+__ZN7WebCore8Document13setDesignModeENS0_13InheritedBoolE
+__ZN7WebCore52jsHTMLInputElementPrototypeFunctionSetSelectionRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18JSHTMLInputElement17setSelectionRangeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore16HTMLInputElement17setSelectionRangeEii
 __ZN7WebCoreL17executeCreateLinkEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17CreateLinkCommandC1EPNS_8DocumentERKNS_6StringE
 __ZN7WebCore17CreateLinkCommandC2EPNS_8DocumentERKNS_6StringE
 __ZN7WebCore17CreateLinkCommand7doApplyEv
 __ZN7WebCore17HTMLAnchorElementC1EPNS_8DocumentE
+__ZN7WebCore17HTMLAnchorElementC2EPNS_8DocumentE
+__ZNK7WebCore11EditCommand15isTypingCommandEv
+__ZNK7WebCore11EditCommand20preservesTypingStyleEv
 __ZNK7WebCore17CreateLinkCommand13editingActionEv
-__ZN7WebCore21nextParagraphPositionERKNS_15VisiblePositionEi
-__ZN7WebCore19SelectionController20modifyMovingBackwardENS_15TextGranularityE
-__ZN7WebCoreL20executeForwardDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZNK7WebCore17RenderTextControl10renderNameEv
+__ZN7WebCore17CreateLinkCommandD0Ev
+__ZN7WebCore20CompositeEditCommand22insertBlockPlaceholderERKNS_8PositionE
+__ZN7WebCore29createBlockPlaceholderElementEPNS_8DocumentE
+__ZN7WebCore6Editor16shouldEndEditingEPNS_5RangeE
+__ZN7WebCoreL25executeDeleteWordBackwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20previousWordPositionERKNS_15VisiblePositionE
+__ZN7WebCoreL28previousWordPositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore6Editor13addToKillRingEPNS_5RangeEb
+__ZN7WebCore6Editor24startNewKillRingSequenceEv
+__ZN7WebCoreL26initializeKillRingIfNeededEv
+__ZN7WebCore6Editor16appendToKillRingERKNS_6StringE
+__ZN7WebCore22DeleteButtonController16createDeletionUIEv
+__ZN7WebCore12DeleteButtonC1EPNS_8DocumentE
+__ZN7WebCore12DeleteButtonC2EPNS_8DocumentE
+__ZN7WebCore11CachedImageC1EPNS_5ImageE
+__ZN7WebCore11CachedImageC2EPNS_5ImageE
+__ZN7WebCore11ImageLoader8setImageEPNS_11CachedImageE
+__ZN7WebCore33jsDOMWindowPrototypeFunctionAlertEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow5alertERKNS_6StringE
+__ZN7WebCore6Chrome18runJavaScriptAlertEPNS_5FrameERKNS_6StringE
+__ZN7WebCore21PageGroupLoadDeferrerC1EPNS_4PageEb
+__ZN7WebCore21PageGroupLoadDeferrerC2EPNS_4PageEb
+__ZN7WebCore21PageGroupLoadDeferrerD1Ev
+__ZN7WebCore21PageGroupLoadDeferrerD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE6shrinkEm
+__ZN7WebCore12DeleteButton19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore22DeleteButtonController12deleteTargetEv
+__ZN7WebCore12EventHandler24scheduleHoverStateUpdateEv
+__ZNK7WebCore11EditCommand13editingActionEv
+__ZN7WebCore12RenderObject17setSelectionStateENS0_14SelectionStateE
+__ZN7WebCore12RenderObject23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
++[WebUndefined undefined]
++[WebUndefined allocWithZone:]
+-[WebScriptObject valueForKey:]
+-[WebScriptObject _originRootObject]
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE14shrinkCapacityEm
+__ZN7WebCore23ReplaceSelectionCommand28removeNodePreservingChildrenEPNS_4NodeE
+__ZN7WebCore20CompositeEditCommand28removeNodePreservingChildrenEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore35RemoveNodePreservingChildrenCommandC1EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore35RemoveNodePreservingChildrenCommandC2EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore35RemoveNodePreservingChildrenCommand7doApplyEv
+__ZN7WebCore35RemoveNodePreservingChildrenCommandD0Ev
+__ZN7WebCore12TextIterator8subrangeEPNS_5RangeEii
+__ZN3WTF6VectorIN7WebCore18TextCheckingResultELm0EE6shrinkEm
+__ZN7WebCoreeqERKNS_5RangeES2_
+__ZN7WebCore13InlineTextBox28paintSpellingOrGrammarMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleERKNS_4F
+__ZN7WebCore15GraphicsContext34drawLineForMisspellingOrBadGrammarERKNS_8IntPointEib
+__ZN7WebCoreL18createPatternColorEP8NSStringP7NSColorRb
 __ZN7WebCoreL22executeInsertParagraphEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore13TypingCommand24insertParagraphSeparatorEPNS_8DocumentE
 __ZN7WebCore13TypingCommand24insertParagraphSeparatorEv
 __ZN7WebCore31InsertParagraphSeparatorCommandC1EPNS_8DocumentEb
+__ZN7WebCore31InsertParagraphSeparatorCommandC2EPNS_8DocumentEb
 __ZN7WebCore31InsertParagraphSeparatorCommand7doApplyEv
 __ZN7WebCore31InsertParagraphSeparatorCommand29calculateStyleBeforeInsertionERKNS_8PositionE
 __ZNK7WebCore31InsertParagraphSeparatorCommand32shouldUseDefaultParagraphElementEPNS_4NodeE
-__ZN7WebCore7Element12cloneElementEv
+__ZN7WebCore20CompositeEditCommand22appendBlockPlaceholderEN3WTF10PassRefPtrINS_7ElementEEE
 __ZN7WebCore31InsertParagraphSeparatorCommand24applyStyleAfterInsertionEPNS_4NodeE
-__ZN7WebCore17InsertTextCommand9insertTabERKNS_8PositionE
-__ZN7WebCore20createTabSpanElementEPNS_8DocumentE
-__ZN7WebCore20createTabSpanElementEPNS_8DocumentEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCoreL28fontSizeChangesComputedStyleEPNS_11RenderStyleENS_11StyleChangeE
-__ZNK7WebCore4Font27selectionRectForComplexTextERKNS_7TextRunERKNS_8IntPointEiii
+__ZN7WebCore31InsertParagraphSeparatorCommandD0Ev
+__ZN7WebCore30setJSHTMLOptionElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL17createFontElementEPNS_8DocumentE
+__ZN7WebCoreL35executeInsertNewlineInQuotedContentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEPNS_8DocumentE
+__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEv
+__ZN7WebCore22BreakBlockquoteCommandC1EPNS_8DocumentE
+__ZN7WebCore22BreakBlockquoteCommandC2EPNS_8DocumentE
+__ZN7WebCore22BreakBlockquoteCommand7doApplyEv
+__ZN7WebCore28isFirstVisiblePositionInNodeERKNS_15VisiblePositionEPKNS_4NodeE
+__ZN7WebCore27isLastVisiblePositionInNodeERKNS_15VisiblePositionEPKNS_4NodeE
+__ZN7WebCore20CompositeEditCommand19rebalanceWhitespaceEv
+__ZN7WebCore22BreakBlockquoteCommandD0Ev
 __ZN7WebCoreL11enabledUndoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
 __ZN7WebCore6Editor7canUndoEv
 __ZN7WebCoreL11executeUndoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor4undoEv
 __ZN7WebCore11EditCommand7unapplyEv
 __ZN7WebCore20CompositeEditCommand9doUnapplyEv
-__ZN7WebCore17RemoveNodeCommand9doUnapplyEv
-__ZN7WebCore17AppendNodeCommand9doUnapplyEv
-__ZN7WebCore6Editor16unappliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCore23SetNodeAttributeCommand9doUnapplyEv
-__ZN7WebCore23InsertNodeBeforeCommand9doUnapplyEv
 __ZN7WebCore25DeleteFromTextNodeCommand9doUnapplyEv
+__ZN7WebCore6Editor16unappliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore26setJSHTMLTableElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement8setAlignERKNS_6StringE
+__ZNK7WebCore9RenderBox19lastLineBoxBaselineEv
+__ZN7WebCore20CompositeEditCommand27addBlockPlaceholderIfNeededEPNS_7ElementE
+__ZN7WebCoreL20executeForwardDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedEPNS_8DocumentEbNS_15TextGranularityEb
+__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedENS_15TextGranularityEb
+__ZN7WebCore16VisibleSelectionD2Ev
+__ZN7WebCoreL28fontSizeChangesComputedStyleEPNS_11RenderStyleENS_11StyleChangeE
+__ZN7WebCore15createJSWrapperEPN3JSC8JSObjectEN3WTF10PassRefPtrINS0_8Bindings10RootObjectEEES7_
+__ZN7WebCore12getJSWrapperEPN3JSC8JSObjectE
+-[WebScriptObject _initWithJSObject:originRootObject:rootObject:]
+-[WebScriptObject webScriptValueAtIndex:]
 __ZN7WebCore25InsertIntoTextNodeCommand9doUnapplyEv
-__ZN7WebCoreL22executeInsertLineBreakEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL18marqueeConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore18HTMLMarqueeElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18HTMLMarqueeElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore18HTMLMarqueeElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore18HTMLMarqueeElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreL31createHTMLMarqueeElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore20JSHTMLMarqueeElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSHTMLMarqueeElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLMarqueeElementEEE
+__ZN7WebCore20JSHTMLMarqueeElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLMarqueeElementEEE
+__ZNK7WebCore18HTMLMarqueeElement17endTagRequirementEv
+__ZNK7WebCore18HTMLMarqueeElement11tagPriorityEv
+__ZN7WebCore16StyleMarqueeDataC1ERKS0_
+__ZN7WebCore16StyleMarqueeDataC2ERKS0_
+__ZN7WebCore13RenderMarqueeC1EPNS_11RenderLayerE
+__ZN7WebCore13RenderMarqueeC2EPNS_11RenderLayerE
+__ZN7WebCore13RenderMarquee18updateMarqueeStyleEv
+__ZNK7WebCore13RenderMarquee12isHorizontalEv
+__ZNK7WebCore13RenderMarquee9directionEv
+__ZNK7WebCore13RenderMarquee12marqueeSpeedEv
+__ZN7WebCore13RenderMarquee21updateMarqueePositionEv
+__ZN7WebCore13RenderMarquee15computePositionENS_17EMarqueeDirectionEb
+__ZN7WebCore13RenderMarquee5startEv
+__ZN7WebCore5TimerINS_13RenderMarqueeEE5firedEv
+__ZN7WebCore13RenderMarquee10timerFiredEPNS_5TimerIS0_EE
+__ZThn112_NK7WebCore18HTMLMarqueeElement10canSuspendEv
+__ZNK7WebCore18HTMLMarqueeElement10canSuspendEv
+__ZThn112_N7WebCore18HTMLMarqueeElement4stopEv
+__ZN7WebCore18HTMLMarqueeElement4stopEv
+__ZN7WebCore13RenderMarquee4stopEv
+__ZN7WebCore20JSHTMLMarqueeElementD1Ev
+__ZN7WebCore29JSHTMLMarqueeElementPrototypeD1Ev
+__ZN7WebCore18HTMLMarqueeElementD0Ev
+__ZNK7WebCore4Font27selectionRectForComplexTextERKNS_7TextRunERKNS_8IntPointEiii
+__ZN7WebCore26RenderTextControlMultiLine17subtreeHasChangedEv
+__ZN7WebCore5Frame23textDidChangeInTextAreaEPNS_7ElementE
+__Z3kitPN7WebCore19HTMLTextAreaElementE
+__ZN7WebCore8Position42uncheckedPreviousOffsetForBackwardDeletionEPKNS_4NodeEi
+__ZNK7WebCore10RenderText33previousOffsetForBackwardDeletionEi
+__ZN7WebCore40lastEditablePositionBeforePositionInRootERKNS_8PositionEPNS_4NodeE
+__ZNK7WebCore16RenderListMarker18canBeSelectionLeafEv
+__ZN7WebCore16RenderListMarker17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZN7WebCore16RenderListMarker23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN7WebCore17InsertTextCommand9insertTabERKNS_8PositionE
+__ZN7WebCore20createTabSpanElementEPNS_8DocumentE
+__ZN7WebCore20createTabSpanElementEPNS_8DocumentEN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore11tabSpanNodeEPKNS_4NodeE
+__ZN7WebCore20CompositeEditCommand13splitTextNodeEN3WTF10PassRefPtrINS_4TextEEEj
+__ZN7WebCore20SplitTextNodeCommandC1EN3WTF10PassRefPtrINS_4TextEEEi
+__ZN7WebCore20SplitTextNodeCommandC2EN3WTF10PassRefPtrINS_4TextEEEi
+__ZN7WebCore20SplitTextNodeCommand7doApplyEv
+__ZN7WebCore8Document11copyMarkersEPNS_4NodeEjiS2_iNS_14DocumentMarker10MarkerTypeE
+__ZN7WebCore20SplitTextNodeCommandD0Ev
+__ZN7WebCoreL22executeInsertLineBreakEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13TypingCommand15insertLineBreakEPNS_8DocumentE
+__ZN7WebCore13TypingCommand15insertLineBreakEv
+__ZN7WebCore22InsertLineBreakCommandC1EPNS_8DocumentE
+__ZN7WebCore22InsertLineBreakCommandC2EPNS_8DocumentE
+__ZN7WebCore22InsertLineBreakCommand7doApplyEv
+__ZN7WebCore22InsertLineBreakCommand21shouldUseBreakElementERKNS_8PositionE
+__ZN7WebCore22InsertLineBreakCommandD0Ev
+__ZN7WebCoreL29executeDeleteToEndOfParagraphEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore21createListItemElementEPNS_8DocumentE
+__ZN7WebCore39jsDocumentPrototypeFunctionGetSelectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore8Document12getSelectionEv
+__ZN7WebCore48jsDOMSelectionPrototypeFunctionSelectAllChildrenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection17selectAllChildrenEPNS_4NodeERi
+__ZN7WebCore44jsDOMSelectionPrototypeFunctionCollapseToEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection13collapseToEndEv
+__ZN7WebCore38jsRangePrototypeFunctionSetStartBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore35jsRangePrototypeFunctionSetEndAfterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL20executeDeleteForwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore36jsDOMWindowHTMLDivElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCoreL25enableCaretInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
 __ZN7WebCoreL16executeTransposeEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor9transposeEv
-__ZN7WebCoreL35executeInsertNewlineInQuotedContentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEPNS_8DocumentE
-__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEv
-__ZN7WebCore22BreakBlockquoteCommandC1EPNS_8DocumentE
-__ZN7WebCore22BreakBlockquoteCommand7doApplyEv
-__ZN7WebCore27isLastVisiblePositionInNodeERKNS_15VisiblePositionEPKNS_4NodeE
-__ZN7WebCore20CompositeEditCommand13splitTextNodeEN3WTF10PassRefPtrINS_4TextEEEj
-__ZN7WebCore20SplitTextNodeCommandC1EN3WTF10PassRefPtrINS_4TextEEEi
-__ZN7WebCore20SplitTextNodeCommand7doApplyEv
-__ZN7WebCore8Document11copyMarkersEPNS_4NodeEjiS2_iNS_14DocumentMarker10MarkerTypeE
-__ZN7WebCore31InsertParagraphSeparatorCommandD1Ev
-__ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE6shrinkEm
-__ZN7WebCore17InsertListCommand11modifyRangeEv
-__ZN7WebCore20startOfNextParagraphERKNS_15VisiblePositionE
-__ZN7WebCore20CompositeEditCommand12splitElementEN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
-__ZN7WebCore19SplitElementCommandC1EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
-__ZN7WebCore19SplitElementCommand7doApplyEv
-__ZNK7WebCore14ClipboardEvent16isClipboardEventEv
-__ZNK7WebCore14ClipboardEvent9clipboardEv
-__ZN7WebCoreL14supportedPasteEPNS_5FrameENS_19EditorCommandSourceE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE15reserveCapacityEm
+__ZN7WebCore16logicalEndOfLineERKNS_15VisiblePositionE
+__ZN7WebCoreL26getLeafBoxesInLogicalOrderEPNS_13RootInlineBoxERN3WTF6VectorIPNS_9InlineBoxELm0EEE
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE6shrinkEm
+__ZN7WebCore17inSameLogicalLineERKNS_15VisiblePositionES2_
+__ZN7WebCore18logicalStartOfLineERKNS_15VisiblePositionE
+__ZN7WebCore32jsDOMWindowPrototypeFunctionFindEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow4findERKNS_6StringEbbbbbb
+__ZN7WebCore5Frame10findStringERKNS_6StringEbbbb
+__ZNK7WebCore16VisibleSelection18shadowTreeRootNodeEv
+__ZN7WebCoreL20executeJustifyCenterEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL26executeApplyParagraphStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
+__ZN7WebCore6Editor19applyParagraphStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore17ApplyStyleCommand15applyBlockStyleEPNS_26CSSMutableStyleDeclarationE
+__ZN7WebCore20CompositeEditCommand42moveParagraphContentsToNewBlockIfNecessaryERKNS_8PositionE
+__ZN7WebCore20CompositeEditCommand34insertNewDefaultParagraphElementAtERKNS_8PositionE
+__ZN7WebCore17ApplyStyleCommand13addBlockStyleERKNS_11StyleChangeEPNS_11HTMLElementE
+__ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
+__ZNK7WebCore17ApplyStyleCommand13editingActionEv
+__ZN7WebCoreL16executeBackColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL17executeApplyStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
+__ZN7WebCore6Editor10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore5Frame24computeAndSetTypingStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCoreL13executeIndentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20IndentOutdentCommandC1EPNS_8DocumentENS0_11EIndentTypeEi
+__ZN7WebCore20IndentOutdentCommandC2EPNS_8DocumentENS0_11EIndentTypeEi
+__ZN7WebCore20IndentOutdentCommand7doApplyEv
+__ZN7WebCore20IndentOutdentCommand12indentRegionEv
+__ZN7WebCore30selectionForParagraphIterationERKNS_16VisibleSelectionE
+__ZN7WebCore23indexForVisiblePositionERNS_15VisiblePositionE
+__ZN7WebCore13enclosingListEPNS_4NodeE
+__ZN7WebCoreL29createIndentBlockquoteElementEPNS_8DocumentE
+__ZN7WebCoreL22indentBlockquoteStringEv
+__ZN7WebCore20CompositeEditCommand15splitTreeToNodeEPNS_4NodeES2_b
+__ZN7WebCore20IndentOutdentCommand34prepareBlockquoteLevelForInsertionERNS_15VisiblePositionERN3WTF6RefPtrINS_7ElementEEE
+__ZN7WebCoreL18isIndentBlockquoteEPKNS_4NodeE
+__ZNK7WebCore20IndentOutdentCommand20preservesTypingStyleEv
+__ZNK7WebCore20IndentOutdentCommand13editingActionEv
+__ZN7WebCore20IndentOutdentCommandD0Ev
+__ZN7WebCoreL18executeFormatBlockEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13validBlockTagERKNS_6StringE
+__ZN7WebCore18FormatBlockCommandC1EPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore18FormatBlockCommandC2EPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore18FormatBlockCommand7doApplyEv
+__ZN7WebCore18FormatBlockCommand11modifyRangeEv
+__ZN7WebCore25enclosingBlockFlowElementERKNS_15VisiblePositionE
+__ZN7WebCore17createHTMLElementEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationERKNS_8PositionES5_NS_10EditActionE
+__ZN7WebCore17ApplyStyleCommandC1EPNS_8DocumentEPNS_19CSSStyleDeclarationERKNS_8PositionES7_NS_10EditActionENS0_14EPropertyLeve
+__ZN7WebCore17ApplyStyleCommandC2EPNS_8DocumentEPNS_19CSSStyleDeclarationERKNS_8PositionES7_NS_10EditActionENS0_14EPropertyLeve
+__ZNK7WebCore18FormatBlockCommand13editingActionEv
+__ZN7WebCore18FormatBlockCommandD0Ev
 __ZN7WebCoreL26enabledRangeInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
 __ZN7WebCoreL19executeRemoveFormatEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor24removeFormattingAndStyleEv
+__ZN7WebCore19RemoveFormatCommandC1EPNS_8DocumentE
 __ZN7WebCore19RemoveFormatCommandC2EPNS_8DocumentE
 __ZN7WebCore19RemoveFormatCommand7doApplyEv
-__ZN7WebCore20CompositeEditCommand9inputTextERKNS_6StringEb
 __ZNK7WebCore19RemoveFormatCommand13editingActionEv
+__ZN7WebCore19RemoveFormatCommandD0Ev
 __ZN7WebCore20CompositeEditCommand39pushPartiallySelectedAnchorElementsDownEv
 __ZN7WebCore20CompositeEditCommand18applyStyledElementEN3WTF10PassRefPtrINS_7ElementEEE
 __ZN7WebCore17ApplyStyleCommandC1EN3WTF10PassRefPtrINS_7ElementEEEbNS_10EditActionE
-__ZN7WebCoreL18executeInsertImageEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCoreL17executeInsertNodeEPNS_5FrameEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCoreL21executeInsertFragmentEPNS_5FrameEN3WTF10PassRefPtrINS_16DocumentFragmentEEE
-__ZN7WebCore23ReplaceSelectionCommand37insertNodeAfterAndUpdateNodesInsertedEN3WTF10PassRefPtrINS_4NodeEEEPS3_
-__ZN7WebCore17InsertListCommand20fixOrphanedListChildEPNS_4NodeE
-__ZN7WebCoreL27executeInsertHorizontalRuleEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17ApplyStyleCommandC2EN3WTF10PassRefPtrINS_7ElementEEEbNS_10EditActionE
+__ZN7WebCoreL26executeInsertUnorderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17InsertListCommandC1EPNS_8DocumentENS0_4TypeE
+__ZN7WebCore17InsertListCommandC2EPNS_8DocumentENS0_4TypeE
+__ZN7WebCore17InsertListCommand7doApplyEv
+__ZN7WebCore22outermostEnclosingListEPNS_4NodeE
+__ZN7WebCore18enclosingTableCellERKNS_8PositionE
+__ZN7WebCore26createUnorderedListElementEPNS_8DocumentE
+__ZNK7WebCore17InsertListCommand20preservesTypingStyleEv
+__ZNK7WebCore17InsertListCommand13editingActionEv
+__ZN7WebCoreL17executeToggleBoldEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL18executeToggleStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiPKcS5_
+__ZNK7WebCore6Editor22selectionStartHasStyleEPNS_19CSSStyleDeclarationE
+__ZN7WebCoreL14executeOutdentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20IndentOutdentCommand13outdentRegionEv
+__ZN7WebCore20IndentOutdentCommand16outdentParagraphEv
+__ZN7WebCoreL24isListOrIndentBlockquoteEPKNS_4NodeE
+__ZN7WebCore17InsertListCommandD0Ev
+__ZN7WebCore32jsDOMWindowPrototypeFunctionBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow4blurEv
+__ZN7WebCore5Frame13unfocusWindowEv
+__ZNK7WebCore6Chrome7unfocusEv
+__ZN7WebCore11inSameBlockERKNS_15VisiblePositionES2_
+__ZN7WebCore8Position12moveToOffsetEi
 __ZN7WebCore20CompositeEditCommand30splitTextNodeContainingElementEN3WTF10PassRefPtrINS_4TextEEEj
 __ZN7WebCore37SplitTextNodeContainingElementCommandC1EN3WTF10PassRefPtrINS_4TextEEEi
+__ZN7WebCore37SplitTextNodeContainingElementCommandC2EN3WTF10PassRefPtrINS_4TextEEEi
 __ZN7WebCore37SplitTextNodeContainingElementCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand23wrapContentsInDummySpanEN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore30WrapContentsInDummySpanCommandC1EN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore30WrapContentsInDummySpanCommandC2EN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore30WrapContentsInDummySpanCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand12splitElementEN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore19SplitElementCommandC1EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore19SplitElementCommandC2EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore19SplitElementCommand7doApplyEv
 __ZN7WebCoreL24dummySpanAncestorForNodeEPKNS_4NodeE
 __ZN7WebCore17ApplyStyleCommand27mergeEndWithNextIfIdenticalERKNS_8PositionES3_
 __ZN7WebCoreL20areIdenticalElementsEPNS_4NodeES1_
 __ZN7WebCore20CompositeEditCommand22mergeIdenticalElementsEN3WTF10PassRefPtrINS_7ElementEEES4_
 __ZN7WebCore29MergeIdenticalElementsCommandC1EN3WTF10PassRefPtrINS_7ElementEEES4_
+__ZN7WebCore29MergeIdenticalElementsCommandC2EN3WTF10PassRefPtrINS_7ElementEEES4_
 __ZN7WebCore29MergeIdenticalElementsCommand7doApplyEv
+__ZN7WebCoreL19isUnstyledStyleSpanEPKNS_4NodeE
+__ZN7WebCore37SplitTextNodeContainingElementCommandD0Ev
+__ZN7WebCore30WrapContentsInDummySpanCommandD0Ev
+__ZN7WebCore19SplitElementCommandD0Ev
+__ZN7WebCore29MergeIdenticalElementsCommandD0Ev
+__ZN7WebCoreL19executeJustifyRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL17executeInsertHTMLEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL21executeInsertFragmentEPNS_5FrameEN3WTF10PassRefPtrINS_16DocumentFragmentEEE
+__ZN7WebCore23ReplaceSelectionCommand37insertNodeAfterAndUpdateNodesInsertedEN3WTF10PassRefPtrINS_4NodeEEEPS3_
+__ZN7WebCore23ReplaceSelectionCommand11shouldMergeERKNS_15VisiblePositionES3_
+__ZNK7WebCore23ReplaceSelectionCommand13editingActionEv
+__ZN7WebCoreL11executeCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor4copyEv
+__ZN7WebCore6Editor12tryDHTMLCopyEv
+__ZN7WebCore10Pasteboard17generalPasteboardEv
+__ZN7WebCore10PasteboardC1EP12NSPasteboard
+__ZN7WebCore10PasteboardC2EP12NSPasteboard
+__ZN7WebCore10Pasteboard5clearEv
+__ZN7WebCore6Editor13selectedRangeEv
+__ZN7WebCore10Pasteboard14writeSelectionEPNS_5RangeEbPNS_5FrameE
+__ZN7WebCore10Pasteboard14writeSelectionEP12NSPasteboardPNS_5RangeEbPNS_5FrameE
+-[DOMObject copyWithZone:]
+-[DOMCSSPrimitiveValue getStringValue]
+__ZNK7WebCore17CSSPrimitiveValue14getStringValueERi
+__ZN7WebCoreL14valueForShadowEPKNS_10ShadowDataE
+-[DOMElement(WebPrivate) _font]
+-[DOMRGBColor(WebPrivate) _color]
+-[DOMRGBColor color]
+__ZN7WebCore16LegacyWebArchive19createFromSelectionEPNS_5FrameE
+__ZNK7WebCore5Range4textEv
+__ZN7WebCore6Editor29didWriteSelectionToPasteboardEv
+__ZN7WebCoreL14supportedPasteEPNS_5FrameENS_19EditorCommandSourceE
+__ZN7WebCoreL12enabledPasteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL12executePasteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor5pasteEv
+__ZN7WebCore6Editor13tryDHTMLPasteEv
+__ZN7WebCore14DocumentLoader22addAllArchiveResourcesEPNS_7ArchiveE
+__ZN7WebCore25ArchiveResourceCollectionC1Ev
+__ZN7WebCore25ArchiveResourceCollectionC2Ev
+__ZN7WebCore25ArchiveResourceCollection15addAllResourcesEPNS_7ArchiveE
+__Z4coreP19DOMDocumentFragment
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEmPKS3_
+__ZN7WebCore17InsertListCommand11modifyRangeEv
+__ZN7WebCore20CompositeEditCommand9inputTextERKNS_6StringEb
+__ZN7WebCore27jsHTMLOptionElementSelectedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLSelectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17ApplyStyleCommand26extractTextDecorationStyleEPNS_4NodeE
+__ZN7WebCore20CompositeEditCommand17removeCSSPropertyEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE13CSSPropertyID
+__ZN7WebCore24RemoveCSSPropertyCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE13CSSPropertyID
+__ZN7WebCore24RemoveCSSPropertyCommandC2EPNS_8DocumentEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE13CSSPropertyID
+__ZN7WebCore24RemoveCSSPropertyCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand19removeNodeAttributeEN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameE
+__ZN7WebCore24RemoveCSSPropertyCommandD0Ev
+__ZN7WebCoreL24executeInsertOrderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore24createOrderedListElementEPNS_8DocumentE
+__ZN7WebCore20startOfNextParagraphERKNS_15VisiblePositionE
+__ZN7WebCore39jsRangePrototypeFunctionExtractContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range15extractContentsERi
+__ZN7WebCore5Range18checkDeleteExtractERi
+__ZN7WebCore5Range15processContentsENS0_10ActionTypeERi
+__ZN7WebCore17ApplyStyleCommand19removeHTMLStyleNodeEPNS_11HTMLElementE
+__ZN7WebCore20CompositeEditCommand15insertLineBreakEv
+__ZN3WTF6VectorISt4pairIiiELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIiiELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorISt4pairIiiELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIiiELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIiiELm0EE6shrinkEm
+__ZN7WebCore15isEndOfDocumentERKNS_15VisiblePositionE
 __ZN7WebCoreL32enabledRangeInRichlyEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
 __ZN7WebCoreL13executeUnlinkEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13UnlinkCommandC1EPNS_8DocumentE
 __ZN7WebCore13UnlinkCommandC2EPNS_8DocumentE
 __ZN7WebCore13UnlinkCommand7doApplyEv
 __ZN7WebCore20CompositeEditCommand21pushAnchorElementDownEPNS_4NodeE
 __ZN7WebCore20CompositeEditCommand19removeStyledElementEN3WTF10PassRefPtrINS_7ElementEEE
 __ZNK7WebCore13UnlinkCommand13editingActionEv
-__ZN7WebCore23ReplaceSelectionCommand11shouldMergeERKNS_15VisiblePositionES3_
+__ZN7WebCore13UnlinkCommandD0Ev
+__ZN7WebCoreL16executeUnderlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore17ApplyStyleCommand33mergeStartWithPreviousIfIdenticalERKNS_8PositionES3_
-__ZN7WebCore18FormatBlockCommand11modifyRangeEv
-__ZN7WebCore5Frame24computeAndSetTypingStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCoreL17executeFindStringEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20CompositeEditCommand23wrapContentsInDummySpanEN3WTF10PassRefPtrINS_7ElementEEE
-__ZN7WebCore30WrapContentsInDummySpanCommandC1EN3WTF10PassRefPtrINS_7ElementEEE
-__ZN7WebCore30WrapContentsInDummySpanCommand7doApplyEv
-__ZN7WebCoreL17executeInsertHTMLEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17ApplyStyleCommand19removeHTMLStyleNodeEPNS_11HTMLElementE
-__ZN7WebCore11inSameBlockERKNS_15VisiblePositionES2_
-__ZN7WebCore46jsDocumentPrototypeFunctionQueryCommandEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8Document19queryCommandEnabledERKNS_6StringE
-__ZN7WebCore20CompositeEditCommand15insertLineBreakEv
-__ZN7WebCore32jsDOMWindowPrototypeFunctionFindEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9DOMWindow4findERKNS_6StringEbbbbbb
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEmPKS3_
-__ZN7WebCore20CompositeEditCommand27addBlockPlaceholderIfNeededEPNS_7ElementE
-__ZNK7WebCore14RenderListItem7isEmptyEv
-__ZN7WebCoreL20executeStrikethroughEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore48jsDocumentPrototypeFunctionQueryCommandSupportedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document21queryCommandSupportedERKNS_6StringE
+__ZN7WebCoreL19executeStyleWithCSSEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore46jsCanvasRenderingContext2DPrototypeFunctionArcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D3arcEfffffbRi
+__ZN7WebCore4Path6addArcERKNS_10FloatPointEfffb
+__ZN7WebCore51jsCanvasRenderingContext2DPrototypeFunctionFillRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D8fillRectEffff
+__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectE
 __ZN7WebCoreL10executeCutEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor3cutEv
 __ZN7WebCore6Editor11tryDHTMLCutEv
-__ZN7WebCoreL12executePrintEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore6Chrome5printEPNS_5FrameE
-__ZN7WebCore31setJSHTMLElementContentEditableEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
+__ZN7WebCoreL17executeFindStringEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL27executeInsertHorizontalRuleEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL17executeInsertNodeEPNS_5FrameEN3WTF10PassRefPtrINS_4NodeEEE
+__ZNK7WebCore14ClipboardEvent16isClipboardEventEv
+__ZNK7WebCore14ClipboardEvent9clipboardEv
+__ZN7WebCore11JSClipboard15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSClipboardC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ClipboardEEE
+__ZN7WebCore11JSClipboardC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ClipboardEEE
+__ZN7WebCore11JSClipboard18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSClipboardPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsClipboardPrototypeFunctionSetDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSClipboard9classInfoEv
+__ZN7WebCore11JSClipboard7setDataEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12ClipboardMac7setDataERKNS_6StringES3_
+__ZN7WebCoreL21cocoaTypeFromMIMETypeERKNS_6StringE
+__ZN7WebCore35jsClipboardPrototypeFunctionGetDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSClipboard7getDataEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore12ClipboardMac7getDataERKNS_6StringERb
+__ZN7WebCore11JSClipboardD1Ev
+__ZN7WebCore11JSClipboardD2Ev
+__ZN7WebCore20JSClipboardPrototypeD1Ev
+__ZN7WebCore31setJSHTMLElementContentEditableEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore11HTMLElement18setContentEditableERKNS_6StringE
-__ZN7WebCore48jsDOMSelectionPrototypeFunctionSelectAllChildrenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12DOMSelection17selectAllChildrenEPNS_4NodeERi
-__ZN7WebCore39jsDocumentPrototypeFunctionGetSelectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore8Document12getSelectionEv
+__ZN7WebCore46jsDOMSelectionPrototypeFunctionRemoveAllRangesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection15removeAllRangesEv
 __ZNK7WebCore6Editor9canDeleteEv
-__ZN7WebCoreL16executeSubscriptEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCoreL18executeSuperscriptEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17ApplyStyleCommand35extractAndNegateTextDecorationStyleEPNS_4NodeE
+__ZN7WebCoreL23enabledVisibleSelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore46jsDocumentPrototypeFunctionQueryCommandEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document19queryCommandEnabledERKNS_6StringE
+__ZN7WebCore17isStartOfDocumentERKNS_15VisiblePositionE
+__ZNK7WebCore16RenderPartObject10renderNameEv
+__ZN7WebCore24setJSHTMLAreaElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement7setHrefERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAreaElementCoordsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement9setCoordsERKNS_12AtomicStringE
+__ZN7WebCore12EventHandler32handleMousePressEventDoubleClickERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler31selectClosestWordFromMouseEventERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore16VisibleSelection22expandUsingGranularityENS_15TextGranularityE
+__ZN7WebCore11isEndOfLineERKNS_15VisiblePositionE
+__ZN7WebCore9endOfLineERKNS_15VisiblePositionE
+__ZN7WebCoreL18endPositionForLineERKNS_15VisiblePositionE
+__ZN7WebCore6Editor33isSelectTrailingWhitespaceEnabledEv
+__ZN7WebCore12EventHandler27handleMouseDoubleClickEventERKNS_18PlatformMouseEventE
+__ZN7WebCore11RenderBlock26addContinuationWithOutlineEPNS_12RenderInlineE
+__ZNK3WTF7HashMapIPN7WebCore11RenderBlockEPNS_11ListHashSetIPNS1_12RenderInlineENS_7PtrHashIS6_EEEENS7_IS3_EENS_10HashTraitsIS3
+__ZN3WTF7HashMapIPN7WebCore11RenderBlockEPNS_11ListHashSetIPNS1_12RenderInlineENS_7PtrHashIS6_EEEENS7_IS3_EENS_10HashTraitsIS3_
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockESt4pairIS3_PNS_11ListHashSetIPNS1_12RenderInlineENS_7PtrHashIS7_EEEEENS_18PairFirstE
+__ZN7WebCore19jsDOMWindowOnscrollEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onscrollEv
+__ZN7WebCore22setJSDOMWindowOnscrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnscrollEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17jsNodeOnmousemoveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node11onmousemoveEv
+__ZN7WebCoreL18executeInsertImageEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL19executeToggleItalicEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL16executeForeColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZNK7WebCore6Editor17shouldDeleteRangeEPNS_5RangeE
 __ZNK7WebCore6Editor14canDeleteRangeEPNS_5RangeE
 __ZN7WebCore6Editor30deleteSelectionWithSmartDeleteEb
 __ZNK7WebCore22DeleteSelectionCommand20preservesTypingStyleEv
 __ZNK7WebCore22DeleteSelectionCommand13editingActionEv
-__ZN7WebCore29MergeIdenticalElementsCommandD1Ev
-__ZN7WebCore30WrapContentsInDummySpanCommandD1Ev
+__ZN7WebCore29isCharacterSmartReplaceExemptEib
+__ZN7WebCoreL11getSmartSetEb
+__ZN7WebCoreL12executePrintEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Chrome5printEPNS_5FrameE
+__ZN7WebCore44jsDocumentPrototypeFunctionQueryCommandStateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document17queryCommandStateERKNS_6StringE
+__ZN7WebCoreL18stateUnorderedListEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor27selectionUnorderedListStateEv
+__ZN7WebCoreL16stateOrderedListEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor25selectionOrderedListStateEv
+__ZN7WebCore17InsertListCommand20fixOrphanedListChildEPNS_4NodeE
+__ZN7WebCoreL20executeStrikethroughEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17ApplyStyleCommand24applyTextDecorationStyleEPNS_4NodeEPNS_26CSSMutableStyleDeclarationE
+__ZN7WebCore49jsCSSStyleDeclarationPrototypeFunctionSetPropertyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL16executeSubscriptEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL18executeSuperscriptEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17ApplyStyleCommand35extractAndNegateTextDecorationStyleEPNS_4NodeE
+__ZN7WebCore6Editor24insertParagraphSeparatorEv
+__ZN7WebCoreL19executeMoveBackwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore55jsHTMLTextAreaElementPrototypeFunctionSetSelectionRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore17InsertTextCommand21performTrivialReplaceERKNS_6StringEb
+__ZN7WebCore25setJSHTMLAnchorElementRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement6setRelERKNS_12AtomicStringE
 __ZN7WebCore20CompositeEditCommand27insertNodeAtTabSpanPositionEN3WTF10PassRefPtrINS_4NodeEEERKNS_8PositionE
-__ZN7WebCore20SplitTextNodeCommand9doUnapplyEv
+__ZNK7WebCore11RenderTheme11systemColorEi
+__ZN7WebCore10JSNodeList10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore35jsDOMWindowXSLTProcessorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow13xsltProcessorEPN3JSC9ExecStateE
+__ZN7WebCore26JSXSLTProcessorConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore26JSXSLTProcessorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSXSLTProcessorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSXSLTProcessor15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSXSLTProcessorConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL22constructXSLTProcessorEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XSLTProcessorEEE
+__ZN7WebCore15JSXSLTProcessorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XSLTProcessorEEE
+__ZN7WebCore22HTMLFormControlElement5resetEv
+__ZN7WebCore15JSXSLTProcessorD1Ev
+__ZN7WebCore15JSXSLTProcessorD2Ev
+__ZN7WebCore24JSXSLTProcessorPrototypeD1Ev
+__ZN7WebCore26JSXSLTProcessorConstructorD1Ev
+__ZN7WebCore17AppendNodeCommand9doUnapplyEv
 __ZN7WebCoreL11enabledRedoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
 __ZN7WebCore6Editor7canRedoEv
 __ZN7WebCoreL11executeRedoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
@@ -15713,981 +14746,1323 @@
 __ZN7WebCore20CompositeEditCommand9doReapplyEv
 __ZN7WebCore11EditCommand9doReapplyEv
 __ZN7WebCore6Editor16reappliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCoreL22caretMaxRenderedOffsetEPKNS_4NodeE
-__ZN7WebCore12_GLOBAL__N_120convertedSpaceStringEv
+__ZN7WebCore12EventHandler22defaultTabEventHandlerEPNS_13KeyboardEventE
+__ZN7WebCoreL16executeInsertTabEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore19ReplacementFragment30insertFragmentForTestRenderingEPNS_4NodeE
+__ZN7WebCore19ReplacementFragment35restoreTestRenderingNodesToFragmentEPNS_4NodeE
+__ZN7WebCore19ReplacementFragment21removeUnrenderedNodesEPNS_4NodeE
+__ZN7WebCore14isNodeRenderedEPKNS_4NodeE
 __ZN7WebCore20CompositeEditCommand24insertParagraphSeparatorEb
+__ZN7WebCoreL25executePasteAndMatchStyleEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor16pasteAsPlainTextEv
+__ZN7WebCore6Editor30pasteAsPlainTextWithPasteboardEPNS_10PasteboardE
+__ZN7WebCore10Pasteboard9plainTextEPNS_5FrameE
+__ZN7WebCore6Editor29canSmartReplaceWithPasteboardEPNS_10PasteboardE
+__ZN7WebCore10Pasteboard15canSmartReplaceEv
+__ZN7WebCore6Editor24replaceSelectionWithTextERKNS_6StringEbb
+__ZN7WebCore6Editor28replaceSelectionWithFragmentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbb
 __ZN7WebCoreL19stringValueForRangeEPKNS_4NodeEPKNS_5RangeE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE6shrinkEm
+__ZN7WebCoreL25stripAttachmentCharactersEP18NSAttributedString
+__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_15ArchiveResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_15ArchiveResourceEEEENS_18PairFirstExtractorIS7_EENS1_10StringHas
+__ZNK7WebCore14RenderMenuList10renderNameEv
+__ZN7WebCore5Range11compareNodeEPNS_4NodeERi
+__ZN7WebCore12ClipboardMac10writeRangeEPNS_5RangeEPNS_5FrameE
+__ZN7WebCore6Editor24smartInsertDeleteEnabledEv
+__ZN7WebCore27createDragImageForSelectionEPNS_5FrameE
+__ZN7WebCore5Frame21dragImageForSelectionEv
+__ZNK7WebCore5Frame14selectionImageEb
+__ZN7WebCore9FrameView19setPaintRestrictionENS_16PaintRestrictionE
+__ZNK7WebCore5Frame13imageFromRectE6CGRect
+__ZN7WebCore14DragController10dragIsMoveEPNS_19SelectionControllerE
+__ZN7WebCore14DragController13isCopyKeyDownEv
+__ZNK7WebCore8DragData10asFragmentEPNS_8DocumentE
+__ZN7WebCore6Editor20shouldInsertFragmentEN3WTF10PassRefPtrINS_16DocumentFragmentEEENS2_INS_5RangeEEENS_18EditorInsertActionE
+__ZNK7WebCore4Node19isCharacterDataNodeEv
+__ZNK7WebCore8DragData15canSmartReplaceEv
+__ZN7WebCore20MoveSelectionCommandC1EN3WTF10PassRefPtrINS_16DocumentFragmentEEERKNS_8PositionEb
+__ZN7WebCore20MoveSelectionCommandC2EN3WTF10PassRefPtrINS_16DocumentFragmentEEERKNS_8PositionEb
+__ZN7WebCore20MoveSelectionCommand7doApplyEv
+__ZNK7WebCore20MoveSelectionCommand13editingActionEv
+__ZN7WebCore20MoveSelectionCommandD0Ev
+__ZN7WebCore42jsRangePrototypeFunctionSelectNodeContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26setJSHTMLOListElementStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLOListElement8setStartEi
+__ZN7WebCore26CSSMutableStyleDeclaration17addParsedPropertyERKNS_11CSSPropertyE
+__ZN7WebCore10systemBeepEv
+__ZN7WebCore10Pasteboard10writeImageEPNS_4NodeERKNS_4KURLERKNS_6StringE
+__ZN7WebCoreL21writableTypesForImageEv
+__ZN7WebCoreL19writableTypesForURLEv
+__ZN7WebCore10Pasteboard8writeURLEP12NSPasteboardP7NSArrayRKNS_4KURLERKNS_6StringEPNS_5FrameE
+_suggestedFilenameWithMIMEType
+_filenameByFixingIllegalCharacters
+__ZN7WebCore16MIMETypeRegistry24getExtensionsForMIMETypeERKNS_6StringE
+__ZN7WebCore10Pasteboard32writeFileWrapperAsRTFDAttachmentEP13NSFileWrapper
+__ZN7WebCore14DocumentLoader18addArchiveResourceEN3WTF10PassRefPtrINS_15ArchiveResourceEEE
+__ZN7WebCore25ArchiveResourceCollection11addResourceEN3WTF10PassRefPtrINS_15ArchiveResourceEEE
+__ZN7WebCore25ArchiveResourceCollection21archiveResourceForURLERKNS_4KURLE
+__ZNK3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_15ArchiveResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14ResourceLoaderEEENS1_INS2_18SubstituteResourceEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEN
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14ResourceLoaderEEESt4pairIS4_NS1_INS2_18SubstituteResourceEEEENS_18PairFirstExtractorIS
+__ZN7WebCore5TimerINS_14DocumentLoaderEE5firedEv
+__ZN7WebCore14DocumentLoader36substituteResourceDeliveryTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore7Element5styleEv
+__ZNK7WebCore8Document10isFrameSetEv
+__ZN7WebCoreL23setSelectionToDragCaretEPNS_5FrameERNS_16VisibleSelectionERN3WTF6RefPtrINS_5RangeEEERKNS_8IntPointE
+__ZN7WebCoreL22caretMaxRenderedOffsetEPKNS_4NodeE
+__ZN7WebCore8Document23activeChainNodeDetachedEPNS_4NodeE
+__ZN7WebCore12EventHandler15hoverTimerFiredEPNS_5TimerIS0_EE
+__ZNK7WebCore11RenderTheme32inactiveSelectionBackgroundColorEv
+__ZN7WebCore14RenderReplaced16positionForPointERKNS_8IntPointE
+__ZN7WebCore12ClipboardMac8writeURLERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZNK7WebCore12RenderButton10renderNameEv
+__ZNK7WebCore8DragData11asPlainTextEv
+__ZN7WebCoreL11executeYankEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor16yankFromKillRingEv
+__ZN7WebCore6Editor24setKillRingToYankedStateEv
+__ZN7WebCoreL33executeMoveToBeginningOfParagraphEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZNK7WebCore9Clipboard20destinationOperationERNS_13DragOperationE
+__ZN7WebCore12EventHandler18performDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
+-[DOMHTMLInputElement type]
+__ZNK7WebCore16HTMLInputElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK3JSC8JSObject14isGlobalObjectEv
+__ZN3JSC16RuntimeObjectImp11getCallDataERNS_8CallDataE
+__ZNK3JSC8Bindings12ObjcInstance27supportsInvokeDefaultMethodEv
+__ZN3JSCL17callRuntimeObjectEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8Bindings12ObjcInstance19invokeDefaultMethodEPNS_9ExecStateERKNS_7ArgListE
+__ZN7WebCore27jsHTMLAnchorElementHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8hostnameEv
+-[DOMHTMLOListElement start]
 -[DOMHTMLTableElement cellSpacing]
 -[DOMHTMLTableElement cellPadding]
 -[DOMHTMLTableCellElement rowSpan]
 -[DOMHTMLTableCellElement colSpan]
 -[DOMHTMLTableCellElement width]
 -[DOMHTMLTableCellElement height]
-__ZN7WebCore19SplitElementCommand9doUnapplyEv
-__ZN7WebCore26CSSMutableStyleDeclaration17addParsedPropertyERKNS_11CSSPropertyE
-__ZN7WebCore10systemBeepEv
-__ZN7WebCoreL23fillContainerFromStringEPNS_13ContainerNodeERKNS_6StringE
-__ZN7WebCoreL25stripAttachmentCharactersEP18NSAttributedString
-__ZN7WebCore49jsDOMSelectionPrototypeFunctionDeleteFromDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12DOMSelection18deleteFromDocumentEv
-__ZN7WebCore12RenderWidget17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZN7WebCore24jsDOMSelectionBaseOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12DOMSelection10baseOffsetEv
+__ZNK7WebCore14CSSCharsetRule4typeEv
+__ZN7WebCore16JSCSSCharsetRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSCSSCharsetRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CSSCharsetRuleEEE
+__ZN7WebCore16JSCSSCharsetRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CSSCharsetRuleEEE
+__ZN7WebCore16JSCSSCharsetRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSCSSRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16JSCSSCharsetRuleD1Ev
+__ZN7WebCore25JSCSSCharsetRulePrototypeD1Ev
+__ZN7WebCore30jsHTMLButtonElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLButtonElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLButtonElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLButtonElementConstructorD1Ev
+__ZN7WebCore24parseXMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentEPNS_7ElementE
+__ZN7WebCore12XMLTokenizerC1EPNS_16DocumentFragmentEPNS_7ElementE
+__ZN7WebCore12XMLTokenizerC2EPNS_16DocumentFragmentEPNS_7ElementE
+__ZN7WebCore12XMLTokenizerD1Ev
+__ZN7WebCore12XMLTokenizerD2Ev
+__ZN7WebCore20createTabSpanElementEPNS_8DocumentERKNS_6StringE
+__ZN7WebCore17RemoveNodeCommand9doUnapplyEv
+__ZN7WebCore23InsertNodeBeforeCommand9doUnapplyEv
+__ZN7WebCore8RenderBR16positionForPointERKNS_8IntPointE
 __ZN7WebCore20nextSentencePositionERKNS_15VisiblePositionE
-__ZN7WebCoreL28nextSentencePositionBoundaryEPKtj
-__ZN7WebCore22jsDOMSelectionBaseNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12DOMSelection8baseNodeEv
-__ZN7WebCore24jsDOMSelectionExtentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12DOMSelection10extentNodeEv
+__ZN7WebCoreL28nextSentencePositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore21sentenceBreakIteratorEPKti
+__ZN7WebCore24previousSentencePositionERKNS_15VisiblePositionE
+__ZN7WebCoreL32previousSentencePositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCoreL46executeMoveToBeginningOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL40executeMoveToEndOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL51executeMoveToBeginningOfParagraphAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL45executeMoveToEndOfParagraphAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZNK7WebCore11ShadowValue7cssTextEv
+__ZN3WTF7HashMapIPKN7WebCore14RenderReplacedENS1_7IntRectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3setERKS4_RKS5_
+__ZN3WTF9HashTableIPKN7WebCore14RenderReplacedESt4pairIS4_NS1_7IntRectEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS4_EENS_14Pair
+__ZNK3WTF7HashMapIPKN7WebCore14RenderReplacedENS1_7IntRectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3getERKS4_
+__ZN7WebCore12EventHandler32handleMousePressEventTripleClickERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore20endOfEditableContentERKNS_15VisiblePositionE
+__ZN7WebCore21ContextMenuController16clearContextMenuEv
+__ZN7WebCore12EventHandler20sendContextMenuEventERKNS_18PlatformMouseEventE
+__ZN7WebCore12EventHandler37selectClosestWordOrLinkFromMouseEventERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore21ContextMenuController22handleContextMenuEventEPNS_5EventE
+__ZN7WebCore11ContextMenuC1ERKNS_13HitTestResultE
+__ZN7WebCore11ContextMenuC2ERKNS_13HitTestResultE
++[WebCoreMenuTarget sharedMenuTarget]
+__ZNK7WebCore11ContextMenu10controllerEv
+-[WebCoreMenuTarget setMenuController:]
+__ZN7WebCore11ContextMenu8populateEv
+__ZN7WebCore26contextMenuItemTagOpenLinkEv
+__ZN7WebCore15ContextMenuItemC1ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKNS_6StringEPNS_11ContextMenuE
+__ZN7WebCore15ContextMenuItemC2ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKNS_6StringEPNS_11ContextMenuE
+__ZN7WebCore37contextMenuItemTagOpenLinkInNewWindowEv
+__ZN7WebCore36contextMenuItemTagDownloadLinkToDiskEv
+__ZN7WebCore37contextMenuItemTagCopyLinkToClipboardEv
+__ZN7WebCore38contextMenuItemTagOpenImageInNewWindowEv
+__ZN7WebCore37contextMenuItemTagDownloadImageToDiskEv
+__ZN7WebCore38contextMenuItemTagCopyImageToClipboardEv
+__ZN7WebCore35contextMenuItemTagSearchInSpotlightEv
+__ZN7WebCore36contextMenuItemTagLookUpInDictionaryEv
+__ZN7WebCore27contextMenuItemTagSearchWebEv
+__ZN7WebCore22contextMenuItemTagCopyEv
+__ZN7WebCore24contextMenuItemTagGoBackEv
+__ZN7WebCore27contextMenuItemTagGoForwardEv
+__ZN7WebCore22contextMenuItemTagStopEv
+__ZN7WebCore24contextMenuItemTagReloadEv
+__ZN7WebCore38contextMenuItemTagOpenFrameInNewWindowEv
+__ZN7WebCore32contextMenuItemTagNoGuessesFoundEv
+__ZN7WebCore32contextMenuItemTagIgnoreSpellingEv
+__ZN7WebCore31contextMenuItemTagLearnSpellingEv
+__ZN7WebCore31contextMenuItemTagIgnoreGrammarEv
+__ZN7WebCore21contextMenuItemTagCutEv
+__ZN7WebCore23contextMenuItemTagPasteEv
+__ZN7WebCoreL29selectionContainsPossibleWordEPNS_5FrameE
+__ZN7WebCore11ContextMenu10appendItemERNS_15ContextMenuItemE
+__ZNK7WebCore11ContextMenu21checkOrEnableIfNeededERNS_15ContextMenuItemE
+__ZNK7WebCore15ContextMenuItem4typeEv
+__ZNK7WebCore15ContextMenuItem6actionEv
+__ZN7WebCore15ContextMenuItem10setCheckedEb
+__ZN7WebCore15ContextMenuItem10setEnabledEb
+__ZN7WebCore15ContextMenuItem26releasePlatformDescriptionEv
+__ZN7WebCoreL17setMenuItemTargetEP10NSMenuItem
+__ZN7WebCoreL13separatorItemEv
+__ZN7WebCore15ContextMenuItemD1Ev
+__ZN7WebCore15ContextMenuItemD2Ev
+__ZNK7WebCore11ContextMenu19platformDescriptionEv
+__ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
+__ZSt5mergeIPN7WebCore20CSSGradientColorStopES2_S2_PFbRKS1_S4_EET1_T_S8_T0_S9_S7_T2_
+__ZN7WebCore5Image21mayFillWithSolidColorEv
+__ZNK7WebCore14GeneratedImage4sizeEv
+__ZNK7WebCore14GeneratedImage16hasRelativeWidthEv
+__ZNK7WebCore14GeneratedImage17hasRelativeHeightEv
+__ZN7WebCoreL36executeMoveForwardAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore26jsDOMSelectionExtentOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore12DOMSelection12extentOffsetEv
-__ZN7WebCore39jsDOMSelectionPrototypeFunctionCollapseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12DOMSelection8collapseEPNS_4NodeEiRi
-__ZN7WebCore20endOfEditableContentERKNS_15VisiblePositionE
-__ZN7WebCore43jsDOMSelectionPrototypeFunctionContainsNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZNK7WebCore12DOMSelection16visibleSelectionEv
+__ZN7WebCoreL14extentPositionERKNS_16VisibleSelectionE
+__ZN7WebCore24jsDOMSelectionBaseOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection10baseOffsetEv
+__ZN7WebCoreL12basePositionERKNS_16VisibleSelectionE
+__ZN7WebCoreL37executeMoveBackwardAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore18jsDOMSelectionTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection4typeEv
+__ZN3JSC16RuntimeObjectImp3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8Bindings9ObjcFieldC1EP9objc_ivar
+__ZN3JSC8Bindings9ObjcFieldC2EP9objc_ivar
+__ZNK3JSC8Bindings9ObjcField18setValueToInstanceEPNS_9ExecStateEPKNS0_8InstanceENS_7JSValueE
+__ZN7WebCore13endOfSentenceERKNS_15VisiblePositionE
+__ZN7WebCoreL19endSentenceBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore15startOfSentenceERKNS_15VisiblePositionE
+__ZN7WebCoreL21startSentenceBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore24jsDOMSelectionExtentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection10extentNodeEv
+__ZN7WebCore11ContextMenuD1Ev
+__ZN7WebCore11ContextMenuD2Ev
+__ZN7WebCore6Editor44guessesForMisspelledOrUngrammaticalSelectionERbS1_
+__ZNK7WebCore13HitTestResult14replacedStringEv
+__ZN7WebCore30contextMenuItemTagSpellingMenuEv
+__ZN7WebCore35contextMenuItemTagShowSpellingPanelEb
+__ZN7WebCore31contextMenuItemTagCheckSpellingEv
+__ZN7WebCore42contextMenuItemTagCheckSpellingWhileTypingEv
+__ZN7WebCore42contextMenuItemTagCheckGrammarWithSpellingEv
+__ZN7WebCore46contextMenuItemTagCorrectSpellingAutomaticallyEv
+__ZN7WebCore6Editor22spellingPanelIsShowingEv
+__ZN7WebCore15ContextMenuItem8setTitleERKNS_6StringE
+__ZN7WebCore15ContextMenuItem10setSubMenuEPNS_11ContextMenuE
+__ZN7WebCore35contextMenuItemTagSubstitutionsMenuEv
+__ZN7WebCore35contextMenuItemTagShowSubstitutionsEb
+__ZN7WebCore32contextMenuItemTagSmartCopyPasteEv
+__ZN7WebCore29contextMenuItemTagSmartQuotesEv
+__ZN7WebCore29contextMenuItemTagSmartDashesEv
+__ZN7WebCore28contextMenuItemTagSmartLinksEv
+__ZN7WebCore33contextMenuItemTagTextReplacementEv
+__ZN7WebCore6Editor27substitutionsPanelIsShowingEv
+__ZN7WebCore37contextMenuItemTagTransformationsMenuEv
+__ZN7WebCore31contextMenuItemTagMakeUpperCaseEv
+__ZN7WebCore31contextMenuItemTagMakeLowerCaseEv
+__ZN7WebCore28contextMenuItemTagCapitalizeEv
+__ZN7WebCore26contextMenuItemTagFontMenuEv
+__ZN7WebCore27contextMenuItemTagShowFontsEv
+__ZN7WebCore22contextMenuItemTagBoldEv
+__ZN7WebCore24contextMenuItemTagItalicEv
+__ZN7WebCore27contextMenuItemTagUnderlineEv
+__ZN7WebCore25contextMenuItemTagOutlineEv
+__ZN7WebCore24contextMenuItemTagStylesEv
+__ZN7WebCore28contextMenuItemTagShowColorsEv
+__ZN7WebCore8Document25createCSSStyleDeclarationEv
+__ZN7WebCore28contextMenuItemTagSpeechMenuEv
+__ZN7WebCore31contextMenuItemTagStartSpeakingEv
+__ZN7WebCore30contextMenuItemTagStopSpeakingEv
+__ZN7WebCore38contextMenuItemTagWritingDirectionMenuEv
+__ZN7WebCore34contextMenuItemTagDefaultDirectionEv
+__ZN7WebCore29contextMenuItemTagLeftToRightEv
+__ZN7WebCore29contextMenuItemTagRightToLeftEv
+__ZNK7WebCore6Editor16hasBidiSelectionEv
+__ZNK7WebCore11FrameLoader18canGoBackOrForwardEi
+__ZN7WebCore22jsDOMSelectionBaseNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection8baseNodeEv
+__ZN7WebCore19SelectionController16modifyMovingLeftENS_15TextGranularityE
+__ZNK7WebCore15VisiblePosition4leftEb
+__ZNK7WebCore15VisiblePosition29leftVisuallyDistinctCandidateEv
+__ZN7WebCore24jsDOMSelectionAnchorNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection10anchorNodeEv
+__ZN7WebCoreL14anchorPositionERKNS_16VisibleSelectionE
+__ZN7WebCore26jsDOMSelectionAnchorOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection12anchorOffsetEv
+__ZN7WebCore19SelectionController17modifyMovingRightENS_15TextGranularityE
+__ZNK7WebCore15VisiblePosition5rightEb
+__ZNK7WebCore15VisiblePosition30rightVisuallyDistinctCandidateEv
+__ZNK7WebCore5Range21compareBoundaryPointsENS0_10CompareHowEPKS0_Ri
+__ZN7WebCore23jsDOMSelectionFocusNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection9focusNodeEv
+__ZN7WebCoreL13focusPositionERKNS_16VisibleSelectionE
+__ZN7WebCore25jsDOMSelectionFocusOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection11focusOffsetEv
+__ZN7WebCore36jsDOMSelectionPrototypeFunctionEmptyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection5emptyEv
+__ZNK7WebCore20HTMLFrameElementBase11isFocusableEv
+__ZN7WebCore20HTMLFrameElementBase8setFocusEb
+__ZN7WebCore24jsDOMSelectionRangeCountEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection10rangeCountEv
+__ZN7WebCore41jsDOMSelectionPrototypeFunctionGetRangeAtEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection10getRangeAtEiRi
+__ZNK7WebCore16VisibleSelection10firstRangeEv
+__ZN7WebCore21jsRangeStartContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsRangeEndContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsRangeStartOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsRangeEndOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17setJSDOMWindowTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12RenderObject22positionForCoordinatesEii
+__ZN7WebCore25jsDOMSelectionIsCollapsedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection11isCollapsedEv
+__ZN7WebCore43jsDOMSelectionPrototypeFunctionContainsNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore12DOMSelection12containsNodeEPKNS_4NodeEb
-__ZN7WebCore24previousSentencePositionERKNS_15VisiblePositionE
-__ZN7WebCoreL32previousSentencePositionBoundaryEPKtj
-__ZN7WebCore37jsDOMSelectionPrototypeFunctionExtendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore49jsDOMSelectionPrototypeFunctionDeleteFromDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection18deleteFromDocumentEv
+__ZN7WebCore5Range14deleteContentsERi
+__ZN7WebCore33setJSHTMLFormElementAcceptCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement16setAcceptCharsetERKNS_6StringE
+__ZN7WebCore25setJSHTMLInputElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement7setSizeEj
+__ZN7WebCore16VisibleSelection24appendTrailingWhitespaceEv
+__ZN7WebCore32jsRangePrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore5Range8toStringERi
+__ZN7WebCore19SelectionController20modifyExtendingRightENS_15TextGranularityE
+__ZN7WebCore19SelectionController25directionOfEnclosingBlockEv
+__ZN7WebCore26jsDOMWindowTextConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSTextConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19SelectionController19modifyExtendingLeftENS_15TextGranularityE
+__ZSt9__reverseIPPN7WebCore9InlineBoxEEvT_S4_St26random_access_iterator_tag
+__ZN7WebCore37jsDOMSelectionPrototypeFunctionExtendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore12DOMSelection6extendEPNS_4NodeEiRi
 __ZN7WebCore19SelectionController22expandUsingGranularityENS_15TextGranularityE
-__ZN7WebCore20HTMLFrameElementBase8setFocusEb
+__ZN7WebCore39jsDOMSelectionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection8toStringEv
+__ZN7WebCore5Range13setStartAfterEPNS_4NodeERi
+__ZNK7WebCore11RenderTheme32inactiveSelectionForegroundColorEv
+__ZN7WebCore12RenderWidget17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZN3WTF6VectorItLm32EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm32EE14expandCapacityEm
+__ZN3WTF6VectorItLm32EE15reserveCapacityEm
+__ZN7WebCoreL15executeMoveLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL27executeMoveToRightEndOfLineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL26executeMoveToLeftEndOfLineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL45executeMoveToRightEndOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL16executeMoveRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL44executeMoveToLeftEndOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN3JSC8Bindings9ObjcArrayC1EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings9ObjcArrayC2EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings5ArrayC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC12RuntimeArrayC1EPNS_9ExecStateEPNS_8Bindings5ArrayE
+__ZN3JSC12RuntimeArrayC2EPNS_9ExecStateEPNS_8Bindings5ArrayE
+__ZN3JSC12RuntimeArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZNK3JSC8Bindings9ObjcArray9getLengthEv
+__ZN3JSC12RuntimeArray11indexGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC8Bindings9ObjcArray7valueAtEPNS_9ExecStateEj
+__ZNK7WebCore5Frame17firstRectForRangeEPNS_5RangeE
+__ZN3JSC12RuntimeArrayD1Ev
+__ZN3JSC8Bindings9ObjcArrayD0Ev
+__ZN3JSC8Bindings5ArrayD2Ev
+__ZN7WebCore29setJSHTMLInputElementReadOnlyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement11setReadOnlyEb
+__ZN7WebCoreL17executeSelectLineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL28expandSelectionToGranularityEPNS_5FrameENS_15TextGranularityE
+__ZN7WebCore34jsRangePrototypeFunctionSelectNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore39jsDOMSelectionPrototypeFunctionCollapseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection8collapseEPNS_4NodeEiRi
+__ZN7WebCore34jsDOMWindowDOMExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSDOMCoreException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSDOMCoreExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSDOMCoreExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSDOMCoreExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32jsDOMCoreExceptionINDEX_SIZE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSDOMCoreExceptionConstructorD1Ev
+__ZN7WebCore26setJSHTMLButtonElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSHTMLTableCellElementNoWrapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement9setNoWrapEb
+__ZN7WebCore17HTMLSelectElement5resetEv
+__ZN7WebCoreL30newStreamingTextDecoderUTF16LEERKNS_12TextEncodingEPKv
+__ZN7WebCore13RootInlineBox15clearTruncationEv
+__ZN7WebCore13InlineFlowBox15clearTruncationEv
+__ZN7WebCore13InlineTextBox15clearTruncationEv
+__ZNK3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore11EllipsisBox5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCoreL18executeJustifyLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL15executeFontSizeEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13RootInlineBox20addHighlightOverflowEv
+__ZN7WebCore13InlineTextBox20paintCustomHighlightEiiRKNS_12AtomicStringE
+__ZN7WebCore13RootInlineBox20paintCustomHighlightERNS_12RenderObject9PaintInfoEiiRKNS_12AtomicStringE
+__ZNK7WebCore9FloatRect10intersectsERKS0_
+__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CSSStyleSheet10deleteRuleEjRi
+__ZN7WebCore9StyleList6removeEj
 __ZN7WebCoreL20executeFontSizeDeltaEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore17ApplyStyleCommand18joinChildTextNodesEPNS_4NodeERKNS_8PositionES5_
 __ZN7WebCore17ApplyStyleCommand24splitTextAtStartIfNeededERKNS_8PositionES3_
 __ZN7WebCore17ApplyStyleCommand22splitTextAtEndIfNeededERKNS_8PositionES3_
 __ZN7WebCore17ApplyStyleCommand16computedFontSizeEPKNS_4NodeE
 __ZN3WTF7HashMapIPN7WebCore4NodeEfNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IfEEE3setERKS3_RKf
-__ZN3WTF9HashTableIPN7WebCore4NodeESt4pairIS3_fENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IfEEEESC_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore4NodeESt4pairIS3_fENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTrai
 __ZNK3WTF7HashMapIPN7WebCore4NodeEfNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IfEEE3getERKS3_
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE15reserveCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE6shrinkEm
-__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13CSSStyleSheet10deleteRuleEjRi
-__ZN7WebCore13RootInlineBox20addHighlightOverflowEv
-__ZN7WebCore18jsDOMSelectionTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12DOMSelection4typeEv
-__ZN7WebCore13InlineTextBox20paintCustomHighlightEiiRKNS_12AtomicStringE
-__ZN7WebCore13RootInlineBox20paintCustomHighlightERNS_12RenderObject9PaintInfoEiiRKNS_12AtomicStringE
-__ZNK7WebCore9FloatRect10intersectsERKS0_
-__ZN7WebCore21ApplicationCacheGroup11selectCacheEPNS_5FrameERKNS_4KURLE
-__ZN7WebCore21JSDOMApplicationCache18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSDOMApplicationCachePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore54jsDOMApplicationCachePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore21JSDOMApplicationCache16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZNK7WebCore19DOMApplicationCache22scriptExecutionContextEv
-__ZN7WebCore17JSDOMGlobalObject27jsUnprotectedEventListenersEv
-__ZN7WebCore19DOMApplicationCache16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEEENS_18PairFirstExtractorIS9_EENS1_16AtomicStringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSE_IS8_EEEESF_E4findIS2_NS_22IdentityHashTranslatorIS2_S9_SC_EEEENS_17HashTableIteratorIS2_S9_SB_SC_SH_SF_EERKT_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEC2ERKS5_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEaSERKS5_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE6shrinkEm
-__ZN7WebCore21JSDOMApplicationCache3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore34setJSDOMApplicationCacheOnnoupdateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore37setJSDOMApplicationCacheOnupdatereadyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore32setJSDOMApplicationCacheOncachedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore31setJSDOMApplicationCacheOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore34setJSDOMApplicationCacheOnobsoleteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore27jsDOMApplicationCacheStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore19DOMApplicationCache6statusEv
-__ZNK7WebCore19DOMApplicationCache15associatedCacheEv
-__ZN7WebCore29jsDOMApplicationCacheUNCACHEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore37setJSDOMApplicationCacheOndownloadingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore34setJSDOMApplicationCacheOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25jsDOMApplicationCacheIDLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
--[WebCoreSynchronousLoader connection:didFailWithError:]
-__ZN7WebCore20ResourceResponseBase17setHTTPStatusCodeEi
-__ZNK7WebCore16HTMLVideoElement11tagPriorityEv
-__ZN7WebCoreL29createHTMLVideoElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLVideoElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLVideoElementEEE
-__ZN7WebCore18JSHTMLMediaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLMediaElementEEE
-__ZN7WebCore18JSHTMLVideoElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLMediaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSHTMLMediaElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLVideoElement9classInfoEv
-__ZN7WebCore18JSHTMLVideoElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore18JSHTMLMediaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore24setJSHTMLMediaElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionPlayEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16HTMLMediaElement4playERi
-__ZNK7WebCore11MediaPlayer4rateEv
-__ZN7WebCore16HTMLMediaElement18dispatchEventAsyncERKNS_12AtomicStringE
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE15reserveCapacityEm
-__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionLoadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZL45QTMovieAskUnresolvedDataRefsAttributeFunctionv
-__ZL44QTSecurityPolicyNoCrossSiteAttributeFunctionv
-__ZL47QTMoviePreventExternalURLLinksAttributeFunctionv
-__ZL27QTMovieURLAttributeFunctionv
-__ZN7WebCore16HTMLMediaElement11recalcStyleENS_4Node11StyleChangeE
-__ZN7WebCore11RenderVideo14calcPrefWidthsEv
-__ZN7WebCore16HTMLMediaElement20asyncEventTimerFiredEPNS_5TimerIS0_EE
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE6shrinkEm
-__ZL45QTMovieLoadStateDidChangeNotificationFunctionv
-__ZL40QTMovieRateDidChangeNotificationFunctionv
-__ZL40QTMovieSizeDidChangeNotificationFunctionv
-__ZL40QTMovieTimeDidChangeNotificationFunctionv
-__ZL33QTMovieDidEndNotificationFunctionv
-__ZN7WebCore16HTMLMediaElement26documentWillBecomeInactiveEv
-__ZN7WebCore18JSHTMLVideoElementD0Ev
-__ZN7WebCore20JSHTMLIsIndexElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore10CachedFont5errorEv
-__ZN7WebCore35jsDOMCoreExceptionINVALID_STATE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4FileC1ERKNS_6StringE
-__ZN7WebCore15pathGetFileNameERKNS_6StringE
-__ZN7WebCore15FormDataBuilder28addFilenameToMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_12TextEncodingERKNS_6StringE
-__ZN7WebCore28jsProcessingInstructionSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL17scriptConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGScriptElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
-__ZN7WebCore16SVGScriptElement20insertedIntoDocumentEv
-__ZNK7WebCore16SVGScriptElement20sourceAttributeValueEv
-__ZN7WebCore16SVGScriptElement15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCore16SVGScriptElement21finishParsingChildrenEv
-__ZN7WebCore16SVGScriptElement27haveLoadedRequiredResourcesEv
-__ZThn108_NK7WebCore16SVGScriptElement14contextElementEv
-__ZNK7WebCore16SVGScriptElement14contextElementEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIbEEPN3WTF7HashMapIPKNS_10SVGElementEPNS3_IPNS_10StringImplET_NS_10StringHashENS2_10HashTraitsIS8_EENSB_IS9_EEEENS2_7PtrHashIS6_EENSB_IS6_EENSB_ISF_EEEEvE14s_baseValueMap
-__ZThn160_NK7WebCore16SVGScriptElement20sourceAttributeValueEv
-__ZThn160_NK7WebCore16SVGScriptElement13scriptContentEv
-__ZNK7WebCore16SVGScriptElement13scriptContentEv
-__ZN7WebCore27JSHTMLFrameElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateHTMLDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore17DOMImplementation18createHTMLDocumentERKNS_6StringE
-__ZNK7WebCore14RenderFrameSet12canResizeRowERKNS_8IntPointE
-__ZNK7WebCore14RenderFrameSet12hitTestSplitERKNS0_8GridAxisEi
-__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16JSXMLHttpRequest16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore14XMLHttpRequest16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCore29setJSDOMWindowAttrConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore37setJSDOMWindowCDATASectionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore38setJSDOMWindowCharacterDataConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore42setJSDOMWindowCSSPrimitiveValueConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore32setJSDOMWindowCSSRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore44setJSDOMWindowCSSStyleDeclarationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore33setJSDOMWindowCSSValueConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore41setJSDOMWindowDocumentFragmentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore37setJSDOMWindowDocumentTypeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore37setJSDOMWindowDOMExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore42setJSDOMWindowDOMImplementationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore34setJSDOMWindowDOMParserConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore31setJSDOMWindowEntityConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore40setJSDOMWindowEntityReferenceConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore42setJSDOMWindowHTMLCanvasElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore36setJSDOMWindowHTMLElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore43setJSDOMWindowHTMLMarqueeElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore38setJSDOMWindowMutationEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore35setJSDOMWindowNodeFilterConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore33setJSDOMWindowNotationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore46setJSDOMWindowProcessingInstructionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30setJSDOMWindowRangeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore36setJSDOMWindowXMLDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore38setJSDOMWindowXMLSerializerConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore39setJSDOMWindowXPathEvaluatorConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore36setJSDOMWindowXPathResultConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore31setJSDOMWindowClientInformationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore27setJSDOMWindowDefaultstatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30setJSDOMWindowDevicePixelRatioEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20setJSDOMWindowFramesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25setJSDOMWindowInnerHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24setJSDOMWindowInnerWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20setJSDOMWindowLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25setJSDOMWindowLocationbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore21setJSDOMWindowMenubarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23setJSDOMWindowNavigatorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore32setJSDOMWindowOffscreenBufferingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore21setJSDOMWindowOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow10setOnabortEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore22setJSDOMWindowOnchangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow11setOnchangeEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore24setJSDOMWindowOndblclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow13setOndblclickEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore21setJSDOMWindowOnkeyupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow10setOnkeyupEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore25setJSDOMWindowOnmousedownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow14setOnmousedownEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore24setJSDOMWindowOnmouseoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow13setOnmouseoutEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore23setJSDOMWindowOnmouseupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow12setOnmouseupEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore21setJSDOMWindowOnresetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow10setOnresetEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore22setJSDOMWindowOnsearchEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow11setOnsearchEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore22setJSDOMWindowOnselectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow11setOnselectEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore22setJSDOMWindowOnsubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow11setOnsubmitEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore25setJSDOMWindowOuterHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24setJSDOMWindowOuterWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25setJSDOMWindowPersonalbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24setJSDOMWindowScreenLeftEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23setJSDOMWindowScreenTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore21setJSDOMWindowScreenXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore21setJSDOMWindowScreenYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23setJSDOMWindowStatusbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore21setJSDOMWindowToolbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
+-[DOMRange text]
+__ZN7WebCore23SetNodeAttributeCommand9doUnapplyEv
+__ZN7WebCore8SVGImageC1EPNS_13ImageObserverE
 __ZN7WebCore8SVGImageC2EPNS_13ImageObserverE
 __ZN7WebCore8SVGImage11dataChangedEb
 __ZN7WebCore22EmptyFrameLoaderClient20createDocumentLoaderERKNS_15ResourceRequestERKNS_14SubstituteDataE
+__ZN7WebCore14DocumentLoaderC1ERKNS_15ResourceRequestERKNS_14SubstituteDataE
 __ZN7WebCore22EmptyFrameLoaderClient22provisionalLoadStartedEv
 __ZN7WebCore22EmptyFrameLoaderClient25setMainFrameDocumentReadyEb
 __ZN7WebCore22EmptyFrameLoaderClient17setCopiesOnScrollEv
 __ZN7WebCore22EmptyFrameLoaderClient31prepareForDataSourceReplacementEv
 __ZN7WebCore22EmptyFrameLoaderClient31transitionToCommittedForNewPageEv
 __ZN7WebCore17EmptyEditorClient23clearUndoRedoOperationsEv
-__ZN7WebCore17EmptyChromeClient16setStatusbarTextERKNS_6StringE
 __ZN7WebCore22EmptyFrameLoaderClient15finishedLoadingEPNS_14DocumentLoaderE
+__ZNK7WebCore17FrameLoaderClient23shouldUsePluginDocumentERKNS_6StringE
+__ZNK7WebCore22EmptyFrameLoaderClient17overrideMediaTypeEv
+__ZN7WebCore17EmptyChromeClient22createHTMLParserQuirksEv
+__ZNK7WebCore17EmptyChromeClient19contentsSizeChangedEPNS_5FrameERKNS_7IntSizeE
+__ZN7WebCore22EmptyFrameLoaderClient24documentElementAvailableEv
 __ZN7WebCore22EmptyFrameLoaderClient18frameLoadCompletedEv
 __ZN7WebCore22EmptyFrameLoaderClient21forceLayoutForNonHTMLEv
-__ZNK7WebCore22EmptyFrameLoaderClient17overrideMediaTypeEv
-__ZNK7WebCore17EmptyChromeClient19contentsSizeChangedEPNS_5FrameERKNS_7IntSizeE
 __ZN7WebCore22EmptyFrameLoaderClient9userAgentERKNS_4KURLE
 __ZN7WebCore22EmptyFrameLoaderClient17cancelPolicyCheckEv
+__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_14NavigationTypeE
+__ZN7WebCore16NavigationActionC2ERKNS_4KURLENS_14NavigationTypeE
 __ZN7WebCore17EmptyChromeClient30canRunBeforeUnloadConfirmPanelEv
 __ZN7WebCore22EmptyFrameLoaderClient27willChangeEstimatedProgressEv
 __ZN7WebCore22EmptyFrameLoaderClient31postProgressStartedNotificationEv
 __ZN7WebCore22EmptyFrameLoaderClient26didChangeEstimatedProgressEv
 __ZN7WebCore22EmptyFrameLoaderClient31dispatchDidStartProvisionalLoadEv
 __ZN7WebCore22EmptyFrameLoaderClient32assignIdentifierToInitialRequestEmPNS_14DocumentLoaderERKNS_15ResourceRequestE
-__ZN7WebCore22EmptyFrameLoaderClient23dispatchWillSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore22EmptyFrameLoaderClient31dispatchDecidePolicyForMIMETypeEMNS_11FrameLoaderEFvNS_12PolicyActionEERKNS_6StringERKNS_15ResourceRequestE
+__ZN7WebCore22EmptyFrameLoaderClient23dispatchWillSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceRespon
+__ZN7WebCore22EmptyFrameLoaderClient31dispatchDecidePolicyForMIMETypeEMNS_11FrameLoaderEFvNS_12PolicyActionEERKNS_6StringERKNS_
 __ZN7WebCore11FrameLoader24cancelContentPolicyCheckEv
 __ZN7WebCore22EmptyFrameLoaderClient17dispatchWillCloseEv
 __ZN7WebCore22EmptyFrameLoaderClient18makeRepresentationEPNS_14DocumentLoaderE
+__ZN7WebCore14DocumentLoaderD0Ev
 __ZNK7WebCore17FrameLoaderClient11hasHTMLViewEv
-__ZNK7WebCore17FrameLoaderClient23shouldUsePluginDocumentERKNS_6StringE
-__ZN7WebCoreL16imageConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGImageLoaderC2EPNS_15SVGImageElementE
-__ZN7WebCore15SVGImageElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn196_NK7WebCore15SVGImageElement14contextElementEv
-__ZNK7WebCore15SVGImageElement14contextElementEv
-__ZN7WebCore15SVGImageElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore15SVGImageElement20insertedIntoDocumentEv
-__ZNK7WebCore15SVGImageElement24imageSourceAttributeNameEv
-__ZNK7WebCore14SVGImageLoader9sourceURIERKNS_12AtomicStringE
-__ZN7WebCore15SVGImageElement6attachEv
-__ZNK7WebCore15SVGImageElement7isValidEv
-__ZN7WebCore15SVGImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderSVGImageC2EPNS_15SVGImageElementE
-__ZNK7WebCore14RenderSVGImage13requiresLayerEv
-__ZN7WebCore15SVGImageElement27haveLoadedRequiredResourcesEv
+__ZN7WebCore17EmptyChromeClient16setStatusbarTextERKNS_6StringE
+__ZN7WebCore11FrameLoader19setResponseMIMETypeERKNS_6StringE
+__ZN7WebCore9SVGLength20PercentageOfViewportEfPKNS_10SVGElementENS_13SVGLengthModeE
+__ZNK7WebCore10SVGElement15viewportElementEv
+__ZN7WebCoreL21updateCSSForAttributeEPNS_13SVGSVGElementERKNS_13QualifiedNameE13CSSPropertyIDRKNS_9SVGLengthE
+__ZNK7WebCore9SVGLength13valueAsStringEv
+__ZN7WebCore15SVGFitToViewBox12parseViewBoxERPKtS2_RfS4_S4_S4_b
+__ZThn344_NK7WebCore13SVGSVGElement14contextElementEv
+__ZNK7WebCore13SVGSVGElement14contextElementEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplENS1_9FloatRectENS1_10StringHashENS_10HashTraitsIS6_EENS9_IS7_
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEEN
+__ZN7WebCoreL16titleConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGTitleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGTitleElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGTitleElement20insertedIntoDocumentEv
+__ZNK7WebCore10SVGElement7isValidEv
+__ZN7WebCore15SVGTitleElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore15SVGTitleElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore22EmptyFrameLoaderClient15willChangeTitleEPNS_14DocumentLoaderE
+__ZN7WebCore22EmptyFrameLoaderClient14didChangeTitleEPNS_14DocumentLoaderE
+__ZN7WebCoreL15descConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGDescElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGDescElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGDescElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCoreL12gConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore11SVGGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore11SVGGElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11SVGGElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore11SVGGElement7isValidEv
+__ZN7WebCore11SVGGElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore31RenderSVGTransformableContainerC1EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore31RenderSVGTransformableContainerC2EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore18RenderSVGContainerC2EPNS_16SVGStyledElementE
+__ZNK7WebCore18RenderSVGContainer15virtualChildrenEv
+__ZN7WebCore11SVGGElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore12SVGLangSpace11setXmlspaceERKNS_12AtomicStringE
+__ZN7WebCore15StyleStrokeDataC1ERKS0_
+__ZN7WebCore15StyleStrokeDataC2ERKS0_
+__ZN7WebCore18RenderSVGContainer15virtualChildrenEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_16SVGTransformListENS1_10StringHashENS_10HashTraitsIS6_E
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14shrinkCapacityEm
+__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERKNS_12AtomicStringE
+__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERPKtS4_
+__ZN7WebCore16SVGTransformable19parseTransformValueEjRPKtS2_RNS_12SVGTransformE
+__ZN7WebCore12SVGTransform12setTranslateEff
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE15reserveCapacityEm
+__ZNK7WebCore15StyleStrokeDataeqERKS0_
+__ZN7WebCore14SVGRenderStyle11inheritFromEPKS0_
+__ZN7WebCore21SVGTextContentElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreL15lineConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGLineElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGLineElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGLineElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore14SVGLineElement7isValidEv
+__ZN7WebCore7DataRefINS_15StyleStrokeDataEE6accessEv
+__ZN7WebCoreL18animateConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGAnimateElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGAnimateElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimationElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGSMILElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimationElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore14SVGSMILElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore19SVGAnimationElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGSMILElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore10SVGElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCoreL13parseKeyTimesERKNS_6StringERN3WTF6VectorIfLm0EEEb
+__ZN7WebCore14SVGSMILElement15parseBeginOrEndERKNS_6StringENS0_10BeginOrEndE
+__ZN7WebCore14SVGSMILElement15parseClockValueERKNS_6StringE
+__ZN7WebCore14SVGSMILElement16parseOffsetValueERKNS_6StringE
+__ZNK3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E8containsIdNS_22IdentityHashTranslatorI
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE15reserveCapacityEm
+__ZN7WebCoreL12sortTimeListERN3WTF6VectorINS_8SMILTimeELm0EEE
+__ZSt16__introsort_loopIPN7WebCore8SMILTimeElEvT_S3_T0_
+__ZSt22__final_insertion_sortIPN7WebCore8SMILTimeEEvT_S3_
+__ZSt16__insertion_sortIPN7WebCore8SMILTimeEEvT_S3_
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E15deallocateTableEPdi
+__ZN7WebCore14SVGSMILElement20insertedIntoDocumentEv
+__ZNK7WebCore10SVGElement15ownerSVGElementEv
+__ZN7WebCore14SVGSMILElement10rescheduleEv
+__ZN7WebCore17SMILTimeContainer8scheduleEPNS_14SVGSMILElementE
+__ZNK7WebCore14SVGSMILElement16nextProgressTimeEv
+__ZN3WTF7HashSetIPN7WebCore14SVGSMILElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandE
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashE
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13alloca
+__ZN7WebCore14SVGSMILElement21finishParsingChildrenEv
+__ZN7WebCore14SVGSMILElement20resolveFirstIntervalEv
+__ZNK7WebCore14SVGSMILElement15resolveIntervalEbRNS_8SMILTimeES2_
+__ZNK7WebCore14SVGSMILElement16findInstanceTimeENS0_10BeginOrEndENS_8SMILTimeEb
+__ZNK7WebCore14SVGSMILElement16resolveActiveEndENS_8SMILTimeES1_
+__ZNK7WebCore14SVGSMILElement3durEv
+__ZNK7WebCore14SVGSMILElement17repeatingDurationEv
+__ZNK7WebCore14SVGSMILElement11repeatCountEv
+__ZNK7WebCore14SVGSMILElement9repeatDurEv
+__ZNK7WebCore14SVGSMILElement14simpleDurationEv
+__ZNK7WebCore14SVGSMILElement8minValueEv
+__ZNK7WebCore14SVGSMILElement8maxValueEv
+__ZN7WebCoreplERKNS_8SMILTimeES2_
+__ZN7WebCore14SVGSMILElement31notifyDependentsIntervalChangedENS0_21NewOrExistingIntervalE
+__ZNK3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8contai
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remove
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeE
 __ZN7WebCore22EmptyFrameLoaderClient29dispatchDidFinishDocumentLoadEv
 __ZN7WebCore22EmptyFrameLoaderClient29dispatchDidHandleOnloadEventsEv
 __ZN7WebCore10ScrollView16updateScrollbarsERKNS_7IntSizeE
 __ZN7WebCore10ScrollView34platformHandleHorizontalAdjustmentERKNS_7IntSizeE
 __ZN7WebCore10ScrollView32platformHandleVerticalAdjustmentERKNS_7IntSizeE
-__ZN7WebCore14RenderSVGImage29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZN7WebCore14RenderSVGImage6layoutEv
-__ZN7WebCore14RenderSVGImage23calculateLocalTransformEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_15widthAttrStringEEEE11synchronizeEv
-__ZN7WebCore14RenderSVGImage23calculateAbsoluteBoundsEv
-__ZNK7WebCore14RenderSVGImage12relativeBBoxEb
-__ZNK7WebCore14RenderSVGImage14localTransformEv
+__ZN7WebCore18RenderSVGContainer6layoutEv
+__ZN7WebCore18RenderSVGContainer12calcViewportEv
+__ZNK7WebCore18RenderSVGContainer13selfWillPaintEv
+__ZN7WebCore31RenderSVGTransformableContainer23calculateLocalTransformEv
+__ZN7WebCore12SVGTransformC1ERKNS_20TransformationMatrixE
+__ZN7WebCore12SVGTransformC2ERKNS_20TransformationMatrixE
+__ZNK7WebCore14SVGLineElement10toPathDataEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y2AttrStri
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y1AttrStri
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x1AttrStri
+__ZN7WebCore4Path10createLineERKNS_10FloatPointES3_
+__ZN7WebCore22SVGPreserveAspectRatio6getCTMEdddddddd
+__ZNK7WebCore22SVGPreserveAspectRatio5alignEv
 __ZN7WebCore22EmptyFrameLoaderClient22dispatchDidFirstLayoutEv
 __ZN7WebCore22EmptyFrameLoaderClient38dispatchDidFirstVisuallyNonEmptyLayoutEv
-__ZN7WebCore20SVGImageChromeClient7repaintERKNS_7IntRectEbbb
-__ZThn268_N7WebCore11CachedImage13changedInRectEPKNS_5ImageERKNS_7IntRectE
-__ZN7WebCore11CachedImage13changedInRectEPKNS_5ImageERKNS_7IntRectE
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE15reserveCapacityEm
+__ZN7WebCore17SMILTimeContainer26updateDocumentOrderIndexesEv
+__ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
+__ZSt16__introsort_loopIPPN7WebCore14SVGSMILElementElNS0_15PriorityCompareEEvT_S5_T0_T1_
+__ZSt22__final_insertion_sortIPPN7WebCore14SVGSMILElementENS0_15PriorityCompareEEvT_S5_T0_
+__ZSt16__insertion_sortIPPN7WebCore14SVGSMILElementENS0_15PriorityCompareEEvT_S5_T0_
+__ZNK7WebCore14SVGSMILElement13targetElementEv
+__ZNK7WebCore14SVGSMILElement9xlinkHrefEv
+__ZNK7WebCore14SVGSMILElement13attributeNameEv
+__ZNK3WTF7HashMapISt4pairIPN7WebCore10SVGElementENS2_6StringEEPNS2_14SVGSMILElementENS_8PairHashIS4_S5_EENS_10HashTraitsIS6_EEN
+__ZN7WebCore17SMILTimeContainer12baseValueForESt4pairIPNS_10SVGElementENS_6StringEE
+__ZN7WebCore19SVGAnimationElement14attributeIsCSSERKNS_6StringE
+__ZN3WTF7HashMapISt4pairIPN7WebCore10SVGElementENS2_6StringEES5_NS_8PairHashIS4_S5_EENS_10HashTraitsIS6_EENS9_IS5_EEE3addERKS6_
+__ZN3WTF9HashTableISt4pairIPN7WebCore10SVGElementENS2_6StringEES1_IS6_S5_ENS_18PairFirstExtractorIS7_EENS_8PairHashIS4_S5_EENS_
+__ZN7WebCore17SVGAnimateElement16resetToBaseValueERKNS_6StringE
+__ZNK7WebCore17SVGAnimateElement21determinePropertyTypeERKNS_6StringE
+__ZN7WebCoreL23parseNumberValueAndUnitERKNS_6StringERdRS0_
+__ZN3WTF7HashMapISt4pairIPN7WebCore10SVGElementENS2_6StringEEPNS2_14SVGSMILElementENS_8PairHashIS4_S5_EENS_10HashTraitsIS6_EENS
+__ZN3WTF9HashTableISt4pairIPN7WebCore10SVGElementENS2_6StringEES1_IS6_PNS2_14SVGSMILElementEENS_18PairFirstExtractorIS9_EENS_8P
+__ZN7WebCore14SVGSMILElement8progressENS_8SMILTimeEPS0_
+__ZN7WebCore14SVGSMILElement17connectConditionsEv
+__ZN7WebCore19SVGAnimationElement21startedActiveIntervalEv
+__ZNK7WebCore19SVGAnimationElement14hasValidTargetEv
+__ZNK7WebCore19SVGAnimationElement13animationModeEv
+__ZNK7WebCore19SVGAnimationElement13animationPathEv
+__ZNK7WebCore19SVGAnimationElement8calcModeEv
+__ZNK7WebCore14SVGSMILElement34calculateAnimationPercentAndRepeatENS_8SMILTimeERj
+__ZN7WebCoremiERKNS_8SMILTimeES2_
+__ZN7WebCore14SVGSMILElement12checkRestartENS_8SMILTimeE
+__ZNK7WebCore14SVGSMILElement7restartEv
+__ZNK7WebCore14SVGSMILElement20determineActiveStateENS_8SMILTimeE
+__ZNK7WebCore14SVGSMILElement14isContributingENS_8SMILTimeE
+__ZNK7WebCore14SVGSMILElement4fillEv
+__ZN7WebCore19SVGAnimationElement15updateAnimationEfjPNS_14SVGSMILElementE
+__ZNK7WebCore19SVGAnimationElement31currentValuesForValuesAnimationEfRfRNS_6StringES3_
+__ZN7WebCore17SVGAnimateElement24calculateFromAndToValuesERKNS_6StringES3_
+__ZN7WebCore17SVGAnimateElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
+__ZNK7WebCore19SVGAnimationElement13isAccumulatedEv
+__ZNK7WebCore19SVGAnimationElement10isAdditiveEv
+__ZNK7WebCore14SVGSMILElement25calculateNextProgressTimeENS_8SMILTimeE
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE14expandCapacityEmPKS3_
+__ZSt16__introsort_loopIPPN7WebCore14SVGSMILElementElPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt22__final_insertion_sortIPPN7WebCore14SVGSMILElementEPFbS2_S2_EEvT_S6_T0_
+__ZSt16__insertion_sortIPPN7WebCore14SVGSMILElementEPFbS2_S2_EEvT_S6_T0_
+__ZN7WebCore17SVGAnimateElement20applyResultsToTargetEv
+__ZN7WebCore19SVGAnimationElement31setTargetAttributeAnimatedValueERKNS_6StringE
+__ZN7WebCore16SVGStyledElement25setInstanceUpdatesBlockedEb
+__ZN3WTF7HashSetIPKN7WebCore16SVGStyledElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expa
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6reha
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13all
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15dea
+__ZNK7WebCore19SVGAnimationElement20targetAttributeIsCSSEv
+__ZNK7WebCore19SVGAnimationElement13attributeTypeEv
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4find
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47rem
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6remo
+__ZNK7WebCore17SMILTimeContainer7elapsedEv
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE6shrinkEm
 __ZNK7WebCore8SVGImage4sizeEv
 __ZNK7WebCore11SVGDocument11rootElementEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrStr
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_16heightAttrSt
+__ZNK7WebCore9SVGLength8unitTypeEv
+__ZNK7WebCore13SVGSVGElement18relativeWidthValueEv
+__ZNK7WebCore9SVGLength17valueAsPercentageEv
+__ZNK7WebCore9SVGLength21valueInSpecifiedUnitsEv
+__ZNK7WebCore13SVGSVGElement19relativeHeightValueEv
+__ZN7WebCore8SVGImage16setContainerSizeERKNS_7IntSizeE
 __ZNK7WebCore8SVGImage16hasRelativeWidthEv
-__ZNK7WebCore8SVGImage17usesContainerSizeEv
 __ZNK7WebCore8SVGImage17hasRelativeHeightEv
-__ZNK7WebCore5Image23hasSingleSecurityOriginEv
 __ZN7WebCore8SVGImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
 __ZN7WebCore9FrameView15contentsResizedEv
-__ZN7WebCore9FrameView14setNeedsLayoutEv
 __ZN7WebCore10ScrollView17frameRectsChangedEv
-__ZN7WebCore14RenderSVGImage5paintERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_22SVGPreserveAspectRatioEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_29preserveAspectRatioAttrStringEEEE11synchronizeEv
-__ZN7WebCore14RenderSVGImage25adjustRectsForAspectRatioERNS_9FloatRectES2_PNS_22SVGPreserveAspectRatioE
-__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionGetImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore24CanvasRenderingContext2D12getImageDataEffffRi
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9ImageDataE
-__ZN7WebCore14RenderSVGImage12imageChangedEPvPKNS_7IntRectE
-__ZN7WebCore14SVGImageLoader17dispatchLoadEventEv
-__ZN7WebCore34jsDOMWindowPrototypeFunctionPromptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9DOMWindow6promptERKNS_6StringES3_
-__ZN7WebCore6Chrome19runJavaScriptPromptEPNS_5FrameERKNS_6StringES5_RS3_
-__ZN7WebCore40jsDOMWindowPrototypeFunctionOpenDatabaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9DOMWindow12openDatabaseERKNS_6StringES3_S3_mRi
-__ZN7WebCore8Database12openDatabaseEPNS_8DocumentERKNS_6StringES5_S5_mRi
-__ZN7WebCore15DatabaseTracker20canEstablishDatabaseEPNS_8DocumentERKNS_6StringES5_m
-__ZN7WebCore15DatabaseTracker14usageForOriginEPNS_14SecurityOriginE
-__ZN7WebCore15DatabaseTracker18originQuotaManagerEv
-__ZN7WebCore18OriginQuotaManager4lockEv
-__ZNK7WebCore18OriginQuotaManager12tracksOriginEPNS_14SecurityOriginE
-__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS2_17OriginUsageRecordEENS_18PairFirstExtractorIS8_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSD_IS7_EEEESE_E8containsIPS3_NS_29RefPtrHashMapRawKeyTranslatorISJ_S8_SG_SB_EEEEbRKT_
-__ZN7WebCore18OriginQuotaManager11trackOriginEN3WTF10PassRefPtrINS_14SecurityOriginEEE
-__ZN7WebCore17OriginUsageRecordC2Ev
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS2_17OriginUsageRecordEENS_18PairFirstExtractorIS8_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSD_IS7_EEEESE_E6expandEv
-__ZN7WebCore15DatabaseTracker22databaseNamesForOriginEPNS_14SecurityOriginERN3WTF6VectorINS_6StringELm0EEE
-__ZNK7WebCore18OriginQuotaManager9diskUsageEPNS_14SecurityOriginE
-__ZN7WebCore17OriginUsageRecord9diskUsageEv
-__ZN7WebCore18OriginQuotaManager6unlockEv
-__ZN7WebCore15DatabaseTracker19hasEntryForDatabaseEPNS_14SecurityOriginERKNS_6StringE
-__ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEyNS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS6_IyEEE3setEPS3_RKy
-__ZN7WebCore15DatabaseTracker23detailsForNameAndOriginERKNS_6StringEPNS_14SecurityOriginE
-__ZN7WebCore15DatabaseTracker8setQuotaEPNS_14SecurityOriginEy
-__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_yENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSB_IyEEEESC_E8containsIPS3_NS_29RefPtrHashMapRawKeyTranslatorISH_S6_SE_S9_EEEEbRKT_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_yENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSB_IyEEEESC_E6expandEv
-__ZN7WebCore8DatabaseC2EPNS_8DocumentERKNS_6StringES5_
-__ZN7WebCoreL20guidForOriginAndNameERKNS_6StringES2_
-__ZNK3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3getERKS2_
-__ZN3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3setERKS2_RKi
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENS9_IiEEEESA_E6expandEv
-__ZN7WebCoreL9guidMutexEv
-__ZN7WebCoreL17guidToDatabaseMapEv
-__ZNK3WTF7HashMapIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEENS_7IntHashIjEENS7_IiEENS7_ISA_EEE3getERKi
-__ZN3WTF9HashTableIiSt4pairIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEEENS_18PairFirstExtractorISC_EENS_7IntHashIjEENS_14PairHashTraitsINS8_IiEENS8_ISB_EEEESI_E6expandEv
-__ZN3WTF7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore15DatabaseTracker19fullPathForDatabaseEPNS_14SecurityOriginERKNS_6StringEb
-__ZNK7WebCore15DatabaseTracker10originPathEPNS_14SecurityOriginE
-__ZN7WebCore15DatabaseTracker11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
-__ZN7WebCore18OriginQuotaManager11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
-__ZN7WebCore17OriginUsageRecord11addDatabaseERKNS_6StringES3_
-__ZNK3WTF7HashMapIN7WebCore6StringENS1_17OriginUsageRecord13DatabaseEntryENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_17OriginUsageRecord13DatabaseEntryEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E6expandEv
-__ZN7WebCore15DatabaseTracker15addOpenDatabaseEPNS_8DatabaseE
-__ZNK7WebCore8Database18securityOriginCopyEv
-__ZN7WebCore14SecurityOrigin4copyEv
-__ZN7WebCore14SecurityOriginC1EPKS0_
-__ZNK7WebCore8Database16stringIdentifierEv
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS_7HashMapINS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7PtrHashISA_EENS_10HashTraitsISA_EEEENS2_10StringHashENSD_IS7_EENSD_ISG_EEEEENS_18PairFirstExtractorISM_EENS2_18SecurityOriginHashENS_14PairHashTraitsINSD_IS4_EENSD_ISL_EEEESR_E6expandEv
-__ZNK3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2_EENS8_ISB_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS_18PairFirstExtractorISD_EENS1_10StringHashENS_14PairHashTraitsINS9_IS2_EENS9_ISC_EEEESI_E6expandEv
-__ZN7WebCore8Document15addOpenDatabaseEPNS_8DatabaseE
-__ZN7WebCore8Database20openAndVerifyVersionERi
-__ZN7WebCore8Document14databaseThreadEv
-__ZN7WebCore14DatabaseThreadC1Ev
-__ZN7WebCore14DatabaseThread5startEv
-__ZN7WebCore18DatabaseAuthorizerC2Ev
-__ZN7WebCore18DatabaseAuthorizer5resetEv
-__ZN7WebCore16DatabaseOpenTaskC1EPNS_8DatabaseE
-__ZN7WebCore12DatabaseTaskC2EPNS_8DatabaseE
-__ZN7WebCore14DatabaseThread19databaseThreadStartEPv
-__ZN7WebCore12DatabaseTask28lockForSynchronousSchedulingEv
-__ZN7WebCore14DatabaseThread14databaseThreadEv
-__ZN7WebCore14DatabaseThread21scheduleImmediateTaskEN3WTF10PassRefPtrINS_12DatabaseTaskEEE
-__ZN3WTF5DequeINS_6RefPtrIN7WebCore12DatabaseTaskEEEE14expandCapacityEv
-__ZN7WebCore12DatabaseTask28waitForSynchronousCompletionEv
-__ZN7WebCore12DatabaseTask11performTaskEv
-__ZN7WebCore8Database15resetAuthorizerEv
-__ZN7WebCore16DatabaseOpenTask13doPerformTaskEv
-__ZN7WebCore8Database20performOpenAndVerifyERi
-__ZN7WebCore14SQLiteDatabase13setAuthorizerEN3WTF10PassRefPtrINS_18DatabaseAuthorizerEEE
-__ZN7WebCore14SQLiteDatabase16enableAuthorizerEb
-sqlite3_set_authorizer
-__ZN7WebCore8Database21databaseInfoTableNameEv
-__ZN7WebCore14SQLiteDatabase18authorizerFunctionEPviPKcS3_S3_S3_
-__ZN7WebCore18DatabaseAuthorizer9allowReadERKNS_6StringES3_
-__ZN7WebCore18DatabaseAuthorizer20denyBasedOnTableNameERKNS_6StringE
-__ZN7WebCore18DatabaseAuthorizer11allowInsertERKNS_6StringE
-__ZN7WebCore18DatabaseAuthorizer11createTableERKNS_6StringE
-__ZN7WebCore18DatabaseAuthorizer11createIndexERKNS_6StringES3_
-__ZN7WebCore18DatabaseAuthorizer11allowUpdateERKNS_6StringES3_
-__ZN7WebCoreL16guidToVersionMapEv
-__ZNK3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
-__ZN7WebCore8Database22getVersionFromDatabaseERNS_6StringE
-__ZN7WebCoreL18databaseVersionKeyEv
-__ZN7WebCore18DatabaseAuthorizer7disableEv
-__ZN7WebCore18DatabaseAuthorizer6enableEv
-__ZN7WebCore8Database20setVersionInDatabaseERKNS_6StringE
-__ZN3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore6StringEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E6expandEv
-__ZN7WebCore8Database19performPolicyChecksEv
-__ZN7WebCore15DatabaseTracker18setDatabaseDetailsEPNS_14SecurityOriginERKNS_6StringES5_m
-__ZN7WebCore19InspectorController15didOpenDatabaseEPNS_8DatabaseERKNS_6StringES5_S5_
-__ZN3WTF7HashSetINS_6RefPtrIN7WebCore25InspectorDatabaseResourceEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore25InspectorDatabaseResourceEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E5clearEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8DatabaseE
-__ZN7WebCore10JSDatabase15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore10JSDatabaseC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DatabaseEEE
-__ZN7WebCore10JSDatabase18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSDatabasePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore10JSDatabase9classInfoEv
-__ZN7WebCore32jsDOMWindowPrototypeFunctionAtobEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11JSDOMWindow4atobEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore12base64DecodeERKN3WTF6VectorIcLm0EEERS2_
-__ZN7WebCore12base64DecodeEPKcjRN3WTF6VectorIcLm0EEE
-__ZN7WebCore32jsDOMWindowPrototypeFunctionBtoaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11JSDOMWindow4btoaEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore12base64EncodeERKN3WTF6VectorIcLm0EEERS2_b
-__ZN7WebCore33jsDOMWindowPrototypeFunctionPrintEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9DOMWindow5printEv
-__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9DOMWindow6moveByEff
-__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9DOMWindow8resizeByEff
-__ZL30windowProtoFuncShowModalDialogPN3JSC9ExecStateEPNS_8JSObjectENS_10JSValuePtrERKNS_7ArgListE
-__ZNK7WebCore6Chrome14canRunModalNowEv
-__ZN7WebCore14ResourceHandle12loadsBlockedEv
-__ZN7WebCore14WindowFeatures12floatFeatureERKN3WTF7HashMapINS_6StringES3_NS_10StringHashENS1_10HashTraitsIS3_EES6_EEPKcfff
-__ZN7WebCore14WindowFeatures11boolFeatureERKN3WTF7HashMapINS_6StringES3_NS_10StringHashENS1_10HashTraitsIS3_EES6_EEPKcb
-__ZN7WebCore15JSDOMWindowBase18setReturnValueSlotEPN3JSC10JSValuePtrE
-__ZNK7WebCore6Chrome8runModalEv
-__ZNK7WebCore5Image13isBitmapImageEv
-__ZN7WebCore8Database4stopEv
-__ZN7WebCore14DatabaseThread23unscheduleDatabaseTasksEPNS_8DatabaseE
-__ZN7WebCore14DatabaseThread18requestTerminationEv
-__ZN7WebCore8DatabaseD2Ev
-__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN3WTF9HashTableIiSt4pairIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEEENS_18PairFirstExtractorISC_EENS_7IntHashIjEENS_14PairHashTraitsINS8_IiEENS8_ISB_EEEESI_E4findIiNS_22IdentityHashTranslatorIiSC_SG_EEEENS_17HashTableIteratorIiSC_SE_SG_SK_SI_EERKT_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore6StringEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E4findIiNS_22IdentityHashTranslatorIiS4_S8_EEEENS_17HashTableIteratorIiS4_S6_S8_SD_SB_EERKT_
-__ZN7WebCore15DatabaseTracker18removeOpenDatabaseEPNS_8DatabaseE
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS_18PairFirstExtractorISD_EENS1_10StringHashENS_14PairHashTraitsINS9_IS2_EENS9_ISC_EEEESI_E4findIS2_NS_22IdentityHashTranslatorIS2_SD_SG_EEEENS_17HashTableIteratorIS2_SD_SF_SG_SK_SI_EERKT_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS_7HashMapINS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7PtrHashISA_EENS_10HashTraitsISA_EEEENS2_10StringHashENSD_IS7_EENSD_ISG_EEEEENS_18PairFirstExtractorISM_EENS2_18SecurityOriginHashENS_14PairHashTraitsINSD_IS4_EENSD_ISL_EEEESR_E4findIS4_NS_22IdentityHashTranslatorIS4_SM_SP_EEEENS_17HashTableIteratorIS4_SM_SO_SP_ST_SR_EERKT_
-__ZN7WebCore8Document18removeOpenDatabaseEPNS_8DatabaseE
-__ZN7WebCore14SQLiteDatabaseD2Ev
-__ZN7WebCore14DatabaseThreadD2Ev
+__ZNK7WebCore13SVGSVGElement17hasRelativeValuesEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11xAttrStringE
+__ZNK7WebCore22SVGPreserveAspectRatio11meetOrSliceEv
+__ZN7WebCore20SVGImageChromeClient7repaintERKNS_7IntRectEbbb
+__ZThn392_N7WebCore11CachedImage13changedInRectEPKNS_5ImageERKNS_7IntRectE
+__ZN7WebCore11CachedImage13changedInRectEPKNS_5ImageERKNS_7IntRectE
+__ZNK7WebCore18RenderSVGContainer29repaintRectInLocalCoordinatesEv
+__ZN7WebCore30BoundingRectStrokeStyleApplier11strokeStyleEPNS_15GraphicsContextE
+__ZN7WebCore25applyStrokeStyleToContextEPNS_15GraphicsContextEPNS_11RenderStyleEPKNS_12RenderObjectE
+__ZN7WebCore14SVGRenderStyle20cssPrimitiveToLengthEPKNS_12RenderObjectEPNS_8CSSValueEf
+__ZN7WebCore27dashArrayFromRenderingStyleEPKNS_11RenderStyleE
+__ZN7WebCore15GraphicsContext11setLineDashERKN3WTF6VectorIdLm0EEEf
+__ZNK7WebCore31RenderSVGTransformableContainer22localToParentTransformEv
+__ZN7WebCore18RenderSVGContainer5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore18RenderSVGContainer13drawsContentsEv
+__ZN7WebCore18RenderSVGContainer17applyViewportClipERNS_12RenderObject9PaintInfoE
+__ZNK7WebCore14SVGLineElement15supportsMarkersEv
+__ZNK7WebCore10RenderPath19drawMarkersIfNeededEPNS_15GraphicsContextERKNS_9FloatRectERKNS_4PathE
+__ZN7WebCore13getMarkerByIdEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore5TimerINS_17SMILTimeContainerEE5firedEv
+__ZN7WebCore17SMILTimeContainer10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore14SVGSMILElement19resolveNextIntervalEv
+__ZN7WebCore19SVGAnimationElement19endedActiveIntervalEv
+__ZN7WebCore20RenderSVGModelObject29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore13SVGRenderBase29clippedOverflowRectForRepaintEPNS_12RenderObjectEPNS_20RenderBoxModelObjectE
+__ZN7WebCore20RenderSVGModelObject21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZN7WebCore13SVGRenderBase21computeRectForRepaintEPNS_12RenderObjectEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore20RenderSVGModelObject23outlineBoundsForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore20RenderSVGModelObject19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore13SVGRenderBase19mapLocalToContainerEPKNS_12RenderObjectEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore16CSSStyleSelector11mapFillClipEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore15GraphicsContext17clipToImageBufferERKNS_9FloatRectEPKNS_11ImageBufferE
+__ZN7WebCore11BitmapImage13getCGImageRefEv
 __ZN7WebCore5Image14resetAnimationEv
-__ZN7WebCore8SVGImage18destroyDecodedDataEb
-__ZN7WebCore26setJSXMLHttpRequestOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore22jsXMLHttpRequestUploadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14XMLHttpRequest6uploadEv
-__ZN7WebCore20XMLHttpRequestUploadC1EPNS_14XMLHttpRequestE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_20XMLHttpRequestUploadE
-__ZN7WebCore22JSXMLHttpRequestUploadC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20XMLHttpRequestUploadEEE
-__ZN7WebCore22JSXMLHttpRequestUpload3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore31setJSXMLHttpRequestUploadOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZNK7WebCore20XMLHttpRequestUpload22scriptExecutionContextEv
-__ZN7WebCore20jsXMLHttpRequestDONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL34newStreamingTextDecoderUserDefinedERKNS_12TextEncodingEPKv
-__ZN7WebCore20TextCodecUserDefined6decodeEPKcmbbRb
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_23XMLHttpRequestExceptionE
-__ZN7WebCore25JSXMLHttpRequestExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23XMLHttpRequestExceptionEEE
-__ZN7WebCore25JSXMLHttpRequestException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34JSXMLHttpRequestExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32jsXMLHttpRequestExceptionMessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29setJSXMLHttpRequestOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29JSXMLHttpRequestProgressEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15JSProgressEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25jsDOMCoreExceptionMessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10toDocumentEN3JSC10JSValuePtrE
-__ZN7WebCore14XMLHttpRequest4sendEPNS_8DocumentERi
-__ZN7WebCore36setJSXMLHttpRequestUploadOnloadstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore46jsXMLHttpRequestPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore52jsXMLHttpRequestPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16JSXMLHttpRequest19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore14XMLHttpRequest19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore30setJSXMLHttpRequestOnloadstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore50jsXMLHttpRequestExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore25JSXMLHttpRequestException9classInfoEv
-__ZN7WebCoreL17circleConstructorEPNS_8DocumentEb
+__ZN7WebCore16CSSStyleSelector16mapFillCompositeEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore9FillLayer7setNextEPS0_
+__ZN7WebCore16CSSStyleSelector13mapFillOriginEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore9FillLayer15cullEmptyLayersEv
+__ZN7WebCore9FillLayer19fillUnsetPropertiesEv
+__ZN7WebCore13SVGZoomAndPan15parseZoomAndPanERPKtS2_
+__ZN7WebCore13SVGZoomAndPan13setZoomAndPanEt
+__ZN7WebCoreL17scriptConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGScriptElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGScriptElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGURIReferenceC2Ev
+__ZN7WebCore16SVGScriptElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGScriptElement7setTypeERKNS_6StringE
+__ZN7WebCore16SVGScriptElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore15SVGURIReference16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore16SVGScriptElement20insertedIntoDocumentEv
+__ZNK7WebCore16SVGScriptElement20sourceAttributeValueEv
+__ZN7WebCore10SVGElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore16SVGScriptElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore16SVGScriptElement21finishParsingChildrenEv
+__ZN7WebCore16SVGScriptElement27haveLoadedRequiredResourcesEv
+__ZThn240_NK7WebCore16SVGScriptElement14contextElementEv
+__ZNK7WebCore16SVGScriptElement14contextElementEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEbNS1_10StringHashENS_10HashTraitsIS6_EENS8_IbEEEENS_7PtrHashI
+__ZThn288_NK7WebCore16SVGScriptElement20sourceAttributeValueEv
+__ZThn288_NK7WebCore16SVGScriptElement13scriptContentEv
+__ZNK7WebCore16SVGScriptElement13scriptContentEv
+__ZN7WebCoreL17circleConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore16SVGCircleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_11rAttrSt
 __ZN7WebCore16SVGCircleElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore16SVGCircleElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore35setJSXMLHttpRequestUploadOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore22JSXMLHttpRequestUpload4markEv
-__ZN7WebCore37jsXMLHttpRequestProgressEventPositionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsProgressEventLoadedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore38jsXMLHttpRequestProgressEventTotalSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsProgressEventTotalEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16SVGCircleElementD1Ev
-__ZN7WebCore23jsHTMLMediaElementStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30setJSHTMLMediaElementPlayCountEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLMediaElement12setPlayCountEjRi
-__ZN7WebCore16HTMLMediaElement17checkIfSeekNeededEv
-__ZN7WebCore10StringImpl6toUIntEPb
-__ZN7WebCore16charactersToUIntEPKtmPb
-__ZN7WebCore27jsHTMLMediaElementPlayCountEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsHTMLMediaElementCurrentLoopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLMediaElement16effectiveLoopEndEv
-__ZNK7WebCore16HTMLMediaElement7loopEndEv
-__ZN7WebCore16HTMLMediaElement8checkDTDEPKNS_4NodeE
-__ZN7WebCoreL17sourceConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLSourceElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore17HTMLSourceElement17endTagRequirementEv
-__ZNK7WebCore17HTMLSourceElement11tagPriorityEv
-__ZN7WebCore17HTMLSourceElement20insertedIntoDocumentEv
-__ZN7WebCore28jsHTMLMediaElementReadyStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsHTMLMediaElementDATA_UNAVAILABLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL16audioConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLAudioElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16HTMLAudioElement11tagPriorityEv
-__ZN7WebCore16HTMLMediaElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCoreL29createHTMLAudioElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLAudioElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLAudioElementEEE
-__ZN7WebCore25jsHTMLMediaElementLoopEndEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLAudioElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30jsHTMLMediaElementNetworkStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLMediaElementEMPTYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore5Event29isXMLHttpRequestProgressEventEv
-__ZN7WebCore24jsHTMLMediaElementPausedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLVideoElement24imageSourceAttributeNameEv
-__ZN7WebCore24jsHTMLVideoElementPosterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLMediaElementEndedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsHTMLMediaElementEndEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLMediaElementMutedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26setJSHTMLMediaElementMutedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLMediaElement8setMutedEb
-__ZN7WebCore27jsHTMLMediaElementLoopStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30setJSHTMLMediaElementLoopStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLMediaElement12setLoopStartEf
-__ZN7WebCore16HTMLMediaElement22setTimeOffsetAttributeERKNS_13QualifiedNameEf
-__ZN7WebCore26jsHTMLMediaElementSeekableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10TimeRangesE
-__ZN7WebCore12JSTimeRanges15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore12JSTimeRangesC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TimeRangesEEE
-__ZN7WebCore12JSTimeRanges18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18jsTimeRangesLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21JSTimeRangesPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34jsTimeRangesPrototypeFunctionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore12JSTimeRanges9classInfoEv
-__ZN7WebCore32jsTimeRangesPrototypeFunctionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24setJSHTMLMediaElementEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLMediaElement6setEndEf
-__ZN7WebCore28setJSHTMLMediaElementLoopEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLMediaElement10setLoopEndEf
-__ZN7WebCore26setJSHTMLMediaElementStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLMediaElement8setStartEf
-__ZN7WebCore28jsHTMLMediaElementCurrentSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLMediaElement10currentSrcEv
-__ZN7WebCoreL30createHTMLSourceElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLSourceElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSHTMLSourceElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSourceElementEEE
-__ZN7WebCore19JSHTMLSourceElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLSourceElement9classInfoEv
-__ZN7WebCore40jsHTMLMediaElementPrototypeFunctionPauseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore23jsHTMLMediaElementErrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLMediaElement5errorEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10MediaErrorE
-__ZN7WebCore26jsHTMLMediaElementAutoplayEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLMediaElement8autoplayEv
-__ZN7WebCore24jsHTMLMediaElementVolumeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLMediaElement6volumeEv
-__ZN7WebCore27setJSHTMLMediaElementVolumeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLMediaElement9setVolumeEfRi
-__ZN7WebCore18JSAudioConstructor16getConstructDataERN3JSC13ConstructDataE
-__ZN7WebCoreL14constructAudioEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
-__ZNK7WebCore18JSHTMLAudioElement9classInfoEv
-__ZN7WebCore26jsHTMLMediaElementControlsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLMediaElement7isVideoEv
-__ZN7WebCore16HTMLMediaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore11RenderMediaC2EPNS_16HTMLMediaElementE
-__ZN7WebCore28jsHTMLVideoElementVideoWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLVideoElement10videoWidthEv
-__ZN7WebCore29jsHTMLVideoElementVideoHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLVideoElement11videoHeightEv
-__ZN7WebCore29jsHTMLMediaElementCurrentTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsHTMLVideoElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLVideoElement5widthEv
-__ZN7WebCore24jsHTMLVideoElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLVideoElement6heightEv
-__ZN7WebCore26setJSHTMLVideoElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLVideoElement8setWidthEj
-__ZN7WebCore27setJSHTMLVideoElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLVideoElement9setHeightEj
-__ZN7WebCore26jsHTMLMediaElementBufferedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLMediaElement8bufferedEv
-__ZN7WebCore29setJSHTMLMediaElementAutoplayEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLMediaElement11setAutoplayEb
-__ZN7WebCore7Element19setBooleanAttributeERKNS_13QualifiedNameEb
-__ZNK7WebCore22SkewTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore22SkewTransformOperation10isSameTypeERKNS_18TransformOperationE
-__ZNK7WebCore22SkewTransformOperation16getOperationTypeEv
-__ZNK7WebCore22SkewTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
-__ZN7WebCore20TransformationMatrix4skewEdd
-__ZN7WebCore20TransformationMatrix5shearEdd
-__ZN7WebCore9CSSParser12parseReflectEib
-__ZN7WebCore11RenderLayer16createReflectionEv
-__ZN7WebCore13RenderReplicaC1EPNS_4NodeE
-__ZN7WebCore11RenderLayer21updateReflectionStyleEv
-__ZNK7WebCore13RenderReplica13requiresLayerEv
-__ZN7WebCore13RenderReplicaD1Ev
-__ZN7WebCore16HTMLMediaElement19removedFromDocumentEv
-__ZNK7WebCore9RenderBox13reflectedRectERKNS_7IntRectE
-__ZNK7WebCore9RenderBox16reflectionOffsetEv
-__ZN7WebCore13RenderReplica6layoutEv
-__ZN7WebCore14RenderReplaced13paintReplacedERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore31jsProgressEventLengthComputableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLSourceElement3srcEv
-__ZN7WebCore12JSMediaErrorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MediaErrorEEE
-__ZN7WebCore12JSMediaError18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16jsMediaErrorCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsMediaErrorMEDIA_ERR_ABORTEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLMediaElementLOADINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17HTMLSourceElement5mediaEv
-__ZN7WebCoreL32min_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZNK7WebCore17HTMLSourceElement4typeEv
-__ZN7WebCore15JSProgressEventD0Ev
-__ZN7WebCore12JSMediaErrorD0Ev
-__ZN7WebCore11RenderMediaD1Ev
-__ZN7WebCore18MediaPlayerPrivate24disableUnsupportedTracksERj
-__ZL20initQTMediaTypeVideov
-__ZL20initQTMediaTypeSoundv
-__ZL19initQTMediaTypeTextv
-__ZL19initQTMediaTypeBasev
-__ZL24initQTMediaTypeAttributev
-__ZN7WebCore11MediaPlayer4playEv
-__ZN7WebCore18MediaPlayerPrivate4playEv
-__ZN7WebCoreL20QTVideoRendererClassEv
-__ZN7WebCore18MediaPlayerPrivate21createQTVideoRendererEv
-__ZL58initQTVideoRendererWebKitOnlyNewImageAvailableNotificationv
-__ZL28QTMediaTypeAttributeFunctionv
-__ZL35QTMovieNaturalSizeAttributeFunctionv
-__ZN7WebCore32setJSHTMLMediaElementCurrentTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZL62QTVideoRendererWebKitOnlyNewImageAvailableNotificationFunctionv
-__ZN7WebCore26jsHTMLMediaElementDurationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsHTMLMediaElementLOADEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13RenderReplica5paintERNS_12RenderObject9PaintInfoEii
--[WebCoreMovieObserver didEnd:]
-__ZN7WebCore18MediaPlayerPrivate6didEndEv
-__ZNK7WebCore16HTMLMediaElement18effectiveLoopStartEv
-__ZN7WebCore11MediaPlayer5pauseEv
-__ZN7WebCore18MediaPlayerPrivate5pauseEv
-__ZN7WebCore29setJSHTMLMediaElementControlsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLMediaElement11setControlsEb
-__ZN7WebCore7Element15removeAttributeERKNS_13QualifiedNameERi
-__ZN7WebCore33jsHTMLMediaElementLOADED_METADATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore36jsHTMLMediaElementLOADED_FIRST_FRAMEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsHTMLMediaElementSeekingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLMediaElement7seekingEv
-__ZN7WebCore29jsMediaErrorMEDIA_ERR_NETWORKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40jsHTMLMediaElementCAN_SHOW_CURRENT_FRAMEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsHTMLMediaElementCAN_PLAY_THROUGHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore5TimerINS_18MediaPlayerPrivateEE5firedEv
-__ZN7WebCore18MediaPlayerPrivate18endPointTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore5TimerINS_11RenderMediaEE5firedEv
-__ZN7WebCore11RenderMedia26opacityAnimationTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore11RenderMedia13changeOpacityEPNS_11HTMLElementEf
-__ZN7WebCore11RenderMedia20timeUpdateTimerFiredEPNS_5TimerIS0_EE
--[WebCoreMovieObserver newImageAvailable:]
--[WebCoreMovieObserver repaint]
-__ZN7WebCore18MediaPlayerPrivate7repaintEv
-__ZN7WebCore11MediaPlayer7repaintEv
-__ZThn56_N7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
-__ZN7WebCore19JSHTMLSourceElementD0Ev
-__ZN7WebCore17HTMLSourceElementD1Ev
-__ZN7WebCore15CSSReflectValueD1Ev
-__ZN7WebCore26setJSHTMLEmbedElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLPlugInElement8setAlignERKNS_6StringE
-__ZN7WebCore25setJSHTMLEmbedElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLEmbedElement7setTypeERKNS_6StringE
-__ZN7WebCore24setJSHTMLEmbedElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLEmbedElement6setSrcERKNS_6StringE
-__ZN7WebCore15RenderScrollbar21createCustomScrollbarEPNS_15ScrollbarClientENS_20ScrollbarOrientationEPNS_9RenderBoxE
-__ZN7WebCore15RenderScrollbarC1EPNS_15ScrollbarClientENS_20ScrollbarOrientationEPNS_9RenderBoxE
-__ZN7WebCore20RenderScrollbarTheme20renderScrollbarThemeEv
-__ZN7WebCore20RenderScrollbarTheme17registerScrollbarEPNS_9ScrollbarE
-__ZN7WebCore20RenderScrollbarTheme18scrollbarThicknessENS_20ScrollbarControlSizeE
-__ZN7WebCore15RenderScrollbar9setParentEPNS_10ScrollViewE
-__ZN7WebCore15RenderScrollbar12styleChangedEv
-__ZN7WebCore15RenderScrollbar20updateScrollbarPartsEb
-__ZN7WebCore15RenderScrollbar19updateScrollbarPartENS_13ScrollbarPartEb
-__ZN7WebCore15RenderScrollbar23getScrollbarPseudoStyleENS_13ScrollbarPartENS_11RenderStyle8PseudoIdE
-__ZNK7WebCore16CSSStyleSelector15SelectorChecker25checkScrollbarPseudoClassEPNS_11CSSSelectorERNS_11RenderStyle8PseudoIdE
-__ZN7WebCore15RenderScrollbar19partForStyleResolveEv
-__ZNK7WebCore20RenderScrollbarTheme16buttonsPlacementEv
-__ZN3WTF7HashMapIjPN7WebCore19RenderScrollbarPartENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
-__ZN7WebCore19RenderScrollbarPartC1EPNS_4NodeEPNS_15RenderScrollbarENS_13ScrollbarPartE
-__ZN3WTF9HashTableIjSt4pairIjPN7WebCore19RenderScrollbarPartEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSB_IS4_EEEESC_E6expandEv
-__ZN7WebCore19RenderScrollbarPart15styleWillChangeENS_11RenderStyle4DiffEPKS1_
-__ZN7WebCore19RenderScrollbarPart14styleDidChangeENS_11RenderStyle4DiffEPKS1_
-__ZNK7WebCore19RenderScrollbarPart13requiresLayerEv
-__ZN7WebCore19RenderScrollbarPart6layoutEv
-__ZN7WebCore19RenderScrollbarPart18layoutVerticalPartEv
-__ZN7WebCore19RenderScrollbarPart21computeScrollbarWidthEv
-__ZN7WebCoreL27calcScrollbarThicknessUsingERKNS_6LengthEi
-__ZN7WebCore15RenderScrollbar10setEnabledEb
-__ZN7WebCore20RenderScrollbarTheme9trackRectEPNS_9ScrollbarEb
-__ZN7WebCore20RenderScrollbarTheme10hasButtonsEPNS_9ScrollbarE
-__ZN7WebCore20RenderScrollbarTheme25buttonSizesAlongTrackAxisEPNS_9ScrollbarERiS3_
-__ZN7WebCore20RenderScrollbarTheme14backButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
-__ZN7WebCore15RenderScrollbar10buttonRectENS_13ScrollbarPartE
-__ZN7WebCore19RenderScrollbarPart22computeScrollbarHeightEv
-__ZN7WebCore20RenderScrollbarTheme17forwardButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
-__ZN7WebCore20RenderScrollbarTheme31constrainTrackRectToTrackPiecesEPNS_9ScrollbarERKNS_7IntRectE
-__ZN7WebCore15RenderScrollbar25trackPieceRectWithMarginsENS_13ScrollbarPartERKNS_7IntRectE
-__ZN7WebCore20RenderScrollbarTheme18minimumThumbLengthEPNS_9ScrollbarE
-__ZN7WebCore15RenderScrollbar18minimumThumbLengthEv
-__ZN7WebCore15RenderScrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore23ScrollbarThemeComposite5paintEPNS_9ScrollbarEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore15RenderScrollbar9trackRectEii
-__ZN7WebCore20RenderScrollbarTheme8hasThumbEPNS_9ScrollbarE
-__ZN7WebCore20RenderScrollbarTheme24paintScrollbarBackgroundEPNS_15GraphicsContextEPNS_9ScrollbarE
-__ZN7WebCore15RenderScrollbar9paintPartEPNS_15GraphicsContextENS_13ScrollbarPartERKNS_7IntRectE
-__ZN7WebCore19RenderScrollbarPart13paintIntoRectEPNS_15GraphicsContextEiiRKNS_7IntRectE
-__ZN7WebCore20RenderScrollbarTheme11paintButtonEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectENS_13ScrollbarPartE
-__ZN7WebCore20RenderScrollbarTheme20paintTrackBackgroundEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
-__ZN7WebCore20RenderScrollbarTheme15paintTrackPieceEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectENS_13ScrollbarPartE
-__ZN7WebCore23ScrollbarThemeComposite14paintTickmarksEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
-__ZN7WebCore20RenderScrollbarTheme10paintThumbEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
-__ZN3WTF9HashTableIjSt4pairIjPN7WebCore19RenderScrollbarPartEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSB_IS4_EEEESC_E4findIjNS_22IdentityHashTranslatorIjS5_S9_EEEENS_17HashTableIteratorIjS5_S7_S9_SE_SC_EERKT_
-__ZN7WebCore19RenderScrollbarPartD1Ev
-__ZN7WebCore15RenderScrollbarD1Ev
-__ZN7WebCore20RenderScrollbarTheme19unregisterScrollbarEPNS_9ScrollbarE
-__ZN7WebCore19RenderScrollbarPart20layoutHorizontalPartEv
-__ZThn136_NK7WebCore13RenderListBox22scrollbarCornerPresentEv
-__ZNK7WebCore13RenderListBox22scrollbarCornerPresentEv
-__ZN7WebCore19RenderScrollbarPart12imageChangedEPvPKNS_7IntRectE
-__ZNK7WebCore11RenderLayer22scrollbarCornerPresentEv
-__ZN7WebCore9JSStorage18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore9JSStorage18canGetItemsForNameEPN3JSC9ExecStateEPNS_7StorageERKNS1_10IdentifierE
-__ZNK7WebCore7Storage8containsERKNS_6StringE
-__ZNK7WebCore11StorageArea8containsERKNS_6StringE
-__ZNK7WebCore11StorageArea16internalContainsERKNS_6StringE
-__ZNK7WebCore10StorageMap8containsERKNS_6StringE
-__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS2_EESA_EESA_E8containsIS2_NS_22IdentityHashTranslatorIS2_S4_S7_EEEEbRKT_
-__ZN7WebCore18JSStoragePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33jsStoragePrototypeFunctionSetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Storage7setItemERKNS_6StringES3_Ri
-__ZN7WebCore11StorageArea7setItemERKNS_6StringES3_RiPNS_5FrameE
-__ZN7WebCore11StorageArea15internalSetItemERKNS_6StringES3_RiPNS_5FrameE
-__ZN7WebCore10StorageMap7setItemERKNS_6StringES3_RS1_
-__ZN7WebCore10StorageMap18invalidateIteratorEv
-__ZN7WebCore18SessionStorageArea11itemChangedERKNS_6StringES3_S3_PNS_5FrameE
-__ZN7WebCore18SessionStorageArea20dispatchStorageEventERKNS_6StringES3_S3_PNS_5FrameE
-__ZN7WebCore15EventTargetNode20dispatchStorageEventERKNS_12AtomicStringERKNS_6StringES6_S6_PNS_5FrameE
-__ZN7WebCore12StorageEventC1ERKNS_12AtomicStringERKNS_6StringES6_S6_S6_N3WTF10PassRefPtrINS_9DOMWindowEEE
-__ZN7WebCore14ResourceHandle15scheduleFailureENS0_11FailureTypeE
-__ZN7WebCore5TimerINS_14ResourceHandleEE5firedEv
-__ZN7WebCore14ResourceHandle11fireFailureEPNS_5TimerIS0_EE
-__ZN7WebCore14ResourceLoader10wasBlockedEPNS_14ResourceHandleE
-__ZN7WebCore14ResourceLoader12blockedErrorEv
-__ZNK7WebCore11FrameLoader12blockedErrorERKNS_15ResourceRequestE
-__ZN7WebCore9JSStorage16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore9JSStorage22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore7Storage6lengthEv
-__ZNK7WebCore16LocalStorageArea6lengthEv
-__ZNK7WebCore11StorageArea14internalLengthEv
-__ZNK7WebCore10StorageMap6lengthEv
-__ZN7WebCore9JSStorage3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore9JSStorage9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore16LocalStorageArea7setItemERKNS_6StringES3_RiPNS_5FrameE
-__ZN7WebCore16LocalStorageArea11itemChangedERKNS_6StringES3_S3_PNS_5FrameE
-__ZN7WebCore16LocalStorageArea19scheduleItemForSyncERKNS_6StringES3_
-__ZN7WebCore16LocalStorageArea20dispatchStorageEventERKNS_6StringES3_S3_PNS_5FrameE
-__ZNK7WebCore12StorageEvent14isStorageEventEv
-__ZN7WebCore14JSStorageEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12StorageEventEEE
-__ZN7WebCore14JSStorageEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17jsStorageEventKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsStorageEventNewValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsStorageEventOldValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16LocalStorageArea8containsERKNS_6StringE
-__ZN7WebCore9JSStorage10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore7Storage7getItemERKNS_6StringE
-__ZNK7WebCore16LocalStorageArea7getItemERKNS_6StringE
-__ZNK7WebCore11StorageArea15internalGetItemERKNS_6StringE
-__ZNK7WebCore10StorageMap7getItemERKNS_6StringE
-__ZN7WebCore33jsStoragePrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore36jsStoragePrototypeFunctionRemoveItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Storage10removeItemERKNS_6StringE
-__ZN7WebCore16LocalStorageArea10removeItemERKNS_6StringEPNS_5FrameE
-__ZN7WebCore11StorageArea18internalRemoveItemERKNS_6StringEPNS_5FrameE
-__ZN7WebCore10StorageMap10removeItemERKNS_6StringERS1_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS2_EESA_EESA_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S7_EEEENS_17HashTableIteratorIS2_S4_S6_S7_SB_SA_EERKT_
-__ZN7WebCore16LocalStorageArea11itemRemovedERKNS_6StringES3_PNS_5FrameE
-__ZNK7WebCore7Storage3keyEjRi
-__ZNK7WebCore16LocalStorageArea3keyEjRi
-__ZNK7WebCore11StorageArea11internalKeyEjRi
-__ZNK7WebCore10StorageMap3keyEjRNS_6StringE
-__ZNK7WebCore10StorageMap18setIteratorToIndexEj
-__ZN7WebCore15jsStorageLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSStorageEventD0Ev
-__ZN7WebCore29jsStoragePrototypeFunctionKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore17jsStorageEventUriEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsStorageEventSourceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9JSStorage14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
-__ZN7WebCore31jsStoragePrototypeFunctionClearEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Storage5clearEv
-__ZN7WebCore11StorageArea5clearEPNS_5FrameE
-__ZN7WebCore11StorageArea13internalClearEPNS_5FrameE
-__ZN7WebCore16LocalStorageArea11areaClearedEPNS_5FrameE
-__ZN7WebCore16LocalStorageArea13scheduleClearEv
-__ZN7WebCore5TimerINS_16LocalStorageAreaEE5firedEv
-__ZNK7WebCore11StorageArea6lengthEv
-__ZNK7WebCore11StorageArea7getItemERKNS_6StringE
-__ZN7WebCore11StorageArea10removeItemERKNS_6StringEPNS_5FrameE
-__ZN7WebCore18SessionStorageArea11itemRemovedERKNS_6StringES3_PNS_5FrameE
-__ZNK7WebCore11StorageArea3keyEjRi
-__ZN7WebCore18SessionStorageArea11areaClearedEPNS_5FrameE
-__ZN7WebCore10StorageMap4copyEv
-__ZN7WebCore14SecurityOrigin28createFromDatabaseIdentifierERKNS_6StringE
-__ZN7WebCore11getFileSizeERKNS_6StringERx
-__ZN7WebCore38jsDatabasePrototypeFunctionTransactionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore10JSDatabase11transactionEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore30JSCustomSQLTransactionCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
-__ZN7WebCore35JSCustomSQLTransactionErrorCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
-__ZN7WebCore14toVoidCallbackEPN3JSC9ExecStateENS0_10JSValuePtrE
-__ZN7WebCore20JSCustomVoidCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
-__ZN7WebCore8Database11transactionEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS2_INS_27SQLTransactionErrorCallbackEEENS2_INS_12VoidCallbackEEE
-__ZN7WebCore14SQLTransaction6createEPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionErrorCallbackEEENS4_INS_12VoidCallbackEEENS4_INS_21SQLTransactionWrapperEEE
-__ZN7WebCore14SQLTransactionC1EPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionErrorCallbackEEENS4_INS_12VoidCallbackEEENS4_INS_21SQLTransactionWrapperEEE
-__ZN3WTF5DequeINS_6RefPtrIN7WebCore14SQLTransactionEEEE14expandCapacityEv
-__ZN7WebCore8Database19scheduleTransactionEv
-__ZN7WebCore23DatabaseTransactionTaskC1EN3WTF10PassRefPtrINS_14SQLTransactionEEE
-__ZN7WebCore14DatabaseThread12scheduleTaskEN3WTF10PassRefPtrINS_12DatabaseTaskEEE
-__ZN7WebCore23DatabaseTransactionTask13doPerformTaskEv
-__ZN7WebCore14SQLTransaction15performNextStepEv
-__ZN7WebCore14SQLTransaction28checkAndHandleClosedDatabaseEv
-__ZN7WebCore14SQLTransaction27openTransactionAndPreflightEv
-__ZNK7WebCore8Database11maximumSizeEv
-__ZNK7WebCore8Database12databaseSizeEv
-__ZN7WebCore14SQLiteDatabase14setMaximumSizeEx
-__ZN7WebCore14SQLiteDatabase8pageSizeEv
-returnSingleInt
-__ZN7WebCore6String6numberEx
-__ZN7WebCore18DatabaseAuthorizer16allowTransactionEv
-__ZN7WebCore8Database27scheduleTransactionCallbackEPNS_14SQLTransactionE
-__ZN7WebCore8Database22deliverPendingCallbackEPv
-__ZN7WebCore14SQLTransaction22performPendingCallbackEv
-__ZN7WebCore14SQLTransaction26deliverTransactionCallbackEv
-__ZN7WebCore30JSCustomSQLTransactionCallback11handleEventEPNS_14SQLTransactionERb
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14SQLTransactionE
-__ZN7WebCore16JSSQLTransaction15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSSQLTransactionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SQLTransactionEEE
-__ZN7WebCore25JSSQLTransactionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsSQLTransactionPrototypeFunctionExecuteSqlEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore16JSSQLTransaction9classInfoEv
-__ZN7WebCore16JSSQLTransaction10executeSqlEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore28JSCustomSQLStatementCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
-__ZN7WebCore14SQLTransaction10executeSQLERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_INS_25SQLStatementErrorCallbackEEERi
-__ZN7WebCore12SQLStatement6createERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_INS_25SQLStatementErrorCallbackEEE
-__ZN7WebCore12SQLStatementC2ERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_INS_25SQLStatementErrorCallbackEEE
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EEC2ERKS3_
-__ZNK7WebCore8Database22versionMatchesExpectedEv
-__ZN7WebCore14SQLTransaction16enqueueStatementEN3WTF10PassRefPtrINS_12SQLStatementEEE
-__ZN3WTF5DequeINS_6RefPtrIN7WebCore12SQLStatementEEEE14expandCapacityEv
-__ZN7WebCore14SQLTransaction23scheduleToRunStatementsEv
-__ZN7WebCore8Database23scheduleTransactionStepEPNS_14SQLTransactionE
-__ZN7WebCore14SQLTransaction13runStatementsEv
-__ZN7WebCore14SQLTransaction16getNextStatementEv
-__ZN7WebCore14SQLTransaction19runCurrentStatementEv
-__ZN7WebCore12SQLStatement7executeEPNS_8DatabaseE
-__ZN7WebCore12SQLStatement22clearFailureDueToQuotaEv
-__ZNK7WebCore12SQLStatement29lastExecutionFailedDueToQuotaEv
-__ZNK7WebCore15SQLiteStatement18bindParameterCountEv
-sqlite3_bind_parameter_count
-__ZN7WebCore12SQLResultSetC1Ev
-__ZN7WebCore12SQLResultSet11setInsertIdEx
-__ZN7WebCore14SQLiteDatabase11lastChangesEv
-sqlite3_changes
-__ZN7WebCore12SQLResultSet15setRowsAffectedEi
-__ZN7WebCore18OriginQuotaManager12markDatabaseEPNS_8DatabaseE
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS2_17OriginUsageRecordENS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS8_IS6_EEE3getEPS3_
-__ZN7WebCore17OriginUsageRecord12markDatabaseERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE15reserveCapacityEm
-__ZN7WebCore8SQLValueC2ERKS0_
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE6shrinkEm
-__ZN7WebCore14SQLTransaction19postflightAndCommitEv
-__ZN7WebCore33JSCustomSQLStatementErrorCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
-__ZN7WebCore14SQLiteDatabase12lastErrorMsgEv
-sqlite3_errmsg
-__ZN7WebCore14SQLTransaction27handleCurrentStatementErrorEv
-__ZN7WebCore14SQLTransaction22handleTransactionErrorEb
-__ZN7WebCore14SQLTransaction36cleanupAfterTransactionErrorCallbackEv
-__ZN7WebCore17SQLiteTransaction8rollbackEv
-sqlite3RollbackTransaction
-sqlite3RollbackAll
-__ZN7WebCore14SQLTransaction24deliverStatementCallbackEv
-__ZN7WebCore12SQLStatement15performCallbackEPNS_14SQLTransactionE
-__ZN7WebCore28JSCustomSQLStatementCallback11handleEventEPNS_14SQLTransactionEPNS_12SQLResultSetERb
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SQLResultSetE
-__ZN7WebCore14JSSQLResultSet15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore14JSSQLResultSetC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SQLResultSetEEE
-__ZN7WebCore30JSCustomSQLTransactionCallback10deleteDataEPv
-__ZN7WebCore15DatabaseTracker29scheduleNotifyDatabaseChangedEPNS_14SecurityOriginERKNS_6StringE
-__ZN7WebCoreL17notificationMutexEv
-__ZN7WebCoreL17notificationQueueEv
-__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE14expandCapacityEmPKS6_
-__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE14expandCapacityEm
-__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE15reserveCapacityEm
-__ZN7WebCore15DatabaseTracker23scheduleForNotificationEv
-__ZN7WebCore15DatabaseTracker22notifyDatabasesChangedEPv
-__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE6shrinkEm
-__ZN7WebCore14SQLTransaction22deliverSuccessCallbackEv
-__ZN7WebCore20JSCustomVoidCallback11handleEventEv
-__ZN7WebCore14JSSQLResultSetD0Ev
-__ZN7WebCore14SQLTransactionD1Ev
-__ZN7WebCore20JSCustomVoidCallbackD1Ev
-__ZN7WebCore14SQLTransaction27cleanupAfterSuccessCallbackEv
-__ZN7WebCore14SQLTransaction31deliverTransactionErrorCallbackEv
-__ZN7WebCore18DatabaseAuthorizer13allowFunctionERKNS_6StringE
-randomBlob
-__ZN7WebCore15SQLiteStatement9bindValueEiRKNS_8SQLValueE
-__ZNK7WebCore8SQLValue6numberEv
-__ZN7WebCore15SQLiteStatement10bindDoubleEid
-sqlite3_bind_double
-__ZNK7WebCore8SQLValue6stringEv
-__ZN7WebCore33JSCustomSQLStatementErrorCallback11handleEventEPNS_14SQLTransactionEPNS_8SQLErrorE
-__ZNK7WebCore12SQLResultSet4rowsEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8SQLErrorE
-__ZN7WebCore15SQLiteStatement13getColumnNameEi
-sqlite3_column_name16
-__ZN7WebCore10JSSQLError15createPrototypeEPN3JSC9ExecStateE
-sqlite3_value_text16
-__ZN7WebCore10JSSQLErrorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SQLErrorEEE
-__ZN7WebCore15SQLiteStatement14getColumnValueEi
-sqlite3_column_value
-sqlite3_value_type
-sqlite3_value_double
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE14expandCapacityEmPKS2_
-__ZN7WebCore14JSSQLResultSet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18jsSQLResultSetRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SQLResultSetRowListE
-__ZN7WebCore21JSSQLResultSetRowList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSSQLResultSetRowListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SQLResultSetRowListEEE
-__ZN7WebCore21JSSQLResultSetRowList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSSQLResultSetRowListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsSQLResultSetRowListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21JSSQLResultSetRowList9classInfoEv
-__ZN7WebCore21JSSQLResultSetRowList4itemEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZNK7WebCore19SQLResultSetRowList6lengthEv
-__ZN7WebCore18DatabaseAuthorizer11allowDeleteERKNS_6StringE
-__ZN7WebCore18DatabaseAuthorizer9dropTableERKNS_6StringE
-__ZN7WebCore28setJSHTMLTableElementSummaryEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLTableElement10setSummaryERKNS_6StringE
-__ZN7WebCore32setJSHTMLTableCellElementRowSpanEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement10setRowSpanEi
-__ZNK7WebCore21JSHTMLTableColElement9classInfoEv
-__ZN7WebCore29setJSHTMLTableColElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTableColElement8setWidthERKNS_6StringE
-__ZN7WebCore24setJSHTMLFontElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLFontElement7setSizeERKNS_6StringE
-__ZN7WebCore14RenderTableCol12imageChangedEPvPKNS_7IntRectE
-__ZN7WebCore14RenderTableRow5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore17decodeNamedEntityEPKc
-__ZN7WebCore12JSStyleSheet3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore23setJSStyleSheetDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9CSSParser20parseTransformOriginEiRiS1_RN3WTF6RefPtrINS_8CSSValueEEES6_
+__ZNK7WebCore16SVGCircleElement7isValidEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_12rxAttrStri
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_12ryAttrStri
+__ZN7WebCore4Path22createRoundedRectangleERKNS_9FloatRectERKNS_9FloatSizeE
+__ZNK7WebCore16SVGCircleElement10toPathDataEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_11rAttrS
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cyAttr
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cxAttr
+__ZN7WebCore4Path12createCircleERKNS_10FloatPointEf
+__ZN7WebCore4Path13createEllipseERKNS_10FloatPointEff
+__ZN7WebCoreL36calculateTextAnchorShiftForTextChunkERNS_12SVGTextChunkENS_11ETextAnchorE
+__ZN7WebCoreL26cummulatedWidthOfTextChunkERNS_12SVGTextChunkE
+__ZN7WebCoreL34cummulatedWidthOrHeightOfTextChunkERNS_12SVGTextChunkEb
+__ZN7WebCore40cummulatedWidthOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11yAttrStringE
+__ZN7WebCore10SVGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL15pathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPathDataC2Ev
+__ZN7WebCore14SVGPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGPathElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCoreL25lineargradientConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore24SVGLinearGradientElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore24SVGLinearGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_24SVGLinearGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23linearGradientTagStringEEEXad
+__ZN7WebCore24SVGLinearGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore18SVGGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SVGURIReference20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore24SVGLinearGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore18SVGGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore18SVGGradientElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCoreL15stopConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGStopElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGStopElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEEC1If
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEEC2If
+__ZN7WebCore14SVGStopElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE12se
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE12o
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEfNS1_10StringHashENS_10HashTraitsIS6_EENS8_IfEEEENS_7PtrHashI
+__ZN7WebCore9CSSParser13parseSVGColorEv
+__ZN7WebCore8SVGColorC1ERKNS_5ColorE
+__ZN7WebCoreL25radialgradientConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore24SVGRadialGradientElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore24SVGRadialGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_24SVGRadialGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23radialGradientTagStringEEEXad
+__ZN7WebCore24SVGRadialGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore24SVGRadialGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEiNS1_10StringHashENS_10HashTraitsIS6_EENS8_IiEEEENS_7PtrHashI
+__ZN7WebCore8SVGPaintC1ENS0_12SVGPaintTypeERKNS_6StringES4_S4_
+__ZN7WebCore8SVGPaintC2ENS0_12SVGPaintTypeERKNS_6StringES4_S4_
+__ZN7WebCore8SVGColorC2ERKNS_6StringE
+__ZN7WebCore8SVGColor11setRGBColorERKNS_6StringERi
+__ZN7WebCore8SVGColor23colorFromRGBColorStringERKNS_6StringE
+__ZN7WebCore8SVGPaint6setUriERKNS_6StringE
+__ZNK7WebCore14SVGPathElement11pathSegListEv
+__ZN7WebCore14SVGPathSegListC1ERKNS_13QualifiedNameE
+__ZN7WebCore14SVGPathSegListC2ERKNS_13QualifiedNameE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14shrinkCapacityEm
+__ZN7WebCore22pathSegListFromSVGDataEPNS_14SVGPathSegListERKNS_6StringEb
+__ZN7WebCore13SVGPathParser8parseSVGERKNS_6StringEb
+__ZN7WebCoreL11parseNumberERPKtS1_Rdb
+__ZN7WebCore21SVGPathSegListBuilder9svgMoveToEddbb
+__ZN7WebCore14SVGPathElement25createSVGPathSegMovetoAbsEff
+__ZN7WebCore19SVGPathSegMovetoAbsC1Eff
+__ZN7WebCore19SVGPathSegMovetoAbsC2Eff
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE15reserveCapacityEm
+__ZN7WebCore21SVGPathSegListBuilder9svgLineToEddb
+__ZN7WebCore14SVGPathElement25createSVGPathSegLinetoAbsEff
+__ZN7WebCore19SVGPathSegLinetoAbsC1Eff
+__ZN7WebCore19SVGPathSegLinetoAbsC2Eff
+__ZN7WebCore21SVGPathSegListBuilder12svgClosePathEv
+__ZN7WebCore14SVGPathElement25createSVGPathSegClosePathEv
+__ZN7WebCore19SVGPathSegClosePathC1Ev
+__ZN7WebCore19SVGPathSegClosePathC2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE6shrinkEm
+__ZNK7WebCore14SVGPathElement7isValidEv
+__ZNK7WebCore8SVGPaint3uriEv
+__ZNK7WebCore13SVGSVGElement5isSVGEv
+__ZNK7WebCore14SVGPathElement10toPathDataEv
+__ZN7WebCore14SVGPathSegList10toPathDataEv
+__ZNK7WebCore19SVGPathSegMovetoAbs11pathSegTypeEv
+__ZNK7WebCore19SVGPathSegLinetoAbs11pathSegTypeEv
+__ZNK7WebCore19SVGPathSegClosePath11pathSegTypeEv
+__ZN7WebCore18getPaintServerByIdEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore18SVGGradientElement14canvasResourceEv
+__ZNK7WebCore24SVGLinearGradientElement12gradientTypeEv
+__ZN7WebCore28SVGPaintServerLinearGradientC1EPKNS_18SVGGradientElementE
+__ZN7WebCore28SVGPaintServerLinearGradientC2EPKNS_18SVGGradientElementE
+__ZN7WebCore22SVGPaintServerGradientC2EPKNS_18SVGGradientElementE
+__ZNK7WebCore14SVGPaintServer12resourceTypeEv
+__ZNK7WebCore10RenderPath12isRenderPathEv
+__ZN7WebCore11SVGResource9addClientEPNS_16SVGStyledElementE
+__ZNK3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN3WTF7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZNK3WTF7HashMapIPN7WebCore16SVGStyledElementEPNS1_11ResourceSetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN3WTF7HashMapIPN7WebCore16SVGStyledElementEPNS1_11ResourceSetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS
+__ZNK7WebCore22SVGPaintServerGradient5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZNK7WebCore24SVGLinearGradientElement13buildGradientEv
+__ZNK7WebCore24SVGLinearGradientElement25collectGradientPropertiesEv
+__ZNK7WebCore18SVGGradientElement10buildStopsEv
+__ZNK7WebCore14SVGStopElement14isGradientStopEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE5va
+__ZN7WebCore16SVGStyledElement12resolveStyleEPNS_11RenderStyleE
+__ZN7WebCoreL25colorFromSVGColorCSSValueEPNS_8CSSValueEPNS_11RenderStyleE
+__ZNK7WebCore8SVGColor9colorTypeEv
+__ZN7WebCore13StyleStopDataC1ERKS0_
+__ZN7WebCore13StyleStopDataC2ERKS0_
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EEaSERKS5_
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE6shrinkEm
+__ZNK7WebCore19SVGAnimatedPropertyINS_24SVGLinearGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23linearGradientTagStringEEEXa
+__ZN3WTF7HashSetIPKN7WebCore18SVGGradientElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6ex
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6re
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13a
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15d
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EEC1ERKS5_
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EEC2ERKS5_
+__ZN7WebCore10FloatPoint15narrowPrecisionEdd
+__ZN7WebCore8Gradient15setSpreadMethodENS_20GradientSpreadMethodE
+__ZN7WebCore22SVGPaintServerGradient11setGradientEN3WTF10PassRefPtrINS_8GradientEEE
+__ZN7WebCore22SVGPaintServerGradient18setBoundingBoxModeEb
+__ZN7WebCore22SVGPaintServerGradient20setGradientTransformERKNS_20TransformationMatrixE
+__ZN7WebCore28SVGPaintServerLinearGradient16setGradientStartERKNS_10FloatPointE
+__ZN7WebCore28SVGPaintServerLinearGradient14setGradientEndERKNS_10FloatPointE
+__ZNK7WebCore22SVGPaintServerGradient15boundingBoxModeEv
+__ZNK7WebCore22SVGPaintServerGradient17gradientTransformEv
+__ZNK7WebCore22SVGPaintServerGradient8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZNK7WebCore14SVGPathElement15supportsMarkersEv
+__ZN7WebCore18SVGGradientElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore24RenderSVGHiddenContainerC1EPNS_16SVGStyledElementE
+__ZN7WebCore24RenderSVGHiddenContainerC2EPNS_16SVGStyledElementE
+__ZN7WebCore14SVGStopElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore21RenderSVGGradientStopC1EPNS_14SVGStopElementE
+__ZN7WebCore21RenderSVGGradientStopC2EPNS_14SVGStopElementE
+__ZN7WebCore21RenderSVGGradientStop14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore21RenderSVGGradientStop15gradientElementEv
+__ZNK7WebCore24SVGRadialGradientElement12gradientTypeEv
+__ZN7WebCore28SVGPaintServerRadialGradientC1EPKNS_18SVGGradientElementE
+__ZN7WebCore28SVGPaintServerRadialGradientC2EPKNS_18SVGGradientElementE
+__ZN7WebCore11SVGResource10invalidateEv
+__ZN7WebCore12SVGTransform8setScaleEff
+__ZN7WebCoreL18ellipseConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGEllipseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGEllipseElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore12SVGTransform9setRotateEfff
+__ZN7WebCore17SVGEllipseElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore17SVGEllipseElement7isValidEv
+__ZNK7WebCore13StyleStopDataeqERKS0_
+__ZN7WebCore24RenderSVGHiddenContainer6layoutEv
+__ZN7WebCore21RenderSVGGradientStop6layoutEv
+__ZNK7WebCore17SVGEllipseElement10toPathDataEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12rxAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cyAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cxAt
+__ZNK7WebCore24RenderSVGHiddenContainer29repaintRectInLocalCoordinatesEv
+__ZNK7WebCore12RenderObject22localToParentTransformEv
+__ZNK7WebCore12RenderObject14localTransformEv
+__ZN7WebCore24RenderSVGHiddenContainer5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore24SVGRadialGradientElement13buildGradientEv
+__ZNK7WebCore24SVGRadialGradientElement25collectGradientPropertiesEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_24SVGRadialGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23radialGradientTagStringEEEXa
+__ZN7WebCore28SVGPaintServerRadialGradient17setGradientCenterERKNS_10FloatPointE
+__ZN7WebCore28SVGPaintServerRadialGradient16setGradientFocalERKNS_10FloatPointE
+__ZN7WebCore28SVGPaintServerRadialGradient17setGradientRadiusEf
+__ZN7WebCore13SVGPathParser12calculateArcEbRdS1_dddddbb
+__ZN7WebCore21SVGPathSegListBuilder15svgCurveToCubicEddddddb
+__ZN7WebCore14SVGPathElement31createSVGPathSegCurvetoCubicAbsEffffff
+__ZN7WebCore25SVGPathSegCurvetoCubicAbsC1Effffff
+__ZN7WebCore25SVGPathSegCurvetoCubicAbsC2Effffff
+__ZNK7WebCore25SVGPathSegCurvetoCubicAbs11pathSegTypeEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_22SVGPreserveAspectRatioENS1_10StringHashENS_10HashTrait
+__ZN7WebCore22SVGPreserveAspectRatio24parsePreserveAspectRatioERPKtS2_b
+__ZN7WebCore19SVGAnimatedPropertyINS_15SVGURIReferenceENS_6StringEXadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkNames1
+__ZThn184_NK7WebCore16SVGScriptElement14contextElementEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplENS1_6StringENS1_10StringHashENS_10HashTraitsIS6_EENS9_IS7_EEE
+__ZThn288_NK7WebCore16SVGScriptElement13scriptCharsetEv
+__ZNK7WebCore16SVGScriptElement13scriptCharsetEv
+__ZThn288_NK7WebCore16SVGScriptElement21charsetAttributeValueEv
+__ZNK7WebCore16SVGScriptElement21charsetAttributeValueEv
+__ZN7WebCore12SVGTransform9setMatrixENS_20TransformationMatrixE
+__ZN7WebCoreL16tspanConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGTSpanElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGTSpanElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGTSpanElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderSVGTSpanC1EPNS_4NodeE
+__ZN7WebCore14RenderSVGTSpanC2EPNS_4NodeE
+__ZN7WebCore15RenderSVGInlineC2EPNS_4NodeE
+__ZNK7WebCore15RenderSVGInline13requiresLayerEv
+__ZNK7WebCore15SVGTSpanElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore15RenderSVGInline13createFlowBoxEv
+__ZN7WebCore22SVGCharacterLayoutInfo14processedChunkEff
+__ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE14shrinkCapacityEm
+__ZN7WebCore9InlineBox18isSVGRootInlineBoxEv
+__ZNK7WebCore16SVGInlineFlowBox12svgBoxHeightEv
+__ZN7WebCore30jsHTMLScriptElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLScriptElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLScriptElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCoreL15defsConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGDefsElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore14SVGDefsElement7isValidEv
+__ZN7WebCore14SVGDefsElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore8SVGColorC1ERKNS_6StringE
+__ZN7WebCoreL15maskConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGMaskElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEEEC
+__ZN7WebCore14SVGMaskElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGMaskElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore14SVGMaskElement7isValidEv
+__ZN7WebCore14SVGMaskElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore18RenderSVGContainerC1EPNS_16SVGStyledElementE
+__ZN7WebCore18RenderSVGContainer16setDrawsContentsEb
+__ZN7WebCore14SVGMaskElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore13StyleMaskDataC1ERKS0_
+__ZN7WebCore13StyleMaskDataC2ERKS0_
+__ZNK7WebCore13StyleMaskDataeqERKS0_
+__ZN7WebCore18RenderSVGContainer23calculateLocalTransformEv
+__ZN7WebCore14SVGMaskElement14canvasResourceEv
+__ZN7WebCore17SVGResourceMaskerC1EPKNS_14SVGMaskElementE
+__ZN7WebCore17SVGResourceMaskerC2EPKNS_14SVGMaskElementE
+__ZNK7WebCore17SVGResourceMasker12resourceTypeEv
+__ZN7WebCore17SVGResourceMasker9applyMaskEPNS_15GraphicsContextERKNS_9FloatRectE
+__ZNK7WebCore14SVGMaskElement17drawMaskerContentERKNS_9FloatRectERS1_
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11xAttrStrin
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11yAttrStrin
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_16heightAttr
+__ZN7WebCore30clampImageBufferSizeToViewportEPNS_9FrameViewERNS_7IntSizeE
+__ZN7WebCore20renderSubtreeToImageEPNS_11ImageBufferEPNS_12RenderObjectE
+__ZNK7WebCore11ImageBuffer12getImageDataERKNS_7IntRectE
+__ZN7WebCore9ImageData6createEjj
+__ZN7WebCore9ImageDataC1Ejj
+__ZN7WebCore9ImageDataC2Ejj
+__ZN7WebCore16CanvasPixelArray6createEj
+__ZN7WebCore16CanvasPixelArrayC1Ej
+__ZN7WebCore16CanvasPixelArrayC2Ej
+__ZN7WebCore11ImageBuffer12putImageDataEPNS_9ImageDataERKNS_7IntRectERKNS_8IntPointE
+__ZN7WebCore30JSHTMLScriptElementConstructorD1Ev
+__ZNK7WebCore21HTMLFrameOwnerElement13scrollingModeEv
+__ZN7WebCore6Widget11handleEventEPNS_5EventE
+__ZNK7WebCore14RenderFieldset10renderNameEv
+__ZN7WebCore8Document17setSecurityOriginEPNS_14SecurityOriginE
+__ZN7WebCore11FrameLoader5writeERKNS_6StringE
+__ZNK7WebCore15CSSInitialValue22isImplicitInitialValueEv
+__ZN7WebCore10CachedFont5errorEv
+__ZNK7WebCore15HTMLLinkElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore9TextCodec25getUnencodableReplacementEjNS_19UnencodableHandlingEPc
+__ZN7WebCore21setJSDOMWindowOnclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore17RenderFlexibleBox10renderNameEv
+__ZN7WebCore17RenderFlexibleBoxD0Ev
+__ZN7WebCore24setJSHTMLFormElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement7setNameERKNS_6StringE
+__ZNK7WebCore16StyleCachedImage8isLoadedEv
+__ZNK7WebCore11RenderBlock18adjustForBorderFitEiRiS1_
+__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectES5_NS0_8TileRuleES6_NS_17CompositeOperatorE
+__ZN7WebCore13InlineFlowBox9paintMaskERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore8SVGImage26nativeImageForCurrentFrameEv
+__ZN7WebCore5Image14startAnimationEb
+__ZN7WebCore13InlineFlowBox14paintBoxShadowEPNS_15GraphicsContextEPNS_11RenderStyleEiiii
+__ZN7WebCore15GraphicsContext18clipOutRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_
+__ZN7WebCore15GraphicsContext7clipOutERKNS_4PathE
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionGetImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZNK7WebCore24CanvasRenderingContext2D12getImageDataEffffRi
+__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_9FloatRectE
+__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_10FloatPointE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9ImageDataE
+__ZN7WebCore11JSImageData15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSImageDataC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ImageDataEEE
+__ZN7WebCore11JSImageDataC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ImageDataEEE
+__ZN7WebCore11JSImageData18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsImageDataWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsImageDataHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionPutImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore26JSCanvasRenderingContext2D12putImageDataEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore11toImageDataEN3JSC7JSValueE
+__ZNK7WebCore11JSImageData9classInfoEv
+__ZN7WebCore24CanvasRenderingContext2D12putImageDataEPNS_9ImageDataEffRi
+__ZN7WebCore24CanvasRenderingContext2D12putImageDataEPNS_9ImageDataEffffffRi
+__ZN7WebCore11JSImageDataD1Ev
+__ZN7WebCore11JSImageDataD2Ev
+__ZN7WebCore20JSImageDataPrototypeD1Ev
+__ZN7WebCore9CSSParser11parseCanvasERN3WTF6RefPtrINS_8CSSValueEEE
+__ZNK7WebCore14CSSCanvasValue11isFixedSizeEv
+__ZNK7WebCore10StyleImage13isCachedImageEv
+__ZN7WebCore46jsDocumentPrototypeFunctionGetCSSCanvasContextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document19getCSSCanvasContextERKNS_6StringES3_ii
+__ZN7WebCore8Document19getCSSCanvasElementERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_17HTMLCanvasElementEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getER
+__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_17HTMLCanvasElementEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERK
+__ZNK7WebCore10StyleImage13errorOccurredEv
+__ZNK7WebCore19StyleGeneratedImage21imageHasRelativeWidthEv
+__ZN7WebCore14CSSCanvasValue5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore14CSSCanvasValue7elementEPNS_8DocumentE
+__ZThn104_N7WebCore14CSSCanvasValue13canvasChangedEPNS_17HTMLCanvasElementERKNS_9FloatRectE
+__ZN7WebCore14CSSCanvasValue13canvasChangedEPNS_17HTMLCanvasElementERKNS_9FloatRectE
+__ZNK7WebCore19StyleGeneratedImage4dataEv
+__ZN7WebCore14CSSCanvasValue9fixedSizeEPKNS_12RenderObjectE
+__ZThn104_N7WebCore14CSSCanvasValue15canvasDestroyedEPNS_17HTMLCanvasElementE
+__ZN7WebCore14CSSCanvasValue15canvasDestroyedEPNS_17HTMLCanvasElementE
+__ZN7WebCore14CSSCanvasValueD0Ev
+__ZNK7WebCore16RenderHTMLCanvas10renderNameEv
+__ZN7WebCore53setJSCanvasRenderingContext2DGlobalCompositeOperationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D27setGlobalCompositeOperationERKNS_6StringE
+__ZN7WebCore22parseCompositeOperatorERKNS_6StringERNS_17CompositeOperatorE
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionSetFillColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore26JSCanvasRenderingContext2D12setFillColorEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D12setFillColorEffff
+__ZN7WebCore11CanvasStyleC1Effff
+__ZN7WebCore11CanvasStyleC2Effff
+__ZN7WebCore20makeRGBA32FromFloatsEffff
+__ZN7WebCoreL20colorFloatToRGBAByteEf
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionSetTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore24CanvasRenderingContext2D12setTransformEffffff
+__ZNK7WebCore15GraphicsContext6getCTMEv
+__ZNK7WebCore17HTMLCanvasElement13baseTransformEv
+__ZN7WebCore24CanvasRenderingContext2D9transformEffffff
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16RenderHTMLCanvas17canvasSizeChangedEv
+__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionScaleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D5scaleEff
+__ZN7WebCore42setJSCanvasRenderingContext2DShadowOffsetXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetXEf
+__ZN7WebCore24CanvasRenderingContext2D11applyShadowEv
+__ZN7WebCore42setJSCanvasRenderingContext2DShadowOffsetYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetYEf
+__ZN7WebCore39setJSCanvasRenderingContext2DShadowBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D13setShadowBlurEf
+__ZN7WebCore40setJSCanvasRenderingContext2DShadowColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D14setShadowColorERKNS_6StringE
+__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionBezierCurveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore24CanvasRenderingContext2D13bezierCurveToEffffff
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionRotateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D6rotateEf
+__ZN7WebCore15GraphicsContext6rotateEf
+__ZN7WebCore33setJSCanvasRenderingContext2DFontEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D7setFontERKNS_6StringE
+__ZN7WebCore16CSSStyleSelector20applyPropertyToStyleEiPNS_8CSSValueEPNS_11RenderStyleE
+__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionStrokeTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore26JSCanvasRenderingContext2D10strokeTextEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D10strokeTextERKNS_6StringEff
+__ZN7WebCore24CanvasRenderingContext2D16drawTextInternalERKNS_6StringEffbfb
+__ZN7WebCore24CanvasRenderingContext2D10accessFontEv
+__ZN7WebCore51jsCanvasRenderingContext2DPrototypeFunctionFillTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSCanvasRenderingContext2D8fillTextEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D8fillTextERKNS_6StringEff
+__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionCreatePatternEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore26JSCanvasRenderingContext2D13createPatternEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_17HTMLCanvasElementERKNS_6StringERi
+__ZN7WebCore13CanvasPattern19parseRepetitionTypeERKNS_6StringERbS4_Ri
+__ZN7WebCore13CanvasPatternC1EPNS_5ImageEbbb
+__ZN7WebCore13CanvasPatternC2EPNS_5ImageEbbb
+__ZN7WebCore7PatternC1EPNS_5ImageEbb
+__ZN7WebCore7PatternC2EPNS_5ImageEbb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13CanvasPatternE
+__ZN7WebCore15JSCanvasPattern15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCanvasPatternC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CanvasPatternEEE
+__ZN7WebCore15JSCanvasPatternC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CanvasPatternEEE
+__ZNK7WebCore15JSCanvasPattern9classInfoEv
+__ZN7WebCore11CanvasStyleC1EN3WTF10PassRefPtrINS_13CanvasPatternEEE
+__ZN7WebCore11CanvasStyleC2EN3WTF10PassRefPtrINS_13CanvasPatternEEE
+__ZN7WebCore15GraphicsContext14setFillPatternEN3WTF10PassRefPtrINS_7PatternEEE
+__ZN7WebCore15GraphicsContext16applyFillPatternEv
+__ZNK7WebCore7Pattern21createPlatformPatternERKNS_20TransformationMatrixE
+__ZN7WebCoreL15patternCallbackEPvP9CGContext
+__ZN7WebCoreL22patternReleaseCallbackEPv
+__ZN7WebCore15JSCanvasPatternD1Ev
+__ZN7WebCore15JSCanvasPatternD2Ev
+__ZN7WebCore7PatternD0Ev
+__ZN7WebCore24JSCanvasPatternPrototypeD1Ev
+__ZN7WebCore58jsCanvasRenderingContext2DPrototypeFunctionCreateImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZNK7WebCore24CanvasRenderingContext2D15createImageDataEff
+__ZN7WebCoreL20createEmptyImageDataERKNS_7IntSizeE
+__ZN7WebCore24CanvasRenderingContext2D5resetEv
+__ZN7WebCore35jsCanvasRenderingContext2DFillStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSCanvasRenderingContext2D9fillStyleEPN3JSC9ExecStateE
+__ZNK7WebCore24CanvasRenderingContext2D9fillStyleEv
+__ZN7WebCoreL4toJSEPN3JSC9ExecStateEPNS_11CanvasStyleE
+__ZN7WebCore37jsCanvasRenderingContext2DStrokeStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSCanvasRenderingContext2D11strokeStyleEPN3JSC9ExecStateE
+__ZNK7WebCore24CanvasRenderingContext2D11strokeStyleEv
+__ZN7WebCore38setJSCanvasRenderingContext2DTextAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D12setTextAlignERKNS_6StringE
+__ZN7WebCore14parseTextAlignERKNS_6StringERNS_9TextAlignE
+__ZN7WebCore54jsCanvasRenderingContext2DPrototypeFunctionMeasureTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore24CanvasRenderingContext2D11measureTextERKNS_6StringE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11TextMetricsE
+__ZN7WebCore13JSTextMetrics15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSTextMetricsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11TextMetricsEEE
+__ZN7WebCore13JSTextMetricsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11TextMetricsEEE
+__ZN7WebCore13JSTextMetrics18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsTextMetricsWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41setJSCanvasRenderingContext2DTextBaselineEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D15setTextBaselineERKNS_6StringE
+__ZN7WebCore17parseTextBaselineERKNS_6StringERNS_12TextBaselineE
+__ZN7WebCore13JSTextMetricsD1Ev
+__ZN7WebCore13JSTextMetricsD2Ev
+__ZN7WebCore22JSTextMetricsPrototypeD1Ev
+__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionArcToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D5arcToEfffffRi
+__ZN7WebCore4Path8addArcToERKNS_10FloatPointES3_f
+__ZN7WebCore22jsHTMLEmbedElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement4typeEv
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementERKNS_9FloatRectES5_Ri
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEff
+__ZN7WebCore60jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZN7WebCore26JSCanvasRenderingContext2D17drawImageFromRectEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D17drawImageFromRectEPNS_16HTMLImageElementEffffffffRKNS_6StringE
+__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_16HTMLImageElementERKNS_6StringERi
+__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionIsPointInPathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore24CanvasRenderingContext2D13isPointInPathEff
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionSetShadowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSCanvasRenderingContext2D9setShadowEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffRKNS_6StringE
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEffff
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffRKNS_6StringEf
+__ZN7WebCore22colorWithOverrideAlphaEjf
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffffff
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffff
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEffffffff
+__ZN7WebCore45jsHTMLCanvasElementPrototypeFunctionToDataURLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17HTMLCanvasElement9toDataURLERKNS_6StringERi
+__ZN7WebCore16MIMETypeRegistry35isSupportedImageMIMETypeForEncodingERKNS_6StringE
+__ZN7WebCoreL44initializeSupportedImageMIMETypesForEncodingEv
+__ZNK7WebCore11ImageBuffer9toDataURLERKNS_6StringE
+__ZN7WebCore12base64EncodeERKN3WTF6VectorIcLm0EEERS2_b
+__ZNK7WebCore18JSHTMLQuoteElement9classInfoEv
+__ZNK7WebCore11RenderLayer16enclosingElementEv
+__ZN7WebCore11RenderStyle12clearContentEv
+__ZNK7WebCore15RenderWordBreak10renderNameEv
+__ZN7WebCore30jsCSSPrimitiveValueCSS_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsCSSPrimitiveValueCSS_STRINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsCSSPrimitiveValuePrimitiveTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsCSSPrimitiveValueCSS_RECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_PXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionGetStringValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore51jsCSSPrimitiveValuePrototypeFunctionGetCounterValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17CSSPrimitiveValue15getCounterValueERi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7CounterE
+__ZN7WebCore52jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13getJSRGBColorEPN3JSC9ExecStateEj
+__ZN7WebCore10JSRGBColorC1EPN3JSC9ExecStateEj
+__ZN7WebCore10JSRGBColorC2EPN3JSC9ExecStateEj
+__ZN7WebCore31jsCSSPrimitiveValueCSS_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsCSSPrimitiveValuePrototypeFunctionGetRectValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17CSSPrimitiveValue12getRectValueERi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_4RectE
+__ZN7WebCore10JSRGBColorD1Ev
+__ZN7WebCore19mimeTypeFromDataURLERKNS_6StringE
+__ZNK7WebCore12RenderObject12isRenderPartEv
+__ZN7WebCore11RenderBlock18heightForLineCountEi
+__ZN7WebCoreL21getHeightForLineCountEPNS_11RenderBlockEibRi
+__ZN7WebCore11RenderBlock11lineAtIndexEi
+__ZN7WebCoreL14getLineAtIndexEPNS_11RenderBlockEiRi
+__ZN7WebCore20jsCommentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSComment14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSCommentConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore18JSCommentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSCommentConstructorD1Ev
+__ZN7WebCore11CSSSelector8parseNthEv
+__ZN7WebCore11CSSSelector8RareData8parseNthEv
+__ZN7WebCore11CSSSelector8matchNthEi
+__ZN7WebCore11CSSSelector8RareData8matchNthEi
+__ZN7WebCore52jsCSSStyleDeclarationPrototypeFunctionRemovePropertyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CSSStyleSheet18determineNamespaceERKNS_12AtomicStringE
+__ZN7WebCore9CSSParser21parseDashboardRegionsEib
+__ZN3WTF10RefCountedIN7WebCore15DashboardRegionEE5derefEv
+__ZN7WebCoreL35device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL16parseAspectRatioEPNS_8CSSValueERiS2_
+__ZN7WebCore46jsDOMWindowPrototypeFunctionGetMatchedCSSRulesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow18getMatchedCSSRulesEPNS_7ElementERKNS_6StringEb
+__ZNK7WebCore15CSSFontFaceRule4typeEv
+__ZN7WebCore17JSCSSFontFaceRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSCSSFontFaceRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15CSSFontFaceRuleEEE
+__ZN7WebCore17JSCSSFontFaceRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15CSSFontFaceRuleEEE
+__ZN7WebCore17JSCSSFontFaceRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsCSSFontFaceRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSValueList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore14JSCSSValueListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSValueListEEE
-__ZNK7WebCore14JSCSSValueList9classInfoEv
+__ZN7WebCore14JSCSSValueListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSValueListEEE
 __ZN7WebCore14JSCSSValueList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25jsCSSValueListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSCSSValueList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
-__ZN7WebCore14JSCSSValueList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore12CSSValueList4itemEj
-__ZNK7WebCore23WebKitCSSTransformValue25isWebKitCSSTransformValueEv
-__ZN7WebCore25JSWebKitCSSTransformValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23WebKitCSSTransformValueEEE
-__ZNK7WebCore25JSWebKitCSSTransformValue9classInfoEv
-__ZN7WebCore25JSWebKitCSSTransformValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore36jsWebKitCSSTransformValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore38jsWebKitCSSTransformValueOperationTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore38jsWebKitCSSTransformValueCSS_TRANSLATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore17jsCSSValueCssTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore39jsWebKitCSSTransformValueCSS_TRANSLATEXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore39jsWebKitCSSTransformValueCSS_TRANSLATEYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsWebKitCSSTransformValueCSS_ROTATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsWebKitCSSTransformValueCSS_SCALEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsWebKitCSSTransformValueCSS_SCALEXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsWebKitCSSTransformValueCSS_SCALEYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsWebKitCSSTransformValueCSS_SKEWEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsWebKitCSSTransformValueCSS_SKEWXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsWebKitCSSTransformValueCSS_SKEWYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsWebKitCSSTransformValueCSS_MATRIXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSWebKitCSSTransformValueD0Ev
-__ZN7WebCore14JSCSSValueListD0Ev
+__ZN7WebCore14JSCSSValueListD1Ev
+__ZN7WebCore17JSCSSFontFaceRuleD1Ev
+__ZN7WebCore23JSCSSValueListPrototypeD1Ev
+__ZN7WebCore26JSCSSFontFaceRulePrototypeD1Ev
+__ZSt21__inplace_stable_sortIPPN7WebCore11CSSFontFaceEPFbS2_S2_EEvT_S6_T0_
+__ZN7WebCore21JSCSSStyleDeclaration18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriorityEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore19CSSStyleDeclaration19getPropertyPriorityERKNS_6StringE
+__ZN7WebCoreL24scaleFactorForConversionEt
+__ZN7WebCore9CSSParser18parseHSLParametersEPNS_14CSSParserValueEPdb
+__ZN7WebCore16makeRGBAFromHSLAEdddd
+__ZN7WebCoreL7calcHueEddd
+__ZNK7WebCore9FrameView14didFirstLayoutEv
+__ZNK7WebCore13CSSImportRule4typeEv
+__ZN7WebCore15JSCSSImportRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCSSImportRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSImportRuleEEE
+__ZN7WebCore15JSCSSImportRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSImportRuleEEE
+__ZN7WebCore15JSCSSImportRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsCSSImportRuleStyleSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCSSImportRuleD1Ev
+__ZN7WebCore24JSCSSImportRulePrototypeD1Ev
+__ZNK7WebCore15CSSFontFaceRule7cssTextEv
+__ZNK7WebCore12CSSMediaRule4typeEv
+__ZN7WebCore14JSCSSMediaRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSCSSMediaRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSMediaRuleEEE
+__ZN7WebCore14JSCSSMediaRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSMediaRuleEEE
+__ZN7WebCore14JSCSSMediaRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore12CSSMediaRule7cssTextEv
+__ZNK7WebCore9MediaList9mediaTextEv
+__ZNK7WebCore10MediaQuery7cssTextEv
+__ZN7WebCore14JSCSSMediaRuleD1Ev
+__ZN7WebCore23JSCSSMediaRulePrototypeD1Ev
+__ZN7WebCore18jsDOMWindowScrollXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL39max_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore23JSCSSMediaRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsCSSMediaRulePrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSCSSMediaRule9classInfoEv
+__ZN7WebCore12CSSMediaRule10insertRuleERKNS_6StringEjRi
+__ZN7WebCore11CSSRuleList10insertRuleEPNS_7CSSRuleEj
+__ZN7WebCore22jsCSSMediaRuleCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsCSSMediaRulePrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12CSSMediaRule10deleteRuleEjRi
+__ZN7WebCoreL39min_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore14RenderTableRow5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore25jsCSSRuleParentStyleSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthandEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore19CSSStyleDeclaration20getPropertyShorthandERKNS_6StringE
+__ZNK7WebCore26CSSMutableStyleDeclaration20getPropertyShorthandEi
+__ZN7WebCore9CSSParser24parseTimingFunctionValueERPNS_18CSSParserValueListERd
+__ZNK7WebCore22CSSTimingFunctionValue21isTimingFunctionValueEv
+__ZNK7WebCore16HTMLInputElement17isTextFormControlEv
+__ZNK7WebCore22HTMLFormControlElement17isTextFormControlEv
+__ZNK7WebCore19HTMLTextAreaElement17isTextFormControlEv
+__ZNK7WebCore11RenderLayer18absoluteToContentsERKNS_8IntPointE
+__ZNK7WebCore11RenderLayer22offsetFromResizeCornerERKNS_8IntPointE
+__ZN7WebCore11RenderLayer6resizeERKNS_18PlatformMouseEventERKNS_7IntSizeE
+__ZNK7WebCore7Element22minimumSizeForResizingEv
+__ZN7WebCore7Element25setMinimumSizeForResizingERKNS_7IntSizeE
+__ZN7WebCore26RenderTextControlMultiLine11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore5Image13isBitmapImageEv
+__ZN7WebCore8SVGImage18destroyDecodedDataEb
+__ZN7WebCore8SVGImageD0Ev
+__ZN7WebCore22EmptyFrameLoaderClient14cancelledErrorERKNS_15ResourceRequestE
+__ZN7WebCore22EmptyFrameLoaderClient14shouldFallBackERKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient20setMainDocumentErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient27dispatchDidLoadMainResourceEPNS_14DocumentLoaderE
+__ZN7WebCore22EmptyFrameLoaderClient19dispatchDidFailLoadERKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient39postProgressEstimateChangedNotificationEv
+__ZN7WebCore22EmptyFrameLoaderClient32postProgressFinishedNotificationEv
+__ZN7WebCore22EmptyFrameLoaderClient22dispatchDidFailLoadingEPNS_14DocumentLoaderEmRKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient19detachedFromParent2Ev
+__ZN7WebCore22EmptyFrameLoaderClient19detachedFromParent3Ev
+__ZN7WebCore31RenderSVGTransformableContainerD0Ev
+__ZN7WebCore18RenderSVGContainerD2Ev
+__ZN7WebCore16SVGInlineFlowBoxD0Ev
+__ZN7WebCore14RenderSVGTSpanD0Ev
+__ZN7WebCore12RenderInlineD2Ev
+__ZN7WebCore17EmptyEditorClient13pageDestroyedEv
+__ZN7WebCore20EmptyInspectorClient18inspectorDestroyedEv
+__ZN7WebCore16SVGScriptElementD0Ev
+__ZN7WebCore15SVGURIReferenceD2Ev
+__ZN7WebCore11SVGGElementD0Ev
+__ZN7WebCore14SVGPathElementD0Ev
+__ZN7WebCore14SVGPathSegListD0Ev
+__ZN7WebCore19SVGPathSegMovetoAbsD0Ev
+__ZN7WebCore19SVGPathSegLinetoAbsD0Ev
+__ZN7WebCore19SVGPathSegClosePathD0Ev
+__ZN7WebCore19SVGAnimatedPathDataD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE6shrinkEm
+__ZN7WebCore25SVGPathSegCurvetoCubicAbsD0Ev
+__ZN7WebCore15SVGTSpanElementD0Ev
+__ZN7WebCore22EmptyFrameLoaderClient20frameLoaderDestroyedEv
+__ZN7WebCore22EmptyContextMenuClient20contextMenuDestroyedEv
+__ZN7WebCore15EmptyDragClient23dragControllerDestroyedEv
+__ZN7WebCore20SVGImageChromeClient15chromeDestroyedEv
+__ZN7WebCore20SVGImageChromeClientD0Ev
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remo
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remov
+__ZN7WebCore10SVGElementD0Ev
+__ZN7WebCore24SVGLinearGradientElementD0Ev
+__ZN7WebCore18SVGGradientElementD2Ev
+__ZN7WebCore24SVGRadialGradientElementD0Ev
+__ZN7WebCore28SVGPaintServerLinearGradientD0Ev
+__ZN7WebCore22SVGPaintServerGradientD2Ev
+__ZN7WebCore14SVGPaintServerD2Ev
+__ZN7WebCore11SVGResourceD2Ev
+__ZN7WebCore14SVGStopElementD0Ev
+__ZN7WebCore8SVGColorD0Ev
+__ZN7WebCore21RenderSVGGradientStopD0Ev
+__ZN7WebCore24RenderSVGHiddenContainerD0Ev
+__ZN7WebCore18RenderSVGContainerD0Ev
+__ZN7WebCore15SVGTitleElementD0Ev
+__ZN7WebCore14SVGDescElementD0Ev
+__ZN7WebCore16SVGCircleElementD0Ev
+__ZN7WebCore14SVGLineElementD0Ev
+__ZN7WebCore14SVGDefsElementD0Ev
+__ZN7WebCore28SVGPaintServerRadialGradientD0Ev
+__ZN7WebCore14SVGMaskElementD0Ev
+__ZN7WebCore17SVGResourceMaskerD0Ev
+__ZN7WebCore17SVGEllipseElementD0Ev
+__ZN7WebCore17SVGAnimateElementD0Ev
+__ZN7WebCore19SVGAnimationElementD2Ev
+__ZN7WebCore14SVGSMILElementD2Ev
+__ZN7WebCore14SVGSMILElement20disconnectConditionsEv
+__ZN7WebCore17SMILTimeContainer10unscheduleEPNS_14SVGSMILElementE
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE6shrinkEm
+__ZN7WebCore30setJSDOMWindowRangeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSHTMLInputElementPlaceholderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement14setPlaceholderERKNS_6StringE
+__ZN7WebCore29jsHTMLInputElementPlaceholderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document18setVisuallyOrderedEv
+__ZN7WebCore10TextStreamlsEf
+__ZN7WebCore10ShadowDataD2Ev
+__ZN7WebCore30jsHistoryPrototypeFunctionBackEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9JSHistory9classInfoEv
+__ZN7WebCore7History4backEv
+__ZN7WebCore11FrameLoader25scheduleHistoryNavigationEi
+__ZN7WebCore11FrameLoader15goBackOrForwardEi
+__ZN7WebCore9CSSParser23parseAnimationShorthandEb
+__ZNK7WebCore15PropertyWrapperIRKNS_5ColorEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
+__ZNK7WebCore11RenderStyle15backgroundColorEv
+__ZN7WebCore11RenderStyle18setBackgroundColorERKNS_5ColorE
 __ZN7WebCore13AnimationBase18getPropertyAtIndexEiRb
 __ZNK7WebCore19PropertyWrapperBase18isShorthandWrapperEv
 __ZNK7WebCore11RenderStyle5rightEv
@@ -16707,10 +16082,17 @@
 __ZNK7WebCore11RenderStyle13paddingBottomEv
 __ZNK7WebCore21PropertyWrapperGetterIRKNS_5ColorEE6equalsEPKNS_11RenderStyleES7_
 __ZNK7WebCore11RenderStyle5colorEv
-__ZNK7WebCore11RenderStyle15backgroundColorEv
+__ZNK7WebCore11RenderStyle19backgroundXPositionEv
+__ZNK7WebCore11RenderStyle19backgroundYPositionEv
+__ZNK7WebCore21PropertyWrapperGetterINS_10LengthSizeEE6equalsEPKNS_11RenderStyleES5_
+__ZNK7WebCore11RenderStyle14backgroundSizeEv
+__ZNK7WebCore11RenderStyle13maskXPositionEv
+__ZNK7WebCore11RenderStyle13maskYPositionEv
+__ZNK7WebCore11RenderStyle8maskSizeEv
 __ZNK7WebCore21PropertyWrapperGetterIiE6equalsEPKNS_11RenderStyleES4_
 __ZNK7WebCore11RenderStyle8fontSizeEv
 __ZNK7WebCore11RenderStyle15columnRuleWidthEv
+__ZNK7WebCore21PropertyWrapperGetterIfE6equalsEPKNS_11RenderStyleES4_
 __ZNK7WebCore11RenderStyle9columnGapEv
 __ZNK7WebCore11RenderStyle11columnCountEv
 __ZNK7WebCore11RenderStyle11columnWidthEv
@@ -16722,8 +16104,12 @@
 __ZNK7WebCore11RenderStyle12outlineWidthEv
 __ZNK7WebCore11RenderStyle13letterSpacingEv
 __ZNK7WebCore11RenderStyle11wordSpacingEv
+__ZNK7WebCore11RenderStyle11perspectiveEv
+__ZNK7WebCore11RenderStyle18perspectiveOriginXEv
+__ZNK7WebCore11RenderStyle18perspectiveOriginYEv
 __ZNK7WebCore11RenderStyle16transformOriginXEv
 __ZNK7WebCore11RenderStyle16transformOriginYEv
+__ZNK7WebCore11RenderStyle16transformOriginZEv
 __ZNK7WebCore21PropertyWrapperGetterIRKNS_7IntSizeEE6equalsEPKNS_11RenderStyleES7_
 __ZNK7WebCore11RenderStyle19borderTopLeftRadiusEv
 __ZNK7WebCore11RenderStyle20borderTopRightRadiusEv
@@ -16748,1993 +16134,2455 @@
 __ZNK7WebCore11RenderStyle12floodOpacityEv
 __ZNK7WebCore11RenderStyle13strokeOpacityEv
 __ZNK7WebCore24ShorthandPropertyWrapper18isShorthandWrapperEv
-__ZN7WebCoreL7calcHueEddd
-__ZNK7WebCore15PropertyWrapperIRKNS_5ColorEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
-__ZN7WebCore11RenderStyle18setBackgroundColorERKNS_5ColorE
-__ZN7WebCore21WebKitTransitionEventC1Ev
-__ZNK7WebCore21WebKitTransitionEvent23isWebKitTransitionEventEv
-__ZN7WebCore23JSWebKitTransitionEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitTransitionEventEEE
-__ZN7WebCore23JSWebKitTransitionEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore35jsWebKitTransitionEventPropertyNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21WebKitTransitionEvent12propertyNameEv
-__ZN7WebCore34jsWebKitTransitionEventElapsedTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21WebKitTransitionEvent11elapsedTimeEv
-__ZNK7WebCore21PropertyWrapperShadow5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS4_S7_d
-__ZN7WebCore35setJSDOMWindowOnwebkittransitionendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9DOMWindow24setOnwebkittransitionendEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZNK7WebCore24ShorthandPropertyWrapper6equalsEPKNS_11RenderStyleES3_
-__ZNK7WebCore24ShorthandPropertyWrapper5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS4_S7_d
 __ZNK7WebCore32PropertyWrapperMaybeInvalidColor5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS4_S7_d
-__ZN7WebCore11RenderStyle17setBorderTopColorERKNS_5ColorE
-__ZNK7WebCore15PropertyWrapperItE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
-__ZN7WebCore11RenderStyle17setBorderTopWidthEt
-__ZN7WebCore11RenderStyle19setBorderRightColorERKNS_5ColorE
-__ZN7WebCore11RenderStyle19setBorderRightWidthEt
-__ZN7WebCore11RenderStyle20setBorderBottomColorERKNS_5ColorE
-__ZN7WebCore11RenderStyle20setBorderBottomWidthEt
 __ZN7WebCore11RenderStyle18setBorderLeftColorERKNS_5ColorE
-__ZN7WebCore11RenderStyle18setBorderLeftWidthEt
-__ZNK7WebCore15PropertyWrapperIRKNS_7IntSizeEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
-__ZN7WebCore11RenderStyle23setBorderTopRightRadiusERKNS_7IntSizeE
-__ZN7WebCore11RenderStyle22setBorderTopLeftRadiusERKNS_7IntSizeE
-__ZN7WebCore11RenderStyle25setBorderBottomLeftRadiusERKNS_7IntSizeE
-__ZN7WebCore11RenderStyle26setBorderBottomRightRadiusERKNS_7IntSizeE
-__ZN7WebCore11RenderStyle12setMarginTopENS_6LengthE
-__ZN7WebCore11RenderStyle14setMarginRightENS_6LengthE
-__ZN7WebCore11RenderStyle15setMarginBottomENS_6LengthE
-__ZN7WebCore11RenderStyle13setMarginLeftENS_6LengthE
-__ZN7WebCore11RenderStyle19setTransformOriginXENS_6LengthE
-__ZN7WebCore11RenderStyle19setTransformOriginYENS_6LengthE
-__ZN7WebCore11RenderStyle15setOutlineColorERKNS_5ColorE
-__ZNK7WebCore15PropertyWrapperIiE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
-__ZN7WebCore11RenderStyle16setOutlineOffsetEi
-__ZN7WebCore11RenderStyle15setOutlineWidthEt
-__ZN7WebCore11RenderStyle13setPaddingTopENS_6LengthE
-__ZN7WebCore11RenderStyle15setPaddingRightENS_6LengthE
-__ZN7WebCore11RenderStyle16setPaddingBottomENS_6LengthE
-__ZN7WebCore11RenderStyle14setPaddingLeftENS_6LengthE
-__ZN7WebCore15EventTargetNode29dispatchWebKitTransitionEventERKNS_12AtomicStringERKNS_6StringEd
-__ZN7WebCore21WebKitTransitionEventC1ERKNS_12AtomicStringERKNS_6StringEd
-__ZN7WebCore22jsCSSValueCssValueTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsCSSValueCSS_VALUE_LISTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11RenderStyle20setBorderBottomColorERKNS_5ColorE
+__ZN7WebCore11RenderStyle19setBorderRightColorERKNS_5ColorE
+__ZN7WebCore11RenderStyle17setBorderTopColorERKNS_5ColorE
+__ZN7WebCore17ImplicitAnimation14onAnimationEndEd
+__ZN7WebCore17ImplicitAnimation19sendTransitionEventERKNS_12AtomicStringEd
+__ZNK7WebCore17ImplicitAnimation26shouldSendEventForListenerENS_8Document12ListenerTypeE
+__ZN7WebCore13AnimationBase26resumeOverriddenAnimationsEv
+__ZN3WTF9HashTableIiSt4pairIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHa
+__ZN7WebCore23JSCSSValueListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsCSSValueListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSCSSValueList9classInfoEv
+__ZN7WebCore12CSSValueList4itemEj
+__ZN7WebCore20JSHTMLMarqueeElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZThn88_N7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore28jsProcessingInstructionSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsStyleSheetDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15HTMLBodyElement13setScrollLeftEi
+__ZN7WebCore15HTMLBodyElement12setScrollTopEi
+__ZNK7WebCore27CSSComputedStyleDeclaration6lengthEv
+__ZN7WebCore42jsCSSStyleDeclarationPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore27CSSComputedStyleDeclaration4itemEj
+__ZN7WebCoreL26getBorderRadiusCornerValueENS_7IntSizeE
+__ZN7WebCoreL22valueForNinePieceImageERKNS_14NinePieceImageE
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEC2ERKS3_
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_15DashboardRegionEEE
+__ZNK7WebCore27CSSComputedStyleDeclaration22getSVGPropertyCSSValueEiNS_13EUpdateLayoutE
+__ZNK7WebCore8SVGPaint7cssTextEv
+__ZNK7WebCore8SVGColor7cssTextEv
+__ZN7WebCoreL35glyphOrientationToCSSPrimitiveValueENS_17EGlyphOrientationE
+__ZN7WebCore19JSCSSValuePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19StyleGeneratedImage8cssValueEv
+__ZN7WebCoreL18valueForRepeatRuleEi
+__ZN7WebCore10JSCSSValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8CSSValueEEE
+__ZNK7WebCore10JSCSSValue9classInfoEv
+__ZN7WebCore14GeneratedImage11drawPatternEPNS_15GraphicsContextERKNS_9FloatRectERKNS_20TransformationMatrixERKNS_10FloatPointEN
+__ZN7WebCore10JSCSSValueD1Ev
+__ZNK7WebCore22SkewTransformOperation16getOperationTypeEv
+__ZNK7WebCore22SkewTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore20TransformationMatrix4skewEdd
+__ZNK7WebCore22SkewTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore22SkewTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore22SkewTransformOperationD0Ev
+__ZN7WebCore25setJSHTMLElementOuterHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setOuterHTMLERKNS_6StringERi
+__ZN7WebCore12CSSNamespace18namespaceForPrefixERKNS_12AtomicStringE
+__ZN7WebCore12CSSNamespaceD2Ev
+__ZN7WebCore9CSSParser21addUnresolvedPropertyEib
+__ZN7WebCore12CSSValueListC1EPNS_18CSSParserValueListE
+__ZN7WebCore12CSSValueListC2EPNS_18CSSParserValueListE
+__ZN7WebCore14CSSParserValue14createCSSValueEv
+__ZN7WebCore25CSSVariableDependentValueC1EN3WTF10PassRefPtrINS_12CSSValueListEEE
+__ZN7WebCore25CSSVariableDependentValueC2EN3WTF10PassRefPtrINS_12CSSValueListEEE
+__ZN7WebCore9CSSParser27addVariableDeclarationBlockERKNS_15CSSParserStringE
+__ZN7WebCore9CSSParser19createVariablesRuleEPNS_9MediaListEb
+__ZNK7WebCore25CSSVariableDependentValue24isVariableDependentValueEv
+__ZNK3WTF7HashMapIPN7WebCore26CSSMutableStyleDeclarationENS_6RefPtrIS2_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getE
+__ZNK7WebCore19CSSStyleDeclaration10parentRuleEv
+__ZN7WebCore26CSSMutableStyleDeclarationC1EPNS_7CSSRuleE
+__ZN3WTF7HashMapIPN7WebCore26CSSMutableStyleDeclarationENS_6RefPtrIS2_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setER
+__ZN3WTF9HashTableIPN7WebCore26CSSMutableStyleDeclarationESt4pairIS3_NS_6RefPtrIS2_EEENS_18PairFirstExtractorIS7_EENS_7PtrHashI
+__ZN7WebCore16CSSStyleSelector30resolveVariablesForDeclarationEPNS_26CSSMutableStyleDeclarationES2_RN3WTF7HashSetINS_6StringENS
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_16CSSVariablesRuleENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
+__ZNK7WebCore14XMLHttpRequest38usesDashboardBackwardCompatibilityModeEv
+__ZN7WebCore9CSSParser11addVariableERKNS_15CSSParserStringEPNS_18CSSParserValueListE
+__ZN7WebCore25CSSVariableDependentValueD0Ev
+__ZNK7WebCore17CSSPrimitiveValue11parserValueEv
+__ZN7WebCore9StyleBase6isRuleEv
+__ZN7WebCore26JSXMLSerializerConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26JSXMLSerializerConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCore26JSXMLSerializerConstructor9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13XMLSerializerE
+__ZN7WebCore15JSXMLSerializerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XMLSerializerEEE
+__ZN7WebCore15JSXMLSerializerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XMLSerializerEEE
+__ZN7WebCore15JSXMLSerializer18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSXMLSerializerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore49jsXMLSerializerPrototypeFunctionSerializeToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSXMLSerializer9classInfoEv
+__ZN7WebCore13XMLSerializer17serializeToStringEPNS_4NodeERi
+__ZN7WebCore15JSXMLSerializerD1Ev
+__ZN7WebCore15JSXMLSerializerD2Ev
+__ZN7WebCoreL22shouldAddNamespaceElemEPKNS_7ElementE
+__ZN7WebCoreL15appendNamespaceERN3WTF6VectorItLm0EEERKNS_12AtomicStringES6_RNS0_7HashMapIPNS_16AtomicStringImplES9_NS0_7PtrHash
+__ZN7WebCoreL22shouldAddNamespaceAttrEPKNS_9AttributeERN3WTF7HashMapIPNS_16AtomicStringImplES6_NS3_7PtrHashIS6_EENS3_10HashTrai
+__ZN7WebCore23jsHTMLAnchorElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4textEv
+__ZN7WebCore40jsHTMLSelectElementPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14jsSVGElementIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSSVGSVGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore12JSSVGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17setJSSVGElementIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10SVGElement5setIdERKNS_6StringERi
+__ZN7WebCoreL17isViewportElementEPNS_4NodeE
+__ZN7WebCore13SVGSVGElement19removedFromDocumentEv
+__ZThn8_N7WebCore13SVGSVGElementD0Ev
+__ZN7WebCore9Attribute17isMappedAttributeEv
+__ZN7WebCore22JSNamedNodesCollectionC1EPN3JSC9ExecStateERKN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZN7WebCore22JSNamedNodesCollectionC2EPN3JSC9ExecStateERKN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEC2ERKS5_
+__ZN7WebCore22JSNamedNodesCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSNamedNodesCollection11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore22JSNamedNodesCollectionD1Ev
+__ZN7WebCore50jsCanvasRenderingContext2DGlobalCompositeOperationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D24globalCompositeOperationEv
+__ZN7WebCore21compositeOperatorNameENS_17CompositeOperatorE
+__ZN7WebCore33jsCanvasRenderingContext2DLineCapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D7lineCapEv
+__ZN7WebCore11lineCapNameENS_7LineCapE
+__ZN7WebCore34jsCanvasRenderingContext2DLineJoinEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D8lineJoinEv
+__ZN7WebCore12lineJoinNameENS_8LineJoinE
+__ZN7WebCore37jsCanvasRenderingContext2DShadowColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D11shadowColorEv
+__ZNK7WebCore19JSHTMLLegendElement9classInfoEv
+__ZN7WebCore28setJSHTMLLinkElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement11setDisabledEb
+__ZN7WebCore15HTMLLinkElement16setDisabledStateEb
+__ZN7WebCore37jsRangePrototypeFunctionCloneContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range13cloneContentsERi
+__ZN7WebCoreL18callHTMLCollectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore31jsCSSStyleDeclarationParentRuleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27CSSComputedStyleDeclaration11setPropertyEiRKNS_6StringEbRi
+__ZN7WebCore21jsCSSRuleUNKNOWN_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSRuleSTYLE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsCSSRuleCHARSET_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSRuleIMPORT_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSRuleMEDIA_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsCSSRuleFONT_FACE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsCSSRulePAGE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsCSSValueCSS_INHERITEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore29jsCSSValueCSS_PRIMITIVE_VALUEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsCSSPrimitiveValuePrimitiveTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsCSSPrimitiveValueCSS_STRINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore31jsCSSPrimitiveValueCSS_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsCSSPrimitiveValueCSS_RECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore52jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13getJSRGBColorEPN3JSC9ExecStateEj
-__ZN7WebCore10JSRGBColorC1EPN3JSC9ExecStateEj
+__ZN7WebCore24jsCSSValueCSS_VALUE_LISTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSValueCSS_CUSTOMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsDOMWindowCSSValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSCSSValue14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSCSSValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32jsDOMWindowNodeFilterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSNodeFilter14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSNodeFilterConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSNodeFilterPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSNodeFilter15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSNodeFilterConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24jsNodeFilterSHOW_ELEMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsDocumentPrototypeFunctionCreateNodeIteratorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12toNodeFilterEN3JSC7JSValueE
+__ZN7WebCore21JSNodeFilterConditionC1EN3JSC7JSValueE
+__ZN7WebCore21JSNodeFilterConditionC2EN3JSC7JSValueE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12NodeIteratorE
+__ZN7WebCore14JSNodeIterator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSNodeIteratorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NodeIteratorEEE
+__ZN7WebCore14JSNodeIteratorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NodeIteratorEEE
+__ZN7WebCore14JSNodeIterator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsNodeIteratorFilterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10NodeFilterE
+__ZN7WebCore12JSNodeFilterC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10NodeFilterEEE
+__ZN7WebCore12JSNodeFilterC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10NodeFilterEEE
+__ZN7WebCore12JSNodeFilter18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSNodeFilterPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsNodeFilterFILTER_ACCEPTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsNodeFilterFILTER_REJECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsNodeFilterFILTER_SKIPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsNodeFilterSHOW_ALLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsNodeFilterSHOW_ATTRIBUTEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsNodeFilterSHOW_TEXTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsNodeFilterSHOW_CDATA_SECTIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodeFilterSHOW_ENTITY_REFERENCEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsNodeFilterSHOW_ENTITYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsNodeFilterSHOW_PROCESSING_INSTRUCTIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNodeFilterSHOW_COMMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsNodeFilterSHOW_DOCUMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsNodeFilterSHOW_DOCUMENT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsNodeFilterSHOW_DOCUMENT_FRAGMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsNodeFilterSHOW_NOTATIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSNodeFilter4markEv
+__ZN7WebCore21JSNodeFilterCondition4markEv
+__ZN7WebCore14JSNodeIterator4markEv
+__ZN7WebCore27jsDOMWindowAudioConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow5audioEPN3JSC9ExecStateE
+__ZN7WebCore18JSAudioConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore18JSAudioConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore27JSHTMLAudioElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSAudioConstructor4markEv
+__ZN7WebCore12JSNodeFilterD1Ev
+__ZN7WebCore12JSNodeFilterD2Ev
+__ZN7WebCore14JSNodeIteratorD1Ev
+__ZN7WebCore14JSNodeIteratorD2Ev
+__ZN7WebCore21JSNodeFilterConditionD0Ev
+__ZN7WebCore23JSNodeIteratorPrototypeD1Ev
+__ZN7WebCore21JSNodeFilterPrototypeD1Ev
+__ZN7WebCore23JSNodeFilterConstructorD1Ev
+__ZN7WebCore21JSCSSValueConstructorD1Ev
+__ZN7WebCore18JSAudioConstructorD1Ev
+__ZN7WebCore30setJSDOMWindowImageConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMWindowOptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowXMLHttpRequestConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowXMLSerializerConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowDOMParserConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowXSLTProcessorConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSProcessingInstructionDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore10JSRGBColor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZL13jsRGBColorRedPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 __ZL15jsRGBColorGreenPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 __ZL14jsRGBColorBluePN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore20jsCSSValueListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23JSWebKitTransitionEventD0Ev
-__ZN7WebCore10JSRGBColorD0Ev
-__ZN7WebCore24jsNodeFilterSHOW_ELEMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsNodeFilterFILTER_ACCEPTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsNodeFilterFILTER_SKIPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsNodeFilterSHOW_ALLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsNodeFilterFILTER_REJECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12JSTreeWalker3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore26setJSTreeWalkerCurrentNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10TreeWalker14setCurrentNodeEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN7WebCore27jsNodeIteratorReferenceNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40jsNodeIteratorPointerBeforeReferenceNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12JSTreeWalker4markEv
-__ZN7WebCore21JSNodeFilterCondition4markEv
-__ZN7WebCore14JSNodeIterator4markEv
-__ZNK7WebCore11RenderBlock18adjustForBorderFitEiRiS1_
-__ZN7WebCore9RenderBox12maskClipRectEv
-__ZN7WebCore9RenderBox9paintMaskERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore9RenderBox15paintMaskImagesERKNS_12RenderObject9PaintInfoEiiiiii
-__ZN7WebCoreL16titleConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGTitleElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGTitleElement20insertedIntoDocumentEv
-__ZN7WebCore15SVGTitleElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore15SVGTitleElement15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCore8SVGColorC2ERKNS_6StringE
-__ZN7WebCore21SVGDocumentExtensions18addPendingResourceERKNS_12AtomicStringEPNS_16SVGStyledElementE
-__ZNK3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2_EENS8_ISB_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS_18PairFirstExtractorISD_EENS1_10StringHashENS_14PairHashTraitsINS9_IS2_EENS9_ISC_EEEESI_E6expandEv
-__ZNK7WebCore13SVGUseElement7isValidEv
-__ZN7WebCore13SVGUseElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore15StyleStrokeDataeqERKS0_
-__ZN7WebCore13SVGUseElement11recalcStyleENS_4Node11StyleChangeE
-__ZN7WebCoreL15maskConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGMaskElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGMaskElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGMaskElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore14SVGMaskElement7isValidEv
-__ZN7WebCore14SVGMaskElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore18RenderSVGContainerC2EPNS_16SVGStyledElementE
-__ZN7WebCore18RenderSVGContainer16setDrawsContentsEb
-__ZN7WebCore14SVGMaskElement15childrenChangedEbPNS_4NodeES2_i
-__ZNK7WebCore16SVGCircleElement7isValidEv
-__ZN7WebCore10SVGElement16shadowParentNodeEv
-__ZN7WebCore13StyleMaskDataC2ERKS0_
-__ZNK7WebCore13StyleMaskDataeqERKS0_
-__ZN7WebCore18RenderSVGContainer23calculateLocalTransformEv
-__ZNK7WebCore16SVGCircleElement10toPathDataEv
-__ZN7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_11rAttrStringEEEEC1INS_13SVGLengthModeEEEPKS1_RKNS_13QualifiedNameERKT_
-__ZN7WebCore4Path12createCircleERKNS_10FloatPointEf
-__ZN7WebCore14SVGMaskElement14canvasResourceEv
-__ZN7WebCore17SVGResourceMaskerC2EPKNS_14SVGMaskElementE
-__ZNK7WebCore17SVGResourceMasker12resourceTypeEv
-__ZN7WebCore17SVGResourceMasker9applyMaskEPNS_15GraphicsContextERKNS_9FloatRectE
-__ZNK7WebCore14SVGMaskElement17drawMaskerContentERKNS_9FloatRectERS1_
-__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEEE11synchronizeEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_15widthAttrStringEEEE11synchronizeEv
-__ZN7WebCore30clampImageBufferSizeToViewportEPNS_12RenderObjectERNS_7IntSizeE
-__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_26maskContentUnitsAttrStringEEEE11synchronizeEv
-__ZN7WebCore20renderSubtreeToImageEPNS_11ImageBufferEPNS_12RenderObjectE
-__ZN7WebCoreL33applyExpandAlphatoGrayscaleFilterEP7CIImage
-__ZNK7WebCore13SVGSVGElement5isSVGEv
-__ZN7WebCoreL18patternConstructorEPNS_8DocumentEb
-__ZN7WebCore17SVGPatternElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17SVGPatternElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore17SVGPatternElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore17SVGPatternElement7isValidEv
-__ZN7WebCore17SVGPatternElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore17SVGPatternElement15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCore18SVGElementInstance11appendChildEN3WTF10PassRefPtrIS0_EE
-__ZN7WebCore22appendChildToContainerINS_18SVGElementInstanceES1_EEvPT_PT0_
-__ZN7WebCore12SVGTransform8setScaleEff
-__ZN7WebCoreL15descConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGDescElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGDescElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCoreL25radialGradientConstructorEPNS_8DocumentEb
-__ZN7WebCore24SVGRadialGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore24SVGRadialGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore24SVGRadialGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore24SVGRadialGradientElement12gradientTypeEv
-__ZN7WebCore28SVGPaintServerRadialGradientC2EPKNS_18SVGGradientElementE
-__ZThn136_NK7WebCore17SVGPatternElement14contextElementEv
-__ZNK7WebCore17SVGPatternElement14contextElementEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_22SVGPreserveAspectRatioEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZN7WebCore22SVGPreserveAspectRatio24parsePreserveAspectRatioERPKtS2_b
-__ZN7WebCore13SVGUseElement24handleDeepUseReferencingEPS0_PNS_18SVGElementInstanceERb
-__ZNK7WebCore13SVGUseElement38transferUseAttributesToReplacedElementEPNS_10SVGElementES2_
-__ZN7WebCore13SVGUseElement19removedFromDocumentEv
-__ZN7WebCore7DataRefINS_15StyleMarkerDataEE6accessEv
-__ZN7WebCore15StyleMarkerDataC2ERKS0_
-__ZNK7WebCore15StyleMarkerDataeqERKS0_
-__ZNK7WebCore24SVGRadialGradientElement13buildGradientEv
-__ZNK7WebCore24SVGRadialGradientElement25collectGradientPropertiesEv
-__ZN7WebCore28SVGPaintServerRadialGradient17setGradientCenterERKNS_10FloatPointE
-__ZN7WebCore28SVGPaintServerRadialGradient16setGradientFocalERKNS_10FloatPointE
-__ZN7WebCore28SVGPaintServerRadialGradient17setGradientRadiusEf
-__ZN7WebCore18RenderSVGContainerD1Ev
-__ZN7WebCore17SVGPatternElementD1Ev
-__ZN7WebCore14SVGDescElementD1Ev
-__ZN7WebCore24SVGRadialGradientElementD1Ev
-__ZN7WebCore17SVGPatternElement14canvasResourceEv
-__ZN7WebCore21SVGPaintServerPatternC2EPKNS_17SVGPatternElementE
-__ZNK7WebCore21SVGPaintServerPattern5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZNK7WebCore17SVGPatternElement12buildPatternERKNS_9FloatRectE
-__ZNK7WebCore17SVGPatternElement24collectPatternPropertiesEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_15widthAttrStringEEEE11synchronizeEv
-__ZN3WTF7HashSetIPKN7WebCore17SVGPatternElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandEv
-__ZNK7WebCore15SVGFitToViewBox22viewBoxToViewTransformEff
-__ZN7WebCore21SVGPaintServerPattern19setPatternTransformERKNS_20TransformationMatrixE
-__ZN7WebCore21SVGPaintServerPattern20setPatternBoundariesERKNS_9FloatRectE
-__ZN7WebCore21SVGPaintServerPattern7setTileESt8auto_ptrINS_11ImageBufferEE
-__ZNK7WebCore21SVGPaintServerPattern4tileEv
-__ZNK7WebCore21SVGPaintServerPattern17patternBoundariesEv
-__ZNK7WebCore21SVGPaintServerPattern16patternTransformEv
-__ZNK7WebCore21SVGPaintServerPattern8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_22patternUnitsAttrStringEEEE11synchronizeEv
-__ZN7WebCoreL17symbolConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGSymbolElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16SVGSymbolElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn148_NK7WebCore16SVGSymbolElement14contextElementEv
-__ZNK7WebCore16SVGSymbolElement14contextElementEv
-__ZN7WebCore16SVGSymbolElement16rendererIsNeededEPNS_11RenderStyleE
-__ZNK7WebCore13SVGSVGElement7isValidEv
-__ZN7WebCore26RenderSVGViewportContainerC2EPNS_16SVGStyledElementE
-__ZNK7WebCore26RenderSVGViewportContainer17absoluteTransformEv
-__ZNK7WebCore26RenderSVGViewportContainer8viewportEv
-__ZNK7WebCore26RenderSVGViewportContainer17viewportTransformEv
-__ZN7WebCore26RenderSVGViewportContainer6layoutEv
-__ZN7WebCore26RenderSVGViewportContainer12calcViewportEv
-__ZNK7WebCore12RenderObject20containingBlockWidthEv
-__ZNK7WebCore26RenderSVGViewportContainer14isSVGContainerEv
-__ZN7WebCore26RenderSVGViewportContainer5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore26RenderSVGViewportContainer22applyContentTransformsERNS_12RenderObject9PaintInfoE
-__ZN7WebCore26RenderSVGViewportContainer25applyAdditionalTransformsERNS_12RenderObject9PaintInfoE
-__ZNK7WebCore4Font20drawTextUsingSVGFontEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZN7WebCore16SVGTextRunWalkerINS_28SVGTextRunWalkerDrawTextDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
-__ZN7WebCoreL28drawTextUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_28SVGTextRunWalkerDrawTextDataE
-__ZN7WebCoreL15lineConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGLineElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGLineElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGLineElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore14SVGLineElement7isValidEv
-__ZN7WebCoreL23angleToGlyphOrientationEf
-__ZNK7WebCore14SVGLineElement10toPathDataEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x2AttrStringEEEE11synchronizeEv
-__ZN7WebCore4Path10createLineERKNS_10FloatPointES3_
-__ZNK7WebCore22SVGCharacterLayoutInfo11dyValueNextEv
-__ZN7WebCore18PathTraversalState13cubicBezierToERKNS_10FloatPointES3_S3_
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE14shrinkCapacityEm
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_13SVGNumberListEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZN7WebCore13SVGNumberList5parseERKNS_6StringE
-__ZNK7WebCore22SVGCharacterLayoutInfo22baselineShiftValueNextEv
-__ZNK7WebCore22SVGCharacterLayoutInfo14angleValueNextEv
-__ZN7WebCoreL15trefConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGTRefElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGTRefElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn164_NK7WebCore14SVGTRefElement14contextElementEv
-__ZNK7WebCore14SVGTRefElement14contextElementEv
-__ZN7WebCore14SVGTRefElement20updateReferencedTextEv
-__ZN7WebCore14SVGTRefElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore15RenderSVGInlineC2EPNS_4NodeE
-__ZNK7WebCore14SVGTRefElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore13StyleTextDataC1ERKS0_
-__ZNK7WebCore13StyleTextDataeqERKS0_
-__ZNK7WebCore22SVGCharacterLayoutInfo11dxValueNextEv
-__ZN7WebCoreL27cummulatedHeightOfTextChunkERNS_12SVGTextChunkE
-__ZN7WebCore41cummulatedHeightOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
-__ZN7WebCore11PathBuilder15svgCurveToCubicEddddddb
-__ZN7WebCore12SVGTransform8setSkewXEf
-__ZN7WebCore20TransformationMatrix5skewXEd
-__ZN7WebCore20findCharUnicodeRangeEi
-__ZNK7WebCore14SVGLineElement15supportsMarkersEv
-__ZN7WebCore16SVGRootInlineBox37retrievePaintServersForTextDecorationEPNS_12RenderObjectE
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE15reserveCapacityEm
-__ZNK3WTF7HashMapIiPN7WebCore12RenderObjectENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3getERKi
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE6shrinkEm
-__ZN3WTF9HashTableIiSt4pairIiPN7WebCore12RenderObjectEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSB_IS4_EEEESC_EaSERKSF_
-__ZN7WebCore16SVGInlineTextBox15paintDecorationENS_15ETextDecorationEPNS_15GraphicsContextEiiiRKNS_7SVGCharERKNS_21SVGTextDecorationInfoE
-__ZNK3WTF9HashTableIiSt4pairIiPN7WebCore12RenderObjectEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSB_IS4_EEEESC_E8containsIiNS_22IdentityHashTranslatorIiS5_S9_EEEEbRKT_
-__ZNK7WebCore10SVGElement21isStyledTransformableEv
-__ZNK7WebCore12RenderObject12isRenderPathEv
-__ZN7WebCore15GraphicsContext17clipToImageBufferERKNS_9FloatRectEPKNS_11ImageBufferE
-__ZN7WebCore15GraphicsContext17setStrokeGradientEN3WTF10PassRefPtrINS_8GradientEEE
-__ZNK7WebCore12RenderObject12relativeBBoxEb
-__ZN7WebCore21SVGDocumentExtensions11reportErrorERKNS_6StringE
-__ZN7WebCore16ScriptController21createSVGEventHandlerERKNS_6StringES3_PNS_4NodeE
-__ZN7WebCore16SVGScriptElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16SVGScriptElement7setTypeERKNS_6StringE
-__ZN7WebCore16SVGScriptElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore15SVGURIReference16isKnownAttributeERKNS_13QualifiedNameE
-__ZThn160_NK7WebCore16SVGScriptElement13scriptCharsetEv
-__ZNK7WebCore16SVGScriptElement13scriptCharsetEv
-__ZThn160_NK7WebCore16SVGScriptElement21charsetAttributeValueEv
-__ZNK7WebCore16SVGScriptElement21charsetAttributeValueEv
-__ZN7WebCore13SVGZoomAndPan15parseZoomAndPanERPKtS2_
-__ZN7WebCore13SVGZoomAndPan13setZoomAndPanEt
-__ZThn160_N7WebCore16SVGScriptElement17dispatchLoadEventEv
-__ZN7WebCore16SVGScriptElement17dispatchLoadEventEv
-__ZNK7WebCore17JSEventTargetNode21pushEventHandlerScopeEPN3JSC9ExecStateERNS1_10ScopeChainE
-__ZN7WebCoreL24createSVGGElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore13JSSVGGElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore13JSSVGGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGGElementEEE
-__ZN7WebCore13JSSVGGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSSVGGElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore13JSSVGGElement9classInfoEv
-__ZN7WebCoreL26createSVGUseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore15JSSVGUseElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSSVGUseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGUseElementEEE
-__ZN7WebCore15JSSVGUseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSSVGUseElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSSVGUseElement9classInfoEv
-__ZN7WebCoreL30createSVGEllipseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore19JSSVGEllipseElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSSVGEllipseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGEllipseElementEEE
-__ZN7WebCore19JSSVGEllipseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSSVGEllipseElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSSVGEllipseElement9classInfoEv
-__ZN7WebCoreL30shadowTreeContainsChangedNodesEPNS_18SVGElementInstanceE
-__ZN7WebCore4Path22createRoundedRectangleERKNS_9FloatRectERKNS_9FloatSizeE
-__ZN7WebCoreL27createSVGLineElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore16JSSVGLineElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSSVGLineElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGLineElementEEE
-__ZN7WebCore16JSSVGLineElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGLineElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSSVGLineElement9classInfoEv
-__ZN7WebCoreL27createSVGDefsElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore16JSSVGDefsElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSSVGDefsElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDefsElementEEE
-__ZN7WebCoreL29createSVGSymbolElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore18JSSVGSymbolElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSSVGSymbolElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGSymbolElementEEE
-__ZN7WebCore18JSSVGSymbolElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSSVGSymbolElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSSVGSymbolElement9classInfoEv
-__ZN7WebCore16JSSVGDefsElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGDefsElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSSVGDefsElement9classInfoEv
-__ZN7WebCoreL12aConstructorEPNS_8DocumentEb
-__ZN7WebCore11SVGAElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore11SVGAElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore11SVGAElement14contextElementEv
-__ZN7WebCore11SVGAElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore11SVGAElement7isValidEv
-__ZN7WebCore11SVGAElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore10SVGElement13isTextContentEv
-__ZNK7WebCore11SVGAElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCoreL37createSVGLinearGradientElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore26JSSVGLinearGradientElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore26JSSVGLinearGradientElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGLinearGradientElementEEE
-__ZN7WebCore20JSSVGGradientElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGGradientElementEEE
-__ZN7WebCore26JSSVGLinearGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSSVGGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSSVGGradientElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSSVGLinearGradientElement9classInfoEv
-__ZN7WebCoreL27createSVGStopElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore16JSSVGStopElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSSVGStopElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGStopElementEEE
-__ZN7WebCore16JSSVGStopElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGStopElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSSVGStopElement9classInfoEv
-__ZN7WebCore18SVGElementInstance13forgetWrapperEv
-__ZN7WebCore12GCController17garbageCollectNowEv
-__ZN7WebCore13JSSVGGElementD0Ev
-__ZN7WebCore16JSSVGStopElementD0Ev
-__ZN7WebCore18JSSVGSymbolElementD0Ev
-__ZN7WebCore16JSSVGDefsElementD0Ev
-__ZN7WebCore26RenderSVGViewportContainerD1Ev
-__ZN7WebCore13RenderSVGRoot14calcPrefWidthsEv
-__ZNK7WebCore13RenderSVGRoot10lineHeightEbb
-__ZNK7WebCore13RenderSVGRoot16baselinePositionEbb
-__ZN7WebCore13RenderSVGRoot8positionEPNS_9InlineBoxE
-__ZNK7WebCore18RenderSVGContainer23outlineBoundsForRepaintEPNS_9RenderBoxE
-__ZN7WebCore40jsSVGTextElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore14SVGTextElement7getBBoxEv
-__ZN7WebCore12SVGLocatable7getBBoxEPKNS_10SVGElementE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9FloatRectEEEPNS_10SVGElementE
-__ZN7WebCore9JSSVGRect15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore9JSSVGRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9FloatRectEEEEEPNS_10SVGElementE
-__ZN7WebCore9JSSVGRect18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore14jsSVGRectWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEEcvS1_Ev
-__ZN7WebCore25SVGTextPositioningElement16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore21SVGTextContentElement16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore13SVGPathParser12calculateArcEbRdS1_dddddbb
-__ZN7WebCore24parseXMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentEPNS_7ElementE
-__ZN7WebCore12XMLTokenizerC2EPNS_16DocumentFragmentEPNS_7ElementE
-__ZN7WebCore12XMLTokenizerD0Ev
-__ZN7WebCore26jsCSSPrimitiveValueCSS_DEGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore42jsCSSStyleDeclarationPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19JSCSSValuePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSCSSValueListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore8SVGPaint10isSVGPaintEv
-__ZN7WebCore10JSSVGPaintC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGPaintEEE
-__ZN7WebCore10JSSVGColorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGColorEEE
-__ZN7WebCore10JSSVGPaint18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore10JSSVGColor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSSVGPaintPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSSVGColorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore10JSSVGPaint9classInfoEv
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEED1Ev
-__ZN7WebCore10JSSVGPaintD0Ev
-__ZN7WebCore22JSSVGGElementPrototypeD0Ev
-__ZN7WebCore19RenderSVGInlineText14localCaretRectEPNS_9InlineBoxEiPi
-__ZN7WebCore28JSSVGEllipseElementPrototypeD0Ev
-__ZN7WebCore25JSSVGStopElementPrototypeD0Ev
-__ZN7WebCore25JSSVGDefsElementPrototypeD0Ev
-__ZN7WebCore25JSSVGLineElementPrototypeD0Ev
-__ZN7WebCore14RenderSVGImageD1Ev
-__ZN7WebCore27JSSVGSymbolElementPrototypeD0Ev
-__ZN7WebCore18SVGResourceClipper13resetClipDataEv
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14shrinkCapacityEm
-__ZN7WebCore15RenderSVGInlineD1Ev
-__ZN7WebCore14SVGTRefElementD1Ev
-__ZN7WebCoreL29createSVGCircleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore18JSSVGCircleElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSSVGCircleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCircleElementEEE
-__ZN7WebCore18JSSVGCircleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSSVGCircleElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSSVGCircleElement9classInfoEv
-__ZN7WebCoreL14isSVG11FeatureERKNS_6StringE
-__ZN7WebCoreL9addStringERN3WTF7HashSetINS_6StringENS_15CaseFoldingHashENS0_10HashTraitsIS2_EEEEPKc
-__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E4findIS2_NS_22IdentityHashTranslatorIS2_S2_S5_EEEENS_17HashTableIteratorIS2_S2_S4_S5_S7_S7_EERKT_
-__ZN7WebCore18JSHTMLFrameElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore24setJSHTMLFrameElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore18JSHTMLFrameElement6setSrcEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZNK7WebCore18JSHTMLFrameElement9classInfoEv
-__ZN7WebCore21jsSVGRectElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16SVGStyledElement5styleEv
-__ZN7WebCore49jsHTMLEmbedElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore28jsSVGTextContentElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17jsSVGRectElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGRectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11yAttrStringEEEE7baseValEv
-__ZN7WebCore17jsSVGRectElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11xAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_13rectTagStringEEEXadL_ZNS3_11xAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore11JSSVGLength3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore19setJSSVGLengthValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore9SVGLength8setValueEf
-__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEE12commitChangeES1_PNS_10SVGElementE
-__ZN7WebCore55jsSVGTextContentElementPrototypeFunctionSelectSubStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21SVGTextContentElement15selectSubStringEllRi
-__ZN7WebCore23jsSVGSVGElementViewportEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13SVGSVGElement8viewportEv
-__ZN7WebCore9FloatRect15narrowPrecisionEdddd
-__ZN7WebCore10jsSVGRectXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9JSSVGRect3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore13setJSSVGRectXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEE12commitChangeES1_PNS_10SVGElementE
-__ZN7WebCore41jsSVGDocumentPrototypeFunctionCreateEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12SVGZoomEventC1Ev
-__ZNK7WebCore12SVGZoomEvent14isSVGZoomEventEv
-__ZN7WebCore15getDOMStructureINS_14JSSVGZoomEventEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore14JSSVGZoomEvent15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore14JSSVGZoomEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGZoomEventEEEPNS_10SVGElementE
-__ZN7WebCore14JSSVGZoomEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28jsSVGZoomEventZoomRectScreenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12SVGZoomEvent14zoomRectScreenEv
-__ZN7WebCore27jsSVGZoomEventPreviousScaleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12SVGZoomEvent13previousScaleEv
-__ZN7WebCore31jsSVGZoomEventPreviousTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12SVGZoomEvent17previousTranslateEv
-__ZN7WebCore10JSSVGPoint3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore14setJSSVGPointXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_10FloatPointEE12commitChangeES1_PNS_10SVGElementE
-__ZN7WebCore22jsSVGZoomEventNewScaleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12SVGZoomEvent8newScaleEv
-__ZN7WebCore26jsSVGZoomEventNewTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12SVGZoomEvent12newTranslateEv
-__ZN7WebCore49jsHTMLFrameElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore31jsSVGSVGElementCurrentTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35JSSVGStaticPODTypeWrapperWithParentINS_10FloatPointENS_13SVGSVGElementEEcvS1_Ev
-__ZN7WebCore35JSSVGStaticPODTypeWrapperWithParentINS_10FloatPointENS_13SVGSVGElementEE12commitChangeES1_PNS_10SVGElementE
-__ZN7WebCore13SVGSVGElement19setCurrentTranslateERKNS_10FloatPointE
-__ZN7WebCore14setJSSVGPointYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGMatrixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13SVGSVGElement15createSVGMatrixEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_20TransformationMatrixEEEPNS_10SVGElementE
-__ZN7WebCore11JSSVGMatrix15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore11JSSVGMatrixC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_20TransformationMatrixEEEEEPNS_10SVGElementE
-__ZN7WebCore11JSSVGMatrix18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSSVGMatrixPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore44jsSVGMatrixPrototypeFunctionRotateFromVectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore11JSSVGMatrix9classInfoEv
-__ZN7WebCore11JSSVGMatrix16rotateFromVectorEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_20TransformationMatrixEEcvS1_Ev
-__ZN7WebCore20TransformationMatrix16rotateFromVectorEdd
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SVGExceptionEPNS_10SVGElementE
-__ZN7WebCore14JSSVGExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGExceptionEEEPNS_10SVGElementE
-__ZN7WebCore14JSSVGException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSSVGExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore39jsSVGExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore14JSSVGException9classInfoEv
-__ZN7WebCore25jsSVGExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsSVGExceptionSVG_WRONG_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsSVGExceptionSVG_INVALID_VALUE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore39jsSVGExceptionSVG_MATRIX_NOT_INVERTABLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23JSSVGTextContentElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore12JSSVGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCoreL25font_face_nameConstructorEPNS_8DocumentEb
-__ZN7WebCore22SVGFontFaceNameElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN3WTF9HashTableItSt4pairItNS_6RefPtrIN7WebCore12GlyphMapNodeEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsItEENSC_IS5_EEEESD_E4findItNS_22IdentityHashTranslatorItS6_SA_EEEENS_17HashTableIteratorItS6_S8_SA_SF_SD_EERKT_
-__ZN7WebCore18JSSVGCircleElementD0Ev
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_20TransformationMatrixEED1Ev
-__ZN7WebCore50jsSVGSVGElementPrototypeFunctionCreateSVGTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13SVGSVGElement18createSVGTransformEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_12SVGTransformEEEPNS_10SVGElementE
-__ZN7WebCore14JSSVGTransformC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_12SVGTransformEEEEEPNS_10SVGElementE
-__ZN7WebCore14JSSVGTransform18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20jsSVGTransformMatrixEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEEcvS1_Ev
-__ZN7WebCore12jsSVGMatrixAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore11JSSVGMatrix3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore15setJSSVGMatrixAEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore42JSSVGStaticPODTypeWrapperWithPODTypeParentINS_20TransformationMatrixENS_12SVGTransformEE12commitChangeES1_PNS_10SVGElementE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEE12commitChangeES1_PNS_10SVGElementE
-__ZN7WebCore8SVGPaintC1ERKNS_6StringERKNS_5ColorE
-__ZN7WebCoreL30createSVGPatternElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore19JSSVGPatternElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSSVGPatternElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPatternElementEEE
-__ZN7WebCore19JSSVGPatternElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSSVGPatternElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSSVGPatternElement9classInfoEv
-__ZN7WebCoreL23dominantBaselineToShiftEbPKNS_12RenderObjectERKNS_4FontE
-__ZN7WebCore9CSSParser23parseSVGStrokeDasharrayEv
-__ZN7WebCoreL17markerConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGMarkerElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore8SVGAngleC2Ev
-__ZN7WebCore16SVGMarkerElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16SVGMarkerElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZThn148_NK7WebCore16SVGMarkerElement14contextElementEv
-__ZNK7WebCore16SVGMarkerElement14contextElementEv
-__ZN7WebCore16SVGMarkerElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16SVGMarkerElement15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCore43jsElementPrototypeFunctionRemoveAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Element17removeAttributeNSERKNS_6StringES3_Ri
-__ZN7WebCoreL29createSVGMarkerElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore18JSSVGMarkerElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGMarkerElementEEE
-__ZN7WebCore18JSSVGMarkerElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSSVGMarkerElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSSVGMarkerElement9classInfoEv
-__ZNK7WebCore18SVGGradientElement14contextElementEv
-__ZN7WebCore21jsSVGStopElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15SVGFitToViewBox16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore27jsSVGUseElementInstanceRootEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13SVGUseElement12instanceRootEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_18SVGElementInstanceE
-__ZN7WebCore20JSSVGElementInstance15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore20JSSVGElementInstanceC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGElementInstanceEEE
-__ZN7WebCore20JSSVGElementInstance18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore40jsSVGElementInstanceCorrespondingElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21SVGDocumentExtensions13reportWarningERKNS_6StringE
-__ZN7WebCore18SVGElementInstance14setNeedsUpdateEb
-__ZN7WebCore19JSSVGPatternElementD0Ev
-__ZN7WebCore20JSSVGElementInstanceD0Ev
-__ZN7WebCore18JSSVGMarkerElementD0Ev
-__ZN7WebCore21SVGDocumentExtensions21removePendingResourceERKNS_12AtomicStringE
-__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS_18PairFirstExtractorISD_EENS1_10StringHashENS_14PairHashTraitsINS9_IS2_EENS9_ISC_EEEESI_E4findIS2_NS_22IdentityHashTranslatorIS2_SD_SG_EEEENS_17HashTableIteratorIS2_SD_SF_SG_SK_SI_EERKT_
-__ZN7WebCore11SVGResource17invalidateClientsEN3WTF7HashSetIPNS_16SVGStyledElementENS1_7PtrHashIS4_EENS1_10HashTraitsIS4_EEEE
-__ZN7WebCoreL19polylineConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGPolylineElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGPolyElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17SVGAnimatedPointsC2Ev
-__ZN7WebCore14SVGPolyElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGPolyElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore14SVGPolyElement6pointsEv
-__ZN7WebCore12SVGPointListC2ERKNS_13QualifiedNameE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14shrinkCapacityEm
-__ZN7WebCore21pointsListFromSVGDataEPNS_12SVGPointListERKNS_6StringE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEmPKS6_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE15reserveCapacityEm
-__ZNK7WebCore14SVGPolyElement7isValidEv
-__ZN7WebCore14SVGPolyElement16rendererIsNeededEPNS_11RenderStyleE
-__ZNK7WebCore18SVGPolylineElement10toPathDataEv
-__ZN7WebCoreL24foreignObjectConstructorEPNS_8DocumentEb
-__ZN7WebCore23SVGForeignObjectElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore23SVGForeignObjectElement7isValidEv
-__ZN7WebCore23SVGForeignObjectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore19RenderForeignObjectC1EPNS_23SVGForeignObjectElementE
-__ZNK7WebCore19RenderForeignObject13requiresLayerEv
-__ZNK7WebCore23SVGForeignObjectElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore24jsSVGDocumentRootElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore57jsSVGRectElementPrototypeFunctionGetPresentationAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore16SVGStyledElement24getPresentationAttributeERKNS_6StringE
-__ZN7WebCore38jsSVGColorPrototypeFunctionSetRGBColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19RenderForeignObject21computeRectForRepaintEPNS_9RenderBoxERNS_7IntRectEb
-__ZNK7WebCore19RenderForeignObject14localTransformEv
-__ZN7WebCore19RenderForeignObject24translationForAttributesEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_23SVGForeignObjectElementENS_9SVGLengthEXadL_ZNS_8SVGNames22foreignObjectTagStringEEEXadL_ZNS3_11xAttrStringEEEE11synchronizeEv
-__ZN7WebCore19RenderForeignObject6layoutEv
-__ZN7WebCore19RenderForeignObject23calculateLocalTransformEv
-__ZN7WebCoreL28createSVGTitleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore17JSSVGTitleElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSSVGTitleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTitleElementEEE
-__ZN7WebCore17JSSVGTitleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSSVGTitleElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSSVGTitleElement9classInfoEv
-__ZN7WebCore21RenderSVGGradientStop29clippedOverflowRectForRepaintEPNS_9RenderBoxE
-__ZN7WebCore31jsSVGAngleSVG_ANGLETYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsSVGAngleSVG_ANGLETYPE_UNSPECIFIEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsSVGAngleSVG_ANGLETYPE_DEGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsSVGAngleSVG_ANGLETYPE_RADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGAngleSVG_ANGLETYPE_GRADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore31jsSVGColorSVG_COLORTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsSVGColorSVG_COLORTYPE_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore36jsSVGColorSVG_COLORTYPE_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40jsSVGGradientElementSVG_SPREADMETHOD_PADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44jsSVGGradientElementSVG_SPREADMETHOD_REFLECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore43jsSVGGradientElementSVG_SPREADMETHOD_REPEATEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsSVGLengthSVG_LENGTHTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore36jsSVGLengthSVG_LENGTHTYPE_PERCENTAGEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsSVGLengthSVG_LENGTHTYPE_EMSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsSVGLengthSVG_LENGTHTYPE_EXSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_CMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_MMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_INEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore48jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore45jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore43jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40jsSVGMarkerElementSVG_MARKER_ORIENT_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore31jsSVGPaintSVG_PAINTTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsSVGPaintSVG_PAINTTYPE_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGPaintSVG_PAINTTYPE_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore36jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsSVGPaintSVG_PAINTTYPE_URI_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore36jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore45jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsSVGPaintSVG_PAINTTYPE_URIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsSVGPathSegPATHSEG_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsSVGPathSegPATHSEG_CLOSEPATHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsSVGPathSegPATHSEG_MOVETO_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsSVGPathSegPATHSEG_MOVETO_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsSVGPathSegPATHSEG_LINETO_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsSVGPathSegPATHSEG_LINETO_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore37jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore37jsSVGPathSegPATHSEG_CURVETO_CUBIC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsSVGPathSegPATHSEG_ARC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsSVGPathSegPATHSEG_ARC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore39jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore39jsSVGPathSegPATHSEG_LINETO_VERTICAL_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore48jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore48jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore55jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore52jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore47jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEETEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore45jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore44jsSVGRenderingIntentRENDERING_INTENT_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsSVGRenderingIntentRENDERING_INTENT_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore47jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore58jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore47jsSVGRenderingIntentRENDERING_INTENT_SATURATIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore58jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore43jsSVGTextContentElementLENGTHADJUST_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore43jsSVGTextContentElementLENGTHADJUST_SPACINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore52jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore47jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore45jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore47jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore48jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore45jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore46jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsSVGTransformSVG_TRANSFORM_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsSVGTransformSVG_TRANSFORM_MATRIXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore37jsSVGTransformSVG_TRANSFORM_TRANSLATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SCALEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsSVGTransformSVG_TRANSFORM_ROTATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SKEWXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SKEWYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore42jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore45jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsSVGSVGElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsSVGSVGElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19synchronizePropertyINS_13SVGSVGElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
-__ZN7WebCore46jsSVGSVGElementPrototypeFunctionCreateSVGPointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13SVGSVGElement14createSVGPointEv
-__ZN7WebCore45jsSVGTextElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore14SVGTextElement12getScreenCTMEv
-__ZNK7WebCore16SVGTransformable12getScreenCTMEPKNS_10SVGElementE
-__ZN7WebCore12SVGLocatable12getScreenCTMEPKNS_10SVGElementE
-__ZNK7WebCore25SVGStyledLocatableElement17isStyledLocatableEv
-__ZNK7WebCore13SVGSVGElement12getScreenCTMEv
-__ZNK7WebCore25SVGStyledLocatableElement12getScreenCTMEv
-__ZThn360_NK7WebCore14SVGTextElement22animatedLocalTransformEv
-__ZN7WebCore19JSSVGPointPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore35jsSVGMatrixPrototypeFunctionInverseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore11JSSVGMatrix7inverseEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore42jsSVGPointPrototypeFunctionMatrixTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore10JSSVGPoint9classInfoEv
-__ZN7WebCore11toSVGMatrixEN3JSC10JSValuePtrE
-__ZNK7WebCore10FloatPoint15matrixTransformERKNS_20TransformationMatrixE
-__ZN7WebCore47jsSVGPathElementPrototypeFunctionGetTotalLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement14getTotalLengthEv
-__ZN7WebCore18PathTraversalState12closeSubpathEv
-__ZN7WebCore19jsSVGUseElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_15SVGURIReferenceENS_6StringEXadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkNames14hrefAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_NS_10SVGElementES2_S2_XadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS3_14hrefAttrStringEEEEES5_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_6StringEEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS6_EEE3setERKS2_RKS6_
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGURIReferenceENS_10SVGElementENS_6StringES3_XadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkNames14hrefAttrStringEEEED0Ev
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateINS_6StringEEEPNS_10SVGElementE
-__ZN7WebCore19JSSVGAnimatedString15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSSVGAnimatedStringC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_6StringEEEEEPNS_10SVGElementE
-__ZN7WebCore19JSSVGAnimatedString3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore29setJSSVGAnimatedStringBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16jsSVGUseElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_15widthAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_12useTagStringEEEXadL_ZNS3_15widthAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_13SVGUseElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_15widthAttrStringEEEE7baseValEv
-__ZN7WebCore19JSSVGAnimatedStringD0Ev
-__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEEENS_18PairFirstExtractorIS9_EENS1_29SVGAnimatedTypeWrapperKeyHashENS_14PairHashTraitsINS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS8_EEEESE_E4findIS2_NS_22IdentityHashTranslatorIS2_S9_SC_EEEENS_17HashTableIteratorIS2_S9_SB_SC_SH_SE_EERKT_
-__ZN7WebCore16jsSVGUseElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore45jsSVGSVGElementPrototypeFunctionCreateSVGRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13SVGSVGElement13createSVGRectEv
-__ZN7WebCore10jsSVGRectYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15jsSVGRectHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13setJSSVGRectYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17setJSSVGRectWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore18setJSSVGRectHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23SVGForeignObjectElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore23SVGForeignObjectElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore12SVGTransform8setSkewYEf
-__ZN7WebCore20TransformationMatrix5skewYEd
-__ZN7WebCoreL27createSVGMaskElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore16JSSVGMaskElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSSVGMaskElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGMaskElementEEE
-__ZN7WebCore16JSSVGMaskElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17SVGResourceMasker10invalidateEv
-__ZN7WebCoreL18animateConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGSMILElement21finishParsingChildrenEv
-__ZN7WebCore14SVGSMILElement16parseOffsetValueERKNS_6StringE
-__ZNK7WebCore19SVGAnimationElement13animationPathEv
-__ZNK7WebCore19SVGAnimationElement8calcModeEv
-__ZNK7WebCore19SVGAnimationElement31currentValuesForValuesAnimationEfRfRNS_6StringES3_
-__ZNK7WebCore21SVGPathSegSingleCoord8toStringEv
-__ZNK7WebCore19SVGPathSegMovetoAbs19pathSegTypeAsLetterEv
-__ZNK7WebCore19SVGPathSegLinetoAbs19pathSegTypeAsLetterEv
-__ZNK7WebCore22SVGPathSegCurvetoCubic8toStringEv
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs19pathSegTypeAsLetterEv
-__ZN7WebCore13SVGUseElement35removeDisallowedElementsFromSubtreeEPNS_4NodeE
-__ZN7WebCore23SVGForeignObjectElementD1Ev
-__ZN7WebCore25JSSVGMaskElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSSVGMaskElement9classInfoEv
-__ZNK7WebCore22SVGFontFaceNameElement8srcValueEv
-__ZN7WebCore49jsSVGPathElementPrototypeFunctionGetPointAtLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement16getPointAtLengthEf
-__ZN7WebCoreL19metadataConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGMetadataElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL31createSVGMetadataElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore20JSSVGMetadataElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore20JSSVGMetadataElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGMetadataElementEEE
-__ZNK7WebCore20JSSVGMetadataElement9classInfoEv
-__ZNK7WebCore8SVGTests18requiredExtensionsEv
-__ZN7WebCore13SVGStringListC2ERKNS_13QualifiedNameE
-__ZN7WebCore13SVGStringList5resetERKNS_6StringE
-__ZN7WebCore13SVGStringList5parseERKNS_6StringEt
-__ZN7WebCore13SVGUseElement24alterShadowTreeForSVGTagEPNS_10SVGElementE
-__ZNK7WebCore19JSLazyEventListener20wasCreatedFromMarkupEv
-__ZN7WebCore29JSSVGElementInstancePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20JSSVGElementInstance9classInfoEv
-__ZN7WebCore43jsSVGElementInstanceCorrespondingUseElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore53jsSVGElementInstancePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore20JSSVGElementInstance16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZNK7WebCore18SVGElementInstance22scriptExecutionContextEv
-__ZN7WebCore18SVGElementInstance16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCore20JSSVGMetadataElementD0Ev
-__ZNK7WebCore13EventListener20wasCreatedFromMarkupEv
-__ZN7WebCore45jsSVGRectElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore29SVGStyledTransformableElement12getScreenCTMEv
-__ZThn136_NK7WebCore29SVGStyledTransformableElement22animatedLocalTransformEv
-__ZN7WebCore12jsSVGMatrixBEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12jsSVGMatrixCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12jsSVGMatrixDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12jsSVGMatrixEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12jsSVGMatrixFEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore38jsSVGSVGElementPrototypeFunctionGetCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore13SVGSVGElement6getCTMEv
-__ZN7WebCore44jsSVGSVGElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCoreL28createSVGImageElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore17JSSVGImageElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSSVGImageElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGImageElementEEE
-__ZN7WebCore17JSSVGImageElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore14SVGSMILElement19resolveNextIntervalEv
-__ZN7WebCore19SVGAnimationElement19endedActiveIntervalEv
-__ZN7WebCore54jsSVGTextElementPrototypeFunctionGetTransformToElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12toSVGElementEN3JSC10JSValuePtrE
-__ZNK7WebCore12SVGLocatable21getTransformToElementEPNS_10SVGElementERi
-__ZTv0_n28_NK7WebCore14SVGTextElement6getCTMEv
-__ZNK7WebCore14SVGTextElement6getCTMEv
-__ZNK7WebCore16SVGTransformable6getCTMEPKNS_10SVGElementE
-__ZN7WebCore12SVGLocatable6getCTMEPKNS_10SVGElementE
-__ZNK7WebCore29SVGStyledTransformableElement6getCTMEv
-__ZN7WebCore20TransformationMatrixmLERKS0_
-__ZN7WebCore39jsSVGTextElementPrototypeFunctionGetCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCoreL31createSVGPolylineElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore20JSSVGPolylineElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore20JSSVGPolylineElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGPolylineElementEEE
-__ZN7WebCore20JSSVGPolylineElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSSVGPolylineElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20JSSVGPolylineElement9classInfoEv
-__ZN7WebCore18jsSVGExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE6shrinkEm
-__ZN7WebCore26jsSVGPolylineElementPointsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SVGPointListEPNS_10SVGElementE
-__ZN7WebCore14JSSVGPointList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore14JSSVGPointListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGPointListEEEPNS_10SVGElementE
-__ZN7WebCore14JSSVGPointList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSSVGPointListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore41jsSVGPointListPrototypeFunctionAppendItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore14JSSVGPointList9classInfoEv
-__ZN7WebCore14JSSVGPointList10appendItemEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore10toSVGPointEN3JSC10JSValuePtrE
-__ZN7WebCoreL12finishSetterEPN3JSC9ExecStateERiPNS_10SVGElementEPNS_12SVGPointListEN3WTF10PassRefPtrINS_14SVGPODListItemINS_10FloatPointEEEEE
-__ZNK7WebCore14SVGPolyElement26updateAnimatedSVGAttributeERKNS_6StringE
-__ZN7WebCore19synchronizePropertyINS_14SVGPolyElementEPNS_12SVGPointListEEEvPKT_RKNS_13QualifiedNameET0_
-__ZNK7WebCore12SVGPointList13valueAsStringEv
-__ZN7WebCore17JSSVGImageElementD0Ev
-__ZN7WebCore14JSSVGExceptionD0Ev
-__ZN7WebCore14JSSVGPointListD0Ev
-__ZN7WebCore26JSSVGImageElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSSVGImageElement9classInfoEv
-__ZN7WebCoreL18polygonConstructorEPNS_8DocumentEb
-__ZN7WebCore17SVGPolygonElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL30createSVGPolygonElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore19JSSVGPolygonElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore19JSSVGPolygonElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPolygonElementEEE
-__ZN7WebCore19JSSVGPolygonElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSSVGPolygonElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSSVGPolygonElement9classInfoEv
-__ZN7WebCore16jsSVGSVGElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrStringEEEE7baseValEv
-__ZN7WebCoreL31createSVGClipPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore20JSSVGClipPathElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore20JSSVGClipPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGClipPathElementEEE
-__ZN7WebCore20JSSVGClipPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSSVGClipPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20JSSVGClipPathElement9classInfoEv
-__ZN7WebCoreL26ignorableWhitespaceHandlerEPvPKhi
-__ZNK7WebCore17SVGPolygonElement10toPathDataEv
-__ZN7WebCore17SVGPolygonElementD1Ev
-__ZN7WebCore17SVGAnimatedPointsD0Ev
-__ZN7WebCore18SVGPolylineElementD1Ev
-__ZN7WebCore15JSSVGSVGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore17setJSSVGElementIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10SVGElement5setIdERKNS_6StringERi
-__ZN7WebCore13JSSVGGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore16JSSVGRectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore22jsSVGRectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15JSSVGUseElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCoreL28createSVGStyleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore17JSSVGStyleElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore17JSSVGStyleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGStyleElementEEE
-__ZN7WebCore17JSSVGStyleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSSVGStyleElement9classInfoEv
-__ZN7WebCore15SVGStyleElement19removedFromDocumentEv
-__ZN7WebCore25jsSVGRectElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_16SVGStyledElementENS_6StringEXadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLNames15classAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS3_15classAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGStyledElementES1_NS_6StringES2_XadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLNames15classAttrStringEEEED0Ev
-__ZN7WebCore19synchronizePropertyINS_16SVGStyledElementENS_6StringEEEvPKT_RKNS_13QualifiedNameET0_
-__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGNumberEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13SVGSVGElement15createSVGNumberEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperIfEEPNS_10SVGElementE
-__ZN7WebCore11JSSVGNumber15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore11JSSVGNumberC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperIfEEEEPNS_10SVGElementE
-__ZN7WebCore11JSSVGNumber18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16jsSVGNumberValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperIfEcvfEv
-__ZN7WebCore11JSSVGNumber3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore19setJSSVGNumberValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperIfE12commitChangeEfPNS_10SVGElementE
-__ZN7WebCore37jsSVGGElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore29SVGStyledTransformableElement7getBBoxEv
-__ZN7WebCore41jsSVGImageElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore40jsSVGRectElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore37jsSVGMatrixPrototypeFunctionTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCoreL27createSVGTRefElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore16JSSVGTRefElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSSVGTRefElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTRefElementEEE
-__ZN7WebCore16JSSVGTRefElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSSVGTRefElement9classInfoEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_8SVGAngleEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZN7WebCore8SVGAngleD1Ev
-__ZN7WebCore15SVGGlyphElement19removedFromDocumentEv
-__ZN7WebCore16jsSVGSVGElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_12svgTagStringEEEXadL_ZNS3_15widthAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperIfED1Ev
-__ZN7WebCore17JSSVGStyleElementD0Ev
-__ZN7WebCore28jsSVGTextPositioningElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS7_EEE3setERKS2_RKS7_
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_25SVGTextPositioningElementES1_NS_13SVGLengthListEPS2_XadL_ZNS_35SVGTextPositioningElementIdentifierEEEXadL_ZNS_8SVGNames11xAttrStringEEEE10setBaseValES3_
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_13SVGLengthListEEEPNS_10SVGElementE
-__ZN7WebCore23JSSVGAnimatedLengthList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore23JSSVGAnimatedLengthListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_13SVGLengthListEEEEEPNS_10SVGElementE
-__ZN7WebCore23JSSVGAnimatedLengthList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30jsSVGAnimatedLengthListBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13SVGLengthListEPNS_10SVGElementE
-__ZN7WebCore15JSSVGLengthList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore15JSSVGLengthListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGLengthListEEEPNS_10SVGElementE
-__ZN7WebCore15JSSVGLengthList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28jsSVGLengthListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore8SVGPaintC1Ev
-__ZN7WebCore15JSSVGLengthListD0Ev
-__ZN7WebCore23JSSVGAnimatedLengthListD0Ev
-__ZN7WebCore60jsSVGTextContentElementPrototypeFunctionGetCharNumAtPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21SVGTextContentElement20getCharNumAtPositionERKNS_10FloatPointE
-__ZNK7WebCore16SVGInlineTextBox26closestCharacterToPositionEiiRi
-__ZN7WebCore18SVGTextChunkWalkerINS_48SVGInlineTextBoxClosestCharacterToPositionWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGCharESB_
-__ZN7WebCore48SVGInlineTextBoxClosestCharacterToPositionWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGCharES9_
-__ZN7WebCore55jsSVGTextContentElementPrototypeFunctionGetExtentOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore21SVGTextContentElement15getExtentOfCharElRi
-__ZN7WebCore19RenderSVGInlineText13selectionRectEb
-__ZNK7WebCore12RenderObject20isSVGHiddenContainerEv
-__ZN7WebCore19RenderSVGInlineText27computeAbsoluteRectForRangeEii
-__ZN7WebCore17findSVGRootObjectEPNS_12RenderObjectE
-__ZNK7WebCore12RenderObject14localTransformEv
-__ZN7WebCore33jsSVGTextContentElementTextLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_21SVGTextContentElementENS_9SVGLengthEXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_8SVGNames20textLengthAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS3_20textLengthAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_21SVGTextContentElementES1_NS_9SVGLengthES2_XadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_8SVGNames20textLengthAttrStringEEEED1Ev
-__ZN7WebCore35jsSVGTextContentElementLengthAdjustEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_21SVGTextContentElementEiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_8SVGNames22lengthAdjustAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_iiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS2_22lengthAdjustAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_21SVGTextContentElementES1_iiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_8SVGNames22lengthAdjustAttrStringEEEED0Ev
-__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIiEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS5_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIiEEENS_18PairFirstExtractorIS7_EENS1_29SVGAnimatedTypeWrapperKeyHashENS_14PairHashTraitsINS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS6_EEEESC_E6expandEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIiEEPNS_10SVGElementE
-__ZN7WebCore24JSSVGAnimatedEnumeration15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore24JSSVGAnimatedEnumerationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIiEEEEPNS_10SVGElementE
-__ZN7WebCore24JSSVGAnimatedEnumeration18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31jsSVGAnimatedEnumerationBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore31jsSVGAnimatedEnumerationAnimValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGPolygonElementTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_29SVGStyledTransformableElementENS_16SVGTransformListEXadL_ZNS_39SVGStyledTransformableElementIdentifierEEEXadL_ZNS_8SVGNames19transformAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_PS2_XadL_ZNS_39SVGStyledTransformableElementIdentifierEEEXadL_ZNS3_19transformAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_16SVGTransformListEEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS7_EEE3setERKS2_RKS7_
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_29SVGStyledTransformableElementES1_NS_16SVGTransformListEPS2_XadL_ZNS_39SVGStyledTransformableElementIdentifierEEEXadL_ZNS_8SVGNames19transformAttrStringEEEED1Ev
-__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEEENS_18PairFirstExtractorIS9_EENS1_29SVGAnimatedTypeWrapperKeyHashENS_14PairHashTraitsINS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS8_EEEESE_E6expandEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_16SVGTransformListEEEPNS_10SVGElementE
-__ZN7WebCore26JSSVGAnimatedTransformList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore26JSSVGAnimatedTransformListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_16SVGTransformListEEEEEPNS_10SVGElementE
-__ZN7WebCore26JSSVGAnimatedTransformList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33jsSVGAnimatedTransformListBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_16SVGTransformListEPNS_10SVGElementE
-__ZN7WebCore18JSSVGTransformList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSSVGTransformListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGTransformListEEEPNS_10SVGElementE
-__ZN7WebCore18JSSVGTransformList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSSVGTransformListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsSVGTransformListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore18JSSVGTransformList9classInfoEv
-__ZN7WebCore18JSSVGTransformList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore23JSSVGTransformPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsSVGTransformPrototypeFunctionSetTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore14JSSVGTransform9classInfoEv
-__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_12SVGTransformEEcvS1_Ev
-__ZNK7WebCore14SVGPODListItemINS_12SVGTransformEE5valueEv
-__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_12SVGTransformEE12commitChangeES1_PNS_10SVGElementE
-__ZN7WebCore14SVGPODListItemINS_12SVGTransformEE8setValueES1_
-__ZN7WebCore45jsSVGTransformListPrototypeFunctionAppendItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore18JSSVGTransformList10appendItemEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore14toSVGTransformEN3JSC10JSValuePtrE
-__ZN7WebCoreL12finishSetterEPN3JSC9ExecStateERiPNS_10SVGElementEPNS_16SVGTransformListEN3WTF10PassRefPtrINS_14SVGPODListItemINS_12SVGTransformEEEEE
-__ZN7WebCore14JSSVGTransformD0Ev
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEED1Ev
-__ZN7WebCore18JSSVGTransformListD0Ev
-__ZN7WebCore26JSSVGAnimatedTransformListD0Ev
-__ZN7WebCore24JSSVGAnimatedEnumerationD0Ev
-__ZNK7WebCore10RenderPath14strokeContainsERKNS_10FloatPointEb
-__ZNK7WebCore4Path14strokeContainsEPNS_18StrokeStyleApplierERKNS_10FloatPointE
-__ZNK3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8containsIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEEbRKT_
-__ZN7WebCore13RenderSVGText13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEiib
-__ZN7WebCore15GraphicsContext18setShouldAntialiasEb
-__ZN7WebCore15GraphicsContext26setPlatformShouldAntialiasEb
-__ZN7WebCore16SVGMarkerElement14canvasResourceEv
-__ZN7WebCore17SVGResourceMarkerC2Ev
-__ZN7WebCore17SVGResourceMarker9setMarkerEPNS_26RenderSVGViewportContainerE
-__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementEiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_27SVGOrientTypeAttrIdentifierEEEE11synchronizeEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementENS_8SVGAngleEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_28SVGOrientAngleAttrIdentifierEEEE11synchronizeEv
-__ZNK7WebCore8SVGAngle5valueEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_21markerWidthAttrStringEEEE11synchronizeEv
-__ZN7WebCore17SVGResourceMarker6setRefEdd
-__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementEiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS2_21markerUnitsAttrStringEEEE11synchronizeEv
-__ZNK7WebCore17SVGResourceMarker12resourceTypeEv
-__ZN7WebCore15DrawMarkersDataC2EPNS_15GraphicsContextEPNS_17SVGResourceMarkerES4_d
-__ZN7WebCoreL22drawStartAndMidMarkersEPvPKNS_11PathElementE
-__ZN7WebCoreL18drawMarkerWithDataEPNS_15GraphicsContextERNS_10MarkerDataE
-__ZN7WebCore17SVGResourceMarker4drawEPNS_15GraphicsContextERKNS_9FloatRectEdddd
-__ZNK3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEEbRKT_
-__ZN3WTF7HashSetIPN7WebCore17SVGResourceMarkerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZNK7WebCore17SVGResourceMarker12cachedBoundsEv
-__ZNK3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8containsIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEEbRKT_
-__ZNK7WebCore14SVGPolyElement15supportsMarkersEv
-__ZN7WebCore19RenderForeignObject5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore12RenderObject5paintERNS0_9PaintInfoEii
-__ZNK7WebCore19SVGAnimatedPropertyINS_18SVGGradientElementEiXadL_ZNS_28SVGGradientElementIdentifierEEEXadL_ZNS_8SVGNames22spreadMethodAttrStringEEEE11synchronizeEv
-__ZN7WebCore19SVGAnimatedPropertyINS_24SVGRadialGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23radialGradientTagStringEEEXadL_ZNS3_11rAttrStringEEEEC1INS_13SVGLengthModeEA4_cEEPKS1_RKNS_13QualifiedNameERKT_RKT0_
-__ZN7WebCore10RenderPath17addFocusRingRectsEPNS_15GraphicsContextEii
-__ZN7WebCore18RenderSVGContainer17addFocusRingRectsEPNS_15GraphicsContextEii
-__ZN7WebCore16SVGInlineTextBox14paintSelectionEiRKNS_7SVGCharEPKtiPNS_15GraphicsContextEPNS_11RenderStyleERKNS_4FontE
-__ZN7WebCore16SVGMarkerElementD1Ev
-__ZN7WebCore29JSSVGMetadataElementPrototypeD0Ev
-__ZN7WebCore22SVGFontFaceNameElementD1Ev
-__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE14shrinkCapacityEm
-__ZN7WebCore16SVGScriptElement19removedFromDocumentEv
-__ZN7WebCore26JSSVGImageElementPrototypeD0Ev
-__ZN7WebCore32JSSVGAnimatedLengthListPrototypeD0Ev
-__ZN7WebCore25JSSVGMaskElementPrototypeD0Ev
-__ZN7WebCore35JSSVGAnimatedTransformListPrototypeD0Ev
-__ZN7WebCore28JSSVGPolygonElementPrototypeD0Ev
-__ZN7WebCore26JSSVGTitleElementPrototypeD0Ev
-__ZN7WebCore29JSSVGPolylineElementPrototypeD0Ev
-__ZN7WebCore33JSSVGAnimatedEnumerationPrototypeD0Ev
-__ZN7WebCore25JSSVGTRefElementPrototypeD0Ev
-__ZN7WebCore23JSSVGZoomEventPrototypeD0Ev
-__ZN7WebCore27jsSVGPointListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore38jsSVGPointListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14JSSVGPointList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_10FloatPointEEcvS1_Ev
-__ZNK7WebCore14SVGPODListItemINS_10FloatPointEE5valueEv
-__ZNK7WebCore13HTMLTokenizer10lineNumberEv
-__ZN7WebCore36jsSVGImageElementPreserveAspectRatioEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_22SVGPreserveAspectRatioEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_29preserveAspectRatioAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_PS2_XadL_ZNS3_14imageTagStringEEEXadL_ZNS3_29preserveAspectRatioAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_22SVGPreserveAspectRatioEEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS7_EEE3setERKS2_RKS7_
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGImageElementES1_NS_22SVGPreserveAspectRatioEPS2_XadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS4_29preserveAspectRatioAttrStringEEEED1Ev
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_22SVGPreserveAspectRatioEEEPNS_10SVGElementE
-__ZN7WebCore32JSSVGAnimatedPreserveAspectRatio15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_22SVGPreserveAspectRatioEEEEEPNS_10SVGElementE
-__ZN7WebCore32JSSVGAnimatedPreserveAspectRatio18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore39jsSVGAnimatedPreserveAspectRatioBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_22SVGPreserveAspectRatioEPNS_10SVGElementE
-__ZN7WebCore24JSSVGPreserveAspectRatioC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGPreserveAspectRatioEEEPNS_10SVGElementE
-__ZN7WebCore24JSSVGPreserveAspectRatio18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29jsSVGPreserveAspectRatioAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsSVGPreserveAspectRatioMeetOrSliceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL35createSVGFontFaceNameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore24JSSVGFontFaceNameElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore24JSSVGFontFaceNameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGFontFaceNameElementEEE
-__ZNK7WebCore24JSSVGFontFaceNameElement9classInfoEv
-__ZN7WebCoreL27font_face_formatConstructorEPNS_8DocumentEb
-__ZN7WebCore24SVGFontFaceFormatElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL37createSVGFontFaceFormatElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore26JSSVGFontFaceFormatElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore26JSSVGFontFaceFormatElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGFontFaceFormatElementEEE
-__ZNK7WebCore26JSSVGFontFaceFormatElement9classInfoEv
-__ZN7WebCoreL34createSVGFontFaceSrcElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore23JSSVGFontFaceSrcElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore23JSSVGFontFaceSrcElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceSrcElementEEE
-__ZNK7WebCore23JSSVGFontFaceSrcElement9classInfoEv
-__ZN7WebCoreL34createSVGFontFaceUriElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore23JSSVGFontFaceUriElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore23JSSVGFontFaceUriElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceUriElementEEE
-__ZNK7WebCore23JSSVGFontFaceUriElement9classInfoEv
-__ZN7WebCoreL25definition_srcConstructorEPNS_8DocumentEb
-__ZN7WebCore23SVGDefinitionSrcElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL36createSVGDefinitionSrcElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGDefinitionSrcElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore25JSSVGDefinitionSrcElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGDefinitionSrcElementEEE
-__ZNK7WebCore25JSSVGDefinitionSrcElement9classInfoEv
-__ZN7WebCoreL29createSVGScriptElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore18JSSVGScriptElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSSVGScriptElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGScriptElementEEE
-__ZN7WebCore18JSSVGScriptElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZNK7WebCore18JSSVGScriptElement9classInfoEv
-__ZThn160_NK7WebCore16SVGScriptElement18typeAttributeValueEv
-__ZNK7WebCore16SVGScriptElement18typeAttributeValueEv
-__ZNK7WebCore16SVGScriptElement4typeEv
-__ZThn160_NK7WebCore16SVGScriptElement22languageAttributeValueEv
-__ZNK7WebCore16SVGScriptElement22languageAttributeValueEv
-__ZN7WebCore18JSSVGScriptElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsSVGScriptElementExternalResourcesRequiredEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_28SVGExternalResourcesRequiredEbXadL_ZNS_38SVGExternalResourcesRequiredIdentifierEEEXadL_ZNS_8SVGNames35externalResourcesRequiredAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_NS_10SVGElementEbbXadL_ZNS_38SVGExternalResourcesRequiredIdentifierEEEXadL_ZNS2_35externalResourcesRequiredAttrStringEEEEES4_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIbEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS5_EEE3setERKS2_RKS5_
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_28SVGExternalResourcesRequiredENS_10SVGElementEbbXadL_ZNS_38SVGExternalResourcesRequiredIdentifierEEEXadL_ZNS_8SVGNames35externalResourcesRequiredAttrStringEEEED1Ev
-__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIbEEENS_18PairFirstExtractorIS7_EENS1_29SVGAnimatedTypeWrapperKeyHashENS_14PairHashTraitsINS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS6_EEEESC_E6expandEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIbEEPNS_10SVGElementE
-__ZN7WebCore20JSSVGAnimatedBoolean15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore20JSSVGAnimatedBooleanC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIbEEEEPNS_10SVGElementE
-__ZN7WebCore20JSSVGAnimatedBoolean3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore30setJSSVGAnimatedBooleanBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore22jsSVGScriptElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14jsSVGElementIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsSVGPathElementPathSegListEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14SVGPathSegListEPNS_10SVGElementE
-__ZN7WebCore16JSSVGPathSegList15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore16JSSVGPathSegListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathSegListEEEPNS_10SVGElementE
-__ZN7WebCore16JSSVGPathSegList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29jsSVGPathSegListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSSVGPathSegListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore40jsSVGPathSegListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore16JSSVGPathSegList9classInfoEv
-__ZN7WebCore16JSSVGPathSegList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10SVGPathSegEPNS_10SVGElementE
-__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegMovetoAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore21JSSVGPathSegMovetoAbs15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSSVGPathSegMovetoAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoAbsEEEPNS_10SVGElementE
-__ZN7WebCore12JSSVGPathSegC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10SVGPathSegEEEPNS_10SVGElementE
-__ZN7WebCore21JSSVGPathSegMovetoAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12JSSVGPathSeg18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31jsSVGPathSegPathSegTypeAsLetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsSVGPathSegMovetoAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsSVGPathSegMovetoAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegLinetoAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore21JSSVGPathSegLinetoAbs15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSSVGPathSegLinetoAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoAbsEEEPNS_10SVGElementE
-__ZN7WebCore21JSSVGPathSegLinetoAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22jsSVGPathSegLinetoAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsSVGPathSegLinetoAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegClosePathEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore21JSSVGPathSegClosePath15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSSVGPathSegClosePathC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegClosePathEEEPNS_10SVGElementE
-__ZNK7WebCore19SVGPathSegClosePath19pathSegTypeAsLetterEv
-__ZN7WebCore15getDOMStructureINS_27JSSVGPathSegCurvetoCubicAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore27JSSVGPathSegCurvetoCubicAbs15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore27JSSVGPathSegCurvetoCubicAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicAbsEEEPNS_10SVGElementE
-__ZN7WebCore27JSSVGPathSegCurvetoCubicAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGPathSegCurvetoCubicAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGPathSegCurvetoCubicAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZThn160_N7WebCore16SVGScriptElement18dispatchErrorEventEv
-__ZN7WebCore16SVGScriptElement18dispatchErrorEventEv
-__ZN7WebCore24JSSVGPreserveAspectRatioD0Ev
-__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioD0Ev
-__ZN7WebCore25JSSVGDefinitionSrcElementD0Ev
-__ZN7WebCore23JSSVGFontFaceUriElementD0Ev
-__ZN7WebCore23JSSVGFontFaceSrcElementD0Ev
-__ZN7WebCore26JSSVGFontFaceFormatElementD0Ev
-__ZN7WebCore24JSSVGFontFaceNameElementD0Ev
-__ZN7WebCore21JSSVGPathSegMovetoAbsD0Ev
-__ZN7WebCore27JSSVGPathSegCurvetoCubicAbsD0Ev
-__ZN7WebCore20JSSVGAnimatedBooleanD0Ev
-__ZN7WebCore21JSSVGPathSegLinetoAbsD0Ev
-__ZN7WebCore16JSSVGPathSegListD0Ev
-__ZN7WebCore24JSSVGLengthListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore39jsSVGLengthListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore15JSSVGLengthList9classInfoEv
-__ZN7WebCore24jsSVGLengthValueAsStringEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEEcvS1_Ev
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEED1Ev
-__ZN7WebCore14SVGSMILElement14parseConditionERKNS_6StringENS0_10BeginOrEndE
-__ZN3WTF7HashSetIdNS_9FloatHashIdEENS_10HashTraitsIdEEE3addERKd
-__ZN7WebCore14SVGSMILElement9ConditionC1ENS1_4TypeENS0_10BeginOrEndERKNS_6StringES6_NS_8SMILTimeEi
-__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE6shrinkEm
-__ZSt25__unguarded_linear_insertIPN7WebCore8SMILTimeES1_EvT_T0_
-__ZSt21__unguarded_partitionIPN7WebCore8SMILTimeES1_ET_S3_S3_T0_
-__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E4findIdNS_22IdentityHashTranslatorIddS4_EEEENS_17HashTableIteratorIddS2_S4_S6_S6_EERKT_
-__ZSt12partial_sortIPN7WebCore8SMILTimeEEvT_S3_S3_
-__ZSt9make_heapIPN7WebCore8SMILTimeEEvT_S3_
-__ZSt13__adjust_heapIPN7WebCore8SMILTimeEiS1_EvT_T0_S4_T1_
-__ZSt11__push_heapIPN7WebCore8SMILTimeEiS1_EvT_T0_S4_T1_
-__ZSt9sort_heapIPN7WebCore8SMILTimeEEvT_S3_
-__ZNK7WebCore8SVGColor10isSVGColorEv
-__ZNK7WebCore10JSSVGColor9classInfoEv
-__ZN7WebCore22jsSVGGElementTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore31jsSVGTransformListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19synchronizePropertyINS_29SVGStyledTransformableElementEPNS_16SVGTransformListEEEvPKT_RKNS_13QualifiedNameET0_
-__ZNK7WebCore16SVGTransformList13valueAsStringEv
-__ZNK7WebCore12SVGTransform4typeEv
-__ZN7WebCore10JSSVGColorD0Ev
-__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore23jsSVGPathSegPathSegTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement25createSVGPathSegMovetoRelEff
-__ZN7WebCore19SVGPathSegMovetoRelC1Eff
-__ZNK7WebCore19SVGPathSegMovetoRel11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegMovetoRelEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore21JSSVGPathSegMovetoRel15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSSVGPathSegMovetoRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoRelEEEPNS_10SVGElementE
-__ZN7WebCore21JSSVGPathSegMovetoRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19SVGPathSegMovetoRel19pathSegTypeAsLetterEv
-__ZN7WebCore22jsSVGPathSegMovetoRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsSVGPathSegMovetoRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement25createSVGPathSegLinetoRelEff
-__ZN7WebCore19SVGPathSegLinetoRelC1Eff
-__ZNK7WebCore19SVGPathSegLinetoRel11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegLinetoRelEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore21JSSVGPathSegLinetoRel15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore21JSSVGPathSegLinetoRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoRelEEEPNS_10SVGElementE
-__ZN7WebCore21JSSVGPathSegLinetoRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19SVGPathSegLinetoRel19pathSegTypeAsLetterEv
-__ZN7WebCore22jsSVGPathSegLinetoRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsSVGPathSegLinetoRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore64jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore64jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement31createSVGPathSegCurvetoCubicRelEffffff
-__ZN7WebCore25SVGPathSegCurvetoCubicRelC1Effffff
-__ZNK7WebCore25SVGPathSegCurvetoCubicRel11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_27JSSVGPathSegCurvetoCubicRelEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore27JSSVGPathSegCurvetoCubicRel15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore27JSSVGPathSegCurvetoCubicRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicRelEEEPNS_10SVGElementE
-__ZN7WebCore27JSSVGPathSegCurvetoCubicRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25SVGPathSegCurvetoCubicRel19pathSegTypeAsLetterEv
-__ZN7WebCore28jsSVGPathSegCurvetoCubicRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGPathSegCurvetoCubicRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsSVGPathSegCurvetoCubicRelX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsSVGPathSegCurvetoCubicRelY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsSVGPathSegCurvetoCubicRelX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsSVGPathSegCurvetoCubicRelY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement35createSVGPathSegCurvetoQuadraticAbsEffff
-__ZN7WebCore29SVGPathSegCurvetoQuadraticAbsC1Effff
-__ZNK7WebCore29SVGPathSegCurvetoQuadraticAbs11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegCurvetoQuadraticAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbs15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticAbsEEEPNS_10SVGElementE
-__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29SVGPathSegCurvetoQuadraticAbs19pathSegTypeAsLetterEv
-__ZN7WebCore32jsSVGPathSegCurvetoQuadraticAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsSVGPathSegCurvetoQuadraticAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsSVGPathSegCurvetoQuadraticAbsX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsSVGPathSegCurvetoQuadraticAbsY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement35createSVGPathSegCurvetoQuadraticRelEffff
-__ZN7WebCore29SVGPathSegCurvetoQuadraticRelC1Effff
-__ZNK7WebCore29SVGPathSegCurvetoQuadraticRel11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegCurvetoQuadraticRelEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRel15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticRelEEEPNS_10SVGElementE
-__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29SVGPathSegCurvetoQuadraticRel19pathSegTypeAsLetterEv
-__ZN7WebCore32jsSVGPathSegCurvetoQuadraticRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsSVGPathSegCurvetoQuadraticRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsSVGPathSegCurvetoQuadraticRelX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsSVGPathSegCurvetoQuadraticRelY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore55jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement22createSVGPathSegArcAbsEfffffbb
-__ZN7WebCore16SVGPathSegArcAbsC1Efffffbb
-__ZNK7WebCore16SVGPathSegArcAbs11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_18JSSVGPathSegArcAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore18JSSVGPathSegArcAbs15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSSVGPathSegArcAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcAbsEEEPNS_10SVGElementE
-__ZN7WebCore18JSSVGPathSegArcAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16SVGPathSegArcAbs19pathSegTypeAsLetterEv
-__ZN7WebCore19jsSVGPathSegArcAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsSVGPathSegArcAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsSVGPathSegArcAbsR1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsSVGPathSegArcAbsR2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsSVGPathSegArcAbsAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsSVGPathSegArcAbsLargeArcFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsSVGPathSegArcAbsSweepFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore55jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement22createSVGPathSegArcRelEfffffbb
-__ZN7WebCore16SVGPathSegArcRelC1Efffffbb
-__ZNK7WebCore16SVGPathSegArcRel11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_18JSSVGPathSegArcRelEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore18JSSVGPathSegArcRel15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSSVGPathSegArcRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcRelEEEPNS_10SVGElementE
-__ZN7WebCore18JSSVGPathSegArcRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16SVGPathSegArcRel19pathSegTypeAsLetterEv
-__ZN7WebCore19jsSVGPathSegArcRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsSVGPathSegArcRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsSVGPathSegArcRelR1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsSVGPathSegArcRelR2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsSVGPathSegArcRelAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsSVGPathSegArcRelLargeArcFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsSVGPathSegArcRelSweepFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement35createSVGPathSegLinetoHorizontalAbsEf
-__ZN7WebCore29SVGPathSegLinetoHorizontalAbsC1Ef
-__ZNK7WebCore29SVGPathSegLinetoHorizontalAbs11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegLinetoHorizontalAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbs15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalAbsEEEPNS_10SVGElementE
-__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29SVGPathSegLinetoHorizontalAbs19pathSegTypeAsLetterEv
-__ZN7WebCore32jsSVGPathSegLinetoHorizontalAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement35createSVGPathSegLinetoHorizontalRelEf
-__ZN7WebCore29SVGPathSegLinetoHorizontalRelC1Ef
-__ZNK7WebCore29SVGPathSegLinetoHorizontalRel11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegLinetoHorizontalRelEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore31JSSVGPathSegLinetoHorizontalRel15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore31JSSVGPathSegLinetoHorizontalRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalRelEEEPNS_10SVGElementE
-__ZN7WebCore31JSSVGPathSegLinetoHorizontalRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29SVGPathSegLinetoHorizontalRel19pathSegTypeAsLetterEv
-__ZN7WebCore32jsSVGPathSegLinetoHorizontalRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore66jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement33createSVGPathSegLinetoVerticalAbsEf
-__ZN7WebCore27SVGPathSegLinetoVerticalAbsC1Ef
-__ZNK7WebCore27SVGPathSegLinetoVerticalAbs11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_29JSSVGPathSegLinetoVerticalAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore29JSSVGPathSegLinetoVerticalAbs15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore29JSSVGPathSegLinetoVerticalAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalAbsEEEPNS_10SVGElementE
-__ZN7WebCore29JSSVGPathSegLinetoVerticalAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27SVGPathSegLinetoVerticalAbs19pathSegTypeAsLetterEv
-__ZN7WebCore30jsSVGPathSegLinetoVerticalAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore66jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement33createSVGPathSegLinetoVerticalRelEf
-__ZN7WebCore27SVGPathSegLinetoVerticalRelC1Ef
-__ZNK7WebCore27SVGPathSegLinetoVerticalRel11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_29JSSVGPathSegLinetoVerticalRelEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore29JSSVGPathSegLinetoVerticalRel15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore29JSSVGPathSegLinetoVerticalRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalRelEEEPNS_10SVGElementE
-__ZN7WebCore29JSSVGPathSegLinetoVerticalRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27SVGPathSegLinetoVerticalRel19pathSegTypeAsLetterEv
-__ZN7WebCore30jsSVGPathSegLinetoVerticalRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore70jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement37createSVGPathSegCurvetoCubicSmoothAbsEffff
-__ZN7WebCore31SVGPathSegCurvetoCubicSmoothAbsC1Effff
-__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothAbs11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_33JSSVGPathSegCurvetoCubicSmoothAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbs15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothAbsEEEPNS_10SVGElementE
-__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothAbs19pathSegTypeAsLetterEv
-__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothAbsX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothAbsY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore70jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement37createSVGPathSegCurvetoCubicSmoothRelEffff
-__ZN7WebCore31SVGPathSegCurvetoCubicSmoothRelC1Effff
-__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothRel11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_33JSSVGPathSegCurvetoCubicSmoothRelEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRel15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothRelEEEPNS_10SVGElementE
-__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothRel19pathSegTypeAsLetterEv
-__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothRelX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothRelY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore74jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement41createSVGPathSegCurvetoQuadraticSmoothAbsEff
-__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothAbsC1Eff
-__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothAbs11pathSegTypeEv
-__ZN7WebCore15getDOMStructureINS_37JSSVGPathSegCurvetoQuadraticSmoothAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbs15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticSmoothAbsEEEPNS_10SVGElementE
-__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothAbs19pathSegTypeAsLetterEv
-__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore74jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore14SVGPathElement41createSVGPathSegCurvetoQuadraticSmoothRelEff
-__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothRelC1Eff
-__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothRel11pathSegTypeEv
-__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRel15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticSmoothRelEEEPNS_10SVGElementE
-__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothRel19pathSegTypeAsLetterEv
-__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsSVGScriptElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore46jsSVGSVGElementPrototypeFunctionCreateSVGAngleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13SVGSVGElement14createSVGAngleEv
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8SVGAngleEPNS_10SVGElementE
-__ZN7WebCore10JSSVGAngleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGAngleEEEPNS_10SVGElementE
-__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13SVGSVGElement15createSVGLengthEv
-__ZN7WebCore22setJSSVGElementXmlbaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10SVGElement10setXmlbaseERKNS_6StringERi
-__ZN7WebCore19jsSVGElementXmlbaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore10SVGElement7xmlbaseEv
-__ZN7WebCore10JSSVGAngle3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore26setJSSVGAngleValueAsStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore8SVGAngle16setValueAsStringERKNS_6StringE
-__ZN7WebCore8SVGAngle9calculateEv
-__ZN7WebCore10JSSVGAngle18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23jsSVGAngleValueAsStringEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8SVGAngle13valueAsStringEv
-__ZN7WebCore27setJSSVGLengthValueAsStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEE12commitChangeES1_PNS_10SVGElementE
-__ZN7WebCore25setJSSVGScriptElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZNK7WebCore19JSSVGAnimatedLength9classInfoEv
-__ZN7WebCore20JSSVGLengthPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore11JSSVGLength9classInfoEv
-__ZN7WebCore26jsSVGAltGlyphElementFormatEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore18SVGAltGlyphElement6formatEv
-__ZN7WebCore20JSSVGAltGlyphElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore29setJSSVGAltGlyphElementFormatEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore18SVGAltGlyphElement9setFormatERKNS_12AtomicStringERi
-__ZN7WebCore21JSSVGPathSegLinetoRelD0Ev
-__ZN7WebCore19SVGPathSegLinetoRelD1Ev
-__ZN7WebCore21JSSVGPathSegMovetoRelD0Ev
-__ZN7WebCore19SVGPathSegMovetoRelD1Ev
-__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRelD0Ev
-__ZN7WebCore29SVGPathSegCurvetoQuadraticRelD1Ev
-__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbsD0Ev
-__ZN7WebCore29SVGPathSegCurvetoQuadraticAbsD1Ev
-__ZN7WebCore27JSSVGPathSegCurvetoCubicRelD0Ev
-__ZN7WebCore25SVGPathSegCurvetoCubicRelD1Ev
-__ZN7WebCore18JSSVGPathSegArcAbsD0Ev
-__ZN7WebCore16SVGPathSegArcAbsD1Ev
-__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbsD0Ev
-__ZN7WebCore29SVGPathSegLinetoHorizontalAbsD1Ev
-__ZN7WebCore18JSSVGPathSegArcRelD0Ev
-__ZN7WebCore16SVGPathSegArcRelD1Ev
-__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbsD0Ev
-__ZN7WebCore31SVGPathSegCurvetoCubicSmoothAbsD1Ev
-__ZN7WebCore29JSSVGPathSegLinetoVerticalRelD0Ev
-__ZN7WebCore27SVGPathSegLinetoVerticalRelD1Ev
-__ZN7WebCore29JSSVGPathSegLinetoVerticalAbsD0Ev
-__ZN7WebCore27SVGPathSegLinetoVerticalAbsD1Ev
-__ZN7WebCore31JSSVGPathSegLinetoHorizontalRelD0Ev
-__ZN7WebCore29SVGPathSegLinetoHorizontalRelD1Ev
-__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRelD0Ev
-__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothRelD1Ev
-__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbsD0Ev
-__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothAbsD1Ev
-__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRelD0Ev
-__ZN7WebCore31SVGPathSegCurvetoCubicSmoothRelD1Ev
-__ZN7WebCore10JSSVGAngleD0Ev
-__ZN7WebCore38jsSVGPatternElementPatternContentUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_22patternUnitsAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_iiXadL_ZNS2_16patternTagStringEEEXadL_ZNS2_22patternUnitsAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCoreL36createSVGForeignObjectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGForeignObjectElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore25JSSVGForeignObjectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGForeignObjectElementEEE
-__ZN7WebCore25JSSVGForeignObjectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34JSSVGForeignObjectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSSVGForeignObjectElement9classInfoEv
-__ZN7WebCore32jsSVGMaskElementMaskContentUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_iiXadL_ZNS2_13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore20jsSVGPatternElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsSVGMarkerElementRefYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL17cursorConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGCursorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCoreL29createSVGCursorElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore18JSSVGCursorElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSSVGCursorElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCursorElementEEE
-__ZN7WebCore18JSSVGCursorElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSSVGCursorElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSSVGCursorElement9classInfoEv
-__ZN7WebCore16SVGCursorElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16SVGCursorElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZThn124_NK7WebCore16SVGCursorElement14contextElementEv
-__ZNK7WebCore16SVGCursorElement14contextElementEv
-__ZN7WebCore19jsSVGCursorElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCursorElementENS_9SVGLengthEXadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11yAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_15cursorTagStringEEEXadL_ZNS3_11yAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGCursorElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11yAttrStringEEEED0Ev
-__ZNK7WebCore16SVGCursorElement7isValidEv
-__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCursorElementENS_9SVGLengthEXadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11yAttrStringEEEE11synchronizeEv
-__ZN7WebCore13CSSImageValue14cachedImageURLEv
-__ZN7WebCore13CSSImageValue16clearCachedImageEv
-__ZN3WTF7HashSetIPN7WebCore10SVGElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
-__ZN7WebCore16SVGCursorElement9addClientEPNS_10SVGElementE
-__ZN7WebCoreL24createSVGAElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore13JSSVGAElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore13JSSVGAElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGAElementEEE
-__ZN7WebCore13JSSVGAElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSSVGAElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore13JSSVGAElement9classInfoEv
-__ZN7WebCore17jsSVGAElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsSVGPatternElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11xAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_16patternTagStringEEEXadL_ZNS3_11xAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore20jsSVGPatternElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_16heightAttrStringEEEE7baseValEv
-__ZN7WebCore28jsSVGMarkerElementOrientTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementEiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS2_21markerUnitsAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_iiXadL_ZNS2_15markerTagStringEEEXadL_ZNS2_21markerUnitsAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore29jsSVGMarkerElementOrientAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_8SVGAngleEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_28SVGOrientAngleAttrIdentifierEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_PS2_XadL_ZNS3_15markerTagStringEEEXadL_ZNS_28SVGOrientAngleAttrIdentifierEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_8SVGAngleEEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS7_EEE3setERKS2_RKS7_
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_NS_8SVGAngleEPS2_XadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_28SVGOrientAngleAttrIdentifierEEEED1Ev
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_8SVGAngleEEEPNS_10SVGElementE
-__ZN7WebCore18JSSVGAnimatedAngle15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore18JSSVGAnimatedAngleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_8SVGAngleEEEEEPNS_10SVGElementE
-__ZN7WebCore18JSSVGAnimatedAngle18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25jsSVGAnimatedAngleBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15jsSVGAngleValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsSVGEllipseElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_17SVGEllipseElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cxAttrStringEEEE7baseValEv
-__ZN7WebCore18jsSVGTransformTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsSVGTransformAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12SVGTransform5angleEv
-__ZN7WebCore35jsSVGPatternElementPatternTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_16SVGTransformListEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_26patternTransformAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_PS2_XadL_ZNS3_16patternTagStringEEEXadL_ZNS3_26patternTransformAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_NS_16SVGTransformListEPS2_XadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS4_26patternTransformAttrStringEEEED0Ev
-__ZN7WebCore31jsSVGPatternElementPatternUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_iiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_22patternUnitsAttrStringEEEED1Ev
-__ZN7WebCore33jsSVGGradientElementGradientUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_18SVGGradientElementEiXadL_ZNS_28SVGGradientElementIdentifierEEEXadL_ZNS_8SVGNames22spreadMethodAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_iiXadL_ZNS_28SVGGradientElementIdentifierEEEXadL_ZNS2_22spreadMethodAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore30jsSVGForeignObjectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19synchronizePropertyINS_23SVGForeignObjectElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
-__ZN7WebCore21jsSVGEllipseElementRyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cxAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_16ellipseTagStringEEEXadL_ZNS3_12cxAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore24jsSVGPatternElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsSVGLineElementY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x1AttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_13lineTagStringEEEXadL_ZNS3_12x1AttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore21jsSVGEllipseElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsSVGMaskElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11xAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_13maskTagStringEEEXadL_ZNS3_11xAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore31jsSVGForeignObjectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_23SVGForeignObjectElementENS_9SVGLengthEXadL_ZNS_8SVGNames22foreignObjectTagStringEEEXadL_ZNS3_11xAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_22foreignObjectTagStringEEEXadL_ZNS3_11xAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore21jsSVGMaskElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL37createSVGRadialGradientElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore26JSSVGRadialGradientElement15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore26JSSVGRadialGradientElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGRadialGradientElementEEE
-__ZN7WebCore26JSSVGRadialGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSSVGRadialGradientElement9classInfoEv
-__ZN7WebCore28jsSVGRadialGradientElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsSVGEllipseElementRxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsSVGRadialGradientElementREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsSVGImageElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19synchronizePropertyINS_15SVGImageElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
-__ZN7WebCore23jsSVGImageElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsSVGCircleElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore15setJSSVGMatrixEEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore37jsSVGGradientElementGradientTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_18SVGGradientElementENS_16SVGTransformListEXadL_ZNS_28SVGGradientElementIdentifierEEEXadL_ZNS_8SVGNames27gradientTransformAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_PS2_XadL_ZNS_28SVGGradientElementIdentifierEEEXadL_ZNS3_27gradientTransformAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_18SVGGradientElementES1_NS_16SVGTransformListEPS2_XadL_ZNS_28SVGGradientElementIdentifierEEEXadL_ZNS_8SVGNames27gradientTransformAttrStringEEEED1Ev
-__ZN7WebCore26jsSVGForeignObjectElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17jsSVGMaskElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGMaskElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11xAttrStringEEEE7baseValEv
-__ZN7WebCore28jsSVGLinearGradientElementY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsSVGLineElementX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGLineElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x1AttrStringEEEE7baseValEv
-__ZN7WebCore29jsSVGMarkerElementMarkerWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsSVGLineElementY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGLinearGradientElementX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsSVGCircleElementREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cxAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_15circleTagStringEEEXadL_ZNS3_12cxAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore28jsSVGRadialGradientElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_24SVGRadialGradientElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames23radialGradientTagStringEEEXadL_ZNS3_11rAttrStringEEEE10setBaseValES2_
-__ZN7WebCore28jsSVGRadialGradientElementFxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsSVGRadialGradientElementFyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_24SVGRadialGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23radialGradientTagStringEEEXadL_ZNS3_12cxAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_23radialGradientTagStringEEEXadL_ZNS3_12cxAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore22jsSVGMarkerElementRefXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_22markerHeightAttrStringEEEE7baseValEv
-__ZN7WebCore25jsSVGMaskElementMaskUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGMaskElementES1_iiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_26maskContentUnitsAttrStringEEEED1Ev
-__ZN7WebCore29jsSVGMarkerElementMarkerUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_iiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS2_21markerUnitsAttrStringEEEED0Ev
-__ZN7WebCore18jsSVGImageElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_15widthAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_14imageTagStringEEEXadL_ZNS3_15widthAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore28jsSVGLinearGradientElementX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_24SVGLinearGradientElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames23linearGradientTagStringEEEXadL_ZNS3_12y1AttrStringEEEE10setBaseValES2_
-__ZN7WebCore26jsSVGForeignObjectElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_23SVGForeignObjectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames22foreignObjectTagStringEEEXadL_ZNS3_11xAttrStringEEEE7baseValEv
-__ZN7WebCore17jsSVGMaskElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsSVGAElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_11SVGAElementENS_6StringEXadL_ZNS_8SVGNames10aTagStringEEEXadL_ZNS3_16targetAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_10aTagStringEEEXadL_ZNS3_16targetAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_11SVGAElementES1_NS_6StringES2_XadL_ZNS_8SVGNames10aTagStringEEEXadL_ZNS3_16targetAttrStringEEEED1Ev
-__ZN7WebCore18jsSVGLineElementX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsSVGCircleElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGCircleElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_11rAttrStringEEEED0Ev
-__ZN7WebCore33jsSVGClipPathElementClipPathUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_18SVGClipPathElementEiXadL_ZNS_8SVGNames17clipPathTagStringEEEXadL_ZNS2_23clipPathUnitsAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_iiXadL_ZNS2_17clipPathTagStringEEEXadL_ZNS2_23clipPathUnitsAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore26SVGAnimatedPropertyTearOffINS_18SVGClipPathElementES1_iiXadL_ZNS_8SVGNames17clipPathTagStringEEEXadL_ZNS2_23clipPathUnitsAttrStringEEEED0Ev
-__ZN7WebCore30jsSVGMarkerElementMarkerHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refXAttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_15markerTagStringEEEXadL_ZNS3_14refXAttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore28jsSVGLinearGradientElementY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21lookupOrCreateWrapperINS_24SVGLinearGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23linearGradientTagStringEEEXadL_ZNS3_12x1AttrStringEEENS_26SVGAnimatedPropertyTearOffIS1_S1_S2_S2_XadL_ZNS3_23linearGradientTagStringEEEXadL_ZNS3_12x1AttrStringEEEEES1_EEN3WTF10PassRefPtrIT3_EERKNS_19SVGAnimatedPropertyIT_T0_XT1_EXT2_EEEPKT4_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore18jsSVGImageElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_15SVGImageElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11xAttrStringEEEE7baseValEv
-__ZN7WebCore19jsSVGCursorElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19synchronizePropertyINS_24SVGRadialGradientElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
-__ZN7WebCore19synchronizePropertyINS_17SVGPatternElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
-__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_16SVGTransformListEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_26patternTransformAttrStringEEEE11synchronizeEv
-__ZN7WebCore19synchronizePropertyINS_24SVGLinearGradientElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
-__ZN7WebCore18JSSVGAnimatedAngleD0Ev
-__ZN7WebCore22JSSVGAElementPrototypeD0Ev
-__ZN7WebCore13JSSVGAElementD0Ev
-__ZN7WebCore27JSSVGCursorElementPrototypeD0Ev
-__ZN7WebCore19CSSCursorImageValue23removeReferencedElementEPNS_10SVGElementE
-__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore34JSSVGForeignObjectElementPrototypeD0Ev
-__ZN7WebCore41JSSVGAnimatedPreserveAspectRatioPrototypeD0Ev
-__ZN7WebCore27JSSVGAnimatedAnglePrototypeD0Ev
-__ZN7WebCore35JSSVGRadialGradientElementPrototypeD0Ev
-__ZN7WebCore27JSSVGScriptElementPrototypeD0Ev
-__ZN7WebCore34JSSVGDefinitionSrcElementPrototypeD0Ev
-__ZN7WebCore32JSSVGFontFaceUriElementPrototypeD0Ev
-__ZN7WebCore32JSSVGFontFaceSrcElementPrototypeD0Ev
-__ZN7WebCore35JSSVGFontFaceFormatElementPrototypeD0Ev
-__ZN7WebCore33JSSVGFontFaceNameElementPrototypeD0Ev
-__ZN7WebCore30JSSVGPathSegClosePathPrototypeD0Ev
-__ZN7WebCore36JSSVGPathSegCurvetoCubicAbsPrototypeD0Ev
-__ZN7WebCore30JSSVGPathSegMovetoAbsPrototypeD0Ev
-__ZN7WebCore30JSSVGPathSegLinetoAbsPrototypeD0Ev
-__ZN7WebCore30JSSVGPathSegLinetoRelPrototypeD0Ev
-__ZN7WebCore30JSSVGPathSegMovetoRelPrototypeD0Ev
-__ZN7WebCore27JSSVGPathSegArcAbsPrototypeD0Ev
-__ZN7WebCore40JSSVGPathSegLinetoHorizontalAbsPrototypeD0Ev
-__ZN7WebCore27JSSVGPathSegArcRelPrototypeD0Ev
-__ZN7WebCore36JSSVGPathSegCurvetoCubicRelPrototypeD0Ev
-__ZN7WebCore38JSSVGPathSegLinetoVerticalRelPrototypeD0Ev
-__ZN7WebCore38JSSVGPathSegLinetoVerticalAbsPrototypeD0Ev
-__ZN7WebCore40JSSVGPathSegLinetoHorizontalRelPrototypeD0Ev
-__ZN7WebCore46JSSVGPathSegCurvetoQuadraticSmoothRelPrototypeD0Ev
-__ZN7WebCore46JSSVGPathSegCurvetoQuadraticSmoothAbsPrototypeD0Ev
-__ZN7WebCore19RenderForeignObject11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore50jsSVGLengthPrototypeFunctionNewValueSpecifiedUnitsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9SVGLength22newValueSpecifiedUnitsEtf
-__ZNK7WebCore24RenderSVGHiddenContainer20isSVGHiddenContainerEv
-__ZNK7WebCore4Font32selectionRectForTextUsingSVGFontERKNS_7TextRunERKNS_8IntPointEiii
-__ZN7WebCoremlERKNS_8SMILTimeES2_
-__ZNK7WebCore6String12toUIntStrictEPbi
-__ZN7WebCore10StringImpl12toUIntStrictEPbi
-__ZN7WebCore22charactersToUIntStrictEPKtmPbi
-__ZNK7WebCore14SVGSMILElement8isFrozenEv
-__ZSt25__unguarded_linear_insertIPPN7WebCore14SVGSMILElementES2_NS0_15PriorityCompareEEvT_T0_T1_
-__ZN7WebCore14SVGSMILElement16addTimeDependentEPS0_
-__ZN7WebCore14SVGSMILElement31createInstanceTimesFromSyncbaseEPS0_NS0_21NewOrExistingIntervalE
-__ZN7WebCore14SVGSMILElement10addEndTimeENS_8SMILTimeE
-__ZN7WebCore14SVGSMILElement14endListChangedEv
-__ZN7WebCoreL22applyOrderSortFunctionEPNS_14SVGSMILElementES1_
-__ZSt25__unguarded_linear_insertIPPN7WebCore14SVGSMILElementES2_PFbS2_S2_EEvT_T0_T1_
-__ZNK7WebCore19SVGAnimationElement9fromValueEv
-__ZN7WebCoreL13parseKeyTimesERKNS_6StringERN3WTF6VectorIfLm0EEEb
-__ZN7WebCoreL24animateMotionConstructorEPNS_8DocumentEb
-__ZN7WebCore23SVGAnimateMotionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore23SVGAnimateMotionElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore23SVGAnimateMotionElement16resetToBaseValueERKNS_6StringE
-__ZNK7WebCore23SVGAnimateMotionElement14hasValidTargetEv
-__ZN7WebCore29SVGStyledTransformableElement21supplementalTransformEv
-__ZNK7WebCore23SVGAnimateMotionElement13animationPathEv
-__ZN7WebCore23SVGAnimateMotionElement24calculateFromAndToValuesERKNS_6StringES3_
-__ZN7WebCoreL10parsePointERKNS_6StringERNS_10FloatPointE
-__ZN7WebCore23SVGAnimateMotionElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
-__ZN7WebCore23SVGAnimateMotionElement20applyResultsToTargetEv
-__ZN7WebCore13ColorDistanceC1ERKNS_5ColorES3_
-__ZNK7WebCore13ColorDistance14scaledDistanceEf
-__ZN7WebCore13ColorDistanceC1Eiii
-__ZNK7WebCore13ColorDistance18addToColorAndClampERKNS_5ColorE
-__ZN7WebCore8SVGColorC1ENS0_12SVGColorTypeE
-__ZN7WebCore19SVGAnimationElement33calculateKeyTimesForCalcModePacedEv
-__ZN7WebCore17SVGAnimateElement17calculateDistanceERKNS_6StringES3_
-__ZN7WebCoreL23animateColorConstructorEPNS_8DocumentEb
-__ZN7WebCore22SVGAnimateColorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore23SVGAnimateMotionElement10rotateModeEv
-__ZN7WebCoreL27animateTransformConstructorEPNS_8DocumentEb
-__ZN7WebCore26SVGAnimateTransformElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore26SVGAnimateTransformElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZSt21__unguarded_partitionIPPN7WebCore14SVGSMILElementES2_NS0_15PriorityCompareEET_S5_S5_T0_T1_
-__ZN7WebCore26SVGAnimateTransformElement16resetToBaseValueERKNS_6StringE
-__ZNK7WebCore26SVGAnimateTransformElement14hasValidTargetEv
-__ZN7WebCoreL16transformListForEPNS_10SVGElementE
-__ZN3WTF9HashTableISt4pairIPN7WebCore10SVGElementENS2_6StringEES1_IS6_S5_ENS_18PairFirstExtractorIS7_EENS_8PairHashIS4_S5_EENS_14PairHashTraitsINS_10HashTraitsIS6_EENSD_IS5_EEEESE_E4findIS6_NS_22IdentityHashTranslatorIS6_S7_SB_EEEENS_17HashTableIteratorIS6_S7_S9_SB_SG_SE_EERKT_
-__ZSt21__unguarded_partitionIPPN7WebCore14SVGSMILElementES2_PFbS2_S2_EET_S6_S6_T0_T1_
-__ZN7WebCore26SVGAnimateTransformElement20applyResultsToTargetEv
-__ZN7WebCoreL30floatWidthMissingGlyphCallbackERKNS_7TextRunERNS_34SVGTextRunWalkerMeasuredLengthDataE
-__ZNK7WebCore4Font12fontSelectorEv
-__ZN7WebCoreL17switchConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGSwitchElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16SVGSwitchElement7isValidEv
-__ZN7WebCore16SVGSwitchElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore16SVGSwitchElement25childShouldCreateRendererEPNS_4NodeE
-__ZNK7WebCore8SVGTests16requiredFeaturesEv
-__ZNK7WebCore8SVGTests14systemLanguageEv
-__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14shrinkCapacityEm
-__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE15reserveCapacityEm
-__ZNK7WebCore19SVGAnimationElement25calculatePercentForSplineEfj
-__ZNK7WebCore19SVGAnimationElement26currentValuesFromKeyPointsEfRfRNS_6StringES3_
-__ZNK7WebCore19SVGAnimationElement29calculatePercentFromKeyPointsEf
-__ZN7WebCore23SVGAnimateMotionElement17calculateDistanceERKNS_6StringES3_
-__ZN7WebCore14SVGTextElement21supplementalTransformEv
-__ZN7WebCoreL15viewConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGViewElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGViewElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGViewElement16rendererIsNeededEPNS_11RenderStyleE
-__ZThn136_NK7WebCore14SVGViewElement14contextElementEv
-__ZNK7WebCore14SVGViewElement14contextElementEv
-__ZNK7WebCore14SVGViewElement10viewTargetEv
-__ZN7WebCore26SVGAnimateTransformElement24calculateFromAndToValuesERKNS_6StringES3_
-__ZNK7WebCore26SVGAnimateTransformElement19parseTransformValueERKNS_6StringE
-__ZN7WebCore12SVGTransform7isValidEv
-__ZN7WebCore26SVGAnimateTransformElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
-__ZN7WebCore20SVGTransformDistanceC1ERKNS_12SVGTransformES3_
-__ZNK7WebCore12SVGTransform14rotationCenterEv
-__ZNK7WebCore20SVGTransformDistance14scaledDistanceEf
-__ZN7WebCore20SVGTransformDistanceC1ENS_12SVGTransform16SVGTransformTypeEfffRKNS_20TransformationMatrixE
-__ZNK7WebCore20SVGTransformDistance17addToSVGTransformERKNS_12SVGTransformE
-__ZNK7WebCore12SVGTransform5scaleEv
-__ZN7WebCore9FloatSize15narrowPrecisionEdd
-__ZN7WebCore26SVGAnimateTransformElementD1Ev
-__ZNK7WebCore12SVGTransform9translateEv
-__ZN7WebCore27jsSVGElementOwnerSVGElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL16mpathConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGMPathElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGMPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore15SVGMPathElement14contextElementEv
-__ZN7WebCore15SVGMPathElement11pathElementEv
-__ZN7WebCore42jsSVGCircleElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore41jsSVGCircleElementFarthestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore29SVGStyledTransformableElement23farthestViewportElementEv
-__ZN7WebCore12SVGLocatable23farthestViewportElementEPKNS_10SVGElementE
-__ZN7WebCore40jsElementPrototypeFunctionGetAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore7Element14getAttributeNSERKNS_6StringES3_
-__ZN7WebCore40jsSVGCircleElementNearestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore29SVGStyledTransformableElement22nearestViewportElementEv
-__ZN7WebCore13SVGUseElement15childrenChangedEbPNS_4NodeES2_i
-__ZN7WebCore26SVGAnimateTransformElement17calculateDistanceERKNS_6StringES3_
-__ZN7WebCore14SVGPathSegList14createAnimatedEPKS0_S2_f
-__ZN7WebCore21SVGPathSegListBuilder17svgLineToVerticalEdb
-__ZN7WebCore21SVGPathSegListBuilder19svgLineToHorizontalEdb
-__ZN7WebCore21SVGPathSegListBuilder21svgCurveToCubicSmoothEddddb
-__ZN7WebCore21SVGPathSegListBuilder19svgCurveToQuadraticEddddb
-__ZN7WebCore21SVGPathSegListBuilder25svgCurveToQuadraticSmoothEddb
-__ZNK7WebCore19SVGPathSegClosePath8toStringEv
-__ZNK7WebCore24SVGPathSegLinetoVertical8toStringEv
-__ZNK7WebCore26SVGPathSegLinetoHorizontal8toStringEv
-__ZNK7WebCore28SVGPathSegCurvetoCubicSmooth8toStringEv
-__ZNK7WebCore26SVGPathSegCurvetoQuadratic8toStringEv
-__ZNK7WebCore19SVGAnimationElement7byValueEv
-__ZN7WebCore17SVGAnimateElement24calculateFromAndByValuesERKNS_6StringES3_
-__ZN7WebCoreL28drawTextMissingGlyphCallbackERKNS_7TextRunERNS_28SVGTextRunWalkerDrawTextDataE
-__ZN7WebCore16SVGStyledElement12resolveStyleEPNS_11RenderStyleE
-__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE6shrinkEm
-__ZN7WebCore14SVGSMILElement19removeTimeDependentEPS0_
-__ZN7WebCore15SVGMPathElementD1Ev
-__ZN7WebCore16SVGCursorElement12removeClientEPNS_10SVGElementE
-__ZN7WebCore16SVGSwitchElementD1Ev
-__ZN7WebCore8SVGImage16setContainerSizeERKNS_7IntSizeE
-__ZN7WebCore22EmptyFrameLoaderClient15willChangeTitleEPNS_14DocumentLoaderE
-__ZN7WebCore22EmptyFrameLoaderClient14didChangeTitleEPNS_14DocumentLoaderE
-__ZNK7WebCore13SVGSVGElement18relativeWidthValueEv
-__ZNK7WebCore13SVGSVGElement19relativeHeightValueEv
-__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectES5_NS0_8TileRuleES6_NS_17CompositeOperatorE
-__ZN7WebCore13InlineFlowBox9paintMaskERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore8SVGImage26nativeImageForCurrentFrameEv
-__ZN7WebCore13InlineFlowBox14paintBoxShadowEPNS_15GraphicsContextEPNS_11RenderStyleEiiii
-__ZN7WebCore15GraphicsContext18clipOutRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_
-__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_9FloatRectE
-__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_10FloatPointE
-__ZNK7WebCore11ImageBuffer12getImageDataERKNS_7IntRectE
-__ZN7WebCore9ImageData6createEjj
-__ZN7WebCore9ImageDataC1Ejj
-__ZN7WebCore16CanvasPixelArray6createEj
-__ZN7WebCore16CanvasPixelArrayC1Ej
-__ZN7WebCore11JSImageData15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore11JSImageDataC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ImageDataEEE
-__ZN7WebCore11JSImageData18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore46jsCanvasRenderingContext2DPrototypeFunctionArcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D3arcEfffffbRi
-__ZN7WebCore4Path6addArcERKNS_10FloatPointEfffb
-__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionArcToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D5arcToEfffffRi
-__ZN7WebCore4Path8addArcToERKNS_10FloatPointES3_f
-__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionBezierCurveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D13bezierCurveToEffffff
-__ZNK7WebCore10StyleImage13isCachedImageEv
-__ZNK7WebCore10StyleImage13errorOccurredEv
-__ZNK7WebCore19StyleGeneratedImage21imageHasRelativeWidthEv
-__ZN7WebCore45jsHTMLCanvasElementPrototypeFunctionToDataURLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore17HTMLCanvasElement9toDataURLERKNS_6StringERi
-__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionSetFillColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26JSCanvasRenderingContext2D12setFillColorEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D12setFillColorEffff
-__ZN7WebCore11CanvasStyleC1Effff
-__ZN7WebCore20makeRGBA32FromFloatsEffff
-__ZN7WebCoreL20colorFloatToRGBAByteEf
-__ZN7WebCore11JSImageDataD0Ev
-__ZN7WebCore33setJSCanvasRenderingContext2DFontEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24CanvasRenderingContext2D7setFontERKNS_6StringE
-__ZN7WebCore16CSSStyleSelector20applyPropertyToStyleEiPNS_8CSSValueEPNS_11RenderStyleE
-__ZN7WebCore51jsCanvasRenderingContext2DPrototypeFunctionFillTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26JSCanvasRenderingContext2D8fillTextEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D8fillTextERKNS_6StringEff
-__ZN7WebCore24CanvasRenderingContext2D16drawTextInternalERKNS_6StringEffbfb
-__ZN7WebCore24CanvasRenderingContext2D10accessFontEv
-__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionStrokeTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26JSCanvasRenderingContext2D10strokeTextEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D10strokeTextERKNS_6StringEff
-__ZN7WebCore38setJSCanvasRenderingContext2DTextAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24CanvasRenderingContext2D12setTextAlignERKNS_6StringE
-__ZN7WebCore14parseTextAlignERKNS_6StringERNS_9TextAlignE
-__ZN7WebCore54jsCanvasRenderingContext2DPrototypeFunctionMeasureTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D11measureTextERKNS_6StringE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11TextMetricsE
-__ZN7WebCore13JSTextMetricsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11TextMetricsEEE
-__ZN7WebCore13JSTextMetrics18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18jsTextMetricsWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41setJSCanvasRenderingContext2DTextBaselineEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24CanvasRenderingContext2D15setTextBaselineERKNS_6StringE
-__ZN7WebCore17parseTextBaselineERKNS_6StringERNS_12TextBaselineE
-__ZN7WebCore16MIMETypeRegistry35isSupportedImageMIMETypeForEncodingERKNS_6StringE
-__ZN7WebCoreL44initializeSupportedImageMIMETypesForEncodingEv
-__ZNK7WebCore11ImageBuffer9toDataURLERKNS_6StringE
-__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_17HTMLCanvasElementERKNS_6StringERi
-__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionIsPointInPathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D13isPointInPathEff
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionSetShadowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26JSCanvasRenderingContext2D9setShadowEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffRKNS_6StringE
-__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffffff
-__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffff
-__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffRKNS_6StringEf
-__ZN7WebCore22colorWithOverrideAlphaEjf
-__ZN7WebCore24CanvasRenderingContext2D9setShadowEffffffff
-__ZN7WebCore24CanvasRenderingContext2D9setShadowEffff
-__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionPutImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26JSCanvasRenderingContext2D12putImageDataEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore11toImageDataEN3JSC10JSValuePtrE
-__ZNK7WebCore11JSImageData9classInfoEv
-__ZN7WebCore24CanvasRenderingContext2D12putImageDataEPNS_9ImageDataEffRi
-__ZN7WebCore24CanvasRenderingContext2D12putImageDataEPNS_9ImageDataEffffffRi
-__ZN7WebCore11ImageBuffer12putImageDataEPNS_9ImageDataERKNS_7IntRectERKNS_8IntPointE
-__ZN7WebCore16jsImageDataWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17jsImageDataHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionSetTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D12setTransformEffffff
-__ZNK7WebCore17HTMLCanvasElement13baseTransformEv
-__ZN7WebCore20TransformationMatrix8multiplyERKS0_
-__ZN7WebCore24CanvasRenderingContext2D12setFillColorERKNS_6StringE
-__ZN7WebCore24CanvasRenderingContext2D12setFillColorERKNS_6StringEf
-__ZN7WebCore11CanvasStyleC1ERKNS_6StringEf
-__ZN7WebCore24CanvasRenderingContext2D12setFillColorEf
-__ZN7WebCore11CanvasStyleC1Eff
-__ZN7WebCore24CanvasRenderingContext2D12setFillColorEff
-__ZN7WebCore24CanvasRenderingContext2D12setFillColorEfffff
-__ZN7WebCore11CanvasStyleC1Efffff
-__ZN7WebCore57jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26JSCanvasRenderingContext2D14setStrokeColorEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D14setStrokeColorERKNS_6StringE
-__ZN7WebCore24CanvasRenderingContext2D14setStrokeColorERKNS_6StringEf
-__ZN7WebCore24CanvasRenderingContext2D14setStrokeColorEf
-__ZN7WebCore24CanvasRenderingContext2D14setStrokeColorEff
-__ZN7WebCore24CanvasRenderingContext2D14setStrokeColorEffff
-__ZN7WebCore24CanvasRenderingContext2D14setStrokeColorEfffff
-__ZN7WebCore58jsCanvasRenderingContext2DPrototypeFunctionCreateImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore24CanvasRenderingContext2D15createImageDataEff
-__ZN7WebCoreL20createEmptyImageDataERKNS_7IntSizeE
-__ZN7WebCore35jsCanvasRenderingContext2DFillStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26JSCanvasRenderingContext2D9fillStyleEPN3JSC9ExecStateE
-__ZNK7WebCore24CanvasRenderingContext2D9fillStyleEv
-__ZN7WebCoreL4toJSEPN3JSC9ExecStateEPNS_11CanvasStyleE
-__ZN7WebCore37jsCanvasRenderingContext2DStrokeStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26JSCanvasRenderingContext2D11strokeStyleEPN3JSC9ExecStateE
-__ZNK7WebCore24CanvasRenderingContext2D11strokeStyleEv
-__ZN7WebCore60jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore26JSCanvasRenderingContext2D17drawImageFromRectEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore24CanvasRenderingContext2D17drawImageFromRectEPNS_16HTMLImageElementEffffffffRKNS_6StringE
-__ZThn76_N7WebCore14CSSCanvasValue13canvasChangedEPNS_17HTMLCanvasElementERKNS_9FloatRectE
-__ZN7WebCore14CSSCanvasValue13canvasChangedEPNS_17HTMLCanvasElementERKNS_9FloatRectE
-__ZN7WebCore12CSSNamespaceD2Ev
-__ZN7WebCore12CSSNamespace18namespaceForPrefixERKNS_12AtomicStringE
-__ZN7WebCore9CSSParser11addVariableERKNS_15CSSParserStringEPNS_18CSSParserValueListE
-__ZN7WebCore9CSSParser19createVariablesRuleEPNS_9MediaListEb
-__ZN7WebCore9CSSParser21addUnresolvedPropertyEib
-__ZN7WebCore12CSSValueListC1EPNS_18CSSParserValueListE
-__ZN7WebCore14CSSParserValue14createCSSValueEv
-__ZN7WebCore25CSSVariableDependentValueC1EN3WTF10PassRefPtrINS_12CSSValueListEEE
-__ZNK7WebCore25CSSVariableDependentValue24isVariableDependentValueEv
-__ZN3WTF7HashMapIPN7WebCore26CSSMutableStyleDeclarationENS_6RefPtrIS2_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
-__ZNK7WebCore19CSSStyleDeclaration10parentRuleEv
-__ZN7WebCore7CSSRule6isRuleEv
-__ZN3WTF9HashTableIPN7WebCore26CSSMutableStyleDeclarationESt4pairIS3_NS_6RefPtrIS2_EEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6expandEv
-__ZN7WebCore16CSSStyleSelector30resolveVariablesForDeclarationEPNS_26CSSMutableStyleDeclarationES2_RN3WTF7HashSetINS_6StringENS_10StringHashENS3_10HashTraitsIS5_EEEE
-__ZN3WTF7HashMapIN7WebCore6StringEPNS1_16CSSVariablesRuleENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
-__ZNK7WebCore17CSSPrimitiveValue11parserValueEv
-__ZN7WebCore9CSSParser27addVariableDeclarationBlockERKNS_15CSSParserStringE
-__ZN7WebCore20jsCSSStyleSheetRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9StyleBase13isCharsetRuleEv
-__ZN7WebCore9StyleBase6isRuleEv
-__ZNK7WebCore12CSSMediaRule4typeEv
-__ZN7WebCore14JSCSSMediaRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSMediaRuleEEE
-__ZN7WebCore14JSCSSMediaRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22jsCSSMediaRuleCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15CSSFontFaceRule4typeEv
-__ZN7WebCore17JSCSSFontFaceRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15CSSFontFaceRuleEEE
-__ZN7WebCore17JSCSSFontFaceRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement13isTextControlEv
-__ZNK7WebCore4Node13isTextControlEv
-__ZNK7WebCore19HTMLTextAreaElement13isTextControlEv
-__ZNK7WebCore16StyleMarqueeDataeqERKS0_
-__ZN7WebCore23JSCSSMediaRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore41jsCSSMediaRulePrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore14JSCSSMediaRule9classInfoEv
-__ZN7WebCore12CSSMediaRule10insertRuleERKNS_6StringEjRi
-__ZN7WebCore11CSSRuleList10insertRuleEPNS_7CSSRuleEj
-__ZN7WebCore41jsCSSMediaRulePrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore12CSSMediaRule10deleteRuleEjRi
-__ZN7WebCoreL24scaleFactorForConversionEt
-__ZN7WebCore9CSSParser24parseTimingFunctionValueERPNS_18CSSParserValueListERd
-__ZNK7WebCore22CSSTimingFunctionValue21isTimingFunctionValueEv
-__ZSt21__inplace_stable_sortIPPN7WebCore11CSSFontFaceEPFbS2_S2_EEvT_S6_T0_
-__ZN7WebCore35jsCSSValueListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9CSSParser21parseDashboardRegionsEib
-__ZN7WebCoreL26skipCommaInDashboardRegionEPNS_18CSSParserValueListE
-__ZN3WTF10RefCountedIN7WebCore15DashboardRegionEE5derefEv
-__ZN7WebCoreL31createHTMLMarqueeElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore20JSHTMLMarqueeElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLMarqueeElementEEE
-__ZN7WebCore20JSHTMLMarqueeElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19StyleGeneratedImage8cssValueEv
-__ZN7WebCoreL18valueForRepeatRuleEi
-__ZNK7WebCore19CSSBorderImageValue7cssTextEv
-__ZNK7WebCore16CSSGradientValue7cssTextEv
-__ZNK7WebCore10JSCSSValue9classInfoEv
-__ZN7WebCore17JSCSSFontFaceRuleD0Ev
-__ZN7WebCore14JSCSSMediaRuleD0Ev
-__ZN7WebCore30jsCSSPrimitiveValueCSS_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsCSSPrimitiveValueCSS_PXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionGetStringValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore51jsCSSPrimitiveValuePrototypeFunctionGetCounterValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore17CSSPrimitiveValue15getCounterValueERi
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7CounterE
-__ZN7WebCore48jsCSSPrimitiveValuePrototypeFunctionGetRectValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore17CSSPrimitiveValue12getRectValueERi
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_4RectE
-__ZN7WebCore22jsCSSFontFaceRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore12CSSMediaRule7cssTextEv
-__ZNK7WebCore9MediaList9mediaTextEv
-__ZNK7WebCore10MediaQuery7cssTextEv
-__ZNK7WebCore15CSSFontFaceRule7cssTextEv
-__ZNK7WebCore13CSSImportRule4typeEv
-__ZN7WebCore15JSCSSImportRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSImportRuleEEE
-__ZN7WebCore15JSCSSImportRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25jsCSSImportRuleStyleSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCoreL39min_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL35device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL39max_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZNK7WebCore10StyleImage8isLoadedEv
-__ZN7WebCore14GeneratedImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
-__ZN7WebCore15JSCSSImportRuleD0Ev
-__ZN7WebCore11RenderStyle12clearContentEv
-__ZN7WebCore39jsDOMCoreExceptionINVALID_CHARACTER_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsEventExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore16JSEventException9classInfoEv
-__ZN7WebCore27jsEventExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore42jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsDOMCoreExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSImportRuleHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSImportRuleMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9MediaListE
+__ZN7WebCore11JSMediaList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSMediaListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9MediaListEEE
+__ZN7WebCore11JSMediaListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9MediaListEEE
+__ZN7WebCore11JSMediaList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsMediaListMediaTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSMediaRuleMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13CSSImportRule7cssTextEv
+__ZN7WebCore11JSMediaListD1Ev
+__ZN7WebCore11JSMediaListD2Ev
+__ZN7WebCore20JSMediaListPrototypeD1Ev
+__ZN7WebCore14JSCSSStyleRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSCSSRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19setJSCSSRuleCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore7CSSRule10setCssTextERKNS_6StringERi
+__ZN7WebCore29setJSCSSStyleRuleSelectorTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12CSSStyleRule15setSelectorTextERKNS_6StringERi
+__ZN7WebCore10JSCSSValue3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20setJSCSSValueCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11JSMediaList3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore23setJSMediaListMediaTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39jsCSSStyleSheetPrototypeFunctionAddRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_Ri
+__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_iRi
+__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionRemoveRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSStyleSheet3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore23setJSStyleSheetDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38jsRangePrototypeFunctionDeleteContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateHTMLDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore17DOMImplementation18createHTMLDocumentERKNS_6StringE
+__ZN7WebCore20setJSHTMLDocumentDirEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12HTMLDocument6setDirERKNS_6StringE
+__ZN7WebCore17setJSDocumentBodyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document7setBodyEN3WTF10PassRefPtrINS_11HTMLElementEEERi
+__ZN7WebCore20setJSDocumentCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document10setCharsetERKNS_6StringE
+__ZN7WebCore34setJSDocumentSelectedStylesheetSetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document24setSelectedStylesheetSetERKNS_6StringE
+__ZN7WebCore31jsDocumentSelectedStylesheetSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document21selectedStylesheetSetEv
+__ZN7WebCore21jsHTMLDocumentFgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument7fgColorEv
+__ZN7WebCore27setJSHTMLDocumentAlinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12HTMLDocument13setAlinkColorERKNS_6StringE
+__ZN7WebCore24jsHTMLDocumentAlinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument10alinkColorEv
+__ZN7WebCore23jsHTMLDocumentLinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument9linkColorEv
+__ZN7WebCore24jsHTMLDocumentVlinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument10vlinkColorEv
+__ZN7WebCore11HTMLElement6setDirERKNS_6StringE
+__ZNK7WebCore17HTMLObjectElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore16HTMLParamElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore26jsDOMWindowAttrConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSAttr14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore15JSAttrPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSAttrConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSAttrConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowCharacterDataConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCharacterData14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSCharacterDataConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSCharacterDataConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCDATASectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCDATASection14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCDATASectionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSCDATASectionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCDATASectionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCDATASectionConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowCommentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSCommentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSCommentConstructor9classInfoEv
+__ZNK7WebCore21JSDocumentConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowDocumentFragmentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSDocumentFragment14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSDocumentFragmentConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSDocumentFragmentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSDocumentFragmentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSDocumentFragmentConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowDocumentTypeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSDocumentType14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSDocumentTypeConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSDocumentTypePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSDocumentTypeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSDocumentTypeConstructor9classInfoEv
+__ZN7WebCore28jsDOMWindowEntityConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8JSEntity14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore19JSEntityConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore17JSEntityPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSEntity15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSEntityConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSEntityConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowEntityReferenceConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSEntityReference14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSEntityReferenceConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSEntityReferencePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSEntityReferenceConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSEntityReferenceConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowHTMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSHTMLDocumentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSHTMLDocumentConstructor9classInfoEv
+__ZNK7WebCore17JSNodeConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowNotationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSNotation14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSNotationConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSNotationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSNotation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSNotationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSNotationConstructor9classInfoEv
+__ZN7WebCore43jsDOMWindowProcessingInstructionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSProcessingInstruction14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSProcessingInstructionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34JSProcessingInstructionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSProcessingInstructionConstructor9classInfoEv
+__ZNK7WebCore17JSTextConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLAnchorElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLAnchorElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLAnchorElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLAppletElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLAppletElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLAppletElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLAppletElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLAppletElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLAreaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLAreaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLAreaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLAreaElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLBaseElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLBaseElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLBaseElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLBaseElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLBaseElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLBaseFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLBaseFontElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLBaseFontElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLBaseFontElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLBaseFontElementConstructor9classInfoEv
+__ZN7WebCore43jsDOMWindowHTMLBlockquoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSHTMLBlockquoteElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSHTMLBlockquoteElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34JSHTMLBlockquoteElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSHTMLBlockquoteElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLBodyElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28JSHTMLBodyElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLBodyElementConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowHTMLBRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSHTMLBRElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSHTMLBRElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSHTMLBRElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSHTMLBRElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLButtonElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLButtonElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLButtonElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLCanvasElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLCanvasElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLCanvasElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLCanvasElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLCanvasElementConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowHTMLDirectoryElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSHTMLDirectoryElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLDirectoryElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSHTMLDirectoryElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSHTMLDirectoryElementConstructor9classInfoEv
+__ZN7WebCore27JSHTMLDivElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLDivElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLDListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLDListElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLDListElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLDListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLDListElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLEmbedElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLEmbedElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLEmbedElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLEmbedElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLFieldSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLFieldSetElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSHTMLFieldSetElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLFieldSetElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLFieldSetElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLFieldSetElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLFontElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLFontElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLFontElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLFontElementConstructor9classInfoEv
+__ZNK7WebCore28JSHTMLFormElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLFrameElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLFrameElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLFrameElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLFrameElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLFrameSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLFrameSetElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLFrameSetElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLFrameSetElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLFrameSetElementConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowHTMLHeadingElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31JSHTMLHeadingElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSHTMLHeadingElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLHeadElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLHeadElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLHeadElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLHeadElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLHeadElementConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowHTMLHRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSHTMLHRElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSHTMLHRElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSHTMLHRElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSHTMLHRElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLHtmlElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28JSHTMLHtmlElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLHtmlElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLIFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLIFrameElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLIFrameElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLImageElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLImageElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLImageElementConstructor9classInfoEv
+__ZNK7WebCore29JSHTMLInputElementConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowHTMLIsIndexElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSHTMLIsIndexElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLIsIndexElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSHTMLIsIndexElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSHTMLIsIndexElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLLabelElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLLabelElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLLabelElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLLabelElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLLabelElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLLegendElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLLegendElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLLegendElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLLegendElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLLegendElementConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowHTMLLIElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26JSHTMLLIElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSHTMLLIElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLLinkElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLLinkElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLLinkElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLLinkElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLLinkElementConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLMapElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLMapElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLMapElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSHTMLMapElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLMapElementConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowHTMLMarqueeElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSHTMLMarqueeElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLMarqueeElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLMarqueeElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSHTMLMarqueeElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSHTMLMarqueeElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLMenuElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLMenuElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLMenuElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLMenuElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLMenuElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLMetaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLMetaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLMetaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLMetaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLMetaElementConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLModElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSHTMLModElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLModElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLObjectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLObjectElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLObjectElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLObjectElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLObjectElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLOListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLOListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLOListElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLOptGroupElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLOptGroupElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLOptGroupElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLOptGroupElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLOptGroupElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLOptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLOptionElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLOptionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLOptionElementConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowHTMLParagraphElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33JSHTMLParagraphElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSHTMLParagraphElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLParamElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLParamElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLParamElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLParamElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLParamElementConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLPreElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLPreElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLPreElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSHTMLPreElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLPreElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLQuoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLQuoteElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLQuoteElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLQuoteElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLQuoteElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLScriptElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLScriptElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLScriptElementConstructor9classInfoEv
+__ZNK7WebCore30JSHTMLSelectElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLStyleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLStyleElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLStyleElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLStyleElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLStyleElementConstructor9classInfoEv
+__ZN7WebCore45jsDOMWindowHTMLTableCaptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSHTMLTableCaptionElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSHTMLTableCaptionElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSHTMLTableCaptionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSHTMLTableCaptionElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLTableColElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLTableColElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLTableColElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLTableColElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLTableColElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLTableElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLTableElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLTableElementConstructor9classInfoEv
+__ZN7WebCore45jsDOMWindowHTMLTableSectionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSHTMLTableSectionElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSHTMLTableSectionElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSHTMLTableSectionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSHTMLTableSectionElementConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowHTMLTableCellElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSHTMLTableCellElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLTableCellElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSHTMLTableCellElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSHTMLTableCellElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLTableRowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLTableRowElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLTableRowElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLTableRowElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLTableRowElementConstructor9classInfoEv
+__ZNK7WebCore32JSHTMLTextAreaElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLTitleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLTitleElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLTitleElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLTitleElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLTitleElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLUListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLUListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLUListElementConstructor9classInfoEv
+__ZNK7WebCore24JSHTMLElementConstructor9classInfoEv
+__ZN7WebCore46jsDOMWindowCanvasRenderingContext2DConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26JSCanvasRenderingContext2D14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore35JSCanvasRenderingContext2DPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37JSCanvasRenderingContext2DConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlot
+__ZNK7WebCore37JSCanvasRenderingContext2DConstructor9classInfoEv
+__ZN7WebCore31jsDOMWindowClipboardConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSClipboard14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSClipboardPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSClipboardConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSClipboardConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowCounterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCounter14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSCounterConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore18JSCounterPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSCounter15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSCounterConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSCounterConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowCSSCharsetRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSCSSCharsetRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCSSCharsetRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSCSSCharsetRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSCSSCharsetRuleConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowCSSFontFaceRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSCSSFontFaceRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSCSSFontFaceRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSCSSFontFaceRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSCSSFontFaceRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSCSSFontFaceRuleConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowCSSImportRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCSSImportRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSCSSImportRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSCSSImportRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSCSSImportRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSCSSImportRuleConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCSSMediaRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSMediaRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCSSMediaRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSCSSMediaRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSMediaRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCSSMediaRuleConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowCSSPageRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSCSSPageRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore22JSCSSPageRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSCSSPageRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSCSSPageRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSCSSPageRuleConstructor9classInfoEv
+__ZNK7WebCore30JSCSSPrimitiveValueConstructor9classInfoEv
+__ZNK7WebCore20JSCSSRuleConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowCSSRuleListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSCSSRuleList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSCSSRuleListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSCSSRuleListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSCSSRuleListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSCSSRuleListConstructor9classInfoEv
+__ZN7WebCore32JSCSSStyleDeclarationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSCSSStyleDeclarationConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCSSStyleRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSStyleRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSCSSStyleRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSStyleRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCSSStyleRuleConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowCSSStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCSSStyleSheet14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSCSSStyleSheetConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSCSSStyleSheetPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSCSSStyleSheetConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSCSSStyleSheetConstructor9classInfoEv
+__ZNK7WebCore21JSCSSValueConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCSSValueListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSValueList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCSSValueListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSCSSValueListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSValueListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCSSValueListConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowDOMImplementationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSDOMImplementation14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSDOMImplementationConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore28JSDOMImplementationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSDOMImplementationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSDOMImplementationConstructor9classInfoEv
+__ZNK7WebCore18JSEventConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLCollectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLCollection14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLCollectionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLCollectionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLCollectionConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowKeyboardEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSKeyboardEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSKeyboardEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSKeyboardEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSKeyboardEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSKeyboardEventConstructor9classInfoEv
+__ZN7WebCore31jsDOMWindowMediaListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSMediaList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSMediaListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSMediaListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSMediaListConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowMimeTypeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSMimeType14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSMimeTypeConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSMimeTypePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSMimeTypeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSMimeTypeConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowMimeTypeArrayConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSMimeTypeArray14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSMimeTypeArrayConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSMimeTypeArrayPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSMimeTypeArrayConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSMimeTypeArrayConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowMouseEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSMouseEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSMouseEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSMouseEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSMouseEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSMouseEventConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowMutationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSMutationEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSMutationEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSMutationEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSMutationEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSMutationEventConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowNamedNodeMapConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSNamedNodeMapConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSNamedNodeMapPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSNamedNodeMapConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSNamedNodeMapConstructor9classInfoEv
+__ZNK7WebCore23JSNodeFilterConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowNodeListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSNodeListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSNodeListConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowOverflowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSOverflowEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSOverflowEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSOverflowEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSOverflowEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSOverflowEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSOverflowEventConstructor9classInfoEv
+__ZN7WebCore28jsDOMWindowPluginConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8JSPlugin14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore19JSPluginConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore17JSPluginPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSPluginConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSPluginConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowPluginArrayConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSPluginArray14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSPluginArrayConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSPluginArrayPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSPluginArrayConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSPluginArrayConstructor9classInfoEv
+__ZN7WebCore27jsDOMWindowRangeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7JSRange14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore18JSRangeConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore16JSRangePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSRangeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSRangeConstructor9classInfoEv
+__ZN7WebCore26jsDOMWindowRectConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSRect14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSRectConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore15JSRectPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSRectConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSRectConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSStyleSheet14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSStyleSheetConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSStyleSheetConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowStyleSheetListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSStyleSheetList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSStyleSheetListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSStyleSheetListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSStyleSheetListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSStyleSheetListConstructor9classInfoEv
+__ZN7WebCore31jsDOMWindowTextEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSTextEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore22JSTextEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore20JSTextEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSTextEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSTextEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSTextEventConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowUIEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSUIEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSUIEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore20JSUIEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSUIEventConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowWheelEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSWheelEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSWheelEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSWheelEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSWheelEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSWheelEventConstructor9classInfoEv
+__ZNK7WebCore24JSXPathResultConstructor9classInfoEv
+__ZN7WebCore28jsDOMWindowWorkerConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow6workerEPN3JSC9ExecStateE
+__ZN7WebCore19JSWorkerConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore19JSWorkerConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore17JSWorkerPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSWorker15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSWorkerConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL15constructWorkerEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore36jsDOMWindowXPathEvaluatorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSXPathEvaluator14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSXPathEvaluatorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSXPathEvaluatorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSXPathEvaluator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSXPathEvaluatorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCore27JSXPathEvaluatorConstructor16getConstructDataERN3JSC13ConstructDataE
 __ZN7WebCore27JSXPathEvaluatorConstructor9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14XPathEvaluatorE
 __ZN7WebCore16JSXPathEvaluatorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathEvaluatorEEE
+__ZN7WebCore16JSXPathEvaluatorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathEvaluatorEEE
 __ZN7WebCore16JSXPathEvaluator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCore25JSXPathEvaluatorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore49jsXPathEvaluatorPrototypeFunctionCreateNSResolverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
 __ZNK7WebCore16JSXPathEvaluator9classInfoEv
-__ZN7WebCore41jsXPathEvaluatorPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore41jsXPathExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore24JSXSLTProcessorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSXSLTProcessor9classInfoEv
+__ZN7WebCore18JSAudioConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL14constructAudioEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore18JSAudioConstructor8documentEv
+__ZN7WebCore16JSXPathEvaluatorD1Ev
+__ZN7WebCore16JSXPathEvaluatorD2Ev
+__ZThn8_N7WebCore16HTMLAudioElementD0Ev
+__ZN7WebCore28JSEntityReferenceConstructorD1Ev
+__ZN7WebCore17JSEntityPrototypeD1Ev
+__ZN7WebCore19JSEntityConstructorD1Ev
+__ZN7WebCore25JSDocumentTypeConstructorD1Ev
+__ZN7WebCore29JSDocumentFragmentConstructorD1Ev
+__ZN7WebCore25JSCDATASectionConstructorD1Ev
+__ZN7WebCore26JSCharacterDataConstructorD1Ev
+__ZN7WebCore17JSAttrConstructorD1Ev
+__ZN7WebCore26JSHTMLHRElementConstructorD1Ev
+__ZN7WebCore28JSHTMLHeadElementConstructorD1Ev
+__ZN7WebCore32JSHTMLFrameSetElementConstructorD1Ev
+__ZN7WebCore29JSHTMLFrameElementConstructorD1Ev
+__ZN7WebCore28JSHTMLFontElementConstructorD1Ev
+__ZN7WebCore32JSHTMLFieldSetElementConstructorD1Ev
+__ZN7WebCore29JSHTMLEmbedElementConstructorD1Ev
+__ZN7WebCore29JSHTMLDListElementConstructorD1Ev
+__ZN7WebCore30JSHTMLCanvasElementConstructorD1Ev
+__ZN7WebCore26JSHTMLBRElementConstructorD1Ev
+__ZN7WebCore34JSHTMLBlockquoteElementConstructorD1Ev
+__ZN7WebCore32JSHTMLBaseFontElementConstructorD1Ev
+__ZN7WebCore28JSHTMLBaseElementConstructorD1Ev
+__ZN7WebCore28JSHTMLAreaElementConstructorD1Ev
+__ZN7WebCore30JSHTMLAppletElementConstructorD1Ev
+__ZN7WebCore19JSNotationPrototypeD1Ev
+__ZN7WebCore33JSHTMLDirectoryElementConstructorD1Ev
+__ZN7WebCore21JSNotationConstructorD1Ev
+__ZN7WebCore34JSProcessingInstructionConstructorD1Ev
+__ZN7WebCore31JSHTMLIsIndexElementConstructorD1Ev
+__ZN7WebCore29JSHTMLLabelElementConstructorD1Ev
+__ZN7WebCore30JSHTMLLegendElementConstructorD1Ev
+__ZN7WebCore28JSHTMLLinkElementConstructorD1Ev
+__ZN7WebCore27JSHTMLMapElementConstructorD1Ev
+__ZN7WebCore31JSHTMLMarqueeElementConstructorD1Ev
+__ZN7WebCore28JSHTMLMenuElementConstructorD1Ev
+__ZN7WebCore28JSHTMLMetaElementConstructorD1Ev
+__ZN7WebCore30JSHTMLObjectElementConstructorD1Ev
+__ZN7WebCore29JSHTMLOListElementConstructorD1Ev
+__ZN7WebCore32JSHTMLOptGroupElementConstructorD1Ev
+__ZN7WebCore30JSHTMLOptionElementConstructorD1Ev
+__ZN7WebCore29JSHTMLParamElementConstructorD1Ev
+__ZN7WebCore27JSHTMLPreElementConstructorD1Ev
+__ZN7WebCore29JSHTMLQuoteElementConstructorD1Ev
+__ZN7WebCore29JSHTMLStyleElementConstructorD1Ev
+__ZN7WebCore36JSHTMLTableCaptionElementConstructorD1Ev
+__ZN7WebCore32JSHTMLTableColElementConstructorD1Ev
+__ZN7WebCore36JSHTMLTableSectionElementConstructorD1Ev
+__ZN7WebCore33JSHTMLTableCellElementConstructorD1Ev
+__ZN7WebCore32JSHTMLTableRowElementConstructorD1Ev
+__ZN7WebCore29JSHTMLTitleElementConstructorD1Ev
+__ZN7WebCore37JSCanvasRenderingContext2DConstructorD1Ev
+__ZN7WebCore22JSClipboardConstructorD1Ev
+__ZN7WebCore20JSCounterConstructorD1Ev
+__ZN7WebCore18JSCounterPrototypeD1Ev
+__ZN7WebCore27JSCSSCharsetRuleConstructorD1Ev
+__ZN7WebCore28JSCSSFontFaceRuleConstructorD1Ev
+__ZN7WebCore26JSCSSImportRuleConstructorD1Ev
+__ZN7WebCore25JSCSSMediaRuleConstructorD1Ev
+__ZN7WebCore24JSCSSPageRuleConstructorD1Ev
+__ZN7WebCore22JSCSSPageRulePrototypeD1Ev
+__ZN7WebCore24JSCSSRuleListConstructorD1Ev
+__ZN7WebCore25JSCSSStyleRuleConstructorD1Ev
+__ZN7WebCore26JSCSSStyleSheetConstructorD1Ev
+__ZN7WebCore25JSCSSValueListConstructorD1Ev
+__ZN7WebCore30JSDOMImplementationConstructorD1Ev
+__ZN7WebCore27JSHTMLCollectionConstructorD1Ev
+__ZN7WebCore26JSKeyboardEventConstructorD1Ev
+__ZN7WebCore22JSMediaListConstructorD1Ev
+__ZN7WebCore21JSMimeTypeConstructorD1Ev
+__ZN7WebCore26JSMimeTypeArrayConstructorD1Ev
+__ZN7WebCore23JSMouseEventConstructorD1Ev
+__ZN7WebCore26JSMutationEventConstructorD1Ev
+__ZN7WebCore25JSNamedNodeMapConstructorD1Ev
+__ZN7WebCore26JSOverflowEventConstructorD1Ev
+__ZN7WebCore24JSOverflowEventPrototypeD1Ev
+__ZN7WebCore19JSPluginConstructorD1Ev
+__ZN7WebCore24JSPluginArrayConstructorD1Ev
+__ZN7WebCore18JSRangeConstructorD1Ev
+__ZN7WebCore17JSRectConstructorD1Ev
+__ZN7WebCore15JSRectPrototypeD1Ev
+__ZN7WebCore23JSStyleSheetConstructorD1Ev
+__ZN7WebCore27JSStyleSheetListConstructorD1Ev
+__ZN7WebCore22JSTextEventConstructorD1Ev
+__ZN7WebCore20JSTextEventPrototypeD1Ev
+__ZN7WebCore20JSUIEventConstructorD1Ev
+__ZN7WebCore23JSWheelEventConstructorD1Ev
+__ZN7WebCore21JSWheelEventPrototypeD1Ev
+__ZN7WebCore19JSWorkerConstructorD1Ev
+__ZN7WebCore17JSWorkerPrototypeD1Ev
+__ZN7WebCore27JSXPathEvaluatorConstructorD1Ev
+__ZN7WebCore25JSXPathEvaluatorPrototypeD1Ev
+__ZN7WebCoreL14warningHandlerEPvPKcz
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplES3_NS_7PtrHashIS3_EENS_10HashTraitsIS3_EES7_E3setERKS3_SA_
+__ZN7WebCore48jsRangePrototypeFunctionCreateContextualFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore5Range24createContextualFragmentERKNS_6StringERi
+__ZN7WebCore16JSHTMLCollection16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore25JSHTMLCollectionPrototype9classInfoEv
+__ZN7WebCore14JSNamedNodeMap16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore23JSNamedNodeMapPrototype9classInfoEv
+__ZN7WebCore17JSHTMLFormElement16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore26JSHTMLFormElementPrototype9classInfoEv
+__ZNK7WebCore22JSHTMLElementPrototype9classInfoEv
+__ZNK7WebCore18JSElementPrototype9classInfoEv
+__ZNK7WebCore15JSNodePrototype9classInfoEv
+__ZN7WebCore17JSHTMLFormElement11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore15HTMLFormElement4itemEj
+__ZN7WebCore36jsNodeDOCUMENT_POSITION_CONTAINED_BYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsNodeDOCUMENT_POSITION_CONTAINSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsNodeDOCUMENT_POSITION_DISCONNECTEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodeDOCUMENT_POSITION_FOLLOWINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodeDOCUMENT_POSITION_PRECEDINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNodeDOCUMENT_TYPE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsNodeENTITY_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsNodeENTITY_REFERENCE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsNodeNOTATION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodePROCESSING_INSTRUCTION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsElementChildElementCountEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element17childElementCountEv
+__ZN7WebCore28jsHTMLElementContentEditableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement15contentEditableEv
+__ZN7WebCore25jsHTMLFormElementEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsElementFirstElementChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLElementIsContentEditableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsElementLastElementChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element16lastElementChildEv
+__ZN7WebCore27jsElementNextElementSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element18nextElementSiblingEv
+__ZN7WebCore22jsHTMLElementOuterTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element9outerTextEv
+__ZN7WebCore31jsElementPreviousElementSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element22previousElementSiblingEv
+__ZN7WebCore19JSHTMLSelectElement16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore28JSHTMLSelectElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLSelectElementAutofocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLSelectElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore22HTMLFormControlElement12willValidateEv
+__ZN7WebCore16JSStyleSheetList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore25JSStyleSheetListPrototype9classInfoEv
+__ZN7WebCore13JSCSSRuleList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore22JSCSSRuleListPrototype9classInfoEv
+__ZN7WebCore21JSCSSStyleDeclaration16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore30JSCSSStyleDeclarationPrototype9classInfoEv
+__ZN7WebCore14JSCSSValueList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore23JSCSSValueListPrototype9classInfoEv
+__ZNK7WebCore19JSCSSValuePrototype9classInfoEv
+__ZN7WebCore14JSCSSValueList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore22jsCSSValueCssValueTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSValueListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSMediaList9classInfoEv
+__ZN7WebCore11JSMediaList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore20JSMediaListPrototype9classInfoEv
+__ZN7WebCore20JSMediaListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11JSMediaList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore9MediaList4itemEj
+__ZN7WebCore17jsMediaListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsMediaListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15setJSNodePrefixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore7Element9setPrefixERKNS_12AtomicStringERi
+__ZN7WebCore4Node14checkSetPrefixERKNS_12AtomicStringERi
+__ZN7WebCore20setJSHTMLElementLangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement7setLangERKNS_6StringE
+__ZN7WebCore19setJSHTMLElementDirEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLAnchorElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement10setCharsetERKNS_12AtomicStringE
+__ZN7WebCore28setJSHTMLAnchorElementCoordsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement9setCoordsERKNS_12AtomicStringE
+__ZN7WebCore30setJSHTMLAnchorElementHreflangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement11setHreflangERKNS_12AtomicStringE
+__ZN7WebCore25setJSHTMLAnchorElementRevEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement6setRevERKNS_12AtomicStringE
+__ZN7WebCore27setJSHTMLAnchorElementShapeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement8setShapeERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAnchorElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement7setTypeERKNS_12AtomicStringE
+__ZN7WebCore27setJSHTMLAppletElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLPlugInElement8setAlignERKNS_6StringE
+__ZN7WebCore25setJSHTMLAppletElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAppletElement6setAltERKNS_6StringE
+__ZN7WebCore29setJSHTMLAppletElementArchiveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAppletElement10setArchiveERKNS_6StringE
+__ZN7WebCore26setJSHTMLAppletElementCodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAppletElement7setCodeERKNS_6StringE
+__ZN7WebCore30setJSHTMLAppletElementCodeBaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAppletElement11setCodeBaseERKNS_6StringE
+__ZN7WebCore28setJSHTMLAppletElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore28setJSHTMLAppletElementHspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAppletElement9setHspaceERKNS_6StringE
+__ZN7WebCore26setJSHTMLAppletElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLPlugInElement7setNameERKNS_6StringE
+__ZN7WebCore28setJSHTMLAppletElementObjectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAppletElement9setObjectERKNS_6StringE
+__ZN7WebCore28setJSHTMLAppletElementVspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAppletElement9setVspaceERKNS_6StringE
+__ZN7WebCore27setJSHTMLAppletElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLAreaElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement12setAccessKeyERKNS_12AtomicStringE
+__ZN7WebCore23setJSHTMLAreaElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement6setAltERKNS_12AtomicStringE
+__ZN7WebCore25setJSHTMLAreaElementShapeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement8setShapeERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAreaElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement9setTargetERKNS_12AtomicStringE
+__ZN7WebCore24setJSHTMLBaseElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLBaseElement7setHrefERKNS_6StringE
+__ZN7WebCore26setJSHTMLBaseElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLBaseElement9setTargetERKNS_6StringE
+__ZN7WebCore21JSHTMLBaseFontElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLBaseFontElementColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLBaseFontElement8setColorERKNS_6StringE
+__ZN7WebCore28setJSHTMLBaseFontElementFaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLBaseFontElement7setFaceERKNS_6StringE
+__ZN7WebCore30setJSHTMLBlockquoteElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21HTMLBlockquoteElement7setCiteERKNS_6StringE
+__ZN7WebCore25setJSHTMLBodyElementALinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLBodyElement8setALinkERKNS_6StringE
+__ZN7WebCore30setJSHTMLBodyElementBackgroundEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLBodyElement13setBackgroundERKNS_6StringE
+__ZN7WebCore27setJSHTMLBodyElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLBodyElementLinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLBodyElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLBodyElementVLinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSHTMLBRElementClearEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13HTMLBRElement8setClearERKNS_6StringE
+__ZN7WebCore31setJSHTMLButtonElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLButtonElement12setAccessKeyERKNS_6StringE
+__ZN7WebCore27setJSHTMLButtonElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLButtonElement8setValueERKNS_6StringE
+__ZN7WebCore24setJSHTMLDivElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14HTMLDivElement8setAlignERKNS_6StringE
+__ZN7WebCore26setJSHTMLEmbedElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23jsHTMLEmbedElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25setJSHTMLEmbedElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLEmbedElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLEmbedElement6setSrcERKNS_6StringE
+__ZN7WebCore25setJSHTMLEmbedElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLEmbedElement7setTypeERKNS_6StringE
+__ZN7WebCore25setJSHTMLFontElementColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFontElement8setColorERKNS_6StringE
+__ZN7WebCore24setJSHTMLFontElementFaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFontElement7setFaceERKNS_6StringE
+__ZN7WebCore24setJSHTMLFontElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFontElement7setSizeERKNS_6StringE
+__ZN7WebCore28setJSHTMLFormElementEncodingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement10setEnctypeERKNS_6StringE
+__ZN7WebCore27setJSHTMLFormElementEnctypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLFrameElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSHTMLFrameElementFrameBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLFrameElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase11setLongDescERKNS_6StringE
+__ZN7WebCore33setJSHTMLFrameElementMarginHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSHTMLFrameElementMarginWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLFrameElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSHTMLFrameElementScrollingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLFrameElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLFrameElement6setSrcEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore29setJSHTMLFrameElementLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLFrameElement11setLocationEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26jsHTMLFrameElementLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase8locationEv
+__ZN7WebCore21JSHTMLFrameSetElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore28setJSHTMLFrameSetElementColsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLFrameSetElement7setColsERKNS_6StringE
+__ZN7WebCore28setJSHTMLFrameSetElementRowsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLFrameSetElement7setRowsERKNS_6StringE
+__ZN7WebCore27setJSHTMLHeadElementProfileEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLHeadElement10setProfileERKNS_6StringE
+__ZN7WebCore28setJSHTMLHeadingElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18HTMLHeadingElement8setAlignERKNS_6StringE
+__ZN7WebCore23setJSHTMLHRElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13HTMLHRElement8setAlignERKNS_6StringE
+__ZN7WebCore22setJSHTMLHRElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13HTMLHRElement7setSizeERKNS_6StringE
+__ZN7WebCore23setJSHTMLHRElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13HTMLHRElement8setWidthERKNS_6StringE
+__ZN7WebCore27setJSHTMLHtmlElementVersionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLHtmlElement10setVersionERKNS_6StringE
+__ZN7WebCore27setJSHTMLIFrameElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLIFrameElement8setAlignERKNS_6StringE
+__ZN7WebCore30setJSHTMLIFrameElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLImageElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement7setNameERKNS_6StringE
+__ZN7WebCore29setJSHTMLImageElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement11setLongDescERKNS_6StringE
+__ZN7WebCore27setJSHTMLImageElementLowsrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setLowsrcERKNS_6StringE
+__ZN7WebCore24jsHTMLImageElementLowsrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6lowsrcEv
+__ZN7WebCore27setJSHTMLInputElementAcceptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement9setAcceptERKNS_6StringE
+__ZN7WebCore30setJSHTMLInputElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement12setAccessKeyERKNS_6StringE
+__ZN7WebCore26setJSHTMLInputElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement8setAlignERKNS_6StringE
+__ZN7WebCore24setJSHTMLInputElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement6setAltERKNS_6StringE
+__ZN7WebCore33setJSHTMLInputElementDefaultValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement15setDefaultValueERKNS_6StringE
+__ZN7WebCore24setJSHTMLInputElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement6setSrcERKNS_6StringE
+__ZN7WebCore7Element15removeAttributeERKNS_13QualifiedNameERi
+__ZN7WebCore27setJSHTMLInputElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement9setUseMapERKNS_6StringE
+__ZN7WebCore20JSHTMLIsIndexElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLIsIndexElementPromptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18HTMLIsIndexElement9setPromptERKNS_6StringE
+__ZN7WebCore30setJSHTMLLabelElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLLabelElement12setAccessKeyERKNS_6StringE
+__ZN7WebCore31setJSHTMLLegendElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLLegendElement12setAccessKeyERKNS_6StringE
+__ZN7WebCore27setJSHTMLLegendElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLLegendElement8setAlignERKNS_6StringE
+__ZN7WebCore22setJSHTMLLIElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13HTMLLIElement7setTypeERKNS_6StringE
+__ZN7WebCore27setJSHTMLLinkElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement10setCharsetERKNS_6StringE
+__ZN7WebCore28setJSHTMLLinkElementHreflangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement11setHreflangERKNS_6StringE
+__ZN7WebCore23setJSHTMLLinkElementRevEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement6setRevERKNS_6StringE
+__ZN7WebCore26setJSHTMLLinkElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement9setTargetERKNS_6StringE
+__ZN7WebCore23setJSHTMLMapElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14HTMLMapElement7setNameERKNS_6StringE
+__ZN7WebCore29setJSHTMLMetaElementHttpEquivEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLMetaElement12setHttpEquivERKNS_6StringE
+__ZN7WebCore26setJSHTMLMetaElementSchemeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLMetaElement9setSchemeERKNS_6StringE
+__ZN7WebCore23setJSHTMLModElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14HTMLModElement7setCiteERKNS_6StringE
+__ZN7WebCore27setJSHTMLModElementDateTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14HTMLModElement11setDateTimeERKNS_6StringE
+__ZN7WebCore26setJSHTMLObjectElementCodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement7setCodeERKNS_6StringE
+__ZN7WebCore27setJSHTMLObjectElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLObjectElementArchiveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement10setArchiveERKNS_6StringE
+__ZN7WebCore28setJSHTMLObjectElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement9setBorderERKNS_6StringE
+__ZN7WebCore30setJSHTMLObjectElementCodeBaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement11setCodeBaseERKNS_6StringE
+__ZN7WebCore30setJSHTMLObjectElementCodeTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement11setCodeTypeERKNS_6StringE
+__ZN7WebCore28setJSHTMLObjectElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSHTMLObjectElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLObjectElementStandbyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement10setStandbyERKNS_6StringE
+__ZN7WebCore28setJSHTMLObjectElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement9setUseMapERKNS_6StringE
+__ZN7WebCore27setJSHTMLObjectElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLOListElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLOListElement7setTypeERKNS_6StringE
+__ZN7WebCore21JSHTMLOptGroupElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLOptGroupElementLabelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLOptGroupElement8setLabelERKNS_6StringE
+__ZN7WebCore27setJSHTMLOptionElementLabelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLOptionElement8setLabelERKNS_6StringE
+__ZN7WebCore30setJSHTMLParagraphElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLParagraphElement8setAlignERKNS_6StringE
+__ZN7WebCore25setJSHTMLParamElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLParamElement7setTypeERKNS_6StringE
+__ZN7WebCore30setJSHTMLParamElementValueTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLParamElement12setValueTypeERKNS_6StringE
+__ZN7WebCore18JSHTMLQuoteElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLQuoteElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLQuoteElement7setCiteERKNS_6StringE
+__ZN7WebCore29setJSHTMLScriptElementHtmlForEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement10setHtmlForERKNS_6StringE
+__ZN7WebCore27setJSHTMLScriptElementEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement8setEventERKNS_6StringE
+__ZN7WebCore26setJSHTMLSelectElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSHTMLStyleElementMediaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLStyleElement8setMediaERKNS_12AtomicStringE
+__ZN7WebCore25JSHTMLTableCaptionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore33setJSHTMLTableCaptionElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23HTMLTableCaptionElement8setAlignERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableCellElementAbbrEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement7setAbbrERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement8setAlignERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableCellElementAxisEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement7setAxisERKNS_6StringE
+__ZN7WebCore32setJSHTMLTableCellElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement10setBgColorERKNS_6StringE
+__ZN7WebCore27setJSHTMLTableCellElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement5setChERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement8setChOffERKNS_6StringE
+__ZN7WebCore32setJSHTMLTableCellElementHeadersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement10setHeadersERKNS_6StringE
+__ZN7WebCore31setJSHTMLTableCellElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement9setHeightERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementScopeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement8setScopeERKNS_6StringE
+__ZN7WebCore31setJSHTMLTableCellElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement9setVAlignERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement8setWidthERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableColElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableColElement8setAlignERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableColElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableColElement5setChERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableColElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableColElement8setChOffERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableColElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableColElement9setVAlignERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableColElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableColElement8setWidthERKNS_6StringE
+__ZN7WebCore28setJSHTMLTableElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement10setBgColorERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableElementFrameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement8setFrameERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableElementRulesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement8setRulesERKNS_6StringE
+__ZN7WebCore28setJSHTMLTableElementSummaryEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement10setSummaryERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableRowElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableRowElement8setAlignERKNS_6StringE
+__ZN7WebCore31setJSHTMLTableRowElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableRowElement10setBgColorERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableRowElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableRowElement5setChERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableRowElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableRowElement8setChOffERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableRowElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableRowElement9setVAlignERKNS_6StringE
+__ZN7WebCore33setJSHTMLTableSectionElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23HTMLTableSectionElement8setAlignERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableSectionElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23HTMLTableSectionElement5setChERKNS_6StringE
+__ZN7WebCore33setJSHTMLTableSectionElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23HTMLTableSectionElement8setChOffERKNS_6StringE
+__ZN7WebCore34setJSHTMLTableSectionElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23HTMLTableSectionElement9setVAlignERKNS_6StringE
+__ZN7WebCore36setJSHTMLTextAreaElementDefaultValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement15setDefaultValueERKNS_6StringE
+__ZN7WebCore33setJSHTMLTextAreaElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement12setAccessKeyERKNS_6StringE
+__ZN7WebCore28setJSHTMLTextAreaElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLTitleElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLUListElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLUListElement7setTypeERKNS_6StringE
+__ZThn8_N7WebCore16HTMLEmbedElementD0Ev
+__ZNK3JSC8Bindings12ObjcInstance12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8Bindings12ObjcInstance7valueOfEPNS_9ExecStateE
+__ZNK3JSC8Bindings12ObjcInstance11stringValueEPNS_9ExecStateE
+__ZN7WebCore19jsDOMWindowOnsubmitEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onsubmitEv
+__ZN7WebCore38jsDOMWindowHTMLAudioElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLAudioElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLAudioElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLAudioElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLAudioElementConstructor9classInfoEv
+__ZN7WebCore44jsDOMWindowSVGPreserveAspectRatioConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSSVGPreserveAspectRatio14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore33JSSVGPreserveAspectRatioPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGPreserveAspectRatio15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore35JSSVGPreserveAspectRatioConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore35JSSVGPreserveAspectRatioConstructor9classInfoEv
+__ZN7WebCore18jsDOMWindowMenubarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7menubarEv
+__ZNK7WebCore9JSBarInfo9classInfoEv
+__ZN7WebCore30jsDOMWindowSVGAngleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSSVGAngle14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore19JSSVGAnglePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGAngle15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGAngleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSSVGAngleConstructor9classInfoEv
+__ZN7WebCore21jsDOMWindowScrollbarsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10scrollbarsEv
+__ZN7WebCore30jsDOMWindowSVGPaintConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSSVGPaint14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGPaintConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSSVGPaintPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGPaint15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGColorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGColor15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPaintConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSSVGPaintConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowDOMStringListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSDOMStringList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSDOMStringListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSDOMStringListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSDOMStringList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSDOMStringListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSDOMStringListConstructor9classInfoEv
+__ZN7WebCore18jsDOMWindowOnfocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onfocusEv
+__ZN7WebCore21jsDOMWindowOuterWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10outerWidthEv
+__ZN7WebCore18jsDOMWindowOnresetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onresetEv
+__ZN7WebCore37jsDOMWindowOnwebkitanimationiterationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow26onwebkitanimationiterationEv
+__ZNK7WebCore28JSWebKitCSSMatrixConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowWebKitPointConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow11webKitPointEPN3JSC9ExecStateE
+__ZN7WebCore24JSWebKitPointConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore24JSWebKitPointConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSWebKitPointPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSWebKitPoint15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore24JSWebKitPointConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowXMLHttpRequestUploadConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSXMLHttpRequestUpload14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSXMLHttpRequestUploadPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSXMLHttpRequestUpload15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSXMLHttpRequestUploadConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSXMLHttpRequestUploadConstructor9classInfoEv
+__ZNK7WebCore22JSDOMParserConstructor9classInfoEv
+__ZNK7WebCore8JSScreen9classInfoEv
+__ZN7WebCore25jsDOMWindowSessionStorageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow14sessionStorageEv
+__ZN7WebCore14SessionStorage6createEPNS_4PageE
+__ZN7WebCore14SessionStorageC1EPNS_4PageE
+__ZN7WebCore14SessionStorageC2EPNS_4PageE
+__ZN7WebCore14SessionStorage11storageAreaEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_18SessionStorageAreaEEENS2_18SecurityOriginHashENS_10HashTrai
+__ZN7WebCore18SessionStorageAreaC1EPNS_14SecurityOriginEPNS_4PageE
+__ZN7WebCore18SessionStorageAreaC2EPNS_14SecurityOriginEPNS_4PageE
+__ZN7WebCore11StorageAreaC2EPNS_14SecurityOriginE
+__ZN7WebCore10StorageMap6createEv
+__ZN7WebCore10StorageMapC1Ev
+__ZN7WebCore10StorageMapC2Ev
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_18SessionStorageAreaEEENS2_18SecurityOriginHashENS_10HashTrait
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_NS1_INS2_18SessionStorageAreaEEEENS_18PairFirstExtractorIS
+__ZN7WebCore19InspectorController16didUseDOMStorageEPNS_11StorageAreaEbPNS_5FrameE
+__ZN7WebCore7Storage6createEPNS_5FrameEN3WTF10PassRefPtrINS_11StorageAreaEEE
+__ZN7WebCore7StorageC1EPNS_5FrameEN3WTF10PassRefPtrINS_11StorageAreaEEE
+__ZN7WebCore7StorageC2EPNS_5FrameEN3WTF10PassRefPtrINS_11StorageAreaEEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7StorageE
+__ZN7WebCore9JSStorage15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSStorageC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7StorageEEE
+__ZN7WebCore9JSStorageC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7StorageEEE
+__ZN7WebCore9JSStorage18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSStorage18canGetItemsForNameEPN3JSC9ExecStateEPNS_7StorageERKNS1_10IdentifierE
+__ZNK7WebCore7Storage8containsERKNS_6StringE
+__ZNK7WebCore11StorageArea8containsERKNS_6StringE
+__ZNK7WebCore11StorageArea16internalContainsERKNS_6StringE
+__ZNK7WebCore10StorageMap8containsERKNS_6StringE
+__ZN7WebCore18JSStoragePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore9JSStorage9classInfoEv
+__ZNK7WebCore29JSDOMCoreExceptionConstructor9classInfoEv
+__ZN7WebCore28jsDOMWindowClientInformationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMWindowRangeExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSRangeException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSRangeExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSRangeExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSRangeException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSRangeExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSRangeExceptionConstructor9classInfoEv
+__ZN7WebCore23jsDOMWindowLocalStorageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow12localStorageEv
+__ZN7WebCore12LocalStorage11storageAreaEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_16LocalStorageAreaEEENS2_18SecurityOriginHashENS_10HashTraits
+__ZN7WebCore16LocalStorageAreaC1EPNS_14SecurityOriginEPNS_12LocalStorageE
+__ZN7WebCore16LocalStorageAreaC2EPNS_14SecurityOriginEPNS_12LocalStorageE
+__ZN7WebCore12LocalStorage14scheduleImportEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_16LocalStorageAreaEEENS2_18SecurityOriginHashENS_10HashTraitsI
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_NS1_INS2_16LocalStorageAreaEEEENS_18PairFirstExtractorIS8_
+__ZNK7WebCore16LocalStorageArea8containsERKNS_6StringE
+__ZN7WebCore29jsDOMWindowStorageConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSStorage14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSStorageConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore18JSStoragePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSStorageConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSStorageConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowMessageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSMessageEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSMessageEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSMessageEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSMessageEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSMessageEventConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowStorageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSStorageEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSStorageEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSStorageEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSStorageEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSStorageEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSStorageEventConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowOnwebkitanimationstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow22onwebkitanimationstartEv
+__ZN7WebCore19jsDOMWindowOnsearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onsearchEv
+__ZN7WebCore21jsDOMWindowOndblclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10ondblclickEv
+__ZNK7WebCore26JSXSLTProcessorConstructor9classInfoEv
+__ZNK7WebCore19JSWorkerConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowOnmousemoveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11onmousemoveEv
+__ZN7WebCore43jsDOMWindowWebKitTransitionEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSWebKitTransitionEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSWebKitTransitionEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore32JSWebKitTransitionEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSWebKitTransitionEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34JSWebKitTransitionEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSWebKitTransitionEventConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowOuterHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11outerHeightEv
+__ZN7WebCore45jsDOMWindowCSSVariablesDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSCSSVariablesDeclaration14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSCSSVariablesDeclarationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSVariablesDeclaration15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSCSSVariablesDeclarationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSCSSVariablesDeclarationConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowTextMetricsConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSTextMetrics14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSTextMetricsConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSTextMetricsPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSTextMetricsConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSTextMetricsConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowPersonalbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11personalbarEv
+__ZN7WebCore36jsDOMWindowClientRectListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSClientRectList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSClientRectListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSClientRectListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSClientRectList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSClientRectListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSClientRectListConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowSVGGradientElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGGradientElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSSVGGradientElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSSVGGradientElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGGradientElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGGradientElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSSVGGradientElementConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowProgressEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSProgressEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSProgressEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSProgressEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSProgressEventConstructor9classInfoEv
+__ZN7WebCore19jsDOMWindowOnselectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onselectEv
+__ZN7WebCore32jsDOMWindowMediaErrorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSMediaError14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSMediaErrorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSMediaErrorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSMediaError15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSMediaErrorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSMediaErrorConstructor9classInfoEv
+__ZN7WebCore27jsDOMWindowDevicePixelRatioEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow16devicePixelRatioEv
+__ZN7WebCore21jsDOMWindowScreenLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7screenXEv
+__ZN7WebCore18jsDOMWindowOnkeyupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onkeyupEv
+__ZNK7WebCore19JSOptionConstructor9classInfoEv
+__ZN7WebCore23jsDOMWindowOnmousewheelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow12onmousewheelEv
+__ZN7WebCore35JSWebKitCSSKeyframesRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore35JSWebKitCSSKeyframesRuleConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowOnwebkittransitionendEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow21onwebkittransitionendEv
+__ZN7WebCore18jsDOMWindowScreenYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7screenYEv
+__ZN7WebCore21jsDOMWindowOnkeypressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10onkeypressEv
+__ZN7WebCore18jsDOMWindowToolbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7toolbarEv
+__ZN7WebCore43jsDOMWindowSVGTextContentElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGTextContentElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSSVGTextContentElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSSVGTextContentElementConstructor9classInfoEv
+__ZN7WebCore20jsDOMWindowScreenTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsDOMWindowOnclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onclickEv
+__ZN7WebCore26jsDOMWindowFileConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSFile14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSFileConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore15JSFilePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSFile15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSFileConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSFileConstructor9classInfoEv
+__ZNK7WebCore18JSAudioConstructor9classInfoEv
+__ZN7WebCore17jsDOMWindowCryptoEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow6cryptoEPN3JSC9ExecStateE
+__ZN7WebCore36jsDOMWindowEventExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSEventException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSEventExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSEventExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSEventExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSEventExceptionConstructor9classInfoEv
+__ZN7WebCore24jsDOMWindowDefaultStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow13defaultStatusEv
+__ZNK7WebCore5Frame22jsDefaultStatusBarTextEv
+__ZN7WebCore31jsDOMWindowOnwebkitanimationendEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow20onwebkitanimationendEv
+__ZN7WebCore18jsDOMWindowScreenXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsDOMWindowOnmouseoverEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11onmouseoverEv
+__ZN7WebCore38jsDOMWindowSVGMarkerElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSSVGMarkerElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSSVGMarkerElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGMarkerElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSSVGMarkerElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSSVGMarkerElementConstructor9classInfoEv
+__ZN7WebCore20jsDOMWindowOnmouseupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9onmouseupEv
+__ZN7WebCore24jsDOMWindowDefaultstatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsDOMWindowWebKitAnimationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSWebKitAnimationEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore33JSWebKitAnimationEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore31JSWebKitAnimationEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSWebKitAnimationEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSWebKitAnimationEventConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowSVGColorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSSVGColor14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGColorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGColorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSSVGColorConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowOffscreenBufferingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow18offscreenBufferingEv
+__ZN7WebCore27jsDOMWindowApplicationCacheEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow16applicationCacheEv
+__ZN7WebCore19DOMApplicationCacheC1EPNS_5FrameE
+__ZN7WebCore19DOMApplicationCacheC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19DOMApplicationCacheE
+__ZN7WebCore21JSDOMApplicationCache15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSDOMApplicationCacheC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19DOMApplicationCacheEEE
+__ZN7WebCore21JSDOMApplicationCacheC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19DOMApplicationCacheEEE
+__ZN7WebCore21JSDOMApplicationCache18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSDOMApplicationCachePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSDOMApplicationCache9classInfoEv
+__ZN7WebCore32jsDOMWindowClientRectConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSClientRect14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSClientRectConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSClientRectPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSClientRectConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSClientRectConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowLocationbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11locationbarEv
+__ZN7WebCore31jsDOMWindowSVGLengthConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSSVGLength14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSSVGLengthPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSSVGLength15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSSVGLengthConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSSVGLengthConstructor9classInfoEv
+__ZNK7WebCore27JSXPathEvaluatorConstructor9classInfoEv
+__ZN7WebCore19jsDOMWindowOnchangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onchangeEv
+__ZN7WebCore18jsDOMWindowOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onabortEv
+__ZN7WebCore22jsDOMWindowOnmousedownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11onmousedownEv
+__ZN7WebCore21jsDOMWindowOnmouseoutEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10onmouseoutEv
+__ZN7WebCore45jsDOMWindowWebKitCSSTransformValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSWebKitCSSTransformValue14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore36JSWebKitCSSTransformValueConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore34JSWebKitCSSTransformValuePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSWebKitCSSTransformValue15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSWebKitCSSTransformValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSWebKitCSSTransformValueConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowCSSVariablesRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSCSSVariablesRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSCSSVariablesRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSCSSVariablesRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSCSSVariablesRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSCSSVariablesRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSCSSVariablesRuleConstructor9classInfoEv
+__ZNK7WebCore18JSImageConstructor9classInfoEv
+__ZN7WebCore34JSWebKitCSSKeyframeRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSWebKitCSSKeyframeRuleConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowFileListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSFileList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSFileListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSFileListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSFileList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSFileListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSFileListConstructor9classInfoEv
+__ZNK7WebCore26JSXMLSerializerConstructor9classInfoEv
+__ZNK7WebCore27JSXMLHttpRequestConstructor9classInfoEv
+__ZN7WebCore45jsDOMWindowXMLHttpRequestExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSXMLHttpRequestException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore36JSXMLHttpRequestExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore34JSXMLHttpRequestExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSXMLHttpRequestException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSXMLHttpRequestExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSXMLHttpRequestExceptionConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLMediaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLMediaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLMediaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLMediaElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLVideoElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLVideoElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLVideoElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLVideoElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLVideoElementConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowXPathExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSXPathException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSXPathExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSXPathExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSXPathExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSXPathExceptionConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowSVGExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSSVGException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSSVGExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSSVGExceptionConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowSVGPathSegConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSSVGPathSeg14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGPathSegConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGPathSegPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSSVGPathSeg15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGPathSegConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSSVGPathSegConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowSVGRenderingIntentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGRenderingIntent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSSVGRenderingIntentConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSSVGRenderingIntentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGRenderingIntent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGRenderingIntentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSSVGRenderingIntentConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowSVGTextPathElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGTextPathElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSSVGTextPathElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSSVGTextPathElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGTextPathElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGTextPathElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSSVGTextPathElementConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowSVGTransformConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSSVGTransform14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSSVGTransformConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGTransformPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGTransform15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGTransformConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSSVGTransformConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowSVGUnitTypesConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSSVGUnitTypes14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSSVGUnitTypesConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGUnitTypesPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGUnitTypes15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGUnitTypesConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSSVGUnitTypesConstructor9classInfoEv
+__ZNK7WebCore23JSHTMLDocumentPrototype9classInfoEv
+__ZNK7WebCore19JSDocumentPrototype9classInfoEv
+__ZN7WebCore27jsHTMLDocumentActiveElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument13activeElementEv
+__ZN7WebCore32jsDocumentPreferredStylesheetSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document22preferredStylesheetSetEv
+__ZN7WebCore21JSDOMApplicationCache4markEv
+__ZN7WebCore19DOMApplicationCache15disconnectFrameEv
+__ZN7WebCore24JSTextMetricsConstructorD1Ev
+__ZN7WebCore34JSCSSVariablesDeclarationPrototypeD1Ev
+__ZN7WebCore36JSCSSVariablesDeclarationConstructorD1Ev
+__ZN7WebCore32JSWebKitTransitionEventPrototypeD1Ev
+__ZN7WebCore34JSWebKitTransitionEventConstructorD1Ev
+__ZN7WebCore23JSStorageEventPrototypeD1Ev
+__ZN7WebCore25JSStorageEventConstructorD1Ev
+__ZN7WebCore25JSMessageEventConstructorD1Ev
+__ZN7WebCore20JSStorageConstructorD1Ev
+__ZN7WebCore9JSStorageD1Ev
+__ZN7WebCore9JSStorageD2Ev
+__ZN7WebCore25JSRangeExceptionPrototypeD1Ev
+__ZN7WebCore27JSRangeExceptionConstructorD1Ev
+__ZN7WebCore18JSStoragePrototypeD1Ev
+__ZN7WebCore31JSXMLHttpRequestUploadPrototypeD1Ev
+__ZN7WebCore33JSXMLHttpRequestUploadConstructorD1Ev
+__ZN7WebCore22JSWebKitPointPrototypeD1Ev
+__ZN7WebCore24JSWebKitPointConstructorD1Ev
+__ZN7WebCore24JSDOMStringListPrototypeD1Ev
+__ZN7WebCore26JSDOMStringListConstructorD1Ev
+__ZN7WebCore19JSSVGPaintPrototypeD1Ev
+__ZN7WebCore19JSSVGColorPrototypeD1Ev
+__ZN7WebCore21JSSVGPaintConstructorD1Ev
+__ZN7WebCore19JSSVGAnglePrototypeD1Ev
+__ZN7WebCore21JSSVGAngleConstructorD1Ev
+__ZN7WebCore33JSSVGPreserveAspectRatioPrototypeD1Ev
+__ZN7WebCore35JSSVGPreserveAspectRatioConstructorD1Ev
+__ZN7WebCore29JSHTMLAudioElementConstructorD1Ev
+__ZN7WebCore20JSSVGLengthPrototypeD1Ev
+__ZN7WebCore22JSSVGLengthConstructorD1Ev
+__ZN7WebCore23JSClientRectConstructorD1Ev
+__ZN7WebCore21JSDOMApplicationCacheD1Ev
+__ZN7WebCore21JSDOMApplicationCacheD2Ev
+__ZN7WebCore19DOMApplicationCacheD0Ev
+__ZN7WebCore30JSDOMApplicationCachePrototypeD1Ev
+__ZN7WebCore21JSSVGColorConstructorD1Ev
+__ZN7WebCore33JSWebKitAnimationEventConstructorD1Ev
+__ZN7WebCore27JSSVGMarkerElementPrototypeD1Ev
+__ZN7WebCore29JSSVGMarkerElementConstructorD1Ev
+__ZN7WebCore23JSSVGUnitTypesPrototypeD1Ev
+__ZN7WebCore25JSSVGUnitTypesConstructorD1Ev
+__ZN7WebCore23JSSVGTransformPrototypeD1Ev
+__ZN7WebCore27JSEventExceptionConstructorD1Ev
+__ZN7WebCore25JSSVGTransformConstructorD1Ev
+__ZN7WebCore29JSSVGTextPathElementPrototypeD1Ev
+__ZN7WebCore31JSSVGTextPathElementConstructorD1Ev
+__ZN7WebCore29JSSVGRenderingIntentPrototypeD1Ev
+__ZN7WebCore31JSSVGRenderingIntentConstructorD1Ev
+__ZN7WebCore21JSSVGPathSegPrototypeD1Ev
+__ZN7WebCore23JSSVGPathSegConstructorD1Ev
+__ZN7WebCore23JSSVGExceptionPrototypeD1Ev
+__ZN7WebCore25JSSVGExceptionConstructorD1Ev
+__ZN7WebCore27JSXPathExceptionConstructorD1Ev
+__ZN7WebCore29JSHTMLVideoElementConstructorD1Ev
+__ZN7WebCore29JSHTMLMediaElementConstructorD1Ev
+__ZN7WebCore34JSXMLHttpRequestExceptionPrototypeD1Ev
+__ZN7WebCore36JSXMLHttpRequestExceptionConstructorD1Ev
+__ZN7WebCore19JSFileListPrototypeD1Ev
+__ZN7WebCore21JSFileListConstructorD1Ev
+__ZN7WebCore15JSFilePrototypeD1Ev
+__ZN7WebCore17JSFileConstructorD1Ev
+__ZN7WebCore27JSCSSVariablesRulePrototypeD1Ev
+__ZN7WebCore29JSCSSVariablesRuleConstructorD1Ev
+__ZN7WebCore34JSWebKitCSSTransformValuePrototypeD1Ev
+__ZN7WebCore36JSWebKitCSSTransformValueConstructorD1Ev
+__ZN7WebCore34JSSVGTextContentElementConstructorD1Ev
+__ZN7WebCore21JSMediaErrorPrototypeD1Ev
+__ZN7WebCore23JSMediaErrorConstructorD1Ev
+__ZN7WebCore26JSProgressEventConstructorD1Ev
+__ZN7WebCore29JSSVGGradientElementPrototypeD1Ev
+__ZN7WebCore31JSSVGGradientElementConstructorD1Ev
+__ZN7WebCore25JSClientRectListPrototypeD1Ev
+__ZN7WebCore27JSClientRectListConstructorD1Ev
+__ZN7WebCore31jsHTMLFrameElementContentWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore5Image9nullImageEv
+__ZN7WebCore41jsXPathEvaluatorPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore33jsLocationPrototypeFunctionReloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10JSLocation6reloadEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore11FrameLoader15scheduleRefreshEb
+__ZN7WebCore40jsElementPrototypeFunctionGetClientRectsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element14getClientRectsEv
+__ZN7WebCore14ClientRectListC1ERKN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore14ClientRectListC2ERKN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14ClientRectListE
+__ZN7WebCore16JSClientRectListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14ClientRectListEEE
+__ZN7WebCore16JSClientRectListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14ClientRectListEEE
+__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8scrollByEii
+__ZN7WebCore16JSClientRectList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZNK7WebCore14ClientRectList6lengthEv
+__ZN7WebCore16JSClientRectList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore14ClientRectList4itemEj
+__ZN7WebCore7DataRefINS_17StyleMultiColDataEE6accessEv
+__ZN7WebCore17StyleMultiColDataC1ERKS0_
+__ZN7WebCore17StyleMultiColDataC2ERKS0_
+__ZNK7WebCore11RenderBlock9columnGapEv
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_PNS1_10ColumnInfoEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairH
+__ZNK3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore10RenderView18setBestTruncatedAtEiPNS_20RenderBoxModelObjectEb
+__ZNK7WebCore11RenderBlock11columnRectsEv
+__ZN7WebCore17jsClientRectWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsClientRectHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE4takeERKS4_
+__ZN7WebCore16JSClientRectListD1Ev
+__ZN7WebCore16JSClientRectListD2Ev
+__ZN7WebCore14ClientRectListD1Ev
+__ZN7WebCore14ClientRectListD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10ClientRectEEELm0EE6shrinkEm
+__ZN7WebCore16JSClientRectList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsClientRectListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSDOMWindowShell12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore11JSDOMWindow12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore16JSDOMWindowShell12lookupGetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore11JSDOMWindow12lookupGetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore16JSDOMWindowShell12defineSetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore11JSDOMWindow12defineSetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore29setJSDOMWindowNodeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13StringBuilder6appendEc
+__ZNK7WebCore21JSHTMLTableColElement9classInfoEv
+__ZN7WebCore33jsLocationPrototypeFunctionAssignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10JSLocation6assignEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore33jsHistoryPrototypeFunctionForwardEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7History7forwardEv
+__ZN7WebCore14SessionStorage4copyEPNS_4PageE
+__ZN7WebCore18SessionStorageArea4copyEPNS_14SecurityOriginEPNS_4PageE
+__ZN7WebCore18SessionStorageAreaC1EPNS_14SecurityOriginEPNS_4PageEPS0_
+__ZN7WebCore18SessionStorageAreaC2EPNS_14SecurityOriginEPNS_4PageEPS0_
+__ZN7WebCore11StorageAreaC2EPNS_14SecurityOriginEPS0_
+__ZN7WebCore4Page17setSessionStorageEN3WTF10PassRefPtrINS_14SessionStorageEEE
+__ZN7WebCore21setJSLocationProtocolEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation11setProtocolEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore17setJSLocationHostEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setHostEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore4KURL14setHostAndPortERKNS_6StringE
+__ZN7WebCore21setJSLocationHostnameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation11setHostnameEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore17setJSLocationPortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setPortEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore21setJSLocationPathnameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation11setPathnameEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore19setJSLocationSearchEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation9setSearchEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore18SessionStorageAreaD0Ev
+__ZN7WebCore11StorageAreaD2Ev
+__ZNK7WebCore20JSNavigatorPrototype9classInfoEv
+__ZN7WebCore17jsNavigatorOnLineEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase6onLineEv
+__ZN7WebCore43jsDocumentPrototypeFunctionCreateTreeWalkerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document16createTreeWalkerEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
+__ZN7WebCore10TreeWalkerC1EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore10TreeWalkerC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10TreeWalkerE
+__ZN7WebCore12JSTreeWalker15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSTreeWalkerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TreeWalkerEEE
+__ZN7WebCore12JSTreeWalkerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TreeWalkerEEE
+__ZN7WebCore12JSTreeWalker4markEv
+__ZN7WebCore12JSTreeWalkerD1Ev
+__ZN7WebCore12JSTreeWalkerD2Ev
+__ZN7WebCore21JSTreeWalkerPrototypeD1Ev
+__ZN7WebCore39jsElementPrototypeFunctionScrollByLinesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element13scrollByLinesEi
+__ZN7WebCore7Element13scrollByUnitsEiNS_17ScrollGranularityE
+__ZN7WebCore39jsElementPrototypeFunctionScrollByPagesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element13scrollByPagesEi
+__ZN7WebCore43jsHTMLOptionsCollectionPrototypeFunctionAddEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23JSHTMLOptionsCollection3addEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEERi
+__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEEiRi
+__ZN7WebCore46jsHTMLOptionsCollectionPrototypeFunctionRemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23JSHTMLOptionsCollection6removeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13KeyboardEventC1Ev
+__ZN7WebCore13KeyboardEventC2Ev
+__ZN7WebCore24JSKeyboardEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore49jsKeyboardEventPrototypeFunctionInitKeyboardEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSKeyboardEvent9classInfoEv
+__ZN7WebCore11toDOMWindowEN3JSC7JSValueE
+__ZN7WebCore13KeyboardEvent17initKeyboardEventERKNS_12AtomicStringEbbPNS_9DOMWindowERKNS_6StringEjbbbbb
+__ZN7WebCore7UIEvent11initUIEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEi
+__ZN7WebCore43jsMouseEventPrototypeFunctionInitMouseEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13toEventTargetEN3JSC7JSValueE
+__ZN7WebCore10MouseEvent14initMouseEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTarge
+__ZN7WebCore17MouseRelatedEvent15initCoordinatesEii
+__ZN7WebCore12NodeIterator17nodeWillBeRemovedEPNS_4NodeE
+__ZNK7WebCore12NodeIterator20updateForNodeRemovalEPNS_4NodeERNS0_11NodePointerE
+__ZN7WebCore13ProgressEventC1Ev
+__ZN7WebCore13ProgressEventC2Ev
+__ZN7WebCore15JSProgressEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSProgressEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore49jsProgressEventPrototypeFunctionInitProgressEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSProgressEvent9classInfoEv
+__ZN7WebCore13ProgressEvent17initProgressEventERKNS_12AtomicStringEbbbjj
+__ZN7WebCore36jsRangePrototypeFunctionComparePointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore38jsRangePrototypeFunctionIsPointInRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range14isPointInRangeEPNS_4NodeEiRi
+__ZN7WebCore37jsUIEventPrototypeFunctionInitUIEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow6moveByEff
+__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8resizeByEff
+__ZN7WebCore30setJSHTMLOptionElementSelectedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36jsHTMLOptionsCollectionSelectedIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21HTMLOptionsCollection13selectedIndexEv
+__ZN7WebCore25setJSHTMLElementOuterTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setOuterTextERKNS_6StringERi
+__ZNK7WebCore28JSHTMLObjectElementPrototype9classInfoEv
+__ZN7WebCore18JSHTMLEmbedElement11getCallDataERN3JSC8CallDataE
+__ZN7WebCore24runtimeObjectGetCallDataEPNS_11HTMLElementERN3JSC8CallDataE
+__ZNK7WebCore27JSHTMLEmbedElementPrototype9classInfoEv
+__ZN7WebCore24jsHTMLEmbedElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLEmbedElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLAppletElement11getCallDataERN3JSC8CallDataE
+__ZN7WebCore19JSHTMLObjectElement11getCallDataERN3JSC8CallDataE
+__ZNK7WebCore28JSHTMLAppletElementPrototype9classInfoEv
+__ZNK7WebCore25JSHTMLDivElementPrototype9classInfoEv
+__ZNK7WebCore24JSKeyboardEventPrototype9classInfoEv
+__ZN7WebCore6JSRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4RectEEE
+__ZN7WebCore6JSRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4RectEEE
+__ZN7WebCore6JSRectD1Ev
+__ZN7WebCore6JSRectD2Ev
+__ZN7WebCore18setJSDOMWindowSelfEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore28setJSHTMLSelectElementLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplES3_NS_7PtrHashIS3_EENS_10HashTraitsIS3_EES7_E3getERKS3_
+__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionSetFloatValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17CSSPrimitiveValue13setFloatValueEtdRi
+__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionSetStringValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17CSSPrimitiveValue14setStringValueEtRKNS_6StringERi
+__ZN7WebCore26setJSHTMLTableElementTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25toHTMLTableSectionElementEN3JSC7JSValueE
+__ZN7WebCore20setJSHTMLDocumentAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14JSHTMLDocument6setAllEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK3JSC38StringObjectThatMasqueradesAsUndefined9toBooleanEPNS_9ExecStateE
+__ZN3JSC38StringObjectThatMasqueradesAsUndefinedD1Ev
+__ZNK7WebCore15JSAttrPrototype9classInfoEv
+__ZN7WebCore17jsAttrConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSCommentPrototype9classInfoEv
+__ZNK7WebCore27JSDocumentFragmentPrototype9classInfoEv
+__ZN7WebCore29jsDocumentFragmentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore28JSDOMImplementationPrototype9classInfoEv
+__ZN7WebCore30jsDOMImplementationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14JSNodeIterator9classInfoEv
+__ZNK7WebCore23JSNodeIteratorPrototype9classInfoEv
+__ZN7WebCore25jsNodeIteratorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSNodeIterator14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSNodeIteratorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSNodeIteratorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore25JSNodeIteratorConstructor9classInfoEv
+__ZNK7WebCore16JSRangePrototype9classInfoEv
+__ZN7WebCore18jsRangeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15JSTextPrototype9classInfoEv
+__ZNK7WebCore12JSTreeWalker9classInfoEv
+__ZN7WebCore12JSTreeWalker18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSTreeWalkerPrototype9classInfoEv
+__ZN7WebCore23jsTreeWalkerConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSTreeWalker14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSTreeWalkerPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore23JSTreeWalkerConstructor9classInfoEv
+__ZN7WebCore21jsDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23JSCDATASectionPrototype9classInfoEv
+__ZN7WebCore25jsCDATASectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSEntityReferencePrototype9classInfoEv
+__ZN7WebCore28jsEntityReferenceConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore32JSProcessingInstructionPrototype9classInfoEv
+__ZN7WebCore34jsProcessingInstructionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsKeyboardEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsMouseEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24JSMutationEventPrototype9classInfoEv
+__ZN7WebCore26jsMutationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13OverflowEventC1Ev
+__ZN7WebCore13OverflowEventC2Ev
+__ZNK7WebCore13OverflowEvent15isOverflowEventEv
+__ZN7WebCore15getDOMStructureINS_15JSOverflowEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore15JSOverflowEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13OverflowEventEEE
+__ZN7WebCore15JSOverflowEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13OverflowEventEEE
+__ZNK7WebCore15JSOverflowEvent9classInfoEv
+__ZN7WebCore15JSOverflowEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSOverflowEventPrototype9classInfoEv
+__ZN7WebCore26jsOverflowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9TextEventC1Ev
+__ZN7WebCore9TextEventC2Ev
+__ZN7WebCore15getDOMStructureINS_11JSTextEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore11JSTextEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9TextEventEEE
+__ZN7WebCore11JSTextEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9TextEventEEE
+__ZNK7WebCore11JSTextEvent9classInfoEv
+__ZN7WebCore11JSTextEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSTextEventPrototype9classInfoEv
+__ZN7WebCore22jsTextEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsUIEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10WheelEventC1Ev
+__ZN7WebCore10WheelEventC2Ev
+__ZNK7WebCore12JSWheelEvent9classInfoEv
+__ZNK7WebCore21JSWheelEventPrototype9classInfoEv
+__ZN7WebCore23jsWheelEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsStyleSheetListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24JSCSSStyleSheetPrototype9classInfoEv
+__ZN7WebCore26jsCSSStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsCSSRuleListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14JSCSSStyleRule9classInfoEv
+__ZNK7WebCore23JSCSSStyleRulePrototype9classInfoEv
+__ZN7WebCore25jsCSSStyleRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsCSSStyleDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore28JSCSSPrimitiveValuePrototype9classInfoEv
+__ZN7WebCore30jsCSSPrimitiveValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10JSRGBColor9classInfoEv
+__ZNK7WebCore6JSRect9classInfoEv
+__ZN7WebCore6JSRect18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSRectPrototype9classInfoEv
+__ZN7WebCore17jsRectConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSValueListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCounterC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CounterEEE
+__ZN7WebCore9JSCounterC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CounterEEE
+__ZNK7WebCore9JSCounter9classInfoEv
+__ZN7WebCore9JSCounter18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSCounterPrototype9classInfoEv
+__ZN7WebCore20jsCounterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsStyleSheetMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsMediaListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSXPathExpressionPrototype9classInfoEv
+__ZN7WebCore28jsXPathExpressionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSXPathExpression14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSXPathExpressionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSXPathExpressionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore28JSXPathExpressionConstructor9classInfoEv
+__ZNK7WebCore22JSXPathResultPrototype9classInfoEv
+__ZN7WebCore24jsXPathResultConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore28JSHTMLAnchorElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLAppletElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSHTMLAreaElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17JSHTMLBaseElement9classInfoEv
+__ZNK7WebCore26JSHTMLBaseElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLBaseElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21JSHTMLBaseFontElement9classInfoEv
+__ZNK7WebCore30JSHTMLBaseFontElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLBaseFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore32JSHTMLBlockquoteElementPrototype9classInfoEv
+__ZN7WebCore34jsHTMLBlockquoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSHTMLBodyElementPrototype9classInfoEv
+__ZNK7WebCore24JSHTMLBRElementPrototype9classInfoEv
+__ZN7WebCore26jsHTMLBRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore28JSHTMLButtonElementPrototype9classInfoEv
+__ZNK7WebCore28JSHTMLCanvasElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLCanvasElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore25JSHTMLTableCaptionElement9classInfoEv
+__ZNK7WebCore34JSHTMLTableCaptionElementPrototype9classInfoEv
+__ZN7WebCore36jsHTMLTableCaptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore30JSHTMLTableColElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLTableColElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore25JSHTMLModElementPrototype9classInfoEv
+__ZNK7WebCore22JSHTMLDirectoryElement9classInfoEv
+__ZNK7WebCore31JSHTMLDirectoryElementPrototype9classInfoEv
+__ZN7WebCore33jsHTMLDirectoryElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore27JSHTMLDListElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLDListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLEmbedElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore30JSHTMLFieldSetElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLFieldSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCounterD1Ev
+__ZN7WebCore9JSCounterD2Ev
+__ZN7WebCore12JSWheelEventD1Ev
+__ZN7WebCore11JSTextEventD1Ev
+__ZN7WebCore15JSOverflowEventD1Ev
+__ZN7WebCore13OverflowEventD0Ev
+__ZNK7WebCore26JSHTMLFontElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLFormElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSHTMLFrameElement9classInfoEv
+__ZNK7WebCore27JSHTMLFrameElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore30JSHTMLFrameSetElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLFrameSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSHTMLHeadElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLHeadElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29JSHTMLHeadingElementPrototype9classInfoEv
+__ZNK7WebCore24JSHTMLHRElementPrototype9classInfoEv
+__ZN7WebCore26jsHTMLHRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSHTMLHtmlElementPrototype9classInfoEv
+__ZNK7WebCore28JSHTMLIFrameElementPrototype9classInfoEv
+__ZNK7WebCore27JSHTMLImageElementPrototype9classInfoEv
+__ZNK7WebCore27JSHTMLInputElementPrototype9classInfoEv
+__ZNK7WebCore20JSHTMLIsIndexElement9classInfoEv
+__ZNK7WebCore29JSHTMLIsIndexElementPrototype9classInfoEv
+__ZN7WebCore31jsHTMLIsIndexElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL17keygenConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLKeygenElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLKeygenElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore20getSupportedKeySizesERN3WTF6VectorINS_6StringELm0EEE
+__ZNK7WebCore27JSHTMLLabelElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLLabelElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore28JSHTMLLegendElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLLegendElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24JSHTMLLIElementPrototype9classInfoEv
+__ZNK7WebCore26JSHTMLLinkElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLLinkElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore25JSHTMLPreElementPrototype9classInfoEv
+__ZN7WebCore27jsHTMLPreElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore25JSHTMLMapElementPrototype9classInfoEv
+__ZN7WebCore27jsHTMLMapElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20JSHTMLMarqueeElement9classInfoEv
+__ZNK7WebCore29JSHTMLMarqueeElementPrototype9classInfoEv
+__ZN7WebCore31jsHTMLMarqueeElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17JSHTMLMenuElement9classInfoEv
+__ZNK7WebCore26JSHTMLMenuElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLMenuElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSHTMLMetaElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLMetaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLObjectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore27JSHTMLOListElementPrototype9classInfoEv
+__ZNK7WebCore21JSHTMLOptGroupElement9classInfoEv
+__ZNK7WebCore30JSHTMLOptGroupElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLOptGroupElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore28JSHTMLOptionElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLOptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore31JSHTMLParagraphElementPrototype9classInfoEv
+__ZNK7WebCore27JSHTMLParamElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLParamElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore27JSHTMLQuoteElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLQuoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore28JSHTMLScriptElementPrototype9classInfoEv
+__ZNK7WebCore27JSHTMLStyleElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLStyleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore27JSHTMLTableElementPrototype9classInfoEv
+__ZNK7WebCore34JSHTMLTableSectionElementPrototype9classInfoEv
+__ZN7WebCore36jsHTMLTableSectionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore31JSHTMLTableCellElementPrototype9classInfoEv
+__ZN7WebCore33jsHTMLTableCellElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore30JSHTMLTextAreaElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLTextAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore27JSHTMLTitleElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLTitleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore30JSHTMLTableRowElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLTableRowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore27JSHTMLUListElementPrototype9classInfoEv
+__ZThn8_N7WebCore18HTMLMarqueeElementD0Ev
+__ZThn8_N7WebCore17HTMLKeygenElementD0Ev
+__ZN7WebCore17HTMLKeygenElementD0Ev
+__ZN7WebCore23JSTreeWalkerConstructorD1Ev
+__ZN7WebCore25JSNodeIteratorConstructorD1Ev
+__ZN7WebCore28JSXPathExpressionConstructorD1Ev
+__ZN7WebCore14XMLHttpRequest12networkErrorEv
+__ZN7WebCore14XMLHttpRequest18dispatchErrorEventEv
+__ZN7WebCore41jsEventExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSEventException9classInfoEv
+__ZNK7WebCore25JSEventExceptionPrototype9classInfoEv
+__ZN7WebCore27jsEventExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsRangePrototypeFunctionSetStartAfterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14RangeExceptionE
+__ZN7WebCore16JSRangeExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14RangeExceptionEEE
+__ZN7WebCore16JSRangeExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14RangeExceptionEEE
+__ZN7WebCore16JSRangeException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSRangeExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsRangeExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSRangeException9classInfoEv
+__ZNK7WebCore25JSRangeExceptionPrototype9classInfoEv
+__ZN7WebCore27jsRangeExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsRangeExceptionINVALID_NODE_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsRangeExceptionBAD_BOUNDARYPOINTS_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore49jsXPathEvaluatorPrototypeFunctionCreateNSResolverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore41jsXPathExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore16JSXPathException9classInfoEv
+__ZNK7WebCore25JSXPathExceptionPrototype9classInfoEv
 __ZN7WebCore27jsXPathExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore24jsXPathExceptionTYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore38jsXPathExceptionINVALID_EXPRESSION_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore41jsRangeExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore16JSRangeException9classInfoEv
-__ZN7WebCore27jsRangeExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore40jsElementPrototypeFunctionHasAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore45jsNamedNodeMapPrototypeFunctionGetNamedItemNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore12NamedAttrMap14getNamedItemNSERKNS_6StringES3_
-__ZN7WebCore15setJSNodePrefixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
+__ZN7WebCore16JSRangeExceptionD1Ev
+__ZN7WebCore16JSRangeExceptionD2Ev
+__ZNK7WebCore27JSDOMCoreExceptionPrototype9classInfoEv
+__ZN7WebCore29jsDOMCoreExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsDOMCoreExceptionHIERARCHY_REQUEST_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsDOMCoreExceptionINVALID_CHARACTER_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsDOMCoreExceptionNAMESPACE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsElementPrototypeFunctionHasAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore45jsNamedNodeMapPrototypeFunctionGetNamedItemNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12NamedNodeMap14getNamedItemNSERKNS_6StringES3_
+__ZN7WebCore43jsElementPrototypeFunctionRemoveAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element17removeAttributeNSERKNS_6StringES3_Ri
+__ZN7WebCore48jsNamedNodeMapPrototypeFunctionRemoveNamedItemNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12NamedNodeMap17removeNamedItemNSERKNS_6StringES3_Ri
 __ZN7WebCore4Node9setPrefixERKNS_12AtomicStringERi
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_5FrameE
-__ZN7WebCore25setJSHTMLElementOuterHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11HTMLElement12setOuterHTMLERKNS_6StringERi
-__ZN7WebCore27setJSHTMLHtmlElementVersionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLHtmlElement10setVersionERKNS_6StringE
-__ZN7WebCore24jsHTMLImageElementLowsrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLImageElement6lowsrcEv
-__ZN7WebCore27setJSHTMLImageElementLowsrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement9setLowsrcERKNS_6StringE
-__ZN7WebCore29setJSHTMLImageElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLImageElement11setLongDescERKNS_6StringE
-__ZNK7WebCore17JSHTMLBaseElement9classInfoEv
-__ZN7WebCore41jsHTMLButtonElementPrototypeFunctionClickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCoreL18callHTMLCollectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore33setJSDOMWindowNodeListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore21ProcessingInstruction9cloneNodeEb
-__ZN7WebCore35jsRangePrototypeFunctionCompareNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore31jsDOMCoreExceptionNOT_FOUND_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14RenderFrameSet10renderNameEv
+__ZNK7WebCore11RenderFrame10renderNameEv
+__ZN7WebCore39jsHTMLDocumentPrototypeFunctionHasFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12HTMLDocument8hasFocusEv
+__ZN7WebCore33jsHTMLTextAreaElementSelectionEndEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19HTMLTextAreaElement12selectionEndEv
+__ZN7WebCore15HTMLFormElement26willMoveToNewOwnerDocumentEv
+__ZN7WebCore15HTMLFormElement25didMoveToNewOwnerDocumentEv
+__ZN7WebCore31jsHTMLImageElementNaturalHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement13naturalHeightEv
+__ZN7WebCore22JSNamedNodesCollection12lengthGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore23resetButtonDefaultLabelEv
+__ZN7WebCore41jsHTMLButtonElementPrototypeFunctionClickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL14isSVG10FeatureERKNS_6StringE
+__ZN7WebCore19jsNodeOncontextmenuEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node13oncontextmenuEv
+__ZNK7WebCore22JSNamedNodesCollection9classInfoEv
+__ZN7WebCore17HTMLSelectElement17saveLastSelectionEv
+__ZN7WebCore17HTMLSelectElement16menuListOnChangeEv
+__ZN7WebCore32setJSHTMLTableCellElementColSpanEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement10setColSpanEi
+__ZN7WebCore33setJSDOMWindowNodeListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40jsRangePrototypeFunctionSurroundContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range16surroundContentsEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZNK7WebCore13CharacterData19isCharacterDataNodeEv
+__ZN7WebCore20jsRangeExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMCoreExceptionWRONG_DOCUMENT_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsRangePrototypeFunctionDetachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range6detachERi
+__ZN7WebCore35jsDOMCoreExceptionINVALID_STATE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore21jsRangeSTART_TO_STARTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsRangePrototypeFunctionCompareBoundaryPointsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19jsRangeSTART_TO_ENDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsRangeEND_TO_STARTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore17jsRangeEND_TO_ENDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore38jsRangePrototypeFunctionIsPointInRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore5Range14isPointInRangeEPNS_4NodeEiRi
-__ZN7WebCore36jsRangePrototypeFunctionComparePointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore38jsRangePrototypeFunctionIntersectsNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore5Range14intersectsNodeEPNS_4NodeERi
 __ZN7WebCore5Range15textNodesMergedERNS_13NodeWithIndexEj
+__ZN7WebCore35jsRangePrototypeFunctionCompareNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore31jsDOMCoreExceptionNOT_FOUND_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore7Comment16childTypeAllowedENS_4Node8NodeTypeE
-__ZN7WebCore51jsDocumentFragmentPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore48jsDocumentFragmentPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore16jsRangeCollapsedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsRangeCommonAncestorContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsRangePrototypeFunctionIntersectsNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore21ProcessingInstruction18offsetInCharactersEv
+__ZN7WebCore21ProcessingInstruction9cloneNodeEb
+__ZN7WebCore51jsDocumentFragmentPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore48jsDocumentFragmentPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17decodeNamedEntityEPKc
+__ZN7WebCoreL17sharedXHTMLEntityEv
+__ZN7WebCore28jsDOMCoreExceptionSYNTAX_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL27createSVGDescElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGDescElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGDescElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDescElementEEE
+__ZN7WebCore16JSSVGDescElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDescElementEEE
+__ZN7WebCore16JSSVGDescElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL29createSVGCircleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGCircleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGCircleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCircleElementEEE
+__ZN7WebCore18JSSVGCircleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCircleElementEEE
+__ZN7WebCore18JSSVGCircleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsDOMCoreExceptionMessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSSVGCircleElementD1Ev
+__ZN7WebCore16JSSVGDescElementD1Ev
+__ZN7WebCore27JSSVGCircleElementPrototypeD1Ev
+__ZN7WebCore25JSSVGDescElementPrototypeD1Ev
 __ZN7WebCore22jsHTMLLinkElementSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17setJSLocationHostEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10JSLocation7setHostEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore4KURL14setHostAndPortERKNS_6StringE
-__ZN7WebCore21setJSLocationPathnameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10JSLocation11setPathnameEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore17setJSLocationPortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10JSLocation7setPortEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore19setJSLocationSearchEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10JSLocation9setSearchEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore21setJSLocationHostnameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10JSLocation11setHostnameEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore21setJSLocationProtocolEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore10JSLocation11setProtocolEPN3JSC9ExecStateENS1_10JSValuePtrE
+__ZN7WebCore21jsStyleSheetOwnerNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsTreeWalkerCurrentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSTreeWalkerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsTreeWalkerPrototypeFunctionParentNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker10parentNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker10parentNodeEPN3JSC9ExecStateE
+__ZN7WebCore12JSTreeWalker3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore26setJSTreeWalkerCurrentNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10TreeWalker14setCurrentNodeEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZN7WebCore37jsTreeWalkerPrototypeFunctionNextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker8nextNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker8nextNodeEPN3JSC9ExecStateE
+__ZNK7WebCore10NodeFilter10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
+__ZNK7WebCore21JSNodeFilterCondition10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore41jsTreeWalkerPrototypeFunctionPreviousNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker12previousNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker12previousNodeEPN3JSC9ExecStateE
+__ZN7WebCore39jsTreeWalkerPrototypeFunctionFirstChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker10firstChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker10firstChildEPN3JSC9ExecStateE
+__ZN7WebCore38jsTreeWalkerPrototypeFunctionLastChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker9lastChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker9lastChildEPN3JSC9ExecStateE
+__ZN7WebCore40jsTreeWalkerPrototypeFunctionNextSiblingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker11nextSiblingEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker11nextSiblingEPN3JSC9ExecStateE
+__ZN7WebCore44jsTreeWalkerPrototypeFunctionPreviousSiblingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker15previousSiblingEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker15previousSiblingEPN3JSC9ExecStateE
+__ZN7WebCore35jsDOMWindowPrototypeFunctionConfirmEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow7confirmERKNS_6StringE
+__ZN7WebCore6Chrome20runJavaScriptConfirmEPNS_5FrameERKNS_6StringE
+__ZN7WebCore34jsDOMWindowPrototypeFunctionPromptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow6promptERKNS_6StringES3_
+__ZN7WebCore6Chrome19runJavaScriptPromptEPNS_5FrameERKNS_6StringES5_RS3_
+__ZN7WebCore32jsDOMWindowPrototypeFunctionAtobEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow4atobEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore32jsDOMWindowPrototypeFunctionBtoaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow4btoaEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore30jsConsolePrototypeFunctionInfoEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console4infoEPNS_15ScriptCallStackE
+__ZN7WebCore30jsConsolePrototypeFunctionWarnEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console4warnEPNS_15ScriptCallStackE
+__ZN7WebCore31jsConsolePrototypeFunctionErrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console5errorEPNS_15ScriptCallStackE
+__ZN7WebCore31jsConsolePrototypeFunctionTraceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console5traceEPNS_15ScriptCallStackE
+__ZN7WebCore24JSWebKitPointConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL20constructWebKitPointEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11WebKitPointE
+__ZN7WebCore13JSWebKitPointC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11WebKitPointEEE
+__ZN7WebCore13JSWebKitPointC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11WebKitPointEEE
+__ZNK7WebCore13JSWebKitPoint9classInfoEv
+__ZN7WebCore26JSWebKitCSSMatrixPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsWebKitCSSMatrixPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17JSWebKitCSSMatrix9classInfoEv
+__ZNK7WebCore15WebKitCSSMatrix8toStringEv
+__ZN7WebCore13JSWebKitPointD1Ev
+__ZN7WebCore13JSWebKitPointD2Ev
+__ZN7WebCore41jsDOMWindowPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore29setJSDOMWindowAttrConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCDATASectionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowCSSPrimitiveValueConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowCSSRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowCSSStyleDeclarationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowCSSValueConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowCharacterDataConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowCommentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowDOMExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowDOMImplementationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowDocumentFragmentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowDocumentTypeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMWindowEntityConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowEntityReferenceConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLAnchorElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLAppletElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLAreaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowHTMLBRElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLBaseElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLBaseFontElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLBodyElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLButtonElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLCanvasElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLDListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore45setJSDOMWindowHTMLDirectoryElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLDivElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowHTMLDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowHTMLElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLFieldSetElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLFontElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLFormElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLFrameElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLFrameSetElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowHTMLHRElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLHeadElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowHTMLHeadingElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLHtmlElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLIFrameElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLImageElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLInputElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowHTMLIsIndexElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowHTMLLIElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLLabelElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLLegendElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLLinkElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLMapElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowHTMLMarqueeElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLMenuElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLMetaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLModElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLOListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLOptGroupElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLOptionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore45setJSDOMWindowHTMLParagraphElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLParamElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLPreElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLQuoteElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLScriptElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLSelectElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLStyleElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore48setJSDOMWindowHTMLTableCaptionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore45setJSDOMWindowHTMLTableCellElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLTableColElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLTableElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLTableRowElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore48setJSDOMWindowHTMLTableSectionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLTextAreaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLTitleElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLUListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowMutationEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowNodeFilterConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowNotationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore46setJSDOMWindowProcessingInstructionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowRangeExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowXMLDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowXPathEvaluatorConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowXPathResultConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMWindowClientInformationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSDOMWindowDevicePixelRatioEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20setJSDOMWindowFramesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowInnerHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowInnerWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20setJSDOMWindowLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowLocationbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowMenubarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSDOMWindowNavigatorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowOffscreenBufferingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20setJSDOMWindowOpenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowOuterHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowOuterWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowPersonalbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowScreenLeftEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSDOMWindowScreenTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowScreenXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowScreenYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowScrollYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowScrollbarsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSDOMWindowStatusbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowToolbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore27setJSDOMWindowDefaultStatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow16setDefaultStatusERKNS_6StringE
+__ZN7WebCore27setJSDOMWindowDefaultstatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnabortEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnchangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnchangeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore24setJSDOMWindowOndblclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow13setOndblclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowOnfocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnfocusEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore24setJSDOMWindowOnkeypressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow13setOnkeypressEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowOnkeyupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnkeyupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore25setJSDOMWindowOnmousedownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow14setOnmousedownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore25setJSDOMWindowOnmousemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow14setOnmousemoveEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore24setJSDOMWindowOnmouseoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow13setOnmouseoutEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore25setJSDOMWindowOnmouseoverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow14setOnmouseoverEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore23setJSDOMWindowOnmouseupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow12setOnmouseupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowOnresetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnresetEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnsearchEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnsearchEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnselectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnselectEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnsubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnsubmitEN3WTF10PassRefPtrINS_13EventListenerEEE
 __ZNK7WebCore6Chrome17scrollbarsVisibleEv
-__ZN7WebCore21jsCSSRuleCHARSET_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsCSSRuleFONT_FACE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsCSSRuleIMPORT_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsCSSRuleMEDIA_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18jsCSSRulePAGE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore19jsCSSRuleSTYLE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsCSSRuleUNKNOWN_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Chrome15toolbarsVisibleEv
+__ZNK7WebCore6Chrome14menubarVisibleEv
+__ZN7WebCore60jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZN7WebCore13toWebKitPointEN3JSC7JSValueE
+__ZNK7WebCore9DOMWindow32webkitConvertPointFromNodeToPageEPNS_4NodeEPKNS_11WebKitPointE
+__ZNK7WebCore4Node13convertToPageERKNS_10FloatPointE
+__ZN7WebCore13JSWebKitPoint18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14jsWebKitPointXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsWebKitPointYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore60jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZNK7WebCore9DOMWindow32webkitConvertPointFromPageToNodeEPNS_4NodeEPKNS_11WebKitPointE
+__ZNK7WebCore4Node15convertFromPageERKNS_10FloatPointE
+__ZN7WebCore9JSHistory16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore9JSHistory22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore18JSHistoryPrototype9classInfoEv
+__ZNK7WebCore18JSBarInfoPrototype9classInfoEv
+__ZNK7WebCore17JSScreenPrototype9classInfoEv
+__ZN7WebCoreL32min_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore39setJSDOMWindowCSSCharsetRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowCSSFontFaceRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowCSSImportRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCSSMediaRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowCSSPageRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowCSSRuleListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCSSStyleRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowCSSStyleSheetConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCSSValueListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowCounterConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowEventExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore46setJSDOMWindowHTMLBlockquoteElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLEmbedElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLObjectElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowKeyboardEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowMediaListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowMouseEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowNamedNodeMapConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowOverflowEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowProgressEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSDOMWindowRectConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowSVGAngleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowSVGColorConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowSVGExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowSVGGradientElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowSVGLengthConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowSVGMarkerElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowSVGPaintConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowSVGPathSegConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore47setJSDOMWindowSVGPreserveAspectRatioConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowSVGRenderingIntentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore46setJSDOMWindowSVGTextContentElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowSVGTextPathElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowSVGTransformConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowSVGUnitTypesConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowStyleSheetConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowStyleSheetListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowTextEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowUIEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowWheelEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore48setJSDOMWindowXMLHttpRequestExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowXPathExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13toMessagePortEN3JSC7JSValueE
+__ZNK7WebCore27JSHTMLAudioElementPrototype9classInfoEv
+__ZNK7WebCore27JSHTMLMediaElementPrototype9classInfoEv
+__ZN7WebCore35jsHTMLMediaElementHAVE_CURRENT_DATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLMediaElementHAVE_ENOUGH_DATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLMediaElementHAVE_FUTURE_DATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLMediaElementHAVE_METADATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLMediaElementHAVE_NOTHINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLMediaElementNETWORK_EMPTYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLMediaElementNETWORK_IDLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsHTMLMediaElementNETWORK_LOADEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsHTMLMediaElementNETWORK_LOADINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsHTMLMediaElementNETWORK_NO_SOURCEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24JSCharacterDataPrototype9classInfoEv
+__ZNK7WebCore25JSCSSCharsetRulePrototype9classInfoEv
+__ZNK7WebCore18JSCSSRulePrototype9classInfoEv
 __ZN7WebCore23jsCSSRuleVARIABLES_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSCSSFontFaceRulePrototype9classInfoEv
+__ZNK7WebCore24JSCSSImportRulePrototype9classInfoEv
+__ZNK7WebCore23JSCSSMediaRulePrototype9classInfoEv
+__ZNK7WebCore22JSCSSPageRulePrototype9classInfoEv
 __ZN7WebCore27jsCSSPrimitiveValueCSS_ATTREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore25jsCSSPrimitiveValueCSS_CMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore30jsCSSPrimitiveValueCSS_COUNTEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_DEGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore32jsCSSPrimitiveValueCSS_DIMENSIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore26jsCSSPrimitiveValueCSS_EMSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore26jsCSSPrimitiveValueCSS_EXSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
@@ -18751,69 +18599,232 @@
 __ZN7WebCore26jsCSSPrimitiveValueCSS_RADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore24jsCSSPrimitiveValueCSS_SEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore26jsCSSPrimitiveValueCSS_URIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsCSSValueCSS_CUSTOMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsCSSValueCSS_INHERITEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21JSStyleSheetPrototype9classInfoEv
 __ZN7WebCore34JSCSSVariablesDeclarationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSCSSVariablesDeclarationPrototype9classInfoEv
+__ZNK7WebCore35JSCanvasRenderingContext2DPrototype9classInfoEv
+__ZNK7WebCore21JSClientRectPrototype9classInfoEv
+__ZN7WebCore25JSClientRectListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSClientRectListPrototype9classInfoEv
+__ZNK7WebCore20JSClipboardPrototype9classInfoEv
+__ZN7WebCore27jsDOMCoreExceptionABORT_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore36jsDOMCoreExceptionDOMSTRING_SIZE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore37jsDOMCoreExceptionINUSE_ATTRIBUTE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMCoreExceptionINVALID_ACCESS_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore42jsDOMCoreExceptionINVALID_MODIFICATION_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMCoreExceptionNETWORK_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore35jsDOMCoreExceptionNOT_SUPPORTED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore37jsDOMCoreExceptionNO_DATA_ALLOWED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore45jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsDOMCoreExceptionSYNTAX_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMCoreExceptionQUOTA_EXCEEDED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsDOMCoreExceptionSECURITY_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore35jsDOMCoreExceptionTYPE_MISMATCH_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsDOMCoreExceptionURL_MISMATCH_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore32jsDOMCoreExceptionVALIDATION_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore36jsDOMCoreExceptionWRONG_DOCUMENT_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20JSDOMParserPrototype9classInfoEv
 __ZN7WebCore24JSDOMStringListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSDOMStringListPrototype9classInfoEv
+__ZNK7WebCore23JSDocumentTypePrototype9classInfoEv
+__ZNK7WebCore17JSEntityPrototype9classInfoEv
+__ZNK7WebCore15JSFilePrototype9classInfoEv
 __ZN7WebCore19JSFileListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSFileListPrototype9classInfoEv
+__ZN7WebCore27JSHTMLFrameElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCore29JSHTMLMarqueeElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26jsHTMLMediaElementCAN_PLAYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsMediaErrorMEDIA_ERR_ABORTEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore28jsMediaErrorMEDIA_ERR_DECODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsMediaErrorMEDIA_ERR_NETWORKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore21JSMediaErrorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSMediaListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSMediaErrorPrototype9classInfoEv
+__ZNK7WebCore19JSMimeTypePrototype9classInfoEv
+__ZNK7WebCore24JSMimeTypeArrayPrototype9classInfoEv
 __ZN7WebCore23jsMutationEventADDITIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore27jsMutationEventMODIFICATIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore22jsMutationEventREMOVALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsNodeFilterSHOW_ATTRIBUTEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsNodeFilterSHOW_CDATA_SECTIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsNodeFilterSHOW_COMMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsNodeFilterSHOW_DOCUMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsNodeFilterSHOW_DOCUMENT_FRAGMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsNodeFilterSHOW_DOCUMENT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsNodeFilterSHOW_ENTITYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsNodeFilterSHOW_ENTITY_REFERENCEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsNodeFilterSHOW_NOTATIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore39jsNodeFilterSHOW_PROCESSING_INSTRUCTIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21jsNodeFilterSHOW_TEXTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore21JSNodeFilterPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSNodeFilterPrototype9classInfoEv
 __ZN7WebCore19jsOverflowEventBOTHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore25jsOverflowEventHORIZONTALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore23jsOverflowEventVERTICALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore24JSOverflowEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCore17JSPluginPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSProgressEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSPluginPrototype9classInfoEv
+__ZNK7WebCore22JSPluginArrayPrototype9classInfoEv
 __ZN7WebCore17jsRangeNODE_AFTEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore18jsRangeNODE_BEFOREEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore28jsRangeNODE_BEFORE_AND_AFTEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore18jsRangeNODE_INSIDEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSRectConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsSVGAngleSVG_ANGLETYPE_DEGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGAngleSVG_ANGLETYPE_GRADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGAngleSVG_ANGLETYPE_RADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGAngleSVG_ANGLETYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGAngleSVG_ANGLETYPE_UNSPECIFIEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore19JSSVGAnglePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSSVGAnglePrototype9classInfoEv
+__ZN7WebCore36jsSVGColorSVG_COLORTYPE_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGColorSVG_COLORTYPE_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGColorSVG_COLORTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSSVGColorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsSVGExceptionSVG_INVALID_VALUE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGExceptionSVG_MATRIX_NOT_INVERTABLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGExceptionSVG_WRONG_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSSVGExceptionPrototype9classInfoEv
+__ZN7WebCore40jsSVGGradientElementSVG_SPREADMETHOD_PADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGGradientElementSVG_SPREADMETHOD_REFLECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGGradientElementSVG_SPREADMETHOD_REPEATEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSSVGGradientElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_CMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGLengthSVG_LENGTHTYPE_EMSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGLengthSVG_LENGTHTYPE_EXSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_INEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_MMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGLengthSVG_LENGTHTYPE_NUMBEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsSVGLengthSVG_LENGTHTYPE_PERCENTAGEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGLengthSVG_LENGTHTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGLengthPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGLengthPrototype9classInfoEv
+__ZN7WebCore45jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsSVGMarkerElementSVG_MARKER_ORIENT_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSSVGMarkerElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore36jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPaintSVG_PAINTTYPE_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPaintSVG_PAINTTYPE_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGPaintSVG_PAINTTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPaintSVG_PAINTTYPE_URIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPaintSVG_PAINTTYPE_URI_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSSVGPaintPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegPATHSEG_ARC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegPATHSEG_ARC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegPATHSEG_CLOSEPATHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGPathSegPATHSEG_CURVETO_CUBIC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_LINETO_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_LINETO_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGPathSegPATHSEG_LINETO_VERTICAL_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_MOVETO_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_MOVETO_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegPATHSEG_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore21JSSVGPathSegPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSSVGPathSegPrototype9classInfoEv
+__ZN7WebCore44jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEETEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
 __ZN7WebCore33JSSVGPreserveAspectRatioPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSSVGPreserveAspectRatioPrototype9classInfoEv
+__ZN7WebCore58jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySl
+__ZN7WebCore41jsSVGRenderingIntentRENDERING_INTENT_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySl
+__ZN7WebCore47jsSVGRenderingIntentRENDERING_INTENT_SATURATIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGRenderingIntentRENDERING_INTENT_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore29JSSVGRenderingIntentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSSVGRenderingIntentPrototype9classInfoEv
+__ZN7WebCore43jsSVGTextContentElementLENGTHADJUST_SPACINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGTextContentElementLENGTHADJUST_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore46jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSSVGTextPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsSVGTransformSVG_TRANSFORM_MATRIXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGTransformSVG_TRANSFORM_ROTATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SCALEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SKEWXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SKEWYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGTransformSVG_TRANSFORM_TRANSLATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGTransformSVG_TRANSFORM_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGTransformPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSSVGTransformPrototype9classInfoEv
+__ZN7WebCore45jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore23JSSVGUnitTypesPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSSVGUnitTypesPrototype9classInfoEv
+__ZNK7WebCore18JSStoragePrototype9classInfoEv
 __ZN7WebCore23JSStorageEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCore20JSTextEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSTextMetricsPrototype9classInfoEv
 __ZN7WebCore31JSWebKitAnimationEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSWebKitCSSMatrixPrototype9classInfoEv
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_MATRIXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsWebKitCSSTransformValueCSS_MATRIX3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsWebKitCSSTransformValueCSS_PERSPECTIVEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_ROTATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsWebKitCSSTransformValueCSS_ROTATE3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_ROTATEXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_ROTATEYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_ROTATEZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsWebKitCSSTransformValueCSS_SCALEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_SCALE3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_SCALEXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_SCALEYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_SCALEZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsWebKitCSSTransformValueCSS_SKEWEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsWebKitCSSTransformValueCSS_SKEWXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsWebKitCSSTransformValueCSS_SKEWYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsWebKitCSSTransformValueCSS_TRANSLATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsWebKitCSSTransformValueCSS_TRANSLATE3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsWebKitCSSTransformValueCSS_TRANSLATEXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsWebKitCSSTransformValueCSS_TRANSLATEYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsWebKitCSSTransformValueCSS_TRANSLATEZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore34JSWebKitCSSTransformValuePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSWebKitPointPrototype9classInfoEv
 __ZN7WebCore32JSWebKitTransitionEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSWorkerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSWorkerPrototype9classInfoEv
+__ZNK7WebCore25JSXMLHttpRequestPrototype9classInfoEv
+__ZN7WebCore20jsXMLHttpRequestDONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore32jsXMLHttpRequestHEADERS_RECEIVEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore23jsXMLHttpRequestLOADINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore22jsXMLHttpRequestOPENEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore22jsXMLHttpRequestUNSENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore34jsXMLHttpRequestExceptionABORT_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore36jsXMLHttpRequestExceptionNETWORK_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34JSXMLHttpRequestExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL42getJSXMLHttpRequestExceptionPrototypeTableEPN3JSC9ExecStateE
+__ZNK7WebCore34JSXMLHttpRequestExceptionPrototype9classInfoEv
 __ZN7WebCore31JSXMLHttpRequestUploadPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL39getJSXMLHttpRequestUploadPrototypeTableEPN3JSC9ExecStateE
+__ZNK7WebCore31JSXMLHttpRequestUploadPrototype9classInfoEv
+__ZNK7WebCore24JSXMLSerializerPrototype9classInfoEv
+__ZNK7WebCore25JSXPathEvaluatorPrototype9classInfoEv
 __ZN7WebCore21jsXPathResultANY_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore36jsXPathResultANY_UNORDERED_NODE_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore25jsXPathResultBOOLEAN_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
@@ -18822,10 +18833,14 @@
 __ZN7WebCore39jsXPathResultORDERED_NODE_ITERATOR_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore24jsXPathResultSTRING_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore41jsXPathResultUNORDERED_NODE_ITERATOR_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24JSXSLTProcessorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSXSLTProcessorPrototype9classInfoEv
+__ZN7WebCore21JSDOMApplicationCache3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore30JSDOMApplicationCachePrototype9classInfoEv
 __ZN7WebCore29jsDOMApplicationCacheCHECKINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore32jsDOMApplicationCacheDOWNLOADINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsDOMApplicationCacheIDLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore29jsDOMApplicationCacheOBSOLETEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMApplicationCacheUNCACHEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore32jsDOMApplicationCacheUPDATEREADYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore29jsDOMApplicationCacheOncachedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore31jsDOMApplicationCacheOncheckingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
@@ -18835,546 +18850,417 @@
 __ZN7WebCore31jsDOMApplicationCacheOnobsoleteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore31jsDOMApplicationCacheOnprogressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore34jsDOMApplicationCacheOnupdatereadyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17jsNavigatorOnLineEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13NavigatorBase6onLineEv
+__ZN7WebCore27jsDOMApplicationCacheStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19DOMApplicationCache6statusEv
+__ZNK7WebCore19DOMApplicationCache15associatedCacheEv
+__ZNK7WebCore18JSConsolePrototype9classInfoEv
 __ZN7WebCore17jsConsoleProfilesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore9JSConsole8profilesEPN3JSC9ExecStateE
-__ZN7WebCore9JSHistory16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore9JSHistory22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore6Chrome15toolbarsVisibleEv
-__ZNK7WebCore6Chrome14menubarVisibleEv
-__ZN7WebCore35setJSDOMWindowStyleSheetConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore38setJSDOMWindowCSSStyleSheetConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore37setJSDOMWindowCSSValueListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore39setJSDOMWindowCSSCharsetRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore40setJSDOMWindowCSSFontFaceRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore38setJSDOMWindowCSSImportRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore37setJSDOMWindowCSSMediaRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore36setJSDOMWindowCSSPageRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore37setJSDOMWindowCSSStyleRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore34setJSDOMWindowMediaListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore36setJSDOMWindowCSSRuleListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29setJSDOMWindowRectConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore37setJSDOMWindowNamedNodeMapConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore46setJSDOMWindowHTMLBlockquoteElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore41setJSDOMWindowHTMLEmbedElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore31jsConsolePrototypeFunctionTraceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Console5traceEPNS_15ScriptCallStackE
-__ZN7WebCore15ScriptCallStack4sizeEv
-__ZN7WebCore15ScriptCallStack10initializeEv
-__ZNK7WebCore9Attribute5cloneEv
-__ZN7WebCore19setJSHTMLElementDirEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11HTMLElement6setDirERKNS_6StringE
-__ZN7WebCore29setJSHTMLAnchorElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAnchorElement10setCharsetERKNS_12AtomicStringE
-__ZN7WebCore28setJSHTMLAnchorElementCoordsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAnchorElement9setCoordsERKNS_12AtomicStringE
-__ZN7WebCore30setJSHTMLAnchorElementHreflangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAnchorElement11setHreflangERKNS_12AtomicStringE
-__ZN7WebCore25setJSHTMLAnchorElementRevEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAnchorElement6setRevERKNS_12AtomicStringE
-__ZN7WebCore27setJSHTMLAnchorElementShapeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAnchorElement8setShapeERKNS_12AtomicStringE
-__ZN7WebCore26setJSHTMLAnchorElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAnchorElement7setTypeERKNS_12AtomicStringE
-__ZN7WebCore27setJSHTMLAppletElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25setJSHTMLAppletElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAppletElement6setAltERKNS_6StringE
-__ZN7WebCore29setJSHTMLAppletElementArchiveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAppletElement10setArchiveERKNS_6StringE
-__ZN7WebCore26setJSHTMLAppletElementCodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAppletElement7setCodeERKNS_6StringE
-__ZN7WebCore30setJSHTMLAppletElementCodeBaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAppletElement11setCodeBaseERKNS_6StringE
-__ZN7WebCore28setJSHTMLAppletElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore28setJSHTMLAppletElementHspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAppletElement9setHspaceERKNS_6StringE
-__ZN7WebCore26setJSHTMLAppletElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore28setJSHTMLAppletElementObjectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAppletElement9setObjectERKNS_6StringE
-__ZN7WebCore28setJSHTMLAppletElementVspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLAppletElement9setVspaceERKNS_6StringE
-__ZN7WebCore27setJSHTMLAppletElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29setJSHTMLAreaElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLAreaElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore26setJSHTMLAreaElementCoordsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLAreaElement9setCoordsERKNS_6StringE
-__ZN7WebCore25setJSHTMLAreaElementShapeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLAreaElement8setShapeERKNS_6StringE
-__ZN7WebCore26setJSHTMLAreaElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLAreaElement9setTargetERKNS_6StringE
-__ZN7WebCore24setJSHTMLBaseElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLBaseElement7setHrefERKNS_6StringE
-__ZN7WebCore26setJSHTMLBaseElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLBaseElement9setTargetERKNS_6StringE
-__ZN7WebCore21JSHTMLBaseFontElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore29setJSHTMLBaseFontElementColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLBaseFontElement8setColorERKNS_6StringE
-__ZN7WebCore28setJSHTMLBaseFontElementFaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLBaseFontElement7setFaceERKNS_6StringE
-__ZN7WebCore30setJSHTMLBlockquoteElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore21HTMLBlockquoteElement7setCiteERKNS_6StringE
-__ZN7WebCore25setJSHTMLBodyElementALinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLBodyElement8setALinkERKNS_6StringE
-__ZN7WebCore30setJSHTMLBodyElementBackgroundEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLBodyElement13setBackgroundERKNS_6StringE
-__ZN7WebCore24setJSHTMLBodyElementLinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore24setJSHTMLBodyElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25setJSHTMLBodyElementVLinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23setJSHTMLBRElementClearEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore13HTMLBRElement8setClearERKNS_6StringE
-__ZN7WebCore31setJSHTMLButtonElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLButtonElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore23jsHTMLEmbedElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25setJSHTMLFontElementColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLFontElement8setColorERKNS_6StringE
-__ZN7WebCore24setJSHTMLFontElementFaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLFontElement7setFaceERKNS_6StringE
-__ZN7WebCore25jsHTMLFormElementEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27setJSHTMLFormElementEnctypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore32setJSHTMLFrameElementFrameBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29setJSHTMLFrameElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLFrameElementBase11setLongDescERKNS_6StringE
-__ZN7WebCore33setJSHTMLFrameElementMarginHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore32setJSHTMLFrameElementMarginWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25setJSHTMLFrameElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore30setJSHTMLFrameElementScrollingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29setJSHTMLFrameElementLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore18JSHTMLFrameElement11setLocationEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore26jsHTMLFrameElementLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20HTMLFrameElementBase8locationEv
-__ZN7WebCore21JSHTMLFrameSetElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore28setJSHTMLFrameSetElementColsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLFrameSetElement7setColsERKNS_6StringE
-__ZN7WebCore28setJSHTMLFrameSetElementRowsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLFrameSetElement7setRowsERKNS_6StringE
-__ZN7WebCore27setJSHTMLHeadElementProfileEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLHeadElement10setProfileERKNS_6StringE
-__ZN7WebCore28setJSHTMLHeadingElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore18HTMLHeadingElement8setAlignERKNS_6StringE
-__ZN7WebCore23setJSHTMLHRElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore13HTMLHRElement8setAlignERKNS_6StringE
-__ZN7WebCore22setJSHTMLHRElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore13HTMLHRElement7setSizeERKNS_6StringE
-__ZN7WebCore23setJSHTMLHRElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore13HTMLHRElement8setWidthERKNS_6StringE
-__ZN7WebCore27setJSHTMLIFrameElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLIFrameElement8setAlignERKNS_6StringE
-__ZN7WebCore30setJSHTMLIFrameElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore27setJSHTMLInputElementAcceptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement9setAcceptERKNS_6StringE
-__ZN7WebCore30setJSHTMLInputElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore26setJSHTMLInputElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement8setAlignERKNS_6StringE
-__ZN7WebCore24setJSHTMLInputElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement6setAltERKNS_6StringE
-__ZN7WebCore27setJSHTMLInputElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement9setUseMapERKNS_6StringE
-__ZN7WebCore29setJSHTMLIsIndexElementPromptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore18HTMLIsIndexElement9setPromptERKNS_6StringE
-__ZN7WebCore30setJSHTMLLabelElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLLabelElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore31setJSHTMLLegendElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLLegendElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore27setJSHTMLLegendElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLLegendElement8setAlignERKNS_6StringE
-__ZN7WebCore22setJSHTMLLIElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore13HTMLLIElement7setTypeERKNS_6StringE
-__ZN7WebCore27setJSHTMLLinkElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLLinkElement10setCharsetERKNS_6StringE
-__ZN7WebCore28setJSHTMLLinkElementHreflangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLLinkElement11setHreflangERKNS_6StringE
-__ZN7WebCore23setJSHTMLLinkElementRevEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLLinkElement6setRevERKNS_6StringE
-__ZN7WebCore26setJSHTMLLinkElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLLinkElement9setTargetERKNS_6StringE
-__ZN7WebCore23setJSHTMLMapElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore14HTMLMapElement7setNameERKNS_6StringE
-__ZN7WebCore26setJSHTMLMetaElementSchemeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLMetaElement9setSchemeERKNS_6StringE
-__ZN7WebCore23setJSHTMLModElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore14HTMLModElement7setCiteERKNS_6StringE
-__ZN7WebCore27setJSHTMLModElementDateTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore14HTMLModElement11setDateTimeERKNS_6StringE
-__ZN7WebCore26setJSHTMLObjectElementCodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLObjectElement7setCodeERKNS_6StringE
-__ZN7WebCore27setJSHTMLObjectElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29setJSHTMLObjectElementArchiveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLObjectElement10setArchiveERKNS_6StringE
-__ZN7WebCore28setJSHTMLObjectElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLObjectElement9setBorderERKNS_6StringE
-__ZN7WebCore30setJSHTMLObjectElementCodeBaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLObjectElement11setCodeBaseERKNS_6StringE
-__ZN7WebCore30setJSHTMLObjectElementCodeTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLObjectElement11setCodeTypeERKNS_6StringE
-__ZN7WebCore26setJSHTMLObjectElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore29setJSHTMLObjectElementStandbyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLObjectElement10setStandbyERKNS_6StringE
-__ZN7WebCore28setJSHTMLObjectElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLObjectElement9setUseMapERKNS_6StringE
-__ZN7WebCore25setJSHTMLOListElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLOListElement7setTypeERKNS_6StringE
-__ZN7WebCore29setJSHTMLOptGroupElementLabelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLOptGroupElement8setLabelERKNS_6StringE
-__ZN7WebCore30setJSHTMLParagraphElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLParagraphElement8setAlignERKNS_6StringE
-__ZN7WebCore25setJSHTMLParamElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLParamElement7setTypeERKNS_6StringE
-__ZN7WebCore30setJSHTMLParamElementValueTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLParamElement12setValueTypeERKNS_6StringE
-__ZN7WebCore25setJSHTMLQuoteElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLQuoteElement7setCiteERKNS_6StringE
-__ZN7WebCore29setJSHTMLScriptElementHtmlForEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLScriptElement10setHtmlForERKNS_6StringE
-__ZN7WebCore27setJSHTMLScriptElementEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLScriptElement8setEventERKNS_6StringE
-__ZN7WebCore33setJSHTMLTableCaptionElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23HTMLTableCaptionElement8setAlignERKNS_6StringE
-__ZN7WebCore29setJSHTMLTableCellElementAbbrEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement7setAbbrERKNS_6StringE
-__ZN7WebCore29setJSHTMLTableCellElementAxisEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement7setAxisERKNS_6StringE
-__ZN7WebCore32setJSHTMLTableCellElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement10setBgColorERKNS_6StringE
-__ZN7WebCore27setJSHTMLTableCellElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement5setChERKNS_6StringE
-__ZN7WebCore30setJSHTMLTableCellElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement8setChOffERKNS_6StringE
-__ZN7WebCore32setJSHTMLTableCellElementHeadersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement10setHeadersERKNS_6StringE
-__ZN7WebCore30setJSHTMLTableCellElementScopeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement8setScopeERKNS_6StringE
-__ZN7WebCore31setJSHTMLTableCellElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20HTMLTableCellElement9setVAlignERKNS_6StringE
-__ZN7WebCore29setJSHTMLTableColElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTableColElement8setAlignERKNS_6StringE
-__ZN7WebCore26setJSHTMLTableColElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTableColElement5setChERKNS_6StringE
-__ZN7WebCore29setJSHTMLTableColElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTableColElement8setChOffERKNS_6StringE
-__ZN7WebCore30setJSHTMLTableColElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTableColElement9setVAlignERKNS_6StringE
-__ZN7WebCore28setJSHTMLTableElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLTableElement10setBgColorERKNS_6StringE
-__ZN7WebCore26setJSHTMLTableElementFrameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLTableElement8setFrameERKNS_6StringE
-__ZN7WebCore26setJSHTMLTableElementRulesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLTableElement8setRulesERKNS_6StringE
-__ZN7WebCore29setJSHTMLTableRowElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTableRowElement8setAlignERKNS_6StringE
-__ZN7WebCore31setJSHTMLTableRowElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTableRowElement10setBgColorERKNS_6StringE
-__ZN7WebCore26setJSHTMLTableRowElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTableRowElement5setChERKNS_6StringE
-__ZN7WebCore29setJSHTMLTableRowElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTableRowElement8setChOffERKNS_6StringE
-__ZN7WebCore30setJSHTMLTableRowElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTableRowElement9setVAlignERKNS_6StringE
-__ZN7WebCore33setJSHTMLTableSectionElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23HTMLTableSectionElement8setAlignERKNS_6StringE
-__ZN7WebCore30setJSHTMLTableSectionElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23HTMLTableSectionElement5setChERKNS_6StringE
-__ZN7WebCore33setJSHTMLTableSectionElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23HTMLTableSectionElement8setChOffERKNS_6StringE
-__ZN7WebCore34setJSHTMLTableSectionElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore23HTMLTableSectionElement9setVAlignERKNS_6StringE
-__ZN7WebCore36setJSHTMLTextAreaElementDefaultValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore33setJSHTMLTextAreaElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore19HTMLTextAreaElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore25setJSHTMLTitleElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore25setJSHTMLUListElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLUListElement7setTypeERKNS_6StringE
-__ZN7WebCore5Image9nullImageEv
-__ZN7WebCore10JSCSSValue3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore14JSCSSStyleRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore9JSCSSRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore40jsHTMLSelectElementPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore33jsHistoryPrototypeFunctionForwardEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7History7forwardEv
-__ZN7WebCore20setJSHTMLDocumentDirEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore12HTMLDocument6setDirERKNS_6StringE
-__ZN7WebCore6JSRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4RectEEE
-__ZN7WebCore13StringBuilder6appendEc
-__ZN7WebCore31jsCSSStyleDeclarationParentRuleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27CSSComputedStyleDeclaration11setPropertyEiRKNS_6StringEbRi
-__ZNK3JSC8Bindings9JavaClass13isStringClassEv
-__ZN7WebCore23jsHTMLDocumentLinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12HTMLDocument9linkColorEv
-__ZN7WebCore21jsHTMLDocumentFgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12HTMLDocument7fgColorEv
-__ZN7WebCore24jsHTMLDocumentVlinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12HTMLDocument10vlinkColorEv
-__ZN7WebCore24jsHTMLDocumentAlinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12HTMLDocument10alinkColorEv
-__ZN7WebCore17jsHTMLDocumentDirEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12HTMLDocument3dirEv
-__ZN7WebCore32jsDocumentPreferredStylesheetSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Document22preferredStylesheetSetEv
-__ZN7WebCore31jsDocumentSelectedStylesheetSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore8Document21selectedStylesheetSetEv
-__ZN7WebCore19JSHTMLAppletElement11getCallDataERN3JSC8CallDataE
-__ZN7WebCore17setJSDocumentBodyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore8Document7setBodyEN3WTF10PassRefPtrINS_11HTMLElementEEERi
-__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionRemoveRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13KeyboardEventC2Ev
-__ZN7WebCore26JSXSLTProcessorConstructor16getConstructDataERN3JSC13ConstructDataE
-__ZN7WebCoreL22constructXSLTProcessorEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
-__ZN7WebCore15JSXSLTProcessorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XSLTProcessorEEE
-__ZN7WebCore20jsNodeIteratorFilterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10NodeFilterE
-__ZN7WebCore12JSNodeFilterC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10NodeFilterEEE
-__ZN7WebCore30setJSProcessingInstructionDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore33jsLocationPrototypeFunctionAssignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore10JSLocation6assignEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore12JSNodeFilter4markEv
-__ZNK7WebCore29JSXMLHttpRequestProgressEvent9classInfoEv
-__ZNK7WebCore38JSXMLHttpRequestProgressEventPrototype9classInfoEv
-__ZN7WebCore31jsHTMLFrameElementContentWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20setJSHTMLDocumentAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore14JSHTMLDocument6setAllEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore16JSDOMWindowShell12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
-__ZN7WebCore11JSDOMWindow12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
-__ZN7WebCore25setJSHTMLElementOuterTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11HTMLElement12setOuterTextERKNS_6StringERi
-__ZN7WebCore16JSDOMWindowShell12lookupGetterEPN3JSC9ExecStateERKNS1_10IdentifierE
-__ZN7WebCore11JSDOMWindow12lookupGetterEPN3JSC9ExecStateERKNS1_10IdentifierE
-__ZN7WebCore16JSDOMWindowShell12defineSetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
-__ZN7WebCore11JSDOMWindow12defineSetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
-__ZN7WebCore19JSWorkerConstructor16getConstructDataERN3JSC13ConstructDataE
-__ZN7WebCoreL15constructWorkerEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
-__ZNK7WebCore15JSXSLTProcessor9classInfoEv
-__ZN7WebCore19jsCSSMediaRuleMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9MediaListE
-__ZN7WebCore11JSMediaListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9MediaListEEE
-__ZN7WebCore19setJSCSSRuleCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore7CSSRule10setCssTextERKNS_6StringERi
-__ZN7WebCore29setJSCSSStyleRuleSelectorTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore12CSSStyleRule15setSelectorTextERKNS_6StringERi
-__ZN7WebCore20setJSCSSValueCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11JSMediaList3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore23setJSMediaListMediaTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore11JSMediaList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20jsMediaListMediaTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9Attribute17isMappedAttributeEv
-__ZN7WebCore50jsCanvasRenderingContext2DGlobalCompositeOperationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore24CanvasRenderingContext2D24globalCompositeOperationEv
-__ZN7WebCore21compositeOperatorNameENS_17CompositeOperatorE
-__ZN7WebCore33jsCanvasRenderingContext2DLineCapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore24CanvasRenderingContext2D7lineCapEv
-__ZN7WebCore11lineCapNameENS_7LineCapE
-__ZN7WebCore34jsCanvasRenderingContext2DLineJoinEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore24CanvasRenderingContext2D8lineJoinEv
-__ZN7WebCore12lineJoinNameENS_8LineJoinE
-__ZN7WebCore34setJSDocumentSelectedStylesheetSetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore8Document24setSelectedStylesheetSetERKNS_6StringE
-__ZN7WebCore27setJSHTMLDocumentAlinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore12HTMLDocument13setAlinkColorERKNS_6StringE
-__ZN7WebCore17JSHTMLFormElement16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore19JSHTMLSelectElement16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore28jsHTMLSelectElementAutofocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore31jsHTMLSelectElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore22HTMLFormControlElement12willValidateEv
-__ZN7WebCore16JSStyleSheetList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore13JSCSSRuleList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore14JSCSSValueList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore11JSMediaList9classInfoEv
-__ZN7WebCore11JSMediaList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore11JSMediaList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore9MediaList4itemEj
-__ZN7WebCore17jsMediaListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsMediaListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore19jsCSSImportRuleHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsCSSImportRuleMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore13CSSImportRule7cssTextEv
-__ZN7WebCore39jsElementPrototypeFunctionScrollByLinesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Element13scrollByLinesEi
-__ZN7WebCore7Element13scrollByUnitsEiNS_17ScrollGranularityE
-__ZN7WebCore39jsElementPrototypeFunctionScrollByPagesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Element13scrollByPagesEi
-__ZN7WebCore30setJSHTMLBodyElementScrollLeftEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15HTMLBodyElement13setScrollLeftEi
-__ZN7WebCore46jsHTMLOptionsCollectionPrototypeFunctionRemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore23JSHTMLOptionsCollection6removeEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore49jsKeyboardEventPrototypeFunctionInitKeyboardEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13KeyboardEvent17initKeyboardEventERKNS_12AtomicStringEbbPNS_9DOMWindowERKNS_6StringEjbbbbb
-__ZN7WebCore13ProgressEventC2Ev
-__ZN7WebCore49jsProgressEventPrototypeFunctionInitProgressEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore15JSProgressEvent9classInfoEv
-__ZN7WebCore13ProgressEvent17initProgressEventERKNS_12AtomicStringEbbbjj
-__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionSetFloatValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore17CSSPrimitiveValue13setFloatValueEtdRi
-__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionSetStringValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore17CSSPrimitiveValue14setStringValueEtRKNS_6StringERi
-__ZN7WebCore12JSNodeFilter18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17jsAttrConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsCommentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore29jsDocumentFragmentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsDOMImplementationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore23JSNodeIteratorPrototype9classInfoEv
-__ZN7WebCore25jsNodeIteratorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore14JSNodeIterator14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore25JSNodeIteratorConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore23JSNodeIteratorPrototype4selfEPN3JSC9ExecStateE
-__ZNK7WebCore25JSNodeIteratorConstructor9classInfoEv
-__ZN7WebCore18jsRangeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21JSTreeWalkerPrototype9classInfoEv
-__ZN7WebCore23jsTreeWalkerConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore12JSTreeWalker14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore21JSTreeWalkerPrototype4selfEPN3JSC9ExecStateE
-__ZNK7WebCore23JSTreeWalkerConstructor9classInfoEv
-__ZN7WebCore21jsDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsCDATASectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore28jsEntityReferenceConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsProcessingInstructionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsKeyboardEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore23jsMouseEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsMutationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore13OverflowEventC2Ev
-__ZNK7WebCore13OverflowEvent15isOverflowEventEv
-__ZN7WebCore15getDOMStructureINS_15JSOverflowEventEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore15JSOverflowEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13OverflowEventEEE
-__ZNK7WebCore15JSOverflowEvent9classInfoEv
-__ZN7WebCore15JSOverflowEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26jsOverflowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9TextEventC2Ev
-__ZN7WebCore15getDOMStructureINS_11JSTextEventEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore11JSTextEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9TextEventEEE
-__ZNK7WebCore11JSTextEvent9classInfoEv
-__ZN7WebCore11JSTextEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22jsTextEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsUIEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore10WheelEventC2Ev
-__ZN7WebCore15getDOMStructureINS_12JSWheelEventEEEPN3JSC9StructureEPNS2_9ExecStateE
-__ZN7WebCore12JSWheelEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10WheelEventEEE
-__ZNK7WebCore12JSWheelEvent9classInfoEv
-__ZN7WebCore12JSWheelEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23jsWheelEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore27jsStyleSheetListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsCSSStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore24jsCSSRuleListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsCSSStyleRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore32jsCSSStyleDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsCSSPrimitiveValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore10JSRGBColor9classInfoEv
-__ZNK7WebCore6JSRect9classInfoEv
-__ZN7WebCore6JSRect18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17jsRectConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore9JSCounterC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CounterEEE
-__ZNK7WebCore9JSCounter9classInfoEv
-__ZN7WebCore9JSCounter18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20jsCounterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17jsStyleSheetMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore22jsMediaListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore26JSXPathExpressionPrototype9classInfoEv
-__ZN7WebCore28jsXPathExpressionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17JSXPathExpression14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore28JSXPathExpressionConstructorC2EPN3JSC9ExecStateE
-__ZN7WebCore26JSXPathExpressionPrototype4selfEPN3JSC9ExecStateE
-__ZNK7WebCore28JSXPathExpressionConstructor9classInfoEv
-__ZN7WebCore24jsXPathResultConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore21JSHTMLBaseFontElement9classInfoEv
-__ZN7WebCore34jsHTMLBlockquoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore30jsHTMLCanvasElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore22JSHTMLDirectoryElement9classInfoEv
-__ZN7WebCore29jsHTMLEmbedElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20JSHTMLIsIndexElement9classInfoEv
-__ZN7WebCoreL17keygenConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLKeygenElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore20getSupportedKeySizesERN3WTF6VectorINS_6StringELm0EEE
-__ZNK7WebCore20JSHTMLMarqueeElement9classInfoEv
-__ZN7WebCore31jsHTMLMarqueeElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore17JSHTMLMenuElement9classInfoEv
-__ZNK7WebCore18JSHTMLQuoteElement9classInfoEv
-__ZN7WebCore11JSTextEventD0Ev
-__ZN7WebCore15JSOverflowEventD0Ev
-__ZN7WebCore6JSRectD0Ev
-__ZN7WebCore23JSTreeWalkerConstructorD0Ev
-__ZN3WTF6VectorIN7WebCore12ScriptStringELm0EE6shrinkEm
-__ZN7WebCore51jsHTMLElementPrototypeFunctionInsertAdjacentElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZNK7WebCore14SecurityOrigin5equalEPKS0_
+__ZNK7WebCore23JSDOMSelectionPrototype9classInfoEv
+__ZN7WebCore19JSLocationPrototype12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore19JSLocationPrototype3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19JSLocationPrototype9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSLocation12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore12JSSVGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10SVGElementEEE
+__ZN7WebCore12JSSVGElementD1Ev
+__ZN7WebCoreL20setTableCellsChangedEPNS_4NodeE
+__ZN7WebCore28setJSHTMLTextAreaElementRowsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement7setRowsEi
+__ZN7WebCore23JSCustomXPathNSResolver18lookupNamespaceURIERKNS_6StringE
+__ZN7WebCore51jsHTMLElementPrototypeFunctionInsertAdjacentElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore11HTMLElement21insertAdjacentElementERKNS_6StringEPNS_7ElementERi
-__ZN7WebCore48jsHTMLElementPrototypeFunctionInsertAdjacentTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore16HTMLMediaElement19removedFromDocumentEv
+__ZN7WebCoreL17sourceConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLSourceElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLSourceElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL30createHTMLSourceElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLSourceElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLSourceElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSourceElementEEE
+__ZN7WebCore19JSHTMLSourceElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSourceElementEEE
+__ZNK7WebCore19JSHTMLSourceElement9classInfoEv
+__ZN7WebCore17HTMLSourceElement20insertedIntoDocumentEv
+__ZN7WebCore19JSHTMLSourceElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZThn8_N7WebCore16HTMLVideoElementD0Ev
+__ZN7WebCore19JSHTMLSourceElementD1Ev
+__ZThn8_N7WebCore17HTMLSourceElementD0Ev
+__ZN7WebCore17HTMLSourceElementD0Ev
+__ZN7WebCore28JSHTMLSourceElementPrototypeD1Ev
+__ZN7WebCore48jsHTMLElementPrototypeFunctionInsertAdjacentTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore11HTMLElement18insertAdjacentTextERKNS_6StringES3_Ri
 __ZN7WebCore11RenderLayer20updateOverflowStatusEbb
 __ZN7WebCore9FrameView20updateOverflowStatusEbb
+__ZN7WebCore13OverflowEventC1Ebbbb
 __ZN7WebCore13OverflowEventC2Ebbbb
+__ZNK7WebCore5XPath13FunStartsWith8evaluateEv
+__ZN7WebCoreL17gbkCallbackEscapeEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
+__ZN7WebCoreL12getGbkEscapeEi
 __ZNK7WebCore14CSSCharsetRule7cssTextEv
 __ZN7WebCore24jsCSSCharsetRuleEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore16JSCSSCharsetRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore27setJSCSSCharsetRuleEncodingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCoreL17gbkCallbackEscapeEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
+__ZN7WebCore16JSCSSCharsetRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore27setJSCSSCharsetRuleEncodingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore14CSSCharsetRule13isCharsetRuleEv
-__ZN7WebCoreL12getGbkEscapeEi
-__ZN7WebCore21jsOverflowEventOrientEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsOverflowEventHorizontalOverflowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore31jsOverflowEventVerticalOverflowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore6Chrome12canTakeFocusENS_14FocusDirectionE
-__ZNK7WebCore6Chrome9takeFocusENS_14FocusDirectionE
-__ZN7WebCore6WorkerC1ERKNS_6StringEPNS_8DocumentERi
-__ZThn44_N7WebCore8Document25refScriptExecutionContextEv
-__ZN7WebCore8Document25refScriptExecutionContextEv
-__ZN7WebCore20WorkerMessagingProxyC1EN3WTF10PassRefPtrINS_22ScriptExecutionContextEEEPNS_6WorkerE
-__ZNK7WebCore6Worker8documentEv
+__ZN7WebCore26setJSHTMLImageElementIsMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement8setIsMapEb
+__ZN7WebCoreL15newTextCodecMacERKNS_12TextEncodingEPKv
+__ZN7WebCore12TextCodecMacC1Ej
+__ZN7WebCore12TextCodecMacC2Ej
+__ZN7WebCore12TextCodecMac6decodeEPKcmbbRb
+__ZNK7WebCore12TextCodecMac18createTECConverterEv
+__ZN7WebCoreL18cachedConverterTECEv
+__ZN7WebCore12TextCodecMac6decodeEPKhiRiPviS3_
+__ZN7WebCore12TextCodecMacD0Ev
+__ZNK7WebCore12TextCodecMac19releaseTECConverterEv
+__ZN7WebCoreL26gbkUrlEscapedEntityCallackEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
+__ZNK7WebCore8Document21getElementByAccessKeyERKNS_6StringE
+__ZN3WTF7HashMapIPN7WebCore10StringImplEPNS1_7ElementENS1_15CaseFoldingHashENS_10HashTraitsIS3_EENS7_IS5_EEE3setERKS3_RKS5_
+__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS1_15CaseFoldingHashENS_14Pai
+__ZNK3WTF7HashMapIPN7WebCore10StringImplEPNS1_7ElementENS1_15CaseFoldingHashENS_10HashTraitsIS3_EENS7_IS5_EEE3getERKS3_
+__ZN7WebCore17HTMLAnchorElement15accessKeyActionEb
+__ZN7WebCore22jsKeyboardEventCtrlKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsKeyboardEventAltKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsKeyboardEventMetaKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsKeyboardEventKeyIdentifierEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsKeyboardEventKeyLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12EventHandler14scrollOverflowENS_15ScrollDirectionENS_17ScrollGranularityE
+__ZNK7WebCore27RenderTextControlSingleLine10scrollLeftEv
+__ZN7WebCore35setJSHTMLInputElementSelectionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLInputElement17setSelectionStartEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore16HTMLInputElement17setSelectionStartEi
+__ZN7WebCore33setJSHTMLInputElementSelectionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLInputElement15setSelectionEndEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore16HTMLInputElement15setSelectionEndEi
+__ZNK7WebCore11RenderBlock24containsNonZeroBidiLevelEv
+__ZN7WebCore22jsXMLHttpRequestUploadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14XMLHttpRequest6uploadEv
+__ZN7WebCore20XMLHttpRequestUploadC1EPNS_14XMLHttpRequestE
+__ZN7WebCore20XMLHttpRequestUploadC2EPNS_14XMLHttpRequestE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_20XMLHttpRequestUploadE
+__ZN7WebCore22JSXMLHttpRequestUploadC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20XMLHttpRequestUploadEEE
+__ZN7WebCore22JSXMLHttpRequestUploadC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20XMLHttpRequestUploadEEE
+__ZN7WebCore6WorkerC1ERKNS_6StringEPNS_22ScriptExecutionContextERi
+__ZN7WebCore6WorkerC2ERKNS_6StringEPNS_22ScriptExecutionContextERi
+__ZN7WebCore18WorkerContextProxy6createEPNS_6WorkerE
+__ZN7WebCore20WorkerMessagingProxyC1EPNS_6WorkerE
+__ZN7WebCore20WorkerMessagingProxyC2EPNS_6WorkerE
 __ZNK7WebCore6Worker22scriptExecutionContextEv
-__ZN7WebCore6Worker18dispatchErrorEventEv
-__ZN7WebCore6Worker13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZThn88_N7WebCore8Document25refScriptExecutionContextEv
+__ZN7WebCore8Document25refScriptExecutionContextEv
+__ZThn24_N7WebCore6Worker14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore6Worker14notifyFinishedEPNS_14CachedResourceE
+__ZThn88_NK7WebCore8Document9userAgentERKNS_4KURLE
+__ZNK7WebCore8Document9userAgentERKNS_4KURLE
+__ZN7WebCore20WorkerMessagingProxy18startWorkerContextERKNS_4KURLERKNS_6StringES6_
+__ZN7WebCore12WorkerThread6createERKNS_4KURLERKNS_6StringES6_PNS_17WorkerObjectProxyE
+__ZN7WebCore12WorkerThreadC1ERKNS_4KURLERKNS_6StringES6_PNS_17WorkerObjectProxyE
+__ZN7WebCore12WorkerThreadC2ERKNS_4KURLERKNS_6StringES6_PNS_17WorkerObjectProxyE
+__ZN7WebCore13WorkerRunLoopC1Ev
+__ZN7WebCore13WorkerRunLoopC2Ev
+__ZN7WebCore23WorkerThreadStartupDataC1ERKNS_4KURLERKNS_6StringES6_
+__ZN7WebCore23WorkerThreadStartupDataC2ERKNS_4KURLERKNS_6StringES6_
+__ZNK7WebCore4KURL4copyEv
+__ZN7WebCore20WorkerMessagingProxy19workerThreadCreatedEN3WTF10PassRefPtrINS_12WorkerThreadEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE14shrinkCapacityEm
+__ZN7WebCore12WorkerThread5startEv
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_6WorkerE
-__ZN7WebCore8JSWorker15createPrototypeEPN3JSC9ExecStateE
 __ZN7WebCore8JSWorkerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6WorkerEEE
+__ZN7WebCore8JSWorkerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6WorkerEEE
+__ZN7WebCore46jsXMLHttpRequestPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore22JSXMLHttpRequestUpload18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore52jsXMLHttpRequestUploadPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCoreL30getJSXMLHttpRequestUploadTableEPN3JSC9ExecStateE
+__ZN7WebCore52jsXMLHttpRequestUploadPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore22JSXMLHttpRequestUpload9classInfoEv
 __ZN7WebCore20XMLHttpRequestUpload13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
-__ZN7WebCore51jsDOMApplicationCachePrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore51jsDOMApplicationCachePrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore19DOMApplicationCache13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
 __ZN7WebCore8JSWorker18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSWorkerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore38jsWorkerPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore38jsWorkerPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore8JSWorker9classInfoEv
-__ZN7WebCore49jsMutationEventPrototypeFunctionInitMutationEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore6Worker13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore12WorkerThread17workerThreadStartEPv
+__ZN7WebCore12WorkerThread12workerThreadEv
+__ZN7WebCore13WorkerContextC1ERKNS_4KURLERKNS_6StringEPNS_12WorkerThreadE
+__ZN7WebCore13WorkerContextC2ERKNS_4KURLERKNS_6StringEPNS_12WorkerThreadE
+__ZN7WebCore22WorkerScriptControllerC1EPNS_13WorkerContextE
+__ZN7WebCore22WorkerScriptControllerC2EPNS_13WorkerContextE
+__ZN7WebCore22WorkerScriptController8evaluateERKNS_16ScriptSourceCodeE
+__ZN7WebCore22WorkerScriptController8evaluateERKNS_16ScriptSourceCodeEPNS_11ScriptValueE
+__ZN7WebCore22WorkerScriptController10initScriptEv
+__ZN7WebCore24JSWorkerContextPrototypenwEmPN3JSC12JSGlobalDataE
+__ZN7WebCore15JSWorkerContextC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13WorkerContextEEE
+__ZN7WebCore15JSWorkerContextC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13WorkerContextEEE
+__ZN7WebCore19JSWorkerContextBaseC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13WorkerContextEEE
+__ZN7WebCore17JSDOMGlobalObject21JSDOMGlobalObjectDataC1Ev
+__ZNK3JSC14JSGlobalObject17supportsProfilingEv
+__ZNK7WebCore13WorkerContext18hasPendingActivityEv
+__ZThn8_N7WebCore20WorkerMessagingProxy21reportPendingActivityEb
+__ZN7WebCore20WorkerMessagingProxy21reportPendingActivityEb
+__ZThn88_N7WebCore8Document8postTaskEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore8Document8postTaskEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore13WorkerRunLoop3runEPNS_13WorkerContextE
+__ZN7WebCore17WorkerSharedTimer16setFiredFunctionEPFvvE
+__ZN7WebCore17WorkerSharedTimer4stopEv
+__ZN7WebCore13WorkerRunLoop11defaultModeEv
+__ZN7WebCore13WorkerRunLoop9runInModeEPNS_13WorkerContextERKNS_13ModePredicateE
+__ZN7WebCoreL11performTaskEPv
+__ZN7WebCore30WorkerThreadActivityReportTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore20WorkerMessagingProxy29reportPendingActivityInternalEbb
+__ZN7WebCore30WorkerThreadActivityReportTaskD0Ev
+__ZN7WebCore22ScriptExecutionContext4TaskD2Ev
+__ZNK7WebCore6Worker18hasPendingActivityEv
+__ZNK7WebCore20WorkerMessagingProxy18hasPendingActivityEv
+__ZN7WebCore22JSXMLHttpRequestUpload4markEv
+__ZN7WebCore8JSWorker4markEv
+__ZNK7WebCore6Worker10canSuspendEv
+__ZN7WebCore6Worker4stopEv
+__ZN7WebCore6Worker9terminateEv
+__ZN7WebCore20WorkerMessagingProxy22terminateWorkerContextEv
+__ZN7WebCore12WorkerThread4stopEv
+__ZN7WebCore22WorkerScriptController15forbidExecutionEv
+__ZN7WebCore13WorkerRunLoop9terminateEv
+__ZN7WebCore22WorkerScriptControllerD1Ev
+__ZN7WebCore22WorkerScriptControllerD2Ev
+__ZN7WebCore24JSWorkerContextPrototypeD1Ev
+__ZN7WebCore15JSWorkerContextD1Ev
+__ZN7WebCore19JSWorkerContextBaseD2Ev
+__ZN7WebCore17JSDOMGlobalObject21JSDOMGlobalObjectDataD0Ev
+__ZN7WebCore13WorkerContextD0Ev
+__ZThn8_N7WebCore20WorkerMessagingProxy22workerContextDestroyedEv
+__ZN7WebCore20WorkerMessagingProxy22workerContextDestroyedEv
+__ZN3WTF14ThreadSpecificIN7WebCore16ThreadGlobalDataEE7destroyEPv
+__ZN7WebCore16ThreadGlobalDataD1Ev
+__ZN7WebCore16ThreadGlobalDataD2Ev
+__ZN7WebCore19ICUConverterWrapperD1Ev
+__ZN7WebCore19ICUConverterWrapperD2Ev
+__ZN7WebCore10EventNamesD2Ev
+__ZN7WebCore26WorkerContextDestroyedTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore20WorkerMessagingProxy30workerContextDestroyedInternalEv
+__ZN7WebCore12WorkerThreadD1Ev
+__ZN7WebCore12WorkerThreadD2Ev
+__ZN7WebCore13WorkerRunLoopD1Ev
+__ZN7WebCore13WorkerRunLoopD2Ev
+__ZN7WebCore17WorkerSharedTimerD0Ev
+__ZN7WebCore26WorkerContextDestroyedTaskD0Ev
+__ZN7WebCore8JSWorkerD1Ev
+__ZN7WebCore8JSWorkerD2Ev
+__ZN7WebCore6WorkerD0Ev
+__ZN7WebCore20WorkerMessagingProxy21workerObjectDestroyedEv
+__ZN7WebCore20WorkerMessagingProxyD0Ev
+__ZThn88_N7WebCore8Document27derefScriptExecutionContextEv
+__ZN7WebCore8Document27derefScriptExecutionContextEv
+__ZN7WebCore22JSXMLHttpRequestUploadD1Ev
+__ZN7WebCore22JSXMLHttpRequestUploadD2Ev
+__ZN7WebCore20XMLHttpRequestUploadD0Ev
+__ZN7WebCore49jsMutationEventPrototypeFunctionInitMutationEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore13MutationEvent17initMutationEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringESA_SA_t
-__ZN7WebCore16HTMLLabelElement5focusEb
-__ZN7WebCore26jsKeyboardEventKeyLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore26jsKeyboardEventAltGraphKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL27createSVGPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGPathElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathElementEEE
+__ZN7WebCore16JSSVGPathElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathElementEEE
+__ZN7WebCore16JSSVGPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGPathElement9classInfoEv
+__ZNK7WebCore6JSNode21pushEventHandlerScopeEPN3JSC9ExecStateERNS1_10ScopeChainE
+__ZN7WebCore26jsProgressEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore12MessageEventC1Ev
-__ZN7WebCore47jsMessageEventPrototypeFunctionInitMessageEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore12MessageEventC2Ev
+__ZN7WebCore25jsMessageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsWebKitAnimationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21WebKitTransitionEventC1Ev
+__ZN7WebCore21WebKitTransitionEventC2Ev
+__ZNK7WebCore21WebKitTransitionEvent23isWebKitTransitionEventEv
+__ZN7WebCore23JSWebKitTransitionEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitTransitionEventEEE
+__ZN7WebCore23JSWebKitTransitionEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitTransitionEventEEE
+__ZN7WebCore23JSWebKitTransitionEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsWebKitTransitionEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSSVGPathElementD1Ev
+__ZThn8_N7WebCore14SVGPathElementD0Ev
+__ZN7WebCore25JSSVGPathElementPrototypeD1Ev
+__ZN7WebCore23JSWebKitTransitionEventD1Ev
+__ZN7WebCore21WebKitTransitionEventD0Ev
+__ZNK7WebCore21HTMLFrameOwnerElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZNK7WebCore21HTMLFrameOwnerElement19isFrameOwnerElementEv
+__ZNK7WebCore17HTMLAnchorElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZNK7WebCore12EventHandler11tabsToLinksEPNS_13KeyboardEventE
+__ZNK7WebCore12EventHandler24invertSenseOfTabsToLinksEPNS_13KeyboardEventE
+__ZNK7WebCore12RenderInline17borderBoundingBoxEv
+__ZNK7WebCore4Node19isFrameOwnerElementEv
+__ZNK7WebCore16HTMLInputElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZN7WebCore8Document21previousFocusableNodeEPNS_4NodeEPNS_13KeyboardEventE
+__ZN7WebCore26jsKeyboardEventAltGraphKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7UIEvent6layerXEv
+__ZNK7WebCore7UIEvent6layerYEv
+__ZNK7WebCore7UIEvent5pageXEv
+__ZNK7WebCore7UIEvent5pageYEv
+__ZNK7WebCore13KeyboardEvent5whichEv
+__ZN7WebCore47jsMessageEventPrototypeFunctionInitMessageEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore14JSMessageEvent9classInfoEv
-__ZN7WebCore13toMessagePortEN3JSC10JSValuePtrE
 __ZN7WebCore12MessageEvent16initMessageEventERKNS_12AtomicStringEbbRKNS_6StringES6_S6_PNS_9DOMWindowEPNS_11MessagePortE
 __ZN7WebCore25jsMessageEventLastEventIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore20jsMessageEventSourceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsMutationEventRelatedNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore24jsMutationEventPrevValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore23jsMutationEventNewValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore23jsMutationEventAttrNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore25jsMutationEventAttrChangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore49jsOverflowEventPrototypeFunctionInitOverflowEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore49jsOverflowEventPrototypeFunctionInitOverflowEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore13OverflowEvent17initOverflowEventEtbb
-__ZN7WebCore47jsStorageEventPrototypeFunctionInitStorageEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore21jsOverflowEventOrientEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsOverflowEventHorizontalOverflowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsOverflowEventVerticalOverflowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsProgressEventLengthComputableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsProgressEventLoadedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsProgressEventTotalEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12StorageEvent14isStorageEventEv
+__ZN7WebCore14JSStorageEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12StorageEventEEE
+__ZN7WebCore14JSStorageEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12StorageEventEEE
+__ZN7WebCore14JSStorageEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore47jsStorageEventPrototypeFunctionInitStorageEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore14JSStorageEvent9classInfoEv
 __ZN7WebCore12StorageEvent16initStorageEventERKNS_12AtomicStringEbbRKNS_6StringES6_S6_S6_N3WTF10PassRefPtrINS_9DOMWindowEEE
-__ZN7WebCore41jsTextEventPrototypeFunctionInitTextEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore17jsStorageEventKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsStorageEventOldValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsStorageEventNewValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsStorageEventUriEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsStorageEventSourceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsTextEventPrototypeFunctionInitTextEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore9TextEvent13initTextEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEERKNS_6StringE
 __ZN7WebCore15jsTextEventDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore7UIEvent5whichEv
-__ZN7WebCore63jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore63jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS
 __ZNK7WebCore22JSWebKitAnimationEvent9classInfoEv
 __ZN7WebCore20WebKitAnimationEvent24initWebKitAnimationEventERKNS_12AtomicStringEbbRKNS_6StringEd
-__ZN7WebCore65jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore65jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERK
 __ZNK7WebCore23JSWebKitTransitionEvent9classInfoEv
 __ZN7WebCore21WebKitTransitionEvent25initWebKitTransitionEventERKNS_12AtomicStringEbbRKNS_6StringEd
-__ZNK7WebCore6Worker18hasPendingActivityEv
-__ZNK7WebCore20WorkerMessagingProxy30workerThreadHasPendingActivityEv
-__ZN7WebCore8JSWorker4markEv
-__ZN7WebCore26jsProgressEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore25jsMessageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore33jsWebKitAnimationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore34jsWebKitTransitionEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore20TransformationMatrix8mapPointERKNS_8IntPointE
-__ZN7WebCore8Document21previousFocusableNodeEPNS_4NodeEPNS_13KeyboardEventE
+__ZN7WebCore35jsWebKitTransitionEventPropertyNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21WebKitTransitionEvent12propertyNameEv
+__ZN7WebCore34jsWebKitTransitionEventElapsedTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21WebKitTransitionEvent11elapsedTimeEv
+__ZN7WebCore14JSStorageEventD1Ev
+__ZN7WebCore12StorageEventD0Ev
+__ZN7WebCore16HTMLLabelElement5focusEb
+__ZN7WebCore11RenderBlock16paintColumnRulesERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderBlock19paintColumnContentsERNS_12RenderObject9PaintInfoEiib
+__ZN7WebCore16HTMLInputElement15addSearchResultEv
+__ZN7WebCore27RenderTextControlSingleLine15addSearchResultEv
+__ZN7WebCore16HTMLInputElement8onSearchEv
+__ZN7WebCore27RenderTextControlSingleLine20stopSearchEventTimerEv
+__ZN7WebCore17HTMLSelectElement13typeAheadFindEPNS_13KeyboardEventE
+__ZNK7WebCore17HTMLSelectElement17listToOptionIndexEi
+__ZN7WebCore24submitButtonDefaultLabelEv
+__ZN7WebCore17setJSNodeOnunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore6Chrome12canTakeFocusENS_14FocusDirectionE
+__ZNK7WebCore6Chrome9takeFocusENS_14FocusDirectionE
+__ZN7WebCore17setJSNodeOnscrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnscrollEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore9Scrollbar6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore12EventHandler30passMousePressEventToScrollbarERNS_28MouseEventWithHitTestResultsEPNS_9ScrollbarE
+__ZN7WebCore9Scrollbar9mouseDownERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar14setPressedPartENS_13ScrollbarPartE
+__ZN7WebCore17ScrollbarThemeMac19shouldCenterOnThumbEPNS_9ScrollbarERKNS_18PlatformMouseEventE
+__ZN7WebCore17ScrollbarThemeMac27initialAutoscrollTimerDelayEv
+__ZN7WebCore9Scrollbar21autoscrollPressedPartEd
+__ZN7WebCoreL15thumbUnderMouseEPNS_9ScrollbarE
+__ZN7WebCore23ScrollbarThemeComposite13trackPositionEPNS_9ScrollbarE
+__ZN7WebCore9Scrollbar28pressedPartScrollGranularityEv
+__ZN7WebCore9Scrollbar26pressedPartScrollDirectionEv
+__ZN7WebCore9Scrollbar18startTimerIfNeededEd
+__ZN7WebCore17ScrollbarThemeMac20autoscrollTimerDelayEv
+__ZN7WebCore9Scrollbar7mouseUpEv
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE6shrinkEm
+__ZN7WebCore32jsDOMWindowPrototypeFunctionStopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow4stopEv
+__ZN7WebCore11FrameLoader25scheduleCheckLoadCompleteEv
+__ZNK7WebCore15HTMLAreaElement11isFocusableEv
+__ZN7WebCore16HTMLMediaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderMediaC1EPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderMedia24createControlsShadowRootEv
+__ZN7WebCore29MediaControlShadowRootElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore29MediaControlShadowRootElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZNK7WebCore29MediaControlShadowRootElement12isShadowNodeEv
+__ZN7WebCore29MediaControlShadowRootElement16shadowParentNodeEv
+__ZN7WebCore11RenderMedia11createPanelEv
+__ZN7WebCore11RenderMedia16createMuteButtonEv
+__ZN7WebCore29MediaControlMuteButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore29MediaControlMuteButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZN7WebCore24MediaControlInputElementC2EPNS_8DocumentENS_8PseudoIdERKNS_6StringEPNS_16HTMLMediaElementENS_23MediaControlElemen
+__ZN7WebCore24MediaControlInputElement14attachToParentEPNS_7ElementE
+__ZN7WebCore11RenderMedia16createPlayButtonEv
+__ZN7WebCore29MediaControlPlayButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore29MediaControlPlayButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZN7WebCore11RenderMedia23createTimelineContainerEv
+__ZN7WebCore11RenderMedia14createTimelineEv
+__ZN7WebCore27MediaControlTimelineElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore27MediaControlTimelineElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderMedia20createSeekBackButtonEv
+__ZN7WebCore29MediaControlSeekButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore29MediaControlSeekButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore11RenderMedia23createSeekForwardButtonEv
+__ZN7WebCore11RenderMedia24createCurrentTimeDisplayEv
+__ZN7WebCore23MediaTimeDisplayElementC1EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore23MediaTimeDisplayElementC2EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore23MediaTextDisplayElementC2EPNS_8DocumentENS_8PseudoIdEPNS_16HTMLMediaElementE
+__ZN7WebCore23MediaTextDisplayElement14attachToParentEPNS_7ElementE
+__ZN7WebCore11RenderMedia26createTimeRemainingDisplayEv
+__ZN7WebCore11RenderMedia22createFullscreenButtonEv
+__ZN7WebCore35MediaControlFullscreenButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore35MediaControlFullscreenButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore24MediaControlInputElement6updateEv
+__ZN7WebCore29MediaControlMuteButtonElement17updateDisplayTypeEv
+__ZN7WebCore24MediaControlInputElement14setDisplayTypeENS_23MediaControlElementTypeE
+__ZN7WebCore29MediaControlPlayButtonElement17updateDisplayTypeEv
+__ZN7WebCore27MediaControlTimelineElement6updateEb
+__ZN7WebCore24MediaControlInputElement17updateDisplayTypeEv
+__ZN7WebCore11RenderMedia17updateTimeDisplayEv
+__ZN7WebCore11RenderMedia23updateControlVisibilityEv
+__ZNK7WebCore16HTMLMediaElement8hasVideoEv
+__ZNK7WebCore16HTMLVideoElement8hasVideoEv
+__ZNK7WebCore17HTMLSourceElement17endTagRequirementEv
+__ZNK7WebCore17HTMLSourceElement11tagPriorityEv
+__ZNK7WebCore16HTMLMediaElement12networkStateEv
+__ZNK7WebCore22NullMediaPlayerPrivate11currentTimeEv
+__ZN7WebCore17HTMLSourceElement23cancelPendingErrorEventEv
+__ZN7WebCore16HTMLMediaElement24havePotentialSourceChildEv
+__ZN7WebCore16HTMLMediaElement21selectNextSourceChildEPNS_11ContentTypeENS0_19InvalidSourceActionE
+__ZNK7WebCore17HTMLSourceElement4typeEv
+__ZNK7WebCore17HTMLSourceElement3srcEv
+__ZN7WebCore16HTMLMediaElement19loadNextSourceChildEv
+__ZN7WebCore11MediaPlayer8hasVideoEv
+__ZNK7WebCore22NullMediaPlayerPrivate8hasVideoEv
+__ZNK7WebCore18MediaPlayerPrivate8hasVideoEv
+__ZNK7WebCore11RenderVideo20calcAspectRatioWidthEv
+__ZNK7WebCore11RenderVideo21calcAspectRatioHeightEv
+__ZN7WebCore24MediaControlInputElement11updateStyleEv
+__ZN7WebCore23MediaTextDisplayElement11updateStyleEv
+__ZNK7WebCore19HTMLFieldSetElement11isFocusableEv
 __ZN7WebCore17HTMLLegendElement5focusEb
+__ZNK7WebCore17HTMLLegendElement11isFocusableEv
 __ZN7WebCore17HTMLLegendElement11formElementEv
 __ZNK7WebCore19HTMLOptGroupElement11isFocusableEv
+__ZNK7WebCore17HTMLOptionElement11isFocusableEv
+__ZN7WebCore12RenderSliderD0Ev
+__ZThn8_N7WebCore18SliderThumbElementD0Ev
+__ZN7WebCore18SliderThumbElementD0Ev
+__ZN7WebCore28RenderMediaControlShadowRootD0Ev
+__ZThn8_N7WebCore29MediaControlShadowRootElementD0Ev
+__ZN7WebCore29MediaControlShadowRootElementD0Ev
+__ZN7WebCore29MediaControlMuteButtonElementD0Ev
+__ZN7WebCore29MediaControlPlayButtonElementD0Ev
+__ZN7WebCore29MediaControlSeekButtonElementD0Ev
+__ZN7WebCore35MediaControlFullscreenButtonElementD0Ev
+__ZN7WebCore27MediaControlTimelineElementD0Ev
+__ZN7WebCore23MediaTimeDisplayElementD0Ev
+__ZN7WebCore11RenderMediaD0Ev
+__ZN7WebCore11FrameLoader21reportLocalLoadFailedEPNS_5FrameERKNS_6StringE
+__ZN7WebCore16HTMLMediaElement13noneSupportedEv
+__ZN7WebCore16HTMLMediaElement5pauseEv
+__ZN7WebCore16HTMLMediaElement13pauseInternalEv
 __ZN7WebCore19CachedXSLStyleSheet4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
 __ZN7WebCore13XSLStyleSheet17compileStyleSheetEv
 __ZL26initxsltParseStylesheetDocP7_xmlDoc
@@ -19391,209 +19277,744 @@
 __ZN7WebCoreL13writeToVectorEPvPKci
 __ZL22initxsltFreeStylesheetP15_xsltStylesheet
 __ZN7WebCore13XSLTProcessor24createDocumentFromSourceERKNS_6StringES3_S3_PNS_4NodeEPNS_5FrameE
-__ZN7WebCore6Worker4stopEv
-__ZN7WebCore6Worker9terminateEv
-__ZN7WebCore20WorkerMessagingProxy9terminateEv
-__ZN7WebCore6WorkerD1Ev
-__ZN7WebCore20WorkerMessagingProxy21workerObjectDestroyedEv
-__ZN7WebCore20WorkerMessagingProxy30workerContextDestroyedInternalEv
-__ZN7WebCore20WorkerMessagingProxyD1Ev
-__ZThn44_N7WebCore8Document27derefScriptExecutionContextEv
-__ZN7WebCore8Document27derefScriptExecutionContextEv
 __ZNK7WebCore9RenderBox14overrideHeightEv
-__ZN7WebCore13RenderListBox17listIndexAtOffsetEii
-__ZN7WebCore17RenderTextControl22textWithHardLineBreaksEv
-__ZN7WebCoreL16getNextSoftBreakERPNS_13RootInlineBoxERPNS_4NodeERj
-__ZNK7WebCore17RenderTextControl11scrollWidthEv
+__ZN7WebCore17RenderFlexibleBox22calcVerticalPrefWidthsEv
+__ZNK7WebCore13RenderListBox10renderNameEv
+__ZN7WebCore17HTMLButtonElement15accessKeyActionEb
+__ZN7WebCore16HTMLInputElement15accessKeyActionEb
+__ZN7WebCore17HTMLLegendElement15accessKeyActionEb
+__ZN7WebCore16HTMLLabelElement15accessKeyActionEb
 __ZN7WebCore27jsHTMLInputElementAutofocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30setJSHTMLInputElementAutofocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement12setAutofocusEb
+__ZN7WebCore32setJSHTMLTextAreaElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore28setJSHTMLTextAreaElementColsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement7setColsEi
+__ZNK7WebCore12RenderSlider10renderNameEv
+__ZNK7WebCore23RenderFileUploadControl10renderNameEv
+__ZNK7WebCore12RenderButton23createsAnonymousWrapperEv
+__ZN7WebCore14FormElementKeyC1EPNS_16AtomicStringImplES2_
+__ZN7WebCore14FormElementKeyC2EPNS_16AtomicStringImplES2_
+__ZNK7WebCore14FormElementKey3refEv
+__ZN3WTF9HashTableIN7WebCore14FormElementKeyESt4pairIS2_NS_6VectorINS1_6StringELm0EEEENS_18PairFirstExtractorIS7_EENS1_18FormEl
+__ZN3WTF7HashMapIN7WebCore14FormElementKeyENS_6VectorINS1_6StringELm0EEENS1_18FormElementKeyHashENS1_24FormElementKeyHashTraits
+__ZN7WebCore14FormElementKeyC1ERKS0_
+__ZN7WebCore14FormElementKeyC2ERKS0_
+__ZN7WebCore14FormElementKeyD1Ev
+__ZN7WebCore14FormElementKeyD2Ev
+__ZNK7WebCore14FormElementKey5derefEv
+__ZN7WebCore18FormElementKeyHash4hashERKNS_14FormElementKeyE
+__ZN7WebCore14FormElementKeyaSERKS0_
+__ZN7WebCore8Document23takeStateForFormElementEPNS_16AtomicStringImplES2_RNS_6StringE
+__ZN7WebCore16HTMLInputElement23restoreFormControlStateERKNS_6StringE
+__ZN7WebCore14jsNodeOnselectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onselectEv
+__ZNK7WebCore8DragData11asFilenamesERN3WTF6VectorINS_6StringELm0EEE
+__ZN7WebCore23RenderFileUploadControl19receiveDroppedFilesERKN3WTF6VectorINS_6StringELm0EEE
+__ZN7WebCore23RenderFileUploadControl19allowsMultipleFilesEv
+__ZN7WebCore11FileChooser10chooseFileERKNS_6StringE
+__ZThn200_N7WebCore23RenderFileUploadControl12valueChangedEv
+__ZN7WebCore23RenderFileUploadControl12valueChangedEv
+__ZN7WebCore16HTMLInputElement23setFileListFromRendererERKN3WTF6VectorINS_6StringELm0EEE
+__ZN7WebCore4FileC1ERKNS_6StringE
+__ZN7WebCore4FileC2ERKNS_6StringE
+__ZN7WebCore15pathGetFileNameERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE15reserveCapacityEm
+__ZNK7WebCore8FileList4itemEj
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE6shrinkEm
+__ZNK7WebCore22HTMLFormControlElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZNK7WebCore12EventHandler17tabsToAllControlsEPNS_13KeyboardEventE
+__ZNK7WebCore19HTMLTextAreaElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZN7WebCore19HTMLTextAreaElement15accessKeyActionEb
+__ZN7WebCore39setJSDOMWindowHTMLCollectionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore14RenderTableCol10renderNameEv
+__ZN7WebCore34setJSHTMLInputElementIndeterminateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement16setIndeterminateEb
+__ZThn128_N7WebCore16HTMLInputElement8setValueERKNS_6StringE
+__ZN7WebCore26jsHTMLInputElementMultipleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement8multipleEv
+__ZN7WebCore29setJSHTMLInputElementMultipleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement11setMultipleEb
+__ZNK7WebCore17RenderTextControl28canBeProgramaticallyScrolledEb
+__ZN7WebCore27RenderTextControlSingleLine10autoscrollEv
+__ZN7WebCore30setJSHTMLInputElementMaxLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement12setMaxLengthEi
 __ZNK7WebCore17HTMLSelectElement12canSelectAllEv
 __ZN7WebCore17HTMLSelectElement9selectAllEv
 __ZN7WebCore17HTMLSelectElement23nextSelectableListIndexEi
 __ZN7WebCore17HTMLSelectElement27previousSelectableListIndexEi
 __ZN7WebCore17HTMLSelectElement22updateListBoxSelectionEb
+__ZN7WebCore13RenderListBox32scrollToRevealElementAtListIndexEi
 __ZN7WebCore17HTMLSelectElement15listBoxOnChangeEv
 __ZN7WebCore13RenderListBox12setScrollTopEi
-__ZThn136_N7WebCore13RenderListBox12valueChangedEPNS_9ScrollbarE
+__ZThn200_N7WebCore13RenderListBox12valueChangedEPNS_9ScrollbarE
 __ZN7WebCore13RenderListBox12valueChangedEPNS_9ScrollbarE
-__ZN7WebCore30jsHTMLInputElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement12willValidateEv
+__ZN7WebCore13RenderListBox17listIndexAtOffsetEii
+__ZNK7WebCore11RenderTheme37activeListBoxSelectionBackgroundColorEv
+__ZNK7WebCore14RenderThemeMac45platformActiveListBoxSelectionBackgroundColorEv
+__ZNK7WebCore11RenderTheme37activeListBoxSelectionForegroundColorEv
+__ZNK7WebCore14RenderThemeMac45platformActiveListBoxSelectionForegroundColorEv
+__ZNK7WebCore13RenderListBox9scrollTopEv
+__ZN7WebCore30setJSHTMLSelectElementMultipleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLSelectElement11setMultipleEb
+__ZN7WebCore26setJSHTMLSelectElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLSelectElement7setSizeEi
+__ZThn128_NK7WebCore19HTMLOptGroupElement14groupLabelTextEv
+__ZNK7WebCore19HTMLOptGroupElement14groupLabelTextEv
+__ZN7WebCore19HTMLOptGroupElement11appendChildEN3WTF10PassRefPtrINS_4NodeEEERib
 __ZN7WebCore19HTMLOptGroupElement11removeChildEPNS_4NodeERi
-__ZN7WebCore30setJSHTMLInputElementAutofocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore22HTMLFormControlElement12setAutofocusEb
-__ZN7WebCore45jsHTMLSelectElementPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore17HTMLSelectElement9namedItemERKNS_12AtomicStringE
-__ZThn72_N7WebCore16HTMLInputElement8setValueERKNS_6StringE
+__ZN7WebCore19HTMLOptGroupElement12replaceChildEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
+__ZN7WebCore19HTMLOptGroupElement12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
+__ZN7WebCore19HTMLOptGroupElement14removeChildrenEv
+__ZN7WebCore13RenderListBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore13RenderListBox24isPointInOverflowControlERNS_13HitTestResultEiiii
+__ZNK7WebCore17HTMLSelectElement16isMouseFocusableEv
+__ZNK7WebCore17HTMLSelectElement17canStartSelectionEv
+__ZNK7WebCore13RenderListBox28canBeProgramaticallyScrolledEb
 __ZN7WebCore31HTMLFormControlElementWithState26willMoveToNewOwnerDocumentEv
 __ZN7WebCore31HTMLFormControlElementWithState25didMoveToNewOwnerDocumentEv
 __ZN7WebCore16HTMLInputElement26willMoveToNewOwnerDocumentEv
 __ZN7WebCore16HTMLInputElement25didMoveToNewOwnerDocumentEv
+__ZN7WebCore30SearchFieldCancelButtonElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore12EventHandler27setCapturingMouseEventsNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZThn8_N7WebCore30SearchFieldCancelButtonElementD0Ev
+__ZN7WebCore27RenderTextControlSingleLine21startSearchEventTimerEv
+__ZN7WebCore5TimerINS_27RenderTextControlSingleLineEE5firedEv
+__ZN7WebCore27RenderTextControlSingleLine21searchEventTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore24HitTestingTransformState9translateEiiNS0_21TransformAccumulationE
+__ZN7WebCore17HTMLSelectElement15accessKeyActionEb
+__ZNK7WebCore17HTMLSelectElement21lastSelectedListIndexEv
+__ZN7WebCore19JSHTMLSelectElement3putEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore19JSHTMLSelectElement11indexSetterEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore45jsHTMLSelectElementPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17HTMLSelectElement9namedItemERKNS_12AtomicStringE
+__ZN7WebCore17HTMLSelectElement14appendFormDataERNS_12FormDataListEb
+__ZN7WebCore12RenderSlider12forwardEventEPNS_5EventE
+__ZN7WebCore18SliderThumbElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore12RenderSlider19mouseEventIsInThumbEPNS_10MouseEventE
+__ZN7WebCore12RenderSlider15currentPositionEv
+__ZN7WebCore12RenderSlider17positionForOffsetERKNS_8IntPointE
+__ZN7WebCore12RenderSlider9trackSizeEv
+__ZN7WebCore12RenderSlider19setValueForPositionEi
+__ZN7WebCore12TextDocumentC1EPNS_5FrameE
+__ZN7WebCore12TextDocumentC2EPNS_5FrameE
+__ZN7WebCore12TextDocument15createTokenizerEv
+__ZN7WebCore13TextTokenizerC1EPNS_8DocumentE
+__ZN7WebCore13TextTokenizerC2EPNS_8DocumentE
+__ZN7WebCore13TextTokenizer5writeERKNS_15SegmentedStringEb
+__ZN7WebCore13TextTokenizer6finishEv
+__ZN7WebCore13TextTokenizerD0Ev
+__ZN7WebCore12TextDocumentD0Ev
+__ZN7WebCore17RenderTextControl22textWithHardLineBreaksEv
+__ZN7WebCoreL16getNextSoftBreakERPNS_13RootInlineBoxERPNS_4NodeERj
+__ZN7WebCore15RenderScrollbar21createCustomScrollbarEPNS_15ScrollbarClientENS_20ScrollbarOrientationEPNS_9RenderBoxE
+__ZN7WebCore15RenderScrollbarC1EPNS_15ScrollbarClientENS_20ScrollbarOrientationEPNS_9RenderBoxE
+__ZN7WebCore15RenderScrollbarC2EPNS_15ScrollbarClientENS_20ScrollbarOrientationEPNS_9RenderBoxE
+__ZN7WebCore20RenderScrollbarTheme20renderScrollbarThemeEv
+__ZN7WebCore20RenderScrollbarTheme17registerScrollbarEPNS_9ScrollbarE
+__ZN7WebCore20RenderScrollbarTheme18scrollbarThicknessENS_20ScrollbarControlSizeE
+__ZN7WebCore15RenderScrollbar9setParentEPNS_10ScrollViewE
+__ZN7WebCore15RenderScrollbar12styleChangedEv
+__ZN7WebCore15RenderScrollbar20updateScrollbarPartsEb
+__ZN7WebCore15RenderScrollbar19updateScrollbarPartENS_13ScrollbarPartEb
+__ZN7WebCore15RenderScrollbar23getScrollbarPseudoStyleENS_13ScrollbarPartENS_8PseudoIdE
+__ZNK7WebCore20RenderScrollbarTheme16buttonsPlacementEv
+__ZNK3WTF7HashMapIjPN7WebCore19RenderScrollbarPartENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3getERKj
+__ZN7WebCore19RenderScrollbarPartC1EPNS_4NodeEPNS_15RenderScrollbarENS_13ScrollbarPartE
+__ZN7WebCore19RenderScrollbarPartC2EPNS_4NodeEPNS_15RenderScrollbarENS_13ScrollbarPartE
+__ZN3WTF7HashMapIjPN7WebCore19RenderScrollbarPartENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
+__ZN3WTF9HashTableIjSt4pairIjPN7WebCore19RenderScrollbarPartEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsIN
+__ZN7WebCore19RenderScrollbarPart15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore19RenderScrollbarPart14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore19RenderScrollbarPart13requiresLayerEv
+__ZN7WebCore19RenderScrollbarPart6layoutEv
+__ZN7WebCore19RenderScrollbarPart18layoutVerticalPartEv
+__ZN7WebCore19RenderScrollbarPart21computeScrollbarWidthEv
+__ZN7WebCoreL27calcScrollbarThicknessUsingERKNS_6LengthEi
+__ZN7WebCore15RenderScrollbar10setEnabledEb
+__ZN7WebCore20RenderScrollbarTheme9trackRectEPNS_9ScrollbarEb
+__ZN7WebCore20RenderScrollbarTheme10hasButtonsEPNS_9ScrollbarE
+__ZN7WebCore20RenderScrollbarTheme25buttonSizesAlongTrackAxisEPNS_9ScrollbarERiS3_
+__ZN7WebCore20RenderScrollbarTheme14backButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
+__ZN7WebCore15RenderScrollbar10buttonRectENS_13ScrollbarPartE
+__ZN7WebCore20RenderScrollbarTheme17forwardButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
+__ZN7WebCore15RenderScrollbar9trackRectEii
+__ZN7WebCore20RenderScrollbarTheme31constrainTrackRectToTrackPiecesEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore15RenderScrollbar25trackPieceRectWithMarginsENS_13ScrollbarPartERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme18minimumThumbLengthEPNS_9ScrollbarE
+__ZN7WebCore15RenderScrollbar18minimumThumbLengthEv
+__ZN7WebCore19RenderScrollbarPartD0Ev
+__ZN7WebCore15RenderScrollbarD0Ev
+__ZN7WebCore9ScrollbarD2Ev
+__ZN7WebCore20RenderScrollbarTheme19unregisterScrollbarEPNS_9ScrollbarE
+__ZNK7WebCore12RenderObject8isSliderEv
+__ZN7WebCore30jsHTMLInputElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement12willValidateEv
+__ZN7WebCore33jsHTMLTextAreaElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore33jsHTMLFieldSetElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore19HTMLFieldSetElement12willValidateEv
-__ZN7WebCore19HTMLOptGroupElement14removeChildrenEv
-__ZN7WebCore17HTMLSelectElement14removeChildrenEv
-__ZNK7WebCore13RenderListBox9scrollTopEv
-__ZN7WebCore33jsHTMLTextAreaElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore31jsHTMLButtonElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore17HTMLButtonElement12willValidateEv
-__ZNK7WebCore12RenderButton23createsAnonymousWrapperEv
-__ZN7WebCore30setJSHTMLSelectElementMultipleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore17HTMLSelectElement11setMultipleEb
-__ZN7WebCore34setJSHTMLInputElementIndeterminateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore16HTMLInputElement16setIndeterminateEb
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE11reverseRunsEjj
-__ZNK7WebCore12RenderObject8isSliderEv
+__ZN7WebCoreL31transferMailtoPostFormDataToURLERN3WTF6RefPtrINS_8FormDataEEERNS_4KURLERKNS_6StringE
+__ZN7WebCore14RenderFrameSet13startResizingERNS0_8GridAxisEi
+__ZNK7WebCore14RenderFrameSet12hitTestSplitERKNS0_8GridAxisEi
+__ZNK7WebCore14RenderFrameSet13splitPositionERKNS0_8GridAxisEi
+__ZN7WebCore14RenderFrameSet13setIsResizingEb
+__ZN7WebCore12EventHandler19setResizingFrameSetEPNS_19HTMLFrameSetElementE
+__ZN7WebCore14RenderFrameSet16continueResizingERNS0_8GridAxisEi
+__ZNK7WebCore14RenderFrameSet12canResizeRowERKNS_8IntPointE
+__ZNK7WebCore14RenderFrameSet15canResizeColumnERKNS_8IntPointE
+__ZN7WebCore18columnResizeCursorEv
+__ZN7WebCore15rowResizeCursorEv
 __ZN7WebCore23jsHTMLFrameElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20HTMLFrameElementBase5widthEv
 __ZN7WebCore24jsHTMLFrameElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20HTMLFrameElementBase6heightEv
+__ZNK7WebCore11FrameLoader20childFramesMatchItemEPNS_11HistoryItemE
+__ZNK7WebCore11HistoryItem19childItemWithTargetERKNS_6StringE
+__ZN7WebCore26setJSXMLHttpRequestOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLOptionElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore22HTMLViewSourceDocumentC1EPNS_5FrameERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocumentC2EPNS_5FrameERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocument15createTokenizerEv
+__ZN7WebCore13HTMLTokenizerC1EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore13HTMLTokenizerC2EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore22HTMLViewSourceDocument18addViewSourceTokenEPNS_5TokenE
+__ZN7WebCore22HTMLViewSourceDocument21createContainingTableEv
+__ZN7WebCore22HTMLViewSourceDocument20addSpanWithClassNameERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocument7addLineERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocument7addTextERKNS_6StringES3_
+__ZN7WebCore22HTMLViewSourceDocumentD0Ev
+__ZN7WebCore22HTMLViewSourceDocument25addViewSourceDoctypeTokenEPNS_12DoctypeTokenE
+__ZN7WebCore16CSSGradientValue13resolveRadiusEPNS_17CSSPrimitiveValueEf
 __ZNK7WebCore27RenderImageGeneratedContent21setImageContainerSizeERKNS_7IntSizeE
 __ZNK7WebCore19StyleGeneratedImage22usesImageContainerSizeEv
-__ZN7WebCore16CSSGradientValue13resolveRadiusEPNS_17CSSPrimitiveValueEf
-__ZSt16__merge_backwardIPN7WebCore20CSSGradientColorStopES2_S2_PFbRKS1_S4_EET1_T_S8_T0_S9_S7_T2_
+__ZN7WebCore28jsHistoryPrototypeFunctionGoEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7History2goEi
+__ZNK7WebCore17HTMLButtonElement17canStartSelectionEv
 __ZN7WebCore17HTMLKeygenElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZNK7WebCore17HTMLKeygenElement11tagPriorityEv
-__ZThn56_NK7WebCore17HTMLKeygenElement4typeEv
-__ZNK7WebCore17HTMLKeygenElement4typeEv
+__ZNK7WebCore17HTMLKeygenElement15formControlTypeEv
+__ZN7WebCore7DataRefINS_16StyleMarqueeDataEE6accessEv
+__ZNK7WebCore11RenderImage21setImageContainerSizeERKNS_7IntSizeE
 __ZNK7WebCore16HTMLEmbedElement24imageSourceAttributeNameEv
+__ZN7WebCore16PDFDocumentImageC1Ev
 __ZN7WebCore16PDFDocumentImageC2Ev
 __ZN7WebCore16PDFDocumentImage11dataChangedEb
 __ZN7WebCore16PDFDocumentImage14setCurrentPageEi
 __ZNK7WebCore16PDFDocumentImage9pageCountEv
 __ZNK7WebCore16PDFDocumentImage4sizeEv
-__ZNK7WebCore11RenderImage21setImageContainerSizeERKNS_7IntSizeE
 __ZN7WebCore16PDFDocumentImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
 __ZNK7WebCore16PDFDocumentImage9adjustCTMEPNS_15GraphicsContextE
 __ZN7WebCore5Image26nativeImageForCurrentFrameEv
-__ZN7WebCore10RenderFlow19paintOutlineForLineEPNS_15GraphicsContextEiiRKNS_7IntRectES5_S5_
-__ZN7WebCore16PDFDocumentImage18destroyDecodedDataEb
+__ZNK7WebCore8SVGImage17usesContainerSizeEv
+__ZNK7WebCore13RenderSVGRoot13selfWillPaintEv
+__ZN7WebCore11RenderBlock25rectWithOutlineForRepaintEPNS_20RenderBoxModelObjectEi
+__ZN7WebCore12RenderInline19paintOutlineForLineEPNS_15GraphicsContextEiiRKNS_7IntRectES5_S5_
+__ZN7WebCore13RenderSVGRoot14calcPrefWidthsEv
+__ZNK7WebCore13RenderSVGRoot10lineHeightEbb
+__ZNK7WebCore13RenderSVGRoot16baselinePositionEbb
+__ZN7WebCore56jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore19CSSStyleDeclaration18isPropertyImplicitERKNS_6StringE
+__ZN7WebCore17setJSNodeOnresizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnresizeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore40jsDOMWindowPrototypeFunctionOpenDatabaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow12openDatabaseERKNS_6StringES3_S3_mRi
+__ZN7WebCore8Database12openDatabaseEPNS_8DocumentERKNS_6StringES5_S5_mRi
+__ZN7WebCore15DatabaseTracker20canEstablishDatabaseEPNS_8DocumentERKNS_6StringES5_m
+__ZN7WebCore15DatabaseTracker15populateOriginsEv
+__ZN7WebCore18OriginQuotaManagerC1Ev
+__ZN7WebCore18OriginQuotaManagerC2Ev
+__ZN7WebCore15DatabaseTracker19openTrackerDatabaseEb
+__ZNK7WebCore15DatabaseTracker19trackerDatabasePathEv
+__ZN7WebCore15DatabaseTracker14usageForOriginEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker18originQuotaManagerEv
+__ZN7WebCore18OriginQuotaManager4lockEv
+__ZNK7WebCore18OriginQuotaManager12tracksOriginEPNS_14SecurityOriginE
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS2_17OriginUsageRecordEENS_18PairFirstExtractorIS8_EENS
+__ZN7WebCore18OriginQuotaManager11trackOriginEN3WTF10PassRefPtrINS_14SecurityOriginEEE
+__ZN7WebCore17OriginUsageRecordC1Ev
+__ZN7WebCore17OriginUsageRecordC2Ev
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS2_17OriginUsageRecordENS2_18SecurityOriginHashENS_10HashTraitsIS4_EE
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS2_17OriginUsageRecordEENS_18PairFirstExtractorIS8_EENS2
+__ZN7WebCore15DatabaseTracker22databaseNamesForOriginEPNS_14SecurityOriginERN3WTF6VectorINS_6StringELm0EEE
+__ZNK7WebCore18OriginQuotaManager9diskUsageEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS2_17OriginUsageRecordENS2_18SecurityOriginHashENS_10HashTraitsIS4_E
+__ZN7WebCore17OriginUsageRecord9diskUsageEv
+__ZN7WebCore18OriginQuotaManager6unlockEv
+__ZN7WebCore15DatabaseTracker19hasEntryForDatabaseEPNS_14SecurityOriginERKNS_6StringE
+__ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEyNS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS6_IyEEE3getEPS3_
+__ZN7WebCore18SecurityOriginHash4hashEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker8setQuotaEPNS_14SecurityOriginEy
+__ZN7WebCore7CString11mutableDataEv
+__ZN7WebCore7CString18copyBufferIfNeededEv
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_yENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashEN
+__ZNK7WebCore14SecurityOrigin18databaseIdentifierEv
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEyNS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS6_IyEEE3setEPS3_RKy
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_yENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS
+__ZN7WebCore8DatabaseC1EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCore8DatabaseC2EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCoreL20guidForOriginAndNameERKNS_6StringES2_
+__ZNK3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3getERKS2_
+__ZN3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3setERKS2_RKi
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTra
+__ZN7WebCoreL9guidMutexEv
+__ZN7WebCoreL17guidToDatabaseMapEv
+__ZNK3WTF7HashMapIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEENS_7IntHashIjEENS7_IiEENS7_ISA_EEE3
+__ZN3WTF7HashMapIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEENS_7IntHashIjEENS7_IiEENS7_ISA_EEE3s
+__ZN3WTF9HashTableIiSt4pairIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEEENS_18PairFirstExtractorI
+__ZN3WTF7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTable
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTab
+__ZN7WebCore15DatabaseTracker19fullPathForDatabaseEPNS_14SecurityOriginERKNS_6StringEb
+__ZNK7WebCore15DatabaseTracker10originPathEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
+__ZN7WebCore18OriginQuotaManager11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
+__ZN7WebCore17OriginUsageRecord11addDatabaseERKNS_6StringES3_
+__ZN3WTF7HashMapIN7WebCore6StringENS1_17OriginUsageRecord13DatabaseEntryENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_17OriginUsageRecord13DatabaseEntryEENS_18PairFirstExtractorIS6_EENS1_10Strin
+__ZN7WebCore15DatabaseTracker15addOpenDatabaseEPNS_8DatabaseE
+__ZNK7WebCore8Database18securityOriginCopyEv
+__ZN7WebCore14SecurityOrigin4copyEv
+__ZN7WebCore14SecurityOriginC1EPKS0_
+__ZN7WebCore14SecurityOriginC2EPKS0_
+__ZNK7WebCore8Database16stringIdentifierEv
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS0_INS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7PtrHashIS8_EENS_10Ha
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS0_INS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7PtrHashIS8_EENS_10Has
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS_7HashMapINS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7P
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2
+__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS_18PairFi
+__ZN7WebCore8Document15addOpenDatabaseEPNS_8DatabaseE
+__ZN7WebCore8Database20openAndVerifyVersionERi
+__ZN7WebCore8Document14databaseThreadEv
+__ZN7WebCore14DatabaseThreadC1Ev
+__ZN7WebCore14DatabaseThreadC2Ev
+__ZN7WebCore14DatabaseThread5startEv
+__ZN7WebCore18DatabaseAuthorizerC1Ev
+__ZN7WebCore18DatabaseAuthorizerC2Ev
+__ZN7WebCore18DatabaseAuthorizer5resetEv
+__ZN7WebCore16DatabaseOpenTaskC1EPNS_8DatabaseE
+__ZN7WebCore16DatabaseOpenTaskC2EPNS_8DatabaseE
+__ZN7WebCore12DatabaseTaskC2EPNS_8DatabaseE
+__ZN7WebCore12DatabaseTask28lockForSynchronousSchedulingEv
+__ZN7WebCore14DatabaseThread21scheduleImmediateTaskEN3WTF10PassRefPtrINS_12DatabaseTaskEEE
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore12DatabaseTaskEEEE14expandCapacityEv
+__ZN7WebCore12DatabaseTask28waitForSynchronousCompletionEv
+__ZN7WebCore14DatabaseThread19databaseThreadStartEPv
+__ZN7WebCore14DatabaseThread14databaseThreadEv
+__ZN3WTF12MessageQueueINS_6RefPtrIN7WebCore12DatabaseTaskEEEE19alwaysTruePredicateERS4_
+__ZN7WebCore12DatabaseTask11performTaskEv
+__ZN7WebCore8Database15resetAuthorizerEv
+__ZN7WebCore16DatabaseOpenTask13doPerformTaskEv
+__ZN7WebCore8Database20performOpenAndVerifyERi
+__ZN7WebCore14SQLiteDatabase13setAuthorizerEN3WTF10PassRefPtrINS_18DatabaseAuthorizerEEE
+__ZN7WebCore14SQLiteDatabase16enableAuthorizerEb
+__ZN7WebCore8Database21databaseInfoTableNameEv
+__ZN7WebCore14SQLiteDatabase18authorizerFunctionEPviPKcS3_S3_S3_
+__ZN7WebCore18DatabaseAuthorizer9allowReadERKNS_6StringES3_
+__ZN7WebCore18DatabaseAuthorizer20denyBasedOnTableNameERKNS_6StringE
+__ZN7WebCore18DatabaseAuthorizer11allowInsertERKNS_6StringE
+__ZN7WebCore18DatabaseAuthorizer11createTableERKNS_6StringE
+__ZN7WebCore18DatabaseAuthorizer11createIndexERKNS_6StringES3_
+__ZN7WebCore18DatabaseAuthorizer11allowUpdateERKNS_6StringES3_
+__ZN7WebCoreL16guidToVersionMapEv
+__ZN7WebCore8Database22getVersionFromDatabaseERNS_6StringE
+__ZN7WebCoreL18databaseVersionKeyEv
+__ZN7WebCore18DatabaseAuthorizer7disableEv
+__ZN7WebCore18DatabaseAuthorizer6enableEv
+__ZN7WebCore8Database20setVersionInDatabaseERKNS_6StringE
+__ZN3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
+__ZN3WTF9HashTableIiSt4pairIiN7WebCore6StringEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsI
+__ZN7WebCore8Database19performPolicyChecksEv
+__ZN7WebCore16DatabaseOpenTaskD0Ev
+__ZN7WebCore12DatabaseTaskD2Ev
+__ZN7WebCore15DatabaseTracker18setDatabaseDetailsEPNS_14SecurityOriginERKNS_6StringES5_m
+__ZN7WebCore19InspectorController15didOpenDatabaseEPNS_8DatabaseERKNS_6StringES5_S5_
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8DatabaseE
+__ZN7WebCore10JSDatabase15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSDatabaseC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DatabaseEEE
+__ZN7WebCore10JSDatabaseC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DatabaseEEE
+__ZN7WebCore10JSDatabase18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSDatabasePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsDatabasePrototypeFunctionTransactionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore10JSDatabase9classInfoEv
+__ZN7WebCore10JSDatabase11transactionEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore30JSCustomSQLTransactionCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore30JSCustomSQLTransactionCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore8Database11transactionEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS2_INS_27SQLTransactionErrorCallbackEEENS2_
+__ZN7WebCore14SQLTransaction6createEPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionError
+__ZN7WebCore14SQLTransactionC1EPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionErrorCallb
+__ZN7WebCore14SQLTransactionC2EPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionErrorCallb
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore14SQLTransactionEEEE14expandCapacityEv
+__ZN7WebCore8Database19scheduleTransactionEv
+__ZN7WebCore23DatabaseTransactionTaskC1EN3WTF10PassRefPtrINS_14SQLTransactionEEE
+__ZN7WebCore23DatabaseTransactionTaskC2EN3WTF10PassRefPtrINS_14SQLTransactionEEE
+__ZN7WebCore14DatabaseThread12scheduleTaskEN3WTF10PassRefPtrINS_12DatabaseTaskEEE
+__ZN7WebCore23DatabaseTransactionTask13doPerformTaskEv
+__ZN7WebCore14SQLTransaction15performNextStepEv
+__ZN7WebCore14SQLTransaction28checkAndHandleClosedDatabaseEv
+__ZN7WebCore14SQLTransaction27openTransactionAndPreflightEv
+__ZNK7WebCore8Database11maximumSizeEv
+__ZNK3WTF7HashMapIN7WebCore6StringENS1_17OriginUsageRecord13DatabaseEntryENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3get
+__ZN7WebCore11getFileSizeERKNS_6StringERx
+__ZNK7WebCore8Database12databaseSizeEv
+__ZN7WebCore14SQLiteDatabase14setMaximumSizeEx
+__ZN7WebCore14SQLiteDatabase8pageSizeEv
+__ZN7WebCore6String6numberEx
+__ZN7WebCore18DatabaseAuthorizer16allowTransactionEv
+__ZN7WebCore8Database27scheduleTransactionCallbackEPNS_14SQLTransactionE
+__ZN7WebCore23DatabaseTransactionTaskD0Ev
+__ZN7WebCore8Database22deliverPendingCallbackEPv
+__ZN7WebCore14SQLTransaction22performPendingCallbackEv
+__ZN7WebCore14SQLTransaction26deliverTransactionCallbackEv
+__ZN7WebCore30JSCustomSQLTransactionCallback11handleEventEPNS_14SQLTransactionERb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14SQLTransactionE
+__ZN7WebCore16JSSQLTransaction15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSQLTransactionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SQLTransactionEEE
+__ZN7WebCore16JSSQLTransactionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SQLTransactionEEE
+__ZN7WebCore14SQLTransaction31deliverTransactionErrorCallbackEv
+__ZN7WebCore8Database23scheduleTransactionStepEPNS_14SQLTransactionE
+__ZN7WebCore14SQLTransaction36cleanupAfterTransactionErrorCallbackEv
+__ZN7WebCore17SQLiteTransaction8rollbackEv
+__ZN7WebCore30JSCustomSQLTransactionCallbackD0Ev
+__ZN7WebCore30JSCustomSQLTransactionCallback10deleteDataEPv
+__ZN7WebCore25JSSQLTransactionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsSQLTransactionPrototypeFunctionExecuteSqlEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSSQLTransaction9classInfoEv
+__ZN7WebCore16JSSQLTransaction10executeSqlEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore28JSCustomSQLStatementCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore28JSCustomSQLStatementCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore33JSCustomSQLStatementErrorCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore33JSCustomSQLStatementErrorCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore14SQLTransaction10executeSQLERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallb
+__ZN7WebCore12SQLStatement6createERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEEN
+__ZN7WebCore12SQLStatementC1ERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_IN
+__ZN7WebCore12SQLStatementC2ERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_IN
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EEC2ERKS3_
+__ZNK7WebCore8Database22versionMatchesExpectedEv
+__ZNK3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
+__ZN7WebCore14SQLTransaction16enqueueStatementEN3WTF10PassRefPtrINS_12SQLStatementEEE
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore12SQLStatementEEEE14expandCapacityEv
+__ZN3WTF16ThreadSafeSharedIN7WebCore12SQLStatementEE5derefEv
+__ZN7WebCore14SQLTransaction23scheduleToRunStatementsEv
+__ZN7WebCore14SQLTransaction13runStatementsEv
+__ZN7WebCore14SQLTransaction16getNextStatementEv
+__ZN7WebCore14SQLTransaction19runCurrentStatementEv
+__ZN7WebCore12SQLStatement7executeEPNS_8DatabaseE
+__ZN7WebCore12SQLStatement22clearFailureDueToQuotaEv
+__ZNK7WebCore12SQLStatement29lastExecutionFailedDueToQuotaEv
+__ZN7WebCore14SQLiteDatabase12lastErrorMsgEv
+__ZN7WebCore14SQLTransaction27handleCurrentStatementErrorEv
+__ZN7WebCore14SQLTransaction24deliverStatementCallbackEv
+__ZN7WebCore12SQLStatement15performCallbackEPNS_14SQLTransactionE
+__ZN7WebCore33JSCustomSQLStatementErrorCallback11handleEventEPNS_14SQLTransactionEPNS_8SQLErrorE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8SQLErrorE
+__ZN7WebCore10JSSQLError15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSQLErrorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SQLErrorEEE
+__ZN7WebCore10JSSQLErrorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SQLErrorEEE
+__ZN7WebCore28JSCustomSQLStatementCallbackD0Ev
+__ZN7WebCore33JSCustomSQLStatementErrorCallbackD0Ev
+__ZN7WebCore14SQLTransaction22handleTransactionErrorEb
+__ZN7WebCore10JSSQLErrorD1Ev
+__ZN7WebCore10JSSQLErrorD2Ev
+__ZN7WebCore16JSSQLTransactionD1Ev
+__ZN7WebCore16JSSQLTransactionD2Ev
+__ZN7WebCore14SQLTransactionD1Ev
+__ZN7WebCore14SQLTransactionD2Ev
+__ZN7WebCore8Database4stopEv
+__ZN7WebCore14DatabaseThread23unscheduleDatabaseTasksEPNS_8DatabaseE
+__ZN7WebCore14DatabaseThread18requestTerminationEv
+__ZN7WebCore19JSSQLErrorPrototypeD1Ev
+__ZN7WebCore25JSSQLTransactionPrototypeD1Ev
+__ZN7WebCore10JSDatabaseD1Ev
+__ZN7WebCore10JSDatabaseD2Ev
+__ZN7WebCore8DatabaseD1Ev
+__ZN7WebCore8DatabaseD2Ev
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22I
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInva
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore15DatabaseTracker18removeOpenDatabaseEPNS_8DatabaseE
+__ZN7WebCore8Document18removeOpenDatabaseEPNS_8DatabaseE
+__ZN7WebCore14SQLiteDatabaseD1Ev
+__ZN7WebCore14SQLiteDatabaseD2Ev
+__ZN7WebCore19JSDatabasePrototypeD1Ev
+__ZN7WebCore14DatabaseThreadD1Ev
+__ZN7WebCore14DatabaseThreadD2Ev
+__ZN7WebCore15JSMimeTypeArray18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore15JSMimeTypeArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore13MimeTypeArray4itemEj
+__ZN7WebCore14jsMimeTypeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType4typeEv
 __ZNK7WebCore16JSDOMWindowShell21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
 __ZNK7WebCore11JSDOMWindow21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
-__ZN7WebCore34jsWorkerPrototypeFunctionTerminateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore8JSWorker3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCore20setJSWorkerOnmessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore36jsWorkerPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore6Worker11postMessageERKNS_6StringE
-__ZN7WebCore20WorkerMessagingProxy26postMessageToWorkerContextERKNS_6StringE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10WorkerTaskEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10WorkerTaskEEELm0EE15reserveCapacityEm
+__ZNK7WebCore9RenderBox20firstLineBoxBaselineEv
+__ZN7WebCore10ClientRectC1Ev
+__ZN7WebCore10ClientRectC2Ev
+__ZN7WebCoreL14isSVG11FeatureERKNS_6StringE
+__ZN7WebCoreL9addStringERN3WTF7HashSetINS_6StringENS_15CaseFoldingHashENS0_10HashTraitsIS2_EEEEPKc
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E4findIS2_NS_2
+__ZN7WebCore40setJSCanvasRenderingContext2DGlobalAlphaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D14setGlobalAlphaEf
+__ZN7WebCore12RenderInline20childBecameNonInlineEPNS_12RenderObjectE
+__ZN7WebCore12EventHandler20resizeLayerDestroyedEv
+__ZN7WebCore14RenderThemeMac20paintMediaMuteButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac20paintMediaPlayButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac21paintMediaSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac21paintMediaSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac24paintMediaSeekBackButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac27paintMediaSeekForwardButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore11RenderVideo10renderNameEv
+__ZN7WebCoreL19metadataConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGMetadataElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGMetadataElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZThn240_NK7WebCore18SVGGradientElement14contextElementEv
+__ZNK7WebCore18SVGGradientElement14contextElementEv
+__ZNK3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8c
+__ZN7WebCore18SVGMetadataElementD0Ev
+__ZN7WebCoreL8toHebrewEi
+__ZN7WebCoreL17toHebrewUnder1000EiPt
+__ZN7WebCore14ResourceHandle15scheduleFailureENS0_11FailureTypeE
+__ZN7WebCore11FrameLoader27checkLoadCompleteTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore9CSSParser24createFloatingMediaQueryEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCoreL21colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore23screenDepthPerComponentEPNS_6WidgetE
+__ZN7WebCoreL20parseMediaDescriptorERKNS_6StringE
+__ZN7WebCoreL30min_monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL26monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore18screenIsMonochromeEPNS_6WidgetE
+__ZN7WebCoreL11numberValueEPNS_8CSSValueERf
+__ZN7WebCoreL25animationMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL32min_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL32max_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL20gridMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL26max_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL22heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore40jsMediaListPrototypeFunctionDeleteMediumEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9MediaList12deleteMediumERKNS_6StringERi
+__ZN7WebCore40jsMediaListPrototypeFunctionAppendMediumEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9MediaList12appendMediumERKNS_6StringERi
+__ZNK7WebCore10MediaQueryeqERKS0_
+__ZN7WebCoreL38max_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL27orientationMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore32setJSHTMLTextAreaElementReadOnlyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL26min_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28transform_2dMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28transform_3dMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL26transitionMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore27MediaControlTimelineElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore16PDFDocumentImage18destroyDecodedDataEb
+__ZN7WebCore16PDFDocumentImageD0Ev
+__ZNK7WebCore17StyleMultiColDataeqERKS0_
+__ZN7WebCoreL26ignorableWhitespaceHandlerEPvPKhi
+__ZL18initxsltNextImportP15_xsltStylesheet
+__ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE6shrinkEm
+__ZN7WebCore13HTMLTokenizer9parseTextERNS_15SegmentedStringENS0_5StateE
+__ZN7WebCore19InspectorController14enableProfilerEb
+__ZN7WebCore21JavaScriptDebugServer27recompileAllJSFunctionsSoonEv
+__ZN7WebCore33jsConsolePrototypeFunctionProfileEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console7profileERKN3JSC7UStringEPNS_15ScriptCallStackE
+__ZN7WebCore36jsConsolePrototypeFunctionProfileEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console10profileEndERKN3JSC7UStringEPNS_15ScriptCallStackE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE15reserveCapacityEm
+__ZN7WebCore19InspectorController10addProfileEN3WTF10PassRefPtrIN3JSC7ProfileEEEjRKNS3_7UStringE
+__ZN7WebCore19InspectorController26addProfileMessageToConsoleEN3WTF10PassRefPtrIN3JSC7ProfileEEEjRKNS3_7UStringE
+__ZN7WebCore14ConsoleMessageC1ENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_j
+__ZN7WebCore14ConsoleMessageC2ENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_j
+__ZN7WebCore19InspectorController17addConsoleMessageEPN3JSC9ExecStateEPNS_14ConsoleMessageE
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE15reserveCapacityEm
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS0_7ProfileE
+__ZN7WebCoreL12profileCacheEv
+__ZNK3WTF7HashMapIPN3JSC7ProfileEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN7WebCoreL12ProfileClassEv
+__ZN3WTF7HashMapIPN3JSC7ProfileEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN3WTF9HashTableIPN3JSC7ProfileESt4pairIS3_PNS1_8JSObjectEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCoreL16getTitleCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL15getHeadCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS0_11ProfileNodeE
+__ZN7WebCoreL16profileNodeCacheEv
+__ZNK3WTF7HashMapIPN3JSC11ProfileNodeEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN7WebCore16ProfileNodeClassEv
+__ZN3WTF7HashMapIPN3JSC11ProfileNodeEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN3WTF9HashTableIPN3JSC11ProfileNodeESt4pairIS3_PNS1_8JSObjectEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTr
+__ZN7WebCoreL15getFunctionNameEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL10getVisibleEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL6getURLEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL13getLineNumberEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL11getChildrenEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZNK3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3getERKx
+__ZN7WebCore5TimerINS_21JavaScriptDebugServerEE5firedEv
+__ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
+__ZNK3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEdeEv
+__ZN3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEppEv
+__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC16FunctionBodyNodeEEES4_NS_7PtrHashIS4_EENS_10HashTraitsIS4_EES8_E3addEPS3_RKS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC16FunctionBodyNodeEEESt4pairIS4_S4_ENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairH
+__ZN3JSC6Parser5parseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPiPNS_7UStri
+__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE6shrinkEm
+__ZN7WebCoreL8finalizeEP13OpaqueJSValue
+__ZNK7WebCore14ConsoleMessage7isEqualEPN3JSC9ExecStateEPS0_
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE6shrinkEm
+__ZN7WebCoreL12callNodeListEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17InspectorResourceC1ExPNS_14DocumentLoaderE
+__ZN7WebCore17InspectorResourceC2ExPNS_14DocumentLoaderE
+__ZN7WebCore17InspectorResource13updateRequestERKNS_15ResourceRequestE
+__ZN7WebCore19InspectorController11addResourceEPNS_17InspectorResourceE
+__ZN3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3setERKxRKS4_
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore5FrameEEEPNS0_IxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS9_IS6_
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore5FrameEEEPNS0_IxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS9_IS6_E
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore5FrameEEESt4pairIS4_PNS_7HashMapIxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10Has
+__ZN7WebCore17InspectorResource11startTimingEv
+__ZN7WebCore17InspectorResource14updateResponseERKNS_16ResourceResponseE
+__ZN7WebCore17InspectorResource24markResponseReceivedTimeEv
+__ZN7WebCore19InspectorController14pruneResourcesEPN3WTF7HashMapIxNS1_6RefPtrINS_17InspectorResourceEEENS1_7IntHashIyEENS1_10Ha
+__ZN3WTF9HashTableIxSt4pairIxNS_6RefPtrIN7WebCore17InspectorResourceEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIyEENS_14PairHa
+__ZN7WebCore17InspectorResource9addLengthEi
+__ZN7WebCore19InspectorController14removeResourceEPNS_17InspectorResourceE
+__ZN7WebCore17InspectorResource9endTimingEv
+__ZN7WebCore19InspectorController27startUserInitiatedProfilingEPNS_5TimerIS0_EE
+__ZN7WebCore19InspectorController18toggleRecordButtonEb
+__ZN7WebCore22CSSQuirkPrimitiveValueD0Ev
+__ZN7WebCore16jsStyleSheetHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18RenderTableSection16leftmostPositionEbb
+__ZNK7WebCore4Font31offsetForPositionForComplexTextERKNS_7TextRunEib
+__ZN7WebCore18CoreTextController17offsetForPositionEib
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE11reverseRunsEjj
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE5embedEN3WTF7Unicode9DirectionE
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE23commitExplicitEmbeddingEv
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE27raiseExplicitEmbeddingLevelEN3WTF7Unicode9DirectionES6
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE27lowerExplicitEmbeddingLevelEN3WTF7Unicode9DirectionE
+__ZN7WebCore36jsRangePrototypeFunctionSetEndBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range12setEndBeforeEPNS_4NodeERi
+__ZN3WTF6VectorI6CGSizeLm256EE14expandCapacityEmPKS1_
+__ZN3WTF6VectorI6CGSizeLm256EE14expandCapacityEm
+__ZN3WTF6VectorI6CGSizeLm256EE15reserveCapacityEm
+__ZN3WTF6VectorItLm256EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm256EE14expandCapacityEm
+__ZN3WTF6VectorItLm256EE15reserveCapacityEm
+__ZN7WebCore32setJSHTMLTableCellElementRowSpanEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement10setRowSpanEi
+__ZN7WebCore8JSWorker3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20setJSWorkerOnmessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17jsWorkerOnmessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18setJSWorkerOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZThn16_N7WebCore6Worker14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore6Worker14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore12WorkerThread6createERKNS_4KURLERKNS_6StringES6_PNS_20WorkerMessagingProxyE
-__ZN7WebCore12WorkerThreadC1ERKNS_4KURLERKNS_6StringES6_PNS_20WorkerMessagingProxyE
-__ZN7WebCore23WorkerThreadStartupDataC1ERKNS_4KURLERKNS_6StringES6_
-__ZNK7WebCore4KURL4copyEv
-__ZN7WebCore20WorkerMessagingProxy19workerThreadCreatedEN3WTF10PassRefPtrINS_12WorkerThreadEEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10WorkerTaskEEELm0EE14shrinkCapacityEm
-__ZN7WebCore12WorkerThread5startEv
-__ZN7WebCore12WorkerThread17workerThreadStartEPv
-__ZN7WebCore12WorkerThread12workerThreadEv
-__ZN7WebCore13WorkerContextC1ERKNS_4KURLERKNS_6StringEPNS_12WorkerThreadE
-__ZN7WebCore22WorkerScriptControllerC1EPNS_13WorkerContextE
-__ZN7WebCore13WorkerRunLoop8postTaskEN3WTF10PassRefPtrINS_10WorkerTaskEEE
-__ZN3WTF5DequeINS_6RefPtrIN7WebCore10WorkerTaskEEEE14expandCapacityEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10WorkerTaskEEELm0EE6shrinkEm
-__ZN7WebCore12WorkerThread4stopEv
-__ZN7WebCore13WorkerRunLoop9terminateEv
-__ZThn20_N7WebCore6Worker14refEventTargetEv
-__ZN7WebCore6Worker14refEventTargetEv
-__ZN7WebCore22WorkerScriptController8evaluateERKNS_16ScriptSourceCodeE
-__ZN7WebCore22WorkerScriptController10initScriptEv
-__ZN7WebCore24JSWorkerContextPrototypenwEmPN3JSC12JSGlobalDataE
-__ZN7WebCore22WorkerScriptController15forbidExecutionEv
-__ZNK7WebCore13WorkerContext18hasPendingActivityEv
-__ZN7WebCore20WorkerMessagingProxy26confirmWorkerThreadMessageEb
-__ZThn44_N7WebCore8Document8postTaskEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
-__ZN7WebCore8Document8postTaskEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
-__ZN7WebCore13WorkerRunLoop3runEPNS_13WorkerContextE
-__ZN7WebCore22WorkerScriptControllerD1Ev
-__ZN7WebCore15JSWorkerContextC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13WorkerContextEEE
-__ZN7WebCore19JSWorkerContextBaseC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13WorkerContextEEE
-__ZNK3JSC14JSGlobalObject17supportsProfilingEv
-__ZN7WebCore15JSWorkerContext3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_10JSValuePtrERNS1_15PutPropertySlotE
-__ZN7WebCoreL23getJSWorkerContextTableEPN3JSC9ExecStateE
-__ZN7WebCore27setJSWorkerContextOnmessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore20WorkerMessagingProxy26reportWorkerThreadActivityEb
-__ZN7WebCore24MessageWorkerContextTask11performTaskEPNS_13WorkerContextE
 __ZN7WebCore15JSWorkerContext18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCore15JSWorkerContext24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL23getJSWorkerContextTableEPN3JSC9ExecStateE
 __ZN7WebCore24JSWorkerContextPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCoreL32getJSWorkerContextPrototypeTableEPN3JSC9ExecStateE
-__ZN7WebCore48jsWorkerContextPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
 __ZNK7WebCore15JSWorkerContext9classInfoEv
-__ZN7WebCore15JSWorkerContext16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore13WorkerContext16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCore13WorkerContextD1Ev
-__ZN7WebCore20WorkerMessagingProxy22workerContextDestroyedEv
-__ZThn52_N7WebCore13WorkerContext14refEventTargetEv
-__ZN7WebCore13WorkerContext14refEventTargetEv
+__ZN7WebCore15JSWorkerContext4markEv
 __ZNK7WebCore19JSWorkerContextBase22scriptExecutionContextEv
-__ZNK7WebCore22ScriptExecutionContext10isDocumentEv
-__ZN3WTF14ThreadSpecificIN7WebCore16ThreadGlobalDataEE7destroyEPv
-__ZN7WebCore16ThreadGlobalDataD1Ev
-__ZN7WebCore19ICUConverterWrapperD1Ev
-__ZN7WebCore10EventNamesD2Ev
+__ZN7WebCore43jsWorkerContextPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13WorkerContext11postMessageERKNS_6StringE
+__ZThn8_N7WebCore20WorkerMessagingProxy25postMessageToWorkerObjectERKNS_6StringE
+__ZN7WebCore20WorkerMessagingProxy25postMessageToWorkerObjectERKNS_6StringE
+__ZN7WebCore17MessageWorkerTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore6Worker15dispatchMessageERKNS_6StringE
+__ZThn32_N7WebCore6Worker14refEventTargetEv
+__ZN7WebCore6Worker14refEventTargetEv
 __ZN7WebCore11EventTarget16toXMLHttpRequestEv
 __ZN7WebCore11EventTarget22toXMLHttpRequestUploadEv
 __ZN7WebCore11EventTarget21toDOMApplicationCacheEv
 __ZN7WebCore11EventTarget13toMessagePortEv
+__ZThn32_N7WebCore6Worker8toWorkerEv
+__ZN7WebCore6Worker8toWorkerEv
+__ZN7WebCore17MessageWorkerTaskD0Ev
+__ZNK3JSC14JSGlobalObject21shouldInterruptScriptEv
+__ZN7WebCore19WebCoreJSClientDataD0Ev
+__ZThn32_N7WebCore6Worker16derefEventTargetEv
+__ZN7WebCore6Worker16derefEventTargetEv
+__ZN7WebCore18setJSWorkerOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore6Worker18dispatchErrorEventEv
+__ZN7WebCore36jsWorkerPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6Worker11postMessageERKNS_6StringE
+__ZN7WebCore20WorkerMessagingProxy26postMessageToWorkerContextERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE15reserveCapacityEm
+__ZN7WebCore13WorkerRunLoop8postTaskEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore13WorkerRunLoop15postTaskForModeEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEERKNS_6StringE
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore13WorkerRunLoop4TaskEEEE14expandCapacityEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE6shrinkEm
+__ZN7WebCore15JSWorkerContext3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore27setJSWorkerContextOnmessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24MessageWorkerContextTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore13WorkerContext15dispatchMessageERKNS_6StringE
+__ZThn96_N7WebCore13WorkerContext14refEventTargetEv
+__ZN7WebCore13WorkerContext14refEventTargetEv
+__ZNK7WebCore22ScriptExecutionContext10isDocumentEv
 __ZN7WebCore11EventTarget8toWorkerEv
-__ZThn52_N7WebCore13WorkerContext15toWorkerContextEv
+__ZThn96_N7WebCore13WorkerContext15toWorkerContextEv
 __ZN7WebCore13WorkerContext15toWorkerContextEv
 __ZNK7WebCore13WorkerContext15isWorkerContextEv
-__ZN7WebCore15JSWorkerContext4markEv
-__ZN7WebCore13WorkerContext13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
-__ZN7WebCoreL11performTaskEPv
-__ZN7WebCore30WorkerThreadActivityReportTask11performTaskEPNS_22ScriptExecutionContextE
-__ZN7WebCore20WorkerMessagingProxy34reportWorkerThreadActivityInternalEbb
-__ZN7WebCore22ScriptExecutionContext4TaskD0Ev
-__ZN7WebCore26WorkerContextDestroyedTask11performTaskEPNS_22ScriptExecutionContextE
-__ZN7WebCore51jsWorkerContextPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore15JSWorkerContext19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore13WorkerContext19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore45jsWorkerContextPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZThn52_N7WebCore13WorkerContext16derefEventTargetEv
-__ZN7WebCore13WorkerContext16derefEventTargetEv
-__ZN7WebCore43jsWorkerContextPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore13WorkerContext11postMessageERKNS_6StringE
-__ZN7WebCore20WorkerMessagingProxy25postMessageToWorkerObjectERKNS_6StringE
-__ZN7WebCore10WorkerTaskD0Ev
-__ZN7WebCore17MessageWorkerTask11performTaskEPNS_22ScriptExecutionContextE
-__ZThn20_N7WebCore6Worker8toWorkerEv
-__ZN7WebCore6Worker8toWorkerEv
-__ZThn20_N7WebCore6Worker16derefEventTargetEv
-__ZN7WebCore6Worker16derefEventTargetEv
-__ZN7WebCore19jsWorkerContextSelfEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore15JSWorkerContext4selfEPN3JSC9ExecStateE
-__ZN7WebCore41setJSWorkerContextMessageEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore22setJSWorkerContextSelfEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrE
-__ZN7WebCore15JSWorkerContext7setSelfEPN3JSC9ExecStateENS1_10JSValuePtrE
-__ZN7WebCore40jsWorkerContextWorkerLocationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore24jsWorkerContextNavigatorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore13WorkerContext9navigatorEv
 __ZN7WebCore15WorkerNavigatorC1ERKNS_6StringE
-__ZN7WebCore16JSWorkerLocation14getConstructorEPN3JSC9ExecStateE
-__ZN7WebCore27JSWorkerLocationConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore15WorkerNavigatorC2ERKNS_6StringE
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15WorkerNavigatorE
-__ZN7WebCore17JSWorkerNavigator15createPrototypeEPN3JSC9ExecStateE
+__ZN7WebCore17JSWorkerNavigator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore17JSWorkerNavigatorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WorkerNavigatorEEE
-__ZN7WebCore25JSWorkerLocationPrototype4selfEPN3JSC9ExecStateE
-__ZN7WebCore16JSWorkerLocation15createPrototypeEPN3JSC9ExecStateE
-__ZN7WebCore27JSWorkerLocationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSWorkerLocationConstructor9classInfoEv
-__ZN7WebCore17JSWorkerNavigatorD0Ev
+__ZN7WebCore17JSWorkerNavigatorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WorkerNavigatorEEE
 __ZN7WebCore17JSWorkerNavigator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCoreL25getJSWorkerNavigatorTableEPN3JSC9ExecStateE
+__ZN7WebCore13WorkerContext13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZThn8_N7WebCore20WorkerMessagingProxy30confirmMessageFromWorkerObjectEb
+__ZN7WebCore20WorkerMessagingProxy30confirmMessageFromWorkerObjectEb
+__ZN7WebCore24MessageWorkerContextTaskD0Ev
+__ZThn96_N7WebCore13WorkerContext16derefEventTargetEv
+__ZN7WebCore13WorkerContext16derefEventTargetEv
 __ZN7WebCore23jsWorkerContextLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13WorkerContext8locationEv
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14WorkerLocationE
+__ZN7WebCore16JSWorkerLocation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
 __ZN7WebCore16JSWorkerLocationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14WorkerLocationEEE
+__ZN7WebCore16JSWorkerLocationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14WorkerLocationEEE
 __ZN7WebCore16JSWorkerLocation18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCoreL24getJSWorkerLocationTableEPN3JSC9ExecStateE
+__ZN7WebCore17JSWorkerNavigatorD1Ev
+__ZN7WebCore17JSWorkerNavigatorD2Ev
+__ZN7WebCore26JSWorkerNavigatorPrototypeD1Ev
+__ZN7WebCore16JSWorkerLocationD1Ev
+__ZN7WebCore16JSWorkerLocationD2Ev
+__ZN7WebCore25JSWorkerLocationPrototypeD1Ev
+__ZN7WebCore15WorkerNavigatorD0Ev
+__ZN7WebCore48jsWorkerContextPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapIN7WebCore12AtomicStringENS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEENS1_16AtomicStringHashENS_10HashTrai
+__ZN3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEEENS_18PairFirstExtracto
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEC2ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEaSERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE6shrinkEm
+__ZN7WebCore51jsWorkerContextPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore45jsWorkerContextPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore40jsWorkerContextWorkerLocationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSWorkerLocation14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSWorkerLocationConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSWorkerLocationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSWorkerLocationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSWorkerLocationConstructor9classInfoEv
 __ZN7WebCore25JSWorkerLocationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZN7WebCoreL33getJSWorkerLocationPrototypeTableEPN3JSC9ExecStateE
-__ZN7WebCore41jsWorkerLocationPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore41jsWorkerLocationPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore16JSWorkerLocation9classInfoEv
 __ZNK7WebCore14WorkerLocation8toStringEv
 __ZN7WebCore20jsWorkerLocationHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
@@ -19612,6 +20033,7 @@
 __ZNK7WebCore14WorkerLocation6searchEv
 __ZN7WebCore20jsWorkerLocationHashEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore14WorkerLocation4hashEv
+__ZN7WebCore27JSWorkerLocationConstructorD1Ev
 __ZNK7WebCore17JSWorkerNavigator9classInfoEv
 __ZN7WebCore24jsWorkerNavigatorAppNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore27jsWorkerNavigatorAppVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
@@ -19619,134 +20041,3958 @@
 __ZN7WebCore25jsWorkerNavigatorPlatformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore26jsWorkerNavigatorUserAgentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore23jsWorkerNavigatorOnLineEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZNK7WebCore5XPath8Negative8evaluateEv
-__ZNK7WebCore5XPath9FunNumber8evaluateEv
-__ZNK7WebCore5XPath7FunTrue8evaluateEv
-__ZNK7WebCore5XPath8FunFalse8evaluateEv
-__ZNK7WebCore5XPath8FunCount8evaluateEv
-__ZNK7WebCore5XPath15FunNamespaceURI8evaluateEv
-__ZNK7WebCore5XPath13FunStartsWith8evaluateEv
-__ZNK7WebCore5XPath17FunSubstringAfter8evaluateEv
+__ZN7WebCore19jsWorkerContextSelfEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13WorkerContextE
+__ZN7WebCore41setJSWorkerContextMessageEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22setJSWorkerContextSelfEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34jsWorkerPrototypeFunctionTerminateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsWorkerContextPrototypeFunctionSetTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext10setTimeoutEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext10setTimeoutEPNS_15ScheduledActionEi
+__ZNK7WebCore13WorkerContext22scriptExecutionContextEv
+__ZN7WebCore44jsWorkerContextPrototypeFunctionClearTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13WorkerContext12clearTimeoutEi
+__ZN7WebCore43jsWorkerContextPrototypeFunctionSetIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext11setIntervalEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext11setIntervalEPNS_15ScheduledActionEi
+__ZN7WebCore17WorkerSharedTimer11setFireTimeEd
+__ZN7WebCore15ScheduledAction7executeEPNS_13WorkerContextE
+__ZN7WebCore45jsWorkerContextPrototypeFunctionClearIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13WorkerContext13clearIntervalEi
+__ZN7WebCore23jsXMLHttpRequestOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsXMLHttpRequestOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsXMLHttpRequestOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsXMLHttpRequestOnloadstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsXMLHttpRequestOnprogressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsXMLHttpRequestOnreadystatechangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsXMLHttpRequestUploadOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsXMLHttpRequestUploadOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsXMLHttpRequestUploadOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsXMLHttpRequestUploadOnloadstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsXMLHttpRequestUploadOnprogressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29JSXMLHttpRequestProgressEvent9classInfoEv
+__ZN7WebCoreL37getJSXMLHttpRequestProgressEventTableEPN3JSC9ExecStateE
+__ZNK7WebCore38JSXMLHttpRequestProgressEventPrototype9classInfoEv
+__ZN7WebCoreL46getJSXMLHttpRequestProgressEventPrototypeTableEPN3JSC9ExecStateE
+__ZNK7WebCore24JSProgressEventPrototype9classInfoEv
+__ZN7WebCore29JSXMLHttpRequestProgressEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore37jsXMLHttpRequestProgressEventPositionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsXMLHttpRequestProgressEventTotalSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsRangePrototypeFunctionCollapseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore5XPath5Union8evaluateEv
 __ZNK7WebCore5XPath12FunSubstring8evaluateEv
 __ZN7WebCore5XPath8FunRound5roundEd
+__ZN7WebCore5XPath4PathC1EPNS0_6FilterEPNS0_12LocationPathE
+__ZN7WebCore5XPath4PathC2EPNS0_6FilterEPNS0_12LocationPathE
+__ZNK7WebCore5XPath4Path8evaluateEv
+__ZN7WebCore5XPath4PathD0Ev
+__ZNK7WebCore5XPath9FunNumber8evaluateEv
 __ZNK7WebCore5XPath15FunStringLength8evaluateEv
 __ZNK7WebCore5XPath17FunNormalizeSpace8evaluateEv
+__ZNK7WebCore5XPath7FunName8evaluateEv
+__ZN7WebCoreL24createSVGGElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore13JSSVGGElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSSVGGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGGElementEEE
+__ZN7WebCore13JSSVGGElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGGElementEEE
+__ZN7WebCore13JSSVGGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13JSSVGGElement9classInfoEv
+__ZNK7WebCore5XPath17FunSubstringAfter8evaluateEv
+__ZNK7WebCore5XPath8FunFalse8evaluateEv
+__ZN7WebCore13JSSVGGElementD1Ev
+__ZN7WebCore22JSSVGGElementPrototypeD1Ev
+__ZThn8_N7WebCore11SVGGElementD0Ev
+__ZN3WTF6VectorItLm1024EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm1024EE14expandCapacityEm
+__ZN3WTF6VectorItLm1024EE15reserveCapacityEm
 __ZNK7WebCore5XPath12FunTranslate8evaluateEv
 __ZNK7WebCore5XPath10FunBoolean8evaluateEv
+__ZNK7WebCore5XPath7FunTrue8evaluateEv
+__ZNK7WebCore5XPath7FunLang8evaluateEv
+__ZN7WebCore5XPathL12createFunSumEv
+__ZNK7WebCore5XPath6FunSum8evaluateEv
+__ZN7WebCore5XPath6FunSumD0Ev
 __ZNK7WebCore5XPath8FunFloor8evaluateEv
 __ZNK7WebCore5XPath10FunCeiling8evaluateEv
 __ZNK7WebCore5XPath8FunRound8evaluateEv
-__ZN7WebCore24JSWorkerContextPrototypeD0Ev
-__ZN7WebCore15JSWorkerContextD0Ev
-__ZN7WebCore17JSDOMGlobalObject21JSDOMGlobalObjectDataD1Ev
-__ZNK7WebCore5XPath7FunLang8evaluateEv
-__ZN7WebCore19WebCoreJSClientDataD1Ev
-__ZN7WebCore12WorkerThreadD1Ev
-__ZN7WebCore5XPath4PathC2EPNS0_6FilterEPNS0_12LocationPathE
-__ZNK7WebCore5XPath4Path8evaluateEv
-__ZN7WebCore5XPathL12createFunSumEv
-__ZNK7WebCore5XPath6FunSum8evaluateEv
+__ZNK7WebCore5XPath8Negative8evaluateEv
+__ZNK7WebCore5XPath8FunCount8evaluateEv
+__ZNK7WebCore5XPath15FunNamespaceURI8evaluateEv
+__ZN7WebCore48jsXSLTProcessorPrototypeFunctionImportStylesheetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor16importStylesheetEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore51jsXSLTProcessorPrototypeFunctionTransformToFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor19transformToFragmentEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13XSLTProcessor19transformToFragmentEPNS_4NodeEPNS_8DocumentE
+__ZN7WebCoreL13docLoaderFuncEPKhP8_xmlDictiPv12xsltLoadType
+__ZN7WebCoreL20exsltNodeSetFunctionEP22_xmlXPathParserContexti
+__ZL23initxsltFunctionNodeSetP22_xmlXPathParserContexti
+__ZN7WebCore44jsXSLTProcessorPrototypeFunctionSetParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor12setParameterEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13XSLTProcessor12setParameterERKNS_6StringES3_S3_
+__ZN7WebCore44jsXSLTProcessorPrototypeFunctionGetParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor12getParameterEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore13XSLTProcessor12getParameterERKNS_6StringES3_
 __ZL17initxsltGetNsPropP8_xmlNodePKhS2_
-__ZN7WebCore6String8fromUTF8EPKc
 __ZN7WebCore13XSLStyleSheet14loadChildSheetERKNS_6StringE
 __ZN7WebCore13XSLImportRuleC1EPNS_13XSLStyleSheetERKNS_6StringE
+__ZN7WebCore13XSLImportRuleC2EPNS_13XSLStyleSheetERKNS_6StringE
 __ZN7WebCore13XSLImportRule9loadSheetEv
 __ZNK7WebCore13XSLStyleSheet15isXSLStyleSheetEv
 __ZNK7WebCore13XSLImportRule16parentStyleSheetEv
 __ZN7WebCore13XSLImportRule12isImportRuleEv
 __ZN7WebCore13XSLImportRule9isLoadingEv
-__ZThn12_N7WebCore13XSLImportRule16setXSLStyleSheetERKNS_6StringES3_
+__ZThn24_N7WebCore13XSLImportRule16setXSLStyleSheetERKNS_6StringES3_
 __ZN7WebCore13XSLImportRule16setXSLStyleSheetERKNS_6StringES3_
+__ZN7WebCore13XSLStyleSheetC1EPNS_13XSLImportRuleERKNS_6StringE
 __ZN7WebCore13XSLStyleSheetC2EPNS_13XSLImportRuleERKNS_6StringE
 __ZN7WebCore13XSLStyleSheet19setParentStyleSheetEPS0_
-__ZN7WebCoreL13docLoaderFuncEPKhP8_xmlDictiPv12xsltLoadType
 __ZN7WebCore13XSLStyleSheet27locateStylesheetSubResourceEP7_xmlDocPKh
 __ZN7WebCore13XSLStyleSheet15markAsProcessedEv
-__ZL18initxsltNextImportP15_xsltStylesheet
-__ZN7WebCore48jsXSLTProcessorPrototypeFunctionImportStylesheetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore15JSXSLTProcessor16importStylesheetEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore51jsXSLTProcessorPrototypeFunctionTransformToFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore15JSXSLTProcessor19transformToFragmentEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore13XSLTProcessor19transformToFragmentEPNS_4NodeEPNS_8DocumentE
-__ZN7WebCore7Element5styleEv
-__ZN7WebCore44jsXSLTProcessorPrototypeFunctionSetParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore15JSXSLTProcessor12setParameterEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore13XSLTProcessor12setParameterERKNS_6StringES3_S3_
-__ZN7WebCore44jsXSLTProcessorPrototypeFunctionGetParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore15JSXSLTProcessor12getParameterEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZNK7WebCore13XSLTProcessor12getParameterERKNS_6StringES3_
-__ZN7WebCore51jsXSLTProcessorPrototypeFunctionTransformToDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
+__ZN7WebCore13XSLImportRuleD0Ev
+__ZN7WebCore51jsXSLTProcessorPrototypeFunctionTransformToDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore15JSXSLTProcessor19transformToDocumentEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZN7WebCore13XSLTProcessor19transformToDocumentEPNS_4NodeE
-__ZN7WebCore37jsXSLTProcessorPrototypeFunctionResetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore47jsXSLTProcessorPrototypeFunctionRemoveParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore15JSXSLTProcessor15removeParameterEPN3JSC9ExecStateERKNS1_7ArgListE
-__ZN7WebCore13XSLTProcessor15removeParameterERKNS_6StringES3_
-__ZN7WebCore47jsXSLTProcessorPrototypeFunctionClearParametersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCoreL9errorFuncEPvPKcz
-__ZL24initxsltLoadStylesheetPIP7_xmlDoc
-__ZN7WebCoreL20exsltNodeSetFunctionEP22_xmlXPathParserContexti
-__ZL23initxsltFunctionNodeSetP22_xmlXPathParserContexti
 __ZN7WebCore23xsltUnicodeSortFunctionEP21_xsltTransformContextPP8_xmlNodei
 __ZL25initxsltComputeSortResultP21_xsltTransformContextP8_xmlNode
 __ZNK7WebCore9DocLoader24printAccessDeniedMessageERKNS_4KURLE
-__ZN7WebCore13XSLTProcessor14parseErrorFuncEPvP9_xmlError
 __ZNK7WebCore9StyleBase15isXSLStyleSheetEv
-__ZN7WebCore25JSWorkerLocationPrototypeD0Ev
-__ZN7WebCore27JSWorkerLocationConstructorD0Ev
-__ZN7WebCore15WorkerNavigatorD1Ev
-__ZNK3JSC14JSGlobalObject21shouldInterruptScriptEv
-__ZN7WebCoreL8toHebrewEi
-__ZN7WebCoreL17toHebrewUnder1000EiPt
-__ZN7WebCoreL20gridMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL20parseMediaDescriptorERKNS_6StringE
-__ZN7WebCore40jsMediaListPrototypeFunctionAppendMediumEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9MediaList12appendMediumERKNS_6StringERi
-__ZN7WebCoreL28transform_3dMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL26transitionMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCore40jsMediaListPrototypeFunctionDeleteMediumEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore9MediaList12deleteMediumERKNS_6StringERi
-__ZNK7WebCore10MediaQueryeqERKS0_
-__ZN7WebCoreL38max_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL25animationMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCoreL28transform_2dMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
-__ZN7WebCore13HTMLTokenizer9parseTextERNS_15SegmentedStringENS0_5StateE
-__ZN7WebCore33jsConsolePrototypeFunctionProfileEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Console7profileERKN3JSC7UStringEPNS_15ScriptCallStackE
-__ZN7WebCore36jsConsolePrototypeFunctionProfileEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZN7WebCore7Console10profileEndERKN3JSC7UStringEPNS_15ScriptCallStackE
-__ZN7WebCoreL12callNodeListEPN3JSC9ExecStateEPNS0_8JSObjectENS0_10JSValuePtrERKNS0_7ArgListE
-__ZNK7WebCore9RenderBox13reflectionBoxEv
-__ZNK7WebCore15CSSReflectValue7cssTextEv
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE15reserveCapacityEm
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE5embedEN3WTF7Unicode9DirectionE
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE23commitExplicitEmbeddingEv
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE27raiseExplicitEmbeddingLevelEN3WTF7Unicode9DirectionES6_
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE27lowerExplicitEmbeddingLevelEN3WTF7Unicode9DirectionE
-__ZN7WebCore22CSSQuirkPrimitiveValueD1Ev
-__ZN7WebCore22EmptyFrameLoaderClient14cancelledErrorERKNS_15ResourceRequestE
-__ZN7WebCore22EmptyFrameLoaderClient14shouldFallBackERKNS_13ResourceErrorE
-__ZN7WebCore22EmptyFrameLoaderClient20setMainDocumentErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
-__ZN7WebCore22EmptyFrameLoaderClient27dispatchDidLoadMainResourceEPNS_14DocumentLoaderE
-__ZN7WebCore22EmptyFrameLoaderClient21dispatchDidFinishLoadEv
-__ZN7WebCore22EmptyFrameLoaderClient39postProgressEstimateChangedNotificationEv
-__ZN7WebCore22EmptyFrameLoaderClient32postProgressFinishedNotificationEv
-__ZN7WebCore22EmptyFrameLoaderClient19detachedFromParent2Ev
-__ZN7WebCore22EmptyFrameLoaderClient19detachedFromParent3Ev
-__ZN7WebCore17EmptyEditorClient13pageDestroyedEv
-__ZN7WebCore22EmptyFrameLoaderClient20frameLoaderDestroyedEv
-__ZN7WebCore20EmptyInspectorClient18inspectorDestroyedEv
-__ZN7WebCore22EmptyContextMenuClient20contextMenuDestroyedEv
-__ZN7WebCore15EmptyDragClient23dragControllerDestroyedEv
-__ZN7WebCore20SVGImageChromeClient15chromeDestroyedEv
-__ZN7WebCore20SVGImageChromeClientD1Ev
-__ZThn8_N7WebCore24DocumentThreadableLoader15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore13XSLTProcessor14parseErrorFuncEPvP9_xmlError
+__ZN7WebCore37jsXSLTProcessorPrototypeFunctionResetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore47jsXSLTProcessorPrototypeFunctionRemoveParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor15removeParameterEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13XSLTProcessor15removeParameterERKNS_6StringES3_
+__ZN7WebCore47jsXSLTProcessorPrototypeFunctionClearParametersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZL24initxsltLoadStylesheetPIP7_xmlDoc
+__ZN7WebCore21ApplicationCacheGroup11selectCacheEPNS_5FrameERKNS_4KURLE
+__ZN7WebCore23ApplicationCacheStorage22findOrCreateCacheGroupERKNS_4KURLE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_21ApplicationCacheGroupENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3addERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_21ApplicationCacheGroupEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_1
+__ZN7WebCore23ApplicationCacheStorage14loadCacheGroupERKNS_4KURLE
+__ZN7WebCore21ApplicationCacheGroupC1ERKNS_4KURLEb
+__ZN7WebCore21ApplicationCacheGroupC2ERKNS_4KURLEb
+__ZN3WTF7HashMapIjjN7WebCore13AlreadyHashedENS_10HashTraitsIjEES4_E3addERKjS7_
+__ZN3WTF9HashTableIjSt4pairIjjENS_18PairFirstExtractorIS2_EEN7WebCore13AlreadyHashedENS_14PairHashTraitsINS_10HashTraitsIjEES9_
+__ZN7WebCore14DocumentLoader33setCandidateApplicationCacheGroupEPNS_21ApplicationCacheGroupE
+__ZN3WTF7HashSetIPN7WebCore14DocumentLoaderENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandE
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashE
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13alloca
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallo
+__ZN7WebCore21ApplicationCacheGroup6updateEPNS_5FrameENS_28ApplicationCacheUpdateOptionE
+__ZN7WebCore21ApplicationCacheGroup16postListenerTaskEMNS_19DOMApplicationCacheEFvvERKN3WTF7HashSetIPNS_14DocumentLoaderENS4_7P
+__ZN7WebCore21ApplicationCacheGroup16postListenerTaskEMNS_19DOMApplicationCacheEFvvEPNS_14DocumentLoaderE
+__ZN7WebCore21ApplicationCacheGroup20createResourceHandleERKNS_4KURLEPNS_24ApplicationCacheResourceE
+__ZN7WebCore54jsDOMApplicationCachePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore21JSDOMApplicationCache16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore19DOMApplicationCache22scriptExecutionContextEv
+__ZN7WebCore19DOMApplicationCache16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore21ApplicationCacheGroup27finishedLoadingMainResourceEPNS_14DocumentLoaderE
+__ZN7WebCore20ResourceHandleClient26shouldUseCredentialStorageEPNS_14ResourceHandleE
+__ZN7WebCore31ScriptExecutionContextTaskTimer5firedEv
+__ZN7WebCore21CallCacheListenerTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore19DOMApplicationCache20callCheckingListenerEv
+__ZN7WebCore19DOMApplicationCache12callListenerERKNS_12AtomicStringEPNS_13EventListenerE
+__ZN7WebCore19DOMApplicationCache14refEventTargetEv
+__ZN7WebCore19DOMApplicationCache21toDOMApplicationCacheEv
+__ZN7WebCore31ScriptExecutionContextTaskTimerD0Ev
+__ZN7WebCore21CallCacheListenerTaskD0Ev
+__ZN7WebCore20ResourceHandleClient17willCacheResponseEPNS_14ResourceHandleEP19NSCachedURLResponse
+__ZN7WebCore20ResourceHandleClient17willCacheResponseEPNS_14ResourceHandleERNS_18CacheStoragePolicyE
+__ZN7WebCore21ApplicationCacheGroup18didReceiveResponseEPNS_14ResourceHandleERKNS_16ResourceResponseE
+__ZN7WebCore21ApplicationCacheGroup26didReceiveManifestResponseERKNS_16ResourceResponseE
+__ZN7WebCore21ApplicationCacheGroup16manifestNotFoundEv
+__ZN7WebCore21ApplicationCacheGroup12makeObsoleteEv
+__ZN7WebCore23ApplicationCacheStorage22cacheGroupMadeObsoleteEPNS_21ApplicationCacheGroupE
+__ZN7WebCore21ApplicationCacheGroup11stopLoadingEv
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remove
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeE
+__ZN7WebCore21ApplicationCacheGroupD0Ev
+__ZN7WebCore23ApplicationCacheStorage19cacheGroupDestroyedEPNS_21ApplicationCacheGroupE
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZN7WebCore19DOMApplicationCache17callErrorListenerEv
+__ZN7WebCore19DOMApplicationCache16derefEventTargetEv
+__ZN7WebCore24ApplicationCacheResourceC1ERKNS_4KURLERKNS_16ResourceResponseEjN3WTF10PassRefPtrINS_12SharedBufferEEE
+__ZN7WebCore24ApplicationCacheResourceC2ERKNS_4KURLERKNS_16ResourceResponseEjN3WTF10PassRefPtrINS_12SharedBufferEEE
+__ZN7WebCore21ApplicationCacheGroup14didReceiveDataEPNS_14ResourceHandleEPKcii
+__ZN7WebCore21ApplicationCacheGroup22didReceiveManifestDataEPKci
+__ZN7WebCore21ApplicationCacheGroup16didFinishLoadingEPNS_14ResourceHandleE
+__ZN7WebCore21ApplicationCacheGroup24didFinishLoadingManifestEv
+__ZN7WebCore13parseManifestERKNS_4KURLEPKciRNS_8ManifestE
+__ZN7WebCore16ApplicationCacheC1Ev
+__ZN7WebCore16ApplicationCacheC2Ev
+__ZN7WebCore16ApplicationCache8setGroupEPNS_21ApplicationCacheGroupE
+__ZN7WebCore21ApplicationCacheGroup32associateDocumentLoaderWithCacheEPNS_14DocumentLoaderEPNS_16ApplicationCacheE
+__ZN7WebCore14DocumentLoader19setApplicationCacheEN3WTF10PassRefPtrINS_16ApplicationCacheEEE
+__ZN7WebCore21ApplicationCacheGroup8addEntryERKNS_6StringEj
+__ZN7WebCore16ApplicationCache14resourceForURLERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_24ApplicationCacheResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EE
+__ZN3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3addERKS2_RKj
+__ZN7WebCore16ApplicationCache18setOnlineWhitelistERKN3WTF6VectorINS_4KURLELm0EEE
+__ZN3WTF6VectorIN7WebCore4KURLELm0EEaSERKS3_
+__ZN7WebCore16ApplicationCache15setFallbackURLsERKN3WTF6VectorISt4pairINS_4KURLES4_ELm0EEE
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EEaSERKS5_
+__ZN7WebCore21ApplicationCacheGroup17startLoadingEntryEv
+__ZN7WebCore19DOMApplicationCache23callDownloadingListenerEv
+__ZN7WebCore19DOMApplicationCache20callProgressListenerEv
+__ZN7WebCore21ApplicationCacheGroup17cacheUpdateFailedEv
+__ZN7WebCore24ApplicationCacheResourceD0Ev
+__ZN7WebCore21ApplicationCacheGroup27deliverDelayedMainResourcesEv
+__ZN3WTF6VectorIPN7WebCore14DocumentLoaderELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14DocumentLoaderELm0EE15reserveCapacityEm
+__ZN7WebCore16ApplicationCacheD1Ev
+__ZN7WebCore16ApplicationCacheD2Ev
+__ZN7WebCore21ApplicationCacheGroup14cacheDestroyedEPNS_16ApplicationCacheE
+__ZNK3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3
+__ZN7WebCore21ApplicationCacheGroup21checkIfLoadIsCompleteEv
+__ZN3WTF6VectorIPN7WebCore14DocumentLoaderELm0EE6shrinkEm
+__ZN7WebCore16ApplicationCache11addResourceEN3WTF10PassRefPtrINS_24ApplicationCacheResourceEEE
+__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_24ApplicationCacheResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_24ApplicationCacheResourceEEEENS_18PairFirstExtractorIS7_EENS1_10
+__ZN7WebCore16ApplicationCache19setManifestResourceEN3WTF10PassRefPtrINS_24ApplicationCacheResourceEEE
+__ZN7WebCore21ApplicationCacheGroup14setNewestCacheEN3WTF10PassRefPtrINS_16ApplicationCacheEEE
+__ZN3WTF7HashSetIPN7WebCore16ApplicationCacheENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
+__ZN7WebCore23ApplicationCacheStorage16storeNewestCacheEPNS_21ApplicationCacheGroupE
+__ZN7WebCore23ApplicationCacheStorage19verifySchemaVersionEv
+__ZN7WebCore23ApplicationCacheStorage16executeStatementERNS_15SQLiteStatementE
+__ZN7WebCore23ApplicationCacheStorage17executeSQLCommandERKNS_6StringE
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_21ApplicationCacheGroupE
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_16ApplicationCacheE
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_24ApplicationCacheResourceEj
+__ZN7WebCore19DOMApplicationCache18callCachedListenerEv
+__ZNK7WebCore16ApplicationCache10isCompleteEv
+__ZN7WebCore16ApplicationCache27urlMatchesFallbackNamespaceERKNS_4KURLEPS1_
+__ZN7WebCore16ApplicationCache22isURLInOnlineWhitelistERKNS_4KURLE
+__ZNK7WebCore11FrameLoader18cannotShowURLErrorERKNS_15ResourceRequestE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_23XMLHttpRequestExceptionE
+__ZN7WebCore25JSXMLHttpRequestExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23XMLHttpRequestExceptionEEE
+__ZN7WebCore25JSXMLHttpRequestExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23XMLHttpRequestExceptionEEE
+__ZN7WebCore25JSXMLHttpRequestException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL33getJSXMLHttpRequestExceptionTableEPN3JSC9ExecStateE
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_21ApplicationCacheGroupEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_
+__ZN7WebCore25JSXMLHttpRequestExceptionD1Ev
+__ZN7WebCore25JSXMLHttpRequestExceptionD2Ev
+__ZN7WebCore21ApplicationCacheGroup26disassociateDocumentLoaderEPNS_14DocumentLoaderE
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remo
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remov
+__ZN7WebCore23ApplicationCacheStorage9loadCacheEj
+__ZN7WebCore20ResourceResponseBase18setHTTPHeaderFieldERKNS_12AtomicStringERKNS_6StringE
+__ZN7WebCore24ApplicationCacheResource7addTypeEj
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_21ApplicationCacheGroupENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN7WebCore16ApplicationCache18resourceForRequestERKNS_15ResourceRequestE
+__ZN7WebCore19DOMApplicationCache20callNoUpdateListenerEv
+__ZN7WebCore12jsNodeOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node6onloadEv
+__ZN7WebCore34setJSDOMApplicationCacheOnnoupdateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMApplicationCacheOncachedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMApplicationCacheOnupdatereadyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMApplicationCacheOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE6shrinkEm
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_24ApplicationCacheResourceEPNS_16ApplicationCacheE
+__ZN7WebCore34setJSDOMApplicationCacheOncheckingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMApplicationCacheOndownloadingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMApplicationCacheOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMApplicationCacheOnobsoleteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44jsDOMApplicationCachePrototypeFunctionUpdateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19DOMApplicationCache6updateERi
+__ZN7WebCore20ResourceHandleClient15willSendRequestEPNS_14ResourceHandleERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore21ApplicationCacheGroup7didFailEPNS_14ResourceHandleERKNS_13ResourceErrorE
+__ZN7WebCore57jsDOMApplicationCachePrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore21JSDOMApplicationCache19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore19DOMApplicationCache19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore29jsXMLHttpRequestExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23ApplicationCacheStorage6removeEPNS_16ApplicationCacheE
+__ZN7WebCore16ApplicationCache14clearStorageIDEv
+__ZN7WebCore21ApplicationCacheGroup14clearStorageIDEv
+__ZN7WebCore19DOMApplicationCache20callObsoleteListenerEv
+__ZN7WebCore19DOMApplicationCache23callUpdateReadyListenerEv
+__ZN7WebCore47jsDOMApplicationCachePrototypeFunctionSwapCacheEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19DOMApplicationCache9swapCacheERi
+__ZN7WebCore19DOMApplicationCache9swapCacheEv
+__ZN7WebCore23ApplicationCacheStorage16storeUpdatedTypeEPNS_24ApplicationCacheResourceEPNS_16ApplicationCacheE
+__ZNK7WebCore11HistoryItem15formContentTypeEv
+__ZN7WebCore14ResourceHandle17willLoadFromCacheERNS_15ResourceRequestE
+__ZN3WTF6VectorIcLm512EE14expandCapacityEmPKc
+__ZN7WebCore18MainResourceLoader26stopLoadingForPolicyChangeEv
+__ZNK7WebCore18MainResourceLoader32interruptionForPolicyChangeErrorEv
+__ZN7WebCore11FrameLoader32interruptionForPolicyChangeErrorERKNS_15ResourceRequestE
+__ZN7WebCore18JSHTMLVideoElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLMediaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSHTMLMediaElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement6setSrcERKNS_6StringE
+-[WebCoreMovieObserver sizeChanged:]
+__ZN7WebCore18MediaPlayerPrivate11sizeChangedEv
+__ZN7WebCore11MediaPlayer11sizeChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement22mediaPlayerSizeChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement22mediaPlayerSizeChangedEPNS_11MediaPlayerE
+__ZNK7WebCore16HTMLMediaElement5endedEv
+__ZL28initQTMovieHasVideoAttributev
+__ZL32QTMovieHasVideoAttributeFunctionv
+__ZN7WebCore5TimerINS_11RenderMediaEE5firedEv
+__ZN7WebCore11RenderMedia26opacityAnimationTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore11RenderMedia13changeOpacityEPNS_11HTMLElementEf
+__ZN7WebCore11RenderMedia20timeUpdateTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore28jsHTMLMediaElementReadyStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement10readyStateEv
+__ZN7WebCore32setJSHTMLMediaElementCurrentTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement4seekEfRi
+__ZNK7WebCore16HTMLMediaElement8seekableEv
+__ZN7WebCore11MediaPlayer15maxTimeSeekableEv
+__ZNK7WebCore18MediaPlayerPrivate15maxTimeSeekableEv
+__ZN7WebCore10TimeRangesC1Eff
+__ZN7WebCore10TimeRangesC2Eff
+__ZNK7WebCore10TimeRanges7containEf
+__ZNK7WebCore10TimeRanges5startEjRi
+__ZNK7WebCore10TimeRanges3endEjRi
+__ZN7WebCore30jsHTMLMediaElementNetworkStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLMediaElementSeekableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10TimeRangesE
+__ZN7WebCore12JSTimeRanges15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSTimeRangesC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TimeRangesEEE
+__ZN7WebCore12JSTimeRangesC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TimeRangesEEE
+__ZN7WebCore12JSTimeRanges18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsTimeRangesLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSTimeRangesPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsTimeRangesPrototypeFunctionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12JSTimeRanges9classInfoEv
+__ZN7WebCore32jsTimeRangesPrototypeFunctionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26jsHTMLMediaElementDurationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSTimeRangesD1Ev
+__ZN7WebCore12JSTimeRangesD2Ev
+__ZN7WebCore21JSTimeRangesPrototypeD1Ev
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE6shrinkEm
+__ZN7WebCore17InspectorResourceD1Ev
+__ZN7WebCore17InspectorResourceD2Ev
+__ZN7WebCoreL19fontfaceConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGFontFaceElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGFontFaceElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore8Document18mappedElementSheetEv
+__ZN7WebCore18SVGFontFaceElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreL32cssPropertyIdForSVGAttributeNameERKNS_13QualifiedNameE
+__ZN7WebCoreL25mapAttributeToCSSPropertyEPN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiE
+__ZN7WebCore18SVGFontFaceElement20insertedIntoDocumentEv
+__ZN7WebCore18SVGFontFaceElement15rebuildFontFaceEv
+__ZN7WebCore18SVGFontFaceElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCoreL22fontfacesrcConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore21SVGFontFaceSrcElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21SVGFontFaceSrcElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore21SVGFontFaceSrcElement8srcValueEv
+__ZN7WebCore21SVGFontFaceSrcElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCoreL22fontfaceuriConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore21SVGFontFaceUriElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21SVGFontFaceUriElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21SVGFontFaceUriElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore21SVGFontFaceUriElement20insertedIntoDocumentEv
+__ZN7WebCore21SVGFontFaceUriElement8loadFontEv
+__ZNK7WebCore21SVGFontFaceUriElement8srcValueEv
+__ZN7WebCore18SVGFontFaceElementD0Ev
+__ZN7WebCore18SVGFontFaceElement28removeFromMappedElementSheetEv
+__ZN7WebCore21SVGFontFaceSrcElementD0Ev
+__ZN7WebCore21SVGFontFaceUriElementD0Ev
+__ZN7WebCore23JSNodeIteratorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsNodeIteratorPrototypeFunctionNextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSNodeIterator8nextNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore43jsNodeIteratorPrototypeFunctionPreviousNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSNodeIterator12previousNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12NodeIterator12previousNodeEPN3JSC9ExecStateERi
+__ZN7WebCore12NodeIterator11NodePointer14moveToPreviousEPNS_4NodeE
+__ZN7WebCore34jsRangePrototypeFunctionCloneRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL25min_colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL25max_colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore28setJSHTMLTableElementCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25toHTMLTableCaptionElementEN3JSC7JSValueE
+__ZN7WebCore26setJSHTMLTableElementTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSHTMLOptionElementDefaultSelectedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20CachedResourceClient10fontLoadedEPNS_10CachedFontE
+__ZN7WebCore13RenderSVGText29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore13RenderSVGText21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore13RenderSVGText19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore10CachedFont17ensureSVGFontDataEv
+__ZN7WebCoreL15fontConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGFontElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore18SVGFontFaceElement10fontFamilyEv
+__ZN7WebCoreL23missingglyphConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore22SVGMissingGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore22SVGMissingGlyphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL16glyphConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGGlyphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGGlyphElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SVGGlyphElement20insertedIntoDocumentEv
+__ZN7WebCore15SVGGlyphElement20invalidateGlyphCacheEv
+__ZN7WebCore14SVGFontElement20invalidateGlyphCacheEv
+__ZNK7WebCore10CachedFont14getSVGFontByIdERKNS_6StringE
+__ZN7WebCore11SVGFontDataC1EPNS_18SVGFontFaceElementE
+__ZN7WebCore11SVGFontDataC2EPNS_18SVGFontFaceElementE
+__ZNK7WebCore18SVGFontFaceElement17horizontalOriginXEv
+__ZNK7WebCore18SVGFontFaceElement17horizontalOriginYEv
+__ZNK7WebCore18SVGFontFaceElement18horizontalAdvanceXEv
+__ZNK7WebCore18SVGFontFaceElement15verticalOriginXEv
+__ZNK7WebCore18SVGFontFaceElement15verticalOriginYEv
+__ZNK7WebCore18SVGFontFaceElement6ascentEv
+__ZNK7WebCore18SVGFontFaceElement16verticalAdvanceYEv
+__ZNK7WebCore18SVGFontFaceElement10unitsPerEmEv
+__ZNK7WebCore18SVGFontFaceElement7descentEv
+__ZNK7WebCore18SVGFontFaceElement7xHeightEv
+__ZNK7WebCore14SVGFontElement28getGlyphIdentifiersForStringERKNS_6StringERN3WTF6VectorINS_18SVGGlyphIdentifierELm0EEE
+__ZNK7WebCore14SVGFontElement16ensureGlyphCacheEv
+__ZNK7WebCore15SVGGlyphElement20buildGlyphIdentifierEv
+__ZN7WebCore15SVGGlyphElement27buildGenericGlyphIdentifierEPKNS_10SVGElementE
+__ZN7WebCore15pathFromSVGDataERNS_4PathERKNS_6StringE
+__ZNK3WTF7HashMapItNS_6RefPtrIN7WebCore12GlyphMapNodeEEENS_7IntHashIjEENS_10HashTraitsItEENS7_IS4_EEE3getERKt
+__ZN3WTF7HashMapItNS_6RefPtrIN7WebCore12GlyphMapNodeEEENS_7IntHashIjEENS_10HashTraitsItEENS7_IS4_EEE3setERKtRKS4_
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE15reserveCapacityEm
+__ZNK7WebCore4Font22floatWidthUsingSVGFontERKNS_7TextRunE
+__ZN7WebCoreL33floatWidthOfSubStringUsingSVGFontEPKNS_4FontERKNS_7TextRunEiiiRiRNS_6StringE
+__ZN7WebCore16SVGTextRunWalkerINS_34SVGTextRunWalkerMeasuredLengthDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
+__ZN7WebCoreL24charactersWithArabicFormERKNS_6StringEb
+__ZNK7WebCore14SVGFontElement24firstMissingGlyphElementEv
+__ZN7WebCore11PathBuilder9svgMoveToEddbb
+__ZN7WebCore11PathBuilder9svgLineToEddb
+__ZN7WebCore15SVGGlyphElement28inheritUnspecifiedAttributesERNS_18SVGGlyphIdentifierEPKNS_11SVGFontDataE
+__ZN7WebCoreL30floatWidthUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_34SVGTextRunWalkerMeasuredLengthDataE
+__ZNK7WebCore4Font22floatWidthUsingSVGFontERKNS_7TextRunEiRiRNS_6StringE
+__ZNK7WebCore4Font7svgFontEv
+__ZN7WebCore28jsDocumentTypeInternalSubsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore50jsHTMLIFrameElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore21HTMLFrameOwnerElement14getSVGDocumentERi
+__ZN7WebCore50jsHTMLObjectElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL14setConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore13SVGSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13SVGSetElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL26createSVGSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore15JSSVGSetElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSSVGAnimationElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGAnimationElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSetElementEEE
+__ZN7WebCore15JSSVGSetElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSetElementEEE
+__ZN7WebCore21JSSVGAnimationElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimationElementEEE
+__ZN7WebCore21JSSVGAnimationElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSSVGAnimationElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSSVGSetElement9classInfoEv
+__ZN7WebCore21jsSVGRectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_15widthAttr
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEENS1_29SVGAnimatedTypeWrapper
+__ZN3WTF7HashMapIN7WebCore6StringEPKNS1_23SVGAnimatedPropertyBaseENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RK
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_23SVGAnimatedPropertyBaseEENS_18PairFirstExtractorIS7_EENS1_10StringHashEN
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEENS1_29SVGAnimatedTypeWrapperK
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEEENS_18PairFirstE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateINS_9SVGLengthEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedLength15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGAnimatedLengthC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9SVGLengthEEEEEPNS_10S
+__ZN7WebCore19JSSVGAnimatedLengthC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9SVGLengthEEEEEPNS_10S
+__ZN7WebCore19JSSVGAnimatedLength18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsSVGAnimatedLengthBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3WTF9HashTableIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_PNS1_26JSSVGD
+__ZN3WTF7HashMapIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEEPNS1_26JSSVGDynamicPODTypeW
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGLengthC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEEEPNS_10SVGElemen
+__ZN7WebCore11JSSVGLengthC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEEEPNS_10SVGElemen
+__ZN7WebCore26jsSVGAnimatedLengthAnimValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3WTF7HashMapIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEEPNS1_26JSSVGDynamicPODType
+__ZN7WebCore11JSSVGLength18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsSVGLengthUnitTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEEcvS1_Ev
+__ZN7WebCore32jsSVGLengthValueInSpecifiedUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsSVGLengthValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSSVGLength5valueEPN3JSC9ExecStateE
+__ZN7WebCore50jsSVGAnimationElementPrototypeFunctionBeginElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19SVGAnimationElement12beginElementERi
+__ZN7WebCore19SVGAnimationElement14beginElementAtEfRi
+__ZNK7WebCore14SVGSMILElement7elapsedEv
+__ZN7WebCore14SVGSMILElement12addBeginTimeENS_8SMILTimeE
+__ZN7WebCore14SVGSMILElement16beginListChangedEv
+__ZN7WebCore46jsSVGSVGElementPrototypeFunctionSetCurrentTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement14setCurrentTimeEf
+__ZNK7WebCore19SVGAnimationElement7toValueEv
+__ZN7WebCore19synchronizePropertyINS_14SVGRectElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore56jsSVGTextContentElementPrototypeFunctionGetNumberOfCharsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZNK7WebCore21SVGTextContentElement16getNumberOfCharsEv
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE6appendIS2_EEvPKT_m
+__ZSt16__introsort_loopIPN7WebCore18SVGGlyphIdentifierElPFbRKS1_S4_EEvT_S7_T0_T1_
+__ZSt22__final_insertion_sortIPN7WebCore18SVGGlyphIdentifierEPFbRKS1_S4_EEvT_S7_T0_
+__ZSt16__insertion_sortIPN7WebCore18SVGGlyphIdentifierEPFbRKS1_S4_EEvT_S7_T0_
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE6shrinkEm
+__ZNK7WebCore14SVGFontElement43getHorizontalKerningPairForStringsAndGlyphsERKNS_6StringES3_S3_S3_RNS_24SVGHorizontalKerningPair
+__ZNK7WebCore13RenderSVGText9isSVGTextEv
+__ZNK7WebCore16SVGRootInlineBox13svgTextChunksEv
+__ZN7WebCoreL29findInlineTextBoxInTextChunksEPKNS_21SVGTextContentElementERKN3WTF6VectorINS_12SVGTextChunkELm0EEE
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE15reserveCapacityEm
+__ZN7WebCore18SVGTextChunkWalkerINS_27SVGInlineTextBoxQueryWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS
+__ZN7WebCore27SVGInlineTextBoxQueryWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGC
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE6shrinkEm
+__ZN7WebCore61jsSVGTextContentElementPrototypeFunctionGetComputedTextLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_
+__ZNK7WebCore21SVGTextContentElement21getComputedTextLengthEv
+__ZN7WebCore58jsSVGTextContentElementPrototypeFunctionGetSubStringLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZNK7WebCore21SVGTextContentElement18getSubStringLengthEjjRi
+__ZN7WebCore62jsSVGTextContentElementPrototypeFunctionGetStartPositionOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0
+__ZNK7WebCore21SVGTextContentElement22getStartPositionOfCharEjRi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_10FloatPointEEEPNS_10SVGElementE
+__ZN7WebCore10JSSVGPoint15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGPointC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_10FloatPointEEEEEPNS_10SVGEleme
+__ZN7WebCore10JSSVGPointC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_10FloatPointEEEEEPNS_10SVGEleme
+__ZN7WebCore10JSSVGPoint18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11jsSVGPointXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_10FloatPointEEcvS1_Ev
+__ZN7WebCore11jsSVGPointYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore60jsSVGTextContentElementPrototypeFunctionGetEndPositionOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZNK7WebCore21SVGTextContentElement20getEndPositionOfCharEjRi
+__ZN7WebCoreL19textpathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGTextPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGTextPathElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL31createSVGTextPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGTextPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGTextPathElementEEE
+__ZN7WebCore20JSSVGTextPathElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGTextPathElementEEE
+__ZN7WebCore20JSSVGTextPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGTextPathElement9classInfoEv
+__ZN7WebCore18SVGTextPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn432_NK7WebCore18SVGTextPathElement14contextElementEv
+__ZNK7WebCore18SVGTextPathElement14contextElementEv
+__ZN7WebCore18SVGTextPathElement20insertedIntoDocumentEv
+__ZN7WebCore57jsSVGTextContentElementPrototypeFunctionGetRotationOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZNK7WebCore21SVGTextContentElement17getRotationOfCharEjRi
+__ZN7WebCore18SVGTextPathElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore18SVGTextPathElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore17RenderSVGTextPathC1EPNS_4NodeE
+__ZN7WebCore17RenderSVGTextPathC2EPNS_4NodeE
+__ZNK7WebCore18SVGTextPathElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore22SVGCharacterLayoutInfo15setInPathLayoutEb
+__ZN7WebCore22SVGCharacterLayoutInfo20addLayoutInformationEPNS_13InlineFlowBoxEf
+__ZNK7WebCore17RenderSVGTextPath10layoutPathEv
+__ZN7WebCore4Path6lengthEv
+__ZN7WebCore18PathTraversalStateC1ENS0_19PathTraversalActionE
+__ZN7WebCore18PathTraversalStateC2ENS0_19PathTraversalActionE
+__ZNK7WebCore4Path5applyEPvPFvS1_PKNS_11PathElementEE
+__ZN7WebCoreL26CGPathApplierToPathApplierEPvPK13CGPathElement
+__ZN7WebCoreL25pathLengthApplierFunctionEPvPKNS_11PathElementE
+__ZN7WebCore18PathTraversalState6moveToERKNS_10FloatPointE
+__ZN7WebCore18PathTraversalState6lineToERKNS_10FloatPointE
+__ZNK7WebCore17RenderSVGTextPath11startOffsetEv
+__ZN7WebCore22SVGCharacterLayoutInfo27nextPathLayoutPointAndAngleEfff
+__ZN7WebCore4Path13pointAtLengthEfRb
+__ZN7WebCore4Path19normalAngleAtLengthEfRb
+__ZN7WebCore24RenderSVGHiddenContainer29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore18SVGFontFaceElement19removedFromDocumentEv
+__ZN7WebCore11SVGFontDataD0Ev
+__ZN7WebCoreL31createSVGFontFaceElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGFontFaceElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGFontFaceElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGFontFaceElementEEE
+__ZN7WebCore20JSSVGFontFaceElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGFontFaceElementEEE
+__ZNK7WebCore20JSSVGFontFaceElement9classInfoEv
+__ZN7WebCoreL35createSVGMissingGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore24JSSVGMissingGlyphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGMissingGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGMissingGlyphElementEEE
+__ZN7WebCore24JSSVGMissingGlyphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGMissingGlyphElementEEE
+__ZNK7WebCore24JSSVGMissingGlyphElement9classInfoEv
+__ZN7WebCoreL28createSVGGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGGlyphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGGlyphElementEEE
+__ZN7WebCore17JSSVGGlyphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGGlyphElementEEE
+__ZNK7WebCore17JSSVGGlyphElement9classInfoEv
+__ZN7WebCoreL16hkernConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGHKernElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGHKernElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore12JSSVGElement9classInfoEv
+__ZN7WebCoreL27createSVGFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGFontElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGFontElementEEE
+__ZN7WebCore16JSSVGFontElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGFontElementEEE
+__ZNK7WebCore16JSSVGFontElement9classInfoEv
+__ZN7WebCore14SVGFontElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore15SVGHKernElement20insertedIntoDocumentEv
+__ZN7WebCoreL28createSVGTSpanElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGTSpanElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGTSpanElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTSpanElementEEE
+__ZN7WebCore17JSSVGTSpanElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTSpanElementEEE
+__ZNK7WebCore17JSSVGTSpanElement9classInfoEv
+__ZN7WebCore12SVGLangSpace10setXmllangERKNS_12AtomicStringE
+__ZN7WebCoreL19altglyphConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGAltGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGAltGlyphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL31createSVGAltGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGAltGlyphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGAltGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGAltGlyphElementEEE
+__ZN7WebCore20JSSVGAltGlyphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGAltGlyphElementEEE
+__ZN7WebCore20JSSVGAltGlyphElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGAltGlyphElement9classInfoEv
+__ZN7WebCore18SVGAltGlyphElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore18SVGAltGlyphElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore11PathBuilder12svgClosePathEv
+__ZN7WebCore20parseDelimitedStringERKNS_6StringEc
+__ZNK7WebCore15SVGHKernElement26buildHorizontalKerningPairEv
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE15reserveCapacityEm
+__ZN7WebCore11SVGGlyphMap20compareGlyphPriorityERKNS_18SVGGlyphIdentifierES3_
+__ZSt25__unguarded_linear_insertIPN7WebCore18SVGGlyphIdentifierES1_PFbRKS1_S4_EEvT_T0_T1_
+__ZN7WebCoreL25stringMatchesUnicodeRangeERKNS_6StringES2_
+__ZN3WTF6VectorISt4pairIjjELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIjjELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIjjELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIjjELm0EE6shrinkEm
+__ZN3WTF6VectorISt4pairIjjELm0EE14expandCapacityEmPKS2_
+__ZNK7WebCore18SVGAltGlyphElement12glyphElementEv
+__ZN7WebCore17RenderSVGTextPathD0Ev
+__ZN7WebCore17JSSVGTSpanElementD1Ev
+__ZN7WebCore16JSSVGFontElementD1Ev
+__ZN7WebCore17JSSVGGlyphElementD1Ev
+__ZN7WebCore24JSSVGMissingGlyphElementD1Ev
+__ZN7WebCore20JSSVGFontFaceElementD1Ev
+__ZN7WebCore20JSSVGTextPathElementD1Ev
+__ZN7WebCore10JSSVGPointD1Ev
+__ZN7WebCore10JSSVGPointD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_10FloatPointEED0Ev
+__ZN7WebCore11JSSVGLengthD1Ev
+__ZN7WebCore11JSSVGLengthD2Ev
+__ZN3WTF9HashTableIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_PNS1_26JSSVGDy
+__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEED0Ev
+__ZN7WebCore19JSSVGAnimatedLengthD1Ev
+__ZN7WebCore19JSSVGAnimatedLengthD2Ev
+__ZN7WebCore15JSSVGSetElementD1Ev
+__ZN7WebCore14SVGFontElementD0Ev
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE6shrinkEm
+__ZN7WebCore22SVGMissingGlyphElementD0Ev
+__ZN7WebCore15SVGGlyphElementD0Ev
+__ZN7WebCore15SVGHKernElementD0Ev
+__ZN7WebCore13SVGSetElementD0Ev
+__ZN7WebCore17SVGAnimateElementD2Ev
+__ZN7WebCore18SVGTextPathElementD0Ev
+__ZN7WebCore20JSSVGAltGlyphElementD1Ev
+__ZThn8_N7WebCore14SVGTextElementD0Ev
+__ZN7WebCore18SVGAltGlyphElementD0Ev
+__ZN7WebCore26JSSVGTSpanElementPrototypeD1Ev
+__ZN7WebCore25JSSVGFontElementPrototypeD1Ev
+__ZN7WebCore26JSSVGGlyphElementPrototypeD1Ev
+__ZN7WebCore33JSSVGMissingGlyphElementPrototypeD1Ev
+__ZN7WebCore29JSSVGFontFaceElementPrototypeD1Ev
+__ZN7WebCore19JSSVGPointPrototypeD1Ev
+__ZN7WebCore28JSSVGAnimatedLengthPrototypeD1Ev
+__ZN7WebCore24JSSVGSetElementPrototypeD1Ev
+__ZN7WebCore30JSSVGAnimationElementPrototypeD1Ev
+__ZN7WebCore29JSSVGAltGlyphElementPrototypeD1Ev
+__ZN7WebCore8Document29parseDNSPrefetchControlHeaderERKNS_6StringE
+__ZN7WebCore15FormDataBuilder28generateUniqueBoundaryStringEv
+__ZN7WebCore15FormDataBuilder20beginMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_7CStringES7_
+__ZN7WebCore15FormDataBuilder28addBoundaryToMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_7CStringEb
+__ZN7WebCore15FormDataBuilder28addFilenameToMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_12TextEncodingERKNS_6StringE
+__ZN7WebCore15FormDataBuilder21finishMultiPartHeaderERN3WTF6VectorIcLm0EEE
+__ZN7WebCoreL37nonCachingStaticReplaceFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11FrameLoader27handleUnimplementablePolicyERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader25setupForReplaceByMIMETypeERKNS_6StringE
+__ZN7WebCore14DocumentLoader25setupForReplaceByMIMETypeERKNS_6StringE
+__ZN7WebCore14ResourceLoader17clearResourceDataEv
+__ZN7WebCore11FrameLoader12setReplacingEv
+__ZN7WebCore12SharedBuffer5clearEv
+__ZN7WebCore12SharedBuffer17clearPlatformDataEv
+__ZNK7WebCore11CachedImage7isImageEv
+__ZN7WebCore14DocumentLoader39subresourceLoaderFinishedLoadingOnePartEPNS_14ResourceLoaderE
+__ZN7WebCore17HTMLSelectElement23restoreFormControlStateERKNS_6StringE
+__ZN7WebCore19HTMLTextAreaElement23restoreFormControlStateERKNS_6StringE
+__ZN7WebCore14jsNodeOnresizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onresizeEv
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementEffffRi
+__ZN7WebCoreL16imageConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGImageLoaderC1EPNS_15SVGImageElementE
+__ZN7WebCore14SVGImageLoaderC2EPNS_15SVGImageElementE
+__ZN7WebCore15SVGImageElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn408_NK7WebCore15SVGImageElement14contextElementEv
+__ZNK7WebCore15SVGImageElement14contextElementEv
+__ZN7WebCore15SVGImageElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore15SVGImageElement20insertedIntoDocumentEv
+__ZNK7WebCore15SVGImageElement24imageSourceAttributeNameEv
+__ZNK7WebCore14SVGImageLoader9sourceURIERKNS_12AtomicStringE
+__ZN7WebCore22EmptyFrameLoaderClient38dispatchDidLoadResourceFromMemoryCacheEPNS_14DocumentLoaderERKNS_15ResourceRequestERKNS_1
+__ZN7WebCore22EmptyFrameLoaderClient26dispatchDidReceiveResponseEPNS_14DocumentLoaderEmRKNS_16ResourceResponseE
+__ZN7WebCore22EmptyFrameLoaderClient31dispatchDidReceiveContentLengthEPNS_14DocumentLoaderEmi
+__ZN7WebCore22EmptyFrameLoaderClient24dispatchDidFinishLoadingEPNS_14DocumentLoaderEm
+__ZN7WebCore15SVGImageElement6attachEv
+__ZNK7WebCore15SVGImageElement7isValidEv
+__ZN7WebCore15SVGImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderSVGImageC1EPNS_15SVGImageElementE
+__ZN7WebCore14RenderSVGImageC2EPNS_15SVGImageElementE
+__ZNK7WebCore14RenderSVGImage13requiresLayerEv
+__ZN7WebCore14RenderSVGImage12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore14RenderSVGImage29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore14RenderSVGImage29repaintRectInLocalCoordinatesEv
+__ZN7WebCore14RenderSVGImage21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore14RenderSVGImage22localToParentTransformEv
+__ZN7WebCore15SVGImageElement27haveLoadedRequiredResourcesEv
+__ZThn360_NK7WebCore15SVGImageElement14contextElementEv
+__ZN7WebCore14SVGImageLoader17dispatchLoadEventEv
+__ZN7WebCore14RenderSVGImage6layoutEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_16heightAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11yAttrStr
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11xAttrStr
+__ZNK7WebCore5Image23hasSingleSecurityOriginEv
+__ZN7WebCore14RenderSVGImage5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderSVGImage25adjustRectsForAspectRatioERNS_9FloatRectES2_PNS_22SVGPreserveAspectRatioE
+-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]
+__ZN7WebCore4coreEP28NSURLAuthenticationChallenge
+__ZN7WebCore23AuthenticationChallengeC1EP28NSURLAuthenticationChallenge
+__ZN7WebCore23AuthenticationChallengeC2EP28NSURLAuthenticationChallenge
+__ZN7WebCore4coreEP15NSURLCredential
+__ZN7WebCore10CredentialC1ERKNS_6StringES3_NS_21CredentialPersistenceE
+__ZN7WebCore10CredentialC2ERKNS_6StringES3_NS_21CredentialPersistenceE
+__ZN7WebCore4coreEP20NSURLProtectionSpace
+__ZN7WebCore15ProtectionSpaceC1ERKNS_6StringEiNS_25ProtectionSpaceServerTypeES3_NS_35ProtectionSpaceAuthenticationSchemeE
+__ZN7WebCore15ProtectionSpaceC2ERKNS_6StringEiNS_25ProtectionSpaceServerTypeES3_NS_35ProtectionSpaceAuthenticationSchemeE
+__ZN7WebCore27AuthenticationChallengeBaseC2ERKNS_15ProtectionSpaceERKNS_10CredentialEjRKNS_16ResourceResponseERKNS_13ResourceEr
+__ZN7WebCore14ResourceHandle33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
+__ZN7WebCore14ResourceHandle18receivedCredentialERKNS_23AuthenticationChallengeERKNS_10CredentialE
+__ZN7WebCore27AuthenticationChallengeBase7compareERKNS_23AuthenticationChallengeES3_
+__ZNK7WebCore27AuthenticationChallengeBase6isNullEv
+__ZNK7WebCore27AuthenticationChallengeBase15protectionSpaceEv
+__ZN7WebCoreeqERKNS_15ProtectionSpaceES2_
+__ZNK7WebCore15ProtectionSpace4hostEv
+__ZNK7WebCore15ProtectionSpace4portEv
+__ZNK7WebCore15ProtectionSpace10serverTypeEv
+__ZNK7WebCore15ProtectionSpace5realmEv
+__ZNK7WebCore15ProtectionSpace20authenticationSchemeEv
+__ZNK7WebCore27AuthenticationChallengeBase18proposedCredentialEv
+__ZN7WebCoreeqERKNS_10CredentialES2_
+__ZNK7WebCore10Credential4userEv
+__ZNK7WebCore10Credential8passwordEv
+__ZNK7WebCore10Credential11persistenceEv
+__ZNK7WebCore27AuthenticationChallengeBase20previousFailureCountEv
+__ZNK7WebCore27AuthenticationChallengeBase15failureResponseEv
+__ZN7WebCore20ResourceResponseBase7compareERKNS_16ResourceResponseES3_
+__ZN3WTFeqIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEEEbRKNS_7HashMapIT_T0_T1_T2
+__ZN7WebCore16ResourceResponse15platformCompareERKS0_S2_
+__ZNK7WebCore27AuthenticationChallengeBase5errorEv
+__ZN7WebCore17ResourceErrorBase7compareERKNS_13ResourceErrorES3_
+__ZN7WebCore23AuthenticationChallenge15platformCompareERKS0_S2_
+__ZN7WebCore3macERKNS_10CredentialE
+__ZN7WebCore23AuthenticationChallengeD2Ev
+__ZN7WebCore33jsDOMWindowPrototypeFunctionPrintEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore28objectToStringFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSHistory14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore10JSLocation14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_33jsDOMWindowPrototypeFunctionFocusEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_32jsDOMWindowPrototypeFunctionBlurEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7J
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_33jsDOMWindowPrototypeFunctionCloseEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7
+__ZN7WebCore17jsDOMWindowWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16setJSNodeOnpasteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnpasteEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore15setJSNodeOndropEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOndropEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCoreL34nonCachingStaticBackFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL37nonCachingStaticForwardFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL32nonCachingStaticGoFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL36nonCachingStaticAssignFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL36nonCachingStaticReloadFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSDOMWindowShell12lookupSetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore11JSDOMWindow12lookupSetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore27setJSHTMLVideoElementPosterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLVideoElement9setPosterERKNS_6StringE
+__ZNK7WebCore16HTMLVideoElement24imageSourceAttributeNameEv
+__ZN7WebCore17HTMLSourceElement18scheduleErrorEventEv
+__ZN7WebCore5TimerINS_17HTMLSourceElementEE5firedEv
+__ZN7WebCore17HTMLSourceElement20errorEventTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore28jsHTMLMediaElementCurrentSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement10currentSrcEv
+__ZN7WebCore11FrameLoader35shouldInterruptLoadForXFrameOptionsERKNS_6StringERKNS_4KURLE
+__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZNK7WebCore15HTMLLinkElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore17HTMLScriptElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore40jsWorkerContextXMLHttpRequestConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15JSWorkerContext14xmlHttpRequestEPN3JSC9ExecStateE
+__ZNK7WebCore13WorkerContext18virtualCompleteURLERKNS_6StringE
+__ZNK7WebCore13WorkerContext11completeURLERKNS_6StringE
+__ZN7WebCore22WorkerThreadableLoader25loadResourceSynchronouslyEPNS_13WorkerContextERKNS_15ResourceRequestERNS_22ThreadableLoad
+__ZN7WebCore6String6numberEm
+__ZN7WebCore22WorkerThreadableLoaderC1EPNS_13WorkerContextEPNS_22ThreadableLoaderClientERKNS_6StringERKNS_15ResourceRequestENS_
+__ZN7WebCore22WorkerThreadableLoaderC2EPNS_13WorkerContextEPNS_22ThreadableLoaderClientERKNS_6StringERKNS_15ResourceRequestENS_
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridgeC1EN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEERNS_20WorkerMes
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridgeC2EN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEERNS_20WorkerMes
+__ZN7WebCore18createCallbackTaskIPNS_22WorkerThreadableLoader16MainThreadBridgeES3_NS_15ResourceRequestESt8auto_ptrINS_30CrossT
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_15ResourceRequestEE4copyERKS1_
+__ZNK7WebCore19ResourceRequestBase8copyDataEv
+__ZNK7WebCore13HTTPHeaderMap8copyDataEv
+__ZN7WebCore20WorkerMessagingProxy22postTaskToWorkerObjectEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore13WorkerRunLoop9runInModeEPNS_13WorkerContextERKNS_6StringE
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge22mainThreadCreateLoaderEPNS_22ScriptExecutionContextEPS1_St8auto_ptrINS_
+__ZN7WebCore19ResourceRequestBase5adoptESt8auto_ptrINS_30CrossThreadResourceRequestDataEE
+__ZN7WebCore13HTTPHeaderMap5adoptESt8auto_ptrIN3WTF6VectorISt4pairINS_6StringES5_ELm0EEEE
+__ZN7WebCore19ResourceRequestBase19setAllowHTTPCookiesEb
+__ZN7WebCore18GenericWorkerTask5IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_St8auto_ptrINS_30CrossThreadResourceRequestD
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EENS_16Reso
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_16ResourceResponseEE4copyERKS1_
+__ZNK7WebCore20ResourceResponseBase8copyDataEv
+__ZNK7WebCore20ResourceResponseBase16lastModifiedDateEv
+__ZN7WebCore20WorkerMessagingProxy30postTaskForModeToWorkerContextEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEERKNS_6S
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EESt8auto_ptrINS_31Cross
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge14didReceiveDataEPKci
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EESt8auto_p
+__ZN7WebCoreL31workerContextDidReceiveResponseEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEES
+__ZN7WebCore20ResourceResponseBase5adoptESt8auto_ptrINS_31CrossThreadResourceResponseDataEE
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge16didFinishLoadingEm
+__ZN7WebCore20ResourceResponseBase6setURLERKNS_4KURLE
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EEmmEENS1_1
+__ZN7WebCore20ResourceResponseBase11setMimeTypeERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase24setExpectedContentLengthEx
+__ZN7WebCore20ResourceResponseBase19setTextEncodingNameERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase20setSuggestedFilenameERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase17setHTTPStatusTextERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase17setExpirationDateEl
+__ZN7WebCore20ResourceResponseBase19setLastModifiedDateEl
+__ZN7WebCoreL27workerContextDidReceiveDataEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEESt8au
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EESt8auto_ptrINS1_6Vecto
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EEmmE11performTaskEPNS_2
+__ZN7WebCoreL29workerContextDidFinishLoadingEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEEm
+__ZN7WebCore13WorkerContext33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZN7WebCore13WorkerContext10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
+__ZThn8_N7WebCore20WorkerMessagingProxy32postConsoleMessageToWorkerObjectENS_18MessageDestinationENS_13MessageSourceENS_12Messa
+__ZN7WebCore20WorkerMessagingProxy32postConsoleMessageToWorkerObjectENS_18MessageDestinationENS_13MessageSourceENS_12MessageLev
+__ZN7WebCore18createCallbackTaskIPNS_20WorkerMessagingProxyES2_NS_18MessageDestinationES3_NS_13MessageSourceES4_NS_12MessageLev
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_6StringEE4copyERKS1_
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EEmmED0Ev
+__ZN7WebCore18GenericWorkerTask7IPNS_20WorkerMessagingProxyES2_NS_18MessageDestinationES3_NS_13MessageSourceES4_NS_12MessageLev
+__ZN7WebCoreL22postConsoleMessageTaskEPNS_22ScriptExecutionContextEPNS_20WorkerMessagingProxyENS_18MessageDestinationENS_13Mess
+__ZN7WebCore22WorkerThreadableLoaderD0Ev
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge7destroyEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge18clearClientWrapperEv
+__ZN7WebCore18createCallbackTaskIPNS_22WorkerThreadableLoader16MainThreadBridgeES3_EEN3WTF10PassRefPtrINS_22ScriptExecutionCont
+__ZN7WebCore18GenericWorkerTask1IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_E11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge17mainThreadDestroyEPNS_22ScriptExecutionContextEPS1_
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridgeD0Ev
+__ZN7WebCore18GenericWorkerTask1IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_ED0Ev
+__ZN7WebCore45jsWorkerContextPrototypeFunctionImportScriptsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext13importScriptsEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext13importScriptsERKN3WTF6VectorINS_6StringELm0EEERKS3_iRi
+__ZN7WebCore25WorkerImportScriptsClient18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore25WorkerImportScriptsClient14didReceiveDataEPKci
+__ZN7WebCore25WorkerImportScriptsClient16didFinishLoadingEm
+__ZN7WebCore13WorkerContext14scriptImportedEmRKNS_6StringE
+__ZN7WebCore50jsXMLHttpRequestExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore25JSXMLHttpRequestException9classInfoEv
+__ZN7WebCore22WorkerScriptController12setExceptionENS_11ScriptValueE
+__ZN7WebCore36jsXMLHttpRequestExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14XMLHttpRequest28makeCrossOriginAccessRequestERi
+__ZN7WebCore32isSimpleCrossOriginAccessRequestERKNS_6StringERKNS_13HTTPHeaderMapE
+__ZN7WebCore45isOnAccessControlSimpleRequestMethodWhitelistERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest34makeSimpleCrossOriginAccessRequestERi
+__ZN7WebCore24passesAccessControlCheckERKNS_16ResourceResponseEbPNS_14SecurityOriginE
+__ZN7WebCore14XMLHttpRequest41makeCrossOriginAccessRequestWithPreflightERi
+__ZN7WebCore31CrossOriginPreflightResultCache16canSkipPreflightERKNS_6StringERKNS_4KURLEbS3_RKNS_13HTTPHeaderMapE
+__ZN7WebCore14XMLHttpRequest27didReceiveResponsePreflightERKNS_16ResourceResponseE
+__ZN7WebCore35CrossOriginPreflightResultCacheItem5parseERKNS_16ResourceResponseE
+__ZN7WebCoreL27addToAccessControlAllowListINS_10StringHashEEEvRKNS_6StringEjjRN3WTF7HashSetIS2_T_NS5_10HashTraitsIS2_EEEE
+__ZNK7WebCore6String13substringCopyEjj
+__ZN7WebCore10StringImpl13substringCopyEjj
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E5clearEv
+__ZNK7WebCore6String12toUIntStrictEPbi
+__ZN7WebCore10StringImpl12toUIntStrictEPbi
+__ZN7WebCore22charactersToUIntStrictEPKtmPbi
+__ZNK7WebCore35CrossOriginPreflightResultCacheItem23allowsCrossOriginMethodERKNS_6StringE
+__ZNK7WebCore35CrossOriginPreflightResultCacheItem24allowsCrossOriginHeadersERKNS_13HTTPHeaderMapE
+__ZN7WebCore31CrossOriginPreflightResultCache11appendEntryERKNS_6StringERKNS_4KURLEPNS_35CrossOriginPreflightResultCacheItemE
+__ZN3WTF7HashMapISt4pairIN7WebCore6StringENS2_4KURLEEPNS2_35CrossOriginPreflightResultCacheItemENS_8PairHashIS3_S4_EENS_10HashT
+__ZN3WTF9HashTableISt4pairIN7WebCore6StringENS2_4KURLEES1_IS5_PNS2_35CrossOriginPreflightResultCacheItemEENS_18PairFirstExtract
+__ZN7WebCore14XMLHttpRequest25didFinishLoadingPreflightEv
+__ZN7WebCore14XMLHttpRequest33handleAsynchronousPreflightResultEv
+__ZNK7WebCore35CrossOriginPreflightResultCacheItem13allowsRequestEbRKNS_6StringERKNS_13HTTPHeaderMapE
+__ZN7WebCore45isOnAccessControlSimpleRequestHeaderWhitelistERKNS_6StringES2_
+__ZN7WebCoreL27addToAccessControlAllowListINS_15CaseFoldingHashEEEvRKNS_6StringEjjRN3WTF7HashSetIS2_T_NS5_10HashTraitsIS2_EEEE
+__ZN7WebCore32jsXMLHttpRequestExceptionMessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40isOnAccessControlResponseHeaderWhitelistERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest4openERKNS_6StringERKNS_4KURLEbS3_S3_Ri
+-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]
+__ZN7WebCoreL34newStreamingTextDecoderUserDefinedERKNS_12TextEncodingEPKv
+__ZN7WebCore20TextCodecUserDefined6decodeEPKcmbbRb
+__ZN7WebCore20TextCodecUserDefinedD0Ev
+__ZN7WebCore29jsXMLHttpRequestExceptionNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsXMLHttpRequestPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore29setJSXMLHttpRequestOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSXMLHttpRequestOnloadstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZThn16_N7WebCore24DocumentThreadableLoader15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResp
 __ZN7WebCore24DocumentThreadableLoader15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZThn16_N7WebCore14XMLHttpRequest20didFailRedirectCheckEv
+__ZN7WebCore14XMLHttpRequest20didFailRedirectCheckEv
+__ZN7WebCore22JSXMLHttpRequestUpload3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSXMLHttpRequestUploadOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore20XMLHttpRequestUpload22scriptExecutionContextEv
+__ZN7WebCore32setJSXMLHttpRequestUploadOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSXMLHttpRequestUploadOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSXMLHttpRequestUploadOnloadstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSXMLHttpRequestUploadOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL10formCreateEP14__CFReadStreamPv
+__ZN7WebCoreL20getStreamFormDataMapEv
+__ZN3WTF7HashMapIP14__CFReadStreamNS_6RefPtrIN7WebCore8FormDataEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3setERKS2_RK
+__ZN3WTF9HashTableIP14__CFReadStreamSt4pairIS2_NS_6RefPtrIN7WebCore8FormDataEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS2_EEN
+__ZN7WebCore18httpBodyFromStreamEP13NSInputStream
+__ZNK3WTF7HashMapIP14__CFReadStreamNS_6RefPtrIN7WebCore8FormDataEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3getERKS2_
+__ZN7WebCoreL12formScheduleEP14__CFReadStreamP11__CFRunLoopPK10__CFStringPv
+__ZN7WebCore12SchedulePairC1EP11__CFRunLoopPK10__CFString
+__ZN7WebCore12SchedulePairC2EP11__CFRunLoopPK10__CFString
+__ZN7WebCoreL8formOpenEP14__CFReadStreamP13CFStreamErrorPhPv
+__ZN7WebCoreL14openNextStreamEPNS_16FormStreamFieldsE
+__ZN7WebCoreL20advanceCurrentStreamEPNS_16FormStreamFieldsE
+__ZN7WebCoreL18closeCurrentStreamEPNS_16FormStreamFieldsE
+__ZN7WebCoreL17formEventCallbackEP14__CFReadStreammPv
+__ZN7WebCoreL8formReadEP14__CFReadStreamPhlP13CFStreamErrorS2_Pv
+__ZN7WebCoreL11formCanReadEP14__CFReadStreamPv
+__ZN7WebCoreL9formCloseEP14__CFReadStreamPv
+__ZN7WebCore20XMLHttpRequestUpload18dispatchErrorEventEv
+__ZN7WebCore20XMLHttpRequestUpload35dispatchXMLHttpRequestProgressEventEPNS_13EventListenerERKNS_12AtomicStringEbjj
+__ZN7WebCore20XMLHttpRequestUpload14refEventTargetEv
+__ZN7WebCore20XMLHttpRequestUpload22toXMLHttpRequestUploadEv
+__ZN7WebCore20XMLHttpRequestUpload16derefEventTargetEv
+__ZNK7WebCore20XMLHttpRequestUpload12hasListenersEv
+__ZN7WebCore20XMLHttpRequestUpload22dispatchLoadStartEventEv
+__ZN7WebCoreL12formFinalizeEP14__CFReadStreamPv
+__ZN7WebCore20XMLHttpRequestUpload21dispatchProgressEventExx
+__ZN7WebCore20XMLHttpRequestUpload17dispatchLoadEventEv
+__ZN7WebCore10toDocumentEN3JSC7JSValueE
+__ZN7WebCore14XMLHttpRequest4sendEPNS_8DocumentERi
+__ZN3WTF6VectorIN7WebCore6StringELm16EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore6StringELm16EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore6StringELm16EE15reserveCapacityEm
+__ZN7WebCore5TimerINS_14ResourceHandleEE5firedEv
+__ZN7WebCore14ResourceHandle11fireFailureEPNS_5TimerIS0_EE
+__ZN7WebCore14ResourceLoader10wasBlockedEPNS_14ResourceHandleE
+__ZN7WebCore14ResourceLoader12blockedErrorEv
+__ZNK7WebCore11FrameLoader12blockedErrorERKNS_15ResourceRequestE
+__ZNK7WebCore18JSSVGCircleElement9classInfoEv
+__ZN7WebCoreL12aConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore11SVGAElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore11SVGAElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11SVGAElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore11SVGAElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore15RenderSVGInlineC1EPNS_4NodeE
+__ZNK7WebCore11SVGAElement25childShouldCreateRendererEPNS_4NodeE
+__ZNK7WebCore10SVGElement13isTextContentEv
+__ZN7WebCore22JSSVGGElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL28createSVGImageElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGImageElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGImageElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGImageElementEEE
+__ZN7WebCore17JSSVGImageElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGImageElementEEE
+__ZN7WebCore17JSSVGImageElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsSVGImageElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_16heightA
+__ZN7WebCore22jsSVGImageElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_15widthAt
+__ZNK7WebCore14RenderSVGImage19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore15RenderSVGInlineD0Ev
+__ZN7WebCore14RenderSVGImageD0Ev
+__ZN7WebCore17JSSVGImageElementD1Ev
+__ZN7WebCore26JSSVGImageElementPrototypeD1Ev
+__ZN7WebCore11SVGAElementD0Ev
+__ZN7WebCore15SVGImageElementD0Ev
+__ZN7WebCore14SVGImageLoaderD1Ev
+__ZN7WebCore14SVGImageLoaderD2Ev
+__ZN7WebCore22WorkerThreadableLoader6cancelEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge6cancelEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge7didFailERKNS_13ResourceErrorE
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EENS_13Reso
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_13ResourceErrorEE4copyERKS1_
+__ZNK7WebCore17ResourceErrorBase4copyEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge16mainThreadCancelEPNS_22ScriptExecutionContextEPS1_
+__ZN7WebCore22WorkerThreadableLoader21derefThreadableLoaderEv
+__ZNK7WebCore8FormData8deepCopyEv
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EENS_13ResourceErrorERKS
+__ZN7WebCoreL20workerContextDidFailEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEERKNS_13Resou
+__ZN7WebCore13WorkerContext15reportExceptionERKNS_6StringEiS3_
+__ZThn8_N7WebCore20WorkerMessagingProxy27postExceptionToWorkerObjectERKNS_6StringEiS3_
+__ZN7WebCore20WorkerMessagingProxy27postExceptionToWorkerObjectERKNS_6StringEiS3_
+__ZN7WebCore19WorkerExceptionTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore19WorkerExceptionTaskD0Ev
+__ZN7WebCore14RenderReplaced13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore11RenderMedia10renderNameEv
+__ZN7WebCore29jsHTMLMediaElementCurrentTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLMediaElementErrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement5errorEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10MediaErrorE
+__ZN7WebCore12JSMediaErrorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MediaErrorEEE
+__ZN7WebCore12JSMediaErrorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MediaErrorEEE
+__ZN7WebCore12JSMediaError18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore12JSMediaError9classInfoEv
+__ZN7WebCore12JSMediaErrorD1Ev
+__ZN7WebCore12JSMediaErrorD2Ev
+__ZN7WebCore27jsHTMLMediaElementStartTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement9startTimeEv
+__ZNK7WebCore11MediaPlayer9startTimeEv
+__ZNK7WebCore27MediaPlayerPrivateInterface9startTimeEv
+__ZN7WebCore24jsHTMLMediaElementPausedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsMediaErrorCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLMediaElementAutoplayEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLMediaElementBufferedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement8bufferedEv
+__ZN7WebCore11MediaPlayer15maxTimeBufferedEv
+__ZNK7WebCore18MediaPlayerPrivate15maxTimeBufferedEv
+__ZN7WebCore46jsHTMLMediaElementPrototypeFunctionCanPlayTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16HTMLMediaElement11canPlayTypeERKNS_6StringE
+__ZN7WebCore13MediaDocumentC1EPNS_5FrameE
+__ZN7WebCore13MediaDocumentC2EPNS_5FrameE
+__ZN7WebCore13MediaDocument15createTokenizerEv
+__ZNK7WebCore14MediaTokenizer12wantsRawDataEv
+__ZN7WebCore14MediaTokenizer12writeRawDataEPKci
+__ZN7WebCore14MediaTokenizer23createDocumentStructureEv
+__ZNK7WebCore13MediaDocument15isMediaDocumentEv
+__ZN7WebCore14MediaTokenizer6finishEv
+__ZN7WebCore13MediaDocument19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore14MediaTokenizerD0Ev
+__ZN7WebCore14DocumentLoader22cancelMainResourceLoadERKNS_13ResourceErrorE
+__ZN7WebCore18MediaPlayerPrivate17createQTMovieViewEv
+__ZN7WebCore18MediaPlayerPrivate17detachQTMovieViewEv
+__ZL15initQTMovieViewv
+-[WebCoreMovieObserver setView:]
+__ZN7WebCore24MediaControlInputElement7hitTestERKNS_8IntPointE
+__ZN7WebCore14RenderThemeMac23hitTestMediaControlPartEPNS_12RenderObjectERKNS_8IntPointE
+__ZN7WebCore11RenderTheme23hitTestMediaControlPartEPNS_12RenderObjectERKNS_8IntPointE
+__ZN7WebCore13MediaDocumentD0Ev
+__ZN7WebCore26jsHTMLMediaElementControlsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29MediaControlPlayButtonElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore16HTMLMediaElement15togglePlayStateEv
+__ZThn8_N7WebCore29MediaControlPlayButtonElementD0Ev
+__ZN7WebCore11RenderVideo20intrinsicSizeChangedEv
+__ZN7WebCore29setJSHTMLMediaElementControlsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement11setControlsEb
+__ZN7WebCore7Element19setBooleanAttributeERKNS_13QualifiedNameEb
+__ZN7WebCore40jsHTMLMediaElementPrototypeFunctionPauseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore28jsHTMLMediaElementAutobufferEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement10autobufferEv
+__ZN7WebCore31setJSHTMLMediaElementAutobufferEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement13setAutobufferEb
+__ZN7WebCore29setJSHTMLMediaElementAutoplayEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement11setAutoplayEb
+__ZN7WebCore22jsHTMLMediaElementLoopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25setJSHTMLMediaElementLoopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement7setLoopEb
+__ZN7WebCore23jsHTMLMediaElementEndedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLMediaElementMutedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26setJSHTMLMediaElementMutedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement8setMutedEb
+__ZN7WebCore18MediaPlayerPrivate9setVolumeEf
+__ZN7WebCore24jsHTMLMediaElementPlayedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement6playedEv
+__ZN7WebCore10TimeRanges4copyEv
+__ZN7WebCore24jsHTMLVideoElementPosterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLMediaElementSeekingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement7seekingEv
+__ZN7WebCore28jsHTMLVideoElementVideoWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement10videoWidthEv
+__ZN7WebCore29jsHTMLVideoElementVideoHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement11videoHeightEv
+__ZNK7WebCore17HTMLSourceElement5mediaEv
+__ZN7WebCore22jsHTMLSourceElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore22NullMediaPlayerPrivate8durationEv
+__ZN7WebCore24jsHTMLMediaElementVolumeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZN7WebCore27setJSHTMLMediaElementVolumeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement9setVolumeEfRi
+__ZN7WebCore23jsHTMLVideoElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement5widthEv
+__ZNK7WebCore6String6toUIntEPb
+__ZN7WebCore10StringImpl6toUIntEPb
+__ZN7WebCore16charactersToUIntEPKtmPb
+__ZN7WebCore24jsHTMLVideoElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement6heightEv
+__ZN7WebCore26setJSHTMLVideoElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLVideoElement8setWidthEj
+__ZN7WebCore27setJSHTMLVideoElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLVideoElement9setHeightEj
+__ZNK7WebCore25AccessibilityRenderObject13valueForRangeEv
+__ZNK7WebCore25AccessibilityRenderObject16minValueForRangeEv
+__ZNK7WebCore25AccessibilityRenderObject16maxValueForRangeEv
+__ZNK7WebCore25AccessibilityRenderObject16activeDescendantEv
+-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]
+__ZNK7WebCore25AccessibilityRenderObject13isMenuRelatedEv
+__ZNK7WebCore25AccessibilityRenderObject29boundsForVisiblePositionRangeERKNS_20VisiblePositionRangeE
+__ZNK7WebCore10ScrollView16contentsToScreenERKNS_7IntRectE
+__ZNK7WebCore10ScrollView24platformContentsToScreenERKNS_7IntRectE
+__ZN7WebCore9makeRangeERKNS_15VisiblePositionES2_
+__ZN7WebCore5Range11boundingBoxEv
+-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]
+__ZNK7WebCore25AccessibilityRenderObject20canSetValueAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject10isReadOnlyEv
+__ZNK7WebCore25AccessibilityRenderObject30accessibilityParentForImageMapEPNS_14HTMLMapElementE
+-[AccessibilityObjectWrapper accessibilityHitTest:]
+__ZNK7WebCore25AccessibilityRenderObject22doAccessibilityHitTestERKNS_8IntPointE
+__ZNK7WebCore25AccessibilityRenderObject28accessibilityImageMapHitTestEPNS_15HTMLAreaElementERKNS_8IntPointE
+__ZNK7WebCore25AccessibilityImageMapLink22accessibilityIsIgnoredEv
+__ZN7WebCoreL16styleConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGStyleElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGStyleElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGStyleElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SVGStyleElement20insertedIntoDocumentEv
+__ZN7WebCore15SVGStyleElement15childrenChangedEbPNS_4NodeES2_i
+__ZThn184_NK7WebCore15SVGStyleElement4typeEv
+__ZNK7WebCore15SVGStyleElement4typeEv
+__ZThn184_NK7WebCore15SVGStyleElement5mediaEv
+__ZNK7WebCore15SVGStyleElement5mediaEv
+__ZN7WebCore12StyleElement10setLoadingEb
+__ZNK7WebCore15SVGStyleElement5titleEv
+__ZN7WebCore15SVGStyleElement11sheetLoadedEv
+__ZN7WebCore15SVGStyleElement5sheetEv
+__ZN7WebCore15SVGStyleElement21finishParsingChildrenEv
+__ZN7WebCore19SVGAnimatedPropertyINS_16SVGStyledElementENS_6StringEXadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLNames1
+__ZN7WebCore6Editor14setCompositionERKNS_6StringERKN3WTF6VectorINS_20CompositionUnderlineELm0EEEjj
+__ZN7WebCore6Editor35setIgnoreCompositionSelectionChangeEb
+__ZN7WebCore6Editor17selectCompositionEv
+__ZNK7WebCore6Editor16compositionRangeEv
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EEaSERKS3_
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EE15reserveCapacityEm
+__ZN7WebCore19SelectionController16setSelectedRangeEPNS_5RangeENS_9EAffinityEb
+__ZN7WebCore13TypingCommand15deleteSelectionEPNS_8DocumentEb
+__ZN7WebCore13TypingCommand15deleteSelectionEb
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EE6shrinkEm
+__ZN3JSC12RuntimeArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZNK3JSC12RuntimeArray9classInfoEv
+__ZN3JSC12RuntimeArray12lengthGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN7WebCore15SVGStyleElementD0Ev
+__ZN7WebCore13InlineTextBox26paintCompositionBackgroundEPNS_15GraphicsContextEiiPNS_11RenderStyleERKNS_4FontEii
+__ZNK7WebCore6Editor23getCompositionSelectionERjS1_
+__ZN7WebCore6Editor44confirmCompositionWithoutDisturbingSelectionEv
+__ZN7WebCore6Editor18confirmCompositionERKNS_6StringEb
+-[WebScriptObject evaluateWebScript:]
+__ZN7WebCore6Editor18confirmCompositionERKNS_6StringE
+__ZN7WebCore6Editor13performDeleteEv
+__ZN7WebCore6Editor18confirmCompositionEv
+__ZN7WebCoreL26skipCommaInDashboardRegionEPNS_18CSSParserValueListE
+__Z3kitPN7WebCore5EventE
+__Z8kitClassPN7WebCore5EventE
+-[DOMEvent dealloc]
+__ZN7WebCore19implementationFrontEPNS_19JSDOMImplementationE
+__Z3kitPN7WebCore22DOMImplementationFrontE
+__ZN7WebCore22DOMImplementationFront3refEv
+-[DOMImplementation dealloc]
+__ZN7WebCore22DOMImplementationFront5derefEv
+__Z3kitPN7WebCore10TreeWalkerE
+-[DOMTreeWalker dealloc]
+__Z3kitPN7WebCore4RectE
+-[DOMRect dealloc]
+__Z3kitPN7WebCore7CounterE
+-[DOMCounter dealloc]
+__Z3kitPN7WebCore9MediaListE
+-[DOMMediaList dealloc]
+-[DOMXPathExpression dealloc]
+-[DOMXPathResult dealloc]
+-[DOMHTMLOptionsCollection dealloc]
+-[WebScriptObject removeWebScriptKey:]
+-[WebScriptObject setWebScriptValueAtIndex:value:]
+-[WebScriptObject stringRepresentation]
+-[DOMNode addEventListener:listener:useCapture:]
+__ZN7WebCore17ObjCEventListener4wrapEP11objc_object
+__ZN7WebCore17ObjCEventListener4findEP11objc_object
+__ZN7WebCore17ObjCEventListenerC1EP11objc_object
+__ZN7WebCore17ObjCEventListenerC2EP11objc_object
+__ZN3WTF7HashMapIP11objc_objectPN7WebCore17ObjCEventListenerENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3setERKS2_RKS5_
+__ZNK3WTF7HashMapIP11objc_objectPN7WebCore17ObjCEventListenerENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3getERKS2_
+__ZN7WebCore17ObjCEventListener11handleEventEPNS_5EventEb
+-[DOMEvent target]
+__Z3kitPN7WebCore11EventTargetE
+-[DOMEvent type]
+-[DOMEvent eventPhase]
+-[DOMEvent bubbles]
+-[DOMEvent cancelable]
+-[DOMUIEvent detail]
+-[DOMUIEvent view]
+-[DOMAbstractView document]
+-[DOMMouseEvent button]
+-[DOMMouseEvent clientX]
+-[DOMMouseEvent clientY]
+-[DOMMouseEvent screenX]
+-[DOMMouseEvent screenY]
+-[DOMMouseEvent metaKey]
+-[DOMMouseEvent altKey]
+-[DOMMouseEvent shiftKey]
+-[DOMMouseEvent ctrlKey]
+-[DOMMouseEvent relatedTarget]
+-[DOMKeyboardEvent keyIdentifier]
+-[DOMKeyboardEvent keyLocation]
+-[DOMKeyboardEvent metaKey]
+-[DOMKeyboardEvent altKey]
+-[DOMKeyboardEvent shiftKey]
+-[DOMKeyboardEvent ctrlKey]
+-[DOMKeyboardEvent keyCode]
+-[DOMKeyboardEvent charCode]
+__ZN7WebCore17ObjCEventListenerD0Ev
+__ZN3WTF9HashTableIP11objc_objectSt4pairIS2_PN7WebCore17ObjCEventListenerEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS2_EENS_14P
+-[DOMDocument createEvent:]
+-[DOMDocument defaultView]
+-[DOMKeyboardEvent initKeyboardEvent:canBubble:cancelable:view:keyIdentifier:keyLocation:ctrlKey:altKey:shiftKey:metaKey:]
+__Z4coreP15DOMAbstractView
+-[DOMNode dispatchEvent:]
+__Z4coreP8DOMEvent
++[WebScriptObject throwException:]
+__ZN3JSC8Bindings10throwErrorEPNS_9ExecStateENS_9ErrorTypeEP8NSString
+__ZN7WebCoreL10callPluginEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN3JSC13RuntimeMethod18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC16RuntimeObjectImp11fieldGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN7WebCore13IdentifierRep3getEi
+__ZN7WebCoreL16intIdentifierMapEv
+__ZN3WTF7HashMapIiPN7WebCore13IdentifierRepENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3addERKiRKS3_
+__ZN3JSC16RuntimeObjectImp16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL22callRuntimeConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC16RuntimeObjectImp23throwInvalidAccessErrorEPNS_9ExecStateE
+__ZN3JSC16RuntimeObjectImp16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN7WebCore16jsPluginFilenameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin8filenameEv
+__ZN7WebCore14jsPluginLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin6lengthEv
+__ZN7WebCore8JSPlugin18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore8JSPlugin11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore6Plugin4itemEj
+__ZN7WebCore21jsMimeTypeDescriptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType11descriptionEv
+__ZN7WebCore18jsMimeTypeSuffixesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType8suffixesEv
+__ZN7WebCore8JSPlugin18canGetItemsForNameEPN3JSC9ExecStateEPNS_6PluginERKNS1_10IdentifierE
+__ZN7WebCore6Plugin18canGetItemsForNameERKNS_12AtomicStringE
+__ZN7WebCore29jsPluginPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore8JSPlugin9classInfoEv
+__ZN7WebCore34jsPluginPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6Plugin9namedItemERKNS_12AtomicStringE
+__ZN7WebCore34jsPluginArrayPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore39jsPluginArrayPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore36jsMimeTypeArrayPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSMimeTypeArray9classInfoEv
+__ZN7WebCore41jsMimeTypeArrayPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14PluginDocumentC1EPNS_5FrameE
+__ZN7WebCore14PluginDocumentC2EPNS_5FrameE
+__ZN7WebCore14PluginDocument15createTokenizerEv
+__ZNK7WebCore15PluginTokenizer12wantsRawDataEv
+__ZN7WebCore15PluginTokenizer12writeRawDataEPKci
+__ZN7WebCore15PluginTokenizer23createDocumentStructureEv
+__ZNK7WebCore14PluginDocument16isPluginDocumentEv
+__ZN7WebCore15PluginTokenizer6finishEv
+__ZN7WebCore15PluginTokenizerD0Ev
+__ZN7WebCore14PluginDocumentD0Ev
+-[DOMNode(WebCoreInternal) _rootObject]
+-[WebScriptObject setException:]
+__ZN3JSC8Bindings9ObjcClass14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
+__ZN3JSC8Bindings21ObjcFallbackObjectImpC1EPNS_9ExecStateEPNS0_12ObjcInstanceERKNS_10IdentifierE
+__ZN3JSC8Bindings21ObjcFallbackObjectImpC2EPNS_9ExecStateEPNS0_12ObjcInstanceERKNS_10IdentifierE
+__ZN3JSC16RuntimeObjectImp20fallbackObjectGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC8Bindings21ObjcFallbackObjectImp9toBooleanEPNS_9ExecStateE
+__ZN3JSC8Bindings21ObjcFallbackObjectImpD1Ev
+__ZN7WebCore19RenderScrollbarPart22computeScrollbarHeightEv
+__ZN7WebCore15RenderScrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore23ScrollbarThemeComposite5paintEPNS_9ScrollbarEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme8hasThumbEPNS_9ScrollbarE
+__ZN7WebCore20RenderScrollbarTheme24paintScrollbarBackgroundEPNS_15GraphicsContextEPNS_9ScrollbarE
+__ZN7WebCore15RenderScrollbar9paintPartEPNS_15GraphicsContextENS_13ScrollbarPartERKNS_7IntRectE
+__ZN7WebCore19RenderScrollbarPart13paintIntoRectEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme11paintButtonEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectENS_13ScrollbarPartE
+__ZN7WebCore20RenderScrollbarTheme20paintTrackBackgroundEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme15paintTrackPieceEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectENS_13ScrollbarPartE
+__ZN7WebCore23ScrollbarThemeComposite14paintTickmarksEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme10paintThumbEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker25checkScrollbarPseudoClassEPNS_11CSSSelectorERNS_8PseudoIdE
+__ZN7WebCore15RenderScrollbar19partForStyleResolveEv
+__ZN7WebCore19RenderScrollbarPart20layoutHorizontalPartEv
+__ZThn200_NK7WebCore13RenderListBox22scrollbarCornerPresentEv
+__ZNK7WebCore13RenderListBox22scrollbarCornerPresentEv
+__ZN7WebCore19RenderScrollbarPart12imageChangedEPvPKNS_7IntRectE
+__ZNK7WebCore11RenderLayer22scrollbarCornerPresentEv
+__ZNK7WebCore9FillLayer13hasFixedImageEv
+__ZN7WebCore33jsStoragePrototypeFunctionSetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Storage7setItemERKNS_6StringES3_Ri
+__ZN7WebCore11StorageArea7setItemERKNS_6StringES3_RiPNS_5FrameE
+__ZN7WebCore11StorageArea15internalSetItemERKNS_6StringES3_RiPNS_5FrameE
+__ZN7WebCore10StorageMap7setItemERKNS_6StringES3_RS1_
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3addERKS2_S8_
+__ZN7WebCore10StorageMap18invalidateIteratorEv
+__ZN7WebCore18SessionStorageArea11itemChangedERKNS_6StringES3_S3_PNS_5FrameE
+__ZN7WebCore18SessionStorageArea20dispatchStorageEventERKNS_6StringES3_S3_PNS_5FrameE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE15reserveCapacityEm
+__ZN7WebCore4Node20dispatchStorageEventERKNS_12AtomicStringERKNS_6StringES6_S6_PNS_5FrameE
+__ZN7WebCore12StorageEventC1ERKNS_12AtomicStringERKNS_6StringES6_S6_S6_N3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore12StorageEventC2ERKNS_12AtomicStringERKNS_6StringES6_S6_S6_N3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE6shrinkEm
+__ZN7WebCore9JSStorage10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore7Storage7getItemERKNS_6StringE
+__ZNK7WebCore11StorageArea7getItemERKNS_6StringE
+__ZNK7WebCore11StorageArea15internalGetItemERKNS_6StringE
+__ZNK7WebCore10StorageMap7getItemERKNS_6StringE
+__ZN7WebCore36jsStoragePrototypeFunctionRemoveItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Storage10removeItemERKNS_6StringE
+__ZN7WebCore11StorageArea10removeItemERKNS_6StringEPNS_5FrameE
+__ZN7WebCore11StorageArea18internalRemoveItemERKNS_6StringEPNS_5FrameE
+__ZN7WebCore10StorageMap10removeItemERKNS_6StringERS1_
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E4takeERKS2_
+__ZN7WebCore18SessionStorageArea11itemRemovedERKNS_6StringES3_PNS_5FrameE
+__ZN7WebCore14SecurityOrigin28createFromDatabaseIdentifierERKNS_6StringE
+__ZNK7WebCore15SQLiteStatement18bindParameterCountEv
+__ZN7WebCore12SQLResultSetC1Ev
+__ZN7WebCore12SQLResultSetC2Ev
+__ZN7WebCore12SQLResultSet11setInsertIdEx
+__ZN7WebCore14SQLiteDatabase11lastChangesEv
+__ZN7WebCore12SQLResultSet15setRowsAffectedEi
+__ZN7WebCore18OriginQuotaManager12markDatabaseEPNS_8DatabaseE
+__ZN7WebCore17OriginUsageRecord12markDatabaseERKNS_6StringE
+__ZN7WebCore28JSCustomSQLStatementCallback11handleEventEPNS_14SQLTransactionEPNS_12SQLResultSetERb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SQLResultSetE
+__ZN7WebCore14JSSQLResultSet15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSQLResultSetC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SQLResultSetEEE
+__ZN7WebCore14JSSQLResultSetC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SQLResultSetEEE
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE15reserveCapacityEm
+__ZN7WebCore8SQLValueC1ERKS0_
+__ZN7WebCore8SQLValueC2ERKS0_
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE6shrinkEm
+__ZN7WebCore15SQLiteStatement9bindValueEiRKNS_8SQLValueE
+__ZNK7WebCore8SQLValue6numberEv
+__ZN7WebCore15SQLiteStatement10bindDoubleEid
+__ZNK7WebCore8SQLValue6stringEv
+__ZN7WebCore14SQLTransaction19postflightAndCommitEv
+__ZN7WebCore15DatabaseTracker29scheduleNotifyDatabaseChangedEPNS_14SecurityOriginERKNS_6StringE
+__ZN7WebCoreL17notificationMutexEv
+__ZN7WebCoreL17notificationQueueEv
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE15reserveCapacityEm
+__ZN7WebCore15DatabaseTracker23scheduleForNotificationEv
+__ZN7WebCore15DatabaseTracker22notifyDatabasesChangedEPv
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE6shrinkEm
+__ZN7WebCore14SQLTransaction27cleanupAfterSuccessCallbackEv
+__ZNK7WebCore12SQLResultSet4rowsEv
+__ZN7WebCore15SQLiteStatement13getColumnNameEi
+__ZN7WebCore15SQLiteStatement14getColumnValueEi
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE14expandCapacityEmPKS2_
+__ZN7WebCore17SQLiteTransaction4stopEv
+__ZN7WebCore14JSSQLResultSetD1Ev
+__ZN7WebCore14JSSQLResultSetD2Ev
+__ZN7WebCore23JSSQLResultSetPrototypeD1Ev
+__ZN7WebCore35JSCustomSQLTransactionErrorCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore35JSCustomSQLTransactionErrorCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore14toVoidCallbackEPN3JSC9ExecStateENS0_7JSValueE
+__ZN7WebCore20JSCustomVoidCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore20JSCustomVoidCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore35JSCustomSQLTransactionErrorCallbackD0Ev
+__ZN7WebCore14SQLTransaction22deliverSuccessCallbackEv
+__ZN7WebCore20JSCustomVoidCallback11handleEventEv
+__ZN7WebCore20JSCustomVoidCallbackD0Ev
+__ZN7WebCore8Database21setAuthorizerReadOnlyEv
+__ZN7WebCore18DatabaseAuthorizer11setReadOnlyEv
+__ZN7WebCore10JSSQLError18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17jsSQLErrorMessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18DatabaseAuthorizer11allowDeleteERKNS_6StringE
+__ZN7WebCore15DatabaseTracker18deleteAllDatabasesEv
+__ZN7WebCore15DatabaseTracker7originsERN3WTF6VectorINS1_6RefPtrINS_14SecurityOriginEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE15reserveCapacityEm
+__ZN7WebCore15DatabaseTracker12deleteOriginEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker18deleteDatabaseFileEPNS_14SecurityOriginERKNS_6StringE
+__ZN7WebCore10deleteFileERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE15reserveCapacityEm
+__ZN7WebCore8Database21markAsDeletedAndCloseEv
+__ZNK7WebCore14DatabaseThread20terminationRequestedEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE6shrinkEm
+__ZN7WebCore20deleteEmptyDirectoryERKNS_6StringE
+__ZN7WebCore18OriginQuotaManager12removeOriginEPNS_14SecurityOriginE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE6shrinkEm
+__ZN7WebCore18DatabaseAuthorizer13allowFunctionERKNS_6StringE
+__ZN7WebCore12SQLStatement20setFailureDueToQuotaEv
+__ZN7WebCore14SQLTransaction28deliverQuotaIncreaseCallbackEv
+__ZN7WebCore14JSSQLResultSet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsSQLResultSetRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SQLResultSetRowListE
+__ZN7WebCore21JSSQLResultSetRowList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSQLResultSetRowListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SQLResultSetRowListEEE
+__ZN7WebCore21JSSQLResultSetRowListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SQLResultSetRowListEEE
+__ZN7WebCore21JSSQLResultSetRowList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSSQLResultSetRowListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsSQLResultSetRowListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore21JSSQLResultSetRowList9classInfoEv
+__ZN7WebCore21JSSQLResultSetRowList4itemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore19SQLResultSetRowList6lengthEv
+__ZN7WebCore18DatabaseAuthorizer9dropTableERKNS_6StringE
+__ZN7WebCore21JSSQLResultSetRowListD1Ev
+__ZN7WebCore21JSSQLResultSetRowListD2Ev
+__ZN7WebCore30JSSQLResultSetRowListPrototypeD1Ev
+__ZN7WebCore9JSStorage16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore9JSStorage22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore7Storage6lengthEv
+__ZNK7WebCore16LocalStorageArea6lengthEv
+__ZNK7WebCore11StorageArea14internalLengthEv
+__ZNK7WebCore10StorageMap6lengthEv
+__ZN7WebCore15jsStorageLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsStoragePrototypeFunctionClearEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Storage5clearEv
+__ZN7WebCore11StorageArea5clearEPNS_5FrameE
+__ZN7WebCore11StorageArea13internalClearEPNS_5FrameE
+__ZN7WebCore16LocalStorageArea11areaClearedEPNS_5FrameE
+__ZN7WebCore16LocalStorageArea13scheduleClearEv
+__ZN7WebCore16LocalStorageArea20dispatchStorageEventERKNS_6StringES3_S3_PNS_5FrameE
+__ZN7WebCore9JSStorage3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSStorage9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore16LocalStorageArea7setItemERKNS_6StringES3_RiPNS_5FrameE
+__ZN7WebCore16LocalStorageArea11itemChangedERKNS_6StringES3_S3_PNS_5FrameE
+__ZN7WebCore16LocalStorageArea19scheduleItemForSyncERKNS_6StringES3_
+__ZNK7WebCore16LocalStorageArea7getItemERKNS_6StringE
+__ZN7WebCore9JSStorage14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore16LocalStorageArea10removeItemERKNS_6StringEPNS_5FrameE
+__ZN7WebCore16LocalStorageArea11itemRemovedERKNS_6StringES3_PNS_5FrameE
+__ZN7WebCore5TimerINS_16LocalStorageAreaEE5firedEv
+__ZN7WebCore16LocalStorageArea14syncTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore12LocalStorage12scheduleSyncEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZNK7WebCore7Storage3keyEjRi
+__ZNK7WebCore16LocalStorageArea3keyEjRi
+__ZNK7WebCore11StorageArea11internalKeyEjRi
+__ZNK7WebCore10StorageMap3keyEjRNS_6StringE
+__ZNK7WebCore10StorageMap18setIteratorToIndexEj
+__ZN7WebCore33jsStoragePrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore29jsStoragePrototypeFunctionKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11StorageArea6lengthEv
+__ZN7WebCore18SessionStorageArea11areaClearedEPNS_5FrameE
+__ZNK7WebCore11StorageArea3keyEjRi
+__ZN7WebCore10StorageMap4copyEv
+__ZN7WebCoremlERKNS_8SMILTimeES2_
+__ZNK7WebCore14SVGSMILElement8isFrozenEv
+__ZSt25__unguarded_linear_insertIPPN7WebCore14SVGSMILElementES2_NS0_15PriorityCompareEEvT_T0_T1_
+__ZNK7WebCore19SVGAnimationElement9fromValueEv
+__ZN7WebCoreL22applyOrderSortFunctionEPNS_14SVGSMILElementES1_
+__ZSt25__unguarded_linear_insertIPPN7WebCore14SVGSMILElementES2_PFbS2_S2_EEvT_T0_T1_
+__ZNK7WebCore10SVGElement8isStyledEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_13RenderSVGRootEi
+__ZN7WebCoreL19writeStandardPrefixERNS_10TextStreamERKNS_12RenderObjectEi
+__ZNK7WebCore13RenderSVGRoot10renderNameEv
+__ZN7WebCoreL21writePositionAndStyleERNS_10TextStreamERKNS_12RenderObjectE
+__ZNK7WebCore13RenderSVGRoot17absoluteTransformEv
+__ZNK7WebCore12RenderObject17absoluteTransformEv
+__ZNK7WebCore9RenderBox14localTransformEv
+__ZNK7WebCore13RenderSVGRoot14localTransformEv
+__ZN7WebCorelsERNS_10TextStreamERKNS_9FloatRectE
+__ZN7WebCoreL12hasFractionsEd
+__ZN7WebCoreL17writeIfNotDefaultIfEEvRNS_10TextStreamEPKcT_S5_
+__ZN7WebCoreL15writeIfNotEmptyERNS_10TextStreamEPKcRKNS_6StringE
+__ZN7WebCoreL13writeChildrenERNS_10TextStreamERKNS_12RenderObjectEi
+__ZNK7WebCore18RenderSVGContainer14isSVGContainerEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_18RenderSVGContainerEi
+__ZNK7WebCore18RenderSVGContainer10renderNameEv
+__ZNK7WebCore31RenderSVGTransformableContainer14localTransformEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_10RenderPathEi
+__ZNK7WebCore10RenderPath10renderNameEv
+__ZNK7WebCore10RenderPath14localTransformEv
+__ZN7WebCorelsERNS_10TextStreamERNS_19TextStreamSeparatorE
+__ZN7WebCorelsERNS_10TextStreamERKNS_14SVGPaintServerE
+__ZNK7WebCore19SVGPaintServerSolid22externalRepresentationERNS_10TextStreamE
+__ZN7WebCorelsERNS_10TextStreamERKNS_5ColorE
+__ZN7WebCoreL17writeIfNotDefaultIdEEvRNS_10TextStreamEPKcT_S5_
+__ZN7WebCore10TextStreamlsEd
+__ZNK7WebCore10RenderPath4pathEv
+__ZNK7WebCore4Path11debugStringEv
+__ZN7WebCoreL31CGPathToCFStringApplierFunctionEPvPK13CGPathElement
+__ZN7WebCoreL23writeNameAndQuotedValueINS_6StringEEEvRNS_10TextStreamEPKcT_
+__ZN7WebCore5writeERNS_10TextStreamERKNS_13RenderSVGTextEi
+__ZNK7WebCore13RenderSVGText10renderNameEv
+__ZN7WebCore10TextStreamlsEm
+__ZN7WebCore5writeERNS_10TextStreamERKNS_19RenderSVGInlineTextEi
+__ZNK7WebCore19RenderSVGInlineText10renderNameEv
+__ZNK7WebCore10RenderText14firstRunOriginEv
+__ZNK7WebCore16SVGInlineTextBox16svgRootInlineBoxEv
+__ZN7WebCore10TextStreamlsEj
+__ZN7WebCorelsERNS_10TextStreamERKNS_20TransformationMatrixE
+__ZN7WebCore11PathBuilder15svgCurveToCubicEddddddb
+__ZN7WebCore13ColorDistanceC1ERKNS_5ColorES3_
+__ZN7WebCore13ColorDistanceC2ERKNS_5ColorES3_
+__ZNK7WebCore13ColorDistance14scaledDistanceEf
+__ZN7WebCore13ColorDistanceC1Eiii
+__ZN7WebCore13ColorDistanceC2Eiii
+__ZNK7WebCore13ColorDistance18addToColorAndClampERKNS_5ColorE
+__ZN7WebCore16SVGStyledElement5styleEv
+__ZNK7WebCore4Font20drawTextUsingSVGFontEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZN7WebCore16SVGTextRunWalkerINS_28SVGTextRunWalkerDrawTextDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
+__ZN7WebCoreL28drawTextUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_28SVGTextRunWalkerDrawTextDataE
+__ZNK7WebCore24RenderSVGHiddenContainer14isSVGContainerEv
+__ZNK7WebCore24RenderSVGHiddenContainer10renderNameEv
+__ZNK7WebCore24RenderSVGHiddenContainer17absoluteTransformEv
+__ZN7WebCoreL24animatemotionConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore23SVGAnimateMotionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23SVGAnimateMotionElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23SVGAnimateMotionElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore23SVGAnimateMotionElement16resetToBaseValueERKNS_6StringE
+__ZNK7WebCore23SVGAnimateMotionElement14hasValidTargetEv
+__ZNK7WebCore29SVGStyledTransformableElement21isStyledTransformableEv
+__ZN7WebCore29SVGStyledTransformableElement21supplementalTransformEv
+__ZNK7WebCore23SVGAnimateMotionElement13animationPathEv
+__ZN7WebCore23SVGAnimateMotionElement24calculateFromAndToValuesERKNS_6StringES3_
+__ZN7WebCoreL10parsePointERKNS_6StringERNS_10FloatPointE
+__ZN7WebCore23SVGAnimateMotionElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
+__ZN7WebCore23SVGAnimateMotionElement20applyResultsToTargetEv
+__ZN7WebCore23SVGAnimateMotionElementD0Ev
+__ZN7WebCore18PathTraversalState13cubicBezierToERKNS_10FloatPointES3_S3_
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE6shrinkEm
+__ZNK7WebCore23SVGAnimateMotionElement10rotateModeEv
+__ZN7WebCoreL16mpathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGMPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGMPathElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGMPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn184_NK7WebCore15SVGMPathElement14contextElementEv
+__ZNK7WebCore15SVGMPathElement14contextElementEv
+__ZN7WebCore15SVGMPathElement11pathElementEv
+__ZN7WebCore15SVGMPathElementD0Ev
+__ZN7WebCore19SVGAnimationElement33calculateKeyTimesForCalcModePacedEv
+__ZN7WebCore17SVGAnimateElement17calculateDistanceERKNS_6StringES3_
+__ZN7WebCore23SVGAnimateMotionElement17calculateDistanceERKNS_6StringES3_
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE15reserveCapacityEm
+__ZNK7WebCore19SVGAnimationElement25calculatePercentForSplineEfj
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE6shrinkEm
+__ZThn304_NK7WebCore11SVGAElement14contextElementEv
+__ZNK7WebCore11SVGAElement14contextElementEv
+__ZNK7WebCore11SVGAElement7isValidEv
+__ZN7WebCore14SVGSMILElement14parseConditionERKNS_6StringENS0_10BeginOrEndE
+__ZN7WebCore14SVGSMILElement9ConditionC1ENS1_4TypeENS0_10BeginOrEndERKNS_6StringES6_NS_8SMILTimeEi
+__ZN7WebCore14SVGSMILElement9ConditionC2ENS1_4TypeENS0_10BeginOrEndERKNS_6StringES6_NS_8SMILTimeEi
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE15reserveCapacityEm
+__ZN7WebCore14SVGSMILElement16addTimeDependentEPS0_
+__ZN7WebCore14SVGSMILElement19removedFromDocumentEv
+__ZN7WebCore14SVGSMILElement19removeTimeDependentEPS0_
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE6shrinkEm
+__ZThn8_N7WebCore17SVGAnimateElementD0Ev
+__ZN7WebCoreL23animatecolorConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore22SVGAnimateColorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore22SVGAnimateColorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL27animatetransformConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore26SVGAnimateTransformElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore26SVGAnimateTransformElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore26SVGAnimateTransformElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore10SVGElement21isStyledTransformableEv
+__ZN7WebCore14SVGTextElement21supplementalTransformEv
+__ZN7WebCore26SVGAnimateTransformElement16resetToBaseValueERKNS_6StringE
+__ZNK7WebCore26SVGAnimateTransformElement14hasValidTargetEv
+__ZN7WebCore25SVGTextPositioningElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore21SVGTextContentElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore26SVGAnimateTransformElement20applyResultsToTargetEv
+__ZN7WebCoreL16transformListForEPNS_10SVGElementE
+__ZN7WebCore22SVGAnimateColorElementD0Ev
+__ZN7WebCore26SVGAnimateTransformElementD0Ev
+__ZN7WebCoreL19polylineConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGPolylineElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGPolyElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGAnimatedPointsC2Ev
+__ZN7WebCore14SVGPolyElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore14SVGPolyElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14SVGPolyElement6pointsEv
+__ZN7WebCore12SVGPointListC1ERKNS_13QualifiedNameE
+__ZN7WebCore12SVGPointListC2ERKNS_13QualifiedNameE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14shrinkCapacityEm
+__ZN7WebCore21pointsListFromSVGDataEPNS_12SVGPointListERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE15reserveCapacityEm
+__ZNK7WebCore14SVGPolyElement7isValidEv
+__ZN7WebCore14SVGPolyElement16rendererIsNeededEPNS_11RenderStyleE
+__ZNK7WebCore14SVGPolyElement26updateAnimatedSVGAttributeERKNS_6StringE
+__ZN7WebCoreL18polygonConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGPolygonElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL14useConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore13SVGUseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13SVGUseElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn408_NK7WebCore13SVGUseElement14contextElementEv
+__ZNK7WebCore13SVGUseElement14contextElementEv
+__ZN7WebCore13SVGUseElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore13SVGUseElement20insertedIntoDocumentEv
+__ZN7WebCore13SVGUseElement20buildPendingResourceEv
+__ZN7WebCore18SVGElementInstanceC1EPNS_13SVGUseElementEPNS_10SVGElementE
+__ZN7WebCore18SVGElementInstanceC2EPNS_13SVGUseElementEPNS_10SVGElementE
+__ZN7WebCore10SVGElement20mapInstanceToElementEPNS_18SVGElementInstanceE
+__ZN3WTF7HashSetIPN7WebCore18SVGElementInstanceENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6exp
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reh
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13al
+__ZN7WebCore13SVGUseElement17buildInstanceTreeEPNS_10SVGElementEPNS_18SVGElementInstanceERb
+__ZN7WebCoreL19isDisallowedElementEPNS_4NodeE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11xAttrStringE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11yAttrStringE
+__ZN7WebCore13SVGUseElement15buildShadowTreeEPNS_10SVGElementEPNS_18SVGElementInstanceE
+__ZN7WebCoreL32subtreeContainsDisallowedElementEPNS_4NodeE
+__ZN7WebCore13SVGUseElement35removeDisallowedElementsFromSubtreeEPNS_4NodeE
+__ZN7WebCore13SVGUseElement29expandUseElementsInShadowTreeEPNS_4NodeE
+__ZN7WebCore13SVGUseElement32expandSymbolElementsInShadowTreeEPNS_4NodeE
+__ZN7WebCore13SVGUseElement40associateInstancesWithShadowTreeElementsEPNS_4NodeEPNS_18SVGElementInstanceE
+__ZN7WebCore18SVGElementInstance20setShadowTreeElementEPNS_10SVGElementE
+__ZN7WebCore13SVGUseElement34transferEventListenersToShadowTreeEPNS_18SVGElementInstanceE
+__ZN7WebCore13SVGUseElement16attachShadowTreeEv
+__ZN7WebCore13SVGUseElement6attachEv
+__ZNK7WebCore13SVGUseElement7isValidEv
+__ZN7WebCore13SVGUseElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore10SVGElement16shadowParentNodeEv
+__ZN7WebCore13SVGUseElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore18SVGElementInstance13forgetWrapperEv
+__ZN7WebCore10TreeSharedINS_18SVGElementInstanceEE14removedLastRefEv
+__ZN7WebCore18SVGElementInstanceD0Ev
+__ZN7WebCore10SVGElement21removeInstanceMappingEPNS_18SVGElementInstanceE
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4fin
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47re
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rem
+__ZN7WebCore28removeAllChildrenInContainerINS_18SVGElementInstanceES1_EEvPT0_
+__ZN7WebCore7Private28addChildNodesToDeletionQueueINS_18SVGElementInstanceES2_EEvRPT_S5_PT0_
+__ZThn8_N7WebCore22SVGAnimateColorElementD0Ev
+__ZThn8_N7WebCore26SVGAnimateTransformElementD0Ev
+__ZThn8_N7WebCore23SVGAnimateMotionElementD0Ev
+__ZN7WebCore18SVGPolylineElementD0Ev
+__ZN7WebCore14SVGPolyElementD2Ev
+__ZN7WebCore12SVGPointListD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE6shrinkEm
+__ZN7WebCore17SVGAnimatedPointsD2Ev
+__ZN7WebCore17SVGPolygonElementD0Ev
+__ZN7WebCore13SVGUseElement11recalcStyleENS_4Node11StyleChangeE
+__ZNK7WebCore18SVGPolylineElement10toPathDataEv
+__ZNK7WebCore17SVGPolygonElement10toPathDataEv
+__ZSt21__unguarded_partitionIPPN7WebCore14SVGSMILElementES2_NS0_15PriorityCompareEET_S5_S5_T0_T1_
+__ZN7WebCore26SVGAnimateTransformElement24calculateFromAndToValuesERKNS_6StringES3_
+__ZNK7WebCore26SVGAnimateTransformElement19parseTransformValueERKNS_6StringE
+__ZN7WebCore12SVGTransform7isValidEv
+__ZN7WebCore26SVGAnimateTransformElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
+__ZN7WebCore20SVGTransformDistanceC1ERKNS_12SVGTransformES3_
+__ZN7WebCore20SVGTransformDistanceC2ERKNS_12SVGTransformES3_
+__ZNK7WebCore12SVGTransform4typeEv
+__ZNK7WebCore12SVGTransform5scaleEv
+__ZN7WebCore9FloatSize15narrowPrecisionEdd
+__ZNK7WebCore20SVGTransformDistance14scaledDistanceEf
+__ZN7WebCore20SVGTransformDistanceC1ENS_12SVGTransform16SVGTransformTypeEfffRKNS_20TransformationMatrixE
+__ZN7WebCore20SVGTransformDistanceC2ENS_12SVGTransform16SVGTransformTypeEfffRKNS_20TransformationMatrixE
+__ZNK7WebCore20SVGTransformDistance17addToSVGTransformERKNS_12SVGTransformE
+__ZNK7WebCore12SVGTransform9translateEv
+__ZNK7WebCore12SVGTransform14rotationCenterEv
+__ZNK7WebCore12SVGTransform5angleEv
+__ZN7WebCore18SVGElementInstance14setNeedsUpdateEb
+__ZN7WebCoreL30shadowTreeContainsChangedNodesEPNS_18SVGElementInstanceE
+__ZN7WebCore19SVGAnimatedPropertyINS_29SVGStyledTransformableElementENS_16SVGTransformListEXadL_ZNS_39SVGStyledTransformableEle
+__ZNK7WebCore14SVGPolyElement15supportsMarkersEv
+__ZNK7WebCore14RenderSVGImage10isSVGImageEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_14RenderSVGImageEi
+__ZNK7WebCore14RenderSVGImage10renderNameEv
+__ZNK7WebCore14RenderSVGImage14localTransformEv
+__ZN7WebCore13SVGUseElement6detachEv
+__ZN7WebCore13SVGUseElementD0Ev
+__ZThn8_N7WebCore14SVGLineElementD0Ev
+__ZThn8_N7WebCore14SVGRectElementD0Ev
+__ZThn8_N7WebCore16SVGCircleElementD0Ev
+__ZThn8_N7WebCore18SVGPolylineElementD0Ev
+__ZThn8_N7WebCore17SVGPolygonElementD0Ev
+__ZThn8_N7WebCore15SVGImageElementD0Ev
+__ZN7WebCore9CSSParser23parseSVGStrokeDasharrayEv
+__ZNK7WebCore19SVGAnimationElement26currentValuesFromKeyPointsEfRfRNS_6StringES3_
+__ZNK7WebCore19SVGAnimationElement29calculatePercentFromKeyPointsEf
+__ZN3WTF6VectorIdLm0EE14expandCapacityEm
+__ZN3WTF6VectorIdLm0EE15reserveCapacityEm
+__ZN3WTF6VectorIdLm0EE6shrinkEm
+__ZN3WTF6VectorIdLm0EEC1ERKS1_
+__ZN3WTF6VectorIdLm0EEC2ERKS1_
+__ZN7WebCorelsERNS_10TextStreamENS_8WindRuleE
+__ZN7WebCore14SVGSMILElement31createInstanceTimesFromSyncbaseEPS0_NS0_21NewOrExistingIntervalE
+__ZSt25__unguarded_linear_insertIPN7WebCore8SMILTimeES1_EvT_T0_
+__ZThn8_N7WebCore13SVGSetElementD0Ev
+__ZN7WebCore18SVGElementInstance11appendChildEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCore22appendChildToContainerINS_18SVGElementInstanceES1_EEvPT_PT0_
+__ZN7WebCore13SVGUseElement24handleDeepUseReferencingEPS0_PNS_18SVGElementInstanceERb
+__ZNK7WebCore13SVGUseElement38transferUseAttributesToReplacedElementEPNS_10SVGElementES2_
+__ZN7WebCore13SVGUseElement19removedFromDocumentEv
+__ZThn8_N7WebCore13SVGUseElementD0Ev
+__ZSt21__unguarded_partitionIPPN7WebCore14SVGSMILElementES2_PFbS2_S2_EET_S6_S6_T0_T1_
+__ZN7WebCore22ConditionEventListenerD0Ev
+__ZN7WebCore14SVGSMILElement10addEndTimeENS_8SMILTimeE
+__ZN7WebCore14SVGSMILElement14endListChangedEv
+__ZN7WebCore8SVGColorC1ENS0_12SVGColorTypeE
+__ZN7WebCore8SVGColorC2ENS0_12SVGColorTypeE
+__ZNK7WebCore28SVGPaintServerLinearGradient22externalRepresentationERNS_10TextStreamE
+__ZNK7WebCore22SVGPaintServerGradient22externalRepresentationERNS_10TextStreamE
+__ZNK7WebCore28SVGPaintServerLinearGradient11gradientEndEv
+__ZNK7WebCore28SVGPaintServerLinearGradient13gradientStartEv
+__ZN7WebCorelsERNS_10TextStreamERKNS_10FloatPointE
+__ZNK7WebCore21RenderSVGGradientStop10renderNameEv
+__ZN7WebCore12SVGTransform8setSkewXEf
+__ZN7WebCore12SVGTransform8setSkewYEf
+__ZN7WebCoreL18patternConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGPatternElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGPatternElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGPatternElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore17SVGPatternElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore17SVGPatternElement7isValidEv
+__ZN7WebCore17SVGPatternElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore17SVGPatternElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore17SVGPatternElement14canvasResourceEv
+__ZN7WebCore21SVGPaintServerPatternC1EPKNS_17SVGPatternElementE
+__ZN7WebCore21SVGPaintServerPatternC2EPKNS_17SVGPatternElementE
+__ZNK7WebCore21SVGPaintServerPattern5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZNK7WebCore17SVGPatternElement12buildPatternERKNS_9FloatRectE
+__ZNK7WebCore17SVGPatternElement24collectPatternPropertiesEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11xAtt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11yAtt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_16heig
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_29patternContentUni
+__ZN3WTF7HashSetIPKN7WebCore17SVGPatternElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6exp
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6reh
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13al
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15de
+__ZNK7WebCore15SVGFitToViewBox22viewBoxToViewTransformEff
+__ZN7WebCore21SVGPaintServerPattern19setPatternTransformERKNS_20TransformationMatrixE
+__ZN7WebCore21SVGPaintServerPattern20setPatternBoundariesERKNS_9FloatRectE
+__ZN7WebCore21SVGPaintServerPattern7setTileESt8auto_ptrINS_11ImageBufferEE
+__ZNK7WebCore21SVGPaintServerPattern4tileEv
+__ZNK7WebCore21SVGPaintServerPattern17patternBoundariesEv
+__ZNK7WebCore21SVGPaintServerPattern16patternTransformEv
+__ZNK7WebCore21SVGPaintServerPattern8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZN7WebCore10TextStreamlsEb
+__ZNK7WebCore28SVGPaintServerRadialGradient22externalRepresentationERNS_10TextStreamE
+__ZNK7WebCore28SVGPaintServerRadialGradient14gradientRadiusEv
+__ZNK7WebCore28SVGPaintServerRadialGradient13gradientFocalEv
+__ZNK7WebCore28SVGPaintServerRadialGradient14gradientCenterEv
+__ZNK7WebCore21SVGPaintServerPattern22externalRepresentationERNS_10TextStreamE
+__ZN7WebCore17SVGPatternElementD0Ev
+__ZN7WebCore21SVGPaintServerPatternD0Ev
+__ZNK7WebCore13SVGSVGElement7isValidEv
+__ZN7WebCore26RenderSVGViewportContainerC1EPNS_16SVGStyledElementE
+__ZN7WebCore26RenderSVGViewportContainerC2EPNS_16SVGStyledElementE
+__ZN7WebCore26RenderSVGViewportContainer12calcViewportEv
+__ZNK7WebCore26RenderSVGViewportContainer22localToParentTransformEv
+__ZNK7WebCore26RenderSVGViewportContainer8viewportEv
+__ZNK7WebCore26RenderSVGViewportContainer17viewportTransformEv
+__ZN7WebCore26RenderSVGViewportContainer5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore26RenderSVGViewportContainer17applyViewportClipERNS_12RenderObject9PaintInfoE
+__ZNK7WebCore26RenderSVGViewportContainer14isSVGContainerEv
+__ZNK7WebCore26RenderSVGViewportContainer10renderNameEv
+__ZNK7WebCore26RenderSVGViewportContainer17absoluteTransformEv
+__ZN7WebCore26RenderSVGViewportContainerD0Ev
+__ZN7WebCore7DataRefINS_13StyleMiscDataEE6accessEv
+__ZN7WebCore13StyleMiscDataC1ERKS0_
+__ZN7WebCore13StyleMiscDataC2ERKS0_
+__ZNK7WebCore13StyleMiscDataeqERKS0_
+__ZN7WebCoreL18writeNameValuePairINS_6StringEEEvRNS_10TextStreamEPKcT_
+__ZN7WebCore15GraphicsContext18setShouldAntialiasEb
+__ZN7WebCore15GraphicsContext26setPlatformShouldAntialiasEb
+__ZNK7WebCore14RenderSVGTSpan10renderNameEv
+__ZN7WebCoreL30floatWidthMissingGlyphCallbackERKNS_7TextRunERNS_34SVGTextRunWalkerMeasuredLengthDataE
+__ZNK7WebCore4Font12fontSelectorEv
+__ZN7WebCoreL28drawTextMissingGlyphCallbackERKNS_7TextRunERNS_28SVGTextRunWalkerDrawTextDataE
+__ZN7WebCoreL17cursorConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGCursorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGCursorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGCursorElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGCursorElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZThn264_NK7WebCore16SVGCursorElement14contextElementEv
+__ZNK7WebCore16SVGCursorElement14contextElementEv
+__ZNK7WebCore16SVGCursorElement7isValidEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCursorElementENS_9SVGLengthEXadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11xAttrS
+__ZN7WebCore13CSSImageValue14cachedImageURLEv
+__ZN7WebCore13CSSImageValue16clearCachedImageEv
+__ZN3WTF7HashSetIPN7WebCore10SVGElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTa
+__ZN7WebCore16SVGCursorElement9addClientEPNS_10SVGElementE
+__ZNK7WebCore15RenderSVGInline10renderNameEv
+__ZN7WebCore16SVGCursorElement12removeClientEPNS_10SVGElementE
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndI
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore19CSSCursorImageValue23removeReferencedElementEPNS_10SVGElementE
+__ZN7WebCore16SVGCursorElementD0Ev
+__ZN7WebCore19SVGAnimatedPropertyINS_11SVGAElementENS_6StringEXadL_ZNS_8SVGNames10aTagStringEEEXadL_ZNS3_16targetAttrStringEEEE
+__ZN7WebCoreL15viewConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGViewElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGViewElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGViewElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGViewElement16rendererIsNeededEPNS_11RenderStyleE
+__ZThn288_NK7WebCore14SVGViewElement14contextElementEv
+__ZNK7WebCore14SVGViewElement14contextElementEv
+__ZNK7WebCore14SVGViewElement10viewTargetEv
+__ZN7WebCore13SVGStringListC1ERKNS_13QualifiedNameE
+__ZN7WebCore13SVGStringListC2ERKNS_13QualifiedNameE
+__ZN7WebCore13SVGStringList5resetERKNS_6StringE
+__ZN7WebCore13SVGStringList5parseERKNS_6StringEt
+__ZN7WebCore14SVGViewElementD0Ev
+__ZN7WebCore13SVGStringListD0Ev
+__ZN7WebCoreL19clippathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGClipPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGClipPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore18SVGClipPathElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore18SVGClipPathElement7isValidEv
+__ZN7WebCore18SVGClipPathElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore18SVGClipPathElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore13StyleClipDataC1ERKS0_
+__ZN7WebCore13StyleClipDataC2ERKS0_
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEEE1
+__ZNK7WebCore13StyleClipDataeqERKS0_
+__ZN7WebCore18SVGClipPathElement14canvasResourceEv
+__ZN7WebCore18SVGResourceClipperC1Ev
+__ZN7WebCore18SVGResourceClipperC2Ev
+__ZNK7WebCore29SVGStyledTransformableElement10toClipPathEv
+__ZN7WebCore18SVGResourceClipper11addClipDataERKNS_4PathENS_8WindRuleEb
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE15reserveCapacityEm
+__ZNK7WebCore18SVGResourceClipper8clipDataEv
+__ZNK7WebCore18SVGResourceClipper12resourceTypeEv
+__ZNK7WebCore18SVGResourceClipper9applyClipEPNS_15GraphicsContextERKNS_9FloatRectE
+__ZN7WebCore15GraphicsContext8clipPathENS_8WindRuleE
+__ZN7WebCore18SVGResourceClipper13resetClipDataEv
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE6shrinkEm
+__ZN7WebCorelsERNS_10TextStreamERKNS_11SVGResourceE
+__ZNK7WebCore18SVGResourceClipper22externalRepresentationERNS_10TextStreamE
+__ZN7WebCorelsINS_8ClipDataEEERNS_10TextStreamES3_RKN3WTF6VectorIT_Lm0EEE
+__ZN7WebCorelsERNS_10TextStreamERKNS_8ClipDataE
+__ZNK7WebCore17SVGResourceMasker22externalRepresentationERNS_10TextStreamE
+__ZN7WebCore18SVGClipPathElementD0Ev
+__ZN7WebCore18SVGResourceClipperD0Ev
+__ZN7WebCoreL17markerConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGMarkerElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGMarkerElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore8SVGAngleC1Ev
+__ZN7WebCore8SVGAngleC2Ev
+__ZN7WebCore16SVGMarkerElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGMarkerElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZThn312_NK7WebCore16SVGMarkerElement14contextElementEv
+__ZNK7WebCore16SVGMarkerElement14contextElementEv
+__ZN7WebCore16SVGMarkerElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore16SVGMarkerElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore15StyleMarkerDataC1ERKS0_
+__ZN7WebCore15StyleMarkerDataC2ERKS0_
+__ZN7WebCore7DataRefINS_15StyleMarkerDataEE6accessEv
+__ZNK7WebCore15StyleMarkerDataeqERKS0_
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_22marker
+__ZN7WebCore16SVGMarkerElement14canvasResourceEv
+__ZN7WebCore17SVGResourceMarkerC1Ev
+__ZN7WebCore17SVGResourceMarkerC2Ev
+__ZN7WebCore17SVGResourceMarker9setMarkerEPNS_26RenderSVGViewportContainerE
+__ZNK7WebCore8SVGAngle5valueEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refYAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refXAt
+__ZN7WebCore17SVGResourceMarker6setRefEdd
+__ZNK7WebCore17SVGResourceMarker12resourceTypeEv
+__ZN7WebCore15DrawMarkersDataC1EPNS_15GraphicsContextEPNS_17SVGResourceMarkerES4_d
+__ZN7WebCore15DrawMarkersDataC2EPNS_15GraphicsContextEPNS_17SVGResourceMarkerES4_d
+__ZN7WebCoreL22drawStartAndMidMarkersEPvPKNS_11PathElementE
+__ZN7WebCoreL18drawMarkerWithDataEPNS_15GraphicsContextERNS_10MarkerDataE
+__ZN7WebCore17SVGResourceMarker4drawEPNS_15GraphicsContextERKNS_9FloatRectEdddd
+__ZNK3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8con
+__ZN3WTF7HashSetIPN7WebCore17SVGResourceMarkerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expa
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reha
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13all
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dea
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4find
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47rem
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remo
+__ZNK7WebCore17SVGResourceMarker12cachedBoundsEv
+__ZNK7WebCore17SVGResourceMarker22externalRepresentationERNS_10TextStreamE
+__ZN7WebCore16SVGMarkerElementD0Ev
+__ZN7WebCore17SVGResourceMarkerD0Ev
+__ZN7WebCore8SVGAngleD0Ev
+__ZThn240_NK7WebCore17SVGPatternElement14contextElementEv
+__ZNK7WebCore17SVGPatternElement14contextElementEv
+__ZNK3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8co
+__ZN7WebCore16SVGTransformList11consolidateEv
+__ZNK7WebCore13RenderSVGText14localTransformEv
+__ZN7WebCore15GraphicsContext16setStrokePatternEN3WTF10PassRefPtrINS_7PatternEEE
+__ZN7WebCore15GraphicsContext18applyStrokePatternEv
+__ZN7WebCoreL17switchConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGSwitchElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16SVGSwitchElement7isValidEv
+__ZN7WebCore16SVGSwitchElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore16SVGSwitchElement25childShouldCreateRendererEPNS_4NodeE
+__ZNK7WebCore8SVGTests18requiredExtensionsEv
+__ZNK7WebCore8SVGTests14systemLanguageEv
+__ZN7WebCore16SVGSwitchElementD0Ev
+__ZNK7WebCore8SVGTests16requiredFeaturesEv
+__ZN7WebCore27jsSVGElementOwnerSVGElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsSVGRectElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11xAttrStri
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGRectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_
+__ZN7WebCore17jsSVGRectElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11yAttrStri
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGRectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3
+__ZN7WebCore22jsSVGRectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_16heightAtt
+__ZN7WebCore11JSSVGLength3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19setJSSVGLengthValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9SVGLength8setValueEf
+__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEE12commitChangeES1_PNS_10SVGElementE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11yAttrStrin
+__ZN7WebCore15SVGTitleElement19removedFromDocumentEv
+__ZN7WebCore16SVGScriptElement19removedFromDocumentEv
+__ZN7WebCore13SVGUseElement24alterShadowTreeForSVGTagEPNS_10SVGElementE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_15widthAttrStr
+__ZN7WebCoreL17symbolConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGSymbolElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGSymbolElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGSymbolElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn312_NK7WebCore16SVGSymbolElement14contextElementEv
+__ZNK7WebCore16SVGSymbolElement14contextElementEv
+__ZN7WebCore16SVGSymbolElement16rendererIsNeededEPNS_11RenderStyleE
+__ZThn8_N7WebCore16SVGSymbolElementD0Ev
+__ZN7WebCore16SVGSymbolElementD0Ev
+__ZThn8_N7WebCore17SVGEllipseElementD0Ev
+__ZN7WebCore21SVGDocumentExtensions18addPendingResourceERKNS_12AtomicStringEPNS_16SVGStyledElementE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHash
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS
+__ZNK7WebCore22SVGCharacterLayoutInfo22baselineShiftValueNextEv
+__ZN7WebCoreL15trefConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGTRefElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGTRefElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGTRefElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn672_NK7WebCore14SVGTRefElement14contextElementEv
+__ZNK7WebCore14SVGTRefElement14contextElementEv
+__ZN7WebCore14SVGTRefElement20updateReferencedTextEv
+__ZN7WebCore14SVGTRefElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore14SVGTRefElement25childShouldCreateRendererEPNS_4NodeE
+__ZNK7WebCore17RenderSVGTextPath10renderNameEv
+__ZN7WebCoreL23angleToGlyphOrientationEf
+__ZN7WebCoreL27cummulatedHeightOfTextChunkERNS_12SVGTextChunkE
+__ZN7WebCore41cummulatedHeightOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
+__ZN7WebCore14SVGTRefElementD0Ev
+__ZN7WebCore16SVGRootInlineBox37retrievePaintServersForTextDecorationEPNS_12RenderObjectE
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapIiPN7WebCore12RenderObjectENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE6shrinkEm
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore12RenderObjectEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10Has
+__ZN7WebCore16SVGInlineTextBox15paintDecorationENS_15ETextDecorationEPNS_15GraphicsContextEiiiRKNS_7SVGCharERKNS_21SVGTextDecor
+__ZNK3WTF9HashTableIiSt4pairIiPN7WebCore12RenderObjectEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10Ha
+__ZNK3WTF7HashMapIiPN7WebCore12RenderObjectENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3getERKi
+__ZNK7WebCore22SVGCharacterLayoutInfo11dyValueNextEv
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHas
+__ZN7WebCore21SVGDocumentExtensions21removePendingResourceERKNS_12AtomicStringE
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC1ERKS
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC2ERKS
+__ZN7WebCore11SVGResource17invalidateClientsEN3WTF7HashSetIPNS_16SVGStyledElementENS1_7PtrHashIS4_EENS1_10HashTraitsIS4_EEEE
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_13SVGNumberListENS1_10StringHashENS_10HashTraitsIS6_EENS
+__ZN7WebCore13SVGNumberList5parseERKNS_6StringE
+__ZNK7WebCore22SVGCharacterLayoutInfo14angleValueNextEv
+__ZN7WebCore55jsSVGTextContentElementPrototypeFunctionSelectSubStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZNK7WebCore21SVGTextContentElement15selectSubStringEjjRi
+__ZN7WebCore19RenderSVGInlineText23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZNK7WebCore12RenderObject20isSVGHiddenContainerEv
+__ZN7WebCore19RenderSVGInlineText26computeRepaintRectForRangeEPNS_20RenderBoxModelObjectEii
+__ZN7WebCore19RenderSVGInlineText26computeRepaintQuadForRangeEPNS_20RenderBoxModelObjectEii
+__ZN7WebCore17findSVGRootObjectEPNS_12RenderObjectE
+__ZN7WebCore16SVGInlineTextBox13selectionRectEiiii
+__ZN7WebCore18SVGTextChunkWalkerINS_35SVGInlineTextBoxSelectionRectWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatr
+__ZN7WebCore35SVGInlineTextBoxSelectionRectWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKP
+__ZN7WebCore16SVGInlineTextBox14paintSelectionEiRKNS_7SVGCharEPKtiPNS_15GraphicsContextEPNS_11RenderStyleERKNS_4FontE
+__ZNK7WebCore22SVGCharacterLayoutInfo11dxValueNextEv
+__ZN7WebCore45jsSVGTextElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14SVGTextElement12getScreenCTMEv
+__ZNK7WebCore16SVGTransformable12getScreenCTMEPKNS_10SVGElementE
+__ZN7WebCore12SVGLocatable12getScreenCTMEPKNS_10SVGElementE
+__ZNK7WebCore25SVGStyledLocatableElement17isStyledLocatableEv
+__ZNK7WebCore29SVGStyledTransformableElement12getScreenCTMEv
+__ZNK7WebCore13SVGSVGElement12getScreenCTMEv
+__ZNK7WebCore25SVGStyledLocatableElement12getScreenCTMEv
+__ZThn240_NK7WebCore29SVGStyledTransformableElement22animatedLocalTransformEv
+__ZThn672_NK7WebCore14SVGTextElement22animatedLocalTransformEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_20TransformationMatrixEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGMatrix15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSSVGMatrixC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_20TransformationMatrixEEEEEPNS
+__ZN7WebCore11JSSVGMatrixC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_20TransformationMatrixEEEEEPNS
+__ZN7WebCore11JSSVGMatrix18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_20TransformationMatrixEEcvS1_Ev
+__ZN7WebCore12jsSVGMatrixBEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixFEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGTextElementPrototypeFunctionGetCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14SVGTextElement6getCTMEv
+__ZNK7WebCore16SVGTransformable6getCTMEPKNS_10SVGElementE
+__ZN7WebCore12SVGLocatable6getCTMEPKNS_10SVGElementE
+__ZNK7WebCore29SVGStyledTransformableElement6getCTMEv
+__ZNK7WebCore13SVGSVGElement6getCTMEv
+__ZN7WebCore54jsSVGTextElementPrototypeFunctionGetTransformToElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore12toSVGElementEN3JSC7JSValueE
+__ZNK7WebCore12SVGLocatable21getTransformToElementEPNS_10SVGElementERi
+__ZTv0_n56_NK7WebCore14SVGTextElement6getCTMEv
+__ZN7WebCore27JSSVGCircleElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsSVGCircleElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore29SVGStyledTransformableElement7getBBoxEv
+__ZN7WebCore12SVGLocatable7getBBoxEPKNS_10SVGElementE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9FloatRectEEEPNS_10SVGElementE
+__ZN7WebCore9JSSVGRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSSVGRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9FloatRectEEEEEPNS_10SVGElementE
+__ZN7WebCore9JSSVGRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9FloatRectEEEEEPNS_10SVGElementE
+__ZN7WebCore9JSSVGRect18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10jsSVGRectXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEEcvS1_Ev
+__ZN7WebCore10jsSVGRectYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsSVGRectWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsSVGRectHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGCircleElementFarthestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29SVGStyledTransformableElement23farthestViewportElementEv
+__ZN7WebCore12SVGLocatable23farthestViewportElementEPKNS_10SVGElementE
+__ZN7WebCore40jsSVGCircleElementNearestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29SVGStyledTransformableElement22nearestViewportElementEv
+__ZN7WebCore9JSSVGRectD1Ev
+__ZN7WebCore9JSSVGRectD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEED0Ev
+__ZN7WebCore11JSSVGMatrixD1Ev
+__ZN7WebCore11JSSVGMatrixD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_20TransformationMatrixEED0Ev
+__ZN7WebCore18JSSVGRectPrototypeD1Ev
+__ZN7WebCore20JSSVGMatrixPrototypeD1Ev
+__ZThn400_NK7WebCore17SVGPatternElement14contextElementEv
+__ZNK7WebCore14RenderSVGTSpan17objectBoundingBoxEv
+__ZN7WebCore13StyleTextDataC1ERKS0_
+__ZN7WebCore13StyleTextDataC2ERKS0_
+__ZNK7WebCore13StyleTextDataeqERKS0_
+__ZN7WebCore20findCharUnicodeRangeEi
+__ZThn288_N7WebCore16SVGScriptElement17dispatchLoadEventEv
+__ZN7WebCore16SVGScriptElement17dispatchLoadEventEv
+__ZN7WebCoreL26createSVGUseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore15JSSVGUseElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGUseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGUseElementEEE
+__ZN7WebCore15JSSVGUseElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGUseElementEEE
+__ZN7WebCore15JSSVGUseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSSVGUseElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSSVGUseElement9classInfoEv
+__ZN7WebCoreL30createSVGEllipseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore19JSSVGEllipseElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGEllipseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGEllipseElementEEE
+__ZN7WebCore19JSSVGEllipseElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGEllipseElementEEE
+__ZN7WebCore19JSSVGEllipseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSSVGEllipseElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSSVGEllipseElement9classInfoEv
+__ZN7WebCoreL27createSVGDefsElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGDefsElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGDefsElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDefsElementEEE
+__ZN7WebCore16JSSVGDefsElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDefsElementEEE
+__ZN7WebCoreL37createSVGLinearGradientElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore26JSSVGLinearGradientElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGLinearGradientElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGLinearGradientElementEEE
+__ZN7WebCore26JSSVGLinearGradientElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGLinearGradientElementEEE
+__ZN7WebCore20JSSVGGradientElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGGradientElementEEE
+__ZN7WebCore26JSSVGLinearGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSSVGGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSSVGLinearGradientElement9classInfoEv
+__ZN7WebCoreL27createSVGStopElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGStopElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGStopElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGStopElementEEE
+__ZN7WebCore16JSSVGStopElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGStopElementEEE
+__ZN7WebCore16JSSVGStopElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGStopElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGStopElement9classInfoEv
+__ZN7WebCore16JSSVGDefsElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGDefsElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGDefsElement9classInfoEv
+__ZN7WebCoreL27createSVGLineElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGLineElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGLineElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGLineElementEEE
+__ZN7WebCore16JSSVGLineElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGLineElementEEE
+__ZN7WebCore16JSSVGLineElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGLineElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGLineElement9classInfoEv
+__ZN7WebCore16JSSVGStopElementD1Ev
+__ZN7WebCore26JSSVGLinearGradientElementD1Ev
+__ZN7WebCore19JSSVGEllipseElementD1Ev
+__ZN7WebCore15JSSVGUseElementD1Ev
+__ZN7WebCore28JSSVGEllipseElementPrototypeD1Ev
+__ZN7WebCore24JSSVGUseElementPrototypeD1Ev
+__ZN7WebCore16JSSVGLineElementD1Ev
+__ZN7WebCore25JSSVGLineElementPrototypeD1Ev
+__ZN7WebCore25JSSVGStopElementPrototypeD1Ev
+__ZN7WebCore35JSSVGLinearGradientElementPrototypeD1Ev
+__ZN7WebCore16JSSVGDefsElementD1Ev
+__ZThn8_N7WebCore14SVGDefsElementD0Ev
+__ZN7WebCore25JSSVGDefsElementPrototypeD1Ev
+__ZN7WebCore21SVGDocumentExtensions11reportErrorERKNS_6StringE
+__ZThn8_N7WebCore15SVGTSpanElementD0Ev
+__ZN7WebCoreL29createSVGSymbolElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGSymbolElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGSymbolElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGSymbolElementEEE
+__ZN7WebCore18JSSVGSymbolElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGSymbolElementEEE
+__ZN7WebCore18JSSVGSymbolElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGSymbolElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSSVGSymbolElement9classInfoEv
+__ZN7WebCore18JSSVGSymbolElementD1Ev
+__ZN7WebCore27JSSVGSymbolElementPrototypeD1Ev
+__ZN7WebCore10JSSVGPaintC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGPaintEEE
+__ZN7WebCore10JSSVGPaintC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGPaintEEE
+__ZN7WebCore10JSSVGColorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGColorEEE
+__ZN7WebCore10JSSVGPaint18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10JSSVGColor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore10JSSVGPaint9classInfoEv
+__ZN7WebCore10JSSVGPaintD1Ev
+__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGMatrixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement15createSVGMatrixEv
+__ZN7WebCore20JSSVGMatrixPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore44jsSVGMatrixPrototypeFunctionRotateFromVectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSSVGMatrix9classInfoEv
+__ZN7WebCore11JSSVGMatrix16rotateFromVectorEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore20TransformationMatrix16rotateFromVectorEdd
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SVGExceptionEPNS_10SVGElementE
+__ZN7WebCore14JSSVGExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGExceptionEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGExceptionEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsSVGExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSSVGException9classInfoEv
+__ZN7WebCore25jsSVGExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGMatrixPrototypeFunctionTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSSVGExceptionD1Ev
+__ZN7WebCore14JSSVGExceptionD2Ev
+__ZN7WebCore24jsSVGDocumentRootElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGNumberEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement15createSVGNumberEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperIfEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumber15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSSVGNumberC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperIfEEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumberC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperIfEEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumber18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsSVGNumberValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperIfEcvfEv
+__ZN7WebCore11JSSVGNumber3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19setJSSVGNumberValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperIfE12commitChangeEfPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumberD1Ev
+__ZN7WebCore11JSSVGNumberD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperIfED0Ev
+__ZN7WebCore46jsSVGSVGElementPrototypeFunctionCreateSVGPointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement14createSVGPointEv
+__ZN7WebCore10JSSVGPoint3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore14setJSSVGPointXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_10FloatPointEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore14setJSSVGPointYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20JSSVGNumberPrototypeD1Ev
+__ZN7WebCore19JSSVGPointPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsSVGMatrixPrototypeFunctionInverseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSSVGMatrix7inverseEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore42jsSVGPointPrototypeFunctionMatrixTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore10JSSVGPoint9classInfoEv
+__ZN7WebCore11toSVGMatrixEN3JSC7JSValueE
+__ZNK7WebCore10FloatPoint15matrixTransformERKNS_20TransformationMatrixE
+__ZN7WebCore23JSSVGTextContentElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore45jsSVGSVGElementPrototypeFunctionCreateSVGRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement13createSVGRectEv
+__ZN7WebCore9JSSVGRect3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore13setJSSVGRectXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore13setJSSVGRectYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17setJSSVGRectWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18setJSSVGRectHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL23dominantBaselineToShiftEbPKNS_12RenderObjectERKNS_4FontE
+__ZNK7WebCore21SVGPathSegSingleCoord8toStringEv
+__ZNK7WebCore19SVGPathSegMovetoAbs19pathSegTypeAsLetterEv
+__ZN7WebCore14SVGPathSegList14createAnimatedEPKS0_S2_f
+__ZNK7WebCore19SVGPathSegLinetoAbs19pathSegTypeAsLetterEv
+__ZNK7WebCore22SVGPathSegCurvetoCubic8toStringEv
+__ZNK7WebCore25SVGPathSegCurvetoCubicAbs19pathSegTypeAsLetterEv
+__ZN7WebCoreL24foreignobjectConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore23SVGForeignObjectElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore23SVGForeignObjectElement7isValidEv
+__ZN7WebCore23SVGForeignObjectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore19RenderForeignObjectC1EPNS_23SVGForeignObjectElementE
+__ZN7WebCore19RenderForeignObjectC2EPNS_23SVGForeignObjectElementE
+__ZNK7WebCore19RenderForeignObject13requiresLayerEv
+__ZNK7WebCore23SVGForeignObjectElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore16jsSVGSVGElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11xAttrString
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11
+__ZN7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11xAttrStringEE
+__ZN7WebCore19RenderForeignObject21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore19RenderForeignObject22localToParentTransformEv
+__ZNK7WebCore19RenderForeignObject24translationForAttributesEv
+__ZNK7WebCore19RenderForeignObject14localTransformEv
+__ZN7WebCore19RenderForeignObject6layoutEv
+__ZNK7WebCore19RenderForeignObject29repaintRectInLocalCoordinatesEv
+__ZN7WebCore19RenderForeignObject5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore19RenderForeignObject10renderNameEv
+__ZN7WebCore19RenderForeignObjectD0Ev
+__ZN7WebCore13RenderSVGRoot11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore10RenderPath16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActionE
+__ZN7WebCore21PointerEventsHitRulesC1ENS0_11EHitTestingENS_14EPointerEventsE
+__ZN7WebCore21PointerEventsHitRulesC2ENS0_11EHitTestingENS_14EPointerEventsE
+__ZNK7WebCore10RenderPath12fillContainsERKNS_10FloatPointEb
+__ZNK7WebCore11SVGDocument17zoomAndPanEnabledEv
+__ZN7WebCore23SVGForeignObjectElementD0Ev
+__ZN7WebCore25jsSVGRectElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGStyledElementENS_6StringEXadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLName
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_6StringEEENS1_29SVGAnimatedTypeWrapperKey
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_6StringEEENS1_29SVGAnimatedTypeWrapperKeyH
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateINS1_6StringEEEENS_18PairFirstExtr
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateINS_6StringEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedString15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGAnimatedStringC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_6StringEEEEEPNS_10SVGE
+__ZN7WebCore19JSSVGAnimatedStringC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_6StringEEEEEPNS_10SVGE
+__ZN7WebCore19JSSVGAnimatedString3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSSVGAnimatedStringBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGStyledElementENS_6StringEXadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLNames
+__ZN7WebCore19synchronizePropertyINS_16SVGStyledElementENS_6StringEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore19JSSVGAnimatedStringD1Ev
+__ZN7WebCore19JSSVGAnimatedStringD2Ev
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGStyledElementES1_NS_6StringES2_XadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZN
+__ZN7WebCore28JSSVGAnimatedStringPrototypeD1Ev
+__ZN7WebCore18RenderSVGContainer16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActi
+__ZN7WebCore18RenderSVGContainer25pointIsInsideViewportClipERKNS_10FloatPointE
+__ZNK7WebCore7Element5titleEv
+__ZNK7WebCore13SVGZoomAndPan10zoomAndPanEv
+__ZN7WebCore12RenderObject16positionForPointERKNS_8IntPointE
+__ZN7WebCoreL31createSVGClipPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGClipPathElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGClipPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGClipPathElementEEE
+__ZN7WebCore20JSSVGClipPathElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGClipPathElementEEE
+__ZN7WebCore20JSSVGClipPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSSVGClipPathElementD1Ev
+__ZN7WebCore29JSSVGClipPathElementPrototypeD1Ev
+__ZNK7WebCore13SVGUseElement10toClipPathEv
+__ZN7WebCore33jsSVGClipPathElementClipPathUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_18SVGClipPathElementEiXadL_ZNS_8SVGNames17clipPathTagStringEEEXadL_ZNS2_23clipPathUnitsA
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIiEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIiEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35S
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIiEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIiEEPNS_10SVGElementE
+__ZN7WebCore24JSSVGAnimatedEnumeration15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGAnimatedEnumerationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIiEEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGAnimatedEnumerationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIiEEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGAnimatedEnumeration3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore34setJSSVGAnimatedEnumerationBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24JSSVGAnimatedEnumerationD1Ev
+__ZN7WebCore24JSSVGAnimatedEnumerationD2Ev
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_18SVGClipPathElementES1_iiXadL_ZNS_8SVGNames17clipPathTagStringEEEXadL_ZNS2_23clipP
+__ZN7WebCore33JSSVGAnimatedEnumerationPrototypeD1Ev
+__ZN7WebCoreL31createSVGMetadataElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGMetadataElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGMetadataElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGMetadataElementEEE
+__ZN7WebCore20JSSVGMetadataElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGMetadataElementEEE
+__ZNK7WebCore20JSSVGMetadataElement9classInfoEv
+__ZN7WebCore20JSSVGMetadataElementD1Ev
+__ZThn8_N7WebCore18SVGMetadataElementD0Ev
+__ZN7WebCore29JSSVGMetadataElementPrototypeD1Ev
+__ZN7WebCore26RenderSVGViewportContainer25pointIsInsideViewportClipERKNS_10FloatPointE
+__ZNK7WebCore10RenderPath14strokeContainsERKNS_10FloatPointEb
+__ZNK7WebCore4Path14strokeContainsEPNS_18StrokeStyleApplierERKNS_10FloatPointE
+__ZNK7WebCore13SVGUseElement28instanceForShadowTreeElementEPNS_4NodeE
+__ZNK7WebCore13SVGUseElement28instanceForShadowTreeElementEPNS_4NodeEPNS_18SVGElementInstanceE
+__ZThn24_N7WebCore18SVGElementInstance14refEventTargetEv
+__ZN7WebCore18SVGElementInstance14refEventTargetEv
+__ZThn24_N7WebCore18SVGElementInstance6toNodeEv
+__ZN7WebCore18SVGElementInstance6toNodeEv
+__ZThn24_N7WebCore18SVGElementInstance16derefEventTargetEv
+__ZN7WebCore18SVGElementInstance16derefEventTargetEv
+__ZN7WebCore22jsSVGStopElementOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE15a
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEENS_
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIfEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGStopElementES1_ffXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStr
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIfEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35S
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIfEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIfEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedNumber15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGAnimatedNumberC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIfEEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedNumberC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIfEEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedNumber18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsSVGAnimatedNumberBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE9ba
+__ZN7WebCore19JSSVGAnimatedNumber3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSSVGAnimatedNumberBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19JSSVGAnimatedNumberD1Ev
+__ZN7WebCore19JSSVGAnimatedNumberD2Ev
+__ZNK7WebCore24JSSVGSVGElementPrototype9classInfoEv
+__ZNK7WebCore21JSSVGElementPrototype9classInfoEv
+__ZN7WebCore29jsSVGSVGElementSystemLanguageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13SVGStringListEPNS_10SVGElementE
+__ZN7WebCore15JSSVGStringList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGStringListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGStringListEEEPNS_10SVGElementE
+__ZN7WebCore15JSSVGStringListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGStringListEEEPNS_10SVGElementE
+__ZN7WebCore40jsSVGSVGElementExternalResourcesRequiredEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn296_NK7WebCore13SVGSVGElement14contextElementEv
+__ZN7WebCore21lookupOrCreateWrapperINS_28SVGExternalResourcesRequiredEbXadL_ZNS_38SVGExternalResourcesRequiredIdentifierEEEXadL
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIbEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIbEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35S
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIbEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIbEEPNS_10SVGElementE
+__ZN7WebCore20JSSVGAnimatedBoolean15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGAnimatedBooleanC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIbEEEEPNS_10SVGElementE
+__ZN7WebCore20JSSVGAnimatedBooleanC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIbEEEEPNS_10SVGElementE
+__ZN7WebCore31jsSVGSVGElementCurrentTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGSVGElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrSt
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15
+__ZN7WebCore22jsSVGSVGElementViewBoxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGFitToViewBoxENS_9FloatRectEXadL_ZNS_25SVGFitToViewBoxIdentifierEEEXadL_ZNS_8SVGName
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9FloatRectEEENS1_29SVGAnimatedTypeWrapper
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGFitToViewBoxENS_10SVGElementENS_9FloatRectES3_XadL_ZNS_25SVGFitToViewBoxIdenti
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9FloatRectEEENS1_29SVGAnimatedTypeWrapperK
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateINS1_9FloatRectEEEENS_18PairFirstE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateINS_9FloatRectEEEPNS_10SVGElementE
+__ZN7WebCore17JSSVGAnimatedRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGAnimatedRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9FloatRectEEEEEPNS_10SVG
+__ZN7WebCore17JSSVGAnimatedRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9FloatRectEEEEEPNS_10SVG
+__ZN7WebCore37jsSVGSVGElementPixelUnitToMillimeterXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement22pixelUnitToMillimeterXEv
+__ZN7WebCore16jsSVGSVGElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11yAttrString
+__ZN7WebCore39jsSVGSVGElementScreenPixelToMillimeterXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement24screenPixelToMillimeterXEv
+__ZN7WebCore27jsSVGSVGElementCurrentScaleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGSVGElementViewportEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement8viewportEv
+__ZN7WebCore9FloatRect15narrowPrecisionEdddd
+__ZN7WebCore29jsSVGSVGElementUseCurrentViewEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGSVGElementXmllangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGLangSpace7xmllangEv
+__ZN7WebCore37jsSVGSVGElementPixelUnitToMillimeterYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement22pixelUnitToMillimeterYEv
+__ZN7WebCore24jsSVGSVGElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsSVGSVGElementFarthestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore25SVGStyledLocatableElement23farthestViewportElementEv
+__ZN7WebCore21jsSVGSVGElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_16heightAttrS
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_16
+__ZN7WebCore39jsSVGSVGElementScreenPixelToMillimeterYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement24screenPixelToMillimeterYEv
+__ZN7WebCore33jsSVGSVGElementRequiredExtensionsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGSVGElementContentStyleTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement16contentStyleTypeEv
+__ZN7WebCore32jsSVGSVGElementContentScriptTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement17contentScriptTypeEv
+__ZN7WebCore31jsSVGSVGElementRequiredFeaturesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGSVGElementXmlspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGLangSpace8xmlspaceEv
+__ZN7WebCore20jsSVGSVGElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementNearestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGSVGElementPreserveAspectRatioEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGFitToViewBoxENS_22SVGPreserveAspectRatioEXadL_ZNS_25SVGFitToViewBoxIdentifierEEEXad
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_22SVGPreserveAspectRatioEEENS1_29SVGAnim
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGFitToViewBoxENS_10SVGElementENS_22SVGPreserveAspectRatioEPS3_XadL_ZNS_25SVGFit
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_22SVGPreserveAspectRatioEEENS1_29SVGAnima
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_22SVGPreserveAspectRatioEEEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_22SVGPreserveAspectRatioEEEPNS_10SVGElementE
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatio15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_22SVGPre
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_22SVGPre
+__ZN7WebCore25jsSVGSVGElementZoomAndPanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGElementXmlbaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10SVGElement7xmlbaseEv
+__ZN7WebCore27jsSVGElementViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementSVG_ZOOMANDPAN_DISABLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioD1Ev
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioD2Ev
+__ZN7WebCore15JSSVGStringListD1Ev
+__ZN7WebCore15JSSVGStringListD2Ev
+__ZN7WebCore17JSSVGAnimatedRectD1Ev
+__ZN7WebCore17JSSVGAnimatedRectD2Ev
+__ZN7WebCore35JSSVGStaticPODTypeWrapperWithParentINS_10FloatPointENS_13SVGSVGElementEED0Ev
+__ZN7WebCore20JSSVGAnimatedBooleanD1Ev
+__ZN7WebCore20JSSVGAnimatedBooleanD2Ev
+__ZN7WebCore28JSSVGAnimatedNumberPrototypeD1Ev
+__ZN7WebCore41JSSVGAnimatedPreserveAspectRatioPrototypeD1Ev
+__ZN7WebCore26JSSVGAnimatedRectPrototypeD1Ev
+__ZN7WebCore29JSSVGAnimatedBooleanPrototypeD1Ev
+__ZN7WebCore24JSSVGStringListPrototypeD1Ev
+__ZN7WebCore23SVGForeignObjectElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore23SVGForeignObjectElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_1
+__ZN7WebCore15SVGFitToViewBox16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore57jsSVGRectElementPrototypeFunctionGetPresentationAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore16SVGStyledElement24getPresentationAttributeERKNS_6StringE
+__ZNK7WebCore15MappedAttribute5styleEv
+__ZN7WebCore38jsSVGColorPrototypeFunctionSetRGBColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8SVGPaintC1ERKNS_6StringERKNS_5ColorE
+__ZN7WebCore8SVGPaintC2ERKNS_6StringERKNS_5ColorE
+__ZN7WebCore10RenderPath17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore18RenderSVGContainer17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore14RenderSVGImage17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCoreL23fontfacenameConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore22SVGFontFaceNameElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore22SVGFontFaceNameElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore22SVGFontFaceNameElement8srcValueEv
+__ZN7WebCore15SVGGlyphElement19removedFromDocumentEv
+__ZN7WebCore22SVGFontFaceNameElementD0Ev
+__ZThn8_N7WebCore14SVGFontElementD0Ev
+__ZN7WebCoreL28createSVGStyleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGStyleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGStyleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGStyleElementEEE
+__ZN7WebCore17JSSVGStyleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGStyleElementEEE
+__ZN7WebCore17JSSVGStyleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSSVGStyleElement9classInfoEv
+__ZN7WebCore15SVGStyleElement19removedFromDocumentEv
+__ZN7WebCore17JSSVGStyleElementD1Ev
+__ZN7WebCore26JSSVGStyleElementPrototypeD1Ev
+__ZN7WebCore19RenderForeignObject16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestAct
+__ZN7WebCore49jsHTMLFrameElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore49jsHTMLEmbedElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore37jsSVGGElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18RenderSVGContainer17objectBoundingBoxEv
+__ZN7WebCore40jsSVGTextElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14SVGTextElement7getBBoxEv
+__ZN7WebCore26JSSVGImageElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSSVGImageElement9classInfoEv
+__ZN7WebCore41jsSVGImageElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14RenderSVGImage17objectBoundingBoxEv
+__ZN7WebCore40jsSVGRectElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore28jsSVGTextContentElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGRectElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21jsSVGRectElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsSVGStopElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13RenderSVGText16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActionE
+__ZN7WebCore11SVGAElement19defaultEventHandlerEPNS_5EventE
+__ZNK7WebCore11SVGAElement5titleEv
+__ZNK7WebCore11SVGAElement11isFocusableEv
+__ZNK7WebCore11SVGAElement16isMouseFocusableEv
+__ZN7WebCore19RenderSVGInlineText14localCaretRectEPNS_9InlineBoxEiPi
+__ZNK7WebCore11SVGAElement6targetEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_11SVGAElementENS_6StringEXadL_ZNS_8SVGNames10aTagStringEEEXadL_ZNS3_16targetAttrStringEEE
+__ZN7WebCore21jsSVGPathElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14RenderSVGImage16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActionE
+__ZNK7WebCore16SVGScriptElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore15SVGImageElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore41jsSVGDocumentPrototypeFunctionCreateEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12SVGZoomEventC1Ev
+__ZN7WebCore12SVGZoomEventC2Ev
+__ZNK7WebCore12SVGZoomEvent14isSVGZoomEventEv
+__ZN7WebCore15getDOMStructureINS_14JSSVGZoomEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore14JSSVGZoomEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGZoomEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGZoomEventEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGZoomEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGZoomEventEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGZoomEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28jsSVGZoomEventZoomRectScreenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent14zoomRectScreenEv
+__ZN7WebCore27jsSVGZoomEventPreviousScaleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent13previousScaleEv
+__ZN7WebCore31jsSVGZoomEventPreviousTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent17previousTranslateEv
+__ZN7WebCore22jsSVGZoomEventNewScaleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent8newScaleEv
+__ZN7WebCore26jsSVGZoomEventNewTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent12newTranslateEv
+__ZN7WebCore14JSSVGZoomEventD1Ev
+__ZN7WebCore12SVGZoomEventD0Ev
+__ZN7WebCore23JSSVGZoomEventPrototypeD1Ev
+__ZN7WebCore8SVGPaintC1Ev
+__ZN7WebCore8SVGPaintC2Ev
+__ZN7WebCore28jsSVGTextPositioningElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEENS1_29SVGAnimatedTypeW
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEENS1_29SVGAnimatedTypeWr
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_13SVGLengthListEEEPNS_10SVGElementE
+__ZN7WebCore23JSSVGAnimatedLengthList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGAnimatedLengthListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_13SVGLengthListEE
+__ZN7WebCore23JSSVGAnimatedLengthListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_13SVGLengthListEE
+__ZN7WebCore23JSSVGAnimatedLengthList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsSVGAnimatedLengthListBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13SVGLengthListEPNS_10SVGElementE
+__ZN7WebCore15JSSVGLengthList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGLengthListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGLengthListEEEPNS_10SVGElementE
+__ZN7WebCore15JSSVGLengthListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGLengthListEEEPNS_10SVGElementE
+__ZN7WebCore15JSSVGLengthList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28jsSVGLengthListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSSVGLengthListD1Ev
+__ZN7WebCore15JSSVGLengthListD2Ev
+__ZN7WebCore23JSSVGAnimatedLengthListD1Ev
+__ZN7WebCore23JSSVGAnimatedLengthListD2Ev
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEEENS_18Pair
+__ZN7WebCore24JSSVGLengthListPrototypeD1Ev
+__ZN7WebCore32JSSVGAnimatedLengthListPrototypeD1Ev
+__ZN7WebCore29JSSVGClipPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGClipPathElement9classInfoEv
+__ZThn8_N7WebCore14SVGStopElementD0Ev
+__ZN7WebCoreL29createSVGMarkerElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGMarkerElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGMarkerElementEEE
+__ZN7WebCore18JSSVGMarkerElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGMarkerElementEEE
+__ZN7WebCore18JSSVGMarkerElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSSVGMarkerElement9classInfoEv
+__ZN7WebCore18JSSVGMarkerElementD1Ev
+__ZN7WebCoreL27createSVGMaskElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGMaskElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGMaskElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGMaskElementEEE
+__ZN7WebCore16JSSVGMaskElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGMaskElementEEE
+__ZN7WebCore16JSSVGMaskElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGMaskElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGMaskElement9classInfoEv
+__ZN7WebCore16JSSVGMaskElementD1Ev
+__ZN7WebCore25JSSVGMaskElementPrototypeD1Ev
+__ZN7WebCoreL30createSVGPatternElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore19JSSVGPatternElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGPatternElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPatternElementEEE
+__ZN7WebCore19JSSVGPatternElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPatternElementEEE
+__ZN7WebCore19JSSVGPatternElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSSVGPatternElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSSVGPatternElement9classInfoEv
+__ZN7WebCore19JSSVGPatternElementD1Ev
+__ZN7WebCore28JSSVGPatternElementPrototypeD1Ev
+__ZN7WebCore28jsSVGLinearGradientElementX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_24SVGLinearGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23linearGradientTagStringEEEX
+__ZN7WebCore19synchronizePropertyINS_24SVGLinearGradientElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore27jsSVGPathElementPathSegListEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14SVGPathSegListEPNS_10SVGElementE
+__ZN7WebCore16JSSVGPathSegList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGPathSegListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathSegListEEEPNS_10SVGElementE
+__ZN7WebCore16JSSVGPathSegListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathSegListEEEPNS_10SVGElementE
+__ZN7WebCore16JSSVGPathSegList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGPathSegListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore40jsSVGPathSegListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSSVGPathSegList9classInfoEv
+__ZN7WebCore16JSSVGPathSegList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10SVGPathSegEPNS_10SVGElementE
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegMovetoAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegMovetoAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegMovetoAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore12JSSVGPathSegC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10SVGPathSegEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegMovetoAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSSVGPathSegMovetoAbs3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSSVGPathSegMovetoAbsXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21JSSVGPathSegMovetoAbsD1Ev
+__ZN7WebCore12JSSVGPathSegD2Ev
+__ZN7WebCore16JSSVGPathSegListD1Ev
+__ZN7WebCore16JSSVGPathSegListD2Ev
+__ZN7WebCore29jsSVGPathSegListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGPathSegListPrototypeFunctionRemoveItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList10removeItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15getDOMStructureINS_27JSSVGPathSegCurvetoCubicAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicAbsEEEPNS_10SVG
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicAbsEEEPNS_10SVG
+__ZN7WebCore30JSSVGPathSegMovetoAbsPrototypeD1Ev
+__ZN7WebCore25JSSVGPathSegListPrototypeD1Ev
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbsD1Ev
+__ZN7WebCore36JSSVGPathSegCurvetoCubicAbsPrototypeD1Ev
+__ZN7WebCore24jsSVGPatternElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_15wid
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_15widt
+__ZN7WebCore19synchronizePropertyINS_17SVGPatternElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCoreL30createSVGPolygonElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore19JSSVGPolygonElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGPolygonElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPolygonElementEEE
+__ZN7WebCore19JSSVGPolygonElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPolygonElementEEE
+__ZN7WebCore19JSSVGPolygonElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsSVGPolygonElementPointsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SVGPointListEPNS_10SVGElementE
+__ZN7WebCore14JSSVGPointList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGPointListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGPointListEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGPointListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGPointListEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGPointList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsSVGPointListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGPointListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsSVGPointListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSSVGPointList9classInfoEv
+__ZN7WebCore14JSSVGPointList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_10FloatPointEEcvS1_Ev
+__ZNK7WebCore14SVGPODListItemINS_10FloatPointEE5valueEv
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_10FloatPointEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore14SVGPODListItemINS_10FloatPointEE8setValueES1_
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_10FloatPointEED0Ev
+__ZN7WebCore14JSSVGPointListD1Ev
+__ZN7WebCore14JSSVGPointListD2Ev
+__ZN7WebCore41jsSVGPointListPrototypeFunctionRemoveItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSSVGPointList10removeItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore23JSSVGPointListPrototypeD1Ev
+__ZN7WebCore19JSSVGPolygonElementD1Ev
+__ZN7WebCore28JSSVGPolygonElementPrototypeD1Ev
+__ZN7WebCore28jsSVGPolygonElementTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_29SVGStyledTransformableElementENS_16SVGTransformListEXadL_ZNS_39SVGStyledTransformableE
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_16SVGTransformListEEENS1_29SVGAnimatedTy
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_16SVGTransformListEEENS1_29SVGAnimatedTyp
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_16SVGTransformListEEEENS_18P
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_16SVGTransformListEEEPNS_10SVGElementE
+__ZN7WebCore26JSSVGAnimatedTransformList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGAnimatedTransformListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_16SVGTransform
+__ZN7WebCore26JSSVGAnimatedTransformListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_16SVGTransform
+__ZN7WebCore26JSSVGAnimatedTransformList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore33jsSVGAnimatedTransformListBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_16SVGTransformListEPNS_10SVGElementE
+__ZN7WebCore18JSSVGTransformList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGTransformListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGTransformListEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGTransformListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGTransformListEEEPNS_10SVGElementE
+__ZN7WebCore50jsSVGSVGElementPrototypeFunctionCreateSVGTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement18createSVGTransformEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_12SVGTransformEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGTransformC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_12SVGTransformEEEEEPNS_10SV
+__ZN7WebCore14JSSVGTransformC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_12SVGTransformEEEEEPNS_10SV
+__ZN7WebCore14JSSVGTransform18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsSVGTransformPrototypeFunctionSetTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSSVGTransform9classInfoEv
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEEcvS1_Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore18JSSVGTransformList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGTransformListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore45jsSVGTransformListPrototypeFunctionAppendItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSSVGTransformList9classInfoEv
+__ZN7WebCore18JSSVGTransformList10appendItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14toSVGTransformEN3JSC7JSValueE
+__ZN7WebCoreL12finishSetterEPN3JSC9ExecStateERiPNS_10SVGElementEPNS_16SVGTransformListEN3WTF10PassRefPtrINS_14SVGPODListItemINS
+__ZN7WebCore14JSSVGTransformD1Ev
+__ZN7WebCore14JSSVGTransformD2Ev
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_12SVGTransformEED0Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEED0Ev
+__ZN7WebCore18JSSVGTransformListD1Ev
+__ZN7WebCore18JSSVGTransformListD2Ev
+__ZN7WebCore26JSSVGAnimatedTransformListD1Ev
+__ZN7WebCore26JSSVGAnimatedTransformListD2Ev
+__ZN7WebCore42jsSVGTransformListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18JSSVGTransformList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_12SVGTransformEEcvS1_Ev
+__ZNK7WebCore14SVGPODListItemINS_12SVGTransformEE5valueEv
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_12SVGTransformEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore14SVGPODListItemINS_12SVGTransformEE8setValueES1_
+__ZN7WebCore27JSSVGTransformListPrototypeD1Ev
+__ZN7WebCore35JSSVGAnimatedTransformListPrototypeD1Ev
+__ZNK7WebCore13SVGSVGElement11currentViewEv
+__ZN7WebCore11SVGViewSpecC1EPKNS_13SVGSVGElementE
+__ZN7WebCore11SVGViewSpecC2EPKNS_13SVGSVGElementE
+__ZN7WebCore11SVGViewSpec13parseViewSpecERKNS_6StringE
+__ZNK7WebCore11SVGViewSpec14contextElementEv
+__ZN7WebCore11SVGViewSpec19setViewTargetStringERKNS_6StringE
+__ZN7WebCore13SVGSVGElement17setUseCurrentViewEb
+__ZN7WebCore11SVGViewSpecD0Ev
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_8SVGAngleENS1_10StringHashENS_10HashTraitsIS6_EENSA_IS8_
+__ZN7WebCore17SVGResourceMasker10invalidateEv
+__ZN7WebCoreL28createSVGTitleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGTitleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGTitleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTitleElementEEE
+__ZN7WebCore17JSSVGTitleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTitleElementEEE
+__ZN7WebCore17JSSVGTitleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26JSSVGTitleElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSSVGTitleElement9classInfoEv
+__ZN7WebCore17JSSVGTitleElementD1Ev
+__ZN7WebCore26JSSVGTitleElementPrototypeD1Ev
+__ZN7WebCore57jsSVGPathElementPrototypeFunctionGetPresentationAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore47jsSVGPathElementPrototypeFunctionGetTotalLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14SVGPathElement14getTotalLengthEv
+__ZN7WebCore18PathTraversalState12closeSubpathEv
+__ZN7WebCore49jsSVGPathElementPrototypeFunctionGetPointAtLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14SVGPathElement16getPointAtLengthEf
+__ZN7WebCore16SVGInlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore19RenderSVGInlineText16positionForPointERKNS_8IntPointE
+__ZNK7WebCore16SVGInlineTextBox24svgCharacterHitsPositionEiiRi
+__ZNK7WebCore16SVGInlineTextBox26closestCharacterToPositionEiiRi
+__ZN7WebCore18SVGTextChunkWalkerINS_48SVGInlineTextBoxClosestCharacterToPositionWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20Trans
+__ZN7WebCore48SVGInlineTextBoxClosestCharacterToPositionWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20Transformat
+__ZN7WebCoreL31createSVGPolylineElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGPolylineElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGPolylineElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGPolylineElementEEE
+__ZN7WebCore20JSSVGPolylineElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGPolylineElementEEE
+__ZN7WebCore20JSSVGPolylineElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29JSSVGPolylineElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGPolylineElement9classInfoEv
+__ZN7WebCore28JSSVGPolygonElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSSVGPolygonElement9classInfoEv
+__ZN7WebCore20JSSVGPolylineElementD1Ev
+__ZN7WebCore26jsSVGPolylineElementPointsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPointListPrototypeFunctionAppendItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSSVGPointList10appendItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10toSVGPointEN3JSC7JSValueE
+__ZN7WebCoreL12finishSetterEPN3JSC9ExecStateERiPNS_10SVGElementEPNS_12SVGPointListEN3WTF10PassRefPtrINS_14SVGPODListItemINS_10F
+__ZN7WebCore19synchronizePropertyINS_14SVGPolyElementEPNS_12SVGPointListEEEvPKT_RKNS_13QualifiedNameET0_
+__ZNK7WebCore12SVGPointList13valueAsStringEv
+__ZN7WebCore29JSSVGPolylineElementPrototypeD1Ev
+__ZN7WebCore18jsSVGExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21RenderSVGGradientStop29repaintRectInLocalCoordinatesEv
+__ZN7WebCore12RenderObject5paintERNS0_9PaintInfoEii
+__ZN7WebCore16jsNodeOndblclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node10ondblclickEv
+__ZN7WebCore35JSSVGStaticPODTypeWrapperWithParentINS_10FloatPointENS_13SVGSVGElementEEcvS1_Ev
+__ZN7WebCore35JSSVGStaticPODTypeWrapperWithParentINS_10FloatPointENS_13SVGSVGElementEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore13SVGSVGElement19setCurrentTranslateERKNS_10FloatPointE
+__ZNK3WTF7HashMapIN7WebCore6StringEPKNS1_23SVGAnimatedPropertyBaseENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS2_
+__ZN7WebCore38jsSVGSVGElementPrototypeFunctionGetCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore44jsSVGSVGElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore36jsSVGGElementPrototypeFunctionGetCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsSVGGElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore20jsSVGTransformMatrixEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSSVGMatrix3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15setJSSVGMatrixAEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42JSSVGStaticPODTypeWrapperWithPODTypeParentINS_20TransformationMatrixENS_12SVGTransformEE12commitChangeES1_PNS_10S
+__ZN7WebCore42JSSVGStaticPODTypeWrapperWithPODTypeParentINS_20TransformationMatrixENS_12SVGTransformEED0Ev
+__ZN7WebCore60jsSVGTextContentElementPrototypeFunctionGetCharNumAtPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZNK7WebCore21SVGTextContentElement20getCharNumAtPositionERKNS_10FloatPointE
+__ZN7WebCore55jsSVGTextContentElementPrototypeFunctionGetExtentOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZNK7WebCore21SVGTextContentElement15getExtentOfCharEjRi
+__ZN7WebCore33jsSVGTextContentElementTextLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_21SVGTextContentElementENS_9SVGLengthEXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_21SVGTextContentElementES1_NS_9SVGLengthES2_XadL_ZNS_31SVGTextContentElementIdenti
+__ZN7WebCore35jsSVGTextContentElementLengthAdjustEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_21SVGTextContentElementEiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_8SVGNames
+__ZN7WebCore24JSSVGAnimatedEnumeration18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore31jsSVGAnimatedEnumerationBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGAnimatedEnumerationAnimValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_21SVGTextContentElementES1_iiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_21SVGTextContentElementES1_iiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_
+__ZN7WebCoreL27createSVGTRefElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGTRefElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGTRefElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTRefElementEEE
+__ZN7WebCore16JSSVGTRefElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTRefElementEEE
+__ZN7WebCore16JSSVGTRefElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGTRefElement9classInfoEv
+__ZN7WebCore16JSSVGTRefElementD1Ev
+__ZN7WebCore24RenderSVGHiddenContainer16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTe
+__ZN7WebCore25JSSVGTRefElementPrototypeD1Ev
+__ZThn24_N7WebCore18SVGElementInstance20toSVGElementInstanceEv
+__ZN7WebCore18SVGElementInstance20toSVGElementInstanceEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_18SVGElementInstanceE
+__ZN7WebCore20JSSVGElementInstance15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGElementInstanceC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGElementInstanceEEE
+__ZN7WebCore20JSSVGElementInstanceC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGElementInstanceEEE
+__ZN7WebCore20JSSVGElementInstance18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsSVGElementInstanceCorrespondingUseElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsSVGElementInstanceCorrespondingElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGElementInstanceD1Ev
+__ZN7WebCore20JSSVGElementInstanceD2Ev
+__ZN7WebCore30jsSVGElementInstanceParentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGElementInstanceNextSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGElementInstanceFirstChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGElementInstanceLastChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGElementInstancePreviousSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSSVGElementInstancePrototypeD1Ev
+__ZNK7WebCore19JSLazyEventListener20wasCreatedFromMarkupEv
+__ZN7WebCore27jsSVGUseElementInstanceRootEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGUseElement12instanceRootEv
+__ZN7WebCore29JSSVGElementInstancePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGElementInstance9classInfoEv
+__ZN7WebCore53jsSVGElementInstancePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore20JSSVGElementInstance16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore18SVGElementInstance22scriptExecutionContextEv
+__ZN7WebCore18SVGElementInstance16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZNK7WebCore13EventListener20wasCreatedFromMarkupEv
+__ZN7WebCore56jsSVGElementInstancePrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore20JSSVGElementInstance19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore18SVGElementInstance19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore20JSSVGElementInstance4markEv
+__ZN7WebCore50jsSVGElementInstancePrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18SVGElementInstance13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore13JSSVGGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore16JSSVGRectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15JSSVGUseElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19jsSVGUseElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGURIReferenceENS_6StringEXadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkName
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGURIReferenceENS_10SVGElementENS_6StringES3_XadL_ZNS_25SVGURIReferenceIdentifie
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGURIReferenceENS_6StringEXadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkNames
+__ZN7WebCore19synchronizePropertyINS_10SVGElementENS_6StringEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore21SVGDocumentExtensions13reportWarningERKNS_6StringE
+__ZThn8_N7WebCore23SVGForeignObjectElementD0Ev
+__ZN7WebCore16jsSVGUseElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11xAttrString
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGUseElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11
+__ZN7WebCore16jsSVGUseElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11yAttrString
+__ZN7WebCore13SVGZoomAndPan16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore19synchronizePropertyINS_13SVGSVGElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore26jsSVGAltGlyphElementFormatEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18SVGAltGlyphElement6formatEv
+__ZN7WebCore20JSSVGAltGlyphElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSSVGAltGlyphElementFormatEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18SVGAltGlyphElement9setFormatERKNS_12AtomicStringERi
+__ZNK7WebCore19JSSVGAnimatedLength9classInfoEv
+__ZNK7WebCore11JSSVGLength9classInfoEv
+__ZN7WebCoreL35createSVGFontFaceNameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore24JSSVGFontFaceNameElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGFontFaceNameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGFontFaceNameElementEEE
+__ZN7WebCore24JSSVGFontFaceNameElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGFontFaceNameElementEEE
+__ZNK7WebCore24JSSVGFontFaceNameElement9classInfoEv
+__ZN7WebCoreL25fontfaceformatConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore24SVGFontFaceFormatElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore24SVGFontFaceFormatElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL37createSVGFontFaceFormatElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore26JSSVGFontFaceFormatElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGFontFaceFormatElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGFontFaceFormatElementEEE
+__ZN7WebCore26JSSVGFontFaceFormatElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGFontFaceFormatElementEEE
+__ZNK7WebCore26JSSVGFontFaceFormatElement9classInfoEv
+__ZN7WebCoreL34createSVGFontFaceSrcElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore23JSSVGFontFaceSrcElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGFontFaceSrcElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceSrcElementEEE
+__ZN7WebCore23JSSVGFontFaceSrcElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceSrcElementEEE
+__ZNK7WebCore23JSSVGFontFaceSrcElement9classInfoEv
+__ZN7WebCoreL34createSVGFontFaceUriElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore23JSSVGFontFaceUriElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGFontFaceUriElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceUriElementEEE
+__ZN7WebCore23JSSVGFontFaceUriElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceUriElementEEE
+__ZNK7WebCore23JSSVGFontFaceUriElement9classInfoEv
+__ZN7WebCoreL24definitionsrcConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore23SVGDefinitionSrcElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23SVGDefinitionSrcElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL36createSVGDefinitionSrcElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore25JSSVGDefinitionSrcElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGDefinitionSrcElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGDefinitionSrcElementEEE
+__ZN7WebCore25JSSVGDefinitionSrcElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGDefinitionSrcElementEEE
+__ZNK7WebCore25JSSVGDefinitionSrcElement9classInfoEv
+__ZN7WebCore25JSSVGDefinitionSrcElementD1Ev
+__ZThn8_N7WebCore23SVGDefinitionSrcElementD0Ev
+__ZN7WebCore23SVGDefinitionSrcElementD0Ev
+__ZN7WebCore23JSSVGFontFaceUriElementD1Ev
+__ZThn8_N7WebCore21SVGFontFaceUriElementD0Ev
+__ZN7WebCore23JSSVGFontFaceSrcElementD1Ev
+__ZThn8_N7WebCore21SVGFontFaceSrcElementD0Ev
+__ZN7WebCore26JSSVGFontFaceFormatElementD1Ev
+__ZThn8_N7WebCore24SVGFontFaceFormatElementD0Ev
+__ZN7WebCore24SVGFontFaceFormatElementD0Ev
+__ZN7WebCore24JSSVGFontFaceNameElementD1Ev
+__ZThn8_N7WebCore22SVGFontFaceNameElementD0Ev
+__ZThn8_N7WebCore18SVGFontFaceElementD0Ev
+__ZNK7WebCore13HTMLTokenizer10lineNumberEv
+__ZN7WebCore12JSSVGPathSeg18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore31jsSVGPathSegPathSegTypeAsLetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegClosePathEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegClosePath15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegClosePathC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegClosePathEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegClosePathC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegClosePathEEEPNS_10SVGElementE
+__ZNK7WebCore19SVGPathSegClosePath19pathSegTypeAsLetterEv
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegLinetoAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegLinetoAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegLinetoAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34JSSVGDefinitionSrcElementPrototypeD1Ev
+__ZN7WebCore32JSSVGFontFaceUriElementPrototypeD1Ev
+__ZN7WebCore32JSSVGFontFaceSrcElementPrototypeD1Ev
+__ZN7WebCore35JSSVGFontFaceFormatElementPrototypeD1Ev
+__ZN7WebCore33JSSVGFontFaceNameElementPrototypeD1Ev
+__ZN7WebCore21JSSVGPathSegClosePathD1Ev
+__ZN7WebCore21JSSVGPathSegLinetoAbsD1Ev
+__ZN7WebCore24JSSVGLengthListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsSVGLengthListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSSVGLengthList9classInfoEv
+__ZN7WebCore24jsSVGLengthValueAsStringEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEEcvS1_Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEED0Ev
+__ZN7WebCore30JSSVGPathSegClosePathPrototypeD1Ev
+__ZN7WebCore30JSSVGPathSegLinetoAbsPrototypeD1Ev
+__ZN7WebCore22jsSVGPathSegMovetoAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegLinetoAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegLinetoAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPathSegCurvetoCubicAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPathSegCurvetoCubicAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore23jsSVGPathSegPathSegTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore14SVGPathElement25createSVGPathSegMovetoRelEff
+__ZN7WebCore19SVGPathSegMovetoRelC1Eff
+__ZN7WebCore19SVGPathSegMovetoRelC2Eff
+__ZNK7WebCore19SVGPathSegMovetoRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegMovetoRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegMovetoRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegMovetoRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19SVGPathSegMovetoRel19pathSegTypeAsLetterEv
+__ZN7WebCore22jsSVGPathSegMovetoRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegMovetoRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore14SVGPathElement25createSVGPathSegLinetoRelEff
+__ZN7WebCore19SVGPathSegLinetoRelC1Eff
+__ZN7WebCore19SVGPathSegLinetoRelC2Eff
+__ZNK7WebCore19SVGPathSegLinetoRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegLinetoRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegLinetoRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegLinetoRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19SVGPathSegLinetoRel19pathSegTypeAsLetterEv
+__ZN7WebCore22jsSVGPathSegLinetoRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegLinetoRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore64jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKN
+__ZN7WebCore64jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKN
+__ZN7WebCore14SVGPathElement31createSVGPathSegCurvetoCubicRelEffffff
+__ZN7WebCore25SVGPathSegCurvetoCubicRelC1Effffff
+__ZN7WebCore25SVGPathSegCurvetoCubicRelC2Effffff
+__ZNK7WebCore25SVGPathSegCurvetoCubicRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_27JSSVGPathSegCurvetoCubicRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicRelEEEPNS_10SVG
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicRelEEEPNS_10SVG
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25SVGPathSegCurvetoCubicRel19pathSegTypeAsLetterEv
+__ZN7WebCore28jsSVGPathSegCurvetoCubicRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPathSegCurvetoCubicRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegCurvetoQuadraticAbsEffff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticAbsC1Effff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticAbsC2Effff
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegCurvetoQuadraticAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticAbsEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticAbsEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticAbs19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticAbsX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticAbsY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegCurvetoQuadraticRelEffff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticRelC1Effff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticRelC2Effff
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegCurvetoQuadraticRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticRelEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticRelEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticRel19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticRelX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticRelY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore14SVGPathElement22createSVGPathSegArcAbsEfffffbb
+__ZN7WebCore16SVGPathSegArcAbsC1Efffffbb
+__ZN7WebCore16SVGPathSegArcAbsC2Efffffbb
+__ZNK7WebCore16SVGPathSegArcAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_18JSSVGPathSegArcAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore18JSSVGPathSegArcAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGPathSegArcAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcAbsEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcAbsEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16SVGPathSegArcAbs19pathSegTypeAsLetterEv
+__ZN7WebCore19jsSVGPathSegArcAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGPathSegArcAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcAbsR1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcAbsR2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGPathSegArcAbsAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegArcAbsLargeArcFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegArcAbsSweepFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore14SVGPathElement22createSVGPathSegArcRelEfffffbb
+__ZN7WebCore16SVGPathSegArcRelC1Efffffbb
+__ZN7WebCore16SVGPathSegArcRelC2Efffffbb
+__ZNK7WebCore16SVGPathSegArcRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_18JSSVGPathSegArcRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore18JSSVGPathSegArcRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGPathSegArcRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcRelEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcRelEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16SVGPathSegArcRel19pathSegTypeAsLetterEv
+__ZN7WebCore19jsSVGPathSegArcRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGPathSegArcRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcRelR1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcRelR2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGPathSegArcRelAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegArcRelLargeArcFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegArcRelSweepFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegLinetoHorizontalAbsEf
+__ZN7WebCore29SVGPathSegLinetoHorizontalAbsC1Ef
+__ZN7WebCore29SVGPathSegLinetoHorizontalAbsC2Ef
+__ZNK7WebCore29SVGPathSegLinetoHorizontalAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegLinetoHorizontalAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalAbsEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalAbsEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegLinetoHorizontalAbs19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegLinetoHorizontalAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegLinetoHorizontalRelEf
+__ZN7WebCore29SVGPathSegLinetoHorizontalRelC1Ef
+__ZN7WebCore29SVGPathSegLinetoHorizontalRelC2Ef
+__ZNK7WebCore29SVGPathSegLinetoHorizontalRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegLinetoHorizontalRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalRelEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalRelEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegLinetoHorizontalRel19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegLinetoHorizontalRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore66jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueER
+__ZN7WebCore14SVGPathElement33createSVGPathSegLinetoVerticalAbsEf
+__ZN7WebCore27SVGPathSegLinetoVerticalAbsC1Ef
+__ZN7WebCore27SVGPathSegLinetoVerticalAbsC2Ef
+__ZNK7WebCore27SVGPathSegLinetoVerticalAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_29JSSVGPathSegLinetoVerticalAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalAbsEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalAbsEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27SVGPathSegLinetoVerticalAbs19pathSegTypeAsLetterEv
+__ZN7WebCore30jsSVGPathSegLinetoVerticalAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore66jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueER
+__ZN7WebCore14SVGPathElement33createSVGPathSegLinetoVerticalRelEf
+__ZN7WebCore27SVGPathSegLinetoVerticalRelC1Ef
+__ZN7WebCore27SVGPathSegLinetoVerticalRelC2Ef
+__ZNK7WebCore27SVGPathSegLinetoVerticalRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_29JSSVGPathSegLinetoVerticalRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalRelEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalRelEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27SVGPathSegLinetoVerticalRel19pathSegTypeAsLetterEv
+__ZN7WebCore30jsSVGPathSegLinetoVerticalRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore70jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSVal
+__ZN7WebCore14SVGPathElement37createSVGPathSegCurvetoCubicSmoothAbsEffff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothAbsC1Effff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothAbsC2Effff
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_33JSSVGPathSegCurvetoCubicSmoothAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothAbs
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothAbs
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothAbs19pathSegTypeAsLetterEv
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothAbsX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothAbsY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore70jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSVal
+__ZN7WebCore14SVGPathElement37createSVGPathSegCurvetoCubicSmoothRelEffff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothRelC1Effff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothRelC2Effff
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_33JSSVGPathSegCurvetoCubicSmoothRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothRel
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothRel
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothRel19pathSegTypeAsLetterEv
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothRelX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothRelY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore74jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7J
+__ZN7WebCore14SVGPathElement41createSVGPathSegCurvetoQuadraticSmoothAbsEff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothAbsC1Eff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothAbsC2Eff
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_37JSSVGPathSegCurvetoQuadraticSmoothAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlot
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothAbs19pathSegTypeAsLetterEv
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore74jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7J
+__ZN7WebCore14SVGPathElement41createSVGPathSegCurvetoQuadraticSmoothRelEff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothRelC1Eff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothRelC2Eff
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothRel11pathSegTypeEv
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlot
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothRel19pathSegTypeAsLetterEv
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRelD1Ev
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothRelD0Ev
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbsD1Ev
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothAbsD0Ev
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRelD1Ev
+__ZN7WebCore27SVGPathSegLinetoVerticalRelD0Ev
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbsD1Ev
+__ZN7WebCore27SVGPathSegLinetoVerticalAbsD0Ev
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRelD1Ev
+__ZN7WebCore29SVGPathSegLinetoHorizontalRelD0Ev
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbsD1Ev
+__ZN7WebCore29SVGPathSegLinetoHorizontalAbsD0Ev
+__ZN7WebCore18JSSVGPathSegArcRelD1Ev
+__ZN7WebCore16SVGPathSegArcRelD0Ev
+__ZN7WebCore18JSSVGPathSegArcAbsD1Ev
+__ZN7WebCore16SVGPathSegArcAbsD0Ev
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRelD1Ev
+__ZN7WebCore29SVGPathSegCurvetoQuadraticRelD0Ev
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbsD1Ev
+__ZN7WebCore29SVGPathSegCurvetoQuadraticAbsD0Ev
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRelD1Ev
+__ZN7WebCore25SVGPathSegCurvetoCubicRelD0Ev
+__ZN7WebCore21JSSVGPathSegLinetoRelD1Ev
+__ZN7WebCore19SVGPathSegLinetoRelD0Ev
+__ZN7WebCore21JSSVGPathSegMovetoRelD1Ev
+__ZN7WebCore19SVGPathSegMovetoRelD0Ev
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRelD1Ev
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothRelD0Ev
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbsD1Ev
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothAbsD0Ev
+__ZN7WebCore42JSSVGPathSegCurvetoCubicSmoothRelPrototypeD1Ev
+__ZN7WebCore42JSSVGPathSegCurvetoCubicSmoothAbsPrototypeD1Ev
+__ZN7WebCore38JSSVGPathSegLinetoVerticalRelPrototypeD1Ev
+__ZN7WebCore38JSSVGPathSegLinetoVerticalAbsPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegLinetoHorizontalRelPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegLinetoHorizontalAbsPrototypeD1Ev
+__ZN7WebCore27JSSVGPathSegArcRelPrototypeD1Ev
+__ZN7WebCore27JSSVGPathSegArcAbsPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegCurvetoQuadraticRelPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegCurvetoQuadraticAbsPrototypeD1Ev
+__ZN7WebCore36JSSVGPathSegCurvetoCubicRelPrototypeD1Ev
+__ZN7WebCore30JSSVGPathSegLinetoRelPrototypeD1Ev
+__ZN7WebCore30JSSVGPathSegMovetoRelPrototypeD1Ev
+__ZN7WebCore46JSSVGPathSegCurvetoQuadraticSmoothRelPrototypeD1Ev
+__ZN7WebCore46JSSVGPathSegCurvetoQuadraticSmoothAbsPrototypeD1Ev
+__ZN7WebCore36jsSVGImageElementPreserveAspectRatioEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_22SVGPreserveAspectRatioEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatio18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsSVGAnimatedPreserveAspectRatioBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_22SVGPreserveAspectRatioEPNS_10SVGElementE
+__ZN7WebCore24JSSVGPreserveAspectRatioC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGPreserveAspectRatioEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGPreserveAspectRatioC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGPreserveAspectRatioEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGPreserveAspectRatio18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsSVGPreserveAspectRatioAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPreserveAspectRatioMeetOrSliceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSSVGPreserveAspectRatioD1Ev
+__ZN7WebCore24JSSVGPreserveAspectRatioD2Ev
+__ZNK7WebCore8SVGColor10isSVGColorEv
+__ZN7WebCore10JSSVGColorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGColorEEE
+__ZNK7WebCore10JSSVGColor9classInfoEv
+__ZN7WebCore10JSSVGColorD1Ev
+__ZN3WTF7HashSetIdNS_9FloatHashIdEENS_10HashTraitsIdEEE3addERKd
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E6expandEv
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E6rehashEi
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E13allocateTableEi
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14shrinkCapacityEm
+__ZSt21__unguarded_partitionIPN7WebCore8SMILTimeES1_ET_S3_S3_T0_
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E4findIdNS_22IdentityHashTranslatorIddS4_
+__ZSt13__heap_selectIPN7WebCore8SMILTimeEEvT_S3_S3_
+__ZSt9make_heapIPN7WebCore8SMILTimeEEvT_S3_
+__ZSt13__adjust_heapIPN7WebCore8SMILTimeElS1_EvT_T0_S4_T1_
+__ZSt11__push_heapIPN7WebCore8SMILTimeElS1_EvT_T0_S4_T1_
+__ZSt9sort_heapIPN7WebCore8SMILTimeEEvT_S3_
+__ZN7WebCore46jsSVGSVGElementPrototypeFunctionCreateSVGAngleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement14createSVGAngleEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8SVGAngleEPNS_10SVGElementE
+__ZN7WebCore10JSSVGAngleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGAngleEEEPNS_10SVGElementE
+__ZN7WebCore10JSSVGAngleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGAngleEEEPNS_10SVGElementE
+__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement15createSVGLengthEv
+__ZN7WebCoreL29createSVGScriptElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGScriptElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGScriptElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGScriptElementEEE
+__ZN7WebCore18JSSVGScriptElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGScriptElementEEE
+__ZN7WebCore22setJSSVGElementXmlbaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10SVGElement10setXmlbaseERKNS_6StringERi
+__ZN7WebCore10JSSVGAngle3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore26setJSSVGAngleValueAsStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8SVGAngle16setValueAsStringERKNS_6StringE
+__ZN7WebCore8SVGAngle9calculateEv
+__ZN7WebCore10JSSVGAngle18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsSVGAngleValueAsStringEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8SVGAngle13valueAsStringEv
+__ZN7WebCore27setJSSVGLengthValueAsStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore18JSSVGScriptElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSSVGScriptElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSSVGScriptElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsSVGScriptElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16SVGScriptElement4typeEv
+__ZN7WebCore18JSSVGScriptElementD1Ev
+__ZThn8_N7WebCore16SVGScriptElementD0Ev
+__ZN7WebCore10JSSVGAngleD1Ev
+__ZN7WebCore10JSSVGAngleD2Ev
+__ZN7WebCore49jsSVGPathSegListPrototypeFunctionInsertItemBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList16insertItemBeforeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12toSVGPathSegEN3JSC7JSValueE
+__ZN7WebCore44jsSVGPathSegListPrototypeFunctionReplaceItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList11replaceItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore27JSSVGScriptElementPrototypeD1Ev
+__ZN7WebCore43jsSVGPathSegListPrototypeFunctionAppendItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList10appendItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore21JSSVGPathSegMovetoAbs9classInfoEv
+__ZN7WebCore22jsSVGGElementTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGTransformListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19SVGAnimatedPropertyINS_29SVGStyledTransformableElementENS_16SVGTransformListEXadL_ZNS_39SVGStyledTransformableEl
+__ZN7WebCore19synchronizePropertyINS_29SVGStyledTransformableElementEPNS_16SVGTransformListEEEvPKT_RKNS_13QualifiedNameET0_
+__ZNK7WebCore16SVGTransformList13valueAsStringEv
+__ZN7WebCore22jsSVGScriptElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSSVGScriptElement9classInfoEv
+__ZN7WebCore43jsSVGScriptElementExternalResourcesRequiredEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGAnimatedBoolean3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore30setJSSVGAnimatedBooleanBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZThn288_NK7WebCore16SVGScriptElement18typeAttributeValueEv
+__ZNK7WebCore16SVGScriptElement18typeAttributeValueEv
+__ZThn288_NK7WebCore16SVGScriptElement22languageAttributeValueEv
+__ZNK7WebCore16SVGScriptElement22languageAttributeValueEv
+__ZThn288_NK7WebCore16SVGScriptElement17forAttributeValueEv
+__ZNK7WebCore16SVGScriptElement17forAttributeValueEv
+__ZThn288_N7WebCore16SVGScriptElement18dispatchErrorEventEv
+__ZN7WebCore16SVGScriptElement18dispatchErrorEventEv
+__ZN7WebCoreL24createSVGAElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore13JSSVGAElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSSVGAElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGAElementEEE
+__ZN7WebCore13JSSVGAElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGAElementEEE
+__ZN7WebCore13JSSVGAElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSSVGAElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13JSSVGAElement9classInfoEv
+__ZN7WebCore22JSSVGAElementPrototypeD1Ev
+__ZN7WebCore13JSSVGAElementD1Ev
+__ZN7WebCore17jsSVGAElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGAElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_11SVGAElementENS_6StringEXadL_ZNS_8SVGNames10aTagStringEEEXadL_ZNS3_16targetAttrStringEE
+__ZN7WebCore20jsSVGCircleElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cxAtt
+__ZN7WebCore20jsSVGCircleElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cyAtt
+__ZN7WebCore19jsSVGCircleElementREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_11rAttr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGCircleElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15circleTagStringEEEXadL_Z
+__ZN7WebCoreL29createSVGCursorElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGCursorElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGCursorElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCursorElementEEE
+__ZN7WebCore18JSSVGCursorElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCursorElementEEE
+__ZN7WebCore18JSSVGCursorElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGCursorElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSSVGCursorElement9classInfoEv
+__ZN7WebCore6CursorC1EPNS_5ImageERKNS_8IntPointE
+__ZN7WebCore6CursorC2EPNS_5ImageERKNS_8IntPointE
+__ZN7WebCore18JSSVGCursorElementD1Ev
+__ZN7WebCore27JSSVGCursorElementPrototypeD1Ev
+__ZN7WebCore19jsSVGCursorElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCursorElementENS_9SVGLengthEXadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11xAttr
+__ZN7WebCore19jsSVGCursorElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCursorElementENS_9SVGLengthEXadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11yAttr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGCursorElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15cursorTagStringEEEXadL_Z
+__ZN7WebCore21jsSVGEllipseElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cxA
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGEllipseElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16ellipseTagStringEEEXadL
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_17SVGEllipseElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16ellipseTagStringEEEXad
+__ZN7WebCore21jsSVGEllipseElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cyA
+__ZN7WebCore21jsSVGEllipseElementRxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12rxA
+__ZN7WebCore21jsSVGEllipseElementRyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12ryA
+__ZN7WebCoreL36createSVGForeignObjectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore25JSSVGForeignObjectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGForeignObjectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGForeignObjectElementEEE
+__ZN7WebCore25JSSVGForeignObjectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGForeignObjectElementEEE
+__ZN7WebCore25JSSVGForeignObjectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34JSSVGForeignObjectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSSVGForeignObjectElement9classInfoEv
+__ZN7WebCore25JSSVGForeignObjectElementD1Ev
+__ZN7WebCore34JSSVGForeignObjectElementPrototypeD1Ev
+__ZN7WebCore31jsSVGForeignObjectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19synchronizePropertyINS_23SVGForeignObjectElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore30jsSVGForeignObjectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsSVGForeignObjectElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_23SVGForeignObjectElementENS_9SVGLengthEXadL_ZNS_8SVGNames22foreignObjectTagStringEEEXad
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_23SVGForeignObjectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames22foreignObjectTagS
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_23SVGForeignObjectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames22foreignObjectTag
+__ZNK7WebCore19SVGAnimatedPropertyINS_23SVGForeignObjectElementENS_9SVGLengthEXadL_ZNS_8SVGNames22foreignObjectTagStringEEEXadL
+__ZN7WebCore26jsSVGForeignObjectElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19synchronizePropertyINS_15SVGImageElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_22SVGPreserveAspectRatioEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_Z
+__ZN7WebCore24JSSVGPreserveAspectRatio3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSSVGPreserveAspectRatioAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22SVGPreserveAspectRatio8setAlignEt
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_15widthAtt
+__ZN7WebCore18jsSVGImageElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11xAttrSt
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGImageElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_15SVGImageElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZN
+__ZN7WebCore18jsSVGImageElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11yAttrSt
+__ZN7WebCore18jsSVGLineElementX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x1AttrStr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGLineElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGLineElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3
+__ZN7WebCore18jsSVGLineElementX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x2AttrStr
+__ZN7WebCore18jsSVGLineElementY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y1AttrStr
+__ZN7WebCore18jsSVGLineElementY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y2AttrStr
+__ZN7WebCore15setJSSVGMatrixEEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18jsSVGTransformTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGTransformAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGGradientElementGradientTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_18SVGGradientElementENS_16SVGTransformListEXadL_ZNS_28SVGGradientElementIdentifierEEEXad
+__ZN7WebCore33jsSVGGradientElementGradientUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_18SVGGradientElementEiXadL_ZNS_28SVGGradientElementIdentifierEEEXadL_ZNS_8SVGNames23grad
+__ZN7WebCore28jsSVGLinearGradientElementX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLinearGradientElementY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_24SVGLinearGradientElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames23linearGradientTa
+__ZN7WebCore28jsSVGLinearGradientElementY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19SVGAnimatedTemplateINS_9SVGLengthEED2Ev
+__ZN7WebCore30jsSVGMarkerElementMarkerHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_22marke
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15markerTagStringEEEXadL_
+__ZN7WebCore29jsSVGMarkerElementMarkerUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementEiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS2_21markerUnitsAttrStr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_iiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS2_21markerUni
+__ZN7WebCore29jsSVGMarkerElementMarkerWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_21marke
+__ZN7WebCore28jsSVGMarkerElementOrientTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementEiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_27SVGOrientTypeAttrId
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_iiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_27SVGOrientT
+__ZN7WebCore29jsSVGMarkerElementOrientAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_8SVGAngleEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_28SVGOrie
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_8SVGAngleEEENS1_29SVGAnimatedTypeWrapper
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_8SVGAngleEEENS1_29SVGAnimatedTypeWrapperK
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_8SVGAngleEEEENS_18PairFirstE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_8SVGAngleEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGAnimatedAngle15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGAnimatedAngleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_8SVGAngleEEEEEPNS_10SV
+__ZN7WebCore18JSSVGAnimatedAngleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_8SVGAngleEEEEEPNS_10SV
+__ZN7WebCore18JSSVGAnimatedAngle18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsSVGAnimatedAngleBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsSVGAngleValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18setJSSVGAngleValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8SVGAngle8setValueEf
+__ZN7WebCore18JSSVGAnimatedAngleD1Ev
+__ZN7WebCore18JSSVGAnimatedAngleD2Ev
+__ZN7WebCore27JSSVGAnimatedAnglePrototypeD1Ev
+__ZN7WebCore22jsSVGMarkerElementRefXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refXA
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15markerTagStringEEEXadL_Z
+__ZN7WebCore22jsSVGMarkerElementRefYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refYA
+__ZN7WebCore51jsSVGMarkerElementPrototypeFunctionSetOrientToAngleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10toSVGAngleEN3JSC7JSValueE
+__ZNK7WebCore10JSSVGAngle9classInfoEv
+__ZN7WebCore16SVGMarkerElement16setOrientToAngleEN3WTF10PassRefPtrINS_8SVGAngleEEE
+__ZN7WebCore50jsSVGMarkerElementPrototypeFunctionSetOrientToAutoEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16SVGMarkerElement15setOrientToAutoEv
+__ZN7WebCore22jsSVGMaskElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_16heightAtt
+__ZN7WebCore32jsSVGMaskElementMaskContentUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_26maskContentUnitsAttrSt
+__ZN7WebCore25jsSVGMaskElementMaskUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEE
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGMaskElementES1_iiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttr
+__ZN7WebCore21jsSVGMaskElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_15widthAttr
+__ZN7WebCore17jsSVGMaskElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11xAttrStri
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGMaskElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGMaskElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3
+__ZN7WebCore17jsSVGMaskElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11yAttrStri
+__ZN7WebCore25jsSVGPatternElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_16hei
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16patternTagStringEEEXad
+__ZN7WebCore38jsSVGPatternElementPatternContentUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_29patternContentUn
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_iiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_29pattern
+__ZN7WebCore35jsSVGPatternElementPatternTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_16SVGTransformListEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZN
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_NS_16SVGTransformListEPS2_XadL_ZNS_8SVGNames16patternTagStri
+__ZN7WebCore31jsSVGPatternElementPatternUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_22patternUnitsAttr
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_22patternUnitsAttrS
+__ZN7WebCore20jsSVGPatternElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11xAt
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16patternTagStringEEEXadL
+__ZN7WebCore20jsSVGPatternElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11yAt
+__ZN7WebCoreL37createSVGRadialGradientElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore26JSSVGRadialGradientElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGRadialGradientElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGRadialGradientElementEEE
+__ZN7WebCore26JSSVGRadialGradientElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGRadialGradientElementEEE
+__ZN7WebCore26JSSVGRadialGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSSVGRadialGradientElement9classInfoEv
+__ZN7WebCore26JSSVGRadialGradientElementD1Ev
+__ZN7WebCore35JSSVGRadialGradientElementPrototypeD1Ev
+__ZN7WebCore28jsSVGRadialGradientElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_24SVGRadialGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23radialGradientTagStringEEEX
+__ZN7WebCore19synchronizePropertyINS_24SVGRadialGradientElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore28jsSVGRadialGradientElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGRadialGradientElementFxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGRadialGradientElementFyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGRadialGradientElementREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_24SVGRadialGradientElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames23radialGradientTa
+__ZN7WebCore50jsSVGLengthPrototypeFunctionNewValueSpecifiedUnitsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9SVGLength22newValueSpecifiedUnitsEtf
+__ZNK7WebCore24RenderSVGHiddenContainer20isSVGHiddenContainerEv
+__ZNK7WebCore4Font32selectionRectForTextUsingSVGFontERKNS_7TextRunERKNS_8IntPointEiii
+__ZNK7WebCore16SVGCursorElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore16SVGScriptElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore8CSSValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
 __ZN7WebCore25jsHTMLAreaElementHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIlLm16EE14expandCapacityEm
+__ZN3WTF6VectorIlLm16EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE15reserveCapacityEm
+__ZN7WebCore14RenderTableCol12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore18RenderTableSection12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore48jsWebKitCSSMatrixPrototypeFunctionSetMatrixValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsWebKitCSSMatrixPrototypeFunctionMultiplyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17toWebKitCSSMatrixEN3JSC7JSValueE
+__ZNK7WebCore15WebKitCSSMatrix8multiplyEPS0_
+__ZN7WebCore15WebKitCSSMatrixC1ERKNS_20TransformationMatrixE
+__ZN7WebCore15WebKitCSSMatrixC2ERKNS_20TransformationMatrixE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15WebKitCSSMatrixE
+__ZN7WebCore41jsWebKitCSSMatrixPrototypeFunctionInverseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix7inverseERi
+__ZN7WebCore43jsWebKitCSSMatrixPrototypeFunctionTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix9translateEddd
+__ZN7WebCore39jsWebKitCSSMatrixPrototypeFunctionScaleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix5scaleEddd
+__ZN7WebCore40jsWebKitCSSMatrixPrototypeFunctionRotateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix6rotateEddd
+__ZN7WebCore14JSCSSValueList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZNK7WebCore23WebKitCSSTransformValue25isWebKitCSSTransformValueEv
+__ZN7WebCore25JSWebKitCSSTransformValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23WebKitCSSTransformValueEEE
+__ZN7WebCore25JSWebKitCSSTransformValueC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23WebKitCSSTransformValueEEE
+__ZNK7WebCore25JSWebKitCSSTransformValue9classInfoEv
+__ZN7WebCore25JSWebKitCSSTransformValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSWebKitCSSTransformValuePrototype9classInfoEv
+__ZN7WebCore36jsWebKitCSSTransformValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsWebKitCSSTransformValueOperationTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSWebKitCSSTransformValueD1Ev
+__ZNK7WebCore24ShorthandPropertyWrapper6equalsEPKNS_11RenderStyleES3_
+__ZNK7WebCore24ShorthandPropertyWrapper5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS4_S7_d
+__ZN7WebCore11RenderStyle22setBackgroundXPositionENS_6LengthE
+__ZN7WebCore11RenderStyle22setBackgroundYPositionENS_6LengthE
+__ZNK7WebCore15PropertyWrapperINS_10LengthSizeEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS6_S9_d
+__ZN7WebCore11RenderStyle17setBackgroundSizeENS_10LengthSizeE
+__ZN7WebCore19AnimationController21pauseTransitionAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore26AnimationControllerPrivate21pauseTransitionAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore18CompositeAnimation21pauseTransitionAtTimeEid
+__ZN7WebCore4Node29dispatchWebKitTransitionEventERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore21WebKitTransitionEventC1ERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore21WebKitTransitionEventC2ERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore11RenderStyle16setMaskXPositionENS_6LengthE
+__ZN7WebCore11RenderStyle16setMaskYPositionENS_6LengthE
+__ZN7WebCore11RenderStyle11setMaskSizeENS_10LengthSizeE
+__ZNK7WebCore21PropertyWrapperShadow5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS4_S7_d
+__ZNK7WebCore15PropertyWrapperItE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
+__ZN7WebCore11RenderStyle17setBorderTopWidthEt
+__ZN7WebCore11RenderStyle19setBorderRightWidthEt
+__ZN7WebCore11RenderStyle20setBorderBottomWidthEt
+__ZN7WebCore11RenderStyle18setBorderLeftWidthEt
+__ZN7WebCore11RenderStyle19setTransformOriginXENS_6LengthE
+__ZN7WebCore11RenderStyle19setTransformOriginYENS_6LengthE
+__ZN7WebCore11RenderStyle12setMarginTopENS_6LengthE
+__ZN7WebCore11RenderStyle14setMarginRightENS_6LengthE
+__ZN7WebCore11RenderStyle15setMarginBottomENS_6LengthE
+__ZN7WebCore11RenderStyle13setMarginLeftENS_6LengthE
+__ZNK7WebCore15PropertyWrapperIRKNS_7IntSizeEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
+__ZN7WebCore11RenderStyle23setBorderTopRightRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle22setBorderTopLeftRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle25setBorderBottomLeftRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle26setBorderBottomRightRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle15setOutlineColorERKNS_5ColorE
+__ZNK7WebCore15PropertyWrapperIiE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
+__ZN7WebCore11RenderStyle16setOutlineOffsetEi
+__ZN7WebCore11RenderStyle15setOutlineWidthEt
+__ZN7WebCore11RenderStyle13setPaddingTopENS_6LengthE
+__ZN7WebCore11RenderStyle15setPaddingRightENS_6LengthE
+__ZN7WebCore11RenderStyle16setPaddingBottomENS_6LengthE
+__ZN7WebCore11RenderStyle14setPaddingLeftENS_6LengthE
+__ZN7WebCore35setJSDOMWindowOnwebkittransitionendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow24setOnwebkittransitionendEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore27jsNodeIteratorReferenceNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsNodeIteratorPointerBeforeReferenceNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15HTMLBodyElement25didMoveToNewOwnerDocumentEv
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7ArchiveEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7ArchiveEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE6shrinkEm
+__ZN7WebCore16LegacyWebArchive6createEPNS_5FrameE
+__ZNK7WebCore14DocumentLoader15getSubresourcesERN3WTF6VectorINS1_10PassRefPtrINS_15ArchiveResourceEEELm0EEE
+__ZNK7WebCore14DocumentLoader12mainResourceEv
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE14expandCapacityEmPKS4_
+__ZN7WebCore13CSSImportRule23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore15CSSFontFaceRule23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore19CSSFontFaceSrcValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZN7WebCore19CSSBorderImageValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZN7WebCore15CSSReflectValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZNK7WebCore20HTMLFrameElementBase14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore17HTMLObjectElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore14ArchiveFactory6createEPNS_12SharedBufferERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEPFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEENS1_15CaseFoldingHashENS_10HashTraitsI
+__ZN7WebCoreL20archiveFactoryCreateINS_16LegacyWebArchiveEEEN3WTF10PassRefPtrINS_7ArchiveEEEPNS_12SharedBufferE
+__ZN7WebCore14DocumentLoader20setParsedArchiveDataEN3WTF10PassRefPtrINS_12SharedBufferEEE
+-[DOMElement(WebPrivate) isFocused]
+__ZN7WebCore11RenderStyle13setCursorListEN3WTF10PassRefPtrINS_10CursorListEEE
+__ZNK7WebCore9Tokenizer15isHTMLTokenizerEv
+__ZN7WebCore11HistoryItem12setViewStateEP11objc_object
+__ZN7WebCore9InlineBox16placeEllipsisBoxEbiiiRb
+__ZN7WebCore9InlineBox15clearTruncationEv
+__ZN7WebCoreL9stateBoldEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL11stateItalicEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL18stateStrikethroughEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore21ProcessingInstruction18maxCharacterOffsetEv
+__ZN7WebCore15setJSNodeOndragEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOndragEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore39setJSHTMLOptionsCollectionSelectedIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21HTMLOptionsCollection16setSelectedIndexEi
+__ZN7WebCore35jsCanvasRenderingContext2DLineWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsCanvasRenderingContext2DMiterLimitEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39setJSCanvasRenderingContext2DMiterLimitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D13setMiterLimitEf
+__ZN7WebCore14jsNodeOnscrollEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onscrollEv
+__ZN7WebCore19JSSVGAnimatedString18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsSVGDefsElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGGradientElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsSVGStopElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGGElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGCircleElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore27RenderTextControlSingleLine9scrollTopEv
+__ZN7WebCore32jsCanvasRenderingContext2DCanvasEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18LocalStorageThread14scheduleImportEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageTaskC2ENS0_4TypeEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageArea13performImportEv
+__ZN7WebCore12LocalStorage20fullDatabaseFilenameEPNS_14SecurityOriginE
+__ZN7WebCore10HTMLParser15popInlineBlocksEv
+__ZN7WebCore26NetscapePlugInStreamLoader7didFailERKNS_13ResourceErrorE
+__ZN7WebCore18LocalStorageThread12scheduleSyncEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageArea11performSyncEv
+__ZN7WebCore16LocalStorageArea4syncEbRKN3WTF7HashMapINS_6StringES3_NS_10StringHashENS1_10HashTraitsIS3_EES6_EE
+__ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
+__ZN7WebCore12IconDatabase14checkIntegrityEv
+__ZNK7WebCore32HTMLFileUploadInnerButtonElement12isShadowNodeEv
+__ZN7WebCore32HTMLFileUploadInnerButtonElement16shadowParentNodeEv
+__ZN7WebCore16JSSVGLineElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21jsSVGLineElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14ResourceHandle12releaseProxyEv
+__ZNK7WebCore14ResourceHandle10connectionEv
+__ZN7WebCore31jsConsolePrototypeFunctionDebugEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console5debugEPNS_15ScriptCallStackE
+__ZNK7WebCore11RenderBlock20adjustRectForColumnsERNS_7IntRectE
+__ZN7WebCore13jsNodeOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onerrorEv
+__ZNK7WebCore13ChildNodeList11nodeMatchesEPNS_7ElementE
+__ZN7WebCore29setJSHTMLStyleElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLStyleElement11setDisabledEb
+__ZN7WebCore4Node11appendChildEN3WTF10PassRefPtrIS0_EERib
+__ZN7WebCore27setJSHTMLImageElementHspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setHspaceEi
+__ZN7WebCore27setJSHTMLImageElementVspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setVspaceEi
+__ZN7WebCore14ResourceLoader13cannotShowURLEPNS_14ResourceHandleE
+__ZN7WebCore14ResourceLoader18cannotShowURLErrorEv
+__ZN3WTF6VectorItLm16EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm16EE14expandCapacityEm
+__ZN3WTF6VectorItLm16EE15reserveCapacityEm
+__ZN7WebCore31SearchFieldResultsButtonElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore11RenderStyle8setColorERKNS_5ColorE
+__ZN7WebCore18jsSVGGElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSSVGPathElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore19JSSVGAnimatedString9classInfoEv
+__ZN7WebCore25jsSVGPathElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11HistoryItem20setTransientPropertyERKNS_6StringEP11objc_object
+__ZN3WTF7HashMapIN7WebCore6StringENS_9RetainPtrIP11objc_objectEENS1_10StringHashENS_10HashTraitsIS2_EENS8_IS6_EEE3setERKS2_RKS6
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_9RetainPtrIP11objc_objectEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_
+__ZNK3WTF7HashMapIN7WebCore6StringENS_9RetainPtrIP11objc_objectEENS1_10StringHashENS_10HashTraitsIS2_EENS8_IS6_EEE3getERKS2_
+__ZN7WebCore5TimerINS_12RenderButtonEE5firedEv
+__ZN7WebCore12RenderButton10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore5TimerINS_12RenderButtonEED0Ev
+__ZN7WebCore11RenderStyle9setBottomENS_6LengthE
+__ZN7WebCore23jsHTMLAnchorElementPortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4portEv
+__ZN7WebCore16LocalStorageArea17scheduleFinalSyncEv
+__ZN7WebCore10moveCursorEv
+__ZN7WebCore19jsWheelEventOffsetXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12EventHandler17eventMayStartDragERKNS_18PlatformMouseEventE
+__ZN7WebCore12zoomInCursorEv
+__ZN7WebCore18ImageEventListener11handleEventEPNS_5EventEb
+__ZN7WebCore13ImageDocument12imageClickedEii
+__ZN7WebCore13ImageDocument16restoreImageSizeEv
+__ZN7WebCore13zoomOutCursorEv
+-[WebCoreMenuTarget validateMenuItem:]
+__ZN7WebCore15ContextMenuItemC1EP10NSMenuItem
+__ZN7WebCore15ContextMenuItemC2EP10NSMenuItem
+__ZNK7WebCore15ContextMenuItem7enabledEv
+__ZThn8_N7WebCore20ImageDocumentElementD0Ev
+__ZThn32_N7WebCore8DOMTimer6resumeEv
+__ZN7WebCore16HTMLInputElement23documentDidBecomeActiveEv
+__ZN7WebCore5Frame24searchForLabelsAboveCellEPNS_17RegularExpressionEPNS_20HTMLTableCellElementE
+__ZN7WebCore15BackForwardList17backListWithLimitEiRN3WTF6VectorINS1_6RefPtrINS_11HistoryItemEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14expandCapacityEmPKS4_
+__ZN7WebCore11HistoryItem10targetItemEv
+__ZN7WebCore11HistoryItem14findTargetItemEv
+__ZN7WebCore27RenderTextControlSingleLine6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore11EllipsisBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCoreL15executeMoveDownEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore25jsHTMLAreaElementProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore7DataRefINS_16StyleMarqueeDataEE6accessEv
+__ZN7WebCore14RenderMenuList9showPopupEv
+__ZN7WebCore9PopupMenuC1EPNS_15PopupMenuClientE
+__ZN7WebCore9PopupMenuC2EPNS_15PopupMenuClientE
+__ZN7WebCore9PopupMenu4showERKNS_7IntRectEPNS_9FrameViewEi
+__ZN7WebCore9PopupMenu8populateEv
+__ZThn200_NK7WebCore14RenderMenuList13shouldPopOverEv
+__ZNK7WebCore14RenderMenuList13shouldPopOverEv
+__ZThn200_NK7WebCore14RenderMenuList8listSizeEv
+__ZNK7WebCore14RenderMenuList8listSizeEv
+__ZThn200_NK7WebCore14RenderMenuList15itemIsSeparatorEj
+__ZNK7WebCore14RenderMenuList15itemIsSeparatorEj
+__ZThn200_NK7WebCore14RenderMenuList9itemStyleEj
+__ZNK7WebCore14RenderMenuList9itemStyleEj
+__ZNK7WebCore14RenderMenuList19itemBackgroundColorEj
+__ZNK7WebCore5Color5blendERKS0_
+__ZThn200_NK7WebCore14RenderMenuList8itemTextEj
+__ZNK7WebCore14RenderMenuList8itemTextEj
+__ZThn200_NK7WebCore14RenderMenuList13itemIsEnabledEj
+__ZNK7WebCore14RenderMenuList13itemIsEnabledEj
+__ZThn200_NK7WebCore14RenderMenuList9menuStyleEv
+__ZNK7WebCore14RenderMenuList9menuStyleEv
+__ZThn200_N7WebCore14RenderMenuList9hidePopupEv
+__ZN7WebCore14RenderMenuList9hidePopupEv
+__ZN7WebCore9PopupMenu4hideEv
+__ZN7WebCore12EventHandler33sendFakeEventsAfterWidgetTrackingEP7NSEvent
+__ZN7WebCore9PopupMenuD1Ev
+__ZN7WebCore9PopupMenuD2Ev
+__ZN7WebCore10waitCursorEv
+__ZN7WebCore14ScrollbarTheme26shouldSnapBackToDragOriginEPNS_9ScrollbarERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar9moveThumbEi
+__ZThn200_N7WebCore14RenderMenuList12valueChangedEjb
+__ZN7WebCore14RenderMenuList12valueChangedEjb
+__ZN7WebCore9PopupMenu5clearEv
+-[DOMHTMLInputElement(FormAutoFillTransition) _rectOnScreen]
+__ZN7WebCore11RenderImage20intrinsicSizeChangedEv
+__ZNK7WebCore27RenderTextControlSingleLine12scrollHeightEv
+__ZNK7WebCore17HTMLSelectElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZN7WebCore31jsHTMLInputElementIndeterminateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLInputElementFilesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8FileListE
+__ZN7WebCore12jsNodeOndragEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node6ondragEv
+__ZN7WebCore16HTMLInputElement18setActivatedSubmitEb
+__ZN7WebCore23SubresourceLoaderClient11didSendDataEPNS_17SubresourceLoaderEyy
+-[DOMHTMLInputElement(FormAutoFillTransition) _selectedRange]
+-[DOMHTMLInputElement(FormAutoFillTransition) _replaceCharactersInRange:withString:selectingFromIndex:]
+__ZNK7WebCore16VisibleSelection5isAllENS_21StayInEditableContentE
+__ZNK7WebCore12RenderObject24shouldPaintSelectionGapsEv
+__ZN7WebCore11FrameLoader16canHandleRequestERKNS_15ResourceRequestE
+__ZN7WebCore14scaleDragImageEN3WTF9RetainPtrI7NSImageEENS_9FloatSizeE
+-[WebCoreMenuTarget forwardContextMenuAction:]
+__ZN7WebCore21ContextMenuController23contextMenuItemSelectedEPNS_15ContextMenuItemE
+__ZN7WebCore6Editor7copyURLERKNS_4KURLERKNS_6StringE
+__ZN7WebCore10Pasteboard8writeURLERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZN7WebCore13JSPluginArray16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore5Cache13getStatisticsEv
+__ZN7WebCore5Cache13TypeStatistic11addResourceEPNS_14CachedResourceE
+__ZNK7WebCore14CachedResource11isPurgeableEv
+__ZN7WebCore12IconDatabase19pageURLMappingCountEv
+__ZN7WebCore12IconDatabase20retainedPageURLCountEv
+__ZN7WebCore12IconDatabase15iconRecordCountEv
+__ZN7WebCore12IconDatabase23iconRecordCountWithDataEv
+__ZN7WebCore9FontCache13fontDataCountEv
+__ZN7WebCore9FontCache21inactiveFontDataCountEv
+__ZN7WebCore17GlyphPageTreeNode18treeGlyphPageCountEv
+__ZNK7WebCore17GlyphPageTreeNode9pageCountEv
+__ZN7WebCore13jsNodeOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onabortEv
+__ZN7WebCore34jsConsolePrototypeFunctionGroupEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console8groupEndEv
+__ZN7WebCore19InspectorController8endGroupENS_13MessageSourceEjRKNS_6StringE
+__ZN7WebCore15StringTruncator13rightTruncateERKNS_6StringEfRKNS_4FontEb
+__ZN7WebCore17ScrollbarThemeMac14backButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
+__ZN7WebCoreL17buttonRepaintRectERKNS_7IntRectENS_20ScrollbarOrientationENS_20ScrollbarControlSizeEb
+__ZN7WebCore9FrameView29forceLayoutWithPageWidthRangeEffb
+__ZN7WebCore9FrameView16adjustPageHeightEPffff
+__ZN7WebCore18correctedTextColorENS_5ColorES0_
+__ZN7WebCore15GraphicsContext21focusRingBoundingRectEv
+__ZN7WebCore12RenderObject13addPDFURLRectEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore15GraphicsContext13setURLForRectERKNS_4KURLERKNS_7IntRectE
+-[DOMHTMLInputElement readOnly]
+__ZN7WebCore8Document23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
+__ZNK7WebCore5Frame18selectionTextRectsERN3WTF6VectorINS_9FloatRectELm0EEEb
+__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE15reserveCapacityEm
+__ZNK7WebCore9FrameTree24traversePreviousWithWrapEb
+__ZNK7WebCore9FrameTree13deepLastChildEv
+__ZNK7WebCore5Frame12selectedTextEv
+__ZN7WebCore14RenderReplaced20intrinsicSizeChangedEv
+__ZN7WebCore11FrameLoader26reloadWithOverrideEncodingERKNS_6StringE
+__ZN7WebCore15BackForwardList12containsItemEPNS_11HistoryItemE
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore11HistoryItemEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA
+_WebCoreSetAlwaysUsesComplexTextCodePath
+__ZN7WebCore4Font11setCodePathENS0_8CodePathE
+__ZN7WebCore20NetworkStateNotifier20dynamicStoreCallbackEPK16__SCDynamicStorePK9__CFArrayPv
+__ZN7WebCore5TimerINS_20NetworkStateNotifierEE5firedEv
+__ZN7WebCore20NetworkStateNotifier28networkStateChangeTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore11FrameLoader26saveDocumentAndScrollStateEv
+__ZNK7WebCore11HistoryItem4copyEv
+__ZN3WTF6VectorIiLm0EEC1ERKS1_
+__ZN3WTF6VectorIiLm0EEC2ERKS1_
+__ZN7WebCore19InspectorController4showEv
+__ZN7WebCore19InspectorController20clearConsoleMessagesEv
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE14shrinkCapacityEm
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore25InspectorDatabaseResourceEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashT
+__ZN7WebCore19InspectorController27windowScriptObjectAvailableEv
+__ZN7WebCore19scriptStateFromPageEPNS_4PageE
+__ZN7WebCore18ScriptGlobalObject3setEPN3JSC9ExecStateEPKcPNS_19InspectorControllerE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19InspectorControllerE
+__ZN7WebCore21JSInspectorController15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSInspectorControllerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19InspectorControllerEEE
+__ZN7WebCore21JSInspectorControllerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19InspectorControllerEEE
+__ZN7WebCoreL15handleExceptionEPN3JSC9ExecStateE
+__ZN7WebCore21JSInspectorController18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSInspectorControllerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore57jsInspectorControllerPrototypeFunctionLocalizedStringsURLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZNK7WebCore21JSInspectorController9classInfoEv
+__ZN7WebCore19InspectorController19localizedStringsURLEv
+__ZN7WebCore46jsInspectorControllerPrototypeFunctionPlatformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19InspectorController8platformEv
+__ZN7WebCore50jsInspectorControllerPrototypeFunctionHiddenPanelsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController12hiddenPanelsEv
+__ZN7WebCore50jsInspectorControllerPrototypeFunctionWrapCallbackEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21JSInspectorController12wrapCallbackEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore26JSInspectorCallbackWrapper4wrapEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore26JSInspectorCallbackWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getE
+__ZN7WebCore26JSInspectorCallbackWrapperC1EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN7WebCore26JSInspectorCallbackWrapperC2EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN7WebCore26JSQuarantinedObjectWrapperC2EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore26JSInspectorCallbackWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setER
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore26JSInspectorCallbackWrapperEENS_18PairFirstExtractorIS8_EENS_7PtrHashI
+__ZN7WebCore58jsInspectorControllerPrototypeFunctionHideDOMNodeHighlightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore19InspectorController13hideHighlightEv
+__ZN7WebCore54jsInspectorControllerPrototypeFunctionSearchingForNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionInspectedWindowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore21JSInspectorController15inspectedWindowEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24JSInspectedObjectWrapper4wrapEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCoreL8wrappersEv
+__ZNK3WTF7HashMapIPN3JSC14JSGlobalObjectEPNS0_IPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS5_EENS_10HashTr
+__ZN7WebCore24JSInspectedObjectWrapperC1EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN7WebCore24JSInspectedObjectWrapperC2EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN3WTF7HashMapIPN3JSC14JSGlobalObjectEPNS0_IPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS5_EENS_10HashTra
+__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectESt4pairIS3_PNS_7HashMapIPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHa
+__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore24JSInspectedObjectWrapperEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3
+__ZN7WebCore26JSQuarantinedObjectWrapper18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSInspectedObjectWrapper17allowsGetPropertyEv
+__ZNK7WebCore26JSQuarantinedObjectWrapper18unwrappedExecStateEv
+__ZNK7WebCore24JSInspectedObjectWrapper17wrapOutgoingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getERK
+__ZNK7WebCore26JSQuarantinedObjectWrapper28transferExceptionToExecStateEPN3JSC9ExecStateE
+__ZN7WebCore26JSQuarantinedObjectWrapper17cachedValueGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionIsWindowVisibleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionDebuggerEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore55jsInspectorControllerPrototypeFunctionPauseOnExceptionsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore19InspectorController17pauseOnExceptionsEv
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionProfilerEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore44jsInspectorControllerPrototypeFunctionLoadedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController17scriptObjectReadyEv
+__ZN7WebCore18ScriptGlobalObject3getEPN3JSC9ExecStateEPKcRNS_12ScriptObjectE
+__ZN7WebCore12ScriptObjectC1EPN3JSC8JSObjectE
+__ZN7WebCore12ScriptObjectC2EPN3JSC8JSObjectE
+__ZN7WebCore19InspectorController10showWindowEv
+__ZN7WebCore19InspectorController16setWindowVisibleEbb
+__ZN7WebCore19InspectorController17setAttachedWindowEb
+__ZN7WebCore18ScriptFunctionCallC1EPN3JSC9ExecStateERKNS_12ScriptObjectERKNS_6StringE
+__ZN7WebCore18ScriptFunctionCallC2EPN3JSC9ExecStateERKNS_12ScriptObjectERKNS_6StringE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEb
+__ZN7WebCore18ScriptFunctionCall4callEv
+__ZN7WebCore18ScriptFunctionCall4callERbb
+__ZN7WebCore44jsInspectorControllerPrototypeFunctionAttachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController12attachWindowEv
+__ZN7WebCore19InspectorController21populateScriptObjectsEv
+__ZN7WebCoreL18callSimpleFunctionEPN3JSC9ExecStateERKNS_12ScriptObjectEPKc
+__ZN7WebCore19InspectorController9showPanelENS0_13SpecialPanelsE
+__ZN7WebCore17InspectorResource18updateScriptObjectEPN3JSC9ExecStateE
+__ZN7WebCore19InspectorController18resetScriptObjectsEv
+__ZN7WebCore17InspectorResource19releaseScriptObjectEPN3JSC9ExecStateERKNS_12ScriptObjectEb
+__ZN7WebCore26JSQuarantinedObjectWrapper11getCallDataERN3JSC8CallDataE
+__ZNK7WebCore24JSInspectedObjectWrapper20allowsCallAsFunctionEv
+__ZN7WebCore26JSQuarantinedObjectWrapper4callEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7JSValueERKNS1_7ArgListE
+__ZNK7WebCore24JSInspectedObjectWrapper20prepareIncomingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26JSQuarantinedObjectWrapper9asWrapperEN3JSC7JSValueE
+__ZNK7WebCore24JSInspectedObjectWrapper9classInfoEv
+__ZNK7WebCore26JSQuarantinedObjectWrapper25allowsUnwrappedAccessFromEPN3JSC9ExecStateE
+__ZN7WebCore26JSQuarantinedObjectWrapper15unwrappedObjectEv
+__ZNK7WebCore26JSInspectorCallbackWrapper9classInfoEv
+__ZN7WebCore17InspectorResource18createScriptObjectEPN3JSC9ExecStateERKNS_12ScriptObjectE
+__ZN7WebCoreL19createHeadersObjectEPN3JSC9ExecStateERKNS_13HTTPHeaderMapEb
+__ZN7WebCore12ScriptObject9createNewEPN3JSC9ExecStateE
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateERKNS_6StringES6_
+__ZN7WebCore18ScriptFunctionCall14appendArgumentERKNS_12ScriptObjectE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentERKNS_6StringE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEx
+__ZN7WebCore18ScriptFunctionCall9constructERbb
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcRKNS_6StringE
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcx
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKci
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcRKS0_
+__ZNK7WebCore17InspectorResource4typeEv
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcd
+__ZN7WebCore26getQuarantinedScriptObjectEPNS_9DOMWindowERNS_12ScriptObjectE
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcb
+__ZN7WebCore26JSQuarantinedObjectWrapper4markEv
+__ZN7WebCore24JSInspectedObjectWrapperD1Ev
+__ZN7WebCore24JSInspectedObjectWrapperD2Ev
+__ZN7WebCore26JSQuarantinedObjectWrapperD2Ev
+__ZNK7WebCore26JSQuarantinedObjectWrapper17allowsGetPropertyEv
+__ZNK7WebCore26JSInspectorCallbackWrapper20allowsCallAsFunctionEv
+__ZNK7WebCore26JSInspectorCallbackWrapper20prepareIncomingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26JSQuarantinedObjectWrapper3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore24JSInspectedObjectWrapper17allowsSetPropertyEv
+__ZN7WebCore36jsNodePrototypeFunctionHasAttributesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSQuarantinedObjectWrapper18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore48jsElementPrototypeFunctionScrollIntoViewIfNeededEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element22scrollIntoViewIfNeededEb
+__ZN7WebCore11jsAttrStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSInspectorCallbackWrapper17wrapOutgoingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26JSInspectorCallbackWrapperD1Ev
+__ZN7WebCore26JSInspectorCallbackWrapperD2Ev
+__ZN7WebCore17InspectorResource12createCachedExPNS_14DocumentLoaderEPKNS_14CachedResourceE
+__ZN7WebCore14ConsoleMessage12addToConsoleEPN3JSC9ExecStateERKNS_12ScriptObjectE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEj
+__ZN7WebCore17InspectorResource22setXMLHttpResponseTextERKNS_12ScriptStringE
+__ZN7WebCore54jsInspectorControllerPrototypeFunctionHighlightDOMNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore21JSInspectorController16highlightDOMNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore19InspectorController9highlightEPNS_4NodeE
+__ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
+__ZN7WebCoreL19drawHighlightForBoxERNS_15GraphicsContextERKNS_9FloatQuadES4_S4_S4_
+__ZN7WebCoreL16drawOutlinedQuadERNS_15GraphicsContextERKNS_9FloatQuadERKNS_5ColorE
+__ZN7WebCoreL10quadToPathERKNS_9FloatQuadE
+__ZN7WebCore44jsInspectorControllerPrototypeFunctionDetachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController12detachWindowEv
+__ZN7WebCore56jsInspectorControllerPrototypeFunctionMoveByUnrestrictedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZNK7WebCore19InspectorController12moveWindowByEff
+__ZN7WebCoreL24drawOutlinedQuadWithClipERNS_15GraphicsContextERKNS_9FloatQuadES4_RKNS_5ColorE
+__ZN7WebCore62jsInspectorControllerPrototypeFunctionAddResourceSourceToFrameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0
+__ZN7WebCore21JSInspectorController24addResourceSourceToFrameEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore17InspectorResource12sourceStringEv
+__ZN7WebCore19InspectorController16addSourceToFrameERKNS_6StringES3_PNS_4NodeE
+__ZN7WebCore11FrameLoader5beginEv
+__ZN7WebCore22HTMLViewSourceDocument7addLinkERKNS_6StringEb
+__ZN7WebCore19createTextTokenizerEPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore13TextTokenizerC1EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore13TextTokenizerC2EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore22HTMLViewSourceDocument17addViewSourceTextERKNS_6StringE
+__ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableDebuggerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController14enableDebuggerEv
+__ZN7WebCore21JavaScriptDebugServer11addListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
+__ZN3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EE
+__ZN3WTF7HashSetIPN7WebCore23JavaScriptDebugListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore23JavaScriptDebugListenerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_
+__ZN7WebCore21JavaScriptDebugServer14didAddListenerEPNS_4PageE
+__ZN7WebCore4Page11setDebuggerEPN3JSC8DebuggerE
+__ZN7WebCore21JavaScriptDebugServer16clearBreakpointsEv
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEEKNS_7HashMapIlS7_NS2_ImEENS4_IlEENS4_IS7_EEEEE
+__ZNK7WebCore25JSCanvasGradientPrototype9classInfoEv
+__ZNK7WebCore30JSInspectorControllerPrototype9classInfoEv
+__ZN3WTF7HashMapIPN3JSC14SourceProviderEPNS1_9ExecStateENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
+__ZN3WTF9HashTableIPN3JSC14SourceProviderESt4pairIS3_PNS1_9ExecStateEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHa
+__ZN7WebCore21JavaScriptDebugServer12sourceParsedEPN3JSC9ExecStateERKNS1_10SourceCodeEiRKNS1_7UStringE
+__ZN7WebCoreL6toPageEPN3JSC14JSGlobalObjectE
+__ZNK3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_E
+__ZN7WebCoreL22dispatchDidParseSourceERKN3WTF7HashSetIPNS_23JavaScriptDebugListenerENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEEP
+__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE15reserveCapacityEm
+__ZN7WebCore19InspectorController14didParseSourceEPN3JSC9ExecStateERKNS1_10SourceCodeE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentERKN3JSC7UStringE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEi
+__ZN7WebCore54jsInspectorControllerPrototypeFunctionAddSourceToFrameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore21JSInspectorController16addSourceToFrameEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore32jsConsolePrototypeFunctionAssertEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console15assertConditionEbPNS_15ScriptCallStackE
+__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE6shrinkEm
+__ZN7WebCore21JavaScriptDebugServer9callEventERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore19JavaScriptCallFrameC1ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
+__ZN7WebCore19JavaScriptCallFrameC2ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
+__ZN7WebCore21JavaScriptDebugServer13pauseIfNeededEPNS_4PageE
+__ZNK7WebCore21JavaScriptDebugServer13hasBreakpointElj
+__ZNK3WTF7HashMapIlPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEENS2_ImEENS4_IlEENS4_IS7_EEE3getERKl
+__ZN7WebCore21JavaScriptDebugServer11atStatementERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore21JavaScriptDebugServer11returnEventERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore19JavaScriptCallFrame6callerEv
+__ZN3WTF10RefCountedIN7WebCore19JavaScriptCallFrameEE5derefEv
+__ZN7WebCore21JavaScriptDebugServer18willExecuteProgramERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore21JavaScriptDebugServer17didExecuteProgramERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore46jsInspectorControllerPrototypeFunctionProfilesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21JSInspectorController8profilesEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableProfilerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore32JSHTMLOptionsCollectionPrototype9classInfoEv
+__ZN7WebCore21JavaScriptDebugServer15continueProgramEv
+__ZN7WebCore21JavaScriptDebugServer9exceptionERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore52jsInspectorControllerPrototypeFunctionStartProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore51jsInspectorControllerPrototypeFunctionStopProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
+__ZN7WebCore19InspectorController15disableDebuggerEv
+__ZN7WebCore21JavaScriptDebugServer14removeListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
+__ZN3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_E
+__ZN7WebCore21JavaScriptDebugServer17didRemoveListenerEPNS_4PageE
+__ZN7WebCore21JavaScriptDebugServer21didRemoveLastListenerEv
+__ZN7WebCore5Frame17setIsDisconnectedEb
+__ZN7WebCore19InspectorController11closeWindowEv
+__ZN7WebCoreL19getUniqueIdCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCore28setJSHTMLTableColElementSpanEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableColElement7setSpanEi
+__ZN7WebCoreL12getTotalTimeEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL7getHeadEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL10getCallUIDEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL9getParentEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL11getSelfTimeEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL16getNumberOfCallsEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionWindowUnloadingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore11HistoryItem11setReferrerERKNS_6StringE
+-[DOMHTMLTextAreaElement form]
+-[DOMHTMLTextAreaElement(FormPromptAdditions) _isEdited]
+__Z4coreP22DOMHTMLTextAreaElement
+__ZN7WebCore4Page9goForwardEv
+__ZN7WebCoreL11scanForFormEPNS_4NodeE
+__ZN7WebCore3macERKNS_23AuthenticationChallengeE
+__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeEPNS_14ResourceHandleERKNS_23AuthenticationChallengeE
+__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
+__ZN7WebCore11FrameLoader33didReceiveAuthenticationChallengeEPNS_14ResourceLoaderERKNS_23AuthenticationChallengeE
+-[WebCoreResourceHandleAsDelegate useCredential:forAuthenticationChallenge:]
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE6shrinkEm
+__ZNK3JSC8Bindings9ObjcField17valueFromInstanceEPNS_9ExecStateEPKNS0_8InstanceE
+__ZN7WebCore12RenderObject23collectDashboardRegionsERN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN7WebCore12RenderObject19addDashboardRegionsERN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE15reserveCapacityEm
+__ZNK7WebCore8Document16dashboardRegionsEv
+__ZN3WTFeqIN7WebCore20DashboardRegionValueELm0EEEbRKNS_6VectorIT_XT0_EEES7_
+__ZN7WebCore8Document19setDashboardRegionsERKN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EEaSERKS3_
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE14shrinkCapacityEm
+__ZN7WebCore5Frame26dashboardRegionsDictionaryEv
+-[WebDashboardRegion initWithRect:clip:type:]
+-[WebDashboardRegion dashboardRegionType]
+-[WebDashboardRegion dashboardRegionClip]
+-[WebDashboardRegion dashboardRegionRect]
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE6shrinkEm
+__ZNK7WebCore16PDFDocumentImage23hasSingleSecurityOriginEv
+__ZN7WebCore11RenderStyle20noneDashboardRegionsEv
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEaSERKS3_
+__ZN7WebCore12RenderInline19addDashboardRegionsERN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN3JSC8Bindings12ObjcInstance24setValueOfUndefinedFieldEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueE
+__ZN7WebCore10RenderView13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+__ZN7WebCoreL21printSourceURLAndLineERKNS_6StringEj
+__ZN7WebCoreL32printMessageSourceAndLevelPrefixENS_13MessageSourceENS_12MessageLevelE
+-[AccessibilityObjectWrapper position]
+__ZN7WebCore17SubresourceLoader33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
+__ZThn16_N7WebCore24DocumentThreadableLoader33didReceiveAuthenticationChallengeEPNS_17SubresourceLoaderERKNS_23AuthenticationCh
+__ZN7WebCore24DocumentThreadableLoader33didReceiveAuthenticationChallengeEPNS_17SubresourceLoaderERKNS_23AuthenticationChalleng
+__ZN7WebCore57jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore26JSCanvasRenderingContext2D14setStrokeColorEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D14setStrokeColorERKNS_6StringEf
+__ZN7WebCore11CanvasStyleC1ERKNS_6StringEf
+__ZN7WebCore11CanvasStyleC2ERKNS_6StringEf
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionSetLineWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionSetLineCapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
diff --git a/WebCore/WebCore.pro b/WebCore/WebCore.pro
index e992828..f98f186 100644
--- a/WebCore/WebCore.pro
+++ b/WebCore/WebCore.pro
@@ -14,23 +14,38 @@
     PRECOMPILED_HEADER = $$PWD/../WebKit/qt/WebKit_pch.h
     DEFINES *= NDEBUG
 } else {
-    win32-*:!static: DEFINES += QT_MAKEDLL
+    !static: DEFINES += QT_MAKEDLL
+
+    CONFIG(debug, debug|release) {
+        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
+        OBJECTS_DIR = obj/debug
+    } else { # Release
+        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
+        OBJECTS_DIR = obj/release
+    }
+
+    DESTDIR = $$OUTPUT_DIR/lib
 }
 
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR/
-win32-*|wince*: GENERATED_SOURCES_DIR_SLASH ~= s|/|\|
-unix:QMAKE_PKGCONFIG_REQUIRES = QtCore QtDBus QtGui QtNetwork QtXml
+GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR${QMAKE_DIR_SEP}
 
-!CONFIG(QTDIR_build) {
-     OBJECTS_DIR = tmp
-     DESTDIR = $$OUTPUT_DIR/lib
+unix {
+    QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork
+    lessThan(QT_MINOR_VERSION, 4): QMAKE_PKGCONFIG_REQUIRES += QtXml
 }
 
 include($$OUTPUT_DIR/config.pri)
 
 CONFIG -= warn_on
 *-g++*:QMAKE_CXXFLAGS += -Wreturn-type -fno-strict-aliasing
+
+# Disable a few warnings on Windows. The warnings are also
+# disabled in WebKitLibraries/win/tools/vsprops/common.vsprops
+win32-*: QMAKE_CXXFLAGS += -wd4291 -wd4344
+
+unix:!mac:*-g++*:QMAKE_CXXFLAGS += -ffunction-sections -fdata-sections 
+unix:!mac:*-g++*:QMAKE_LFLAGS += -Wl,--gc-sections
+
 #QMAKE_CXXFLAGS += -Wall -Wno-undef -Wno-unused-parameter
 
 CONFIG(release):!CONFIG(QTDIR_build) {
@@ -41,13 +56,6 @@
 linux-*: DEFINES += HAVE_STDINT_H
 freebsd-*: DEFINES += HAVE_PTHREAD_NP_H
 
-# PRE-BUILD: make the required config.h file
-#config_h.target = config.h
-#config_h.commands = cp config.h.qmake config.h
-#config_h.depends = config.h.qmake
-#QMAKE_EXTRA_TARGETS += config_h
-#PRE_TARGETDEPS += config.h
-
 DEFINES += BUILD_WEBKIT
 
 win32-*: DEFINES += _HAS_TR1=0
@@ -80,34 +88,48 @@
 
 # Optional components (look for defs in config.h and included files!)
 
-# turn off database support if we do not have sqlite3 support 
-!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_DATABASE=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
+contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0
+}
 
+# turn off SQLITE support if we do not have sqlite3 available
+!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_SQLITE=0 ENABLE_DATABASE=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
+
+!contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
+!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
 !contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 !contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
 !contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
 
-# turn on database support if any of the dependent features are turned on
-!contains(DEFINES, ENABLE_DATABASE=1) {
-  contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
-    DEFINES += ENABLE_DATABASE=1
+# turn on SQLITE support if any of the dependent features are turned on
+!contains(DEFINES, ENABLE_SQLITE=.) {
+  contains(DEFINES, ENABLE_DATABASE=1)|contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
+    DEFINES += ENABLE_SQLITE=1
+  } else {
+    DEFINES += ENABLE_SQLITE=0
   }
 }
 
-# if database support is not on by now, turn it off 
-!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=0
-
 !contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
+!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=0
 !contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
+!contains(DEFINES, ENABLE_XSLT=.): DEFINES += ENABLE_XSLT=0
 #!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
 !contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
-!contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
-!contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
-!contains(DEFINES, ENABLE_SVG_FILTERS=.): DEFINES += ENABLE_SVG_FILTERS=1
-!contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
-!contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
-!contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
-!contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
+!contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
+!contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
+
+# SVG support
+!contains(DEFINES, ENABLE_SVG=0) {
+    !contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
+    !contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
+    !contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
+    !contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
+    !contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
+    !contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
+} else {
+    DEFINES += ENABLE_SVG_FONTS=0 ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_ANIMATION=0 ENABLE_SVG_AS_IMAGE=0 ENABLE_SVG_USE=0
+}
 
 # HTML5 media support
 !contains(DEFINES, ENABLE_VIDEO=.) {
@@ -126,16 +148,8 @@
 
 DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
 
-INCLUDEPATH += $$PWD $$PWD/../JavaScriptCore $$PWD/../JavaScriptCore/ForwardingHeaders \
-               $$PWD/../JavaScriptCore/interpreter \
-               $$PWD/../JavaScriptCore/bytecode \
-               $$PWD/../JavaScriptCore/debugger \
-               $$PWD/../JavaScriptCore/parser \
-               $$PWD/../JavaScriptCore/runtime \
-               $$PWD/../JavaScriptCore/bindings \
-               $$PWD/../JavaScriptCore/wrec \
-               $$PWD/../JavaScriptCore/jit \
-               $$PWD/../JavaScriptCore/wtf \
+# Ensure that we pick up WebCore's config.h over JavaScriptCore's
+INCLUDEPATH = $$PWD $$INCLUDEPATH
 
 include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
 
@@ -148,21 +162,16 @@
     $$PWD/platform/graphics/filters \
     $$PWD/platform/graphics/transforms \
     $$PWD/platform/graphics/qt \
-    $$PWD/svg/graphics/qt \
-    $$PWD/loader \
     $$PWD/page/qt \
     $$PWD/../WebKit/qt/WebCoreSupport \
-    $$PWD/../WebKit/qt/Api \
-    $$PWD/bridge/qt
 
 # Make sure storage/ appears before JavaScriptCore/. Both provide LocalStorage.h
 # but the header from the former include path is included across directories while
 # LocalStorage.h is included only from files within the same directory
 INCLUDEPATH = $$PWD/storage $$INCLUDEPATH
 
-INCLUDEPATH +=  $$PWD \
+INCLUDEPATH +=  $$PWD/accessibility \
                 $$PWD/ForwardingHeaders \
-                $$PWD/.. \
                 $$PWD/platform \
                 $$PWD/platform/animation \
                 $$PWD/platform/network \
@@ -180,7 +189,6 @@
                 $$PWD/dom \
                 $$PWD/page \
                 $$PWD/page/animation \
-                $$PWD/bridge \
                 $$PWD/editing \
                 $$PWD/rendering \
                 $$PWD/rendering/style \
@@ -196,8 +204,8 @@
                 $$PWD/plugins \
                 $$PWD/bridge \
                 $$PWD/bridge/c \
-                $$PWD/bridge/qt \
-                $$GENERATED_SOURCES_DIR
+                $$PWD/bridge/qt
+INCLUDEPATH *=  $$GENERATED_SOURCES_DIR
 
 QT += network
 lessThan(QT_MINOR_VERSION, 4): QT += xml
@@ -317,6 +325,7 @@
     html/CanvasRenderingContext2D.idl \
     html/File.idl \
     html/FileList.idl \
+    html/HTMLAudioElement.idl \
     html/HTMLAnchorElement.idl \
     html/HTMLAppletElement.idl \
     html/HTMLAreaElement.idl \
@@ -353,6 +362,7 @@
     html/HTMLLinkElement.idl \
     html/HTMLMapElement.idl \
     html/HTMLMarqueeElement.idl \
+    html/HTMLMediaElement.idl \
     html/HTMLMenuElement.idl \
     html/HTMLMetaElement.idl \
     html/HTMLModElement.idl \
@@ -367,6 +377,7 @@
     html/HTMLQuoteElement.idl \
     html/HTMLScriptElement.idl \
     html/HTMLSelectElement.idl \
+    html/HTMLSourceElement.idl \
     html/HTMLStyleElement.idl \
     html/HTMLTableCaptionElement.idl \
     html/HTMLTableCellElement.idl \
@@ -377,9 +388,11 @@
     html/HTMLTextAreaElement.idl \
     html/HTMLTitleElement.idl \
     html/HTMLUListElement.idl \
+    html/HTMLVideoElement.idl \
     html/ImageData.idl \
+    html/MediaError.idl \
     html/TextMetrics.idl \
-    inspector/JavaScriptCallFrame.idl \
+    html/VoidCallback.idl \
     inspector/InspectorController.idl \
     page/BarInfo.idl \
     page/Console.idl \
@@ -394,24 +407,34 @@
     page/PositionError.idl \
     page/Screen.idl \
     page/WebKitPoint.idl \
-    page/WorkerNavigator.idl \
     plugins/Plugin.idl \
     plugins/MimeType.idl \
     plugins/PluginArray.idl \
     plugins/MimeTypeArray.idl \
-    workers/Worker.idl \
-    workers/WorkerContext.idl \
-    workers/WorkerLocation.idl \
     xml/DOMParser.idl \
     xml/XMLHttpRequest.idl \
     xml/XMLHttpRequestException.idl \
     xml/XMLHttpRequestProgressEvent.idl \
     xml/XMLHttpRequestUpload.idl \
-    xml/XMLSerializer.idl \
-    xml/XSLTProcessor.idl
+    xml/XMLSerializer.idl
 
 
 SOURCES += \
+    accessibility/AccessibilityImageMapLink.cpp \
+    accessibility/AccessibilityObject.cpp \    
+    accessibility/AccessibilityList.cpp \    
+    accessibility/AccessibilityListBox.cpp \    
+    accessibility/AccessibilityListBoxOption.cpp \    
+    accessibility/AccessibilityRenderObject.cpp \    
+    accessibility/AccessibilityARIAGrid.cpp \    
+    accessibility/AccessibilityARIAGridCell.cpp \    
+    accessibility/AccessibilityARIAGridRow.cpp \    
+    accessibility/AccessibilityTable.cpp \    
+    accessibility/AccessibilityTableCell.cpp \    
+    accessibility/AccessibilityTableColumn.cpp \    
+    accessibility/AccessibilityTableHeaderContainer.cpp \    
+    accessibility/AccessibilityTableRow.cpp \    
+    accessibility/AXObjectCache.cpp \
     bindings/js/GCController.cpp \
     bindings/js/JSAttrCustom.cpp \
     bindings/js/JSCDATASectionCustom.cpp \
@@ -421,6 +444,7 @@
     bindings/js/JSCSSRuleCustom.cpp \
     bindings/js/JSCSSStyleDeclarationCustom.cpp \
     bindings/js/JSCSSValueCustom.cpp \
+    bindings/js/JSCoordinatesCustom.cpp \
     bindings/js/JSCustomPositionCallback.cpp \
     bindings/js/JSCustomPositionErrorCallback.cpp \
     bindings/js/JSCustomVoidCallback.cpp \
@@ -438,7 +462,6 @@
     bindings/js/JSGeolocationCustom.cpp \
     bindings/js/JSHTMLAllCollection.cpp \
     bindings/js/JSHistoryCustom.cpp \
-    bindings/js/JSJavaScriptCallFrameCustom.cpp \
     bindings/js/JSHTMLAppletElementCustom.cpp \
     bindings/js/JSHTMLCollectionCustom.cpp \
     bindings/js/JSHTMLDocumentCustom.cpp \
@@ -478,8 +501,6 @@
     bindings/js/JSXMLHttpRequestConstructor.cpp \
     bindings/js/JSXMLHttpRequestCustom.cpp \
     bindings/js/JSXMLHttpRequestUploadCustom.cpp \
-    bindings/js/JSXSLTProcessorConstructor.cpp \
-    bindings/js/JSXSLTProcessorCustom.cpp \
     bindings/js/JSPluginCustom.cpp \
     bindings/js/JSPluginArrayCustom.cpp \
     bindings/js/JSMessageChannelConstructor.cpp \
@@ -494,9 +515,11 @@
     bindings/js/ScriptCallFrame.cpp \
     bindings/js/ScriptCallStack.cpp \
     bindings/js/ScriptController.cpp \
+    bindings/js/ScriptEventListener.cpp \
     bindings/js/ScriptFunctionCall.cpp \
     bindings/js/ScriptObject.cpp \
     bindings/js/ScriptObjectQuarantine.cpp \
+    bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
     bridge/IdentifierRep.cpp \
@@ -576,6 +599,7 @@
     dom/BeforeUnloadEvent.cpp \
     dom/CDATASection.cpp \
     dom/CharacterData.cpp \
+    dom/CheckedRadioButtons.cpp \
     dom/ChildNodeList.cpp \
     dom/ClassNames.cpp \
     dom/ClassNodeList.cpp \
@@ -601,8 +625,6 @@
     dom/EventTarget.cpp \
     dom/ExceptionBase.cpp \
     dom/ExceptionCode.cpp \
-    dom/FormControlElementWithState.cpp \
-    dom/FormControlElement.cpp \
     dom/InputElement.cpp \
     dom/KeyboardEvent.cpp \
     dom/MappedAttribute.cpp \
@@ -632,6 +654,7 @@
     dom/RegisteredEventListener.cpp \
     dom/ScriptElement.cpp \
     dom/ScriptExecutionContext.cpp \
+    dom/SelectElement.cpp \
     dom/SelectorNodeList.cpp \
     dom/StaticNodeList.cpp \
     dom/StaticStringList.cpp \
@@ -649,6 +672,7 @@
     dom/WheelEvent.cpp \
     dom/XMLTokenizer.cpp \
     dom/XMLTokenizerQt.cpp \
+    dom/XMLTokenizerScope.cpp \
     editing/AppendNodeCommand.cpp \
     editing/ApplyStyleCommand.cpp \
     editing/BreakBlockquoteCommand.cpp \
@@ -680,6 +704,7 @@
     editing/RemoveFormatCommand.cpp \
     editing/RemoveNodeCommand.cpp \
     editing/RemoveNodePreservingChildrenCommand.cpp \
+    editing/ReplaceNodeWithSpanCommand.cpp \
     editing/ReplaceSelectionCommand.cpp \
     editing/SelectionController.cpp \
     editing/SetNodeAttributeCommand.cpp \
@@ -705,6 +730,7 @@
     html/CanvasPixelArray.cpp \
     html/CanvasRenderingContext2D.cpp \
     html/CanvasStyle.cpp \
+    html/CollectionCache.cpp \
     html/File.cpp \
     html/FileList.cpp \
     html/FormDataList.cpp \
@@ -768,6 +794,7 @@
     html/HTMLPreElement.cpp \
     html/HTMLQuoteElement.cpp \
     html/HTMLScriptElement.cpp \
+    html/HTMLNoScriptElement.cpp \
     html/HTMLSelectElement.cpp \
     html/HTMLStyleElement.cpp \
     html/HTMLTableCaptionElement.cpp \
@@ -789,11 +816,9 @@
     inspector/InspectorDatabaseResource.cpp \
     inspector/InspectorDOMStorageResource.cpp \
     inspector/InspectorController.cpp \
+    inspector/InspectorFrontend.cpp \
     inspector/InspectorResource.cpp \
-    inspector/JavaScriptCallFrame.cpp \
-    inspector/JavaScriptDebugServer.cpp \
-    inspector/JavaScriptProfile.cpp \
-    inspector/JavaScriptProfileNode.cpp \
+    inspector/JSONObject.cpp \
     loader/archive/ArchiveFactory.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
@@ -832,24 +857,11 @@
     loader/TextDocument.cpp \
     loader/TextResourceDecoder.cpp \
     loader/ThreadableLoader.cpp \
-    loader/WorkerThreadableLoader.cpp \
-    page/AccessibilityImageMapLink.cpp \
-    page/AccessibilityObject.cpp \    
-    page/AccessibilityList.cpp \    
-    page/AccessibilityListBox.cpp \    
-    page/AccessibilityListBoxOption.cpp \    
-    page/AccessibilityRenderObject.cpp \    
-    page/AccessibilityTable.cpp \    
-    page/AccessibilityTableCell.cpp \    
-    page/AccessibilityTableColumn.cpp \    
-    page/AccessibilityTableHeaderContainer.cpp \    
-    page/AccessibilityTableRow.cpp \    
     page/animation/AnimationBase.cpp \
     page/animation/AnimationController.cpp \
     page/animation/CompositeAnimation.cpp \
     page/animation/ImplicitAnimation.cpp \
     page/animation/KeyframeAnimation.cpp \
-    page/AXObjectCache.cpp \
     page/BarInfo.cpp \
     page/Chrome.cpp \
     page/Console.cpp \
@@ -873,6 +885,7 @@
     page/MouseEventWithHitTestResults.cpp \
     page/Page.cpp \
     page/PageGroup.cpp \
+    page/PageGroupLoadDeferrer.cpp \
     page/PrintContext.cpp \
     page/SecurityOrigin.cpp \
     page/Screen.cpp \
@@ -987,7 +1000,6 @@
     rendering/InlineFlowBox.cpp \
     rendering/InlineTextBox.cpp \
     rendering/LayoutState.cpp \
-    rendering/ListMarkerBox.cpp \
     rendering/RenderApplet.cpp \
     rendering/RenderArena.cpp \
     rendering/RenderBlock.cpp \
@@ -1064,35 +1076,13 @@
     rendering/style/StyleTransformData.cpp \
     rendering/style/StyleVisualData.cpp \
     xml/DOMParser.cpp \
-    xml/NativeXPathNSResolver.cpp \
     xml/XMLHttpRequest.cpp \
     xml/XMLHttpRequestUpload.cpp \
-    xml/XMLSerializer.cpp \
-    xml/XPathEvaluator.cpp \
-    xml/XPathExpression.cpp \
-    xml/XPathExpressionNode.cpp \
-    xml/XPathFunctions.cpp \
-    xml/XPathNamespace.cpp \
-    xml/XPathNodeSet.cpp \
-    xml/XPathNSResolver.cpp \
-    xml/XPathParser.cpp \
-    xml/XPathPath.cpp \
-    xml/XPathPredicate.cpp \
-    xml/XPathResult.cpp \
-    xml/XPathStep.cpp \
-    xml/XPathUtil.cpp \
-    xml/XPathValue.cpp \
-    xml/XPathVariableReference.cpp \
-    xml/XSLImportRule.cpp \
-    xml/XSLStyleSheet.cpp \
-    xml/XSLTExtensions.cpp \
-    xml/XSLTUnicodeSort.cpp \
-    xml/XSLTProcessor.cpp
+    xml/XMLSerializer.cpp 
 
 HEADERS += \
     $$PWD/platform/graphics/qt/StillImageQt.h \
     $$PWD/platform/qt/QWebPopup.h \
-    $$PWD/platform/qt/MenuEventProxy.h \
     $$PWD/../WebKit/qt/Api/qwebpluginfactory.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
     $$PWD/platform/network/qt/QNetworkReplyHandler.h \
@@ -1107,11 +1097,11 @@
 
 
 SOURCES += \
+    accessibility/qt/AccessibilityObjectQt.cpp \
     bindings/js/ScriptControllerQt.cpp \
     bridge/qt/qt_class.cpp \
     bridge/qt/qt_instance.cpp \
     bridge/qt/qt_runtime.cpp \
-    page/qt/AccessibilityObjectQt.cpp \
     page/qt/DragControllerQt.cpp \
     page/qt/EventHandlerQt.cpp \
     page/qt/FrameQt.cpp \
@@ -1190,6 +1180,7 @@
     ../WebKit/qt/Api/qwebframe.cpp \
     ../WebKit/qt/Api/qwebpage.cpp \
     ../WebKit/qt/Api/qwebview.cpp \
+    ../WebKit/qt/Api/qwebelement.cpp \
     ../WebKit/qt/Api/qwebhistory.cpp \
     ../WebKit/qt/Api/qwebsettings.cpp \
     ../WebKit/qt/Api/qwebhistoryinterface.cpp \
@@ -1232,6 +1223,8 @@
     SOURCES += plugins/npapi.cpp
 
     unix {
+        DEFINES += ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH=1
+
         mac {
             SOURCES += \
                 plugins/mac/PluginPackageMac.cpp \
@@ -1244,8 +1237,11 @@
         } else {
             !embedded: CONFIG += x11
             SOURCES += \
+                plugins/qt/PluginContainerQt.cpp \
                 plugins/qt/PluginPackageQt.cpp \
                 plugins/qt/PluginViewQt.cpp
+            HEADERS += \
+                plugins/qt/PluginContainerQt.h
             DEFINES += XP_UNIX
         }
     }
@@ -1268,15 +1264,17 @@
             -lversion
     }
 
+} else {
+    SOURCES += \
+        plugins/PluginPackageNone.cpp \
+        plugins/PluginViewNone.cpp
 }
 
 contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0) {
     DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
 }
 
-contains(DEFINES, ENABLE_DATABASE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
-
+contains(DEFINES, ENABLE_SQLITE=1) {
     # somewhat copied from src/plugins/sqldrivers/sqlite/sqlite.pro
     CONFIG(QTDIR_build):system-sqlite {
         LIBS *= $$QT_LFLAGS_SQLITE
@@ -1286,6 +1284,9 @@
             # we have source - use it
             CONFIG(release, debug|release):DEFINES *= NDEBUG
             DEFINES += SQLITE_CORE SQLITE_OMIT_LOAD_EXTENSION SQLITE_OMIT_COMPLETE 
+            contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+                DEFINES+=SQLITE_THREADSAFE=0
+            }
             INCLUDEPATH += $${SQLITE3SRCDIR}
             SOURCES += $${SQLITE3SRCDIR}/sqlite3.c
         } else {
@@ -1301,20 +1302,21 @@
         platform/sql/SQLiteStatement.cpp \
         platform/sql/SQLiteTransaction.cpp \
         platform/sql/SQLValue.cpp \
-        storage/ChangeVersionWrapper.cpp \
-        storage/DatabaseAuthorizer.cpp \
         storage/Database.cpp \
+        storage/DatabaseAuthorizer.cpp
+}
+
+
+contains(DEFINES, ENABLE_DATABASE=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
+
+    SOURCES += \
+        storage/ChangeVersionWrapper.cpp \
         storage/DatabaseTask.cpp \
         storage/DatabaseThread.cpp \
         storage/DatabaseTracker.cpp \
-        storage/LocalStorage.cpp \
-        storage/LocalStorageArea.cpp \
-        storage/LocalStorageTask.cpp \
-        storage/LocalStorageThread.cpp \
         storage/OriginQuotaManager.cpp \
         storage/OriginUsageRecord.cpp \
-        storage/StorageArea.cpp \
-        storage/StorageMap.cpp \
         storage/SQLResultSet.cpp \
         storage/SQLResultSetRowList.cpp \
         storage/SQLStatement.cpp \
@@ -1345,7 +1347,13 @@
         storage/SessionStorageArea.h
 
     SOURCES += \
+        storage/LocalStorage.cpp \
+        storage/LocalStorageArea.cpp \
+        storage/LocalStorageTask.cpp \
+        storage/LocalStorageThread.cpp \
         storage/Storage.cpp \
+        storage/StorageArea.cpp \
+        storage/StorageMap.cpp \
         storage/StorageEvent.cpp \
         storage/SessionStorage.cpp \
         storage/SessionStorageArea.cpp \
@@ -1366,17 +1374,37 @@
         loader/icon/IconDatabaseNone.cpp
 }
 
+contains(DEFINES, ENABLE_WORKERS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WORKERS=1
+
+    IDL_BINDINGS += \
+        page/WorkerNavigator.idl \
+        workers/Worker.idl \
+        workers/WorkerContext.idl \
+        workers/WorkerLocation.idl
+
+    SOURCES += \
+        bindings/js/JSWorkerConstructor.cpp \
+        bindings/js/JSWorkerContextBase.cpp \
+        bindings/js/JSWorkerContextCustom.cpp \
+        bindings/js/JSWorkerCustom.cpp \
+        bindings/js/WorkerScriptController.cpp \
+        loader/WorkerThreadableLoader.cpp \
+        page/WorkerNavigator.cpp \
+        workers/Worker.cpp \
+        workers/WorkerContext.cpp \
+        workers/WorkerLocation.cpp \
+        workers/WorkerMessagingProxy.cpp \
+        workers/WorkerRunLoop.cpp \
+        workers/WorkerThread.cpp \
+        workers/WorkerImportScriptsClient.cpp
+}
+
 contains(DEFINES, ENABLE_VIDEO=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_VIDEO=1
 
     IDL_BINDINGS += \
-        html/HTMLAudioElement.idl \
-        html/HTMLMediaElement.idl \
-        html/HTMLSourceElement.idl \
-        html/HTMLVideoElement.idl \
-        html/MediaError.idl \
-        html/TimeRanges.idl \
-        html/VoidCallback.idl 
+        html/TimeRanges.idl
 
     SOURCES += \
         html/HTMLAudioElement.cpp \
@@ -1420,6 +1448,24 @@
         xml/XPathExpression.idl \
         xml/XPathResult.idl \
         xml/XPathEvaluator.idl
+
+    SOURCES += \
+        xml/NativeXPathNSResolver.cpp \
+        xml/XPathEvaluator.cpp \
+        xml/XPathExpression.cpp \
+        xml/XPathExpressionNode.cpp \
+        xml/XPathFunctions.cpp \
+        xml/XPathNamespace.cpp \
+        xml/XPathNodeSet.cpp \
+        xml/XPathNSResolver.cpp \
+        xml/XPathParser.cpp \
+        xml/XPathPath.cpp \
+        xml/XPathPredicate.cpp \
+        xml/XPathResult.cpp \
+        xml/XPathStep.cpp \
+        xml/XPathUtil.cpp \
+        xml/XPathValue.cpp \
+        xml/XPathVariableReference.cpp
 }
 
 unix:!mac:CONFIG += link_pkgconfig
@@ -1436,12 +1482,37 @@
     win32-msvc* {
         LIBS += -llibxml2 -llibxslt
     }
+
+    IDL_BINDINGS += \
+        xml/XSLTProcessor.idl
+
+    SOURCES += \
+        bindings/js/JSXSLTProcessorConstructor.cpp \
+        bindings/js/JSXSLTProcessorCustom.cpp \
+        xml/XSLImportRule.cpp \
+        xml/XSLStyleSheet.cpp \
+        xml/XSLTExtensions.cpp \
+        xml/XSLTProcessor.cpp \
+        xml/XSLTUnicodeSort.cpp
 }
 
 contains(DEFINES, ENABLE_XBL=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_XBL=1
 }
 
+contains(DEFINES, ENABLE_FILTERS=1) {
+    SOURCES += \
+        platform/graphics/filters/FEBlend.cpp \
+        platform/graphics/filters/FEColorMatrix.cpp \
+        platform/graphics/filters/FEComponentTransfer.cpp \
+        platform/graphics/filters/FEComposite.cpp \
+        platform/graphics/filters/FilterEffect.cpp \
+        platform/graphics/filters/SourceAlpha.cpp \
+        platform/graphics/filters/SourceGraphic.cpp
+
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
+}
+
 contains(DEFINES, ENABLE_WML=1) {
     SOURCES += \
         wml/WMLAElement.cpp \
@@ -1473,6 +1544,7 @@
         wml/WMLPostfieldElement.cpp \
         wml/WMLPrevElement.cpp \
         wml/WMLRefreshElement.cpp \
+        wml/WMLSelectElement.cpp \
         wml/WMLSetvarElement.cpp \
         wml/WMLTableElement.cpp \
         wml/WMLTaskElement.cpp \
@@ -1484,22 +1556,26 @@
 
     WML_NAMES = $$PWD/wml/WMLTagNames.in
 
-    wmlnames_a.output = $$GENERATED_SOURCES_DIR/WMLNames.cpp
+    wmlnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
     wmlnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/wml/WMLTagNames.in --attrs $$PWD/wml/WMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
     wmlnames_a.input = WML_NAMES
     wmlnames_a.dependency_type = TYPE_C
     wmlnames_a.CONFIG = target_predeps
     wmlnames_a.variable_out = GENERATED_SOURCES
     addExtraCompilerWithHeader(wmlnames_a)
-    wmlnames_b.output = $$GENERATED_SOURCES_DIR/WMLElementFactory.cpp
+    wmlnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLElementFactory.cpp
     wmlnames_b.commands = @echo -n ''
     wmlnames_b.input = SVG_NAMES
-    wmlnames_b.depends = $$GENERATED_SOURCES_DIR/WMLNames.cpp
+    wmlnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
     wmlnames_b.CONFIG = target_predeps
     wmlnames_b.variable_out = GENERATED_SOURCES
     addExtraCompilerWithHeader(wmlnames_b)
 }
 
+contains(DEFINES, ENABLE_XHTMLMP=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XHTMLMP=1
+}
+
 contains(DEFINES, ENABLE_SVG=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
 
@@ -1658,7 +1734,6 @@
         rendering/style/SVGRenderStyleDefs.cpp \
         svg/SVGZoomEvent.cpp \
         rendering/PointerEventsHitRules.cpp \
-        svg/FilterEffect.cpp \
         svg/SVGDocumentExtensions.cpp \
         svg/SVGImageLoader.cpp \
         svg/ColorDistance.cpp \
@@ -1792,10 +1867,6 @@
         svg/animation/SMILTime.cpp \
         svg/animation/SMILTimeContainer.cpp \
         svg/animation/SVGSMILElement.cpp \
-        platform/graphics/filters/FEBlend.cpp \
-        platform/graphics/filters/FEColorMatrix.cpp \
-        platform/graphics/filters/FEComponentTransfer.cpp \
-        platform/graphics/filters/FEComposite.cpp \
         svg/graphics/filters/SVGFEConvolveMatrix.cpp \
         svg/graphics/filters/SVGFEDiffuseLighting.cpp \
         svg/graphics/filters/SVGFEDisplacementMap.cpp \
@@ -1808,7 +1879,8 @@
         svg/graphics/filters/SVGFESpecularLighting.cpp \
         svg/graphics/filters/SVGFETile.cpp \
         svg/graphics/filters/SVGFETurbulence.cpp \
-        svg/graphics/filters/SVGFilterEffect.cpp \
+        svg/graphics/filters/SVGFilter.cpp \
+        svg/graphics/filters/SVGFilterBuilder.cpp \
         svg/graphics/filters/SVGLightSource.cpp \
         svg/graphics/SVGImage.cpp \
         svg/graphics/SVGPaintServer.cpp \
@@ -1831,6 +1903,7 @@
         rendering/RenderSVGImage.cpp \
         rendering/RenderSVGInline.cpp \
         rendering/RenderSVGInlineText.cpp \
+        rendering/RenderSVGModelObject.cpp \
         rendering/RenderSVGRoot.cpp \
         rendering/RenderSVGText.cpp \
         rendering/RenderSVGTextPath.cpp \
@@ -1843,42 +1916,39 @@
         rendering/SVGRenderSupport.cpp \
         rendering/SVGRootInlineBox.cpp
 
-SOURCES += \
-        svg/graphics/qt/SVGResourceFilterQt.cpp
-
 
         # GENERATOR 5-C:
-        svgnames_a.output = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/svg/svgtags.in --attrs $$PWD/svg/svgattrs.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
         svgnames_a.input = SVG_NAMES
         svgnames_a.dependency_type = TYPE_C
         svgnames_a.CONFIG = target_predeps
         svgnames_a.variable_out = GENERATED_SOURCES
         addExtraCompilerWithHeader(svgnames_a)
-        svgnames_b.output = $$GENERATED_SOURCES_DIR/SVGElementFactory.cpp
+        svgnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGElementFactory.cpp
         svgnames_b.commands = @echo -n ''
         svgnames_b.input = SVG_NAMES
-        svgnames_b.depends = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgnames_b.CONFIG = target_predeps
         svgnames_b.variable_out = GENERATED_SOURCES
         addExtraCompilerWithHeader(svgnames_b)
-        svgelementwrapper.output = $$GENERATED_SOURCES_DIR/JSSVGElementWrapperFactory.cpp
+        svgelementwrapper.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.cpp
         svgelementwrapper.commands = @echo -n ''
         svgelementwrapper.input = SVG_NAMES
-        svgelementwrapper.depends = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgelementwrapper.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgelementwrapper.CONFIG = target_predeps
         svgelementwrapper.variable_out = GENERATED_SOURCES
         addExtraCompiler(svgelementwrapper)
-        svgelementwrapper_header.output = $$GENERATED_SOURCES_DIR/JSSVGElementWrapperFactory.h
+        svgelementwrapper_header.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.h
         svgelementwrapper_header.commands = @echo -n ''
         svgelementwrapper_header.input = SVG_NAMES
-        svgelementwrapper_header.depends = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgelementwrapper_header.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgelementwrapper_header.CONFIG = target_predeps
         svgelementwrapper_header.variable_out = GENERATED_FILES
         addExtraCompiler(svgelementwrapper_header)
 
         # GENERATOR 5-D:
-        xlinknames.output = $$GENERATED_SOURCES_DIR/XLinkNames.cpp
+        xlinknames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XLinkNames.cpp
         xlinknames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/svg/xlinkattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
         xlinknames.input = XLINK_NAMES
         xlinknames.dependency_type = TYPE_C
@@ -1887,38 +1957,52 @@
         addExtraCompilerWithHeader(xlinknames)
 
     # GENERATOR 6-A:
-    cssprops.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
     cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$SVGCSSPROPERTIES > $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$SVGCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
     cssprops.CONFIG = target_predeps no_link
     cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES SVGCSSPROPERTIES
     addExtraCompilerWithHeader(cssprops)
 
     # GENERATOR 6-B:
-    cssvalues.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.c
+    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
     cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$SVGCSSVALUES > $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
+    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$SVGCSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
     cssvalues.CONFIG = target_predeps no_link
     cssvalues.depend = ${QMAKE_FILE_NAME} SVGCSSVALUES
     addExtraCompilerWithHeader(cssvalues)
 } else {
     # GENERATOR 6-A:
-    cssprops.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
     cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES > $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
     cssprops.CONFIG = target_predeps no_link
     cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES
     addExtraCompilerWithHeader(cssprops)
 
     # GENERATOR 6-B:
-    cssvalues.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.c
+    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
     cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} > $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
+    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
     cssvalues.CONFIG = target_predeps no_link
     cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
     addExtraCompiler(cssvalues)
 }
 
+contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
+
+    IDL_BINDINGS += \
+        inspector/JavaScriptCallFrame.idl
+
+    SOURCES += \
+        bindings/js/JSJavaScriptCallFrameCustom.cpp \
+        inspector/JavaScriptCallFrame.cpp \
+        inspector/JavaScriptDebugServer.cpp \
+        inspector/JavaScriptProfile.cpp \
+        inspector/JavaScriptProfileNode.cpp
+}
+
 contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 
@@ -1936,7 +2020,7 @@
 }
 
 # GENERATOR 1: IDL compiler
-idl.output = $$GENERATED_SOURCES_DIR/JS${QMAKE_FILE_BASE}.cpp
+idl.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JS${QMAKE_FILE_BASE}.cpp
 idl.variable_out = GENERATED_SOURCES
 idl.input = IDL_BINDINGS
 idl.commands = perl -I$$PWD/bindings/scripts $$PWD/bindings/scripts/generate-bindings.pl --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator JS --include $$PWD/dom --include $$PWD/html --include $$PWD/xml --include $$PWD/svg --outputDir $$GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
@@ -1944,7 +2028,7 @@
 addExtraCompilerWithHeader(idl)
 
 # GENERATOR 2-A: LUT creator
-domlut.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.lut.h
+domlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
 domlut.commands = perl $$PWD/../JavaScriptCore/create_hash_table ${QMAKE_FILE_NAME} -n WebCore > ${QMAKE_FILE_OUT}
 domlut.depend = ${QMAKE_FILE_NAME}
 domlut.input = DOMLUT_FILES
@@ -1952,7 +2036,7 @@
 addExtraCompiler(domlut)
 
 # GENERATOR 3: tokenizer (flex)
-tokenizer.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+tokenizer.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
 tokenizer.commands = flex -t < ${QMAKE_FILE_NAME} | perl $$PWD/css/maketokenizer > ${QMAKE_FILE_OUT}
 tokenizer.dependency_type = TYPE_C
 tokenizer.input = TOKENIZER
@@ -1960,8 +2044,8 @@
 addExtraCompiler(tokenizer)
 
 # GENERATOR 4: CSS grammar
-cssbison.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
-cssbison.commands = perl $$PWD/css/makegrammar.pl ${QMAKE_FILE_NAME} $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}
+cssbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+cssbison.commands = perl $$PWD/css/makegrammar.pl ${QMAKE_FILE_NAME} $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}
 cssbison.depend = ${QMAKE_FILE_NAME}
 cssbison.input = CSSBISON
 cssbison.CONFIG = target_predeps
@@ -1970,7 +2054,7 @@
 addExtraCompilerWithHeader(cssbison)
 
 # GENERATOR 5-A:
-htmlnames.output = $$GENERATED_SOURCES_DIR/HTMLNames.cpp
+htmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
 htmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/html/HTMLTagNames.in --attrs $$PWD/html/HTMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\"  --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
 htmlnames.input = HTML_NAMES
 htmlnames.dependency_type = TYPE_C
@@ -1978,26 +2062,26 @@
 htmlnames.variable_out = GENERATED_SOURCES
 addExtraCompilerWithHeader(htmlnames)
 
-htmlelementfactory.output = $$GENERATED_SOURCES_DIR/HTMLElementFactory.cpp
+htmlelementfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLElementFactory.cpp
 htmlelementfactory.commands = @echo -n ''
 htmlelementfactory.input = HTML_NAMES
-htmlelementfactory.depends = $$GENERATED_SOURCES_DIR/HTMLNames.cpp
+htmlelementfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
 htmlelementfactory.CONFIG = target_predeps
 htmlelementfactory.variable_out = GENERATED_SOURCES
 htmlelementfactory.clean += ${QMAKE_FILE_OUT}
 addExtraCompilerWithHeader(htmlelementfactory)
 
-elementwrapperfactory.output = $$GENERATED_SOURCES_DIR/JSHTMLElementWrapperFactory.cpp
+elementwrapperfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSHTMLElementWrapperFactory.cpp
 elementwrapperfactory.commands = @echo -n ''
 elementwrapperfactory.input = HTML_NAMES
-elementwrapperfactory.depends = $$GENERATED_SOURCES_DIR/HTMLNames.cpp
+elementwrapperfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
 elementwrapperfactory.CONFIG = target_predeps
 elementwrapperfactory.variable_out = GENERATED_SOURCES
 elementwrapperfactory.clean += ${QMAKE_FILE_OUT}
 addExtraCompilerWithHeader(elementwrapperfactory)
 
 # GENERATOR 5-B:
-xmlnames.output = $$GENERATED_SOURCES_DIR/XMLNames.cpp
+xmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XMLNames.cpp
 xmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/xml/xmlattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
 xmlnames.input = XML_NAMES
 xmlnames.dependency_type = TYPE_C
@@ -2006,8 +2090,8 @@
 addExtraCompilerWithHeader(xmlnames)
 
 # GENERATOR 8-A:
-entities.output = $$GENERATED_SOURCES_DIR/HTMLEntityNames.c
-entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $$GENERATED_SOURCES_DIR/HTMLEntityNames.c
+entities.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
+entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
 entities.input = ENTITIES_GPERF
 entities.dependency_type = TYPE_C
 entities.CONFIG = target_predeps no_link
@@ -2015,7 +2099,7 @@
 addExtraCompiler(entities)
 
 # GENERATOR 8-B:
-doctypestrings.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+doctypestrings.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
 doctypestrings.input = DOCTYPESTRINGS
 doctypestrings.commands = perl -e \"print \'$${LITERAL_HASH}include <string.h>\';\" > ${QMAKE_FILE_OUT} && echo // bogus >> ${QMAKE_FILE_OUT} && gperf -CEot -L ANSI-C --key-positions="*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
 doctypestrings.dependency_type = TYPE_C
@@ -2024,14 +2108,14 @@
 addExtraCompiler(doctypestrings)
 
 # GENERATOR 8-C:
-colordata.output = $$GENERATED_SOURCES_DIR/ColorData.c
+colordata.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}ColorData.c
 colordata.commands = perl -e \"print \'$${LITERAL_HASH}include <string.h>\';\" > ${QMAKE_FILE_OUT} && echo // bogus >> ${QMAKE_FILE_OUT} && gperf -CDEot -L ANSI-C --key-positions="*" -N findColor -D -s 2 < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
 colordata.input = COLORDAT_GPERF
 colordata.CONFIG = target_predeps no_link
 addExtraCompiler(colordata)
 
 # GENERATOR 9:
-stylesheets.output = $$GENERATED_SOURCES_DIR/UserAgentStyleSheetsData.cpp
+stylesheets.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheetsData.cpp
 stylesheets.commands = perl $$PWD/css/make-css-file-arrays.pl --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h ${QMAKE_FILE_OUT} $$STYLESHEETS_EMBED
 STYLESHEETS_EMBED_GENERATOR_SCRIPT = $$PWD/css/make-css-file-arrays.pl
 stylesheets.input = STYLESHEETS_EMBED_GENERATOR_SCRIPT
@@ -2039,11 +2123,11 @@
 stylesheets.CONFIG = target_predeps
 stylesheets.variable_out = GENERATED_SOURCES
 stylesheets.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h
-addExtraCompilerWithHeader(stylesheets, $$GENERATED_SOURCES_DIR/UserAgentStyleSheets.h)
+addExtraCompilerWithHeader(stylesheets, $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheets.h)
 
 # GENERATOR 10: XPATH grammar
-xpathbison.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
-xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o ${QMAKE_FILE_BASE}.tab.c && $(MOVE) ${QMAKE_FILE_BASE}.tab.c $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp && $(MOVE) ${QMAKE_FILE_BASE}.tab.h $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.h
+xpathbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
 xpathbison.depend = ${QMAKE_FILE_NAME}
 xpathbison.input = XPATHBISON
 xpathbison.CONFIG = target_predeps
@@ -2082,6 +2166,23 @@
         lib_replace.replace = $$[QT_INSTALL_LIBS]
         QMAKE_PKGCONFIG_INSTALL_REPLACE += lib_replace
     }
+
+    mac:!static:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework) {
+        !build_pass {
+            message("Building QtWebKit as a framework, as that's how Qt was built. You can")
+            message("override this by passing CONFIG+=webkit_no_framework to build-webkit.")
+        } else {
+            debug_and_release:CONFIG(debug, debug|release) {
+                TARGET = $$qtLibraryTarget($$TARGET)
+            }
+        }
+
+        CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
+        FRAMEWORK_HEADERS.version = Versions
+        FRAMEWORK_HEADERS.files = $$WEBKIT_API_HEADERS
+        FRAMEWORK_HEADERS.path = Headers
+        QMAKE_BUNDLE_DATA += FRAMEWORK_HEADERS
+    }
 }
 
 CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4) {
diff --git a/WebCore/WebCore.scons b/WebCore/WebCore.scons
deleted file mode 100644
index 914cd57..0000000
--- a/WebCore/WebCore.scons
+++ /dev/null
@@ -1,989 +0,0 @@
-# The keys in sources are the paths to the directories
-# the values are an array of source files in those directories to compile
-sources = {}
-sources['css'] = [
-    'css/CSSBorderImageValue.cpp',
-    'css/CSSCanvasValue.cpp',
-    'css/CSSCharsetRule.cpp',
-    'css/CSSComputedStyleDeclaration.cpp',
-    'css/CSSCursorImageValue.cpp',
-    'css/CSSFontFace.cpp',
-    'css/CSSFontFaceRule.cpp',
-    'css/CSSFontFaceSource.cpp',
-    'css/CSSFontFaceSrcValue.cpp',
-    'css/CSSFontSelector.cpp',
-    'css/CSSFunctionValue.cpp',
-    'css/CSSGradientValue.cpp',
-    'css/CSSHelper.cpp',
-    'css/CSSImageGeneratorValue.cpp',
-    'css/CSSImageValue.cpp',
-    'css/CSSImportRule.cpp',
-    'css/CSSInheritedValue.cpp',
-    'css/CSSInitialValue.cpp',
-    'css/CSSMediaRule.cpp',
-    'css/CSSMutableStyleDeclaration.cpp',
-    'css/CSSPageRule.cpp',
-    'css/CSSParser.cpp',
-    'css/CSSParserValues.cpp',
-    'css/CSSPrimitiveValue.cpp',
-    'css/CSSPropertyLonghand.cpp',
-    'css/CSSProperty.cpp',
-    'css/CSSReflectValue.cpp',
-    'css/CSSRule.cpp',
-    'css/CSSRuleList.cpp',
-    'css/CSSSegmentedFontFace.cpp',
-    'css/CSSSelector.cpp',
-    'css/CSSSelectorList.cpp',
-    'css/CSSStyleDeclaration.cpp',
-    'css/CSSStyleRule.cpp',
-    'css/CSSStyleSelector.cpp',
-    'css/CSSStyleSheet.cpp',
-    'css/CSSTimingFunctionValue.cpp',
-    'css/CSSUnicodeRangeValue.cpp',
-    'css/CSSValueList.cpp',
-    'css/CSSVariableDependentValue.cpp',
-    'css/CSSVariablesDeclaration.cpp',
-    'css/CSSVariablesRule.cpp',
-    'css/FontFamilyValue.cpp',
-    'css/FontValue.cpp',
-    'css/MediaFeatureNames.cpp',
-    'css/MediaList.cpp',
-    'css/MediaQuery.cpp',
-    'css/MediaQueryEvaluator.cpp',
-    'css/MediaQueryExp.cpp',
-    'css/ShadowValue.cpp',
-    'css/StyleBase.cpp',
-    'css/StyleList.cpp',
-    'css/StyleSheet.cpp',
-    'css/StyleSheetList.cpp',
-    'css/SVGCSSComputedStyleDeclaration.cpp',
-    'css/SVGCSSParser.cpp',
-    'css/SVGCSSStyleSelector.cpp',
-    'css/WebKitCSSKeyframeRule.cpp',
-    'css/WebKitCSSKeyframesRule.cpp',
-    'css/WebKitCSSTransformValue.cpp'
-]
-sources['dom'] = [
-    'dom/ActiveDOMObject.cpp',
-    'dom/Attr.cpp',
-    'dom/Attribute.cpp',
-    'dom/BeforeTextInsertedEvent.cpp',
-    'dom/BeforeUnloadEvent.cpp',
-    'dom/CDATASection.cpp',
-    'dom/CharacterData.cpp',
-    'dom/ChildNodeList.cpp',
-    'dom/ClassNames.cpp',
-    'dom/ClassNodeList.cpp',
-    'dom/Clipboard.cpp',
-    'dom/ClipboardEvent.cpp',
-    'dom/Comment.cpp',
-    'dom/ContainerNode.cpp',
-    'dom/CSSMappedAttributeDeclaration.cpp',
-    'dom/Document.cpp',
-    'dom/DocumentFragment.cpp',
-    'dom/DocumentType.cpp',
-    'dom/DOMImplementation.cpp',
-    'dom/DOMStringList.cpp',
-    'dom/DynamicNodeList.cpp',
-    'dom/EditingText.cpp',
-    'dom/Element.cpp',
-    'dom/Entity.cpp',
-    'dom/EntityReference.cpp',
-    'dom/Event.cpp',
-    'dom/EventNames.cpp',
-    'dom/EventTarget.cpp',
-    'dom/ExceptionBase.cpp',
-    'dom/ExceptionCode.cpp',
-    'dom/FormControlElementWithState.cpp',
-    'dom/FormControlElement.cpp',
-    'dom/InputElement.cpp',
-    'dom/KeyboardEvent.cpp',
-    'dom/MappedAttribute.cpp',
-    'dom/MessageChannel.cpp',
-    'dom/MessageEvent.cpp',
-    'dom/MessagePort.cpp',
-    'dom/MouseEvent.cpp',
-    'dom/MouseRelatedEvent.cpp',
-    'dom/MutationEvent.cpp',
-    'dom/NamedAttrMap.cpp',
-    'dom/NamedMappedAttrMap.cpp',
-    'dom/NameNodeList.cpp',
-    'dom/Node.cpp',
-    'dom/NodeFilter.cpp',
-    'dom/NodeFilterCondition.cpp',
-    'dom/NodeIterator.cpp',
-    'dom/Notation.cpp',
-    'dom/OptionGroupElement.cpp',
-    'dom/OptionElement.cpp',
-    'dom/OverflowEvent.cpp',
-    'dom/Position.cpp',
-    'dom/PositionIterator.cpp',
-    'dom/ProcessingInstruction.cpp',
-    'dom/ProgressEvent.cpp',
-    'dom/QualifiedName.cpp',
-    'dom/Range.cpp',
-    'dom/RegisteredEventListener.cpp',
-    'dom/ScriptElement.cpp',
-    'dom/ScriptExecutionContext.cpp',
-    'dom/SelectorNodeList.cpp',
-    'dom/StaticNodeList.cpp',
-    'dom/StaticStringList.cpp',
-    'dom/StyledElement.cpp',
-    'dom/StyleElement.cpp',
-    'dom/TagNodeList.cpp',
-    'dom/Text.cpp',
-    'dom/TextEvent.cpp',
-    'dom/Traversal.cpp',
-    'dom/TreeWalker.cpp',
-    'dom/UIEvent.cpp',
-    'dom/UIEventWithKeyState.cpp',
-    'dom/WebKitAnimationEvent.cpp',
-    'dom/WebKitTransitionEvent.cpp',
-    'dom/WheelEvent.cpp',
-    'dom/XMLTokenizer.cpp',
-    'dom/XMLTokenizerLibxml2.cpp',
-]
-sources['editing'] = [
-    'editing/AppendNodeCommand.cpp',
-    'editing/ApplyStyleCommand.cpp',
-    'editing/BreakBlockquoteCommand.cpp',
-    'editing/CompositeEditCommand.cpp',
-    'editing/CreateLinkCommand.cpp',
-    'editing/DeleteButton.cpp',
-    'editing/DeleteButtonController.cpp',
-    'editing/DeleteFromTextNodeCommand.cpp',
-    'editing/DeleteSelectionCommand.cpp',
-    'editing/EditCommand.cpp',
-    'editing/Editor.cpp',
-    'editing/EditorCommand.cpp',
-    'editing/FormatBlockCommand.cpp',
-    'editing/htmlediting.cpp',
-    'editing/HTMLInterchange.cpp',
-    'editing/IndentOutdentCommand.cpp',
-    'editing/InsertIntoTextNodeCommand.cpp',
-    'editing/InsertLineBreakCommand.cpp',
-    'editing/InsertListCommand.cpp',
-    'editing/InsertNodeBeforeCommand.cpp',
-    'editing/InsertParagraphSeparatorCommand.cpp',
-    'editing/InsertTextCommand.cpp',
-    'editing/JoinTextNodesCommand.cpp',
-    'editing/markup.cpp',
-    'editing/MergeIdenticalElementsCommand.cpp',
-    'editing/ModifySelectionListLevel.cpp',
-    'editing/MoveSelectionCommand.cpp',
-    'editing/RemoveCSSPropertyCommand.cpp',
-    'editing/RemoveFormatCommand.cpp',
-    'editing/RemoveNodeCommand.cpp',
-    'editing/RemoveNodePreservingChildrenCommand.cpp',
-    'editing/ReplaceSelectionCommand.cpp',
-    'editing/SelectionController.cpp',
-    'editing/SetNodeAttributeCommand.cpp',
-    'editing/SmartReplace.cpp',
-    'editing/SmartReplaceCF.cpp',
-    'editing/SmartReplaceICU.cpp',
-    'editing/SplitElementCommand.cpp',
-    'editing/SplitTextNodeCommand.cpp',
-    'editing/SplitTextNodeContainingElementCommand.cpp',
-    'editing/TextIterator.cpp',
-    'editing/TypingCommand.cpp',
-    'editing/UnlinkCommand.cpp',
-    'editing/visible_units.cpp',
-    'editing/VisiblePosition.cpp',
-    'editing/VisibleSelection.cpp',
-    'editing/WrapContentsInDummySpanCommand.cpp',
-]
-sources['history'] = [
-    'history/BackForwardList.cpp',
-    'history/CachedFrame.cpp',
-    'history/CachedPage.cpp',
-    'history/HistoryItem.cpp',
-    'history/PageCache.cpp'
-]
-sources['html'] = [
-    'html/CanvasGradient.cpp',
-    'html/CanvasPattern.cpp',
-    'html/CanvasRenderingContext2D.cpp',
-    'html/CanvasStyle.cpp',
-    'html/File.cpp',
-    'html/FileList.cpp',
-    'html/FormDataList.cpp',
-    'html/HTMLAnchorElement.cpp',
-    'html/HTMLAppletElement.cpp',
-    'html/HTMLAreaElement.cpp',
-    'html/HTMLAudioElement.cpp',
-    'html/HTMLBaseElement.cpp',
-    'html/HTMLBaseFontElement.cpp',
-    'html/HTMLBlockquoteElement.cpp',
-    'html/HTMLBodyElement.cpp',
-    'html/HTMLBRElement.cpp',
-    'html/HTMLButtonElement.cpp',
-    'html/HTMLCanvasElement.cpp',
-    'html/HTMLCollection.cpp',
-    'html/HTMLDirectoryElement.cpp',
-    'html/HTMLDivElement.cpp',
-    'html/HTMLDListElement.cpp',
-    'html/HTMLDocument.cpp',
-    'html/HTMLElement.cpp',
-    'html/HTMLEmbedElement.cpp',
-    'html/HTMLFieldSetElement.cpp',
-    'html/HTMLFontElement.cpp',
-    'html/HTMLFormCollection.cpp',
-    'html/HTMLFormControlElement.cpp',
-    'html/HTMLFormElement.cpp',
-    'html/HTMLFrameElement.cpp',
-    'html/HTMLFrameElementBase.cpp',
-    'html/HTMLFrameOwnerElement.cpp',
-    'html/HTMLFrameSetElement.cpp',
-    'html/HTMLHeadElement.cpp',
-    'html/HTMLHeadingElement.cpp',
-    'html/HTMLHRElement.cpp',
-    'html/HTMLHtmlElement.cpp',
-    'html/HTMLIFrameElement.cpp',
-    'html/HTMLImageElement.cpp',
-    'html/HTMLImageLoader.cpp',
-    'html/HTMLInputElement.cpp',
-    'html/HTMLIsIndexElement.cpp',
-    'html/HTMLKeygenElement.cpp',
-    'html/HTMLLabelElement.cpp',
-    'html/HTMLLegendElement.cpp',
-    'html/HTMLLIElement.cpp',
-    'html/HTMLLinkElement.cpp',
-    'html/HTMLMapElement.cpp',
-    'html/HTMLMarqueeElement.cpp',
-    'html/HTMLMediaElement.cpp',
-    'html/HTMLMenuElement.cpp',
-    'html/HTMLMetaElement.cpp',
-    'html/HTMLModElement.cpp',
-    'html/HTMLNameCollection.cpp',
-    'html/HTMLObjectElement.cpp',
-    'html/HTMLOListElement.cpp',
-    'html/HTMLOptGroupElement.cpp',
-    'html/HTMLOptionElement.cpp',
-    'html/HTMLOptionsCollection.cpp',
-    'html/HTMLParagraphElement.cpp',
-    'html/HTMLParamElement.cpp',
-    'html/HTMLParser.cpp',
-    'html/HTMLParserErrorCodes.cpp',
-    'html/HTMLPlugInElement.cpp',
-    'html/HTMLPlugInImageElement.cpp',
-    'html/HTMLPreElement.cpp',
-    'html/HTMLQuoteElement.cpp',
-    'html/HTMLScriptElement.cpp',
-    'html/HTMLSelectElement.cpp',
-    'html/HTMLSourceElement.cpp',
-    'html/HTMLStyleElement.cpp',
-    'html/HTMLTableCaptionElement.cpp',
-    'html/HTMLTableCellElement.cpp',
-    'html/HTMLTableColElement.cpp',
-    'html/HTMLTableElement.cpp',
-    'html/HTMLTablePartElement.cpp',
-    'html/HTMLTableRowElement.cpp',
-    'html/HTMLTableRowsCollection.cpp',
-    'html/HTMLTableSectionElement.cpp',
-    'html/HTMLTextAreaElement.cpp',
-    'html/HTMLTitleElement.cpp',
-    'html/HTMLTokenizer.cpp',
-    'html/HTMLUListElement.cpp',
-    'html/HTMLVideoElement.cpp',
-    'html/HTMLViewSourceDocument.cpp',
-    'html/ImageData.cpp',
-    'html/PreloadScanner.cpp',
-    'html/TimeRanges.cpp'
-]
-sources['inspector'] = [
-    'inspector/ConsoleMessage.cpp',
-    'inspector/InspectorDatabaseResource.cpp',
-    'inspector/InspectorDOMStorageResource.cpp',
-    'inspector/InspectorController.cpp',
-    'inspector/InspectorResource.cpp',
-    'inspector/JavaScriptCallFrame.cpp',
-    'inspector/JavaScriptDebugServer.cpp',
-    'inspector/JavaScriptProfile.cpp',
-    'inspector/JavaScriptProfileNode.cpp'
-]
-sources['loader/appcache'] = [
-    'loader/appcache/ApplicationCache.cpp',
-    'loader/appcache/ApplicationCacheGroup.cpp',
-    'loader/appcache/ApplicationCacheResource.cpp',
-    'loader/appcache/ApplicationCacheStorage.cpp',
-    'loader/appcache/DOMApplicationCache.cpp',
-    'loader/appcache/ManifestParser.cpp',
-]
-sources['loader/archive'] = [
-    'loader/archive/ArchiveFactory.cpp',
-    'loader/archive/ArchiveResource.cpp',
-    'loader/archive/ArchiveResourceCollection.cpp'
-]
-sources['loader/icon'] = [
-    'loader/icon/IconDatabase.cpp',
-    'loader/icon/IconDatabaseNone.cpp',
-    'loader/icon/IconFetcher.cpp',
-    'loader/icon/IconLoader.cpp',
-    'loader/icon/IconRecord.cpp',
-    'loader/icon/PageURLRecord.cpp'
-]
-sources['loader'] = [
-    'loader/Cache.cpp',
-    'loader/CachedCSSStyleSheet.cpp',
-    'loader/CachedFont.cpp',
-    'loader/CachedImage.cpp',
-    'loader/CachedResource.cpp',
-    'loader/CachedResourceClientWalker.cpp',
-    'loader/CachedResourceHandle.cpp',
-    'loader/CachedScript.cpp',
-    'loader/CachedXBLDocument.cpp',
-    'loader/CachedXSLStyleSheet.cpp',
-    'loader/CrossOriginAccessControl.cpp',
-    'loader/CrossOriginPreflightResultCache.cpp',
-    'loader/DocLoader.cpp',
-    'loader/DocumentLoader.cpp',
-    'loader/DocumentThreadableLoader.cpp',
-    'loader/FormState.cpp',
-    'loader/FrameLoader.cpp',
-    'loader/FTPDirectoryDocument.cpp',
-    'loader/FTPDirectoryParser.cpp',
-    'loader/ImageDocument.cpp',
-    'loader/ImageLoader.cpp',
-    'loader/loader.cpp',
-    'loader/MainResourceLoader.cpp',
-    'loader/MediaDocument.cpp',
-    'loader/NavigationAction.cpp',
-    'loader/NetscapePlugInStreamLoader.cpp',
-    'loader/PluginDocument.cpp',
-    'loader/ProgressTracker.cpp',
-    'loader/Request.cpp',
-    'loader/ResourceLoader.cpp',
-    'loader/SubresourceLoader.cpp',
-    'loader/TextDocument.cpp',
-    'loader/TextResourceDecoder.cpp',
-    'loader/ThreadableLoader.cpp',
-    'loader/UserStyleSheetLoader.cpp',
-    'loader/WorkerThreadableLoader.cpp',
-]
-sources['page'] = [
-    'page/AccessibilityImageMapLink.cpp',
-    'page/AccessibilityList.cpp',
-    'page/AccessibilityListBox.cpp',
-    'page/AccessibilityListBoxOption.cpp',
-    'page/AccessibilityObject.cpp',
-    'page/AccessibilityRenderObject.cpp',
-    'page/AccessibilityTable.cpp',
-    'page/AccessibilityTableCell.cpp',
-    'page/AccessibilityTableColumn.cpp',
-    'page/AccessibilityTableHeaderContainer.cpp',
-    'page/AccessibilityTableRow.cpp',
-    'page/AXObjectCache.cpp',
-    'page/BarInfo.cpp',
-    'page/Chrome.cpp',
-    'page/Console.cpp',
-    'page/ContextMenuController.cpp',
-    'page/Coordinates.cpp',
-    'page/DOMSelection.cpp',
-    'page/DOMTimer.cpp',
-    'page/DOMWindow.cpp',
-    'page/DragController.cpp',
-    'page/EventHandler.cpp',
-    'page/FocusController.cpp',
-    'page/Frame.cpp',
-    'page/FrameTree.cpp',
-    'page/FrameView.cpp',
-    'page/Geolocation.cpp',
-    'page/Geoposition.cpp',
-    'page/History.cpp',
-    'page/Location.cpp',
-    'page/MouseEventWithHitTestResults.cpp',
-    'page/Navigator.cpp',
-    'page/NavigatorBase.cpp',
-    'page/Page.cpp',
-    'page/PageGroup.cpp',
-    'page/PrintContext.cpp',
-    'page/Screen.cpp',
-    'page/SecurityOrigin.cpp',
-    'page/Settings.cpp',
-    'page/WindowFeatures.cpp',
-    'page/WorkerNavigator.cpp',
-]
-sources['page/animation'] = [
-    'page/animation/AnimationBase.cpp',
-    'page/animation/AnimationController.cpp',
-    'page/animation/CompositeAnimation.cpp',
-    'page/animation/ImplicitAnimation.cpp',
-    'page/animation/KeyframeAnimation.cpp',
-]
-sources['page/chromium'] = [
-    'page/chromium/AccessibilityObjectChromium.cpp',
-]
-# platform/ sources are in a separate section below
-# and may eventually be moved to another file
-sources['plugins'] = [
-    'plugins/MimeType.cpp',
-    'plugins/MimeTypeArray.cpp',
-    'plugins/npapi.cpp',
-    'plugins/Plugin.cpp',
-    'plugins/PluginArray.cpp',
-    'plugins/PluginData.cpp',
-    'plugins/PluginDatabase.cpp',
-    'plugins/PluginInfoStore.cpp',
-    'plugins/PluginMainThreadScheduler.cpp',
-    'plugins/PluginPackage.cpp',
-    'plugins/PluginStream.cpp',
-    'plugins/PluginView.cpp'
-]
-sources['rendering'] = [
-    'rendering/AutoTableLayout.cpp',
-    'rendering/CounterNode.cpp',
-    'rendering/EllipsisBox.cpp',
-    'rendering/FixedTableLayout.cpp',
-    'rendering/HitTestResult.cpp',
-    'rendering/InlineBox.cpp',
-    'rendering/InlineFlowBox.cpp',
-    'rendering/InlineTextBox.cpp',
-    'rendering/LayoutState.cpp',
-    'rendering/ListMarkerBox.cpp',
-    'rendering/MediaControlElements.cpp',
-    'rendering/PointerEventsHitRules.cpp',
-    'rendering/RenderApplet.cpp',
-    'rendering/RenderArena.cpp',
-    'rendering/RenderBR.cpp',
-    'rendering/RenderBlock.cpp',
-    'rendering/RenderBox.cpp',
-    'rendering/RenderButton.cpp',
-    'rendering/RenderContainer.cpp',
-    'rendering/RenderCounter.cpp',
-    'rendering/RenderFieldset.cpp',
-    'rendering/RenderFileUploadControl.cpp',
-    'rendering/RenderFlexibleBox.cpp',
-    'rendering/RenderFlow.cpp',
-    'rendering/RenderForeignObject.cpp',
-    'rendering/RenderFrame.cpp',
-    'rendering/RenderFrameSet.cpp',
-    'rendering/RenderHTMLCanvas.cpp',
-    'rendering/RenderImage.cpp',
-    'rendering/RenderImageGeneratedContent.cpp',
-    'rendering/RenderInline.cpp',
-    'rendering/RenderLayer.cpp',
-    'rendering/RenderLegend.cpp',
-    'rendering/RenderListBox.cpp',
-    'rendering/RenderListItem.cpp',
-    'rendering/RenderListMarker.cpp',
-    'rendering/RenderMarquee.cpp',
-    'rendering/RenderMedia.cpp',
-    'rendering/RenderMenuList.cpp',
-    'rendering/RenderObject.cpp',
-    'rendering/RenderPart.cpp',
-    'rendering/RenderPartObject.cpp',
-    'rendering/RenderPath.cpp',
-    'rendering/RenderReplaced.cpp',
-    'rendering/RenderReplica.cpp',
-    'rendering/RenderSVGBlock.cpp',
-    'rendering/RenderSVGContainer.cpp',
-    'rendering/RenderSVGGradientStop.cpp',
-    'rendering/RenderSVGHiddenContainer.cpp',
-    'rendering/RenderSVGImage.cpp',
-    'rendering/RenderSVGInline.cpp',
-    'rendering/RenderSVGInlineText.cpp',
-    'rendering/RenderSVGRoot.cpp',
-    'rendering/RenderSVGTSpan.cpp',
-    'rendering/RenderSVGText.cpp',
-    'rendering/RenderSVGTextPath.cpp',
-    'rendering/RenderSVGTransformableContainer.cpp',
-    'rendering/RenderSVGViewportContainer.cpp',
-    'rendering/RenderScrollbar.cpp',
-    'rendering/RenderScrollbarPart.cpp',
-    'rendering/RenderScrollbarTheme.cpp',
-    'rendering/RenderSlider.cpp',
-    'rendering/RenderTable.cpp',
-    'rendering/RenderTableCell.cpp',
-    'rendering/RenderTableCol.cpp',
-    'rendering/RenderTableRow.cpp',
-    'rendering/RenderTableSection.cpp',
-    'rendering/RenderText.cpp',
-    'rendering/RenderTextControl.cpp',
-    'rendering/RenderTextControlMultiLine.cpp',
-    'rendering/RenderTextControlSingleLine.cpp',
-    'rendering/RenderTextFragment.cpp',
-    'rendering/RenderTheme.cpp',
-    'rendering/RenderTreeAsText.cpp',
-    'rendering/RenderVideo.cpp',
-    'rendering/RenderView.cpp',
-    'rendering/RenderWidget.cpp',
-    'rendering/RenderWordBreak.cpp',
-    'rendering/RootInlineBox.cpp',
-    'rendering/SVGCharacterLayoutInfo.cpp',
-    'rendering/SVGInlineFlowBox.cpp',
-    'rendering/SVGInlineTextBox.cpp',
-    'rendering/SVGRenderSupport.cpp',
-    'rendering/SVGRenderTreeAsText.cpp',
-    'rendering/SVGRootInlineBox.cpp',
-    'rendering/ScrollBehavior.cpp',
-    'rendering/TextControlInnerElements.cpp',
-    'rendering/TransformState.cpp',
-    'rendering/bidi.cpp',
-    'rendering/break_lines.cpp',
-]
-sources['rendering/style'] = [
-    'rendering/style/BindingURI.cpp',
-    'rendering/style/ContentData.cpp',
-    'rendering/style/CounterDirectives.cpp',
-    'rendering/style/FillLayer.cpp',
-    'rendering/style/KeyframeList.cpp',
-    'rendering/style/NinePieceImage.cpp',
-    'rendering/style/RenderStyle.cpp',
-    'rendering/style/ShadowData.cpp',
-    'rendering/style/StyleBackgroundData.cpp',
-    'rendering/style/StyleBoxData.cpp',
-    'rendering/style/StyleCachedImage.cpp',
-    'rendering/style/StyleFlexibleBoxData.cpp',
-    'rendering/style/StyleGeneratedImage.cpp',
-    'rendering/style/StyleInheritedData.cpp',
-    'rendering/style/StyleMarqueeData.cpp',
-    'rendering/style/StyleMultiColData.cpp',
-    'rendering/style/StyleRareInheritedData.cpp',
-    'rendering/style/StyleRareNonInheritedData.cpp',
-    'rendering/style/StyleSurroundData.cpp',
-    'rendering/style/StyleTransformData.cpp',
-    'rendering/style/StyleVisualData.cpp',
-    'rendering/style/SVGRenderStyle.cpp',
-    'rendering/style/SVGRenderStyleDefs.cpp',
-]
-sources['storage'] = [
-    'storage/ChangeVersionWrapper.cpp',
-    'storage/Database.cpp',
-    'storage/DatabaseAuthorizer.cpp',
-    'storage/DatabaseTask.cpp',
-    'storage/DatabaseThread.cpp',
-    'storage/DatabaseTracker.cpp',
-    'storage/LocalStorage.cpp',
-    'storage/LocalStorageArea.cpp',
-    'storage/LocalStorageTask.cpp',
-    'storage/LocalStorageThread.cpp',
-    'storage/OriginQuotaManager.cpp',
-    'storage/OriginUsageRecord.cpp',
-    'storage/SessionStorage.cpp',
-    'storage/SessionStorageArea.cpp',
-    'storage/SQLResultSet.cpp',
-    'storage/SQLResultSetRowList.cpp',
-    'storage/SQLStatement.cpp',
-    'storage/SQLTransaction.cpp',
-    'storage/Storage.cpp',
-    'storage/StorageArea.cpp',
-    'storage/StorageEvent.cpp',
-    'storage/StorageMap.cpp'
-]
-sources['workers'] = [
-    'workers/Worker.cpp',
-    'workers/WorkerContext.cpp',
-    'workers/WorkerLocation.cpp',
-]
-sources['xml'] = [
-    'xml/DOMParser.cpp',
-    'xml/NativeXPathNSResolver.cpp',
-    'xml/XMLHttpRequest.cpp',
-    'xml/XMLHttpRequestUpload.cpp',
-    'xml/XMLSerializer.cpp',
-    'xml/XPathEvaluator.cpp',
-    'xml/XPathExpression.cpp',
-    'xml/XPathExpressionNode.cpp',
-    'xml/XPathFunctions.cpp',
-    'xml/XPathNamespace.cpp',
-    'xml/XPathNodeSet.cpp',
-    'xml/XPathNSResolver.cpp',
-    'xml/XPathParser.cpp',
-    'xml/XPathPath.cpp',
-    'xml/XPathPredicate.cpp',
-    'xml/XPathResult.cpp',
-    'xml/XPathStep.cpp',
-    'xml/XPathUtil.cpp',
-    'xml/XPathValue.cpp',
-    'xml/XPathVariableReference.cpp',
-    'xml/XSLImportRule.cpp',
-    'xml/XSLStyleSheet.cpp',
-    'xml/XSLTExtensions.cpp',
-    'xml/XSLTProcessor.cpp',
-    'xml/XSLTUnicodeSort.cpp'
-]
-
-# Using JavaScriptCore for now, eventually this needs to be configurable (and in separate file)
-sources['bindings/js'] = [
-    "bindings/js/GCController.cpp",
-    "bindings/js/JSAttrCustom.cpp",
-    "bindings/js/JSAudioConstructor.cpp",
-    "bindings/js/JSCDATASectionCustom.cpp",
-    "bindings/js/JSCSSRuleCustom.cpp",
-    "bindings/js/JSCSSStyleDeclarationCustom.cpp",
-    "bindings/js/JSCSSValueCustom.cpp",
-    "bindings/js/JSCanvasRenderingContext2DCustom.cpp",
-    "bindings/js/JSClipboardCustom.cpp",
-    "bindings/js/JSConsoleCustom.cpp",
-    "bindings/js/JSCustomPositionCallback.cpp",
-    "bindings/js/JSCustomPositionErrorCallback.cpp",
-    "bindings/js/JSCustomSQLStatementCallback.cpp",
-    "bindings/js/JSCustomSQLStatementErrorCallback.cpp",
-    "bindings/js/JSCustomSQLTransactionCallback.cpp",
-    "bindings/js/JSCustomSQLTransactionErrorCallback.cpp",
-    "bindings/js/JSCustomVoidCallback.cpp",
-    "bindings/js/JSCustomXPathNSResolver.cpp",
-    "bindings/js/JSDOMApplicationCacheCustom.cpp",
-    "bindings/js/JSDOMBinding.cpp",
-    "bindings/js/JSDOMGlobalObject.cpp",
-    "bindings/js/JSDOMStringListCustom.cpp",
-    "bindings/js/JSDOMWindowBase.cpp",
-    "bindings/js/JSDOMWindowCustom.cpp",
-    "bindings/js/JSDOMWindowShell.cpp",
-    "bindings/js/JSDatabaseCustom.cpp",
-    "bindings/js/JSDocumentCustom.cpp",
-    "bindings/js/JSDocumentFragmentCustom.cpp",
-    "bindings/js/JSElementCustom.cpp",
-    "bindings/js/JSEventCustom.cpp",
-    "bindings/js/JSEventListener.cpp",
-    "bindings/js/JSEventTarget.cpp",
-    "bindings/js/JSGeolocationCustom.cpp",
-    "bindings/js/JSHTMLAllCollection.cpp",
-    "bindings/js/JSHTMLAppletElementCustom.cpp",
-    "bindings/js/JSHTMLCollectionCustom.cpp",
-    "bindings/js/JSHTMLDocumentCustom.cpp",
-    "bindings/js/JSHTMLElementCustom.cpp",
-    "bindings/js/JSHTMLEmbedElementCustom.cpp",
-    "bindings/js/JSHTMLFormElementCustom.cpp",
-    "bindings/js/JSHTMLFrameElementCustom.cpp",
-    "bindings/js/JSHTMLFrameSetElementCustom.cpp",
-    "bindings/js/JSHTMLIFrameElementCustom.cpp",
-    "bindings/js/JSHTMLInputElementCustom.cpp",
-    "bindings/js/JSHTMLObjectElementCustom.cpp",
-    "bindings/js/JSHTMLOptionsCollectionCustom.cpp",
-    "bindings/js/JSHTMLSelectElementCustom.cpp",
-    "bindings/js/JSHistoryCustom.cpp",
-    "bindings/js/JSImageConstructor.cpp",
-    "bindings/js/JSImageDataCustom.cpp",
-    "bindings/js/JSInspectedObjectWrapper.cpp",
-    "bindings/js/JSInspectorCallbackWrapper.cpp",
-    "bindings/js/JSJavaScriptCallFrameCustom.cpp",
-    "bindings/js/JSLazyEventListener.cpp",
-    "bindings/js/JSLocationCustom.cpp",
-    "bindings/js/JSMessageChannelConstructor.cpp",
-    "bindings/js/JSMessageChannelCustom.cpp",
-    "bindings/js/JSMessagePortCustom.cpp",
-    "bindings/js/JSMimeTypeArrayCustom.cpp",
-    "bindings/js/JSNamedNodeMapCustom.cpp",
-    "bindings/js/JSNamedNodesCollection.cpp",
-    "bindings/js/JSNavigatorCustom.cpp",
-    "bindings/js/JSNodeCustom.cpp",
-    "bindings/js/JSNodeFilterCondition.cpp",
-    "bindings/js/JSNodeFilterCustom.cpp",
-    "bindings/js/JSNodeIteratorCustom.cpp",
-    "bindings/js/JSNodeListCustom.cpp",
-    "bindings/js/JSOptionConstructor.cpp",
-    "bindings/js/JSPluginArrayCustom.cpp",
-    "bindings/js/JSPluginCustom.cpp",
-    "bindings/js/JSPluginElementFunctions.cpp",
-    "bindings/js/JSQuarantinedObjectWrapper.cpp",
-    "bindings/js/JSRGBColor.cpp",
-    "bindings/js/JSSQLResultSetRowListCustom.cpp",
-    "bindings/js/JSSQLTransactionCustom.cpp",
-    "bindings/js/JSSVGElementInstanceCustom.cpp",
-    "bindings/js/JSSVGLengthCustom.cpp",
-    "bindings/js/JSSVGMatrixCustom.cpp",
-    "bindings/js/JSSVGPathSegCustom.cpp",
-    "bindings/js/JSSVGPathSegListCustom.cpp",
-    "bindings/js/JSSVGPointListCustom.cpp",
-    "bindings/js/JSSVGTransformListCustom.cpp",
-    "bindings/js/JSStorageCustom.cpp",
-    "bindings/js/JSStyleSheetCustom.cpp",
-    "bindings/js/JSStyleSheetListCustom.cpp",
-    "bindings/js/JSTextCustom.cpp",
-    "bindings/js/JSTreeWalkerCustom.cpp",
-    "bindings/js/JSWorkerConstructor.cpp",
-    "bindings/js/JSWorkerContextBase.cpp",
-    "bindings/js/JSWorkerContextCustom.cpp",
-    "bindings/js/JSWorkerCustom.cpp",
-    "bindings/js/JSXMLHttpRequestConstructor.cpp",
-    "bindings/js/JSXMLHttpRequestCustom.cpp",
-    "bindings/js/JSXMLHttpRequestUploadCustom.cpp",
-    "bindings/js/JSXSLTProcessorConstructor.cpp",
-    "bindings/js/JSXSLTProcessorCustom.cpp",
-    "bindings/js/ScheduledAction.cpp",
-    "bindings/js/ScriptCallFrame.cpp",
-    "bindings/js/ScriptCallStack.cpp",
-    "bindings/js/ScriptController.cpp",
-    "bindings/js/ScriptValue.cpp",
-    "bindings/js/WorkerScriptController.cpp",
-]
-sources['bridge'] = [
-    'bridge/IdentifierRep.cpp',
-    'bridge/NP_jsobject.cpp',
-    'bridge/npruntime.cpp',
-    'bridge/runtime.cpp',
-    'bridge/runtime_array.cpp',
-    'bridge/runtime_method.cpp',
-    'bridge/runtime_object.cpp',
-    'bridge/runtime_root.cpp',
-]
-sources['bridge/c'] = [
-    'bridge/c/c_class.cpp',
-    'bridge/c/c_instance.cpp',
-    'bridge/c/c_runtime.cpp',
-    'bridge/c/c_utility.cpp',
-]
-
-# Platform-specific sources, including common files
-# These may eventually move to a separate sources file
-sources['platform'] = [
-    'platform/Arena.cpp',
-    'platform/ContentType.cpp',
-    'platform/ContextMenu.cpp',
-    'platform/CrossThreadCopier.cpp',
-    'platform/DeprecatedPtrListImpl.cpp',
-    'platform/DragData.cpp',
-    'platform/DragImage.cpp',
-    'platform/FileChooser.cpp',
-    'platform/GeolocationService.cpp',
-    'platform/KURL.cpp',
-    'platform/Length.cpp',
-    'platform/Logging.cpp',
-    'platform/MIMETypeRegistry.cpp',
-    'platform/Scrollbar.cpp',
-    'platform/ScrollbarThemeComposite.cpp',
-    'platform/ScrollView.cpp',
-    'platform/SharedBuffer.cpp',
-    'platform/Theme.cpp',
-    'platform/ThreadGlobalData.cpp',
-    'platform/ThreadTimers.cpp',
-    'platform/Timer.cpp',
-    'platform/Widget.cpp'
-]
-sources['platform/animation'] = [
-    'platform/animation/Animation.cpp',
-    'platform/animation/AnimationList.cpp',
-]
-sources['platform/sql'] = [
-    'platform/sql/SQLiteAuthorizer.cpp',
-    'platform/sql/SQLiteDatabase.cpp',
-    'platform/sql/SQLiteStatement.cpp',
-    'platform/sql/SQLiteTransaction.cpp',
-    'platform/sql/SQLValue.cpp'
-]
-sources['platform/graphics'] = [
-    'platform/graphics/BitmapImage.cpp',
-    'platform/graphics/Color.cpp',
-    'platform/graphics/FloatPoint.cpp',
-    'platform/graphics/FloatPoint3D.cpp',
-    'platform/graphics/FloatRect.cpp',
-    'platform/graphics/FloatSize.cpp',
-    'platform/graphics/Font.cpp',
-    'platform/graphics/FontCache.cpp',
-    'platform/graphics/FontData.cpp',
-    'platform/graphics/FontDescription.cpp',
-    'platform/graphics/FontFallbackList.cpp',
-    'platform/graphics/FontFamily.cpp',
-    'platform/graphics/GeneratedImage.cpp',
-    'platform/graphics/GlyphPageTreeNode.cpp',
-    'platform/graphics/GlyphWidthMap.cpp',
-    'platform/graphics/Gradient.cpp',
-    'platform/graphics/GraphicsContext.cpp',
-    'platform/graphics/GraphicsTypes.cpp',
-    'platform/graphics/Image.cpp',
-    'platform/graphics/IntRect.cpp',
-    'platform/graphics/MediaPlayer.cpp',
-    'platform/graphics/Path.cpp',
-    'platform/graphics/PathTraversalState.cpp',
-    'platform/graphics/Pattern.cpp',
-    'platform/graphics/Pen.cpp',
-    'platform/graphics/SegmentedFontData.cpp',
-    'platform/graphics/SimpleFontData.cpp',
-    'platform/graphics/StringTruncator.cpp',
-    'platform/graphics/WidthIterator.cpp',
-]
-sources['platform/graphics/transforms'] = [
-    'platform/graphics/transforms/MatrixTransformOperation.cpp',
-    'platform/graphics/transforms/Matrix3DTransformOperation.cpp',
-    'platform/graphics/transforms/RotateTransformOperation.cpp',
-    'platform/graphics/transforms/PerspectiveTransformOperation.cpp',
-    'platform/graphics/transforms/ScaleTransformOperation.cpp',
-    'platform/graphics/transforms/SkewTransformOperation.cpp',
-    'platform/graphics/transforms/TransformOperations.cpp',
-    'platform/graphics/transforms/TransformationMatrix.cpp',
-    'platform/graphics/transforms/TranslateTransformOperation.cpp',
-]
-sources['platform/network'] = [
-    'platform/network/AuthenticationChallengeBase.cpp',
-    'platform/network/Credential.cpp',
-    'platform/network/FormData.cpp',
-    'platform/network/FormDataBuilder.cpp',
-    'platform/network/HTTPHeaderMap.cpp',
-    'platform/network/HTTPParsers.cpp',
-    'platform/network/mac/NetworkStateNotifierMac.cpp',
-    'platform/network/NetworkStateNotifier.cpp',
-    'platform/network/ProtectionSpace.cpp',
-    'platform/network/ResourceErrorBase.cpp',
-    'platform/network/ResourceHandle.cpp',
-    'platform/network/ResourceRequestBase.cpp',
-    'platform/network/ResourceResponseBase.cpp'
-]
-sources['platform/text'] = [
-    'platform/text/AtomicString.cpp',
-    'platform/text/Base64.cpp',
-    'platform/text/BidiContext.cpp',
-    'platform/text/CString.cpp',
-    'platform/text/RegularExpression.cpp',
-    'platform/text/SegmentedString.cpp',
-    'platform/text/String.cpp',
-    'platform/text/StringBuilder.cpp',
-    'platform/text/StringFragment.cpp',
-    'platform/text/StringImpl.cpp',
-    'platform/text/symbian/StringImplSymbian.cpp',
-    'platform/text/symbian/StringSymbian.cpp',
-    'platform/text/TextBoundariesICU.cpp',
-    'platform/text/TextBreakIteratorICU.cpp',
-    'platform/text/TextCodec.cpp',
-    'platform/text/TextCodecICU.cpp',
-    'platform/text/TextCodecLatin1.cpp',
-    'platform/text/TextCodecUserDefined.cpp',
-    'platform/text/TextCodecUTF16.cpp',
-    'platform/text/TextEncoding.cpp',
-    'platform/text/TextEncodingDetectorICU.cpp',
-    'platform/text/TextEncodingRegistry.cpp',
-    'platform/text/TextStream.cpp',
-    'platform/text/UnicodeRange.cpp',
-]
-
-env = Environment()
-
-building_on_win32 = env['PLATFORM'] == 'win32' or env['PLATFORM'] == 'cygwin'
-
-if env['PLATFORM'] == 'darwin':
-    sources['platform/graphics/cg'] = [
-        'platform/graphics/cg/TransformationMatrixCG.cpp',
-        'platform/graphics/cg/ColorCG.cpp',
-        'platform/graphics/cg/FloatPointCG.cpp',
-        'platform/graphics/cg/FloatRectCG.cpp',
-        'platform/graphics/cg/FloatSizeCG.cpp',
-        'platform/graphics/cg/GradientCG.cpp',
-        'platform/graphics/cg/GraphicsContextCG.cpp',
-        'platform/graphics/cg/ImageBufferCG.cpp',
-        'platform/graphics/cg/ImageCG.cpp',
-        'platform/graphics/cg/ImageSourceCG.cpp',
-        'platform/graphics/cg/IntPointCG.cpp',
-        'platform/graphics/cg/IntRectCG.cpp',
-        'platform/graphics/cg/IntSizeCG.cpp',
-        'platform/graphics/cg/PathCG.cpp',
-        'platform/graphics/cg/PatternCG.cpp',
-        'platform/graphics/cg/PDFDocumentImage.cpp',
-    ]
-    sources['platform/graphics/mac'] = [
-        'platform/graphics/mac/CoreTextController.cpp',
-        'platform/graphics/mac/FontCustomPlatformData.cpp',
-        'platform/graphics/mac/FontMacCoreText.cpp',
-        'platform/graphics/mac/GlyphPageTreeNodeMac.cpp',
-    ]
-    sources['platform/network/cf'] = [
-        'platform/network/cf/AuthenticationCF.cpp',
-        'platform/network/cf/DNSCFNet.cpp',
-        'platform/network/cf/FormDataStreamCFNet.cpp',
-        'platform/network/cf/ResourceErrorCF.cpp',
-        'platform/network/cf/ResourceHandleCFNet.cpp',
-        'platform/network/cf/ResourceRequestCFNet.cpp',
-        'platform/network/cf/ResourceResponseCFNet.cpp'
-    ]
-    sources['platform/network/mac'] = [
-        'platform/network/mac/AuthenticationMac.mm',
-        'platform/network/mac/FormDataStreamMac.mm',
-        'platform/network/mac/ResourceErrorMac.mm',
-        'platform/network/mac/ResourceHandleMac.mm',
-        'platform/network/mac/ResourceRequestMac.mm',
-        'platform/network/mac/ResourceResponseMac.mm',
-        'platform/network/mac/WebCoreURLResponse.mm'
-    ]
-    sources['platform/text/cf'] = [
-        'platform/text/cf/StringCF.cpp',
-        'platform/text/cf/StringImplCF.cpp'
-    ]
-    sources['platform/text/mac'] = [
-        'platform/text/mac/TextCodecMac.cpp',
-        'platform/text/mac/StringImplMac.mm',
-        'platform/text/mac/StringMac.mm',
-        'platform/text/mac/TextBoundaries.mm',
-        'platform/text/mac/TextBreakIteratorInternalICUMac.mm',
-    ]
-
-sources['platform/chromium'] = [
-]
-
-sources['platform/graphics/chromium'] = [
-]
-
-sources['platform/network/chromium'] = [
-]
-
-derived_sources_path = 'DerivedSources/WebCore/'
-def DerivedSources(path):
-    return derived_sources_path + path
-
-derived_sources_results = map(DerivedSources, [
-    'CSSValueKeywords.h',
-])
-
-derived_sources_sources = [
-    'css/CSSValueKeywords.in'
-]
-
-# Generate DerivedSources
-# Ideally Scons would be provided a full list of all the
-# DerivedSources so it can better know when to run make-generated-sources.sh
-env.Command(derived_sources_results, derived_sources_sources, './make-generated-sources.sh')
-sources[derived_sources_path] = [DerivedSources('JSSVGFontFaceElement.cpp')]
-
-env['CPPDEFINES'] = { 'BUILDING_CHROMIUM__' : 1, 'WTF_USE_V8' : 0 }
-
-# Scons out-of-the-box only supports precompiled headers for MSVC
-# remove this when we fix Scons to understand GCC precompiled headers
-if env['CC'] == 'gcc':
-    env['CCFLAGS'] = '-include WebCorePrefix.h'
-# env['PCH'] = 'WebCorePrefix.h'
-
-if env['PLATFORM'] == 'darwin':
-    env['FRAMEWORKPATH'] = [
-        '/System/Library/Frameworks/Carbon.framework/Frameworks',
-        '/System/Library/Frameworks/ApplicationServices.framework/Frameworks',
-        '/System/Library/Frameworks/CoreServices.framework/Frameworks', # for CFNetwork, eventually we'll move to Chromium's network layer
-    ]
-    env['FRAMEWORKS'] = ['JavaScriptCore', 'ApplicationServices', 'Cocoa', 'CoreServices']
-    # Temporarily disabling AX support for the Chromium Mac Build until we can fix our AX arch
-    env.Append(CPPDEFINES = {'HAVE_ACCESSIBILITY' : 0})
-
-env['CPPPATH'] = ['.', '..']
-
-# Includes for JavaScriptCore (the Apple Mac build use JavaScriptCore.framework)
-# Scons doesn't know how to build frameworks yet :( so we have to manually include a bunch of paths
-env.Append(CPPPATH = [
-    '../JavaScriptCore',
-    '../JavaScriptCore/bytecode',
-    '../JavaScriptCore/jit',
-    '../JavaScriptCore/interpreter',
-    '../JavaScriptCore/parser',
-    '../JavaScriptCore/wtf',
-    '../JavaScriptCore/runtime',
-])
-
-# HACK: Include ForwardingHeaders after ../JavaScriptCore for now to allow JavaScriptCore/wtf includes to work
-env.Append(CPPPATH = ['ForwardingHeaders'])
-
-# For bring-up we're depending on WebKitSystemInterface, this will go away once more of our port is upstreamed
-env.Append(CPPPATH = ['../WebKitLibraries'])
-
-# Mac OS X doesn't include icu headers, so WebKit svn includes icu 3.2 headers
-if env['PLATFORM'] == 'darwin':
-    env.Append(CPPPATH = ['icu', '/usr/include/libxml2'])
-
-webkit_libraries_path = "../WebKitLibraries/win/"
-def WebKitLibraries(path):
-    return webkit_libraries_path + path
-
-if building_on_win32:
-    env.Append(CPPPATH = ['os-win32', WebKitLibraries('include')])
-    env.Prepend(LIBPATH = [WebKitLibraries('lib')])
-    env.Append(LIBS = ['icuin', 'icuuc', 'user32', 'winmm'])
-
-# Include headers for all of the directories from which we are compiling source files
-env.Append(CPPPATH = sources.keys())
-
-env.SharedLibrary("WebCore", sources.values())
diff --git a/WebCore/WebCore.vcproj/QTMovieWin.vcproj b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
index 8c38094..7444d29 100644
--- a/WebCore/WebCore.vcproj/QTMovieWin.vcproj
+++ b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
@@ -57,6 +57,7 @@
 				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

 				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				IgnoreDefaultLibraryNames="LIBCMT"

 				DelayLoadDLLs=""

 			/>

 			<Tool

@@ -128,6 +129,7 @@
 				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

 				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				IgnoreDefaultLibraryNames="LIBCMT"

 				DelayLoadDLLs=""

 			/>

 			<Tool

@@ -198,6 +200,7 @@
 				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

 				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				IgnoreDefaultLibraryNames="LIBCMT"

 				DelayLoadDLLs=""

 			/>

 			<Tool

diff --git a/WebCore/WebCore.vcproj/WebCore.vcproj b/WebCore/WebCore.vcproj/WebCore.vcproj
index 45aa72e..6052ce4 100644
--- a/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -17,14 +17,12 @@
 	<Configurations>

 		<Configuration

 			Name="Debug|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

 			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;exit /b&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -40,11 +38,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\network\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\cg&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\cg&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitOutputDir)\include\QtMovieWin&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"

-				PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_DATABASE;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

-				UsePrecompiledHeader="2"

-				PrecompiledHeaderThrough="WebCorePrefix.h"

-				ForcedIncludeFiles="WebCorePrefix.h"

+				AdditionalIncludeDirectories=""

+				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -72,20 +67,18 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Release|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

 			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops"

 			CharacterSet="1"

 			WholeProgramOptimization="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;exit /b&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -101,11 +94,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\network\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\cg&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\cg&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitOutputDir)\include\QtMovieWin&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"

-				PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_DATABASE;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

-				UsePrecompiledHeader="2"

-				PrecompiledHeaderThrough="WebCorePrefix.h"

-				ForcedIncludeFiles="WebCorePrefix.h"

+				AdditionalIncludeDirectories=""

+				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -133,19 +123,17 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Debug_Internal|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

 			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;exit /b&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -161,11 +149,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\network\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\cg&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\cg&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitOutputDir)\include\QtMovieWin&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"

-				PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_DATABASE;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

-				UsePrecompiledHeader="2"

-				PrecompiledHeaderThrough="WebCorePrefix.h"

-				ForcedIncludeFiles="WebCorePrefix.h"

+				AdditionalIncludeDirectories=""

+				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -193,20 +178,17 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Debug_Cairo|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

-			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"

 			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCairo.vsprops;.\WebCoreCURL.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;exit /b&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -222,11 +204,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\network\curl&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\cairo&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\image-decoders&quot;;&quot;$(ProjectDir)..\platform\image-decoders\bmp&quot;;&quot;$(ProjectDir)..\platform\image-decoders\gif&quot;;&quot;$(ProjectDir)..\platform\image-decoders\ico&quot;;&quot;$(ProjectDir)..\platform\image-decoders\jpeg&quot;;&quot;$(ProjectDir)..\platform\image-decoders\png&quot;;&quot;$(ProjectDir)..\platform\image-decoders\xbm&quot;;&quot;$(ProjectDir)..\platform\image-decoders\zlib&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\platform\cairo\pixman\src&quot;;&quot;$(ProjectDir)..\platform\cairo\cairo\src&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\cairo&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\kcanvas&quot;;&quot;$(ProjectDir)..\kcanvas\device&quot;;&quot;$(ProjectDir)..\kcanvas\device\quartz&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"

-				PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_DATABASE;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

-				UsePrecompiledHeader="2"

-				PrecompiledHeaderThrough="WebCorePrefix.h"

-				ForcedIncludeFiles="WebCorePrefix.h"

+				AdditionalIncludeDirectories=""

+				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -254,21 +233,18 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

 			Name="Release_Cairo|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

-			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"

 			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCairo.vsprops;.\WebCoreCURL.vsprops"

 			CharacterSet="1"

 			WholeProgramOptimization="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;exit /b&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -284,11 +260,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\network\curl&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\cairo&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\image-decoders&quot;;&quot;$(ProjectDir)..\platform\image-decoders\bmp&quot;;&quot;$(ProjectDir)..\platform\image-decoders\gif&quot;;&quot;$(ProjectDir)..\platform\image-decoders\ico&quot;;&quot;$(ProjectDir)..\platform\image-decoders\jpeg&quot;;&quot;$(ProjectDir)..\platform\image-decoders\png&quot;;&quot;$(ProjectDir)..\platform\image-decoders\xbm&quot;;&quot;$(ProjectDir)..\platform\image-decoders\zlib&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\platform\cairo\pixman\src&quot;;&quot;$(ProjectDir)..\platform\cairo\cairo\src&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\cairo&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\kcanvas&quot;;&quot;$(ProjectDir)..\kcanvas\device&quot;;&quot;$(ProjectDir)..\kcanvas\device\quartz&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"

-				PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_DATABASE;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

-				UsePrecompiledHeader="2"

-				PrecompiledHeaderThrough="WebCorePrefix.h"

-				ForcedIncludeFiles="WebCorePrefix.h"

+				AdditionalIncludeDirectories=""

+				ForcedIncludeFiles=""

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -316,68 +289,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

-			/>

-		</Configuration>

-		<Configuration

-			Name="Release_PGO|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

-			ConfigurationType="4"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

-			CharacterSet="1"

-			WholeProgramOptimization="1"

-			>

-			<Tool

-				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;exit /b&#x0D;&#x0A;"

-			/>

-			<Tool

-				Name="VCCustomBuildTool"

-			/>

-			<Tool

-				Name="VCXMLDataGeneratorTool"

-			/>

-			<Tool

-				Name="VCWebServiceProxyGeneratorTool"

-			/>

-			<Tool

-				Name="VCMIDLTool"

-			/>

-			<Tool

-				Name="VCCLCompilerTool"

-				WholeProgramOptimization="false"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\network\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\cg&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\cg&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitOutputDir)\include\QtMovieWin&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"

-				PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_DATABASE;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

-				PrecompiledHeaderThrough="WebCorePrefix.h"

-				ForcedIncludeFiles="WebCorePrefix.h"

-			/>

-			<Tool

-				Name="VCManagedResourceCompilerTool"

-			/>

-			<Tool

-				Name="VCResourceCompilerTool"

-			/>

-			<Tool

-				Name="VCPreLinkEventTool"

-			/>

-			<Tool

-				Name="VCLibrarianTool"

-			/>

-			<Tool

-				Name="VCALinkTool"

-			/>

-			<Tool

-				Name="VCXDCMakeTool"

-			/>

-			<Tool

-				Name="VCBscMakeTool"

-			/>

-			<Tool

-				Name="VCFxCopTool"

-			/>

-			<Tool

-				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 	</Configurations>

@@ -440,16 +352,6 @@
 						ForcedIncludeFiles="$(NOINHERIT)"

 					/>

 				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						UsePrecompiledHeader="0"

-						DisableSpecificWarnings="4065;4273;4565;4701;4702"

-						ForcedIncludeFiles="$(NOINHERIT)"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\CSSGrammar.h"

@@ -498,26 +400,10 @@
 						UsePrecompiledHeader="0"

 					/>

 				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						UsePrecompiledHeader="0"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\HTMLElementFactory.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\HTMLElementFactory.h"

@@ -1924,16 +1810,6 @@
 						ForcedIncludeFiles="$(NOINHERIT)"

 					/>

 				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						UsePrecompiledHeader="0"

-						DisableSpecificWarnings="4065;4273;4565;4701;4702"

-						ForcedIncludeFiles="$(NOINHERIT)"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\XPathGrammar.h"

@@ -1941,107 +1817,151 @@
 			</File>

 		</Filter>

 		<Filter

+			Name="accessibility"

+			>

+			<File

+				RelativePath="..\accessibility\AccessibilityARIAGrid.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityARIAGrid.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityARIAGridCell.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityARIAGridCell.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityARIAGridRow.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityARIAGridRow.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityImageMapLink.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityImageMapLink.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityList.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityList.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityListBox.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityListBox.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityListBoxOption.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityListBoxOption.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityRenderObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityRenderObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityTable.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityTable.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityTableCell.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityTableCell.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityTableColumn.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityTableColumn.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityTableHeaderContainer.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityTableHeaderContainer.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityTableRow.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityTableRow.h"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AXObjectCache.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AXObjectCache.h"

+				>

+			</File>

+			<Filter

+				Name="win"

+				>

+				<File

+					RelativePath="..\accessibility\win\AccessibilityObjectWin.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\accessibility\win\AccessibilityObjectWrapperWin.h"

+					>

+				</File>

+				<File

+					RelativePath="..\accessibility\win\AXObjectCacheWin.cpp"

+					>

+				</File>

+			</Filter>

+		</Filter>

+		<Filter

 			Name="page"

 			>

 			<File

-				RelativePath="..\page\AccessibilityImageMapLink.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityImageMapLink.h"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityList.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityList.h"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityListBox.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityListBox.h"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityListBoxOption.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityListBoxOption.h"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityObject.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityObject.h"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityRenderObject.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityRenderObject.h"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityTable.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityTable.h"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityTableCell.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityTableCell.h"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityTableColumn.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityTableColumn.h"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityTableHeaderContainer.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityTableHeaderContainer.h"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityTableRow.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AccessibilityTableRow.h"

-				>

-			</File>

-			<File

 				RelativePath="..\page\animation\AnimationBase.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\animation\AnimationBase.h"

@@ -2050,14 +1970,6 @@
 			<File

 				RelativePath="..\page\animation\AnimationController.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\animation\AnimationController.h"

@@ -2068,24 +1980,8 @@
 				>

 			</File>

 			<File

-				RelativePath="..\page\AXObjectCache.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\page\AXObjectCache.h"

-				>

-			</File>

-			<File

 				RelativePath="..\page\BarInfo.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\BarInfo.h"

@@ -2094,14 +1990,6 @@
 			<File

 				RelativePath="..\page\Chrome.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\Chrome.h"

@@ -2114,14 +2002,6 @@
 			<File

 				RelativePath="..\page\animation\CompositeAnimation.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\animation\CompositeAnimation.h"

@@ -2130,14 +2010,6 @@
 			<File

 				RelativePath="..\page\Console.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\Console.h"

@@ -2150,14 +2022,6 @@
 			<File

 				RelativePath="..\page\ContextMenuController.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\ContextMenuController.h"

@@ -2166,14 +2030,6 @@
 			<File

 				RelativePath="..\page\Coordinates.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\Coordinates.h"

@@ -2182,14 +2038,6 @@
 			<File

 				RelativePath="..\page\DOMSelection.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\DOMSelection.h"

@@ -2206,14 +2054,6 @@
 			<File

 				RelativePath="..\page\DOMWindow.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\DOMWindow.h"

@@ -2230,14 +2070,6 @@
 			<File

 				RelativePath="..\page\DragController.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\DragController.h"

@@ -2246,14 +2078,6 @@
 			<File

 				RelativePath="..\page\win\DragControllerWin.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\bridge\EditorClient.h"

@@ -2262,14 +2086,6 @@
 			<File

 				RelativePath="..\page\EventHandler.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\EventHandler.h"

@@ -2278,26 +2094,10 @@
 			<File

 				RelativePath="..\page\win\EventHandlerWin.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\FocusController.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\FocusController.h"

@@ -2310,14 +2110,6 @@
 			<File

 				RelativePath="..\page\Frame.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\Frame.h"

@@ -2330,14 +2122,6 @@
 			<File

 				RelativePath="..\page\FrameTree.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\FrameTree.h"

@@ -2346,14 +2130,6 @@
 			<File

 				RelativePath="..\page\FrameView.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\FrameView.h"

@@ -2362,14 +2138,6 @@
 			<File

 				RelativePath="..\page\Geolocation.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\Geolocation.h"

@@ -2378,14 +2146,6 @@
 			<File

 				RelativePath="..\page\Geoposition.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\Geoposition.h"

@@ -2394,14 +2154,6 @@
 			<File

 				RelativePath="..\page\History.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\History.h"

@@ -2410,14 +2162,6 @@
 			<File

 				RelativePath="..\page\animation\ImplicitAnimation.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\animation\ImplicitAnimation.h"

@@ -2426,14 +2170,6 @@
 			<File

 				RelativePath="..\page\animation\KeyframeAnimation.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\animation\KeyframeAnimation.h"

@@ -2442,14 +2178,6 @@
 			<File

 				RelativePath="..\page\Location.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\Location.h"

@@ -2458,14 +2186,6 @@
 			<File

 				RelativePath="..\page\MouseEventWithHitTestResults.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\MouseEventWithHitTestResults.h"

@@ -2474,14 +2194,6 @@
 			<File

 				RelativePath="..\page\Navigator.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\Navigator.h"

@@ -2490,14 +2202,6 @@
 			<File

 				RelativePath="..\page\NavigatorBase.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\NavigatorBase.h"

@@ -2506,32 +2210,24 @@
 			<File

 				RelativePath="..\page\Page.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\PageGroup.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\PageGroup.h"

 				>

 			</File>

 			<File

+				RelativePath="..\page\PageGroupLoadDeferrer.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\page\PageGroupLoadDeferrer.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\Plugin.h"

 				>

 			</File>

@@ -2554,14 +2250,6 @@
 			<File

 				RelativePath="..\page\Screen.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\Screen.h"

@@ -2578,14 +2266,6 @@
 			<File

 				RelativePath="..\page\Settings.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\Settings.h"

@@ -2598,14 +2278,6 @@
 			<File

 				RelativePath="..\page\WindowFeatures.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\WindowFeatures.h"

@@ -2614,14 +2286,6 @@
 			<File

 				RelativePath="..\page\WorkerNavigator.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\page\WorkerNavigator.h"

@@ -2631,18 +2295,6 @@
 				Name="win"

 				>

 				<File

-					RelativePath="..\page\win\AccessibilityObjectWin.cpp"

-					>

-				</File>

-				<File

-					RelativePath="..\page\win\AccessibilityObjectWrapperWin.h"

-					>

-				</File>

-				<File

-					RelativePath="..\page\win\AXObjectCacheWin.cpp"

-					>

-				</File>

-				<File

 					RelativePath="..\page\win\FrameCairoWin.cpp"

 					>

 					<FileConfiguration

@@ -2669,14 +2321,6 @@
 							Name="VCCLCompilerTool"

 						/>

 					</FileConfiguration>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						ExcludedFromBuild="true"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\page\win\FrameCGWin.cpp"

@@ -3234,14 +2878,6 @@
 			<File

 				RelativePath="..\platform\CrossThreadCopier.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\platform\CrossThreadCopier.h"

@@ -3484,6 +3120,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\platform\SuddenTermination.h"

+				>

+			</File>

+			<File

 				RelativePath="..\platform\SystemTime.h"

 				>

 			</File>

@@ -3613,14 +3253,6 @@
 							Name="VCCLCompilerTool"

 						/>

 					</FileConfiguration>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						ExcludedFromBuild="true"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\win\DragImageCGWin.cpp"

@@ -3739,6 +3371,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\win\SystemInfo.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\win\SystemInfo.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\win\SystemTimeWin.cpp"

 					>

 				</File>

@@ -3794,15 +3434,6 @@
 							ForcedIncludeFiles="$(NOINHERIT)"

 						/>

 					</FileConfiguration>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							UsePrecompiledHeader="0"

-							ForcedIncludeFiles="$(NOINHERIT)"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\win\WCDataObject.h"

@@ -3841,6 +3472,14 @@
 				Name="cf"

 				>

 				<File

+					RelativePath="..\platform\cf\BinaryPropertyList.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\cf\BinaryPropertyList.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\cf\KURLCFNet.cpp"

 					>

 				</File>

@@ -3955,14 +3594,6 @@
 							AdditionalOptions="$(AnalyzeWithLargeStack)"

 						/>

 					</FileConfiguration>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							AdditionalOptions="$(AnalyzeWithLargeStack)"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\graphics\Font.h"

@@ -4290,14 +3921,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\FontDatabase.cpp"

@@ -4354,14 +3977,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\FontPlatformDataCGWin.cpp"

@@ -4430,14 +4045,6 @@
 								AdditionalOptions="$(AnalyzeWithLargeStack)"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-								AdditionalOptions="$(AnalyzeWithLargeStack)"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\GlyphPageTreeNodeCairoWin.cpp"

@@ -4466,14 +4073,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\GlyphPageTreeNodeCGWin.cpp"

@@ -4522,14 +4121,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\GraphicsContextCGWin.cpp"

@@ -4586,14 +4177,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\ImageCGWin.cpp"

@@ -4706,14 +4289,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\SimpleFontDataCGWin.cpp"

@@ -5182,14 +4757,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCustomBuildTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\FontCairo.cpp"

@@ -5218,14 +4785,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\GradientCairo.cpp"

@@ -5254,14 +4813,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\GraphicsContextCairo.cpp"

@@ -5290,14 +4841,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\GraphicsContextPlatformPrivateCairo.h"

@@ -5326,14 +4869,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCustomBuildTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\ImageBufferCairo.cpp"

@@ -5362,14 +4897,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\ImageCairo.cpp"

@@ -5398,14 +4925,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\ImageSourceCairo.cpp"

@@ -5434,14 +4953,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\PathCairo.cpp"

@@ -5470,14 +4981,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\PatternCairo.cpp"

@@ -5534,14 +5037,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -6019,26 +5514,6 @@
 							/>

 						</FileConfiguration>

 					</File>

-					<File

-						RelativePath="..\platform\network\cf\ResourceResponseCFNet.h"

-						>

-						<FileConfiguration

-							Name="Debug_Cairo|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCustomBuildTool"

-							/>

-						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_Cairo|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCustomBuildTool"

-							/>

-						</FileConfiguration>

-					</File>

 				</Filter>

 				<Filter

 					Name="win"

@@ -6090,14 +5565,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\win\CookieStorageWin.cpp"

@@ -6174,14 +5641,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\DNSCurl.cpp"

@@ -6238,14 +5697,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\FormDataStreamCurl.h"

@@ -6274,14 +5725,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceError.h"

@@ -6310,14 +5753,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceHandleCurl.cpp"

@@ -6346,14 +5781,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceHandleManager.cpp"

@@ -6382,14 +5809,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceHandleManager.h"

@@ -6418,14 +5837,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceRequest.h"

@@ -6454,14 +5865,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceResponse.h"

@@ -6490,14 +5893,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 				</Filter>

 			</Filter>

@@ -6723,14 +6118,6 @@
 							AdditionalOptions="$(AnalyzeWithLargeStack)"

 						/>

 					</FileConfiguration>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							AdditionalOptions="$(AnalyzeWithLargeStack)"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\text\TextCodecICU.h"

@@ -6773,11 +6160,11 @@
 					>

 				</File>

 				<File

-					RelativePath="..\platform\text\TextEncodingDetectorICU.cpp"

+					RelativePath="..\platform\text\TextEncodingDetector.h"

 					>

 				</File>

 				<File

-					RelativePath="..\platform\text\TextEncodingDetector.h"

+					RelativePath="..\platform\text\TextEncodingDetectorICU.cpp"

 					>

 				</File>

 				<File

@@ -6863,14 +6250,6 @@
 							Name="VCCustomBuildTool"

 						/>

 					</FileConfiguration>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						ExcludedFromBuild="true"

-						>

-						<Tool

-							Name="VCCustomBuildTool"

-						/>

-					</FileConfiguration>

 				</File>

 				<Filter

 					Name="gif"

@@ -6902,14 +6281,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\gif\GIFImageDecoder.h"

@@ -6938,14 +6309,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCustomBuildTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\gif\GIFImageReader.cpp"

@@ -6974,14 +6337,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\gif\GIFImageReader.h"

@@ -7010,14 +6365,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCustomBuildTool"

-							/>

-						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -7050,14 +6397,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\jpeg\JPEGImageDecoder.h"

@@ -7086,14 +6425,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCustomBuildTool"

-							/>

-						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -7126,14 +6457,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\png\PNGImageDecoder.h"

@@ -7162,14 +6485,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCustomBuildTool"

-							/>

-						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -7202,14 +6517,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\bmp\BMPImageDecoder.h"

@@ -7238,14 +6545,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCustomBuildTool"

-							/>

-						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -7278,14 +6577,6 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\ico\ICOImageDecoder.h"

@@ -7314,14 +6605,6 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCustomBuildTool"

-							/>

-						</FileConfiguration>

 					</File>

 				</Filter>

 			</Filter>

@@ -7376,15 +6659,6 @@
 							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"

 						/>

 					</FileConfiguration>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							ObjectFile="$(IntDir)\$(InputName)1.obj"

-							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\animation\Animation.h"

@@ -7438,15 +6712,6 @@
 							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"

 						/>

 					</FileConfiguration>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							ObjectFile="$(IntDir)\$(InputName)1.obj"

-							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\animation\AnimationList.h"

@@ -7468,14 +6733,6 @@
 			<File

 				RelativePath="..\css\CSSBorderImageValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSBorderImageValue.h"

@@ -7484,14 +6741,6 @@
 			<File

 				RelativePath="..\css\CSSCanvasValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSCanvasValue.h"

@@ -7500,14 +6749,6 @@
 			<File

 				RelativePath="..\css\CSSCharsetRule.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSCharsetRule.h"

@@ -7516,14 +6757,6 @@
 			<File

 				RelativePath="..\css\CSSComputedStyleDeclaration.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSComputedStyleDeclaration.h"

@@ -7532,14 +6765,6 @@
 			<File

 				RelativePath="..\css\CSSCursorImageValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSCursorImageValue.h"

@@ -7548,14 +6773,6 @@
 			<File

 				RelativePath="..\css\CSSFontFace.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSFontFace.h"

@@ -7564,14 +6781,6 @@
 			<File

 				RelativePath="..\css\CSSFontFaceRule.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSFontFaceRule.h"

@@ -7580,14 +6789,6 @@
 			<File

 				RelativePath="..\css\CSSFontFaceSource.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSFontFaceSource.h"

@@ -7596,14 +6797,6 @@
 			<File

 				RelativePath="..\css\CSSFontFaceSrcValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSFontFaceSrcValue.h"

@@ -7612,14 +6805,6 @@
 			<File

 				RelativePath="..\css\CSSFontSelector.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSFontSelector.h"

@@ -7628,14 +6813,6 @@
 			<File

 				RelativePath="..\css\CSSFunctionValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSFunctionValue.h"

@@ -7644,14 +6821,6 @@
 			<File

 				RelativePath="..\css\CSSGradientValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSGradientValue.h"

@@ -7664,14 +6833,6 @@
 			<File

 				RelativePath="..\css\CSSHelper.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSHelper.h"

@@ -7680,14 +6841,6 @@
 			<File

 				RelativePath="..\css\CSSImageGeneratorValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSImageGeneratorValue.h"

@@ -7696,14 +6849,6 @@
 			<File

 				RelativePath="..\css\CSSImageValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSImageValue.h"

@@ -7712,14 +6857,6 @@
 			<File

 				RelativePath="..\css\CSSImportRule.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSImportRule.h"

@@ -7728,14 +6865,6 @@
 			<File

 				RelativePath="..\css\CSSInheritedValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSInheritedValue.h"

@@ -7744,14 +6873,6 @@
 			<File

 				RelativePath="..\css\CSSInitialValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSInitialValue.h"

@@ -7760,14 +6881,6 @@
 			<File

 				RelativePath="..\css\CSSMediaRule.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSMediaRule.h"

@@ -7776,14 +6889,6 @@
 			<File

 				RelativePath="..\css\CSSMutableStyleDeclaration.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSMutableStyleDeclaration.h"

@@ -7796,14 +6901,6 @@
 			<File

 				RelativePath="..\css\CSSPageRule.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSPageRule.h"

@@ -7812,14 +6909,6 @@
 			<File

 				RelativePath="..\css\CSSParser.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSParser.h"

@@ -7828,14 +6917,6 @@
 			<File

 				RelativePath="..\css\CSSParserValues.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSParserValues.h"

@@ -7844,14 +6925,6 @@
 			<File

 				RelativePath="..\css\CSSPrimitiveValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSPrimitiveValue.h"

@@ -7860,14 +6933,6 @@
 			<File

 				RelativePath="..\css\CSSProperty.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSProperty.h"

@@ -7876,14 +6941,6 @@
 			<File

 				RelativePath="..\css\CSSPropertyLonghand.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSPropertyLonghand.h"

@@ -7904,14 +6961,6 @@
 			<File

 				RelativePath="..\css\CSSReflectValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSReflectValue.h"

@@ -7920,14 +6969,6 @@
 			<File

 				RelativePath="..\css\CSSRule.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSRule.h"

@@ -7936,14 +6977,6 @@
 			<File

 				RelativePath="..\css\CSSRuleList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSRuleList.h"

@@ -7952,14 +6985,6 @@
 			<File

 				RelativePath="..\css\CSSSegmentedFontFace.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSSegmentedFontFace.h"

@@ -7968,14 +6993,6 @@
 			<File

 				RelativePath="..\css\CSSSelector.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSSelector.h"

@@ -7984,14 +7001,6 @@
 			<File

 				RelativePath="..\css\CSSSelectorList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSSelectorList.h"

@@ -8000,14 +7009,6 @@
 			<File

 				RelativePath="..\css\CSSStyleDeclaration.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSStyleDeclaration.h"

@@ -8016,14 +7017,6 @@
 			<File

 				RelativePath="..\css\CSSStyleRule.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSStyleRule.h"

@@ -8036,14 +7029,6 @@
 			<File

 				RelativePath="..\css\CSSStyleSelector.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSStyleSelector.h"

@@ -8052,14 +7037,6 @@
 			<File

 				RelativePath="..\css\CSSStyleSheet.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSStyleSheet.h"

@@ -8068,14 +7045,6 @@
 			<File

 				RelativePath="..\css\CSSTimingFunctionValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSTimingFunctionValue.h"

@@ -8084,14 +7053,6 @@
 			<File

 				RelativePath="..\css\CSSUnicodeRangeValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSUnicodeRangeValue.h"

@@ -8112,14 +7073,6 @@
 			<File

 				RelativePath="..\css\CSSValueList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSValueList.h"

@@ -8128,14 +7081,6 @@
 			<File

 				RelativePath="..\css\CSSVariableDependentValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSVariableDependentValue.h"

@@ -8144,14 +7089,6 @@
 			<File

 				RelativePath="..\css\CSSVariablesDeclaration.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSVariablesDeclaration.h"

@@ -8160,14 +7097,6 @@
 			<File

 				RelativePath="..\css\CSSVariablesRule.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\CSSVariablesRule.h"

@@ -8180,14 +7109,6 @@
 			<File

 				RelativePath="..\css\FontFamilyValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\FontFamilyValue.h"

@@ -8196,14 +7117,6 @@
 			<File

 				RelativePath="..\css\FontValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\FontValue.h"

@@ -8220,14 +7133,6 @@
 			<File

 				RelativePath="..\css\MediaFeatureNames.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\MediaFeatureNames.h"

@@ -8236,14 +7141,6 @@
 			<File

 				RelativePath="..\css\MediaList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\MediaList.h"

@@ -8252,14 +7149,6 @@
 			<File

 				RelativePath="..\css\MediaQuery.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\MediaQuery.h"

@@ -8268,14 +7157,6 @@
 			<File

 				RelativePath="..\css\MediaQueryEvaluator.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\MediaQueryEvaluator.h"

@@ -8284,14 +7165,6 @@
 			<File

 				RelativePath="..\css\MediaQueryExp.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\MediaQueryExp.h"

@@ -8312,14 +7185,6 @@
 			<File

 				RelativePath="..\css\ShadowValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\ShadowValue.h"

@@ -8328,14 +7193,6 @@
 			<File

 				RelativePath="..\css\StyleBase.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\StyleBase.h"

@@ -8344,14 +7201,6 @@
 			<File

 				RelativePath="..\css\StyleList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\StyleList.h"

@@ -8360,14 +7209,6 @@
 			<File

 				RelativePath="..\css\StyleSheet.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\StyleSheet.h"

@@ -8376,14 +7217,6 @@
 			<File

 				RelativePath="..\css\StyleSheetList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\StyleSheetList.h"

@@ -8392,38 +7225,14 @@
 			<File

 				RelativePath="..\css\SVGCSSComputedStyleDeclaration.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\SVGCSSParser.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\SVGCSSStyleSelector.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\tokenizer.flex"

@@ -8432,14 +7241,6 @@
 			<File

 				RelativePath="..\css\WebKitCSSKeyframeRule.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\WebKitCSSKeyframeRule.h"

@@ -8448,14 +7249,6 @@
 			<File

 				RelativePath="..\css\WebKitCSSKeyframesRule.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\WebKitCSSKeyframesRule.h"

@@ -8464,14 +7257,6 @@
 			<File

 				RelativePath="..\css\WebKitCSSMatrix.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\WebKitCSSMatrix.h"

@@ -8480,14 +7265,6 @@
 			<File

 				RelativePath="..\css\WebKitCSSTransformValue.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\css\WebKitCSSTransformValue.h"

@@ -8500,14 +7277,6 @@
 			<File

 				RelativePath="..\rendering\AutoTableLayout.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\AutoTableLayout.h"

@@ -8516,14 +7285,6 @@
 			<File

 				RelativePath="..\rendering\bidi.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\bidi.h"

@@ -8532,14 +7293,6 @@
 			<File

 				RelativePath="..\rendering\break_lines.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\break_lines.h"

@@ -8548,14 +7301,6 @@
 			<File

 				RelativePath="..\rendering\CounterNode.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\CounterNode.h"

@@ -8564,14 +7309,6 @@
 			<File

 				RelativePath="..\rendering\EllipsisBox.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\EllipsisBox.h"

@@ -8580,14 +7317,6 @@
 			<File

 				RelativePath="..\rendering\FixedTableLayout.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\FixedTableLayout.h"

@@ -8604,14 +7333,6 @@
 			<File

 				RelativePath="..\rendering\HitTestResult.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\HitTestResult.h"

@@ -8620,14 +7341,6 @@
 			<File

 				RelativePath="..\rendering\InlineBox.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\InlineBox.h"

@@ -8636,14 +7349,6 @@
 			<File

 				RelativePath="..\rendering\InlineFlowBox.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\InlineFlowBox.h"

@@ -8656,14 +7361,6 @@
 			<File

 				RelativePath="..\rendering\InlineTextBox.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\InlineTextBox.h"

@@ -8672,46 +7369,14 @@
 			<File

 				RelativePath="..\rendering\LayoutState.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\LayoutState.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\ListMarkerBox.cpp"

-				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

-			</File>

-			<File

-				RelativePath="..\rendering\ListMarkerBox.h"

-				>

-			</File>

-			<File

 				RelativePath="..\rendering\MediaControlElements.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\MediaControlElements.h"

@@ -8720,14 +7385,6 @@
 			<File

 				RelativePath="..\rendering\PointerEventsHitRules.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\PointerEventsHitRules.h"

@@ -8736,14 +7393,6 @@
 			<File

 				RelativePath="..\rendering\RenderApplet.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderApplet.h"

@@ -8752,14 +7401,6 @@
 			<File

 				RelativePath="..\rendering\RenderArena.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderArena.h"

@@ -8768,14 +7409,6 @@
 			<File

 				RelativePath="..\rendering\RenderBlock.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderBlock.h"

@@ -8784,14 +7417,6 @@
 			<File

 				RelativePath="..\rendering\RenderBox.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderBox.h"

@@ -8800,14 +7425,6 @@
 			<File

 				RelativePath="..\rendering\RenderBoxModelObject.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderBoxModelObject.h"

@@ -8816,14 +7433,6 @@
 			<File

 				RelativePath="..\rendering\RenderBR.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderBR.h"

@@ -8832,14 +7441,6 @@
 			<File

 				RelativePath="..\rendering\RenderButton.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderButton.h"

@@ -8848,14 +7449,6 @@
 			<File

 				RelativePath="..\rendering\RenderCounter.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderCounter.h"

@@ -8864,14 +7457,6 @@
 			<File

 				RelativePath="..\rendering\RenderFieldset.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderFieldset.h"

@@ -8880,14 +7465,6 @@
 			<File

 				RelativePath="..\rendering\RenderFileUploadControl.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderFileUploadControl.h"

@@ -8896,14 +7473,6 @@
 			<File

 				RelativePath="..\rendering\RenderFlexibleBox.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderFlexibleBox.h"

@@ -8912,14 +7481,6 @@
 			<File

 				RelativePath="..\rendering\RenderForeignObject.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderForeignObject.h"

@@ -8928,14 +7489,6 @@
 			<File

 				RelativePath="..\rendering\RenderFrame.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderFrame.h"

@@ -8944,14 +7497,6 @@
 			<File

 				RelativePath="..\rendering\RenderFrameSet.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderFrameSet.h"

@@ -8960,14 +7505,6 @@
 			<File

 				RelativePath="..\rendering\RenderHTMLCanvas.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderHTMLCanvas.h"

@@ -8976,14 +7513,6 @@
 			<File

 				RelativePath="..\rendering\RenderImage.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderImage.h"

@@ -8992,14 +7521,6 @@
 			<File

 				RelativePath="..\rendering\RenderImageGeneratedContent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderImageGeneratedContent.h"

@@ -9008,14 +7529,6 @@
 			<File

 				RelativePath="..\rendering\RenderInline.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderInline.h"

@@ -9024,14 +7537,6 @@
 			<File

 				RelativePath="..\rendering\RenderLayer.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderLayer.h"

@@ -9040,14 +7545,6 @@
 			<File

 				RelativePath="..\rendering\RenderLineBoxList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderLineBoxList.h"

@@ -9056,14 +7553,6 @@
 			<File

 				RelativePath="..\rendering\RenderListBox.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderListBox.h"

@@ -9072,14 +7561,6 @@
 			<File

 				RelativePath="..\rendering\RenderListItem.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderListItem.h"

@@ -9088,14 +7569,6 @@
 			<File

 				RelativePath="..\rendering\RenderListMarker.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderListMarker.h"

@@ -9104,14 +7577,6 @@
 			<File

 				RelativePath="..\rendering\RenderMarquee.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderMarquee.h"

@@ -9120,30 +7585,54 @@
 			<File

 				RelativePath="..\rendering\RenderMedia.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderMedia.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderMenuList.cpp"

+				RelativePath="..\rendering\RenderMediaControls.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderMediaControls.h"

+				>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCustomBuildTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCustomBuildTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderMenuList.cpp"

+				>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderMenuList.h"

@@ -9152,14 +7641,6 @@
 			<File

 				RelativePath="..\rendering\RenderObject.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderObject.h"

@@ -9168,14 +7649,6 @@
 			<File

 				RelativePath="..\rendering\RenderObjectChildList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderObjectChildList.h"

@@ -9184,14 +7657,6 @@
 			<File

 				RelativePath="..\rendering\RenderPart.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderPart.h"

@@ -9200,14 +7665,6 @@
 			<File

 				RelativePath="..\rendering\RenderPartObject.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderPartObject.h"

@@ -9216,14 +7673,6 @@
 			<File

 				RelativePath="..\rendering\RenderPath.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderPath.h"

@@ -9232,14 +7681,6 @@
 			<File

 				RelativePath="..\rendering\RenderReplaced.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderReplaced.h"

@@ -9248,14 +7689,6 @@
 			<File

 				RelativePath="..\rendering\RenderReplica.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderReplica.h"

@@ -9264,14 +7697,6 @@
 			<File

 				RelativePath="..\rendering\RenderScrollbar.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderScrollbar.h"

@@ -9280,14 +7705,6 @@
 			<File

 				RelativePath="..\rendering\RenderScrollbarPart.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderScrollbarPart.h"

@@ -9296,14 +7713,6 @@
 			<File

 				RelativePath="..\rendering\RenderScrollbarTheme.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderScrollbarTheme.h"

@@ -9316,14 +7725,6 @@
 			<File

 				RelativePath="..\rendering\RenderSlider.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSlider.h"

@@ -9332,14 +7733,6 @@
 			<File

 				RelativePath="..\rendering\RenderSVGBlock.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGBlock.h"

@@ -9348,14 +7741,6 @@
 			<File

 				RelativePath="..\rendering\RenderSVGContainer.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGContainer.h"

@@ -9364,14 +7749,6 @@
 			<File

 				RelativePath="..\rendering\RenderSVGGradientStop.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGGradientStop.h"

@@ -9380,14 +7757,6 @@
 			<File

 				RelativePath="..\rendering\RenderSVGHiddenContainer.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGHiddenContainer.h"

@@ -9396,14 +7765,6 @@
 			<File

 				RelativePath="..\rendering\RenderSVGImage.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGImage.h"

@@ -9412,14 +7773,6 @@
 			<File

 				RelativePath="..\rendering\RenderSVGInline.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGInline.h"

@@ -9428,30 +7781,22 @@
 			<File

 				RelativePath="..\rendering\RenderSVGInlineText.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGInlineText.h"

 				>

 			</File>

 			<File

+				RelativePath="..\rendering\RenderSVGModelObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderSVGModelObject.h"

+				>

+			</File>

+			<File

 				RelativePath="..\rendering\RenderSVGRoot.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGRoot.h"

@@ -9460,14 +7805,6 @@
 			<File

 				RelativePath="..\rendering\RenderSVGText.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGText.h"

@@ -9476,14 +7813,6 @@
 			<File

 				RelativePath="..\rendering\RenderSVGTextPath.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGTextPath.h"

@@ -9492,14 +7821,6 @@
 			<File

 				RelativePath="..\rendering\RenderSVGTransformableContainer.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGTransformableContainer.h"

@@ -9508,14 +7829,6 @@
 			<File

 				RelativePath="..\rendering\RenderSVGTSpan.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGTSpan.h"

@@ -9524,26 +7837,10 @@
 			<File

 				RelativePath="..\rendering\RenderSVGViewportContainer.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTable.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTable.h"

@@ -9552,14 +7849,6 @@
 			<File

 				RelativePath="..\rendering\RenderTableCell.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTableCell.h"

@@ -9568,14 +7857,6 @@
 			<File

 				RelativePath="..\rendering\RenderTableCol.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTableCol.h"

@@ -9584,14 +7865,6 @@
 			<File

 				RelativePath="..\rendering\RenderTableRow.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTableRow.h"

@@ -9600,14 +7873,6 @@
 			<File

 				RelativePath="..\rendering\RenderTableSection.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTableSection.h"

@@ -9616,14 +7881,6 @@
 			<File

 				RelativePath="..\rendering\RenderText.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderText.h"

@@ -9632,14 +7889,6 @@
 			<File

 				RelativePath="..\rendering\RenderTextControl.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTextControl.h"

@@ -9648,14 +7897,6 @@
 			<File

 				RelativePath="..\rendering\RenderTextControlMultiLine.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTextControlMultiLine.h"

@@ -9664,14 +7905,6 @@
 			<File

 				RelativePath="..\rendering\RenderTextControlSingleLine.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTextControlSingleLine.h"

@@ -9680,14 +7913,6 @@
 			<File

 				RelativePath="..\rendering\RenderTextFragment.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTextFragment.h"

@@ -9696,14 +7921,6 @@
 			<File

 				RelativePath="..\rendering\RenderTheme.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTheme.h"

@@ -9728,14 +7945,6 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderThemeSafari.h"

@@ -9799,25 +8008,10 @@
 						Name="VCCustomBuildTool"

 					/>

 				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCustomBuildTool"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTreeAsText.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTreeAsText.h"

@@ -9826,14 +8020,6 @@
 			<File

 				RelativePath="..\rendering\RenderVideo.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderVideo.h"

@@ -9842,14 +8028,6 @@
 			<File

 				RelativePath="..\rendering\RenderView.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderView.h"

@@ -9858,14 +8036,6 @@
 			<File

 				RelativePath="..\rendering\RenderWidget.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderWidget.h"

@@ -9874,14 +8044,6 @@
 			<File

 				RelativePath="..\rendering\RenderWordBreak.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderWordBreak.h"

@@ -9890,14 +8052,6 @@
 			<File

 				RelativePath="..\rendering\RootInlineBox.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RootInlineBox.h"

@@ -9906,14 +8060,6 @@
 			<File

 				RelativePath="..\rendering\ScrollBehavior.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\ScrollBehavior.h"

@@ -9922,38 +8068,14 @@
 			<File

 				RelativePath="..\rendering\SVGCharacterLayoutInfo.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGCharacterLayoutInfo.h"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGInlineFlowBox.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGInlineFlowBox.h"

@@ -9962,14 +8084,6 @@
 			<File

 				RelativePath="..\rendering\SVGInlineTextBox.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGInlineTextBox.h"

@@ -9978,14 +8092,6 @@
 			<File

 				RelativePath="..\rendering\SVGRenderSupport.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGRenderSupport.h"

@@ -9994,14 +8100,6 @@
 			<File

 				RelativePath="..\rendering\SVGRenderTreeAsText.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGRenderTreeAsText.h"

@@ -10010,14 +8108,6 @@
 			<File

 				RelativePath="..\rendering\SVGRootInlineBox.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGRootInlineBox.h"

@@ -10049,14 +8139,6 @@
 				<File

 					RelativePath="..\rendering\style\BindingURI.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\BindingURI.h"

@@ -10077,14 +8159,6 @@
 				<File

 					RelativePath="..\rendering\style\ContentData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\ContentData.h"

@@ -10097,14 +8171,6 @@
 				<File

 					RelativePath="..\rendering\style\CounterDirectives.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\CounterDirectives.h"

@@ -10125,14 +8191,6 @@
 				<File

 					RelativePath="..\rendering\style\FillLayer.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\FillLayer.h"

@@ -10141,14 +8199,6 @@
 				<File

 					RelativePath="..\rendering\style\KeyframeList.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\KeyframeList.h"

@@ -10157,14 +8207,6 @@
 				<File

 					RelativePath="..\rendering\style\NinePieceImage.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\NinePieceImage.h"

@@ -10177,14 +8219,6 @@
 				<File

 					RelativePath="..\rendering\style\RenderStyle.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\RenderStyle.h"

@@ -10197,14 +8231,6 @@
 				<File

 					RelativePath="..\rendering\style\ShadowData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\ShadowData.h"

@@ -10213,14 +8239,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleBackgroundData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleBackgroundData.h"

@@ -10229,14 +8247,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleBoxData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleBoxData.h"

@@ -10245,14 +8255,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleCachedImage.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleCachedImage.h"

@@ -10261,14 +8263,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleFlexibleBoxData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleFlexibleBoxData.h"

@@ -10277,14 +8271,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleGeneratedImage.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleGeneratedImage.h"

@@ -10297,14 +8283,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleInheritedData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleInheritedData.h"

@@ -10313,14 +8291,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleMarqueeData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleMarqueeData.h"

@@ -10329,14 +8299,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleMultiColData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleMultiColData.h"

@@ -10345,14 +8307,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleRareInheritedData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleRareInheritedData.h"

@@ -10361,14 +8315,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleRareNonInheritedData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleRareNonInheritedData.h"

@@ -10381,14 +8327,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleSurroundData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleSurroundData.h"

@@ -10397,14 +8335,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleTransformData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleTransformData.h"

@@ -10413,14 +8343,6 @@
 				<File

 					RelativePath="..\rendering\style\StyleVisualData.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleVisualData.h"

@@ -10429,14 +8351,6 @@
 				<File

 					RelativePath="..\rendering\style\SVGRenderStyle.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\SVGRenderStyle.h"

@@ -10445,14 +8359,6 @@
 				<File

 					RelativePath="..\rendering\style\SVGRenderStyleDefs.cpp"

 					>

-					<FileConfiguration

-						Name="Release_PGO|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							WholeProgramOptimization="true"

-						/>

-					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\SVGRenderStyleDefs.h"

@@ -10623,15 +8529,6 @@
 						ForcedIncludeFiles="$(NOINHERIT)"

 					/>

 				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						UsePrecompiledHeader="0"

-						ForcedIncludeFiles="$(NOINHERIT)"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\xml\XPathParser.h"

@@ -10752,14 +8649,6 @@
 			<File

 				RelativePath="..\dom\Attr.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Attr.h"

@@ -10768,14 +8657,6 @@
 			<File

 				RelativePath="..\dom\Attribute.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Attribute.h"

@@ -10784,14 +8665,6 @@
 			<File

 				RelativePath="..\dom\BeforeTextInsertedEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\BeforeTextInsertedEvent.h"

@@ -10800,14 +8673,6 @@
 			<File

 				RelativePath="..\dom\BeforeUnloadEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\BeforeUnloadEvent.h"

@@ -10816,14 +8681,6 @@
 			<File

 				RelativePath="..\dom\CDATASection.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\CDATASection.h"

@@ -10832,30 +8689,22 @@
 			<File

 				RelativePath="..\dom\CharacterData.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\CharacterData.h"

 				>

 			</File>

 			<File

+				RelativePath="..\dom\CheckedRadioButtons.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\CheckedRadioButtons.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\ChildNodeList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ChildNodeList.h"

@@ -10864,14 +8713,6 @@
 			<File

 				RelativePath="..\dom\ClassNames.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ClassNames.h"

@@ -10880,14 +8721,6 @@
 			<File

 				RelativePath="..\dom\ClassNodeList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ClassNodeList.h"

@@ -10896,14 +8729,6 @@
 			<File

 				RelativePath="..\dom\ClientRect.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ClientRect.h"

@@ -10912,14 +8737,6 @@
 			<File

 				RelativePath="..\dom\ClientRectList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ClientRectList.h"

@@ -10928,14 +8745,6 @@
 			<File

 				RelativePath="..\dom\Clipboard.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Clipboard.h"

@@ -10948,14 +8757,6 @@
 			<File

 				RelativePath="..\dom\ClipboardEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ClipboardEvent.h"

@@ -10964,14 +8765,6 @@
 			<File

 				RelativePath="..\dom\Comment.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Comment.h"

@@ -10980,14 +8773,6 @@
 			<File

 				RelativePath="..\dom\ContainerNode.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ContainerNode.h"

@@ -10996,14 +8781,6 @@
 			<File

 				RelativePath="..\dom\CSSMappedAttributeDeclaration.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\CSSMappedAttributeDeclaration.h"

@@ -11016,14 +8793,6 @@
 			<File

 				RelativePath="..\dom\Document.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Document.h"

@@ -11032,14 +8801,6 @@
 			<File

 				RelativePath="..\dom\DocumentFragment.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DocumentFragment.h"

@@ -11052,14 +8813,6 @@
 			<File

 				RelativePath="..\dom\DocumentType.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DocumentType.h"

@@ -11072,14 +8825,6 @@
 			<File

 				RelativePath="..\dom\DOMImplementation.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DOMImplementation.h"

@@ -11088,14 +8833,6 @@
 			<File

 				RelativePath="..\dom\DOMStringList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DOMStringList.h"

@@ -11104,14 +8841,6 @@
 			<File

 				RelativePath="..\dom\DynamicNodeList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DynamicNodeList.h"

@@ -11120,14 +8849,6 @@
 			<File

 				RelativePath="..\dom\EditingText.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\EditingText.h"

@@ -11136,14 +8857,6 @@
 			<File

 				RelativePath="..\dom\Element.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Element.h"

@@ -11152,14 +8865,6 @@
 			<File

 				RelativePath="..\dom\Entity.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Entity.h"

@@ -11168,14 +8873,6 @@
 			<File

 				RelativePath="..\dom\EntityReference.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\EntityReference.h"

@@ -11184,14 +8881,6 @@
 			<File

 				RelativePath="..\dom\Event.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Event.h"

@@ -11208,14 +8897,6 @@
 			<File

 				RelativePath="..\dom\EventNames.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\EventNames.h"

@@ -11224,14 +8905,6 @@
 			<File

 				RelativePath="..\dom\EventTarget.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\EventTarget.h"

@@ -11240,14 +8913,6 @@
 			<File

 				RelativePath="..\dom\ExceptionBase.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ExceptionBase.h"

@@ -11256,62 +8921,14 @@
 			<File

 				RelativePath="..\dom\ExceptionCode.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ExceptionCode.h"

 				>

 			</File>

 			<File

-				RelativePath="..\dom\FormControlElement.cpp"

-				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

-			</File>

-			<File

-				RelativePath="..\dom\FormControlElement.h"

-				>

-			</File>

-			<File

-				RelativePath="..\dom\FormControlElementWithState.cpp"

-				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

-			</File>

-			<File

-				RelativePath="..\dom\FormControlElementWithState.h"

-				>

-			</File>

-			<File

 				RelativePath="..\dom\InputElement.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\InputElement.h"

@@ -11320,14 +8937,6 @@
 			<File

 				RelativePath="..\dom\KeyboardEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\KeyboardEvent.h"

@@ -11336,14 +8945,6 @@
 			<File

 				RelativePath="..\dom\MappedAttribute.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MappedAttribute.h"

@@ -11364,14 +8965,6 @@
 			<File

 				RelativePath="..\dom\MessageEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MessageEvent.h"

@@ -11386,16 +8979,12 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\MessagePortProxy.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\MouseEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MouseEvent.h"

@@ -11404,14 +8993,6 @@
 			<File

 				RelativePath="..\dom\MouseRelatedEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MouseRelatedEvent.h"

@@ -11420,14 +9001,6 @@
 			<File

 				RelativePath="..\dom\MutationEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MutationEvent.h"

@@ -11436,14 +9009,6 @@
 			<File

 				RelativePath="..\dom\NamedAttrMap.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\NamedAttrMap.h"

@@ -11452,14 +9017,6 @@
 			<File

 				RelativePath="..\dom\NamedMappedAttrMap.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\NamedMappedAttrMap.h"

@@ -11472,14 +9029,6 @@
 			<File

 				RelativePath="..\dom\NameNodeList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\NameNodeList.h"

@@ -11488,14 +9037,6 @@
 			<File

 				RelativePath="..\dom\Node.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Node.h"

@@ -11504,14 +9045,6 @@
 			<File

 				RelativePath="..\dom\NodeFilter.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\NodeFilter.h"

@@ -11520,14 +9053,6 @@
 			<File

 				RelativePath="..\dom\NodeFilterCondition.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\NodeFilterCondition.h"

@@ -11536,14 +9061,6 @@
 			<File

 				RelativePath="..\dom\NodeIterator.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\NodeIterator.h"

@@ -11552,14 +9069,6 @@
 			<File

 				RelativePath="..\dom\Notation.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Notation.h"

@@ -11568,14 +9077,6 @@
 			<File

 				RelativePath="..\dom\OptionElement.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\OptionElement.h"

@@ -11584,14 +9085,6 @@
 			<File

 				RelativePath="..\dom\OptionGroupElement.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\OptionGroupElement.h"

@@ -11600,14 +9093,6 @@
 			<File

 				RelativePath="..\dom\OverflowEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\OverflowEvent.h"

@@ -11616,14 +9101,6 @@
 			<File

 				RelativePath="..\dom\Position.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Position.h"

@@ -11632,14 +9109,6 @@
 			<File

 				RelativePath="..\dom\PositionIterator.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\PositionIterator.h"

@@ -11648,14 +9117,6 @@
 			<File

 				RelativePath="..\dom\ProcessingInstruction.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ProcessingInstruction.h"

@@ -11664,14 +9125,6 @@
 			<File

 				RelativePath="..\dom\ProgressEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ProgressEvent.h"

@@ -11680,14 +9133,6 @@
 			<File

 				RelativePath="..\dom\QualifiedName.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\QualifiedName.h"

@@ -11696,14 +9141,6 @@
 			<File

 				RelativePath="..\dom\Range.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Range.h"

@@ -11720,14 +9157,6 @@
 			<File

 				RelativePath="..\dom\RegisteredEventListener.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\RegisteredEventListener.h"

@@ -11736,14 +9165,6 @@
 			<File

 				RelativePath="..\dom\ScriptElement.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ScriptElement.h"

@@ -11752,30 +9173,22 @@
 			<File

 				RelativePath="..\dom\ScriptExecutionContext.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ScriptExecutionContext.h"

 				>

 			</File>

 			<File

+				RelativePath="..\dom\SelectElement.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\SelectElement.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\SelectorNodeList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\SelectorNodeList.h"

@@ -11784,14 +9197,6 @@
 			<File

 				RelativePath="..\dom\StaticNodeList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\StaticNodeList.h"

@@ -11800,14 +9205,6 @@
 			<File

 				RelativePath="..\dom\StaticStringList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\StaticStringList.h"

@@ -11816,14 +9213,6 @@
 			<File

 				RelativePath="..\dom\StyledElement.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\StyledElement.h"

@@ -11832,14 +9221,6 @@
 			<File

 				RelativePath="..\dom\StyleElement.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\StyleElement.h"

@@ -11848,14 +9229,6 @@
 			<File

 				RelativePath="..\dom\TagNodeList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\TagNodeList.h"

@@ -11864,14 +9237,6 @@
 			<File

 				RelativePath="..\dom\Text.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Text.h"

@@ -11880,14 +9245,6 @@
 			<File

 				RelativePath="..\dom\TextEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\TextEvent.h"

@@ -11900,14 +9257,6 @@
 			<File

 				RelativePath="..\dom\Traversal.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Traversal.h"

@@ -11916,14 +9265,6 @@
 			<File

 				RelativePath="..\dom\TreeWalker.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\TreeWalker.h"

@@ -11932,14 +9273,6 @@
 			<File

 				RelativePath="..\dom\UIEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\UIEvent.h"

@@ -11948,14 +9281,6 @@
 			<File

 				RelativePath="..\dom\UIEventWithKeyState.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\UIEventWithKeyState.h"

@@ -11964,14 +9289,6 @@
 			<File

 				RelativePath="..\dom\WebKitAnimationEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\WebKitAnimationEvent.h"

@@ -11980,14 +9297,6 @@
 			<File

 				RelativePath="..\dom\WebKitTransitionEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\WebKitTransitionEvent.h"

@@ -11996,14 +9305,6 @@
 			<File

 				RelativePath="..\dom\WheelEvent.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\WheelEvent.h"

@@ -12012,14 +9313,6 @@
 			<File

 				RelativePath="..\dom\XMLTokenizer.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\XMLTokenizer.h"

@@ -12028,14 +9321,14 @@
 			<File

 				RelativePath="..\dom\XMLTokenizerLibxml2.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="..\dom\XMLTokenizerScope.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\XMLTokenizerScope.h"

+				>

 			</File>

 		</Filter>

 		<Filter

@@ -12074,6 +9367,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\workers\WorkerLoaderProxy.h"

+				>

+			</File>

+			<File

 				RelativePath="..\workers\WorkerLocation.cpp"

 				>

 			</File>

@@ -12366,6 +9663,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\editing\ReplaceNodeWithSpanCommand.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\editing\ReplaceNodeWithSpanCommand.h"

+				>

+			</File>

+			<File

 				RelativePath="..\editing\ReplaceSelectionCommand.cpp"

 				>

 			</File>

@@ -12496,14 +9801,6 @@
 			<File

 				RelativePath="..\html\CanvasGradient.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\CanvasGradient.h"

@@ -12512,14 +9809,6 @@
 			<File

 				RelativePath="..\html\CanvasPattern.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\CanvasPattern.h"

@@ -12528,14 +9817,6 @@
 			<File

 				RelativePath="..\html\CanvasPixelArray.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\CanvasPixelArray.h"

@@ -12544,14 +9825,6 @@
 			<File

 				RelativePath="..\html\CanvasRenderingContext2D.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\CanvasRenderingContext2D.h"

@@ -12560,21 +9833,13 @@
 			<File

 				RelativePath="..\html\CanvasStyle.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\CanvasStyle.h"

 				>

 			</File>

 			<File

-				RelativePath="..\html\File.cpp"

+				RelativePath="..\html\CollectionCache.cpp"

 				>

 				<FileConfiguration

 					Name="Release_PGO|Win32"

@@ -12586,20 +9851,24 @@
 				</FileConfiguration>

 			</File>

 			<File

+				RelativePath="..\html\CollectionCache.h"

+				>

+			</File>

+			<File

+				RelativePath="..\html\CollectionType.h"

+				>

+			</File>

+			<File

+				RelativePath="..\html\File.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\html\File.h"

 				>

 			</File>

 			<File

 				RelativePath="..\html\FileList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\FileList.h"

@@ -12608,14 +9877,6 @@
 			<File

 				RelativePath="..\html\FormDataList.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\FormDataList.h"

@@ -12625,11 +9886,43 @@
 				RelativePath="..\html\HTMLAnchorElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12641,11 +9934,43 @@
 				RelativePath="..\html\HTMLAppletElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12657,11 +9982,43 @@
 				RelativePath="..\html\HTMLAreaElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12673,11 +10030,43 @@
 				RelativePath="..\html\HTMLAudioElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12689,11 +10078,43 @@
 				RelativePath="..\html\HTMLBaseElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12705,11 +10126,43 @@
 				RelativePath="..\html\HTMLBaseFontElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12721,11 +10174,43 @@
 				RelativePath="..\html\HTMLBlockquoteElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12737,11 +10222,43 @@
 				RelativePath="..\html\HTMLBodyElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12753,11 +10270,43 @@
 				RelativePath="..\html\HTMLBRElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12769,11 +10318,43 @@
 				RelativePath="..\html\HTMLButtonElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12785,11 +10366,43 @@
 				RelativePath="..\html\HTMLCanvasElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12800,14 +10413,6 @@
 			<File

 				RelativePath="..\html\HTMLCollection.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLCollection.h"

@@ -12817,11 +10422,43 @@
 				RelativePath="..\html\HTMLDirectoryElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12833,11 +10470,43 @@
 				RelativePath="..\html\HTMLDivElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12849,11 +10518,43 @@
 				RelativePath="..\html\HTMLDListElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12864,14 +10565,6 @@
 			<File

 				RelativePath="..\html\HTMLDocument.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLDocument.h"

@@ -12881,11 +10574,43 @@
 				RelativePath="..\html\HTMLElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12894,14 +10619,50 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\HTMLElementsAllInOne.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\html\HTMLEmbedElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12913,11 +10674,43 @@
 				RelativePath="..\html\HTMLFieldSetElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12929,11 +10722,43 @@
 				RelativePath="..\html\HTMLFontElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12944,14 +10769,6 @@
 			<File

 				RelativePath="..\html\HTMLFormCollection.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLFormCollection.h"

@@ -12961,11 +10778,43 @@
 				RelativePath="..\html\HTMLFormControlElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -12976,6 +10825,46 @@
 			<File

 				RelativePath="..\html\HTMLFormElement.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLFormElement.h"

@@ -12985,11 +10874,43 @@
 				RelativePath="..\html\HTMLFrameElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13001,11 +10922,43 @@
 				RelativePath="..\html\HTMLFrameElementBase.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13017,11 +10970,43 @@
 				RelativePath="..\html\HTMLFrameOwnerElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13033,11 +11018,43 @@
 				RelativePath="..\html\HTMLFrameSetElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13049,11 +11066,43 @@
 				RelativePath="..\html\HTMLHeadElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13065,11 +11114,43 @@
 				RelativePath="..\html\HTMLHeadingElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13081,11 +11162,43 @@
 				RelativePath="..\html\HTMLHRElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13097,11 +11210,43 @@
 				RelativePath="..\html\HTMLHtmlElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13113,11 +11258,43 @@
 				RelativePath="..\html\HTMLIFrameElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13129,11 +11306,43 @@
 				RelativePath="..\html\HTMLImageElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13144,14 +11353,6 @@
 			<File

 				RelativePath="..\html\HTMLImageLoader.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLImageLoader.h"

@@ -13161,11 +11362,43 @@
 				RelativePath="..\html\HTMLInputElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13177,11 +11410,43 @@
 				RelativePath="..\html\HTMLIsIndexElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13193,11 +11458,43 @@
 				RelativePath="..\html\HTMLKeygenElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13209,11 +11506,43 @@
 				RelativePath="..\html\HTMLLabelElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13225,11 +11554,43 @@
 				RelativePath="..\html\HTMLLegendElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13241,11 +11602,43 @@
 				RelativePath="..\html\HTMLLIElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13257,11 +11650,43 @@
 				RelativePath="..\html\HTMLLinkElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13273,11 +11698,43 @@
 				RelativePath="..\html\HTMLMapElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13289,11 +11746,43 @@
 				RelativePath="..\html\HTMLMarqueeElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13305,11 +11794,43 @@
 				RelativePath="..\html\HTMLMediaElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13321,11 +11842,43 @@
 				RelativePath="..\html\HTMLMenuElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13337,11 +11890,43 @@
 				RelativePath="..\html\HTMLMetaElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13353,11 +11938,43 @@
 				RelativePath="..\html\HTMLModElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13368,6 +11985,14 @@
 			<File

 				RelativePath="..\html\HTMLNameCollection.cpp"

 				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLNameCollection.h"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLNoScriptElement.cpp"

+				>

 				<FileConfiguration

 					Name="Release_PGO|Win32"

 					>

@@ -13378,18 +12003,50 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\html\HTMLNameCollection.h"

+				RelativePath="..\html\HTMLNoScriptElement.h"

 				>

 			</File>

 			<File

 				RelativePath="..\html\HTMLObjectElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13401,11 +12058,43 @@
 				RelativePath="..\html\HTMLOListElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13417,11 +12106,43 @@
 				RelativePath="..\html\HTMLOptGroupElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13433,11 +12154,43 @@
 				RelativePath="..\html\HTMLOptionElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13448,14 +12201,6 @@
 			<File

 				RelativePath="..\html\HTMLOptionsCollection.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLOptionsCollection.h"

@@ -13465,11 +12210,43 @@
 				RelativePath="..\html\HTMLParagraphElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13481,11 +12258,43 @@
 				RelativePath="..\html\HTMLParamElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13496,14 +12305,6 @@
 			<File

 				RelativePath="..\html\HTMLParser.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLParser.h"

@@ -13512,14 +12313,6 @@
 			<File

 				RelativePath="..\html\HTMLParserErrorCodes.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLParserErrorCodes.h"

@@ -13529,11 +12322,43 @@
 				RelativePath="..\html\HTMLPlugInElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13545,11 +12370,43 @@
 				RelativePath="..\html\HTMLPlugInImageElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13561,11 +12418,43 @@
 				RelativePath="..\html\HTMLPreElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13577,11 +12466,43 @@
 				RelativePath="..\html\HTMLQuoteElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13593,11 +12514,43 @@
 				RelativePath="..\html\HTMLScriptElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13609,11 +12562,43 @@
 				RelativePath="..\html\HTMLSelectElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13625,11 +12610,43 @@
 				RelativePath="..\html\HTMLSourceElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13641,11 +12658,43 @@
 				RelativePath="..\html\HTMLStyleElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13657,11 +12706,43 @@
 				RelativePath="..\html\HTMLTableCaptionElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13673,11 +12754,43 @@
 				RelativePath="..\html\HTMLTableCellElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13689,11 +12802,43 @@
 				RelativePath="..\html\HTMLTableColElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13705,11 +12850,43 @@
 				RelativePath="..\html\HTMLTableElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13721,11 +12898,43 @@
 				RelativePath="..\html\HTMLTablePartElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13737,11 +12946,43 @@
 				RelativePath="..\html\HTMLTableRowElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13752,14 +12993,6 @@
 			<File

 				RelativePath="..\html\HTMLTableRowsCollection.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLTableRowsCollection.h"

@@ -13769,11 +13002,43 @@
 				RelativePath="..\html\HTMLTableSectionElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13785,11 +13050,43 @@
 				RelativePath="..\html\HTMLTextAreaElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13801,11 +13098,43 @@
 				RelativePath="..\html\HTMLTitleElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13816,14 +13145,6 @@
 			<File

 				RelativePath="..\html\HTMLTokenizer.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLTokenizer.h"

@@ -13833,11 +13154,43 @@
 				RelativePath="..\html\HTMLUListElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13849,11 +13202,43 @@
 				RelativePath="..\html\HTMLVideoElement.cpp"

 				>

 				<FileConfiguration

-					Name="Release_PGO|Win32"

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

 					>

 					<Tool

 						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

 			</File>

@@ -13864,14 +13249,6 @@
 			<File

 				RelativePath="..\html\HTMLViewSourceDocument.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLViewSourceDocument.h"

@@ -13880,14 +13257,6 @@
 			<File

 				RelativePath="..\html\ImageData.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\ImageData.h"

@@ -13900,14 +13269,6 @@
 			<File

 				RelativePath="..\html\PreloadScanner.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\PreloadScanner.h"

@@ -13916,14 +13277,6 @@
 			<File

 				RelativePath="..\html\TimeRanges.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\TimeRanges.h"

@@ -13981,6 +13334,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSCoordinatesCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSCSSRuleCustom.cpp"

 					>

 				</File>

@@ -14133,10 +13490,6 @@
 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSEventTargetBase.h"

-					>

-				</File>

-				<File

 					RelativePath="..\bindings\js\JSGeolocationCustom.cpp"

 					>

 				</File>

@@ -14537,6 +13890,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\ScriptEventListener.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\ScriptEventListener.h"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\ScriptFunctionCall.cpp"

 					>

 				</File>

@@ -14569,6 +13930,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\ScriptState.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\ScriptState.h"

 					>

 				</File>

@@ -15457,30 +14822,6 @@
 					>

 				</File>

 				<Filter

-					Name="cg"

-					>

-					<File

-						RelativePath="..\svg\graphics\cg\SVGResourceFilterCg.cpp"

-						>

-						<FileConfiguration

-							Name="Debug_Cairo|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_Cairo|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-					</File>

-				</Filter>

-				<Filter

 					Name="filters"

 					>

 					<File

@@ -15612,14 +14953,6 @@
 						>

 					</File>

 					<File

-						RelativePath="..\svg\graphics\filters\SVGFilterEffect.cpp"

-						>

-					</File>

-					<File

-						RelativePath="..\svg\graphics\filters\SVGFilterEffect.h"

-						>

-					</File>

-					<File

 						RelativePath="..\svg\graphics\filters\SVGLightSource.cpp"

 						>

 					</File>

@@ -15636,46 +14969,6 @@
 						>

 					</File>

 				</Filter>

-				<Filter

-					Name="cairo"

-					>

-					<File

-						RelativePath="..\svg\graphics\cairo\SVGResourceFilterCairo.cpp"

-						>

-						<FileConfiguration

-							Name="Debug|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-						<FileConfiguration

-							Name="Release|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-						<FileConfiguration

-							Name="Debug_Internal|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-						<FileConfiguration

-							Name="Release_PGO|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-					</File>

-				</Filter>

 			</Filter>

 		</Filter>

 		<Filter

@@ -15757,6 +15050,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\ForwardingHeaders\wtf\OwnPtrCommon.h"

+					>

+				</File>

+				<File

+					RelativePath="..\ForwardingHeaders\wtf\PassOwnPtr.h"

+					>

+				</File>

+				<File

 					RelativePath="..\ForwardingHeaders\wtf\PassRefPtr.h"

 					>

 				</File>

@@ -15957,6 +15258,18 @@
 				RelativePath="..\history\PageCache.h"

 				>

 			</File>

+			<Filter

+				Name="cf"

+				>

+				<File

+					RelativePath="..\history\cf\HistoryPropertyList.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\history\cf\HistoryPropertyList.h"

+					>

+				</File>

+			</Filter>

 		</Filter>

 		<Filter

 			Name="storage"

@@ -16300,14 +15613,6 @@
 			<File

 				RelativePath="..\inspector\InspectorController.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\inspector\InspectorController.h"

@@ -16330,6 +15635,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InspectorFrontend.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InspectorFrontend.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorResource.cpp"

 				>

 			</File>

@@ -16340,14 +15653,6 @@
 			<File

 				RelativePath="..\inspector\JavaScriptCallFrame.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\inspector\JavaScriptCallFrame.h"

@@ -16360,14 +15665,6 @@
 			<File

 				RelativePath="..\inspector\JavaScriptDebugServer.cpp"

 				>

-				<FileConfiguration

-					Name="Release_PGO|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						WholeProgramOptimization="true"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\inspector\JavaScriptDebugServer.h"

@@ -16389,10 +15686,22 @@
 				RelativePath="..\inspector\JavaScriptProfileNode.h"

 				>

 			</File>

+			<File

+				RelativePath="..\inspector\JSONObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\JSONObject.h"

+				>

+			</File>

 			<Filter

 				Name="front-end"

 				>

 				<File

+					RelativePath="..\inspector\front-end\BottomUpProfileDataGridTree.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\Breakpoint.js"

 					>

 				</File>

@@ -16489,6 +15798,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\ProfileDataGridTree.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\PropertiesSection.js"

 					>

 				</File>

@@ -16549,6 +15862,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\TopDownProfileDataGridTree.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\treeoutline.js"

 					>

 				</File>

@@ -16798,6 +16115,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\wml\WMLSelectElement.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\wml\WMLSelectElement.h"

+				>

+			</File>

+			<File

 				RelativePath="..\wml\WMLSetvarElement.cpp"

 				>

 			</File>

@@ -16893,14 +16218,6 @@
 					UsePrecompiledHeader="1"

 				/>

 			</FileConfiguration>

-			<FileConfiguration

-				Name="Release_PGO|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-				/>

-			</FileConfiguration>

 		</File>

 		<File

 			RelativePath="..\WebCorePrefix.h"

diff --git a/WebCore/WebCore.vcproj/WebCoreCFNetwork.vsprops b/WebCore/WebCore.vcproj/WebCoreCFNetwork.vsprops
new file mode 100644
index 0000000..ea8f8e4
--- /dev/null
+++ b/WebCore/WebCore.vcproj/WebCoreCFNetwork.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WebCoreCFNetwork"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="$(ProjectDir)..\platform\network\cf"

+	/>

+</VisualStudioPropertySheet>

diff --git a/WebCore/WebCore.vcproj/WebCoreCG.vsprops b/WebCore/WebCore.vcproj/WebCoreCG.vsprops
new file mode 100644
index 0000000..2ff8330
--- /dev/null
+++ b/WebCore/WebCore.vcproj/WebCoreCG.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WebCoreCG"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\platform\graphics\cg&quot;;&quot;$(ProjectDir)..\svg\graphics\cg&quot;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/WebCore/WebCore.vcproj/WebCoreCURL.vsprops b/WebCore/WebCore.vcproj/WebCoreCURL.vsprops
new file mode 100644
index 0000000..aaadb97
--- /dev/null
+++ b/WebCore/WebCore.vcproj/WebCoreCURL.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WebCoreCURL"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="$(ProjectDir)..\platform\network\curl"

+	/>

+</VisualStudioPropertySheet>

diff --git a/WebCore/WebCore.vcproj/WebCoreCairo.vsprops b/WebCore/WebCore.vcproj/WebCoreCairo.vsprops
new file mode 100644
index 0000000..b1493d4
--- /dev/null
+++ b/WebCore/WebCore.vcproj/WebCoreCairo.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WebCoreCairo"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\platform\graphics\cairo&quot;;&quot;$(ProjectDir)..\svg\graphics\cairo&quot;;&quot;$(ProjectDir)..\platform\image-decoders&quot;;&quot;$(ProjectDir)..\platform\image-decoders\bmp&quot;;&quot;$(ProjectDir)..\platform\image-decoders\gif&quot;;&quot;$(ProjectDir)..\platform\image-decoders\ico&quot;;&quot;$(ProjectDir)..\platform\image-decoders\jpeg&quot;;&quot;$(ProjectDir)..\platform\image-decoders\png&quot;;&quot;$(ProjectDir)..\platform\image-decoders\xbm&quot;;&quot;$(ProjectDir)..\platform\image-decoders\zlib&quot;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
new file mode 100644
index 0000000..f7c97f5
--- /dev/null
+++ b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WebCoreCommon"

+	OutputDirectory="$(WebKitOutputDir)\lib"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"

+		PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_DATABASE;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+		UsePrecompiledHeader="2"

+		PrecompiledHeaderThrough="WebCorePrefix.h"

+		ForcedIncludeFiles="WebCorePrefix.h"

+	/>

+	<Tool

+		Name="VCPostBuildEventTool"

+		CommandLine=""

+	/>

+	<Tool

+		Name="VCPreBuildEventTool"

+		CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;exit /b&#x0D;&#x0A;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/WebCore/WebCore.vcproj/WebCoreMediaQT.vsprops b/WebCore/WebCore.vcproj/WebCoreMediaQT.vsprops
new file mode 100644
index 0000000..4915270
--- /dev/null
+++ b/WebCore/WebCore.vcproj/WebCoreMediaQT.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WebCoreMediaQT"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="$(WebKitOutputDir)\include\QTMovieWin"

+		PreprocessorDefinitions="ENABLE_VIDEO"

+	/>

+</VisualStudioPropertySheet>

diff --git a/WebCore/WebCore.vcproj/WebCorePthreads.vsprops b/WebCore/WebCore.vcproj/WebCorePthreads.vsprops
new file mode 100644
index 0000000..7757ee2
--- /dev/null
+++ b/WebCore/WebCore.vcproj/WebCorePthreads.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WebCorePthreads"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="$(WebKitLibrariesDir)\include\pthreads"

+	/>

+</VisualStudioPropertySheet>

diff --git a/WebCore/WebCore.vcproj/build-generated-files.sh b/WebCore/WebCore.vcproj/build-generated-files.sh
index 7064a3b..fe29a7c 100644
--- a/WebCore/WebCore.vcproj/build-generated-files.sh
+++ b/WebCore/WebCore.vcproj/build-generated-files.sh
@@ -65,5 +65,5 @@
 cd "${BUILT_PRODUCTS_DIR}/DerivedSources"
 
 export WebCore="${XSRCROOT}"
-export FEATURE_DEFINES="ENABLE_DATABASE ENABLE_DOM_STORAGE ENABLE_ICONDATABASE ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT"
+export FEATURE_DEFINES="ENABLE_DATABASE ENABLE_DOM_STORAGE ENABLE_ICONDATABASE ENABLE_JAVASCRIPT_DEBUGGER ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT"
 make -f "$WebCore/DerivedSources.make" -j ${NUMCPUS} || exit 1
diff --git a/WebCore/WebCore.xcodeproj/project.pbxproj b/WebCore/WebCore.xcodeproj/project.pbxproj
index c8a7394..c7b27ee 100644
--- a/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -50,21 +50,26 @@
 		0818AEE30EDB86BC00647B66 /* WMLEventHandlingElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 0818AEE10EDB86BC00647B66 /* WMLEventHandlingElement.h */; };
 		081D81310EE0E74D00D73689 /* WMLTimerElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 081D812F0EE0E74D00D73689 /* WMLTimerElement.cpp */; };
 		081D81320EE0E74D00D73689 /* WMLTimerElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 081D81300EE0E74D00D73689 /* WMLTimerElement.h */; };
+		081EBF3A0FD34F4100DA7559 /* SVGFilterBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 081EBF380FD34F4100DA7559 /* SVGFilterBuilder.cpp */; };
+		081EBF3B0FD34F4100DA7559 /* SVGFilterBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 081EBF390FD34F4100DA7559 /* SVGFilterBuilder.h */; };
 		08203A9F0ED8C35300B8B61A /* WMLAccessElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08203A9D0ED8C35300B8B61A /* WMLAccessElement.cpp */; };
 		08203AA00ED8C35300B8B61A /* WMLAccessElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08203A9E0ED8C35300B8B61A /* WMLAccessElement.h */; };
+		082341C50FCF3A9500D75BD6 /* WMLSelectElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 082341C30FCF3A9400D75BD6 /* WMLSelectElement.cpp */; };
+		082341C60FCF3A9500D75BD6 /* WMLSelectElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 082341C40FCF3A9400D75BD6 /* WMLSelectElement.h */; };
 		0839476C0ECE4BD600027350 /* WMLElementFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08FB84B00ECE373300DC064E /* WMLElementFactory.cpp */; };
 		0839476D0ECE4BD600027350 /* WMLElementFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 08FB84B10ECE373300DC064E /* WMLElementFactory.h */; };
 		083DAEA60F01A7FB00342754 /* RenderTextControlMultiLine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 083DAEA20F01A7FB00342754 /* RenderTextControlMultiLine.cpp */; };
 		083DAEA70F01A7FB00342754 /* RenderTextControlMultiLine.h in Headers */ = {isa = PBXBuildFile; fileRef = 083DAEA30F01A7FB00342754 /* RenderTextControlMultiLine.h */; };
 		083DAEA80F01A7FB00342754 /* RenderTextControlSingleLine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 083DAEA40F01A7FB00342754 /* RenderTextControlSingleLine.cpp */; };
 		083DAEA90F01A7FB00342754 /* RenderTextControlSingleLine.h in Headers */ = {isa = PBXBuildFile; fileRef = 083DAEA50F01A7FB00342754 /* RenderTextControlSingleLine.h */; };
+		084AEBE40FB505FA0038483E /* SelectElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 084AEBE20FB505FA0038483E /* SelectElement.cpp */; };
+		084AEBE50FB505FA0038483E /* SelectElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 084AEBE30FB505FA0038483E /* SelectElement.h */; };
 		084CE5CB0F27DADC00E6240E /* WMLOptGroupElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 084CE5C70F27DADC00E6240E /* WMLOptGroupElement.cpp */; };
 		084CE5CC0F27DADC00E6240E /* WMLOptGroupElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 084CE5C80F27DADC00E6240E /* WMLOptGroupElement.h */; };
 		084CE5CD0F27DADC00E6240E /* WMLOptionElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 084CE5C90F27DADC00E6240E /* WMLOptionElement.cpp */; };
 		084CE5CE0F27DADC00E6240E /* WMLOptionElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 084CE5CA0F27DADC00E6240E /* WMLOptionElement.h */; };
 		084DBAA10ED39D360038C226 /* WMLVariables.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 084DBA9D0ED39D350038C226 /* WMLVariables.cpp */; };
 		084DBAA20ED39D360038C226 /* WMLVariables.h in Headers */ = {isa = PBXBuildFile; fileRef = 084DBA9E0ED39D360038C226 /* WMLVariables.h */; };
-		085773350F0846010080583E /* FormControlElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 085773340F0846010080583E /* FormControlElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		08591AA50F085C4E009BACB1 /* InputElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08591AA40F085C4E009BACB1 /* InputElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		085AFDC80F2977350061F2B3 /* WMLFormControlElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 085AFDC60F2977350061F2B3 /* WMLFormControlElement.cpp */; };
 		085AFDC90F2977350061F2B3 /* WMLFormControlElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 085AFDC70F2977350061F2B3 /* WMLFormControlElement.h */; settings = {ATTRIBUTES = (); }; };
@@ -116,13 +121,12 @@
 		08A484770E5272C500C3FE76 /* ScriptElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08A484750E5272C500C3FE76 /* ScriptElement.cpp */; };
 		08A484780E5272C500C3FE76 /* ScriptElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08A484760E5272C500C3FE76 /* ScriptElement.h */; };
 		08A48A6E0E86CF6D00E225DD /* JSSVGElementInstanceCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08A48A6D0E86CF6D00E225DD /* JSSVGElementInstanceCustom.cpp */; };
-		08B93F750F293481000720C2 /* FormControlElementWithState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08B93F730F293481000720C2 /* FormControlElementWithState.cpp */; };
-		08B93F760F293481000720C2 /* FormControlElementWithState.h in Headers */ = {isa = PBXBuildFile; fileRef = 08B93F740F293481000720C2 /* FormControlElementWithState.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		08BFDFC40F099E70007DC2BF /* FormControlElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08BFDFC30F099E70007DC2BF /* FormControlElement.cpp */; };
 		08C4C5180EF19A4000E4840F /* WMLImageElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08C4C5140EF19A4000E4840F /* WMLImageElement.cpp */; };
 		08C4C5190EF19A4000E4840F /* WMLImageElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08C4C5150EF19A4000E4840F /* WMLImageElement.h */; };
 		08C4C51A0EF19A4000E4840F /* WMLImageLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08C4C5160EF19A4000E4840F /* WMLImageLoader.cpp */; };
 		08C4C51B0EF19A4000E4840F /* WMLImageLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 08C4C5170EF19A4000E4840F /* WMLImageLoader.h */; };
+		08C925190FCC7C4A00480DEC /* FilterEffect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08C925170FCC7C4A00480DEC /* FilterEffect.cpp */; };
+		08C9251A0FCC7C4A00480DEC /* FilterEffect.h in Headers */ = {isa = PBXBuildFile; fileRef = 08C925180FCC7C4A00480DEC /* FilterEffect.h */; };
 		08CD61BC0ED3929C002DDF51 /* WMLTaskElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08CD61B80ED3929C002DDF51 /* WMLTaskElement.cpp */; };
 		08CD61BD0ED3929C002DDF51 /* WMLTaskElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08CD61B90ED3929C002DDF51 /* WMLTaskElement.h */; };
 		08E192530EDE0C3A0087B780 /* WMLErrorHandling.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08E192510EDE0C390087B780 /* WMLErrorHandling.cpp */; };
@@ -136,7 +140,7 @@
 		0B8C56D40F28627F000502E1 /* HTTPHeaderMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0B8C56D30F28627F000502E1 /* HTTPHeaderMap.cpp */; };
 		0B9056190F2578BE0095FF6A /* DocumentThreadableLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0B9056150F2578BE0095FF6A /* DocumentThreadableLoader.cpp */; };
 		0B90561A0F2578BF0095FF6A /* DocumentThreadableLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 0B9056160F2578BE0095FF6A /* DocumentThreadableLoader.h */; settings = {ATTRIBUTES = (); }; };
-		0B90561B0F2578BF0095FF6A /* ThreadableLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 0B9056170F2578BE0095FF6A /* ThreadableLoader.h */; settings = {ATTRIBUTES = (); }; };
+		0B90561B0F2578BF0095FF6A /* ThreadableLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 0B9056170F2578BE0095FF6A /* ThreadableLoader.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0B90561C0F2578BF0095FF6A /* ThreadableLoaderClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 0B9056180F2578BE0095FF6A /* ThreadableLoaderClient.h */; settings = {ATTRIBUTES = (); }; };
 		0B90561E0F257E930095FF6A /* ThreadableLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0B90561D0F257E930095FF6A /* ThreadableLoader.cpp */; };
 		0B9056F80F2685F30095FF6A /* WorkerThreadableLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0B9056F60F2685F30095FF6A /* WorkerThreadableLoader.cpp */; };
@@ -204,6 +208,7 @@
 		185BCF290F3279CE000EA262 /* ThreadTimers.h in Headers */ = {isa = PBXBuildFile; fileRef = 185BCF270F3279CE000EA262 /* ThreadTimers.h */; };
 		188604B30F2E654A000B6443 /* DOMTimer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 188604B10F2E654A000B6443 /* DOMTimer.cpp */; };
 		188604B40F2E654A000B6443 /* DOMTimer.h in Headers */ = {isa = PBXBuildFile; fileRef = 188604B20F2E654A000B6443 /* DOMTimer.h */; };
+		18F831B80FD48C7800D8C56B /* WorkerLoaderProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 18F831B70FD48C7800D8C56B /* WorkerLoaderProxy.h */; };
 		1A0D57360A5C77FE007EDD4C /* OverflowEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A0D57340A5C77FE007EDD4C /* OverflowEvent.cpp */; };
 		1A0D57370A5C77FE007EDD4C /* OverflowEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A0D57350A5C77FE007EDD4C /* OverflowEvent.h */; };
 		1A0D57400A5C7867007EDD4C /* JSOverflowEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A0D573E0A5C7867007EDD4C /* JSOverflowEvent.cpp */; };
@@ -444,8 +449,6 @@
 		1AE82FEC0CAB07EE002237AE /* JSSQLResultSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AE82FEA0CAB07EE002237AE /* JSSQLResultSet.cpp */; };
 		1AE82FED0CAB07EE002237AE /* JSSQLResultSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AE82FEB0CAB07EE002237AE /* JSSQLResultSet.h */; };
 		1AE830440CAB0ED1002237AE /* JSDatabaseCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AE830420CAB0ED1002237AE /* JSDatabaseCustom.cpp */; };
-		1AF326460D78B5530068F0C4 /* AXObjectCacheMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AF326400D78B5530068F0C4 /* AXObjectCacheMac.mm */; };
-		1AF326780D78B9440068F0C4 /* AXObjectCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF326760D78B9440068F0C4 /* AXObjectCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AF326790D78B9440068F0C4 /* EditorClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF326770D78B9440068F0C4 /* EditorClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AFE117D0CBFFB36003017FA /* SQLResultSetRowList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */; };
 		1AFE117E0CBFFB36003017FA /* SQLResultSetRowList.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */; };
@@ -514,41 +517,40 @@
 		1CF6BE140E9BB4670025E1CD /* ObjCNodeFilterCondition.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1CF6BE120E9BB4670025E1CD /* ObjCNodeFilterCondition.mm */; };
 		1CF6BE150E9BB4670025E1CD /* ObjCNodeFilterCondition.h in Headers */ = {isa = PBXBuildFile; fileRef = 1CF6BE130E9BB4670025E1CD /* ObjCNodeFilterCondition.h */; };
 		1CFAE3230A6D6A3F0032593D /* libobjc.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 1CFAE3220A6D6A3F0032593D /* libobjc.dylib */; };
-		1CFCEE960AACC40100348750 /* DOMHTMLBodyElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEE8D0AACC3CD00348750 /* DOMHTMLBodyElementPrivate.h */; };
-		1CFCEE970AACC40100348750 /* DOMHTMLButtonElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEE8E0AACC3CD00348750 /* DOMHTMLButtonElementPrivate.h */; };
-		1CFCEE980AACC40100348750 /* DOMHTMLImageElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEE8F0AACC3CD00348750 /* DOMHTMLImageElementPrivate.h */; };
-		1CFCEE9B0AACC40100348750 /* DOMHTMLLinkElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEE920AACC3CD00348750 /* DOMHTMLLinkElementPrivate.h */; };
-		1CFCEE9D0AACC40100348750 /* DOMHTMLStyleElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEE940AACC3CD00348750 /* DOMHTMLStyleElementPrivate.h */; };
-		1CFCEE9E0AACC40100348750 /* DOMHTMLTextAreaElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEE950AACC3CD00348750 /* DOMHTMLTextAreaElementPrivate.h */; };
-		1CFCEE9F0AACC40100348750 /* DOMHTMLAnchorElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEE7F0AACC3B300348750 /* DOMHTMLAnchorElementPrivate.h */; };
-		1CFCEEA00AACC40100348750 /* DOMHTMLAreaElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEE880AACC3C000348750 /* DOMHTMLAreaElementPrivate.h */; };
-		1CFCEEB40AACC4A900348750 /* DOMDocumentPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEEB20AACC4A200348750 /* DOMDocumentPrivate.h */; };
-		1CFCEEB50AACC4A900348750 /* DOMElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEEB30AACC4A200348750 /* DOMElementPrivate.h */; };
-		1CFCEECB0AACC60100348750 /* DOMProcessingInstructionPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEECA0AACC5F400348750 /* DOMProcessingInstructionPrivate.h */; };
-		1CFCEED50AACC66900348750 /* DOMHTMLOptionsCollectionPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEED40AACC65D00348750 /* DOMHTMLOptionsCollectionPrivate.h */; };
-		1CFCEEDF0AACC6A300348750 /* DOMHTMLPreElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEEDA0AACC68300348750 /* DOMHTMLPreElementPrivate.h */; };
-		1CFCEEFA0AACC7A700348750 /* DOMHTMLInputElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CFCEEF90AACC79000348750 /* DOMHTMLInputElementPrivate.h */; };
-		2951A2AE0E646C8800DB9ADE /* AccessibilityObjectMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 2951A2AD0E646C8800DB9ADE /* AccessibilityObjectMac.mm */; };
-		2955BE2C0E2548EC00893AB5 /* AccessibilityImageMapLink.h in Headers */ = {isa = PBXBuildFile; fileRef = 2955BE2A0E2548EC00893AB5 /* AccessibilityImageMapLink.h */; };
-		2955BE2D0E2548EC00893AB5 /* AccessibilityImageMapLink.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2955BE2B0E2548EC00893AB5 /* AccessibilityImageMapLink.cpp */; };
-		29800C3B0E522A5300025536 /* AccessibilityTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 29800C390E522A5300025536 /* AccessibilityTable.h */; };
-		29800C3C0E522A5300025536 /* AccessibilityTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29800C3A0E522A5300025536 /* AccessibilityTable.cpp */; };
-		29800C950E524C8B00025536 /* AccessibilityTableRow.h in Headers */ = {isa = PBXBuildFile; fileRef = 29800C930E524C8B00025536 /* AccessibilityTableRow.h */; };
-		29800C960E524C8B00025536 /* AccessibilityTableRow.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29800C940E524C8B00025536 /* AccessibilityTableRow.cpp */; };
-		29800C990E524DA500025536 /* AccessibilityTableColumn.h in Headers */ = {isa = PBXBuildFile; fileRef = 29800C970E524DA500025536 /* AccessibilityTableColumn.h */; };
-		29800C9A0E524DA500025536 /* AccessibilityTableColumn.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29800C980E524DA500025536 /* AccessibilityTableColumn.cpp */; };
-		299984BD0DC8598500F8D261 /* AccessibilityRenderObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 299984BB0DC8598500F8D261 /* AccessibilityRenderObject.cpp */; };
-		299984BE0DC8598500F8D261 /* AccessibilityRenderObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 299984BC0DC8598500F8D261 /* AccessibilityRenderObject.h */; };
-		2999869E0DD0DEEA00F8D261 /* AccessibilityListBoxOption.h in Headers */ = {isa = PBXBuildFile; fileRef = 2999869A0DD0DEEA00F8D261 /* AccessibilityListBoxOption.h */; };
-		2999869F0DD0DEEA00F8D261 /* AccessibilityListBoxOption.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2999869B0DD0DEEA00F8D261 /* AccessibilityListBoxOption.cpp */; };
-		299986A00DD0DEEA00F8D261 /* AccessibilityListBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 2999869C0DD0DEEA00F8D261 /* AccessibilityListBox.h */; };
-		299986A10DD0DEEA00F8D261 /* AccessibilityListBox.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2999869D0DD0DEEA00F8D261 /* AccessibilityListBox.cpp */; };
-		29AAC36D0E534E86008F9B3B /* AccessibilityTableCell.h in Headers */ = {isa = PBXBuildFile; fileRef = 29AAC36B0E534E86008F9B3B /* AccessibilityTableCell.h */; };
-		29AAC36E0E534E86008F9B3B /* AccessibilityTableCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29AAC36C0E534E86008F9B3B /* AccessibilityTableCell.cpp */; };
-		29AAC51F0E53963B008F9B3B /* AccessibilityTableHeaderContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 29AAC51D0E53963B008F9B3B /* AccessibilityTableHeaderContainer.h */; };
-		29AAC5200E53963B008F9B3B /* AccessibilityTableHeaderContainer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29AAC51E0E53963B008F9B3B /* AccessibilityTableHeaderContainer.cpp */; };
-		29FFBB820E7C5A3D00407730 /* AccessibilityList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29FFBB800E7C5A3D00407730 /* AccessibilityList.cpp */; };
-		29FFBB830E7C5A3D00407730 /* AccessibilityList.h in Headers */ = {isa = PBXBuildFile; fileRef = 29FFBB810E7C5A3D00407730 /* AccessibilityList.h */; };
+		29A812260FBB9C1D00510293 /* AccessibilityRenderObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812080FBB9C1D00510293 /* AccessibilityRenderObject.cpp */; };
+		29A812270FBB9C1D00510293 /* AccessibilityTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812090FBB9C1D00510293 /* AccessibilityTable.cpp */; };
+		29A812280FBB9C1D00510293 /* AccessibilityARIAGrid.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8120A0FBB9C1D00510293 /* AccessibilityARIAGrid.cpp */; };
+		29A812290FBB9C1D00510293 /* AccessibilityTableRow.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8120B0FBB9C1D00510293 /* AccessibilityTableRow.cpp */; };
+		29A8122A0FBB9C1D00510293 /* AccessibilityTableCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8120C0FBB9C1D00510293 /* AccessibilityTableCell.cpp */; };
+		29A8122B0FBB9C1D00510293 /* AccessibilityTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8120D0FBB9C1D00510293 /* AccessibilityTable.h */; };
+		29A8122C0FBB9C1D00510293 /* AccessibilityList.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8120E0FBB9C1D00510293 /* AccessibilityList.h */; };
+		29A8122D0FBB9C1D00510293 /* AccessibilityARIAGridRow.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8120F0FBB9C1D00510293 /* AccessibilityARIAGridRow.cpp */; };
+		29A8122E0FBB9C1D00510293 /* AccessibilityARIAGridCell.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812100FBB9C1D00510293 /* AccessibilityARIAGridCell.h */; };
+		29A8122F0FBB9C1D00510293 /* AccessibilityList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812110FBB9C1D00510293 /* AccessibilityList.cpp */; };
+		29A812300FBB9C1D00510293 /* AccessibilityARIAGridCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812120FBB9C1D00510293 /* AccessibilityARIAGridCell.cpp */; };
+		29A812310FBB9C1D00510293 /* AccessibilityTableRow.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812130FBB9C1D00510293 /* AccessibilityTableRow.h */; };
+		29A812320FBB9C1D00510293 /* AccessibilityTableCell.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812140FBB9C1D00510293 /* AccessibilityTableCell.h */; };
+		29A812330FBB9C1D00510293 /* AccessibilityARIAGridRow.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812150FBB9C1D00510293 /* AccessibilityARIAGridRow.h */; };
+		29A812340FBB9C1D00510293 /* AccessibilityARIAGrid.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812160FBB9C1D00510293 /* AccessibilityARIAGrid.h */; };
+		29A812350FBB9C1D00510293 /* AccessibilityTableColumn.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812170FBB9C1D00510293 /* AccessibilityTableColumn.cpp */; };
+		29A812360FBB9C1D00510293 /* AccessibilityObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812180FBB9C1D00510293 /* AccessibilityObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		29A812370FBB9C1D00510293 /* AXObjectCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812190FBB9C1D00510293 /* AXObjectCache.cpp */; };
+		29A812380FBB9C1D00510293 /* AXObjectCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8121A0FBB9C1D00510293 /* AXObjectCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		29A812390FBB9C1D00510293 /* AccessibilityRenderObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8121B0FBB9C1D00510293 /* AccessibilityRenderObject.h */; };
+		29A8123A0FBB9C1D00510293 /* AccessibilityImageMapLink.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8121C0FBB9C1D00510293 /* AccessibilityImageMapLink.cpp */; };
+		29A8123B0FBB9C1D00510293 /* AccessibilityImageMapLink.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8121D0FBB9C1D00510293 /* AccessibilityImageMapLink.h */; };
+		29A8123C0FBB9C1D00510293 /* AccessibilityObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8121E0FBB9C1D00510293 /* AccessibilityObject.cpp */; };
+		29A8123D0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8121F0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp */; };
+		29A8123E0FBB9C1D00510293 /* AccessibilityListBox.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812200FBB9C1D00510293 /* AccessibilityListBox.cpp */; };
+		29A8123F0FBB9C1D00510293 /* AccessibilityTableHeaderContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812210FBB9C1D00510293 /* AccessibilityTableHeaderContainer.h */; };
+		29A812400FBB9C1D00510293 /* AccessibilityTableHeaderContainer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812220FBB9C1D00510293 /* AccessibilityTableHeaderContainer.cpp */; };
+		29A812410FBB9C1D00510293 /* AccessibilityTableColumn.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812230FBB9C1D00510293 /* AccessibilityTableColumn.h */; };
+		29A812420FBB9C1D00510293 /* AccessibilityListBoxOption.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812240FBB9C1D00510293 /* AccessibilityListBoxOption.h */; };
+		29A812430FBB9C1D00510293 /* AccessibilityListBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812250FBB9C1D00510293 /* AccessibilityListBox.h */; };
+		29A812480FBB9CA900510293 /* AccessibilityObjectMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 29A812440FBB9CA900510293 /* AccessibilityObjectMac.mm */; };
+		29A812490FBB9CA900510293 /* AccessibilityObjectWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812450FBB9CA900510293 /* AccessibilityObjectWrapper.h */; };
+		29A8124A0FBB9CA900510293 /* AccessibilityObjectWrapper.mm in Sources */ = {isa = PBXBuildFile; fileRef = 29A812460FBB9CA900510293 /* AccessibilityObjectWrapper.mm */; };
+		29A8124B0FBB9CA900510293 /* AXObjectCacheMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 29A812470FBB9CA900510293 /* AXObjectCacheMac.mm */; };
 		2D9066060BE141D400956998 /* LayoutState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2D9066040BE141D400956998 /* LayoutState.cpp */; };
 		2D9066070BE141D400956998 /* LayoutState.h in Headers */ = {isa = PBXBuildFile; fileRef = 2D9066050BE141D400956998 /* LayoutState.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		2E4346440F546A8200B0F1BA /* GenericWorkerTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E4346320F546A8200B0F1BA /* GenericWorkerTask.h */; };
@@ -624,6 +626,7 @@
 		3724CA590E68A7E400DB4384 /* FontMacATSUI.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */; };
 		3724CA7E0E68B20500DB4384 /* FontMacCoreText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA7D0E68B20500DB4384 /* FontMacCoreText.cpp */; };
 		3744570F0DB05FA500AE0992 /* SVGGlyphMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 3744570E0DB05FA500AE0992 /* SVGGlyphMap.h */; };
+		3774ABA50FA21EB400AD7DE9 /* OverlapTestRequestClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 3774ABA30FA21EB400AD7DE9 /* OverlapTestRequestClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3784C34B0E11AA34007D8D48 /* FontTraitsMask.h in Headers */ = {isa = PBXBuildFile; fileRef = 3784C34A0E11AA34007D8D48 /* FontTraitsMask.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37919C230B7D188600A56998 /* PositionIterator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37919C210B7D188600A56998 /* PositionIterator.cpp */; };
 		37919C240B7D188600A56998 /* PositionIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 37919C220B7D188600A56998 /* PositionIterator.h */; settings = {ATTRIBUTES = (); }; };
@@ -633,12 +636,16 @@
 		37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */; };
 		41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */; };
 		41002CCE0F66EDEF009E660D /* ScriptFunctionCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */; };
+		411046410FA222A600BA436A /* ScriptEventListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 4110463F0FA222A600BA436A /* ScriptEventListener.h */; };
+		411046420FA222A600BA436A /* ScriptEventListener.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 411046400FA222A600BA436A /* ScriptEventListener.cpp */; };
+		4127D5370F8AAB1D00E424F5 /* ScriptState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */; };
 		412A68470F6B03DD000EA66E /* ScriptObjectQuarantine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */; };
+		415E3EF60F8D67FE007EEB50 /* MessagePortProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 415E3EF50F8D67FE007EEB50 /* MessagePortProxy.h */; };
 		416E75BE0EDF8FD700360E1D /* ScriptCallStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 416E75BC0EDF8FD700360E1D /* ScriptCallStack.h */; };
 		416E75BF0EDF8FD700360E1D /* ScriptCallStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 416E75BD0EDF8FD700360E1D /* ScriptCallStack.cpp */; };
 		416E75CB0EDF90C700360E1D /* ScriptCallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 416E75C90EDF90C700360E1D /* ScriptCallFrame.h */; };
 		416E75CC0EDF90C700360E1D /* ScriptCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 416E75CA0EDF90C700360E1D /* ScriptCallFrame.cpp */; };
-		416F45F00ED7B311008215B6 /* ScriptString.h in Headers */ = {isa = PBXBuildFile; fileRef = 416F45EF0ED7B311008215B6 /* ScriptString.h */; };
+		416F45F00ED7B311008215B6 /* ScriptString.h in Headers */ = {isa = PBXBuildFile; fileRef = 416F45EF0ED7B311008215B6 /* ScriptString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		419536510F68222400D0C679 /* ScriptObjectQuarantine.h in Headers */ = {isa = PBXBuildFile; fileRef = 419536500F68222400D0C679 /* ScriptObjectQuarantine.h */; };
 		41C760B10EDE03D300C1655F /* ScriptState.h in Headers */ = {isa = PBXBuildFile; fileRef = 41C760B00EDE03D300C1655F /* ScriptState.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41D015CA0F4B5C71004A662F /* ContentType.h in Headers */ = {isa = PBXBuildFile; fileRef = 41D015C80F4B5C71004A662F /* ContentType.h */; };
@@ -654,22 +661,21 @@
 		41F062020F5F0B6600A07EAC /* InspectorResource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41F062000F5F0B6600A07EAC /* InspectorResource.cpp */; };
 		41F062140F5F192600A07EAC /* InspectorDatabaseResource.h in Headers */ = {isa = PBXBuildFile; fileRef = 41F062120F5F192600A07EAC /* InspectorDatabaseResource.h */; };
 		41F062150F5F192600A07EAC /* InspectorDatabaseResource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41F062130F5F192600A07EAC /* InspectorDatabaseResource.cpp */; };
-		41F066E40F64BCF600A07EAC /* ScriptObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 41F066E20F64BCF600A07EAC /* ScriptObject.h */; };
+		41F066E40F64BCF600A07EAC /* ScriptObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 41F066E20F64BCF600A07EAC /* ScriptObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41F066E50F64BCF600A07EAC /* ScriptObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41F066E30F64BCF600A07EAC /* ScriptObject.cpp */; };
 		41F1D21F0EF35C2A00DA8753 /* ScriptCachedFrameData.h in Headers */ = {isa = PBXBuildFile; fileRef = 41F1D21D0EF35C2A00DA8753 /* ScriptCachedFrameData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41F1D2200EF35C2A00DA8753 /* ScriptCachedFrameData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41F1D21E0EF35C2A00DA8753 /* ScriptCachedFrameData.cpp */; };
 		4415292E0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4415292C0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.h */; };
 		4415292F0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4415292D0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.cpp */; };
-		441B05560CD779B6007C1F18 /* DOMCSSStyleSheetPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 4429AAEA0CB84DC7007647C5 /* DOMCSSStyleSheetPrivate.h */; };
-		441B05580CD779F2007C1F18 /* DOMEventPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 4429AAF80CB84E5F007647C5 /* DOMEventPrivate.h */; };
-		441B055A0CD77A14007C1F18 /* DOMHTMLCollectionPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 4429AAF10CB84E35007647C5 /* DOMHTMLCollectionPrivate.h */; };
 		441B055C0CD77A2D007C1F18 /* DOMHTMLEmbedElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 4429AAFB0CB84E88007647C5 /* DOMHTMLEmbedElementPrivate.h */; };
 		441B055E0CD77A48007C1F18 /* DOMHTMLIFrameElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 4429AAFD0CB84EA5007647C5 /* DOMHTMLIFrameElementPrivate.h */; };
 		441B05600CD77A65007C1F18 /* DOMHTMLObjectElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 4429AAFF0CB84EC3007647C5 /* DOMHTMLObjectElementPrivate.h */; };
-		441B05620CD77A7E007C1F18 /* DOMHTMLSelectElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 4429AB010CB84ED8007647C5 /* DOMHTMLSelectElementPrivate.h */; };
+		447D69030FA626810015CCB1 /* RuntimeApplicationChecks.h in Headers */ = {isa = PBXBuildFile; fileRef = 447D69010FA626810015CCB1 /* RuntimeApplicationChecks.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		447D69040FA626810015CCB1 /* RuntimeApplicationChecks.mm in Sources */ = {isa = PBXBuildFile; fileRef = 447D69020FA626810015CCB1 /* RuntimeApplicationChecks.mm */; };
 		448A29BF0A46D9CB0030759F /* JSHTMLOptionsCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 448A29BD0A46D9CB0030759F /* JSHTMLOptionsCollection.h */; };
 		448A29C00A46D9CB0030759F /* JSHTMLOptionsCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 448A29BE0A46D9CB0030759F /* JSHTMLOptionsCollection.cpp */; };
 		448AD27C0A48137A0023D179 /* JSHTMLOptionsCollectionCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 448AD27A0A4813790023D179 /* JSHTMLOptionsCollectionCustom.cpp */; };
+		449B19F50FA72ECE0015CA4A /* HTMLParserQuirks.h in Headers */ = {isa = PBXBuildFile; fileRef = 449B19F30FA72ECE0015CA4A /* HTMLParserQuirks.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4614A1FE0B23A8D600446E1C /* copyCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 4614A1FD0B23A8D600446E1C /* copyCursor.png */; };
 		464EA2730B8A350B00A8E6E3 /* crossHairCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 464EA2710B8A350B00A8E6E3 /* crossHairCursor.png */; };
 		464EA2740B8A350B00A8E6E3 /* notAllowedCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 464EA2720B8A350B00A8E6E3 /* notAllowedCursor.png */; };
@@ -720,10 +726,6 @@
 		49E912AD0EFAC906009D0CAF /* AnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A80EFAC906009D0CAF /* AnimationList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49E912AE0EFAC906009D0CAF /* TimingFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A90EFAC906009D0CAF /* TimingFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4A8C96EB0BE69032004EEFF0 /* SelectionControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4A8C96EA0BE69032004EEFF0 /* SelectionControllerMac.mm */; };
-		4B17CBC90D945B370053F183 /* AccessibilityObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B17CBC80D945B370053F183 /* AccessibilityObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		4B17CBCC0D945B910053F183 /* AccessibilityObjectWrapper.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4B17CBCA0D945B910053F183 /* AccessibilityObjectWrapper.mm */; };
-		4B17CBCD0D945B910053F183 /* AccessibilityObjectWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B17CBCB0D945B910053F183 /* AccessibilityObjectWrapper.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		4B24F9A80DA7050B00269E58 /* AXObjectCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4B24F9A70DA7050B00269E58 /* AXObjectCache.cpp */; };
 		4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B2708C50AF19EE40065127F /* Pasteboard.h */; };
 		4B2709830AF2E5E00065127F /* PasteboardMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4B2709810AF2E5E00065127F /* PasteboardMac.mm */; };
 		4B3043C70AE0370300A82647 /* Sound.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B3043C60AE0370300A82647 /* Sound.h */; };
@@ -732,7 +734,6 @@
 		4B3043CD0AE0373B00A82647 /* Editor.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B3043CB0AE0373B00A82647 /* Editor.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4B3480930EEF50D400AC1B41 /* ImageSourceCGMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4B3480910EEF50D400AC1B41 /* ImageSourceCGMac.mm */; };
 		4B3480940EEF50D400AC1B41 /* ImageSourceCG.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B3480920EEF50D400AC1B41 /* ImageSourceCG.h */; };
-		4B5B7C8E0D945CFA00DDF3AB /* AccessibilityObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4B5B7C8D0D945CFA00DDF3AB /* AccessibilityObject.cpp */; };
 		4B6FA6F40C39E48C00087011 /* SmartReplace.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B6FA6F20C39E48C00087011 /* SmartReplace.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4B6FA6F50C39E48C00087011 /* SmartReplace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4B6FA6F30C39E48C00087011 /* SmartReplace.cpp */; };
 		4B6FA6F70C39E4A100087011 /* SmartReplaceCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4B6FA6F60C39E4A100087011 /* SmartReplaceCF.cpp */; };
@@ -746,11 +747,6 @@
 		4E19592C0A39DACC00220FE5 /* MediaQueryEvaluator.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E1959260A39DACC00220FE5 /* MediaQueryEvaluator.h */; };
 		4E19592D0A39DACC00220FE5 /* MediaQueryExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4E1959270A39DACC00220FE5 /* MediaQueryExp.cpp */; };
 		4E19592E0A39DACC00220FE5 /* MediaQueryExp.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E1959280A39DACC00220FE5 /* MediaQueryExp.h */; };
-		50A5DF750E1A13C9000A03AE /* Filter.h in Headers */ = {isa = PBXBuildFile; fileRef = 50A5DF730E1A13C9000A03AE /* Filter.h */; };
-		50A5DF760E1A13C9000A03AE /* FilterBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 50A5DF740E1A13C9000A03AE /* FilterBuilder.h */; };
-		50A5E2100E1ABAF2000A03AE /* FilterEffect.h in Headers */ = {isa = PBXBuildFile; fileRef = 50A5E20F0E1ABAF2000A03AE /* FilterEffect.h */; };
-		50A5E4720E1AEF3A000A03AE /* Filter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50A5E4710E1AEF3A000A03AE /* Filter.cpp */; };
-		50A5E4740E1AEF84000A03AE /* FilterEffect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50A5E4730E1AEF84000A03AE /* FilterEffect.cpp */; };
 		510184690B08602A004A825F /* CachedPage.h in Headers */ = {isa = PBXBuildFile; fileRef = 510184670B08602A004A825F /* CachedPage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5101846A0B08602A004A825F /* CachedPage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510184680B08602A004A825F /* CachedPage.cpp */; };
 		5116D9770CF177BD00C2B84D /* DatabaseDetails.h in Headers */ = {isa = PBXBuildFile; fileRef = 5116D9750CF177BD00C2B84D /* DatabaseDetails.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -881,6 +877,8 @@
 		54C50F7B0E801DF3009832A0 /* XMLTokenizerLibxml2.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 54C50F7A0E801DF3009832A0 /* XMLTokenizerLibxml2.cpp */; };
 		550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 550A0BC7085F6039007353D6 /* QualifiedName.cpp */; };
 		550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */ = {isa = PBXBuildFile; fileRef = 550A0BC8085F6039007353D6 /* QualifiedName.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		5D15E3AB0F9E6AC1009E0E3F /* XMLTokenizerScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D15E3A90F9E6AC1009E0E3F /* XMLTokenizerScope.cpp */; };
+		5D15E3AC0F9E6AC1009E0E3F /* XMLTokenizerScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D15E3AA0F9E6AC1009E0E3F /* XMLTokenizerScope.h */; };
 		5D874F130D161D3200796C3B /* NetscapePlugInStreamLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93E227DD0AF589AD00D48324 /* NetscapePlugInStreamLoader.cpp */; };
 		5D925B670F64D4DD00B847F0 /* ScrollBehavior.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D925B650F64D4DD00B847F0 /* ScrollBehavior.cpp */; };
 		5D925B680F64D4DD00B847F0 /* ScrollBehavior.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D925B660F64D4DD00B847F0 /* ScrollBehavior.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -993,7 +991,20 @@
 		75793ED30D0CE85B007FC0AC /* DOMMessageEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793ED00D0CE85B007FC0AC /* DOMMessageEvent.h */; };
 		75793ED40D0CE85B007FC0AC /* DOMMessageEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 75793ED10D0CE85B007FC0AC /* DOMMessageEvent.mm */; };
 		75793ED50D0CE85B007FC0AC /* DOMMessageEventInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793ED20D0CE85B007FC0AC /* DOMMessageEventInternal.h */; };
+		7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */; };
+		7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */; };
+		7AB6F8870FB9D27100805D02 /* JSONObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AB6F8850FB9D27100805D02 /* JSONObject.cpp */; };
+		7AB6F8880FB9D27100805D02 /* JSONObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AB6F8860FB9D27100805D02 /* JSONObject.h */; };
+		7AED3E050FBB1EAA00D2B03C /* InspectorFrontend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AED3E030FBB1EAA00D2B03C /* InspectorFrontend.cpp */; };
+		7AED3E060FBB1EAA00D2B03C /* InspectorFrontend.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */; };
+		845E72F80FD261EE00A87D79 /* Filter.h in Headers */ = {isa = PBXBuildFile; fileRef = 845E72F70FD261EE00A87D79 /* Filter.h */; };
+		845E72FB0FD2623900A87D79 /* SVGFilter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 845E72F90FD2623900A87D79 /* SVGFilter.cpp */; };
+		845E72FC0FD2623900A87D79 /* SVGFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = 845E72FA0FD2623900A87D79 /* SVGFilter.h */; };
 		849F77760EFEC6200090849D /* StrokeStyleApplier.h in Headers */ = {isa = PBXBuildFile; fileRef = 849F77750EFEC6200090849D /* StrokeStyleApplier.h */; };
+		84A81F3D0FC7DFF000955300 /* SourceAlpha.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84A81F3B0FC7DFF000955300 /* SourceAlpha.cpp */; };
+		84A81F3E0FC7DFF000955300 /* SourceAlpha.h in Headers */ = {isa = PBXBuildFile; fileRef = 84A81F3C0FC7DFF000955300 /* SourceAlpha.h */; };
+		84A81F410FC7E02700955300 /* SourceGraphic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84A81F3F0FC7E02700955300 /* SourceGraphic.cpp */; };
+		84A81F420FC7E02700955300 /* SourceGraphic.h in Headers */ = {isa = PBXBuildFile; fileRef = 84A81F400FC7E02700955300 /* SourceGraphic.h */; };
 		85004D940ACEEAEF00C438F6 /* DOMSVGDefsElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 85004D880ACEEAEF00C438F6 /* DOMSVGDefsElement.h */; };
 		85004D950ACEEAEF00C438F6 /* DOMSVGDefsElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85004D890ACEEAEF00C438F6 /* DOMSVGDefsElement.mm */; };
 		85004D960ACEEAEF00C438F6 /* DOMSVGDescElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 85004D8A0ACEEAEF00C438F6 /* DOMSVGDescElement.h */; };
@@ -1103,7 +1114,7 @@
 		85031B490A44EFC700F992E0 /* MutationEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 85031B330A44EFC700F992E0 /* MutationEvent.cpp */; };
 		85031B4A0A44EFC700F992E0 /* MutationEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85031B340A44EFC700F992E0 /* MutationEvent.h */; };
 		85031B4B0A44EFC700F992E0 /* RegisteredEventListener.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 85031B350A44EFC700F992E0 /* RegisteredEventListener.cpp */; };
-		85031B4C0A44EFC700F992E0 /* RegisteredEventListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 85031B360A44EFC700F992E0 /* RegisteredEventListener.h */; };
+		85031B4C0A44EFC700F992E0 /* RegisteredEventListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 85031B360A44EFC700F992E0 /* RegisteredEventListener.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		85031B4D0A44EFC700F992E0 /* UIEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 85031B370A44EFC700F992E0 /* UIEvent.cpp */; };
 		85031B4E0A44EFC700F992E0 /* UIEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85031B380A44EFC700F992E0 /* UIEvent.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		85031B4F0A44EFC700F992E0 /* UIEventWithKeyState.h in Headers */ = {isa = PBXBuildFile; fileRef = 85031B390A44EFC700F992E0 /* UIEventWithKeyState.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1240,9 +1251,7 @@
 		8538F08C0AD72E0A006A81D1 /* DOMRange.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 8538F0580AD722F1006A81D1 /* DOMRange.h */; };
 		853BF4DB0ABB6B55008647BB /* DOMNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 853BF4D90ABB6B55008647BB /* DOMNode.h */; };
 		853BF4DC0ABB6B55008647BB /* DOMNode.mm in Sources */ = {isa = PBXBuildFile; fileRef = 853BF4DA0ABB6B55008647BB /* DOMNode.mm */; };
-		853BF4EB0ABB6E97008647BB /* DOMNodePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 853BF4EA0ABB6E97008647BB /* DOMNodePrivate.h */; };
 		853BF4EC0ABB6EB9008647BB /* DOMNode.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 853BF4D90ABB6B55008647BB /* DOMNode.h */; };
-		853BF4ED0ABB6EB9008647BB /* DOMNodePrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 853BF4EA0ABB6E97008647BB /* DOMNodePrivate.h */; };
 		853CA9D60AEEC5E9002372DC /* RenderSVGContainer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 853CA9CA0AEEC5E9002372DC /* RenderSVGContainer.cpp */; };
 		853CA9D70AEEC5E9002372DC /* RenderSVGContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 853CA9CB0AEEC5E9002372DC /* RenderSVGContainer.h */; };
 		853CA9D80AEEC5E9002372DC /* RenderSVGImage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 853CA9CC0AEEC5E9002372DC /* RenderSVGImage.cpp */; };
@@ -1327,9 +1336,7 @@
 		855247D00AD850B80012093B /* DOMHTMLEmbedElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 855247CE0AD850B80012093B /* DOMHTMLEmbedElementInternal.h */; };
 		85526C370AB0A17E000302EA /* DOMNodeIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 85526C350AB0A17E000302EA /* DOMNodeIterator.h */; };
 		85526C380AB0A17E000302EA /* DOMNodeIterator.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85526C360AB0A17E000302EA /* DOMNodeIterator.mm */; };
-		85526C3E0AB0A76F000302EA /* DOMNodeIteratorPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 85526C3D0AB0A76F000302EA /* DOMNodeIteratorPrivate.h */; };
 		85526C720AB0AE2F000302EA /* DOMNodeIterator.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85526C350AB0A17E000302EA /* DOMNodeIterator.h */; };
-		85526C730AB0AE2F000302EA /* DOMNodeIteratorPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85526C3D0AB0A76F000302EA /* DOMNodeIteratorPrivate.h */; };
 		85526CD20AB0B7D9000302EA /* DOMTreeWalker.h in Headers */ = {isa = PBXBuildFile; fileRef = 85526CD00AB0B7D9000302EA /* DOMTreeWalker.h */; };
 		85526CD30AB0B7DA000302EA /* DOMTreeWalker.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85526CD10AB0B7D9000302EA /* DOMTreeWalker.mm */; };
 		85526D050AB0B979000302EA /* DOMTreeWalker.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85526CD00AB0B7D9000302EA /* DOMTreeWalker.h */; };
@@ -1357,9 +1364,7 @@
 		8575DF870AA6130E00F5DBB5 /* DOMHTMLTitleElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85992EB80AA5069500AC0785 /* DOMHTMLTitleElement.h */; };
 		857E0B250AB043460036E447 /* DOMMouseEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 857E0B230AB043460036E447 /* DOMMouseEvent.h */; };
 		857E0B260AB043460036E447 /* DOMMouseEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 857E0B240AB043460036E447 /* DOMMouseEvent.mm */; };
-		857E0B2C0AB043FC0036E447 /* DOMMouseEventPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 857E0B2B0AB043FC0036E447 /* DOMMouseEventPrivate.h */; };
 		857E0B310AB044780036E447 /* DOMMouseEvent.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 857E0B230AB043460036E447 /* DOMMouseEvent.h */; };
-		857E0B320AB044780036E447 /* DOMMouseEventPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 857E0B2B0AB043FC0036E447 /* DOMMouseEventPrivate.h */; };
 		858015CE0ABCA75D0080588D /* DOMXPathException.h in Headers */ = {isa = PBXBuildFile; fileRef = 858015CD0ABCA75D0080588D /* DOMXPathException.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		858C381C0AA8E29600B187A4 /* DOMCSSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 858C381A0AA8E29600B187A4 /* DOMCSSValue.h */; };
 		858C381D0AA8E29600B187A4 /* DOMCSSValue.mm in Sources */ = {isa = PBXBuildFile; fileRef = 858C381B0AA8E29600B187A4 /* DOMCSSValue.mm */; };
@@ -1482,7 +1487,6 @@
 		859D62EF0AD8892700012995 /* DOMSVGViewElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 859D62DA0AD8892700012995 /* DOMSVGViewElementInternal.h */; };
 		859D62F00AD8892700012995 /* DOMSVGZoomEventInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 859D62DB0AD8892700012995 /* DOMSVGZoomEventInternal.h */; };
 		85A0F97E0AC7163D00161FDC /* DOMSVG.h in Headers */ = {isa = PBXBuildFile; fileRef = 85A0F97D0AC7163D00161FDC /* DOMSVG.h */; settings = {ATTRIBUTES = (); }; };
-		85A795BA0AD754A30006B9D8 /* DOMRangePrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85C320780AD7401500BC15C4 /* DOMRangePrivate.h */; };
 		85ACA9860A9B520300671E90 /* DOMCharacterData.h in Headers */ = {isa = PBXBuildFile; fileRef = 85ACA9840A9B520300671E90 /* DOMCharacterData.h */; settings = {ATTRIBUTES = (); }; };
 		85ACA9870A9B520300671E90 /* DOMCharacterData.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85ACA9850A9B520300671E90 /* DOMCharacterData.mm */; };
 		85ACA99C0A9B575900671E90 /* DOMText.h in Headers */ = {isa = PBXBuildFile; fileRef = 85ACA99A0A9B575900671E90 /* DOMText.h */; settings = {ATTRIBUTES = (); }; };
@@ -1524,8 +1528,6 @@
 		85B4996B0ADB3FF500925CBB /* DOMSVGPathElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 85B499690ADB3FF500925CBB /* DOMSVGPathElement.h */; };
 		85B4996C0ADB3FF500925CBB /* DOMSVGPathElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85B4996A0ADB3FF500925CBB /* DOMSVGPathElement.mm */; };
 		85B499780ADB425E00925CBB /* DOMSVGPathElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 85B499770ADB425E00925CBB /* DOMSVGPathElementInternal.h */; };
-		85B916840AEBDB47008DD727 /* DOMHTMLFormElementPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 85B916830AEBDB47008DD727 /* DOMHTMLFormElementPrivate.h */; };
-		85B916870AEBDBC4008DD727 /* DOMHTMLFormElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85B916830AEBDB47008DD727 /* DOMHTMLFormElementPrivate.h */; };
 		85BA4CDD0AA6861B0088052D /* DOMHTMLButtonElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 85BA4CD50AA6861B0088052D /* DOMHTMLButtonElement.h */; };
 		85BA4CDE0AA6861B0088052D /* DOMHTMLButtonElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85BA4CD60AA6861B0088052D /* DOMHTMLButtonElement.mm */; };
 		85BA4CDF0AA6861B0088052D /* DOMHTMLFieldSetElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 85BA4CD70AA6861B0088052D /* DOMHTMLFieldSetElement.h */; };
@@ -1566,14 +1568,11 @@
 		85C239810AD5907D003533E7 /* DOMSVGNumberList.h in Headers */ = {isa = PBXBuildFile; fileRef = 85C2397F0AD5907D003533E7 /* DOMSVGNumberList.h */; };
 		85C239820AD5907D003533E7 /* DOMSVGNumberList.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85C239800AD5907D003533E7 /* DOMSVGNumberList.mm */; };
 		85C239840AD59098003533E7 /* DOMSVGNumberListInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 85C239830AD59098003533E7 /* DOMSVGNumberListInternal.h */; };
-		85C320790AD7401500BC15C4 /* DOMRangePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 85C320780AD7401500BC15C4 /* DOMRangePrivate.h */; };
 		85C78A680ABDE1B40044FC16 /* DOMException.h in Headers */ = {isa = PBXBuildFile; fileRef = 85C78A670ABDE1B40044FC16 /* DOMException.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		85C7F3E60AAF5D5E004014DD /* DOMEvent.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85AFA8200AAF528A00E84305 /* DOMEvent.h */; };
 		85C7F4910AAF79DC004014DD /* DOMUIEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85C7F48F0AAF79DC004014DD /* DOMUIEvent.h */; };
 		85C7F4920AAF79DC004014DD /* DOMUIEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85C7F4900AAF79DC004014DD /* DOMUIEvent.mm */; };
-		85C7F4C30AAF8081004014DD /* DOMUIEventPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 85C7F4C20AAF8081004014DD /* DOMUIEventPrivate.h */; };
 		85C7F4D00AAF83F6004014DD /* DOMUIEvent.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85C7F48F0AAF79DC004014DD /* DOMUIEvent.h */; };
-		85C7F4D10AAF83F6004014DD /* DOMUIEventPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85C7F4C20AAF8081004014DD /* DOMUIEventPrivate.h */; };
 		85C7F5BF0AAFB7CC004014DD /* DOMMutationEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85C7F5BC0AAFB7CC004014DD /* DOMMutationEvent.h */; };
 		85C7F5C00AAFB7CD004014DD /* DOMMutationEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85C7F5BD0AAFB7CC004014DD /* DOMMutationEvent.mm */; };
 		85C7F5D00AAFB8D9004014DD /* DOMOverflowEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85C7F5CE0AAFB8D9004014DD /* DOMOverflowEvent.h */; };
@@ -1693,13 +1692,10 @@
 		85DF2F8F0AA3C88100AD64C5 /* DOMHTMLCollection.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85DF2F8D0AA3C88100AD64C5 /* DOMHTMLCollection.mm */; };
 		85DF2F9B0AA3CAE500AD64C5 /* DOMHTMLOptionsCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 85DF2F990AA3CAE500AD64C5 /* DOMHTMLOptionsCollection.h */; settings = {ATTRIBUTES = (); }; };
 		85DF2F9C0AA3CAE500AD64C5 /* DOMHTMLOptionsCollection.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85DF2F9A0AA3CAE500AD64C5 /* DOMHTMLOptionsCollection.mm */; };
-		85DF34400AAFC0ED00E59AE3 /* DOMKeyboardEventPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 85DF343F0AAFC0ED00E59AE3 /* DOMKeyboardEventPrivate.h */; };
 		85DF345D0AAFC2D400E59AE3 /* DOMMutationEvent.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85C7F5BC0AAFB7CC004014DD /* DOMMutationEvent.h */; };
 		85DF345F0AAFC2D400E59AE3 /* DOMOverflowEvent.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85C7F5CE0AAFB8D9004014DD /* DOMOverflowEvent.h */; };
 		85DF34600AAFC2D400E59AE3 /* DOMWheelEvent.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85C7F5E50AAFBAFB004014DD /* DOMWheelEvent.h */; };
-		85DF34610AAFC2D400E59AE3 /* DOMWheelEventPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85FF313B0AAFBD7200374F38 /* DOMWheelEventPrivate.h */; };
 		85DF34620AAFC2D400E59AE3 /* DOMKeyboardEvent.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85FF31580AAFBFCB00374F38 /* DOMKeyboardEvent.h */; };
-		85DF34630AAFC2D400E59AE3 /* DOMKeyboardEventPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85DF343F0AAFC0ED00E59AE3 /* DOMKeyboardEventPrivate.h */; };
 		85DF81270AA7787200486AD7 /* DOMHTMLAnchorElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 85DF81210AA7787200486AD7 /* DOMHTMLAnchorElement.h */; };
 		85DF81280AA7787200486AD7 /* DOMHTMLAnchorElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85DF81220AA7787200486AD7 /* DOMHTMLAnchorElement.mm */; };
 		85DF81290AA7787200486AD7 /* DOMHTMLImageElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 85DF81230AA7787200486AD7 /* DOMHTMLImageElement.h */; };
@@ -1872,7 +1868,6 @@
 		85F74E080AA8DF8C000DC284 /* DOMCSSStyleDeclaration.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85032DD10AA8C9BE007D3B7D /* DOMCSSStyleDeclaration.h */; };
 		85F74E090AA8DF8C000DC284 /* DOMCSSStyleRule.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85032DD30AA8C9BE007D3B7D /* DOMCSSStyleRule.h */; };
 		85F74E0A0AA8DF8C000DC284 /* DOMCSSUnknownRule.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85032DD50AA8C9BE007D3B7D /* DOMCSSUnknownRule.h */; };
-		85FF313C0AAFBD7200374F38 /* DOMWheelEventPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 85FF313B0AAFBD7200374F38 /* DOMWheelEventPrivate.h */; };
 		85FF315A0AAFBFCB00374F38 /* DOMKeyboardEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85FF31580AAFBFCB00374F38 /* DOMKeyboardEvent.h */; };
 		85FF315B0AAFBFCB00374F38 /* DOMKeyboardEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85FF31590AAFBFCB00374F38 /* DOMKeyboardEvent.mm */; };
 		898D1FB30F27934B004BBAC7 /* CanvasPixelArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 898D1FB20F27934B004BBAC7 /* CanvasPixelArray.h */; };
@@ -1990,7 +1985,7 @@
 		935207C009BD412100F2038D /* LocalizedStringsMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 935207BF09BD412000F2038D /* LocalizedStringsMac.mm */; };
 		9352084509BD43B900F2038D /* Language.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9352084409BD43B900F2038D /* Language.mm */; };
 		9352087709BD453400F2038D /* CookieJar.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9352087609BD453400F2038D /* CookieJar.mm */; };
-		9352088209BD45E900F2038D /* CookieJar.h in Headers */ = {isa = PBXBuildFile; fileRef = 9352088109BD45E900F2038D /* CookieJar.h */; };
+		9352088209BD45E900F2038D /* CookieJar.h in Headers */ = {isa = PBXBuildFile; fileRef = 9352088109BD45E900F2038D /* CookieJar.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9353676B09AED88B00D35CD6 /* ScrollViewMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9353676A09AED88B00D35CD6 /* ScrollViewMac.mm */; };
 		935C476309AC4CE600A6AAB4 /* MouseEventWithHitTestResults.h in Headers */ = {isa = PBXBuildFile; fileRef = 935C476209AC4CE600A6AAB4 /* MouseEventWithHitTestResults.h */; };
 		935C476809AC4D4300A6AAB4 /* PlatformKeyboardEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 935C476609AC4D4300A6AAB4 /* PlatformKeyboardEvent.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2003,14 +1998,18 @@
 		935C477509AC4D8E00A6AAB4 /* GapRects.h in Headers */ = {isa = PBXBuildFile; fileRef = 935C477409AC4D8D00A6AAB4 /* GapRects.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		935F45420F7C3B5F00D7C1FB /* JSLazyEventListener.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 935F45400F7C3B5F00D7C1FB /* JSLazyEventListener.cpp */; };
 		935F45430F7C3B5F00D7C1FB /* JSLazyEventListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 935F45410F7C3B5F00D7C1FB /* JSLazyEventListener.h */; };
-		935FBC4509BA00B900E230B1 /* EventListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 935FBC4409BA00B900E230B1 /* EventListener.h */; };
+		935FBC4509BA00B900E230B1 /* EventListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 935FBC4409BA00B900E230B1 /* EventListener.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		935FBCF209BA143B00E230B1 /* ExceptionCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 935FBCF109BA143B00E230B1 /* ExceptionCode.h */; };
 		9362640B0DE1137D009D5A00 /* CSSReflectionDirection.h in Headers */ = {isa = PBXBuildFile; fileRef = 9362640A0DE1137D009D5A00 /* CSSReflectionDirection.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9363B62C0F8E8FE000803810 /* HistoryPropertyList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9363B62A0F8E8FE000803810 /* HistoryPropertyList.cpp */; };
+		9363B62D0F8E8FE000803810 /* HistoryPropertyList.h in Headers */ = {isa = PBXBuildFile; fileRef = 9363B62B0F8E8FE000803810 /* HistoryPropertyList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93799EF80BF2743600D0F230 /* RenderWordBreak.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93799EF60BF2743600D0F230 /* RenderWordBreak.cpp */; };
 		93799EF90BF2743600D0F230 /* RenderWordBreak.h in Headers */ = {isa = PBXBuildFile; fileRef = 93799EF70BF2743600D0F230 /* RenderWordBreak.h */; };
 		9380F47309A11AB4001FDB34 /* Widget.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9380F47109A11AB4001FDB34 /* Widget.cpp */; };
 		9380F47409A11AB4001FDB34 /* Widget.h in Headers */ = {isa = PBXBuildFile; fileRef = 9380F47209A11AB4001FDB34 /* Widget.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9380F47809A11ACC001FDB34 /* WidgetMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9380F47709A11ACC001FDB34 /* WidgetMac.mm */; };
+		938192030F87E1E600D5352A /* BinaryPropertyList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 938192020F87E1E600D5352A /* BinaryPropertyList.cpp */; };
+		938192050F87E1EC00D5352A /* BinaryPropertyList.h in Headers */ = {isa = PBXBuildFile; fileRef = 938192040F87E1EC00D5352A /* BinaryPropertyList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9382AAB40D8C386100F357A6 /* NodeWithIndex.h in Headers */ = {isa = PBXBuildFile; fileRef = 9382AAB10D8C386100F357A6 /* NodeWithIndex.h */; };
 		93831B570D087D6000E5C984 /* ExceptionCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93831B560D087D6000E5C984 /* ExceptionCode.cpp */; };
 		938E65F109F09840008A48EC /* JSHTMLElementWrapperFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 938E65F009F09840008A48EC /* JSHTMLElementWrapperFactory.h */; };
@@ -2027,6 +2026,8 @@
 		939B02EF0EA2DBC400C54570 /* WidthIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 939B02ED0EA2DBC400C54570 /* WidthIterator.h */; };
 		939B3E4E0D3C1E8400B4A92B /* StringBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 939B3E4D0D3C1E8400B4A92B /* StringBuffer.h */; };
 		93A38B4B0D0E5808006872C2 /* EditorCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93A38B4A0D0E5808006872C2 /* EditorCommand.cpp */; };
+		93B2D8160F9920D2006AE6B2 /* SuddenTermination.h in Headers */ = {isa = PBXBuildFile; fileRef = 93B2D8150F9920D2006AE6B2 /* SuddenTermination.h */; };
+		93B2D8180F9920EE006AE6B2 /* SuddenTermination.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93B2D8170F9920EE006AE6B2 /* SuddenTermination.mm */; };
 		93B6A0E60B0BCA5C00F5027A /* ContextMenu.h in Headers */ = {isa = PBXBuildFile; fileRef = 93B6A0E50B0BCA5C00F5027A /* ContextMenu.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93B6A0E80B0BCA6700F5027A /* ContextMenu.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93B6A0E70B0BCA6700F5027A /* ContextMenu.cpp */; };
 		93B6A0EA0B0BCA8400F5027A /* ContextMenuMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93B6A0E90B0BCA8400F5027A /* ContextMenuMac.mm */; };
@@ -2044,10 +2045,15 @@
 		93C09A7F0B064EEF005ABD4D /* EventHandlerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93C09A7E0B064EEF005ABD4D /* EventHandlerMac.mm */; };
 		93C09A810B064F00005ABD4D /* EventHandler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93C09A800B064F00005ABD4D /* EventHandler.cpp */; };
 		93C09C860B0657AA005ABD4D /* ScrollTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C09C850B0657AA005ABD4D /* ScrollTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		93C441EF0F813A1A00C1A634 /* CollectionCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93C441ED0F813A1A00C1A634 /* CollectionCache.cpp */; };
+		93C441F00F813A1A00C1A634 /* CollectionCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C441EE0F813A1A00C1A634 /* CollectionCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		93C442000F813AE100C1A634 /* CollectionType.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C441FF0F813AE100C1A634 /* CollectionType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93C841F809CE855C00DFF5E5 /* DOMImplementationFront.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C841F709CE855C00DFF5E5 /* DOMImplementationFront.h */; };
 		93C841FF09CE858300DFF5E5 /* DOMImplementationFront.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93C841FE09CE858300DFF5E5 /* DOMImplementationFront.cpp */; };
 		93CCF0270AF6C52900018E89 /* NavigationAction.h in Headers */ = {isa = PBXBuildFile; fileRef = 93CCF0260AF6C52900018E89 /* NavigationAction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93CCF0600AF6CA7600018E89 /* NavigationAction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93CCF05F0AF6CA7600018E89 /* NavigationAction.cpp */; };
+		93D3C1590F97A9D70053C013 /* DOMHTMLCanvasElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 93D3C1580F97A9D70053C013 /* DOMHTMLCanvasElement.h */; };
+		93D3C17D0F97AA760053C013 /* DOMHTMLCanvasElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 93D3C1580F97A9D70053C013 /* DOMHTMLCanvasElement.h */; };
 		93D9D53C0DA27E180077216C /* RangeBoundaryPoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 93D9D53B0DA27E180077216C /* RangeBoundaryPoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93E227E00AF589AD00D48324 /* DocumentLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93E227DB0AF589AD00D48324 /* DocumentLoader.cpp */; };
 		93E227E10AF589AD00D48324 /* MainResourceLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93E227DC0AF589AD00D48324 /* MainResourceLoader.cpp */; };
@@ -2121,7 +2127,8 @@
 		93F19B1508245E59001E9ABC /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = F5C2869502846DCD018635CA /* Cocoa.framework */; };
 		93F19B1608245E59001E9ABC /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = F8216299029F4FB501000131 /* JavaScriptCore.framework */; };
 		93F19B1708245E59001E9ABC /* libicucore.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 93F1D31A0558CC5C00821BC0 /* libicucore.dylib */; };
-		93F9B6560BA0F35E00854064 /* DOMHTMLCanvasElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 93F9B6530BA0F35E00854064 /* DOMHTMLCanvasElement.h */; settings = {ATTRIBUTES = (); }; };
+		93F925430F7EF5B8007E37C9 /* CheckedRadioButtons.h in Headers */ = {isa = PBXBuildFile; fileRef = 93F925410F7EF5B8007E37C9 /* CheckedRadioButtons.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		93F925440F7EF5B8007E37C9 /* CheckedRadioButtons.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F925420F7EF5B8007E37C9 /* CheckedRadioButtons.cpp */; };
 		93F9B6570BA0F35E00854064 /* DOMHTMLCanvasElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93F9B6540BA0F35E00854064 /* DOMHTMLCanvasElement.mm */; };
 		93F9B6580BA0F35E00854064 /* DOMHTMLCanvasElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 93F9B6550BA0F35E00854064 /* DOMHTMLCanvasElementInternal.h */; };
 		93F9B6E00BA0FB7200854064 /* JSComment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F9B6DE0BA0FB7200854064 /* JSComment.cpp */; };
@@ -2411,7 +2418,7 @@
 		A81369D3097374F600D74463 /* HTMLButtonElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A81369B7097374F500D74463 /* HTMLButtonElement.cpp */; };
 		A81369D4097374F600D74463 /* HTMLFieldSetElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369B8097374F500D74463 /* HTMLFieldSetElement.h */; };
 		A81369D5097374F600D74463 /* HTMLFieldSetElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A81369B9097374F500D74463 /* HTMLFieldSetElement.cpp */; };
-		A81369D6097374F600D74463 /* HTMLTextAreaElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369BA097374F500D74463 /* HTMLTextAreaElement.h */; };
+		A81369D6097374F600D74463 /* HTMLTextAreaElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369BA097374F500D74463 /* HTMLTextAreaElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A81369D7097374F600D74463 /* HTMLTextAreaElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A81369BB097374F500D74463 /* HTMLTextAreaElement.cpp */; };
 		A81369D8097374F600D74463 /* HTMLSelectElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369BC097374F500D74463 /* HTMLSelectElement.h */; };
 		A81369D9097374F600D74463 /* HTMLSelectElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A81369BD097374F500D74463 /* HTMLSelectElement.cpp */; };
@@ -2557,6 +2564,8 @@
 		A88FE3340E5EEE87008D8C0F /* GraphicsContextPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A88FE3330E5EEE87008D8C0F /* GraphicsContextPrivate.h */; };
 		A89943280B42338800D7C802 /* BitmapImage.h in Headers */ = {isa = PBXBuildFile; fileRef = A89943260B42338700D7C802 /* BitmapImage.h */; };
 		A89943290B42338800D7C802 /* BitmapImage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A89943270B42338700D7C802 /* BitmapImage.cpp */; };
+		A89CCC520F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A89CCC500F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp */; };
+		A89CCC530F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = A89CCC510F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h */; };
 		A8A909AC0CBCD6B50029B807 /* RenderSVGTransformableContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = A8A909AA0CBCD6B50029B807 /* RenderSVGTransformableContainer.h */; };
 		A8A909AD0CBCD6B50029B807 /* RenderSVGTransformableContainer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8A909AB0CBCD6B50029B807 /* RenderSVGTransformableContainer.cpp */; };
 		A8C4A7FD09D563270003AC8D /* StyledElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A8C4A7EB09D563270003AC8D /* StyledElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2811,11 +2820,9 @@
 		A8EA79FB0A1916DF00A8EF5F /* HTMLOListElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8EA79EF0A1916DF00A8EF5F /* HTMLOListElement.cpp */; };
 		A8EA79FC0A1916DF00A8EF5F /* HTMLLIElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8EA79F00A1916DF00A8EF5F /* HTMLLIElement.cpp */; };
 		A8EA7A4E0A191A5200A8EF5F /* RenderListItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8EA7A480A191A5200A8EF5F /* RenderListItem.cpp */; };
-		A8EA7A4F0A191A5200A8EF5F /* ListMarkerBox.h in Headers */ = {isa = PBXBuildFile; fileRef = A8EA7A490A191A5200A8EF5F /* ListMarkerBox.h */; };
 		A8EA7A500A191A5200A8EF5F /* RenderListMarker.h in Headers */ = {isa = PBXBuildFile; fileRef = A8EA7A4A0A191A5200A8EF5F /* RenderListMarker.h */; };
 		A8EA7A510A191A5200A8EF5F /* RenderListMarker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8EA7A4B0A191A5200A8EF5F /* RenderListMarker.cpp */; };
 		A8EA7A520A191A5200A8EF5F /* RenderListItem.h in Headers */ = {isa = PBXBuildFile; fileRef = A8EA7A4C0A191A5200A8EF5F /* RenderListItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A8EA7A530A191A5200A8EF5F /* ListMarkerBox.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8EA7A4D0A191A5200A8EF5F /* ListMarkerBox.cpp */; };
 		A8EA7CAB0A192B9C00A8EF5F /* HTMLMarqueeElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A8EA7C9D0A192B9C00A8EF5F /* HTMLMarqueeElement.h */; };
 		A8EA7CAC0A192B9C00A8EF5F /* HTMLMarqueeElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8EA7C9E0A192B9C00A8EF5F /* HTMLMarqueeElement.cpp */; };
 		A8EA7CAD0A192B9C00A8EF5F /* HTMLPreElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8EA7C9F0A192B9C00A8EF5F /* HTMLPreElement.cpp */; };
@@ -2974,6 +2981,8 @@
 		A8F46B810CB20A9D003A9670 /* DOMSVGStringList.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85D79AD20ACA17EB00F02FC5 /* DOMSVGStringList.h */; };
 		A8F4FB940C169E7B002AFED5 /* SVGRenderSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = A8F4FB930C169E7B002AFED5 /* SVGRenderSupport.h */; };
 		A8F4FB960C169E85002AFED5 /* SVGRenderSupport.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8F4FB950C169E85002AFED5 /* SVGRenderSupport.cpp */; };
+		A8F5C0B80F9285AC0098E06B /* RenderSVGModelObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A8F5C0B60F9285AC0098E06B /* RenderSVGModelObject.h */; };
+		A8F5C0B90F9285AC0098E06B /* RenderSVGModelObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8F5C0B70F9285AC0098E06B /* RenderSVGModelObject.cpp */; };
 		A8FA6E5D0E4CFDED00D5CF49 /* Pattern.h in Headers */ = {isa = PBXBuildFile; fileRef = A8FA6E5B0E4CFDED00D5CF49 /* Pattern.h */; };
 		A8FA6E5E0E4CFDED00D5CF49 /* Pattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8FA6E5C0E4CFDED00D5CF49 /* Pattern.cpp */; };
 		A9C6E4E30D745E05006442E9 /* MimeType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A9C6E4E10D745E05006442E9 /* MimeType.cpp */; };
@@ -3305,51 +3314,6 @@
 		B237C8A80D344D110013F707 /* SVGFontData.h in Headers */ = {isa = PBXBuildFile; fileRef = B237C8A60D344D110013F707 /* SVGFontData.h */; };
 		B24055650B5BE640002A28C0 /* DOMSVGElementInstanceInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = B24055630B5BE640002A28C0 /* DOMSVGElementInstanceInternal.h */; };
 		B24055660B5BE640002A28C0 /* DOMSVGElementInstanceListInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = B24055640B5BE640002A28C0 /* DOMSVGElementInstanceListInternal.h */; };
-		B25599350D00D8BA00BB825C /* SVGResourceFilterCg.mm in Sources */ = {isa = PBXBuildFile; fileRef = B25598990D00D8B800BB825C /* SVGResourceFilterCg.mm */; };
-		B25599400D00D8BA00BB825C /* SVGFEHelpersCg.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598A60D00D8B800BB825C /* SVGFEHelpersCg.h */; };
-		B25599410D00D8BA00BB825C /* SVGFEHelpersCg.mm in Sources */ = {isa = PBXBuildFile; fileRef = B25598A70D00D8B800BB825C /* SVGFEHelpersCg.mm */; };
-		B25599470D00D8BA00BB825C /* SVGFilterEffectCg.mm in Sources */ = {isa = PBXBuildFile; fileRef = B25598AD0D00D8B800BB825C /* SVGFilterEffectCg.mm */; };
-		B25599480D00D8BA00BB825C /* WKArithmeticFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598AE0D00D8B900BB825C /* WKArithmeticFilter.cikernel */; };
-		B25599490D00D8BA00BB825C /* WKArithmeticFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598AF0D00D8B900BB825C /* WKArithmeticFilter.h */; };
-		B255994A0D00D8BA00BB825C /* WKArithmeticFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598B00D00D8B900BB825C /* WKArithmeticFilter.m */; };
-		B255994B0D00D8BA00BB825C /* WKComponentMergeFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598B10D00D8B900BB825C /* WKComponentMergeFilter.cikernel */; };
-		B255994C0D00D8BA00BB825C /* WKComponentMergeFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598B20D00D8B900BB825C /* WKComponentMergeFilter.h */; };
-		B255994D0D00D8BA00BB825C /* WKComponentMergeFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598B30D00D8B900BB825C /* WKComponentMergeFilter.m */; };
-		B255994E0D00D8BA00BB825C /* WKDiffuseLightingFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598B40D00D8B900BB825C /* WKDiffuseLightingFilter.cikernel */; };
-		B255994F0D00D8BA00BB825C /* WKDiffuseLightingFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598B50D00D8B900BB825C /* WKDiffuseLightingFilter.h */; };
-		B25599500D00D8BA00BB825C /* WKDiffuseLightingFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598B60D00D8B900BB825C /* WKDiffuseLightingFilter.m */; };
-		B25599510D00D8BA00BB825C /* WKDiscreteTransferFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598B70D00D8B900BB825C /* WKDiscreteTransferFilter.cikernel */; };
-		B25599520D00D8BA00BB825C /* WKDiscreteTransferFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598B80D00D8B900BB825C /* WKDiscreteTransferFilter.h */; };
-		B25599530D00D8BA00BB825C /* WKDiscreteTransferFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598B90D00D8B900BB825C /* WKDiscreteTransferFilter.m */; };
-		B25599540D00D8BA00BB825C /* WKDisplacementMapFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598BA0D00D8B900BB825C /* WKDisplacementMapFilter.cikernel */; };
-		B25599550D00D8BA00BB825C /* WKDisplacementMapFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598BB0D00D8B900BB825C /* WKDisplacementMapFilter.h */; };
-		B25599560D00D8BA00BB825C /* WKDisplacementMapFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598BC0D00D8B900BB825C /* WKDisplacementMapFilter.m */; };
-		B25599570D00D8BA00BB825C /* WKDistantLightFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598BD0D00D8B900BB825C /* WKDistantLightFilter.cikernel */; };
-		B25599580D00D8BA00BB825C /* WKDistantLightFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598BE0D00D8B900BB825C /* WKDistantLightFilter.h */; };
-		B25599590D00D8BA00BB825C /* WKDistantLightFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598BF0D00D8B900BB825C /* WKDistantLightFilter.m */; };
-		B255995A0D00D8BA00BB825C /* WKGammaTransferFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598C00D00D8B900BB825C /* WKGammaTransferFilter.cikernel */; };
-		B255995B0D00D8BA00BB825C /* WKGammaTransferFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598C10D00D8B900BB825C /* WKGammaTransferFilter.h */; };
-		B255995C0D00D8BA00BB825C /* WKGammaTransferFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598C20D00D8B900BB825C /* WKGammaTransferFilter.m */; };
-		B255995D0D00D8BA00BB825C /* WKIdentityTransferFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598C30D00D8B900BB825C /* WKIdentityTransferFilter.h */; };
-		B255995E0D00D8BA00BB825C /* WKIdentityTransferFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598C40D00D8B900BB825C /* WKIdentityTransferFilter.m */; };
-		B255995F0D00D8BA00BB825C /* WKLinearTransferFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598C50D00D8B900BB825C /* WKLinearTransferFilter.cikernel */; };
-		B25599600D00D8BA00BB825C /* WKLinearTransferFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598C60D00D8B900BB825C /* WKLinearTransferFilter.h */; };
-		B25599610D00D8BA00BB825C /* WKLinearTransferFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598C70D00D8B900BB825C /* WKLinearTransferFilter.m */; };
-		B25599620D00D8BA00BB825C /* WKNormalMapFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598C80D00D8B900BB825C /* WKNormalMapFilter.cikernel */; };
-		B25599630D00D8BA00BB825C /* WKNormalMapFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598C90D00D8B900BB825C /* WKNormalMapFilter.h */; };
-		B25599640D00D8BA00BB825C /* WKNormalMapFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598CA0D00D8B900BB825C /* WKNormalMapFilter.m */; };
-		B25599650D00D8BA00BB825C /* WKPointLightFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598CB0D00D8B900BB825C /* WKPointLightFilter.cikernel */; };
-		B25599660D00D8BA00BB825C /* WKPointLightFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598CC0D00D8B900BB825C /* WKPointLightFilter.h */; };
-		B25599670D00D8BA00BB825C /* WKPointLightFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598CD0D00D8B900BB825C /* WKPointLightFilter.m */; };
-		B25599680D00D8BA00BB825C /* WKSpecularLightingFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598CE0D00D8B900BB825C /* WKSpecularLightingFilter.cikernel */; };
-		B25599690D00D8BA00BB825C /* WKSpecularLightingFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598CF0D00D8B900BB825C /* WKSpecularLightingFilter.h */; };
-		B255996A0D00D8BA00BB825C /* WKSpecularLightingFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598D00D00D8B900BB825C /* WKSpecularLightingFilter.m */; };
-		B255996B0D00D8BA00BB825C /* WKSpotLightFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598D10D00D8B900BB825C /* WKSpotLightFilter.cikernel */; };
-		B255996C0D00D8BA00BB825C /* WKSpotLightFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598D20D00D8B900BB825C /* WKSpotLightFilter.h */; };
-		B255996D0D00D8BA00BB825C /* WKSpotLightFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598D30D00D8B900BB825C /* WKSpotLightFilter.m */; };
-		B255996E0D00D8BA00BB825C /* WKTableTransferFilter.cikernel in Resources */ = {isa = PBXBuildFile; fileRef = B25598D40D00D8B900BB825C /* WKTableTransferFilter.cikernel */; };
-		B255996F0D00D8BA00BB825C /* WKTableTransferFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598D50D00D8B900BB825C /* WKTableTransferFilter.h */; };
-		B25599700D00D8BA00BB825C /* WKTableTransferFilter.m in Sources */ = {isa = PBXBuildFile; fileRef = B25598D60D00D8B900BB825C /* WKTableTransferFilter.m */; };
 		B25599710D00D8BA00BB825C /* SVGDistantLightSource.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598D70D00D8B900BB825C /* SVGDistantLightSource.h */; };
 		B255997A0D00D8BA00BB825C /* SVGFEConvolveMatrix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B25598E00D00D8B900BB825C /* SVGFEConvolveMatrix.cpp */; };
 		B255997B0D00D8BA00BB825C /* SVGFEConvolveMatrix.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598E10D00D8B900BB825C /* SVGFEConvolveMatrix.h */; };
@@ -3374,14 +3338,10 @@
 		B255998E0D00D8BA00BB825C /* SVGFETile.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598F40D00D8B900BB825C /* SVGFETile.h */; };
 		B255998F0D00D8BA00BB825C /* SVGFETurbulence.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B25598F50D00D8B900BB825C /* SVGFETurbulence.cpp */; };
 		B25599900D00D8BA00BB825C /* SVGFETurbulence.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598F60D00D8B900BB825C /* SVGFETurbulence.h */; };
-		B25599910D00D8BA00BB825C /* SVGFilterEffect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B25598F70D00D8B900BB825C /* SVGFilterEffect.cpp */; };
-		B25599920D00D8BA00BB825C /* SVGFilterEffect.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598F80D00D8B900BB825C /* SVGFilterEffect.h */; };
 		B25599930D00D8BA00BB825C /* SVGLightSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B25598F90D00D8B900BB825C /* SVGLightSource.cpp */; };
 		B25599940D00D8BA00BB825C /* SVGLightSource.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598FA0D00D8B900BB825C /* SVGLightSource.h */; };
 		B25599950D00D8BA00BB825C /* SVGPointLightSource.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598FB0D00D8B900BB825C /* SVGPointLightSource.h */; };
 		B25599960D00D8BA00BB825C /* SVGSpotLightSource.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598FC0D00D8B900BB825C /* SVGSpotLightSource.h */; };
-		B25599970D00D8BA00BB825C /* SVGResourceFilterPlatformDataMac.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598FE0D00D8B900BB825C /* SVGResourceFilterPlatformDataMac.h */; };
-		B25599980D00D8BA00BB825C /* SVGResourceFilterPlatformDataMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = B25598FF0D00D8B900BB825C /* SVGResourceFilterPlatformDataMac.mm */; };
 		B25599A30D00D8BA00BB825C /* SVGImage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B255990B0D00D8B900BB825C /* SVGImage.cpp */; };
 		B25599A40D00D8BA00BB825C /* SVGImage.h in Headers */ = {isa = PBXBuildFile; fileRef = B255990C0D00D8B900BB825C /* SVGImage.h */; };
 		B25599A50D00D8BA00BB825C /* EmptyClients.h in Headers */ = {isa = PBXBuildFile; fileRef = B255990D0D00D8B900BB825C /* EmptyClients.h */; };
@@ -3408,7 +3368,6 @@
 		B25599BA0D00D8BA00BB825C /* SVGResourceMarker.h in Headers */ = {isa = PBXBuildFile; fileRef = B25599220D00D8B900BB825C /* SVGResourceMarker.h */; };
 		B25599BB0D00D8BA00BB825C /* SVGResourceMasker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B25599230D00D8B900BB825C /* SVGResourceMasker.cpp */; };
 		B25599BC0D00D8BA00BB825C /* SVGResourceMasker.h in Headers */ = {isa = PBXBuildFile; fileRef = B25599240D00D8B900BB825C /* SVGResourceMasker.h */; };
-		B25BE5110D06B70800B524C6 /* JSEventTargetBase.h in Headers */ = {isa = PBXBuildFile; fileRef = B25BE50F0D06B70800B524C6 /* JSEventTargetBase.h */; };
 		B25DFAAF0B2E2929000E6510 /* JSSVGMatrixCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B25DFAAE0B2E2929000E6510 /* JSSVGMatrixCustom.cpp */; };
 		B262B8040D1F32D000158F09 /* SVGFont.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B262B8030D1F32D000158F09 /* SVGFont.cpp */; };
 		B26554EA0B80D74900A50EC3 /* RenderSVGTextPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B26554E80B80D74900A50EC3 /* RenderSVGTextPath.cpp */; };
@@ -3841,7 +3800,6 @@
 		BC02A5400E099C5A004B6D2B /* CSSParserValues.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02A53F0E099C5A004B6D2B /* CSSParserValues.cpp */; };
 		BC02A63C0E09A9CF004B6D2B /* CSSFunctionValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02A63B0E09A9CF004B6D2B /* CSSFunctionValue.h */; };
 		BC02A6460E09AAE9004B6D2B /* CSSFunctionValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02A6450E09AAE9004B6D2B /* CSSFunctionValue.cpp */; };
-		BC066F6F09FEB2FA00C589A7 /* WebCoreTextRenderer.h in Headers */ = {isa = PBXBuildFile; fileRef = BC066F6C09FEB2FA00C589A7 /* WebCoreTextRenderer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC06ED060BFD5BAE00856E9D /* JSHTMLTableSectionElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC06ED040BFD5BAE00856E9D /* JSHTMLTableSectionElement.cpp */; };
 		BC06ED070BFD5BAE00856E9D /* JSHTMLTableSectionElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC06ED050BFD5BAE00856E9D /* JSHTMLTableSectionElement.h */; };
 		BC06ED9D0BFD660600856E9D /* JSHTMLTableColElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC06ED990BFD660600856E9D /* JSHTMLTableColElement.cpp */; };
@@ -4053,11 +4011,9 @@
 		BC6D44EC0C07F2ED0072D2C9 /* JSHTMLEmbedElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC6D44EA0C07F2ED0072D2C9 /* JSHTMLEmbedElement.cpp */; };
 		BC6D44ED0C07F2ED0072D2C9 /* JSHTMLEmbedElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6D44EB0C07F2ED0072D2C9 /* JSHTMLEmbedElement.h */; };
 		BC6D6E2609AF943500F59759 /* ScrollView.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6D6E2509AF943500F59759 /* ScrollView.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC6DADEF0A195FDF00E5CD14 /* WebFontCache.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6DADEE0A195FDF00E5CD14 /* WebFontCache.h */; };
+		BC6DADEF0A195FDF00E5CD14 /* WebFontCache.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6DADEE0A195FDF00E5CD14 /* WebFontCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC6DADFA0A19602B00E5CD14 /* WebFontCache.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC6DADF90A19602B00E5CD14 /* WebFontCache.mm */; };
 		BC6DC7A10C1A4BFA004E2017 /* JSHTMLAllCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6DC7A00C1A4BFA004E2017 /* JSHTMLAllCollection.h */; };
-		BC6E2B1A0C04B93600444EF8 /* DOMHTMLDocumentPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6E2B190C04B93600444EF8 /* DOMHTMLDocumentPrivate.h */; };
-		BC6E2B290C04B95400444EF8 /* DOMHTMLDocumentPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = BC6E2B190C04B93600444EF8 /* DOMHTMLDocumentPrivate.h */; };
 		BC76AC130DD7AD5C00415F34 /* ParserUtilities.h in Headers */ = {isa = PBXBuildFile; fileRef = BC76AC110DD7AD5C00415F34 /* ParserUtilities.h */; };
 		BC772B3B0C4EA91E0083285F /* CSSHelper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC772B350C4EA91E0083285F /* CSSHelper.cpp */; };
 		BC772B3C0C4EA91E0083285F /* CSSHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = BC772B360C4EA91E0083285F /* CSSHelper.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4158,10 +4114,8 @@
 		BCC573350D695BBE006EF517 /* DOMProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC573330D695BBE006EF517 /* DOMProgressEvent.h */; };
 		BCC573360D695BBE006EF517 /* DOMProgressEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */; };
 		BCC573380D695BD7006EF517 /* DOMProgressEventInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC573370D695BD7006EF517 /* DOMProgressEventInternal.h */; };
-		BCC5733A0D695BF1006EF517 /* DOMTextPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC573390D695BF1006EF517 /* DOMTextPrivate.h */; };
 		BCC5734D0D695C06006EF517 /* DOMProgressEvent.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = BCC573330D695BBE006EF517 /* DOMProgressEvent.h */; };
 		BCC5734E0D695C06006EF517 /* DOMProgressEventInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = BCC573370D695BD7006EF517 /* DOMProgressEventInternal.h */; };
-		BCC5734F0D695C06006EF517 /* DOMTextPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = BCC573390D695BF1006EF517 /* DOMTextPrivate.h */; };
 		BCC5BE000C0E93110011C2DB /* JSCSSStyleSheet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC5BDFE0C0E93110011C2DB /* JSCSSStyleSheet.cpp */; };
 		BCC5BE010C0E93110011C2DB /* JSCSSStyleSheet.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC5BDFF0C0E93110011C2DB /* JSCSSStyleSheet.h */; };
 		BCCBAD3B0C18BFF800CE890F /* JSHTMLCollectionCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCCBAD3A0C18BFF800CE890F /* JSHTMLCollectionCustom.cpp */; };
@@ -4287,13 +4241,11 @@
 		BCEFE1E50DCA5F3300739219 /* JSXSLTProcessorCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCEFE1E40DCA5F3300739219 /* JSXSLTProcessorCustom.cpp */; };
 		BCEFE1EA0DCA5F6400739219 /* JSXSLTProcessor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCEFE1E80DCA5F6400739219 /* JSXSLTProcessor.cpp */; };
 		BCEFE1EB0DCA5F6400739219 /* JSXSLTProcessor.h in Headers */ = {isa = PBXBuildFile; fileRef = BCEFE1E90DCA5F6400739219 /* JSXSLTProcessor.h */; };
-		BCF937E70E8B2E95005C7AB7 /* JSDOMWindowBase.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF937E60E8B2E95005C7AB7 /* JSDOMWindowBase.lut.h */; };
 		BCFB2E5E0979E46400BA703D /* CachedResourceClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFB2E5D0979E46400BA703D /* CachedResourceClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCFB2F76097A2E1A00BA703D /* Arena.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFB2F74097A2E1A00BA703D /* Arena.cpp */; };
 		BCFB2F77097A2E1A00BA703D /* Arena.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFB2F75097A2E1A00BA703D /* Arena.h */; };
 		BCFE2F110C1B58370020235F /* JSRect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFE2F0F0C1B58370020235F /* JSRect.cpp */; };
 		BCFE2F120C1B58380020235F /* JSRect.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFE2F100C1B58370020235F /* JSRect.h */; };
-		BCFE8E320A02A1D30009E61D /* WebCoreTextRenderer.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCFE8E310A02A1D30009E61D /* WebCoreTextRenderer.mm */; };
 		BCFF64910EAD15C200C1D6F7 /* LengthBox.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFF648F0EAD15C200C1D6F7 /* LengthBox.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCFF64920EAD15C200C1D6F7 /* LengthSize.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFF64900EAD15C200C1D6F7 /* LengthSize.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C091588A0DB4209200E55AF4 /* JSInspectedObjectWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C09158840DB4209200E55AF4 /* JSInspectedObjectWrapper.cpp */; };
@@ -4358,7 +4310,6 @@
 		E182568F0EF2B02D00933242 /* JSWorkerContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E182568D0EF2B02D00933242 /* JSWorkerContext.cpp */; };
 		E18256900EF2B02D00933242 /* JSWorkerContext.h in Headers */ = {isa = PBXBuildFile; fileRef = E182568E0EF2B02D00933242 /* JSWorkerContext.h */; };
 		E18258AC0EF3CD7000933242 /* JSWorkerContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18258AB0EF3CD7000933242 /* JSWorkerContextCustom.cpp */; };
-		E18259E70EF3E34B00933242 /* JSWorkerContextBase.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = E18259E60EF3E34B00933242 /* JSWorkerContextBase.lut.h */; };
 		E1A302BC0DE8370300C52F2C /* StringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A302BB0DE8370300C52F2C /* StringBuilder.h */; };
 		E1A302C10DE8376900C52F2C /* StringBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A302C00DE8376900C52F2C /* StringBuilder.cpp */; };
 		E1A5F99B0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */; };
@@ -4471,6 +4422,7 @@
 		FE6FD4890F676E5700092873 /* Coordinates.idl in Resources */ = {isa = PBXBuildFile; fileRef = FE6FD4860F676E5700092873 /* Coordinates.idl */; };
 		FE6FD48D0F676E9300092873 /* JSCoordinates.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE6FD48B0F676E9300092873 /* JSCoordinates.cpp */; };
 		FE6FD48E0F676E9300092873 /* JSCoordinates.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6FD48C0F676E9300092873 /* JSCoordinates.h */; };
+		FE700DD10F92D81A008E2BFE /* JSCoordinatesCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */; };
 		FE80D7A70E9C1ED2000D6F75 /* JSCustomPositionCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80D7A20E9C1ED2000D6F75 /* JSCustomPositionCallback.cpp */; };
 		FE80D7A80E9C1ED2000D6F75 /* JSCustomPositionCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7A30E9C1ED2000D6F75 /* JSCustomPositionCallback.h */; };
 		FE80D7A90E9C1ED2000D6F75 /* JSCustomPositionErrorCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80D7A40E9C1ED2000D6F75 /* JSCustomPositionErrorCallback.cpp */; };
@@ -4527,7 +4479,6 @@
 				1ACD1B630B029739007E5016 /* DOMCSSStyleDeclarationInternal.h in Copy Generated Headers */,
 				85F74E090AA8DF8C000DC284 /* DOMCSSStyleRule.h in Copy Generated Headers */,
 				858C39BD0AA905EF00B187A4 /* DOMCSSStyleSheet.h in Copy Generated Headers */,
-				441B05560CD779B6007C1F18 /* DOMCSSStyleSheetPrivate.h in Copy Generated Headers */,
 				85F74E0A0AA8DF8C000DC284 /* DOMCSSUnknownRule.h in Copy Generated Headers */,
 				858C39B80AA905EF00B187A4 /* DOMCSSValue.h in Copy Generated Headers */,
 				858C39BA0AA905EF00B187A4 /* DOMCSSValueList.h in Copy Generated Headers */,
@@ -4539,42 +4490,33 @@
 				1C11CCC60AA6093700DADB20 /* DOMDocumentFragment.h in Copy Generated Headers */,
 				85E711940AC5D5350053270F /* DOMDocumentFragmentInternal.h in Copy Generated Headers */,
 				1CB4214A0AF2B2CA0085AD91 /* DOMDocumentInternal.h in Copy Generated Headers */,
-				1CFCEEB40AACC4A900348750 /* DOMDocumentPrivate.h in Copy Generated Headers */,
 				1C11CCC00AA6093700DADB20 /* DOMDocumentType.h in Copy Generated Headers */,
 				1C11CCC40AA6093700DADB20 /* DOMElement.h in Copy Generated Headers */,
 				1CB4214B0AF2B2CA0085AD91 /* DOMElementInternal.h in Copy Generated Headers */,
-				1CFCEEB50AACC4A900348750 /* DOMElementPrivate.h in Copy Generated Headers */,
 				5DD0A3810D9AC6070056C122 /* DOMElementTimeControl.h in Copy Generated Headers */,
 				1C11CCBF0AA6093700DADB20 /* DOMEntity.h in Copy Generated Headers */,
 				1C11CCB90AA6093700DADB20 /* DOMEntityReference.h in Copy Generated Headers */,
 				85C7F3E60AAF5D5E004014DD /* DOMEvent.h in Copy Generated Headers */,
 				85D2AD6D0AB1A48200C313EA /* DOMEventListener.h in Copy Generated Headers */,
-				441B05580CD779F2007C1F18 /* DOMEventPrivate.h in Copy Generated Headers */,
 				8540753E0AD6C6DC00620C57 /* DOMEventTarget.h in Copy Generated Headers */,
 				BC00F0360E0A19DB00FD04E3 /* DOMFile.h in Copy Generated Headers */,
 				BC00F0370E0A19DB00FD04E3 /* DOMFileInternal.h in Copy Generated Headers */,
 				BC00F0380E0A19DB00FD04E3 /* DOMFileList.h in Copy Generated Headers */,
 				BC00F0390E0A19DB00FD04E3 /* DOMFileListInternal.h in Copy Generated Headers */,
 				85DF812D0AA778A300486AD7 /* DOMHTMLAnchorElement.h in Copy Generated Headers */,
-				1CFCEE9F0AACC40100348750 /* DOMHTMLAnchorElementPrivate.h in Copy Generated Headers */,
 				854075830AD6CF1400620C57 /* DOMHTMLAppletElement.h in Copy Generated Headers */,
 				85ECBF080AA7628900544F0B /* DOMHTMLAreaElement.h in Copy Generated Headers */,
-				1CFCEEA00AACC40100348750 /* DOMHTMLAreaElementPrivate.h in Copy Generated Headers */,
 				85183B590AA6928600F19FA3 /* DOMHTMLBRElement.h in Copy Generated Headers */,
 				8575DF800AA612D600F5DBB5 /* DOMHTMLBaseElement.h in Copy Generated Headers */,
 				85ECBF090AA7628900544F0B /* DOMHTMLBaseFontElement.h in Copy Generated Headers */,
 				8575DF810AA612D600F5DBB5 /* DOMHTMLBodyElement.h in Copy Generated Headers */,
-				1CFCEE960AACC40100348750 /* DOMHTMLBodyElementPrivate.h in Copy Generated Headers */,
 				85BA4CE50AA686510088052D /* DOMHTMLButtonElement.h in Copy Generated Headers */,
-				1CFCEE970AACC40100348750 /* DOMHTMLButtonElementPrivate.h in Copy Generated Headers */,
-				93F9B6560BA0F35E00854064 /* DOMHTMLCanvasElement.h in Copy Generated Headers */,
+				93D3C17D0F97AA760053C013 /* DOMHTMLCanvasElement.h in Copy Generated Headers */,
 				1C11CCBA0AA6093700DADB20 /* DOMHTMLCollection.h in Copy Generated Headers */,
-				441B055A0CD77A14007C1F18 /* DOMHTMLCollectionPrivate.h in Copy Generated Headers */,
 				85BA4D2A0AA6889F0088052D /* DOMHTMLDListElement.h in Copy Generated Headers */,
 				85BA4D280AA6889F0088052D /* DOMHTMLDirectoryElement.h in Copy Generated Headers */,
 				85BA4D290AA6889F0088052D /* DOMHTMLDivElement.h in Copy Generated Headers */,
 				85F264B20ABBAA580096944B /* DOMHTMLDocument.h in Copy Generated Headers */,
-				BC6E2B290C04B95400444EF8 /* DOMHTMLDocumentPrivate.h in Copy Generated Headers */,
 				1C11CCC80AA6093700DADB20 /* DOMHTMLElement.h in Copy Generated Headers */,
 				1CB4214C0AF2B2CA0085AD91 /* DOMHTMLElementInternal.h in Copy Generated Headers */,
 				854075840AD6CF1400620C57 /* DOMHTMLEmbedElement.h in Copy Generated Headers */,
@@ -4582,7 +4524,6 @@
 				85BA4CE60AA686510088052D /* DOMHTMLFieldSetElement.h in Copy Generated Headers */,
 				85ECBF0A0AA7628900544F0B /* DOMHTMLFontElement.h in Copy Generated Headers */,
 				1C11CCBB0AA6093700DADB20 /* DOMHTMLFormElement.h in Copy Generated Headers */,
-				85B916870AEBDBC4008DD727 /* DOMHTMLFormElementPrivate.h in Copy Generated Headers */,
 				85DF819D0AA77E7E00486AD7 /* DOMHTMLFrameElement.h in Copy Generated Headers */,
 				BC5156F40C03B7DC008BB0EE /* DOMHTMLFrameElementPrivate.h in Copy Generated Headers */,
 				85DF819E0AA77E7E00486AD7 /* DOMHTMLFrameSetElement.h in Copy Generated Headers */,
@@ -4593,16 +4534,13 @@
 				85DF819F0AA77E7E00486AD7 /* DOMHTMLIFrameElement.h in Copy Generated Headers */,
 				441B055E0CD77A48007C1F18 /* DOMHTMLIFrameElementPrivate.h in Copy Generated Headers */,
 				85DF812E0AA778A300486AD7 /* DOMHTMLImageElement.h in Copy Generated Headers */,
-				1CFCEE980AACC40100348750 /* DOMHTMLImageElementPrivate.h in Copy Generated Headers */,
 				85F32B400AA6401A00FF3184 /* DOMHTMLInputElement.h in Copy Generated Headers */,
 				6596F2B30B8731DF001326BD /* DOMHTMLInputElementInternal.h in Copy Generated Headers */,
-				1CFCEEFA0AACC7A700348750 /* DOMHTMLInputElementPrivate.h in Copy Generated Headers */,
 				8575DF820AA612D600F5DBB5 /* DOMHTMLIsIndexElement.h in Copy Generated Headers */,
 				85BA4D2B0AA6889F0088052D /* DOMHTMLLIElement.h in Copy Generated Headers */,
 				85BA4CE70AA686510088052D /* DOMHTMLLabelElement.h in Copy Generated Headers */,
 				85BA4CE80AA686510088052D /* DOMHTMLLegendElement.h in Copy Generated Headers */,
 				8575DF860AA6130E00F5DBB5 /* DOMHTMLLinkElement.h in Copy Generated Headers */,
-				1CFCEE9B0AACC40100348750 /* DOMHTMLLinkElementPrivate.h in Copy Generated Headers */,
 				85ECBF0C0AA7628900544F0B /* DOMHTMLMapElement.h in Copy Generated Headers */,
 				BC5156E80C03B741008BB0EE /* DOMHTMLMarqueeElement.h in Copy Generated Headers */,
 				85BA4D2C0AA6889F0088052D /* DOMHTMLMenuElement.h in Copy Generated Headers */,
@@ -4614,17 +4552,13 @@
 				85F32B410AA6401A00FF3184 /* DOMHTMLOptGroupElement.h in Copy Generated Headers */,
 				854075850AD6CF1400620C57 /* DOMHTMLOptionElement.h in Copy Generated Headers */,
 				1C11CCB80AA6093700DADB20 /* DOMHTMLOptionsCollection.h in Copy Generated Headers */,
-				1CFCEED50AACC66900348750 /* DOMHTMLOptionsCollectionPrivate.h in Copy Generated Headers */,
 				85183B5B0AA6928600F19FA3 /* DOMHTMLParagraphElement.h in Copy Generated Headers */,
 				85ECBF0E0AA7628900544F0B /* DOMHTMLParamElement.h in Copy Generated Headers */,
 				85183B5C0AA6928600F19FA3 /* DOMHTMLPreElement.h in Copy Generated Headers */,
-				1CFCEEDF0AACC6A300348750 /* DOMHTMLPreElementPrivate.h in Copy Generated Headers */,
 				85183B5D0AA6928600F19FA3 /* DOMHTMLQuoteElement.h in Copy Generated Headers */,
 				85DF81A00AA77E7E00486AD7 /* DOMHTMLScriptElement.h in Copy Generated Headers */,
 				85F32B420AA6401A00FF3184 /* DOMHTMLSelectElement.h in Copy Generated Headers */,
-				441B05620CD77A7E007C1F18 /* DOMHTMLSelectElementPrivate.h in Copy Generated Headers */,
 				8575DF7E0AA6127E00F5DBB5 /* DOMHTMLStyleElement.h in Copy Generated Headers */,
-				1CFCEE9D0AACC40100348750 /* DOMHTMLStyleElementPrivate.h in Copy Generated Headers */,
 				85DF822F0AA7866800486AD7 /* DOMHTMLTableCaptionElement.h in Copy Generated Headers */,
 				85DF82300AA7866800486AD7 /* DOMHTMLTableCellElement.h in Copy Generated Headers */,
 				85DF82310AA7866800486AD7 /* DOMHTMLTableColElement.h in Copy Generated Headers */,
@@ -4633,33 +4567,26 @@
 				85DF82330AA7866800486AD7 /* DOMHTMLTableSectionElement.h in Copy Generated Headers */,
 				85F32B430AA6401A00FF3184 /* DOMHTMLTextAreaElement.h in Copy Generated Headers */,
 				6596F2C10B87325C001326BD /* DOMHTMLTextAreaElementInternal.h in Copy Generated Headers */,
-				1CFCEE9E0AACC40100348750 /* DOMHTMLTextAreaElementPrivate.h in Copy Generated Headers */,
 				8575DF870AA6130E00F5DBB5 /* DOMHTMLTitleElement.h in Copy Generated Headers */,
 				85BA4D2E0AA6889F0088052D /* DOMHTMLUListElement.h in Copy Generated Headers */,
 				85DF34620AAFC2D400E59AE3 /* DOMKeyboardEvent.h in Copy Generated Headers */,
-				85DF34630AAFC2D400E59AE3 /* DOMKeyboardEventPrivate.h in Copy Generated Headers */,
 				8506579F0AAB4A8E002D15C0 /* DOMMediaList.h in Copy Generated Headers */,
 				857E0B310AB044780036E447 /* DOMMouseEvent.h in Copy Generated Headers */,
-				857E0B320AB044780036E447 /* DOMMouseEventPrivate.h in Copy Generated Headers */,
 				85DF345D0AAFC2D400E59AE3 /* DOMMutationEvent.h in Copy Generated Headers */,
 				1C11CCB70AA6093700DADB20 /* DOMNamedNodeMap.h in Copy Generated Headers */,
 				853BF4EC0ABB6EB9008647BB /* DOMNode.h in Copy Generated Headers */,
 				8540753F0AD6C6DC00620C57 /* DOMNodeFilter.h in Copy Generated Headers */,
 				9307F1130AF2C8BE00DBA31A /* DOMNodeInternal.h in Copy Generated Headers */,
 				85526C720AB0AE2F000302EA /* DOMNodeIterator.h in Copy Generated Headers */,
-				85526C730AB0AE2F000302EA /* DOMNodeIteratorPrivate.h in Copy Generated Headers */,
 				1C11CCBE0AA6093700DADB20 /* DOMNodeList.h in Copy Generated Headers */,
-				853BF4ED0ABB6EB9008647BB /* DOMNodePrivate.h in Copy Generated Headers */,
 				1C11CCB50AA6093700DADB20 /* DOMNotation.h in Copy Generated Headers */,
 				85DF345F0AAFC2D400E59AE3 /* DOMOverflowEvent.h in Copy Generated Headers */,
 				1C11CCC30AA6093700DADB20 /* DOMProcessingInstruction.h in Copy Generated Headers */,
-				1CFCEECB0AACC60100348750 /* DOMProcessingInstructionPrivate.h in Copy Generated Headers */,
 				BCC5734D0D695C06006EF517 /* DOMProgressEvent.h in Copy Generated Headers */,
 				BCC5734E0D695C06006EF517 /* DOMProgressEventInternal.h in Copy Generated Headers */,
 				855D358D0AD707CC0019AAC7 /* DOMRGBColor.h in Copy Generated Headers */,
 				8538F08C0AD72E0A006A81D1 /* DOMRange.h in Copy Generated Headers */,
 				1CB4214D0AF2B2CA0085AD91 /* DOMRangeInternal.h in Copy Generated Headers */,
-				85A795BA0AD754A30006B9D8 /* DOMRangePrivate.h in Copy Generated Headers */,
 				858C39BC0AA905EF00B187A4 /* DOMRect.h in Copy Generated Headers */,
 				A8F46B380CB20A9D003A9670 /* DOMSVG.h in Copy Generated Headers */,
 				A8F46AE40CB20A9D003A9670 /* DOMSVGAElement.h in Copy Generated Headers */,
@@ -4929,12 +4856,9 @@
 				850657A10AAB4A8E002D15C0 /* DOMStyleSheetList.h in Copy Generated Headers */,
 				1C11CCC20AA6093700DADB20 /* DOMText.h in Copy Generated Headers */,
 				933A14760B7D1BAF00A53FFD /* DOMTextEvent.h in Copy Generated Headers */,
-				BCC5734F0D695C06006EF517 /* DOMTextPrivate.h in Copy Generated Headers */,
 				85526D050AB0B979000302EA /* DOMTreeWalker.h in Copy Generated Headers */,
 				85C7F4D00AAF83F6004014DD /* DOMUIEvent.h in Copy Generated Headers */,
-				85C7F4D10AAF83F6004014DD /* DOMUIEventPrivate.h in Copy Generated Headers */,
 				85DF34600AAFC2D400E59AE3 /* DOMWheelEvent.h in Copy Generated Headers */,
-				85DF34610AAFC2D400E59AE3 /* DOMWheelEventPrivate.h in Copy Generated Headers */,
 				85E9E0A80AB3A11900069CD0 /* DOMXPathExpression.h in Copy Generated Headers */,
 				85E9E0AA0AB3A11900069CD0 /* DOMXPathNSResolver.h in Copy Generated Headers */,
 				85E9E0AB0AB3A11900069CD0 /* DOMXPathResult.h in Copy Generated Headers */,
@@ -4962,10 +4886,10 @@
 		066C772F0AB603FD00238CC4 /* RenderFileUploadControl.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderFileUploadControl.h; sourceTree = "<group>"; };
 		06E81ED60AB5D5E900C87837 /* LocalCurrentGraphicsContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalCurrentGraphicsContext.h; sourceTree = "<group>"; };
 		06E81EEB0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = LocalCurrentGraphicsContext.mm; sourceTree = "<group>"; };
-		070DD8F50F01868000727DEB /* mediaControls.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = mediaControls.css; sourceTree = "<group>"; };
+		070DD8F50F01868000727DEB /* mediaControls.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mediaControls.css; sourceTree = "<group>"; };
 		0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerProxy.h; sourceTree = "<group>"; };
 		079F5E4B0F3BEBEA005E0782 /* MediaPlayerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerPrivate.h; sourceTree = "<group>"; };
-		07AFE5900F1446BD00841617 /* mediaControlsQT.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = mediaControlsQT.css; sourceTree = "<group>"; };
+		07AFE5900F1446BD00841617 /* mediaControlsQT.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mediaControlsQT.css; sourceTree = "<group>"; };
 		080081940ED3B2DD00C53BC0 /* WMLAnchorElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLAnchorElement.cpp; sourceTree = "<group>"; };
 		080081950ED3B2DD00C53BC0 /* WMLAnchorElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLAnchorElement.h; sourceTree = "<group>"; };
 		0804BF6C0EE09C3B0006C000 /* WMLDoElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLDoElement.cpp; sourceTree = "<group>"; };
@@ -4980,19 +4904,24 @@
 		0818AEE10EDB86BC00647B66 /* WMLEventHandlingElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLEventHandlingElement.h; sourceTree = "<group>"; };
 		081D812F0EE0E74D00D73689 /* WMLTimerElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLTimerElement.cpp; sourceTree = "<group>"; };
 		081D81300EE0E74D00D73689 /* WMLTimerElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLTimerElement.h; sourceTree = "<group>"; };
+		081EBF380FD34F4100DA7559 /* SVGFilterBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFilterBuilder.cpp; sourceTree = "<group>"; };
+		081EBF390FD34F4100DA7559 /* SVGFilterBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGFilterBuilder.h; sourceTree = "<group>"; };
 		08203A9D0ED8C35300B8B61A /* WMLAccessElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLAccessElement.cpp; sourceTree = "<group>"; };
 		08203A9E0ED8C35300B8B61A /* WMLAccessElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLAccessElement.h; sourceTree = "<group>"; };
+		082341C30FCF3A9400D75BD6 /* WMLSelectElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLSelectElement.cpp; sourceTree = "<group>"; };
+		082341C40FCF3A9400D75BD6 /* WMLSelectElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLSelectElement.h; sourceTree = "<group>"; };
 		083DAEA20F01A7FB00342754 /* RenderTextControlMultiLine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderTextControlMultiLine.cpp; sourceTree = "<group>"; };
 		083DAEA30F01A7FB00342754 /* RenderTextControlMultiLine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderTextControlMultiLine.h; sourceTree = "<group>"; };
 		083DAEA40F01A7FB00342754 /* RenderTextControlSingleLine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderTextControlSingleLine.cpp; sourceTree = "<group>"; };
 		083DAEA50F01A7FB00342754 /* RenderTextControlSingleLine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderTextControlSingleLine.h; sourceTree = "<group>"; };
+		084AEBE20FB505FA0038483E /* SelectElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SelectElement.cpp; sourceTree = "<group>"; };
+		084AEBE30FB505FA0038483E /* SelectElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SelectElement.h; sourceTree = "<group>"; };
 		084CE5C70F27DADC00E6240E /* WMLOptGroupElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLOptGroupElement.cpp; sourceTree = "<group>"; };
 		084CE5C80F27DADC00E6240E /* WMLOptGroupElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLOptGroupElement.h; sourceTree = "<group>"; };
 		084CE5C90F27DADC00E6240E /* WMLOptionElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLOptionElement.cpp; sourceTree = "<group>"; };
 		084CE5CA0F27DADC00E6240E /* WMLOptionElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLOptionElement.h; sourceTree = "<group>"; };
 		084DBA9D0ED39D350038C226 /* WMLVariables.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLVariables.cpp; sourceTree = "<group>"; };
 		084DBA9E0ED39D360038C226 /* WMLVariables.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLVariables.h; sourceTree = "<group>"; };
-		085773340F0846010080583E /* FormControlElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FormControlElement.h; sourceTree = "<group>"; };
 		08591AA40F085C4E009BACB1 /* InputElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InputElement.h; sourceTree = "<group>"; };
 		085AFDC60F2977350061F2B3 /* WMLFormControlElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLFormControlElement.cpp; sourceTree = "<group>"; };
 		085AFDC70F2977350061F2B3 /* WMLFormControlElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLFormControlElement.h; sourceTree = "<group>"; };
@@ -5032,13 +4961,12 @@
 		08A484750E5272C500C3FE76 /* ScriptElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptElement.cpp; sourceTree = "<group>"; };
 		08A484760E5272C500C3FE76 /* ScriptElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptElement.h; sourceTree = "<group>"; };
 		08A48A6D0E86CF6D00E225DD /* JSSVGElementInstanceCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGElementInstanceCustom.cpp; sourceTree = "<group>"; };
-		08B93F730F293481000720C2 /* FormControlElementWithState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FormControlElementWithState.cpp; sourceTree = "<group>"; };
-		08B93F740F293481000720C2 /* FormControlElementWithState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FormControlElementWithState.h; sourceTree = "<group>"; };
-		08BFDFC30F099E70007DC2BF /* FormControlElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FormControlElement.cpp; sourceTree = "<group>"; };
 		08C4C5140EF19A4000E4840F /* WMLImageElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLImageElement.cpp; sourceTree = "<group>"; };
 		08C4C5150EF19A4000E4840F /* WMLImageElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLImageElement.h; sourceTree = "<group>"; };
 		08C4C5160EF19A4000E4840F /* WMLImageLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLImageLoader.cpp; sourceTree = "<group>"; };
 		08C4C5170EF19A4000E4840F /* WMLImageLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLImageLoader.h; sourceTree = "<group>"; };
+		08C925170FCC7C4A00480DEC /* FilterEffect.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FilterEffect.cpp; path = filters/FilterEffect.cpp; sourceTree = "<group>"; };
+		08C925180FCC7C4A00480DEC /* FilterEffect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FilterEffect.h; path = filters/FilterEffect.h; sourceTree = "<group>"; };
 		08CD61B80ED3929C002DDF51 /* WMLTaskElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLTaskElement.cpp; sourceTree = "<group>"; };
 		08CD61B90ED3929C002DDF51 /* WMLTaskElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLTaskElement.h; sourceTree = "<group>"; };
 		08E192510EDE0C390087B780 /* WMLErrorHandling.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLErrorHandling.cpp; sourceTree = "<group>"; };
@@ -5133,6 +5061,7 @@
 		185BCF270F3279CE000EA262 /* ThreadTimers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadTimers.h; sourceTree = "<group>"; };
 		188604B10F2E654A000B6443 /* DOMTimer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMTimer.cpp; sourceTree = "<group>"; };
 		188604B20F2E654A000B6443 /* DOMTimer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMTimer.h; sourceTree = "<group>"; };
+		18F831B70FD48C7800D8C56B /* WorkerLoaderProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerLoaderProxy.h; path = workers/WorkerLoaderProxy.h; sourceTree = "<group>"; };
 		1A0D57340A5C77FE007EDD4C /* OverflowEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = OverflowEvent.cpp; sourceTree = "<group>"; };
 		1A0D57350A5C77FE007EDD4C /* OverflowEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = OverflowEvent.h; sourceTree = "<group>"; };
 		1A0D57380A5C7812007EDD4C /* OverflowEvent.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = OverflowEvent.idl; sourceTree = "<group>"; };
@@ -5417,8 +5346,6 @@
 		1AE82FEA0CAB07EE002237AE /* JSSQLResultSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLResultSet.cpp; sourceTree = "<group>"; };
 		1AE82FEB0CAB07EE002237AE /* JSSQLResultSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLResultSet.h; sourceTree = "<group>"; };
 		1AE830420CAB0ED1002237AE /* JSDatabaseCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDatabaseCustom.cpp; sourceTree = "<group>"; };
-		1AF326400D78B5530068F0C4 /* AXObjectCacheMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = AXObjectCacheMac.mm; sourceTree = "<group>"; };
-		1AF326760D78B9440068F0C4 /* AXObjectCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AXObjectCache.h; sourceTree = "<group>"; };
 		1AF326770D78B9440068F0C4 /* EditorClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditorClient.h; sourceTree = "<group>"; };
 		1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLResultSetRowList.cpp; sourceTree = "<group>"; };
 		1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLResultSetRowList.h; sourceTree = "<group>"; };
@@ -5470,41 +5397,40 @@
 		1CF6BE120E9BB4670025E1CD /* ObjCNodeFilterCondition.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ObjCNodeFilterCondition.mm; sourceTree = "<group>"; };
 		1CF6BE130E9BB4670025E1CD /* ObjCNodeFilterCondition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjCNodeFilterCondition.h; sourceTree = "<group>"; };
 		1CFAE3220A6D6A3F0032593D /* libobjc.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libobjc.dylib; path = /usr/lib/libobjc.dylib; sourceTree = "<absolute>"; };
-		1CFCEE7F0AACC3B300348750 /* DOMHTMLAnchorElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLAnchorElementPrivate.h; sourceTree = "<group>"; };
-		1CFCEE880AACC3C000348750 /* DOMHTMLAreaElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLAreaElementPrivate.h; sourceTree = "<group>"; };
-		1CFCEE8D0AACC3CD00348750 /* DOMHTMLBodyElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLBodyElementPrivate.h; sourceTree = "<group>"; };
-		1CFCEE8E0AACC3CD00348750 /* DOMHTMLButtonElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLButtonElementPrivate.h; sourceTree = "<group>"; };
-		1CFCEE8F0AACC3CD00348750 /* DOMHTMLImageElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLImageElementPrivate.h; sourceTree = "<group>"; };
-		1CFCEE920AACC3CD00348750 /* DOMHTMLLinkElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLLinkElementPrivate.h; sourceTree = "<group>"; };
-		1CFCEE940AACC3CD00348750 /* DOMHTMLStyleElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLStyleElementPrivate.h; sourceTree = "<group>"; };
-		1CFCEE950AACC3CD00348750 /* DOMHTMLTextAreaElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLTextAreaElementPrivate.h; sourceTree = "<group>"; };
-		1CFCEEB20AACC4A200348750 /* DOMDocumentPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDocumentPrivate.h; sourceTree = "<group>"; };
-		1CFCEEB30AACC4A200348750 /* DOMElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMElementPrivate.h; sourceTree = "<group>"; };
-		1CFCEECA0AACC5F400348750 /* DOMProcessingInstructionPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMProcessingInstructionPrivate.h; sourceTree = "<group>"; };
-		1CFCEED40AACC65D00348750 /* DOMHTMLOptionsCollectionPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLOptionsCollectionPrivate.h; sourceTree = "<group>"; };
-		1CFCEEDA0AACC68300348750 /* DOMHTMLPreElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLPreElementPrivate.h; sourceTree = "<group>"; };
-		1CFCEEF90AACC79000348750 /* DOMHTMLInputElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLInputElementPrivate.h; sourceTree = "<group>"; };
-		2951A2AD0E646C8800DB9ADE /* AccessibilityObjectMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = AccessibilityObjectMac.mm; sourceTree = "<group>"; };
-		2955BE2A0E2548EC00893AB5 /* AccessibilityImageMapLink.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityImageMapLink.h; sourceTree = "<group>"; };
-		2955BE2B0E2548EC00893AB5 /* AccessibilityImageMapLink.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityImageMapLink.cpp; sourceTree = "<group>"; };
-		29800C390E522A5300025536 /* AccessibilityTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTable.h; sourceTree = "<group>"; };
-		29800C3A0E522A5300025536 /* AccessibilityTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTable.cpp; sourceTree = "<group>"; };
-		29800C930E524C8B00025536 /* AccessibilityTableRow.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableRow.h; sourceTree = "<group>"; };
-		29800C940E524C8B00025536 /* AccessibilityTableRow.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableRow.cpp; sourceTree = "<group>"; };
-		29800C970E524DA500025536 /* AccessibilityTableColumn.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableColumn.h; sourceTree = "<group>"; };
-		29800C980E524DA500025536 /* AccessibilityTableColumn.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableColumn.cpp; sourceTree = "<group>"; };
-		299984BB0DC8598500F8D261 /* AccessibilityRenderObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityRenderObject.cpp; sourceTree = "<group>"; };
-		299984BC0DC8598500F8D261 /* AccessibilityRenderObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityRenderObject.h; sourceTree = "<group>"; };
-		2999869A0DD0DEEA00F8D261 /* AccessibilityListBoxOption.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityListBoxOption.h; sourceTree = "<group>"; };
-		2999869B0DD0DEEA00F8D261 /* AccessibilityListBoxOption.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityListBoxOption.cpp; sourceTree = "<group>"; };
-		2999869C0DD0DEEA00F8D261 /* AccessibilityListBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityListBox.h; sourceTree = "<group>"; };
-		2999869D0DD0DEEA00F8D261 /* AccessibilityListBox.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityListBox.cpp; sourceTree = "<group>"; };
-		29AAC36B0E534E86008F9B3B /* AccessibilityTableCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableCell.h; sourceTree = "<group>"; };
-		29AAC36C0E534E86008F9B3B /* AccessibilityTableCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableCell.cpp; sourceTree = "<group>"; };
-		29AAC51D0E53963B008F9B3B /* AccessibilityTableHeaderContainer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableHeaderContainer.h; sourceTree = "<group>"; };
-		29AAC51E0E53963B008F9B3B /* AccessibilityTableHeaderContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableHeaderContainer.cpp; sourceTree = "<group>"; };
-		29FFBB800E7C5A3D00407730 /* AccessibilityList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityList.cpp; sourceTree = "<group>"; };
-		29FFBB810E7C5A3D00407730 /* AccessibilityList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityList.h; sourceTree = "<group>"; };
+		29A812080FBB9C1D00510293 /* AccessibilityRenderObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityRenderObject.cpp; sourceTree = "<group>"; };
+		29A812090FBB9C1D00510293 /* AccessibilityTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTable.cpp; sourceTree = "<group>"; };
+		29A8120A0FBB9C1D00510293 /* AccessibilityARIAGrid.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityARIAGrid.cpp; sourceTree = "<group>"; };
+		29A8120B0FBB9C1D00510293 /* AccessibilityTableRow.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableRow.cpp; sourceTree = "<group>"; };
+		29A8120C0FBB9C1D00510293 /* AccessibilityTableCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableCell.cpp; sourceTree = "<group>"; };
+		29A8120D0FBB9C1D00510293 /* AccessibilityTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTable.h; sourceTree = "<group>"; };
+		29A8120E0FBB9C1D00510293 /* AccessibilityList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityList.h; sourceTree = "<group>"; };
+		29A8120F0FBB9C1D00510293 /* AccessibilityARIAGridRow.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityARIAGridRow.cpp; sourceTree = "<group>"; };
+		29A812100FBB9C1D00510293 /* AccessibilityARIAGridCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityARIAGridCell.h; sourceTree = "<group>"; };
+		29A812110FBB9C1D00510293 /* AccessibilityList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityList.cpp; sourceTree = "<group>"; };
+		29A812120FBB9C1D00510293 /* AccessibilityARIAGridCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityARIAGridCell.cpp; sourceTree = "<group>"; };
+		29A812130FBB9C1D00510293 /* AccessibilityTableRow.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableRow.h; sourceTree = "<group>"; };
+		29A812140FBB9C1D00510293 /* AccessibilityTableCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableCell.h; sourceTree = "<group>"; };
+		29A812150FBB9C1D00510293 /* AccessibilityARIAGridRow.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityARIAGridRow.h; sourceTree = "<group>"; };
+		29A812160FBB9C1D00510293 /* AccessibilityARIAGrid.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityARIAGrid.h; sourceTree = "<group>"; };
+		29A812170FBB9C1D00510293 /* AccessibilityTableColumn.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableColumn.cpp; sourceTree = "<group>"; };
+		29A812180FBB9C1D00510293 /* AccessibilityObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityObject.h; sourceTree = "<group>"; };
+		29A812190FBB9C1D00510293 /* AXObjectCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AXObjectCache.cpp; sourceTree = "<group>"; };
+		29A8121A0FBB9C1D00510293 /* AXObjectCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AXObjectCache.h; sourceTree = "<group>"; };
+		29A8121B0FBB9C1D00510293 /* AccessibilityRenderObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityRenderObject.h; sourceTree = "<group>"; };
+		29A8121C0FBB9C1D00510293 /* AccessibilityImageMapLink.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityImageMapLink.cpp; sourceTree = "<group>"; };
+		29A8121D0FBB9C1D00510293 /* AccessibilityImageMapLink.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityImageMapLink.h; sourceTree = "<group>"; };
+		29A8121E0FBB9C1D00510293 /* AccessibilityObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityObject.cpp; sourceTree = "<group>"; };
+		29A8121F0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityListBoxOption.cpp; sourceTree = "<group>"; };
+		29A812200FBB9C1D00510293 /* AccessibilityListBox.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityListBox.cpp; sourceTree = "<group>"; };
+		29A812210FBB9C1D00510293 /* AccessibilityTableHeaderContainer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableHeaderContainer.h; sourceTree = "<group>"; };
+		29A812220FBB9C1D00510293 /* AccessibilityTableHeaderContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableHeaderContainer.cpp; sourceTree = "<group>"; };
+		29A812230FBB9C1D00510293 /* AccessibilityTableColumn.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableColumn.h; sourceTree = "<group>"; };
+		29A812240FBB9C1D00510293 /* AccessibilityListBoxOption.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityListBoxOption.h; sourceTree = "<group>"; };
+		29A812250FBB9C1D00510293 /* AccessibilityListBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityListBox.h; sourceTree = "<group>"; };
+		29A812440FBB9CA900510293 /* AccessibilityObjectMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = AccessibilityObjectMac.mm; sourceTree = "<group>"; };
+		29A812450FBB9CA900510293 /* AccessibilityObjectWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityObjectWrapper.h; sourceTree = "<group>"; };
+		29A812460FBB9CA900510293 /* AccessibilityObjectWrapper.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = AccessibilityObjectWrapper.mm; sourceTree = "<group>"; };
+		29A812470FBB9CA900510293 /* AXObjectCacheMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = AXObjectCacheMac.mm; sourceTree = "<group>"; };
 		2D9066040BE141D400956998 /* LayoutState.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = LayoutState.cpp; sourceTree = "<group>"; };
 		2D9066050BE141D400956998 /* LayoutState.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = LayoutState.h; sourceTree = "<group>"; };
 		2D90660B0665D937006B6F1A /* ClipboardMac.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = ClipboardMac.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -5590,6 +5516,7 @@
 		3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = FontMacATSUI.mm; sourceTree = "<group>"; };
 		3724CA7D0E68B20500DB4384 /* FontMacCoreText.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontMacCoreText.cpp; sourceTree = "<group>"; };
 		3744570E0DB05FA500AE0992 /* SVGGlyphMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGGlyphMap.h; sourceTree = "<group>"; };
+		3774ABA30FA21EB400AD7DE9 /* OverlapTestRequestClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OverlapTestRequestClient.h; sourceTree = "<group>"; };
 		3784C34A0E11AA34007D8D48 /* FontTraitsMask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontTraitsMask.h; sourceTree = "<group>"; };
 		37919C210B7D188600A56998 /* PositionIterator.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = PositionIterator.cpp; sourceTree = "<group>"; };
 		37919C220B7D188600A56998 /* PositionIterator.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PositionIterator.h; sourceTree = "<group>"; };
@@ -5599,7 +5526,11 @@
 		37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreURLResponse.mm; sourceTree = "<group>"; };
 		41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFunctionCall.h; sourceTree = "<group>"; };
 		41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptFunctionCall.cpp; sourceTree = "<group>"; };
+		4110463F0FA222A600BA436A /* ScriptEventListener.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptEventListener.h; sourceTree = "<group>"; };
+		411046400FA222A600BA436A /* ScriptEventListener.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptEventListener.cpp; sourceTree = "<group>"; };
+		4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptState.cpp; sourceTree = "<group>"; };
 		412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptObjectQuarantine.cpp; sourceTree = "<group>"; };
+		415E3EF50F8D67FE007EEB50 /* MessagePortProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MessagePortProxy.h; sourceTree = "<group>"; };
 		416E75BC0EDF8FD700360E1D /* ScriptCallStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallStack.h; sourceTree = "<group>"; };
 		416E75BD0EDF8FD700360E1D /* ScriptCallStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallStack.cpp; sourceTree = "<group>"; };
 		416E75C90EDF90C700360E1D /* ScriptCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallFrame.h; sourceTree = "<group>"; };
@@ -5627,17 +5558,27 @@
 		41F1D21E0EF35C2A00DA8753 /* ScriptCachedFrameData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCachedFrameData.cpp; sourceTree = "<group>"; };
 		4415292C0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLPlugInImageElement.h; sourceTree = "<group>"; };
 		4415292D0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLPlugInImageElement.cpp; sourceTree = "<group>"; };
-		4429AAEA0CB84DC7007647C5 /* DOMCSSStyleSheetPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMCSSStyleSheetPrivate.h; sourceTree = "<group>"; };
-		4429AAF10CB84E35007647C5 /* DOMHTMLCollectionPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLCollectionPrivate.h; sourceTree = "<group>"; };
-		4429AAF80CB84E5F007647C5 /* DOMEventPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMEventPrivate.h; sourceTree = "<group>"; };
 		4429AAFB0CB84E88007647C5 /* DOMHTMLEmbedElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLEmbedElementPrivate.h; sourceTree = "<group>"; };
 		4429AAFD0CB84EA5007647C5 /* DOMHTMLIFrameElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLIFrameElementPrivate.h; sourceTree = "<group>"; };
 		4429AAFF0CB84EC3007647C5 /* DOMHTMLObjectElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLObjectElementPrivate.h; sourceTree = "<group>"; };
-		4429AB010CB84ED8007647C5 /* DOMHTMLSelectElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLSelectElementPrivate.h; sourceTree = "<group>"; };
 		4429AB070CB84F81007647C5 /* DOMTextEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMTextEventInternal.h; sourceTree = "<group>"; };
+		447D69010FA626810015CCB1 /* RuntimeApplicationChecks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RuntimeApplicationChecks.h; sourceTree = "<group>"; };
+		447D69020FA626810015CCB1 /* RuntimeApplicationChecks.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RuntimeApplicationChecks.mm; sourceTree = "<group>"; };
 		448A29BD0A46D9CB0030759F /* JSHTMLOptionsCollection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLOptionsCollection.h; sourceTree = "<group>"; };
 		448A29BE0A46D9CB0030759F /* JSHTMLOptionsCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLOptionsCollection.cpp; sourceTree = "<group>"; };
 		448AD27A0A4813790023D179 /* JSHTMLOptionsCollectionCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLOptionsCollectionCustom.cpp; sourceTree = "<group>"; };
+		449098B10F8F82520076A327 /* FeatureDefines.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = FeatureDefines.xcconfig; sourceTree = "<group>"; };
+		449195940FBE17D700D9F824 /* WebCore.VideoProxy.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.VideoProxy.exp; sourceTree = "<group>"; };
+		449195950FBE17D700D9F824 /* WebCore.Tiger.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.Tiger.exp; sourceTree = "<group>"; };
+		449195960FBE17D700D9F824 /* WebCore.SVG.ForeignObject.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.SVG.ForeignObject.exp; sourceTree = "<group>"; };
+		449195970FBE17D700D9F824 /* WebCore.SVG.Filters.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.SVG.Filters.exp; sourceTree = "<group>"; };
+		449195980FBE17D700D9F824 /* WebCore.SVG.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.SVG.exp; sourceTree = "<group>"; };
+		449195990FBE17D700D9F824 /* WebCore.SVG.Animation.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.SVG.Animation.exp; sourceTree = "<group>"; };
+		4491959A0FBE17D700D9F824 /* WebCore.NPAPI.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.NPAPI.exp; sourceTree = "<group>"; };
+		4491959B0FBE17D700D9F824 /* WebCore.LP64.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.LP64.exp; sourceTree = "<group>"; };
+		4491959C0FBE17D700D9F824 /* WebCore.JNI.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.JNI.exp; sourceTree = "<group>"; };
+		4491959D0FBE17D700D9F824 /* WebCore.DashboardSupport.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.DashboardSupport.exp; sourceTree = "<group>"; };
+		449B19F30FA72ECE0015CA4A /* HTMLParserQuirks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLParserQuirks.h; sourceTree = "<group>"; };
 		4614A1FD0B23A8D600446E1C /* copyCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = copyCursor.png; sourceTree = "<group>"; };
 		464EA2710B8A350B00A8E6E3 /* crossHairCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = crossHairCursor.png; sourceTree = "<group>"; };
 		464EA2720B8A350B00A8E6E3 /* notAllowedCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = notAllowedCursor.png; sourceTree = "<group>"; };
@@ -5690,10 +5631,6 @@
 		49E912A80EFAC906009D0CAF /* AnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AnimationList.h; path = animation/AnimationList.h; sourceTree = "<group>"; };
 		49E912A90EFAC906009D0CAF /* TimingFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TimingFunction.h; path = animation/TimingFunction.h; sourceTree = "<group>"; };
 		4A8C96EA0BE69032004EEFF0 /* SelectionControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = SelectionControllerMac.mm; path = mac/SelectionControllerMac.mm; sourceTree = "<group>"; };
-		4B17CBC80D945B370053F183 /* AccessibilityObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityObject.h; sourceTree = "<group>"; };
-		4B17CBCA0D945B910053F183 /* AccessibilityObjectWrapper.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = AccessibilityObjectWrapper.mm; sourceTree = "<group>"; };
-		4B17CBCB0D945B910053F183 /* AccessibilityObjectWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityObjectWrapper.h; sourceTree = "<group>"; };
-		4B24F9A70DA7050B00269E58 /* AXObjectCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AXObjectCache.cpp; sourceTree = "<group>"; };
 		4B2708C50AF19EE40065127F /* Pasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pasteboard.h; sourceTree = "<group>"; };
 		4B2709810AF2E5E00065127F /* PasteboardMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PasteboardMac.mm; sourceTree = "<group>"; };
 		4B3043C60AE0370300A82647 /* Sound.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Sound.h; sourceTree = "<group>"; };
@@ -5702,7 +5639,6 @@
 		4B3043CB0AE0373B00A82647 /* Editor.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Editor.h; sourceTree = "<group>"; };
 		4B3480910EEF50D400AC1B41 /* ImageSourceCGMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ImageSourceCGMac.mm; sourceTree = "<group>"; };
 		4B3480920EEF50D400AC1B41 /* ImageSourceCG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageSourceCG.h; sourceTree = "<group>"; };
-		4B5B7C8D0D945CFA00DDF3AB /* AccessibilityObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityObject.cpp; sourceTree = "<group>"; };
 		4B6FA6F20C39E48C00087011 /* SmartReplace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SmartReplace.h; sourceTree = "<group>"; };
 		4B6FA6F30C39E48C00087011 /* SmartReplace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SmartReplace.cpp; sourceTree = "<group>"; };
 		4B6FA6F60C39E4A100087011 /* SmartReplaceCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SmartReplaceCF.cpp; sourceTree = "<group>"; };
@@ -5731,11 +5667,6 @@
 		4E1959260A39DACC00220FE5 /* MediaQueryEvaluator.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaQueryEvaluator.h; sourceTree = "<group>"; };
 		4E1959270A39DACC00220FE5 /* MediaQueryExp.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = MediaQueryExp.cpp; sourceTree = "<group>"; };
 		4E1959280A39DACC00220FE5 /* MediaQueryExp.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaQueryExp.h; sourceTree = "<group>"; };
-		50A5DF730E1A13C9000A03AE /* Filter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Filter.h; sourceTree = "<group>"; };
-		50A5DF740E1A13C9000A03AE /* FilterBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FilterBuilder.h; sourceTree = "<group>"; };
-		50A5E20F0E1ABAF2000A03AE /* FilterEffect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FilterEffect.h; sourceTree = "<group>"; };
-		50A5E4710E1AEF3A000A03AE /* Filter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Filter.cpp; sourceTree = "<group>"; };
-		50A5E4730E1AEF84000A03AE /* FilterEffect.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FilterEffect.cpp; sourceTree = "<group>"; };
 		510184670B08602A004A825F /* CachedPage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedPage.h; sourceTree = "<group>"; };
 		510184680B08602A004A825F /* CachedPage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedPage.cpp; sourceTree = "<group>"; };
 		5116D9750CF177BD00C2B84D /* DatabaseDetails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseDetails.h; sourceTree = "<group>"; };
@@ -5879,6 +5810,8 @@
 		54C50F7A0E801DF3009832A0 /* XMLTokenizerLibxml2.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLTokenizerLibxml2.cpp; sourceTree = "<group>"; };
 		550A0BC7085F6039007353D6 /* QualifiedName.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = QualifiedName.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		550A0BC8085F6039007353D6 /* QualifiedName.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = QualifiedName.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		5D15E3A90F9E6AC1009E0E3F /* XMLTokenizerScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLTokenizerScope.cpp; sourceTree = "<group>"; };
+		5D15E3AA0F9E6AC1009E0E3F /* XMLTokenizerScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XMLTokenizerScope.h; sourceTree = "<group>"; };
 		5D925B650F64D4DD00B847F0 /* ScrollBehavior.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollBehavior.cpp; sourceTree = "<group>"; };
 		5D925B660F64D4DD00B847F0 /* ScrollBehavior.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollBehavior.h; sourceTree = "<group>"; };
 		5DCF836C0D59159800953BC6 /* PluginInfoStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginInfoStore.h; sourceTree = "<group>"; };
@@ -6002,7 +5935,20 @@
 		75793ED00D0CE85B007FC0AC /* DOMMessageEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMessageEvent.h; sourceTree = "<group>"; };
 		75793ED10D0CE85B007FC0AC /* DOMMessageEvent.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMMessageEvent.mm; sourceTree = "<group>"; };
 		75793ED20D0CE85B007FC0AC /* DOMMessageEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMessageEventInternal.h; sourceTree = "<group>"; };
+		7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageGroupLoadDeferrer.cpp; sourceTree = "<group>"; };
+		7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageGroupLoadDeferrer.h; sourceTree = "<group>"; };
+		7AB6F8850FB9D27100805D02 /* JSONObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSONObject.cpp; sourceTree = "<group>"; };
+		7AB6F8860FB9D27100805D02 /* JSONObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSONObject.h; sourceTree = "<group>"; };
+		7AED3E030FBB1EAA00D2B03C /* InspectorFrontend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontend.cpp; sourceTree = "<group>"; };
+		7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontend.h; sourceTree = "<group>"; };
+		845E72F70FD261EE00A87D79 /* Filter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Filter.h; path = filters/Filter.h; sourceTree = "<group>"; };
+		845E72F90FD2623900A87D79 /* SVGFilter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFilter.cpp; sourceTree = "<group>"; };
+		845E72FA0FD2623900A87D79 /* SVGFilter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGFilter.h; sourceTree = "<group>"; };
 		849F77750EFEC6200090849D /* StrokeStyleApplier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StrokeStyleApplier.h; sourceTree = "<group>"; };
+		84A81F3B0FC7DFF000955300 /* SourceAlpha.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SourceAlpha.cpp; path = filters/SourceAlpha.cpp; sourceTree = "<group>"; };
+		84A81F3C0FC7DFF000955300 /* SourceAlpha.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SourceAlpha.h; path = filters/SourceAlpha.h; sourceTree = "<group>"; };
+		84A81F3F0FC7E02700955300 /* SourceGraphic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SourceGraphic.cpp; path = filters/SourceGraphic.cpp; sourceTree = "<group>"; };
+		84A81F400FC7E02700955300 /* SourceGraphic.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SourceGraphic.h; path = filters/SourceGraphic.h; sourceTree = "<group>"; };
 		84B2B1F7056BEF3A00D2B771 /* WebCoreKeyGenerator.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreKeyGenerator.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		84B2B1F8056BEF3A00D2B771 /* WebCoreKeyGenerator.m */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebCoreKeyGenerator.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SSLKeyGeneratorMac.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -6248,7 +6194,6 @@
 		8538F0840AD72CB6006A81D1 /* DOMRanges.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMRanges.h; sourceTree = "<group>"; };
 		853BF4D90ABB6B55008647BB /* DOMNode.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMNode.h; sourceTree = "<group>"; };
 		853BF4DA0ABB6B55008647BB /* DOMNode.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMNode.mm; sourceTree = "<group>"; };
-		853BF4EA0ABB6E97008647BB /* DOMNodePrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMNodePrivate.h; sourceTree = "<group>"; };
 		853CA9CA0AEEC5E9002372DC /* RenderSVGContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGContainer.cpp; sourceTree = "<group>"; };
 		853CA9CB0AEEC5E9002372DC /* RenderSVGContainer.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSVGContainer.h; sourceTree = "<group>"; };
 		853CA9CC0AEEC5E9002372DC /* RenderSVGImage.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGImage.cpp; sourceTree = "<group>"; };
@@ -6320,7 +6265,6 @@
 		855247CE0AD850B80012093B /* DOMHTMLEmbedElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLEmbedElementInternal.h; sourceTree = "<group>"; };
 		85526C350AB0A17E000302EA /* DOMNodeIterator.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMNodeIterator.h; sourceTree = "<group>"; };
 		85526C360AB0A17E000302EA /* DOMNodeIterator.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMNodeIterator.mm; sourceTree = "<group>"; };
-		85526C3D0AB0A76F000302EA /* DOMNodeIteratorPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMNodeIteratorPrivate.h; sourceTree = "<group>"; };
 		85526CD00AB0B7D9000302EA /* DOMTreeWalker.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMTreeWalker.h; sourceTree = "<group>"; };
 		85526CD10AB0B7D9000302EA /* DOMTreeWalker.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMTreeWalker.mm; sourceTree = "<group>"; };
 		855542570AA48B1E00BA89F2 /* HTMLTableCaptionElement.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = HTMLTableCaptionElement.idl; sourceTree = "<group>"; };
@@ -6356,7 +6300,6 @@
 		8574D1F80ADE6122004CBA11 /* JSSVGRect.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.h; path = JSSVGRect.h; sourceTree = "<group>"; };
 		857E0B230AB043460036E447 /* DOMMouseEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMouseEvent.h; sourceTree = "<group>"; };
 		857E0B240AB043460036E447 /* DOMMouseEvent.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMMouseEvent.mm; sourceTree = "<group>"; };
-		857E0B2B0AB043FC0036E447 /* DOMMouseEventPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMouseEventPrivate.h; sourceTree = "<group>"; };
 		858015CD0ABCA75D0080588D /* DOMXPathException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMXPathException.h; sourceTree = "<group>"; };
 		858C381A0AA8E29600B187A4 /* DOMCSSValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMCSSValue.h; sourceTree = "<group>"; };
 		858C381B0AA8E29600B187A4 /* DOMCSSValue.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMCSSValue.mm; sourceTree = "<group>"; };
@@ -6523,7 +6466,6 @@
 		85B499690ADB3FF500925CBB /* DOMSVGPathElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMSVGPathElement.h; sourceTree = "<group>"; };
 		85B4996A0ADB3FF500925CBB /* DOMSVGPathElement.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMSVGPathElement.mm; sourceTree = "<group>"; };
 		85B499770ADB425E00925CBB /* DOMSVGPathElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMSVGPathElementInternal.h; sourceTree = "<group>"; };
-		85B916830AEBDB47008DD727 /* DOMHTMLFormElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLFormElementPrivate.h; sourceTree = "<group>"; };
 		85BA4CD50AA6861B0088052D /* DOMHTMLButtonElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLButtonElement.h; sourceTree = "<group>"; };
 		85BA4CD60AA6861B0088052D /* DOMHTMLButtonElement.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMHTMLButtonElement.mm; sourceTree = "<group>"; };
 		85BA4CD70AA6861B0088052D /* DOMHTMLFieldSetElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLFieldSetElement.h; sourceTree = "<group>"; };
@@ -6553,7 +6495,6 @@
 		85C2397F0AD5907D003533E7 /* DOMSVGNumberList.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMSVGNumberList.h; sourceTree = "<group>"; };
 		85C239800AD5907D003533E7 /* DOMSVGNumberList.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMSVGNumberList.mm; sourceTree = "<group>"; };
 		85C239830AD59098003533E7 /* DOMSVGNumberListInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMSVGNumberListInternal.h; sourceTree = "<group>"; };
-		85C320780AD7401500BC15C4 /* DOMRangePrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMRangePrivate.h; sourceTree = "<group>"; };
 		85C56C5B0AA87AFD00D95755 /* MediaList.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = MediaList.idl; sourceTree = "<group>"; };
 		85C56CA10AA89AB400D95755 /* CSSStyleRule.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = CSSStyleRule.idl; sourceTree = "<group>"; };
 		85C56CA20AA89C1000D95755 /* CSSMediaRule.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = CSSMediaRule.idl; sourceTree = "<group>"; };
@@ -6565,7 +6506,6 @@
 		85C78A670ABDE1B40044FC16 /* DOMException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMException.h; sourceTree = "<group>"; };
 		85C7F48F0AAF79DC004014DD /* DOMUIEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMUIEvent.h; sourceTree = "<group>"; };
 		85C7F4900AAF79DC004014DD /* DOMUIEvent.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMUIEvent.mm; sourceTree = "<group>"; };
-		85C7F4C20AAF8081004014DD /* DOMUIEventPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMUIEventPrivate.h; sourceTree = "<group>"; };
 		85C7F5BC0AAFB7CC004014DD /* DOMMutationEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMutationEvent.h; sourceTree = "<group>"; };
 		85C7F5BD0AAFB7CC004014DD /* DOMMutationEvent.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMMutationEvent.mm; sourceTree = "<group>"; };
 		85C7F5CE0AAFB8D9004014DD /* DOMOverflowEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMOverflowEvent.h; sourceTree = "<group>"; };
@@ -6686,7 +6626,6 @@
 		85DF2F920AA3C9B600AD64C5 /* HTMLOptionsCollection.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = HTMLOptionsCollection.idl; sourceTree = "<group>"; };
 		85DF2F990AA3CAE500AD64C5 /* DOMHTMLOptionsCollection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLOptionsCollection.h; sourceTree = "<group>"; };
 		85DF2F9A0AA3CAE500AD64C5 /* DOMHTMLOptionsCollection.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMHTMLOptionsCollection.mm; sourceTree = "<group>"; };
-		85DF343F0AAFC0ED00E59AE3 /* DOMKeyboardEventPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMKeyboardEventPrivate.h; sourceTree = "<group>"; };
 		85DF81210AA7787200486AD7 /* DOMHTMLAnchorElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLAnchorElement.h; sourceTree = "<group>"; };
 		85DF81220AA7787200486AD7 /* DOMHTMLAnchorElement.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMHTMLAnchorElement.mm; sourceTree = "<group>"; };
 		85DF81230AA7787200486AD7 /* DOMHTMLImageElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLImageElement.h; sourceTree = "<group>"; };
@@ -6821,7 +6760,6 @@
 		85F32AEB0AA63B8700FF3184 /* DOMHTMLTextAreaElement.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMHTMLTextAreaElement.mm; sourceTree = "<group>"; };
 		85F56A780A98CE3700ADB60A /* DOMProcessingInstruction.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMProcessingInstruction.h; sourceTree = "<group>"; };
 		85F56A790A98CE3700ADB60A /* DOMProcessingInstruction.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMProcessingInstruction.mm; sourceTree = "<group>"; };
-		85FF313B0AAFBD7200374F38 /* DOMWheelEventPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMWheelEventPrivate.h; sourceTree = "<group>"; };
 		85FF31580AAFBFCB00374F38 /* DOMKeyboardEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMKeyboardEvent.h; sourceTree = "<group>"; };
 		85FF31590AAFBFCB00374F38 /* DOMKeyboardEvent.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMKeyboardEvent.mm; sourceTree = "<group>"; };
 		898D1FB20F27934B004BBAC7 /* CanvasPixelArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CanvasPixelArray.h; sourceTree = "<group>"; };
@@ -6960,12 +6898,16 @@
 		935FBC4409BA00B900E230B1 /* EventListener.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventListener.h; sourceTree = "<group>"; };
 		935FBCF109BA143B00E230B1 /* ExceptionCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionCode.h; sourceTree = "<group>"; };
 		9362640A0DE1137D009D5A00 /* CSSReflectionDirection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSReflectionDirection.h; sourceTree = "<group>"; };
+		9363B62A0F8E8FE000803810 /* HistoryPropertyList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HistoryPropertyList.cpp; sourceTree = "<group>"; };
+		9363B62B0F8E8FE000803810 /* HistoryPropertyList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HistoryPropertyList.h; sourceTree = "<group>"; };
 		936DD03A09CEAC270056AE8C /* Range.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Range.idl; sourceTree = "<group>"; };
 		93799EF60BF2743600D0F230 /* RenderWordBreak.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderWordBreak.cpp; sourceTree = "<group>"; };
 		93799EF70BF2743600D0F230 /* RenderWordBreak.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderWordBreak.h; sourceTree = "<group>"; };
 		9380F47109A11AB4001FDB34 /* Widget.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Widget.cpp; sourceTree = "<group>"; };
 		9380F47209A11AB4001FDB34 /* Widget.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Widget.h; sourceTree = "<group>"; };
 		9380F47709A11ACC001FDB34 /* WidgetMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = WidgetMac.mm; sourceTree = "<group>"; };
+		938192020F87E1E600D5352A /* BinaryPropertyList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BinaryPropertyList.cpp; sourceTree = "<group>"; };
+		938192040F87E1EC00D5352A /* BinaryPropertyList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BinaryPropertyList.h; sourceTree = "<group>"; };
 		9382AAB10D8C386100F357A6 /* NodeWithIndex.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeWithIndex.h; sourceTree = "<group>"; };
 		93831B560D087D6000E5C984 /* ExceptionCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionCode.cpp; sourceTree = "<group>"; };
 		938E65F009F09840008A48EC /* JSHTMLElementWrapperFactory.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLElementWrapperFactory.h; sourceTree = "<group>"; };
@@ -6985,6 +6927,8 @@
 		939B02ED0EA2DBC400C54570 /* WidthIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WidthIterator.h; sourceTree = "<group>"; };
 		939B3E4D0D3C1E8400B4A92B /* StringBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringBuffer.h; sourceTree = "<group>"; };
 		93A38B4A0D0E5808006872C2 /* EditorCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EditorCommand.cpp; sourceTree = "<group>"; };
+		93B2D8150F9920D2006AE6B2 /* SuddenTermination.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SuddenTermination.h; sourceTree = "<group>"; };
+		93B2D8170F9920EE006AE6B2 /* SuddenTermination.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SuddenTermination.mm; sourceTree = "<group>"; };
 		93B6A0E50B0BCA5C00F5027A /* ContextMenu.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ContextMenu.h; sourceTree = "<group>"; };
 		93B6A0E70B0BCA6700F5027A /* ContextMenu.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = ContextMenu.cpp; sourceTree = "<group>"; };
 		93B6A0E90B0BCA8400F5027A /* ContextMenuMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = ContextMenuMac.mm; sourceTree = "<group>"; };
@@ -7002,6 +6946,9 @@
 		93C09A7E0B064EEF005ABD4D /* EventHandlerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = EventHandlerMac.mm; sourceTree = "<group>"; };
 		93C09A800B064F00005ABD4D /* EventHandler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventHandler.cpp; sourceTree = "<group>"; };
 		93C09C850B0657AA005ABD4D /* ScrollTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollTypes.h; sourceTree = "<group>"; };
+		93C441ED0F813A1A00C1A634 /* CollectionCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CollectionCache.cpp; sourceTree = "<group>"; };
+		93C441EE0F813A1A00C1A634 /* CollectionCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CollectionCache.h; sourceTree = "<group>"; };
+		93C441FF0F813AE100C1A634 /* CollectionType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CollectionType.h; sourceTree = "<group>"; };
 		93C841F709CE855C00DFF5E5 /* DOMImplementationFront.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMImplementationFront.h; sourceTree = "<group>"; };
 		93C841FE09CE858300DFF5E5 /* DOMImplementationFront.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMImplementationFront.cpp; sourceTree = "<group>"; };
 		93CA4C9909DF93FA00DF8677 /* html4.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = html4.css; sourceTree = "<group>"; };
@@ -7014,6 +6961,7 @@
 		93CA4CA309DF93FA00DF8677 /* tokenizer.flex */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = tokenizer.flex; sourceTree = "<group>"; };
 		93CCF0260AF6C52900018E89 /* NavigationAction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigationAction.h; sourceTree = "<group>"; };
 		93CCF05F0AF6CA7600018E89 /* NavigationAction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NavigationAction.cpp; sourceTree = "<group>"; };
+		93D3C1580F97A9D70053C013 /* DOMHTMLCanvasElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLCanvasElement.h; sourceTree = "<group>"; };
 		93D9D53B0DA27E180077216C /* RangeBoundaryPoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RangeBoundaryPoint.h; sourceTree = "<group>"; };
 		93E227DB0AF589AD00D48324 /* DocumentLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentLoader.cpp; sourceTree = "<group>"; };
 		93E227DC0AF589AD00D48324 /* MainResourceLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MainResourceLoader.cpp; sourceTree = "<group>"; };
@@ -7053,7 +7001,8 @@
 		93F8B3060A300FEA00F61AB8 /* CodeGeneratorJS.pm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.perl; name = CodeGeneratorJS.pm; path = ../scripts/CodeGeneratorJS.pm; sourceTree = "<group>"; };
 		93F8B3070A300FEA00F61AB8 /* generate-bindings.pl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.perl; name = "generate-bindings.pl"; path = "scripts/generate-bindings.pl"; sourceTree = "<group>"; };
 		93F8B3080A300FEA00F61AB8 /* IDLStructure.pm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.perl; name = IDLStructure.pm; path = scripts/IDLStructure.pm; sourceTree = "<group>"; };
-		93F9B6530BA0F35E00854064 /* DOMHTMLCanvasElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLCanvasElement.h; sourceTree = "<group>"; };
+		93F925410F7EF5B8007E37C9 /* CheckedRadioButtons.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CheckedRadioButtons.h; sourceTree = "<group>"; };
+		93F925420F7EF5B8007E37C9 /* CheckedRadioButtons.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CheckedRadioButtons.cpp; sourceTree = "<group>"; };
 		93F9B6540BA0F35E00854064 /* DOMHTMLCanvasElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMHTMLCanvasElement.mm; sourceTree = "<group>"; };
 		93F9B6550BA0F35E00854064 /* DOMHTMLCanvasElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLCanvasElementInternal.h; sourceTree = "<group>"; };
 		93F9B6DE0BA0FB7200854064 /* JSComment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSComment.cpp; sourceTree = "<group>"; };
@@ -7354,6 +7303,8 @@
 		A88FE3330E5EEE87008D8C0F /* GraphicsContextPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GraphicsContextPrivate.h; sourceTree = "<group>"; };
 		A89943260B42338700D7C802 /* BitmapImage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BitmapImage.h; sourceTree = "<group>"; };
 		A89943270B42338700D7C802 /* BitmapImage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BitmapImage.cpp; sourceTree = "<group>"; };
+		A89CCC500F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ReplaceNodeWithSpanCommand.cpp; sourceTree = "<group>"; };
+		A89CCC510F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReplaceNodeWithSpanCommand.h; sourceTree = "<group>"; };
 		A8A909AA0CBCD6B50029B807 /* RenderSVGTransformableContainer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGTransformableContainer.h; sourceTree = "<group>"; };
 		A8A909AB0CBCD6B50029B807 /* RenderSVGTransformableContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGTransformableContainer.cpp; sourceTree = "<group>"; };
 		A8C4A7EB09D563270003AC8D /* StyledElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = StyledElement.h; sourceTree = "<group>"; };
@@ -7601,11 +7552,9 @@
 		A8EA79EF0A1916DF00A8EF5F /* HTMLOListElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLOListElement.cpp; sourceTree = "<group>"; };
 		A8EA79F00A1916DF00A8EF5F /* HTMLLIElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLLIElement.cpp; sourceTree = "<group>"; };
 		A8EA7A480A191A5200A8EF5F /* RenderListItem.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderListItem.cpp; sourceTree = "<group>"; };
-		A8EA7A490A191A5200A8EF5F /* ListMarkerBox.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ListMarkerBox.h; sourceTree = "<group>"; };
 		A8EA7A4A0A191A5200A8EF5F /* RenderListMarker.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderListMarker.h; sourceTree = "<group>"; };
 		A8EA7A4B0A191A5200A8EF5F /* RenderListMarker.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderListMarker.cpp; sourceTree = "<group>"; };
 		A8EA7A4C0A191A5200A8EF5F /* RenderListItem.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderListItem.h; sourceTree = "<group>"; };
-		A8EA7A4D0A191A5200A8EF5F /* ListMarkerBox.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = ListMarkerBox.cpp; sourceTree = "<group>"; };
 		A8EA7C9D0A192B9C00A8EF5F /* HTMLMarqueeElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HTMLMarqueeElement.h; sourceTree = "<group>"; };
 		A8EA7C9E0A192B9C00A8EF5F /* HTMLMarqueeElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLMarqueeElement.cpp; sourceTree = "<group>"; };
 		A8EA7C9F0A192B9C00A8EF5F /* HTMLPreElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLPreElement.cpp; sourceTree = "<group>"; };
@@ -7646,6 +7595,8 @@
 		A8EA80060A19516E00A8EF5F /* MediaList.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaList.h; sourceTree = "<group>"; };
 		A8F4FB930C169E7B002AFED5 /* SVGRenderSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGRenderSupport.h; sourceTree = "<group>"; };
 		A8F4FB950C169E85002AFED5 /* SVGRenderSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGRenderSupport.cpp; sourceTree = "<group>"; };
+		A8F5C0B60F9285AC0098E06B /* RenderSVGModelObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGModelObject.h; sourceTree = "<group>"; };
+		A8F5C0B70F9285AC0098E06B /* RenderSVGModelObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGModelObject.cpp; sourceTree = "<group>"; };
 		A8FA6E5B0E4CFDED00D5CF49 /* Pattern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pattern.h; sourceTree = "<group>"; };
 		A8FA6E5C0E4CFDED00D5CF49 /* Pattern.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Pattern.cpp; sourceTree = "<group>"; };
 		A9C6E4E10D745E05006442E9 /* MimeType.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = MimeType.cpp; sourceTree = "<group>"; };
@@ -8126,51 +8077,6 @@
 		B237C8A60D344D110013F707 /* SVGFontData.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGFontData.h; sourceTree = "<group>"; };
 		B24055630B5BE640002A28C0 /* DOMSVGElementInstanceInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMSVGElementInstanceInternal.h; sourceTree = "<group>"; };
 		B24055640B5BE640002A28C0 /* DOMSVGElementInstanceListInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMSVGElementInstanceListInternal.h; sourceTree = "<group>"; };
-		B25598990D00D8B800BB825C /* SVGResourceFilterCg.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = SVGResourceFilterCg.mm; sourceTree = "<group>"; };
-		B25598A60D00D8B800BB825C /* SVGFEHelpersCg.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGFEHelpersCg.h; sourceTree = "<group>"; };
-		B25598A70D00D8B800BB825C /* SVGFEHelpersCg.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = SVGFEHelpersCg.mm; sourceTree = "<group>"; };
-		B25598AD0D00D8B800BB825C /* SVGFilterEffectCg.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = SVGFilterEffectCg.mm; sourceTree = "<group>"; };
-		B25598AE0D00D8B900BB825C /* WKArithmeticFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKArithmeticFilter.cikernel; sourceTree = "<group>"; };
-		B25598AF0D00D8B900BB825C /* WKArithmeticFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKArithmeticFilter.h; sourceTree = "<group>"; };
-		B25598B00D00D8B900BB825C /* WKArithmeticFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKArithmeticFilter.m; sourceTree = "<group>"; };
-		B25598B10D00D8B900BB825C /* WKComponentMergeFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKComponentMergeFilter.cikernel; sourceTree = "<group>"; };
-		B25598B20D00D8B900BB825C /* WKComponentMergeFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKComponentMergeFilter.h; sourceTree = "<group>"; };
-		B25598B30D00D8B900BB825C /* WKComponentMergeFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKComponentMergeFilter.m; sourceTree = "<group>"; };
-		B25598B40D00D8B900BB825C /* WKDiffuseLightingFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKDiffuseLightingFilter.cikernel; sourceTree = "<group>"; };
-		B25598B50D00D8B900BB825C /* WKDiffuseLightingFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKDiffuseLightingFilter.h; sourceTree = "<group>"; };
-		B25598B60D00D8B900BB825C /* WKDiffuseLightingFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKDiffuseLightingFilter.m; sourceTree = "<group>"; };
-		B25598B70D00D8B900BB825C /* WKDiscreteTransferFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKDiscreteTransferFilter.cikernel; sourceTree = "<group>"; };
-		B25598B80D00D8B900BB825C /* WKDiscreteTransferFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKDiscreteTransferFilter.h; sourceTree = "<group>"; };
-		B25598B90D00D8B900BB825C /* WKDiscreteTransferFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKDiscreteTransferFilter.m; sourceTree = "<group>"; };
-		B25598BA0D00D8B900BB825C /* WKDisplacementMapFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKDisplacementMapFilter.cikernel; sourceTree = "<group>"; };
-		B25598BB0D00D8B900BB825C /* WKDisplacementMapFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKDisplacementMapFilter.h; sourceTree = "<group>"; };
-		B25598BC0D00D8B900BB825C /* WKDisplacementMapFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKDisplacementMapFilter.m; sourceTree = "<group>"; };
-		B25598BD0D00D8B900BB825C /* WKDistantLightFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKDistantLightFilter.cikernel; sourceTree = "<group>"; };
-		B25598BE0D00D8B900BB825C /* WKDistantLightFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKDistantLightFilter.h; sourceTree = "<group>"; };
-		B25598BF0D00D8B900BB825C /* WKDistantLightFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKDistantLightFilter.m; sourceTree = "<group>"; };
-		B25598C00D00D8B900BB825C /* WKGammaTransferFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKGammaTransferFilter.cikernel; sourceTree = "<group>"; };
-		B25598C10D00D8B900BB825C /* WKGammaTransferFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKGammaTransferFilter.h; sourceTree = "<group>"; };
-		B25598C20D00D8B900BB825C /* WKGammaTransferFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKGammaTransferFilter.m; sourceTree = "<group>"; };
-		B25598C30D00D8B900BB825C /* WKIdentityTransferFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKIdentityTransferFilter.h; sourceTree = "<group>"; };
-		B25598C40D00D8B900BB825C /* WKIdentityTransferFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKIdentityTransferFilter.m; sourceTree = "<group>"; };
-		B25598C50D00D8B900BB825C /* WKLinearTransferFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKLinearTransferFilter.cikernel; sourceTree = "<group>"; };
-		B25598C60D00D8B900BB825C /* WKLinearTransferFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKLinearTransferFilter.h; sourceTree = "<group>"; };
-		B25598C70D00D8B900BB825C /* WKLinearTransferFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKLinearTransferFilter.m; sourceTree = "<group>"; };
-		B25598C80D00D8B900BB825C /* WKNormalMapFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKNormalMapFilter.cikernel; sourceTree = "<group>"; };
-		B25598C90D00D8B900BB825C /* WKNormalMapFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKNormalMapFilter.h; sourceTree = "<group>"; };
-		B25598CA0D00D8B900BB825C /* WKNormalMapFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKNormalMapFilter.m; sourceTree = "<group>"; };
-		B25598CB0D00D8B900BB825C /* WKPointLightFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKPointLightFilter.cikernel; sourceTree = "<group>"; };
-		B25598CC0D00D8B900BB825C /* WKPointLightFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKPointLightFilter.h; sourceTree = "<group>"; };
-		B25598CD0D00D8B900BB825C /* WKPointLightFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKPointLightFilter.m; sourceTree = "<group>"; };
-		B25598CE0D00D8B900BB825C /* WKSpecularLightingFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKSpecularLightingFilter.cikernel; sourceTree = "<group>"; };
-		B25598CF0D00D8B900BB825C /* WKSpecularLightingFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKSpecularLightingFilter.h; sourceTree = "<group>"; };
-		B25598D00D00D8B900BB825C /* WKSpecularLightingFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKSpecularLightingFilter.m; sourceTree = "<group>"; };
-		B25598D10D00D8B900BB825C /* WKSpotLightFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKSpotLightFilter.cikernel; sourceTree = "<group>"; };
-		B25598D20D00D8B900BB825C /* WKSpotLightFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKSpotLightFilter.h; sourceTree = "<group>"; };
-		B25598D30D00D8B900BB825C /* WKSpotLightFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKSpotLightFilter.m; sourceTree = "<group>"; };
-		B25598D40D00D8B900BB825C /* WKTableTransferFilter.cikernel */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = WKTableTransferFilter.cikernel; sourceTree = "<group>"; };
-		B25598D50D00D8B900BB825C /* WKTableTransferFilter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WKTableTransferFilter.h; sourceTree = "<group>"; };
-		B25598D60D00D8B900BB825C /* WKTableTransferFilter.m */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.objc; path = WKTableTransferFilter.m; sourceTree = "<group>"; };
 		B25598D70D00D8B900BB825C /* SVGDistantLightSource.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGDistantLightSource.h; sourceTree = "<group>"; };
 		B25598E00D00D8B900BB825C /* SVGFEConvolveMatrix.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFEConvolveMatrix.cpp; sourceTree = "<group>"; };
 		B25598E10D00D8B900BB825C /* SVGFEConvolveMatrix.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGFEConvolveMatrix.h; sourceTree = "<group>"; };
@@ -8195,14 +8101,10 @@
 		B25598F40D00D8B900BB825C /* SVGFETile.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGFETile.h; sourceTree = "<group>"; };
 		B25598F50D00D8B900BB825C /* SVGFETurbulence.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFETurbulence.cpp; sourceTree = "<group>"; };
 		B25598F60D00D8B900BB825C /* SVGFETurbulence.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGFETurbulence.h; sourceTree = "<group>"; };
-		B25598F70D00D8B900BB825C /* SVGFilterEffect.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFilterEffect.cpp; sourceTree = "<group>"; };
-		B25598F80D00D8B900BB825C /* SVGFilterEffect.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGFilterEffect.h; sourceTree = "<group>"; };
 		B25598F90D00D8B900BB825C /* SVGLightSource.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGLightSource.cpp; sourceTree = "<group>"; };
 		B25598FA0D00D8B900BB825C /* SVGLightSource.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGLightSource.h; sourceTree = "<group>"; };
 		B25598FB0D00D8B900BB825C /* SVGPointLightSource.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGPointLightSource.h; sourceTree = "<group>"; };
 		B25598FC0D00D8B900BB825C /* SVGSpotLightSource.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGSpotLightSource.h; sourceTree = "<group>"; };
-		B25598FE0D00D8B900BB825C /* SVGResourceFilterPlatformDataMac.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGResourceFilterPlatformDataMac.h; sourceTree = "<group>"; };
-		B25598FF0D00D8B900BB825C /* SVGResourceFilterPlatformDataMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = SVGResourceFilterPlatformDataMac.mm; sourceTree = "<group>"; };
 		B255990B0D00D8B900BB825C /* SVGImage.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGImage.cpp; sourceTree = "<group>"; };
 		B255990C0D00D8B900BB825C /* SVGImage.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGImage.h; sourceTree = "<group>"; };
 		B255990D0D00D8B900BB825C /* EmptyClients.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = EmptyClients.h; sourceTree = "<group>"; };
@@ -8229,7 +8131,6 @@
 		B25599220D00D8B900BB825C /* SVGResourceMarker.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGResourceMarker.h; sourceTree = "<group>"; };
 		B25599230D00D8B900BB825C /* SVGResourceMasker.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGResourceMasker.cpp; sourceTree = "<group>"; };
 		B25599240D00D8B900BB825C /* SVGResourceMasker.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGResourceMasker.h; sourceTree = "<group>"; };
-		B25BE50F0D06B70800B524C6 /* JSEventTargetBase.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSEventTargetBase.h; sourceTree = "<group>"; };
 		B25DFAAE0B2E2929000E6510 /* JSSVGMatrixCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGMatrixCustom.cpp; sourceTree = "<group>"; };
 		B262B8030D1F32D000158F09 /* SVGFont.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFont.cpp; sourceTree = "<group>"; };
 		B26554E80B80D74900A50EC3 /* RenderSVGTextPath.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGTextPath.cpp; sourceTree = "<group>"; };
@@ -8663,7 +8564,6 @@
 		BC02A53F0E099C5A004B6D2B /* CSSParserValues.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSParserValues.cpp; sourceTree = "<group>"; };
 		BC02A63B0E09A9CF004B6D2B /* CSSFunctionValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSFunctionValue.h; sourceTree = "<group>"; };
 		BC02A6450E09AAE9004B6D2B /* CSSFunctionValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSFunctionValue.cpp; sourceTree = "<group>"; };
-		BC066F6C09FEB2FA00C589A7 /* WebCoreTextRenderer.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebCoreTextRenderer.h; sourceTree = "<group>"; };
 		BC06ED040BFD5BAE00856E9D /* JSHTMLTableSectionElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLTableSectionElement.cpp; sourceTree = "<group>"; };
 		BC06ED050BFD5BAE00856E9D /* JSHTMLTableSectionElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLTableSectionElement.h; sourceTree = "<group>"; };
 		BC06ED990BFD660600856E9D /* JSHTMLTableColElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLTableColElement.cpp; sourceTree = "<group>"; };
@@ -8892,7 +8792,6 @@
 		BC6DADEE0A195FDF00E5CD14 /* WebFontCache.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebFontCache.h; sourceTree = "<group>"; };
 		BC6DADF90A19602B00E5CD14 /* WebFontCache.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = WebFontCache.mm; sourceTree = "<group>"; };
 		BC6DC7A00C1A4BFA004E2017 /* JSHTMLAllCollection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLAllCollection.h; sourceTree = "<group>"; };
-		BC6E2B190C04B93600444EF8 /* DOMHTMLDocumentPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLDocumentPrivate.h; sourceTree = "<group>"; };
 		BC76AC110DD7AD5C00415F34 /* ParserUtilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ParserUtilities.h; sourceTree = "<group>"; };
 		BC772B350C4EA91E0083285F /* CSSHelper.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSHelper.cpp; sourceTree = "<group>"; };
 		BC772B360C4EA91E0083285F /* CSSHelper.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSHelper.h; sourceTree = "<group>"; };
@@ -9000,7 +8899,6 @@
 		BCC573330D695BBE006EF517 /* DOMProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMProgressEvent.h; sourceTree = "<group>"; };
 		BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMProgressEvent.mm; sourceTree = "<group>"; };
 		BCC573370D695BD7006EF517 /* DOMProgressEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMProgressEventInternal.h; sourceTree = "<group>"; };
-		BCC573390D695BF1006EF517 /* DOMTextPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMTextPrivate.h; sourceTree = "<group>"; };
 		BCC5BDFE0C0E93110011C2DB /* JSCSSStyleSheet.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSCSSStyleSheet.cpp; sourceTree = "<group>"; };
 		BCC5BDFF0C0E93110011C2DB /* JSCSSStyleSheet.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCSSStyleSheet.h; sourceTree = "<group>"; };
 		BCC64F600DCFB84E0081EF3B /* English */ = {isa = PBXFileReference; fileEncoding = 10; lastKnownFileType = sourcecode.javascript; name = English; path = English.lproj/localizedStrings.js; sourceTree = SOURCE_ROOT; };
@@ -9136,13 +9034,11 @@
 		BCEFE1E40DCA5F3300739219 /* JSXSLTProcessorCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSXSLTProcessorCustom.cpp; sourceTree = "<group>"; };
 		BCEFE1E80DCA5F6400739219 /* JSXSLTProcessor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSXSLTProcessor.cpp; sourceTree = "<group>"; };
 		BCEFE1E90DCA5F6400739219 /* JSXSLTProcessor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSXSLTProcessor.h; sourceTree = "<group>"; };
-		BCF937E60E8B2E95005C7AB7 /* JSDOMWindowBase.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMWindowBase.lut.h; sourceTree = "<group>"; };
 		BCFB2E5D0979E46400BA703D /* CachedResourceClient.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CachedResourceClient.h; sourceTree = "<group>"; };
 		BCFB2F74097A2E1A00BA703D /* Arena.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Arena.cpp; sourceTree = "<group>"; };
 		BCFB2F75097A2E1A00BA703D /* Arena.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Arena.h; sourceTree = "<group>"; };
 		BCFE2F0F0C1B58370020235F /* JSRect.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSRect.cpp; sourceTree = "<group>"; };
 		BCFE2F100C1B58370020235F /* JSRect.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSRect.h; sourceTree = "<group>"; };
-		BCFE8E310A02A1D30009E61D /* WebCoreTextRenderer.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreTextRenderer.mm; sourceTree = "<group>"; };
 		BCFF648F0EAD15C200C1D6F7 /* LengthBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LengthBox.h; sourceTree = "<group>"; };
 		BCFF64900EAD15C200C1D6F7 /* LengthSize.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LengthSize.h; sourceTree = "<group>"; };
 		BE855F7F0701E83500239769 /* WebCoreView.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreView.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -9211,7 +9107,6 @@
 		E182568D0EF2B02D00933242 /* JSWorkerContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorkerContext.cpp; sourceTree = "<group>"; };
 		E182568E0EF2B02D00933242 /* JSWorkerContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWorkerContext.h; sourceTree = "<group>"; };
 		E18258AB0EF3CD7000933242 /* JSWorkerContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorkerContextCustom.cpp; sourceTree = "<group>"; };
-		E18259E60EF3E34B00933242 /* JSWorkerContextBase.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWorkerContextBase.lut.h; sourceTree = "<group>"; };
 		E1A302BB0DE8370300C52F2C /* StringBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringBuilder.h; sourceTree = "<group>"; };
 		E1A302C00DE8376900C52F2C /* StringBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringBuilder.cpp; sourceTree = "<group>"; };
 		E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageChannelCustom.cpp; sourceTree = "<group>"; };
@@ -9368,6 +9263,7 @@
 		FE6FD4860F676E5700092873 /* Coordinates.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Coordinates.idl; sourceTree = "<group>"; };
 		FE6FD48B0F676E9300092873 /* JSCoordinates.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCoordinates.cpp; sourceTree = "<group>"; };
 		FE6FD48C0F676E9300092873 /* JSCoordinates.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCoordinates.h; sourceTree = "<group>"; };
+		FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCoordinatesCustom.cpp; sourceTree = "<group>"; };
 		FE80D7A20E9C1ED2000D6F75 /* JSCustomPositionCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCustomPositionCallback.cpp; sourceTree = "<group>"; };
 		FE80D7A30E9C1ED2000D6F75 /* JSCustomPositionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCustomPositionCallback.h; sourceTree = "<group>"; };
 		FE80D7A40E9C1ED2000D6F75 /* JSCustomPositionErrorCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCustomPositionErrorCallback.cpp; sourceTree = "<group>"; };
@@ -9433,7 +9329,7 @@
 				EDEC98020AED7E170059137F /* WebCorePrefix.h */,
 				9307061309E0CA8200B17FE4 /* DerivedSources.make */,
 				93F19B1908245E59001E9ABC /* Info.plist */,
-				F58EF58E02DFDFB7018635CA /* WebCore.base.exp */,
+				29A812040FBB9B4100510293 /* accessibility */,
 				BC1A3790097C6F970019F3D8 /* bindings */,
 				1A569CC40D7E2B60007C3983 /* bridge */,
 				F523D18402DE42E8018635CA /* css */,
@@ -9457,6 +9353,7 @@
 				0867D69AFE84028FC02AAC07 /* Frameworks */,
 				034768DFFF38A50411DB9C8B /* Products */,
 				1CDD44660BA9C80000F90147 /* Configurations */,
+				449195900FBE175B00D9F824 /* Exports */,
 			);
 			name = WebKit;
 			sourceTree = "<group>";
@@ -9674,6 +9571,8 @@
 		1AE42F670AA4B8CB00C8612D /* cf */ = {
 			isa = PBXGroup;
 			children = (
+				938192020F87E1E600D5352A /* BinaryPropertyList.cpp */,
+				938192040F87E1EC00D5352A /* BinaryPropertyList.h */,
 				5160306B0CC4362300C8AC25 /* FileSystemCF.cpp */,
 				1A98956A0AA78F80005EF5EF /* KURLCFNet.cpp */,
 				1C63A2470F71646600C09D5A /* RunLoopTimerCF.cpp */,
@@ -9769,14 +9668,16 @@
 				1C81B9590E97330800266E07 /* front-end */,
 				41F0618D0F5F069800A07EAC /* ConsoleMessage.cpp */,
 				41F0618C0F5F069800A07EAC /* ConsoleMessage.h */,
-				41F062130F5F192600A07EAC /* InspectorDatabaseResource.cpp */,
-				41F062120F5F192600A07EAC /* InspectorDatabaseResource.h */,
-				41F061730F5F00AC00A07EAC /* InspectorDOMStorageResource.cpp */,
-				41F061720F5F00AC00A07EAC /* InspectorDOMStorageResource.h */,
 				1C81B9580E97330800266E07 /* InspectorClient.h */,
 				1C81B9570E97330800266E07 /* InspectorController.cpp */,
 				1C81B9560E97330800266E07 /* InspectorController.h */,
 				41F060AA0F5EE8BB00A07EAC /* InspectorController.idl */,
+				41F061730F5F00AC00A07EAC /* InspectorDOMStorageResource.cpp */,
+				41F061720F5F00AC00A07EAC /* InspectorDOMStorageResource.h */,
+				41F062130F5F192600A07EAC /* InspectorDatabaseResource.cpp */,
+				41F062120F5F192600A07EAC /* InspectorDatabaseResource.h */,
+				7AED3E030FBB1EAA00D2B03C /* InspectorFrontend.cpp */,
+				7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */,
 				41F062000F5F0B6600A07EAC /* InspectorResource.cpp */,
 				41F061FF0F5F0B6600A07EAC /* InspectorResource.h */,
 				1C81BA030E97348300266E07 /* JavaScriptCallFrame.cpp */,
@@ -9789,6 +9690,8 @@
 				1C81B9FD0E9733CB00266E07 /* JavaScriptProfile.h */,
 				1C81B9FC0E9733CB00266E07 /* JavaScriptProfileNode.cpp */,
 				1C81B9FB0E9733CB00266E07 /* JavaScriptProfileNode.h */,
+				7AB6F8850FB9D27100805D02 /* JSONObject.cpp */,
+				7AB6F8860FB9D27100805D02 /* JSONObject.h */,
 				BCC64F5F0DCFB84E0081EF3B /* localizedStrings.js */,
 			);
 			path = inspector;
@@ -9801,6 +9704,7 @@
 			children = (
 				1CDD45E60BA9C84600F90147 /* Base.xcconfig */,
 				1CDD45E40BA9C84600F90147 /* DebugRelease.xcconfig */,
+				449098B10F8F82520076A327 /* FeatureDefines.xcconfig */,
 				1C904DF90BA9D2C80081E9D0 /* Version.xcconfig */,
 				1CDD45E50BA9C84600F90147 /* WebCore.xcconfig */,
 			);
@@ -9809,9 +9713,59 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		29A812040FBB9B4100510293 /* accessibility */ = {
+			isa = PBXGroup;
+			children = (
+				29A812050FBB9B5200510293 /* mac */,
+				29A8120A0FBB9C1D00510293 /* AccessibilityARIAGrid.cpp */,
+				29A812160FBB9C1D00510293 /* AccessibilityARIAGrid.h */,
+				29A812120FBB9C1D00510293 /* AccessibilityARIAGridCell.cpp */,
+				29A812100FBB9C1D00510293 /* AccessibilityARIAGridCell.h */,
+				29A8120F0FBB9C1D00510293 /* AccessibilityARIAGridRow.cpp */,
+				29A812150FBB9C1D00510293 /* AccessibilityARIAGridRow.h */,
+				29A8121C0FBB9C1D00510293 /* AccessibilityImageMapLink.cpp */,
+				29A8121D0FBB9C1D00510293 /* AccessibilityImageMapLink.h */,
+				29A812110FBB9C1D00510293 /* AccessibilityList.cpp */,
+				29A8120E0FBB9C1D00510293 /* AccessibilityList.h */,
+				29A812200FBB9C1D00510293 /* AccessibilityListBox.cpp */,
+				29A812250FBB9C1D00510293 /* AccessibilityListBox.h */,
+				29A8121F0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp */,
+				29A812240FBB9C1D00510293 /* AccessibilityListBoxOption.h */,
+				29A8121E0FBB9C1D00510293 /* AccessibilityObject.cpp */,
+				29A812180FBB9C1D00510293 /* AccessibilityObject.h */,
+				29A812080FBB9C1D00510293 /* AccessibilityRenderObject.cpp */,
+				29A8121B0FBB9C1D00510293 /* AccessibilityRenderObject.h */,
+				29A812090FBB9C1D00510293 /* AccessibilityTable.cpp */,
+				29A8120D0FBB9C1D00510293 /* AccessibilityTable.h */,
+				29A8120C0FBB9C1D00510293 /* AccessibilityTableCell.cpp */,
+				29A812140FBB9C1D00510293 /* AccessibilityTableCell.h */,
+				29A812170FBB9C1D00510293 /* AccessibilityTableColumn.cpp */,
+				29A812230FBB9C1D00510293 /* AccessibilityTableColumn.h */,
+				29A812220FBB9C1D00510293 /* AccessibilityTableHeaderContainer.cpp */,
+				29A812210FBB9C1D00510293 /* AccessibilityTableHeaderContainer.h */,
+				29A8120B0FBB9C1D00510293 /* AccessibilityTableRow.cpp */,
+				29A812130FBB9C1D00510293 /* AccessibilityTableRow.h */,
+				29A812190FBB9C1D00510293 /* AXObjectCache.cpp */,
+				29A8121A0FBB9C1D00510293 /* AXObjectCache.h */,
+			);
+			path = accessibility;
+			sourceTree = "<group>";
+		};
+		29A812050FBB9B5200510293 /* mac */ = {
+			isa = PBXGroup;
+			children = (
+				29A812440FBB9CA900510293 /* AccessibilityObjectMac.mm */,
+				29A812460FBB9CA900510293 /* AccessibilityObjectWrapper.mm */,
+				29A812450FBB9CA900510293 /* AccessibilityObjectWrapper.h */,
+				29A812470FBB9CA900510293 /* AXObjectCacheMac.mm */,
+			);
+			path = mac;
+			sourceTree = "<group>";
+		};
 		2E4346310F546A6800B0F1BA /* workers */ = {
 			isa = PBXGroup;
 			children = (
+				18F831B70FD48C7800D8C56B /* WorkerLoaderProxy.h */,
 				2E4346320F546A8200B0F1BA /* GenericWorkerTask.h */,
 				2E4346330F546A8200B0F1BA /* Worker.cpp */,
 				2E4346340F546A8200B0F1BA /* Worker.h */,
@@ -9820,6 +9774,8 @@
 				2E4346370F546A8200B0F1BA /* WorkerContext.h */,
 				2E4346380F546A8200B0F1BA /* WorkerContext.idl */,
 				2E4346390F546A8200B0F1BA /* WorkerContextProxy.h */,
+				A7D6B3480F61104500B79FD1 /* WorkerImportScriptsClient.cpp */,
+				A7D6B3470F61104500B79FD1 /* WorkerImportScriptsClient.h */,
 				2E43463A0F546A8200B0F1BA /* WorkerLocation.cpp */,
 				2E43463B0F546A8200B0F1BA /* WorkerLocation.h */,
 				2E43463C0F546A8200B0F1BA /* WorkerLocation.idl */,
@@ -9830,8 +9786,6 @@
 				2E4346410F546A8200B0F1BA /* WorkerRunLoop.h */,
 				2E4346420F546A8200B0F1BA /* WorkerThread.cpp */,
 				2E4346430F546A8200B0F1BA /* WorkerThread.h */,
-				A7D6B3470F61104500B79FD1 /* WorkerImportScriptsClient.h */,
-				A7D6B3480F61104500B79FD1 /* WorkerImportScriptsClient.cpp */,
 			);
 			name = workers;
 			sourceTree = "<group>";
@@ -9854,6 +9808,24 @@
 			name = animation;
 			sourceTree = "<group>";
 		};
+		449195900FBE175B00D9F824 /* Exports */ = {
+			isa = PBXGroup;
+			children = (
+				4491959D0FBE17D700D9F824 /* WebCore.DashboardSupport.exp */,
+				4491959C0FBE17D700D9F824 /* WebCore.JNI.exp */,
+				4491959B0FBE17D700D9F824 /* WebCore.LP64.exp */,
+				4491959A0FBE17D700D9F824 /* WebCore.NPAPI.exp */,
+				449195990FBE17D700D9F824 /* WebCore.SVG.Animation.exp */,
+				449195970FBE17D700D9F824 /* WebCore.SVG.Filters.exp */,
+				449195960FBE17D700D9F824 /* WebCore.SVG.ForeignObject.exp */,
+				449195980FBE17D700D9F824 /* WebCore.SVG.exp */,
+				449195950FBE17D700D9F824 /* WebCore.Tiger.exp */,
+				449195940FBE17D700D9F824 /* WebCore.VideoProxy.exp */,
+				F58EF58E02DFDFB7018635CA /* WebCore.base.exp */,
+			);
+			name = Exports;
+			sourceTree = "<group>";
+		};
 		49E911B20EF86D27009D0CAF /* transforms */ = {
 			isa = PBXGroup;
 			children = (
@@ -9956,6 +9928,8 @@
 				08807B710ED709AB003F6975 /* WMLPrevElement.h */,
 				08807B720ED709AB003F6975 /* WMLRefreshElement.cpp */,
 				08807B730ED709AB003F6975 /* WMLRefreshElement.h */,
+				082341C30FCF3A9400D75BD6 /* WMLSelectElement.cpp */,
+				082341C40FCF3A9400D75BD6 /* WMLSelectElement.h */,
 				08807B740ED709AB003F6975 /* WMLSetvarElement.cpp */,
 				08807B750ED709AB003F6975 /* WMLSetvarElement.h */,
 				08820BDC0EF5D381009099A8 /* WMLTableElement.cpp */,
@@ -10035,6 +10009,7 @@
 		51741D080B07257000ED442C /* history */ = {
 			isa = PBXGroup;
 			children = (
+				9363B6290F8E8FE000803810 /* cf */,
 				5160F4920B0AA71500C1D2AF /* mac */,
 				51741D0C0B07259A00ED442C /* BackForwardList.cpp */,
 				51741D0B0B07259A00ED442C /* BackForwardList.h */,
@@ -10204,8 +10179,8 @@
 				935C476C09AC4D6300A6AAB4 /* FoundationExtras.h */,
 				BCE494A90F4F5E9E0084E319 /* GeolocationServiceMac.h */,
 				BCE494AA0F4F5E9E0084E319 /* GeolocationServiceMac.mm */,
-				935C476E09AC4D7300A6AAB4 /* KeyEventMac.mm */,
 				6593923909AE435C002C531F /* KURLMac.mm */,
+				935C476E09AC4D7300A6AAB4 /* KeyEventMac.mm */,
 				9352084409BD43B900F2038D /* Language.mm */,
 				06E81ED60AB5D5E900C87837 /* LocalCurrentGraphicsContext.h */,
 				06E81EEB0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm */,
@@ -10218,17 +10193,20 @@
 				BC94D1070C274F88006BC617 /* PlatformScreenMac.mm */,
 				0668E18E0ADD9640004128E0 /* PopupMenuMac.mm */,
 				E4D687760ED7AE3D006EA978 /* PurgeableBufferMac.cpp */,
+				447D69010FA626810015CCB1 /* RuntimeApplicationChecks.h */,
+				447D69020FA626810015CCB1 /* RuntimeApplicationChecks.mm */,
+				84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.mm */,
 				1CE24F960D7CAF0E007E04C2 /* SchedulePairMac.mm */,
+				9353676A09AED88B00D35CD6 /* ScrollViewMac.mm */,
 				BCAA90C20A7EBA60008B1229 /* Scrollbar.cpp */,
 				BC8B853C0E7C7F1100AB6984 /* ScrollbarThemeMac.h */,
 				BCEF869E0E844E9D00A85CD5 /* ScrollbarThemeMac.mm */,
-				9353676A09AED88B00D35CD6 /* ScrollViewMac.mm */,
 				AB71709F0B31193B0017123E /* SearchPopupMenuMac.mm */,
 				1A4A95510B4EDCFF002D8C3C /* SharedBufferMac.mm */,
 				93309E9F099EB78C0056E581 /* SharedTimerMac.mm */,
 				0A4844980CA44CB200B7BD48 /* SoftLinking.h */,
 				4B3043C80AE0371D00A82647 /* SoundMac.mm */,
-				84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.mm */,
+				93B2D8170F9920EE006AE6B2 /* SuddenTermination.mm */,
 				6582A15509999D6D00BEEB6D /* SystemTimeMac.cpp */,
 				BCE659E50EA92FB2007E4533 /* ThemeMac.h */,
 				BCE659E80EA92FFA007E4533 /* ThemeMac.mm */,
@@ -10241,8 +10219,6 @@
 				B50F5B800E96CD9900AD71A6 /* WebCoreObjCExtras.mm */,
 				93EB169609F880C00091F8FF /* WebCoreSystemInterface.h */,
 				93EB169409F880B00091F8FF /* WebCoreSystemInterface.mm */,
-				BC066F6C09FEB2FA00C589A7 /* WebCoreTextRenderer.h */,
-				BCFE8E310A02A1D30009E61D /* WebCoreTextRenderer.mm */,
 				BE855F7F0701E83500239769 /* WebCoreView.h */,
 				BE8560510701F91100239769 /* WebCoreView.m */,
 				BC6DADEE0A195FDF00E5CD14 /* WebFontCache.h */,
@@ -10258,31 +10234,7 @@
 			children = (
 				316FE1060E6E1D8400BF6088 /* animation */,
 				93C09A820B064F05005ABD4D /* mac */,
-				4B24F9A70DA7050B00269E58 /* AXObjectCache.cpp */,
-				1AF326760D78B9440068F0C4 /* AXObjectCache.h */,
 				8538F0000AD71770006A81D1 /* AbstractView.idl */,
-				2955BE2B0E2548EC00893AB5 /* AccessibilityImageMapLink.cpp */,
-				2955BE2A0E2548EC00893AB5 /* AccessibilityImageMapLink.h */,
-				29FFBB800E7C5A3D00407730 /* AccessibilityList.cpp */,
-				29FFBB810E7C5A3D00407730 /* AccessibilityList.h */,
-				2999869D0DD0DEEA00F8D261 /* AccessibilityListBox.cpp */,
-				2999869C0DD0DEEA00F8D261 /* AccessibilityListBox.h */,
-				2999869B0DD0DEEA00F8D261 /* AccessibilityListBoxOption.cpp */,
-				2999869A0DD0DEEA00F8D261 /* AccessibilityListBoxOption.h */,
-				4B5B7C8D0D945CFA00DDF3AB /* AccessibilityObject.cpp */,
-				4B17CBC80D945B370053F183 /* AccessibilityObject.h */,
-				299984BB0DC8598500F8D261 /* AccessibilityRenderObject.cpp */,
-				299984BC0DC8598500F8D261 /* AccessibilityRenderObject.h */,
-				29800C3A0E522A5300025536 /* AccessibilityTable.cpp */,
-				29800C390E522A5300025536 /* AccessibilityTable.h */,
-				29AAC36C0E534E86008F9B3B /* AccessibilityTableCell.cpp */,
-				29AAC36B0E534E86008F9B3B /* AccessibilityTableCell.h */,
-				29800C980E524DA500025536 /* AccessibilityTableColumn.cpp */,
-				29800C970E524DA500025536 /* AccessibilityTableColumn.h */,
-				29AAC51E0E53963B008F9B3B /* AccessibilityTableHeaderContainer.cpp */,
-				29AAC51D0E53963B008F9B3B /* AccessibilityTableHeaderContainer.h */,
-				29800C940E524C8B00025536 /* AccessibilityTableRow.cpp */,
-				29800C930E524C8B00025536 /* AccessibilityTableRow.h */,
 				BC124EE40C2641CD009E2349 /* BarInfo.cpp */,
 				BC124EE50C2641CD009E2349 /* BarInfo.h */,
 				BC124EE60C2641CD009E2349 /* BarInfo.idl */,
@@ -10346,6 +10298,8 @@
 				65A21467097A329100B9050A /* Page.h */,
 				9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */,
 				9302B0BE0D79F82C00C7EE83 /* PageGroup.h */,
+				7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */,
+				7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */,
 				FE80D7BD0E9C1F25000D6F75 /* PositionCallback.h */,
 				FE80D7BE0E9C1F25000D6F75 /* PositionCallback.idl */,
 				FE80D7BF0E9C1F25000D6F75 /* PositionError.h */,
@@ -10400,7 +10354,6 @@
 			children = (
 				8538F0580AD722F1006A81D1 /* DOMRange.h */,
 				8538F0590AD722F1006A81D1 /* DOMRange.mm */,
-				85C320780AD7401500BC15C4 /* DOMRangePrivate.h */,
 			);
 			name = Ranges;
 			sourceTree = "<group>";
@@ -10442,7 +10395,6 @@
 				854075250AD6C66700620C57 /* DOMNodeFilter.h */,
 				85526C350AB0A17E000302EA /* DOMNodeIterator.h */,
 				85526C360AB0A17E000302EA /* DOMNodeIterator.mm */,
-				85526C3D0AB0A76F000302EA /* DOMNodeIteratorPrivate.h */,
 				85526CD00AB0B7D9000302EA /* DOMTreeWalker.h */,
 				85526CD10AB0B7D9000302EA /* DOMTreeWalker.mm */,
 			);
@@ -10474,12 +10426,10 @@
 				85ACABAF0A9CAF8000671E90 /* DOMDocument.mm */,
 				85089CD30A98C42800A275AA /* DOMDocumentFragment.h */,
 				85089CD40A98C42800A275AA /* DOMDocumentFragment.mm */,
-				1CFCEEB20AACC4A200348750 /* DOMDocumentPrivate.h */,
 				85CA975A0A962E5400690CCF /* DOMDocumentType.h */,
 				85CA975B0A962E5400690CCF /* DOMDocumentType.mm */,
 				85ACA9BE0A9B5FA500671E90 /* DOMElement.h */,
 				85ACA9BF0A9B5FA500671E90 /* DOMElement.mm */,
-				1CFCEEB30AACC4A200348750 /* DOMElementPrivate.h */,
 				85CA96B60A9621A600690CCF /* DOMEntity.h */,
 				85CA96B70A9621A600690CCF /* DOMEntity.mm */,
 				85089CD50A98C42800A275AA /* DOMEntityReference.h */,
@@ -10490,15 +10440,12 @@
 				853BF4DA0ABB6B55008647BB /* DOMNode.mm */,
 				85ACAA890A9B759C00671E90 /* DOMNodeList.h */,
 				85ACAA8A0A9B759C00671E90 /* DOMNodeList.mm */,
-				853BF4EA0ABB6E97008647BB /* DOMNodePrivate.h */,
 				85CA96E80A9624E900690CCF /* DOMNotation.h */,
 				85CA96E90A9624E900690CCF /* DOMNotation.mm */,
 				85F56A780A98CE3700ADB60A /* DOMProcessingInstruction.h */,
 				85F56A790A98CE3700ADB60A /* DOMProcessingInstruction.mm */,
-				1CFCEECA0AACC5F400348750 /* DOMProcessingInstructionPrivate.h */,
 				85ACA99A0A9B575900671E90 /* DOMText.h */,
 				85ACA99B0A9B575900671E90 /* DOMText.mm */,
-				BCC573390D695BF1006EF517 /* DOMTextPrivate.h */,
 			);
 			name = Core;
 			sourceTree = "<group>";
@@ -10528,7 +10475,6 @@
 				85032DD40AA8C9BE007D3B7D /* DOMCSSStyleRule.mm */,
 				858C39260AA8FF9D00B187A4 /* DOMCSSStyleSheet.h */,
 				858C39270AA8FF9D00B187A4 /* DOMCSSStyleSheet.mm */,
-				4429AAEA0CB84DC7007647C5 /* DOMCSSStyleSheetPrivate.h */,
 				85032DD50AA8C9BE007D3B7D /* DOMCSSUnknownRule.h */,
 				85032DD60AA8C9BE007D3B7D /* DOMCSSUnknownRule.mm */,
 				858C381A0AA8E29600B187A4 /* DOMCSSValue.h */,
@@ -11015,18 +10961,15 @@
 				85AFA8200AAF528A00E84305 /* DOMEvent.h */,
 				85AFA8210AAF528A00E84305 /* DOMEvent.mm */,
 				85D2AD670AB1A40A00C313EA /* DOMEventListener.h */,
-				4429AAF80CB84E5F007647C5 /* DOMEventPrivate.h */,
 				8540751F0AD6C5FB00620C57 /* DOMEventTarget.h */,
 				85FF31580AAFBFCB00374F38 /* DOMKeyboardEvent.h */,
 				85FF31590AAFBFCB00374F38 /* DOMKeyboardEvent.mm */,
-				85DF343F0AAFC0ED00E59AE3 /* DOMKeyboardEventPrivate.h */,
 				75793ED00D0CE85B007FC0AC /* DOMMessageEvent.h */,
 				75793ED10D0CE85B007FC0AC /* DOMMessageEvent.mm */,
 				E1ACAF4B0E791AAF0087D12B /* DOMMessagePort.h */,
 				E1ACAF4A0E791AAF0087D12B /* DOMMessagePort.mm */,
 				857E0B230AB043460036E447 /* DOMMouseEvent.h */,
 				857E0B240AB043460036E447 /* DOMMouseEvent.mm */,
-				857E0B2B0AB043FC0036E447 /* DOMMouseEventPrivate.h */,
 				85C7F5BC0AAFB7CC004014DD /* DOMMutationEvent.h */,
 				85C7F5BD0AAFB7CC004014DD /* DOMMutationEvent.mm */,
 				85C7F5CE0AAFB8D9004014DD /* DOMOverflowEvent.h */,
@@ -11037,7 +10980,6 @@
 				933A14A90B7D1D0900A53FFD /* DOMTextEvent.mm */,
 				85C7F48F0AAF79DC004014DD /* DOMUIEvent.h */,
 				85C7F4900AAF79DC004014DD /* DOMUIEvent.mm */,
-				85C7F4C20AAF8081004014DD /* DOMUIEventPrivate.h */,
 				31C0FF430E4CEFDD007D6FE5 /* DOMWebKitAnimationEvent.h */,
 				31C0FF440E4CEFDD007D6FE5 /* DOMWebKitAnimationEvent.mm */,
 				31C0FF450E4CEFDD007D6FE5 /* DOMWebKitAnimationEventInternal.h */,
@@ -11046,7 +10988,6 @@
 				31C0FF480E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h */,
 				85C7F5E50AAFBAFB004014DD /* DOMWheelEvent.h */,
 				85C7F5E60AAFBAFB004014DD /* DOMWheelEvent.mm */,
-				85FF313B0AAFBD7200374F38 /* DOMWheelEventPrivate.h */,
 			);
 			name = Events;
 			sourceTree = "<group>";
@@ -11079,12 +11020,10 @@
 				BC00F0020E0A185500FD04E3 /* DOMFileList.mm */,
 				85DF81210AA7787200486AD7 /* DOMHTMLAnchorElement.h */,
 				85DF81220AA7787200486AD7 /* DOMHTMLAnchorElement.mm */,
-				1CFCEE7F0AACC3B300348750 /* DOMHTMLAnchorElementPrivate.h */,
 				854075640AD6CBF900620C57 /* DOMHTMLAppletElement.h */,
 				85C050B80AD84F5E005532E7 /* DOMHTMLAppletElement.mm */,
 				85ECBEDD0AA7626800544F0B /* DOMHTMLAreaElement.h */,
 				85ECBEDE0AA7626800544F0B /* DOMHTMLAreaElement.mm */,
-				1CFCEE880AACC3C000348750 /* DOMHTMLAreaElementPrivate.h */,
 				85183B380AA6926100F19FA3 /* DOMHTMLBRElement.h */,
 				85183B390AA6926100F19FA3 /* DOMHTMLBRElement.mm */,
 				859A9C3D0AA5E3BD00B694B2 /* DOMHTMLBaseElement.h */,
@@ -11093,16 +11032,12 @@
 				85ECBEE00AA7626800544F0B /* DOMHTMLBaseFontElement.mm */,
 				859A9C3F0AA5E3BD00B694B2 /* DOMHTMLBodyElement.h */,
 				859A9C400AA5E3BD00B694B2 /* DOMHTMLBodyElement.mm */,
-				1CFCEE8D0AACC3CD00348750 /* DOMHTMLBodyElementPrivate.h */,
 				85BA4CD50AA6861B0088052D /* DOMHTMLButtonElement.h */,
 				85BA4CD60AA6861B0088052D /* DOMHTMLButtonElement.mm */,
-				1CFCEE8E0AACC3CD00348750 /* DOMHTMLButtonElementPrivate.h */,
-				93F9B6530BA0F35E00854064 /* DOMHTMLCanvasElement.h */,
+				93D3C1580F97A9D70053C013 /* DOMHTMLCanvasElement.h */,
 				93F9B6540BA0F35E00854064 /* DOMHTMLCanvasElement.mm */,
-				93F9B6550BA0F35E00854064 /* DOMHTMLCanvasElementInternal.h */,
 				85DF2F8C0AA3C88100AD64C5 /* DOMHTMLCollection.h */,
 				85DF2F8D0AA3C88100AD64C5 /* DOMHTMLCollection.mm */,
-				4429AAF10CB84E35007647C5 /* DOMHTMLCollectionPrivate.h */,
 				85BA4D010AA688680088052D /* DOMHTMLDListElement.h */,
 				85BA4D020AA688680088052D /* DOMHTMLDListElement.mm */,
 				85BA4CFD0AA688680088052D /* DOMHTMLDirectoryElement.h */,
@@ -11111,7 +11046,6 @@
 				85BA4D000AA688680088052D /* DOMHTMLDivElement.mm */,
 				85BCBC110ABBA87D00381160 /* DOMHTMLDocument.h */,
 				85BCBC120ABBA87D00381160 /* DOMHTMLDocument.mm */,
-				BC6E2B190C04B93600444EF8 /* DOMHTMLDocumentPrivate.h */,
 				85DF2EEB0AA387CB00AD64C5 /* DOMHTMLElement.h */,
 				85DF2EEC0AA387CB00AD64C5 /* DOMHTMLElement.mm */,
 				854075650AD6CBF900620C57 /* DOMHTMLEmbedElement.h */,
@@ -11123,7 +11057,6 @@
 				85ECBEE20AA7626800544F0B /* DOMHTMLFontElement.mm */,
 				85DF2C100AA341F600AD64C5 /* DOMHTMLFormElement.h */,
 				85DF2C110AA341F600AD64C5 /* DOMHTMLFormElement.mm */,
-				85B916830AEBDB47008DD727 /* DOMHTMLFormElementPrivate.h */,
 				85DF818D0AA77E4B00486AD7 /* DOMHTMLFrameElement.h */,
 				85DF818E0AA77E4B00486AD7 /* DOMHTMLFrameElement.mm */,
 				BC5156F30C03B7DC008BB0EE /* DOMHTMLFrameElementPrivate.h */,
@@ -11142,10 +11075,8 @@
 				4429AAFD0CB84EA5007647C5 /* DOMHTMLIFrameElementPrivate.h */,
 				85DF81230AA7787200486AD7 /* DOMHTMLImageElement.h */,
 				85DF81240AA7787200486AD7 /* DOMHTMLImageElement.mm */,
-				1CFCEE8F0AACC3CD00348750 /* DOMHTMLImageElementPrivate.h */,
 				85F32AE40AA63B8700FF3184 /* DOMHTMLInputElement.h */,
 				85F32AE50AA63B8700FF3184 /* DOMHTMLInputElement.mm */,
-				1CFCEEF90AACC79000348750 /* DOMHTMLInputElementPrivate.h */,
 				859A9C410AA5E3BD00B694B2 /* DOMHTMLIsIndexElement.h */,
 				859A9C420AA5E3BD00B694B2 /* DOMHTMLIsIndexElement.mm */,
 				85BA4D030AA688680088052D /* DOMHTMLLIElement.h */,
@@ -11156,7 +11087,6 @@
 				85BA4CDC0AA6861B0088052D /* DOMHTMLLegendElement.mm */,
 				85992EB60AA5069500AC0785 /* DOMHTMLLinkElement.h */,
 				85992EB70AA5069500AC0785 /* DOMHTMLLinkElement.mm */,
-				1CFCEE920AACC3CD00348750 /* DOMHTMLLinkElementPrivate.h */,
 				85ECBEE50AA7626800544F0B /* DOMHTMLMapElement.h */,
 				85ECBEE60AA7626800544F0B /* DOMHTMLMapElement.mm */,
 				BC5156E50C03B741008BB0EE /* DOMHTMLMarqueeElement.h */,
@@ -11179,24 +11109,20 @@
 				854075680AD6CBF900620C57 /* DOMHTMLOptionElementInternal.h */,
 				85DF2F990AA3CAE500AD64C5 /* DOMHTMLOptionsCollection.h */,
 				85DF2F9A0AA3CAE500AD64C5 /* DOMHTMLOptionsCollection.mm */,
-				1CFCEED40AACC65D00348750 /* DOMHTMLOptionsCollectionPrivate.h */,
 				85183B3C0AA6926100F19FA3 /* DOMHTMLParagraphElement.h */,
 				85183B3D0AA6926100F19FA3 /* DOMHTMLParagraphElement.mm */,
 				85ECBEE90AA7626900544F0B /* DOMHTMLParamElement.h */,
 				85ECBEEA0AA7626900544F0B /* DOMHTMLParamElement.mm */,
 				85183B3E0AA6926100F19FA3 /* DOMHTMLPreElement.h */,
 				85183B3F0AA6926100F19FA3 /* DOMHTMLPreElement.mm */,
-				1CFCEEDA0AACC68300348750 /* DOMHTMLPreElementPrivate.h */,
 				85183B400AA6926100F19FA3 /* DOMHTMLQuoteElement.h */,
 				85183B410AA6926100F19FA3 /* DOMHTMLQuoteElement.mm */,
 				85DF81930AA77E4B00486AD7 /* DOMHTMLScriptElement.h */,
 				85DF81940AA77E4B00486AD7 /* DOMHTMLScriptElement.mm */,
 				85F32AE80AA63B8700FF3184 /* DOMHTMLSelectElement.h */,
 				85F32AE90AA63B8700FF3184 /* DOMHTMLSelectElement.mm */,
-				4429AB010CB84ED8007647C5 /* DOMHTMLSelectElementPrivate.h */,
 				859A9C450AA5E3BD00B694B2 /* DOMHTMLStyleElement.h */,
 				859A9C460AA5E3BD00B694B2 /* DOMHTMLStyleElement.mm */,
-				1CFCEE940AACC3CD00348750 /* DOMHTMLStyleElementPrivate.h */,
 				85DF82130AA7849E00486AD7 /* DOMHTMLTableCaptionElement.h */,
 				85DF82140AA7849E00486AD7 /* DOMHTMLTableCaptionElement.mm */,
 				85DF82150AA7849E00486AD7 /* DOMHTMLTableCellElement.h */,
@@ -11211,7 +11137,6 @@
 				85DF821C0AA7849E00486AD7 /* DOMHTMLTableSectionElement.mm */,
 				85F32AEA0AA63B8700FF3184 /* DOMHTMLTextAreaElement.h */,
 				85F32AEB0AA63B8700FF3184 /* DOMHTMLTextAreaElement.mm */,
-				1CFCEE950AACC3CD00348750 /* DOMHTMLTextAreaElementPrivate.h */,
 				85992EB80AA5069500AC0785 /* DOMHTMLTitleElement.h */,
 				85992EB90AA5069500AC0785 /* DOMHTMLTitleElement.mm */,
 				85BA4D090AA688680088052D /* DOMHTMLUListElement.h */,
@@ -11263,6 +11188,7 @@
 				85E7114F0AC5D5340053270F /* DOMHTMLBaseFontElementInternal.h */,
 				85E711500AC5D5340053270F /* DOMHTMLBodyElementInternal.h */,
 				85E711520AC5D5340053270F /* DOMHTMLButtonElementInternal.h */,
+				93F9B6550BA0F35E00854064 /* DOMHTMLCanvasElementInternal.h */,
 				85E711530AC5D5340053270F /* DOMHTMLCollectionInternal.h */,
 				85E711560AC5D5340053270F /* DOMHTMLDListElementInternal.h */,
 				85E711540AC5D5340053270F /* DOMHTMLDirectoryElementInternal.h */,
@@ -11536,6 +11462,8 @@
 				93309DB6099E64910056E581 /* RemoveNodeCommand.h */,
 				93309DB7099E64910056E581 /* RemoveNodePreservingChildrenCommand.cpp */,
 				93309DB8099E64910056E581 /* RemoveNodePreservingChildrenCommand.h */,
+				A89CCC500F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp */,
+				A89CCC510F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h */,
 				93309DBA099E64910056E581 /* ReplaceSelectionCommand.cpp */,
 				93309DBB099E64910056E581 /* ReplaceSelectionCommand.h */,
 				93309DBE099E64910056E581 /* SelectionController.cpp */,
@@ -11577,6 +11505,15 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		9363B6290F8E8FE000803810 /* cf */ = {
+			isa = PBXGroup;
+			children = (
+				9363B62A0F8E8FE000803810 /* HistoryPropertyList.cpp */,
+				9363B62B0F8E8FE000803810 /* HistoryPropertyList.h */,
+			);
+			path = cf;
+			sourceTree = "<group>";
+		};
 		93A1EAA20A5634D8006960A0 /* mac */ = {
 			isa = PBXGroup;
 			children = (
@@ -11591,10 +11528,6 @@
 		93C09A820B064F05005ABD4D /* mac */ = {
 			isa = PBXGroup;
 			children = (
-				1AF326400D78B5530068F0C4 /* AXObjectCacheMac.mm */,
-				2951A2AD0E646C8800DB9ADE /* AccessibilityObjectMac.mm */,
-				4B17CBCB0D945B910053F183 /* AccessibilityObjectWrapper.h */,
-				4B17CBCA0D945B910053F183 /* AccessibilityObjectWrapper.mm */,
 				ABAF22070C03B1C700B0BCF0 /* ChromeMac.mm */,
 				A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */,
 				93C09A7E0B064EEF005ABD4D /* EventHandlerMac.mm */,
@@ -11627,6 +11560,9 @@
 				930CAAD609C495B600229C04 /* CanvasRenderingContext2D.idl */,
 				93EEC27009C3218800C515D1 /* CanvasStyle.cpp */,
 				93EEC1EF09C2877700C515D1 /* CanvasStyle.h */,
+				93C441ED0F813A1A00C1A634 /* CollectionCache.cpp */,
+				93C441EE0F813A1A00C1A634 /* CollectionCache.h */,
+				93C441FF0F813AE100C1A634 /* CollectionType.h */,
 				BCDBB8CC0E08958400C60FF6 /* File.cpp */,
 				BCDBB8CB0E08958400C60FF6 /* File.h */,
 				BC1881D90E08C4ED00048C13 /* File.idl */,
@@ -11798,6 +11734,7 @@
 				F523D25102DE4396018635CA /* HTMLParser.h */,
 				BC588B4A0BFA723C00EE679E /* HTMLParserErrorCodes.cpp */,
 				BC588AEF0BFA6CF900EE679E /* HTMLParserErrorCodes.h */,
+				449B19F30FA72ECE0015CA4A /* HTMLParserQuirks.h */,
 				A871D44D0A127CBC00B12A68 /* HTMLPlugInElement.cpp */,
 				A871D44C0A127CBC00B12A68 /* HTMLPlugInElement.h */,
 				4415292D0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.cpp */,
@@ -11882,6 +11819,11 @@
 		A75E8B7F0E1DE2B0007F2481 /* filters */ = {
 			isa = PBXGroup;
 			children = (
+				845E72F70FD261EE00A87D79 /* Filter.h */,
+				84A81F3F0FC7E02700955300 /* SourceGraphic.cpp */,
+				84A81F400FC7E02700955300 /* SourceGraphic.h */,
+				84A81F3B0FC7DFF000955300 /* SourceAlpha.cpp */,
+				84A81F3C0FC7DFF000955300 /* SourceAlpha.h */,
 				A75E8B800E1DE2D6007F2481 /* FEBlend.cpp */,
 				A75E8B810E1DE2D6007F2481 /* FEBlend.h */,
 				A75E8B820E1DE2D6007F2481 /* FEColorMatrix.cpp */,
@@ -11890,6 +11832,8 @@
 				A75E8B850E1DE2D6007F2481 /* FEComponentTransfer.h */,
 				A75E8B860E1DE2D6007F2481 /* FEComposite.cpp */,
 				A75E8B870E1DE2D6007F2481 /* FEComposite.h */,
+				08C925170FCC7C4A00480DEC /* FilterEffect.cpp */,
+				08C925180FCC7C4A00480DEC /* FilterEffect.h */,
 			);
 			name = filters;
 			sourceTree = "<group>";
@@ -12555,11 +12499,6 @@
 				B22277CC0D00BF1F0071B782 /* ColorDistance.h */,
 				E415F1830D9A1A830033CE97 /* ElementTimeControl.h */,
 				E415F10C0D9A05870033CE97 /* ElementTimeControl.idl */,
-				50A5E4710E1AEF3A000A03AE /* Filter.cpp */,
-				50A5DF730E1A13C9000A03AE /* Filter.h */,
-				50A5DF740E1A13C9000A03AE /* FilterBuilder.h */,
-				50A5E4730E1AEF84000A03AE /* FilterEffect.cpp */,
-				50A5E20F0E1ABAF2000A03AE /* FilterEffect.h */,
 				B22277CD0D00BF1F0071B782 /* GradientAttributes.h */,
 				B22277CE0D00BF1F0071B782 /* LinearGradientAttributes.h */,
 				B22277DB0D00BF1F0071B782 /* PatternAttributes.h */,
@@ -12987,9 +12926,7 @@
 		B25598860D00D8B800BB825C /* graphics */ = {
 			isa = PBXGroup;
 			children = (
-				B255988F0D00D8B800BB825C /* cg */,
 				B255989C0D00D8B800BB825C /* filters */,
-				B25598FD0D00D8B900BB825C /* mac */,
 				B255990B0D00D8B900BB825C /* SVGImage.cpp */,
 				B255990C0D00D8B900BB825C /* SVGImage.h */,
 				B255990E0D00D8B900BB825C /* SVGPaintServer.cpp */,
@@ -13019,18 +12956,9 @@
 			path = graphics;
 			sourceTree = "<group>";
 		};
-		B255988F0D00D8B800BB825C /* cg */ = {
-			isa = PBXGroup;
-			children = (
-				B25598990D00D8B800BB825C /* SVGResourceFilterCg.mm */,
-			);
-			path = cg;
-			sourceTree = "<group>";
-		};
 		B255989C0D00D8B800BB825C /* filters */ = {
 			isa = PBXGroup;
 			children = (
-				B255989D0D00D8B800BB825C /* cg */,
 				B25598D70D00D8B900BB825C /* SVGDistantLightSource.h */,
 				B25598E00D00D8B900BB825C /* SVGFEConvolveMatrix.cpp */,
 				B25598E10D00D8B900BB825C /* SVGFEConvolveMatrix.h */,
@@ -13056,8 +12984,10 @@
 				B25598F40D00D8B900BB825C /* SVGFETile.h */,
 				B25598F50D00D8B900BB825C /* SVGFETurbulence.cpp */,
 				B25598F60D00D8B900BB825C /* SVGFETurbulence.h */,
-				B25598F70D00D8B900BB825C /* SVGFilterEffect.cpp */,
-				B25598F80D00D8B900BB825C /* SVGFilterEffect.h */,
+				845E72F90FD2623900A87D79 /* SVGFilter.cpp */,
+				845E72FA0FD2623900A87D79 /* SVGFilter.h */,
+				081EBF380FD34F4100DA7559 /* SVGFilterBuilder.cpp */,
+				081EBF390FD34F4100DA7559 /* SVGFilterBuilder.h */,
 				B25598F90D00D8B900BB825C /* SVGLightSource.cpp */,
 				B25598FA0D00D8B900BB825C /* SVGLightSource.h */,
 				B25598FB0D00D8B900BB825C /* SVGPointLightSource.h */,
@@ -13066,66 +12996,6 @@
 			path = filters;
 			sourceTree = "<group>";
 		};
-		B255989D0D00D8B800BB825C /* cg */ = {
-			isa = PBXGroup;
-			children = (
-				B25598A60D00D8B800BB825C /* SVGFEHelpersCg.h */,
-				B25598A70D00D8B800BB825C /* SVGFEHelpersCg.mm */,
-				B25598AD0D00D8B800BB825C /* SVGFilterEffectCg.mm */,
-				B25598AE0D00D8B900BB825C /* WKArithmeticFilter.cikernel */,
-				B25598AF0D00D8B900BB825C /* WKArithmeticFilter.h */,
-				B25598B00D00D8B900BB825C /* WKArithmeticFilter.m */,
-				B25598B10D00D8B900BB825C /* WKComponentMergeFilter.cikernel */,
-				B25598B20D00D8B900BB825C /* WKComponentMergeFilter.h */,
-				B25598B30D00D8B900BB825C /* WKComponentMergeFilter.m */,
-				B25598B40D00D8B900BB825C /* WKDiffuseLightingFilter.cikernel */,
-				B25598B50D00D8B900BB825C /* WKDiffuseLightingFilter.h */,
-				B25598B60D00D8B900BB825C /* WKDiffuseLightingFilter.m */,
-				B25598B70D00D8B900BB825C /* WKDiscreteTransferFilter.cikernel */,
-				B25598B80D00D8B900BB825C /* WKDiscreteTransferFilter.h */,
-				B25598B90D00D8B900BB825C /* WKDiscreteTransferFilter.m */,
-				B25598BA0D00D8B900BB825C /* WKDisplacementMapFilter.cikernel */,
-				B25598BB0D00D8B900BB825C /* WKDisplacementMapFilter.h */,
-				B25598BC0D00D8B900BB825C /* WKDisplacementMapFilter.m */,
-				B25598BD0D00D8B900BB825C /* WKDistantLightFilter.cikernel */,
-				B25598BE0D00D8B900BB825C /* WKDistantLightFilter.h */,
-				B25598BF0D00D8B900BB825C /* WKDistantLightFilter.m */,
-				B25598C00D00D8B900BB825C /* WKGammaTransferFilter.cikernel */,
-				B25598C10D00D8B900BB825C /* WKGammaTransferFilter.h */,
-				B25598C20D00D8B900BB825C /* WKGammaTransferFilter.m */,
-				B25598C30D00D8B900BB825C /* WKIdentityTransferFilter.h */,
-				B25598C40D00D8B900BB825C /* WKIdentityTransferFilter.m */,
-				B25598C50D00D8B900BB825C /* WKLinearTransferFilter.cikernel */,
-				B25598C60D00D8B900BB825C /* WKLinearTransferFilter.h */,
-				B25598C70D00D8B900BB825C /* WKLinearTransferFilter.m */,
-				B25598C80D00D8B900BB825C /* WKNormalMapFilter.cikernel */,
-				B25598C90D00D8B900BB825C /* WKNormalMapFilter.h */,
-				B25598CA0D00D8B900BB825C /* WKNormalMapFilter.m */,
-				B25598CB0D00D8B900BB825C /* WKPointLightFilter.cikernel */,
-				B25598CC0D00D8B900BB825C /* WKPointLightFilter.h */,
-				B25598CD0D00D8B900BB825C /* WKPointLightFilter.m */,
-				B25598CE0D00D8B900BB825C /* WKSpecularLightingFilter.cikernel */,
-				B25598CF0D00D8B900BB825C /* WKSpecularLightingFilter.h */,
-				B25598D00D00D8B900BB825C /* WKSpecularLightingFilter.m */,
-				B25598D10D00D8B900BB825C /* WKSpotLightFilter.cikernel */,
-				B25598D20D00D8B900BB825C /* WKSpotLightFilter.h */,
-				B25598D30D00D8B900BB825C /* WKSpotLightFilter.m */,
-				B25598D40D00D8B900BB825C /* WKTableTransferFilter.cikernel */,
-				B25598D50D00D8B900BB825C /* WKTableTransferFilter.h */,
-				B25598D60D00D8B900BB825C /* WKTableTransferFilter.m */,
-			);
-			path = cg;
-			sourceTree = "<group>";
-		};
-		B25598FD0D00D8B900BB825C /* mac */ = {
-			isa = PBXGroup;
-			children = (
-				B25598FE0D00D8B900BB825C /* SVGResourceFilterPlatformDataMac.h */,
-				B25598FF0D00D8B900BB825C /* SVGResourceFilterPlatformDataMac.mm */,
-			);
-			path = mac;
-			sourceTree = "<group>";
-		};
 		B27535290B053814002CE64F /* cg */ = {
 			isa = PBXGroup;
 			children = (
@@ -13419,7 +13289,6 @@
 				93B70D4E09EB0C7C009D8468 /* JSEventListener.h */,
 				BC60901E0E91B8EC000C68B5 /* JSEventTarget.cpp */,
 				BC60901D0E91B8EC000C68B5 /* JSEventTarget.h */,
-				B25BE50F0D06B70800B524C6 /* JSEventTargetBase.h */,
 				9350E70C0E87500B00189FFF /* JSHTMLAllCollection.cpp */,
 				BC6DC7A00C1A4BFA004E2017 /* JSHTMLAllCollection.h */,
 				BC6C49F10D7DBA0500FFA558 /* JSImageConstructor.cpp */,
@@ -13468,14 +13337,17 @@
 				93B70D5309EB0C7C009D8468 /* ScriptController.cpp */,
 				93B70D5409EB0C7C009D8468 /* ScriptController.h */,
 				A83E1C720E49042B00140B9C /* ScriptControllerMac.mm */,
+				411046400FA222A600BA436A /* ScriptEventListener.cpp */,
+				4110463F0FA222A600BA436A /* ScriptEventListener.h */,
 				41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */,
 				41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */,
 				934CC1160EDCAC7300A658F2 /* ScriptInstance.h */,
-				41F066E20F64BCF600A07EAC /* ScriptObject.h */,
 				41F066E30F64BCF600A07EAC /* ScriptObject.cpp */,
+				41F066E20F64BCF600A07EAC /* ScriptObject.h */,
 				412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */,
 				419536500F68222400D0C679 /* ScriptObjectQuarantine.h */,
 				934CC1090EDB223900A658F2 /* ScriptSourceCode.h */,
+				4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */,
 				41C760B00EDE03D300C1655F /* ScriptState.h */,
 				416F45EF0ED7B311008215B6 /* ScriptString.h */,
 				934CC0DF0ED39D6F00A658F2 /* ScriptValue.cpp */,
@@ -13545,6 +13417,7 @@
 				1A9EF4560A1B957D00332B63 /* JSCanvasRenderingContext2DCustom.cpp */,
 				BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */,
 				C0DFC86F0DB6841A003EAE7C /* JSConsoleCustom.cpp */,
+				FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */,
 				FE80D7A20E9C1ED2000D6F75 /* JSCustomPositionCallback.cpp */,
 				FE80D7A30E9C1ED2000D6F75 /* JSCustomPositionCallback.h */,
 				FE80D7A40E9C1ED2000D6F75 /* JSCustomPositionErrorCallback.cpp */,
@@ -13698,7 +13571,6 @@
 				BC5A86B40C3367E800EEA649 /* JSDOMSelection.h */,
 				1403BA0B09EB18C700797C7F /* JSDOMWindow.cpp */,
 				1403BA0E09EB18F800797C7F /* JSDOMWindow.h */,
-				BCF937E60E8B2E95005C7AB7 /* JSDOMWindowBase.lut.h */,
 				BC94D14C0C275C68006BC617 /* JSHistory.cpp */,
 				BC94D14D0C275C68006BC617 /* JSHistory.h */,
 				BCE1C4390D9830D3003B02F2 /* JSLocation.cpp */,
@@ -13873,13 +13745,13 @@
 				A7CFB3CF0B7ED10A0070C32D /* DragImage.cpp */,
 				A7CFB3D00B7ED10A0070C32D /* DragImage.h */,
 				1CA19E150DC255CA0065A994 /* EventLoop.h */,
-				934FE9E40B5CA539003E4A73 /* FileChooser.cpp */,
 				066C772A0AB603B700238CC4 /* FileChooser.h */,
 				514B3F720C722047000530DF /* FileSystem.h */,
 				BC073BA90C399B1F000F5979 /* FloatConversion.h */,
 				FEAB90100EA51B9C006348C3 /* GeolocationService.cpp */,
 				FEAB90110EA51B9C006348C3 /* GeolocationService.h */,
 				BC3BC29B0E91AB0F00835588 /* HostWindow.h */,
+				934FE9E40B5CA539003E4A73 /* FileChooser.cpp */,
 				6593923509AE4346002C531F /* KURL.cpp */,
 				6593923609AE4346002C531F /* KURL.h */,
 				BCBD21AA0E417AD400A070F2 /* KURLHash.h */,
@@ -13921,6 +13793,7 @@
 				93309EA0099EB78C0056E581 /* SharedTimer.h */,
 				4B3043C60AE0370300A82647 /* Sound.h */,
 				9352071709BD3BA500F2038D /* StaticConstructors.h */,
+				93B2D8150F9920D2006AE6B2 /* SuddenTermination.h */,
 				93E62D990985F41600E1B5E3 /* SystemTime.h */,
 				BCE65D310EAD1211007E4533 /* Theme.cpp */,
 				BCE658FE0EA9248A007E4533 /* Theme.h */,
@@ -13948,7 +13821,6 @@
 				E1CAA5C50E8BD23600A73ECA /* JSWorker.h */,
 				E182568D0EF2B02D00933242 /* JSWorkerContext.cpp */,
 				E182568E0EF2B02D00933242 /* JSWorkerContext.h */,
-				E18259E60EF3E34B00933242 /* JSWorkerContextBase.lut.h */,
 				E1C362EE0EAF2AA9007410BC /* JSWorkerLocation.cpp */,
 				E1C362ED0EAF2AA9007410BC /* JSWorkerLocation.h */,
 				E1271A570EEECDE400F61213 /* JSWorkerNavigator.cpp */,
@@ -14260,10 +14132,9 @@
 				BCEA481B097D93020094C9E4 /* InlineTextBox.h */,
 				2D9066040BE141D400956998 /* LayoutState.cpp */,
 				2D9066050BE141D400956998 /* LayoutState.h */,
-				A8EA7A4D0A191A5200A8EF5F /* ListMarkerBox.cpp */,
-				A8EA7A490A191A5200A8EF5F /* ListMarkerBox.h */,
 				ABFE7E100D32FAF50066F4D2 /* MediaControlElements.cpp */,
 				ABFE7E110D32FAF50066F4D2 /* MediaControlElements.h */,
+				3774ABA30FA21EB400AD7DE9 /* OverlapTestRequestClient.h */,
 				B2B1F7140D00CAA8004AEA64 /* PointerEventsHitRules.cpp */,
 				B2B1F7150D00CAA8004AEA64 /* PointerEventsHitRules.h */,
 				BCEA481C097D93020094C9E4 /* RenderApplet.cpp */,
@@ -14350,6 +14221,8 @@
 				853CA9CF0AEEC5E9002372DC /* RenderSVGInline.h */,
 				853CA9D00AEEC5E9002372DC /* RenderSVGInlineText.cpp */,
 				853CA9D10AEEC5E9002372DC /* RenderSVGInlineText.h */,
+				A8F5C0B70F9285AC0098E06B /* RenderSVGModelObject.cpp */,
+				A8F5C0B60F9285AC0098E06B /* RenderSVGModelObject.h */,
 				AA31B5B20C1DFD1000AE7083 /* RenderSVGRoot.cpp */,
 				AA31B5B30C1DFD1000AE7083 /* RenderSVGRoot.h */,
 				853CA9D40AEEC5E9002372DC /* RenderSVGTSpan.cpp */,
@@ -14458,6 +14331,8 @@
 				6550B695099DF0270090D781 /* CharacterData.cpp */,
 				6550B696099DF0270090D781 /* CharacterData.h */,
 				93EEC1E609C2877700C515D1 /* CharacterData.idl */,
+				93F925420F7EF5B8007E37C9 /* CheckedRadioButtons.cpp */,
+				93F925410F7EF5B8007E37C9 /* CheckedRadioButtons.h */,
 				A818721A0977D3C0005826D9 /* ChildNodeList.cpp */,
 				A81872150977D3C0005826D9 /* ChildNodeList.h */,
 				BC4BF9E20D11E133007D247F /* ClassNames.cpp */,
@@ -14530,10 +14405,6 @@
 				BC60D8F10D2A11E000B9918F /* ExceptionBase.h */,
 				93831B560D087D6000E5C984 /* ExceptionCode.cpp */,
 				935FBCF109BA143B00E230B1 /* ExceptionCode.h */,
-				08BFDFC30F099E70007DC2BF /* FormControlElement.cpp */,
-				085773340F0846010080583E /* FormControlElement.h */,
-				08B93F730F293481000720C2 /* FormControlElementWithState.cpp */,
-				08B93F740F293481000720C2 /* FormControlElementWithState.h */,
 				08700BE60F086C5300919419 /* InputElement.cpp */,
 				08591AA40F085C4E009BACB1 /* InputElement.h */,
 				85031B2D0A44EFC700F992E0 /* KeyboardEvent.cpp */,
@@ -14551,6 +14422,7 @@
 				E1ADECBE0E76ACF1004A1A5E /* MessagePort.cpp */,
 				E1ADECBD0E76ACF1004A1A5E /* MessagePort.h */,
 				E1ADECC60E76AD1F004A1A5E /* MessagePort.idl */,
+				415E3EF50F8D67FE007EEB50 /* MessagePortProxy.h */,
 				85031B2F0A44EFC700F992E0 /* MouseEvent.cpp */,
 				85031B300A44EFC700F992E0 /* MouseEvent.h */,
 				141B94E509EC4223000E9413 /* MouseEvent.idl */,
@@ -14617,6 +14489,8 @@
 				08A484760E5272C500C3FE76 /* ScriptElement.h */,
 				E11C9DAF0EB3699500E409DB /* ScriptExecutionContext.cpp */,
 				E11C9D9A0EB3681200E409DB /* ScriptExecutionContext.h */,
+				084AEBE20FB505FA0038483E /* SelectElement.cpp */,
+				084AEBE30FB505FA0038483E /* SelectElement.h */,
 				BC7FA6800D1F167900DB22A9 /* SelectorNodeList.cpp */,
 				BC7FA67F0D1F167900DB22A9 /* SelectorNodeList.h */,
 				BC7FA62C0D1F0EFF00DB22A9 /* StaticNodeList.cpp */,
@@ -14658,6 +14532,8 @@
 				F523D30902DE4476018635CA /* XMLTokenizer.cpp */,
 				F523D30A02DE4476018635CA /* XMLTokenizer.h */,
 				54C50F7A0E801DF3009832A0 /* XMLTokenizerLibxml2.cpp */,
+				5D15E3A90F9E6AC1009E0E3F /* XMLTokenizerScope.cpp */,
+				5D15E3AA0F9E6AC1009E0E3F /* XMLTokenizerScope.h */,
 			);
 			path = dom;
 			sourceTree = "<group>";
@@ -14671,19 +14547,6 @@
 			isa = PBXHeadersBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				1AF326780D78B9440068F0C4 /* AXObjectCache.h in Headers */,
-				2955BE2C0E2548EC00893AB5 /* AccessibilityImageMapLink.h in Headers */,
-				29FFBB830E7C5A3D00407730 /* AccessibilityList.h in Headers */,
-				299986A00DD0DEEA00F8D261 /* AccessibilityListBox.h in Headers */,
-				2999869E0DD0DEEA00F8D261 /* AccessibilityListBoxOption.h in Headers */,
-				4B17CBC90D945B370053F183 /* AccessibilityObject.h in Headers */,
-				4B17CBCD0D945B910053F183 /* AccessibilityObjectWrapper.h in Headers */,
-				299984BE0DC8598500F8D261 /* AccessibilityRenderObject.h in Headers */,
-				29800C3B0E522A5300025536 /* AccessibilityTable.h in Headers */,
-				29AAC36D0E534E86008F9B3B /* AccessibilityTableCell.h in Headers */,
-				29800C990E524DA500025536 /* AccessibilityTableColumn.h in Headers */,
-				29AAC51F0E53963B008F9B3B /* AccessibilityTableHeaderContainer.h in Headers */,
-				29800C950E524C8B00025536 /* AccessibilityTableRow.h in Headers */,
 				E1C4DE690EA75C1E0023CCD6 /* ActiveDOMObject.h in Headers */,
 				49E912AB0EFAC906009D0CAF /* Animation.h in Headers */,
 				316FE1120E6E1DA700BF6088 /* AnimationBase.h in Headers */,
@@ -14718,6 +14581,7 @@
 				85031B3D0A44EFC700F992E0 /* BeforeUnloadEvent.h in Headers */,
 				B2C3DA240D006C1D00EF6F26 /* BidiContext.h in Headers */,
 				B2C3DA250D006C1D00EF6F26 /* BidiResolver.h in Headers */,
+				938192050F87E1EC00D5352A /* BinaryPropertyList.h in Headers */,
 				BC5EB9200E82040800B25965 /* BindingURI.h in Headers */,
 				A89943280B42338800D7C802 /* BitmapImage.h in Headers */,
 				93F199BE08245E59001E9ABC /* BlockExceptions.h in Headers */,
@@ -14803,6 +14667,7 @@
 				6550B6A0099DF0270090D781 /* CharacterData.h in Headers */,
 				B2C3DA260D006C1D00EF6F26 /* CharacterNames.h in Headers */,
 				B2C3DA2A0D006C1D00EF6F26 /* CharsetData.h in Headers */,
+				93F925430F7EF5B8007E37C9 /* CheckedRadioButtons.h in Headers */,
 				A81872200977D3C0005826D9 /* ChildNodeList.h in Headers */,
 				14D823520AF92A790004F057 /* Chrome.h in Headers */,
 				14D824080AF93AEB0004F057 /* ChromeClient.h in Headers */,
@@ -14815,6 +14680,8 @@
 				85031B400A44EFC700F992E0 /* ClipboardEvent.h in Headers */,
 				93F199E708245E59001E9ABC /* ClipboardMac.h in Headers */,
 				BC5EB5DF0E81B9AB00B25965 /* CollapsedBorderValue.h in Headers */,
+				93C441F00F813A1A00C1A634 /* CollectionCache.h in Headers */,
+				93C442000F813AE100C1A634 /* CollectionType.h in Headers */,
 				B27535670B053814002CE64F /* Color.h in Headers */,
 				B22279630D00BF220071B782 /* ColorDistance.h in Headers */,
 				EDE3A5000C7A430600956A37 /* ColorMac.h in Headers */,
@@ -14822,6 +14689,7 @@
 				316FE1160E6E1DA700BF6088 /* CompositeAnimation.h in Headers */,
 				93309DDD099E64920056E581 /* CompositeEditCommand.h in Headers */,
 				BC0B36A50CD3C67C00AC7EB5 /* Console.h in Headers */,
+				41F0618E0F5F069800A07EAC /* ConsoleMessage.h in Headers */,
 				A818721C0977D3C0005826D9 /* ContainerNode.h in Headers */,
 				BC5EB9810E82072500B25965 /* ContentData.h in Headers */,
 				41D015CA0F4B5C71004A662F /* ContentType.h in Headers */,
@@ -14830,6 +14698,7 @@
 				065AD4F70B0C2EDA005A2B1D /* ContextMenuController.h in Headers */,
 				06027CAD0B1CBFC000884B2D /* ContextMenuItem.h in Headers */,
 				9352088209BD45E900F2038D /* CookieJar.h in Headers */,
+				FE6FD4880F676E5700092873 /* Coordinates.h in Headers */,
 				3724CA570E68A7E400DB4384 /* CoreTextController.h in Headers */,
 				A80E6D040A1989CA007FB8C5 /* Counter.h in Headers */,
 				BC5EB9790E82069200B25965 /* CounterContent.h in Headers */,
@@ -14837,6 +14706,8 @@
 				9392F14C0AD1861B00691BD4 /* CounterNode.h in Headers */,
 				D0B0556809C6700100307E43 /* CreateLinkCommand.h in Headers */,
 				514C766E0CE923A1007EF3CD /* Credential.h in Headers */,
+				E1C416120F6562FD0092D2FB /* CrossOriginAccessControl.h in Headers */,
+				E1C415DA0F655D6F0092D2FB /* CrossOriginPreflightResultCache.h in Headers */,
 				2E4346590F546A9900B0F1BA /* CrossThreadCopier.h in Headers */,
 				93F1992F08245E59001E9ABC /* Cursor.h in Headers */,
 				BC2272A20E82E87C00E7F975 /* CursorData.h in Headers */,
@@ -14936,6 +14807,7 @@
 				85E7119F0AC5D5350053270F /* DOMHTMLBodyElementInternal.h in Headers */,
 				85BA4CDD0AA6861B0088052D /* DOMHTMLButtonElement.h in Headers */,
 				85E711A10AC5D5350053270F /* DOMHTMLButtonElementInternal.h in Headers */,
+				93D3C1590F97A9D70053C013 /* DOMHTMLCanvasElement.h in Headers */,
 				93F9B6580BA0F35E00854064 /* DOMHTMLCanvasElementInternal.h in Headers */,
 				85DF2F8E0AA3C88100AD64C5 /* DOMHTMLCollection.h in Headers */,
 				85E711A20AC5D5350053270F /* DOMHTMLCollectionInternal.h in Headers */,
@@ -14947,7 +14819,6 @@
 				85E711A40AC5D5350053270F /* DOMHTMLDivElementInternal.h in Headers */,
 				85BCBC130ABBA87D00381160 /* DOMHTMLDocument.h in Headers */,
 				85E711A60AC5D5350053270F /* DOMHTMLDocumentInternal.h in Headers */,
-				BC6E2B1A0C04B93600444EF8 /* DOMHTMLDocumentPrivate.h in Headers */,
 				85DF2EED0AA387CB00AD64C5 /* DOMHTMLElement.h in Headers */,
 				85E711A70AC5D5350053270F /* DOMHTMLElementInternal.h in Headers */,
 				8540756A0AD6CBF900620C57 /* DOMHTMLEmbedElement.h in Headers */,
@@ -14958,7 +14829,6 @@
 				85E711A90AC5D5350053270F /* DOMHTMLFontElementInternal.h in Headers */,
 				85DF2C5C0AA341F600AD64C5 /* DOMHTMLFormElement.h in Headers */,
 				85E711AA0AC5D5350053270F /* DOMHTMLFormElementInternal.h in Headers */,
-				85B916840AEBDB47008DD727 /* DOMHTMLFormElementPrivate.h in Headers */,
 				85DF81950AA77E4B00486AD7 /* DOMHTMLFrameElement.h in Headers */,
 				85E711AB0AC5D5350053270F /* DOMHTMLFrameElementInternal.h in Headers */,
 				BC5157DD0C03BC22008BB0EE /* DOMHTMLFrameElementPrivate.h in Headers */,
@@ -15045,7 +14915,6 @@
 				BC1A37B9097C715F0019F3D8 /* DOMInternal.h in Headers */,
 				85FF315A0AAFBFCB00374F38 /* DOMKeyboardEvent.h in Headers */,
 				85989DCC0ACC8BBD00A0BC51 /* DOMKeyboardEventInternal.h in Headers */,
-				85DF34400AAFC0ED00E59AE3 /* DOMKeyboardEventPrivate.h in Headers */,
 				850656FE0AAB4763002D15C0 /* DOMMediaList.h in Headers */,
 				85E711D10AC5D5350053270F /* DOMMediaListInternal.h in Headers */,
 				75793ED30D0CE85B007FC0AC /* DOMMessageEvent.h in Headers */,
@@ -15054,7 +14923,6 @@
 				E1ADEDD50E76BD60004A1A5E /* DOMMessagePortInternal.h in Headers */,
 				857E0B250AB043460036E447 /* DOMMouseEvent.h in Headers */,
 				85989DCD0ACC8BBD00A0BC51 /* DOMMouseEventInternal.h in Headers */,
-				857E0B2C0AB043FC0036E447 /* DOMMouseEventPrivate.h in Headers */,
 				85C7F5BF0AAFB7CC004014DD /* DOMMutationEvent.h in Headers */,
 				85989DCE0ACC8BBD00A0BC51 /* DOMMutationEventInternal.h in Headers */,
 				8518DD780A9CF31B0091B7A6 /* DOMNamedNodeMap.h in Headers */,
@@ -15064,10 +14932,8 @@
 				85B498FB0ADB340200925CBB /* DOMNodeInternal.h in Headers */,
 				85526C370AB0A17E000302EA /* DOMNodeIterator.h in Headers */,
 				850B41C20AD9E7E700A6ED4F /* DOMNodeIteratorInternal.h in Headers */,
-				85526C3E0AB0A76F000302EA /* DOMNodeIteratorPrivate.h in Headers */,
 				85ACAA8D0A9B759C00671E90 /* DOMNodeList.h in Headers */,
 				85E711D30AC5D5350053270F /* DOMNodeListInternal.h in Headers */,
-				853BF4EB0ABB6E97008647BB /* DOMNodePrivate.h in Headers */,
 				85CA96EA0A9624E900690CCF /* DOMNotation.h in Headers */,
 				85E711D40AC5D5350053270F /* DOMNotationInternal.h in Headers */,
 				856C8AE40A912649005C687B /* DOMObject.h in Headers */,
@@ -15084,7 +14950,6 @@
 				8538F05B0AD722F1006A81D1 /* DOMRange.h in Headers */,
 				851EE8210ABCA58100A6AA33 /* DOMRangeException.h in Headers */,
 				8538F05D0AD722F1006A81D1 /* DOMRangeInternal.h in Headers */,
-				85C320790AD7401500BC15C4 /* DOMRangePrivate.h in Headers */,
 				8538F0850AD72CB6006A81D1 /* DOMRanges.h in Headers */,
 				858C38A70AA8F20400B187A4 /* DOMRect.h in Headers */,
 				85E711D60AC5D5350053270F /* DOMRectInternal.h in Headers */,
@@ -15545,14 +15410,12 @@
 				85ACA99C0A9B575900671E90 /* DOMText.h in Headers */,
 				DDE63ED50B7D45A800226998 /* DOMTextEvent.h in Headers */,
 				85E711D90AC5D5350053270F /* DOMTextInternal.h in Headers */,
-				BCC5733A0D695BF1006EF517 /* DOMTextPrivate.h in Headers */,
 				188604B40F2E654A000B6443 /* DOMTimer.h in Headers */,
 				BC1A37BE097C715F0019F3D8 /* DOMTraversal.h in Headers */,
 				85526CD20AB0B7D9000302EA /* DOMTreeWalker.h in Headers */,
 				850B41C30AD9E7E700A6ED4F /* DOMTreeWalkerInternal.h in Headers */,
 				85C7F4910AAF79DC004014DD /* DOMUIEvent.h in Headers */,
 				85989DD00ACC8BBD00A0BC51 /* DOMUIEventInternal.h in Headers */,
-				85C7F4C30AAF8081004014DD /* DOMUIEventPrivate.h in Headers */,
 				BC1A37C0097C715F0019F3D8 /* DOMViews.h in Headers */,
 				31C0FF490E4CEFDD007D6FE5 /* DOMWebKitAnimationEvent.h in Headers */,
 				31C0FF4B0E4CEFDD007D6FE5 /* DOMWebKitAnimationEventInternal.h in Headers */,
@@ -15570,7 +15433,6 @@
 				31C0FF4E0E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h in Headers */,
 				85C7F5E70AAFBAFB004014DD /* DOMWheelEvent.h in Headers */,
 				85989DD10ACC8BBD00A0BC51 /* DOMWheelEventInternal.h in Headers */,
-				85FF313C0AAFBD7200374F38 /* DOMWheelEventPrivate.h in Headers */,
 				1403B99709EB13AF00797C7F /* DOMWindow.h in Headers */,
 				1A1D13800A5325520064BF5F /* DOMXPath.h in Headers */,
 				858015CE0ABCA75D0080588D /* DOMXPathException.h in Headers */,
@@ -15644,9 +15506,6 @@
 				BCDBB8AC0E088CA500C60FF6 /* FileList.h in Headers */,
 				514B3F730C722047000530DF /* FileSystem.h in Headers */,
 				BC5EB69F0E81DAEB00B25965 /* FillLayer.h in Headers */,
-				50A5DF750E1A13C9000A03AE /* Filter.h in Headers */,
-				50A5DF760E1A13C9000A03AE /* FilterBuilder.h in Headers */,
-				50A5E2100E1ABAF2000A03AE /* FilterEffect.h in Headers */,
 				A8CFF04F0A154F09000A4234 /* FixedTableLayout.h in Headers */,
 				BC073BAA0C399B1F000F5979 /* FloatConversion.h in Headers */,
 				B27535690B053814002CE64F /* FloatPoint.h in Headers */,
@@ -15669,8 +15528,6 @@
 				B2C3DA6B0D006CD600EF6F26 /* FontSelector.h in Headers */,
 				3784C34B0E11AA34007D8D48 /* FontTraitsMask.h in Headers */,
 				A80E6CED0A1989CA007FB8C5 /* FontValue.h in Headers */,
-				085773350F0846010080583E /* FormControlElement.h in Headers */,
-				08B93F760F293481000720C2 /* FormControlElementWithState.h in Headers */,
 				514C76700CE923A1007EF3CD /* FormData.h in Headers */,
 				085B92BB0EFDE73D00E6123C /* FormDataBuilder.h in Headers */,
 				A8136D380973A8E700D74463 /* FormDataList.h in Headers */,
@@ -15692,6 +15549,7 @@
 				2E4346440F546A8200B0F1BA /* GenericWorkerTask.h in Headers */,
 				FE80D7C60E9C1F25000D6F75 /* Geolocation.h in Headers */,
 				FEAB90130EA51B9C006348C3 /* GeolocationService.h in Headers */,
+				BCE494AB0F4F5E9E0084E319 /* GeolocationServiceMac.h in Headers */,
 				FE80D7C90E9C1F25000D6F75 /* Geoposition.h in Headers */,
 				B2C3DA6C0D006CD600EF6F26 /* GlyphBuffer.h in Headers */,
 				B2C3DA6E0D006CD600EF6F26 /* GlyphPageTreeNode.h in Headers */,
@@ -15764,6 +15622,7 @@
 				A871D4580A127CBC00B12A68 /* HTMLParamElement.h in Headers */,
 				93F198EF08245E59001E9ABC /* HTMLParser.h in Headers */,
 				BC588AF00BFA6CF900EE679E /* HTMLParserErrorCodes.h in Headers */,
+				449B19F50FA72ECE0015CA4A /* HTMLParserQuirks.h in Headers */,
 				A871D4560A127CBC00B12A68 /* HTMLPlugInElement.h in Headers */,
 				4415292E0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.h in Headers */,
 				A8EA7CB00A192B9C00A8EF5F /* HTMLPreElement.h in Headers */,
@@ -15790,6 +15649,7 @@
 				514C76730CE923A1007EF3CD /* HTTPParsers.h in Headers */,
 				BC94D1540C275C8B006BC617 /* History.h in Headers */,
 				51741D110B07259A00ED442C /* HistoryItem.h in Headers */,
+				9363B62D0F8E8FE000803810 /* HistoryPropertyList.h in Headers */,
 				930908910AF7EDE40081DF01 /* HitTestRequest.h in Headers */,
 				9307F1D80AF2D59000DBA31A /* HitTestResult.h in Headers */,
 				BC3BC29C0E91AB0F00835588 /* HostWindow.h in Headers */,
@@ -15824,6 +15684,9 @@
 				93309DF2099E64920056E581 /* InsertTextCommand.h in Headers */,
 				1C81B95C0E97330800266E07 /* InspectorClient.h in Headers */,
 				1C81B95A0E97330800266E07 /* InspectorController.h in Headers */,
+				41F061740F5F00AC00A07EAC /* InspectorDOMStorageResource.h in Headers */,
+				41F062140F5F192600A07EAC /* InspectorDatabaseResource.h in Headers */,
+				41F062010F5F0B6600A07EAC /* InspectorResource.h in Headers */,
 				B27535720B053814002CE64F /* IntPoint.h in Headers */,
 				B27535740B053814002CE64F /* IntRect.h in Headers */,
 				B27535750B053814002CE64F /* IntSize.h in Headers */,
@@ -15856,6 +15719,7 @@
 				BCA83E500D7CE1E9003421A8 /* JSClipboard.h in Headers */,
 				93F9B6E10BA0FB7200854064 /* JSComment.h in Headers */,
 				BC98543E0CD3D98C00069BC1 /* JSConsole.h in Headers */,
+				FE6FD48E0F676E9300092873 /* JSCoordinates.h in Headers */,
 				930705DA09E0C9BF00B17FE4 /* JSCounter.h in Headers */,
 				FE80D7A80E9C1ED2000D6F75 /* JSCustomPositionCallback.h in Headers */,
 				FE80D7AA0E9C1ED2000D6F75 /* JSCustomPositionErrorCallback.h in Headers */,
@@ -15875,7 +15739,6 @@
 				E10BB3860F14B95000560E13 /* JSDOMStringList.h in Headers */,
 				E10BB3860F14B95000560E13 /* JSDOMStringList.h in Headers */,
 				BC6932740D7E293900AE44D1 /* JSDOMWindowBase.h in Headers */,
-				BCF937E70E8B2E95005C7AB7 /* JSDOMWindowBase.lut.h in Headers */,
 				652FBBBC0DE27CB60001D386 /* JSDOMWindowCustom.h in Headers */,
 				BCBFB53D0DCD29CF0019B3E5 /* JSDOMWindowShell.h in Headers */,
 				1AE82F900CAAFA9D002237AE /* JSDatabase.h in Headers */,
@@ -15889,7 +15752,6 @@
 				BC60D9C00D2A269A00B9918F /* JSEventException.h in Headers */,
 				93B70D6A09EB0C7C009D8468 /* JSEventListener.h in Headers */,
 				BC60901F0E91B8EC000C68B5 /* JSEventTarget.h in Headers */,
-				B25BE5110D06B70800B524C6 /* JSEventTargetBase.h in Headers */,
 				BC00F0150E0A189500FD04E3 /* JSFile.h in Headers */,
 				BC00F0170E0A189500FD04E3 /* JSFileList.h in Headers */,
 				FE80DA640E9C4703000D6F75 /* JSGeolocation.h in Headers */,
@@ -15966,8 +15828,10 @@
 				A77979290D6B9E64003851B9 /* JSImageData.h in Headers */,
 				C091588B0DB4209200E55AF4 /* JSInspectedObjectWrapper.h in Headers */,
 				C091588D0DB4209200E55AF4 /* JSInspectorCallbackWrapper.h in Headers */,
+				41F060CE0F5EEB2B00A07EAC /* JSInspectorController.h in Headers */,
 				1C5FAED20DCFD90100D58F78 /* JSJavaScriptCallFrame.h in Headers */,
 				A86629D309DA2B48009633A5 /* JSKeyboardEvent.h in Headers */,
+				935F45430F7C3B5F00D7C1FB /* JSLazyEventListener.h in Headers */,
 				BCE1C43C0D9830D3003B02F2 /* JSLocation.h in Headers */,
 				E44614190CD6826900FADA75 /* JSMediaError.h in Headers */,
 				BC3C39B70C0D3D8D005F4D7A /* JSMediaList.h in Headers */,
@@ -16166,7 +16030,6 @@
 				E1CA5CD30E8CDE8000E8EF90 /* JSWorkerConstructor.h in Headers */,
 				E18256900EF2B02D00933242 /* JSWorkerContext.h in Headers */,
 				E1C36D350EB0A094007410BC /* JSWorkerContextBase.h in Headers */,
-				E18259E70EF3E34B00933242 /* JSWorkerContextBase.lut.h in Headers */,
 				E1C362EF0EAF2AA9007410BC /* JSWorkerLocation.h in Headers */,
 				E1271A580EEECDE400F61213 /* JSWorkerNavigator.h in Headers */,
 				BC348BD40DB7F804004ABAB9 /* JSXMLHttpRequest.h in Headers */,
@@ -16201,7 +16064,6 @@
 				BCFF64920EAD15C200C1D6F7 /* LengthSize.h in Headers */,
 				B22279650D00BF220071B782 /* LinearGradientAttributes.h in Headers */,
 				A7AD2F880EC89D07008AB002 /* LinkHash.h in Headers */,
-				A8EA7A4F0A191A5200A8EF5F /* ListMarkerBox.h in Headers */,
 				656D37320ADBA5DE00A4554D /* LoaderNSURLExtras.h in Headers */,
 				06E81ED70AB5D5E900C87837 /* LocalCurrentGraphicsContext.h in Headers */,
 				51BE38290DAEF7DA001085FC /* LocalStorage.h in Headers */,
@@ -16233,6 +16095,7 @@
 				E1ADECCE0E76AD8B004A1A5E /* MessageChannel.h in Headers */,
 				75793E840D0CE0B3007FC0AC /* MessageEvent.h in Headers */,
 				E1ADECBF0E76ACF1004A1A5E /* MessagePort.h in Headers */,
+				415E3EF60F8D67FE007EEB50 /* MessagePortProxy.h in Headers */,
 				A9C6E4E40D745E05006442E9 /* MimeType.h in Headers */,
 				A9C6E4E80D745E18006442E9 /* MimeTypeArray.h in Headers */,
 				C6D74AD509AA282E000B0A52 /* ModifySelectionListLevel.h in Headers */,
@@ -16270,10 +16133,12 @@
 				51A9267F0D53F0570063ECC2 /* OriginUsageRecord.h in Headers */,
 				BC5EB5DD0E81B8DD00B25965 /* OutlineValue.h in Headers */,
 				1A0D57370A5C77FE007EDD4C /* OverflowEvent.h in Headers */,
+				3774ABA50FA21EB400AD7DE9 /* OverlapTestRequestClient.h in Headers */,
 				B27535650B053814002CE64F /* PDFDocumentImage.h in Headers */,
 				65A21468097A329100B9050A /* Page.h in Headers */,
 				1477E7770BF4134A00152872 /* PageCache.h in Headers */,
 				9302B0BF0D79F82C00C7EE83 /* PageGroup.h in Headers */,
+				7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */,
 				51E1ECC30C91C90400DC255B /* PageURLRecord.h in Headers */,
 				A80E6CFB0A1989CA007FB8C5 /* Pair.h in Headers */,
 				BC76AC130DD7AD5C00415F34 /* ParserUtilities.h in Headers */,
@@ -16367,6 +16232,7 @@
 				853CA9D90AEEC5E9002372DC /* RenderSVGImage.h in Headers */,
 				853CA9DB0AEEC5E9002372DC /* RenderSVGInline.h in Headers */,
 				853CA9DD0AEEC5E9002372DC /* RenderSVGInlineText.h in Headers */,
+				A8F5C0B80F9285AC0098E06B /* RenderSVGModelObject.h in Headers */,
 				AA31B5B50C1DFD1000AE7083 /* RenderSVGRoot.h in Headers */,
 				853CA9E10AEEC5E9002372DC /* RenderSVGTSpan.h in Headers */,
 				853CA9DF0AEEC5E9002372DC /* RenderSVGText.h in Headers */,
@@ -16411,6 +16277,8 @@
 				514C767F0CE923A1007EF3CD /* ResourceResponseBase.h in Headers */,
 				A8CFF5E10A155A05000A4234 /* RootInlineBox.h in Headers */,
 				49E911C90EF86D47009D0CAF /* RotateTransformOperation.h in Headers */,
+				1C63A2480F71646600C09D5A /* RunLoopTimer.h in Headers */,
+				447D69030FA626810015CCB1 /* RuntimeApplicationChecks.h in Headers */,
 				E4AFD00C0DAF335400F5F55C /* SMILTime.h in Headers */,
 				E4AFD00E0DAF335500F5F55C /* SMILTimeContainer.h in Headers */,
 				51EC92590CE90DB400F90308 /* SQLError.h in Headers */,
@@ -16475,7 +16343,6 @@
 				B22279E90D00BF220071B782 /* SVGFEFuncRElement.h in Headers */,
 				B25599830D00D8BA00BB825C /* SVGFEGaussianBlur.h in Headers */,
 				B22279EC0D00BF220071B782 /* SVGFEGaussianBlurElement.h in Headers */,
-				B25599400D00D8BA00BB825C /* SVGFEHelpersCg.h in Headers */,
 				B25599850D00D8BA00BB825C /* SVGFEImage.h in Headers */,
 				B22279EF0D00BF220071B782 /* SVGFEImageElement.h in Headers */,
 				B22279F20D00BF220071B782 /* SVGFELightElement.h in Headers */,
@@ -16493,7 +16360,6 @@
 				B2227A060D00BF220071B782 /* SVGFETileElement.h in Headers */,
 				B25599900D00D8BA00BB825C /* SVGFETurbulence.h in Headers */,
 				B2227A090D00BF220071B782 /* SVGFETurbulenceElement.h in Headers */,
-				B25599920D00D8BA00BB825C /* SVGFilterEffect.h in Headers */,
 				B2227A0C0D00BF220071B782 /* SVGFilterElement.h in Headers */,
 				B2227A0F0D00BF220071B782 /* SVGFilterPrimitiveStandardAttributes.h in Headers */,
 				B2227A120D00BF220071B782 /* SVGFitToViewBox.h in Headers */,
@@ -16569,7 +16435,6 @@
 				B25599B30D00D8BA00BB825C /* SVGResource.h in Headers */,
 				B25599B50D00D8BA00BB825C /* SVGResourceClipper.h in Headers */,
 				B25599B70D00D8BA00BB825C /* SVGResourceFilter.h in Headers */,
-				B25599970D00D8BA00BB825C /* SVGResourceFilterPlatformDataMac.h in Headers */,
 				B25599B80D00D8BA00BB825C /* SVGResourceListener.h in Headers */,
 				B25599BA0D00D8BA00BB825C /* SVGResourceMarker.h in Headers */,
 				B25599BC0D00D8BA00BB825C /* SVGResourceMasker.h in Headers */,
@@ -16616,6 +16481,7 @@
 				416E75BE0EDF8FD700360E1D /* ScriptCallStack.h in Headers */,
 				93B70D7009EB0C7C009D8468 /* ScriptController.h in Headers */,
 				08A484780E5272C500C3FE76 /* ScriptElement.h in Headers */,
+				411046410FA222A600BA436A /* ScriptEventListener.h in Headers */,
 				E11C9D9B0EB3681200E409DB /* ScriptExecutionContext.h in Headers */,
 				41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */,
 				934CC1170EDCAC7300A658F2 /* ScriptInstance.h in Headers */,
@@ -16625,6 +16491,7 @@
 				41C760B10EDE03D300C1655F /* ScriptState.h in Headers */,
 				416F45F00ED7B311008215B6 /* ScriptString.h in Headers */,
 				934CC0E20ED39D6F00A658F2 /* ScriptValue.h in Headers */,
+				5D925B680F64D4DD00B847F0 /* ScrollBehavior.h in Headers */,
 				93C09C860B0657AA005ABD4D /* ScrollTypes.h in Headers */,
 				BC6D6E2609AF943500F59759 /* ScrollView.h in Headers */,
 				93F199B808245E59001E9ABC /* Scrollbar.h in Headers */,
@@ -16637,6 +16504,7 @@
 				BCD0E0FC0E972C3500265DEA /* SecurityOriginHash.h in Headers */,
 				371F4FFC0D25E7F300ECE0D5 /* SegmentedFontData.h in Headers */,
 				B2C3DA2F0D006C1D00EF6F26 /* SegmentedString.h in Headers */,
+				084AEBE50FB505FA0038483E /* SelectElement.h in Headers */,
 				93309E0E099E64920056E581 /* SelectionController.h in Headers */,
 				BC7FA6810D1F167900DB22A9 /* SelectorNodeList.h in Headers */,
 				51E0BB230DA572A600A9E417 /* SessionStorage.h in Headers */,
@@ -16696,6 +16564,7 @@
 				1A3178930B20A81600316987 /* SubresourceLoaderClient.h in Headers */,
 				659A7D130B6DB4D9001155B3 /* SubstituteData.h in Headers */,
 				1A8F6B020DB53006001DB794 /* SubstituteResource.h in Headers */,
+				93B2D8160F9920D2006AE6B2 /* SuddenTermination.h in Headers */,
 				93E62D9B0985F41600E1B5E3 /* SystemTime.h in Headers */,
 				A8CFF0510A154F09000A4234 /* TableLayout.h in Headers */,
 				BCE3BEC30D222B1D007E06E4 /* TagNodeList.h in Headers */,
@@ -16754,20 +16623,6 @@
 				93309E20099E64920056E581 /* VisiblePosition.h in Headers */,
 				A883DF280F3D045D00F19BF6 /* VisibleSelection.h in Headers */,
 				E44613B60CD6344E00FADA75 /* VoidCallback.h in Headers */,
-				B25599490D00D8BA00BB825C /* WKArithmeticFilter.h in Headers */,
-				B255994C0D00D8BA00BB825C /* WKComponentMergeFilter.h in Headers */,
-				B255994F0D00D8BA00BB825C /* WKDiffuseLightingFilter.h in Headers */,
-				B25599520D00D8BA00BB825C /* WKDiscreteTransferFilter.h in Headers */,
-				B25599550D00D8BA00BB825C /* WKDisplacementMapFilter.h in Headers */,
-				B25599580D00D8BA00BB825C /* WKDistantLightFilter.h in Headers */,
-				B255995B0D00D8BA00BB825C /* WKGammaTransferFilter.h in Headers */,
-				B255995D0D00D8BA00BB825C /* WKIdentityTransferFilter.h in Headers */,
-				B25599600D00D8BA00BB825C /* WKLinearTransferFilter.h in Headers */,
-				B25599630D00D8BA00BB825C /* WKNormalMapFilter.h in Headers */,
-				B25599660D00D8BA00BB825C /* WKPointLightFilter.h in Headers */,
-				B25599690D00D8BA00BB825C /* WKSpecularLightingFilter.h in Headers */,
-				B255996C0D00D8BA00BB825C /* WKSpotLightFilter.h in Headers */,
-				B255996F0D00D8BA00BB825C /* WKTableTransferFilter.h in Headers */,
 				088C97520ECB6E28000534BA /* WMLAElement.h in Headers */,
 				08203AA00ED8C35300B8B61A /* WMLAccessElement.h in Headers */,
 				080081970ED3B2DD00C53BC0 /* WMLAnchorElement.h in Headers */,
@@ -16812,7 +16667,6 @@
 				DD05FE0D0B8BA3C6009ACDFE /* WebCoreObjCExtras.h in Headers */,
 				EDEC98030AED7E170059137F /* WebCorePrefix.h in Headers */,
 				93EB169709F880C00091F8FF /* WebCoreSystemInterface.h in Headers */,
-				BC066F6F09FEB2FA00C589A7 /* WebCoreTextRenderer.h in Headers */,
 				37F818FD0D657606005E1F05 /* WebCoreURLResponse.h in Headers */,
 				93F199F008245E59001E9ABC /* WebCoreView.h in Headers */,
 				93F199B308245E59001E9ABC /* WebCoreViewFactory.h in Headers */,
@@ -16838,6 +16692,7 @@
 				2E4346460F546A8200B0F1BA /* Worker.h in Headers */,
 				2E4346490F546A8200B0F1BA /* WorkerContext.h in Headers */,
 				2E43464B0F546A8200B0F1BA /* WorkerContextProxy.h in Headers */,
+				A7D6B3490F61104500B79FD1 /* WorkerImportScriptsClient.h in Headers */,
 				2E43464D0F546A8200B0F1BA /* WorkerLocation.h in Headers */,
 				2E4346500F546A8200B0F1BA /* WorkerMessagingProxy.h in Headers */,
 				E1271A0B0EEEC77A00F61213 /* WorkerNavigator.h in Headers */,
@@ -16855,6 +16710,7 @@
 				A833C80D0A2CF25600D57664 /* XMLNames.h in Headers */,
 				1ACE53EB0A8D18E70022947D /* XMLSerializer.h in Headers */,
 				93F1992108245E59001E9ABC /* XMLTokenizer.h in Headers */,
+				5D15E3AC0F9E6AC1009E0E3F /* XMLTokenizerScope.h in Headers */,
 				1AB7FC690A8B92EC00D9D37B /* XPathEvaluator.h in Headers */,
 				BC60DA5B0D2A31F700B9918F /* XPathException.h in Headers */,
 				1AB7FC6C0A8B92EC00D9D37B /* XPathExpression.h in Headers */,
@@ -16883,6 +16739,8 @@
 				1A569CFA0D7E2B82007C3983 /* c_instance.h in Headers */,
 				1A569CFC0D7E2B82007C3983 /* c_runtime.h in Headers */,
 				1A569CFE0D7E2B82007C3983 /* c_utility.h in Headers */,
+				7AB6F8880FB9D27100805D02 /* JSONObject.h in Headers */,
+				7AED3E060FBB1EAA00D2B03C /* InspectorFrontend.h in Headers */,
 				65C97AF308EA908800ACD273 /* config.h in Headers */,
 				93309DE8099E64920056E581 /* htmlediting.h in Headers */,
 				1A569D000D7E2B82007C3983 /* jni_class.h in Headers */,
@@ -16909,20 +16767,31 @@
 				1A569D230D7E2B82007C3983 /* runtime_object.h in Headers */,
 				1A569D250D7E2B82007C3983 /* runtime_root.h in Headers */,
 				93309E1E099E64920056E581 /* visible_units.h in Headers */,
-				BCE494AB0F4F5E9E0084E319 /* GeolocationServiceMac.h in Headers */,
-				41F060CE0F5EEB2B00A07EAC /* JSInspectorController.h in Headers */,
-				41F061740F5F00AC00A07EAC /* InspectorDOMStorageResource.h in Headers */,
-				41F0618E0F5F069800A07EAC /* ConsoleMessage.h in Headers */,
-				41F062010F5F0B6600A07EAC /* InspectorResource.h in Headers */,
-				41F062140F5F192600A07EAC /* InspectorDatabaseResource.h in Headers */,
-				5D925B680F64D4DD00B847F0 /* ScrollBehavior.h in Headers */,
-				E1C415DA0F655D6F0092D2FB /* CrossOriginPreflightResultCache.h in Headers */,
-				E1C416120F6562FD0092D2FB /* CrossOriginAccessControl.h in Headers */,
-				A7D6B3490F61104500B79FD1 /* WorkerImportScriptsClient.h in Headers */,
-				FE6FD4880F676E5700092873 /* Coordinates.h in Headers */,
-				FE6FD48E0F676E9300092873 /* JSCoordinates.h in Headers */,
-				1C63A2480F71646600C09D5A /* RunLoopTimer.h in Headers */,
-				935F45430F7C3B5F00D7C1FB /* JSLazyEventListener.h in Headers */,
+				29A8122B0FBB9C1D00510293 /* AccessibilityTable.h in Headers */,
+				29A8122C0FBB9C1D00510293 /* AccessibilityList.h in Headers */,
+				29A8122E0FBB9C1D00510293 /* AccessibilityARIAGridCell.h in Headers */,
+				29A812310FBB9C1D00510293 /* AccessibilityTableRow.h in Headers */,
+				29A812320FBB9C1D00510293 /* AccessibilityTableCell.h in Headers */,
+				29A812330FBB9C1D00510293 /* AccessibilityARIAGridRow.h in Headers */,
+				29A812340FBB9C1D00510293 /* AccessibilityARIAGrid.h in Headers */,
+				29A812360FBB9C1D00510293 /* AccessibilityObject.h in Headers */,
+				29A812380FBB9C1D00510293 /* AXObjectCache.h in Headers */,
+				29A812390FBB9C1D00510293 /* AccessibilityRenderObject.h in Headers */,
+				29A8123B0FBB9C1D00510293 /* AccessibilityImageMapLink.h in Headers */,
+				29A8123F0FBB9C1D00510293 /* AccessibilityTableHeaderContainer.h in Headers */,
+				29A812410FBB9C1D00510293 /* AccessibilityTableColumn.h in Headers */,
+				29A812420FBB9C1D00510293 /* AccessibilityListBoxOption.h in Headers */,
+				29A812430FBB9C1D00510293 /* AccessibilityListBox.h in Headers */,
+				29A812490FBB9CA900510293 /* AccessibilityObjectWrapper.h in Headers */,
+				84A81F3E0FC7DFF000955300 /* SourceAlpha.h in Headers */,
+				84A81F420FC7E02700955300 /* SourceGraphic.h in Headers */,
+				08C9251A0FCC7C4A00480DEC /* FilterEffect.h in Headers */,
+				082341C60FCF3A9500D75BD6 /* WMLSelectElement.h in Headers */,
+				845E72F80FD261EE00A87D79 /* Filter.h in Headers */,
+				845E72FC0FD2623900A87D79 /* SVGFilter.h in Headers */,
+				081EBF3B0FD34F4100DA7559 /* SVGFilterBuilder.h in Headers */,
+				18F831B80FD48C7800D8C56B /* WorkerLoaderProxy.h in Headers */,
+				A89CCC530F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -16991,19 +16860,7 @@
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				B25599480D00D8BA00BB825C /* WKArithmeticFilter.cikernel in Resources */,
-				B255994B0D00D8BA00BB825C /* WKComponentMergeFilter.cikernel in Resources */,
-				B255994E0D00D8BA00BB825C /* WKDiffuseLightingFilter.cikernel in Resources */,
-				B25599510D00D8BA00BB825C /* WKDiscreteTransferFilter.cikernel in Resources */,
-				B25599540D00D8BA00BB825C /* WKDisplacementMapFilter.cikernel in Resources */,
-				B25599570D00D8BA00BB825C /* WKDistantLightFilter.cikernel in Resources */,
-				B255995A0D00D8BA00BB825C /* WKGammaTransferFilter.cikernel in Resources */,
-				B255995F0D00D8BA00BB825C /* WKLinearTransferFilter.cikernel in Resources */,
-				B25599620D00D8BA00BB825C /* WKNormalMapFilter.cikernel in Resources */,
-				B25599650D00D8BA00BB825C /* WKPointLightFilter.cikernel in Resources */,
-				B25599680D00D8BA00BB825C /* WKSpecularLightingFilter.cikernel in Resources */,
-				B255996B0D00D8BA00BB825C /* WKSpotLightFilter.cikernel in Resources */,
-				B255996E0D00D8BA00BB825C /* WKTableTransferFilter.cikernel in Resources */,
+				FE6FD4890F676E5700092873 /* Coordinates.idl in Resources */,
 				46F9D5DD0B0D60170028EE36 /* aliasCursor.png in Resources */,
 				46D4F2490AF97E810035385A /* cellCursor.png in Resources */,
 				46D4F24A0AF97E810035385A /* contextMenuCursor.png in Resources */,
@@ -17037,7 +16894,6 @@
 				85136CA80AED665900F90A3D /* westResizeCursor.png in Resources */,
 				1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */,
 				1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */,
-				FE6FD4890F676E5700092873 /* Coordinates.idl in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -17179,7 +17035,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\n\nexport CREATE_HASH_TABLE=\"${JAVASCRIPTCORE_PRIVATE_HEADERS_DIR}/create_hash_table\"\n\nln -sfh \"${SRCROOT}\" WebCore\nexport WebCore=\"WebCore\"\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make -f \"WebCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
+			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\n\nexport CREATE_HASH_TABLE=\"${JAVASCRIPTCORE_PRIVATE_HEADERS_DIR}/create_hash_table\"\n\n/bin/ln -sfh \"${SRCROOT}\" WebCore\nexport WebCore=\"WebCore\"\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make -f \"WebCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
 		};
 /* End PBXShellScriptBuildPhase section */
 
@@ -17188,21 +17044,6 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				4B24F9A80DA7050B00269E58 /* AXObjectCache.cpp in Sources */,
-				1AF326460D78B5530068F0C4 /* AXObjectCacheMac.mm in Sources */,
-				2955BE2D0E2548EC00893AB5 /* AccessibilityImageMapLink.cpp in Sources */,
-				29FFBB820E7C5A3D00407730 /* AccessibilityList.cpp in Sources */,
-				299986A10DD0DEEA00F8D261 /* AccessibilityListBox.cpp in Sources */,
-				2999869F0DD0DEEA00F8D261 /* AccessibilityListBoxOption.cpp in Sources */,
-				4B5B7C8E0D945CFA00DDF3AB /* AccessibilityObject.cpp in Sources */,
-				2951A2AE0E646C8800DB9ADE /* AccessibilityObjectMac.mm in Sources */,
-				4B17CBCC0D945B910053F183 /* AccessibilityObjectWrapper.mm in Sources */,
-				299984BD0DC8598500F8D261 /* AccessibilityRenderObject.cpp in Sources */,
-				29800C3C0E522A5300025536 /* AccessibilityTable.cpp in Sources */,
-				29AAC36E0E534E86008F9B3B /* AccessibilityTableCell.cpp in Sources */,
-				29800C9A0E524DA500025536 /* AccessibilityTableColumn.cpp in Sources */,
-				29AAC5200E53963B008F9B3B /* AccessibilityTableHeaderContainer.cpp in Sources */,
-				29800C960E524C8B00025536 /* AccessibilityTableRow.cpp in Sources */,
 				E1C4DE6E0EA75C650023CCD6 /* ActiveDOMObject.cpp in Sources */,
 				49E912AA0EFAC906009D0CAF /* Animation.cpp in Sources */,
 				316FE1110E6E1DA700BF6088 /* AnimationBase.cpp in Sources */,
@@ -17231,6 +17072,7 @@
 				AB23A32709BBA7D00067CC53 /* BeforeTextInsertedEvent.cpp in Sources */,
 				85031B3C0A44EFC700F992E0 /* BeforeUnloadEvent.cpp in Sources */,
 				B2C3DA230D006C1D00EF6F26 /* BidiContext.cpp in Sources */,
+				938192030F87E1E600D5352A /* BinaryPropertyList.cpp in Sources */,
 				BC5EB91F0E82040800B25965 /* BindingURI.cpp in Sources */,
 				A89943290B42338800D7C802 /* BitmapImage.cpp in Sources */,
 				93F19AE108245E59001E9ABC /* BlockExceptions.mm in Sources */,
@@ -17301,6 +17143,7 @@
 				514185EF0CD65F0400763C99 /* ChangeVersionWrapper.cpp in Sources */,
 				6550B69F099DF0270090D781 /* CharacterData.cpp in Sources */,
 				9326DC0C09DAD5D600AFC847 /* CharsetData.cpp in Sources */,
+				93F925440F7EF5B8007E37C9 /* CheckedRadioButtons.cpp in Sources */,
 				A81872250977D3C0005826D9 /* ChildNodeList.cpp in Sources */,
 				14D8238B0AF92DF60004F057 /* Chrome.cpp in Sources */,
 				ABAF22080C03B1C700B0BCF0 /* ChromeMac.mm in Sources */,
@@ -17311,6 +17154,7 @@
 				A784941B0B5FE507001E237A /* Clipboard.cpp in Sources */,
 				85031B3F0A44EFC700F992E0 /* ClipboardEvent.cpp in Sources */,
 				93F19AFF08245E59001E9ABC /* ClipboardMac.mm in Sources */,
+				93C441EF0F813A1A00C1A634 /* CollectionCache.cpp in Sources */,
 				B27535660B053814002CE64F /* Color.cpp in Sources */,
 				0FCF33240F2B9715004B6795 /* ColorCG.cpp in Sources */,
 				B22279620D00BF220071B782 /* ColorDistance.cpp in Sources */,
@@ -17319,6 +17163,7 @@
 				316FE1150E6E1DA700BF6088 /* CompositeAnimation.cpp in Sources */,
 				93309DDC099E64920056E581 /* CompositeEditCommand.cpp in Sources */,
 				BC0B36A40CD3C67C00AC7EB5 /* Console.cpp in Sources */,
+				41F0618F0F5F069800A07EAC /* ConsoleMessage.cpp in Sources */,
 				A818721F0977D3C0005826D9 /* ContainerNode.cpp in Sources */,
 				BC5EB9800E82072500B25965 /* ContentData.cpp in Sources */,
 				41D015CB0F4B5C71004A662F /* ContentType.cpp in Sources */,
@@ -17327,11 +17172,14 @@
 				06027CB30B1CC03D00884B2D /* ContextMenuItemMac.mm in Sources */,
 				93B6A0EA0B0BCA8400F5027A /* ContextMenuMac.mm in Sources */,
 				9352087709BD453400F2038D /* CookieJar.mm in Sources */,
+				FE6FD4870F676E5700092873 /* Coordinates.cpp in Sources */,
 				3724CA580E68A7E400DB4384 /* CoreTextController.cpp in Sources */,
 				BC5EB9500E82056B00B25965 /* CounterDirectives.cpp in Sources */,
 				9392F1500AD1862300691BD4 /* CounterNode.cpp in Sources */,
 				D0B0556909C6700100307E43 /* CreateLinkCommand.cpp in Sources */,
 				514C766D0CE923A1007EF3CD /* Credential.cpp in Sources */,
+				E1C416170F6563180092D2FB /* CrossOriginAccessControl.cpp in Sources */,
+				E1C415DE0F655D7C0092D2FB /* CrossOriginPreflightResultCache.cpp in Sources */,
 				2E4346580F546A9900B0F1BA /* CrossThreadCopier.cpp in Sources */,
 				93F19A2608245E59001E9ABC /* CursorMac.mm in Sources */,
 				B2F34FE90E82F82700F627CD /* DNSCFNet.cpp in Sources */,
@@ -17663,8 +17511,6 @@
 				514B3F760C722055000530DF /* FileSystemMac.mm in Sources */,
 				5160300B0CC4251200C8AC25 /* FileSystemPOSIX.cpp in Sources */,
 				BC5EB69E0E81DAEB00B25965 /* FillLayer.cpp in Sources */,
-				50A5E4720E1AEF3A000A03AE /* Filter.cpp in Sources */,
-				50A5E4740E1AEF84000A03AE /* FilterEffect.cpp in Sources */,
 				A8CFF04D0A154F09000A4234 /* FixedTableLayout.cpp in Sources */,
 				B27535680B053814002CE64F /* FloatPoint.cpp in Sources */,
 				B2E27C9F0B0F2B0900F17C7B /* FloatPoint3D.cpp in Sources */,
@@ -17693,8 +17539,6 @@
 				3724CA7E0E68B20500DB4384 /* FontMacCoreText.cpp in Sources */,
 				B2AFFC820D00A5C10030074D /* FontPlatformDataMac.mm in Sources */,
 				A80E6CF10A1989CA007FB8C5 /* FontValue.cpp in Sources */,
-				08BFDFC40F099E70007DC2BF /* FormControlElement.cpp in Sources */,
-				08B93F750F293481000720C2 /* FormControlElementWithState.cpp in Sources */,
 				514C766F0CE923A1007EF3CD /* FormData.cpp in Sources */,
 				085B92BA0EFDE73D00E6123C /* FormDataBuilder.cpp in Sources */,
 				A8136D390973A8E700D74463 /* FormDataList.cpp in Sources */,
@@ -17710,6 +17554,7 @@
 				BCE04C940DAFF902007A0F41 /* GeneratedImage.cpp in Sources */,
 				FE80D7C50E9C1F25000D6F75 /* Geolocation.cpp in Sources */,
 				FEAB90120EA51B9C006348C3 /* GeolocationService.cpp in Sources */,
+				BCE494AC0F4F5E9E0084E319 /* GeolocationServiceMac.mm in Sources */,
 				FE80D7C80E9C1F25000D6F75 /* Geoposition.cpp in Sources */,
 				B2C3DA6D0D006CD600EF6F26 /* GlyphPageTreeNode.cpp in Sources */,
 				B2AFFC830D00A5C10030074D /* GlyphPageTreeNodeMac.cpp in Sources */,
@@ -17809,6 +17654,7 @@
 				BC94D1530C275C8B006BC617 /* History.cpp in Sources */,
 				51741D120B07259A00ED442C /* HistoryItem.cpp in Sources */,
 				5160F4980B0AA75F00C1D2AF /* HistoryItemMac.mm in Sources */,
+				9363B62C0F8E8FE000803810 /* HistoryPropertyList.cpp in Sources */,
 				9307F1D70AF2D59000DBA31A /* HitTestResult.cpp in Sources */,
 				5126E6BB0A2E3B12005C29FA /* IconDatabase.cpp in Sources */,
 				1A2D753E0DE47FAB00F0A648 /* IconFetcher.cpp in Sources */,
@@ -17838,6 +17684,9 @@
 				93309DEF099E64920056E581 /* InsertParagraphSeparatorCommand.cpp in Sources */,
 				93309DF1099E64920056E581 /* InsertTextCommand.cpp in Sources */,
 				1C81B95B0E97330800266E07 /* InspectorController.cpp in Sources */,
+				41F061750F5F00AC00A07EAC /* InspectorDOMStorageResource.cpp in Sources */,
+				41F062150F5F192600A07EAC /* InspectorDatabaseResource.cpp in Sources */,
+				41F062020F5F0B6600A07EAC /* InspectorResource.cpp in Sources */,
 				B27535600B053814002CE64F /* IntPointCG.cpp in Sources */,
 				B275357C0B053814002CE64F /* IntPointMac.mm in Sources */,
 				B27535730B053814002CE64F /* IntRect.cpp in Sources */,
@@ -17881,6 +17730,8 @@
 				93F9B6E00BA0FB7200854064 /* JSComment.cpp in Sources */,
 				BC98543D0CD3D98B00069BC1 /* JSConsole.cpp in Sources */,
 				C0DFC8700DB6841A003EAE7C /* JSConsoleCustom.cpp in Sources */,
+				FE6FD48D0F676E9300092873 /* JSCoordinates.cpp in Sources */,
+				FE700DD10F92D81A008E2BFE /* JSCoordinatesCustom.cpp in Sources */,
 				930705D809E0C9B700B17FE4 /* JSCounter.cpp in Sources */,
 				FE80D7A70E9C1ED2000D6F75 /* JSCustomPositionCallback.cpp in Sources */,
 				FE80D7A90E9C1ED2000D6F75 /* JSCustomPositionErrorCallback.cpp in Sources */,
@@ -18016,6 +17867,7 @@
 				1C5FAED10DCFD90100D58F78 /* JSJavaScriptCallFrame.cpp in Sources */,
 				1C5FAEE70DCFDA6800D58F78 /* JSJavaScriptCallFrameCustom.cpp in Sources */,
 				A86629D409DA2B48009633A5 /* JSKeyboardEvent.cpp in Sources */,
+				935F45420F7C3B5F00D7C1FB /* JSLazyEventListener.cpp in Sources */,
 				BCE1C43B0D9830D3003B02F2 /* JSLocation.cpp in Sources */,
 				BCE1C4400D9830F4003B02F2 /* JSLocationCustom.cpp in Sources */,
 				E44614180CD6826900FADA75 /* JSMediaError.cpp in Sources */,
@@ -18276,7 +18128,6 @@
 				51B2417B0D931F3F00E83F5C /* LegacyWebArchiveMac.mm in Sources */,
 				BCE65BEA0EACDF16007E4533 /* Length.cpp in Sources */,
 				A7AD2F870EC89D07008AB002 /* LinkHash.cpp in Sources */,
-				A8EA7A530A191A5200A8EF5F /* ListMarkerBox.cpp in Sources */,
 				656D37330ADBA5DE00A4554D /* LoaderNSURLExtras.mm in Sources */,
 				06E81EEC0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm in Sources */,
 				51BE38280DAEF7DA001085FC /* LocalStorage.cpp in Sources */,
@@ -18343,6 +18194,7 @@
 				65FEA86909833ADE00BED4AB /* Page.cpp in Sources */,
 				1477E7760BF4134A00152872 /* PageCache.cpp in Sources */,
 				9302B0BD0D79F82900C7EE83 /* PageGroup.cpp in Sources */,
+				7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */,
 				1C26497C0D7E24EC00BD10F2 /* PageMac.cpp in Sources */,
 				51E1ECC20C91C90400DC255B /* PageURLRecord.cpp in Sources */,
 				4B2709830AF2E5E00065127F /* PasteboardMac.mm in Sources */,
@@ -18421,6 +18273,7 @@
 				853CA9D80AEEC5E9002372DC /* RenderSVGImage.cpp in Sources */,
 				853CA9DA0AEEC5E9002372DC /* RenderSVGInline.cpp in Sources */,
 				853CA9DC0AEEC5E9002372DC /* RenderSVGInlineText.cpp in Sources */,
+				A8F5C0B90F9285AC0098E06B /* RenderSVGModelObject.cpp in Sources */,
 				AA31B5B40C1DFD1000AE7083 /* RenderSVGRoot.cpp in Sources */,
 				853CA9E00AEEC5E9002372DC /* RenderSVGTSpan.cpp in Sources */,
 				853CA9DE0AEEC5E9002372DC /* RenderSVGText.cpp in Sources */,
@@ -18463,6 +18316,8 @@
 				514C76550CE9234F007EF3CD /* ResourceResponseMac.mm in Sources */,
 				A8CFF5E70A155A05000A4234 /* RootInlineBox.cpp in Sources */,
 				49E911C80EF86D47009D0CAF /* RotateTransformOperation.cpp in Sources */,
+				1C63A2490F71646600C09D5A /* RunLoopTimerCF.cpp in Sources */,
+				447D69040FA626810015CCB1 /* RuntimeApplicationChecks.mm in Sources */,
 				E4AFD00B0DAF335400F5F55C /* SMILTime.cpp in Sources */,
 				E4AFD00D0DAF335500F5F55C /* SMILTimeContainer.cpp in Sources */,
 				519611730CAC56570010A80C /* SQLResultSet.cpp in Sources */,
@@ -18523,7 +18378,6 @@
 				B22279E80D00BF220071B782 /* SVGFEFuncRElement.cpp in Sources */,
 				B25599820D00D8BA00BB825C /* SVGFEGaussianBlur.cpp in Sources */,
 				B22279EB0D00BF220071B782 /* SVGFEGaussianBlurElement.cpp in Sources */,
-				B25599410D00D8BA00BB825C /* SVGFEHelpersCg.mm in Sources */,
 				B25599840D00D8BA00BB825C /* SVGFEImage.cpp in Sources */,
 				B22279EE0D00BF220071B782 /* SVGFEImageElement.cpp in Sources */,
 				B22279F10D00BF220071B782 /* SVGFELightElement.cpp in Sources */,
@@ -18541,8 +18395,6 @@
 				B2227A050D00BF220071B782 /* SVGFETileElement.cpp in Sources */,
 				B255998F0D00D8BA00BB825C /* SVGFETurbulence.cpp in Sources */,
 				B2227A080D00BF220071B782 /* SVGFETurbulenceElement.cpp in Sources */,
-				B25599910D00D8BA00BB825C /* SVGFilterEffect.cpp in Sources */,
-				B25599470D00D8BA00BB825C /* SVGFilterEffectCg.mm in Sources */,
 				B2227A0B0D00BF220071B782 /* SVGFilterElement.cpp in Sources */,
 				B2227A0E0D00BF220071B782 /* SVGFilterPrimitiveStandardAttributes.cpp in Sources */,
 				B2227A110D00BF220071B782 /* SVGFitToViewBox.cpp in Sources */,
@@ -18613,8 +18465,6 @@
 				B25599B20D00D8BA00BB825C /* SVGResource.cpp in Sources */,
 				B25599B40D00D8BA00BB825C /* SVGResourceClipper.cpp in Sources */,
 				B25599B60D00D8BA00BB825C /* SVGResourceFilter.cpp in Sources */,
-				B25599350D00D8BA00BB825C /* SVGResourceFilterCg.mm in Sources */,
-				B25599980D00D8BA00BB825C /* SVGResourceFilterPlatformDataMac.mm in Sources */,
 				B25599B90D00D8BA00BB825C /* SVGResourceMarker.cpp in Sources */,
 				B25599BB0D00D8BA00BB825C /* SVGResourceMasker.cpp in Sources */,
 				853CA9E80AEEC608002372DC /* SVGRootInlineBox.cpp in Sources */,
@@ -18660,11 +18510,14 @@
 				93B70D6F09EB0C7C009D8468 /* ScriptController.cpp in Sources */,
 				A83E1C740E49042C00140B9C /* ScriptControllerMac.mm in Sources */,
 				08A484770E5272C500C3FE76 /* ScriptElement.cpp in Sources */,
+				411046420FA222A600BA436A /* ScriptEventListener.cpp in Sources */,
 				E11C9DB00EB3699500E409DB /* ScriptExecutionContext.cpp in Sources */,
 				41002CCE0F66EDEF009E660D /* ScriptFunctionCall.cpp in Sources */,
 				41F066E50F64BCF600A07EAC /* ScriptObject.cpp in Sources */,
 				412A68470F6B03DD000EA66E /* ScriptObjectQuarantine.cpp in Sources */,
+				4127D5370F8AAB1D00E424F5 /* ScriptState.cpp in Sources */,
 				934CC0E10ED39D6F00A658F2 /* ScriptValue.cpp in Sources */,
+				5D925B670F64D4DD00B847F0 /* ScrollBehavior.cpp in Sources */,
 				BC2441C40E8B65D00055320F /* ScrollView.cpp in Sources */,
 				9353676B09AED88B00D35CD6 /* ScrollViewMac.mm in Sources */,
 				BCAA90C30A7EBA60008B1229 /* Scrollbar.cpp in Sources */,
@@ -18674,6 +18527,7 @@
 				BCD0E0FA0E972C3500265DEA /* SecurityOrigin.cpp in Sources */,
 				371F4FFD0D25E7F300ECE0D5 /* SegmentedFontData.cpp in Sources */,
 				B2C3DA2E0D006C1D00EF6F26 /* SegmentedString.cpp in Sources */,
+				084AEBE40FB505FA0038483E /* SelectElement.cpp in Sources */,
 				93309E0D099E64920056E581 /* SelectionController.cpp in Sources */,
 				4A8C96EB0BE69032004EEFF0 /* SelectionControllerMac.mm in Sources */,
 				BC7FA6820D1F167900DB22A9 /* SelectorNodeList.cpp in Sources */,
@@ -18731,6 +18585,7 @@
 				BC5EB6990E81DA6300B25965 /* StyleVisualData.cpp in Sources */,
 				A8C4A7FE09D563270003AC8D /* StyledElement.cpp in Sources */,
 				93E227E40AF589AD00D48324 /* SubresourceLoader.cpp in Sources */,
+				93B2D8180F9920EE006AE6B2 /* SuddenTermination.mm in Sources */,
 				6582A16309999D6D00BEEB6D /* SystemTimeMac.cpp in Sources */,
 				BCE3BEC20D222B1D007E06E4 /* TagNodeList.cpp in Sources */,
 				6550B6A5099DF0270090D781 /* Text.cpp in Sources */,
@@ -18776,20 +18631,6 @@
 				7284ADDD0E6FEB31002EEFBD /* UserStyleSheetLoader.cpp in Sources */,
 				93309E1F099E64920056E581 /* VisiblePosition.cpp in Sources */,
 				A883DF270F3D045D00F19BF6 /* VisibleSelection.cpp in Sources */,
-				B255994A0D00D8BA00BB825C /* WKArithmeticFilter.m in Sources */,
-				B255994D0D00D8BA00BB825C /* WKComponentMergeFilter.m in Sources */,
-				B25599500D00D8BA00BB825C /* WKDiffuseLightingFilter.m in Sources */,
-				B25599530D00D8BA00BB825C /* WKDiscreteTransferFilter.m in Sources */,
-				B25599560D00D8BA00BB825C /* WKDisplacementMapFilter.m in Sources */,
-				B25599590D00D8BA00BB825C /* WKDistantLightFilter.m in Sources */,
-				B255995C0D00D8BA00BB825C /* WKGammaTransferFilter.m in Sources */,
-				B255995E0D00D8BA00BB825C /* WKIdentityTransferFilter.m in Sources */,
-				B25599610D00D8BA00BB825C /* WKLinearTransferFilter.m in Sources */,
-				B25599640D00D8BA00BB825C /* WKNormalMapFilter.m in Sources */,
-				B25599670D00D8BA00BB825C /* WKPointLightFilter.m in Sources */,
-				B255996A0D00D8BA00BB825C /* WKSpecularLightingFilter.m in Sources */,
-				B255996D0D00D8BA00BB825C /* WKSpotLightFilter.m in Sources */,
-				B25599700D00D8BA00BB825C /* WKTableTransferFilter.m in Sources */,
 				088C97510ECB6E28000534BA /* WMLAElement.cpp in Sources */,
 				08203A9F0ED8C35300B8B61A /* WMLAccessElement.cpp in Sources */,
 				080081960ED3B2DD00C53BC0 /* WMLAnchorElement.cpp in Sources */,
@@ -18831,7 +18672,6 @@
 				934D9BA50B8C116B007B42A9 /* WebCoreNSStringExtras.mm in Sources */,
 				B50F5B810E96CD9900AD71A6 /* WebCoreObjCExtras.mm in Sources */,
 				93EB169509F880B00091F8FF /* WebCoreSystemInterface.mm in Sources */,
-				BCFE8E320A02A1D30009E61D /* WebCoreTextRenderer.mm in Sources */,
 				37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */,
 				93F19B0708245E59001E9ABC /* WebCoreView.m in Sources */,
 				93F19A5F08245E59001E9ABC /* WebCoreViewFactory.m in Sources */,
@@ -18854,6 +18694,7 @@
 				BC8243E80D0CFD7500460C8F /* WindowFeatures.cpp in Sources */,
 				2E4346450F546A8200B0F1BA /* Worker.cpp in Sources */,
 				2E4346480F546A8200B0F1BA /* WorkerContext.cpp in Sources */,
+				A7D6B34A0F61104500B79FD1 /* WorkerImportScriptsClient.cpp in Sources */,
 				2E43464C0F546A8200B0F1BA /* WorkerLocation.cpp in Sources */,
 				2E43464F0F546A8200B0F1BA /* WorkerMessagingProxy.cpp in Sources */,
 				E1271A140EEEC80400F61213 /* WorkerNavigator.cpp in Sources */,
@@ -18869,6 +18710,7 @@
 				1ACE53EA0A8D18E70022947D /* XMLSerializer.cpp in Sources */,
 				93F19ABC08245E59001E9ABC /* XMLTokenizer.cpp in Sources */,
 				54C50F7B0E801DF3009832A0 /* XMLTokenizerLibxml2.cpp in Sources */,
+				5D15E3AB0F9E6AC1009E0E3F /* XMLTokenizerScope.cpp in Sources */,
 				1AB7FC680A8B92EC00D9D37B /* XPathEvaluator.cpp in Sources */,
 				1AB7FC6B0A8B92EC00D9D37B /* XPathExpression.cpp in Sources */,
 				1AB7FC6E0A8B92EC00D9D37B /* XPathExpressionNode.cpp in Sources */,
@@ -18889,6 +18731,8 @@
 				93F19B0308245E59001E9ABC /* XSLStyleSheet.cpp in Sources */,
 				E1F1E82F0C3C2BB9006DB391 /* XSLTExtensions.cpp in Sources */,
 				93F19B0408245E59001E9ABC /* XSLTProcessor.cpp in Sources */,
+				7AB6F8870FB9D27100805D02 /* JSONObject.cpp in Sources */,
+				7AED3E050FBB1EAA00D2B03C /* InspectorFrontend.cpp in Sources */,
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				BCEA4852097D93020094C9E4 /* bidi.cpp in Sources */,
 				BCEA4854097D93020094C9E4 /* break_lines.cpp in Sources */,
@@ -18916,19 +18760,31 @@
 				1A569D220D7E2B82007C3983 /* runtime_object.cpp in Sources */,
 				1A569D240D7E2B82007C3983 /* runtime_root.cpp in Sources */,
 				93309E1D099E64920056E581 /* visible_units.cpp in Sources */,
-				BCE494AC0F4F5E9E0084E319 /* GeolocationServiceMac.mm in Sources */,
-				41F061750F5F00AC00A07EAC /* InspectorDOMStorageResource.cpp in Sources */,
-				41F0618F0F5F069800A07EAC /* ConsoleMessage.cpp in Sources */,
-				41F062020F5F0B6600A07EAC /* InspectorResource.cpp in Sources */,
-				41F062150F5F192600A07EAC /* InspectorDatabaseResource.cpp in Sources */,
-				5D925B670F64D4DD00B847F0 /* ScrollBehavior.cpp in Sources */,
-				E1C415DE0F655D7C0092D2FB /* CrossOriginPreflightResultCache.cpp in Sources */,
-				E1C416170F6563180092D2FB /* CrossOriginAccessControl.cpp in Sources */,
-				A7D6B34A0F61104500B79FD1 /* WorkerImportScriptsClient.cpp in Sources */,
-				FE6FD4870F676E5700092873 /* Coordinates.cpp in Sources */,
-				FE6FD48D0F676E9300092873 /* JSCoordinates.cpp in Sources */,
-				1C63A2490F71646600C09D5A /* RunLoopTimerCF.cpp in Sources */,
-				935F45420F7C3B5F00D7C1FB /* JSLazyEventListener.cpp in Sources */,
+				29A812260FBB9C1D00510293 /* AccessibilityRenderObject.cpp in Sources */,
+				29A812270FBB9C1D00510293 /* AccessibilityTable.cpp in Sources */,
+				29A812280FBB9C1D00510293 /* AccessibilityARIAGrid.cpp in Sources */,
+				29A812290FBB9C1D00510293 /* AccessibilityTableRow.cpp in Sources */,
+				29A8122A0FBB9C1D00510293 /* AccessibilityTableCell.cpp in Sources */,
+				29A8122D0FBB9C1D00510293 /* AccessibilityARIAGridRow.cpp in Sources */,
+				29A8122F0FBB9C1D00510293 /* AccessibilityList.cpp in Sources */,
+				29A812300FBB9C1D00510293 /* AccessibilityARIAGridCell.cpp in Sources */,
+				29A812350FBB9C1D00510293 /* AccessibilityTableColumn.cpp in Sources */,
+				29A812370FBB9C1D00510293 /* AXObjectCache.cpp in Sources */,
+				29A8123A0FBB9C1D00510293 /* AccessibilityImageMapLink.cpp in Sources */,
+				29A8123C0FBB9C1D00510293 /* AccessibilityObject.cpp in Sources */,
+				29A8123D0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp in Sources */,
+				29A8123E0FBB9C1D00510293 /* AccessibilityListBox.cpp in Sources */,
+				29A812400FBB9C1D00510293 /* AccessibilityTableHeaderContainer.cpp in Sources */,
+				29A812480FBB9CA900510293 /* AccessibilityObjectMac.mm in Sources */,
+				29A8124A0FBB9CA900510293 /* AccessibilityObjectWrapper.mm in Sources */,
+				29A8124B0FBB9CA900510293 /* AXObjectCacheMac.mm in Sources */,
+				84A81F3D0FC7DFF000955300 /* SourceAlpha.cpp in Sources */,
+				84A81F410FC7E02700955300 /* SourceGraphic.cpp in Sources */,
+				08C925190FCC7C4A00480DEC /* FilterEffect.cpp in Sources */,
+				082341C50FCF3A9500D75BD6 /* WMLSelectElement.cpp in Sources */,
+				845E72FB0FD2623900A87D79 /* SVGFilter.cpp in Sources */,
+				081EBF3A0FD34F4100DA7559 /* SVGFilterBuilder.cpp in Sources */,
+				A89CCC520F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -18979,12 +18835,6 @@
 					normal,
 					debug,
 				);
-				SECTORDER_FLAGS = (
-					"-sectorder",
-					__TEXT,
-					__text,
-					WebCore.order,
-				);
 			};
 			name = Production;
 		};
diff --git a/WebCore/WebCoreSources.bkl b/WebCore/WebCoreSources.bkl
index dfc3094..fb1eab9 100644
--- a/WebCore/WebCoreSources.bkl
+++ b/WebCore/WebCoreSources.bkl
@@ -32,6 +32,24 @@
 -->
 
 <makefile>
+    <set append="1" var="WEBCORE_SOURCES_ACCESSIBILITY">
+        accessibility/AccessibilityARIAGrid.cpp
+        accessibility/AccessibilityARIAGridCell.cpp
+        accessibility/AccessibilityARIAGridRow.cpp
+        accessibility/AccessibilityImageMapLink.cpp
+        accessibility/AccessibilityObject.cpp
+        accessibility/AccessibilityList.cpp
+        accessibility/AccessibilityListBox.cpp
+        accessibility/AccessibilityListBoxOption.cpp
+        accessibility/AccessibilityRenderObject.cpp
+        accessibility/AccessibilityTable.cpp
+        accessibility/AccessibilityTableCell.cpp
+        accessibility/AccessibilityTableColumn.cpp
+        accessibility/AccessibilityTableHeaderContainer.cpp
+        accessibility/AccessibilityTableRow.cpp
+        accessibility/AXObjectCache.cpp
+    </set>
+    
     <set append="1" var="WEBCORE_SOURCES_JS">
         bindings/js/GCController.cpp
         bindings/js/JSAttrCustom.cpp
@@ -43,6 +61,7 @@
         bindings/js/JSCSSRuleCustom.cpp
         bindings/js/JSCSSStyleDeclarationCustom.cpp
         bindings/js/JSCSSValueCustom.cpp
+        bindings/js/JSCoordinatesCustom.cpp
         bindings/js/JSCustomPositionCallback.cpp
         bindings/js/JSCustomPositionErrorCallback.cpp
         bindings/js/JSCustomSQLStatementCallback.cpp
@@ -123,9 +142,11 @@
         bindings/js/ScriptCallFrame.cpp
         bindings/js/ScriptCallStack.cpp
         bindings/js/ScriptController.cpp
+        bindings/js/ScriptEventListener.cpp
         bindings/js/ScriptFunctionCall.cpp
         bindings/js/ScriptObject.cpp
         bindings/js/ScriptObjectQuarantine.cpp
+        bindings/js/ScriptState.cpp
         bindings/js/ScriptValue.cpp
         bindings/js/ScheduledAction.cpp
         bindings/js/JSWebKitCSSMatrixConstructor.cpp
@@ -401,6 +422,7 @@
         dom/CDATASection.cpp
         dom/CSSMappedAttributeDeclaration.cpp
         dom/CharacterData.cpp
+        dom/CheckedRadioButtons.cpp
         dom/ChildNodeList.cpp
         dom/ClassNames.cpp
         dom/ClassNodeList.cpp
@@ -425,8 +447,6 @@
         dom/EventTarget.cpp
         dom/ExceptionBase.cpp
         dom/ExceptionCode.cpp
-        dom/FormControlElementWithState.cpp
-        dom/FormControlElement.cpp
         dom/InputElement.cpp
         dom/KeyboardEvent.cpp
         dom/MappedAttribute.cpp
@@ -456,6 +476,7 @@
         dom/RegisteredEventListener.cpp
         dom/ScriptElement.cpp
         dom/ScriptExecutionContext.cpp
+        dom/SelectElement.cpp 
         dom/SelectorNodeList.cpp
         dom/StaticNodeList.cpp
         dom/StaticStringList.cpp
@@ -473,6 +494,7 @@
         dom/WheelEvent.cpp
         dom/XMLTokenizer.cpp
         dom/XMLTokenizerLibxml2.cpp
+        dom/XMLTokenizerScope.cpp
     </set>
 
     <set append="1" var="WEBCORE_SOURCES_EDITING">
@@ -538,6 +560,7 @@
         html/CanvasPixelArray.cpp
         html/CanvasRenderingContext2D.cpp
         html/CanvasStyle.cpp
+        html/CollectionCache.cpp
         html/File.cpp
         html/FileList.cpp
         html/FormDataList.cpp
@@ -601,6 +624,7 @@
         html/HTMLPreElement.cpp
         html/HTMLQuoteElement.cpp
         html/HTMLScriptElement.cpp
+        html/HTMLNoScriptElement.cpp
         html/HTMLSelectElement.cpp
         html/HTMLStyleElement.cpp
         html/HTMLTableCaptionElement.cpp
@@ -625,11 +649,13 @@
         inspector/InspectorDatabaseResource.cpp
         inspector/InspectorDOMStorageResource.cpp
         inspector/InspectorController.cpp
+        inspector/InspectorFrontend.cpp
         inspector/InspectorResource.cpp
         inspector/JavaScriptCallFrame.cpp
         inspector/JavaScriptDebugServer.cpp
         inspector/JavaScriptProfile.cpp
         inspector/JavaScriptProfileNode.cpp
+        inspector/JSONObject.cpp
     </set>
 
     <set append="1" var="WEBCORE_SOURCES_LOADER">
@@ -685,23 +711,11 @@
     </set>
 
     <set append="1" var="WEBCORE_SOURCES_PAGE">
-        page/AccessibilityImageMapLink.cpp
-        page/AccessibilityObject.cpp
-        page/AccessibilityList.cpp
-        page/AccessibilityListBox.cpp
-        page/AccessibilityListBoxOption.cpp
-        page/AccessibilityRenderObject.cpp
-        page/AccessibilityTable.cpp
-        page/AccessibilityTableCell.cpp
-        page/AccessibilityTableColumn.cpp
-        page/AccessibilityTableHeaderContainer.cpp
-        page/AccessibilityTableRow.cpp
         page/animation/AnimationBase.cpp
         page/animation/AnimationController.cpp
         page/animation/CompositeAnimation.cpp
         page/animation/ImplicitAnimation.cpp
         page/animation/KeyframeAnimation.cpp
-        page/AXObjectCache.cpp
         page/BarInfo.cpp
         page/Chrome.cpp
         page/Console.cpp
@@ -725,6 +739,7 @@
         page/NavigatorBase.cpp
         page/Page.cpp
         page/PageGroup.cpp
+        page/PageGroupLoadDeferrer.cpp
         page/Screen.cpp
         page/SecurityOrigin.cpp
         page/Settings.cpp
@@ -898,7 +913,6 @@
         rendering/InlineFlowBox.cpp
         rendering/InlineTextBox.cpp
         rendering/LayoutState.cpp
-        rendering/ListMarkerBox.cpp
         rendering/MediaControlElements.cpp
         rendering/RenderApplet.cpp
         rendering/RenderArena.cpp
diff --git a/WebCore/page/AXObjectCache.cpp b/WebCore/accessibility/AXObjectCache.cpp
similarity index 71%
rename from WebCore/page/AXObjectCache.cpp
rename to WebCore/accessibility/AXObjectCache.cpp
index f8167a5..ec250ed 100644
--- a/WebCore/page/AXObjectCache.cpp
+++ b/WebCore/accessibility/AXObjectCache.cpp
@@ -29,6 +29,9 @@
 #include "config.h"
 #include "AXObjectCache.h"
 
+#include "AccessibilityARIAGrid.h"
+#include "AccessibilityARIAGridRow.h"
+#include "AccessibilityARIAGridCell.h"
 #include "AccessibilityList.h"
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
@@ -41,6 +44,7 @@
 #include "AccessibilityTableRow.h"
 #include "HTMLNames.h"
 #include "RenderObject.h"
+#include "RenderView.h"
 
 #include <wtf/PassRefPtr.h>
 
@@ -51,6 +55,11 @@
 bool AXObjectCache::gAccessibilityEnabled = false;
 bool AXObjectCache::gAccessibilityEnhancedUserInterfaceEnabled = false;
 
+AXObjectCache::AXObjectCache()
+    : m_notificationPostTimer(this, &AXObjectCache::notificationPostTimerFired)
+{
+}
+
 AXObjectCache::~AXObjectCache()
 {
     HashMap<AXID, RefPtr<AccessibilityObject> >::iterator end = m_objects.end();
@@ -76,6 +85,14 @@
     
     return obj;
 }
+    
+bool AXObjectCache::nodeIsAriaType(Node* node, String role)
+{
+    if (!node || !node->isElementNode())
+        return false;
+    
+    return equalIgnoringCase(static_cast<Element*>(node)->getAttribute(roleAttr), role);
+}
 
 AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
 {
@@ -91,12 +108,23 @@
             newObj = AccessibilityListBox::create(renderer);
         else if (node && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
             newObj = AccessibilityList::create(renderer);
+        
+        // aria tables
+        else if (nodeIsAriaType(node, "grid"))
+            newObj = AccessibilityARIAGrid::create(renderer);
+        else if (nodeIsAriaType(node, "row"))
+            newObj = AccessibilityARIAGridRow::create(renderer);
+        else if (nodeIsAriaType(node, "gridcell") || nodeIsAriaType(node, "columnheader") || nodeIsAriaType(node, "rowheader"))
+            newObj = AccessibilityARIAGridCell::create(renderer);
+
+        // standard tables
         else if (renderer->isTable())
             newObj = AccessibilityTable::create(renderer);
         else if (renderer->isTableRow())
             newObj = AccessibilityTableRow::create(renderer);
         else if (renderer->isTableCell())
             newObj = AccessibilityTableCell::create(renderer);
+
         else
             newObj = AccessibilityRenderObject::create(renderer);
         
@@ -225,11 +253,68 @@
     if (obj)
         obj->childrenChanged();
 }
+    
+void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
+{
+    m_notificationPostTimer.stop();
 
+    unsigned i = 0, count = m_notificationsToPost.size();
+    for (i = 0; i < count; ++i) {
+        AccessibilityObject* obj = m_notificationsToPost[i].first;
+#ifndef NDEBUG
+        // Make sure none of the render views are in the process of being layed out.
+        // Notifications should only be sent after the renderer has finished
+        if (obj->isAccessibilityRenderObject()) {
+            AccessibilityRenderObject* renderObj = static_cast<AccessibilityRenderObject*>(obj);
+            RenderObject* renderer = renderObj->renderer();
+            if (renderer && renderer->view())
+                ASSERT(!renderer->view()->layoutState());
+        }
+#endif
+        
+        postPlatformNotification(obj, m_notificationsToPost[i].second);
+    }
+    
+    m_notificationsToPost.clear();
+}
+    
 #if HAVE(ACCESSIBILITY)
+void AXObjectCache::postNotification(RenderObject* renderer, const String& message, bool postToElement)
+{
+    // Notifications for text input objects are sent to that object.
+    // All others are sent to the top WebArea.
+    if (!renderer)
+        return;
+    
+    // Get an accessibility object that already exists. One should not be created here
+    // because a render update may be in progress and creating an AX object can re-trigger a layout
+    RefPtr<AccessibilityObject> obj = get(renderer);
+    while (!obj && renderer) {
+        renderer = renderer->parent();
+        obj = get(renderer); 
+    }
+    
+    if (!renderer)
+        return;
+
+    if (obj && !postToElement)
+        obj = obj->observableObject();
+    
+    Document* document = renderer->document();
+    if (!obj && document)
+        obj = get(document->renderer());
+    
+    if (!obj)
+        return;
+
+    m_notificationsToPost.append(make_pair(obj.get(), message));
+    if (!m_notificationPostTimer.isActive())
+        m_notificationPostTimer.startOneShot(0);
+}
+
 void AXObjectCache::selectedChildrenChanged(RenderObject* renderer)
 {
-    postNotificationToElement(renderer, "AXSelectedChildrenChanged");
+    postNotification(renderer, "AXSelectedChildrenChanged", true);
 }
 #endif
 
diff --git a/WebCore/page/AXObjectCache.h b/WebCore/accessibility/AXObjectCache.h
similarity index 82%
rename from WebCore/page/AXObjectCache.h
rename to WebCore/accessibility/AXObjectCache.h
index 4fd6dc3..904283c 100644
--- a/WebCore/page/AXObjectCache.h
+++ b/WebCore/accessibility/AXObjectCache.h
@@ -27,6 +27,8 @@
 #define AXObjectCache_h
 
 #include "AccessibilityObject.h"
+#include "EventHandler.h"
+#include "Timer.h"
 #include <limits.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -57,6 +59,7 @@
 
     class AXObjectCache {
     public:
+        AXObjectCache();
         ~AXObjectCache();
         
         // to be used with render objects
@@ -73,13 +76,16 @@
 
         void detachWrapper(AccessibilityObject*);
         void attachWrapper(AccessibilityObject*);
-        void postNotification(RenderObject*, const String&);
-        void postNotificationToElement(RenderObject*, const String&);
+        void postNotification(RenderObject*, const String&, bool postToElement);
+        void postPlatformNotification(AccessibilityObject*, const String&);
         void childrenChanged(RenderObject*);
         void selectedChildrenChanged(RenderObject*);
         void handleActiveDescendantChanged(RenderObject*);
         void handleAriaRoleChanged(RenderObject*);
         void handleFocusedUIElementChanged();
+#if PLATFORM(GTK)
+        void handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*);
+#endif
         static void enableAccessibility() { gAccessibilityEnabled = true; }
         static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
         
@@ -97,7 +103,12 @@
         
         HashSet<AXID> m_idsInUse;
         
+        Timer<AXObjectCache> m_notificationPostTimer;
+        Vector<pair<AccessibilityObject*, const String> > m_notificationsToPost;
+        void notificationPostTimerFired(Timer<AXObjectCache>*);
+        
         AXID getAXID(AccessibilityObject*);
+        bool nodeIsAriaType(Node* node, String role);
     };
 
 #if !HAVE(ACCESSIBILITY)
@@ -107,8 +118,11 @@
     inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
-    inline void AXObjectCache::postNotification(RenderObject*, const String&) { }
-    inline void AXObjectCache::postNotificationToElement(RenderObject*, const String&) { }
+    inline void AXObjectCache::postNotification(RenderObject*, const String&, bool postToElement) { }
+    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&) { }
+#if PLATFORM(GTK)
+    inline void AXObjectCache::handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*) { }
+#endif
 #endif
 
 }
diff --git a/WebCore/accessibility/AccessibilityARIAGrid.cpp b/WebCore/accessibility/AccessibilityARIAGrid.cpp
new file mode 100644
index 0000000..69c4512
--- /dev/null
+++ b/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityARIAGrid.h"
+
+#include "AccessibilityTableCell.h"
+#include "AccessibilityTableColumn.h"
+#include "AccessibilityTableHeaderContainer.h"
+#include "AccessibilityTableRow.h"
+#include "AXObjectCache.h"
+#include "RenderObject.h"
+
+using namespace std;
+
+namespace WebCore {
+
+AccessibilityARIAGrid::AccessibilityARIAGrid(RenderObject* renderer)
+    : AccessibilityTable(renderer)
+{
+#if ACCESSIBILITY_TABLES
+    m_isAccessibilityTable = true;
+#else
+    m_isAccessibilityTable = false;
+#endif
+}
+
+AccessibilityARIAGrid::~AccessibilityARIAGrid()
+{
+}
+
+PassRefPtr<AccessibilityARIAGrid> AccessibilityARIAGrid::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityARIAGrid(renderer));
+}
+
+void AccessibilityARIAGrid::addChild(AccessibilityObject* child, HashSet<AccessibilityObject*>& appendedRows, unsigned& columnCount)
+{
+    if (!child || !child->isTableRow() || child->ariaRoleAttribute() != RowRole)
+        return;
+        
+    AccessibilityTableRow* row = static_cast<AccessibilityTableRow*>(child);
+    if (appendedRows.contains(row))
+        return;
+        
+    // store the maximum number of columns
+    unsigned rowCellCount = row->children().size();
+    if (rowCellCount > columnCount)
+        columnCount = rowCellCount;
+    
+    row->setRowIndex((int)m_rows.size());        
+    m_rows.append(row);
+    m_children.append(row);
+    appendedRows.add(row);
+}
+    
+void AccessibilityARIAGrid::addChildren()
+{
+    ASSERT(!m_haveChildren); 
+    
+    if (!isDataTable()) {
+        AccessibilityRenderObject::addChildren();
+        return;
+    }
+    
+    m_haveChildren = true;
+    if (!m_renderer)
+        return;
+    
+    AXObjectCache* axCache = m_renderer->document()->axObjectCache();
+    
+    // add only rows that are labeled as aria rows
+    HashSet<AccessibilityObject*> appendedRows;
+    unsigned columnCount = 0;
+    for (RefPtr<AccessibilityObject> child = firstChild(); child; child = child->nextSibling()) {
+
+        // in case the render tree doesn't match the expected ARIA hierarchy, look at the children
+        if (child->accessibilityIsIgnored()) {
+            if (!child->hasChildren())
+                child->addChildren();
+            
+            AccessibilityChildrenVector children = child->children();
+            unsigned length = children.size();
+            for (unsigned i = 0; i < length; ++i)
+                addChild(children[i].get(), appendedRows, columnCount);
+        } else
+            addChild(child.get(), appendedRows, columnCount);            
+    }
+    
+    // make the columns based on the number of columns in the first body
+    for (unsigned i = 0; i < columnCount; ++i) {
+        AccessibilityTableColumn* column = static_cast<AccessibilityTableColumn*>(axCache->getOrCreate(ColumnRole));
+        column->setColumnIndex((int)i);
+        column->setParentTable(this);
+        m_columns.append(column);
+        m_children.append(column);
+    }
+    
+    AccessibilityObject* headerContainerObject = headerContainer();
+    if (headerContainerObject)
+        m_children.append(headerContainerObject);
+}
+    
+AccessibilityTableCell* AccessibilityARIAGrid::cellForColumnAndRow(unsigned column, unsigned row)
+{
+    if (!m_renderer)
+        return 0;
+    
+    if (!hasChildren())
+        addChildren();
+    
+    if (column >= columnCount() || row >= rowCount())
+        return 0;
+    
+    AccessibilityObject *tableRow = m_rows[row].get();
+    if (!tableRow)
+        return 0;
+    
+    AccessibilityChildrenVector children = tableRow->children();
+    // in case this row had fewer columns than other rows
+    AccessibilityObject* tableCell = 0;
+    if (column >= children.size())
+        return 0;
+
+    tableCell = children[column].get();
+    return static_cast<AccessibilityTableCell*>(tableCell);
+}
+    
+} // namespace WebCore
diff --git a/WebCore/page/AccessibilityList.h b/WebCore/accessibility/AccessibilityARIAGrid.h
similarity index 65%
copy from WebCore/page/AccessibilityList.h
copy to WebCore/accessibility/AccessibilityARIAGrid.h
index 315ccac..32c8ce9 100644
--- a/WebCore/page/AccessibilityList.h
+++ b/WebCore/accessibility/AccessibilityARIAGrid.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,31 +26,35 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef AccessibilityList_h
-#define AccessibilityList_h
+#ifndef AccessibilityARIAGrid_h
+#define AccessibilityARIAGrid_h
 
-#include "AccessibilityRenderObject.h"
+#include "AccessibilityTable.h"
 
 namespace WebCore {
     
-class AccessibilityList : public AccessibilityRenderObject {
+class String;
+class AccessibilityTableCell;
+class AccessibilityTableHeaderContainer;
+
+class AccessibilityARIAGrid : public AccessibilityTable {
     
 private:
-    AccessibilityList(RenderObject*);
+    AccessibilityARIAGrid(RenderObject*);
 public:
-    static PassRefPtr<AccessibilityList> create(RenderObject*);
-    virtual ~AccessibilityList();
+    static PassRefPtr<AccessibilityARIAGrid> create(RenderObject*);
+    virtual ~AccessibilityARIAGrid();
     
-    virtual bool isList() const { return true; };
-    bool isUnorderedList() const;
-    bool isOrderedList() const;
-    bool isDefinitionList() const;
+    virtual bool isAriaTable() const { return true; }    
+    
+    virtual void addChildren();
+    
+    virtual AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
 
-    virtual AccessibilityRole roleValue() const { return ListRole; }
-    virtual bool accessibilityIsIgnored() const;
-    
+private:
+    void addChild(AccessibilityObject* object, HashSet<AccessibilityObject*>& appendedRows, unsigned& columnCount);
 };
-    
-} // namespace WebCore
 
-#endif // AccessibilityList_h
+} // namespace WebCore 
+
+#endif // AccessibilityARIAGrid_h
diff --git a/WebCore/accessibility/AccessibilityARIAGridCell.cpp b/WebCore/accessibility/AccessibilityARIAGridCell.cpp
new file mode 100644
index 0000000..1771bb8
--- /dev/null
+++ b/WebCore/accessibility/AccessibilityARIAGridCell.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityARIAGridCell.h"
+
+#include "AccessibilityObject.h"
+#include "AccessibilityTableRow.h"
+
+using namespace std;
+
+namespace WebCore {
+    
+AccessibilityARIAGridCell::AccessibilityARIAGridCell(RenderObject* renderer)
+    : AccessibilityTableCell(renderer)
+{
+}
+
+AccessibilityARIAGridCell::~AccessibilityARIAGridCell()
+{
+}
+
+PassRefPtr<AccessibilityARIAGridCell> AccessibilityARIAGridCell::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityARIAGridCell(renderer));
+}
+
+AccessibilityObject* AccessibilityARIAGridCell::parentTable() const
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isTableRow())
+        return 0;
+    
+    parent = parent->parentObjectUnignored();
+    if (!parent || !parent->isDataTable())
+        return 0;
+    
+    return parent;
+}
+    
+void AccessibilityARIAGridCell::rowIndexRange(pair<int, int>& rowRange)
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isTableRow())
+        return;
+
+    // as far as I can tell, grid cells cannot span rows
+    rowRange.first = static_cast<AccessibilityTableRow*>(parent)->rowIndex();
+    rowRange.second = 1;    
+}
+
+void AccessibilityARIAGridCell::columnIndexRange(pair<int, int>& columnRange)
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isTableRow())
+        return;
+    
+    AccessibilityChildrenVector siblings = parent->children();
+    unsigned childrenSize = siblings.size();
+    for (unsigned k = 0; k < childrenSize; ++k) {
+        if (siblings[k].get() == this) {
+            columnRange.first = k;
+            break;
+        }
+    }
+    
+    // as far as I can tell, grid cells cannot span columns
+    columnRange.second = 1;    
+}
+  
+} // namespace WebCore
diff --git a/WebCore/page/AccessibilityList.h b/WebCore/accessibility/AccessibilityARIAGridCell.h
similarity index 67%
copy from WebCore/page/AccessibilityList.h
copy to WebCore/accessibility/AccessibilityARIAGridCell.h
index 315ccac..2923de8 100644
--- a/WebCore/page/AccessibilityList.h
+++ b/WebCore/accessibility/AccessibilityARIAGridCell.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,31 +26,30 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef AccessibilityList_h
-#define AccessibilityList_h
+#ifndef AccessibilityARIAGridCell_h
+#define AccessibilityARIAGridCell_h
 
-#include "AccessibilityRenderObject.h"
+#include "AccessibilityTableCell.h"
 
 namespace WebCore {
     
-class AccessibilityList : public AccessibilityRenderObject {
+class AccessibilityARIAGridCell : public AccessibilityTableCell {
     
 private:
-    AccessibilityList(RenderObject*);
+    AccessibilityARIAGridCell(RenderObject*);
 public:
-    static PassRefPtr<AccessibilityList> create(RenderObject*);
-    virtual ~AccessibilityList();
+    static PassRefPtr<AccessibilityARIAGridCell> create(RenderObject*);
+    virtual ~AccessibilityARIAGridCell();
     
-    virtual bool isList() const { return true; };
-    bool isUnorderedList() const;
-    bool isOrderedList() const;
-    bool isDefinitionList() const;
+    // fills in the start location and row span of cell
+    virtual void rowIndexRange(pair<int, int>& rowRange);
+    // fills in the start location and column span of cell
+    virtual void columnIndexRange(pair<int, int>& columnRange);
+    
+protected:
+    virtual AccessibilityObject* parentTable() const;
+}; 
+    
+} // namespace WebCore 
 
-    virtual AccessibilityRole roleValue() const { return ListRole; }
-    virtual bool accessibilityIsIgnored() const;
-    
-};
-    
-} // namespace WebCore
-
-#endif // AccessibilityList_h
+#endif // AccessibilityARIAGridCell_h
diff --git a/WebCore/accessibility/AccessibilityARIAGridRow.cpp b/WebCore/accessibility/AccessibilityARIAGridRow.cpp
new file mode 100644
index 0000000..6e1f1c8
--- /dev/null
+++ b/WebCore/accessibility/AccessibilityARIAGridRow.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityARIAGridRow.h"
+
+#include "AccessibilityObject.h"
+#include "RenderObject.h"
+
+using namespace std;
+
+namespace WebCore {
+    
+AccessibilityARIAGridRow::AccessibilityARIAGridRow(RenderObject* renderer)
+    : AccessibilityTableRow(renderer)
+{
+}
+
+AccessibilityARIAGridRow::~AccessibilityARIAGridRow()
+{
+}
+
+PassRefPtr<AccessibilityARIAGridRow> AccessibilityARIAGridRow::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityARIAGridRow(renderer));
+}
+
+AccessibilityObject* AccessibilityARIAGridRow::parentTable() const
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent->isDataTable())
+        return 0;
+    
+    return parent;
+}
+
+AccessibilityObject* AccessibilityARIAGridRow::headerObject()
+{
+    AccessibilityChildrenVector rowChildren = children();
+    unsigned childrenCount = rowChildren.size();
+    for (unsigned i = 0; i < childrenCount; ++i) {
+        AccessibilityObject* cell = rowChildren[i].get();
+        if (cell->ariaRoleAttribute() == RowHeaderRole)
+            return cell;
+    }
+    
+    return 0;
+}
+
+} // namespace WebCore
diff --git a/WebCore/page/AccessibilityList.h b/WebCore/accessibility/AccessibilityARIAGridRow.h
similarity index 69%
copy from WebCore/page/AccessibilityList.h
copy to WebCore/accessibility/AccessibilityARIAGridRow.h
index 315ccac..c2ca8b8 100644
--- a/WebCore/page/AccessibilityList.h
+++ b/WebCore/accessibility/AccessibilityARIAGridRow.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,31 +26,25 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef AccessibilityList_h
-#define AccessibilityList_h
+#ifndef AccessibilityARIAGridRow_h
+#define AccessibilityARIAGridRow_h
 
-#include "AccessibilityRenderObject.h"
+#include "AccessibilityTableRow.h"
 
 namespace WebCore {
     
-class AccessibilityList : public AccessibilityRenderObject {
+class AccessibilityARIAGridRow : public AccessibilityTableRow {
     
 private:
-    AccessibilityList(RenderObject*);
+    AccessibilityARIAGridRow(RenderObject*);
 public:
-    static PassRefPtr<AccessibilityList> create(RenderObject*);
-    virtual ~AccessibilityList();
+    static PassRefPtr<AccessibilityARIAGridRow> create(RenderObject*);
+    virtual ~AccessibilityARIAGridRow();
     
-    virtual bool isList() const { return true; };
-    bool isUnorderedList() const;
-    bool isOrderedList() const;
-    bool isDefinitionList() const;
+    virtual AccessibilityObject* headerObject();
+    virtual AccessibilityObject* parentTable() const;    
+}; 
+    
+} // namespace WebCore 
 
-    virtual AccessibilityRole roleValue() const { return ListRole; }
-    virtual bool accessibilityIsIgnored() const;
-    
-};
-    
-} // namespace WebCore
-
-#endif // AccessibilityList_h
+#endif // AccessibilityARIAGridRow_h
diff --git a/WebCore/page/AccessibilityImageMapLink.cpp b/WebCore/accessibility/AccessibilityImageMapLink.cpp
similarity index 96%
rename from WebCore/page/AccessibilityImageMapLink.cpp
rename to WebCore/accessibility/AccessibilityImageMapLink.cpp
index 86ca623..943122e 100644
--- a/WebCore/page/AccessibilityImageMapLink.cpp
+++ b/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -78,6 +78,14 @@
     return m_areaElement;
 }
 
+KURL AccessibilityImageMapLink::url() const
+{
+    if (!m_areaElement)
+        return KURL();
+    
+    return m_areaElement->href();
+}
+    
 String AccessibilityImageMapLink::accessibilityDescription() const
 {
     if (!m_areaElement)
diff --git a/WebCore/page/AccessibilityImageMapLink.h b/WebCore/accessibility/AccessibilityImageMapLink.h
similarity index 96%
rename from WebCore/page/AccessibilityImageMapLink.h
rename to WebCore/accessibility/AccessibilityImageMapLink.h
index 7fc8d3c..2c27e46 100644
--- a/WebCore/page/AccessibilityImageMapLink.h
+++ b/WebCore/accessibility/AccessibilityImageMapLink.h
@@ -49,11 +49,12 @@
         
     virtual AccessibilityRole roleValue() const { return WebCoreLinkRole; }
     virtual bool accessibilityIsIgnored() const { return false; }
+    virtual bool isEnabled() const { return true; }
 
     virtual AccessibilityObject* parentObject() const;
     virtual Element* anchorElement() const;
     virtual Element* actionElement() const;
-    
+    virtual KURL url() const;
     virtual bool isLink() const { return true; } 
     virtual String title() const;
     virtual String accessibilityDescription() const;
diff --git a/WebCore/page/AccessibilityList.cpp b/WebCore/accessibility/AccessibilityList.cpp
similarity index 96%
rename from WebCore/page/AccessibilityList.cpp
rename to WebCore/accessibility/AccessibilityList.cpp
index 3097b3b..3b7c7a4 100644
--- a/WebCore/page/AccessibilityList.cpp
+++ b/WebCore/accessibility/AccessibilityList.cpp
@@ -56,10 +56,10 @@
 bool AccessibilityList::accessibilityIsIgnored() const
 {
     // lists don't appear on tiger/leopard on the mac
-#if PLATFORM(MAC) && (defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD))
-    return true;
-#else
+#if ACCESSIBILITY_LISTS
     return false;
+#else
+    return true;
 #endif
 }    
     
diff --git a/WebCore/page/AccessibilityList.h b/WebCore/accessibility/AccessibilityList.h
similarity index 93%
rename from WebCore/page/AccessibilityList.h
rename to WebCore/accessibility/AccessibilityList.h
index 315ccac..89befb2 100644
--- a/WebCore/page/AccessibilityList.h
+++ b/WebCore/accessibility/AccessibilityList.h
@@ -29,6 +29,12 @@
 #ifndef AccessibilityList_h
 #define AccessibilityList_h
 
+#if PLATFORM(MAC) && (defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD))
+#define ACCESSIBILITY_LISTS 0
+#else
+#define ACCESSIBILITY_LISTS 1
+#endif
+
 #include "AccessibilityRenderObject.h"
 
 namespace WebCore {
diff --git a/WebCore/page/AccessibilityListBox.cpp b/WebCore/accessibility/AccessibilityListBox.cpp
similarity index 88%
rename from WebCore/page/AccessibilityListBox.cpp
rename to WebCore/accessibility/AccessibilityListBox.cpp
index 37baec9..e38aff5 100644
--- a/WebCore/page/AccessibilityListBox.cpp
+++ b/WebCore/accessibility/AccessibilityListBox.cpp
@@ -74,10 +74,12 @@
     
     m_haveChildren = true;
     
-    const Vector<HTMLElement*>& listItems = static_cast<HTMLSelectElement*>(selectNode)->listItems();
+    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(selectNode)->listItems();
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++) {
-        AccessibilityObject* listOption = listBoxOptionAccessibilityObject(listItems[i]);
+        // The cast to HTMLElement below is safe because the only other possible listItem type
+        // would be a WMLElement, but WML builds don't use accessbility features at all.
+        AccessibilityObject* listOption = listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
         if (listOption)
             m_children.append(listOption);
     }
@@ -163,12 +165,14 @@
     
     IntRect parentRect = boundingBoxRect();
     
-    const Vector<HTMLElement*>& listItems = static_cast<HTMLSelectElement*>(node)->listItems();
+    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(node)->listItems();
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++) {
         IntRect rect = static_cast<RenderListBox*>(m_renderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), i);
+        // The cast to HTMLElement below is safe because the only other possible listItem type
+        // would be a WMLElement, but WML builds don't use accessbility features at all.
         if (rect.contains(point))
-            return listBoxOptionAccessibilityObject(listItems[i]);
+            return listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
     }
     
     return axObjectCache()->getOrCreate(m_renderer);
diff --git a/WebCore/page/AccessibilityListBox.h b/WebCore/accessibility/AccessibilityListBox.h
similarity index 100%
rename from WebCore/page/AccessibilityListBox.h
rename to WebCore/accessibility/AccessibilityListBox.h
diff --git a/WebCore/page/AccessibilityListBoxOption.cpp b/WebCore/accessibility/AccessibilityListBoxOption.cpp
similarity index 98%
rename from WebCore/page/AccessibilityListBoxOption.cpp
rename to WebCore/accessibility/AccessibilityListBoxOption.cpp
index 088c556..a5cd5da 100644
--- a/WebCore/page/AccessibilityListBoxOption.cpp
+++ b/WebCore/accessibility/AccessibilityListBoxOption.cpp
@@ -195,7 +195,7 @@
     if (!selectElement) 
         return -1;
     
-    const Vector<HTMLElement*>& listItems = selectElement->listItems();
+    const Vector<Element*>& listItems = selectElement->listItems();
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++)
         if (listItems[i] == m_optionElement)
diff --git a/WebCore/page/AccessibilityListBoxOption.h b/WebCore/accessibility/AccessibilityListBoxOption.h
similarity index 100%
rename from WebCore/page/AccessibilityListBoxOption.h
rename to WebCore/accessibility/AccessibilityListBoxOption.h
diff --git a/WebCore/page/AccessibilityObject.cpp b/WebCore/accessibility/AccessibilityObject.cpp
similarity index 99%
rename from WebCore/page/AccessibilityObject.cpp
rename to WebCore/accessibility/AccessibilityObject.cpp
index d5b7ff5..dccff82 100644
--- a/WebCore/page/AccessibilityObject.cpp
+++ b/WebCore/accessibility/AccessibilityObject.cpp
@@ -404,7 +404,7 @@
         if (!p.node())
             break;
         renderer = p.node()->renderer();
-        if (!renderer || (renderer->isRenderBlock() && !p.m_offset))
+        if (!renderer || (renderer->isRenderBlock() && !p.deprecatedEditingOffset()))
             break;
         InlineBox* box;
         int ignoredCaretOffset;
diff --git a/WebCore/page/AccessibilityObject.h b/WebCore/accessibility/AccessibilityObject.h
similarity index 98%
rename from WebCore/page/AccessibilityObject.h
rename to WebCore/accessibility/AccessibilityObject.h
index 9141b36..f71be99 100644
--- a/WebCore/page/AccessibilityObject.h
+++ b/WebCore/accessibility/AccessibilityObject.h
@@ -136,6 +136,8 @@
     DisclosureTriangleRole,
     GridRole,
     CellRole, 
+    ColumnHeaderRole,
+    RowHeaderRole,
     // AppKit includes SortButtonRole but it is misnamed and really a subrole of ButtonRole so we do not include it here.
 
     // WebCore-specific roles
@@ -252,7 +254,7 @@
     virtual int intValue() const;
     virtual float valueForRange() const { return 0.0f; }
     virtual float maxValueForRange() const { return 0.0f; }
-    virtual float minValueForRange() const {return 0.0f; }
+    virtual float minValueForRange() const { return 0.0f; }
     virtual int layoutCount() const;
     static bool isARIAControl(AccessibilityRole);
     static bool isARIAInput(AccessibilityRole);
@@ -270,6 +272,7 @@
     virtual AccessibilityObject* observableObject() const;
     virtual void linkedUIElements(AccessibilityChildrenVector&) const;
     virtual AccessibilityObject* titleUIElement() const;
+    virtual bool exposesTitleUIElement() const { return true; }
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
diff --git a/WebCore/page/AccessibilityRenderObject.cpp b/WebCore/accessibility/AccessibilityRenderObject.cpp
similarity index 94%
rename from WebCore/page/AccessibilityRenderObject.cpp
rename to WebCore/accessibility/AccessibilityRenderObject.cpp
index 8ed352a..8c522a1 100644
--- a/WebCore/page/AccessibilityRenderObject.cpp
+++ b/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -39,6 +39,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLAreaElement.h"
+#include "HTMLFormElement.h"
 #include "HTMLFrameElementBase.h"
 #include "HTMLImageElement.h"
 #include "HTMLInputElement.h"
@@ -53,10 +54,10 @@
 #include "HitTestResult.h"
 #include "LocalizedStrings.h"
 #include "NodeList.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "RenderFieldset.h"
 #include "RenderFileUploadControl.h"
+#include "RenderHTMLCanvas.h"
 #include "RenderImage.h"
 #include "RenderInline.h"
 #include "RenderListBox.h"
@@ -555,8 +556,8 @@
         return static_cast<Element*>(m_renderer->node());
     
     if (m_renderer->isMenuList())
-        return static_cast<RenderMenuList*>(m_renderer)->selectElement();
-    
+        return static_cast<Element*>(m_renderer->node());
+
     Element* elt = anchorElement();
     if (!elt)
         elt = mouseButtonListener();
@@ -568,12 +569,17 @@
     Node* node = m_renderer->node();
     if (!node)
         return 0;
-    if (!node->isElementNode())
+    
+    // check if our parent is a mouse button listener
+    while (node && !node->isElementNode())
+        node = node->parent();
+
+    if (!node)
         return 0;
 
     // FIXME: Do the continuation search like anchorElement does
     for (Element* element = static_cast<Element*>(node); element; element = element->parentElement()) {
-        if (element->inlineEventListenerForType(eventNames().clickEvent) || element->inlineEventListenerForType(eventNames().mousedownEvent) || element->inlineEventListenerForType(eventNames().mouseupEvent))
+        if (element->getAttributeEventListener(eventNames().clickEvent) || element->getAttributeEventListener(eventNames().mousedownEvent) || element->getAttributeEventListener(eventNames().mouseupEvent))
             return element;
     }
 
@@ -814,7 +820,7 @@
         if (idElement) {
             String nameFragment = accessibleNameForNode(idElement);
             ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement->nextSibling())) {
+            for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
                 nameFragment = accessibleNameForNode(n);
                 ariaLabel.append(nameFragment.characters(), nameFragment.length());
             }
@@ -908,6 +914,10 @@
         HTMLLabelElement* label = labelForElement(static_cast<Element*>(node));
         if (label && !titleUIElement())
             return label->innerText();
+        
+        const AtomicString& placeholder = getAttribute(placeholderAttr);
+        if (!placeholder.isEmpty())
+            return placeholder;
     }
     
     if (roleValue() == ButtonRole
@@ -941,7 +951,7 @@
     if (!ariaDescription.isEmpty())
         return ariaDescription;
     
-    if (isImage() || isInputImage()) {
+    if (isImage() || isInputImage() || isNativeImage()) {
         Node* node = m_renderer->node();
         if (node && node->isHTMLElement()) {
             const AtomicString& alt = static_cast<HTMLElement*>(node)->getAttribute(altAttr);
@@ -979,7 +989,6 @@
 
 IntRect AccessibilityRenderObject::boundingBoxRect() const
 {
-    IntRect rect;
     RenderObject* obj = m_renderer;
     
     if (!obj)
@@ -988,20 +997,22 @@
     if (obj->node()) // If we are a continuation, we want to make sure to use the primary renderer.
         obj = obj->node()->renderer();
     
-    // FIXME: This doesn't work correctly with transforms.
-    Vector<IntRect> rects;
-    FloatPoint absPos = obj->localToAbsolute();
-    obj->absoluteRects(rects, absPos.x(), absPos.y());
-    const size_t n = rects.size();
+    Vector<FloatQuad> quads;
+    obj->absoluteQuads(quads);
+    const size_t n = quads.size();
+    if (!n)
+        return IntRect();
+
+    IntRect result;
     for (size_t i = 0; i < n; ++i) {
-        IntRect r = rects[i];
+        IntRect r = quads[i].enclosingBoundingBox();
         if (!r.isEmpty()) {
             if (obj->style()->hasAppearance())
                 theme()->adjustRepaintRect(obj, r);
-            rect.unite(r);
+            result.unite(r);
         }
     }
-    return rect;
+    return result;
 }
     
 IntRect AccessibilityRenderObject::checkboxOrRadioRect() const
@@ -1124,6 +1135,18 @@
         addRadioButtonGroupMembers(linkedUIElements);
 }
 
+bool AccessibilityRenderObject::exposesTitleUIElement() const
+{
+    if (!isControl())
+        return false;
+
+    // checkbox or radio buttons don't expose the title ui element unless it has a title already
+    if (isCheckboxOrRadio() && getAttribute(titleAttr).isEmpty())
+        return false;
+    
+    return true;
+}
+    
 AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
 {
     if (!m_renderer)
@@ -1133,8 +1156,7 @@
     if (isFieldset())
         return axObjectCache()->getOrCreate(static_cast<RenderFieldset*>(m_renderer)->findLegend());
     
-    // checkbox and radio hide their labels. Only controls get titleUIElements for now
-    if (isCheckboxOrRadio() || !isControl())
+    if (!exposesTitleUIElement())
         return 0;
     
     Node* element = m_renderer->node();
@@ -1167,7 +1189,7 @@
         HTMLElement* correspondingControl = labelElement->correspondingControl();
         if (correspondingControl && correspondingControl->renderer()) {
             AccessibilityObject* controlObject = axObjectCache()->getOrCreate(correspondingControl->renderer());
-            if (controlObject->isCheckboxOrRadio())
+            if (!controlObject->exposesTitleUIElement())
                 return true;
         }
     }
@@ -1184,7 +1206,12 @@
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole ||
             parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
             return true;
-         return m_renderer->isBR() || !toRenderText(m_renderer)->firstTextBox();
+        RenderText* renderText = toRenderText(m_renderer);
+        if (m_renderer->isBR() || !renderText->firstTextBox())
+            return true;
+        
+        // text elements that are just empty whitespace should not be returned
+        return renderText->text()->containsOnlyWhitespace();
     }
     
     if (isHeading())
@@ -1218,6 +1245,13 @@
                 return true;
         }
         
+        if (node && node->hasTagName(canvasTag)) {
+            RenderHTMLCanvas* canvas = static_cast<RenderHTMLCanvas*>(m_renderer);
+            if (canvas->height() <= 1 || canvas->width() <= 1)
+                return true;
+            return false;
+        }
+        
         // check for one-dimensional image
         RenderImage* image = toRenderImage(m_renderer);
         if (image->height() <= 1 || image->width() <= 1)
@@ -1478,14 +1512,11 @@
 bool AccessibilityRenderObject::isEnabled() const
 {
     ASSERT(m_renderer);
-    if (!m_renderer->node() || !m_renderer->node()->isElementNode())
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
         return true;
 
-    FormControlElement* formControlElement = toFormControlElement(static_cast<Element*>(m_renderer->node()));
-    if (!formControlElement)
-        return true;
-
-    return formControlElement->isEnabled();    
+    return static_cast<Element*>(node)->isEnabledFormControl();
 }
 
 RenderView* AccessibilityRenderObject::topRenderer() const
@@ -1522,6 +1553,7 @@
     if (!m_renderer || !map)
         return 0;
 
+    String mapName = map->getName().string().lower();
     RefPtr<HTMLCollection> coll = m_renderer->document()->images();
     for (Node* curr = coll->firstItem(); curr; curr = coll->nextItem()) {
         RenderObject* obj = curr->renderer();
@@ -1530,7 +1562,8 @@
         
         // The HTMLImageElement's useMap() value includes the '#' symbol at the beginning,
         // which has to be stripped off
-        if (static_cast<HTMLImageElement*>(curr)->useMap().substring(1) == map->getName())
+        String useMapName = static_cast<HTMLImageElement*>(curr)->useMap().substring(1).lower();
+        if (useMapName == mapName)
             return axObjectCache()->getOrCreate(obj);
     }
     
@@ -1547,8 +1580,7 @@
         if (obj) {
             RefPtr<AccessibilityObject> axobj = document->axObjectCache()->getOrCreate(obj);
             ASSERT(axobj);
-            ASSERT(axobj->roleValue() == WebCoreLinkRole);
-            if (!axobj->accessibilityIsIgnored())
+            if (!axobj->accessibilityIsIgnored() && axobj->isLink())
                 result.append(axobj);
         } else {
             Node* parent = curr->parent();
@@ -1690,7 +1722,7 @@
     ExceptionCode ec = 0;
     RefPtr<Range> range = Range::create(m_renderer->document());
     range->setStart(node, 0, ec);
-    range->setEnd(indexPosition.node(), indexPosition.m_offset, ec);
+    range->setEnd(indexPosition.node(), indexPosition.deprecatedEditingOffset(), ec);
     return TextIterator::rangeLength(range.get());
 }
 
@@ -1918,6 +1950,27 @@
     return IntRect();
 }
 
+AccessibilityObject* AccessibilityRenderObject::accessibilityImageMapHitTest(HTMLAreaElement* area, const IntPoint& point) const
+{
+    if (!area)
+        return 0;
+    
+    HTMLMapElement *map = static_cast<HTMLMapElement*>(area->parent());
+    AccessibilityObject* parent = accessibilityParentForImageMap(map);
+    if (!parent)
+        return 0;
+    
+    AccessibilityObject::AccessibilityChildrenVector children = parent->children();
+    
+    unsigned count = children.size();
+    for (unsigned k = 0; k < count; ++k) {
+        if (children[k]->elementRect().contains(point))
+            return children[k].get();
+    }
+    
+    return 0;
+}
+    
 AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const IntPoint& point) const
 {
     if (!m_renderer || !m_renderer->hasLayer())
@@ -1932,6 +1985,10 @@
     if (!hitTestResult.innerNode())
         return 0;
     Node* node = hitTestResult.innerNode()->shadowAncestorNode();
+
+    if (node->hasTagName(areaTag)) 
+        return accessibilityImageMapHitTest(static_cast<HTMLAreaElement*>(node), point);
+    
     RenderObject* obj = node->renderer();
     if (!obj)
         return 0;
@@ -2039,7 +2096,7 @@
     AccessibilityRenderObject* activedescendant = static_cast<AccessibilityRenderObject*>(activeDescendant());
     
     if (activedescendant && shouldFocusActiveDescendant())
-        doc->axObjectCache()->postNotificationToElement(activedescendant->renderer(), "AXFocusedUIElementChanged");
+        doc->axObjectCache()->postNotification(activedescendant->renderer(), "AXFocusedUIElementChanged", true);
 }
 
 
@@ -2065,6 +2122,10 @@
     const RoleEntry roles[] = {
         { "button", ButtonRole },
         { "checkbox", CheckBoxRole },
+        { "grid", TableRole },
+        { "gridcell", CellRole },
+        { "columnheader", ColumnHeaderRole },
+        { "rowheader", RowHeaderRole },
         { "group", GroupRole },
         { "heading", HeadingRole },
         { "img", ImageRole },
@@ -2078,6 +2139,7 @@
         { "menuitemradio", MenuItemRole },
         { "progressbar", ProgressIndicatorRole },
         { "radio", RadioButtonRole },
+        { "row", RowRole },
         { "range", SliderRole },
         { "slider", SliderRole },
         { "spinbutton", ProgressIndicatorRole },
@@ -2161,6 +2223,9 @@
             return ButtonRole;
         return ImageRole;
     }
+    if (node && node->hasTagName(canvasTag))
+        return ImageRole;
+    
     if (m_renderer->isRenderView())
         return WebAreaRole;
     
@@ -2230,15 +2295,15 @@
 bool AccessibilityRenderObject::canSetFocusAttribute() const
 {
     ASSERT(m_renderer);
+    Node* node = m_renderer->node();
 
     // NOTE: It would be more accurate to ask the document whether setFocusedNode() would
     // do anything.  For example, it setFocusedNode() will do nothing if the current focused
     // node will not relinquish the focus.
-    if (!m_renderer->node() || !m_renderer->node()->isElementNode())
+    if (!node || !node->isElementNode())
         return false;
 
-    FormControlElement* formControlElement = toFormControlElement(static_cast<Element*>(m_renderer->node()));
-    if (formControlElement && !formControlElement->isEnabled())
+    if (!static_cast<Element*>(node)->isEnabledFormControl())
         return false;
 
     switch (roleValue()) {
@@ -2276,16 +2341,14 @@
     
     markChildrenDirty();
     
-    // This object may not be accessible (and thus may not appear
-    // in the hierarchy), which means we need to go up the parent
-    // chain and mark the parent's dirty. Ideally, we would want
-    // to only access the next object that is not ignored, but
-    // asking an element if it's ignored can lead to an examination of the
-    // render tree which is dangerous. 
-    // Only parents that already exist must be retrieved, otherwise objects can be created
-    // at bad times
-    for (AccessibilityObject* parent = parentObjectIfExists(); parent; parent = parent->parentObjectIfExists()) {
-        if (parent->isAccessibilityRenderObject())
+    if (!m_renderer)
+        return;
+    
+    // Go up the render parent chain, marking children as dirty.
+    // We can't rely on the accessibilityParent() because it may not exist and we must not create an AX object here either
+    for (RenderObject* renderParent = m_renderer->parent(); renderParent; renderParent = renderParent->parent()) {
+        AccessibilityObject* parent = m_renderer->document()->axObjectCache()->get(renderParent);
+        if (parent && parent->isAccessibilityRenderObject())
             static_cast<AccessibilityRenderObject *>(parent)->markChildrenDirty();
     }
 }
diff --git a/WebCore/page/AccessibilityRenderObject.h b/WebCore/accessibility/AccessibilityRenderObject.h
similarity index 98%
rename from WebCore/page/AccessibilityRenderObject.h
rename to WebCore/accessibility/AccessibilityRenderObject.h
index 5370eac..3fa88a2 100644
--- a/WebCore/page/AccessibilityRenderObject.h
+++ b/WebCore/accessibility/AccessibilityRenderObject.h
@@ -128,6 +128,7 @@
     virtual AccessibilityObject* parentObjectIfExists() const;
     virtual AccessibilityObject* observableObject() const;
     virtual void linkedUIElements(AccessibilityChildrenVector&) const;
+    virtual bool exposesTitleUIElement() const;
     virtual AccessibilityObject* titleUIElement() const;
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
@@ -233,6 +234,7 @@
     IntRect checkboxOrRadioRect() const;
     void addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const;
     AccessibilityObject* internalLinkElement() const;
+    AccessibilityObject* accessibilityImageMapHitTest(HTMLAreaElement*, const IntPoint&) const;
     AccessibilityObject* accessibilityParentForImageMap(HTMLMapElement* map) const;
 
     void markChildrenDirty() const { m_childrenDirty = true; }
diff --git a/WebCore/page/AccessibilityTable.cpp b/WebCore/accessibility/AccessibilityTable.cpp
similarity index 97%
rename from WebCore/page/AccessibilityTable.cpp
rename to WebCore/accessibility/AccessibilityTable.cpp
index 2b60d43..6d7dbe2 100644
--- a/WebCore/page/AccessibilityTable.cpp
+++ b/WebCore/accessibility/AccessibilityTable.cpp
@@ -53,10 +53,10 @@
     : AccessibilityRenderObject(renderer),
     m_headerContainer(0)
 {
-#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)
-    m_isAccessibilityTable = false;
-#else
+#if ACCESSIBILITY_TABLES
     m_isAccessibilityTable = isTableExposableThroughAccessibility();
+#else
+    m_isAccessibilityTable = false;
 #endif
 }
 
@@ -81,8 +81,6 @@
     // if the developer assigned an aria role to this, then we shouldn't 
     // expose it as a table, unless, of course, the aria role is a table
     AccessibilityRole ariaRole = ariaRoleAttribute();
-    if (ariaRole == TableRole)
-        return true;
     if (ariaRole != UnknownRole)
         return false;
     
@@ -211,7 +209,7 @@
     ASSERT(!m_haveChildren); 
     
     m_haveChildren = true;
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTable())
         return;
     
     RenderTable* table = static_cast<RenderTable*>(m_renderer);
@@ -352,7 +350,7 @@
     }
 }
     
-const unsigned AccessibilityTable::columnCount()
+unsigned AccessibilityTable::columnCount()
 {
     if (!hasChildren())
         addChildren();
@@ -360,7 +358,7 @@
     return m_columns.size();    
 }
     
-const unsigned AccessibilityTable::rowCount()
+unsigned AccessibilityTable::rowCount()
 {
     if (!hasChildren())
         addChildren();
@@ -370,7 +368,7 @@
     
 AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column, unsigned row)
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTable())
         return 0;
     
     if (!hasChildren())
@@ -467,7 +465,7 @@
     
     // see if there is a caption
     Node* tableElement = m_renderer->node();
-    if (tableElement) {
+    if (tableElement && tableElement->hasTagName(tableTag)) {
         HTMLTableCaptionElement* caption = static_cast<HTMLTableElement*>(tableElement)->caption();
         if (caption)
             title = caption->innerText();
diff --git a/WebCore/page/AccessibilityTable.h b/WebCore/accessibility/AccessibilityTable.h
similarity index 88%
rename from WebCore/page/AccessibilityTable.h
rename to WebCore/accessibility/AccessibilityTable.h
index b98b6b7..b6aa3ca 100644
--- a/WebCore/page/AccessibilityTable.h
+++ b/WebCore/accessibility/AccessibilityTable.h
@@ -31,6 +31,12 @@
 
 #include "AccessibilityRenderObject.h"
 
+#if PLATFORM(MAC) && (defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD))
+#define ACCESSIBILITY_TABLES 0
+#else
+#define ACCESSIBILITY_TABLES 1
+#endif
+
 namespace WebCore {
 
 class String;
@@ -39,7 +45,7 @@
     
 class AccessibilityTable : public AccessibilityRenderObject {
 
-private:
+protected:
     AccessibilityTable(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTable> create(RenderObject*);
@@ -47,6 +53,7 @@
     
     virtual bool isDataTable() const;
     virtual AccessibilityRole roleValue() const;
+    virtual bool isAriaTable() const { return false; }
     
     virtual bool accessibilityIsIgnored() const;
     
@@ -56,14 +63,14 @@
     AccessibilityChildrenVector& columns();
     AccessibilityChildrenVector& rows();
     
-    const unsigned columnCount();
-    const unsigned rowCount();
+    unsigned columnCount();
+    unsigned rowCount();
     
     virtual String title() const;
     
     // all the cells in the table
     void cells(AccessibilityChildrenVector&);
-    AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
+    virtual AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
     
     void columnHeaders(AccessibilityChildrenVector&);
     void rowHeaders(AccessibilityChildrenVector&);
@@ -71,7 +78,7 @@
     // an object that contains, as children, all the objects that act as headers
     AccessibilityObject* headerContainer();
     
-private:    
+protected:    
     AccessibilityChildrenVector m_rows;
     AccessibilityChildrenVector m_columns;
     
diff --git a/WebCore/page/AccessibilityTableCell.cpp b/WebCore/accessibility/AccessibilityTableCell.cpp
similarity index 90%
rename from WebCore/page/AccessibilityTableCell.cpp
rename to WebCore/accessibility/AccessibilityTableCell.cpp
index f7cbe98..4d7cf5a 100644
--- a/WebCore/page/AccessibilityTableCell.cpp
+++ b/WebCore/accessibility/AccessibilityTableCell.cpp
@@ -61,14 +61,19 @@
     
     return false;
 }
+   
+AccessibilityObject* AccessibilityTableCell::parentTable() const
+{
+    if (!m_renderer || !m_renderer->isTableCell())
+        return false;
+    
+    return axObjectCache()->getOrCreate(static_cast<RenderTableCell*>(m_renderer)->table());
+}
     
 bool AccessibilityTableCell::isTableCell() const
 {
-    if (!m_renderer)
-        return false;
-    
-    AccessibilityObject* renderTable = axObjectCache()->getOrCreate(static_cast<RenderTableCell*>(m_renderer)->table());
-    if (!renderTable->isDataTable())
+    AccessibilityObject* table = parentTable();
+    if (!table || !table->isDataTable())
         return false;
     
     return true;
@@ -84,7 +89,7 @@
     
 void AccessibilityTableCell::rowIndexRange(pair<int, int>& rowRange)
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTableCell())
         return;
     
     RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
@@ -114,7 +119,7 @@
     
 void AccessibilityTableCell::columnIndexRange(pair<int, int>& columnRange)
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTableCell())
         return;
     
     RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
@@ -127,7 +132,7 @@
     // Try to find if the first cell in this row is a <th>. If it is,
     // then it can act as the title ui element. (This is only in the
     // case when the table is not appearing as an AXTable.)
-    if (!m_renderer || isTableCell())
+    if (isTableCell() || !m_renderer || !m_renderer->isTableCell())
         return 0;
     
     RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
diff --git a/WebCore/page/AccessibilityTableCell.h b/WebCore/accessibility/AccessibilityTableCell.h
similarity index 92%
rename from WebCore/page/AccessibilityTableCell.h
rename to WebCore/accessibility/AccessibilityTableCell.h
index 8f8dd77..dabbce2 100644
--- a/WebCore/page/AccessibilityTableCell.h
+++ b/WebCore/accessibility/AccessibilityTableCell.h
@@ -35,7 +35,7 @@
     
 class AccessibilityTableCell : public AccessibilityRenderObject {
     
-private:
+protected:
     AccessibilityTableCell(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTableCell> create(RenderObject*);
@@ -47,17 +47,17 @@
     virtual bool accessibilityIsIgnored() const;
 
     // fills in the start location and row span of cell
-    void rowIndexRange(pair<int, int>& rowRange);
+    virtual void rowIndexRange(pair<int, int>& rowRange);
     // fills in the start location and column span of cell
-    void columnIndexRange(pair<int, int>& columnRange);
+    virtual void columnIndexRange(pair<int, int>& columnRange);
     
     // if a table cell is not exposed as a table cell, a TH element can
     // serve as its title ui element
     AccessibilityObject* titleUIElement() const;
     
-private:
+protected:
+    virtual AccessibilityObject* parentTable() const;
     int m_rowIndex;
-    
 }; 
     
 } // namespace WebCore 
diff --git a/WebCore/page/AccessibilityTableColumn.cpp b/WebCore/accessibility/AccessibilityTableColumn.cpp
similarity index 88%
rename from WebCore/page/AccessibilityTableColumn.cpp
rename to WebCore/accessibility/AccessibilityTableColumn.cpp
index ff330c0..ee79444 100644
--- a/WebCore/page/AccessibilityTableColumn.cpp
+++ b/WebCore/accessibility/AccessibilityTableColumn.cpp
@@ -61,7 +61,6 @@
     m_parentTable = table;
     
     clearChildren();
-    addChildren();
 }
     
 IntRect AccessibilityTableColumn::elementRect() const
@@ -87,7 +86,26 @@
     if (!m_parentTable)
         return 0;
     
-    RenderTable* table = static_cast<RenderTable*>(m_parentTable->renderer());
+    RenderObject* renderer = m_parentTable->renderer();
+    if (!renderer)
+        return 0;
+    
+    if (m_parentTable->isAriaTable()) {
+        AccessibilityChildrenVector rowChildren = children();
+        unsigned childrenCount = rowChildren.size();
+        for (unsigned i = 0; i < childrenCount; ++i) {
+            AccessibilityObject* cell = rowChildren[i].get();
+            if (cell->ariaRoleAttribute() == ColumnHeaderRole)
+                return cell;
+        }
+        
+        return 0;
+    }
+
+    if (!renderer->isTable())
+        return 0;
+    
+    RenderTable* table = static_cast<RenderTable*>(renderer);
     
     AccessibilityObject* headerObject = 0;
     
diff --git a/WebCore/page/AccessibilityTableColumn.h b/WebCore/accessibility/AccessibilityTableColumn.h
similarity index 100%
rename from WebCore/page/AccessibilityTableColumn.h
rename to WebCore/accessibility/AccessibilityTableColumn.h
diff --git a/WebCore/page/AccessibilityTableHeaderContainer.cpp b/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
similarity index 100%
rename from WebCore/page/AccessibilityTableHeaderContainer.cpp
rename to WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
diff --git a/WebCore/page/AccessibilityTableHeaderContainer.h b/WebCore/accessibility/AccessibilityTableHeaderContainer.h
similarity index 100%
rename from WebCore/page/AccessibilityTableHeaderContainer.h
rename to WebCore/accessibility/AccessibilityTableHeaderContainer.h
diff --git a/WebCore/page/AccessibilityTableRow.cpp b/WebCore/accessibility/AccessibilityTableRow.cpp
similarity index 89%
rename from WebCore/page/AccessibilityTableRow.cpp
rename to WebCore/accessibility/AccessibilityTableRow.cpp
index e67fcfe..9f5f972 100644
--- a/WebCore/page/AccessibilityTableRow.cpp
+++ b/WebCore/accessibility/AccessibilityTableRow.cpp
@@ -67,11 +67,8 @@
 
 bool AccessibilityTableRow::isTableRow() const
 {
-    if (!m_renderer)
-        return true;
-    
-    AccessibilityObject* renderTable = axObjectCache()->getOrCreate(static_cast<RenderTableRow*>(m_renderer)->table());
-    if (!renderTable->isDataTable())
+    AccessibilityObject* table = parentTable();
+    if (!table || !table->isDataTable())
         return false;
     
     return true;
@@ -85,8 +82,19 @@
     return false;
 }
     
+AccessibilityObject* AccessibilityTableRow::parentTable() const
+{
+    if (!m_renderer || !m_renderer->isTableRow())
+        return 0;
+    
+    return axObjectCache()->getOrCreate(static_cast<RenderTableRow*>(m_renderer)->table());
+}
+    
 AccessibilityObject* AccessibilityTableRow::headerObject()
 {
+    if (!m_renderer || !m_renderer->isTableRow())
+        return 0;
+    
     AccessibilityChildrenVector rowChildren = children();
     if (!rowChildren.size())
         return 0;
diff --git a/WebCore/page/AccessibilityTableRow.h b/WebCore/accessibility/AccessibilityTableRow.h
similarity index 95%
rename from WebCore/page/AccessibilityTableRow.h
rename to WebCore/accessibility/AccessibilityTableRow.h
index 0ec7f04..29ac935 100644
--- a/WebCore/page/AccessibilityTableRow.h
+++ b/WebCore/accessibility/AccessibilityTableRow.h
@@ -35,7 +35,7 @@
     
 class AccessibilityTableRow : public AccessibilityRenderObject {
     
-private:
+protected:
     AccessibilityTableRow(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTableRow> create(RenderObject*);
@@ -43,11 +43,11 @@
     
     virtual bool isTableRow() const;
     virtual AccessibilityRole roleValue() const;
+    virtual bool accessibilityIsIgnored() const;
 
     // retrieves the "row" header (a th tag in the rightmost column)
-    AccessibilityObject* headerObject();
-
-    virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityObject* headerObject();
+    virtual AccessibilityObject* parentTable() const;
     
     void setRowIndex(int rowIndex) { m_rowIndex = rowIndex; }
     int rowIndex() const { return m_rowIndex; }
diff --git a/WebCore/page/chromium/AXObjectCacheChromium.cpp b/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
similarity index 92%
rename from WebCore/page/chromium/AXObjectCacheChromium.cpp
rename to WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
index bbaf21d..d0f1882 100644
--- a/WebCore/page/chromium/AXObjectCacheChromium.cpp
+++ b/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
@@ -43,11 +43,7 @@
     // In Chromium, AccessibilityObjects are wrapped lazily.
 }
 
-void AXObjectCache::postNotification(RenderObject*, const String&)
-{
-}
-
-void AXObjectCache::postNotificationToElement(RenderObject*, const String&)
+void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&)
 {
 }
 
diff --git a/WebCore/page/chromium/AccessibilityObjectChromium.cpp b/WebCore/accessibility/chromium/AccessibilityObjectChromium.cpp
similarity index 100%
rename from WebCore/page/chromium/AccessibilityObjectChromium.cpp
rename to WebCore/accessibility/chromium/AccessibilityObjectChromium.cpp
diff --git a/WebCore/page/chromium/AccessibilityObjectWrapper.h b/WebCore/accessibility/chromium/AccessibilityObjectWrapper.h
similarity index 98%
rename from WebCore/page/chromium/AccessibilityObjectWrapper.h
rename to WebCore/accessibility/chromium/AccessibilityObjectWrapper.h
index 6420b32..d7238e1 100644
--- a/WebCore/page/chromium/AccessibilityObjectWrapper.h
+++ b/WebCore/accessibility/chromium/AccessibilityObjectWrapper.h
@@ -42,7 +42,7 @@
             : m_object(obj)
         {
             // FIXME: Remove this once our immediate subclass no longer uses COM.
-            m_refCount = 0;
+            *addressOfCount() = 0;
         }
         AccessibilityObjectWrapper() : m_object(0) { }
 
diff --git a/WebCore/page/gtk/AXObjectCacheAtk.cpp b/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
similarity index 64%
rename from WebCore/page/gtk/AXObjectCacheAtk.cpp
rename to WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
index 3535cf1..25665b1 100644
--- a/WebCore/page/gtk/AXObjectCacheAtk.cpp
+++ b/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
@@ -37,16 +37,26 @@
     g_object_unref(atkObj);
 }
 
-void AXObjectCache::postNotification(RenderObject*, const String&)
+void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&)
 {
 }
-
-void AXObjectCache::postNotificationToElement(RenderObject*, const String&)
-{
-}
-
+    
 void AXObjectCache::handleFocusedUIElementChanged()
 {
 }
 
+void AXObjectCache::handleFocusedUIElementChangedWithRenderers(RenderObject* oldFocusedRender, RenderObject* newFocusedRender)
+{
+    RefPtr<AccessibilityObject> oldObject = getOrCreate(oldFocusedRender);
+    if (oldObject) {
+        g_signal_emit_by_name(oldObject->wrapper(), "focus-event", false);
+        g_signal_emit_by_name(oldObject->wrapper(), "state-change", "focused", false);
+    }
+    RefPtr<AccessibilityObject> newObject = getOrCreate(newFocusedRender);
+    if (newObject) {
+        g_signal_emit_by_name(newObject->wrapper(), "focus-event", true);
+        g_signal_emit_by_name(newObject->wrapper(), "state-change", "focused", true);
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/gtk/AccessibilityObjectAtk.cpp b/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
similarity index 71%
rename from WebCore/page/gtk/AccessibilityObjectAtk.cpp
rename to WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
index 1710027..854816f 100644
--- a/WebCore/page/gtk/AccessibilityObjectAtk.cpp
+++ b/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Ltd.
+ * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -20,6 +21,8 @@
 #include "config.h"
 #include "AccessibilityObject.h"
 
+#include <glib-object.h>
+
 #if HAVE(ACCESSIBILITY)
 
 namespace WebCore {
@@ -29,6 +32,25 @@
     return false;
 }
 
+AccessibilityObjectWrapper* AccessibilityObject::wrapper() const
+{
+    return m_wrapper;
+}
+
+void AccessibilityObject::setWrapper(AccessibilityObjectWrapper* wrapper)
+{
+    if (wrapper == m_wrapper)
+        return;
+
+    if (m_wrapper)
+        g_object_unref(m_wrapper);
+
+    m_wrapper = wrapper;
+
+    if (m_wrapper)
+        g_object_ref(m_wrapper);
+}
+
 } // namespace WebCore
 
 #endif // HAVE(ACCESSIBILITY)
diff --git a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
new file mode 100644
index 0000000..141d561
--- /dev/null
+++ b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -0,0 +1,1189 @@
+/*
+ * Copyright (C) 2008 Nuanti Ltd.
+ * Copyright (C) 2009 Igalia S.L.
+ *
+ * Portions from Mozilla a11y, copyright as follows:
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Sun Microsystems, Inc.
+ * Portions created by the Initial Developer are Copyright (C) 2002
+ * the Initial Developer. All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "AccessibilityObjectWrapperAtk.h"
+
+#if HAVE(ACCESSIBILITY)
+
+#include "AXObjectCache.h"
+#include "AccessibilityListBox.h"
+#include "AccessibilityRenderObject.h"
+#include "AtomicString.h"
+#include "CString.h"
+#include "Document.h"
+#include "Editor.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "HTMLNames.h"
+#include "IntRect.h"
+#include "NotImplemented.h"
+
+#include <atk/atk.h>
+#include <glib.h>
+#include <glib/gprintf.h>
+#include <pango/pango.h>
+
+using namespace WebCore;
+
+static AccessibilityObject* fallbackObject()
+{
+    static AXObjectCache* fallbackCache = new AXObjectCache();
+    static AccessibilityObject* object = 0;
+    if (!object) {
+        // FIXME: using fallbackCache->getOrCreate(ListBoxOptionRole) is a hack
+        object = fallbackCache->getOrCreate(ListBoxOptionRole);
+        object->ref();
+    }
+
+    return object;
+}
+
+// Used to provide const char* returns.
+static const char* returnString(const String& str)
+{
+    static CString returnedString;
+    returnedString = str.utf8();
+    return returnedString.data();
+}
+
+static AccessibilityObject* core(WebKitAccessible* accessible)
+{
+    if (!accessible)
+        return 0;
+
+    return accessible->m_object;
+}
+
+static AccessibilityObject* core(AtkObject* object)
+{
+    if (!WEBKIT_IS_ACCESSIBLE(object))
+        return 0;
+
+    return core(WEBKIT_ACCESSIBLE(object));
+}
+
+static AccessibilityObject* core(AtkAction* action)
+{
+    return core(ATK_OBJECT(action));
+}
+
+static AccessibilityObject* core(AtkStreamableContent* streamable)
+{
+    return core(ATK_OBJECT(streamable));
+}
+
+static AccessibilityObject* core(AtkText* text)
+{
+    return core(ATK_OBJECT(text));
+}
+
+static AccessibilityObject* core(AtkEditableText* text)
+{
+    return core(ATK_OBJECT(text));
+}
+
+static AccessibilityObject* core(AtkComponent* component)
+{
+    return core(ATK_OBJECT(component));
+}
+
+static AccessibilityObject* core(AtkImage* image)
+{
+    return core(ATK_OBJECT(image));
+}
+
+static const gchar* webkit_accessible_get_name(AtkObject* object)
+{
+    return returnString(core(object)->stringValue());
+}
+
+static const gchar* webkit_accessible_get_description(AtkObject* object)
+{
+    // TODO: the Mozilla MSAA implementation prepends "Description: "
+    // Should we do this too?
+    return returnString(core(object)->accessibilityDescription());
+}
+
+static AtkObject* webkit_accessible_get_parent(AtkObject* object)
+{
+    AccessibilityObject* coreParent = core(object)->parentObject();
+
+    if (!coreParent)
+        return NULL;
+
+    return coreParent->wrapper();
+}
+
+static gint webkit_accessible_get_n_children(AtkObject* object)
+{
+    return core(object)->children().size();
+}
+
+static AtkObject* webkit_accessible_ref_child(AtkObject* object, gint index)
+{
+    AccessibilityObject* coreObject = core(object);
+
+    g_return_val_if_fail(index >= 0, NULL);
+    g_return_val_if_fail(static_cast<size_t>(index) < coreObject->children().size(), NULL);
+
+    AccessibilityObject* coreChild = coreObject->children().at(index).get();
+
+    if (!coreChild)
+        return NULL;
+
+    AtkObject* child = coreChild->wrapper();
+    // TODO: Should we call atk_object_set_parent() here?
+    //atk_object_set_parent(child, object);
+    g_object_ref(child);
+
+    return child;
+}
+
+static gint webkit_accessible_get_index_in_parent(AtkObject* object)
+{
+    // FIXME: This needs to be implemented.
+    notImplemented();
+    return 0;
+}
+
+static AtkRole atkRole(AccessibilityRole role)
+{
+    switch (role) {
+    case UnknownRole:
+        return ATK_ROLE_UNKNOWN;
+    case ButtonRole:
+        return ATK_ROLE_PUSH_BUTTON;
+    case RadioButtonRole:
+        return ATK_ROLE_RADIO_BUTTON;
+    case CheckBoxRole:
+        return ATK_ROLE_CHECK_BOX;
+    case SliderRole:
+        return ATK_ROLE_SLIDER;
+    case TabGroupRole:
+        return ATK_ROLE_PAGE_TAB_LIST;
+    case TextFieldRole:
+    case TextAreaRole:
+        return ATK_ROLE_ENTRY;
+    case StaticTextRole:
+        return ATK_ROLE_TEXT;
+    case OutlineRole:
+        return ATK_ROLE_TREE;
+    case MenuBarRole:
+        return ATK_ROLE_MENU_BAR;
+    case MenuRole:
+        return ATK_ROLE_MENU;
+    case MenuItemRole:
+        return ATK_ROLE_MENU_ITEM;
+    case ColumnRole:
+        //return ATK_ROLE_TABLE_COLUMN_HEADER; // Is this right?
+        return ATK_ROLE_UNKNOWN; // Matches Mozilla
+    case RowRole:
+        //return ATK_ROLE_TABLE_ROW_HEADER; // Is this right?
+        return ATK_ROLE_LIST_ITEM; // Matches Mozilla
+    case ToolbarRole:
+        return ATK_ROLE_TOOL_BAR;
+    case BusyIndicatorRole:
+        return ATK_ROLE_PROGRESS_BAR; // Is this right?
+    case ProgressIndicatorRole:
+        //return ATK_ROLE_SPIN_BUTTON; // Some confusion about this role in AccessibilityRenderObject.cpp
+        return ATK_ROLE_PROGRESS_BAR;
+    case WindowRole:
+        return ATK_ROLE_WINDOW;
+    case ComboBoxRole:
+        return ATK_ROLE_COMBO_BOX;
+    case SplitGroupRole:
+        return ATK_ROLE_SPLIT_PANE;
+    case SplitterRole:
+        return ATK_ROLE_SEPARATOR;
+    case ColorWellRole:
+        return ATK_ROLE_COLOR_CHOOSER;
+    case ListRole:
+        return ATK_ROLE_LIST;
+    case ScrollBarRole:
+        return ATK_ROLE_SCROLL_BAR;
+    case GridRole: // Is this right?
+    case TableRole:
+        return ATK_ROLE_TABLE;
+    case ApplicationRole:
+        return ATK_ROLE_APPLICATION;
+    //case LabelRole: // TODO: should this be covered in the switch?
+    //    return ATK_ROLE_LABEL;
+    case GroupRole:
+    case RadioGroupRole:
+        return ATK_ROLE_PANEL;
+    case CellRole:
+        return ATK_ROLE_TABLE_CELL;
+    case LinkRole:
+    case WebCoreLinkRole:
+    case ImageMapLinkRole:
+        return ATK_ROLE_LINK;
+    case ImageMapRole:
+    case ImageRole:
+        return ATK_ROLE_IMAGE;
+    case ListMarkerRole:
+        return ATK_ROLE_TEXT;
+    case WebAreaRole:
+        //return ATK_ROLE_HTML_CONTAINER; // Is this right?
+        return ATK_ROLE_DOCUMENT_FRAME;
+    case HeadingRole:
+        return ATK_ROLE_HEADING;
+    case ListBoxRole:
+        return ATK_ROLE_LIST;
+    case ListBoxOptionRole:
+        return ATK_ROLE_LIST_ITEM;
+    default:
+        return ATK_ROLE_UNKNOWN;
+    }
+}
+
+static AtkRole webkit_accessible_get_role(AtkObject* object)
+{
+    AccessibilityObject* AXObject = core(object);
+
+    if (!AXObject)
+        return ATK_ROLE_UNKNOWN;
+
+    // WebCore does not seem to have a role for list items
+    if (AXObject->isGroup()) {
+        AccessibilityObject* parent = AXObject->parentObjectUnignored();
+        if (parent && parent->isList())
+            return ATK_ROLE_LIST_ITEM;
+    }
+
+    // WebCore does not know about paragraph role
+    Node* node = static_cast<AccessibilityRenderObject*>(AXObject)->renderer()->node();
+    if (node && node->hasTagName(HTMLNames::pTag))
+        return ATK_ROLE_PARAGRAPH;
+
+    // Note: Why doesn't WebCore have a password field for this
+    if (AXObject->isPasswordField())
+        return ATK_ROLE_PASSWORD_TEXT;
+
+    return atkRole(AXObject->roleValue());
+}
+
+static void setAtkStateSetFromCoreObject(AccessibilityObject* coreObject, AtkStateSet* stateSet)
+{
+    // Please keep the state list in alphabetical order
+
+    if (coreObject->isChecked())
+        atk_state_set_add_state(stateSet, ATK_STATE_CHECKED);
+
+    if (!coreObject->isReadOnly())
+        atk_state_set_add_state(stateSet, ATK_STATE_EDITABLE);
+
+    if (coreObject->isEnabled())
+        atk_state_set_add_state(stateSet, ATK_STATE_ENABLED);
+
+    if (coreObject->canSetFocusAttribute())
+        atk_state_set_add_state(stateSet, ATK_STATE_FOCUSABLE);
+
+    if (coreObject->isFocused())
+        atk_state_set_add_state(stateSet, ATK_STATE_FOCUSED);
+
+    // TODO: ATK_STATE_HORIZONTAL
+
+    if (coreObject->isIndeterminate())
+        atk_state_set_add_state(stateSet, ATK_STATE_INDETERMINATE);
+
+    if (coreObject->isMultiSelect())
+        atk_state_set_add_state(stateSet, ATK_STATE_MULTISELECTABLE);
+
+    // TODO: ATK_STATE_OPAQUE
+
+    if (coreObject->isPressed())
+        atk_state_set_add_state(stateSet, ATK_STATE_PRESSED);
+
+    // TODO: ATK_STATE_SELECTABLE_TEXT
+
+    // TODO: ATK_STATE_SENSITIVE
+
+    if (coreObject->isSelected())
+        atk_state_set_add_state(stateSet, ATK_STATE_SELECTED);
+
+    if (!coreObject->isOffScreen())
+        atk_state_set_add_state(stateSet, ATK_STATE_SHOWING);
+
+    // Mutually exclusive, so we group these two
+    if (coreObject->roleValue() == TextFieldRole)
+        atk_state_set_add_state(stateSet, ATK_STATE_SINGLE_LINE);
+    else if (coreObject->roleValue() == TextAreaRole)
+        atk_state_set_add_state(stateSet, ATK_STATE_MULTI_LINE);
+
+    // TODO: ATK_STATE_SENSITIVE
+
+    // TODO: ATK_STATE_VERTICAL
+
+    if (coreObject->isVisited())
+        atk_state_set_add_state(stateSet, ATK_STATE_VISITED);
+}
+
+static gpointer webkit_accessible_parent_class = NULL;
+
+static AtkStateSet* webkit_accessible_ref_state_set(AtkObject* object)
+{
+    AtkStateSet* stateSet = ATK_OBJECT_CLASS(webkit_accessible_parent_class)->ref_state_set(object);
+    AccessibilityObject* coreObject = core(object);
+
+    if (coreObject == fallbackObject()) {
+        atk_state_set_add_state(stateSet, ATK_STATE_DEFUNCT);
+        return stateSet;
+    }
+
+    setAtkStateSetFromCoreObject(coreObject, stateSet);
+
+    return stateSet;
+}
+
+static void webkit_accessible_init(AtkObject* object, gpointer data)
+{
+    if (ATK_OBJECT_CLASS(webkit_accessible_parent_class)->initialize)
+        ATK_OBJECT_CLASS(webkit_accessible_parent_class)->initialize(object, data);
+
+    WEBKIT_ACCESSIBLE(object)->m_object = reinterpret_cast<AccessibilityObject*>(data);
+}
+
+static void webkit_accessible_finalize(GObject* object)
+{
+    // This is a good time to clear the return buffer.
+    returnString(String());
+
+    if (G_OBJECT_CLASS(webkit_accessible_parent_class)->finalize)
+        G_OBJECT_CLASS(webkit_accessible_parent_class)->finalize(object);
+}
+
+static void webkit_accessible_class_init(AtkObjectClass* klass)
+{
+    GObjectClass* gobjectClass = G_OBJECT_CLASS(klass);
+
+    webkit_accessible_parent_class = g_type_class_peek_parent(klass);
+
+    gobjectClass->finalize = webkit_accessible_finalize;
+
+    klass->initialize = webkit_accessible_init;
+    klass->get_name = webkit_accessible_get_name;
+    klass->get_description = webkit_accessible_get_description;
+    klass->get_parent = webkit_accessible_get_parent;
+    klass->get_n_children = webkit_accessible_get_n_children;
+    klass->ref_child = webkit_accessible_ref_child;
+    klass->get_role = webkit_accessible_get_role;
+    klass->ref_state_set = webkit_accessible_ref_state_set;
+}
+
+GType
+webkit_accessible_get_type(void)
+{
+    static volatile gsize type_volatile = 0;
+
+    if (g_once_init_enter(&type_volatile)) {
+        static const GTypeInfo tinfo = {
+            sizeof(WebKitAccessibleClass),
+            (GBaseInitFunc)NULL,
+            (GBaseFinalizeFunc)NULL,
+            (GClassInitFunc)webkit_accessible_class_init,
+            (GClassFinalizeFunc)NULL,
+            NULL, /* class data */
+            sizeof(WebKitAccessible), /* instance size */
+            0, /* nb preallocs */
+            (GInstanceInitFunc)NULL,
+            NULL /* value table */
+        };
+
+        GType type = g_type_register_static(ATK_TYPE_OBJECT,
+                                            "WebKitAccessible", &tinfo, GTypeFlags(0));
+        g_once_init_leave(&type_volatile, type);
+    }
+
+    return type_volatile;
+}
+
+static gboolean webkit_accessible_action_do_action(AtkAction* action, gint i)
+{
+    g_return_val_if_fail(i == 0, FALSE);
+    return core(action)->performDefaultAction();
+}
+
+static gint webkit_accessible_action_get_n_actions(AtkAction* action)
+{
+    return 1;
+}
+
+static const gchar* webkit_accessible_action_get_description(AtkAction* action, gint i)
+{
+    g_return_val_if_fail(i == 0, NULL);
+    // TODO: Need a way to provide/localize action descriptions.
+    notImplemented();
+    return "";
+}
+
+static const gchar* webkit_accessible_action_get_keybinding(AtkAction* action, gint i)
+{
+    g_return_val_if_fail(i == 0, NULL);
+    // FIXME: Construct a proper keybinding string.
+    return returnString(core(action)->accessKey().string());
+}
+
+static const gchar* webkit_accessible_action_get_name(AtkAction* action, gint i)
+{
+    g_return_val_if_fail(i == 0, NULL);
+    return returnString(core(action)->actionVerb());
+}
+
+static void atk_action_interface_init(AtkActionIface* iface)
+{
+    iface->do_action = webkit_accessible_action_do_action;
+    iface->get_n_actions = webkit_accessible_action_get_n_actions;
+    iface->get_description = webkit_accessible_action_get_description;
+    iface->get_keybinding = webkit_accessible_action_get_keybinding;
+    iface->get_name = webkit_accessible_action_get_name;
+}
+
+// Text
+
+static gchar* webkit_accessible_text_get_text(AtkText* text, gint startOffset, gint endOffset)
+{
+    AccessibilityObject* coreObject = core(text);
+    String ret;
+    unsigned start = startOffset;
+    int length = endOffset - startOffset;
+
+    if (coreObject->isTextControl())
+        ret = coreObject->doAXStringForRange(PlainTextRange(start, length));
+    else
+        ret = coreObject->textUnderElement().substring(start, length);
+
+    return g_strdup(ret.utf8().data());
+}
+
+enum GetTextFunctionType {
+    AfterOffset,
+    AtOffset,
+    BeforeOffset
+};
+
+typedef bool (*isCharacterAttribute) (PangoLogAttr* attr);
+
+static inline bool isWordStart(PangoLogAttr* attr)
+{
+    return attr->is_word_start;
+}
+
+static inline bool isWordEnd(PangoLogAttr* attr)
+{
+    return attr->is_word_end;
+}
+
+static inline bool isSentenceStart(PangoLogAttr* attr)
+{
+    return attr->is_sentence_start;
+}
+
+static inline bool isSentenceEnd(PangoLogAttr* attr)
+{
+    return attr->is_sentence_end;
+}
+
+enum Direction {
+    DirectionForward,
+    DirectionBackwards
+};
+
+static bool findCharacterAttribute(isCharacterAttribute predicateFunction, PangoLogAttr* attributes, Direction direction, int startOffset, int attrsLength, int* resultOffset)
+{
+    int advanceBy = direction == DirectionForward ? 1 : -1;
+
+    *resultOffset = -1;
+
+    for (int i = startOffset; i >= 0 && i < attrsLength; i += advanceBy) {
+        if (predicateFunction(attributes + i)) {
+            *resultOffset = i;
+            return true;
+        }
+    }
+
+    return false;
+}
+
+static bool findCharacterAttributeSkip(isCharacterAttribute predicateFunction, unsigned skip, PangoLogAttr* attributes, Direction direction, int startOffset, int attrsLength, int* resultOffset)
+{
+    int tmpOffset;
+
+    bool retValue = findCharacterAttribute(predicateFunction, attributes, direction, startOffset, attrsLength, &tmpOffset);
+    if (skip == 0) {
+        *resultOffset = tmpOffset;
+        return retValue;
+    }
+
+    if (direction == DirectionForward)
+        tmpOffset++;
+    else
+        tmpOffset--;
+
+    return findCharacterAttributeSkip(predicateFunction, skip - 1, attributes, direction, tmpOffset, attrsLength, resultOffset);
+}
+
+static isCharacterAttribute oppositePredicate(isCharacterAttribute predicate)
+{
+    if (predicate == isWordStart)
+        return isWordEnd;
+    if (predicate == isWordEnd)
+        return isWordStart;
+    if (predicate == isSentenceStart)
+        return isSentenceEnd;
+    if (predicate == isSentenceEnd)
+        return isSentenceStart;
+
+    g_assert_not_reached();
+}
+
+static gchar* getTextHelper(GetTextFunctionType getTextFunctionType, AtkText* textObject, gint offset, AtkTextBoundary boundaryType, gint* startOffset, gint* endOffset)
+{
+    AccessibilityObject* coreObject = core(textObject);
+    String text;
+
+    *startOffset = *endOffset = -1;
+
+    if (coreObject->isTextControl())
+        text = coreObject->text();
+    else
+        text = coreObject->textUnderElement();
+
+    char* cText = g_strdup(text.utf8().data());
+    glong textLength = g_utf8_strlen(cText, -1);
+
+    if (boundaryType == ATK_TEXT_BOUNDARY_CHAR) {
+        int effectiveOffset;
+
+        switch (getTextFunctionType) {
+        case AfterOffset:
+            effectiveOffset = offset + 1;
+            break;
+        case BeforeOffset:
+            effectiveOffset = offset - 1;
+            break;
+        case AtOffset:
+            effectiveOffset = offset;
+            break;
+        default:
+            g_assert_not_reached();
+        }
+
+        *startOffset = effectiveOffset;
+        *endOffset = effectiveOffset + 1;
+    } else {
+        PangoLogAttr* attrs = g_new(PangoLogAttr, textLength + 1);
+        PangoLanguage* language = pango_language_get_default();
+        pango_get_log_attrs(cText, -1, -1, language, attrs, textLength + 1);
+      
+        isCharacterAttribute predicate;
+
+        if (boundaryType == ATK_TEXT_BOUNDARY_WORD_START)
+            predicate = isWordStart;
+        else if (boundaryType == ATK_TEXT_BOUNDARY_WORD_END)
+            predicate = isWordEnd;
+        else if (boundaryType == ATK_TEXT_BOUNDARY_SENTENCE_START)
+            predicate = isSentenceStart;
+        else if (boundaryType == ATK_TEXT_BOUNDARY_SENTENCE_END)
+            predicate = isSentenceEnd;
+        else
+            // FIXME: bail out for now, since we are missing the LINE
+            // boundary implementations
+            goto out;
+
+        switch (boundaryType) {
+        case ATK_TEXT_BOUNDARY_WORD_START:
+        case ATK_TEXT_BOUNDARY_SENTENCE_START:
+            if (getTextFunctionType == AfterOffset) {
+                // Take the item after the current one in any case
+                findCharacterAttribute(predicate, attrs, DirectionForward, offset + 1, textLength + 1, startOffset);
+                findCharacterAttributeSkip(predicate, 1, attrs, DirectionForward, offset + 1, textLength + 1, endOffset);
+            } else if (getTextFunctionType == AtOffset) {
+                // Take the item at point if the offset is in an item or
+                // the item before otherwise
+                findCharacterAttribute(predicate, attrs, DirectionBackwards, offset, textLength + 1, startOffset);
+                if (!findCharacterAttribute(predicate, attrs, DirectionForward, offset + 1, textLength + 1, endOffset)) {
+                    findCharacterAttribute(oppositePredicate(predicate), attrs, DirectionForward, offset + 1, textLength + 1, endOffset);
+                    // We want to include the actual end boundary
+                    // here, since *_START would have done so. Advance
+                    // until the end of the string if possible
+                    if (*endOffset != -1 && *endOffset < textLength)
+                        *endOffset = textLength;
+                }
+            } else {
+                // Take the item before the point if the offset is in an
+                // item, or the the item before that one otherwise
+                findCharacterAttributeSkip(predicate, 1, attrs, DirectionBackwards, offset, textLength + 1, startOffset);
+                findCharacterAttribute(predicate, attrs, DirectionBackwards, offset, textLength + 1, endOffset);
+            }
+            break;
+        case ATK_TEXT_BOUNDARY_WORD_END:
+        case ATK_TEXT_BOUNDARY_SENTENCE_END:
+            if (getTextFunctionType == AfterOffset) {
+                // Take the item after the current item if the offset is
+                // in a item, or the item after that otherwise
+                findCharacterAttribute(predicate, attrs, DirectionForward, offset, textLength + 1, startOffset);
+                findCharacterAttributeSkip(predicate, 1, attrs, DirectionForward, offset, textLength + 1, endOffset);
+            } else if (getTextFunctionType == AtOffset) {
+                // Take the item at point if the offset is in a item or
+                // the item after otherwise
+                if (!findCharacterAttribute(predicate, attrs, DirectionBackwards, offset, textLength + 1, startOffset))
+                    // No match before offset, take the first opposite match at or before the offset
+                    findCharacterAttribute(oppositePredicate(predicate), attrs, DirectionBackwards, offset, textLength + 1, startOffset);
+                findCharacterAttribute(predicate, attrs, DirectionForward, offset + 1, textLength + 1, endOffset);
+            } else {
+                // Take the item before the point in any case
+                if (!findCharacterAttributeSkip(predicate, 1, attrs, DirectionBackwards, offset, textLength + 1, startOffset)) {
+                    int tmpOffset;
+                    // No match before offset, take the first opposite match at or before the offset
+                    findCharacterAttribute(predicate, attrs, DirectionBackwards, offset, textLength + 1, &tmpOffset);
+                    findCharacterAttribute(oppositePredicate(predicate), attrs, DirectionBackwards, tmpOffset - 1, textLength + 1, startOffset);
+                }
+                findCharacterAttribute(predicate, attrs, DirectionBackwards, offset, textLength + 1, endOffset);
+            }
+            break;
+        default:
+            g_assert_not_reached();
+        }
+
+        g_free(attrs);
+    }
+
+ out:
+    if (*startOffset < 0 || *endOffset < 0) {
+        *startOffset = *endOffset = 0;
+        return g_strdup("");
+    }
+
+    char* start = g_utf8_offset_to_pointer(cText, (glong)*startOffset);
+    char* end = g_utf8_offset_to_pointer(cText, (glong)*endOffset);
+    char* resultText = g_strndup(start, end - start);
+    g_free(cText);
+    return resultText;
+}
+
+static gchar* webkit_accessible_text_get_text_after_offset(AtkText* text, gint offset, AtkTextBoundary boundaryType, gint* startOffset, gint* endOffset)
+{
+    return getTextHelper(AfterOffset, text, offset, boundaryType, startOffset, endOffset);
+}
+
+static gchar* webkit_accessible_text_get_text_at_offset(AtkText* text, gint offset, AtkTextBoundary boundaryType, gint* startOffset, gint* endOffset)
+{
+    return getTextHelper(AtOffset, text, offset, boundaryType, startOffset, endOffset);
+}
+
+static gchar* webkit_accessible_text_get_text_before_offset(AtkText* text, gint offset, AtkTextBoundary boundaryType, gint* startOffset, gint* endOffset)
+{
+    return getTextHelper(BeforeOffset, text, offset, boundaryType, startOffset, endOffset);
+}
+
+static gunichar webkit_accessible_text_get_character_at_offset(AtkText* text, gint offset)
+{
+    notImplemented();
+    return NULL;
+}
+
+static gint webkit_accessible_text_get_caret_offset(AtkText* text)
+{
+    // TODO: Verify this for RTL text.
+    return core(text)->selection().start().offsetInContainerNode();
+}
+
+static AtkAttributeSet* webkit_accessible_text_get_run_attributes(AtkText* text, gint offset, gint* start_offset, gint* end_offset)
+{
+    notImplemented();
+    return NULL;
+}
+
+static AtkAttributeSet* webkit_accessible_text_get_default_attributes(AtkText* text)
+{
+    notImplemented();
+    return NULL;
+}
+
+static void webkit_accessible_text_get_character_extents(AtkText* text, gint offset, gint* x, gint* y, gint* width, gint* height, AtkCoordType coords)
+{
+    IntRect extents = core(text)->doAXBoundsForRange(PlainTextRange(offset, 1));
+    // FIXME: Use the AtkCoordType
+    // Requires WebCore::ScrollView::contentsToScreen() to be implemented
+
+#if 0
+    switch(coords) {
+    case ATK_XY_SCREEN:
+        extents = core(text)->document()->view()->contentsToScreen(extents);
+        break;
+    case ATK_XY_WINDOW:
+        // No-op
+        break;
+    }
+#endif
+
+    *x = extents.x();
+    *y = extents.y();
+    *width = extents.width();
+    *height = extents.height();
+}
+
+static gint webkit_accessible_text_get_character_count(AtkText* text)
+{
+    AccessibilityObject* coreObject = core(text);
+
+    if (coreObject->isTextControl())
+        return coreObject->textLength();
+    else
+        return coreObject->textUnderElement().length();
+}
+
+static gint webkit_accessible_text_get_offset_at_point(AtkText* text, gint x, gint y, AtkCoordType coords)
+{
+    // FIXME: Use the AtkCoordType
+    // TODO: Is it correct to ignore range.length?
+    IntPoint pos(x, y);
+    PlainTextRange range = core(text)->doAXRangeForPosition(pos);
+    return range.start;
+}
+
+static gint webkit_accessible_text_get_n_selections(AtkText* text)
+{
+    notImplemented();
+    return 0;
+}
+
+static gchar* webkit_accessible_text_get_selection(AtkText* text, gint selection_num, gint* start_offset, gint* end_offset)
+{
+    notImplemented();
+    return NULL;
+}
+
+static gboolean webkit_accessible_text_add_selection(AtkText* text, gint start_offset, gint end_offset)
+{
+    notImplemented();
+    return FALSE;
+}
+
+static gboolean webkit_accessible_text_remove_selection(AtkText* text, gint selection_num)
+{
+    notImplemented();
+    return FALSE;
+}
+
+static gboolean webkit_accessible_text_set_selection(AtkText* text, gint selection_num, gint start_offset, gint end_offset)
+{
+    notImplemented();
+    return FALSE;
+}
+
+static gboolean webkit_accessible_text_set_caret_offset(AtkText* text, gint offset)
+{
+    // TODO: Verify
+    //core(text)->setSelectedTextRange(PlainTextRange(offset, 0));
+    AccessibilityObject* coreObject = core(text);
+    coreObject->setSelectedVisiblePositionRange(coreObject->visiblePositionRangeForRange(PlainTextRange(offset, 0)));
+    return TRUE;
+}
+
+static void atk_text_interface_init(AtkTextIface* iface)
+{
+    iface->get_text = webkit_accessible_text_get_text;
+    iface->get_text_after_offset = webkit_accessible_text_get_text_after_offset;
+    iface->get_text_at_offset = webkit_accessible_text_get_text_at_offset;
+    iface->get_character_at_offset = webkit_accessible_text_get_character_at_offset;
+    iface->get_text_before_offset = webkit_accessible_text_get_text_before_offset;
+    iface->get_caret_offset = webkit_accessible_text_get_caret_offset;
+    iface->get_run_attributes = webkit_accessible_text_get_run_attributes;
+    iface->get_default_attributes = webkit_accessible_text_get_default_attributes;
+    iface->get_character_extents = webkit_accessible_text_get_character_extents;
+    iface->get_character_count = webkit_accessible_text_get_character_count;
+    iface->get_offset_at_point = webkit_accessible_text_get_offset_at_point;
+    iface->get_n_selections = webkit_accessible_text_get_n_selections;
+    iface->get_selection = webkit_accessible_text_get_selection;
+
+    // set methods
+    iface->add_selection = webkit_accessible_text_add_selection;
+    iface->remove_selection = webkit_accessible_text_remove_selection;
+    iface->set_selection = webkit_accessible_text_set_selection;
+    iface->set_caret_offset = webkit_accessible_text_set_caret_offset;
+}
+
+// EditableText
+
+static gboolean webkit_accessible_editable_text_set_run_attributes(AtkEditableText* text, AtkAttributeSet* attrib_set, gint start_offset, gint end_offset)
+{
+    notImplemented();
+    return FALSE;
+}
+
+static void webkit_accessible_editable_text_set_text_contents(AtkEditableText* text, const gchar* string)
+{
+    // FIXME: string nullcheck?
+    core(text)->setValue(String::fromUTF8(string));
+}
+
+static void webkit_accessible_editable_text_insert_text(AtkEditableText* text, const gchar* string, gint length, gint* position)
+{
+    // FIXME: string nullcheck?
+
+    AccessibilityObject* coreObject = core(text);
+    // FIXME: Not implemented in WebCore
+    //coreObject->setSelectedTextRange(PlainTextRange(*position, 0));
+    //coreObject->setSelectedText(String::fromUTF8(string));
+
+    if (!coreObject->document() || !coreObject->document()->frame())
+        return;
+    coreObject->setSelectedVisiblePositionRange(coreObject->visiblePositionRangeForRange(PlainTextRange(*position, 0)));
+    coreObject->setFocused(true);
+    // FIXME: We should set position to the actual inserted text length, which may be less than that requested.
+    if (coreObject->document()->frame()->editor()->insertTextWithoutSendingTextEvent(String::fromUTF8(string), false, 0))
+        *position += length;
+}
+
+static void webkit_accessible_editable_text_copy_text(AtkEditableText* text, gint start_pos, gint end_pos)
+{
+    notImplemented();
+}
+
+static void webkit_accessible_editable_text_cut_text(AtkEditableText* text, gint start_pos, gint end_pos)
+{
+    notImplemented();
+}
+
+static void webkit_accessible_editable_text_delete_text(AtkEditableText* text, gint start_pos, gint end_pos)
+{
+    AccessibilityObject* coreObject = core(text);
+    // FIXME: Not implemented in WebCore
+    //coreObject->setSelectedTextRange(PlainTextRange(start_pos, end_pos - start_pos));
+    //coreObject->setSelectedText(String());
+
+    if (!coreObject->document() || !coreObject->document()->frame())
+        return;
+    coreObject->setSelectedVisiblePositionRange(coreObject->visiblePositionRangeForRange(PlainTextRange(start_pos, end_pos - start_pos)));
+    coreObject->setFocused(true);
+    coreObject->document()->frame()->editor()->performDelete();
+}
+
+static void webkit_accessible_editable_text_paste_text(AtkEditableText* text, gint position)
+{
+    notImplemented();
+}
+
+static void atk_editable_text_interface_init(AtkEditableTextIface* iface)
+{
+    iface->set_run_attributes = webkit_accessible_editable_text_set_run_attributes;
+    iface->set_text_contents = webkit_accessible_editable_text_set_text_contents;
+    iface->insert_text = webkit_accessible_editable_text_insert_text;
+    iface->copy_text = webkit_accessible_editable_text_copy_text;
+    iface->cut_text = webkit_accessible_editable_text_cut_text;
+    iface->delete_text = webkit_accessible_editable_text_delete_text;
+    iface->paste_text = webkit_accessible_editable_text_paste_text;
+}
+
+// StreamableContent
+
+static gint webkit_accessible_streamable_content_get_n_mime_types(AtkStreamableContent* streamable)
+{
+    notImplemented();
+    return 0;
+}
+
+static G_CONST_RETURN gchar* webkit_accessible_streamable_content_get_mime_type(AtkStreamableContent* streamable, gint i)
+{
+    notImplemented();
+    return "";
+}
+
+static GIOChannel* webkit_accessible_streamable_content_get_stream(AtkStreamableContent* streamable, const gchar* mime_type)
+{
+    notImplemented();
+    return NULL;
+}
+
+static G_CONST_RETURN gchar* webkit_accessible_streamable_content_get_uri(AtkStreamableContent* streamable, const gchar* mime_type)
+{
+    notImplemented();
+    return NULL;
+}
+
+static void atk_streamable_content_interface_init(AtkStreamableContentIface* iface)
+{
+    iface->get_n_mime_types = webkit_accessible_streamable_content_get_n_mime_types;
+    iface->get_mime_type = webkit_accessible_streamable_content_get_mime_type;
+    iface->get_stream = webkit_accessible_streamable_content_get_stream;
+    iface->get_uri = webkit_accessible_streamable_content_get_uri;
+}
+
+static void contentsToAtk(AccessibilityObject* coreObject, AtkCoordType coordType, IntRect rect, gint* x, gint* y, gint* width = 0, gint* height = 0)
+{
+    FrameView* frameView = coreObject->documentFrameView();
+
+    if (frameView) {
+        switch (coordType) {
+        case ATK_XY_WINDOW:
+            rect = frameView->contentsToWindow(rect);
+            break;
+        case ATK_XY_SCREEN:
+            rect = frameView->contentsToScreen(rect);
+            break;
+        }
+    }
+
+    if (x)
+        *x = rect.x();
+    if (y)
+        *y = rect.y();
+    if (width)
+        *width = rect.width();
+    if (height)
+        *height = rect.height();
+}
+
+static IntPoint atkToContents(AccessibilityObject* coreObject, AtkCoordType coordType, gint x, gint y)
+{
+    IntPoint pos(x, y);
+
+    FrameView* frameView = coreObject->documentFrameView();
+    if (frameView) {
+        switch (coordType) {
+        case ATK_XY_SCREEN:
+            return frameView->screenToContents(pos);
+        case ATK_XY_WINDOW:
+            return frameView->windowToContents(pos);
+        }
+    }
+
+    return pos;
+}
+
+static AtkObject* webkit_accessible_component_ref_accessible_at_point(AtkComponent* component, gint x, gint y, AtkCoordType coordType)
+{
+    IntPoint pos = atkToContents(core(component), coordType, x, y);
+    AccessibilityObject* target = core(component)->doAccessibilityHitTest(pos);
+    if (!target)
+        return NULL;
+    g_object_ref(target->wrapper());
+    return target->wrapper();
+}
+
+static void webkit_accessible_component_get_extents(AtkComponent* component, gint* x, gint* y, gint* width, gint* height, AtkCoordType coordType)
+{
+    IntRect rect = core(component)->elementRect();
+    contentsToAtk(core(component), coordType, rect, x, y, width, height);
+}
+
+static gboolean webkit_accessible_component_grab_focus(AtkComponent* component)
+{
+    core(component)->setFocused(true);
+    return core(component)->isFocused();
+}
+
+static void atk_component_interface_init(AtkComponentIface *iface)
+{
+    iface->ref_accessible_at_point = webkit_accessible_component_ref_accessible_at_point;
+    iface->get_extents = webkit_accessible_component_get_extents;
+    iface->grab_focus = webkit_accessible_component_grab_focus;
+}
+
+// Image
+
+static void webkit_accessible_image_get_image_position(AtkImage* image, gint* x, gint* y, AtkCoordType coordType)
+{
+    IntRect rect = core(image)->elementRect();
+    contentsToAtk(core(image), coordType, rect, x, y);
+}
+
+static const gchar* webkit_accessible_image_get_image_description(AtkImage* image)
+{
+    return returnString(core(image)->accessibilityDescription());
+}
+
+static void webkit_accessible_image_get_image_size(AtkImage* image, gint* width, gint* height)
+{
+    IntSize size = core(image)->size();
+
+    if (width)
+        *width = size.width();
+    if (height)
+        *height = size.height();
+}
+
+static void atk_image_interface_init(AtkImageIface* iface)
+{
+    iface->get_image_position = webkit_accessible_image_get_image_position;
+    iface->get_image_description = webkit_accessible_image_get_image_description;
+    iface->get_image_size = webkit_accessible_image_get_image_size;
+}
+
+static const GInterfaceInfo AtkInterfacesInitFunctions[] = {
+    {(GInterfaceInitFunc)atk_action_interface_init,
+     (GInterfaceFinalizeFunc) NULL, NULL},
+    {(GInterfaceInitFunc)atk_streamable_content_interface_init,
+     (GInterfaceFinalizeFunc) NULL, NULL},
+    {(GInterfaceInitFunc)atk_editable_text_interface_init,
+     (GInterfaceFinalizeFunc) NULL, NULL},
+    {(GInterfaceInitFunc)atk_text_interface_init,
+     (GInterfaceFinalizeFunc) NULL, NULL},
+    {(GInterfaceInitFunc)atk_component_interface_init,
+     (GInterfaceFinalizeFunc) NULL, NULL},
+    {(GInterfaceInitFunc)atk_image_interface_init,
+     (GInterfaceFinalizeFunc) NULL, NULL}
+};
+
+enum WAIType {
+    WAI_ACTION,
+    WAI_STREAMABLE,
+    WAI_EDITABLE_TEXT,
+    WAI_TEXT,
+    WAI_COMPONENT,
+    WAI_IMAGE
+};
+
+static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
+{
+  switch (type) {
+  case WAI_ACTION:
+      return ATK_TYPE_ACTION;
+  case WAI_STREAMABLE:
+      return ATK_TYPE_STREAMABLE_CONTENT;
+  case WAI_EDITABLE_TEXT:
+      return ATK_TYPE_EDITABLE_TEXT;
+  case WAI_TEXT:
+      return ATK_TYPE_TEXT;
+  case WAI_COMPONENT:
+      return ATK_TYPE_COMPONENT;
+  case WAI_IMAGE:
+      return ATK_TYPE_IMAGE;
+  }
+
+  return G_TYPE_INVALID;
+}
+
+static guint16 getInterfaceMaskFromObject(AccessibilityObject* coreObject)
+{
+    guint16 interfaceMask = 0;
+
+    // Streamable is always supported (FIXME: This is wrong)
+    interfaceMask |= 1 << WAI_STREAMABLE;
+
+    // Component interface is always supported
+    interfaceMask |= 1 << WAI_COMPONENT;
+
+    // Action
+    if (!coreObject->actionVerb().isEmpty())
+        interfaceMask |= 1 << WAI_ACTION;
+
+    // Text & Editable Text
+    AccessibilityRole role = coreObject->roleValue();
+
+    if (role == StaticTextRole)
+        interfaceMask |= 1 << WAI_TEXT;
+
+    if (coreObject->isAccessibilityRenderObject() && coreObject->isTextControl()) {
+        if (coreObject->isReadOnly())
+            interfaceMask |= 1 << WAI_TEXT;
+        else
+            interfaceMask |= 1 << WAI_EDITABLE_TEXT;
+    }
+
+    // Image
+    if (coreObject->isImage())
+        interfaceMask |= 1 << WAI_IMAGE;
+
+    return interfaceMask;
+}
+
+static const char* getUniqueAccessibilityTypeName(guint16 interfaceMask)
+{
+#define WAI_TYPE_NAME_LEN (30) /* Enough for prefix + 5 hex characters (max) */
+    static char name[WAI_TYPE_NAME_LEN + 1];
+    
+    g_sprintf(name, "WAIType%x", interfaceMask);
+    name[WAI_TYPE_NAME_LEN] = '\0';
+    
+    return name;
+}
+
+static GType getAccessibilityTypeFromObject(AccessibilityObject* coreObject)
+{
+    static const GTypeInfo typeInfo = {
+        sizeof(WebKitAccessibleClass),
+        (GBaseInitFunc) NULL,
+        (GBaseFinalizeFunc) NULL,
+        (GClassInitFunc) NULL,
+        (GClassFinalizeFunc) NULL,
+        NULL, /* class data */
+        sizeof(WebKitAccessible), /* instance size */
+        0, /* nb preallocs */
+        (GInstanceInitFunc) NULL,
+        NULL /* value table */
+    };
+
+    guint16 interfaceMask = getInterfaceMaskFromObject(coreObject);
+    const char* atkTypeName = getUniqueAccessibilityTypeName(interfaceMask);
+    GType type = g_type_from_name(atkTypeName);
+    if (type)
+        return type;
+
+    type = g_type_register_static(WEBKIT_TYPE_ACCESSIBLE,
+                                  atkTypeName,
+                                  &typeInfo, GTypeFlags(0));
+    for (guint i = 0; i < G_N_ELEMENTS(AtkInterfacesInitFunctions); i++) {
+        if (interfaceMask & (1 << i))
+            g_type_add_interface_static(type,
+                                        GetAtkInterfaceTypeFromWAIType(static_cast<WAIType>(i)),
+                                        &AtkInterfacesInitFunctions[i]);
+    }
+
+    return type;
+}
+
+WebKitAccessible* webkit_accessible_new(AccessibilityObject* coreObject)
+{
+    GType type = getAccessibilityTypeFromObject(coreObject);
+    AtkObject* object = static_cast<AtkObject*>(g_object_new(type, NULL));
+
+    atk_object_initialize(object, coreObject);
+
+    return WEBKIT_ACCESSIBLE(object);
+}
+
+AccessibilityObject* webkit_accessible_get_accessibility_object(WebKitAccessible* accessible)
+{
+    return accessible->m_object;
+}
+
+void webkit_accessible_detach(WebKitAccessible* accessible)
+{
+    ASSERT(accessible->m_object);
+
+    // We replace the WebCore AccessibilityObject with a fallback object that
+    // provides default implementations to avoid repetitive null-checking after
+    // detachment.
+    accessible->m_object = fallbackObject();
+}
+
+#endif // HAVE(ACCESSIBILITY)
diff --git a/WebCore/page/gtk/AccessibilityObjectWrapperAtk.h b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.h
similarity index 100%
rename from WebCore/page/gtk/AccessibilityObjectWrapperAtk.h
rename to WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.h
diff --git a/WebCore/page/mac/AXObjectCacheMac.mm b/WebCore/accessibility/mac/AXObjectCacheMac.mm
similarity index 74%
rename from WebCore/page/mac/AXObjectCacheMac.mm
rename to WebCore/accessibility/mac/AXObjectCacheMac.mm
index 936d9de..be7968b 100644
--- a/WebCore/page/mac/AXObjectCacheMac.mm
+++ b/WebCore/accessibility/mac/AXObjectCacheMac.mm
@@ -51,33 +51,11 @@
     obj->setWrapper([[AccessibilityObjectWrapper alloc] initWithAccessibilityObject:obj]);
 }
 
-void AXObjectCache::postNotification(RenderObject* renderer, const String& message)
+void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, const String& message)
 {
-    if (!renderer)
+    if (!obj)
         return;
     
-    // notifications for text input objects are sent to that object
-    // all others are sent to the top WebArea
-    RefPtr<AccessibilityObject> obj = getOrCreate(renderer)->observableObject();
-    if (!obj)
-        obj = getOrCreate(renderer->document()->renderer());
-
-    if (!obj)
-        return;
-
-    NSAccessibilityPostNotification(obj->wrapper(), message);
-}
-
-void AXObjectCache::postNotificationToElement(RenderObject* renderer, const String& message)
-{
-    // send the notification to the specified element itself, not one of its ancestors
-    if (!renderer)
-        return;
-
-    RefPtr<AccessibilityObject> obj = getOrCreate(renderer);
-    if (!obj)
-        return;
-
     NSAccessibilityPostNotification(obj->wrapper(), message);
 }
 
diff --git a/WebCore/page/mac/AccessibilityObjectMac.mm b/WebCore/accessibility/mac/AccessibilityObjectMac.mm
similarity index 100%
rename from WebCore/page/mac/AccessibilityObjectMac.mm
rename to WebCore/accessibility/mac/AccessibilityObjectMac.mm
diff --git a/WebCore/page/mac/AccessibilityObjectWrapper.h b/WebCore/accessibility/mac/AccessibilityObjectWrapper.h
similarity index 100%
rename from WebCore/page/mac/AccessibilityObjectWrapper.h
rename to WebCore/accessibility/mac/AccessibilityObjectWrapper.h
diff --git a/WebCore/page/mac/AccessibilityObjectWrapper.mm b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
similarity index 98%
rename from WebCore/page/mac/AccessibilityObjectWrapper.mm
rename to WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index 1e596eb..6137e68 100644
--- a/WebCore/page/mac/AccessibilityObjectWrapper.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -203,7 +203,7 @@
     bzero(&textMarkerData, sizeof(TextMarkerData));
     textMarkerData.axID = obj.get()->axObjectID();
     textMarkerData.node = domNode;
-    textMarkerData.offset = deepPos.m_offset;
+    textMarkerData.offset = deepPos.deprecatedEditingOffset();
     textMarkerData.affinity = visiblePos.affinity();
     return [[WebCoreViewFactory sharedFactory] textMarkerWithBytes:&textMarkerData length:sizeof(textMarkerData)];
 }
@@ -228,7 +228,7 @@
     if (!cache->isIDinUse(textMarkerData.axID))
         return VisiblePosition();
 
-    if (deepPos.node() != textMarkerData.node || deepPos.m_offset != textMarkerData.offset)
+    if (deepPos.node() != textMarkerData.node || deepPos.deprecatedEditingOffset() != textMarkerData.offset)
         return VisiblePosition();
     
     return visiblePos;
@@ -632,6 +632,7 @@
     static NSArray* tableCellAttrs = nil;
     static NSArray* groupAttrs = nil;
     static NSArray* inputImageAttrs = nil;
+    static NSArray* passwordFieldAttrs = nil;
     NSMutableArray* tempArray;
     if (attributes == nil) {
         attributes = [[NSArray alloc] initWithObjects: NSAccessibilityRoleAttribute,
@@ -814,9 +815,15 @@
         inputImageAttrs = [[NSArray alloc] initWithArray:tempArray];
         [tempArray release];
     }
+    if (passwordFieldAttrs == nil) {
+        tempArray = [[NSMutableArray alloc] initWithArray:attributes];
+        [tempArray addObject:NSAccessibilityTitleUIElementAttribute];
+        passwordFieldAttrs = [[NSArray alloc] initWithArray:tempArray];
+        [tempArray release];
+    }
     
     if (m_object->isPasswordField())
-        return attributes;
+        return passwordFieldAttrs;
 
     if (m_object->isWebArea())
         return webAreaAttrs;
@@ -824,7 +831,7 @@
     if (m_object->isTextControl())
         return textAttrs;
 
-    if (m_object->isAnchor() || m_object->isImage())
+    if (m_object->isAnchor() || m_object->isImage() || m_object->isLink())
         return anchorAttrs;
 
     if (m_object->isDataTable())
@@ -996,16 +1003,15 @@
         { HeadingRole, @"AXHeading" },
         { ListBoxRole, NSAccessibilityListRole },
         { ListBoxOptionRole, NSAccessibilityStaticTextRole },
-        // cells don't exist on tiger or leopard
-#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)
-        { CellRole, NSAccessibilityGroupRole },
-#else
+#if ACCESSIBILITY_TABLES
         { CellRole, NSAccessibilityCellRole },
+#else
+        { CellRole, NSAccessibilityGroupRole },
 #endif
         { TableHeaderContainerRole, NSAccessibilityGroupRole },
         { DefinitionListDefinitionRole, NSAccessibilityGroupRole },
         { DefinitionListTermRole, NSAccessibilityGroupRole }
-        
+
     };
     AccessibilityRoleMap& roleMap = *new AccessibilityRoleMap;
     
diff --git a/WebCore/page/qt/AccessibilityObjectQt.cpp b/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
similarity index 100%
rename from WebCore/page/qt/AccessibilityObjectQt.cpp
rename to WebCore/accessibility/qt/AccessibilityObjectQt.cpp
diff --git a/WebCore/page/win/AXObjectCacheWin.cpp b/WebCore/accessibility/win/AXObjectCacheWin.cpp
similarity index 92%
rename from WebCore/page/win/AXObjectCacheWin.cpp
rename to WebCore/accessibility/win/AXObjectCacheWin.cpp
index da30ac5..e39d5a5 100644
--- a/WebCore/page/win/AXObjectCacheWin.cpp
+++ b/WebCore/accessibility/win/AXObjectCacheWin.cpp
@@ -46,11 +46,7 @@
     // software requests them via get_accChild.
 }
 
-void AXObjectCache::postNotification(RenderObject*, const String&)
-{
-}
-
-void AXObjectCache::postNotificationToElement(RenderObject*, const String&)
+void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&)
 {
 }
 
diff --git a/WebCore/page/win/AccessibilityObjectWin.cpp b/WebCore/accessibility/win/AccessibilityObjectWin.cpp
similarity index 100%
rename from WebCore/page/win/AccessibilityObjectWin.cpp
rename to WebCore/accessibility/win/AccessibilityObjectWin.cpp
diff --git a/WebCore/page/win/AccessibilityObjectWrapperWin.h b/WebCore/accessibility/win/AccessibilityObjectWrapperWin.h
similarity index 100%
rename from WebCore/page/win/AccessibilityObjectWrapperWin.h
rename to WebCore/accessibility/win/AccessibilityObjectWrapperWin.h
diff --git a/WebCore/page/wx/AccessibilityObjectWx.cpp b/WebCore/accessibility/wx/AccessibilityObjectWx.cpp
similarity index 100%
rename from WebCore/page/wx/AccessibilityObjectWx.cpp
rename to WebCore/accessibility/wx/AccessibilityObjectWx.cpp
diff --git a/WebCore/bindings/js/GCController.cpp b/WebCore/bindings/js/GCController.cpp
index ceb7928..db295c2 100644
--- a/WebCore/bindings/js/GCController.cpp
+++ b/WebCore/bindings/js/GCController.cpp
@@ -65,7 +65,7 @@
 void GCController::garbageCollectSoon()
 {
     if (!m_GCTimer.isActive())
-        m_GCTimer.startOneShot(0);
+        m_GCTimer.startOneShot(0.5);
 }
 
 void GCController::gcTimerFired(Timer<GCController>*)
diff --git a/WebCore/bindings/js/JSAttrCustom.cpp b/WebCore/bindings/js/JSAttrCustom.cpp
index a97d039..4f3c8ee 100644
--- a/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/WebCore/bindings/js/JSAttrCustom.cpp
@@ -40,14 +40,14 @@
 
 using namespace HTMLNames;
 
-void JSAttr::setValue(ExecState* exec, JSValuePtr value)
+void JSAttr::setValue(ExecState* exec, JSValue value)
 {
     Attr* imp = static_cast<Attr*>(impl());
     String attrValue = valueToStringWithNullCheck(exec, value);
 
     Element* ownerElement = imp->ownerElement();
     if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
-        if (equalIgnoringCase(imp->name(), "src") && protocolIs(parseURL(attrValue), "javascript")) {
+        if (equalIgnoringCase(imp->name(), "src") && protocolIsJavaScript(parseURL(attrValue))) {
             if (!checkNodeSecurity(exec, static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument()))
                 return;
         }
diff --git a/WebCore/bindings/js/JSAudioConstructor.cpp b/WebCore/bindings/js/JSAudioConstructor.cpp
index 3fd53fe..74bcad5 100644
--- a/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -41,13 +41,14 @@
 
 const ClassInfo JSAudioConstructor::s_info = { "AudioConstructor", 0, 0, 0 };
 
-JSAudioConstructor::JSAudioConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSAudioConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
-    , m_globalObject(toJSDOMGlobalObject(context))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
 
-    putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
 }
 
@@ -60,9 +61,13 @@
 {
     // FIXME: Why doesn't this need the call toJS on the document like JSImageConstructor?
 
-    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, static_cast<JSAudioConstructor*>(constructor)->document());
+    Document* document = static_cast<JSAudioConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Audio constructor associated document is unavailable");
+
+    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, document);
     if (args.size() > 0) {
-        audio->setSrc(args.at(exec, 0).toString(exec));
+        audio->setSrc(args.at(0).toString(exec));
         audio->scheduleLoad();
     }
     return asObject(toJS(exec, audio.release()));
diff --git a/WebCore/bindings/js/JSAudioConstructor.h b/WebCore/bindings/js/JSAudioConstructor.h
index 1078b0f..0a3a7ea 100644
--- a/WebCore/bindings/js/JSAudioConstructor.h
+++ b/WebCore/bindings/js/JSAudioConstructor.h
@@ -36,7 +36,7 @@
 
     class JSAudioConstructor : public DOMObject {
     public:
-        JSAudioConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        JSAudioConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
         Document* document() const;
 
diff --git a/WebCore/bindings/js/JSCDATASectionCustom.cpp b/WebCore/bindings/js/JSCDATASectionCustom.cpp
index 68180f1..44a8957 100644
--- a/WebCore/bindings/js/JSCDATASectionCustom.cpp
+++ b/WebCore/bindings/js/JSCDATASectionCustom.cpp
@@ -32,7 +32,7 @@
 
 namespace WebCore {
 
-JSValuePtr toJSNewlyCreated(ExecState* exec, CDATASection* section)
+JSValue toJSNewlyCreated(ExecState* exec, CDATASection* section)
 {
     if (!section)
         return jsNull();
diff --git a/WebCore/bindings/js/JSCSSRuleCustom.cpp b/WebCore/bindings/js/JSCSSRuleCustom.cpp
index 32462fa..2c20431 100644
--- a/WebCore/bindings/js/JSCSSRuleCustom.cpp
+++ b/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -49,7 +49,7 @@
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, CSSRule* rule)
+JSValue toJS(ExecState* exec, CSSRule* rule)
 {
     if (!rule)
         return jsNull();
diff --git a/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 22154ce..b07f201 100644
--- a/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -127,7 +127,7 @@
 
 // FIXME: You can get these properties, and set them (see customPut below),
 // but you should also be able to enumerate them.
-JSValuePtr JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
 
@@ -156,7 +156,7 @@
 }
 
 
-bool JSCSSStyleDeclaration::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&)
+bool JSCSSStyleDeclaration::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     if (!isCSSPropertyName(propertyName))
         return false;
diff --git a/WebCore/bindings/js/JSCSSValueCustom.cpp b/WebCore/bindings/js/JSCSSValueCustom.cpp
index 9e31304..ad0cee1 100644
--- a/WebCore/bindings/js/JSCSSValueCustom.cpp
+++ b/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -44,7 +44,7 @@
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, CSSValue* value)
+JSValue toJS(ExecState* exec, CSSValue* value)
 {
     if (!value)
         return jsNull();
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index ae48440..76db871 100644
--- a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -40,7 +40,7 @@
 
 namespace WebCore {
 
-static JSValuePtr toJS(ExecState* exec, CanvasStyle* style)
+static JSValue toJS(ExecState* exec, CanvasStyle* style)
 {
     if (style->canvasGradient())
         return toJS(exec, style->canvasGradient());
@@ -49,7 +49,7 @@
     return jsString(exec, style->color());
 }
 
-static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValuePtr value)
+static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
 {
     if (value.isString())
         return CanvasStyle::create(asString(value)->value());
@@ -63,27 +63,27 @@
     return 0;
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
+JSValue JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
 {
     return toJS(exec, impl()->strokeStyle());        
 }
 
-void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValuePtr value)
+void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValue value)
 {
     impl()->setStrokeStyle(toHTMLCanvasStyle(exec, value));
 }
 
-JSValuePtr JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
+JSValue JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
 {
     return toJS(exec, impl()->fillStyle());
 }
 
-void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValuePtr value)
+void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValue value)
 {
     impl()->setFillStyle(toHTMLCanvasStyle(exec, value));
 }
 
-JSValuePtr JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
 {
     CanvasRenderingContext2D* context = impl();
 
@@ -95,24 +95,24 @@
     // 5 args = c, m, y, k, a
     switch (args.size()) {
         case 1:
-            if (args.at(exec, 0).isString())
-                context->setFillColor(asString(args.at(exec, 0))->value());
+            if (args.at(0).isString())
+                context->setFillColor(asString(args.at(0))->value());
             else
-                context->setFillColor(args.at(exec, 0).toFloat(exec));
+                context->setFillColor(args.at(0).toFloat(exec));
             break;
         case 2:
-            if (args.at(exec, 0).isString())
-                context->setFillColor(asString(args.at(exec, 0))->value(), args.at(exec, 1).toFloat(exec));
+            if (args.at(0).isString())
+                context->setFillColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
             else
-                context->setFillColor(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec));
+                context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
         case 4:
-            context->setFillColor(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                                  args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec));
+            context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                  args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            context->setFillColor(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                                  args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec), args.at(exec, 4).toFloat(exec));
+            context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                  args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -120,7 +120,7 @@
     return jsUndefined();
 }    
 
-JSValuePtr JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -132,24 +132,24 @@
     // 5 args = c, m, y, k, a
     switch (args.size()) {
         case 1:
-            if (args.at(exec, 0).isString())
-                context->setStrokeColor(asString(args.at(exec, 0))->value());
+            if (args.at(0).isString())
+                context->setStrokeColor(asString(args.at(0))->value());
             else
-                context->setStrokeColor(args.at(exec, 0).toFloat(exec));
+                context->setStrokeColor(args.at(0).toFloat(exec));
             break;
         case 2:
-            if (args.at(exec, 0).isString())
-                context->setStrokeColor(asString(args.at(exec, 0))->value(), args.at(exec, 1).toFloat(exec));
+            if (args.at(0).isString())
+                context->setStrokeColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
             else
-                context->setStrokeColor(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec));
+                context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
         case 4:
-            context->setStrokeColor(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                                    args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec));
+            context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            context->setStrokeColor(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                                    args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec), args.at(exec, 4).toFloat(exec));
+            context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -158,21 +158,21 @@
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
     
     if (args.size() <= 4)
-        context->strokeRect(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                            args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec));
+        context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                            args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->strokeRect(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                            args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec), args.at(exec, 4).toFloat(exec));
+        context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                            args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
 
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -182,7 +182,7 @@
     //     drawImage(img, sx, sy, sw, sh, dx, dy, dw, dh)
     // Composite operation is specified with globalCompositeOperation.
     // The img parameter can be a <img> or <canvas> element.
-    JSValuePtr value = args.at(exec, 0);
+    JSValue value = args.at(0);
     if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
@@ -192,18 +192,18 @@
         HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
         switch (args.size()) {
             case 3:
-                context->drawImage(imgElt, args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec));
+                context->drawImage(imgElt, args.at(1).toFloat(exec), args.at(2).toFloat(exec));
                 break;
             case 5:
-                context->drawImage(imgElt, args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec),
-                                   args.at(exec, 3).toFloat(exec), args.at(exec, 4).toFloat(exec), ec);
+                context->drawImage(imgElt, args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec), ec);
                 setDOMException(exec, ec);
                 break;
             case 9:
-                context->drawImage(imgElt, FloatRect(args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec),
-                                   args.at(exec, 3).toFloat(exec), args.at(exec, 4).toFloat(exec)),
-                                   FloatRect(args.at(exec, 5).toFloat(exec), args.at(exec, 6).toFloat(exec),
-                                   args.at(exec, 7).toFloat(exec), args.at(exec, 8).toFloat(exec)), ec);
+                context->drawImage(imgElt, FloatRect(args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec)),
+                                   FloatRect(args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                                   args.at(7).toFloat(exec), args.at(8).toFloat(exec)), ec);
                 setDOMException(exec, ec);
                 break;
             default:
@@ -213,18 +213,18 @@
         HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
         switch (args.size()) {
             case 3:
-                context->drawImage(canvas, args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec));
+                context->drawImage(canvas, args.at(1).toFloat(exec), args.at(2).toFloat(exec));
                 break;
             case 5:
-                context->drawImage(canvas, args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec),
-                                   args.at(exec, 3).toFloat(exec), args.at(exec, 4).toFloat(exec), ec);
+                context->drawImage(canvas, args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec), ec);
                 setDOMException(exec, ec);
                 break;
             case 9:
-                context->drawImage(canvas, FloatRect(args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec),
-                                   args.at(exec, 3).toFloat(exec), args.at(exec, 4).toFloat(exec)),
-                                   FloatRect(args.at(exec, 5).toFloat(exec), args.at(exec, 6).toFloat(exec),
-                                   args.at(exec, 7).toFloat(exec), args.at(exec, 8).toFloat(exec)), ec);
+                context->drawImage(canvas, FloatRect(args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec)),
+                                   FloatRect(args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                                   args.at(7).toFloat(exec), args.at(8).toFloat(exec)), ec);
                 setDOMException(exec, ec);
                 break;
             default:
@@ -237,11 +237,11 @@
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
     
-    JSValuePtr value = args.at(exec, 0);
+    JSValue value = args.at(0);
     if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
@@ -249,52 +249,52 @@
     if (!o->inherits(&JSHTMLImageElement::s_info))
         return throwError(exec, TypeError);
     context->drawImageFromRect(static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                               args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec),
-                               args.at(exec, 3).toFloat(exec), args.at(exec, 4).toFloat(exec),
-                               args.at(exec, 5).toFloat(exec), args.at(exec, 6).toFloat(exec),
-                               args.at(exec, 7).toFloat(exec), args.at(exec, 8).toFloat(exec),
-                               args.at(exec, 9).toString(exec));    
+                               args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                               args.at(3).toFloat(exec), args.at(4).toFloat(exec),
+                               args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                               args.at(7).toFloat(exec), args.at(8).toFloat(exec),
+                               args.at(9).toString(exec));    
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
     switch (args.size()) {
         case 3:
-            context->setShadow(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                               args.at(exec, 2).toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec));
             break;
         case 4:
-            if (args.at(exec, 3).isString())
-                context->setShadow(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                                   args.at(exec, 2).toFloat(exec), asString(args.at(exec, 3))->value());
+            if (args.at(3).isString())
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value());
             else
-                context->setShadow(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                                   args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec));
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            if (args.at(exec, 3).isString())
-                context->setShadow(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                                   args.at(exec, 2).toFloat(exec), asString(args.at(exec, 3))->value(),
-                                   args.at(exec, 4).toFloat(exec));
+            if (args.at(3).isString())
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(),
+                                   args.at(4).toFloat(exec));
             else
-                context->setShadow(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                                   args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec),
-                                   args.at(exec, 4).toFloat(exec));
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                                   args.at(4).toFloat(exec));
             break;
         case 7:
-            context->setShadow(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                               args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec),
-                               args.at(exec, 4).toFloat(exec), args.at(exec, 5).toFloat(exec),
-                               args.at(exec, 6).toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                               args.at(4).toFloat(exec), args.at(5).toFloat(exec),
+                               args.at(6).toFloat(exec));
             break;
         case 8:
-            context->setShadow(args.at(exec, 0).toFloat(exec), args.at(exec, 1).toFloat(exec),
-                               args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec),
-                               args.at(exec, 4).toFloat(exec), args.at(exec, 5).toFloat(exec),
-                               args.at(exec, 6).toFloat(exec), args.at(exec, 7).toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                               args.at(4).toFloat(exec), args.at(5).toFloat(exec),
+                               args.at(6).toFloat(exec), args.at(7).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -303,28 +303,28 @@
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
-    JSValuePtr value = args.at(exec, 0);
+    JSValue value = args.at(0);
     if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
 
     if (o->inherits(&JSHTMLImageElement::s_info)) {
         ExceptionCode ec;
-        JSValuePtr pattern = toJS(exec,
+        JSValue pattern = toJS(exec,
             context->createPattern(static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                                   valueToStringWithNullCheck(exec, args.at(exec, 1)), ec).get());
+                                   valueToStringWithNullCheck(exec, args.at(1)), ec).get());
         setDOMException(exec, ec);
         return pattern;
     }
     if (o->inherits(&JSHTMLCanvasElement::s_info)) {
         ExceptionCode ec;
-        JSValuePtr pattern = toJS(exec,
+        JSValue pattern = toJS(exec,
             context->createPattern(static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                valueToStringWithNullCheck(exec, args.at(exec, 1)), ec).get());
+                valueToStringWithNullCheck(exec, args.at(1)), ec).get());
         setDOMException(exec, ec);
         return pattern;
     }
@@ -332,7 +332,7 @@
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList& args)
 {
     // putImageData has two variants
     // putImageData(ImageData, x, y)
@@ -341,16 +341,16 @@
 
     ExceptionCode ec = 0;
     if (args.size() >= 7)
-        context->putImageData(toImageData(args.at(exec, 0)), args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec), 
-                              args.at(exec, 3).toFloat(exec), args.at(exec, 4).toFloat(exec), args.at(exec, 5).toFloat(exec), args.at(exec, 6).toFloat(exec), ec);
+        context->putImageData(toImageData(args.at(0)), args.at(1).toFloat(exec), args.at(2).toFloat(exec), 
+                              args.at(3).toFloat(exec), args.at(4).toFloat(exec), args.at(5).toFloat(exec), args.at(6).toFloat(exec), ec);
     else
-        context->putImageData(toImageData(args.at(exec, 0)), args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec), ec);
+        context->putImageData(toImageData(args.at(0)), args.at(1).toFloat(exec), args.at(2).toFloat(exec), ec);
 
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -362,13 +362,13 @@
         return throwError(exec, SyntaxError);
     
     if (args.size() == 4)
-        context->fillText(args.at(exec, 0).toString(exec), args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec));
+        context->fillText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->fillText(args.at(exec, 0).toString(exec), args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec));
+        context->fillText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -380,9 +380,9 @@
         return throwError(exec, SyntaxError);
     
     if (args.size() == 4)
-        context->strokeText(args.at(exec, 0).toString(exec), args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec), args.at(exec, 3).toFloat(exec));
+        context->strokeText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->strokeText(args.at(exec, 0).toString(exec), args.at(exec, 1).toFloat(exec), args.at(exec, 2).toFloat(exec));
+        context->strokeText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSClipboardCustom.cpp b/WebCore/bindings/js/JSClipboardCustom.cpp
index 373ba8a..78dca49 100644
--- a/WebCore/bindings/js/JSClipboardCustom.cpp
+++ b/WebCore/bindings/js/JSClipboardCustom.cpp
@@ -48,7 +48,7 @@
 
 using namespace HTMLNames;
 
-JSValuePtr JSClipboard::types(ExecState* exec) const
+JSValue JSClipboard::types(ExecState* exec) const
 {
     Clipboard* clipboard = impl();
 
@@ -56,14 +56,14 @@
     if (types.isEmpty())
         return jsNull();
 
-    ArgList list;
+    MarkedArgumentBuffer list;
     HashSet<String>::const_iterator end = types.end();
     for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it)
         list.append(jsString(exec, UString(*it)));
     return constructArray(exec, list);
 }
 
-JSValuePtr JSClipboard::clearData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::clearData(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -73,7 +73,7 @@
     }
 
     if (args.size() == 1) {
-        clipboard->clearData(args.at(exec, 0).toString(exec));
+        clipboard->clearData(args.at(0).toString(exec));
         return jsUndefined();
     }
 
@@ -81,7 +81,7 @@
     return throwError(exec, SyntaxError, "clearData: Invalid number of arguments");
 }
 
-JSValuePtr JSClipboard::getData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::getData(ExecState* exec, const ArgList& args)
 {
     // FIXME: It does not match the rest of the JS bindings to throw on invalid number of arguments.
     if (args.size() != 1)
@@ -90,14 +90,14 @@
     Clipboard* clipboard = impl();
 
     bool success;
-    String result = clipboard->getData(args.at(exec, 0).toString(exec), success);
+    String result = clipboard->getData(args.at(0).toString(exec), success);
     if (!success)
         return jsUndefined();
 
     return jsString(exec, result);
 }
 
-JSValuePtr JSClipboard::setData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::setData(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -105,10 +105,10 @@
     if (args.size() != 2)
         return throwError(exec, SyntaxError, "setData: Invalid number of arguments");
 
-    return jsBoolean(clipboard->setData(args.at(exec, 0).toString(exec), args.at(exec, 1).toString(exec)));
+    return jsBoolean(clipboard->setData(args.at(0).toString(exec), args.at(1).toString(exec)));
 }
 
-JSValuePtr JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -119,11 +119,11 @@
     if (args.size() != 3)
         return throwError(exec, SyntaxError, "setDragImage: Invalid number of arguments");
 
-    int x = args.at(exec, 1).toInt32(exec);
-    int y = args.at(exec, 2).toInt32(exec);
+    int x = args.at(1).toInt32(exec);
+    int y = args.at(2).toInt32(exec);
 
     // See if they passed us a node
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
     if (!node)
         return throwError(exec, TypeError);
 
diff --git a/WebCore/bindings/js/JSConsoleCustom.cpp b/WebCore/bindings/js/JSConsoleCustom.cpp
index ddfe4f7..9c48467 100644
--- a/WebCore/bindings/js/JSConsoleCustom.cpp
+++ b/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -34,12 +34,14 @@
 
 namespace WebCore {
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 typedef Vector<RefPtr<JSC::Profile> > ProfilesArray;
 
-JSValuePtr JSConsole::profiles(ExecState* exec) const
+JSValue JSConsole::profiles(ExecState* exec) const
 {
     const ProfilesArray& profiles = impl()->profiles();
-    ArgList list;
+    MarkedArgumentBuffer list;
 
     ProfilesArray::const_iterator end = profiles.end();
     for (ProfilesArray::const_iterator iter = profiles.begin(); iter != end; ++iter)
@@ -48,4 +50,6 @@
     return constructArray(exec, list);
 }
 
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCoordinatesCustom.cpp b/WebCore/bindings/js/JSCoordinatesCustom.cpp
new file mode 100644
index 0000000..720bb9b
--- /dev/null
+++ b/WebCore/bindings/js/JSCoordinatesCustom.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCoordinates.h"
+
+#include "Coordinates.h"
+
+using namespace JSC;
+
+namespace WebCore {
+    
+JSValue JSCoordinates::altitude(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideAltitude())
+        return jsNull();
+    return jsNumber(exec, imp->altitude());
+}
+
+JSValue JSCoordinates::altitudeAccuracy(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideAltitudeAccuracy())
+        return jsNull();
+    return jsNumber(exec, imp->altitudeAccuracy());
+}
+
+JSValue JSCoordinates::heading(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideHeading())
+        return jsNull();
+    return jsNumber(exec, imp->heading());
+}
+
+JSValue JSCoordinates::speed(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideSpeed())
+        return jsNull();
+    return jsNumber(exec, imp->speed());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionCallback.cpp b/WebCore/bindings/js/JSCustomPositionCallback.cpp
index 6b0bb43..6f9efd9 100644
--- a/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -54,7 +54,7 @@
     
     JSC::JSLock lock(false);
     
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -68,7 +68,7 @@
     
     RefPtr<JSCustomPositionCallback> protect(this);
     
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, geoposition));
     
     globalObject->globalData()->timeoutChecker.start();
@@ -80,7 +80,7 @@
         raisedException = true;
     }
     
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index ecc67dd..cc6cd55 100644
--- a/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -54,7 +54,7 @@
     
     JSC::JSLock lock(false);
     
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -68,7 +68,7 @@
     
     RefPtr<JSCustomPositionErrorCallback> protect(this);
     
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, positionError));
     
     globalObject->globalData()->timeoutChecker.start();
@@ -78,7 +78,7 @@
     if (exec->hadException())
         reportCurrentException(exec);
     
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
     
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
index 4b9ff8a..107a491 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -59,7 +59,7 @@
         
     JSC::JSLock lock(false);
 
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -73,7 +73,7 @@
 
     RefPtr<JSCustomSQLStatementCallback> protect(this);
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
     args.append(toJS(exec, resultSet));
         
@@ -87,7 +87,7 @@
         raisedException = true;
     }
 
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 2932919..018dabd 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -60,7 +60,7 @@
         
     JSC::JSLock lock(false);
         
-    JSValuePtr handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData handleEventCallData;
     CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
     CallData callbackCallData;
@@ -76,11 +76,11 @@
         
     RefPtr<JSCustomSQLStatementErrorCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
     args.append(toJS(exec, error));
         
-    JSValuePtr result;
+    JSValue result;
     globalObject->globalData()->timeoutChecker.start();
     if (handleEventCallType != CallTypeNone)
         result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
@@ -98,7 +98,7 @@
         return true;
     }
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 
     return result.toBoolean(exec);
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
index 9918e71..a41ac78 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -100,7 +100,7 @@
         
     JSC::JSLock lock(false);
         
-    JSValuePtr handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
     CallData handleEventCallData;
     CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
     CallData callbackCallData;
@@ -116,7 +116,7 @@
         
     RefPtr<JSCustomSQLTransactionCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
 
     globalObject->globalData()->timeoutChecker.start();
@@ -132,7 +132,7 @@
         raisedException = true;
     }
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
     
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
index f6e59f6..324e2bb 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -46,49 +46,46 @@
 {
 }
     
-bool JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
+void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
 {
     ASSERT(m_callback);
     ASSERT(m_frame);
-        
+
     if (!m_frame->script()->isEnabled())
-        return true;
-        
+        return;
+
     JSGlobalObject* globalObject = m_frame->script()->globalObject();
     ExecState* exec = globalObject->globalExec();
-        
+
     JSC::JSLock lock(false);
-        
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
             // FIXME: Should an exception be thrown here?
-            return true;
+            return;
         }
         function = m_callback;
     }
 
     RefPtr<JSCustomSQLTransactionErrorCallback> protect(this);
-        
-    ArgList args;
+
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, error));
 
-    JSValuePtr result;
     globalObject->globalData()->timeoutChecker.start();
-    result = call(exec, function, callType, callData, m_callback, args);
+    call(exec, function, callType, callData, m_callback, args);
     globalObject->globalData()->timeoutChecker.stop();
-        
+
     if (exec->hadException())
         reportCurrentException(exec);
-        
-    Document::updateDocumentsRendering();
-    
-    return result.toBoolean(exec);
+
+    Document::updateStyleForAllDocuments();
 }
-    
+
 }
 
 #endif // ENABLE(DATABASE)
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
index 5f3d727..be3df29 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -50,7 +50,7 @@
 public:
     static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, frame)); }
     
-    virtual bool handleEvent(SQLError*);
+    virtual void handleEvent(SQLError*);
 
 private:
     JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, Frame*);
diff --git a/WebCore/bindings/js/JSCustomVoidCallback.cpp b/WebCore/bindings/js/JSCustomVoidCallback.cpp
index 23e9fa6..f3f76c4 100644
--- a/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -57,7 +57,7 @@
         
     JSC::JSLock lock(false);
         
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -71,7 +71,7 @@
         
     RefPtr<JSCustomVoidCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     
     globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
@@ -80,10 +80,10 @@
     if (exec->hadException())
         reportCurrentException(exec);
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
  
-PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValuePtr value)
+PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValue value)
 {
     JSObject* object = value.getObject();
     if (!object)
diff --git a/WebCore/bindings/js/JSCustomVoidCallback.h b/WebCore/bindings/js/JSCustomVoidCallback.h
index f54ddb6..9cd7c34 100644
--- a/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -55,7 +55,7 @@
         RefPtr<Frame> m_frame;
     };
 
-    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValuePtr);
+    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index 5187411..6361e70 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -39,7 +39,7 @@
 
 using namespace JSC;
 
-PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecState* exec, JSC::JSValuePtr value)
+PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecState* exec, JSC::JSValue value)
 {
     if (value.isUndefinedOrNull())
         return 0;
@@ -77,7 +77,7 @@
     JSGlobalObject* globalObject = m_frame->script()->globalObject();
     ExecState* exec = globalObject->globalExec();
         
-    JSValuePtr function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
+    JSValue function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -92,11 +92,11 @@
 
     RefPtr<JSCustomXPathNSResolver> selfProtector(this);
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(jsString(exec, prefix));
 
     globalObject->globalData()->timeoutChecker.start();
-    JSValuePtr retval = call(exec, function, callType, callData, m_customResolver, args);
+    JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
     globalObject->globalData()->timeoutChecker.stop();
 
     String result;
@@ -107,7 +107,7 @@
             result = retval.toString(exec);
     }
 
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 
     return result;
 }
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.h b/WebCore/bindings/js/JSCustomXPathNSResolver.h
index fecbb61..44c44f9 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.h
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.h
@@ -44,7 +44,7 @@
 
     class JSCustomXPathNSResolver : public XPathNSResolver {
     public:
-        static PassRefPtr<JSCustomXPathNSResolver> create(JSC::ExecState*, JSC::JSValuePtr);
+        static PassRefPtr<JSCustomXPathNSResolver> create(JSC::ExecState*, JSC::JSValue);
         
         virtual ~JSCustomXPathNSResolver();
 
diff --git a/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 20d09dd..7e8d9ce 100644
--- a/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -60,18 +60,18 @@
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->mark();
+            (*vecIter)->markJSFunction();
     }
 }
 
-#if ENABLE(APPLICATION_CAHE_DYNAMIC_ENTRIES)
+#if ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
 
-JSValuePtr JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0).toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
 
     ExceptionCode ec = 0;
     bool result = impl()->hasItem(url, ec);
@@ -79,12 +79,12 @@
     return jsBoolean(result);
 }
 
-JSValuePtr JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0).toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
     
     ExceptionCode ec = 0;
     impl()->add(url, ec);
@@ -92,12 +92,12 @@
     return jsUndefined();
 }
 
-JSValuePtr JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0).toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
     
     ExceptionCode ec = 0;
     impl()->remove(url, ec);
@@ -105,29 +105,29 @@
     return jsUndefined();
 }
 
-#endif
+#endif // ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
 
-JSValuePtr JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0).toString(exec), listener.release(), args.at(exec, 2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0).toString(exec), listener, args.at(exec, 2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSDOMBinding.cpp b/WebCore/bindings/js/JSDOMBinding.cpp
index 6e27dc1..4f58797 100644
--- a/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/WebCore/bindings/js/JSDOMBinding.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
  *
  *  This library is free software; you can redistribute it and/or
@@ -33,6 +33,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLImageElement.h"
+#include "HTMLScriptElement.h"
 #include "HTMLNames.h"
 #include "JSDOMCoreException.h"
 #include "JSDOMWindowCustom.h"
@@ -259,32 +260,47 @@
     removeWrappers(document->wrapperCache());
 }
 
+static inline bool isObservableThroughDOM(JSNode* jsNode)
+{
+    // Certain conditions implicitly make a JS DOM node wrapper observable
+    // through the DOM, even if no explicit reference to it remains.
+
+    Node* node = jsNode->impl();
+
+    if (node->inDocument()) {
+        // 1. If a node is in the document, and its wrapper has custom properties,
+        // the wrapper is observable because future access to the node through the
+        // DOM must reflect those properties.
+        if (jsNode->hasCustomProperties())
+            return true;
+
+        // 2. If a node is in the document, and has event listeners, its wrapper is
+        // observable because its wrapper is responsible for marking those event listeners.
+        if (node->eventListeners().size())
+            return true; // Technically, we may overzealously mark a wrapper for a node that has only non-JS event listeners. Oh well.
+    } else {
+        // 3. If a wrapper is the last reference to an image or script element
+        // that is loading but not in the document, the wrapper is observable
+        // because it is the only thing keeping the image element alive, and if
+        // the image element is destroyed, its load event will not fire.
+        // FIXME: The DOM should manage this issue without the help of JavaScript wrappers.
+        if (node->hasTagName(imgTag) && !static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent())
+            return true;
+        if (node->hasTagName(scriptTag) && !static_cast<HTMLScriptElement*>(node)->haveFiredLoadEvent())
+            return true;
+    }
+
+    return false;
+}
+
 void markDOMNodesForDocument(Document* doc)
 {
-    // If a node's JS wrapper holds custom properties, those properties must
-    // persist every time the node is fetched from the DOM. So, we keep JS
-    // wrappers like that from being garbage collected.
-
     JSWrapperCache& nodeDict = doc->wrapperCache();
     JSWrapperCache::iterator nodeEnd = nodeDict.end();
     for (JSWrapperCache::iterator nodeIt = nodeDict.begin(); nodeIt != nodeEnd; ++nodeIt) {
         JSNode* jsNode = nodeIt->second;
-        Node* node = jsNode->impl();
-
-        if (jsNode->marked())
-            continue;
-
-        // No need to preserve a wrapper that has no custom properties or is no
-        // longer fetchable through the DOM.
-        if (!jsNode->hasCustomProperties() || !node->inDocument()) {
-            //... unless the wrapper wraps a loading image, since the "new Image"
-            // syntax allows an orphan image wrapper to be the last reference
-            // to a loading image, whose load event might have important side-effects.
-            if (!node->hasTagName(imgTag) || static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent())
-                continue;
-        }
-
-        jsNode->mark();
+        if (!jsNode->marked() && isObservableThroughDOM(jsNode))
+            jsNode->mark();
     }
 }
 
@@ -340,70 +356,70 @@
     wrapper->mark();
 }
 
-JSValuePtr jsStringOrNull(ExecState* exec, const String& s)
+JSValue jsStringOrNull(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsNull();
     return jsString(exec, s);
 }
 
-JSValuePtr jsOwnedStringOrNull(ExecState* exec, const UString& s)
+JSValue jsOwnedStringOrNull(ExecState* exec, const UString& s)
 {
     if (s.isNull())
         return jsNull();
     return jsOwnedString(exec, s);
 }
 
-JSValuePtr jsStringOrUndefined(ExecState* exec, const String& s)
+JSValue jsStringOrUndefined(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsUndefined();
     return jsString(exec, s);
 }
 
-JSValuePtr jsStringOrFalse(ExecState* exec, const String& s)
+JSValue jsStringOrFalse(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsBoolean(false);
     return jsString(exec, s);
 }
 
-JSValuePtr jsStringOrNull(ExecState* exec, const KURL& url)
+JSValue jsStringOrNull(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsNull();
     return jsString(exec, url.string());
 }
 
-JSValuePtr jsStringOrUndefined(ExecState* exec, const KURL& url)
+JSValue jsStringOrUndefined(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsUndefined();
     return jsString(exec, url.string());
 }
 
-JSValuePtr jsStringOrFalse(ExecState* exec, const KURL& url)
+JSValue jsStringOrFalse(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsBoolean(false);
     return jsString(exec, url.string());
 }
 
-UString valueToStringWithNullCheck(ExecState* exec, JSValuePtr value)
+UString valueToStringWithNullCheck(ExecState* exec, JSValue value)
 {
     if (value.isNull())
         return UString();
     return value.toString(exec);
 }
 
-UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValuePtr value)
+UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValue value)
 {
     if (value.isUndefinedOrNull())
         return UString();
     return value.toString(exec);
 }
 
-void reportException(JSC::ExecState* exec, JSValuePtr exception)
+void reportException(ExecState* exec, JSValue exception)
 {
     UString errorMessage = exception.toString(exec);
     JSObject* exceptionObject = exception.toObject(exec);
@@ -412,12 +428,19 @@
     exec->clearException();
 
     ScriptExecutionContext* scriptExecutionContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    ASSERT(scriptExecutionContext);
+
+    // Crash data indicates null-dereference crashes at this point in the Safari 4 Public Beta.
+    // It's harmless to return here without reporting the exception to the log and the debugger in this case.
+    if (!scriptExecutionContext)
+        return;
+
     scriptExecutionContext->reportException(errorMessage, lineNumber, exceptionSourceURL);
 }
 
-void reportCurrentException(JSC::ExecState* exec)
+void reportCurrentException(ExecState* exec)
 {
-    JSValuePtr exception = exec->exception();
+    JSValue exception = exec->exception();
     exec->clearException();
     reportException(exec, exception);
 }
@@ -430,7 +453,7 @@
     ExceptionCodeDescription description;
     getExceptionCodeDescription(ec, description);
 
-    JSValuePtr errorObject = noValue();
+    JSValue errorObject;
     switch (description.type) {
         case DOMExceptionType:
             errorObject = toJS(exec, DOMCoreException::create(description));
@@ -481,6 +504,12 @@
     return window && window->allowsAccessFrom(exec, message);
 }
 
+bool shouldAllowNavigation(ExecState* exec, Frame* frame)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    return lexicalFrame && lexicalFrame->loader()->shouldAllowNavigation(frame);
+}
+
 void printErrorMessageForFrame(Frame* frame, const String& message)
 {
     if (!frame)
@@ -489,37 +518,57 @@
         window->printErrorMessage(message);
 }
 
-JSValuePtr objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+Frame* toLexicalFrame(ExecState* exec)
+{
+    return asJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame();
+}
+
+Frame* toDynamicFrame(ExecState* exec)
+{
+    return asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+}
+
+bool processingUserGesture(ExecState* exec)
+{
+    Frame* frame = toDynamicFrame(exec);
+    return frame && frame->script()->processingUserGesture();
+}
+
+KURL completeURL(ExecState* exec, const String& relativeURL)
+{
+    // For histoical reasons, we need to complete the URL using the dynamic frame.
+    Frame* frame = toDynamicFrame(exec);
+    if (!frame)
+        return KURL();
+    return frame->loader()->completeURL(relativeURL);
+}
+
+JSValue objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 0, propertyName, objectProtoFuncToString);
 }
 
-ScriptState* scriptStateFromNode(Node* node)
+Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInfo* classInfo)
 {
-    if (!node)
-        return 0;
-    Document* document = node->document();
-    if (!document)
-        return 0;
-    Frame* frame = document->frame();
-    if (!frame)
-        return 0;
-    if (!frame->script()->isEnabled())
-        return 0;
-    return frame->script()->globalObject()->globalExec();
+    JSDOMStructureMap& structures = globalObject->structures();
+    return structures.get(classInfo).get();
+}
+
+Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+{
+    JSDOMStructureMap& structures = globalObject->structures();
+    ASSERT(!structures.contains(classInfo));
+    return structures.set(classInfo, structure).first->second.get();
 }
 
 Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
-    return structures.get(classInfo).get();
+    return getCachedDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), classInfo);
 }
 
 Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
-    ASSERT(!structures.contains(classInfo));
-    return structures.set(classInfo, structure).first->second.get();
+    return cacheDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), structure, classInfo);
 }
 
 JSObject* getCachedDOMConstructor(ExecState* exec, const ClassInfo* classInfo)
diff --git a/WebCore/bindings/js/JSDOMBinding.h b/WebCore/bindings/js/JSDOMBinding.h
index 71da21b..1378c91 100644
--- a/WebCore/bindings/js/JSDOMBinding.h
+++ b/WebCore/bindings/js/JSDOMBinding.h
@@ -25,7 +25,6 @@
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
 #include <runtime/JSFunction.h>
-#include "ScriptState.h"
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -73,21 +72,27 @@
     void markActiveObjectsForContext(JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::JSGlobalData& globalData, void* object);
 
+    JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSC::ExecState*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
 
+    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
+    {
+        if (JSC::Structure* structure = getCachedDOMStructure(globalObject, &WrapperClass::s_info))
+            return structure;
+        return cacheDOMStructure(globalObject, WrapperClass::createStructure(WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
+    }
     template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
     {
-        if (JSC::Structure* structure = getCachedDOMStructure(exec, &WrapperClass::s_info))
-            return structure;
-        return cacheDOMStructure(exec, WrapperClass::createStructure(WrapperClass::createPrototype(exec)), &WrapperClass::s_info);
+        return getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()));
     }
-    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
     {
-        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec)->storedPrototype()));
+        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(globalObject))->storedPrototype()));
     }
     #define CREATE_DOM_OBJECT_WRAPPER(exec, className, object) createDOMObjectWrapper<JS##className>(exec, static_cast<className*>(object))
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
@@ -98,7 +103,7 @@
         cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
     {
         if (!object)
             return JSC::jsNull();
@@ -117,7 +122,7 @@
         cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object, SVGElement* context)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object, SVGElement* context)
     {
         if (!object)
             return JSC::jsNull();
@@ -136,7 +141,7 @@
         cacheDOMNodeWrapper(node->document(), node, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMNodeWrapper(JSC::ExecState* exec, DOMClass* node)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMNodeWrapper(JSC::ExecState* exec, DOMClass* node)
     {
         if (!node)
             return JSC::jsNull();
@@ -147,29 +152,29 @@
 
     const JSC::HashTable* getHashTableForGlobalData(JSC::JSGlobalData&, const JSC::HashTable* staticTable);
 
-    void reportException(JSC::ExecState*, JSC::JSValuePtr exception);
+    void reportException(JSC::ExecState*, JSC::JSValue exception);
     void reportCurrentException(JSC::ExecState*);
 
     // Convert a DOM implementation exception code into a JavaScript exception in the execution state.
     void setDOMException(JSC::ExecState*, ExceptionCode);
 
-    JSC::JSValuePtr jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
-    JSC::JSValuePtr jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
+    JSC::JSValue jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
+    JSC::JSValue jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
 
-    JSC::JSValuePtr jsStringOrUndefined(JSC::ExecState*, const String&); // undefined if the string is null
-    JSC::JSValuePtr jsStringOrUndefined(JSC::ExecState*, const KURL&); // undefined if the URL is null
+    JSC::JSValue jsStringOrUndefined(JSC::ExecState*, const String&); // undefined if the string is null
+    JSC::JSValue jsStringOrUndefined(JSC::ExecState*, const KURL&); // undefined if the URL is null
 
-    JSC::JSValuePtr jsStringOrFalse(JSC::ExecState*, const String&); // boolean false if the string is null
-    JSC::JSValuePtr jsStringOrFalse(JSC::ExecState*, const KURL&); // boolean false if the URL is null
+    JSC::JSValue jsStringOrFalse(JSC::ExecState*, const String&); // boolean false if the string is null
+    JSC::JSValue jsStringOrFalse(JSC::ExecState*, const KURL&); // boolean false if the URL is null
 
     // See JavaScriptCore for explanation: Should be used for any UString that is already owned by another
     // object, to let the engine know that collecting the JSString wrapper is unlikely to save memory.
-    JSC::JSValuePtr jsOwnedStringOrNull(JSC::ExecState*, const JSC::UString&); 
+    JSC::JSValue jsOwnedStringOrNull(JSC::ExecState*, const JSC::UString&); 
 
-    JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValuePtr); // null if the value is null
-    JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValuePtr); // null if the value is null or undefined
+    JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null
+    JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null or undefined
 
-    template <typename T> inline JSC::JSValuePtr toJS(JSC::ExecState* exec, PassRefPtr<T> ptr) { return toJS(exec, ptr.get()); }
+    template <typename T> inline JSC::JSValue toJS(JSC::ExecState* exec, PassRefPtr<T> ptr) { return toJS(exec, ptr.get()); }
 
     bool checkNodeSecurity(JSC::ExecState*, Node*);
 
@@ -178,10 +183,14 @@
     // because we do not want current property values involved at all.
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*);
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*, String& message);
+    bool shouldAllowNavigation(JSC::ExecState*, Frame*);
     void printErrorMessageForFrame(Frame*, const String& message);
-    JSC::JSValuePtr objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
+    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
 
-    ScriptState* scriptStateFromNode(Node*);
+    Frame* toLexicalFrame(JSC::ExecState*);
+    Frame* toDynamicFrame(JSC::ExecState*);
+    bool processingUserGesture(JSC::ExecState*);
+    KURL completeURL(JSC::ExecState*, const String& relativeURL);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.cpp b/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 849c470..a7f7b21 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -30,12 +30,11 @@
 #include "Document.h"
 #include "JSDOMWindow.h"
 #include "JSEventListener.h"
-#ifdef ANDROID_FIX  // these are generated files, need to check ENABLE(WORKERS)
+
 #if ENABLE(WORKERS)
 #include "JSWorkerContext.h"
-#endif
-#endif
 #include "WorkerContext.h"
+#endif
 
 using namespace JSC;
 
@@ -53,26 +52,10 @@
 
 JSDOMGlobalObject::~JSDOMGlobalObject()
 {
-    // Clear any backpointers to the window
-    ProtectedListenersMap::iterator i1 = d()->jsProtectedEventListeners.begin();
-    ProtectedListenersMap::iterator e1 = d()->jsProtectedEventListeners.end();
-    for (; i1 != e1; ++i1)
-        i1->second->clearGlobalObject();
-
-    i1 = d()->jsProtectedInlineEventListeners.begin();
-    e1 = d()->jsProtectedInlineEventListeners.end();
-    for (; i1 != e1; ++i1)
-        i1->second->clearGlobalObject();
-
-    JSListenersMap::iterator i2 = d()->jsEventListeners.begin();
-    JSListenersMap::iterator e2 = d()->jsEventListeners.end();
-    for (; i2 != e2; ++i2)
-        i2->second->clearGlobalObject();
-
-    i2 = d()->jsInlineEventListeners.begin();
-    e2 = d()->jsInlineEventListeners.end();
-    for (; i2 != e2; ++i2)
-        i2->second->clearGlobalObject();
+    JSListenersMap::iterator it = d()->jsEventListeners.begin();
+    JSListenersMap::iterator end = d()->jsEventListeners.end();
+    for (; it != end; ++it)
+        it->second->clearGlobalObject();
 }
 
 void JSDOMGlobalObject::mark()
@@ -90,56 +73,32 @@
     }
 }
 
-JSProtectedEventListener* JSDOMGlobalObject::findJSProtectedEventListener(JSValuePtr val, bool isInline)
-{
-    if (!val.isObject())
-        return 0;
-    JSObject* object = asObject(val);
-    ProtectedListenersMap& listeners = isInline ? d()->jsProtectedInlineEventListeners : d()->jsProtectedEventListeners;
-    return listeners.get(object);
-}
-
-PassRefPtr<JSProtectedEventListener> JSDOMGlobalObject::findOrCreateJSProtectedEventListener(ExecState*, JSValuePtr val, bool isInline)
-{
-    if (JSProtectedEventListener* listener = findJSProtectedEventListener(val, isInline))
-        return listener;
-
-    if (!val.isObject())
-        return 0;
-
-    // The JSProtectedEventListener constructor adds it to our jsProtectedEventListeners map.
-    return JSProtectedEventListener::create(asObject(val), this, isInline).get();
-}
-
-JSEventListener* JSDOMGlobalObject::findJSEventListener(ExecState*, JSValuePtr val, bool isInline)
+JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValue val)
 {
     if (!val.isObject())
         return 0;
 
-    JSListenersMap& listeners = isInline ? d()->jsInlineEventListeners : d()->jsEventListeners;
-    return listeners.get(asObject(val));
+    return d()->jsEventListeners.get(asObject(val));
 }
 
-PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(ExecState* exec, JSValuePtr val, bool isInline)
+PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(JSValue val)
 {
-    if (JSEventListener* listener = findJSEventListener(exec, val, isInline))
+    if (JSEventListener* listener = findJSEventListener(val))
         return listener;
 
     if (!val.isObject())
         return 0;
 
     // The JSEventListener constructor adds it to our jsEventListeners map.
-    return JSEventListener::create(asObject(val), this, isInline).get();
+    return JSEventListener::create(asObject(val), this, false).get();
 }
 
-JSDOMGlobalObject::ProtectedListenersMap& JSDOMGlobalObject::jsProtectedEventListeners()
+PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
 {
-    return d()->jsProtectedEventListeners;
-}
+    if (!val.isObject())
+        return 0;
 
-JSDOMGlobalObject::ProtectedListenersMap& JSDOMGlobalObject::jsProtectedInlineEventListeners()
-{
-    return d()->jsProtectedInlineEventListeners;
+    return JSEventListener::create(asObject(val), this, true).get();
 }
 
 JSDOMGlobalObject::JSListenersMap& JSDOMGlobalObject::jsEventListeners()
@@ -147,17 +106,12 @@
     return d()->jsEventListeners;
 }
 
-JSDOMGlobalObject::JSListenersMap& JSDOMGlobalObject::jsInlineEventListeners()
-{
-    return d()->jsInlineEventListeners;
-}
-
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
 {
     d()->evt = evt;
 }
 
-Event* JSDOMGlobalObject::currentEvent()
+Event* JSDOMGlobalObject::currentEvent() const
 {
     return d()->evt;
 }
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.h b/WebCore/bindings/js/JSDOMGlobalObject.h
index 6ca3797..8e4e820 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -32,7 +32,7 @@
 namespace WebCore {
 
     class Event;
-    class JSProtectedEventListener;
+    class JSLazyEventListener;
     class JSEventListener;
     class ScriptExecutionContext;
 
@@ -53,28 +53,22 @@
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Finds a wrapper of a JS EventListener, returns 0 if no existing one.
-        JSProtectedEventListener* findJSProtectedEventListener(JSC::JSValuePtr, bool isInline = false);
-
-        // Finds or creates a wrapper of a JS EventListener. JS EventListener object is GC-protected.
-        PassRefPtr<JSProtectedEventListener> findOrCreateJSProtectedEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
-
         // Finds a wrapper of a GC-unprotected JS EventListener, returns 0 if no existing one.
-        JSEventListener* findJSEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
+        JSEventListener* findJSEventListener(JSC::JSValue);
 
         // Finds or creates a wrapper of a JS EventListener. JS EventListener object is *NOT* GC-protected.
-        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
+        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::JSValue);
 
-        typedef HashMap<JSC::JSObject*, JSProtectedEventListener*> ProtectedListenersMap;
+        // Creates a GC-protected JS EventListener for an "onXXX" event attribute.
+        // These listeners cannot be removed through the removeEventListener API.
+        PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
+
         typedef HashMap<JSC::JSObject*, JSEventListener*> JSListenersMap;
 
-        ProtectedListenersMap& jsProtectedEventListeners();
-        ProtectedListenersMap& jsProtectedInlineEventListeners();
         JSListenersMap& jsEventListeners();
-        JSListenersMap& jsInlineEventListeners();
 
         void setCurrentEvent(Event*);
-        Event* currentEvent();
+        Event* currentEvent() const;
 
         virtual void mark();
 
@@ -85,10 +79,7 @@
             JSDOMStructureMap structures;
             JSDOMConstructorMap constructors;
 
-            JSDOMGlobalObject::ProtectedListenersMap jsProtectedEventListeners;
-            JSDOMGlobalObject::ProtectedListenersMap jsProtectedInlineEventListeners;
             JSDOMGlobalObject::JSListenersMap jsEventListeners;
-            JSDOMGlobalObject::JSListenersMap jsInlineEventListeners;
 
             Event* evt;
         };
@@ -108,11 +99,11 @@
     }
 
     template<class ConstructorClass>
-    inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
+    inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, const JSDOMGlobalObject* globalObject)
     {
         if (JSC::JSObject* constructor = globalObject->constructors().get(&ConstructorClass::s_info))
             return constructor;
-        JSC::JSObject* constructor = new (exec) ConstructorClass(exec, globalObject->scriptExecutionContext());
+        JSC::JSObject* constructor = new (exec) ConstructorClass(exec, const_cast<JSDOMGlobalObject*>(globalObject));
         ASSERT(!globalObject->constructors().contains(&ConstructorClass::s_info));
         globalObject->constructors().set(&ConstructorClass::s_info, constructor);
         return constructor;
diff --git a/WebCore/bindings/js/JSDOMStringListCustom.cpp b/WebCore/bindings/js/JSDOMStringListCustom.cpp
index d1ea663..ac088af 100644
--- a/WebCore/bindings/js/JSDOMStringListCustom.cpp
+++ b/WebCore/bindings/js/JSDOMStringListCustom.cpp
@@ -32,14 +32,14 @@
 
 namespace WebCore {
 
-JSValuePtr JSDOMStringList::getByIndex(ExecState* exec, unsigned index)
+JSValue JSDOMStringList::getByIndex(ExecState* exec, unsigned index)
 {
     return jsString(exec, impl()->item(index));
 }
 
-JSValuePtr JSDOMStringList::item(ExecState* exec, const ArgList& args)
+JSValue JSDOMStringList::item(ExecState* exec, const ArgList& args)
 {
-    unsigned index = args.at(exec, 0).toUInt32(exec);
+    unsigned index = args.at(0).toUInt32(exec);
     if (index >= impl()->length())
         return jsNull();
 
diff --git a/WebCore/bindings/js/JSDOMWindowBase.cpp b/WebCore/bindings/js/JSDOMWindowBase.cpp
index 5e5ac2f..4fd1139 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *
  *  This library is free software; you can redistribute it and/or
@@ -25,106 +25,29 @@
 
 #include "CString.h"
 #include "Console.h"
-#include "DOMTimer.h"
 #include "DOMWindow.h"
 #include "Element.h"
-#include "FloatRect.h"
 #include "Frame.h"
-#include "FrameLoadRequest.h"
+#include "HTMLCollection.h"
 #include "HTMLDocument.h"
 #include "InspectorController.h"
-#include "JSAudioConstructor.h"
 #include "JSDOMWindowCustom.h"
-#include "JSEvent.h"
 #include "JSHTMLCollection.h"
-#include "JSImageConstructor.h"
-#include "JSMessageChannelConstructor.h"
 #include "JSNode.h"
-#include "JSWebKitCSSMatrixConstructor.h"
-#include "JSOptionConstructor.h"
-#include "JSWebKitPointConstructor.h"
-#include "JSWorkerConstructor.h"
-#include "JSXMLHttpRequestConstructor.h"
-#include "JSXSLTProcessorConstructor.h"
 #include "Logging.h"
-#include "MediaPlayer.h"
 #include "Page.h"
-#include "PlatformScreen.h"
-#include "PluginInfoStore.h"
-#include "RenderView.h"
-#include "ScheduledAction.h"
 #include "ScriptController.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
-#include "WindowFeatures.h"
-#include <runtime/JSLock.h>
-#include <wtf/MathExtras.h>
 
 using namespace JSC;
 
-static JSValuePtr windowProtoFuncOpen(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr windowProtoFuncShowModalDialog(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr windowProtoFuncNotImplemented(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-
-static JSValuePtr jsDOMWindowBaseCrypto(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsDOMWindowBaseEvent(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseEvent(ExecState*, JSObject*, JSValuePtr);
-
-// Constructors
-static JSValuePtr jsDOMWindowBaseAudio(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseAudio(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseImage(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseImage(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseMessageChannel(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseMessageChannel(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseWorker(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseWorker(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseOption(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseOption(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseWebKitCSSMatrix(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseWebKitCSSMatrix(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseWebKitPoint(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseWebKitPoint(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseXMLHttpRequest(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseXMLHttpRequest(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseXSLTProcessor(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseXSLTProcessor(ExecState*, JSObject*, JSValuePtr);
-
-#include "JSDOMWindowBase.lut.h"
-
 namespace WebCore {
 
-////////////////////// JSDOMWindowBase Object ////////////////////////
-
-const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, &JSDOMWindowBaseTable, 0 };
-
-/*
-@begin JSDOMWindowBaseTable
-# -- Functions --
-  open                          windowProtoFuncOpen                         DontDelete|Function 3
-  showModalDialog               windowProtoFuncShowModalDialog              DontDelete|Function 1
-# Not implemented
-  captureEvents                 windowProtoFuncNotImplemented               DontDelete|Function 0
-  releaseEvents                 windowProtoFuncNotImplemented               DontDelete|Function 0
-# -- Attributes --
-  crypto                        jsDOMWindowBaseCrypto                       DontDelete|ReadOnly
-  event                         jsDOMWindowBaseEvent                        DontDelete
-# -- Constructors --
-  Audio                         jsDOMWindowBaseAudio                        DontDelete
-  Image                         jsDOMWindowBaseImage                        DontDelete
-  MessageChannel                jsDOMWindowBaseMessageChannel               DontDelete
-  Option                        jsDOMWindowBaseOption                       DontDelete
-  WebKitCSSMatrix               jsDOMWindowBaseWebKitCSSMatrix              DontDelete
-  WebKitPoint                   jsDOMWindowBaseWebKitPoint                  DontDelete
-  Worker                        jsDOMWindowBaseWorker                       DontDelete
-  XMLHttpRequest                jsDOMWindowBaseXMLHttpRequest               DontDelete
-  XSLTProcessor                 jsDOMWindowBaseXSLTProcessor                DontDelete
-@end
-*/
+const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
 
 JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : impl(window)
-    , returnValueSlot(0)
     , shell(shell)
 {
 }
@@ -147,411 +70,22 @@
     symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, d()->impl->document()), DontDelete | ReadOnly);
 }
 
-JSDOMWindowBase::~JSDOMWindowBase()
-{
-    if (d()->impl->frame())
-        d()->impl->frame()->script()->clearFormerWindow(asJSDOMWindow(this));
-}
-
 ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
 {
     return d()->impl->document();
 }
 
-static bool allowPopUp(ExecState* exec)
-{
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-
-    ASSERT(frame);
-    if (frame->script()->processingUserGesture())
-        return true;
-    Settings* settings = frame->settings();
-    return settings && settings->JavaScriptCanOpenWindowsAutomatically();
-}
-
-static HashMap<String, String> parseModalDialogFeatures(const String& featuresArg)
-{
-    HashMap<String, String> map;
-
-    Vector<String> features;
-    featuresArg.split(';', features);
-    Vector<String>::const_iterator end = features.end();
-    for (Vector<String>::const_iterator it = features.begin(); it != end; ++it) {
-        String s = *it;
-        int pos = s.find('=');
-        int colonPos = s.find(':');
-        if (pos >= 0 && colonPos >= 0)
-            continue; // ignore any strings that have both = and :
-        if (pos < 0)
-            pos = colonPos;
-        if (pos < 0) {
-            // null string for value means key without value
-            map.set(s.stripWhiteSpace().lower(), String());
-        } else {
-            String key = s.left(pos).stripWhiteSpace().lower();
-            String val = s.substring(pos + 1).stripWhiteSpace().lower();
-            int spacePos = val.find(' ');
-            if (spacePos != -1)
-                val = val.left(spacePos);
-            map.set(key, val);
-        }
-    }
-
-    return map;
-}
-
-static Frame* createWindow(ExecState* exec, Frame* openerFrame, const String& url,
-    const String& frameName, const WindowFeatures& windowFeatures, JSValuePtr dialogArgs)
-{
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    ASSERT(activeFrame);
-
-    ResourceRequest request;
-
-    request.setHTTPReferrer(activeFrame->loader()->outgoingReferrer());
-    FrameLoader::addHTTPOriginIfNeeded(request, activeFrame->loader()->outgoingOrigin());
-    FrameLoadRequest frameRequest(request, frameName);
-
-    // FIXME: It's much better for client API if a new window starts with a URL, here where we
-    // know what URL we are going to open. Unfortunately, this code passes the empty string
-    // for the URL, but there's a reason for that. Before loading we have to set up the opener,
-    // openedByDOM, and dialogArguments values. Also, to decide whether to use the URL we currently
-    // do an allowsAccessFrom call using the window we create, which can't be done before creating it.
-    // We'd have to resolve all those issues to pass the URL instead of "".
-
-    bool created;
-    // We pass in the opener frame here so it can be used for looking up the frame name, in case the active frame
-    // is different from the opener frame, and the name references a frame relative to the opener frame, for example
-    // "_self" or "_parent".
-    Frame* newFrame = activeFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
-    if (!newFrame)
-        return 0;
-
-    newFrame->loader()->setOpener(openerFrame);
-    newFrame->loader()->setOpenedByDOM();
-
-    JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
-
-    if (dialogArgs)
-        newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
-
-    if (!protocolIs(url, "javascript") || newWindow->allowsAccessFrom(exec)) {
-        KURL completedURL = url.isEmpty() ? KURL("") : activeFrame->document()->completeURL(url);
-        bool userGesture = activeFrame->script()->processingUserGesture();
-
-        if (created)
-            newFrame->loader()->changeLocation(completedURL, activeFrame->loader()->outgoingReferrer(), false, false, userGesture);
-        else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedURL.string(), activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
-    }
-
-    return newFrame;
-}
-
-static bool canShowModalDialog(const Frame* frame)
-{
-    if (!frame)
-        return false;
-
-    Page* page = frame->page();
-    if (!page)
-        return false;
-
-    return page->chrome()->canRunModal();
-}
-
-static bool canShowModalDialogNow(const Frame* frame)
-{
-    if (!frame)
-        return false;
-
-    Page* page = frame->page();
-    if (!page)
-        return false;
-
-    return page->chrome()->canRunModalNow();
-}
-
-static JSValuePtr showModalDialog(ExecState* exec, Frame* frame, const String& url, JSValuePtr dialogArgs, const String& featureArgs)
-{
-    if (!canShowModalDialogNow(frame) || !allowPopUp(exec))
-        return jsUndefined();
-
-    const HashMap<String, String> features = parseModalDialogFeatures(featureArgs);
-
-    const bool trusted = false;
-
-    // The following features from Microsoft's documentation are not implemented:
-    // - default font settings
-    // - width, height, left, and top specified in units other than "px"
-    // - edge (sunken or raised, default is raised)
-    // - dialogHide: trusted && boolFeature(features, "dialoghide"), makes dialog hide when you print
-    // - help: boolFeature(features, "help", true), makes help icon appear in dialog (what does it do on Windows?)
-    // - unadorned: trusted && boolFeature(features, "unadorned");
-
-    if (!frame)
-        return jsUndefined();
-
-    FloatRect screenRect = screenAvailableRect(frame->view());
-
-    WindowFeatures wargs;
-    wargs.width = WindowFeatures::floatFeature(features, "dialogwidth", 100, screenRect.width(), 620); // default here came from frame size of dialog in MacIE
-    wargs.widthSet = true;
-    wargs.height = WindowFeatures::floatFeature(features, "dialogheight", 100, screenRect.height(), 450); // default here came from frame size of dialog in MacIE
-    wargs.heightSet = true;
-
-    wargs.x = WindowFeatures::floatFeature(features, "dialogleft", screenRect.x(), screenRect.right() - wargs.width, -1);
-    wargs.xSet = wargs.x > 0;
-    wargs.y = WindowFeatures::floatFeature(features, "dialogtop", screenRect.y(), screenRect.bottom() - wargs.height, -1);
-    wargs.ySet = wargs.y > 0;
-
-    if (WindowFeatures::boolFeature(features, "center", true)) {
-        if (!wargs.xSet) {
-            wargs.x = screenRect.x() + (screenRect.width() - wargs.width) / 2;
-            wargs.xSet = true;
-        }
-        if (!wargs.ySet) {
-            wargs.y = screenRect.y() + (screenRect.height() - wargs.height) / 2;
-            wargs.ySet = true;
-        }
-    }
-
-    wargs.dialog = true;
-    wargs.resizable = WindowFeatures::boolFeature(features, "resizable");
-    wargs.scrollbarsVisible = WindowFeatures::boolFeature(features, "scroll", true);
-    wargs.statusBarVisible = WindowFeatures::boolFeature(features, "status", !trusted);
-    wargs.menuBarVisible = false;
-    wargs.toolBarVisible = false;
-    wargs.locationBarVisible = false;
-    wargs.fullscreen = false;
-
-    Frame* dialogFrame = createWindow(exec, frame, url, "", wargs, dialogArgs);
-    if (!dialogFrame)
-        return jsUndefined();
-
-    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
-
-    // Get the return value either just before clearing the dialog window's
-    // properties (in JSDOMWindowBase::clear), or when on return from runModal.
-    JSValuePtr returnValue = noValue();
-    dialogWindow->setReturnValueSlot(&returnValue);
-    dialogFrame->page()->chrome()->runModal();
-    dialogWindow->setReturnValueSlot(0);
-
-    // If we don't have a return value, get it now.
-    // Either JSDOMWindowBase::clear was not called yet, or there was no return value,
-    // and in that case, there's no harm in trying again (no benefit either).
-    if (!returnValue)
-        returnValue = dialogWindow->getDirect(Identifier(exec, "returnValue"));
-
-    return returnValue ? returnValue : jsUndefined();
-}
-
-} // namespace WebCore
-
-using namespace WebCore;
-
-JSValuePtr jsDOMWindowBaseCrypto(ExecState*, const Identifier&, const PropertySlot&)
-{
-    return jsUndefined(); // FIXME: implement this
-}
-
-JSValuePtr jsDOMWindowBaseEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->currentEvent())
-        return jsUndefined();
-    return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->currentEvent());
-}
-
-JSValuePtr jsDOMWindowBaseImage(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSImageConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-#if !ENABLE(CHANNEL_MESSAGING)
-
-JSValuePtr jsDOMWindowBaseMessageChannel(ExecState*, const Identifier&, const PropertySlot&)
-{
-    return jsUndefined();
-}
-
-#else
-
-JSValuePtr jsDOMWindowBaseMessageChannel(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSMessageChannelConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-#endif
-
-JSValuePtr jsDOMWindowBaseOption(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSOptionConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-JSValuePtr jsDOMWindowBaseWebKitCSSMatrix(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec);
-}
- 
-JSValuePtr jsDOMWindowBaseXMLHttpRequest(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-JSValuePtr jsDOMWindowBaseAudio(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(VIDEO)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    if (!MediaPlayer::isAvailable())
-        return jsUndefined();
-    return getDOMConstructor<JSAudioConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-#else
-    UNUSED_PARAM(exec);
-    UNUSED_PARAM(slot);
-    return jsUndefined();
-#endif
-}
-
-JSValuePtr jsDOMWindowBaseWebKitPoint(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSWebKitPointConstructor>(exec);
-}
-
-JSValuePtr jsDOMWindowBaseWorker(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(WORKERS)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSWorkerConstructor>(exec);
-#else
-    UNUSED_PARAM(exec);
-    UNUSED_PARAM(slot);
-    return jsUndefined();
-#endif
-}
-
-JSValuePtr jsDOMWindowBaseXSLTProcessor(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(XSLT)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSXSLTProcessorConstructor>(exec);
-#else
-    UNUSED_PARAM(exec);
-    UNUSED_PARAM(slot);
-    return jsUndefined();
-#endif
-}
-
-void setJSDOMWindowBaseEvent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Event"), value);
-}
-
-void setJSDOMWindowBaseAudio(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Audio"), value);
-}
-
-void setJSDOMWindowBaseImage(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Image"), value);
-}
-
-void setJSDOMWindowBaseMessageChannel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "MessageChannel"), value);
-}
-
-void setJSDOMWindowBaseOption(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Option"), value);
-}
-
-void setJSDOMWindowBaseWorker(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Worker"), value);
-}
-
-void setJSDOMWindowBaseWebKitCSSMatrix(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "WebKitCSSMatrix"), value);
-}
-
-void setJSDOMWindowBaseWebKitPoint(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "WebKitPoint"), value);
-}
-
-void setJSDOMWindowBaseXMLHttpRequest(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequest"), value);
-}
-
-void setJSDOMWindowBaseXSLTProcessor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "XSLTProcessor"), value);
-}
-
-namespace WebCore {
-
-JSValuePtr JSDOMWindowBase::childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSDOMWindowBase::childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
 }
 
-JSValuePtr JSDOMWindowBase::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSDOMWindowBase::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(slot.index())->domWindow());
 }
 
-JSValuePtr JSDOMWindowBase::namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSDOMWindowBase::namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSDOMWindowBase* thisObj = static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()));
     Document* doc = thisObj->impl()->frame()->document();
@@ -577,25 +111,9 @@
         return true;
     }
 
-    const HashEntry* entry = JSDOMWindowBaseTable.entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (entry->function() == windowProtoFuncShowModalDialog) {
-                if (!canShowModalDialog(impl()->frame()))
-                    return false;
-            }
-            if (allowsAccessFrom(exec))
-                setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
-            else
-                slot.setUndefined();
-        } else
-            slot.setCustom(this, entry->propertyGetter());
-        return true;
-    }
-
     // Do prototype lookup early so that functions and attributes in the prototype can have
     // precedence over the index and name getters.  
-    JSValuePtr proto = prototype();
+    JSValue proto = prototype();
     if (proto.isObject()) {
         if (asObject(proto)->getPropertySlot(exec, propertyName, slot)) {
             if (!allowsAccessFrom(exec))
@@ -633,19 +151,8 @@
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void JSDOMWindowBase::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDOMWindowBase::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    const HashEntry* entry = JSDOMWindowBaseTable.entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (allowsAccessFrom(exec))
-                Base::put(exec, propertyName, value, slot);
-            return;
-        }
-        if (entry->attributes() & ReadOnly)
-            return;
-    }
-
     if (allowsAccessFrom(exec))
         Base::put(exec, propertyName, value, slot);
 }
@@ -692,6 +199,9 @@
 
 bool JSDOMWindowBase::supportsProfiling() const
 {
+#if !ENABLE(JAVASCRIPT_DEBUGGER)
+    return false;
+#else
     Frame* frame = impl()->frame();
     if (!frame)
         return false;
@@ -701,6 +211,7 @@
         return false;
 
     return page->inspectorController()->profilerEnabled();
+#endif
 }
 
 bool JSDOMWindowBase::shouldInterruptScript() const
@@ -721,21 +232,11 @@
     return page->chrome()->shouldInterruptJavaScript();
 }
 
-void JSDOMWindowBase::clearHelperObjectProperties()
+void JSDOMWindowBase::willRemoveFromWindowShell()
 {
     setCurrentEvent(0);
 }
 
-void JSDOMWindowBase::clear()
-{
-    JSLock lock(false);
-
-    if (d()->returnValueSlot && !*d()->returnValueSlot)
-        *d()->returnValueSlot = getDirect(Identifier(globalExec(), "returnValue"));
-
-    clearHelperObjectProperties();
-}
-
 JSObject* JSDOMWindowBase::toThisObject(ExecState*) const
 {
     return shell();
@@ -757,137 +258,7 @@
     return globalData;
 }
 
-} // namespace WebCore
-
-using namespace WebCore;
-
-JSValuePtr windowProtoFuncOpen(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    JSDOMWindow* window = toJSDOMWindow(thisValue);
-    if (!window)
-        return throwError(exec, TypeError);
-    if (!window->allowsAccessFrom(exec))
-        return jsUndefined();
-
-    Frame* frame = window->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
-        return  jsUndefined();
-
-    Page* page = frame->page();
-
-    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
-    AtomicString frameName = args.at(exec, 1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(exec, 1).toString(exec));
-
-    // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
-    // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
-    if (!allowPopUp(exec) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
-        return jsUndefined();
-
-    // Get the target frame for the special cases of _top and _parent.  In those
-    // cases, we can schedule a location change right now and return early.
-    bool topOrParent = false;
-    if (frameName == "_top") {
-        frame = frame->tree()->top();
-        topOrParent = true;
-    } else if (frameName == "_parent") {
-        if (Frame* parent = frame->tree()->parent())
-            frame = parent;
-        topOrParent = true;
-    }
-    if (topOrParent) {
-        if (!activeFrame->loader()->shouldAllowNavigation(frame))
-            return jsUndefined();
-
-        String completedURL;
-        if (!urlString.isEmpty())
-            completedURL = activeFrame->document()->completeURL(urlString).string();
-
-        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
-        if (!completedURL.isEmpty() && (!protocolIs(completedURL, "javascript") || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
-            bool userGesture = activeFrame->script()->processingUserGesture();
-            frame->loader()->scheduleLocationChange(completedURL, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
-        }
-        return toJS(exec, frame->domWindow());
-    }
-
-    // In the case of a named frame or a new window, we'll use the createWindow() helper
-    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2)));
-    FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
-                         windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
-    DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
-
-    windowFeatures.x = windowRect.x();
-    windowFeatures.y = windowRect.y();
-    windowFeatures.height = windowRect.height();
-    windowFeatures.width = windowRect.width();
-
-    frame = createWindow(exec, frame, urlString, frameName, windowFeatures, noValue());
-
-    if (!frame)
-        return jsUndefined();
-
-    return toJS(exec, frame->domWindow()); // global object
-}
-
-JSValuePtr windowProtoFuncShowModalDialog(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    JSDOMWindow* window = toJSDOMWindow(thisValue);
-    if (!window)
-        return throwError(exec, TypeError);
-    if (!window->allowsAccessFrom(exec))
-        return jsUndefined();
-
-    Frame* frame = window->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-
-    return showModalDialog(exec, frame, valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0)), args.at(exec, 1), valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2)));
-}
-
-JSValuePtr windowProtoFuncNotImplemented(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
-{
-    if (!toJSDOMWindow(thisValue))
-        return throwError(exec, TypeError);
-    return jsUndefined();
-}
-
-namespace WebCore {
-
-void JSDOMWindowBase::setReturnValueSlot(JSValuePtr* slot)
-{
-    d()->returnValueSlot = slot;
-}
-
-////////////////////// timeouts ////////////////////////
-
-int JSDOMWindowBase::installTimeout(ScheduledAction* a, int t, bool singleShot)
-{
-    return DOMTimer::install(scriptExecutionContext(), a, t, singleShot);
-}
-
-int JSDOMWindowBase::installTimeout(const UString& handler, int t, bool singleShot)
-{
-    return installTimeout(new ScheduledAction(handler), t, singleShot);
-}
-
-int JSDOMWindowBase::installTimeout(ExecState* exec, JSValuePtr func, const ArgList& args, int t, bool singleShot)
-{
-    return installTimeout(new ScheduledAction(exec, func, args), t, singleShot);
-}
-
-void JSDOMWindowBase::removeTimeout(int timeoutId)
-{
-    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
-}
-
-void JSDOMWindowBase::disconnectFrame()
-{
-}
-
-JSValuePtr toJS(ExecState*, DOMWindow* domWindow)
+JSValue toJS(ExecState*, DOMWindow* domWindow)
 {
     if (!domWindow)
         return jsNull();
@@ -904,7 +275,7 @@
     return frame->script()->windowShell()->window();
 }
 
-JSDOMWindow* toJSDOMWindow(JSValuePtr value)
+JSDOMWindow* toJSDOMWindow(JSValue value)
 {
     if (!value.isObject())
         return 0;
diff --git a/WebCore/bindings/js/JSDOMWindowBase.h b/WebCore/bindings/js/JSDOMWindowBase.h
index ef87f20..6d93196 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/WebCore/bindings/js/JSDOMWindowBase.h
@@ -34,10 +34,8 @@
     class Frame;
     class JSDOMWindow;
     class JSDOMWindowShell;
-    class JSProtectedEventListener;
     class JSLocation;
     class JSEventListener;
-    class ScheduledAction;
     class SecurityOrigin;
 
     class JSDOMWindowBasePrivate;
@@ -45,32 +43,20 @@
     // This is the only WebCore JS binding which does not inherit from DOMObject
     class JSDOMWindowBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
-
-        friend class ScheduledAction;
     protected:
         JSDOMWindowBase(PassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
-        virtual ~JSDOMWindowBase();
-
         void updateDocument();
 
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        void disconnectFrame();
-
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
 
-        int installTimeout(const JSC::UString& handler, int t, bool singleShot);
-        int installTimeout(JSC::ExecState*, JSC::JSValuePtr function, const JSC::ArgList& args, int t, bool singleShot);
-        void removeTimeout(int timeoutId);
-
-        void clear();
-
-        // Set a place to put a dialog return value when the window is cleared.
-        void setReturnValueSlot(JSC::JSValuePtr* slot);
+        // Called just before removing this window from the JSDOMWindowShell.
+        void willRemoveFromWindowShell();
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
@@ -100,17 +86,12 @@
             JSDOMWindowBaseData(PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
             RefPtr<DOMWindow> impl;
-
-            JSC::JSValuePtr* returnValueSlot;
             JSDOMWindowShell* shell;
         };
 
-        static JSC::JSValuePtr childFrameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr namedItemGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-        void clearHelperObjectProperties();
-        int installTimeout(ScheduledAction*, int interval, bool singleShot);
+        static JSC::JSValue childFrameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue namedItemGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
@@ -119,11 +100,11 @@
     };
 
     // Returns a JSDOMWindow or jsNull()
-    JSC::JSValuePtr toJS(JSC::ExecState*, DOMWindow*);
+    JSC::JSValue toJS(JSC::ExecState*, DOMWindow*);
 
     // Returns JSDOMWindow or 0
     JSDOMWindow* toJSDOMWindow(Frame*);
-    JSDOMWindow* toJSDOMWindow(JSC::JSValuePtr);
+    JSDOMWindow* toJSDOMWindow(JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.cpp b/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 703ad8a..b8c30c7 100644
--- a/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,17 +25,39 @@
 #include "DOMWindow.h"
 #include "Document.h"
 #include "ExceptionCode.h"
+#include "FloatRect.h"
 #include "Frame.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
+#include "FrameView.h"
+#include "History.h"
+#include "JSAudioConstructor.h"
 #include "JSDOMWindowShell.h"
+#include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSHistory.h"
+#include "JSImageConstructor.h"
+#include "JSLocation.h"
+#include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSOptionConstructor.h"
+#include "JSWebKitCSSMatrixConstructor.h"
+#include "JSWebKitPointConstructor.h"
+#include "JSWorkerConstructor.h"
+#include "JSXMLHttpRequestConstructor.h"
+#include "JSXSLTProcessorConstructor.h"
+#include "Location.h"
+#include "MediaPlayer.h"
 #include "MessagePort.h"
+#include "Page.h"
+#include "PlatformScreen.h"
+#include "RegisteredEventListener.h"
+#include "ScheduledAction.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "WindowFeatures.h"
 #include <runtime/JSObject.h>
-#include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
 
@@ -45,6 +67,8 @@
 {
     Base::mark();
 
+    markEventListeners(impl()->eventListeners());
+
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
     markDOMObjectWrapper(globalData, impl()->optionalConsole());
@@ -97,6 +121,11 @@
     // Only allow defining getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
+
+    // Don't allow shadowing location using defineGetter.
+    if (propertyName == "location")
+        return;
+
     Base::defineGetter(exec, propertyName, getterFunction);
 }
 
@@ -108,7 +137,7 @@
     Base::defineSetter(exec, propertyName, setterFunction);
 }
 
-JSValuePtr JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow looking-up getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -116,7 +145,7 @@
     return Base::lookupGetter(exec, propertyName);
 }
 
-JSValuePtr JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow looking-up setters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -124,17 +153,41 @@
     return Base::lookupSetter(exec, propertyName);
 }
 
-void JSDOMWindow::setLocation(ExecState* exec, JSValuePtr value)
+// Custom Attributes
+
+JSValue JSDOMWindow::history(ExecState* exec) const
 {
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
+    History* history = impl()->history();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), history))
+        return wrapper;
+
+    JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, const_cast<JSDOMWindow*>(this)), history);
+    cacheDOMObjectWrapper(exec->globalData(), history, jsHistory);
+    return jsHistory;
+}
+
+JSValue JSDOMWindow::location(ExecState* exec) const
+{
+    Location* location = impl()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, const_cast<JSDOMWindow*>(this)), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
+}
+
+void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
         return;
 
 #if ENABLE(DASHBOARD_SUPPORT)
     // To avoid breaking old widgets, make "var location =" in a top-level frame create
     // a property named "location" instead of performing a navigation (<rdar://problem/5688039>).
-    if (Settings* settings = activeFrame->settings()) {
-        if (settings->usesDashboardBackwardCompatibilityMode() && !activeFrame->tree()->parent()) {
+    if (Settings* settings = lexicalFrame->settings()) {
+        if (settings->usesDashboardBackwardCompatibilityMode() && !lexicalFrame->tree()->parent()) {
             if (allowsAccessFrom(exec))
                 putDirect(Identifier(exec, "location"), value);
             return;
@@ -142,29 +195,307 @@
     }
 #endif
 
-    if (!activeFrame->loader()->shouldAllowNavigation(impl()->frame()))
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    if (!shouldAllowNavigation(exec, frame))
         return;
-    String dstUrl = activeFrame->loader()->completeURL(value.toString(exec)).string();
-    if (!protocolIs(dstUrl, "javascript") || allowsAccessFrom(exec)) {
-        bool userGesture = activeFrame->script()->processingUserGesture();
+
+    KURL url = completeURL(exec, value.toString(exec));
+    if (url.isNull())
+        return;
+
+    if (!protocolIsJavaScript(url) || allowsAccessFrom(exec)) {
         // We want a new history item if this JS was called via a user gesture
-        impl()->frame()->loader()->scheduleLocationChange(dstUrl, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+        frame->loader()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
     }
 }
 
-JSValuePtr JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::crypto(ExecState*) const
+{
+    return jsUndefined();
+}
+
+JSValue JSDOMWindow::event(ExecState* exec) const
+{
+    Event* event = currentEvent();
+    if (!event)
+        return jsUndefined();
+    return toJS(exec, event);
+}
+
+JSValue JSDOMWindow::image(ExecState* exec) const
+{
+    return getDOMConstructor<JSImageConstructor>(exec, this);
+}
+
+JSValue JSDOMWindow::option(ExecState* exec) const
+{
+    return getDOMConstructor<JSOptionConstructor>(exec, this);
+}
+
+#if ENABLE(VIDEO)
+JSValue JSDOMWindow::audio(ExecState* exec) const
+{
+    if (!MediaPlayer::isAvailable())
+        return jsUndefined();
+    return getDOMConstructor<JSAudioConstructor>(exec, this);
+}
+#endif
+
+JSValue JSDOMWindow::webKitPoint(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebKitPointConstructor>(exec);
+}
+
+JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec);
+}
+ 
+JSValue JSDOMWindow::xmlHttpRequest(ExecState* exec) const
+{
+    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
+}
+
+#if ENABLE(XSLT)
+JSValue JSDOMWindow::xsltProcessor(ExecState* exec) const
+{
+    return getDOMConstructor<JSXSLTProcessorConstructor>(exec);
+}
+#endif
+
+#if ENABLE(CHANNEL_MESSAGING)
+JSValue JSDOMWindow::messageChannel(ExecState* exec) const
+{
+    return getDOMConstructor<JSMessageChannelConstructor>(exec, this);
+}
+#endif
+
+#if ENABLE(WORKERS)
+JSValue JSDOMWindow::worker(ExecState* exec) const
+{
+    return getDOMConstructor<JSWorkerConstructor>(exec);
+}
+#endif
+
+// Custom functions
+
+// Helper for window.open() and window.showModalDialog()
+static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicFrame,
+                           Frame* openerFrame, const String& url, const String& frameName, 
+                           const WindowFeatures& windowFeatures, JSValue dialogArgs)
+{
+    ASSERT(lexicalFrame);
+    ASSERT(dynamicFrame);
+
+    ResourceRequest request;
+
+    // For whatever reason, Firefox uses the dynamicGlobalObject to determine
+    // the outgoingReferrer.  We replicate that behavior here.
+    String referrer = dynamicFrame->loader()->outgoingReferrer();
+    request.setHTTPReferrer(referrer);
+    FrameLoader::addHTTPOriginIfNeeded(request, dynamicFrame->loader()->outgoingOrigin());
+    FrameLoadRequest frameRequest(request, frameName);
+
+    // FIXME: It's much better for client API if a new window starts with a URL, here where we
+    // know what URL we are going to open. Unfortunately, this code passes the empty string
+    // for the URL, but there's a reason for that. Before loading we have to set up the opener,
+    // openedByDOM, and dialogArguments values. Also, to decide whether to use the URL we currently
+    // do an allowsAccessFrom call using the window we create, which can't be done before creating it.
+    // We'd have to resolve all those issues to pass the URL instead of "".
+
+    bool created;
+    // We pass in the opener frame here so it can be used for looking up the frame name, in case the active frame
+    // is different from the opener frame, and the name references a frame relative to the opener frame, for example
+    // "_self" or "_parent".
+    Frame* newFrame = lexicalFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
+    if (!newFrame)
+        return 0;
+
+    newFrame->loader()->setOpener(openerFrame);
+    newFrame->loader()->setOpenedByDOM();
+
+    JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
+
+    if (dialogArgs)
+        newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
+
+    if (!protocolIsJavaScript(url) || newWindow->allowsAccessFrom(exec)) {
+        KURL completedURL = url.isEmpty() ? KURL("") : completeURL(exec, url);
+        bool userGesture = processingUserGesture(exec);
+
+        if (created)
+            newFrame->loader()->changeLocation(completedURL, referrer, false, false, userGesture);
+        else if (!url.isEmpty())
+            newFrame->loader()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+    }
+
+    return newFrame;
+}
+
+JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return jsUndefined();
+    Frame* dynamicFrame = toDynamicFrame(exec);
+    if (!dynamicFrame)
+        return jsUndefined();
+
+    Page* page = frame->page();
+
+    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
+
+    // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
+    // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
+    if (!DOMWindow::allowPopUp(dynamicFrame) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
+        return jsUndefined();
+
+    // Get the target frame for the special cases of _top and _parent.  In those
+    // cases, we can schedule a location change right now and return early.
+    bool topOrParent = false;
+    if (frameName == "_top") {
+        frame = frame->tree()->top();
+        topOrParent = true;
+    } else if (frameName == "_parent") {
+        if (Frame* parent = frame->tree()->parent())
+            frame = parent;
+        topOrParent = true;
+    }
+    if (topOrParent) {
+        if (!shouldAllowNavigation(exec, frame))
+            return jsUndefined();
+
+        String completedURL;
+        if (!urlString.isEmpty())
+            completedURL = completeURL(exec, urlString).string();
+
+        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
+        if (!completedURL.isEmpty() && (!protocolIsJavaScript(completedURL) || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
+            bool userGesture = processingUserGesture(exec);
+
+            // For whatever reason, Firefox uses the dynamicGlobalObject to
+            // determine the outgoingReferrer.  We replicate that behavior
+            // here.
+            String referrer = dynamicFrame->loader()->outgoingReferrer();
+
+            frame->loader()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+        }
+        return toJS(exec, frame->domWindow());
+    }
+
+    // In the case of a named frame or a new window, we'll use the createWindow() helper
+    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
+    FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
+                         windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
+    DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
+
+    windowFeatures.x = windowRect.x();
+    windowFeatures.y = windowRect.y();
+    windowFeatures.height = windowRect.height();
+    windowFeatures.width = windowRect.width();
+
+    frame = createWindow(exec, lexicalFrame, dynamicFrame, frame, urlString, frameName, windowFeatures, JSValue());
+
+    if (!frame)
+        return jsUndefined();
+
+    return toJS(exec, frame->domWindow());
+}
+
+JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return jsUndefined();
+    Frame* dynamicFrame = toDynamicFrame(exec);
+    if (!dynamicFrame)
+        return jsUndefined();
+
+    if (!DOMWindow::canShowModalDialogNow(frame) || !DOMWindow::allowPopUp(dynamicFrame))
+        return jsUndefined();
+
+    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    JSValue dialogArgs = args.at(1);
+    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+
+    HashMap<String, String> features;
+    DOMWindow::parseModalDialogFeatures(featureArgs, features);
+
+    const bool trusted = false;
+
+    // The following features from Microsoft's documentation are not implemented:
+    // - default font settings
+    // - width, height, left, and top specified in units other than "px"
+    // - edge (sunken or raised, default is raised)
+    // - dialogHide: trusted && boolFeature(features, "dialoghide"), makes dialog hide when you print
+    // - help: boolFeature(features, "help", true), makes help icon appear in dialog (what does it do on Windows?)
+    // - unadorned: trusted && boolFeature(features, "unadorned");
+
+    FloatRect screenRect = screenAvailableRect(frame->view());
+
+    WindowFeatures wargs;
+    wargs.width = WindowFeatures::floatFeature(features, "dialogwidth", 100, screenRect.width(), 620); // default here came from frame size of dialog in MacIE
+    wargs.widthSet = true;
+    wargs.height = WindowFeatures::floatFeature(features, "dialogheight", 100, screenRect.height(), 450); // default here came from frame size of dialog in MacIE
+    wargs.heightSet = true;
+
+    wargs.x = WindowFeatures::floatFeature(features, "dialogleft", screenRect.x(), screenRect.right() - wargs.width, -1);
+    wargs.xSet = wargs.x > 0;
+    wargs.y = WindowFeatures::floatFeature(features, "dialogtop", screenRect.y(), screenRect.bottom() - wargs.height, -1);
+    wargs.ySet = wargs.y > 0;
+
+    if (WindowFeatures::boolFeature(features, "center", true)) {
+        if (!wargs.xSet) {
+            wargs.x = screenRect.x() + (screenRect.width() - wargs.width) / 2;
+            wargs.xSet = true;
+        }
+        if (!wargs.ySet) {
+            wargs.y = screenRect.y() + (screenRect.height() - wargs.height) / 2;
+            wargs.ySet = true;
+        }
+    }
+
+    wargs.dialog = true;
+    wargs.resizable = WindowFeatures::boolFeature(features, "resizable");
+    wargs.scrollbarsVisible = WindowFeatures::boolFeature(features, "scroll", true);
+    wargs.statusBarVisible = WindowFeatures::boolFeature(features, "status", !trusted);
+    wargs.menuBarVisible = false;
+    wargs.toolBarVisible = false;
+    wargs.locationBarVisible = false;
+    wargs.fullscreen = false;
+
+    Frame* dialogFrame = createWindow(exec, lexicalFrame, dynamicFrame, frame, url, "", wargs, dialogArgs);
+    if (!dialogFrame)
+        return jsUndefined();
+
+    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
+    dialogFrame->page()->chrome()->runModal();
+
+    return dialogWindow->getDirect(Identifier(exec, "returnValue"));
+}
+
+JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
 {
     DOMWindow* window = impl();
 
-    DOMWindow* source = asJSDOMWindow(exec->dynamicGlobalObject())->impl();
-    String message = args.at(exec, 0).toString(exec);
+    DOMWindow* source = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
+    String message = args.at(0).toString(exec);
 
     if (exec->hadException())
         return jsUndefined();
 
-    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(exec, 1));
+    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(1));
 
-    String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, (args.size() == 2) ? 1 : 2));
+    String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at((args.size() == 2) ? 1 : 2));
     if (exec->hadException())
         return jsUndefined();
 
@@ -175,48 +506,30 @@
     return jsUndefined();
 }
 
-static JSValuePtr setTimeoutOrInterval(ExecState* exec, JSDOMWindow* window, const ArgList& args, bool timeout)
+JSValue JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr v = args.at(exec, 0);
-    int delay = args.at(exec, 1).toInt32(exec);
-    if (v.isString())
-        return jsNumber(exec, window->installTimeout(asString(v)->value(), delay, timeout));
-    CallData callData;
-    if (v.getCallData(callData) == CallTypeNone)
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
         return jsUndefined();
-    ArgList argsTail;
-    args.getSlice(2, argsTail);
-    return jsNumber(exec, window->installTimeout(exec, v, argsTail, delay, timeout));
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setTimeout(action, delay));
 }
 
-JSValuePtr JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
 {
-    return setTimeoutOrInterval(exec, this, args, true);
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setInterval(action, delay));
 }
 
-JSValuePtr JSDOMWindow::clearTimeout(ExecState* exec, const ArgList& args)
-{
-    removeTimeout(args.at(exec, 0).toInt32(exec));
-    return jsUndefined();
-}
-
-JSValuePtr JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
-{
-    return setTimeoutOrInterval(exec, this, args, false);
-}
-
-JSValuePtr JSDOMWindow::clearInterval(ExecState* exec, const ArgList& args)
-{
-    removeTimeout(args.at(exec, 0).toInt32(exec));
-    return jsUndefined();
-}
-
-JSValuePtr JSDOMWindow::atob(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::atob(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    JSValuePtr v = args.at(exec, 0);
+    JSValue v = args.at(0);
     if (v.isNull())
         return jsEmptyString(exec);
 
@@ -237,12 +550,12 @@
     return jsString(exec, String(out.data(), out.size()));
 }
 
-JSValuePtr JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    JSValuePtr v = args.at(exec, 0);
+    JSValue v = args.at(0);
     if (v.isNull())
         return jsEmptyString(exec);
 
@@ -262,31 +575,31 @@
     return jsString(exec, String(out.data(), out.size()));
 }
 
-JSValuePtr JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    if (RefPtr<JSProtectedEventListener> listener = findOrCreateJSProtectedEventListener(exec, args.at(exec, 1)))
-        frame->document()->addWindowEventListener(AtomicString(args.at(exec, 0).toString(exec)), listener.release(), args.at(exec, 2).toBoolean(exec));
+    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(AtomicString(args.at(0).toString(exec)), listener.release(), args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-JSValuePtr JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    if (JSProtectedEventListener* listener = findJSProtectedEventListener(args.at(exec, 1)))
-        frame->document()->removeWindowEventListener(AtomicString(args.at(exec, 0).toString(exec)), listener, args.at(exec, 2).toBoolean(exec));
+    if (JSEventListener* listener = findJSEventListener(args.at(1)))
+        impl()->removeEventListener(AtomicString(args.at(0).toString(exec)), listener, args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-DOMWindow* toDOMWindow(JSValuePtr value)
+DOMWindow* toDOMWindow(JSValue value)
 {
     if (!value.isObject())
         return 0;
@@ -298,24 +611,4 @@
     return 0;
 }
 
-JSValuePtr nonCachingStaticCloseFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionClose);
-}
-
-JSValuePtr nonCachingStaticBlurFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionBlur);
-}
-
-JSValuePtr nonCachingStaticFocusFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionFocus);
-}
-
-JSValuePtr nonCachingStaticPostMessageFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 2, propertyName, jsDOMWindowPrototypeFunctionPostMessage);
-}
-
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.h b/WebCore/bindings/js/JSDOMWindowCustom.h
index 73a9656..52ef4a0 100644
--- a/WebCore/bindings/js/JSDOMWindowCustom.h
+++ b/WebCore/bindings/js/JSDOMWindowCustom.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2008, 2009 Apple Inc. All rights reseved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -21,6 +21,7 @@
 
 #include "JSDOMWindow.h"
 #include "JSDOMWindowShell.h"
+#include <runtime/PrototypeFunction.h>
 #include <wtf/AlwaysInline.h>
 
 namespace WebCore {
@@ -35,10 +36,11 @@
     return static_cast<const JSDOMWindow*>(globalObject);
 }
 
-JSC::JSValuePtr nonCachingStaticCloseFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticBlurFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticFocusFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticPostMessageFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+template<JSC::NativeFunction nativeFunction, int length>
+JSC::JSValue nonCachingStaticFunctionGetter(JSC::ExecState* exec, const JSC::Identifier& propertyName, const JSC::PropertySlot&)
+{
+    return new (exec) JSC::PrototypeFunction(exec, length, propertyName, nativeFunction);
+}
 
 ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
 {
@@ -59,7 +61,7 @@
         }
         entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
         if (entry && (entry->attributes() & JSC::Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
-            slot.setCustom(this, nonCachingStaticCloseFunctionGetter);
+            slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
             return true;
         }
 
@@ -88,22 +90,27 @@
         if (entry->attributes() & JSC::Function) {
             if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticBlurFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
                     return true;
                 }
             } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticCloseFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
                     return true;
                 }
             } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticFocusFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
                     return true;
                 }
             } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticPostMessageFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
+                    slot.setUndefined();
                     return true;
                 }
             }
@@ -121,7 +128,7 @@
     return false;
 }
 
-inline bool JSDOMWindow::customPut(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::JSValuePtr value, JSC::PutPropertySlot& slot)
+inline bool JSDOMWindow::customPut(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::JSValue value, JSC::PutPropertySlot& slot)
 {
     if (!impl()->frame())
         return true;
@@ -144,8 +151,6 @@
     return false;
 }
 
-
-
 inline bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* other) const
 {
     if (allowsAccessFromPrivate(other))
@@ -154,7 +159,7 @@
     return false;
 }
 
-    inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec) const
+inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec) const
 {
     if (allowsAccessFromPrivate(exec->lexicalGlobalObject()))
         return true;
@@ -183,12 +188,6 @@
     if (originWindow == targetWindow)
         return true;
 
-    // JS may be attempting to access the "window" object, which should be valid,
-    // even if the document hasn't been constructed yet.  If the document doesn't
-    // exist yet allow JS to access the window object.
-    if (!originWindow->impl()->document())
-        return true;
-
     const SecurityOrigin* originSecurityOrigin = originWindow->impl()->securityOrigin();
     const SecurityOrigin* targetSecurityOrigin = targetWindow->impl()->securityOrigin();
 
diff --git a/WebCore/bindings/js/JSDOMWindowShell.cpp b/WebCore/bindings/js/JSDOMWindowShell.cpp
index f14c2f7..1bf478b 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -88,12 +88,12 @@
     return m_window->getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     m_window->put(exec, propertyName, value, slot);
 }
 
-void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     m_window->putWithAttributes(exec, propertyName, value, attributes);
 }
@@ -123,12 +123,12 @@
     m_window->defineSetter(exec, propertyName, setterFunction);
 }
 
-JSValuePtr JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->lookupGetter(exec, propertyName);
 }
 
-JSValuePtr JSDOMWindowShell::lookupSetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindowShell::lookupSetter(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->lookupSetter(exec, propertyName);
 }
@@ -147,16 +147,6 @@
     return m_window->impl();
 }
 
-void JSDOMWindowShell::disconnectFrame()
-{
-    m_window->disconnectFrame();
-}
-
-void JSDOMWindowShell::clear()
-{
-    m_window->clear();
-}
-
 void* JSDOMWindowShell::operator new(size_t size)
 {
     return JSDOMWindow::commonJSGlobalData()->heap.allocate(size);
@@ -166,7 +156,7 @@
 // Conversion methods
 // ----
 
-JSValuePtr toJS(ExecState*, Frame* frame)
+JSValue toJS(ExecState*, Frame* frame)
 {
     if (!frame)
         return jsNull();
diff --git a/WebCore/bindings/js/JSDOMWindowShell.h b/WebCore/bindings/js/JSDOMWindowShell.h
index 931a256..6f21892 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/WebCore/bindings/js/JSDOMWindowShell.h
@@ -55,12 +55,10 @@
         static const JSC::ClassInfo s_info;
 
         DOMWindow* impl() const;
-        void disconnectFrame();
-        void clear();
 
         void* operator new(size_t);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType)); 
         }
@@ -69,22 +67,22 @@
         virtual void mark();
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-        virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, unsigned attributes);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+        virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
         virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
         virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
-        virtual JSC::JSValuePtr lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
-        virtual JSC::JSValuePtr lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSObject* unwrappedObject();
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
         JSDOMWindow* m_window;
     };
 
-    JSC::JSValuePtr toJS(JSC::ExecState*, Frame*);
+    JSC::JSValue toJS(JSC::ExecState*, Frame*);
     JSDOMWindowShell* toJSDOMWindowShell(Frame*);
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDatabaseCustom.cpp b/WebCore/bindings/js/JSDatabaseCustom.cpp
index f0f2b69..af3b066 100644
--- a/WebCore/bindings/js/JSDatabaseCustom.cpp
+++ b/WebCore/bindings/js/JSDatabaseCustom.cpp
@@ -47,17 +47,17 @@
 
 using namespace JSC;
 
-JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
+JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
 {
-    String oldVersion = args.at(exec, 0).toString(exec);
-    String newVersion = args.at(exec, 1).toString(exec);
+    String oldVersion = args.at(0).toString(exec);
+    String newVersion = args.at(1).toString(exec);
 
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
     
     JSObject* object;
-    if (!(object = args.at(exec, 2).getObject())) {
+    if (!(object = args.at(2).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }
@@ -65,8 +65,8 @@
     RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
     
     RefPtr<SQLTransactionErrorCallback> errorCallback;
-    if (!args.at(exec, 3).isNull()) {
-        if (!(object = args.at(exec, 3).getObject())) {
+    if (!args.at(3).isNull()) {
+        if (!(object = args.at(3).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
@@ -75,8 +75,8 @@
     }
     
     RefPtr<VoidCallback> successCallback;
-    if (!args.at(exec, 4).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(exec, 4));
+    if (!args.at(4).isNull()) {
+        successCallback = toVoidCallback(exec, args.at(4));
         if (!successCallback) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -88,11 +88,11 @@
     return jsUndefined();
 }
 
-JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
+JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
 {
     JSObject* object;
     
-    if (!(object = args.at(exec, 0).getObject())) {
+    if (!(object = args.at(0).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }        
@@ -104,8 +104,8 @@
     RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     
-    if (args.size() > 1 && !args.at(exec, 1).isNull()) {
-        if (!(object = args.at(exec, 1).getObject())) {
+    if (args.size() > 1 && !args.at(1).isNull()) {
+        if (!(object = args.at(1).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
@@ -114,8 +114,8 @@
     }
 
     RefPtr<VoidCallback> successCallback;
-    if (args.size() > 2 && !args.at(exec, 2).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(exec, 2));
+    if (args.size() > 2 && !args.at(2).isNull()) {
+        successCallback = toVoidCallback(exec, args.at(2));
         if (!successCallback) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
diff --git a/WebCore/bindings/js/JSDocumentCustom.cpp b/WebCore/bindings/js/JSDocumentCustom.cpp
index c432aea..956327a 100644
--- a/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -27,6 +27,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
 #include "JSLocation.h"
+#include "Location.h"
 #include "ScriptController.h"
 
 #if ENABLE(SVG)
@@ -45,16 +46,23 @@
     markActiveObjectsForContext(*Heap::heap(this)->globalData(), impl());
 }
 
-JSValuePtr JSDocument::location(ExecState* exec) const
+JSValue JSDocument::location(ExecState* exec) const
 {
     Frame* frame = static_cast<Document*>(impl())->frame();
     if (!frame)
         return jsNull();
 
-    return toJS(exec, frame->domWindow()->location());
+    Location* location = frame->domWindow()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSDOMWindow* window = static_cast<JSDOMWindow*>(exec->lexicalGlobalObject());
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
 }
 
-void JSDocument::setLocation(ExecState* exec, JSValuePtr value)
+void JSDocument::setLocation(ExecState* exec, JSValue value)
 {
     Frame* frame = static_cast<Document*>(impl())->frame();
     if (!frame)
@@ -72,7 +80,7 @@
     frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
-JSValuePtr toJS(ExecState* exec, Document* document)
+JSValue toJS(ExecState* exec, Document* document)
 {
     if (!document)
         return jsNull();
diff --git a/WebCore/bindings/js/JSElementCustom.cpp b/WebCore/bindings/js/JSElementCustom.cpp
index f5ef4be..b12c185 100644
--- a/WebCore/bindings/js/JSElementCustom.cpp
+++ b/WebCore/bindings/js/JSElementCustom.cpp
@@ -53,7 +53,7 @@
 
 static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
 {
-    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIs(parseURL(value), "javascript")) {
+    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(parseURL(value))) {
         HTMLFrameElementBase* frame = static_cast<HTMLFrameElementBase*>(element);
         if (!checkNodeSecurity(exec, frame->contentDocument()))
             return false;
@@ -61,11 +61,11 @@
     return true;
 } 
 
-JSValuePtr JSElement::setAttribute(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttribute(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    AtomicString name = args.at(exec, 0).toString(exec);
-    AtomicString value = args.at(exec, 1).toString(exec);
+    AtomicString name = args.at(0).toString(exec);
+    AtomicString value = args.at(1).toString(exec);
 
     Element* imp = impl();
     if (!allowSettingSrcToJavascriptURL(exec, imp, name, value))
@@ -76,10 +76,10 @@
     return jsUndefined();
 }
 
-JSValuePtr JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    Attr* newAttr = toAttr(args.at(exec, 0));
+    Attr* newAttr = toAttr(args.at(0));
     if (!newAttr) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -89,17 +89,17 @@
     if (!allowSettingSrcToJavascriptURL(exec, imp, newAttr->name(), newAttr->value()))
         return jsUndefined();
 
-    JSValuePtr result = toJS(exec, WTF::getPtr(imp->setAttributeNode(newAttr, ec)));
+    JSValue result = toJS(exec, WTF::getPtr(imp->setAttributeNode(newAttr, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    AtomicString namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    AtomicString qualifiedName = args.at(exec, 1).toString(exec);
-    AtomicString value = args.at(exec, 2).toString(exec);
+    AtomicString namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    AtomicString qualifiedName = args.at(1).toString(exec);
+    AtomicString value = args.at(2).toString(exec);
 
     Element* imp = impl();
     if (!allowSettingSrcToJavascriptURL(exec, imp, qualifiedName, value))
@@ -110,10 +110,10 @@
     return jsUndefined();
 }
 
-JSValuePtr JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    Attr* newAttr = toAttr(args.at(exec, 0));
+    Attr* newAttr = toAttr(args.at(0));
     if (!newAttr) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -123,12 +123,12 @@
     if (!allowSettingSrcToJavascriptURL(exec, imp, newAttr->name(), newAttr->value()))
         return jsUndefined();
 
-    JSValuePtr result = toJS(exec, WTF::getPtr(imp->setAttributeNodeNS(newAttr, ec)));
+    JSValue result = toJS(exec, WTF::getPtr(imp->setAttributeNodeNS(newAttr, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr toJSNewlyCreated(ExecState* exec, Element* element)
+JSValue toJSNewlyCreated(ExecState* exec, Element* element)
 {
     if (!element)
         return jsNull();
diff --git a/WebCore/bindings/js/JSEventCustom.cpp b/WebCore/bindings/js/JSEventCustom.cpp
index 613e46d..a020d74 100644
--- a/WebCore/bindings/js/JSEventCustom.cpp
+++ b/WebCore/bindings/js/JSEventCustom.cpp
@@ -77,12 +77,12 @@
 
 namespace WebCore {
 
-JSValuePtr JSEvent::clipboardData(ExecState* exec) const
+JSValue JSEvent::clipboardData(ExecState* exec) const
 {
     return impl()->isClipboardEvent() ? toJS(exec, impl()->clipboardData()) : jsUndefined();
 }
 
-JSValuePtr toJS(ExecState* exec, Event* event)
+JSValue toJS(ExecState* exec, Event* event)
 {
     JSLock lock(false);
 
diff --git a/WebCore/bindings/js/JSEventListener.cpp b/WebCore/bindings/js/JSEventListener.cpp
index 4c9cf0d..b9ed685 100644
--- a/WebCore/bindings/js/JSEventListener.cpp
+++ b/WebCore/bindings/js/JSEventListener.cpp
@@ -31,15 +31,43 @@
 
 namespace WebCore {
 
-void JSAbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
+JSEventListener::JSEventListener(JSObject* function, JSDOMGlobalObject* globalObject, bool isAttribute)
+    : m_jsFunction(function)
+    , m_globalObject(globalObject)
+    , m_isAttribute(isAttribute)
+{
+    if (!m_isAttribute && m_jsFunction)
+        globalObject->jsEventListeners().set(m_jsFunction, this);
+}
+
+JSEventListener::~JSEventListener()
+{
+    if (!m_isAttribute && m_jsFunction && m_globalObject)
+        m_globalObject->jsEventListeners().remove(m_jsFunction);
+}
+
+JSObject* JSEventListener::jsFunction() const
+{
+    return m_jsFunction;
+}
+
+void JSEventListener::markJSFunction()
+{
+    if (m_jsFunction && !m_jsFunction->marked())
+        m_jsFunction->mark();
+    if (m_globalObject && !m_globalObject->marked())
+        m_globalObject->mark();
+}
+
+void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
 {
     JSLock lock(false);
 
-    JSObject* listener = function();
-    if (!listener)
+    JSObject* jsFunction = this->jsFunction();
+    if (!jsFunction)
         return;
 
-    JSDOMGlobalObject* globalObject = this->globalObject();
+    JSDOMGlobalObject* globalObject = m_globalObject;
     // Null check as clearGlobalObject() can clear this and we still get called back by
     // xmlhttprequest objects. See http://bugs.webkit.org/show_bug.cgi?id=13275
     // FIXME: Is this check still necessary? Requests are supposed to be stopped before clearGlobalObject() is called.
@@ -67,18 +95,18 @@
 
     ExecState* exec = globalObject->globalExec();
 
-    JSValuePtr handleEventFunction = listener->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
     CallType callType = handleEventFunction.getCallData(callData);
     if (callType == CallTypeNone) {
-        handleEventFunction = noValue();
-        callType = listener->getCallData(callData);
+        handleEventFunction = JSValue();
+        callType = jsFunction->getCallData(callData);
     }
 
     if (callType != CallTypeNone) {
         ref();
 
-        ArgList args;
+        MarkedArgumentBuffer args;
         args.append(toJS(exec, event));
 
         Event* savedEvent = globalObject->currentEvent();
@@ -90,18 +118,18 @@
         JSGlobalData* globalData = globalObject->globalData();
         DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);
 
-        JSValuePtr retval;
+        JSValue retval;
         if (handleEventFunction) {
             globalObject->globalData()->timeoutChecker.start();
-            retval = call(exec, handleEventFunction, callType, callData, listener, args);
+            retval = call(exec, handleEventFunction, callType, callData, jsFunction, args);
         } else {
-            JSValuePtr thisValue;
+            JSValue thisValue;
             if (isWindowEvent)
                 thisValue = globalObject->toThisObject(exec);
             else
                 thisValue = toJS(exec, event->currentTarget());
             globalObject->globalData()->timeoutChecker.start();
-            retval = call(exec, listener, callType, callData, thisValue, args);
+            retval = call(exec, jsFunction, callType, callData, thisValue, args);
         }
         globalObject->globalData()->timeoutChecker.stop();
 
@@ -112,7 +140,7 @@
         else {
             if (!retval.isUndefinedOrNull() && event->storesResultAsString())
                 event->storeResult(retval.toString(exec));
-            if (m_isInline) {
+            if (m_isAttribute) {
                 bool retvalbool;
                 if (retval.getBoolean(retvalbool) && !retvalbool)
                     event->preventDefault();
@@ -120,106 +148,14 @@
         }
 
         if (scriptExecutionContext->isDocument())
-            Document::updateDocumentsRendering();
+            Document::updateStyleForAllDocuments();
         deref();
     }
 }
 
-bool JSAbstractEventListener::virtualIsInline() const
+bool JSEventListener::virtualisAttribute() const
 {
-    return m_isInline;
-}
-
-// -------------------------------------------------------------------------
-
-JSEventListener::JSEventListener(JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-    : JSAbstractEventListener(isInline)
-    , m_listener(listener)
-    , m_globalObject(globalObject)
-{
-    if (m_listener) {
-        JSDOMWindow::JSListenersMap& listeners = isInline
-            ? globalObject->jsInlineEventListeners() : globalObject->jsEventListeners();
-        listeners.set(m_listener, this);
-    }
-}
-
-JSEventListener::~JSEventListener()
-{
-    if (m_listener && m_globalObject) {
-        JSDOMWindow::JSListenersMap& listeners = isInline()
-            ? m_globalObject->jsInlineEventListeners() : m_globalObject->jsEventListeners();
-        listeners.remove(m_listener);
-    }
-}
-
-JSObject* JSEventListener::function() const
-{
-    return m_listener;
-}
-
-JSDOMGlobalObject* JSEventListener::globalObject() const
-{
-    return m_globalObject;
-}
-
-void JSEventListener::clearGlobalObject()
-{
-    m_globalObject = 0;
-}
-
-void JSEventListener::mark()
-{
-    if (m_listener && !m_listener->marked())
-        m_listener->mark();
-}
-
-#ifndef NDEBUG
-static WTF::RefCountedLeakCounter eventListenerCounter("EventListener");
-#endif
-
-// -------------------------------------------------------------------------
-
-JSProtectedEventListener::JSProtectedEventListener(JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-    : JSAbstractEventListener(isInline)
-    , m_listener(listener)
-    , m_globalObject(globalObject)
-{
-    if (m_listener) {
-        JSDOMWindow::ProtectedListenersMap& listeners = isInline
-            ? m_globalObject->jsProtectedInlineEventListeners() : m_globalObject->jsProtectedEventListeners();
-        listeners.set(m_listener, this);
-    }
-#ifndef NDEBUG
-    eventListenerCounter.increment();
-#endif
-}
-
-JSProtectedEventListener::~JSProtectedEventListener()
-{
-    if (m_listener && m_globalObject) {
-        JSDOMWindow::ProtectedListenersMap& listeners = isInline()
-            ? m_globalObject->jsProtectedInlineEventListeners() : m_globalObject->jsProtectedEventListeners();
-        listeners.remove(m_listener);
-    }
-#ifndef NDEBUG
-    eventListenerCounter.decrement();
-#endif
-}
-
-JSObject* JSProtectedEventListener::function() const
-{
-    return m_listener;
-}
-
-JSDOMGlobalObject* JSProtectedEventListener::globalObject() const
-{
-    return m_globalObject;
-}
-
-void JSProtectedEventListener::clearGlobalObject()
-{
-    m_globalObject = 0;
+    return m_isAttribute;
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSEventListener.h b/WebCore/bindings/js/JSEventListener.h
index 9589001..ce34832 100644
--- a/WebCore/bindings/js/JSEventListener.h
+++ b/WebCore/bindings/js/JSEventListener.h
@@ -21,70 +21,39 @@
 #define JSEventListener_h
 
 #include "EventListener.h"
+#include "JSDOMWindow.h"
 #include <runtime/Protect.h>
 
 namespace WebCore {
 
     class JSDOMGlobalObject;
 
-    class JSAbstractEventListener : public EventListener {
+    class JSEventListener : public EventListener {
     public:
-        bool isInline() const { return m_isInline; }
-
-    protected:
-        JSAbstractEventListener(bool isInline)
-            : m_isInline(isInline)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isAttribute)
         {
-        }
-
-    private:
-        virtual void handleEvent(Event*, bool isWindowEvent);
-        virtual JSDOMGlobalObject* globalObject() const = 0;
-        virtual bool virtualIsInline() const;
-
-        bool m_isInline;
-    };
-
-    class JSEventListener : public JSAbstractEventListener {
-    public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-        {
-            return adoptRef(new JSEventListener(listener, globalObject, isInline));
+            return adoptRef(new JSEventListener(listener, globalObject, isAttribute));
         }
         virtual ~JSEventListener();
+        void clearGlobalObject() { m_globalObject = 0; }
 
-        void clearGlobalObject();
+        // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
+        bool isAttribute() const { return m_isAttribute; }
+
+        virtual JSC::JSObject* jsFunction() const;
 
     private:
-        JSEventListener(JSC::JSObject* listener, JSDOMGlobalObject*, bool isInline);
-
-        virtual JSC::JSObject* function() const;
-        virtual void mark();
-        virtual JSDOMGlobalObject* globalObject() const;
-
-        JSC::JSObject* m_listener;
-        JSDOMGlobalObject* m_globalObject;
-    };
-
-    class JSProtectedEventListener : public JSAbstractEventListener {
-    public:
-        static PassRefPtr<JSProtectedEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-        {
-            return adoptRef(new JSProtectedEventListener(listener, globalObject, isInline));
-        }
-        virtual ~JSProtectedEventListener();
-
-        void clearGlobalObject();
+        virtual void markJSFunction();
+        virtual void handleEvent(Event*, bool isWindowEvent);
+        virtual bool virtualisAttribute() const;
+        void clearJSFunctionInline();
 
     protected:
-        JSProtectedEventListener(JSC::JSObject* listener, JSDOMGlobalObject*, bool isInline);
+        JSEventListener(JSC::JSObject* function, JSDOMGlobalObject*, bool isAttribute);
 
-        mutable JSC::ProtectedPtr<JSC::JSObject> m_listener;
-        JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-
-    private:
-        virtual JSC::JSObject* function() const;
-        virtual JSDOMGlobalObject* globalObject() const;
+        mutable JSC::JSObject* m_jsFunction;
+        JSDOMGlobalObject* m_globalObject;
+        bool m_isAttribute;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSEventTarget.cpp b/WebCore/bindings/js/JSEventTarget.cpp
index d9cff4a..2058098 100644
--- a/WebCore/bindings/js/JSEventTarget.cpp
+++ b/WebCore/bindings/js/JSEventTarget.cpp
@@ -26,7 +26,10 @@
 #include "config.h"
 #include "JSEventTarget.h"
 
+#include "DOMWindow.h"
 #include "Document.h"
+#include "JSDOMWindow.h"
+#include "JSDOMWindowShell.h"
 #include "JSEventListener.h"
 #include "JSMessagePort.h"
 #include "JSNode.h"
@@ -57,7 +60,7 @@
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, EventTarget* target)
+JSValue toJS(ExecState* exec, EventTarget* target)
 {
     if (!target)
         return jsNull();
@@ -71,6 +74,9 @@
     if (Node* node = target->toNode())
         return toJS(exec, node);
 
+    if (DOMWindow* domWindow = target->toDOMWindow())
+        return toJS(exec, domWindow);
+
     if (XMLHttpRequest* xhr = target->toXMLHttpRequest())
         // XMLHttpRequest is always created via JS, so we don't need to use cacheDOMObject() here.
         return getCachedDOMObjectWrapper(exec->globalData(), xhr);
@@ -99,7 +105,7 @@
     return jsNull();
 }
 
-EventTarget* toEventTarget(JSC::JSValuePtr value)
+EventTarget* toEventTarget(JSC::JSValue value)
 {
     #define CONVERT_TO_EVENT_TARGET(type) \
         if (value.isObject(&JS##type::s_info)) \
@@ -110,6 +116,9 @@
     CONVERT_TO_EVENT_TARGET(XMLHttpRequestUpload)
     CONVERT_TO_EVENT_TARGET(MessagePort)
 
+    if (value.isObject(&JSDOMWindowShell::s_info))
+        return static_cast<JSDOMWindowShell*>(asObject(value))->impl();
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     CONVERT_TO_EVENT_TARGET(DOMApplicationCache)
 #endif
diff --git a/WebCore/bindings/js/JSEventTarget.h b/WebCore/bindings/js/JSEventTarget.h
index 02f3734..05df056 100644
--- a/WebCore/bindings/js/JSEventTarget.h
+++ b/WebCore/bindings/js/JSEventTarget.h
@@ -36,8 +36,8 @@
 
     class EventTarget;
 
-    JSC::JSValuePtr toJS(JSC::ExecState*, EventTarget*);
-    EventTarget* toEventTarget(JSC::JSValuePtr);
+    JSC::JSValue toJS(JSC::ExecState*, EventTarget*);
+    EventTarget* toEventTarget(JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSEventTargetBase.h b/WebCore/bindings/js/JSEventTargetBase.h
deleted file mode 100644
index b841ee9..0000000
--- a/WebCore/bindings/js/JSEventTargetBase.h
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSEventTargetBase_h
-#define JSEventTargetBase_h
-
-#include "Event.h"
-#include "EventNames.h"
-#include "JSEvent.h"
-
-#define JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, macro) \
-    macro(specificEventTarget, OnAbort, abortEvent) \
-    macro(specificEventTarget, OnBlur, blurEvent) \
-    macro(specificEventTarget, OnChange, changeEvent) \
-    macro(specificEventTarget, OnClick, clickEvent) \
-    macro(specificEventTarget, OnContextMenu, contextmenuEvent) \
-    macro(specificEventTarget, OnDblClick, dblclickEvent) \
-    macro(specificEventTarget, OnError, errorEvent) \
-    macro(specificEventTarget, OnFocus, focusEvent) \
-    macro(specificEventTarget, OnInput, inputEvent) \
-    macro(specificEventTarget, OnKeyDown, keydownEvent) \
-    macro(specificEventTarget, OnKeyPress, keypressEvent) \
-    macro(specificEventTarget, OnKeyUp, keyupEvent) \
-    macro(specificEventTarget, OnLoad, loadEvent) \
-    macro(specificEventTarget, OnMouseDown, mousedownEvent) \
-    macro(specificEventTarget, OnMouseMove, mousemoveEvent) \
-    macro(specificEventTarget, OnMouseOut, mouseoutEvent) \
-    macro(specificEventTarget, OnMouseOver, mouseoverEvent) \
-    macro(specificEventTarget, OnMouseUp, mouseupEvent) \
-    macro(specificEventTarget, OnMouseWheel, mousewheelEvent) \
-    macro(specificEventTarget, OnBeforeCut, beforecutEvent) \
-    macro(specificEventTarget, OnCut, cutEvent) \
-    macro(specificEventTarget, OnBeforeCopy, beforecopyEvent) \
-    macro(specificEventTarget, OnCopy, copyEvent) \
-    macro(specificEventTarget, OnBeforePaste, beforepasteEvent) \
-    macro(specificEventTarget, OnPaste, pasteEvent) \
-    macro(specificEventTarget, OnDragEnter, dragenterEvent) \
-    macro(specificEventTarget, OnDragOver, dragoverEvent) \
-    macro(specificEventTarget, OnDragLeave, dragleaveEvent) \
-    macro(specificEventTarget, OnDrop, dropEvent) \
-    macro(specificEventTarget, OnDragStart, dragstartEvent) \
-    macro(specificEventTarget, OnDrag, dragEvent) \
-    macro(specificEventTarget, OnDragEnd, dragendEvent) \
-    macro(specificEventTarget, OnReset, resetEvent) \
-    macro(specificEventTarget, OnResize, resizeEvent) \
-    macro(specificEventTarget, OnScroll, scrollEvent) \
-    macro(specificEventTarget, OnSearch, searchEvent) \
-    macro(specificEventTarget, OnSelect, selectEvent) \
-    macro(specificEventTarget, OnSelectStart, selectstartEvent) \
-    macro(specificEventTarget, OnSubmit, submitEvent) \
-    macro(specificEventTarget, OnUnload, unloadEvent) \
-/* #if ENABLE(TOUCH_EVENTS) // Android */ \
-    macro(specificEventTarget, OnTouchStart, touchstartEvent) \
-    macro(specificEventTarget, OnTouchMove, touchmoveEvent) \
-    macro(specificEventTarget, OnTouchEnd, touchendEvent) \
-    macro(specificEventTarget, OnTouchCancel, touchcancelEvent) \
-/* #endif */ \
-
-#define EVENT_LISTENER_GETTER(specificEventTarget, name, event) \
-JSC::JSValuePtr js##specificEventTarget##name(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot& slot) \
-{ \
-    return static_cast<JS##specificEventTarget*>(slot.slotBase())->getListener(event); \
-} \
-
-#define EVENT_LISTENER_SETTER(specificEventTarget, name, event) \
-void setJS##specificEventTarget##name(JSC::ExecState* exec, JSC::JSObject* baseObject, JSC::JSValuePtr value) \
-{ \
-    static_cast<JS##specificEventTarget*>(baseObject)->setListener(exec, event, value); \
-} \
-
-#define DECLARE_JS_EVENT_LISTENERS(specificEventTarget) \
-    JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, EVENT_LISTENER_GETTER) \
-    JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, EVENT_LISTENER_SETTER) \
-
-#endif // JSEventTargetBase_h
diff --git a/WebCore/bindings/js/JSGeolocationCustom.cpp b/WebCore/bindings/js/JSGeolocationCustom.cpp
index c818dd9..493166c 100644
--- a/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -39,28 +39,28 @@
 
 namespace WebCore {
 
-static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValuePtr value)
+static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
 {
     if (!value.isObject())
         return 0;
 
     JSObject* object = asObject(value);
 
-    JSValuePtr enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
+    JSValue enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
     if (exec->hadException())
         return 0;
     bool enableHighAccuracy = enableHighAccuracyValue.toBoolean(exec);
     if (exec->hadException())
         return 0;
 
-    JSValuePtr timeoutValue = object->get(exec, Identifier(exec, "timeout"));
+    JSValue timeoutValue = object->get(exec, Identifier(exec, "timeout"));
     if (exec->hadException())
         return 0;
     unsigned timeout = timeoutValue.toUInt32(exec);
     if (exec->hadException())
         return 0;
 
-    JSValuePtr maximumAgeValue = object->get(exec, Identifier(exec, "maximumAge"));
+    JSValue maximumAgeValue = object->get(exec, Identifier(exec, "maximumAge"));
     if (exec->hadException())
         return 0;
     unsigned maximumAge = maximumAgeValue.toUInt32(exec);
@@ -70,11 +70,11 @@
     return PositionOptions::create(enableHighAccuracy, timeout, maximumAge);
 }
 
-JSValuePtr JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
+JSValue JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
     RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(exec, 0).getObject();
+    JSObject* object = args.at(0).getObject();
     if (exec->hadException())
         return jsUndefined();
     if (!object) {
@@ -86,8 +86,8 @@
         positionCallback = JSCustomPositionCallback::create(object, frame);
     
     RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(exec, 1).isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1).getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -98,22 +98,22 @@
     }
     
     RefPtr<PositionOptions> positionOptions;
-    if (!args.at(exec, 2).isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(exec, 2));
+    if (!args.at(2).isUndefinedOrNull()) {
+        positionOptions = createPositionOptions(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
     }
 
-    m_impl->getCurrentPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.get());
+    m_impl->getCurrentPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
     
     return jsUndefined();
 }
 
-JSValuePtr JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
+JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
     RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(exec, 0).getObject();
+    JSObject* object = args.at(0).getObject();
     if (exec->hadException())
         return jsUndefined();
     if (!object) {
@@ -125,8 +125,8 @@
         positionCallback = JSCustomPositionCallback::create(object, frame);
     
     RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(exec, 1).isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1).getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -137,13 +137,13 @@
     }
     
     RefPtr<PositionOptions> positionOptions;
-    if (!args.at(exec, 2).isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(exec, 2));
+    if (!args.at(2).isUndefinedOrNull()) {
+        positionOptions = createPositionOptions(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
     }
 
-    int watchID = m_impl->watchPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.get());
+    int watchID = m_impl->watchPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
     return jsNumber(exec, watchID);
 }
 
diff --git a/WebCore/bindings/js/JSHTMLAllCollection.h b/WebCore/bindings/js/JSHTMLAllCollection.h
index 511c9d7..d559d3b 100644
--- a/WebCore/bindings/js/JSHTMLAllCollection.h
+++ b/WebCore/bindings/js/JSHTMLAllCollection.h
@@ -40,7 +40,7 @@
         {
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr proto) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
             return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::MasqueradesAsUndefined)); 
         }
diff --git a/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index a99a36d..de6565d 100644
--- a/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -38,7 +38,7 @@
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLAppletElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLAppletElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index e9f12bf..4100468 100644
--- a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -35,7 +35,7 @@
 
 namespace WebCore {
 
-static JSValuePtr getNamedItems(ExecState* exec, HTMLCollection* impl, const Identifier& propertyName)
+static JSValue getNamedItems(ExecState* exec, HTMLCollection* impl, const Identifier& propertyName)
 {
     Vector<RefPtr<Node> > namedItems;
     impl->namedItems(propertyName, namedItems);
@@ -51,7 +51,7 @@
 
 // HTMLCollections are strange objects, they support both get and call,
 // so that document.forms.item(0) and document.forms(0) both work.
-static JSValuePtr callHTMLCollection(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callHTMLCollection(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -64,7 +64,7 @@
     if (args.size() == 1) {
         // Support for document.all(<index>) etc.
         bool ok;
-        UString string = args.at(exec, 0).toString(exec);
+        UString string = args.at(0).toString(exec);
         unsigned index = string.toUInt32(&ok, false);
         if (ok)
             return toJS(exec, collection->item(index));
@@ -75,8 +75,8 @@
 
     // The second arg, if set, is the index of the item we want
     bool ok;
-    UString string = args.at(exec, 0).toString(exec);
-    unsigned index = args.at(exec, 1).toString(exec).toUInt32(&ok, false);
+    UString string = args.at(0).toString(exec);
+    unsigned index = args.at(1).toString(exec).toUInt32(&ok, false);
     if (ok) {
         String pstr = string;
         Node* node = collection->namedItem(pstr);
@@ -102,27 +102,27 @@
     return !getNamedItems(exec, thisObj, propertyName).isUndefined();
 }
 
-JSValuePtr JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
     return getNamedItems(exec, thisObj->impl(), propertyName);
 }
 
-JSValuePtr JSHTMLCollection::item(ExecState* exec, const ArgList& args)
+JSValue JSHTMLCollection::item(ExecState* exec, const ArgList& args)
 {
     bool ok;
-    uint32_t index = args.at(exec, 0).toString(exec).toUInt32(&ok, false);
+    uint32_t index = args.at(0).toString(exec).toUInt32(&ok, false);
     if (ok)
         return toJS(exec, impl()->item(index));
-    return getNamedItems(exec, impl(), Identifier(exec, args.at(exec, 0).toString(exec)));
+    return getNamedItems(exec, impl(), Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr JSHTMLCollection::namedItem(ExecState* exec, const ArgList& args)
+JSValue JSHTMLCollection::namedItem(ExecState* exec, const ArgList& args)
 {
-    return getNamedItems(exec, impl(), Identifier(exec, args.at(exec, 0).toString(exec)));
+    return getNamedItems(exec, impl(), Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr toJS(ExecState* exec, HTMLCollection* collection)
+JSValue toJS(ExecState* exec, HTMLCollection* collection)
 {
     if (!collection)
         return jsNull();
@@ -133,10 +133,10 @@
         return wrapper;
 
     switch (collection->type()) {
-        case HTMLCollection::SelectOptions:
+        case SelectOptions:
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLOptionsCollection, collection);
             break;
-        case HTMLCollection::DocAll:
+        case DocAll:
             typedef HTMLCollection HTMLAllCollection;
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLAllCollection, collection);
             break;
diff --git a/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index 1bc40ff..c113ec7 100644
--- a/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -54,7 +54,7 @@
     return atomicPropertyName && (document->hasNamedItem(atomicPropertyName) || document->hasExtraNamedItem(atomicPropertyName));
 }
 
-JSValuePtr JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLDocument* thisObj = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
     HTMLDocument* document = static_cast<HTMLDocument*>(thisObj->impl());
@@ -81,17 +81,17 @@
 
 // Custom attributes
 
-JSValuePtr JSHTMLDocument::all(ExecState* exec) const
+JSValue JSHTMLDocument::all(ExecState* exec) const
 {
     // If "all" has been overwritten, return the overwritten value
-    JSValuePtr v = getDirect(Identifier(exec, "all"));
+    JSValue v = getDirect(Identifier(exec, "all"));
     if (v)
         return v;
 
     return toJS(exec, static_cast<HTMLDocument*>(impl())->all().get());
 }
 
-void JSHTMLDocument::setAll(ExecState* exec, JSValuePtr value)
+void JSHTMLDocument::setAll(ExecState* exec, JSValue value)
 {
     // Add "all" to the property map.
     putDirect(Identifier(exec, "all"), value);
@@ -99,7 +99,7 @@
 
 // Custom functions
 
-JSValuePtr JSHTMLDocument::open(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::open(ExecState* exec, const ArgList& args)
 {
     // For compatibility with other browsers, pass open calls with more than 2 parameters to the window.
     if (args.size() > 2) {
@@ -107,7 +107,7 @@
         if (frame) {
             JSDOMWindowShell* wrapper = toJSDOMWindowShell(frame);
             if (wrapper) {
-                JSValuePtr function = wrapper->get(exec, Identifier(exec, "open"));
+                JSValue function = wrapper->get(exec, Identifier(exec, "open"));
                 CallData callData;
                 CallType callType = function.getCallData(callData);
                 if (callType == CallTypeNone)
@@ -135,14 +135,14 @@
 
     size_t size = args.size();
 
-    UString firstString = args.at(exec, 0).toString(exec);
+    UString firstString = args.at(0).toString(exec);
     SegmentedString segmentedString = String(firstString);
     if (size != 1) {
         if (!size)
             segmentedString.clear();
         else {
             for (size_t i = 1; i < size; ++i) {
-                UString subsequentString = args.at(exec, i).toString(exec);
+                UString subsequentString = args.at(i).toString(exec);
                 segmentedString.append(SegmentedString(String(subsequentString)));
             }
         }
@@ -154,13 +154,13 @@
     document->write(segmentedString, activeDocument);
 }
 
-JSValuePtr JSHTMLDocument::write(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::write(ExecState* exec, const ArgList& args)
 {
     documentWrite(exec, args, static_cast<HTMLDocument*>(impl()), DoNotAddNewline);
     return jsUndefined();
 }
 
-JSValuePtr JSHTMLDocument::writeln(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::writeln(ExecState* exec, const ArgList& args)
 {
     documentWrite(exec, args, static_cast<HTMLDocument*>(impl()), DoAddNewline);
     return jsUndefined();
diff --git a/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index 2856393..19aae86 100644
--- a/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -38,7 +38,7 @@
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLEmbedElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLEmbedElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index 68b727b..8bf543c 100644
--- a/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -43,7 +43,7 @@
     return namedItems.size();
 }
 
-JSValuePtr JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     HTMLFormElement* form = static_cast<HTMLFormElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     
@@ -57,7 +57,7 @@
     return jsUndefined();
 }
 
-JSValuePtr JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
+JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
 {
     Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!activeFrame)
diff --git a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
index a97a72a..0a5d1f1 100644
--- a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -40,14 +40,14 @@
 
 static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement* imp, const String& value)
 {
-    if (protocolIs(parseURL(value), "javascript")) {
+    if (protocolIsJavaScript(parseURL(value))) {
         if (!checkNodeSecurity(exec, imp->contentDocument()))
             return false;
     }
     return true;
 }
 
-void JSHTMLFrameElement::setSrc(ExecState* exec, JSValuePtr value)
+void JSHTMLFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
     String srcValue = valueToStringWithNullCheck(exec, value);
@@ -59,7 +59,7 @@
     return;
 }
 
-void JSHTMLFrameElement::setLocation(ExecState* exec, JSValuePtr value)
+void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
     String locationValue = valueToStringWithNullCheck(exec, value);
diff --git a/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
index f17cb89..05972e6 100644
--- a/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -27,6 +27,7 @@
 #include "JSHTMLFrameSetElement.h"
 
 #include "Document.h"
+#include "HTMLCollection.h"
 #include "HTMLFrameElement.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
@@ -46,7 +47,7 @@
     return frame && frame->hasTagName(frameTag);
 }
 
-JSValuePtr JSHTMLFrameSetElement::nameGetter(ExecState*, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFrameSetElement::nameGetter(ExecState*, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
diff --git a/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
index 1a0fc1c..afff977 100644
--- a/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
@@ -38,13 +38,13 @@
 
 namespace WebCore {
 
-void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValuePtr value)
+void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(impl());
 
     String srcValue = valueToStringWithNullCheck(exec, value);
 
-    if (protocolIs(parseURL(srcValue), "javascript")) {
+    if (protocolIsJavaScript(parseURL(srcValue))) {
         if (!checkNodeSecurity(exec, imp->contentDocument()))
             return;
     }
diff --git a/WebCore/bindings/js/JSHTMLInputElementCustom.cpp b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
index aa52007..6b47622 100644
--- a/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
@@ -26,13 +26,47 @@
 #include "config.h"
 #include "JSHTMLInputElement.h"
 
+#include "Document.h"
 #include "HTMLInputElement.h"
+#include "Settings.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSHTMLInputElement::selectionStart(ExecState* exec) const
+static bool needsGmailQuirk(HTMLInputElement* input)
+{
+    Document* document = input->document();
+
+    const KURL& url = document->url();
+    if (url.host() != "mail.google.com")
+        return false;
+
+    // As with other site-specific quirks, allow website developers to turn this off.
+    // In theory, this allows website developers to check if their fixes are effective.
+    Settings* settings = document->settings();
+    if (!settings)
+        return false;
+    if (!settings->needsSiteSpecificQuirks())
+        return false;
+
+    return true;
+}
+
+JSValue JSHTMLInputElement::type(ExecState* exec) const
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    const AtomicString& type = input->type();
+
+    DEFINE_STATIC_LOCAL(const AtomicString, url, ("url"));
+    DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
+
+    if (type == url && needsGmailQuirk(input))
+        return jsString(exec, text);
+    return jsString(exec, type);
+}
+
+JSValue JSHTMLInputElement::selectionStart(ExecState* exec) const
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
     if (!input->canHaveSelection())
@@ -41,7 +75,7 @@
     return jsNumber(exec, input->selectionStart());
 }
 
-void JSHTMLInputElement::setSelectionStart(ExecState* exec, JSValuePtr value)
+void JSHTMLInputElement::setSelectionStart(ExecState* exec, JSValue value)
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
     if (!input->canHaveSelection())
@@ -50,7 +84,7 @@
     input->setSelectionStart(value.toInt32(exec));
 }
 
-JSValuePtr JSHTMLInputElement::selectionEnd(ExecState* exec) const
+JSValue JSHTMLInputElement::selectionEnd(ExecState* exec) const
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
     if (!input->canHaveSelection())
@@ -59,7 +93,7 @@
     return jsNumber(exec, input->selectionEnd());
 }
 
-void JSHTMLInputElement::setSelectionEnd(ExecState* exec, JSValuePtr value)
+void JSHTMLInputElement::setSelectionEnd(ExecState* exec, JSValue value)
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
     if (!input->canHaveSelection())
@@ -68,14 +102,14 @@
     input->setSelectionEnd(value.toInt32(exec));
 }
 
-JSValuePtr JSHTMLInputElement::setSelectionRange(ExecState* exec, const ArgList& args)
+JSValue JSHTMLInputElement::setSelectionRange(ExecState* exec, const ArgList& args)
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
     if (!input->canHaveSelection())
         return throwError(exec, TypeError);
 
-    int start = args.at(exec, 0).toInt32(exec);
-    int end = args.at(exec, 1).toInt32(exec);
+    int start = args.at(0).toInt32(exec);
+    int end = args.at(1).toInt32(exec);
 
     input->setSelectionRange(start, end);
     return jsUndefined();
diff --git a/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index 5ad3454..f7f12b9 100644
--- a/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -38,7 +38,7 @@
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLObjectElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLObjectElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp b/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
index b6e53de..460ba08 100644
--- a/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
@@ -35,13 +35,13 @@
 
 namespace WebCore {
 
-JSValuePtr JSHTMLOptionsCollection::length(ExecState* exec) const
+JSValue JSHTMLOptionsCollection::length(ExecState* exec) const
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     return jsNumber(exec, imp->length());
 }
 
-void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValuePtr value)
+void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValue value)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     ExceptionCode ec = 0;
@@ -60,23 +60,23 @@
     setDOMException(exec, ec);
 }
 
-void JSHTMLOptionsCollection::indexSetter(ExecState* exec, unsigned index, JSValuePtr value)
+void JSHTMLOptionsCollection::indexSetter(ExecState* exec, unsigned index, JSValue value)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     HTMLSelectElement* base = static_cast<HTMLSelectElement*>(imp->base());
     selectIndexSetter(base, exec, index, value);
 }
 
-JSValuePtr JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
+JSValue JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
-    HTMLOptionElement* option = toHTMLOptionElement(args.at(exec, 0));
+    HTMLOptionElement* option = toHTMLOptionElement(args.at(0));
     ExceptionCode ec = 0;
     if (args.size() < 2)
         imp->add(option, ec);
     else {
         bool ok;
-        int index = args.at(exec, 1).toInt32(exec, ok);
+        int index = args.at(1).toInt32(exec, ok);
         if (exec->hadException())
             return jsUndefined();
         if (!ok)
@@ -88,7 +88,7 @@
     return jsUndefined();
 }
 
-JSValuePtr JSHTMLOptionsCollection::remove(ExecState* exec, const ArgList& args)
+JSValue JSHTMLOptionsCollection::remove(ExecState* exec, const ArgList& args)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     JSHTMLSelectElement* base = static_cast<JSHTMLSelectElement*>(asObject(toJS(exec, imp->base())));
diff --git a/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp b/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
index 755aec5..9bb6b75 100644
--- a/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
@@ -32,21 +32,21 @@
 using namespace JSC;
 using namespace HTMLNames;
 
-JSValuePtr JSHTMLSelectElement::remove(ExecState* exec, const ArgList& args)
+JSValue JSHTMLSelectElement::remove(ExecState* exec, const ArgList& args)
 {
     HTMLSelectElement& select = *static_cast<HTMLSelectElement*>(impl());
 
     // we support both options index and options objects
-    HTMLElement* element = toHTMLElement(args.at(exec, 0));
+    HTMLElement* element = toHTMLElement(args.at(0));
     if (element && element->hasTagName(optionTag))
         select.remove(static_cast<HTMLOptionElement*>(element)->index());
     else
-        select.remove(args.at(exec, 0).toInt32(exec));
+        select.remove(args.at(0).toInt32(exec));
 
     return jsUndefined();
 }
 
-void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned index, JSC::JSValuePtr value)
+void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     if (value.isUndefinedOrNull())
         select->remove(index);
@@ -61,7 +61,7 @@
     }
 }
 
-void JSHTMLSelectElement::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValuePtr value)
+void JSHTMLSelectElement::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     selectIndexSetter(static_cast<HTMLSelectElement*>(impl()), exec, index, value);
 }
diff --git a/WebCore/bindings/js/JSHTMLSelectElementCustom.h b/WebCore/bindings/js/JSHTMLSelectElementCustom.h
index 87344b5..a449038 100644
--- a/WebCore/bindings/js/JSHTMLSelectElementCustom.h
+++ b/WebCore/bindings/js/JSHTMLSelectElementCustom.h
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-void selectIndexSetter(HTMLSelectElement*, JSC::ExecState*, unsigned index, JSC::JSValuePtr);
+void selectIndexSetter(HTMLSelectElement*, JSC::ExecState*, unsigned index, JSC::JSValue);
 
 }
 
diff --git a/WebCore/bindings/js/JSHistoryCustom.cpp b/WebCore/bindings/js/JSHistoryCustom.cpp
index e83ac40..998a364 100644
--- a/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -37,17 +37,17 @@
 
 namespace WebCore {
 
-static JSValuePtr nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionBack);
 }
 
-static JSValuePtr nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionForward);
 }
 
-static JSValuePtr nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 1, propertyName, jsHistoryPrototypeFunctionGo);
 }
@@ -92,7 +92,7 @@
     return true;
 }
 
-bool JSHistory::customPut(ExecState* exec, const Identifier&, JSValuePtr, PutPropertySlot&)
+bool JSHistory::customPut(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
 {
     // Only allow putting by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
diff --git a/WebCore/bindings/js/JSImageConstructor.cpp b/WebCore/bindings/js/JSImageConstructor.cpp
index aa44c73..4a27bb4 100644
--- a/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/WebCore/bindings/js/JSImageConstructor.cpp
@@ -34,13 +34,14 @@
 
 const ClassInfo JSImageConstructor::s_info = { "ImageConstructor", 0, 0, 0 };
 
-JSImageConstructor::JSImageConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSImageConstructor::JSImageConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSImageConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
-    , m_globalObject(toJSDOMGlobalObject(context))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
 
-    putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 Document* JSImageConstructor::document() const
@@ -56,14 +57,16 @@
     int height = 0;
     if (args.size() > 0) {
         widthSet = true;
-        width = args.at(exec, 0).toInt32(exec);
+        width = args.at(0).toInt32(exec);
     }
     if (args.size() > 1) {
         heightSet = true;
-        height = args.at(exec, 1).toInt32(exec);
+        height = args.at(1).toInt32(exec);
     }
 
     Document* document = static_cast<JSImageConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Image constructor associated document is unavailable");
 
     // Calling toJS on the document causes the JS document wrapper to be
     // added to the window object. This is done to ensure that JSDocument::mark
diff --git a/WebCore/bindings/js/JSImageConstructor.h b/WebCore/bindings/js/JSImageConstructor.h
index 578d1cf..8dc7add 100644
--- a/WebCore/bindings/js/JSImageConstructor.h
+++ b/WebCore/bindings/js/JSImageConstructor.h
@@ -27,7 +27,7 @@
 
     class JSImageConstructor : public DOMObject {
     public:
-        JSImageConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        JSImageConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         Document* document() const;
 
         static const JSC::ClassInfo s_info;
diff --git a/WebCore/bindings/js/JSImageDataCustom.cpp b/WebCore/bindings/js/JSImageDataCustom.cpp
index 06c5d1b..32fe58b 100644
--- a/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -36,7 +36,7 @@
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, ImageData* imageData)
+JSValue toJS(ExecState* exec, ImageData* imageData)
 {
     if (!imageData)
         return jsNull();
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
index 09007c1..fff7aee 100644
--- a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -47,7 +47,7 @@
 
 const ClassInfo JSInspectedObjectWrapper::s_info = { "JSInspectedObjectWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
 
-JSValuePtr JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValuePtr unwrappedValue)
+JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
 {
     if (!unwrappedValue.isObject())
         return unwrappedValue;
@@ -61,7 +61,7 @@
         if (JSInspectedObjectWrapper* wrapper = wrapperMap->get(unwrappedObject))
             return wrapper;
 
-    JSValuePtr prototype = unwrappedObject->prototype();
+    JSValue prototype = unwrappedObject->prototype();
     ASSERT(prototype.isNull() || prototype.isObject());
 
     if (prototype.isNull())
@@ -96,7 +96,7 @@
     }
 }
 
-JSValuePtr JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValuePtr value) const
+JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value) const
 {
     // The Inspector is only allowed to pass primitive values and wrapped objects to objects from the inspected page.
 
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.h b/WebCore/bindings/js/JSInspectedObjectWrapper.h
index 273c0b0..201feb6 100644
--- a/WebCore/bindings/js/JSInspectedObjectWrapper.h
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.h
@@ -32,7 +32,7 @@
 
     class JSInspectedObjectWrapper : public JSQuarantinedObjectWrapper {
     public:
-        static JSC::JSValuePtr wrap(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue);
+        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
         virtual ~JSInspectedObjectWrapper();
 
         static const JSC::ClassInfo s_info;
@@ -48,8 +48,8 @@
         virtual bool allowsCallAsFunction() const { return true; }
         virtual bool allowsGetPropertyNames() const { return true; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     };
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
index 1fb5eae..0e14109 100644
--- a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -53,7 +53,7 @@
     return structure;
 }
 
-JSValuePtr JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValuePtr unwrappedValue)
+JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
 {
     if (!unwrappedValue.isObject())
         return unwrappedValue;
@@ -66,7 +66,7 @@
     if (JSInspectorCallbackWrapper* wrapper = wrappers().get(unwrappedObject))
         return wrapper;
 
-    JSValuePtr prototype = unwrappedObject->prototype();
+    JSValue prototype = unwrappedObject->prototype();
     ASSERT(prototype.isNull() || prototype.isObject());
 
     if (prototype.isNull()) {
@@ -88,7 +88,7 @@
     wrappers().remove(unwrappedObject());
 }
 
-JSValuePtr JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValuePtr unwrappedValue) const
+JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValue unwrappedValue) const
 {
     if (JSQuarantinedObjectWrapper* wrapper = asWrapper(unwrappedValue)) {
         // The only time a wrapper should be passed into a JSInspectorCallbackWrapper is when a client-side storage callback
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.h b/WebCore/bindings/js/JSInspectorCallbackWrapper.h
index 49157c0..cfc2fb6 100644
--- a/WebCore/bindings/js/JSInspectorCallbackWrapper.h
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.h
@@ -32,7 +32,7 @@
 
     class JSInspectorCallbackWrapper : public JSQuarantinedObjectWrapper {
     public:
-        static JSC::JSValuePtr wrap(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue);
+        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
 
         virtual ~JSInspectorCallbackWrapper();
 
@@ -44,8 +44,8 @@
 
         virtual bool allowsCallAsFunction() const { return true; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSInspectorControllerCustom.cpp b/WebCore/bindings/js/JSInspectorControllerCustom.cpp
index 79c69c8..b06c9e9 100644
--- a/WebCore/bindings/js/JSInspectorControllerCustom.cpp
+++ b/WebCore/bindings/js/JSInspectorControllerCustom.cpp
@@ -43,7 +43,6 @@
 #include "FrameLoader.h"
 #include "InspectorController.h"
 #include "InspectorResource.h"
-#include "JavaScriptProfile.h"
 #include "JSDOMWindow.h"
 #include "JSInspectedObjectWrapper.h"
 #include "JSInspectorCallbackWrapper.h"
@@ -53,8 +52,6 @@
 #include "Page.h"
 #include "TextIterator.h"
 #include "VisiblePosition.h"
-#include <profiler/Profile.h>
-#include <profiler/Profiler.h>
 #include <runtime/JSArray.h>
 #include <runtime/JSLock.h>
 #include <wtf/Vector.h>
@@ -62,31 +59,22 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
 #include "JavaScriptDebugServer.h"
+#include "JavaScriptProfile.h"
 #include "JSJavaScriptCallFrame.h"
+#include <profiler/Profile.h>
+#include <profiler/Profiler.h>
 #endif
 
 using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSInspectorController::profiles(JSC::ExecState* exec, const JSC::ArgList&)
-{
-    JSLock lock(false);
-    ArgList result;
-    const Vector<RefPtr<Profile> >& profiles = impl()->profiles();
-
-    for (size_t i = 0; i < profiles.size(); ++i)
-        result.append(toJS(exec, profiles[i].get()));
-
-    return constructArray(exec, result);
-}
-
-JSValuePtr JSInspectorController::highlightDOMNode(JSC::ExecState* exec, const JSC::ArgList& args)
+JSValue JSInspectorController::highlightDOMNode(JSC::ExecState*, const JSC::ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(exec, 0));
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
     if (!wrapper)
         return jsUndefined();
 
@@ -99,51 +87,13 @@
     return jsUndefined();
 }
 
-JSValuePtr JSInspectorController::addResourceSourceToFrame(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    bool ok = false;
-    unsigned identifier = args.at(exec, 0).toUInt32(exec, ok);
-    if (!ok)
-        return jsUndefined();
-
-    RefPtr<InspectorResource> resource = impl()->resources().get(identifier);
-    ASSERT(resource);
-    if (!resource)
-        return jsUndefined();
-
-    String sourceString = resource->sourceString();
-    if (sourceString.isEmpty())
-        return jsUndefined();
-
-    return jsBoolean(impl()->addSourceToFrame(resource->mimeType, sourceString, toNode(args.at(exec, 1))));
-}
-
-JSValuePtr JSInspectorController::addSourceToFrame(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 3)
-        return jsUndefined();
-
-    String mimeType = args.at(exec, 0).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    String sourceString = args.at(exec, 1).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    return jsBoolean(impl()->addSourceToFrame(mimeType, sourceString, toNode(args.at(exec, 1))));
-}
-
-JSValuePtr JSInspectorController::getResourceDocumentNode(ExecState* exec, const ArgList& args)
+JSValue JSInspectorController::getResourceDocumentNode(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
     bool ok = false;
-    unsigned identifier = args.at(exec, 0).toUInt32(exec, ok);
+    unsigned identifier = args.at(0).toUInt32(exec, ok);
     if (!ok)
         return jsUndefined();
 
@@ -152,33 +102,32 @@
     if (!resource)
         return jsUndefined();
 
-    Frame* frame = resource->frame.get();
+    Frame* frame = resource->frame();
     Document* document = frame->document();
 
     if (document->isPluginDocument() || document->isImageDocument() || document->isMediaDocument())
         return jsUndefined();
 
-    // FIXME: I am not sure if this is actually needed. Can we just use exec?
-    ExecState* resourceExec = toJSDOMWindowShell(resource->frame.get())->window()->globalExec();
+    ExecState* resourceExec = toJSDOMWindowShell(frame)->window()->globalExec();
 
     JSLock lock(false);
     return JSInspectedObjectWrapper::wrap(resourceExec, toJS(resourceExec, document));
 }
 
-JSValuePtr JSInspectorController::search(ExecState* exec, const ArgList& args)
+JSValue JSInspectorController::search(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return jsUndefined();
 
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
     if (!node)
         return jsUndefined();
 
-    String target = args.at(exec, 1).toString(exec);
+    String target = args.at(1).toString(exec);
     if (exec->hadException())
         return jsUndefined();
 
-    ArgList result;
+    MarkedArgumentBuffer result;
     RefPtr<Range> searchRange(rangeOfContents(node));
 
     ExceptionCode ec = 0;
@@ -202,12 +151,12 @@
 }
 
 #if ENABLE(DATABASE)
-JSValuePtr JSInspectorController::databaseTableNames(ExecState* exec, const ArgList& args)
+JSValue JSInspectorController::databaseTableNames(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(exec, 0));
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
     if (!wrapper)
         return jsUndefined();
 
@@ -215,7 +164,7 @@
     if (!database)
         return jsUndefined();
 
-    ArgList result;
+    MarkedArgumentBuffer result;
 
     Vector<String> tableNames = database->tableNames();
     unsigned length = tableNames.size();
@@ -226,18 +175,18 @@
 }
 #endif
 
-JSValuePtr JSInspectorController::inspectedWindow(ExecState*, const ArgList&)
+JSValue JSInspectorController::inspectedWindow(ExecState*, const ArgList&)
 {
     JSDOMWindow* inspectedWindow = toJSDOMWindow(impl()->inspectedPage()->mainFrame());
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow);
 }
 
-JSValuePtr JSInspectorController::setting(ExecState* exec, const ArgList& args)
+JSValue JSInspectorController::setting(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    String key = args.at(exec, 0).toString(exec);
+    String key = args.at(0).toString(exec);
     if (exec->hadException())
         return jsUndefined();
 
@@ -256,7 +205,7 @@
         case InspectorController::Setting::BooleanType:
             return jsBoolean(setting.booleanValue());
         case InspectorController::Setting::StringVectorType: {
-            ArgList stringsArray;
+            MarkedArgumentBuffer stringsArray;
             const Vector<String>& strings = setting.stringVector();
             const unsigned length = strings.size();
             for (unsigned i = 0; i < length; ++i)
@@ -266,18 +215,18 @@
     }
 }
 
-JSValuePtr JSInspectorController::setSetting(ExecState* exec, const ArgList& args)
+JSValue JSInspectorController::setSetting(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return jsUndefined();
 
-    String key = args.at(exec, 0).toString(exec);
+    String key = args.at(0).toString(exec);
     if (exec->hadException())
         return jsUndefined();
 
     InspectorController::Setting setting;
 
-    JSValuePtr value = args.at(exec, 0);
+    JSValue value = args.at(1);
     if (value.isUndefined() || value.isNull()) {
         // Do nothing. The setting is already NoType.
         ASSERT(setting.type() == InspectorController::Setting::NoType);
@@ -309,15 +258,17 @@
     return jsUndefined();
 }
 
-JSValuePtr JSInspectorController::wrapCallback(ExecState* exec, const ArgList& args)
+JSValue JSInspectorController::wrapCallback(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    return JSInspectorCallbackWrapper::wrap(exec, args.at(exec, 0));
+    return JSInspectorCallbackWrapper::wrap(exec, args.at(0));
 }
 
-JSValuePtr JSInspectorController::currentCallFrame(ExecState* exec, const ArgList&)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+JSValue JSInspectorController::currentCallFrame(ExecState* exec, const ArgList&)
 {
     JavaScriptCallFrame* callFrame = impl()->currentCallFrame();
     if (!callFrame || !callFrame->isValid())
@@ -330,4 +281,18 @@
     return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
 }
 
+JSValue JSInspectorController::profiles(JSC::ExecState* exec, const JSC::ArgList&)
+{
+    JSLock lock(false);
+    MarkedArgumentBuffer result;
+    const Vector<RefPtr<Profile> >& profiles = impl()->profiles();
+
+    for (size_t i = 0; i < profiles.size(); ++i)
+        result.append(toJS(exec, profiles[i].get()));
+
+    return constructArray(exec, result);
+}
+
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp b/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
index 7c99120..08ecf2b 100644
--- a/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
+++ b/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSJavaScriptCallFrame.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JavaScriptCallFrame.h"
 #include <runtime/ArrayPrototype.h>
 
@@ -33,10 +35,10 @@
 
 namespace WebCore {
 
-JSValuePtr JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
+JSValue JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr exception = noValue();
-    JSValuePtr result = impl()->evaluate(args.at(exec, 0).toString(exec), exception);
+    JSValue exception;
+    JSValue result = impl()->evaluate(args.at(0).toString(exec), exception);
 
     if (exception)
         exec->setException(exception);
@@ -44,12 +46,12 @@
     return result;
 }
 
-JSValuePtr JSJavaScriptCallFrame::thisObject(ExecState*) const
+JSValue JSJavaScriptCallFrame::thisObject(ExecState*) const
 {
     return impl()->thisObject() ? impl()->thisObject() : jsNull();
 }
 
-JSValuePtr JSJavaScriptCallFrame::type(ExecState* exec) const
+JSValue JSJavaScriptCallFrame::type(ExecState* exec) const
 {
     switch (impl()->type()) {
         case DebuggerCallFrame::FunctionType:
@@ -62,7 +64,7 @@
     return jsNull();
 }
 
-JSValuePtr JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
+JSValue JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
 {
     if (!impl()->scopeChain())
         return jsNull();
@@ -74,7 +76,7 @@
     // we must always have something in the scope chain
     ASSERT(iter != end);
 
-    ArgList list;
+    MarkedArgumentBuffer list;
     do {
         list.append(*iter);
         ++iter;
@@ -84,3 +86,5 @@
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/WebCore/bindings/js/JSLazyEventListener.cpp b/WebCore/bindings/js/JSLazyEventListener.cpp
index 3c80efe..f7c74ae 100644
--- a/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -23,19 +23,25 @@
 #include "Frame.h"
 #include "JSNode.h"
 #include <runtime/FunctionConstructor.h>
+#include <runtime/JSLock.h>
+#include <wtf/RefCountedLeakCounter.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-JSLazyEventListener::JSLazyEventListener(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
-    : JSProtectedEventListener(0, globalObject, true)
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
+#endif
+
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+    : JSEventListener(0, globalObject, true)
     , m_functionName(functionName)
+    , m_eventParameterName(eventParameterName)
     , m_code(code)
     , m_parsed(false)
     , m_lineNumber(lineNumber)
     , m_originalNode(node)
-    , m_type(type)
 {
     // We don't retain the original node because we assume it
     // will stay alive as long as this handler object is around
@@ -47,26 +53,23 @@
     // a setAttribute call from JavaScript, so make the line number 1 in that case.
     if (m_lineNumber == 0)
         m_lineNumber = 1;
+
+#ifndef NDEBUG
+    eventListenerCounter.increment();
+#endif
 }
 
-JSObject* JSLazyEventListener::function() const
+JSLazyEventListener::~JSLazyEventListener()
+{
+#ifndef NDEBUG
+    eventListenerCounter.decrement();
+#endif
+}
+
+JSObject* JSLazyEventListener::jsFunction() const
 {
     parseCode();
-    return m_listener;
-}
-
-static inline JSValuePtr eventParameterName(JSLazyEventListener::LazyEventListenerType type, ExecState* exec)
-{
-    switch (type) {
-        case JSLazyEventListener::HTMLLazyEventListener:
-            return jsNontrivialString(exec, "event");
-#if ENABLE(SVG)
-        case JSLazyEventListener::SVGLazyEventListener:
-            return jsNontrivialString(exec, "evt");
-#endif
-    }
-    ASSERT_NOT_REACHED();
-    return jsUndefined();
+    return m_jsFunction;
 }
 
 void JSLazyEventListener::parseCode() const
@@ -75,7 +78,7 @@
         return;
 
     if (m_globalObject->scriptExecutionContext()->isDocument()) {
-        JSDOMWindow* window = static_cast<JSDOMWindow*>(m_globalObject.get());
+        JSDOMWindow* window = static_cast<JSDOMWindow*>(m_globalObject);
         Frame* frame = window->impl()->frame();
         if (!frame)
             return;
@@ -89,43 +92,38 @@
 
     ExecState* exec = m_globalObject->globalExec();
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     UString sourceURL(m_globalObject->scriptExecutionContext()->url().string());
-    args.append(eventParameterName(m_type, exec));
+    args.append(jsNontrivialString(exec, m_eventParameterName));
     args.append(jsString(exec, m_code));
 
     // FIXME: Passing the document's URL to construct is not always correct, since this event listener might
     // have been added with setAttribute from a script, and we should pass String() in that case.
-    m_listener = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
+    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
 
-    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_listener.get());
+    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_jsFunction);
 
     if (exec->hadException()) {
         exec->clearException();
 
         // failed to parse, so let's just make this listener a no-op
-        m_listener = 0;
+        m_jsFunction = 0;
     } else if (m_originalNode) {
         // Add the event's home element to the scope
         // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
         ScopeChain scope = listenerAsFunction->scope();
 
-        JSValuePtr thisObj = toJS(exec, m_originalNode);
+        JSValue thisObj = toJS(exec, m_originalNode);
         if (thisObj.isObject()) {
             static_cast<JSNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
             listenerAsFunction->setScope(scope);
         }
     }
 
-    // no more need to keep the unparsed code around
+    // Since we only parse once, there's no need to keep data used for parsing around anymore.
     m_functionName = String();
     m_code = String();
-
-    if (m_listener) {
-        ASSERT(isInline());
-        JSDOMWindow::ProtectedListenersMap& listeners = m_globalObject->jsProtectedInlineEventListeners();
-        listeners.set(m_listener, const_cast<JSLazyEventListener*>(this));
-    }
+    m_eventParameterName = String();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSLazyEventListener.h b/WebCore/bindings/js/JSLazyEventListener.h
index 5424883..a5304cf 100644
--- a/WebCore/bindings/js/JSLazyEventListener.h
+++ b/WebCore/bindings/js/JSLazyEventListener.h
@@ -27,35 +27,28 @@
 
     class Node;
 
-    class JSLazyEventListener : public JSProtectedEventListener {
+    class JSLazyEventListener : public JSEventListener {
     public:
-        enum LazyEventListenerType {
-            HTMLLazyEventListener
-#if ENABLE(SVG)
-            , SVGLazyEventListener
-#endif
-        };
-
-        static PassRefPtr<JSLazyEventListener> create(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
         {
-            return adoptRef(new JSLazyEventListener(type, functionName, code, globalObject, node, lineNumber));
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, globalObject, node, lineNumber));
         }
+        virtual ~JSLazyEventListener();
 
     private:
-        JSLazyEventListener(LazyEventListenerType, const String& functionName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
 
-        virtual JSC::JSObject* function() const;
+        virtual JSC::JSObject* jsFunction() const;
         virtual bool wasCreatedFromMarkup() const { return true; }
 
         void parseCode() const;
 
         mutable String m_functionName;
+        mutable String m_eventParameterName;
         mutable String m_code;
         mutable bool m_parsed;
         int m_lineNumber;
         Node* m_originalNode;
-
-        LazyEventListenerType m_type;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSLocationCustom.cpp b/WebCore/bindings/js/JSLocationCustom.cpp
index a99a105..9c5a834 100644
--- a/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/WebCore/bindings/js/JSLocationCustom.cpp
@@ -37,17 +37,17 @@
 
 namespace WebCore {
 
-static JSValuePtr nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionReplace);
 }
 
-static JSValuePtr nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 0, propertyName, jsLocationPrototypeFunctionReload);
 }
 
-static JSValuePtr nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionAssign);
 }
@@ -93,12 +93,15 @@
     return true;
 }
 
-bool JSLocation::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSLocation::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return true;
 
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return true;
+
     bool sameDomainAccess = allowsAccessFromFrame(exec, frame);
 
     const HashEntry* entry = JSLocation::s_info.propHashTable(exec)->entry(exec, propertyName);
@@ -133,31 +136,39 @@
     return false;
 }
 
-static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory, bool lockBackForwardList)
+void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
 {
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!url.protocolIs("javascript") || allowsAccessFromFrame(exec, frame)) {
-        bool userGesture = activeFrame->script()->processingUserGesture();
-        frame->loader()->scheduleLocationChange(url.string(), activeFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, userGesture);
-    }
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return;
+    Base::defineGetter(exec, propertyName, getterFunction);
 }
 
-void JSLocation::setHref(ExecState* exec, JSValuePtr value)
+static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory, bool lockBackForwardList)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return;
+
+    if (!protocolIsJavaScript(url) || allowsAccessFromFrame(exec, frame))
+        frame->loader()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
+}
+
+void JSLocation::setHref(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
-        return;
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+    if (!shouldAllowNavigation(exec, frame))
         return;
 
-    KURL url = activeFrame->loader()->completeURL(value.toString(exec));
+    KURL url = completeURL(exec, value.toString(exec));
+    if (url.isNull())
+        return;
+
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setProtocol(ExecState* exec, JSValuePtr value)
+void JSLocation::setProtocol(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
@@ -168,7 +179,7 @@
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHost(ExecState* exec, JSValuePtr value)
+void JSLocation::setHost(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
@@ -179,7 +190,7 @@
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHostname(ExecState* exec, JSValuePtr value)
+void JSLocation::setHostname(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
@@ -190,7 +201,7 @@
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setPort(ExecState* exec, JSValuePtr value)
+void JSLocation::setPort(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
@@ -206,7 +217,7 @@
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setPathname(ExecState* exec, JSValuePtr value)
+void JSLocation::setPathname(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
@@ -217,7 +228,7 @@
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setSearch(ExecState* exec, JSValuePtr value)
+void JSLocation::setSearch(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
@@ -228,7 +239,7 @@
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHash(ExecState* exec, JSValuePtr value)
+void JSLocation::setHash(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
@@ -245,65 +256,71 @@
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-JSValuePtr JSLocation::replace(ExecState* exec, const ArgList& args)
+JSValue JSLocation::replace(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame) 
-        return jsUndefined();
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+    if (!shouldAllowNavigation(exec, frame))
         return jsUndefined();
 
-    navigateIfAllowed(exec, frame, activeFrame->loader()->completeURL(args.at(exec, 0).toString(exec)), true, true);
+    KURL url = completeURL(exec, args.at(0).toString(exec));
+    if (url.isNull())
+        return jsUndefined();
+
+    navigateIfAllowed(exec, frame, url, true, true);
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::reload(ExecState* exec, const ArgList&)
+JSValue JSLocation::reload(ExecState* exec, const ArgList&)
 {
     Frame* frame = impl()->frame();
-    if (!frame)
+    if (!frame || !allowsAccessFromFrame(exec, frame))
         return jsUndefined();
 
-    JSDOMWindow* window = toJSDOMWindow(frame);
-    if (!window->allowsAccessFrom(exec))
-        return jsUndefined();
-
-    if (!frame->loader()->url().protocolIs("javascript") || (window && window->allowsAccessFrom(exec))) {
-        bool userGesture = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame()->script()->processingUserGesture();
-        frame->loader()->scheduleRefresh(userGesture);
-    }
+    if (!protocolIsJavaScript(frame->loader()->url()))
+        frame->loader()->scheduleRefresh(processingUserGesture(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::assign(ExecState* exec, const ArgList& args)
+JSValue JSLocation::assign(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
+    if (!shouldAllowNavigation(exec, frame))
         return jsUndefined();
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+
+    KURL url = completeURL(exec, args.at(0).toString(exec));
+    if (url.isNull())
         return jsUndefined();
 
     // We want a new history item if this JS was called via a user gesture
-    navigateIfAllowed(exec, frame, activeFrame->loader()->completeURL(args.at(exec, 0).toString(exec)), !frame->script()->anyPageIsProcessingUserGesture(), false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::toString(ExecState* exec, const ArgList&)
+JSValue JSLocation::toString(ExecState* exec, const ArgList&)
 {
     Frame* frame = impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    if (!allowsAccessFromFrame(exec, frame))
+    if (!frame || !allowsAccessFromFrame(exec, frame))
         return jsUndefined();
 
     return jsString(exec, impl()->toString());
 }
 
+bool JSLocationPrototype::customPut(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&)
+{
+    return (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf);
+}
+
+void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+{
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return;
+    Base::defineGetter(exec, propertyName, getterFunction);
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
index f5b73df..495bd53 100644
--- a/WebCore/bindings/js/JSMessageChannelConstructor.cpp
+++ b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -29,11 +29,6 @@
 #include "Document.h"
 #include "JSDocument.h"
 #include "JSMessageChannel.h"
-#ifdef ANDROID_FIX  // these are generated files, need to check ENABLE(WORKERS)
-#if ENABLE(WORKERS)
-#include "JSWorkerContext.h"
-#endif
-#endif
 #include "MessageChannel.h"
 
 using namespace JSC;
@@ -42,11 +37,11 @@
 
 const ClassInfo JSMessageChannelConstructor::s_info = { "MessageChannelConstructor", 0, 0, 0 };
 
-JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, ScriptExecutionContext* scriptExecutionContext)
+JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSMessageChannelConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
-    , m_globalObject(toJSDOMGlobalObject(scriptExecutionContext))
+    , m_globalObject(globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 JSMessageChannelConstructor::~JSMessageChannelConstructor()
@@ -66,7 +61,11 @@
 
 JSObject* JSMessageChannelConstructor::construct(ExecState* exec, JSObject* constructor, const ArgList&)
 {
-    return asObject(toJS(exec, MessageChannel::create(static_cast<JSMessageChannelConstructor*>(constructor)->scriptExecutionContext())));
+    ScriptExecutionContext* context = static_cast<JSMessageChannelConstructor*>(constructor)->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "MessageChannel constructor associated document is unavailable");
+
+    return asObject(toJS(exec, MessageChannel::create(context)));
 }
 
 void JSMessageChannelConstructor::mark()
diff --git a/WebCore/bindings/js/JSMessageChannelConstructor.h b/WebCore/bindings/js/JSMessageChannelConstructor.h
index 2691777..90c29a3 100644
--- a/WebCore/bindings/js/JSMessageChannelConstructor.h
+++ b/WebCore/bindings/js/JSMessageChannelConstructor.h
@@ -32,7 +32,7 @@
 
     class JSMessageChannelConstructor : public DOMObject {
     public:
-        JSMessageChannelConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        JSMessageChannelConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         virtual ~JSMessageChannelConstructor();
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
diff --git a/WebCore/bindings/js/JSMessagePortCustom.cpp b/WebCore/bindings/js/JSMessagePortCustom.cpp
index 394f9b1..f4809ae 100644
--- a/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -45,7 +45,7 @@
     markIfNotNull(m_impl->onmessage());
     markIfNotNull(m_impl->onclose());
 
-    if (MessagePort* entangledPort = m_impl->entangledPort()) {
+    if (MessagePortProxy* entangledPort = m_impl->entangledPort()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
         if (wrapper && !wrapper->marked())
             wrapper->mark();
@@ -56,39 +56,39 @@
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) 
-            (*vecIter)->mark();
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSMessagePort::startConversation(ExecState* exec, const ArgList& args)
+JSValue JSMessagePort::startConversation(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
-    const UString& message = args.at(exec, 0).toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
     return toJS(exec, impl()->startConversation(globalObject->scriptExecutionContext(), message).get());
 }
 
-JSValuePtr JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0).toString(exec), listener.release(), args.at(exec, 2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0).toString(exec), listener, args.at(exec, 2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp b/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
index 5338d5b..c90dadd 100644
--- a/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
+++ b/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
@@ -33,7 +33,7 @@
     return mimeTypeArray->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index e7b0764..7bd95b4 100644
--- a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -41,7 +41,7 @@
     return impl->getNamedItem(propertyName);
 }
 
-JSValuePtr JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
diff --git a/WebCore/bindings/js/JSNamedNodesCollection.cpp b/WebCore/bindings/js/JSNamedNodesCollection.cpp
index 8068a1d..93a8937 100644
--- a/WebCore/bindings/js/JSNamedNodesCollection.cpp
+++ b/WebCore/bindings/js/JSNamedNodesCollection.cpp
@@ -29,7 +29,7 @@
 #include "AtomicString.h"
 #include "Element.h"
 #include "JSNode.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 
 namespace WebCore {
 
@@ -48,13 +48,13 @@
 {
 }
 
-JSValuePtr JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNamedNodesCollection* thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
     return jsNumber(exec, thisObj->m_nodes->size());
 }
 
-JSValuePtr JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNamedNodesCollection *thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
     return toJS(exec, (*thisObj->m_nodes)[slot.index()].get());
diff --git a/WebCore/bindings/js/JSNamedNodesCollection.h b/WebCore/bindings/js/JSNamedNodesCollection.h
index 19f194b..3bbc102 100644
--- a/WebCore/bindings/js/JSNamedNodesCollection.h
+++ b/WebCore/bindings/js/JSNamedNodesCollection.h
@@ -44,19 +44,19 @@
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
         }
 
     private:
-        static JSC::JSValuePtr lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
         OwnPtr<Vector<RefPtr<Node> > > m_nodes;
     };
diff --git a/WebCore/bindings/js/JSNavigatorCustom.cpp b/WebCore/bindings/js/JSNavigatorCustom.cpp
index a7b6194..ea6cceb 100644
--- a/WebCore/bindings/js/JSNavigatorCustom.cpp
+++ b/WebCore/bindings/js/JSNavigatorCustom.cpp
@@ -2,7 +2,7 @@
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (c) 2000 Daniel Molkentin (molkentin@kde.org)
  *  Copyright (c) 2000 Stefan Schimanski (schimmi@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
  *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  *  This library is free software; you can redistribute it and/or
@@ -23,92 +23,12 @@
 #include "config.h"
 #include "JSNavigator.h"
 
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "KURL.h"
 #include "Navigator.h"
-#include "Settings.h"
 
 namespace WebCore {
 
 using namespace JSC;
 
-static bool needsYouTubeQuirk(ExecState*, Frame*);
-
-#if 1
-
-static inline bool needsYouTubeQuirk(ExecState*, Frame*)
-{
-    return false;
-}
-
-#else
-
-static bool needsYouTubeQuirk(ExecState* exec, Frame* frame)
-{
-    // This quirk works around a mistaken check in an ad at youtube.com.
-    // There's a function called isSafari that returns false if the function
-    // called isWindows returns true; thus the site malfunctions with Windows Safari.
-
-    // Do the quirk only if the function's name is "isWindows".
-    JSFunction* function = exec->function();
-    if (!function)
-        return false;
-    DEFINE_STATIC_LOCAL(const Identifier, isWindowsFunctionName, (exec, "isWindows"));
-    if (function->functionName() != isWindowsFunctionName)
-        return false;
-
-    // Do the quirk only if the function is called by an "isSafari" function.
-    // However, that function is not itself named -- it is stored in the isSafari
-    // property, though, so that's how we recognize it.
-    ExecState* callingExec = exec->callingExecState();
-    if (!callingExec)
-        return false;
-    JSFunction* callingFunction = callingExec->function();
-    if (!callingFunction)
-        return false;
-    JSObject* thisObject = callingExec->thisValue();
-    if (!thisObject)
-        return false;
-    DEFINE_STATIC_LOCAL(const Identifier, isSafariFunction, (exec, "isSafari"));
-    JSValuePtr isSafariFunction = thisObject->getDirect(isSafariFunctionName);
-    if (isSafariFunction != callingFunction)
-        return false;
-
-    Document* document = frame->document();
-
-    // Do the quirk only on the front page of the global version of YouTube.
-    const KURL& url = document->url();
-    if (url.host() != "youtube.com" && url.host() != "www.youtube.com")
-        return false;
-    if (url.path() != "/")
-        return false;
-
-    // As with other site-specific quirks, allow website developers to turn this off.
-    // In theory, this allows website developers to check if their fixes are effective.
-    Settings* settings = frame->settings();
-    if (!settings)
-        return false;
-    if (!settings->needsSiteSpecificQuirks())
-        return false;
-
-    return true;
-}
-
-#endif
-
-JSValuePtr JSNavigator::appVersion(ExecState* exec) const
-{
-    Navigator* imp = static_cast<Navigator*>(impl());
-    Frame* frame = imp->frame();
-    if (!frame)
-        return jsString(exec, "");
-
-    if (needsYouTubeQuirk(exec, frame))
-        return jsString(exec, "");
-    return jsString(exec, imp->appVersion());
-}
-
 void JSNavigator::mark()
 {
     Base::mark();
diff --git a/WebCore/bindings/js/JSNodeCustom.cpp b/WebCore/bindings/js/JSNodeCustom.cpp
index 8f4d2c1..79ac6b7 100644
--- a/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/WebCore/bindings/js/JSNodeCustom.cpp
@@ -52,6 +52,7 @@
 #include "Node.h"
 #include "Notation.h"
 #include "ProcessingInstruction.h"
+#include "RegisteredEventListener.h"
 #include "Text.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -67,66 +68,66 @@
 
 typedef int ExpectionCode;
 
-JSValuePtr JSNode::insertBefore(ExecState* exec, const ArgList& args)
+JSValue JSNode::insertBefore(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->insertBefore(toNode(args.at(exec, 0)), toNode(args.at(exec, 1)), ec, true);
+    bool ok = impl()->insertBefore(toNode(args.at(0)), toNode(args.at(1)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
-JSValuePtr JSNode::replaceChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::replaceChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->replaceChild(toNode(args.at(exec, 0)), toNode(args.at(exec, 1)), ec, true);
+    bool ok = impl()->replaceChild(toNode(args.at(0)), toNode(args.at(1)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 1);
+        return args.at(1);
     return jsNull();
 }
 
-JSValuePtr JSNode::removeChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::removeChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->removeChild(toNode(args.at(exec, 0)), ec);
+    bool ok = impl()->removeChild(toNode(args.at(0)), ec);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
-JSValuePtr JSNode::appendChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->appendChild(toNode(args.at(exec, 0)), ec, true);
+    bool ok = impl()->appendChild(toNode(args.at(0)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
-JSValuePtr JSNode::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSProtectedEventListener> listener = globalObject->findOrCreateJSProtectedEventListener(exec, args.at(exec, 1)))
-        impl()->addEventListener(args.at(exec, 0).toString(exec), listener.release(), args.at(exec, 2).toBoolean(exec));
+    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-JSValuePtr JSNode::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
 
-    if (JSProtectedEventListener* listener = globalObject->findJSProtectedEventListener(args.at(exec, 1)))
-        impl()->removeEventListener(args.at(exec, 0).toString(exec), listener, args.at(exec, 2).toBoolean(exec));
+    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
+        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
@@ -141,16 +142,16 @@
 
     Node* node = m_impl.get();
 
-    // Nodes in the document are kept alive by JSDocument::mark,
-    // so we have no special responsibilities and can just call the base class here.
+    // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
+    // the document, we need to mark the document, but we don't need to explicitly
+    // mark any other nodes.
     if (node->inDocument()) {
-        // But if the document isn't marked we have to mark it to ensure that
-        // nodes reachable from this one are also marked
+        DOMObject::mark();
+        markEventListeners(node->eventListeners());
         if (Document* doc = node->ownerDocument())
             if (DOMObject* docWrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), doc))
                 if (!docWrapper->marked())
                     docWrapper->mark();
-        DOMObject::mark();
         return;
     }
 
@@ -160,14 +161,15 @@
     for (Node* current = m_impl.get(); current; current = current->parentNode())
         root = current;
 
-    // If we're already marking this tree, then we can simply mark this wrapper
-    // by calling the base class; our caller is iterating the tree.
+    // Nodes in a subtree are marked by the tree's root, so, if the root is already
+    // marking the tree, we don't need to explicitly mark any other nodes.
     if (root->inSubtreeMark()) {
         DOMObject::mark();
+        markEventListeners(node->eventListeners());
         return;
     }
 
-    // Mark the whole tree; use the global set of roots to avoid reentering.
+    // Mark the whole tree subtree.
     root->setInSubtreeMark(true);
     for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
         JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
@@ -190,7 +192,7 @@
     ASSERT(marked());
 }
 
-static ALWAYS_INLINE JSValuePtr createWrapper(ExecState* exec, Node* node)
+static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, Node* node)
 {
     ASSERT(node);
     ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
@@ -247,7 +249,7 @@
     return wrapper;    
 }
     
-JSValuePtr toJSNewlyCreated(ExecState* exec, Node* node)
+JSValue toJSNewlyCreated(ExecState* exec, Node* node)
 {
     if (!node)
         return jsNull();
@@ -255,7 +257,7 @@
     return createWrapper(exec, node);
 }
     
-JSValuePtr toJS(ExecState* exec, Node* node)
+JSValue toJS(ExecState* exec, Node* node)
 {
     if (!node)
         return jsNull();
diff --git a/WebCore/bindings/js/JSNodeFilterCondition.cpp b/WebCore/bindings/js/JSNodeFilterCondition.cpp
index f4b9e0c..f5d4d5c 100644
--- a/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -31,7 +31,7 @@
 
 ASSERT_CLASS_FITS_IN_CELL(JSNodeFilterCondition);
 
-JSNodeFilterCondition::JSNodeFilterCondition(JSValuePtr filter)
+JSNodeFilterCondition::JSNodeFilterCondition(JSValue filter)
     : m_filter(filter)
 {
 }
@@ -60,12 +60,12 @@
     if (!exec)
         return NodeFilter::FILTER_REJECT;
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, filterNode));
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValuePtr result = call(exec, m_filter, callType, callData, m_filter, args);
+    JSValue result = call(exec, m_filter, callType, callData, m_filter, args);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/WebCore/bindings/js/JSNodeFilterCondition.h b/WebCore/bindings/js/JSNodeFilterCondition.h
index b6be44b..3d591c6 100644
--- a/WebCore/bindings/js/JSNodeFilterCondition.h
+++ b/WebCore/bindings/js/JSNodeFilterCondition.h
@@ -30,18 +30,18 @@
 
     class JSNodeFilterCondition : public NodeFilterCondition {
     public:
-        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValuePtr filter)
+        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValue filter)
         {
             return adoptRef(new JSNodeFilterCondition(filter));
         }
 
     private:
-        JSNodeFilterCondition(JSC::JSValuePtr filter);
+        JSNodeFilterCondition(JSC::JSValue filter);
 
         virtual short acceptNode(ScriptState*, Node*) const;
         virtual void mark();
 
-        mutable JSC::JSValuePtr m_filter;
+        mutable JSC::JSValue m_filter;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSNodeFilterCustom.cpp b/WebCore/bindings/js/JSNodeFilterCustom.cpp
index 61fd0e2..ecc12d5 100644
--- a/WebCore/bindings/js/JSNodeFilterCustom.cpp
+++ b/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -41,12 +41,12 @@
     DOMObject::mark();
 }
 
-JSValuePtr JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
+JSValue JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
 {
-    return jsNumber(exec, impl()->acceptNode(exec, toNode(args.at(exec, 0))));
+    return jsNumber(exec, impl()->acceptNode(exec, toNode(args.at(0))));
 }
 
-PassRefPtr<NodeFilter> toNodeFilter(JSValuePtr value)
+PassRefPtr<NodeFilter> toNodeFilter(JSValue value)
 {
     if (value.isObject(&JSNodeFilter::s_info))
         return static_cast<JSNodeFilter*>(asObject(value))->impl();
diff --git a/WebCore/bindings/js/JSNodeIteratorCustom.cpp b/WebCore/bindings/js/JSNodeIteratorCustom.cpp
index 6498a7c..8fff82e 100644
--- a/WebCore/bindings/js/JSNodeIteratorCustom.cpp
+++ b/WebCore/bindings/js/JSNodeIteratorCustom.cpp
@@ -37,7 +37,7 @@
     DOMObject::mark();
 }
 
-JSValuePtr JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
+JSValue JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     RefPtr<Node> node = impl()->nextNode(exec, ec);
@@ -52,7 +52,7 @@
     return toJS(exec, node.get());
 }
 
-JSValuePtr JSNodeIterator::previousNode(ExecState* exec, const ArgList&)
+JSValue JSNodeIterator::previousNode(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     RefPtr<Node> node = impl()->previousNode(exec, ec);
diff --git a/WebCore/bindings/js/JSNodeListCustom.cpp b/WebCore/bindings/js/JSNodeListCustom.cpp
index 386a756..2821d01 100644
--- a/WebCore/bindings/js/JSNodeListCustom.cpp
+++ b/WebCore/bindings/js/JSNodeListCustom.cpp
@@ -36,10 +36,10 @@
 namespace WebCore {
 
 // Need to support call so that list(0) works.
-static JSValuePtr callNodeList(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callNodeList(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     bool ok;
-    unsigned index = args.at(exec, 0).toString(exec).toUInt32(&ok);
+    unsigned index = args.at(0).toString(exec).toUInt32(&ok);
     if (!ok)
         return jsUndefined();
     return toJS(exec, static_cast<JSNodeList*>(function)->impl()->item(index));
@@ -56,7 +56,7 @@
     return impl->itemWithName(propertyName);
 }
 
-JSValuePtr JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->itemWithName(propertyName));
diff --git a/WebCore/bindings/js/JSOptionConstructor.cpp b/WebCore/bindings/js/JSOptionConstructor.cpp
index e1d5cfe..9e818ff 100644
--- a/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -34,13 +34,14 @@
 
 const ClassInfo JSOptionConstructor::s_info = { "OptionConstructor", 0, 0, 0 };
 
-JSOptionConstructor::JSOptionConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSOptionConstructor::JSOptionConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSOptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
-    , m_globalObject(toJSDOMGlobalObject(context))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
 
-    putDirect(exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 4), ReadOnly|DontDelete|DontEnum);
 }
 
@@ -52,21 +53,23 @@
 static JSObject* constructHTMLOptionElement(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
     Document* document = static_cast<JSOptionConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Option constructor associated document is unavailable");
 
     RefPtr<HTMLOptionElement> element = static_pointer_cast<HTMLOptionElement>(document->createElement(HTMLNames::optionTag, false));
 
     ExceptionCode ec = 0;
     RefPtr<Text> text = document->createTextNode("");
-    if (!args.at(exec, 0).isUndefined())
-        text->setData(args.at(exec, 0).toString(exec), ec);
+    if (!args.at(0).isUndefined())
+        text->setData(args.at(0).toString(exec), ec);
     if (ec == 0)
         element->appendChild(text.release(), ec);
-    if (ec == 0 && !args.at(exec, 1).isUndefined())
-        element->setValue(args.at(exec, 1).toString(exec));
+    if (ec == 0 && !args.at(1).isUndefined())
+        element->setValue(args.at(1).toString(exec));
     if (ec == 0)
-        element->setDefaultSelected(args.at(exec, 2).toBoolean(exec));
+        element->setDefaultSelected(args.at(2).toBoolean(exec));
     if (ec == 0)
-        element->setSelected(args.at(exec, 3).toBoolean(exec));
+        element->setSelected(args.at(3).toBoolean(exec));
 
     if (ec) {
         setDOMException(exec, ec);
diff --git a/WebCore/bindings/js/JSOptionConstructor.h b/WebCore/bindings/js/JSOptionConstructor.h
index 60f6873..3c87c28 100644
--- a/WebCore/bindings/js/JSOptionConstructor.h
+++ b/WebCore/bindings/js/JSOptionConstructor.h
@@ -28,7 +28,7 @@
 
     class JSOptionConstructor : public DOMObject {
     public:
-        JSOptionConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        JSOptionConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         Document* document() const;
 
         static const JSC::ClassInfo s_info;
diff --git a/WebCore/bindings/js/JSPluginArrayCustom.cpp b/WebCore/bindings/js/JSPluginArrayCustom.cpp
index 5e82942..81d4295 100644
--- a/WebCore/bindings/js/JSPluginArrayCustom.cpp
+++ b/WebCore/bindings/js/JSPluginArrayCustom.cpp
@@ -33,7 +33,7 @@
     return pluginArray->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/WebCore/bindings/js/JSPluginCustom.cpp b/WebCore/bindings/js/JSPluginCustom.cpp
index 2cc3bae..555dd9e 100644
--- a/WebCore/bindings/js/JSPluginCustom.cpp
+++ b/WebCore/bindings/js/JSPluginCustom.cpp
@@ -32,7 +32,7 @@
     return plugin->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/WebCore/bindings/js/JSPluginElementFunctions.cpp b/WebCore/bindings/js/JSPluginElementFunctions.cpp
index eeaa394..56b0eca 100644
--- a/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -57,7 +57,7 @@
     return instance->createRuntimeObject(exec);
 }
 
-JSValuePtr runtimeObjectGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue runtimeObjectGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
@@ -65,7 +65,7 @@
     return runtimeObject ? runtimeObject : jsUndefined();
 }
 
-JSValuePtr runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
@@ -86,7 +86,7 @@
     return true;
 }
 
-bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, HTMLElement* element, PutPropertySlot& slot)
+bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
     RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
     if (!runtimeObject)
@@ -97,11 +97,11 @@
     return true;
 }
 
-static JSValuePtr callPlugin(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callPlugin(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     Instance* instance = pluginInstance(static_cast<JSHTMLElement*>(function)->impl());
     instance->begin();
-    JSValuePtr result = instance->invokeDefaultMethod(exec, args);
+    JSValue result = instance->invokeDefaultMethod(exec, args);
     instance->end();
     return result;
 }
diff --git a/WebCore/bindings/js/JSPluginElementFunctions.h b/WebCore/bindings/js/JSPluginElementFunctions.h
index a1a86c0..8c9dfa7 100644
--- a/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -30,10 +30,10 @@
 
     // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
 
-    JSC::JSValuePtr runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-    JSC::JSValuePtr runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
-    bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, HTMLElement*, JSC::PutPropertySlot&);
+    bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
     JSC::CallType runtimeObjectGetCallData(HTMLElement*, JSC::CallData&);
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index c3fc41f..ad1e556 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -36,7 +36,7 @@
 
 const ClassInfo JSQuarantinedObjectWrapper::s_info = { "JSQuarantinedObjectWrapper", 0, 0, 0 };
 
-JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValuePtr value)
+JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValue value)
 {
     if (!value.isObject())
         return 0;
@@ -49,9 +49,9 @@
     return static_cast<JSQuarantinedObjectWrapper*>(object);
 }
 
-JSValuePtr JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
 {
-    JSValuePtr v = slot.slotBase();
+    JSValue v = slot.slotBase();
     ASSERT(v);
     return v;
 }
@@ -87,7 +87,7 @@
     if (!unwrappedExecState()->hadException())
         return;
 
-    JSValuePtr exception = unwrappedExecState()->exception();
+    JSValue exception = unwrappedExecState()->exception();
     unwrappedExecState()->clearException();
     exec->setException(wrapOutgoingValue(unwrappedExecState(), exception));
 }
@@ -112,7 +112,7 @@
     PropertySlot unwrappedSlot(m_unwrappedObject);
     bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
     if (result) {
-        JSValuePtr unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
+        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
         slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
     }
 
@@ -131,7 +131,7 @@
     PropertySlot unwrappedSlot(m_unwrappedObject);
     bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
     if (result) {
-        JSValuePtr unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
+        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
         slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
     }
 
@@ -140,7 +140,7 @@
     return result;
 }
 
-void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValuePtr value, PutPropertySlot& slot)
+void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     if (!allowsSetProperty())
         return;
@@ -150,7 +150,7 @@
     transferExceptionToExecState(exec);
 }
 
-void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValuePtr value)
+void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValue value)
 {
     if (!allowsSetProperty())
         return;
@@ -188,9 +188,9 @@
 {
     JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(constructor);
 
-    ArgList preparedArgs;
+    MarkedArgumentBuffer preparedArgs;
     for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(exec, i)));
+        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
 
     // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getConstructData
     // from when we called it in JSQuarantinedObjectWrapper::getConstructData.
@@ -198,9 +198,9 @@
     ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
     ASSERT(unwrappedConstructType != ConstructTypeNone);
 
-    JSValuePtr unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
+    JSValue unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
 
-    JSValuePtr resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
+    JSValue resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
     ASSERT(resultValue.isObject());
     JSObject* result = asObject(resultValue);
 
@@ -220,7 +220,7 @@
     return ConstructTypeHost;
 }
 
-bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr proto)
+bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValue value, JSValue proto)
 {
     if (!allowsHasInstance())
         return false;
@@ -232,15 +232,15 @@
     return result;
 }
 
-JSValuePtr JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValuePtr thisValue, const ArgList& args)
+JSValue JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(function);
 
-    JSValuePtr preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
+    JSValue preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
 
-    ArgList preparedArgs;
+    MarkedArgumentBuffer preparedArgs;
     for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(exec, i)));
+        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
 
     // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getCallData
     // from when we called it in JSQuarantinedObjectWrapper::getCallData.
@@ -248,9 +248,9 @@
     CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
     ASSERT(unwrappedCallType != CallTypeNone);
 
-    JSValuePtr unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
+    JSValue unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
 
-    JSValuePtr result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
+    JSValue result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
 
     wrapper->transferExceptionToExecState(exec);
 
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index d66dc46..bf8fddb 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -32,7 +32,7 @@
 
     class JSQuarantinedObjectWrapper : public JSC::JSObject {
     public:
-        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValuePtr);
+        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValue);
 
         virtual ~JSQuarantinedObjectWrapper();
 
@@ -45,7 +45,7 @@
 
         static const JSC::ClassInfo s_info;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr proto) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
             return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::OverridesHasInstance)); 
         }
@@ -59,8 +59,8 @@
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
 
-        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
-        virtual void put(JSC::ExecState*, unsigned, JSC::JSValuePtr);
+        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
+        virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
 
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
         virtual bool deleteProperty(JSC::ExecState*, unsigned);
@@ -68,7 +68,7 @@
         virtual JSC::CallType getCallData(JSC::CallData&);
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
 
-        virtual bool hasInstance(JSC::ExecState*, JSC::JSValuePtr, JSC::JSValuePtr proto);
+        virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
 
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
@@ -82,14 +82,14 @@
         virtual bool allowsCallAsFunction() const { return false; }
         virtual bool allowsGetPropertyNames() const { return false; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const = 0;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const = 0;
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
 
-        static JSC::JSValuePtr cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
         void transferExceptionToExecState(JSC::ExecState*) const;
 
-        static JSC::JSValuePtr call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValuePtr thisValue, const JSC::ArgList&);
+        static JSC::JSValue JSC_HOST_CALL call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValue thisValue, const JSC::ArgList&);
         static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
 
         JSC::JSGlobalObject* m_unwrappedGlobalObject;
diff --git a/WebCore/bindings/js/JSRGBColor.cpp b/WebCore/bindings/js/JSRGBColor.cpp
index 90f8037..f7c87e2 100644
--- a/WebCore/bindings/js/JSRGBColor.cpp
+++ b/WebCore/bindings/js/JSRGBColor.cpp
@@ -28,9 +28,9 @@
 
 using namespace JSC;
 
-static JSValuePtr jsRGBColorRed(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsRGBColorGreen(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsRGBColorBlue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorRed(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorGreen(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorBlue(ExecState*, const Identifier&, const PropertySlot&);
 
 /*
 @begin JSRGBColorTable
@@ -59,7 +59,7 @@
     return getStaticValueSlot<JSRGBColor, DOMObject>(exec, &JSRGBColorTable, this, propertyName, slot);
 }
 
-JSValuePtr getJSRGBColor(ExecState* exec, unsigned color)
+JSValue getJSRGBColor(ExecState* exec, unsigned color)
 {
     return new (exec) JSRGBColor(exec, color);
 }
@@ -68,17 +68,17 @@
 
 using namespace WebCore;
 
-JSValuePtr jsRGBColorRed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorRed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create((static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() >> 16) & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
 
-JSValuePtr jsRGBColorGreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorGreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create((static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() >> 8) & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
 
-JSValuePtr jsRGBColorBlue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorBlue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create(static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
diff --git a/WebCore/bindings/js/JSRGBColor.h b/WebCore/bindings/js/JSRGBColor.h
index d5acff3..cc2870f 100644
--- a/WebCore/bindings/js/JSRGBColor.h
+++ b/WebCore/bindings/js/JSRGBColor.h
@@ -38,12 +38,12 @@
 
         unsigned impl() const { return m_color; }
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
         }
@@ -52,7 +52,7 @@
         unsigned m_color;
     };
 
-    JSC::JSValuePtr getJSRGBColor(JSC::ExecState*, unsigned color);
+    JSC::JSValue getJSRGBColor(JSC::ExecState*, unsigned color);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp b/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
index 53696d4..f40956e 100644
--- a/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
+++ b/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
@@ -39,10 +39,10 @@
 
 namespace WebCore {
 
-JSValuePtr JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
+JSValue JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    int index = args.at(exec, 0).toInt32(exec, indexOk);
+    int index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -58,7 +58,7 @@
     unsigned valuesIndex = index * numColumns;
     for (unsigned i = 0; i < numColumns; i++) {
         const SQLValue& value = m_impl->values()[valuesIndex + i];
-        JSValuePtr jsValue = noValue();
+        JSValue jsValue;
 
         switch (value.type()) {
             case SQLValue::StringValue:
diff --git a/WebCore/bindings/js/JSSQLTransactionCustom.cpp b/WebCore/bindings/js/JSSQLTransactionCustom.cpp
index 064ab15..30d59aa 100644
--- a/WebCore/bindings/js/JSSQLTransactionCustom.cpp
+++ b/WebCore/bindings/js/JSSQLTransactionCustom.cpp
@@ -42,22 +42,22 @@
 
 namespace WebCore {
     
-JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
+JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
 {
-    String sqlStatement = args.at(exec, 0).toString(exec);
+    String sqlStatement = args.at(0).toString(exec);
     if (exec->hadException())
         return jsUndefined();
 
     // Now assemble the list of SQL arguments
     Vector<SQLValue> sqlValues;
-    if (!args.at(exec, 1).isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1).getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
 
-        JSValuePtr lengthValue = object->get(exec, exec->propertyNames().length);
+        JSValue lengthValue = object->get(exec, exec->propertyNames().length);
         if (exec->hadException())
             return jsUndefined();
         unsigned length = lengthValue.toUInt32(exec);
@@ -65,7 +65,7 @@
             return jsUndefined();
         
         for (unsigned i = 0 ; i < length; ++i) {
-            JSValuePtr value = object->get(exec, i);
+            JSValue value = object->get(exec, i);
             if (exec->hadException())
                 return jsUndefined();
             
@@ -83,8 +83,8 @@
     }
 
     RefPtr<SQLStatementCallback> callback;
-    if (!args.at(exec, 2).isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 2).getObject();
+    if (!args.at(2).isUndefinedOrNull()) {
+        JSObject* object = args.at(2).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -95,8 +95,8 @@
     }
     
     RefPtr<SQLStatementErrorCallback> errorCallback;
-    if (!args.at(exec, 3).isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 3).getObject();
+    if (!args.at(3).isUndefinedOrNull()) {
+        JSObject* object = args.at(3).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
diff --git a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index 56ceb7c..2922740 100644
--- a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -26,36 +26,47 @@
 #include "config.h"
 
 #if ENABLE(SVG)
-#include "SVGElementInstance.h"
 #include "JSSVGElementInstance.h"
 
-#include "JSEventListener.h"
 #include "JSDOMWindow.h"
+#include "JSEventListener.h"
+#include "JSSVGElement.h"
+#include "SVGElementInstance.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
+void JSSVGElementInstance::mark()
+{
+    DOMObject::mark();
+
+    // Mark the wrapper for our corresponding element, so it can mark its event handlers.
+    JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
+    if (correspondingWrapper && !correspondingWrapper->marked())
+        correspondingWrapper->mark();
+}
+
+JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSProtectedEventListener> listener = globalObject->findOrCreateJSProtectedEventListener(exec, args.at(exec, 1)))
-        impl()->addEventListener(args.at(exec, 0).toString(exec), listener.release(), args.at(exec, 2).toBoolean(exec));
+    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-JSValuePtr JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
 
-    if (JSProtectedEventListener* listener = globalObject->findJSProtectedEventListener(args.at(exec, 1)))
-        impl()->removeEventListener(args.at(exec, 0).toString(exec), listener, args.at(exec, 2).toBoolean(exec));
+    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
+        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
@@ -64,6 +75,17 @@
 {
 }
 
+JSC::JSValue toJS(JSC::ExecState* exec, SVGElementInstance* object)
+{
+    JSValue result = getDOMObjectWrapper<JSSVGElementInstance>(exec, object);
+
+    // Ensure that our corresponding element has a JavaScript wrapper to keep its event handlers alive.
+    if (object)
+        toJS(exec, object->correspondingElement());
+
+    return result;
 }
 
-#endif
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/bindings/js/JSSVGLengthCustom.cpp b/WebCore/bindings/js/JSSVGLengthCustom.cpp
index edba220..bad52ae 100644
--- a/WebCore/bindings/js/JSSVGLengthCustom.cpp
+++ b/WebCore/bindings/js/JSSVGLengthCustom.cpp
@@ -26,18 +26,18 @@
 
 namespace WebCore {
 
-JSValuePtr JSSVGLength::value(ExecState* exec) const
+JSValue JSSVGLength::value(ExecState* exec) const
 {
     SVGLength imp(*impl());
     return jsNumber(exec, imp.value(context()));
 }
 
-JSValuePtr JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
+JSValue JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
 {
     JSSVGPODTypeWrapper<SVGLength>* wrapper = impl();
 
     SVGLength imp(*wrapper);
-    imp.convertToSpecifiedUnits(args.at(exec, 0).toInt32(exec), context());
+    imp.convertToSpecifiedUnits(args.at(0).toInt32(exec), context());
 
     wrapper->commitChange(imp, context());
     return jsUndefined();
diff --git a/WebCore/bindings/js/JSSVGMatrixCustom.cpp b/WebCore/bindings/js/JSSVGMatrixCustom.cpp
index 0dd086d..fc1e266 100644
--- a/WebCore/bindings/js/JSSVGMatrixCustom.cpp
+++ b/WebCore/bindings/js/JSSVGMatrixCustom.cpp
@@ -29,10 +29,10 @@
 
 namespace WebCore {
 
-JSValuePtr JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
+JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 {
     TransformationMatrix imp(*impl());
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.inverse()).get(), m_context.get());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.inverse()).get(), m_context.get());
 
     if (!imp.isInvertible())
         setDOMException(exec, SVGException::SVG_MATRIX_NOT_INVERTABLE);
@@ -40,14 +40,14 @@
     return result;
 }
 
-JSValuePtr JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
+JSValue JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
 {
     TransformationMatrix imp(*impl());
  
-    float x = args.at(exec, 0).toFloat(exec);
-    float y = args.at(exec, 1).toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
 
     if (x == 0.0 || y == 0.0)
         setDOMException(exec, SVGException::SVG_INVALID_VALUE_ERR);
diff --git a/WebCore/bindings/js/JSSVGPathSegCustom.cpp b/WebCore/bindings/js/JSSVGPathSegCustom.cpp
index b7490e7..cb4687c 100644
--- a/WebCore/bindings/js/JSSVGPathSegCustom.cpp
+++ b/WebCore/bindings/js/JSSVGPathSegCustom.cpp
@@ -59,7 +59,7 @@
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, SVGPathSeg* object, SVGElement* context)
+JSValue toJS(ExecState* exec, SVGPathSeg* object, SVGElement* context)
 {
     if (!object)
         return jsNull();
diff --git a/WebCore/bindings/js/JSSVGPathSegListCustom.cpp b/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
index 69fb3b5..b6fc116 100644
--- a/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
+++ b/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
@@ -35,7 +35,7 @@
 
 namespace WebCore {
 
-JSValuePtr JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
 
@@ -48,28 +48,28 @@
     return jsUndefined();
 }
 
-JSValuePtr JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
     SVGPathSeg* obj = WTF::getPtr(imp->initialize(newItem, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj, m_context.get());
+    JSC::JSValue result = toJS(exec, obj, m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
 
     bool indexOk;
-    unsigned index = args.at(exec, 0).toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -78,18 +78,18 @@
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
     SVGPathSeg* obj = WTF::getPtr(imp->getItem(index, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj, m_context.get());
+    JSC::JSValue result = toJS(exec, obj, m_context.get());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     bool indexOk;
-    unsigned index = args.at(exec, 1).toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -97,20 +97,20 @@
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
     
     bool indexOk;
-    unsigned index = args.at(exec, 1).toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -118,19 +118,19 @@
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     
     bool indexOk;
-    unsigned index = args.at(exec, 0).toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,21 +140,21 @@
 
     RefPtr<SVGPathSeg> obj(imp->removeItem(index, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj.get(), m_context.get());
+    JSC::JSValue result = toJS(exec, obj.get(), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
diff --git a/WebCore/bindings/js/JSSVGPointListCustom.cpp b/WebCore/bindings/js/JSSVGPointListCustom.cpp
index 580b56f..a18c2a2 100644
--- a/WebCore/bindings/js/JSSVGPointListCustom.cpp
+++ b/WebCore/bindings/js/JSSVGPointListCustom.cpp
@@ -33,7 +33,7 @@
 typedef SVGPODListItem<FloatPoint> PODListItem;
 typedef SVGList<RefPtr<PODListItem> > SVGPointListBase;
 
-static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
+static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -42,7 +42,7 @@
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), list->associatedAttributeName()).get(), context);
 }
 
-static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
+static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -53,7 +53,7 @@
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), attributeName).get(), context);
 }
 
-static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -63,7 +63,7 @@
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(*item).get(), context);
 }
 
-JSValuePtr JSSVGPointList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGPointList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     impl()->clear(ec);
@@ -72,18 +72,18 @@
     return jsUndefined();
 }
 
-JSValuePtr JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(exec, 0))), ec));
+        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(0))), ec));
 }
 
-JSValuePtr JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0).toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -95,10 +95,10 @@
         listImp->getItem(index, ec));
 }
 
-JSValuePtr JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1).toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -107,13 +107,13 @@
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(exec, 0))), index, ec));
+        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1).toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -122,13 +122,13 @@
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(exec, 0))), index, ec));
+        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0).toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,12 +140,12 @@
         listImp->removeItem(index, ec));
 }
 
-JSValuePtr JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(exec, 0))), ec));
+        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(0))), ec));
 }
 
 }
diff --git a/WebCore/bindings/js/JSSVGTransformListCustom.cpp b/WebCore/bindings/js/JSSVGTransformListCustom.cpp
index 3bdb2e0..58b25ad 100644
--- a/WebCore/bindings/js/JSSVGTransformListCustom.cpp
+++ b/WebCore/bindings/js/JSSVGTransformListCustom.cpp
@@ -33,7 +33,7 @@
 typedef SVGPODListItem<SVGTransform> PODListItem;
 typedef SVGList<RefPtr<PODListItem> > SVGTransformListBase;
 
-static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -42,7 +42,7 @@
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), list->associatedAttributeName()).get(), context);
 }
 
-static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -53,7 +53,7 @@
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), attributeName).get(), context);
 }
 
-static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -63,7 +63,7 @@
     return toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(*item).get(), context);
 }
 
-JSValuePtr JSSVGTransformList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGTransformList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     impl()->clear(ec);
@@ -72,18 +72,18 @@
     return jsUndefined();
 }
 
-JSValuePtr JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(exec, 0))), ec));
+        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(0))), ec));
 }
 
-JSValuePtr JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0).toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -95,10 +95,10 @@
         listImp->getItem(index, ec));
 }
 
-JSValuePtr JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1).toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -107,13 +107,13 @@
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(exec, 0))), index, ec));
+        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1).toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -122,13 +122,13 @@
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(exec, 0))), index, ec));
+        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0).toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,12 +140,12 @@
         listImp->removeItem(index, ec));
 }
 
-JSValuePtr JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(exec, 0))), ec));
+        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(0))), ec));
 }
 
 }
diff --git a/WebCore/bindings/js/JSStorageCustom.cpp b/WebCore/bindings/js/JSStorageCustom.cpp
index a72898e..bc43d79 100644
--- a/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/WebCore/bindings/js/JSStorageCustom.cpp
@@ -41,7 +41,7 @@
     return impl->contains(propertyName);
 }
 
-JSValuePtr JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSStorage* thisObj = static_cast<JSStorage*>(asObject(slot.slotBase()));
     return jsStringOrNull(exec, thisObj->impl()->getItem(propertyName));
@@ -56,7 +56,7 @@
     if (getStaticValueSlot<JSStorage, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
         return false;
         
-    JSValuePtr prototype = this->prototype();
+    JSValue prototype = this->prototype();
     if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
         return false;
 
@@ -74,7 +74,7 @@
     return false;
 }
 
-bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&)
+bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     // Only perform the custom put if the object doesn't have a native property by this name.
     // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
@@ -83,11 +83,11 @@
     if (getStaticValueSlot<JSStorage, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
         return false;
         
-    JSValuePtr prototype = this->prototype();
+    JSValue prototype = this->prototype();
     if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
         return false;
     
-    String stringValue = valueToStringWithNullCheck(exec, value);
+    String stringValue = value.toString(exec);
     if (exec->hadException())
         return true;
     
diff --git a/WebCore/bindings/js/JSStyleSheetCustom.cpp b/WebCore/bindings/js/JSStyleSheetCustom.cpp
index 2cadcb4..f8146bd 100644
--- a/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -35,7 +35,7 @@
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, StyleSheet* styleSheet)
+JSValue toJS(ExecState* exec, StyleSheet* styleSheet)
 {
     if (!styleSheet)
         return jsNull();
diff --git a/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index ea41687..1da6418 100644
--- a/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -40,7 +40,7 @@
     return styleSheetList->getNamedItem(propertyName);
 }
 
-JSValuePtr JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
     HTMLStyleElement* element = thisObj->impl()->getNamedItem(propertyName);
diff --git a/WebCore/bindings/js/JSTextCustom.cpp b/WebCore/bindings/js/JSTextCustom.cpp
index 8118aef..9e66826 100644
--- a/WebCore/bindings/js/JSTextCustom.cpp
+++ b/WebCore/bindings/js/JSTextCustom.cpp
@@ -32,7 +32,7 @@
 
 namespace WebCore {
 
-JSValuePtr toJSNewlyCreated(ExecState* exec, Text* text)
+JSValue toJSNewlyCreated(ExecState* exec, Text* text)
 {
     if (!text)
         return jsNull();
diff --git a/WebCore/bindings/js/JSTreeWalkerCustom.cpp b/WebCore/bindings/js/JSTreeWalkerCustom.cpp
index aca0f93..6369017 100644
--- a/WebCore/bindings/js/JSTreeWalkerCustom.cpp
+++ b/WebCore/bindings/js/JSTreeWalkerCustom.cpp
@@ -37,7 +37,7 @@
     DOMObject::mark();
 }
     
-JSValuePtr JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->parentNode(exec);
     if (exec->hadException())
@@ -45,7 +45,7 @@
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::firstChild(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::firstChild(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->firstChild(exec);
     if (exec->hadException())
@@ -53,7 +53,7 @@
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::lastChild(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::lastChild(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->lastChild(exec);
     if (exec->hadException())
@@ -61,7 +61,7 @@
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::nextSibling(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::nextSibling(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->nextSibling(exec);
     if (exec->hadException())
@@ -69,7 +69,7 @@
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::previousSibling(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::previousSibling(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->previousSibling(exec);
     if (exec->hadException())
@@ -77,7 +77,7 @@
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::previousNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::previousNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->previousNode(exec);
     if (exec->hadException())
@@ -85,7 +85,7 @@
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::nextNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::nextNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->nextNode(exec);
     if (exec->hadException())
diff --git a/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp b/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp
index 3b97eb1..c7fe4a5 100644
--- a/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp
+++ b/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp
@@ -38,7 +38,7 @@
 JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor(ExecState* exec)
     : DOMObject(JSWebKitCSSMatrixConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
 {
-    putDirect(exec->propertyNames().prototype, JSWebKitCSSMatrixPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSWebKitCSSMatrixPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
 }
 
@@ -46,7 +46,7 @@
 {
     String s;
     if (args.size() >= 1)
-        s = args.at(exec, 0).toString(exec);
+        s = args.at(0).toString(exec);
     
     ExceptionCode ec = 0;
     RefPtr<WebKitCSSMatrix> matrix = WebKitCSSMatrix::create(s, ec);
diff --git a/WebCore/bindings/js/JSWebKitPointConstructor.cpp b/WebCore/bindings/js/JSWebKitPointConstructor.cpp
index c3a8ea6..c7d4e36 100644
--- a/WebCore/bindings/js/JSWebKitPointConstructor.cpp
+++ b/WebCore/bindings/js/JSWebKitPointConstructor.cpp
@@ -39,7 +39,7 @@
 JSWebKitPointConstructor::JSWebKitPointConstructor(ExecState* exec)
     : DOMObject(JSWebKitPointConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
 {
-    putDirect(exec->propertyNames().prototype, JSWebKitPointPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSWebKitPointPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
@@ -48,8 +48,8 @@
     float x = 0;
     float y = 0;
     if (args.size() >= 2) {
-        x = (float)args.at(exec, 0).toNumber(exec);
-        y = (float)args.at(exec, 1).toNumber(exec);
+        x = (float)args.at(0).toNumber(exec);
+        y = (float)args.at(1).toNumber(exec);
         if (isnan(x))
             x = 0;
         if (isnan(y))
diff --git a/WebCore/bindings/js/JSWorkerConstructor.cpp b/WebCore/bindings/js/JSWorkerConstructor.cpp
index a9f2f74..8ea6718 100644
--- a/WebCore/bindings/js/JSWorkerConstructor.cpp
+++ b/WebCore/bindings/js/JSWorkerConstructor.cpp
@@ -44,7 +44,7 @@
 JSWorkerConstructor::JSWorkerConstructor(ExecState* exec)
     : DOMObject(JSWorkerConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
 {
-    putDirect(exec->propertyNames().prototype, JSWorkerPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSWorkerPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
 }
 
@@ -53,7 +53,7 @@
     if (args.size() == 0)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    UString scriptURL = args.at(exec, 0).toString(exec);
+    UString scriptURL = args.at(0).toString(exec);
     if (exec->hadException())
         return 0;
 
diff --git a/WebCore/bindings/js/JSWorkerContextBase.cpp b/WebCore/bindings/js/JSWorkerContextBase.cpp
index c948b85..c71f45b 100644
--- a/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -31,36 +31,17 @@
 
 #include "JSWorkerContextBase.h"
 
-#include "Event.h"
-#include "JSDOMBinding.h"
-#include "JSEventListener.h"
-#include "JSMessageChannelConstructor.h"
-#include "JSMessageEvent.h"
-#include "JSMessagePort.h"
-#include "JSWorkerLocation.h"
-#include "JSWorkerNavigator.h"
-#include "JSXMLHttpRequestConstructor.h"
+#include "JSWorkerContext.h"
 #include "WorkerContext.h"
-#include "WorkerLocation.h"
 
 using namespace JSC;
 
-/*
-@begin JSWorkerContextBaseTable
-# -- Constructors --
-  XMLHttpRequest                jsWorkerContextBaseXMLHttpRequest               DontDelete
-@end
-*/
-
-static JSValuePtr jsWorkerContextBaseXMLHttpRequest(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSWorkerContextBaseXMLHttpRequest(ExecState*, JSObject*, JSValuePtr);
-
-#include "JSWorkerContextBase.lut.h"
-
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 
+const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
+
 JSWorkerContextBase::JSWorkerContextBase(PassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
     : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
     , m_impl(impl)
@@ -76,45 +57,16 @@
     return m_impl.get();
 }
 
-static const HashTable* getJSWorkerContextBaseTable(ExecState* exec)
+JSValue toJS(ExecState*, WorkerContext* workerContext)
 {
-    return getHashTableForGlobalData(exec->globalData(), &JSWorkerContextBaseTable);
-}
-
-const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, getJSWorkerContextBaseTable };
-
-void JSWorkerContextBase::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
-{
-    lookupPut<JSWorkerContextBase, Base>(exec, propertyName, value, getJSWorkerContextBaseTable(exec), this, slot);
-}
-
-bool JSWorkerContextBase::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    const HashEntry* entry = getJSWorkerContextBaseTable(exec)->entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function)
-            setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
-        else
-            slot.setCustom(this, entry->propertyGetter());
-        return true;
-    }
-
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
+    if (!workerContext)
+        return jsNull();
+    WorkerScriptController* script = workerContext->script();
+    if (!script)
+        return jsNull();
+    return script->workerContextWrapper();
 }
 
 } // namespace WebCore
 
-using namespace WebCore;
-
-JSValuePtr jsWorkerContextBaseXMLHttpRequest(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, static_cast<JSWorkerContextBase*>(asObject(slot.slotBase())));
-}
-
-void setJSWorkerContextBaseXMLHttpRequest(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    // Shadowing a built-in constructor
-    static_cast<JSWorkerContextBase*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequest"), value);
-}
-
 #endif // ENABLE(WORKERS)
diff --git a/WebCore/bindings/js/JSWorkerContextBase.h b/WebCore/bindings/js/JSWorkerContextBase.h
index 5dc1921..dcbc5c3 100644
--- a/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/WebCore/bindings/js/JSWorkerContextBase.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,19 +41,19 @@
         JSWorkerContextBase(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
         virtual ~JSWorkerContextBase();
 
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
         WorkerContext* impl() const { return m_impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-
     private:
         RefPtr<WorkerContext> m_impl;
     };
 
+    // Returns a JSWorkerContext or jsNull()
+    JSC::JSValue toJS(JSC::ExecState*, WorkerContext*);
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/WebCore/bindings/js/JSWorkerContextCustom.cpp b/WebCore/bindings/js/JSWorkerContextCustom.cpp
index a28cb75..6824914 100644
--- a/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -31,27 +31,29 @@
 
 #include "JSDOMBinding.h"
 #include "JSEventListener.h"
+#include "JSWorkerLocation.h"
+#include "JSWorkerNavigator.h"
+#include "JSXMLHttpRequestConstructor.h"
 #include "ScheduledAction.h"
 #include "WorkerContext.h"
+#include "WorkerLocation.h"
+#include "WorkerNavigator.h"
 #include <interpreter/Interpreter.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-bool JSWorkerContext::customGetOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
-{
-    // Look for overrides before looking at any of our own properties.
-    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
-        return true;
-    return false;
-}
-
 void JSWorkerContext::mark()
 {
     Base::mark();
 
-    markActiveObjectsForContext(*globalData(), scriptExecutionContext());
+    JSGlobalData& globalData = *this->globalData();
+
+    markActiveObjectsForContext(globalData, scriptExecutionContext());
+
+    markDOMObjectWrapper(globalData, impl()->optionalLocation());
+    markDOMObjectWrapper(globalData, impl()->optionalNavigator());
 
     markIfNotNull(impl()->onmessage());
 
@@ -60,28 +62,31 @@
     EventListenersMap& eventListeners = impl()->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->mark();
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSWorkerContext::self(ExecState*) const
+bool JSWorkerContext::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return JSValuePtr(this);
+    // Look for overrides before looking at any of our own properties.
+    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
+        return true;
+    return false;
 }
 
-void JSWorkerContext::setSelf(ExecState* exec, JSValuePtr value)
+JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
 {
-    putDirect(Identifier(exec, "self"), value);
+    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
 }
 
-JSValuePtr JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
+JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 {
     if (!args.size())
         return jsUndefined();
 
     Vector<String> urls;
     for (unsigned i = 0; i < args.size(); i++) {
-        urls.append(args.at(exec, i).toString(exec));
+        urls.append(args.at(i).toString(exec));
         if (exec->hadException())
             return jsUndefined();
     }
@@ -89,7 +94,7 @@
     int signedLineNumber;
     intptr_t sourceID;
     UString sourceURL;
-    JSValuePtr function;
+    JSValue function;
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, sourceURL, function);
 
     impl()->importScripts(urls, sourceURL, signedLineNumber >= 0 ? signedLineNumber : 0, ec);
@@ -97,58 +102,40 @@
     return jsUndefined();
 }
 
-JSValuePtr JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
 {
-    RefPtr<JSEventListener> listener = findOrCreateJSEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0).toString(exec), listener.release(), args.at(exec, 2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSEventListener* listener = findJSEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0).toString(exec), listener, args.at(exec, 2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-static JSValuePtr setTimeoutOrInterval(ExecState* exec, WorkerContext* workerContext, const ArgList& args, bool singleShot)
+JSValue JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr v = args.at(exec, 0);
-    int delay = args.at(exec, 1).toInt32(exec);
-    if (v.isString())
-        return jsNumber(exec, workerContext->installTimeout(new ScheduledAction(asString(v)->value()), delay, singleShot));
-    CallData callData;
-    if (v.getCallData(callData) == CallTypeNone)
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
         return jsUndefined();
-    ArgList argsTail;
-    args.getSlice(2, argsTail);
-    return jsNumber(exec, workerContext->installTimeout(new ScheduledAction(exec, v, argsTail), delay, singleShot));
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setTimeout(action, delay));
 }
 
-JSValuePtr JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
+JSValue JSWorkerContext::setInterval(ExecState* exec, const ArgList& args)
 {
-    return setTimeoutOrInterval(exec, impl(), args, true);
-}
-
-JSValuePtr JSWorkerContext::clearTimeout(ExecState* exec, const ArgList& args)
-{
-    impl()->removeTimeout(args.at(exec, 0).toInt32(exec));
-    return jsUndefined();
-}
-
-JSValuePtr JSWorkerContext::setInterval(ExecState* exec, const ArgList& args)
-{
-    return setTimeoutOrInterval(exec, impl(), args, false);
-}
-
-JSValuePtr JSWorkerContext::clearInterval(ExecState* exec, const ArgList& args)
-{
-    impl()->removeTimeout(args.at(exec, 0).toInt32(exec));
-    return jsUndefined();
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setInterval(action, delay));
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSWorkerCustom.cpp b/WebCore/bindings/js/JSWorkerCustom.cpp
index 12103d3..f4d3033 100644
--- a/WebCore/bindings/js/JSWorkerCustom.cpp
+++ b/WebCore/bindings/js/JSWorkerCustom.cpp
@@ -49,31 +49,31 @@
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->mark();
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSWorker::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorker::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0).toString(exec), listener.release(), args.at(exec, 2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSWorker::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorker::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0).toString(exec), listener, args.at(exec, 2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
index a7f8ab0..65cdfc2 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -32,11 +32,11 @@
 
 const ClassInfo JSXMLHttpRequestConstructor::s_info = { "XMLHttpRequestConstructor", 0, 0, 0 };
 
-JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, ScriptExecutionContext* scriptExecutionContext)
+JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSXMLHttpRequestConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
-    , m_globalObject(toJSDOMGlobalObject(scriptExecutionContext))
+    , m_globalObject(globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 ScriptExecutionContext* JSXMLHttpRequestConstructor::scriptExecutionContext() const
@@ -46,7 +46,11 @@
 
 static JSObject* constructXMLHttpRequest(ExecState* exec, JSObject* constructor, const ArgList&)
 {
-    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(static_cast<JSXMLHttpRequestConstructor*>(constructor)->scriptExecutionContext());
+    ScriptExecutionContext* context = static_cast<JSXMLHttpRequestConstructor*>(constructor)->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "XMLHttpRequest constructor associated document is unavailable");
+
+    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(context);
     return CREATE_DOM_OBJECT_WRAPPER(exec, XMLHttpRequest, xmlHttpRequest.get());
 }
 
diff --git a/WebCore/bindings/js/JSXMLHttpRequestConstructor.h b/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
index 01d1f85..978a9f0 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
+++ b/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
@@ -26,7 +26,7 @@
 
 class JSXMLHttpRequestConstructor : public DOMObject {
 public:
-    JSXMLHttpRequestConstructor(JSC::ExecState*, ScriptExecutionContext*);
+    JSXMLHttpRequestConstructor(JSC::ExecState*, JSDOMGlobalObject*);
     ScriptExecutionContext* scriptExecutionContext() const;
     static const JSC::ClassInfo s_info;
 
diff --git a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index a7f78b7..06a5817 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -71,28 +71,28 @@
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->mark();
+            (*vecIter)->markJSFunction();
     }
 }
 
 // Custom functions
-JSValuePtr JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    const KURL& url = impl()->scriptExecutionContext()->completeURL(args.at(exec, 1).toString(exec));
-    String method = args.at(exec, 0).toString(exec);
+    const KURL& url = impl()->scriptExecutionContext()->completeURL(args.at(1).toString(exec));
+    String method = args.at(0).toString(exec);
     bool async = true;
     if (args.size() >= 3)
-        async = args.at(exec, 2).toBoolean(exec);
+        async = args.at(2).toBoolean(exec);
 
     ExceptionCode ec = 0;
-    if (args.size() >= 4 && !args.at(exec, 3).isUndefined()) {
-        String user = valueToStringWithNullCheck(exec, args.at(exec, 3));
+    if (args.size() >= 4 && !args.at(3).isUndefined()) {
+        String user = valueToStringWithNullCheck(exec, args.at(3));
 
-        if (args.size() >= 5 && !args.at(exec, 4).isUndefined()) {
-            String password = valueToStringWithNullCheck(exec, args.at(exec, 4));
+        if (args.size() >= 5 && !args.at(4).isUndefined()) {
+            String password = valueToStringWithNullCheck(exec, args.at(4));
             impl()->open(method, url, async, user, password, ec);
         } else
             impl()->open(method, url, async, user, ec);
@@ -103,24 +103,24 @@
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::setRequestHeader(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::setRequestHeader(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     ExceptionCode ec = 0;
-    impl()->setRequestHeader(args.at(exec, 0).toString(exec), args.at(exec, 1).toString(exec), ec);
+    impl()->setRequestHeader(args.at(0).toString(exec), args.at(1).toString(exec), ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     if (args.isEmpty())
         impl()->send(ec);
     else {
-        JSValuePtr val = args.at(exec, 0);
+        JSValue val = args.at(0);
         if (val.isUndefinedOrNull())
             impl()->send(ec);
         else if (val.isObject(&JSDocument::s_info))
@@ -134,7 +134,7 @@
     int signedLineNumber;
     intptr_t sourceID;
     UString sourceURL;
-    JSValuePtr function;
+    JSValue function;
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, sourceURL, function);
     impl()->setLastSendLineNumber(signedLineNumber >= 0 ? signedLineNumber : 0);
     impl()->setLastSendURL(sourceURL);
@@ -143,51 +143,51 @@
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::getResponseHeader(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::getResponseHeader(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     ExceptionCode ec = 0;
-    JSValuePtr header = jsStringOrNull(exec, impl()->getResponseHeader(args.at(exec, 0).toString(exec), ec));
+    JSValue header = jsStringOrNull(exec, impl()->getResponseHeader(args.at(0).toString(exec), ec));
     setDOMException(exec, ec);
     return header;
 }
 
-JSValuePtr JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    impl()->overrideMimeType(args.at(exec, 0).toString(exec));
+    impl()->overrideMimeType(args.at(0).toString(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0).toString(exec), listener.release(), args.at(exec, 2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0).toString(exec), listener, args.at(exec, 2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::responseText(ExecState* exec) const
+JSValue JSXMLHttpRequest::responseText(ExecState* exec) const
 {
     return jsOwnedStringOrNull(exec, impl()->responseText());
 }
diff --git a/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index 26342e0..597010c 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -62,31 +62,31 @@
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->mark();
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0).toString(exec), listener.release(), args.at(exec, 2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0).toString(exec), listener, args.at(exec, 2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp b/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
index 448c832..807b017 100644
--- a/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
+++ b/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
@@ -44,7 +44,7 @@
 JSXSLTProcessorConstructor::JSXSLTProcessorConstructor(ExecState* exec)
     : DOMObject(JSXSLTProcessorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
 {
-    putDirect(exec->propertyNames().prototype, JSXSLTProcessorPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSXSLTProcessorPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 static JSObject* constructXSLTProcessor(ExecState* exec, JSObject*, const ArgList&)
diff --git a/WebCore/bindings/js/JSXSLTProcessorCustom.cpp b/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
index 8de2e54..01e53a6 100644
--- a/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
+++ b/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
@@ -46,9 +46,9 @@
 
 namespace WebCore {
 
-JSValuePtr JSXSLTProcessor::importStylesheet(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::importStylesheet(ExecState*, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
+    JSValue nodeVal = args.at(0);
     if (nodeVal.isObject(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         impl()->importStylesheet(node->impl());
@@ -58,10 +58,10 @@
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
-    JSValuePtr docVal = args.at(exec, 1);
+    JSValue nodeVal = args.at(0);
+    JSValue docVal = args.at(1);
     if (nodeVal.isObject(&JSNode::s_info) && docVal.isObject(&JSDocument::s_info)) {
         WebCore::Node* node = static_cast<JSNode*>(asObject(nodeVal))->impl();
         Document* doc = static_cast<Document*>(static_cast<JSDocument*>(asObject(docVal))->impl());
@@ -71,9 +71,9 @@
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
+    JSValue nodeVal = args.at(0);
     if (nodeVal.isObject(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         RefPtr<Document> resultDocument = impl()->transformToDocument(node->impl());
@@ -85,33 +85,33 @@
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::setParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::setParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1).isUndefinedOrNull() || args.at(exec, 2).isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull() || args.at(2).isUndefinedOrNull())
         return jsUndefined(); // Throw exception?
-    String namespaceURI = args.at(exec, 0).toString(exec);
-    String localName = args.at(exec, 1).toString(exec);
-    String value = args.at(exec, 2).toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
+    String value = args.at(2).toString(exec);
     impl()->setParameter(namespaceURI, localName, value);
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::getParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::getParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1).isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull())
         return jsUndefined();
-    String namespaceURI = args.at(exec, 0).toString(exec);
-    String localName = args.at(exec, 1).toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
     String value = impl()->getParameter(namespaceURI, localName);
     return jsStringOrUndefined(exec, value);
 }
 
-JSValuePtr JSXSLTProcessor::removeParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::removeParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1).isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull())
         return jsUndefined();
-    String namespaceURI = args.at(exec, 0).toString(exec);
-    String localName = args.at(exec, 1).toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
     impl()->removeParameter(namespaceURI, localName);
     return jsUndefined();
 }
diff --git a/WebCore/bindings/js/ScheduledAction.cpp b/WebCore/bindings/js/ScheduledAction.cpp
index 986a96e..91bece7 100644
--- a/WebCore/bindings/js/ScheduledAction.cpp
+++ b/WebCore/bindings/js/ScheduledAction.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *  Copyright (C) 2009 Google Inc. All rights reseved.
  *
@@ -31,30 +31,43 @@
 #include "FrameLoader.h"
 #include "JSDOMBinding.h"
 #include "JSDOMWindow.h"
-#ifdef ANDROID_FIX  // these are generated files, need to check ENABLE(WORKERS)
-#if ENABLE(WORKERS)
-#include "JSWorkerContext.h"
-#endif
-#endif
 #include "ScriptController.h"
 #include "ScriptExecutionContext.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
+#include <runtime/JSLock.h>
+
+#if ENABLE(WORKERS)
+#include "JSWorkerContext.h"
 #include "WorkerContext.h"
 #include "WorkerThread.h"
-#include <runtime/JSLock.h>
+#endif
 
 using namespace JSC;
 
 namespace WebCore {
 
-ScheduledAction::ScheduledAction(ExecState* exec, JSValuePtr function, const ArgList& args)
+ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args)
+{
+    JSValue v = args.at(0);
+    CallData callData;
+    if (v.getCallData(callData) == CallTypeNone) {
+        UString string = v.toString(exec);
+        if (exec->hadException())
+            return 0;
+        return new ScheduledAction(string);
+    }
+    ArgList argsTail;
+    args.getSlice(2, argsTail);
+    return new ScheduledAction(v, argsTail);
+}
+
+ScheduledAction::ScheduledAction(JSValue function, const ArgList& args)
     : m_function(function)
 {
     ArgList::const_iterator end = args.end();
-    for (ArgList::const_iterator it = args.begin(); it != end; ++it) {
-        m_args.append((*it).jsValue(exec));
-    }
+    for (ArgList::const_iterator it = args.begin(); it != end; ++it)
+        m_args.append(*it);
 }
 
 void ScheduledAction::execute(ScriptExecutionContext* context)
@@ -71,7 +84,7 @@
 #endif
 }
 
-void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSValuePtr thisValue)
+void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSValue thisValue)
 {
     ASSERT(m_function);
     JSLock lock(false);
@@ -83,7 +96,7 @@
 
     ExecState* exec = globalObject->globalExec();
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     size_t size = m_args.size();
     for (size_t i = 0; i < size; ++i)
         args.append(m_args[i]);
@@ -96,6 +109,27 @@
         reportCurrentException(exec);
 }
 
+void ScheduledAction::execute(Document* document)
+{
+    JSDOMWindow* window = toJSDOMWindow(document->frame());
+    if (!window)
+        return;
+
+    RefPtr<Frame> frame = window->impl()->frame();
+    if (!frame || !frame->script()->isEnabled())
+        return;
+
+    frame->script()->setProcessingTimerCallback(true);
+
+    if (m_function) {
+        executeFunctionInContext(window, window->shell());
+        Document::updateStyleForAllDocuments();
+    } else
+        frame->loader()->executeScript(m_code);
+
+    frame->script()->setProcessingTimerCallback(false);
+}
+
 #if ENABLE(WORKERS)
 void ScheduledAction::execute(WorkerContext* workerContext)
 {
@@ -114,31 +148,4 @@
 }
 #endif // ENABLE(WORKERS)
 
-void ScheduledAction::execute(Document* document)
-{
-    JSDOMWindow* window = toJSDOMWindow(document->frame());
-    if (!window)
-        return;
-
-    RefPtr<Frame> frame = window->impl()->frame();
-    if (!frame || !frame->script()->isEnabled())
-        return;
-
-    frame->script()->setProcessingTimerCallback(true);
-
-    if (m_function)
-        executeFunctionInContext(window, window->shell());
-    else
-        frame->loader()->executeScript(m_code);
-
-    // Update our document's rendering following the execution of the timeout callback.
-    // FIXME: Why not use updateDocumentsRendering to update rendering of all documents?
-    // FIXME: Is this really the right point to do the update? We need a place that works
-    // for all possible entry points that might possibly execute script, but this seems
-    // to be a bit too low-level.
-    frame->document()->updateRendering();
-
-    frame->script()->setProcessingTimerCallback(false);
-}
-
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScheduledAction.h b/WebCore/bindings/js/ScheduledAction.h
index a1dbbe4..e7d0b75 100644
--- a/WebCore/bindings/js/ScheduledAction.h
+++ b/WebCore/bindings/js/ScheduledAction.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -40,23 +40,25 @@
     */
     class ScheduledAction {
     public:
-        ScheduledAction(JSC::ExecState* exec, JSC::JSValuePtr function, const JSC::ArgList&);
+        static ScheduledAction* create(JSC::ExecState*, const JSC::ArgList&);
+
+        void execute(ScriptExecutionContext*);
+
+    private:
+        ScheduledAction(JSC::JSValue function, const JSC::ArgList&);
         ScheduledAction(const String& code)
             : m_code(code)
         {
         }
 
-        void execute(ScriptExecutionContext*);
-
-    private:
-        void executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValuePtr thisValue);
+        void executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue thisValue);
         void execute(Document*);
 #if ENABLE(WORKERS)        
         void execute(WorkerContext*);
 #endif
 
-        JSC::ProtectedJSValuePtr m_function;
-        Vector<JSC::ProtectedJSValuePtr> m_args;
+        JSC::ProtectedJSValue m_function;
+        Vector<JSC::ProtectedJSValue> m_args;
         String m_code;
     };
 
diff --git a/WebCore/bindings/js/ScriptCachedFrameData.cpp b/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 955a368..213c708 100644
--- a/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -50,6 +50,7 @@
     ScriptController* scriptController = frame->script();
     if (scriptController->haveWindowShell()) {
         m_window = scriptController->windowShell()->window();
+        scriptController->attachDebugger(0);
     }
 }
 
diff --git a/WebCore/bindings/js/ScriptCallFrame.cpp b/WebCore/bindings/js/ScriptCallFrame.cpp
index 29f380a..58168d0 100644
--- a/WebCore/bindings/js/ScriptCallFrame.cpp
+++ b/WebCore/bindings/js/ScriptCallFrame.cpp
@@ -38,14 +38,14 @@
 
 namespace WebCore {
 
-ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, ExecState* exec, const ArgList& args, unsigned skipArgumentCount)
+ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, const ArgList& args, unsigned skipArgumentCount)
     : m_functionName(functionName)
     , m_sourceURL(urlString)
     , m_lineNumber(lineNumber)
 {
     size_t argumentCount = args.size();
     for (size_t i = skipArgumentCount; i < argumentCount; ++i)
-        m_arguments.append(ScriptValue(args.at(exec, i)));
+        m_arguments.append(ScriptValue(args.at(i)));
 }
 
 ScriptCallFrame::~ScriptCallFrame()
diff --git a/WebCore/bindings/js/ScriptCallFrame.h b/WebCore/bindings/js/ScriptCallFrame.h
index 64a1a08..b8c0aba 100644
--- a/WebCore/bindings/js/ScriptCallFrame.h
+++ b/WebCore/bindings/js/ScriptCallFrame.h
@@ -50,7 +50,7 @@
     // <https://bugs.webkit.org/show_bug.cgi?id=21180>
     class ScriptCallFrame  {
     public:
-        ScriptCallFrame(const JSC::UString& functionName, const JSC::UString& urlString, int lineNumber, JSC::ExecState*, const JSC::ArgList&, unsigned skipArgumentCount);
+        ScriptCallFrame(const JSC::UString& functionName, const JSC::UString& urlString, int lineNumber, const JSC::ArgList&, unsigned skipArgumentCount);
         ~ScriptCallFrame();
 
         const ScriptString& functionName() const { return m_functionName; }
diff --git a/WebCore/bindings/js/ScriptCallStack.cpp b/WebCore/bindings/js/ScriptCallStack.cpp
index d984bf4..021ede5 100644
--- a/WebCore/bindings/js/ScriptCallStack.cpp
+++ b/WebCore/bindings/js/ScriptCallStack.cpp
@@ -50,18 +50,18 @@
     int signedLineNumber;
     intptr_t sourceID;
     UString urlString;
-    JSValuePtr function;
+    JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, urlString, function);
 
     if (function) {
         m_caller = asInternalFunction(function);
         unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
-        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, exec, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, args, skipArgumentCount));
     } else {
         // Caller is unknown, but we should still add the frame, because
         // something called us, and gave us arguments.
-        m_frames.append(ScriptCallFrame(UString(), UString(), 0, exec, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(UString(), UString(), 0, args, skipArgumentCount));
     }
 }
 
@@ -90,11 +90,11 @@
     if (!m_caller || m_initialized)
         return;
 
-    JSValuePtr func = m_exec->interpreter()->retrieveCaller(m_exec, m_caller);
+    JSValue func = m_exec->interpreter()->retrieveCaller(m_exec, m_caller);
     while (!func.isNull()) {
         InternalFunction* internalFunction = asInternalFunction(func);
         ArgList emptyArgList;
-        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, 0, emptyArgList, 0));
+        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, emptyArgList, 0));
         func = m_exec->interpreter()->retrieveCaller(m_exec, internalFunction);
     }
     m_initialized = true;
diff --git a/WebCore/bindings/js/ScriptCallStack.h b/WebCore/bindings/js/ScriptCallStack.h
index 7634ce3..1907564 100644
--- a/WebCore/bindings/js/ScriptCallStack.h
+++ b/WebCore/bindings/js/ScriptCallStack.h
@@ -38,7 +38,7 @@
 
 namespace JSC {
     class ExecState;
-    class JSValuePtr;
+    class JSValue;
 }
 
 namespace WebCore {
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
index fbca680..2f676c0 100644
--- a/WebCore/bindings/js/ScriptController.cpp
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -27,7 +27,6 @@
 #include "GCController.h"
 #include "HTMLPlugInElement.h"
 #include "JSDocument.h"
-#include "JSLazyEventListener.h"
 #include "NP_jsobject.h"
 #include "Page.h"
 #include "PageGroup.h"
@@ -45,10 +44,11 @@
 
 ScriptController::ScriptController(Frame* frame)
     : m_frame(frame)
-    , m_handlerLineno(0)
+    , m_handlerLineNumber(0)
     , m_sourceURL(0)
     , m_processingTimerCallback(false)
     , m_paused(false)
+    , m_allowPopupsFromPlugin(false)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_windowScriptNPObject(0)
 #endif
@@ -96,14 +96,16 @@
 
     JSLock lock(false);
 
-    // Evaluating the JavaScript could cause the frame to be deallocated
-    // so we start the keep alive timer here.
-    m_frame->keepAlive();
+    RefPtr<Frame> protect = m_frame;
 
     m_windowShell->window()->globalData()->timeoutChecker.start();
     Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, m_windowShell);
     m_windowShell->window()->globalData()->timeoutChecker.stop();
 
+    // Evaluating the JavaScript could cause the frame to be deallocated
+    // so we start the keep alive timer here.
+    m_frame->keepAlive();
+
     if (comp.complType() == Normal || comp.complType() == ReturnValue) {
         m_sourceURL = savedSourceURL;
         return comp.value();
@@ -113,7 +115,7 @@
         reportException(exec, comp.value());
 
     m_sourceURL = savedSourceURL;
-    return noValue();
+    return JSValue();
 }
 
 void ScriptController::clearWindowShell()
@@ -122,9 +124,13 @@
         return;
 
     JSLock lock(false);
-    m_windowShell->window()->clear();
-    m_liveFormerWindows.add(m_windowShell->window());
+
+    // Clear the debugger from the current window before setting the new window.
+    attachDebugger(0);
+
+    m_windowShell->window()->willRemoveFromWindowShell();
     m_windowShell->setWindow(m_frame->domWindow());
+
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
         m_windowShell->window()->setProfileGroup(page->group().identifier());
@@ -134,24 +140,6 @@
     gcController().garbageCollectSoon();
 }
 
-PassRefPtr<EventListener> ScriptController::createInlineEventListener(const String& functionName, const String& code, Node* node)
-{
-    initScriptIfNeeded();
-    JSLock lock(false);
-    return JSLazyEventListener::create(JSLazyEventListener::HTMLLazyEventListener, functionName, code, m_windowShell->window(), node, m_handlerLineno);
-}
-
-#if ENABLE(SVG)
-
-PassRefPtr<EventListener> ScriptController::createSVGEventHandler(const String& functionName, const String& code, Node* node)
-{
-    initScriptIfNeeded();
-    JSLock lock(false);
-    return JSLazyEventListener::create(JSLazyEventListener::SVGLazyEventListener, functionName, code, m_windowShell->window(), node, m_handlerLineno);
-}
-
-#endif
-
 void ScriptController::initScript()
 {
     if (m_windowShell)
@@ -160,7 +148,7 @@
     JSLock lock(false);
 
     m_windowShell = new JSDOMWindowShell(m_frame->domWindow());
-    updateDocument();
+    m_windowShell->window()->updateDocument();
 
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
@@ -172,7 +160,7 @@
 
 bool ScriptController::processingUserGesture() const
 {
-    return processingUserGestureEvent() || isJavaScriptAnchorNavigation();
+    return m_allowPopupsFromPlugin || processingUserGestureEvent() || isJavaScriptAnchorNavigation();
 }
 
 bool ScriptController::processingUserGestureEvent() const
@@ -257,9 +245,6 @@
     JSLock lock(false);
     if (m_windowShell)
         m_windowShell->window()->updateDocument();
-    HashSet<JSDOMWindow*>::iterator end = m_liveFormerWindows.end();
-    for (HashSet<JSDOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
-        (*it)->updateDocument();
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -335,7 +320,7 @@
     // Create a JSObject bound to this element
     JSLock lock(false);
     ExecState* exec = globalObject()->globalExec();
-    JSValuePtr jsElementValue = toJS(exec, plugin);
+    JSValue jsElementValue = toJS(exec, plugin);
     if (!jsElementValue || !jsElementValue.isObject())
         return 0;
     
diff --git a/WebCore/bindings/js/ScriptController.h b/WebCore/bindings/js/ScriptController.h
index 6f1781e..f700cd9 100644
--- a/WebCore/bindings/js/ScriptController.h
+++ b/WebCore/bindings/js/ScriptController.h
@@ -81,11 +81,8 @@
 
     ScriptValue evaluate(const ScriptSourceCode&);
 
-    PassRefPtr<EventListener> createInlineEventListener(const String& functionName, const String& code, Node*);
-#if ENABLE(SVG)
-    PassRefPtr<EventListener> createSVGEventHandler(const String& functionName, const String& code, Node*);
-#endif
-    void setEventHandlerLineno(int lineno) { m_handlerLineno = lineno; }
+    void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
+    int eventHandlerLineNumber() { return m_handlerLineNumber; }
 
     void setProcessingTimerCallback(bool b) { m_processingTimerCallback = b; }
     bool processingUserGesture() const;
@@ -98,10 +95,12 @@
     void setPaused(bool b) { m_paused = b; }
     bool isPaused() const { return m_paused; }
 
+    void setAllowPopupsFromPlugin(bool allowPopupsFromPlugin) { m_allowPopupsFromPlugin = allowPopupsFromPlugin; }
+    bool allowPopupsFromPlugin() const { return m_allowPopupsFromPlugin; }
+    
     const String* sourceURL() const { return m_sourceURL; } // 0 if we are not evaluating any script
 
     void clearWindowShell();
-    void clearFormerWindow(JSDOMWindow* window) { m_liveFormerWindows.remove(window); }
     void updateDocument();
 
     // Notifies the ScriptController that the securityOrigin of the current
@@ -148,13 +147,13 @@
     bool isJavaScriptAnchorNavigation() const;
 
     JSC::ProtectedPtr<JSDOMWindowShell> m_windowShell;
-    HashSet<JSDOMWindow*> m_liveFormerWindows;
     Frame* m_frame;
-    int m_handlerLineno;
+    int m_handlerLineNumber;
     const String* m_sourceURL;
 
     bool m_processingTimerCallback;
     bool m_paused;
+    bool m_allowPopupsFromPlugin;
 
     // The root object used for objects bound outside the context of a plugin.
     RefPtr<JSC::Bindings::RootObject> m_bindingRootObject;
diff --git a/WebCore/bindings/js/ScriptControllerMac.mm b/WebCore/bindings/js/ScriptControllerMac.mm
index 6554e11..502a504 100644
--- a/WebCore/bindings/js/ScriptControllerMac.mm
+++ b/WebCore/bindings/js/ScriptControllerMac.mm
@@ -141,7 +141,7 @@
 
 static pthread_t mainThread;
 
-static void updateRenderingForBindings(JSC::ExecState*, JSC::JSObject* rootObject)
+static void updateStyleIfNeededForBindings(JSC::ExecState*, JSC::JSObject* rootObject)
 {
     if (pthread_self() != mainThread)
         return;
@@ -157,14 +157,14 @@
     if (!frame)
         return;
 
-    frame->document()->updateRendering();
+    frame->document()->updateStyleIfNeeded();
 }
 
 void ScriptController::initJavaJSBindings()
 {
     mainThread = pthread_self();
     JSC::Bindings::JavaJSObject::initializeJNIThreading();
-    JSC::Bindings::Instance::setDidExecuteFunction(updateRenderingForBindings);
+    JSC::Bindings::Instance::setDidExecuteFunction(updateStyleIfNeededForBindings);
 }
 
 #endif
diff --git a/WebCore/bindings/js/ScriptEventListener.cpp b/WebCore/bindings/js/ScriptEventListener.cpp
new file mode 100644
index 0000000..0ce7bca
--- /dev/null
+++ b/WebCore/bindings/js/ScriptEventListener.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptEventListener.h"
+
+#include "Attribute.h"
+#include "Document.h"
+#include "JSNode.h"
+#include "Frame.h"
+
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+static const String& eventParameterName(bool isSVGEvent)
+{
+    DEFINE_STATIC_LOCAL(const String, eventString, ("event"));
+    DEFINE_STATIC_LOCAL(const String, evtString, ("evt"));
+    return isSVGEvent ? evtString : eventString;
+}
+
+PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
+{
+    ASSERT(node);
+
+    Frame* frame = node->document()->frame();
+    if (!frame)
+        return 0;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return 0;
+
+    JSDOMWindow* globalObject = scriptController->globalObject();
+
+    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
+    {
+        JSLock lock(false);
+        toJS(globalObject->globalExec(), node);
+    }
+
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), globalObject, node, scriptController->eventHandlerLineNumber());
+}
+
+PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
+{
+    if (!frame)
+        return 0;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return 0;
+
+    // 'globalObject' is the JavaScript wrapper that will mark the event listener we're creating.
+    JSDOMWindow* globalObject = scriptController->globalObject();
+
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), globalObject, 0, scriptController->eventHandlerLineNumber());
+}
+
+} // namespace WebCore
diff --git a/WebCore/css/themeChromiumWin.css b/WebCore/bindings/js/ScriptEventListener.h
similarity index 77%
copy from WebCore/css/themeChromiumWin.css
copy to WebCore/bindings/js/ScriptEventListener.h
index e829373..8299d29 100644
--- a/WebCore/css/themeChromiumWin.css
+++ b/WebCore/bindings/js/ScriptEventListener.h
@@ -1,10 +1,10 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,12 +28,22 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* These styles override the default styling for HTML elements as defined in
-   WebCore/css/themeWin.css. */
-#include "themeWin.css"
+#ifndef ScriptEventListener_h
+#define ScriptEventListener_h
 
-input[type="search"]::-webkit-search-cancel-button,
-input[type="search"]::-webkit-search-results-decoration,
-input[type="search"]::-webkit-search-results-button {
-    margin: 0 0 0 0;
-}
+#include "JSLazyEventListener.h"
+
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class Attribute;
+    class Frame;
+    class Node;
+
+    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node*, Attribute*);
+    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+
+} // namespace WebCore
+
+#endif // ScriptEventListener_h
diff --git a/WebCore/bindings/js/ScriptFunctionCall.cpp b/WebCore/bindings/js/ScriptFunctionCall.cpp
index 5d928c1..1122931 100644
--- a/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -34,13 +34,15 @@
 #include "JSDOMBinding.h"
 #include "ScriptString.h"
 #include "ScriptValue.h"
+
 #include <runtime/JSLock.h>
+#include <runtime/UString.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ScriptFunctionCall::ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const char* name)
+ScriptFunctionCall::ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name)
     : m_exec(exec)
     , m_thisObject(thisObject)
     , m_name(name)
@@ -68,26 +70,50 @@
     m_arguments.append(jsString(m_exec, argument));
 }
 
+void ScriptFunctionCall::appendArgument(const JSC::UString& argument)
+{
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(JSC::JSValue argument)
+{
+    m_arguments.append(argument);
+}
+
+void ScriptFunctionCall::appendArgument(long long argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(unsigned int argument)
 {
     JSLock lock(false);
     m_arguments.append(jsNumber(m_exec, argument));
 }
 
+void ScriptFunctionCall::appendArgument(int argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(bool argument)
 {
     m_arguments.append(jsBoolean(argument));
 }
 
-ScriptValue ScriptFunctionCall::call(bool& hadException)
+ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
 {
     JSObject* thisObject = m_thisObject.jsObject();
 
     JSLock lock(false);
 
-    JSValuePtr function = thisObject->get(m_exec, Identifier(m_exec, m_name));
+    JSValue function = thisObject->get(m_exec, Identifier(m_exec, m_name));
     if (m_exec->hadException()) {
-        reportException(m_exec, m_exec->exception());
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
         hadException = true;
         return ScriptValue();
     }
@@ -97,9 +123,11 @@
     if (callType == CallTypeNone)
         return ScriptValue();
 
-    JSValuePtr result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
+    JSValue result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
     if (m_exec->hadException()) {
-        reportException(m_exec, m_exec->exception());
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
         hadException = true;
         return ScriptValue();
     }
@@ -107,7 +135,13 @@
     return ScriptValue(result);
 }
 
-ScriptObject ScriptFunctionCall::construct(bool& hadException)
+ScriptValue ScriptFunctionCall::call()
+{
+    bool hadException = false;
+    return call(hadException);
+}
+
+ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExceptions)
 {
     JSObject* thisObject = m_thisObject.jsObject();
 
@@ -115,7 +149,9 @@
 
     JSObject* constructor = asObject(thisObject->get(m_exec, Identifier(m_exec, m_name)));
     if (m_exec->hadException()) {
-        reportException(m_exec, m_exec->exception());
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
         hadException = true;
         return ScriptObject();
     }
@@ -125,9 +161,11 @@
     if (constructType == ConstructTypeNone)
         return ScriptObject();
 
-    JSValuePtr result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
+    JSValue result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
     if (m_exec->hadException()) {
-        reportException(m_exec, m_exec->exception());
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
         hadException = true;
         return ScriptObject();
     }
diff --git a/WebCore/bindings/js/ScriptFunctionCall.h b/WebCore/bindings/js/ScriptFunctionCall.h
index 0b01717..079ac21 100644
--- a/WebCore/bindings/js/ScriptFunctionCall.h
+++ b/WebCore/bindings/js/ScriptFunctionCall.h
@@ -37,30 +37,39 @@
 
 #include <runtime/ArgList.h>
 
+namespace JSC {
+    class UString;
+    class JSValue;
+}
+
 namespace WebCore {
     class ScriptValue;
     class ScriptString;
 
     class ScriptFunctionCall {
     public:
-        ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const char* name);
+        ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name);
         virtual ~ScriptFunctionCall() {};
 
         void appendArgument(const ScriptObject&);
         void appendArgument(const ScriptString&);
         void appendArgument(const ScriptValue&);
         void appendArgument(const String&);
+        void appendArgument(const JSC::UString&);
+        void appendArgument(JSC::JSValue);
+        void appendArgument(long long);
         void appendArgument(unsigned int);
+        void appendArgument(int);
         void appendArgument(bool);
-        ScriptValue call(bool& hadException);
-        ScriptObject construct(bool& hadException);
+        ScriptValue call(bool& hadException, bool reportExceptions = true);
+        ScriptValue call();
+        ScriptObject construct(bool& hadException, bool reportExceptions = true);
 
     protected:
         ScriptState* m_exec;
         ScriptObject m_thisObject;
         String m_name;
-        JSC::ArgList m_arguments;
-        bool m_quarantineObjects;
+        JSC::MarkedArgumentBuffer m_arguments;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptObject.cpp b/WebCore/bindings/js/ScriptObject.cpp
index 148dac5..44337bd 100644
--- a/WebCore/bindings/js/ScriptObject.cpp
+++ b/WebCore/bindings/js/ScriptObject.cpp
@@ -31,6 +31,14 @@
 #include "config.h"
 #include "ScriptObject.h"
 
+#include "JSDOMBinding.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "JSInspectorController.h"
+#endif
+
+#include <runtime/JSLock.h>
+
 using namespace JSC;
 
 namespace WebCore {
@@ -40,4 +48,112 @@
 {
 }
 
+static bool handleException(ScriptState* scriptState)
+{
+    if (!scriptState->hadException())
+        return true;
+
+    reportException(scriptState, scriptState->exception());
+    return false;
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const String& name, const String& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), value.jsObject(), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, const String& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, double value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, long long value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, int value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, bool value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsBoolean(value), slot);
+    return handleException(scriptState);
+}
+
+ScriptObject ScriptObject::createNew(ScriptState* scriptState)
+{
+    JSLock lock(false);
+    return ScriptObject(constructEmptyObject(scriptState));
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->putDirect(Identifier(scriptState, name), value.jsObject());
+    return handleException(scriptState);
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorController* value)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->putDirect(Identifier(scriptState, name), toJS(scriptState, value));
+    return handleException(scriptState);
+}
+#endif
+
+bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
+{
+    JSLock lock(false);
+    JSValue jsValue = scriptState->lexicalGlobalObject()->get(scriptState, Identifier(scriptState, name));
+    if (!jsValue)
+        return false;
+
+    if (!jsValue.isObject())
+        return false;
+
+    value = ScriptObject(asObject(jsValue));
+    return true;
+}
+
+bool ScriptGlobalObject::remove(ScriptState* scriptState, const char* name)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->deleteProperty(scriptState, Identifier(scriptState, name));
+    return handleException(scriptState);
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptObject.h b/WebCore/bindings/js/ScriptObject.h
index 08fa323..ed86659 100644
--- a/WebCore/bindings/js/ScriptObject.h
+++ b/WebCore/bindings/js/ScriptObject.h
@@ -31,18 +31,40 @@
 #ifndef ScriptObject_h
 #define ScriptObject_h
 
+#include "ScriptState.h"
 #include "ScriptValue.h"
 
 #include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 
 namespace WebCore {
+    class InspectorController;
 
     class ScriptObject : public ScriptValue {
     public:
         ScriptObject(JSC::JSObject*);
         ScriptObject() {}
         JSC::JSObject* jsObject() const { return asObject(jsValue()); }
+
+        bool set(ScriptState*, const String& name, const String&);
+        bool set(ScriptState*, const char* name, const ScriptObject&);
+        bool set(ScriptState*, const char* name, const String&);
+        bool set(ScriptState*, const char* name, double);
+        bool set(ScriptState*, const char* name, long long);
+        bool set(ScriptState*, const char* name, int);
+        bool set(ScriptState*, const char* name, bool);
+
+        static ScriptObject createNew(ScriptState*);
+    };
+
+    class ScriptGlobalObject {
+    public:
+        static bool set(ScriptState*, const char* name, const ScriptObject&);
+        static bool set(ScriptState*, const char* name, InspectorController*);
+        static bool get(ScriptState*, const char* name, ScriptObject&);
+        static bool remove(ScriptState*, const char* name);
+    private:
+        ScriptGlobalObject() { }
     };
 
 }
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
index 9311737..13e180a 100644
--- a/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -34,15 +34,22 @@
 #include "Database.h"
 #include "Document.h"
 #include "Frame.h"
-#include "JSDatabase.h"
-#include "JSStorage.h"
 #include "JSDOMBinding.h"
 #include "JSInspectedObjectWrapper.h"
+#include "JSNode.h"
 #include "ScriptObject.h"
 #include "ScriptValue.h"
 
 #include <runtime/JSLock.h>
 
+#if ENABLE(DATABASE)
+#include "JSDatabase.h"
+#endif
+
+#if ENABLE(DOM_STORAGE)
+#include "JSStorage.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -53,6 +60,7 @@
     return ScriptValue(JSInspectedObjectWrapper::wrap(scriptState, value.jsValue()));
 }
 
+#if ENABLE(DATABASE)
 bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
 {
     ASSERT(database);
@@ -68,7 +76,9 @@
 
     return true;
 }
+#endif
 
+#if ENABLE(DOM_STORAGE)
 bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
 {
     ASSERT(frame);
@@ -81,5 +91,32 @@
 
     return true;
 }
+#endif
+
+bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
+{
+    ExecState* exec = scriptStateFromNode(node);
+    if (!exec)
+        return false;
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, node))));
+
+    return true;
+}
+
+bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
+{
+    ASSERT(domWindow);
+
+    JSDOMWindow* window = toJSDOMWindow(domWindow->frame());
+    ExecState* exec = window->globalExec();
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, window)));
+
+    return true;
+}
+
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.h b/WebCore/bindings/js/ScriptObjectQuarantine.h
index a3ac7f1..d70acd7 100644
--- a/WebCore/bindings/js/ScriptObjectQuarantine.h
+++ b/WebCore/bindings/js/ScriptObjectQuarantine.h
@@ -36,15 +36,23 @@
 namespace WebCore {
 
     class Database;
+    class DOMWindow;
     class Frame;
+    class Node;
     class ScriptObject;
     class ScriptValue;
     class Storage;
 
     ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
 
+#if ENABLE(DATABASE)
     bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
+#endif
+#if ENABLE(DOM_STORAGE)
     bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+#endif
+    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
 
 }
 
diff --git a/WebCore/css/themeChromiumWin.css b/WebCore/bindings/js/ScriptState.cpp
similarity index 71%
copy from WebCore/css/themeChromiumWin.css
copy to WebCore/bindings/js/ScriptState.cpp
index e829373..8bfa33d 100644
--- a/WebCore/css/themeChromiumWin.css
+++ b/WebCore/bindings/js/ScriptState.cpp
@@ -1,10 +1,10 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,12 +28,33 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* These styles override the default styling for HTML elements as defined in
-   WebCore/css/themeWin.css. */
-#include "themeWin.css"
+#include "config.h"
+#include "ScriptState.h"
 
-input[type="search"]::-webkit-search-cancel-button,
-input[type="search"]::-webkit-search-results-decoration,
-input[type="search"]::-webkit-search-results-button {
-    margin: 0 0 0 0;
+#include "Frame.h"
+#include "Node.h"
+#include "Page.h"
+
+namespace WebCore {
+
+ScriptState* scriptStateFromNode(Node* node)
+{
+    if (!node)
+        return 0;
+    Document* document = node->document();
+    if (!document)
+        return 0;
+    Frame* frame = document->frame();
+    if (!frame)
+        return 0;
+    if (!frame->script()->isEnabled())
+        return 0;
+    return frame->script()->globalObject()->globalExec();
+}
+
+ScriptState* scriptStateFromPage(Page* page)
+{
+    return page->mainFrame()->script()->globalObject()->globalExec();
+}
+
 }
diff --git a/WebCore/bindings/js/ScriptState.h b/WebCore/bindings/js/ScriptState.h
index 3cce093..fa5c4a8 100644
--- a/WebCore/bindings/js/ScriptState.h
+++ b/WebCore/bindings/js/ScriptState.h
@@ -32,11 +32,11 @@
 #ifndef ScriptState_h
 #define ScriptState_h
 
-namespace JSC {
-    class ExecState;
-}
+#include "JSDOMBinding.h"
 
 namespace WebCore {
+    class Node;
+    class Page;
 
     // The idea is to expose "state-like" methods (hadException, and any other
     // methods where ExecState just dips into globalData) of JSC::ExecState as a
@@ -44,6 +44,9 @@
     // For now, the separation is purely by convention.
     typedef JSC::ExecState ScriptState;
 
+    ScriptState* scriptStateFromNode(Node*);
+    ScriptState* scriptStateFromPage(Page*);
+
 } // namespace WebCore
 
 #endif // ScriptState_h
diff --git a/WebCore/bindings/js/ScriptValue.cpp b/WebCore/bindings/js/ScriptValue.cpp
index c4a7579..dfb46da 100644
--- a/WebCore/bindings/js/ScriptValue.cpp
+++ b/WebCore/bindings/js/ScriptValue.cpp
@@ -57,7 +57,7 @@
     if (hasNoValue())
         return anotherValue.hasNoValue();
 
-    return JSValueIsEqual(toRef(scriptState), toRef(jsValue()), toRef(anotherValue.jsValue()), 0);
+    return JSValueIsEqual(toRef(scriptState), toRef(scriptState, jsValue()), toRef(scriptState, anotherValue.jsValue()), 0);
 }
 
 bool ScriptValue::isNull() const
diff --git a/WebCore/bindings/js/ScriptValue.h b/WebCore/bindings/js/ScriptValue.h
index e6e7cb1..209ce06 100644
--- a/WebCore/bindings/js/ScriptValue.h
+++ b/WebCore/bindings/js/ScriptValue.h
@@ -41,19 +41,19 @@
 
 class ScriptValue {
 public:
-    ScriptValue(JSC::JSValuePtr value = JSC::noValue()) : m_value(value) {}
+    ScriptValue(JSC::JSValue value = JSC::JSValue()) : m_value(value) {}
     virtual ~ScriptValue() {}
 
-    JSC::JSValuePtr jsValue() const { return m_value.get(); }
+    JSC::JSValue jsValue() const { return m_value.get(); }
     bool getString(String& result) const;
     String toString(ScriptState* scriptState) const { return m_value.get().toString(scriptState); }
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
     bool isUndefined() const;
-    bool hasNoValue() const { return m_value == JSC::noValue(); }
+    bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
 private:
-    JSC::ProtectedJSValuePtr m_value;
+    JSC::ProtectedJSValue m_value;
 };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/WorkerScriptController.cpp b/WebCore/bindings/js/WorkerScriptController.cpp
index 25d7eb9..bcf107b 100644
--- a/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/WebCore/bindings/js/WorkerScriptController.cpp
@@ -83,7 +83,7 @@
     {
         MutexLocker lock(m_sharedDataMutex);
         if (m_executionForbidden)
-            return noValue();
+            return JSValue();
     }
     ScriptValue exception;
     ScriptValue result = evaluate(sourceCode, &exception);
@@ -99,7 +99,7 @@
     {
         MutexLocker lock(m_sharedDataMutex);
         if (m_executionForbidden)
-            return noValue();
+            return JSValue();
     }
 
     initScriptIfNeeded();
@@ -110,14 +110,14 @@
     Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
     m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
-    m_workerContext->thread()->workerObjectProxy()->reportPendingActivity(m_workerContext->hasPendingActivity());
+    m_workerContext->thread()->workerObjectProxy().reportPendingActivity(m_workerContext->hasPendingActivity());
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
         return comp.value();
 
     if (comp.complType() == Throw)
         *exception = comp.value();
-    return noValue();
+    return JSValue();
 }
 
 void WorkerScriptController::setException(ScriptValue exception)
diff --git a/WebCore/bindings/objc/DOM.mm b/WebCore/bindings/objc/DOM.mm
index 53be4ff..3fd28d1 100644
--- a/WebCore/bindings/objc/DOM.mm
+++ b/WebCore/bindings/objc/DOM.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 James G. Speth (speth@end.com)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
  *
@@ -26,34 +26,32 @@
  */
 
 #import "config.h"
+#import "DOMInternal.h" // import first to make the private/public trick work
 #import "DOM.h"
 
+#import "DOMRangeInternal.h"
+#import "DOMElementInternal.h"
+#import "DOMNodeInternal.h"
 #import "DOMHTMLCanvasElement.h"
-#import "DOMInternal.h"
-#import "ExceptionHandlers.h"
 #import "Frame.h"
 #import "HTMLNames.h"
-#import "HTMLPlugInElement.h"
-#import "NodeIterator.h"
-#import "Range.h"
+#import "HTMLElement.h"
 #import "RenderImage.h"
-#import "RenderView.h"
-#import "ScriptController.h"
-#import "SimpleFontData.h"
-#import "TreeWalker.h"
-
+#import "NodeFilter.h"
+#import "WebScriptObjectPrivate.h"
 #import <wtf/HashMap.h>
 
-#if ENABLE(SVG)
-#import "SVGElement.h"
-#import "SVGElementInstance.h"
-#import "SVGNames.h"
+#if ENABLE(SVG_DOM_OBJC_BINDINGS)
 #import "DOMSVG.h"
+#import "SVGElementInstance.h"
 #endif
 
 using namespace JSC;
 using namespace WebCore;
 
+// FIXME: Would be nice to break this up into separate files to match how other WebKit
+// code is organized.
+
 //------------------------------------------------------------------------------------------
 // DOMNode
 
@@ -144,7 +142,7 @@
     addElementClass(HTMLNames::ulTag, [DOMHTMLUListElement class]);
     addElementClass(HTMLNames::xmpTag, [DOMHTMLPreElement class]);
 
-#if ENABLE(SVG)
+#if ENABLE(SVG_DOM_OBJC_BINDINGS)
     addElementClass(SVGNames::aTag, [DOMSVGAElement class]);
     addElementClass(SVGNames::altGlyphTag, [DOMSVGAltGlyphElement class]);
 #if ENABLE(SVG_ANIMATION)
@@ -162,7 +160,7 @@
     addElementClass(SVGNames::defsTag, [DOMSVGDefsElement class]);
     addElementClass(SVGNames::descTag, [DOMSVGDescElement class]);
     addElementClass(SVGNames::ellipseTag, [DOMSVGEllipseElement class]);
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
     addElementClass(SVGNames::feBlendTag, [DOMSVGFEBlendElement class]);
     addElementClass(SVGNames::feColorMatrixTag, [DOMSVGFEColorMatrixElement class]);
     addElementClass(SVGNames::feComponentTransferTag, [DOMSVGFEComponentTransferElement class]);
@@ -260,7 +258,6 @@
 
 @implementation DOMNode (WebCoreInternal)
 
-// FIXME: should this go in the main implementation?
 - (NSString *)description
 {
     if (!_internal)
@@ -274,192 +271,125 @@
     return [NSString stringWithFormat:@"<%@ [%@]: %p>", [[self class] description], [self nodeName], _internal];
 }
 
-- (id)_initWithNode:(WebCore::Node *)impl
+- (JSC::Bindings::RootObject*)_rootObject
 {
-    ASSERT(impl);
-
-    [super _init];
-    _internal = reinterpret_cast<DOMObjectInternal*>(impl);
-    impl->ref();
-    WebCore::addDOMWrapper(self, impl);
-    return self;
+    WebCore::Frame* frame = core(self)->document()->frame();
+    if (!frame)
+        return 0;
+    return frame->script()->bindingRootObject();
 }
 
-+ (DOMNode *)_wrapNode:(WebCore::Node *)impl
+@end
+
+Class kitClass(WebCore::Node* impl)
 {
-    if (!impl)
-        return nil;
-
-    id cachedInstance;
-    cachedInstance = WebCore::getDOMWrapper(impl);
-    if (cachedInstance)
-        return [[cachedInstance retain] autorelease];
-
-    Class wrapperClass = nil;
     switch (impl->nodeType()) {
         case WebCore::Node::ELEMENT_NODE:
             if (impl->isHTMLElement())
-                wrapperClass = WebCore::elementClass(static_cast<WebCore::HTMLElement*>(impl)->tagQName(), [DOMHTMLElement class]);
-#if ENABLE(SVG)
-            else if (impl->isSVGElement())
-                wrapperClass = WebCore::elementClass(static_cast<WebCore::SVGElement*>(impl)->tagQName(), [DOMSVGElement class]);
+                return WebCore::elementClass(static_cast<WebCore::HTMLElement*>(impl)->tagQName(), [DOMHTMLElement class]);
+#if ENABLE(SVG_DOM_OBJC_BINDINGS)
+            if (impl->isSVGElement())
+                return WebCore::elementClass(static_cast<WebCore::SVGElement*>(impl)->tagQName(), [DOMSVGElement class]);
 #endif
-            else
-                wrapperClass = [DOMElement class];
-            break;
+            return [DOMElement class];
         case WebCore::Node::ATTRIBUTE_NODE:
-            wrapperClass = [DOMAttr class];
-            break;
+            return [DOMAttr class];
         case WebCore::Node::TEXT_NODE:
-            wrapperClass = [DOMText class];
-            break;
+            return [DOMText class];
         case WebCore::Node::CDATA_SECTION_NODE:
-            wrapperClass = [DOMCDATASection class];
-            break;
+            return [DOMCDATASection class];
         case WebCore::Node::ENTITY_REFERENCE_NODE:
-            wrapperClass = [DOMEntityReference class];
-            break;
+            return [DOMEntityReference class];
         case WebCore::Node::ENTITY_NODE:
-            wrapperClass = [DOMEntity class];
-            break;
+            return [DOMEntity class];
         case WebCore::Node::PROCESSING_INSTRUCTION_NODE:
-            wrapperClass = [DOMProcessingInstruction class];
-            break;
+            return [DOMProcessingInstruction class];
         case WebCore::Node::COMMENT_NODE:
-            wrapperClass = [DOMComment class];
-            break;
+            return [DOMComment class];
         case WebCore::Node::DOCUMENT_NODE:
             if (static_cast<WebCore::Document*>(impl)->isHTMLDocument())
-                wrapperClass = [DOMHTMLDocument class];
-#if ENABLE(SVG)
-            else if (static_cast<WebCore::Document*>(impl)->isSVGDocument())
-                wrapperClass = [DOMSVGDocument class];
+                return [DOMHTMLDocument class];
+#if ENABLE(SVG_DOM_OBJC_BINDINGS)
+            if (static_cast<WebCore::Document*>(impl)->isSVGDocument())
+                return [DOMSVGDocument class];
 #endif
-            else
-                wrapperClass = [DOMDocument class];
-            break;
+            return [DOMDocument class];
         case WebCore::Node::DOCUMENT_TYPE_NODE:
-            wrapperClass = [DOMDocumentType class];
-            break;
+            return [DOMDocumentType class];
         case WebCore::Node::DOCUMENT_FRAGMENT_NODE:
-            wrapperClass = [DOMDocumentFragment class];
-            break;
+            return [DOMDocumentFragment class];
         case WebCore::Node::NOTATION_NODE:
-            wrapperClass = [DOMNotation class];
-            break;
+            return [DOMNotation class];
         case WebCore::Node::XPATH_NAMESPACE_NODE:
             // FIXME: Create an XPath objective C wrapper
             // See http://bugs.webkit.org/show_bug.cgi?id=8755
             return nil;
     }
-    return [[[wrapperClass alloc] _initWithNode:impl] autorelease];
-}
-
-+ (id <DOMEventTarget>)_wrapEventTarget:(WebCore::EventTarget *)eventTarget
-{
-    if (!eventTarget)
-        return nil;
-
-    // We don't have an ObjC binding for XMLHttpRequest
-    return [DOMNode _wrapNode:eventTarget->toNode()];
-}
-
-- (WebCore::Node *)_node
-{
-    return reinterpret_cast<WebCore::Node*>(_internal);
-}
-
-- (JSC::Bindings::RootObject*)_rootObject
-{
-    if (WebCore::Node *n = [self _node]) {
-        if (WebCore::Frame* frame = n->document()->frame())
-            return frame->script()->bindingRootObject();
-    }
-    return 0;
-}
-
-@end
-
-@implementation DOMNode (DOMNodeExtensions)
-
-// FIXME: This should be implemented in Node so we don't have to fetch the renderer.
-// If it was, we could even autogenerate.
-- (NSRect)boundingBox
-{
-    [self _node]->document()->updateLayoutIgnorePendingStylesheets();
-    WebCore::RenderObject *renderer = [self _node]->renderer();
-    if (renderer)
-        return renderer->absoluteBoundingBoxRect();
-    return NSZeroRect;
-}
-
-// FIXME: This should be implemented in Node so we don't have to fetch the renderer.
-// If it was, we could even autogenerate.
-- (NSArray *)lineBoxRects
-{
-    [self _node]->document()->updateLayoutIgnorePendingStylesheets();
-    WebCore::RenderObject *renderer = [self _node]->renderer();
-    if (renderer) {
-        Vector<WebCore::IntRect> rects;
-        renderer->absoluteRectsForRange(rects);
-        return kit(rects);
-    }
+    ASSERT_NOT_REACHED();
     return nil;
 }
 
-@end
-
-#if ENABLE(SVG)
-@implementation DOMSVGElementInstance (WebCoreInternal)
-
-- (id)_initWithSVGElementInstance:(WebCore::SVGElementInstance *)impl
-{
-    ASSERT(impl);
-
-    [super _init];
-    _internal = reinterpret_cast<DOMObjectInternal*>(impl);
-    impl->ref();
-    WebCore::addDOMWrapper(self, impl);
-    return self;
-}
-
-+ (DOMSVGElementInstance *)_wrapSVGElementInstance:(WebCore::SVGElementInstance *)impl
-{
-    if (!impl)
-        return nil;
-    
-    id cachedInstance;
-    cachedInstance = WebCore::getDOMWrapper(impl);
-    if (cachedInstance)
-        return [[cachedInstance retain] autorelease];
-    
-    return [[[self alloc] _initWithSVGElementInstance:impl] autorelease];
-}
-
-+ (id <DOMEventTarget>)_wrapEventTarget:(WebCore::EventTarget *)eventTarget
+id <DOMEventTarget> kit(WebCore::EventTarget* eventTarget)
 {
     if (!eventTarget)
         return nil;
 
-    return [DOMSVGElementInstance _wrapSVGElementInstance:eventTarget->toSVGElementInstance()];
+    if (WebCore::Node* node = eventTarget->toNode())
+        return kit(node);
+
+#if ENABLE(SVG_DOM_OBJC_BINDINGS)
+    if (WebCore::SVGElementInstance* svgElementInstance = eventTarget->toSVGElementInstance())
+        return kit(svgElementInstance);
+#endif
+
+    // We don't have an ObjC binding for XMLHttpRequest.
+
+    return nil;
 }
 
-- (WebCore::SVGElementInstance *)_SVGElementInstance
+@implementation DOMNode (DOMNodeExtensions)
+
+- (NSRect)boundingBox
 {
-    return reinterpret_cast<WebCore::SVGElementInstance*>(_internal);
+    // FIXME: Could we move this function to WebCore::Node and autogenerate?
+    core(self)->document()->updateLayoutIgnorePendingStylesheets();
+    WebCore::RenderObject* renderer = core(self)->renderer();
+    if (!renderer)
+        return NSZeroRect;
+    return renderer->absoluteBoundingBoxRect();
+}
+
+- (NSArray *)textRects
+{
+    // FIXME: Could we move this function to WebCore::Node and autogenerate?
+    core(self)->document()->updateLayoutIgnorePendingStylesheets();
+    if (!core(self)->renderer())
+        return nil;
+    RefPtr<Range> range = Range::create(core(self)->document());
+    WebCore::ExceptionCode ec = 0;
+    range->selectNodeContents(core(self), ec);
+    Vector<WebCore::IntRect> rects;
+    range->textRects(rects);
+    return kit(rects);
+}
+
+- (NSArray *)lineBoxRects
+{
+    return [self textRects];
 }
 
 @end
-#endif
 
 @implementation DOMNode (DOMNodeExtensionsPendingPublic)
 
 - (NSImage *)renderedImage
 {
-    if (WebCore::Node *node = [self _node])
-        if (WebCore::Frame* frame = node->document()->frame())
-            return frame->nodeImage(node);
-    return nil;
+    // FIXME: Could we move this function to WebCore::Node and autogenerate?
+    WebCore::Node* node = core(self);
+    WebCore::Frame* frame = node->document()->frame();
+    if (!frame)
+        return nil;
+    return frame->nodeImage(node);
 }
 
 @end
@@ -468,16 +398,24 @@
 
 - (NSRect)boundingBox
 {
-    [self _range]->ownerDocument()->updateLayoutIgnorePendingStylesheets();
-    return [self _range]->boundingBox();
+    // FIXME: The call to updateLayoutIgnorePendingStylesheets should be moved into WebCore::Range.
+    core(self)->ownerDocument()->updateLayoutIgnorePendingStylesheets();
+    return core(self)->boundingBox();
+}
+
+- (NSArray *)textRects
+{
+    // FIXME: The call to updateLayoutIgnorePendingStylesheets should be moved into WebCore::Range.
+    Vector<WebCore::IntRect> rects;
+    core(self)->ownerDocument()->updateLayoutIgnorePendingStylesheets();
+    core(self)->textRects(rects);
+    return kit(rects);
 }
 
 - (NSArray *)lineBoxRects
 {
-    Vector<WebCore::IntRect> rects;
-    [self _range]->ownerDocument()->updateLayoutIgnorePendingStylesheets();
-    [self _range]->addLineBoxRects(rects);
-    return kit(rects);
+    // FIXME: Remove this once all clients stop using it and we drop Leopard support.
+    return [self textRects];
 }
 
 @end
@@ -485,67 +423,63 @@
 //------------------------------------------------------------------------------------------
 // DOMElement
 
-// FIXME: this should be auto-generated in DOMElement.mm
 @implementation DOMElement (DOMElementAppKitExtensions)
 
-// FIXME: this should be implemented in the implementation
 - (NSImage*)image
 {
-    WebCore::RenderObject* renderer = [self _element]->renderer();
-    if (renderer && renderer->isImage()) {
-        WebCore::RenderImage* img = static_cast<WebCore::RenderImage*>(renderer);
-        if (img->cachedImage() && !img->cachedImage()->errorOccurred())
-            return img->cachedImage()->image()->getNSImage();
-    }
-    return nil;
+    // FIXME: Could we move this function to WebCore::Node and autogenerate?
+    WebCore::RenderObject* renderer = core(self)->renderer();
+    if (!renderer || !renderer->isImage())
+        return nil;
+    WebCore::CachedImage* cachedImage = static_cast<WebCore::RenderImage*>(renderer)->cachedImage();
+    if (!cachedImage || cachedImage->errorOccurred())
+        return nil;
+    return cachedImage->image()->getNSImage();
 }
 
 @end
 
 @implementation DOMElement (WebPrivate)
 
-// FIXME: this should be implemented in the implementation
 - (NSFont *)_font
 {
-    WebCore::RenderObject* renderer = [self _element]->renderer();
-    if (renderer)
-        return renderer->style()->font().primaryFont()->getNSFont();
-    return nil;
+    // FIXME: Could we move this function to WebCore::Element and autogenerate?
+    WebCore::RenderObject* renderer = core(self)->renderer();
+    if (!renderer)
+        return nil;
+    return renderer->style()->font().primaryFont()->getNSFont();
 }
 
-// FIXME: this should be implemented in the implementation
 - (NSData *)_imageTIFFRepresentation
 {
-    WebCore::RenderObject* renderer = [self _element]->renderer();
-    if (renderer && renderer->isImage()) {
-        WebCore::RenderImage* img = static_cast<WebCore::RenderImage*>(renderer);
-        if (img->cachedImage() && !img->cachedImage()->errorOccurred())
-            return (NSData*)(img->cachedImage()->image()->getTIFFRepresentation());
-    }
-    return nil;
+    // FIXME: Could we move this function to WebCore::Element and autogenerate?
+    WebCore::RenderObject* renderer = core(self)->renderer();
+    if (!renderer || !renderer->isImage())
+        return nil;
+    WebCore::CachedImage* cachedImage = static_cast<WebCore::RenderImage*>(renderer)->cachedImage();
+    if (!cachedImage || cachedImage->errorOccurred())
+        return nil;
+    return (NSData *)cachedImage->image()->getTIFFRepresentation();
 }
 
-// FIXME: this should be implemented in the implementation
 - (NSURL *)_getURLAttribute:(NSString *)name
 {
+    // FIXME: Could we move this function to WebCore::Element and autogenerate?
     ASSERT(name);
-    WebCore::Element* element = [self _element];
+    WebCore::Element* element = core(self);
     ASSERT(element);
     return element->document()->completeURL(parseURL(element->getAttribute(name)));
 }
 
-// FIXME: this should be implemented in the implementation
 - (BOOL)isFocused
 {
-    WebCore::Element* impl = [self _element];
-    if (impl->document()->focusedNode() == impl)
-        return YES;
-    return NO;
+    // FIXME: Could we move this function to WebCore::Element and autogenerate?
+    WebCore::Element* element = core(self);
+    return element->document()->focusedNode() == element;
 }
 
 @end
 
-
 //------------------------------------------------------------------------------------------
 // DOMRange
 
@@ -559,7 +493,7 @@
                [self startContainer], [self startOffset], [self endContainer], [self endOffset]];
 }
 
-// FIXME: this should be removed as soon as all internal Apple uses of it have been replaced with
+// FIXME: This should be removed as soon as all internal Apple uses of it have been replaced with
 // calls to the public method - (NSString *)text.
 - (NSString *)_text
 {
@@ -568,43 +502,31 @@
 
 @end
 
-
 //------------------------------------------------------------------------------------------
 // DOMNodeFilter
 
-// FIXME: This implementation should be in it's own file.
-
-@implementation DOMNodeFilter
-
-- (id)_initWithNodeFilter:(WebCore::NodeFilter *)impl
-{
-    ASSERT(impl);
-
-    [super _init];
-    _internal = reinterpret_cast<DOMObjectInternal*>(impl);
-    impl->ref();
-    WebCore::addDOMWrapper(self, impl);
-    return self;
-}
-
-+ (DOMNodeFilter *)_wrapNodeFilter:(WebCore::NodeFilter *)impl
+DOMNodeFilter *kit(WebCore::NodeFilter* impl)
 {
     if (!impl)
         return nil;
-
-    id cachedInstance;
-    cachedInstance = WebCore::getDOMWrapper(impl);
-    if (cachedInstance)
-        return [[cachedInstance retain] autorelease];
-
-    return [[[self alloc] _initWithNodeFilter:impl] autorelease];
+    
+    if (DOMNodeFilter *wrapper = getDOMWrapper(impl))
+        return [[wrapper retain] autorelease];
+    
+    DOMNodeFilter *wrapper = [[DOMNodeFilter alloc] _init];
+    wrapper->_internal = reinterpret_cast<DOMObjectInternal*>(impl);
+    impl->ref();
+    addDOMWrapper(wrapper, impl);
+    return [wrapper autorelease];
 }
 
-- (WebCore::NodeFilter *)_nodeFilter
+WebCore::NodeFilter* core(DOMNodeFilter *wrapper)
 {
-    return reinterpret_cast<WebCore::NodeFilter*>(_internal);
+    return wrapper ? reinterpret_cast<WebCore::NodeFilter*>(wrapper->_internal) : 0;
 }
 
+@implementation DOMNodeFilter
+
 - (void)dealloc
 {
     if (_internal)
@@ -621,7 +543,7 @@
 
 - (short)acceptNode:(DOMNode *)node
 {
-    return [self _nodeFilter]->acceptNode([node _node]);
+    return core(self)->acceptNode(core(node));
 }
 
 @end
diff --git a/WebCore/bindings/objc/DOMAbstractView.mm b/WebCore/bindings/objc/DOMAbstractView.mm
index 7bfe7f1..0b79aa9 100644
--- a/WebCore/bindings/objc/DOMAbstractView.mm
+++ b/WebCore/bindings/objc/DOMAbstractView.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,16 +27,14 @@
  */
 
 #import "config.h"
-#import "DOMAbstractView.h"
+#import "DOMInternal.h" // import first to make the private/public trick work
+#import "DOMAbstractViewInternal.h"
 
-#import "DOMDocument.h"
-#import "DOMInternal.h"
-#import "DOMWindow.h"
-#import "Document.h"
+#import "DOMDocumentInternal.h"
 #import "ExceptionHandlers.h"
 #import "Frame.h"
 #import "ThreadCheck.h"
-#import <wtf/GetPtr.h>
+#import "WebScriptObjectPrivate.h"
 
 #define IMPL reinterpret_cast<WebCore::Frame*>(_internal)
 
@@ -52,7 +50,7 @@
 {
     if (!_internal)
         return nil;
-    return [DOMDocument _wrapDocument:WTF::getPtr(IMPL->domWindow()->document())];
+    return kit(IMPL->domWindow()->document());
 }
 
 @end
@@ -62,44 +60,34 @@
 - (void)_disconnectFrame
 {
     ASSERT(_internal);
-    WebCore::removeDOMWrapper(_internal);
+    removeDOMWrapper(_internal);
     _internal = 0;
 }
 
 @end
 
-@implementation DOMAbstractView (WebCoreInternal)
-
-- (WebCore::DOMWindow *)_abstractView
+WebCore::DOMWindow* core(DOMAbstractView *wrapper)
 {
-    if (!_internal)
-        return nil;
-    return IMPL->domWindow();
+    if (!wrapper)
+        return 0;
+    if (!wrapper->_internal)
+        return 0;
+    return reinterpret_cast<WebCore::Frame*>(wrapper->_internal)->domWindow();
 }
 
-- (id)_initWithFrame:(WebCore::Frame *)impl
-{
-    { DOM_ASSERT_MAIN_THREAD(); WebCoreThreadViolationCheckRoundOne(); };
-    [super _init];
-    _internal = reinterpret_cast<DOMObjectInternal*>(impl);
-    WebCore::addDOMWrapper(self, impl);
-    return self;
-}
-
-+ (DOMAbstractView *)_wrapAbstractView:(WebCore::DOMWindow *)impl
+DOMAbstractView *kit(WebCore::DOMWindow* value)
 {
     { DOM_ASSERT_MAIN_THREAD(); WebCoreThreadViolationCheckRoundOne(); };
 
-    if (!impl)
+    if (!value)
         return nil;
-    WebCore::Frame* frame = impl->frame();
+    WebCore::Frame* frame = value->frame();
     if (!frame)
         return nil;
-    id cachedInstance;
-    cachedInstance = WebCore::getDOMWrapper(frame);
-    if (cachedInstance)
-        return [[cachedInstance retain] autorelease];
-    return [[[self alloc] _initWithFrame:frame] autorelease];
+    if (DOMAbstractView *wrapper = getDOMWrapper(frame))
+        return [[wrapper retain] autorelease];
+    DOMAbstractView *wrapper = [[DOMAbstractView alloc] _init];
+    wrapper->_internal = reinterpret_cast<DOMObjectInternal*>(frame);
+    addDOMWrapper(wrapper, frame);
+    return [wrapper autorelease];
 }
-
-@end
diff --git a/WebCore/bindings/objc/DOMCSS.mm b/WebCore/bindings/objc/DOMCSS.mm
index 4e9cd0c..0149273 100644
--- a/WebCore/bindings/objc/DOMCSS.mm
+++ b/WebCore/bindings/objc/DOMCSS.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 James G. Speth (speth@end.com)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
  *
@@ -26,194 +26,99 @@
  */
 
 #import "config.h"
-#import "DOMCSS.h"
 
-#import "CSSCharsetRule.h"
-#import "CSSFontFaceRule.h"
-#import "CSSImportRule.h"
-#import "CSSMediaRule.h"
-#import "CSSPageRule.h"
-#import "CSSPrimitiveValue.h"
 #import "CSSRule.h"
-#import "CSSRuleList.h"
-#import "CSSStyleDeclaration.h"
-#import "CSSStyleRule.h"
-#import "CSSStyleSheet.h"
-#import "CSSValueList.h"
+#import "CSSValue.h"
+#import "DOMCSSCharsetRule.h"
+#import "DOMCSSFontFaceRule.h"
+#import "DOMCSSImportRule.h"
+#import "DOMCSSMediaRule.h"
+#import "DOMCSSPageRule.h"
+#import "DOMCSSPrimitiveValue.h"
+#import "DOMCSSRuleInternal.h"
+#import "DOMCSSStyleDeclaration.h"
+#import "DOMCSSStyleRule.h"
+#import "DOMCSSStyleSheet.h"
+#import "DOMCSSUnknownRule.h"
+#import "DOMCSSValueInternal.h"
+#import "DOMCSSValueList.h"
+#import "DOMCSSVariablesRule.h"
 #import "DOMInternal.h"
-#import "DOMPrivate.h"
-#import "StyleSheet.h"
-#import <objc/objc-class.h>
+#import "DOMStyleSheetInternal.h"
+#import "DOMWebKitCSSKeyframeRule.h"
+#import "DOMWebKitCSSKeyframesRule.h"
 
-#if ENABLE(SVG)
-#import "DOMSVGColor.h"
+#if ENABLE(SVG_DOM_OBJC_BINDINGS)
 #import "DOMSVGPaint.h"
 #endif
 
 //------------------------------------------------------------------------------------------
 // DOMStyleSheet
 
-@implementation DOMStyleSheet (WebCoreInternal)
-
-- (WebCore::StyleSheet *)_styleSheet
+Class kitClass(WebCore::StyleSheet* impl)
 {
-    return reinterpret_cast<WebCore::StyleSheet*>(_internal);
-}
-
-- (id)_initWithStyleSheet:(WebCore::StyleSheet *)impl
-{
-    [super _init];
-    _internal = reinterpret_cast<DOMObjectInternal*>(impl);
-    impl->ref();
-    WebCore::addDOMWrapper(self, impl);
-    return self;
-}
-
-+ (DOMStyleSheet *)_wrapStyleSheet:(WebCore::StyleSheet *)impl
-{
-    if (!impl)
-        return nil;
-
-    id cachedInstance;
-    cachedInstance = WebCore::getDOMWrapper(impl);
-    if (cachedInstance)
-        return [[cachedInstance retain] autorelease];
-    
-    Class wrapperClass;
     if (impl->isCSSStyleSheet())
-        wrapperClass = [DOMCSSStyleSheet class];
-    else
-        wrapperClass = [DOMStyleSheet class];
-    return [[[wrapperClass alloc] _initWithStyleSheet:impl] autorelease];
+        return [DOMCSSStyleSheet class];
+    return [DOMStyleSheet class];
 }
 
-@end
-
 //------------------------------------------------------------------------------------------
 // DOMCSSRule
 
-@implementation DOMCSSRule (WebCoreInternal)
-
-- (WebCore::CSSRule *)_CSSRule
+Class kitClass(WebCore::CSSRule* impl)
 {
-    return reinterpret_cast<WebCore::CSSRule*>(_internal);
-}
-
-- (id)_initWithCSSRule:(WebCore::CSSRule *)impl
-{
-    [super _init];
-    _internal = reinterpret_cast<DOMObjectInternal*>(impl);
-    impl->ref();
-    WebCore::addDOMWrapper(self, impl);
-    return self;
-}
-
-+ (DOMCSSRule *)_wrapCSSRule:(WebCore::CSSRule *)impl
-{
-    if (!impl)
-        return nil;
-
-    id cachedInstance;
-    cachedInstance = WebCore::getDOMWrapper(impl);
-    if (cachedInstance)
-        return [[cachedInstance retain] autorelease];
-
-    Class wrapperClass = nil;
     switch (impl->type()) {
         case DOM_UNKNOWN_RULE:
-            wrapperClass = [DOMCSSUnknownRule class];
-            break;
+            return [DOMCSSUnknownRule class];
         case DOM_STYLE_RULE:
-            wrapperClass = [DOMCSSStyleRule class];
-            break;
+            return [DOMCSSStyleRule class];
         case DOM_CHARSET_RULE:
-            wrapperClass = [DOMCSSCharsetRule class];
-            break;
+            return [DOMCSSCharsetRule class];
         case DOM_IMPORT_RULE:
-            wrapperClass = [DOMCSSImportRule class];
-            break;
+            return [DOMCSSImportRule class];
         case DOM_MEDIA_RULE:
-            wrapperClass = [DOMCSSMediaRule class];
-            break;
+            return [DOMCSSMediaRule class];
         case DOM_FONT_FACE_RULE:
-            wrapperClass = [DOMCSSFontFaceRule class];
-            break;
+            return [DOMCSSFontFaceRule class];
         case DOM_PAGE_RULE:
-            wrapperClass = [DOMCSSPageRule class];
-            break;
+            return [DOMCSSPageRule class];
         case DOM_VARIABLES_RULE:
-            wrapperClass = [DOMCSSVariablesRule class];
-            break;
+            return [DOMCSSVariablesRule class];
         case DOM_WEBKIT_KEYFRAMES_RULE:
-            wrapperClass = [DOMWebKitCSSKeyframesRule class];
-            break;
+            return [DOMWebKitCSSKeyframesRule class];
         case DOM_WEBKIT_KEYFRAME_RULE:
-            wrapperClass = [DOMWebKitCSSKeyframeRule class];
-            break;
+            return [DOMWebKitCSSKeyframeRule class];
     }
-    return [[[wrapperClass alloc] _initWithCSSRule:impl] autorelease];
+    ASSERT_NOT_REACHED();
+    return nil;
 }
 
-@end
-
-
 //------------------------------------------------------------------------------------------
 // DOMCSSValue
 
-@implementation DOMCSSValue (WebCoreInternal)
-
-- (WebCore::CSSValue *)_CSSValue
+Class kitClass(WebCore::CSSValue* impl)
 {
-    return reinterpret_cast<WebCore::CSSValue*>(_internal);
-}
-
-- (id)_initWithCSSValue:(WebCore::CSSValue *)impl
-{
-    [super _init];
-    _internal = reinterpret_cast<DOMObjectInternal*>(impl);
-    impl->ref();
-    WebCore::addDOMWrapper(self, impl);
-    return self;
-}
-
-+ (DOMCSSValue *)_wrapCSSValue:(WebCore::CSSValue *)impl
-{
-    if (!impl)
-        return nil;
-
-    id cachedInstance;
-    cachedInstance = WebCore::getDOMWrapper(impl);
-    if (cachedInstance)
-        return [[cachedInstance retain] autorelease];
-
-    Class wrapperClass = nil;
     switch (impl->cssValueType()) {
-        case DOM_CSS_PRIMITIVE_VALUE:
-            wrapperClass = [DOMCSSPrimitiveValue class];
-            break;
-        case DOM_CSS_VALUE_LIST:
-            wrapperClass = [DOMCSSValueList class];
-            break;
-        case DOM_CSS_INHERIT:
-            wrapperClass = [DOMCSSValue class];
-            break;
-        case DOM_CSS_CUSTOM:
-#if ENABLE(SVG)
+        case WebCore::CSSValue::CSS_PRIMITIVE_VALUE:
+            return [DOMCSSPrimitiveValue class];
+        case WebCore::CSSValue::CSS_VALUE_LIST:
+            return [DOMCSSValueList class];
+        case WebCore::CSSValue::CSS_INHERIT:
+        case WebCore::CSSValue::CSS_INITIAL:
+            return [DOMCSSValue class];
+        case WebCore::CSSValue::CSS_CUSTOM:
+#if ENABLE(SVG_DOM_OBJC_BINDINGS)
             if (impl->isSVGPaint())
-                wrapperClass = [DOMSVGPaint class];
-            else if (impl->isSVGColor())
-                wrapperClass = [DOMSVGColor class];
-            else
+                return [DOMSVGPaint class];
+            if (impl->isSVGColor())
+                return [DOMSVGColor class];
 #endif
-                wrapperClass = [DOMCSSValue class];
-            break;
+            return [DOMCSSValue class];
     }
-    return [[[wrapperClass alloc] _initWithCSSValue:impl] autorelease];
+    ASSERT_NOT_REACHED();
+    return nil;
 }
 
-@end
-
-
 //------------------------------------------------------------------------------------------
 // DOMCSSStyleDeclaration CSS2 Properties
 
diff --git a/WebCore/bindings/objc/DOMEvents.mm b/WebCore/bindings/objc/DOMEvents.mm
index 6f7f72d..c901e12 100644
--- a/WebCore/bindings/objc/DOMEvents.mm
+++ b/WebCore/bindings/objc/DOMEvents.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Jonas Witt <jonas.witt@gmail.com>
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
@@ -26,85 +26,46 @@
  */
 
 #import "config.h"
-#import "DOMEvents.h"
+#import "DOMEventInternal.h"
 
-#import "DOMInternal.h"
+#import "DOMKeyboardEvent.h"
 #import "DOMMessageEvent.h"
-#import "DOMPrivate.h"
+#import "DOMMouseEvent.h"
+#import "DOMMutationEvent.h"
+#import "DOMOverflowEvent.h"
 #import "DOMProgressEvent.h"
+#import "DOMTextEvent.h"
+#import "DOMWheelEvent.h"
 #import "Event.h"
-#import "KeyboardEvent.h"
-#import "MessageEvent.h"
-#import "MouseEvent.h"
-#import "MutationEvent.h"
-#import "OverflowEvent.h"
-#import "ProgressEvent.h"
-#import "UIEvent.h"
 
-#if ENABLE(SVG)
+#if ENABLE(SVG_DOM_OBJC_BINDINGS)
 #import "DOMSVGZoomEvent.h"
-#import "SVGZoomEvent.h"
 #endif
 
-//------------------------------------------------------------------------------------------
-// DOMEvent
-
-@implementation DOMEvent (WebCoreInternal)
-
-- (WebCore::Event *)_event
+Class kitClass(WebCore::Event* impl)
 {
-    return reinterpret_cast<WebCore::Event*>(_internal);
-}
-
-- (id)_initWithEvent:(WebCore::Event *)impl
-{
-    ASSERT(impl);
-
-    [super _init];
-    _internal = reinterpret_cast<DOMObjectInternal *>(impl);
-    impl->ref();
-    WebCore::addDOMWrapper(self, impl);
-    return self;
-}
-
-+ (DOMEvent *)_wrapEvent:(WebCore::Event *)impl
-{
-    if (!impl)
-        return nil;
-    
-    id cachedInstance;
-    cachedInstance = WebCore::getDOMWrapper(impl);
-    if (cachedInstance)
-        return [[cachedInstance retain] autorelease];
-
-    Class wrapperClass = nil;
     if (impl->isUIEvent()) {
         if (impl->isKeyboardEvent())
-            wrapperClass = [DOMKeyboardEvent class];
-        else if (impl->isTextEvent())
-            wrapperClass = [DOMTextEvent class];
-        else if (impl->isMouseEvent())
-            wrapperClass = [DOMMouseEvent class];
-        else if (impl->isWheelEvent())
-            wrapperClass = [DOMWheelEvent class];        
-#if ENABLE(SVG)
-        else if (impl->isSVGZoomEvent())
-            wrapperClass = [DOMSVGZoomEvent class];
+            return [DOMKeyboardEvent class];
+        if (impl->isTextEvent())
+            return [DOMTextEvent class];
+        if (impl->isMouseEvent())
+            return [DOMMouseEvent class];
+        if (impl->isWheelEvent())
+            return [DOMWheelEvent class];        
+#if ENABLE(SVG_DOM_OBJC_BINDINGS)
+        if (impl->isSVGZoomEvent())
+            return [DOMSVGZoomEvent class];
 #endif
-        else
-            wrapperClass = [DOMUIEvent class];
-    } else if (impl->isMutationEvent())
-        wrapperClass = [DOMMutationEvent class];
-    else if (impl->isOverflowEvent())
-        wrapperClass = [DOMOverflowEvent class];
-    else if (impl->isMessageEvent())
-        wrapperClass = [DOMMessageEvent class];
-    else if (impl->isProgressEvent())
-        wrapperClass = [DOMProgressEvent class];
-    else
-        wrapperClass = [DOMEvent class];
-
-    return [[[wrapperClass alloc] _initWithEvent:impl] autorelease];
+        return [DOMUIEvent class];
+    }
+    if (impl->isMutationEvent())
+        return [DOMMutationEvent class];
+    if (impl->isOverflowEvent())
+        return [DOMOverflowEvent class];
+    if (impl->isMessageEvent())
+        return [DOMMessageEvent class];
+    if (impl->isProgressEvent())
+        return [DOMProgressEvent class];
+    return [DOMEvent class];
 }
-
-@end
diff --git a/WebCore/bindings/objc/DOMHTML.h b/WebCore/bindings/objc/DOMHTML.h
index cd80612..c336c04 100644
--- a/WebCore/bindings/objc/DOMHTML.h
+++ b/WebCore/bindings/objc/DOMHTML.h
@@ -26,6 +26,8 @@
 
 #import <WebCore/DOMCore.h>
 
+#import <WebCore/DOMFile.h>
+#import <WebCore/DOMFileList.h>
 #import <WebCore/DOMHTMLAnchorElement.h>
 #import <WebCore/DOMHTMLAppletElement.h>
 #import <WebCore/DOMHTMLAreaElement.h>
diff --git a/WebCore/bindings/objc/DOMHTML.mm b/WebCore/bindings/objc/DOMHTML.mm
index baf5774..8c0d30b 100644
--- a/WebCore/bindings/objc/DOMHTML.mm
+++ b/WebCore/bindings/objc/DOMHTML.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -25,20 +25,27 @@
  */
 
 #import "config.h"
-#import "DOMHTML.h"
 
-#import "CSSHelper.h"
+#import "DOMDocumentFragmentInternal.h"
 #import "DOMExtensions.h"
-#import "DOMInternal.h"
+#import "DOMHTMLCollectionInternal.h"
+#import "DOMHTMLDocumentInternal.h"
+#import "DOMHTMLInputElementInternal.h"
+#import "DOMHTMLSelectElementInternal.h"
+#import "DOMHTMLTextAreaElementInternal.h"
+#import "DOMNodeInternal.h"
 #import "DOMPrivate.h"
 #import "DocumentFragment.h"
 #import "FrameView.h"
+#import "HTMLCollection.h"
 #import "HTMLDocument.h"
 #import "HTMLInputElement.h"
-#import "HTMLObjectElement.h"
 #import "HTMLSelectElement.h"
+#import "HTMLTextAreaElement.h"
+#import "Page.h"
 #import "Range.h"
 #import "RenderTextControl.h"
+#import "Settings.h"
 #import "markup.h"
 
 //------------------------------------------------------------------------------------------
@@ -48,13 +55,13 @@
 
 - (DOMDocumentFragment *)createDocumentFragmentWithMarkupString:(NSString *)markupString baseURL:(NSURL *)baseURL
 {
-    return [DOMDocumentFragment _wrapDocumentFragment:createFragmentFromMarkup([self _document], markupString, [baseURL absoluteString]).get()];
+    return kit(createFragmentFromMarkup(core(self), markupString, [baseURL absoluteString]).get());
 }
 
 - (DOMDocumentFragment *)createDocumentFragmentWithText:(NSString *)text
 {
     // FIXME: Since this is not a contextual fragment, it won't handle whitespace properly.
-    return [DOMDocumentFragment _wrapDocumentFragment:createFragmentFromText([self _document]->createRange().get(), text).get()];
+    return kit(createFragmentFromText(core(self)->createRange().get(), text).get());
 }
 
 @end
@@ -63,7 +70,7 @@
 
 - (DOMDocumentFragment *)_createDocumentFragmentWithMarkupString:(NSString *)markupString baseURLString:(NSString *)baseURLString
 {
-    NSURL *baseURL = [self _document]->completeURL(WebCore::parseURL(baseURLString));
+    NSURL *baseURL = core(self)->completeURL(WebCore::parseURL(baseURLString));
     return [self createDocumentFragmentWithMarkupString:markupString baseURL:baseURL];
 }
 
@@ -74,49 +81,40 @@
 
 @end
 
-#pragma mark DOM EXTENSIONS
+#ifdef BUILDING_ON_TIGER
+@implementation DOMHTMLDocument (DOMHTMLDocumentOverrides)
 
-@implementation DOMHTMLInputElement(FormAutoFillTransition)
+- (DOMNode *)firstChild
+{
+    WebCore::HTMLDocument* coreHTMLDocument = core(self);
+    if (!coreHTMLDocument->page() || !coreHTMLDocument->page()->settings()->needsTigerMailQuirks())
+        return kit(coreHTMLDocument->firstChild());
+
+    WebCore::Node* child = coreHTMLDocument->firstChild();
+    while (child && child->nodeType() == WebCore::Node::DOCUMENT_TYPE_NODE)
+        child = child->nextSibling();
+    
+    return kit(child);
+}
+
+@end
+#endif
+
+@implementation DOMHTMLInputElement (FormAutoFillTransition)
 
 - (BOOL)_isTextField
 {
-    // We could make this public API as-is, or we could change it into a method that returns whether
-    // the element is a text field or a button or ... ?
-    static NSArray *textInputTypes = nil;
-#ifndef NDEBUG
-    static NSArray *nonTextInputTypes = nil;
-#endif
-    
-    NSString *fieldType = [self type];
-    
-    // No type at all is treated as text type
-    if ([fieldType length] == 0)
-        return YES;
-    
-    if (textInputTypes == nil)
-        textInputTypes = [[NSSet alloc] initWithObjects:@"text", @"password", @"search", @"isindex", nil];
-    
-    BOOL isText = [textInputTypes containsObject:[fieldType lowercaseString]];
-    
-#ifndef NDEBUG
-    if (nonTextInputTypes == nil)
-        nonTextInputTypes = [[NSSet alloc] initWithObjects:@"checkbox", @"radio", @"submit", @"reset", @"file", @"hidden", @"image", @"button", @"range", nil];
-    
-    // Catch cases where a new input type has been added that's not in these lists.
-    ASSERT(isText || [nonTextInputTypes containsObject:[fieldType lowercaseString]]);
-#endif    
-    
-    return isText;
+    return core(self)->isTextField();
 }
 
 - (NSRect)_rectOnScreen
 {
     // Returns bounding rect of text field, in screen coordinates.
     NSRect result = [self boundingBox];
-    if (![self _HTMLInputElement]->document()->view())
+    if (!core(self)->document()->view())
         return result;
 
-    NSView* view = [self _HTMLInputElement]->document()->view()->documentView();
+    NSView* view = core(self)->document()->view()->documentView();
     result = [view convertRect:result toView:nil];
     result.origin = [[view window] convertBaseToScreen:result.origin];
     return result;
@@ -124,7 +122,7 @@
 
 - (void)_replaceCharactersInRange:(NSRange)targetRange withString:(NSString *)replacementString selectingFromIndex:(int)index
 {
-    WebCore::HTMLInputElement* inputElement = [self _HTMLInputElement];
+    WebCore::HTMLInputElement* inputElement = core(self);
     if (inputElement) {
         WebCore::String newValue = inputElement->value();
         newValue.replace(targetRange.location, targetRange.length, replacementString);
@@ -135,7 +133,7 @@
 
 - (NSRange)_selectedRange
 {
-    WebCore::HTMLInputElement* inputElement = [self _HTMLInputElement];
+    WebCore::HTMLInputElement* inputElement = core(self);
     if (inputElement) {
         int start = inputElement->selectionStart();
         int end = inputElement->selectionEnd();
@@ -149,9 +147,7 @@
     // This notifies the input element that the content has been autofilled
     // This allows WebKit to obey the -webkit-autofill pseudo style, which
     // changes the background color.
-    WebCore::HTMLInputElement* inputElement = [self _HTMLInputElement];
-    if (inputElement)
-        inputElement->setAutofilled(filled);
+    core(self)->setAutofilled(filled);
 }
 
 @end
@@ -160,30 +156,35 @@
 
 - (void)_activateItemAtIndex:(int)index
 {
-    if (WebCore::HTMLSelectElement* select = [self _HTMLSelectElement])
+    if (WebCore::HTMLSelectElement* select = core(self))
         select->setSelectedIndex(index);
 }
 
 @end
 
 @implementation DOMHTMLInputElement (FormPromptAdditions)
+
 - (BOOL)_isEdited
 {
-    WebCore::RenderObject *renderer = [self _node]->renderer();
-    if (renderer && [self _isTextField])
-        return static_cast<WebCore::RenderTextControl *>(renderer)->isUserEdited();
-    
-    return NO;
+    WebCore::RenderObject *renderer = core(self)->renderer();
+    return renderer && [self _isTextField] && static_cast<WebCore::RenderTextControl *>(renderer)->isUserEdited();
 }
+
 @end
 
 @implementation DOMHTMLTextAreaElement (FormPromptAdditions)
+
 - (BOOL)_isEdited
 {
-    WebCore::RenderObject *renderer = [self _node]->renderer();
-    if (renderer)
-        return static_cast<WebCore::RenderTextControl *>(renderer)->isUserEdited();
-    
-    return NO;
+    WebCore::RenderObject* renderer = core(self)->renderer();
+    return renderer && static_cast<WebCore::RenderTextControl*>(renderer)->isUserEdited();
 }
+
 @end
+
+Class kitClass(WebCore::HTMLCollection* collection)
+{
+    if (collection->type() == WebCore::SelectOptions)
+        return [DOMHTMLOptionsCollection class];
+    return [DOMHTMLCollection class];
+}
diff --git a/WebCore/bindings/objc/DOMInternal.h b/WebCore/bindings/objc/DOMInternal.h
index 9ddcada..48f5d2f 100644
--- a/WebCore/bindings/objc/DOMInternal.h
+++ b/WebCore/bindings/objc/DOMInternal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 James G. Speth (speth@end.com)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
  *
@@ -25,272 +25,18 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#import "DOM.h"
-
+// This is lets our internals access DOMObject's _internal field while having
+// it be private for clients outside WebKit.
+#define private public
 #import "DOMObject.h"
-#import "HitTestResult.h"
+#undef private
 
-#if ENABLE(XPATH)
-#import "DOMXPathExpressionInternal.h"
+#import "DOMNodeFilter.h"
 #import "DOMXPathNSResolver.h"
-#import "DOMXPathResultInternal.h"
-#endif // ENABLE(XPATH)
-
-// Auto-generated internal interfaces
-#import "DOMAbstractViewInternal.h"
-#import "DOMAttrInternal.h"
-#import "DOMCDATASectionInternal.h"
-#import "DOMCSSCharsetRuleInternal.h"
-#import "DOMCSSFontFaceRuleInternal.h"
-#import "DOMCSSImportRuleInternal.h"
-#import "DOMCSSMediaRuleInternal.h"
-#import "DOMCSSPageRuleInternal.h"
-#import "DOMCSSPrimitiveValueInternal.h"
-#import "DOMCSSRuleInternal.h"
-#import "DOMCSSRuleListInternal.h"
-#import "DOMCSSStyleDeclarationInternal.h"
-#import "DOMCSSStyleRuleInternal.h"
-#import "DOMCSSStyleSheetInternal.h"
-#import "DOMCSSUnknownRuleInternal.h"
-#import "DOMCSSValueInternal.h"
-#import "DOMCSSValueListInternal.h"
-#import "DOMCSSVariablesRuleInternal.h"
-#import "DOMCSSVariablesDeclarationInternal.h"
-#import "DOMCharacterDataInternal.h"
-#import "DOMCommentInternal.h"
-#import "DOMCounterInternal.h"
-#import "DOMDOMImplementationInternal.h"
-#import "DOMDocumentFragmentInternal.h"
-#import "DOMDocumentInternal.h"
-#import "DOMDocumentTypeInternal.h"
-#import "DOMElementInternal.h"
-#import "DOMEntityInternal.h"
-#import "DOMEntityReferenceInternal.h"
-#import "DOMEventInternal.h"
-#import "DOMFileInternal.h"
-#import "DOMFileListInternal.h"
-#import "DOMHTMLAnchorElementInternal.h"
-#import "DOMHTMLAppletElementInternal.h"
-#import "DOMHTMLAreaElementInternal.h"
-#import "DOMHTMLBRElementInternal.h"
-#import "DOMHTMLBaseElementInternal.h"
-#import "DOMHTMLBaseFontElementInternal.h"
-#import "DOMHTMLBodyElementInternal.h"
-#import "DOMHTMLButtonElementInternal.h"
-#import "DOMHTMLCollectionInternal.h"
-#import "DOMHTMLDListElementInternal.h"
-#import "DOMHTMLDirectoryElementInternal.h"
-#import "DOMHTMLDivElementInternal.h"
-#import "DOMHTMLDocumentInternal.h"
-#import "DOMHTMLElementInternal.h"
-#import "DOMHTMLEmbedElementInternal.h"
-#import "DOMHTMLFieldSetElementInternal.h"
-#import "DOMHTMLFontElementInternal.h"
-#import "DOMHTMLFormElementInternal.h"
-#import "DOMHTMLFrameElementInternal.h"
-#import "DOMHTMLFrameSetElementInternal.h"
-#import "DOMHTMLHRElementInternal.h"
-#import "DOMHTMLHeadElementInternal.h"
-#import "DOMHTMLHeadingElementInternal.h"
-#import "DOMHTMLHtmlElementInternal.h"
-#import "DOMHTMLIFrameElementInternal.h"
-#import "DOMHTMLImageElementInternal.h"
-#import "DOMHTMLInputElementInternal.h"
-#import "DOMHTMLIsIndexElementInternal.h"
-#import "DOMHTMLLIElementInternal.h"
-#import "DOMHTMLLabelElementInternal.h"
-#import "DOMHTMLLegendElementInternal.h"
-#import "DOMHTMLLinkElementInternal.h"
-#import "DOMHTMLMapElementInternal.h"
-#import "DOMHTMLMarqueeElementInternal.h"
-#import "DOMHTMLMenuElementInternal.h"
-#import "DOMHTMLMetaElementInternal.h"
-#import "DOMHTMLModElementInternal.h"
-#import "DOMHTMLOListElementInternal.h"
-#import "DOMHTMLObjectElementInternal.h"
-#import "DOMHTMLOptGroupElementInternal.h"
-#import "DOMHTMLOptionElementInternal.h"
-#import "DOMHTMLOptionsCollectionInternal.h"
-#import "DOMHTMLParagraphElementInternal.h"
-#import "DOMHTMLParamElementInternal.h"
-#import "DOMHTMLPreElementInternal.h"
-#import "DOMHTMLQuoteElementInternal.h"
-#import "DOMHTMLScriptElementInternal.h"
-#import "DOMHTMLSelectElementInternal.h"
-#import "DOMHTMLStyleElementInternal.h"
-#import "DOMHTMLTableCaptionElementInternal.h"
-#import "DOMHTMLTableCellElementInternal.h"
-#import "DOMHTMLTableColElementInternal.h"
-#import "DOMHTMLTableElementInternal.h"
-#import "DOMHTMLTableRowElementInternal.h"
-#import "DOMHTMLTableSectionElementInternal.h"
-#import "DOMHTMLTextAreaElementInternal.h"
-#import "DOMHTMLTitleElementInternal.h"
-#import "DOMHTMLUListElementInternal.h"
-#import "DOMKeyboardEventInternal.h"
-#import "DOMMediaListInternal.h"
-#import "DOMMessagePortInternal.h"
-#import "DOMMouseEventInternal.h"
-#import "DOMMutationEventInternal.h"
-#import "DOMNamedNodeMapInternal.h"
-#import "DOMNodeInternal.h"
-#import "DOMNodeIteratorInternal.h"
-#import "DOMNodeListInternal.h"
-#import "DOMNotationInternal.h"
-#import "DOMOverflowEventInternal.h"
-#import "DOMProcessingInstructionInternal.h"
-#import "DOMRGBColorInternal.h"
-#import "DOMRangeInternal.h"
-#import "DOMRectInternal.h"
-#import "DOMStyleSheetInternal.h"
-#import "DOMStyleSheetListInternal.h"
-#import "DOMTextEventInternal.h"
-#import "DOMTextInternal.h"
-#import "DOMTreeWalkerInternal.h"
-#import "DOMUIEventInternal.h"
-#import "DOMWebKitCSSKeyframeRuleInternal.h"
-#import "DOMWebKitCSSKeyframesRuleInternal.h"
-#import "DOMWebKitCSSMatrixInternal.h"
-#import "DOMWebKitCSSTransformValueInternal.h"
-#import "DOMWheelEventInternal.h"
-
-#if ENABLE(SVG)
-#import "DOMSVGAElementInternal.h"
-#import "DOMSVGAltGlyphElementInternal.h"
-#import "DOMSVGAngleInternal.h"
-#import "DOMSVGAnimateColorElementInternal.h"
-#import "DOMSVGAnimateElementInternal.h"
-#import "DOMSVGAnimateTransformElementInternal.h"
-#import "DOMSVGAnimatedAngleInternal.h"
-#import "DOMSVGAnimatedBooleanInternal.h"
-#import "DOMSVGAnimatedEnumerationInternal.h"
-#import "DOMSVGAnimatedIntegerInternal.h"
-#import "DOMSVGAnimatedLengthInternal.h"
-#import "DOMSVGAnimatedLengthListInternal.h"
-#import "DOMSVGAnimatedNumberInternal.h"
-#import "DOMSVGAnimatedNumberListInternal.h"
-#import "DOMSVGAnimatedPreserveAspectRatioInternal.h"
-#import "DOMSVGAnimatedRectInternal.h"
-#import "DOMSVGAnimatedStringInternal.h"
-#import "DOMSVGAnimatedTransformListInternal.h"
-#import "DOMSVGAnimationElementInternal.h"
-#import "DOMSVGCircleElementInternal.h"
-#import "DOMSVGClipPathElementInternal.h"
-#import "DOMSVGColorInternal.h"
-#import "DOMSVGComponentTransferFunctionElementInternal.h"
-#import "DOMSVGCursorElementInternal.h"
-#import "DOMSVGDefsElementInternal.h"
-#import "DOMSVGDefinitionSrcElementInternal.h"
-#import "DOMSVGDescElementInternal.h"
-#import "DOMSVGDocumentInternal.h"
-#import "DOMSVGElementInternal.h"
-#import "DOMSVGElementInstanceInternal.h"
-#import "DOMSVGElementInstanceListInternal.h"
-#import "DOMSVGEllipseElementInternal.h"
-#import "DOMSVGFEBlendElementInternal.h"
-#import "DOMSVGFEColorMatrixElementInternal.h"
-#import "DOMSVGFEComponentTransferElementInternal.h"
-#import "DOMSVGFECompositeElementInternal.h"
-#import "DOMSVGFEDiffuseLightingElementInternal.h"
-#import "DOMSVGFEDisplacementMapElementInternal.h"
-#import "DOMSVGFEDistantLightElementInternal.h"
-#import "DOMSVGFEFloodElementInternal.h"
-#import "DOMSVGFEFuncAElementInternal.h"
-#import "DOMSVGFEFuncBElementInternal.h"
-#import "DOMSVGFEFuncGElementInternal.h"
-#import "DOMSVGFEFuncRElementInternal.h"
-#import "DOMSVGFEGaussianBlurElementInternal.h"
-#import "DOMSVGFEImageElementInternal.h"
-#import "DOMSVGFEMergeElementInternal.h"
-#import "DOMSVGFEMergeNodeElementInternal.h"
-#import "DOMSVGFEOffsetElementInternal.h"
-#import "DOMSVGFEPointLightElementInternal.h"
-#import "DOMSVGFESpecularLightingElementInternal.h"
-#import "DOMSVGFESpotLightElementInternal.h"
-#import "DOMSVGFETileElementInternal.h"
-#import "DOMSVGFETurbulenceElementInternal.h"
-#import "DOMSVGFilterElementInternal.h"
-#import "DOMSVGFontElementInternal.h"
-#import "DOMSVGFontFaceElementInternal.h"
-#import "DOMSVGFontFaceFormatElementInternal.h"
-#import "DOMSVGFontFaceNameElementInternal.h"
-#import "DOMSVGFontFaceSrcElementInternal.h"
-#import "DOMSVGFontFaceUriElementInternal.h"
-#import "DOMSVGForeignObjectElementInternal.h"
-#import "DOMSVGGElementInternal.h"
-#import "DOMSVGGlyphElementInternal.h"
-#import "DOMSVGGradientElementInternal.h"
-#import "DOMSVGImageElementInternal.h"
-#import "DOMSVGLengthInternal.h"
-#import "DOMSVGLengthListInternal.h"
-#import "DOMSVGLineElementInternal.h"
-#import "DOMSVGLinearGradientElementInternal.h"
-#import "DOMSVGMarkerElementInternal.h"
-#import "DOMSVGMaskElementInternal.h"
-#import "DOMSVGMatrixInternal.h"
-#import "DOMSVGMetadataElementInternal.h"
-#import "DOMSVGMissingGlyphElementInternal.h"
-#import "DOMSVGNumberInternal.h"
-#import "DOMSVGNumberListInternal.h"
-#import "DOMSVGPaintInternal.h"
-#import "DOMSVGPathElementInternal.h"
-#import "DOMSVGPathSegArcAbsInternal.h"
-#import "DOMSVGPathSegArcRelInternal.h"
-#import "DOMSVGPathSegClosePathInternal.h"
-#import "DOMSVGPathSegCurvetoCubicAbsInternal.h"
-#import "DOMSVGPathSegCurvetoCubicRelInternal.h"
-#import "DOMSVGPathSegCurvetoCubicSmoothAbsInternal.h"
-#import "DOMSVGPathSegCurvetoCubicSmoothRelInternal.h"
-#import "DOMSVGPathSegCurvetoQuadraticAbsInternal.h"
-#import "DOMSVGPathSegCurvetoQuadraticRelInternal.h"
-#import "DOMSVGPathSegCurvetoQuadraticSmoothAbsInternal.h"
-#import "DOMSVGPathSegCurvetoQuadraticSmoothRelInternal.h"
-#import "DOMSVGPathSegInternal.h"
-#import "DOMSVGPathSegLinetoAbsInternal.h"
-#import "DOMSVGPathSegLinetoHorizontalAbsInternal.h"
-#import "DOMSVGPathSegLinetoHorizontalRelInternal.h"
-#import "DOMSVGPathSegLinetoRelInternal.h"
-#import "DOMSVGPathSegLinetoVerticalAbsInternal.h"
-#import "DOMSVGPathSegLinetoVerticalRelInternal.h"
-#import "DOMSVGPathSegListInternal.h"
-#import "DOMSVGPathSegMovetoAbsInternal.h"
-#import "DOMSVGPathSegMovetoRelInternal.h"
-#import "DOMSVGPatternElementInternal.h"
-#import "DOMSVGPointInternal.h"
-#import "DOMSVGPointListInternal.h"
-#import "DOMSVGPolygonElementInternal.h"
-#import "DOMSVGPolylineElementInternal.h"
-#import "DOMSVGPreserveAspectRatioInternal.h"
-#import "DOMSVGRadialGradientElementInternal.h"
-#import "DOMSVGRectElementInternal.h"
-#import "DOMSVGRectInternal.h"
-#import "DOMSVGRenderingIntentInternal.h"
-#import "DOMSVGSVGElementInternal.h"
-#import "DOMSVGScriptElementInternal.h"
-#import "DOMSVGSetElementInternal.h"
-#import "DOMSVGStopElementInternal.h"
-#import "DOMSVGStringListInternal.h"
-#import "DOMSVGStyleElementInternal.h"
-#import "DOMSVGSwitchElementInternal.h"
-#import "DOMSVGSymbolElementInternal.h"
-#import "DOMSVGTRefElementInternal.h"
-#import "DOMSVGTSpanElementInternal.h"
-#import "DOMSVGTextContentElementInternal.h"
-#import "DOMSVGTextElementInternal.h"
-#import "DOMSVGTextPathElementInternal.h"
-#import "DOMSVGTextPositioningElementInternal.h"
-#import "DOMSVGTitleElementInternal.h"
-#import "DOMSVGTransformInternal.h"
-#import "DOMSVGTransformListInternal.h"
-#import "DOMSVGUnitTypesInternal.h"
-#import "DOMSVGUseElementInternal.h"
-#import "DOMSVGViewElementInternal.h"
-#import "DOMSVGZoomEventInternal.h"
-#endif // ENABLE(SVG)
+#import <wtf/Forward.h>
 
 namespace JSC {
     class JSObject;
-    
     namespace Bindings {
         class RootObject;
     }
@@ -298,65 +44,47 @@
 
 namespace WebCore {
     class NodeFilter;
-
-#if ENABLE(SVG)
-    class TransformationMatrix;
-    class FloatPoint;
-    class FloatRect;
-#endif // ENABLE(SVG)
-
 #if ENABLE(XPATH)
     class XPathNSResolver;
-#endif // ENABLE(XPATH)
+#endif
 }
 
-// Core Internal Interfaces
-
-@interface DOMObject (WebCoreInternal)
-- (id)_init;
-@end
-
-// Traversal Internal Interfaces
-
 @interface DOMNodeFilter : DOMObject <DOMNodeFilter>
-+ (DOMNodeFilter *)_wrapNodeFilter:(WebCore::NodeFilter *)impl;
 @end
 
 #if ENABLE(XPATH)
-
-// XPath Internal Interfaces
-
 @interface DOMNativeXPathNSResolver : DOMObject <DOMXPathNSResolver>
-+ (DOMNativeXPathNSResolver *)_wrapXPathNSResolver:(WebCore::XPathNSResolver *)impl;
-- (WebCore::XPathNSResolver *)_xpathNSResolver;
 @end
-
 #endif // ENABLE(XPATH)
 
 // Helper functions for DOM wrappers and gluing to Objective-C
 
-namespace WebCore {
+// Create an NSMapTable mapping from pointers to ObjC objects held with zeroing weak references.
+NSMapTable* createWrapperCache();
+NSMapTable* createWrapperCacheWithIntegerKeys(); // Same, but from integers to ObjC objects.
 
-    // Create an NSMapTable mapping from pointers to ObjC objects held with zeroing weak references.
-    NSMapTable* createWrapperCache();
-    NSMapTable* createWrapperCacheWithIntegerKeys(); // Same, but from integers to ObjC objects.
+id createDOMWrapper(JSC::JSObject*, PassRefPtr<JSC::Bindings::RootObject> origin, PassRefPtr<JSC::Bindings::RootObject> current);
 
-    id createDOMWrapper(JSC::JSObject*, PassRefPtr<JSC::Bindings::RootObject> origin, PassRefPtr<JSC::Bindings::RootObject> current);
+NSObject* getDOMWrapper(DOMObjectInternal*);
+void addDOMWrapper(NSObject* wrapper, DOMObjectInternal*);
+void removeDOMWrapper(DOMObjectInternal*);
 
-    NSObject* getDOMWrapper(DOMObjectInternal*);
-    void addDOMWrapper(NSObject* wrapper, DOMObjectInternal*);
-    void removeDOMWrapper(DOMObjectInternal*);
+template <class Source>
+inline id getDOMWrapper(Source impl)
+{
+    return getDOMWrapper(reinterpret_cast<DOMObjectInternal*>(impl));
+}
 
-    template <class Source>
-    inline id getDOMWrapper(Source impl)
-    {
-        return getDOMWrapper(reinterpret_cast<DOMObjectInternal*>(impl));
-    }
+template <class Source>
+inline void addDOMWrapper(NSObject* wrapper, Source impl)
+{
+    addDOMWrapper(wrapper, reinterpret_cast<DOMObjectInternal*>(impl));
+}
 
-    template <class Source>
-    inline void addDOMWrapper(NSObject* wrapper, Source impl)
-    {
-        addDOMWrapper(wrapper, reinterpret_cast<DOMObjectInternal*>(impl));
-    }
+DOMNodeFilter *kit(WebCore::NodeFilter*);
+WebCore::NodeFilter* core(DOMNodeFilter *);
 
-} // namespace WebCore
+#if ENABLE(XPATH)
+DOMNativeXPathNSResolver *kit(WebCore::XPathNSResolver*);
+WebCore::XPathNSResolver* core(DOMNativeXPathNSResolver *);
+#endif // ENABLE(XPATH)
diff --git a/WebCore/bindings/objc/DOMInternal.mm b/WebCore/bindings/objc/DOMInternal.mm
index ea26d5e..eb98a8a 100644
--- a/WebCore/bindings/objc/DOMInternal.mm
+++ b/WebCore/bindings/objc/DOMInternal.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,25 +26,15 @@
 #import "config.h"
 #import "DOMInternal.h"
 
-#import "Document.h"
-#import "Event.h"
+#import "DOMNodeInternal.h"
 #import "Frame.h"
 #import "JSNode.h"
-#import "Node.h"
-#import "PlatformString.h"
-#import "Range.h"
-#import "RangeException.h"
-#import "SVGException.h"
 #import "WebScriptObjectPrivate.h"
-#import "XPathEvaluator.h"
-#import "ScriptController.h"
 #import "runtime_root.h"
 
 //------------------------------------------------------------------------------------------
 // Wrapping WebCore implementation objects
 
-namespace WebCore {
-
 static NSMapTable* DOMWrapperCache;
 
 NSMapTable* createWrapperCache()
@@ -92,8 +82,6 @@
     NSMapRemove(DOMWrapperCache, impl);
 }
 
-} // namespace WebCore
-
 //------------------------------------------------------------------------------------------
 
 @implementation WebScriptObject (WebScriptObjectInternal)
@@ -127,7 +115,7 @@
     
     // Extract the WebCore::Node from the ObjectiveC wrapper.
     DOMNode *n = (DOMNode *)self;
-    WebCore::Node *nodeImpl = [n _node];
+    WebCore::Node *nodeImpl = core(n);
 
     // Dig up Interpreter and ExecState.
     WebCore::Frame *frame = 0;
diff --git a/WebCore/bindings/objc/DOMObject.h b/WebCore/bindings/objc/DOMObject.h
index 166637d..c4a3f6f 100644
--- a/WebCore/bindings/objc/DOMObject.h
+++ b/WebCore/bindings/objc/DOMObject.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -37,6 +37,7 @@
 
 @interface DOMObject : WebScriptObject <NSCopying>
 {
+@private
     DOMObjectInternal *_internal;
 }
 @end
diff --git a/WebCore/bindings/objc/DOMObject.mm b/WebCore/bindings/objc/DOMObject.mm
index 8510ae9..d88e86b 100644
--- a/WebCore/bindings/objc/DOMObject.mm
+++ b/WebCore/bindings/objc/DOMObject.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2006, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 James G. Speth <speth@end.com>
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
@@ -28,11 +28,11 @@
 #import "config.h"
 #import "DOMObject.h"
 
-#import "DOMHTMLLinkElement.h"
-#import "DOMHTMLStyleElement.h"
+#import "DOMHTMLLinkElementInternal.h"
+#import "DOMHTMLStyleElementInternal.h"
 #import "DOMInternal.h"
-#import "DOMProcessingInstruction.h"
-#import "DOMStyleSheet.h"
+#import "DOMProcessingInstructionInternal.h"
+#import "DOMStyleSheetInternal.h"
 #import "HTMLLinkElement.h"
 #import "HTMLStyleElement.h"
 #import "ProcessingInstruction.h"
@@ -53,7 +53,7 @@
 - (void)dealloc
 {
     if (_internal)
-        WebCore::removeDOMWrapper(_internal);
+        removeDOMWrapper(_internal);
     [super dealloc];
 }
 
@@ -69,27 +69,18 @@
 
 - (DOMStyleSheet *)sheet
 {
-    WebCore::StyleSheet *styleSheet;
+    WebCore::StyleSheet* styleSheet;
 
     if ([self isKindOfClass:[DOMProcessingInstruction class]])
-        styleSheet = static_cast<WebCore::ProcessingInstruction*>([(DOMProcessingInstruction *)self _node])->sheet();
+        styleSheet = core(static_cast<DOMProcessingInstruction *>(self))->sheet();
     else if ([self isKindOfClass:[DOMHTMLLinkElement class]])
-        styleSheet = static_cast<WebCore::HTMLLinkElement*>([(DOMHTMLLinkElement *)self _node])->sheet();
+        styleSheet = core(static_cast<DOMHTMLLinkElement *>(self))->sheet();
     else if ([self isKindOfClass:[DOMHTMLStyleElement class]])
-        styleSheet = static_cast<WebCore::HTMLStyleElement*>([(DOMHTMLStyleElement *)self _node])->sheet();
+        styleSheet = core(static_cast<DOMHTMLStyleElement *>(self))->sheet();
     else
         return nil;
 
-    return [DOMStyleSheet _wrapStyleSheet:styleSheet];
-}
-
-@end
-
-@implementation DOMObject (WebCoreInternal)
-
-- (id)_init
-{
-    return [super _init];
+    return kit(styleSheet);
 }
 
 @end
diff --git a/WebCore/bindings/objc/DOMPrivate.h b/WebCore/bindings/objc/DOMPrivate.h
index ba95ce3..4291cbc 100644
--- a/WebCore/bindings/objc/DOMPrivate.h
+++ b/WebCore/bindings/objc/DOMPrivate.h
@@ -24,45 +24,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#import <WebCore/DOMCSS.h>
-#import <WebCore/DOMCSSStyleDeclaration.h>
-#import <WebCore/DOMElement.h>
-#import <WebCore/DOMEvents.h>
-#import <WebCore/DOMHTML.h>
-#import <WebCore/DOMHTMLDocument.h>
-#import <WebCore/DOMHTMLInputElement.h>
-#import <WebCore/DOMHTMLSelectElement.h>
-#import <WebCore/DOMNode.h>
-#import <WebCore/DOMRGBColor.h>
-#import <WebCore/DOMRange.h>
-
-#import <WebCore/DOMDocumentPrivate.h>
-#import <WebCore/DOMElementPrivate.h>
-#import <WebCore/DOMHTMLAnchorElementPrivate.h>
-#import <WebCore/DOMHTMLAreaElementPrivate.h>
-#import <WebCore/DOMHTMLBodyElementPrivate.h>
-#import <WebCore/DOMHTMLButtonElementPrivate.h>
-#import <WebCore/DOMHTMLDocumentPrivate.h>
-#import <WebCore/DOMHTMLFormElementPrivate.h>
-#import <WebCore/DOMHTMLFrameElementPrivate.h>
-#import <WebCore/DOMHTMLImageElementPrivate.h>
-#import <WebCore/DOMHTMLInputElementPrivate.h>
-#import <WebCore/DOMHTMLLinkElementPrivate.h>
-#import <WebCore/DOMHTMLOptionsCollectionPrivate.h>
-#import <WebCore/DOMHTMLPreElementPrivate.h>
-#import <WebCore/DOMHTMLStyleElementPrivate.h>
-#import <WebCore/DOMHTMLTextAreaElementPrivate.h>
-#import <WebCore/DOMKeyboardEventPrivate.h>
-#import <WebCore/DOMMouseEventPrivate.h>
-#import <WebCore/DOMNodeIteratorPrivate.h>
-#import <WebCore/DOMNodePrivate.h>
-#import <WebCore/DOMProcessingInstructionPrivate.h>
-#import <WebCore/DOMRangePrivate.h>
-#import <WebCore/DOMUIEventPrivate.h>
-#import <WebCore/DOMWheelEventPrivate.h>
+#import <WebCore/DOM.h>
 
 @interface DOMNode (DOMNodeExtensionsPendingPublic)
 - (NSImage *)renderedImage;
+- (NSArray *)textRects;
 @end
 
 // FIXME: this should be removed as soon as all internal Apple uses of it have been replaced with
@@ -79,7 +45,8 @@
 
 @interface DOMRange (DOMRangeExtensions)
 - (NSRect)boundingBox;
-- (NSArray *)lineBoxRects;
+- (NSArray *)lineBoxRects; // Deprecated. Use textRects instead.
+- (NSArray *)textRects;
 @end
 
 @interface DOMElement (WebPrivate)
diff --git a/WebCore/bindings/objc/DOMRGBColor.mm b/WebCore/bindings/objc/DOMRGBColor.mm
index 5921b8e..27f8966 100644
--- a/WebCore/bindings/objc/DOMRGBColor.mm
+++ b/WebCore/bindings/objc/DOMRGBColor.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -25,18 +25,15 @@
  */
 
 #import "config.h"
-#import "DOMRGBColor.h"
+#import "DOMInternal.h" // import first to make the private/public trick work
+#import "DOMRGBColorInternal.h"
 
 #import "CSSPrimitiveValue.h"
-#import "Color.h"
 #import "ColorMac.h"
-#import "DOMCSSPrimitiveValue.h"
-#import "DOMInternal.h"
+#import "DOMCSSPrimitiveValueInternal.h"
 #import "WebCoreObjCExtras.h"
+#import "WebScriptObjectPrivate.h"
 #import <runtime/InitializeThreading.h>
-#import <wtf/GetPtr.h>
-
-namespace WebCore {
 
 static NSMapTable* RGBColorWrapperCache;
 
@@ -63,9 +60,6 @@
     NSMapRemove(RGBColorWrapperCache, reinterpret_cast<const void*>(value));
 }
 
-} // namespace WebCore
-
-
 @implementation DOMRGBColor
 
 + (void)initialize
@@ -81,7 +75,7 @@
     if (WebCoreObjCScheduleDeallocateOnMainThread([DOMRGBColor class], self))
         return;
     
-    WebCore::removeWrapperForRGB(reinterpret_cast<uintptr_t>(_internal));
+    removeWrapperForRGB(reinterpret_cast<uintptr_t>(_internal));
     _internal = 0;
     [super dealloc];
 }
@@ -90,28 +84,28 @@
 {
     WebCore::RGBA32 rgb = reinterpret_cast<uintptr_t>(_internal);
     int value = (rgb >> 16) & 0xFF;
-    return [DOMCSSPrimitiveValue _wrapCSSPrimitiveValue:WebCore::CSSPrimitiveValue::create(value, WebCore::CSSPrimitiveValue::CSS_NUMBER).get()];
+    return kit(WebCore::CSSPrimitiveValue::create(value, WebCore::CSSPrimitiveValue::CSS_NUMBER).get());
 }
 
 - (DOMCSSPrimitiveValue *)green
 {
     WebCore::RGBA32 rgb = reinterpret_cast<uintptr_t>(_internal);
     int value = (rgb >> 8) & 0xFF;
-    return [DOMCSSPrimitiveValue _wrapCSSPrimitiveValue:WebCore::CSSPrimitiveValue::create(value, WebCore::CSSPrimitiveValue::CSS_NUMBER).get()];
+    return kit(WebCore::CSSPrimitiveValue::create(value, WebCore::CSSPrimitiveValue::CSS_NUMBER).get());
 }
 
 - (DOMCSSPrimitiveValue *)blue
 {
     WebCore::RGBA32 rgb = reinterpret_cast<uintptr_t>(_internal);
     int value = rgb & 0xFF;
-    return [DOMCSSPrimitiveValue _wrapCSSPrimitiveValue:WebCore::CSSPrimitiveValue::create(value, WebCore::CSSPrimitiveValue::CSS_NUMBER).get()];
+    return kit(WebCore::CSSPrimitiveValue::create(value, WebCore::CSSPrimitiveValue::CSS_NUMBER).get());
 }
 
 - (DOMCSSPrimitiveValue *)alpha
 {
     WebCore::RGBA32 rgb = reinterpret_cast<uintptr_t>(_internal);
     float value = static_cast<float>(WebCore::Color(rgb).alpha()) / 0xFF;
-    return [DOMCSSPrimitiveValue _wrapCSSPrimitiveValue:WebCore::CSSPrimitiveValue::create(value, WebCore::CSSPrimitiveValue::CSS_NUMBER).get()];
+    return kit(WebCore::CSSPrimitiveValue::create(value, WebCore::CSSPrimitiveValue::CSS_NUMBER).get());
     
 }
 
@@ -134,28 +128,18 @@
 
 @end
 
-@implementation DOMRGBColor (WebCoreInternal)
-
-- (WebCore::RGBA32)_RGBColor
+WebCore::RGBA32 core(DOMRGBColor *color)
 {
-     return static_cast<WebCore::RGBA32>(reinterpret_cast<uintptr_t>(_internal));
+     return color ? static_cast<WebCore::RGBA32>(reinterpret_cast<uintptr_t>(color->_internal)) : 0;
 }
 
-- (id)_initWithRGB:(WebCore::RGBA32)value
+DOMRGBColor *kit(WebCore::RGBA32 value)
 {
-    [super _init];
-    _internal = reinterpret_cast<DOMObjectInternal*>(value);
-    WebCore::setWrapperForRGB(self, value);
-    return self;
-}
+    if (DOMRGBColor *wrapper = getWrapperForRGB(value))
+        return [[wrapper retain] autorelease];
 
-+ (DOMRGBColor *)_wrapRGBColor:(WebCore::RGBA32)value
-{
-    id cachedInstance;
-    cachedInstance = WebCore::getWrapperForRGB(value);
-    if (cachedInstance)
-        return [[cachedInstance retain] autorelease];
-    return [[[self alloc] _initWithRGB:value] autorelease];
+    DOMRGBColor *wrapper = [[DOMRGBColor alloc] _init];
+    wrapper->_internal = reinterpret_cast<DOMObjectInternal*>(value);
+    setWrapperForRGB(wrapper, value);
+    return [wrapper autorelease];
 }
-
-@end
diff --git a/WebCore/bindings/objc/DOMSVGPathSegInternal.mm b/WebCore/bindings/objc/DOMSVGPathSegInternal.mm
index cbbe6bd..1710f88 100644
--- a/WebCore/bindings/objc/DOMSVGPathSegInternal.mm
+++ b/WebCore/bindings/objc/DOMSVGPathSegInternal.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,8 +30,6 @@
 
 #import "DOMSVGPathSegInternal.h"
 
-#import "DOMInternal.h"
-#import "DOMSVGPathSeg.h"
 #import "DOMSVGPathSegArcAbs.h"
 #import "DOMSVGPathSegArcRel.h"
 #import "DOMSVGPathSegClosePath.h"
@@ -53,102 +51,53 @@
 #import "DOMSVGPathSegMovetoAbs.h"
 #import "DOMSVGPathSegMovetoRel.h"
 #import "SVGPathSeg.h"
-#import <objc/objc-class.h>
 
-@implementation DOMSVGPathSeg (WebCoreInternal)
-
-- (WebCore::SVGPathSeg *)_SVGPathSeg
+Class kitClass(WebCore::SVGPathSeg* impl)
 {
-    return reinterpret_cast<WebCore::SVGPathSeg*>(_internal);
-}
-
-- (id)_initWithSVGPathSeg:(WebCore::SVGPathSeg *)impl
-{
-    ASSERT(impl);
-
-    [super _init];
-    _internal = reinterpret_cast<DOMObjectInternal*>(impl);
-    impl->ref();
-    WebCore::addDOMWrapper(self, impl);
-    return self;
-}
-
-+ (DOMSVGPathSeg *)_wrapSVGPathSeg:(WebCore::SVGPathSeg *)impl
-{
-    if (!impl)
-        return nil;
-    id cachedInstance;
-    cachedInstance = WebCore::getDOMWrapper(impl);
-    if (cachedInstance)
-        return [[cachedInstance retain] autorelease];
-
-    Class wrapperClass = nil;
     switch (impl->pathSegType()) {
         case WebCore::SVGPathSeg::PATHSEG_UNKNOWN:
-            wrapperClass = [DOMSVGPathSeg class];
-            break;
+            return [DOMSVGPathSeg class];
         case WebCore::SVGPathSeg::PATHSEG_CLOSEPATH:
-            wrapperClass = [DOMSVGPathSegClosePath class];
-            break;
+            return [DOMSVGPathSegClosePath class];
         case WebCore::SVGPathSeg::PATHSEG_MOVETO_ABS:
-            wrapperClass = [DOMSVGPathSegMovetoAbs class];
-            break;
+            return [DOMSVGPathSegMovetoAbs class];
         case WebCore::SVGPathSeg::PATHSEG_MOVETO_REL:
-            wrapperClass = [DOMSVGPathSegMovetoRel class];
-            break;
+            return [DOMSVGPathSegMovetoRel class];
         case WebCore::SVGPathSeg::PATHSEG_LINETO_ABS:
-            wrapperClass = [DOMSVGPathSegLinetoAbs class];
-            break;
+            return [DOMSVGPathSegLinetoAbs class];
         case WebCore::SVGPathSeg::PATHSEG_LINETO_REL:
-            wrapperClass = [DOMSVGPathSegLinetoRel class];
-            break;
+            return [DOMSVGPathSegLinetoRel class];
         case WebCore::SVGPathSeg::PATHSEG_CURVETO_CUBIC_ABS:
-            wrapperClass = [DOMSVGPathSegCurvetoCubicAbs class];
-            break;
+            return [DOMSVGPathSegCurvetoCubicAbs class];
         case WebCore::SVGPathSeg::PATHSEG_CURVETO_CUBIC_REL:
-            wrapperClass = [DOMSVGPathSegCurvetoCubicRel class];
-            break;
+            return [DOMSVGPathSegCurvetoCubicRel class];
         case WebCore::SVGPathSeg::PATHSEG_CURVETO_QUADRATIC_ABS:
-            wrapperClass = [DOMSVGPathSegCurvetoQuadraticAbs class];
-            break;
+            return [DOMSVGPathSegCurvetoQuadraticAbs class];
         case WebCore::SVGPathSeg::PATHSEG_CURVETO_QUADRATIC_REL:
-            wrapperClass = [DOMSVGPathSegCurvetoQuadraticRel class];
-            break;
+            return [DOMSVGPathSegCurvetoQuadraticRel class];
         case WebCore::SVGPathSeg::PATHSEG_ARC_ABS:
-            wrapperClass = [DOMSVGPathSegArcAbs class];
-            break;
+            return [DOMSVGPathSegArcAbs class];
         case WebCore::SVGPathSeg::PATHSEG_ARC_REL:
-            wrapperClass = [DOMSVGPathSegArcRel class];
-            break;
+            return [DOMSVGPathSegArcRel class];
         case WebCore::SVGPathSeg::PATHSEG_LINETO_HORIZONTAL_ABS:
-            wrapperClass = [DOMSVGPathSegLinetoHorizontalAbs class];
-            break;
+            return [DOMSVGPathSegLinetoHorizontalAbs class];
         case WebCore::SVGPathSeg::PATHSEG_LINETO_HORIZONTAL_REL:
-            wrapperClass = [DOMSVGPathSegLinetoHorizontalRel class];
-            break;
+            return [DOMSVGPathSegLinetoHorizontalRel class];
         case WebCore::SVGPathSeg::PATHSEG_LINETO_VERTICAL_ABS:
-            wrapperClass = [DOMSVGPathSegLinetoVerticalAbs class];
-            break;
+            return [DOMSVGPathSegLinetoVerticalAbs class];
         case WebCore::SVGPathSeg::PATHSEG_LINETO_VERTICAL_REL:
-            wrapperClass = [DOMSVGPathSegLinetoVerticalRel class];
-            break;
+            return [DOMSVGPathSegLinetoVerticalRel class];
         case WebCore::SVGPathSeg::PATHSEG_CURVETO_CUBIC_SMOOTH_ABS:
-            wrapperClass = [DOMSVGPathSegCurvetoCubicSmoothAbs class];
-            break;
+            return [DOMSVGPathSegCurvetoCubicSmoothAbs class];
         case WebCore::SVGPathSeg::PATHSEG_CURVETO_CUBIC_SMOOTH_REL:
-            wrapperClass = [DOMSVGPathSegCurvetoCubicSmoothRel class];
-            break;
+            return [DOMSVGPathSegCurvetoCubicSmoothRel class];
         case WebCore::SVGPathSeg::PATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS:
-            wrapperClass = [DOMSVGPathSegCurvetoQuadraticSmoothAbs class];
-            break;
+            return [DOMSVGPathSegCurvetoQuadraticSmoothAbs class];
         case WebCore::SVGPathSeg::PATHSEG_CURVETO_QUADRATIC_SMOOTH_REL:
-            wrapperClass = [DOMSVGPathSegCurvetoQuadraticSmoothRel class];
-            break;
+            return [DOMSVGPathSegCurvetoQuadraticSmoothRel class];
     }
-
-    return [[[wrapperClass alloc] _initWithSVGPathSeg:impl] autorelease];
+    ASSERT_NOT_REACHED();
+    return nil;
 }
 
-@end
-
 #endif // ENABLE(SVG)
diff --git a/WebCore/bindings/objc/DOMUtility.mm b/WebCore/bindings/objc/DOMUtility.mm
index e346c9e..2b8c474 100644
--- a/WebCore/bindings/objc/DOMUtility.mm
+++ b/WebCore/bindings/objc/DOMUtility.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 James G. Speth (speth@end.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,8 +26,27 @@
 
 #import "config.h"
 
+#import "DOMAbstractViewInternal.h"
+#import "DOMCSSRuleInternal.h"
+#import "DOMCSSRuleListInternal.h"
+#import "DOMCSSStyleDeclarationInternal.h"
+#import "DOMCSSValueInternal.h"
+#import "DOMCounterInternal.h"
+#import "DOMEventInternal.h"
+#import "DOMHTMLCollectionInternal.h"
 #import "DOMImplementationFront.h"
 #import "DOMInternal.h"
+#import "DOMMediaListInternal.h"
+#import "DOMNamedNodeMapInternal.h"
+#import "DOMNodeInternal.h"
+#import "DOMNodeIteratorInternal.h"
+#import "DOMNodeListInternal.h"
+#import "DOMRGBColorInternal.h"
+#import "DOMRangeInternal.h"
+#import "DOMRectInternal.h"
+#import "DOMStyleSheetInternal.h"
+#import "DOMStyleSheetListInternal.h"
+#import "DOMTreeWalkerInternal.h"
 #import "JSCSSRule.h"
 #import "JSCSSRuleList.h"
 #import "JSCSSStyleDeclaration.h"
@@ -52,20 +71,25 @@
 #import "JSTreeWalker.h"
 #import "JSXPathExpression.h"
 #import "JSXPathResult.h"
-#import "Node.h"
 #import "WebScriptObjectPrivate.h"
 #import "runtime_root.h"
-#import <objc/objc-runtime.h>
+
+#if ENABLE(XPATH)
+#import "DOMXPathExpressionInternal.h"
+#import "DOMXPathResultInternal.h"
+#endif
+
+// FIXME: Couldn't get an include of "DOMDOMImplementationInternal.h" to work here.
+DOMImplementation *kit(WebCore::DOMImplementationFront*);
 
 // This file makes use of both the ObjC DOM API and the C++ DOM API, so we need to be careful about what
 // headers are included and what namespaces we use to avoid naming conflicts.
 
-// FIXME: This has to be in the KJS namespace to avoid an Objective-C++ ambiguity with C++ and
-// Objective-C classes of the same name (even when not in the same namespace). That's also the
-// reason for the use of objc_getClass in the WRAP_OLD macro below.
+// FIXME: This has to be in the JSC namespace to avoid an Objective-C++ ambiguity with C++ and
+// Objective-C classes of the same name (even when not in the same namespace).
 
 // Some day if the compiler is fixed, or if all the JS wrappers are named with a "JS" prefix,
-// we could move the function into the WebCore namespace where it belongs.
+// we could move the function out of the JSC namespace.
 
 namespace JSC {
 
@@ -73,7 +97,7 @@
 {
     #define WRAP(className) \
         if (object->inherits(&WebCore::JS##className::s_info)) \
-            return [DOM##className _wrap##className:static_cast<WebCore::JS##className*>(object)->impl()];
+            return kit(static_cast<WebCore::JS##className*>(object)->impl());
 
     WRAP(CSSRule)
     WRAP(CSSRuleList)
@@ -105,18 +129,16 @@
     #undef WRAP
 
     if (object->inherits(&WebCore::JSDOMWindowShell::s_info))
-        return [DOMAbstractView _wrapAbstractView:static_cast<WebCore::JSDOMWindowShell*>(object)->impl()];
+        return kit(static_cast<WebCore::JSDOMWindowShell*>(object)->impl());
 
     if (object->inherits(&WebCore::JSDOMImplementation::s_info))
-        return [DOMImplementation _wrapDOMImplementation:implementationFront(static_cast<WebCore::JSDOMImplementation*>(object))];
+        return kit(implementationFront(static_cast<WebCore::JSDOMImplementation*>(object)));
 
     return nil;
 }
 
 }
 
-namespace WebCore {
-
 id createDOMWrapper(JSC::JSObject* object, PassRefPtr<JSC::Bindings::RootObject> origin, PassRefPtr<JSC::Bindings::RootObject> current)
 {
     id wrapper = JSC::createDOMWrapper(object);
@@ -124,5 +146,3 @@
         [wrapper _setImp:object originRootObject:origin rootObject:current];
     return wrapper;
 }
-
-}
diff --git a/WebCore/bindings/objc/DOMXPath.mm b/WebCore/bindings/objc/DOMXPath.mm
index 0d008f1..d1c07d7 100644
--- a/WebCore/bindings/objc/DOMXPath.mm
+++ b/WebCore/bindings/objc/DOMXPath.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2009 Apple Inc.  All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,10 +28,11 @@
 
 #if ENABLE(XPATH)
 
+#import "DOMInternal.h" // import first to make the private/public trick work
 #import "DOMXPath.h"
 
-#import "DOMInternal.h"
 #import "PlatformString.h"
+#import "WebScriptObjectPrivate.h"
 #import "XPathNSResolver.h"
 
 //------------------------------------------------------------------------------------------
@@ -55,35 +56,6 @@
     [super finalize];
 }
 
-- (WebCore::XPathNSResolver *)_xpathNSResolver
-{
-    return IMPL;
-}
-
-- (id)_initWithXPathNSResolver:(WebCore::XPathNSResolver *)impl
-{
-    ASSERT(impl);
-    
-    [super _init];
-    _internal = reinterpret_cast<DOMObjectInternal*>(impl);
-    impl->ref();
-    WebCore::addDOMWrapper(self, impl);
-    return self;    
-}
-
-+ (DOMNativeXPathNSResolver *)_wrapXPathNSResolver:(WebCore::XPathNSResolver *)impl
-{
-    if (!impl)
-        return nil;
-    
-    id cachedInstance;
-    cachedInstance = WebCore::getDOMWrapper(impl);
-    if (cachedInstance)
-        return [[cachedInstance retain] autorelease];
-    
-    return [[[DOMNativeXPathNSResolver alloc] _initWithXPathNSResolver:impl] autorelease];    
-}
-
 - (NSString *)lookupNamespaceURI:(NSString *)prefix
 {
     return IMPL->lookupNamespaceURI(prefix);
@@ -91,4 +63,24 @@
 
 @end
 
+WebCore::XPathNSResolver* core(DOMNativeXPathNSResolver *wrapper)
+{
+    return wrapper ? reinterpret_cast<WebCore::XPathNSResolver*>(wrapper->_internal) : 0;
+}
+
+DOMNativeXPathNSResolver *kit(WebCore::XPathNSResolver* impl)
+{
+    if (!impl)
+        return nil;
+    
+    if (DOMNativeXPathNSResolver *wrapper = getDOMWrapper(impl))
+        return [[wrapper retain] autorelease];
+    
+    DOMNativeXPathNSResolver *wrapper = [[DOMNativeXPathNSResolver alloc] _init];
+    wrapper->_internal = reinterpret_cast<DOMObjectInternal*>(impl);
+    impl->ref();
+    addDOMWrapper(wrapper, impl);
+    return [wrapper autorelease];    
+}
+
 #endif // ENABLE(XPATH)
diff --git a/WebCore/bindings/objc/ExceptionHandlers.mm b/WebCore/bindings/objc/ExceptionHandlers.mm
index e9e42a8..96ba2c9 100644
--- a/WebCore/bindings/objc/ExceptionHandlers.mm
+++ b/WebCore/bindings/objc/ExceptionHandlers.mm
@@ -28,11 +28,14 @@
 
 #include "ExceptionCode.h"
 
-NSString * DOMException = @"DOMException";
-NSString * DOMRangeException = @"DOMRangeException";
-NSString * DOMEventException = @"DOMEventException";
-NSString * DOMSVGException = @"DOMSVGException";
-NSString * DOMXPathException = @"DOMXPathException";
+NSString *DOMException = @"DOMException";
+NSString *DOMRangeException = @"DOMRangeException";
+NSString *DOMEventException = @"DOMEventException";
+NSString *DOMXPathException = @"DOMXPathException";
+
+#if ENABLE(SVG_DOM_OBJC_BINDINGS)
+NSString *DOMSVGException = @"DOMSVGException";
+#endif
 
 namespace WebCore {
 
@@ -48,8 +51,10 @@
         exceptionName = DOMRangeException;
     else if (strcmp(description.typeName, "DOM Events") == 0)
         exceptionName = DOMEventException;
+#if ENABLE(SVG_DOM_OBJC_BINDINGS)
     else if (strcmp(description.typeName, "DOM SVG") == 0)
         exceptionName = DOMSVGException;
+#endif
     else if (strcmp(description.typeName, "DOM XPath") == 0)
         exceptionName = DOMXPathException;
     else
diff --git a/WebCore/bindings/objc/ObjCEventListener.mm b/WebCore/bindings/objc/ObjCEventListener.mm
index 46c04c1..77c6ad2 100644
--- a/WebCore/bindings/objc/ObjCEventListener.mm
+++ b/WebCore/bindings/objc/ObjCEventListener.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 James G. Speth (speth@end.com)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
  *
@@ -26,15 +26,12 @@
  */
 
 #import "config.h"
-
 #import "ObjCEventListener.h"
 
 #import "DOMEventInternal.h"
 #import "DOMEventListener.h"
 #import "Event.h"
 #import "EventListener.h"
-
-#import <objc/objc-class.h>
 #import <wtf/HashMap.h>
 
 namespace WebCore {
@@ -44,9 +41,10 @@
 
 ObjCEventListener* ObjCEventListener::find(id <DOMEventListener> listener)
 {
-    if (ListenerMap* map = listenerMap)
-        return map->get(listener);
-    return 0;
+    ListenerMap* map = listenerMap;
+    if (!map)
+        return 0;
+    return map->get(listener);
 }
 
 PassRefPtr<ObjCEventListener> ObjCEventListener::wrap(id <DOMEventListener> listener)
@@ -76,7 +74,7 @@
 
 void ObjCEventListener::handleEvent(Event* event, bool)
 {
-    [m_listener handleEvent:[DOMEvent _wrapEvent:event]];
+    [m_listener handleEvent:kit(event)];
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/objc/ObjCNodeFilterCondition.mm b/WebCore/bindings/objc/ObjCNodeFilterCondition.mm
index 982cfe0..825c247 100644
--- a/WebCore/bindings/objc/ObjCNodeFilterCondition.mm
+++ b/WebCore/bindings/objc/ObjCNodeFilterCondition.mm
@@ -41,7 +41,7 @@
 {
     if (!node)
         return NodeFilter::FILTER_REJECT;
-    return [m_filter.get() acceptNode:[DOMNode _wrapNode:node]];
+    return [m_filter.get() acceptNode:kit(node)];
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/objc/PublicDOMInterfaces.h b/WebCore/bindings/objc/PublicDOMInterfaces.h
index 349abaf..9221037 100644
--- a/WebCore/bindings/objc/PublicDOMInterfaces.h
+++ b/WebCore/bindings/objc/PublicDOMInterfaces.h
@@ -91,6 +91,18 @@
 @property(readonly, copy) NSString *URL;
 @property(retain) DOMHTMLElement *body;
 @property(copy) NSString *cookie;
+@property(readonly, copy) NSString *inputEncoding AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *xmlEncoding AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *xmlVersion AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property BOOL xmlStandalone AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *documentURI AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *charset AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *defaultCharset AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *readyState AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *characterSet AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *preferredStylesheetSet AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *selectedStylesheetSet AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *lastModified AVAILABLE_IN_WEBKIT_VERSION_4_0;
 - (DOMElement *)createElement:(NSString *)tagName;
 - (DOMDocumentFragment *)createDocumentFragment;
 - (DOMText *)createTextNode:(NSString *)data;
@@ -132,6 +144,18 @@
 - (DOMXPathResult *)evaluate:(NSString *)expression :(DOMNode *)contextNode :(id <DOMXPathNSResolver>)resolver :(unsigned short)type :(DOMXPathResult *)inResult AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED;
 - (DOMXPathResult *)evaluate:(NSString *)expression contextNode:(DOMNode *)contextNode resolver:(id <DOMXPathNSResolver>)resolver type:(unsigned short)type inResult:(DOMXPathResult *)inResult AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 #endif
+- (BOOL)execCommand:(NSString *)command userInterface:(BOOL)userInterface value:(NSString *)value AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (BOOL)execCommand:(NSString *)command userInterface:(BOOL)userInterface AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (BOOL)execCommand:(NSString *)command AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (BOOL)queryCommandEnabled:(NSString *)command AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (BOOL)queryCommandIndeterm:(NSString *)command AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (BOOL)queryCommandState:(NSString *)command AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (BOOL)queryCommandSupported:(NSString *)command AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (NSString *)queryCommandValue:(NSString *)command AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (DOMElement *)elementFromPoint:(int)x y:(int)y AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (DOMNodeList *)getElementsByClassName:(NSString *)tagname AVAILABLE_IN_WEBKIT_VERSION_4_0;
+- (DOMElement *)querySelector:(NSString *)selectors AVAILABLE_IN_WEBKIT_VERSION_4_0;
+- (DOMNodeList *)querySelectorAll:(NSString *)selectors AVAILABLE_IN_WEBKIT_VERSION_4_0;
 @end
 
 @interface DOMDocumentFragment : DOMNode WEBKIT_VERSION_1_3
@@ -160,6 +184,14 @@
 @property int scrollTop;
 @property(readonly) int scrollWidth;
 @property(readonly) int scrollHeight;
+@property(readonly) int clientLeft AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int clientTop AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *innerText AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, retain) DOMElement *firstElementChild AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property(readonly, retain) DOMElement *lastElementChild AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property(readonly, retain) DOMElement *previousElementSibling AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property(readonly, retain) DOMElement *nextElementSibling AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property(readonly) unsigned childElementCount AVAILABLE_IN_WEBKIT_VERSION_4_0;
 - (NSString *)getAttribute:(NSString *)name;
 - (void)setAttribute:(NSString *)name :(NSString *)value;
 - (void)setAttribute:(NSString *)name value:(NSString *)value AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
@@ -184,6 +216,14 @@
 - (BOOL)hasAttributeNS:(NSString *)namespaceURI localName:(NSString *)localName AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (void)scrollIntoView:(BOOL)alignWithTop AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (void)scrollIntoViewIfNeeded:(BOOL)centerIfNeeded AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (BOOL)contains:(DOMElement *)element AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (void)scrollByLines:(int)lines AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (void)scrollByPages:(int)pages AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (void)focus AVAILABLE_IN_WEBKIT_VERSION_4_0;
+- (void)blur AVAILABLE_IN_WEBKIT_VERSION_4_0;
+- (DOMNodeList *)getElementsByClassName:(NSString *)name AVAILABLE_IN_WEBKIT_VERSION_4_0;
+- (DOMElement *)querySelector:(NSString *)selectors AVAILABLE_IN_WEBKIT_VERSION_4_0;
+- (DOMNodeList *)querySelectorAll:(NSString *)selectors AVAILABLE_IN_WEBKIT_VERSION_4_0;
 @end
 
 @interface DOMEntity : DOMNode WEBKIT_VERSION_1_3
@@ -195,6 +235,16 @@
 @interface DOMEntityReference : DOMNode WEBKIT_VERSION_1_3
 @end
 
+@interface DOMFile : DOMObject WEBKIT_VERSION_4_0
+@property(readonly, copy) NSString *fileName;
+@property(readonly) unsigned long long fileSize;
+@end
+
+@interface DOMFileList : DOMObject WEBKIT_VERSION_4_0
+@property(readonly) unsigned length;
+- (DOMFile *)item:(unsigned)index;
+@end
+
 @interface DOMNamedNodeMap : DOMObject WEBKIT_VERSION_1_3
 @property(readonly) unsigned length;
 - (DOMNode *)getNamedItem:(NSString *)name;
@@ -224,6 +274,9 @@
 @property(copy) NSString *prefix;
 @property(readonly, copy) NSString *localName;
 @property(copy) NSString *textContent AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *baseURI AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, retain) DOMElement *parentElement AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) BOOL isContentEditable AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (DOMNode *)insertBefore:(DOMNode *)newChild :(DOMNode *)refChild;
 - (DOMNode *)insertBefore:(DOMNode *)newChild refChild:(DOMNode *)refChild AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (DOMNode *)replaceChild:(DOMNode *)newChild :(DOMNode *)oldChild;
@@ -238,6 +291,10 @@
 - (BOOL)hasAttributes;
 - (BOOL)isSameNode:(DOMNode *)other AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (BOOL)isEqualNode:(DOMNode *)other AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (NSString *)lookupPrefix:(NSString *)namespaceURI AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (BOOL)isDefaultNamespace:(NSString *)namespaceURI AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (NSString *)lookupNamespaceURI:(NSString *)prefix AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (unsigned short)compareDocumentPosition:(DOMNode *)other AVAILABLE_IN_WEBKIT_VERSION_4_0;
 @end
 
 @interface DOMNodeList : DOMObject WEBKIT_VERSION_1_3
@@ -253,10 +310,13 @@
 @interface DOMProcessingInstruction : DOMNode WEBKIT_VERSION_1_3
 @property(readonly, copy) NSString *target;
 @property(copy) NSString *data;
+@property(readonly, retain) DOMStyleSheet *sheet AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMText : DOMCharacterData WEBKIT_VERSION_1_3
+@property(readonly, copy) NSString *wholeText AVAILABLE_IN_WEBKIT_VERSION_4_0;
 - (DOMText *)splitText:(unsigned)offset;
+- (DOMText *)replaceWholeText:(NSString *)content AVAILABLE_IN_WEBKIT_VERSION_4_0;
 @end
 
 @interface DOMHTMLAnchorElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -272,6 +332,14 @@
 @property(copy) NSString *target;
 @property(copy) NSString *type;
 @property(readonly, copy) NSURL *absoluteLinkURL AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *hashName AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *host AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *hostname AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *pathname AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *port AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *protocol AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *search AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *text AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMHTMLAppletElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -297,6 +365,13 @@
 @property(copy) NSString *shape;
 @property(copy) NSString *target;
 @property(readonly, copy) NSURL *absoluteLinkURL AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *hashName AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *host AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *hostname AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *pathname AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *port AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *protocol AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, copy) NSString *search AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMHTMLBRElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -330,6 +405,9 @@
 @property(copy) NSString *name;
 @property(readonly, copy) NSString *type;
 @property(copy) NSString *value;
+@property BOOL autofocus AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property(readonly) BOOL willValidate AVAILABLE_IN_WEBKIT_VERSION_4_0;
+- (void)click AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMHTMLCanvasElement : DOMHTMLElement WEBKIT_VERSION_3_0
@@ -341,6 +419,7 @@
 @property(readonly) unsigned length;
 - (DOMNode *)item:(unsigned)index;
 - (DOMNode *)namedItem:(NSString *)name;
+- (DOMNodeList *)tags:(NSString *)name AVAILABLE_IN_WEBKIT_VERSION_4_0;
 @end
 
 @interface DOMHTMLDListElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -356,6 +435,24 @@
 @end
 
 @interface DOMHTMLDocument : DOMDocument WEBKIT_VERSION_1_3
+@property(readonly, retain) DOMHTMLCollection *embeds AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, retain) DOMHTMLCollection *plugins AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, retain) DOMHTMLCollection *scripts AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int width AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int height AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *dir AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *designMode AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *bgColor AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *fgColor AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *alinkColor AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *linkColor AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *vlinkColor AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, retain) DOMElement *activeElement AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property(readonly, copy) NSString *compatMode AVAILABLE_IN_WEBKIT_VERSION_4_0;
+- (void)captureEvents AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (void)releaseEvents AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (void)clear AVAILABLE_IN_WEBKIT_VERSION_4_0;
+- (BOOL)hasFocus AVAILABLE_IN_WEBKIT_VERSION_4_0;
 - (void)open;
 - (void)close;
 - (void)write:(NSString *)text;
@@ -377,8 +474,6 @@
 @property(readonly) BOOL isContentEditable;
 @property(readonly, copy) NSString *titleDisplayString AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @property int tabIndex;
-- (void)blur;
-- (void)focus;
 @end
 
 @interface DOMHTMLEmbedElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -409,6 +504,7 @@
 @property(copy) NSString *enctype;
 @property(copy) NSString *method;
 @property(copy) NSString *target;
+@property(copy) NSString *encoding AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (void)submit;
 - (void)reset;
 @end
@@ -423,6 +519,10 @@
 @property(copy) NSString *scrolling;
 @property(copy) NSString *src;
 @property(readonly, retain) DOMDocument *contentDocument;
+@property(readonly, retain) DOMAbstractView *contentWindow AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *location AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int width AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int height AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMHTMLFrameSetElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -461,6 +561,7 @@
 @property(copy) NSString *src;
 @property(copy) NSString *width;
 @property(readonly, retain) DOMDocument *contentDocument;
+@property(readonly, retain) DOMAbstractView *contentWindow AVAILABLE_IN_WEBKIT_VERSION_4_0;
 @end
 
 @interface DOMHTMLImageElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -478,6 +579,12 @@
 @property int width;
 @property(readonly, copy) NSString *altDisplayString AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @property(readonly, copy) NSURL *absoluteImageURL AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) BOOL complete AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(copy) NSString *lowsrc AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int naturalHeight AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int naturalWidth AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int x AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int y AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMHTMLInputElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -500,8 +607,16 @@
 @property(copy) NSString *value;
 @property(readonly, copy) NSString *altDisplayString AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @property(readonly, copy) NSURL *absoluteImageURL AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property BOOL indeterminate AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property int selectionStart AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property int selectionEnd AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property BOOL autofocus AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property BOOL multiple AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property(readonly) BOOL willValidate AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property(readonly, retain) DOMFileList *files AVAILABLE_IN_WEBKIT_VERSION_4_0;
 - (void)select;
 - (void)click;
+- (void)setSelectionRange:(int)start end:(int)end AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMHTMLIsIndexElement : DOMHTMLInputElement WEBKIT_VERSION_1_3
@@ -537,6 +652,7 @@
 @property(copy) NSString *target;
 @property(copy) NSString *type;
 @property(readonly, copy) NSURL *absoluteLinkURL AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, retain) DOMStyleSheet *sheet AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMHTMLMapElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -611,8 +727,11 @@
 
 @interface DOMHTMLOptionsCollection : DOMObject WEBKIT_VERSION_1_3
 @property unsigned length;
+@property int selectedIndex AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (DOMNode *)item:(unsigned)index;
 - (DOMNode *)namedItem:(NSString *)name;
+- (void)add:(DOMHTMLOptionElement *)option index:(unsigned)index AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (void)remove:(unsigned)index AVAILABLE_IN_WEBKIT_VERSION_4_0;
 @end
 
 @interface DOMHTMLParagraphElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -628,6 +747,7 @@
 
 @interface DOMHTMLPreElement : DOMHTMLElement WEBKIT_VERSION_1_3
 @property int width;
+@property BOOL wrap AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMHTMLQuoteElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -655,15 +775,20 @@
 @property BOOL multiple;
 @property(copy) NSString *name;
 @property int size;
+@property(readonly) BOOL willValidate AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property BOOL autofocus AVAILABLE_IN_WEBKIT_VERSION_4_0;
 - (void)add:(DOMHTMLElement *)element :(DOMHTMLElement *)before;
 - (void)add:(DOMHTMLElement *)element before:(DOMHTMLElement *)before AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (void)remove:(int)index;
+- (DOMNode *)item:(unsigned)index AVAILABLE_IN_WEBKIT_VERSION_4_0;
+- (DOMNode *)namedItem:(NSString *)name AVAILABLE_IN_WEBKIT_VERSION_4_0;
 @end
 
 @interface DOMHTMLStyleElement : DOMHTMLElement WEBKIT_VERSION_1_3
 @property BOOL disabled;
 @property(copy) NSString *media;
 @property(copy) NSString *type;
+@property(readonly, retain) DOMStyleSheet *sheet AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMHTMLTableCaptionElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -756,7 +881,12 @@
 @property int rows;
 @property(readonly, copy) NSString *type;
 @property(copy) NSString *value;
+@property int selectionStart AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property int selectionEnd AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property BOOL autofocus AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property(readonly) BOOL willValidate AVAILABLE_IN_WEBKIT_VERSION_4_0;
 - (void)select;
+- (void)setSelectionRange:(int)start end:(int)end AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMHTMLTitleElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -866,9 +996,12 @@
 @interface DOMCSSStyleSheet : DOMStyleSheet WEBKIT_VERSION_1_3
 @property(readonly, retain) DOMCSSRule *ownerRule;
 @property(readonly, retain) DOMCSSRuleList *cssRules;
+@property(readonly, retain) DOMCSSRuleList *rules AVAILABLE_IN_WEBKIT_VERSION_4_0;
 - (unsigned)insertRule:(NSString *)rule :(unsigned)index;
 - (unsigned)insertRule:(NSString *)rule index:(unsigned)index AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (void)deleteRule:(unsigned)index;
+- (int)addRule:(NSString *)selector style:(NSString *)style index:(unsigned)index AVAILABLE_IN_WEBKIT_VERSION_4_0;
+- (void)removeRule:(unsigned)index AVAILABLE_IN_WEBKIT_VERSION_4_0;
 @end
 
 @interface DOMCSSValue : DOMObject WEBKIT_VERSION_1_3
@@ -905,6 +1038,9 @@
 @property(readonly) BOOL bubbles;
 @property(readonly) BOOL cancelable;
 @property(readonly) DOMTimeStamp timeStamp;
+@property(readonly, retain) id <DOMEventTarget> srcElement AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property BOOL returnValue AVAILABLE_IN_WEBKIT_VERSION_4_0;
+@property BOOL cancelBubble AVAILABLE_IN_WEBKIT_VERSION_4_0;
 - (void)stopPropagation;
 - (void)preventDefault;
 - (void)initEvent:(NSString *)eventTypeArg canBubbleArg:(BOOL)canBubbleArg cancelableArg:(BOOL)cancelableArg AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
@@ -914,6 +1050,13 @@
 @interface DOMUIEvent : DOMEvent WEBKIT_VERSION_1_3
 @property(readonly, retain) DOMAbstractView *view;
 @property(readonly) int detail;
+@property(readonly) int keyCode AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int charCode AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int layerX AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int layerY AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int pageX AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int pageY AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int which AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (void)initUIEvent:(NSString *)type canBubble:(BOOL)canBubble cancelable:(BOOL)cancelable view:(DOMAbstractView *)view detail:(int)detail AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (void)initUIEvent:(NSString *)type :(BOOL)canBubble :(BOOL)cancelable :(DOMAbstractView *)view :(int)detail;
 @end
@@ -946,6 +1089,13 @@
 @property(readonly) BOOL metaKey;
 @property(readonly) BOOL isHorizontal;
 @property(readonly) int wheelDelta;
+@property(readonly) int wheelDeltaX AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int wheelDeltaY AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int offsetX AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int offsetY AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int x AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int y AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (void)initWheelEvent:(int)wheelDeltaX wheelDeltaY:(int)wheelDeltaY view:(DOMAbstractView *)view screenX:(int)screenX screenY:(int)screenY clientX:(int)clientX clientY:(int)clientY ctrlKey:(BOOL)ctrlKey altKey:(BOOL)altKey shiftKey:(BOOL)shiftKey metaKey:(BOOL)metaKey AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMKeyboardEvent : DOMUIEvent WEBKIT_VERSION_3_0
@@ -957,7 +1107,10 @@
 @property(readonly) BOOL metaKey;
 @property(readonly) int keyCode;
 @property(readonly) int charCode;
+@property(readonly) BOOL altGraphKey AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (BOOL)getModifierState:(NSString *)keyIdentifierArg;
+- (void)initKeyboardEvent:(NSString *)type canBubble:(BOOL)canBubble cancelable:(BOOL)cancelable view:(DOMAbstractView *)view keyIdentifier:(NSString *)keyIdentifier keyLocation:(unsigned)keyLocation ctrlKey:(BOOL)ctrlKey altKey:(BOOL)altKey shiftKey:(BOOL)shiftKey metaKey:(BOOL)metaKey altGraphKey:(BOOL)altGraphKey AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (void)initKeyboardEvent:(NSString *)type canBubble:(BOOL)canBubble cancelable:(BOOL)cancelable view:(DOMAbstractView *)view keyIdentifier:(NSString *)keyIdentifier keyLocation:(unsigned)keyLocation ctrlKey:(BOOL)ctrlKey altKey:(BOOL)altKey shiftKey:(BOOL)shiftKey metaKey:(BOOL)metaKey AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMMouseEvent : DOMUIEvent WEBKIT_VERSION_1_3
@@ -971,6 +1124,12 @@
 @property(readonly) BOOL metaKey;
 @property(readonly) unsigned short button;
 @property(readonly, retain) id <DOMEventTarget> relatedTarget;
+@property(readonly) int offsetX AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int offsetY AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int x AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) int y AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, retain) DOMNode *fromElement AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly, retain) DOMNode *toElement AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (void)initMouseEvent:(NSString *)type canBubble:(BOOL)canBubble cancelable:(BOOL)cancelable view:(DOMAbstractView *)view detail:(int)detail screenX:(int)screenX screenY:(int)screenY clientX:(int)clientX clientY:(int)clientY ctrlKey:(BOOL)ctrlKey altKey:(BOOL)altKey shiftKey:(BOOL)shiftKey metaKey:(BOOL)metaKey button:(unsigned short)button relatedTarget:(id <DOMEventTarget>)relatedTarget AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (void)initMouseEvent:(NSString *)type :(BOOL)canBubble :(BOOL)cancelable :(DOMAbstractView *)view :(int)detail :(int)screenX :(int)screenY :(int)clientX :(int)clientY :(BOOL)ctrlKey :(BOOL)altKey :(BOOL)shiftKey :(BOOL)metaKey :(unsigned short)button :(id <DOMEventTarget>)relatedTarget;
 @end
@@ -1004,6 +1163,11 @@
 - (DOMRange *)cloneRange;
 - (NSString *)toString;
 - (void)detach;
+- (DOMDocumentFragment *)createContextualFragment:(NSString *)html AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (BOOL)intersectsNode:(DOMNode *)refNode AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (short)compareNode:(DOMNode *)refNode AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (short)comparePoint:(DOMNode *)refNode offset:(int)offset AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+- (BOOL)isPointInRange:(DOMNode *)refNode offset:(int)offset AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @end
 
 @interface DOMNodeIterator : DOMObject WEBKIT_VERSION_1_3
@@ -1011,6 +1175,8 @@
 @property(readonly) unsigned whatToShow;
 @property(readonly, retain) id <DOMNodeFilter> filter;
 @property(readonly) BOOL expandEntityReferences;
+@property(readonly, retain) DOMNode *referenceNode AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
+@property(readonly) BOOL pointerBeforeReferenceNode AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 - (DOMNode *)nextNode;
 - (DOMNode *)previousNode;
 - (void)detach;
diff --git a/WebCore/bindings/objc/WebScriptObject.mm b/WebCore/bindings/objc/WebScriptObject.mm
index 3cdae86..8889eac 100644
--- a/WebCore/bindings/objc/WebScriptObject.mm
+++ b/WebCore/bindings/objc/WebScriptObject.mm
@@ -113,7 +113,7 @@
 
 + (id)scriptObjectForJSObject:(JSObjectRef)jsObject originRootObject:(RootObject*)originRootObject rootObject:(RootObject*)rootObject
 {
-    if (id domWrapper = WebCore::createDOMWrapper(toJS(jsObject), originRootObject, rootObject))
+    if (id domWrapper = createDOMWrapper(toJS(jsObject), originRootObject, rootObject))
         return domWrapper;
     
     return WebCore::createJSWrapper(toJS(jsObject), originRootObject, rootObject);
@@ -265,7 +265,7 @@
     return YES;
 }
 
-static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* rootObject, ArgList& aList)
+static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* rootObject, MarkedArgumentBuffer& aList)
 {
     int i, numObjects = array ? [array count] : 0;
     
@@ -286,20 +286,20 @@
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSValuePtr function = [self _imp]->get(exec, Identifier(exec, String(name)));
+    JSValue function = [self _imp]->get(exec, Identifier(exec, String(name)));
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return nil;
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     getListFromNSArray(exec, args, [self _rootObject], argList);
 
     if (![self _isSafeScript])
         return nil;
 
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.start();
-    JSValuePtr result = call(exec, function, callType, callData, [self _imp], argList);
+    JSValue result = call(exec, function, callType, callData, [self _imp], argList);
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.stop();
 
     if (exec->hadException()) {
@@ -324,7 +324,7 @@
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSValuePtr result;
+    JSValue result;
     JSLock lock(false);
     
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.start();
@@ -388,7 +388,7 @@
         // leaving the lock permanently held
         JSLock lock(false);
         
-        JSValuePtr result = [self _imp]->get(exec, Identifier(exec, String(key)));
+        JSValue result = [self _imp]->get(exec, Identifier(exec, String(key)));
         
         if (exec->hadException()) {
             addExceptionToConsole(exec);
@@ -455,7 +455,7 @@
     ASSERT(!exec->hadException());
 
     JSLock lock(false);
-    JSValuePtr result = [self _imp]->get(exec, index);
+    JSValue result = [self _imp]->get(exec, index);
 
     if (exec->hadException()) {
         addExceptionToConsole(exec);
@@ -504,7 +504,7 @@
     return toRef([self _imp]);
 }
 
-+ (id)_convertValueToObjcValue:(JSValuePtr)value originRootObject:(RootObject*)originRootObject rootObject:(RootObject*)rootObject
++ (id)_convertValueToObjcValue:(JSValue)value originRootObject:(RootObject*)originRootObject rootObject:(RootObject*)rootObject
 {
     if (value.isObject()) {
         JSObject* object = asObject(value);
@@ -512,7 +512,7 @@
         JSLock lock(false);
         
         if (object->classInfo() != &RuntimeObjectImp::s_info) {
-            JSValuePtr runtimeObject = object->get(exec, Identifier(exec, "__apple_runtime_object"));
+            JSValue runtimeObject = object->get(exec, Identifier(exec, "__apple_runtime_object"));
             if (runtimeObject && runtimeObject.isObject())
                 object = asObject(runtimeObject);
         }
diff --git a/WebCore/bindings/objc/WebScriptObjectPrivate.h b/WebCore/bindings/objc/WebScriptObjectPrivate.h
index 6810de6..3a424ce 100644
--- a/WebCore/bindings/objc/WebScriptObjectPrivate.h
+++ b/WebCore/bindings/objc/WebScriptObjectPrivate.h
@@ -46,7 +46,7 @@
 }
 
 @interface WebScriptObject (Private)
-+ (id)_convertValueToObjcValue:(JSC::JSValuePtr)value originRootObject:(JSC::Bindings::RootObject*)originRootObject rootObject:(JSC::Bindings::RootObject*)rootObject;
++ (id)_convertValueToObjcValue:(JSC::JSValue)value originRootObject:(JSC::Bindings::RootObject*)originRootObject rootObject:(JSC::Bindings::RootObject*)rootObject;
 + (id)scriptObjectForJSObject:(JSObjectRef)jsObject originRootObject:(JSC::Bindings::RootObject*)originRootObject rootObject:(JSC::Bindings::RootObject*)rootObject;
 - (id)_init;
 - (id)_initWithJSObject:(JSC::JSObject*)imp originRootObject:(PassRefPtr<JSC::Bindings::RootObject>)originRootObject rootObject:(PassRefPtr<JSC::Bindings::RootObject>)rootObject;
diff --git a/WebCore/bindings/scripts/CodeGenerator.pm b/WebCore/bindings/scripts/CodeGenerator.pm
index 4f899be..d217c37 100644
--- a/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/WebCore/bindings/scripts/CodeGenerator.pm
@@ -381,6 +381,8 @@
     my $ret = lcfirst($param);
     $ret =~ s/uRL/url/ if $ret =~ /^uRL/;
     $ret =~ s/jS/js/ if $ret =~ /^jS/;
+    $ret =~ s/xML/xml/ if $ret =~ /^xML/;
+    $ret =~ s/xSLT/xslt/ if $ret =~ /^xSLT/;
     return $ret;
 }
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
index 4e363aa..7e80a17 100644
--- a/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
@@ -900,7 +900,7 @@
                                                                                          "Forwarder" => $parentClassName });
                 push(@CPPHeaderContent, values(%attributes));
             }
-            
+
             # Add attribute names to attribute names set in case other ancestors 
             # also define them.
             $attributeNameSet{$_->signature->name} = 1 foreach @attributeList;
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 08ef971..4563018 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -145,7 +145,7 @@
 {
     my $type = shift;
 
-    return 1 if $type eq "Node" or $type eq "Document" or $type eq "HTMLCollection" or $type eq "SVGPathSeg" or $type eq "StyleSheet" or $type eq "CSSRule" or $type eq "CSSValue" or $type eq "Event" or $type eq "ImageData" or $type eq "Element" or $type eq "Text";
+    return 1 if $type eq "Node" or $type eq "Document" or $type eq "HTMLCollection" or $type eq "SVGPathSeg" or $type eq "StyleSheet" or $type eq "CSSRule" or $type eq "CSSValue" or $type eq "Event" or $type eq "ImageData" or $type eq "Element" or $type eq "Text" or $type eq "SVGElementInstance";
     return 0;
 }
 
@@ -279,7 +279,7 @@
     my @getOwnPropertySlotImpl = ();
 
     if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection") {
-        push(@getOwnPropertySlotImpl, "    ${namespaceMaybe}JSValuePtr proto = prototype();\n");
+        push(@getOwnPropertySlotImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
         push(@getOwnPropertySlotImpl, "    if (proto.isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
         push(@getOwnPropertySlotImpl, "        return false;\n\n");
     }
@@ -434,10 +434,10 @@
     }
 
     # Destructor
-    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $interfaceName eq "Document");
+    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $interfaceName eq "Document" or $interfaceName eq "DOMWindow");
 
     # Prototype
-    push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
+    push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
 
     $implIncludes{"${className}Custom.h"} = 1 if $dataNode->extendedAttributes->{"CustomHeader"} || $dataNode->extendedAttributes->{"CustomPutFunction"};
 
@@ -470,9 +470,9 @@
 
     # Getters
     if ($hasSetter) {
-        push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);\n");
-        push(@headerContent, "    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValuePtr);\n") if $dataNode->extendedAttributes->{"HasCustomIndexSetter"};
-        push(@headerContent, "    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomPutFunction"};
+        push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
+        push(@headerContent, "    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);\n") if $dataNode->extendedAttributes->{"HasCustomIndexSetter"};
+        push(@headerContent, "    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomPutFunction"};
     }
 
     # Class info
@@ -482,13 +482,13 @@
     # Structure ID
     if ($interfaceName eq "DOMWindow") {
         push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)\n" .
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::NeedsThisConversion));\n" .
             "    }\n\n");
     } elsif ($hasGetter) {
         push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)\n" .
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
             "    }\n\n");
@@ -520,13 +520,13 @@
     push(@headerContent, "    virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);\n") if $dataNode->extendedAttributes->{"CustomDefineSetter"};
 
     # Custom lookupGetter function
-    push(@headerContent, "    virtual JSC::JSValuePtr lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupGetter"};
+    push(@headerContent, "    virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupGetter"};
 
     # Custom lookupSetter function
-    push(@headerContent, "    virtual JSC::JSValuePtr lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupSetter"};
+    push(@headerContent, "    virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupSetter"};
 
     # Constructor object getter
-    push(@headerContent, "    static JSC::JSValuePtr getConstructor(JSC::ExecState*);\n") if $dataNode->extendedAttributes->{"GenerateConstructor"};
+    push(@headerContent, "    static JSC::JSValue getConstructor(JSC::ExecState*);\n") if $dataNode->extendedAttributes->{"GenerateConstructor"};
 
     my $numCustomFunctions = 0;
     my $numCustomAttributes = 0;
@@ -536,8 +536,8 @@
         foreach (@{$dataNode->attributes}) {
             my $attribute = $_;
             $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"};
-            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomGetter"};
-            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomSetter"};
+            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCCustomGetter"};
+            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCCustomSetter"};
         }
     }
 
@@ -546,15 +546,15 @@
 
         foreach my $attribute (@{$dataNode->attributes}) {
             if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"}) {
-                push(@headerContent, "    JSC::JSValuePtr " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
+                push(@headerContent, "    JSC::JSValue " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
                 if ($attribute->type !~ /^readonly/) {
-                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValuePtr);\n");
+                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValue);\n");
                 }
-            } elsif ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
-                push(@headerContent, "    JSC::JSValuePtr " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
-            } elsif ($attribute->signature->extendedAttributes->{"CustomSetter"}) {
+            } elsif ($attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCCustomGetter"}) {
+                push(@headerContent, "    JSC::JSValue " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
+            } elsif ($attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCCustomSetter"}) {
                 if ($attribute->type !~ /^readonly/) {
-                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValuePtr);\n");
+                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValue);\n");
                 }
             }
         }
@@ -569,7 +569,7 @@
         foreach my $function (@{$dataNode->functions}) {
             if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"JSCCustom"}) {
                 my $functionImplementationName = $function->signature->extendedAttributes->{"ImplementationFunction"} || $codeGenerator->WK_lcfirst($function->signature->name);
-                push(@headerContent, "    JSC::JSValuePtr " . $functionImplementationName . "(JSC::ExecState*, const JSC::ArgList&);\n");
+                push(@headerContent, "    JSC::JSValue " . $functionImplementationName . "(JSC::ExecState*, const JSC::ArgList&);\n");
             }
         }
     }
@@ -601,21 +601,21 @@
 
     # Index getter
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
-        push(@headerContent, "    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+        push(@headerContent, "    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
     }
     if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
-        push(@headerContent, "    JSC::JSValuePtr getByIndex(JSC::ExecState*, unsigned index);\n");
+        push(@headerContent, "    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\n");
     }
     
     # Index setter
     if ($dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
-        push(@headerContent, "    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValuePtr);\n");
+        push(@headerContent, "    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);\n");
     }
     # Name getter
     if ($dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
         push(@headerContent, "private:\n");
         push(@headerContent, "    static bool canGetItemsForName(JSC::ExecState*, $implClassName*, const JSC::Identifier&);\n");
-        push(@headerContent, "    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+        push(@headerContent, "    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
     }
 
     push(@headerContent, "};\n\n");
@@ -629,48 +629,59 @@
 
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateToJS"}) {
         if ($podType) {
-            push(@headerContent, "JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<$podType>*, SVGElement* context);\n");
+            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<$podType>*, SVGElement* context);\n");
         } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-            push(@headerContent, "JSC::JSValuePtr toJS(JSC::ExecState*, $implType*, SVGElement* context);\n");
+            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, $implType*, SVGElement* context);\n");
         } else {
-            push(@headerContent, "JSC::JSValuePtr toJS(JSC::ExecState*, $implType*);\n");
+            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, $implType*);\n");
         }
     }
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateNativeConverter"}) {
         if ($podType) {
-            push(@headerContent, "$podType to${interfaceName}(JSC::JSValuePtr);\n");
+            push(@headerContent, "$podType to${interfaceName}(JSC::JSValue);\n");
         } elsif ($interfaceName eq "NodeFilter") {
-            push(@headerContent, "PassRefPtr<NodeFilter> toNodeFilter(JSC::JSValuePtr);\n");
+            push(@headerContent, "PassRefPtr<NodeFilter> toNodeFilter(JSC::JSValue);\n");
         } else {
-            push(@headerContent, "$implClassName* to${interfaceName}(JSC::JSValuePtr);\n");
+            push(@headerContent, "$implClassName* to${interfaceName}(JSC::JSValue);\n");
         }
     }
     if ($interfaceName eq "Node" or $interfaceName eq "Element" or $interfaceName eq "Text" or $interfaceName eq "CDATASection") {
-        push(@headerContent, "JSC::JSValuePtr toJSNewlyCreated(JSC::ExecState*, $interfaceName*);\n");
+        push(@headerContent, "JSC::JSValue toJSNewlyCreated(JSC::ExecState*, $interfaceName*);\n");
     }
     
     push(@headerContent, "\n");
 
     # Add prototype declaration.
     push(@headerContent, "class ${className}Prototype : public JSC::JSObject {\n");
+    push(@headerContent, "    typedef JSC::JSObject Base;\n");
     push(@headerContent, "public:\n");
     if ($interfaceName eq "DOMWindow") {
         push(@headerContent, "    void* operator new(size_t);\n");
     } elsif ($interfaceName eq "WorkerContext") {
         push(@headerContent, "    void* operator new(size_t, JSC::JSGlobalData*);\n");
     } else {
-        push(@headerContent, "    static JSC::JSObject* self(JSC::ExecState*);\n");
+        push(@headerContent, "    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);\n");
     }
     push(@headerContent, "    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }\n");
     push(@headerContent, "    static const JSC::ClassInfo s_info;\n");
-    if ($numFunctions > 0 || $numConstants > 0) {
+    if ($numFunctions > 0 || $numConstants > 0 || $dataNode->extendedAttributes->{"CustomPrototypeGetOwnPropertySlot"}) {
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n");
+        push(@headerContent, "    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomPrototypeGetOwnPropertySlot"};
+
         push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)\n" .
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
             "    }\n");
     }
+    if ($dataNode->extendedAttributes->{"CustomPrototypePutFunction"}) {
+        push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
+        push(@headerContent, "    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n");
+    }
+
+    # Custom defineGetter function
+    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);\n") if $dataNode->extendedAttributes->{"CustomPrototypeDefineGetter"};
+
     push(@headerContent, "    ${className}Prototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }\n");
 
     push(@headerContent, "};\n\n");
@@ -679,7 +690,7 @@
         push(@headerContent,"// Functions\n\n");
         foreach my $function (@{$dataNode->functions}) {
             my $functionName = $codeGenerator->WK_lcfirst($className) . "PrototypeFunction" . $codeGenerator->WK_ucfirst($function->signature->name);
-            push(@headerContent, "JSC::JSValuePtr ${functionName}(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);\n");
+            push(@headerContent, "JSC::JSValue JSC_HOST_CALL ${functionName}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);\n");
         }
     }
 
@@ -687,16 +698,16 @@
         push(@headerContent,"// Attributes\n\n");
         foreach my $attribute (@{$dataNode->attributes}) {
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
-            push(@headerContent, "JSC::JSValuePtr ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
             unless ($attribute->type =~ /readonly/) {
                 my $setter = "setJS" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
-                push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);\n");
+                push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);\n");
             }
         }
         
         if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
             my $getter = "js" . $interfaceName . "Constructor";
-            push(@headerContent, "JSC::JSValuePtr ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
         }
     }
 
@@ -704,7 +715,7 @@
         push(@headerContent,"// Constants\n\n");
         foreach my $constant (@{$dataNode->constants}) {
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
-            push(@headerContent, "JSC::JSValuePtr ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
         }
     }
 
@@ -771,6 +782,7 @@
         my @hashSpecials = ();
         my @hashValue1 = ();
         my @hashValue2 = ();
+        my %conditionals = ();
 
         my @entries = ();
 
@@ -794,6 +806,11 @@
                 my $setter = "setJS" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
                 push(@hashValue2, $setter);
             }
+
+            my $conditional = $attribute->signature->extendedAttributes->{"Conditional"};
+            if ($conditional) {
+                $conditionals{$name} = $conditional;
+            }
         }
 
         if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
@@ -806,7 +823,8 @@
 
         $object->GenerateHashTable($hashName, $hashSize,
                                    \@hashKeys, \@hashSpecials,
-                                   \@hashValue1, \@hashValue2);
+                                   \@hashValue1, \@hashValue2,
+                                   \%conditionals);
     }
 
     my $numConstants = @{$dataNode->constants};
@@ -872,7 +890,7 @@
         my @specials = ();
         push(@specials, "DontDelete") unless $function->signature->extendedAttributes->{"Deletable"};
         push(@specials, "DontEnum") if $function->signature->extendedAttributes->{"DontEnum"};
-        push(@specials, "Function");        
+        push(@specials, "Function");
         my $special = (@specials > 0) ? join("|", @specials) : "0";
         push(@hashSpecials, $special);
     }
@@ -901,15 +919,23 @@
         push(@implContent, "    return globalData->heap.allocate(size);\n");
         push(@implContent, "}\n\n");
     } else {
-        push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec)\n");
+        push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
-        push(@implContent, "    return getDOMPrototype<${className}>(exec);\n");
+        push(@implContent, "    return getDOMPrototype<${className}>(exec, globalObject);\n");
         push(@implContent, "}\n\n");
     }
-    if ($numConstants > 0 || $numFunctions > 0) {
+    if ($numConstants > 0 || $numFunctions > 0 || $dataNode->extendedAttributes->{"CustomPrototypeGetOwnPropertySlot"}) {
         push(@implContent, "bool ${className}Prototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)\n");
         push(@implContent, "{\n");
-        if ($numConstants eq 0) {
+
+        if ($dataNode->extendedAttributes->{"CustomPrototypeGetOwnPropertySlot"}) {
+            push(@implContent, "    if (customGetOwnPropertySlot(exec, propertyName, slot))\n");
+            push(@implContent, "        return true;\n");
+        }
+
+        if ($numConstants eq 0 && $numFunctions eq 0) {
+            push(@implContent, "    return Base::getOwnPropertySlot(exec, propertyName, slot);\n");        
+        } elsif ($numConstants eq 0) {
             push(@implContent, "    return getStaticFunctionSlot<JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, slot);\n");
         } elsif ($numFunctions eq 0) {
             push(@implContent, "    return getStaticValueSlot<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, slot);\n");
@@ -919,6 +945,15 @@
         push(@implContent, "}\n\n");
     }
 
+    if ($dataNode->extendedAttributes->{"CustomPrototypePutFunction"}) {
+        push(@implContent, "void ${className}Prototype::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    if (customPut(exec, propertyName, value, slot))\n");
+        push(@implContent, "        return;\n");
+        push(@implContent, "    Base::put(exec, propertyName, value, slot);\n");
+        push(@implContent, "}\n\n");
+    }
+
     # - Initialize static ClassInfo object
     if ($numAttributes > 0 && $dataNode->extendedAttributes->{"NoStaticTables"}) {
         push(@implContent, "static const HashTable* get${className}Table(ExecState* exec)\n");
@@ -979,12 +1014,17 @@
     push(@implContent, "}\n\n");
 
     # Destructor
-    if (!$hasParent) {
+    if (!$hasParent || $interfaceName eq "DOMWindow") {
         push(@implContent, "${className}::~$className()\n");
         push(@implContent, "{\n");
 
         if ($interfaceName eq "Node") {
-            push(@implContent, "    forgetDOMNode(m_impl->document(), m_impl.get());\n");
+             $implIncludes{"RegisteredEventListener.h"} = 1;
+             push(@implContent, "    invalidateEventListeners(m_impl->eventListeners());\n");
+             push(@implContent, "    forgetDOMNode(m_impl->document(), m_impl.get());\n");
+        } elsif ($interfaceName eq "DOMWindow") {
+             $implIncludes{"RegisteredEventListener.h"} = 1;
+             push(@implContent, "    invalidateEventListeners(impl()->eventListeners());\n");
         } else {
             if ($podType) {
                 my $animatedType = $implClassName;
@@ -998,7 +1038,7 @@
             push(@implContent, "    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());\n");
         }
 
-        push(@implContent, "\n}\n\n");
+        push(@implContent, "}\n\n");
     }
 
     # Document needs a special destructor because it's a special case for caching. It needs
@@ -1009,12 +1049,12 @@
     }
 
     if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
-        push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec)\n");
+        push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
         if ($hasParent && $parentClassName ne "JSC::DOMNodeFilter") {
-            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(${parentClassName}Prototype::self(exec)));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(${parentClassName}Prototype::self(exec, globalObject)));\n");
         } else {
-            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(globalObject->objectPrototype()));\n");
         }
         push(@implContent, "}\n\n");
     }
@@ -1059,7 +1099,13 @@
                 my $getFunctionName = "js" . $interfaceName .  $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
                 my $implGetterFunctionName = $codeGenerator->WK_lcfirst($name);
 
-                push(@implContent, "JSValuePtr ${getFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+                my $conditional = $attribute->signature->extendedAttributes->{"Conditional"};
+                if ($conditional) {
+                    $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+                    push(@implContent, "#if ${conditionalString}\n");
+                }
+
+                push(@implContent, "JSValue ${getFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
                 push(@implContent, "{\n");
 
                 my $implClassNameForValueConversion = "";
@@ -1074,7 +1120,7 @@
                     push(@implContent, "        return jsUndefined();\n");
                 }
 
-                if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"} || $attribute->signature->extendedAttributes->{"CustomGetter"}) {
+                if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"} || $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCCustomGetter"}) {
                     push(@implContent, "    return static_cast<$className*>(asObject(slot.slotBase()))->$implGetterFunctionName(exec);\n");
                 } elsif ($attribute->signature->extendedAttributes->{"CheckNodeSecurity"}) {
                     $implIncludes{"JSDOMBinding.h"} = 1;
@@ -1090,8 +1136,8 @@
                     push(@implContent, "    UNUSED_PARAM(exec);\n");
                     push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
                     push(@implContent, "    if (EventListener* listener = imp->$implGetterFunctionName()) {\n");
-                    push(@implContent, "        if (JSObject* function = listener->function())\n");
-                    push(@implContent, "            return function;\n");
+                    push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction())\n");
+                    push(@implContent, "            return jsFunction;\n");
                     push(@implContent, "    }\n");
                     push(@implContent, "    return jsNull();\n");
                 } elsif ($attribute->signature->type =~ /Constructor$/) {
@@ -1123,23 +1169,29 @@
 
                     if ($podType) {
                         push(@implContent, "    $podType imp(*static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
-                        push(@implContent, "    JSC::JSValuePtr result = " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp.$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
+                        push(@implContent, "    JSC::JSValue result = " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp.$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
                     } else {
                         push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
-                        push(@implContent, "    JSC::JSValuePtr result = " . NativeToJSValue($attribute->signature, 0, $implClassName, $implClassNameForValueConversion, "imp->$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
+                        push(@implContent, "    JSC::JSValue result = " . NativeToJSValue($attribute->signature, 0, $implClassName, $implClassNameForValueConversion, "imp->$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
                     }
 
                     push(@implContent, "    setDOMException(exec, ec);\n");
                     push(@implContent, "    return result;\n");
                 }
 
-                push(@implContent, "}\n\n");
+                push(@implContent, "}\n");
+
+                if ($conditional) {
+                    push(@implContent, "#endif\n");
+                }
+
+                push(@implContent, "\n");
             }
 
             if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
                 my $constructorFunctionName = "js" . $interfaceName . "Constructor";
 
-                push(@implContent, "JSValuePtr ${constructorFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+                push(@implContent, "JSValue ${constructorFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    return static_cast<$className*>(asObject(slot.slotBase()))->getConstructor(exec);\n");
                 push(@implContent, "}\n");
@@ -1157,7 +1209,7 @@
                      || $dataNode->extendedAttributes->{"HasCustomIndexSetter"};
 
         if ($hasSetter) {
-            push(@implContent, "void ${className}::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)\n");
+            push(@implContent, "void ${className}::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\n");
             push(@implContent, "{\n");
             if ($dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
                 push(@implContent, "    bool ok;\n");
@@ -1180,7 +1232,7 @@
             push(@implContent, "}\n\n");
 
             if ($dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
-                push(@implContent, "void ${className}::put(ExecState* exec, unsigned propertyName, JSValuePtr value)\n");
+                push(@implContent, "void ${className}::put(ExecState* exec, unsigned propertyName, JSValue value)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    indexSetter(exec, propertyName, value);\n");
                 push(@implContent, "    return;\n");
@@ -1195,7 +1247,7 @@
                         my $putFunctionName = "setJS" . $interfaceName .  $codeGenerator->WK_ucfirst($name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
                         my $implSetterFunctionName = $codeGenerator->WK_ucfirst($name);
 
-                        push(@implContent, "void ${putFunctionName}(ExecState* exec, JSObject* thisObject, JSValuePtr value)\n");
+                        push(@implContent, "void ${putFunctionName}(ExecState* exec, JSObject* thisObject, JSValue value)\n");
                         push(@implContent, "{\n");
 
                         if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !$attribute->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
@@ -1207,17 +1259,12 @@
                             push(@implContent, "        return;\n");
                         }
 
-                        if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"} || $attribute->signature->extendedAttributes->{"CustomSetter"}) {
+                        if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"} || $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCCustomSetter"}) {
                             push(@implContent, "    static_cast<$className*>(thisObject)->set$implSetterFunctionName(exec, value);\n");
                         } elsif ($type eq "EventListener") {
                             $implIncludes{"JSEventListener.h"} = 1;
+                            push(@implContent, "    UNUSED_PARAM(exec);\n");
                             push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(thisObject)->impl());\n");
-                            my $listenerType;
-                            if ($attribute->signature->extendedAttributes->{"ProtectedListener"}) {
-                                $listenerType = "JSProtectedEventListener";
-                            } else {
-                                $listenerType = "JSEventListener";
-                            }
                             if ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
                                 push(@implContent, "    JSDOMGlobalObject* globalObject = static_cast<$className*>(thisObject);\n");
                             } else {
@@ -1227,7 +1274,7 @@
                                 push(@implContent, "    if (!globalObject)\n");
                                 push(@implContent, "        return;\n");
                             }
-                            push(@implContent, "    imp->set$implSetterFunctionName(globalObject->findOrCreate${listenerType}(exec, value, true));\n");
+                            push(@implContent, "    imp->set$implSetterFunctionName(globalObject->createJSAttributeEventListener(value));\n");
                         } elsif ($attribute->signature->type =~ /Constructor$/) {
                             my $constructorType = $attribute->signature->type;
                             $constructorType =~ s/Constructor$//;
@@ -1284,7 +1331,7 @@
     }
 
     if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
-        push(@implContent, "JSValuePtr ${className}::getConstructor(ExecState* exec)\n{\n");
+        push(@implContent, "JSValue ${className}::getConstructor(ExecState* exec)\n{\n");
         push(@implContent, "    return getDOMConstructor<${className}Constructor>(exec);\n");
         push(@implContent, "}\n\n");
     }
@@ -1297,14 +1344,14 @@
             my $functionName = $codeGenerator->WK_lcfirst($className) . "PrototypeFunction" . $codeGenerator->WK_ucfirst($function->signature->name);
             my $functionImplementationName = $function->signature->extendedAttributes->{"ImplementationFunction"} || $codeGenerator->WK_lcfirst($function->signature->name);
 
-            push(@implContent, "JSValuePtr ${functionName}(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)\n");
+            push(@implContent, "JSValue JSC_HOST_CALL ${functionName}(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)\n");
             push(@implContent, "{\n");
             push(@implContent, "    UNUSED_PARAM(args);\n");
 
             $implKJSInclude{"Error.h"} = 1;
 
             if ($interfaceName eq "DOMWindow") {
-                push(@implContent, "    $className* castedThisObj = toJSDOMWindow(thisValue);\n");
+                push(@implContent, "    $className* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));\n");
                 push(@implContent, "    if (!castedThisObj)\n");
                 push(@implContent, "        return throwError(exec, TypeError);\n");
             } else {
@@ -1372,15 +1419,15 @@
                     
                     if ($parameter->type eq "XPathNSResolver") {
                         push(@implContent, "    RefPtr<XPathNSResolver> customResolver;\n");
-                        push(@implContent, "    XPathNSResolver* resolver = toXPathNSResolver(args.at(exec, $paramIndex));\n");
+                        push(@implContent, "    XPathNSResolver* resolver = toXPathNSResolver(args.at($paramIndex));\n");
                         push(@implContent, "    if (!resolver) {\n");
-                        push(@implContent, "        customResolver = JSCustomXPathNSResolver::create(exec, args.at(exec, $paramIndex));\n");
+                        push(@implContent, "        customResolver = JSCustomXPathNSResolver::create(exec, args.at($paramIndex));\n");
                         push(@implContent, "        if (exec->hadException())\n");
                         push(@implContent, "            return jsUndefined();\n");
                         push(@implContent, "        resolver = customResolver.get();\n");
                         push(@implContent, "    }\n");
                     } else {
-                        push(@implContent, "    " . GetNativeTypeFromSignature($parameter) . " $name = " . JSValueToNative($parameter, "args.at(exec, $paramIndex)") . ";\n");
+                        push(@implContent, "    " . GetNativeTypeFromSignature($parameter) . " $name = " . JSValueToNative($parameter, "args.at($paramIndex)") . ";\n");
 
                         # If a parameter is "an index" and it's negative it should throw an INDEX_SIZE_ERR exception.
                         # But this needs to be done in the bindings, because the type is unsigned and the fact that it
@@ -1419,7 +1466,7 @@
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
 
             # FIXME: this casts into int to match our previous behavior which turned 0xFFFFFFFF in -1 for NodeFilter.SHOW_ALL
-            push(@implContent, "JSValuePtr ${getter}(ExecState* exec, const Identifier&, const PropertySlot&)\n");
+            push(@implContent, "JSValue ${getter}(ExecState* exec, const Identifier&, const PropertySlot&)\n");
             push(@implContent, "{\n");
             push(@implContent, "    return jsNumber(exec, static_cast<int>(" . $constant->value . "));\n");
             push(@implContent, "}\n\n");
@@ -1427,7 +1474,7 @@
     }
 
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
-        push(@implContent, "\nJSValuePtr ${className}::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+        push(@implContent, "\nJSValue ${className}::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}* thisObj = static_cast<$className*>(asObject(slot.slotBase()));\n");
         if (IndexGetterReturnsStrings($implClassName)) {
@@ -1445,11 +1492,11 @@
 
     if ((!$hasParent or $dataNode->extendedAttributes->{"GenerateToJS"}) and !UsesManualToJSImplementation($implClassName)) {
         if ($podType) {
-            push(@implContent, "JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<$podType>* object, SVGElement* context)\n");
+            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<$podType>* object, SVGElement* context)\n");
         } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-             push(@implContent, "JSC::JSValuePtr toJS(JSC::ExecState* exec, $implType* object, SVGElement* context)\n");
+             push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, $implType* object, SVGElement* context)\n");
         } else {
-            push(@implContent, "JSC::JSValuePtr toJS(JSC::ExecState* exec, $implType* object)\n");
+            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, $implType* object)\n");
         }
 
         push(@implContent, "{\n");
@@ -1465,9 +1512,9 @@
 
     if ((!$hasParent or $dataNode->extendedAttributes->{"GenerateNativeConverter"}) and !$dataNode->extendedAttributes->{"CustomNativeConverter"}) {
         if ($podType) {
-            push(@implContent, "$podType to${interfaceName}(JSC::JSValuePtr value)\n");
+            push(@implContent, "$podType to${interfaceName}(JSC::JSValue value)\n");
         } else {
-            push(@implContent, "$implClassName* to${interfaceName}(JSC::JSValuePtr value)\n");
+            push(@implContent, "$implClassName* to${interfaceName}(JSC::JSValue value)\n");
         }
 
         push(@implContent, "{\n");
@@ -1516,7 +1563,7 @@
 
         push(@implContent, $indent . "return jsUndefined();\n");
     } else {
-        push(@implContent, "\n" . $indent . "JSC::JSValuePtr result = " . NativeToJSValue($function->signature, 1, $implClassName, "", $functionString, "castedThisObj") . ";\n");
+        push(@implContent, "\n" . $indent . "JSC::JSValue result = " . NativeToJSValue($function->signature, 1, $implClassName, "", $functionString, "castedThisObj") . ";\n");
         push(@implContent, $indent . "setDOMException(exec, ec);\n") if @{$function->raisesExceptions};
 
         if ($podType and not $function->signature->extendedAttributes->{"Immutable"}) {
@@ -1687,10 +1734,6 @@
         $implIncludes{"CSSMutableStyleDeclaration.h"} = 1;
     }
 
-    if ($type eq "NamedNodeMap") {
-        $implIncludes{"NamedAttrMap.h"} = 1;
-    }
-
     if ($type eq "NodeList") {
         $implIncludes{"NameNodeList.h"} = 1;
     }
@@ -1748,6 +1791,7 @@
     my $specials = shift;
     my $value1 = shift;
     my $value2 = shift;
+    my $conditionals = shift;
 
     # Generate size data for two hash tables
     # - The 'perfect' size makes a table large enough for perfect hashing
@@ -1832,7 +1876,19 @@
     push(@implContent, "\nstatic const HashTableValue $nameEntries\[$count\] =\n\{\n");
     $i = 0;
     foreach my $key (@{$keys}) {
+        my $conditional;
+
+        if ($conditionals) {
+            $conditional = $conditionals->{$key};
+        }
+        if ($conditional) {
+            my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+            push(@implContent, "#if ${conditionalString}\n");
+        }
         push(@implContent, "    { \"$key\", @$specials[$i], (intptr_t)@$value1[$i], (intptr_t)@$value2[$i] },\n");
+        if ($conditional) {
+            push(@implContent, "#endif\n");
+        }
         ++$i;
     }
     push(@implContent, "    { 0, 0, 0, 0 }\n");
@@ -1963,13 +2019,13 @@
     ${className}Constructor(ExecState* exec)
         : DOMObject(${className}Constructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec), None);
+        putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
diff --git a/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 5ec960e..fc265f9 100644
--- a/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -3,7 +3,7 @@
 # Copyright (C) 2006 Anders Carlsson <andersca@mac.com> 
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
-# Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+# Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -33,7 +33,6 @@
 my $interfaceAvailabilityVersion = "";
 my $isProtocol = 0;
 my $noImpl = 0;
-my @ivars = ();
 
 my @headerContentHeader = ();
 my @headerContent = ();
@@ -130,10 +129,10 @@
 
 my $fatalError = 0;
 
-# Default Licence Templates
-my $headerLicenceTemplate = << "EOF";
+# Default License Templates
+my $headerLicenseTemplate = << "EOF";
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig\@gmail.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -159,7 +158,7 @@
  */
 EOF
 
-my $implementationLicenceTemplate = << "EOF";
+my $implementationLicenseTemplate = << "EOF";
 /*
  * This file is part of the WebKit open source project.
  * This file has been generated by generate-bindings.pl. DO NOT MODIFY!
@@ -218,7 +217,7 @@
 
     my $fileName = "WebCore/bindings/objc/PublicDOMInterfaces.h";
     open FILE, "-|", "/usr/bin/gcc", "-E", "-P", "-x", "objective-c", 
-        (map { "-D$_" } split(/ /, $defines)), "-DOBJC_CODE_GENERATION", $fileName or die "Could not open $fileName";
+        (map { "-D$_" } split(/ +/, $defines)), "-DOBJC_CODE_GENERATION", $fileName or die "Could not open $fileName";
     my @documentContent = <FILE>;
     close FILE;
 
@@ -455,47 +454,24 @@
 
     push(@attributes, "readonly") if $readOnly;
 
-#    FIXME: uncomment these lines once <rdar://problem/4996504> is fixed.
-#    unless ($readOnly) {
-        if ($codeGenerator->IsStringType($type) || IsNativeObjCType($type)) {
-            push(@attributes, "copy");
-        } elsif ($codeGenerator->IsPodType($type) || $codeGenerator->IsSVGAnimatedType($type)) {
-            push(@attributes, "retain");
-        } elsif (!$codeGenerator->IsStringType($type) && !$codeGenerator->IsPrimitiveType($type) && $type ne "DOMTimeStamp" && $type ne "CompareHow" && $type ne "SVGPaintType") {
-            push(@attributes, "retain");
-        }
-#    }
+    # FIXME: <rdar://problem/5049934> Consider using 'nonatomic' on the DOM @property declarations.
+    if ($codeGenerator->IsStringType($type) || IsNativeObjCType($type)) {
+        push(@attributes, "copy");
+    } elsif ($codeGenerator->IsPodType($type) || $codeGenerator->IsSVGAnimatedType($type)) {
+        push(@attributes, "retain");
+    } elsif (!$codeGenerator->IsStringType($type) && !$codeGenerator->IsPrimitiveType($type) && $type ne "DOMTimeStamp" && $type ne "CompareHow" && $type ne "SVGPaintType") {
+        push(@attributes, "retain");
+    }
 
     return "" unless @attributes > 0;
     return "(" . join(", ", @attributes) . ")";
 }
 
-sub GetObjCTypeMaker
+sub ConversionNeeded
 {
     my $type = $codeGenerator->StripModule(shift);
 
-    return "" if $codeGenerator->IsNonPointerType($type) or $codeGenerator->IsStringType($type) or IsNativeObjCType($type);
-    return "_wrapAbstractView" if $type eq "DOMWindow";
-    return "_wrap$type";
-}
-
-sub GetObjCTypeGetterName
-{
-    my $type = $codeGenerator->StripModule(shift);
-
-    my $typeGetter = "";
-    if ($type =~ /^(HTML|CSS|SVG)/ or $type eq "DOMImplementation" or $type eq "CDATASection" or $type eq "RGBColor") {
-        $typeGetter = $type;
-    } elsif ($type =~ /^XPath(.+)/) {
-        $typeGetter = "xpath" . $1;
-    } elsif ($type eq "DOMWindow") {
-        $typeGetter = "abstractView";
-    } else {
-        $typeGetter = lcfirst($type);
-    }
-
-    # put into the form "_fooBar" for type FooBar.
-    return "_" . $typeGetter;
+    return !$codeGenerator->IsNonPointerType($type) && !$codeGenerator->IsStringType($type) && !IsNativeObjCType($type);
 }
 
 sub GetObjCTypeGetter
@@ -507,65 +483,10 @@
     return $argName . "Node" if $type eq "EventTarget";
     return "static_cast<WebCore::Range::CompareHow>($argName)" if $type eq "CompareHow";
     return "static_cast<WebCore::SVGPaint::SVGPaintType>($argName)" if $type eq "SVGPaintType";
-
-    my $typeGetterMethodName = GetObjCTypeGetterName($type);
-
     return "WTF::getPtr(nativeEventListener)" if $type eq "EventListener";
     return "WTF::getPtr(nativeNodeFilter)" if $type eq "NodeFilter";
     return "WTF::getPtr(nativeResolver)" if $type eq "XPathNSResolver";
-    return "[$argName $typeGetterMethodName]";
-}
-
-sub GetInternalTypeGetterSignature
-{
-    my ($interfaceName, $podType) = @_;
-
-    my $implClassNameWithNamespace = "WebCore::" . GetImplClassName($interfaceName);
-    my $podTypeWithNamespace;
-    if ($podType) {
-        $podTypeWithNamespace = ($podType eq "float") ? "$podType" : "WebCore::$podType";
-    }
-
-    # - Type-Getter
-    # - (WebCore::FooBar *)_fooBar for implementation class FooBar
-    my $typeGetterName = GetObjCTypeGetterName($interfaceName);
-    return "- " . ($podType ? "($podTypeWithNamespace)" : "($implClassNameWithNamespace *)") . $typeGetterName;
-}
-
-sub GetInternalTypeMakerSignature
-{
-    my ($interfaceName, $podType) = @_;
-
-    my $className = GetClassName($interfaceName);
-    my $implClassNameWithNamespace = "WebCore::" . GetImplClassName($interfaceName);
-    my $podTypeWithNamespace;
-    if ($podType) {
-        $podTypeWithNamespace = ($podType eq "float") ? "$podType" : "WebCore::$podType";
-    }
- 
-    my @ivarsToRetain = ();
-    my $ivarsToInit = "";
-    my $typeMakerSigAddition = "";
-    if (@ivars > 0) {
-        my @ivarsInitSig = ();
-        my @ivarsInitCall = ();
-        foreach $attribute (@ivars) {
-            my $name = $attribute->signature->name;
-            my $memberName = "m_" . $name;
-            my $varName = "in" . $name;
-            my $type = GetObjCType($attribute->signature->type);
-            push(@ivarsInitSig, "$name:($type)$varName");
-            push(@ivarsInitCall, "$name:$varName");
-            push(@ivarsToRetain, "    $memberName = [$varName retain];\n");
-        }
-        $ivarsToInit = " " . join(" ", @ivarsInitCall);
-        $typeMakerSigAddition = " " . join(" ", @ivarsInitSig);
-    }
-
-    my $typeMakerName = GetObjCTypeMaker($interfaceName);
-    return ("+ ($className *)$typeMakerName:(" . ($podType ? "$podTypeWithNamespace" : "$implClassNameWithNamespace *") . ")impl" . $typeMakerSigAddition,
-            $typeMakerSigAddition,
-            $ivarsToInit);
+    return "core($argName)";
 }
 
 sub AddForwardDeclarationsForType
@@ -602,77 +523,89 @@
     }
 
     if ($type eq "RGBColor") {
-        $implIncludes{"Color.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMRGBColorInternal.h"} = 1;
         return;
     }
 
     if ($type eq "DOMWindow") {
-        $implIncludes{"DOMAbstractView.h"} = 1;
-        $implIncludes{"$type.h"} = 1;
+        $implIncludes{"DOMAbstractViewInternal.h"} = 1;
+        $implIncludes{"DOMWindow.h"} = 1;
         return;
     }
 
     if ($type eq "DOMImplementation") {
+        $implIncludes{"DOMDOMImplementationInternal.h"} = 1;
         $implIncludes{"DOMImplementationFront.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
         return;
     }
 
     if ($type eq "EventTarget") {
         $implIncludes{"Node.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMEventTarget.h"} = 1;
         return;
     }
 
     if ($codeGenerator->IsSVGAnimatedType($type)) {
         $implIncludes{"SVGAnimatedTemplate.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOM${type}Internal.h"} = 1;
         return;
     }
 
     if ($type eq "SVGRect") {
         $implIncludes{"FloatRect.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGRectInternal.h"} = 1;
         return;
     }
 
     if ($type eq "SVGPoint") {
         $implIncludes{"FloatPoint.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGPointInternal.h"} = 1;
         return;
     }
 
     if ($type eq "SVGMatrix") {
         $implIncludes{"TransformationMatrix.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGMatrixInternal.h"} = 1;
         $implIncludes{"SVGException.h"} = 1;
         return;
     }
 
     if ($type eq "SVGNumber") {
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGNumberInternal.h"} = 1;
         return;
     }
 
     if ($type =~ /(\w+)(Abs|Rel)$/) {
         $implIncludes{"$1.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOM${type}Internal.h"} = 1;
         return;
     }
 
-    $implIncludes{"ObjCEventListener.h"} = 1 if $type eq "EventListener";
-    $implIncludes{"ObjCNodeFilterCondition.h"} = 1 if $type eq "NodeFilter";
-    $implIncludes{"DOMCustomXPathNSResolver.h"} = 1 if $type eq "XPathNSResolver";
+    if ($type eq "NodeFilter") {
+        $implIncludes{"NodeFilter.h"} = 1;
+        $implIncludes{"ObjCNodeFilterCondition.h"} = 1;
+        return;
+    }
+
+    if ($type eq "EventListener") {
+        $implIncludes{"EventListener.h"} = 1;
+        $implIncludes{"ObjCEventListener.h"} = 1;
+        return;
+    }
+
+    if ($type eq "XPathNSResolver") {
+        $implIncludes{"DOMCustomXPathNSResolver.h"} = 1;
+        $implIncludes{"XPathNSResolver.h"} = 1;
+        return;
+    }
 
     # FIXME: won't compile without these
     $implIncludes{"CSSMutableStyleDeclaration.h"} = 1 if $type eq "CSSStyleDeclaration";
-    $implIncludes{"NamedAttrMap.h"} = 1 if $type eq "NamedNodeMap";
     $implIncludes{"NameNodeList.h"} = 1 if $type eq "NodeList";
 
     # Default, include the same named file (the implementation) and the same name prefixed with "DOM". 
     $implIncludes{"$type.h"} = 1;
-    $implIncludes{"DOM$type.h"} = 1;
+    $implIncludes{"DOM${type}Internal.h"} = 1;
 }
 
 sub GenerateHeader
@@ -692,7 +625,7 @@
     my $numFunctions = @{$dataNode->functions};
 
     # - Add default header template
-    @headerContentHeader = split("\r", $headerLicenceTemplate);
+    @headerContentHeader = split("\r", $headerLicenseTemplate);
     push(@headerContentHeader, "\n");
 
     # - INCLUDES -
@@ -759,23 +692,6 @@
 
     # - Add attribute getters/setters.
     if ($numAttributes > 0) {
-        # Add ivars, if any, first
-        @ivars = ();
-        foreach my $attribute (@{$dataNode->attributes}) {
-            push(@ivars, $attribute) if $attribute->signature->extendedAttributes->{"ObjCIvar"};
-        }
-
-        if (@ivars > 0) {
-            push(@headerContent, "{\n");
-            foreach my $attribute (@ivars) {
-                my $type = GetObjCType($attribute->signature->type);
-                my $name = "m_" . $attribute->signature->name;
-                my $ivarDeclaration = "$type $name";
-                push(@headerContent, "    $ivarDeclaration;\n");
-            }
-            push(@headerContent, "}\n");
-        }
-
         foreach my $attribute (@{$dataNode->attributes}) {
             my $attributeName = $attribute->signature->name;
 
@@ -971,7 +887,7 @@
 
     if (@privateHeaderAttributes > 0 or @privateHeaderFunctions > 0 or exists $alwaysGenerateForNoSVGBuild{$className}) {
         # - Private category @interface
-        @privateHeaderContentHeader = split("\r", $headerLicenceTemplate);
+        @privateHeaderContentHeader = split("\r", $headerLicenseTemplate);
         push(@privateHeaderContentHeader, "\n");
 
         my $classHeaderName = GetClassHeaderName($className);
@@ -991,45 +907,66 @@
     unless ($isProtocol) {
         # Generate internal interfaces
         my $podType = $dataNode->extendedAttributes->{"PODType"};
-        my $typeGetterSig = GetInternalTypeGetterSignature($interfaceName, $podType);
-        my ($typeMakerSig, $typeMakerSigAddition, $ivarsToInit) = GetInternalTypeMakerSignature($interfaceName, $podType);
 
         # Generate interface definitions. 
-        @internalHeaderContent = split("\r", $implementationLicenceTemplate);
+        @internalHeaderContent = split("\r", $implementationLicenseTemplate);
 
         push(@internalHeaderContent, "\n#import <WebCore/$className.h>\n\n");
         push(@internalHeaderContent, $interfaceAvailabilityVersionCheck) if length $interfaceAvailabilityVersion;
 
-        if ($interfaceName eq "Node" or $interfaceName eq "SVGElementInstance") {
+        if ($interfaceName eq "Node") {
             push(@internalHeaderContent, "\@protocol DOMEventTarget;\n\n");
         }
 
+        my $startedNamespace = 0;
+
+        my $implClassName = GetImplClassName($interfaceName);
+
         if ($codeGenerator->IsSVGAnimatedType($interfaceName)) {
             push(@internalHeaderContent, "#import <WebCore/SVGAnimatedTemplate.h>\n\n");
         } elsif ($interfaceName eq "RGBColor") {
             push(@internalHeaderContent, "#import <WebCore/Color.h>\n\n");
         } else {
+            push(@internalHeaderContent, "namespace WebCore {\n");
+            $startedNamespace = 1;
             if ($podType and $podType ne "float") {
-                push(@internalHeaderContent, "namespace WebCore { class $podType; }\n\n");
+                push(@internalHeaderContent, "    class $podType;\n");
             } elsif ($interfaceName eq "Node") {
-                push(@internalHeaderContent, "namespace WebCore { class Node; class EventTarget; }\n\n");
-            } elsif ($interfaceName eq "SVGElementInstance") {
-                push(@internalHeaderContent, "namespace WebCore { class SVGElementInstance; class EventTarget; }\n\n");
+                push(@internalHeaderContent, "    class EventTarget;\n    class Node;\n");
             } else {
-                my $implClassName = GetImplClassName($interfaceName);
-                push(@internalHeaderContent, "namespace WebCore { class $implClassName; }\n\n");
+                push(@internalHeaderContent, "    class $implClassName;\n");
             }
+            push(@internalHeaderContent, "}\n\n");
         }
 
-        push(@internalHeaderContent, "\@interface $className (WebCoreInternal)\n");
-        push(@internalHeaderContent, $typeGetterSig . ";\n");
-        push(@internalHeaderContent, $typeMakerSig . ";\n");
-
-        if ($interfaceName eq "Node" or $interfaceName eq "SVGElementInstance") {
-            push(@internalHeaderContent, "+ (id <DOMEventTarget>)_wrapEventTarget:(WebCore::EventTarget *)eventTarget;\n");
+        if ($podType) {
+            if ($podType eq "float") {
+                push(@internalHeaderContent, "float core($className *);\n");
+            } else {
+                push(@internalHeaderContent, "WebCore::$podType core($className *);\n");
+            }
+        } else {
+            push(@internalHeaderContent, "WebCore::$implClassName* core($className *);\n");
         }
 
-        push(@internalHeaderContent, "\@end\n");
+        if ($podType) {
+            if ($podType eq "float") {
+                push(@internalHeaderContent, "$className *kit($podType);\n");
+            } else {
+                push(@internalHeaderContent, "$className *kit(WebCore::$podType);\n");
+            }
+        } else {
+            push(@internalHeaderContent, "$className *kit(WebCore::$implClassName*);\n");
+        }
+
+        if ($dataNode->extendedAttributes->{Polymorphic}) {
+            push(@internalHeaderContent, "Class kitClass(WebCore::$implClassName*);\n");
+        }
+
+        if ($interfaceName eq "Node") {
+            push(@internalHeaderContent, "id <DOMEventTarget> kit(WebCore::EventTarget*);\n");
+        }
+
         push(@internalHeaderContent, "\n#endif\n") if length $interfaceAvailabilityVersion;
     }
 }
@@ -1063,7 +1000,7 @@
     }
 
     # - Add default header template.
-    @implContentHeader = split("\r", $implementationLicenceTemplate);
+    @implContentHeader = split("\r", $implementationLicenseTemplate);
 
     # - INCLUDES -
     push(@implContentHeader, "\n#import \"config.h\"\n");
@@ -1071,13 +1008,25 @@
     my $conditionalString;
     if ($conditional) {
         $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
-        push(@implContentHeader, "\n#if ${conditionalString}\n");
+        push(@implContentHeader, "\n#if ${conditionalString}\n\n");
     }
 
-    push(@implContentHeader, "\n#import \"$classHeaderName.h\"\n\n");
+    push(@implContentHeader, "#import \"DOMInternal.h\"\n\n");
+    push(@implContentHeader, "#import \"$classHeaderName.h\"\n\n");
 
-    push(@implContentHeader, "#import \"ThreadCheck.h\"\n");
-    push(@implContentHeader, "#import <wtf/GetPtr.h>\n\n");
+    $implIncludes{"ExceptionHandlers.h"} = 1;
+    $implIncludes{"ThreadCheck.h"} = 1;
+    $implIncludes{"WebScriptObjectPrivate.h"} = 1;
+    $implIncludes{$classHeaderName . "Internal.h"} = 1;
+
+    # FIXME: These includes are only needed when the class is a subclass of one of these polymorphic classes.
+    $implIncludes{"DOMCSSRuleInternal.h"} = 1;
+    $implIncludes{"DOMCSSValueInternal.h"} = 1;
+    $implIncludes{"DOMEventInternal.h"} = 1;
+    $implIncludes{"DOMNodeInternal.h"} = 1;
+    $implIncludes{"DOMStyleSheetInternal.h"} = 1;
+
+    $implIncludes{"DOMSVGPathSegInternal.h"} = 1 if $interfaceName =~ /^SVGPathSeg.+/;
 
     if ($codeGenerator->IsSVGAnimatedType($interfaceName)) {
         $implIncludes{"SVGAnimatedTemplate.h"} = 1;
@@ -1091,11 +1040,10 @@
         }
     } 
 
-    $implIncludes{"DOMInternal.h"} = 1;
-    $implIncludes{"ExceptionHandlers.h"} = 1;
-
     @implContent = ();
 
+    push(@implContent, "#import <wtf/GetPtr.h>\n\n");
+
     # add implementation accessor
     if ($podType) {
         push(@implContent, "#define IMPL reinterpret_cast<$podTypeWithNamespace*>(_internal)\n\n");
@@ -1111,18 +1059,9 @@
 
     # Only generate 'dealloc' and 'finalize' methods for direct subclasses of DOMObject.
     if ($parentImplClassName eq "Object") {
-        my @ivarsToRelease = ();
-        if (@ivars > 0) {
-            foreach $attribute (@ivars) {
-                my $name = "m_" . $attribute->signature->name;
-                push(@ivarsToRelease, "    [$name release];\n");
-            }
-        }
-
         push(@implContent, "- (void)dealloc\n");
         push(@implContent, "{\n");
         push(@implContent, "    $assertMainThread\n");
-        push(@implContent, @ivarsToRelease);
         if ($interfaceName eq "NodeIterator") {
             push(@implContent, "    if (_internal) {\n");
             push(@implContent, "        [self detach];\n");
@@ -1210,17 +1149,16 @@
             # special case for EventTarget protocol
             $attributeTypeSansPtr = "DOMNode" if $idlType eq "EventTarget";
 
-            my $typeMaker = GetObjCTypeMaker($attribute->signature->type);
-
             # Special cases
             my @customGetterContent = (); 
             if ($attributeTypeSansPtr eq "DOMImplementation") {
                 # FIXME: We have to special case DOMImplementation until DOMImplementationFront is removed
-                $getterContentHead = "[$attributeTypeSansPtr $typeMaker:implementationFront(IMPL";
-                $getterContentTail .= "]";
+                $getterContentHead = "kit(implementationFront(IMPL";
+                $getterContentTail .= ")";
             } elsif ($attributeName =~ /(\w+)DisplayString$/) {
                 my $attributeToDisplay = $1;
-                $getterContentHead = "WebCore::displayString(IMPL->$attributeToDisplay(), [self _element]";
+                $getterContentHead = "WebCore::displayString(IMPL->$attributeToDisplay(), core(self)";
+                $implIncludes{"HitTestResult.h"} = 1;
             } elsif ($attributeName =~ /^absolute(\w+)URL$/) {
                 my $typeOfURL = $1;
                 $getterContentHead = "[self _getURLAttribute:";
@@ -1245,15 +1183,14 @@
             } elsif ($attribute->signature->extendedAttributes->{"ConvertFromString"}) {
                 $getterContentTail .= ".toInt()";
             } elsif ($codeGenerator->IsPodType($idlType)) {
-                $getterContentHead = "[$attributeTypeSansPtr $typeMaker:" . $getterContentHead;
-                $getterContentTail .= "]";
+                $getterContentHead = "kit($getterContentHead";
+                $getterContentTail .= ")";
             } elsif (IsProtocolType($idlType) and $idlType ne "EventTarget") {
-                $getterContentHead = "[$attributeClassName $typeMaker:WTF::getPtr(" . $getterContentHead;
-                $getterContentTail .= ")]";
-            } elsif ($typeMaker ne "") {
-                # Surround getter with TypeMaker
-                $getterContentHead = "[$attributeTypeSansPtr $typeMaker:WTF::getPtr(" . $getterContentHead;
-                $getterContentTail .= ")]";
+                $getterContentHead = "kit($getterContentHead";
+                $getterContentTail .= ")";
+            } elsif (ConversionNeeded($attribute->signature->type)) {
+                $getterContentHead = "kit(WTF::getPtr($getterContentHead";
+                $getterContentTail .= "))";
             }
 
             my $getterContent;
@@ -1390,7 +1327,7 @@
                 push(@functionContent, "    RefPtr<WebCore::XPathNSResolver> customResolver;\n");
                 push(@functionContent, "    if ($paramName) {\n");
                 push(@functionContent, "        if ([$paramName isMemberOfClass:[DOMNativeXPathNSResolver class]])\n");
-                push(@functionContent, "            nativeResolver = [(DOMNativeXPathNSResolver *)$paramName _xpathNSResolver];\n");
+                push(@functionContent, "            nativeResolver = core(static_cast<DOMNativeXPathNSResolver *>($paramName));\n");
                 push(@functionContent, "        else {\n");
                 push(@functionContent, "            customResolver = WebCore::DOMCustomXPathNSResolver::create($paramName);\n");
                 push(@functionContent, "            nativeResolver = WTF::getPtr(customResolver);\n");
@@ -1402,7 +1339,7 @@
             if (defined $needsCustom{"EventTarget"}) {
                 my $paramName = $needsCustom{"EventTarget"};
                 push(@functionContent, "    DOMNode* ${paramName}ObjC = $paramName;\n");
-                push(@functionContent, "    WebCore::Node* ${paramName}Node = [${paramName}ObjC _node];\n");
+                push(@functionContent, "    WebCore::Node* ${paramName}Node = core(${paramName}ObjC);\n");
                 $implIncludes{"DOMNode.h"} = 1;
                 $implIncludes{"Node.h"} = 1;
             }
@@ -1443,14 +1380,14 @@
                 push(@functionContent, "    if (x == 0.0 || y == 0.0)\n");
                 push(@functionContent, "        ec = WebCore::SVGException::SVG_INVALID_VALUE_ERR;\n");
                 push(@functionContent, "    $exceptionRaiseOnError\n");
-                push(@functionContent, "    return [DOMSVGMatrix _wrapSVGMatrix:$content];\n");
+                push(@functionContent, "    return kit($content);\n");
             } elsif ($svgMatrixInverse) {
                 # Special case with inverse & SVGMatrix
                 push(@functionContent, "    $exceptionInit\n");
                 push(@functionContent, "    if (!$caller->isInvertible())\n");
                 push(@functionContent, "        ec = WebCore::SVGException::SVG_MATRIX_NOT_INVERTABLE;\n");
                 push(@functionContent, "    $exceptionRaiseOnError\n");
-                push(@functionContent, "    return [DOMSVGMatrix _wrapSVGMatrix:$content];\n");
+                push(@functionContent, "    return kit($content);\n");
             } elsif ($svgLengthConvertToSpecifiedUnits) {
                 push(@functionContent, "    IMPL->convertToSpecifiedUnits(inUnitType, 0 /* FIXME */);\n");
             } elsif ($returnType eq "void") {
@@ -1478,26 +1415,11 @@
                     push(@functionContent, "    return nil;\n");
                 }
             } else {
-                my $typeMaker = GetObjCTypeMaker($function->signature->type);
-                unless ($typeMaker eq "") {
-                    my $returnTypeClass = "";
-                    if ($function->signature->type eq "XPathNSResolver") {
-                        # Special case XPathNSResolver
-                        $returnTypeClass = "DOMNativeXPathNSResolver";
+                if (ConversionNeeded($function->signature->type)) {
+                    if ($codeGenerator->IsPodType($function->signature->type)) {
+                        $content = "kit($content)";
                     } else {
-                        # Remove trailing " *" from pointer types.
-                        $returnTypeClass = $returnType;
-                        $returnTypeClass =~ s/ \*$//;
-                    }
-
-                    # Surround getter with TypeMaker
-                    my $idlType = $returnTypeClass;
-                    $idlType =~ s/^DOM//;
-
-                    if ($codeGenerator->IsPodType($idlType)) {
-                        $content = "[$returnTypeClass $typeMaker:" . $content . "]";
-                    } else {
-                        $content = "[$returnTypeClass $typeMaker:WTF::getPtr(" . $content . ")]";
+                        $content = "kit(WTF::getPtr($content))";
                     }
                 }
 
@@ -1544,87 +1466,55 @@
     push(@implContent, "\@end\n");
 
     # Generate internal interfaces
-    unless ($dataNode->extendedAttributes->{ObjCCustomInternalImpl}) {
-        # - BEGIN WebCoreInternal category @implementation
-        push(@implContent, "\n\@implementation $className (WebCoreInternal)\n\n");
-
-        my $typeGetterSig = GetInternalTypeGetterSignature($interfaceName, $podType);
-        push(@implContent, "$typeGetterSig\n");
+    if ($podType) {
+        my $prefixedPodType = $podType eq "float" ? $podType : "WebCore::$podType";
+        push(@implContent, "\n$prefixedPodType core($className *wrapper)\n");
         push(@implContent, "{\n");
-
-        if ($podType) {
-            push(@implContent, "    return *IMPL;\n");
-        } else {
-            push(@implContent, "    return IMPL;\n");
-        }
-
+        push(@implContent, "    return wrapper ? *reinterpret_cast<$prefixedPodType*>(wrapper->_internal) : $prefixedPodType();\n");
         push(@implContent, "}\n\n");
+    } else {
+        push(@implContent, "\nWebCore::$implClassName* core($className *wrapper)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    return wrapper ? reinterpret_cast<WebCore::$implClassName*>(wrapper->_internal) : 0;\n");
+        push(@implContent, "}\n\n");
+    }
 
-        my ($typeMakerSig, $typeMakerSigAddition, $ivarsToInit) = GetInternalTypeMakerSignature($interfaceName, $podType);
-
-        if ($podType) {
-            # - (id)_initWithFooBar:(WebCore::FooBar)impl for implementation class FooBar
-            my $initWithImplName = "_initWith" . $implClassName;
-            my $initWithSig = "- (id)$initWithImplName:($podTypeWithNamespace)impl" . $typeMakerSigAddition;
-
-            # FIXME: Implement Caching
-            push(@implContent, "$initWithSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    [super _init];\n");
-            push(@implContent, "    $podTypeWithNamespace* _impl = new $podTypeWithNamespace(impl);\n");
-            push(@implContent, "    _internal = reinterpret_cast<DOMObjectInternal*>(_impl);\n");
-            push(@implContent, "    return self;\n");
-            push(@implContent, "}\n\n");
-
-            # - (DOMFooBar)_wrapFooBar:(WebCore::FooBar)impl for implementation class FooBar
-            push(@implContent, "$typeMakerSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    return [[[self alloc] $initWithImplName:impl] autorelease];\n");
-            push(@implContent, "}\n\n");
-        } elsif ($parentImplClassName eq "Object") {        
-            # - (id)_initWithFooBar:(WebCore::FooBar *)impl for implementation class FooBar
-            my $initWithImplName = "_initWith" . $implClassName;
-            my $initWithSig = "- (id)$initWithImplName:($implClassNameWithNamespace *)impl" . $typeMakerSigAddition;
-
-            push(@implContent, "$initWithSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    [super _init];\n");
-            push(@implContent, "    _internal = reinterpret_cast<DOMObjectInternal*>(impl);\n");
-            push(@implContent, "    impl->ref();\n");
-            push(@implContent, "    WebCore::addDOMWrapper(self, impl);\n");
-            push(@implContent, @ivarsToRetain);
-            push(@implContent, "    return self;\n");
-            push(@implContent, "}\n\n");
-
-            # - (DOMFooBar)_wrapFooBar:(WebCore::FooBar *)impl for implementation class FooBar
-            push(@implContent, "$typeMakerSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    if (!impl)\n");
+    if ($podType) {
+        # FIXME: Implement caching.
+        my $prefixedPodType = $podType eq "float" ? $podType : "WebCore::$podType";
+        push(@implContent, "$className *kit($prefixedPodType value)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    $assertMainThread;\n");
+        push(@implContent, "    $className *wrapper = [[$className alloc] _init];\n");
+        push(@implContent, "    wrapper->_internal = reinterpret_cast<DOMObjectInternal*>(new $prefixedPodType(value));\n");
+        push(@implContent, "    return [wrapper autorelease];\n");
+        push(@implContent, "}\n");
+    } elsif ($parentImplClassName eq "Object") {        
+        push(@implContent, "$className *kit(WebCore::$implClassName* value)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    $assertMainThread;\n");
+        push(@implContent, "    if (!value)\n");
+        push(@implContent, "        return nil;\n");
+        push(@implContent, "    if ($className *wrapper = getDOMWrapper(value))\n");
+        push(@implContent, "        return [[wrapper retain] autorelease];\n");
+        if ($dataNode->extendedAttributes->{Polymorphic}) {
+            push(@implContent, "    $className *wrapper = [[kitClass(value) alloc] _init];\n");
+            push(@implContent, "    if (!wrapper)\n");
             push(@implContent, "        return nil;\n");
-            push(@implContent, "    id cachedInstance;\n");
-            push(@implContent, "    cachedInstance = WebCore::getDOMWrapper(impl);\n");
-            push(@implContent, "    if (cachedInstance)\n");
-            push(@implContent, "        return [[cachedInstance retain] autorelease];\n");
-            push(@implContent, "    return [[[self alloc] $initWithImplName:impl" . $ivarsToInit . "] autorelease];\n");
-            push(@implContent, "}\n\n");
         } else {
-            my $internalBaseType = "DOM$baseClass";
-            my $internalBaseTypeMaker = GetObjCTypeMaker($baseClass);
-
-            # - (DOMFooBar)_wrapFooBar:(WebCore::FooBar *)impl for implementation class FooBar
-            push(@implContent, "$typeMakerSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    return static_cast<$className*>([$internalBaseType $internalBaseTypeMaker:impl]);\n");
-            push(@implContent, "}\n\n");
+            push(@implContent, "    $className *wrapper = [[$className alloc] _init];\n");
         }
-
-        # END WebCoreInternal category
-        push(@implContent, "\@end\n");
+        push(@implContent, "    wrapper->_internal = reinterpret_cast<DOMObjectInternal*>(value);\n");
+        push(@implContent, "    value->ref();\n");
+        push(@implContent, "    addDOMWrapper(wrapper, value);\n");
+        push(@implContent, "    return [wrapper autorelease];\n");
+        push(@implContent, "}\n");
+    } else {
+        push(@implContent, "$className *kit(WebCore::$implClassName* value)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    $assertMainThread;\n");
+        push(@implContent, "    return static_cast<$className*>(kit(static_cast<WebCore::$baseClass*>(value)));\n");
+        push(@implContent, "}\n");
     }
 
     # - End the ifdef conditional if necessary
@@ -1692,8 +1582,6 @@
 
         print IMPL @implContentHeader;
         print IMPL map { "#import \"$_\"\n" } sort keys(%implIncludes);
-
-        print IMPL "\n" if keys(%implIncludes);
         print IMPL @implContent;
 
         close(IMPL);
diff --git a/WebCore/bindings/v8/ScheduledAction.cpp b/WebCore/bindings/v8/ScheduledAction.cpp
index 7c71d00..ab51600 100644
--- a/WebCore/bindings/v8/ScheduledAction.cpp
+++ b/WebCore/bindings/v8/ScheduledAction.cpp
@@ -34,9 +34,13 @@
 #include "Document.h"
 #include "ScriptExecutionContext.h"
 #include "ScriptSourceCode.h"
+#include "ScriptValue.h"
 
 #include "V8Binding.h"
 #include "V8Proxy.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
+#include "WorkerThread.h"
 
 namespace WebCore {
 
@@ -86,10 +90,20 @@
 
 void ScheduledAction::execute(ScriptExecutionContext* context)
 {
-    // FIXME: Timeouts for running the javascript code are not set.
     V8Proxy* proxy = V8Proxy::retrieve(context);
-    if (!proxy)
-        return;
+    if (proxy)
+        execute(proxy);
+#if ENABLE(WORKERS)
+    else {
+        ASSERT(context->isWorkerContext());
+        execute(static_cast<WorkerContext*>(context));
+    }
+#endif
+}
+
+void ScheduledAction::execute(V8Proxy* proxy)
+{
+    ASSERT(proxy);
 
     v8::HandleScope handleScope;
     v8::Local<v8::Context> v8Context = proxy->GetContext();
@@ -100,15 +114,33 @@
 
     proxy->setTimerCallback(true);
 
-    if (!m_function.IsEmpty() && m_function->IsFunction())
+    // FIXME: Need to implement timeouts for preempting a long-running script.
+    if (!m_function.IsEmpty() && m_function->IsFunction()) {
         proxy->CallFunction(v8::Persistent<v8::Function>::Cast(m_function), v8Context->Global(), m_argc, m_argv);
-    else
+        Document::updateStyleForAllDocuments();
+    } else
         proxy->evaluate(m_code, 0);
 
-    if (context->isDocument())
-        static_cast<Document*>(context)->updateRendering();
-
     proxy->setTimerCallback(false);
 }
 
+#if ENABLE(WORKERS)
+void ScheduledAction::execute(WorkerContext* workerContext)
+{
+    // In a Worker, the execution should always happen on a worker thread.
+    ASSERT(workerContext->thread()->threadID() == currentThread());
+  
+    WorkerScriptController* scriptController = workerContext->script();
+
+    if (!m_function.IsEmpty() && m_function->IsFunction()) {
+        v8::HandleScope handleScope;
+        v8::Local<v8::Context> v8Context = scriptController->proxy()->GetContext();
+        ASSERT(!v8Context.IsEmpty());
+        v8::Context::Scope scope(v8Context);
+        m_function->Call(v8Context->Global(), m_argc, m_argv);
+    } else
+        scriptController->evaluate(m_code);
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/ScheduledAction.h b/WebCore/bindings/v8/ScheduledAction.h
index da6cb02..53694c7 100644
--- a/WebCore/bindings/v8/ScheduledAction.h
+++ b/WebCore/bindings/v8/ScheduledAction.h
@@ -39,14 +39,16 @@
 
     class String;
     class ScriptExecutionContext;
+    class V8Proxy;
+    class WorkerContext;
 
     class ScheduledAction {
     public:
         ScheduledAction(v8::Handle<v8::Function>, int argc, v8::Handle<v8::Value> argv[]);
-        explicit ScheduledAction(const WebCore::String& code)
+        explicit ScheduledAction(const WebCore::String& code, const KURL& url = KURL())
             : m_argc(0)
             , m_argv(0)
-            , m_code(code)
+            , m_code(code, url)
         {
         }
 
@@ -54,6 +56,11 @@
         virtual void execute(ScriptExecutionContext*);
 
     private:
+        void execute(V8Proxy*);
+#if ENABLE(WORKERS)
+        void execute(WorkerContext*);
+#endif
+
         v8::Persistent<v8::Function> m_function;
         int m_argc;
         v8::Persistent<v8::Value>* m_argv;
diff --git a/WebCore/bindings/v8/ScriptController.cpp b/WebCore/bindings/v8/ScriptController.cpp
new file mode 100644
index 0000000..9ecf3ab
--- /dev/null
+++ b/WebCore/bindings/v8/ScriptController.cpp
@@ -0,0 +1,391 @@
+/*
+ * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "ChromiumBridge.h"
+#include "CString.h"
+#include "Document.h"
+#include "DOMWindow.h"
+#include "Event.h"
+#include "EventListener.h"
+#include "EventNames.h"
+#include "Frame.h"
+#include "Node.h"
+#include "NotImplemented.h"
+#include "npruntime_priv.h"
+#include "NPV8Object.h"
+#include "ScriptSourceCode.h"
+#include "ScriptState.h"
+#include "Widget.h"
+
+#include "V8Binding.h"
+#include "V8NPObject.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+void ScriptController::setFlags(const char* string, int length)
+{
+    v8::V8::SetFlagsFromString(string, length);
+}
+
+Frame* ScriptController::retrieveFrameForEnteredContext()
+{
+    return V8Proxy::retrieveFrameForEnteredContext();
+}
+
+Frame* ScriptController::retrieveFrameForCurrentContext()
+{
+    return V8Proxy::retrieveFrameForCurrentContext();
+}
+
+bool ScriptController::isSafeScript(Frame* target)
+{
+    return V8Proxy::CanAccessFrame(target, true);
+}
+
+void ScriptController::gcProtectJSWrapper(void* domObject)
+{
+    V8Proxy::GCProtect(domObject);
+}
+
+void ScriptController::gcUnprotectJSWrapper(void* domObject)
+{
+    V8Proxy::GCUnprotect(domObject);
+}
+
+ScriptController::ScriptController(Frame* frame)
+    : m_frame(frame)
+    , m_sourceURL(0)
+    , m_processingTimerCallback(false)
+    , m_paused(false)
+    , m_scriptState(new ScriptState(frame))
+    , m_proxy(new V8Proxy(frame))
+#if ENABLE(NETSCAPE_PLUGIN_API)
+    , m_windowScriptNPObject(0)
+#endif
+{
+}
+
+ScriptController::~ScriptController()
+{
+    m_proxy->disconnectFrame();
+}
+
+void ScriptController::clearScriptObjects()
+{
+    PluginObjectMap::iterator it = m_pluginObjects.begin();
+    for (; it != m_pluginObjects.end(); ++it) {
+        _NPN_UnregisterObject(it->second);
+        NPN_ReleaseObject(it->second);
+    }
+    m_pluginObjects.clear();
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+    if (m_windowScriptNPObject) {
+        // Call _NPN_DeallocateObject() instead of _NPN_ReleaseObject() so that we don't leak if a plugin fails to release the window
+        // script object properly.
+        // This shouldn't cause any problems for plugins since they should have already been stopped and destroyed at this point.
+        _NPN_DeallocateObject(m_windowScriptNPObject);
+        m_windowScriptNPObject = 0;
+    }
+#endif
+}
+
+void ScriptController::updateSecurityOrigin()
+{
+    m_proxy->updateSecurityOrigin();
+}
+
+void ScriptController::updatePlatformScriptObjects()
+{
+    notImplemented();
+}
+
+bool ScriptController::processingUserGesture() const
+{
+    Frame* activeFrame = V8Proxy::retrieveFrameForEnteredContext();
+    // No script is running, so it must be run by users.
+    if (!activeFrame)
+        return true;
+
+    V8Proxy* activeProxy = activeFrame->script()->proxy();
+
+    v8::HandleScope handleScope;
+    v8::Handle<v8::Context> context = V8Proxy::GetContext(activeFrame);
+    // FIXME: find all cases context can be empty:
+    //  1) JS is disabled;
+    //  2) page is NULL;
+    if (context.IsEmpty())
+        return true;
+
+    v8::Context::Scope scope(context);
+
+    v8::Handle<v8::Object> global = context->Global();
+    v8::Handle<v8::Value> jsEvent = global->Get(v8::String::NewSymbol("event"));
+    Event* event = V8Proxy::ToNativeEvent(jsEvent);
+
+    // Based on code from kjs_bindings.cpp.
+    // Note: This is more liberal than Firefox's implementation.
+    if (event) {
+        const AtomicString& type = event->type();
+        bool eventOk =
+            // mouse events
+            type == eventNames().clickEvent || type == eventNames().mousedownEvent || type == eventNames().mouseupEvent || type == eventNames().dblclickEvent
+            // keyboard events
+            || type == eventNames().keydownEvent || type == eventNames().keypressEvent || type == eventNames().keyupEvent
+            // other accepted events
+            || type == eventNames().selectEvent || type == eventNames().changeEvent || type == eventNames().focusEvent || type == eventNames().blurEvent || type == eventNames().submitEvent;
+
+        if (eventOk)
+            return true;
+    } else if (activeProxy->inlineCode() && !activeProxy->timerCallback()) {
+        // This is the <a href="javascript:window.open('...')> case -> we let it through.
+        return true;
+    }
+
+    // This is the <script>window.open(...)</script> case or a timer callback -> block it.
+    return false;
+}
+
+void ScriptController::evaluateInNewContext(const Vector<ScriptSourceCode>& sources)
+{
+    m_proxy->evaluateInNewContext(sources);
+}
+
+// Evaluate a script file in the environment of this proxy.
+ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
+{
+    v8::HandleScope handleScope;
+    v8::Handle<v8::Context> context = V8Proxy::GetContext(m_proxy->frame());
+    if (context.IsEmpty())
+        return ScriptValue();
+
+    v8::Context::Scope scope(context);
+
+    RefPtr<Frame> protect(m_frame);
+
+    v8::Local<v8::Value> object = m_proxy->evaluate(sourceCode, 0);
+
+    // Evaluating the JavaScript could cause the frame to be deallocated
+    // so we start the keep alive timer here.
+    m_frame->keepAlive();
+
+    if (object.IsEmpty() || object->IsUndefined())
+        return ScriptValue();
+
+    return ScriptValue(object);
+}
+
+void ScriptController::setEventHandlerLineNumber(int lineNumber)
+{
+    m_proxy->setEventHandlerLineno(lineNumber);
+}
+
+void ScriptController::finishedWithEvent(Event* event)
+{
+    m_proxy->finishedWithEvent(event);
+}
+
+// Create a V8 object with an interceptor of NPObjectPropertyGetter.
+void ScriptController::bindToWindowObject(Frame* frame, const String& key, NPObject* object)
+{
+    v8::HandleScope handleScope;
+
+    v8::Handle<v8::Context> context = V8Proxy::GetContext(frame);
+    if (context.IsEmpty())
+        return;
+
+    v8::Context::Scope scope(context);
+
+    v8::Handle<v8::Object> value = CreateV8ObjectForNPObject(object, 0);
+
+    // Attach to the global object.
+    v8::Handle<v8::Object> global = context->Global();
+    global->Set(v8String(key), value);
+}
+
+void ScriptController::collectGarbage()
+{
+    v8::HandleScope handleScope;
+    v8::Handle<v8::Context> context = V8Proxy::GetContext(m_proxy->frame());
+    if (context.IsEmpty())
+        return;
+
+    v8::Context::Scope scope(context);
+
+    m_proxy->evaluate(ScriptSourceCode("if (window.gc) void(gc());"), 0);
+}
+
+bool ScriptController::haveInterpreter() const
+{
+    return m_proxy->ContextInitialized();
+}
+
+bool ScriptController::isEnabled() const
+{
+    return m_proxy->isEnabled();
+}
+
+PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widget)
+{
+    ASSERT(widget);
+
+    if (widget->isFrameView())
+        return 0;
+
+    NPObject* npObject = ChromiumBridge::pluginScriptableObject(widget);
+    if (!npObject)
+        return 0;
+
+    // Frame Memory Management for NPObjects
+    // -------------------------------------
+    // NPObjects are treated differently than other objects wrapped by JS.
+    // NPObjects can be created either by the browser (e.g. the main
+    // window object) or by the plugin (the main plugin object
+    // for a HTMLEmbedElement). Further, unlike most DOM Objects, the frame
+    // is especially careful to ensure NPObjects terminate at frame teardown because
+    // if a plugin leaks a reference, it could leak its objects (or the browser's objects).
+    //
+    // The Frame maintains a list of plugin objects (m_pluginObjects)
+    // which it can use to quickly find the wrapped embed object.
+    //
+    // Inside the NPRuntime, we've added a few methods for registering
+    // wrapped NPObjects. The purpose of the registration is because
+    // javascript garbage collection is non-deterministic, yet we need to
+    // be able to tear down the plugin objects immediately. When an object
+    // is registered, javascript can use it. When the object is destroyed,
+    // or when the object's "owning" object is destroyed, the object will
+    // be un-registered, and the javascript engine must not use it.
+    //
+    // Inside the javascript engine, the engine can keep a reference to the
+    // NPObject as part of its wrapper. However, before accessing the object
+    // it must consult the NPN_Registry.
+
+    v8::Local<v8::Object> wrapper = CreateV8ObjectForNPObject(npObject, 0);
+
+    // Track the plugin object. We've been given a reference to the object.
+    m_pluginObjects.set(widget, npObject);
+
+    return V8ScriptInstance::create(wrapper);
+}
+
+void ScriptController::cleanupScriptObjectsForPlugin(void* nativeHandle)
+{
+    PluginObjectMap::iterator it = m_pluginObjects.find(nativeHandle);
+    if (it == m_pluginObjects.end())
+        return;
+    _NPN_UnregisterObject(it->second);
+    NPN_ReleaseObject(it->second);
+    m_pluginObjects.remove(it);
+}
+
+static NPObject* createNoScriptObject()
+{
+    notImplemented();
+    return 0;
+}
+
+static NPObject* createScriptObject(Frame* frame)
+{
+    v8::HandleScope handleScope;
+    v8::Handle<v8::Context> context = V8Proxy::GetContext(frame);
+    if (context.IsEmpty())
+        return createNoScriptObject();
+
+    v8::Context::Scope scope(context);
+    DOMWindow* window = frame->domWindow();
+    v8::Handle<v8::Value> global = V8Proxy::ToV8Object(V8ClassIndex::DOMWINDOW, window);
+    ASSERT(global->IsObject());
+    return npCreateV8ScriptObject(0, v8::Handle<v8::Object>::Cast(global), window);
+}
+
+NPObject* ScriptController::windowScriptNPObject()
+{
+    if (m_windowScriptNPObject)
+        return m_windowScriptNPObject;
+
+    if (isEnabled()) {
+        // JavaScript is enabled, so there is a JavaScript window object.
+        // Return an NPObject bound to the window object.
+        m_windowScriptNPObject = createScriptObject(m_frame);
+        _NPN_RegisterObject(m_windowScriptNPObject, 0);
+    } else {
+        // JavaScript is not enabled, so we cannot bind the NPObject to the
+        // JavaScript window object. Instead, we create an NPObject of a
+        // different class, one which is not bound to a JavaScript object.
+        m_windowScriptNPObject = createNoScriptObject();
+    }
+    return m_windowScriptNPObject;
+}
+
+NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement* plugin)
+{
+    // Can't create NPObjects when JavaScript is disabled.
+    if (!isEnabled())
+        return createNoScriptObject();
+
+    v8::HandleScope handleScope;
+    v8::Handle<v8::Context> context = V8Proxy::GetContext(m_frame);
+    if (context.IsEmpty())
+        return createNoScriptObject();
+    v8::Context::Scope scope(context);
+
+    DOMWindow* window = m_frame->domWindow();
+    v8::Handle<v8::Value> v8plugin = V8Proxy::ToV8Object(V8ClassIndex::HTMLEMBEDELEMENT, plugin);
+    if (!v8plugin->IsObject())
+        return createNoScriptObject();
+
+    return npCreateV8ScriptObject(0, v8::Handle<v8::Object>::Cast(v8plugin), window);
+}
+
+
+void ScriptController::clearWindowShell()
+{
+    // V8 binding expects ScriptController::clearWindowShell only be called
+    // when a frame is loading a new page. V8Proxy::clearForNavigation
+    // creates a new context for the new page.
+    m_proxy->clearForNavigation();
+}
+
+void ScriptController::attachDebugger(void*)
+{
+    notImplemented();
+}
+
+void ScriptController::updateDocument()
+{
+    m_proxy->updateDocument();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptController.h b/WebCore/bindings/v8/ScriptController.h
new file mode 100644
index 0000000..17703b5
--- /dev/null
+++ b/WebCore/bindings/v8/ScriptController.h
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptController_h
+#define ScriptController_h
+
+#include "ScriptInstance.h"
+#include "ScriptValue.h"
+
+#include "V8Proxy.h"
+
+#include <v8.h>
+
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+    class Event;
+    class Frame;
+    class HTMLPlugInElement;
+    class ScriptSourceCode;
+    class ScriptState;
+    class String;
+    class Widget;
+
+    class ScriptController {
+    public:
+        ScriptController(Frame*);
+        ~ScriptController();
+
+        // FIXME: V8Proxy should either be folded into ScriptController
+        // or this accessor should be made JSProxy*
+        V8Proxy* proxy() { return m_proxy.get(); }
+
+        // Evaluate a script file in the environment of this proxy.
+        // If succeeded, 'succ' is set to true and result is returned
+        // as a string.
+        ScriptValue evaluate(const ScriptSourceCode&);
+
+        // Executes JavaScript in a new context associated with the web frame. The
+        // script gets its own global scope and its own prototypes for intrinsic
+        // JavaScript objects (String, Array, and so-on). It shares the wrappers for
+        // all DOM nodes and DOM constructors.
+        void evaluateInNewContext(const Vector<ScriptSourceCode>&);
+
+        // JSC has a WindowShell object, but for V8, the ScriptController
+        // is the WindowShell.
+        bool haveWindowShell() const { return true; }
+
+        // Masquerade 'this' as the windowShell.
+        // This is a bit of a hack, but provides reasonable compatibility
+        // with what JSC does as well.
+        ScriptController* windowShell() { return this; }
+
+        ScriptState* state() const { return m_scriptState.get(); }
+
+        void collectGarbage();
+
+        // Creates a property of the global object of a frame.
+        void bindToWindowObject(Frame*, const String& key, NPObject*);
+
+        PassScriptInstance createScriptInstanceForWidget(Widget*);
+
+        // Check if the javascript engine has been initialized.
+        bool haveInterpreter() const;
+
+        bool isEnabled() const;
+
+        // FIXME: void* is a compile hack.
+        void attachDebugger(void*);
+
+        // --- Static methods assume we are running VM in single thread, ---
+        // --- and there is only one VM instance.                        ---
+
+        // Returns the frame for the entered context. See comments in
+        // V8Proxy::retrieveFrameForEnteredContext() for more information.
+        static Frame* retrieveFrameForEnteredContext();
+
+        // Returns the frame for the current context. See comments in
+        // V8Proxy::retrieveFrameForEnteredContext() for more information.
+        static Frame* retrieveFrameForCurrentContext();
+
+        // Check whether it is safe to access a frame in another domain.
+        static bool isSafeScript(Frame*);
+
+        // Pass command-line flags to the JS engine.
+        static void setFlags(const char* string, int length);
+
+        // Protect and unprotect the JS wrapper from garbage collected.
+        static void gcProtectJSWrapper(void*);
+        static void gcUnprotectJSWrapper(void*);
+
+        void finishedWithEvent(Event*);
+        void setEventHandlerLineNumber(int lineNumber);
+
+        void setProcessingTimerCallback(bool processingTimerCallback) { m_processingTimerCallback = processingTimerCallback; }
+        bool processingUserGesture() const;
+
+        void setPaused(bool paused) { m_paused = paused; }
+        bool isPaused() const { return m_paused; }
+
+        const String* sourceURL() const { return m_sourceURL; } // 0 if we are not evaluating any script.
+
+        void clearWindowShell();
+        void updateDocument();
+
+        void updateSecurityOrigin();
+        void clearScriptObjects();
+        void updatePlatformScriptObjects();
+        void cleanupScriptObjectsForPlugin(void*);
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+        NPObject* createScriptObjectForPluginElement(HTMLPlugInElement*);
+        NPObject* windowScriptNPObject();
+#endif
+
+    private:
+        Frame* m_frame;
+        const String* m_sourceURL;
+
+        bool m_processingTimerCallback;
+        bool m_paused;
+
+        OwnPtr<ScriptState> m_scriptState;
+        OwnPtr<V8Proxy> m_proxy;
+        typedef HashMap<void*, NPObject*> PluginObjectMap;
+
+        // A mapping between Widgets and their corresponding script object.
+        // This list is used so that when the plugin dies, we can immediately
+        // invalidate all sub-objects which are associated with that plugin.
+        // The frame keeps a NPObject reference for each item on the list.
+        PluginObjectMap m_pluginObjects;
+#if ENABLE(NETSCAPE_PLUGIN_API)
+        NPObject* m_windowScriptNPObject;
+#endif
+    };
+
+} // namespace WebCore
+
+#endif // ScriptController_h
diff --git a/WebCore/css/themeChromiumWin.css b/WebCore/bindings/v8/ScriptEventListener.cpp
similarity index 67%
copy from WebCore/css/themeChromiumWin.css
copy to WebCore/bindings/v8/ScriptEventListener.cpp
index e829373..42c2529 100644
--- a/WebCore/css/themeChromiumWin.css
+++ b/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -1,10 +1,10 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,12 +28,33 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* These styles override the default styling for HTML elements as defined in
-   WebCore/css/themeWin.css. */
-#include "themeWin.css"
+#include "config.h"
+#include "ScriptEventListener.h"
 
-input[type="search"]::-webkit-search-cancel-button,
-input[type="search"]::-webkit-search-results-decoration,
-input[type="search"]::-webkit-search-results-button {
-    margin: 0 0 0 0;
+#include "Attribute.h"
+#include "Document.h"
+#include "Frame.h"
+
+namespace WebCore {
+
+PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
+{
+    ASSERT(node);
+
+    Frame* frame = node->document()->frame();
+
+    if (!frame)
+        return 0;
+
+    return V8LazyEventListener::create(frame, attr->value(), attr->localName().string(), node->isSVGElement());
 }
+
+PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
+{
+    if (!frame)
+        return 0;
+
+    return V8LazyEventListener::create(frame, attr->value(), attr->localName().string(), frame->document()->isSVGDocument());
+}
+
+} // namespace WebCore
diff --git a/WebCore/css/themeChromiumWin.css b/WebCore/bindings/v8/ScriptEventListener.h
similarity index 77%
copy from WebCore/css/themeChromiumWin.css
copy to WebCore/bindings/v8/ScriptEventListener.h
index e829373..0171120 100644
--- a/WebCore/css/themeChromiumWin.css
+++ b/WebCore/bindings/v8/ScriptEventListener.h
@@ -1,10 +1,10 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,12 +28,22 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* These styles override the default styling for HTML elements as defined in
-   WebCore/css/themeWin.css. */
-#include "themeWin.css"
+#ifndef ScriptEventListener_h
+#define ScriptEventListener_h
 
-input[type="search"]::-webkit-search-cancel-button,
-input[type="search"]::-webkit-search-results-decoration,
-input[type="search"]::-webkit-search-results-button {
-    margin: 0 0 0 0;
-}
+#include "V8LazyEventListener.h"
+
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class Attribute;
+    class Frame;
+    class Node;
+
+    PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node*, Attribute*);
+    PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+
+} // namespace WebCore
+
+#endif // ScriptEventListener_h
diff --git a/WebCore/bindings/v8/ScriptFunctionCall.cpp b/WebCore/bindings/v8/ScriptFunctionCall.cpp
new file mode 100644
index 0000000..d2f7a52
--- /dev/null
+++ b/WebCore/bindings/v8/ScriptFunctionCall.cpp
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptFunctionCall.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "ScriptScope.h"
+#include "ScriptState.h"
+#include "ScriptString.h"
+#include "ScriptValue.h"
+
+#include "V8Binding.h"
+#include "V8Proxy.h"
+
+#include <v8.h>
+#include <wtf/OwnArrayPtr.h>
+
+namespace WebCore {
+
+static void reportException(ScriptState* scriptState, v8::TryCatch &exceptionCatcher)
+{
+    v8::Local<v8::Message> message = exceptionCatcher.Message();
+    scriptState->frame()->document()->reportException(toWebCoreString(message->Get()), message->GetLineNumber(), toWebCoreString(message->GetScriptResourceName()));
+    exceptionCatcher.Reset();
+}
+
+ScriptFunctionCall::ScriptFunctionCall(ScriptState* scriptState, const ScriptObject& thisObject, const String& name)
+    : m_scriptState(scriptState)
+    , m_thisObject(thisObject)
+    , m_name(name)
+{
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptObject& argument)
+{
+    m_arguments.append(argument);
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptString& argument)
+{
+    ScriptScope scope(m_scriptState);
+    m_arguments.append(v8String(argument));
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptValue& argument)
+{
+    m_arguments.append(argument);
+}
+
+void ScriptFunctionCall::appendArgument(const String& argument)
+{
+    ScriptScope scope(m_scriptState);
+    m_arguments.append(v8String(argument));
+}
+
+void ScriptFunctionCall::appendArgument(long long argument)
+{
+    ScriptScope scope(m_scriptState);
+    m_arguments.append(v8::Number::New(argument));
+}
+
+void ScriptFunctionCall::appendArgument(unsigned int argument)
+{
+    ScriptScope scope(m_scriptState);
+    m_arguments.append(v8::Number::New(argument));
+}
+
+void ScriptFunctionCall::appendArgument(int argument)
+{
+    ScriptScope scope(m_scriptState);
+    m_arguments.append(v8::Number::New(argument));
+}
+
+void ScriptFunctionCall::appendArgument(bool argument)
+{
+    m_arguments.append(v8Boolean(argument));
+}
+
+ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
+{
+    ScriptScope scope(m_scriptState, reportExceptions);
+
+    v8::Local<v8::Object> thisObject = m_thisObject.v8Object();
+    v8::Local<v8::Value> value = thisObject->Get(v8String(m_name));
+    if (!scope.success()) {
+        hadException = true;
+        return ScriptValue();
+    }
+
+    ASSERT(value->IsFunction());
+
+    v8::Local<v8::Function> function(v8::Function::Cast(*value));
+    OwnArrayPtr<v8::Handle<v8::Value> > args(new v8::Handle<v8::Value>[m_arguments.size()]);
+    for (size_t i = 0; i < m_arguments.size(); ++i)
+        args[i] = m_arguments[i].v8Value();
+
+    v8::Local<v8::Value> result = function->Call(thisObject, m_arguments.size(), args.get());
+    if (!scope.success()) {
+        hadException = true;
+        return ScriptValue();
+    }
+
+    return ScriptValue(result);
+}
+
+ScriptValue ScriptFunctionCall::call()
+{
+    bool hadException = false;
+    return call(hadException);
+}
+
+ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExceptions)
+{
+    ScriptScope scope(m_scriptState, reportExceptions);
+
+    v8::Local<v8::Object> thisObject = m_thisObject.v8Object();
+    v8::Local<v8::Value> value = thisObject->Get(v8String(m_name));
+    if (!scope.success()) {
+        hadException = true;
+        return ScriptObject();
+    }
+
+    ASSERT(value->IsFunction());
+
+    v8::Local<v8::Function> constructor(v8::Function::Cast(*value));
+    OwnArrayPtr<v8::Handle<v8::Value> > args(new v8::Handle<v8::Value>[m_arguments.size()]);
+    for (size_t i = 0; i < m_arguments.size(); ++i)
+        args[i] = m_arguments[i].v8Value();
+
+    v8::Local<v8::Object> result = SafeAllocation::newInstance(constructor, m_arguments.size(), args.get());
+    if (!scope.success()) {
+        hadException = true;
+        return ScriptObject();
+    }
+
+    return ScriptObject(result);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptFunctionCall.h b/WebCore/bindings/v8/ScriptFunctionCall.h
new file mode 100644
index 0000000..8365a4e
--- /dev/null
+++ b/WebCore/bindings/v8/ScriptFunctionCall.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptFunctionCall_h
+#define ScriptFunctionCall_h
+
+#include "PlatformString.h"
+#include "ScriptObject.h"
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+    class ScriptValue;
+    class ScriptState;
+    class ScriptString;
+
+    class ScriptFunctionCall {
+    public:
+        ScriptFunctionCall(ScriptState* scriptState, const ScriptObject& thisObject, const String& name);
+        virtual ~ScriptFunctionCall() {};
+
+        void appendArgument(const ScriptObject&);
+        void appendArgument(const ScriptString&);
+        void appendArgument(const ScriptValue&);
+        void appendArgument(const String&);
+        void appendArgument(long long);
+        void appendArgument(unsigned int);
+        void appendArgument(int);
+        void appendArgument(bool);
+        ScriptValue call(bool& hadException, bool reportExceptions = true);
+        ScriptValue call();
+        ScriptObject construct(bool& hadException, bool reportExceptions = true);
+
+    protected:
+        ScriptState* m_scriptState;
+        ScriptObject m_thisObject;
+        String m_name;
+        Vector<ScriptValue> m_arguments;
+    };
+
+} // namespace WebCore
+
+#endif // ScriptFunctionCall
diff --git a/WebCore/bindings/v8/ScriptObject.cpp b/WebCore/bindings/v8/ScriptObject.cpp
new file mode 100644
index 0000000..dd44acb
--- /dev/null
+++ b/WebCore/bindings/v8/ScriptObject.cpp
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptObject.h"
+
+#include "ScriptScope.h"
+#include "ScriptState.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "V8Binding.h"
+#include "V8Proxy.h"
+
+#include <v8.h>
+
+namespace WebCore {
+
+ScriptObject::ScriptObject(v8::Handle<v8::Object> v8Object)
+    : ScriptValue(v8Object)
+{
+}
+
+v8::Local<v8::Object> ScriptObject::v8Object() const
+{
+    ASSERT(v8Value()->IsObject());
+    return v8::Local<v8::Object>(v8::Object::Cast(*v8Value()));
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const String& name, const String& value)
+{
+    ScriptScope scope(scriptState);
+    v8Object()->Set(v8String(name), v8String(value));
+    return scope.success();
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+{
+    ScriptScope scope(scriptState);
+    v8Object()->Set(v8::String::New(name), value.v8Value());
+    return scope.success();
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, const String& value)
+{
+    ScriptScope scope(scriptState);
+    v8Object()->Set(v8::String::New(name), v8String(value));
+    return scope.success();
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, double value)
+{
+    ScriptScope scope(scriptState);
+    v8Object()->Set(v8::String::New(name), v8::Number::New(value));
+    return scope.success();
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, long long value)
+{
+    ScriptScope scope(scriptState);
+    v8Object()->Set(v8::String::New(name), v8::Number::New(value));
+    return scope.success();
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, int value)
+{
+    ScriptScope scope(scriptState);
+    v8Object()->Set(v8::String::New(name), v8::Number::New(value));
+    return scope.success();
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, bool value)
+{
+    ScriptScope scope(scriptState);
+    v8Object()->Set(v8::String::New(name), v8Boolean(value));
+    return scope.success();
+}
+
+ScriptObject ScriptObject::createNew(ScriptState* scriptState)
+{
+    ScriptScope scope(scriptState);
+    return ScriptObject(v8::Object::New());
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+{
+    ScriptScope scope(scriptState);
+    scope.global()->Set(v8::String::New(name), value.v8Value());
+    return scope.success();
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorController* value)
+{
+    ScriptScope scope(scriptState);
+    scope.global()->Set(v8::String::New(name), V8Proxy::ToV8Object(V8ClassIndex::INSPECTORCONTROLLER, value));
+    return scope.success();
+}
+
+bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
+{
+    ScriptScope scope(scriptState);
+    v8::Local<v8::Value> v8Value = scope.global()->Get(v8::String::New(name));
+    if (v8Value.IsEmpty())
+        return false;
+
+    if (!v8Value->IsObject())
+        return false;
+
+    value = ScriptObject(v8::Handle<v8::Object>(v8::Object::Cast(*v8Value)));
+    return true;
+}
+
+bool ScriptGlobalObject::remove(ScriptState* scriptState, const char* name)
+{
+    ScriptScope scope(scriptState);
+    return scope.global()->Delete(v8::String::New(name));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptObject.h b/WebCore/bindings/v8/ScriptObject.h
new file mode 100644
index 0000000..e5618ab
--- /dev/null
+++ b/WebCore/bindings/v8/ScriptObject.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptObject_h
+#define ScriptObject_h
+
+#include "ScriptValue.h"
+
+#include <v8.h>
+
+namespace WebCore {
+    class InspectorController;
+    class ScriptState;
+
+    class ScriptObject : public ScriptValue {
+    public:
+        ScriptObject(v8::Handle<v8::Object>);
+        ScriptObject() {}
+        virtual ~ScriptObject() {}
+
+        v8::Local<v8::Object> v8Object() const;
+
+        bool set(ScriptState*, const String& name, const String&);
+        bool set(ScriptState*, const char* name, const ScriptObject&);
+        bool set(ScriptState*, const char* name, const String&);
+        bool set(ScriptState*, const char* name, double);
+        bool set(ScriptState*, const char* name, long long);
+        bool set(ScriptState*, const char* name, int);
+        bool set(ScriptState*, const char* name, bool);
+
+        static ScriptObject createNew(ScriptState*);
+    };
+
+    class ScriptGlobalObject {
+    public:
+        static bool set(ScriptState*, const char* name, const ScriptObject&);
+        static bool set(ScriptState*, const char* name, InspectorController*);
+        static bool get(ScriptState*, const char* name, ScriptObject&);
+        static bool remove(ScriptState*, const char* name);
+    private:
+        ScriptGlobalObject() { }
+    };
+
+}
+
+#endif // ScriptObject_h
diff --git a/WebCore/bindings/v8/ScriptObjectQuarantine.cpp b/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
new file mode 100644
index 0000000..8a7715e
--- /dev/null
+++ b/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptObjectQuarantine.h"
+
+#include "Database.h"
+#include "Document.h"
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "Page.h"
+#include "ScriptObject.h"
+#include "ScriptValue.h"
+
+#include "V8Binding.h"
+#include "V8Proxy.h"
+
+#include <v8.h>
+
+namespace WebCore {
+
+ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
+{
+    return value;
+}
+
+bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
+{
+    ASSERT(database);
+
+    // FIXME: Implement when Database V8 bindings are enabled
+    ASSERT_NOT_REACHED();
+    quarantinedObject = ScriptObject();
+    return false;
+}
+
+bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
+{
+    ASSERT(frame);
+    ASSERT(storage);
+
+    // FIXME: Implement when DOM Storage V8 bindings are enabled
+    ASSERT_NOT_REACHED();
+    quarantinedObject = ScriptObject();
+    return true;
+}
+
+bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
+{
+    ASSERT(node);
+
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = V8Proxy::GetContext(node->document()->page()->mainFrame());
+    v8::Context::Scope scope(context);
+
+    v8::Handle<v8::Value> v8Node = V8Proxy::NodeToV8Object(node);
+    quarantinedObject = ScriptObject(v8::Local<v8::Object>(v8::Object::Cast(*v8Node)));
+
+    return true;
+}
+
+bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
+{
+    ASSERT(domWindow);
+
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = V8Proxy::GetContext(domWindow->frame());
+    v8::Context::Scope scope(context);
+
+    v8::Handle<v8::Value> v8DomWindow = V8Proxy::ToV8Object(V8ClassIndex::DOMWINDOW, domWindow);
+    quarantinedObject = ScriptObject(v8::Local<v8::Object>(v8::Object::Cast(*v8DomWindow)));
+
+    return true;
+}
+
+
+} // namespace WebCore
diff --git a/WebCore/css/themeChromiumWin.css b/WebCore/bindings/v8/ScriptObjectQuarantine.h
similarity index 60%
copy from WebCore/css/themeChromiumWin.css
copy to WebCore/bindings/v8/ScriptObjectQuarantine.h
index e829373..3b7ccff 100644
--- a/WebCore/css/themeChromiumWin.css
+++ b/WebCore/bindings/v8/ScriptObjectQuarantine.h
@@ -1,10 +1,10 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,12 +28,33 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* These styles override the default styling for HTML elements as defined in
-   WebCore/css/themeWin.css. */
-#include "themeWin.css"
+// ScriptObjectQuarantine is used in JSC for wrapping DOM objects of the page
+// before they are passed to Inspector's front-end. The wrapping prevents
+// malicious scripts from gaining privileges. For V8, we are currently just
+// passing the object itself, without any wrapping.
 
-input[type="search"]::-webkit-search-cancel-button,
-input[type="search"]::-webkit-search-results-decoration,
-input[type="search"]::-webkit-search-results-button {
-    margin: 0 0 0 0;
+#ifndef ScriptObjectQuarantine_h
+#define ScriptObjectQuarantine_h
+
+#include "ScriptState.h"
+
+namespace WebCore {
+
+    class Database;
+    class DOMWindow;
+    class Frame;
+    class Node;
+    class ScriptObject;
+    class ScriptValue;
+    class Storage;
+
+    ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
+
+    bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
+
 }
+
+#endif // ScriptObjectQuarantine_h
diff --git a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h b/WebCore/bindings/v8/ScriptScope.cpp
similarity index 63%
copy from WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
copy to WebCore/bindings/v8/ScriptScope.cpp
index 5a55974..937f664 100644
--- a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
+++ b/WebCore/bindings/v8/ScriptScope.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,18 +28,40 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8XMLHttpRequestUtilities_h
-#define V8XMLHttpRequestUtilities_h
+#include "config.h"
+#include "ScriptScope.h"
+
+#include "ScriptState.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "V8Binding.h"
+#include "V8Proxy.h"
 
 #include <v8.h>
 
 namespace WebCore {
 
-// Use an array to hold dependents. It works like a ref-counted scheme.
-// A value can be added more than once to the xmlHttpRequest object.
-void createHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
-void removeHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
+ScriptScope::ScriptScope(ScriptState* scriptState, bool reportExceptions)
+    : m_context(V8Proxy::GetContext(scriptState->frame()))
+    , m_scope(m_context)
+    , m_scriptState(scriptState)
+    , m_reportExceptions(reportExceptions)
+{
+    ASSERT(!m_context.IsEmpty());
+}
+
+bool ScriptScope::success()
+{
+    if (!m_exceptionCatcher.HasCaught())
+        return true;
+
+    v8::Local<v8::Message> message = m_exceptionCatcher.Message();
+    if (m_reportExceptions)
+        m_scriptState->frame()->document()->reportException(toWebCoreString(message->Get()), message->GetLineNumber(), toWebCoreString(message->GetScriptResourceName()));
+
+    m_exceptionCatcher.Reset();
+    return false;
+}
 
 } // namespace WebCore
-
-#endif // V8XMLHttpRequestUtilities_h
diff --git a/WebCore/css/themeChromiumWin.css b/WebCore/bindings/v8/ScriptScope.h
similarity index 71%
copy from WebCore/css/themeChromiumWin.css
copy to WebCore/bindings/v8/ScriptScope.h
index e829373..6fee458 100644
--- a/WebCore/css/themeChromiumWin.css
+++ b/WebCore/bindings/v8/ScriptScope.h
@@ -1,10 +1,10 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,12 +28,30 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* These styles override the default styling for HTML elements as defined in
-   WebCore/css/themeWin.css. */
-#include "themeWin.css"
+#ifndef ScriptScope_h
+#define ScriptScope_h
 
-input[type="search"]::-webkit-search-cancel-button,
-input[type="search"]::-webkit-search-results-decoration,
-input[type="search"]::-webkit-search-results-button {
-    margin: 0 0 0 0;
+#include <v8.h>
+
+namespace WebCore {
+    class ScriptState;
+
+    class ScriptScope {
+    public:
+        ScriptScope(ScriptState* scriptState, bool reportExceptions = true);
+        bool success();
+
+        v8::Local<v8::Object> global() const { return m_context->Global(); }
+
+    private:
+        v8::HandleScope m_handleScope;
+        v8::Local<v8::Context> m_context;
+        v8::Context::Scope m_scope;
+        v8::TryCatch m_exceptionCatcher;
+        ScriptState* m_scriptState;
+        bool m_reportExceptions;
+    };
+
 }
+
+#endif // ScriptScope_h
diff --git a/WebCore/css/themeChromiumWin.css b/WebCore/bindings/v8/ScriptState.cpp
similarity index 73%
copy from WebCore/css/themeChromiumWin.css
copy to WebCore/bindings/v8/ScriptState.cpp
index e829373..b9e240c 100644
--- a/WebCore/css/themeChromiumWin.css
+++ b/WebCore/bindings/v8/ScriptState.cpp
@@ -1,10 +1,10 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,12 +28,34 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* These styles override the default styling for HTML elements as defined in
-   WebCore/css/themeWin.css. */
-#include "themeWin.css"
+#include "config.h"
+#include "ScriptState.h"
 
-input[type="search"]::-webkit-search-cancel-button,
-input[type="search"]::-webkit-search-results-decoration,
-input[type="search"]::-webkit-search-results-button {
-    margin: 0 0 0 0;
+#include "Frame.h"
+#include "Node.h"
+#include "Page.h"
+#include "ScriptController.h"
+
+#include <wtf/Assertions.h>
+
+namespace WebCore {
+
+ScriptState::ScriptState(Frame* frame)
+    : m_frame(frame)
+{
+}
+
+ScriptState* scriptStateFromNode(Node* node)
+{
+    // This should be never reached with V8 bindings (WebKit only uses it
+    // for non-JS bindings)
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+ScriptState* scriptStateFromPage(Page* page)
+{
+    return page->mainFrame()->script()->state();
+}
+
 }
diff --git a/WebCore/bindings/v8/ScriptState.h b/WebCore/bindings/v8/ScriptState.h
index b5a9578..8fbcfa3 100644
--- a/WebCore/bindings/v8/ScriptState.h
+++ b/WebCore/bindings/v8/ScriptState.h
@@ -34,8 +34,15 @@
 #include <v8.h>
 
 namespace WebCore {
+    class Node;
+    class Page;
+    class Frame;
+
     class ScriptState {
     public:
+        ScriptState() { }
+        ScriptState(Frame* frame);
+
         bool hadException() { return !m_exception.IsEmpty(); }
         void setException(v8::Local<v8::Value> exception)
         {
@@ -43,9 +50,15 @@
         }
         v8::Local<v8::Value> exception() { return m_exception; }
 
+        Frame* frame() const { return m_frame; }
+
     private:
         v8::Local<v8::Value> m_exception;
+        Frame* m_frame;
     };
+
+    ScriptState* scriptStateFromNode(Node*);
+    ScriptState* scriptStateFromPage(Page*);
 }
 
 #endif // ScriptState_h
diff --git a/WebCore/bindings/v8/ScriptString.h b/WebCore/bindings/v8/ScriptString.h
index 66a575f..fe254a5 100644
--- a/WebCore/bindings/v8/ScriptString.h
+++ b/WebCore/bindings/v8/ScriptString.h
@@ -37,6 +37,7 @@
 
 class ScriptString {
 public:
+    ScriptString() {}
     ScriptString(const String& s) : m_str(s) {}
     ScriptString(const char* s) : m_str(s) {}
 
diff --git a/WebCore/bindings/v8/ScriptValue.h b/WebCore/bindings/v8/ScriptValue.h
index bfb11c2..04e8819 100644
--- a/WebCore/bindings/v8/ScriptValue.h
+++ b/WebCore/bindings/v8/ScriptValue.h
@@ -91,6 +91,11 @@
         return m_value == value.m_value;
     }
 
+    bool isEqual(ScriptState*, const ScriptValue& value) const
+    {
+        return m_value == value.m_value;
+    }
+
     bool operator!=(const ScriptValue value) const
     {
         return !operator==(value);
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.cpp b/WebCore/bindings/v8/V8AbstractEventListener.cpp
index 83ab856..462a729 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -39,8 +39,8 @@
 
 namespace WebCore {
 
-V8AbstractEventListener::V8AbstractEventListener(Frame* frame, bool isInline)
-    : m_isInline(isInline)
+V8AbstractEventListener::V8AbstractEventListener(Frame* frame, bool isAttribute)
+    : m_isAttribute(isAttribute)
     , m_frame(frame)
     , m_lineNumber(0)
     , m_columnNumber(0)
@@ -49,7 +49,7 @@
         return;
 
     // Get the position in the source if any.
-    if (m_isInline && m_frame->document()->tokenizer()) {
+    if (m_isAttribute && m_frame->document()->tokenizer()) {
         m_lineNumber = m_frame->document()->tokenizer()->lineNumber();
         m_columnNumber = m_frame->document()->tokenizer()->columnNumber();
     }
@@ -57,27 +57,21 @@
 
 void V8AbstractEventListener::invokeEventHandler(v8::Handle<v8::Context> context, Event* event, v8::Handle<v8::Value> jsEvent, bool isWindowEvent)
 {
-    // For compatibility, we store the event object as a property on the window called "event".  Because this is the global namespace, we save away any
-    // existing "event" property, and then restore it after executing the javascript handler.
+    // We push the event being processed into the global object, so that it can be exposed by DOMWindow's bindings.
     v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
     v8::Local<v8::Value> returnValue;
 
     {
         // Catch exceptions thrown in the event handler so they do not propagate to javascript code that caused the event to fire.
-        // Setting and getting the 'event' property on the global object can throw exceptions as well (for instance if accessors that
-        // throw exceptions are defined for 'event' using __defineGetter__ and __defineSetter__ on the global object).
         v8::TryCatch tryCatch;
         tryCatch.SetVerbose(true);
 
         // Save the old 'event' property so we can restore it later.
-        v8::Local<v8::Value> savedEvent = context->Global()->Get(eventSymbol);
+        v8::Local<v8::Value> savedEvent = context->Global()->GetHiddenValue(eventSymbol);
         tryCatch.Reset();
 
-        // Make the event available in the window object.
-        //
-        // FIXME: This does not work as it does with jsc bindings if the window.event property is already set. We need to make sure that property
-        // access is intercepted correctly.
-        context->Global()->Set(eventSymbol, jsEvent);
+        // Make the event available in the global object, so DOMWindow can expose it.
+        context->Global()->SetHiddenValue(eventSymbol, jsEvent);
         tryCatch.Reset();
 
         // Call the event handler.
@@ -86,9 +80,9 @@
 
         // Restore the old event. This must be done for all exit paths through this method.
         if (savedEvent.IsEmpty())
-            context->Global()->Set(eventSymbol, v8::Undefined());
+            context->Global()->SetHiddenValue(eventSymbol, v8::Undefined());
         else
-            context->Global()->Set(eventSymbol, savedEvent);
+            context->Global()->SetHiddenValue(eventSymbol, savedEvent);
         tryCatch.Reset();
     }
 
@@ -102,7 +96,7 @@
 
     // Prevent default action if the return value is false;
     // FIXME: Add example, and reference to bug entry.
-    if (m_isInline && returnValue->IsBoolean() && !returnValue->BooleanValue())
+    if (m_isAttribute && returnValue->IsBoolean() && !returnValue->BooleanValue())
         event->preventDefault();
 }
 
@@ -133,7 +127,7 @@
 
     invokeEventHandler(context, event, jsEvent, isWindowEvent);
 
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
 
 void V8AbstractEventListener::disposeListenerObject()
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.h b/WebCore/bindings/v8/V8AbstractEventListener.h
index 0c34a86..ed643db 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.h
+++ b/WebCore/bindings/v8/V8AbstractEventListener.h
@@ -69,7 +69,7 @@
         v8::Persistent<v8::Object> m_listener;
 
         // Indicates if this is an HTML type listener.
-        bool m_isInline;
+        bool m_isAttribute;
 
     private:
         V8AbstractEventListener(Frame*, bool isInline);
diff --git a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h b/WebCore/bindings/v8/V8Collection.cpp
similarity index 62%
copy from WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
copy to WebCore/bindings/v8/V8Collection.cpp
index 5a55974..861f68a 100644
--- a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
+++ b/WebCore/bindings/v8/V8Collection.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,18 +28,35 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8XMLHttpRequestUtilities_h
-#define V8XMLHttpRequestUtilities_h
+#include "config.h"
+#include "V8Collection.h"
 
-#include <v8.h>
+#include "ExceptionCode.h"
+#include "HTMLOptionElement.h"
+#include "V8HTMLOptionElement.h"
 
 namespace WebCore {
 
-// Use an array to hold dependents. It works like a ref-counted scheme.
-// A value can be added more than once to the xmlHttpRequest object.
-void createHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
-void removeHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
+v8::Handle<v8::Value> toOptionsCollectionSetter(uint32_t index, v8::Handle<v8::Value> value, HTMLSelectElement* base)
+{
+    if (value->IsNull() || value->IsUndefined()) {
+        base->remove(index);
+        return value;
+    }
+
+    ExceptionCode ec = 0;
+
+    // Check that the value is an HTMLOptionElement.  If not, throw a TYPE_MISMATCH_ERR DOMException.
+    if (!V8HTMLOptionElement::HasInstance(value)) {
+        V8Proxy::SetDOMException(TYPE_MISMATCH_ERR);
+        return value;
+    }
+
+    HTMLOptionElement* element = V8Proxy::DOMWrapperToNode<HTMLOptionElement>(v8::Handle<v8::Object>::Cast(value));
+    base->setOption(index, element, ec);
+
+    V8Proxy::SetDOMException(ec);
+    return value;
+}
 
 } // namespace WebCore
-
-#endif // V8XMLHttpRequestUtilities_h
diff --git a/WebCore/bindings/v8/V8Collection.h b/WebCore/bindings/v8/V8Collection.h
index 247c108..1731f9c 100644
--- a/WebCore/bindings/v8/V8Collection.h
+++ b/WebCore/bindings/v8/V8Collection.h
@@ -31,6 +31,8 @@
 #ifndef V8Collection_h
 #define V8Collection_h
 
+#include "HTMLFormElement.h"
+#include "HTMLSelectElement.h"
 #include "V8Binding.h"
 #include "V8Proxy.h"
 #include <v8.h>
@@ -70,6 +72,15 @@
     // A template of named property accessor of collections.
     template<class Collection, class ItemType> static v8::Handle<v8::Value> collectionNamedPropertyGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
     {
+        v8::Handle<v8::Value> value = info.Holder()->GetRealNamedPropertyInPrototypeChain(name);
+
+        if (!value.IsEmpty())
+            return value;
+
+        // Search local callback properties next to find IDL defined
+        // properties.
+        if (info.Holder()->HasRealNamedCallbackProperty(name))
+            return notHandledByInterceptor();
         return getNamedPropertyOfCollection<Collection, ItemType>(name, info.Holder(), info.Data());
     }
 
@@ -78,6 +89,15 @@
     {
         ASSERT(V8Proxy::MaybeDOMWrapper(info.Holder()));
         ASSERT(V8Proxy::GetDOMWrapperType(info.Holder()) == V8ClassIndex::NODE);
+        v8::Handle<v8::Value> value = info.Holder()->GetRealNamedPropertyInPrototypeChain(name);
+
+        if (!value.IsEmpty())
+            return value;
+
+        // Search local callback properties next to find IDL defined
+        // properties.
+        if (info.Holder()->HasRealNamedCallbackProperty(name))
+            return notHandledByInterceptor();
         Collection* collection = V8Proxy::DOMWrapperToNode<Collection>(info.Holder());
         String propertyName = toWebCoreString(name);
         void* implementation = collection->namedItem(propertyName);
@@ -188,6 +208,8 @@
         desc->InstanceTemplate()->SetIndexedPropertyHandler(collectionStringOrNullIndexedPropertyGetter<Collection>, 0, 0, 0, collectionIndexedPropertyEnumerator<Collection>);
     }
 
+    v8::Handle<v8::Value> toOptionsCollectionSetter(uint32_t index, v8::Handle<v8::Value>, HTMLSelectElement*);
+
 } // namespace WebCore
 
 #endif // V8Collection_h
diff --git a/WebCore/bindings/v8/V8DOMMap.cpp b/WebCore/bindings/v8/V8DOMMap.cpp
index 82d9e69..60ce32b 100644
--- a/WebCore/bindings/v8/V8DOMMap.cpp
+++ b/WebCore/bindings/v8/V8DOMMap.cpp
@@ -40,6 +40,7 @@
 #include <wtf/StdLibExtras.h>
 #include <wtf/Threading.h>
 #include <wtf/ThreadSpecific.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
@@ -47,7 +48,7 @@
 //
 // There are two kinds of DOM objects:
 // 1. DOM tree nodes, such as Document, HTMLElement, ...
-//    there classes implements TreeShared<T> interface;
+//    there classes implement TreeShared<T> interface;
 // 2. Non-node DOM objects, such as CSSRule, Location, etc.
 //    these classes implement a ref-counted scheme.
 //
@@ -103,23 +104,21 @@
 // The helper function will be scheduled by the GC thread to get called from the owning thread.
 static void derefDelayedObjectsInCurrentThread(void*);
 
-// This should be called to remove all DOM objects associated with the current thread when it is tearing down.
-static void removeAllDOMObjectsInCurrentThread();
-
-// A map from a thread ID to thread's specific data.
+// A list of all ThreadSpecific DOM Data objects. Traversed during GC to find a thread-specific map that
+// contains the object - so we can schedule the object to be deleted on the thread which created it.
 class ThreadSpecificDOMData;
-typedef WTF::HashMap<WTF::ThreadIdentifier, ThreadSpecificDOMData*> DOMThreadMap;
-static DOMThreadMap& domThreadMap()
+typedef WTF::Vector<ThreadSpecificDOMData*> DOMDataList;
+static DOMDataList& domDataList()
 {
-    DEFINE_STATIC_LOCAL(DOMThreadMap, staticDOMThreadMap, ());
-    return staticDOMThreadMap;
+    DEFINE_STATIC_LOCAL(DOMDataList, staticDOMDataList, ());
+    return staticDOMDataList;
 }
 
-// Mutex to protect against concurrent access of domThreadMap.
-static WTF::Mutex& domThreadMapMutex()
+// Mutex to protect against concurrent access of DOMDataList.
+static WTF::Mutex& domDataListMutex()
 {
-    DEFINE_STATIC_LOCAL(WTF::Mutex, staticDOMThreadMapMutex, ());
-    return staticDOMThreadMapMutex;
+    DEFINE_STATIC_LOCAL(WTF::Mutex, staticDOMDataListMutex, ());
+    return staticDOMDataListMutex;
 }
 
 class ThreadSpecificDOMData : Noncopyable {
@@ -161,14 +160,14 @@
         , m_delayedProcessingScheduled(false)
         , m_isMainThread(WTF::isMainThread())
     {
-        WTF::MutexLocker locker(domThreadMapMutex());
-        domThreadMap().set(WTF::currentThread(), this);
+        WTF::MutexLocker locker(domDataListMutex());
+        domDataList().append(this);
     }
 
     virtual ~ThreadSpecificDOMData()
     {
-        WTF::MutexLocker locker(domThreadMapMutex());
-        domThreadMap().remove(WTF::currentThread());
+        WTF::MutexLocker locker(domDataListMutex());
+        domDataList().remove(domDataList().find(this));
     }
 
     void* getDOMWrapperMap(DOMWrapperMapType type)
@@ -241,8 +240,6 @@
     // We assume that all child threads running V8 instances are created by WTF.
     virtual ~NonMainThreadSpecificDOMData()
     {
-        removeAllDOMObjectsInCurrentThread();
-
         delete m_domNodeMap;
         delete m_domObjectMap;
         delete m_activeDomObjectMap;
@@ -254,7 +251,8 @@
 };
 
 // This encapsulates thread-specific DOM data for the main thread. All the maps in it are static.
-// This is because we are unable to rely on WTF::ThreadSpecificThreadExit to do the cleanup since the place that tears down the main thread can not call any WTF functions.
+// This is because we are unable to rely on WTF::ThreadSpecificThreadExit to do the cleanup since
+// the place that tears down the main thread can not call any WTF functions.
 class MainThreadSpecificDOMData : public ThreadSpecificDOMData {
 public:
     MainThreadSpecificDOMData()
@@ -279,10 +277,8 @@
     InternalDOMWrapperMap<Node> m_staticDomNodeMap;
     InternalDOMWrapperMap<void> m_staticDomObjectMap;
     InternalDOMWrapperMap<void> m_staticActiveDomObjectMap;
-#if ENABLE(SVG)    
     InternalDOMWrapperMap<SVGElementInstance> m_staticDomSvgElementInstanceMap;
     InternalDOMWrapperMap<void> m_staticDomSvgObjectWithContextMap;
-#endif
 };
 
 DEFINE_STATIC_LOCAL(WTF::ThreadSpecific<NonMainThreadSpecificDOMData>, threadSpecificDOMData, ());
@@ -386,16 +382,10 @@
 template<typename T>
 static void handleWeakObjectInOwningThread(ThreadSpecificDOMData::DOMWrapperMapType mapType, V8ClassIndex::V8WrapperType objectType, T* object)
 {
-    WTF::MutexLocker locker(domThreadMapMutex());
-    for (typename DOMThreadMap::iterator iter(domThreadMap().begin()); iter != domThreadMap().end(); ++iter) {
-        WTF::ThreadIdentifier threadID = iter->first;
-        ThreadSpecificDOMData* threadData = iter->second;
-
-        // Skip the current thread that is GC thread.
-        if (threadID == WTF::currentThread()) {
-            ASSERT(!static_cast<DOMWrapperMap<T>*>(threadData->getDOMWrapperMap(mapType))->contains(object));
-            continue;
-        }
+    WTF::MutexLocker locker(domDataListMutex());
+    DOMDataList& list = domDataList();
+    for (size_t i = 0; i < list.size(); ++i) {
+        ThreadSpecificDOMData* threadData = list[i];
 
         ThreadSpecificDOMData::InternalDOMWrapperMap<T>* domMap = static_cast<ThreadSpecificDOMData::InternalDOMWrapperMap<T>*>(threadData->getDOMWrapperMap(mapType));
         if (domMap->contains(object)) {
@@ -515,7 +505,7 @@
 
 static void derefDelayedObjects()
 {
-    WTF::MutexLocker locker(domThreadMapMutex());
+    WTF::MutexLocker locker(domDataListMutex());
 
     getThreadSpecificDOMData().setDelayedProcessingScheduled(false);
 
@@ -574,7 +564,7 @@
 #endif
 }
 
-static void removeAllDOMObjectsInCurrentThread()
+void removeAllDOMObjectsInCurrentThread()
 {
     // Use the locker only if it has already been invoked before, as by worker thread.
     if (v8::Locker::IsActive()) {
diff --git a/WebCore/bindings/v8/V8DOMMap.h b/WebCore/bindings/v8/V8DOMMap.h
index 909fbcd..41dc2e04 100644
--- a/WebCore/bindings/v8/V8DOMMap.h
+++ b/WebCore/bindings/v8/V8DOMMap.h
@@ -31,8 +31,7 @@
 #ifndef V8DOMMap_h
 #define V8DOMMap_h
 
-#include "dom_wrapper_map.h"
-
+#include <wtf/HashMap.h>
 #include <v8.h>
 
 namespace WebCore {
@@ -41,6 +40,61 @@
     class SVGElementInstance;
 #endif
 
+    // A table of wrappers with weak pointers.
+    // This table allows us to avoid track wrapped objects for debugging
+    // and for ensuring that we don't double wrap the same object.
+    template<class KeyType, class ValueType> class WeakReferenceMap {
+    public:
+        WeakReferenceMap(v8::WeakReferenceCallback callback) : m_weakReferenceCallback(callback) { }
+    #ifndef NDEBUG
+        virtual ~WeakReferenceMap()
+        {
+            if (m_map.size() > 0)
+                fprintf(stderr, "Leak %d JS wrappers.\n", m_map.size());
+        }
+    #endif
+
+        // Get the JS wrapper object of an object.
+        virtual v8::Persistent<ValueType> get(KeyType* obj)
+        {
+            ValueType* wrapper = m_map.get(obj);
+            return wrapper ? v8::Persistent<ValueType>(wrapper) : v8::Persistent<ValueType>();
+        }
+
+        virtual void set(KeyType* obj, v8::Persistent<ValueType> wrapper)
+        {
+            ASSERT(!m_map.contains(obj));
+            wrapper.MakeWeak(obj, m_weakReferenceCallback);
+            m_map.set(obj, *wrapper);
+        }
+
+        virtual void forget(KeyType* obj)
+        {
+            ASSERT(obj);
+            ValueType* wrapper = m_map.take(obj);
+            if (!wrapper)
+                return;
+
+            v8::Persistent<ValueType> handle(wrapper);
+            handle.Dispose();
+            handle.Clear();
+        }
+
+        bool contains(KeyType* obj) { return m_map.contains(obj); }
+
+        HashMap<KeyType*, ValueType*>& impl() { return m_map; }
+
+    protected:
+        HashMap<KeyType*, ValueType*> m_map;
+        v8::WeakReferenceCallback m_weakReferenceCallback;
+    };
+
+
+    template <class KeyType> class DOMWrapperMap : public WeakReferenceMap<KeyType, v8::Object> {
+    public:
+        DOMWrapperMap(v8::WeakReferenceCallback callback) : WeakReferenceMap<KeyType, v8::Object>(callback) { }
+    };
+
     // Callback when JS wrapper of active DOM object is dead.
     void weakActiveDOMObjectCallback(v8::Persistent<v8::Value> v8Object, void* domObject);
 
@@ -53,6 +107,9 @@
     // A map from a DOM object to its JS wrapper for DOM objects which can have pending activity.
     DOMWrapperMap<void>& getActiveDOMObjectMap();
 
+    // This should be called to remove all DOM objects associated with the current thread when it is tearing down.
+    void removeAllDOMObjectsInCurrentThread();
+
 #if ENABLE(SVG)
     // A map for SVGElementInstances to its JS wrapper.
     DOMWrapperMap<SVGElementInstance>& getDOMSVGElementInstanceMap();
diff --git a/WebCore/bindings/v8/V8EventListenerList.cpp b/WebCore/bindings/v8/V8EventListenerList.cpp
new file mode 100644
index 0000000..df60028
--- /dev/null
+++ b/WebCore/bindings/v8/V8EventListenerList.cpp
@@ -0,0 +1,185 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8EventListenerList.h"
+
+#include "V8CustomEventListener.h"
+
+namespace WebCore {
+
+V8EventListenerListIterator::V8EventListenerListIterator(V8EventListenerList* list)
+    : m_list(list)
+    , m_vectorIndex(0)
+    , m_iter(list->m_table.begin())
+{
+}
+
+V8EventListenerListIterator::V8EventListenerListIterator(V8EventListenerList* list, bool shouldSeekToEnd)
+    : m_list(list)
+    , m_vectorIndex(0)
+    , m_iter(list->m_table.begin())
+{
+    if (shouldSeekToEnd)
+        seekToEnd();
+}
+
+V8EventListenerListIterator::~V8EventListenerListIterator() { }
+
+void V8EventListenerListIterator::operator++()
+{
+    if (m_iter != m_list->m_table.end()) {
+        Vector<V8EventListener*>* vector = m_iter->second;
+        if (m_vectorIndex + 1 < vector->size()) {
+            m_vectorIndex++;
+            return;
+        }
+        m_vectorIndex = 0;
+        ++m_iter;
+    }
+}
+
+bool V8EventListenerListIterator::operator==(const V8EventListenerListIterator& other)
+{
+    return other.m_iter == m_iter && other.m_vectorIndex == m_vectorIndex && other.m_list == m_list;
+}
+
+bool V8EventListenerListIterator::operator!=(const V8EventListenerListIterator& other)
+{
+    return !operator==(other);
+}
+
+V8EventListener* V8EventListenerListIterator::operator*()
+{
+    if (m_iter != m_list->m_table.end()) {
+        Vector<V8EventListener*>* vector = m_iter->second;
+        if (m_vectorIndex < vector->size())
+            return vector->at(m_vectorIndex);
+    }
+    return 0;
+}
+
+void V8EventListenerListIterator::seekToEnd()
+{
+    m_iter = m_list->m_table.end();
+    m_vectorIndex = 0;
+}
+
+
+V8EventListenerList::V8EventListenerList()
+{
+}
+
+V8EventListenerList::~V8EventListenerList()
+{
+}
+
+V8EventListenerListIterator V8EventListenerList::begin()
+{
+    return iterator(this);
+}
+
+V8EventListenerListIterator V8EventListenerList::end()
+{
+    return iterator(this, true);
+}
+
+
+static int getKey(v8::Local<v8::Object> object)
+{
+    // 0 is a sentinel value for the HashMap key, so we map it to 1.
+    int hash = object->GetIdentityHash();
+    if (!hash)
+        return 1;
+    return hash;
+}
+
+void V8EventListenerList::add(V8EventListener* listener)
+{
+    ASSERT(v8::Context::InContext());
+    v8::HandleScope handleScope;
+
+    v8::Local<v8::Object> object = listener->getListenerObject();
+    int key = getKey(object);
+    Vector<V8EventListener*>* vector = m_table.get(key);
+    if (!vector) {
+        vector = new Vector<V8EventListener*>();
+        m_table.set(key, vector);
+    }
+    vector->append(listener);
+    m_reverseTable.set(listener, key);
+}
+
+void V8EventListenerList::remove(V8EventListener* listener)
+{
+    if (m_reverseTable.contains(listener)) {
+        int key = m_reverseTable.get(listener);
+        Vector<V8EventListener*>* vector = m_table.get(key);
+        if (!vector)
+            return;
+        for (size_t j = 0; j < vector->size(); j++) {
+            if (vector->at(j) == listener) {
+                vector->remove(j);
+                if (!vector->size()) {
+                    m_table.remove(key);
+                    delete vector;
+                    vector = 0;
+                }
+                m_reverseTable.remove(listener);
+                return;
+            }
+        }
+    }
+}
+
+void V8EventListenerList::clear()
+{
+    m_table.clear();
+    m_reverseTable.clear();
+}
+
+V8EventListener* V8EventListenerList::find(v8::Local<v8::Object> object, bool isAttribute)
+{
+    ASSERT(v8::Context::InContext());
+    int key = getKey(object);
+
+    Vector<V8EventListener*>* vector = m_table.get(key);
+    if (!vector)
+        return 0;
+
+    for (size_t i = 0; i < vector->size(); i++) {
+        V8EventListener* element = vector->at(i);
+        if (isAttribute == element->isAttribute() && object == element->getListenerObject())
+            return element;
+    }
+    return 0;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/V8EventListenerList.h b/WebCore/bindings/v8/V8EventListenerList.h
new file mode 100644
index 0000000..d7799b8
--- /dev/null
+++ b/WebCore/bindings/v8/V8EventListenerList.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef V8EventListenerList_h
+#define V8EventListenerList_h
+
+#include <v8.h>
+#include <wtf/Vector.h>
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+    class V8EventListener;
+    class V8EventListenerListIterator;
+
+    // This is a container for V8EventListener objects that uses the identity hash of the v8::Object to
+    // speed up lookups
+    class V8EventListenerList {
+    public:
+        // Because v8::Object identity hashes are not guaranteed to be unique, we unfortunately can't just map
+        // an int to V8EventListener. Instead we define a HashMap of int to Vector of V8EventListener
+        // called a ListenerMultiMap.
+        typedef Vector<V8EventListener*>* Values;
+        struct ValuesTraits : HashTraits<Values> {
+            static const bool needsDestruction = true;
+        };
+        typedef HashMap<int, Values, DefaultHash<int>::Hash, HashTraits<int>, ValuesTraits> ListenerMultiMap;
+
+        V8EventListenerList();
+        ~V8EventListenerList();
+
+        friend class V8EventListenerListIterator;
+        typedef V8EventListenerListIterator iterator;        
+
+        iterator begin();
+        iterator end();
+
+        void add(V8EventListener*);
+        void remove(V8EventListener*);
+        V8EventListener* find(v8::Local<v8::Object>, bool isAttribute);
+        void clear();
+        size_t size() { return m_table.size(); }
+
+    private:
+        ListenerMultiMap m_table;
+
+        // we also keep a reverse mapping of V8EventListener to v8::Object identity hash,
+        // in order to speed up removal by V8EventListener
+        HashMap<V8EventListener*, int> m_reverseTable;
+    };
+
+    class V8EventListenerListIterator {
+    public:
+        ~V8EventListenerListIterator();
+        void operator++();
+        bool operator==(const V8EventListenerListIterator&);
+        bool operator!=(const V8EventListenerListIterator&);
+        V8EventListener* operator*();
+    private:
+        friend class V8EventListenerList;
+        explicit V8EventListenerListIterator(V8EventListenerList*);
+        V8EventListenerListIterator(V8EventListenerList*, bool shouldSeekToEnd);
+        void seekToEnd();
+
+        V8EventListenerList* m_list;
+        V8EventListenerList::ListenerMultiMap::iterator m_iter;
+        size_t m_vectorIndex;
+    };
+
+} // namespace WebCore
+
+#endif // V8EventListenerList_h
diff --git a/WebCore/bindings/v8/V8LazyEventListener.cpp b/WebCore/bindings/v8/V8LazyEventListener.cpp
index f53370d..f0e81de 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -37,10 +37,11 @@
 
 namespace WebCore {
 
-V8LazyEventListener::V8LazyEventListener(Frame *frame, const String& code, const String& functionName)
+V8LazyEventListener::V8LazyEventListener(Frame *frame, const String& code, const String& functionName, bool isSVGEvent)
     : V8AbstractEventListener(frame, true)
     , m_code(code)
     , m_functionName(functionName)
+    , m_isSVGEvent(isSVGEvent)
     , m_compiled(false)
     , m_wrappedFunctionCompiled(false)
 {
@@ -93,7 +94,10 @@
         // See issue 944690.
         //
         // The ECMAScript spec says (very obliquely) that the parameter to an event handler is named "evt".
-        String code = "(function (evt) {\n";
+        //
+        // Don't use new lines so that lines in the modified handler
+        // have the same numbers as in the original code.
+        String code = "(function (evt) {";
         code.append(m_code);
         code.append("\n})");
 
@@ -133,6 +137,13 @@
     return proxy->CallFunction(handlerFunction, receiver, 1, parameters);
 }
 
+
+static v8::Handle<v8::Value> V8LazyEventListenerToString(const v8::Arguments& args)
+{
+    return args.Callee()->GetHiddenValue(v8::String::New("toStringString"));
+}
+
+
 v8::Local<v8::Function> V8LazyEventListener::getWrappedListenerFunction()
 {
     if (m_wrappedFunctionCompiled) {
@@ -161,20 +172,19 @@
         // See chrome/fast/forms/form-action.html
         //     chrome/fast/forms/selected-index-value.html
         //     base/fast/overflow/onscroll-layer-self-destruct.html
-        String code = "(function (evt) {\n" \
-                      "  with (this.ownerDocument ? this.ownerDocument : {}) {\n" \
-                      "    with (this.form ? this.form : {}) {\n" \
-                      "      with (this) {\n" \
-                      "        return (function(evt){\n";
+        //
+        // Don't use new lines so that lines in the modified handler
+        // have the same numbers as in the original code.
+        String code = "(function (evt) {" \
+                      "with (this.ownerDocument ? this.ownerDocument : {}) {" \
+                      "with (this.form ? this.form : {}) {" \
+                      "with (this) {" \
+                      "return (function(evt){";
         code.append(m_code);
-        code.append(  "\n" \
-                      "}).call(this, evt);\n" \
-                      "      }\n" \
-                      "    }\n" \
-                      "  }\n" \
-                      "})");
+        // Insert '\n' otherwise //-style comments could break the handler.
+        code.append(  "\n}).call(this, evt);}}}})");
         v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
-        v8::Handle<v8::Script> script = V8Proxy::CompileScript(codeExternalString, m_frame->document()->url(), m_lineNumber - 4);
+        v8::Handle<v8::Script> script = V8Proxy::CompileScript(codeExternalString, m_frame->document()->url(), m_lineNumber);
         if (!script.IsEmpty()) {
             V8Proxy* proxy = V8Proxy::retrieve(m_frame);
             ASSERT(proxy);
@@ -183,6 +193,30 @@
                 ASSERT(value->IsFunction());
 
                 m_wrappedFunction = v8::Persistent<v8::Function>::New(v8::Local<v8::Function>::Cast(value));
+
+                // Change the toString function on the wrapper function to avoid it returning the source for the actual wrapper function. Instead
+                // it returns source for a clean wrapper function with the event argument wrapping the event source code. The reason for this
+                // is that some web sites uses toString on event functions and the evals the source returned (some times a RegExp is applied as
+                // well) for some other use. That fails miserably if the actual wrapper source is returned.
+                v8::Local<v8::FunctionTemplate> toStringTemplate = v8::FunctionTemplate::New(V8LazyEventListenerToString);
+                v8::Local<v8::Function> toStringFunction;
+                if (!toStringTemplate.IsEmpty())
+                    toStringFunction = toStringTemplate->GetFunction();
+                if (!toStringFunction.IsEmpty()) {
+                    String toStringResult = "function ";
+                    toStringResult.append(m_functionName);
+                    toStringResult.append("(");
+                    if (m_isSVGEvent)
+                        toStringResult.append("evt");
+                    else
+                        toStringResult.append("event");
+                    toStringResult.append(") {\n  ");
+                    toStringResult.append(m_code);
+                    toStringResult.append("\n}");
+                    toStringFunction->SetHiddenValue(v8::String::New("toStringString"), v8ExternalString(toStringResult));
+                    m_wrappedFunction->Set(v8::String::New("toString"), toStringFunction);
+                }
+
 #ifndef NDEBUG
                 V8Proxy::RegisterGlobalHandle(EVENT_LISTENER, this, m_wrappedFunction);
 #endif
diff --git a/WebCore/bindings/v8/V8LazyEventListener.h b/WebCore/bindings/v8/V8LazyEventListener.h
index 7c7be34..62d9342 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.h
+++ b/WebCore/bindings/v8/V8LazyEventListener.h
@@ -45,23 +45,24 @@
     // A V8LazyEventListener is always a HTML event handler.
     class V8LazyEventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8LazyEventListener> create(Frame* frame, const String& code, const String& functionName)
+        static PassRefPtr<V8LazyEventListener> create(Frame* frame, const String& code, const String& functionName, bool isSVGEvent)
         {
-            return adoptRef(new V8LazyEventListener(frame, code, functionName));
+            return adoptRef(new V8LazyEventListener(frame, code, functionName, isSVGEvent));
         }
 
-        virtual bool isInline() const { return true; }
-
         // For lazy event listener, the listener object is the same as its listener
         // function without additional scope chains.
         virtual v8::Local<v8::Object> getListenerObject() { return getWrappedListenerFunction(); }
 
     private:
-        V8LazyEventListener(Frame*, const String& code, const String& functionName);
+        V8LazyEventListener(Frame*, const String& code, const String& functionName, bool isSVGEvent);
         virtual ~V8LazyEventListener();
 
+        virtual bool virtualisAttribute() const { return true; }
+
         String m_code;
         String m_functionName;
+        bool m_isSVGEvent;
         bool m_compiled;
 
         // If the event listener is on a non-document dom node, we compile the function with some implicit scope chains before it.
diff --git a/WebCore/bindings/v8/V8ObjectEventListener.h b/WebCore/bindings/v8/V8ObjectEventListener.h
index 730b96c..501bdac 100644
--- a/WebCore/bindings/v8/V8ObjectEventListener.h
+++ b/WebCore/bindings/v8/V8ObjectEventListener.h
@@ -47,7 +47,7 @@
             return adoptRef(new V8ObjectEventListener(frame, listener, isInline));
         }
 
-    protected:
+    private:
         V8ObjectEventListener(Frame*, v8::Local<v8::Object> listener, bool isInline);
         virtual ~V8ObjectEventListener();
     };
diff --git a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.cpp b/WebCore/bindings/v8/V8Utilities.cpp
similarity index 61%
rename from WebCore/bindings/v8/V8XMLHttpRequestUtilities.cpp
rename to WebCore/bindings/v8/V8Utilities.cpp
index dfd5e45..395a8df 100644
--- a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.cpp
+++ b/WebCore/bindings/v8/V8Utilities.cpp
@@ -29,7 +29,7 @@
  */
 
 #include "config.h"
-#include "V8XMLHttpRequestUtilities.h"
+#include "V8Utilities.h"
 
 #include <v8.h>
 
@@ -37,28 +37,27 @@
 #include "V8Proxy.h"
 
 #include <wtf/Assertions.h>
+#include "Frame.h"
 
 namespace WebCore {
 
 // Use an array to hold dependents. It works like a ref-counted scheme.
-// A value can be added more than once to the xmlHttpRequest object.
-void createHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value> value)
+// A value can be added more than once to the DOM object.
+void createHiddenDependency(v8::Local<v8::Object> object, v8::Local<v8::Value> value, int cacheIndex)
 {
-    ASSERT(V8Proxy::GetDOMWrapperType(xmlHttpRequest) == V8ClassIndex::XMLHTTPREQUEST || V8Proxy::GetDOMWrapperType(xmlHttpRequest) == V8ClassIndex::XMLHTTPREQUESTUPLOAD);
-    v8::Local<v8::Value> cache = xmlHttpRequest->GetInternalField(V8Custom::kXMLHttpRequestCacheIndex);
+    v8::Local<v8::Value> cache = object->GetInternalField(cacheIndex);
     if (cache->IsNull() || cache->IsUndefined()) {
         cache = v8::Array::New();
-        xmlHttpRequest->SetInternalField(V8Custom::kXMLHttpRequestCacheIndex, cache);
+        object->SetInternalField(cacheIndex, cache);
     }
 
     v8::Local<v8::Array> cacheArray = v8::Local<v8::Array>::Cast(cache);
     cacheArray->Set(v8::Integer::New(cacheArray->Length()), value);
 }
 
-void removeHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value> value)
+void removeHiddenDependency(v8::Local<v8::Object> object, v8::Local<v8::Value> value, int cacheIndex)
 {
-    ASSERT(V8Proxy::GetDOMWrapperType(xmlHttpRequest) == V8ClassIndex::XMLHTTPREQUEST || V8Proxy::GetDOMWrapperType(xmlHttpRequest) == V8ClassIndex::XMLHTTPREQUESTUPLOAD);
-    v8::Local<v8::Value> cache = xmlHttpRequest->GetInternalField(V8Custom::kXMLHttpRequestCacheIndex);
+    v8::Local<v8::Value> cache = object->GetInternalField(cacheIndex);
     ASSERT(cache->IsArray());
     v8::Local<v8::Array> cacheArray = v8::Local<v8::Array>::Cast(cache);
     for (int i = cacheArray->Length() - 1; i >= 0; --i) {
@@ -73,4 +72,35 @@
     ASSERT_NOT_REACHED();
 }
 
+bool processingUserGesture()
+{
+    Frame* frame = V8Proxy::retrieveFrameForEnteredContext();
+    return frame && frame->script()->processingUserGesture();
+}
+
+bool shouldAllowNavigation(Frame* frame)
+{
+    Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
+    return callingFrame && callingFrame->loader()->shouldAllowNavigation(frame);
+}
+
+KURL completeURL(const String& relativeURL)
+{
+    // For histoical reasons, we need to complete the URL using the dynamic frame.
+    Frame* frame = V8Proxy::retrieveFrameForEnteredContext();
+    if (!frame)
+        return KURL();
+    return frame->loader()->completeURL(relativeURL);
+}
+
+void navigateIfAllowed(Frame* frame, const KURL& url, bool lockHistory, bool lockBackForwardList)
+{
+    Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
+    if (!callingFrame)
+        return;
+
+    if (!protocolIsJavaScript(url) || ScriptController::isSafeScript(frame))
+        frame->loader()->scheduleLocationChange(url.string(), callingFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture());
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Utilities.h b/WebCore/bindings/v8/V8Utilities.h
new file mode 100644
index 0000000..5769910
--- /dev/null
+++ b/WebCore/bindings/v8/V8Utilities.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef V8Utilities_h
+#define V8Utilities_h
+
+// FIXME: Remove once chromium dependencies on v8_utility.h are removed.
+#define V8UTILITIES_DEFINED 1
+
+#include <v8.h>
+
+namespace WebCore {
+
+    class Frame;
+    class KURL;
+    class String;
+
+    // Use an array to hold dependents. It works like a ref-counted scheme. A value can be added more than once to the DOM object.
+    void createHiddenDependency(v8::Local<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
+    void removeHiddenDependency(v8::Local<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
+
+    bool processingUserGesture();
+    bool shouldAllowNavigation(Frame*);
+    KURL completeURL(const String& relativeURL);
+    void navigateIfAllowed(Frame*, const KURL&, bool lockHistory, bool lockBackForwardList);
+
+    class AllowAllocation {
+    public:
+        inline AllowAllocation()
+        {
+            m_previous = m_current;
+            m_current = true;
+        }
+
+        inline ~AllowAllocation()
+        {
+            m_current = m_previous;
+        }
+
+        static bool m_current;
+
+    private:
+        bool m_previous;
+    };
+
+    class SafeAllocation {
+     public:
+      static inline v8::Local<v8::Object> newInstance(v8::Handle<v8::Function>);
+      static inline v8::Local<v8::Object> newInstance(v8::Handle<v8::ObjectTemplate>);
+      static inline v8::Local<v8::Object> newInstance(v8::Handle<v8::Function>, int argc, v8::Handle<v8::Value> argv[]);
+
+      // FIXME: These NewInstance functions are here to ease upstreaming. Remove along with V8UTILITIES_DEFINED once chromium dependencies on v8_utility.h are removed.
+      static inline v8::Local<v8::Object> NewInstance(v8::Handle<v8::Function>);
+      static inline v8::Local<v8::Object> NewInstance(v8::Handle<v8::ObjectTemplate>);
+      static inline v8::Local<v8::Object> NewInstance(v8::Handle<v8::Function>, int argc, v8::Handle<v8::Value> argv[]);
+    };
+
+    v8::Local<v8::Object> SafeAllocation::newInstance(v8::Handle<v8::Function> function)
+    {
+        if (function.IsEmpty())
+            return v8::Local<v8::Object>();
+        AllowAllocation allow;
+        return function->NewInstance();
+    }
+
+    v8::Local<v8::Object> SafeAllocation::newInstance(v8::Handle<v8::ObjectTemplate> objectTemplate)
+    {
+        if (objectTemplate.IsEmpty())
+            return v8::Local<v8::Object>();
+        AllowAllocation allow;
+        return objectTemplate->NewInstance();
+    }
+
+    v8::Local<v8::Object> SafeAllocation::newInstance(v8::Handle<v8::Function> function, int argc, v8::Handle<v8::Value> argv[])
+    {
+        if (function.IsEmpty())
+            return v8::Local<v8::Object>();
+        AllowAllocation allow;
+        return function->NewInstance(argc, argv);
+    }
+
+    // FIXME: These NewInstance functions are here to ease upstreaming. Remove along with V8UTILITIES_DEFINED once chromium dependencies on v8_utility.h are removed.
+    v8::Local<v8::Object> SafeAllocation::NewInstance(v8::Handle<v8::Function> function)
+    {
+        return newInstance(function);
+    }
+
+    v8::Local<v8::Object> SafeAllocation::NewInstance(v8::Handle<v8::ObjectTemplate> objectTemplate)
+    {
+        return newInstance(objectTemplate);
+    }
+
+    v8::Local<v8::Object> SafeAllocation::NewInstance(v8::Handle<v8::Function> function, int argc, v8::Handle<v8::Value> argv[])
+    {
+        return newInstance(function, argc, argv);
+    }
+
+} // namespace WebCore
+
+#endif // V8Utilities_h
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
index ba7a2c0..9bb48fb 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
@@ -40,7 +40,7 @@
 namespace WebCore {
 
 V8WorkerContextEventListener::V8WorkerContextEventListener(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
-    : V8ObjectEventListener(0, listener, isInline)
+    : V8EventListener(0, listener, isInline)
     , m_proxy(proxy)
 {
 }
@@ -54,7 +54,7 @@
 
 void V8WorkerContextEventListener::handleEvent(Event* event, bool isWindowEvent)
 {
-    // Is the EventListener disconnected from the frame?
+    // Is the EventListener disconnected?
     if (disconnected())
         return;
 
@@ -62,7 +62,6 @@
     // See issue 889829.
     RefPtr<V8AbstractEventListener> protect(this);
 
-    v8::Locker locker;
     v8::HandleScope handleScope;
 
     v8::Handle<v8::Context> context = m_proxy->GetContext();
@@ -81,10 +80,10 @@
 v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event, bool isWindowEvent)
 {
     v8::Local<v8::Function> handlerFunction = getListenerFunction();
-    if (handlerFunction.IsEmpty())
+    v8::Local<v8::Object> receiver = getReceiverObject(event, isWindowEvent);
+    if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
-    v8::Local<v8::Object> receiver = getReceiverObject(event, isWindowEvent);
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
     v8::Local<v8::Value> result = handlerFunction->Call(receiver, 1, parameters);
 
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.h b/WebCore/bindings/v8/V8WorkerContextEventListener.h
index 85dae41..8e56a73 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.h
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.h
@@ -33,7 +33,7 @@
 
 #if ENABLE(WORKERS)
 
-#include "V8ObjectEventListener.h"
+#include "V8CustomEventListener.h"
 #include <v8.h>
 #include <wtf/PassRefPtr.h>
 
@@ -42,7 +42,7 @@
     class Event;
     class WorkerContextExecutionProxy;
 
-    class V8WorkerContextEventListener : public V8ObjectEventListener {
+    class V8WorkerContextEventListener : public V8EventListener {
     public:
         static PassRefPtr<V8WorkerContextEventListener> create(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
         {
@@ -54,6 +54,7 @@
         virtual void handleEvent(Event*, bool isWindowEvent);
         virtual bool disconnected() const { return !m_proxy; }
 
+        WorkerContextExecutionProxy* proxy() const { return m_proxy; }
         void disconnect() { m_proxy = 0; }
 
     private:
diff --git a/WebCore/css/themeChromiumWin.css b/WebCore/bindings/v8/V8WorkerContextObjectEventListener.cpp
similarity index 65%
copy from WebCore/css/themeChromiumWin.css
copy to WebCore/bindings/v8/V8WorkerContextObjectEventListener.cpp
index e829373..bec25f1 100644
--- a/WebCore/css/themeChromiumWin.css
+++ b/WebCore/bindings/v8/V8WorkerContextObjectEventListener.cpp
@@ -1,10 +1,10 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,12 +28,32 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* These styles override the default styling for HTML elements as defined in
-   WebCore/css/themeWin.css. */
-#include "themeWin.css"
+#include "config.h"
 
-input[type="search"]::-webkit-search-cancel-button,
-input[type="search"]::-webkit-search-results-decoration,
-input[type="search"]::-webkit-search-results-button {
-    margin: 0 0 0 0;
+#if ENABLE(WORKERS)
+
+#include "V8WorkerContextObjectEventListener.h"
+
+#include "WorkerContextExecutionProxy.h"
+
+namespace WebCore {
+
+static void weakObjectEventListenerCallback(v8::Persistent<v8::Value>, void* parameter)
+{
+    V8WorkerContextObjectEventListener* listener = static_cast<V8WorkerContextObjectEventListener*>(parameter);
+
+    // Remove the wrapper
+    listener->proxy()->RemoveEventListener(listener);
+
+    listener->disposeListenerObject();
 }
+
+V8WorkerContextObjectEventListener::V8WorkerContextObjectEventListener(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
+    : V8WorkerContextEventListener(proxy, listener, isInline)
+{
+    m_listener.MakeWeak(this, weakObjectEventListenerCallback);
+}
+
+} // namespace WebCore
+
+#endif // WORKERS
diff --git a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h b/WebCore/bindings/v8/V8WorkerContextObjectEventListener.h
similarity index 64%
copy from WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
copy to WebCore/bindings/v8/V8WorkerContextObjectEventListener.h
index 5a55974..6471637 100644
--- a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
+++ b/WebCore/bindings/v8/V8WorkerContextObjectEventListener.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,18 +28,32 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8XMLHttpRequestUtilities_h
-#define V8XMLHttpRequestUtilities_h
+#ifndef V8WorkerContextObjectEventListener_h
+#define V8WorkerContextObjectEventListener_h
 
+#if ENABLE(WORKERS)
+
+#include "V8WorkerContextEventListener.h"
 #include <v8.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
-// Use an array to hold dependents. It works like a ref-counted scheme.
-// A value can be added more than once to the xmlHttpRequest object.
-void createHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
-void removeHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
+    class WorkerContextExecutionProxy;
+
+    class V8WorkerContextObjectEventListener : public V8WorkerContextEventListener {
+    public:
+        static PassRefPtr<V8WorkerContextObjectEventListener> create(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
+        {
+            return adoptRef(new V8WorkerContextObjectEventListener(proxy, listener, isInline));
+        }
+
+    private:
+        V8WorkerContextObjectEventListener(WorkerContextExecutionProxy*, v8::Local<v8::Object> listener, bool isInline);
+    };
 
 } // namespace WebCore
 
-#endif // V8XMLHttpRequestUtilities_h
+#endif // WORKERS
+
+#endif // V8WorkerContextObjectEventListener_h
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index a46aa24..7af9536 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -39,6 +39,8 @@
 #include "V8Proxy.h"
 #include "Event.h"
 #include "V8WorkerContextEventListener.h"
+#include "V8WorkerContextObjectEventListener.h"
+#include "Worker.h"
 #include "WorkerContext.h"
 #include "WorkerLocation.h"
 #include "WorkerNavigator.h"
@@ -48,6 +50,33 @@
 
 static bool isWorkersEnabled = false;
 
+static void reportFatalErrorInV8(const char* location, const char* message)
+{
+    // FIXME: We temporarily deal with V8 internal error situations such as out-of-memory by crashing the worker.
+    CRASH();
+}
+
+static void handleConsoleMessage(v8::Handle<v8::Message> message, v8::Handle<v8::Value> data)
+{
+    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
+    if (!proxy)
+        return;
+    
+    WorkerContext* workerContext = proxy->workerContext();
+    if (!workerContext)
+        return;
+    
+    v8::Handle<v8::String> errorMessageString = message->Get();
+    ASSERT(!errorMessageString.IsEmpty());
+    String errorMessage = ToWebCoreString(errorMessageString);
+    
+    v8::Handle<v8::Value> resourceName = message->GetScriptResourceName();
+    bool useURL = (resourceName.IsEmpty() || !resourceName->IsString());
+    String resourceNameString = useURL ? workerContext->url() : ToWebCoreString(resourceName);
+    
+    workerContext->addMessage(ConsoleDestination, JSMessageSource, ErrorMessageLevel, errorMessage, message->GetLineNumber(), resourceNameString);
+}
+
 bool WorkerContextExecutionProxy::isWebWorkersEnabled()
 {
     return isWorkersEnabled;
@@ -62,6 +91,7 @@
     : m_workerContext(workerContext)
     , m_recursion(0)
 {
+    initV8IfNeeded();
 }
 
 WorkerContextExecutionProxy::~WorkerContextExecutionProxy()
@@ -72,10 +102,13 @@
 void WorkerContextExecutionProxy::dispose()
 {
     // Disconnect all event listeners.
-    for (size_t listenerIndex = 0; listenerIndex < m_listeners.size(); ++listenerIndex)
-       m_listeners[listenerIndex]->disconnect();
+    if (m_listeners.get())
+    {
+        for (V8EventListenerList::iterator iterator(m_listeners->begin()); iterator != m_listeners->end(); ++iterator)
+           static_cast<V8WorkerContextEventListener*>(*iterator)->disconnect();
 
-    m_listeners.clear();
+        m_listeners->clear();
+    }
 
     // Detach all events from their JS wrappers.
     for (size_t eventIndex = 0; eventIndex < m_events.size(); ++eventIndex) {
@@ -90,17 +123,6 @@
         m_context.Dispose();
         m_context.Clear();
     }
-
-    // Remove the wrapping between JS object and DOM object. This is because
-    // the worker context object is going to be disposed immediately when a
-    // worker thread is tearing down. We do not want to re-delete the real object
-    // when JS object is garbage collected.
-    v8::Locker locker;
-    v8::HandleScope scope;
-    v8::Persistent<v8::Object> wrapper = domObjectMap().get(m_workerContext);
-    if (!wrapper.IsEmpty())
-        V8Proxy::SetDOMWrapper(wrapper, V8ClassIndex::INVALID_CLASS_INDEX, NULL);
-    domObjectMap().forget(m_workerContext);
 }
 
 WorkerContextExecutionProxy* WorkerContextExecutionProxy::retrieve()
@@ -108,11 +130,30 @@
     v8::Handle<v8::Context> context = v8::Context::GetCurrent();
     v8::Handle<v8::Object> global = context->Global();
     global = V8Proxy::LookupDOMWrapper(V8ClassIndex::WORKERCONTEXT, global);
-    ASSERT(!global.IsEmpty());
+    // Return 0 if the current executing context is not the worker context.
+    if (global.IsEmpty())
+        return 0;
     WorkerContext* workerContext = V8Proxy::ToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, global);
     return workerContext->script()->proxy();
 }
 
+void WorkerContextExecutionProxy::initV8IfNeeded()
+{
+    static bool v8Initialized = false;
+
+    if (v8Initialized)
+        return;
+
+    // Tell V8 not to call the default OOM handler, binding code will handle it.
+    v8::V8::IgnoreOutOfMemoryException();
+    v8::V8::SetFatalErrorHandler(reportFatalErrorInV8);
+
+    // Set up the handler for V8 error message.
+    v8::V8::AddMessageListener(handleConsoleMessage);
+
+    v8Initialized = true;
+}
+
 void WorkerContextExecutionProxy::initContextIfNeeded()
 {
     // Bail out if the context has already been initialized.
@@ -121,7 +162,7 @@
 
     // Create a new environment
     v8::Persistent<v8::ObjectTemplate> globalTemplate;
-    m_context = v8::Context::New(NULL, globalTemplate);
+    m_context = v8::Context::New(0, globalTemplate);
 
     // Starting from now, use local context only.
     v8::Local<v8::Context> context = v8::Local<v8::Context>::New(m_context);
@@ -132,7 +173,7 @@
 
     // Create a new JS object and use it as the prototype for the shadow global object.
     v8::Handle<v8::Function> workerContextConstructor = GetConstructor(V8ClassIndex::WORKERCONTEXT);
-    v8::Local<v8::Object> jsWorkerContext = SafeAllocation::NewInstance(workerContextConstructor);
+    v8::Local<v8::Object> jsWorkerContext = SafeAllocation::newInstance(workerContextConstructor);
     // Bail out if allocation failed.
     if (jsWorkerContext.IsEmpty()) {
         dispose();
@@ -143,10 +184,13 @@
     V8Proxy::SetDOMWrapper(jsWorkerContext, V8ClassIndex::ToInt(V8ClassIndex::WORKERCONTEXT), m_workerContext);
 
     V8Proxy::SetJSWrapperForDOMObject(m_workerContext, v8::Persistent<v8::Object>::New(jsWorkerContext));
+    m_workerContext->ref();
 
     // Insert the object instance as the prototype of the shadow object.
     v8::Handle<v8::Object> globalObject = m_context->Global();
     globalObject->Set(implicitProtoString, jsWorkerContext);
+
+    m_listeners.set(new V8EventListenerList());
 }
 
 v8::Local<v8::Function> WorkerContextExecutionProxy::GetConstructor(V8ClassIndex::V8WrapperType type)
@@ -173,6 +217,19 @@
     if (type == V8ClassIndex::WORKERCONTEXT)
         return WorkerContextToV8Object(static_cast<WorkerContext*>(impl));
 
+    if (type == V8ClassIndex::WORKER) {
+        v8::Persistent<v8::Object> result = getActiveDOMObjectMap().get(impl);
+        if (!result.IsEmpty())
+            return result;
+
+        v8::Local<v8::Object> object = toV8(type, type, impl);
+        if (!object.IsEmpty())
+            static_cast<Worker*>(impl)->ref();
+        result = v8::Persistent<v8::Object>::New(object);
+        V8Proxy::SetJSWrapperForDOMObject(impl, result);
+        return result;
+    }
+
     // Non DOM node
     v8::Persistent<v8::Object> result = domObjectMap().get(impl);
     if (result.IsEmpty()) {
@@ -222,7 +279,7 @@
     return result;
 }
 
-// A JS object of type EventTarget in the worker context can only be WorkerContext.
+// A JS object of type EventTarget in the worker context can only be Worker or WorkerContext.
 v8::Handle<v8::Value> WorkerContextExecutionProxy::EventTargetToV8Object(EventTarget* target)
 {
     if (!target)
@@ -232,6 +289,10 @@
     if (workerContext)
         return WorkerContextToV8Object(workerContext);
 
+    Worker* worker = target->toWorker();
+    if (worker)
+        return ToV8Object(V8ClassIndex::WORKER, worker);
+
     ASSERT_NOT_REACHED();
     return v8::Handle<v8::Value>();
 }
@@ -257,7 +318,7 @@
     else
         function = V8Proxy::GetTemplate(descType)->GetFunction();
 
-    v8::Local<v8::Object> instance = SafeAllocation::NewInstance(function);
+    v8::Local<v8::Object> instance = SafeAllocation::newInstance(function);
     if (!instance.IsEmpty()) {
         // Avoid setting the DOM wrapper for failed allocations.
         V8Proxy::SetDOMWrapper(instance, V8ClassIndex::ToInt(cptrType), impl);
@@ -276,7 +337,6 @@
 
 v8::Local<v8::Value> WorkerContextExecutionProxy::evaluate(const String& script, const String& fileName, int baseLine)
 {
-    v8::Locker locker;
     v8::HandleScope hs;
 
     initContextIfNeeded();
@@ -319,34 +379,39 @@
     return result;
 }
 
-PassRefPtr<V8EventListener> WorkerContextExecutionProxy::FindOrCreateEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly)
+PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateEventListenerHelper(v8::Local<v8::Value> object, bool isInline, bool findOnly, bool createObjectEventListener)
 {
     if (!object->IsObject())
         return 0;
 
-    for (size_t index = 0; index < m_listeners.size(); ++index) {
-        V8EventListener* el = m_listeners[index];
-        if (el->isInline() == isInline && el->getListenerObject() == object)
-            return el;
-    }
+    V8EventListener* listener = m_listeners->find(object->ToObject(), isInline);
     if (findOnly)
-        return NULL;
+        return listener;
 
     // Create a new one, and add to cache.
-    RefPtr<V8WorkerContextEventListener> listener = V8WorkerContextEventListener::create(this, v8::Local<v8::Object>::Cast(object), isInline);
-    m_listeners.append(listener.get());
+    RefPtr<V8EventListener> newListener;
+    if (createObjectEventListener)
+        newListener = V8WorkerContextObjectEventListener::create(this, v8::Local<v8::Object>::Cast(object), isInline);
+    else
+        newListener = V8WorkerContextEventListener::create(this, v8::Local<v8::Object>::Cast(object), isInline);
+    m_listeners->add(newListener.get());
 
-    return listener.release();
+    return newListener.release();
+}
+
+PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly)
+{
+    return findOrCreateEventListenerHelper(object, isInline, findOnly, false);
+}
+
+PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateObjectEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly)
+{
+    return findOrCreateEventListenerHelper(object, isInline, findOnly, true);
 }
 
 void WorkerContextExecutionProxy::RemoveEventListener(V8EventListener* listener)
 {
-    for (size_t index = 0; index < m_listeners.size(); ++index) {
-        if (m_listeners[index] == listener) {
-            m_listeners.remove(index);
-            return;
-        }
-    }
+    m_listeners->remove(listener);
 }
 
 void WorkerContextExecutionProxy::trackEvent(Event* event)
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.h b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
index 3023666..dad191c 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.h
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
@@ -35,7 +35,9 @@
 #if ENABLE(WORKERS)
 
 #include <v8.h>
+#include "V8EventListenerList.h"
 #include "V8Index.h"
+#include <wtf/OwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -54,7 +56,6 @@
         // FIXME: following function sshould have camelCased names once V8 code-generating script is migrated.
         v8::Local<v8::Context> GetContext() { return v8::Local<v8::Context>::New(m_context); }
         v8::Local<v8::Function> GetConstructor(V8ClassIndex::V8WrapperType);
-        PassRefPtr<V8EventListener> FindOrCreateEventListener(v8::Local<v8::Value> listener, bool isInline, bool findOnly);
         void RemoveEventListener(V8EventListener*);
 
         static v8::Handle<v8::Value> ToV8Object(V8ClassIndex::V8WrapperType type, void* impl);
@@ -62,6 +63,10 @@
         static v8::Handle<v8::Value> EventTargetToV8Object(EventTarget* target);
         static v8::Handle<v8::Value> WorkerContextToV8Object(WorkerContext* wc);
 
+        // Finds/creates event listener wrappers.
+        PassRefPtr<V8EventListener> findOrCreateEventListener(v8::Local<v8::Value> listener, bool isInline, bool findOnly);
+        PassRefPtr<V8EventListener> findOrCreateObjectEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly);
+
         // Track the event so that we can detach it from the JS wrapper when a worker
         // terminates. This is needed because we need to be able to dispose these
         // events and releases references to their event targets: WorkerContext.
@@ -73,7 +78,7 @@
         // Returns WorkerContext object.
         WorkerContext* workerContext() { return m_workerContext; }
 
-        // Returns WorkerContextExecutionProxy object of the currently executing context.
+        // Returns WorkerContextExecutionProxy object of the currently executing context. 0 will be returned if the current executing context is not the worker context.
         static WorkerContextExecutionProxy* retrieve();
 
         // Enables HTML5 worker support.
@@ -81,8 +86,10 @@
         static void setIsWebWorkersEnabled(bool);
 
     private:
+        void initV8IfNeeded();
         void initContextIfNeeded();
         void dispose();
+        PassRefPtr<V8EventListener> findOrCreateEventListenerHelper(v8::Local<v8::Value> object, bool isInline, bool findOnly, bool createObjectEventListener);
 
         // Run an already compiled script.
         v8::Local<v8::Value> runScript(v8::Handle<v8::Script>);
@@ -95,7 +102,7 @@
         v8::Persistent<v8::Context> m_context;
         int m_recursion;
 
-        Vector<V8WorkerContextEventListener*> m_listeners;
+        OwnPtr<V8EventListenerList> m_listeners;
         Vector<Event*> m_events;
     };
 
diff --git a/WebCore/bindings/v8/WorkerScriptController.cpp b/WebCore/bindings/v8/WorkerScriptController.cpp
index 85bee0a..b3ede11 100644
--- a/WebCore/bindings/v8/WorkerScriptController.cpp
+++ b/WebCore/bindings/v8/WorkerScriptController.cpp
@@ -39,6 +39,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "DOMTimer.h"
+#include "V8DOMMap.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 #include "WorkerObjectProxy.h"
@@ -55,6 +56,7 @@
 
 WorkerScriptController::~WorkerScriptController()
 {
+    removeAllDOMObjectsInCurrentThread();
 }
 
 ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode)
@@ -66,7 +68,7 @@
     }
 
     v8::Local<v8::Value> result = m_proxy->evaluate(sourceCode.source(), sourceCode.url().string(), sourceCode.startLine() - 1);
-    m_workerContext->thread()->workerObjectProxy()->reportPendingActivity(m_workerContext->hasPendingActivity());
+    m_workerContext->thread()->workerObjectProxy().reportPendingActivity(m_workerContext->hasPendingActivity());
     return ScriptValue();
 }
 
diff --git a/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp b/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
index c86f924..1ad0e7a 100644
--- a/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "CSSStyleDeclaration.h"
 
+#include "CSSParser.h"
 #include "CSSValue.h"
 #include "CSSPrimitiveValue.h"
 #include "EventTarget.h"
@@ -42,6 +43,7 @@
 #include <wtf/ASCIICType.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -75,6 +77,13 @@
     return false;
 }
 
+class CSSPropertyInfo {
+public:
+    int propID;
+    bool hadPixelOrPosPrefix;
+    bool wasFilter;
+};
+
 // When getting properties on CSSStyleDeclarations, the name used from
 // Javascript and the actual name of the property are not the same, so
 // we have to do the following translation.  The translation turns upper
@@ -86,47 +95,61 @@
 // Also, certain prefixes such as 'pos', 'css-' and 'pixel-' are stripped
 // and the hadPixelOrPosPrefix out parameter is used to indicate whether or
 // not the property name was prefixed with 'pos-' or 'pixel-'.
-static String cssPropertyName(const String& propertyName, bool& hadPixelOrPosPrefix)
+static CSSPropertyInfo* cssPropertyInfo(v8::Handle<v8::String>v8PropertyName)
 {
-    hadPixelOrPosPrefix = false;
+    String propertyName = toWebCoreString(v8PropertyName);
+    typedef HashMap<String, CSSPropertyInfo*> CSSPropertyInfoMap;
+    DEFINE_STATIC_LOCAL(CSSPropertyInfoMap, map, ());
+    CSSPropertyInfo* propInfo = map.get(propertyName);
+    if (!propInfo) {
+        unsigned length = propertyName.length();
+        bool hadPixelOrPosPrefix = false;
+        if (!length)
+            return 0;
 
-    unsigned length = propertyName.length();
-    if (!length)
-        return String();
+        Vector<UChar> name;
+        name.reserveCapacity(length);
 
-    Vector<UChar> name;
-    name.reserveCapacity(length);
+        unsigned i = 0;
 
-    unsigned i = 0;
-
-    if (hasCSSPropertyNamePrefix(propertyName, "css"))
-        i += 3;
-    else if (hasCSSPropertyNamePrefix(propertyName, "pixel")) {
-        i += 5;
-        hadPixelOrPosPrefix = true;
-    } else if (hasCSSPropertyNamePrefix(propertyName, "pos")) {
-        i += 3;
-        hadPixelOrPosPrefix = true;
-    } else if (hasCSSPropertyNamePrefix(propertyName, "webkit")
-            || hasCSSPropertyNamePrefix(propertyName, "khtml")
-            || hasCSSPropertyNamePrefix(propertyName, "apple"))
-        name.append('-');
-    else if (WTF::isASCIIUpper(propertyName[0]))
-        return String();
-
-    name.append(WTF::toASCIILower(propertyName[i++]));
-
-    for (; i < length; ++i) {
-        UChar c = propertyName[i];
-        if (!WTF::isASCIIUpper(c))
-            name.append(c);
-        else {
+        if (hasCSSPropertyNamePrefix(propertyName, "css"))
+            i += 3;
+        else if (hasCSSPropertyNamePrefix(propertyName, "pixel")) {
+            i += 5;
+            hadPixelOrPosPrefix = true;
+        } else if (hasCSSPropertyNamePrefix(propertyName, "pos")) {
+            i += 3;
+            hadPixelOrPosPrefix = true;
+        } else if (hasCSSPropertyNamePrefix(propertyName, "webkit")
+                || hasCSSPropertyNamePrefix(propertyName, "khtml")
+                || hasCSSPropertyNamePrefix(propertyName, "apple"))
             name.append('-');
-            name.append(WTF::toASCIILower(c));
+        else if (WTF::isASCIIUpper(propertyName[0]))
+            return 0;
+
+        name.append(WTF::toASCIILower(propertyName[i++]));
+
+        for (; i < length; ++i) {
+            UChar c = propertyName[i];
+            if (!WTF::isASCIIUpper(c))
+                name.append(c);
+            else {
+                name.append('-');
+                name.append(WTF::toASCIILower(c));
+            }
+        }
+
+        String propName = String::adopt(name);
+        int propertyID = cssPropertyID(propName);
+        if (propertyID) {
+            propInfo = new CSSPropertyInfo();
+            propInfo->hadPixelOrPosPrefix = hadPixelOrPosPrefix;
+            propInfo->wasFilter = (propName == "filter");
+            propInfo->propID = propertyID;
+            map.add(propertyName, propInfo);
         }
     }
-
-    return String::adopt(name);
+    return propInfo;
 }
 
 NAMED_PROPERTY_GETTER(CSSStyleDeclaration)
@@ -137,30 +160,32 @@
         return notHandledByInterceptor();
 
     // Search the style declaration.
-    CSSStyleDeclaration* imp = V8Proxy::ToNativeObject<CSSStyleDeclaration>(V8ClassIndex::CSSSTYLEDECLARATION, info.Holder());
-
-    bool hadPixelOrPosPrefix = false;
-    String propertyName = cssPropertyName(toWebCoreString(name), hadPixelOrPosPrefix);
+    CSSStyleDeclaration* imp =
+        V8Proxy::ToNativeObject<CSSStyleDeclaration>(V8ClassIndex::CSSSTYLEDECLARATION, info.Holder());
+    CSSPropertyInfo* propInfo = cssPropertyInfo(name);
 
     // Do not handle non-property names.
-    if (!CSSStyleDeclaration::isPropertyName(propertyName))
+    if (!propInfo)
         return notHandledByInterceptor();
 
 
-    RefPtr<CSSValue> cssValue = imp->getPropertyCSSValue(propertyName);
+    RefPtr<CSSValue> cssValue = imp->getPropertyCSSValue(propInfo->propID);
     if (cssValue) {
-        if (hadPixelOrPosPrefix && cssValue->cssValueType() == CSSValue::CSS_PRIMITIVE_VALUE)
-            return v8::Number::New(static_cast<CSSPrimitiveValue*>(cssValue.get())->getFloatValue(CSSPrimitiveValue::CSS_PX));
+        if (propInfo->hadPixelOrPosPrefix &&
+            cssValue->cssValueType() == CSSValue::CSS_PRIMITIVE_VALUE) {
+            return v8::Number::New(static_cast<CSSPrimitiveValue*>(
+                cssValue.get())->getFloatValue(CSSPrimitiveValue::CSS_PX));
+        }
         return v8StringOrNull(cssValue->cssText());
     }
 
-    String result = imp->getPropertyValue(propertyName);
+    String result = imp->getPropertyValue(propInfo->propID);
     if (result.isNull())
         result = "";  // convert null to empty string.
 
     // The 'filter' attribute is made undetectable in KJS/WebKit
     // to avoid confusion with IE's filter extension.
-    if (propertyName == "filter")
+    if (propInfo->wasFilter)
         return v8UndetectableString(result);
 
     return v8String(result);
@@ -169,19 +194,25 @@
 NAMED_PROPERTY_SETTER(CSSStyleDeclaration)
 {
     INC_STATS("DOM.CSSStyleDeclaration.NamedPropertySetter");
-    CSSStyleDeclaration* imp = V8Proxy::ToNativeObject<CSSStyleDeclaration>(V8ClassIndex::CSSSTYLEDECLARATION, info.Holder());
-
-    bool hadPixelOrPosPrefix = false;
-    String prop = cssPropertyName(toWebCoreString(name), hadPixelOrPosPrefix);
-    if (!CSSStyleDeclaration::isPropertyName(prop))
+    CSSStyleDeclaration* imp =
+        V8Proxy::ToNativeObject<CSSStyleDeclaration>(
+            V8ClassIndex::CSSSTYLEDECLARATION, info.Holder());
+    CSSPropertyInfo* propInfo = cssPropertyInfo(name);
+    if (!propInfo)
         return notHandledByInterceptor();
 
     String propertyValue = valueToStringWithNullCheck(value);
-    if (hadPixelOrPosPrefix)
+    if (propInfo->hadPixelOrPosPrefix)
         propertyValue.append("px");
 
     ExceptionCode ec = 0;
-    imp->setProperty(prop, propertyValue, ec);
+    int importantIndex = propertyValue.find("!important", 0, false);
+    bool important = false;
+    if (importantIndex != -1) {
+        important = true;
+        propertyValue = propertyValue.left(importantIndex - 1);
+    }
+    imp->setProperty(propInfo->propID, propertyValue, important, ec);
 
     if (ec)
         throwError(ec);
diff --git a/WebCore/bindings/v8/custom/V8CanvasPixelArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasPixelArrayCustom.cpp
new file mode 100644
index 0000000..28f6b59
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasPixelArrayCustom.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CanvasPixelArray.h"
+
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+// Get the specified value from the pixel buffer and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid pixel buffer range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasPixelArray)
+{
+    INC_STATS("DOM.CanvasPixelArray.IndexedPropertyGetter");
+    CanvasPixelArray* pixelBuffer = V8Proxy::ToNativeObject<CanvasPixelArray>(V8ClassIndex::CANVASPIXELARRAY, info.Holder());
+
+    if ((index < 0) || (index >= pixelBuffer->length()))
+        return v8::Undefined();
+    unsigned char result;
+    if (!pixelBuffer->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the pixel buffer. Accesses outside the valid pixel buffer range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasPixelArray)
+{
+    INC_STATS("DOM.CanvasPixelArray.IndexedPropertySetter");
+    CanvasPixelArray* pixelBuffer = V8Proxy::ToNativeObject<CanvasPixelArray>(V8ClassIndex::CANVASPIXELARRAY, info.Holder());
+
+    if ((index >= 0) && (index < pixelBuffer->length()))
+        pixelBuffer->set(index, value->NumberValue());
+    return value;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp
index 0570e0e..26086ab 100644
--- a/WebCore/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp
@@ -34,11 +34,15 @@
 #include "CanvasGradient.h"
 #include "CanvasPattern.h"
 #include "CanvasStyle.h"
+#include "ExceptionCode.h"
+#include "FloatRect.h"
 
 #include "V8Binding.h"
 #include "V8CanvasGradient.h"
 #include "V8CanvasPattern.h"
 #include "V8CustomBinding.h"
+#include "V8HTMLCanvasElement.h"
+#include "V8HTMLImageElement.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
@@ -92,4 +96,330 @@
     impl->setFillStyle(toCanvasStyle(value));
 }
 
+// TODO: SetStrokeColor and SetFillColor are similar except function names,
+// consolidate them into one.
+CALLBACK_FUNC_DECL(CanvasRenderingContext2DSetStrokeColor)
+{
+    INC_STATS("DOM.CanvasRenderingContext2D.setStrokeColor()");
+    CanvasRenderingContext2D* context = V8Proxy::ToNativeObject<CanvasRenderingContext2D>(V8ClassIndex::CANVASRENDERINGCONTEXT2D, args.Holder());
+    switch (args.Length()) {
+    case 1:
+        if (args[0]->IsString())
+            context->setStrokeColor(ToWebCoreString(args[0]));
+        else
+            context->setStrokeColor(toFloat(args[0]));
+        break;
+    case 2:
+        if (args[0]->IsString())
+            context->setStrokeColor(ToWebCoreString(args[0]), toFloat(args[1]));
+        else
+            context->setStrokeColor(toFloat(args[0]), toFloat(args[1]));
+        break;
+    case 4:
+        context->setStrokeColor(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), toFloat(args[3]));
+        break;
+    case 5:
+        context->setStrokeColor(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4]));
+        break;
+    default:
+        V8Proxy::ThrowError(V8Proxy::SYNTAX_ERROR, "setStrokeColor: Invalid number of arguments");
+        break;
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext2DSetFillColor)
+{
+    INC_STATS("DOM.CanvasRenderingContext2D.setFillColor()");
+    CanvasRenderingContext2D* context = V8Proxy::ToNativeObject<CanvasRenderingContext2D>(V8ClassIndex::CANVASRENDERINGCONTEXT2D, args.Holder());
+    switch (args.Length()) {
+    case 1:
+        if (args[0]->IsString())
+            context->setFillColor(ToWebCoreString(args[0]));
+        else 
+            context->setFillColor(toFloat(args[0]));
+        break;
+    case 2:
+        if (args[0]->IsString())
+            context->setFillColor(ToWebCoreString(args[0]), toFloat(args[1]));
+        else
+            context->setFillColor(toFloat(args[0]), toFloat(args[1]));
+        break;
+    case 4:
+        context->setFillColor(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), toFloat(args[3]));
+        break;
+    case 5:
+        context->setFillColor(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4]));
+        break;
+    default:
+        V8Proxy::ThrowError(V8Proxy::SYNTAX_ERROR, "setFillColor: Invalid number of arguments");
+        break;
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext2DStrokeRect)
+{
+    INC_STATS("DOM.CanvasRenderingContext2D.strokeRect()");
+    CanvasRenderingContext2D* context = V8Proxy::ToNativeObject<CanvasRenderingContext2D>(V8ClassIndex::CANVASRENDERINGCONTEXT2D, args.Holder());
+    if (args.Length() == 5)
+        context->strokeRect(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4]));
+    else if (args.Length() == 4)
+        context->strokeRect(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), toFloat(args[3]));
+    else {
+        V8Proxy::SetDOMException(INDEX_SIZE_ERR);
+        return notHandledByInterceptor();
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext2DSetShadow)
+{
+    INC_STATS("DOM.CanvasRenderingContext2D.setShadow()");
+    CanvasRenderingContext2D* context = V8Proxy::ToNativeObject<CanvasRenderingContext2D>(V8ClassIndex::CANVASRENDERINGCONTEXT2D, args.Holder());
+
+    switch (args.Length()) {
+    case 3:
+        context->setShadow(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]));
+        break;
+    case 4:
+        if (args[3]->IsString())
+            context->setShadow(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), ToWebCoreString(args[3]));
+        else
+            context->setShadow(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), toFloat(args[3]));
+        break;
+    case 5:
+        if (args[3]->IsString())
+            context->setShadow(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), ToWebCoreString(args[3]), toFloat(args[4]));
+        else
+            context->setShadow(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4]));
+        break;
+    case 7:
+        context->setShadow(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4]), toFloat(args[5]), toFloat(args[6]));
+        break;
+    case 8:
+        context->setShadow(toFloat(args[0]), toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4]), toFloat(args[5]), toFloat(args[6]), toFloat(args[7]));
+        break;
+    default:
+        V8Proxy::ThrowError(V8Proxy::SYNTAX_ERROR, "setShadow: Invalid number of arguments");
+        break;
+    }
+
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext2DDrawImage)
+{
+    INC_STATS("DOM.CanvasRenderingContext2D.drawImage()");
+    CanvasRenderingContext2D* context = V8Proxy::ToNativeObject<CanvasRenderingContext2D>(V8ClassIndex::CANVASRENDERINGCONTEXT2D, args.Holder());
+
+    v8::Handle<v8::Value> arg = args[0];
+
+    if (V8HTMLImageElement::HasInstance(arg)) {
+        ExceptionCode ec = 0;
+        HTMLImageElement* image_element = V8Proxy::DOMWrapperToNode<HTMLImageElement>(arg);
+        switch (args.Length()) {
+        case 3:
+            context->drawImage(image_element, toFloat(args[1]), toFloat(args[2]));
+            break;
+        case 5:
+            context->drawImage(image_element, toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4]), ec);
+            if (ec != 0) {
+                V8Proxy::SetDOMException(ec);
+                return notHandledByInterceptor();
+            }
+            break;
+        case 9:
+            context->drawImage(image_element, 
+                FloatRect(toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4])), 
+                FloatRect(toFloat(args[5]), toFloat(args[6]), toFloat(args[7]), toFloat(args[8])),
+                ec);
+            if (ec != 0) {
+                V8Proxy::SetDOMException(ec);
+                return notHandledByInterceptor();
+            }
+            break;
+        default:
+            V8Proxy::ThrowError(V8Proxy::SYNTAX_ERROR, "drawImage: Invalid number of arguments");
+            return v8::Undefined();
+        }
+        return v8::Undefined();
+    }
+
+    // HTMLCanvasElement
+    if (V8HTMLCanvasElement::HasInstance(arg)) {
+        ExceptionCode ec = 0;
+        HTMLCanvasElement* canvas_element = V8Proxy::DOMWrapperToNode<HTMLCanvasElement>(arg);
+        switch (args.Length()) {
+        case 3:
+            context->drawImage(canvas_element, toFloat(args[1]), toFloat(args[2]));
+            break;
+        case 5:
+            context->drawImage(canvas_element, toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4]), ec);
+            if (ec != 0) {
+                V8Proxy::SetDOMException(ec);
+                return notHandledByInterceptor();
+            }
+            break;
+        case 9:
+            context->drawImage(canvas_element,
+                FloatRect(toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4])),
+                FloatRect(toFloat(args[5]), toFloat(args[6]), toFloat(args[7]), toFloat(args[8])),
+                ec);
+            if (ec != 0) {
+                V8Proxy::SetDOMException(ec);
+                return notHandledByInterceptor();
+            }
+            break;
+        default:
+            V8Proxy::ThrowError(V8Proxy::SYNTAX_ERROR, "drawImage: Invalid number of arguments");
+            return v8::Undefined();
+        }
+        return v8::Undefined();
+    }
+
+    V8Proxy::SetDOMException(TYPE_MISMATCH_ERR);
+    return notHandledByInterceptor();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext2DDrawImageFromRect)
+{
+    INC_STATS("DOM.CanvasRenderingContext2D.drawImageFromRect()");
+    CanvasRenderingContext2D* context = V8Proxy::ToNativeObject<CanvasRenderingContext2D>(V8ClassIndex::CANVASRENDERINGCONTEXT2D, args.Holder());
+
+    v8::Handle<v8::Value> arg = args[0];
+
+    if (V8HTMLImageElement::HasInstance(arg)) {
+        HTMLImageElement* image_element = V8Proxy::DOMWrapperToNode<HTMLImageElement>(arg);
+        context->drawImageFromRect(image_element,  toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4]), toFloat(args[5]), toFloat(args[6]), toFloat(args[7]), toFloat(args[8]), ToWebCoreString(args[9]));
+    } else
+        V8Proxy::ThrowError(V8Proxy::TYPE_ERROR, "drawImageFromRect: Invalid type of arguments");
+
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext2DCreatePattern)
+{
+    INC_STATS("DOM.CanvasRenderingContext2D.createPattern()");
+    CanvasRenderingContext2D* context = V8Proxy::ToNativeObject<CanvasRenderingContext2D>(V8ClassIndex::CANVASRENDERINGCONTEXT2D, args.Holder());
+
+    v8::Handle<v8::Value> arg = args[0];
+
+    if (V8HTMLImageElement::HasInstance(arg)) {
+        HTMLImageElement* image_element = V8Proxy::DOMWrapperToNode<HTMLImageElement>(arg);
+        ExceptionCode ec = 0;
+        RefPtr<CanvasPattern> pattern = context->createPattern(image_element, valueToStringWithNullCheck(args[1]), ec);
+        if (ec != 0) {
+            V8Proxy::SetDOMException(ec);
+            return notHandledByInterceptor();
+        }
+        return V8Proxy::ToV8Object(V8ClassIndex::CANVASPATTERN, pattern.get());
+    }
+
+    if (V8HTMLCanvasElement::HasInstance(arg)) {
+        HTMLCanvasElement* canvas_element = V8Proxy::DOMWrapperToNode<HTMLCanvasElement>(arg);
+        ExceptionCode ec = 0;
+        RefPtr<CanvasPattern> pattern = context->createPattern(canvas_element, valueToStringWithNullCheck(args[1]), ec);
+        if (ec != 0) {
+            V8Proxy::SetDOMException(ec);
+            return notHandledByInterceptor();
+        }
+        return V8Proxy::ToV8Object(V8ClassIndex::CANVASPATTERN, pattern.get());
+    }
+
+    V8Proxy::SetDOMException(TYPE_MISMATCH_ERR);
+    return notHandledByInterceptor();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext2DFillText)
+{
+    INC_STATS("DOM.CanvasRenderingContext2D.fillText()");
+
+    CanvasRenderingContext2D* context = V8Proxy::ToNativeObject<CanvasRenderingContext2D>(V8ClassIndex::CANVASRENDERINGCONTEXT2D, args.Holder());
+
+    // Two forms:
+    // * fillText(text, x, y)
+    // * fillText(text, x, y, maxWidth)
+    if (args.Length() < 3 || args.Length() > 4) {
+        V8Proxy::SetDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    String text = ToWebCoreString(args[0]);
+    float x = toFloat(args[1]);
+    float y = toFloat(args[2]);
+
+    if (args.Length() == 4) {
+        float maxWidth = toFloat(args[3]);
+        context->fillText(text, x, y, maxWidth);
+    } else
+        context->fillText(text, x, y);
+
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext2DStrokeText)
+{
+    INC_STATS("DOM.CanvasRenderingContext2D.strokeText()");
+    CanvasRenderingContext2D* context = V8Proxy::ToNativeObject<CanvasRenderingContext2D>(V8ClassIndex::CANVASRENDERINGCONTEXT2D, args.Holder());
+
+    // Two forms:
+    // * strokeText(text, x, y)
+    // * strokeText(text, x, y, maxWidth)
+    if (args.Length() < 3 || args.Length() > 4) {
+        V8Proxy::SetDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    String text = ToWebCoreString(args[0]);
+    float x = toFloat(args[1]);
+    float y = toFloat(args[2]);
+
+    if (args.Length() == 4) {
+        float maxWidth = toFloat(args[3]);
+        context->strokeText(text, x, y, maxWidth);
+    } else
+        context->strokeText(text, x, y);
+
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext2DPutImageData)
+{
+    INC_STATS("DOM.CanvasRenderingContext2D.putImageData()");
+
+    // Two froms:
+    // * putImageData(ImageData, x, y)
+    // * putImageData(ImageData, x, y, dirtyX, dirtyY, dirtyWidth, dirtyHeight)
+    if (args.Length() != 3 && args.Length() != 7) {
+        V8Proxy::SetDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext2D* context = V8Proxy::ToNativeObject<CanvasRenderingContext2D>(V8ClassIndex::CANVASRENDERINGCONTEXT2D, args.Holder());
+
+    ImageData* imageData = 0;
+
+    // Need to check that the argument is of the correct type, since
+    // ToNativeObject() expects it to be correct. If the argument was incorrect
+    // we leave it null, and putImageData() will throw the correct exception
+    // (TYPE_MISMATCH_ERR).
+    if (V8Proxy::IsWrapperOfType(args[0], V8ClassIndex::IMAGEDATA))
+        imageData = V8Proxy::ToNativeObject<ImageData>(V8ClassIndex::IMAGEDATA, args[0]);
+
+    ExceptionCode ec = 0;
+
+    if (args.Length() == 7)
+        context->putImageData(imageData, toFloat(args[1]), toFloat(args[2]), toFloat(args[3]), toFloat(args[4]), toFloat(args[5]), toFloat(args[6]), ec);
+    else
+        context->putImageData(imageData, toFloat(args[1]), toFloat(args[2]), ec);
+
+    if (ec != 0) {
+        V8Proxy::SetDOMException(ec);
+        return notHandledByInterceptor();
+    }
+
+    return v8::Undefined();
+}
+
 } // namespace WebCore
diff --git a/WebCore/css/themeChromiumWin.css b/WebCore/bindings/v8/custom/V8ClientRectListCustom.cpp
similarity index 70%
copy from WebCore/css/themeChromiumWin.css
copy to WebCore/bindings/v8/custom/V8ClientRectListCustom.cpp
index e829373..e3f89b9 100644
--- a/WebCore/css/themeChromiumWin.css
+++ b/WebCore/bindings/v8/custom/V8ClientRectListCustom.cpp
@@ -1,10 +1,10 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,12 +28,28 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* These styles override the default styling for HTML elements as defined in
-   WebCore/css/themeWin.css. */
-#include "themeWin.css"
+#include "config.h"
+#include "ClientRectList.h"
 
-input[type="search"]::-webkit-search-cancel-button,
-input[type="search"]::-webkit-search-results-decoration,
-input[type="search"]::-webkit-search-results-button {
-    margin: 0 0 0 0;
+#include "ClientRect.h"
+
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+INDEXED_PROPERTY_GETTER(ClientRectList)
+{
+    INC_STATS("DOM.ClientRectList.IndexedPropertyGetter");
+    ClientRectList* imp = V8Proxy::ToNativeObject<ClientRectList>(V8ClassIndex::CLIENTRECTLIST, info.Holder());
+    RefPtr<ClientRect> result = imp->item(index);
+    if (!result)
+        return notHandledByInterceptor();
+
+    return V8Proxy::ToV8Object(V8ClassIndex::CLIENTRECT, result.get());
 }
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CustomBinding.cpp b/WebCore/bindings/v8/custom/V8CustomBinding.cpp
index 03361ea..037c729 100644
--- a/WebCore/bindings/v8/custom/V8CustomBinding.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomBinding.cpp
@@ -37,6 +37,7 @@
 #include "HTMLNames.h"
 #include "HTMLFrameElementBase.h"
 #include "CSSHelper.h"
+#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
index 68c8328..bd9e307 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
@@ -35,8 +35,8 @@
 
 namespace WebCore {
 
-V8EventListener::V8EventListener(Frame* frame, v8::Local<v8::Object> listener, bool isInline)
-    : V8AbstractEventListener(frame, isInline)
+V8EventListener::V8EventListener(Frame* frame, v8::Local<v8::Object> listener, bool isAttribute)
+    : V8AbstractEventListener(frame, isAttribute)
 {
     m_listener = v8::Persistent<v8::Object>::New(listener);
 #ifndef NDEBUG
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.h b/WebCore/bindings/v8/custom/V8CustomEventListener.h
index 1e613d0..20adf99 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.h
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.h
@@ -44,23 +44,22 @@
     // that can handle the event.
     class V8EventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8EventListener> create(Frame* frame, v8::Local<v8::Object> listener, bool isInline)
+        static PassRefPtr<V8EventListener> create(Frame* frame, v8::Local<v8::Object> listener, bool isAttribute)
         {
-            return adoptRef(new V8EventListener(frame, listener, isInline));
+            return adoptRef(new V8EventListener(frame, listener, isAttribute));
         }
 
-        virtual bool isInline() const { return m_isInline; }
-
         // Detach the listener from its owner frame.
         void disconnectFrame() { m_frame = 0; }
 
     protected:
-        V8EventListener(Frame*, v8::Local<v8::Object> listener, bool isInline);
+        V8EventListener(Frame*, v8::Local<v8::Object> listener, bool isAttribute);
         virtual ~V8EventListener();
         v8::Local<v8::Function> getListenerFunction();
 
     private:
         virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*, bool isWindowEvent);
+        virtual bool virtualisAttribute() const { return m_isAttribute; }
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp b/WebCore/bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp
index 5333006..6233a1d 100644
--- a/WebCore/bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp
@@ -50,13 +50,13 @@
     m_callback.Dispose();
 }
 
-bool V8CustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
+void V8CustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
 {
     v8::HandleScope handleScope;
 
     v8::Handle<v8::Context> context = V8Proxy::GetContext(m_frame.get());
     if (context.IsEmpty())
-        return true;
+        return;
 
     v8::Context::Scope scope(context);
 
@@ -69,10 +69,6 @@
 
     bool callbackReturnValue = false;
     invokeCallback(m_callback, 1, argv, callbackReturnValue);
-
-    // FIXME: Eliminate return value once SQLTransactionErrorCallback is changed
-    // to match the spec.
-    return true;
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h b/WebCore/bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h
index 13e8178..0387deb 100644
--- a/WebCore/bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h
+++ b/WebCore/bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h
@@ -51,7 +51,7 @@
     }
     virtual ~V8CustomSQLTransactionErrorCallback();
 
-    virtual bool handleEvent(SQLError*);
+    virtual void handleEvent(SQLError*);
 
 private:
     V8CustomSQLTransactionErrorCallback(v8::Local<v8::Object>, Frame*);
diff --git a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index d031a50..c13c3b2 100644
--- a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -35,24 +35,130 @@
 #include "V8CustomBinding.h"
 #include "V8CustomEventListener.h"
 #include "V8Proxy.h"
+#include "V8Utilities.h"
 
+#include "Base64.h"
+#include "ExceptionCode.h"
 #include "DOMTimer.h"
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "FrameView.h"
+#include "HTMLCollection.h"
 #include "Page.h"
 #include "PlatformScreen.h"
+#include "ScheduledAction.h"
 #include "ScriptSourceCode.h"
 #include "Settings.h"
 #include "WindowFeatures.h"
 
-
 // Horizontal and vertical offset, from the parent content area, around newly
 // opened popups that don't specify a location.
 static const int popupTilePixels = 10;
 
 namespace WebCore {
 
+v8::Handle<v8::Value> V8Custom::WindowSetTimeoutImpl(const v8::Arguments& args, bool singleShot)
+{
+    int argumentCount = args.Length();
+
+    if (argumentCount < 1)
+        return v8::Undefined();
+
+    DOMWindow* imp = V8Proxy::ToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
+
+    if (!imp->frame())
+        return v8::Undefined();
+
+    if (!V8Proxy::CanAccessFrame(imp->frame(), true))
+        return v8::Undefined();
+
+    ScriptExecutionContext* scriptContext = static_cast<ScriptExecutionContext*>(imp->frame()->document());
+
+    v8::Handle<v8::Value> function = args[0];
+
+    int32_t timeout = 0;
+    if (argumentCount >= 2) 
+        timeout = args[1]->Int32Value();
+
+    int id;
+    if (function->IsString()) {
+        // Don't allow setting timeouts to run empty functions!
+        // (Bug 1009597)
+        WebCore::String functionString = toWebCoreString(function);
+        if (functionString.length() == 0)
+            return v8::Undefined();
+
+        id = DOMTimer::install(scriptContext, new ScheduledAction(functionString), timeout, singleShot);
+    } else if (function->IsFunction()) {
+        int paramCount = argumentCount >= 2 ? argumentCount - 2 : 0;
+        v8::Local<v8::Value>* params = 0;
+        if (paramCount > 0) {
+            params = new v8::Local<v8::Value>[paramCount];
+            for (int i = 0; i < paramCount; i++)
+                // parameters must be globalized
+                params[i] = args[i+2];
+        }
+
+        // params is passed to action, and released in action's destructor
+        ScheduledAction* action = new ScheduledAction(v8::Handle<v8::Function>::Cast(function), paramCount, params);
+
+        delete[] params;
+
+        id = DOMTimer::install(scriptContext, action, timeout, singleShot);
+    } else
+        // FIXME(fqian): what's the right return value if failed.
+        return v8::Undefined();
+
+    return v8::Integer::New(id);
+}
+
+static bool isAscii(const String& str)
+{
+    for (size_t i = 0; i < str.length(); i++) {
+        if (str[i] > 0xFF)
+            return false;
+    }
+    return true;
+}
+
+static v8::Handle<v8::Value> convertBase64(const String& str, bool encode)
+{
+    if (!isAscii(str)) {
+        V8Proxy::SetDOMException(INVALID_CHARACTER_ERR);
+        return notHandledByInterceptor();
+    }
+
+    Vector<char> inputCharacters(str.length());
+    for (size_t i = 0; i < str.length(); i++)
+        inputCharacters[i] = static_cast<char>(str[i]);
+    Vector<char> outputCharacters;
+
+    if (encode)
+        base64Encode(inputCharacters, outputCharacters);
+    else {
+        if (!base64Decode(inputCharacters, outputCharacters))
+            return throwError("Cannot decode base64", V8Proxy::GENERAL_ERROR);
+    }
+
+    return v8String(String(outputCharacters.data(), outputCharacters.size()));
+}
+
+ACCESSOR_GETTER(DOMWindowEvent)
+{
+    v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
+    v8::Local<v8::Context> context = v8::Context::GetCurrent();
+    v8::Handle<v8::Value> jsEvent = context->Global()->GetHiddenValue(eventSymbol);
+    if (jsEvent.IsEmpty())
+        return v8::Undefined();
+    return jsEvent;
+}
+
+ACCESSOR_GETTER(DOMWindowCrypto)
+{
+    // FIXME: Implement me.
+    return v8::Undefined();
+}
+
 ACCESSOR_SETTER(DOMWindowLocation)
 {
     v8::Handle<v8::Object> holder = V8Proxy::LookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
@@ -103,7 +209,7 @@
     if (!doc)
         return v8::Undefined();
 
-    // TODO: Check if there is not enough arguments
+    // FIXME: Check if there is not enough arguments
     V8Proxy* proxy = V8Proxy::retrieve(imp->frame());
     if (!proxy)
         return v8::Undefined();
@@ -113,7 +219,7 @@
     if (listener) {
         String eventType = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
-        doc->addWindowEventListener(eventType, listener, useCapture);
+        imp->addEventListener(eventType, listener, useCapture);
     }
 
     return v8::Undefined();
@@ -144,7 +250,7 @@
     if (listener) {
         String eventType = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
-        doc->removeWindowEventListener(eventType, listener.get(), useCapture);
+        imp->removeEventListener(eventType, listener.get(), useCapture);
     }
 
     return v8::Undefined();
@@ -155,39 +261,168 @@
     INC_STATS("DOM.DOMWindow.postMessage()");
     DOMWindow* window = V8Proxy::ToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
 
-    DOMWindow* source = V8Proxy::retrieveActiveFrame()->domWindow();
+    DOMWindow* source = V8Proxy::retrieveFrameForCallingContext()->domWindow();
     ASSERT(source->frame());
 
-    String uri = source->frame()->loader()->url().string();
-
     v8::TryCatch tryCatch;
 
     String message = toWebCoreString(args[0]);
     MessagePort* port = 0;
-    String domain;
+    String targetOrigin;
 
     // This function has variable arguments and can either be:
-    //   postMessage(message, port, domain);
+    //   postMessage(message, port, targetOrigin);
     // or
-    //   postMessage(message, domain);
+    //   postMessage(message, targetOrigin);
     if (args.Length() > 2) {
         if (V8Proxy::IsWrapperOfType(args[1], V8ClassIndex::MESSAGEPORT))
             port = V8Proxy::ToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, args[1]);
-        domain = valueToStringWithNullOrUndefinedCheck(args[2]);
-    } else
-        domain = valueToStringWithNullOrUndefinedCheck(args[1]);
+        targetOrigin = valueToStringWithNullOrUndefinedCheck(args[2]);
+    } else {
+        targetOrigin = valueToStringWithNullOrUndefinedCheck(args[1]);
+    }
 
     if (tryCatch.HasCaught())
         return v8::Undefined();
 
     ExceptionCode ec = 0;
-    window->postMessage(message, port, domain, source, ec);
+    window->postMessage(message, port, targetOrigin, source, ec);
     if (ec)
         V8Proxy::SetDOMException(ec);
 
     return v8::Undefined();
 }
 
+CALLBACK_FUNC_DECL(DOMWindowAtob)
+{
+    INC_STATS("DOM.DOMWindow.atob()");
+    DOMWindow* imp = V8Proxy::ToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
+
+    if (!V8Proxy::CanAccessFrame(imp->frame(), true))
+        return v8::Undefined();
+
+    if (args.Length() < 1)
+        return throwError("Not enough arguments", V8Proxy::SYNTAX_ERROR);
+
+    if (args[0]->IsNull())
+        return v8String("");
+
+    String str = toWebCoreString(args[0]);
+    return convertBase64(str, false);
+}
+
+CALLBACK_FUNC_DECL(DOMWindowBtoa)
+{
+    INC_STATS("DOM.DOMWindow.btoa()");
+    DOMWindow* imp = V8Proxy::ToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
+
+    if (!V8Proxy::CanAccessFrame(imp->frame(), true))
+        return v8::Undefined();
+
+    if (args.Length() < 1)
+        return throwError("Not enough arguments", V8Proxy::SYNTAX_ERROR);
+
+    if (args[0]->IsNull())
+        return v8String("");
+
+    String str = toWebCoreString(args[0]);
+    return convertBase64(str, true);
+}
+
+// FIXME(fqian): returning string is cheating, and we should
+// fix this by calling toString function on the receiver.
+// However, V8 implements toString in JavaScript, which requires
+// switching context of receiver. I consider it is dangerous.
+CALLBACK_FUNC_DECL(DOMWindowToString)
+{
+    INC_STATS("DOM.DOMWindow.toString()");
+    return args.This()->ObjectProtoToString();
+}
+
+CALLBACK_FUNC_DECL(DOMWindowNOP)
+{
+    INC_STATS("DOM.DOMWindow.nop()");
+    return v8::Undefined();
+}
+
+static String eventNameFromAttributeName(const String& name)
+{
+    ASSERT(name.startsWith("on"));
+    String eventType = name.substring(2);
+
+    if (eventType.startsWith("w")) {
+        switch(eventType[eventType.length() - 1]) {
+        case 't':
+            eventType = "webkitAnimationStart";
+            break;
+        case 'n':
+            eventType = "webkitAnimationIteration";
+            break;
+        case 'd':
+            ASSERT(eventType.length() > 7);
+            if (eventType[7] == 'a')
+                eventType = "webkitAnimationEnd";
+            else
+                eventType = "webkitTransitionEnd";
+            break;
+        }
+    }
+
+    return eventType;
+}
+
+ACCESSOR_SETTER(DOMWindowEventHandler)
+{
+    v8::Handle<v8::Object> holder = V8Proxy::LookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
+    if (holder.IsEmpty())
+        return;
+
+    DOMWindow* imp = V8Proxy::ToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
+    if (!imp->frame())
+        return;
+
+    Document* doc = imp->frame()->document();
+    if (!doc)
+        return;
+
+    String key = toWebCoreString(name);
+    String eventType = eventNameFromAttributeName(key);
+
+    if (value->IsNull()) {
+        // Clear the event listener
+        imp->clearAttributeEventListener(eventType);
+    } else {
+        V8Proxy* proxy = V8Proxy::retrieve(imp->frame());
+        if (!proxy)
+            return;
+
+        RefPtr<EventListener> listener =
+            proxy->FindOrCreateV8EventListener(value, true);
+        if (listener)
+            imp->setAttributeEventListener(eventType, listener);
+    }
+}
+
+ACCESSOR_GETTER(DOMWindowEventHandler)
+{
+    v8::Handle<v8::Object> holder = V8Proxy::LookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
+    if (holder.IsEmpty())
+        return v8::Undefined();
+
+    DOMWindow* imp = V8Proxy::ToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
+    if (!imp->frame())
+        return v8::Undefined();
+
+    Document* doc = imp->frame()->document();
+    if (!doc)
+        return v8::Undefined();
+
+    String key = toWebCoreString(name);
+    String eventType = eventNameFromAttributeName(key);
+
+    EventListener* listener = imp->getAttributeEventListener(eventType);
+    return V8Proxy::EventListenerToV8Object(listener);
+}
 
 static bool canShowModalDialogNow(const Frame* frame)
 {
@@ -199,13 +434,13 @@
 
 static bool allowPopUp()
 {
-    Frame* frame = V8Proxy::retrieveActiveFrame();
+    Frame* frame = V8Proxy::retrieveFrameForEnteredContext();
 
     ASSERT(frame);
     if (frame->script()->processingUserGesture())
         return true;
     Settings* settings = frame->settings();
-    return settings && settings->JavaScriptCanOpenWindowsAutomatically();
+    return settings && settings->javaScriptCanOpenWindowsAutomatically();
 }
 
 static HashMap<String, String> parseModalDialogFeatures(const String& featuresArg)
@@ -240,17 +475,24 @@
 }
 
 
-static Frame* createWindow(Frame* openerFrame,
+static Frame* createWindow(Frame* callingFrame,
+                           Frame* enteredFrame,
+                           Frame* openerFrame,
                            const String& url,
                            const String& frameName,
                            const WindowFeatures& windowFeatures,
                            v8::Local<v8::Value> dialogArgs)
 {
-    Frame* activeFrame = V8Proxy::retrieveActiveFrame();
+    ASSERT(callingFrame);
+    ASSERT(enteredFrame);
 
     ResourceRequest request;
-    if (activeFrame)
-        request.setHTTPReferrer(activeFrame->loader()->outgoingReferrer());
+
+    // For whatever reason, Firefox uses the entered frame to determine
+    // the outgoingReferrer.  We replicate that behavior here.
+    String referrer = enteredFrame->loader()->outgoingReferrer();
+    request.setHTTPReferrer(referrer);
+    FrameLoader::addHTTPOriginIfNeeded(request, enteredFrame->loader()->outgoingOrigin());
     FrameLoadRequest frameRequest(request, frameName);
 
     // FIXME: It's much better for client API if a new window starts with a URL,
@@ -267,7 +509,7 @@
     // frame name, in case the active frame is different from the opener frame,
     // and the name references a frame relative to the opener frame, for example
     // "_self" or "_parent".
-    Frame* newFrame = activeFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
+    Frame* newFrame = callingFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
     if (!newFrame)
         return 0;
 
@@ -283,16 +525,15 @@
         }
     }
 
-    if (!parseURL(url).startsWith("javascript:", false)
-        || ScriptController::isSafeScript(newFrame)) {
+    if (protocolIsJavaScript(url) || ScriptController::isSafeScript(newFrame)) {
         KURL completedUrl =
-            url.isEmpty() ? KURL("") : activeFrame->document()->completeURL(url);
-        bool userGesture = activeFrame->script()->processingUserGesture();
+            url.isEmpty() ? KURL("") : completeURL(url);
+        bool userGesture = processingUserGesture();
 
         if (created)
-            newFrame->loader()->changeLocation(completedUrl, activeFrame->loader()->outgoingReferrer(), false, false, userGesture);
+            newFrame->loader()->changeLocation(completedUrl, referrer, false, false, userGesture);
         else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedUrl.string(), activeFrame->loader()->outgoingReferrer(), false, userGesture);
+            newFrame->loader()->scheduleLocationChange(completedUrl.string(), referrer, false, userGesture);
     }
 
     return newFrame;
@@ -310,6 +551,14 @@
     if (!frame || !V8Proxy::CanAccessFrame(frame, true)) 
         return v8::Undefined();
 
+    Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
+    if (!callingFrame)
+        return v8::Undefined();
+
+    Frame* enteredFrame = V8Proxy::retrieveFrameForEnteredContext();
+    if (!enteredFrame)
+        return v8::Undefined();
+
     if (!canShowModalDialogNow(frame) || !allowPopUp())
         return v8::Undefined();
 
@@ -356,7 +605,7 @@
     windowFeatures.locationBarVisible = false;
     windowFeatures.fullscreen = false;
 
-    Frame* dialogFrame = createWindow(frame, url, "", windowFeatures, dialogArgs);
+    Frame* dialogFrame = createWindow(callingFrame, enteredFrame, frame, url, "", windowFeatures, dialogArgs);
     if (!dialogFrame)
         return v8::Undefined();
 
@@ -387,16 +636,20 @@
     DOMWindow* parent = V8Proxy::ToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
     Frame* frame = parent->frame();
 
-    if (!V8Proxy::CanAccessFrame(frame, true))
-      return v8::Undefined();
+    if (!frame || !V8Proxy::CanAccessFrame(frame, true))
+        return v8::Undefined();
 
-    Frame* activeFrame = V8Proxy::retrieveActiveFrame();
-    if (!activeFrame)
-      return v8::Undefined();
+    Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
+    if (!callingFrame)
+        return v8::Undefined();
+
+    Frame* enteredFrame = V8Proxy::retrieveFrameForEnteredContext();
+    if (!enteredFrame)
+        return v8::Undefined();
 
     Page* page = frame->page();
     if (!page)
-      return v8::Undefined();
+        return v8::Undefined();
 
     String urlString = valueToStringWithNullOrUndefinedCheck(args[0]);
     AtomicString frameName = (args[1]->IsUndefined() || args[1]->IsNull()) ? "_blank" : AtomicString(toWebCoreString(args[1]));
@@ -421,18 +674,22 @@
         topOrParent = true;
     }
     if (topOrParent) {
-        if (!activeFrame->loader()->shouldAllowNavigation(frame))
+        if (!shouldAllowNavigation(frame))
             return v8::Undefined();
     
         String completedUrl;
         if (!urlString.isEmpty())
-            completedUrl = activeFrame->document()->completeURL(urlString);
+            completedUrl = completeURL(urlString);
     
         if (!completedUrl.isEmpty() &&
-            (!parseURL(urlString).startsWith("javascript:", false)
-             || ScriptController::isSafeScript(frame))) {
-            bool userGesture = activeFrame->script()->processingUserGesture();
-            frame->loader()->scheduleLocationChange(completedUrl, activeFrame->loader()->outgoingReferrer(), false, userGesture);
+            (!protocolIsJavaScript(completedUrl) || ScriptController::isSafeScript(frame))) {
+            bool userGesture = processingUserGesture();
+
+            // For whatever reason, Firefox uses the entered frame to determine
+            // the outgoingReferrer.  We replicate that behavior here.
+            String referrer = enteredFrame->loader()->outgoingReferrer();
+
+            frame->loader()->scheduleLocationChange(completedUrl, referrer, false, userGesture);
         }
         return V8Proxy::ToV8Object(V8ClassIndex::DOMWINDOW, frame->domWindow());
     }
@@ -489,7 +746,7 @@
         windowFeatures.ySet = false;
     }
 
-    frame = createWindow(frame, urlString, frameName, windowFeatures, v8::Local<v8::Value>());
+    frame = createWindow(callingFrame, enteredFrame, frame, urlString, frameName, windowFeatures, v8::Local<v8::Value>());
 
     if (!frame)
         return v8::Undefined();
@@ -524,9 +781,6 @@
 NAMED_PROPERTY_GETTER(DOMWindow)
 {
     INC_STATS("DOM.DOMWindow.NamedPropertyGetter");
-    // The key must be a string.
-    if (!name->IsString())
-        return notHandledByInterceptor();
 
     v8::Handle<v8::Object> holder = V8Proxy::LookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
     if (holder.IsEmpty())
@@ -536,14 +790,13 @@
     if (!window)
         return notHandledByInterceptor();
 
-    String propName = toWebCoreString(name);
-
     Frame* frame = window->frame();
     // window is detached from a frame.
     if (!frame)
         return notHandledByInterceptor();
 
     // Search sub-frames.
+    AtomicString propName = v8StringToAtomicWebCoreString(name);
     Frame* child = frame->tree()->child(propName);
     if (child)
         return V8Proxy::ToV8Object(V8ClassIndex::DOMWINDOW, child->domWindow());
@@ -553,66 +806,6 @@
     if (!result.IsEmpty())
         return result;
 
-    // Lazy initialization map keeps global properties that can be lazily
-    // initialized. The value is the code to instantiate the property.
-    // It must return the value of property after initialization.
-    static HashMap<String, String> lazyInitMap;
-    if (lazyInitMap.isEmpty()) {
-      // "new Image()" does not appear to be well-defined in a spec, but Safari,
-      // Opera, and Firefox all consider it to always create an HTML image
-      // element, regardless of the current doctype.
-      lazyInitMap.set("Image",
-                       "function Image() { \
-                          return document.createElementNS( \
-                            'http://www.w3.org/1999/xhtml', 'img'); \
-                        }; \
-                        Image");
-      lazyInitMap.set("Option",
-        "function Option(text, value, defaultSelected, selected) { \
-           var option = document.createElement('option'); \
-           if (text == null) return option; \
-           option.text = text; \
-           if (value == null) return option; \
-           option.value = value; \
-           if (defaultSelected == null) return option; \
-           option.defaultSelected = defaultSelected; \
-           if (selected == null) return option; \
-           option.selected = selected; \
-           return option; \
-         }; \
-         Option");
-    }
-
-    String code = lazyInitMap.get(propName);
-    if (!code.isEmpty()) {
-        v8::Local<v8::Context> context = V8Proxy::GetContext(window->frame());
-        // Bail out if we cannot get the context for the frame.
-        if (context.IsEmpty())
-            return notHandledByInterceptor();
-  
-        // switch to the target object's environment.
-        v8::Context::Scope scope(context);
-
-        // Set the property name to undefined to make sure that the
-        // property exists.  This is necessary because this getter
-        // might be called when evaluating 'var RangeException = value'
-        // to figure out if we have a property named 'RangeException' before
-        // we set RangeException to the new value.  In that case, we will
-        // evaluate 'var RangeException = {}' and enter an infinite loop.
-        // Setting the property name to undefined on the global object
-        // ensures that we do not have to ask this getter to figure out
-        // that we have the property.
-        //
-        // TODO(ager): We probably should implement the Has method
-        // for the interceptor instead of using the default Has method
-        // that calls Get.
-        context->Global()->Set(v8String(propName), v8::Undefined());
-        V8Proxy* proxy = V8Proxy::retrieve(window->frame());
-        ASSERT(proxy);
-
-        return proxy->evaluate(WebCore::ScriptSourceCode(code), 0);
-    }
-
     // Search named items in the document.
     Document* doc = frame->document();
     if (doc) {
@@ -629,29 +822,20 @@
 }
 
 
-void V8Custom::WindowSetLocation(DOMWindow* window, const String& v)
+void V8Custom::WindowSetLocation(DOMWindow* window, const String& relativeURL)
 {
-    if (!window->frame())
+    Frame* frame = window->frame();
+    if (!frame)
         return;
 
-    Frame* activeFrame = ScriptController::retrieveActiveFrame();
-    if (!activeFrame)
+    if (!shouldAllowNavigation(frame))
         return;
 
-    if (!activeFrame->loader()->shouldAllowNavigation(window->frame()))
+    KURL url = completeURL(relativeURL);
+    if (url.isNull())
         return;
 
-    if (!parseURL(v).startsWith("javascript:", false)
-        || ScriptController::isSafeScript(window->frame())) {
-        String completedUrl = activeFrame->loader()->completeURL(v).string();
-  
-        // FIXME: The JSC bindings pass !anyPageIsProcessingUserGesture() for
-        // the lockHistory parameter.  We should probably do something similar.
-  
-        window->frame()->loader()->scheduleLocationChange(completedUrl,
-            activeFrame->loader()->outgoingReferrer(), false, false,
-            activeFrame->script()->processingUserGesture());
-    }
+    navigateIfAllowed(frame, url, false, false);
 }
 
 
@@ -695,4 +879,52 @@
     return v8::Undefined();
 }
 
+NAMED_ACCESS_CHECK(DOMWindow)
+{
+    ASSERT(V8ClassIndex::FromInt(data->Int32Value()) == V8ClassIndex::DOMWINDOW);
+    v8::Handle<v8::Value> window = V8Proxy::LookupDOMWrapper(V8ClassIndex::DOMWINDOW, host);
+    if (window.IsEmpty())
+        return false;  // the frame is gone.
+
+    DOMWindow* targetWindow = V8Proxy::ToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, window);
+
+    ASSERT(targetWindow);
+
+    Frame* target = targetWindow->frame();
+    if (!target)
+        return false;
+
+    if (key->IsString()) {
+        String name = toWebCoreString(key);
+
+        // Allow access of GET and HAS if index is a subframe.
+        if ((type == v8::ACCESS_GET || type == v8::ACCESS_HAS) && target->tree()->child(name))
+            return true;
+    }
+
+    return V8Proxy::CanAccessFrame(target, false);
+}
+
+INDEXED_ACCESS_CHECK(DOMWindow)
+{
+    ASSERT(V8ClassIndex::FromInt(data->Int32Value()) == V8ClassIndex::DOMWINDOW);
+    v8::Handle<v8::Value> window = V8Proxy::LookupDOMWrapper(V8ClassIndex::DOMWINDOW, host);
+    if (window.IsEmpty())
+        return false;
+
+    DOMWindow* targetWindow = V8Proxy::ToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, window);
+
+    ASSERT(targetWindow);
+
+    Frame* target = targetWindow->frame();
+    if (!target)
+        return false;
+
+    // Allow access of GET and HAS if index is a subframe.
+    if ((type == v8::ACCESS_GET || type == v8::ACCESS_HAS) && target->tree()->child(index))
+        return true;
+
+    return V8Proxy::CanAccessFrame(target, false);
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8DocumentLocationCustom.cpp b/WebCore/bindings/v8/custom/V8DocumentLocationCustom.cpp
new file mode 100644
index 0000000..dfcacef
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8DocumentLocationCustom.cpp
@@ -0,0 +1,56 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ *  Copyright (C) 2006 James G. Speth (speth@end.com)
+ *  Copyright (C) 2006 Samuel Weinig (sam@webkit.org)
+ *  Copyright (C) 2007, 2008, 2009 Google Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include "config.h"
+#include "V8CustomBinding.h"
+
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "V8Binding.h"
+#include "V8Document.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+ACCESSOR_GETTER(DocumentLocation)
+{
+    Document* document = V8Proxy::DOMWrapperToNative<Document>(info.Holder());
+    if (!document->frame())
+        return v8::Null();
+
+    DOMWindow* window = document->frame()->domWindow();
+    return V8Proxy::ToV8Object(V8ClassIndex::LOCATION, window->location());
+}
+
+ACCESSOR_SETTER(DocumentLocation)
+{
+    Document* document = V8Proxy::DOMWrapperToNative<Document>(info.Holder());
+    if (!document->frame())
+        return;
+
+    DOMWindow* window = document->frame()->domWindow();
+    // WindowSetLocation does security checks. // XXXMB- verify!
+    WindowSetLocation(window, toWebCoreString(value));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8ElementCustom.cpp b/WebCore/bindings/v8/custom/V8ElementCustom.cpp
index 131f401..64a9d3d 100644
--- a/WebCore/bindings/v8/custom/V8ElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8ElementCustom.cpp
@@ -72,7 +72,7 @@
 {
     INC_STATS("DOM.Element.setAttributeNode()");
     if (!V8Attr::HasInstance(args[0]))
-        throwError(TYPE_MISMATCH_ERR);
+        return throwError(TYPE_MISMATCH_ERR);
 
     Attr* newAttr = V8Proxy::DOMWrapperToNode<Attr>(args[0]);
     Element* element = V8Proxy::DOMWrapperToNode<Element>(args.Holder());
@@ -147,21 +147,21 @@
         // the document might be created using createDocument,
         // which does not have a frame, use the active frame
         if (!proxy)
-            proxy = V8Proxy::retrieve(V8Proxy::retrieveActiveFrame());
+            proxy = V8Proxy::retrieve(V8Proxy::retrieveFrameForEnteredContext());
         if (!proxy)
             return;
 
         if (RefPtr<EventListener> listener = proxy->FindOrCreateV8EventListener(value, true))
-            node->setInlineEventListenerForType(eventType, listener);
+            node->setAttributeEventListener(eventType, listener);
     } else
-        node->removeInlineEventListenerForType(eventType);
+        node->clearAttributeEventListener(eventType);
 }
 
 ACCESSOR_GETTER(ElementEventHandler)
 {
     Node* node = V8Proxy::DOMWrapperToNode<Node>(info.Holder());
 
-    EventListener* listener = node->inlineEventListenerForType(toEventType(name));
+    EventListener* listener = node->getAttributeEventListener(toEventType(name));
     return V8Proxy::EventListenerToV8Object(listener);
 }
 
diff --git a/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
index 97a3b4f..1436a48 100644
--- a/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
@@ -38,7 +38,7 @@
 
 namespace WebCore {
 
-static v8::Handle<v8::Value> getNamedItems(HTMLCollection* collection, String name)
+static v8::Handle<v8::Value> getNamedItems(HTMLCollection* collection, AtomicString name)
 {
     Vector<RefPtr<Node> > namedItems;
     collection->namedItems(name, namedItems);
@@ -85,7 +85,7 @@
 
     // Finally, search the DOM structure.
     HTMLCollection* imp = V8Proxy::ToNativeObject<HTMLCollection>(V8ClassIndex::HTMLCOLLECTION, info.Holder());
-    return getNamedItems(imp, toWebCoreString(name));
+    return getNamedItems(imp, v8StringToAtomicWebCoreString(name));
 }
 
 CALLBACK_FUNC_DECL(HTMLCollectionItem)
diff --git a/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
index 1d408b2..34bf89c 100644
--- a/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
@@ -32,6 +32,7 @@
 #include "HTMLDocument.h"
 
 #include "Frame.h"
+#include "HTMLCollection.h"
 #include "HTMLIFrameElement.h"
 #include "HTMLNames.h"
 
@@ -40,6 +41,7 @@
 #include "V8Proxy.h"
 
 #include <wtf/RefPtr.h>
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -48,8 +50,9 @@
     // Only handle document.all.  Insert the marker object into the
     // shadow internal field to signal that document.all is no longer
     // shadowed.
-    String key = toWebCoreString(name);
-    if (key != "all")
+    AtomicString key = v8StringToAtomicWebCoreString(name);
+    DEFINE_STATIC_LOCAL(const AtomicString, all, ("all"));
+    if (key != all)
         return deletionNotHandledByInterceptor();
 
     ASSERT(info.Holder()->InternalFieldCount() == kHTMLDocumentInternalFieldCount);
@@ -61,12 +64,13 @@
 NAMED_PROPERTY_GETTER(HTMLDocument)
 {
     INC_STATS("DOM.HTMLDocument.NamedPropertyGetter");
-    AtomicString key = toWebCoreString(name);
+    AtomicString key = v8StringToAtomicWebCoreString(name);
 
     // Special case for document.all.  If the value in the shadow
     // internal field is not the marker object, then document.all has
     // been temporarily shadowed and we return the value.
-    if (key == "all") {
+    DEFINE_STATIC_LOCAL(const AtomicString, all, ("all"));
+    if (key == all) {
         ASSERT(info.Holder()->InternalFieldCount() == kHTMLDocumentInternalFieldCount);
         v8::Local<v8::Value> marker = info.Holder()->GetInternalField(kHTMLDocumentMarkerIndex);
         v8::Local<v8::Value> value = info.Holder()->GetInternalField(kHTMLDocumentShadowIndex);
@@ -114,7 +118,7 @@
 {
     INC_STATS("DOM.HTMLDocument.write()");
     HTMLDocument* htmlDocument = V8Proxy::DOMWrapperToNode<HTMLDocument>(args.Holder());
-    Frame* frame = V8Proxy::retrieveActiveFrame();
+    Frame* frame = V8Proxy::retrieveFrameForCallingContext();
     ASSERT(frame);
     htmlDocument->write(writeHelperGetString(args), frame->document());
     return v8::Undefined();
@@ -124,7 +128,7 @@
 {
     INC_STATS("DOM.HTMLDocument.writeln()");
     HTMLDocument* htmlDocument = V8Proxy::DOMWrapperToNode<HTMLDocument>(args.Holder());
-    Frame* frame = V8Proxy::retrieveActiveFrame();
+    Frame* frame = V8Proxy::retrieveFrameForCallingContext();
     ASSERT(frame);
     htmlDocument->writeln(writeHelperGetString(args), frame->document());
     return v8::Undefined();
@@ -164,7 +168,7 @@
         }
     }
 
-    Frame* frame = V8Proxy::retrieveActiveFrame();
+    Frame* frame = V8Proxy::retrieveFrameForCallingContext();
     htmlDocument->open(frame->document());
     // Return the document.
     return args.Holder();
diff --git a/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp
index 454bbc0..27ab7e3 100644
--- a/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "HTMLFormElement.h"
 
+#include "HTMLCollection.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
 #include "V8NamedNodesCollection.h"
@@ -38,11 +39,23 @@
 
 namespace WebCore {
 
+INDEXED_PROPERTY_GETTER(HTMLFormElement)
+{
+    INC_STATS("DOM.HTMLFormElement.IndexedPropertyGetter");
+    HTMLFormElement* form = V8Proxy::DOMWrapperToNode<HTMLFormElement>(info.Holder());
+    
+    RefPtr<Node> formElement = form->elements()->item(index);
+    if (!formElement)
+        return notHandledByInterceptor();
+    return V8Proxy::NodeToV8Object(formElement.get());
+}
+
+
 NAMED_PROPERTY_GETTER(HTMLFormElement)
 {
     INC_STATS("DOM.HTMLFormElement.NamedPropertyGetter");
     HTMLFormElement* imp = V8Proxy::DOMWrapperToNode<HTMLFormElement>(info.Holder());
-    String v = toWebCoreString(name);
+    AtomicString v = v8StringToAtomicWebCoreString(name);
 
     // Call getNamedElements twice, first time check if it has a value
     // and let HTMLFormElement update its cache.
@@ -51,7 +64,7 @@
         Vector<RefPtr<Node> > elements;
         imp->getNamedElements(v, elements);
         if (elements.isEmpty())
-            return v8::Handle<v8::Value>();
+            return notHandledByInterceptor();
     }
 
     // Second call may return different results from the first call,
@@ -66,5 +79,12 @@
     NodeList* collection = new V8NamedNodesCollection(elements);
     return V8Proxy::ToV8Object(V8ClassIndex::NODELIST, collection);
 }
+    
+CALLBACK_FUNC_DECL(HTMLFormElementSubmit) {
+    INC_STATS("DOM.HTMLFormElement.submit()");
+    HTMLFormElement* form = V8Proxy::DOMWrapperToNative<HTMLFormElement>(args.Holder());
+    form->submit(0, false, false);
+    return v8::Undefined();
+}
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp
index df08542..220af02 100644
--- a/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp
@@ -48,7 +48,7 @@
 {
     INC_STATS("DOM.HTMLFrameSetElement.NamedPropertyGetter");
     HTMLFrameSetElement* imp = V8Proxy::DOMWrapperToNode<HTMLFrameSetElement>(info.Holder());
-    Node* frameNode = imp->children()->namedItem(toWebCoreString(name));
+    Node* frameNode = imp->children()->namedItem(v8StringToAtomicWebCoreString(name));
     if (frameNode && frameNode->hasTagName(HTMLNames::frameTag)) {
         Document* doc = static_cast<HTMLFrameElement*>(frameNode)->contentDocument();
         if (!doc)
diff --git a/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp b/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
new file mode 100644
index 0000000..afcc29d
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HTMLImageElement.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "HTMLNames.h"
+
+#include "V8Binding.h"
+#include "V8Proxy.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(HTMLImageElementConstructor)
+{
+    INC_STATS("DOM.HTMLImageElement.Contructor");
+
+    if (!args.IsConstructCall())
+        return throwError("DOM object constructor cannot be called as a function.");
+
+    Document* document = V8Proxy::retrieveFrame()->document();
+    if (!document)
+        return throwError("Image constructor associated document is unavailable", V8Proxy::REFERENCE_ERROR);
+
+    // Make sure the document is added to the DOM Node map. Otherwise, the HTMLImageElement instance
+    // may end up being the only node in the map and get garbage-ccollected prematurely.
+    V8Proxy::NodeToV8Object(document);
+
+    RefPtr<HTMLImageElement> image = new HTMLImageElement(HTMLNames::imgTag, V8Proxy::retrieveFrame()->document());
+    if (args.Length() > 0) {
+        image->setWidth(toInt32(args[0]));
+        if (args.Length() > 1)
+            image->setHeight(toInt32(args[1]));
+    }
+
+    V8Proxy::SetDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::NODE), image.get());
+    image->ref();
+    V8Proxy::SetJSWrapperForDOMNode(image.get(), v8::Persistent<v8::Object>::New(args.Holder()));
+    return args.Holder();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.cpp b/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.cpp
new file mode 100644
index 0000000..93a9b68
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HTMLOptionElement.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "HTMLNames.h"
+#include "Text.h"
+
+#include "V8Binding.h"
+#include "V8Proxy.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(HTMLOptionElementConstructor)
+{
+    INC_STATS("DOM.HTMLOptionElement.Contructor");
+
+    if (!args.IsConstructCall())
+        return throwError("DOM object constructor cannot be called as a function.");
+
+    Document* document = V8Proxy::retrieveFrame()->document();
+    if (!document)
+        return throwError("Option constructor associated document is unavailable", V8Proxy::REFERENCE_ERROR);
+
+    RefPtr<HTMLOptionElement> option = new HTMLOptionElement(HTMLNames::optionTag, V8Proxy::retrieveFrame()->document());
+
+    ExceptionCode ec = 0;
+    RefPtr<Text> text = document->createTextNode("");
+    if (args.Length() > 0) {
+        if (!args[0]->IsUndefined()) {
+            text->setData(toWebCoreString(args[0]), ec);
+            if (ec)
+                throwError(ec);
+        }
+
+        option->appendChild(text.release(), ec);
+        if (ec)
+            throwError(ec);
+
+        if (args.Length() > 1) {
+            if (!args[1]->IsUndefined())
+                option->setValue(toWebCoreString(args[1]));
+
+            if (args.Length() > 2) {
+                option->setDefaultSelected(args[2]->BooleanValue());
+                if (args.Length() > 3)
+                    option->setSelected(args[3]->BooleanValue());
+            }
+        }
+    }
+
+    V8Proxy::SetDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::NODE), option.get());
+    option->ref();
+    V8Proxy::SetJSWrapperForDOMNode(option.get(), v8::Persistent<v8::Object>::New(args.Holder()));
+    return args.Holder();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
index c8f7f6e..9f0d25e 100644
--- a/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
@@ -32,10 +32,10 @@
 #include "HTMLOptionsCollection.h"
 
 #include "HTMLOptionElement.h"
-#include "HTMLSelectElement.h"
 #include "ExceptionCode.h"
 
 #include "V8Binding.h"
+#include "V8Collection.h"
 #include "V8CustomBinding.h"
 #include "V8HTMLOptionElement.h"
 #include "V8HTMLSelectElementCustom.h"
@@ -113,4 +113,24 @@
     V8Proxy::SetDOMException(ec);
 }
 
+INDEXED_PROPERTY_GETTER(HTMLOptionsCollection)
+{
+    INC_STATS("DOM.HTMLOptionsCollection.IndexedPropertyGetter");
+    HTMLOptionsCollection* collection = V8Proxy::ToNativeObject<HTMLOptionsCollection>(V8ClassIndex::HTMLOPTIONSCOLLECTION, info.Holder());
+
+    RefPtr<Node> result = collection->item(index);
+    if (!result)
+        return notHandledByInterceptor();
+
+    return V8Proxy::NodeToV8Object(result.get());
+}
+
+INDEXED_PROPERTY_SETTER(HTMLOptionsCollection)
+{
+    INC_STATS("DOM.HTMLOptionsCollection.IndexedPropertySetter");
+    HTMLOptionsCollection* collection = V8Proxy::ToNativeObject<HTMLOptionsCollection>(V8ClassIndex::HTMLOPTIONSCOLLECTION, info.Holder());
+    HTMLSelectElement* base = static_cast<HTMLSelectElement*>(collection->base());
+    return toOptionsCollectionSetter(index, value, base);
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp
new file mode 100644
index 0000000..8b3b72a
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HTMLSelectElement.h"
+
+#include "HTMLOptionsCollection.h"
+#include "V8Binding.h"
+#include "V8Collection.h"
+#include "V8CustomBinding.h"
+#include "V8NamedNodesCollection.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+NAMED_PROPERTY_GETTER(HTMLSelectElementCollection)
+{
+    INC_STATS("DOM.HTMLSelectElementCollection.NamedPropertySetter");
+    HTMLSelectElement* select = V8Proxy::DOMWrapperToNode<HTMLSelectElement>(info.Holder());
+    v8::Handle<v8::Value> value = info.Holder()->GetRealNamedPropertyInPrototypeChain(name);
+
+    if (!value.IsEmpty())
+        return value;
+
+    // Search local callback properties next to find IDL defined properties.
+    if (info.Holder()->HasRealNamedCallbackProperty(name))
+        return notHandledByInterceptor();
+
+    PassRefPtr<HTMLOptionsCollection> collection = select->options();
+
+    Vector<RefPtr<Node> > items;
+    collection->namedItems(v8StringToAtomicWebCoreString(name), items);
+
+    if (!items.size())
+        return notHandledByInterceptor();
+
+    if (items.size() == 1)
+        return V8Proxy::NodeToV8Object(items.at(0).get());
+
+    NodeList* list = new V8NamedNodesCollection(items);
+    return V8Proxy::ToV8Object(V8ClassIndex::NODELIST, list);
+}
+
+INDEXED_PROPERTY_SETTER(HTMLSelectElementCollection)
+{
+    INC_STATS("DOM.HTMLSelectElementCollection.IndexedPropertySetter");
+    HTMLSelectElement* select = V8Proxy::DOMWrapperToNode<HTMLSelectElement>(info.Holder());
+    return toOptionsCollectionSetter(index, value, select);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8InspectorControllerCustom.cpp b/WebCore/bindings/v8/custom/V8InspectorControllerCustom.cpp
index 387806f..a85c0d6 100644
--- a/WebCore/bindings/v8/custom/V8InspectorControllerCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8InspectorControllerCustom.cpp
@@ -31,7 +31,17 @@
 #include "config.h"
 #include "InspectorController.h"
 
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "FrameLoader.h"
 #include "ExceptionCode.h"
+#include "InspectorResource.h"
+#include "NotImplemented.h"
+#include "Node.h"
+#include "Range.h"
+#include "Page.h"
+#include "TextIterator.h"
+#include "VisiblePosition.h"
 
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
@@ -39,22 +49,87 @@
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(InspectorControllerDebuggerEnabled)
+CALLBACK_FUNC_DECL(InspectorControllerHighlightDOMNode)
 {
-    INC_STATS("InspectorController.debuggerEnabled()");
-    return v8::False();
+    INC_STATS("InspectorController.highlightDOMNode()");
+
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    Node* node = V8Proxy::DOMWrapperToNode<Node>(args[0]);
+    if (!node)
+        return v8::Undefined();
+
+    InspectorController* inspectorController = V8Proxy::ToNativeObject<InspectorController>(V8ClassIndex::INSPECTORCONTROLLER, args.Holder());
+    inspectorController->highlight(node);
+
+    return v8::Undefined();
 }
 
-CALLBACK_FUNC_DECL(InspectorControllerPauseOnExceptions)
+CALLBACK_FUNC_DECL(InspectorControllerGetResourceDocumentNode)
 {
-    INC_STATS("InspectorController.pauseOnExceptions()");
-    return v8::False();
+    INC_STATS("InspectorController.getResourceDocumentNode()");
+
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    if (!args[1]->IsNumber())
+        return v8::Undefined();
+
+    unsigned identifier = args[1]->Int32Value();
+
+    InspectorController* inspectorController = V8Proxy::ToNativeObject<InspectorController>(V8ClassIndex::INSPECTORCONTROLLER, args.Holder());
+    RefPtr<InspectorResource> resource = inspectorController->resources().get(identifier);
+    ASSERT(resource);
+    if (!resource)
+        return v8::Undefined();
+
+    Frame* frame = resource->frame();
+    Document* document = frame->document();
+
+    if (document->isPluginDocument() || document->isImageDocument() || document->isMediaDocument())
+        return v8::Undefined();
+
+    return V8Proxy::ToV8Object(V8ClassIndex::DOCUMENT, document);
 }
 
-CALLBACK_FUNC_DECL(InspectorControllerProfilerEnabled)
+CALLBACK_FUNC_DECL(InspectorControllerSearch)
 {
-    INC_STATS("InspectorController.profilerEnabled()");
-    return v8::False();
+    INC_STATS("InspectorController.search()");
+
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    Node* node = V8Proxy::DOMWrapperToNode<Node>(args[0]);
+    if (!node)
+        return v8::Undefined();
+
+    String target = toWebCoreStringWithNullCheck(args[1]);
+    if (target.isEmpty())
+        return v8::Undefined();
+
+    v8::Local<v8::Array> result = v8::Array::New();
+    RefPtr<Range> searchRange(rangeOfContents(node));
+
+    ExceptionCode ec = 0;
+    int index = 0;
+    do {
+        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
+        if (resultRange->collapsed(ec))
+            break;
+
+        // A non-collapsed result range can in some funky whitespace cases still not
+        // advance the range's start position (4509328). Break to avoid infinite loop.
+        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
+        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
+            break;
+
+        result->Set(v8::Number::New(index++), V8Proxy::ToV8Object<Range>(V8ClassIndex::RANGE, resultRange.get()));
+
+        setStart(searchRange.get(), newStart);
+    } while (true);
+
+    return result;
 }
 
 #if ENABLE(DATABASE)
@@ -66,6 +141,92 @@
 }
 #endif
 
+CALLBACK_FUNC_DECL(InspectorControllerInspectedWindow)
+{
+    INC_STATS("InspectorController.inspectedWindow()");
+
+    InspectorController* inspectorController = V8Proxy::ToNativeObject<InspectorController>(V8ClassIndex::INSPECTORCONTROLLER, args.Holder());
+    return V8Proxy::ToV8Object<DOMWindow>(V8ClassIndex::DOMWINDOW, inspectorController->inspectedPage()->mainFrame()->domWindow());
+}
+
+CALLBACK_FUNC_DECL(InspectorControllerSetting)
+{
+    INC_STATS("InspectorController.setting()");
+
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    String key = toWebCoreStringWithNullCheck(args[0]);
+    if (key.isEmpty())
+        return v8::Undefined();
+
+    InspectorController* inspectorController = V8Proxy::ToNativeObject<InspectorController>(V8ClassIndex::INSPECTORCONTROLLER, args.Holder());
+    const InspectorController::Setting& setting = inspectorController ->setting(key);
+
+    switch (setting.type()) {
+        default:
+        case InspectorController::Setting::NoType:
+            return v8::Undefined();
+        case InspectorController::Setting::StringType:
+            return v8String(setting.string());
+        case InspectorController::Setting::DoubleType:
+            return v8::Number::New(setting.doubleValue());
+        case InspectorController::Setting::IntegerType:
+            return v8::Number::New(setting.integerValue());
+        case InspectorController::Setting::BooleanType:
+            return v8Boolean(setting.booleanValue());
+        case InspectorController::Setting::StringVectorType: {
+            const Vector<String>& strings = setting.stringVector();
+            v8::Local<v8::Array> stringsArray = v8::Array::New(strings.size());
+            const unsigned length = strings.size();
+            for (unsigned i = 0; i < length; ++i)
+                stringsArray->Set(v8::Number::New(i), v8String(strings[i]));
+            return stringsArray;
+        }
+    }
+}
+
+CALLBACK_FUNC_DECL(InspectorControllerSetSetting)
+{
+    INC_STATS("InspectorController.setSetting()");
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    String key = toWebCoreStringWithNullCheck(args[0]);
+    if (key.isEmpty())
+        return v8::Undefined();
+
+    InspectorController::Setting setting;
+
+    v8::Local<v8::Value> value = args[1];
+    if (value->IsUndefined() || value->IsNull()) {
+        // Do nothing. The setting is already NoType.
+        ASSERT(setting.type() == InspectorController::Setting::NoType);
+    } else if (value->IsString())
+        setting.set(toWebCoreStringWithNullCheck(value));
+    else if (value->IsNumber())
+        setting.set(value->NumberValue());
+    else if (value->IsBoolean())
+        setting.set(value->BooleanValue());
+    else if (value->IsArray()) {
+        v8::Local<v8::Array> v8Array = v8::Local<v8::Array>::Cast(value);
+        Vector<String> strings;
+        for (unsigned i = 0; i < v8Array->Length(); ++i) {
+            String item = toWebCoreString(v8Array->Get(v8::Integer::New(i)));
+            if (item.isEmpty())
+                return v8::Undefined();
+            strings.append(item);
+        }
+        setting.set(strings);
+    } else
+        return v8::Undefined();
+
+    InspectorController* inspectorController = V8Proxy::ToNativeObject<InspectorController>(V8ClassIndex::INSPECTORCONTROLLER, args.Holder());
+    inspectorController->setSetting(key, setting);
+
+    return v8::Undefined();
+}
+
 CALLBACK_FUNC_DECL(InspectorControllerWrapCallback)
 {
     INC_STATS("InspectorController.wrapCallback()");
diff --git a/WebCore/bindings/v8/custom/V8LocationCustom.cpp b/WebCore/bindings/v8/custom/V8LocationCustom.cpp
index 6dc2652..c5f3b1d 100644
--- a/WebCore/bindings/v8/custom/V8LocationCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8LocationCustom.cpp
@@ -35,6 +35,7 @@
 #include "V8CustomBinding.h"
 #include "V8CustomEventListener.h"
 #include "V8Location.h"
+#include "V8Utilities.h"
 #include "V8Proxy.h"
 
 #include "PlatformString.h"
@@ -51,27 +52,12 @@
 // This class is not very JS-engine specific.  If we can move a couple of
 // methods to the scriptController, we should be able to unify the code
 // between JSC and V8:
-//    retrieveActiveFrame()   - in JSC, this needs an ExecState.
+//    toCallingFrame()   - in JSC, this needs an ExecState.
 //    isSafeScript()
-// Since JSC and V8 have different mechanisms for getting at the ActiveFrame,
+// Since JSC and V8 have different mechanisms for getting at the calling frame,
 // we're just making all these custom for now.  The functionality is simple
 // and mirrors JSLocationCustom.cpp.
 
-static void navigateIfAllowed(Frame* frame, const KURL& url, bool lockHistory, bool lockBackForwardList)
-{
-    if (url.isEmpty())
-        return;
-
-    Frame* activeFrame = ScriptController::retrieveActiveFrame();
-    if (!activeFrame)
-        return;
-
-    if (!url.protocolIs("javascript") || ScriptController::isSafeScript(frame)) {
-        bool userGesture = activeFrame->script()->processingUserGesture();
-        frame->loader()->scheduleLocationChange(url.string(), activeFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, userGesture);
-    }
-}
-
 ACCESSOR_SETTER(LocationHash)
 {
     INC_STATS("DOM.Location.hash._set");
@@ -137,20 +123,19 @@
     INC_STATS("DOM.Location.href._set");
     v8::Handle<v8::Object> holder = info.Holder();
     Location* imp = V8Proxy::ToNativeObject<Location>(V8ClassIndex::LOCATION, holder);
-    String href = toWebCoreString(value);
 
     Frame* frame = imp->frame();
     if (!frame)
         return;
 
-    Frame* activeFrame = ScriptController::retrieveActiveFrame();
-    if (!activeFrame)
+    if (!shouldAllowNavigation(frame))
         return;
 
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+    KURL url = completeURL(toWebCoreString(value));
+    if (url.isNull())
         return;
 
-    navigateIfAllowed(frame, activeFrame->loader()->completeURL(href), false, false);
+    navigateIfAllowed(frame, url, false, false);
 }
 
 ACCESSOR_SETTER(LocationPathname)
@@ -285,18 +270,11 @@
     Location* imp = V8Proxy::ToNativeObject<Location>(V8ClassIndex::LOCATION, holder);
 
     Frame* frame = imp->frame();
-    if (!frame)
+    if (!frame || !ScriptController::isSafeScript(frame))
         return v8::Undefined();
 
-    Frame* activeFrame = ScriptController::retrieveActiveFrame();
-    if (!activeFrame)
-        return v8::Undefined();
-
-    if (!ScriptController::isSafeScript(frame))
-        return v8::Undefined();
-
-    bool userGesture = activeFrame->script()->processingUserGesture();
-    frame->loader()->scheduleRefresh(userGesture);
+    if (!protocolIsJavaScript(frame->loader()->url()))
+        frame->loader()->scheduleRefresh(processingUserGesture());
     return v8::Undefined();
 }
 
@@ -305,20 +283,19 @@
     INC_STATS("DOM.Location.replace");
     v8::Handle<v8::Value> holder = args.Holder();
     Location* imp = V8Proxy::ToNativeObject<Location>(V8ClassIndex::LOCATION, holder);
-    String url = toWebCoreString(args[0]);
 
     Frame* frame = imp->frame();
     if (!frame)
         return v8::Undefined();
 
-    Frame* activeFrame = ScriptController::retrieveActiveFrame();
-    if (!activeFrame)
+    if (!shouldAllowNavigation(frame))
         return v8::Undefined();
 
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+    KURL url = completeURL(toWebCoreString(args[0]));
+    if (url.isNull())
         return v8::Undefined();
 
-    navigateIfAllowed(frame, activeFrame->loader()->completeURL(url), true, true);
+    navigateIfAllowed(frame, url, true, true);
     return v8::Undefined();
 }
 
@@ -327,20 +304,19 @@
     INC_STATS("DOM.Location.assign");
     v8::Handle<v8::Value> holder = args.Holder();
     Location* imp = V8Proxy::ToNativeObject<Location>(V8ClassIndex::LOCATION, holder);
-    String url = toWebCoreString(args[0]);
 
     Frame* frame = imp->frame();
     if (!frame)
         return v8::Undefined();
 
-    Frame* activeFrame = ScriptController::retrieveActiveFrame();
-    if (!activeFrame)
+    if (!shouldAllowNavigation(frame))
         return v8::Undefined();
 
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+    KURL url = completeURL(toWebCoreString(args[0]));
+    if (url.isNull())
         return v8::Undefined();
 
-    navigateIfAllowed(frame, activeFrame->loader()->completeURL(url), false, false);
+    navigateIfAllowed(frame, url, false, false);
     return v8::Undefined();
 }
 
diff --git a/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp b/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
new file mode 100644
index 0000000..fce04b6
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "ExceptionCode.h"
+#include "MessagePort.h"
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8ObjectEventListener.h"
+#include "V8Proxy.h"
+#include "V8Utilities.h"
+
+namespace WebCore {
+
+ACCESSOR_GETTER(MessagePortOnmessage)
+{
+    INC_STATS("DOM.MessagePort.onmessage._get");
+    MessagePort* messagePort = V8Proxy::ToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, info.Holder());
+    return V8Proxy::EventListenerToV8Object(messagePort->onmessage());
+}
+
+ACCESSOR_SETTER(MessagePortOnmessage)
+{
+    INC_STATS("DOM.MessagePort.onmessage._set");
+    MessagePort* messagePort = V8Proxy::ToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, info.Holder());
+    if (value->IsNull()) {
+        if (messagePort->onmessage()) {
+            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(messagePort->onmessage());
+            removeHiddenDependency(info.Holder(), listener->getListenerObject(), V8Custom::kMessagePortRequestCacheIndex);
+        }
+
+        // Clear the listener.
+        messagePort->setOnmessage(0);
+
+    } else {
+        V8Proxy* proxy = V8Proxy::retrieve(messagePort->scriptExecutionContext());
+        if (!proxy)
+            return;
+
+        RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
+        if (listener) {
+            messagePort->setOnmessage(listener);
+            createHiddenDependency(info.Holder(), value, V8Custom::kMessagePortRequestCacheIndex);
+        }
+    }
+}
+
+ACCESSOR_GETTER(MessagePortOnclose)
+{
+    INC_STATS("DOM.MessagePort.onclose._get");
+    MessagePort* messagePort = V8Proxy::ToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, info.Holder());
+    return V8Proxy::EventListenerToV8Object(messagePort->onclose());
+}
+
+ACCESSOR_SETTER(MessagePortOnclose)
+{
+    INC_STATS("DOM.MessagePort.onclose._set");
+    MessagePort* messagePort = V8Proxy::ToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, info.Holder());
+    if (value->IsNull()) {
+        if (messagePort->onclose()) {
+            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(messagePort->onclose());
+            removeHiddenDependency(info.Holder(), listener->getListenerObject(), V8Custom::kXMLHttpRequestCacheIndex);
+        }
+
+        // Clear the listener.
+        messagePort->setOnclose(0);
+    } else {
+        V8Proxy* proxy = V8Proxy::retrieve(messagePort->scriptExecutionContext());
+        if (!proxy)
+            return;
+
+        RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
+        if (listener) {
+            messagePort->setOnclose(listener);
+            createHiddenDependency(info.Holder(), value, V8Custom::kMessagePortRequestCacheIndex);
+        }
+    }
+}
+
+CALLBACK_FUNC_DECL(MessagePortStartConversation)
+{
+    INC_STATS("DOM.MessagePort.StartConversation()");
+    if (args.Length() < 1)
+        return throwError("Not enough arguments", V8Proxy::SYNTAX_ERROR);
+    MessagePort* messagePort = V8Proxy::ToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, args.Holder());
+
+    V8Proxy* proxy = V8Proxy::retrieve(messagePort->scriptExecutionContext());
+    if (!proxy)
+        return v8::Undefined();
+
+    RefPtr<MessagePort> port = messagePort->startConversation(messagePort->scriptExecutionContext(), toWebCoreString(args[0]));
+    v8::Handle<v8::Value> wrapper = V8Proxy::ToV8Object(V8ClassIndex::MESSAGEPORT, port.get());
+    return wrapper;
+}
+
+CALLBACK_FUNC_DECL(MessagePortAddEventListener)
+{
+    INC_STATS("DOM.MessagePort.AddEventListener()");
+    MessagePort* messagePort = V8Proxy::ToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, args.Holder());
+
+    V8Proxy* proxy = V8Proxy::retrieve(messagePort->scriptExecutionContext());
+    if (!proxy)
+        return v8::Undefined();
+
+    RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(args[1], false);
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        messagePort->addEventListener(type, listener, useCapture);
+
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kMessagePortRequestCacheIndex);
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(MessagePortRemoveEventListener)
+{
+    INC_STATS("DOM.MessagePort.RemoveEventListener()");
+    MessagePort* messagePort = V8Proxy::ToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, args.Holder());
+
+    V8Proxy* proxy = V8Proxy::retrieve(messagePort->scriptExecutionContext());
+    if (!proxy)
+        return v8::Undefined(); // probably leaked
+
+    RefPtr<EventListener> listener = proxy->FindObjectEventListener(args[1], false);
+
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        messagePort->removeEventListener(type, listener.get(), useCapture);
+
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kMessagePortRequestCacheIndex);
+    }
+
+    return v8::Undefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8NodeCustom.cpp b/WebCore/bindings/v8/custom/V8NodeCustom.cpp
index bf30414..e81e8b5 100644
--- a/WebCore/bindings/v8/custom/V8NodeCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8NodeCustom.cpp
@@ -37,6 +37,7 @@
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
 #include "V8CustomEventListener.h"
+#include "V8Node.h"
 #include "V8Proxy.h"
 
 #include <wtf/RefPtr.h>
@@ -83,4 +84,77 @@
     return v8::Undefined();
 }
 
+// This function is customized to take advantage of the optional 4th argument: shouldLazyAttach
+CALLBACK_FUNC_DECL(NodeInsertBefore)
+{
+    INC_STATS("DOM.Node.insertBefore");
+    v8::Handle<v8::Value> holder = args.Holder();
+    Node* imp = V8Proxy::DOMWrapperToNode<Node>(holder);
+    ExceptionCode ec = 0;
+    Node* newChild = V8Node::HasInstance(args[0]) ? V8Proxy::DOMWrapperToNode<Node>(args[0]) : 0;
+    Node* refChild = V8Node::HasInstance(args[1]) ? V8Proxy::DOMWrapperToNode<Node>(args[1]) : 0;
+    bool success = imp->insertBefore(newChild, refChild, ec, true);
+    if (ec) {
+        V8Proxy::SetDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    if (success)
+        return args[0];
+    return v8::Null();
+}
+
+// This function is customized to take advantage of the optional 4th argument: shouldLazyAttach
+CALLBACK_FUNC_DECL(NodeReplaceChild)
+{
+    INC_STATS("DOM.Node.replaceChild");
+    v8::Handle<v8::Value> holder = args.Holder();
+    Node* imp = V8Proxy::DOMWrapperToNode<Node>(holder);
+    ExceptionCode ec = 0;
+    Node* newChild = V8Node::HasInstance(args[0]) ? V8Proxy::DOMWrapperToNode<Node>(args[0]) : 0;
+    Node* oldChild = V8Node::HasInstance(args[1]) ? V8Proxy::DOMWrapperToNode<Node>(args[1]) : 0;
+    bool success = imp->replaceChild(newChild, oldChild, ec, true);
+    if (ec) {
+        V8Proxy::SetDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    if (success)
+        return args[1];
+    return v8::Null();
+}
+
+CALLBACK_FUNC_DECL(NodeRemoveChild)
+{
+    INC_STATS("DOM.Node.removeChild");
+    v8::Handle<v8::Value> holder = args.Holder();
+    Node* imp = V8Proxy::DOMWrapperToNode<Node>(holder);
+    ExceptionCode ec = 0;
+    Node* oldChild = V8Node::HasInstance(args[0]) ? V8Proxy::DOMWrapperToNode<Node>(args[0]) : 0;
+    bool success = imp->removeChild(oldChild, ec);
+    if (ec) {
+        V8Proxy::SetDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    if (success)
+        return args[0];
+    return v8::Null();
+}
+
+// This function is customized to take advantage of the optional 4th argument: shouldLazyAttach
+CALLBACK_FUNC_DECL(NodeAppendChild)
+{
+    INC_STATS("DOM.Node.appendChild");
+    v8::Handle<v8::Value> holder = args.Holder();
+    Node* imp = V8Proxy::DOMWrapperToNode<Node>(holder);
+    ExceptionCode ec = 0;
+    Node* newChild = V8Node::HasInstance(args[0]) ? V8Proxy::DOMWrapperToNode<Node>(args[0]) : 0;
+    bool success = imp->appendChild(newChild, ec, true );
+    if (ec) {
+        V8Proxy::SetDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    if (success)
+        return args[0];
+    return v8::Null();
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
new file mode 100755
index 0000000..a67cb10
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -0,0 +1,185 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WORKERS)
+
+#include "WorkerContextExecutionProxy.h"
+
+#include "ExceptionCode.h"
+#include "DOMTimer.h"
+#include "NotImplemented.h"
+#include "ScheduledAction.h"
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+#include "V8Utilities.h"
+#include "V8WorkerContextEventListener.h"
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+ACCESSOR_GETTER(WorkerContextSelf)
+{
+    INC_STATS(L"DOM.WorkerContext.self._get");
+    WorkerContext* workerContext = V8Proxy::ToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
+    return WorkerContextExecutionProxy::WorkerContextToV8Object(workerContext);
+}
+
+ACCESSOR_GETTER(WorkerContextOnmessage)
+{
+    INC_STATS(L"DOM.WorkerContext.onmessage._get");
+    WorkerContext* workerContext = V8Proxy::ToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
+    if (workerContext->onmessage()) {
+        V8WorkerContextEventListener* listener = static_cast<V8WorkerContextEventListener*>(workerContext->onmessage());
+        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
+        return v8Listener;
+    }
+    return v8::Undefined();
+}
+
+ACCESSOR_SETTER(WorkerContextOnmessage)
+{
+    INC_STATS(L"DOM.WorkerContext.onmessage._set");
+    WorkerContext* workerContext = V8Proxy::ToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
+    V8WorkerContextEventListener* oldListener = static_cast<V8WorkerContextEventListener*>(workerContext->onmessage());
+    if (value->IsNull()) {
+        if (workerContext->onmessage()) {
+            v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
+            removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerContextRequestCacheIndex);
+        }
+
+        // Clear the listener.
+        workerContext->setOnmessage(0);
+    } else {
+        RefPtr<V8EventListener> listener = workerContext->script()->proxy()->findOrCreateEventListener(v8::Local<v8::Object>::Cast(value), false, false);
+        if (listener) {
+            if (oldListener) {
+                v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
+                removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerContextRequestCacheIndex);
+            }
+
+            workerContext->setOnmessage(listener);
+            createHiddenDependency(info.Holder(), value, V8Custom::kWorkerContextRequestCacheIndex);
+        }
+    }
+}
+
+v8::Handle<v8::Value> SetTimeoutOrInterval(const v8::Arguments& args, bool singleShot)
+{
+    WorkerContext* workerContext = V8Proxy::ToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, args.Holder());
+
+    int argumentCount = args.Length();
+    if (argumentCount < 1)
+        return v8::Undefined();
+
+    v8::Handle<v8::Value> function = args[0];
+    int32_t timeout = argumentCount >= 2 ? args[1]->Int32Value() : 0;
+    int timerId;
+
+    if (function->IsString()) {
+        WebCore::String stringFunction = ToWebCoreString(function);
+        timerId = DOMTimer::install(workerContext, new ScheduledAction(stringFunction, workerContext->url()), timeout, singleShot);
+    } else if (function->IsFunction()) {
+        size_t paramCount = argumentCount >= 2 ? argumentCount - 2 : 0;
+        v8::Local<v8::Value>* params = 0;
+        if (paramCount > 0) {
+            params = new v8::Local<v8::Value>[paramCount];
+            for (size_t i = 0; i < paramCount; ++i)
+                params[i] = args[i+2];
+        }
+        // ScheduledAction takes ownership of actual params and releases them in its destructor.
+        ScheduledAction* action = new ScheduledAction(v8::Handle<v8::Function>::Cast(function), paramCount, params);
+        delete [] params;
+        timerId = DOMTimer::install(workerContext, action, timeout, singleShot);
+    } else
+        return v8::Undefined();
+
+    return v8::Integer::New(timerId);
+}
+
+CALLBACK_FUNC_DECL(WorkerContextImportScripts)
+{
+    INC_STATS(L"DOM.WorkerContext.importScripts()");
+    notImplemented();
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WorkerContextSetTimeout)
+{
+    INC_STATS(L"DOM.WorkerContext.setTimeout()");
+    return SetTimeoutOrInterval(args, true);
+}
+
+CALLBACK_FUNC_DECL(WorkerContextSetInterval) {
+    INC_STATS(L"DOM.WorkerContext.setInterval()");
+    return SetTimeoutOrInterval(args, false);
+}
+
+CALLBACK_FUNC_DECL(WorkerContextAddEventListener)
+{
+    INC_STATS(L"DOM.WorkerContext.addEventListener()");
+    WorkerContext* workerContext = V8Proxy::ToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, args.Holder());
+
+    RefPtr<V8EventListener> listener = workerContext->script()->proxy()->findOrCreateEventListener(v8::Local<v8::Object>::Cast(args[1]), false, false);
+
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        workerContext->addEventListener(type, listener, useCapture);
+
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kWorkerContextRequestCacheIndex);
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WorkerContextRemoveEventListener)
+{
+    INC_STATS(L"DOM.WorkerContext.removeEventListener()");
+    WorkerContext* workerContext = V8Proxy::ToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, args.Holder());
+    WorkerContextExecutionProxy* proxy = workerContext->script()->proxy();
+
+    RefPtr<V8EventListener> listener = proxy->findOrCreateEventListener(v8::Local<v8::Object>::Cast(args[1]), false, true);
+
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        workerContext->removeEventListener(type, listener.get(), useCapture);
+
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kWorkerContextRequestCacheIndex);
+    }
+
+    return v8::Undefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
diff --git a/WebCore/bindings/v8/custom/V8WorkerCustom.cpp b/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
new file mode 100755
index 0000000..3edaa8e
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
@@ -0,0 +1,228 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WORKERS)
+
+#include "Worker.h"
+
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8ObjectEventListener.h"
+#include "V8Proxy.h"
+#include "V8Utilities.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(WorkerConstructor)
+{
+    INC_STATS(L"DOM.Worker.Constructor");
+
+    if (!WorkerContextExecutionProxy::isWebWorkersEnabled()) {
+        return throwError("Worker is not enabled.", V8Proxy::SYNTAX_ERROR);
+    }
+
+    if (!args.IsConstructCall()) {
+        return throwError("DOM object constructor cannot be called as a function.");
+    }
+
+    if (args.Length() == 0) {
+        return throwError("Not enough arguments", V8Proxy::SYNTAX_ERROR);
+    }
+
+    v8::TryCatch tryCatch;
+    v8::Handle<v8::String> scriptUrl = args[0]->ToString();
+    if (tryCatch.HasCaught()) {
+        return throwError(tryCatch.Exception());
+    }
+    if (scriptUrl.IsEmpty())
+        return v8::Undefined();
+
+    // Get the script execution context.
+    ScriptExecutionContext* context = 0;
+    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
+    if (proxy)
+        context = proxy->workerContext();
+    else {
+        Frame* frame = V8Proxy::retrieveFrame();
+        if (!frame)
+            return v8::Undefined();
+        context = frame->document();
+    }
+
+    // Create the worker object.
+    // Note: it's OK to let this RefPtr go out of scope because we also call SetDOMWrapper(), which effectively holds a reference to obj.
+    ExceptionCode ec = 0;
+    RefPtr<Worker> obj = Worker::create(toWebCoreString(scriptUrl), context, ec);
+
+    // Setup the standard wrapper object internal fields.
+    v8::Handle<v8::Object> wrapperObject = args.Holder();
+    V8Proxy::SetDOMWrapper(wrapperObject, V8ClassIndex::WORKER, obj.get());
+
+    obj->ref();
+    V8Proxy::SetJSWrapperForActiveDOMObject(obj.get(), v8::Persistent<v8::Object>::New(wrapperObject));
+
+    return wrapperObject;
+}
+
+PassRefPtr<EventListener> getEventListener(Worker* worker, v8::Local<v8::Value> value, bool findOnly)
+{
+    if (worker->scriptExecutionContext()->isWorkerContext()) {
+        WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
+        ASSERT(workerContextProxy);
+        return workerContextProxy->findOrCreateObjectEventListener(value, false, findOnly);
+    }
+
+    V8Proxy* proxy = V8Proxy::retrieve(worker->scriptExecutionContext());
+    if (proxy)
+        return findOnly ? proxy->FindObjectEventListener(value, false) : proxy->FindOrCreateObjectEventListener(value, false);
+
+    return 0;
+}
+
+ACCESSOR_GETTER(WorkerOnmessage)
+{
+    INC_STATS(L"DOM.Worker.onmessage._get");
+    Worker* worker = V8Proxy::ToNativeObject<Worker>(V8ClassIndex::WORKER, info.Holder());
+    if (worker->onmessage()) {
+        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(worker->onmessage());
+        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
+        return v8Listener;
+    }
+    return v8::Undefined();
+}
+
+ACCESSOR_SETTER(WorkerOnmessage)
+{
+    INC_STATS(L"DOM.Worker.onmessage._set");
+    Worker* worker = V8Proxy::ToNativeObject<Worker>(V8ClassIndex::WORKER, info.Holder());
+    V8ObjectEventListener* oldListener = static_cast<V8ObjectEventListener*>(worker->onmessage());
+    if (value->IsNull()) {
+        if (oldListener) {
+            v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
+            removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerRequestCacheIndex);
+        }
+
+        // Clear the listener.
+        worker->setOnmessage(0);
+    } else {
+        RefPtr<EventListener> listener = getEventListener(worker, value, false);
+        if (listener) {
+            if (oldListener) {
+                v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
+                removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerRequestCacheIndex);
+            }
+
+            worker->setOnmessage(listener);
+            createHiddenDependency(info.Holder(), value, V8Custom::kWorkerRequestCacheIndex);
+        }
+    }
+}
+
+ACCESSOR_GETTER(WorkerOnerror)
+{
+    INC_STATS(L"DOM.Worker.onerror._get");
+    Worker* worker = V8Proxy::ToNativeObject<Worker>(V8ClassIndex::WORKER, info.Holder());
+    if (worker->onerror()) {
+        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(worker->onerror());
+        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
+        return v8Listener;
+    }
+    return v8::Undefined();
+}
+
+ACCESSOR_SETTER(WorkerOnerror)
+{
+    INC_STATS(L"DOM.Worker.onerror._set");
+    Worker* worker = V8Proxy::ToNativeObject<Worker>(V8ClassIndex::WORKER, info.Holder());
+    V8ObjectEventListener* oldListener = static_cast<V8ObjectEventListener*>(worker->onerror());
+    if (value->IsNull()) {
+        if (oldListener) {
+            v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
+            removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerRequestCacheIndex);
+        }
+
+        // Clear the listener.
+        worker->setOnerror(0);
+    } else {
+        RefPtr<EventListener> listener = getEventListener(worker, value, false);
+        if (listener) {
+            if (oldListener) {
+                v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
+                removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerRequestCacheIndex);
+            }
+
+            worker->setOnerror(listener);
+            createHiddenDependency(info.Holder(), value, V8Custom::kWorkerRequestCacheIndex);
+        }
+    }
+}
+
+CALLBACK_FUNC_DECL(WorkerAddEventListener)
+{
+    INC_STATS(L"DOM.Worker.addEventListener()");
+    Worker* worker = V8Proxy::ToNativeObject<Worker>(V8ClassIndex::WORKER, args.Holder());
+
+    RefPtr<EventListener> listener = getEventListener(worker, args[1], false);
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        worker->addEventListener(type, listener, useCapture);
+
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kWorkerRequestCacheIndex);
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WorkerRemoveEventListener)
+{
+    INC_STATS(L"DOM.Worker.removeEventListener()");
+    Worker* worker = V8Proxy::ToNativeObject<Worker>(V8ClassIndex::WORKER, args.Holder());
+
+    RefPtr<EventListener> listener = getEventListener(worker, args[1], true);
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        worker->removeEventListener(type, listener.get(), useCapture);
+
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kWorkerRequestCacheIndex);
+    }
+
+    return v8::Undefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
diff --git a/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp b/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
index 6b55238..c913c08 100644
--- a/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
@@ -36,6 +36,8 @@
 #include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 #include "XMLHttpRequest.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
 
 namespace WebCore {
 
@@ -48,8 +50,15 @@
 
     // Expect no parameters.
     // Allocate a XMLHttpRequest object as its internal field.
-    Document* doc = V8Proxy::retrieveFrame()->document();
-    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(doc);
+    ScriptExecutionContext* context = 0;
+#if ENABLE(WORKERS)
+    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
+    if (proxy)
+        context = proxy->workerContext();
+    else
+#endif
+        context = V8Proxy::retrieveFrame()->document();
+    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(context);
     V8Proxy::SetDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::XMLHTTPREQUEST), xmlHttpRequest.get());
 
     // Add object to the wrapper map.
diff --git a/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index ea69f0b..cb80a4f 100644
--- a/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -38,10 +38,27 @@
 #include "V8HTMLDocument.h"
 #include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
-#include "V8XMLHttpRequestUtilities.h"
+#include "V8Utilities.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
 
 namespace WebCore {
 
+PassRefPtr<EventListener> getEventListener(XMLHttpRequest* xmlHttpRequest, v8::Local<v8::Value> value, bool findOnly)
+{
+#if ENABLE(WORKERS)
+    WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
+    if (workerContextProxy)
+        return workerContextProxy->findOrCreateObjectEventListener(value, false, findOnly);
+#endif
+
+    V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
+    if (proxy)
+        return findOnly ? proxy->FindObjectEventListener(value, false) : proxy->FindOrCreateObjectEventListener(value, false);
+
+    return PassRefPtr<EventListener>();
+}
+
 ACCESSOR_GETTER(XMLHttpRequestOnabort)
 {
     INC_STATS("DOM.XMLHttpRequest.onabort._get");
@@ -51,7 +68,7 @@
         v8::Local<v8::Object> v8Listener = listener->getListenerObject();
         return v8Listener;
     }
-    return v8::Undefined();
+    return v8::Null();
 }
 
 ACCESSOR_SETTER(XMLHttpRequestOnabort)
@@ -62,20 +79,16 @@
         if (xmlHttpRequest->onabort()) {
             V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onabort());
             v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenXHRDependency(info.Holder(), v8Listener);
+            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
         }
 
         // Clear the listener.
         xmlHttpRequest->setOnabort(0);
     } else {
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
+        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
         if (listener) {
             xmlHttpRequest->setOnabort(listener);
-            createHiddenXHRDependency(info.Holder(), value);
+            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
         }
     }
 }
@@ -89,7 +102,7 @@
         v8::Local<v8::Object> v8Listener = listener->getListenerObject();
         return v8Listener;
     }
-    return v8::Undefined();
+    return v8::Null();
 }
 
 ACCESSOR_SETTER(XMLHttpRequestOnerror)
@@ -100,20 +113,16 @@
         if (xmlHttpRequest->onerror()) {
             V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onerror());
             v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenXHRDependency(info.Holder(), v8Listener);
+            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
         }
 
         // Clear the listener.
         xmlHttpRequest->setOnerror(0);
     } else {
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
+        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
         if (listener) {
             xmlHttpRequest->setOnerror(listener);
-            createHiddenXHRDependency(info.Holder(), value);
+            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
         }
     }
 }
@@ -127,7 +136,7 @@
         v8::Local<v8::Object> v8Listener = listener->getListenerObject();
         return v8Listener;
     }
-    return v8::Undefined();
+    return v8::Null();
 }
 
 ACCESSOR_SETTER(XMLHttpRequestOnload)
@@ -138,20 +147,16 @@
         if (xmlHttpRequest->onload()) {
             V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onload());
             v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenXHRDependency(info.Holder(), v8Listener);
+            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
         }
 
         xmlHttpRequest->setOnload(0);
 
     } else {
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
+        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
         if (listener) {
             xmlHttpRequest->setOnload(listener.get());
-            createHiddenXHRDependency(info.Holder(), value);
+            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
         }
     }
 }
@@ -165,7 +170,7 @@
         v8::Local<v8::Object> v8Listener = listener->getListenerObject();
         return v8Listener;
     }
-    return v8::Undefined();
+    return v8::Null();
 }
 
 ACCESSOR_SETTER(XMLHttpRequestOnloadstart)
@@ -176,20 +181,16 @@
         if (xmlHttpRequest->onloadstart()) {
             V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onloadstart());
             v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenXHRDependency(info.Holder(), v8Listener);
+            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
         }
 
         // Clear the listener.
         xmlHttpRequest->setOnloadstart(0);
     } else {
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
+        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
         if (listener) {
             xmlHttpRequest->setOnloadstart(listener);
-            createHiddenXHRDependency(info.Holder(), value);
+            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
         }
     }
 }
@@ -203,7 +204,7 @@
         v8::Local<v8::Object> v8Listener = listener->getListenerObject();
         return v8Listener;
     }
-    return v8::Undefined();
+    return v8::Null();
 }
 
 ACCESSOR_SETTER(XMLHttpRequestOnprogress)
@@ -214,20 +215,16 @@
         if (xmlHttpRequest->onprogress()) {
             V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onprogress());
             v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenXHRDependency(info.Holder(), v8Listener);
+            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
         }
 
         // Clear the listener.
         xmlHttpRequest->setOnprogress(0);
     } else {
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
+        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
         if (listener) {
             xmlHttpRequest->setOnprogress(listener);
-            createHiddenXHRDependency(info.Holder(), value);
+            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
         }
     }
 }
@@ -241,7 +238,7 @@
         v8::Local<v8::Object> v8Listener = listener->getListenerObject();
         return v8Listener;
     }
-    return v8::Undefined();
+    return v8::Null();
 }
 
 ACCESSOR_SETTER(XMLHttpRequestOnreadystatechange)
@@ -252,20 +249,16 @@
         if (xmlHttpRequest->onreadystatechange()) {
             V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onreadystatechange());
             v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenXHRDependency(info.Holder(), v8Listener);
+            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
         }
 
         // Clear the listener.
         xmlHttpRequest->setOnreadystatechange(0);
     } else {
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
+        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
         if (listener) {
             xmlHttpRequest->setOnreadystatechange(listener.get());
-            createHiddenXHRDependency(info.Holder(), value);
+            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
         }
     }
 }
@@ -284,17 +277,13 @@
     INC_STATS("DOM.XMLHttpRequest.addEventListener()");
     XMLHttpRequest* xmlHttpRequest = V8Proxy::ToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, args.Holder());
 
-    V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-    if (!proxy)
-        return v8::Undefined();
-
-    RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(args[1], false);
+    RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, args[1], false);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
         xmlHttpRequest->addEventListener(type, listener, useCapture);
 
-        createHiddenXHRDependency(args.Holder(), args[1]);
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kXMLHttpRequestCacheIndex);
     }
     return v8::Undefined();
 }
@@ -304,18 +293,13 @@
     INC_STATS("DOM.XMLHttpRequest.removeEventListener()");
     XMLHttpRequest* xmlHttpRequest = V8Proxy::ToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, args.Holder());
 
-    V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-    if (!proxy)
-        return v8::Undefined(); // Probably leaked.
-
-    RefPtr<EventListener> listener = proxy->FindObjectEventListener(args[1], false);
-
+    RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, args[1], true);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
         xmlHttpRequest->removeEventListener(type, listener.get(), useCapture);
 
-        removeHiddenXHRDependency(args.Holder(), args[1]);
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kXMLHttpRequestCacheIndex);
     }
 
     return v8::Undefined();
@@ -337,8 +321,24 @@
 
     String method = toWebCoreString(args[0]);
     String urlstring = toWebCoreString(args[1]);
-    V8Proxy* proxy = V8Proxy::retrieve();
-    KURL url = proxy->frame()->document()->completeURL(urlstring);
+    ScriptExecutionContext* context = 0;
+#if ENABLE(WORKERS)
+    WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
+    if (workerContextProxy) {
+        context = workerContextProxy->workerContext();
+        ASSERT(context);
+    }
+#endif
+
+    if (!context) {
+        V8Proxy* proxy = V8Proxy::retrieve();
+        if (!proxy)
+            return v8::Undefined();
+        context = proxy->frame()->document();
+        ASSERT(context);
+    }
+
+    KURL url = context->completeURL(urlstring);
 
     bool async = (args.Length() < 3) ? true : args[2]->BooleanValue();
 
diff --git a/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp b/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp
index 7ffad82..7afa82c 100644
--- a/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp
@@ -36,7 +36,7 @@
 #include "V8CustomBinding.h"
 #include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
-#include "V8XMLHttpRequestUtilities.h"
+#include "V8Utilities.h"
 #include "XMLHttpRequest.h"
 
 #include <wtf/Assertions.h>
@@ -52,7 +52,7 @@
         v8::Local<v8::Object> v8Listener = listener->getListenerObject();
         return v8Listener;
     }
-    return v8::Undefined();
+    return v8::Null();
 }
 
 ACCESSOR_SETTER(XMLHttpRequestUploadOnabort)
@@ -63,7 +63,7 @@
         if (xmlHttpRequestUpload->onabort()) {
             V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onabort());
             v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenXHRDependency(info.Holder(), v8Listener);
+            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
         }
 
         // Clear the listener.
@@ -77,7 +77,7 @@
         RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
         if (listener) {
             xmlHttpRequestUpload->setOnabort(listener);
-            createHiddenXHRDependency(info.Holder(), value);
+            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
         }
     }
 }
@@ -91,7 +91,7 @@
         v8::Local<v8::Object> v8Listener = listener->getListenerObject();
         return v8Listener;
     }
-    return v8::Undefined();
+    return v8::Null();
 }
 
 ACCESSOR_SETTER(XMLHttpRequestUploadOnerror)
@@ -102,7 +102,7 @@
         if (xmlHttpRequestUpload->onerror()) {
             V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onerror());
             v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenXHRDependency(info.Holder(), v8Listener);
+            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
         }
 
         // Clear the listener.
@@ -116,7 +116,7 @@
         RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
         if (listener) {
             xmlHttpRequestUpload->setOnerror(listener);
-            createHiddenXHRDependency(info.Holder(), value);
+            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
         }
     }
 }
@@ -130,7 +130,7 @@
         v8::Local<v8::Object> v8Listener = listener->getListenerObject();
         return v8Listener;
     }
-    return v8::Undefined();
+    return v8::Null();
 }
 
 ACCESSOR_SETTER(XMLHttpRequestUploadOnload)
@@ -141,7 +141,7 @@
         if (xmlHttpRequestUpload->onload()) {
             V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onload());
             v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenXHRDependency(info.Holder(), v8Listener);
+            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
         }
 
         // Clear the listener.
@@ -155,7 +155,7 @@
         RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
         if (listener) {
             xmlHttpRequestUpload->setOnload(listener);
-            createHiddenXHRDependency(info.Holder(), value);
+            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
         }
     }
 }
@@ -169,7 +169,7 @@
         v8::Local<v8::Object> v8Listener = listener->getListenerObject();
         return v8Listener;
     }
-    return v8::Undefined();
+    return v8::Null();
 }
 
 ACCESSOR_SETTER(XMLHttpRequestUploadOnloadstart)
@@ -180,7 +180,7 @@
         if (xmlHttpRequestUpload->onloadstart()) {
             V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onloadstart());
             v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenXHRDependency(info.Holder(), v8Listener);
+            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
         }
 
         // Clear the listener.
@@ -194,7 +194,7 @@
         RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
         if (listener) {
             xmlHttpRequestUpload->setOnloadstart(listener);
-            createHiddenXHRDependency(info.Holder(), value);
+            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
         }
     }
 }
@@ -208,7 +208,7 @@
         v8::Local<v8::Object> v8Listener = listener->getListenerObject();
         return v8Listener;
     }
-    return v8::Undefined();
+    return v8::Null();
 }
 
 ACCESSOR_SETTER(XMLHttpRequestUploadOnprogress)
@@ -219,7 +219,7 @@
         if (xmlHttpRequestUpload->onprogress()) {
             V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onprogress());
             v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenXHRDependency(info.Holder(), v8Listener);
+            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
         }
 
         // Clear the listener.
@@ -233,7 +233,7 @@
         RefPtr<EventListener> listener = proxy->FindOrCreateObjectEventListener(value, false);
         if (listener) {
             xmlHttpRequestUpload->setOnprogress(listener);
-            createHiddenXHRDependency(info.Holder(), value);
+            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
         }
     }
 }
@@ -254,7 +254,7 @@
         bool useCapture = args[2]->BooleanValue();
         xmlHttpRequestUpload->addEventListener(type, listener, useCapture);
 
-        createHiddenXHRDependency(args.Holder(), args[1]);
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kXMLHttpRequestCacheIndex);
     }
     return v8::Undefined();
 }
@@ -276,7 +276,7 @@
         bool useCapture = args[2]->BooleanValue();
         xmlHttpRequestUpload->removeEventListener(type, listener.get(), useCapture);
 
-        removeHiddenXHRDependency(args.Holder(), args[1]);
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kXMLHttpRequestCacheIndex);
     }
 
     return v8::Undefined();
diff --git a/WebCore/bridge/NP_jsobject.cpp b/WebCore/bridge/NP_jsobject.cpp
index 9a9cfc3..b1000d0 100644
--- a/WebCore/bridge/NP_jsobject.cpp
+++ b/WebCore/bridge/NP_jsobject.cpp
@@ -52,7 +52,7 @@
 using namespace JSC::Bindings;
 using namespace WebCore;
 
-static void getListFromVariantArgs(ExecState* exec, const NPVariant* args, unsigned argCount, RootObject* rootObject, ArgList& aList)
+static void getListFromVariantArgs(ExecState* exec, const NPVariant* args, unsigned argCount, RootObject* rootObject, MarkedArgumentBuffer& aList)
 {
     for (unsigned i = 0; i < argCount; ++i)
         aList.append(convertNPVariantToValue(exec, &args[i], rootObject));
@@ -116,17 +116,17 @@
         JSLock lock(false);
         
         // Call the function object.
-        JSValuePtr function = obj->imp;
+        JSValue function = obj->imp;
         CallData callData;
         CallType callType = function.getCallData(callData);
         if (callType == CallTypeNone)
             return false;
         
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValuePtr resultV = call(exec, function, callType, callData, function, argList);
+        JSValue resultV = call(exec, function, callType, callData, function, argList);
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -165,18 +165,18 @@
             return false;
         ExecState* exec = rootObject->globalObject()->globalExec();
         JSLock lock(false);
-        JSValuePtr function = obj->imp->get(exec, identifierFromNPIdentifier(i->string()));
+        JSValue function = obj->imp->get(exec, identifierFromNPIdentifier(i->string()));
         CallData callData;
         CallType callType = function.getCallData(callData);
         if (callType == CallTypeNone)
             return false;
 
         // Call the function object.
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValuePtr resultV = call(exec, function, callType, callData, obj->imp, argList);
+        JSValue resultV = call(exec, function, callType, callData, obj->imp, argList);
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -210,7 +210,7 @@
         globalObject->globalData()->timeoutChecker.stop();
         ComplType type = completion.complType();
         
-        JSValuePtr result;
+        JSValue result;
         if (type == Normal) {
             result = completion.value();
             if (!result)
@@ -240,7 +240,7 @@
         IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
         
         JSLock lock(false);
-        JSValuePtr result;
+        JSValue result;
         if (i->isString())
             result = obj->imp->get(exec, identifierFromNPIdentifier(i->string()));
         else
@@ -368,7 +368,7 @@
 
         ExecState* exec = rootObject->globalObject()->globalExec();
         JSLock lock(false);
-        JSValuePtr func = obj->imp->get(exec, identifierFromNPIdentifier(i->string()));
+        JSValue func = obj->imp->get(exec, identifierFromNPIdentifier(i->string()));
         exec->clearException();
         return !func.isUndefined();
     }
@@ -442,17 +442,17 @@
         JSLock lock(false);
         
         // Call the constructor object.
-        JSValuePtr constructor = obj->imp;
+        JSValue constructor = obj->imp;
         ConstructData constructData;
         ConstructType constructType = constructor.getConstructData(constructData);
         if (constructType == ConstructTypeNone)
             return false;
         
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValuePtr resultV = construct(exec, constructor, constructType, constructData, argList);
+        JSValue resultV = construct(exec, constructor, constructType, constructData, argList);
         globalObject->globalData()->timeoutChecker.stop();
         
         // Convert and return the result.
diff --git a/WebCore/bridge/c/c_instance.cpp b/WebCore/bridge/c/c_instance.cpp
index 24b881f..97a89eb 100644
--- a/WebCore/bridge/c/c_instance.cpp
+++ b/WebCore/bridge/c/c_instance.cpp
@@ -101,7 +101,7 @@
     return _object->_class->invokeDefault;
 }
 
-JSValuePtr CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, const ArgList& args)
+JSValue CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, const ArgList& args)
 {
     // Overloading methods are not allowed by NPObjects.  Should only be one
     // name match for a particular method.
@@ -118,7 +118,7 @@
 
     unsigned i;
     for (i = 0; i < count; i++)
-        convertValueToNPVariant(exec, args.at(exec, i), &cArgs[i]);
+        convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
 #ifdef ANDROID_NPN_SETEXCEPTION
@@ -137,7 +137,7 @@
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValuePtr resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
 #ifdef ANDROID_NPN_SETEXCEPTION
     MoveGlobalExceptionToExecState(exec);
@@ -146,7 +146,7 @@
 }
 
 
-JSValuePtr CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
+JSValue CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
 {
     if (!_object->_class->invokeDefault)
         return jsUndefined();
@@ -156,7 +156,7 @@
 
     unsigned i;
     for (i = 0; i < count; i++)
-        convertValueToNPVariant(exec, args.at(exec, i), &cArgs[i]);
+        convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
 #ifdef ANDROID_NPN_SETEXCEPTION
@@ -174,7 +174,7 @@
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValuePtr resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
 #ifdef ANDROID_NPN_SETEXCEPTION
     MoveGlobalExceptionToExecState(exec);
@@ -187,7 +187,7 @@
     return _object->_class->construct;
 }
     
-JSValuePtr CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
+JSValue CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
 {
     if (!_object->_class->construct)
         return jsUndefined();
@@ -197,7 +197,7 @@
 
     unsigned i;
     for (i = 0; i < count; i++)
-        convertValueToNPVariant(exec, args.at(exec, i), &cArgs[i]);
+        convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
     NPVariant resultVariant;
@@ -212,12 +212,12 @@
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValuePtr resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
 
-JSValuePtr CInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue CInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
         return stringValue(exec);
@@ -226,26 +226,26 @@
     return valueOf(exec);
 }
 
-JSValuePtr CInstance::stringValue(ExecState* exec) const
+JSValue CInstance::stringValue(ExecState* exec) const
 {
     char buf[1024];
     snprintf(buf, sizeof(buf), "NPObject %p, NPClass %p", _object, _object->_class);
     return jsString(exec, buf);
 }
 
-JSValuePtr CInstance::numberValue(ExecState* exec) const
+JSValue CInstance::numberValue(ExecState* exec) const
 {
     // FIXME: Implement something sensible.
     return jsNumber(exec, 0);
 }
 
-JSValuePtr CInstance::booleanValue() const
+JSValue CInstance::booleanValue() const
 {
     // FIXME: Implement something sensible.
     return jsBoolean(false);
 }
 
-JSValuePtr CInstance::valueOf(ExecState* exec) const 
+JSValue CInstance::valueOf(ExecState* exec) const 
 {
     return stringValue(exec);
 }
diff --git a/WebCore/bridge/c/c_instance.h b/WebCore/bridge/c/c_instance.h
index ed107e9..f9e9de3 100644
--- a/WebCore/bridge/c/c_instance.h
+++ b/WebCore/bridge/c/c_instance.h
@@ -55,21 +55,21 @@
 
     virtual Class *getClass() const;
 
-    virtual JSValuePtr valueOf(ExecState*) const;
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue valueOf(ExecState*) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual JSValuePtr invokeMethod(ExecState*, const MethodList&, const ArgList&);
+    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
     virtual bool supportsInvokeDefaultMethod() const;
-    virtual JSValuePtr invokeDefaultMethod(ExecState*, const ArgList&);
+    virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&);
 
     virtual bool supportsConstruct() const;
-    virtual JSValuePtr invokeConstruct(ExecState*, const ArgList&);
+    virtual JSValue invokeConstruct(ExecState*, const ArgList&);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
-    JSValuePtr stringValue(ExecState*) const;
-    JSValuePtr numberValue(ExecState*) const;
-    JSValuePtr booleanValue() const;
+    JSValue stringValue(ExecState*) const;
+    JSValue numberValue(ExecState*) const;
+    JSValue booleanValue() const;
 
     NPObject *getObject() const { return _object; }
 
diff --git a/WebCore/bridge/c/c_runtime.cpp b/WebCore/bridge/c/c_runtime.cpp
index 56220ee..9338775 100644
--- a/WebCore/bridge/c/c_runtime.cpp
+++ b/WebCore/bridge/c/c_runtime.cpp
@@ -71,9 +71,9 @@
     throwError(exec, GeneralError, *globalLastException);
     SetGlobalException(0);
 }
-#endif  // ANDROID_NPN_SETEXCEPTION
+#endif // ANDROID_NPN_SETEXCEPTION
 
-JSValuePtr CField::valueFromInstance(ExecState* exec, const Instance* inst) const
+JSValue CField::valueFromInstance(ExecState* exec, const Instance* inst) const
 {
     const CInstance* instance = static_cast<const CInstance*>(inst);
     NPObject* obj = instance->getObject();
@@ -93,7 +93,7 @@
         MoveGlobalExceptionToExecState(exec);
 #endif  // ANDROID_NPN_SETEXCEPTION
         if (result) {
-            JSValuePtr result = convertNPVariantToValue(exec, &property, instance->rootObject());
+            JSValue result = convertNPVariantToValue(exec, &property, instance->rootObject());
             _NPN_ReleaseVariantValue(&property);
             return result;
         }
@@ -101,7 +101,7 @@
     return jsUndefined();
 }
 
-void CField::setValueToInstance(ExecState *exec, const Instance *inst, JSValuePtr aValue) const
+void CField::setValueToInstance(ExecState *exec, const Instance *inst, JSValue aValue) const
 {
     const CInstance* instance = static_cast<const CInstance*>(inst);
     NPObject* obj = instance->getObject();
diff --git a/WebCore/bridge/c/c_runtime.h b/WebCore/bridge/c/c_runtime.h
index 12e3b2e..676d949 100644
--- a/WebCore/bridge/c/c_runtime.h
+++ b/WebCore/bridge/c/c_runtime.h
@@ -38,8 +38,8 @@
 public:
     CField(NPIdentifier ident) : _fieldIdentifier(ident) { }
 
-    virtual JSValuePtr valueFromInstance(ExecState*, const Instance*) const;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValuePtr) const;
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const;
 
     NPIdentifier identifier() const { return _fieldIdentifier; }
 
diff --git a/WebCore/bridge/c/c_utility.cpp b/WebCore/bridge/c/c_utility.cpp
index 352163c..77b5de2 100644
--- a/WebCore/bridge/c/c_utility.cpp
+++ b/WebCore/bridge/c/c_utility.cpp
@@ -66,7 +66,7 @@
 }
 
 // Variant value must be released with NPReleaseVariantValue()
-void convertValueToNPVariant(ExecState* exec, JSValuePtr value, NPVariant* result)
+void convertValueToNPVariant(ExecState* exec, JSValue value, NPVariant* result)
 {
     JSLock lock(false);
 
@@ -105,7 +105,7 @@
     }
 }
 
-JSValuePtr convertNPVariantToValue(ExecState* exec, const NPVariant* variant, RootObject* rootObject)
+JSValue convertNPVariantToValue(ExecState* exec, const NPVariant* variant, RootObject* rootObject)
 {
     JSLock lock(false);
     
diff --git a/WebCore/bridge/c/c_utility.h b/WebCore/bridge/c/c_utility.h
index bd25e80..f69bba6 100644
--- a/WebCore/bridge/c/c_utility.h
+++ b/WebCore/bridge/c/c_utility.h
@@ -47,8 +47,8 @@
 typedef uint16_t NPUTF16;
 
 WebCore::String convertNPStringToUTF16(const NPString *string);
-void convertValueToNPVariant(ExecState*, JSValuePtr, NPVariant* result);
-JSValuePtr convertNPVariantToValue(ExecState*, const NPVariant*, RootObject*);
+void convertValueToNPVariant(ExecState*, JSValue, NPVariant* result);
+JSValue convertNPVariantToValue(ExecState*, const NPVariant*, RootObject*);
 Identifier identifierFromNPIdentifier(const NPUTF8* name);
 
 } }
diff --git a/WebCore/bridge/jni/jni_instance.cpp b/WebCore/bridge/jni/jni_instance.cpp
index 5a819a6..c47bd8b 100644
--- a/WebCore/bridge/jni/jni_instance.cpp
+++ b/WebCore/bridge/jni/jni_instance.cpp
@@ -84,7 +84,7 @@
     return _class;
 }
 
-JSValuePtr JavaInstance::stringValue(ExecState* exec) const
+JSValue JavaInstance::stringValue(ExecState* exec) const
 {
     JSLock lock(false);
     
@@ -96,23 +96,23 @@
     return jsString(exec, u);
 }
 
-JSValuePtr JavaInstance::numberValue(ExecState* exec) const
+JSValue JavaInstance::numberValue(ExecState* exec) const
 {
     jdouble doubleValue = callJNIMethod<jdouble>(_instance->_instance, "doubleValue", "()D");
     return jsNumber(exec, doubleValue);
 }
 
-JSValuePtr JavaInstance::booleanValue() const
+JSValue JavaInstance::booleanValue() const
 {
     jboolean booleanValue = callJNIMethod<jboolean>(_instance->_instance, "booleanValue", "()Z");
     return jsBoolean(booleanValue);
 }
 
-JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &methodList, const ArgList &args)
+JSValue JavaInstance::invokeMethod (ExecState *exec, const MethodList &methodList, const ArgList &args)
 {
     int i, count = args.size();
     jvalue *jArgs;
-    JSValuePtr resultValue;
+    JSValue resultValue;
     Method *method = 0;
     size_t numMethods = methodList.size();
     
@@ -145,8 +145,8 @@
         
     for (i = 0; i < count; i++) {
         JavaParameter* aParameter = jMethod->parameterAt(i);
-        jArgs[i] = convertValueToJValue(exec, args.at(exec, i), aParameter->getJNIType(), aParameter->type());
-        JS_LOG("arg[%d] = %s\n", i, args.at(exec, i).toString(exec).ascii());
+        jArgs[i] = convertValueToJValue(exec, args.at(i), aParameter->getJNIType(), aParameter->type());
+        JS_LOG("arg[%d] = %s\n", i, args.at(i).toString(exec).ascii());
     }
         
     jvalue result;
@@ -161,7 +161,7 @@
     bool handled = false;
     if (rootObject->nativeHandle()) {
         jobject obj = _instance->_instance;
-        JSValuePtr exceptionDescription = noValue();
+        JSValue exceptionDescription;
         const char *callingURL = 0;  // FIXME, need to propagate calling URL to Java
         handled = dispatchJNICall(exec, rootObject->nativeHandle(), obj, jMethod->isStatic(), jMethod->JNIReturnType(), jMethod->methodID(obj), jArgs, result, callingURL, exceptionDescription);
         if (exceptionDescription) {
@@ -287,7 +287,7 @@
     return resultValue;
 }
 
-JSValuePtr JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
         return stringValue(exec);
@@ -303,7 +303,7 @@
     return valueOf(exec);
 }
 
-JSValuePtr JavaInstance::valueOf(ExecState* exec) const 
+JSValue JavaInstance::valueOf(ExecState* exec) const 
 {
     return stringValue(exec);
 }
diff --git a/WebCore/bridge/jni/jni_instance.h b/WebCore/bridge/jni/jni_instance.h
index 551b8e7..96dda7d 100644
--- a/WebCore/bridge/jni/jni_instance.h
+++ b/WebCore/bridge/jni/jni_instance.h
@@ -86,16 +86,16 @@
     
     virtual Class *getClass() const;
     
-    virtual JSValuePtr valueOf(ExecState*) const;
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue valueOf(ExecState*) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual JSValuePtr invokeMethod(ExecState* exec, const MethodList& method, const ArgList& args);
+    virtual JSValue invokeMethod(ExecState* exec, const MethodList& method, const ArgList& args);
 
     jobject javaInstance() const { return _instance->_instance; }
     
-    JSValuePtr stringValue(ExecState*) const;
-    JSValuePtr numberValue(ExecState*) const;
-    JSValuePtr booleanValue() const;
+    JSValue stringValue(ExecState*) const;
+    JSValue numberValue(ExecState*) const;
+    JSValue booleanValue() const;
 
 protected:
     virtual void virtualBegin();
diff --git a/WebCore/bridge/jni/jni_jsobject.h b/WebCore/bridge/jni/jni_jsobject.h
index 4125565..b4f5719 100644
--- a/WebCore/bridge/jni/jni_jsobject.h
+++ b/WebCore/bridge/jni/jni_jsobject.h
@@ -42,6 +42,7 @@
 class ArgList;
 class ExecState;
 class JSObject;
+class MarkedArgumentBuffer;
 
 namespace Bindings {
 
@@ -90,9 +91,9 @@
     
     static jvalue invoke(JSObjectCallContext*);
 
-    jobject convertValueToJObject(JSValuePtr) const;
-    JSValuePtr convertJObjectToValue(ExecState*, jobject) const;
-    void getListFromJArray(ExecState*, jobjectArray, ArgList&) const;
+    jobject convertValueToJObject(JSValue) const;
+    JSValue convertJObjectToValue(ExecState*, jobject) const;
+    void getListFromJArray(ExecState*, jobjectArray, MarkedArgumentBuffer&) const;
     
     RootObject* rootObject() const;
     
diff --git a/WebCore/bridge/jni/jni_jsobject.mm b/WebCore/bridge/jni/jni_jsobject.mm
index 3689840..32d7b0d 100644
--- a/WebCore/bridge/jni/jni_jsobject.mm
+++ b/WebCore/bridge/jni/jni_jsobject.mm
@@ -293,17 +293,17 @@
     JSLock lock(false);
     
     Identifier identifier(exec, JavaString(methodName));
-    JSValuePtr function = _imp->get(exec, identifier);
+    JSValue function = _imp->get(exec, identifier);
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return 0;
 
     // Call the function object.
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     getListFromJArray(exec, args, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    JSValuePtr result = JSC::call(exec, function, callType, callData, _imp, argList);
+    JSValue result = JSC::call(exec, function, callType, callData, _imp, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
 
     return convertValueToJObject(result);
@@ -313,7 +313,7 @@
 {
     JS_LOG ("script = %s\n", JavaString(script).UTF8String());
     
-    JSValuePtr result;
+    JSValue result;
 
     JSLock lock(false);
     
@@ -347,7 +347,7 @@
     ExecState* exec = rootObject->globalObject()->globalExec();
     
     JSLock lock(false);
-    JSValuePtr result = _imp->get(exec, Identifier(exec, JavaString(memberName)));
+    JSValue result = _imp->get(exec, Identifier(exec, JavaString(memberName)));
 
     return convertValueToJObject(result);
 }
@@ -397,7 +397,7 @@
     ExecState* exec = rootObject->globalObject()->globalExec();
 
     JSLock lock(false);
-    JSValuePtr result = _imp->get(exec, index);
+    JSValue result = _imp->get(exec, index);
 
     return convertValueToJObject(result);
 }
@@ -485,7 +485,7 @@
     return nativeHandle;
 }
 
-jobject JavaJSObject::convertValueToJObject(JSValuePtr value) const
+jobject JavaJSObject::convertValueToJObject(JSValue value) const
 {
     JSLock lock(false);
     
@@ -571,7 +571,7 @@
     return result;
 }
 
-JSValuePtr JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObject) const
+JSValue JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObject) const
 {
     // Instances of netscape.javascript.JSObject get converted back to
     // JavaScript objects.  All other objects are wrapped.  It's not
@@ -605,7 +605,7 @@
     return JavaInstance::create(theObject, _rootObject)->createRuntimeObject(exec);
 }
 
-void JavaJSObject::getListFromJArray(ExecState* exec, jobjectArray jArray, ArgList& list) const
+void JavaJSObject::getListFromJArray(ExecState* exec, jobjectArray jArray, MarkedArgumentBuffer& list) const
 {
     JNIEnv *env = getJNIEnv();
     int numObjects = jArray ? env->GetArrayLength(jArray) : 0;
diff --git a/WebCore/bridge/jni/jni_objc.mm b/WebCore/bridge/jni/jni_objc.mm
index 232d9e9..7c19442 100644
--- a/WebCore/bridge/jni/jni_objc.mm
+++ b/WebCore/bridge/jni/jni_objc.mm
@@ -45,7 +45,7 @@
        exceptionDescription:(NSString **)exceptionString;
 @end
 
-bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue &result, const char*, JSValuePtr& exceptionDescription)
+bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue &result, const char*, JSValue& exceptionDescription)
 {
     id view = (id)targetAppletView;
     
diff --git a/WebCore/bridge/jni/jni_runtime.cpp b/WebCore/bridge/jni/jni_runtime.cpp
index 38d6d6c..9d06a8c 100644
--- a/WebCore/bridge/jni/jni_runtime.cpp
+++ b/WebCore/bridge/jni/jni_runtime.cpp
@@ -70,7 +70,7 @@
     _field = new JObjectWrapper(aField);
 }
 
-JSValuePtr JavaArray::convertJObjectToArray(ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject> rootObject)
+JSValue JavaArray::convertJObjectToArray(ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject> rootObject)
 {
     if (type[0] != '[')
         return jsUndefined();
@@ -93,7 +93,7 @@
         {
             RootObject* rootObject = instance->rootObject();
             if (rootObject && rootObject->nativeHandle()) {
-                JSValuePtr exceptionDescription = noValue();
+                JSValue exceptionDescription;
                 jvalue args[1];
                 
                 args[0].l = jinstance;
@@ -106,11 +106,11 @@
     return result;
 }
 
-JSValuePtr JavaField::valueFromInstance(ExecState* exec, const Instance* i) const 
+JSValue JavaField::valueFromInstance(ExecState* exec, const Instance* i) const 
 {
     const JavaInstance *instance = static_cast<const JavaInstance *>(i);
 
-    JSValuePtr jsresult = jsUndefined();
+    JSValue jsresult = jsUndefined();
     
     switch (_JNIType) {
         case array_type:
@@ -175,7 +175,7 @@
         {
             RootObject* rootObject = instance->rootObject();
             if (rootObject && rootObject->nativeHandle()) {
-                JSValuePtr exceptionDescription = noValue();
+                JSValue exceptionDescription;
                 jvalue args[2];
                 jvalue result;
                 
@@ -189,7 +189,7 @@
     }
 }
 
-void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValuePtr aValue) const
+void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValue aValue) const
 {
     const JavaInstance *instance = static_cast<const JavaInstance *>(i);
     jvalue javaValue = convertValueToJValue (exec, aValue, _JNIType, type());
@@ -389,7 +389,7 @@
     return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
 }
 
-void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValuePtr aValue) const
+void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
 {
     JNIEnv *env = getJNIEnv();
     char *javaClassName = 0;
@@ -457,7 +457,7 @@
 }
 
 
-JSValuePtr JavaArray::valueAt(ExecState* exec, unsigned index) const
+JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
 {
     JNIEnv *env = getJNIEnv();
     JNIType arrayType = JNITypeFromPrimitiveType(_type[1]);
diff --git a/WebCore/bridge/jni/jni_runtime.h b/WebCore/bridge/jni/jni_runtime.h
index 3697f2b..f3cbf2b 100644
--- a/WebCore/bridge/jni/jni_runtime.h
+++ b/WebCore/bridge/jni/jni_runtime.h
@@ -112,8 +112,8 @@
 public:
     JavaField (JNIEnv *env, jobject aField);
 
-    virtual JSValuePtr valueFromInstance(ExecState *exec, const Instance *instance) const;
-    virtual void setValueToInstance(ExecState *exec, const Instance *instance, JSValuePtr aValue) const;
+    virtual JSValue valueFromInstance(ExecState *exec, const Instance *instance) const;
+    virtual void setValueToInstance(ExecState *exec, const Instance *instance, JSValue aValue) const;
     
     UString::Rep* name() const { return ((UString)_name).rep(); }
     virtual RuntimeType type() const { return _type.UTF8String(); }
@@ -168,13 +168,13 @@
 
     RootObject* rootObject() const;
 
-    virtual void setValueAt(ExecState *exec, unsigned int index, JSValuePtr aValue) const;
-    virtual JSValuePtr valueAt(ExecState *exec, unsigned int index) const;
+    virtual void setValueAt(ExecState *exec, unsigned int index, JSValue aValue) const;
+    virtual JSValue valueAt(ExecState *exec, unsigned int index) const;
     virtual unsigned int getLength() const;
     
     jobject javaArray() const { return _array->_instance; }
 
-    static JSValuePtr convertJObjectToArray (ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject>);
+    static JSValue convertJObjectToArray (ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject>);
 
 private:
     RefPtr<JObjectWrapper> _array;
diff --git a/WebCore/bridge/jni/jni_utility.cpp b/WebCore/bridge/jni/jni_utility.cpp
index a1f4a2d..31cdfea 100644
--- a/WebCore/bridge/jni/jni_utility.cpp
+++ b/WebCore/bridge/jni/jni_utility.cpp
@@ -369,7 +369,7 @@
                 env->FindClass("java/lang/String"),
                 env->NewStringUTF(""));
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
+                JSValue item = jsArray->get(exec, i);
                 UString stringValue = item.toString(exec);
                 env->SetObjectArrayElement(jarray,i,
                     env->functions->NewString(env, (const jchar *)stringValue.data(), stringValue.size()));
@@ -381,7 +381,7 @@
         case boolean_type: {
             jarray = (jobjectArray)env->NewBooleanArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
+                JSValue item = jsArray->get(exec, i);
                 jboolean value = (jboolean)item.toNumber(exec);
                 env->SetBooleanArrayRegion((jbooleanArray)jarray, (jsize)i, (jsize)1, &value);
             }
@@ -391,7 +391,7 @@
         case byte_type: {
             jarray = (jobjectArray)env->NewByteArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
+                JSValue item = jsArray->get(exec, i);
                 jbyte value = (jbyte)item.toNumber(exec);
                 env->SetByteArrayRegion((jbyteArray)jarray, (jsize)i, (jsize)1, &value);
             }
@@ -401,7 +401,7 @@
         case char_type: {
             jarray = (jobjectArray)env->NewCharArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
+                JSValue item = jsArray->get(exec, i);
                 UString stringValue = item.toString(exec);
                 jchar value = 0;
                 if (stringValue.size() > 0)
@@ -414,7 +414,7 @@
         case short_type: {
             jarray = (jobjectArray)env->NewShortArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
+                JSValue item = jsArray->get(exec, i);
                 jshort value = (jshort)item.toNumber(exec);
                 env->SetShortArrayRegion((jshortArray)jarray, (jsize)i, (jsize)1, &value);
             }
@@ -424,7 +424,7 @@
         case int_type: {
             jarray = (jobjectArray)env->NewIntArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
+                JSValue item = jsArray->get(exec, i);
                 jint value = (jint)item.toNumber(exec);
                 env->SetIntArrayRegion((jintArray)jarray, (jsize)i, (jsize)1, &value);
             }
@@ -434,7 +434,7 @@
         case long_type: {
             jarray = (jobjectArray)env->NewLongArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
+                JSValue item = jsArray->get(exec, i);
                 jlong value = (jlong)item.toNumber(exec);
                 env->SetLongArrayRegion((jlongArray)jarray, (jsize)i, (jsize)1, &value);
             }
@@ -444,7 +444,7 @@
         case float_type: {
             jarray = (jobjectArray)env->NewFloatArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
+                JSValue item = jsArray->get(exec, i);
                 jfloat value = (jfloat)item.toNumber(exec);
                 env->SetFloatArrayRegion((jfloatArray)jarray, (jsize)i, (jsize)1, &value);
             }
@@ -454,7 +454,7 @@
         case double_type: {
             jarray = (jobjectArray)env->NewDoubleArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
+                JSValue item = jsArray->get(exec, i);
                 jdouble value = (jdouble)item.toNumber(exec);
                 env->SetDoubleArrayRegion((jdoubleArray)jarray, (jsize)i, (jsize)1, &value);
             }
@@ -472,7 +472,7 @@
 }
 
 
-jvalue convertValueToJValue(ExecState* exec, JSValuePtr value, JNIType _JNIType, const char* javaClassName)
+jvalue convertValueToJValue(ExecState* exec, JSValue value, JNIType _JNIType, const char* javaClassName)
 {
     JSLock lock(false);
     
diff --git a/WebCore/bridge/jni/jni_utility.h b/WebCore/bridge/jni/jni_utility.h
index 4330b1e..90e7fe5 100644
--- a/WebCore/bridge/jni/jni_utility.h
+++ b/WebCore/bridge/jni/jni_utility.h
@@ -77,7 +77,7 @@
 const char *signatureFromPrimitiveType(JNIType type);
 
 #if USE(JSC)
-jvalue convertValueToJValue(ExecState*, JSValuePtr, JNIType, const char* javaClassName);
+jvalue convertValueToJValue(ExecState*, JSValue, JNIType, const char* javaClassName);
 #endif
 
 jvalue getJNIField(jobject obj, JNIType type, const char *name, const char *signature);
@@ -285,10 +285,16 @@
     
     return result;
 }
+#ifdef MANUAL_MERGE_REQUIRED
 
 #if USE(JSC)
 bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValuePtr& exceptionDescription);
 #endif
+#else // MANUAL_MERGE_REQUIRED
+    
+bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription);
+
+#endif // MANUAL_MERGE_REQUIRED
 } // namespace Bindings
 
 } // namespace JSC
diff --git a/WebCore/bridge/npapi.h b/WebCore/bridge/npapi.h
index 43b701b..d436565 100644
--- a/WebCore/bridge/npapi.h
+++ b/WebCore/bridge/npapi.h
@@ -494,6 +494,8 @@
             uint16 keyCode;
         } key;
         struct {
+            CGContextRef context;
+
             double x;
             double y;
             double width;
@@ -557,6 +559,14 @@
 typedef void * NPMenu;
 #endif
 
+typedef enum {
+    NPCoordinateSpacePlugin = 1,
+    NPCoordinateSpaceWindow,
+    NPCoordinateSpaceFlippedWindow,
+    NPCoordinateSpaceScreen,
+    NPCoordinateSpaceFlippedScreen
+} NPCoordinateSpace;
+
 #if defined(XP_MAC) || defined(XP_MACOSX)
 
 #ifndef NP_NO_CARBON
@@ -842,10 +852,14 @@
 void        NPN_PushPopupsEnabledState(NPP instance, NPBool enabled);
 void        NPN_PopPopupsEnabledState(NPP instance);
 void        NPN_PluginThreadAsyncCall(NPP instance, void (*func) (void *), void *userData);
+NPError     NPN_GetValueForURL(NPP instance, NPNURLVariable variable, const char* url, char** value, uint32* len);
+NPError     NPN_SetValueForURL(NPP instance, NPNURLVariable variable, const char* url, const char* value, uint32 len);
+NPError     NPN_GetAuthenticationInfo(NPP instance, const char* protocol, const char* host, int32 port, const char* scheme, const char *realm, char** username, uint32* ulen, char** password, uint32* plen);
 uint32      NPN_ScheduleTimer(NPP instance, uint32 interval, NPBool repeat, void (*timerFunc)(NPP npp, uint32 timerID));
 void        NPN_UnscheduleTimer(NPP instance, uint32 timerID);
 NPError     NPN_PopUpContextMenu(NPP instance, NPMenu* menu);
-
+NPBool      NPN_ConvertPoint(NPP instance, double sourceX, double sourceY, NPCoordinateSpace sourceSpace, double *destX, double *destY, NPCoordinateSpace destSpace);
+    
 #ifdef __cplusplus
 }  /* end extern "C" */
 #endif
diff --git a/WebCore/bridge/objc/WebScriptObject.h b/WebCore/bridge/objc/WebScriptObject.h
index 7942635..6d9ff2c 100644
--- a/WebCore/bridge/objc/WebScriptObject.h
+++ b/WebCore/bridge/objc/WebScriptObject.h
@@ -34,7 +34,7 @@
 + (NSString *)webScriptNameForKey:(const char *)name;
 + (BOOL)isKeyExcludedFromWebScript:(const char *)name;
 
-+ (id)_convertValueToObjcValue:(JSC::JSValuePtr)value originRootObject:(JSC::Bindings::RootObject*)originRootObject rootObject:(JSC::Bindings::RootObject*)rootObject;
++ (id)_convertValueToObjcValue:(JSC::JSValue)value originRootObject:(JSC::Bindings::RootObject*)originRootObject rootObject:(JSC::Bindings::RootObject*)rootObject;
 - _initWithJSObject:(JSC::JSObject*)imp originRootObject:(PassRefPtr<JSC::Bindings::RootObject>)originRootObject rootObject:(PassRefPtr<JSC::Bindings::RootObject>)rootObject;
 - (JSC::JSObject *)_imp;
 @end
diff --git a/WebCore/bridge/objc/objc_class.h b/WebCore/bridge/objc/objc_class.h
index 3735680..eebfd2a 100644
--- a/WebCore/bridge/objc/objc_class.h
+++ b/WebCore/bridge/objc/objc_class.h
@@ -43,7 +43,7 @@
     virtual MethodList methodsNamed(const Identifier&, Instance *instance) const;
     virtual Field *fieldNamed(const Identifier&, Instance *instance) const;
 
-    virtual JSValuePtr fallbackObject(ExecState *exec, Instance *instance, const Identifier &propertyName);
+    virtual JSValue fallbackObject(ExecState *exec, Instance *instance, const Identifier &propertyName);
     
     ClassStructPtr isa() { return _isa; }
     
diff --git a/WebCore/bridge/objc/objc_class.mm b/WebCore/bridge/objc/objc_class.mm
index e3bde0a..5f3677e 100644
--- a/WebCore/bridge/objc/objc_class.mm
+++ b/WebCore/bridge/objc/objc_class.mm
@@ -239,7 +239,7 @@
     return aField;
 }
 
-JSValuePtr ObjcClass::fallbackObject(ExecState* exec, Instance* instance, const Identifier &propertyName)
+JSValue ObjcClass::fallbackObject(ExecState* exec, Instance* instance, const Identifier &propertyName)
 {
     ObjcInstance* objcInstance = static_cast<ObjcInstance*>(instance);
     id targetObject = objcInstance->getObject();
diff --git a/WebCore/bridge/objc/objc_instance.h b/WebCore/bridge/objc/objc_instance.h
index 1b7e184..6f1eb0d 100644
--- a/WebCore/bridge/objc/objc_instance.h
+++ b/WebCore/bridge/objc/objc_instance.h
@@ -48,21 +48,21 @@
     
     virtual Class *getClass() const;
         
-    virtual JSValuePtr valueOf(ExecState*) const;
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue valueOf(ExecState*) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
     
-    virtual JSValuePtr invokeMethod(ExecState*, const MethodList&, const ArgList&);
+    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
     virtual bool supportsInvokeDefaultMethod() const;
-    virtual JSValuePtr invokeDefaultMethod(ExecState*, const ArgList&);
+    virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&);
 
-    JSValuePtr getValueOfUndefinedField(ExecState*, const Identifier&) const;
-    virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValuePtr);
+    JSValue getValueOfUndefinedField(ExecState*, const Identifier&) const;
+    virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue);
 
     ObjectStructPtr getObject() const { return _instance.get(); }
     
-    JSValuePtr stringValue(ExecState*) const;
-    JSValuePtr numberValue(ExecState*) const;
-    JSValuePtr booleanValue() const;
+    JSValue stringValue(ExecState*) const;
+    JSValue numberValue(ExecState*) const;
+    JSValue booleanValue() const;
 
 protected:
     virtual void virtualBegin();
diff --git a/WebCore/bridge/objc/objc_instance.mm b/WebCore/bridge/objc/objc_instance.mm
index 54af18c..094ed78 100644
--- a/WebCore/bridge/objc/objc_instance.mm
+++ b/WebCore/bridge/objc/objc_instance.mm
@@ -124,9 +124,9 @@
     return [_instance.get() respondsToSelector:@selector(invokeDefaultMethodWithArguments:)];
 }
 
-JSValuePtr ObjcInstance::invokeMethod(ExecState* exec, const MethodList &methodList, const ArgList &args)
+JSValue ObjcInstance::invokeMethod(ExecState* exec, const MethodList &methodList, const ArgList &args)
 {
-    JSValuePtr result = jsUndefined();
+    JSValue result = jsUndefined();
     
     JSLock::DropAllLocks dropAllLocks(false); // Can't put this inside the @try scope because it unwinds incorrectly.
 
@@ -158,7 +158,7 @@
         NSMutableArray* objcArgs = [NSMutableArray array];
         int count = args.size();
         for (int i = 0; i < count; i++) {
-            ObjcValue value = convertValueToObjcValue(exec, args.at(exec, i), ObjcObjectType);
+            ObjcValue value = convertValueToObjcValue(exec, args.at(i), ObjcObjectType);
             [objcArgs addObject:value.objectValue];
         }
         [invocation setArgument:&objcArgs atIndex:3];
@@ -173,7 +173,7 @@
             // types.
             ASSERT(objcValueType != ObjcInvalidType && objcValueType != ObjcVoidType);
 
-            ObjcValue value = convertValueToObjcValue(exec, args.at(exec, i-2), objcValueType);
+            ObjcValue value = convertValueToObjcValue(exec, args.at(i-2), objcValueType);
 
             switch (objcValueType) {
                 case ObjcObjectType:
@@ -242,12 +242,12 @@
 
     // Work around problem in some versions of GCC where result gets marked volatile and
     // it can't handle copying from a volatile to non-volatile.
-    return const_cast<JSValuePtr&>(result);
+    return const_cast<JSValue&>(result);
 }
 
-JSValuePtr ObjcInstance::invokeDefaultMethod(ExecState* exec, const ArgList &args)
+JSValue ObjcInstance::invokeDefaultMethod(ExecState* exec, const ArgList &args)
 {
-    JSValuePtr result = jsUndefined();
+    JSValue result = jsUndefined();
 
     JSLock::DropAllLocks dropAllLocks(false); // Can't put this inside the @try scope because it unwinds incorrectly.
     setGlobalException(nil);
@@ -269,7 +269,7 @@
     NSMutableArray* objcArgs = [NSMutableArray array];
     unsigned count = args.size();
     for (unsigned i = 0; i < count; i++) {
-        ObjcValue value = convertValueToObjcValue(exec, args.at(exec, i), ObjcObjectType);
+        ObjcValue value = convertValueToObjcValue(exec, args.at(i), ObjcObjectType);
         [objcArgs addObject:value.objectValue];
     }
     [invocation setArgument:&objcArgs atIndex:2];
@@ -293,10 +293,10 @@
 
     // Work around problem in some versions of GCC where result gets marked volatile and
     // it can't handle copying from a volatile to non-volatile.
-    return const_cast<JSValuePtr&>(result);
+    return const_cast<JSValue&>(result);
 }
 
-bool ObjcInstance::setValueOfUndefinedField(ExecState* exec, const Identifier& property, JSValuePtr aValue)
+bool ObjcInstance::setValueOfUndefinedField(ExecState* exec, const Identifier& property, JSValue aValue)
 {
     id targetObject = getObject();
     if (![targetObject respondsToSelector:@selector(setValue:forUndefinedKey:)])
@@ -324,9 +324,9 @@
     return true;
 }
 
-JSValuePtr ObjcInstance::getValueOfUndefinedField(ExecState* exec, const Identifier& property) const
+JSValue ObjcInstance::getValueOfUndefinedField(ExecState* exec, const Identifier& property) const
 {
-    JSValuePtr result = jsUndefined();
+    JSValue result = jsUndefined();
     
     id targetObject = getObject();
 
@@ -350,10 +350,10 @@
 
     // Work around problem in some versions of GCC where result gets marked volatile and
     // it can't handle copying from a volatile to non-volatile.
-    return const_cast<JSValuePtr&>(result);
+    return const_cast<JSValue&>(result);
 }
 
-JSValuePtr ObjcInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue ObjcInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
         return stringValue(exec);
@@ -366,24 +366,24 @@
     return valueOf(exec);
 }
 
-JSValuePtr ObjcInstance::stringValue(ExecState* exec) const
+JSValue ObjcInstance::stringValue(ExecState* exec) const
 {
     return convertNSStringToString(exec, [getObject() description]);
 }
 
-JSValuePtr ObjcInstance::numberValue(ExecState* exec) const
+JSValue ObjcInstance::numberValue(ExecState* exec) const
 {
     // FIXME:  Implement something sensible
     return jsNumber(exec, 0);
 }
 
-JSValuePtr ObjcInstance::booleanValue() const
+JSValue ObjcInstance::booleanValue() const
 {
     // FIXME:  Implement something sensible
     return jsBoolean(false);
 }
 
-JSValuePtr ObjcInstance::valueOf(ExecState* exec) const 
+JSValue ObjcInstance::valueOf(ExecState* exec) const 
 {
     return stringValue(exec);
 }
diff --git a/WebCore/bridge/objc/objc_runtime.h b/WebCore/bridge/objc/objc_runtime.h
index 5ed6d2a..82d563b 100644
--- a/WebCore/bridge/objc/objc_runtime.h
+++ b/WebCore/bridge/objc/objc_runtime.h
@@ -44,8 +44,8 @@
     ObjcField(IvarStructPtr);
     ObjcField(CFStringRef name);
     
-    virtual JSValuePtr valueFromInstance(ExecState*, const Instance*) const;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValuePtr) const;
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const;
 
 private:
     IvarStructPtr _ivar;
@@ -77,13 +77,13 @@
 public:
     ObjcArray(ObjectStructPtr, PassRefPtr<RootObject>);
 
-    virtual void setValueAt(ExecState *exec, unsigned int index, JSValuePtr aValue) const;
-    virtual JSValuePtr valueAt(ExecState *exec, unsigned int index) const;
+    virtual void setValueAt(ExecState *exec, unsigned int index, JSValue aValue) const;
+    virtual JSValue valueAt(ExecState *exec, unsigned int index) const;
     virtual unsigned int getLength() const;
     
     ObjectStructPtr getObjcArray() const { return _array.get(); }
 
-    static JSValuePtr convertObjcArrayToArray(ExecState *exec, ObjectStructPtr anObject);
+    static JSValue convertObjcArrayToArray(ExecState *exec, ObjectStructPtr anObject);
 
 private:
     RetainPtr<ObjectStructPtr> _array;
@@ -97,22 +97,22 @@
 
     const Identifier& propertyName() const { return _item; }
 
-    static ObjectPrototype* createPrototype(ExecState* exec)
+    static ObjectPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->objectPrototype();
+        return globalObject->objectPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType));
     }
 
 private:
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-    virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+    virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
     virtual CallType getCallData(CallData&);
     virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
     virtual bool toBoolean(ExecState*) const;
 
diff --git a/WebCore/bridge/objc/objc_runtime.mm b/WebCore/bridge/objc/objc_runtime.mm
index 61ec6ed..4169517 100644
--- a/WebCore/bridge/objc/objc_runtime.mm
+++ b/WebCore/bridge/objc/objc_runtime.mm
@@ -90,9 +90,9 @@
 {
 }
 
-JSValuePtr ObjcField::valueFromInstance(ExecState* exec, const Instance* instance) const
+JSValue ObjcField::valueFromInstance(ExecState* exec, const Instance* instance) const
 {
-    JSValuePtr result = jsUndefined();
+    JSValue result = jsUndefined();
     
     id targetObject = (static_cast<const ObjcInstance*>(instance))->getObject();
 
@@ -109,10 +109,10 @@
 
     // Work around problem in some versions of GCC where result gets marked volatile and
     // it can't handle copying from a volatile to non-volatile.
-    return const_cast<JSValuePtr&>(result);
+    return const_cast<JSValue&>(result);
 }
 
-static id convertValueToObjcObject(ExecState* exec, JSValuePtr value)
+static id convertValueToObjcObject(ExecState* exec, JSValue value)
 {
     RefPtr<RootObject> rootObject = findRootObject(exec->dynamicGlobalObject());
     if (!rootObject)
@@ -120,7 +120,7 @@
     return [webScriptObjectClass() _convertValueToObjcValue:value originRootObject:rootObject.get() rootObject:rootObject.get()];
 }
 
-void ObjcField::setValueToInstance(ExecState* exec, const Instance* instance, JSValuePtr aValue) const
+void ObjcField::setValueToInstance(ExecState* exec, const Instance* instance, JSValue aValue) const
 {
     id targetObject = (static_cast<const ObjcInstance*>(instance))->getObject();
     id value = convertValueToObjcObject(exec, aValue);
@@ -144,7 +144,7 @@
 {
 }
 
-void ObjcArray::setValueAt(ExecState* exec, unsigned int index, JSValuePtr aValue) const
+void ObjcArray::setValueAt(ExecState* exec, unsigned int index, JSValue aValue) const
 {
     if (![_array.get() respondsToSelector:@selector(insertObject:atIndex:)]) {
         throwError(exec, TypeError, "Array is not mutable.");
@@ -167,7 +167,7 @@
     }
 }
 
-JSValuePtr ObjcArray::valueAt(ExecState* exec, unsigned int index) const
+JSValue ObjcArray::valueAt(ExecState* exec, unsigned int index) const
 {
     if (index > [_array.get() count])
         return throwError(exec, RangeError, "Index exceeds array size.");
@@ -202,16 +202,16 @@
     return true;
 }
 
-void ObjcFallbackObjectImp::put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&)
+void ObjcFallbackObjectImp::put(ExecState*, const Identifier&, JSValue, PutPropertySlot&)
 {
 }
 
-static JSValuePtr callObjCFallbackObject(ExecState* exec, JSObject* function, JSValuePtr thisValue, const ArgList& args)
+static JSValue JSC_HOST_CALL callObjCFallbackObject(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     if (!thisValue.isObject(&RuntimeObjectImp::s_info))
         return throwError(exec, TypeError);
 
-    JSValuePtr result = jsUndefined();
+    JSValue result = jsUndefined();
 
     RuntimeObjectImp* imp = static_cast<RuntimeObjectImp*>(asObject(thisValue));
     Instance* instance = imp->getInternalInstance();
@@ -254,7 +254,7 @@
     return false;
 }
 
-JSValuePtr ObjcFallbackObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType) const
+JSValue ObjcFallbackObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType) const
 {
     return _instance->getValueOfUndefinedField(exec, _item);
 }
diff --git a/WebCore/bridge/objc/objc_utility.h b/WebCore/bridge/objc/objc_utility.h
index 35787ea..c34be2a 100644
--- a/WebCore/bridge/objc/objc_utility.h
+++ b/WebCore/bridge/objc/objc_utility.h
@@ -73,9 +73,9 @@
 
 class RootObject;
 
-ObjcValue convertValueToObjcValue(ExecState*, JSValuePtr, ObjcValueType);
-JSValuePtr convertNSStringToString(ExecState* exec, NSString *nsstring);
-JSValuePtr convertObjcValueToValue(ExecState*, void* buffer, ObjcValueType, RootObject*);
+ObjcValue convertValueToObjcValue(ExecState*, JSValue, ObjcValueType);
+JSValue convertNSStringToString(ExecState* exec, NSString *nsstring);
+JSValue convertObjcValueToValue(ExecState*, void* buffer, ObjcValueType, RootObject*);
 ObjcValueType objcValueTypeForType(const char *type);
 
 bool convertJSMethodNameToObjc(const char *JSName, char *buffer, size_t bufferSize);
diff --git a/WebCore/bridge/objc/objc_utility.mm b/WebCore/bridge/objc/objc_utility.mm
index dbf8c56..501131d 100644
--- a/WebCore/bridge/objc/objc_utility.mm
+++ b/WebCore/bridge/objc/objc_utility.mm
@@ -126,7 +126,7 @@
     [], other       exception
 
 */
-ObjcValue convertValueToObjcValue(ExecState* exec, JSValuePtr value, ObjcValueType type)
+ObjcValue convertValueToObjcValue(ExecState* exec, JSValue value, ObjcValueType type)
 {
     ObjcValue result;
     double d = 0;
@@ -194,7 +194,7 @@
     return result;
 }
 
-JSValuePtr convertNSStringToString(ExecState* exec, NSString *nsstring)
+JSValue convertNSStringToString(ExecState* exec, NSString *nsstring)
 {
     JSLock lock(false);
     
@@ -203,7 +203,7 @@
     chars = (unichar *)malloc(sizeof(unichar)*length);
     [nsstring getCharacters:chars];
     UString u((const UChar*)chars, length);
-    JSValuePtr aValue = jsString(exec, u);
+    JSValue aValue = jsString(exec, u);
     free((void *)chars);
     return aValue;
 }
@@ -226,7 +226,7 @@
     id              object wrapper
     other           should not happen
 */
-JSValuePtr convertObjcValueToValue(ExecState* exec, void* buffer, ObjcValueType type, RootObject* rootObject)
+JSValue convertObjcValueToValue(ExecState* exec, void* buffer, ObjcValueType type, RootObject* rootObject)
 {
     JSLock lock(false);
     
diff --git a/WebCore/bridge/qt/qt_class.cpp b/WebCore/bridge/qt/qt_class.cpp
index 3aa218c..c39b3af 100644
--- a/WebCore/bridge/qt/qt_class.cpp
+++ b/WebCore/bridge/qt/qt_class.cpp
@@ -66,7 +66,7 @@
 // and not get wrapped in RuntimeMethod). Also, use this for methods,
 // so we can cache the object and return the same object for the same
 // identifier.
-JSValuePtr QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifier& identifier)
+JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifier& identifier)
 {
     QtInstance* qtinst = static_cast<QtInstance*>(inst);
 
diff --git a/WebCore/bridge/qt/qt_class.h b/WebCore/bridge/qt/qt_class.h
index c83bb0f..19d4207 100644
--- a/WebCore/bridge/qt/qt_class.h
+++ b/WebCore/bridge/qt/qt_class.h
@@ -45,7 +45,7 @@
     virtual MethodList methodsNamed(const Identifier&, Instance*) const;
     virtual Field* fieldNamed(const Identifier&, Instance*) const;
 
-    virtual JSValuePtr fallbackObject(ExecState*, Instance*, const Identifier&);
+    virtual JSValue fallbackObject(ExecState*, Instance*, const Identifier&);
 
 private:
     QtClass(const QtClass&); // prohibit copying
diff --git a/WebCore/bridge/qt/qt_instance.cpp b/WebCore/bridge/qt/qt_instance.cpp
index d2a9cc6..60cf16f 100644
--- a/WebCore/bridge/qt/qt_instance.cpp
+++ b/WebCore/bridge/qt/qt_instance.cpp
@@ -158,7 +158,7 @@
     return object->JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void QtInstance::put(JSObject* object, ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void QtInstance::put(JSObject* object, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     object->JSObject::put(exec, propertyName, value, slot);
 }
@@ -199,7 +199,7 @@
         if (val && !val->marked())
             val->mark();
     }
-    foreach(JSValuePtr val, m_children.values()) {
+    foreach(JSValue val, m_children.values()) {
         if (val && !val.marked())
             val.mark();
     }
@@ -247,14 +247,14 @@
     }
 }
 
-JSValuePtr QtInstance::invokeMethod(ExecState*, const MethodList&, const ArgList&)
+JSValue QtInstance::invokeMethod(ExecState*, const MethodList&, const ArgList&)
 {
     // Implemented via fallbackMethod & QtRuntimeMetaMethod::callAsFunction
     return jsUndefined();
 }
 
 
-JSValuePtr QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
         return stringValue(exec);
@@ -263,7 +263,7 @@
     return valueOf(exec);
 }
 
-JSValuePtr QtInstance::stringValue(ExecState* exec) const
+JSValue QtInstance::stringValue(ExecState* exec) const
 {
     // Hmm.. see if there is a toString defined
     QByteArray buf;
@@ -307,25 +307,25 @@
     return jsString(exec, buf.constData());
 }
 
-JSValuePtr QtInstance::numberValue(ExecState* exec) const
+JSValue QtInstance::numberValue(ExecState* exec) const
 {
     return jsNumber(exec, 0);
 }
 
-JSValuePtr QtInstance::booleanValue() const
+JSValue QtInstance::booleanValue() const
 {
     // ECMA 9.2
     return jsBoolean(true);
 }
 
-JSValuePtr QtInstance::valueOf(ExecState* exec) const
+JSValue QtInstance::valueOf(ExecState* exec) const
 {
     return stringValue(exec);
 }
 
 // In qt_runtime.cpp
-JSValuePtr convertQVariantToValue(ExecState*, PassRefPtr<RootObject> root, const QVariant& variant);
-QVariant convertValueToQVariant(ExecState*, JSValuePtr, QMetaType::Type hint, int *distance);
+JSValue convertQVariantToValue(ExecState*, PassRefPtr<RootObject> root, const QVariant& variant);
+QVariant convertValueToQVariant(ExecState*, JSValue, QMetaType::Type hint, int *distance);
 
 const char* QtField::name() const
 {
@@ -338,7 +338,7 @@
     return ""; // deleted child object
 }
 
-JSValuePtr QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
+JSValue QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
 {
     const QtInstance* instance = static_cast<const QtInstance*>(inst);
     QObject* obj = instance->getObject();
@@ -355,7 +355,7 @@
         else if (m_type == DynamicProperty)
             val = obj->property(m_dynamicProperty);
 
-        JSValuePtr ret = convertQVariantToValue(exec, inst->rootObject(), val);
+        JSValue ret = convertQVariantToValue(exec, inst->rootObject(), val);
 
         // Need to save children so we can mark them
         if (m_type == ChildObject)
@@ -368,7 +368,7 @@
     }
 }
 
-void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValuePtr aValue) const
+void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValue aValue) const
 {
     if (m_type == ChildObject) // QtScript doesn't allow setting to a named child
         return;
diff --git a/WebCore/bridge/qt/qt_instance.h b/WebCore/bridge/qt/qt_instance.h
index 526adb4..590fadf 100644
--- a/WebCore/bridge/qt/qt_instance.h
+++ b/WebCore/bridge/qt/qt_instance.h
@@ -45,25 +45,25 @@
     virtual void begin();
     virtual void end();
 
-    virtual JSValuePtr valueOf(ExecState*) const;
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue valueOf(ExecState*) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
     virtual void mark(); // This isn't inherited
 
-    virtual JSValuePtr invokeMethod(ExecState*, const MethodList&, const ArgList&);
+    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
-    JSValuePtr stringValue(ExecState* exec) const;
-    JSValuePtr numberValue(ExecState* exec) const;
-    JSValuePtr booleanValue() const;
+    JSValue stringValue(ExecState* exec) const;
+    JSValue numberValue(ExecState* exec) const;
+    JSValue booleanValue() const;
 
     QObject* getObject() const { return m_object; }
 
     static PassRefPtr<QtInstance> getQtInstance(QObject*, PassRefPtr<RootObject>, QScriptEngine::ValueOwnership ownership);
 
     virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&);
-    virtual void put(JSObject*, ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
+    virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
     static QtInstance* getInstance(JSObject*);
 
@@ -81,7 +81,7 @@
     QObject* m_hashkey;
     mutable QHash<QByteArray, JSObject*> m_methods;
     mutable QHash<QString, QtField*> m_fields;
-    mutable QSet<JSValuePtr> m_children;
+    mutable QSet<JSValue> m_children;
     mutable QtRuntimeMetaMethod* m_defaultMethod;
     QScriptEngine::ValueOwnership m_ownership;
 };
diff --git a/WebCore/bridge/qt/qt_runtime.cpp b/WebCore/bridge/qt/qt_runtime.cpp
index 31b343e..161e570 100644
--- a/WebCore/bridge/qt/qt_runtime.cpp
+++ b/WebCore/bridge/qt/qt_runtime.cpp
@@ -113,7 +113,7 @@
 }
 #endif
 
-static JSRealType valueRealType(ExecState* exec, JSValuePtr val)
+static JSRealType valueRealType(ExecState* exec, JSValue val)
 {
     if (val.isNumber())
         return Number;
@@ -143,8 +143,11 @@
     return String; // I don't know.
 }
 
-QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance, HashSet<JSObject*>* visitedObjects)
+QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance, HashSet<JSObject*>* visitedObjects)
 {
+    if (!value)
+        return QVariant();
+
     JSObject* object = 0;
     if (value.isObject()) {
         object = value.toObject(exec);
@@ -321,7 +324,7 @@
                 int objdist = 0;
                 while(it != properties.end()) {
                     if (object->propertyIsEnumerable(exec, *it)) {
-                        JSValuePtr val = object->get(exec, *it);
+                        JSValue val = object->get(exec, *it);
                         QVariant v = convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects);
                         if (objdist >= 0) {
                             UString ustring = (*it).ustring();
@@ -345,7 +348,7 @@
                 int objdist = 0;
                 qConvDebug() << "converting a " << len << " length Array";
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
+                    JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                     result.append(convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects));
                     if (objdist == -1) {
                         qConvDebug() << "Failed converting element at index " << i;
@@ -364,7 +367,7 @@
                 int objdist = 0;
                 qConvDebug() << "converting a " << len << " length Array";
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = array->get(exec, i);
+                    JSValue val = array->get(exec, i);
                     result.append(convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects));
                     if (objdist == -1) {
                         qConvDebug() << "Failed converting element at index " << i;
@@ -398,7 +401,7 @@
                 QStringList result;
                 int len = rtarray->getLength();
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
+                    JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                     UString ustring = val.toString(exec);
                     QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
@@ -412,7 +415,7 @@
                 QStringList result;
                 int len = array->length();
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = array->get(exec, i);
+                    JSValue val = array->get(exec, i);
                     UString ustring = val.toString(exec);
                     QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
@@ -453,7 +456,7 @@
         case QMetaType::QTime:
             if (type == Date) {
                 DateInstance* date = static_cast<DateInstance*>(object);
-                GregorianDateTime gdt;
+                WTF::GregorianDateTime gdt;
                 date->getUTCTime(gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
@@ -467,7 +470,7 @@
                 }
             } else if (type == Number) {
                 double b = value.toNumber(exec);
-                GregorianDateTime gdt;
+                WTF::GregorianDateTime gdt;
                 msToGregorianDateTime(b, true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
@@ -621,7 +624,7 @@
                     QObjectList result;
                     int len = rtarray->getLength();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
+                        JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::QObjectStar, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -640,7 +643,7 @@
                     QObjectList result;
                     int len = array->length();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = array->get(exec, i);
+                        JSValue val = array->get(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::QObjectStar, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -672,7 +675,7 @@
                     QList<int> result;
                     int len = rtarray->getLength();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
+                        JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::Int, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -691,7 +694,7 @@
                     QList<int> result;
                     int len = array->length();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = array->get(exec, i);
+                        JSValue val = array->get(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::Int, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -746,13 +749,13 @@
     return ret;
 }
 
-QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance)
+QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance)
 {
     HashSet<JSObject*> visitedObjects;
     return convertValueToQVariant(exec, value, hint, distance, &visitedObjects);
 }
 
-JSValuePtr convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant)
+JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant)
 {
     // Variants with QObject * can be isNull but not a null pointer
     // An empty QString variant is also null
@@ -820,7 +823,7 @@
         }
 
         // Dates specified this way are in local time (we convert DateTimes above)
-        GregorianDateTime dt;
+        WTF::GregorianDateTime dt;
         dt.year = date.year() - 1900;
         dt.month = date.month() - 1;
         dt.monthDay = date.day();
@@ -828,7 +831,7 @@
         dt.minute = time.minute();
         dt.second = time.second();
         dt.isDST = -1;
-        double ms = JSC::gregorianDateTimeToMS(dt, time.msec(), /*inputIsUTC*/ false);
+        double ms = WTF::gregorianDateTimeToMS(dt, time.msec(), /*inputIsUTC*/ false);
 
         DateInstance* instance = new (exec) DateInstance(exec->lexicalGlobalObject()->dateStructure());
         instance->setInternalValue(jsNumber(exec, trunc(ms)));
@@ -854,7 +857,7 @@
         QVariantMap::const_iterator i = map.constBegin();
         while (i != map.constEnd()) {
             QString s = i.key();
-            JSValuePtr val = convertQVariantToValue(exec, root, i.value());
+            JSValue val = convertQVariantToValue(exec, root, i.value());
             if (val) {
                 PutPropertySlot slot;
                 ret->put(exec, Identifier(exec, (const UChar *)s.constData(), s.length()), val, slot);
@@ -1181,7 +1184,7 @@
         bool converted = true;
         int matchDistance = 0;
         for (int i = 0; converted && i < types.count() - 1; ++i) {
-            JSValuePtr arg = i < jsArgs.size() ? jsArgs.at(exec, i) : jsUndefined();
+            JSValue arg = i < jsArgs.size() ? jsArgs.at(i) : jsUndefined();
 
             int argdistance = -1;
             QVariant v = convertValueToQVariant(exec, arg, types.at(i+1).typeId(), &argdistance);
@@ -1333,7 +1336,7 @@
         d->m_disconnect->mark();
 }
 
-JSValuePtr QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     QtRuntimeMetaMethodData* d = static_cast<QtRuntimeMetaMethod *>(functionObject)->d_func();
 
@@ -1391,13 +1394,13 @@
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValuePtr QtRuntimeMetaMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue QtRuntimeMetaMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     // QtScript always returns 0
     return jsNumber(exec, 0);
 }
 
-JSValuePtr QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slot.slotBase()));
     QW_DS(QtRuntimeMetaMethod, thisObj);
@@ -1407,7 +1410,7 @@
     return d->m_connect;
 }
 
-JSValuePtr QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slot.slotBase()));
     QW_DS(QtRuntimeMetaMethod, thisObj);
@@ -1431,7 +1434,7 @@
     d->m_isConnect = isConnect;
 }
 
-JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     QtRuntimeConnectionMethodData* d = static_cast<QtRuntimeConnectionMethod *>(functionObject)->d_func();
 
@@ -1454,7 +1457,7 @@
 
         if (signalIndex != -1) {
             if (args.size() == 1) {
-                funcObject = args.at(exec, 0).toObject(exec);
+                funcObject = args.at(0).toObject(exec);
                 CallData callData;
                 if (funcObject->getCallData(callData) == CallTypeNone) {
                     if (d->m_isConnect)
@@ -1463,23 +1466,23 @@
                         return throwError(exec, TypeError, "QtMetaMethod.disconnect: target is not a function");
                 }
             } else if (args.size() >= 2) {
-                if (args.at(exec, 0).isObject()) {
-                    thisObject = args.at(exec, 0).toObject(exec);
+                if (args.at(0).isObject()) {
+                    thisObject = args.at(0).toObject(exec);
 
                     // Get the actual function to call
-                    JSObject *asObj = args.at(exec, 1).toObject(exec);
+                    JSObject *asObj = args.at(1).toObject(exec);
                     CallData callData;
                     if (asObj->getCallData(callData) != CallTypeNone) {
                         // Function version
                         funcObject = asObj;
                     } else {
                         // Convert it to a string
-                        UString funcName = args.at(exec, 1).toString(exec);
+                        UString funcName = args.at(1).toString(exec);
                         Identifier funcIdent(exec, funcName);
 
                         // ### DropAllLocks
                         // This is resolved at this point in QtScript
-                        JSValuePtr val = thisObject->get(exec, funcIdent);
+                        JSValue val = thisObject->get(exec, funcIdent);
                         JSObject* asFuncObj = val.toObject(exec);
 
                         if (asFuncObj->getCallData(callData) != CallTypeNone) {
@@ -1577,7 +1580,7 @@
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValuePtr QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     // we have one formal argument, and one optional
     return jsNumber(exec, 1);
@@ -1675,7 +1678,7 @@
                 ExecState* exec = globalobj->globalExec();
                 if (exec) {
                     // Build the argument list (up to the formal argument length of the slot)
-                    ArgList l;
+                    MarkedArgumentBuffer l;
                     // ### DropAllLocks?
                     int funcArgC = m_funcObject->get(exec, exec->propertyNames().length).toInt32(exec);
                     int argTotal = qMax(funcArgC, argc);
@@ -1743,7 +1746,7 @@
     return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
 }
 
-template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned index, JSValuePtr aValue) const
+template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
 {
     // QtScript sets the value, but doesn't forward it to the original source
     // (e.g. if you do 'object.intList[5] = 6', the object is not updated, but the
@@ -1757,7 +1760,7 @@
 }
 
 
-template <typename T> JSValuePtr QtArray<T>::valueAt(ExecState *exec, unsigned int index) const
+template <typename T> JSValue QtArray<T>::valueAt(ExecState *exec, unsigned int index) const
 {
     if (index < m_length) {
         T val = m_list.at(index);
diff --git a/WebCore/bridge/qt/qt_runtime.h b/WebCore/bridge/qt/qt_runtime.h
index 7912a2b..72d93eb 100644
--- a/WebCore/bridge/qt/qt_runtime.h
+++ b/WebCore/bridge/qt/qt_runtime.h
@@ -56,8 +56,8 @@
         : m_type(ChildObject), m_childObject(child)
         {}
 
-    virtual JSValuePtr valueFromInstance(ExecState*, const Instance*) const;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValuePtr) const;
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const;
     virtual const char* name() const;
     QtFieldType fieldType() const {return m_type;}
 private:
@@ -98,8 +98,8 @@
 
     RootObject* rootObject() const;
 
-    virtual void setValueAt(ExecState*, unsigned index, JSValuePtr) const;
-    virtual JSValuePtr valueAt(ExecState*, unsigned index) const;
+    virtual void setValueAt(ExecState*, unsigned index, JSValue) const;
+    virtual JSValue valueAt(ExecState*, unsigned index) const;
     virtual unsigned int getLength() const {return m_length;}
 
 private:
@@ -144,12 +144,12 @@
 
     static const ClassInfo s_info;
 
-    static FunctionPrototype* createPrototype(ExecState* exec)
+    static FunctionPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->functionPrototype();
+        return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType));
     }
@@ -174,10 +174,10 @@
 
 private:
     virtual CallType getCallData(CallData&);
-    static JSValuePtr call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args);
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr connectGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr disconnectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue JSC_HOST_CALL call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue connectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue disconnectGetter(ExecState*, const Identifier&, const PropertySlot&);
 };
 
 class QtConnectionObject;
@@ -193,8 +193,8 @@
 
 private:
     virtual CallType getCallData(CallData&);
-    static JSValuePtr call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args);
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue JSC_HOST_CALL call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     static QMultiMap<QObject *, QtConnectionObject *> connections;
     friend class QtConnectionObject;
 };
@@ -223,7 +223,8 @@
     ProtectedPtr<JSObject> m_funcObject;
 };
 
-QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance);
+QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance);
+JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant);
 
 } // namespace Bindings
 } // namespace JSC
diff --git a/WebCore/bridge/runtime.h b/WebCore/bridge/runtime.h
index 8adfbe1..72736d4 100644
--- a/WebCore/bridge/runtime.h
+++ b/WebCore/bridge/runtime.h
@@ -49,8 +49,8 @@
 
 class Field {
 public:
-    virtual JSValuePtr valueFromInstance(ExecState*, const Instance*) const = 0;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValuePtr) const = 0;
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const = 0;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const = 0;
 
     virtual ~Field() { }
 };
@@ -66,7 +66,7 @@
 public:
     virtual MethodList methodsNamed(const Identifier&, Instance*) const = 0;
     virtual Field* fieldNamed(const Identifier&, Instance*) const = 0;
-    virtual JSValuePtr fallbackObject(ExecState*, Instance*, const Identifier&) { return jsUndefined(); }
+    virtual JSValue fallbackObject(ExecState*, Instance*, const Identifier&) { return jsUndefined(); }
 
     virtual ~Class() { }
 };
@@ -90,28 +90,28 @@
     virtual RuntimeObjectImp* createRuntimeObject(ExecState*);
     
     // Returns false if the value was not set successfully.
-    virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValuePtr) { return false; }
+    virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue) { return false; }
 
-    virtual JSValuePtr invokeMethod(ExecState*, const MethodList&, const ArgList& args) = 0;
+    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList& args) = 0;
 
     virtual bool supportsInvokeDefaultMethod() const { return false; }
-    virtual JSValuePtr invokeDefaultMethod(ExecState*, const ArgList&) { return jsUndefined(); }
+    virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&) { return jsUndefined(); }
     
     virtual bool supportsConstruct() const { return false; }
-    virtual JSValuePtr invokeConstruct(ExecState*, const ArgList&) { return noValue(); }
+    virtual JSValue invokeConstruct(ExecState*, const ArgList&) { return JSValue(); }
     
     virtual void getPropertyNames(ExecState*, PropertyNameArray&) { }
 
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const = 0;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const = 0;
     
-    virtual JSValuePtr valueOf(ExecState* exec) const = 0;
+    virtual JSValue valueOf(ExecState* exec) const = 0;
     
     RootObject* rootObject() const;
     
     virtual ~Instance();
 
     virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&) { return false; }
-    virtual void put(JSObject*, ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&) { }
+    virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&) { }
 
 protected:
     virtual void virtualBegin() { }
@@ -125,8 +125,8 @@
     Array(PassRefPtr<RootObject>);
     virtual ~Array();
     
-    virtual void setValueAt(ExecState *, unsigned index, JSValuePtr) const = 0;
-    virtual JSValuePtr valueAt(ExecState *, unsigned index) const = 0;
+    virtual void setValueAt(ExecState *, unsigned index, JSValue) const = 0;
+    virtual JSValue valueAt(ExecState *, unsigned index) const = 0;
     virtual unsigned int getLength() const = 0;
 
 protected:
diff --git a/WebCore/bridge/runtime_array.cpp b/WebCore/bridge/runtime_array.cpp
index 1979432..fead83a 100644
--- a/WebCore/bridge/runtime_array.cpp
+++ b/WebCore/bridge/runtime_array.cpp
@@ -42,13 +42,13 @@
 {
 }
 
-JSValuePtr RuntimeArray::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeArray::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slot.slotBase()));
     return jsNumber(exec, thisObj->getLength());
 }
 
-JSValuePtr RuntimeArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slot.slotBase()));
     return thisObj->getConcreteArray()->valueAt(exec, slot.index());
@@ -83,7 +83,7 @@
     return JSObject::getOwnPropertySlot(exec, index, slot);
 }
 
-void RuntimeArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RuntimeArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().length) {
         throwError(exec, RangeError);
@@ -100,7 +100,7 @@
     JSObject::put(exec, propertyName, value, slot);
 }
 
-void RuntimeArray::put(ExecState* exec, unsigned index, JSValuePtr value)
+void RuntimeArray::put(ExecState* exec, unsigned index, JSValue value)
 {
     if (index >= getLength()) {
         throwError(exec, RangeError);
diff --git a/WebCore/bridge/runtime_array.h b/WebCore/bridge/runtime_array.h
index 1ea47a4..5a86e9d 100644
--- a/WebCore/bridge/runtime_array.h
+++ b/WebCore/bridge/runtime_array.h
@@ -37,8 +37,8 @@
     
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState *, unsigned, PropertySlot&);
-    virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-    virtual void put(ExecState*, unsigned propertyName, JSValuePtr);
+    virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+    virtual void put(ExecState*, unsigned propertyName, JSValue);
     
     virtual bool deleteProperty(ExecState *exec, const Identifier &propertyName);
     virtual bool deleteProperty(ExecState *exec, unsigned propertyName);
@@ -51,19 +51,19 @@
 
     static const ClassInfo s_info;
 
-    static ArrayPrototype* createPrototype(ExecState* exec)
+    static ArrayPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->arrayPrototype();
+        return globalObject->arrayPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType));
     }
 
 private:
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr indexGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue indexGetter(ExecState*, const Identifier&, const PropertySlot&);
 
     OwnPtr<Bindings::Array> _array;
 };
diff --git a/WebCore/bridge/runtime_method.cpp b/WebCore/bridge/runtime_method.cpp
index eb0fae4..30a3581 100644
--- a/WebCore/bridge/runtime_method.cpp
+++ b/WebCore/bridge/runtime_method.cpp
@@ -47,7 +47,7 @@
 {
 }
 
-JSValuePtr RuntimeMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     RuntimeMethod* thisObj = static_cast<RuntimeMethod*>(asObject(slot.slotBase()));
 
@@ -70,7 +70,7 @@
     return InternalFunction::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-static JSValuePtr callRuntimeMethod(ExecState* exec, JSObject* function, JSValuePtr thisValue, const ArgList& args)
+static JSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     RuntimeMethod* method = static_cast<RuntimeMethod*>(function);
 
@@ -84,7 +84,7 @@
     } else {
         // If thisObj is the DOM object for a plugin, get the corresponding
         // runtime object from the DOM object.
-        JSValuePtr value = thisValue.get(exec, Identifier(exec, "__apple_runtime_object"));
+        JSValue value = thisValue.get(exec, Identifier(exec, "__apple_runtime_object"));
         if (value.isObject(&RuntimeObjectImp::s_info))    
             imp = static_cast<RuntimeObjectImp*>(asObject(value));
         else
@@ -96,7 +96,7 @@
         return RuntimeObjectImp::throwInvalidAccessError(exec);
         
     instance->begin();
-    JSValuePtr result = instance->invokeMethod(exec, *method->methods(), args);
+    JSValue result = instance->invokeMethod(exec, *method->methods(), args);
     instance->end();
     return result;
 }
diff --git a/WebCore/bridge/runtime_method.h b/WebCore/bridge/runtime_method.h
index bb983f9..5333c14 100644
--- a/WebCore/bridge/runtime_method.h
+++ b/WebCore/bridge/runtime_method.h
@@ -40,18 +40,18 @@
 
     static const ClassInfo s_info;
 
-    static FunctionPrototype* createPrototype(ExecState* exec)
+    static FunctionPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->functionPrototype();
+        return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance));
     }
 
 private:
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual CallType getCallData(CallData&);
 
diff --git a/WebCore/bridge/runtime_object.cpp b/WebCore/bridge/runtime_object.cpp
index 88aa560..79afd3f 100644
--- a/WebCore/bridge/runtime_object.cpp
+++ b/WebCore/bridge/runtime_object.cpp
@@ -66,7 +66,7 @@
     instance = 0;
 }
 
-JSValuePtr RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
     RefPtr<Instance> instance = thisObj->instance;
@@ -77,14 +77,14 @@
     instance->begin();
 
     Class *aClass = instance->getClass();
-    JSValuePtr result = aClass->fallbackObject(exec, instance.get(), propertyName);
+    JSValue result = aClass->fallbackObject(exec, instance.get(), propertyName);
 
     instance->end();
             
     return result;
 }
 
-JSValuePtr RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {    
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
     RefPtr<Instance> instance = thisObj->instance;
@@ -96,14 +96,14 @@
 
     Class *aClass = instance->getClass();
     Field* aField = aClass->fieldNamed(propertyName, instance.get());
-    JSValuePtr result = aField->valueFromInstance(exec, instance.get());
+    JSValue result = aField->valueFromInstance(exec, instance.get());
     
     instance->end();
             
     return result;
 }
 
-JSValuePtr RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
     RefPtr<Instance> instance = thisObj->instance;
@@ -115,7 +115,7 @@
 
     Class *aClass = instance->getClass();
     MethodList methodList = aClass->methodsNamed(propertyName, instance.get());
-    JSValuePtr result = new (exec) RuntimeMethod(exec, propertyName, methodList);
+    JSValue result = new (exec) RuntimeMethod(exec, propertyName, methodList);
 
     instance->end();
             
@@ -165,7 +165,7 @@
     return instance->getOwnPropertySlot(this, exec, propertyName, slot);
 }
 
-void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (!instance) {
         throwInvalidAccessError(exec);
@@ -191,23 +191,23 @@
     return false;
 }
 
-JSValuePtr RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (!instance)
         return throwInvalidAccessError(exec);
     
     RefPtr<Instance> protector(instance);
     instance->begin();
-    JSValuePtr result = instance->defaultValue(exec, hint);
+    JSValue result = instance->defaultValue(exec, hint);
     instance->end();
     return result;
 }
 
-static JSValuePtr callRuntimeObject(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callRuntimeObject(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     RefPtr<Instance> instance(static_cast<RuntimeObjectImp*>(function)->getInternalInstance());
     instance->begin();
-    JSValuePtr result = instance->invokeDefaultMethod(exec, args);
+    JSValue result = instance->invokeDefaultMethod(exec, args);
     instance->end();
     return result;
 }
@@ -224,7 +224,7 @@
 {
     RefPtr<Instance> instance(static_cast<RuntimeObjectImp*>(constructor)->getInternalInstance());
     instance->begin();
-    JSValuePtr result = instance->invokeConstruct(exec, args);
+    JSValue result = instance->invokeConstruct(exec, args);
     instance->end();
     
     ASSERT(result);
diff --git a/WebCore/bridge/runtime_object.h b/WebCore/bridge/runtime_object.h
index b8788c9..f01fe1e 100644
--- a/WebCore/bridge/runtime_object.h
+++ b/WebCore/bridge/runtime_object.h
@@ -38,9 +38,9 @@
     virtual ~RuntimeObjectImp();
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
-    virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+    virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
     virtual bool deleteProperty(ExecState* , const Identifier& propertyName);
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
     virtual CallType getCallData(CallData&);
     virtual ConstructType getConstructData(ConstructData&);
     
@@ -53,12 +53,12 @@
 
     static const ClassInfo s_info;
 
-    static ObjectPrototype* createPrototype(ExecState* exec)
+    static ObjectPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->objectPrototype();
+        return globalObject->objectPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType));
     }
@@ -69,9 +69,9 @@
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
     
-    static JSValuePtr fallbackObjectGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr fieldGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr methodGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue fallbackObjectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue fieldGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue methodGetter(ExecState*, const Identifier&, const PropertySlot&);
 
     RefPtr<Bindings::Instance> instance;
 };
diff --git a/WebCore/bridge/testbindings.pro b/WebCore/bridge/testbindings.pro
index 1beee44..a854d4f 100644
--- a/WebCore/bridge/testbindings.pro
+++ b/WebCore/bridge/testbindings.pro
@@ -1,8 +1,7 @@
 QT -= gui
 
 include(../../WebKit.pri)
-INCLUDEPATH += .. ../ .
-qt-port:INCLUDEPATH += bindings/qt
+INCLUDEPATH += .. ../ . bindings/qt
 
 SOURCES += testqtbindings.cpp
 
diff --git a/WebCore/config.h b/WebCore/config.h
index 8a4cf56..df5a502 100644
--- a/WebCore/config.h
+++ b/WebCore/config.h
@@ -24,6 +24,22 @@
 
 #include <wtf/Platform.h>
 
+#if PLATFORM(WIN_OS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+#define JS_EXPORTDATA __declspec(dllexport)
+#else
+#define JS_EXPORTDATA __declspec(dllimport)
+#endif
+#if defined(BUILDING_WebCore) || defined(BUILDING_WebKit)
+#define WEBKIT_EXPORTDATA __declspec(dllexport)
+#else
+#define WEBKIT_EXPORTDATA __declspec(dllimport)
+#endif
+#else
+#define JS_EXPORTDATA
+#define WEBKIT_EXPORTDATA
+#endif
+
 #define MOBILE 0
 
 #ifdef __APPLE__
diff --git a/WebCore/css/CSSCanvasValue.cpp b/WebCore/css/CSSCanvasValue.cpp
index 4fd5210..cf8cb42 100644
--- a/WebCore/css/CSSCanvasValue.cpp
+++ b/WebCore/css/CSSCanvasValue.cpp
@@ -59,6 +59,13 @@
         curr->first->imageChanged(static_cast<WrappedImagePtr>(this));
 }
 
+void CSSCanvasValue::canvasDestroyed(HTMLCanvasElement* element)
+{
+    ASSERT(element == m_element);
+    if (element == m_element)
+        m_element = 0;
+}
+
 IntSize CSSCanvasValue::fixedSize(const RenderObject* renderer)
 {
     if (HTMLCanvasElement* elt = element(renderer->document()))
diff --git a/WebCore/css/CSSCanvasValue.h b/WebCore/css/CSSCanvasValue.h
index a698f31..4cd4280 100644
--- a/WebCore/css/CSSCanvasValue.h
+++ b/WebCore/css/CSSCanvasValue.h
@@ -52,8 +52,9 @@
     {
     }
 
-    virtual void canvasChanged(HTMLCanvasElement* element, const FloatRect& changedRect);
-    virtual void canvasResized(HTMLCanvasElement* element);
+    virtual void canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect);
+    virtual void canvasResized(HTMLCanvasElement*);
+    virtual void canvasDestroyed(HTMLCanvasElement*);
 
     HTMLCanvasElement* element(Document*);
      
diff --git a/WebCore/css/CSSCharsetRule.idl b/WebCore/css/CSSCharsetRule.idl
index ebe659c..db0333a 100644
--- a/WebCore/css/CSSCharsetRule.idl
+++ b/WebCore/css/CSSCharsetRule.idl
@@ -26,7 +26,7 @@
         InterfaceUUID=94180bad-a74e-4df9-adbc-6ce4e5b96155,
         ImplementationUUID=354aa39e-ad53-4e9a-a927-80c3966c47f2
     ] CSSCharsetRule : CSSRule {
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute [ConvertNullStringTo=Null] DOMString encoding;
 #else
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString encoding
diff --git a/WebCore/css/CSSComputedStyleDeclaration.cpp b/WebCore/css/CSSComputedStyleDeclaration.cpp
index 6103b2c..f5a5216 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2004 Zack Rusin <zack@kde.org>
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  *
@@ -46,7 +46,6 @@
 #endif
 #include "WebKitCSSTransformValue.h"
 
-
 #if ENABLE(DASHBOARD_SUPPORT)
 #include "DashboardRegion.h"
 #endif
@@ -58,8 +57,7 @@
     CSSPropertyBackgroundAttachment,
     CSSPropertyBackgroundColor,
     CSSPropertyBackgroundImage,
-    // more specific background-position-x/y are non-standard
-    CSSPropertyBackgroundPosition,
+    CSSPropertyBackgroundPosition, // more-specific background-position-x/y are non-standard
     CSSPropertyBackgroundRepeat,
     CSSPropertyBorderBottomColor,
     CSSPropertyBorderBottomStyle,
@@ -77,6 +75,7 @@
     CSSPropertyBottom,
     CSSPropertyCaptionSide,
     CSSPropertyClear,
+    CSSPropertyClip,
     CSSPropertyColor,
     CSSPropertyCursor,
     CSSPropertyDirection,
@@ -134,6 +133,7 @@
     CSSPropertyWhiteSpace,
     CSSPropertyWidows,
     CSSPropertyWidth,
+    CSSPropertyWordBreak,
     CSSPropertyWordSpacing,
     CSSPropertyWordWrap,
     CSSPropertyZIndex,
@@ -151,9 +151,13 @@
     CSSPropertyWebkitBackgroundComposite,
     CSSPropertyWebkitBackgroundOrigin,
     CSSPropertyWebkitBackgroundSize,
+    CSSPropertyWebkitBorderBottomLeftRadius,
+    CSSPropertyWebkitBorderBottomRightRadius,
     CSSPropertyWebkitBorderFit,
-    CSSPropertyWebkitBorderImage,
     CSSPropertyWebkitBorderHorizontalSpacing,
+    CSSPropertyWebkitBorderImage,
+    CSSPropertyWebkitBorderTopLeftRadius,
+    CSSPropertyWebkitBorderTopRightRadius,
     CSSPropertyWebkitBorderVerticalSpacing,
     CSSPropertyWebkitBoxAlign,
     CSSPropertyWebkitBoxDirection,
@@ -175,6 +179,9 @@
     CSSPropertyWebkitColumnRuleStyle,
     CSSPropertyWebkitColumnRuleWidth,
     CSSPropertyWebkitColumnWidth,
+#if ENABLE(DASHBOARD_SUPPORT)
+    CSSPropertyWebkitDashboardRegion,
+#endif
     CSSPropertyWebkitHighlight,
     CSSPropertyWebkitLineBreak,
     CSSPropertyWebkitLineClamp,
@@ -186,12 +193,12 @@
     CSSPropertyWebkitMarqueeStyle,
     CSSPropertyWebkitMaskAttachment,
     CSSPropertyWebkitMaskBoxImage,
-    CSSPropertyWebkitMaskImage,
-    CSSPropertyWebkitMaskPosition,
-    CSSPropertyWebkitMaskRepeat,
     CSSPropertyWebkitMaskClip,
     CSSPropertyWebkitMaskComposite,
+    CSSPropertyWebkitMaskImage,
     CSSPropertyWebkitMaskOrigin,
+    CSSPropertyWebkitMaskPosition,
+    CSSPropertyWebkitMaskRepeat,
     CSSPropertyWebkitMaskSize,
     CSSPropertyWebkitNbspMode,
     CSSPropertyWebkitPerspective,
@@ -211,15 +218,8 @@
     CSSPropertyWebkitTransitionTimingFunction,
     CSSPropertyWebkitUserDrag,
     CSSPropertyWebkitUserModify,
-    CSSPropertyWebkitUserSelect,
-#if ENABLE(DASHBOARD_SUPPORT)
-    CSSPropertyWebkitDashboardRegion,
-#endif
-    CSSPropertyWebkitBorderBottomLeftRadius,
-    CSSPropertyWebkitBorderBottomRightRadius,
-    CSSPropertyWebkitBorderTopLeftRadius,
-    CSSPropertyWebkitBorderTopRightRadius
-    
+    CSSPropertyWebkitUserSelect
+
 #if ENABLE(SVG)
     ,
     CSSPropertyClipPath,
@@ -546,11 +546,63 @@
     ec = NO_MODIFICATION_ALLOWED_ERR;
 }
 
+static int cssIdentifierForFontSizeKeyword(int keywordSize)
+{
+    ASSERT_ARG(keywordSize, keywordSize);
+    ASSERT_ARG(keywordSize, keywordSize <= 8);
+    return CSSValueXxSmall + keywordSize - 1;
+}
+
+PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getFontSizeCSSValuePreferringKeyword() const
+{
+    Node* node = m_node.get();
+    if (!node)
+        return 0;
+
+    node->document()->updateLayoutIgnorePendingStylesheets();
+
+    RefPtr<RenderStyle> style = node->computedStyle();
+    if (!style)
+        return 0;
+
+    if (int keywordSize = style->fontDescription().keywordSize())
+        return CSSPrimitiveValue::createIdentifier(cssIdentifierForFontSizeKeyword(keywordSize));
+
+    return CSSPrimitiveValue::create(style->fontDescription().computedPixelSize(), CSSPrimitiveValue::CSS_PX);
+}
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID) const
 {
     return getPropertyCSSValue(propertyID, UpdateLayout);
 }
 
+static int identifierForFamily(const AtomicString& family)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, cursiveFamily, ("-webkit-cursive")); 
+    DEFINE_STATIC_LOCAL(AtomicString, fantasyFamily, ("-webkit-fantasy")); 
+    DEFINE_STATIC_LOCAL(AtomicString, monospaceFamily, ("-webkit-monospace")); 
+    DEFINE_STATIC_LOCAL(AtomicString, sansSerifFamily, ("-webkit-sans-serif")); 
+    DEFINE_STATIC_LOCAL(AtomicString, serifFamily, ("-webkit-serif")); 
+    if (family == cursiveFamily)
+        return CSSValueCursive;
+    if (family == fantasyFamily)
+        return CSSValueFantasy;
+    if (family == monospaceFamily)
+        return CSSValueMonospace;
+    if (family == sansSerifFamily)
+        return CSSValueSansSerif;
+    if (family == serifFamily)
+        return CSSValueSerif;
+    return 0;
+}
+
+static PassRefPtr<CSSPrimitiveValue> valueForFamily(const AtomicString& family)
+{
+    if (int familyIdentifier = identifierForFamily(family))
+        return CSSPrimitiveValue::createIdentifier(familyIdentifier);
+    return CSSPrimitiveValue::create(family.string(), CSSPrimitiveValue::CSS_STRING);
+}
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID, EUpdateLayout updateLayout) const
 {
     Node* node = m_node.get();
@@ -739,9 +791,15 @@
                 return CSSPrimitiveValue::createIdentifier(CSSValueNone);
 #endif
             return CSSPrimitiveValue::create(style->floating());
-        case CSSPropertyFontFamily:
-            // FIXME: This only returns the first family.
-            return CSSPrimitiveValue::create(style->fontDescription().family().family().string(), CSSPrimitiveValue::CSS_STRING);
+        case CSSPropertyFontFamily: {
+            const FontFamily& firstFamily = style->fontDescription().family();
+            if (!firstFamily.next())
+                return valueForFamily(firstFamily.family());
+            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
+            for (const FontFamily* family = &firstFamily; family; family = family->next())
+                list->append(valueForFamily(family->family()));
+            return list.release();
+        }
         case CSSPropertyFontSize:
             return CSSPrimitiveValue::create(style->fontDescription().computedPixelSize(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyWebkitBinding:
@@ -1235,17 +1293,15 @@
             return getBorderRadiusCornerValue(style->borderTopLeftRadius());
         case CSSPropertyWebkitBorderTopRightRadius:
             return getBorderRadiusCornerValue(style->borderTopRightRadius());
-        case CSSPropertyClip:
-        {
-            if (style->hasClip()) {
-                RefPtr<Rect> rect = Rect::create();
-                rect->setTop(CSSPrimitiveValue::create(style->clip().top().value(), CSSPrimitiveValue::CSS_PX));
-                rect->setRight(CSSPrimitiveValue::create(style->clip().right().value(), CSSPrimitiveValue::CSS_PX));
-                rect->setBottom(CSSPrimitiveValue::create(style->clip().bottom().value(), CSSPrimitiveValue::CSS_PX));
-                rect->setLeft(CSSPrimitiveValue::create(style->clip().left().value(), CSSPrimitiveValue::CSS_PX));
-                return CSSPrimitiveValue::create(rect.release());
-            }
-            return 0;
+        case CSSPropertyClip: {
+            if (!style->hasClip())
+                return CSSPrimitiveValue::createIdentifier(CSSValueAuto);
+            RefPtr<Rect> rect = Rect::create();
+            rect->setTop(CSSPrimitiveValue::create(style->clip().top().value(), CSSPrimitiveValue::CSS_PX));
+            rect->setRight(CSSPrimitiveValue::create(style->clip().right().value(), CSSPrimitiveValue::CSS_PX));
+            rect->setBottom(CSSPrimitiveValue::create(style->clip().bottom().value(), CSSPrimitiveValue::CSS_PX));
+            rect->setLeft(CSSPrimitiveValue::create(style->clip().left().value(), CSSPrimitiveValue::CSS_PX));
+            return CSSPrimitiveValue::create(rect.release());
         }
         case CSSPropertyWebkitTransform:
             return computedTransform(renderer, style.get());
@@ -1358,7 +1414,12 @@
         case CSSPropertyWebkitMarqueeSpeed:
         case CSSPropertyWebkitMask:
         case CSSPropertyWebkitPaddingStart:
+        case CSSPropertyWebkitPerspectiveOriginX:
+        case CSSPropertyWebkitPerspectiveOriginY:
         case CSSPropertyWebkitTextStroke:
+        case CSSPropertyWebkitTransformOriginX:
+        case CSSPropertyWebkitTransformOriginY:
+        case CSSPropertyWebkitTransformOriginZ:
         case CSSPropertyWebkitTransition:
         case CSSPropertyWebkitVariableDeclarationBlock:
             break;
@@ -1428,7 +1489,7 @@
 // This is the list of properties we want to copy in the copyInheritableProperties() function.
 // It is the intersection of the list of inherited CSS properties and the
 // properties for which we have a computed implementation in this file.
-const int inheritableProperties[] = {
+static const int inheritableProperties[] = {
     CSSPropertyBorderCollapse,
     CSSPropertyColor,
     CSSPropertyFontFamily,
@@ -1457,7 +1518,7 @@
 #endif
 };
 
-const unsigned numInheritableProperties = sizeof(inheritableProperties) / sizeof(inheritableProperties[0]);
+static const unsigned numInheritableProperties = sizeof(inheritableProperties) / sizeof(inheritableProperties[0]);
 
 void CSSComputedStyleDeclaration::removeComputedInheritablePropertiesFrom(CSSMutableStyleDeclaration* declaration)
 {
@@ -1477,6 +1538,8 @@
         if (!m_node->computedStyle()->textStrokeColor().isValid())
             style->removeProperty(CSSPropertyWebkitTextStrokeColor, ec);
         ASSERT(ec == 0);
+        if (int keywordSize = m_node->computedStyle()->fontDescription().keywordSize())
+            style->setProperty(CSSPropertyFontSize, cssIdentifierForFontSizeKeyword(keywordSize));
     }
     return style.release();
 }
diff --git a/WebCore/css/CSSComputedStyleDeclaration.h b/WebCore/css/CSSComputedStyleDeclaration.h
index 487c02b..23244e2 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.h
+++ b/WebCore/css/CSSComputedStyleDeclaration.h
@@ -50,6 +50,7 @@
     virtual PassRefPtr<CSSMutableStyleDeclaration> makeMutable();
 
     PassRefPtr<CSSValue> getPropertyCSSValue(int propertyID, EUpdateLayout) const;
+    PassRefPtr<CSSValue> getFontSizeCSSValuePreferringKeyword() const;
 #if ENABLE(SVG)
     PassRefPtr<CSSValue> getSVGPropertyCSSValue(int propertyID, EUpdateLayout) const;
 #endif
diff --git a/WebCore/css/CSSCursorImageValue.cpp b/WebCore/css/CSSCursorImageValue.cpp
index ddd3e6b..84ac565 100644
--- a/WebCore/css/CSSCursorImageValue.cpp
+++ b/WebCore/css/CSSCursorImageValue.cpp
@@ -27,6 +27,7 @@
 #include "PlatformString.h"
 #include "RenderStyle.h"
 #include <wtf/MathExtras.h>
+#include <wtf/UnusedParam.h>
 
 #if ENABLE(SVG)
 #include "SVGCursorElement.h"
@@ -79,7 +80,9 @@
 
 bool CSSCursorImageValue::updateIfSVGCursorIsUsed(Element* element)
 {
-#if ENABLE(SVG)
+#if !ENABLE(SVG)
+    UNUSED_PARAM(element);
+#else
     if (!element || !element->isSVGElement())
         return false;
 
diff --git a/WebCore/css/CSSFontSelector.cpp b/WebCore/css/CSSFontSelector.cpp
index 0e26f4e..35bc876 100644
--- a/WebCore/css/CSSFontSelector.cpp
+++ b/WebCore/css/CSSFontSelector.cpp
@@ -233,10 +233,7 @@
     int srcLength = srcList->length();
 
     bool foundLocal = false;
-
-#if ENABLE(SVG_FONTS)
     bool foundSVGFont = false;
-#endif
 
     for (int i = 0; i < srcLength; i++) {
         // An item in the list either specifies a string (local font name) or a URL (remote font to download).
@@ -246,9 +243,10 @@
 #if ENABLE(SVG_FONTS)
         foundSVGFont = item->isSVGFontFaceSrc() || item->svgFontFaceElement();
 #endif
-
         if (!item->isLocal()) {
-            if (item->isSupportedFormat() && m_document) {
+            Settings* settings = m_document ? m_document->frame() ? m_document->frame()->settings() : 0 : 0;
+            bool allowDownloading = foundSVGFont || (settings && settings->downloadableBinaryFontsEnabled());
+            if (allowDownloading && item->isSupportedFormat() && m_document) {
                 CachedFont* cachedFont = m_document->docLoader()->requestFont(item->resource());
                 if (cachedFont) {
 #if ENABLE(SVG_FONTS)
diff --git a/WebCore/css/CSSGrammar.y b/WebCore/css/CSSGrammar.y
index 451591d..4706521 100644
--- a/WebCore/css/CSSGrammar.y
+++ b/WebCore/css/CSSGrammar.y
@@ -26,6 +26,7 @@
 
 #include "CSSMediaRule.h"
 #include "CSSParser.h"
+#include "CSSPrimitiveValue.h"
 #include "CSSPropertyNames.h"
 #include "CSSRuleList.h"
 #include "CSSSelector.h"
@@ -1380,7 +1381,9 @@
   | variable_reference maybe_space {
       $$ = $1;
   }
-  | '%' maybe_space { $$.id = 0; $$.fValue = 0; $$.unit = CSSPrimitiveValue::CSS_PERCENTAGE; } /* Handle width: %; ANDROID: Fix an uninitialized Value object causing the device to crash */
+  | '%' maybe_space { /* Handle width: %; */
+      $$.id = 0; $$.unit = 0;
+  }
   ;
 
 unary_term:
diff --git a/WebCore/css/CSSMutableStyleDeclaration.cpp b/WebCore/css/CSSMutableStyleDeclaration.cpp
index cf50306..67b7da1 100644
--- a/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -397,12 +397,12 @@
     m_properties.remove(foundProperty - m_properties.data());
 
     if (notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
 
     return value;
 }
 
-void CSSMutableStyleDeclaration::setChanged()
+void CSSMutableStyleDeclaration::setNeedsStyleRecalc()
 {
     if (m_node) {
         // FIXME: Ideally, this should be factored better and there
@@ -410,10 +410,10 @@
         // for inline style declarations that handles this
         bool isInlineStyleDeclaration = m_node->isStyledElement() && this == static_cast<StyledElement*>(m_node)->inlineStyleDecl();
         if (isInlineStyleDeclaration) {
-            m_node->setChanged(InlineStyleChange);
+            m_node->setNeedsStyleRecalc(InlineStyleChange);
             static_cast<StyledElement*>(m_node)->invalidateStyleAttribute();
         } else
-            m_node->setChanged(FullStyleChange);
+            m_node->setNeedsStyleRecalc(FullStyleChange);
         return;
     }
 
@@ -474,7 +474,7 @@
         // CSS DOM requires raising SYNTAX_ERR here, but this is too dangerous for compatibility,
         // see <http://bugs.webkit.org/show_bug.cgi?id=7296>.
     } else if (notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
 
     return success;
 }
@@ -498,7 +498,7 @@
     CSSProperty property(propertyID, CSSPrimitiveValue::createIdentifier(value), important);
     setPropertyInternal(property);
     if (notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
     return true;
 }
 
@@ -507,7 +507,7 @@
     ASSERT(!m_iteratorCount);
 
     setPropertyInternal(CSSProperty(propertyId, CSSPrimitiveValue::create(value, type), important));
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::setImageProperty(int propertyId, const String& url, bool important)
@@ -515,7 +515,7 @@
     ASSERT(!m_iteratorCount);
 
     setPropertyInternal(CSSProperty(propertyId, CSSImageValue::create(url), important));
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::parseDeclaration(const String& styleDeclaration)
@@ -525,7 +525,7 @@
     m_properties.clear();
     CSSParser parser(useStrictParsing());
     parser.parseDeclaration(this, styleDeclaration);
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::addParsedProperties(const CSSProperty* const* properties, int numProperties)
@@ -544,7 +544,7 @@
                 m_variableDependentValueCount++;
         }
     }
-    // FIXME: This probably should have a call to setChanged() if something changed. We may also wish to add
+    // FIXME: This probably should have a call to setNeedsStyleRecalc() if something changed. We may also wish to add
     // a notifyChanged argument to this function to follow the model of other functions in this class.
 }
 
@@ -626,7 +626,7 @@
     CSSParser parser(useStrictParsing());
     parser.parseDeclaration(this, text);
     // FIXME: Detect syntax errors and set ec.
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::merge(CSSMutableStyleDeclaration* other, bool argOverridesOnConflict)
@@ -644,7 +644,7 @@
         } else
             m_properties.append(toMerge);
     }
-    // FIXME: This probably should have a call to setChanged() if something changed. We may also wish to add
+    // FIXME: This probably should have a call to setNeedsStyleRecalc() if something changed. We may also wish to add
     // a notifyChanged argument to this function to follow the model of other functions in this class.
 }
 
@@ -720,7 +720,7 @@
     m_properties = newProperties;
     
     if (changed && notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
 }
 
 PassRefPtr<CSSMutableStyleDeclaration> CSSMutableStyleDeclaration::makeMutable()
diff --git a/WebCore/css/CSSMutableStyleDeclaration.h b/WebCore/css/CSSMutableStyleDeclaration.h
index 7951388..5eb8a27 100644
--- a/WebCore/css/CSSMutableStyleDeclaration.h
+++ b/WebCore/css/CSSMutableStyleDeclaration.h
@@ -144,7 +144,7 @@
 
     virtual PassRefPtr<CSSMutableStyleDeclaration> makeMutable();
 
-    void setChanged();
+    void setNeedsStyleRecalc();
 
     String getShorthandValue(const int* properties, int number) const;
     String getCommonValue(const int* properties, int number) const;
diff --git a/WebCore/css/CSSParser.cpp b/WebCore/css/CSSParser.cpp
index 98d670b..d9f0a30 100644
--- a/WebCore/css/CSSParser.cpp
+++ b/WebCore/css/CSSParser.cpp
@@ -363,7 +363,7 @@
 
 void CSSParser::addProperty(int propId, PassRefPtr<CSSValue> value, bool important)
 {
-    CSSProperty* prop = new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand);
+    auto_ptr<CSSProperty> prop(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand));
     if (m_numParsedProperties >= m_maxParsedProperties) {
         m_maxParsedProperties += 32;
         if (m_maxParsedProperties > UINT_MAX / sizeof(CSSProperty*))
@@ -371,7 +371,7 @@
         m_parsedProperties = static_cast<CSSProperty**>(fastRealloc(m_parsedProperties,
                                                        m_maxParsedProperties * sizeof(CSSProperty*)));
     }
-    m_parsedProperties[m_numParsedProperties++] = prop;
+    m_parsedProperties[m_numParsedProperties++] = prop.release();
 }
 
 void CSSParser::rollbackLastProperties(int num)
@@ -623,7 +623,6 @@
     case CSSPropertyContent:              // [ <string> | <uri> | <counter> | attr(X) | open-quote |
         // close-quote | no-open-quote | no-close-quote ]+ | inherit
         return parseContent(propId, important);
-        break;
 
     case CSSPropertyWhiteSpace:          // normal | pre | nowrap | inherit
         if (id == CSSValueNormal ||
@@ -1626,6 +1625,7 @@
     case CSSPropertyTextLineThrough:
     case CSSPropertyTextOverline:
     case CSSPropertyTextUnderline:
+    case CSSPropertyWebkitVariableDeclarationBlock:
         return false;
 #ifdef ANDROID_CSS_TAP_HIGHLIGHT_COLOR
     case CSSPropertyWebkitTapHighlightColor:
@@ -2015,16 +2015,13 @@
             if (!args)
                 return false;
             if (equalIgnoringCase(val->function->name, "attr(")) {
-                if (args->size() != 1)
+                parsedValue = parseAttr(args);
+                if (!parsedValue)
                     return false;
-                CSSParserValue* a = args->current();
-                String attrName = a->string;
-                if (document()->isHTMLDocument())
-                    attrName = attrName.lower();
-                parsedValue = CSSPrimitiveValue::create(attrName, CSSPrimitiveValue::CSS_ATTR);
             } else if (equalIgnoringCase(val->function->name, "counter(")) {
                 parsedValue = parseCounterContent(args, false);
-                if (!parsedValue) return false;
+                if (!parsedValue)
+                    return false;
             } else if (equalIgnoringCase(val->function->name, "counters(")) {
                 parsedValue = parseCounterContent(args, true);
                 if (!parsedValue)
@@ -2061,6 +2058,29 @@
     return false;
 }
 
+PassRefPtr<CSSValue> CSSParser::parseAttr(CSSParserValueList* args)
+{
+    if (args->size() != 1)
+        return 0;
+
+    CSSParserValue* a = args->current();
+
+    if (a->unit != CSSPrimitiveValue::CSS_IDENT)
+        return 0;
+
+    String attrName = a->string;
+    // CSS allows identifiers with "-" at the start, like "-webkit-mask-image".
+    // But HTML attribute names can't have those characters, and we should not
+    // even parse them inside attr().
+    if (attrName[0] == '-')
+        return 0;
+
+    if (document()->isHTMLDocument())
+        attrName = attrName.lower();
+    
+    return CSSPrimitiveValue::create(attrName, CSSPrimitiveValue::CSS_ATTR);
+}
+
 PassRefPtr<CSSValue> CSSParser::parseBackgroundColor()
 {
     int id = m_valueList->current()->id;
diff --git a/WebCore/css/CSSParser.h b/WebCore/css/CSSParser.h
index 3b07ef9..d47720f 100644
--- a/WebCore/css/CSSParser.h
+++ b/WebCore/css/CSSParser.h
@@ -75,6 +75,8 @@
         bool parse4Values(int propId, const int* properties, bool important);
         bool parseContent(int propId, bool important);
 
+        PassRefPtr<CSSValue> parseAttr(CSSParserValueList* args);
+
         PassRefPtr<CSSValue> parseBackgroundColor();
 
         bool parseFillImage(RefPtr<CSSValue>&);
diff --git a/WebCore/css/CSSParserValues.h b/WebCore/css/CSSParserValues.h
index 4e0a280..24bd9b7 100644
--- a/WebCore/css/CSSParserValues.h
+++ b/WebCore/css/CSSParserValues.h
@@ -83,7 +83,7 @@
     bool containsVariables() const { return m_variablesCount; }
 
 private:
-    Vector<CSSParserValue, 16> m_values;
+    Vector<CSSParserValue, 4> m_values;
     unsigned m_current;
     unsigned m_variablesCount;
 };
diff --git a/WebCore/css/CSSPrimitiveValue.cpp b/WebCore/css/CSSPrimitiveValue.cpp
index 4bf6005..15c5a01 100644
--- a/WebCore/css/CSSPrimitiveValue.cpp
+++ b/WebCore/css/CSSPrimitiveValue.cpp
@@ -754,9 +754,18 @@
         case CSS_IDENT:
             text = valueOrPropertyName(m_value.ident);
             break;
-        case CSS_ATTR:
-            // FIXME
-            break;
+        case CSS_ATTR: {
+            DEFINE_STATIC_LOCAL(const String, attrParen, ("attr("));
+
+            Vector<UChar> result;
+            result.reserveInitialCapacity(6 + m_value.string->length());
+
+            append(result, attrParen);
+            append(result, m_value.string);
+            result.uncheckedAppend(')');
+
+            return String::adopt(result);
+        }
         case CSS_COUNTER:
             text = "counter(";
             text += String::number(m_value.num);
diff --git a/WebCore/css/CSSPrimitiveValue.idl b/WebCore/css/CSSPrimitiveValue.idl
index b049c29..befe5ac 100644
--- a/WebCore/css/CSSPrimitiveValue.idl
+++ b/WebCore/css/CSSPrimitiveValue.idl
@@ -69,7 +69,7 @@
             raises(DOMException);
         Rect getRectValue()
             raises(DOMException);
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         RGBColor getRGBColorValue()
             raises(DOMException);
 #endif
diff --git a/WebCore/css/CSSRule.idl b/WebCore/css/CSSRule.idl
index 4d9e568..f13f293 100644
--- a/WebCore/css/CSSRule.idl
+++ b/WebCore/css/CSSRule.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -23,7 +23,7 @@
     // Introduced in DOM Level 2:
     interface [
         GenerateConstructor,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=548139b4-31ab-4978-b1d5-cfcfdfbaea0e,
         ImplementationUUID=0268e673-2489-4743-9a3a-197dae4b4d9c
     ] CSSRule {
diff --git a/WebCore/css/CSSStyleDeclaration.h b/WebCore/css/CSSStyleDeclaration.h
index e6fede6..ef4cc21 100644
--- a/WebCore/css/CSSStyleDeclaration.h
+++ b/WebCore/css/CSSStyleDeclaration.h
@@ -42,6 +42,7 @@
     virtual void setCssText(const String&, ExceptionCode&) = 0;
 
     virtual unsigned length() const = 0;
+    bool isEmpty() const { return !length(); }
     virtual String item(unsigned index) const = 0;
 
     PassRefPtr<CSSValue> getPropertyCSSValue(const String& propertyName);
diff --git a/WebCore/css/CSSStyleSelector.cpp b/WebCore/css/CSSStyleSelector.cpp
index 42b07ef..146b1ee 100644
--- a/WebCore/css/CSSStyleSelector.cpp
+++ b/WebCore/css/CSSStyleSelector.cpp
@@ -62,6 +62,7 @@
 #include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
 #include "LinkHash.h"
+#include "MappedAttribute.h"
 #include "MatrixTransformOperation.h"
 #include "Matrix3DTransformOperation.h"
 #include "MediaList.h"
@@ -110,6 +111,10 @@
 #include "WMLNames.h"
 #endif
 
+#if PLATFORM(QT)
+#include <qwebhistoryinterface.h>
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -138,6 +143,16 @@
     return;\
 }
 
+#define HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(prop, Prop) \
+HANDLE_INHERIT_AND_INITIAL(prop, Prop) \
+if (primitiveValue) \
+    m_style->set##Prop(*primitiveValue);
+
+#define HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(prop, Prop, Value) \
+HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(prop, Prop, Value) \
+if (primitiveValue) \
+    m_style->set##Prop(*primitiveValue);
+
 #define HANDLE_FILL_LAYER_INHERIT_AND_INITIAL(layerType, LayerType, prop, Prop) \
 if (isInherit) { \
     FillLayer* currChild = m_style->access##LayerType##Layers(); \
@@ -863,9 +878,26 @@
     if (!checkVisited)
         return PseudoAnyLink;
 
+#if PLATFORM(QT)
+    Vector<UChar, 512> url;
+    visitedURL(m_document->baseURL(), *attr, url);
+    if (url.isEmpty())
+        return PseudoLink;
+
+    // If the Qt4.4 interface for the history is used, we will have to fallback
+    // to the old global history.
+    QWebHistoryInterface* iface = QWebHistoryInterface::defaultInterface();
+    if (iface)
+        return iface->historyContains(QString(reinterpret_cast<QChar*>(url.data()), url.size())) ? PseudoVisited : PseudoLink;
+
+    LinkHash hash = visitedLinkHash(url.data(), url.size());
+    if (!hash)
+        return PseudoLink;
+#else
     LinkHash hash = visitedLinkHash(m_document->baseURL(), *attr);
     if (!hash)
         return PseudoLink;
+#endif
 
     Frame* frame = m_document->frame();
     if (!frame)
@@ -957,12 +989,7 @@
                 } else
                     return false;
 
-                FormControlElement* thisFormControlElement = toFormControlElement(s);
-                FormControlElement* otherFormControlElement = toFormControlElement(m_element);
-                if (thisFormControlElement && otherFormControlElement) {
-                    if (thisFormControlElement->isEnabled() != otherFormControlElement->isEnabled())
-                        return false;
-                } else
+                if (s->isEnabledFormControl() != m_element->isEnabledFormControl())
                     return false;
             }
 
@@ -2300,7 +2327,7 @@
                     // The UI spec states that you can't match :enabled unless you are an object that can
                     // "receive focus and be activated."  We will limit matching of this pseudo-class to elements
                     // that are non-"hidden" controls.
-                    return toFormControlElement(e)->isEnabled();
+                    return e->isEnabledFormControl();
                 }
                 break;
             case CSSSelector::PseudoFullPageMedia:
@@ -2315,20 +2342,18 @@
                     // The UI spec states that you can't match :enabled unless you are an object that can
                     // "receive focus and be activated."  We will limit matching of this pseudo-class to elements
                     // that are non-"hidden" controls.
-                    return !toFormControlElement(e)->isEnabled();
+                    return !e->isEnabledFormControl();
                 }
                 break;
             case CSSSelector::PseudoReadOnly: {
                 if (!e || !e->isFormControlElement())
                     return false;
-                FormControlElement* formControlElement = toFormControlElement(e);
-                return formControlElement->isTextControl() && formControlElement->isReadOnlyControl();
+                return e->isTextFormControl() && e->isReadOnlyFormControl();
             }
             case CSSSelector::PseudoReadWrite: {
                 if (!e || !e->isFormControlElement())
                     return false;
-                FormControlElement* formControlElement = toFormControlElement(e);
-                return formControlElement->isTextControl() && !formControlElement->isReadOnlyControl();
+                return e->isTextFormControl() && !e->isReadOnlyFormControl();
             }
             case CSSSelector::PseudoChecked: {
                 if (!e || !e->isFormControlElement())
@@ -2894,26 +2919,17 @@
                 return;
         }
         return;
-        
     case CSSPropertyBorderTopStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderTopStyle, BorderTopStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderTopStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderTopStyle, BorderTopStyle, BorderStyle)
         return;
     case CSSPropertyBorderRightStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderRightStyle, BorderRightStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderRightStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderRightStyle, BorderRightStyle, BorderStyle)
         return;
     case CSSPropertyBorderBottomStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderBottomStyle, BorderBottomStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderBottomStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderBottomStyle, BorderBottomStyle, BorderStyle)
         return;
     case CSSPropertyBorderLeftStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderLeftStyle, BorderLeftStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderLeftStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderLeftStyle, BorderLeftStyle, BorderStyle)
         return;
     case CSSPropertyOutlineStyle:
         HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(outlineStyle, OutlineStyle, BorderStyle)
@@ -2925,49 +2941,23 @@
         }
         return;
     case CSSPropertyCaptionSide:
-    {
-        HANDLE_INHERIT_AND_INITIAL(captionSide, CaptionSide)
-        if (primitiveValue)
-            m_style->setCaptionSide(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(captionSide, CaptionSide)
         return;
-    }
     case CSSPropertyClear:
-    {
-        HANDLE_INHERIT_AND_INITIAL(clear, Clear)
-        if (primitiveValue)
-            m_style->setClear(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(clear, Clear)
         return;
-    }
     case CSSPropertyDirection:
-    {
-        HANDLE_INHERIT_AND_INITIAL(direction, Direction)
-        if (primitiveValue)
-            m_style->setDirection(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(direction, Direction)
         return;
-    }
     case CSSPropertyDisplay:
-    {
-        HANDLE_INHERIT_AND_INITIAL(display, Display)
-        if (primitiveValue)
-            m_style->setDisplay(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(display, Display)
         return;
-    }
-
     case CSSPropertyEmptyCells:
-    {
-        HANDLE_INHERIT_AND_INITIAL(emptyCells, EmptyCells)
-        if (primitiveValue)
-            m_style->setEmptyCells(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(emptyCells, EmptyCells)
         return;
-    }
     case CSSPropertyFloat:
-    {
-        HANDLE_INHERIT_AND_INITIAL(floating, Floating)
-        if (primitiveValue)
-            m_style->setFloating(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(floating, Floating)
         return;
-    }
-
     case CSSPropertyFontStyle:
     {
         FontDescription fontDescription = m_style->fontDescription();
@@ -3078,21 +3068,11 @@
     }
         
     case CSSPropertyListStylePosition:
-    {
-        HANDLE_INHERIT_AND_INITIAL(listStylePosition, ListStylePosition)
-        if (primitiveValue)
-            m_style->setListStylePosition(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(listStylePosition, ListStylePosition)
         return;
-    }
-
     case CSSPropertyListStyleType:
-    {
-        HANDLE_INHERIT_AND_INITIAL(listStyleType, ListStyleType)
-        if (primitiveValue)
-            m_style->setListStyleType(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(listStyleType, ListStyleType)
         return;
-    }
-
     case CSSPropertyOverflow:
     {
         if (isInherit) {
@@ -3115,35 +3095,17 @@
     }
 
     case CSSPropertyOverflowX:
-    {
-        HANDLE_INHERIT_AND_INITIAL(overflowX, OverflowX)
-        m_style->setOverflowX(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(overflowX, OverflowX)
         return;
-    }
-
     case CSSPropertyOverflowY:
-    {
-        HANDLE_INHERIT_AND_INITIAL(overflowY, OverflowY)
-        m_style->setOverflowY(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(overflowY, OverflowY)
         return;
-    }
-
     case CSSPropertyPageBreakBefore:
-    {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(pageBreakBefore, PageBreakBefore, PageBreak)
-        if (primitiveValue)
-            m_style->setPageBreakBefore(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakBefore, PageBreakBefore, PageBreak)
         return;
-    }
-
     case CSSPropertyPageBreakAfter:
-    {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(pageBreakAfter, PageBreakAfter, PageBreak)
-        if (primitiveValue)
-            m_style->setPageBreakAfter(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakAfter, PageBreakAfter, PageBreak)
         return;
-    }
-
     case CSSPropertyPageBreakInside: {
         HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(pageBreakInside, PageBreakInside, PageBreak)
         if (!primitiveValue)
@@ -3155,13 +3117,8 @@
     }
         
     case CSSPropertyPosition:
-    {
-        HANDLE_INHERIT_AND_INITIAL(position, Position)
-        if (primitiveValue)
-            m_style->setPosition(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(position, Position)
         return;
-    }
-
     case CSSPropertyTableLayout: {
         HANDLE_INHERIT_AND_INITIAL(tableLayout, TableLayout)
 
@@ -3173,26 +3130,17 @@
         return;
     }
         
-    case CSSPropertyUnicodeBidi: {
-        HANDLE_INHERIT_AND_INITIAL(unicodeBidi, UnicodeBidi)
-        m_style->setUnicodeBidi(*primitiveValue);
+    case CSSPropertyUnicodeBidi: 
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(unicodeBidi, UnicodeBidi)
         return;
-    }
-    case CSSPropertyTextTransform: {
-        HANDLE_INHERIT_AND_INITIAL(textTransform, TextTransform)
-        m_style->setTextTransform(*primitiveValue);
+    case CSSPropertyTextTransform: 
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textTransform, TextTransform)
         return;
-    }
-
     case CSSPropertyVisibility:
-    {
-        HANDLE_INHERIT_AND_INITIAL(visibility, Visibility)
-        m_style->setVisibility(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(visibility, Visibility)
         return;
-    }
     case CSSPropertyWhiteSpace:
-        HANDLE_INHERIT_AND_INITIAL(whiteSpace, WhiteSpace)
-        m_style->setWhiteSpace(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(whiteSpace, WhiteSpace)
         return;
 
     case CSSPropertyBackgroundPosition:
@@ -3485,38 +3433,21 @@
         return;
     }
 
-    case CSSPropertyWordBreak: {
-        HANDLE_INHERIT_AND_INITIAL(wordBreak, WordBreak)
-        m_style->setWordBreak(*primitiveValue);
+    case CSSPropertyWordBreak:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(wordBreak, WordBreak)
         return;
-    }
-
-    case CSSPropertyWordWrap: {
-        HANDLE_INHERIT_AND_INITIAL(wordWrap, WordWrap)
-        m_style->setWordWrap(*primitiveValue);
+    case CSSPropertyWordWrap:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(wordWrap, WordWrap)
         return;
-    }
-
     case CSSPropertyWebkitNbspMode:
-    {
-        HANDLE_INHERIT_AND_INITIAL(nbspMode, NBSPMode)
-        m_style->setNBSPMode(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(nbspMode, NBSPMode)
         return;
-    }
-
     case CSSPropertyWebkitLineBreak:
-    {
-        HANDLE_INHERIT_AND_INITIAL(khtmlLineBreak, KHTMLLineBreak)
-        m_style->setKHTMLLineBreak(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(khtmlLineBreak, KHTMLLineBreak)
         return;
-    }
-
     case CSSPropertyWebkitMatchNearestMailBlockquoteColor:
-    {
-        HANDLE_INHERIT_AND_INITIAL(matchNearestMailBlockquoteColor, MatchNearestMailBlockquoteColor)
-        m_style->setMatchNearestMailBlockquoteColor(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(matchNearestMailBlockquoteColor, MatchNearestMailBlockquoteColor)
         return;
-    }
 
     case CSSPropertyResize:
     {
@@ -4635,19 +4566,13 @@
             m_style->setBackfaceVisibility((primitiveValue->getIdent() == CSSValueVisible) ? BackfaceVisibilityVisible : BackfaceVisibilityHidden);
         return;
     case CSSPropertyWebkitBoxDirection:
-        HANDLE_INHERIT_AND_INITIAL(boxDirection, BoxDirection)
-        if (primitiveValue)
-            m_style->setBoxDirection(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxDirection, BoxDirection)
         return;
     case CSSPropertyWebkitBoxLines:
-        HANDLE_INHERIT_AND_INITIAL(boxLines, BoxLines)
-        if (primitiveValue)
-            m_style->setBoxLines(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxLines, BoxLines)
         return;
     case CSSPropertyWebkitBoxOrient:
-        HANDLE_INHERIT_AND_INITIAL(boxOrient, BoxOrient)
-        if (primitiveValue)
-            m_style->setBoxOrient(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxOrient, BoxOrient)
         return;
     case CSSPropertyWebkitBoxPack:
     {
@@ -4729,19 +4654,14 @@
         return;
     }
     case CSSPropertyWebkitColumnRuleStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnRuleStyle, ColumnRuleStyle, BorderStyle)
-        m_style->setColumnRuleStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnRuleStyle, ColumnRuleStyle, BorderStyle)
         return;
-    case CSSPropertyWebkitColumnBreakBefore: {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnBreakBefore, ColumnBreakBefore, PageBreak)
-        m_style->setColumnBreakBefore(*primitiveValue);
+    case CSSPropertyWebkitColumnBreakBefore:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakBefore, ColumnBreakBefore, PageBreak)
         return;
-    }
-    case CSSPropertyWebkitColumnBreakAfter: {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnBreakAfter, ColumnBreakAfter, PageBreak)
-        m_style->setColumnBreakAfter(*primitiveValue);
+    case CSSPropertyWebkitColumnBreakAfter:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakAfter, ColumnBreakAfter, PageBreak)
         return;
-    }
     case CSSPropertyWebkitColumnBreakInside: {
         HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnBreakInside, ColumnBreakInside, PageBreak)
         EPageBreak pb = *primitiveValue;
@@ -4838,36 +4758,22 @@
         }
         return;
     }
-    case CSSPropertyWebkitMarqueeStyle: {
-        HANDLE_INHERIT_AND_INITIAL(marqueeBehavior, MarqueeBehavior)      
-        if (primitiveValue)
-            m_style->setMarqueeBehavior(*primitiveValue);
+    case CSSPropertyWebkitMarqueeStyle:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeBehavior, MarqueeBehavior)      
         return;
-    }
-    case CSSPropertyWebkitMarqueeDirection: {
-        HANDLE_INHERIT_AND_INITIAL(marqueeDirection, MarqueeDirection)
-        if (primitiveValue)
-            m_style->setMarqueeDirection(*primitiveValue);
+    case CSSPropertyWebkitMarqueeDirection:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeDirection, MarqueeDirection)
         return;
-    }
-    case CSSPropertyWebkitUserDrag: {
-        HANDLE_INHERIT_AND_INITIAL(userDrag, UserDrag)      
-        if (primitiveValue)
-            m_style->setUserDrag(*primitiveValue);
+    case CSSPropertyWebkitUserDrag:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userDrag, UserDrag)      
         return;
-    }
-    case CSSPropertyWebkitUserModify: {
-        HANDLE_INHERIT_AND_INITIAL(userModify, UserModify)      
-        if (primitiveValue)
-            m_style->setUserModify(*primitiveValue);
+    case CSSPropertyWebkitUserModify:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userModify, UserModify)      
         return;
-    }
-    case CSSPropertyWebkitUserSelect: {
-        HANDLE_INHERIT_AND_INITIAL(userSelect, UserSelect)      
-        if (primitiveValue)
-            m_style->setUserSelect(*primitiveValue);
+    case CSSPropertyWebkitUserSelect:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userSelect, UserSelect)      
         return;
-    }
+
     case CSSPropertyTextOverflow: {
         // This property is supported by WinIE, and so we leave off the "-webkit-" in order to
         // work with WinIE-specific pages that use the property.
@@ -4888,18 +4794,13 @@
         }
         return;
     }
-    case CSSPropertyWebkitMarginTopCollapse: {
-        HANDLE_INHERIT_AND_INITIAL(marginTopCollapse, MarginTopCollapse)
-        if (primitiveValue)
-            m_style->setMarginTopCollapse(*primitiveValue);
+
+    case CSSPropertyWebkitMarginTopCollapse:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marginTopCollapse, MarginTopCollapse)
         return;
-    }
-    case CSSPropertyWebkitMarginBottomCollapse: {
-        HANDLE_INHERIT_AND_INITIAL(marginBottomCollapse, MarginBottomCollapse)
-        if (primitiveValue)
-            m_style->setMarginBottomCollapse(*primitiveValue);
+    case CSSPropertyWebkitMarginBottomCollapse:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marginBottomCollapse, MarginBottomCollapse)
         return;
-    }
 
     // Apple-specific changes.  Do not merge these properties into KHTML.
     case CSSPropertyWebkitLineClamp: {
@@ -4932,12 +4833,10 @@
         m_fontDirty = true;
         return;
     }
-    case CSSPropertyWebkitTextSecurity: {
-        HANDLE_INHERIT_AND_INITIAL(textSecurity, TextSecurity)
-        if (primitiveValue)
-            m_style->setTextSecurity(*primitiveValue);
+    case CSSPropertyWebkitTextSecurity:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textSecurity, TextSecurity)
         return;
-    }
+
 #if ENABLE(DASHBOARD_SUPPORT)
     case CSSPropertyWebkitDashboardRegion: {
         HANDLE_INHERIT_AND_INITIAL(dashboardRegions, DashboardRegions)
@@ -5185,6 +5084,7 @@
     case CSSPropertyWebkitPaddingStart:
     case CSSPropertyWebkitTextDecorationsInEffect:
     case CSSPropertyWebkitTextStroke:
+    case CSSPropertyWebkitVariableDeclarationBlock:
         return;
 #ifdef ANDROID_CSS_TAP_HIGHLIGHT_COLOR
     case CSSPropertyWebkitTapHighlightColor: {
@@ -5865,7 +5765,7 @@
         return;
     for (Node* node = m_document; node; node = node->traverseNextNode()) {
         if (node->isLink())
-            node->setChanged();
+            node->setNeedsStyleRecalc();
     }
 }
 
@@ -5876,7 +5776,7 @@
     for (Node* node = m_document; node; node = node->traverseNextNode()) {
         const AtomicString* attr = linkAttribute(node);
         if (attr && visitedLinkHash(m_document->baseURL(), *attr) == visitedHash)
-            node->setChanged();
+            node->setNeedsStyleRecalc();
     }
 }
 
diff --git a/WebCore/css/CSSValue.idl b/WebCore/css/CSSValue.idl
index 8979b61..875d12e 100644
--- a/WebCore/css/CSSValue.idl
+++ b/WebCore/css/CSSValue.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -22,7 +22,7 @@
 
     interface [
         GenerateConstructor,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=9fd62a7b-539d-4500-bd6c-ec075abbc404,
         ImplementationUUID=e10a2860-f98e-4bd3-96b4-1493ad941dfe
     ] CSSValue {
diff --git a/WebCore/css/CSSVariablesDeclaration.cpp b/WebCore/css/CSSVariablesDeclaration.cpp
index 5f8d601..cb852cb 100644
--- a/WebCore/css/CSSVariablesDeclaration.cpp
+++ b/WebCore/css/CSSVariablesDeclaration.cpp
@@ -72,7 +72,7 @@
             }
         }
         
-        setChanged();
+        setNeedsStyleRecalc();
     }
     
     // FIXME: Communicate this change so that the document will update.
@@ -86,7 +86,7 @@
     if (!parser.parseVariable(this, variableName, variableValue)) // If the parse succeeds, it will call addParsedVariable (our internal method for doing the add) with the parsed Value*.
         excCode = SYNTAX_ERR;
     else
-        setChanged();
+        setNeedsStyleRecalc();
 }
 
 void CSSVariablesDeclaration::addParsedVariable(const String& variableName, PassRefPtr<CSSValue> variableValue, bool updateNamesList)
@@ -162,7 +162,7 @@
     // FIXME: It's not clear if this is actually settable.
 }
 
-void CSSVariablesDeclaration::setChanged()
+void CSSVariablesDeclaration::setNeedsStyleRecalc()
 {
     // FIXME: Make this much better (it has the same problem CSSMutableStyleDeclaration does).
     StyleBase* root = this;
diff --git a/WebCore/css/CSSVariablesDeclaration.h b/WebCore/css/CSSVariablesDeclaration.h
index aa98158..f16b011 100644
--- a/WebCore/css/CSSVariablesDeclaration.h
+++ b/WebCore/css/CSSVariablesDeclaration.h
@@ -70,7 +70,7 @@
 private:
     CSSVariablesDeclaration(StyleBase* owningRule, const Vector<String>& names, const Vector<RefPtr<CSSValue> >& values);
 
-    void setChanged();
+    void setNeedsStyleRecalc();
 
 protected:
     Vector<String> m_variableNames;
diff --git a/WebCore/css/MediaFeatureNames.h b/WebCore/css/MediaFeatureNames.h
index bea2b8a..5196586 100644
--- a/WebCore/css/MediaFeatureNames.h
+++ b/WebCore/css/MediaFeatureNames.h
@@ -33,11 +33,14 @@
     macro(monochrome, "monochrome") \
     macro(height, "height") \
     macro(width, "width") \
+    macro(orientation, "orientation") \
+    macro(aspect_ratio, "aspect-ratio") \
     macro(device_aspect_ratio, "device-aspect-ratio") \
     macro(device_pixel_ratio, "-webkit-device-pixel-ratio") \
     macro(device_height, "device-height") \
     macro(device_width, "device-width") \
     macro(max_color, "max-color") \
+    macro(max_aspect_ratio, "max-aspect-ratio") \
     macro(max_device_aspect_ratio, "max-device-aspect-ratio") \
     macro(max_device_pixel_ratio, "-webkit-max-device-pixel-ratio") \
     macro(max_device_height, "max-device-height") \
@@ -46,6 +49,7 @@
     macro(max_monochrome, "max-monochrome") \
     macro(max_width, "max-width") \
     macro(min_color, "min-color") \
+    macro(min_aspect_ratio, "min-aspect-ratio") \
     macro(min_device_aspect_ratio, "min-device-aspect-ratio") \
     macro(min_device_pixel_ratio, "-webkit-min-device-pixel-ratio") \
     macro(min_device_height, "min-device-height") \
diff --git a/WebCore/css/MediaQueryEvaluator.cpp b/WebCore/css/MediaQueryEvaluator.cpp
index 4268d8c..c641dfd 100644
--- a/WebCore/css/MediaQueryEvaluator.cpp
+++ b/WebCore/css/MediaQueryEvaluator.cpp
@@ -230,6 +230,38 @@
     return colorMediaFeatureEval(value, style, frame, op);
 }
 
+static bool orientationMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix)
+{
+    // A missing parameter should fail
+    if (!value)
+        return false;
+
+    FrameView* view = frame->view();
+    int width = view->layoutWidth();
+    int height = view->layoutHeight();
+    if (width > height) // Square viewport is portrait
+        return "landscape" == static_cast<CSSPrimitiveValue*>(value)->getStringValue();
+    return "portrait" == static_cast<CSSPrimitiveValue*>(value)->getStringValue();
+}
+
+static bool aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix op)
+{
+    if (value) {
+        FrameView* view = frame->view();
+        int width = view->layoutWidth();
+        int height = view->layoutHeight();
+        int h = 0;
+        int v = 0;
+        if (parseAspectRatio(value, h, v))
+            return v != 0 && compareValue(width * v, height * h, op);
+        return false;
+    }
+
+    // ({,min-,max-}aspect-ratio)
+    // assume if we have a device, its aspect ratio is non-zero
+    return true;
+}
+
 static bool device_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix op)
 {
     if (value) {
@@ -328,6 +360,16 @@
     return monochromeMediaFeatureEval(value, style, frame, MaxPrefix);
 }
 
+static bool min_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix)
+{
+    return aspect_ratioMediaFeatureEval(value, style, frame, MinPrefix);
+}
+
+static bool max_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix)
+{
+    return aspect_ratioMediaFeatureEval(value, style, frame, MaxPrefix);
+}
+
 static bool min_device_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix)
 {
     return device_aspect_ratioMediaFeatureEval(value, style, frame, MinPrefix);
diff --git a/WebCore/css/MediaQueryExp.h b/WebCore/css/MediaQueryExp.h
index daae232..3036d04 100644
--- a/WebCore/css/MediaQueryExp.h
+++ b/WebCore/css/MediaQueryExp.h
@@ -57,7 +57,11 @@
                                               m_mediaFeature == MediaFeatureNames::min_widthMediaFeature ||
                                               m_mediaFeature == MediaFeatureNames::min_heightMediaFeature ||
                                               m_mediaFeature == MediaFeatureNames::max_widthMediaFeature ||
-                                              m_mediaFeature == MediaFeatureNames::max_heightMediaFeature; }
+                                              m_mediaFeature == MediaFeatureNames::max_heightMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::orientationMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::aspect_ratioMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::min_aspect_ratioMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::max_aspect_ratioMediaFeature;  }
 private:
     AtomicString m_mediaFeature;
     RefPtr<CSSValue> m_value;
diff --git a/WebCore/css/RGBColor.idl b/WebCore/css/RGBColor.idl
index cb14319..f76b6a2 100644
--- a/WebCore/css/RGBColor.idl
+++ b/WebCore/css/RGBColor.idl
@@ -33,10 +33,10 @@
         readonly attribute CSSPrimitiveValue  blue;
 
         // WebKit extensions
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute CSSPrimitiveValue  alpha;
 #endif
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute Color              color;
 #endif
     };
diff --git a/WebCore/css/StyleSheet.idl b/WebCore/css/StyleSheet.idl
index 81bbe34..3a26f20 100644
--- a/WebCore/css/StyleSheet.idl
+++ b/WebCore/css/StyleSheet.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -24,7 +24,7 @@
     interface [
         CustomMarkFunction,
         GenerateConstructor,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=2bd2db5f-aaab-4422-96a0-e05455313f35,
         ImplementationUUID=a8ca694d-71f2-4479-8c76-ee9c1c729b49
     ] StyleSheet {
diff --git a/WebCore/css/html4.css b/WebCore/css/html4.css
index 2b6d3fe..59a08eb 100644
--- a/WebCore/css/html4.css
+++ b/WebCore/css/html4.css
@@ -359,9 +359,10 @@
     -webkit-box-orient: vertical;
     resize: auto;
     cursor: auto;
+    padding: 2px;
 }
 
-input::-webkit-input-placeholder {
+input::-webkit-input-placeholder, isindex::-webkit-input-placeholder {
     color: darkGray;
 }
 
diff --git a/WebCore/css/maketokenizer b/WebCore/css/maketokenizer
index 4f65d17..d14b37a 100644
--- a/WebCore/css/maketokenizer
+++ b/WebCore/css/maketokenizer
@@ -126,3 +126,10 @@
     print;
     last if /end of yylex/;
 }
+
+# We don't want the remainder of flex's output.
+# However, flex may choke with "flex: error writing output file <stdout>"
+# if its stdout is unexpectedly closed on it.
+# Consume the remaining output.
+while (<>) {
+}
diff --git a/WebCore/css/mediaControlsChromium.css b/WebCore/css/mediaControlsChromium.css
new file mode 100644
index 0000000..63eca4b
--- /dev/null
+++ b/WebCore/css/mediaControlsChromium.css
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+/* Chromium default media controls */
+
+audio {
+    width: 200px;
+    height: 32px;
+}
+
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    -webkit-user-select: none;
+    position: absolute;
+    bottom: 0;
+    width: 100%;
+    height: 100%;
+    z-index: 0;
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+    bottom: -16px;
+}
+
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
+    -webkit-appearance: media-mute-button;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    right: 0;
+    left: auto;
+
+    width: 34px;
+    height: 32px;
+
+    background: rgba(123, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
+    -webkit-appearance: media-play-button;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 0px;
+    right: auto;
+
+    width: 30px;
+    height: 32px;
+
+    background: rgba(0, 221, 0, 0.6);
+}
+
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-timeline-container;
+    -webkit-user-select: none;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 30px;
+    right: 34px;
+
+    width: auto;
+    height: 32px;
+
+    background: rgba(0, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    -webkit-appearance: media-current-time-display;
+    -webkit-user-select: none;
+    display: inline-block;
+
+    overflow: hidden;
+    cursor: default;
+
+    position: absolute;
+    line-height: 21px;
+    top: auto;
+    bottom: 6px;
+    left: auto;
+    right: 0px;
+
+    height: 20px;
+    width: 48px;
+
+    text-align: center;
+    font-family: Arial;
+    font-weight: bold;
+    color: white;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
+    -webkit-appearance: media-time-remaining-display;
+    -webkit-user-select: none;
+    display: none;
+
+    overflow: hidden;
+    cursor: default;
+
+    position: absolute;
+    line-height: 21px;
+    top: auto;
+    bottom: 6px;
+    left: auto;
+    right: 0px;
+
+    height: 20px;
+    width: 48px;
+
+    text-align: center;
+    font-family: Arial;
+    font-weight: bold;
+    color: white;
+}
+
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    -webkit-appearance: slider-horizontal;
+    position: absolute;
+    top: auto;
+    bottom: 9px;
+    left: 0px;
+    right: 50px;
+    height: 13px;
+
+    background: rgba(0, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
+    -webkit-appearance: media-seek-back-button;
+    display: none;
+}
+
+audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
+    -webkit-appearance: media-seek-forward-button;
+    display: none;
+}
+
+audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
+    -webkit-appearance: media-fullscreen-button;
+    display: none;
+}
diff --git a/WebCore/platform/chromium/KeyboardCodes.h b/WebCore/css/themeChromiumLinux.css
similarity index 86%
rename from WebCore/platform/chromium/KeyboardCodes.h
rename to WebCore/css/themeChromiumLinux.css
index 10eb0cd..f8210c3 100644
--- a/WebCore/platform/chromium/KeyboardCodes.h
+++ b/WebCore/css/themeChromiumLinux.css
@@ -1,10 +1,10 @@
 /*
- * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
- * 
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,13 +28,9 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef KeyboardCodes_h
-#define KeyboardCodes_h
+/* These styles override other user-agent styles for Chromium on Linux. */
 
-#if PLATFORM(WIN_OS)
-#include "KeyboardCodesWin.h"
-#else
-#include "KeyboardCodesPosix.h"
-#endif
-
-#endif
+select {
+    background-color: #dddddd;
+    border: 0px;
+}
diff --git a/WebCore/css/themeWin.css b/WebCore/css/themeWin.css
index 6c582e9..421fed0 100644
--- a/WebCore/css/themeWin.css
+++ b/WebCore/css/themeWin.css
@@ -35,12 +35,10 @@
 input:not([type]), 
 input[type="text"],
 input[type="password"] {
-    margin:0;
     padding:1px 0;
 }
 
 input[type="search"] {
-    margin:0;
     padding:1px;
 }
 
@@ -67,10 +65,6 @@
     background-color: #EBEBE4; 
 }
 
-input[type="search"] {
-    -webkit-appearance: textfield;
-}
-
 input[type="search"]::-webkit-search-cancel-button {
    margin-right: 3px; 
 }
@@ -86,7 +80,6 @@
 input[type="button"], input[type="submit"], input[type="reset"], input[type="file"]::-webkit-file-upload-button, button {
     /* Matches Firefox */
     padding: 0 6px;
-    margin: 0;
 }
 
 /* Windows selects are not rounded. Custom borders for them shouldn't be either. */
@@ -95,17 +88,15 @@
 select[size="0"],
 select[size="1"] {
     -webkit-border-radius: 0;
-    margin: 0;
 }
-/* Options always use the selects' fonts */
+
+/* Option font must be inherited because we depend on computing the size of the
+   <select> based on the size of the options, and they must use the same font
+   for that computation to be correct */
 option {
     font: inherit !important;
 }
 
 textarea {
   font-family: monospace;
-  margin: 1px 0;
-
-  /* Matches IE */
-  padding: 2px;
 }
diff --git a/WebCore/dom/Attr.h b/WebCore/dom/Attr.h
index 9525251..ed4dc07 100644
--- a/WebCore/dom/Attr.h
+++ b/WebCore/dom/Attr.h
@@ -37,7 +37,7 @@
 // destruction. however, this is not yet implemented.
 
 class Attr : public ContainerNode {
-    friend class NamedAttrMap;
+    friend class NamedNodeMap;
 public:
     Attr(Element*, Document*, PassRefPtr<Attribute>);
     ~Attr();
diff --git a/WebCore/dom/Attr.idl b/WebCore/dom/Attr.idl
index ccbfada..29f4be1 100644
--- a/WebCore/dom/Attr.idl
+++ b/WebCore/dom/Attr.idl
@@ -39,7 +39,7 @@
         readonly attribute Element ownerElement;
         
         // extensions
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute CSSStyleDeclaration style;
 #endif
     };
diff --git a/WebCore/dom/Attribute.h b/WebCore/dom/Attribute.h
index 2b2863f..b06d120 100644
--- a/WebCore/dom/Attribute.h
+++ b/WebCore/dom/Attribute.h
@@ -32,14 +32,14 @@
 class Attr;
 class CSSStyleDeclaration;
 class Element;
-class NamedAttrMap;
+class NamedNodeMap;
 
 // This has no counterpart in DOM.
 // It is an internal representation of the node value of an Attr.
 // The actual Attr with its value as a Text child is allocated only if needed.
 class Attribute : public RefCounted<Attribute> {
     friend class Attr;
-    friend class NamedAttrMap;
+    friend class NamedNodeMap;
 public:
     static PassRefPtr<Attribute> create(const QualifiedName& name, const AtomicString& value)
     {
diff --git a/WebCore/dom/CharacterData.cpp b/WebCore/dom/CharacterData.cpp
index 54e1888..9a72de9 100644
--- a/WebCore/dom/CharacterData.cpp
+++ b/WebCore/dom/CharacterData.cpp
@@ -198,7 +198,7 @@
         parentNode()->childrenChanged();
     if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER)) {
         ExceptionCode ec;
-        dispatchEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, false, 0, prevValue, m_data, String(), 0), ec);
+        dispatchMutationEvent(eventNames().DOMCharacterDataModifiedEvent, true, 0, prevValue, m_data, ec); 
     }
     dispatchSubtreeModifiedEvent();
 }
diff --git a/WebCore/dom/CheckedRadioButtons.cpp b/WebCore/dom/CheckedRadioButtons.cpp
new file mode 100644
index 0000000..9883f58
--- /dev/null
+++ b/WebCore/dom/CheckedRadioButtons.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "CheckedRadioButtons.h"
+
+#include "HTMLInputElement.h"
+
+namespace WebCore {
+
+void CheckedRadioButtons::addButton(HTMLFormControlElement* element)
+{
+    // We only want to add radio buttons.
+    if (!element->isRadioButton())
+        return;
+
+    // Without a name, there is no group.
+    if (element->name().isEmpty())
+        return;
+
+    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
+
+    // We only track checked buttons.
+    if (!inputElement->checked())
+        return;
+
+    if (!m_nameToCheckedRadioButtonMap)
+        m_nameToCheckedRadioButtonMap.set(new NameToInputMap);
+
+    pair<NameToInputMap::iterator, bool> result = m_nameToCheckedRadioButtonMap->add(element->name().impl(), inputElement);
+    if (result.second)
+        return;
+    
+    HTMLInputElement* oldCheckedButton = result.first->second;
+    if (oldCheckedButton == inputElement)
+        return;
+
+    result.first->second = inputElement;
+    oldCheckedButton->setChecked(false);
+}
+
+HTMLInputElement* CheckedRadioButtons::checkedButtonForGroup(const AtomicString& name) const
+{
+    if (!m_nameToCheckedRadioButtonMap)
+        return 0;
+    
+    return m_nameToCheckedRadioButtonMap->get(name.impl());
+}
+
+void CheckedRadioButtons::removeButton(HTMLFormControlElement* element)
+{
+    if (element->name().isEmpty() || !m_nameToCheckedRadioButtonMap)
+        return;
+    
+    NameToInputMap::iterator it = m_nameToCheckedRadioButtonMap->find(element->name().impl());
+    if (it == m_nameToCheckedRadioButtonMap->end() || it->second != element)
+        return;
+    
+    InputElement* inputElement = toInputElement(element);
+    ASSERT_UNUSED(inputElement, inputElement);
+    ASSERT(inputElement->isChecked());
+    ASSERT(element->isRadioButton());
+
+    m_nameToCheckedRadioButtonMap->remove(it);
+    if (m_nameToCheckedRadioButtonMap->isEmpty())
+        m_nameToCheckedRadioButtonMap.clear();
+}
+
+} // namespace
diff --git a/WebCore/dom/CheckedRadioButtons.h b/WebCore/dom/CheckedRadioButtons.h
new file mode 100644
index 0000000..5a57955
--- /dev/null
+++ b/WebCore/dom/CheckedRadioButtons.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef CheckedRadioButtons_h
+#define CheckedRadioButtons_h
+
+#include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+class AtomicString;
+class AtomicStringImpl;
+class HTMLInputElement;
+class HTMLFormControlElement;
+
+class CheckedRadioButtons {
+public:
+    void addButton(HTMLFormControlElement*);
+    void removeButton(HTMLFormControlElement*);
+    HTMLInputElement* checkedButtonForGroup(const AtomicString& groupName) const;
+
+private:
+    typedef HashMap<AtomicStringImpl*, HTMLInputElement*> NameToInputMap;
+    OwnPtr<NameToInputMap> m_nameToCheckedRadioButtonMap;
+};
+
+} // namespace WebCore
+
+#endif // CheckedRadioButtons_h
diff --git a/WebCore/dom/ClassNames.h b/WebCore/dom/ClassNames.h
index 7992d54..8f4852f 100644
--- a/WebCore/dom/ClassNames.h
+++ b/WebCore/dom/ClassNames.h
@@ -56,8 +56,8 @@
 
         typedef Vector<AtomicString, 8> ClassNameVector;
         String m_string;
-        bool m_shouldFoldCase;
         ClassNameVector m_vector;
+        bool m_shouldFoldCase;
         bool m_createdVector;
     };
 
diff --git a/WebCore/dom/ContainerNode.cpp b/WebCore/dom/ContainerNode.cpp
index 91b633f..2573908 100644
--- a/WebCore/dom/ContainerNode.cpp
+++ b/WebCore/dom/ContainerNode.cpp
@@ -23,6 +23,7 @@
 #include "config.h"
 #include "ContainerNode.h"
 
+#include "Cache.h"
 #include "ContainerNodeAlgorithms.h"
 #include "DeleteButtonController.h"
 #include "EventNames.h"
@@ -35,6 +36,7 @@
 #include "Page.h"
 #include "RenderTheme.h"
 #include "RootInlineBox.h"
+#include "loader.h"
 #include <wtf/CurrentTime.h>
 
 namespace WebCore {
@@ -155,7 +157,6 @@
         child = nextChild.release();
     }
 
-    document()->setDocumentChanged(true);
     dispatchSubtreeModifiedEvent();
     return true;
 }
@@ -268,7 +269,6 @@
         child = nextChild.release();
     }
 
-    document()->setDocumentChanged(true);
     if (childCountDelta)
         childrenChanged(false, prev.get(), next.get(), childCountDelta);
     dispatchSubtreeModifiedEvent();
@@ -362,8 +362,6 @@
 
     allowEventDispatch();
 
-    document()->setDocumentChanged(true);
-
     // Dispatch post-removal mutation events
     childrenChanged(false, prev, next, -1);
     dispatchSubtreeModifiedEvent();
@@ -495,13 +493,13 @@
         child = nextChild.release();
     }
 
-    document()->setDocumentChanged(true);
     dispatchSubtreeModifiedEvent();
     return true;
 }
 
 ContainerNode* ContainerNode::addChild(PassRefPtr<Node> newChild)
 {
+    ASSERT(newChild);
     // This function is only used during parsing.
     // It does not send any DOM mutation events.
 
@@ -534,6 +532,7 @@
                 s_shouldReEnableMemoryCacheCallsAfterAttach = true;
             }
         }
+        cache()->loader()->suspendPendingRequests();
     }
     ++s_attachDepth;
 }
@@ -548,6 +547,7 @@
             if (Page* page = document()->page())
                 page->setMemoryCacheClientCallsEnabled(true);
         }
+        cache()->loader()->resumePendingRequests();
     }
     --s_attachDepth;
 }
@@ -576,20 +576,16 @@
 
 void ContainerNode::attach()
 {
-    suspendPostAttachCallbacks();
-
     for (Node* child = m_firstChild; child; child = child->nextSibling())
         child->attach();
     Node::attach();
-
-    resumePostAttachCallbacks();
 }
 
 void ContainerNode::detach()
 {
     for (Node* child = m_firstChild; child; child = child->nextSibling())
         child->detach();
-    setHasChangedChild(false);
+    setChildNeedsStyleRecalc(false);
     Node::detach();
 }
 
@@ -786,7 +782,7 @@
     Node::setFocus(received);
 
     // note that we need to recalc the style
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void ContainerNode::setActive(bool down, bool pause)
@@ -800,7 +796,7 @@
     if (renderer()) {
         bool reactsToPress = renderer()->style()->affectedByActiveRules();
         if (reactsToPress)
-            setChanged();
+            setNeedsStyleRecalc();
         if (renderer() && renderer()->style()->hasAppearance()) {
             if (theme()->stateChanged(renderer(), PressedState))
                 reactsToPress = true;
@@ -815,7 +811,7 @@
 #endif
 
             // Ensure there are no pending changes
-            Document::updateDocumentsRendering();
+            Document::updateStyleForAllDocuments();
             // Do an immediate repaint.
             if (renderer())
                 renderer()->repaint(true);
@@ -842,7 +838,7 @@
     // FIXME: Move to Element
     if (renderer()) {
         if (renderer()->style()->affectedByHoverRules())
-            setChanged();
+            setNeedsStyleRecalc();
         if (renderer() && renderer()->style()->hasAppearance())
             theme()->stateChanged(renderer(), HoverState);
     }
@@ -882,8 +878,7 @@
 
     if (c->parentNode() && doc->hasListenerType(Document::DOMNODEINSERTED_LISTENER)) {
         ec = 0;
-        c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedEvent, true, false,
-            c->parentNode(), String(), String(), String(), 0), ec);
+        c->dispatchMutationEvent(eventNames().DOMNodeInsertedEvent, true, c->parentNode(), String(), String(), ec); 
         if (ec)
             return;
     }
@@ -892,8 +887,7 @@
     if (c->inDocument() && doc->hasListenerType(Document::DOMNODEINSERTEDINTODOCUMENT_LISTENER))
         for (; c; c = c->traverseNextNode(child)) {
             ec = 0;
-            c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedIntoDocumentEvent, false, false,
-                0, String(), String(), String(), 0), ec);
+            c->dispatchMutationEvent(eventNames().DOMNodeInsertedIntoDocumentEvent, false, 0, String(), String(), ec); 
             if (ec)
                 return;
         }
@@ -912,8 +906,7 @@
     // dispatch pre-removal mutation events
     if (c->parentNode() && doc->hasListenerType(Document::DOMNODEREMOVED_LISTENER)) {
         ec = 0;
-        c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedEvent, true, false,
-            c->parentNode(), String(), String(), String(), 0), ec);
+        c->dispatchMutationEvent(eventNames().DOMNodeRemovedEvent, true, c->parentNode(), String(), String(), ec); 
         if (ec)
             return;
     }
@@ -922,8 +915,7 @@
     if (c->inDocument() && doc->hasListenerType(Document::DOMNODEREMOVEDFROMDOCUMENT_LISTENER))
         for (; c; c = c->traverseNextNode(child)) {
             ec = 0;
-            c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedFromDocumentEvent, false, false,
-                0, String(), String(), String(), 0), ec);
+            c->dispatchMutationEvent(eventNames().DOMNodeRemovedFromDocumentEvent, false, 0, String(), String(), ec); 
             if (ec)
                 return;
         }
diff --git a/WebCore/dom/DOMCoreException.idl b/WebCore/dom/DOMCoreException.idl
index c9ac356..3001995 100644
--- a/WebCore/dom/DOMCoreException.idl
+++ b/WebCore/dom/DOMCoreException.idl
@@ -36,7 +36,7 @@
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
@@ -66,6 +66,13 @@
         const unsigned short      VALIDATION_ERR                 = 16;
         // Introduced in DOM Level 3:
         const unsigned short      TYPE_MISMATCH_ERR              = 17;
+        // Introduced as an XHR extension:
+        const unsigned short      SECURITY_ERR                   = 18;
+        // Introduced in HTML5:
+        const unsigned short      NETWORK_ERR                    = 19;
+        const unsigned short      ABORT_ERR                      = 20;
+        const unsigned short      URL_MISMATCH_ERR               = 21;
+        const unsigned short      QUOTA_EXCEEDED_ERR             = 22;
     };
 
 }
diff --git a/WebCore/dom/DOMImplementation.cpp b/WebCore/dom/DOMImplementation.cpp
index 4f29f96..783c629 100644
--- a/WebCore/dom/DOMImplementation.cpp
+++ b/WebCore/dom/DOMImplementation.cpp
@@ -4,7 +4,7 @@
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig (sam@webkit.org)
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -76,7 +76,7 @@
     static bool initialized = false;
     DEFINE_STATIC_LOCAL(FeatureSet, svgFeatures, ());
     if (!initialized) {
-#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(SVG_FILTER) && ENABLE(SVG_FONTS)
+#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(FILTERS) && ENABLE(SVG_FONTS)
         addString(svgFeatures, "svg");
         addString(svgFeatures, "svg.static");
 #endif
@@ -84,7 +84,7 @@
 //      addString(svgFeatures, "svg.dynamic");
 //      addString(svgFeatures, "svg.dom.animation");
 //      addString(svgFeatures, "svg.dom.dynamic");
-#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(SVG_FILTER) && ENABLE(SVG_FONTS)
+#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(FILTERS) && ENABLE(SVG_FONTS)
         addString(svgFeatures, "dom");
         addString(svgFeatures, "dom.svg");
         addString(svgFeatures, "dom.svg.static");
@@ -104,7 +104,7 @@
         // Sadly, we cannot claim to implement any of the SVG 1.1 generic feature sets
         // lack of Font and Filter support.
         // http://bugs.webkit.org/show_bug.cgi?id=15480
-#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(SVG_FILTER) && ENABLE(SVG_FONTS)
+#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(FILTERS) && ENABLE(SVG_FONTS)
         addString(svgFeatures, "SVG");
         addString(svgFeatures, "SVGDOM");
         addString(svgFeatures, "SVG-static");
@@ -141,7 +141,7 @@
         addString(svgFeatures, "Clip");
         addString(svgFeatures, "BasicClip");
         addString(svgFeatures, "Mask");
-#if ENABLE(SVG_FILTER)
+#if ENABLE(FILTERS)
 //      addString(svgFeatures, "Filter");
         addString(svgFeatures, "BasicFilter");
 #endif
@@ -250,9 +250,10 @@
         doc->addChild(doctype);
 
     if (!qualifiedName.isEmpty()) {
-        doc->addChild(doc->createElementNS(namespaceURI, qualifiedName, ec));
-        if (ec != 0)
+        RefPtr<Node> documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
+        if (ec)
             return 0;
+        doc->addChild(documentElement.release());
     }
 
     // Hixie's interpretation of the DOM Core spec suggests we should prefer
@@ -314,14 +315,22 @@
 PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame* frame, bool inViewSourceMode)
 {
     if (inViewSourceMode) {
-        if (type == "text/html" || type == "application/xhtml+xml" || type == "image/svg+xml" || isTextMIMEType(type) || isXMLMIMEType(type))
+        if (type == "text/html" || type == "application/xhtml+xml" || type == "image/svg+xml" || isTextMIMEType(type) || isXMLMIMEType(type)
+#if ENABLE(XHTMLMP)
+            || type == "application/vnd.wap.xhtml+xml"
+#endif
+           )
             return HTMLViewSourceDocument::create(frame, type);
     }
 
     // Plugins cannot take HTML and XHTML from us, and we don't even need to initialize the plugin database for those.
     if (type == "text/html")
         return HTMLDocument::create(frame);
-    if (type == "application/xhtml+xml")
+    if (type == "application/xhtml+xml"
+#if ENABLE(XHTMLMP)
+        || type == "application/vnd.wap.xhtml+xml"
+#endif
+        )
         return Document::createXHTML(frame);
 
 #if ENABLE(WML)
diff --git a/WebCore/dom/DOMImplementation.idl b/WebCore/dom/DOMImplementation.idl
index 94d75fb..6f4df80 100644
--- a/WebCore/dom/DOMImplementation.idl
+++ b/WebCore/dom/DOMImplementation.idl
@@ -44,7 +44,7 @@
 
         // DOMImplementationCSS interface from DOM Level 2 CSS
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         [OldStyleObjC] CSSStyleSheet createCSSStyleSheet(in DOMString title,
                                                          in DOMString media)
             raises(DOMException);
diff --git a/WebCore/dom/Document.cpp b/WebCore/dom/Document.cpp
index e280c81..ec8dfee 100644
--- a/WebCore/dom/Document.cpp
+++ b/WebCore/dom/Document.cpp
@@ -4,7 +4,7 @@
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 David Levin (levin@chromium.org)
  *
  * This library is free software; you can redistribute it and/or
@@ -25,8 +25,9 @@
 #include "config.h"
 #include "Document.h"
 
-#include "AnimationController.h"
 #include "AXObjectCache.h"
+#include "AnimationController.h"
+#include "Attr.h"
 #include "CDATASection.h"
 #include "CSSHelper.h"
 #include "CSSStyleSelector.h"
@@ -59,6 +60,7 @@
 #include "HTMLAnchorElement.h"
 #include "HTMLBodyElement.h"
 #include "HTMLCanvasElement.h"
+#include "HTMLCollection.h"
 #include "HTMLDocument.h"
 #include "HTMLElementFactory.h"
 #include "HTMLFrameOwnerElement.h"
@@ -68,6 +70,7 @@
 #include "HTMLMapElement.h"
 #include "HTMLNameCollection.h"
 #include "HTMLNames.h"
+#include "HTMLParser.h"
 #include "HTMLStyleElement.h"
 #include "HTMLTitleElement.h"
 #include "HTTPParsers.h"
@@ -76,8 +79,10 @@
 #include "HitTestResult.h"
 #include "ImageLoader.h"
 #include "InspectorController.h"
+#include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
+#include "MappedAttribute.h"
 #include "MessageEvent.h"
 #include "MouseEvent.h"
 #include "MouseEventWithHitTestResults.h"
@@ -97,6 +102,7 @@
 #include "RenderView.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
+#include "ScriptElement.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "SelectionController.h"
@@ -105,8 +111,8 @@
 #include "TextEvent.h"
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
-#include "TreeWalker.h"
 #include "Timer.h"
+#include "TreeWalker.h"
 #include "UIEvent.h"
 #include "WebKitAnimationEvent.h"
 #include "WebKitTransitionEvent.h"
@@ -114,15 +120,11 @@
 #include "XMLHttpRequest.h"
 #include "XMLNames.h"
 #include "XMLTokenizer.h"
-#if USE(JSC)
-#include "JSDOMBinding.h"
-#endif
-#include "ScriptController.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/HashFunctions.h>
 #include <wtf/MainThread.h>
-#include <wtf/StdLibExtras.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/StdLibExtras.h>
 
 #if ENABLE(DATABASE)
 #include "Database.h"
@@ -182,6 +184,10 @@
 #include "WMLNames.h"
 #endif
 
+#if ENABLE(XHTMLMP)
+#include "HTMLNoScriptElement.h"
+#endif
+
 using namespace std;
 using namespace WTF;
 using namespace Unicode;
@@ -307,16 +313,18 @@
 #endif
 }
 
-static HashSet<Document*>* changedDocuments = 0;
+static HashSet<Document*>* documentsThatNeedStyleRecalc = 0;
 
 Document::Document(Frame* frame, bool isXHTML)
     : ContainerNode(0)
     , m_domtree_version(0)
     , m_styleSheets(StyleSheetList::create(this))
+    , m_styleRecalcTimer(this, &Document::styleRecalcTimerFired)
     , m_frameElementsShouldIgnoreScrolling(false)
     , m_title("")
     , m_titleSetExplicitly(false)
     , m_updateFocusAppearanceTimer(this, &Document::updateFocusAppearanceTimerFired)
+    , m_executeScriptSoonTimer(this, &Document::executeScriptSoonTimerFired)
 #if ENABLE(XSLT)
     , m_transformSource(0)
 #endif
@@ -358,14 +366,13 @@
 
     m_frame = frame;
     m_renderArena = 0;
-
+#if !PLATFORM(ANDROID)
     m_axObjectCache = 0;
-    
+#endif    
     m_docLoader = new DocLoader(this);
 
     visuallyOrdered = false;
     m_bParsing = false;
-    m_docChanged = false;
     m_tokenizer = 0;
     m_wellFormed = false;
 
@@ -405,6 +412,9 @@
 
     static int docID = 0;
     m_docID = docID++;
+#if ENABLE(XHTMLMP)
+    m_shouldProcessNoScriptElement = settings() && !settings()->isJavaScriptEnabled();
+#endif
 }
 
 void Document::removedLastRef()
@@ -454,16 +464,17 @@
     ASSERT(!m_inPageCache);
     ASSERT(!m_savedRenderer);
     ASSERT(m_ranges.isEmpty());
+    ASSERT(!m_styleRecalcTimer.isActive());
+
+    for (size_t i = 0; i < m_scriptsToExecuteSoon.size(); ++i)
+        m_scriptsToExecuteSoon[i].first->element()->deref(); // Balances ref() in executeScriptSoon().
 
     removeAllEventListeners();
 
-
 #if USE(JSC)
     forgetAllDOMNodesForDocument(this);
 #endif
 
-    if (m_docChanged && changedDocuments)
-        changedDocuments->remove(this);
     delete m_tokenizer;
     m_document.resetSkippingRef(0);
     delete m_styleSelector;
@@ -661,7 +672,7 @@
             if (ec)
                 return 0;
 
-            NamedAttrMap* attrs = oldElement->attributes(true);
+            NamedNodeMap* attrs = oldElement->attributes(true);
             if (attrs) {
                 unsigned length = attrs->length();
                 for (unsigned i = 0; i < length; i++) {
@@ -796,14 +807,19 @@
         e = SVGElementFactory::createSVGElement(qName, this, createdByParser);
 #endif
 #if ENABLE(WML)
-    else if (qName.namespaceURI() == WMLNames::wmlNamespaceURI || isWMLDocument())
+    else if (qName.namespaceURI() == WMLNames::wmlNamespaceURI)
         e = WMLElementFactory::createWMLElement(qName, this, createdByParser);
+    else if (isWMLDocument())
+        e = WMLElementFactory::createWMLElement(QualifiedName(nullAtom, qName.localName(), WMLNames::wmlNamespaceURI), this, createdByParser);
 #endif
     
     if (!e)
         e = new Element(qName, document());
 
     // <image> uses imgTag so we need a special rule.
+#if ENABLE(WML)
+    if (!isWMLDocument())
+#endif
     ASSERT((qName.matches(imageTag) && e->tagQName().matches(imgTag) && e->tagQName().prefix() == qName.prefix()) || qName == e->tagQName());
 
     return e.release();
@@ -867,7 +883,7 @@
 String Document::encoding() const
 {
     if (TextResourceDecoder* d = decoder())
-        return d->encoding().name();
+        return d->encoding().domName();
     return String();
 }
 
@@ -1103,24 +1119,39 @@
     return TreeWalker::create(root, whatToShow, filter, expandEntityReferences);
 }
 
-void Document::setDocumentChanged(bool b)
+void Document::scheduleStyleRecalc()
 {
-    if (b) {
-        if (!m_docChanged) {
-            if (!changedDocuments)
-                changedDocuments = new HashSet<Document*>;
-            changedDocuments->add(this);
-        }
-        if (m_accessKeyMapValid) {
-            m_accessKeyMapValid = false;
-            m_elementsByAccessKey.clear();
-        }
-    } else {
-        if (m_docChanged && changedDocuments)
-            changedDocuments->remove(this);
-    }
+    if (m_styleRecalcTimer.isActive() || inPageCache())
+        return;
 
-    m_docChanged = b;
+    ASSERT(childNeedsStyleRecalc());
+
+    if (!documentsThatNeedStyleRecalc)
+        documentsThatNeedStyleRecalc = new HashSet<Document*>;
+    documentsThatNeedStyleRecalc->add(this);
+    
+    // FIXME: Why on earth is this here? This is clearly misplaced.
+    if (m_accessKeyMapValid) {
+        m_accessKeyMapValid = false;
+        m_elementsByAccessKey.clear();
+    }
+    
+    m_styleRecalcTimer.startOneShot(0);
+}
+
+void Document::unscheduleStyleRecalc()
+{
+    ASSERT(!childNeedsStyleRecalc());
+
+    if (documentsThatNeedStyleRecalc)
+        documentsThatNeedStyleRecalc->remove(this);
+
+    m_styleRecalcTimer.stop();
+}
+
+void Document::styleRecalcTimerFired(Timer<Document>*)
+{
+    updateStyleIfNeeded();
 }
 
 void Document::recalcStyle(StyleChange change)
@@ -1183,28 +1214,26 @@
     }
 
     for (Node* n = firstChild(); n; n = n->nextSibling())
-        if (change >= Inherit || n->hasChangedChild() || n->changed())
+        if (change >= Inherit || n->childNeedsStyleRecalc() || n->needsStyleRecalc())
             n->recalcStyle(change);
 
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::record(android::TimeCounter::CalculateStyleTimeCounter, __FUNCTION__);
 #endif
 
-    if (view()) {
-        if (changed())
-            view()->layout();
 #if USE(ACCELERATED_COMPOSITING)
-        else {
-            // If we didn't update compositing layers because of layout(), we need to do so here.
+    if (view()) {
+        bool layoutPending = view()->layoutPending() || renderer()->needsLayout();
+        // If we didn't update compositing layers because of layout(), we need to do so here.
+        if (!layoutPending)
             view()->updateCompositingLayers();
-        }
-#endif
     }
+#endif
 
 bail_out:
-    setChanged(NoStyleChange);
-    setHasChangedChild(false);
-    setDocumentChanged(false);
+    setNeedsStyleRecalc(NoStyleChange);
+    setChildNeedsStyleRecalc(false);
+    unscheduleStyleRecalc();
 
     if (view())
         view()->resumeScheduledEvents();
@@ -1218,9 +1247,9 @@
     }
 }
 
-void Document::updateRendering()
+void Document::updateStyleIfNeeded()
 {
-    if (!hasChangedChild() || inPageCache())
+    if (!childNeedsStyleRecalc() || inPageCache())
         return;
         
     if (m_frame)
@@ -1228,23 +1257,22 @@
         
     recalcStyle(NoChange);
     
-    // Tell the animation controller that updateRendering is finished and it can do any post-processing
+    // Tell the animation controller that updateStyleIfNeeded is finished and it can do any post-processing
     if (m_frame)
         m_frame->animation()->endAnimationUpdate();
 }
 
-void Document::updateDocumentsRendering()
+void Document::updateStyleForAllDocuments()
 {
-    if (!changedDocuments)
+    if (!documentsThatNeedStyleRecalc)
         return;
 
-    while (changedDocuments->size()) {
-        HashSet<Document*>::iterator it = changedDocuments->begin();
+    while (documentsThatNeedStyleRecalc->size()) {
+        HashSet<Document*>::iterator it = documentsThatNeedStyleRecalc->begin();
         Document* doc = *it;
-        changedDocuments->remove(it);
-        
-        doc->m_docChanged = false;
-        doc->updateRendering();
+        documentsThatNeedStyleRecalc->remove(doc);
+        ASSERT(doc->childNeedsStyleRecalc() && !doc->inPageCache());
+        doc->updateStyleIfNeeded();
     }
 }
 
@@ -1253,7 +1281,7 @@
     if (Element* oe = ownerElement())
         oe->document()->updateLayout();
 
-    updateRendering();
+    updateStyleIfNeeded();
 
     // Only do a layout if changes have occurred that make it necessary.      
     FrameView* v = view();
@@ -1298,8 +1326,9 @@
 {
     ASSERT(!attached());
     ASSERT(!m_inPageCache);
+#if !PLATFORM(ANDROID)    
     ASSERT(!m_axObjectCache);
-
+#endif
     if (!m_renderArena)
         m_renderArena = new RenderArena();
     
@@ -1349,14 +1378,17 @@
 
     ContainerNode::detach();
 
+    unscheduleStyleRecalc();
+
     if (render)
         render->destroy();
     
     // This is required, as our Frame might delete itself as soon as it detaches
-    // us.  However, this violates Node::detach() symantics, as it's never
-    // possible to re-attach.  Eventually Document::detach() should be renamed
-    // or this call made explicit in each of the callers of Document::detach().
-    clearFramePointer();
+    // us. However, this violates Node::detach() symantics, as it's never
+    // possible to re-attach. Eventually Document::detach() should be renamed,
+    // or this setting of the frame to 0 could be made explicit in each of the
+    // callers of Document::detach().
+    m_frame = 0;
     
     if (m_renderArena) {
         delete m_renderArena;
@@ -1364,17 +1396,10 @@
     }
 }
 
-void Document::clearFramePointer()
+void Document::removeAllEventListeners()
 {
-    m_frame = 0;
-}
-
-void Document::removeAllEventListenersFromAllNodes()
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i)
-        m_windowEventListeners[i]->setRemoved(true);
-    m_windowEventListeners.clear();
+    if (DOMWindow* domWindow = this->domWindow())
+        domWindow->removeAllEventListeners();
     removeAllDisconnectedNodeEventListeners();
     for (Node* node = this; node; node = node->traverseNextNode())
         node->removeAllEventListeners();
@@ -1405,6 +1430,9 @@
 
 void Document::clearAXObjectCache()
 {
+#if PLATFORM(ANDROID)
+    return;
+#else
     // clear cache in top document
     if (m_axObjectCache) {
         delete m_axObjectCache;
@@ -1416,10 +1444,14 @@
     Document* doc = topDocument();
     if (doc != this)
         doc->clearAXObjectCache();
+#endif
 }
 
 AXObjectCache* Document::axObjectCache() const
 {
+#if PLATFORM(ANDROID)
+    return 0;
+#else
     // The only document that actually has a AXObjectCache is the top-level
     // document.  This is because we need to be able to get from any WebCoreAXObject
     // to any other WebCoreAXObject on the same page.  Using a single cache allows
@@ -1453,6 +1485,7 @@
     // this is the top-level document, so install a new cache
     m_axObjectCache = new AXObjectCache;
     return m_axObjectCache;
+#endif // ANDROID
 }
 
 void Document::setVisuallyOrdered()
@@ -1510,6 +1543,11 @@
     clear();
     m_tokenizer = createTokenizer();
     setParsing(true);
+
+    // If we reload, the animation controller sticks around and has
+    // a stale animation time. We need to update it here.
+    if (m_frame && m_frame->animation())
+        m_frame->animation()->beginAnimationUpdate();
 }
 
 HTMLElement* Document::body() const
@@ -1599,10 +1637,16 @@
     // Parser should have picked up all preloads by now
     m_docLoader->clearPreloads();
 
-    // Create a body element if we don't already have one. See Radar 3758785.
+    // Create a head and a body if we don't have those yet (e.g. for about:blank).
     if (!this->body() && isHTMLDocument()) {
         if (Node* documentElement = this->documentElement()) {
             ExceptionCode ec = 0;
+            
+            // The implicit <head> isn't expected in older versions of Mail - <rdar://problem/6863795>
+            if (!head() && shouldCreateImplicitHead(this)) {
+                documentElement->appendChild(new HTMLHeadElement(headTag, this), ec);
+                ASSERT(!ec);
+            }
             documentElement->appendChild(new HTMLBodyElement(bodyTag, this), ec);
             ASSERT(!ec);
         }
@@ -1623,7 +1667,7 @@
         f->animation()->resumeAnimations(this);
 
     ImageLoader::dispatchPendingLoadEvents();
-    dispatchWindowEvent(eventNames().loadEvent, false, false);
+    dispatchLoadEvent();
     if (f)
         f->loader()->handledOnloadEvents();
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
@@ -1650,30 +1694,21 @@
 
     frame()->loader()->checkCallImplicitClose();
 
-    // Now do our painting/layout, but only if we aren't in a subframe or if we're in a subframe
-    // that has been sized already.  Otherwise, our view size would be incorrect, so doing any 
-    // layout/painting now would be pointless.
+    // We used to force a synchronous display and flush here.  This really isn't
+    // necessary and can in fact be actively harmful if pages are loading at a rate of > 60fps
+    // (if your platform is syncing flushes and limiting them to 60fps).
+    m_overMinimumLayoutThreshold = true;
     if (!ownerElement() || (ownerElement()->renderer() && !ownerElement()->renderer()->needsLayout())) {
-        updateRendering();
+        updateStyleIfNeeded();
         
         // Always do a layout after loading if needed.
         if (view() && renderer() && (!renderer()->firstChild() || renderer()->needsLayout()))
             view()->layout();
-            
-        // Paint immediately after the document is ready.  We do this to ensure that any timers set by the
-        // onload don't have a chance to fire before we would have painted.  To avoid over-flushing we only
-        // worry about this for the top-level document.  For platforms that use native widgets for ScrollViews, this
-        // call does nothing (Mac, wx).
-        // FIXME: This causes a timing issue with the dispatchDidFinishLoad delegate callback on Mac, so think
-        // before enabling it, even if Mac becomes viewless later.
-        // See <rdar://problem/5092361>
-        if (view() && !ownerElement())
-            view()->hostWindow()->paint();
     }
 
 #if PLATFORM(MAC)
     if (f && renderer() && this == topDocument() && AXObjectCache::accessibilityEnabled())
-        axObjectCache()->postNotificationToElement(renderer(), "AXLoadComplete");
+        axObjectCache()->postNotification(renderer(), "AXLoadComplete", true);
 #endif
 
 #if ENABLE(SVG)
@@ -1778,11 +1813,8 @@
     m_tokenizer = 0;
 
     removeChildren();
-
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i)
-        m_windowEventListeners[i]->setRemoved(true);
-    m_windowEventListeners.clear();
+    if (DOMWindow* domWindow = this->domWindow())
+        domWindow->removeAllEventListeners();
 }
 
 const KURL& Document::virtualURL() const
@@ -2071,11 +2103,11 @@
 }
 #endif
 
-void Document::processHttpEquiv(const String &equiv, const String &content)
+void Document::processHttpEquiv(const String& equiv, const String& content)
 {
     ASSERT(!equiv.isNull() && !content.isNull());
 
-    Frame *frame = this->frame();
+    Frame* frame = this->frame();
 
     if (equalIgnoringCase(equiv, "default-style")) {
         // The preferred style set has been overridden as per section 
@@ -2105,6 +2137,13 @@
         setContentLanguage(content);
     else if (equalIgnoringCase(equiv, "x-dns-prefetch-control"))
         parseDNSPrefetchControlHeader(content);
+    else if (equalIgnoringCase(equiv, "x-frame-options")) {
+        FrameLoader* frameLoader = frame->loader();
+        if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
+            frameLoader->stopAllLoaders();
+            frameLoader->scheduleHTTPRedirection(0, blankURL());
+        }
+    }
 }
 
 MouseEventWithHitTestResults Document::prepareMouseEvent(const HitTestRequest& request, const IntPoint& documentPoint, const PlatformMouseEvent& event)
@@ -2118,7 +2157,7 @@
     renderView()->layer()->hitTest(request, result);
 
     if (!request.readOnly())
-        updateRendering();
+        updateStyleIfNeeded();
 
     return MouseEventWithHitTestResults(event, result);
 }
@@ -2574,7 +2613,7 @@
         // Dispatch a change event for text fields or textareas that have been edited
         RenderObject* r = static_cast<RenderObject*>(oldFocusedNode.get()->renderer());
         if (r && r->isTextControl() && toRenderTextControl(r)->isEdited()) {
-            oldFocusedNode->dispatchEventForType(eventNames().changeEvent, true, false);
+            oldFocusedNode->dispatchEvent(eventNames().changeEvent, true, false);
             if ((r = static_cast<RenderObject*>(oldFocusedNode.get()->renderer()))) {
                 if (r->isTextControl())
                     toRenderTextControl(r)->setEdited(false);
@@ -2649,23 +2688,45 @@
         }
    }
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !PLATFORM(CHROMIUM)
     if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled())
         axObjectCache()->handleFocusedUIElementChanged();
+#elif PLATFORM(GTK)
+    if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled()) {
+        RenderObject* oldFocusedRenderer = 0;
+        RenderObject* newFocusedRenderer = 0;
+
+        if (oldFocusedNode)
+            oldFocusedRenderer = oldFocusedNode.get()->renderer();
+        if (newFocusedNode)
+            newFocusedRenderer = newFocusedNode.get()->renderer();
+
+        axObjectCache()->handleFocusedUIElementChangedWithRenderers(oldFocusedRenderer, newFocusedRenderer);
+    }
 #endif
 
 SetFocusedNodeDone:
-    updateRendering();
+    updateStyleIfNeeded();
     return !focusChangeBlocked;
-  }
+}
+    
+void Document::getFocusableNodes(Vector<RefPtr<Node> >& nodes)
+{
+    updateLayout();
+
+    for (Node* node = firstChild(); node; node = node->traverseNextNode()) {
+        if (node->isFocusable())
+            nodes.append(node);
+    }
+}
   
 void Document::setCSSTarget(Element* n)
 {
     if (m_cssTarget)
-        m_cssTarget->setChanged();
+        m_cssTarget->setNeedsStyleRecalc();
     m_cssTarget = n;
     if (n)
-        n->setChanged();
+        n->setNeedsStyleRecalc();
 }
 
 void Document::attachNodeIterator(NodeIterator *ni)
@@ -2758,9 +2819,51 @@
 {
     if (!frame())
         return 0;
+
+    // The m_frame pointer is not (not always?) zeroed out when the document is put into b/f cache, so the frame can hold an unrelated document/window pair.
+    // FIXME: We should always zero out the frame pointer on navigation to avoid accidentally accessing the new frame content.
+    if (m_frame->document() != this)
+        return 0;
+
     return frame()->domWindow();
 }
 
+void Document::setWindowAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+{
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    domWindow->setAttributeEventListener(eventType, listener);
+}
+
+void Document::dispatchWindowEvent(PassRefPtr<Event> event)
+{
+    ASSERT(!eventDispatchForbidden());
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    ExceptionCode ec;
+    domWindow->dispatchEvent(event, ec);
+}
+
+void Document::dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
+{
+    ASSERT(!eventDispatchForbidden());
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    domWindow->dispatchEvent(eventType, canBubbleArg, cancelableArg);
+}
+
+void Document::dispatchLoadEvent()
+{
+    ASSERT(!eventDispatchForbidden());
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    domWindow->dispatchLoadEvent();
+}
+
 PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
 {
     if (eventType == "Event" || eventType == "Events" || eventType == "HTMLEvents")
@@ -2838,141 +2941,6 @@
     return 0;
 }
 
-void Document::handleWindowEvent(Event* event, bool useCapture)
-{
-    if (m_windowEventListeners.isEmpty())
-        return;
-        
-    // If any HTML event listeners are registered on the window, dispatch them here.
-    RegisteredEventListenerVector listenersCopy = m_windowEventListeners;
-    size_t size = listenersCopy.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listenersCopy[i];
-        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
-            r.listener()->handleEvent(event, true);
-    }
-}
-
-void Document::setWindowInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener> listener)
-{
-    // If we already have it we don't want removeWindowEventListener to delete it
-    removeWindowInlineEventListenerForType(eventType);
-    if (listener)
-        addWindowEventListener(eventType, listener, false);
-}
-
-EventListener* Document::windowInlineEventListenerForType(const AtomicString& eventType)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_windowEventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isInline())
-            return r.listener();
-    }
-    return 0;
-}
-
-void Document::removeWindowInlineEventListenerForType(const AtomicString& eventType)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_windowEventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isInline()) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingFrameUnloadEventCount();
-            else if (eventType == eventNames().beforeunloadEvent)
-                removePendingFrameBeforeUnloadEventCount();
-            r.setRemoved(true);
-            m_windowEventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-void Document::addWindowEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-{
-    if (eventType == eventNames().unloadEvent)
-        addPendingFrameUnloadEventCount();
-    else if (eventType == eventNames().beforeunloadEvent)
-        addPendingFrameBeforeUnloadEventCount();
-    // Remove existing identical listener set with identical arguments.
-    // The DOM 2 spec says that "duplicate instances are discarded" in this case.
-    removeWindowEventListener(eventType, listener.get(), useCapture);
-    addListenerTypeIfNeeded(eventType);
-    m_windowEventListeners.append(RegisteredEventListener::create(eventType, listener, useCapture));
-}
-
-void Document::removeWindowEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_windowEventListeners[i];
-        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingFrameUnloadEventCount();
-            else if (eventType == eventNames().beforeunloadEvent)
-                removePendingFrameBeforeUnloadEventCount();
-            r.setRemoved(true);
-            m_windowEventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-bool Document::hasWindowEventListener(const AtomicString& eventType)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_windowEventListeners[i]->eventType() == eventType)
-            return true;
-    }
-    return false;
-}
-
-void Document::addPendingFrameUnloadEventCount() 
-{
-    if (m_frame)
-         m_frame->eventHandler()->addPendingFrameUnloadEventCount();
-}
-
-void Document::removePendingFrameUnloadEventCount() 
-{
-    if (m_frame)
-        m_frame->eventHandler()->removePendingFrameUnloadEventCount();
-}
-
-void Document::addPendingFrameBeforeUnloadEventCount() 
-{
-    if (m_frame)
-         m_frame->eventHandler()->addPendingFrameBeforeUnloadEventCount();
-}
-
-void Document::removePendingFrameBeforeUnloadEventCount() 
-{
-    if (m_frame)
-        m_frame->eventHandler()->removePendingFrameBeforeUnloadEventCount();
-}
-
-PassRefPtr<EventListener> Document::createEventListener(const String& functionName, const String& code, Node* node)
-{
-    Frame* frm = frame();
-    if (!frm || !frm->script()->isEnabled())
-        return 0;
-
-#if ENABLE(SVG)
-    if (node ? node->isSVGElement() : isSVGDocument())
-        return frm->script()->createSVGEventHandler(functionName, code, node);
-#endif
-
-    // We may want to treat compound document event handlers in a different way, in future.
-    return frm->script()->createInlineEventListener(functionName, code, node);
-}
-
-void Document::setWindowInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute* attr)
-{
-    setWindowInlineEventListenerForType(eventType, createEventListener(attr->localName().string(), attr->value(), 0));
-}
-
 Element* Document::ownerElement() const
 {
     if (!frame())
@@ -3001,7 +2969,7 @@
     if (cookieURL.isEmpty())
         return;
 
-    setCookies(this, cookieURL, policyBaseURL(), value);
+    setCookies(this, cookieURL, value);
 }
 
 String Document::referrer() const
@@ -3236,11 +3204,14 @@
         m_savedRenderer = renderer();
         if (FrameView* v = view())
             v->resetScrollbars();
+        unscheduleStyleRecalc();
     } else {
         ASSERT(renderer() == 0 || renderer() == m_savedRenderer);
         ASSERT(m_renderArena);
         setRenderer(m_savedRenderer);
         m_savedRenderer = 0;
+        if (childNeedsStyleRecalc())
+            scheduleStyleRecalc();
     }
 }
 
@@ -3357,7 +3328,7 @@
     for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
         RefPtr<Range> textPiece = markedText.range();
         int exception = 0;
-        DocumentMarker marker = {type, textPiece->startOffset(exception), textPiece->endOffset(exception), description};
+        DocumentMarker marker = {type, textPiece->startOffset(exception), textPiece->endOffset(exception), description, false};
         addMarker(textPiece->startContainer(exception), marker);
     }
 }
@@ -3782,6 +3753,53 @@
         node->renderer()->repaint();
 }
 
+void Document::setMarkersActive(Range* range, bool active)
+{
+    if (m_markers.isEmpty())
+        return;
+
+    ExceptionCode ec = 0;
+    Node* startContainer = range->startContainer(ec);
+    Node* endContainer = range->endContainer(ec);
+
+    Node* pastLastNode = range->pastLastNode();
+    for (Node* node = range->firstNode(); node != pastLastNode; node = node->traverseNextNode()) {
+        int startOffset = node == startContainer ? range->startOffset(ec) : 0;
+        int endOffset = node == endContainer ? range->endOffset(ec) : INT_MAX;
+        setMarkersActive(node, startOffset, endOffset, active);
+    }
+}
+
+void Document::setMarkersActive(Node* node, unsigned startOffset, unsigned endOffset, bool active)
+{
+    MarkerMapVectorPair* vectorPair = m_markers.get(node);
+    if (!vectorPair)
+        return;
+
+    Vector<DocumentMarker>& markers = vectorPair->first;
+    ASSERT(markers.size() == vectorPair->second.size());
+
+    bool docDirty = false;
+    for (size_t i = 0; i != markers.size(); ++i) {
+        DocumentMarker &marker = markers[i];
+
+        // Markers are returned in order, so stop if we are now past the specified range.
+        if (marker.startOffset >= endOffset)
+            break;
+
+        // Skip marker that is wrong type or before target.
+        if (marker.endOffset < startOffset || marker.type != DocumentMarker::TextMatch)
+            continue;
+
+        marker.activeMatch = active;
+        docDirty = true;
+    }
+
+    // repaint the affected node
+    if (docDirty && node->renderer())
+        node->renderer()->repaint();
+}
+
 #if ENABLE(XSLT)
 
 void Document::applyXSLTransform(ProcessingInstruction* pi)
@@ -3848,6 +3866,11 @@
     return doc;
 }
 
+PassRefPtr<Attr> Document::createAttribute(const String& name, ExceptionCode& ec)
+{
+    return createAttributeNS(String(), name, ec, true);
+}
+
 PassRefPtr<Attr> Document::createAttributeNS(const String& namespaceURI, const String& qualifiedName, ExceptionCode& ec, bool shouldIgnoreNamespaceChecks)
 {
     String prefix, localName;
@@ -3887,75 +3910,75 @@
 
 PassRefPtr<HTMLCollection> Document::images()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocImages);
+    return HTMLCollection::create(this, DocImages);
 }
 
 PassRefPtr<HTMLCollection> Document::applets()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocApplets);
+    return HTMLCollection::create(this, DocApplets);
 }
 
 PassRefPtr<HTMLCollection> Document::embeds()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocEmbeds);
+    return HTMLCollection::create(this, DocEmbeds);
 }
 
 PassRefPtr<HTMLCollection> Document::plugins()
 {
     // This is an alias for embeds() required for the JS DOM bindings.
-    return HTMLCollection::create(this, HTMLCollection::DocEmbeds);
+    return HTMLCollection::create(this, DocEmbeds);
 }
 
 PassRefPtr<HTMLCollection> Document::objects()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocObjects);
+    return HTMLCollection::create(this, DocObjects);
 }
 
 PassRefPtr<HTMLCollection> Document::scripts()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocScripts);
+    return HTMLCollection::create(this, DocScripts);
 }
 
 PassRefPtr<HTMLCollection> Document::links()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocLinks);
+    return HTMLCollection::create(this, DocLinks);
 }
 
 PassRefPtr<HTMLCollection> Document::forms()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocForms);
+    return HTMLCollection::create(this, DocForms);
 }
 
 PassRefPtr<HTMLCollection> Document::anchors()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocAnchors);
+    return HTMLCollection::create(this, DocAnchors);
 }
 
 PassRefPtr<HTMLCollection> Document::all()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocAll);
+    return HTMLCollection::create(this, DocAll);
 }
 
 PassRefPtr<HTMLCollection> Document::windowNamedItems(const String &name)
 {
-    return HTMLNameCollection::create(this, HTMLCollection::WindowNamedItems, name);
+    return HTMLNameCollection::create(this, WindowNamedItems, name);
 }
 
 PassRefPtr<HTMLCollection> Document::documentNamedItems(const String &name)
 {
-    return HTMLNameCollection::create(this, HTMLCollection::DocumentNamedItems, name);
+    return HTMLNameCollection::create(this, DocumentNamedItems, name);
 }
 
-HTMLCollection::CollectionInfo* Document::nameCollectionInfo(HTMLCollection::Type type, const AtomicString& name)
+CollectionCache* Document::nameCollectionInfo(CollectionType type, const AtomicString& name)
 {
-    ASSERT(type >= HTMLCollection::FirstNamedDocumentCachedType);
-    unsigned index = type - HTMLCollection::FirstNamedDocumentCachedType;
-    ASSERT(index < HTMLCollection::NumNamedDocumentCachedTypes);
+    ASSERT(type >= FirstNamedDocumentCachedType);
+    unsigned index = type - FirstNamedDocumentCachedType;
+    ASSERT(index < NumNamedDocumentCachedTypes);
 
     NamedCollectionMap& map = m_nameCollectionInfo[index];
     NamedCollectionMap::iterator iter = map.find(name.impl());
     if (iter == map.end())
-        iter = map.add(name.impl(), new HTMLCollection::CollectionInfo).first;
+        iter = map.add(name.impl(), new CollectionCache).first;
     return iter->second;
 }
 
@@ -3974,17 +3997,14 @@
 {
     Vector<String> stateVector;
     stateVector.reserveInitialCapacity(m_formElementsWithState.size() * 3);
-    typedef ListHashSet<FormControlElementWithState*>::const_iterator Iterator;
+    typedef ListHashSet<Element*>::const_iterator Iterator;
     Iterator end = m_formElementsWithState.end();
     for (Iterator it = m_formElementsWithState.begin(); it != end; ++it) {
-        FormControlElementWithState* e = *it;
+        Element* e = *it;
         String value;
-        if (e->saveState(value)) {
-            FormControlElement* formControlElement = e->toFormControlElement();
-            ASSERT(formControlElement);
-
-            stateVector.append(formControlElement->name().string());
-            stateVector.append(formControlElement->type().string());
+        if (e->saveFormControlState(value)) {
+            stateVector.append(e->formControlName().string());
+            stateVector.append(e->formControlType().string());
             stateVector.append(value);
         }
     }
@@ -4259,6 +4279,34 @@
         element->updateFocusAppearance(false);
 }
 
+void Document::executeScriptSoonTimerFired(Timer<Document>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_executeScriptSoonTimer);
+
+    Vector<pair<ScriptElementData*, CachedResourceHandle<CachedScript> > > scripts;
+    scripts.swap(m_scriptsToExecuteSoon);
+    size_t size = scripts.size();
+    for (size_t i = 0; i < size; ++i) {
+        scripts[i].first->execute(scripts[i].second.get());
+        scripts[i].first->element()->deref(); // Balances ref() in executeScriptSoon().
+    }
+}
+
+void Document::executeScriptSoon(ScriptElementData* data, CachedResourceHandle<CachedScript> cachedScript)
+{
+    ASSERT_ARG(data, data);
+
+    Element* element = data->element();
+    ASSERT(element);
+    ASSERT(element->document() == this);
+    ASSERT(element->inDocument());
+
+    m_scriptsToExecuteSoon.append(make_pair(data, cachedScript));
+    element->ref(); // Balanced by deref()s in executeScriptSoonTimerFired() and ~Document().
+    if (!m_executeScriptSoonTimer.isActive())
+        m_executeScriptSoonTimer.startOneShot(0);
+}
+
 // FF method for accessing the selection added for compatability.
 DOMSelection* Document::getSelection() const
 {
@@ -4322,6 +4370,14 @@
     if (WMLPageState* pageState = wmlPageStateForDocument(this))
         pageState->reset();
 }
+
+void Document::initializeWMLPageState()
+{
+    if (!isWMLDocument())
+        return;
+
+    static_cast<WMLDocument*>(this)->initialize();
+}
 #endif
 
 void Document::attachRange(Range* range)
@@ -4435,6 +4491,11 @@
 {
     if (page())
         page()->inspectorController()->resourceRetrievedByXMLHttpRequest(identifier, sourceString);
+    Frame* frame = this->frame();
+    if (frame) {
+        FrameLoader* frameLoader = frame->loader();
+        frameLoader->didLoadResourceByXMLHttpRequest(identifier, sourceString);
+    }
 }
 
 void Document::scriptImported(unsigned long identifier, const String& sourceString)
@@ -4533,4 +4594,16 @@
         m_decoder->encoding().displayBuffer(buffer, len);
 }
 
+#if ENABLE(XHTMLMP)
+bool Document::isXHTMLMPDocument() const
+{
+    if (!frame() || !frame()->loader())
+        return false;
+    // As per section 7.2 of OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf, a conforming user agent
+    // MUST accept XHTMLMP document identified as "application/vnd.wap.xhtml+xml"
+    // and SHOULD accept it identified as "application/xhtml+xml"
+    return frame()->loader()->responseMIMEType() == "application/vnd.wap.xhtml+xml" || frame()->loader()->responseMIMEType() == "application/xhtml+xml";
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/dom/Document.h b/WebCore/dom/Document.h
index 3d232ec..70bc225 100644
--- a/WebCore/dom/Document.h
+++ b/WebCore/dom/Document.h
@@ -4,7 +4,7 @@
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,16 +26,16 @@
 #ifndef Document_h
 #define Document_h
 
-#include "Attr.h"
+#include "CachedResourceHandle.h"
+#include "CheckedRadioButtons.h"
+#include "ContainerNode.h"
+#include "CollectionCache.h"
+#include "CollectionType.h"
 #include "Color.h"
 #include "DocumentMarker.h"
-#include "HTMLCollection.h"
-#include "HTMLFormElement.h"
 #include "ScriptExecutionContext.h"
-#include "StringHash.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
-#include <wtf/ListHashSet.h>
 
 // FIXME: We should move Mac off of the old Frame-based user stylesheet loading
 // code and onto the new code in Page. We can't do that until the code in Page
@@ -48,11 +48,11 @@
 
 namespace WebCore {
 
-    class AXObjectCache;
     class Attr;
-    class Attribute;
+    class AXObjectCache;
     class CDATASection;
     class CachedCSSStyleSheet;
+    class CachedScript;
     class CanvasRenderingContext2D;
     class CharacterData;
     class CSSStyleDeclaration;
@@ -72,11 +72,11 @@
     class EntityReference;
     class Event;
     class EventListener;
-    class FormControlElementWithState;
     class Frame;
     class FrameView;
     class HitTestRequest;
     class HTMLCanvasElement;
+    class HTMLCollection;
     class HTMLDocument;
     class HTMLElement;
     class HTMLFormElement;
@@ -95,6 +95,7 @@
     class RegisteredEventListener;
     class RenderArena;
     class RenderView;
+    class ScriptElementData;
     class SecurityOrigin;
     class SegmentedString;
     class Settings;
@@ -228,7 +229,7 @@
     PassRefPtr<Comment> createComment(const String& data);
     PassRefPtr<CDATASection> createCDATASection(const String& data, ExceptionCode&);
     PassRefPtr<ProcessingInstruction> createProcessingInstruction(const String& target, const String& data, ExceptionCode&);
-    PassRefPtr<Attr> createAttribute(const String& name, ExceptionCode& ec) { return createAttributeNS(String(), name, ec, true); }
+    PassRefPtr<Attr> createAttribute(const String& name, ExceptionCode&);
     PassRefPtr<Attr> createAttributeNS(const String& namespaceURI, const String& qualifiedName, ExceptionCode&, bool shouldIgnoreNamespaceChecks = false);
     PassRefPtr<EntityReference> createEntityReference(const String& name, ExceptionCode&);
     PassRefPtr<Node> importNode(Node* importedNode, bool deep, ExceptionCode&);
@@ -288,15 +289,15 @@
     // quirks mode for historical compatibility reasons.
     Element* findAnchor(const String& name);
 
-    HTMLCollection::CollectionInfo* collectionInfo(HTMLCollection::Type type)
+    CollectionCache* collectionInfo(CollectionType type)
     {
-        ASSERT(type >= HTMLCollection::FirstUnnamedDocumentCachedType);
-        unsigned index = type - HTMLCollection::FirstUnnamedDocumentCachedType;
-        ASSERT(index < HTMLCollection::NumUnnamedDocumentCachedTypes);
+        ASSERT(type >= FirstUnnamedDocumentCachedType);
+        unsigned index = type - FirstUnnamedDocumentCachedType;
+        ASSERT(index < NumUnnamedDocumentCachedTypes);
         return &m_collectionInfo[index]; 
     }
 
-    HTMLCollection::CollectionInfo* nameCollectionInfo(HTMLCollection::Type, const AtomicString& name);
+    CollectionCache* nameCollectionInfo(CollectionType, const AtomicString& name);
 
     // DOM methods overridden from  parent classes
 
@@ -308,12 +309,19 @@
     virtual bool isImageDocument() const { return false; }
 #if ENABLE(SVG)
     virtual bool isSVGDocument() const { return false; }
+#else
+    static bool isSVGDocument() { return false; }
 #endif
     virtual bool isPluginDocument() const { return false; }
     virtual bool isMediaDocument() const { return false; }
 #if ENABLE(WML)
     virtual bool isWMLDocument() const { return false; }
 #endif
+#if ENABLE(XHTMLMP)
+    bool isXHTMLMPDocument() const; 
+    bool shouldProcessNoscriptElement() const { return m_shouldProcessNoScriptElement; }
+    void setShouldProcessNoscriptElement(bool shouldDo) { m_shouldProcessNoScriptElement = shouldDo; }
+#endif
     virtual bool isFrameSet() const { return false; }
     
     CSSStyleSelector* styleSelector() const { return m_styleSelector; }
@@ -371,8 +379,8 @@
     void setUsesBeforeAfterRules(bool b) { m_usesBeforeAfterRules = b; }
 
     // Machinery for saving and restoring state when you leave and then go back to a page.
-    void registerFormElementWithState(FormControlElementWithState* e) { m_formElementsWithState.add(e); }
-    void unregisterFormElementWithState(FormControlElementWithState* e) { m_formElementsWithState.remove(e); }
+    void registerFormElementWithState(Element* e) { m_formElementsWithState.add(e); }
+    void unregisterFormElementWithState(Element* e) { m_formElementsWithState.remove(e); }
     Vector<String> formElementsState() const;
     void setStateForNewFormElements(const Vector<String>&);
     bool hasStateForNewFormElements() const;
@@ -396,17 +404,15 @@
     PassRefPtr<EditingText> createEditingTextNode(const String&);
 
     virtual void recalcStyle( StyleChange = NoChange );
-    virtual void updateRendering();
+    virtual void updateStyleIfNeeded();
     void updateLayout();
     void updateLayoutIgnorePendingStylesheets();
-    static void updateDocumentsRendering();
+    static void updateStyleForAllDocuments(); // FIXME: Try to reduce the # of calls to this function.
     DocLoader* docLoader() { return m_docLoader; }
 
     virtual void attach();
     virtual void detach();
 
-    void clearFramePointer();
-
     RenderArena* renderArena() { return m_renderArena; }
 
     RenderView* renderView() const;
@@ -515,6 +521,8 @@
     bool setFocusedNode(PassRefPtr<Node>);
     Node* focusedNode() const { return m_focusedNode.get(); }
 
+    void getFocusableNodes(Vector<RefPtr<Node> >&);
+    
     // The m_ignoreAutofocus flag specifies whether or not the document has been changed by the user enough 
     // for WebCore to ignore the autofocus attribute on any form controls
     bool ignoreAutofocus() const { return m_ignoreAutofocus; };
@@ -535,7 +543,9 @@
     void setCSSTarget(Element*);
     Element* cssTarget() const { return m_cssTarget; }
     
-    void setDocumentChanged(bool);
+    void scheduleStyleRecalc();
+    void unscheduleStyleRecalc();
+    void styleRecalcTimerFired(Timer<Document>*);
 
     void attachNodeIterator(NodeIterator*);
     void detachNodeIterator(NodeIterator*);
@@ -554,6 +564,12 @@
     DOMWindow* defaultView() const { return domWindow(); } 
     DOMWindow* domWindow() const;
 
+    // Helper functions for forwarding DOMWindow event related tasks to the DOMWindow if it exists.
+    void setWindowAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+    void dispatchWindowEvent(PassRefPtr<Event>);
+    void dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg);
+    void dispatchLoadEvent();
+
     PassRefPtr<Event> createEvent(const String& eventType, ExceptionCode&);
 
     // keep track of what types of event listeners are registered, so we don't
@@ -579,24 +595,6 @@
 
     CSSStyleDeclaration* getOverrideStyle(Element*, const String& pseudoElt);
 
-    void handleWindowEvent(Event*, bool useCapture);
-    void setWindowInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener>);
-    EventListener* windowInlineEventListenerForType(const AtomicString& eventType);
-    void removeWindowInlineEventListenerForType(const AtomicString& eventType);
-
-    void setWindowInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute*);
-
-    void addWindowEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    void removeWindowEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-    bool hasWindowEventListener(const AtomicString& eventType);
-    
-    void addPendingFrameUnloadEventCount();
-    void removePendingFrameUnloadEventCount();
-    void addPendingFrameBeforeUnloadEventCount();
-    void removePendingFrameBeforeUnloadEventCount();
-
-    PassRefPtr<EventListener> createEventListener(const String& functionName, const String& code, Node*);
-
     /**
      * Searches through the document, starting from fromNode, for the next selectable element that comes after fromNode.
      * The order followed is as specified in section 17.11.1 of the HTML4 spec, which is elements with tab indexes
@@ -665,8 +663,8 @@
 
     const KURL& cookieURL() const { return m_cookieURL; }
 
-    const KURL& policyBaseURL() const { return m_policyBaseURL; }
-    void setPolicyBaseURL(const KURL& url) { m_policyBaseURL = url; }
+    const KURL& firstPartyForCookies() const { return m_firstPartyForCookies; }
+    void setFirstPartyForCookies(const KURL& url) { m_firstPartyForCookies = url; }
     
     // The following implements the rule from HTML 4 for what valid names are.
     // To get this right for all the XML cases, we probably have to improve this or move it
@@ -711,6 +709,8 @@
     void setRenderedRectForMarker(Node*, DocumentMarker, const IntRect&);
     void invalidateRenderedRectsForMarkersInRect(const IntRect&);
     void shiftMarkers(Node*, unsigned startOffset, int delta, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
+    void setMarkersActive(Range*, bool);
+    void setMarkersActive(Node*, unsigned startOffset, unsigned endOffset, bool);
 
     DocumentMarker* markerContainingPoint(const IntPoint&, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     Vector<DocumentMarker> markersForNode(Node*);
@@ -727,6 +727,8 @@
 
     int docID() const { return m_docID; }
 
+    void executeScriptSoon(ScriptElementData*, CachedResourceHandle<CachedScript>);
+
 #if ENABLE(XSLT)
     void applyXSLTransform(ProcessingInstruction* pi);
     void setTransformSource(void* doc);
@@ -826,6 +828,8 @@
 
     String encoding() const;
 
+    void executeScriptSoonTimerFired(Timer<Document>*);
+
     CSSStyleSelector* m_styleSelector;
     bool m_didCalculateStyleSelector;
 
@@ -839,7 +843,7 @@
     KURL m_baseURL;  // Node.baseURI: The URL to use when resolving relative URLs.
     KURL m_baseElementURL;  // The URL set by the <base> element.
     KURL m_cookieURL;  // The URL to use for cookie access.
-    KURL m_policyBaseURL;  // The policy URL for third-party cookie blocking.
+    KURL m_firstPartyForCookies; // The policy URL for third-party cookie blocking.
 
     // Document.documentURI:
     // Although URL-like, Document.documentURI can actually be set to any
@@ -901,10 +905,8 @@
     RefPtr<StyleSheetList> m_styleSheets; // All of the stylesheets that are currently in effect for our media type and stylesheet set.
     ListHashSet<Node*> m_styleSheetCandidateNodes; // All of the nodes that could potentially provide stylesheets to the document (<link>, <style>, <?xml-stylesheet>)
 
-    RegisteredEventListenerVector m_windowEventListeners;
-
     typedef HashMap<FormElementKey, Vector<String>, FormElementKeyHash, FormElementKeyHashTraits> FormElementStateMap;
-    ListHashSet<FormControlElementWithState*> m_formElementsWithState;
+    ListHashSet<Element*> m_formElementsWithState;
     FormElementStateMap m_stateForNewFormElements;
     
     Color m_linkColor;
@@ -917,7 +919,7 @@
     bool m_loadingSheet;
     bool visuallyOrdered;
     bool m_bParsing;
-    bool m_docChanged;
+    Timer<Document> m_styleRecalcTimer;
     bool m_inStyleRecalc;
     bool m_closeAfterStyleRecalc;
     bool m_usesDescendantRules;
@@ -939,9 +941,9 @@
     typedef std::pair<Vector<DocumentMarker>, Vector<IntRect> > MarkerMapVectorPair;
     typedef HashMap<RefPtr<Node>, MarkerMapVectorPair*> MarkerMap;
     MarkerMap m_markers;
-
+#if !PLATFORM(ANDROID)
     mutable AXObjectCache* m_axObjectCache;
-    
+#endif
     Timer<Document> m_updateFocusAppearanceTimer;
 
     Element* m_cssTarget;
@@ -949,6 +951,9 @@
     bool m_processingLoadEvent;
     double m_startTime;
     bool m_overMinimumLayoutThreshold;
+
+    Vector<std::pair<ScriptElementData*, CachedResourceHandle<CachedScript> > > m_scriptsToExecuteSoon;
+    Timer<Document> m_executeScriptSoonTimer;
     
 #if ENABLE(XSLT)
     void* m_transformSource;
@@ -972,6 +977,10 @@
 
     String m_contentLanguage;
 
+#if ENABLE(XHTMLMP)
+    bool m_shouldProcessNoScriptElement;
+#endif
+
 public:
     bool inPageCache() const { return m_inPageCache; }
     void setInPageCache(bool flag);
@@ -1010,12 +1019,12 @@
     void setDashboardRegions(const Vector<DashboardRegionValue>&);
 #endif
 
-    void removeAllEventListenersFromAllNodes();
+    void removeAllEventListeners();
 
     void registerDisconnectedNodeWithEventListeners(Node*);
     void unregisterDisconnectedNodeWithEventListeners(Node*);
     
-    HTMLFormElement::CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
+    CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
     
 #if ENABLE(SVG)
     const SVGDocumentExtensions* svgExtensions();
@@ -1045,6 +1054,7 @@
 
 #if ENABLE(WML)
     void resetWMLPageState();
+    void initializeWMLPageState();
 #endif
 
 protected:
@@ -1075,11 +1085,11 @@
     
     int m_selfOnlyRefCount;
 
-    HTMLFormElement::CheckedRadioButtons m_checkedRadioButtons;
+    CheckedRadioButtons m_checkedRadioButtons;
 
-    typedef HashMap<AtomicStringImpl*, HTMLCollection::CollectionInfo*> NamedCollectionMap;
-    HTMLCollection::CollectionInfo m_collectionInfo[HTMLCollection::NumUnnamedDocumentCachedTypes];
-    NamedCollectionMap m_nameCollectionInfo[HTMLCollection::NumNamedDocumentCachedTypes];
+    typedef HashMap<AtomicStringImpl*, CollectionCache*> NamedCollectionMap;
+    CollectionCache m_collectionInfo[NumUnnamedDocumentCachedTypes];
+    NamedCollectionMap m_nameCollectionInfo[NumNamedDocumentCachedTypes];
 
 #if ENABLE(XPATH)
     RefPtr<XPathEvaluator> m_xpathEvaluator;
diff --git a/WebCore/dom/Document.idl b/WebCore/dom/Document.idl
index 3543cc7..232ceb4 100644
--- a/WebCore/dom/Document.idl
+++ b/WebCore/dom/Document.idl
@@ -81,7 +81,7 @@
 
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString documentURI;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Events (DocumentEvents interface)
 
         Event              createEvent(in DOMString eventType)
@@ -116,7 +116,7 @@
 
         [OldStyleObjC] CSSStyleDeclaration getOverrideStyle(in Element element,
                                                             in DOMString pseudoElement);
-#if ENABLE_XPATH
+#if defined(ENABLE_XPATH) && ENABLE_XPATH
         // DOM Level 3 XPath (XPathEvaluator interface)
         [OldStyleObjC] XPathExpression createExpression(in DOMString expression,
                                                         in XPathNSResolver resolver)
@@ -137,7 +137,7 @@
                                        in boolean userInterface,
                                        in [ConvertUndefinedOrNullToNullString] DOMString value);
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // FIXME: remove the these two versions once [Optional] is implemented for Objective-C.
         boolean            execCommand(in DOMString command,
                                        in boolean userInterface);
@@ -154,7 +154,7 @@
 
                  attribute [ConvertNullToNullString] DOMString title;
         readonly attribute DOMString referrer;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString domain;
 #else
         readonly attribute DOMString domain;
@@ -180,7 +180,7 @@
 
         NodeList getElementsByName(in DOMString elementName);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [Custom] Location location;
 #endif
 
@@ -193,7 +193,7 @@
         Element            elementFromPoint(in long x, in long y);
 
         // Mozilla extensions
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         DOMSelection       getSelection();
 #endif
         readonly attribute [ConvertNullStringTo=Null] DOMString characterSet;
@@ -203,13 +203,13 @@
         readonly attribute [ConvertNullStringTo=Null] DOMString preferredStylesheetSet;
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString selectedStylesheetSet;
 
-#if !defined(LANGUAGE_COM)
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         CSSStyleDeclaration createCSSStyleDeclaration();
 #endif
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // DOM Level 2 Style Interface
         [OldStyleObjC, UsesView] CSSStyleDeclaration getComputedStyle(in Element element,
                                                                       in DOMString pseudoElement);
@@ -224,8 +224,8 @@
                                                   
 #endif
 
-#if !defined(LANGUAGE_COM)
-#if !defined(LANGUAGE_OBJECTIVE_C)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         [V8Custom] DOMObject getCSSCanvasContext(in DOMString contextId, in DOMString name, in long width, in long height);
 #endif
 #endif
@@ -239,9 +239,10 @@
         NodeList querySelectorAll(in DOMString selectors)
             raises(DOMException);
 
-#if ENABLE_WML
+#if defined(ENABLE_WML) && ENABLE_WML
         // Only used from within WML layout tests, WML doesn't have JS support at all.
         void resetWMLPageState();
+        void initializeWMLPageState();
 #endif
     };
 
diff --git a/WebCore/dom/DocumentMarker.h b/WebCore/dom/DocumentMarker.h
index 2ba9b47..8945eb0 100644
--- a/WebCore/dom/DocumentMarker.h
+++ b/WebCore/dom/DocumentMarker.h
@@ -30,19 +30,23 @@
 
 // A range of a node within a document that is "marked", such as the range of a misspelled word.
 // It optionally includes a description that could be displayed in the user interface.
+// It also optionally includes a flag specifying whether the match is active, which is ignored
+// for all types other than type TextMatch.
 struct DocumentMarker {
 
     enum MarkerType {
         AllMarkers  = -1,
         Spelling,
         Grammar,
-        TextMatch
+        TextMatch,
+        Replacement
     };
 
     MarkerType type;
     unsigned startOffset;
     unsigned endOffset;
     String description;
+    bool activeMatch;
 
     bool operator==(const DocumentMarker& o) const
     {
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index dbec884..4cf49bb 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -27,6 +27,7 @@
 #include "Element.h"
 
 #include "AXObjectCache.h"
+#include "Attr.h"
 #include "CSSStyleSelector.h"
 #include "CString.h"
 #include "ClientRect.h"
@@ -40,19 +41,20 @@
 #include "FrameView.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 #include "NodeList.h"
 #include "NodeRenderStyle.h"
 #include "Page.h"
 #include "PlatformString.h"
 #include "RenderBlock.h"
-#if ENABLE(SVG)
-#include "SVGNames.h"
-#endif
 #include "SelectionController.h"
 #include "TextIterator.h"
 #include "XMLNames.h"
 
+#if ENABLE(SVG)
+#include "SVGNames.h"
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -107,7 +109,7 @@
 
     // Clone attributes.
     if (namedAttrMap)
-        clone->attributes()->setAttributes(*namedAttrMap);
+        clone->attributes()->setAttributes(*attributes(true)); // Call attributes(true) to force attribute synchronization to occur (for svg and style) before cloning happens.
 
     clone->copyNonAttributeProperties(this);
     
@@ -140,12 +142,12 @@
 }
 
 // Virtual function, defined in base class.
-NamedAttrMap* Element::attributes() const
+NamedNodeMap* Element::attributes() const
 {
     return attributes(false);
 }
 
-NamedAttrMap* Element::attributes(bool readonly) const
+NamedNodeMap* Element::attributes(bool readonly) const
 {
     if (!m_isStyleAttributeValid)
         updateStyleAttribute();
@@ -268,19 +270,50 @@
 static int adjustForLocalZoom(int value, RenderObject* renderer)
 {
     float zoomFactor = localZoomForRenderer(renderer);
-    if (zoomFactor == 1.0f)
+    if (zoomFactor == 1)
         return value;
+    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
+    if (zoomFactor > 1)
+        value++;
     return static_cast<int>(value / zoomFactor);
 }
 
 static int adjustForAbsoluteZoom(int value, RenderObject* renderer)
 {
     float zoomFactor = renderer->style()->effectiveZoom();
-    if (zoomFactor == 1.0f)
+    if (zoomFactor == 1)
         return value;
+    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
+    if (zoomFactor > 1)
+        value++;
     return static_cast<int>(value / zoomFactor);
 }
 
+static FloatPoint adjustFloatPointForAbsoluteZoom(const FloatPoint& point, RenderObject* renderer)
+{
+    // The result here is in floats, so we don't need the truncation hack from the integer version above.
+    float zoomFactor = renderer->style()->effectiveZoom();
+    if (zoomFactor == 1)
+        return point;
+    return FloatPoint(point.x() / zoomFactor, point.y() / zoomFactor);
+}
+
+static void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* renderer)
+{
+    quad.setP1(adjustFloatPointForAbsoluteZoom(quad.p1(), renderer));
+    quad.setP2(adjustFloatPointForAbsoluteZoom(quad.p2(), renderer));
+    quad.setP3(adjustFloatPointForAbsoluteZoom(quad.p3(), renderer));
+    quad.setP4(adjustFloatPointForAbsoluteZoom(quad.p4(), renderer));
+}
+
+static void adjustIntRectForAbsoluteZoom(IntRect& rect, RenderObject* renderer)
+{
+    rect.setX(adjustForAbsoluteZoom(rect.x(), renderer));
+    rect.setY(adjustForAbsoluteZoom(rect.y(), renderer));
+    rect.setWidth(adjustForAbsoluteZoom(rect.width(), renderer));
+    rect.setHeight(adjustForAbsoluteZoom(rect.height(), renderer));
+}
+
 int Element::offsetLeft()
 {
     document()->updateLayoutIgnorePendingStylesheets();
@@ -377,7 +410,7 @@
     return 0;
 }
 
-int Element::scrollLeft()
+int Element::scrollLeft() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
     if (RenderBox* rend = renderBox())
@@ -385,7 +418,7 @@
     return 0;
 }
 
-int Element::scrollTop()
+int Element::scrollTop() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
     if (RenderBox* rend = renderBox())
@@ -407,7 +440,7 @@
         rend->setScrollTop(static_cast<int>(newTop * rend->style()->effectiveZoom()));
 }
 
-int Element::scrollWidth()
+int Element::scrollWidth() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
     if (RenderBox* rend = renderBox())
@@ -415,7 +448,7 @@
     return 0;
 }
 
-int Element::scrollHeight()
+int Element::scrollHeight() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
     if (RenderBox* rend = renderBox())
@@ -439,8 +472,10 @@
 
     if (FrameView* view = document()->view()) {
         IntRect visibleContentRect = view->visibleContentRect();
-        for (size_t i = 0; i < quads.size(); ++i)
+        for (size_t i = 0; i < quads.size(); ++i) {
             quads[i].move(-visibleContentRect.x(), -visibleContentRect.y());
+            adjustFloatQuadForAbsoluteZoom(quads[i], renderBoxModelObject);
+        }
     }
 
     return ClientRectList::create(quads);
@@ -468,6 +503,8 @@
         result.move(-visibleContentRect.x(), -visibleContentRect.y());
     }
 
+    adjustIntRectForAbsoluteZoom(result, renderBoxModelObject);
+
     return ClientRect::create(result);
 }
 
@@ -566,7 +603,7 @@
     }
 }
 
-void Element::setAttributeMap(PassRefPtr<NamedAttrMap> list)
+void Element::setAttributeMap(PassRefPtr<NamedNodeMap> list)
 {
     document()->incDOMTreeVersion();
 
@@ -644,7 +681,7 @@
 
 void Element::createAttributeMap() const
 {
-    namedAttrMap = NamedAttrMap::create(const_cast<Element*>(this));
+    namedAttrMap = NamedNodeMap::create(const_cast<Element*>(this));
 }
 
 bool Element::isURLAttribute(Attribute*) const
@@ -677,7 +714,7 @@
     ContainerNode::insertedIntoDocument();
 
     if (hasID()) {
-        if (NamedAttrMap* attrs = namedAttrMap.get()) {
+        if (NamedNodeMap* attrs = namedAttrMap.get()) {
             Attribute* idItem = attrs->getAttributeItem(idAttr);
             if (idItem && !idItem->isNull())
                 updateId(nullAtom, idItem->value());
@@ -688,7 +725,7 @@
 void Element::removedFromDocument()
 {
     if (hasID()) {
-        if (NamedAttrMap* attrs = namedAttrMap.get()) {
+        if (NamedNodeMap* attrs = namedAttrMap.get()) {
             Attribute* idItem = attrs->getAttributeItem(idAttr);
             if (idItem && !idItem->isNull())
                 updateId(idItem->value(), nullAtom);
@@ -700,6 +737,8 @@
 
 void Element::attach()
 {
+    suspendPostAttachCallbacks();
+
     createRendererIfNeeded();
     ContainerNode::attach();
     if (hasRareData()) {   
@@ -710,6 +749,8 @@
             data->setNeedsFocusAppearanceUpdateSoonAfterAttach(false);
         }
     }
+
+    resumePostAttachCallbacks();
 }
 
 void Element::detach()
@@ -724,7 +765,7 @@
 {
     RenderStyle* currentStyle = renderStyle();
     bool hasParentStyle = parentNode() ? parentNode()->renderStyle() : false;
-    bool hasPositionalRules = changed() && currentStyle && currentStyle->childrenAffectedByPositionalRules();
+    bool hasPositionalRules = needsStyleRecalc() && currentStyle && currentStyle->childrenAffectedByPositionalRules();
     bool hasDirectAdjacentRules = currentStyle && currentStyle->childrenAffectedByDirectAdjacentRules();
 
 #if ENABLE(SVG)
@@ -732,11 +773,11 @@
         hasParentStyle = true;
 #endif
 
-    if ((change > NoChange || changed())) {
+    if ((change > NoChange || needsStyleRecalc())) {
         if (hasRareData())
             rareData()->resetComputedStyle();
     }
-    if (hasParentStyle && (change >= Inherit || changed())) {
+    if (hasParentStyle && (change >= Inherit || needsStyleRecalc())) {
         RefPtr<RenderStyle> newStyle = document()->styleSelector()->styleForElement(this);
         StyleChange ch = diff(currentStyle, newStyle.get());
         if (ch == Detach || !currentStyle) {
@@ -744,8 +785,8 @@
                 detach();
             attach(); // FIXME: The style gets computed twice by calling attach. We could do better if we passed the style along.
             // attach recalulates the style for all children. No need to do it twice.
-            setChanged(NoStyleChange);
-            setHasChangedChild(false);
+            setNeedsStyleRecalc(NoStyleChange);
+            setChildNeedsStyleRecalc(false);
             return;
         }
 
@@ -772,7 +813,7 @@
 
         if (ch != NoChange) {
             setRenderStyle(newStyle);
-        } else if (changed() && (styleChangeType() != AnimationStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
+        } else if (needsStyleRecalc() && (styleChangeType() != AnimationStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
             // Although no change occurred, we use the new style so that the cousin style sharing code won't get
             // fooled into believing this style is the same.  This is only necessary if the document actually uses
             // sibling/descendant rules, since otherwise it isn't possible for ancestor styles to affect sharing of
@@ -797,17 +838,17 @@
     // without doing way too much re-resolution.
     bool forceCheckOfNextElementSibling = false;
     for (Node *n = firstChild(); n; n = n->nextSibling()) {
-        bool childRulesChanged = n->changed() && n->styleChangeType() == FullStyleChange;
+        bool childRulesChanged = n->needsStyleRecalc() && n->styleChangeType() == FullStyleChange;
         if (forceCheckOfNextElementSibling && n->isElementNode())
-            n->setChanged();
-        if (change >= Inherit || n->isTextNode() || n->hasChangedChild() || n->changed())
+            n->setNeedsStyleRecalc();
+        if (change >= Inherit || n->isTextNode() || n->childNeedsStyleRecalc() || n->needsStyleRecalc())
             n->recalcStyle(change);
         if (n->isElementNode())
             forceCheckOfNextElementSibling = childRulesChanged && hasDirectAdjacentRules;
     }
 
-    setChanged(NoStyleChange);
-    setHasChangedChild(false);
+    setNeedsStyleRecalc(NoStyleChange);
+    setChildNeedsStyleRecalc(false);
 }
 
 bool Element::childTypeAllowed(NodeType type)
@@ -829,7 +870,7 @@
 static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool finishedParsingCallback,
                                         Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    if (!style || (e->changed() && style->childrenAffectedByPositionalRules()))
+    if (!style || (e->needsStyleRecalc() && style->childrenAffectedByPositionalRules()))
         return;
 
     // :first-child.  In the parser callback case, we don't have to check anything, since we were right the first time.
@@ -849,11 +890,11 @@
         // This is the insert/append case.
         if (newFirstChild != firstElementAfterInsertion && firstElementAfterInsertion && firstElementAfterInsertion->attached() &&
             firstElementAfterInsertion->renderStyle() && firstElementAfterInsertion->renderStyle()->firstChildState())
-            firstElementAfterInsertion->setChanged();
+            firstElementAfterInsertion->setNeedsStyleRecalc();
             
         // We also have to handle node removal.
         if (childCountDelta < 0 && newFirstChild == firstElementAfterInsertion && newFirstChild && newFirstChild->renderStyle() && !newFirstChild->renderStyle()->firstChildState())
-            newFirstChild->setChanged();
+            newFirstChild->setNeedsStyleRecalc();
     }
 
     // :last-child.  In the parser callback case, we don't have to check anything, since we were right the first time.
@@ -871,12 +912,12 @@
         
         if (newLastChild != lastElementBeforeInsertion && lastElementBeforeInsertion && lastElementBeforeInsertion->attached() &&
             lastElementBeforeInsertion->renderStyle() && lastElementBeforeInsertion->renderStyle()->lastChildState())
-            lastElementBeforeInsertion->setChanged();
+            lastElementBeforeInsertion->setNeedsStyleRecalc();
             
         // We also have to handle node removal.  The parser callback case is similar to node removal as well in that we need to change the last child
         // to match now.
         if ((childCountDelta < 0 || finishedParsingCallback) && newLastChild == lastElementBeforeInsertion && newLastChild && newLastChild->renderStyle() && !newLastChild->renderStyle()->lastChildState())
-            newLastChild->setChanged();
+            newLastChild->setNeedsStyleRecalc();
     }
 
     // The + selector.  We need to invalidate the first element following the insertion point.  It is the only possible element
@@ -887,7 +928,7 @@
              firstElementAfterInsertion && !firstElementAfterInsertion->isElementNode();
              firstElementAfterInsertion = firstElementAfterInsertion->nextSibling()) {};
         if (firstElementAfterInsertion && firstElementAfterInsertion->attached())
-            firstElementAfterInsertion->setChanged();
+            firstElementAfterInsertion->setNeedsStyleRecalc();
     }
 
     // Forward positional selectors include the ~ selector, nth-child, nth-of-type, first-of-type and only-of-type.
@@ -899,11 +940,11 @@
     // here.  recalcStyle will then force a walk of the children when it sees that this has happened.
     if ((style->childrenAffectedByForwardPositionalRules() && afterChange) ||
         (style->childrenAffectedByBackwardPositionalRules() && beforeChange))
-        e->setChanged();
+        e->setNeedsStyleRecalc();
     
     // :empty selector.
     if (style->affectedByEmpty() && (!style->emptyState() || e->hasChildNodes()))
-        e->setChanged();
+        e->setNeedsStyleRecalc();
 }
 
 void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -948,7 +989,7 @@
 {
     String result = "<" + nodeName();
 
-    NamedAttrMap *attrMap = attributes(true);
+    NamedNodeMap* attrMap = attributes(true);
 
     if (attrMap) {
         unsigned numAttrs = attrMap->length();
@@ -1048,7 +1089,7 @@
         return 0;
     }
 
-    NamedAttrMap *attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return 0;
 
@@ -1083,7 +1124,7 @@
 
 PassRefPtr<Attr> Element::getAttributeNode(const String& name)
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return 0;
     String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
@@ -1092,7 +1133,7 @@
 
 PassRefPtr<Attr> Element::getAttributeNodeNS(const String& namespaceURI, const String& localName)
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return 0;
     return static_pointer_cast<Attr>(attrs->getNamedItem(QualifiedName(nullAtom, localName, namespaceURI)));
@@ -1100,7 +1141,7 @@
 
 bool Element::hasAttribute(const String& name) const
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return false;
 
@@ -1112,7 +1153,7 @@
 
 bool Element::hasAttributeNS(const String& namespaceURI, const String& localName) const
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return false;
     return attrs->getAttributeItem(QualifiedName(nullAtom, localName, namespaceURI));
@@ -1172,14 +1213,6 @@
 void Element::blur()
 {
     cancelFocusAppearanceUpdate();
-#ifdef ANDROID_IGNORE_BLUR
-    // Since we control the focus anyway, there is no need to do blur events
-    // unless the element has a blur event.
-    NamedAttrMap* map = attributes();
-    Node* blur = (map->getNamedItem(HTMLNames::onblurAttr)).get();
-    if (!blur)
-        return;
-#endif
     Document* doc = document();
     if (doc->focusedNode() == this) {
         if (doc->frame())
@@ -1254,7 +1287,7 @@
 void Element::normalizeAttributes()
 {
     // Normalize attributes.
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return;
     unsigned numAttrs = attrs->length();
@@ -1308,4 +1341,4 @@
     return count;
 }
 
-}
+} // namespace WebCore
diff --git a/WebCore/dom/Element.h b/WebCore/dom/Element.h
index b9b391a..025de1d 100644
--- a/WebCore/dom/Element.h
+++ b/WebCore/dom/Element.h
@@ -34,10 +34,10 @@
 class Attr;
 class Attribute;
 class CSSStyleDeclaration;
-class ElementRareData;
-class IntSize;
 class ClientRect;
 class ClientRectList;
+class ElementRareData;
+class IntSize;
 
 class Element : public ContainerNode {
 public:
@@ -77,12 +77,12 @@
     int clientTop();
     int clientWidth();
     int clientHeight();
-    int scrollLeft();
-    int scrollTop();
-    void setScrollLeft(int);
-    void setScrollTop(int);
-    int scrollWidth();
-    int scrollHeight();
+    virtual int scrollLeft() const;
+    virtual int scrollTop() const;
+    virtual void setScrollLeft(int);
+    virtual void setScrollTop(int);
+    virtual int scrollWidth() const;
+    virtual int scrollHeight() const;
 
     PassRefPtr<ClientRectList> getClientRects() const;
     PassRefPtr<ClientRect> getBoundingClientRect() const;
@@ -124,24 +124,20 @@
     PassRefPtr<Element> cloneElementWithoutChildren();
 
     void normalizeAttributes();
-
-    virtual bool isFormControlElement() const { return false; }
-    virtual bool isFormControlElementWithState() const { return false; }
-
     String nodeNamePreservingCase() const;
 
     // convenience methods which ignore exceptions
     void setAttribute(const QualifiedName&, const AtomicString& value);
     void setBooleanAttribute(const QualifiedName& name, bool);
 
-    virtual NamedAttrMap* attributes() const;
-    NamedAttrMap* attributes(bool readonly) const;
+    virtual NamedNodeMap* attributes() const;
+    NamedNodeMap* attributes(bool readonly) const;
 
     // This method is called whenever an attribute is added, changed or removed.
     virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
     // not part of the DOM
-    void setAttributeMap(PassRefPtr<NamedAttrMap>);
+    void setAttributeMap(PassRefPtr<NamedNodeMap>);
 
     virtual void copyNonAttributeProperties(const Element* /*source*/) { }
 
@@ -202,6 +198,23 @@
     Element* nextElementSibling() const;
     unsigned childElementCount() const;
 
+    // FormControlElement API
+    virtual bool isFormControlElement() const { return false; }
+    virtual bool isEnabledFormControl() const { return true; }
+    virtual bool isReadOnlyFormControl() const { return false; }
+    virtual bool isTextFormControl() const { return false; }
+
+    virtual bool formControlValueMatchesRenderer() const { return false; }
+    virtual void setFormControlValueMatchesRenderer(bool) { }
+
+    virtual const AtomicString& formControlName() const { return nullAtom; }
+    virtual const AtomicString& formControlType() const { return nullAtom; }
+
+    virtual bool saveFormControlState(String&) const { return false; }
+    virtual void restoreFormControlState(const String&) { }
+
+    virtual void dispatchFormControlChangeEvent() { }
+
 private:
     virtual void createAttributeMap() const;
 
@@ -229,7 +242,7 @@
     ElementRareData* rareData() const;
     ElementRareData* ensureRareData();
     
-    mutable RefPtr<NamedAttrMap> namedAttrMap;
+    mutable RefPtr<NamedNodeMap> namedAttrMap;
 };
     
 inline bool Node::hasTagName(const QualifiedName& name) const
@@ -242,7 +255,7 @@
     return isElementNode() && static_cast<const Element*>(this)->hasAttributes();
 }
 
-inline NamedAttrMap* Node::attributes() const
+inline NamedNodeMap* Node::attributes() const
 {
     return isElementNode() ? static_cast<const Element*>(this)->attributes() : 0;
 }
diff --git a/WebCore/dom/Element.idl b/WebCore/dom/Element.idl
index 889eaf0..6e16bfe 100644
--- a/WebCore/dom/Element.idl
+++ b/WebCore/dom/Element.idl
@@ -66,7 +66,7 @@
         [OldStyleObjC] boolean hasAttributeNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                               in DOMString localName);
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute CSSStyleDeclaration style;
 #endif
 
@@ -109,7 +109,7 @@
         NodeList querySelectorAll(in DOMString selectors)
             raises(DOMException);
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // ElementTraversal API
         readonly attribute Element firstElementChild;
         readonly attribute Element lastElementChild;
@@ -118,13 +118,13 @@
         readonly attribute unsigned long childElementCount;
 #endif
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // CSSOM View Module API
         ClientRectList getClientRects();
         ClientRect getBoundingClientRect();
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extensions
         readonly attribute DOMString innerText;
 #endif
diff --git a/WebCore/dom/Event.cpp b/WebCore/dom/Event.cpp
index 918f463..53242b6 100644
--- a/WebCore/dom/Event.cpp
+++ b/WebCore/dom/Event.cpp
@@ -35,8 +35,8 @@
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
-    , m_currentTarget(0)
     , m_eventPhase(0)
+    , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
 {
 }
@@ -49,8 +49,8 @@
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
-    , m_currentTarget(0)
     , m_eventPhase(0)
+    , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
 {
 }
diff --git a/WebCore/dom/Event.h b/WebCore/dom/Event.h
index df92de1..2e7f376 100644
--- a/WebCore/dom/Event.h
+++ b/WebCore/dom/Event.h
@@ -160,8 +160,8 @@
         bool m_defaultHandled;
         bool m_cancelBubble;
 
-        EventTarget* m_currentTarget;
         unsigned short m_eventPhase;
+        EventTarget* m_currentTarget;
         RefPtr<EventTarget> m_target;
         DOMTimeStamp m_createTime;
 
diff --git a/WebCore/dom/Event.idl b/WebCore/dom/Event.idl
index 99b0bd1..5ac9e0c 100644
--- a/WebCore/dom/Event.idl
+++ b/WebCore/dom/Event.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -24,7 +24,7 @@
     interface [
         GenerateConstructor,
         NoStaticTables,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=D17495FA-ACAD-4d27-9362-E19E057B189D,
         ImplementationUUID=CFDCDDB2-5B3F-412d-BDA4-80B23C721549
     ] Event {
@@ -34,7 +34,7 @@
         const unsigned short AT_TARGET           = 2;
         const unsigned short BUBBLING_PHASE      = 3;
 
-#if !defined(LANGUAGE_OBJECTIVE_C)
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         // Reverse-engineered from Netscape
         const unsigned short MOUSEDOWN           = 1;
         const unsigned short MOUSEUP             = 2;
@@ -60,7 +60,7 @@
         readonly attribute unsigned short   eventPhase;
         readonly attribute boolean          bubbles;
         readonly attribute boolean          cancelable;
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute DOMTimeStamp     timeStamp;
 #endif
         void               stopPropagation();
@@ -74,7 +74,7 @@
                  attribute boolean          returnValue;
                  attribute boolean          cancelBubble;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute [Custom] Clipboard        clipboardData;
 #endif
 
diff --git a/WebCore/dom/EventException.idl b/WebCore/dom/EventException.idl
index f948078..3d82f85 100644
--- a/WebCore/dom/EventException.idl
+++ b/WebCore/dom/EventException.idl
@@ -38,7 +38,7 @@
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
diff --git a/WebCore/dom/EventListener.h b/WebCore/dom/EventListener.h
index 1836fe6..dbc41b2 100644
--- a/WebCore/dom/EventListener.h
+++ b/WebCore/dom/EventListener.h
@@ -38,19 +38,20 @@
         virtual bool wasCreatedFromMarkup() const { return false; }
 
 #if USE(JSC)
-        virtual JSC::JSObject* function() const { return 0; }
-        virtual void mark() { }
+        virtual JSC::JSObject* jsFunction() const { return 0; }
+        virtual void markJSFunction() { }
 #endif
 
-        bool isInline() const { return virtualIsInline(); }
+        bool isAttribute() const { return virtualisAttribute(); }
 
     private:
-        virtual bool virtualIsInline() const { return false; }
+        virtual bool virtualisAttribute() const { return false; }
     };
 
 #if USE(JSC)
-    inline void markIfNotNull(EventListener* listener) { if (listener) listener->mark(); }
+    inline void markIfNotNull(EventListener* listener) { if (listener) listener->markJSFunction(); }
 #endif
+
 }
 
 #endif
diff --git a/WebCore/dom/EventTarget.cpp b/WebCore/dom/EventTarget.cpp
index 6717a02..06cea07 100644
--- a/WebCore/dom/EventTarget.cpp
+++ b/WebCore/dom/EventTarget.cpp
@@ -49,6 +49,11 @@
     return 0;
 }
 
+DOMWindow* EventTarget::toDOMWindow()
+{
+    return 0;
+}
+
 XMLHttpRequest* EventTarget::toXMLHttpRequest()
 {
     return 0;
diff --git a/WebCore/dom/EventTarget.h b/WebCore/dom/EventTarget.h
index 81d2c5a..662902e 100644
--- a/WebCore/dom/EventTarget.h
+++ b/WebCore/dom/EventTarget.h
@@ -38,12 +38,13 @@
 
     class AtomicString;
     class DOMApplicationCache;
+    class DOMWindow;
     class Event;
     class EventListener;
     class MessagePort;
     class Node;
-    class ScriptExecutionContext;
     class SVGElementInstance;
+    class ScriptExecutionContext;
     class Worker;
     class WorkerContext;
     class XMLHttpRequest;
@@ -55,6 +56,7 @@
     public:
         virtual MessagePort* toMessagePort();
         virtual Node* toNode();
+        virtual DOMWindow* toDOMWindow();
         virtual XMLHttpRequest* toXMLHttpRequest();
         virtual XMLHttpRequestUpload* toXMLHttpRequestUpload();
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/WebCore/dom/ExceptionCode.cpp b/WebCore/dom/ExceptionCode.cpp
index 8ce1643..0291a21 100644
--- a/WebCore/dom/ExceptionCode.cpp
+++ b/WebCore/dom/ExceptionCode.cpp
@@ -58,7 +58,11 @@
     "INVALID_ACCESS_ERR",
     "VALIDATION_ERR",
     "TYPE_MISMATCH_ERR",
-    "SECURITY_ERR"
+    "SECURITY_ERR",
+    "NETWORK_ERR",
+    "ABORT_ERR",
+    "URL_MISMATCH_ERR",
+    "QUOTA_EXCEEDED_ERR"
 };
 
 static const char* const rangeExceptionNames[] = {
diff --git a/WebCore/dom/ExceptionCode.h b/WebCore/dom/ExceptionCode.h
index 9e34ae0..58b18e2 100644
--- a/WebCore/dom/ExceptionCode.h
+++ b/WebCore/dom/ExceptionCode.h
@@ -51,7 +51,13 @@
         TYPE_MISMATCH_ERR = 17,
 
         // XMLHttpRequest extension:
-        SECURITY_ERR = 18
+        SECURITY_ERR = 18,
+
+        // Others introduced in HTML5:
+        NETWORK_ERR = 19,
+        ABORT_ERR = 20,
+        URL_MISMATCH_ERR = 21,
+        QUOTA_EXCEEDED_ERR = 22,
     };
 
     enum ExceptionType {
diff --git a/WebCore/dom/FormControlElement.cpp b/WebCore/dom/FormControlElement.cpp
deleted file mode 100644
index 2d883c6..0000000
--- a/WebCore/dom/FormControlElement.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "FormControlElement.h"
-
-#include "Element.h"
-#include "HTMLFormControlElement.h"
-#include <wtf/Assertions.h>
-
-#if ENABLE(WML)
-#include "WMLFormControlElement.h"
-#endif
-
-namespace WebCore {
-
-FormControlElement* toFormControlElement(Element* element)
-{
-    if (!element->isFormControlElement())
-        return 0;
-
-    if (element->isHTMLElement())
-        return static_cast<HTMLFormControlElement*>(element);
-
-#if ENABLE(WML)
-    if (element->isWMLElement())
-        return static_cast<WMLFormControlElement*>(element);
-#endif
-
-    return 0;
-}
-
-}
diff --git a/WebCore/dom/FormControlElement.h b/WebCore/dom/FormControlElement.h
deleted file mode 100644
index dc77ada..0000000
--- a/WebCore/dom/FormControlElement.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef FormControlElement_h
-#define FormControlElement_h
-
-namespace WebCore {
-
-class AtomicString;
-class Element;
-
-class FormControlElement {
-public:
-    virtual ~FormControlElement() { }
-
-    virtual bool isEnabled() const = 0;
-    virtual bool isReadOnlyControl() const = 0;
-    virtual bool isTextControl() const = 0;
-
-    virtual bool valueMatchesRenderer() const = 0;
-    virtual void setValueMatchesRenderer(bool value = true) = 0;
-
-    virtual const AtomicString& name() const = 0;
-    virtual const AtomicString& type() const = 0;
-
-protected:
-    FormControlElement() { }
-};
-
-FormControlElement* toFormControlElement(Element*);
-
-}
-
-#endif
diff --git a/WebCore/dom/FormControlElementWithState.cpp b/WebCore/dom/FormControlElementWithState.cpp
deleted file mode 100644
index 34a719d..0000000
--- a/WebCore/dom/FormControlElementWithState.cpp
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "FormControlElementWithState.h"
-
-#include "Document.h"
-#include "Element.h"
-#include "HTMLFormControlElement.h"
-#include <wtf/Assertions.h>
-
-#if ENABLE(WML)
-#include "WMLFormControlElement.h"
-#endif
-
-namespace WebCore {
-
-void FormControlElementWithState::registerFormControlElementWithState(FormControlElementWithState* element, Document* document)
-{
-    document->registerFormElementWithState(element);
-}
-
-void FormControlElementWithState::unregisterFormControlElementWithState(FormControlElementWithState* element, Document* document)
-{
-    document->unregisterFormElementWithState(element);
-}
-
-void FormControlElementWithState::finishParsingChildren(FormControlElementWithState* element, Document* document)
-{
-    if (!document->hasStateForNewFormElements())
-        return;
-
-    FormControlElement* formControlElement = element->toFormControlElement();
-    ASSERT(formControlElement);
-
-    String state;
-    if (document->takeStateForFormElement(formControlElement->name().impl(), formControlElement->type().impl(), state))
-        element->restoreState(state);
-}
-
-FormControlElementWithState* toFormControlElementWithState(Element* element)
-{
-    if (!element->isFormControlElementWithState())
-        return 0;
-
-    if (element->isHTMLElement())
-        return static_cast<HTMLFormControlElementWithState*>(element);
-
-#if ENABLE(WML)
-    if (element->isWMLElement())
-        return static_cast<WMLFormControlElementWithState*>(element);
-#endif
-
-    return 0;
-}
-
-}
diff --git a/WebCore/dom/FormControlElementWithState.h b/WebCore/dom/FormControlElementWithState.h
deleted file mode 100644
index 4c2b15a..0000000
--- a/WebCore/dom/FormControlElementWithState.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef FormControlElementWithState_h
-#define FormControlElementWithState_h
-
-namespace WebCore {
-
-class Document;
-class Element;
-class FormControlElement;
-class String;
-
-class FormControlElementWithState { 
-public:
-    virtual ~FormControlElementWithState() { }
-
-    virtual bool saveState(String& value) const = 0;
-    virtual void restoreState(const String& value) = 0;
-
-    // Every FormControlElementWithState class, is also a FormControlElement class by definition.
-    virtual FormControlElement* toFormControlElement() = 0;
-
-protected:
-    FormControlElementWithState() { }
-
-    static void registerFormControlElementWithState(FormControlElementWithState*, Document*);
-    static void unregisterFormControlElementWithState(FormControlElementWithState*, Document*);
-    static void finishParsingChildren(FormControlElementWithState*, Document*);
-};
-
-FormControlElementWithState* toFormControlElementWithState(Element*);
-
-}
-
-#endif
diff --git a/WebCore/dom/InputElement.cpp b/WebCore/dom/InputElement.cpp
index 6b733cb..108d17e 100644
--- a/WebCore/dom/InputElement.cpp
+++ b/WebCore/dom/InputElement.cpp
@@ -26,10 +26,10 @@
 #include "Document.h"
 #include "Event.h"
 #include "EventNames.h"
-#include "FormControlElement.h"
 #include "Frame.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderTextControlSingleLine.h"
 #include "SelectionController.h"
@@ -52,87 +52,94 @@
 const int InputElement::s_maximumLength = 524288;
 const int InputElement::s_defaultSize = 20;
 
-void InputElement::dispatchFocusEvent(InputElementData& data, Document* document)
+void InputElement::dispatchFocusEvent(InputElementData& data, InputElement* inputElement, Element* element)
 {
-    if (!data.inputElement()->isTextField())
+    if (!inputElement->isTextField())
         return;
 
-    updatePlaceholderVisibility(data, document);
+    updatePlaceholderVisibility(data, inputElement, element);
 
-    if (data.inputElement()->isPasswordField() && document->frame())
+    Document* document = element->document();
+    if (inputElement->isPasswordField() && document->frame())
         document->setUseSecureKeyboardEntryWhenActive(true);
 }
 
-void InputElement::dispatchBlurEvent(InputElementData& data, Document* document)
+void InputElement::dispatchBlurEvent(InputElementData& data, InputElement* inputElement, Element* element)
 {
-    if (!data.inputElement()->isTextField())
+    if (!inputElement->isTextField())
         return;
 
+    Document* document = element->document();
     Frame* frame = document->frame();
     if (!frame)
         return;
 
-    updatePlaceholderVisibility(data, document);
+    updatePlaceholderVisibility(data, inputElement, element);
 
-    if (data.inputElement()->isPasswordField())
+    if (inputElement->isPasswordField())
         document->setUseSecureKeyboardEntryWhenActive(false);
 
-    frame->textFieldDidEndEditing(data.element());
+    frame->textFieldDidEndEditing(element);
 }
 
-void InputElement::updatePlaceholderVisibility(InputElementData& data, Document* document, bool placeholderValueChanged)
+void InputElement::updatePlaceholderVisibility(InputElementData& data, InputElement* inputElement, Element* element, bool placeholderValueChanged)
 {
-    ASSERT(data.inputElement()->isTextField());
+    ASSERT(inputElement->isTextField());
+    Document* document = element->document();
 
     bool oldPlaceholderShouldBeVisible = data.placeholderShouldBeVisible();
-    Element* element = data.element();
-
-    data.setPlaceholderShouldBeVisible(data.inputElement()->value().isEmpty() 
+    data.setPlaceholderShouldBeVisible(inputElement->value().isEmpty() 
                                        && document->focusedNode() != element
-                                       && !data.inputElement()->placeholderValue().isEmpty());
+                                       && !inputElement->placeholder().isEmpty());
 
     if ((oldPlaceholderShouldBeVisible != data.placeholderShouldBeVisible() || placeholderValueChanged) && element->renderer())
         static_cast<RenderTextControlSingleLine*>(element->renderer())->updatePlaceholderVisibility();
 }
 
-void InputElement::updateFocusAppearance(InputElementData& data, Document* document, bool restorePreviousSelection)
+void InputElement::updateFocusAppearance(InputElementData& data, InputElement* inputElement, Element* element, bool restorePreviousSelection)
 {
-    ASSERT(data.inputElement()->isTextField());
+    ASSERT(inputElement->isTextField());
 
     if (!restorePreviousSelection || data.cachedSelectionStart() == -1)
-        data.inputElement()->select();
+        inputElement->select();
     else
         // Restore the cached selection.
-        updateSelectionRange(data, data.cachedSelectionStart(), data.cachedSelectionEnd());
+        updateSelectionRange(inputElement, element, data.cachedSelectionStart(), data.cachedSelectionEnd());
 
+    Document* document = element->document();
     if (document && document->frame())
         document->frame()->revealSelection();
 }
 
-void InputElement::updateSelectionRange(InputElementData& data, int start, int end)
+void InputElement::updateSelectionRange(InputElement* inputElement, Element* element, int start, int end)
 {
-    if (!data.inputElement()->isTextField())
+    if (!inputElement->isTextField())
         return;
 
-    if (RenderTextControl* renderer = toRenderTextControl(data.element()->renderer()))
+    if (RenderTextControl* renderer = toRenderTextControl(element->renderer()))
         renderer->setSelectionRange(start, end);
 }
 
-void InputElement::aboutToUnload(InputElementData& data, Document* document)
+void InputElement::aboutToUnload(InputElement* inputElement, Element* element)
 {
-    if (!data.inputElement()->isTextField() || !data.element()->focused() || !document->frame())
+    if (!inputElement->isTextField() || !element->focused())
         return;
 
-    document->frame()->textFieldDidEndEditing(data.element());
+    Document* document = element->document();
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+
+    frame->textFieldDidEndEditing(element);
 }
 
-void InputElement::setValueFromRenderer(InputElementData& data, Document* document, const String& value)
+void InputElement::setValueFromRenderer(InputElementData& data, InputElement* inputElement, Element* element, const String& value)
 {
     // Renderer and our event handler are responsible for constraining values.
-    ASSERT(value == data.inputElement()->constrainValue(value) || data.inputElement()->constrainValue(value).isEmpty());
+    ASSERT(value == inputElement->constrainValue(value) || inputElement->constrainValue(value).isEmpty());
 
-    if (data.inputElement()->isTextField())
-        updatePlaceholderVisibility(data, document);
+    if (inputElement->isTextField())
+        updatePlaceholderVisibility(data, inputElement, element);
 
     // Workaround for bug where trailing \n is included in the result of textContent.
     // The assert macro above may also be simplified to:  value == constrainValue(value)
@@ -142,14 +149,11 @@
     else
         data.setValue(value);
 
-    Element* element = data.element();
-    FormControlElement* formControlElement = toFormControlElement(element);
-    ASSERT(formControlElement);
-    formControlElement->setValueMatchesRenderer();
+    element->setFormControlValueMatchesRenderer(true);
 
     // Fire the "input" DOM event
-    element->dispatchEventForType(eventNames().inputEvent, true, false);
-    notifyFormStateChanged(data, document);
+    element->dispatchEvent(eventNames().inputEvent, true, false);
+    notifyFormStateChanged(element);
 }
 
 static int numCharactersInGraphemeClusters(StringImpl* s, int numGraphemeClusters)
@@ -169,12 +173,12 @@
     return textBreakCurrent(it);
 }
 
-String InputElement::constrainValue(const InputElementData& data, const String& proposedValue, int maxLength)
+String InputElement::constrainValue(const InputElement* inputElement, const String& proposedValue, int maxLength)
 {
     String string = proposedValue;
-    if (!data.inputElement()->isTextField())
+    if (!inputElement->isTextField())
         return string;
-        
+
     string.replace("\r\n", " ");
     string.replace('\r', ' ');
     string.replace('\n', ' ');
@@ -211,12 +215,12 @@
     return num;
 }
 
-void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, Document* document, Event* event)
+void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, InputElement* inputElement, Document* document, Event* event)
 {
     ASSERT(event->isBeforeTextInsertedEvent());
 
     // Make sure that the text to be inserted will not violate the maxLength.
-    int oldLength = numGraphemeClusters(data.inputElement()->value().impl());
+    int oldLength = numGraphemeClusters(inputElement->value().impl());
     ASSERT(oldLength <= data.maxLength());
     int selectionLength = numGraphemeClusters(plainText(document->frame()->selection()->selection().toNormalizedRange().get()).impl());
     ASSERT(oldLength >= selectionLength);
@@ -224,18 +228,18 @@
 
     // Truncate the inserted text to avoid violating the maxLength and other constraints.
     BeforeTextInsertedEvent* textEvent = static_cast<BeforeTextInsertedEvent*>(event);
-    textEvent->setText(constrainValue(data, textEvent->text(), maxNewLength));
+    textEvent->setText(constrainValue(inputElement, textEvent->text(), maxNewLength));
 }
 
-void InputElement::parseSizeAttribute(InputElementData& data, MappedAttribute* attribute)
+void InputElement::parseSizeAttribute(InputElementData& data, Element* element, MappedAttribute* attribute)
 {
     data.setSize(attribute->isNull() ? InputElement::s_defaultSize : attribute->value().toInt());
 
-    if (RenderObject* renderer = data.element()->renderer())
+    if (RenderObject* renderer = element->renderer())
         renderer->setNeedsLayoutAndPrefWidthsRecalc();
 }
 
-void InputElement::parseMaxLengthAttribute(InputElementData& data, MappedAttribute* attribute)
+void InputElement::parseMaxLengthAttribute(InputElementData& data, InputElement* inputElement, Element* element, MappedAttribute* attribute)
 {
     int maxLength = attribute->isNull() ? InputElement::s_maximumLength : attribute->value().toInt();
     if (maxLength <= 0 || maxLength > InputElement::s_maximumLength)
@@ -245,45 +249,38 @@
     data.setMaxLength(maxLength);
 
     if (oldMaxLength != maxLength)
-        updateValueIfNeeded(data);
+        updateValueIfNeeded(data, inputElement);
 
-    data.element()->setChanged();
+    element->setNeedsStyleRecalc();
 }
 
-void InputElement::updateValueIfNeeded(InputElementData& data)
+void InputElement::updateValueIfNeeded(InputElementData& data, InputElement* inputElement)
 {
     String oldValue = data.value();
-    String newValue = data.inputElement()->constrainValue(oldValue);
+    String newValue = inputElement->constrainValue(oldValue);
     if (newValue != oldValue)
-        data.inputElement()->setValue(newValue);
+        inputElement->setValue(newValue);
 }
 
-void InputElement::notifyFormStateChanged(InputElementData& data, Document* document)
+void InputElement::notifyFormStateChanged(Element* element)
 {
+    Document* document = element->document();
     Frame* frame = document->frame();
     if (!frame)
         return;
 
     if (Page* page = frame->page())
-        page->chrome()->client()->formStateDidChange(data.element());
+        page->chrome()->client()->formStateDidChange(element);
 }
 
 // InputElementData
-InputElementData::InputElementData(InputElement* inputElement, Element* element)
-    : m_inputElement(inputElement)
-    , m_element(element)
-    , m_placeholderShouldBeVisible(false)
+InputElementData::InputElementData()
+    : m_placeholderShouldBeVisible(false)
     , m_size(InputElement::s_defaultSize)
     , m_maxLength(InputElement::s_maximumLength)
     , m_cachedSelectionStart(-1)
     , m_cachedSelectionEnd(-1)
 {
-    ASSERT(m_inputElement);
-    ASSERT(m_element);
-}
-
-InputElementData::~InputElementData()
-{
 }
 
 const AtomicString& InputElementData::name() const
diff --git a/WebCore/dom/InputElement.h b/WebCore/dom/InputElement.h
index 40c972f..7ad3cbd 100644
--- a/WebCore/dom/InputElement.h
+++ b/WebCore/dom/InputElement.h
@@ -50,7 +50,9 @@
     virtual int size() const = 0;
     virtual String value() const = 0;
     virtual void setValue(const String&) = 0;
-    virtual String placeholderValue() const = 0;
+
+    virtual String placeholder() const = 0;
+    virtual void setPlaceholder(const String&) = 0;
 
     virtual String constrainValue(const String&) const = 0;
     virtual void setValueFromRenderer(const String&) = 0;
@@ -62,32 +64,26 @@
     static const int s_defaultSize;
 
 protected:
-    InputElement() { }
-
-    static void dispatchFocusEvent(InputElementData&, Document*);
-    static void dispatchBlurEvent(InputElementData&, Document*);
-    static void updatePlaceholderVisibility(InputElementData&, Document*, bool placeholderValueChanged = false);
-    static void updateFocusAppearance(InputElementData&, Document*, bool restorePreviousSelection);
-    static void updateSelectionRange(InputElementData&, int start, int end);
-    static void aboutToUnload(InputElementData&, Document*);
-    static void setValueFromRenderer(InputElementData&, Document*, const String&);
-    static String constrainValue(const InputElementData&, const String& proposedValue, int maxLength);
-    static void handleBeforeTextInsertedEvent(InputElementData&, Document*, Event*);
-    static void parseSizeAttribute(InputElementData&, MappedAttribute*);
-    static void parseMaxLengthAttribute(InputElementData&, MappedAttribute*);
-    static void updateValueIfNeeded(InputElementData&);
-    static void notifyFormStateChanged(InputElementData&, Document*);
+    static void dispatchFocusEvent(InputElementData&, InputElement*, Element*);
+    static void dispatchBlurEvent(InputElementData&, InputElement*, Element*);
+    static void updatePlaceholderVisibility(InputElementData&, InputElement*, Element*, bool placeholderValueChanged = false);
+    static void updateFocusAppearance(InputElementData&, InputElement*, Element*, bool restorePreviousSelection);
+    static void updateSelectionRange(InputElement*, Element*, int start, int end);
+    static void aboutToUnload(InputElement*, Element*);
+    static void setValueFromRenderer(InputElementData&, InputElement*, Element*, const String&);
+    static String constrainValue(const InputElement*, const String& proposedValue, int maxLength);
+    static void handleBeforeTextInsertedEvent(InputElementData&, InputElement*, Document*, Event*);
+    static void parseSizeAttribute(InputElementData&, Element*, MappedAttribute*);
+    static void parseMaxLengthAttribute(InputElementData&, InputElement*, Element*, MappedAttribute*);
+    static void updateValueIfNeeded(InputElementData&, InputElement*);
+    static void notifyFormStateChanged(Element*);
 };
 
 // HTML/WMLInputElement hold this struct as member variable
 // and pass it to the static helper functions in InputElement
 class InputElementData {
 public:
-    InputElementData(InputElement*, Element*);
-    ~InputElementData();
-
-    InputElement* inputElement() const { return m_inputElement; }
-    Element* element() const { return m_element; }
+    InputElementData();
 
     bool placeholderShouldBeVisible() const { return m_placeholderShouldBeVisible; }
     void setPlaceholderShouldBeVisible(bool visible) { m_placeholderShouldBeVisible = visible; }
@@ -111,8 +107,6 @@
     void setCachedSelectionEnd(int value) { m_cachedSelectionEnd = value; }
 
 private:
-    InputElement* m_inputElement;
-    Element* m_element;
     bool m_placeholderShouldBeVisible;
     AtomicString m_name;
     String m_value;
diff --git a/WebCore/dom/KeyboardEvent.idl b/WebCore/dom/KeyboardEvent.idl
index 808319f..58e5da7 100644
--- a/WebCore/dom/KeyboardEvent.idl
+++ b/WebCore/dom/KeyboardEvent.idl
@@ -25,7 +25,7 @@
         GenerateConstructor
     ] KeyboardEvent : UIEvent {
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         // KeyLocationCode
         const unsigned long       KEY_LOCATION_STANDARD      = 0x00;
         const unsigned long       KEY_LOCATION_LEFT          = 0x01;
@@ -41,7 +41,7 @@
         readonly attribute boolean          metaKey;
         readonly attribute boolean          altGraphKey;
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         boolean getModifierState(in DOMString keyIdentifierArg);
 #endif
 
@@ -59,7 +59,7 @@
                                in boolean altGraphKey);
 
         // WebKit Extensions
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute long             keyCode;
         readonly attribute long             charCode;
         
diff --git a/WebCore/dom/MessagePort.cpp b/WebCore/dom/MessagePort.cpp
index 312a1f3..efd89e7 100644
--- a/WebCore/dom/MessagePort.cpp
+++ b/WebCore/dom/MessagePort.cpp
@@ -108,7 +108,7 @@
         return 0;
     }
 
-    RefPtr<MessagePort> remotePort = m_entangledPort;
+    RefPtr<MessagePortProxy> remotePort = m_entangledPort;
     RefPtr<MessagePort> newPort = MessagePort::create(0);
 
     // Move all the events in the port message queue of original port to the port message queue of new port, if any, leaving the new port's port message queue in its initial closed state.
@@ -143,9 +143,14 @@
             return;
     }
 
-    m_entangledPort->m_messageQueue.append(EventData::create(message, newMessagePort));
-    if (m_entangledPort->m_queueIsOpen && m_entangledPort->m_scriptExecutionContext)
-        m_entangledPort->m_scriptExecutionContext->processMessagePortMessagesSoon();
+    m_entangledPort->deliverMessage(message, newMessagePort);
+}
+
+void MessagePort::deliverMessage(const String& message, PassRefPtr<MessagePort> dataPort)
+{
+    m_messageQueue.append(EventData::create(message, dataPort));
+    if (m_queueIsOpen && m_scriptExecutionContext)
+        m_scriptExecutionContext->processMessagePortMessagesSoon();
 }
 
 PassRefPtr<MessagePort> MessagePort::startConversation(ScriptExecutionContext* scriptExecutionContext, const String& message)
@@ -157,9 +162,7 @@
 
     entangle(port1.get(), port2.get());
 
-    m_entangledPort->m_messageQueue.append(EventData::create(message, port2));
-    if (m_entangledPort->m_queueIsOpen && m_entangledPort->m_scriptExecutionContext)
-        m_entangledPort->m_scriptExecutionContext->processMessagePortMessagesSoon();
+    m_entangledPort->deliverMessage(message, port2);
     return port1;
 }
 
@@ -177,35 +180,37 @@
     if (!m_entangledPort)
         return;
 
-    MessagePort* otherPort = m_entangledPort;
+    MessagePortProxy* otherPort = m_entangledPort;
     unentangle();
 
     queueCloseEvent();
     otherPort->queueCloseEvent();
 }
 
-void MessagePort::entangle(MessagePort* port1, MessagePort* port2)
+void MessagePort::entangle(MessagePortProxy* port1, MessagePortProxy* port2)
 {
-    if (port1->m_entangledPort) {
-        ASSERT(port1->m_entangledPort != port2);
-        port1->unentangle();
-    }
+    port1->entangle(port2);
+    port2->entangle(port1);
+}
 
-    if (port2->m_entangledPort) {
-        ASSERT(port2->m_entangledPort != port1);
-        port2->unentangle();
+void MessagePort::entangle(MessagePortProxy* remote)
+{
+    // Unentangle from our current port first.
+    if (m_entangledPort) {
+        ASSERT(m_entangledPort != remote);
+        unentangle();
     }
-
-    port1->m_entangledPort = port2;
-    port2->m_entangledPort = port1;
+    m_entangledPort = remote;
 }
 
 void MessagePort::unentangle()
 {
-    ASSERT(this == m_entangledPort->m_entangledPort);
-
-    m_entangledPort->m_entangledPort = 0;
-    m_entangledPort = 0;
+    // Unentangle our end before unentangling the other end.
+    if (m_entangledPort) {
+        MessagePortProxy* remote = m_entangledPort;
+        m_entangledPort = 0;
+        remote->unentangle();
+    }
 }
 
 void MessagePort::contextDestroyed()
diff --git a/WebCore/dom/MessagePort.h b/WebCore/dom/MessagePort.h
index 19252a7..054ae41 100644
--- a/WebCore/dom/MessagePort.h
+++ b/WebCore/dom/MessagePort.h
@@ -30,6 +30,7 @@
 #include "AtomicStringHash.h"
 #include "EventListener.h"
 #include "EventTarget.h"
+#include "MessagePortProxy.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/MessageQueue.h>
@@ -46,7 +47,7 @@
     class String;
     class WorkerContext;
 
-    class MessagePort : public RefCounted<MessagePort>, public EventTarget {
+    class MessagePort : public MessagePortProxy, public EventTarget {
     public:
         static PassRefPtr<MessagePort> create(ScriptExecutionContext* scriptExecutionContext) { return adoptRef(new MessagePort(scriptExecutionContext)); }
         ~MessagePort();
@@ -60,11 +61,16 @@
         void start();
         void close();
 
+        // Implementations of MessagePortProxy APIs
+        virtual void entangle(MessagePortProxy*);
+        virtual void unentangle();
+        virtual void deliverMessage(const String& message, PassRefPtr<MessagePort>);
+        virtual void queueCloseEvent();
+
         bool queueIsOpen() const { return m_queueIsOpen; }
 
-        MessagePort* entangledPort() { return m_entangledPort; }
-        static void entangle(MessagePort*, MessagePort*);
-        void unentangle();
+        MessagePortProxy* entangledPort() { return m_entangledPort; }
+        static void entangle(MessagePortProxy*, MessagePortProxy*);
 
         void contextDestroyed();
         void attachToContext(ScriptExecutionContext*);
@@ -72,7 +78,6 @@
 
         virtual MessagePort* toMessagePort() { return this; }
 
-        void queueCloseEvent();
         void dispatchMessages();
 
         virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
@@ -83,8 +88,8 @@
         typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
         EventListenersMap& eventListeners() { return m_eventListeners; }
 
-        using RefCounted<MessagePort>::ref;
-        using RefCounted<MessagePort>::deref;
+        using RefCounted<MessagePortProxy>::ref;
+        using RefCounted<MessagePortProxy>::deref;
 
         bool hasPendingActivity();
 
@@ -105,7 +110,7 @@
 
         void dispatchCloseEvent();
 
-        MessagePort* m_entangledPort;
+        MessagePortProxy* m_entangledPort;
 
         // FIXME: EventData is necessary to pass messages to other threads. In single threaded case, we can just queue a created event.
         struct EventData : public RefCounted<EventData> {
diff --git a/WebCore/dom/MessagePort.idl b/WebCore/dom/MessagePort.idl
index 2596c0f..03c6bab 100644
--- a/WebCore/dom/MessagePort.idl
+++ b/WebCore/dom/MessagePort.idl
@@ -33,7 +33,7 @@
     ] MessagePort {
 // We need to have something as an ObjC binding, because MessagePort is used in MessageEvent, which already has one,
 // but we don't want to actually expose the API while it is in flux.
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute boolean active;
         void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
             raises(DOMException);
diff --git a/WebCore/css/themeChromiumWin.css b/WebCore/dom/MessagePortProxy.h
similarity index 71%
copy from WebCore/css/themeChromiumWin.css
copy to WebCore/dom/MessagePortProxy.h
index e829373..d024f3d 100644
--- a/WebCore/css/themeChromiumWin.css
+++ b/WebCore/dom/MessagePortProxy.h
@@ -1,39 +1,54 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* These styles override the default styling for HTML elements as defined in
-   WebCore/css/themeWin.css. */
-#include "themeWin.css"
-
-input[type="search"]::-webkit-search-cancel-button,
-input[type="search"]::-webkit-search-results-decoration,
-input[type="search"]::-webkit-search-results-button {
-    margin: 0 0 0 0;
-}
+/*

+ * Copyright (C) 2009 Google Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions are

+ * met:

+ *

+ *     * Redistributions of source code must retain the above copyright

+ * notice, this list of conditions and the following disclaimer.

+ *     * Redistributions in binary form must reproduce the above

+ * copyright notice, this list of conditions and the following disclaimer

+ * in the documentation and/or other materials provided with the

+ * distribution.

+ *     * Neither the name of Google Inc. nor the names of its

+ * contributors may be used to endorse or promote products derived from

+ * this software without specific prior written permission.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#ifndef MessagePortProxy_h

+#define MessagePortProxy_h

+

+#include <wtf/PassRefPtr.h>

+#include <wtf/RefCounted.h>

+

+namespace WebCore {

+

+    class MessagePort;

+    class String;

+

+    class MessagePortProxy : public RefCounted<MessagePortProxy> {

+    public:

+        virtual ~MessagePortProxy() { }

+

+        virtual void entangle(MessagePortProxy*) = 0;

+        virtual void unentangle() = 0;

+        virtual void deliverMessage(const String& message, PassRefPtr<MessagePort>) = 0;

+        virtual void queueCloseEvent() = 0;

+    };

+

+} // namespace WebCore

+

+#endif // MessagePortProxy_h

diff --git a/WebCore/dom/MouseEvent.idl b/WebCore/dom/MouseEvent.idl
index 3195a7a..c509459 100644
--- a/WebCore/dom/MouseEvent.idl
+++ b/WebCore/dom/MouseEvent.idl
@@ -58,7 +58,7 @@
         readonly attribute Node             fromElement;
         readonly attribute Node             toElement;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute Clipboard        dataTransfer;
 #endif
     };
diff --git a/WebCore/dom/MouseRelatedEvent.cpp b/WebCore/dom/MouseRelatedEvent.cpp
index c66b0a8..4ed85ce 100644
--- a/WebCore/dom/MouseRelatedEvent.cpp
+++ b/WebCore/dom/MouseRelatedEvent.cpp
@@ -138,7 +138,7 @@
     m_offsetY = m_pageY;
 
     // Must have an updated render tree for this math to work correctly.
-    targ->document()->updateRendering();
+    targ->document()->updateStyleIfNeeded();
 
     // Adjust offsetX/Y to be relative to the target's position.
     if (!isSimulated()) {
diff --git a/WebCore/dom/NamedAttrMap.cpp b/WebCore/dom/NamedAttrMap.cpp
index 33c60d3..f3e9bb2 100644
--- a/WebCore/dom/NamedAttrMap.cpp
+++ b/WebCore/dom/NamedAttrMap.cpp
@@ -23,8 +23,9 @@
  */
 
 #include "config.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 
+#include "Attr.h"
 #include "Document.h"
 #include "Element.h"
 #include "ExceptionCode.h"
@@ -39,7 +40,7 @@
     return e && e->document()->isHTMLDocument() && e->isHTMLElement();
 }
 
-inline void NamedAttrMap::detachAttributesFromElement()
+inline void NamedNodeMap::detachAttributesFromElement()
 {
     size_t size = m_attributes.size();
     for (size_t i = 0; i < size; i++) {
@@ -48,17 +49,17 @@
     }
 }
 
-NamedAttrMap::~NamedAttrMap()
+NamedNodeMap::~NamedNodeMap()
 {
     detachAttributesFromElement();
 }
 
-bool NamedAttrMap::isMappedAttributeMap() const
+bool NamedNodeMap::isMappedAttributeMap() const
 {
     return false;
 }
 
-PassRefPtr<Node> NamedAttrMap::getNamedItem(const String& name) const
+PassRefPtr<Node> NamedNodeMap::getNamedItem(const String& name) const
 {
     Attribute* a = getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
     if (!a)
@@ -67,12 +68,12 @@
     return a->createAttrIfNeeded(m_element);
 }
 
-PassRefPtr<Node> NamedAttrMap::getNamedItemNS(const String& namespaceURI, const String& localName) const
+PassRefPtr<Node> NamedNodeMap::getNamedItemNS(const String& namespaceURI, const String& localName) const
 {
     return getNamedItem(QualifiedName(nullAtom, localName, namespaceURI));
 }
 
-PassRefPtr<Node> NamedAttrMap::removeNamedItem(const String& name, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::removeNamedItem(const String& name, ExceptionCode& ec)
 {
     Attribute* a = getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
     if (!a) {
@@ -83,12 +84,12 @@
     return removeNamedItem(a->name(), ec);
 }
 
-PassRefPtr<Node> NamedAttrMap::removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode& ec)
 {
     return removeNamedItem(QualifiedName(nullAtom, localName, namespaceURI), ec);
 }
 
-PassRefPtr<Node> NamedAttrMap::getNamedItem(const QualifiedName& name) const
+PassRefPtr<Node> NamedNodeMap::getNamedItem(const QualifiedName& name) const
 {
     Attribute* a = getAttributeItem(name);
     if (!a)
@@ -97,7 +98,7 @@
     return a->createAttrIfNeeded(m_element);
 }
 
-PassRefPtr<Node> NamedAttrMap::setNamedItem(Node* arg, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* arg, ExceptionCode& ec)
 {
     if (!m_element || !arg) {
         ec = NOT_FOUND_ERR;
@@ -146,7 +147,7 @@
 // The DOM2 spec doesn't say that removeAttribute[NS] throws NOT_FOUND_ERR
 // if the attribute is not found, but at this level we have to throw NOT_FOUND_ERR
 // because of removeNamedItem, removeNamedItemNS, and removeAttributeNode.
-PassRefPtr<Node> NamedAttrMap::removeNamedItem(const QualifiedName& name, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::removeNamedItem(const QualifiedName& name, ExceptionCode& ec)
 {
     Attribute* a = getAttributeItem(name);
     if (!a) {
@@ -163,7 +164,7 @@
     return r.release();
 }
 
-PassRefPtr<Node> NamedAttrMap::item (unsigned index) const
+PassRefPtr<Node> NamedNodeMap::item (unsigned index) const
 {
     if (index >= length())
         return 0;
@@ -173,7 +174,7 @@
 
 // We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
 // can tune the behaviour (hasAttribute is case sensitive whereas getAttribute is not).
-Attribute* NamedAttrMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
     for (unsigned i = 0; i < len; ++i) {
@@ -187,7 +188,7 @@
     return 0;
 }
 
-Attribute* NamedAttrMap::getAttributeItem(const QualifiedName& name) const
+Attribute* NamedNodeMap::getAttributeItem(const QualifiedName& name) const
 {
     unsigned len = length();
     for (unsigned i = 0; i < len; ++i) {
@@ -197,21 +198,21 @@
     return 0;
 }
 
-void NamedAttrMap::clearAttributes()
+void NamedNodeMap::clearAttributes()
 {
     detachAttributesFromElement();
     m_attributes.clear();
 }
 
-void NamedAttrMap::detachFromElement()
+void NamedNodeMap::detachFromElement()
 {
-    // we allow a NamedAttrMap w/o an element in case someone still has a reference
+    // we allow a NamedNodeMap w/o an element in case someone still has a reference
     // to if after the element gets deleted - but the map is now invalid
     m_element = 0;
     detachAttributesFromElement();
 }
 
-void NamedAttrMap::setAttributes(const NamedAttrMap& other)
+void NamedNodeMap::setAttributes(const NamedNodeMap& other)
 {
     // clone all attributes in the other map, but attach to our element
     if (!m_element)
@@ -233,13 +234,13 @@
 
     // FIXME: This is wasteful.  The class list could be preserved on a copy, and we
     // wouldn't have to waste time reparsing the attribute.
-    // The derived class, HTMLNamedAttrMap, which manages a parsed class list for the CLASS attribute,
+    // The derived class, HTMLNamedNodeMap, which manages a parsed class list for the CLASS attribute,
     // will update its member variable when parse attribute is called.
     for (unsigned i = 0; i < newLength; i++)
         m_element->attributeChanged(m_attributes[i].get(), true);
 }
 
-void NamedAttrMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
+void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
 {
     RefPtr<Attribute> attribute = prpAttribute;
     
@@ -261,7 +262,7 @@
     }
 }
 
-void NamedAttrMap::removeAttribute(const QualifiedName& name)
+void NamedNodeMap::removeAttribute(const QualifiedName& name)
 {
     unsigned len = length();
     unsigned index = len + 1;
@@ -295,7 +296,7 @@
     }
 }
 
-bool NamedAttrMap::mapsEquivalent(const NamedAttrMap* otherMap) const
+bool NamedNodeMap::mapsEquivalent(const NamedNodeMap* otherMap) const
 {
     if (!otherMap)
         return false;
@@ -315,9 +316,4 @@
     return true;
 }
 
-size_t NamedAttrMap::virtualLength() const
-{
-    return length();
-}
-
 }
diff --git a/WebCore/dom/NamedAttrMap.h b/WebCore/dom/NamedAttrMap.h
index 61628e4..4fb96de 100644
--- a/WebCore/dom/NamedAttrMap.h
+++ b/WebCore/dom/NamedAttrMap.h
@@ -26,8 +26,6 @@
 #define NamedAttrMap_h
 
 #include "Attribute.h"
-#include "NamedNodeMap.h"
-#include <wtf/Vector.h>
 
 #ifdef __OBJC__
 #define id id_AVOID_KEYWORD
@@ -35,27 +33,49 @@
 
 namespace WebCore {
 
-// the map of attributes of an element
-class NamedAttrMap : public NamedNodeMap {
+class Node;
+
+typedef int ExceptionCode;
+
+class NamedNodeMap : public RefCounted<NamedNodeMap> {
     friend class Element;
+
 protected:
-    NamedAttrMap(Element* element) : m_element(element) { }
+    NamedNodeMap(Element* element) : m_element(element) { }
+
 public:
-    static PassRefPtr<NamedAttrMap> create(Element* element) { return adoptRef(new NamedAttrMap(element)); }
+    static PassRefPtr<NamedNodeMap> create(Element* element) { return adoptRef(new NamedNodeMap(element)); }
 
-    virtual ~NamedAttrMap();
+    virtual ~NamedNodeMap();
 
-    void setAttributes(const NamedAttrMap&);
+    // Public DOM interface.
 
+    PassRefPtr<Node> getNamedItem(const String& name) const;
+    PassRefPtr<Node> removeNamedItem(const String& name, ExceptionCode&);
+
+    PassRefPtr<Node> getNamedItemNS(const String& namespaceURI, const String& localName) const;
+    PassRefPtr<Node> removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode&);
+
+    PassRefPtr<Node> getNamedItem(const QualifiedName& name) const;
+    PassRefPtr<Node> removeNamedItem(const QualifiedName& name, ExceptionCode&);
+    PassRefPtr<Node> setNamedItem(Node*, ExceptionCode&);
+    PassRefPtr<Node> setNamedItemNS(Node* node, ExceptionCode& ec) { return setNamedItem(node, ec); }
+
+    PassRefPtr<Node> item(unsigned index) const;
     size_t length() const { return m_attributes.size(); }
+    bool isEmpty() const { return !length(); }
+
+    // Internal interface.
+
+    void setAttributes(const NamedNodeMap&);
+
     Attribute* attributeItem(unsigned index) const { return m_attributes[index].get(); }
     Attribute* getAttributeItem(const QualifiedName&) const;
 
     void shrinkToLength() { m_attributes.shrinkCapacity(length()); }
     void reserveInitialCapacity(unsigned capacity) { m_attributes.reserveInitialCapacity(capacity); }
 
-    // used during parsing: only inserts if not already there
-    // no error checking!
+    // Used during parsing: only inserts if not already there. No error checking!
     void insertAttribute(PassRefPtr<Attribute> newAttribute, bool allowDuplicates)
     {
         ASSERT(!m_element);
@@ -64,11 +84,11 @@
     }
 
     virtual bool isMappedAttributeMap() const;
-    
+
     const AtomicString& id() const { return m_id; }
     void setID(const AtomicString& newId) { m_id = newId; }
 
-    bool mapsEquivalent(const NamedAttrMap* otherMap) const;
+    bool mapsEquivalent(const NamedNodeMap* otherMap) const;
 
     // These functions do no error checking.
     void addAttribute(PassRefPtr<Attribute>);
@@ -84,19 +104,6 @@
     void detachFromElement();
     Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
 
-    virtual PassRefPtr<Node> getNamedItem(const String& name) const;
-    virtual PassRefPtr<Node> removeNamedItem(const String& name, ExceptionCode&);
-
-    virtual PassRefPtr<Node> getNamedItemNS(const String& namespaceURI, const String& localName) const;
-    virtual PassRefPtr<Node> removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode&);
-
-    virtual PassRefPtr<Node> getNamedItem(const QualifiedName& name) const;
-    virtual PassRefPtr<Node> removeNamedItem(const QualifiedName& name, ExceptionCode&);
-    virtual PassRefPtr<Node> setNamedItem(Node*, ExceptionCode&);
-
-    virtual PassRefPtr<Node> item(unsigned index) const;
-    virtual size_t virtualLength() const;
-
     Element* m_element;
     Vector<RefPtr<Attribute> > m_attributes;
     AtomicString m_id;
diff --git a/WebCore/dom/NamedMappedAttrMap.cpp b/WebCore/dom/NamedMappedAttrMap.cpp
index cff4997..d8e3c80 100644
--- a/WebCore/dom/NamedMappedAttrMap.cpp
+++ b/WebCore/dom/NamedMappedAttrMap.cpp
@@ -27,6 +27,7 @@
 
 #include "Document.h"
 #include "Element.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
@@ -34,7 +35,7 @@
 {
     m_classNames.clear();
     m_mappedAttributeCount = 0;
-    NamedAttrMap::clearAttributes();
+    NamedNodeMap::clearAttributes();
 }
 
 bool NamedMappedAttrMap::isMappedAttributeMap() const
diff --git a/WebCore/dom/NamedMappedAttrMap.h b/WebCore/dom/NamedMappedAttrMap.h
index 9267f89..0afa278 100644
--- a/WebCore/dom/NamedMappedAttrMap.h
+++ b/WebCore/dom/NamedMappedAttrMap.h
@@ -27,12 +27,11 @@
 #define NamedMappedAttrMap_h
 
 #include "ClassNames.h"
-#include "MappedAttribute.h" // This header is not required for the NamedMappedAttrMap definition. Should remove it.
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 
 namespace WebCore {
 
-class NamedMappedAttrMap : public NamedAttrMap {
+class NamedMappedAttrMap : public NamedNodeMap {
 public:
     static PassRefPtr<NamedMappedAttrMap> create(Element* element = 0) { return adoptRef(new NamedMappedAttrMap(element)); }
 
@@ -47,7 +46,7 @@
     bool mapsEquivalent(const NamedMappedAttrMap*) const;
 
 private:
-    NamedMappedAttrMap(Element* element) : NamedAttrMap(element), m_mappedAttributeCount(0) { }
+    NamedMappedAttrMap(Element* element) : NamedNodeMap(element), m_mappedAttributeCount(0) { }
 
     virtual void clearAttributes();
     virtual bool isMappedAttributeMap() const;
diff --git a/WebCore/dom/NamedNodeMap.h b/WebCore/dom/NamedNodeMap.h
index 08e6efb..37ef870 100644
--- a/WebCore/dom/NamedNodeMap.h
+++ b/WebCore/dom/NamedNodeMap.h
@@ -1,67 +1 @@
-/*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef NamedNodeMap_h
-#define NamedNodeMap_h
-
-#include <wtf/RefCounted.h>
-#include <wtf/PassRefPtr.h>
-
-namespace WebCore {
-
-class Node;
-class QualifiedName;
-class String;
-
-typedef int ExceptionCode;
-
-// Generic NamedNodeMap interface
-// Other classes implement this for more specific situations e.g. attributes of an element.
-class NamedNodeMap : public RefCounted<NamedNodeMap> {
-public:
-    virtual ~NamedNodeMap() { }
-
-    virtual PassRefPtr<Node> getNamedItem(const String& name) const = 0;
-    virtual PassRefPtr<Node> removeNamedItem(const String& name, ExceptionCode&) = 0;
-
-    virtual PassRefPtr<Node> getNamedItemNS(const String& namespaceURI, const String& localName) const = 0;
-    PassRefPtr<Node> setNamedItemNS(Node* arg, ExceptionCode& ec) { return setNamedItem(arg, ec); }
-    virtual PassRefPtr<Node> removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode&) = 0;
-
-    // DOM methods & attributes for NamedNodeMap
-    virtual PassRefPtr<Node> getNamedItem(const QualifiedName& attrName) const = 0;
-    virtual PassRefPtr<Node> removeNamedItem(const QualifiedName& attrName, ExceptionCode&) = 0;
-    virtual PassRefPtr<Node> setNamedItem(Node*, ExceptionCode&) = 0;
-
-    virtual PassRefPtr<Node> item(unsigned index) const = 0;
-    size_t length() const { return virtualLength(); }
-
-private:
-    virtual size_t virtualLength() const = 0;
-};
-
-} //namespace
-
-#endif
+#include "NamedAttrMap.h"
diff --git a/WebCore/dom/Node.cpp b/WebCore/dom/Node.cpp
index bd8f497..5fbebb9 100644
--- a/WebCore/dom/Node.cpp
+++ b/WebCore/dom/Node.cpp
@@ -4,6 +4,7 @@
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,6 +30,7 @@
 #include "config.h"
 #include "Node.h"
 
+#include "Attr.h"
 #include "CSSParser.h"
 #include "CSSRule.h"
 #include "CSSRuleList.h"
@@ -53,13 +55,12 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
-#include "JSDOMBinding.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
 #include "MouseEvent.h"
 #include "MutationEvent.h"
 #include "NameNodeList.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 #include "NodeRareData.h"
 #include "Page.h"
 #include "PlatformMouseEvent.h"
@@ -82,7 +83,9 @@
 #include "XMLNames.h"
 #include "htmlediting.h"
 #include <wtf/HashSet.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefCountedLeakCounter.h>
+#include <wtf/UnusedParam.h>
 
 #if ENABLE(DOM_STORAGE)
 #include "StorageEvent.h"
@@ -93,6 +96,10 @@
 #include "SVGUseElement.h"
 #endif
 
+#if ENABLE(XHTMLMP)
+#include "HTMLNoScriptElement.h"
+#endif
+
 #define DUMP_NODE_STATISTICS 0
 
 using namespace std;
@@ -157,7 +164,7 @@
                     result.first->second++;
 
                 // AttributeMap stats
-                if (NamedAttrMap* attrMap = element->attributes(true)) {
+                if (NamedNodeMap* attrMap = element->attributes(true)) {
                     attributes += attrMap->length();
                     ++attrMaps;
                     if (attrMap->isMappedAttributeMap())
@@ -254,7 +261,7 @@
     printf("  Number of MappedAttributes: %zu [%zu]\n", mappedAttributes, sizeof(MappedAttribute));
     printf("  Number of MappedAttributes with a StyleDeclaration: %zu\n", mappedAttributesWithStyleDecl);
     printf("  Number of Attributes with an Attr: %zu\n", attributesWithAttr);
-    printf("  Number of NamedAttrMaps: %zu\n", attrMaps);
+    printf("  Number of NamedNodeMaps: %zu\n", attrMaps);
     printf("  Number of NamedMappedAttrMap: %zu\n", mappedAttrMaps);
 #endif
 }
@@ -333,7 +340,7 @@
     , m_hasId(false)
     , m_hasClass(false)
     , m_attached(false)
-    , m_hasChangedChild(false)
+    , m_childNeedsStyleRecalc(false)
     , m_inDocument(false)
     , m_isLink(false)
     , m_active(false)
@@ -405,18 +412,51 @@
         m_next->setPreviousSibling(0);
 }
 
-void Node::setDocument(Document* doc)
+#ifdef NDEBUG
+
+static inline void setWillMoveToNewOwnerDocumentWasCalled(bool)
 {
-    if (inDocument() || m_document == doc)
+}
+
+static inline void setDidMoveToNewOwnerDocumentWasCalled(bool)
+{
+}
+
+#else
+    
+static bool willMoveToNewOwnerDocumentWasCalled;
+static bool didMoveToNewOwnerDocumentWasCalled;
+
+static void setWillMoveToNewOwnerDocumentWasCalled(bool wasCalled)
+{
+    willMoveToNewOwnerDocumentWasCalled = wasCalled;
+}
+
+static void setDidMoveToNewOwnerDocumentWasCalled(bool wasCalled)
+{
+    didMoveToNewOwnerDocumentWasCalled = wasCalled;
+}
+    
+#endif
+    
+void Node::setDocument(Document* document)
+{
+    if (inDocument() || m_document == document)
         return;
 
+    setWillMoveToNewOwnerDocumentWasCalled(false);
     willMoveToNewOwnerDocument();
+    ASSERT(willMoveToNewOwnerDocumentWasCalled);
 
-    updateDOMNodeDocument(this, m_document.get(), doc);
+#if USE(JSC)
+    updateDOMNodeDocument(this, m_document.get(), document);
+#endif
 
-    m_document = doc;
+    m_document = document;
 
+    setDidMoveToNewOwnerDocumentWasCalled(false);
     didMoveToNewOwnerDocument();
+    ASSERT(didMoveToNewOwnerDocumentWasCalled);
 }
 
 NodeRareData* Node::rareData() const
@@ -472,7 +512,7 @@
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -532,43 +572,57 @@
 void Node::normalize()
 {
     // Go through the subtree beneath us, normalizing all nodes. This means that
-    // any two adjacent text nodes are merged together.
+    // any two adjacent text nodes are merged and any empty text nodes are removed.
 
     RefPtr<Node> node = this;
     while (Node* firstChild = node->firstChild())
         node = firstChild;
-    for (; node; node = node->traverseNextNodePostOrder()) {
+    while (node) {
         NodeType type = node->nodeType();
         if (type == ELEMENT_NODE)
             static_cast<Element*>(node.get())->normalizeAttributes();
 
-        Node* firstChild = node->firstChild();
-        if (firstChild && !firstChild->nextSibling() && firstChild->isTextNode()) {
-            Text* text = static_cast<Text*>(firstChild);
-            if (!text->length()) {
-                ExceptionCode ec;
-                text->remove(ec);
-            }
-        }
-
         if (node == this)
             break;
 
-        if (type == TEXT_NODE) {
-            while (1) {
-                Node* nextSibling = node->nextSibling();
-                if (!nextSibling || !nextSibling->isTextNode())
-                    break;
-                // Current child and the next one are both text nodes. Merge them.
-                Text* text = static_cast<Text*>(node.get());
-                RefPtr<Text> nextText = static_cast<Text*>(nextSibling);
-                unsigned offset = text->length();
-                ExceptionCode ec;
-                text->appendData(nextText->data(), ec);
-                document()->textNodesMerged(nextText.get(), offset);
-                nextText->remove(ec);
-            }
+        if (type != TEXT_NODE) {
+            node = node->traverseNextNodePostOrder();
+            continue;
         }
+
+        Text* text = static_cast<Text*>(node.get());
+
+        // Remove empty text nodes.
+        if (!text->length()) {
+            // Care must be taken to get the next node before removing the current node.
+            node = node->traverseNextNodePostOrder();
+            ExceptionCode ec;
+            text->remove(ec);
+            continue;
+        }
+
+        // Merge text nodes.
+        while (Node* nextSibling = node->nextSibling()) {
+            if (!nextSibling->isTextNode())
+                break;
+            RefPtr<Text> nextText = static_cast<Text*>(nextSibling);
+
+            // Remove empty text nodes.
+            if (!nextText->length()) {
+                ExceptionCode ec;
+                nextText->remove(ec);
+                continue;
+            }
+
+            // Both non-empty text nodes. Merge them.
+            unsigned offset = text->length();
+            ExceptionCode ec;
+            text->appendData(nextText->data(), ec);
+            document()->textNodesMerged(nextText.get(), offset);
+            nextText->remove(ec);
+        }
+
+        node = node->traverseNextNodePostOrder();
     }
 }
 
@@ -634,7 +688,7 @@
     return IntRect();
 }
 
-void Node::setChanged(StyleChangeType changeType)
+void Node::setNeedsStyleRecalc(StyleChangeType changeType)
 {
     if ((changeType != NoStyleChange) && !attached()) // changed compared to what?
         return;
@@ -643,9 +697,10 @@
         m_styleChange = changeType;
 
     if (m_styleChange != NoStyleChange) {
-        for (Node* p = parentNode(); p && !p->hasChangedChild(); p = p->parentNode())
-            p->setHasChangedChild(true);
-        document()->setDocumentChanged(true);
+        for (Node* p = parentNode(); p && !p->childNeedsStyleRecalc(); p = p->parentNode())
+            p->setChildNeedsStyleRecalc(true);
+        if (document()->childNeedsStyleRecalc())
+            document()->scheduleStyleRecalc();
     }
 }
 
@@ -667,7 +722,7 @@
         }
 
         if (n->firstChild())
-            n->setHasChangedChild(true);
+            n->setChildNeedsStyleRecalc(true);
         n->m_styleChange = FullStyleChange;
         n->m_attached = true;
     }
@@ -678,9 +733,10 @@
             lazyAttachedAncestor->detach();
         lazyAttachedAncestor->attach();
     } else {
-        for (Node* p = parentNode(); p && !p->hasChangedChild(); p = p->parentNode())
-            p->setHasChangedChild(true);
-        document()->setDocumentChanged(true);
+        for (Node* p = parentNode(); p && !p->childNeedsStyleRecalc(); p = p->parentNode())
+            p->setChildNeedsStyleRecalc(true);
+        if (document()->childNeedsStyleRecalc())
+            document()->scheduleStyleRecalc();
     }
 }
 
@@ -729,7 +785,7 @@
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     } else if (!m_document->hasNodeListCaches()) {
         // We haven't been receiving notifications while there were no registered lists, so the cache is invalid now.
@@ -1231,7 +1287,7 @@
     
     RenderObject* parentRenderer = parent->renderer();
     if (parentRenderer && parentRenderer->canHaveChildren()
-#if ENABLE(SVG)
+#if ENABLE(SVG) || ENABLE(XHTMLMP)
         && parent->childShouldCreateRenderer(this)
 #endif
         ) {
@@ -1252,8 +1308,14 @@
 
 PassRefPtr<RenderStyle> Node::styleForRenderer()
 {
-    if (isElementNode())
-        return document()->styleSelector()->styleForElement(static_cast<Element*>(this));
+    if (isElementNode()) {
+        bool allowSharing = true;
+#if ENABLE(XHTMLMP)
+        // noscript needs the display property protected - it's a special case
+        allowSharing = localName() != HTMLNames::noscriptTag.localName();
+#endif
+        return document()->styleSelector()->styleForElement(static_cast<Element*>(this), 0, allowSharing);
+    }
     return parentNode() && parentNode()->renderer() ? parentNode()->renderer()->style() : 0;
 }
 
@@ -1417,7 +1479,7 @@
     
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -1438,7 +1500,7 @@
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -1453,7 +1515,7 @@
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -1618,8 +1680,8 @@
     if (nodeValue() != other->nodeValue())
         return false;
     
-    NamedAttrMap *attrs = attributes();
-    NamedAttrMap *otherAttrs = other->attributes();
+    NamedNodeMap *attrs = attributes();
+    NamedNodeMap *otherAttrs = other->attributes();
     
     if (!attrs && otherAttrs)
         return false;
@@ -1660,7 +1722,7 @@
                 return elem->namespaceURI() == namespaceURI;
 
             if (elem->hasAttributes()) {
-                NamedAttrMap *attrs = elem->attributes();
+                NamedNodeMap *attrs = elem->attributes();
                 
                 for (unsigned i = 0; i < attrs->length(); i++) {
                     Attribute *attr = attrs->attributeItem(i);
@@ -1746,7 +1808,7 @@
                 return elem->namespaceURI();
             
             if (elem->hasAttributes()) {
-                NamedAttrMap *attrs = elem->attributes();
+                NamedNodeMap *attrs = elem->attributes();
                 
                 for (unsigned i = 0; i < attrs->length(); i++) {
                     Attribute *attr = attrs->attributeItem(i);
@@ -1801,7 +1863,7 @@
         return prefix();
     
     if (hasAttributes()) {
-        NamedAttrMap *attrs = attributes();
+        NamedNodeMap *attrs = attributes();
         
         for (unsigned i = 0; i < attrs->length(); i++) {
             Attribute *attr = attrs->attributeItem(i);
@@ -1942,7 +2004,7 @@
     if (attr1 && attr2 && start1 == start2 && start1) {
         // We are comparing two attributes on the same node.  Crawl our attribute map
         // and see which one we hit first.
-        NamedAttrMap* map = attr1->ownerElement()->attributes(true);
+        NamedNodeMap* map = attr1->ownerElement()->attributes(true);
         unsigned length = map->length();
         for (unsigned i = 0; i < length; ++i) {
             // If neither of the two determining nodes is a child node and nodeType is the same for both determining nodes, then an 
@@ -2267,19 +2329,26 @@
 {
     if (!eventListeners().isEmpty())
         document()->unregisterDisconnectedNodeWithEventListeners(this);
+
+    ASSERT(!willMoveToNewOwnerDocumentWasCalled);
+    setWillMoveToNewOwnerDocumentWasCalled(true);
 }
 
 void Node::didMoveToNewOwnerDocument()
 {
     if (!eventListeners().isEmpty())
         document()->registerDisconnectedNodeWithEventListeners(this);
+
+    ASSERT(!didMoveToNewOwnerDocumentWasCalled);
+    setDidMoveToNewOwnerDocumentWasCalled(true);
 }
 
 static inline void updateSVGElementInstancesAfterEventListenerChange(Node* referenceNode)
 {
+#if !ENABLE(SVG)
+    UNUSED_PARAM(referenceNode);
+#else
     ASSERT(referenceNode);
-
-#if ENABLE(SVG)
     if (!referenceNode->isSVGElement())
         return;
 
@@ -2471,14 +2540,14 @@
         }
     }
 
-    // Set up a pointer to indicate whether to dispatch window events.
+    // Set up a pointer to indicate whether / where to dispatch window events.
     // We don't dispatch load events to the window. That quirk was originally
     // added because Mozilla doesn't propagate load events to the window object.
-    Document* documentForWindowEvents = 0;
+    DOMWindow* targetForWindowEvents = 0;
     if (event->type() != eventNames().loadEvent) {
         Node* topLevelContainer = ancestors.isEmpty() ? this : ancestors.last().get();
         if (topLevelContainer->isDocumentNode())
-            documentForWindowEvents = static_cast<Document*>(topLevelContainer);
+            targetForWindowEvents = static_cast<Document*>(topLevelContainer)->domWindow();
     }
 
     // Give the target node a chance to do some work before DOM event handlers get a crack.
@@ -2489,9 +2558,9 @@
     // Trigger capturing event handlers, starting at the top and working our way down.
     event->setEventPhase(Event::CAPTURING_PHASE);
 
-    if (documentForWindowEvents) {
-        event->setCurrentTarget(documentForWindowEvents);
-        documentForWindowEvents->handleWindowEvent(event.get(), true);
+    if (targetForWindowEvents) {
+        event->setCurrentTarget(targetForWindowEvents->document()); // FIXME: targetForWindowEvents should be the event target.
+        targetForWindowEvents->handleEvent(event.get(), true);
         if (event->propagationStopped())
             goto doneDispatching;
     }
@@ -2527,9 +2596,9 @@
             if (event->propagationStopped() || event->cancelBubble())
                 goto doneDispatching;
         }
-        if (documentForWindowEvents) {
-            event->setCurrentTarget(documentForWindowEvents);
-            documentForWindowEvents->handleWindowEvent(event.get(), false);
+        if (targetForWindowEvents) {
+            event->setCurrentTarget(targetForWindowEvents->document()); // FIXME: targetForWindowEvents should be the event target.
+            targetForWindowEvents->handleEvent(event.get(), false);
             if (event->propagationStopped() || event->cancelBubble())
                 goto doneDispatching;
         }
@@ -2566,12 +2635,12 @@
     }
 
 doneWithDefault:
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 
     return !event->defaultPrevented();
 }
 
-bool Node::dispatchSubtreeModifiedEvent()
+void Node::dispatchSubtreeModifiedEvent()
 {
     ASSERT(!eventDispatchForbidden());
     
@@ -2580,41 +2649,13 @@
     notifyNodeListsAttributeChanged(); // FIXME: Can do better some day. Really only care about the name attribute changing.
     
     if (!document()->hasListenerType(Document::DOMSUBTREEMODIFIED_LISTENER))
-        return false;
+        return;
+
     ExceptionCode ec = 0;
-    return dispatchEvent(MutationEvent::create(eventNames().DOMSubtreeModifiedEvent, true, false, 0, String(), String(), String(), 0), ec);
+    dispatchMutationEvent(eventNames().DOMSubtreeModifiedEvent, true, 0, String(), String(), ec); 
 }
 
-void Node::dispatchWindowEvent(PassRefPtr<Event> e)
-{
-    ASSERT(!eventDispatchForbidden());
-    RefPtr<Event> evt(e);
-    RefPtr<Document> doc = document();
-    evt->setTarget(doc);
-    doc->handleWindowEvent(evt.get(), true);
-    doc->handleWindowEvent(evt.get(), false);
-}
-
-void Node::dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    RefPtr<Document> doc = document();
-    dispatchWindowEvent(Event::create(eventType, canBubbleArg, cancelableArg));
-    
-    if (eventType == eventNames().loadEvent) {
-        // For onload events, send a separate load event to the enclosing frame only.
-        // This is a DOM extension and is independent of bubbling/capturing rules of
-        // the DOM.
-        Element* ownerElement = doc->ownerElement();
-        if (ownerElement) {
-            RefPtr<Event> ownerEvent = Event::create(eventType, false, cancelableArg);
-            ownerEvent->setTarget(ownerElement);
-            ownerElement->dispatchGenericEvent(ownerEvent.release());
-        }
-    }
-}
-
-bool Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent)
+void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent)
 {
     ASSERT(!eventDispatchForbidden());
     ASSERT(eventType == eventNames().DOMFocusInEvent || eventType == eventNames().DOMFocusOutEvent || eventType == eventNames().DOMActivateEvent);
@@ -2624,7 +2665,7 @@
     ExceptionCode ec = 0;
     RefPtr<UIEvent> evt = UIEvent::create(eventType, true, cancelable, document()->defaultView(), detail);
     evt->setUnderlyingEvent(underlyingEvent);
-    return dispatchEvent(evt.release(), ec);
+    dispatchEvent(evt.release(), ec);
 }
 
 bool Node::dispatchKeyEvent(const PlatformKeyboardEvent& key)
@@ -2812,56 +2853,54 @@
         e.accept();
 }
 
-bool Node::dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime)
+void Node::dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime)
 {
     ASSERT(!eventDispatchForbidden());
     
     ExceptionCode ec = 0;
-    return dispatchEvent(WebKitAnimationEvent::create(eventType, animationName, elapsedTime), ec);
+    dispatchEvent(WebKitAnimationEvent::create(eventType, animationName, elapsedTime), ec);
 }
 
-bool Node::dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime)
+void Node::dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime)
 {
     ASSERT(!eventDispatchForbidden());
     
     ExceptionCode ec = 0;
-    return dispatchEvent(WebKitTransitionEvent::create(eventType, propertyName, elapsedTime), ec);
+    dispatchEvent(WebKitTransitionEvent::create(eventType, propertyName, elapsedTime), ec);
+}
+
+void Node::dispatchMutationEvent(const AtomicString& eventType, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode& ec)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    dispatchEvent(MutationEvent::create(eventType, canBubble, false, relatedNode, prevValue, newValue, String(), 0), ec);
 }
 
 void Node::dispatchFocusEvent()
 {
-    dispatchEventForType(eventNames().focusEvent, false, false);
+    dispatchEvent(eventNames().focusEvent, false, false);
 }
 
 void Node::dispatchBlurEvent()
 {
-    dispatchEventForType(eventNames().blurEvent, false, false);
+    dispatchEvent(eventNames().blurEvent, false, false);
 }
 
-bool Node::dispatchEventForType(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
+bool Node::dispatchEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
 {
     ASSERT(!eventDispatchForbidden());
     ExceptionCode ec = 0;
     return dispatchEvent(Event::create(eventType, canBubbleArg, cancelableArg), ec);
 }
 
-bool Node::dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg)
+void Node::dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg)
 {
     ASSERT(!eventDispatchForbidden());
     ExceptionCode ec = 0;
-    return dispatchEvent(ProgressEvent::create(eventType, lengthComputableArg, loadedArg, totalArg), ec);
+    dispatchEvent(ProgressEvent::create(eventType, lengthComputableArg, loadedArg, totalArg), ec);
 }
 
-void Node::dispatchStorageEvent(const AtomicString &eventType, const String& key, const String& oldValue, const String& newValue, Frame* source)
-{
-#if ENABLE(DOM_STORAGE)
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    dispatchEvent(StorageEvent::create(eventType, key, oldValue, newValue, source->document()->documentURI(), source->domWindow()), ec);
-#endif
-}
-
-void Node::removeInlineEventListenerForType(const AtomicString& eventType)
+void Node::clearAttributeEventListener(const AtomicString& eventType)
 {
     if (!hasRareData())
         return;
@@ -2873,7 +2912,7 @@
     size_t size = listeners->size();
     for (size_t i = 0; i < size; ++i) {
         RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() != eventType || !r.listener()->isInline())
+        if (r.eventType() != eventType || !r.listener()->isAttribute())
             continue;
 
         r.setRemoved(true);
@@ -2888,26 +2927,20 @@
     }
 }
 
-void Node::setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+void Node::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
 {
-    // In case we are the only one holding a reference to it, we don't want removeInlineEventListenerForType to destroy it.
-    removeInlineEventListenerForType(eventType);
+    clearAttributeEventListener(eventType);
     if (listener)
         addEventListener(eventType, listener, false);
 }
 
-void Node::setInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute* attr)
-{
-    setInlineEventListenerForType(eventType, document()->createEventListener(attr->localName().string(), attr->value(), this));
-}
-
-EventListener* Node::inlineEventListenerForType(const AtomicString& eventType) const
+EventListener* Node::getAttributeEventListener(const AtomicString& eventType) const
 {
     const RegisteredEventListenerVector& listeners = eventListeners();
     size_t size = listeners.size();
     for (size_t i = 0; i < size; ++i) {
         const RegisteredEventListener& r = *listeners[i];
-        if (r.eventType() == eventType && r.listener()->isInline())
+        if (r.eventType() == eventType && r.listener()->isAttribute())
             return r.listener();
     }
     return 0;
@@ -2943,443 +2976,443 @@
 
 EventListener* Node::onabort() const
 {
-    return inlineEventListenerForType(eventNames().abortEvent);
+    return getAttributeEventListener(eventNames().abortEvent);
 }
 
 void Node::setOnabort(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().abortEvent, eventListener);
+    setAttributeEventListener(eventNames().abortEvent, eventListener);
 }
 
 EventListener* Node::onblur() const
 {
-    return inlineEventListenerForType(eventNames().blurEvent);
+    return getAttributeEventListener(eventNames().blurEvent);
 }
 
 void Node::setOnblur(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().blurEvent, eventListener);
+    setAttributeEventListener(eventNames().blurEvent, eventListener);
 }
 
 EventListener* Node::onchange() const
 {
-    return inlineEventListenerForType(eventNames().changeEvent);
+    return getAttributeEventListener(eventNames().changeEvent);
 }
 
 void Node::setOnchange(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().changeEvent, eventListener);
+    setAttributeEventListener(eventNames().changeEvent, eventListener);
 }
 
 EventListener* Node::onclick() const
 {
-    return inlineEventListenerForType(eventNames().clickEvent);
+    return getAttributeEventListener(eventNames().clickEvent);
 }
 
 void Node::setOnclick(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().clickEvent, eventListener);
+    setAttributeEventListener(eventNames().clickEvent, eventListener);
 }
 
 EventListener* Node::oncontextmenu() const
 {
-    return inlineEventListenerForType(eventNames().contextmenuEvent);
+    return getAttributeEventListener(eventNames().contextmenuEvent);
 }
 
 void Node::setOncontextmenu(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().contextmenuEvent, eventListener);
+    setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
 }
 
 EventListener* Node::ondblclick() const
 {
-    return inlineEventListenerForType(eventNames().dblclickEvent);
+    return getAttributeEventListener(eventNames().dblclickEvent);
 }
 
 void Node::setOndblclick(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().dblclickEvent, eventListener);
+    setAttributeEventListener(eventNames().dblclickEvent, eventListener);
 }
 
 EventListener* Node::onerror() const
 {
-    return inlineEventListenerForType(eventNames().errorEvent);
+    return getAttributeEventListener(eventNames().errorEvent);
 }
 
 void Node::setOnerror(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().errorEvent, eventListener);
+    setAttributeEventListener(eventNames().errorEvent, eventListener);
 }
 
 EventListener* Node::onfocus() const
 {
-    return inlineEventListenerForType(eventNames().focusEvent);
+    return getAttributeEventListener(eventNames().focusEvent);
 }
 
 void Node::setOnfocus(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().focusEvent, eventListener);
+    setAttributeEventListener(eventNames().focusEvent, eventListener);
 }
 
 EventListener* Node::oninput() const
 {
-    return inlineEventListenerForType(eventNames().inputEvent);
+    return getAttributeEventListener(eventNames().inputEvent);
 }
 
 void Node::setOninput(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().inputEvent, eventListener);
+    setAttributeEventListener(eventNames().inputEvent, eventListener);
 }
 
 EventListener* Node::onkeydown() const
 {
-    return inlineEventListenerForType(eventNames().keydownEvent);
+    return getAttributeEventListener(eventNames().keydownEvent);
 }
 
 void Node::setOnkeydown(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keydownEvent, eventListener);
+    setAttributeEventListener(eventNames().keydownEvent, eventListener);
 }
 
 EventListener* Node::onkeypress() const
 {
-    return inlineEventListenerForType(eventNames().keypressEvent);
+    return getAttributeEventListener(eventNames().keypressEvent);
 }
 
 void Node::setOnkeypress(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keypressEvent, eventListener);
+    setAttributeEventListener(eventNames().keypressEvent, eventListener);
 }
 
 EventListener* Node::onkeyup() const
 {
-    return inlineEventListenerForType(eventNames().keyupEvent);
+    return getAttributeEventListener(eventNames().keyupEvent);
 }
 
 void Node::setOnkeyup(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keyupEvent, eventListener);
+    setAttributeEventListener(eventNames().keyupEvent, eventListener);
 }
 
 EventListener* Node::onload() const
 {
-    return inlineEventListenerForType(eventNames().loadEvent);
+    return getAttributeEventListener(eventNames().loadEvent);
 }
 
 void Node::setOnload(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().loadEvent, eventListener);
+    setAttributeEventListener(eventNames().loadEvent, eventListener);
 }
 
 EventListener* Node::onmousedown() const
 {
-    return inlineEventListenerForType(eventNames().mousedownEvent);
+    return getAttributeEventListener(eventNames().mousedownEvent);
 }
 
 void Node::setOnmousedown(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousedownEvent, eventListener);
+    setAttributeEventListener(eventNames().mousedownEvent, eventListener);
 }
 
 EventListener* Node::onmousemove() const
 {
-    return inlineEventListenerForType(eventNames().mousemoveEvent);
+    return getAttributeEventListener(eventNames().mousemoveEvent);
 }
 
 void Node::setOnmousemove(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousemoveEvent, eventListener);
+    setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
 }
 
 EventListener* Node::onmouseout() const
 {
-    return inlineEventListenerForType(eventNames().mouseoutEvent);
+    return getAttributeEventListener(eventNames().mouseoutEvent);
 }
 
 void Node::setOnmouseout(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseoutEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
 }
 
 EventListener* Node::onmouseover() const
 {
-    return inlineEventListenerForType(eventNames().mouseoverEvent);
+    return getAttributeEventListener(eventNames().mouseoverEvent);
 }
 
 void Node::setOnmouseover(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseoverEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
 }
 
 EventListener* Node::onmouseup() const
 {
-    return inlineEventListenerForType(eventNames().mouseupEvent);
+    return getAttributeEventListener(eventNames().mouseupEvent);
 }
 
 void Node::setOnmouseup(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseupEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseupEvent, eventListener);
 }
 
 EventListener* Node::onmousewheel() const
 {
-    return inlineEventListenerForType(eventNames().mousewheelEvent);
+    return getAttributeEventListener(eventNames().mousewheelEvent);
 }
 
 void Node::setOnmousewheel(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousewheelEvent, eventListener);
+    setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
 }
 
 EventListener* Node::onbeforecut() const
 {
-    return inlineEventListenerForType(eventNames().beforecutEvent);
+    return getAttributeEventListener(eventNames().beforecutEvent);
 }
 
 void Node::setOnbeforecut(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().beforecutEvent, eventListener);
+    setAttributeEventListener(eventNames().beforecutEvent, eventListener);
 }
 
 EventListener* Node::oncut() const
 {
-    return inlineEventListenerForType(eventNames().cutEvent);
+    return getAttributeEventListener(eventNames().cutEvent);
 }
 
 void Node::setOncut(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().cutEvent, eventListener);
+    setAttributeEventListener(eventNames().cutEvent, eventListener);
 }
 
 EventListener* Node::onbeforecopy() const
 {
-    return inlineEventListenerForType(eventNames().beforecopyEvent);
+    return getAttributeEventListener(eventNames().beforecopyEvent);
 }
 
 void Node::setOnbeforecopy(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().beforecopyEvent, eventListener);
+    setAttributeEventListener(eventNames().beforecopyEvent, eventListener);
 }
 
 EventListener* Node::oncopy() const
 {
-    return inlineEventListenerForType(eventNames().copyEvent);
+    return getAttributeEventListener(eventNames().copyEvent);
 }
 
 void Node::setOncopy(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().copyEvent, eventListener);
+    setAttributeEventListener(eventNames().copyEvent, eventListener);
 }
 
 EventListener* Node::onbeforepaste() const
 {
-    return inlineEventListenerForType(eventNames().beforepasteEvent);
+    return getAttributeEventListener(eventNames().beforepasteEvent);
 }
 
 void Node::setOnbeforepaste(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().beforepasteEvent, eventListener);
+    setAttributeEventListener(eventNames().beforepasteEvent, eventListener);
 }
 
 EventListener* Node::onpaste() const
 {
-    return inlineEventListenerForType(eventNames().pasteEvent);
+    return getAttributeEventListener(eventNames().pasteEvent);
 }
 
 void Node::setOnpaste(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().pasteEvent, eventListener);
+    setAttributeEventListener(eventNames().pasteEvent, eventListener);
 }
 
 EventListener* Node::ondragenter() const
 {
-    return inlineEventListenerForType(eventNames().dragenterEvent);
+    return getAttributeEventListener(eventNames().dragenterEvent);
 }
 
 void Node::setOndragenter(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().dragenterEvent, eventListener);
+    setAttributeEventListener(eventNames().dragenterEvent, eventListener);
 }
 
 EventListener* Node::ondragover() const
 {
-    return inlineEventListenerForType(eventNames().dragoverEvent);
+    return getAttributeEventListener(eventNames().dragoverEvent);
 }
 
 void Node::setOndragover(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().dragoverEvent, eventListener);
+    setAttributeEventListener(eventNames().dragoverEvent, eventListener);
 }
 
 EventListener* Node::ondragleave() const
 {
-    return inlineEventListenerForType(eventNames().dragleaveEvent);
+    return getAttributeEventListener(eventNames().dragleaveEvent);
 }
 
 void Node::setOndragleave(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().dragleaveEvent, eventListener);
+    setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
 }
 
 EventListener* Node::ondrop() const
 {
-    return inlineEventListenerForType(eventNames().dropEvent);
+    return getAttributeEventListener(eventNames().dropEvent);
 }
 
 void Node::setOndrop(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().dropEvent, eventListener);
+    setAttributeEventListener(eventNames().dropEvent, eventListener);
 }
 
 EventListener* Node::ondragstart() const
 {
-    return inlineEventListenerForType(eventNames().dragstartEvent);
+    return getAttributeEventListener(eventNames().dragstartEvent);
 }
 
 void Node::setOndragstart(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().dragstartEvent, eventListener);
+    setAttributeEventListener(eventNames().dragstartEvent, eventListener);
 }
 
 EventListener* Node::ondrag() const
 {
-    return inlineEventListenerForType(eventNames().dragEvent);
+    return getAttributeEventListener(eventNames().dragEvent);
 }
 
 void Node::setOndrag(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().dragEvent, eventListener);
+    setAttributeEventListener(eventNames().dragEvent, eventListener);
 }
 
 EventListener* Node::ondragend() const
 {
-    return inlineEventListenerForType(eventNames().dragendEvent);
+    return getAttributeEventListener(eventNames().dragendEvent);
 }
 
 void Node::setOndragend(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().dragendEvent, eventListener);
+    setAttributeEventListener(eventNames().dragendEvent, eventListener);
 }
 
 EventListener* Node::onreset() const
 {
-    return inlineEventListenerForType(eventNames().resetEvent);
+    return getAttributeEventListener(eventNames().resetEvent);
 }
 
 void Node::setOnreset(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().resetEvent, eventListener);
+    setAttributeEventListener(eventNames().resetEvent, eventListener);
 }
 
 EventListener* Node::onresize() const
 {
-    return inlineEventListenerForType(eventNames().resizeEvent);
+    return getAttributeEventListener(eventNames().resizeEvent);
 }
 
 void Node::setOnresize(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().resizeEvent, eventListener);
+    setAttributeEventListener(eventNames().resizeEvent, eventListener);
 }
 
 EventListener* Node::onscroll() const
 {
-    return inlineEventListenerForType(eventNames().scrollEvent);
+    return getAttributeEventListener(eventNames().scrollEvent);
 }
 
 void Node::setOnscroll(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().scrollEvent, eventListener);
+    setAttributeEventListener(eventNames().scrollEvent, eventListener);
 }
 
 EventListener* Node::onsearch() const
 {
-    return inlineEventListenerForType(eventNames().searchEvent);
+    return getAttributeEventListener(eventNames().searchEvent);
 }
 
 void Node::setOnsearch(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().searchEvent, eventListener);
+    setAttributeEventListener(eventNames().searchEvent, eventListener);
 }
 
 EventListener* Node::onselect() const
 {
-    return inlineEventListenerForType(eventNames().selectEvent);
+    return getAttributeEventListener(eventNames().selectEvent);
 }
 
 void Node::setOnselect(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().selectEvent, eventListener);
+    setAttributeEventListener(eventNames().selectEvent, eventListener);
 }
 
 EventListener* Node::onselectstart() const
 {
-    return inlineEventListenerForType(eventNames().selectstartEvent);
+    return getAttributeEventListener(eventNames().selectstartEvent);
 }
 
 void Node::setOnselectstart(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().selectstartEvent, eventListener);
+    setAttributeEventListener(eventNames().selectstartEvent, eventListener);
 }
 
 EventListener* Node::onsubmit() const
 {
-    return inlineEventListenerForType(eventNames().submitEvent);
+    return getAttributeEventListener(eventNames().submitEvent);
 }
 
 void Node::setOnsubmit(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().submitEvent, eventListener);
+    setAttributeEventListener(eventNames().submitEvent, eventListener);
 }
 
 EventListener* Node::onunload() const
 {
-    return inlineEventListenerForType(eventNames().unloadEvent);
+    return getAttributeEventListener(eventNames().unloadEvent);
 }
 
 void Node::setOnunload(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().unloadEvent, eventListener);
+    setAttributeEventListener(eventNames().unloadEvent, eventListener);
 }
 
 #if ENABLE(TOUCH_EVENTS) // Android
 EventListener* Node::ontouchstart() const
 {
-    return inlineEventListenerForType(eventNames().touchstartEvent);
+    return getAttributeEventListener(eventNames().touchstartEvent);
 }
 
 void Node::setOntouchstart(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().touchstartEvent, eventListener);
+    setAttributeEventListener(eventNames().touchstartEvent, eventListener);
 }
 
 EventListener* Node::ontouchend() const
 {
-    return inlineEventListenerForType(eventNames().touchendEvent);
+    return getAttributeEventListener(eventNames().touchendEvent);
 }
 
 void Node::setOntouchend(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().touchendEvent, eventListener);
+    setAttributeEventListener(eventNames().touchendEvent, eventListener);
 }
 
 EventListener* Node::ontouchmove() const
 {
-    return inlineEventListenerForType(eventNames().touchmoveEvent);
+    return getAttributeEventListener(eventNames().touchmoveEvent);
 }
 
 void Node::setOntouchmove(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().touchmoveEvent, eventListener);
+    setAttributeEventListener(eventNames().touchmoveEvent, eventListener);
 }
 
 EventListener* Node::ontouchcancel() const
 {
-    return inlineEventListenerForType(eventNames().touchcancelEvent);
+    return getAttributeEventListener(eventNames().touchcancelEvent);
 }
 
 void Node::setOntouchcancel(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().touchcancelEvent, eventListener);
+    setAttributeEventListener(eventNames().touchcancelEvent, eventListener);
 }
 #endif // ENABLE(TOUCH_EVENT)
 
diff --git a/WebCore/dom/Node.h b/WebCore/dom/Node.h
index 01f2736..43f5f76 100644
--- a/WebCore/dom/Node.h
+++ b/WebCore/dom/Node.h
@@ -3,6 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,6 +29,7 @@
 #include "EventTarget.h"
 #include "KURLHash.h"
 #include "PlatformString.h"
+#include "RegisteredEventListener.h"
 #include "TreeShared.h"
 #include "FloatPoint.h"
 #include <wtf/Assertions.h>
@@ -49,7 +51,7 @@
 class IntRect;
 class KeyboardEvent;
 class NSResolver;
-class NamedAttrMap;
+class NamedNodeMap;
 class NodeList;
 class NodeRareData;
 class PlatformKeyboardEvent;
@@ -66,8 +68,6 @@
 
 typedef int ExceptionCode;
 
-typedef Vector<RefPtr<RegisteredEventListener> > RegisteredEventListenerVector;
-
 enum StyleChangeType { NoStyleChange, InlineStyleChange, FullStyleChange, AnimationStyleChange };
 
 const unsigned short DOCUMENT_POSITION_EQUIVALENT = 0x00;
@@ -126,7 +126,7 @@
     Node* firstChild() const { return isContainerNode() ? containerFirstChild() : 0; }
     Node* lastChild() const { return isContainerNode() ? containerLastChild() : 0; }
     bool hasAttributes() const;
-    NamedAttrMap* attributes() const;
+    NamedNodeMap* attributes() const;
 
     virtual KURL baseURI() const;
     
@@ -265,16 +265,16 @@
     bool focused() const { return hasRareData() ? rareDataFocused() : false; }
     bool attached() const { return m_attached; }
     void setAttached(bool b = true) { m_attached = b; }
-    bool changed() const { return m_styleChange != NoStyleChange; }
+    bool needsStyleRecalc() const { return m_styleChange != NoStyleChange; }
     StyleChangeType styleChangeType() const { return static_cast<StyleChangeType>(m_styleChange); }
-    bool hasChangedChild() const { return m_hasChangedChild; }
+    bool childNeedsStyleRecalc() const { return m_childNeedsStyleRecalc; }
     bool isLink() const { return m_isLink; }
     void setHasID(bool b = true) { m_hasId = b; }
     void setHasClass(bool b = true) { m_hasClass = b; }
-    void setHasChangedChild( bool b = true ) { m_hasChangedChild = b; }
+    void setChildNeedsStyleRecalc(bool b = true) { m_childNeedsStyleRecalc = b; }
     void setInDocument(bool b = true) { m_inDocument = b; }
     void setInActiveChain(bool b = true) { m_inActiveChain = b; }
-    void setChanged(StyleChangeType changeType = FullStyleChange);
+    void setNeedsStyleRecalc(StyleChangeType changeType = FullStyleChange);
     void setIsLink(bool b = true) { m_isLink = b; }
 
     bool inSubtreeMark() const { return m_inSubtreeMark; }
@@ -428,7 +428,7 @@
     void createRendererIfNeeded();
     PassRefPtr<RenderStyle> styleForRenderer();
     virtual bool rendererIsNeeded(RenderStyle*);
-#if ENABLE(SVG)
+#if ENABLE(SVG) || ENABLE(XHTMLMP)
     virtual bool childShouldCreateRenderer(Node*) const { return true; }
 #endif
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -526,21 +526,22 @@
 
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
+    // Used for standard DOM addEventListener / removeEventListener APIs.
     virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
     virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+
+    // Used for legacy "onEvent" property APIs.
+    void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+    void clearAttributeEventListener(const AtomicString& eventType);
+    EventListener* getAttributeEventListener(const AtomicString& eventType) const;
+
     virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+    bool dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+
     void removeAllEventListeners() { if (hasRareData()) removeAllEventListenersSlowCase(); }
 
-    void setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener>);
-    void setInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute*);
-    void removeInlineEventListenerForType(const AtomicString& eventType);
-    bool dispatchEventForType(const AtomicString& eventType, bool canBubble, bool cancelable);
-    EventListener* inlineEventListenerForType(const AtomicString& eventType) const;
-
-    bool dispatchSubtreeModifiedEvent();
-    void dispatchWindowEvent(PassRefPtr<Event>);
-    void dispatchWindowEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
-    bool dispatchUIEvent(const AtomicString& eventType, int detail = 0, PassRefPtr<Event> underlyingEvent = 0);
+    void dispatchSubtreeModifiedEvent();
+    void dispatchUIEvent(const AtomicString& eventType, int detail = 0, PassRefPtr<Event> underlyingEvent = 0);
     bool dispatchKeyEvent(const PlatformKeyboardEvent&);
     void dispatchWheelEvent(PlatformWheelEvent&);
     bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType,
@@ -551,10 +552,11 @@
         bool isSimulated = false, Node* relatedTarget = 0, PassRefPtr<Event> underlyingEvent = 0);
     void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent = 0);
     void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
-    bool dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg);
-    void dispatchStorageEvent(const AtomicString &eventType, const String& key, const String& oldValue, const String& newValue, Frame* source);
-    bool dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime);
-    bool dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime);
+    void dispatchProgressEvent(const AtomicString& eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg);
+    void dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime);
+    void dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime);
+    void dispatchMutationEvent(const AtomicString& type, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode&);
+
     bool dispatchGenericEvent(PassRefPtr<Event>);
 
     virtual void handleLocalEvents(Event*, bool useCapture);
@@ -702,7 +704,7 @@
     bool m_hasId : 1;
     bool m_hasClass : 1;
     bool m_attached : 1;
-    bool m_hasChangedChild : 1;
+    bool m_childNeedsStyleRecalc : 1;
     bool m_inDocument : 1;
     bool m_isLink : 1;
     bool m_active : 1;
diff --git a/WebCore/dom/Node.idl b/WebCore/dom/Node.idl
index 0e1848d..dbbb499 100644
--- a/WebCore/dom/Node.idl
+++ b/WebCore/dom/Node.idl
@@ -27,11 +27,11 @@
         GenerateNativeConverter,
         GenerateToJS,
         InlineGetOwnPropertySlot,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=84BA0D7A-7E3E-4a7b-B6FB-7653E8FB54ED,
         ImplementationUUID=81B47FDB-94B0-40fd-8E0C-FB2A6E53CC04
     ] Node
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         : Object, EventTarget
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
      {
@@ -65,15 +65,15 @@
         readonly attribute NamedNodeMap     attributes;
         readonly attribute Document         ownerDocument;
 
-        [OldStyleObjC, JSCCustom] Node insertBefore(in [Return] Node newChild, 
+        [OldStyleObjC, Custom] Node insertBefore(in [Return] Node newChild,
                                                  in Node refChild)
             raises(DOMException);
-        [OldStyleObjC, JSCCustom] Node replaceChild(in Node newChild, 
+        [OldStyleObjC, Custom] Node replaceChild(in Node newChild,
                                                  in [Return] Node oldChild)
             raises(DOMExceptionJSC);
-        [JSCCustom] Node               removeChild(in [Return] Node oldChild)
+        [Custom] Node               removeChild(in [Return] Node oldChild)
             raises(DOMException);
-        [JSCCustom] Node               appendChild(in [Return] Node newChild)
+        [Custom] Node               appendChild(in [Return] Node newChild)
             raises(DOMException);
 
         boolean            hasChildNodes();
@@ -125,61 +125,61 @@
         DOMUserData        getUserData(in DOMString key);
 #endif /* 0 */
 
-        // IE extentions
-        readonly attribute Node             parentElement;
+        // IE extensions
+        readonly attribute Element          parentElement;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extensions
         readonly attribute boolean          isContentEditable;
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
 
-#if !defined(LANGUAGE_OBJECTIVE_C)
-#if !defined(LANGUAGE_COM)
-        attribute [DontEnum, ProtectedListener] EventListener onabort;
-        attribute [DontEnum, ProtectedListener] EventListener onblur;
-        attribute [DontEnum, ProtectedListener] EventListener onchange;
-        attribute [DontEnum, ProtectedListener] EventListener onclick;
-        attribute [DontEnum, ProtectedListener] EventListener oncontextmenu;
-        attribute [DontEnum, ProtectedListener] EventListener ondblclick;
-        attribute [DontEnum, ProtectedListener] EventListener onerror;
-        attribute [DontEnum, ProtectedListener] EventListener onfocus;
-        attribute [DontEnum, ProtectedListener] EventListener oninput;
-        attribute [DontEnum, ProtectedListener] EventListener onkeydown;
-        attribute [DontEnum, ProtectedListener] EventListener onkeypress;
-        attribute [DontEnum, ProtectedListener] EventListener onkeyup;
-        attribute [DontEnum, ProtectedListener] EventListener onload;
-        attribute [DontEnum, ProtectedListener] EventListener onmousedown;
-        attribute [DontEnum, ProtectedListener] EventListener onmousemove;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseout;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseover;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseup;
-        attribute [DontEnum, ProtectedListener] EventListener onmousewheel;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforecut;
-        attribute [DontEnum, ProtectedListener] EventListener oncut;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforecopy;
-        attribute [DontEnum, ProtectedListener] EventListener oncopy;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforepaste;
-        attribute [DontEnum, ProtectedListener] EventListener onpaste;
-        attribute [DontEnum, ProtectedListener] EventListener ondragenter;
-        attribute [DontEnum, ProtectedListener] EventListener ondragover;
-        attribute [DontEnum, ProtectedListener] EventListener ondragleave;
-        attribute [DontEnum, ProtectedListener] EventListener ondrop;
-        attribute [DontEnum, ProtectedListener] EventListener ondragstart;
-        attribute [DontEnum, ProtectedListener] EventListener ondrag;
-        attribute [DontEnum, ProtectedListener] EventListener ondragend;
-        attribute [DontEnum, ProtectedListener] EventListener onreset;
-        attribute [DontEnum, ProtectedListener] EventListener onresize;
-        attribute [DontEnum, ProtectedListener] EventListener onscroll;
-        attribute [DontEnum, ProtectedListener] EventListener onsearch;
-        attribute [DontEnum, ProtectedListener] EventListener onselect;
-        attribute [DontEnum, ProtectedListener] EventListener onselectstart;
-        attribute [DontEnum, ProtectedListener] EventListener onsubmit;
-        attribute [DontEnum, ProtectedListener] EventListener onunload;
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        attribute [DontEnum] EventListener onabort;
+        attribute [DontEnum] EventListener onblur;
+        attribute [DontEnum] EventListener onchange;
+        attribute [DontEnum] EventListener onclick;
+        attribute [DontEnum] EventListener oncontextmenu;
+        attribute [DontEnum] EventListener ondblclick;
+        attribute [DontEnum] EventListener onerror;
+        attribute [DontEnum] EventListener onfocus;
+        attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener onkeydown;
+        attribute [DontEnum] EventListener onkeypress;
+        attribute [DontEnum] EventListener onkeyup;
+        attribute [DontEnum] EventListener onload;
+        attribute [DontEnum] EventListener onmousedown;
+        attribute [DontEnum] EventListener onmousemove;
+        attribute [DontEnum] EventListener onmouseout;
+        attribute [DontEnum] EventListener onmouseover;
+        attribute [DontEnum] EventListener onmouseup;
+        attribute [DontEnum] EventListener onmousewheel;
+        attribute [DontEnum] EventListener onbeforecut;
+        attribute [DontEnum] EventListener oncut;
+        attribute [DontEnum] EventListener onbeforecopy;
+        attribute [DontEnum] EventListener oncopy;
+        attribute [DontEnum] EventListener onbeforepaste;
+        attribute [DontEnum] EventListener onpaste;
+        attribute [DontEnum] EventListener ondragenter;
+        attribute [DontEnum] EventListener ondragover;
+        attribute [DontEnum] EventListener ondragleave;
+        attribute [DontEnum] EventListener ondrop;
+        attribute [DontEnum] EventListener ondragstart;
+        attribute [DontEnum] EventListener ondrag;
+        attribute [DontEnum] EventListener ondragend;
+        attribute [DontEnum] EventListener onreset;
+        attribute [DontEnum] EventListener onresize;
+        attribute [DontEnum] EventListener onscroll;
+        attribute [DontEnum] EventListener onsearch;
+        attribute [DontEnum] EventListener onselect;
+        attribute [DontEnum] EventListener onselectstart;
+        attribute [DontEnum] EventListener onsubmit;
+        attribute [DontEnum] EventListener onunload;
 #if ENABLE_TOUCH_EVENTS
-        attribute [DontEnum, ProtectedListener] EventListener ontouchstart;
-        attribute [DontEnum, ProtectedListener] EventListener ontouchend;
-        attribute [DontEnum, ProtectedListener] EventListener ontouchmove;
-        attribute [DontEnum, ProtectedListener] EventListener ontouchcancel;
+        attribute [DontEnum] EventListener ontouchstart;
+        attribute [DontEnum] EventListener ontouchend;
+        attribute [DontEnum] EventListener ontouchmove;
+        attribute [DontEnum] EventListener ontouchcancel;
 #endif
 
         [Custom] void addEventListener(in DOMString type, 
diff --git a/WebCore/dom/NodeFilter.h b/WebCore/dom/NodeFilter.h
index 4356357..94c87e3 100644
--- a/WebCore/dom/NodeFilter.h
+++ b/WebCore/dom/NodeFilter.h
@@ -25,7 +25,6 @@
 #ifndef NodeFilter_h
 #define NodeFilter_h
 
-#include "JSDOMBinding.h"
 #include "NodeFilterCondition.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
diff --git a/WebCore/dom/NodeIterator.h b/WebCore/dom/NodeIterator.h
index d7eee36..2a992d3 100644
--- a/WebCore/dom/NodeIterator.h
+++ b/WebCore/dom/NodeIterator.h
@@ -25,7 +25,6 @@
 #ifndef NodeIterator_h
 #define NodeIterator_h
 
-#include "JSDOMBinding.h"
 #include "NodeFilter.h"
 #include "Traversal.h"
 #include <wtf/PassRefPtr.h>
diff --git a/WebCore/dom/NodeRareData.h b/WebCore/dom/NodeRareData.h
index bbcfca8..ae0e516 100644
--- a/WebCore/dom/NodeRareData.h
+++ b/WebCore/dom/NodeRareData.h
@@ -28,6 +28,7 @@
 #include "StringHash.h"
 #include "QualifiedName.h"
 #include <wtf/HashSet.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -44,7 +45,11 @@
     
     typedef HashMap<QualifiedName, DynamicNodeList::Caches*> TagCacheMap;
     TagCacheMap m_tagNodeListCaches;
-    
+
+    static PassOwnPtr<NodeListsNodeData> create() {
+        return new NodeListsNodeData;
+    }
+
     ~NodeListsNodeData()
     {
         deleteAllValues(m_classNodeListCaches);
@@ -55,6 +60,9 @@
     void invalidateCaches();
     void invalidateCachesThatDependOnAttributes();
     bool isEmpty() const;
+
+private:
+    NodeListsNodeData() { }
 };
     
 class NodeRareData {
@@ -81,7 +89,7 @@
     }
     
     void clearNodeLists() { m_nodeLists.clear(); }
-    void setNodeLists(std::auto_ptr<NodeListsNodeData> lists) { m_nodeLists.set(lists.release()); }
+    void setNodeLists(PassOwnPtr<NodeListsNodeData> lists) { m_nodeLists = lists; }
     NodeListsNodeData* nodeLists() const { return m_nodeLists.get(); }
     
     short tabIndex() const { return m_tabIndex; }
diff --git a/WebCore/dom/OptionElement.cpp b/WebCore/dom/OptionElement.cpp
index ea8f826..581c070 100644
--- a/WebCore/dom/OptionElement.cpp
+++ b/WebCore/dom/OptionElement.cpp
@@ -27,6 +27,7 @@
 #include "HTMLOptionElement.h"
 #include "OptionGroupElement.h"
 #include "ScriptElement.h"
+#include "SelectElement.h"
 #include <wtf/Assertions.h>
 
 #if ENABLE(WML)
@@ -36,17 +37,39 @@
 
 namespace WebCore {
 
-void OptionElement::setSelectedState(OptionElementData& data, bool selected)
+void OptionElement::setSelectedState(OptionElementData& data, Element* element, bool selected)
 {
     if (data.selected() == selected)
         return;
 
     data.setSelected(selected);
-    data.element()->setChanged();
+    element->setNeedsStyleRecalc();
 }
 
-String OptionElement::collectOptionText(const OptionElementData& data, Document* document)
+int OptionElement::optionIndex(SelectElement* selectElement, const Element* element)
 {
+    if (!selectElement)
+        return 0;
+
+    // Let's do this dynamically. Might be a bit slow, but we're sure
+    // we won't forget to update a member variable in some cases...
+    const Vector<Element*>& items = selectElement->listItems();
+    int length = items.size();
+    int optionIndex = 0;
+    for (int i = 0; i < length; ++i) {
+        if (!isOptionElement(items[i]))
+            continue;
+        if (items[i] == element)
+            return optionIndex;
+        ++optionIndex;
+    }
+
+    return 0;
+}
+
+String OptionElement::collectOptionText(const OptionElementData& data, const Element* element)
+{
+    Document* document = element->document();
     String text;
 
     // WinIE does not use the label attribute, so as a quirk, we ignore it.
@@ -54,16 +77,16 @@
         text = data.label();
 
     if (text.isEmpty()) {
-        Node* n = data.element()->firstChild();
+        Node* n = element->firstChild();
         while (n) {
             if (n->nodeType() == Node::TEXT_NODE || n->nodeType() == Node::CDATA_SECTION_NODE)
                 text += n->nodeValue();
 
             // skip script content
             if (n->isElementNode() && toScriptElement(static_cast<Element*>(n)))
-                n = n->traverseNextSibling(data.element());
+                n = n->traverseNextSibling(element);
             else
-                n = n->traverseNextNode(data.element());
+                n = n->traverseNextNode(element);
         }
     }
 
@@ -77,34 +100,28 @@
     return text;
 }
 
-String OptionElement::collectOptionTextRespectingGroupLabel(const OptionElementData& data, Document* document)
+String OptionElement::collectOptionTextRespectingGroupLabel(const OptionElementData& data, const Element* element)
 {
-    Element* parentElement = static_cast<Element*>(data.element()->parentNode());
+    Element* parentElement = static_cast<Element*>(element->parentNode());
     if (parentElement && toOptionGroupElement(parentElement))
-        return "    " + collectOptionText(data, document);
+        return "    " + collectOptionText(data, element);
 
-    return collectOptionText(data, document);
+    return collectOptionText(data, element);
 }
 
-String OptionElement::collectOptionValue(const OptionElementData& data, Document* document)
+String OptionElement::collectOptionValue(const OptionElementData& data, const Element* element)
 {
     String value = data.value();
     if (!value.isNull())
         return value;
 
     // Use the text if the value wasn't set.
-    return collectOptionText(data, document).stripWhiteSpace();
+    return collectOptionText(data, element).stripWhiteSpace();
 }
 
 // OptionElementData
-OptionElementData::OptionElementData(Element* element)
-    : m_element(element)
-    , m_selected(false)
-{
-    ASSERT(m_element);
-}
-
-OptionElementData::~OptionElementData()
+OptionElementData::OptionElementData()
+    : m_selected(false)
 {
 }
 
@@ -121,4 +138,13 @@
     return 0;
 }
 
+bool isOptionElement(Element* element)
+{
+    return element->hasLocalName(HTMLNames::optionTag)
+#if ENABLE(WML)
+        || element->hasLocalName(WMLNames::optionTag)
+#endif
+        ;
+}
+
 }
diff --git a/WebCore/dom/OptionElement.h b/WebCore/dom/OptionElement.h
index 18fc4ea..c6b9778 100644
--- a/WebCore/dom/OptionElement.h
+++ b/WebCore/dom/OptionElement.h
@@ -28,6 +28,7 @@
 class Element;
 class Document;
 class OptionElementData;
+class SelectElement;
 
 class OptionElement {
 public:
@@ -36,26 +37,23 @@
     virtual bool selected() const = 0;
     virtual void setSelectedState(bool) = 0;
 
+    virtual String text() const = 0;
     virtual String textIndentedToRespectGroupLabel() const = 0;
     virtual String value() const = 0;
 
 protected:
-    OptionElement() { }
-
-    static void setSelectedState(OptionElementData&, bool selected);
-    static String collectOptionText(const OptionElementData&, Document*);
-    static String collectOptionTextRespectingGroupLabel(const OptionElementData&, Document*);
-    static String collectOptionValue(const OptionElementData&, Document*);
+    static void setSelectedState(OptionElementData&, Element*, bool selected);
+    static int optionIndex(SelectElement*, const Element*);
+    static String collectOptionText(const OptionElementData&, const Element*);
+    static String collectOptionTextRespectingGroupLabel(const OptionElementData&, const Element*);
+    static String collectOptionValue(const OptionElementData&, const Element*);
 };
 
 // HTML/WMLOptionElement hold this struct as member variable
 // and pass it to the static helper functions in OptionElement
 class OptionElementData {
 public:
-    OptionElementData(Element*);
-    ~OptionElementData();
-
-    Element* element() const { return m_element; }
+    OptionElementData();
 
     String value() const { return m_value; }
     void setValue(const String& value) { m_value = value; }
@@ -67,13 +65,13 @@
     void setSelected(bool selected) { m_selected = selected; }
 
 private:
-    Element* m_element;
     String m_value;
     String m_label;
     bool m_selected;
 };
 
 OptionElement* toOptionElement(Element*);
+bool isOptionElement(Element*);
 
 }
 
diff --git a/WebCore/dom/OptionGroupElement.cpp b/WebCore/dom/OptionGroupElement.cpp
index 548fb9a..8a001bc 100644
--- a/WebCore/dom/OptionGroupElement.cpp
+++ b/WebCore/dom/OptionGroupElement.cpp
@@ -46,4 +46,13 @@
     return 0;
 }
 
+bool isOptionGroupElement(Element* element)
+{
+    return element->hasLocalName(HTMLNames::optgroupTag)
+#if ENABLE(WML)
+        || element->hasLocalName(WMLNames::optgroupTag)
+#endif
+        ;
+}
+
 }
diff --git a/WebCore/dom/OptionGroupElement.h b/WebCore/dom/OptionGroupElement.h
index eee3930..e4b1566 100644
--- a/WebCore/dom/OptionGroupElement.h
+++ b/WebCore/dom/OptionGroupElement.h
@@ -31,12 +31,10 @@
     virtual ~OptionGroupElement() { }
 
     virtual String groupLabelText() const = 0;
-
-protected:
-    OptionGroupElement() { }
 };
 
 OptionGroupElement* toOptionGroupElement(Element*);
+bool isOptionGroupElement(Element*);
 
 }
 
diff --git a/WebCore/dom/Position.cpp b/WebCore/dom/Position.cpp
index a2591ba..0dd48d4 100644
--- a/WebCore/dom/Position.cpp
+++ b/WebCore/dom/Position.cpp
@@ -73,20 +73,135 @@
     return 0;
 }
 
-Element* Position::documentElement() const
+Position::Position(PassRefPtr<Node> anchorNode, int offset)
+    : m_anchorNode(anchorNode)
+    , m_offset(offset)
+    , m_anchorType(anchorTypeForLegacyEditingPosition(m_anchorNode.get(), m_offset))
+    , m_isLegacyEditingPosition(true)
 {
-    if (Node* n = node())
-        if (Element* e = n->document()->documentElement())
-            return e;
+}
+
+Position::Position(PassRefPtr<Node> anchorNode, AnchorType anchorType)
+    : m_anchorNode(anchorNode)
+    , m_offset(0)
+    , m_anchorType(anchorType)
+    , m_isLegacyEditingPosition(false)
+{
+    ASSERT(anchorType != PositionIsOffsetInAnchor);
+}
+
+Position::Position(PassRefPtr<Node> anchorNode, int offset, AnchorType anchorType)
+    : m_anchorNode(anchorNode)
+    , m_offset(offset)
+    , m_anchorType(anchorType)
+    , m_isLegacyEditingPosition(false)
+{
+    ASSERT(anchorType == PositionIsOffsetInAnchor);
+}
+
+void Position::moveToPosition(PassRefPtr<Node> node, int offset)
+{
+    ASSERT(anchorType() == PositionIsOffsetInAnchor || m_isLegacyEditingPosition);
+    m_anchorNode = node;
+    m_offset = offset;
+    if (m_isLegacyEditingPosition)
+        m_anchorType = anchorTypeForLegacyEditingPosition(m_anchorNode.get(), m_offset);
+}
+void Position::moveToOffset(int offset)
+{
+    ASSERT(anchorType() == PositionIsOffsetInAnchor || m_isLegacyEditingPosition);
+    m_offset = offset;
+    if (m_isLegacyEditingPosition)
+        m_anchorType = anchorTypeForLegacyEditingPosition(m_anchorNode.get(), m_offset);
+}
+
+Node* Position::containerNode() const
+{
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+        return m_anchorNode.get();
+    case PositionIsBeforeAnchor:
+    case PositionIsAfterAnchor:
+        return m_anchorNode->parentNode();
+    }
+    ASSERT_NOT_REACHED();
     return 0;
 }
 
-Element *Position::element() const
+int Position::computeOffsetInContainerNode() const
 {
-    Node *n;
-    for (n = node(); n && !n->isElementNode(); n = n->parentNode())
-        ; // empty loop body
-    return static_cast<Element *>(n);
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+    {
+        int maximumValidOffset = m_anchorNode->offsetInCharacters() ? m_anchorNode->maxCharacterOffset() : m_anchorNode->childNodeCount();
+        return std::min(maximumValidOffset, m_offset);
+    }
+    case PositionIsBeforeAnchor:
+        return m_anchorNode->nodeIndex();
+    case PositionIsAfterAnchor:
+        return m_anchorNode->nodeIndex() + 1;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+Node* Position::computeNodeBeforePosition() const
+{
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+        return m_anchorNode->childNode(m_offset - 1); // -1 converts to childNode((unsigned)-1) and returns null.
+    case PositionIsBeforeAnchor:
+        return m_anchorNode->previousSibling();
+    case PositionIsAfterAnchor:
+        return m_anchorNode.get();
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+Node* Position::computeNodeAfterPosition() const
+{
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+        return m_anchorNode->childNode(m_offset);
+    case PositionIsBeforeAnchor:
+        return m_anchorNode.get();
+    case PositionIsAfterAnchor:
+        return m_anchorNode->nextSibling();
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+Position::AnchorType Position::anchorTypeForLegacyEditingPosition(Node* anchorNode, int offset)
+{
+    if (anchorNode && editingIgnoresContent(anchorNode)) {
+        if (offset == 0)
+            return Position::PositionIsBeforeAnchor;
+        return Position::PositionIsAfterAnchor;
+    }
+    return Position::PositionIsOffsetInAnchor;
+}
+
+// FIXME: This method is confusing (does it return anchorNode() or containerNode()?) and should be renamed or removed
+Element* Position::element() const
+{
+    Node* n = anchorNode();
+    while (n && !n->isElementNode())
+        n = n->parentNode();
+    return static_cast<Element*>(n);
 }
 
 PassRefPtr<CSSComputedStyleDeclaration> Position::computedStyle() const
@@ -680,11 +795,11 @@
         if (node()->hasTagName(brTag))
             return false;
 
-        if (m_offset == pos.m_offset)
+        if (m_offset == pos.deprecatedEditingOffset())
             return false;
             
         if (!node()->isTextNode() && !pos.node()->isTextNode()) {
-            if (m_offset != pos.m_offset)
+            if (m_offset != pos.deprecatedEditingOffset())
                 return true;
         }
     }
@@ -758,7 +873,7 @@
     Position prev = previousCharacterPosition(affinity);
     if (prev != *this && prev.node()->inSameContainingBlockFlowElement(node()) && prev.node()->isTextNode()) {
         String string = static_cast<Text *>(prev.node())->data();
-        UChar c = string[prev.m_offset];
+        UChar c = string[prev.deprecatedEditingOffset()];
         if (considerNonCollapsibleWhitespace ? (isSpaceOrNewline(c) || c == noBreakSpace) : isCollapsibleWhitespace(c))
             if (isEditablePosition(prev))
                 return prev;
diff --git a/WebCore/dom/Position.h b/WebCore/dom/Position.h
index 8efb10f..57f73ec 100644
--- a/WebCore/dom/Position.h
+++ b/WebCore/dom/Position.h
@@ -28,6 +28,7 @@
 
 #include "TextAffinity.h"
 #include "TextDirection.h"
+#include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -46,21 +47,55 @@
     BackwardDeletion // Subject to platform conventions.
 };
 
-// FIXME: Reduce the number of operations we have on a Position.
-// This should be more like a humble struct, without so many different
-// member functions. We should find better homes for these functions.
-
 class Position {
 public:
-    Position() : m_offset(0) { }
+    enum AnchorType {
+        PositionIsOffsetInAnchor,
+        PositionIsAfterAnchor,
+        PositionIsBeforeAnchor
+    };
 
-    // This constructor should be private
-    Position(PassRefPtr<Node> anchorNode, int offset)
-        : m_anchorNode(anchorNode)
-        , m_offset(offset)
-    {}
+    Position()
+        : m_offset(0)
+        , m_anchorType(PositionIsOffsetInAnchor)
+        , m_isLegacyEditingPosition(false)
+    {
+    }
 
-    void clear() { m_anchorNode.clear(); m_offset = 0; }
+    // For creating legacy editing positions: (Anchor type will be determined from editingIgnoresContent(node))
+    Position(PassRefPtr<Node> anchorNode, int offset);
+
+    // For creating before/after positions:
+    Position(PassRefPtr<Node> anchorNode, AnchorType);
+    // For creating offset positions:
+    Position(PassRefPtr<Node> anchorNode, int offset, AnchorType);
+
+    AnchorType anchorType() const { return m_anchorType; }
+
+    void clear() { m_anchorNode.clear(); m_offset = 0; m_anchorType = PositionIsOffsetInAnchor; m_isLegacyEditingPosition = false; }
+
+    // These are always DOM compliant values.  Editing positions like [img, 0] (aka [img, before])
+    // will return img->parentNode() and img->nodeIndex() from these functions.
+    Node* containerNode() const; // NULL for a before/after position anchored to a node with no parent
+    int computeOffsetInContainerNode() const;  // O(n) for before/after-anchored positions, O(1) for parent-anchored positions
+
+    // Inline O(1) access for Positions which callers know to be parent-anchored
+    int offsetInContainerNode() const
+    {
+        ASSERT(anchorType() == PositionIsOffsetInAnchor);
+        return m_offset;
+    }
+
+    // New code should not use this function.
+    int deprecatedEditingOffset() const
+    {
+        // This should probably ASSERT(m_isLegacyEditingPosition);
+        return m_offset;
+    }
+
+    // These are convenience methods which are smart about whether the position is neighbor anchored or parent anchored
+    Node* computeNodeBeforePosition() const;
+    Node* computeNodeAfterPosition() const;
 
     Node* anchorNode() const { return m_anchorNode.get(); }
 
@@ -68,17 +103,11 @@
     // For nodes which editingIgnoresContent(node()) returns true, positions like [ignoredNode, 0]
     // will be treated as before ignoredNode (thus node() is really after the position, not containing it).
     Node* node() const { return m_anchorNode.get(); }
-    Element* documentElement() const;
 
-    void moveToPosition(PassRefPtr<Node> node, int offset)
-    {
-        m_anchorNode = node;
-        m_offset = offset;
-    }
-    void moveToOffset(int offset)
-    {
-        m_offset = offset;
-    }
+    // These should only be used for PositionIsOffsetInAnchor positions, unless
+    // the position is a legacy editing position.
+    void moveToPosition(PassRefPtr<Node> anchorNode, int offset);
+    void moveToOffset(int offset);
 
     bool isNull() const { return !m_anchorNode; }
     bool isNotNull() const { return m_anchorNode; }
@@ -136,19 +165,22 @@
     Position previousCharacterPosition(EAffinity) const;
     Position nextCharacterPosition(EAffinity) const;
 
+    static AnchorType anchorTypeForLegacyEditingPosition(Node* anchorNode, int offset);
+
     RefPtr<Node> m_anchorNode;
-public:
     // m_offset can be the offset inside m_anchorNode, or if editingIgnoresContent(m_anchorNode)
     // returns true, then other places in editing will treat m_offset == 0 as "before the anchor"
     // and m_offset > 0 as "after the anchor node".  See rangeCompliantEquivalent for more info.
-    int m_offset; // FIXME: This should be made private.
+    int m_offset;
+    AnchorType m_anchorType : 2;
+    bool m_isLegacyEditingPosition : 1;
 };
 
 inline bool operator==(const Position& a, const Position& b)
 {
     // FIXME: In <div><img></div> [div, 0] != [img, 0] even though most of the
     // editing code will treat them as identical.
-    return a.anchorNode() == b.anchorNode() && a.m_offset == b.m_offset;
+    return a.anchorNode() == b.anchorNode() && a.deprecatedEditingOffset() == b.deprecatedEditingOffset();
 }
 
 inline bool operator!=(const Position& a, const Position& b)
diff --git a/WebCore/dom/PositionIterator.cpp b/WebCore/dom/PositionIterator.cpp
index 781d352..a029b5e 100644
--- a/WebCore/dom/PositionIterator.cpp
+++ b/WebCore/dom/PositionIterator.cpp
@@ -36,111 +36,111 @@
 
 PositionIterator::operator Position() const
 {
-    if (m_child) {
-        ASSERT(m_child->parentNode() == m_parent);
-        return positionBeforeNode(m_child);
+    if (m_nodeAfterPositionInAnchor) {
+        ASSERT(m_nodeAfterPositionInAnchor->parentNode() == m_anchorNode);
+        return positionBeforeNode(m_nodeAfterPositionInAnchor);
     }
-    if (m_parent->hasChildNodes())
-        return lastDeepEditingPositionForNode(m_parent);
-    return Position(m_parent, m_offset);
+    if (m_anchorNode->hasChildNodes())
+        return lastDeepEditingPositionForNode(m_anchorNode);
+    return Position(m_anchorNode, m_offsetInAnchor);
 }
 
 void PositionIterator::increment()
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return;
 
-    if (m_child) {
-        m_parent = m_child;
-        m_child = m_parent->firstChild();
-        m_offset = 0;
+    if (m_nodeAfterPositionInAnchor) {
+        m_anchorNode = m_nodeAfterPositionInAnchor;
+        m_nodeAfterPositionInAnchor = m_anchorNode->firstChild();
+        m_offsetInAnchor = 0;
         return;
     }
 
-    if (!m_parent->hasChildNodes() && m_offset < lastOffsetForEditing(m_parent))
-        m_offset = Position::uncheckedNextOffset(m_parent, m_offset);
+    if (!m_anchorNode->hasChildNodes() && m_offsetInAnchor < lastOffsetForEditing(m_anchorNode))
+        m_offsetInAnchor = Position::uncheckedNextOffset(m_anchorNode, m_offsetInAnchor);
     else {
-        m_child = m_parent;
-        m_parent = m_child->parentNode();
-        m_child = m_child->nextSibling();
-        m_offset = 0;
+        m_nodeAfterPositionInAnchor = m_anchorNode;
+        m_anchorNode = m_nodeAfterPositionInAnchor->parentNode();
+        m_nodeAfterPositionInAnchor = m_nodeAfterPositionInAnchor->nextSibling();
+        m_offsetInAnchor = 0;
     }
 }
 
 void PositionIterator::decrement()
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return;
 
-    if (m_child) {
-        m_parent = m_child->previousSibling();
-        if (m_parent) {
-            m_child = 0;
-            m_offset = m_parent->hasChildNodes() ? 0 : lastOffsetForEditing(m_parent);
+    if (m_nodeAfterPositionInAnchor) {
+        m_anchorNode = m_nodeAfterPositionInAnchor->previousSibling();
+        if (m_anchorNode) {
+            m_nodeAfterPositionInAnchor = 0;
+            m_offsetInAnchor = m_anchorNode->hasChildNodes() ? 0 : lastOffsetForEditing(m_anchorNode);
         } else {
-            m_child = m_child->parentNode();
-            m_parent = m_child->parentNode();
-            m_offset = 0;
+            m_nodeAfterPositionInAnchor = m_nodeAfterPositionInAnchor->parentNode();
+            m_anchorNode = m_nodeAfterPositionInAnchor->parentNode();
+            m_offsetInAnchor = 0;
         }
         return;
     }
 
-    if (m_offset) {
-        m_offset = Position::uncheckedPreviousOffset(m_parent, m_offset);
+    if (m_offsetInAnchor) {
+        m_offsetInAnchor = Position::uncheckedPreviousOffset(m_anchorNode, m_offsetInAnchor);
     } else {
-        if (m_parent->hasChildNodes()) {
-            m_parent = m_parent->lastChild();
-            if (!m_parent->hasChildNodes())
-                m_offset = lastOffsetForEditing(m_parent);
+        if (m_anchorNode->hasChildNodes()) {
+            m_anchorNode = m_anchorNode->lastChild();
+            if (!m_anchorNode->hasChildNodes())
+                m_offsetInAnchor = lastOffsetForEditing(m_anchorNode);
         } else {
-            m_child = m_parent;
-            m_parent = m_parent->parentNode();
+            m_nodeAfterPositionInAnchor = m_anchorNode;
+            m_anchorNode = m_anchorNode->parentNode();
         }
     }
 }
 
 bool PositionIterator::atStart() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (m_parent->parentNode())
+    if (m_anchorNode->parentNode())
         return false;
-    return (!m_parent->hasChildNodes() && !m_offset) || (m_child && !m_child->previousSibling());
+    return (!m_anchorNode->hasChildNodes() && !m_offsetInAnchor) || (m_nodeAfterPositionInAnchor && !m_nodeAfterPositionInAnchor->previousSibling());
 }
 
 bool PositionIterator::atEnd() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (m_child)
+    if (m_nodeAfterPositionInAnchor)
         return false;
-    return !m_parent->parentNode() && (m_parent->hasChildNodes() || m_offset >= lastOffsetForEditing(m_parent));
+    return !m_anchorNode->parentNode() && (m_anchorNode->hasChildNodes() || m_offsetInAnchor >= lastOffsetForEditing(m_anchorNode));
 }
 
 bool PositionIterator::atStartOfNode() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (!m_child)
-        return !m_parent->hasChildNodes() && !m_offset;
-    return !m_child->previousSibling();
+    if (!m_nodeAfterPositionInAnchor)
+        return !m_anchorNode->hasChildNodes() && !m_offsetInAnchor;
+    return !m_nodeAfterPositionInAnchor->previousSibling();
 }
 
 bool PositionIterator::atEndOfNode() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (m_child)
+    if (m_nodeAfterPositionInAnchor)
         return false;
-    return m_parent->hasChildNodes() || m_offset >= lastOffsetForEditing(m_parent);
+    return m_anchorNode->hasChildNodes() || m_offsetInAnchor >= lastOffsetForEditing(m_anchorNode);
 }
 
 bool PositionIterator::isCandidate() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return false;
 
-    RenderObject* renderer = m_parent->renderer();
+    RenderObject* renderer = m_anchorNode->renderer();
     if (!renderer)
         return false;
     
@@ -148,17 +148,17 @@
         return false;
 
     if (renderer->isBR())
-        return !m_offset && !Position::nodeIsUserSelectNone(m_parent->parent());
+        return !m_offsetInAnchor && !Position::nodeIsUserSelectNone(m_anchorNode->parent());
 
     if (renderer->isText())
-        return Position(*this).inRenderedText() && !Position::nodeIsUserSelectNone(m_parent);
+        return Position(*this).inRenderedText() && !Position::nodeIsUserSelectNone(m_anchorNode);
 
-    if (isTableElement(m_parent) || editingIgnoresContent(m_parent))
-        return (atStartOfNode() || atEndOfNode()) && !Position::nodeIsUserSelectNone(m_parent->parent());
+    if (isTableElement(m_anchorNode) || editingIgnoresContent(m_anchorNode))
+        return (atStartOfNode() || atEndOfNode()) && !Position::nodeIsUserSelectNone(m_anchorNode->parent());
 
-    if (!m_parent->hasTagName(htmlTag) && renderer->isBlockFlow() && !Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (toRenderBlock(renderer)->height() || m_parent->hasTagName(bodyTag)))
-        return atStartOfNode() && !Position::nodeIsUserSelectNone(m_parent);
+    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow() && !Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
+       (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)))
+        return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
     
     return false;
 }
diff --git a/WebCore/dom/PositionIterator.h b/WebCore/dom/PositionIterator.h
index 98a2ccb..7af8977 100644
--- a/WebCore/dom/PositionIterator.h
+++ b/WebCore/dom/PositionIterator.h
@@ -37,16 +37,16 @@
 class PositionIterator {
 public:
     PositionIterator()
-        : m_parent(0)
-        , m_child(0)
-        , m_offset(0)
+        : m_anchorNode(0)
+        , m_nodeAfterPositionInAnchor(0)
+        , m_offsetInAnchor(0)
     {
     }
 
     PositionIterator(const Position& pos)
-        : m_parent(pos.node())
-        , m_child(m_parent->childNode(pos.m_offset))
-        , m_offset(m_child ? 0 : pos.m_offset)
+        : m_anchorNode(pos.anchorNode())
+        , m_nodeAfterPositionInAnchor(m_anchorNode->childNode(pos.deprecatedEditingOffset()))
+        , m_offsetInAnchor(m_nodeAfterPositionInAnchor ? 0 : pos.deprecatedEditingOffset())
     {
     }
     operator Position() const;
@@ -54,8 +54,8 @@
     void increment();
     void decrement();
 
-    Node* node() const { return m_parent; }
-    int offsetInLeafNode() const { return m_offset; }
+    Node* node() const { return m_anchorNode; }
+    int offsetInLeafNode() const { return m_offsetInAnchor; }
 
     bool atStart() const;
     bool atEnd() const;
@@ -64,9 +64,9 @@
     bool isCandidate() const;
 
 private:
-    Node* m_parent;
-    Node* m_child;
-    int m_offset;
+    Node* m_anchorNode;
+    Node* m_nodeAfterPositionInAnchor; // If this is non-null, m_nodeAfterPositionInAnchor->parentNode() == m_anchorNode;
+    int m_offsetInAnchor;
 };
 
 } // namespace WebCore
diff --git a/WebCore/dom/ProcessingInstruction.idl b/WebCore/dom/ProcessingInstruction.idl
index d0923f1..578b22e 100644
--- a/WebCore/dom/ProcessingInstruction.idl
+++ b/WebCore/dom/ProcessingInstruction.idl
@@ -32,7 +32,7 @@
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString data
                      setter raises(DOMException);
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // interface LinkStyle from DOM Level 2 Style Sheets
         readonly attribute StyleSheet sheet;
 #endif
diff --git a/WebCore/dom/QualifiedName.cpp b/WebCore/dom/QualifiedName.cpp
index 5953b97..607c846 100644
--- a/WebCore/dom/QualifiedName.cpp
+++ b/WebCore/dom/QualifiedName.cpp
@@ -55,7 +55,7 @@
 {
     if (!gNameCache)
         gNameCache = new QNameSet;
-    QualifiedNameComponents components = { p.impl(), l.impl(), n.impl() };
+    QualifiedNameComponents components = { p.impl(), l.impl(), n.isEmpty() ? nullAtom.impl() : n.impl() };
     pair<QNameSet::iterator, bool> addResult = gNameCache->add<QualifiedNameComponents, QNameComponentsTranslator>(components);
     m_impl = *addResult.first;    
     if (!addResult.second)
diff --git a/WebCore/dom/QualifiedName.h b/WebCore/dom/QualifiedName.h
index 13747a9..939927b 100644
--- a/WebCore/dom/QualifiedName.h
+++ b/WebCore/dom/QualifiedName.h
@@ -49,8 +49,9 @@
         QualifiedNameImpl(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI)
             : m_prefix(prefix)
             , m_localName(localName)
-            , m_namespace(namespaceURI.isEmpty() ? nullAtom : namespaceURI)
+            , m_namespace(namespaceURI)
         {
+            ASSERT(!namespaceURI.isEmpty() || namespaceURI.isNull());
         }        
     };
 
diff --git a/WebCore/dom/Range.cpp b/WebCore/dom/Range.cpp
index 34b1d21..8a3ca8f 100644
--- a/WebCore/dom/Range.cpp
+++ b/WebCore/dom/Range.cpp
@@ -27,6 +27,7 @@
 
 #include "CString.h"
 #include "DocumentFragment.h"
+#include "HTMLElement.h"
 #include "NodeWithIndex.h"
 #include "ProcessingInstruction.h"
 #include "Text.h"
@@ -89,7 +90,7 @@
 
 PassRefPtr<Range> Range::create(PassRefPtr<Document> ownerDocument, const Position& start, const Position& end)
 {
-    return adoptRef(new Range(ownerDocument, start.node(), start.m_offset, end.node(), end.m_offset));
+    return adoptRef(new Range(ownerDocument, start.node(), start.deprecatedEditingOffset(), end.node(), end.deprecatedEditingOffset()));
 }
 
 Range::~Range()
@@ -207,7 +208,7 @@
     if (startRootContainer != endRootContainer)
         collapse(true, ec);
     // check if new start after end
-    else if (compareBoundaryPoints(m_start.container(), m_start.offset(), m_end.container(), m_end.offset()) > 0)
+    else if (compareBoundaryPoints(m_start, m_end) > 0)
         collapse(true, ec);
 }
 
@@ -245,7 +246,7 @@
     if (startRootContainer != endRootContainer)
         collapse(false, ec);
     // check if new end before start
-    if (compareBoundaryPoints(m_start.container(), m_start.offset(), m_end.container(), m_end.offset()) > 0)
+    if (compareBoundaryPoints(m_start, m_end) > 0)
         collapse(false, ec);
 }
 
@@ -417,17 +418,13 @@
 
     switch (how) {
         case START_TO_START:
-            return compareBoundaryPoints(m_start.container(), m_start.offset(),
-                sourceRange->m_start.container(), sourceRange->m_start.offset());
+            return compareBoundaryPoints(m_start, sourceRange->m_start);
         case START_TO_END:
-            return compareBoundaryPoints(m_end.container(), m_end.offset(),
-                sourceRange->m_start.container(), sourceRange->m_start.offset());
+            return compareBoundaryPoints(m_end, sourceRange->m_start);
         case END_TO_END:
-            return compareBoundaryPoints(m_end.container(), m_end.offset(),
-                sourceRange->m_end.container(), sourceRange->m_end.offset());
+            return compareBoundaryPoints(m_end, sourceRange->m_end);
         case END_TO_START:
-            return compareBoundaryPoints(m_start.container(), m_start.offset(),
-                sourceRange->m_end.container(), sourceRange->m_end.offset());
+            return compareBoundaryPoints(m_start, sourceRange->m_end);
     }
 
     ec = SYNTAX_ERR;
@@ -525,14 +522,14 @@
     return 0;
 }
 
-short Range::compareBoundaryPoints(const Position& a, const Position& b)
+short Range::compareBoundaryPoints(const RangeBoundaryPoint& boundaryA, const RangeBoundaryPoint& boundaryB)
 {
-    return compareBoundaryPoints(a.node(), a.m_offset, b.node(), b.m_offset);
+    return compareBoundaryPoints(boundaryA.container(), boundaryA.offset(), boundaryB.container(), boundaryB.offset());
 }
 
 bool Range::boundaryPointsValid() const
 {
-    return m_start.container() && compareBoundaryPoints(m_start.container(), m_start.offset(), m_end.container(), m_end.offset()) <= 0;
+    return m_start.container() && compareBoundaryPoints(m_start, m_end) <= 0;
 }
 
 void Range::deleteContents(ExceptionCode& ec)
@@ -990,7 +987,7 @@
         // This special case doesn't seem to match the DOM specification, but it's currently required
         // to pass Acid3. We might later decide to remove this.
         if (collapsed)
-            m_end.setToChild(newText.get());
+            m_end.setToBeforeChild(newText.get());
     } else {
         RefPtr<Node> lastChild;
         if (collapsed)
@@ -1354,8 +1351,8 @@
         }
     }
 
-    m_start.setToStart(refNode);
-    m_end.setToEnd(refNode);
+    m_start.setToStartOfNode(refNode);
+    m_end.setToEndOfNode(refNode);
 }
 
 void Range::surroundContents(PassRefPtr<Node> passNewParent, ExceptionCode& ec)
@@ -1584,34 +1581,30 @@
 {
     IntRect result;
     Vector<IntRect> rects;
-    addLineBoxRects(rects);
+    textRects(rects);
     const size_t n = rects.size();
     for (size_t i = 0; i < n; ++i)
         result.unite(rects[i]);
     return result;
 }
 
-void Range::addLineBoxRects(Vector<IntRect>& rects, bool useSelectionHeight)
+void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
 {
     if (!m_start.container() || !m_end.container())
         return;
 
-    RenderObject* start = m_start.container()->renderer();
-    RenderObject* end = m_end.container()->renderer();
-    if (!start || !end)
-        return;
+    Node* startContainer = m_start.container();
+    Node* endContainer = m_end.container();
 
-    RenderObject* stop = end->childAt(m_end.offset());
-    if (!stop)
-        stop = end->nextInPreOrderAfterChildren();
-    
-    for (RenderObject* r = start; r && r != stop; r = r->nextInPreOrder()) {
-        // only ask leaf render objects for their line box rects
-        if (!r->firstChild()) {
-            int startOffset = r == start ? m_start.offset() : 0;
-            int endOffset = r == end ? m_end.offset() : INT_MAX;
-            r->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
-        }
+    Node* stopNode = pastLastNode();
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        RenderObject* r = node->renderer();
+        if (!r || !r->isText())
+            continue;
+        RenderText* renderText = toRenderText(r);
+        int startOffset = node == startContainer ? m_start.offset() : 0;
+        int endOffset = node == endContainer ? m_end.offset() : INT_MAX;
+        renderText->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
     }
 }
 
@@ -1707,7 +1700,7 @@
 
     for (Node* n = boundary.container(); n; n = n->parentNode()) {
         if (n == nodeToBeRemoved) {
-            boundary.setToChild(nodeToBeRemoved);
+            boundary.setToBeforeChild(nodeToBeRemoved);
             return;
         }
     }
diff --git a/WebCore/dom/Range.h b/WebCore/dom/Range.h
index 49dea82..115f442 100644
--- a/WebCore/dom/Range.h
+++ b/WebCore/dom/Range.h
@@ -66,7 +66,7 @@
     enum CompareHow { START_TO_START, START_TO_END, END_TO_END, END_TO_START };
     short compareBoundaryPoints(CompareHow, const Range* sourceRange, ExceptionCode&) const;
     static short compareBoundaryPoints(Node* containerA, int offsetA, Node* containerB, int offsetB);
-    static short compareBoundaryPoints(const Position&, const Position&);
+    static short compareBoundaryPoints(const RangeBoundaryPoint& boundaryA, const RangeBoundaryPoint& boundaryB);
     bool boundaryPointsValid() const;
     bool intersectsNode(Node* refNode, ExceptionCode&);
     void deleteContents(ExceptionCode&);
@@ -91,8 +91,8 @@
     void surroundContents(PassRefPtr<Node>, ExceptionCode&);
     void setStartBefore(Node*, ExceptionCode&);
 
-    const Position& startPosition() const { return m_start.position(); }
-    const Position& endPosition() const { return m_end.position(); }
+    const Position startPosition() const { return m_start.toPosition(); }
+    const Position endPosition() const { return m_end.toPosition(); }
 
     Node* firstNode() const;
     Node* pastLastNode() const;
@@ -102,7 +102,7 @@
     Node* shadowTreeRootNode() const;
 
     IntRect boundingBox();
-    void addLineBoxRects(Vector<IntRect>&, bool useSelectionHeight = false);
+    void textRects(Vector<IntRect>&, bool useSelectionHeight = false);
 
     void nodeChildrenChanged(ContainerNode*);
     void nodeWillBeRemoved(Node*);
diff --git a/WebCore/dom/Range.idl b/WebCore/dom/Range.idl
index 4344474..0750c32 100644
--- a/WebCore/dom/Range.idl
+++ b/WebCore/dom/Range.idl
@@ -112,7 +112,7 @@
                                in long offset)
             raises(RangeException, DOMException);
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute DOMString text;
 #endif
     };
diff --git a/WebCore/dom/RangeBoundaryPoint.h b/WebCore/dom/RangeBoundaryPoint.h
index 65abfcf..2fda51f 100644
--- a/WebCore/dom/RangeBoundaryPoint.h
+++ b/WebCore/dom/RangeBoundaryPoint.h
@@ -36,7 +36,8 @@
     RangeBoundaryPoint();
     explicit RangeBoundaryPoint(PassRefPtr<Node> container);
 
-    const Position& position() const;
+    const Position toPosition() const;
+
     Node* container() const;
     int offset() const;
     Node* childBefore() const;
@@ -45,133 +46,135 @@
 
     void set(PassRefPtr<Node> container, int offset, Node* childBefore);
     void setOffset(int offset);
-    void setToChild(Node* child);
-    void setToStart(PassRefPtr<Node> container);
-    void setToEnd(PassRefPtr<Node> container);
+
+    void setToBeforeChild(Node*);
+    void setToStartOfNode(PassRefPtr<Node>);
+    void setToEndOfNode(PassRefPtr<Node>);
 
     void childBeforeWillBeRemoved();
     void invalidateOffset() const;
+    void ensureOffsetIsValid() const;
 
 private:
     static const int invalidOffset = -1;
-
-    // FIXME: RangeBoundaryPoint is the only file to ever use -1 as am expected offset for Position
-    // RangeBoundaryPoint currently needs to store a Position object to make the
-    // position() function be able to return a const& (and thus avoid ref-churn).
     
-    mutable Position m_position;
-    Node* m_childBefore;
+    RefPtr<Node> m_containerNode;
+    mutable int m_offsetInContainer;
+    Node* m_childBeforeBoundary;
 };
 
 inline RangeBoundaryPoint::RangeBoundaryPoint()
-    : m_childBefore(0)
+    : m_offsetInContainer(0)
+    , m_childBeforeBoundary(0)
 {
 }
 
 inline RangeBoundaryPoint::RangeBoundaryPoint(PassRefPtr<Node> container)
-    : m_position(container, 0)
-    , m_childBefore(0)
+    : m_containerNode(container)
+    , m_offsetInContainer(0)
+    , m_childBeforeBoundary(0)
 {
 }
 
 inline Node* RangeBoundaryPoint::container() const
 {
-    return m_position.node();
+    return m_containerNode.get();
 }
 
 inline Node* RangeBoundaryPoint::childBefore() const
 {
-    return m_childBefore;
+    return m_childBeforeBoundary;
 }
 
-inline const Position& RangeBoundaryPoint::position() const
+inline void RangeBoundaryPoint::ensureOffsetIsValid() const
 {
-    if (m_position.m_offset >= 0)
-        return m_position;
-    ASSERT(m_childBefore);
-    m_position.m_offset = m_childBefore->nodeIndex() + 1;
-    return m_position;
+    if (m_offsetInContainer >= 0)
+        return;
+
+    ASSERT(m_childBeforeBoundary);
+    m_offsetInContainer = m_childBeforeBoundary->nodeIndex() + 1;
+}
+
+inline const Position RangeBoundaryPoint::toPosition() const
+{
+    ensureOffsetIsValid();
+    return Position(m_containerNode.get(), m_offsetInContainer);
 }
 
 inline int RangeBoundaryPoint::offset() const
 {
-    return position().m_offset;
+    ensureOffsetIsValid();
+    return m_offsetInContainer;
 }
 
 inline void RangeBoundaryPoint::clear()
 {
-    m_position.clear();
-    m_childBefore = 0;
+    m_containerNode.clear();
+    m_offsetInContainer = 0;
+    m_childBeforeBoundary = 0;
 }
 
 inline void RangeBoundaryPoint::set(PassRefPtr<Node> container, int offset, Node* childBefore)
 {
     ASSERT(offset >= 0);
     ASSERT(childBefore == (offset ? container->childNode(offset - 1) : 0));
-    m_position.moveToPosition(container, offset);
-    m_childBefore = childBefore;
+    m_containerNode = container;
+    m_offsetInContainer = offset;
+    m_childBeforeBoundary = childBefore;
 }
 
 inline void RangeBoundaryPoint::setOffset(int offset)
 {
-    ASSERT(m_position.node());
-    ASSERT(m_position.node()->offsetInCharacters());
-    ASSERT(m_position.m_offset >= 0);
-    ASSERT(!m_childBefore);
-    m_position.moveToOffset(offset);
+    ASSERT(m_containerNode);
+    ASSERT(m_containerNode->offsetInCharacters());
+    ASSERT(m_offsetInContainer >= 0);
+    ASSERT(!m_childBeforeBoundary);
+    m_offsetInContainer = offset;
 }
 
-inline void RangeBoundaryPoint::setToChild(Node* child)
+inline void RangeBoundaryPoint::setToBeforeChild(Node* child)
 {
     ASSERT(child);
     ASSERT(child->parentNode());
-    m_childBefore = child->previousSibling();
-    m_position.moveToPosition(child->parentNode(), m_childBefore ? invalidOffset : 0);
+    m_childBeforeBoundary = child->previousSibling();
+    m_containerNode = child->parentNode();
+    m_offsetInContainer = m_childBeforeBoundary ? invalidOffset : 0;
 }
 
-inline void RangeBoundaryPoint::setToStart(PassRefPtr<Node> container)
+inline void RangeBoundaryPoint::setToStartOfNode(PassRefPtr<Node> container)
 {
     ASSERT(container);
-    m_position.moveToPosition(container, 0);
-    m_childBefore = 0;
+    m_containerNode = container;
+    m_offsetInContainer = 0;
+    m_childBeforeBoundary = 0;
 }
 
-inline void RangeBoundaryPoint::setToEnd(PassRefPtr<Node> container)
+inline void RangeBoundaryPoint::setToEndOfNode(PassRefPtr<Node> container)
 {
     ASSERT(container);
-    if (container->offsetInCharacters()) {
-#ifdef ANDROID_FIX
-        // Temporary fix of a crash where container becomes empty after
-        // assigning it to the first parameter of Position::moveToPosition,
-        // evaluating the second parameter expression,
-        // container->maxCharacterOffset(), causes NULL-pointer exception.
-        // This change can be removed after merge to a webkit revision
-        // after r42264.
-        int offset = container->maxCharacterOffset();
-        m_position.moveToPosition(container, offset);
-#else
-        m_position.moveToPosition(container, container->maxCharacterOffset());
-#endif
-        m_childBefore = 0;
+    m_containerNode = container;
+    if (m_containerNode->offsetInCharacters()) {
+        m_offsetInContainer = m_containerNode->maxCharacterOffset();
+        m_childBeforeBoundary = 0;
     } else {
-        m_childBefore = container->lastChild();
-        m_position.moveToPosition(container, m_childBefore ? invalidOffset : 0);
+        m_childBeforeBoundary = m_containerNode->lastChild();
+        m_offsetInContainer = m_childBeforeBoundary ? invalidOffset : 0;
     }
 }
 
 inline void RangeBoundaryPoint::childBeforeWillBeRemoved()
 {
-    ASSERT(m_position.m_offset);
-    m_childBefore = m_childBefore->previousSibling();
-    if (!m_childBefore)
-        m_position.m_offset = 0;
-    else if (m_position.m_offset > 0)
-        --m_position.m_offset;
+    ASSERT(m_offsetInContainer);
+    m_childBeforeBoundary = m_childBeforeBoundary->previousSibling();
+    if (!m_childBeforeBoundary)
+        m_offsetInContainer = 0;
+    else if (m_offsetInContainer > 0)
+        --m_offsetInContainer;
 }
 
 inline void RangeBoundaryPoint::invalidateOffset() const
 {
-    m_position.m_offset = invalidOffset;
+    m_offsetInContainer = invalidOffset;
 }
 
 inline bool operator==(const RangeBoundaryPoint& a, const RangeBoundaryPoint& b)
diff --git a/WebCore/dom/RangeException.idl b/WebCore/dom/RangeException.idl
index 36cde16..d2cf385 100644
--- a/WebCore/dom/RangeException.idl
+++ b/WebCore/dom/RangeException.idl
@@ -27,7 +27,7 @@
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
 
diff --git a/WebCore/dom/RegisteredEventListener.h b/WebCore/dom/RegisteredEventListener.h
index 29b061d..479c2ff 100644
--- a/WebCore/dom/RegisteredEventListener.h
+++ b/WebCore/dom/RegisteredEventListener.h
@@ -25,11 +25,10 @@
 #define RegisteredEventListener_h
 
 #include "AtomicString.h"
+#include "EventListener.h"
 
 namespace WebCore {
 
-    class EventListener;
-
     class RegisteredEventListener : public RefCounted<RegisteredEventListener> {
     public:
         static PassRefPtr<RegisteredEventListener> create(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
@@ -53,6 +52,25 @@
         bool m_removed;
     };
 
+    typedef Vector<RefPtr<RegisteredEventListener> > RegisteredEventListenerVector;
+
+#if USE(JSC)
+    inline void markEventListeners(const RegisteredEventListenerVector& listeners)
+    {
+        for (size_t i = 0; i < listeners.size(); ++i)
+            listeners[i]->listener()->markJSFunction();
+    }
+
+    inline void invalidateEventListeners(const RegisteredEventListenerVector& listeners)
+    {
+        // For efficiency's sake, we just set the "removed" bit, instead of
+        // actually removing the event listener. The node that owns these
+        // listeners is about to be deleted, anyway.
+        for (size_t i = 0; i < listeners.size(); ++i)
+            listeners[i]->setRemoved(true);
+    }
+#endif
+
 } // namespace WebCore
 
 #endif // RegisteredEventListener_h
diff --git a/WebCore/dom/ScriptElement.cpp b/WebCore/dom/ScriptElement.cpp
index 1cd8696..55b15e5 100644
--- a/WebCore/dom/ScriptElement.cpp
+++ b/WebCore/dom/ScriptElement.cpp
@@ -128,6 +128,7 @@
     , m_element(element)
     , m_cachedScript(0)
     , m_createdByParser(false)
+    , m_requested(false)
     , m_evaluated(false)
     , m_firedLoad(false)
 {
@@ -152,6 +153,7 @@
 
     ASSERT(!m_cachedScript);
     m_cachedScript = document->docLoader()->requestScript(sourceUrl, scriptCharset());
+    m_requested = true;
 
     // m_createdByParser is never reset - always resied at the initial value set while parsing.
     // m_evaluated is left untouched as well to avoid script reexecution, if a <script> element
@@ -178,7 +180,7 @@
         m_evaluated = true;
 
         frame->script()->evaluate(sourceCode);
-        Document::updateDocumentsRendering();
+        Document::updateStyleForAllDocuments();
     }
 }
 
@@ -190,28 +192,27 @@
     }
 }
 
-void ScriptElementData::notifyFinished(CachedResource* o)
+void ScriptElementData::execute(CachedScript* cachedScript)
 {
-    CachedScript* cs = static_cast<CachedScript*>(o);
-    ASSERT(cs == m_cachedScript);
-
-    // Evaluating the script could lead to a garbage collection which can
-    // delete the script element so we need to protect it and us with it!
-    RefPtr<Element> protector(m_element);
-
-    if (cs->errorOccurred())
+    ASSERT(cachedScript);
+    if (cachedScript->errorOccurred())
         m_scriptElement->dispatchErrorEvent();
     else {
-        evaluateScript(ScriptSourceCode(cs));
+        evaluateScript(ScriptSourceCode(cachedScript));
         m_scriptElement->dispatchLoadEvent();
     }
+}
 
+void ScriptElementData::notifyFinished(CachedResource* o)
+{
+    ASSERT_UNUSED(o, o == m_cachedScript);
+    m_element->document()->executeScriptSoon(this, m_cachedScript);
     stopLoadRequest();
 }
 
 bool ScriptElementData::ignoresLoadRequest() const
 {
-    return m_evaluated || m_cachedScript || m_createdByParser || !m_element->inDocument();
+    return m_evaluated || m_requested || m_createdByParser || !m_element->inDocument();
 }
 
 bool ScriptElementData::shouldExecuteAsJavaScript() const
@@ -231,8 +232,15 @@
     if (!language.isEmpty())
         return isSupportedJavaScriptLanguage(language);
 
-    // No type or language is specified, so we assume the script to be JavaScript
-    return true;
+    // No type or language is specified, so we assume the script to be JavaScript.
+    // We don't yet support setting event listeners via the 'for' attribute for scripts.
+    // If there is such an attribute it's likely better to not execute the script than to do so
+    // immediately and unconditionally.
+    // FIXME: After <rdar://problem/4471751> / https://bugs.webkit.org/show_bug.cgi?id=16915 are resolved 
+    // and we support the for syntax in script tags, this check can be removed and we should just
+    // return 'true' here.
+    String forAttribute = m_scriptElement->forAttributeValue();
+    return forAttribute.isEmpty();
 }
 
 String ScriptElementData::scriptCharset() const
diff --git a/WebCore/dom/ScriptElement.h b/WebCore/dom/ScriptElement.h
index d57fbde..0aed5e8 100644
--- a/WebCore/dom/ScriptElement.h
+++ b/WebCore/dom/ScriptElement.h
@@ -42,6 +42,7 @@
     virtual String charsetAttributeValue() const = 0;
     virtual String typeAttributeValue() const = 0;
     virtual String languageAttributeValue() const = 0;
+    virtual String forAttributeValue() const = 0;
 
     virtual void dispatchLoadEvent() = 0;
     virtual void dispatchErrorEvent() = 0;
@@ -49,6 +50,8 @@
     // A charset for loading the script (may be overridden by HTTP headers or a BOM).
     virtual String scriptCharset() const = 0;
 
+    virtual bool shouldExecuteAsJavaScript() const = 0;
+
 protected:
     // Helper functions used by our parent classes.
     static void insertedIntoDocument(ScriptElementData&, const String& sourceUrl);
@@ -81,6 +84,8 @@
     void evaluateScript(const ScriptSourceCode&);
     void stopLoadRequest();
 
+    void execute(CachedScript*);
+
 private:
     virtual void notifyFinished(CachedResource*);
 
@@ -89,6 +94,7 @@
     Element* m_element;
     CachedResourceHandle<CachedScript> m_cachedScript;
     bool m_createdByParser;
+    bool m_requested;
     bool m_evaluated;
     bool m_firedLoad;
 };
diff --git a/WebCore/dom/SelectElement.cpp b/WebCore/dom/SelectElement.cpp
new file mode 100644
index 0000000..ff8f1c3
--- /dev/null
+++ b/WebCore/dom/SelectElement.cpp
@@ -0,0 +1,928 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "SelectElement.h"
+
+#include "CharacterNames.h"
+#include "ChromeClient.h"
+#include "Element.h"
+#include "EventHandler.h"
+#include "EventNames.h"
+#include "FormDataList.h"
+#include "Frame.h"
+#include "HTMLFormElement.h"
+#include "HTMLNames.h"
+#include "HTMLKeygenElement.h"
+#include "HTMLSelectElement.h"
+#include "KeyboardEvent.h"
+#include "MappedAttribute.h"
+#include "MouseEvent.h"
+#include "OptionElement.h"
+#include "OptionGroupElement.h"
+#include "Page.h"
+#include "RenderListBox.h"
+#include "RenderMenuList.h"
+#include <wtf/Assertions.h>
+
+#if ENABLE(WML)
+#include "WMLNames.h"
+#include "WMLSelectElement.h"
+#endif
+
+#if PLATFORM(MAC)
+#define ARROW_KEYS_POP_MENU 1
+#else
+#define ARROW_KEYS_POP_MENU 0
+#endif
+
+using std::min;
+using std::max;
+using namespace WTF;
+using namespace Unicode;
+
+namespace WebCore {
+
+static const DOMTimeStamp typeAheadTimeout = 1000;
+
+void SelectElement::selectAll(SelectElementData& data, Element* element)
+{
+    ASSERT(!data.usesMenuList());
+    if (!element->renderer() || !data.multiple())
+        return;
+
+    // Save the selection so it can be compared to the new selectAll selection when dispatching change events
+    saveLastSelection(data, element);
+
+    data.setActiveSelectionState(true);
+    setActiveSelectionAnchorIndex(data, element, nextSelectableListIndex(data, element, -1));
+    setActiveSelectionEndIndex(data, previousSelectableListIndex(data, element, -1));
+
+    updateListBoxSelection(data, element, false);
+    listBoxOnChange(data, element);
+}
+
+void SelectElement::saveLastSelection(SelectElementData& data, Element* element)
+{
+    if (data.usesMenuList()) {
+        data.setLastOnChangeIndex(selectedIndex(data, element));
+        return;
+    }
+
+    Vector<bool>& lastOnChangeSelection = data.lastOnChangeSelection(); 
+    lastOnChangeSelection.clear();
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        lastOnChangeSelection.append(optionElement && optionElement->selected());
+    }
+}
+
+int SelectElement::nextSelectableListIndex(SelectElementData& data, Element* element, int startIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int index = startIndex + 1;
+    while (index >= 0 && (unsigned) index < items.size() && (!isOptionElement(items[index]) || items[index]->disabled()))
+        ++index;
+    if ((unsigned) index == items.size())
+        return startIndex;
+    return index;
+}
+
+int SelectElement::previousSelectableListIndex(SelectElementData& data, Element* element, int startIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    if (startIndex == -1)
+        startIndex = items.size();
+    int index = startIndex - 1;
+    while (index >= 0 && (unsigned) index < items.size() && (!isOptionElement(items[index]) || items[index]->disabled()))
+        --index;
+    if (index == -1)
+        return startIndex;
+    return index;
+}
+
+void SelectElement::setActiveSelectionAnchorIndex(SelectElementData& data, Element* element, int index)
+{
+    data.setActiveSelectionAnchorIndex(index);
+
+    // Cache the selection state so we can restore the old selection as the new selection pivots around this anchor index
+    Vector<bool>& cachedStateForActiveSelection = data.cachedStateForActiveSelection(); 
+    cachedStateForActiveSelection.clear();
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        cachedStateForActiveSelection.append(optionElement && optionElement->selected());
+    }
+}
+
+void SelectElement::setActiveSelectionEndIndex(SelectElementData& data, int index)
+{
+    data.setActiveSelectionEndIndex(index);
+}
+
+void SelectElement::updateListBoxSelection(SelectElementData& data, Element* element, bool deselectOtherOptions)
+{
+    ASSERT(element->renderer() && element->renderer()->isListBox());
+    ASSERT(data.activeSelectionAnchorIndex() >= 0);
+
+    unsigned start = min(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
+    unsigned end = max(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
+    Vector<bool>& cachedStateForActiveSelection = data.cachedStateForActiveSelection();
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        if (!optionElement || items[i]->disabled())
+            continue;
+
+        if (i >= start && i <= end)
+            optionElement->setSelectedState(data.activeSelectionState());
+        else if (deselectOtherOptions || i >= cachedStateForActiveSelection.size())
+            optionElement->setSelectedState(false);
+        else
+            optionElement->setSelectedState(cachedStateForActiveSelection[i]);
+    }
+
+    scrollToSelection(data, element);
+}
+
+void SelectElement::listBoxOnChange(SelectElementData& data, Element* element)
+{
+    ASSERT(!data.usesMenuList());
+
+    Vector<bool>& lastOnChangeSelection = data.lastOnChangeSelection(); 
+    const Vector<Element*>& items = data.listItems(element);
+
+    // If the cached selection list is empty, or the size has changed, then fire dispatchFormControlChangeEvent, and return early.
+    if (lastOnChangeSelection.isEmpty() || lastOnChangeSelection.size() != items.size()) {
+        element->dispatchFormControlChangeEvent();
+        return;
+    }
+
+    // Update lastOnChangeSelection and fire dispatchFormControlChangeEvent
+    bool fireOnChange = false;
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        bool selected = optionElement &&  optionElement->selected();
+        if (selected != lastOnChangeSelection[i])
+            fireOnChange = true;
+        lastOnChangeSelection[i] = selected;
+    }
+
+    if (fireOnChange)
+        element->dispatchFormControlChangeEvent();
+}
+
+void SelectElement::menuListOnChange(SelectElementData& data, Element* element)
+{
+    ASSERT(data.usesMenuList());
+
+    int selected = selectedIndex(data, element);
+    if (data.lastOnChangeIndex() != selected) {
+        data.setLastOnChangeIndex(selected);
+        element->dispatchFormControlChangeEvent();
+    }
+}
+
+void SelectElement::scrollToSelection(SelectElementData& data, Element* element)
+{
+    if (data.usesMenuList())
+        return;
+
+    if (RenderObject* renderer = element->renderer())
+        static_cast<RenderListBox*>(renderer)->selectionChanged();
+}
+
+void SelectElement::recalcStyle(SelectElementData& data, Element* element)
+{
+    RenderObject* renderer = element->renderer();
+    if (element->childNeedsStyleRecalc() && renderer) {
+        if (data.usesMenuList())
+            static_cast<RenderMenuList*>(renderer)->setOptionsChanged(true);
+        else
+            static_cast<RenderListBox*>(renderer)->setOptionsChanged(true);
+    } else if (data.shouldRecalcListItems())
+        recalcListItems(data, element);
+}
+
+void SelectElement::setRecalcListItems(SelectElementData& data, Element* element)
+{
+    data.setShouldRecalcListItems(true);
+    data.setActiveSelectionAnchorIndex(-1); // Manual selection anchor is reset when manipulating the select programmatically.
+    if (RenderObject* renderer = element->renderer()) {
+        if (data.usesMenuList())
+            static_cast<RenderMenuList*>(renderer)->setOptionsChanged(true);
+        else
+            static_cast<RenderListBox*>(renderer)->setOptionsChanged(true);
+    }
+    element->setNeedsStyleRecalc();
+}
+
+void SelectElement::recalcListItems(SelectElementData& data, const Element* element, bool updateSelectedStates)
+{
+    Vector<Element*>& listItems = data.rawListItems();
+    listItems.clear();
+
+    OptionElement* foundSelected = 0;
+    for (Node* currentNode = element->firstChild(); currentNode;) {
+        if (!currentNode->isElementNode()) {
+            currentNode = currentNode->traverseNextSibling(element);
+            continue;
+        }
+
+        Element* current = static_cast<Element*>(currentNode);
+
+        // optgroup tags may not nest. However, both FireFox and IE will
+        // flatten the tree automatically, so we follow suit.
+        // (http://www.w3.org/TR/html401/interact/forms.html#h-17.6)
+        if (isOptionGroupElement(current)) {
+            listItems.append(current);
+            if (current->firstChild()) {
+                currentNode = current->firstChild();
+                continue;
+            }
+        }
+
+        if (OptionElement* optionElement = toOptionElement(current)) {
+            listItems.append(current);
+
+            if (updateSelectedStates) {
+                if (!foundSelected && (data.usesMenuList() || (!data.multiple() && optionElement->selected()))) {
+                    foundSelected = optionElement;
+                    foundSelected->setSelectedState(true);
+                } else if (foundSelected && !data.multiple() && optionElement->selected()) {
+                    foundSelected->setSelectedState(false);
+                    foundSelected = optionElement;
+                }
+            }
+        }
+
+        if (current->hasTagName(HTMLNames::hrTag))
+            listItems.append(current);
+
+        // In conforming HTML code, only <optgroup> and <option> will be found
+        // within a <select>. We call traverseNextSibling so that we only step
+        // into those tags that we choose to. For web-compat, we should cope
+        // with the case where odd tags like a <div> have been added but we
+        // handle this because such tags have already been removed from the
+        // <select>'s subtree at this point.
+        currentNode = currentNode->traverseNextSibling(element);
+    }
+
+    data.setShouldRecalcListItems(false);
+}
+
+int SelectElement::selectedIndex(const SelectElementData& data, const Element* element)
+{
+    unsigned index = 0;
+
+    // return the number of the first option selected
+    const Vector<Element*>& items = data.listItems(element);
+    for (size_t i = 0; i < items.size(); ++i) {
+        if (OptionElement* optionElement = toOptionElement(items[i])) {
+            if (optionElement->selected())
+                return index;
+            ++index;
+        }
+    }
+
+    return -1;
+}
+
+void SelectElement::setSelectedIndex(SelectElementData& data, Element* element, int optionIndex, bool deselect, bool fireOnChange)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int listIndex = optionToListIndex(data, element, optionIndex);
+    if (!data.multiple())
+        deselect = true;
+
+    Element* excludeElement = 0;
+    if (OptionElement* optionElement = (listIndex >= 0 ? toOptionElement(items[listIndex]) : 0)) {
+        excludeElement = items[listIndex];
+        if (data.activeSelectionAnchorIndex() < 0 || deselect)
+            setActiveSelectionAnchorIndex(data, element, listIndex);
+        if (data.activeSelectionEndIndex() < 0 || deselect)
+            setActiveSelectionEndIndex(data, listIndex);
+        optionElement->setSelectedState(true);
+    }
+
+    if (deselect)
+        deselectItems(data, element, excludeElement);
+
+    // For the menu list case, this is what makes the selected element appear.
+    if (RenderObject* renderer = element->renderer())
+        renderer->updateFromElement();
+
+    scrollToSelection(data, element);
+
+    // This only gets called with fireOnChange for menu lists. 
+    if (fireOnChange && data.usesMenuList())
+        menuListOnChange(data, element);
+
+    if (Frame* frame = element->document()->frame())
+        frame->page()->chrome()->client()->formStateDidChange(element);
+}
+
+int SelectElement::optionToListIndex(const SelectElementData& data, const Element* element, int optionIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int listSize = (int) items.size();
+    if (optionIndex < 0 || optionIndex >= listSize)
+        return -1;
+
+    int optionIndex2 = -1;
+    for (int listIndex = 0; listIndex < listSize; ++listIndex) {
+        if (isOptionElement(items[listIndex])) {
+            ++optionIndex2;
+            if (optionIndex2 == optionIndex)
+                return listIndex;
+        }
+    }
+
+    return -1;
+}
+
+int SelectElement::listToOptionIndex(const SelectElementData& data, const Element* element, int listIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    if (listIndex < 0 || listIndex >= int(items.size()) ||
+        !isOptionElement(items[listIndex]))
+        return -1;
+
+    int optionIndex = 0; // actual index of option not counting OPTGROUP entries that may be in list
+    for (int i = 0; i < listIndex; ++i)
+        if (isOptionElement(items[i]))
+            ++optionIndex;
+
+    return optionIndex;
+}
+
+void SelectElement::dispatchFocusEvent(SelectElementData& data, Element* element)
+{
+    // Save the selection so it can be compared to the new selection when dispatching change events during blur event dispatchal
+    if (data.usesMenuList())
+        saveLastSelection(data, element);
+}
+
+void SelectElement::dispatchBlurEvent(SelectElementData& data, Element* element)
+{
+    // We only need to fire change events here for menu lists, because we fire change events for list boxes whenever the selection change is actually made.
+    // This matches other browsers' behavior.
+    if (data.usesMenuList())
+        menuListOnChange(data, element);
+}
+
+void SelectElement::deselectItems(SelectElementData& data, Element* element, Element* excludeElement)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        if (items[i] == excludeElement)
+            continue;
+
+        if (OptionElement* optionElement = toOptionElement(items[i]))
+            optionElement->setSelectedState(false);
+    }
+}
+
+bool SelectElement::saveFormControlState(const SelectElementData& data, const Element* element, String& value)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int length = items.size();
+
+    // FIXME: Change this code to use the new StringImpl::createUninitialized code path.
+    Vector<char, 1024> characters(length);
+    for (int i = 0; i < length; ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        bool selected = optionElement && optionElement->selected();
+        characters[i] = selected ? 'X' : '.';
+    }
+
+    value = String(characters.data(), length);
+    return true;
+}
+
+void SelectElement::restoreFormControlState(SelectElementData& data, Element* element, const String& state)
+{
+    recalcListItems(data, element);
+
+    const Vector<Element*>& items = data.listItems(element);
+    int length = items.size();
+
+    for (int i = 0; i < length; ++i) {
+        if (OptionElement* optionElement = toOptionElement(items[i]))
+            optionElement->setSelectedState(state[i] == 'X');
+    }
+
+    element->setNeedsStyleRecalc();
+}
+
+void SelectElement::parseMultipleAttribute(SelectElementData& data, Element* element, MappedAttribute* attribute)
+{
+    bool oldUsesMenuList = data.usesMenuList();
+    data.setMultiple(!attribute->isNull());
+    if (oldUsesMenuList != data.usesMenuList() && element->attached()) {
+        element->detach();
+        element->attach();
+    }
+}
+
+bool SelectElement::appendFormData(SelectElementData& data, Element* element, FormDataList& list)
+{
+    const AtomicString& name = element->formControlName();
+    if (name.isEmpty())
+        return false;
+
+    bool successful = false;
+    const Vector<Element*>& items = data.listItems(element);
+
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        if (optionElement && optionElement->selected()) {
+            list.appendData(name, optionElement->value());
+            successful = true;
+        }
+    }
+
+    // FIXME: This case should not happen. Make sure that we select the first option
+    // in any case, otherwise we have no consistency with the DOM interface.
+    // We return the first one if it was a combobox select
+    if (!successful && !data.multiple() && data.size() <= 1 && items.size()) {
+        OptionElement* optionElement = toOptionElement(items[0]);
+        const AtomicString& value = optionElement->value();
+        if (value.isNull())
+            list.appendData(name, optionElement->text().stripWhiteSpace());
+        else
+            list.appendData(name, value);
+        successful = true;
+    }
+
+    return successful;
+} 
+
+void SelectElement::reset(SelectElementData& data, Element* element)
+{
+    bool optionSelected = false;
+    OptionElement* firstOption = 0;
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        if (!optionElement)
+            continue;
+
+        if (!items[i]->getAttribute(HTMLNames::selectedAttr).isNull()) {
+            optionElement->setSelectedState(true);
+            optionSelected = true;
+        } else
+            optionElement->setSelectedState(false);
+
+        if (!firstOption)
+            firstOption = optionElement;
+    }
+
+    if (!optionSelected && firstOption && data.usesMenuList())
+        firstOption->setSelectedState(true);
+
+    element->setNeedsStyleRecalc();
+}
+
+void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
+{
+#if !ARROW_KEYS_POP_MENU
+    UNUSED_PARAM(htmlForm);
+#endif
+
+    if (event->type() == eventNames().keydownEvent) {
+        if (!element->renderer() || !event->isKeyboardEvent())
+            return;
+
+        String keyIdentifier = static_cast<KeyboardEvent*>(event)->keyIdentifier();
+        bool handled = false;
+
+#if ARROW_KEYS_POP_MENU
+        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
+            element->focus();
+            // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
+            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+            saveLastSelection(data, element);
+            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer()))
+                menuList->showPopup();
+            handled = true;
+        }
+#else
+        const Vector<Element*>& listItems = data.listItems(element);
+        int size = listItems.size();
+
+        int listIndex = optionToListIndex(data, element, selectedIndex(data, element));
+        if (keyIdentifier == "Down" || keyIdentifier == "Right") {
+            for (listIndex += 1;
+                 listIndex >= 0 && listIndex < size && (listItems[listIndex]->disabled() || !isOptionElement(listItems[listIndex]));
+                 ++listIndex) { }
+            if (listIndex >= 0 && listIndex < size)
+                setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex));
+            handled = true;
+        } else if (keyIdentifier == "Up" || keyIdentifier == "Left") {
+            for (listIndex -= 1;
+                 listIndex >= 0 && listIndex < size && (listItems[listIndex]->disabled() || !isOptionElement(listItems[listIndex]));
+                 --listIndex) { }
+            if (listIndex >= 0 && listIndex < size)
+                setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex));
+            handled = true;
+        }
+#endif
+        if (handled)
+            event->setDefaultHandled();
+    }
+
+    // Use key press event here since sending simulated mouse events
+    // on key down blocks the proper sending of the key press event.
+    if (event->type() == eventNames().keypressEvent) {
+        if (!element->renderer() || !event->isKeyboardEvent())
+            return;
+
+        int keyCode = static_cast<KeyboardEvent*>(event)->keyCode();
+        bool handled = false;
+
+#if ARROW_KEYS_POP_MENU
+        if (keyCode == ' ') {
+            element->focus();
+            // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
+            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+            saveLastSelection(data, element);
+            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer()))
+                menuList->showPopup();
+            handled = true;
+        } else if (keyCode == '\r') {
+            menuListOnChange(data, element);
+            if (htmlForm)
+                htmlForm->submitClick(event);
+            handled = true;
+        }
+#else
+        int listIndex = optionToListIndex(data, element, selectedIndex(data, element));
+        if (keyCode == '\r') {
+            // listIndex should already be selected, but this will fire the onchange handler.
+            setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex), true, true);
+            handled = true;
+        }
+#endif
+        if (handled)
+            event->setDefaultHandled();
+    }
+
+    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+        element->focus();
+        if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer())) {
+            if (menuList->popupIsVisible())
+                menuList->hidePopup();
+            else {
+                // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
+                // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+                saveLastSelection(data, element);
+                menuList->showPopup();
+            }
+        }
+        event->setDefaultHandled();
+    }
+}
+
+void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
+{
+    const Vector<Element*>& listItems = data.listItems(element);
+
+    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+        element->focus();
+
+        // Convert to coords relative to the list box if needed.
+        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+        IntPoint localOffset = roundedIntPoint(element->renderer()->absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
+        int listIndex = static_cast<RenderListBox*>(element->renderer())->listIndexAtOffset(localOffset.x(), localOffset.y());
+        if (listIndex >= 0) {
+            // Save the selection so it can be compared to the new selection when dispatching change events during mouseup, or after autoscroll finishes.
+            saveLastSelection(data, element);
+
+            data.setActiveSelectionState(true);
+            
+            bool multiSelectKeyPressed = false;
+#if PLATFORM(MAC)
+            multiSelectKeyPressed = mouseEvent->metaKey();
+#else
+            multiSelectKeyPressed = mouseEvent->ctrlKey();
+#endif
+
+            bool shiftSelect = data.multiple() && mouseEvent->shiftKey();
+            bool multiSelect = data.multiple() && multiSelectKeyPressed && !mouseEvent->shiftKey();
+
+            Element* clickedElement = listItems[listIndex];            
+            OptionElement* option = toOptionElement(clickedElement);
+            if (option) {
+                // Keep track of whether an active selection (like during drag selection), should select or deselect
+                if (option->selected() && multiSelectKeyPressed)
+                    data.setActiveSelectionState(false);
+
+                if (!data.activeSelectionState())
+                    option->setSelectedState(false);
+            }
+            
+            // If we're not in any special multiple selection mode, then deselect all other items, excluding the clicked option.
+            // If no option was clicked, then this will deselect all items in the list.
+            if (!shiftSelect && !multiSelect)
+                deselectItems(data, element, clickedElement);
+
+            // If the anchor hasn't been set, and we're doing a single selection or a shift selection, then initialize the anchor to the first selected index.
+            if (data.activeSelectionAnchorIndex() < 0 && !multiSelect)
+                setActiveSelectionAnchorIndex(data, element, selectedIndex(data, element));
+
+            // Set the selection state of the clicked option
+            if (option && !clickedElement->disabled())
+                option->setSelectedState(true);
+            
+            // If there was no selectedIndex() for the previous initialization, or
+            // If we're doing a single selection, or a multiple selection (using cmd or ctrl), then initialize the anchor index to the listIndex that just got clicked.
+            if (listIndex >= 0 && (data.activeSelectionAnchorIndex() < 0 || !shiftSelect))
+                setActiveSelectionAnchorIndex(data, element, listIndex);
+            
+            setActiveSelectionEndIndex(data, listIndex);
+            updateListBoxSelection(data, element, !multiSelect);
+
+            if (Frame* frame = element->document()->frame())
+                frame->eventHandler()->setMouseDownMayStartAutoscroll();
+
+            event->setDefaultHandled();
+        }
+    } else if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton && element->document()->frame()->eventHandler()->autoscrollRenderer() != element->renderer())
+        // This makes sure we fire dispatchFormControlChangeEvent for a single click.  For drag selection, onChange will fire when the autoscroll timer stops.
+        listBoxOnChange(data, element);
+    else if (event->type() == eventNames().keydownEvent) {
+        if (!event->isKeyboardEvent())
+            return;
+        String keyIdentifier = static_cast<KeyboardEvent*>(event)->keyIdentifier();
+
+        int endIndex = 0;        
+        if (data.activeSelectionEndIndex() < 0) {
+            // Initialize the end index
+            if (keyIdentifier == "Down")
+                endIndex = nextSelectableListIndex(data, element, lastSelectedListIndex(data, element));
+            else if (keyIdentifier == "Up")
+                endIndex = previousSelectableListIndex(data, element, optionToListIndex(data, element, selectedIndex(data, element)));
+        } else {
+            // Set the end index based on the current end index
+            if (keyIdentifier == "Down")
+                endIndex = nextSelectableListIndex(data, element, data.activeSelectionEndIndex());
+            else if (keyIdentifier == "Up")
+                endIndex = previousSelectableListIndex(data, element, data.activeSelectionEndIndex());    
+        }
+        
+        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
+            // Save the selection so it can be compared to the new selection when dispatching change events immediately after making the new selection.
+            saveLastSelection(data, element);
+
+            ASSERT(endIndex >= 0 && (unsigned) endIndex < listItems.size()); 
+            setActiveSelectionEndIndex(data, endIndex);
+            
+            // If the anchor is unitialized, or if we're going to deselect all other options, then set the anchor index equal to the end index.
+            bool deselectOthers = !data.multiple() || !static_cast<KeyboardEvent*>(event)->shiftKey();
+            if (data.activeSelectionAnchorIndex() < 0 || deselectOthers) {
+                data.setActiveSelectionState(true);
+                if (deselectOthers)
+                    deselectItems(data, element);
+                setActiveSelectionAnchorIndex(data, element, data.activeSelectionEndIndex());
+            }
+
+            static_cast<RenderListBox*>(element->renderer())->scrollToRevealElementAtListIndex(endIndex);
+            updateListBoxSelection(data, element, deselectOthers);
+            listBoxOnChange(data, element);
+            event->setDefaultHandled();
+        }
+    } else if (event->type() == eventNames().keypressEvent) {
+        if (!event->isKeyboardEvent())
+            return;
+        int keyCode = static_cast<KeyboardEvent*>(event)->keyCode();
+
+        if (keyCode == '\r') {
+            if (htmlForm)
+                htmlForm->submitClick(event);
+            event->setDefaultHandled();
+            return;
+        }
+    }
+}
+
+void SelectElement::defaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
+{
+    if (!element->renderer())
+        return;
+
+    if (data.usesMenuList())
+        menuListDefaultEventHandler(data, element, event, htmlForm);
+    else 
+        listBoxDefaultEventHandler(data, element, event, htmlForm);
+
+    if (event->defaultHandled())
+        return;
+
+    if (event->type() == eventNames().keypressEvent && event->isKeyboardEvent()) {
+        KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(event);
+        if (!keyboardEvent->ctrlKey() && !keyboardEvent->altKey() && !keyboardEvent->metaKey() && isPrintableChar(keyboardEvent->charCode())) {
+            typeAheadFind(data, element, keyboardEvent);
+            event->setDefaultHandled();
+            return;
+        }
+    }
+}
+
+int SelectElement::lastSelectedListIndex(const SelectElementData& data, const Element* element)
+{
+    // return the number of the last option selected
+    unsigned index = 0;
+    bool found = false;
+    const Vector<Element*>& items = data.listItems(element);
+    for (size_t i = 0; i < items.size(); ++i) {
+        if (OptionElement* optionElement = toOptionElement(items[i])) {
+            if (optionElement->selected()) {
+                index = i;
+                found = true;
+            }
+        }
+    }
+
+    return found ? (int) index : -1;
+}
+
+static String stripLeadingWhiteSpace(const String& string)
+{
+    int length = string.length();
+
+    int i;
+    for (i = 0; i < length; ++i) {
+        if (string[i] != noBreakSpace && (string[i] <= 0x7F ? !isASCIISpace(string[i]) : (direction(string[i]) != WhiteSpaceNeutral)))
+            break;
+    }
+
+    return string.substring(i, length - i);
+}
+
+void SelectElement::typeAheadFind(SelectElementData& data, Element* element, KeyboardEvent* event)
+{
+    if (event->timeStamp() < data.lastCharTime())
+        return;
+
+    DOMTimeStamp delta = event->timeStamp() - data.lastCharTime();
+    data.setLastCharTime(event->timeStamp());
+
+    UChar c = event->charCode();
+
+    String prefix;
+    int searchStartOffset = 1;
+    if (delta > typeAheadTimeout) {
+        prefix = String(&c, 1);
+        data.setTypedString(prefix);
+        data.setRepeatingChar(c);
+    } else {
+        data.typedString().append(c);
+
+        if (c == data.repeatingChar())
+            // The user is likely trying to cycle through all the items starting with this character, so just search on the character
+            prefix = String(&c, 1);
+        else {
+            data.setRepeatingChar(0);
+            prefix = data.typedString();
+            searchStartOffset = 0;
+        }
+    }
+
+    const Vector<Element*>& items = data.listItems(element);
+    int itemCount = items.size();
+    if (itemCount < 1)
+        return;
+
+    int selected = selectedIndex(data, element);
+    int index = (optionToListIndex(data, element, selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
+    ASSERT(index >= 0);
+
+    for (int i = 0; i < itemCount; ++i, index = (index + 1) % itemCount) {
+        OptionElement* optionElement = toOptionElement(items[index]);
+        if (!optionElement || items[index]->disabled())
+            continue;
+
+        String text = optionElement->textIndentedToRespectGroupLabel();
+        if (stripLeadingWhiteSpace(text).startsWith(prefix, false)) {
+            setSelectedIndex(data, element, listToOptionIndex(data, element, index));
+            if (!data.usesMenuList())
+                listBoxOnChange(data, element);
+            element->setNeedsStyleRecalc();
+            return;
+        }
+    }
+}
+
+void SelectElement::insertedIntoTree(SelectElementData& data, Element* element)
+{
+    // When the element is created during document parsing, it won't have any items yet - but for innerHTML
+    // and related methods, this method is called after the whole subtree is constructed.
+    recalcListItems(data, element, true);
+}
+
+void SelectElement::accessKeySetSelectedIndex(SelectElementData& data, Element* element, int index)
+{    
+    // first bring into focus the list box
+    if (!element->focused())
+        element->accessKeyAction(false);
+    
+    // if this index is already selected, unselect. otherwise update the selected index
+    const Vector<Element*>& items = data.listItems(element);
+    int listIndex = optionToListIndex(data, element, index);
+    if (OptionElement* optionElement = (listIndex >= 0 ? toOptionElement(items[listIndex]) : 0)) {
+        if (optionElement->selected())
+            optionElement->setSelectedState(false);
+        else
+            setSelectedIndex(data, element, index, false, true);
+    }
+ 
+    listBoxOnChange(data, element);
+    scrollToSelection(data, element);
+}
+
+// SelectElementData
+SelectElementData::SelectElementData()
+    : m_multiple(false) 
+    , m_size(0)
+    , m_lastOnChangeIndex(-1)
+    , m_activeSelectionState(false)
+    , m_activeSelectionAnchorIndex(-1)
+    , m_activeSelectionEndIndex(-1)
+    , m_recalcListItems(false)
+    , m_repeatingChar(0)
+    , m_lastCharTime(0)
+{
+}
+
+void SelectElementData::checkListItems(const Element* element) const
+{
+#ifndef NDEBUG
+    const Vector<Element*>& items = m_listItems;
+    SelectElement::recalcListItems(*const_cast<SelectElementData*>(this), element, false);
+    ASSERT(items == m_listItems);
+#else
+    UNUSED_PARAM(element);
+#endif
+}
+
+Vector<Element*>& SelectElementData::listItems(const Element* element)
+{
+    if (m_recalcListItems)
+        SelectElement::recalcListItems(*this, element);
+    else
+        checkListItems(element);
+
+    return m_listItems;
+}
+
+const Vector<Element*>& SelectElementData::listItems(const Element* element) const
+{
+    if (m_recalcListItems)
+        SelectElement::recalcListItems(*const_cast<SelectElementData*>(this), element);
+    else
+        checkListItems(element);
+
+    return m_listItems;
+}
+
+SelectElement* toSelectElement(Element* element)
+{
+    if (element->isHTMLElement()) {
+        if (element->hasTagName(HTMLNames::selectTag))
+            return static_cast<HTMLSelectElement*>(element);
+        if (element->hasTagName(HTMLNames::keygenTag))
+            return static_cast<HTMLKeygenElement*>(element);
+    }
+
+#if ENABLE(WML)
+    if (element->isWMLElement() && element->hasTagName(WMLNames::selectTag))
+        return static_cast<WMLSelectElement*>(element);
+#endif
+
+    return 0;
+}
+
+}
diff --git a/WebCore/dom/SelectElement.h b/WebCore/dom/SelectElement.h
new file mode 100644
index 0000000..bad9b79
--- /dev/null
+++ b/WebCore/dom/SelectElement.h
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http//www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef SelectElement_h
+#define SelectElement_h
+
+#include "Event.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Element;
+class Event;
+class FormDataList;
+class HTMLFormElement;
+class KeyboardEvent;
+class MappedAttribute;
+class SelectElementData;
+class String;
+
+class SelectElement {
+public:
+    virtual bool multiple() const = 0;
+
+    virtual int size() const = 0;
+    virtual const Vector<Element*>& listItems() const = 0;
+
+    virtual void listBoxOnChange() = 0;
+    virtual void updateListBoxSelection(bool deselectOtherOptions) = 0;
+
+    virtual void menuListOnChange() = 0;
+
+    virtual int activeSelectionStartListIndex() const = 0;
+    virtual int activeSelectionEndListIndex() const = 0;
+
+    virtual void setActiveSelectionAnchorIndex(int index) = 0;
+    virtual void setActiveSelectionEndIndex(int index) = 0;
+
+    virtual int listToOptionIndex(int listIndex) const = 0;
+    virtual int optionToListIndex(int optionIndex) const = 0;
+
+    virtual int selectedIndex() const = 0;
+    virtual void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false) = 0;
+
+protected:
+    virtual ~SelectElement() { }
+
+    friend class SelectElementData;
+
+    static void selectAll(SelectElementData&, Element*);
+    static void saveLastSelection(SelectElementData&, Element*);
+    static int nextSelectableListIndex(SelectElementData&, Element*, int startIndex);
+    static int previousSelectableListIndex(SelectElementData&, Element*, int startIndex);
+    static void setActiveSelectionAnchorIndex(SelectElementData&, Element*, int index);
+    static void setActiveSelectionEndIndex(SelectElementData&, int index);
+    static void updateListBoxSelection(SelectElementData&, Element*, bool deselectOtherOptions);
+    static void listBoxOnChange(SelectElementData&, Element*);
+    static void menuListOnChange(SelectElementData&, Element*);
+    static void scrollToSelection(SelectElementData&, Element*);
+    static void recalcStyle(SelectElementData&, Element*);
+    static void setRecalcListItems(SelectElementData&, Element*);
+    static void recalcListItems(SelectElementData&, const Element*, bool updateSelectedStates = true);
+    static int selectedIndex(const SelectElementData&, const Element*);
+    static void setSelectedIndex(SelectElementData&, Element*, int optionIndex, bool deselect = true, bool fireOnChange = false);
+    static int optionToListIndex(const SelectElementData&, const Element*, int optionIndex);
+    static int listToOptionIndex(const SelectElementData&, const Element*, int listIndex);
+    static void dispatchFocusEvent(SelectElementData&, Element*);
+    static void dispatchBlurEvent(SelectElementData&, Element*);
+    static void deselectItems(SelectElementData&, Element*, Element* excludeElement = 0);
+    static bool saveFormControlState(const SelectElementData&, const Element*, String& state);
+    static void restoreFormControlState(SelectElementData&, Element*, const String& state);
+    static void parseMultipleAttribute(SelectElementData&, Element*, MappedAttribute*);
+    static bool appendFormData(SelectElementData&, Element*, FormDataList&);
+    static void reset(SelectElementData&, Element*);
+    static void defaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement* = 0);
+    static int lastSelectedListIndex(const SelectElementData&, const Element*);
+    static void typeAheadFind(SelectElementData&, Element*, KeyboardEvent*);
+    static void insertedIntoTree(SelectElementData&, Element*);
+    static void accessKeySetSelectedIndex(SelectElementData&, Element*, int index);
+
+private:
+    static void menuListDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
+    static void listBoxDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
+};
+
+// HTML/WMLSelectElement hold this struct as member variable
+// and pass it to the static helper functions in SelectElement
+class SelectElementData {
+public:
+    SelectElementData();
+
+    bool multiple() const { return m_multiple; }
+    void setMultiple(bool value) { m_multiple = value; }
+
+    int size() const { return m_size; }
+    void setSize(int value) { m_size = value; }
+
+    bool usesMenuList() const { return !m_multiple && m_size <= 1; }
+
+    int lastOnChangeIndex() const { return m_lastOnChangeIndex; }
+    void setLastOnChangeIndex(int value) { m_lastOnChangeIndex = value; }
+
+    Vector<bool>& lastOnChangeSelection() { return m_lastOnChangeSelection; }
+
+    bool activeSelectionState() const { return m_activeSelectionState; }
+    void setActiveSelectionState(bool value) { m_activeSelectionState = value; }
+
+    int activeSelectionAnchorIndex() const { return m_activeSelectionAnchorIndex; }
+    void setActiveSelectionAnchorIndex(int value) { m_activeSelectionAnchorIndex = value; }
+
+    int activeSelectionEndIndex() const { return m_activeSelectionEndIndex; }
+    void setActiveSelectionEndIndex(int value) { m_activeSelectionEndIndex = value; }
+
+    Vector<bool>& cachedStateForActiveSelection() { return m_cachedStateForActiveSelection; }
+
+    bool shouldRecalcListItems() const { return m_recalcListItems; }
+    void setShouldRecalcListItems(bool value) { m_recalcListItems = value; }
+
+    Vector<Element*>& rawListItems() { return m_listItems; }
+    Vector<Element*>& listItems(const Element*);
+    const Vector<Element*>& listItems(const Element*) const;
+
+    UChar repeatingChar() const { return m_repeatingChar; }
+    void setRepeatingChar(const UChar& value) { m_repeatingChar = value; }
+
+    DOMTimeStamp lastCharTime() const { return m_lastCharTime; }
+    void setLastCharTime(const DOMTimeStamp& value) { m_lastCharTime = value; }
+
+    String& typedString() { return m_typedString; }
+    void setTypedString(const String& value) { m_typedString = value; }
+
+private:
+    void checkListItems(const Element*) const;
+
+    bool m_multiple;
+    int m_size;
+
+    int m_lastOnChangeIndex;
+    Vector<bool> m_lastOnChangeSelection;
+
+    bool m_activeSelectionState;
+    int m_activeSelectionAnchorIndex;
+    int m_activeSelectionEndIndex;
+    Vector<bool> m_cachedStateForActiveSelection;
+
+    bool m_recalcListItems;
+    Vector<Element*> m_listItems;
+
+    // Instance variables for type-ahead find
+    UChar m_repeatingChar;
+    DOMTimeStamp m_lastCharTime;
+    String m_typedString;
+};
+
+SelectElement* toSelectElement(Element*);
+
+}
+
+#endif
diff --git a/WebCore/dom/StyleElement.cpp b/WebCore/dom/StyleElement.cpp
index 68c3ec7..a21959d 100644
--- a/WebCore/dom/StyleElement.cpp
+++ b/WebCore/dom/StyleElement.cpp
@@ -61,13 +61,28 @@
     if (!e || !e->inDocument())
         return;
 
-    Vector<UChar> text;
+    unsigned resultLength = 0;
+    for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
+        Node::NodeType nodeType = c->nodeType();
+        if (nodeType == Node::TEXT_NODE || nodeType == Node::CDATA_SECTION_NODE || nodeType == Node::COMMENT_NODE)
+            resultLength += c->nodeValue().length();
+    }
+    UChar* text;
+    String sheetText = String::createUninitialized(resultLength, text);
 
-    for (Node* c = e->firstChild(); c; c = c->nextSibling())
-        if (c->nodeType() == Node::TEXT_NODE || c->nodeType() == Node::CDATA_SECTION_NODE || c->nodeType() == Node::COMMENT_NODE)
-            append(text, c->nodeValue());
+    UChar* p = text;
+    for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
+        Node::NodeType nodeType = c->nodeType();
+        if (nodeType == Node::TEXT_NODE || nodeType == Node::CDATA_SECTION_NODE || nodeType == Node::COMMENT_NODE) {
+            String nodeValue = c->nodeValue();
+            unsigned nodeLength = nodeValue.length();
+            memcpy(p, nodeValue.characters(), nodeLength * sizeof(UChar));
+            p += nodeLength;
+        }
+    }
+    ASSERT(p == text + resultLength);
 
-    createSheet(e, String::adopt(text));
+    createSheet(e, sheetText);
 }
 
 void StyleElement::createSheet(Element* e, const String& text)
diff --git a/WebCore/dom/StyledElement.cpp b/WebCore/dom/StyledElement.cpp
index d5af1b7..8ddfd31 100644
--- a/WebCore/dom/StyledElement.cpp
+++ b/WebCore/dom/StyledElement.cpp
@@ -29,6 +29,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include <wtf/HashFunctions.h>
 
 using namespace std;
@@ -157,7 +158,7 @@
     MappedAttribute* mappedAttr = static_cast<MappedAttribute*>(attr);
     if (mappedAttr->decl() && !preserveDecls) {
         mappedAttr->setDecl(0);
-        setChanged();
+        setNeedsStyleRecalc();
         if (namedAttrMap)
             mappedAttributes()->declRemoved();
     }
@@ -167,7 +168,7 @@
     bool needToParse = mapToEntry(attr->name(), entry);
     if (preserveDecls) {
         if (mappedAttr->decl()) {
-            setChanged();
+            setNeedsStyleRecalc();
             if (namedAttrMap)
                 mappedAttributes()->declAdded();
             checkDecl = false;
@@ -177,7 +178,7 @@
         CSSMappedAttributeDeclaration* decl = getMappedAttributeDecl(entry, attr);
         if (decl) {
             mappedAttr->setDecl(decl);
-            setChanged();
+            setNeedsStyleRecalc();
             if (namedAttrMap)
                 mappedAttributes()->declAdded();
             checkDecl = false;
@@ -185,11 +186,16 @@
             needToParse = true;
     }
 
+    // parseMappedAttribute() might create a CSSMappedAttributeDeclaration on the attribute.  
+    // Normally we would be concerned about reseting the parent of those declarations in StyledElement::didMoveToNewOwnerDocument().
+    // But currently we always clear its parent and node below when adding it to the decl table.  
+    // If that changes for some reason moving between documents will be buggy.
+    // webarchive/adopt-attribute-styled-node-webarchive.html should catch any resulting crashes.
     if (needToParse)
         parseMappedAttribute(mappedAttr);
 
     if (entry == eNone && ownerDocument()->attached() && ownerDocument()->styleSelector()->hasSelectorForAttribute(attr->name().localName()))
-        setChanged();
+        setNeedsStyleRecalc();
 
     if (checkDecl && mappedAttr->decl()) {
         // Add the decl to the table in the appropriate spot.
@@ -227,7 +233,7 @@
         else
             mappedAttributes()->clearClass();
     }
-    setChanged();
+    setNeedsStyleRecalc();
     dispatchSubtreeModifiedEvent();
 }
 
@@ -244,7 +250,7 @@
             else
                 namedAttrMap->setID(attr->value());
         }
-        setChanged();
+        setNeedsStyleRecalc();
     } else if (attr->name() == classAttr)
         classAttributeChanged(attr->value());
     else if (attr->name() == styleAttr) {
@@ -253,7 +259,7 @@
         else
             getInlineStyleDecl()->parseDeclaration(attr->value());
         m_isStyleAttributeValid = true;
-        setChanged();
+        setNeedsStyleRecalc();
     }
 }
 
@@ -502,4 +508,13 @@
         style->addSubresourceStyleURLs(urls);
 }
 
+
+void StyledElement::didMoveToNewOwnerDocument()
+{
+    if (m_inlineStyleDecl)
+        m_inlineStyleDecl->setParent(document()->elementSheet());
+
+    Element::didMoveToNewOwnerDocument();
+}
+
 }
diff --git a/WebCore/dom/StyledElement.h b/WebCore/dom/StyledElement.h
index 4ca48e9..158992e 100644
--- a/WebCore/dom/StyledElement.h
+++ b/WebCore/dom/StyledElement.h
@@ -25,12 +25,15 @@
 #ifndef StyledElement_h
 #define StyledElement_h
 
+#include "CSSPrimitiveValue.h"
 #include "Element.h"
+#include "MappedAttributeEntry.h"
 #include "NamedMappedAttrMap.h"
 
 namespace WebCore {
 
 class CSSMappedAttributeDeclaration;
+class CSSMutableStyleDeclaration;
 class MappedAttribute;
 
 class StyledElement : public Element {
@@ -87,6 +90,8 @@
     // parseMappedAttribute (called via setAttribute()) and
     // svgAttributeChanged (called when element.className.baseValue is set)
     void classAttributeChanged(const AtomicString& newClassString);
+    
+    virtual void didMoveToNewOwnerDocument();
 
     RefPtr<CSSMutableStyleDeclaration> m_inlineStyleDecl;
 };
diff --git a/WebCore/dom/Text.cpp b/WebCore/dom/Text.cpp
index 5cb1af5..04e499a 100644
--- a/WebCore/dom/Text.cpp
+++ b/WebCore/dom/Text.cpp
@@ -125,17 +125,30 @@
     const Text* startText = earliestLogicallyAdjacentTextNode(this);
     const Text* endText = latestLogicallyAdjacentTextNode(this);
 
-    Vector<UChar> result;
     Node* onePastEndText = endText->nextSibling();
+    unsigned resultLength = 0;
     for (const Node* n = startText; n != onePastEndText; n = n->nextSibling()) {
         if (!n->isTextNode())
             continue;
         const Text* t = static_cast<const Text*>(n);
         const String& data = t->data();
-        result.append(data.characters(), data.length());
+        resultLength += data.length();
     }
+    UChar* resultData;
+    String result = String::createUninitialized(resultLength, resultData);
+    UChar* p = resultData;
+    for (const Node* n = startText; n != onePastEndText; n = n->nextSibling()) {
+        if (!n->isTextNode())
+            continue;
+        const Text* t = static_cast<const Text*>(n);
+        const String& data = t->data();
+        unsigned dataLength = data.length();
+        memcpy(p, data.characters(), dataLength * sizeof(UChar));
+        p += dataLength;
+    }
+    ASSERT(p == resultData + resultLength);
 
-    return String::adopt(result);
+    return result;
 }
 
 PassRefPtr<Text> Text::replaceWholeText(const String& newText, ExceptionCode&)
@@ -257,7 +270,7 @@
         if (renderer())
             renderer()->setStyle(parentNode()->renderer()->style());
     }
-    if (changed()) {
+    if (needsStyleRecalc()) {
         if (renderer()) {
             if (renderer()->isText())
                 toRenderText(renderer())->setText(m_data);
@@ -267,7 +280,7 @@
             attach();
         }
     }
-    setChanged(NoStyleChange);
+    setNeedsStyleRecalc(NoStyleChange);
 }
 
 // DOM Section 1.1.1
diff --git a/WebCore/dom/TreeWalker.h b/WebCore/dom/TreeWalker.h
index d06acb9..4cc8e9a 100644
--- a/WebCore/dom/TreeWalker.h
+++ b/WebCore/dom/TreeWalker.h
@@ -25,7 +25,6 @@
 #ifndef TreeWalker_h
 #define TreeWalker_h
 
-#include "JSDOMBinding.h"
 #include "NodeFilter.h"
 #include "Traversal.h"
 #include <wtf/PassRefPtr.h>
diff --git a/WebCore/dom/WheelEvent.idl b/WebCore/dom/WheelEvent.idl
index 1445509..4cba4ac 100644
--- a/WebCore/dom/WheelEvent.idl
+++ b/WebCore/dom/WheelEvent.idl
@@ -42,11 +42,11 @@
         readonly attribute long    x;
         readonly attribute long    y;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute boolean isHorizontal;
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         void initWheelEvent(in long wheelDeltaX,
                             in long wheelDeltaY, 
                             in DOMWindow view, 
diff --git a/WebCore/dom/XMLTokenizer.cpp b/WebCore/dom/XMLTokenizer.cpp
index 1415922..1747c3c 100644
--- a/WebCore/dom/XMLTokenizer.cpp
+++ b/WebCore/dom/XMLTokenizer.cpp
@@ -273,7 +273,7 @@
         par->appendChild(doc->createTextNode("This document was created as the result of an XSL transformation. The line and column numbers given are from the transformed result."), ec);
     }
 #endif
-    doc->updateRendering();
+    doc->updateStyleIfNeeded();
 }
 
 void XMLTokenizer::notifyFinished(CachedResource* unusedResource)
@@ -320,4 +320,3 @@
 }
 
 }
-
diff --git a/WebCore/dom/XMLTokenizer.h b/WebCore/dom/XMLTokenizer.h
index 8f35c63..2ec1bfa 100644
--- a/WebCore/dom/XMLTokenizer.h
+++ b/WebCore/dom/XMLTokenizer.h
@@ -3,6 +3,7 @@
  * Copyright (C) 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -181,6 +182,10 @@
 
         void setIsXHTMLDocument(bool isXHTML) { m_isXHTMLDocument = isXHTML; }
         bool isXHTMLDocument() const { return m_isXHTMLDocument; }
+#if ENABLE(XHTMLMP)
+        void setIsXHTMLMPDocument(bool isXHTML) { m_isXHTMLMPDocument = isXHTML; }
+        bool isXHTMLMPDocument() const { return m_isXHTMLMPDocument; }
+#endif
 #if ENABLE(WML)
         bool isWMLDocument() const;
 #endif
@@ -258,6 +263,10 @@
         bool m_sawXSLTransform;
         bool m_sawFirstElement;
         bool m_isXHTMLDocument;
+#if ENABLE(XHTMLMP)
+        bool m_isXHTMLMPDocument;
+        bool m_hasDocTypeDeclaration;
+#endif
 
         bool m_parserPaused;
         bool m_requestingScript;
@@ -282,7 +291,6 @@
 
 #if ENABLE(XSLT)
 void* xmlDocPtrForString(DocLoader*, const String& source, const String& url);
-void setLoaderForLibXMLCallbacks(DocLoader*);
 #endif
 
 HashMap<String, String> parseAttributes(const String&, bool& attrsOK);
diff --git a/WebCore/dom/XMLTokenizerLibxml2.cpp b/WebCore/dom/XMLTokenizerLibxml2.cpp
index 77a1afd..4098eaa 100644
--- a/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -5,7 +5,7 @@
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Holger Hans Peter Freyther
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -50,6 +50,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
+#include "XMLTokenizerScope.h"
 #include <libxml/parser.h>
 #include <libxml/parserInternals.h>
 #include <wtf/Platform.h>
@@ -62,6 +63,11 @@
 #include <libxslt/xslt.h>
 #endif
 
+#if ENABLE(XHTMLMP)
+#include "HTMLNames.h"
+#include "HTMLScriptElement.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -325,14 +331,13 @@
 // --------------------------------
 
 static int globalDescriptor = 0;
-static DocLoader* globalDocLoader = 0;
 static ThreadIdentifier libxmlLoaderThread = 0;
 
 static int matchFunc(const char*)
 {
     // Only match loads initiated due to uses of libxml2 from within XMLTokenizer to avoid
     // interfering with client applications that also use libxml2.  http://bugs.webkit.org/show_bug.cgi?id=17353
-    return globalDocLoader && currentThread() == libxmlLoaderThread;
+    return XMLTokenizerScope::currentDocLoader && currentThread() == libxmlLoaderThread;
 }
 
 class OffsetBuffer {
@@ -382,8 +387,8 @@
     // retrieved content.  If we had more context, we could potentially allow
     // the parser to load a DTD.  As things stand, we take the conservative
     // route and allow same-origin requests only.
-    if (!globalDocLoader->doc()->securityOrigin()->canRequest(url)) {
-        globalDocLoader->printAccessDeniedMessage(url);
+    if (!XMLTokenizerScope::currentDocLoader->doc()->securityOrigin()->canRequest(url)) {
+        XMLTokenizerScope::currentDocLoader->printAccessDeniedMessage(url);
         return false;
     }
 
@@ -392,7 +397,7 @@
 
 static void* openFunc(const char* uri)
 {
-    ASSERT(globalDocLoader);
+    ASSERT(XMLTokenizerScope::currentDocLoader);
     ASSERT(currentThread() == libxmlLoaderThread);
 
     KURL url(KURL(), uri);
@@ -403,15 +408,16 @@
     ResourceError error;
     ResourceResponse response;
     Vector<char> data;
-    
-    DocLoader* docLoader = globalDocLoader;
-    globalDocLoader = 0;
-    // FIXME: We should restore the original global error handler as well.
 
-    if (docLoader->frame()) 
-        docLoader->frame()->loader()->loadResourceSynchronously(url, error, response, data);
 
-    globalDocLoader = docLoader;
+    {
+        DocLoader* docLoader = XMLTokenizerScope::currentDocLoader;
+        XMLTokenizerScope scope(0);
+        // FIXME: We should restore the original global error handler as well.
+
+        if (docLoader->frame()) 
+            docLoader->frame()->loader()->loadResourceSynchronously(url, AllowStoredCredentials, error, response, data);
+    }
 
     // We have to check the URL again after the load to catch redirects.
     // See <https://bugs.webkit.org/show_bug.cgi?id=21963>.
@@ -453,11 +459,6 @@
 }
 #endif
 
-void setLoaderForLibXMLCallbacks(DocLoader* docLoader)
-{
-    globalDocLoader = docLoader;
-}
-
 static bool didInit = false;
 
 static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* userData)
@@ -530,6 +531,10 @@
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -553,6 +558,10 @@
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -583,7 +592,7 @@
         return;
     
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedAttrMap* attrs = element->attributes()) {
+        if (NamedNodeMap* attrs = element->attributes()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
                 if (attr->localName() == "xmlns")
@@ -625,6 +634,7 @@
         const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
         xmlSwitchEncoding(m_context, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
+        XMLTokenizerScope scope(m_doc->docLoader());
         xmlParseChunk(m_context, reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
     }
     
@@ -707,8 +717,13 @@
         return;
     }
 
-    bool isFirstElement = !m_sawFirstElement;
-    m_sawFirstElement = true;
+#if ENABLE(XHTMLMP) 
+    // check if the DOCTYPE Declaration of XHTMLMP document exists
+    if (!m_hasDocTypeDeclaration && m_doc->isXHTMLMPDocument()) {
+        handleError(fatal, "DOCTYPE declaration lost.", lineNumber(), columnNumber());
+        return;
+    }
+#endif
 
     exitText();
 
@@ -723,6 +738,27 @@
             uri = m_defaultNamespaceURI;
     }
 
+#if ENABLE(XHTMLMP)
+    if (!m_sawFirstElement && isXHTMLMPDocument()) {
+        // As per the section 7.1 of OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf, 
+        // we should make sure that the root element MUST be 'html' and 
+        // ensure the name of the default namespace on the root elment 'html' 
+        // MUST be 'http://www.w3.org/1999/xhtml'
+        if (localName != HTMLNames::htmlTag.localName()) {
+            handleError(fatal, "XHTMLMP document expects 'html' as root element.", lineNumber(), columnNumber());
+            return;
+        }
+
+        if (uri.isNull()) {
+            m_defaultNamespaceURI = HTMLNames::xhtmlNamespaceURI; 
+            uri = m_defaultNamespaceURI;
+        }
+    }
+#endif
+
+    bool isFirstElement = !m_sawFirstElement;
+    m_sawFirstElement = true;
+
     QualifiedName qName(prefix, localName, uri);
     RefPtr<Element> newElement = m_doc->createElement(qName, true);
     if (!newElement) {
@@ -739,7 +775,7 @@
 
     ScriptController* jsProxy = m_doc->frame() ? m_doc->frame()->script() : 0;
     if (jsProxy && m_doc->frame()->script()->isEnabled())
-        jsProxy->setEventHandlerLineno(lineNumber());
+        jsProxy->setEventHandlerLineNumber(lineNumber());
 
     handleElementAttributes(newElement.get(), libxmlAttributes, nb_attributes, ec);
     if (ec) {
@@ -748,7 +784,7 @@
     }
 
     if (jsProxy)
-        jsProxy->setEventHandlerLineno(0);
+        jsProxy->setEventHandlerLineNumber(0);
 
     newElement->beginParsingChildren();
 
@@ -801,22 +837,28 @@
     ASSERT(!m_pendingScript);
     m_requestingScript = true;
 
-    String scriptHref = scriptElement->sourceAttributeValue();
-    if (!scriptHref.isEmpty()) {
-        // we have a src attribute 
-        String scriptCharset = scriptElement->scriptCharset();
-        if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
-            m_scriptElement = element;
-            m_pendingScript->addClient(this);
+#if ENABLE(XHTMLMP)
+    if (!scriptElement->shouldExecuteAsJavaScript())
+        m_doc->setShouldProcessNoscriptElement(true);
+    else 
+#endif
+    {
+        String scriptHref = scriptElement->sourceAttributeValue();
+        if (!scriptHref.isEmpty()) {
+            // we have a src attribute 
+            String scriptCharset = scriptElement->scriptCharset();
+            if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
+                m_scriptElement = element;
+                m_pendingScript->addClient(this);
 
-            // m_pendingScript will be 0 if script was already loaded and ref() executed it
-            if (m_pendingScript)
-                pauseParsing();
-        } else 
-            m_scriptElement = 0;
-    } else
-        m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
-
+                // m_pendingScript will be 0 if script was already loaded and ref() executed it
+                if (m_pendingScript)
+                    pauseParsing();
+            } else 
+                m_scriptElement = 0;
+        } else
+            m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
+    }
     m_requestingScript = false;
     setCurrentNode(parent.get());
 }
@@ -845,7 +887,8 @@
     vsnprintf(m, sizeof(m) - 1, message, args);
 #else
     char* m;
-    vasprintf(&m, message, args);
+    if (vasprintf(&m, message, args) == -1)
+        return;
 #endif
     
     if (m_parserPaused)
@@ -944,6 +987,9 @@
 void XMLTokenizer::endDocument()
 {
     exitText();
+#if ENABLE(XHTMLMP)
+    m_hasDocTypeDeclaration = false;
+#endif
 }
 
 void XMLTokenizer::internalSubset(const xmlChar* name, const xmlChar* externalID, const xmlChar* systemID)
@@ -957,8 +1003,10 @@
     }
     
     if (m_doc) {
-#if ENABLE(WML)
+#if ENABLE(WML) || ENABLE(XHTMLMP)
         String extId = toString(externalID);
+#endif
+#if ENABLE(WML)
         if (isWMLDocument()
             && extId != "-//WAPFORUM//DTD WML 1.3//EN"
             && extId != "-//WAPFORUM//DTD WML 1.2//EN"
@@ -966,8 +1014,31 @@
             && extId != "-//WAPFORUM//DTD WML 1.0//EN")
             handleError(fatal, "Invalid DTD Public ID", lineNumber(), columnNumber());
 #endif
+#if ENABLE(XHTMLMP)
+        String dtdName = toString(name);
+        if (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN"
+            || extId == "-//WAPFORUM//DTD XHTML Mobile 1.1//EN") {
+            if (dtdName != HTMLNames::htmlTag.localName()) {
+                handleError(fatal, "Invalid DOCTYPE declaration, expected 'html' as root element.", lineNumber(), columnNumber());
+                return;
+            } 
 
+            if (m_doc->isXHTMLMPDocument())
+                setIsXHTMLMPDocument(true);
+            else
+                setIsXHTMLDocument(true);
+
+            m_hasDocTypeDeclaration = true;
+        }
+#endif
+
+#if ENABLE(XHTMLMP)
+        m_doc->addChild(DocumentType::create(m_doc, dtdName, extId, toString(systemID)));
+#elif ENABLE(WML)
+        m_doc->addChild(DocumentType::create(m_doc, toString(name), extId, toString(systemID)));
+#else
         m_doc->addChild(DocumentType::create(m_doc, toString(name), toString(externalID), toString(systemID)));
+#endif
     }
 }
 
@@ -1066,19 +1137,22 @@
     va_end(args);
 }
 
-// Using a global variable entity and marking it XML_INTERNAL_PREDEFINED_ENTITY is
+// Using a static entity and marking it XML_INTERNAL_PREDEFINED_ENTITY is
 // a hack to avoid malloc/free. Using a global variable like this could cause trouble
 // if libxml implementation details were to change
-static xmlChar sharedXHTMLEntityResult[5] = {0,0,0,0,0};
-static xmlEntity sharedXHTMLEntity = {
-    0, XML_ENTITY_DECL, 0, 0, 0, 0, 0, 0, 0, 
-    sharedXHTMLEntityResult, sharedXHTMLEntityResult, 0,
-    XML_INTERNAL_PREDEFINED_ENTITY, 0, 0, 0, 0, 0,
-#if LIBXML_VERSION >= 20627
-    // xmlEntity gained an extra member in 2.6.27.
-    1
-#endif
-};
+static xmlChar sharedXHTMLEntityResult[5] = {0, 0, 0, 0, 0};
+
+static xmlEntityPtr sharedXHTMLEntity()
+{
+    static xmlEntity entity;
+    if (!entity.type) {
+        entity.type = XML_ENTITY_DECL;
+        entity.orig = sharedXHTMLEntityResult;
+        entity.content = sharedXHTMLEntityResult;
+        entity.etype = XML_INTERNAL_PREDEFINED_ENTITY;
+    }
+    return &entity;
+}
 
 static xmlEntityPtr getXHTMLEntity(const xmlChar* name)
 {
@@ -1088,11 +1162,12 @@
 
     CString value = String(&c, 1).utf8();
     ASSERT(value.length() < 5);
-    sharedXHTMLEntity.length = value.length();
-    sharedXHTMLEntity.name = name;
-    memcpy(sharedXHTMLEntityResult, value.data(), sharedXHTMLEntity.length + 1);
+    xmlEntityPtr entity = sharedXHTMLEntity();
+    entity->length = value.length();
+    entity->name = name;
+    memcpy(sharedXHTMLEntityResult, value.data(), entity->length + 1);
 
-    return &sharedXHTMLEntity;
+    return entity;
 }
 
 static xmlEntityPtr getEntityHandler(void* closure, const xmlChar* name)
@@ -1106,6 +1181,9 @@
 
     ent = xmlGetDocEntity(ctxt->myDoc, name);
     if (!ent && (getTokenizer(closure)->isXHTMLDocument()
+#if ENABLE(XHTMLMP)
+                 || getTokenizer(closure)->isXHTMLMPDocument()
+#endif
 #if ENABLE(WML)
                  || getTokenizer(closure)->isWMLDocument()
 #endif
@@ -1147,7 +1225,10 @@
         || (extId == "-//W3C//DTD XHTML Basic 1.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN")
-        || (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))
+#if !ENABLE(XHTMLMP)
+        || (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN")
+#endif
+       )
         getTokenizer(closure)->setIsXHTMLDocument(true); // controls if we replace entities or not.
 }
 
@@ -1185,6 +1266,7 @@
     m_sawXSLTransform = false;
     m_sawFirstElement = false;
 
+    XMLTokenizerScope scope(m_doc->docLoader());
     if (m_parsingFragment)
         m_context = createMemoryParser(&sax, this, chunk);
     else
@@ -1206,8 +1288,11 @@
 
     if (m_context) {
         // Tell libxml we're done.
-        xmlParseChunk(m_context, 0, 0, 1);
-        
+        {
+            XMLTokenizerScope scope(m_doc->docLoader());
+            xmlParseChunk(m_context, 0, 0, 1);
+        }
+
         if (m_context->myDoc)
             xmlFreeDoc(m_context->myDoc);
         xmlFreeParserCtxt(m_context);
@@ -1227,21 +1312,12 @@
     const UChar BOM = 0xFEFF;
     const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
 
-    xmlGenericErrorFunc oldErrorFunc = xmlGenericError;
-    void* oldErrorContext = xmlGenericErrorContext;
-    
-    setLoaderForLibXMLCallbacks(docLoader);        
-    xmlSetGenericErrorFunc(0, errorFunc);
-    
+    XMLTokenizerScope scope(docLoader, errorFunc, 0);
     xmlDocPtr sourceDoc = xmlReadMemory(reinterpret_cast<const char*>(source.characters()),
                                         source.length() * sizeof(UChar),
                                         url.latin1().data(),
                                         BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE", 
                                         XSLT_PARSE_OPTIONS);
-    
-    setLoaderForLibXMLCallbacks(0);
-    xmlSetGenericErrorFunc(oldErrorContext, oldErrorFunc);
-    
     return sourceDoc;
 }
 #endif
@@ -1295,7 +1371,8 @@
 
     XMLTokenizer tokenizer(fragment, parent);
     
-    tokenizer.initializeParserContext(chunk.utf8().data());
+    CString chunkAsUtf8 = chunk.utf8();
+    tokenizer.initializeParserContext(chunkAsUtf8.data());
 
     xmlParseContent(tokenizer.m_context);
 
@@ -1303,7 +1380,7 @@
 
     // Check if all the chunk has been processed.
     long bytesProcessed = xmlByteConsumed(tokenizer.m_context);
-    if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) == sizeof(UChar) * chunk.length())
+    if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) != chunkAsUtf8.length())
         return false;
 
     // No error if the chunk is well formed or it is not but we have no error.
diff --git a/WebCore/dom/XMLTokenizerQt.cpp b/WebCore/dom/XMLTokenizerQt.cpp
index 68bc17b..3173708 100644
--- a/WebCore/dom/XMLTokenizerQt.cpp
+++ b/WebCore/dom/XMLTokenizerQt.cpp
@@ -5,7 +5,7 @@
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Holger Hans Peter Freyther
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -56,6 +56,11 @@
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
 
+#if ENABLE(XHTMLMP)
+#include "HTMLNames.h"
+#include "HTMLScriptElement.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -85,6 +90,10 @@
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -110,6 +119,10 @@
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -141,7 +154,7 @@
     
 #if QT_VERSION < 0x040400
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedAttrMap* attrs = element->attributes()) {
+        if (NamedNodeMap* attrs = element->attributes()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
                 if (attr->localName() == "xmlns")
@@ -154,7 +167,7 @@
 #else
     QXmlStreamNamespaceDeclarations namespaces;
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedAttrMap* attrs = element->attributes()) {
+        if (NamedNodeMap* attrs = element->attributes()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
                 if (attr->localName() == "xmlns")
@@ -419,6 +432,12 @@
         }
             break;
         case QXmlStreamReader::StartElement: {
+#if ENABLE(XHTMLMP)
+            if (m_doc->isXHTMLMPDocument() && !m_hasDocTypeDeclaration) {
+                handleError(fatal, "DOCTYPE declaration lost.", lineNumber(), columnNumber());
+                break;
+            }
+#endif 
             parseStartElement();
         }
             break;
@@ -443,12 +462,18 @@
         case QXmlStreamReader::DTD: {
             //qDebug()<<"------------- DTD";
             parseDtd();
+#if ENABLE(XHTMLMP)
+            m_hasDocTypeDeclaration = true;
+#endif
         }
             break;
         case QXmlStreamReader::EntityReference: {
             //qDebug()<<"---------- ENTITY = "<<m_stream.name().toString()
             //        <<", t = "<<m_stream.text().toString();
             if (isXHTMLDocument()
+#if ENABLE(XHTMLMP)
+                || isXHTMLMPDocument()
+#endif
 #if ENABLE(WML)
                 || isWMLDocument()
 #endif
@@ -508,9 +533,6 @@
         return;
     }
 
-    bool isFirstElement = !m_sawFirstElement;
-    m_sawFirstElement = true;
-
     exitText();
 
     String localName = m_stream.name();
@@ -529,6 +551,28 @@
         return;
     }
 
+#if ENABLE(XHTMLMP)
+    if (!m_sawFirstElement && isXHTMLMPDocument()) {
+        // As per 7.1 section of OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf, 
+        // we should make sure that the root element MUST be 'html' and 
+        // ensure the name of the default namespace on the root elment 'html' 
+        // MUST be 'http://www.w3.org/1999/xhtml'
+        if (localName != HTMLNames::htmlTag.localName()) {
+            handleError(fatal, "XHTMLMP document expects 'html' as root element.", lineNumber(), columnNumber());
+            return;
+        } 
+
+        if (uri.isNull()) {
+            m_defaultNamespaceURI = HTMLNames::xhtmlNamespaceURI; 
+            uri = m_defaultNamespaceURI;
+            m_stream.addExtraNamespaceDeclaration(QXmlStreamNamespaceDeclaration(prefix, HTMLNames::xhtmlNamespaceURI));
+        }
+    }
+#endif
+
+    bool isFirstElement = !m_sawFirstElement;
+    m_sawFirstElement = true;
+
     ExceptionCode ec = 0;
     handleElementNamespaces(newElement.get(), m_stream.namespaceDeclarations(), ec);
     if (ec) {
@@ -583,22 +627,28 @@
     ASSERT(!m_pendingScript);
     m_requestingScript = true;
 
-    String scriptHref = scriptElement->sourceAttributeValue();
-    if (!scriptHref.isEmpty()) {
-        // we have a src attribute 
-        String scriptCharset = scriptElement->scriptCharset();
-        if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
-            m_scriptElement = element;
-            m_pendingScript->addClient(this);
+#if ENABLE(XHTMLMP)
+    if (!scriptElement->shouldExecuteAsJavaScript())
+        m_doc->setShouldProcessNoscriptElement(true);
+    else
+#endif
+    {
+        String scriptHref = scriptElement->sourceAttributeValue();
+        if (!scriptHref.isEmpty()) {
+            // we have a src attribute 
+            String scriptCharset = scriptElement->scriptCharset();
+            if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
+                m_scriptElement = element;
+                m_pendingScript->addClient(this);
 
-            // m_pendingScript will be 0 if script was already loaded and ref() executed it
-            if (m_pendingScript)
-                pauseParsing();
-        } else 
-            m_scriptElement = 0;
-    } else
-        m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
-
+                // m_pendingScript will be 0 if script was already loaded and ref() executed it
+                if (m_pendingScript)
+                    pauseParsing();
+            } else 
+                m_scriptElement = 0;
+        } else
+            m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
+    }
     m_requestingScript = false;
     setCurrentNode(parent.get());
 }
@@ -662,6 +712,9 @@
 
 void XMLTokenizer::endDocument()
 {
+#if ENABLE(XHTMLMP)
+    m_hasDocTypeDeclaration = false;
+#endif
 }
 
 bool XMLTokenizer::hasError() const
@@ -755,9 +808,25 @@
         || (publicId == QLatin1String("-//W3C//DTD XHTML Basic 1.0//EN"))
         || (publicId == QLatin1String("-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN"))
         || (publicId == QLatin1String("-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN"))
-        || (publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))) {
+#if !ENABLE(XHTMLMP)
+        || (publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))
+#endif
+       )
         setIsXHTMLDocument(true); // controls if we replace entities or not.
+#if ENABLE(XHTMLMP)
+    else if ((publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.1//EN"))
+             || (publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))) {
+        if (AtomicString(name) != HTMLNames::htmlTag.localName()) {
+            handleError(fatal, "Invalid DOCTYPE declaration, expected 'html' as root element.", lineNumber(), columnNumber());
+            return;
+        } 
+
+        if (m_doc->isXHTMLMPDocument()) // check if the MIME type is correct with this method
+            setIsXHTMLMPDocument(true);
+        else
+            setIsXHTMLDocument(true);
     }
+#endif
 #if ENABLE(WML)
     else if (m_doc->isWMLDocument()
              && publicId != QLatin1String("-//WAPFORUM//DTD WML 1.3//EN")
@@ -772,4 +841,3 @@
 }
 }
 
-
diff --git a/WebCore/dom/XMLTokenizerScope.cpp b/WebCore/dom/XMLTokenizerScope.cpp
new file mode 100644
index 0000000..3769f59
--- /dev/null
+++ b/WebCore/dom/XMLTokenizerScope.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "XMLTokenizerScope.h"
+
+namespace WebCore {
+
+DocLoader* XMLTokenizerScope::currentDocLoader = 0;
+
+XMLTokenizerScope::XMLTokenizerScope(DocLoader* docLoader)
+    : m_oldDocLoader(currentDocLoader)
+#if ENABLE(XSLT)
+    , m_oldGenericErrorFunc(xmlGenericError)
+    , m_oldStructuredErrorFunc(xmlStructuredError)
+    , m_oldErrorContext(xmlGenericErrorContext)
+#endif
+{
+    currentDocLoader = docLoader;
+}
+
+#if ENABLE(XSLT)
+XMLTokenizerScope::XMLTokenizerScope(DocLoader* docLoader, xmlGenericErrorFunc genericErrorFunc, xmlStructuredErrorFunc structuredErrorFunc, void* errorContext)
+    : m_oldDocLoader(currentDocLoader)
+    , m_oldGenericErrorFunc(xmlGenericError)
+    , m_oldStructuredErrorFunc(xmlStructuredError)
+    , m_oldErrorContext(xmlGenericErrorContext)
+{
+    currentDocLoader = docLoader;
+    if (genericErrorFunc)
+        xmlSetGenericErrorFunc(errorContext, genericErrorFunc);
+    if (structuredErrorFunc)
+        xmlSetStructuredErrorFunc(errorContext, structuredErrorFunc);
+}
+#endif
+
+XMLTokenizerScope::~XMLTokenizerScope()
+{
+    currentDocLoader = m_oldDocLoader;
+#if ENABLE(XSLT)
+    xmlSetGenericErrorFunc(m_oldErrorContext, m_oldGenericErrorFunc);
+    xmlSetStructuredErrorFunc(m_oldErrorContext, m_oldStructuredErrorFunc);
+#endif
+}
+
+}
diff --git a/WebCore/page/chromium/AccessibilityObjectWrapper.h b/WebCore/dom/XMLTokenizerScope.h
similarity index 61%
copy from WebCore/page/chromium/AccessibilityObjectWrapper.h
copy to WebCore/dom/XMLTokenizerScope.h
index 6420b32..a3c1188 100644
--- a/WebCore/page/chromium/AccessibilityObjectWrapper.h
+++ b/WebCore/dom/XMLTokenizerScope.h
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- * Copyright (C) 2008 Google Inc.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,31 +23,40 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef AccessibilityObjectWrapper_h
-#define AccessibilityObjectWrapper_h
+#ifndef XMLTokenizerScope_h
+#define XMLTokenizerScope_h
+
+#include <wtf/Noncopyable.h>
+
+#if ENABLE(XSLT)
+#include <libxml/tree.h>
+#endif
 
 namespace WebCore {
 
-    class AccessibilityObject;
-    class AccessibilityObjectWrapper : public RefCounted<AccessibilityObjectWrapper> {
+    class DocLoader;
+
+    class XMLTokenizerScope : Noncopyable {
     public:
-        virtual ~AccessibilityObjectWrapper() {}
-        virtual void detach() = 0;
-        bool attached() const { return m_object; }
-        AccessibilityObject* accessibilityObject() const { return m_object; }
+        XMLTokenizerScope(DocLoader* docLoader);
+        ~XMLTokenizerScope();
 
-    protected:
-        AccessibilityObjectWrapper(AccessibilityObject* obj)
-            : m_object(obj)
-        {
-            // FIXME: Remove this once our immediate subclass no longer uses COM.
-            m_refCount = 0;
-        }
-        AccessibilityObjectWrapper() : m_object(0) { }
+        static DocLoader* currentDocLoader;
 
-        AccessibilityObject* m_object;
+#if ENABLE(XSLT)
+        XMLTokenizerScope(DocLoader* docLoader, xmlGenericErrorFunc genericErrorFunc, xmlStructuredErrorFunc structuredErrorFunc = 0, void* errorContext = 0);
+#endif
+
+    private:
+        DocLoader* m_oldDocLoader;
+
+#if ENABLE(XSLT)
+        xmlGenericErrorFunc m_oldGenericErrorFunc;
+        xmlStructuredErrorFunc m_oldStructuredErrorFunc;
+        void* m_oldErrorContext;
+#endif
     };
 
 } // namespace WebCore
 
-#endif
+#endif // XMLTokenizerScope_h
diff --git a/WebCore/dom/make_names.pl b/WebCore/dom/make_names.pl
index f2a7a76..12f0ec7 100755
--- a/WebCore/dom/make_names.pl
+++ b/WebCore/dom/make_names.pl
@@ -2,6 +2,7 @@
 
 # Copyright (C) 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
 # Copyright (C) 2009, Julien Chaffraix <jchaffraix@webkit.org>
+# Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -94,7 +95,8 @@
             # By default, the JSInterfaceName is the same as the interfaceName.
             'JSInterfaceName' => defaultInterfaceName($_[0]),
             'mapToTagName' => '',
-            'wrapperOnlyIfMediaIsAvailable' => 0);
+            'wrapperOnlyIfMediaIsAvailable' => 0,
+            'conditional' => 0);
 }
 
 sub initializeAttrPropertyHash
@@ -311,8 +313,18 @@
 
         $uniqueTags{$interfaceName} = '1';
 
+        my $conditional = $tags{$tagName}{"conditional"};
+        if ($conditional) {
+            my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+            print F "#if ${conditionalString}\n\n";
+        }
+
         printConstructorSignature($F, $tagName, $tagConstructorMap{$tagName}, "tagName");
         printConstructorInterior($F, $tagName, $interfaceName, "tagName");
+
+        if ($conditional) {
+            print F "#endif\n\n";
+        }
     }
 
     # Mapped tag name uses a special wrapper to keep their prefix and namespaceURI while using the mapped localname.
@@ -333,11 +345,22 @@
     my %tagConstructorMap = %$tagConstructorMap;
 
     for my $tagName (sort keys %tagConstructorMap) {
+
+        my $conditional = $tags{$tagName}{"conditional"};
+        if ($conditional) {
+            my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+            print F "#if ${conditionalString}\n";
+        }
+
         if ($tags{$tagName}{'mapToTagName'}) {
             print F "    addTag(${tagName}Tag, $tags{$tagName}{'mapToTagName'}To${tagName}Constructor);\n";
         } else {
             print F "    addTag(${tagName}Tag, $tagConstructorMap{$tagName}Constructor);\n";
         }
+
+        if ($conditional) {
+            print F "#endif\n\n";
+        }
     }
 }
 
@@ -831,7 +854,7 @@
     my $name = shift;
 
     # A tag reuses the default wrapper if its JSInterfaceName matches the default namespace Element.
-    return $tags{$name}{'JSInterfaceName'} eq $parameters{"namespace"} . "Element";
+    return $tags{$name}{'JSInterfaceName'} eq $parameters{"namespace"} . "Element" || $tags{$name}{'JSInterfaceName'} eq "HTMLNoScriptElement";
 }
 
 sub printWrapperFunctions
@@ -845,6 +868,12 @@
         next if defined($tagsSeen{$JSInterfaceName}) || usesDefaultJSWrapper($tagName);
         $tagsSeen{$JSInterfaceName} = 1;
 
+        my $conditional = $tags{$tagName}{"conditional"};
+        if ($conditional) {
+            my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+            print F "#if ${conditionalString}\n\n";
+        }
+
         # Hack for the media tags
         if ($tags{$tagName}{"wrapperOnlyIfMediaIsAvailable"}) {
             print F <<END
@@ -867,6 +896,9 @@
 END
 ;
         }
+        if ($conditional) {
+            print F "#endif\n\n";
+        }
     }
 }
 
@@ -919,8 +951,18 @@
         # Do not add the name to the map if it does not have a JS wrapper constructor or uses the default wrapper.
         next if usesDefaultJSWrapper($tag, \%tags);
 
+        my $conditional = $tags{$tag}{"conditional"};
+        if ($conditional) {
+            my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+            print F "#if ${conditionalString}\n";
+        }
+
         my $ucTag = $tags{$tag}{"JSInterfaceName"};
         print F "       map.set(${tag}Tag.localName().impl(), create${ucTag}Wrapper);\n";
+
+        if ($conditional) {
+            print F "#endif\n";
+        }
     }
 
     print F <<END
diff --git a/WebCore/editing/ApplyStyleCommand.cpp b/WebCore/editing/ApplyStyleCommand.cpp
index d43cc81..8d0312b 100644
--- a/WebCore/editing/ApplyStyleCommand.cpp
+++ b/WebCore/editing/ApplyStyleCommand.cpp
@@ -27,6 +27,7 @@
 #include "ApplyStyleCommand.h"
 
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSParser.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
@@ -228,7 +229,11 @@
 {
     ASSERT(pos.isNotNull());
     RefPtr<CSSComputedStyleDeclaration> style = pos.computedStyle();
-    RefPtr<CSSValue> value = style->getPropertyCSSValue(property->id(), DoNotUpdateLayout);
+    RefPtr<CSSValue> value;
+    if (property->id() == CSSPropertyFontSize)
+        value = style->getFontSizeCSSValuePreferringKeyword();
+    else
+        value = style->getPropertyCSSValue(property->id(), DoNotUpdateLayout);
     if (!value)
         return false;
     return equalIgnoringCase(value->cssText(), property->value()->cssText());
@@ -256,7 +261,7 @@
 
     const HTMLElement* elem = static_cast<const HTMLElement*>(node);
     CSSMutableStyleDeclaration* inlineStyleDecl = elem->inlineStyleDecl();
-    return (!inlineStyleDecl || inlineStyleDecl->length() == 0) && elem->getAttribute(classAttr) == styleSpanClassString();
+    return (!inlineStyleDecl || inlineStyleDecl->isEmpty()) && elem->getAttribute(classAttr) == styleSpanClassString();
 }
 
 static bool isSpanWithoutAttributesOrUnstyleStyleSpan(const Node* node)
@@ -265,8 +270,8 @@
         return false;
 
     const HTMLElement* elem = static_cast<const HTMLElement*>(node);
-    NamedAttrMap* attributes = elem->attributes(true); // readonly
-    if (attributes->length() == 0)
+    NamedNodeMap* attributes = elem->attributes(true); // readonly
+    if (attributes->isEmpty())
         return true;
 
     return isUnstyledStyleSpan(node);
@@ -278,7 +283,7 @@
         return false;
 
     const Element *elem = static_cast<const Element *>(node);
-    NamedAttrMap *map = elem->attributes(true); // true for read-only
+    NamedNodeMap *map = elem->attributes(true); // true for read-only
     return (!map || map->length() == 1) && elem->getAttribute(classAttr) == styleSpanClassString();
 }
 
@@ -337,7 +342,7 @@
 
 void ApplyStyleCommand::updateStartEnd(const Position& newStart, const Position& newEnd)
 {
-    ASSERT(Range::compareBoundaryPoints(newEnd, newStart) >= 0);
+    ASSERT(comparePositions(newEnd, newStart) >= 0);
 
     if (!m_useEndingSelection && (newStart != m_start || newEnd != m_end))
         m_useEndingSelection = true;
@@ -403,7 +408,7 @@
     // get positions we want to use for applying style
     Position start = startPosition();
     Position end = endPosition();
-    if (Range::compareBoundaryPoints(end, start) < 0) {
+    if (comparePositions(end, start) < 0) {
         Position swap = start;
         start = end;
         end = swap;
@@ -426,7 +431,7 @@
     VisiblePosition beyondEnd(endOfParagraph(visibleEnd).next());
     while (paragraphStart.isNotNull() && paragraphStart != beyondEnd) {
         StyleChange styleChange(style, paragraphStart.deepEquivalent());
-        if (styleChange.cssStyle().length() > 0 || m_removeOnly) {
+        if (styleChange.cssStyle().length() || m_removeOnly) {
             RefPtr<Node> block = enclosingBlock(paragraphStart.deepEquivalent().node());
             RefPtr<Node> newBlock = moveParagraphContentsToNewBlockIfNecessary(paragraphStart.deepEquivalent());
             if (newBlock)
@@ -479,7 +484,7 @@
     
     Position start = startPosition();
     Position end = endPosition();
-    if (Range::compareBoundaryPoints(end, start) < 0) {
+    if (comparePositions(end, start) < 0) {
         Position swap = start;
         start = end;
         end = swap;
@@ -520,7 +525,7 @@
     
     start = start.upstream(); // Move upstream to ensure we do not add redundant spans.
     Node *startNode = start.node();
-    if (startNode->isTextNode() && start.m_offset >= caretMaxOffset(startNode)) // Move out of text node if range does not include its characters.
+    if (startNode->isTextNode() && start.deprecatedEditingOffset() >= caretMaxOffset(startNode)) // Move out of text node if range does not include its characters.
         startNode = startNode->traverseNextNode();
 
     // Store away font size before making any changes to the document.
@@ -564,7 +569,7 @@
             inlineStyleDecl->setProperty(CSSPropertyFontSize, String::number(desiredFontSize) + "px", false, false);
             setNodeAttribute(element.get(), styleAttr, inlineStyleDecl->cssText());
         }
-        if (inlineStyleDecl->length() == 0) {
+        if (inlineStyleDecl->isEmpty()) {
             removeNodeAttribute(element.get(), styleAttr);
             // FIXME: should this be isSpanWithoutAttributesOrUnstyleStyleSpan?  Need a test.
             if (isUnstyledStyleSpan(element.get()))
@@ -714,7 +719,7 @@
     // adjust to the positions we want to use for applying style
     Position start = startPosition();
     Position end = endPosition();
-    if (Range::compareBoundaryPoints(end, start) < 0) {
+    if (comparePositions(end, start) < 0) {
         Position swap = start;
         start = end;
         end = swap;
@@ -775,7 +780,7 @@
         RefPtr<CSSMutableStyleDeclaration> embeddingStyle = CSSMutableStyleDeclaration::create();
         embeddingStyle->setProperty(CSSPropertyUnicodeBidi, CSSValueEmbed);
         embeddingStyle->setProperty(CSSPropertyDirection, static_cast<CSSPrimitiveValue*>(direction.get())->getIdent());
-        if (Range::compareBoundaryPoints(embeddingRemoveStart, embeddingRemoveEnd) <= 0)
+        if (comparePositions(embeddingRemoveStart, embeddingRemoveEnd) <= 0)
             removeInlineStyle(embeddingStyle, embeddingRemoveStart, embeddingRemoveEnd);
 
         RefPtr<CSSMutableStyleDeclaration> styleWithoutEmbedding = style->copy();
@@ -868,17 +873,17 @@
 
     bool rangeIsEmpty = false;
 
-    if (start.m_offset >= caretMaxOffset(start.node())) {
+    if (start.deprecatedEditingOffset() >= caretMaxOffset(start.node())) {
         node = node->traverseNextNode();
         Position newStart = Position(node, 0);
-        if (!node || Range::compareBoundaryPoints(end, newStart) < 0)
+        if (!node || comparePositions(end, newStart) < 0)
             rangeIsEmpty = true;
     }
 
     if (!rangeIsEmpty) {
         // pastEndNode is the node after the last fully selected node.
         Node* pastEndNode = end.node();
-        if (end.m_offset >= caretMaxOffset(end.node()))
+        if (end.deprecatedEditingOffset() >= caretMaxOffset(end.node()))
             pastEndNode = end.node()->traverseNextSibling();
         // FIXME: Callers should perform this operation on a Range that includes the br
         // if they want style applied to the empty line.
@@ -896,7 +901,7 @@
                 // This is a plaintext-only region. Only proceed if it's fully selected.
                 // pastEndNode is the node after the last fully selected node, so if it's inside node then
                 // node isn't fully selected.
-                if (pastEndNode->isDescendantOf(node))
+                if (pastEndNode && pastEndNode->isDescendantOf(node))
                     break;
                 // Add to this element's inline style and skip over its contents.
                 HTMLElement* element = static_cast<HTMLElement*>(node);
@@ -935,11 +940,14 @@
 
 // This function maps from styling tags to CSS styles.  Used for knowing which
 // styling tags should be removed when toggling styles.
-bool ApplyStyleCommand::isHTMLStyleNode(CSSMutableStyleDeclaration* style, HTMLElement* elem)
+bool ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement* elem, CSSMutableStyleDeclaration* style)
 {
     CSSMutableStyleDeclaration::const_iterator end = style->end();
     for (CSSMutableStyleDeclaration::const_iterator it = style->begin(); it != end; ++it) {
-        switch ((*it).id()) {
+        const CSSProperty& property = *it;
+        // FIXME: This should probably be re-written to lookup the tagname in a
+        // hash and match against an expected property/value pair.
+        switch (property.id()) {
         case CSSPropertyFontWeight:
             // IE inserts "strong" tags for execCommand("bold"), so we remove them, even though they're not strictly presentational
             if (elem->hasLocalName(bTag) || elem->hasLocalName(strongTag))
@@ -953,20 +961,34 @@
             // IE inserts "em" tags for execCommand("italic"), so we remove them, even though they're not strictly presentational
             if (elem->hasLocalName(iTag) || elem->hasLocalName(emTag))
                 return true;
+            break;
         }
     }
-
     return false;
 }
 
-void ApplyStyleCommand::removeHTMLStyleNode(HTMLElement *elem)
+void ApplyStyleCommand::replaceWithSpanOrRemoveIfWithoutAttributes(HTMLElement*& elem)
 {
-    // This node can be removed.
-    // EDIT FIXME: This does not handle the case where the node
-    // has attributes. But how often do people add attributes to <B> tags? 
-    // Not so often I think.
-    ASSERT(elem);
-    removeNodePreservingChildren(elem);
+    bool removeNode = false;
+
+    // Similar to isSpanWithoutAttributesOrUnstyleStyleSpan, but does not look for Apple-style-span.
+    NamedNodeMap* attributes = elem->attributes(true); // readonly
+    if (!attributes || attributes->isEmpty())
+        removeNode = true;
+    else if (attributes->length() == 1 && elem->hasAttribute(styleAttr)) {
+        // Remove the element even if it has just style='' (this might be redundantly checked later too)
+        CSSMutableStyleDeclaration* inlineStyleDecl = elem->inlineStyleDecl();
+        if (!inlineStyleDecl || inlineStyleDecl->isEmpty())
+            removeNode = true;
+    }
+
+    if (removeNode)
+        removeNodePreservingChildren(elem);
+    else {
+        HTMLElement* newSpanElement = replaceNodeWithSpanPreservingChildrenAndAttributes(elem);
+        ASSERT(newSpanElement && newSpanElement->inDocument());
+        elem = newSpanElement;
+    }
 }
 
 void ApplyStyleCommand::removeHTMLFontStyle(CSSMutableStyleDeclaration *style, HTMLElement *elem)
@@ -1035,7 +1057,7 @@
     }
 
     // No need to serialize <foo style=""> if we just removed the last css property
-    if (decl->length() == 0)
+    if (decl->isEmpty())
         removeNodeAttribute(elem, styleAttr);
 
     if (isSpanWithoutAttributesOrUnstyleStyleSpan(elem))
@@ -1116,7 +1138,7 @@
 {
     ASSERT(node);
 
-    if (!style || !style->cssText().length())
+    if (!style || style->cssText().isEmpty())
         return;
 
     if (node->isTextNode()) {
@@ -1131,7 +1153,7 @@
     HTMLElement *element = static_cast<HTMLElement *>(node);
         
     StyleChange styleChange(style, Position(element, 0));
-    if (styleChange.cssStyle().length() > 0) {
+    if (styleChange.cssStyle().length()) {
         String cssText = styleChange.cssStyle();
         CSSMutableStyleDeclaration *decl = element->inlineStyleDecl();
         if (decl)
@@ -1203,7 +1225,7 @@
     ASSERT(end.isNotNull());
     ASSERT(start.node()->inDocument());
     ASSERT(end.node()->inDocument());
-    ASSERT(Range::compareBoundaryPoints(start, end) <= 0);
+    ASSERT(comparePositions(start, end) <= 0);
     
     RefPtr<CSSValue> textDecorationSpecialProperty = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
 
@@ -1228,9 +1250,13 @@
             Node* next = elem->traverseNextNode();
             if (m_styledInlineElement && elem->hasTagName(m_styledInlineElement->tagQName()))
                 removeNodePreservingChildren(elem);
-            if (isHTMLStyleNode(style.get(), elem))
-                removeHTMLStyleNode(elem);
-            else {
+
+            if (implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(elem, style.get()))
+                replaceWithSpanOrRemoveIfWithoutAttributes(elem);
+
+            // If the node was converted to a span, the span may still contain relevant
+            // styles which must be removed (e.g. <b style='font-weight: bold'>)
+            if (elem->inDocument()) {
                 removeHTMLFontStyle(style.get(), elem);
                 removeHTMLBidiEmbeddingStyle(style.get(), elem);
                 removeCSSStyle(style.get(), elem);
@@ -1239,14 +1265,14 @@
                 if (s.node() == elem) {
                     // Since elem must have been fully selected, and it is at the start
                     // of the selection, it is clear we can set the new s offset to 0.
-                    ASSERT(s.m_offset <= caretMinOffset(s.node()));
+                    ASSERT(s.deprecatedEditingOffset() <= caretMinOffset(s.node()));
                     s = Position(next, 0);
                 }
                 if (e.node() == elem) {
                     // Since elem must have been fully selected, and it is at the end
                     // of the selection, it is clear we can set the new e offset to
                     // the max range offset of prev.
-                    ASSERT(e.m_offset >= maxRangeOffset(e.node()));
+                    ASSERT(e.deprecatedEditingOffset() >= maxRangeOffset(e.node()));
                     e = Position(prev, maxRangeOffset(prev));
                 }
             }
@@ -1267,8 +1293,7 @@
     ASSERT(node->isElementNode());
 
     Position pos = Position(node, node->childNodeCount()).upstream();
-    return Range::compareBoundaryPoints(node, 0, start.node(), start.m_offset) >= 0 &&
-        Range::compareBoundaryPoints(pos, end) <= 0;
+    return comparePositions(Position(node, 0), start) >= 0 && comparePositions(pos, end) <= 0;
 }
 
 bool ApplyStyleCommand::nodeFullyUnselected(Node *node, const Position &start, const Position &end) const
@@ -1277,8 +1302,8 @@
     ASSERT(node->isElementNode());
 
     Position pos = Position(node, node->childNodeCount()).upstream();
-    bool isFullyBeforeStart = Range::compareBoundaryPoints(pos, start) < 0;
-    bool isFullyAfterEnd = Range::compareBoundaryPoints(node, 0, end.node(), end.m_offset) > 0;
+    bool isFullyBeforeStart = comparePositions(pos, start) < 0;
+    bool isFullyAfterEnd = comparePositions(Position(node, 0), end) > 0;
 
     return isFullyBeforeStart || isFullyAfterEnd;
 }
@@ -1286,11 +1311,11 @@
 
 bool ApplyStyleCommand::splitTextAtStartIfNeeded(const Position &start, const Position &end)
 {
-    if (start.node()->isTextNode() && start.m_offset > caretMinOffset(start.node()) && start.m_offset < caretMaxOffset(start.node())) {
-        int endOffsetAdjustment = start.node() == end.node() ? start.m_offset : 0;
+    if (start.node()->isTextNode() && start.deprecatedEditingOffset() > caretMinOffset(start.node()) && start.deprecatedEditingOffset() < caretMaxOffset(start.node())) {
+        int endOffsetAdjustment = start.node() == end.node() ? start.deprecatedEditingOffset() : 0;
         Text *text = static_cast<Text *>(start.node());
-        splitTextNode(text, start.m_offset);
-        updateStartEnd(Position(start.node(), 0), Position(end.node(), end.m_offset - endOffsetAdjustment));
+        splitTextNode(text, start.deprecatedEditingOffset());
+        updateStartEnd(Position(start.node(), 0), Position(end.node(), end.deprecatedEditingOffset() - endOffsetAdjustment));
         return true;
     }
     return false;
@@ -1298,15 +1323,15 @@
 
 bool ApplyStyleCommand::splitTextAtEndIfNeeded(const Position &start, const Position &end)
 {
-    if (end.node()->isTextNode() && end.m_offset > caretMinOffset(end.node()) && end.m_offset < caretMaxOffset(end.node())) {
+    if (end.node()->isTextNode() && end.deprecatedEditingOffset() > caretMinOffset(end.node()) && end.deprecatedEditingOffset() < caretMaxOffset(end.node())) {
         Text *text = static_cast<Text *>(end.node());
-        splitTextNode(text, end.m_offset);
+        splitTextNode(text, end.deprecatedEditingOffset());
         
         Node *prevNode = text->previousSibling();
         ASSERT(prevNode);
         Node *startNode = start.node() == end.node() ? prevNode : start.node();
         ASSERT(startNode);
-        updateStartEnd(Position(startNode, start.m_offset), Position(prevNode, caretMaxOffset(prevNode)));
+        updateStartEnd(Position(startNode, start.deprecatedEditingOffset()), Position(prevNode, caretMaxOffset(prevNode)));
         return true;
     }
     return false;
@@ -1314,12 +1339,12 @@
 
 bool ApplyStyleCommand::splitTextElementAtStartIfNeeded(const Position &start, const Position &end)
 {
-    if (start.node()->isTextNode() && start.m_offset > caretMinOffset(start.node()) && start.m_offset < caretMaxOffset(start.node())) {
-        int endOffsetAdjustment = start.node() == end.node() ? start.m_offset : 0;
+    if (start.node()->isTextNode() && start.deprecatedEditingOffset() > caretMinOffset(start.node()) && start.deprecatedEditingOffset() < caretMaxOffset(start.node())) {
+        int endOffsetAdjustment = start.node() == end.node() ? start.deprecatedEditingOffset() : 0;
         Text *text = static_cast<Text *>(start.node());
-        splitTextNodeContainingElement(text, start.m_offset);
+        splitTextNodeContainingElement(text, start.deprecatedEditingOffset());
 
-        updateStartEnd(Position(start.node()->parentNode(), start.node()->nodeIndex()), Position(end.node(), end.m_offset - endOffsetAdjustment));
+        updateStartEnd(Position(start.node()->parentNode(), start.node()->nodeIndex()), Position(end.node(), end.deprecatedEditingOffset() - endOffsetAdjustment));
         return true;
     }
     return false;
@@ -1327,15 +1352,15 @@
 
 bool ApplyStyleCommand::splitTextElementAtEndIfNeeded(const Position &start, const Position &end)
 {
-    if (end.node()->isTextNode() && end.m_offset > caretMinOffset(end.node()) && end.m_offset < caretMaxOffset(end.node())) {
+    if (end.node()->isTextNode() && end.deprecatedEditingOffset() > caretMinOffset(end.node()) && end.deprecatedEditingOffset() < caretMaxOffset(end.node())) {
         Text *text = static_cast<Text *>(end.node());
-        splitTextNodeContainingElement(text, end.m_offset);
+        splitTextNodeContainingElement(text, end.deprecatedEditingOffset());
 
         Node *prevNode = text->parent()->previousSibling()->lastChild();
         ASSERT(prevNode);
         Node *startNode = start.node() == end.node() ? prevNode : start.node();
         ASSERT(startNode);
-        updateStartEnd(Position(startNode, start.m_offset), Position(prevNode->parent(), prevNode->nodeIndex() + 1));
+        updateStartEnd(Position(startNode, start.deprecatedEditingOffset()), Position(prevNode->parent(), prevNode->nodeIndex() + 1));
         return true;
     }
     return false;
@@ -1357,8 +1382,8 @@
     if (!firstElement->tagQName().matches(secondElement->tagQName()))
         return false;
 
-    NamedAttrMap *firstMap = firstElement->attributes();
-    NamedAttrMap *secondMap = secondElement->attributes();
+    NamedNodeMap *firstMap = firstElement->attributes();
+    NamedNodeMap *secondMap = secondElement->attributes();
 
     unsigned firstLength = firstMap->length();
 
@@ -1379,10 +1404,10 @@
 bool ApplyStyleCommand::mergeStartWithPreviousIfIdentical(const Position &start, const Position &end)
 {
     Node *startNode = start.node();
-    int startOffset = start.m_offset;
+    int startOffset = start.deprecatedEditingOffset();
 
     if (isAtomicNode(start.node())) {
-        if (start.m_offset != 0)
+        if (start.deprecatedEditingOffset() != 0)
             return false;
 
         // note: prior siblings could be unrendered elements. it's silly to miss the
@@ -1411,7 +1436,7 @@
 
         int startOffsetAdjustment = startChild->nodeIndex();
         int endOffsetAdjustment = startNode == end.node() ? startOffsetAdjustment : 0;
-        updateStartEnd(Position(startNode, startOffsetAdjustment), Position(end.node(), end.m_offset + endOffsetAdjustment)); 
+        updateStartEnd(Position(startNode, startOffsetAdjustment), Position(end.node(), end.deprecatedEditingOffset() + endOffsetAdjustment)); 
         return true;
     }
 
@@ -1421,7 +1446,7 @@
 bool ApplyStyleCommand::mergeEndWithNextIfIdentical(const Position &start, const Position &end)
 {
     Node *endNode = end.node();
-    int endOffset = end.m_offset;
+    int endOffset = end.deprecatedEditingOffset();
 
     if (isAtomicNode(endNode)) {
         if (endOffset < caretMaxOffset(endNode))
@@ -1451,7 +1476,7 @@
         ASSERT(startNode);
 
         int endOffset = nextChild ? nextChild->nodeIndex() : nextElement->childNodes()->length();
-        updateStartEnd(Position(startNode, start.m_offset), Position(nextElement, endOffset));
+        updateStartEnd(Position(startNode, start.deprecatedEditingOffset()), Position(nextElement, endOffset));
         return true;
     }
 
@@ -1554,7 +1579,7 @@
         }
     }
 
-    if (styleChange.cssStyle().length() > 0) {
+    if (styleChange.cssStyle().length()) {
         RefPtr<Element> styleElement = createStyleSpanElement(document());
         styleElement->setAttribute(styleAttr, styleChange.cssStyle());
         surroundNodeRangeWithElement(startNode, endNode, styleElement.release());
@@ -1607,9 +1632,9 @@
             Text *childText = static_cast<Text *>(child);
             Text *nextText = static_cast<Text *>(next);
             if (next == start.node())
-                newStart = Position(childText, childText->length() + start.m_offset);
+                newStart = Position(childText, childText->length() + start.deprecatedEditingOffset());
             if (next == end.node())
-                newEnd = Position(childText, childText->length() + end.m_offset);
+                newEnd = Position(childText, childText->length() + end.deprecatedEditingOffset());
             String textToMove = nextText->data();
             insertTextIntoNode(childText, childText->length(), textToMove);
             removeNode(next);
diff --git a/WebCore/editing/ApplyStyleCommand.h b/WebCore/editing/ApplyStyleCommand.h
index a42225d..74fe605 100644
--- a/WebCore/editing/ApplyStyleCommand.h
+++ b/WebCore/editing/ApplyStyleCommand.h
@@ -62,8 +62,8 @@
     CSSMutableStyleDeclaration* style() const { return m_style.get(); }
 
     // style-removal helpers
-    bool isHTMLStyleNode(CSSMutableStyleDeclaration*, HTMLElement*);
-    void removeHTMLStyleNode(HTMLElement*);
+    bool implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement*, CSSMutableStyleDeclaration*);
+    void replaceWithSpanOrRemoveIfWithoutAttributes(HTMLElement*&);
     void removeHTMLFontStyle(CSSMutableStyleDeclaration*, HTMLElement*);
     void removeHTMLBidiEmbeddingStyle(CSSMutableStyleDeclaration*, HTMLElement*);
     void removeCSSStyle(CSSMutableStyleDeclaration*, HTMLElement*);
diff --git a/WebCore/editing/BreakBlockquoteCommand.cpp b/WebCore/editing/BreakBlockquoteCommand.cpp
index 2a513a5..e3d66ba 100644
--- a/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -26,12 +26,12 @@
 #include "config.h"
 #include "BreakBlockquoteCommand.h"
 
-#include "Element.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "RenderListItem.h"
 #include "Text.h"
 #include "VisiblePosition.h"
 #include "htmlediting.h"
-#include "RenderListItem.h"
 
 namespace WebCore {
 
@@ -56,42 +56,59 @@
     // be in the first node that we need to move (there are a few exceptions to this, see below).
     Position pos = endingSelection().start().downstream();
     
-    // startNode is the first node that we need to move to the new blockquote.
-    Node* startNode = pos.node();
     // Find the top-most blockquote from the start.
     Element* topBlockquote = 0;
-    for (Node *node = startNode->parentNode(); node; node = node->parentNode()) {
+    for (Node *node = pos.node()->parentNode(); node; node = node->parentNode()) {
         if (isMailBlockquote(node))
             topBlockquote = static_cast<Element*>(node);
     }
     if (!topBlockquote || !topBlockquote->parentNode())
         return;
     
-    // Insert a break after the top blockquote.
     RefPtr<Element> breakNode = createBreakElement(document());
-    insertNodeAfter(breakNode.get(), topBlockquote);
-    
-    if (isLastVisiblePositionInNode(visiblePos, topBlockquote)) {
+
+    // If the position is at the beginning of the top quoted content, we don't need to break the quote.
+    // Instead, insert the break before the blockquote.
+    if (isFirstVisiblePositionInNode(visiblePos, topBlockquote)) {
+        insertNodeBefore(breakNode.get(), topBlockquote);
         setEndingSelection(VisibleSelection(Position(breakNode.get(), 0), DOWNSTREAM));
         rebalanceWhitespace();   
         return;
     }
     
+    // Insert a break after the top blockquote.
+    insertNodeAfter(breakNode.get(), topBlockquote);
+    
+    // If we're inserting the break at the end of the quoted content, we don't need to break the quote.
+    if (isLastVisiblePositionInNode(visiblePos, topBlockquote)) {
+        setEndingSelection(VisibleSelection(Position(breakNode.get(), 0), DOWNSTREAM));
+        rebalanceWhitespace();
+        return;
+    }
+    
     // Don't move a line break just after the caret.  Doing so would create an extra, empty paragraph
     // in the new blockquote.
-    if (lineBreakExistsAtPosition(visiblePos))
+    if (lineBreakExistsAtVisiblePosition(visiblePos))
         pos = pos.next();
         
+    // Adjust the position so we don't split at the beginning of a quote.  
+    while (isFirstVisiblePositionInNode(VisiblePosition(pos), nearestMailBlockquote(pos.node())))
+        pos = pos.previous();
+    
+    // startNode is the first node that we need to move to the new blockquote.
+    Node* startNode = pos.node();
+        
     // Split at pos if in the middle of a text node.
     if (startNode->isTextNode()) {
         Text* textNode = static_cast<Text*>(startNode);
-        if ((unsigned)pos.m_offset >= textNode->length()) {
+        if ((unsigned)pos.deprecatedEditingOffset() >= textNode->length()) {
             startNode = startNode->traverseNextNode();
             ASSERT(startNode);
-        } else if (pos.m_offset > 0)
-            splitTextNode(textNode, pos.m_offset);
-    } else if (pos.m_offset > 0) {
-        startNode = startNode->traverseNextNode();
+        } else if (pos.deprecatedEditingOffset() > 0)
+            splitTextNode(textNode, pos.deprecatedEditingOffset());
+    } else if (pos.deprecatedEditingOffset() > 0) {
+        Node* childAtOffset = startNode->childNode(pos.deprecatedEditingOffset());
+        startNode = childAtOffset ? childAtOffset : startNode->traverseNextNode();
         ASSERT(startNode);
     }
     
@@ -141,10 +158,7 @@
         moveNode = next;
     }
 
-    // Hold open startNode's original parent if we emptied it
     if (!ancestors.isEmpty()) {
-        addBlockPlaceholderIfNeeded(ancestors.first());
-
         // Split the tree up the ancestor chain until the topBlockquote
         // Throughout this loop, clonedParent is the clone of ancestor's parent.
         // This is so we can clone ancestor's siblings and place the clones
@@ -162,6 +176,11 @@
                 moveNode = next;
             }
         }
+        
+        // If the startNode's original parent is now empty, remove it
+        Node* originalParent = ancestors.first();
+        if (!originalParent->hasChildNodes())
+            removeNode(originalParent);
     }
     
     // Make sure the cloned block quote renders.
diff --git a/WebCore/editing/CompositeEditCommand.cpp b/WebCore/editing/CompositeEditCommand.cpp
index 9052582..89a0f8a 100644
--- a/WebCore/editing/CompositeEditCommand.cpp
+++ b/WebCore/editing/CompositeEditCommand.cpp
@@ -36,7 +36,7 @@
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "EditorInsertAction.h"
-#include "Element.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "InsertIntoTextNodeCommand.h"
@@ -50,6 +50,7 @@
 #include "RemoveCSSPropertyCommand.h"
 #include "RemoveNodeCommand.h"
 #include "RemoveNodePreservingChildrenCommand.h"
+#include "ReplaceNodeWithSpanCommand.h"
 #include "ReplaceSelectionCommand.h"
 #include "RenderBlock.h"
 #include "RenderText.h"
@@ -157,7 +158,7 @@
     // likewise for replaced elements, brs, etc.
     Position p = rangeCompliantEquivalent(editingPosition);
     Node* refChild = p.node();
-    int offset = p.m_offset;
+    int offset = p.deprecatedEditingOffset();
     
     if (canHaveChildrenForEditing(refChild)) {
         Node* child = refChild->firstChild();
@@ -215,6 +216,20 @@
     prune(parent.release());
 }
 
+HTMLElement* CompositeEditCommand::replaceNodeWithSpanPreservingChildrenAndAttributes(PassRefPtr<Node> node)
+{
+    // It would also be possible to implement all of ReplaceNodeWithSpanCommand
+    // as a series of existing smaller edit commands.  Someone who wanted to
+    // reduce the number of edit commands could do so here.
+    RefPtr<ReplaceNodeWithSpanCommand> command = ReplaceNodeWithSpanCommand::create(node);
+    applyCommandToComposite(command);
+    // Returning a raw pointer here is OK because the command is retained by
+    // applyCommandToComposite (thus retaining the span), and the span is also
+    // in the DOM tree, and thus alive whie it has a parent.
+    ASSERT(command->spanElement()->inDocument());
+    return command->spanElement();
+}
+
 static bool hasARenderedDescendant(Node* node)
 {
     Node* n = node->firstChild();
@@ -327,13 +342,13 @@
     
     Node* tabSpan = tabSpanNode(pos.node());
     
-    if (pos.m_offset <= caretMinOffset(pos.node()))
+    if (pos.deprecatedEditingOffset() <= caretMinOffset(pos.node()))
         return positionBeforeNode(tabSpan);
         
-    if (pos.m_offset >= caretMaxOffset(pos.node()))
+    if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()))
         return positionAfterNode(tabSpan);
 
-    splitTextNodeContainingElement(static_cast<Text *>(pos.node()), pos.m_offset);
+    splitTextNodeContainingElement(static_cast<Text *>(pos.node()), pos.deprecatedEditingOffset());
     return positionBeforeNode(tabSpan);
 }
 
@@ -392,7 +407,7 @@
     String text = textNode->data();
     ASSERT(!text.isEmpty());
 
-    int offset = position.m_offset;
+    int offset = position.deprecatedEditingOffset();
     // If neither text[offset] nor text[offset - 1] are some form of whitespace, do nothing.
     if (!isWhitespace(text[offset])) {
         offset--;
@@ -449,9 +464,9 @@
     Position previous(previousVisiblePos.deepEquivalent());
     
     if (isCollapsibleWhitespace(previousVisiblePos.characterAfter()) && previous.node()->isTextNode() && !previous.node()->hasTagName(brTag))
-        replaceTextInNode(static_cast<Text*>(previous.node()), previous.m_offset, 1, nonBreakingSpaceString());
+        replaceTextInNode(static_cast<Text*>(previous.node()), previous.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     if (isCollapsibleWhitespace(visiblePos.characterAfter()) && position.node()->isTextNode() && !position.node()->hasTagName(brTag))
-        replaceTextInNode(static_cast<Text*>(position.node()), position.m_offset, 1, nonBreakingSpaceString());
+        replaceTextInNode(static_cast<Text*>(position.node()), position.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
 }
 
 void CompositeEditCommand::rebalanceWhitespace()
@@ -534,7 +549,7 @@
     if (start.isNull() || end.isNull())
         return;
 
-    if (Range::compareBoundaryPoints(start, end) >= 0)
+    if (comparePositions(start, end) >= 0)
         return;
 
     Node* next;
@@ -542,8 +557,8 @@
         next = node->traverseNextNode();
         if (node->isTextNode()) {
             Text* textNode = static_cast<Text*>(node);
-            int startOffset = node == start.node() ? start.m_offset : 0;
-            int endOffset = node == end.node() ? end.m_offset : textNode->length();
+            int startOffset = node == start.node() ? start.deprecatedEditingOffset() : 0;
+            int endOffset = node == end.node() ? end.deprecatedEditingOffset() : textNode->length();
             deleteInsignificantText(textNode, startOffset, endOffset);
         }
         if (node == end.node())
@@ -603,24 +618,18 @@
     return 0;
 }
 
-// Removes '\n's and brs that will collapse when content is inserted just before them.
-// FIXME: We shouldn't really have to remove placeholders, but removing them is a workaround for 9661.
-void CompositeEditCommand::removePlaceholderAt(const VisiblePosition& visiblePosition)
+// Assumes that the position is at a placeholder and does the removal without much checking.
+void CompositeEditCommand::removePlaceholderAt(const Position& p)
 {
-    if (visiblePosition.isNull())
+    ASSERT(lineBreakExistsAtPosition(p));
+    
+    // We are certain that the position is at a line break, but it may be a br or a preserved newline.
+    if (p.anchorNode()->hasTagName(brTag)) {
+        removeNode(p.anchorNode());
         return;
-        
-    Position p = visiblePosition.deepEquivalent().downstream();
-    // If a br or '\n' is at the end of a block and not at the start of a paragraph,
-    // then it is superfluous, so adding content before a br or '\n' that is at
-    // the start of a paragraph will render it superfluous.
-    // FIXME: This doesn't remove placeholders at the end of anonymous blocks.
-    if (isEndOfBlock(visiblePosition) && isStartOfParagraph(visiblePosition)) {
-        if (p.node()->hasTagName(brTag) && p.m_offset == 0)
-            removeNode(p.node());
-        else if (lineBreakExistsAtPosition(visiblePosition))
-            deleteTextFromNode(static_cast<Text*>(p.node()), p.m_offset, 1);
     }
+    
+    deleteTextFromNode(static_cast<Text*>(p.anchorNode()), p.offsetInContainerNode(), 1);
 }
 
 PassRefPtr<Node> CompositeEditCommand::insertNewDefaultParagraphElementAt(const Position& position)
@@ -654,7 +663,7 @@
 
     // If there are no VisiblePositions in the same block as pos then 
     // upstreamStart will be outside the paragraph
-    if (Range::compareBoundaryPoints(pos, upstreamStart) < 0)
+    if (comparePositions(pos, upstreamStart) < 0)
         return 0;
 
     // Perform some checks to see if we need to perform work in this function.
@@ -662,9 +671,9 @@
         // If the block is the root editable element, always move content to a new block,
         // since it is illegal to modify attributes on the root editable element for editing.
         if (upstreamStart.node() == editableRootForPosition(upstreamStart)) {
-            // If the block is the root editable element and there is nothing insde of it, create a new
-            // block but don't try and move content into it, since there's nothing to move.
-            if (upstreamStart == upstreamEnd)
+            // If the block is the root editable element and it contains no visible content, create a new
+            // block but don't try and move content into it, since there's nothing for moveParagraphs to move.
+            if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(upstreamStart.node()->renderer()))
                 return insertNewDefaultParagraphElementAt(upstreamStart);
         } else if (isBlock(upstreamEnd.node())) {
             if (!upstreamEnd.node()->isDescendantOf(upstreamStart.node())) {
@@ -750,12 +759,12 @@
         VisiblePosition visibleStart = endingSelection().visibleStart();
         VisiblePosition visibleEnd = endingSelection().visibleEnd();
         
-        bool startAfterParagraph = Range::compareBoundaryPoints(visibleStart.deepEquivalent(), endOfParagraphToMove.deepEquivalent()) > 0;
-        bool endBeforeParagraph = Range::compareBoundaryPoints(visibleEnd.deepEquivalent(), startOfParagraphToMove.deepEquivalent()) < 0;
+        bool startAfterParagraph = comparePositions(visibleStart, endOfParagraphToMove) > 0;
+        bool endBeforeParagraph = comparePositions(visibleEnd, startOfParagraphToMove) < 0;
         
         if (!startAfterParagraph && !endBeforeParagraph) {
-            bool startInParagraph = Range::compareBoundaryPoints(visibleStart.deepEquivalent(), startOfParagraphToMove.deepEquivalent()) >= 0;
-            bool endInParagraph = Range::compareBoundaryPoints(visibleEnd.deepEquivalent(), endOfParagraphToMove.deepEquivalent()) <= 0;
+            bool startInParagraph = comparePositions(visibleStart, startOfParagraphToMove) >= 0;
+            bool endInParagraph = comparePositions(visibleEnd, endOfParagraphToMove) <= 0;
             
             startIndex = 0;
             if (startInParagraph) {
@@ -782,7 +791,7 @@
     // start and end can't be used directly to create a Range; they are "editing positions"
     Position startRangeCompliant = rangeCompliantEquivalent(start);
     Position endRangeCompliant = rangeCompliantEquivalent(end);
-    RefPtr<Range> range = Range::create(document(), startRangeCompliant.node(), startRangeCompliant.m_offset, endRangeCompliant.node(), endRangeCompliant.m_offset);
+    RefPtr<Range> range = Range::create(document(), startRangeCompliant.node(), startRangeCompliant.deprecatedEditingOffset(), endRangeCompliant.node(), endRangeCompliant.deprecatedEditingOffset());
 
     // FIXME: This is an inefficient way to preserve style on nodes in the paragraph to move.  It 
     // shouldn't matter though, since moved paragraphs will usually be quite small.
@@ -825,13 +834,13 @@
         // expects this behavior).
         else if (isBlock(node))
             removeNodeAndPruneAncestors(node);
-        else if (lineBreakExistsAtPosition(caretAfterDelete)) {
+        else if (lineBreakExistsAtVisiblePosition(caretAfterDelete)) {
             // There is a preserved '\n' at caretAfterDelete.
             Text* textNode = static_cast<Text*>(node);
             if (textNode->length() == 1)
                 removeNodeAndPruneAncestors(node);
             else 
-                deleteTextFromNode(textNode, position.m_offset, 1);
+                deleteTextFromNode(textNode, position.deprecatedEditingOffset(), 1);
         }
     }
 
@@ -856,8 +865,10 @@
     
     setEndingSelection(destination);
     applyCommandToComposite(ReplaceSelectionCommand::create(document(), fragment, true, false, !preserveStyle, false, true));
-    // Restore styles from an empty paragraph to the new empty paragraph.
-    if (styleInEmptyParagraph)
+    
+    // If the selection is in an empty paragraph, restore styles from the old empty paragraph to the new empty paragraph.
+    bool selectionIsEmptyParagraph = endingSelection().isCaret() && isStartOfParagraph(endingSelection().visibleStart()) && isEndOfParagraph(endingSelection().visibleStart());
+    if (styleInEmptyParagraph && selectionIsEmptyParagraph)
         applyStyle(styleInEmptyParagraph.get());
     
     if (preserveSelection && startIndex != -1) {
@@ -941,7 +952,7 @@
     setEndingSelection(VisibleSelection(atBR));
     
     // If this is an empty paragraph there must be a line break here.
-    if (!lineBreakExistsAtPosition(caret))
+    if (!lineBreakExistsAtVisiblePosition(caret))
         return false;
     
     Position caretPos(caret.deepEquivalent());
@@ -953,7 +964,7 @@
         removeNode(caretPos.node());
         prune(beforeBR.node());
     } else {
-        ASSERT(caretPos.m_offset == 0);
+        ASSERT(caretPos.deprecatedEditingOffset() == 0);
         Text* textNode = static_cast<Text*>(caretPos.node());
         Node* parentNode = textNode->parentNode();
         // The preserved newline must be the first thing in the node, since otherwise the previous
@@ -995,7 +1006,7 @@
             // Don't insert outside an anchor if doing so would skip over a line break.  It would
             // probably be safe to move the line break so that we could still avoid the anchor here.
             Position downstream(visiblePos.deepEquivalent().downstream());
-            if (lineBreakExistsAtPosition(visiblePos) && downstream.node()->isDescendantOf(enclosingAnchor))
+            if (lineBreakExistsAtVisiblePosition(visiblePos) && downstream.node()->isDescendantOf(enclosingAnchor))
                 return original;
             
             result = positionAfterNode(enclosingAnchor);
@@ -1030,8 +1041,10 @@
         if (positionInParent != positionInNode)
             applyCommandToComposite(SplitElementCommand::create(static_cast<Element*>(node->parent()), node));
     }
-    if (splitAncestor)
-        return splitTreeToNode(end, end->parent());
+    if (splitAncestor) {
+        splitElement(static_cast<Element*>(end), node);
+        return node->parent();
+    }
     return node.release();
 }
 
diff --git a/WebCore/editing/CompositeEditCommand.h b/WebCore/editing/CompositeEditCommand.h
index 4a3defd..2c6403e 100644
--- a/WebCore/editing/CompositeEditCommand.h
+++ b/WebCore/editing/CompositeEditCommand.h
@@ -33,6 +33,7 @@
 namespace WebCore {
 
 class CSSStyleDeclaration;
+class HTMLElement;
 class Text;
 
 class CompositeEditCommand : public EditCommand {
@@ -71,6 +72,7 @@
     void removeNodeAttribute(PassRefPtr<Element>, const QualifiedName& attribute);
     void removeChildrenInRange(PassRefPtr<Node>, unsigned from, unsigned to);
     virtual void removeNode(PassRefPtr<Node>);
+    HTMLElement* replaceNodeWithSpanPreservingChildrenAndAttributes(PassRefPtr<Node>);
     void removeNodePreservingChildren(PassRefPtr<Node>);
     void removeNodeAndPruneAncestors(PassRefPtr<Node>);
     void prune(PassRefPtr<Node>);
@@ -89,7 +91,7 @@
     PassRefPtr<Node> appendBlockPlaceholder(PassRefPtr<Element>);
     PassRefPtr<Node> insertBlockPlaceholder(const Position&);
     PassRefPtr<Node> addBlockPlaceholderIfNeeded(Element*);
-    void removePlaceholderAt(const VisiblePosition&);
+    void removePlaceholderAt(const Position&);
 
     PassRefPtr<Node> insertNewDefaultParagraphElementAt(const Position&);
 
diff --git a/WebCore/editing/DeleteButtonController.cpp b/WebCore/editing/DeleteButtonController.cpp
index c0775e3..725c01d 100644
--- a/WebCore/editing/DeleteButtonController.cpp
+++ b/WebCore/editing/DeleteButtonController.cpp
@@ -66,36 +66,75 @@
     if (!node || !node->isHTMLElement() || !node->inDocument() || !node->isContentEditable())
         return false;
 
-    const int minimumWidth = 25;
-    const int minimumHeight = 25;
-    const unsigned minimumVisibleBorders = 3;
+    // In general we want to only draw the UI arround object of a certain area, but we still keep the min width/height to
+    // make sure we don't end up with very thin or very short elements getting the UI.
+    const int minimumArea = 2500;
+    const int minimumWidth = 48;
+    const int minimumHeight = 16;
+    const unsigned minimumVisibleBorders = 1;
 
     RenderObject* renderer = node->renderer();
     if (!renderer || !renderer->isBox())
         return false;
 
+    // Disallow the body element since it isn't practical to delete, and the deletion UI would be clipped.
+    if (node->hasTagName(bodyTag))
+        return false;
+
+    // Disallow elements with any overflow clip, since the deletion UI would be clipped as well. <rdar://problem/6840161>
+    if (renderer->hasOverflowClip())
+        return false;
+
+    // Disallow Mail blockquotes since the deletion UI would get in the way of editing for these.
+    if (isMailBlockquote(node))
+        return false;
+
     RenderBox* box = toRenderBox(renderer);
     IntRect borderBoundingBox = box->borderBoundingBox();
     if (borderBoundingBox.width() < minimumWidth || borderBoundingBox.height() < minimumHeight)
         return false;
 
+    if ((borderBoundingBox.width() * borderBoundingBox.height()) < minimumArea)
+        return false;
+
     if (renderer->isTable())
         return true;
 
-    if (node->hasTagName(ulTag) || node->hasTagName(olTag))
+    if (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(iframeTag))
         return true;
 
     if (renderer->isPositioned())
         return true;
 
-    // allow block elements (excluding table cells) that have some non-transparent borders
     if (renderer->isRenderBlock() && !renderer->isTableCell()) {
         RenderStyle* style = renderer->style();
-        if (style && style->hasBorder()) {
-            unsigned visibleBorders = style->borderTop().isVisible() + style->borderBottom().isVisible() + style->borderLeft().isVisible() + style->borderRight().isVisible();
-            if (visibleBorders >= minimumVisibleBorders)
-                return true;
-        }
+        if (!style)
+            return false;
+
+        // Allow blocks that have background images
+        if (style->hasBackgroundImage() && style->backgroundImage()->canRender(1.0f))
+            return true;
+
+        // Allow blocks with a minimum number of non-transparent borders
+        unsigned visibleBorders = style->borderTop().isVisible() + style->borderBottom().isVisible() + style->borderLeft().isVisible() + style->borderRight().isVisible();
+        if (visibleBorders >= minimumVisibleBorders)
+            return true;
+
+        // Allow blocks that have a different background from it's parent
+        Node* parentNode = node->parentNode();
+        if (!parentNode)
+            return false;
+
+        RenderObject* parentRenderer = parentNode->renderer();
+        if (!parentRenderer)
+            return false;
+
+        RenderStyle* parentStyle = parentRenderer->style();
+        if (!parentStyle)
+            return false;
+
+        if (style->hasBackground() && (!parentStyle->hasBackground() || style->backgroundColor() != parentStyle->backgroundColor()))
+            return true;
     }
 
     return false;
@@ -288,7 +327,7 @@
         // Determining if the element is deletable currently depends on style
         // because whether something is editable depends on style, so we need
         // to recalculate style before calling enclosingDeletableElement.
-        m_frame->document()->updateRendering();
+        m_frame->document()->updateStyleIfNeeded();
         show(enclosingDeletableElement(m_frame->selection()->selection()));
     }
 }
diff --git a/WebCore/editing/DeleteSelectionCommand.cpp b/WebCore/editing/DeleteSelectionCommand.cpp
index 09288ee..5a0d8fc 100644
--- a/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/WebCore/editing/DeleteSelectionCommand.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DeleteSelectionCommand.h"
 
+#include "CSSMutableStyleDeclaration.h"
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "Editor.h"
@@ -79,6 +80,7 @@
       m_replace(replace),
       m_expandForSpecialElements(expandForSpecialElements),
       m_pruneStartBlockIfNecessary(false),
+      m_startsAtEmptyLine(false),
       m_startBlock(0),
       m_endBlock(0),
       m_typingStyle(0),
@@ -94,6 +96,7 @@
       m_replace(replace),
       m_expandForSpecialElements(expandForSpecialElements),
       m_pruneStartBlockIfNecessary(false),
+      m_startsAtEmptyLine(false),
       m_selectionToDelete(selection),
       m_startBlock(0),
       m_endBlock(0),
@@ -135,11 +138,12 @@
             break;
         
         // If we're going to expand to include the startSpecialContainer, it must be fully selected.
-        if (startSpecialContainer && !endSpecialContainer && Range::compareBoundaryPoints(positionAfterNode(startSpecialContainer), end) > -1)
+
+        if (startSpecialContainer && !endSpecialContainer && comparePositions(positionAfterNode(startSpecialContainer), end) > -1)
             break;
 
-        // If we're going to expand to include the endSpecialContainer, it must be fully selected.         
-        if (endSpecialContainer && !startSpecialContainer && Range::compareBoundaryPoints(start, positionBeforeNode(endSpecialContainer)) > -1)
+        // If we're going to expand to include the endSpecialContainer, it must be fully selected.
+        if (endSpecialContainer && !startSpecialContainer && comparePositions(start, positionBeforeNode(endSpecialContainer)) > -1)
             break;
         
         if (startSpecialContainer && startSpecialContainer->isDescendantOf(endSpecialContainer))
@@ -195,7 +199,11 @@
     // selections that contain a whole number paragraphs plus a line break, since it is unclear to most users 
     // that such a selection actually ends at the start of the next paragraph. This matches TextEdit behavior 
     // for indented paragraphs.
-    if (numEnclosingMailBlockquotes(start) != numEnclosingMailBlockquotes(end) && isStartOfParagraph(visibleEnd) && isStartOfParagraph(VisiblePosition(start))) {
+    // Only apply this rule if the endingSelection is a range selection.  If it is a caret, then other operations have created
+    // the selection we're deleting (like the process of creating a selection to delete during a backspace), and the user isn't in the situation described above.
+    if (numEnclosingMailBlockquotes(start) != numEnclosingMailBlockquotes(end) 
+            && isStartOfParagraph(visibleEnd) && isStartOfParagraph(VisiblePosition(start)) 
+            && endingSelection().isRange()) {
         m_mergeBlocksAfterDelete = false;
         m_pruneStartBlockIfNecessary = true;
     }
@@ -299,7 +307,7 @@
     // Not a special-case delete per se, but we can detect that the merging of content between blocks
     // should not be done.
     if (upstreamStartIsBR && downstreamStartIsBR) {
-        m_mergeBlocksAfterDelete = false;
+        m_startsAtEmptyLine = true;
         m_endingPosition = m_downstreamEnd;
     }
     
@@ -310,8 +318,8 @@
 {
     if (position.isNull())
         return;
-    if (node->parent() == position.node() && node->nodeIndex() < (unsigned)position.m_offset)
-        position = Position(position.node(), position.m_offset - 1);
+    if (node->parent() == position.node() && node->nodeIndex() < (unsigned)position.deprecatedEditingOffset())
+        position = Position(position.node(), position.deprecatedEditingOffset() - 1);
     if (position.node() == node || position.node()->isDescendantOf(node))
         position = positionBeforeNode(node);
 }
@@ -377,9 +385,9 @@
 static void updatePositionForTextRemoval(Node* node, int offset, int count, Position& position)
 {
     if (position.node() == node) {
-        if (position.m_offset > offset + count)
-            position = Position(position.node(), position.m_offset - count);
-        else if (position.m_offset > offset)
+        if (position.deprecatedEditingOffset() > offset + count)
+            position = Position(position.node(), position.deprecatedEditingOffset() - count);
+        else if (position.deprecatedEditingOffset() > offset)
             position = Position(position.node(), offset);
     }
 }
@@ -390,13 +398,14 @@
     updatePositionForTextRemoval(node.get(), offset, count, m_endingPosition);
     updatePositionForTextRemoval(node.get(), offset, count, m_leadingWhitespace);
     updatePositionForTextRemoval(node.get(), offset, count, m_trailingWhitespace);
+    updatePositionForTextRemoval(node.get(), offset, count, m_downstreamEnd);
     
     CompositeEditCommand::deleteTextFromNode(node, offset, count);
 }
 
 void DeleteSelectionCommand::handleGeneralDelete()
 {
-    int startOffset = m_upstreamStart.m_offset;
+    int startOffset = m_upstreamStart.deprecatedEditingOffset();
     Node* startNode = m_upstreamStart.node();
     
     // Never remove the start block unless it's a table, in which case we won't merge content in.
@@ -425,13 +434,13 @@
         if (!startNode->renderer() || (startOffset == 0 && m_downstreamEnd.atLastEditingPositionForNode())) {
             // just delete
             removeNode(startNode);
-        } else if (m_downstreamEnd.m_offset - startOffset > 0) {
+        } else if (m_downstreamEnd.deprecatedEditingOffset() - startOffset > 0) {
             if (startNode->isTextNode()) {
                 // in a text node that needs to be trimmed
                 Text* text = static_cast<Text*>(startNode);
-                deleteTextFromNode(text, startOffset, m_downstreamEnd.m_offset - startOffset);
+                deleteTextFromNode(text, startOffset, m_downstreamEnd.deprecatedEditingOffset() - startOffset);
             } else {
-                removeChildrenInRange(startNode, startOffset, m_downstreamEnd.m_offset);
+                removeChildrenInRange(startNode, startOffset, m_downstreamEnd.deprecatedEditingOffset());
                 m_endingPosition = m_upstreamStart;
             }
         }
@@ -454,7 +463,7 @@
         
         // handle deleting all nodes that are completely selected
         while (node && node != m_downstreamEnd.node()) {
-            if (Range::compareBoundaryPoints(Position(node.get(), 0), m_downstreamEnd) >= 0) {
+            if (comparePositions(Position(node.get(), 0), m_downstreamEnd) >= 0) {
                 // traverseNextSibling just blew past the end position, so stop deleting
                 node = 0;
             } else if (!m_downstreamEnd.node()->isDescendantOf(node.get())) {
@@ -462,14 +471,14 @@
                 // if we just removed a node from the end container, update end position so the
                 // check above will work
                 if (node->parentNode() == m_downstreamEnd.node()) {
-                    ASSERT(node->nodeIndex() < (unsigned)m_downstreamEnd.m_offset);
-                    m_downstreamEnd = Position(m_downstreamEnd.node(), m_downstreamEnd.m_offset - 1);
+                    ASSERT(node->nodeIndex() < (unsigned)m_downstreamEnd.deprecatedEditingOffset());
+                    m_downstreamEnd = Position(m_downstreamEnd.node(), m_downstreamEnd.deprecatedEditingOffset() - 1);
                 }
                 removeNode(node.get());
                 node = nextNode.get();
             } else {
                 Node* n = node->lastDescendant();
-                if (m_downstreamEnd.node() == n && m_downstreamEnd.m_offset >= caretMaxOffset(n)) {
+                if (m_downstreamEnd.node() == n && m_downstreamEnd.deprecatedEditingOffset() >= caretMaxOffset(n)) {
                     removeNode(node.get());
                     node = 0;
                 } else
@@ -477,7 +486,7 @@
             }
         }
         
-        if (m_downstreamEnd.node() != startNode && !m_upstreamStart.node()->isDescendantOf(m_downstreamEnd.node()) && m_downstreamEnd.node()->inDocument() && m_downstreamEnd.m_offset >= caretMinOffset(m_downstreamEnd.node())) {
+        if (m_downstreamEnd.node() != startNode && !m_upstreamStart.node()->isDescendantOf(m_downstreamEnd.node()) && m_downstreamEnd.node()->inDocument() && m_downstreamEnd.deprecatedEditingOffset() >= caretMinOffset(m_downstreamEnd.node())) {
             if (m_downstreamEnd.atLastEditingPositionForNode() && !canHaveChildrenForEditing(m_downstreamEnd.node())) {
                 // The node itself is fully selected, not just its contents.  Delete it.
                 removeNode(m_downstreamEnd.node());
@@ -485,9 +494,8 @@
                 if (m_downstreamEnd.node()->isTextNode()) {
                     // in a text node that needs to be trimmed
                     Text *text = static_cast<Text *>(m_downstreamEnd.node());
-                    if (m_downstreamEnd.m_offset > 0) {
-                        deleteTextFromNode(text, 0, m_downstreamEnd.m_offset);
-                        m_downstreamEnd = Position(text, 0);
+                    if (m_downstreamEnd.deprecatedEditingOffset() > 0) {
+                        deleteTextFromNode(text, 0, m_downstreamEnd.deprecatedEditingOffset());
                     }
                 // Remove children of m_downstreamEnd.node() that come after m_upstreamStart.
                 // Don't try to remove children if m_upstreamStart was inside m_downstreamEnd.node()
@@ -504,7 +512,7 @@
                         if (n)
                             offset = n->nodeIndex() + 1;
                     }
-                    removeChildrenInRange(m_downstreamEnd.node(), offset, m_downstreamEnd.m_offset);
+                    removeChildrenInRange(m_downstreamEnd.node(), offset, m_downstreamEnd.deprecatedEditingOffset());
                     m_downstreamEnd = Position(m_downstreamEnd.node(), offset);
                 }
             }
@@ -519,12 +527,12 @@
     if (m_leadingWhitespace.isNotNull() && !m_leadingWhitespace.isRenderedCharacter()) {
         Text* textNode = static_cast<Text*>(m_leadingWhitespace.node());
         ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
-        replaceTextInNode(textNode, m_leadingWhitespace.m_offset, 1, nonBreakingSpaceString());
+        replaceTextInNode(textNode, m_leadingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
     if (m_trailingWhitespace.isNotNull() && !m_trailingWhitespace.isRenderedCharacter()) {
         Text* textNode = static_cast<Text*>(m_trailingWhitespace.node());
         ASSERT(!textNode->renderer() ||textNode->renderer()->style()->collapseWhiteSpace());
-        replaceTextInNode(textNode, m_trailingWhitespace.m_offset, 1, nonBreakingSpaceString());
+        replaceTextInNode(textNode, m_trailingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
 }
 
@@ -537,7 +545,7 @@
             // Make sure that the ending position isn't inside the block we're about to prune.
             m_endingPosition = m_downstreamEnd;
             // We aren't going to merge into the start block, so remove it if it's empty.
-            prune(m_upstreamStart.node());
+            prune(m_startBlock);
             // Removing the start block during a deletion is usually an indication that we need
             // a placeholder, but not in this case.
             m_needPlaceholder = false;
@@ -553,12 +561,11 @@
          return;
          
     // FIXME: The deletion algorithm shouldn't let this happen.
-    if (Range::compareBoundaryPoints(m_upstreamStart, m_downstreamEnd) > 0)
+    if (comparePositions(m_upstreamStart, m_downstreamEnd) > 0)
         return;
         
-    // FIXME: Merging will always be unnecessary in this case, but we really bail here because this is a case where
-    // deletion commonly fails to adjust its endpoints, which would cause the visible position comparison below to false negative.
-    if (m_endBlock == m_startBlock)
+    // There's nothing to merge.
+    if (m_upstreamStart == m_downstreamEnd)
         return;
         
     VisiblePosition startOfParagraphToMove(m_downstreamEnd);
@@ -573,7 +580,7 @@
     }
     
     // We need to merge into m_upstreamStart's block, but it's been emptied out and collapsed by deletion.
-    if (!mergeDestination.deepEquivalent().node() || !mergeDestination.deepEquivalent().node()->isDescendantOf(m_upstreamStart.node()->enclosingBlockFlowElement())) {
+    if (!mergeDestination.deepEquivalent().node() || !mergeDestination.deepEquivalent().node()->isDescendantOf(m_upstreamStart.node()->enclosingBlockFlowElement()) || m_startsAtEmptyLine) {
         insertNodeAt(createBreakElement(document()).get(), m_upstreamStart);
         mergeDestination = VisiblePosition(m_upstreamStart);
     }
@@ -588,8 +595,7 @@
     
     // The rule for merging into an empty block is: only do so if its farther to the right.
     // FIXME: Consider RTL.
-    // FIXME: handleSpecialCaseBRDelete prevents us from getting here in a case like <ul><li>foo<br><br></li></ul>^foo
-    if (isStartOfParagraph(mergeDestination) && startOfParagraphToMove.absoluteCaretBounds().x() > mergeDestination.absoluteCaretBounds().x()) {
+    if (!m_startsAtEmptyLine && isStartOfParagraph(mergeDestination) && startOfParagraphToMove.absoluteCaretBounds().x() > mergeDestination.absoluteCaretBounds().x()) {
         ASSERT(mergeDestination.deepEquivalent().downstream().node()->hasTagName(brTag));
         removeNodeAndPruneAncestors(mergeDestination.deepEquivalent().downstream().node());
         m_endingPosition = startOfParagraphToMove.deepEquivalent();
@@ -671,7 +677,7 @@
     if (m_typingStyle && 
         isStartOfParagraph(visibleEnd) &&
         isEndOfParagraph(visibleEnd) &&
-        lineBreakExistsAtPosition(visibleEnd)) {
+        lineBreakExistsAtVisiblePosition(visibleEnd)) {
         // Apply style to the placeholder that is now holding open the empty paragraph. 
         // This makes sure that the paragraph has the right height, and that the paragraph 
         // takes on the right style and retains it even if you move the selection away and
@@ -729,7 +735,7 @@
     Position downstreamEnd = m_selectionToDelete.end().downstream();
     m_needPlaceholder = isStartOfParagraph(m_selectionToDelete.visibleStart()) &&
                         isEndOfParagraph(m_selectionToDelete.visibleEnd()) &&
-                        !lineBreakExistsAtPosition(m_selectionToDelete.visibleEnd());
+                        !lineBreakExistsAtVisiblePosition(m_selectionToDelete.visibleEnd());
     if (m_needPlaceholder) {
         // Don't need a placeholder when deleting a selection that starts just before a table
         // and ends inside it (we do need placeholders to hold open empty cells, but that's
diff --git a/WebCore/editing/DeleteSelectionCommand.h b/WebCore/editing/DeleteSelectionCommand.h
index 640c549..c8872ef 100644
--- a/WebCore/editing/DeleteSelectionCommand.h
+++ b/WebCore/editing/DeleteSelectionCommand.h
@@ -72,6 +72,7 @@
     bool m_replace;
     bool m_expandForSpecialElements;
     bool m_pruneStartBlockIfNecessary;
+    bool m_startsAtEmptyLine;
 
     // This data is transient and should be cleared at the end of the doApply function.
     VisibleSelection m_selectionToDelete;
@@ -90,6 +91,7 @@
     RefPtr<Node> m_endRoot;
     RefPtr<Node> m_startTableRow;
     RefPtr<Node> m_endTableRow;
+    RefPtr<Node> m_temporaryPlaceholder;
 };
 
 } // namespace WebCore
diff --git a/WebCore/editing/Editor.cpp b/WebCore/editing/Editor.cpp
index f44449b..2c303f9 100644
--- a/WebCore/editing/Editor.cpp
+++ b/WebCore/editing/Editor.cpp
@@ -29,7 +29,10 @@
 
 #include "AXObjectCache.h"
 #include "ApplyStyleCommand.h"
+#include "CharacterNames.h"
+#include "CreateLinkCommand.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
@@ -388,7 +391,7 @@
     if (AXObjectCache::accessibilityEnabled()) {
         Node* node = endingSelection.start().node();
         if (node)
-            m_frame->document()->axObjectCache()->postNotification(node->renderer(), "AXValueChanged");
+            m_frame->document()->axObjectCache()->postNotification(node->renderer(), "AXValueChanged", false);
     }
     
     if (client())
@@ -1122,6 +1125,110 @@
     return client() ? client()->spellCheckerDocumentTag() : 0;
 }
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+void Editor::uppercaseWord()
+{
+    if (client())
+        client()->uppercaseWord();
+}
+
+void Editor::lowercaseWord()
+{
+    if (client())
+        client()->lowercaseWord();
+}
+
+void Editor::capitalizeWord()
+{
+    if (client())
+        client()->capitalizeWord();
+}
+
+void Editor::showSubstitutionsPanel()
+{
+    if (!client()) {
+        LOG_ERROR("No NSSpellChecker");
+        return;
+    }
+
+    if (client()->substitutionsPanelIsShowing()) {
+        client()->showSubstitutionsPanel(false);
+        return;
+    }
+    client()->showSubstitutionsPanel(true);
+}
+
+bool Editor::substitutionsPanelIsShowing()
+{
+    if (!client())
+        return false;
+    return client()->substitutionsPanelIsShowing();
+}
+
+void Editor::toggleSmartInsertDelete()
+{
+    if (client())
+        client()->toggleSmartInsertDelete();
+}
+
+bool Editor::isAutomaticQuoteSubstitutionEnabled()
+{
+    return client() && client()->isAutomaticQuoteSubstitutionEnabled();
+}
+
+void Editor::toggleAutomaticQuoteSubstitution()
+{
+    if (client())
+        client()->toggleAutomaticQuoteSubstitution();
+}
+
+bool Editor::isAutomaticLinkDetectionEnabled()
+{
+    return client() && client()->isAutomaticLinkDetectionEnabled();
+}
+
+void Editor::toggleAutomaticLinkDetection()
+{
+    if (client())
+        client()->toggleAutomaticLinkDetection();
+}
+
+bool Editor::isAutomaticDashSubstitutionEnabled()
+{
+    return client() && client()->isAutomaticDashSubstitutionEnabled();
+}
+
+void Editor::toggleAutomaticDashSubstitution()
+{
+    if (client())
+        client()->toggleAutomaticDashSubstitution();
+}
+
+bool Editor::isAutomaticTextReplacementEnabled()
+{
+    return client() && client()->isAutomaticTextReplacementEnabled();
+}
+
+void Editor::toggleAutomaticTextReplacement()
+{
+    if (client())
+        client()->toggleAutomaticTextReplacement();
+}
+
+bool Editor::isAutomaticSpellingCorrectionEnabled()
+{
+    return client() && client()->isAutomaticSpellingCorrectionEnabled();
+}
+
+void Editor::toggleAutomaticSpellingCorrection()
+{
+    if (client())
+        client()->toggleAutomaticSpellingCorrection();
+}
+
+#endif
+
 bool Editor::shouldEndEditing(Range* range)
 {
     return client() && client()->shouldEndEditing(range);
@@ -1197,7 +1304,7 @@
         if (direction == NaturalWritingDirection)
             return;
         static_cast<HTMLElement*>(focusedNode)->setAttribute(dirAttr, direction == LeftToRightWritingDirection ? "ltr" : "rtl");
-        frame()->document()->updateRendering();
+        frame()->document()->updateStyleIfNeeded();
         return;
     }
 
@@ -1290,9 +1397,9 @@
         TypingCommand::insertText(m_frame->document(), text, true, true);
 
         Node* baseNode = m_frame->selection()->base().node();
-        unsigned baseOffset = m_frame->selection()->base().m_offset;
+        unsigned baseOffset = m_frame->selection()->base().deprecatedEditingOffset();
         Node* extentNode = m_frame->selection()->extent().node();
-        unsigned extentOffset = m_frame->selection()->extent().m_offset;
+        unsigned extentOffset = m_frame->selection()->extent().deprecatedEditingOffset();
 
         if (baseNode && baseNode == extentNode && baseNode->isTextNode() && baseOffset + text.length() == extentOffset) {
             m_compositionNode = static_cast<Text*>(baseNode);
@@ -1344,7 +1451,7 @@
     client()->learnWord(text);
 }
 
-static String findFirstMisspellingInRange(EditorClient* client, Range* searchRange, int& firstMisspellingOffset, bool markAll)
+static String findFirstMisspellingInRange(EditorClient* client, Range* searchRange, int& firstMisspellingOffset, bool markAll, RefPtr<Range>& firstMisspellingRange)
 {
     ASSERT_ARG(client, client);
     ASSERT_ARG(searchRange, searchRange);
@@ -1378,23 +1485,24 @@
             
             if (misspellingLocation >= 0 && misspellingLength > 0 && misspellingLocation < len && misspellingLength <= len && misspellingLocation + misspellingLength <= len) {
                 
-                // Remember first-encountered misspelling and its offset
+                // Compute range of misspelled word
+                RefPtr<Range> misspellingRange = TextIterator::subrange(searchRange, currentChunkOffset + misspellingLocation, misspellingLength);
+
+                // Remember first-encountered misspelling and its offset.
                 if (!firstMisspelling) {
                     firstMisspellingOffset = currentChunkOffset + misspellingLocation;
                     firstMisspelling = String(chars + misspellingLocation, misspellingLength);
+                    firstMisspellingRange = misspellingRange;
                 }
-                
-                // Mark this instance if we're marking all instances. Otherwise bail out because we found the first one.
-                if (!markAll)
-                    break;
-                
-                // Compute range of misspelled word
-                RefPtr<Range> misspellingRange = TextIterator::subrange(searchRange, currentChunkOffset + misspellingLocation, misspellingLength);
-                
-                // Store marker for misspelled word
+
+                // Store marker for misspelled word.
                 ExceptionCode ec = 0;
                 misspellingRange->startContainer(ec)->document()->addMarker(misspellingRange.get(), DocumentMarker::Spelling);
                 ASSERT(ec == 0);
+
+                // Bail out if we're marking only the first misspelling, and not all instances.
+                if (!markAll)
+                    break;
             }
         }
         
@@ -1592,17 +1700,18 @@
                 unsigned grammarDetailIndex = 0;
                 
                 Vector<TextCheckingResult> results;
-                client->checkSpellingAndGrammarOfParagraph(paragraphString.characters(), paragraphString.length(), checkGrammar, results);
+                uint64_t checkingTypes = checkGrammar ? (TextCheckingTypeSpelling | TextCheckingTypeGrammar) : TextCheckingTypeSpelling;
+                client->checkTextOfParagraph(paragraphString.characters(), paragraphString.length(), checkingTypes, results);
                 
                 for (unsigned i = 0; i < results.size(); i++) {
                     const TextCheckingResult* result = &results[i];
-                    if (result->resultType == 1 && result->location >= currentStartOffset && result->location + result->length <= currentEndOffset) {
+                    if (result->type == TextCheckingTypeSpelling && result->location >= currentStartOffset && result->location + result->length <= currentEndOffset) {
                         ASSERT(result->length > 0 && result->location >= 0);
                         spellingLocation = result->location;
                         misspelledWord = paragraphString.substring(result->location, result->length);
                         ASSERT(misspelledWord.length() != 0);
                         break;
-                    } else if (checkGrammar && result->resultType == 2 && result->location < currentEndOffset && result->location + result->length > currentStartOffset) {
+                    } else if (checkGrammar && result->type == TextCheckingTypeGrammar && result->location < currentEndOffset && result->location + result->length > currentStartOffset) {
                         ASSERT(result->length > 0 && result->location >= 0);
                         // We can't stop after the first grammar result, since there might still be a spelling result after
                         // it begins but before the first detail in it, but we can stop if we find a second grammar result.
@@ -1696,7 +1805,7 @@
             return;
         
         Position rangeCompliantPosition = rangeCompliantEquivalent(position);
-        spellingSearchRange->setStart(rangeCompliantPosition.node(), rangeCompliantPosition.m_offset, ec);
+        spellingSearchRange->setStart(rangeCompliantPosition.node(), rangeCompliantPosition.deprecatedEditingOffset(), ec);
         startedWithSelection = false;   // won't need to wrap
     }
     
@@ -1745,8 +1854,8 @@
         grammarPhraseOffset = foundOffset;
     }
 #else
-    String misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false);
-    
+    RefPtr<Range> firstMisspellingRange;
+    String misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false, firstMisspellingRange);
     String badGrammarPhrase;
 
 #ifndef BUILDING_ON_TIGER
@@ -1785,7 +1894,7 @@
             grammarPhraseOffset = foundOffset;
         }
 #else
-        misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false);
+        misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false, firstMisspellingRange);
 
 #ifndef BUILDING_ON_TIGER
         grammarSearchRange = spellingSearchRange->cloneRange(ec);
@@ -1961,11 +2070,12 @@
         return guesses;
 
     Vector<TextCheckingResult> results;
-    client->checkSpellingAndGrammarOfParagraph(paragraphString.characters(), paragraphString.length(), checkGrammar, results);
+    uint64_t checkingTypes = checkGrammar ? (TextCheckingTypeSpelling | TextCheckingTypeGrammar) : TextCheckingTypeSpelling;
+    client->checkTextOfParagraph(paragraphString.characters(), paragraphString.length(), checkingTypes, results);
     
     for (unsigned i = 0; i < results.size(); i++) {
         const TextCheckingResult* result = &results[i];
-        if (result->resultType == 1 && result->location == rangeStartOffset && result->length == rangeLength) {
+        if (result->type == TextCheckingTypeSpelling && result->location == rangeStartOffset && result->length == rangeLength) {
             String misspelledWord = paragraphString.substring(rangeStartOffset, rangeLength);
             ASSERT(misspelledWord.length() != 0);
             client->getGuessesForWord(misspelledWord, guesses);
@@ -1980,7 +2090,7 @@
         
     for (unsigned i = 0; i < results.size(); i++) {
         const TextCheckingResult* result = &results[i];
-        if (result->resultType == 2 && result->location <= rangeStartOffset && result->location + result->length >= rangeStartOffset + rangeLength) {
+        if (result->type == TextCheckingTypeGrammar && result->location <= rangeStartOffset && result->location + result->length >= rangeStartOffset + rangeLength) {
             for (unsigned j = 0; j < result->details.size(); j++) {
                 const GrammarDetail* detail = &result->details[j];
                 ASSERT(detail->length > 0 && detail->location >= 0);
@@ -2049,21 +2159,58 @@
 
 void Editor::markMisspellingsAfterTypingToPosition(const VisiblePosition &p)
 {
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    bool markSpelling = isContinuousSpellCheckingEnabled();
+    bool markGrammar = markSpelling && isGrammarCheckingEnabled();
+    bool performTextCheckingReplacements = isAutomaticQuoteSubstitutionEnabled() 
+                                        || isAutomaticLinkDetectionEnabled()
+                                        || isAutomaticDashSubstitutionEnabled()
+                                        || isAutomaticTextReplacementEnabled()
+                                        || (markSpelling && isAutomaticSpellingCorrectionEnabled());
+    if (!markSpelling && !performTextCheckingReplacements)
+        return;
+    
+    VisibleSelection adjacentWords = VisibleSelection(startOfWord(p, LeftWordIfOnBoundary), endOfWord(p, RightWordIfOnBoundary));
+    if (markGrammar) {
+        VisibleSelection selectedSentence = VisibleSelection(startOfSentence(p), endOfSentence(p));
+        markAllMisspellingsAndBadGrammarInRanges(true, adjacentWords.toNormalizedRange().get(), true, selectedSentence.toNormalizedRange().get(), performTextCheckingReplacements);
+    } else {
+        markAllMisspellingsAndBadGrammarInRanges(markSpelling, adjacentWords.toNormalizedRange().get(), false, adjacentWords.toNormalizedRange().get(), performTextCheckingReplacements);
+    }
+#else
     if (!isContinuousSpellCheckingEnabled())
         return;
     
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    VisibleSelection adjacentWords = VisibleSelection(startOfWord(p, LeftWordIfOnBoundary), endOfWord(p, RightWordIfOnBoundary));
-    if (isGrammarCheckingEnabled()) {
-        VisibleSelection selectedSentence = VisibleSelection(startOfSentence(p), endOfSentence(p));
-        markMisspellingsAndBadGrammar(adjacentWords, true, selectedSentence);
-    } else {
-        markMisspellingsAndBadGrammar(adjacentWords, false, adjacentWords);
-    }
-#else
     // Check spelling of one word
-    markMisspellings(VisibleSelection(startOfWord(p, LeftWordIfOnBoundary), endOfWord(p, RightWordIfOnBoundary)));
+    RefPtr<Range> misspellingRange;
+    markMisspellings(VisibleSelection(startOfWord(p, LeftWordIfOnBoundary), endOfWord(p, RightWordIfOnBoundary)), misspellingRange);
+
+    // Autocorrect the misspelled word.
+    if (misspellingRange == 0)
+        return;
     
+    // Get the misspelled word.
+    const String misspelledWord = plainText(misspellingRange.get());
+    String autocorrectedString = client()->getAutoCorrectSuggestionForMisspelledWord(misspelledWord);
+
+    // If autocorrected word is non empty, replace the misspelled word by this word.
+    if (!autocorrectedString.isEmpty()) {
+        VisibleSelection newSelection(misspellingRange.get(), DOWNSTREAM);
+        if (newSelection != frame()->selection()->selection()) {
+            if (!frame()->shouldChangeSelection(newSelection))
+                return;
+            frame()->selection()->setSelection(newSelection);
+        }
+
+        if (!frame()->editor()->shouldInsertText(autocorrectedString, misspellingRange.get(), EditorInsertActionTyped))
+            return;
+        frame()->editor()->replaceSelectionWithText(autocorrectedString, false, true);
+
+        // Reset the charet one character further.
+        frame()->selection()->moveTo(frame()->selection()->end());
+        frame()->selection()->modify(SelectionController::MOVE, SelectionController::FORWARD, CharacterGranularity);
+    }
+
     if (!isGrammarCheckingEnabled())
         return;
     
@@ -2072,12 +2219,12 @@
 #endif
 }
 
-static void markAllMisspellingsInRange(EditorClient* client, Range* searchRange)
+static void markAllMisspellingsInRange(EditorClient* client, Range* searchRange, RefPtr<Range>& firstMisspellingRange)
 {
     // Use the "markAll" feature of findFirstMisspellingInRange. Ignore the return value and the "out parameter";
     // all we need to do is mark every instance.
     int ignoredOffset;
-    findFirstMisspellingInRange(client, searchRange, ignoredOffset, true);
+    findFirstMisspellingInRange(client, searchRange, ignoredOffset, true, firstMisspellingRange);
 }
 
 #ifndef BUILDING_ON_TIGER
@@ -2091,7 +2238,7 @@
 }
 #endif
     
-static void markMisspellingsOrBadGrammar(Editor* editor, const VisibleSelection& selection, bool checkSpelling)
+static void markMisspellingsOrBadGrammar(Editor* editor, const VisibleSelection& selection, bool checkSpelling, RefPtr<Range>& firstMisspellingRange)
 {
     // This function is called with a selection already expanded to word boundaries.
     // Might be nice to assert that here.
@@ -2110,12 +2257,26 @@
     if (!editableNode || !editableNode->isContentEditable())
         return;
     
+    // Ascend the DOM tree to find a "spellcheck" attribute.
+    // When we find a "spellcheck" attribute, retrieve its value and exit if its value is "false".
+    const Node* node = editor->frame()->document()->focusedNode();
+    while (node) {
+        if (node->isElementNode()) {
+            const WebCore::AtomicString& value = static_cast<const Element*>(node)->getAttribute(spellcheckAttr);
+            if (equalIgnoringCase(value, "true"))
+                break;
+            if (equalIgnoringCase(value, "false"))
+                return;
+        }
+        node = node->parent();
+    }
+
     // Get the spell checker if it is available
     if (!editor->client())
         return;
     
     if (checkSpelling)
-        markAllMisspellingsInRange(editor->client(), searchRange.get());
+        markAllMisspellingsInRange(editor->client(), searchRange.get(), firstMisspellingRange);
     else {
 #ifdef BUILDING_ON_TIGER
         ASSERT_NOT_REACHED();
@@ -2126,15 +2287,16 @@
     }    
 }
 
-void Editor::markMisspellings(const VisibleSelection& selection)
+void Editor::markMisspellings(const VisibleSelection& selection, RefPtr<Range>& firstMisspellingRange)
 {
-    markMisspellingsOrBadGrammar(this, selection, true);
+    markMisspellingsOrBadGrammar(this, selection, true, firstMisspellingRange);
 }
     
 void Editor::markBadGrammar(const VisibleSelection& selection)
 {
 #ifndef BUILDING_ON_TIGER
-    markMisspellingsOrBadGrammar(this, selection, false);
+    RefPtr<Range> firstMisspellingRange;
+    markMisspellingsOrBadGrammar(this, selection, false, firstMisspellingRange);
 #else
     UNUSED_PARAM(selection);
 #endif
@@ -2142,11 +2304,19 @@
 
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 
-static void markAllMisspellingsAndBadGrammarInRanges(EditorClient* client, Range *spellingRange, bool markGrammar, Range *grammarRange)
+static inline bool isAmbiguousBoundaryCharacter(UChar character)
+{
+    // These are characters that can behave as word boundaries, but can appear within words.
+    // If they are just typed, i.e. if they are immediately followed by a caret, we want to delay text checking until the next character has been typed.
+    // FIXME: this is required until 6853027 is fixed and text checking can do this for us.
+    return character == '\'' || character == rightSingleQuotationMark || character == hebrewPunctuationGershayim;
+}
+
+void Editor::markAllMisspellingsAndBadGrammarInRanges(bool markSpelling, Range* spellingRange, bool markGrammar, Range* grammarRange, bool performTextCheckingReplacements)
 {
     // This function is called with selections already expanded to word boundaries.
-    ExceptionCode ec;
-    if (!client || !spellingRange || (markGrammar && !grammarRange))
+    ExceptionCode ec = 0;
+    if (!client() || !spellingRange || (markGrammar && !grammarRange))
         return;
     
     // If we're not in an editable node, bail.
@@ -2159,42 +2329,188 @@
     int spellingRangeEndOffset = 0;
     int grammarRangeStartOffset = 0;
     int grammarRangeEndOffset = 0;
+    int offsetDueToReplacement = 0;
+    int paragraphLength = 0;
+    int selectionOffset = 0;
+    int ambiguousBoundaryOffset = -1;
+    bool selectionChanged = false;
+    bool restoreSelectionAfterChange = false;
+    bool adjustSelectionForParagraphBoundaries = false;
     String paragraphString;
+    RefPtr<Range> paragraphRange;
     
     if (markGrammar) {
         // The spelling range should be contained in the paragraph-aligned extension of the grammar range.
-        RefPtr<Range> paragraphRange = paragraphAlignedRangeForRange(grammarRange, grammarRangeStartOffset, paragraphString);
+        paragraphRange = paragraphAlignedRangeForRange(grammarRange, grammarRangeStartOffset, paragraphString);
         RefPtr<Range> offsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), paragraphRange->startPosition(), spellingRange->startPosition());
         spellingRangeStartOffset = TextIterator::rangeLength(offsetAsRange.get());
         grammarRangeEndOffset = grammarRangeStartOffset + TextIterator::rangeLength(grammarRange);
     } else {
-        RefPtr<Range> paragraphRange = paragraphAlignedRangeForRange(spellingRange, spellingRangeStartOffset, paragraphString);
+        paragraphRange = paragraphAlignedRangeForRange(spellingRange, spellingRangeStartOffset, paragraphString);
     }
     spellingRangeEndOffset = spellingRangeStartOffset + TextIterator::rangeLength(spellingRange);
-    if (paragraphString.length() == 0 || (spellingRangeStartOffset >= spellingRangeEndOffset && (!markGrammar || grammarRangeStartOffset >= grammarRangeEndOffset)))
+    paragraphLength = paragraphString.length();
+    if (paragraphLength <= 0 || (spellingRangeStartOffset >= spellingRangeEndOffset && (!markGrammar || grammarRangeStartOffset >= grammarRangeEndOffset)))
         return;
     
+    if (performTextCheckingReplacements) {
+        if (m_frame->selection()->selectionType() == VisibleSelection::CaretSelection) {
+            // Attempt to save the caret position so we can restore it later if needed
+            RefPtr<Range> offsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), paragraphRange->startPosition(), paragraphRange->startPosition());
+            Position caretPosition = m_frame->selection()->end();
+            offsetAsRange->setEnd(caretPosition.containerNode(), caretPosition.computeOffsetInContainerNode(), ec);
+            if (!ec) {
+                selectionOffset = TextIterator::rangeLength(offsetAsRange.get());
+                restoreSelectionAfterChange = true;
+                if (selectionOffset > 0 && (selectionOffset > paragraphLength || paragraphString[selectionOffset - 1] == newlineCharacter))
+                    adjustSelectionForParagraphBoundaries = true;
+                if (selectionOffset > 0 && selectionOffset <= paragraphLength && isAmbiguousBoundaryCharacter(paragraphString[selectionOffset - 1]))
+                    ambiguousBoundaryOffset = selectionOffset - 1;
+            }
+        }
+    }
+    
     Vector<TextCheckingResult> results;
-    client->checkSpellingAndGrammarOfParagraph(paragraphString.characters(), paragraphString.length(), markGrammar, results);
+    uint64_t checkingTypes = 0;
+    if (markSpelling)
+        checkingTypes |= TextCheckingTypeSpelling;
+    if (markGrammar)
+        checkingTypes |= TextCheckingTypeGrammar;
+    if (performTextCheckingReplacements) {
+        if (isAutomaticLinkDetectionEnabled())
+            checkingTypes |= TextCheckingTypeLink;
+        if (isAutomaticQuoteSubstitutionEnabled())
+            checkingTypes |= TextCheckingTypeQuote;
+        if (isAutomaticDashSubstitutionEnabled())
+            checkingTypes |= TextCheckingTypeDash;
+        if (isAutomaticTextReplacementEnabled())
+            checkingTypes |= TextCheckingTypeReplacement;
+        if (markSpelling && isAutomaticSpellingCorrectionEnabled())
+            checkingTypes |= TextCheckingTypeCorrection;
+    }
+    client()->checkTextOfParagraph(paragraphString.characters(), paragraphLength, checkingTypes, results);
     
     for (unsigned i = 0; i < results.size(); i++) {
         const TextCheckingResult* result = &results[i];
-        if (result->resultType == 1 && result->location >= spellingRangeStartOffset && result->location + result->length <= spellingRangeEndOffset) {
-            ASSERT(result->length > 0 && result->location >= 0);
-            RefPtr<Range> misspellingRange = TextIterator::subrange(spellingRange, result->location - spellingRangeStartOffset, result->length);
+        int resultLocation = result->location + offsetDueToReplacement;
+        int resultLength = result->length;
+        if (markSpelling && result->type == TextCheckingTypeSpelling && resultLocation >= spellingRangeStartOffset && resultLocation + resultLength <= spellingRangeEndOffset) {
+            ASSERT(resultLength > 0 && resultLocation >= 0);
+            RefPtr<Range> misspellingRange = TextIterator::subrange(spellingRange, resultLocation - spellingRangeStartOffset, resultLength);
             misspellingRange->startContainer(ec)->document()->addMarker(misspellingRange.get(), DocumentMarker::Spelling);
-        } else if (markGrammar && result->resultType == 2 && result->location < grammarRangeEndOffset && result->location + result->length > grammarRangeStartOffset) {
-            ASSERT(result->length > 0 && result->location >= 0);
+        } else if (markGrammar && result->type == TextCheckingTypeGrammar && resultLocation < grammarRangeEndOffset && resultLocation + resultLength > grammarRangeStartOffset) {
+            ASSERT(resultLength > 0 && resultLocation >= 0);
             for (unsigned j = 0; j < result->details.size(); j++) {
                 const GrammarDetail* detail = &result->details[j];
                 ASSERT(detail->length > 0 && detail->location >= 0);
-                if (result->location + detail->location >= grammarRangeStartOffset && result->location + detail->location + detail->length <= grammarRangeEndOffset) {
-                    RefPtr<Range> badGrammarRange = TextIterator::subrange(grammarRange, result->location + detail->location - grammarRangeStartOffset, detail->length);
+                if (resultLocation + detail->location >= grammarRangeStartOffset && resultLocation + detail->location + detail->length <= grammarRangeEndOffset) {
+                    RefPtr<Range> badGrammarRange = TextIterator::subrange(grammarRange, resultLocation + detail->location - grammarRangeStartOffset, detail->length);
                     grammarRange->startContainer(ec)->document()->addMarker(badGrammarRange.get(), DocumentMarker::Grammar, detail->userDescription);
                 }
             }
+        } else if (performTextCheckingReplacements && resultLocation + resultLength <= spellingRangeEndOffset && resultLocation + resultLength >= spellingRangeStartOffset &&
+                    (result->type == TextCheckingTypeLink
+                    || result->type == TextCheckingTypeQuote
+                    || result->type == TextCheckingTypeDash
+                    || result->type == TextCheckingTypeReplacement
+                    || result->type == TextCheckingTypeCorrection)) {
+            // In this case the result range just has to touch the spelling range, so we can handle replacing non-word text such as punctuation.
+            ASSERT(resultLength > 0 && resultLocation >= 0);
+            int replacementLength = result->replacement.length();
+            bool doReplacement = (replacementLength > 0);
+            RefPtr<Range> rangeToReplace = TextIterator::subrange(paragraphRange.get(), resultLocation, resultLength);
+            VisibleSelection selectionToReplace(rangeToReplace.get(), DOWNSTREAM);
+        
+            // avoid correcting text after an ambiguous boundary character has been typed
+            // FIXME: this is required until 6853027 is fixed and text checking can do this for us
+            if (ambiguousBoundaryOffset >= 0 && resultLocation + resultLength == ambiguousBoundaryOffset)
+                doReplacement = false;
+
+            // adding links should be done only immediately after they are typed
+            if (result->type == TextCheckingTypeLink && selectionOffset > resultLocation + resultLength + 1)
+                doReplacement = false;
+
+            // Don't correct spelling in an already-corrected word.
+            if (doReplacement && result->type == TextCheckingTypeCorrection) {
+                Node* node = rangeToReplace->startContainer();
+                int startOffset = rangeToReplace->startOffset();
+                int endOffset = startOffset + replacementLength;
+                Vector<DocumentMarker> markers = node->document()->markersForNode(node);
+                size_t markerCount = markers.size();
+                for (size_t i = 0; i < markerCount; ++i) {
+                    const DocumentMarker& marker = markers[i];
+                    if (marker.type == DocumentMarker::Replacement && static_cast<int>(marker.startOffset) < endOffset && static_cast<int>(marker.endOffset) > startOffset) {
+                        doReplacement = false;
+                        break;
+                    }
+                    if (static_cast<int>(marker.startOffset) >= endOffset)
+                        break;
+                }
+            }
+            if (doReplacement && selectionToReplace != m_frame->selection()->selection()) {
+                if (m_frame->shouldChangeSelection(selectionToReplace)) {
+                    m_frame->selection()->setSelection(selectionToReplace);
+                    selectionChanged = true;
+                } else {
+                    doReplacement = false;
+                }
+            }
+            if (doReplacement) {
+                if (result->type == TextCheckingTypeLink) {
+                    restoreSelectionAfterChange = false;
+                    if (canEditRichly())
+                        applyCommand(CreateLinkCommand::create(m_frame->document(), result->replacement));
+                } else if (canEdit() && shouldInsertText(result->replacement, rangeToReplace.get(), EditorInsertActionTyped)) {
+                    String replacedString;
+                    if (result->type == TextCheckingTypeCorrection)
+                        replacedString = plainText(rangeToReplace.get());
+                    replaceSelectionWithText(result->replacement, false, false);
+                    spellingRangeEndOffset += replacementLength - resultLength;
+                    offsetDueToReplacement += replacementLength - resultLength;
+                    if (resultLocation < selectionOffset)
+                        selectionOffset += replacementLength - resultLength;
+                    if (result->type == TextCheckingTypeCorrection) {
+                        // Add a marker so that corrections can easily be undone and won't be re-corrected.
+                        RefPtr<Range> replacedRange = TextIterator::subrange(paragraphRange.get(), resultLocation, replacementLength);
+                        replacedRange->startContainer()->document()->addMarker(replacedRange.get(), DocumentMarker::Replacement, replacedString);
+                    }
+                }
+            }
         }
     }
+    
+    if (selectionChanged) {
+        // Restore the caret position if we have made any replacements
+        setEnd(paragraphRange.get(), endOfParagraph(startOfNextParagraph(paragraphRange->startPosition())));
+        int newLength = TextIterator::rangeLength(paragraphRange.get());
+        if (restoreSelectionAfterChange && selectionOffset >= 0 && selectionOffset <= newLength) {
+            RefPtr<Range> selectionRange = TextIterator::subrange(paragraphRange.get(), 0, selectionOffset);
+            m_frame->selection()->moveTo(selectionRange->endPosition(), DOWNSTREAM);
+            if (adjustSelectionForParagraphBoundaries)
+                m_frame->selection()->modify(SelectionController::MOVE, SelectionController::FORWARD, CharacterGranularity);
+        } else {
+            // If this fails for any reason, the fallback is to go one position beyond the last replacement
+            m_frame->selection()->moveTo(m_frame->selection()->end());
+            m_frame->selection()->modify(SelectionController::MOVE, SelectionController::FORWARD, CharacterGranularity);
+        }
+    }
+}
+
+void Editor::changeBackToReplacedString(const String& replacedString)
+{
+    if (replacedString.isEmpty())
+        return;
+
+    RefPtr<Range> selection = selectedRange();
+    if (!shouldInsertText(replacedString, selection.get(), EditorInsertActionPasted))
+        return;
+        
+    String paragraphString;
+    int selectionOffset;
+    RefPtr<Range> paragraphRange = paragraphAlignedRangeForRange(selection.get(), selectionOffset, paragraphString);
+    replaceSelectionWithText(replacedString, false, false);
+    RefPtr<Range> changedRange = TextIterator::subrange(paragraphRange.get(), selectionOffset, replacedString.length());
+    changedRange->startContainer()->document()->addMarker(changedRange.get(), DocumentMarker::Replacement, String());
 }
 
 #endif
@@ -2204,9 +2520,10 @@
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
     if (!isContinuousSpellCheckingEnabled())
         return;
-    markAllMisspellingsAndBadGrammarInRanges(client(), spellingSelection.toNormalizedRange().get(), markGrammar && isGrammarCheckingEnabled(), grammarSelection.toNormalizedRange().get());
+    markAllMisspellingsAndBadGrammarInRanges(true, spellingSelection.toNormalizedRange().get(), markGrammar && isGrammarCheckingEnabled(), grammarSelection.toNormalizedRange().get(), false);
 #else
-    markMisspellings(spellingSelection);
+    RefPtr<Range> firstMisspellingRange;
+    markMisspellings(spellingSelection, firstMisspellingRange);
     if (markGrammar)
         markBadGrammar(grammarSelection);
 #endif
@@ -2269,13 +2586,13 @@
     if (end.node() != m_compositionNode)
         return false;
 
-    if (static_cast<unsigned>(start.m_offset) < m_compositionStart)
+    if (static_cast<unsigned>(start.deprecatedEditingOffset()) < m_compositionStart)
         return false;
-    if (static_cast<unsigned>(end.m_offset) > m_compositionEnd)
+    if (static_cast<unsigned>(end.deprecatedEditingOffset()) > m_compositionEnd)
         return false;
 
-    selectionStart = start.m_offset - m_compositionStart;
-    selectionEnd = start.m_offset - m_compositionEnd;
+    selectionStart = start.deprecatedEditingOffset() - m_compositionStart;
+    selectionEnd = start.deprecatedEditingOffset() - m_compositionEnd;
     return true;
 }
 
diff --git a/WebCore/editing/Editor.h b/WebCore/editing/Editor.h
index ce8fa0f..67a4b59 100644
--- a/WebCore/editing/Editor.h
+++ b/WebCore/editing/Editor.h
@@ -197,9 +197,29 @@
     Vector<String> guessesForUngrammaticalSelection();
     Vector<String> guessesForMisspelledOrUngrammaticalSelection(bool& misspelled, bool& ungrammatical);
     void markMisspellingsAfterTypingToPosition(const VisiblePosition&);
-    void markMisspellings(const VisibleSelection&);
+    void markMisspellings(const VisibleSelection&, RefPtr<Range>& firstMisspellingRange);
     void markBadGrammar(const VisibleSelection&);
     void markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection);
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    void uppercaseWord();
+    void lowercaseWord();
+    void capitalizeWord();
+    void showSubstitutionsPanel();
+    bool substitutionsPanelIsShowing();
+    void toggleSmartInsertDelete();
+    bool isAutomaticQuoteSubstitutionEnabled();
+    void toggleAutomaticQuoteSubstitution();
+    bool isAutomaticLinkDetectionEnabled();
+    void toggleAutomaticLinkDetection();
+    bool isAutomaticDashSubstitutionEnabled();
+    void toggleAutomaticDashSubstitution();
+    bool isAutomaticTextReplacementEnabled();
+    void toggleAutomaticTextReplacement();
+    bool isAutomaticSpellingCorrectionEnabled();
+    void toggleAutomaticSpellingCorrection();
+    void markAllMisspellingsAndBadGrammarInRanges(bool markSpelling, Range* spellingRange, bool markGrammar, Range* grammarRange, bool performTextCheckingReplacements);
+    void changeBackToReplacedString(const String& replacedString);
+#endif
     void advanceToNextMisspelling(bool startBeforeSelection = false);
     void showSpellingGuessPanel();
     bool spellingPanelIsShowing();
diff --git a/WebCore/editing/EditorCommand.cpp b/WebCore/editing/EditorCommand.cpp
index 0090df7..5a189d4 100644
--- a/WebCore/editing/EditorCommand.cpp
+++ b/WebCore/editing/EditorCommand.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 
 #include "AtomicString.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "CreateLinkCommand.h"
diff --git a/WebCore/editing/FormatBlockCommand.cpp b/WebCore/editing/FormatBlockCommand.cpp
index 88169be..d92f365 100644
--- a/WebCore/editing/FormatBlockCommand.cpp
+++ b/WebCore/editing/FormatBlockCommand.cpp
@@ -124,7 +124,7 @@
     appendNode(placeholder, blockNode);
     
     VisiblePosition destination(Position(placeholder.get(), 0));
-    if (paragraphStart == paragraphEnd && !lineBreakExistsAtPosition(paragraphStart)) {
+    if (paragraphStart == paragraphEnd && !lineBreakExistsAtVisiblePosition(paragraphStart)) {
         setEndingSelection(destination);
         return;
     }
diff --git a/WebCore/editing/IndentOutdentCommand.cpp b/WebCore/editing/IndentOutdentCommand.cpp
index 9444b11..0f9b106 100644
--- a/WebCore/editing/IndentOutdentCommand.cpp
+++ b/WebCore/editing/IndentOutdentCommand.cpp
@@ -200,7 +200,7 @@
     VisiblePosition visibleEndOfParagraph = endOfParagraph(visibleStartOfParagraph);
 
     Node* enclosingNode = enclosingNodeOfType(visibleStartOfParagraph.deepEquivalent(), &isListOrIndentBlockquote);
-    if (!enclosingNode)
+    if (!enclosingNode || !isContentEditable(enclosingNode->parentNode()))  // We can't outdent if there is no place to go!
         return;
 
     // Use InsertListCommand to remove the selection from the list
@@ -216,11 +216,24 @@
     // The selection is inside a blockquote
     VisiblePosition positionInEnclosingBlock = VisiblePosition(Position(enclosingNode, 0));
     VisiblePosition startOfEnclosingBlock = startOfBlock(positionInEnclosingBlock);
-    VisiblePosition endOfEnclosingBlock = endOfBlock(positionInEnclosingBlock);
+    VisiblePosition lastPositionInEnclosingBlock = VisiblePosition(Position(enclosingNode, enclosingNode->childNodeCount()));
+    VisiblePosition endOfEnclosingBlock = endOfBlock(lastPositionInEnclosingBlock);
     if (visibleStartOfParagraph == startOfEnclosingBlock &&
         visibleEndOfParagraph == endOfEnclosingBlock) {
         // The blockquote doesn't contain anything outside the paragraph, so it can be totally removed.
+        Node* splitPoint = enclosingNode->nextSibling();
         removeNodePreservingChildren(enclosingNode);
+        // outdentRegion() assumes it is operating on the first paragraph of an enclosing blockquote, but if there are multiply nested blockquotes and we've
+        // just removed one, then this assumption isn't true. By splitting the next containing blockquote after this node, we keep this assumption true
+        if (splitPoint) {
+            if (Node* splitPointParent = splitPoint->parentNode()) {
+                if (isIndentBlockquote(splitPointParent)
+                    && !isIndentBlockquote(splitPoint)
+                    && isContentEditable(splitPointParent->parentNode())) // We can't outdent if there is no place to go!
+                    splitElement(static_cast<Element*>(splitPointParent), splitPoint);
+            }
+        }
+        
         updateLayout();
         visibleStartOfParagraph = VisiblePosition(visibleStartOfParagraph.deepEquivalent());
         visibleEndOfParagraph = VisiblePosition(visibleEndOfParagraph.deepEquivalent());
@@ -228,6 +241,7 @@
             insertNodeAt(createBreakElement(document()), visibleStartOfParagraph.deepEquivalent());
         if (visibleEndOfParagraph.isNotNull() && !isEndOfParagraph(visibleEndOfParagraph))
             insertNodeAt(createBreakElement(document()), visibleEndOfParagraph.deepEquivalent());
+
         return;
     }
     Node* enclosingBlockFlow = enclosingBlockFlowElement(visibleStartOfParagraph);
diff --git a/WebCore/editing/InsertLineBreakCommand.cpp b/WebCore/editing/InsertLineBreakCommand.cpp
index a5c588d..f020459 100644
--- a/WebCore/editing/InsertLineBreakCommand.cpp
+++ b/WebCore/editing/InsertLineBreakCommand.cpp
@@ -28,8 +28,8 @@
 
 #include "CSSMutableStyleDeclaration.h"
 #include "Document.h"
-#include "Element.h"
 #include "Frame.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "Range.h"
 #include "RenderObject.h"
@@ -108,7 +108,7 @@
     
     // FIXME: Need to merge text nodes when inserting just after or before text.
     
-    if (isEndOfParagraph(caret) && !lineBreakExistsAtPosition(caret)) {
+    if (isEndOfParagraph(caret) && !lineBreakExistsAtVisiblePosition(caret)) {
         bool needExtraLineBreak = !pos.node()->hasTagName(hrTag) && !pos.node()->hasTagName(tableTag);
         
         insertNodeAt(nodeToInsert.get(), pos);
@@ -118,7 +118,7 @@
         
         VisiblePosition endingPosition(Position(nodeToInsert.get(), 0));
         setEndingSelection(VisibleSelection(endingPosition));
-    } else if (pos.m_offset <= caretMinOffset(pos.node())) {
+    } else if (pos.deprecatedEditingOffset() <= caretMinOffset(pos.node())) {
         insertNodeAt(nodeToInsert.get(), pos);
         
         // Insert an extra br or '\n' if the just inserted one collapsed.
@@ -128,7 +128,7 @@
         setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
     // If we're inserting after all of the rendered text in a text node, or into a non-text node,
     // a simple insertion is sufficient.
-    } else if (pos.m_offset >= caretMaxOffset(pos.node()) || !pos.node()->isTextNode()) {
+    } else if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()) || !pos.node()->isTextNode()) {
         insertNodeAt(nodeToInsert.get(), pos);
         setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
     } else {
@@ -137,7 +137,7 @@
         
         // Do the split
         Text* textNode = static_cast<Text*>(pos.node());
-        splitTextNode(textNode, pos.m_offset);
+        splitTextNode(textNode, pos.deprecatedEditingOffset());
         insertNodeBefore(nodeToInsert, textNode);
         Position endingPosition = Position(textNode, 0);
         
diff --git a/WebCore/editing/InsertListCommand.cpp b/WebCore/editing/InsertListCommand.cpp
index aa48761..ec707d2 100644
--- a/WebCore/editing/InsertListCommand.cpp
+++ b/WebCore/editing/InsertListCommand.cpp
@@ -202,7 +202,8 @@
     }
     if (!listChildNode || switchListType || m_forceCreateList) {
         // Create list.
-        VisiblePosition start = startOfParagraph(endingSelection().visibleStart());
+        VisiblePosition originalStart = endingSelection().visibleStart();
+        VisiblePosition start = startOfParagraph(originalStart);
         VisiblePosition end = endOfParagraph(endingSelection().visibleEnd());
         
         // Check for adjoining lists.
@@ -251,12 +252,17 @@
             Node* listChild = enclosingListChild(insertionPos.node());
             if (listChild && listChild->hasTagName(liTag))
                 insertionPos = positionBeforeNode(listChild);
-                
+
             insertNodeAt(listElement, insertionPos);
+
+            // We inserted the list at the start of the content we're about to move
+            // Update the start of content, so we don't try to move the list into itself.  bug 19066
+            if (insertionPos == start.deepEquivalent())
+                start = startOfParagraph(originalStart);
         }
         moveParagraph(start, end, VisiblePosition(Position(placeholder.get(), 0)), true);
         if (nextList && previousList)
-            mergeIdenticalElements(static_cast<Element*>(previousList), static_cast<Element*>(nextList));
+            mergeIdenticalElements(previousList, nextList);
     }
 }
 
diff --git a/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index 0e9c291..734d8fc 100644
--- a/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -26,16 +26,17 @@
 #include "config.h"
 #include "InsertParagraphSeparatorCommand.h"
 
-#include "Document.h"
-#include "Logging.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
-#include "Text.h"
-#include "htmlediting.h"
+#include "Document.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "InsertLineBreakCommand.h"
+#include "Logging.h"
 #include "RenderObject.h"
+#include "Text.h"
+#include "htmlediting.h"
 #include "visible_units.h"
 
 namespace WebCore {
@@ -164,13 +165,13 @@
         blockToInsert = createDefaultParagraphElement(document());
     else
         blockToInsert = startBlock->cloneElementWithoutChildren();
-    
+
     //---------------------------------------------------------------------
     // Handle case when position is in the last visible position in its block,
     // including when the block is empty. 
     if (isLastInBlock) {
         if (nestNewBlock) {
-            if (isFirstInBlock && !lineBreakExistsAtPosition(visiblePos)) {
+            if (isFirstInBlock && !lineBreakExistsAtVisiblePosition(visiblePos)) {
                 // The block is empty.  Create an empty block to
                 // represent the paragraph that we're leaving.
                 RefPtr<Element> extraBlock = createDefaultParagraphElement(document());
@@ -178,8 +179,12 @@
                 appendBlockPlaceholder(extraBlock);
             }
             appendNode(blockToInsert, startBlock);
-        } else
-            insertNodeAfter(blockToInsert, startBlock);
+        } else {
+            // We can get here if we pasted a copied portion of a blockquote with a newline at the end and are trying to paste it
+            // into an unquoted area. We then don't want the newline within the blockquote or else it will also be quoted.
+            Node* highestBlockquote = highestEnclosingNodeOfType(canonicalPos, &isMailBlockquote);
+            insertNodeAfter(blockToInsert, highestBlockquote ? highestBlockquote : startBlock);
+        }
 
         appendBlockPlaceholder(blockToInsert);
         setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
@@ -195,7 +200,7 @@
         if (isFirstInBlock && !nestNewBlock)
             refNode = startBlock;
         else if (insertionPosition.node() == startBlock && nestNewBlock) {
-            refNode = startBlock->childNode(insertionPosition.m_offset);
+            refNode = startBlock->childNode(insertionPosition.deprecatedEditingOffset());
             ASSERT(refNode); // must be true or we'd be in the end of block case
         } else
             refNode = insertionPosition.node();
@@ -248,16 +253,16 @@
     if (leadingWhitespace.isNotNull()) {
         Text* textNode = static_cast<Text*>(leadingWhitespace.node());
         ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
-        replaceTextInNode(textNode, leadingWhitespace.m_offset, 1, nonBreakingSpaceString());
+        replaceTextInNode(textNode, leadingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
     
     // Split at pos if in the middle of a text node.
     if (insertionPosition.node()->isTextNode()) {
         Text* textNode = static_cast<Text*>(insertionPosition.node());
-        bool atEnd = (unsigned)insertionPosition.m_offset >= textNode->length();
-        if (insertionPosition.m_offset > 0 && !atEnd) {
-            splitTextNode(textNode, insertionPosition.m_offset);
-            insertionPosition.m_offset = 0;
+        bool atEnd = (unsigned)insertionPosition.deprecatedEditingOffset() >= textNode->length();
+        if (insertionPosition.deprecatedEditingOffset() > 0 && !atEnd) {
+            splitTextNode(textNode, insertionPosition.deprecatedEditingOffset());
+            insertionPosition.moveToOffset(0);
             visiblePos = VisiblePosition(insertionPosition);
             splitText = true;
         }
@@ -282,13 +287,13 @@
     // If the paragraph separator was inserted at the end of a paragraph, an empty line must be
     // created.  All of the nodes, starting at visiblePos, are about to be added to the new paragraph 
     // element.  If the first node to be inserted won't be one that will hold an empty line open, add a br.
-    if (isEndOfParagraph(visiblePos) && !lineBreakExistsAtPosition(visiblePos))
+    if (isEndOfParagraph(visiblePos) && !lineBreakExistsAtVisiblePosition(visiblePos))
         appendNode(createBreakElement(document()).get(), blockToInsert.get());
         
     // Move the start node and the siblings of the start node.
     if (insertionPosition.node() != startBlock) {
         Node* n = insertionPosition.node();
-        if (insertionPosition.m_offset >= caretMaxOffset(n))
+        if (insertionPosition.deprecatedEditingOffset() >= caretMaxOffset(n))
             n = n->nextSibling();
 
         while (n && n != blockToInsert) {
diff --git a/WebCore/editing/InsertTextCommand.cpp b/WebCore/editing/InsertTextCommand.cpp
index 52da5d0..bf6fd19 100644
--- a/WebCore/editing/InsertTextCommand.cpp
+++ b/WebCore/editing/InsertTextCommand.cpp
@@ -89,9 +89,9 @@
     if (start.node() != end.node() || !start.node()->isTextNode() || isTabSpanTextNode(start.node()))
         return false;
         
-    replaceTextInNode(static_cast<Text*>(start.node()), start.m_offset, end.m_offset - start.m_offset, text);
+    replaceTextInNode(static_cast<Text*>(start.node()), start.deprecatedEditingOffset(), end.deprecatedEditingOffset() - start.deprecatedEditingOffset(), text);
     
-    Position endPosition(start.node(), start.m_offset + text.length());
+    Position endPosition(start.node(), start.deprecatedEditingOffset() + text.length());
     
     // We could have inserted a part of composed character sequence,
     // so we are basically treating ending selection as a range to avoid validation.
@@ -130,8 +130,27 @@
         deleteSelection(false, true, true, false);
     }
     
+    Position startPosition(endingSelection().start());
+    
+    Position placeholder;
+    // We want to remove preserved newlines and brs that will collapse (and thus become unnecessary) when content 
+    // is inserted just before them.
+    // FIXME: We shouldn't really have to do this, but removing placeholders is a workaround for 9661.
+    // If the caret is just before a placeholder, downstream will normalize the caret to it.
+    Position downstream(startPosition.downstream());
+    if (lineBreakExistsAtPosition(downstream)) {
+        // FIXME: This doesn't handle placeholders at the end of anonymous blocks.
+        VisiblePosition caret(startPosition);
+        if (isEndOfBlock(caret) && isStartOfParagraph(caret))
+            placeholder = downstream;
+        // Don't remove the placeholder yet, otherwise the block we're inserting into would collapse before
+        // we get a chance to insert into it.  We check for a placeholder now, though, because doing so requires
+        // the creation of a VisiblePosition, and if we did that post-insertion it would force a layout.
+    }
+    
     // Insert the character at the leftmost candidate.
-    Position startPosition = endingSelection().start().upstream();
+    startPosition = startPosition.upstream();
+    
     // It is possible for the node that contains startPosition to contain only unrendered whitespace,
     // and so deleteInsignificantText could remove it.  Save the position before the node in case that happens.
     Position positionBeforeStartNode(positionBeforeNode(startPosition.node()));
@@ -148,14 +167,16 @@
     if (text == "\t") {
         endPosition = insertTab(startPosition);
         startPosition = endPosition.previous();
-        removePlaceholderAt(VisiblePosition(startPosition));
+        if (placeholder.isNotNull())
+            removePlaceholderAt(placeholder);
         m_charactersAdded += 1;
     } else {
         // Make sure the document is set up to receive text
         startPosition = prepareForTextInsertion(startPosition);
-        removePlaceholderAt(VisiblePosition(startPosition));
+        if (placeholder.isNotNull())
+            removePlaceholderAt(placeholder);
         Text *textNode = static_cast<Text *>(startPosition.node());
-        int offset = startPosition.m_offset;
+        int offset = startPosition.deprecatedEditingOffset();
 
         insertTextIntoNode(textNode, offset, text);
         endPosition = Position(textNode, offset + text.length());
@@ -207,7 +228,7 @@
     Position insertPos = VisiblePosition(pos, DOWNSTREAM).deepEquivalent();
         
     Node *node = insertPos.node();
-    unsigned int offset = insertPos.m_offset;
+    unsigned int offset = insertPos.deprecatedEditingOffset();
 
     // keep tabs coalesced in tab span
     if (isTabSpanTextNode(node)) {
diff --git a/WebCore/editing/ModifySelectionListLevel.cpp b/WebCore/editing/ModifySelectionListLevel.cpp
index 5ea658c..9a7e105 100644
--- a/WebCore/editing/ModifySelectionListLevel.cpp
+++ b/WebCore/editing/ModifySelectionListLevel.cpp
@@ -27,8 +27,8 @@
 #include "ModifySelectionListLevel.h"
 
 #include "Document.h"
-#include "Element.h"
 #include "Frame.h"
+#include "HTMLElement.h"
 #include "RenderObject.h"
 #include "SelectionController.h"
 #include "htmlediting.h"
diff --git a/WebCore/editing/MoveSelectionCommand.cpp b/WebCore/editing/MoveSelectionCommand.cpp
index 2c656e7..0a2d3f4 100644
--- a/WebCore/editing/MoveSelectionCommand.cpp
+++ b/WebCore/editing/MoveSelectionCommand.cpp
@@ -48,14 +48,14 @@
         
     // Update the position otherwise it may become invalid after the selection is deleted.
     Node *positionNode = m_position.node();
-    int positionOffset = m_position.m_offset;
+    int positionOffset = m_position.deprecatedEditingOffset();
     Position selectionEnd = selection.end();
-    int selectionEndOffset = selectionEnd.m_offset;    
+    int selectionEndOffset = selectionEnd.deprecatedEditingOffset();
     if (selectionEnd.node() == positionNode && selectionEndOffset < positionOffset) {
         positionOffset -= selectionEndOffset;
         Position selectionStart = selection.start();
         if (selectionStart.node() == positionNode) {
-            positionOffset += selectionStart.m_offset;
+            positionOffset += selectionStart.deprecatedEditingOffset();
         }
         pos = Position(positionNode, positionOffset);
     }
diff --git a/WebCore/editing/RemoveCSSPropertyCommand.h b/WebCore/editing/RemoveCSSPropertyCommand.h
index fd81307..836f9d7 100644
--- a/WebCore/editing/RemoveCSSPropertyCommand.h
+++ b/WebCore/editing/RemoveCSSPropertyCommand.h
@@ -27,6 +27,7 @@
 #define RemoveCSSPropertyCommand_h
 
 #include "EditCommand.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
 
 namespace WebCore {
diff --git a/WebCore/editing/RemoveFormatCommand.cpp b/WebCore/editing/RemoveFormatCommand.cpp
index 609ab0e..6d681ee 100644
--- a/WebCore/editing/RemoveFormatCommand.cpp
+++ b/WebCore/editing/RemoveFormatCommand.cpp
@@ -27,6 +27,7 @@
 #include "RemoveFormatCommand.h"
 
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "Editor.h"
 #include "Frame.h"
 #include "HTMLNames.h"
diff --git a/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp b/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
index 98f4282..1452f88 100644
--- a/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
+++ b/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
@@ -32,7 +32,8 @@
 namespace WebCore {
 
 RemoveNodePreservingChildrenCommand::RemoveNodePreservingChildrenCommand(PassRefPtr<Node> node)
-    : CompositeEditCommand(node->document()), m_node(node)
+    : CompositeEditCommand(node->document())
+    , m_node(node)
 {
     ASSERT(m_node);
 }
diff --git a/WebCore/editing/ReplaceNodeWithSpanCommand.cpp b/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
new file mode 100644
index 0000000..21ca924
--- /dev/null
+++ b/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ReplaceNodeWithSpanCommand.h"
+
+#include "htmlediting.h"
+#include "HTMLElement.h"
+#include "HTMLNames.h"
+#include "NamedAttrMap.h"
+
+#include <wtf/Assertions.h>
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+ReplaceNodeWithSpanCommand::ReplaceNodeWithSpanCommand(PassRefPtr<Node> node)
+    : CompositeEditCommand(node->document())
+    , m_node(node)
+{
+    ASSERT(m_node);
+}
+
+static void swapInNodePreservingAttributesAndChildren(Node* newNode, Node* nodeToReplace)
+{
+    ASSERT(nodeToReplace->inDocument());
+    ExceptionCode ec = 0;
+    Node* parentNode = nodeToReplace->parentNode();
+    parentNode->insertBefore(newNode, nodeToReplace, ec);
+    ASSERT(!ec);
+
+    for (Node* child = nodeToReplace->firstChild(); child; child = child->nextSibling()) {
+        newNode->appendChild(child, ec);
+        ASSERT(!ec);
+    }
+
+    newNode->attributes()->setAttributes(*nodeToReplace->attributes());
+
+    parentNode->removeChild(nodeToReplace, ec);
+    ASSERT(!ec);
+}
+
+void ReplaceNodeWithSpanCommand::doApply()
+{
+    if (!m_node->inDocument())
+        return;
+    if (!m_spanElement)
+        m_spanElement = createHTMLElement(m_node->document(), spanTag);
+    swapInNodePreservingAttributesAndChildren(m_spanElement.get(), m_node.get());
+}
+
+void ReplaceNodeWithSpanCommand::doUnapply()
+{
+    if (!m_spanElement->inDocument())
+        return;
+    swapInNodePreservingAttributesAndChildren(m_node.get(), m_spanElement.get());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h b/WebCore/editing/ReplaceNodeWithSpanCommand.h
similarity index 65%
copy from WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
copy to WebCore/editing/ReplaceNodeWithSpanCommand.h
index 5a55974..7b375b6 100644
--- a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
+++ b/WebCore/editing/ReplaceNodeWithSpanCommand.h
@@ -1,10 +1,10 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
- *
+ * Copyright (c) 2009 Google Inc. All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- *
+ * 
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,18 +28,35 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8XMLHttpRequestUtilities_h
-#define V8XMLHttpRequestUtilities_h
+#ifndef ReplaceNodeWithSpanCommand_h
+#define ReplaceNodeWithSpanCommand_h
 
-#include <v8.h>
+#include "CompositeEditCommand.h"
 
 namespace WebCore {
 
-// Use an array to hold dependents. It works like a ref-counted scheme.
-// A value can be added more than once to the xmlHttpRequest object.
-void createHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
-void removeHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
+class HTMLElement;
+
+// More accurately, this is ReplaceNodeWithSpanPreservingChildrenAndAttributesCommand
+class ReplaceNodeWithSpanCommand : public CompositeEditCommand {
+public:
+    static PassRefPtr<ReplaceNodeWithSpanCommand> create(PassRefPtr<Node> node)
+    {
+        return adoptRef(new ReplaceNodeWithSpanCommand(node));
+    }
+
+    HTMLElement* spanElement() { return m_spanElement.get(); }
+
+private:
+    ReplaceNodeWithSpanCommand(PassRefPtr<Node>);
+
+    virtual void doApply();
+    virtual void doUnapply();
+
+    RefPtr<Node> m_node;
+    RefPtr<HTMLElement> m_spanElement;
+};
 
 } // namespace WebCore
 
-#endif // V8XMLHttpRequestUtilities_h
+#endif // ReplaceNodeWithSpanCommand
diff --git a/WebCore/editing/ReplaceSelectionCommand.cpp b/WebCore/editing/ReplaceSelectionCommand.cpp
index 09ad985..c6da864 100644
--- a/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -28,20 +28,21 @@
 
 #include "ApplyStyleCommand.h"
 #include "BeforeTextInsertedEvent.h"
-#include "BreakBlockquoteCommand.h" 
+#include "BreakBlockquoteCommand.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "EditingText.h"
-#include "EventNames.h"
 #include "Element.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "HTMLElement.h"
-#include "HTMLInterchange.h"
 #include "HTMLInputElement.h"
+#include "HTMLInterchange.h"
 #include "HTMLNames.h"
 #include "SelectionController.h"
 #include "SmartReplace.h"
@@ -124,7 +125,7 @@
     
     Node* shadowAncestorNode = editableRoot->shadowAncestorNode();
     
-    if (!editableRoot->inlineEventListenerForType(eventNames().webkitBeforeTextInsertedEvent) &&
+    if (!editableRoot->getAttributeEventListener(eventNames().webkitBeforeTextInsertedEvent) &&
         // FIXME: Remove these checks once textareas and textfields actually register an event handler.
         !(shadowAncestorNode && shadowAncestorNode->renderer() && shadowAncestorNode->renderer()->isTextControl()) &&
         editableRoot->isContentRichlyEditable()) {
@@ -343,14 +344,22 @@
     return isInsideMailBlockquote && (numEnclosingMailBlockquotes(existing) == numEnclosingMailBlockquotes(inserted));
 }
 
-bool ReplaceSelectionCommand::shouldMergeStart(bool selectionStartWasStartOfParagraph, bool fragmentHasInterchangeNewlineAtStart)
+bool ReplaceSelectionCommand::shouldMergeStart(bool selectionStartWasStartOfParagraph, bool fragmentHasInterchangeNewlineAtStart, bool selectionStartWasInsideMailBlockquote)
 {
+    if (m_movingParagraph)
+        return false;
+    
     VisiblePosition startOfInsertedContent(positionAtStartOfInsertedContent());
     VisiblePosition prev = startOfInsertedContent.previous(true);
     if (prev.isNull())
         return false;
     
-    if (!m_movingParagraph && hasMatchingQuoteLevel(prev, positionAtEndOfInsertedContent()))
+    // When we have matching quote levels, its ok to merge more frequently.
+    // For a successful merge, we still need to make sure that the inserted content starts with the beginning of a paragraph.
+    // And we should only merge here if the selection start was inside a mail blockquote.  This prevents against removing a 
+    // blockquote from newly pasted quoted content that was pasted into an unquoted position.  If that unquoted position happens 
+    // to be right after another blockquote, we don't want to merge and risk stripping a valid block (and newline) from the pasted content.
+    if (isStartOfParagraph(startOfInsertedContent) && selectionStartWasInsideMailBlockquote && hasMatchingQuoteLevel(prev, positionAtEndOfInsertedContent()))
         return true;
 
     return !selectionStartWasStartOfParagraph && 
@@ -690,7 +699,8 @@
     moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
     // Merging forward will remove m_lastLeafInserted from the document.
     // FIXME: Maintain positions for the start and end of inserted content instead of keeping nodes.  The nodes are
-    // only ever used to create positions where inserted content starts/ends.
+    // only ever used to create positions where inserted content starts/ends.  Also, we sometimes insert content
+    // directly into text nodes already in the document, in which case tracking inserted nodes is inadequate.
     if (mergeForward) {
         m_lastLeafInserted = destination.previous().deepEquivalent().node();
         if (!m_firstNodeInserted->inDocument())
@@ -711,6 +721,9 @@
     Element* currentRoot = selection.rootEditableElement();
     ReplacementFragment fragment(document(), m_documentFragment.get(), m_matchStyle, selection);
     
+    if (performTrivialReplace(fragment))
+        return;
+    
     if (m_matchStyle)
         m_insertionStyle = styleAtPosition(selection.start());
     
@@ -772,9 +785,10 @@
         insertionPos = endingSelection().start();
     }
     
-    if (startIsInsideMailBlockquote && m_preventNesting) { 
-        // We don't want any of the pasted content to end up nested in a Mail blockquote, so first break 
-        // out of any surrounding Mail blockquotes. 
+    // We don't want any of the pasted content to end up nested in a Mail blockquote, so first break 
+    // out of any surrounding Mail blockquotes. Unless we're inserting in a table, in which case
+    // breaking the blockquote will prevent the content from actually being inserted in the table.
+    if (startIsInsideMailBlockquote && m_preventNesting && !(enclosingNodeOfType(insertionPos, &isTableStructureNode))) { 
         applyCommandToComposite(BreakBlockquoteCommand::create(document())); 
         // This will leave a br between the split. 
         Node* br = endingSelection().start().node(); 
@@ -821,6 +835,9 @@
     
     bool handledStyleSpans = handleStyleSpansBeforeInsertion(fragment, insertionPos);
     
+    // FIXME: When pasting rich content we're often prevented from heading down the fast path by style spans.  Try
+    // again here if they've been removed.
+    
     // We're finished if there is nothing to add.
     if (fragment.isEmpty() || !fragment.firstChild())
         return;
@@ -876,7 +893,7 @@
     
     // We inserted before the startBlock to prevent nesting, and the content before the startBlock wasn't in its own block and
     // didn't have a br after it, so the inserted content ended up in the same paragraph.
-    if (startBlock && insertionPos.node() == startBlock->parentNode() && (unsigned)insertionPos.m_offset < startBlock->nodeIndex() && !isStartOfParagraph(startOfInsertedContent))
+    if (startBlock && insertionPos.node() == startBlock->parentNode() && (unsigned)insertionPos.deprecatedEditingOffset() < startBlock->nodeIndex() && !isStartOfParagraph(startOfInsertedContent))
         insertNodeAt(createBreakElement(document()).get(), startOfInsertedContent.deepEquivalent());
     
     Position lastPositionToSelect;
@@ -890,13 +907,7 @@
     // the start merge so that the start merge doesn't effect our decision.
     m_shouldMergeEnd = shouldMergeEnd(selectionEndWasEndOfParagraph);
     
-    if (shouldMergeStart(selectionStartWasStartOfParagraph, fragment.hasInterchangeNewlineAtStart())) {
-        // Bail to avoid infinite recursion.
-        if (m_movingParagraph) {
-            // setting display:inline does not work for td elements in quirks mode
-            ASSERT(m_firstNodeInserted->hasTagName(tdTag));
-            return;
-        }
+    if (shouldMergeStart(selectionStartWasStartOfParagraph, fragment.hasInterchangeNewlineAtStart(), startIsInsideMailBlockquote)) {
         VisiblePosition destination = startOfInsertedContent.previous();
         VisiblePosition startOfParagraphToMove = startOfInsertedContent;
         
@@ -1092,4 +1103,38 @@
     m_lastLeafInserted = node->lastDescendant();
 }
 
+// During simple pastes, where we're just pasting a text node into a run of text, we insert the text node
+// directly into the text node that holds the selection.  This is much faster than the generalized code in
+// ReplaceSelectionCommand, and works around <https://bugs.webkit.org/show_bug.cgi?id=6148> since we don't 
+// split text nodes.
+bool ReplaceSelectionCommand::performTrivialReplace(const ReplacementFragment& fragment)
+{
+    if (!fragment.firstChild() || fragment.firstChild() != fragment.lastChild() || !fragment.firstChild()->isTextNode())
+        return false;
+        
+    // FIXME: Would be nice to handle smart replace in the fast path.
+    if (m_smartReplace || fragment.hasInterchangeNewlineAtStart() || fragment.hasInterchangeNewlineAtEnd())
+        return false;
+    
+    Text* textNode = static_cast<Text*>(fragment.firstChild());
+    // Our fragment creation code handles tabs, spaces, and newlines, so we don't have to worry about those here.
+    String text(textNode->data());
+    
+    Position start = endingSelection().start();
+    Position end = endingSelection().end();
+    
+    if (start.anchorNode() != end.anchorNode() || !start.anchorNode()->isTextNode())
+        return false;
+        
+    replaceTextInNode(static_cast<Text*>(start.anchorNode()), start.offsetInContainerNode(), end.offsetInContainerNode() - start.offsetInContainerNode(), text);
+    
+    end = Position(start.anchorNode(), start.offsetInContainerNode() + text.length());
+    
+    VisibleSelection selectionAfterReplace(m_selectReplacement ? start : end, end);
+    
+    setEndingSelection(selectionAfterReplace);
+    
+    return true;
+}
+
 } // namespace WebCore
diff --git a/WebCore/editing/ReplaceSelectionCommand.h b/WebCore/editing/ReplaceSelectionCommand.h
index 18dffa5..1cb93c3 100644
--- a/WebCore/editing/ReplaceSelectionCommand.h
+++ b/WebCore/editing/ReplaceSelectionCommand.h
@@ -31,6 +31,7 @@
 namespace WebCore {
 
 class DocumentFragment;
+class ReplacementFragment;
 
 class ReplaceSelectionCommand : public CompositeEditCommand {
 public:
@@ -57,7 +58,7 @@
     void updateNodesInserted(Node*);
     bool shouldRemoveEndBR(Node*, const VisiblePosition&);
     
-    bool shouldMergeStart(bool, bool);
+    bool shouldMergeStart(bool, bool, bool);
     bool shouldMergeEnd(bool selectEndWasEndOfParagraph);
     bool shouldMerge(const VisiblePosition&, const VisiblePosition&);
     
@@ -74,6 +75,8 @@
     
     VisiblePosition positionAtStartOfInsertedContent();
     VisiblePosition positionAtEndOfInsertedContent();
+    
+    bool performTrivialReplace(const ReplacementFragment&);
 
     RefPtr<Node> m_firstNodeInserted;
     RefPtr<Node> m_lastLeafInserted;
diff --git a/WebCore/editing/SelectionController.cpp b/WebCore/editing/SelectionController.cpp
index d606891..d0427c0 100644
--- a/WebCore/editing/SelectionController.cpp
+++ b/WebCore/editing/SelectionController.cpp
@@ -32,7 +32,6 @@
 #include "Editor.h"
 #include "Element.h"
 #include "EventHandler.h"
-#include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FocusController.h"
 #include "FloatQuad.h"
@@ -70,7 +69,7 @@
     , m_lastChangeWasHorizontalExtension(false)
     , m_isDragCaretController(isDragCaretController)
     , m_isCaretBlinkingSuspended(false)
-    , m_focused(false)
+    , m_focused(frame && frame->page() && frame->page()->focusController()->focusedFrame() == frame)
 {
 }
 
@@ -203,8 +202,7 @@
         else
             m_sel.setWithoutValidation(m_sel.end(), m_sel.start());
     // FIXME: This could be more efficient if we had an isNodeInRange function on Ranges.
-    } else if (Range::compareBoundaryPoints(m_sel.start(), Position(node, 0)) == -1 &&
-               Range::compareBoundaryPoints(m_sel.end(), Position(node, 0)) == 1) {
+    } else if (comparePositions(m_sel.start(), Position(node, 0)) == -1 && comparePositions(m_sel.end(), Position(node, 0)) == 1) {
         // If we did nothing here, when this node's renderer was destroyed, the rect that it 
         // occupied would be invalidated, but, selection gaps that change as a result of 
         // the removal wouldn't be invalidated.
@@ -214,7 +212,7 @@
 
     if (clearRenderTreeSelection) {
         RefPtr<Document> document = m_sel.start().node()->document();
-        document->updateRendering();
+        document->updateStyleIfNeeded();
         if (RenderView* view = toRenderView(document->renderer()))
             view->clearSelection();
     }
@@ -252,7 +250,53 @@
     }
 }
 
-VisiblePosition SelectionController::modifyExtendingRightForward(TextGranularity granularity)
+TextDirection SelectionController::directionOfEnclosingBlock() {
+    Node* n = m_sel.extent().node();
+    Node* enclosingBlockNode = enclosingBlock(n);
+    if (!enclosingBlockNode)
+        return LTR;
+    RenderObject* renderer = enclosingBlockNode->renderer();
+    if (renderer)
+        return renderer->style()->direction();
+    return LTR;
+}
+
+VisiblePosition SelectionController::modifyExtendingRight(TextGranularity granularity)
+{
+    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+
+    // The difference between modifyExtendingRight and modifyExtendingForward is:
+    // modifyExtendingForward always extends forward logically.
+    // modifyExtendingRight behaves the same as modifyExtendingForward except for extending character or word,
+    // it extends forward logically if the enclosing block is LTR direction,
+    // but it extends backward logically if the enclosing block is RTL direction.
+    switch (granularity) {
+        case CharacterGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = pos.next(true);                
+            else
+                pos = pos.previous(true);
+            break;
+        case WordGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = nextWordPosition(pos);
+            else
+                pos = previousWordPosition(pos);
+            break;
+        case SentenceGranularity:
+        case LineGranularity:
+        case ParagraphGranularity:
+        case SentenceBoundary:
+        case LineBoundary:
+        case ParagraphBoundary:
+        case DocumentBoundary:
+            // FIXME: implement all of the above?
+            pos = modifyExtendingForward(granularity);
+    }
+    return pos;
+}    
+        
+VisiblePosition SelectionController::modifyExtendingForward(TextGranularity granularity)
 {
     VisiblePosition pos(m_sel.extent(), m_sel.affinity());
     switch (granularity) {
@@ -275,7 +319,7 @@
             pos = endOfSentence(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = endOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = logicalEndOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = endOfParagraph(VisiblePosition(m_sel.end(), m_sel.affinity()));
@@ -349,7 +393,7 @@
             pos = endOfSentence(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = endOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = logicalEndOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = endOfParagraph(VisiblePosition(m_sel.end(), m_sel.affinity()));
@@ -366,10 +410,44 @@
     return pos;
 }
 
-VisiblePosition SelectionController::modifyExtendingLeftBackward(TextGranularity granularity)
+VisiblePosition SelectionController::modifyExtendingLeft(TextGranularity granularity)
 {
     VisiblePosition pos(m_sel.extent(), m_sel.affinity());
-        
+
+    // The difference between modifyExtendingLeft and modifyExtendingBackward is:
+    // modifyExtendingBackward always extends backward logically.
+    // modifyExtendingLeft behaves the same as modifyExtendingBackward except for extending character or word,
+    // it extends backward logically if the enclosing block is LTR direction,
+    // but it extends forward logically if the enclosing block is RTL direction.
+    switch (granularity) {
+        case CharacterGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = pos.previous(true);
+            else
+                pos = pos.next(true);
+            break;
+        case WordGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = previousWordPosition(pos);
+            else
+                pos = nextWordPosition(pos);
+            break;
+        case SentenceGranularity:
+        case LineGranularity:
+        case ParagraphGranularity:
+        case SentenceBoundary:
+        case LineBoundary:
+        case ParagraphBoundary:
+        case DocumentBoundary:
+            pos = modifyExtendingBackward(granularity);
+    }
+    return pos;
+}
+       
+VisiblePosition SelectionController::modifyExtendingBackward(TextGranularity granularity)
+{
+    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+
     // Extending a selection backward by word or character from just after a table selects
     // the table.  This "makes sense" from the user perspective, esp. when deleting.
     // It was done here instead of in VisiblePosition because we want VPs to iterate
@@ -394,7 +472,7 @@
             pos = startOfSentence(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = startOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = logicalStartOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = startOfParagraph(VisiblePosition(m_sel.start(), m_sel.affinity()));
@@ -461,7 +539,7 @@
             pos = startOfSentence(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = startOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = logicalStartOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = startOfParagraph(VisiblePosition(m_sel.start(), m_sel.affinity()));
@@ -501,11 +579,11 @@
             if (alter == MOVE)
                 pos = modifyMovingRight(granularity);
             else
-                pos = modifyExtendingRightForward(granularity);
+                pos = modifyExtendingRight(granularity);
             break;
         case FORWARD:
             if (alter == EXTEND)
-                pos = modifyExtendingRightForward(granularity);
+                pos = modifyExtendingForward(granularity);
             else
                 pos = modifyMovingForward(granularity);
             break;
@@ -513,11 +591,11 @@
             if (alter == MOVE)
                 pos = modifyMovingLeft(granularity);
             else
-                pos = modifyExtendingLeftBackward(granularity);
+                pos = modifyExtendingLeft(granularity);
             break;
         case BACKWARD:
             if (alter == EXTEND)
-                pos = modifyExtendingLeftBackward(granularity);
+                pos = modifyExtendingBackward(granularity);
             else
                 pos = modifyMovingBackward(granularity);
             break;
@@ -735,7 +813,7 @@
         return;
     }
 
-    m_sel.start().node()->document()->updateRendering();
+    m_sel.start().node()->document()->updateStyleIfNeeded();
     
     m_caretRect = IntRect();
         
@@ -796,11 +874,20 @@
 IntRect SelectionController::localCaretRect() const
 {
     if (m_needsLayout)
-        const_cast<SelectionController *>(this)->layout();
+        const_cast<SelectionController*>(this)->layout();
     
     return m_caretRect;
 }
 
+IntRect SelectionController::absoluteBoundsForLocalRect(const IntRect& rect) const
+{
+    RenderObject* caretPainter = caretRenderer();
+    if (!caretPainter)
+        return IntRect();
+        
+    return caretPainter->localToAbsoluteQuad(FloatRect(rect)).enclosingBoundingBox();
+}
+
 IntRect SelectionController::absoluteCaretBounds()
 {
     recomputeCaretRect();
@@ -819,13 +906,7 @@
 
 IntRect SelectionController::caretRepaintRect() const
 {
-    IntRect localRect = repaintRectForCaret(localCaretRect());
-    
-    RenderObject* caretPainter = caretRenderer();
-    if (caretPainter)
-        return caretPainter->localToAbsoluteQuad(FloatRect(localRect)).enclosingBoundingBox();
-
-    return IntRect();
+    return absoluteBoundsForLocalRect(repaintRectForCaret(localCaretRect()));
 }
 
 bool SelectionController::recomputeCaretRect()
@@ -841,22 +922,26 @@
         return false;
 
     IntRect oldRect = m_caretRect;
-    m_needsLayout = true;
     IntRect newRect = localCaretRect();
     if (oldRect == newRect && !m_absCaretBoundsDirty)
         return false;
 
-    IntRect oldAbsRepaintRect = m_absCaretBounds;
-    m_absCaretBounds = caretRepaintRect();
+    IntRect oldAbsCaretBounds = m_absCaretBounds;
+    // FIXME: Rename m_caretRect to m_localCaretRect.
+    m_absCaretBounds = absoluteBoundsForLocalRect(m_caretRect);
     m_absCaretBoundsDirty = false;
     
-    if (oldAbsRepaintRect == m_absCaretBounds)
+    if (oldAbsCaretBounds == m_absCaretBounds)
         return false;
+        
+    IntRect oldAbsoluteCaretRepaintBounds = m_absoluteCaretRepaintBounds;
+    // We believe that we need to inflate the local rect before transforming it to obtain the repaint bounds.
+    m_absoluteCaretRepaintBounds = caretRepaintRect();
     
     if (RenderView* view = toRenderView(m_frame->document()->renderer())) {
         // FIXME: make caret repainting container-aware.
-        view->repaintRectangleInViewAndCompositedLayers(oldAbsRepaintRect, false);
-        view->repaintRectangleInViewAndCompositedLayers(m_absCaretBounds, false);
+        view->repaintRectangleInViewAndCompositedLayers(oldAbsoluteCaretRepaintBounds, false);
+        view->repaintRectangleInViewAndCompositedLayers(m_absoluteCaretRepaintBounds, false);
     }
 
     return true;
@@ -932,9 +1017,9 @@
         if (selected) {
             int offset = 0;
             if (r->node() == m_sel.start().node())
-                offset = m_sel.start().m_offset;
+                offset = m_sel.start().deprecatedEditingOffset();
             else if (r->node() == m_sel.end().node())
-                offset = m_sel.end().m_offset;
+                offset = m_sel.end().deprecatedEditingOffset();
                 
             int pos;
             InlineTextBox *box = textRenderer->findNextInlineTextBox(offset, pos);
@@ -1179,7 +1264,7 @@
     // RenderTheme::isFocused() check if the frame is active, we have to
     // update style and theme state that depended on those.
     if (Node* node = m_frame->document()->focusedNode()) {
-        node->setChanged();
+        node->setNeedsStyleRecalc();
         if (RenderObject* renderer = node->renderer())
             if (renderer && renderer->style()->hasAppearance())
                 theme()->stateChanged(renderer, FocusState);
@@ -1202,8 +1287,6 @@
     m_focused = flag;
 
     focusedOrActiveStateChanged();
-
-    m_frame->document()->dispatchWindowEvent(flag ? eventNames().focusEvent : eventNames().blurEvent, false, false);
 }
 
 bool SelectionController::isFocusedAndActive() const
diff --git a/WebCore/editing/SelectionController.h b/WebCore/editing/SelectionController.h
index 21e849d..bbd343c 100644
--- a/WebCore/editing/SelectionController.h
+++ b/WebCore/editing/SelectionController.h
@@ -102,6 +102,7 @@
     bool isRange() const { return m_sel.isRange(); }
     bool isCaretOrRange() const { return m_sel.isCaretOrRange(); }
     bool isInPasswordField() const;
+    bool isAll(StayInEditableContent stayInEditableContent = MustStayInEditableContent) const { return m_sel.isAll(stayInEditableContent); }
     
     PassRefPtr<Range> toNormalizedRange() const { return m_sel.toNormalizedRange(); }
 
@@ -119,6 +120,7 @@
 
     // Focus
     void setFocused(bool);
+    bool isFocused() const { return m_focused; }
     bool isFocusedAndActive() const;
     void pageActivationChanged();
 
@@ -130,10 +132,14 @@
 private:
     enum EPositionType { START, END, BASE, EXTENT };
 
-    VisiblePosition modifyExtendingRightForward(TextGranularity);
+    TextDirection directionOfEnclosingBlock();
+
+    VisiblePosition modifyExtendingRight(TextGranularity);
+    VisiblePosition modifyExtendingForward(TextGranularity);
     VisiblePosition modifyMovingRight(TextGranularity);
     VisiblePosition modifyMovingForward(TextGranularity);
-    VisiblePosition modifyExtendingLeftBackward(TextGranularity);
+    VisiblePosition modifyExtendingLeft(TextGranularity);
+    VisiblePosition modifyExtendingBackward(TextGranularity);
     VisiblePosition modifyMovingLeft(TextGranularity);
     VisiblePosition modifyMovingBackward(TextGranularity);
 
@@ -142,7 +148,7 @@
 
     int xPosForVerticalArrowNavigation(EPositionType);
     
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || PLATFORM(GTK)
     void notifyAccessibilityForSelectionChange();
 #else
     void notifyAccessibilityForSelectionChange() {};
@@ -150,6 +156,8 @@
 
     void focusedOrActiveStateChanged();
     bool caretRendersInsideNode(Node*) const;
+    
+    IntRect absoluteBoundsForLocalRect(const IntRect&) const;
 
     Frame* m_frame;
     int m_xPosForVerticalArrowNavigation;
@@ -158,6 +166,7 @@
 
     IntRect m_caretRect;        // caret rect in coords local to the renderer responsible for painting the caret
     IntRect m_absCaretBounds;   // absolute bounding rect for the caret
+    IntRect m_absoluteCaretRepaintBounds;
     
     bool m_needsLayout : 1;       // true if the caret and expectedVisible rectangles need to be calculated
     bool m_absCaretBoundsDirty: 1;
@@ -187,3 +196,4 @@
 #endif
 
 #endif // SelectionController_h
+
diff --git a/WebCore/editing/TextAffinity.h b/WebCore/editing/TextAffinity.h
index 5562cc4..a5565c7 100644
--- a/WebCore/editing/TextAffinity.h
+++ b/WebCore/editing/TextAffinity.h
@@ -38,20 +38,22 @@
 // From NSTextView.h:
 // NSSelectionAffinityUpstream = 0
 // NSSelectionAffinityDownstream = 1
-typedef enum { UPSTREAM = 0, DOWNSTREAM = 1 } EAffinity;
+enum EAffinity { UPSTREAM = 0, DOWNSTREAM = 1 };
+
+} // namespace WebCore
 
 #ifdef __OBJC__
-inline NSSelectionAffinity kit(EAffinity affinity)
+
+inline NSSelectionAffinity kit(WebCore::EAffinity affinity)
 {
     return static_cast<NSSelectionAffinity>(affinity);
 }
 
-inline EAffinity core(NSSelectionAffinity affinity)
+inline WebCore::EAffinity core(NSSelectionAffinity affinity)
 {
-    return static_cast<EAffinity>(affinity);
+    return static_cast<WebCore::EAffinity>(affinity);
 }
-#endif
 
-} // namespace WebCore
+#endif
 
 #endif // TextAffinity_h
diff --git a/WebCore/editing/TextIterator.cpp b/WebCore/editing/TextIterator.cpp
index 2d7e641..b311853 100644
--- a/WebCore/editing/TextIterator.cpp
+++ b/WebCore/editing/TextIterator.cpp
@@ -29,7 +29,7 @@
 
 #include "CharacterNames.h"
 #include "Document.h"
-#include "Element.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "htmlediting.h"
 #include "InlineTextBox.h"
@@ -103,6 +103,8 @@
     , m_endContainer(0)
     , m_endOffset(0)
     , m_positionNode(0)
+    , m_textCharacters(0)
+    , m_textLength(0)
     , m_lastCharacter(0)
     , m_emitCharactersBetweenAllVisiblePositions(false)
     , m_enterTextControls(false)
@@ -116,6 +118,8 @@
     , m_endContainer(0)
     , m_endOffset(0)
     , m_positionNode(0)
+    , m_textCharacters(0)
+    , m_textLength(0)
     , m_emitCharactersBetweenAllVisiblePositions(emitCharactersBetweenAllVisiblePositions)
     , m_enterTextControls(enterTextControls)
 {
@@ -609,11 +613,13 @@
     if (!m_node->renderer() || m_node->renderer()->style()->visibility() != VISIBLE)
         return false;
     
-    // The currPos.isNotNull() check is needed because positions in non-html content
-    // (like svg) do not have visible positions, and we don't want to emit for them either.
+    // The startPos.isNotNull() check is needed because the start could be before the body,
+    // and in that case we'll get null. We don't want to put in newlines at the start in that case.
+    // The currPos.isNotNull() check is needed because positions in non-HTML content
+    // (like SVG) do not have visible positions, and we don't want to emit for them either.
     VisiblePosition startPos = VisiblePosition(m_startContainer, m_startOffset, DOWNSTREAM);
     VisiblePosition currPos = VisiblePosition(m_node, 0, DOWNSTREAM);
-    return currPos.isNotNull() && !inSameLine(startPos, currPos);
+    return startPos.isNotNull() && currPos.isNotNull() && !inSameLine(startPos, currPos);
 }
 
 bool TextIterator::shouldEmitSpaceBeforeAndAfterNode(Node* node)
@@ -1558,7 +1564,7 @@
                 Position runEnd = VisiblePosition(runStart).next().deepEquivalent();
                 if (runEnd.isNotNull()) {
                     ExceptionCode ec = 0;
-                    textRunRange->setEnd(runEnd.node(), runEnd.m_offset, ec);
+                    textRunRange->setEnd(runEnd.node(), runEnd.deprecatedEditingOffset(), ec);
                     ASSERT(!ec);
                 }
             }
diff --git a/WebCore/editing/TypingCommand.cpp b/WebCore/editing/TypingCommand.cpp
index 6235f7a..5ce4e56 100644
--- a/WebCore/editing/TypingCommand.cpp
+++ b/WebCore/editing/TypingCommand.cpp
@@ -33,6 +33,7 @@
 #include "Editor.h"
 #include "Element.h"
 #include "Frame.h"
+#include "HTMLNames.h"
 #include "InsertLineBreakCommand.h"
 #include "InsertParagraphSeparatorCommand.h"
 #include "InsertTextCommand.h"
@@ -44,6 +45,8 @@
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, const String &textToInsert, bool selectInsertedText, TextGranularity granularity, bool killRing)
     : CompositeEditCommand(document), 
       m_commandType(commandType), 
@@ -281,8 +284,17 @@
 
 void TypingCommand::markMisspellingsAfterTyping()
 {
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    if (!document()->frame()->editor()->isContinuousSpellCheckingEnabled()
+     && !document()->frame()->editor()->isAutomaticQuoteSubstitutionEnabled()
+     && !document()->frame()->editor()->isAutomaticLinkDetectionEnabled()
+     && !document()->frame()->editor()->isAutomaticDashSubstitutionEnabled()
+     && !document()->frame()->editor()->isAutomaticTextReplacementEnabled())
+        return;
+#else
     if (!document()->frame()->editor()->isContinuousSpellCheckingEnabled())
         return;
+#endif
     // Take a look at the selection that results after typing and determine whether we need to spellcheck. 
     // Since the word containing the current selection is never marked, this does a check to
     // see if typing made a new word that is not in the current selection. Basically, you
@@ -299,8 +311,15 @@
 
 void TypingCommand::typingAddedToOpenCommand()
 {
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    document()->frame()->editor()->appliedEditing(this);
+    // Since the spellchecking code may also perform corrections and other replacements, it should happen after the typing changes.
+    markMisspellingsAfterTyping();
+#else
+    // The old spellchecking code requires that checking be done first, to prevent issues like that in 6864072, where <doesn't> is marked as misspelled.
     markMisspellingsAfterTyping();
     document()->frame()->editor()->appliedEditing(this);
+#endif
 }
 
 void TypingCommand::insertText(const String &text, bool selectInsertedText)
@@ -358,10 +377,38 @@
 
 void TypingCommand::insertParagraphSeparatorInQuotedContent()
 {
+    // If the selection starts inside a table, just insert the paragraph separator normally
+    // Breaking the blockquote would also break apart the table, which is unecessary when inserting a newline
+    if (enclosingNodeOfType(endingSelection().start(), &isTableStructureNode)) {
+        insertParagraphSeparator();
+        return;
+    }
+        
     applyCommandToComposite(BreakBlockquoteCommand::create(document()));
     typingAddedToOpenCommand();
 }
 
+bool TypingCommand::makeEditableRootEmpty()
+{
+    Element* root = endingSelection().rootEditableElement();
+    if (!root->firstChild())
+        return false;
+
+    if (root->firstChild() == root->lastChild() && root->firstElementChild() && root->firstElementChild()->hasTagName(brTag)) {
+        // If there is a single child and it could be a placeholder, leave it alone.
+        if (root->renderer() && root->renderer()->isBlockFlow())
+            return false;
+    }
+
+    while (Node* child = root->firstChild())
+        removeNode(child);
+
+    addBlockPlaceholderIfNeeded(root);
+    setEndingSelection(VisibleSelection(Position(root, 0), DOWNSTREAM));
+
+    return true;
+}
+
 void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
 {
     VisibleSelection selectionToDelete;
@@ -386,12 +433,17 @@
             if (killRing && selection.isCaret() && granularity != CharacterGranularity) 
                 selection.modify(SelectionController::EXTEND, SelectionController::BACKWARD, CharacterGranularity); 
             
-            // When the caret is at the start of the editable area in an empty list item, break out of the list item.
             if (endingSelection().visibleStart().previous(true).isNull()) {
+                // When the caret is at the start of the editable area in an empty list item, break out of the list item.
                 if (breakOutOfEmptyListItem()) {
                     typingAddedToOpenCommand();
                     return;
                 }
+                // When there are no visible positions in the editing root, delete its entire contents.
+                if (endingSelection().visibleStart().next(true).isNull() && makeEditableRootEmpty()) {
+                    typingAddedToOpenCommand();
+                    return;
+                }
             }
             
             VisiblePosition visibleStart(endingSelection().visibleStart());
@@ -411,7 +463,7 @@
 
             selectionToDelete = selection.selection();
 
-            if (granularity == CharacterGranularity && selectionToDelete.end().node() == selectionToDelete.start().node() && selectionToDelete.end().m_offset - selectionToDelete.start().m_offset > 1) {
+            if (granularity == CharacterGranularity && selectionToDelete.end().node() == selectionToDelete.start().node() && selectionToDelete.end().deprecatedEditingOffset() - selectionToDelete.start().deprecatedEditingOffset() > 1) {
                 // If there are multiple Unicode code points to be deleted, adjust the range to match platform conventions.
                 selectionToDelete.setWithoutValidation(selectionToDelete.end(), selectionToDelete.end().previous(BackwardDeletion));
             }
@@ -476,7 +528,7 @@
             if (visibleEnd == endOfParagraph(visibleEnd))
                 downstreamEnd = visibleEnd.next(true).deepEquivalent().downstream();
             // When deleting tables: Select the table first, then perform the deletion
-            if (downstreamEnd.node() && downstreamEnd.node()->renderer() && downstreamEnd.node()->renderer()->isTable() && downstreamEnd.m_offset == 0) {
+            if (downstreamEnd.node() && downstreamEnd.node()->renderer() && downstreamEnd.node()->renderer()->isTable() && downstreamEnd.deprecatedEditingOffset() == 0) {
                 setEndingSelection(VisibleSelection(endingSelection().end(), lastDeepEditingPositionForNode(downstreamEnd.node()), DOWNSTREAM));
                 typingAddedToOpenCommand();
                 return;
@@ -499,10 +551,10 @@
                 else {
                     int extraCharacters;
                     if (selectionToDelete.start().node() == selectionToDelete.end().node())
-                        extraCharacters = selectionToDelete.end().m_offset - selectionToDelete.start().m_offset;
+                        extraCharacters = selectionToDelete.end().deprecatedEditingOffset() - selectionToDelete.start().deprecatedEditingOffset();
                     else
-                        extraCharacters = selectionToDelete.end().m_offset;
-                    extent = Position(extent.node(), extent.m_offset + extraCharacters);
+                        extraCharacters = selectionToDelete.end().deprecatedEditingOffset();
+                    extent = Position(extent.node(), extent.deprecatedEditingOffset() + extraCharacters);
                 }
                 selectionAfterUndo.setWithoutValidation(startingSelection().start(), extent);
             }
diff --git a/WebCore/editing/TypingCommand.h b/WebCore/editing/TypingCommand.h
index bf588be..2c52447 100644
--- a/WebCore/editing/TypingCommand.h
+++ b/WebCore/editing/TypingCommand.h
@@ -83,6 +83,7 @@
 
     void markMisspellingsAfterTyping();
     void typingAddedToOpenCommand();
+    bool makeEditableRootEmpty();
     
     ETypingCommand m_commandType;
     String m_textToInsert;
diff --git a/WebCore/editing/VisiblePosition.cpp b/WebCore/editing/VisiblePosition.cpp
index 27ee146..2db6d31 100644
--- a/WebCore/editing/VisiblePosition.cpp
+++ b/WebCore/editing/VisiblePosition.cpp
@@ -28,8 +28,8 @@
 
 #include "CString.h"
 #include "Document.h"
-#include "Element.h"
 #include "FloatQuad.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "Logging.h"
@@ -511,7 +511,7 @@
     return next;
 }
 
-UChar VisiblePosition::characterAfter() const
+UChar32 VisiblePosition::characterAfter() const
 {
     // We canonicalize to the first of two equivalent candidates, but the second of the two candidates
     // is the one that will be inside the text node containing the character after this visible position.
@@ -520,10 +520,15 @@
     if (!node || !node->isTextNode())
         return 0;
     Text* textNode = static_cast<Text*>(pos.node());
-    int offset = pos.m_offset;
-    if ((unsigned)offset >= textNode->length())
+    unsigned offset = pos.deprecatedEditingOffset();
+    unsigned length = textNode->length();
+    if (offset >= length)
         return 0;
-    return textNode->data()[offset];
+
+    UChar32 ch;
+    const UChar* characters = textNode->data().characters();
+    U16_NEXT(characters, offset, length, ch);
+    return ch;
 }
 
 IntRect VisiblePosition::localCaretRect(RenderObject*& renderer) const
@@ -576,7 +581,7 @@
     if (isNull())
         fprintf(stderr, "Position [%s]: null\n", msg);
     else
-        fprintf(stderr, "Position [%s]: %s [%p] at %d\n", msg, m_deepPosition.node()->nodeName().utf8().data(), m_deepPosition.node(), m_deepPosition.m_offset);
+        fprintf(stderr, "Position [%s]: %s [%p] at %d\n", msg, m_deepPosition.node()->nodeName().utf8().data(), m_deepPosition.node(), m_deepPosition.deprecatedEditingOffset());
 }
 
 #ifndef NDEBUG
@@ -600,7 +605,7 @@
     
     Position s = rangeCompliantEquivalent(start);
     Position e = rangeCompliantEquivalent(end);
-    return Range::create(s.node()->document(), s.node(), s.m_offset, e.node(), e.m_offset);
+    return Range::create(s.node()->document(), s.node(), s.deprecatedEditingOffset(), e.node(), e.deprecatedEditingOffset());
 }
 
 VisiblePosition startVisiblePosition(const Range *r, EAffinity affinity)
@@ -621,7 +626,7 @@
         return false;
     Position p = rangeCompliantEquivalent(visiblePosition);
     int code = 0;
-    r->setStart(p.node(), p.m_offset, code);
+    r->setStart(p.node(), p.deprecatedEditingOffset(), code);
     return code == 0;
 }
 
@@ -631,7 +636,7 @@
         return false;
     Position p = rangeCompliantEquivalent(visiblePosition);
     int code = 0;
-    r->setEnd(p.node(), p.m_offset, code);
+    r->setEnd(p.node(), p.deprecatedEditingOffset(), code);
     return code == 0;
 }
 
diff --git a/WebCore/editing/VisiblePosition.h b/WebCore/editing/VisiblePosition.h
index 403c816..d888806 100644
--- a/WebCore/editing/VisiblePosition.h
+++ b/WebCore/editing/VisiblePosition.h
@@ -47,6 +47,8 @@
 
 class InlineBox;
 
+enum StayInEditableContent { MayLeaveEditableContent, MustStayInEditableContent };
+
 class VisiblePosition {
 public:
     // NOTE: UPSTREAM affinity will be used only if pos is at end of a wrapped line,
@@ -64,6 +66,8 @@
     EAffinity affinity() const { ASSERT(m_affinity == UPSTREAM || m_affinity == DOWNSTREAM); return m_affinity; }
     void setAffinity(EAffinity affinity) { m_affinity = affinity; }
 
+    // FIXME: Change the following functions' parameter from a boolean to StayInEditableContent.
+
     // next() and previous() will increment/decrement by a character cluster.
     VisiblePosition next(bool stayInEditableContent = false) const;
     VisiblePosition previous(bool stayInEditableContent = false) const;
@@ -73,8 +77,8 @@
     VisiblePosition left(bool stayInEditableContent = false) const;
     VisiblePosition right(bool stayInEditableContent = false) const;
 
-    UChar characterAfter() const;
-    UChar characterBefore() const { return previous().characterAfter(); }
+    UChar32 characterAfter() const;
+    UChar32 characterBefore() const { return previous().characterAfter(); }
     
     void debugPosition(const char* msg = "") const;
     
diff --git a/WebCore/editing/VisibleSelection.cpp b/WebCore/editing/VisibleSelection.cpp
index 279adf2..56ad6b3 100644
--- a/WebCore/editing/VisibleSelection.cpp
+++ b/WebCore/editing/VisibleSelection.cpp
@@ -169,7 +169,7 @@
         ASSERT(isRange());
         s = m_start.downstream();
         e = m_end.upstream();
-        if (Range::compareBoundaryPoints(s.node(), s.m_offset, e.node(), e.m_offset) > 0) {
+        if (comparePositions(s, e) > 0) {
             // Make sure the start is before the end.
             // The end can wind up before the start if collapsed whitespace is the only thing selected.
             Position tmp = s;
@@ -213,7 +213,7 @@
 
     Position start(rangeCompliantEquivalent(pos));
     searchRange->selectNodeContents(boundary, ec);
-    searchRange->setStart(start.node(), start.m_offset, ec);
+    searchRange->setStart(start.node(), start.deprecatedEditingOffset(), ec);
 
     ASSERT(!ec);
     if (ec)
@@ -222,6 +222,11 @@
     return searchRange.release();
 }
 
+bool VisibleSelection::isAll(StayInEditableContent stayInEditableContent) const
+{
+    return !shadowTreeRootNode() && visibleStart().previous(stayInEditableContent).isNull() && visibleEnd().next(stayInEditableContent).isNull();
+}
+
 void VisibleSelection::appendTrailingWhitespace()
 {
     RefPtr<Range> searchRange = makeSearchRange(m_end);
@@ -588,13 +593,13 @@
 
     if (m_start == m_end) {
         Position pos = m_start;
-        fprintf(stderr, "pos:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.m_offset);
+        fprintf(stderr, "pos:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.deprecatedEditingOffset());
     } else {
         Position pos = m_start;
-        fprintf(stderr, "start:      %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.m_offset);
+        fprintf(stderr, "start:      %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.deprecatedEditingOffset());
         fprintf(stderr, "-----------------------------------\n");
         pos = m_end;
-        fprintf(stderr, "end:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.m_offset);
+        fprintf(stderr, "end:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.deprecatedEditingOffset());
         fprintf(stderr, "-----------------------------------\n");
     }
 
@@ -628,7 +633,7 @@
 {
     if (start().node()) {
         start().node()->showTreeAndMark(start().node(), "S", end().node(), "E");
-        fprintf(stderr, "start offset: %d, end offset: %d\n", start().m_offset, end().m_offset);
+        fprintf(stderr, "start offset: %d, end offset: %d\n", start().deprecatedEditingOffset(), end().deprecatedEditingOffset());
     }
 }
 
diff --git a/WebCore/editing/VisibleSelection.h b/WebCore/editing/VisibleSelection.h
index ae2142d..e346b27 100644
--- a/WebCore/editing/VisibleSelection.h
+++ b/WebCore/editing/VisibleSelection.h
@@ -42,7 +42,7 @@
     VisibleSelection();
 
     VisibleSelection(const Position&, EAffinity);
-    VisibleSelection(const Position&, const Position&, EAffinity);
+    VisibleSelection(const Position&, const Position&, EAffinity = SEL_DEFAULT_AFFINITY);
 
     VisibleSelection(const Range*, EAffinity = SEL_DEFAULT_AFFINITY);
     
@@ -76,6 +76,8 @@
 
     bool isBaseFirst() const { return m_baseIsFirst; }
 
+    bool isAll(StayInEditableContent) const;
+
     void appendTrailingWhitespace();
 
     bool expandUsingGranularity(TextGranularity granularity);
diff --git a/WebCore/editing/gtk/SelectionControllerGtk.cpp b/WebCore/editing/gtk/SelectionControllerGtk.cpp
new file mode 100644
index 0000000..52fbbab
--- /dev/null
+++ b/WebCore/editing/gtk/SelectionControllerGtk.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+ 
+#include "config.h"
+#include "SelectionController.h"
+
+#include "AXObjectCache.h"
+#include "Frame.h"
+
+#include <gtk/gtk.h>
+
+namespace WebCore {
+
+void SelectionController::notifyAccessibilityForSelectionChange()
+{
+    if (AXObjectCache::accessibilityEnabled() && m_sel.start().isNotNull() && m_sel.end().isNotNull()) {
+        RenderObject* focusedNode = m_sel.start().node()->renderer();
+        AccessibilityObject* accessibilityObject = m_frame->document()->axObjectCache()->getOrCreate(focusedNode);
+        AtkObject* wrapper = accessibilityObject->wrapper();
+        if (ATK_IS_TEXT(wrapper)) {
+            g_signal_emit_by_name(wrapper, "text-caret-moved", m_sel.start().offsetInContainerNode());
+
+            if (m_sel.isRange())
+                g_signal_emit_by_name(wrapper, "text-selection-changed");
+        }
+    }
+}
+
+} // namespace WebCore
diff --git a/WebCore/editing/htmlediting.cpp b/WebCore/editing/htmlediting.cpp
index 055c3a7..7b51295 100644
--- a/WebCore/editing/htmlediting.cpp
+++ b/WebCore/editing/htmlediting.cpp
@@ -98,8 +98,8 @@
     ASSERT(nodeA);
     Node* nodeB = b.node();
     ASSERT(nodeB);
-    int offsetA = a.m_offset;
-    int offsetB = b.m_offset;
+    int offsetA = a.deprecatedEditingOffset();
+    int offsetB = b.deprecatedEditingOffset();
 
     Node* shadowAncestorA = nodeA->shadowAncestorNode();
     if (shadowAncestorA == nodeA)
@@ -126,6 +126,11 @@
     return result ? result : bias;
 }
 
+int comparePositions(const VisiblePosition& a, const VisiblePosition& b)
+{
+    return comparePositions(a.deepEquivalent(), b.deepEquivalent());
+}
+
 Node* highestEditableRoot(const Position& position)
 {
     Node* node = position.node();
@@ -322,17 +327,17 @@
 
     Node* node = pos.node();
 
-    if (pos.m_offset <= 0) {
+    if (pos.deprecatedEditingOffset() <= 0) {
         if (node->parentNode() && (editingIgnoresContent(node) || isTableElement(node)))
             return positionBeforeNode(node);
         return Position(node, 0);
     }
 
     if (node->offsetInCharacters())
-        return Position(node, min(node->maxCharacterOffset(), pos.m_offset));
+        return Position(node, min(node->maxCharacterOffset(), pos.deprecatedEditingOffset()));
 
     int maxCompliantOffset = node->childNodeCount();
-    if (pos.m_offset > maxCompliantOffset) {
+    if (pos.deprecatedEditingOffset() > maxCompliantOffset) {
         if (node->parentNode())
             return positionAfterNode(node);
 
@@ -342,12 +347,12 @@
     } 
 
     // Editing should never generate positions like this.
-    if ((pos.m_offset < maxCompliantOffset) && editingIgnoresContent(node)) {
+    if ((pos.deprecatedEditingOffset() < maxCompliantOffset) && editingIgnoresContent(node)) {
         ASSERT_NOT_REACHED();
         return node->parentNode() ? positionBeforeNode(node) : Position(node, 0);
     }
     
-    if (pos.m_offset == maxCompliantOffset && (editingIgnoresContent(node) || isTableElement(node)))
+    if (pos.deprecatedEditingOffset() == maxCompliantOffset && (editingIgnoresContent(node) || isTableElement(node)))
         return positionAfterNode(node);
     
     return Position(pos);
@@ -906,14 +911,25 @@
     return lastOffsetForEditing(n);
 }
 
-bool lineBreakExistsAtPosition(const VisiblePosition& visiblePosition)
+bool lineBreakExistsAtVisiblePosition(const VisiblePosition& visiblePosition)
 {
-    if (visiblePosition.isNull())
+    return lineBreakExistsAtPosition(visiblePosition.deepEquivalent().downstream());
+}
+
+bool lineBreakExistsAtPosition(const Position& position)
+{
+    if (position.isNull())
         return false;
-        
-    Position downstream(visiblePosition.deepEquivalent().downstream());
-    return downstream.node()->hasTagName(brTag) ||
-           (downstream.node()->isTextNode() && downstream.node()->renderer()->style()->preserveNewline() && visiblePosition.characterAfter() == '\n');
+    
+    if (position.anchorNode()->hasTagName(brTag) && position.atFirstEditingPositionForNode())
+        return true;
+    
+    if (!position.anchorNode()->isTextNode() || !position.anchorNode()->renderer()->style()->preserveNewline())
+        return false;
+    
+    Text* textNode = static_cast<Text*>(position.anchorNode());
+    unsigned offset = position.offsetInContainerNode();
+    return offset < textNode->length() && textNode->data()[offset] == '\n';
 }
 
 // Modifies selections that have an end point at the edge of a table
diff --git a/WebCore/editing/htmlediting.h b/WebCore/editing/htmlediting.h
index ece5e29..374b512 100644
--- a/WebCore/editing/htmlediting.h
+++ b/WebCore/editing/htmlediting.h
@@ -37,9 +37,9 @@
 class Node;
 class Position;
 class Range;
-class VisibleSelection;
 class String;
 class VisiblePosition;
+class VisibleSelection;
 
 Position rangeCompliantEquivalent(const Position&);
 Position rangeCompliantEquivalent(const VisiblePosition&);
@@ -51,6 +51,7 @@
 VisiblePosition firstEditablePositionAfterPositionInRoot(const Position&, Node*);
 VisiblePosition lastEditablePositionBeforePositionInRoot(const Position&, Node*);
 int comparePositions(const Position&, const Position&);
+int comparePositions(const VisiblePosition&, const VisiblePosition&);
 Node* lowestEditableAncestor(Node*);
 bool isContentEditable(const Node*);
 Position nextCandidate(const Position&);
@@ -127,7 +128,8 @@
 bool isTableElement(Node*);
 bool isTableCell(const Node*);
 
-bool lineBreakExistsAtPosition(const VisiblePosition&);
+bool lineBreakExistsAtPosition(const Position&);
+bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
 
 VisibleSelection selectionForParagraphIteration(const VisibleSelection&);
 
diff --git a/WebCore/editing/mac/SelectionControllerMac.mm b/WebCore/editing/mac/SelectionControllerMac.mm
index 03e1051..5970f99 100644
--- a/WebCore/editing/mac/SelectionControllerMac.mm
+++ b/WebCore/editing/mac/SelectionControllerMac.mm
@@ -38,7 +38,7 @@
     Document* document = m_frame->document();
 
     if (AXObjectCache::accessibilityEnabled() && m_sel.start().isNotNull() && m_sel.end().isNotNull())
-        document->axObjectCache()->postNotification(m_sel.start().node()->renderer(), "AXSelectedTextChanged");
+        document->axObjectCache()->postNotification(m_sel.start().node()->renderer(), "AXSelectedTextChanged", false);
 
     // if zoom feature is enabled, insertion point changes should update the zoom
     if (!UAZoomEnabled() || !m_sel.isCaret())
diff --git a/WebCore/editing/markup.cpp b/WebCore/editing/markup.cpp
index 7de5287..d6fe1ce 100644
--- a/WebCore/editing/markup.cpp
+++ b/WebCore/editing/markup.cpp
@@ -30,6 +30,7 @@
 #include "CharacterNames.h"
 #include "Comment.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
@@ -190,7 +191,7 @@
 {
     UChar quoteChar = '\"';
     String strippedURLString = urlString.stripWhiteSpace();
-    if (protocolIs(strippedURLString, "javascript")) {
+    if (protocolIsJavaScript(strippedURLString)) {
         // minimal escaping for javascript urls
         if (strippedURLString.contains('"')) {
             if (strippedURLString.contains('\''))
@@ -387,7 +388,14 @@
     append(result, ">");
 }
 
-static void appendStartMarkup(Vector<UChar>& result, const Node *node, const Range *range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0)
+static void removeExteriorStyles(CSSMutableStyleDeclaration* style)
+{
+    style->removeProperty(CSSPropertyFloat);
+}
+
+enum RangeFullySelectsNode { DoesFullySelectNode, DoesNotFullySelectNode };
+
+static void appendStartMarkup(Vector<UChar>& result, const Node* node, const Range* range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0, RangeFullySelectsNode rangeFullySelectsNode = DoesFullySelectNode)
 {
     bool documentIsHTML = node->document()->isHTMLDocument();
     switch (node->nodeType()) {
@@ -439,7 +447,7 @@
             const Element* el = static_cast<const Element*>(node);
             bool convert = convertBlocksToInlines && isBlock(const_cast<Node*>(node));
             append(result, el->nodeNamePreservingCase());
-            NamedAttrMap *attrs = el->attributes();
+            NamedNodeMap *attrs = el->attributes();
             unsigned length = attrs->length();
             if (!documentIsHTML && namespaces && shouldAddNamespaceElem(el))
                 appendNamespace(result, el->prefix(), el->namespaceURI(), *namespaces);
@@ -502,6 +510,10 @@
                 }
                 if (convert)
                     style->setProperty(CSSPropertyDisplay, CSSValueInline, true);
+                // If the node is not fully selected by the range, then we don't want to keep styles that affect its relationship to the nodes around it
+                // only the ones that affect it and the nodes within it.
+                if (rangeFullySelectsNode == DoesNotFullySelectNode)
+                    removeExteriorStyles(style.get());
                 if (style->length() > 0) {
                     DEFINE_STATIC_LOCAL(const String, stylePrefix, (" style=\""));
                     append(result, stylePrefix);
@@ -536,10 +548,10 @@
     }
 }
 
-static String getStartMarkup(const Node *node, const Range *range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0)
+static String getStartMarkup(const Node* node, const Range* range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0, RangeFullySelectsNode rangeFullySelectsNode = DoesFullySelectNode)
 {
     Vector<UChar> result;
-    appendStartMarkup(result, node, range, annotate, convertBlocksToInlines, namespaces);
+    appendStartMarkup(result, node, range, annotate, convertBlocksToInlines, namespaces, rangeFullySelectsNode);
     return String::adopt(result);
 }
 
@@ -642,7 +654,7 @@
     for (Node* n = node; n != end; n = n->traverseNextNode()) {
         if (n->isElementNode()) {
             Element* e = static_cast<Element*>(n);
-            NamedAttrMap* attrs = e->attributes();
+            NamedNodeMap* attrs = e->attributes();
             unsigned length = attrs->length();
             for (unsigned i = 0; i < length; i++) {
                 Attribute* attr = attrs->attributeItem(i);
@@ -742,6 +754,15 @@
            node->hasTagName(h5Tag);
 }
 
+static bool shouldIncludeWrapperForFullySelectedRoot(Node* fullySelectedRoot, CSSMutableStyleDeclaration* style)
+{
+    if (fullySelectedRoot->isElementNode() && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
+        return true;
+        
+    return style->getPropertyCSSValue(CSSPropertyBackgroundImage) ||
+           style->getPropertyCSSValue(CSSPropertyBackgroundColor);
+}
+
 // FIXME: Shouldn't we omit style info when annotate == DoNotAnnotateForInterchange? 
 // FIXME: At least, annotation and style info should probably not be included in range.markupString()
 String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterchange annotate, bool convertBlocksToInlines)
@@ -798,14 +819,20 @@
 
         markups.append(interchangeNewlineString);
         startNode = visibleStart.next().deepEquivalent().node();
+
+        if (pastEnd && Range::compareBoundaryPoints(startNode, 0, pastEnd, 0) >= 0) {
+            if (deleteButton)
+                deleteButton->enable();
+            return interchangeNewlineString;
+        }
     }
 
     Node* next;
     for (Node* n = startNode; n != pastEnd; n = next) {
-    
-        // According to <rdar://problem/5730668>, it is possible for n to blow past pastEnd and become null here.  This 
-        // shouldn't be possible.  This null check will prevent crashes (but create too much markup) and the ASSERT will 
-        // hopefully lead us to understanding the problem.
+        // According to <rdar://problem/5730668>, it is possible for n to blow
+        // past pastEnd and become null here. This shouldn't be possible.
+        // This null check will prevent crashes (but create too much markup)
+        // and the ASSERT will hopefully lead us to understanding the problem.
         ASSERT(n);
         if (!n)
             break;
@@ -878,7 +905,7 @@
             // We added markup for this node, and we're descending into it.  Set it to close eventually.
             ancestorsToClose.append(n);
     }
-    
+
     // Include ancestors that aren't completely inside the range but are required to retain 
     // the structure and appearance of the copied markup.
     Node* specialCommonAncestor = 0;
@@ -921,29 +948,29 @@
         specialCommonAncestor = enclosingAnchor;
     
     Node* body = enclosingNodeWithTag(Position(commonAncestor, 0), bodyTag);
-    // FIXME: Only include markup for a fully selected root (and ancestors of lastClosed up to that root) if
-    // there are styles/attributes on those nodes that need to be included to preserve the appearance of the copied markup.
     // FIXME: Do this for all fully selected blocks, not just the body.
     Node* fullySelectedRoot = body && *VisibleSelection::selectionFromContentsOfNode(body).toNormalizedRange() == *updatedRange ? body : 0;
-    if (annotate && fullySelectedRoot)
-        specialCommonAncestor = fullySelectedRoot;
+    RefPtr<CSSMutableStyleDeclaration> fullySelectedRootStyle = fullySelectedRoot ? styleFromMatchedRulesAndInlineDecl(fullySelectedRoot) : 0;
+    if (annotate && fullySelectedRoot) {
+        if (shouldIncludeWrapperForFullySelectedRoot(fullySelectedRoot, fullySelectedRootStyle.get()))
+            specialCommonAncestor = fullySelectedRoot;
+    }
         
     if (specialCommonAncestor && lastClosed) {
         // Also include all of the ancestors of lastClosed up to this special ancestor.
         for (Node* ancestor = lastClosed->parentNode(); ancestor; ancestor = ancestor->parentNode()) {
             if (ancestor == fullySelectedRoot && !convertBlocksToInlines) {
-                RefPtr<CSSMutableStyleDeclaration> style = styleFromMatchedRulesAndInlineDecl(fullySelectedRoot);
                 
                 // Bring the background attribute over, but not as an attribute because a background attribute on a div
                 // appears to have no effect.
-                if (!style->getPropertyCSSValue(CSSPropertyBackgroundImage) && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
-                    style->setProperty(CSSPropertyBackgroundImage, "url('" + static_cast<Element*>(fullySelectedRoot)->getAttribute(backgroundAttr) + "')");
+                if (!fullySelectedRootStyle->getPropertyCSSValue(CSSPropertyBackgroundImage) && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
+                    fullySelectedRootStyle->setProperty(CSSPropertyBackgroundImage, "url('" + static_cast<Element*>(fullySelectedRoot)->getAttribute(backgroundAttr) + "')");
                 
-                if (style->length()) {
+                if (fullySelectedRootStyle->length()) {
                     Vector<UChar> openTag;
                     DEFINE_STATIC_LOCAL(const String, divStyle, ("<div style=\""));
                     append(openTag, divStyle);
-                    appendAttributeValue(openTag, style->cssText(), documentIsHTML);
+                    appendAttributeValue(openTag, fullySelectedRootStyle->cssText(), documentIsHTML);
                     openTag.append('\"');
                     openTag.append('>');
                     preMarkups.append(String::adopt(openTag));
@@ -952,7 +979,9 @@
                     markups.append(divCloseTag);
                 }
             } else {
-                preMarkups.append(getStartMarkup(ancestor, updatedRange.get(), annotate, convertBlocksToInlines));
+                // Since this node and all the other ancestors are not in the selection we want to set RangeFullySelectsNode to DoesNotFullySelectNode
+                // so that styles that affect the exterior of the node are not included.
+                preMarkups.append(getStartMarkup(ancestor, updatedRange.get(), annotate, convertBlocksToInlines, 0, DoesNotFullySelectNode));
                 markups.append(getEndMarkup(ancestor));
             }
             if (nodes)
diff --git a/WebCore/editing/visible_units.cpp b/WebCore/editing/visible_units.cpp
index 1e8b05b..02e9fb8 100644
--- a/WebCore/editing/visible_units.cpp
+++ b/WebCore/editing/visible_units.cpp
@@ -43,25 +43,35 @@
 using namespace HTMLNames;
 using namespace WTF::Unicode;
 
-static int firstNonComplexContextLineBreak(const UChar* characters, int length)
+static int endOfFirstWordBoundaryContext(const UChar* characters, int length)
 {
-    for (int i = 0; i < length; ++i) {
-        if (!hasLineBreakingPropertyComplexContext(characters[i]))
-            return i;
+    for (int i = 0; i < length; ) {
+        int first = i;
+        UChar32 ch;
+        U16_NEXT(characters, i, length, ch);
+        if (!requiresContextForWordBoundary(ch))
+            return first;
     }
     return length;
 }
 
-static int lastNonComplexContextLineBreak(const UChar* characters, int length)
+static int startOfLastWordBoundaryContext(const UChar* characters, int length)
 {
-    for (int i = length - 1; i >= 0; --i) {
-        if (!hasLineBreakingPropertyComplexContext(characters[i]))
-            return i;
+    for (int i = length; i > 0; ) {
+        int last = i;
+        UChar32 ch;
+        U16_PREV(characters, 0, i, ch);
+        if (!requiresContextForWordBoundary(ch))
+            return last;
     }
-    return -1;
+    return 0;
 }
 
-static VisiblePosition previousBoundary(const VisiblePosition &c, unsigned (*searchFunction)(const UChar *, unsigned, unsigned))
+enum BoundarySearchContextAvailability { DontHaveMoreContext, MayHaveMoreContext };
+
+typedef unsigned (*BoundarySearchFunction)(const UChar*, unsigned length, unsigned offset, BoundarySearchContextAvailability, bool& needMoreContext);
+
+static VisiblePosition previousBoundary(const VisiblePosition& c, BoundarySearchFunction searchFunction)
 {
     Position pos = c.deepEquivalent();
     Node *n = pos.node();
@@ -86,15 +96,15 @@
     unsigned suffixLength = 0;
 
     ExceptionCode ec = 0;
-    if (hasLineBreakingPropertyComplexContext(c.characterBefore())) {
+    if (requiresContextForWordBoundary(c.characterBefore())) {
         RefPtr<Range> forwardsScanRange(d->createRange());
         forwardsScanRange->setEndAfter(boundary, ec);
-        forwardsScanRange->setStart(end.node(), end.m_offset, ec);
+        forwardsScanRange->setStart(end.node(), end.deprecatedEditingOffset(), ec);
         TextIterator forwardsIterator(forwardsScanRange.get());
         while (!forwardsIterator.atEnd()) {
             const UChar* characters = forwardsIterator.characters();
             int length = forwardsIterator.length();
-            int i = firstNonComplexContextLineBreak(characters, length);
+            int i = endOfFirstWordBoundaryContext(characters, length);
             string.append(characters, i);
             suffixLength += i;
             if (i < length)
@@ -103,8 +113,8 @@
         }
     }
 
-    searchRange->setStart(start.node(), start.m_offset, ec);
-    searchRange->setEnd(end.node(), end.m_offset, ec);
+    searchRange->setStart(start.node(), start.deprecatedEditingOffset(), ec);
+    searchRange->setEnd(end.node(), end.deprecatedEditingOffset(), ec);
     
     ASSERT(!ec);
     if (ec)
@@ -113,6 +123,7 @@
     SimplifiedBackwardsTextIterator it(searchRange.get());
     unsigned next = 0;
     bool inTextSecurityMode = start.node() && start.node()->renderer() && start.node()->renderer()->style()->textSecurity() != TSNONE;
+    bool needMoreContext = false;
     while (!it.atEnd()) {
         // iterate to get chunks until the searchFunction returns a non-zero value.
         if (!inTextSecurityMode) 
@@ -123,13 +134,18 @@
             iteratorString = iteratorString.impl()->secure('x');
             string.prepend(iteratorString.characters(), iteratorString.length());
         }
-        
-        next = searchFunction(string.data(), string.size(), string.size() - suffixLength);
+        next = searchFunction(string.data(), string.size(), string.size() - suffixLength, MayHaveMoreContext, needMoreContext);
         if (next != 0)
             break;
         it.advance();
     }
-    
+    if (needMoreContext) {
+        // The last search returned the beginning of the buffer and asked for more context,
+        // but there is no earlier text. Force a search with what's available.
+        next = searchFunction(string.data(), string.size(), string.size() - suffixLength, DontHaveMoreContext, needMoreContext);
+        ASSERT(!needMoreContext);
+    }
+
     if (it.atEnd() && next == 0) {
         pos = it.range()->startPosition();
     } else if (next != 0) {
@@ -148,7 +164,7 @@
     return VisiblePosition(pos, DOWNSTREAM);
 }
 
-static VisiblePosition nextBoundary(const VisiblePosition &c, unsigned (*searchFunction)(const UChar *, unsigned, unsigned))
+static VisiblePosition nextBoundary(const VisiblePosition& c, BoundarySearchFunction searchFunction)
 {
     Position pos = c.deepEquivalent();
     Node *n = pos.node();
@@ -172,27 +188,28 @@
     unsigned prefixLength = 0;
 
     ExceptionCode ec = 0;
-    if (hasLineBreakingPropertyComplexContext(c.characterAfter())) {
+    if (requiresContextForWordBoundary(c.characterAfter())) {
         RefPtr<Range> backwardsScanRange(d->createRange());
-        backwardsScanRange->setEnd(start.node(), start.m_offset, ec);
+        backwardsScanRange->setEnd(start.node(), start.deprecatedEditingOffset(), ec);
         SimplifiedBackwardsTextIterator backwardsIterator(backwardsScanRange.get());
         while (!backwardsIterator.atEnd()) {
             const UChar* characters = backwardsIterator.characters();
             int length = backwardsIterator.length();
-            int i = lastNonComplexContextLineBreak(characters, length);
-            string.prepend(characters + i + 1, length - i - 1);
-            prefixLength += length - i - 1;
-            if (i > -1)
+            int i = startOfLastWordBoundaryContext(characters, length);
+            string.prepend(characters + i, length - i);
+            prefixLength += length - i;
+            if (i > 0)
                 break;
             backwardsIterator.advance();
         }
     }
 
     searchRange->selectNodeContents(boundary, ec);
-    searchRange->setStart(start.node(), start.m_offset, ec);
+    searchRange->setStart(start.node(), start.deprecatedEditingOffset(), ec);
     TextIterator it(searchRange.get(), true);
     unsigned next = 0;
     bool inTextSecurityMode = start.node() && start.node()->renderer() && start.node()->renderer()->style()->textSecurity() != TSNONE;
+    bool needMoreContext = false;
     while (!it.atEnd()) {
         // Keep asking the iterator for chunks until the search function
         // returns an end value not equal to the length of the string passed to it.
@@ -204,12 +221,17 @@
             iteratorString = iteratorString.impl()->secure('x');
             string.append(iteratorString.characters(), iteratorString.length());
         }
-
-        next = searchFunction(string.data(), string.size(), prefixLength);
+        next = searchFunction(string.data(), string.size(), prefixLength, MayHaveMoreContext, needMoreContext);
         if (next != string.size())
             break;
         it.advance();
     }
+    if (needMoreContext) {
+        // The last search returned the end of the buffer and asked for more context,
+        // but there is no further text. Force a search with what's available.
+        next = searchFunction(string.data(), string.size(), prefixLength, DontHaveMoreContext, needMoreContext);
+        ASSERT(!needMoreContext);
+    }
     
     if (it.atEnd() && next == string.size()) {
         pos = it.range()->startPosition();
@@ -233,11 +255,14 @@
 
 // ---------
 
-static unsigned startWordBoundary(const UChar* characters, unsigned length, unsigned offset)
+static unsigned startWordBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
     ASSERT(offset);
-    if (lastNonComplexContextLineBreak(characters, offset) == -1)
+    if (mayHaveMoreContext && !startOfLastWordBoundaryContext(characters, offset)) {
+        needMoreContext = true;
         return 0;
+    }
+    needMoreContext = false;
     int start, end;
     findWordBoundary(characters, length, offset - 1, &start, &end);
     return start;
@@ -260,11 +285,14 @@
     return previousBoundary(p, startWordBoundary);
 }
 
-static unsigned endWordBoundary(const UChar* characters, unsigned length, unsigned offset)
+static unsigned endWordBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
     ASSERT(offset <= length);
-    if (firstNonComplexContextLineBreak(characters + offset, length - offset) == static_cast<int>(length - offset))
+    if (mayHaveMoreContext && endOfFirstWordBoundaryContext(characters + offset, length - offset) == static_cast<int>(length - offset)) {
+        needMoreContext = true;
         return length;
+    }
+    needMoreContext = false;
     int start, end;
     findWordBoundary(characters, length, offset, &start, &end);
     return end;
@@ -286,10 +314,13 @@
     return nextBoundary(p, endWordBoundary);
 }
 
-static unsigned previousWordPositionBoundary(const UChar* characters, unsigned length, unsigned offset)
+static unsigned previousWordPositionBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
-    if (lastNonComplexContextLineBreak(characters, offset) == -1)
+    if (mayHaveMoreContext && !startOfLastWordBoundaryContext(characters, offset)) {
+        needMoreContext = true;
         return 0;
+    }
+    needMoreContext = false;
     return findNextWordFromIndex(characters, length, offset, false);
 }
 
@@ -299,10 +330,13 @@
     return c.honorEditableBoundaryAtOrAfter(prev);
 }
 
-static unsigned nextWordPositionBoundary(const UChar* characters, unsigned length, unsigned offset)
+static unsigned nextWordPositionBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
-    if (firstNonComplexContextLineBreak(characters + offset, length - offset) == static_cast<int>(length - offset))
+    if (mayHaveMoreContext && endOfFirstWordBoundaryContext(characters + offset, length - offset) == static_cast<int>(length - offset)) {
+        needMoreContext = true;
         return length;
+    }
+    needMoreContext = false;
     return findNextWordFromIndex(characters, length, offset, true);
 }
 
@@ -352,7 +386,7 @@
         // There are VisiblePositions at offset 0 in blocks without
         // RootInlineBoxes, like empty editable blocks and bordered blocks.
         Position p = c.deepEquivalent();
-        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.m_offset == 0)
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.deprecatedEditingOffset() == 0)
             return positionAvoidingFirstPositionInTable(c);
         
         return VisiblePosition();
@@ -399,7 +433,7 @@
         // greater than the input position.  This fix is to account for the discrepancy between lines with webkit-line-break:after-white-space 
         // style versus lines without that style, which would break before a space by default. 
         Position p = visPos.deepEquivalent();
-        if (p.m_offset > c.deepEquivalent().m_offset && p.node()->isSameNode(c.deepEquivalent().node())) {
+        if (p.deprecatedEditingOffset() > c.deepEquivalent().deprecatedEditingOffset() && p.node()->isSameNode(c.deepEquivalent().node())) {
             visPos = c.previous();
             if (visPos.isNull())
                 return VisiblePosition();
@@ -420,7 +454,7 @@
         // There are VisiblePositions at offset 0 in blocks without
         // RootInlineBoxes, like empty editable blocks and bordered blocks.
         Position p = c.deepEquivalent();
-        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.m_offset == 0)
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.deprecatedEditingOffset() == 0)
             return c;
         return VisiblePosition();
     }
@@ -505,6 +539,15 @@
     return 0;
 }
 
+static Node* enclosingNodeWithNonInlineRenderer(Node* n)
+{
+    for (Node* p = n; p; p = p->parentNode()) {
+        if (p->renderer() && !p->renderer()->isInline())
+            return p;
+    }
+    return 0;
+}
+
 VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int x)
 {
     Position p = visiblePosition.deepEquivalent();
@@ -534,9 +577,9 @@
         // This containing editable block does not have a previous line.
         // Need to move back to previous containing editable block in this root editable
         // block and find the last root line box in that block.
-        Node* startBlock = enclosingBlock(node);
+        Node* startBlock = enclosingNodeWithNonInlineRenderer(node);
         Node* n = previousLeafWithSameEditability(node);
-        while (n && startBlock == enclosingBlock(n))
+        while (n && startBlock == enclosingNodeWithNonInlineRenderer(n))
             n = previousLeafWithSameEditability(n);
         while (n) {
             if (highestEditableRoot(Position(n, 0)) != highestRoot)
@@ -566,15 +609,15 @@
             absPos -= containingBlock->layer()->scrolledContentOffset();
         RenderObject* renderer = root->closestLeafChildForXPos(x - absPos.x(), isEditablePosition(p))->renderer();
         Node* node = renderer->node();
-        if (editingIgnoresContent(node))
+        if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForCoordinates(x - absPos.x(), root->topOverflow());
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
     }
     
     // Could not find a previous line. This means we must already be on the first line.
     // Move to the start of the content in this block, which effectively moves us
     // to the start of the line we're on.
-    Node* rootElement = node->isContentEditable() ? node->rootEditableElement() : node->document()->documentElement();
+    Element* rootElement = node->isContentEditable() ? node->rootEditableElement() : node->document()->documentElement();
     return VisiblePosition(rootElement, 0, DOWNSTREAM);
 }
 
@@ -636,9 +679,9 @@
         // This containing editable block does not have a next line.
         // Need to move forward to next containing editable block in this root editable
         // block and find the first root line box in that block.
-        Node* startBlock = enclosingBlock(node);
-        Node* n = nextLeafWithSameEditability(node, p.m_offset);
-        while (n && startBlock == enclosingBlock(n))
+        Node* startBlock = enclosingNodeWithNonInlineRenderer(node);
+        Node* n = nextLeafWithSameEditability(node, p.deprecatedEditingOffset());
+        while (n && startBlock == enclosingNodeWithNonInlineRenderer(n))
             n = nextLeafWithSameEditability(n);
         while (n) {
             if (highestEditableRoot(Position(n, 0)) != highestRoot)
@@ -667,9 +710,9 @@
             absPos -= containingBlock->layer()->scrolledContentOffset();
         RenderObject* renderer = root->closestLeafChildForXPos(x - absPos.x(), isEditablePosition(p))->renderer();
         Node* node = renderer->node();
-        if (editingIgnoresContent(node))
+        if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForCoordinates(x - absPos.x(), root->topOverflow());
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
     }    
 
     // Could not find a next line. This means we must already be on the last line.
@@ -681,7 +724,7 @@
 
 // ---------
 
-static unsigned startSentenceBoundary(const UChar* characters, unsigned length, unsigned)
+static unsigned startSentenceBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     TextBreakIterator* iterator = sentenceBreakIterator(characters, length);
     // FIXME: The following function can return -1; we don't handle that.
@@ -693,7 +736,7 @@
     return previousBoundary(c, startSentenceBoundary);
 }
 
-static unsigned endSentenceBoundary(const UChar* characters, unsigned length, unsigned)
+static unsigned endSentenceBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     TextBreakIterator* iterator = sentenceBreakIterator(characters, length);
     return textBreakNext(iterator);
@@ -705,7 +748,7 @@
     return nextBoundary(c, endSentenceBoundary);
 }
 
-static unsigned previousSentencePositionBoundary(const UChar* characters, unsigned length, unsigned)
+static unsigned previousSentencePositionBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     // FIXME: This is identical to startSentenceBoundary. I'm pretty sure that's not right.
     TextBreakIterator* iterator = sentenceBreakIterator(characters, length);
@@ -719,7 +762,7 @@
     return c.honorEditableBoundaryAtOrAfter(prev);
 }
 
-static unsigned nextSentencePositionBoundary(const UChar* characters, unsigned length, unsigned)
+static unsigned nextSentencePositionBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     // FIXME: This is identical to endSentenceBoundary.  This isn't right, it needs to 
     // move to the equivlant position in the following sentence.
@@ -753,7 +796,7 @@
     Node* startBlock = enclosingBlock(startNode);
 
     Node *node = startNode;
-    int offset = p.m_offset;
+    int offset = p.deprecatedEditingOffset();
 
     Node *n = startNode;
     while (n) {
@@ -814,7 +857,7 @@
     Node *stayInsideBlock = startBlock;
     
     Node *node = startNode;
-    int offset = p.m_offset;
+    int offset = p.deprecatedEditingOffset();
 
     Node *n = startNode;
     while (n) {
@@ -1021,4 +1064,178 @@
     return lastDeepEditingPositionForNode(highestRoot);
 }
 
+static void getLeafBoxesInLogicalOrder(RootInlineBox* rootBox, Vector<InlineBox*>& leafBoxesInLogicalOrder)
+{
+    unsigned char minLevel = 128;
+    unsigned char maxLevel = 0;
+    unsigned count = 0;
+    InlineBox* r = rootBox->firstLeafChild();
+    // First find highest and lowest levels,
+    // and initialize leafBoxesInLogicalOrder with the leaf boxes in visual order.
+    while (r) {
+        if (r->bidiLevel() > maxLevel)
+            maxLevel = r->bidiLevel();
+        if (r->bidiLevel() < minLevel)
+            minLevel = r->bidiLevel();
+        leafBoxesInLogicalOrder.append(r);
+        r = r->nextLeafChild();
+        ++count;
+    }
+
+    if (rootBox->renderer()->style()->visuallyOrdered())
+        return;
+    // Reverse of reordering of the line (L2 according to Bidi spec):
+    // L2. From the highest level found in the text to the lowest odd level on each line,
+    // reverse any contiguous sequence of characters that are at that level or higher.
+
+    // Reversing the reordering of the line is only done up to the lowest odd level.
+    if (!(minLevel % 2))
+        minLevel++;
+    
+    InlineBox** end = leafBoxesInLogicalOrder.end();
+    while (minLevel <= maxLevel) {
+        InlineBox** iter = leafBoxesInLogicalOrder.begin();
+        while (iter != end) {
+            while (iter != end) {
+                if ((*iter)->bidiLevel() >= minLevel)
+                    break;
+                ++iter;
+            }
+            InlineBox** first = iter;
+            while (iter != end) {
+                if ((*iter)->bidiLevel() < minLevel)
+                    break;
+                ++iter;
+            }
+            InlineBox** last = iter;
+            std::reverse(first, last);
+        }                
+        ++minLevel;
+    }
+}
+
+static void getLogicalStartBoxAndNode(RootInlineBox* rootBox, InlineBox*& startBox, Node*& startNode)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    getLeafBoxesInLogicalOrder(rootBox, leafBoxesInLogicalOrder);
+    startBox = 0;
+    startNode = 0;
+    for (size_t i = 0; i < leafBoxesInLogicalOrder.size(); ++i) {
+        startBox = leafBoxesInLogicalOrder[i];
+        startNode = startBox->renderer()->node();
+        if (startNode)
+            return; 
+    }
+}
+
+static void getLogicalEndBoxAndNode(RootInlineBox* rootBox, InlineBox*& endBox, Node*& endNode)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    getLeafBoxesInLogicalOrder(rootBox, leafBoxesInLogicalOrder);
+    endBox = 0;
+    endNode = 0;
+    // Generated content (e.g. list markers and CSS :before and :after
+    // pseudoelements) have no corresponding DOM element, and so cannot be
+    // represented by a VisiblePosition.  Use whatever precedes instead.
+    for (size_t i = leafBoxesInLogicalOrder.size(); i > 0; --i) { 
+        endBox = leafBoxesInLogicalOrder[i - 1];
+        endNode = endBox->renderer()->node();
+        if (endNode)
+            return;
+    }
+}
+
+static VisiblePosition logicalStartPositionForLine(const VisiblePosition& c)
+{
+    if (c.isNull())
+        return VisiblePosition();
+
+    RootInlineBox* rootBox = rootBoxForLine(c);
+    if (!rootBox) {
+        // There are VisiblePositions at offset 0 in blocks without
+        // RootInlineBoxes, like empty editable blocks and bordered blocks.
+        Position p = c.deepEquivalent();
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && !p.deprecatedEditingOffset())
+            return positionAvoidingFirstPositionInTable(c);
+        
+        return VisiblePosition();
+    }
+    
+    InlineBox* logicalStartBox;
+    Node* logicalStartNode;
+    getLogicalStartBoxAndNode(rootBox, logicalStartBox, logicalStartNode);
+
+    if (!logicalStartNode)
+        return VisiblePosition();
+
+    int startOffset = logicalStartBox->caretMinOffset();
+  
+    VisiblePosition visPos = VisiblePosition(logicalStartNode, startOffset, DOWNSTREAM);
+    return positionAvoidingFirstPositionInTable(visPos);
+}
+
+VisiblePosition logicalStartOfLine(const VisiblePosition& c)
+{
+    VisiblePosition visPos = logicalStartPositionForLine(c);
+    
+    if (visPos.isNull())
+        return c.honorEditableBoundaryAtOrAfter(visPos);
+
+    return c.honorEditableBoundaryAtOrAfter(visPos);
+}
+
+static VisiblePosition logicalEndPositionForLine(const VisiblePosition& c)
+{
+    if (c.isNull())
+        return VisiblePosition();
+
+    RootInlineBox* rootBox = rootBoxForLine(c);
+    if (!rootBox) {
+        // There are VisiblePositions at offset 0 in blocks without
+        // RootInlineBoxes, like empty editable blocks and bordered blocks.
+        Position p = c.deepEquivalent();
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && !p.deprecatedEditingOffset())
+            return c;
+        return VisiblePosition();
+    }
+    
+    InlineBox* logicalEndBox;
+    Node* logicalEndNode;
+    getLogicalEndBoxAndNode(rootBox, logicalEndBox, logicalEndNode);
+    if (!logicalEndNode)
+        return VisiblePosition();
+    
+    int endOffset = 1;
+    if (logicalEndNode->hasTagName(brTag))
+        endOffset = 0;
+    else if (logicalEndBox->isInlineTextBox()) {
+        InlineTextBox* endTextBox = static_cast<InlineTextBox*>(logicalEndBox);
+        endOffset = endTextBox->start();
+        if (!endTextBox->isLineBreak())
+            endOffset += endTextBox->len();
+    }
+    
+    return VisiblePosition(logicalEndNode, endOffset, VP_UPSTREAM_IF_POSSIBLE);
+}
+
+bool inSameLogicalLine(const VisiblePosition& a, const VisiblePosition& b)
+{
+    return a.isNotNull() && logicalStartOfLine(a) == logicalStartOfLine(b);
+}
+
+VisiblePosition logicalEndOfLine(const VisiblePosition& c)
+{
+    VisiblePosition visPos = logicalEndPositionForLine(c);
+    
+    // Make sure the end of line is at the same line as the given input position. For a wrapping line, the logical end
+    // position for the not-last-2-lines might incorrectly hand back the logical beginning of the next line. 
+    // For example, <div contenteditable dir="rtl" style="line-break:before-white-space">abcdefg abcdefg abcdefg
+    // a abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg </div>
+    // In this case, use the previous position of the computed logical end position.
+    if (!inSameLogicalLine(c, visPos))
+        visPos = visPos.previous();
+    
+    return c.honorEditableBoundaryAtOrBefore(visPos);
+}
+
 }
diff --git a/WebCore/editing/visible_units.h b/WebCore/editing/visible_units.h
index 2663888..a20b588 100644
--- a/WebCore/editing/visible_units.h
+++ b/WebCore/editing/visible_units.h
@@ -53,8 +53,11 @@
 VisiblePosition previousLinePosition(const VisiblePosition &, int x);
 VisiblePosition nextLinePosition(const VisiblePosition &, int x);
 bool inSameLine(const VisiblePosition &, const VisiblePosition &);
+bool inSameLogicalLine(const VisiblePosition &, const VisiblePosition &);
 bool isStartOfLine(const VisiblePosition &);
 bool isEndOfLine(const VisiblePosition &);
+VisiblePosition logicalStartOfLine(const VisiblePosition &);
+VisiblePosition logicalEndOfLine(const VisiblePosition &);
 
 // paragraphs (perhaps a misnomer, can be divided by line break elements)
 VisiblePosition startOfParagraph(const VisiblePosition&);
diff --git a/WebCore/history/CachedFrame.cpp b/WebCore/history/CachedFrame.cpp
index db18903..9a43b9d 100644
--- a/WebCore/history/CachedFrame.cpp
+++ b/WebCore/history/CachedFrame.cpp
@@ -123,11 +123,13 @@
     if (m_document->inPageCache()) {
         Frame::clearTimers(m_view.get(), m_document.get());
 
+        // FIXME: Why do we need to call removeAllEventListeners here? When the document is in page cache, this method won't work
+        // fully anyway, because the document won't be able to access its DOMWindow object (due to being frameless).
+        m_document->removeAllEventListeners();
+
         m_document->setInPageCache(false);
         // FIXME: We don't call willRemove here. Why is that OK?
         m_document->detach();
-        m_document->removeAllEventListenersFromAllNodes();
-
         m_view->clearFrame();
     }
 
diff --git a/WebCore/history/CachedPage.cpp b/WebCore/history/CachedPage.cpp
index d6b66db..8898ce2 100644
--- a/WebCore/history/CachedPage.cpp
+++ b/WebCore/history/CachedPage.cpp
@@ -26,12 +26,9 @@
 #include "config.h"
 #include "CachedPage.h"
 
-#include "CachedFrame.h"
 #include "FocusController.h"
 #include "Frame.h"
-#ifndef NDEBUG
 #include "FrameView.h"
-#endif
 #include "Page.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/RefCountedLeakCounter.h>
diff --git a/WebCore/history/HistoryItem.cpp b/WebCore/history/HistoryItem.cpp
index 1d05042f..7826eb8 100644
--- a/WebCore/history/HistoryItem.cpp
+++ b/WebCore/history/HistoryItem.cpp
@@ -127,10 +127,10 @@
     if (item.m_formData)
         m_formData = item.m_formData->copy();
         
-    unsigned size = item.m_subItems.size();
-    m_subItems.reserveInitialCapacity(size);
+    unsigned size = item.m_children.size();
+    m_children.reserveInitialCapacity(size);
     for (unsigned i = 0; i < size; ++i)
-        m_subItems.append(item.m_subItems[i]->copy());
+        m_children.uncheckedAppend(item.m_children[i]->copy());
 
     if (item.m_redirectURLs)
         m_redirectURLs.set(new Vector<String>(*item.m_redirectURLs));
@@ -413,55 +413,64 @@
 
 void HistoryItem::addChildItem(PassRefPtr<HistoryItem> child)
 {
-    m_subItems.append(child);
+    ASSERT(!childItemWithTarget(child->target()));
+    m_children.append(child);
 #ifdef ANDROID_HISTORY_CLIENT
     notifyHistoryItemChanged(this);
 #endif
 }
 
-HistoryItem* HistoryItem::childItemWithName(const String& name) const
+void HistoryItem::setChildItem(PassRefPtr<HistoryItem> child)
 {
-    unsigned size = m_subItems.size();
-    for (unsigned i = 0; i < size; ++i) 
-        if (m_subItems[i]->target() == name)
-            return m_subItems[i].get();
+    ASSERT(!child->isTargetItem());
+    unsigned size = m_children.size();
+    for (unsigned i = 0; i < size; ++i)  {
+        if (m_children[i]->target() == child->target()) {
+            child->setIsTargetItem(m_children[i]->isTargetItem());
+            m_children[i] = child;
+            return;
+        }
+    }
+    m_children.append(child);
+}
+
+HistoryItem* HistoryItem::childItemWithTarget(const String& target) const
+{
+    unsigned size = m_children.size();
+    for (unsigned i = 0; i < size; ++i) {
+        if (m_children[i]->target() == target)
+            return m_children[i].get();
+    }
     return 0;
 }
 
-// <rdar://problem/4895849> HistoryItem::recurseToFindTargetItem() should be replace with a non-recursive method
-HistoryItem* HistoryItem::recurseToFindTargetItem()
+// <rdar://problem/4895849> HistoryItem::findTargetItem() should be replaced with a non-recursive method.
+HistoryItem* HistoryItem::findTargetItem()
 {
     if (m_isTargetItem)
         return this;
-    if (!m_subItems.size())
-        return 0;
-    
-    HistoryItem* match;
-    unsigned size = m_subItems.size();
+    unsigned size = m_children.size();
     for (unsigned i = 0; i < size; ++i) {
-        match = m_subItems[i]->recurseToFindTargetItem();
-        if (match)
+        if (HistoryItem* match = m_children[i]->targetItem())
             return match;
     }
-    
     return 0;
 }
 
 HistoryItem* HistoryItem::targetItem()
 {
-    if (!m_subItems.size())
-        return this;
-    return recurseToFindTargetItem();
+    HistoryItem* foundItem = findTargetItem();
+    return foundItem ? foundItem : this;
 }
 
 const HistoryItemVector& HistoryItem::children() const
 {
-    return m_subItems;
+    return m_children;
 }
 
 bool HistoryItem::hasChildren() const
 {
-    return m_subItems.size();
+    return !m_children.isEmpty();
 }
 
 String HistoryItem::formContentType() const
@@ -524,9 +533,9 @@
     return m_redirectURLs.get();
 }
 
-void HistoryItem::setRedirectURLs(std::auto_ptr<Vector<String> > redirectURLs)
+void HistoryItem::setRedirectURLs(PassOwnPtr<Vector<String> > redirectURLs)
 {
-    m_redirectURLs.adopt(redirectURLs);
+    m_redirectURLs = redirectURLs;
 }
 
 #ifndef NDEBUG
@@ -546,8 +555,8 @@
     fprintf(stderr, "%s+-%s (%p)\n", prefix.data(), m_urlString.utf8().data(), this);
     
     int totalSubItems = 0;
-    for (unsigned i = 0; i < m_subItems.size(); ++i)
-        totalSubItems += m_subItems[i]->showTreeWithIndent(indentLevel + 1);
+    for (unsigned i = 0; i < m_children.size(); ++i)
+        totalSubItems += m_children[i]->showTreeWithIndent(indentLevel + 1);
     return totalSubItems + 1;
 }
 
diff --git a/WebCore/history/HistoryItem.h b/WebCore/history/HistoryItem.h
index d35352e..2d8528c 100644
--- a/WebCore/history/HistoryItem.h
+++ b/WebCore/history/HistoryItem.h
@@ -29,6 +29,7 @@
 #include "IntPoint.h"
 #include "PlatformString.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(MAC)
 #import <wtf/RetainPtr.h>
@@ -137,9 +138,9 @@
     void setLastVisitWasHTTPNonGet(bool wasNotGet) { m_lastVisitWasHTTPNonGet = wasNotGet; }
 
     void addChildItem(PassRefPtr<HistoryItem>);
-    HistoryItem* childItemWithName(const String&) const;
+    void setChildItem(PassRefPtr<HistoryItem>);
+    HistoryItem* childItemWithTarget(const String&) const;
     HistoryItem* targetItem();
-    HistoryItem* recurseToFindTargetItem();
     const HistoryItemVector& children() const;
     bool hasChildren() const;
 
@@ -150,7 +151,7 @@
 
     void addRedirectURL(const String&);
     Vector<String>* redirectURLs() const;
-    void setRedirectURLs(std::auto_ptr<Vector<String> >);
+    void setRedirectURLs(PassOwnPtr<Vector<String> >);
 
     bool isCurrentDocument(Document*) const;
     
@@ -187,7 +188,7 @@
     HistoryItem();
     HistoryItem(const String& urlString, const String& title, double lastVisited);
     HistoryItem(const String& urlString, const String& title, const String& alternateTitle, double lastVisited);
-    HistoryItem(const KURL& url, const String& target, const String& parent, const String& title);
+    HistoryItem(const KURL& url, const String& frameName, const String& parent, const String& title);
 
     HistoryItem(const HistoryItem&);
 
@@ -195,6 +196,8 @@
     void collapseDailyVisitsToWeekly();
     void recordVisitAtTime(double);
 
+    HistoryItem* findTargetItem();
+
     String m_urlString;
     String m_originalURLString;
     String m_referrer;
@@ -209,7 +212,7 @@
     IntPoint m_scrollPoint;
     Vector<String> m_documentState;
     
-    HistoryItemVector m_subItems;
+    HistoryItemVector m_children;
     
     bool m_lastVisitWasFailure;
     bool m_isTargetItem;
diff --git a/WebCore/history/cf/HistoryPropertyList.cpp b/WebCore/history/cf/HistoryPropertyList.cpp
new file mode 100644
index 0000000..fd28237
--- /dev/null
+++ b/WebCore/history/cf/HistoryPropertyList.cpp
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HistoryPropertyList.h"
+
+#include "HistoryItem.h"
+#include <wtf/StringExtras.h>
+
+namespace WebCore {
+
+static const int currentFileVersion = 1;
+
+HistoryPropertyListWriter::HistoryPropertyListWriter()
+    : m_dailyVisitCountsKey("D")
+    , m_displayTitleKey("displayTitle")
+    , m_lastVisitWasFailureKey("lastVisitWasFailure")
+    , m_lastVisitWasHTTPNonGetKey("lastVisitWasHTTPNonGet")
+    , m_lastVisitedDateKey("lastVisitedDate")
+    , m_redirectURLsKey("redirectURLs")
+    , m_titleKey("title")
+    , m_urlKey("")
+    , m_visitCountKey("visitCount")
+    , m_weeklyVisitCountsKey("W")
+    , m_buffer(0)
+{
+}
+
+UInt8* HistoryPropertyListWriter::buffer(size_t size)
+{
+    ASSERT(!m_buffer);
+    m_buffer = static_cast<UInt8*>(CFAllocatorAllocate(0, size, 0));
+    m_bufferSize = size;
+    return m_buffer;
+}
+
+RetainPtr<CFDataRef> HistoryPropertyListWriter::releaseData()
+{
+    UInt8* buffer = m_buffer;
+    if (!buffer)
+        return 0;
+    m_buffer = 0;
+    RetainPtr<CFDataRef> data(AdoptCF, CFDataCreateWithBytesNoCopy(0, buffer, m_bufferSize, 0));
+    if (!data) {
+        CFAllocatorDeallocate(0, buffer);
+        return 0;
+    }
+    return data;
+}
+
+void HistoryPropertyListWriter::writeObjects(BinaryPropertyListObjectStream& stream)
+{
+    size_t outerDictionaryStart = stream.writeDictionaryStart();
+
+    stream.writeString("WebHistoryFileVersion");
+    stream.writeString("WebHistoryDates");
+
+    stream.writeInteger(currentFileVersion);
+    size_t outerDateArrayStart = stream.writeArrayStart();
+    writeHistoryItems(stream);
+    stream.writeArrayEnd(outerDateArrayStart);
+
+    stream.writeDictionaryEnd(outerDictionaryStart);
+}
+
+void HistoryPropertyListWriter::writeHistoryItem(BinaryPropertyListObjectStream& stream, HistoryItem* item)
+{
+    size_t itemDictionaryStart = stream.writeDictionaryStart();
+
+    const String& title = item->title();
+    const String& displayTitle = item->alternateTitle();
+    double lastVisitedDate = item->lastVisitedTime();
+    int visitCount = item->visitCount();
+    Vector<String>* redirectURLs = item->redirectURLs();
+    const Vector<int>& dailyVisitCounts = item->dailyVisitCounts();
+    const Vector<int>& weeklyVisitCounts = item->weeklyVisitCounts();
+
+    // keys
+    stream.writeString(m_urlKey);
+    if (!title.isEmpty())
+        stream.writeString(m_titleKey);
+    if (!displayTitle.isEmpty())
+        stream.writeString(m_displayTitleKey);
+    if (lastVisitedDate)
+        stream.writeString(m_lastVisitedDateKey);
+    if (visitCount)
+        stream.writeString(m_visitCountKey);
+    if (item->lastVisitWasFailure())
+        stream.writeString(m_lastVisitWasFailureKey);
+    if (item->lastVisitWasHTTPNonGet())
+        stream.writeString(m_lastVisitWasHTTPNonGetKey);
+    if (redirectURLs)
+        stream.writeString(m_redirectURLsKey);
+    if (!dailyVisitCounts.isEmpty())
+        stream.writeString(m_dailyVisitCountsKey);
+    if (!weeklyVisitCounts.isEmpty())
+        stream.writeString(m_weeklyVisitCountsKey);
+
+    // values
+    stream.writeUniqueString(item->urlString());
+    if (!title.isEmpty())
+        stream.writeString(title);
+    if (!displayTitle.isEmpty())
+        stream.writeString(displayTitle);
+    if (lastVisitedDate) {
+        char buffer[32];
+        snprintf(buffer, sizeof(buffer), "%.1lf", lastVisitedDate);
+        stream.writeUniqueString(buffer);
+    }
+    if (visitCount)
+        stream.writeInteger(visitCount);
+    if (item->lastVisitWasFailure())
+        stream.writeBooleanTrue();
+    if (item->lastVisitWasHTTPNonGet()) {
+        ASSERT(item->urlString().startsWith("http:", false) || item->urlString().startsWith("https:", false));
+        stream.writeBooleanTrue();
+    }
+    if (redirectURLs) {
+        size_t redirectArrayStart = stream.writeArrayStart();
+        size_t size = redirectURLs->size();
+        ASSERT(size);
+        for (size_t i = 0; i < size; ++i)
+            stream.writeUniqueString(redirectURLs->at(i));
+        stream.writeArrayEnd(redirectArrayStart);
+    }
+    if (size_t size = dailyVisitCounts.size())
+        stream.writeIntegerArray(dailyVisitCounts.data(), size);
+    if (size_t size = weeklyVisitCounts.size())
+        stream.writeIntegerArray(weeklyVisitCounts.data(), size);
+
+    stream.writeDictionaryEnd(itemDictionaryStart);
+}
+
+}
diff --git a/WebCore/history/cf/HistoryPropertyList.h b/WebCore/history/cf/HistoryPropertyList.h
new file mode 100644
index 0000000..fcb8c47
--- /dev/null
+++ b/WebCore/history/cf/HistoryPropertyList.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HistoryPropertyList_h
+#define HistoryPropertyList_h
+
+#include "BinaryPropertyList.h"
+#include "PlatformString.h"
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+class HistoryItem;
+
+class HistoryPropertyListWriter : public BinaryPropertyListWriter {
+public:
+    RetainPtr<CFDataRef> releaseData();
+
+protected:
+    HistoryPropertyListWriter();
+
+    void writeHistoryItem(BinaryPropertyListObjectStream&, HistoryItem*);
+
+private:
+    virtual void writeHistoryItems(BinaryPropertyListObjectStream&) = 0;
+
+    virtual void writeObjects(BinaryPropertyListObjectStream&);
+    virtual UInt8* buffer(size_t);
+
+    const String m_dailyVisitCountsKey;
+    const String m_displayTitleKey;
+    const String m_lastVisitWasFailureKey;
+    const String m_lastVisitWasHTTPNonGetKey;
+    const String m_lastVisitedDateKey;
+    const String m_redirectURLsKey;
+    const String m_titleKey;
+    const String m_urlKey;
+    const String m_visitCountKey;
+    const String m_weeklyVisitCountsKey;
+
+    UInt8* m_buffer;
+    size_t m_bufferSize;
+};
+
+}
+
+#endif
diff --git a/WebCore/html/CanvasPixelArray.idl b/WebCore/html/CanvasPixelArray.idl
index 9b333e4..c815788 100644
--- a/WebCore/html/CanvasPixelArray.idl
+++ b/WebCore/html/CanvasPixelArray.idl
@@ -27,7 +27,7 @@
  */
 
 module html {
-#if !defined(LANGUAGE_JAVASCRIPT) || defined(V8_BINDING)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT || defined(V8_BINDING) && V8_BINDING
     interface [
         CustomHeader,
         HasCustomIndexGetter,
diff --git a/WebCore/html/CanvasRenderingContext2D.cpp b/WebCore/html/CanvasRenderingContext2D.cpp
index 82680bd..f2541ed 100644
--- a/WebCore/html/CanvasRenderingContext2D.cpp
+++ b/WebCore/html/CanvasRenderingContext2D.cpp
@@ -36,6 +36,7 @@
 #include "CanvasGradient.h"
 #include "CanvasPattern.h"
 #include "CanvasStyle.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
 #include "Document.h"
@@ -49,7 +50,6 @@
 #include "ImageBuffer.h"
 #include "ImageData.h"
 #include "KURL.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "RenderHTMLCanvas.h"
 #include "SecurityOrigin.h"
@@ -60,6 +60,7 @@
 
 #include <wtf/ByteArray.h>
 #include <wtf/MathExtras.h>
+#include <wtf/OwnPtr.h>
 
 using namespace std;
 
@@ -95,6 +96,9 @@
     : m_canvas(canvas)
     , m_stateStack(1)
 {
+    // Make sure that even if the drawingContext() has a different default
+    // thickness, it is in sync with the canvas thickness.
+    setLineWidth(lineWidth());
 }
 
 void CanvasRenderingContext2D::ref()
@@ -1442,8 +1446,8 @@
         // FIXME: The rect is not big enough for miters on stroked text.
         IntRect maskRect = enclosingIntRect(textRect);
 
-        auto_ptr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
-        
+        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
+
         GraphicsContext* maskImageContext = maskImage->context();
 
         if (fill)
diff --git a/WebCore/html/CanvasStyle.cpp b/WebCore/html/CanvasStyle.cpp
index 0aaaab2..37308ad 100644
--- a/WebCore/html/CanvasStyle.cpp
+++ b/WebCore/html/CanvasStyle.cpp
@@ -44,8 +44,6 @@
 #include <QBrush>
 #include <QPen>
 #include <QColor>
-#elif PLATFORM(CAIRO)
-#include "NotImplemented.h"
 #endif
 
 namespace WebCore {
diff --git a/WebCore/html/CollectionCache.cpp b/WebCore/html/CollectionCache.cpp
new file mode 100644
index 0000000..feecd96
--- /dev/null
+++ b/WebCore/html/CollectionCache.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "CollectionCache.h"
+
+namespace WebCore {
+
+CollectionCache::CollectionCache()
+    : version(0)
+{
+    reset();
+}
+
+inline void CollectionCache::copyCacheMap(NodeCacheMap& dest, const NodeCacheMap& src)
+{
+    ASSERT(dest.isEmpty());
+    NodeCacheMap::const_iterator end = src.end();
+    for (NodeCacheMap::const_iterator it = src.begin(); it != end; ++it)
+        dest.add(it->first, new Vector<Element*>(*it->second));
+}
+
+CollectionCache::CollectionCache(const CollectionCache& other)
+    : version(other.version)
+    , current(other.current)
+    , position(other.position)
+    , length(other.length)
+    , elementsArrayPosition(other.elementsArrayPosition)
+    , hasLength(other.hasLength)
+    , hasNameCache(other.hasNameCache)
+{
+    copyCacheMap(idCache, other.idCache);
+    copyCacheMap(nameCache, other.nameCache);
+}
+
+void CollectionCache::swap(CollectionCache& other)
+{
+    std::swap(version, other.version);
+    std::swap(current, other.current);
+    std::swap(position, other.position);
+    std::swap(length, other.length);
+    std::swap(elementsArrayPosition, other.elementsArrayPosition);
+
+    idCache.swap(other.idCache);
+    nameCache.swap(other.nameCache);
+    
+    std::swap(hasLength, other.hasLength);
+    std::swap(hasNameCache, other.hasNameCache);
+}
+
+CollectionCache::~CollectionCache()
+{
+    deleteAllValues(idCache);
+    deleteAllValues(nameCache);
+}
+
+void CollectionCache::reset()
+{
+    current = 0;
+    position = 0;
+    length = 0;
+    hasLength = false;
+    elementsArrayPosition = 0;
+    deleteAllValues(idCache);
+    idCache.clear();
+    deleteAllValues(nameCache);
+    nameCache.clear();
+    hasNameCache = false;
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/CollectionCache.h b/WebCore/html/CollectionCache.h
new file mode 100644
index 0000000..7cdcdd5
--- /dev/null
+++ b/WebCore/html/CollectionCache.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef CollectionCache_h
+#define CollectionCache_h
+
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class AtomicStringImpl;
+class Element;
+
+struct CollectionCache {
+    CollectionCache();
+    CollectionCache(const CollectionCache&);
+    CollectionCache& operator=(const CollectionCache& other)
+    {
+        CollectionCache tmp(other);    
+        swap(tmp);
+        return *this;
+    }
+    ~CollectionCache();
+
+    void reset();
+    void swap(CollectionCache&);
+
+    typedef HashMap<AtomicStringImpl*, Vector<Element*>*> NodeCacheMap;
+
+    unsigned version;
+    Element* current;
+    unsigned position;
+    unsigned length;
+    int elementsArrayPosition;
+    NodeCacheMap idCache;
+    NodeCacheMap nameCache;
+    bool hasLength;
+    bool hasNameCache;
+
+private:
+    static void copyCacheMap(NodeCacheMap&, const NodeCacheMap&);
+};
+
+} // namespace
+
+#endif
diff --git a/WebCore/html/CollectionType.h b/WebCore/html/CollectionType.h
new file mode 100644
index 0000000..e5973a3
--- /dev/null
+++ b/WebCore/html/CollectionType.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef CollectionType_h
+#define CollectionType_h
+
+namespace WebCore {
+
+enum CollectionType {
+    // unnamed collection types cached in the document
+
+    DocImages,    // all <img> elements in the document
+    DocApplets,   // all <object> and <applet> elements
+    DocEmbeds,    // all <embed> elements
+    DocObjects,   // all <object> elements
+    DocForms,     // all <form> elements
+    DocLinks,     // all <a> _and_ <area> elements with a value for href
+    DocAnchors,   // all <a> elements with a value for name
+    DocScripts,   // all <script> elements
+
+    DocAll,       // "all" elements (IE)
+    NodeChildren, // first-level children (IE)
+
+    // named collection types cached in the document
+
+    WindowNamedItems,
+    DocumentNamedItems,
+
+    // types not cached in the document; these are types that can't be used on a document
+
+    TableTBodies, // all <tbody> elements in this table
+    TSectionRows, // all row elements in this table section
+    TRCells,      // all cells in this row
+    SelectOptions,
+    MapAreas,
+
+    OtherCollection
+};
+
+static const CollectionType FirstUnnamedDocumentCachedType = DocImages;
+static const unsigned NumUnnamedDocumentCachedTypes = NodeChildren - DocImages + 1;
+
+static const CollectionType FirstNamedDocumentCachedType = WindowNamedItems;
+static const unsigned NumNamedDocumentCachedTypes = DocumentNamedItems - WindowNamedItems + 1;
+
+} // namespace
+
+#endif
diff --git a/WebCore/html/HTMLAnchorElement.cpp b/WebCore/html/HTMLAnchorElement.cpp
index c6b2a95..354f9f0 100644
--- a/WebCore/html/HTMLAnchorElement.cpp
+++ b/WebCore/html/HTMLAnchorElement.cpp
@@ -36,6 +36,7 @@
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "MutationEvent.h"
 #include "Page.h"
@@ -280,11 +281,17 @@
         bool wasLink = isLink();
         setIsLink(!attr->isNull());
         if (wasLink != isLink())
-            setChanged();
-        if (isLink() && document()->isDNSPrefetchEnabled()) {
-            String value = attr->value();
-            if (protocolIs(value, "http") || protocolIs(value, "https") || value.startsWith("//"))
-                prefetchDNS(document()->completeURL(value).host());
+            setNeedsStyleRecalc();
+        if (isLink()) {
+            String parsedURL = parseURL(attr->value());
+            if (document()->isDNSPrefetchEnabled()) {
+                if (protocolIs(parsedURL, "http") || protocolIs(parsedURL, "https") || parsedURL.startsWith("//"))
+                    prefetchDNS(document()->completeURL(parsedURL).host());
+            }
+            if (document()->page() && !document()->page()->javaScriptURLsAreAllowed() && protocolIsJavaScript(parsedURL)) {
+                setIsLink(false);
+                attr->setValue(nullAtom);
+            }
         }
     } else if (attr->name() == nameAttr ||
              attr->name() == titleAttr ||
diff --git a/WebCore/html/HTMLAnchorElement.idl b/WebCore/html/HTMLAnchorElement.idl
index f3a15ee..c2dda3d 100644
--- a/WebCore/html/HTMLAnchorElement.idl
+++ b/WebCore/html/HTMLAnchorElement.idl
@@ -47,11 +47,11 @@
         readonly attribute DOMString search;
         readonly attribute DOMString text;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL absoluteLinkURL;
 #endif
diff --git a/WebCore/html/HTMLAppletElement.cpp b/WebCore/html/HTMLAppletElement.cpp
index de8e1cf..13dd911 100644
--- a/WebCore/html/HTMLAppletElement.cpp
+++ b/WebCore/html/HTMLAppletElement.cpp
@@ -27,6 +27,7 @@
 #include "Frame.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderApplet.h"
 #include "RenderInline.h"
 #include "Settings.h"
@@ -119,8 +120,6 @@
         const AtomicString& codeBase = getAttribute(codebaseAttr);
         if (!codeBase.isNull())
             args.set("codeBase", codeBase);
-        else
-            args.set("codeBase", document()->baseURL().baseAsString());
 
         const AtomicString& name = getAttribute(document()->isHTMLDocument() ? nameAttr : idAttr);
         if (!name.isNull())
diff --git a/WebCore/html/HTMLAppletElement.idl b/WebCore/html/HTMLAppletElement.idl
index 794f000..95f03a7 100644
--- a/WebCore/html/HTMLAppletElement.idl
+++ b/WebCore/html/HTMLAppletElement.idl
@@ -35,14 +35,14 @@
                  attribute [ConvertNullToNullString] DOMString code;
                  attribute [ConvertNullToNullString] DOMString codeBase;
                  attribute [ConvertNullToNullString] DOMString height;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString hspace;
 #else
                  attribute [ConvertFromString] long hspace;
 #endif
                  attribute [ConvertNullToNullString] DOMString name;
                  attribute [ConvertNullToNullString] DOMString object;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString vspace;
 #else
                  attribute [ConvertFromString] long vspace;
diff --git a/WebCore/html/HTMLAreaElement.cpp b/WebCore/html/HTMLAreaElement.cpp
index 9db50b7..2f7c1a5 100644
--- a/WebCore/html/HTMLAreaElement.cpp
+++ b/WebCore/html/HTMLAreaElement.cpp
@@ -27,6 +27,7 @@
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "Length.h"
+#include "MappedAttribute.h"
 #include "Path.h"
 #include "RenderObject.h"
 
diff --git a/WebCore/html/HTMLAreaElement.idl b/WebCore/html/HTMLAreaElement.idl
index 39cc719..d80ebed 100644
--- a/WebCore/html/HTMLAreaElement.idl
+++ b/WebCore/html/HTMLAreaElement.idl
@@ -42,7 +42,7 @@
         readonly attribute DOMString protocol;
         readonly attribute DOMString search;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL absoluteLinkURL;
 #endif
diff --git a/WebCore/html/HTMLAttributeNames.in b/WebCore/html/HTMLAttributeNames.in
index 5cb556e..7caf0e5 100644
--- a/WebCore/html/HTMLAttributeNames.in
+++ b/WebCore/html/HTMLAttributeNames.in
@@ -22,6 +22,7 @@
 aria-valuemax
 aria-valuemin
 aria-valuenow
+autobuffer
 autocomplete
 autofocus
 autoplay
@@ -140,6 +141,8 @@
 onmouseover
 onmouseup
 onmousewheel
+ononline
+onoffline
 onpaste
 onreset
 onresize
@@ -183,6 +186,7 @@
 shape
 size
 span
+spellcheck
 src
 standby
 start
diff --git a/WebCore/html/HTMLBRElement.cpp b/WebCore/html/HTMLBRElement.cpp
index e98f8d1..6f86e6a 100644
--- a/WebCore/html/HTMLBRElement.cpp
+++ b/WebCore/html/HTMLBRElement.cpp
@@ -19,11 +19,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLBRElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderBR.h"
 
 namespace WebCore {
diff --git a/WebCore/html/HTMLBaseElement.cpp b/WebCore/html/HTMLBaseElement.cpp
index dd4f7b3..a278908 100644
--- a/WebCore/html/HTMLBaseElement.cpp
+++ b/WebCore/html/HTMLBaseElement.cpp
@@ -29,6 +29,7 @@
 #include "FrameLoader.h"
 #include "HTMLNames.h"
 #include "KURL.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/html/HTMLBaseFontElement.idl b/WebCore/html/HTMLBaseFontElement.idl
index a94f3ab..f09c9d7 100644
--- a/WebCore/html/HTMLBaseFontElement.idl
+++ b/WebCore/html/HTMLBaseFontElement.idl
@@ -26,7 +26,7 @@
     ] HTMLBaseFontElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString color;
         attribute [ConvertNullToNullString] DOMString face;
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         attribute [ConvertToString] DOMString size; // this changed to a long, but our existing API is a string
 #else
         attribute long size;
diff --git a/WebCore/html/HTMLBodyElement.cpp b/WebCore/html/HTMLBodyElement.cpp
index a23f9be..9828dab 100644
--- a/WebCore/html/HTMLBodyElement.cpp
+++ b/WebCore/html/HTMLBodyElement.cpp
@@ -32,9 +32,12 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "EventNames.h"
+#include "Frame.h"
 #include "FrameView.h"
 #include "HTMLFrameElementBase.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "ScriptEventListener.h"
 
 namespace WebCore {
 
@@ -131,25 +134,26 @@
         if (attached())
             document()->recalcStyle(Force);
     } else if (attr->name() == onloadAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onbeforeunloadAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().beforeunloadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onunloadAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().unloadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onblurAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onresizeAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().resizeEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onscrollAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().scrollEvent, attr);
-    else if (attr->name() == onstorageAttr) {
-        // The HTML5 spec currently specifies that storage events are fired only at the body element of
-        // an HTMLDocument, which is why the onstorage attribute differs from the ones before it.
-        // The spec might change on this, and then so should we!
-        setInlineEventListenerForTypeAndAttribute(eventNames().storageEvent, attr);
-    } else
+        document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onstorageAttr)
+        document()->setWindowAttributeEventListener(eventNames().storageEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == ononlineAttr)
+        document()->setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onofflineAttr)
+        document()->setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else
         HTMLElement::parseMappedAttribute(attr);
 }
 
@@ -240,13 +244,24 @@
     setAttribute(vlinkAttr, value);
 }
 
+static int adjustForZoom(int value, FrameView* frameView)
+{
+    float zoomFactor = frameView->frame()->zoomFactor();
+    if (zoomFactor == 1)
+        return value;
+    // Needed because of truncation (rather than rounding) when scaling up.
+    if (zoomFactor > 1)
+        value++;
+    return static_cast<int>(value / zoomFactor);
+}
+
 int HTMLBodyElement::scrollLeft() const
 {
     // Update the document's layout.
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->scrollX() : 0;
+    return view ? adjustForZoom(view->scrollX(), view) : 0;
 }
 
 void HTMLBodyElement::setScrollLeft(int scrollLeft)
@@ -255,7 +270,7 @@
     if (sview) {
         // Update the document's layout
         document()->updateLayoutIgnorePendingStylesheets();
-        sview->setScrollPosition(IntPoint(scrollLeft, sview->scrollY()));
+        sview->setScrollPosition(IntPoint(static_cast<int>(scrollLeft * sview->frame()->zoomFactor()), sview->scrollY()));
     }    
 }
 
@@ -265,7 +280,7 @@
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->scrollY() : 0;
+    return view ? adjustForZoom(view->scrollY(), view) : 0;
 }
 
 void HTMLBodyElement::setScrollTop(int scrollTop)
@@ -274,7 +289,7 @@
     if (sview) {
         // Update the document's layout
         document()->updateLayoutIgnorePendingStylesheets();
-        sview->setScrollPosition(IntPoint(sview->scrollX(), scrollTop));
+        sview->setScrollPosition(IntPoint(sview->scrollX(), static_cast<int>(scrollTop * sview->frame()->zoomFactor())));
     }        
 }
 
@@ -284,7 +299,7 @@
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->contentsHeight() : 0;    
+    return view ? adjustForZoom(view->contentsHeight(), view) : 0;    
 }
 
 int HTMLBodyElement::scrollWidth() const
@@ -293,7 +308,7 @@
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->contentsWidth() : 0;    
+    return view ? adjustForZoom(view->contentsWidth(), view) : 0;    
 }
 
 void HTMLBodyElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
@@ -303,4 +318,16 @@
     addSubresourceURL(urls, document()->completeURL(background()));
 }
 
+void HTMLBodyElement::didMoveToNewOwnerDocument()
+{
+    // When moving body elements between documents, we should have to reset the parent sheet for any
+    // link style declarations.  If we don't we might crash later.
+    // In practice I can't reproduce this theoretical problem.
+    // webarchive/adopt-attribute-styled-body-webarchive.html tries to make sure this crash won't surface.
+    if (m_linkDecl)
+        m_linkDecl->setParent(document()->elementSheet());
+    
+    HTMLElement::didMoveToNewOwnerDocument();
+}
+
 }
diff --git a/WebCore/html/HTMLBodyElement.h b/WebCore/html/HTMLBodyElement.h
index a72e668..8e434be 100644
--- a/WebCore/html/HTMLBodyElement.h
+++ b/WebCore/html/HTMLBodyElement.h
@@ -61,19 +61,22 @@
     String vLink() const;
     void setVLink(const String&);
 
-    int scrollLeft() const;
-    void setScrollLeft(int scrollLeft);
+    virtual int scrollLeft() const;
+    virtual void setScrollLeft(int scrollLeft);
     
-    int scrollTop() const;
-    void setScrollTop(int scrollTop);
+    virtual int scrollTop() const;
+    virtual void setScrollTop(int scrollTop);
     
-    int scrollHeight() const;
-    int scrollWidth() const;
+    virtual int scrollHeight() const;
+    virtual int scrollWidth() const;
     
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
     
 protected:
     RefPtr<CSSMutableStyleDeclaration> m_linkDecl;
+
+private:
+    virtual void didMoveToNewOwnerDocument();
 };
 
 } //namespace
diff --git a/WebCore/html/HTMLBodyElement.idl b/WebCore/html/HTMLBodyElement.idl
index 41d20d6..c639183 100644
--- a/WebCore/html/HTMLBodyElement.idl
+++ b/WebCore/html/HTMLBodyElement.idl
@@ -31,12 +31,6 @@
         attribute [ConvertNullToNullString] DOMString link;
         attribute [ConvertNullToNullString] DOMString text;
         attribute [ConvertNullToNullString] DOMString vLink; 
-
-        // IE Extensions
-                 attribute long scrollLeft;
-                 attribute long scrollTop;
-        readonly attribute long scrollWidth;
-        readonly attribute long scrollHeight;
     };
 
 }
diff --git a/WebCore/html/HTMLButtonElement.cpp b/WebCore/html/HTMLButtonElement.cpp
index 571f30c..3987859 100644
--- a/WebCore/html/HTMLButtonElement.cpp
+++ b/WebCore/html/HTMLButtonElement.cpp
@@ -30,7 +30,9 @@
 #include "FormDataList.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "RenderButton.h"
 #include <wtf/StdLibExtras.h>
 
@@ -55,7 +57,7 @@
     return new (arena) RenderButton(this);
 }
 
-const AtomicString& HTMLButtonElement::type() const
+const AtomicString& HTMLButtonElement::formControlType() const
 {
     switch (m_type) {
         case SUBMIT: {
@@ -89,9 +91,9 @@
         // Don't map 'align' attribute.  This matches what Firefox and IE do, but not Opera.
         // See http://bugs.webkit.org/show_bug.cgi?id=12071
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else
         HTMLFormControlElement::parseMappedAttribute(attr);
 }
diff --git a/WebCore/html/HTMLButtonElement.h b/WebCore/html/HTMLButtonElement.h
index c8f51cb..b1d744c 100644
--- a/WebCore/html/HTMLButtonElement.h
+++ b/WebCore/html/HTMLButtonElement.h
@@ -33,7 +33,7 @@
     HTMLButtonElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
     virtual ~HTMLButtonElement();
 
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
         
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
diff --git a/WebCore/html/HTMLCanvasElement.cpp b/WebCore/html/HTMLCanvasElement.cpp
index 1cd2796..9e635e7 100644
--- a/WebCore/html/HTMLCanvasElement.cpp
+++ b/WebCore/html/HTMLCanvasElement.cpp
@@ -39,6 +39,7 @@
 #include "HTMLNames.h"
 #include "ImageBuffer.h"
 #include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderHTMLCanvas.h"
 #include "Settings.h"
@@ -71,6 +72,8 @@
 
 HTMLCanvasElement::~HTMLCanvasElement()
 {
+    if (m_observer)
+        m_observer->canvasDestroyed(this);
 }
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -256,7 +259,11 @@
     if (!size.width() || !size.height())
         return;
 
-    m_imageBuffer.set(ImageBuffer::create(size, false).release());
+    m_imageBuffer = ImageBuffer::create(size, false);
+    // The convertLogicalToDevice MaxCanvasArea check should prevent common cases
+    // where ImageBuffer::create() returns NULL, however we could still be low on memory.
+    if (!m_imageBuffer)
+        return;
     m_imageBuffer->context()->scale(FloatSize(size.width() / unscaledSize.width(), size.height() / unscaledSize.height()));
     m_imageBuffer->context()->setShadowsIgnoreTransforms(true);
 }
diff --git a/WebCore/html/HTMLCanvasElement.h b/WebCore/html/HTMLCanvasElement.h
index 12b3cb2..bba1f2d 100644
--- a/WebCore/html/HTMLCanvasElement.h
+++ b/WebCore/html/HTMLCanvasElement.h
@@ -49,8 +49,9 @@
 public:
     virtual ~CanvasObserver() {};
 
-    virtual void canvasChanged(HTMLCanvasElement* element, const FloatRect& changedRect) = 0;
-    virtual void canvasResized(HTMLCanvasElement* element) = 0;
+    virtual void canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect) = 0;
+    virtual void canvasResized(HTMLCanvasElement*) = 0;
+    virtual void canvasDestroyed(HTMLCanvasElement*) = 0;
 };
 
 class HTMLCanvasElement : public HTMLElement {
diff --git a/WebCore/html/HTMLCanvasElement.idl b/WebCore/html/HTMLCanvasElement.idl
index bf69ac0..13fc623 100644
--- a/WebCore/html/HTMLCanvasElement.idl
+++ b/WebCore/html/HTMLCanvasElement.idl
@@ -37,7 +37,7 @@
         DOMString toDataURL(in [ConvertUndefinedOrNullToNullString] DOMString type)
             raises(DOMException);
 
-#if !defined(LANGUAGE_OBJECTIVE_C)
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         [V8Custom] DOMObject getContext(in DOMString contextId);
 #endif
 
diff --git a/WebCore/html/HTMLCollection.cpp b/WebCore/html/HTMLCollection.cpp
index fd588dd..de4c424 100644
--- a/WebCore/html/HTMLCollection.cpp
+++ b/WebCore/html/HTMLCollection.cpp
@@ -35,7 +35,7 @@
 
 using namespace HTMLNames;
 
-HTMLCollection::HTMLCollection(PassRefPtr<Node> base, Type type)
+HTMLCollection::HTMLCollection(PassRefPtr<Node> base, CollectionType type)
     : m_idsDone(false)
     , m_base(base)
     , m_type(type)
@@ -44,7 +44,7 @@
 {
 }
 
-HTMLCollection::HTMLCollection(PassRefPtr<Node> base, Type type, CollectionInfo* info)
+HTMLCollection::HTMLCollection(PassRefPtr<Node> base, CollectionType type, CollectionCache* info)
     : m_idsDone(false)
     , m_base(base)
     , m_type(type)
@@ -53,7 +53,7 @@
 {
 }
 
-PassRefPtr<HTMLCollection> HTMLCollection::create(PassRefPtr<Node> base, Type type)
+PassRefPtr<HTMLCollection> HTMLCollection::create(PassRefPtr<Node> base, CollectionType type)
 {
     return adoptRef(new HTMLCollection(base, type));
 }
@@ -64,74 +64,12 @@
         delete m_info;
 }
 
-HTMLCollection::CollectionInfo::CollectionInfo()
-    : version(0)
-{
-    reset();
-}
-
-inline void HTMLCollection::CollectionInfo::copyCacheMap(NodeCacheMap& dest, const NodeCacheMap& src)
-{
-    ASSERT(dest.isEmpty());
-    NodeCacheMap::const_iterator end = src.end();
-    for (NodeCacheMap::const_iterator it = src.begin(); it != end; ++it)
-        dest.add(it->first, new Vector<Element*>(*it->second));
-}
-
-HTMLCollection::CollectionInfo::CollectionInfo(const CollectionInfo& other)
-    : version(other.version)
-    , current(other.current)
-    , position(other.position)
-    , length(other.length)
-    , elementsArrayPosition(other.elementsArrayPosition)
-    , hasLength(other.hasLength)
-    , hasNameCache(other.hasNameCache)
-{
-    copyCacheMap(idCache, other.idCache);
-    copyCacheMap(nameCache, other.nameCache);
-}
-
-void HTMLCollection::CollectionInfo::swap(CollectionInfo& other)
-{
-    std::swap(version, other.version);
-    std::swap(current, other.current);
-    std::swap(position, other.position);
-    std::swap(length, other.length);
-    std::swap(elementsArrayPosition, other.elementsArrayPosition);
-
-    idCache.swap(other.idCache);
-    nameCache.swap(other.nameCache);
-    
-    std::swap(hasLength, other.hasLength);
-    std::swap(hasNameCache, other.hasNameCache);
-}
-
-HTMLCollection::CollectionInfo::~CollectionInfo()
-{
-    deleteAllValues(idCache);
-    deleteAllValues(nameCache);
-}
-
-void HTMLCollection::CollectionInfo::reset()
-{
-    current = 0;
-    position = 0;
-    length = 0;
-    hasLength = false;
-    elementsArrayPosition = 0;
-    deleteAllValues(idCache);
-    idCache.clear();
-    deleteAllValues(nameCache);
-    nameCache.clear();
-    hasNameCache = false;
-}
-
 void HTMLCollection::resetCollectionInfo() const
 {
     unsigned docversion = static_cast<HTMLDocument*>(m_base->document())->domTreeVersion();
 
     if (!m_info) {
-        m_info = new CollectionInfo;
+        m_info = new CollectionCache;
         m_ownsInfo = true;
         m_info->version = docversion;
         return;
@@ -164,7 +102,7 @@
         case DocScripts:
         case DocumentNamedItems:
         case MapAreas:
-        case Other:
+        case OtherCollection:
         case SelectOptions:
         case WindowNamedItems:
             break;
@@ -245,7 +183,7 @@
             case NodeChildren:
                 return e;
             case DocumentNamedItems:
-            case Other:
+            case OtherCollection:
             case WindowNamedItems:
                 ASSERT_NOT_REACHED();
                 break;
diff --git a/WebCore/html/HTMLCollection.h b/WebCore/html/HTMLCollection.h
index 083ec05..b04bcbc 100644
--- a/WebCore/html/HTMLCollection.h
+++ b/WebCore/html/HTMLCollection.h
@@ -23,6 +23,7 @@
 #ifndef HTMLCollection_h
 #define HTMLCollection_h
 
+#include "CollectionType.h"
 #include <wtf/RefCounted.h>
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -37,46 +38,11 @@
 class NodeList;
 class String;
 
+struct CollectionCache;
+
 class HTMLCollection : public RefCounted<HTMLCollection> {
 public:
-    enum Type {
-        // unnamed collection types cached in the document
-
-        DocImages,    // all <img> elements in the document
-        DocApplets,   // all <object> and <applet> elements
-        DocEmbeds,    // all <embed> elements
-        DocObjects,   // all <object> elements
-        DocForms,     // all <form> elements
-        DocLinks,     // all <a> _and_ <area> elements with a value for href
-        DocAnchors,   // all <a> elements with a value for name
-        DocScripts,   // all <script> elements
-
-        DocAll,       // "all" elements (IE)
-        NodeChildren, // first-level children (IE)
-
-        // named collection types cached in the document
-
-        WindowNamedItems,
-        DocumentNamedItems,
-
-        // types not cached in the document; these are types that can't be used on a document
-
-        TableTBodies, // all <tbody> elements in this table
-        TSectionRows, // all row elements in this table section
-        TRCells,      // all cells in this row
-        SelectOptions,
-        MapAreas,
-
-        Other
-    };
-
-    static const Type FirstUnnamedDocumentCachedType = DocImages;
-    static const unsigned NumUnnamedDocumentCachedTypes = NodeChildren - DocImages + 1;
-
-    static const Type FirstNamedDocumentCachedType = WindowNamedItems;
-    static const unsigned NumNamedDocumentCachedTypes = DocumentNamedItems - WindowNamedItems + 1;
-
-    static PassRefPtr<HTMLCollection> create(PassRefPtr<Node> base, Type);
+    static PassRefPtr<HTMLCollection> create(PassRefPtr<Node> base, CollectionType);
     virtual ~HTMLCollection();
     
     unsigned length() const;
@@ -94,52 +60,18 @@
     PassRefPtr<NodeList> tags(const String&);
 
     Node* base() const { return m_base.get(); }
-    Type type() const { return m_type; }
-
-    // FIXME: This class name is a bad in two ways. First, "info" is much too vague,
-    // and doesn't convey the job of this class (caching collection state).
-    // Second, since this is a member of HTMLCollection, it doesn't need "collection"
-    // in its name.
-    struct CollectionInfo {
-        CollectionInfo();
-        CollectionInfo(const CollectionInfo&);
-        CollectionInfo& operator=(const CollectionInfo& other)
-        {
-            CollectionInfo tmp(other);    
-            swap(tmp);
-            return *this;
-        }
-        ~CollectionInfo();
-
-        void reset();
-        void swap(CollectionInfo&);
-
-        typedef HashMap<AtomicStringImpl*, Vector<Element*>*> NodeCacheMap;
-
-        unsigned version;
-        Element* current;
-        unsigned position;
-        unsigned length;
-        int elementsArrayPosition;
-        NodeCacheMap idCache;
-        NodeCacheMap nameCache;
-        bool hasLength;
-        bool hasNameCache;
-
-    private:
-        static void copyCacheMap(NodeCacheMap&, const NodeCacheMap&);
-    };
+    CollectionType type() const { return m_type; }
 
 protected:
-    HTMLCollection(PassRefPtr<Node> base, Type, CollectionInfo*);
+    HTMLCollection(PassRefPtr<Node> base, CollectionType, CollectionCache*);
 
-    CollectionInfo* info() const { return m_info; }
-    virtual void resetCollectionInfo() const;
+    CollectionCache* info() const { return m_info; }
+    void resetCollectionInfo() const;
 
     mutable bool m_idsDone; // for nextNamedItem()
 
 private:
-    HTMLCollection(PassRefPtr<Node> base, Type);
+    HTMLCollection(PassRefPtr<Node> base, CollectionType);
 
     virtual Element* itemAfter(Element*) const;
     virtual unsigned calcLength() const;
@@ -148,9 +80,9 @@
     bool checkForNameMatch(Element*, bool checkName, const AtomicString& name) const;
 
     RefPtr<Node> m_base;
-    Type m_type;
+    CollectionType m_type;
 
-    mutable CollectionInfo* m_info;
+    mutable CollectionCache* m_info;
     mutable bool m_ownsInfo;
 };
 
diff --git a/WebCore/html/HTMLCollection.idl b/WebCore/html/HTMLCollection.idl
index 8290e1a..1ba5ec7 100644
--- a/WebCore/html/HTMLCollection.idl
+++ b/WebCore/html/HTMLCollection.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -26,6 +26,7 @@
         HasNameGetter,
         CustomCall,
         CustomToJS,
+        Polymorphic,
         InterfaceUUID=b0d215ff-6f9c-4d1f-86c3-f200a65a5134,
         ImplementationUUID=8e81b17f-7f74-4121-8f2f-a339a7e66447
     ] HTMLCollection {
diff --git a/WebCore/html/HTMLDivElement.cpp b/WebCore/html/HTMLDivElement.cpp
index 7ffccd7..bd7195e 100644
--- a/WebCore/html/HTMLDivElement.cpp
+++ b/WebCore/html/HTMLDivElement.cpp
@@ -19,12 +19,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLDivElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/html/HTMLDocument.idl b/WebCore/html/HTMLDocument.idl
index 4345195..3dd7a07 100644
--- a/WebCore/html/HTMLDocument.idl
+++ b/WebCore/html/HTMLDocument.idl
@@ -37,7 +37,7 @@
 
         // Extensions
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // FIXME: This should eventually be available (if they are wanted) for all languages.
                  attribute [Custom, Deletable] HTMLCollection all;
 #endif
diff --git a/WebCore/html/HTMLElement.cpp b/WebCore/html/HTMLElement.cpp
index 906f847..c50e6ba 100644
--- a/WebCore/html/HTMLElement.cpp
+++ b/WebCore/html/HTMLElement.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,12 +33,15 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLBRElement.h"
+#include "HTMLCollection.h"
 #include "HTMLDocument.h"
 #include "HTMLElementFactory.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
-#include "HTMLTokenizer.h" // parseHTMLDocumentFragment
+#include "HTMLTokenizer.h"
+#include "MappedAttribute.h"
 #include "RenderWordBreak.h"
+#include "ScriptEventListener.h"
 #include "Settings.h"
 #include "Text.h"
 #include "TextIterator.h"
@@ -65,7 +69,8 @@
 {
     // FIXME: Would be nice to have an atomicstring lookup based off uppercase chars that does not have to copy
     // the string on a hit in the hash.
-    if (document()->isHTMLDocument())
+    // FIXME: We should have a way to detect XHTML elements and replace the hasPrefix() check with it.
+    if (document()->isHTMLDocument() && !tagQName().hasPrefix())
         return tagQName().localName().string().upper();
     return Element::nodeName();
 }
@@ -141,84 +146,84 @@
     }
 // standard events
     else if (attr->name() == onclickAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().clickEvent, attr);
+        setAttributeEventListener(eventNames().clickEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oncontextmenuAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().contextmenuEvent, attr);
+        setAttributeEventListener(eventNames().contextmenuEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondblclickAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dblclickEvent, attr);
+        setAttributeEventListener(eventNames().dblclickEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmousedownAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousedownEvent, attr);
+        setAttributeEventListener(eventNames().mousedownEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmousemoveAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousemoveEvent, attr);
+        setAttributeEventListener(eventNames().mousemoveEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmouseoutAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseoutEvent, attr);
+        setAttributeEventListener(eventNames().mouseoutEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmouseoverAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseoverEvent, attr);
+        setAttributeEventListener(eventNames().mouseoverEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmouseupAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseupEvent, attr);
+        setAttributeEventListener(eventNames().mouseupEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmousewheelAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousewheelEvent, attr);
+        setAttributeEventListener(eventNames().mousewheelEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeydownAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().keydownEvent, attr);
+        setAttributeEventListener(eventNames().keydownEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeypressAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().keypressEvent, attr);
+        setAttributeEventListener(eventNames().keypressEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeyupAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().keyupEvent, attr);
+        setAttributeEventListener(eventNames().keyupEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onscrollAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().scrollEvent, attr);
+        setAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforecutAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforecutEvent, attr);
+        setAttributeEventListener(eventNames().beforecutEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oncutAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().cutEvent, attr);
+        setAttributeEventListener(eventNames().cutEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforecopyAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforecopyEvent, attr);
+        setAttributeEventListener(eventNames().beforecopyEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oncopyAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().copyEvent, attr);
+        setAttributeEventListener(eventNames().copyEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforepasteAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforepasteEvent, attr);
+        setAttributeEventListener(eventNames().beforepasteEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onpasteAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().pasteEvent, attr);
+        setAttributeEventListener(eventNames().pasteEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragenterAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragenterEvent, attr);
+        setAttributeEventListener(eventNames().dragenterEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragoverAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragoverEvent, attr);
+        setAttributeEventListener(eventNames().dragoverEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragleaveAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragleaveEvent, attr);
+        setAttributeEventListener(eventNames().dragleaveEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondropAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dropEvent, attr);
+        setAttributeEventListener(eventNames().dropEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragstartAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragstartEvent, attr);
+        setAttributeEventListener(eventNames().dragstartEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragEvent, attr);
+        setAttributeEventListener(eventNames().dragEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragendAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragendEvent, attr);
+        setAttributeEventListener(eventNames().dragendEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onselectstartAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().selectstartEvent, attr);
+        setAttributeEventListener(eventNames().selectstartEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onsubmitAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().submitEvent, attr);
+        setAttributeEventListener(eventNames().submitEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onerrorAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().errorEvent, attr);
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkitanimationstartAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitAnimationStartEvent, attr);
+        setAttributeEventListener(eventNames().webkitAnimationStartEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkitanimationiterationAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitAnimationIterationEvent, attr);
+        setAttributeEventListener(eventNames().webkitAnimationIterationEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkitanimationendAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitAnimationEndEvent, attr);
+        setAttributeEventListener(eventNames().webkitAnimationEndEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkittransitionendAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitTransitionEndEvent, attr);
+        setAttributeEventListener(eventNames().webkitTransitionEndEvent, createAttributeEventListener(this, attr));
 #if ENABLE(TOUCH_EVENTS) // Android
     } else if (attr->name() == ontouchstartAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().touchstartEvent, attr);
+        setAttributeEventListener(eventNames().touchstartEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ontouchendAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().touchendEvent, attr);
+        setAttributeEventListener(eventNames().touchendEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ontouchmoveAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().touchmoveEvent, attr);
+        setAttributeEventListener(eventNames().touchmoveEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ontouchcancelAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().touchcancelEvent, attr);
+        setAttributeEventListener(eventNames().touchcancelEvent, createAttributeEventListener(this, attr));
 #endif
     }
 }
@@ -394,7 +399,7 @@
     }
 
     // FIXME: Do we need to be able to detect preserveNewline style even when there's no renderer?
-    // FIXME: Can the renderer be out of date here? Do we need to call updateRendering?
+    // FIXME: Can the renderer be out of date here? Do we need to call updateStyleIfNeeded?
     // For example, for the contents of textarea elements that are display:none?
     RenderObject* r = renderer();
     if (r && r->style()->preserveNewline()) {
@@ -611,7 +616,7 @@
 
     // FIXME: this is a terrible thing to do here:
     // https://bugs.webkit.org/show_bug.cgi?id=21834
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
 
     if (!renderer()) {
         if (parentNode())
@@ -628,7 +633,7 @@
     if (document()->frame() && document()->frame()->isContentEditable())
         return true;
 
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
 
     if (!renderer()) {
         if (parentNode())
@@ -642,7 +647,7 @@
 
 String HTMLElement::contentEditable() const 
 {
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
 
     if (!renderer())
         return "false";
@@ -777,7 +782,7 @@
 
 PassRefPtr<HTMLCollection> HTMLElement::children()
 {
-    return HTMLCollection::create(this, HTMLCollection::NodeChildren);
+    return HTMLCollection::create(this, NodeChildren);
 }
 
 // DOM Section 1.1.1
@@ -987,11 +992,13 @@
     
 bool HTMLElement::rendererIsNeeded(RenderStyle *style)
 {
+#if !ENABLE(XHTMLMP)
     if (hasLocalName(noscriptTag)) {
         Settings* settings = document()->settings();
         if (settings && settings->isJavaScriptEnabled())
             return false;
     }
+#endif
     return StyledElement::rendererIsNeeded(style);
 }
     
diff --git a/WebCore/html/HTMLElement.idl b/WebCore/html/HTMLElement.idl
index 8ce5542..ed21628 100644
--- a/WebCore/html/HTMLElement.idl
+++ b/WebCore/html/HTMLElement.idl
@@ -36,8 +36,6 @@
                  attribute [ConvertNullToNullString] DOMString className;
 
                  attribute long            tabIndex;
-                 void                      blur();
-                 void                      focus();
 
         // Extensions
                  attribute [ConvertNullToNullString] DOMString innerHTML
@@ -64,7 +62,7 @@
                  attribute [ConvertNullToNullString] DOMString contentEditable;
         readonly attribute boolean isContentEditable;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute DOMString titleDisplayString;
 #endif
     };
diff --git a/WebCore/html/HTMLElementsAllInOne.cpp b/WebCore/html/HTMLElementsAllInOne.cpp
new file mode 100644
index 0000000..dad548c
--- /dev/null
+++ b/WebCore/html/HTMLElementsAllInOne.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following disclaimer
+ *       in the documentation and/or other materials provided with the
+ *       distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ *       contributors may be used to endorse or promote products derived from
+ *       this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This source file coalesces the HTML elements into a single object file to
+// reduce bloat and allow us to link release builds on 32-bit Windows.
+
+#include "HTMLAnchorElement.cpp"
+#include "HTMLAppletElement.cpp"
+#include "HTMLAreaElement.cpp"
+#include "HTMLAudioElement.cpp"
+#include "HTMLBRElement.cpp"
+#include "HTMLBaseElement.cpp"
+#include "HTMLBaseFontElement.cpp"
+#include "HTMLBlockquoteElement.cpp"
+#include "HTMLBodyElement.cpp"
+#include "HTMLButtonElement.cpp"
+#include "HTMLCanvasElement.cpp"
+#include "HTMLDListElement.cpp"
+#include "HTMLDirectoryElement.cpp"
+#include "HTMLDivElement.cpp"
+#include "HTMLElement.cpp"
+#include "HTMLEmbedElement.cpp"
+#include "HTMLFieldSetElement.cpp"
+#include "HTMLFontElement.cpp"
+#include "HTMLFormControlElement.cpp"
+#include "HTMLFormElement.cpp"
+#include "HTMLFrameElement.cpp"
+#include "HTMLFrameElementBase.cpp"
+#include "HTMLFrameOwnerElement.cpp"
+#include "HTMLFrameSetElement.cpp"
+#include "HTMLHRElement.cpp"
+#include "HTMLHeadElement.cpp"
+#include "HTMLHeadingElement.cpp"
+#include "HTMLHtmlElement.cpp"
+#include "HTMLIFrameElement.cpp"
+#include "HTMLImageElement.cpp"
+#include "HTMLInputElement.cpp"
+#include "HTMLIsIndexElement.cpp"
+#include "HTMLKeygenElement.cpp"
+#include "HTMLLIElement.cpp"
+#include "HTMLLabelElement.cpp"
+#include "HTMLLegendElement.cpp"
+#include "HTMLLinkElement.cpp"
+#include "HTMLMapElement.cpp"
+#include "HTMLMarqueeElement.cpp"
+#include "HTMLMediaElement.cpp"
+#include "HTMLMenuElement.cpp"
+#include "HTMLMetaElement.cpp"
+#include "HTMLModElement.cpp"
+#include "HTMLOListElement.cpp"
+#include "HTMLObjectElement.cpp"
+#include "HTMLOptGroupElement.cpp"
+#include "HTMLOptionElement.cpp"
+#include "HTMLParagraphElement.cpp"
+#include "HTMLParamElement.cpp"
+#include "HTMLPlugInElement.cpp"
+#include "HTMLPlugInImageElement.cpp"
+#include "HTMLPreElement.cpp"
+#include "HTMLQuoteElement.cpp"
+#include "HTMLScriptElement.cpp"
+#include "HTMLSelectElement.cpp"
+#include "HTMLSourceElement.cpp"
+#include "HTMLStyleElement.cpp"
+#include "HTMLTableCaptionElement.cpp"
+#include "HTMLTableCellElement.cpp"
+#include "HTMLTableColElement.cpp"
+#include "HTMLTableElement.cpp"
+#include "HTMLTablePartElement.cpp"
+#include "HTMLTableRowElement.cpp"
+#include "HTMLTableSectionElement.cpp"
+#include "HTMLTextAreaElement.cpp"
+#include "HTMLTitleElement.cpp"
+#include "HTMLUListElement.cpp"
+#include "HTMLVideoElement.cpp"
diff --git a/WebCore/html/HTMLEmbedElement.cpp b/WebCore/html/HTMLEmbedElement.cpp
index f467849..2500dd6 100644
--- a/WebCore/html/HTMLEmbedElement.cpp
+++ b/WebCore/html/HTMLEmbedElement.cpp
@@ -31,10 +31,12 @@
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
 #include "RenderPartObject.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
+#include "Settings.h"
 
 namespace WebCore {
 
@@ -137,6 +139,14 @@
         return false;
     }
 
+#if ENABLE(DASHBOARD_SUPPORT)
+    // Workaround for <rdar://problem/6642221>. 
+    if (Settings* settings = frame->settings()) {
+        if (settings->usesDashboardBackwardCompatibilityMode())
+            return true;
+    }
+#endif
+
     return HTMLPlugInElement::rendererIsNeeded(style);
 }
 
@@ -170,7 +180,7 @@
 
 void HTMLEmbedElement::updateWidget()
 {
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer() && !isImageType())
         static_cast<RenderPartObject*>(renderer())->updateWidget(true);
 }
diff --git a/WebCore/html/HTMLEmbedElement.idl b/WebCore/html/HTMLEmbedElement.idl
index 10c3007..ecf8a96 100644
--- a/WebCore/html/HTMLEmbedElement.idl
+++ b/WebCore/html/HTMLEmbedElement.idl
@@ -30,7 +30,7 @@
         ImplementationUUID=93e0407a-8380-4ff0-978d-f773f2dee6a3
     ] HTMLEmbedElement : HTMLElement {
                  attribute [ConvertNullToNullString] DOMString align;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString height;
 #else
                  attribute [ConvertFromString] long height;
@@ -38,18 +38,20 @@
                  attribute [ConvertNullToNullString] DOMString name;
                  attribute [ConvertNullToNullString] DOMString src;
                  attribute [ConvertNullToNullString] DOMString type;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString width;
 #else
                  attribute [ConvertFromString] long width;
 #endif
 
-#if !defined(LANGUAGE_COM)
-#if ENABLE_SVG
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
     };
 
 }
diff --git a/WebCore/html/HTMLFieldSetElement.cpp b/WebCore/html/HTMLFieldSetElement.cpp
index d90550d..eb8d4ed 100644
--- a/WebCore/html/HTMLFieldSetElement.cpp
+++ b/WebCore/html/HTMLFieldSetElement.cpp
@@ -53,7 +53,7 @@
     return HTMLElement::isFocusable();
 }
 
-const AtomicString& HTMLFieldSetElement::type() const
+const AtomicString& HTMLFieldSetElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, fieldset, ("fieldset"));
     return fieldset;
diff --git a/WebCore/html/HTMLFieldSetElement.h b/WebCore/html/HTMLFieldSetElement.h
index 9a6cff1..e79f2c5 100644
--- a/WebCore/html/HTMLFieldSetElement.h
+++ b/WebCore/html/HTMLFieldSetElement.h
@@ -46,7 +46,7 @@
 
     virtual bool isFocusable() const;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
 
     virtual bool willValidate() const { return false; }
 };
diff --git a/WebCore/html/HTMLFontElement.cpp b/WebCore/html/HTMLFontElement.cpp
index 91b6448..d19032a 100644
--- a/WebCore/html/HTMLFontElement.cpp
+++ b/WebCore/html/HTMLFontElement.cpp
@@ -26,6 +26,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 using namespace WTF;
 
diff --git a/WebCore/html/HTMLFormCollection.cpp b/WebCore/html/HTMLFormCollection.cpp
index 03796d6..812d98a 100644
--- a/WebCore/html/HTMLFormCollection.cpp
+++ b/WebCore/html/HTMLFormCollection.cpp
@@ -23,6 +23,7 @@
 #include "config.h"
 #include "HTMLFormCollection.h"
 
+#include "CollectionCache.h"
 #include "HTMLFormControlElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLImageElement.h"
@@ -35,15 +36,15 @@
 // Since the collections are to be "live", we have to do the
 // calculation every time if anything has changed.
 
-inline HTMLCollection::CollectionInfo* HTMLFormCollection::formCollectionInfo(HTMLFormElement* form)
+inline CollectionCache* HTMLFormCollection::formCollectionInfo(HTMLFormElement* form)
 {
     if (!form->collectionInfo)
-        form->collectionInfo = new CollectionInfo;
+        form->collectionInfo = new CollectionCache;
     return form->collectionInfo;
 }
 
 HTMLFormCollection::HTMLFormCollection(PassRefPtr<HTMLFormElement> form)
-    : HTMLCollection(form.get(), Other, formCollectionInfo(form.get()))
+    : HTMLCollection(form.get(), OtherCollection, formCollectionInfo(form.get()))
 {
 }
 
diff --git a/WebCore/html/HTMLFormCollection.h b/WebCore/html/HTMLFormCollection.h
index 524a59b..a204446 100644
--- a/WebCore/html/HTMLFormCollection.h
+++ b/WebCore/html/HTMLFormCollection.h
@@ -51,7 +51,7 @@
     virtual void updateNameCache() const;
     virtual unsigned calcLength() const;
 
-    static CollectionInfo* formCollectionInfo(HTMLFormElement*);
+    static CollectionCache* formCollectionInfo(HTMLFormElement*);
 
     Element* getNamedItem(const QualifiedName& attrName, const AtomicString& name) const;
     Element* nextNamedItemInternal(const String& name) const;
diff --git a/WebCore/html/HTMLFormControlElement.cpp b/WebCore/html/HTMLFormControlElement.cpp
index 5238ad5..36d20ac 100644
--- a/WebCore/html/HTMLFormControlElement.cpp
+++ b/WebCore/html/HTMLFormControlElement.cpp
@@ -34,6 +34,7 @@
 #include "HTMLNames.h"
 #include "HTMLParser.h"
 #include "HTMLTokenizer.h"
+#include "MappedAttribute.h"
 #include "RenderBox.h"
 #include "RenderTheme.h"
 
@@ -68,7 +69,7 @@
         bool oldDisabled = m_disabled;
         m_disabled = !attr->isNull();
         if (oldDisabled != m_disabled) {
-            setChanged();
+            setNeedsStyleRecalc();
             if (renderer() && renderer()->style()->hasAppearance())
                 theme()->stateChanged(renderer(), EnabledState);
         }
@@ -76,7 +77,7 @@
         bool oldReadOnly = m_readOnly;
         m_readOnly = !attr->isNull();
         if (oldReadOnly != m_readOnly) {
-            setChanged();
+            setNeedsStyleRecalc();
             if (renderer() && renderer()->style()->hasAppearance())
                 theme()->stateChanged(renderer(), ReadOnlyState);
         }
@@ -103,7 +104,7 @@
     if (hasTagName(inputTag))
         isInputTypeHidden = static_cast<HTMLInputElement*>(this)->isInputTypeHidden();
 
-    if (autofocus() && renderer() && !document()->ignoreAutofocus() && !isReadOnlyControl() &&
+    if (autofocus() && renderer() && !document()->ignoreAutofocus() && !isReadOnlyFormControl() &&
             ((hasTagName(inputTag) && !isInputTypeHidden) || hasTagName(selectTag) ||
               hasTagName(buttonTag) || hasTagName(textareaTag)))
          focus();
@@ -151,7 +152,7 @@
     HTMLElement::removedFromTree(deep);
 }
 
-const AtomicString& HTMLFormControlElement::name() const
+const AtomicString& HTMLFormControlElement::formControlName() const
 {
     const AtomicString& n = getAttribute(nameAttr);
     return n.isNull() ? emptyAtom : n;
@@ -162,9 +163,9 @@
     setAttribute(nameAttr, value);
 }
 
-void HTMLFormControlElement::onChange()
+void HTMLFormControlElement::dispatchFormControlChangeEvent()
 {
-    dispatchEventForType(eventNames().changeEvent, true, false);
+    dispatchEvent(eventNames().changeEvent, true, false);
 }
 
 bool HTMLFormControlElement::disabled() const
@@ -238,7 +239,7 @@
     //      The control does not have a repetition template as an ancestor.
     //      The control does not have a datalist element as an ancestor.
     //      The control is not an output element.
-    return form() && name().length() && !disabled() && !isReadOnlyControl();
+    return form() && name().length() && !disabled() && !isReadOnlyFormControl();
 }
     
 bool HTMLFormControlElement::supportsFocus() const
@@ -262,23 +263,23 @@
 HTMLFormControlElementWithState::HTMLFormControlElementWithState(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLFormControlElement(tagName, doc, f)
 {
-    FormControlElementWithState::registerFormControlElementWithState(this, document());
+    document()->registerFormElementWithState(this);
 }
 
 HTMLFormControlElementWithState::~HTMLFormControlElementWithState()
 {
-    FormControlElementWithState::unregisterFormControlElementWithState(this, document());
+    document()->unregisterFormElementWithState(this);
 }
 
 void HTMLFormControlElementWithState::willMoveToNewOwnerDocument()
 {
-    FormControlElementWithState::unregisterFormControlElementWithState(this, document());
+    document()->unregisterFormElementWithState(this);
     HTMLFormControlElement::willMoveToNewOwnerDocument();
 }
 
 void HTMLFormControlElementWithState::didMoveToNewOwnerDocument()
 {
-    FormControlElementWithState::registerFormControlElementWithState(this, document());
+    document()->registerFormElementWithState(this);
     HTMLFormControlElement::didMoveToNewOwnerDocument();
 }
 
@@ -289,7 +290,7 @@
     if (doc->hasStateForNewFormElements()) {
         String state;
         if (doc->takeStateForFormElement(name().impl(), type().impl(), state))
-            restoreState(state);
+            restoreFormControlState(state);
     }
 }
 
diff --git a/WebCore/html/HTMLFormControlElement.h b/WebCore/html/HTMLFormControlElement.h
index 7430df7..0a7bbd1 100644
--- a/WebCore/html/HTMLFormControlElement.h
+++ b/WebCore/html/HTMLFormControlElement.h
@@ -24,8 +24,6 @@
 #ifndef HTMLFormControlElement_h
 #define HTMLFormControlElement_h
 
-#include "FormControlElement.h"
-#include "FormControlElementWithState.h"
 #include "HTMLElement.h"
 
 namespace WebCore {
@@ -33,7 +31,7 @@
 class FormDataList;
 class HTMLFormElement;
 
-class HTMLFormControlElement : public HTMLElement, public FormControlElement {
+class HTMLFormControlElement : public HTMLElement {
 public:
     HTMLFormControlElement(const QualifiedName& tagName, Document*, HTMLFormElement*);
     virtual ~HTMLFormControlElement();
@@ -43,10 +41,8 @@
 
     HTMLFormElement* form() const { return m_form; }
 
-    virtual const AtomicString& type() const = 0;
-
-    virtual bool isTextControl() const { return false; }
-    virtual bool isEnabled() const { return !disabled(); }
+    virtual bool isTextFormControl() const { return false; }
+    virtual bool isEnabledFormControl() const { return !disabled(); }
 
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void attach();
@@ -55,10 +51,10 @@
 
     virtual void reset() {}
 
-    virtual bool valueMatchesRenderer() const { return m_valueMatchesRenderer; }
-    virtual void setValueMatchesRenderer(bool b = true) { m_valueMatchesRenderer = b; }
+    virtual bool formControlValueMatchesRenderer() const { return m_valueMatchesRenderer; }
+    virtual void setFormControlValueMatchesRenderer(bool b) { m_valueMatchesRenderer = b; }
 
-    void onChange();
+    virtual void dispatchFormControlChangeEvent();
 
     bool disabled() const;
     void setDisabled(bool);
@@ -69,7 +65,7 @@
     virtual bool isMouseFocusable() const;
     virtual bool isEnumeratable() const { return false; }
 
-    virtual bool isReadOnlyControl() const { return m_readOnly; }
+    virtual bool isReadOnlyFormControl() const { return m_readOnly; }
     void setReadOnly(bool);
 
     // Determines whether or not a control will be automatically focused
@@ -78,7 +74,12 @@
 
     virtual void recalcStyle(StyleChange);
 
-    virtual const AtomicString& name() const;
+    virtual const AtomicString& formControlName() const;
+    virtual const AtomicString& formControlType() const = 0;
+
+    const AtomicString& type() const { return formControlType(); }
+    const AtomicString& name() const { return formControlName(); }
+
     void setName(const AtomicString& name);
 
     virtual bool isFormControlElement() const { return true; }
@@ -111,14 +112,11 @@
     bool m_valueMatchesRenderer;
 };
 
-class HTMLFormControlElementWithState : public HTMLFormControlElement, public FormControlElementWithState  {
+class HTMLFormControlElementWithState : public HTMLFormControlElement {
 public:
     HTMLFormControlElementWithState(const QualifiedName& tagName, Document*, HTMLFormElement*);
     virtual ~HTMLFormControlElementWithState();
 
-    virtual bool isFormControlElementWithState() const { return true; }
-
-    virtual FormControlElement* toFormControlElement() { return this; }
     virtual void finishParsingChildren();
 
 protected:
diff --git a/WebCore/html/HTMLFormElement.cpp b/WebCore/html/HTMLFormElement.cpp
index df4e541..64cac37 100644
--- a/WebCore/html/HTMLFormElement.cpp
+++ b/WebCore/html/HTMLFormElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ -34,6 +34,7 @@
 #include "FileSystem.h"
 #include "FormData.h"
 #include "FormDataList.h"
+#include "FormState.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
@@ -41,22 +42,21 @@
 #include "HTMLImageElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderTextControl.h"
+#include <limits>
 #include <wtf/CurrentTime.h>
 #include <wtf/RandomNumber.h>
 
-#include <limits>
-
 #if PLATFORM(WX)
 #include <wx/defs.h>
 #include <wx/filename.h>
 #endif
 
-#if PLATFORM(WIN_OS)
-#include <shlwapi.h>
-#endif
+using namespace std;
 
 namespace WebCore {
 
@@ -79,6 +79,7 @@
     , m_doingsubmit(false)
     , m_inreset(false)
     , m_malformed(false)
+    , m_demoted(false)
 {
     ASSERT(hasTagName(formTag));
 }
@@ -107,6 +108,31 @@
     HTMLElement::attach();
 }
 
+bool HTMLFormElement::rendererIsNeeded(RenderStyle* style)
+{
+    if (!isDemoted())
+        return HTMLElement::rendererIsNeeded(style);
+    
+    Node* node = parentNode();
+    RenderObject* parentRenderer = node->renderer();
+    bool parentIsTableElementPart = (parentRenderer->isTable() && node->hasTagName(tableTag))
+        || (parentRenderer->isTableRow() && node->hasTagName(trTag))
+        || (parentRenderer->isTableSection() && node->hasTagName(tbodyTag))
+        || (parentRenderer->isTableCol() && node->hasTagName(colTag)) 
+        || (parentRenderer->isTableCell() && node->hasTagName(trTag));
+
+    if (!parentIsTableElementPart)
+        return true;
+
+    EDisplay display = style->display();
+    bool formIsTablePart = display == TABLE || display == INLINE_TABLE || display == TABLE_ROW_GROUP
+        || display == TABLE_HEADER_GROUP || display == TABLE_FOOTER_GROUP || display == TABLE_ROW
+        || display == TABLE_COLUMN_GROUP || display == TABLE_COLUMN || display == TABLE_CELL
+        || display == TABLE_CAPTION;
+
+    return formIsTablePart;
+}
+
 void HTMLFormElement::insertedIntoDocument()
 {
     if (document()->isHTMLDocument())
@@ -269,7 +295,7 @@
     m_insubmit = true;
     m_doingsubmit = false;
 
-    if (dispatchEventForType(eventNames().submitEvent, true, true) && !m_doingsubmit)
+    if (dispatchEvent(eventNames().submitEvent, true, true) && !m_doingsubmit)
         m_doingsubmit = true;
 
     m_insubmit = false;
@@ -280,6 +306,28 @@
     return m_doingsubmit;
 }
 
+static void transferMailtoPostFormDataToURL(RefPtr<FormData>& data, KURL& url, const String& encodingType)
+{
+    String body = data->flattenToString();
+    data = FormData::create();
+
+    if (equalIgnoringCase(encodingType, "text/plain")) {
+        // Convention seems to be to decode, and s/&/\r\n/. Also, spaces are encoded as %20.
+        body = decodeURLEscapeSequences(body.replace('&', "\r\n").replace('+', ' ') + "\r\n");
+    }
+
+    Vector<char> bodyData;
+    bodyData.append("body=", 5);
+    FormDataBuilder::encodeStringAsFormData(bodyData, body.utf8());
+    body = String(bodyData.data(), bodyData.size()).replace('+', "%20");
+
+    String query = url.query();
+    if (!query.isEmpty())
+        query.append('&');
+    query.append(body);
+    url.setQuery(query);
+}
+
 void HTMLFormElement::submit(Event* event, bool activateSubmitButton, bool lockHistory, bool lockBackForwardList)
 {
     FrameView* view = document()->view();
@@ -297,14 +345,14 @@
     HTMLFormControlElement* firstSuccessfulSubmitButton = 0;
     bool needButtonActivation = activateSubmitButton; // do we need to activate a submit button?
     
-    frame->loader()->clearRecordedFormValues();
-    frame->loader()->setFormAboutToBeSubmitted(this);
+    Vector<pair<String, String> > formValues;
+
     for (unsigned i = 0; i < formElements.size(); ++i) {
         HTMLFormControlElement* control = formElements[i];
         if (control->hasLocalName(inputTag)) {
             HTMLInputElement* input = static_cast<HTMLInputElement*>(control);
             if (input->isTextField()) {
-                frame->loader()->recordFormValue(input->name(), input->value());
+                formValues.append(pair<String, String>(input->name(), input->value()));
                 if (input->isSearchField())
                     input->addSearchResult();
             }
@@ -317,6 +365,8 @@
         }
     }
 
+    RefPtr<FormState> formState = FormState::create(this, formValues, frame);
+
     if (needButtonActivation && firstSuccessfulSubmitButton)
         firstSuccessfulSubmitButton->setActivatedSubmit(true);
     
@@ -331,25 +381,22 @@
 
         if (!m_formDataBuilder.isMultiPartForm()) {
             RefPtr<FormData> data = createFormData(CString());
+
             if (isMailtoForm()) {
-                String body = data->flattenToString();
-                if (equalIgnoringCase(m_formDataBuilder.encodingType(), "text/plain")) {
-                    // Convention seems to be to decode, and s/&/\r\n/. Also, spaces are encoded as %20.
-                    body = decodeURLEscapeSequences(body.replace('&', "\r\n").replace('+', ' ') + "\r\n");
-                }
-                Vector<char> bodyData;
-                bodyData.append("body=", 5);
-                FormDataBuilder::encodeStringAsFormData(bodyData, body.utf8());
-                data = FormData::create(String(bodyData.data(), bodyData.size()).replace('+', "%20").latin1());
+                // Convert the form data into a string that we put into the URL.
+                KURL url = document()->completeURL(m_url);
+                transferMailtoPostFormDataToURL(data, url, m_formDataBuilder.encodingType());
+                m_url = url.string();
             }
-            frame->loader()->submitForm("POST", m_url, data, m_target, m_formDataBuilder.encodingType(), String(), event, lockHistory, lockBackForwardList);
+
+            frame->loader()->submitForm("POST", m_url, data.release(), m_target, m_formDataBuilder.encodingType(), String(), lockHistory, lockBackForwardList, event, formState.release());
         } else {
             Vector<char> boundary = m_formDataBuilder.generateUniqueBoundaryString();
-            frame->loader()->submitForm("POST", m_url, createFormData(boundary.data()), m_target, m_formDataBuilder.encodingType(), boundary.data(), event, lockHistory, lockBackForwardList);
+            frame->loader()->submitForm("POST", m_url, createFormData(boundary.data()), m_target, m_formDataBuilder.encodingType(), boundary.data(), lockHistory, lockBackForwardList, event, formState.release());
         }
     } else {
         m_formDataBuilder.setIsMultiPartForm(false);
-        frame->loader()->submitForm("GET", m_url, createFormData(CString()), m_target, String(), String(), event, lockHistory, lockBackForwardList);
+        frame->loader()->submitForm("GET", m_url, createFormData(CString()), m_target, String(), String(), lockHistory, lockBackForwardList, event, formState.release());
     }
 
     if (needButtonActivation && firstSuccessfulSubmitButton)
@@ -368,7 +415,7 @@
 
     // ### DOM2 labels this event as not cancelable, however
     // common browsers( sick! ) allow it be cancelled.
-    if ( !dispatchEventForType(eventNames().resetEvent,true, true) ) {
+    if ( !dispatchEvent(eventNames().resetEvent,true, true) ) {
         m_inreset = false;
         return;
     }
@@ -402,9 +449,9 @@
         else
             document()->unregisterForDocumentActivationCallbacks(this);
     } else if (attr->name() == onsubmitAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().submitEvent, attr);
+        setAttributeEventListener(eventNames().submitEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onresetAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().resetEvent, attr);
+        setAttributeEventListener(eventNames().resetEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (inDocument() && document()->isHTMLDocument()) {
@@ -581,70 +628,14 @@
 {
     if (!m_autocomplete)
         document()->unregisterForDocumentActivationCallbacks(this);
+    HTMLElement::willMoveToNewOwnerDocument();
 }
 
 void HTMLFormElement::didMoveToNewOwnerDocument()
 {
-    if(m_autocomplete)
+    if (!m_autocomplete)
         document()->registerForDocumentActivationCallbacks(this);
-}
-
-void HTMLFormElement::CheckedRadioButtons::addButton(HTMLFormControlElement* element)
-{
-    // We only want to add radio buttons.
-    if (!element->isRadioButton())
-        return;
-
-    // Without a name, there is no group.
-    if (element->name().isEmpty())
-        return;
-
-    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
-
-    // We only track checked buttons.
-    if (!inputElement->checked())
-        return;
-
-    if (!m_nameToCheckedRadioButtonMap)
-        m_nameToCheckedRadioButtonMap.set(new NameToInputMap);
-
-    pair<NameToInputMap::iterator, bool> result = m_nameToCheckedRadioButtonMap->add(element->name().impl(), inputElement);
-    if (result.second)
-        return;
-    
-    HTMLInputElement* oldCheckedButton = result.first->second;
-    if (oldCheckedButton == inputElement)
-        return;
-
-    result.first->second = inputElement;
-    oldCheckedButton->setChecked(false);
-}
-
-HTMLInputElement* HTMLFormElement::CheckedRadioButtons::checkedButtonForGroup(const AtomicString& name) const
-{
-    if (!m_nameToCheckedRadioButtonMap)
-        return 0;
-    
-    return m_nameToCheckedRadioButtonMap->get(name.impl());
-}
-
-void HTMLFormElement::CheckedRadioButtons::removeButton(HTMLFormControlElement* element)
-{
-    if (element->name().isEmpty() || !m_nameToCheckedRadioButtonMap)
-        return;
-    
-    NameToInputMap::iterator it = m_nameToCheckedRadioButtonMap->find(element->name().impl());
-    if (it == m_nameToCheckedRadioButtonMap->end() || it->second != element)
-        return;
-    
-    InputElement* inputElement = toInputElement(element);
-    ASSERT_UNUSED(inputElement, inputElement);
-    ASSERT(inputElement->isChecked());
-    ASSERT(element->isRadioButton());
-
-    m_nameToCheckedRadioButtonMap->remove(it);
-    if (m_nameToCheckedRadioButtonMap->isEmpty())
-        m_nameToCheckedRadioButtonMap.clear();
+    HTMLElement::didMoveToNewOwnerDocument();
 }
 
 } // namespace
diff --git a/WebCore/html/HTMLFormElement.h b/WebCore/html/HTMLFormElement.h
index 8e5027c..d08e16c 100644
--- a/WebCore/html/HTMLFormElement.h
+++ b/WebCore/html/HTMLFormElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,10 +24,9 @@
 #ifndef HTMLFormElement_h
 #define HTMLFormElement_h
 
+#include "CheckedRadioButtons.h"
 #include "FormDataBuilder.h"
-#include "HTMLCollection.h" 
 #include "HTMLElement.h"
-
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -40,6 +39,8 @@
 class HTMLFormCollection;
 class TextEncoding;
 
+struct CollectionCache;
+
 class HTMLFormElement : public HTMLElement { 
 public:
     HTMLFormElement(const QualifiedName&, Document*);
@@ -49,6 +50,7 @@
     virtual int tagPriority() const { return 3; }
 
     virtual void attach();
+    virtual bool rendererIsNeeded(RenderStyle*);
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
  
@@ -83,6 +85,9 @@
     void setMalformed(bool malformed) { m_malformed = malformed; }
     bool isMalformed() const { return m_malformed; }
 
+    void setDemoted(bool demoted) { m_demoted = demoted; }
+    bool isDemoted() const { return m_demoted; }
+
     virtual bool isURLAttribute(Attribute*) const;
     
     void submitClick(Event*);
@@ -109,17 +114,6 @@
     // FIXME: Change this to be private after getting rid of all the clients.
     Vector<HTMLFormControlElement*> formElements;
 
-    class CheckedRadioButtons {
-    public:
-        void addButton(HTMLFormControlElement*);
-        void removeButton(HTMLFormControlElement*);
-        HTMLInputElement* checkedButtonForGroup(const AtomicString& name) const;
-
-    private:
-        typedef HashMap<AtomicStringImpl*, HTMLInputElement*> NameToInputMap;
-        OwnPtr<NameToInputMap> m_nameToCheckedRadioButtonMap;
-    };
-    
     CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
     
     virtual void documentDidBecomeActive();
@@ -140,7 +134,7 @@
 
     FormDataBuilder m_formDataBuilder;
     AliasMap* m_elementAliases;
-    HTMLCollection::CollectionInfo* collectionInfo;
+    CollectionCache* collectionInfo;
 
     CheckedRadioButtons m_checkedRadioButtons;
     
@@ -152,6 +146,7 @@
     bool m_doingsubmit : 1;
     bool m_inreset : 1;
     bool m_malformed : 1;
+    bool m_demoted : 1;
     AtomicString m_name;
 };
 
diff --git a/WebCore/html/HTMLFrameElement.cpp b/WebCore/html/HTMLFrameElement.cpp
index 63ec265..adc3ff1 100644
--- a/WebCore/html/HTMLFrameElement.cpp
+++ b/WebCore/html/HTMLFrameElement.cpp
@@ -27,14 +27,15 @@
 #include "Frame.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderFrame.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* doc, bool createdByParser)
-    : HTMLFrameElementBase(tagName, doc, createdByParser)
+HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* document)
+    : HTMLFrameElementBase(tagName, document)
     , m_frameBorder(true)
     , m_frameBorderSet(false)
 {
diff --git a/WebCore/html/HTMLFrameElement.h b/WebCore/html/HTMLFrameElement.h
index 5cd9b92..ab602ee 100644
--- a/WebCore/html/HTMLFrameElement.h
+++ b/WebCore/html/HTMLFrameElement.h
@@ -33,10 +33,9 @@
 class RenderArena;
 class RenderStyle;
 
-class HTMLFrameElement : public HTMLFrameElementBase
-{
+class HTMLFrameElement : public HTMLFrameElementBase {
 public:
-    HTMLFrameElement(const QualifiedName&, Document*, bool createdByParser);
+    HTMLFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
     virtual int tagPriority() const { return 0; }
diff --git a/WebCore/html/HTMLFrameElement.idl b/WebCore/html/HTMLFrameElement.idl
index bc512ff..106e57e 100644
--- a/WebCore/html/HTMLFrameElement.idl
+++ b/WebCore/html/HTMLFrameElement.idl
@@ -38,15 +38,17 @@
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
-#if ENABLE_SVG
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
 
                  attribute [ConvertNullToNullString, CustomSetter] DOMString       location;
         readonly attribute long            width;
diff --git a/WebCore/html/HTMLFrameElementBase.cpp b/WebCore/html/HTMLFrameElementBase.cpp
index 59e7d46..1e09595 100644
--- a/WebCore/html/HTMLFrameElementBase.cpp
+++ b/WebCore/html/HTMLFrameElementBase.cpp
@@ -34,7 +34,9 @@
 #include "FrameView.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "KURL.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderFrame.h"
 #include "Settings.h"
@@ -43,8 +45,8 @@
 
 using namespace HTMLNames;
 
-HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Document* doc, bool createdByParser)
-    : HTMLFrameOwnerElement(tagName, doc, createdByParser)
+HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Document* document)
+    : HTMLFrameOwnerElement(tagName, document)
     , m_scrolling(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
@@ -140,10 +142,10 @@
         if (contentFrame())
             contentFrame()->setInViewSourceMode(viewSourceMode());
     } else if (attr->name() == onloadAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforeunloadAttr) {
         // FIXME: should <frame> elements have beforeunload handlers?
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforeunloadEvent, attr);
+        setAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(this, attr));
     } else
         HTMLFrameOwnerElement::parseMappedAttribute(attr);
 }
diff --git a/WebCore/html/HTMLFrameElementBase.h b/WebCore/html/HTMLFrameElementBase.h
index 923cd2f..4a24451 100644
--- a/WebCore/html/HTMLFrameElementBase.h
+++ b/WebCore/html/HTMLFrameElementBase.h
@@ -82,7 +82,7 @@
     bool viewSourceMode() const { return m_viewSource; }
 
 protected:
-    HTMLFrameElementBase(const QualifiedName&, Document*, bool createdByParser);
+    HTMLFrameElementBase(const QualifiedName&, Document*);
 
     bool isURLAllowed(const AtomicString&) const;
     void setNameAndOpenURL();
diff --git a/WebCore/html/HTMLFrameOwnerElement.cpp b/WebCore/html/HTMLFrameOwnerElement.cpp
index 2e16e33..a98a3df 100644
--- a/WebCore/html/HTMLFrameOwnerElement.cpp
+++ b/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -32,10 +32,9 @@
 
 namespace WebCore {
 
-HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document, bool createdByParser)
+HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
     , m_contentFrame(0)
-    , m_createdByParser(createdByParser)
 {
 }
 
diff --git a/WebCore/html/HTMLFrameOwnerElement.h b/WebCore/html/HTMLFrameOwnerElement.h
index e887be0..3f50a02 100644
--- a/WebCore/html/HTMLFrameOwnerElement.h
+++ b/WebCore/html/HTMLFrameOwnerElement.h
@@ -35,7 +35,7 @@
 
 class HTMLFrameOwnerElement : public HTMLElement {
 protected:
-    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*, bool createdByParser);
+    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
 
 public:
     virtual ~HTMLFrameOwnerElement();
@@ -49,8 +49,6 @@
     virtual bool isFrameOwnerElement() const { return true; }
     virtual bool isKeyboardFocusable(KeyboardEvent*) const { return m_contentFrame; }
     
-    bool createdByParser() const { return m_createdByParser; }
-
     virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
 
 #if ENABLE(SVG)
@@ -60,7 +58,6 @@
 private:
     friend class Frame;
     Frame* m_contentFrame;
-    bool m_createdByParser;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameSetElement.cpp b/WebCore/html/HTMLFrameSetElement.cpp
index 3994de4..f8e244c 100644
--- a/WebCore/html/HTMLFrameSetElement.cpp
+++ b/WebCore/html/HTMLFrameSetElement.cpp
@@ -29,8 +29,9 @@
 #include "Event.h"
 #include "EventNames.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "Length.h"
-#include "Length.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "RenderFrameSet.h"
 #include "Text.h"
@@ -88,13 +89,13 @@
         if (!attr->isNull()) {
             if (m_rows) delete [] m_rows;
             m_rows = newLengthArray(attr->value().string(), m_totalRows);
-            setChanged();
+            setNeedsStyleRecalc();
         }
     } else if (attr->name() == colsAttr) {
         if (!attr->isNull()) {
             delete [] m_cols;
             m_cols = newLengthArray(attr->value().string(), m_totalCols);
-            setChanged();
+            setNeedsStyleRecalc();
         }
     } else if (attr->name() == frameborderAttr) {
         if (!attr->isNull()) {
@@ -125,11 +126,11 @@
             m_borderColorSet = true;
         }
     } else if (attr->name() == onloadAttr) {
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
     } else if (attr->name() == onbeforeunloadAttr) {
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().beforeunloadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
     } else if (attr->name() == onunloadAttr) {
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().unloadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
     } else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -186,12 +187,12 @@
 
 void HTMLFrameSetElement::recalcStyle(StyleChange ch)
 {
-    if (changed() && renderer()) {
+    if (needsStyleRecalc() && renderer()) {
         renderer()->setNeedsLayout(true);
 #ifdef FLATTEN_FRAMESET
         static_cast<RenderFrameSet*>(renderer())->setGridNeedsLayout();
 #endif
-        setChanged(NoStyleChange);
+        setNeedsStyleRecalc(NoStyleChange);
     }
     HTMLElement::recalcStyle(ch);
 }
diff --git a/WebCore/html/HTMLHRElement.cpp b/WebCore/html/HTMLHRElement.cpp
index 8be23fd..d6cc58e 100644
--- a/WebCore/html/HTMLHRElement.cpp
+++ b/WebCore/html/HTMLHRElement.cpp
@@ -19,12 +19,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLHRElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/html/HTMLHtmlElement.cpp b/WebCore/html/HTMLHtmlElement.cpp
index 4ed2400..d4867a4 100644
--- a/WebCore/html/HTMLHtmlElement.cpp
+++ b/WebCore/html/HTMLHtmlElement.cpp
@@ -53,10 +53,8 @@
 
 bool HTMLHtmlElement::checkDTD(const Node* newChild)
 {
-    // FIXME: Why is <script> allowed here?
     return newChild->hasTagName(headTag) || newChild->hasTagName(bodyTag) ||
-           newChild->hasTagName(framesetTag) || newChild->hasTagName(noframesTag) ||
-           newChild->hasTagName(scriptTag);
+           newChild->hasTagName(framesetTag) || newChild->hasTagName(noframesTag);
 }
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/WebCore/html/HTMLIFrameElement.cpp b/WebCore/html/HTMLIFrameElement.cpp
index 9ba3b13..a190bca 100644
--- a/WebCore/html/HTMLIFrameElement.cpp
+++ b/WebCore/html/HTMLIFrameElement.cpp
@@ -28,14 +28,15 @@
 #include "Frame.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderPartObject.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* doc, bool createdByParser)
-    : HTMLFrameElementBase(tagName, doc, createdByParser)
+HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* document)
+    : HTMLFrameElementBase(tagName, document)
 {
     ASSERT(hasTagName(iframeTag));
 }
diff --git a/WebCore/html/HTMLIFrameElement.h b/WebCore/html/HTMLIFrameElement.h
index 3407a6d..362b991 100644
--- a/WebCore/html/HTMLIFrameElement.h
+++ b/WebCore/html/HTMLIFrameElement.h
@@ -30,7 +30,7 @@
 
 class HTMLIFrameElement : public HTMLFrameElementBase {
 public:
-    HTMLIFrameElement(const QualifiedName&, Document*, bool createdByParser);
+    HTMLIFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
     virtual int tagPriority() const { return 1; }
diff --git a/WebCore/html/HTMLIFrameElement.idl b/WebCore/html/HTMLIFrameElement.idl
index c6a8599..b5684ca 100644
--- a/WebCore/html/HTMLIFrameElement.idl
+++ b/WebCore/html/HTMLIFrameElement.idl
@@ -40,15 +40,17 @@
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
-#if ENABLE_SVG
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
 
     };
 
diff --git a/WebCore/html/HTMLImageElement.cpp b/WebCore/html/HTMLImageElement.cpp
index c4e7608..c4bf5dc 100644
--- a/WebCore/html/HTMLImageElement.cpp
+++ b/WebCore/html/HTMLImageElement.cpp
@@ -30,7 +30,9 @@
 #include "HTMLDocument.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
+#include "ScriptEventListener.h"
 
 using namespace std;
 
@@ -113,9 +115,9 @@
     } else if (attrName == ismapAttr)
         ismap = true;
     else if (attrName == onabortAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().abortEvent, attr);
+        setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attrName == compositeAttr) {
         if (!parseCompositeOperator(attr->value(), m_compositeOperator))
             m_compositeOperator = CompositeSourceOver;
diff --git a/WebCore/html/HTMLImageElement.idl b/WebCore/html/HTMLImageElement.idl
index fe64e6f..d7da088 100644
--- a/WebCore/html/HTMLImageElement.idl
+++ b/WebCore/html/HTMLImageElement.idl
@@ -46,7 +46,7 @@
         readonly attribute long x;
         readonly attribute long y;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute DOMString altDisplayString;
         readonly attribute URL absoluteImageURL;
diff --git a/WebCore/html/HTMLImageLoader.cpp b/WebCore/html/HTMLImageLoader.cpp
index 5dac8bf..ea53d7e 100644
--- a/WebCore/html/HTMLImageLoader.cpp
+++ b/WebCore/html/HTMLImageLoader.cpp
@@ -42,7 +42,10 @@
 
 void HTMLImageLoader::dispatchLoadEvent()
 {
-    element()->dispatchEventForType(image()->errorOccurred() ? eventNames().errorEvent : eventNames().loadEvent, false, false);
+    bool errorOccurred = image()->errorOccurred();
+    if (!errorOccurred && image()->httpStatusCodeErrorOccurred())
+        errorOccurred = element()->hasTagName(HTMLNames::objectTag); // An <object> considers a 404 to be an error and should fire onerror.
+    element()->dispatchEvent(errorOccurred ? eventNames().errorEvent : eventNames().loadEvent, false, false);
 }
 
 String HTMLImageLoader::sourceURI(const AtomicString& attr) const
@@ -50,12 +53,14 @@
     return parseURL(attr);
 }
 
-void HTMLImageLoader::notifyFinished(CachedResource* image)
-{
-    Element* elem = element();
-    ImageLoader::notifyFinished(image);
+void HTMLImageLoader::notifyFinished(CachedResource*)
+{    
+    CachedImage* cachedImage = image();
 
-    if (image->errorOccurred() && elem->hasTagName(HTMLNames::objectTag))
+    Element* elem = element();
+    ImageLoader::notifyFinished(cachedImage);
+
+    if ((cachedImage->errorOccurred() || cachedImage->httpStatusCodeErrorOccurred()) && elem->hasTagName(HTMLNames::objectTag))
         static_cast<HTMLObjectElement*>(elem)->renderFallbackContent();
 }
 
diff --git a/WebCore/html/HTMLInputElement.cpp b/WebCore/html/HTMLInputElement.cpp
index 103b740..2d1b3d0 100644
--- a/WebCore/html/HTMLInputElement.cpp
+++ b/WebCore/html/HTMLInputElement.cpp
@@ -26,8 +26,8 @@
 #include "config.h"
 #include "HTMLInputElement.h"
 
-#include "ChromeClient.h"
 #include "CSSPropertyNames.h"
+#include "ChromeClient.h"
 #include "Document.h"
 #include "Editor.h"
 #include "Event.h"
@@ -41,8 +41,10 @@
 #include "HTMLFormElement.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
 #include "LocalizedStrings.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "Page.h"
 #include "RenderButton.h"
@@ -68,7 +70,6 @@
 
 HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLFormControlElementWithState(tagName, doc, f)
-    , m_data(this, this)
     , m_xPos(0)
     , m_yPos(0)
     , m_maxResults(-1)
@@ -98,7 +99,7 @@
     removeFromForm();
 }
 
-const AtomicString& HTMLInputElement::name() const
+const AtomicString& HTMLInputElement::formControlName() const
 {
     return m_data.name();
 }
@@ -116,8 +117,7 @@
     return true;
 }
 
-
-static inline HTMLFormElement::CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
+static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
 {
     if (HTMLFormElement* form = element->form())
         return form->checkedRadioButtons();
@@ -164,14 +164,14 @@
 void HTMLInputElement::updateFocusAppearance(bool restorePreviousSelection)
 {        
     if (isTextField())
-        InputElement::updateFocusAppearance(m_data, document(), restorePreviousSelection);
+        InputElement::updateFocusAppearance(m_data, this, this, restorePreviousSelection);
     else
         HTMLFormControlElementWithState::updateFocusAppearance(restorePreviousSelection);
 }
 
 void HTMLInputElement::aboutToUnload()
 {
-    InputElement::aboutToUnload(m_data, document());
+    InputElement::aboutToUnload(this, this);
 }
 
 bool HTMLInputElement::shouldUseInputMethod() const
@@ -181,7 +181,7 @@
 
 void HTMLInputElement::dispatchFocusEvent()
 {
-    InputElement::dispatchFocusEvent(m_data, document());
+    InputElement::dispatchFocusEvent(m_data, this, this);
 
     if (isTextField())
         m_autofilled = false;
@@ -191,7 +191,7 @@
 
 void HTMLInputElement::dispatchBlurEvent()
 {
-    InputElement::dispatchBlurEvent(m_data, document());
+    InputElement::dispatchBlurEvent(m_data, this, this);
     HTMLFormControlElementWithState::dispatchBlurEvent();
 }
 
@@ -242,6 +242,14 @@
         newType = SEARCH;
     else if (equalIgnoringCase(t, "range"))
         newType = RANGE;
+    else if (equalIgnoringCase(t, "email"))
+        newType = EMAIL;
+    else if (equalIgnoringCase(t, "number"))
+        newType = NUMBER;
+    else if (equalIgnoringCase(t, "tel"))
+        newType = TELEPHONE;
+    else if (equalIgnoringCase(t, "url"))
+        newType = URL;
     else
         newType = TEXT;
 
@@ -278,7 +286,7 @@
             if (!didStoreValue && willStoreValue)
                 m_data.setValue(constrainValue(getAttribute(valueAttr)));
             else
-                InputElement::updateValueIfNeeded(m_data);
+                InputElement::updateValueIfNeeded(m_data, this);
 
             if (wasPasswordField && !isPasswordField)
                 unregisterForActivationCallbackIfNeeded();
@@ -287,6 +295,7 @@
 
             if (didRespectHeightAndWidth != willRespectHeightAndWidth) {
                 NamedMappedAttrMap* map = mappedAttributes();
+                ASSERT(map);
                 if (Attribute* height = map->getAttributeItem(heightAttr))
                     attributeChanged(height, false);
                 if (Attribute* width = map->getAttributeItem(widthAttr))
@@ -304,7 +313,7 @@
             checkedRadioButtons(this).addButton(this);
         }
 
-        InputElement::notifyFormStateChanged(m_data, document());
+        InputElement::notifyFormStateChanged(this);
     }
     m_haveType = true;
 
@@ -312,7 +321,7 @@
         m_imageLoader.clear();
 }
 
-const AtomicString& HTMLInputElement::type() const
+const AtomicString& HTMLInputElement::formControlType() const
 {
     // needs to be lowercase according to DOM spec
     switch (inputType()) {
@@ -324,6 +333,10 @@
             DEFINE_STATIC_LOCAL(const AtomicString, checkbox, ("checkbox"));
             return checkbox;
         }
+        case EMAIL: {
+            DEFINE_STATIC_LOCAL(const AtomicString, email, ("email"));
+            return email;
+        }
         case FILE: {
             DEFINE_STATIC_LOCAL(const AtomicString, file, ("file"));
             return file;
@@ -338,6 +351,10 @@
         }
         case ISINDEX:
             return emptyAtom;
+        case NUMBER: {
+            DEFINE_STATIC_LOCAL(const AtomicString, number, ("number"));
+            return number;
+        }
         case PASSWORD: {
             DEFINE_STATIC_LOCAL(const AtomicString, password, ("password"));
             return password;
@@ -362,30 +379,42 @@
             DEFINE_STATIC_LOCAL(const AtomicString, submit, ("submit"));
             return submit;
         }
+        case TELEPHONE: {
+            DEFINE_STATIC_LOCAL(const AtomicString, telephone, ("tel"));
+            return telephone;
+        }
         case TEXT: {
             DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
             return text;
         }
+        case URL: {
+            DEFINE_STATIC_LOCAL(const AtomicString, url, ("url"));
+            return url;
+        }
     }
     return emptyAtom;
 }
 
-bool HTMLInputElement::saveState(String& result) const
+bool HTMLInputElement::saveFormControlState(String& result) const
 {
     if (!autoComplete())
         return false;
 
     switch (inputType()) {
         case BUTTON:
+        case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case NUMBER:
         case RANGE:
         case RESET:
         case SEARCH:
         case SUBMIT:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             result = value();
             return true;
         case CHECKBOX:
@@ -399,20 +428,24 @@
     return false;
 }
 
-void HTMLInputElement::restoreState(const String& state)
+void HTMLInputElement::restoreFormControlState(const String& state)
 {
     ASSERT(inputType() != PASSWORD); // should never save/restore password fields
     switch (inputType()) {
         case BUTTON:
+        case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case NUMBER:
         case RANGE:
         case RESET:
         case SEARCH:
         case SUBMIT:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             setValue(state);
             break;
         case CHECKBOX:
@@ -487,7 +520,7 @@
 
 void HTMLInputElement::setSelectionRange(int start, int end)
 {
-    InputElement::updateSelectionRange(m_data, start, end);
+    InputElement::updateSelectionRange(this, this, start, end);
 }
 
 void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
@@ -508,10 +541,14 @@
         case HIDDEN:
             // a no-op for this type
             break;
+        case EMAIL:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             // should never restore previous selection here
             focus(false);
             break;
@@ -561,8 +598,8 @@
     } else if (attr->name() == valueAttr) {
         // We only need to setChanged if the form is looking at the default value right now.
         if (m_data.value().isNull())
-            setChanged();
-        setValueMatchesRenderer(false);
+            setNeedsStyleRecalc();
+        setFormControlValueMatchesRenderer(false);
     } else if (attr->name() == checkedAttr) {
         m_defaultChecked = !attr->isNull();
         if (m_useDefaultChecked) {
@@ -570,9 +607,9 @@
             m_useDefaultChecked = true;
         }
     } else if (attr->name() == maxlengthAttr)
-        InputElement::parseMaxLengthAttribute(m_data, attr);
+        InputElement::parseMaxLengthAttribute(m_data, this, this, attr);
     else if (attr->name() == sizeAttr)
-        InputElement::parseSizeAttribute(m_data, attr);
+        InputElement::parseSizeAttribute(m_data, this, attr);
     else if (attr->name() == altAttr) {
         if (renderer() && inputType() == IMAGE)
             toRenderImage(renderer())->updateAltText();
@@ -601,20 +638,20 @@
         if (respectHeightAndWidthAttrs())
             addCSSLength(attr, CSSPropertyHeight, attr->value());
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onselectAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().selectEvent, attr);
+        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onchangeAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().changeEvent, attr);
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oninputAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().inputEvent, attr);
+        setAttributeEventListener(eventNames().inputEvent, createAttributeEventListener(this, attr));
     }
     // Search field and slider attributes all just cause updateFromElement to be called through style
     // recalcing.
     else if (attr->name() == onsearchAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().searchEvent, attr);
+        setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == resultsAttr) {
         int oldResults = m_maxResults;
         m_maxResults = !attr->isNull() ? min(attr->value().toInt(), maxSavedResults) : -1;
@@ -624,17 +661,17 @@
             detach();
             attach();
         }
-        setChanged();
+        setNeedsStyleRecalc();
     } else if (attr->name() == placeholderAttr) {
         if (isTextField())
-            InputElement::updatePlaceholderVisibility(m_data, document(), true);
+            updatePlaceholderVisibility();
     } else if (attr->name() == autosaveAttr ||
              attr->name() == incrementalAttr ||
              attr->name() == minAttr ||
              attr->name() == maxAttr ||
              attr->name() == multipleAttr ||
              attr->name() == precisionAttr)
-        setChanged();
+        setNeedsStyleRecalc();
     else
         HTMLFormControlElementWithState::parseMappedAttribute(attr);
 }
@@ -644,16 +681,20 @@
     switch (inputType()) {
         case BUTTON:
         case CHECKBOX:
+        case EMAIL:
         case FILE:
         case IMAGE:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case RADIO:
         case RANGE:
         case RESET:
         case SEARCH:
         case SUBMIT:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             return HTMLFormControlElementWithState::rendererIsNeeded(style);
         case HIDDEN:
             return false;
@@ -680,10 +721,14 @@
             return new (arena) RenderImage(this);
         case RANGE:
             return new (arena) RenderSlider(this);
+        case EMAIL:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             return new (arena) RenderTextControlSingleLine(this);
     }
     ASSERT(false);
@@ -719,7 +764,7 @@
 void HTMLInputElement::detach()
 {
     HTMLFormControlElementWithState::detach();
-    setValueMatchesRenderer(false);
+    setFormControlValueMatchesRenderer(false);
 }
 
 String HTMLInputElement::altText() const
@@ -762,12 +807,16 @@
         return false;
 
     switch (inputType()) {
+        case EMAIL:
         case HIDDEN:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             // always successful
             encoding.appendData(name(), value());
             return true;
@@ -842,7 +891,7 @@
 
     m_useDefaultChecked = false;
     m_checked = nowChecked;
-    setChanged();
+    setNeedsStyleRecalc();
 
     checkedRadioButtons(this).addButton(this);
     
@@ -855,7 +904,7 @@
     // because it says only to fire change events at "lose focus" time, which is
     // definitely wrong in practice for these types of elements.
     if (sendChangeEvent && inDocument() && (inputType() != RADIO || nowChecked))
-        onChange();
+        dispatchFormControlChangeEvent();
 }
 
 void HTMLInputElement::setIndeterminate(bool _indeterminate)
@@ -866,7 +915,7 @@
 
     m_indeterminate = _indeterminate;
 
-    setChanged();
+    setNeedsStyleRecalc();
 
     if (renderer() && renderer()->style()->hasAppearance())
         theme()->stateChanged(renderer(), CheckedState);
@@ -917,15 +966,19 @@
         switch (inputType()) {
             case BUTTON:
             case CHECKBOX:
+            case EMAIL:
             case FILE:
             case HIDDEN:
             case IMAGE:
             case ISINDEX:
+            case NUMBER:
             case PASSWORD:
             case RADIO:
             case RANGE:
             case SEARCH:
+            case TELEPHONE:
             case TEXT:
+            case URL:
                 break;
             case RESET:
                 v = resetButtonDefaultLabel();
@@ -946,21 +999,21 @@
     if (inputType() == FILE && !value.isEmpty())
         return;
 
-    setValueMatchesRenderer(false);
+    setFormControlValueMatchesRenderer(false);
     if (storesValueSeparateFromAttribute()) {
         if (inputType() == FILE)
             m_fileList->clear();
         else {
             m_data.setValue(constrainValue(value));
             if (isTextField()) {
-                InputElement::updatePlaceholderVisibility(m_data, document());
+                InputElement::updatePlaceholderVisibility(m_data, this, this);
                 if (inDocument())
-                    document()->updateRendering();
+                    document()->updateStyleIfNeeded();
             }
         }
         if (renderer())
             renderer()->updateFromElement();
-        setChanged();
+        setNeedsStyleRecalc();
     } else
         setAttribute(valueAttr, constrainValue(value));
     
@@ -972,21 +1025,26 @@
             // Make sure our UI side textfield changes to match the RenderTextControl
             android::WebViewCore::getWebViewCore(document()->view())->updateTextfield(this, false, value);
 #endif
-            InputElement::updateSelectionRange(m_data, max, max);
+            InputElement::updateSelectionRange(this, this, max, max);
 #ifdef ANDROID_ACCEPT_CHANGES_TO_FOCUSED_TEXTFIELDS
         }
 #endif
         else
             cacheSelection(max, max);
     }
-    InputElement::notifyFormStateChanged(m_data, document());
+    InputElement::notifyFormStateChanged(this);
 }
 
-String HTMLInputElement::placeholderValue() const
+String HTMLInputElement::placeholder() const
 {
     return getAttribute(placeholderAttr).string();
 }
 
+void HTMLInputElement::setPlaceholder(const String& value)
+{
+    setAttribute(placeholderAttr, value);
+}
+
 bool HTMLInputElement::searchEventsShouldBeDispatched() const
 {
     return hasAttribute(incrementalAttr);
@@ -996,7 +1054,7 @@
 {
     // File upload controls will always use setFileListFromRenderer.
     ASSERT(inputType() != FILE);
-    InputElement::setValueFromRenderer(m_data, document(), value);
+    InputElement::setValueFromRenderer(m_data, this, this, value);
 }
 
 void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
@@ -1006,8 +1064,8 @@
     for (int i = 0; i < size; i++)
         m_fileList->append(File::create(paths[i]));
 
-    setValueMatchesRenderer();
-    InputElement::notifyFormStateChanged(m_data, document());
+    setFormControlValueMatchesRenderer(true);
+    InputElement::notifyFormStateChanged(this);
 }
 
 bool HTMLInputElement::storesValueSeparateFromAttribute() const
@@ -1021,12 +1079,16 @@
         case RESET:
         case SUBMIT:
             return false;
+        case EMAIL:
         case FILE:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             return true;
     }
     return false;
@@ -1192,12 +1254,16 @@
         if (charCode == '\r') {
             switch (inputType()) {
                 case CHECKBOX:
+                case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
+                case TELEPHONE:
                 case TEXT:
+                case URL:
                     // Simulate mouse click on the default form button for enter for these types of elements.
                     clickDefaultFormButton = true;
                     break;
@@ -1316,12 +1382,16 @@
                     if (!checked())
                         clickElement = true;
                     break;
+                case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
+                case TELEPHONE:
                 case TEXT:
+                case URL:
                     break;
             }
         }
@@ -1342,7 +1412,7 @@
         // Fire onChange for text fields.
         RenderObject* r = renderer();
         if (r && r->isTextField() && toRenderTextControl(r)->isEdited()) {
-            onChange();
+            dispatchFormControlChangeEvent();
             // Refetch the renderer since arbitrary JS code run during onchange can do anything, including destroying it.
             r = renderer();
             if (r && r->isTextField())
@@ -1356,7 +1426,7 @@
     }
 
     if (evt->isBeforeTextInsertedEvent())
-        InputElement::handleBeforeTextInsertedEvent(m_data, document(), evt);
+        InputElement::handleBeforeTextInsertedEvent(m_data, this, document(), evt);
 
     if (isTextField() && renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent() || evt->type() == eventNames().blurEvent || evt->type() == eventNames().focusEvent))
         static_cast<RenderTextControlSingleLine*>(renderer())->forwardEvent(evt);
@@ -1489,7 +1559,7 @@
         return;
         
     m_autofilled = b;
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 FileList* HTMLInputElement::files()
@@ -1501,7 +1571,7 @@
 
 String HTMLInputElement::constrainValue(const String& proposedValue) const
 {
-    return InputElement::constrainValue(m_data, proposedValue, m_data.maxLength());
+    return InputElement::constrainValue(this, proposedValue, m_data.maxLength());
 }
 
 bool HTMLInputElement::needsActivationCallback()
@@ -1539,7 +1609,7 @@
     ASSERT(isSearchField());
     if (renderer())
         static_cast<RenderTextControlSingleLine*>(renderer())->stopSearchEventTimer();
-    dispatchEventForType(eventNames().searchEvent, true, false);
+    dispatchEvent(eventNames().searchEvent, true, false);
 }
 
 VisibleSelection HTMLInputElement::selection() const
diff --git a/WebCore/html/HTMLInputElement.h b/WebCore/html/HTMLInputElement.h
index 5b6a5d6..be2b4f4 100644
--- a/WebCore/html/HTMLInputElement.h
+++ b/WebCore/html/HTMLInputElement.h
@@ -50,7 +50,11 @@
         IMAGE,
         BUTTON,
         SEARCH,
-        RANGE
+        RANGE,
+        EMAIL,
+        NUMBER,
+        TELEPHONE,
+        URL
     };
     
     enum AutoCompleteSetting {
@@ -74,7 +78,7 @@
     virtual void aboutToUnload();
     virtual bool shouldUseInputMethod() const;
 
-    virtual const AtomicString& name() const;
+    virtual const AtomicString& formControlName() const;
  
     bool autoComplete() const;
 
@@ -82,13 +86,13 @@
     virtual bool isChecked() const { return checked() && (inputType() == CHECKBOX || inputType() == RADIO); }
     virtual bool isIndeterminate() const { return indeterminate(); }
     
-    bool readOnly() const { return isReadOnlyControl(); }
+    bool readOnly() const { return isReadOnlyFormControl(); }
 
-    virtual bool isTextControl() const { return isTextField(); }
+    virtual bool isTextFormControl() const { return isTextField(); }
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }
-    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX; }
+    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL; }
     virtual bool isSearchField() const { return m_type == SEARCH; }
     virtual bool isInputTypeHidden() const { return m_type == HIDDEN; }
     virtual bool isPasswordField() const { return m_type == PASSWORD; }
@@ -98,13 +102,15 @@
     bool indeterminate() const { return m_indeterminate; }
     void setIndeterminate(bool);
     virtual int size() const;
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
     void setType(const String&);
 
     virtual String value() const;
     virtual void setValue(const String&);
 
-    virtual String placeholderValue() const;
+    virtual String placeholder() const;
+    virtual void setPlaceholder(const String&);
+
     virtual bool searchEventsShouldBeDispatched() const;
 
     String valueWithDefault() const;
@@ -112,8 +118,8 @@
     virtual void setValueFromRenderer(const String&);
     void setFileListFromRenderer(const Vector<String>&);
 
-    virtual bool saveState(String& value) const;
-    virtual void restoreState(const String&);
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
 
     virtual bool canStartSelection() const;
     
@@ -219,6 +225,11 @@
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
 
+    void updatePlaceholderVisibility()
+    {
+        InputElement::updatePlaceholderVisibility(m_data, this, this, true);
+    }
+
 private:
     bool storesValueSeparateFromAttribute() const;
 
@@ -232,7 +243,7 @@
     short m_maxResults;
     OwnPtr<HTMLImageLoader> m_imageLoader;
     RefPtr<FileList> m_fileList;
-    unsigned m_type : 4; // InputType 
+    unsigned m_type : 5; // InputType 
     bool m_checked : 1;
     bool m_defaultChecked : 1;
     bool m_useDefaultChecked : 1;
diff --git a/WebCore/html/HTMLInputElement.idl b/WebCore/html/HTMLInputElement.idl
index 0734e6a..5536733 100644
--- a/WebCore/html/HTMLInputElement.idl
+++ b/WebCore/html/HTMLInputElement.idl
@@ -38,15 +38,16 @@
                  attribute long            maxLength;
                  attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
+                 attribute DOMString       placeholder;
                  attribute boolean         readOnly;
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
                  attribute [ConvertToString] DOMString size; // DOM level 2 changed this to a long, but our existing API is a string
 #else
                  // FIXME: the spec says this should be a long, not an unsigned long
                  attribute unsigned long   size; // Changed string -> long as part of DOM level 2
 #endif
                  attribute [ConvertNullToNullString] DOMString src;
-                 attribute [ConvertNullToNullString] DOMString type; // readonly dropped as part of DOM level 2
+                 attribute [ConvertNullToNullString, JSCCustomGetter] DOMString type; // readonly dropped as part of DOM level 2
                  attribute [ConvertNullToNullString] DOMString useMap;
                  attribute [ConvertNullToNullString] DOMString value;
         readonly attribute boolean         willValidate;
diff --git a/WebCore/html/HTMLIsIndexElement.cpp b/WebCore/html/HTMLIsIndexElement.cpp
index 7bc98b6..bcfa623 100644
--- a/WebCore/html/HTMLIsIndexElement.cpp
+++ b/WebCore/html/HTMLIsIndexElement.cpp
@@ -24,7 +24,9 @@
 
 #include "config.h"
 #include "HTMLIsIndexElement.h"
+
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
@@ -41,6 +43,8 @@
 {
     if (attr->name() == promptAttr)
         setValue(attr->value());
+    else if (attr->name() == placeholderAttr)
+        updatePlaceholderVisibility();
     else
         // don't call HTMLInputElement::parseMappedAttribute here, as it would
         // accept attributes this element does not support
diff --git a/WebCore/html/HTMLKeygenElement.cpp b/WebCore/html/HTMLKeygenElement.cpp
index 563ad3c..b1b6238 100644
--- a/WebCore/html/HTMLKeygenElement.cpp
+++ b/WebCore/html/HTMLKeygenElement.cpp
@@ -29,6 +29,7 @@
 #include "FormDataList.h"
 #include "HTMLNames.h"
 #include "HTMLOptionElement.h"
+#include "MappedAttribute.h"
 #include "SSLKeyGenerator.h"
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
@@ -54,7 +55,7 @@
     }
 }
 
-const AtomicString& HTMLKeygenElement::type() const
+const AtomicString& HTMLKeygenElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, keygen, ("keygen"));
     return keygen;
diff --git a/WebCore/html/HTMLKeygenElement.h b/WebCore/html/HTMLKeygenElement.h
index 7997635..b2a0c26 100644
--- a/WebCore/html/HTMLKeygenElement.h
+++ b/WebCore/html/HTMLKeygenElement.h
@@ -33,7 +33,7 @@
     HTMLKeygenElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
     virtual int tagPriority() const { return 0; }
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
     virtual bool isEnumeratable() const { return false; }
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool appendFormData(FormDataList&, bool);
diff --git a/WebCore/html/HTMLLIElement.cpp b/WebCore/html/HTMLLIElement.cpp
index 2d5518e..044b93c 100644
--- a/WebCore/html/HTMLLIElement.cpp
+++ b/WebCore/html/HTMLLIElement.cpp
@@ -26,6 +26,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderListItem.h"
 
 namespace WebCore {
diff --git a/WebCore/html/HTMLLegendElement.cpp b/WebCore/html/HTMLLegendElement.cpp
index 4092643..d6e08c7 100644
--- a/WebCore/html/HTMLLegendElement.cpp
+++ b/WebCore/html/HTMLLegendElement.cpp
@@ -47,7 +47,7 @@
     return HTMLElement::isFocusable();
 }
 
-const AtomicString& HTMLLegendElement::type() const
+const AtomicString& HTMLLegendElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, legend, ("legend"));
     return legend;
diff --git a/WebCore/html/HTMLLegendElement.h b/WebCore/html/HTMLLegendElement.h
index 6d01dce..713d73c 100644
--- a/WebCore/html/HTMLLegendElement.h
+++ b/WebCore/html/HTMLLegendElement.h
@@ -34,7 +34,7 @@
     virtual ~HTMLLegendElement();
 
     virtual bool isFocusable() const;
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
     virtual void accessKeyAction(bool sendToAnyElement);
 
     /**
diff --git a/WebCore/html/HTMLLinkElement.cpp b/WebCore/html/HTMLLinkElement.cpp
index 28bf2fa..76a9703 100644
--- a/WebCore/html/HTMLLinkElement.cpp
+++ b/WebCore/html/HTMLLinkElement.cpp
@@ -3,6 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Rob Buis (rwlbuis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,6 +34,7 @@
 #include "FrameLoaderClient.h"
 #include "FrameTree.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
 #include "Page.h"
@@ -182,37 +184,28 @@
     // Stylesheet
     // This was buggy and would incorrectly match <link rel="alternate">, which has a different specified meaning. -dwh
     if (m_disabledState != 2 && m_isStyleSheet && document()->frame() && m_url.isValid()) {
-        // no need to load style sheets which aren't for the screen output
-        // ### there may be in some situations e.g. for an editor or script to manipulate
         // also, don't load style sheets for standalone documents
-        MediaQueryEvaluator allEval(true);
-        MediaQueryEvaluator screenEval("screen", true);
-        MediaQueryEvaluator printEval("print", true);
-        RefPtr<MediaList> media = MediaList::createAllowingDescriptionSyntax(m_media);
-        if (allEval.eval(media.get()) || screenEval.eval(media.get()) || printEval.eval(media.get())) {
+        // Add ourselves as a pending sheet, but only if we aren't an alternate 
+        // stylesheet.  Alternate stylesheets don't hold up render tree construction.
+        if (!isAlternate())
+            document()->addPendingSheet();
 
-            // Add ourselves as a pending sheet, but only if we aren't an alternate 
-            // stylesheet.  Alternate stylesheets don't hold up render tree construction.
-            if (!isAlternate())
-                document()->addPendingSheet();
+        String charset = getAttribute(charsetAttr);
+        if (charset.isEmpty() && document()->frame())
+            charset = document()->frame()->loader()->encoding();
 
-            String chset = getAttribute(charsetAttr);
-            if (chset.isEmpty() && document()->frame())
-                chset = document()->frame()->loader()->encoding();
-            
-            if (m_cachedSheet) {
-                if (m_loading)
-                    document()->removePendingSheet();
-                m_cachedSheet->removeClient(this);
-            }
-            m_loading = true;
-            m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(m_url.string(), chset);
-            if (m_cachedSheet)
-                m_cachedSheet->addClient(this);
-            else if (!isAlternate()) { // request may have been denied if stylesheet is local and document is remote.
-                m_loading = false;
+        if (m_cachedSheet) {
+            if (m_loading)
                 document()->removePendingSheet();
-            }
+            m_cachedSheet->removeClient(this);
+        }
+        m_loading = true;
+        m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(m_url, charset);
+        if (m_cachedSheet)
+            m_cachedSheet->addClient(this);
+        else if (!isAlternate()) { // The request may have been denied if stylesheet is local and document is remote.
+            m_loading = false;
+            document()->removePendingSheet();
         }
     } else if (m_sheet) {
         // we no longer contain a stylesheet, e.g. perhaps rel or type was changed
diff --git a/WebCore/html/HTMLLinkElement.idl b/WebCore/html/HTMLLinkElement.idl
index 532ac31..98de809 100644
--- a/WebCore/html/HTMLLinkElement.idl
+++ b/WebCore/html/HTMLLinkElement.idl
@@ -35,12 +35,12 @@
         attribute  [ConvertNullToNullString] DOMString            target;
         attribute  [ConvertNullToNullString] DOMString            type;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Style
         readonly attribute StyleSheet   sheet;
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL absoluteLinkURL;
 #endif
diff --git a/WebCore/html/HTMLMapElement.cpp b/WebCore/html/HTMLMapElement.cpp
index d7109c9..90204e0 100644
--- a/WebCore/html/HTMLMapElement.cpp
+++ b/WebCore/html/HTMLMapElement.cpp
@@ -18,6 +18,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLMapElement.h"
 
@@ -25,8 +26,9 @@
 #include "HTMLAreaElement.h"
 #include "HTMLCollection.h"
 #include "HTMLNames.h"
-#include "IntSize.h"
 #include "HitTestResult.h"
+#include "IntSize.h"
+#include "MappedAttribute.h"
 
 using namespace std;
 
@@ -96,7 +98,7 @@
 
 PassRefPtr<HTMLCollection> HTMLMapElement::areas()
 {
-    return HTMLCollection::create(this, HTMLCollection::MapAreas);
+    return HTMLCollection::create(this, MapAreas);
 }
 
 String HTMLMapElement::name() const
diff --git a/WebCore/html/HTMLMarqueeElement.cpp b/WebCore/html/HTMLMarqueeElement.cpp
index 040b6fb..d62eaab 100644
--- a/WebCore/html/HTMLMarqueeElement.cpp
+++ b/WebCore/html/HTMLMarqueeElement.cpp
@@ -19,12 +19,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLMarqueeElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderLayer.h"
 #include "RenderMarquee.h"
 
@@ -37,6 +39,7 @@
 
 HTMLMarqueeElement::HTMLMarqueeElement(const QualifiedName& tagName, Document* doc)
     : HTMLElement(tagName, doc)
+    , ActiveDOMObject(doc, this)
     , m_minimumDelay(defaultMinimumDelay)
 {
     ASSERT(hasTagName(marqueeTag));
@@ -119,4 +122,21 @@
         renderBox()->layer()->marquee()->stop();
 }
 
+bool HTMLMarqueeElement::canSuspend() const
+{
+    return true;
+}
+
+void HTMLMarqueeElement::suspend()
+{
+    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
+        renderBox()->layer()->marquee()->suspend();
+}
+    
+void HTMLMarqueeElement::resume()
+{
+    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
+        renderBox()->layer()->marquee()->updateMarqueePosition();
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/HTMLMarqueeElement.h b/WebCore/html/HTMLMarqueeElement.h
index acd639b..2423fc6 100644
--- a/WebCore/html/HTMLMarqueeElement.h
+++ b/WebCore/html/HTMLMarqueeElement.h
@@ -23,11 +23,12 @@
 #ifndef HTMLMarqueeElement_h
 #define HTMLMarqueeElement_h
 
+#include "ActiveDOMObject.h"
 #include "HTMLElement.h"
 
 namespace WebCore {
 
-class HTMLMarqueeElement : public HTMLElement {
+class HTMLMarqueeElement : public HTMLElement, private ActiveDOMObject {
 public:
     HTMLMarqueeElement(const QualifiedName&, Document*);
     
@@ -45,6 +46,11 @@
     void stop();
     
 private:
+    // ActiveDOMObject
+    virtual bool canSuspend() const;
+    virtual void suspend();
+    virtual void resume();
+
     int m_minimumDelay;
 };
 
diff --git a/WebCore/html/HTMLMediaElement.cpp b/WebCore/html/HTMLMediaElement.cpp
index df0ed04..6ad0653 100644
--- a/WebCore/html/HTMLMediaElement.cpp
+++ b/WebCore/html/HTMLMediaElement.cpp
@@ -28,10 +28,11 @@
 #if ENABLE(VIDEO)
 #include "HTMLMediaElement.h"
 
-#include "ContentType.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "ContentType.h"
+#include "DocLoader.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
@@ -41,25 +42,25 @@
 #include "HTMLNames.h"
 #include "HTMLSourceElement.h"
 #include "HTMLVideoElement.h"
-#include <limits>
+#include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
+#include "MediaDocument.h"
 #include "MediaError.h"
 #include "MediaList.h"
-#include "MediaQueryEvaluator.h"
-#include "MIMETypeRegistry.h"
 #include "MediaPlayer.h"
+#include "MediaQueryEvaluator.h"
 #include "Page.h"
 #include "ProgressEvent.h"
 #include "RenderVideo.h"
-#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-#include "RenderPartObject.h"
-#endif
 #include "TimeRanges.h"
-#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-#include "Widget.h"
-#endif
+#include <limits>
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
-#include <limits>
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#include "RenderPartObject.h"
+#include "Widget.h"
+#endif
 
 using namespace std;
 
@@ -73,12 +74,13 @@
     , m_asyncEventTimer(this, &HTMLMediaElement::asyncEventTimerFired)
     , m_progressEventTimer(this, &HTMLMediaElement::progressEventTimerFired)
     , m_playbackProgressTimer(this, &HTMLMediaElement::playbackProgressTimerFired)
+    , m_playedTimeRanges()
     , m_playbackRate(1.0f)
     , m_defaultPlaybackRate(1.0f)
     , m_networkState(NETWORK_EMPTY)
     , m_readyState(HAVE_NOTHING)
     , m_volume(1.0f)
-    , m_currentTimeDuringSeek(0)
+    , m_lastSeekTime(0)
     , m_previousProgress(0)
     , m_previousProgressTime(numeric_limits<double>::max())
     , m_lastTimeUpdateEventWallTime(0)
@@ -87,6 +89,7 @@
     , m_currentSourceNode(0)
     , m_player(0)
     , m_restrictions(NoRestrictions)
+    , m_playing(false)
     , m_processingMediaPlayerCallback(0)
     , m_processingLoad(false)
     , m_delayingTheLoadEvent(false)
@@ -140,7 +143,16 @@
     }
 #endif
 }
-    
+
+void HTMLMediaElement::parseMappedAttribute(MappedAttribute *attr)
+{
+    if (attr->name() == autobufferAttr) {
+        if (m_player)
+            m_player->setAutobuffer(!attr->isNull());
+    } else
+        HTMLElement::parseMappedAttribute(attr);
+}
+
 bool HTMLMediaElement::rendererIsNeeded(RenderStyle* style)
 {
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
@@ -231,7 +243,7 @@
 void HTMLMediaElement::enqueueEvent(RefPtr<Event> event)
 {
     m_pendingEvents.append(event);
-    if (!m_asyncEventTimer.isActive())                            
+    if (!m_asyncEventTimer.isActive())
         m_asyncEventTimer.startOneShot(0);
 }
 
@@ -362,7 +374,7 @@
 
     // 3 - If there are any tasks from the media element's media element event task source in 
     // one of the task queues, then remove those tasks.
-    m_pendingEvents.clear();
+    cancelPendingEventsAndCallbacks();
     
     // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set the 
     // error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED, 
@@ -380,6 +392,8 @@
     // 5 
     m_error = 0;
     m_autoplaying = true;
+    m_playedTimeRanges = TimeRanges::create();
+    m_lastSeekTime = 0;
 
     // 6
     setPlaybackRate(defaultPlaybackRate());
@@ -392,9 +406,10 @@
         m_seeking = false;
         if (m_player) {
             m_player->pause();
+            m_playing = false;
             m_player->seek(0);
         }
-        dispatchEventForType(eventNames().emptiedEvent, false, true);
+        dispatchEvent(eventNames().emptiedEvent, false, true);
     }
     
     selectMediaResource();
@@ -430,9 +445,13 @@
     // 5 - If the media element has a src attribute, then run these substeps
     ContentType contentType("");
     if (!mediaSrc.isEmpty()) {
-        mediaSrc = document()->completeURL(mediaSrc).string();
-        m_loadState = LoadingFromSrcAttr;
-        loadResource(mediaSrc, contentType);
+        KURL mediaURL = document()->completeURL(mediaSrc);
+        if (isSafeToLoadURL(mediaURL, Complain)) {
+            m_loadState = LoadingFromSrcAttr;
+            loadResource(mediaURL, contentType);
+        } else 
+            noneSupported();
+
         return;
     }
 
@@ -444,22 +463,23 @@
 void HTMLMediaElement::loadNextSourceChild()
 {
     ContentType contentType("");
-    String mediaSrc;
-
-    mediaSrc = nextSourceChild(&contentType);
-    if (mediaSrc.isEmpty()) {
-        noneSupported();
+    KURL mediaURL = selectNextSourceChild(&contentType, Complain);
+    if (!mediaURL.isValid()) {
+        // It seems wrong to fail silently when we give up because no suitable <source>
+        // element can be found and set the error attribute if the element's 'src' attribute
+        // fails, but that is what the spec says.
         return;
     }
 
     m_loadState = LoadingFromSourceElement;
-    loadResource(mediaSrc, contentType);
+    loadResource(mediaURL, contentType);
 }
 
-void HTMLMediaElement::loadResource(String url, ContentType& contentType)
+void HTMLMediaElement::loadResource(const KURL& url, ContentType& contentType)
 {
-    // The resource fetch algorithm 
+    ASSERT(isSafeToLoadURL(url, Complain));
 
+    // The resource fetch algorithm 
     m_networkState = NETWORK_LOADING;
 
     m_currentSrc = url;
@@ -483,6 +503,21 @@
         renderer()->updateFromElement();
 }
 
+bool HTMLMediaElement::isSafeToLoadURL(const KURL& url, InvalidSourceAction actionIfInvalid)
+{
+    Frame* frame = document()->frame();
+    FrameLoader* loader = frame ? frame->loader() : 0;
+
+    // don't allow remote to local urls
+    if (!loader || !loader->canLoad(url, String(), document())) {
+        if (actionIfInvalid == Complain)
+            FrameLoader::reportLocalLoadFailed(frame, url.string());
+        return false;
+    }
+    
+    return true;
+}
+
 void HTMLMediaElement::startProgressEventTimer()
 {
     if (m_progressEventTimer.isActive())
@@ -502,8 +537,8 @@
 
     // 3 - Reaching this step indicates that either the URL failed to resolve, or the media 
     // resource failed to load. Set the error attribute to a new MediaError object whose 
-    // code attribute is set to MEDIA_ERR_NONE_SUPPORTED.
-    m_error = MediaError::create(MediaError::MEDIA_ERR_NONE_SUPPORTED);
+    // code attribute is set to MEDIA_ERR_SRC_NOT_SUPPORTED.
+    m_error = MediaError::create(MediaError::MEDIA_ERR_SRC_NOT_SUPPORTED);
 
     // 4- Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
     m_networkState = NETWORK_NO_SOURCE;
@@ -548,6 +583,16 @@
 
 }
 
+void HTMLMediaElement::cancelPendingEventsAndCallbacks()
+{
+    m_pendingEvents.clear();
+
+    for (Node* node = firstChild(); node; node = node->nextSibling()) {
+        if (node->hasTagName(sourceTag))
+            static_cast<HTMLSourceElement*>(node)->cancelPendingErrorEvent();
+    }
+}
+
 void HTMLMediaElement::mediaPlayerNetworkStateChanged(MediaPlayer*)
 {
     beginProcessingMediaPlayerCallback();
@@ -567,9 +612,11 @@
         stopPeriodicTimers();
 
         // If we failed while trying to load a <source> element, the movie was never parsed, and there are more
-        // <source> children, schedule the next one without reporting an error
-        if (m_readyState < HAVE_METADATA && m_loadState == LoadingFromSourceElement && havePotentialSourceChild()) {
-            scheduleLoad();
+        // <source> children, schedule the next one
+        if (m_readyState < HAVE_METADATA && m_loadState == LoadingFromSourceElement) {
+            m_currentSourceNode->scheduleErrorEvent();
+            if (havePotentialSourceChild())
+                scheduleLoad();
             return;
         }
 
@@ -577,7 +624,7 @@
             mediaEngineError(MediaError::create(MediaError::MEDIA_ERR_NETWORK));
         else if (state == MediaPlayer::DecodeError)
             mediaEngineError(MediaError::create(MediaError::MEDIA_ERR_DECODE));
-        else if (state == MediaPlayer::FormatError)
+        else if (state == MediaPlayer::FormatError && m_loadState == LoadingFromSrcAttr)
             noneSupported();
 
         if (isVideo())
@@ -586,31 +633,37 @@
         return;
     }
 
-    if (state == MediaPlayer::Idle && m_networkState > NETWORK_IDLE) {
+    if (state == MediaPlayer::Idle) {
         ASSERT(static_cast<ReadyState>(m_player->readyState()) < HAVE_ENOUGH_DATA);
+        if (m_networkState > NETWORK_IDLE) {
+            stopPeriodicTimers();
+            scheduleProgressEvent(eventNames().suspendEvent);
+        }
         m_networkState = NETWORK_IDLE;
-        stopPeriodicTimers();
-        scheduleProgressEvent(eventNames().suspendEvent);
     }
 
-    if (state == MediaPlayer::Loading && (m_networkState < NETWORK_LOADING || m_networkState == NETWORK_NO_SOURCE)) {
-        ASSERT(static_cast<ReadyState>(m_player->readyState()) < HAVE_ENOUGH_DATA);
+    if (state == MediaPlayer::Loading) {
+        if (m_networkState < NETWORK_LOADING || m_networkState == NETWORK_NO_SOURCE)
+            startProgressEventTimer();
         m_networkState = NETWORK_LOADING;
-        startProgressEventTimer();
     }
 
-    if (state == MediaPlayer::Loaded && (m_networkState < NETWORK_LOADED || m_networkState == NETWORK_NO_SOURCE)) {
+    if (state == MediaPlayer::Loaded) {
+        NetworkState oldState = m_networkState;
+
         m_networkState = NETWORK_LOADED;
-        m_progressEventTimer.stop();
+        if (oldState < NETWORK_LOADED || oldState == NETWORK_NO_SOURCE) {
+            m_progressEventTimer.stop();
 
-        // Check to see if readyState changes need to be dealt with before sending the 
-        // 'load' event so we report 'canplaythrough' first. This is necessary because a
-        //  media engine reports readyState and networkState changes separately
-        MediaPlayer::ReadyState currentState = m_player->readyState();
-        if (static_cast<ReadyState>(currentState) != m_readyState)
-            setReadyState(currentState);
+            // Check to see if readyState changes need to be dealt with before sending the 
+            // 'load' event so we report 'canplaythrough' first. This is necessary because a
+            //  media engine reports readyState and networkState changes separately
+            MediaPlayer::ReadyState currentState = m_player->readyState();
+            if (static_cast<ReadyState>(currentState) != m_readyState)
+                setReadyState(currentState);
 
-         scheduleProgressEvent(eventNames().loadEvent); 
+             scheduleProgressEvent(eventNames().loadEvent); 
+        }
     }
 }
 
@@ -676,11 +729,6 @@
     }
 
     bool isPotentiallyPlaying = potentiallyPlaying();
-    if (m_readyState <= HAVE_CURRENT_DATA && oldState >= HAVE_FUTURE_DATA) {
-        if (isPotentiallyPlaying)
-            scheduleEvent(eventNames().waitingEvent);
-    }
-
     if (m_readyState == HAVE_FUTURE_DATA && oldState <= HAVE_CURRENT_DATA) {
         scheduleEvent(eventNames().canplayEvent);
         if (isPotentiallyPlaying)
@@ -763,7 +811,11 @@
         return;
 
     // 5
-    m_currentTimeDuringSeek = time;
+    if (m_playing) {
+        if (m_lastSeekTime < now)
+            m_playedTimeRanges->add(m_lastSeekTime, now);
+    }
+    m_lastSeekTime = time;
 
     // 6 - set the seeking flag, it will be cleared when the engine tells is the time has actually changed
     m_seeking = true;
@@ -794,7 +846,7 @@
     if (!m_player)
         return 0;
     if (m_seeking)
-        return m_currentTimeDuringSeek;
+        return m_lastSeekTime;
     return m_player->currentTime();
 }
 
@@ -803,6 +855,13 @@
     seek(time, ec);
 }
 
+float HTMLMediaElement::startTime() const
+{
+    if (!m_player)
+        return 0;
+    return m_player->startTime();
+}
+
 float HTMLMediaElement::duration() const
 {
     if (m_readyState >= HAVE_METADATA)
@@ -859,6 +918,16 @@
     setBooleanAttribute(autoplayAttr, b);
 }
 
+bool HTMLMediaElement::autobuffer() const
+{
+    return hasAttribute(autobufferAttr);
+}
+
+void HTMLMediaElement::setAutobuffer(bool b)
+{
+    setBooleanAttribute(autobufferAttr, b);
+}
+
 void HTMLMediaElement::play()
 {
     if (m_restrictions & RequireUserGestureForRateChangeRestriction && !processingUserGesture())
@@ -1065,55 +1134,65 @@
 {
     // Stash the current <source> node so we can restore it after checking
     // to see there is another potential
-    Node* currentSourceNode = m_currentSourceNode;
-    String nextUrl = nextSourceChild();
+    HTMLSourceElement* currentSourceNode = m_currentSourceNode;
+    KURL nextURL = selectNextSourceChild(0, DoNothing);
     m_currentSourceNode = currentSourceNode;
 
-    return !nextUrl.isEmpty();
+    return nextURL.isValid();
 }
 
-String HTMLMediaElement::nextSourceChild(ContentType *contentType)
+KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidSourceAction actionIfInvalid)
 {
-    String mediaSrc;
+    KURL mediaURL;
+    Node* node;
     bool lookingForPreviousNode = m_currentSourceNode;
+    bool canUse = false;
 
-    for (Node* node = firstChild(); node; node = node->nextSibling()) {
+    for (node = firstChild(); !canUse && node; node = node->nextSibling()) {
         if (!node->hasTagName(sourceTag))
             continue;
 
         if (lookingForPreviousNode) {
-            if (m_currentSourceNode == node)
+            if (m_currentSourceNode == static_cast<HTMLSourceElement*>(node))
                 lookingForPreviousNode = false;
             continue;
         }
-        
+
         HTMLSourceElement* source = static_cast<HTMLSourceElement*>(node);
         if (!source->hasAttribute(srcAttr))
-            continue; 
+            goto check_again; 
+
         if (source->hasAttribute(mediaAttr)) {
             MediaQueryEvaluator screenEval("screen", document()->frame(), renderer() ? renderer()->style() : 0);
             RefPtr<MediaList> media = MediaList::createAllowingDescriptionSyntax(source->media());
-            if (!screenEval.eval(media.get()))
-                continue;
+            if (!screenEval.eval(media.get())) 
+                goto check_again;
         }
-        if (source->hasAttribute(typeAttr)) {
-            ContentType type(source->type());
-            if (!MediaPlayer::supportsType(type))
-                continue;
 
-            // return type with all parameters in place so the media engine can use them
-            if (contentType)
-                *contentType = type;
+        if (source->hasAttribute(typeAttr)) {
+            if (!MediaPlayer::supportsType(ContentType(source->type())))
+                goto check_again;
         }
-        mediaSrc = source->src().string();
-        m_currentSourceNode = node;
-        break;
+
+        // Is it safe to load this url?
+        mediaURL = source->src();
+        if (!mediaURL.isValid() || !isSafeToLoadURL(mediaURL, actionIfInvalid))
+            goto check_again;
+
+        // Making it this far means the <source> looks reasonable
+        canUse = true;
+        if (contentType)
+            *contentType = ContentType(source->type());
+
+check_again:
+        if (!canUse && actionIfInvalid == Complain)
+            source->scheduleErrorEvent();
+        m_currentSourceNode = static_cast<HTMLSourceElement*>(node);
     }
 
-    if (!mediaSrc.isEmpty())
-        mediaSrc = document()->completeURL(mediaSrc).string();
-
-    return mediaSrc;
+    if (!canUse)
+        m_currentSourceNode = 0;
+    return canUse ? mediaURL : KURL();
 }
 
 void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
@@ -1127,7 +1206,7 @@
     
     float now = currentTime();
     float dur = duration();
-    if (now >= dur) {
+    if (!isnan(dur) && dur && now >= dur) {
         if (loop()) {
             ExceptionCode ignoredException;
             m_sentEndEvent = false;
@@ -1195,6 +1274,17 @@
     endProcessingMediaPlayerCallback();
 }
 
+void HTMLMediaElement::mediaPlayerSawUnsupportedTracks(MediaPlayer*)
+{
+    // The MediaPlayer came across content it cannot completely handle.
+    // This is normally acceptable except when we are in a standalone
+    // MediaDocument. If so, tell the document what has happened.
+    if (ownerDocument()->isMediaDocument()) {
+        MediaDocument* mediaDocument = static_cast<MediaDocument*>(ownerDocument());
+        mediaDocument->mediaElementSawUnsupportedTracks();
+    }
+}
+
 PassRefPtr<TimeRanges> HTMLMediaElement::buffered() const
 {
     // FIXME real ranges support
@@ -1205,8 +1295,16 @@
 
 PassRefPtr<TimeRanges> HTMLMediaElement::played() const
 {
-    // FIXME track played
-    return TimeRanges::create();
+    if (!m_playedTimeRanges) {
+        // We are not yet loaded
+        return TimeRanges::create();
+    }
+    if (m_playing) {
+        float time = currentTime();
+        if (m_lastSeekTime < time)
+            m_playedTimeRanges->add(m_lastSeekTime, time);
+    }
+    return m_playedTimeRanges->copy();
 }
 
 PassRefPtr<TimeRanges> HTMLMediaElement::seekable() const
@@ -1224,7 +1322,11 @@
 
 bool HTMLMediaElement::endedPlayback() const
 {
-    return m_player && m_readyState >= HAVE_METADATA && currentTime() >= duration() && !loop();
+    if (!m_player || m_readyState < HAVE_METADATA)
+        return false;
+    
+    float dur = duration();
+    return !isnan(dur) && currentTime() >= dur && !loop();
 }
 
 bool HTMLMediaElement::stoppedDueToErrors() const
@@ -1281,9 +1383,14 @@
         m_player->setRate(m_playbackRate);
         m_player->play();
         startPlaybackProgressTimer();
+        m_playing = true;
     } else if (!shouldBePlaying && !playerPaused) {
         m_player->pause();
         m_playbackProgressTimer.stop();
+        m_playing = false;
+        float time = currentTime();
+        if (m_lastSeekTime < time)
+            m_playedTimeRanges->add(m_lastSeekTime, time);
     }
     
     if (renderer())
@@ -1419,15 +1526,12 @@
 
 String HTMLMediaElement::initialURL()
 {
-    String initialSrc = mediaSrc = getAttribute(srcAttr);
+    KURL initialSrc = document()->completeURL(getAttribute(srcAttr));
     
-    if (initialSrc.isEmpty())
-        initialSrc = nextSourceChild();
+    if (!initialSrc.isValid())
+        initialSrc = selectNextSourceChild(0, DoNothing).string();
 
-    if (!initialSrc.isEmpty())
-        initialSrc = document()->completeURL(initialSrc).string();
-
-    m_currentSrc = initialSrc;
+    m_currentSrc = initialSrc.string();
 
     return initialSrc;
 }
@@ -1438,7 +1542,7 @@
     if (!m_player)
         m_player.set(new MediaPlayer(this));
     
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer())
         static_cast<RenderPartObject*>(renderer())->updateWidget(true);
 }
diff --git a/WebCore/html/HTMLMediaElement.h b/WebCore/html/HTMLMediaElement.h
index ab0ab11..65c542b 100644
--- a/WebCore/html/HTMLMediaElement.h
+++ b/WebCore/html/HTMLMediaElement.h
@@ -39,6 +39,7 @@
 namespace WebCore {
 
 class Event;
+class HTMLSourceElement;
 class MediaError;
 class KURL;
 class TimeRanges;
@@ -51,6 +52,7 @@
     bool checkDTD(const Node* newChild);
     
     void attributeChanged(Attribute*, bool preserveDecls);
+    void parseMappedAttribute(MappedAttribute *);
 
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -84,9 +86,11 @@
 
     enum NetworkState { NETWORK_EMPTY, NETWORK_IDLE, NETWORK_LOADING, NETWORK_LOADED, NETWORK_NO_SOURCE };
     NetworkState networkState() const;
+    bool autobuffer() const;    
+    void setAutobuffer(bool);
+
     PassRefPtr<TimeRanges> buffered() const;
     void load(ExceptionCode&);
-    
     String canPlayType(const String& mimeType) const;
 
 // ready state
@@ -97,6 +101,7 @@
 // playback state
     float currentTime() const;
     void setCurrentTime(float, ExceptionCode&);
+    float startTime() const;
     float duration() const;
     bool paused() const;
     float defaultPlaybackRate() const;
@@ -154,6 +159,7 @@
     virtual void mediaPlayerDurationChanged(MediaPlayer*);
     virtual void mediaPlayerRateChanged(MediaPlayer*);
     virtual void mediaPlayerSizeChanged(MediaPlayer*);
+    virtual void mediaPlayerSawUnsupportedTracks(MediaPlayer*);
 
 private:
     void loadTimerFired(Timer<HTMLMediaElement>*);
@@ -174,13 +180,17 @@
     
     // loading
     void selectMediaResource();
-    void loadResource(String url, ContentType& contentType);
+    void loadResource(const KURL&, ContentType&);
     void loadNextSourceChild();
     void userCancelledLoad();
-    String nextSourceChild(ContentType* contentType = 0);
     bool havePotentialSourceChild();
     void noneSupported();
     void mediaEngineError(PassRefPtr<MediaError> err);
+    void cancelPendingEventsAndCallbacks();
+
+    enum InvalidSourceAction { DoNothing, Complain };
+    bool isSafeToLoadURL(const KURL&, InvalidSourceAction);
+    KURL selectNextSourceChild(ContentType*, InvalidSourceAction);
 
     // These "internal" functions do not check user gesture restrictions.
     void loadInternal();
@@ -214,6 +224,7 @@
     Timer<HTMLMediaElement> m_progressEventTimer;
     Timer<HTMLMediaElement> m_playbackProgressTimer;
     Vector<RefPtr<Event> > m_pendingEvents;
+    RefPtr<TimeRanges> m_playedTimeRanges;
     
     float m_playbackRate;
     float m_defaultPlaybackRate;
@@ -224,7 +235,7 @@
     RefPtr<MediaError> m_error;
 
     float m_volume;
-    float m_currentTimeDuringSeek;
+    float m_lastSeekTime;
     
     unsigned m_previousProgress;
     double m_previousProgressTime;
@@ -238,12 +249,14 @@
     // loading state
     enum LoadState { WaitingForSource, LoadingFromSrcAttr, LoadingFromSourceElement };
     LoadState m_loadState;
-    Node *m_currentSourceNode;
+    HTMLSourceElement *m_currentSourceNode;
     
     OwnPtr<MediaPlayer> m_player;
 
     BehaviorRestrictions m_restrictions;
 
+    bool m_playing;
+
     // counter incremented while processing a callback from the media player, so we can avoid
     //  calling the media engine recursively
     int m_processingMediaPlayerCallback;
diff --git a/WebCore/html/HTMLMediaElement.idl b/WebCore/html/HTMLMediaElement.idl
index 931980b..008e059 100644
--- a/WebCore/html/HTMLMediaElement.idl
+++ b/WebCore/html/HTMLMediaElement.idl
@@ -39,6 +39,7 @@
     const unsigned short NETWORK_LOADED = 3;
     const unsigned short NETWORK_NO_SOURCE = 4;
     readonly attribute unsigned short networkState;
+    attribute boolean autobuffer;
 
     readonly attribute TimeRanges buffered;
     void load() 
@@ -57,6 +58,7 @@
     // playback state
     attribute float currentTime
         setter raises (DOMException);
+    readonly attribute float startTime;
     readonly attribute float duration;
     readonly attribute boolean paused;
     attribute float defaultPlaybackRate;
diff --git a/WebCore/html/HTMLMetaElement.cpp b/WebCore/html/HTMLMetaElement.cpp
index 0a07651..48284e3 100644
--- a/WebCore/html/HTMLMetaElement.cpp
+++ b/WebCore/html/HTMLMetaElement.cpp
@@ -19,11 +19,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLMetaElement.h"
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/html/HTMLNameCollection.cpp b/WebCore/html/HTMLNameCollection.cpp
index fdebe78..d5657da 100644
--- a/WebCore/html/HTMLNameCollection.cpp
+++ b/WebCore/html/HTMLNameCollection.cpp
@@ -32,7 +32,7 @@
 
 using namespace HTMLNames;
 
-HTMLNameCollection::HTMLNameCollection(PassRefPtr<Document> document, Type type, const String& name)
+HTMLNameCollection::HTMLNameCollection(PassRefPtr<Document> document, CollectionType type, const String& name)
     : HTMLCollection(document.get(), type, document->nameCollectionInfo(type, name))
     , m_name(name)
 {
diff --git a/WebCore/html/HTMLNameCollection.h b/WebCore/html/HTMLNameCollection.h
index 9add926..3e990d7 100644
--- a/WebCore/html/HTMLNameCollection.h
+++ b/WebCore/html/HTMLNameCollection.h
@@ -32,13 +32,13 @@
 
 class HTMLNameCollection : public HTMLCollection {
 public:
-    static PassRefPtr<HTMLNameCollection> create(PassRefPtr<Document> document, Type type, const String& name)
+    static PassRefPtr<HTMLNameCollection> create(PassRefPtr<Document> document, CollectionType type, const String& name)
     {
         return adoptRef(new HTMLNameCollection(document, type, name));
     }
     
 private:
-    HTMLNameCollection(PassRefPtr<Document>, Type, const String& name);
+    HTMLNameCollection(PassRefPtr<Document>, CollectionType, const String& name);
 
     virtual Element* itemAfter(Element*) const;
 
diff --git a/WebCore/html/HTMLNoScriptElement.cpp b/WebCore/html/HTMLNoScriptElement.cpp
new file mode 100644
index 0000000..3bbfbe6
--- /dev/null
+++ b/WebCore/html/HTMLNoScriptElement.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(XHTMLMP)
+#include "HTMLNoScriptElement.h"
+
+#include "CSSStyleSelector.h"
+#include "HTMLNames.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+HTMLNoScriptElement::HTMLNoScriptElement(const QualifiedName& tagName, Document* doc)
+    : HTMLElement(tagName, doc)
+{
+    ASSERT(hasTagName(noscriptTag));
+}
+
+HTMLNoScriptElement::~HTMLNoScriptElement()
+{
+}
+
+bool HTMLNoScriptElement::checkDTD(const Node* newChild)
+{
+    return newChild->isTextNode() || inBlockTagList(newChild); 
+}
+
+void HTMLNoScriptElement::attach()
+{
+    HTMLElement::attach();
+
+    // If no need to process <noscript>, we hide it by setting display:none temporarily
+    if (!document()->shouldProcessNoscriptElement()) {
+        if (renderer() && renderer()->style())
+            renderer()->style()->setDisplay(NONE);
+        setNeedsStyleRecalc();
+    }
+}
+
+void HTMLNoScriptElement::recalcStyle(StyleChange change)
+{
+    if (!document()->shouldProcessNoscriptElement() || !renderer() || !renderer()->style())
+        return;
+
+    // If <noscript> needs processing, we make it visiable here, including its visible children
+    RefPtr<RenderStyle> style = renderer()->style();
+    if (style->display() == NONE) {
+        style->setDisplay(INLINE);
+
+        // Create renderers for its children
+        if (hasChildNodes()) {
+            for (Node* n = firstChild(); n; n = n->traverseNextNode(this))
+                if (!n->renderer())
+                    n->createRendererIfNeeded();
+        }
+    }
+}
+
+bool HTMLNoScriptElement::childShouldCreateRenderer(Node* child) const
+{
+    return document()->shouldProcessNoscriptElement();
+}
+
+}
+#endif
diff --git a/WebCore/html/HTMLNoScriptElement.h b/WebCore/html/HTMLNoScriptElement.h
new file mode 100644
index 0000000..2cc5a3c
--- /dev/null
+++ b/WebCore/html/HTMLNoScriptElement.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef HTMLNoScriptElement_h
+#define HTMLNoScriptElement_h
+
+#if ENABLE(XHTMLMP)
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+class HTMLNoScriptElement : public HTMLElement {
+public:
+    HTMLNoScriptElement(const QualifiedName&, Document*);
+
+private:
+    virtual ~HTMLNoScriptElement();
+
+    virtual bool checkDTD(const Node*);
+    virtual void attach();
+    virtual void recalcStyle(StyleChange);
+    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool rendererIsNeeded(RenderStyle*) {  return true; }
+};
+
+} //namespace
+
+#endif
+#endif
diff --git a/WebCore/html/HTMLOListElement.cpp b/WebCore/html/HTMLOListElement.cpp
index c1e0d7c..63fd437 100644
--- a/WebCore/html/HTMLOListElement.cpp
+++ b/WebCore/html/HTMLOListElement.cpp
@@ -18,12 +18,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLOListElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderListItem.h"
 
 namespace WebCore {
diff --git a/WebCore/html/HTMLObjectElement.cpp b/WebCore/html/HTMLObjectElement.cpp
index a41e037..6be41c9 100644
--- a/WebCore/html/HTMLObjectElement.cpp
+++ b/WebCore/html/HTMLObjectElement.cpp
@@ -32,14 +32,15 @@
 #include "HTMLFormElement.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
 #include "RenderPartObject.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
 #include "Text.h"
 
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -94,7 +95,7 @@
         if (renderer())
           m_needWidgetUpdate = true;
     } else if (attr->name() == onloadAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (isDocNamedItem() && inDocument() && document()->isHTMLDocument()) {
@@ -163,7 +164,7 @@
 
 void HTMLObjectElement::updateWidget()
 {
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer() && !m_useFallbackContent && !isImageType())
         static_cast<RenderPartObject*>(renderer())->updateWidget(true);
 }
@@ -174,7 +175,7 @@
     if (!m_useFallbackContent) {
         m_needWidgetUpdate = true;
         if (inDocument())
-            setChanged();
+            setNeedsStyleRecalc();
     }
 }
 
@@ -222,7 +223,7 @@
     updateDocNamedItem();
     if (inDocument() && !m_useFallbackContent) {
         m_needWidgetUpdate = true;
-        setChanged();
+        setNeedsStyleRecalc();
     }
     HTMLPlugInElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
diff --git a/WebCore/html/HTMLObjectElement.idl b/WebCore/html/HTMLObjectElement.idl
index c225238..5d4562c 100644
--- a/WebCore/html/HTMLObjectElement.idl
+++ b/WebCore/html/HTMLObjectElement.idl
@@ -50,14 +50,16 @@
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM)
-#if ENABLE_SVG
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL             absoluteImageURL;
 #endif
diff --git a/WebCore/html/HTMLOptGroupElement.cpp b/WebCore/html/HTMLOptGroupElement.cpp
index 5c79e74..af81b07 100644
--- a/WebCore/html/HTMLOptGroupElement.cpp
+++ b/WebCore/html/HTMLOptGroupElement.cpp
@@ -49,7 +49,7 @@
     return HTMLElement::isFocusable();
 }
 
-const AtomicString& HTMLOptGroupElement::type() const
+const AtomicString& HTMLOptGroupElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, optgroup, ("optgroup"));
     return optgroup;
diff --git a/WebCore/html/HTMLOptGroupElement.h b/WebCore/html/HTMLOptGroupElement.h
index b161728..13e92ca 100644
--- a/WebCore/html/HTMLOptGroupElement.h
+++ b/WebCore/html/HTMLOptGroupElement.h
@@ -36,7 +36,7 @@
     HTMLOptGroupElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
     virtual bool checkDTD(const Node*);
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
     virtual bool isFocusable() const;
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
diff --git a/WebCore/html/HTMLOptionElement.cpp b/WebCore/html/HTMLOptionElement.cpp
index 982f578..1d446f7 100644
--- a/WebCore/html/HTMLOptionElement.cpp
+++ b/WebCore/html/HTMLOptionElement.cpp
@@ -30,9 +30,10 @@
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "HTMLSelectElement.h"
+#include "MappedAttribute.h"
+#include "NodeRenderStyle.h"
 #include "RenderMenuList.h"
 #include "Text.h"
-#include "NodeRenderStyle.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
@@ -42,7 +43,6 @@
 
 HTMLOptionElement::HTMLOptionElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLFormControlElement(tagName, doc, f)
-    , m_data(this)
     , m_style(0)
 {
     ASSERT(hasTagName(optionTag));
@@ -71,7 +71,7 @@
     return HTMLElement::isFocusable();
 }
 
-const AtomicString& HTMLOptionElement::type() const
+const AtomicString& HTMLOptionElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, option, ("option"));
     return option;
@@ -79,7 +79,7 @@
 
 String HTMLOptionElement::text() const
 {
-    return OptionElement::collectOptionText(m_data, document());
+    return OptionElement::collectOptionText(m_data, this);
 }
 
 void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
@@ -104,22 +104,7 @@
 
 int HTMLOptionElement::index() const
 {
-    // Let's do this dynamically. Might be a bit slow, but we're sure
-    // we won't forget to update a member variable in some cases...
-    HTMLSelectElement* select = ownerSelectElement();
-    if (select) {
-        const Vector<HTMLElement*>& items = select->listItems();
-        int l = items.size();
-        int optionIndex = 0;
-        for(int i = 0; i < l; i++) {
-            if (items[i]->hasLocalName(optionTag)) {
-                if (static_cast<HTMLOptionElement*>(items[i]) == this)
-                    return optionIndex;
-                optionIndex++;
-            }
-        }
-    }
-    return 0;
+    return OptionElement::optionIndex(ownerSelectElement(), this);
 }
 
 void HTMLOptionElement::parseMappedAttribute(MappedAttribute *attr)
@@ -136,7 +121,7 @@
 
 String HTMLOptionElement::value() const
 {
-    return OptionElement::collectOptionValue(m_data, document());
+    return OptionElement::collectOptionValue(m_data, this);
 }
 
 void HTMLOptionElement::setValue(const String& value)
@@ -154,7 +139,7 @@
     if (m_data.selected() == selected)
         return;
 
-    OptionElement::setSelectedState(m_data, selected);
+    OptionElement::setSelectedState(m_data, this, selected);
 
     if (HTMLSelectElement* select = ownerSelectElement())
         select->setSelectedIndex(selected ? index() : -1, false);
@@ -162,7 +147,7 @@
 
 void HTMLOptionElement::setSelectedState(bool selected)
 {
-    OptionElement::setSelectedState(m_data, selected);
+    OptionElement::setSelectedState(m_data, this, selected);
 }
 
 void HTMLOptionElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -217,7 +202,7 @@
 
 String HTMLOptionElement::textIndentedToRespectGroupLabel() const
 {
-    return OptionElement::collectOptionTextRespectingGroupLabel(m_data, document());
+    return OptionElement::collectOptionTextRespectingGroupLabel(m_data, this);
 }
 
 bool HTMLOptionElement::disabled() const
diff --git a/WebCore/html/HTMLOptionElement.h b/WebCore/html/HTMLOptionElement.h
index 8c0f260..f13a802 100644
--- a/WebCore/html/HTMLOptionElement.h
+++ b/WebCore/html/HTMLOptionElement.h
@@ -48,9 +48,9 @@
     virtual void detach();
     virtual void setRenderStyle(PassRefPtr<RenderStyle>);
     
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
 
-    String text() const;
+    virtual String text() const;
     void setText(const String&, ExceptionCode&);
 
     int index() const;
diff --git a/WebCore/html/HTMLOptionElement.idl b/WebCore/html/HTMLOptionElement.idl
index 34fa999..612d459 100644
--- a/WebCore/html/HTMLOptionElement.idl
+++ b/WebCore/html/HTMLOptionElement.idl
@@ -28,7 +28,7 @@
     ] HTMLOptionElement : HTMLElement {
         readonly attribute  HTMLFormElement      form;
                  attribute  boolean              defaultSelected;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute  [ConvertNullToNullString] DOMString            text
                      setter raises(DOMException);
 #else
diff --git a/WebCore/html/HTMLOptionsCollection.idl b/WebCore/html/HTMLOptionsCollection.idl
index 226f3d7..5f85fcb 100644
--- a/WebCore/html/HTMLOptionsCollection.idl
+++ b/WebCore/html/HTMLOptionsCollection.idl
@@ -36,7 +36,7 @@
              raises (DOMException);
         [Custom] void remove(in unsigned long index);
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         Node item(in unsigned long index);
         Node namedItem(in DOMString name);
 #endif
diff --git a/WebCore/html/HTMLParagraphElement.cpp b/WebCore/html/HTMLParagraphElement.cpp
index 44eaecc..a8deb10 100644
--- a/WebCore/html/HTMLParagraphElement.cpp
+++ b/WebCore/html/HTMLParagraphElement.cpp
@@ -19,6 +19,7 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLParagraphElement.h"
 
@@ -26,6 +27,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/html/HTMLParamElement.cpp b/WebCore/html/HTMLParamElement.cpp
index 6e1197b..d5fc6e7 100644
--- a/WebCore/html/HTMLParamElement.cpp
+++ b/WebCore/html/HTMLParamElement.cpp
@@ -25,6 +25,7 @@
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/html/HTMLParser.cpp b/WebCore/html/HTMLParser.cpp
index a4d4671..dab58b3 100644
--- a/WebCore/html/HTMLParser.cpp
+++ b/WebCore/html/HTMLParser.cpp
@@ -3,7 +3,8 @@
               (C) 1997 Torben Weis (weis@kde.org)
               (C) 1999,2001 Lars Knoll (knoll@kde.org)
               (C) 2000,2001 Dirk Mueller (mueller@kde.org)
-    Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+    Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -27,6 +28,7 @@
 #include "CharacterNames.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "ChromeClient.h"
 #include "Comment.h"
 #include "Console.h"
 #include "DOMWindow.h"
@@ -45,15 +47,17 @@
 #include "HTMLIsIndexElement.h"
 #include "HTMLMapElement.h"
 #include "HTMLNames.h"
+#include "HTMLParserQuirks.h"
 #include "HTMLTableCellElement.h"
 #include "HTMLTableRowElement.h"
 #include "HTMLTableSectionElement.h"
 #include "HTMLTokenizer.h"
 #include "LocalizedStrings.h"
+#include "Page.h"
 #include "Settings.h"
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
-    
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -126,7 +130,6 @@
     , m_blockStack(0)
     , m_blocksInStack(0)
     , m_hasPElementInScope(NotInScope)
-    , m_head(0)
     , m_inBody(false)
     , m_haveContent(false)
     , m_haveFrameSet(false)
@@ -134,6 +137,7 @@
     , m_reportErrors(reportErrors)
     , m_handlingResidualStyleAcrossBlocks(false)
     , m_inStrayTableContent(0)
+    , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : 0)
 {
 }
 
@@ -144,7 +148,6 @@
     , m_blockStack(0)
     , m_blocksInStack(0)
     , m_hasPElementInScope(NotInScope)
-    , m_head(0)
     , m_inBody(true)
     , m_haveContent(false)
     , m_haveFrameSet(false)
@@ -152,6 +155,7 @@
     , m_reportErrors(false)
     , m_handlingResidualStyleAcrossBlocks(false)
     , m_inStrayTableContent(0)
+    , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : 0)
 {
     if (frag)
         frag->ref();
@@ -161,7 +165,7 @@
 {
     freeBlock();
     if (m_didRefCurrent)
-        m_current->deref(); 
+        m_current->deref();
 }
 
 void HTMLParser::reset()
@@ -183,6 +187,9 @@
     m_isindexElement = 0;
 
     m_skipModeTag = nullAtom;
+    
+    if (m_parserQuirks)
+        m_parserQuirks->reset();
 }
 
 void HTMLParser::setCurrent(Node* newCurrent) 
@@ -334,6 +341,9 @@
             popBlock(m_blockStack->tagName);
     }
 
+    if (m_parserQuirks && !m_parserQuirks->shouldInsertNode(m_current, n))
+        return false;
+
     // let's be stupid and just try to insert it.
     // this should work if the document is well-formed
     Node* newNode = m_current->addChild(n);
@@ -347,6 +357,8 @@
             // This case should only be hit when a demoted <form> is placed inside a table.
             ASSERT(localName == formTag);
             reportError(FormInsideTablePartError, &m_current->localName());
+            HTMLFormElement* form = static_cast<HTMLFormElement*>(n);
+            form->setDemoted(true);
         } else {
             // The pushBlock function transfers ownership of current to the block stack
             // so we're guaranteed that m_didRefCurrent is false. The code below is an
@@ -417,9 +429,9 @@
                     reportError(RedundantHTMLBodyError, &localName);
                     // we have another <HTML> element.... apply attributes to existing one
                     // make sure we don't overwrite already existing attributes
-                    NamedAttrMap* map = static_cast<Element*>(n)->attributes(true);
+                    NamedNodeMap* map = static_cast<Element*>(n)->attributes(true);
                     Element* existingHTML = static_cast<Element*>(m_document->documentElement());
-                    NamedAttrMap* bmap = existingHTML->attributes(false);
+                    NamedNodeMap* bmap = existingHTML->attributes(false);
                     for (unsigned l = 0; map && l < map->length(); ++l) {
                         Attribute* it = map->attributeItem(l);
                         if (!bmap->getAttributeItem(it->name()))
@@ -428,7 +440,7 @@
                 }
                 return false;
             }
-        } else if (h->hasLocalName(titleTag) || h->hasLocalName(styleTag)) {
+        } else if (h->hasLocalName(titleTag) || h->hasLocalName(styleTag) || h->hasLocalName(scriptTag)) {
             bool createdHead = false;
             if (!m_head) {
                 createHead();
@@ -461,9 +473,9 @@
                 // make sure we don't overwrite already existing attributes
                 // some sites use <body bgcolor=rightcolor>...<body bgcolor=wrongcolor>
                 reportError(RedundantHTMLBodyError, &localName);
-                NamedAttrMap* map = static_cast<Element*>(n)->attributes(true);
+                NamedNodeMap* map = static_cast<Element*>(n)->attributes(true);
                 Element* existingBody = m_document->body();
-                NamedAttrMap* bmap = existingBody->attributes(false);
+                NamedNodeMap* bmap = existingBody->attributes(false);
                 for (unsigned l = 0; map && l < map->length(); ++l) {
                     Attribute* it = map->attributeItem(l);
                     if (!bmap->getAttributeItem(it->name()))
@@ -506,8 +518,7 @@
                 elt->hasLocalName(baseTag))) {
                 if (!m_head) {
                     m_head = new HTMLHeadElement(headTag, m_document);
-                    e = m_head;
-                    insertNode(e);
+                    insertNode(m_head.get());
                     handled = true;
                 }
             } else {
@@ -517,6 +528,12 @@
                         return false;
                 }
                 if (!m_haveFrameSet) {
+                    // Ensure that head exists.
+                    // But not for older versions of Mail, where the implicit <head> isn't expected - <rdar://problem/6863795>
+                    if (shouldCreateImplicitHead(m_document))
+                        createHead();
+
+                    popBlock(headTag);
                     e = new HTMLBodyElement(bodyTag, m_document);
                     startBody();
                     insertNode(e);
@@ -530,6 +547,7 @@
             else {
                 // This means the body starts here...
                 if (!m_haveFrameSet) {
+                    ASSERT(currentTagName == headTag);
                     popBlock(currentTagName);
                     e = new HTMLBodyElement(bodyTag, m_document);
                     startBody();
@@ -699,6 +717,12 @@
     // body no longer allowed if we have a frameset
     if (m_haveFrameSet)
         return false;
+    
+    // Ensure that head exists (unless parsing a fragment).
+    // But not for older versions of Mail, where the implicit <head> isn't expected - <rdar://problem/6863795>
+    if (!m_isParsingFragment && shouldCreateImplicitHead(m_document))
+        createHead();
+    
     popBlock(headTag);
     startBody();
     return true;
@@ -886,7 +910,9 @@
         gFunctionMap.set(nobrTag.localName().impl(), &HTMLParser::nestedCreateErrorCheck);
         gFunctionMap.set(noembedTag.localName().impl(), &HTMLParser::noembedCreateErrorCheck);
         gFunctionMap.set(noframesTag.localName().impl(), &HTMLParser::noframesCreateErrorCheck);
+#if !ENABLE(XHTMLMP)
         gFunctionMap.set(noscriptTag.localName().impl(), &HTMLParser::noscriptCreateErrorCheck);
+#endif
         gFunctionMap.set(olTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(pTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(plaintextTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
@@ -992,11 +1018,13 @@
             e->hasLocalName(noframesTag) || e->hasLocalName(nolayerTag) ||
             e->hasLocalName(noembedTag))
             return true;
+#if !ENABLE(XHTMLMP)
         if (e->hasLocalName(noscriptTag) && !m_isParsingFragment) {
             Settings* settings = m_document->settings();
             if (settings && settings->isJavaScriptEnabled())
                 return true;
         }
+#endif
     }
     
     return false;
@@ -1335,7 +1363,10 @@
 void HTMLParser::popBlock(const AtomicString& tagName, bool reportErrors)
 {
     HTMLStackElem* elem = m_blockStack;
-    
+
+    if (m_parserQuirks && elem && !m_parserQuirks->shouldPopBlock(elem->tagName, tagName))
+        return;
+
     int maxLevel = 0;
 
     while (elem && (elem->tagName != tagName)) {
@@ -1510,20 +1541,25 @@
 
 void HTMLParser::createHead()
 {
-    if (m_head || !m_document->documentElement())
+    if (m_head)
         return;
 
+    if (!m_document->documentElement()) {
+        insertNode(new HTMLHtmlElement(htmlTag, m_document));
+        ASSERT(m_document->documentElement());
+    }
+
     m_head = new HTMLHeadElement(headTag, m_document);
     HTMLElement* body = m_document->body();
     ExceptionCode ec = 0;
-    m_document->documentElement()->insertBefore(m_head, body, ec);
+    m_document->documentElement()->insertBefore(m_head.get(), body, ec);
     if (ec)
         m_head = 0;
         
     // If the body does not exist yet, then the <head> should be pushed as the current block.
     if (m_head && !body) {
         pushBlock(m_head->localName(), m_head->tagPriority());
-        setCurrent(m_head);
+        setCurrent(m_head.get());
     }
 }
 
@@ -1624,4 +1660,22 @@
         message, lineNumber, m_document->url().string());
 }
 
+#ifdef BUILDING_ON_LEOPARD
+bool shouldCreateImplicitHead(Document* document)
+{
+    ASSERT(document);
+    
+    Settings* settings = document->page() ? document->page()->settings() : 0;
+    return settings ? !settings->needsLeopardMailQuirks() : true;
+}
+#elif defined(BUILDING_ON_TIGER)
+bool shouldCreateImplicitHead(Document* document)
+{
+    ASSERT(document);
+    
+    Settings* settings = document->page() ? document->page()->settings() : 0;
+    return settings ? !settings->needsTigerMailQuirks() : true;
+}
+#endif
+
 }
diff --git a/WebCore/html/HTMLParser.h b/WebCore/html/HTMLParser.h
index 23fb980..19f553e 100644
--- a/WebCore/html/HTMLParser.h
+++ b/WebCore/html/HTMLParser.h
@@ -3,7 +3,7 @@
               (C) 1997 Torben Weis (weis@kde.org)
               (C) 1998 Waldo Bastian (bastian@kde.org)
               (C) 1999 Lars Knoll (knoll@kde.org)
-    Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,6 +26,7 @@
 
 #include "QualifiedName.h"
 #include <wtf/Forward.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 #include "HTMLParserErrorCodes.h"
 
@@ -38,6 +39,7 @@
 class HTMLFormElement;
 class HTMLHeadElement;
 class HTMLMapElement;
+class HTMLParserQuirks;
 class Node;
 
 struct HTMLStackElem;
@@ -169,7 +171,7 @@
 
     RefPtr<HTMLFormElement> m_currentFormElement; // currently active form
     RefPtr<HTMLMapElement> m_currentMapElement; // current map
-    HTMLHeadElement* m_head; // head element; needed for HTML which defines <base> after </head>
+    RefPtr<HTMLHeadElement> m_head; // head element; needed for HTML which defines <base> after </head>
     RefPtr<Node> m_isindexElement; // a possible <isindex> element in the head
 
     bool m_inBody;
@@ -182,8 +184,16 @@
     bool m_reportErrors;
     bool m_handlingResidualStyleAcrossBlocks;
     int m_inStrayTableContent;
+
+    OwnPtr<HTMLParserQuirks> m_parserQuirks;
 };
 
+#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_TIGER)
+bool shouldCreateImplicitHead(Document*);
+#else
+inline bool shouldCreateImplicitHead(Document*) { return true; }
+#endif
+
 }
     
 #endif // HTMLParser_h
diff --git a/WebCore/html/HTMLParserQuirks.h b/WebCore/html/HTMLParserQuirks.h
new file mode 100644
index 0000000..b5972a6
--- /dev/null
+++ b/WebCore/html/HTMLParserQuirks.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLParserQuirks_h
+#define HTMLParserQuirks_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class AtomicString;
+class Node;
+
+class HTMLParserQuirks : Noncopyable {
+public:
+    HTMLParserQuirks() { }
+    virtual ~HTMLParserQuirks() { }
+
+    virtual void reset() = 0;
+
+    virtual bool shouldInsertNode(Node* parent, Node* newNode) = 0;
+    virtual bool shouldPopBlock(const AtomicString& tagNameOnStack, const AtomicString& tagNameToPop) = 0;
+};
+
+} // namespace WebCore
+
+#endif // HTMLParserQuirks_h
diff --git a/WebCore/html/HTMLPlugInElement.cpp b/WebCore/html/HTMLPlugInElement.cpp
index 4344b3d..d950d9d 100644
--- a/WebCore/html/HTMLPlugInElement.cpp
+++ b/WebCore/html/HTMLPlugInElement.cpp
@@ -21,6 +21,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLPlugInElement.h"
 
@@ -30,6 +31,7 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
@@ -46,7 +48,7 @@
 
 HTMLPlugInElement::HTMLPlugInElement(const QualifiedName& tagName, Document* doc)
     // FIXME: Always passing false as createdByParser is odd (see bug22851).
-    : HTMLFrameOwnerElement(tagName, doc, false)
+    : HTMLFrameOwnerElement(tagName, doc)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_NPObject(0)
 #endif
diff --git a/WebCore/html/HTMLPreElement.cpp b/WebCore/html/HTMLPreElement.cpp
index 23ecaaa..f340ae3 100644
--- a/WebCore/html/HTMLPreElement.cpp
+++ b/WebCore/html/HTMLPreElement.cpp
@@ -21,12 +21,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLPreElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/html/HTMLScriptElement.cpp b/WebCore/html/HTMLScriptElement.cpp
index 4744b34..86cc3a2 100644
--- a/WebCore/html/HTMLScriptElement.cpp
+++ b/WebCore/html/HTMLScriptElement.cpp
@@ -26,6 +26,8 @@
 #include "Document.h"
 #include "EventNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "ScriptEventListener.h"
 #include "Text.h"
 
 namespace WebCore {
@@ -67,7 +69,7 @@
     if (attrName == srcAttr)
         handleSourceAttribute(m_data, attr->value());
     else if (attrName == onloadAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -209,18 +211,23 @@
 {
     return getAttribute(languageAttr).string();
 }
+
+String HTMLScriptElement::forAttributeValue() const
+{
+    return getAttribute(forAttr).string();
+}
  
 void HTMLScriptElement::dispatchLoadEvent()
 {
     ASSERT(!m_data.haveFiredLoadEvent());
     m_data.setHaveFiredLoadEvent(true);
 
-    dispatchEventForType(eventNames().loadEvent, false, false);
+    dispatchEvent(eventNames().loadEvent, false, false);
 }
 
 void HTMLScriptElement::dispatchErrorEvent()
 {
-    dispatchEventForType(eventNames().errorEvent, true, false);
+    dispatchEvent(eventNames().errorEvent, true, false);
 }
 
 }
diff --git a/WebCore/html/HTMLScriptElement.h b/WebCore/html/HTMLScriptElement.h
index 8839131..4d18beb 100644
--- a/WebCore/html/HTMLScriptElement.h
+++ b/WebCore/html/HTMLScriptElement.h
@@ -35,7 +35,7 @@
     HTMLScriptElement(const QualifiedName&, Document*, bool createdByParser);
     ~HTMLScriptElement();
 
-    bool shouldExecuteAsJavaScript() const;
+    virtual bool shouldExecuteAsJavaScript() const;
     virtual String scriptContent() const;
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
@@ -75,11 +75,14 @@
     
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
+    bool haveFiredLoadEvent() const { return m_data.haveFiredLoadEvent(); }
+
 protected:
     virtual String sourceAttributeValue() const;
     virtual String charsetAttributeValue() const;
     virtual String typeAttributeValue() const;
     virtual String languageAttributeValue() const;
+    virtual String forAttributeValue() const;
 
     virtual void dispatchLoadEvent();
     virtual void dispatchErrorEvent();
diff --git a/WebCore/html/HTMLSelectElement.cpp b/WebCore/html/HTMLSelectElement.cpp
index 107fbd0..95038e6 100644
--- a/WebCore/html/HTMLSelectElement.cpp
+++ b/WebCore/html/HTMLSelectElement.cpp
@@ -21,67 +21,31 @@
  * Boston, MA 02110-1301, USA.
  *
  */
- 
+
 #include "config.h"
 #include "HTMLSelectElement.h"
 
 #include "AXObjectCache.h"
-#include "CSSPropertyNames.h"
-#include "CSSStyleSelector.h"
-#include "CharacterNames.h"
-#include "ChromeClient.h"
-#include "Document.h"
-#include "Event.h"
-#include "EventHandler.h"
 #include "EventNames.h"
-#include "FormDataList.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "FrameLoaderClient.h"
-#include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HTMLOptionElement.h"
 #include "HTMLOptionsCollection.h"
-#include "KeyboardEvent.h"
-#include "MouseEvent.h"
-#include "Page.h"
+#include "MappedAttribute.h"
 #include "RenderListBox.h"
 #include "RenderMenuList.h"
-#include <math.h>
-#include <wtf/StdLibExtras.h>
-#include <wtf/Vector.h>
-
-#if PLATFORM(MAC)
-#define ARROW_KEYS_POP_MENU 1
-#else
-#define ARROW_KEYS_POP_MENU 0
-#endif
+#include "ScriptEventListener.h"
 
 using namespace std;
-using namespace WTF;
-using namespace Unicode;
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-static const DOMTimeStamp typeAheadTimeout = 1000;
-
 // Upper limit agreed upon with representatives of Opera and Mozilla.
 static const unsigned maxSelectItems = 10000;
 
-HTMLSelectElement::HTMLSelectElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
-    : HTMLFormControlElementWithState(tagName, doc, f)
-    , m_minwidth(0)
-    , m_size(0)
-    , m_multiple(false)
-    , m_recalcListItems(false)
-    , m_lastOnChangeIndex(-1)
-    , m_activeSelectionAnchorIndex(-1)
-    , m_activeSelectionEndIndex(-1)
-    , m_activeSelectionState(false)
-    , m_repeatingChar(0)
-    , m_lastCharTime(0)
+HTMLSelectElement::HTMLSelectElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+    : HTMLFormControlElementWithState(tagName, document, form)
 {
     ASSERT(hasTagName(selectTag) || hasTagName(keygenTag));
 }
@@ -93,120 +57,52 @@
            newChild->hasTagName(scriptTag);
 }
 
-void HTMLSelectElement::recalcStyle( StyleChange ch )
+void HTMLSelectElement::recalcStyle(StyleChange change)
 {
-    if (hasChangedChild() && renderer()) {
-        if (usesMenuList())
-            static_cast<RenderMenuList*>(renderer())->setOptionsChanged(true);
-        else
-            static_cast<RenderListBox*>(renderer())->setOptionsChanged(true);
-    } else if (m_recalcListItems)
-        recalcListItems();
-
-    HTMLFormControlElementWithState::recalcStyle(ch);
+    SelectElement::recalcStyle(m_data, this);
+    HTMLFormControlElementWithState::recalcStyle(change);
 }
 
-const AtomicString& HTMLSelectElement::type() const
+const AtomicString& HTMLSelectElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, selectMultiple, ("select-multiple"));
     DEFINE_STATIC_LOCAL(const AtomicString, selectOne, ("select-one"));
-    return m_multiple ? selectMultiple : selectOne;
+    return m_data.multiple() ? selectMultiple : selectOne;
 }
 
 int HTMLSelectElement::selectedIndex() const
 {
-    // return the number of the first option selected
-    unsigned index = 0;
-    const Vector<HTMLElement*>& items = listItems();
-    for (unsigned int i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            if (static_cast<HTMLOptionElement*>(items[i])->selected())
-                return index;
-            index++;
-        }
-    }
-    return -1;
-}
-
-int HTMLSelectElement::lastSelectedListIndex() const
-{
-    // return the number of the last option selected
-    unsigned index = 0;
-    bool found = false;
-    const Vector<HTMLElement*>& items = listItems();
-    for (unsigned int i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            if (static_cast<HTMLOptionElement*>(items[i])->selected()) {
-                index = i;
-                found = true;
-            }
-        }
-    }
-    return found ? (int) index : -1;
+    return SelectElement::selectedIndex(m_data, this);
 }
 
 void HTMLSelectElement::deselectItems(HTMLOptionElement* excludeElement)
 {
-    const Vector<HTMLElement*>& items = listItems();
-    unsigned i;
-    for (i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag) && (items[i] != excludeElement)) {
-            HTMLOptionElement* element = static_cast<HTMLOptionElement*>(items[i]);
-            element->setSelectedState(false);
-        }
-    }
+    SelectElement::deselectItems(m_data, this, excludeElement);
 }
 
 void HTMLSelectElement::setSelectedIndex(int optionIndex, bool deselect, bool fireOnChange)
 {
-    const Vector<HTMLElement*>& items = listItems();
-    int listIndex = optionToListIndex(optionIndex);
-    HTMLOptionElement* element = 0;
-
-    if (!multiple())
-        deselect = true;
-
-    if (listIndex >= 0) {
-        if (m_activeSelectionAnchorIndex < 0 || deselect)
-            setActiveSelectionAnchorIndex(listIndex);
-        if (m_activeSelectionEndIndex < 0 || deselect)
-            setActiveSelectionEndIndex(listIndex);
-        element = static_cast<HTMLOptionElement*>(items[listIndex]);
-        element->setSelectedState(true);
-    }
-
-    if (deselect)
-        deselectItems(element);
-
-    scrollToSelection();
-
-    // This only gets called with fireOnChange for menu lists. 
-    if (fireOnChange && usesMenuList())
-        menuListOnChange();
-
-    Frame* frame = document()->frame();
-    if (frame)
-        frame->page()->chrome()->client()->formStateDidChange(this);
+    SelectElement::setSelectedIndex(m_data, this, optionIndex, deselect, fireOnChange);
 }
 
 int HTMLSelectElement::activeSelectionStartListIndex() const
 {
-    if (m_activeSelectionAnchorIndex >= 0)
-        return m_activeSelectionAnchorIndex;
+    if (m_data.activeSelectionAnchorIndex() >= 0)
+        return m_data.activeSelectionAnchorIndex();
     return optionToListIndex(selectedIndex());
 }
 
 int HTMLSelectElement::activeSelectionEndListIndex() const
 {
-    if (m_activeSelectionEndIndex >= 0)
-        return m_activeSelectionEndIndex;
-    return lastSelectedListIndex();
+    if (m_data.activeSelectionEndIndex() >= 0)
+        return m_data.activeSelectionEndIndex();
+    return SelectElement::lastSelectedListIndex(m_data, this);
 }
 
 unsigned HTMLSelectElement::length() const
 {
     unsigned len = 0;
-    const Vector<HTMLElement*>& items = listItems();
+    const Vector<Element*>& items = listItems();
     for (unsigned i = 0; i < items.size(); ++i) {
         if (items[i]->hasLocalName(optionTag))
             ++len;
@@ -226,27 +122,24 @@
 
 void HTMLSelectElement::remove(int index)
 {
-    ExceptionCode ec = 0;
     int listIndex = optionToListIndex(index);
+    if (listIndex < 0)
+        return;
 
-    const Vector<HTMLElement*>& items = listItems();
-    if (listIndex < 0 || index >= int(items.size()))
-        return; // ### what should we do ? remove the last item?
-
-    Element *item = items[listIndex];
+    Element* item = listItems()[listIndex];
     ASSERT(item->parentNode());
+    ExceptionCode ec;
     item->parentNode()->removeChild(item, ec);
 }
 
 String HTMLSelectElement::value()
 {
-    unsigned i;
-    const Vector<HTMLElement*>& items = listItems();
-    for (i = 0; i < items.size(); i++) {
+    const Vector<Element*>& items = listItems();
+    for (unsigned i = 0; i < items.size(); i++) {
         if (items[i]->hasLocalName(optionTag) && static_cast<HTMLOptionElement*>(items[i])->selected())
             return static_cast<HTMLOptionElement*>(items[i])->value();
     }
-    return String("");
+    return "";
 }
 
 void HTMLSelectElement::setValue(const String &value)
@@ -255,9 +148,9 @@
         return;
     // find the option with value() matching the given parameter
     // and make it the current selection.
-    const Vector<HTMLElement*>& items = listItems();
+    const Vector<Element*>& items = listItems();
     unsigned optionIndex = 0;
-    for (unsigned i = 0; i < items.size(); i++)
+    for (unsigned i = 0; i < items.size(); i++) {
         if (items[i]->hasLocalName(optionTag)) {
             if (static_cast<HTMLOptionElement*>(items[i])->value() == value) {
                 setSelectedIndex(optionIndex, true);
@@ -265,40 +158,24 @@
             }
             optionIndex++;
         }
-}
-
-bool HTMLSelectElement::saveState(String& value) const
-{
-    const Vector<HTMLElement*>& items = listItems();
-    int l = items.size();
-    Vector<char, 1024> characters(l);
-    for (int i = 0; i < l; ++i) {
-        HTMLElement* e = items[i];
-        bool selected = e->hasLocalName(optionTag) && static_cast<HTMLOptionElement*>(e)->selected();
-        characters[i] = selected ? 'X' : '.';
     }
-    value = String(characters.data(), l);
-    return true;
 }
 
-void HTMLSelectElement::restoreState(const String& state)
+bool HTMLSelectElement::saveFormControlState(String& value) const
 {
-    recalcListItems();
-    
-    const Vector<HTMLElement*>& items = listItems();
-    int l = items.size();
-    for (int i = 0; i < l; i++)
-        if (items[i]->hasLocalName(optionTag))
-            static_cast<HTMLOptionElement*>(items[i])->setSelectedState(state[i] == 'X');
-            
-    setChanged();
+    return SelectElement::saveFormControlState(m_data, this, value);
 }
 
-void HTMLSelectElement::parseMappedAttribute(MappedAttribute *attr)
+void HTMLSelectElement::restoreFormControlState(const String& state)
 {
-    bool oldUsesMenuList = usesMenuList();
+    SelectElement::restoreFormControlState(m_data, this, state);
+}
+
+void HTMLSelectElement::parseMappedAttribute(MappedAttribute* attr) 
+{
+    bool oldUsesMenuList = m_data.usesMenuList();
     if (attr->name() == sizeAttr) {
-        int oldSize = m_size;
+        int oldSize = m_data.size();
         // Set the attribute value to a number.
         // This is important since the style rules for this attribute can determine the appearance property.
         int size = attr->value().toInt();
@@ -306,31 +183,25 @@
         if (attrSize != attr->value())
             attr->setValue(attrSize);
 
-        m_size = max(size, 1);
-        if ((oldUsesMenuList != usesMenuList() || (!oldUsesMenuList && m_size != oldSize)) && attached()) {
+        m_data.setSize(max(size, 1));
+        if ((oldUsesMenuList != m_data.usesMenuList() || (!oldUsesMenuList && m_data.size() != oldSize)) && attached()) {
             detach();
             attach();
             setRecalcListItems();
         }
-    } else if (attr->name() == widthAttr) {
-        m_minwidth = max(attr->value().toInt(), 0);
-    } else if (attr->name() == multipleAttr) {
-        m_multiple = (!attr->isNull());
-        if (oldUsesMenuList != usesMenuList() && attached()) {
-            detach();
-            attach();
-        }
-    } else if (attr->name() == accesskeyAttr) {
+    } else if (attr->name() == multipleAttr)
+        SelectElement::parseMultipleAttribute(m_data, this, attr);
+    else if (attr->name() == accesskeyAttr) {
         // FIXME: ignore for the moment
     } else if (attr->name() == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=12072
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onchangeAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().changeEvent, attr);
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     } else
         HTMLFormControlElementWithState::parseMappedAttribute(attr);
 }
@@ -351,98 +222,34 @@
 
 bool HTMLSelectElement::canSelectAll() const
 {
-    return !usesMenuList(); 
+    return !m_data.usesMenuList(); 
 }
 
 void HTMLSelectElement::selectAll()
 {
-    ASSERT(!usesMenuList());
-    if (!renderer() || !multiple())
-        return;
-    
-    // Save the selection so it can be compared to the new selectAll selection when we call onChange
-    saveLastSelection();
-    
-    m_activeSelectionState = true;
-    setActiveSelectionAnchorIndex(nextSelectableListIndex(-1));
-    setActiveSelectionEndIndex(previousSelectableListIndex(-1));
-    
-    updateListBoxSelection(false);
-    listBoxOnChange();
+    SelectElement::selectAll(m_data, this);
 }
 
 RenderObject* HTMLSelectElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    if (usesMenuList())
+    if (m_data.usesMenuList())
         return new (arena) RenderMenuList(this);
     return new (arena) RenderListBox(this);
 }
 
 bool HTMLSelectElement::appendFormData(FormDataList& list, bool)
 {
-    if (name().isEmpty())
-        return false;
-
-    bool successful = false;
-    const Vector<HTMLElement*>& items = listItems();
-
-    unsigned i;
-    for (i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement *option = static_cast<HTMLOptionElement*>(items[i]);
-            if (option->selected()) {
-                list.appendData(name(), option->value());
-                successful = true;
-            }
-        }
-    }
-
-    // ### this case should not happen. make sure that we select the first option
-    // in any case. otherwise we have no consistency with the DOM interface. FIXME!
-    // we return the first one if it was a combobox select
-    if (!successful && !m_multiple && m_size <= 1 && items.size() &&
-        (items[0]->hasLocalName(optionTag))) {
-        HTMLOptionElement *option = static_cast<HTMLOptionElement*>(items[0]);
-        if (option->value().isNull())
-            list.appendData(name(), option->text().stripWhiteSpace());
-        else
-            list.appendData(name(), option->value());
-        successful = true;
-    }
-
-    return successful;
+    return SelectElement::appendFormData(m_data, this, list);
 }
 
 int HTMLSelectElement::optionToListIndex(int optionIndex) const
 {
-    const Vector<HTMLElement*>& items = listItems();
-    int listSize = (int)items.size();
-    if (optionIndex < 0 || optionIndex >= listSize)
-        return -1;
-
-    int optionIndex2 = -1;
-    for (int listIndex = 0; listIndex < listSize; listIndex++) {
-        if (items[listIndex]->hasLocalName(optionTag)) {
-            optionIndex2++;
-            if (optionIndex2 == optionIndex)
-                return listIndex;
-        }
-    }
-    return -1;
+    return SelectElement::optionToListIndex(m_data, this, optionIndex);
 }
 
 int HTMLSelectElement::listToOptionIndex(int listIndex) const
 {
-    const Vector<HTMLElement*>& items = listItems();
-    if (listIndex < 0 || listIndex >= int(items.size()) ||
-        !items[listIndex]->hasLocalName(optionTag))
-        return -1;
-
-    int optionIndex = 0; // actual index of option not counting OPTGROUP entries that may be in list
-    for (int i = 0; i < listIndex; i++)
-        if (items[i]->hasLocalName(optionTag))
-            optionIndex++;
-    return optionIndex;
+    return SelectElement::listToOptionIndex(m_data, this, listIndex);
 }
 
 PassRefPtr<HTMLOptionsCollection> HTMLSelectElement::options()
@@ -452,37 +259,7 @@
 
 void HTMLSelectElement::recalcListItems(bool updateSelectedStates) const
 {
-    m_listItems.clear();
-    HTMLOptionElement* foundSelected = 0;
-    for (Node* current = firstChild(); current; current = current->traverseNextSibling(this)) {
-        if (current->hasTagName(optgroupTag) && current->firstChild()) {
-            // FIXME: It doesn't make sense to add an optgroup to the list items,
-            // when it has children, but not to add it if it happens to have,
-            // children (say some comment nodes or text nodes), yet that's what
-            // this code does!
-            m_listItems.append(static_cast<HTMLElement*>(current));
-            current = current->firstChild();
-            // FIXME: It doesn't make sense to handle an <optgroup> inside another <optgroup>
-            // if it's not the first child, but not handle it if it happens to be the first
-            // child, yet that's what this code does!
-        }
-
-        if (current->hasTagName(optionTag)) {
-            m_listItems.append(static_cast<HTMLElement*>(current));
-            if (updateSelectedStates) {
-                if (!foundSelected && (usesMenuList() || (!m_multiple && static_cast<HTMLOptionElement*>(current)->selected()))) {
-                    foundSelected = static_cast<HTMLOptionElement*>(current);
-                    foundSelected->setSelectedState(true);
-                } else if (foundSelected && !m_multiple && static_cast<HTMLOptionElement*>(current)->selected()) {
-                    foundSelected->setSelectedState(false);
-                    foundSelected = static_cast<HTMLOptionElement*>(current);
-                }
-            }
-        }
-        if (current->hasTagName(hrTag))
-            m_listItems.append(static_cast<HTMLElement*>(current));
-    }
-    m_recalcListItems = false;
+    SelectElement::recalcListItems(const_cast<SelectElementData&>(m_data), this, updateSelectedStates);
 }
 
 void HTMLSelectElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -496,493 +273,65 @@
 
 void HTMLSelectElement::setRecalcListItems()
 {
-    m_recalcListItems = true;
-    m_activeSelectionAnchorIndex = -1; // Manual selection anchor is reset when manipulating the select programmatically.
-    if (renderer()) {
-        if (usesMenuList())
-            static_cast<RenderMenuList*>(renderer())->setOptionsChanged(true);
-        else
-            static_cast<RenderListBox*>(renderer())->setOptionsChanged(true);
-    }
+    SelectElement::setRecalcListItems(m_data, this);
+
     if (!inDocument())
         m_collectionInfo.reset();
-    setChanged();
 }
 
 void HTMLSelectElement::reset()
 {
-    bool optionSelected = false;
-    HTMLOptionElement* firstOption = 0;
-    const Vector<HTMLElement*>& items = listItems();
-    unsigned i;
-    for (i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement *option = static_cast<HTMLOptionElement*>(items[i]);
-            if (!option->getAttribute(selectedAttr).isNull()) {
-                option->setSelectedState(true);
-                optionSelected = true;
-            } else
-                option->setSelectedState(false);
-            if (!firstOption)
-                firstOption = option;
-        }
-    }
-    if (!optionSelected && firstOption && usesMenuList())
-        firstOption->setSelectedState(true);
-    
-    setChanged();
+    SelectElement::reset(m_data, this);
 }
 
 void HTMLSelectElement::dispatchFocusEvent()
 {
-    if (usesMenuList())
-        // Save the selection so it can be compared to the new selection when we call onChange during dispatchBlurEvent.
-        saveLastSelection();
+    SelectElement::dispatchFocusEvent(m_data, this);
     HTMLFormControlElementWithState::dispatchFocusEvent();
 }
 
 void HTMLSelectElement::dispatchBlurEvent()
 {
-    // We only need to fire onChange here for menu lists, because we fire onChange for list boxes whenever the selection change is actually made.
-    // This matches other browsers' behavior.
-    if (usesMenuList())
-        menuListOnChange();
+    SelectElement::dispatchBlurEvent(m_data, this);
     HTMLFormControlElementWithState::dispatchBlurEvent();
 }
 
-void HTMLSelectElement::defaultEventHandler(Event* evt)
+void HTMLSelectElement::defaultEventHandler(Event* event)
 {
-    if (!renderer())
+    SelectElement::defaultEventHandler(m_data, this, event, form());
+    if (event->defaultHandled())
         return;
-    
-    if (usesMenuList())
-        menuListDefaultEventHandler(evt);
-    else 
-        listBoxDefaultEventHandler(evt);
-    
-    if (evt->defaultHandled())
-        return;
-
-    if (evt->type() == eventNames().keypressEvent && evt->isKeyboardEvent()) {
-        KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(evt);
-    
-        if (!keyboardEvent->ctrlKey() && !keyboardEvent->altKey() && !keyboardEvent->metaKey() &&
-            isPrintableChar(keyboardEvent->charCode())) {
-            typeAheadFind(keyboardEvent);
-            evt->setDefaultHandled();
-            return;
-        }
-    }
-
-    HTMLFormControlElementWithState::defaultEventHandler(evt);
-}
-
-void HTMLSelectElement::menuListDefaultEventHandler(Event* evt)
-{
-    if (evt->type() == eventNames().keydownEvent) {
-        if (!renderer() || !evt->isKeyboardEvent())
-            return;
-        String keyIdentifier = static_cast<KeyboardEvent*>(evt)->keyIdentifier();
-        bool handled = false;
-#if ARROW_KEYS_POP_MENU
-        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
-            focus();
-            // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-            saveLastSelection();
-            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(renderer()))
-                menuList->showPopup();
-            handled = true;
-        }
-#elif defined ANDROID_KEYBOARD_NAVIGATION
-        if ("Enter" == keyIdentifier && usesMenuList()) {
-            menuList->showPopup();
-            handled = true;
-        }
-#else
-        int listIndex = optionToListIndex(selectedIndex());
-        if (keyIdentifier == "Down" || keyIdentifier == "Right") {
-            int size = listItems().size();
-            for (listIndex += 1;
-                 listIndex >= 0 && listIndex < size && (listItems()[listIndex]->disabled() || !listItems()[listIndex]->hasTagName(optionTag));
-                 ++listIndex) { }
-            
-            if (listIndex >= 0 && listIndex < size)
-                setSelectedIndex(listToOptionIndex(listIndex));
-            handled = true;
-        } else if (keyIdentifier == "Up" || keyIdentifier == "Left") {
-            int size = listItems().size();
-            for (listIndex -= 1;
-                 listIndex >= 0 && listIndex < size && (listItems()[listIndex]->disabled() || !listItems()[listIndex]->hasTagName(optionTag));
-                 --listIndex) { }
-            
-            if (listIndex >= 0 && listIndex < size)
-                setSelectedIndex(listToOptionIndex(listIndex));
-            handled = true;
-        }
-#endif
-        if (handled)
-            evt->setDefaultHandled();
-    }
-
-    // Use key press event here since sending simulated mouse events
-    // on key down blocks the proper sending of the key press event.
-    if (evt->type() == eventNames().keypressEvent) {
-        if (!renderer() || !evt->isKeyboardEvent())
-            return;
-        int keyCode = static_cast<KeyboardEvent*>(evt)->keyCode();
-        bool handled = false;
-#if ARROW_KEYS_POP_MENU
-        if (keyCode == ' ') {
-            focus();
-            // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-            saveLastSelection();
-            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(renderer()))
-                menuList->showPopup();
-            handled = true;
-        }
-        if (keyCode == '\r') {
-            menuListOnChange();
-            if (form())
-                form()->submitClick(evt);
-            handled = true;
-        }
-#else
-        int listIndex = optionToListIndex(selectedIndex());
-        if (keyCode == '\r') {
-            // listIndex should already be selected, but this will fire the onchange handler.
-            setSelectedIndex(listToOptionIndex(listIndex), true, true);
-            handled = true;
-        }
-#endif
-        if (handled)
-            evt->setDefaultHandled();
-    }
-
-    if (evt->type() == eventNames().mousedownEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
-        focus();
-        if (RenderMenuList* menuList = static_cast<RenderMenuList*>(renderer())) {
-            if (menuList->popupIsVisible())
-                menuList->hidePopup();
-            else {
-                // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-                // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-                saveLastSelection();
-                menuList->showPopup();
-            }
-        }
-        evt->setDefaultHandled();
-    }
-}
-
-void HTMLSelectElement::listBoxDefaultEventHandler(Event* evt)
-{
-    if (evt->type() == eventNames().mousedownEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
-        focus();
-
-        // Convert to coords relative to the list box if needed.
-        MouseEvent* mouseEvent = static_cast<MouseEvent*>(evt);
-        IntPoint localOffset = roundedIntPoint(renderer()->absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
-        int listIndex = static_cast<RenderListBox*>(renderer())->listIndexAtOffset(localOffset.x(), localOffset.y());
-        if (listIndex >= 0) {
-            // Save the selection so it can be compared to the new selection when we call onChange during mouseup, or after autoscroll finishes.
-            saveLastSelection();
-
-            m_activeSelectionState = true;
-            
-            bool multiSelectKeyPressed = false;
-#if PLATFORM(MAC)
-            multiSelectKeyPressed = mouseEvent->metaKey();
-#else
-            multiSelectKeyPressed = mouseEvent->ctrlKey();
-#endif
-
-            bool shiftSelect = multiple() && mouseEvent->shiftKey();
-            bool multiSelect = multiple() && multiSelectKeyPressed && !mouseEvent->shiftKey();
-            
-            HTMLElement* clickedElement = listItems()[listIndex];            
-            HTMLOptionElement* option = 0;
-            if (clickedElement->hasLocalName(optionTag)) {
-                option = static_cast<HTMLOptionElement*>(clickedElement);
-                
-                // Keep track of whether an active selection (like during drag selection), should select or deselect
-                if (option->selected() && multiSelectKeyPressed)
-                    m_activeSelectionState = false;
-
-                if (!m_activeSelectionState)
-                    option->setSelectedState(false);
-            }
-            
-            // If we're not in any special multiple selection mode, then deselect all other items, excluding the clicked option.
-            // If no option was clicked, then this will deselect all items in the list.
-            if (!shiftSelect && !multiSelect)
-                deselectItems(option);
-
-            // If the anchor hasn't been set, and we're doing a single selection or a shift selection, then initialize the anchor to the first selected index.
-            if (m_activeSelectionAnchorIndex < 0 && !multiSelect)
-                setActiveSelectionAnchorIndex(selectedIndex());
-
-            // Set the selection state of the clicked option
-            if (option && !option->disabled())
-                option->setSelectedState(true);
-            
-            // If there was no selectedIndex() for the previous initialization, or
-            // If we're doing a single selection, or a multiple selection (using cmd or ctrl), then initialize the anchor index to the listIndex that just got clicked.
-            if (listIndex >= 0 && (m_activeSelectionAnchorIndex < 0 || !shiftSelect))
-                setActiveSelectionAnchorIndex(listIndex);
-            
-            setActiveSelectionEndIndex(listIndex);
-            updateListBoxSelection(!multiSelect);
-
-            if (Frame* frame = document()->frame())
-                frame->eventHandler()->setMouseDownMayStartAutoscroll();
-
-            evt->setDefaultHandled();
-        }
-    } else if (evt->type() == eventNames().mouseupEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton && document()->frame()->eventHandler()->autoscrollRenderer() != renderer())
-        // This makes sure we fire onChange for a single click.  For drag selection, onChange will fire when the autoscroll timer stops.
-        listBoxOnChange();
-    else if (evt->type() == eventNames().keydownEvent) {
-        if (!evt->isKeyboardEvent())
-            return;
-        String keyIdentifier = static_cast<KeyboardEvent*>(evt)->keyIdentifier();
-
-        int endIndex = 0;        
-        if (m_activeSelectionEndIndex < 0) {
-            // Initialize the end index
-            if (keyIdentifier == "Down")
-                endIndex = nextSelectableListIndex(lastSelectedListIndex());
-            else if (keyIdentifier == "Up")
-                endIndex = previousSelectableListIndex(optionToListIndex(selectedIndex()));
-        } else {
-            // Set the end index based on the current end index
-            if (keyIdentifier == "Down")
-                endIndex = nextSelectableListIndex(m_activeSelectionEndIndex);
-            else if (keyIdentifier == "Up")
-                endIndex = previousSelectableListIndex(m_activeSelectionEndIndex);    
-        }
-        
-        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
-            // Save the selection so it can be compared to the new selection when we call onChange immediately after making the new selection.
-            saveLastSelection();
-
-            ASSERT(endIndex >= 0 && (unsigned)endIndex < listItems().size()); 
-            setActiveSelectionEndIndex(endIndex);
-            
-            // If the anchor is unitialized, or if we're going to deselect all other options, then set the anchor index equal to the end index.
-            bool deselectOthers = !multiple() || !static_cast<KeyboardEvent*>(evt)->shiftKey();
-            if (m_activeSelectionAnchorIndex < 0 || deselectOthers) {
-                m_activeSelectionState = true;
-                if (deselectOthers)
-                    deselectItems();
-                setActiveSelectionAnchorIndex(m_activeSelectionEndIndex);
-            }
-
-            static_cast<RenderListBox*>(renderer())->scrollToRevealElementAtListIndex(endIndex);
-            updateListBoxSelection(deselectOthers);
-            listBoxOnChange();
-            evt->setDefaultHandled();
-        }
-    } else if (evt->type() == eventNames().keypressEvent) {
-        if (!evt->isKeyboardEvent())
-            return;
-        int keyCode = static_cast<KeyboardEvent*>(evt)->keyCode();
-
-        if (keyCode == '\r') {
-            if (form())
-                form()->submitClick(evt);
-            evt->setDefaultHandled();
-            return;
-        }
-    }
+    HTMLFormControlElementWithState::defaultEventHandler(event);
 }
 
 void HTMLSelectElement::setActiveSelectionAnchorIndex(int index)
 {
-    m_activeSelectionAnchorIndex = index;
-    
-    // Cache the selection state so we can restore the old selection as the new selection pivots around this anchor index
-    const Vector<HTMLElement*>& items = listItems();
-    m_cachedStateForActiveSelection.clear();
-    for (unsigned i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(items[i]);
-            m_cachedStateForActiveSelection.append(option->selected());
-        } else
-            m_cachedStateForActiveSelection.append(false);
-    }
+    SelectElement::setActiveSelectionAnchorIndex(m_data, this, index);
+}
+
+void HTMLSelectElement::setActiveSelectionEndIndex(int index)
+{
+    SelectElement::setActiveSelectionEndIndex(m_data, index);
 }
 
 void HTMLSelectElement::updateListBoxSelection(bool deselectOtherOptions)
 {
-    ASSERT(renderer() && renderer()->isListBox());
-    
-    unsigned start;
-    unsigned end;
-    ASSERT(m_activeSelectionAnchorIndex >= 0);
-    start = min(m_activeSelectionAnchorIndex, m_activeSelectionEndIndex);
-    end = max(m_activeSelectionAnchorIndex, m_activeSelectionEndIndex);
-
-    const Vector<HTMLElement*>& items = listItems();
-    for (unsigned i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(items[i]);
-            if (!option->disabled()) {
-                if (i >= start && i <= end)
-                    option->setSelectedState(m_activeSelectionState);
-                else if (deselectOtherOptions || i >= m_cachedStateForActiveSelection.size())
-                    option->setSelectedState(false);
-                else
-                    option->setSelectedState(m_cachedStateForActiveSelection[i]);
-            }
-        }
-    }
-
-    scrollToSelection();
+    SelectElement::updateListBoxSelection(m_data, this, deselectOtherOptions);
 }
 
 void HTMLSelectElement::menuListOnChange()
 {
-    ASSERT(usesMenuList());
-    int selected = selectedIndex();
-    if (m_lastOnChangeIndex != selected) {
-        m_lastOnChangeIndex = selected;
-        onChange();
-    }
+    SelectElement::menuListOnChange(m_data, this);
 }
 
 void HTMLSelectElement::listBoxOnChange()
 {
-    ASSERT(!usesMenuList());
-
-    const Vector<HTMLElement*>& items = listItems();
-    
-    // If the cached selection list is empty, or the size has changed, then fire onChange, and return early.
-    if (m_lastOnChangeSelection.isEmpty() || m_lastOnChangeSelection.size() != items.size()) {
-        onChange();
-        return;
-    }
-    
-    // Update m_lastOnChangeSelection and fire onChange
-    bool fireOnChange = false;
-    for (unsigned i = 0; i < items.size(); i++) {
-        bool selected = false;
-        if (items[i]->hasLocalName(optionTag))
-            selected = static_cast<HTMLOptionElement*>(items[i])->selected();
-        if (selected != m_lastOnChangeSelection[i])      
-            fireOnChange = true;
-        m_lastOnChangeSelection[i] = selected;
-    }
-    if (fireOnChange)
-        onChange();
+    SelectElement::listBoxOnChange(m_data, this);
 }
 
 void HTMLSelectElement::saveLastSelection()
 {
-    const Vector<HTMLElement*>& items = listItems();
-
-    if (usesMenuList()) {
-        m_lastOnChangeIndex = selectedIndex();
-        return;
-    }
-    
-    m_lastOnChangeSelection.clear();
-    for (unsigned i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(items[i]);
-            m_lastOnChangeSelection.append(option->selected());
-        } else
-            m_lastOnChangeSelection.append(false);
-    }
-}
-
-static String stripLeadingWhiteSpace(const String& string)
-{
-    int length = string.length();
-    int i;
-    for (i = 0; i < length; ++i)
-        if (string[i] != noBreakSpace &&
-            (string[i] <= 0x7F ? !isASCIISpace(string[i]) : (direction(string[i]) != WhiteSpaceNeutral)))
-            break;
-
-    return string.substring(i, length - i);
-}
-
-void HTMLSelectElement::typeAheadFind(KeyboardEvent* event)
-{
-    if (event->timeStamp() < m_lastCharTime)
-        return;
-
-    DOMTimeStamp delta = event->timeStamp() - m_lastCharTime;
-
-    m_lastCharTime = event->timeStamp();
-
-    UChar c = event->charCode();
-
-    String prefix;
-    int searchStartOffset = 1;
-    if (delta > typeAheadTimeout) {
-        m_typedString = prefix = String(&c, 1);
-        m_repeatingChar = c;
-    } else {
-        m_typedString.append(c);
-
-        if (c == m_repeatingChar)
-            // The user is likely trying to cycle through all the items starting with this character, so just search on the character
-            prefix = String(&c, 1);
-        else {
-            m_repeatingChar = 0;
-            prefix = m_typedString;
-            searchStartOffset = 0;
-        }
-    }
-
-    const Vector<HTMLElement*>& items = listItems();
-    int itemCount = items.size();
-    if (itemCount < 1)
-        return;
-
-    int selected = selectedIndex();
-    int index = (optionToListIndex(selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
-    ASSERT(index >= 0);
-    for (int i = 0; i < itemCount; i++, index = (index + 1) % itemCount) {
-        if (!items[index]->hasTagName(optionTag) || items[index]->disabled())
-            continue;
-
-        String text = static_cast<HTMLOptionElement*>(items[index])->textIndentedToRespectGroupLabel();
-        if (stripLeadingWhiteSpace(text).startsWith(prefix, false)) {
-            setSelectedIndex(listToOptionIndex(index));
-            if(!usesMenuList())
-                listBoxOnChange();
-            setChanged();
-            return;
-        }
-    }
-}
-
-int HTMLSelectElement::nextSelectableListIndex(int startIndex)
-{
-    const Vector<HTMLElement*>& items = listItems();
-    int index = startIndex + 1;
-    while (index >= 0 && (unsigned)index < items.size() && (!items[index]->hasLocalName(optionTag) || items[index]->disabled()))
-        index++;
-    if ((unsigned) index == items.size())
-        return startIndex;
-    return index;
-}
-
-int HTMLSelectElement::previousSelectableListIndex(int startIndex)
-{
-    const Vector<HTMLElement*>& items = listItems();
-    if (startIndex == -1)
-        startIndex = items.size();
-    int index = startIndex - 1;
-    while (index >= 0 && (unsigned)index < items.size() && (!items[index]->hasLocalName(optionTag) || items[index]->disabled()))
-        index--;
-    if (index == -1)
-        return startIndex;
-    return index;
+    SelectElement::saveLastSelection(m_data, this);
 }
 
 void HTMLSelectElement::accessKeyAction(bool sendToAnyElement)
@@ -992,23 +341,8 @@
 }
 
 void HTMLSelectElement::accessKeySetSelectedIndex(int index)
-{    
-    // first bring into focus the list box
-    if (!focused())
-        accessKeyAction(false);
-    
-    // if this index is already selected, unselect. otherwise update the selected index
-    Node* listNode = item(index);
-    if (listNode && listNode->hasTagName(optionTag)) {
-        HTMLOptionElement* listElement = static_cast<HTMLOptionElement*>(listNode);
-        if (listElement->selected())
-            listElement->setSelectedState(false);
-        else
-            setSelectedIndex(index, false, true);
-    }
-    
-    listBoxOnChange();
-    scrollToSelection();
+{
+    SelectElement::accessKeySetSelectedIndex(m_data, this, index);
 }
     
 void HTMLSelectElement::setMultiple(bool multiple)
@@ -1050,7 +384,7 @@
     if (!ec) {
         add(option, before, ec);
         if (diff >= 0 && option->selected())
-            setSelectedIndex(index, !m_multiple);
+            setSelectedIndex(index, !m_data.multiple());
     }
 }
 
@@ -1069,27 +403,29 @@
             if (ec)
                 break;
         } while (++diff);
+    } else {
+        const Vector<Element*>& items = listItems();
+
+        size_t optionIndex = 0;
+        for (size_t listIndex = 0; listIndex < items.size(); listIndex++) {
+            if (items[listIndex]->hasLocalName(optionTag) && optionIndex++ >= newLen) {
+                Element *item = items[listIndex];
+                ASSERT(item->parentNode());
+                item->parentNode()->removeChild(item, ec);
+            }
+        }
     }
-    else // remove elements
-        while (diff-- > 0)
-            remove(newLen);
 }
 
 void HTMLSelectElement::scrollToSelection()
 {
-    if (renderer() && !usesMenuList())
-        static_cast<RenderListBox*>(renderer())->selectionChanged();
+    SelectElement::scrollToSelection(m_data, this);
 }
 
-#ifndef NDEBUG
-
-void HTMLSelectElement::checkListItems() const
+void HTMLSelectElement::insertedIntoTree(bool deep)
 {
-    Vector<HTMLElement*> items = m_listItems;
-    recalcListItems(false);
-    ASSERT(items == m_listItems);
+    SelectElement::insertedIntoTree(m_data, this);
+    HTMLFormControlElementWithState::insertedIntoTree(deep);
 }
 
-#endif
-
 } // namespace
diff --git a/WebCore/html/HTMLSelectElement.h b/WebCore/html/HTMLSelectElement.h
index 59e4a4b..df7832c 100644
--- a/WebCore/html/HTMLSelectElement.h
+++ b/WebCore/html/HTMLSelectElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,10 +24,9 @@
 #ifndef HTMLSelectElement_h
 #define HTMLSelectElement_h
 
-#include "Event.h"
-#include "HTMLCollection.h"
+#include "CollectionCache.h"
 #include "HTMLFormControlElement.h"
-#include <wtf/Vector.h>
+#include "SelectElement.h"
 
 namespace WebCore {
 
@@ -35,77 +34,32 @@
 class HTMLOptionsCollection;
 class KeyboardEvent;
 
-class HTMLSelectElement : public HTMLFormControlElementWithState {
+class HTMLSelectElement : public HTMLFormControlElementWithState, public SelectElement {
 public:
     HTMLSelectElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
-    virtual int tagPriority() const { return 6; }
-    virtual bool checkDTD(const Node* newChild);
-
-    virtual const AtomicString& type() const;
-    
-    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
-    virtual bool isMouseFocusable() const;
-    virtual bool canSelectAll() const;
-    virtual void selectAll();
-
-    virtual void recalcStyle(StyleChange);
-
-    virtual void dispatchFocusEvent();
-    virtual void dispatchBlurEvent();
-    
-    virtual bool canStartSelection() const { return false; }
-
-    int selectedIndex() const;
-    void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false);
-    int lastSelectedListIndex() const;
-
-    virtual bool isEnumeratable() const { return true; }
+    virtual int selectedIndex() const;
+    virtual void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false);
 
     unsigned length() const;
 
-    int minWidth() const { return m_minwidth; }
-
-    int size() const { return m_size; }
-
-    bool multiple() const { return m_multiple; }
+    virtual int size() const { return m_data.size(); }
+    virtual bool multiple() const { return m_data.multiple(); }
 
     void add(HTMLElement* element, HTMLElement* before, ExceptionCode&);
     void remove(int index);
 
     String value();
     void setValue(const String&);
-    
-    PassRefPtr<HTMLOptionsCollection> options();
 
-    virtual bool saveState(String& value) const;
-    virtual void restoreState(const String&);
+    PassRefPtr<HTMLOptionsCollection> options();
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    virtual void parseMappedAttribute(MappedAttribute*);
-
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle *);
-    virtual bool appendFormData(FormDataList&, bool);
-
-    // get the actual listbox index of the optionIndexth option
-    int optionToListIndex(int optionIndex) const;
-    // reverse of optionToListIndex - get optionIndex from listboxIndex
-    int listToOptionIndex(int listIndex) const;
-
     void setRecalcListItems();
 
-    const Vector<HTMLElement*>& listItems() const
-    {
-        if (m_recalcListItems)
-            recalcListItems();
-        else
-            checkListItems();
-        return m_listItems;
-    }
-    virtual void reset();
+    virtual const Vector<Element*>& listItems() const { return m_data.listItems(this); }
 
-    virtual void defaultEventHandler(Event*);
     virtual void accessKeyAction(bool sendToAnyElement);
     void accessKeySetSelectedIndex(int);
 
@@ -119,65 +73,73 @@
     Node* namedItem(const AtomicString& name);
     Node* item(unsigned index);
 
-    HTMLCollection::CollectionInfo* collectionInfo() { return &m_collectionInfo; }
-    
-    void setActiveSelectionAnchorIndex(int index);
-    void setActiveSelectionEndIndex(int index) { m_activeSelectionEndIndex = index; }
-    void updateListBoxSelection(bool deselectOtherOptions);
-    void listBoxOnChange();
-    void menuListOnChange();
-    
-    int activeSelectionStartListIndex() const;
-    int activeSelectionEndListIndex() const;
-    
+    CollectionCache* collectionInfo() { return &m_collectionInfo; }
+
     void scrollToSelection();
 
 private:
+    virtual int tagPriority() const { return 6; }
+    virtual bool checkDTD(const Node* newChild);
+
+    virtual const AtomicString& formControlType() const;
+    
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
+    virtual bool isMouseFocusable() const;
+    virtual bool canSelectAll() const;
+    virtual void selectAll();
+
+    virtual void recalcStyle(StyleChange);
+
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
+    
+    virtual bool canStartSelection() const { return false; }
+
+    virtual bool isEnumeratable() const { return true; }
+
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
+
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle *);
+    virtual bool appendFormData(FormDataList&, bool);
+
+#if PLATFORM(ANDROID)
+public:
+    virtual int listToOptionIndex(int listIndex) const;
+    virtual int optionToListIndex(int optionIndex) const;
+private:
+#else
+    virtual int listToOptionIndex(int listIndex) const;
+    virtual int optionToListIndex(int optionIndex) const;
+#endif
+
+    virtual void reset();
+
+    virtual void defaultEventHandler(Event*);
+
+    virtual void setActiveSelectionAnchorIndex(int index);
+    virtual void setActiveSelectionEndIndex(int index);
+    virtual void updateListBoxSelection(bool deselectOtherOptions);
+    virtual void listBoxOnChange();
+    virtual void menuListOnChange();
+    
+    virtual int activeSelectionStartListIndex() const;
+    virtual int activeSelectionEndListIndex() const;
+    
     void recalcListItems(bool updateSelectedStates = true) const;
-    void checkListItems() const;
 
     void deselectItems(HTMLOptionElement* excludeElement = 0);
-#ifdef ANDROID_LISTBOX_USES_MENU_LIST
-    bool usesMenuList() const { return true; }
-#else
-    bool usesMenuList() const { return !m_multiple && m_size <= 1; }
-#endif
-    int nextSelectableListIndex(int startIndex);
-    int previousSelectableListIndex(int startIndex);
-    void menuListDefaultEventHandler(Event*);
-    void listBoxDefaultEventHandler(Event*);
     void typeAheadFind(KeyboardEvent*);
     void saveLastSelection();
 
-    mutable Vector<HTMLElement*> m_listItems;
-    Vector<bool> m_cachedStateForActiveSelection;
-    Vector<bool> m_lastOnChangeSelection;
-    int m_minwidth;
-    int m_size;
-    bool m_multiple;
-    mutable bool m_recalcListItems;
-    mutable int m_lastOnChangeIndex;
+    virtual void insertedIntoTree(bool);
 
-    int m_activeSelectionAnchorIndex;
-    int m_activeSelectionEndIndex;
-    bool m_activeSelectionState;
-
-    // Instance variables for type-ahead find
-    UChar m_repeatingChar;
-    DOMTimeStamp m_lastCharTime;
-    String m_typedString;
-
-    HTMLCollection::CollectionInfo m_collectionInfo;
+    SelectElementData m_data;
+    CollectionCache m_collectionInfo;
 };
 
-#ifdef NDEBUG
-
-inline void HTMLSelectElement::checkListItems() const
-{
-}
-
-#endif
-
 } // namespace
 
 #endif
diff --git a/WebCore/html/HTMLSelectElement.idl b/WebCore/html/HTMLSelectElement.idl
index d3e85a8..fb08bb1 100644
--- a/WebCore/html/HTMLSelectElement.idl
+++ b/WebCore/html/HTMLSelectElement.idl
@@ -33,7 +33,7 @@
                  attribute [ConvertNullToNullString] DOMString       value;
         
         // Modified in DOM Level 2:
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute long            length;
 #else
                  attribute unsigned long   length
@@ -56,7 +56,7 @@
                                in HTMLElement before)
             raises(DOMException);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // In JS, we support both options index and options object parameters - this cannot be autogenerated now.
         [Custom] void      remove(/* 1 */);
 #else
diff --git a/WebCore/html/HTMLSourceElement.cpp b/WebCore/html/HTMLSourceElement.cpp
index 609bcbf..2f09997 100644
--- a/WebCore/html/HTMLSourceElement.cpp
+++ b/WebCore/html/HTMLSourceElement.cpp
@@ -28,6 +28,7 @@
 #if ENABLE(VIDEO)
 #include "HTMLSourceElement.h"
 
+#include "EventNames.h"
 #include "HTMLDocument.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
@@ -40,6 +41,7 @@
 
 HTMLSourceElement::HTMLSourceElement(const QualifiedName& tagName, Document* doc)
     : HTMLElement(tagName, doc)
+    , m_errorEventTimer(this, &HTMLSourceElement::errorEventTimerFired)
 {
     ASSERT(hasTagName(sourceTag));
 }
@@ -88,5 +90,23 @@
     setAttribute(typeAttr, type);
 }
 
+void HTMLSourceElement::scheduleErrorEvent()
+{
+    if (m_errorEventTimer.isActive())
+        return;
+
+    m_errorEventTimer.startOneShot(0);
+}
+
+void HTMLSourceElement::cancelPendingErrorEvent()
+{
+    m_errorEventTimer.stop();
+}
+
+void HTMLSourceElement::errorEventTimerFired(Timer<HTMLSourceElement>*)
+{
+    dispatchEvent(eventNames().errorEvent, false, true);
+}
+
 }
 #endif
diff --git a/WebCore/html/HTMLSourceElement.h b/WebCore/html/HTMLSourceElement.h
index 9027b88..50d6687 100644
--- a/WebCore/html/HTMLSourceElement.h
+++ b/WebCore/html/HTMLSourceElement.h
@@ -29,6 +29,7 @@
 #if ENABLE(VIDEO)
 
 #include "HTMLElement.h"
+#include "Timer.h"
 #include <limits>
 
 namespace WebCore {
@@ -51,6 +52,14 @@
     void setSrc(const String&);    
     void setMedia(const String&);
     void setType(const String&);
+    
+    void scheduleErrorEvent();
+    void cancelPendingErrorEvent();
+
+private:
+    void errorEventTimerFired(Timer<HTMLSourceElement>*);
+
+    Timer<HTMLSourceElement> m_errorEventTimer;
 };
 
 } //namespace
diff --git a/WebCore/html/HTMLStyleElement.cpp b/WebCore/html/HTMLStyleElement.cpp
index bed1cdc..f6b5924 100644
--- a/WebCore/html/HTMLStyleElement.cpp
+++ b/WebCore/html/HTMLStyleElement.cpp
@@ -20,11 +20,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLStyleElement.h"
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/html/HTMLStyleElement.idl b/WebCore/html/HTMLStyleElement.idl
index e6238b7..a1b86f8 100644
--- a/WebCore/html/HTMLStyleElement.idl
+++ b/WebCore/html/HTMLStyleElement.idl
@@ -29,7 +29,7 @@
         attribute  [ConvertNullToNullString] DOMString            media;
         attribute  [ConvertNullToNullString] DOMString            type;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Style
         readonly attribute StyleSheet sheet;
 #endif
diff --git a/WebCore/html/HTMLTableCaptionElement.cpp b/WebCore/html/HTMLTableCaptionElement.cpp
index 35cf8a1..2c94727 100644
--- a/WebCore/html/HTMLTableCaptionElement.cpp
+++ b/WebCore/html/HTMLTableCaptionElement.cpp
@@ -21,11 +21,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTableCaptionElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/html/HTMLTableCellElement.cpp b/WebCore/html/HTMLTableCellElement.cpp
index 1313393..05f02c7 100644
--- a/WebCore/html/HTMLTableCellElement.cpp
+++ b/WebCore/html/HTMLTableCellElement.cpp
@@ -23,6 +23,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTableCellElement.h"
 
@@ -30,6 +31,7 @@
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
 #include "HTMLTableElement.h"
+#include "MappedAttribute.h"
 #include "RenderTableCell.h"
 #ifdef ANDROID_LAYOUT
 #include "Document.h"
diff --git a/WebCore/html/HTMLTableColElement.cpp b/WebCore/html/HTMLTableColElement.cpp
index 11f6df6..ae18ab1 100644
--- a/WebCore/html/HTMLTableColElement.cpp
+++ b/WebCore/html/HTMLTableColElement.cpp
@@ -23,13 +23,15 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTableColElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
-#include "RenderTableCol.h"
 #include "HTMLTableElement.h"
+#include "MappedAttribute.h"
+#include "RenderTableCol.h"
 #include "Text.h"
 
 namespace WebCore {
diff --git a/WebCore/html/HTMLTableElement.cpp b/WebCore/html/HTMLTableElement.cpp
index bb2c2ee..e37c171 100644
--- a/WebCore/html/HTMLTableElement.cpp
+++ b/WebCore/html/HTMLTableElement.cpp
@@ -31,9 +31,10 @@
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "HTMLTableCaptionElement.h"
-#include "HTMLTableRowsCollection.h"
 #include "HTMLTableRowElement.h"
+#include "HTMLTableRowsCollection.h"
 #include "HTMLTableSectionElement.h"
+#include "MappedAttribute.h"
 #include "RenderTable.h"
 #include "Text.h"
 
@@ -310,7 +311,7 @@
     }
 
     if (cellChanged)
-       n->setChanged();
+       n->setNeedsStyleRecalc();
 
     return cellChanged;
 }
@@ -455,7 +456,7 @@
         for (Node* child = firstChild(); child; child = child->nextSibling())
             cellChanged |= setTableCellsChanged(child);
         if (cellChanged)
-            setChanged();
+            setNeedsStyleRecalc();
     }
 }
 
@@ -655,7 +656,7 @@
 
 PassRefPtr<HTMLCollection> HTMLTableElement::tBodies()
 {
-    return HTMLCollection::create(this, HTMLCollection::TableTBodies);
+    return HTMLCollection::create(this, TableTBodies);
 }
 
 String HTMLTableElement::align() const
diff --git a/WebCore/html/HTMLTablePartElement.cpp b/WebCore/html/HTMLTablePartElement.cpp
index 6341197..19babf6 100644
--- a/WebCore/html/HTMLTablePartElement.cpp
+++ b/WebCore/html/HTMLTablePartElement.cpp
@@ -23,6 +23,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTablePartElement.h"
 
@@ -31,6 +32,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/html/HTMLTableRowElement.cpp b/WebCore/html/HTMLTableRowElement.cpp
index 98d928a..94be02e 100644
--- a/WebCore/html/HTMLTableRowElement.cpp
+++ b/WebCore/html/HTMLTableRowElement.cpp
@@ -168,7 +168,7 @@
 
 PassRefPtr<HTMLCollection> HTMLTableRowElement::cells()
 {
-    return HTMLCollection::create(this, HTMLCollection::TRCells);
+    return HTMLCollection::create(this, TRCells);
 }
 
 void HTMLTableRowElement::setCells(HTMLCollection *, ExceptionCode& ec)
diff --git a/WebCore/html/HTMLTableRowsCollection.cpp b/WebCore/html/HTMLTableRowsCollection.cpp
index 7047576..b38c271 100644
--- a/WebCore/html/HTMLTableRowsCollection.cpp
+++ b/WebCore/html/HTMLTableRowsCollection.cpp
@@ -149,7 +149,7 @@
 }
 
 HTMLTableRowsCollection::HTMLTableRowsCollection(PassRefPtr<HTMLTableElement> table)
-    : HTMLCollection(table, Other, 0)
+    : HTMLCollection(table, OtherCollection, 0)
 {
 }
 
diff --git a/WebCore/html/HTMLTableSectionElement.cpp b/WebCore/html/HTMLTableSectionElement.cpp
index 900976c..e91a96a 100644
--- a/WebCore/html/HTMLTableSectionElement.cpp
+++ b/WebCore/html/HTMLTableSectionElement.cpp
@@ -167,7 +167,7 @@
 
 PassRefPtr<HTMLCollection> HTMLTableSectionElement::rows()
 {
-    return HTMLCollection::create(this, HTMLCollection::TSectionRows);
+    return HTMLCollection::create(this, TSectionRows);
 }
 
 }
diff --git a/WebCore/html/HTMLTagNames.in b/WebCore/html/HTMLTagNames.in
index 8b1fa2b..14119ef 100644
--- a/WebCore/html/HTMLTagNames.in
+++ b/WebCore/html/HTMLTagNames.in
@@ -8,9 +8,7 @@
 address interfaceName=HTMLElement
 applet
 area
-#if ENABLE_VIDEO
-audio wrapperOnlyIfMediaIsAvailable
-#endif
+audio wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
 b interfaceName=HTMLElement
 base
 basefont interfaceName=HTMLBaseFontElement
@@ -39,7 +37,7 @@
 fieldset interfaceName=HTMLFieldSetElement, constructorNeedsFormElement
 font
 form
-frame constructorNeedsCreatedByParser
+frame
 frameset interfaceName=HTMLFrameSetElement
 head
 h1 interfaceName=HTMLHeadingElement
@@ -51,7 +49,7 @@
 hr interfaceName=HTMLHRElement
 html
 i interfaceName=HTMLElement
-iframe interfaceName=HTMLIFrameElement, constructorNeedsCreatedByParser
+iframe interfaceName=HTMLIFrameElement
 image mapToTagName=img
 img interfaceName=HTMLImageElement, constructorNeedsFormElement
 input constructorNeedsFormElement
@@ -73,7 +71,11 @@
 noembed interfaceName=HTMLElement
 noframes interfaceName=HTMLElement
 nolayer interfaceName=HTMLElement
+#if ENABLE_XHTMLMP
+noscript interfaceName=HTMLNoScriptElement
+#else
 noscript interfaceName=HTMLElement
+#endif
 object constructorNeedsCreatedByParser
 ol interfaceName=HTMLOListElement
 optgroup interfaceName=HTMLOptGroupElement, constructorNeedsFormElement
@@ -88,9 +90,7 @@
 script constructorNeedsCreatedByParser
 select constructorNeedsFormElement
 small interfaceName=HTMLElement
-#if ENABLE_VIDEO
-source wrapperOnlyIfMediaIsAvailable
-#endif
+source wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
 span interfaceName=HTMLElement
 strike interfaceName=HTMLElement
 strong interfaceName=HTMLElement
@@ -110,8 +110,6 @@
 u interfaceName=HTMLElement
 ul interfaceName=HTMLUListElement
 var interfaceName=HTMLElement
-#if ENABLE_VIDEO
-video wrapperOnlyIfMediaIsAvailable
-#endif
+video wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
 wbr interfaceName=HTMLElement
 xmp interfaceName=HTMLPreElement
diff --git a/WebCore/html/HTMLTextAreaElement.cpp b/WebCore/html/HTMLTextAreaElement.cpp
index 4eec088..41a0126 100644
--- a/WebCore/html/HTMLTextAreaElement.cpp
+++ b/WebCore/html/HTMLTextAreaElement.cpp
@@ -34,11 +34,13 @@
 #include "FormDataList.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderStyle.h"
 #include "RenderTextControlMultiLine.h"
-#include "VisibleSelection.h"
+#include "ScriptEventListener.h"
 #include "Text.h"
+#include "VisibleSelection.h"
 #include <wtf/StdLibExtras.h>
 
 #ifdef ANDROID_ACCEPT_CHANGES_TO_FOCUSED_TEXTFIELDS
@@ -69,23 +71,23 @@
     , m_cachedSelectionEnd(-1)
 {
     ASSERT(hasTagName(textareaTag));
-    setValueMatchesRenderer();
+    setFormControlValueMatchesRenderer(true);
     notifyFormStateChanged(this);
 }
 
-const AtomicString& HTMLTextAreaElement::type() const
+const AtomicString& HTMLTextAreaElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, textarea, ("textarea"));
     return textarea;
 }
 
-bool HTMLTextAreaElement::saveState(String& result) const
+bool HTMLTextAreaElement::saveFormControlState(String& result) const
 {
     result = value();
     return true;
 }
 
-void HTMLTextAreaElement::restoreState(const String& state)
+void HTMLTextAreaElement::restoreFormControlState(const String& state)
 {
     setDefaultValue(state);
 }
@@ -183,13 +185,13 @@
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=7075
     } else if (attr->name() == onfocusAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onblurAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onselectAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().selectEvent, attr);
+        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onchangeAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().changeEvent, attr);
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     else
         HTMLFormControlElementWithState::parseMappedAttribute(attr);
 }
@@ -268,12 +270,12 @@
 
 void HTMLTextAreaElement::updateValue() const
 {
-    if (valueMatchesRenderer())
+    if (formControlValueMatchesRenderer())
         return;
 
     ASSERT(renderer());
     m_value = toRenderTextControl(renderer())->text();
-    const_cast<HTMLTextAreaElement*>(this)->setValueMatchesRenderer();
+    const_cast<HTMLTextAreaElement*>(this)->setFormControlValueMatchesRenderer(true);
     notifyFormStateChanged(this);
 }
 
@@ -297,9 +299,9 @@
         return;
 
     m_value = normalizedValue;
-    setValueMatchesRenderer();
+    setFormControlValueMatchesRenderer(true);
     if (inDocument())
-        document()->updateRendering();
+        document()->updateStyleIfNeeded();
     if (renderer())
         renderer()->updateFromElement();
 
@@ -313,7 +315,7 @@
         setSelectionRange(endOfString, endOfString);
     }
 
-    setChanged();
+    setNeedsStyleRecalc();
     notifyFormStateChanged(this);
 }
 
diff --git a/WebCore/html/HTMLTextAreaElement.h b/WebCore/html/HTMLTextAreaElement.h
index f78386c..e22b5d5 100644
--- a/WebCore/html/HTMLTextAreaElement.h
+++ b/WebCore/html/HTMLTextAreaElement.h
@@ -43,14 +43,14 @@
 
     virtual bool isEnumeratable() const { return true; }
 
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
 
-    virtual bool saveState(String& value) const;
-    virtual void restoreState(const String&);
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
 
-    bool readOnly() const { return isReadOnlyControl(); }
+    bool readOnly() const { return isReadOnlyFormControl(); }
 
-    virtual bool isTextControl() const { return true; }
+    virtual bool isTextFormControl() const { return true; }
 
     int selectionStart();
     int selectionEnd();
diff --git a/WebCore/html/HTMLTokenizer.cpp b/WebCore/html/HTMLTokenizer.cpp
index e4952f7..25e9adf 100644
--- a/WebCore/html/HTMLTokenizer.cpp
+++ b/WebCore/html/HTMLTokenizer.cpp
@@ -7,6 +7,7 @@
               (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
     Copyright (C) 2005, 2006 Alexey Proskuryakov (ap@nypop.com)
+    Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -40,6 +41,7 @@
 #include "HTMLParser.h"
 #include "HTMLScriptElement.h"
 #include "HTMLViewSourceDocument.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "PreloadScanner.h"
 #include "ScriptController.h"
@@ -449,6 +451,10 @@
         } else {
             // Parse m_scriptCode containing <script> info
             doScriptExec = m_scriptNode->shouldExecuteAsJavaScript();
+#if ENABLE(XHTMLMP)
+            if (!doScriptExec)
+                m_doc->setShouldProcessNoscriptElement(true);
+#endif
             m_scriptNode = 0;
         }
     }
@@ -1884,7 +1890,7 @@
     ScriptController* scriptController = (!m_fragment && m_doc->frame()) ? m_doc->frame()->script() : 0;
     if (scriptController && scriptController->isEnabled())
         // FIXME: Why isn't this m_currentScriptTagStartLineNumber?  I suspect this is wrong.
-        scriptController->setEventHandlerLineno(m_currentTagStartLineNumber + 1); // Script line numbers are 1 based.
+        scriptController->setEventHandlerLineNumber(m_currentTagStartLineNumber + 1); // Script line numbers are 1 based.
     if (m_dest > m_buffer) {
         m_currentToken.text = StringImpl::createStrippingNullCharacters(m_buffer, m_dest - m_buffer);
         if (m_currentToken.tagName != commentAtom)
@@ -1892,7 +1898,7 @@
     } else if (m_currentToken.tagName == nullAtom) {
         m_currentToken.reset();
         if (scriptController)
-            scriptController->setEventHandlerLineno(m_lineNumber + 1); // Script line numbers are 1 based.
+            scriptController->setEventHandlerLineNumber(m_lineNumber + 1); // Script line numbers are 1 based.
         return 0;
     }
 
@@ -1911,7 +1917,7 @@
     }
     m_currentToken.reset();
     if (scriptController)
-        scriptController->setEventHandlerLineno(0);
+        scriptController->setEventHandlerLineNumber(0);
 
     return n.release();
 }
@@ -1933,7 +1939,16 @@
 
 void HTMLTokenizer::enlargeBuffer(int len)
 {
-    int newSize = max(m_bufferSize * 2, m_bufferSize + len);
+    // Resize policy: Always at least double the size of the buffer each time.
+    int delta = max(len, m_bufferSize);
+
+    // Check for overflow.
+    // For now, handle overflow the same way we handle fastRealloc failure, with CRASH.
+    static const int maxSize = INT_MAX / sizeof(UChar);
+    if (delta > maxSize - m_bufferSize)
+        CRASH();
+
+    int newSize = m_bufferSize + delta;
     int oldOffset = m_dest - m_buffer;
     m_buffer = static_cast<UChar*>(fastRealloc(m_buffer, newSize * sizeof(UChar)));
     m_dest = m_buffer + oldOffset;
@@ -1942,7 +1957,16 @@
 
 void HTMLTokenizer::enlargeScriptBuffer(int len)
 {
-    int newSize = max(m_scriptCodeCapacity * 2, m_scriptCodeCapacity + len);
+    // Resize policy: Always at least double the size of the buffer each time.
+    int delta = max(len, m_scriptCodeCapacity);
+
+    // Check for overflow.
+    // For now, handle overflow the same way we handle fastRealloc failure, with CRASH.
+    static const int maxSize = INT_MAX / sizeof(UChar);
+    if (delta > maxSize - m_scriptCodeCapacity)
+        CRASH();
+
+    int newSize = m_scriptCodeCapacity + delta;
     m_scriptCode = static_cast<UChar*>(fastRealloc(m_scriptCode, newSize * sizeof(UChar)));
     m_scriptCodeCapacity = newSize;
 }
@@ -1992,11 +2016,15 @@
 #endif
 
         if (errorOccurred)
-            n->dispatchEventForType(eventNames().errorEvent, true, false);
+            n->dispatchEvent(eventNames().errorEvent, true, false);
         else {
             if (static_cast<HTMLScriptElement*>(n.get())->shouldExecuteAsJavaScript())
                 m_state = scriptExecution(sourceCode, m_state);
-            n->dispatchEventForType(eventNames().loadEvent, false, false);
+#if ENABLE(XHTMLMP)
+            else
+                m_doc->setShouldProcessNoscriptElement(true);
+#endif
+            n->dispatchEvent(eventNames().loadEvent, false, false);
         }
 
         // The state of m_pendingScripts.isEmpty() can change inside the scriptExecution()
diff --git a/WebCore/html/HTMLUListElement.cpp b/WebCore/html/HTMLUListElement.cpp
index c1a7644..f36cb57 100644
--- a/WebCore/html/HTMLUListElement.cpp
+++ b/WebCore/html/HTMLUListElement.cpp
@@ -18,11 +18,13 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLUListElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/html/HTMLVideoElement.cpp b/WebCore/html/HTMLVideoElement.cpp
index b0aac3c..d465b73 100644
--- a/WebCore/html/HTMLVideoElement.cpp
+++ b/WebCore/html/HTMLVideoElement.cpp
@@ -33,6 +33,7 @@
 #include "Document.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
 #include "RenderVideo.h"
 
diff --git a/WebCore/html/HTMLViewSourceDocument.cpp b/WebCore/html/HTMLViewSourceDocument.cpp
index 596f16e..d4d6df7 100644
--- a/WebCore/html/HTMLViewSourceDocument.cpp
+++ b/WebCore/html/HTMLViewSourceDocument.cpp
@@ -26,18 +26,19 @@
 #include "HTMLViewSourceDocument.h"
 
 #include "DOMImplementation.h"
-#include "HTMLTokenizer.h"
-#include "HTMLHtmlElement.h"
 #include "HTMLAnchorElement.h"
 #include "HTMLBodyElement.h"
 #include "HTMLDivElement.h"
-#include "HTMLTableElement.h"
+#include "HTMLHtmlElement.h"
+#include "HTMLNames.h"
 #include "HTMLTableCellElement.h"
+#include "HTMLTableElement.h"
 #include "HTMLTableRowElement.h"
 #include "HTMLTableSectionElement.h"
+#include "HTMLTokenizer.h"
+#include "MappedAttribute.h"
 #include "Text.h"
 #include "TextDocument.h"
-#include "HTMLNames.h"
 
 namespace WebCore {
 
@@ -150,6 +151,17 @@
                                 m_current = static_cast<Element*>(m_current->parent());
                         } else {
                             const String& value = attr->value().string();
+
+                            // Compare ignoring case since HTMLTokenizer doesn't
+                            // lower names when passing in tokens to
+                            // HTMLViewSourceDocument.
+                            if (equalIgnoringCase(token->tagName, "base") && equalIgnoringCase(attr->name().localName(), "href")) {
+                                // Catch the href attribute in the base element.
+                                // It will be used for rendering anchors created
+                                // by addLink() below.
+                                setBaseElementURL(KURL(url(), value));
+                            }
+
                             // FIXME: XML could use namespace prefixes and confuse us.
                             if (equalIgnoringCase(attr->name().localName(), "src") || equalIgnoringCase(attr->name().localName(), "href"))
                                 m_current = addLink(value, equalIgnoringCase(token->tagName, "a"));
diff --git a/WebCore/html/ImageData.idl b/WebCore/html/ImageData.idl
index 9be14ff..7f37b52 100644
--- a/WebCore/html/ImageData.idl
+++ b/WebCore/html/ImageData.idl
@@ -34,7 +34,7 @@
     ] ImageData {
         readonly attribute long width;
         readonly attribute long height;
-#if !defined(LANGUAGE_JAVASCRIPT) || defined(V8_BINDING)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT || defined(V8_BINDING) && V8_BINDING
         readonly attribute CanvasPixelArray data;
 #endif
     };
diff --git a/WebCore/html/MediaError.h b/WebCore/html/MediaError.h
index 7dcf72a..5e77d9e 100644
--- a/WebCore/html/MediaError.h
+++ b/WebCore/html/MediaError.h
@@ -34,7 +34,7 @@
 
 class MediaError : public RefCounted<MediaError> {
 public:
-    enum Code { MEDIA_ERR_ABORTED = 1, MEDIA_ERR_NETWORK, MEDIA_ERR_DECODE, MEDIA_ERR_NONE_SUPPORTED };
+    enum Code { MEDIA_ERR_ABORTED = 1, MEDIA_ERR_NETWORK, MEDIA_ERR_DECODE, MEDIA_ERR_SRC_NOT_SUPPORTED };
 
     static PassRefPtr<MediaError> create(Code code) { return adoptRef(new MediaError(code)); }
 
diff --git a/WebCore/html/MediaError.idl b/WebCore/html/MediaError.idl
index 162170f..4dcea7d 100644
--- a/WebCore/html/MediaError.idl
+++ b/WebCore/html/MediaError.idl
@@ -28,7 +28,7 @@
           const unsigned short MEDIA_ERR_ABORTED = 1;
           const unsigned short MEDIA_ERR_NETWORK = 2;
           const unsigned short MEDIA_ERR_DECODE = 3;
-          const unsigned short MEDIA_ERR_NONE_SUPPORTED = 4;
+          const unsigned short MEDIA_ERR_SRC_NOT_SUPPORTED = 4;
           readonly attribute unsigned short code;
     };
 }
diff --git a/WebCore/html/PreloadScanner.cpp b/WebCore/html/PreloadScanner.cpp
index 782e9bd..1c1d28a 100644
--- a/WebCore/html/PreloadScanner.cpp
+++ b/WebCore/html/PreloadScanner.cpp
@@ -44,7 +44,8 @@
 #include <wtf/CurrentTime.h>
 #include <wtf/unicode/Unicode.h>
 
-#if COMPILER(GCC)
+// Use __GNUC__ instead of PLATFORM(GCC) to stay consistent with the gperf generated c file
+#ifdef __GNUC__
 // The main tokenizer includes this too so we are getting two copies of the data. However, this way the code gets inlined.
 #include "HTMLEntityNames.c"
 #else
@@ -225,8 +226,8 @@
             else if (cc >= 'A' && cc <= 'F')
                 result = 10 + cc - 'A';
             else {
-                source.push(seenChars[1]);
                 source.push('#');
+                source.push(seenChars[1]);
                 return 0;
             }
             entityState = Hex;
@@ -280,8 +281,8 @@
             if (seenChars.size() == 2)
                 source.push(seenChars[0]);
             else if (seenChars.size() == 3) {
-                source.push(seenChars[1]);
                 source.push(seenChars[0]);
+                source.push(seenChars[1]);
             } else
                 source.prepend(SegmentedString(String(seenChars.data(), seenChars.size() - 1)));
             return 0;
diff --git a/WebCore/html/TimeRanges.cpp b/WebCore/html/TimeRanges.cpp
index ad81ac8..e5b070d 100644
--- a/WebCore/html/TimeRanges.cpp
+++ b/WebCore/html/TimeRanges.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +34,17 @@
     add(start, end);
 }
 
+PassRefPtr<TimeRanges> TimeRanges::copy()
+{
+    RefPtr<TimeRanges> newSession = TimeRanges::create();
+    
+    unsigned size = m_ranges.size();
+    for (unsigned i = 0; i < size; i++)
+        newSession->add(m_ranges[i].m_start, m_ranges[i].m_end);
+    
+    return newSession.release();
+}
+
 float TimeRanges::start(unsigned index, ExceptionCode& ec) const 
 { 
     if (index >= length()) {
@@ -53,9 +64,46 @@
 }
 
 void TimeRanges::add(float start, float end) 
-{ 
-    m_ranges.append(Range(start, end));
-    // FIXME normalize
+{
+    ASSERT(start <= end);
+    unsigned int overlappingArcIndex;
+    Range addedRange(start, end);
+
+    // For each present range check if we need to:
+    // - merge with the added range, in case we are overlapping or contiguous
+    // - Need to insert in place, we we are completely, not overlapping and not contiguous
+    // in between two ranges.
+    //
+    // TODO: Given that we assume that ranges are correctly ordered, this could be optimized.
+
+    for (overlappingArcIndex = 0; overlappingArcIndex < m_ranges.size(); overlappingArcIndex++) {
+        if (addedRange.isOverlappingRange(m_ranges[overlappingArcIndex])
+         || addedRange.isContiguousWithRange(m_ranges[overlappingArcIndex])) {
+            // We need to merge the addedRange and that range.
+            addedRange = addedRange.unionWithOverlappingOrContiguousRange(m_ranges[overlappingArcIndex]);
+            m_ranges.remove(overlappingArcIndex);
+            overlappingArcIndex--;
+        } else {
+            // Check the case for which there is no more to do
+            if (!overlappingArcIndex) {
+                if (addedRange.isBeforeRange(m_ranges[0])) {
+                    // First index, and we are completely before that range (and not contiguous, nor overlapping).
+                    // We just need to be inserted here.
+                    break;
+                }
+            } else {
+                if (m_ranges[overlappingArcIndex - 1].isBeforeRange(addedRange)
+                 && addedRange.isBeforeRange(m_ranges[overlappingArcIndex])) {
+                    // We are exactly after the current previous range, and before the current range, while
+                    // not overlapping with none of them. Insert here.
+                    break;
+                }
+            }
+        }
+    }
+
+    // Now that we are sure we don't overlap with any range, just add it.
+    m_ranges.insert(overlappingArcIndex, addedRange);
 }
 
 bool TimeRanges::contain(float time) const
diff --git a/WebCore/html/TimeRanges.h b/WebCore/html/TimeRanges.h
index eb54f6b..37820dc 100644
--- a/WebCore/html/TimeRanges.h
+++ b/WebCore/html/TimeRanges.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,8 @@
 #define TimeRanges_h
 
 #include "ExceptionCode.h"
+
+#include <algorithm>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
@@ -44,6 +46,8 @@
         return adoptRef(new TimeRanges(start, end));
     }
 
+    PassRefPtr<TimeRanges> copy();
+
     unsigned length() const { return m_ranges.size(); }
     float start(unsigned index, ExceptionCode&) const;
     float end(unsigned index, ExceptionCode&) const;
@@ -55,7 +59,9 @@
 private:
     TimeRanges() { }
     TimeRanges(float start, float end);
-    
+    TimeRanges(const TimeRanges&);
+
+    // We consider all the Ranges to be semi-bounded as follow: [start, end[
     struct Range {
         Range() { }
         Range(float start, float end) {
@@ -64,6 +70,36 @@
         }
         float m_start;
         float m_end;
+
+        inline bool isPointInRange(float point) const
+        {
+            return m_start <= point && point < m_end;
+        }
+        
+        inline bool isOverlappingRange(const Range& range) const
+        {
+            return isPointInRange(range.m_start) || isPointInRange(range.m_end) || range.isPointInRange(m_start);
+        }
+
+        inline bool isContiguousWithRange(const Range& range) const
+        {
+            return range.m_start == m_end || range.m_end == m_start;
+        }
+        
+        inline Range unionWithOverlappingOrContiguousRange(const Range& range) const
+        {
+            Range ret;
+
+            ret.m_start = std::min(m_start, range.m_start);
+            ret.m_end = std::max(m_end, range.m_end);
+
+            return ret;
+        }
+
+        inline bool isBeforeRange(const Range& range) const
+        {
+            return range.m_start >= m_end;
+        }
     };
     
     Vector<Range> m_ranges;
diff --git a/WebCore/inspector/ConsoleMessage.cpp b/WebCore/inspector/ConsoleMessage.cpp
index b2bf390..62a9ab7 100644
--- a/WebCore/inspector/ConsoleMessage.cpp
+++ b/WebCore/inspector/ConsoleMessage.cpp
@@ -31,12 +31,10 @@
 #include "config.h"
 #include "ConsoleMessage.h"
 
-#include "JSInspectedObjectWrapper.h"
+#include "InspectorFrontend.h"
+#include "JSONObject.h"
 #include "ScriptCallStack.h"
-#include "ScriptCallFrame.h"
-#include "ScriptFunctionCall.h"
 #include "ScriptObjectQuarantine.h"
-#include "ScriptString.h"
 
 namespace WebCore {
 
@@ -75,33 +73,16 @@
         m_wrappedArguments[i] = quarantineValue(callStack->state(), lastCaller.argumentAt(i));
 }
 
-void ConsoleMessage::addToConsole(ScriptState* scriptState, const ScriptObject& webInspector)
+void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
 {
-    ScriptFunctionCall messageConstructor(scriptState, webInspector, "ConsoleMessage");
-    messageConstructor.appendArgument(static_cast<unsigned int>(m_source));
-    messageConstructor.appendArgument(static_cast<unsigned int>(m_level));
-    messageConstructor.appendArgument(m_line);
-    messageConstructor.appendArgument(m_url);
-    messageConstructor.appendArgument(m_groupLevel);
-    messageConstructor.appendArgument(m_repeatCount);
-
-    if (!m_frames.isEmpty()) {
-        for (unsigned i = 0; i < m_frames.size(); ++i)
-            messageConstructor.appendArgument(m_frames[i]);
-    } else if (!m_wrappedArguments.isEmpty()) {
-        for (unsigned i = 0; i < m_wrappedArguments.size(); ++i)
-            messageConstructor.appendArgument(m_wrappedArguments[i]);
-    } else
-        messageConstructor.appendArgument(m_message);
-
-    bool hadException = false;
-    ScriptObject message = messageConstructor.construct(hadException);
-    if (hadException)
-        return;
-
-    ScriptFunctionCall addMessageToConsole(scriptState, webInspector, "addMessageToConsole");
-    addMessageToConsole.appendArgument(message);
-    addMessageToConsole.call(hadException);
+    JSONObject jsonObj = frontend->newJSONObject();
+    jsonObj.set("source", static_cast<int>(m_source));
+    jsonObj.set("level", static_cast<int>(m_level));
+    jsonObj.set("line", static_cast<int>(m_line));
+    jsonObj.set("url", m_url);
+    jsonObj.set("groupLevel", static_cast<int>(m_groupLevel));
+    jsonObj.set("repeatCount", static_cast<int>(m_repeatCount));
+    frontend->addMessageToConsole(jsonObj, m_frames, m_wrappedArguments,  m_message);
 }
 
 bool ConsoleMessage::isEqual(ScriptState* state, ConsoleMessage* msg) const
diff --git a/WebCore/inspector/ConsoleMessage.h b/WebCore/inspector/ConsoleMessage.h
index d97cbb3..15e6e7e 100644
--- a/WebCore/inspector/ConsoleMessage.h
+++ b/WebCore/inspector/ConsoleMessage.h
@@ -35,11 +35,10 @@
 #include "ScriptObject.h"
 #include "ScriptState.h"
 
-#include <runtime/Protect.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
-
+    class InspectorFrontend;
     class ScriptCallStack;
     class ScriptString;
 
@@ -48,7 +47,7 @@
         ConsoleMessage(MessageSource, MessageLevel, const String& m, unsigned li, const String& u, unsigned g);        
         ConsoleMessage(MessageSource, MessageLevel, ScriptCallStack*, unsigned g, bool storeTrace = false);
 
-        void addToConsole(ScriptState*, const ScriptObject& webInspector);
+        void addToConsole(InspectorFrontend* frontend);
         void incrementCount() { ++m_repeatCount; };
         bool isEqual(ScriptState*, ConsoleMessage* msg) const;
 
diff --git a/WebCore/inspector/InspectorController.cpp b/WebCore/inspector/InspectorController.cpp
index ae50769..170c4e3 100644
--- a/WebCore/inspector/InspectorController.cpp
+++ b/WebCore/inspector/InspectorController.cpp
@@ -34,8 +34,6 @@
 #include "CachedResource.h"
 #include "Console.h"
 #include "ConsoleMessage.h"
-#include "DOMWindow.h"
-#include "DocLoader.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -50,15 +48,10 @@
 #include "HTMLFrameOwnerElement.h"
 #include "HitTestResult.h"
 #include "InspectorClient.h"
+#include "InspectorFrontend.h"
 #include "InspectorDatabaseResource.h"
 #include "InspectorDOMStorageResource.h"
 #include "InspectorResource.h"
-#include "JSDOMWindow.h"
-#include "JSInspectedObjectWrapper.h"
-#include "JSInspectorCallbackWrapper.h"
-#include "JSInspectorController.h"
-#include "JSNode.h"
-#include "JSRange.h"
 #include "JavaScriptProfile.h"
 #include "Page.h"
 #include "Range.h"
@@ -66,110 +59,46 @@
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "ScriptCallStack.h"
-#include "ScriptController.h"
+#include "ScriptObject.h"
+#include "ScriptString.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "SharedBuffer.h"
 #include "TextEncoding.h"
 #include "TextIterator.h"
-#include <JavaScriptCore/APICast.h>
-#include <JavaScriptCore/JSRetainPtr.h>
-#include <JavaScriptCore/JSStringRef.h>
-#include <JavaScriptCore/OpaqueJSString.h>
-#include <profiler/Profile.h>
-#include <profiler/Profiler.h>
-#include <runtime/CollectorHeapIterator.h>
-#include <runtime/JSLock.h>
-#include <runtime/UString.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/RefCounted.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(DATABASE)
 #include "Database.h"
-#include "JSDatabase.h"
 #endif
 
 #if ENABLE(DOM_STORAGE)
 #include "Storage.h"
 #include "StorageArea.h"
-#include "JSStorage.h"
 #endif
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
 #include "JavaScriptDebugServer.h"
 #include "JSJavaScriptCallFrame.h"
-#endif
+
+#include <profiler/Profile.h>
+#include <profiler/Profiler.h>
+#include <runtime/JSLock.h>
+#include <runtime/UString.h>
 
 using namespace JSC;
+#endif
 using namespace std;
 
 namespace WebCore {
 
 static const char* const UserInitiatedProfileName = "org.webkit.profiles.user-initiated";
-
-static JSRetainPtr<JSStringRef> jsStringRef(const char* str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithUTF8CString(str));
-}
-
-static JSRetainPtr<JSStringRef> jsStringRef(const SourceCode& str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithCharacters(str.data(), str.length()));
-}
-
-static JSRetainPtr<JSStringRef> jsStringRef(const String& str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithCharacters(str.characters(), str.length()));
-}
-
-static JSRetainPtr<JSStringRef> jsStringRef(const UString& str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, OpaqueJSString::create(str).releaseRef());
-}
-
-static String toString(JSContextRef context, JSValueRef value, JSValueRef* exception)
-{
-    ASSERT_ARG(value, value);
-    if (!value)
-        return String();
-    JSRetainPtr<JSStringRef> scriptString(Adopt, JSValueToStringCopy(context, value, exception));
-    if (exception && *exception)
-        return String();
-    return String(JSStringGetCharactersPtr(scriptString.get()), JSStringGetLength(scriptString.get()));
-}
-
-#define HANDLE_EXCEPTION(context, exception) handleException((context), (exception), __LINE__)
-
-JSValueRef InspectorController::callSimpleFunction(JSContextRef context, JSObjectRef thisObject, const char* functionName) const
-{
-    JSValueRef exception = 0;
-    return callFunction(context, thisObject, functionName, 0, 0, exception);
-}
-
-JSValueRef InspectorController::callFunction(JSContextRef context, JSObjectRef thisObject, const char* functionName, size_t argumentCount, const JSValueRef arguments[], JSValueRef& exception) const
-{
-    ASSERT_ARG(context, context);
-    ASSERT_ARG(thisObject, thisObject);
-
-    if (exception)
-        return JSValueMakeUndefined(context);
-
-    JSValueRef functionProperty = JSObjectGetProperty(context, thisObject, jsStringRef(functionName).get(), &exception);
-    if (HANDLE_EXCEPTION(context, exception))
-        return JSValueMakeUndefined(context);
-
-    JSObjectRef function = JSValueToObject(context, functionProperty, &exception);
-    if (HANDLE_EXCEPTION(context, exception))
-        return JSValueMakeUndefined(context);
-
-    JSValueRef result = JSObjectCallAsFunction(context, function, thisObject, argumentCount, arguments, &exception);
-    if (HANDLE_EXCEPTION(context, exception))
-        return JSValueMakeUndefined(context);
-
-    return result;
-}
+static const char* const resourceTrackingEnabledSettingName = "resourceTrackingEnabled";
+static const char* const debuggerEnabledSettingName = "debuggerEnabled";
+static const char* const profilerEnabledSettingName = "profilerEnabled";
 
 bool InspectorController::addSourceToFrame(const String& mimeType, const String& source, Node* frameNode)
 {
@@ -237,24 +166,24 @@
     : m_inspectedPage(page)
     , m_client(client)
     , m_page(0)
-    , m_scriptObject(0)
-    , m_controllerScriptObject(0)
-    , m_scriptContext(0)
+    , m_scriptState(0)
     , m_windowVisible(false)
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    , m_debuggerEnabled(false)
-    , m_attachDebuggerWhenShown(false)
-#endif
-    , m_profilerEnabled(false)
-    , m_recordingUserInitiatedProfile(false)
     , m_showAfterVisible(ElementsPanel)
     , m_nextIdentifier(-2)
     , m_groupLevel(0)
     , m_searchingForNode(false)
+    , m_previousMessage(0)
+    , m_resourceTrackingEnabled(false)
+    , m_resourceTrackingSettingsLoaded(false)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    , m_debuggerEnabled(false)
+    , m_attachDebuggerWhenShown(false)
+    , m_profilerEnabled(false)
+    , m_recordingUserInitiatedProfile(false)
     , m_currentUserInitiatedProfileNumber(-1)
     , m_nextUserInitiatedProfileNumber(1)
-    , m_previousMessage(0)
     , m_startProfiling(this, &InspectorController::startUserInitiatedProfiling)
+#endif
 {
     ASSERT_ARG(page, page);
     ASSERT_ARG(client, client);
@@ -263,26 +192,11 @@
 
 InspectorController::~InspectorController()
 {
-    m_client->inspectorDestroyed();
-
-    if (m_scriptContext) {
-        JSValueRef exception = 0;
-
-        JSObjectRef global = JSContextGetGlobalObject(m_scriptContext);
-        JSValueRef controllerProperty = JSObjectGetProperty(m_scriptContext, global, jsStringRef("InspectorController").get(), &exception);
-        if (!HANDLE_EXCEPTION(m_scriptContext, exception)) {
-            if (JSObjectRef controller = JSValueToObject(m_scriptContext, controllerProperty, &exception)) {
-                if (!HANDLE_EXCEPTION(m_scriptContext, exception))
-                    JSObjectSetPrivate(controller, 0);
-            }
-        }
-    }
-
-    if (m_page)
-        m_page->setParentInspectorController(0);
-
-    // m_inspectedPage should have been cleared in inspectedPageDestroyed().
+    // These should have been cleared in inspectedPageDestroyed().
+    ASSERT(!m_client);
+    ASSERT(!m_scriptState);
     ASSERT(!m_inspectedPage);
+    ASSERT(!m_page || (m_page && !m_page->parentInspectorController()));
 
     deleteAllValues(m_frameResources);
     deleteAllValues(m_consoleMessages);
@@ -301,8 +215,19 @@
 {
     close();
 
+    if (m_scriptState)
+        ScriptGlobalObject::remove(m_scriptState, "InspectorController");
+
+    if (m_page) {
+        m_page->setParentInspectorController(0);
+        m_page = 0;
+    }
+
     ASSERT(m_inspectedPage);
     m_inspectedPage = 0;
+
+    m_client->inspectorDestroyed();
+    m_client = 0;
 }
 
 bool InspectorController::enabled() const
@@ -390,7 +315,7 @@
         node = node->parentNode();
     m_nodeToFocus = node;
 
-    if (!m_scriptObject) {
+    if (!m_frontend) {
         m_showAfterVisible = ElementsPanel;
         return;
     }
@@ -404,27 +329,11 @@
     if (!enabled())
         return;
 
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
+    ASSERT(m_frontend);
     ASSERT(m_nodeToFocus);
 
-    Frame* frame = m_nodeToFocus->document()->frame();
-    if (!frame)
-        return;
-
-    ExecState* exec = toJSDOMWindow(frame)->globalExec();
-
-    JSValueRef arg0;
-
-    {
-        JSC::JSLock lock(false);
-        arg0 = toRef(JSInspectedObjectWrapper::wrap(exec, toJS(exec, m_nodeToFocus.get())));
-    }
-
+    m_frontend->updateFocusedNode(m_nodeToFocus.get());
     m_nodeToFocus = 0;
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "updateFocusedNode", 1, &arg0, exception);
 }
 
 void InspectorController::highlight(Node* node)
@@ -456,7 +365,7 @@
 
     m_windowVisible = visible;
 
-    if (!m_scriptContext || !m_scriptObject)
+    if (!m_frontend)
         return;
 
     if (m_windowVisible) {
@@ -472,7 +381,13 @@
             showPanel(m_showAfterVisible);
     } else {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+        // If the window is being closed with the debugger enabled,
+        // remember this state to re-enable debugger on the next window
+        // opening.
+        bool debuggerWasEnabled = m_debuggerEnabled;
         disableDebugger();
+        if (debuggerWasEnabled)
+            m_attachDebuggerWhenShown = true;
 #endif
         resetScriptObjects();
     }
@@ -496,12 +411,12 @@
     addConsoleMessage(0, new ConsoleMessage(source, level, message, lineNumber, sourceID, m_groupLevel));
 }
 
-void InspectorController::addConsoleMessage(ExecState* exec, ConsoleMessage* consoleMessage)
+void InspectorController::addConsoleMessage(ScriptState* scriptState, ConsoleMessage* consoleMessage)
 {
     ASSERT(enabled());
     ASSERT_ARG(consoleMessage, consoleMessage);
 
-    if (m_previousMessage && m_previousMessage->isEqual(exec, consoleMessage)) {
+    if (m_previousMessage && m_previousMessage->isEqual(scriptState, consoleMessage)) {
         m_previousMessage->incrementCount();
         delete consoleMessage;
     } else {
@@ -510,7 +425,7 @@
     }
 
     if (windowVisible())
-        m_previousMessage->addToConsole(toJS(m_scriptContext), ScriptObject(toJS(m_scriptObject)));
+        m_previousMessage->addToConsole(m_frontend.get());
 }
 
 void InspectorController::clearConsoleMessages()
@@ -521,18 +436,8 @@
     m_groupLevel = 0;
 }
 
-void InspectorController::toggleRecordButton(bool isProfiling)
-{
-    if (!m_scriptContext)
-        return;
-
-    JSValueRef exception = 0;
-    JSValueRef isProvingValue = JSValueMakeBoolean(m_scriptContext, isProfiling);
-    callFunction(m_scriptContext, m_scriptObject, "setRecordingProfile", 1, &isProvingValue, exception);
-}
-
 void InspectorController::startGroup(MessageSource source, ScriptCallStack* callStack)
-{    
+{
     ++m_groupLevel;
 
     addConsoleMessage(callStack->state(), new ConsoleMessage(source, StartGroupMessageLevel, callStack, m_groupLevel));
@@ -548,32 +453,6 @@
     addConsoleMessage(0, new ConsoleMessage(source, EndGroupMessageLevel, String(), lineNumber, sourceURL, m_groupLevel));
 }
 
-void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
-{
-    if (!enabled())
-        return;
-
-    RefPtr<Profile> profile = prpProfile;
-    m_profiles.append(profile);
-
-    if (windowVisible())
-        addScriptProfile(profile.get());
-
-    addProfileMessageToConsole(profile, lineNumber, sourceURL);
-}
-
-void InspectorController::addProfileMessageToConsole(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
-{
-    RefPtr<Profile> profile = prpProfile;
-
-    UString message = "Profile \"webkit-profile://";
-    message += encodeWithURLEscapeSequences(profile->title());
-    message += "/";
-    message += UString::from(profile->uid());
-    message += "\" finished.";
-    addMessageToConsole(JSMessageSource, LogMessageLevel, message, lineNumber, sourceURL);
-}
-
 void InspectorController::attachWindow()
 {
     if (!enabled())
@@ -590,13 +469,10 @@
 
 void InspectorController::setAttachedWindow(bool attached)
 {
-    if (!enabled() || !m_scriptContext || !m_scriptObject)
+    if (!enabled() || !m_frontend)
         return;
 
-    JSValueRef attachedValue = JSValueMakeBoolean(m_scriptContext, attached);
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "setAttachedWindow", 1, &attachedValue, exception);
+    m_frontend->setAttachedWindow(attached);
 }
 
 void InspectorController::setAttachedWindowHeight(unsigned height)
@@ -616,6 +492,19 @@
         hideHighlight();
 }
 
+void InspectorController::addResourceSourceToFrame(long identifier, Node* frame)
+{
+    if (!enabled() || !m_frontend)
+        return;
+
+    RefPtr<InspectorResource> resource = resources().get(identifier);
+    if (resource) {
+        String sourceString = resource->sourceString();
+        if (!sourceString.isEmpty())
+            addSourceToFrame(resource->mimeType(), sourceString, frame);
+    }
+}
+
 void InspectorController::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
 {
     if (!enabled() || !m_searchingForNode)
@@ -642,21 +531,10 @@
 
 void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame)
 {
-    if (!enabled() || !m_scriptContext || !m_scriptObject)
+    if (!enabled() || !m_frontend)
         return;
 
-    JSDOMWindow* win = toJSDOMWindow(frame);
-    ExecState* exec = win->globalExec();
-
-    JSValueRef arg0;
-
-    {
-        JSC::JSLock lock(false);
-        arg0 = toRef(JSInspectedObjectWrapper::wrap(exec, win));
-    }
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "inspectedWindowCleared", 1, &arg0, exception);
+    m_frontend->inspectedWindowScriptObjectCleared(frame);
 }
 
 void InspectorController::windowScriptObjectAvailable()
@@ -667,52 +545,48 @@
     // Grant the inspector the ability to script the inspected page.
     m_page->mainFrame()->document()->securityOrigin()->grantUniversalAccess();
 
-    // FIXME: This should be cleaned up. API Mix-up.
-    JSGlobalObject* globalObject = m_page->mainFrame()->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-    m_scriptContext = toRef(exec);
-    JSValuePtr jsInspector = toJS(exec, this);
-    m_controllerScriptObject = toRef(asObject(jsInspector));
-    globalObject->putDirect(Identifier(exec, "InspectorController"), jsInspector);
+    m_scriptState = scriptStateFromPage(m_page);
+    ScriptGlobalObject::set(m_scriptState, "InspectorController", this);
 }
 
 void InspectorController::scriptObjectReady()
 {
-    ASSERT(m_scriptContext);
-    if (!m_scriptContext)
+    ASSERT(m_scriptState);
+    if (!m_scriptState)
         return;
 
-    JSObjectRef global = JSContextGetGlobalObject(m_scriptContext);
-    ASSERT(global);
-
-    JSValueRef exception = 0;
-
-    JSValueRef inspectorValue = JSObjectGetProperty(m_scriptContext, global, jsStringRef("WebInspector").get(), &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
+    ScriptObject webInspectorObj;
+    if (!ScriptGlobalObject::get(m_scriptState, "WebInspector", webInspectorObj))
         return;
+    setFrontendProxyObject(m_scriptState, webInspectorObj);
 
-    ASSERT(inspectorValue);
-    if (!inspectorValue)
-        return;
-
-    m_scriptObject = JSValueToObject(m_scriptContext, inspectorValue, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    ASSERT(m_scriptObject);
-
-    JSValueProtect(m_scriptContext, m_scriptObject);
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    Setting debuggerEnabled = setting(debuggerEnabledSettingName);
+    if (debuggerEnabled.type() == Setting::BooleanType && debuggerEnabled.booleanValue())
+        enableDebugger();
+    Setting profilerEnabled = setting(profilerEnabledSettingName);
+    if (profilerEnabled.type() == Setting::BooleanType && profilerEnabled.booleanValue())
+        enableProfiler();
+#endif
 
     // Make sure our window is visible now that the page loaded
     showWindow();
 }
 
+void InspectorController::setFrontendProxyObject(ScriptState* scriptState, ScriptObject webInspectorObj)
+{
+    m_frontend.set(new InspectorFrontend(scriptState, webInspectorObj));
+}
+
 void InspectorController::show()
 {
     if (!enabled())
         return;
-
+    
     if (!m_page) {
+        if (m_frontend)
+            return;  // We are using custom frontend - no need to create page.
+
         m_page = m_client->createPage();
         if (!m_page)
             return;
@@ -732,7 +606,7 @@
 
     show();
 
-    if (!m_scriptObject) {
+    if (!m_frontend) {
         m_showAfterVisible = panel;
         return;
     }
@@ -740,33 +614,7 @@
     if (panel == CurrentPanel)
         return;
 
-    const char* showFunctionName;
-    switch (panel) {
-        case ConsolePanel:
-            showFunctionName = "showConsole";
-            break;
-        case DatabasesPanel:
-            showFunctionName = "showDatabasesPanel";
-            break;
-        case ElementsPanel:
-            showFunctionName = "showElementsPanel";
-            break;
-        case ProfilesPanel:
-            showFunctionName = "showProfilesPanel";
-            break;
-        case ResourcesPanel:
-            showFunctionName = "showResourcesPanel";
-            break;
-        case ScriptsPanel:
-            showFunctionName = "showScriptsPanel";
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-            showFunctionName = 0;
-    }
-
-    if (showFunctionName)
-        callSimpleFunction(m_scriptContext, m_scriptObject, showFunctionName);
+    m_frontend->showPanel(panel);
 }
 
 void InspectorController::close()
@@ -774,17 +622,14 @@
     if (!enabled())
         return;
 
-    stopUserInitiatedProfiling();
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+    stopUserInitiatedProfiling();
     disableDebugger();
 #endif
     closeWindow();
 
-    if (m_scriptContext && m_scriptObject)
-        JSValueUnprotect(m_scriptContext, m_scriptObject);
-
-    m_scriptObject = 0;
-    m_scriptContext = 0;
+    m_frontend.set(0);
+    m_scriptState = 0;
 }
 
 void InspectorController::showWindow()
@@ -798,422 +643,42 @@
     m_client->closeWindow();
 }
 
-void InspectorController::startUserInitiatedProfilingSoon()
-{
-    m_startProfiling.startOneShot(0);
-}
-
-void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>*)
-{
-    if (!enabled())
-        return;
-
-    if (!profilerEnabled()) {
-        enableProfiler(true);
-        JavaScriptDebugServer::shared().recompileAllJSFunctions();
-    }
-
-    m_recordingUserInitiatedProfile = true;
-    m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;
-
-    UString title = UserInitiatedProfileName;
-    title += ".";
-    title += UString::from(m_currentUserInitiatedProfileNumber);
-
-    ExecState* exec = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
-    Profiler::profiler()->startProfiling(exec, title);
-
-    toggleRecordButton(true);
-}
-
-void InspectorController::stopUserInitiatedProfiling()
-{
-    if (!enabled())
-        return;
-
-    m_recordingUserInitiatedProfile = false;
-
-    UString title =  UserInitiatedProfileName;
-    title += ".";
-    title += UString::from(m_currentUserInitiatedProfileNumber);
-
-    ExecState* exec = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
-    RefPtr<Profile> profile = Profiler::profiler()->stopProfiling(exec, title);
-    if (profile)
-        addProfile(profile, 0, UString());
-
-    toggleRecordButton(false);
-}
-
-void InspectorController::enableProfiler(bool skipRecompile)
-{
-    if (m_profilerEnabled)
-        return;
-
-    m_profilerEnabled = true;
-
-    if (!skipRecompile)
-        JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
-
-    if (m_scriptContext && m_scriptObject)
-        callSimpleFunction(m_scriptContext, m_scriptObject, "profilerWasEnabled");
-}
-
-void InspectorController::disableProfiler()
-{
-    if (!m_profilerEnabled)
-        return;
-
-    m_profilerEnabled = false;
-
-    JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
-
-    if (m_scriptContext && m_scriptObject)
-        callSimpleFunction(m_scriptContext, m_scriptObject, "profilerWasDisabled");
-}
-
-static void addHeaders(JSContextRef context, JSObjectRef object, const HTTPHeaderMap& headers, JSValueRef* exception)
-{
-    ASSERT_ARG(context, context);
-    ASSERT_ARG(object, object);
-
-    HTTPHeaderMap::const_iterator end = headers.end();
-    for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it) {
-        JSValueRef value = JSValueMakeString(context, jsStringRef(it->second).get());
-        JSObjectSetProperty(context, object, jsStringRef((it->first).string()).get(), value, kJSPropertyAttributeNone, exception);
-        if (exception && *exception)
-            return;
-    }
-}
-
-static JSObjectRef scriptObjectForRequest(JSContextRef context, const InspectorResource* resource, JSValueRef* exception)
-{
-    ASSERT_ARG(context, context);
-
-    JSObjectRef object = JSObjectMake(context, 0, 0);
-    addHeaders(context, object, resource->requestHeaderFields, exception);
-
-    return object;
-}
-
-static JSObjectRef scriptObjectForResponse(JSContextRef context, const InspectorResource* resource, JSValueRef* exception)
-{
-    ASSERT_ARG(context, context);
-
-    JSObjectRef object = JSObjectMake(context, 0, 0);
-    addHeaders(context, object, resource->responseHeaderFields, exception);
-
-    return object;
-}
-
-JSObjectRef InspectorController::addScriptResource(InspectorResource* resource)
-{
-    ASSERT_ARG(resource, resource);
-
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
-    if (!m_scriptContext || !m_scriptObject)
-        return 0;
-
-    if (!resource->scriptObject) {
-        JSValueRef exception = 0;
-
-        JSValueRef resourceProperty = JSObjectGetProperty(m_scriptContext, m_scriptObject, jsStringRef("Resource").get(), &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        JSObjectRef resourceConstructor = JSValueToObject(m_scriptContext, resourceProperty, &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        JSValueRef urlValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.string()).get());
-        JSValueRef domainValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.host()).get());
-        JSValueRef pathValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.path()).get());
-        JSValueRef lastPathComponentValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.lastPathComponent()).get());
-
-        JSValueRef identifier = JSValueMakeNumber(m_scriptContext, resource->identifier);
-        JSValueRef mainResource = JSValueMakeBoolean(m_scriptContext, m_mainResource == resource);
-        JSValueRef cached = JSValueMakeBoolean(m_scriptContext, resource->cached);
-
-        JSObjectRef scriptObject = scriptObjectForRequest(m_scriptContext, resource, &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        JSValueRef arguments[] = { scriptObject, urlValue, domainValue, pathValue, lastPathComponentValue, identifier, mainResource, cached };
-        JSObjectRef result = JSObjectCallAsConstructor(m_scriptContext, resourceConstructor, 8, arguments, &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        ASSERT(result);
-
-        resource->setScriptObject(m_scriptContext, result);
-    }
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "addResource", 1, &resource->scriptObject, exception);
-
-    if (exception)
-        return 0;
-
-    return resource->scriptObject;
-}
-
-JSObjectRef InspectorController::addAndUpdateScriptResource(InspectorResource* resource)
-{
-    ASSERT_ARG(resource, resource);
-
-    JSObjectRef scriptResource = addScriptResource(resource);
-    if (!scriptResource)
-        return 0;
-
-    updateScriptResourceResponse(resource);
-    updateScriptResource(resource, resource->length);
-    updateScriptResource(resource, resource->startTime, resource->responseReceivedTime, resource->endTime);
-    updateScriptResource(resource, resource->finished, resource->failed);
-    return scriptResource;
-}
-
-void InspectorController::removeScriptResource(InspectorResource* resource)
-{
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
-    if (!m_scriptContext || !m_scriptObject)
-        return;
-
-    ASSERT(resource);
-    ASSERT(resource->scriptObject);
-    if (!resource || !resource->scriptObject)
-        return;
-
-    JSObjectRef scriptObject = resource->scriptObject;
-    resource->setScriptObject(0, 0);
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "removeResource", 1, &scriptObject, exception);
-}
-
-static void updateResourceRequest(InspectorResource* resource, const ResourceRequest& request)
-{
-    resource->requestHeaderFields = request.httpHeaderFields();
-    resource->requestURL = request.url();
-}
-
-static void updateResourceResponse(InspectorResource* resource, const ResourceResponse& response)
-{
-    resource->expectedContentLength = response.expectedContentLength();
-    resource->mimeType = response.mimeType();
-    resource->responseHeaderFields = response.httpHeaderFields();
-    resource->responseStatusCode = response.httpStatusCode();
-    resource->suggestedFilename = response.suggestedFilename();
-}
-
-void InspectorController::updateScriptResourceRequest(InspectorResource* resource)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef urlValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.string()).get());
-    JSValueRef domainValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.host()).get());
-    JSValueRef pathValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.path()).get());
-    JSValueRef lastPathComponentValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.lastPathComponent()).get());
-
-    JSValueRef mainResourceValue = JSValueMakeBoolean(m_scriptContext, m_mainResource == resource);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("url").get(), urlValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("domain").get(), domainValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("path").get(), pathValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("lastPathComponent").get(), lastPathComponentValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectRef scriptObject = scriptObjectForRequest(m_scriptContext, resource, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("requestHeaders").get(), scriptObject, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("mainResource").get(), mainResourceValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResourceResponse(InspectorResource* resource)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef mimeTypeValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->mimeType).get());
-
-    JSValueRef suggestedFilenameValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->suggestedFilename).get());
-
-    JSValueRef expectedContentLengthValue = JSValueMakeNumber(m_scriptContext, static_cast<double>(resource->expectedContentLength));
-    JSValueRef statusCodeValue = JSValueMakeNumber(m_scriptContext, resource->responseStatusCode);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("mimeType").get(), mimeTypeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("suggestedFilename").get(), suggestedFilenameValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("expectedContentLength").get(), expectedContentLengthValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("statusCode").get(), statusCodeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectRef scriptObject = scriptObjectForResponse(m_scriptContext, resource, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("responseHeaders").get(), scriptObject, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    updateScriptResourceType(resource);
-}
-
-void InspectorController::updateScriptResourceType(InspectorResource* resource)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef exception = 0;
-
-    JSValueRef typeValue = JSValueMakeNumber(m_scriptContext, resource->type());
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("type").get(), typeValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResource(InspectorResource* resource, int length)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef lengthValue = JSValueMakeNumber(m_scriptContext, length);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("contentLength").get(), lengthValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResource(InspectorResource* resource, bool finished, bool failed)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef failedValue = JSValueMakeBoolean(m_scriptContext, failed);
-    JSValueRef finishedValue = JSValueMakeBoolean(m_scriptContext, finished);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("failed").get(), failedValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("finished").get(), finishedValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResource(InspectorResource* resource, double startTime, double responseReceivedTime, double endTime)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef startTimeValue = JSValueMakeNumber(m_scriptContext, startTime);
-    JSValueRef responseReceivedTimeValue = JSValueMakeNumber(m_scriptContext, responseReceivedTime);
-    JSValueRef endTimeValue = JSValueMakeNumber(m_scriptContext, endTime);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("startTime").get(), startTimeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("responseReceivedTime").get(), responseReceivedTimeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("endTime").get(), endTimeValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
 void InspectorController::populateScriptObjects()
 {
-    ASSERT(m_scriptContext);
-    if (!m_scriptContext)
+    ASSERT(m_frontend);
+    if (!m_frontend)
         return;
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
     for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
-        addAndUpdateScriptResource(it->second.get());
+        it->second->createScriptObject(m_frontend.get());
 
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
-        m_consoleMessages[i]->addToConsole(toJS(m_scriptContext), ScriptObject(toJS(m_scriptObject)));
+        m_consoleMessages[i]->addToConsole(m_frontend.get());
 
 #if ENABLE(DATABASE)
     DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
     for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        (*it)->bind(toJS(m_scriptContext), ScriptObject(toJS(m_scriptObject)));
+        (*it)->bind(m_frontend.get());
 #endif
 #if ENABLE(DOM_STORAGE)
     DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
     for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        (*it)->bind(toJS(m_scriptContext), ScriptObject(toJS(m_scriptObject)));
+        (*it)->bind(m_frontend.get());
 #endif
 
-    callSimpleFunction(m_scriptContext, m_scriptObject, "populateInterface");
-}
-
-void InspectorController::addScriptProfile(Profile* profile)
-{
-    JSLock lock(false);
-    JSValueRef exception = 0;
-    JSValueRef profileObject = toRef(toJS(toJS(m_scriptContext), profile));
-    callFunction(m_scriptContext, m_scriptObject, "addProfile", 1, &profileObject, exception);
+    m_frontend->populateInterface();
 }
 
 void InspectorController::resetScriptObjects()
 {
-    if (!m_scriptContext || !m_scriptObject)
+    if (!m_frontend)
         return;
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
-        InspectorResource* resource = it->second.get();
-        resource->setScriptObject(0, 0);
-    }
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
+        it->second->releaseScriptObject(m_frontend.get(), false);
 
 #if ENABLE(DATABASE)
     DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
@@ -1226,7 +691,7 @@
         (*it)->unbind();
 #endif
 
-    callSimpleFunction(m_scriptContext, m_scriptObject, "reset");
+    m_frontend->reset();
 }
 
 void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoader* loaderToKeep)
@@ -1240,10 +705,10 @@
         if (resource == m_mainResource)
             continue;
 
-        if (!loaderToKeep || resource->loader != loaderToKeep) {
+        if (!loaderToKeep || !resource->isSameLoader(loaderToKeep)) {
             removeResource(resource);
-            if (windowVisible() && resource->scriptObject)
-                removeScriptResource(resource);
+            if (windowVisible())
+                resource->releaseScriptObject(m_frontend.get(), true);
         }
     }
 }
@@ -1262,8 +727,9 @@
 
         m_times.clear();
         m_counts.clear();
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         m_profiles.clear();
-
+#endif
 #if ENABLE(DATABASE)
         m_databaseResources.clear();
 #endif
@@ -1275,11 +741,11 @@
             resetScriptObjects();
 
             if (!loader->isLoadingFromCachedPage()) {
-                ASSERT(m_mainResource && m_mainResource->loader == loader);
+                ASSERT(m_mainResource && m_mainResource->isSameLoader(loader));
                 // We don't add the main resource until its load is committed. This is
                 // needed to keep the load for a user-entered URL from showing up in the
                 // list of resources for the page they are navigating away from.
-                addAndUpdateScriptResource(m_mainResource.get());
+                m_mainResource->createScriptObject(m_frontend.get());
             } else {
                 // Pages loaded from the page cache are committed before
                 // m_mainResource is the right resource for this load, so we
@@ -1305,33 +771,33 @@
 
 void InspectorController::addResource(InspectorResource* resource)
 {
-    m_resources.set(resource->identifier, resource);
-    m_knownResources.add(resource->requestURL.string());
+    m_resources.set(resource->identifier(), resource);
+    m_knownResources.add(resource->requestURL());
 
-    Frame* frame = resource->frame.get();
+    Frame* frame = resource->frame();
     ResourcesMap* resourceMap = m_frameResources.get(frame);
     if (resourceMap)
-        resourceMap->set(resource->identifier, resource);
+        resourceMap->set(resource->identifier(), resource);
     else {
         resourceMap = new ResourcesMap;
-        resourceMap->set(resource->identifier, resource);
+        resourceMap->set(resource->identifier(), resource);
         m_frameResources.set(frame, resourceMap);
     }
 }
 
 void InspectorController::removeResource(InspectorResource* resource)
 {
-    m_resources.remove(resource->identifier);
-    m_knownResources.remove(resource->requestURL.string());
+    m_resources.remove(resource->identifier());
+    m_knownResources.remove(resource->requestURL());
 
-    Frame* frame = resource->frame.get();
+    Frame* frame = resource->frame();
     ResourcesMap* resourceMap = m_frameResources.get(frame);
     if (!resourceMap) {
         ASSERT_NOT_REACHED();
         return;
     }
 
-    resourceMap->remove(resource->identifier);
+    resourceMap->remove(resource->identifier());
     if (resourceMap->isEmpty()) {
         m_frameResources.remove(frame);
         delete resourceMap;
@@ -1347,115 +813,105 @@
     if (m_knownResources.contains(cachedResource->url()))
         return;
 
-    RefPtr<InspectorResource> resource = InspectorResource::create(m_nextIdentifier--, loader, loader->frame());
-    resource->finished = true;
-
-    resource->requestURL = KURL(cachedResource->url());
-    updateResourceResponse(resource.get(), cachedResource->response());
-
-    resource->length = cachedResource->encodedSize();
-    resource->cached = true;
-    resource->startTime = currentTime();
-    resource->responseReceivedTime = resource->startTime;
-    resource->endTime = resource->startTime;
-
     ASSERT(m_inspectedPage);
+    bool isMainResource = loader->frame() == m_inspectedPage->mainFrame() && cachedResource->url() == loader->requestURL();
+    ensureResourceTrackingSettingsLoaded();
+    if (!isMainResource && !m_resourceTrackingEnabled)
+        return;
+    
+    RefPtr<InspectorResource> resource = InspectorResource::createCached(m_nextIdentifier--, loader, cachedResource);
 
-    if (loader->frame() == m_inspectedPage->mainFrame() && cachedResource->url() == loader->requestURL())
+    if (isMainResource) {
         m_mainResource = resource;
+        resource->markMainResource();
+    }
 
     addResource(resource.get());
 
     if (windowVisible())
-        addAndUpdateScriptResource(resource.get());
+        resource->createScriptObject(m_frontend.get());
 }
 
 void InspectorController::identifierForInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
 {
     if (!enabled())
         return;
-
-    RefPtr<InspectorResource> resource = InspectorResource::create(identifier, loader, loader->frame());
-
-    updateResourceRequest(resource.get(), request);
-
     ASSERT(m_inspectedPage);
 
-    if (loader->frame() == m_inspectedPage->mainFrame() && request.url() == loader->requestURL())
+    bool isMainResource = m_inspectedPage->mainFrame() && request.url() == loader->requestURL();
+    ensureResourceTrackingSettingsLoaded();
+    if (!isMainResource && !m_resourceTrackingEnabled)
+        return;
+
+    RefPtr<InspectorResource> resource = InspectorResource::create(identifier, loader);
+
+    resource->updateRequest(request);
+
+    if (isMainResource) {
         m_mainResource = resource;
+        resource->markMainResource();
+    }
 
     addResource(resource.get());
 
     if (windowVisible() && loader->isLoadingFromCachedPage() && resource == m_mainResource)
-        addAndUpdateScriptResource(resource.get());
+        resource->createScriptObject(m_frontend.get());
 }
 
 void InspectorController::willSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     InspectorResource* resource = m_resources.get(identifier).get();
     if (!resource)
         return;
 
-    resource->startTime = currentTime();
+    resource->startTiming();
 
     if (!redirectResponse.isNull()) {
-        updateResourceRequest(resource, request);
-        updateResourceResponse(resource, redirectResponse);
+        resource->updateRequest(request);
+        resource->updateResponse(redirectResponse);
     }
 
-    if (resource != m_mainResource && windowVisible()) {
-        if (!resource->scriptObject)
-            addScriptResource(resource);
-        else
-            updateScriptResourceRequest(resource);
-
-        updateScriptResource(resource, resource->startTime, resource->responseReceivedTime, resource->endTime);
-
-        if (!redirectResponse.isNull())
-            updateScriptResourceResponse(resource);
-    }
+    if (resource != m_mainResource && windowVisible())
+        resource->createScriptObject(m_frontend.get());
 }
 
 void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse& response)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     InspectorResource* resource = m_resources.get(identifier).get();
     if (!resource)
         return;
 
-    updateResourceResponse(resource, response);
+    resource->updateResponse(response);
+    resource->markResponseReceivedTime();
 
-    resource->responseReceivedTime = currentTime();
-
-    if (windowVisible() && resource->scriptObject) {
-        updateScriptResourceResponse(resource);
-        updateScriptResource(resource, resource->startTime, resource->responseReceivedTime, resource->endTime);
-    }
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
 void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     InspectorResource* resource = m_resources.get(identifier).get();
     if (!resource)
         return;
 
-    resource->length += lengthReceived;
+    resource->addLength(lengthReceived);
 
-    if (windowVisible() && resource->scriptObject)
-        updateScriptResource(resource, resource->length);
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
 void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identifier)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     RefPtr<InspectorResource> resource = m_resources.get(identifier);
@@ -1464,20 +920,17 @@
 
     removeResource(resource.get());
 
-    resource->finished = true;
-    resource->endTime = currentTime();
+    resource->endTiming();
 
     addResource(resource.get());
 
-    if (windowVisible() && resource->scriptObject) {
-        updateScriptResource(resource.get(), resource->startTime, resource->responseReceivedTime, resource->endTime);
-        updateScriptResource(resource.get(), resource->finished);
-    }
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
 void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError& /*error*/)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     RefPtr<InspectorResource> resource = m_resources.get(identifier);
@@ -1486,48 +939,88 @@
 
     removeResource(resource.get());
 
-    resource->finished = true;
-    resource->failed = true;
-    resource->endTime = currentTime();
+    resource->markFailed();
+    resource->endTiming();
 
     addResource(resource.get());
 
-    if (windowVisible() && resource->scriptObject) {
-        updateScriptResource(resource.get(), resource->startTime, resource->responseReceivedTime, resource->endTime);
-        updateScriptResource(resource.get(), resource->finished, resource->failed);
-    }
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const JSC::UString& sourceString)
+void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
 
     InspectorResource* resource = m_resources.get(identifier).get();
     if (!resource)
         return;
 
-    resource->setXMLHttpRequestProperties(sourceString);
+    resource->setXMLHttpResponseText(sourceString);
 
-    if (windowVisible() && resource->scriptObject)
-        updateScriptResourceType(resource);
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::scriptImported(unsigned long identifier, const JSC::UString& sourceString)
+void InspectorController::scriptImported(unsigned long identifier, const String& sourceString)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
         return;
     
     InspectorResource* resource = m_resources.get(identifier).get();
     if (!resource)
         return;
     
-    resource->setXMLHttpRequestProperties(sourceString);
+    // FIXME: imported script and XHR response are currently viewed as the same
+    // thing by the Inspector. They should be made into distinct types.
+    resource->setXMLHttpResponseText(ScriptString(sourceString));
     
-    if (windowVisible() && resource->scriptObject)
-        updateScriptResourceType(resource);
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
+void InspectorController::enableResourceTracking(bool always) {
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(resourceTrackingEnabledSettingName, Setting(true));
+
+    if (m_resourceTrackingEnabled)
+        return;
+
+    ASSERT(m_inspectedPage);
+    m_resourceTrackingEnabled = true;
+    if (m_frontend)
+        m_frontend->resourceTrackingWasEnabled();
+
+    m_inspectedPage->mainFrame()->loader()->reload();
+}
+
+void InspectorController::disableResourceTracking(bool always) {
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(resourceTrackingEnabledSettingName, Setting(false));
+
+    ASSERT(m_inspectedPage);
+    m_resourceTrackingEnabled = false;
+    if (m_frontend)
+        m_frontend->resourceTrackingWasDisabled();
+}
+
+void InspectorController::ensureResourceTrackingSettingsLoaded()
+{
+    if (m_resourceTrackingSettingsLoaded)
+        return;
+    m_resourceTrackingSettingsLoaded = true;
+
+    Setting resourceTracking = setting(resourceTrackingEnabledSettingName);
+    if (resourceTracking.type() == Setting::BooleanType && resourceTracking.booleanValue())
+        m_resourceTrackingEnabled = true;
+}
 
 #if ENABLE(DATABASE)
 void InspectorController::didOpenDatabase(Database* database, const String& domain, const String& name, const String& version)
@@ -1540,7 +1033,7 @@
     m_databaseResources.add(resource);
 
     if (windowVisible())
-        resource->bind(toJS(m_scriptContext), ScriptObject(toJS(m_scriptObject)));
+        resource->bind(m_frontend.get());
 }
 #endif
 
@@ -1560,7 +1053,7 @@
 
     m_domStorageResources.add(resource);
     if (windowVisible())
-        resource->bind(toJS(m_scriptContext), ScriptObject(toJS(m_scriptObject)));
+        resource->bind(m_frontend.get());
 }
 #endif
 
@@ -1575,32 +1068,166 @@
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-void InspectorController::enableDebugger()
+void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
 {
     if (!enabled())
         return;
 
-    if (!m_scriptContext || !m_scriptObject) {
-        m_attachDebuggerWhenShown = true;
+    RefPtr<Profile> profile = prpProfile;
+    m_profiles.append(profile);
+
+    if (windowVisible())
+        addScriptProfile(profile.get());
+
+    addProfileMessageToConsole(profile, lineNumber, sourceURL);
+}
+
+void InspectorController::addProfileMessageToConsole(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
+{
+    RefPtr<Profile> profile = prpProfile;
+
+    UString message = "Profile \"webkit-profile://";
+    message += encodeWithURLEscapeSequences(profile->title());
+    message += "/";
+    message += UString::from(profile->uid());
+    message += "\" finished.";
+    addMessageToConsole(JSMessageSource, LogMessageLevel, message, lineNumber, sourceURL);
+}
+
+void InspectorController::addScriptProfile(Profile* profile)
+{
+    if (!m_frontend)
         return;
+
+    JSLock lock(false);
+    m_frontend->addProfile(toJS(m_scriptState, profile));
+}
+
+void InspectorController::startUserInitiatedProfilingSoon()
+{
+    m_startProfiling.startOneShot(0);
+}
+
+void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>*)
+{
+    if (!enabled())
+        return;
+
+    if (!profilerEnabled()) {
+        enableProfiler(false, true);
+        JavaScriptDebugServer::shared().recompileAllJSFunctions();
     }
 
+    m_recordingUserInitiatedProfile = true;
+    m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;
+
+    UString title = UserInitiatedProfileName;
+    title += ".";
+    title += UString::from(m_currentUserInitiatedProfileNumber);
+
+    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
+    Profiler::profiler()->startProfiling(scriptState, title);
+
+    toggleRecordButton(true);
+}
+
+void InspectorController::stopUserInitiatedProfiling()
+{
+    if (!enabled())
+        return;
+
+    m_recordingUserInitiatedProfile = false;
+
+    UString title =  UserInitiatedProfileName;
+    title += ".";
+    title += UString::from(m_currentUserInitiatedProfileNumber);
+
+    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
+    RefPtr<Profile> profile = Profiler::profiler()->stopProfiling(scriptState, title);
+    if (profile)
+        addProfile(profile, 0, UString());
+
+    toggleRecordButton(false);
+}
+
+void InspectorController::toggleRecordButton(bool isProfiling)
+{
+    if (!m_frontend)
+        return;
+    m_frontend->setRecordingProfile(isProfiling);
+}
+
+void InspectorController::enableProfiler(bool always, bool skipRecompile)
+{
+    if (always)
+        setSetting(profilerEnabledSettingName, Setting(true));
+
+    if (m_profilerEnabled)
+        return;
+
+    m_profilerEnabled = true;
+
+    if (!skipRecompile)
+        JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+
+    if (m_frontend)
+        m_frontend->profilerWasEnabled();
+}
+
+void InspectorController::disableProfiler(bool always)
+{
+    if (always)
+        setSetting(profilerEnabledSettingName, Setting(false));
+
+    if (!m_profilerEnabled)
+        return;
+
+    m_profilerEnabled = false;
+
+    JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+
+    if (m_frontend)
+        m_frontend->profilerWasDisabled();
+}
+
+void InspectorController::enableDebuggerFromFrontend(bool always)
+{
+    if (always)
+        setSetting(debuggerEnabledSettingName, Setting(true));
+
     ASSERT(m_inspectedPage);
 
     JavaScriptDebugServer::shared().addListener(this, m_inspectedPage);
     JavaScriptDebugServer::shared().clearBreakpoints();
 
     m_debuggerEnabled = true;
-    m_attachDebuggerWhenShown = false;
-
-    callSimpleFunction(m_scriptContext, m_scriptObject, "debuggerWasEnabled");
+    m_frontend->debuggerWasEnabled();
 }
 
-void InspectorController::disableDebugger()
+void InspectorController::enableDebugger()
 {
     if (!enabled())
         return;
 
+    if (m_debuggerEnabled)
+        return;
+
+    if (!m_scriptState || !m_frontend) {
+        m_attachDebuggerWhenShown = true;
+    } else {
+        m_frontend->attachDebuggerWhenShown();
+        m_attachDebuggerWhenShown = false;
+    }
+}
+
+void InspectorController::disableDebugger(bool always)
+{
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(debuggerEnabledSettingName, Setting(false));
+
     ASSERT(m_inspectedPage);
 
     JavaScriptDebugServer::shared().removeListener(this, m_inspectedPage);
@@ -1608,8 +1235,8 @@
     m_debuggerEnabled = false;
     m_attachDebuggerWhenShown = false;
 
-    if (m_scriptContext && m_scriptObject)
-        callSimpleFunction(m_scriptContext, m_scriptObject, "debuggerWasDisabled");
+    if (m_frontend)
+        m_frontend->debuggerWasDisabled();
 }
 
 JavaScriptCallFrame* InspectorController::currentCallFrame() const
@@ -1671,6 +1298,29 @@
 {
     JavaScriptDebugServer::shared().removeBreakpoint(sourceID, lineNumber);
 }
+
+// JavaScriptDebugListener functions
+
+void InspectorController::didParseSource(ExecState*, const SourceCode& source)
+{
+    m_frontend->parsedScriptSource(source);
+}
+
+void InspectorController::failedToParseSource(ExecState*, const SourceCode& source, int errorLine, const UString& errorMessage)
+{
+    m_frontend->failedToParseScriptSource(source, errorLine, errorMessage);
+}
+
+void InspectorController::didPause()
+{
+    m_frontend->pausedScript();
+}
+
+void InspectorController::didContinue()
+{
+    m_frontend->resumedScript();
+}
+
 #endif
 
 static Path quadToPath(const FloatQuad& quad)
@@ -1807,7 +1457,7 @@
 
         // FIXME: We should show margins/padding/border for inlines.
         Vector<FloatQuad> lineBoxQuads;
-        renderInline->absoluteQuadsForRange(lineBoxQuads);
+        renderInline->absoluteQuads(lineBoxQuads);
         for (unsigned i = 0; i < lineBoxQuads.size(); ++i)
             lineBoxQuads[i] += mainFrameOffset;
 
@@ -1851,66 +1501,4 @@
     return true;
 }
 
-bool InspectorController::handleException(JSContextRef context, JSValueRef exception, unsigned lineNumber) const
-{
-    if (!exception)
-        return false;
-
-    if (!m_page)
-        return true;
-
-    String message = toString(context, exception, 0);
-    String file(__FILE__);
-
-    if (JSObjectRef exceptionObject = JSValueToObject(context, exception, 0)) {
-        JSValueRef lineValue = JSObjectGetProperty(context, exceptionObject, jsStringRef("line").get(), NULL);
-        if (lineValue)
-            lineNumber = static_cast<unsigned>(JSValueToNumber(context, lineValue, 0));
-
-        JSValueRef fileValue = JSObjectGetProperty(context, exceptionObject, jsStringRef("sourceURL").get(), NULL);
-        if (fileValue)
-            file = toString(context, fileValue, 0);
-    }
-
-    m_page->mainFrame()->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, message, lineNumber, file);
-    return true;
-}
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-
-// JavaScriptDebugListener functions
-
-void InspectorController::didParseSource(ExecState*, const SourceCode& source)
-{
-    JSValueRef sourceIDValue = JSValueMakeNumber(m_scriptContext, source.provider()->asID());
-    JSValueRef sourceURLValue = JSValueMakeString(m_scriptContext, jsStringRef(source.provider()->url()).get());
-    JSValueRef sourceValue = JSValueMakeString(m_scriptContext, jsStringRef(source).get());
-    JSValueRef firstLineValue = JSValueMakeNumber(m_scriptContext, source.firstLine());
-
-    JSValueRef exception = 0;
-    JSValueRef arguments[] = { sourceIDValue, sourceURLValue, sourceValue, firstLineValue };
-    callFunction(m_scriptContext, m_scriptObject, "parsedScriptSource", 4, arguments, exception);
-}
-
-void InspectorController::failedToParseSource(ExecState*, const SourceCode& source, int errorLine, const UString& errorMessage)
-{
-    JSValueRef sourceURLValue = JSValueMakeString(m_scriptContext, jsStringRef(source.provider()->url()).get());
-    JSValueRef sourceValue = JSValueMakeString(m_scriptContext, jsStringRef(source.data()).get());
-    JSValueRef firstLineValue = JSValueMakeNumber(m_scriptContext, source.firstLine());
-    JSValueRef errorLineValue = JSValueMakeNumber(m_scriptContext, errorLine);
-    JSValueRef errorMessageValue = JSValueMakeString(m_scriptContext, jsStringRef(errorMessage).get());
-
-    JSValueRef exception = 0;
-    JSValueRef arguments[] = { sourceURLValue, sourceValue, firstLineValue, errorLineValue, errorMessageValue };
-    callFunction(m_scriptContext, m_scriptObject, "failedToParseScriptSource", 5, arguments, exception);
-}
-
-void InspectorController::didPause()
-{
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "pausedScript", 0, 0, exception);
-}
-
-#endif
-
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorController.h b/WebCore/inspector/InspectorController.h
index de0c7e9..e3aa643 100644
--- a/WebCore/inspector/InspectorController.h
+++ b/WebCore/inspector/InspectorController.h
@@ -31,8 +31,10 @@
 
 #include "Console.h"
 #include "PlatformString.h"
+#include "ScriptState.h"
 #include "StringHash.h"
 #include "Timer.h"
+
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/RefCounted.h>
@@ -40,10 +42,7 @@
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptDebugListener.h"
-#endif
 
-#if USE(JSC)
-#include <JavaScriptCore/JSContextRef.h>
 namespace JSC {
     class Profile;
     class UString;
@@ -58,6 +57,7 @@
 class GraphicsContext;
 class HitTestResult;
 class InspectorClient;
+class InspectorFrontend;
 class JavaScriptCallFrame;
 class StorageArea;
 class Node;
@@ -66,6 +66,8 @@
 class ResourceResponse;
 class ResourceError;
 class ScriptCallStack;
+class ScriptObject;
+class ScriptString;
 class SharedBuffer;
 
 class ConsoleMessage;
@@ -104,6 +106,12 @@
         {
         }
 
+        explicit Setting(bool value)
+            : m_type(BooleanType)
+        {
+            m_simpleContent.m_boolean = value;
+        }
+
         Type type() const { return m_type; }
 
         String string() const { ASSERT(m_type == StringType); return m_string; }
@@ -159,30 +167,14 @@
     void showPanel(SpecialPanels);
     void close();
 
-    bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
-    void startUserInitiatedProfilingSoon();
-    void startUserInitiatedProfiling(Timer<InspectorController>* = 0);
-    void stopUserInitiatedProfiling();
-
-    void enableProfiler(bool skipRecompile = false);
-    void disableProfiler();
-    bool profilerEnabled() const { return enabled() && m_profilerEnabled; }
-
     bool windowVisible();
     void setWindowVisible(bool visible = true, bool attached = false);
 
+    void addResourceSourceToFrame(long identifier, Node* frame);
     bool addSourceToFrame(const String& mimeType, const String& source, Node*);
     void addMessageToConsole(MessageSource, MessageLevel, ScriptCallStack*);
     void addMessageToConsole(MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID);
     void clearConsoleMessages();
-    void toggleRecordButton(bool);
-
-#if USE(JSC)
-    void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
-    void addProfileMessageToConsole(PassRefPtr<JSC::Profile> prpProfile, unsigned lineNumber, const JSC::UString& sourceURL);
-    void addScriptProfile(JSC::Profile* profile);
-    const ProfilesArray& profiles() const { return m_profiles; }
-#endif
 
     void attachWindow();
     void detachWindow();
@@ -195,15 +187,11 @@
     void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
     void handleMousePressOnNode(Node*);
 
-#if USE(JSC)
-    JSContextRef scriptContext() const { return m_scriptContext; };
-    void setScriptContext(JSContextRef context) { m_scriptContext = context; };
-#endif
-
     void inspectedWindowScriptObjectCleared(Frame*);
     void windowScriptObjectAvailable();
 
     void scriptObjectReady();
+    void setFrontendProxyObject(ScriptState* state, ScriptObject object);
 
     void populateScriptObjects();
     void resetScriptObjects();
@@ -219,13 +207,13 @@
     void didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived);
     void didFinishLoading(DocumentLoader*, unsigned long identifier);
     void didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError&);
-#if USE(JSC)
-    void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const JSC::UString& sourceString);
-    void scriptImported(unsigned long identifier, const JSC::UString& sourceString);
-#elif USE(V8)
-    void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const String& sourceString);
+    void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
     void scriptImported(unsigned long identifier, const String& sourceString);
-#endif
+
+    void enableResourceTracking(bool always = false);
+    void disableResourceTracking(bool always = false);
+    bool resourceTrackingEnabled() const { return m_resourceTrackingEnabled; }
+    void ensureResourceTrackingSettingsLoaded();
 
 #if ENABLE(DATABASE)
     void didOpenDatabase(Database*, const String& domain, const String& name, const String& version);
@@ -239,9 +227,38 @@
     void moveWindowBy(float x, float y) const;
     void closeWindow();
 
+    void drawNodeHighlight(GraphicsContext&) const;
+
+    void count(const String& title, unsigned lineNumber, const String& sourceID);
+
+    void startTiming(const String& title);
+    bool stopTiming(const String& title, double& elapsed);
+
+    void startGroup(MessageSource source, ScriptCallStack* callFrame);
+    void endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL);
+
+    const String& platform() const;
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+    void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
+    void addProfileMessageToConsole(PassRefPtr<JSC::Profile> prpProfile, unsigned lineNumber, const JSC::UString& sourceURL);
+    void addScriptProfile(JSC::Profile* profile);
+    const ProfilesArray& profiles() const { return m_profiles; }
+
+    bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
+
+    void startUserInitiatedProfilingSoon();
+    void startUserInitiatedProfiling(Timer<InspectorController>* = 0);
+    void stopUserInitiatedProfiling();
+    void toggleRecordButton(bool);
+
+    void enableProfiler(bool always = false, bool skipRecompile = false);
+    void disableProfiler(bool always = false);
+    bool profilerEnabled() const { return enabled() && m_profilerEnabled; }
+
+    void enableDebuggerFromFrontend(bool always);
     void enableDebugger();
-    void disableDebugger();
+    void disableDebugger(bool always = false);
     bool debuggerEnabled() const { return m_debuggerEnabled; }
 
     JavaScriptCallFrame* currentCallFrame() const;
@@ -258,66 +275,32 @@
     void stepOverStatementInDebugger();
     void stepIntoStatementInDebugger();
     void stepOutOfFunctionInDebugger();
+
+    virtual void didParseSource(JSC::ExecState*, const JSC::SourceCode&);
+    virtual void failedToParseSource(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
+    virtual void didPause();
+    virtual void didContinue();
 #endif
 
-    void drawNodeHighlight(GraphicsContext&) const;
-    
-    void count(const String& title, unsigned lineNumber, const String& sourceID);
-
-    void startTiming(const String& title);
-    bool stopTiming(const String& title, double& elapsed);
-
-    void startGroup(MessageSource source, ScriptCallStack* callFrame);
-    void endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL);
-
-    const String& platform() const;
-
 private:
     InspectorController(Page*, InspectorClient*);
+
     void focusNode();
 
-#if USE(JSC)
-    void addConsoleMessage(JSC::ExecState*, ConsoleMessage*);
-#endif
+    void addConsoleMessage(ScriptState*, ConsoleMessage*);
 
     void addResource(InspectorResource*);
     void removeResource(InspectorResource*);
 
-#if USE(JSC)
-    JSObjectRef addScriptResource(InspectorResource*);
-    JSObjectRef addAndUpdateScriptResource(InspectorResource*);
-#endif
-    void removeScriptResource(InspectorResource*);
-
-    void updateScriptResourceRequest(InspectorResource*);
-    void updateScriptResourceResponse(InspectorResource*);
-    void updateScriptResourceType(InspectorResource*);
-    void updateScriptResource(InspectorResource*, int length);
-    void updateScriptResource(InspectorResource*, bool finished, bool failed = false);
-    void updateScriptResource(InspectorResource*, double startTime, double responseReceivedTime, double endTime);
-
     void pruneResources(ResourcesMap*, DocumentLoader* loaderToKeep = 0);
     void removeAllResources(ResourcesMap* map) { pruneResources(map); }
 
-#if USE(JSC)
-    JSValueRef callSimpleFunction(JSContextRef, JSObjectRef thisObject, const char* functionName) const;
-    JSValueRef callFunction(JSContextRef, JSObjectRef thisObject, const char* functionName, size_t argumentCount, const JSValueRef arguments[], JSValueRef& exception) const;
-
-    bool handleException(JSContextRef, JSValueRef exception, unsigned lineNumber) const;
-#endif
-
     void showWindow();
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-#if USE(JSC)
-    virtual void didParseSource(JSC::ExecState*, const JSC::SourceCode&);
-    virtual void failedToParseSource(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
-#endif
-    virtual void didPause();
-#endif
 
     Page* m_inspectedPage;
     InspectorClient* m_client;
+    OwnPtr<InspectorFrontend> m_frontend;
     Page* m_page;
     RefPtr<Node> m_nodeToFocus;
     RefPtr<InspectorResource> m_mainResource;
@@ -325,9 +308,6 @@
     HashSet<String> m_knownResources;
     FrameResourcesMap m_frameResources;
     Vector<ConsoleMessage*> m_consoleMessages;
-#if USE(JSC)  
-    ProfilesArray m_profiles;
-#endif
     HashMap<String, double> m_times;
     HashMap<String, unsigned> m_counts;
 #if ENABLE(DATABASE)
@@ -336,27 +316,26 @@
 #if ENABLE(DOM_STORAGE)
     DOMStorageResourcesSet m_domStorageResources;
 #endif
-#if USE(JSC)
-    JSObjectRef m_scriptObject;
-    JSObjectRef m_controllerScriptObject;
-    JSContextRef m_scriptContext;
-#endif    
+    ScriptState* m_scriptState;
     bool m_windowVisible;
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    bool m_debuggerEnabled;
-    bool m_attachDebuggerWhenShown;
-#endif
-    bool m_profilerEnabled;
-    bool m_recordingUserInitiatedProfile;
     SpecialPanels m_showAfterVisible;
     long long m_nextIdentifier;
     RefPtr<Node> m_highlightedNode;
     unsigned m_groupLevel;
     bool m_searchingForNode;
+    ConsoleMessage* m_previousMessage;
+    bool m_resourceTrackingEnabled;
+    bool m_resourceTrackingSettingsLoaded;
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    bool m_debuggerEnabled;
+    bool m_attachDebuggerWhenShown;
+    bool m_profilerEnabled;
+    bool m_recordingUserInitiatedProfile;
     int m_currentUserInitiatedProfileNumber;
     unsigned m_nextUserInitiatedProfileNumber;
-    ConsoleMessage* m_previousMessage;
     Timer<InspectorController> m_startProfiling;
+    ProfilesArray m_profiles;
+#endif
 };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorController.idl b/WebCore/inspector/InspectorController.idl
index 0cb8041..920786a 100644
--- a/WebCore/inspector/InspectorController.idl
+++ b/WebCore/inspector/InspectorController.idl
@@ -41,34 +41,18 @@
         [ImplementationFunction=attachWindow] void attach();
         [ImplementationFunction=detachWindow] void detach();
 
-        void enableDebugger();
-        void disableDebugger();
-        void pauseInDebugger();
-        void resumeDebugger();
-        void stepOverStatementInDebugger();
-        void stepIntoStatementInDebugger();
-        void stepOutOfFunctionInDebugger();
-
         void closeWindow();
         [ImplementationFunction=clearConsoleMessages] void clearMessages();
-        [ImplementationFunction=startUserInitiatedProfiling] void startProfiling();
-        [ImplementationFunction=stopUserInitiatedProfiling] void stopProfiling();
-        void enableProfiler();
-        void disableProfiler();
         [ImplementationFunction=toggleSearchForNodeInPage] void toggleNodeSearch();
 
-        boolean debuggerEnabled();
-        boolean pauseOnExceptions();
-
-        boolean profilerEnabled();
         [ImplementationFunction=windowVisible] boolean isWindowVisible();
         [ImplementationFunction=searchingForNodeInPage] boolean searchingForNode();
 
-        [Custom] void addResourceSourceToFrame(in unsigned long identifier, in Node frame);
-        [Custom] void addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
-        [Custom] Node getResourceDocumentNode(in unsigned long identifier);
+        void addResourceSourceToFrame(in long identifier, in Node frame);
+        boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
+        [Custom] Node getResourceDocumentNode(in long long identifier);
         [Custom] void search(in Node node, in DOMString query);
-#if ENABLE_DATABASE
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
         [Custom] DOMObject databaseTableNames(in Database database);
 #endif
         [Custom] DOMObject setting(in DOMString key);
@@ -80,12 +64,31 @@
         [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
         void setAttachedWindowHeight(in unsigned long height);
         [Custom] DOMObject wrapCallback(in DOMObject callback);
+        boolean resourceTrackingEnabled();
+        void enableResourceTracking(in boolean always);
+        void disableResourceTracking(in boolean always);
 
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
+        void enableDebuggerFromFrontend(in boolean always);
+        void disableDebugger(in boolean always);
+        void pauseInDebugger();
+        void resumeDebugger();
+        void stepOverStatementInDebugger();
+        void stepIntoStatementInDebugger();
+        void stepOutOfFunctionInDebugger();
+        boolean debuggerEnabled();
+        boolean pauseOnExceptions();
+        boolean profilerEnabled();
+        [ImplementationFunction=startUserInitiatedProfiling] void startProfiling();
+        [ImplementationFunction=stopUserInitiatedProfiling] void stopProfiling();
+        void enableProfiler(in boolean always);
+        void disableProfiler(in boolean always);
         [Custom] DOMObject currentCallFrame();
         void setPauseOnExceptions(in boolean pauseOnExceptions);
         void addBreakpoint(in unsigned long sourceID, in unsigned long lineNumber);
         void removeBreakpoint(in unsigned long sourceID, in unsigned long lineNumber);
 
         [Custom] Array profiles();
+#endif
      };
  }
diff --git a/WebCore/inspector/InspectorDOMStorageResource.cpp b/WebCore/inspector/InspectorDOMStorageResource.cpp
index 33d036e..1f3522e 100644
--- a/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -35,9 +35,9 @@
 
 #include "Document.h"
 #include "Frame.h"
-#include "ScriptFunctionCall.h"
+#include "InspectorFrontend.h"
+#include "JSONObject.h"
 #include "ScriptObjectQuarantine.h"
-#include "ScriptValue.h"
 #include "Storage.h"
 
 using namespace JSC;
@@ -48,6 +48,7 @@
     : m_domStorage(domStorage)
     , m_isLocalStorage(isLocalStorage)
     , m_frame(frame)
+    , m_scriptObjectCreated(false)
 {
 }
 
@@ -56,38 +57,25 @@
     return equalIgnoringCase(m_frame->document()->securityOrigin()->host(), frame->document()->securityOrigin()->host()) && m_isLocalStorage == isLocalStorage;
 }
 
-void InspectorDOMStorageResource::bind(ScriptState* scriptState, const ScriptObject& webInspector)
+void InspectorDOMStorageResource::bind(InspectorFrontend* frontend)
 {
-    if (!m_scriptObject.hasNoValue())
+    if (m_scriptObjectCreated)
         return;
 
-    ASSERT(scriptState);
-    ASSERT(!webInspector.hasNoValue());
-    if (!scriptState || webInspector.hasNoValue())
-        return;
-
-    ScriptFunctionCall resourceConstructor(scriptState, webInspector, "DOMStorage");
+    JSONObject jsonObject = frontend->newJSONObject();
     ScriptObject domStorage;
     if (!getQuarantinedScriptObject(m_frame.get(), m_domStorage.get(), domStorage))
         return;
-
-    resourceConstructor.appendArgument(domStorage);
-    resourceConstructor.appendArgument(m_frame->document()->securityOrigin()->host());
-    resourceConstructor.appendArgument(m_isLocalStorage);
-
-    bool hadException = false;
-    m_scriptObject = resourceConstructor.construct(hadException);
-    if (hadException)
-        return;
-
-    ScriptFunctionCall addDOMStorage(scriptState, webInspector, "addDOMStorage");
-    addDOMStorage.appendArgument(m_scriptObject);
-    addDOMStorage.call(hadException);
+    jsonObject.set("domStorage", domStorage);
+    jsonObject.set("host", m_frame->document()->securityOrigin()->host());
+    jsonObject.set("isLocalStorage", m_isLocalStorage);
+    if (frontend->addDOMStorage(jsonObject))
+        m_scriptObjectCreated = true;
 }
 
 void InspectorDOMStorageResource::unbind()
 {
-    m_scriptObject = ScriptObject();
+    m_scriptObjectCreated = false;
 }
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorDOMStorageResource.h b/WebCore/inspector/InspectorDOMStorageResource.h
index ad3e196..3e05897 100644
--- a/WebCore/inspector/InspectorDOMStorageResource.h
+++ b/WebCore/inspector/InspectorDOMStorageResource.h
@@ -44,6 +44,7 @@
 
     class Storage;
     class Frame;
+    class InspectorFrontend;
 
     class InspectorDOMStorageResource : public RefCounted<InspectorDOMStorageResource> {
     public:
@@ -52,7 +53,7 @@
             return adoptRef(new InspectorDOMStorageResource(domStorage, isLocalStorage, frame));
         }
 
-        void bind(ScriptState*, const ScriptObject& webInspector);
+        void bind(InspectorFrontend* frontend);
         void unbind();
 
         bool isSameHostAndType(Frame*, bool isLocalStorage) const;
@@ -61,12 +62,11 @@
 
         InspectorDOMStorageResource(Storage*, bool isLocalStorage, Frame*);
 
-        ScriptObject m_scriptObject;
         RefPtr<Storage> m_domStorage;
         bool m_isLocalStorage;
         RefPtr<Frame> m_frame;
+        bool m_scriptObjectCreated;
 
-    private:
     };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorDatabaseResource.cpp b/WebCore/inspector/InspectorDatabaseResource.cpp
index 43cd8ef..b61344c 100644
--- a/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -35,9 +35,10 @@
 #include "Database.h"
 #include "Document.h"
 #include "Frame.h"
-#include "ScriptFunctionCall.h"
+#include "InspectorFrontend.h"
+#include "JSONObject.h"
 #include "ScriptObjectQuarantine.h"
-#include "ScriptValue.h"
+
 
 namespace WebCore {
 
@@ -46,42 +47,30 @@
     , m_domain(domain)
     , m_name(name)
     , m_version(version)
+    , m_scriptObjectCreated(false)
 {
 }
 
-void InspectorDatabaseResource::bind(ScriptState* scriptState, const ScriptObject& webInspector)
+void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
 {
-    if (!m_scriptObject.hasNoValue())
+    if (m_scriptObjectCreated)
         return;
 
-    ASSERT(scriptState);
-    ASSERT(!webInspector.hasNoValue());
-    if (!scriptState || webInspector.hasNoValue())
-        return;
-
-    ScriptFunctionCall resourceConstructor(scriptState, webInspector, "Database");
+    JSONObject jsonObject = frontend->newJSONObject();
     ScriptObject database;
     if (!getQuarantinedScriptObject(m_database.get(), database))
         return;
-
-    resourceConstructor.appendArgument(database);
-    resourceConstructor.appendArgument(m_domain);
-    resourceConstructor.appendArgument(m_name);
-    resourceConstructor.appendArgument(m_version);
-
-    bool hadException = false;
-    m_scriptObject = resourceConstructor.construct(hadException);
-    if (hadException)
-        return;
-
-    ScriptFunctionCall addDatabase(scriptState, webInspector, "addDatabase");
-    addDatabase.appendArgument(m_scriptObject);
-    addDatabase.call(hadException);
+    jsonObject.set("database", database);
+    jsonObject.set("domain", m_domain);
+    jsonObject.set("name", m_name);
+    jsonObject.set("version", m_version);
+    if (frontend->addDatabase(jsonObject))
+        m_scriptObjectCreated = true;
 }
 
 void InspectorDatabaseResource::unbind()
 {
-    m_scriptObject = ScriptObject();
+    m_scriptObjectCreated = false;
 }
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorDatabaseResource.h b/WebCore/inspector/InspectorDatabaseResource.h
index 1be2334..38f9fa1 100644
--- a/WebCore/inspector/InspectorDatabaseResource.h
+++ b/WebCore/inspector/InspectorDatabaseResource.h
@@ -42,7 +42,8 @@
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
-
+    class InspectorFrontend;
+    
     class InspectorDatabaseResource : public RefCounted<InspectorDatabaseResource> {
     public:
         static PassRefPtr<InspectorDatabaseResource> create(Database* database, const String& domain, const String& name, const String& version)
@@ -50,17 +51,18 @@
             return adoptRef(new InspectorDatabaseResource(database, domain, name, version));
         }
 
-        void bind(ScriptState*, const ScriptObject& webInspector);
+        void bind(InspectorFrontend* frontend);
         void unbind();
 
     private:
         InspectorDatabaseResource(Database*, const String& domain, const String& name, const String& version);
-        ScriptObject m_scriptObject;
-
+        
         RefPtr<Database> m_database;
         String m_domain;
         String m_name;
         String m_version;
+        bool m_scriptObjectCreated;
+
     };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorFrontend.cpp b/WebCore/inspector/InspectorFrontend.cpp
new file mode 100644
index 0000000..aacbb90
--- /dev/null
+++ b/WebCore/inspector/InspectorFrontend.cpp
@@ -0,0 +1,298 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorFrontend.h"
+
+#include "ConsoleMessage.h"
+#include "Frame.h"
+#include "InspectorController.h"  // TODO(pfeldman): Extract SpecialPanels to remove include.
+#include "JSONObject.h"
+#include "Node.h"
+#include "ScriptFunctionCall.h"
+#include "ScriptObject.h"
+#include "ScriptObjectQuarantine.h"
+#include "ScriptState.h"
+#include "ScriptString.h"
+#include <wtf/OwnPtr.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include <parser/SourceCode.h>
+#include <runtime/JSValue.h>
+#include <runtime/UString.h>
+#endif
+
+namespace WebCore {
+
+InspectorFrontend::InspectorFrontend(ScriptState* scriptState, ScriptObject webInspector)
+    : m_scriptState(scriptState)
+    , m_webInspector(webInspector)
+{
+}
+
+InspectorFrontend::~InspectorFrontend() 
+{
+    m_webInspector = ScriptObject();
+}
+
+JSONObject InspectorFrontend::newJSONObject() {
+    return JSONObject::createNew(m_scriptState);
+}
+
+void InspectorFrontend::addMessageToConsole(const JSONObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addMessageToConsole"));
+    function->appendArgument(messageObj.scriptObject());
+    if (!frames.isEmpty()) {
+        for (unsigned i = 0; i < frames.size(); ++i)
+            function->appendArgument(frames[i]);
+    } else if (!wrappedArguments.isEmpty()) {
+        for (unsigned i = 0; i < wrappedArguments.size(); ++i)
+            function->appendArgument(wrappedArguments[i]);
+    } else
+        function->appendArgument(message);
+    function->call();
+}
+
+bool InspectorFrontend::addResource(long long identifier, const JSONObject& resourceObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addResource"));
+    function->appendArgument(identifier);
+    function->appendArgument(resourceObj.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+bool InspectorFrontend::updateResource(long long identifier, const JSONObject& resourceObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateResource"));
+    function->appendArgument(identifier);
+    function->appendArgument(resourceObj.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+void InspectorFrontend::removeResource(long long identifier)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("removeResource"));
+    function->appendArgument(identifier);
+    function->call();
+}
+
+void InspectorFrontend::updateFocusedNode(Node* node)
+{
+    ScriptObject quarantinedNode;
+    if (!getQuarantinedScriptObject(node, quarantinedNode))
+        return;
+
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateFocusedNode"));
+    function->appendArgument(quarantinedNode);
+    function->call();
+}
+
+void InspectorFrontend::setAttachedWindow(bool attached)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setAttachedWindow"));
+    function->appendArgument(attached);
+    function->call();
+}
+
+void InspectorFrontend::inspectedWindowScriptObjectCleared(Frame* frame)
+{
+    ScriptObject domWindow;
+    if (!getQuarantinedScriptObject(frame->domWindow(), domWindow))
+        return;
+
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("inspectedWindowCleared"));
+    function->appendArgument(domWindow);
+    function->call();
+}
+
+void InspectorFrontend::showPanel(int panel)
+{
+    const char* showFunctionName;
+    switch (panel) {
+        case InspectorController::ConsolePanel:
+            showFunctionName = "showConsole";
+            break;
+        case InspectorController::DatabasesPanel:
+            showFunctionName = "showDatabasesPanel";
+            break;
+        case InspectorController::ElementsPanel:
+            showFunctionName = "showElementsPanel";
+            break;
+        case InspectorController::ProfilesPanel:
+            showFunctionName = "showProfilesPanel";
+            break;
+        case InspectorController::ResourcesPanel:
+            showFunctionName = "showResourcesPanel";
+            break;
+        case InspectorController::ScriptsPanel:
+            showFunctionName = "showScriptsPanel";
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            showFunctionName = 0;
+    }
+
+    if (showFunctionName)
+        callSimpleFunction(showFunctionName);
+}
+
+void InspectorFrontend::populateInterface()
+{
+    callSimpleFunction("populateInterface");
+}
+
+void InspectorFrontend::reset()
+{
+    callSimpleFunction("reset");
+}
+
+void InspectorFrontend::resourceTrackingWasEnabled()
+{
+    callSimpleFunction("resourceTrackingWasEnabled");
+}
+
+void InspectorFrontend::resourceTrackingWasDisabled()
+{
+    callSimpleFunction("resourceTrackingWasDisabled");
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+void InspectorFrontend::attachDebuggerWhenShown()
+{
+    callSimpleFunction("attachDebuggerWhenShown");
+}
+
+void InspectorFrontend::debuggerWasEnabled()
+{
+    callSimpleFunction("debuggerWasEnabled");
+}
+
+void InspectorFrontend::debuggerWasDisabled()
+{
+    callSimpleFunction("debuggerWasDisabled");
+}
+
+void InspectorFrontend::profilerWasEnabled()
+{
+    callSimpleFunction("profilerWasEnabled");
+}
+
+void InspectorFrontend::profilerWasDisabled()
+{
+    callSimpleFunction("profilerWasDisabled");
+}
+
+void InspectorFrontend::parsedScriptSource(const JSC::SourceCode& source)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("parsedScriptSource"));
+    function->appendArgument(static_cast<long long>(source.provider()->asID()));
+    function->appendArgument(source.provider()->url());
+    function->appendArgument(JSC::UString(source.data(), source.length()));
+    function->appendArgument(source.firstLine());
+    function->call();
+}
+
+void InspectorFrontend::failedToParseScriptSource(const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("failedToParseScriptSource"));
+    function->appendArgument(source.provider()->url());
+    function->appendArgument(JSC::UString(source.data(), source.length()));
+    function->appendArgument(source.firstLine());
+    function->appendArgument(errorLine);
+    function->appendArgument(errorMessage);
+    function->call();
+}
+
+void InspectorFrontend::addProfile(const JSC::JSValue& profile)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfile"));
+    function->appendArgument(profile);
+    function->call();
+}
+
+void InspectorFrontend::setRecordingProfile(bool isProfiling)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setRecordingProfile"));
+    function->appendArgument(isProfiling);
+    function->call();
+}
+
+void InspectorFrontend::pausedScript()
+{
+    callSimpleFunction("pausedScript");
+}
+
+void InspectorFrontend::resumedScript()
+{
+    callSimpleFunction("resumedScript");
+}
+#endif
+
+#if ENABLE(DATABASE)
+bool InspectorFrontend::addDatabase(const JSONObject& dbObject)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
+    function->appendArgument(dbObject.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+bool InspectorFrontend::addDOMStorage(const JSONObject& domStorageObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
+    function->appendArgument(domStorageObj.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+#endif
+
+PassOwnPtr<ScriptFunctionCall> InspectorFrontend::newFunctionCall(const String& functionName)
+{
+    ScriptFunctionCall* function = new ScriptFunctionCall(m_scriptState, m_webInspector, "dispatch");
+    function->appendArgument(functionName);
+    return function;
+}
+
+void InspectorFrontend::callSimpleFunction(const String& functionName)
+{
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch");
+    function.appendArgument(functionName);
+    function.call();
+}
+
+} // namespace WebCore
diff --git a/WebCore/inspector/InspectorFrontend.h b/WebCore/inspector/InspectorFrontend.h
new file mode 100644
index 0000000..d596b3f
--- /dev/null
+++ b/WebCore/inspector/InspectorFrontend.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorFrontend_h
+#define InspectorFrontend_h
+
+#include "JSONObject.h"
+#include "ScriptState.h"
+#include <wtf/PassOwnPtr.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+namespace JSC {
+    class JSValue;
+    class SourceCode;
+    class UString;
+}
+#endif
+
+namespace WebCore {
+    class ConsoleMessage;
+    class InspectorResource;
+    class Node;
+    class ScriptFunctionCall;
+    class ScriptString;
+
+    class InspectorFrontend {
+    public:
+        InspectorFrontend(ScriptState*, ScriptObject webInspector);
+        ~InspectorFrontend();
+        JSONObject newJSONObject();
+
+        void addMessageToConsole(const JSONObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
+        
+        bool addResource(long long identifier, const JSONObject& resourceObj);
+        bool updateResource(long long identifier, const JSONObject& resourceObj);
+        void removeResource(long long identifier);
+
+        void updateFocusedNode(Node* node);
+        void setAttachedWindow(bool attached);
+        void inspectedWindowScriptObjectCleared(Frame* frame);
+        void showPanel(int panel);
+        void populateInterface();
+        void reset();
+
+        void resourceTrackingWasEnabled();
+        void resourceTrackingWasDisabled();
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        void attachDebuggerWhenShown();
+        void debuggerWasEnabled();
+        void debuggerWasDisabled();
+        void profilerWasEnabled();
+        void profilerWasDisabled();
+        void parsedScriptSource(const JSC::SourceCode&);
+        void failedToParseScriptSource(const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
+        void addProfile(const JSC::JSValue& profile);
+        void setRecordingProfile(bool isProfiling);
+        void pausedScript();
+        void resumedScript();
+#endif
+
+#if ENABLE(DATABASE)
+        bool addDatabase(const JSONObject& dbObj);
+#endif
+        
+#if ENABLE(DOM_STORAGE)
+        bool addDOMStorage(const JSONObject& domStorageObj);
+#endif
+
+    private:
+        PassOwnPtr<ScriptFunctionCall> newFunctionCall(const String& functionName);
+        void callSimpleFunction(const String& functionName);
+        ScriptState* m_scriptState;
+        ScriptObject m_webInspector;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(InspectorFrontend_h)
diff --git a/WebCore/inspector/InspectorResource.cpp b/WebCore/inspector/InspectorResource.cpp
index 7db6cd1..6184119 100644
--- a/WebCore/inspector/InspectorResource.cpp
+++ b/WebCore/inspector/InspectorResource.cpp
@@ -35,66 +35,195 @@
 #include "DocLoader.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
+#include "InspectorFrontend.h"
+#include "JSONObject.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
 #include "TextEncoding.h"
 
-#include <runtime/JSLock.h>
-
 namespace WebCore {
 
-// XMLHttpRequestResource Class
-
-struct XMLHttpRequestResource {
-    XMLHttpRequestResource(const JSC::UString& sourceString)
-    {
-        JSC::JSLock lock(false);
-        this->sourceString = sourceString.rep();
-    }
-
-    ~XMLHttpRequestResource()
-    {
-        JSC::JSLock lock(false);
-        sourceString.clear();
-    }
-
-    RefPtr<JSC::UString::Rep> sourceString;
-};
-
-    InspectorResource::InspectorResource(long long identifier, DocumentLoader* documentLoader, Frame* frame)
-    : identifier(identifier)
-    , loader(documentLoader)
-    , frame(frame)
-    , scriptContext(0)
-    , scriptObject(0)
-    , expectedContentLength(0)
-    , cached(false)
-    , finished(false)
-    , failed(false)
-    , length(0)
-    , responseStatusCode(0)
-    , startTime(-1.0)
-    , responseReceivedTime(-1.0)
-    , endTime(-1.0)
-    , xmlHttpRequestResource(0)
-    {
-    }
+InspectorResource::InspectorResource(long long identifier, DocumentLoader* loader)
+    : m_identifier(identifier)
+    , m_loader(loader)
+    , m_frame(loader->frame())
+    , m_scriptObjectCreated(false)
+    , m_expectedContentLength(0)
+    , m_cached(false)
+    , m_finished(false)
+    , m_failed(false)
+    , m_length(0)
+    , m_responseStatusCode(0)
+    , m_startTime(-1.0)
+    , m_responseReceivedTime(-1.0)
+    , m_endTime(-1.0)
+    , m_isMainResource(false)
+{
+}
 
 InspectorResource::~InspectorResource()
 {
-    setScriptObject(0, 0);
+}
+
+PassRefPtr<InspectorResource> InspectorResource::createCached(long long identifier, DocumentLoader* loader, const CachedResource* cachedResource)
+{
+    PassRefPtr<InspectorResource> resource = create(identifier, loader);
+
+    resource->m_finished = true;
+
+    resource->m_requestURL = KURL(cachedResource->url());
+    resource->updateResponse(cachedResource->response());
+
+    resource->m_length = cachedResource->encodedSize();
+    resource->m_cached = true;
+    resource->m_startTime = currentTime();
+    resource->m_responseReceivedTime = resource->m_startTime;
+    resource->m_endTime = resource->m_startTime;
+
+    resource->m_changes.setAll();
+
+    return resource;
+}
+
+void InspectorResource::updateRequest(const ResourceRequest& request)
+{
+    m_requestHeaderFields = request.httpHeaderFields();
+    m_requestURL = request.url();
+
+    m_changes.set(RequestChange);
+}
+
+void InspectorResource::updateResponse(const ResourceResponse& response)
+{
+    m_expectedContentLength = response.expectedContentLength();
+    m_mimeType = response.mimeType();
+    m_responseHeaderFields = response.httpHeaderFields();
+    m_responseStatusCode = response.httpStatusCode();
+    m_suggestedFilename = response.suggestedFilename();
+
+    m_changes.set(ResponseChange);
+    m_changes.set(TypeChange);
+}
+
+static void populateHeadersObject(JSONObject* object, const HTTPHeaderMap& headers)
+{
+    HTTPHeaderMap::const_iterator end = headers.end();
+    for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it) {
+        object->set(it->first.string(), it->second);
+    }
+}
+
+void InspectorResource::createScriptObject(InspectorFrontend* frontend)
+{
+    if (!m_scriptObjectCreated) {
+        JSONObject jsonObject = frontend->newJSONObject();
+        JSONObject requestHeaders = frontend->newJSONObject();
+        populateHeadersObject(&requestHeaders, m_requestHeaderFields);
+        jsonObject.set("requestHeaders", requestHeaders);
+        jsonObject.set("requestURL", requestURL());
+        jsonObject.set("host", m_requestURL.host());
+        jsonObject.set("path", m_requestURL.path());
+        jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
+        jsonObject.set("isMainResource", m_isMainResource);
+        jsonObject.set("cached", m_cached);
+        if (!frontend->addResource(m_identifier, jsonObject))
+            return;
+
+        m_scriptObjectCreated = true;
+        m_changes.clear(RequestChange);
+    }
+    updateScriptObject(frontend);
+}
+
+void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
+{
+    if (!m_scriptObjectCreated)
+        return;
+
+    if (m_changes.hasChange(NoChange))
+        return;
+
+    JSONObject jsonObject = frontend->newJSONObject();
+    if (m_changes.hasChange(RequestChange)) {
+        jsonObject.set("url", requestURL());
+        jsonObject.set("domain", m_requestURL.host());
+        jsonObject.set("path", m_requestURL.path());
+        jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
+        JSONObject requestHeaders = frontend->newJSONObject();
+        populateHeadersObject(&requestHeaders, m_requestHeaderFields);
+        jsonObject.set("requestHeaders", requestHeaders);
+        jsonObject.set("mainResource", m_isMainResource);
+        jsonObject.set("didRequestChange", true);
+    }
+
+    if (m_changes.hasChange(ResponseChange)) {
+        jsonObject.set("mimeType", m_mimeType);
+        jsonObject.set("suggestedFilename", m_suggestedFilename);
+        jsonObject.set("expectedContentLength", m_expectedContentLength);
+        jsonObject.set("statusCode", m_responseStatusCode);
+        jsonObject.set("suggestedFilename", m_suggestedFilename);
+        JSONObject responseHeaders = frontend->newJSONObject();
+        populateHeadersObject(&responseHeaders, m_responseHeaderFields);
+        jsonObject.set("responseHeaders", responseHeaders);
+        jsonObject.set("didResponseChange", true);
+    }
+
+    if (m_changes.hasChange(TypeChange)) {
+        jsonObject.set("type", static_cast<int>(type()));
+        jsonObject.set("didTypeChange", true);
+    }
+    
+    if (m_changes.hasChange(LengthChange)) {
+        jsonObject.set("contentLength", m_length);
+        jsonObject.set("didLengthChange", true);
+    }
+
+    if (m_changes.hasChange(CompletionChange)) {
+        jsonObject.set("failed", m_failed);
+        jsonObject.set("finished", m_finished);
+        jsonObject.set("didCompletionChange", true);
+    }
+
+    if (m_changes.hasChange(TimingChange)) {
+        if (m_startTime > 0)
+            jsonObject.set("startTime", m_startTime);
+        if (m_responseReceivedTime > 0)
+            jsonObject.set("responseReceivedTime", m_responseReceivedTime);
+        if (m_endTime > 0)
+            jsonObject.set("endTime", m_endTime);
+        jsonObject.set("didTimingChange", true);
+    }
+    if (!frontend->updateResource(m_identifier, jsonObject))
+        return;
+    m_changes.clearAll();
+}
+
+void InspectorResource::releaseScriptObject(InspectorFrontend* frontend, bool callRemoveResource)
+{
+    if (!m_scriptObjectCreated)
+        return;
+
+    m_scriptObjectCreated = false;
+    m_changes.setAll();
+
+    if (!callRemoveResource)
+        return;
+
+    frontend->removeResource(m_identifier);
 }
 
 InspectorResource::Type InspectorResource::type() const
 {
-    if (xmlHttpRequestResource)
+    if (!m_xmlHttpResponseText.isNull())
         return XHR;
 
-    if (requestURL == loader->requestURL())
+    if (m_requestURL == m_loader->requestURL())
         return Doc;
 
-    if (loader->frameLoader() && requestURL == loader->frameLoader()->iconURL())
+    if (m_loader->frameLoader() && m_requestURL == m_loader->frameLoader()->iconURL())
         return Image;
 
-    CachedResource* cachedResource = frame->document()->docLoader()->cachedResource(requestURL.string());
+    CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
     if (!cachedResource)
         return Other;
 
@@ -115,42 +244,25 @@
     }
 }
 
-void InspectorResource::setScriptObject(JSContextRef context, JSObjectRef newScriptObject)
+void InspectorResource::setXMLHttpResponseText(const ScriptString& data)
 {
-    if (scriptContext && scriptObject)
-        JSValueUnprotect(scriptContext, scriptObject);
-
-    scriptObject = newScriptObject;
-    scriptContext = context;
-
-    ASSERT((context && newScriptObject) || (!context && !newScriptObject));
-    if (context && newScriptObject)
-        JSValueProtect(context, newScriptObject);
-}
-
-void InspectorResource::setXMLHttpRequestProperties(const JSC::UString& data)
-{
-    xmlHttpRequestResource.set(new XMLHttpRequestResource(data));
-}
-
-void InspectorResource::setScriptProperties(const JSC::UString& data)
-{
-    xmlHttpRequestResource.set(new XMLHttpRequestResource(data));
+    m_xmlHttpResponseText = data;
+    m_changes.set(TypeChange);
 }
 
 String InspectorResource::sourceString() const
 {
-    if (xmlHttpRequestResource)
-        return JSC::UString(xmlHttpRequestResource->sourceString);
+    if (!m_xmlHttpResponseText.isNull())
+        return String(m_xmlHttpResponseText);
 
     RefPtr<SharedBuffer> buffer;
     String textEncodingName;
 
-    if (requestURL == loader->requestURL()) {
-        buffer = loader->mainResourceData();
-        textEncodingName = frame->document()->inputEncoding();
+    if (m_requestURL == m_loader->requestURL()) {
+        buffer = m_loader->mainResourceData();
+        textEncodingName = m_frame->document()->inputEncoding();
     } else {
-        CachedResource* cachedResource = frame->document()->docLoader()->cachedResource(requestURL.string());
+        CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
         if (!cachedResource)
             return String();
 
@@ -178,4 +290,36 @@
     return encoding.decode(buffer->data(), buffer->size());
 }
 
+void InspectorResource::startTiming()
+{
+    m_startTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
+void InspectorResource::markResponseReceivedTime()
+{
+    m_responseReceivedTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
+void InspectorResource::endTiming()
+{
+    m_endTime = currentTime();
+    m_finished = true;
+    m_changes.set(TimingChange);
+    m_changes.set(CompletionChange);
+}
+
+void InspectorResource::markFailed()
+{
+    m_failed = true;
+    m_changes.set(CompletionChange);
+}
+
+void InspectorResource::addLength(int lengthReceived)
+{
+    m_length += lengthReceived;
+    m_changes.set(LengthChange);
+}
+
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorResource.h b/WebCore/inspector/InspectorResource.h
index 46d7fed..8380a8f 100644
--- a/WebCore/inspector/InspectorResource.h
+++ b/WebCore/inspector/InspectorResource.h
@@ -31,24 +31,27 @@
 #ifndef InspectorResource_h
 #define InspectorResource_h
 
-#include <JavaScriptCore/JSContextRef.h>
-
 #include "HTTPHeaderMap.h"
 #include "KURL.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+#include "ScriptString.h"
 
+#include <wtf/CurrentTime.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
-namespace JSC {
-    class UString;
-}
-
 namespace WebCore {
+
+    class CachedResource;
     class DocumentLoader;
+    class InspectorFrontend;
     class Frame;
-    struct XMLHttpRequestResource;
+    class ResourceResponse;
+
+    struct ResourceRequest;
 
     class InspectorResource : public RefCounted<InspectorResource> {
     public:
@@ -65,43 +68,94 @@
             Other
         };
 
-        static PassRefPtr<InspectorResource> create(long long identifier, DocumentLoader* documentLoader, Frame* frame)
+        static PassRefPtr<InspectorResource> create(long long identifier, DocumentLoader* loader)
         {
-            return adoptRef(new InspectorResource(identifier, documentLoader, frame));
+            return adoptRef(new InspectorResource(identifier, loader));
         }
 
+        static PassRefPtr<InspectorResource> createCached(long long identifier, DocumentLoader*, const CachedResource*);
+
         ~InspectorResource();
-        Type type() const;
-        void setScriptObject(JSContextRef, JSObjectRef);
-        void setXMLHttpRequestProperties(const JSC::UString& data);
-        void setScriptProperties(const JSC::UString& data);
+
+        void createScriptObject(InspectorFrontend* frontend);
+        void updateScriptObject(InspectorFrontend* frontend);
+        void releaseScriptObject(InspectorFrontend* frontend, bool callRemoveResource);
+
+        void updateRequest(const ResourceRequest&);
+        void updateResponse(const ResourceResponse&);
+
+        void setXMLHttpResponseText(const ScriptString& data);
 
         String sourceString() const;
+        bool isSameLoader(DocumentLoader* loader) const { return loader == m_loader; }
+        void markMainResource() { m_isMainResource = true; }
+        long long identifier() const { return m_identifier; }
+        String requestURL() const { return m_requestURL.string(); }
+        Frame* frame() const { return m_frame.get(); }
+        const String& mimeType() const { return m_mimeType; }
+        void startTiming();
+        void markResponseReceivedTime();
+        void endTiming();
 
-        long long identifier;
-        RefPtr<DocumentLoader> loader;
-        RefPtr<Frame> frame;
-        KURL requestURL;
-        HTTPHeaderMap requestHeaderFields;
-        HTTPHeaderMap responseHeaderFields;
-        String mimeType;
-        String suggestedFilename;
-        JSContextRef scriptContext;
-        JSObjectRef scriptObject;
-        long long expectedContentLength;
-        bool cached;
-        bool finished;
-        bool failed;
-        int length;
-        int responseStatusCode;
-        double startTime;
-        double responseReceivedTime;
-        double endTime;
+        void markFailed();
+        void addLength(int lengthReceived);
 
     private:
-        InspectorResource(long long identifier, DocumentLoader*, Frame*);
+        enum ChangeType {
+            NoChange = 0,
+            RequestChange = 1,
+            ResponseChange = 2,
+            TypeChange = 4,
+            LengthChange = 8,
+            CompletionChange = 16,
+            TimingChange = 32
+        };
 
-        OwnPtr<XMLHttpRequestResource> xmlHttpRequestResource;
+        class Changes {
+        public:
+            Changes() : m_change(NoChange) {}
+
+            inline bool hasChange(ChangeType change) { return (m_change & change) || !(m_change + change); }
+            inline void set(ChangeType change)
+            {
+                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) | static_cast<unsigned>(change));            
+            }
+            inline void clear(ChangeType change)
+            {
+                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) & ~static_cast<unsigned>(change));
+            }
+
+            inline void setAll() { m_change = static_cast<ChangeType>(63); }
+            inline void clearAll() { m_change = NoChange; }
+
+        private:
+            ChangeType m_change;
+        };
+
+        InspectorResource(long long identifier, DocumentLoader*);
+        Type type() const;
+
+        long long m_identifier;
+        RefPtr<DocumentLoader> m_loader;
+        RefPtr<Frame> m_frame;
+        KURL m_requestURL;
+        HTTPHeaderMap m_requestHeaderFields;
+        HTTPHeaderMap m_responseHeaderFields;
+        String m_mimeType;
+        String m_suggestedFilename;
+        bool m_scriptObjectCreated;
+        long long m_expectedContentLength;
+        bool m_cached;
+        bool m_finished;
+        bool m_failed;
+        int m_length;
+        int m_responseStatusCode;
+        double m_startTime;
+        double m_responseReceivedTime;
+        double m_endTime;
+        ScriptString m_xmlHttpResponseText;
+        Changes m_changes;
+        bool m_isMainResource;
     };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/JSONObject.cpp b/WebCore/inspector/JSONObject.cpp
new file mode 100644
index 0000000..b13ddee
--- /dev/null
+++ b/WebCore/inspector/JSONObject.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSONObject.h"
+
+#include "PlatformString.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+namespace WebCore {
+
+JSONObject::JSONObject(ScriptState* scriptState)
+    : m_scriptState(scriptState)
+{
+    m_scriptObject = ScriptObject::createNew(scriptState);
+}
+
+bool JSONObject::set(const String& name, const String& value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, const ScriptObject& value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, const JSONObject& value)
+{
+    return set(name, value.scriptObject());
+}
+
+bool JSONObject::set(const char* name, const String& value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, double value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, long long value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, int value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool JSONObject::set(const char* name, bool value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+ScriptObject JSONObject::scriptObject() const
+{
+    return m_scriptObject;
+}
+
+JSONObject JSONObject::createNew(ScriptState* scriptState)
+{
+    return JSONObject(scriptState);
+}
+
+} // namespace WebCore
diff --git a/WebCore/page/AccessibilityList.h b/WebCore/inspector/JSONObject.h
similarity index 62%
copy from WebCore/page/AccessibilityList.h
copy to WebCore/inspector/JSONObject.h
index 315ccac..39e64f0 100644
--- a/WebCore/page/AccessibilityList.h
+++ b/WebCore/inspector/JSONObject.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,31 +27,34 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef AccessibilityList_h
-#define AccessibilityList_h
 
-#include "AccessibilityRenderObject.h"
+#ifndef JSONObject_h
+#define JSONObject_h
+
+#include "ScriptObject.h"
+#include "ScriptState.h"
 
 namespace WebCore {
-    
-class AccessibilityList : public AccessibilityRenderObject {
-    
-private:
-    AccessibilityList(RenderObject*);
-public:
-    static PassRefPtr<AccessibilityList> create(RenderObject*);
-    virtual ~AccessibilityList();
-    
-    virtual bool isList() const { return true; };
-    bool isUnorderedList() const;
-    bool isOrderedList() const;
-    bool isDefinitionList() const;
+    class String;
 
-    virtual AccessibilityRole roleValue() const { return ListRole; }
-    virtual bool accessibilityIsIgnored() const;
-    
-};
-    
-} // namespace WebCore
+    class JSONObject {
+    public:
+        bool set(const String& name, const String&);
+        bool set(const char* name, const JSONObject&);
+        bool set(const char* name, const ScriptObject&);
+        bool set(const char* name, const String&);
+        bool set(const char* name, double);
+        bool set(const char* name, long long);
+        bool set(const char* name, int);
+        bool set(const char* name, bool);
+        ScriptObject scriptObject() const;
 
-#endif // AccessibilityList_h
+        static JSONObject createNew(ScriptState* scriptState);
+    private:
+        JSONObject(ScriptState* scriptState);
+        ScriptState* m_scriptState;
+        ScriptObject m_scriptObject;
+    };
+}
+
+#endif // JSONObject_h
diff --git a/WebCore/inspector/JavaScriptCallFrame.cpp b/WebCore/inspector/JavaScriptCallFrame.cpp
index 4962892..6e8fce9 100644
--- a/WebCore/inspector/JavaScriptCallFrame.cpp
+++ b/WebCore/inspector/JavaScriptCallFrame.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JavaScriptCallFrame.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "PlatformString.h"
 #include <debugger/DebuggerCallFrame.h>
 #include <runtime/JSGlobalObject.h>
@@ -37,7 +39,7 @@
 using namespace JSC;
 
 namespace WebCore {
-
+    
 JavaScriptCallFrame::JavaScriptCallFrame(const DebuggerCallFrame& debuggerCallFrame, PassRefPtr<JavaScriptCallFrame> caller, intptr_t sourceID, int line)
     : m_debuggerCallFrame(debuggerCallFrame)
     , m_caller(caller)
@@ -65,10 +67,10 @@
     ASSERT(m_isValid);
     if (!m_isValid)
         return String();
-    const UString* functionName = m_debuggerCallFrame.functionName();
-    if (!functionName)
+    UString functionName = m_debuggerCallFrame.calculatedFunctionName();
+    if (functionName.isEmpty())
         return String();
-    return *functionName;
+    return functionName;
 }
 
 DebuggerCallFrame::Type JavaScriptCallFrame::type() const
@@ -88,7 +90,7 @@
 }
 
 // Evaluate some JavaScript code in the scope of this frame.
-JSValuePtr JavaScriptCallFrame::evaluate(const UString& script, JSValuePtr& exception) const
+JSValue JavaScriptCallFrame::evaluate(const UString& script, JSValue& exception) const
 {
     ASSERT(m_isValid);
     if (!m_isValid)
@@ -99,3 +101,5 @@
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/WebCore/inspector/JavaScriptCallFrame.h b/WebCore/inspector/JavaScriptCallFrame.h
index 6b55bb9..9f193d8 100644
--- a/WebCore/inspector/JavaScriptCallFrame.h
+++ b/WebCore/inspector/JavaScriptCallFrame.h
@@ -26,6 +26,8 @@
 #ifndef JavaScriptCallFrame_h
 #define JavaScriptCallFrame_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include <interpreter/CallFrame.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -61,18 +63,20 @@
         const JSC::ScopeChainNode* scopeChain() const;
 
         JSC::JSObject* thisObject() const;
-        JSC::JSValuePtr evaluate(const JSC::UString& script, JSC::JSValuePtr& exception) const;
+        JSC::JSValue evaluate(const JSC::UString& script, JSC::JSValue& exception) const;
         
     private:
         JavaScriptCallFrame(const JSC::DebuggerCallFrame&, PassRefPtr<JavaScriptCallFrame> caller, intptr_t sourceID, int line);
 
         JSC::DebuggerCallFrame m_debuggerCallFrame;
         RefPtr<JavaScriptCallFrame> m_caller;
-        int m_sourceID;
+        intptr_t m_sourceID;
         int m_line;
         bool m_isValid;
     };
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif // JavaScriptCallFrame_h
diff --git a/WebCore/inspector/JavaScriptCallFrame.idl b/WebCore/inspector/JavaScriptCallFrame.idl
index 96e4c6e..2f247f0 100644
--- a/WebCore/inspector/JavaScriptCallFrame.idl
+++ b/WebCore/inspector/JavaScriptCallFrame.idl
@@ -25,7 +25,7 @@
 
 module inspector {
 
-    interface JavaScriptCallFrame {
+    interface [Conditional=JAVASCRIPT_DEBUGGER] JavaScriptCallFrame {
         [Custom] void evaluate(in DOMString script);
 
         readonly attribute JavaScriptCallFrame caller;
diff --git a/WebCore/inspector/JavaScriptDebugListener.h b/WebCore/inspector/JavaScriptDebugListener.h
index f1cd77f..912a751 100644
--- a/WebCore/inspector/JavaScriptDebugListener.h
+++ b/WebCore/inspector/JavaScriptDebugListener.h
@@ -29,6 +29,8 @@
 #ifndef JavaScriptDebugListener_h
 #define JavaScriptDebugListener_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 namespace JSC {
     class ExecState;
     class SourceCode;
@@ -47,8 +49,11 @@
         virtual void didParseSource(JSC::ExecState*, const JSC::SourceCode& source) = 0;
         virtual void failedToParseSource(JSC::ExecState*, const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage) = 0;
         virtual void didPause() = 0;
+        virtual void didContinue() = 0;
     };
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif // JavaScriptDebugListener_h
diff --git a/WebCore/inspector/JavaScriptDebugServer.cpp b/WebCore/inspector/JavaScriptDebugServer.cpp
index 62ccad4..bb6358c 100644
--- a/WebCore/inspector/JavaScriptDebugServer.cpp
+++ b/WebCore/inspector/JavaScriptDebugServer.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JavaScriptDebugServer.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "DOMWindow.h"
 #include "EventLoop.h"
 #include "Frame.h"
@@ -431,6 +433,8 @@
     setJavaScriptPaused(page->group(), false);
 
     m_paused = false;
+
+    dispatchFunctionToListeners(&JavaScriptDebugListener::didContinue, page);
 }
 
 void JavaScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
@@ -549,8 +553,11 @@
     Vector<ProtectedPtr<JSFunction> > functions;
     Heap::iterator heapEnd = globalData->heap.primaryHeapEnd();
     for (Heap::iterator it = globalData->heap.primaryHeapBegin(); it != heapEnd; ++it) {
-        if ((*it)->isObject(&JSFunction::info))
-            functions.append(static_cast<JSFunction*>(*it));
+        if ((*it)->isObject(&JSFunction::info)) {
+            JSFunction* function = static_cast<JSFunction*>(*it);
+            if (!function->isHostFunction())
+                functions.append(function);
+        }
     }
 
     typedef HashMap<RefPtr<FunctionBodyNode>, RefPtr<FunctionBodyNode> > FunctionBodyMap;
@@ -580,7 +587,7 @@
         result.first->second = newBody;
         function->setBody(newBody.release());
 
-        if (hasListeners())
+        if (hasListeners() && function->scope().globalObject()->debugger() == this)
             sourceProviders.add(sourceCode.provider(), exec);
     }
 
@@ -620,3 +627,5 @@
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/WebCore/inspector/JavaScriptDebugServer.h b/WebCore/inspector/JavaScriptDebugServer.h
index 12c1099..4ec3e33 100644
--- a/WebCore/inspector/JavaScriptDebugServer.h
+++ b/WebCore/inspector/JavaScriptDebugServer.h
@@ -29,6 +29,8 @@
 #ifndef JavaScriptDebugServer_h
 #define JavaScriptDebugServer_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "Timer.h"
 #include <debugger/Debugger.h>
 #include <wtf/HashMap.h>
@@ -127,4 +129,6 @@
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif // JavaScriptDebugServer_h
diff --git a/WebCore/inspector/JavaScriptProfile.cpp b/WebCore/inspector/JavaScriptProfile.cpp
index b0be7a0..3a65fb8 100644
--- a/WebCore/inspector/JavaScriptProfile.cpp
+++ b/WebCore/inspector/JavaScriptProfile.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JavaScriptProfile.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JavaScriptProfileNode.h"
 #include <profiler/Profile.h>
 #include <JavaScriptCore/APICast.h>
@@ -68,26 +70,9 @@
     if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
         return JSValueMakeUndefined(ctx);
 
+    ExecState* exec = toJS(ctx);
     Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    return toRef(toJS(toJS(ctx), profile->head()));
-}
-
-static JSValueRef getHeavyProfileCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    return toRef(toJS(toJS(ctx), profile->heavyProfile()));
-}
-
-static JSValueRef getTreeProfileCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    return toRef(toJS(toJS(ctx), profile->treeProfile()));
+    return toRef(exec, toJS(exec, profile->head()));
 }
 
 static JSValueRef getUniqueIdCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
@@ -146,94 +131,6 @@
     return JSValueMakeUndefined(ctx);
 }
 
-static JSValueRef sortTotalTimeDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortTotalTimeDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortTotalTimeAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortTotalTimeAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortSelfTimeDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortSelfTimeDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortSelfTimeAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortSelfTimeAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortCallsDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortCallsDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortCallsAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortCallsAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortFunctionNameDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortFunctionNameDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortFunctionNameAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortFunctionNameAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
 static void finalize(JSObjectRef object)
 {
     Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(object));
@@ -246,8 +143,6 @@
     static JSStaticValue staticValues[] = {
         { "title", getTitleCallback, 0, kJSPropertyAttributeNone },
         { "head", getHeadCallback, 0, kJSPropertyAttributeNone },
-        { "heavyProfile", getHeavyProfileCallback, 0, kJSPropertyAttributeNone },
-        { "treeProfile", getTreeProfileCallback, 0, kJSPropertyAttributeNone },
         { "uid", getUniqueIdCallback, 0, kJSPropertyAttributeNone },
         { 0, 0, 0, 0 }
     };
@@ -256,14 +151,6 @@
         { "focus", focus, kJSPropertyAttributeNone },
         { "exclude", exclude, kJSPropertyAttributeNone },
         { "restoreAll", restoreAll, kJSPropertyAttributeNone },
-        { "sortTotalTimeDescending", sortTotalTimeDescending, kJSPropertyAttributeNone },
-        { "sortTotalTimeAscending", sortTotalTimeAscending, kJSPropertyAttributeNone },
-        { "sortSelfTimeDescending", sortSelfTimeDescending, kJSPropertyAttributeNone },
-        { "sortSelfTimeAscending", sortSelfTimeAscending, kJSPropertyAttributeNone },
-        { "sortCallsDescending", sortCallsDescending, kJSPropertyAttributeNone },
-        { "sortCallsAscending", sortCallsAscending, kJSPropertyAttributeNone },
-        { "sortFunctionNameDescending", sortFunctionNameDescending, kJSPropertyAttributeNone },
-        { "sortFunctionNameAscending", sortFunctionNameAscending, kJSPropertyAttributeNone },
         { 0, 0, 0 }
     };
 
@@ -276,7 +163,7 @@
     return profileClass;
 }
 
-JSValuePtr toJS(ExecState* exec, Profile* profile)
+JSValue toJS(ExecState* exec, Profile* profile)
 {
     if (!profile)
         return jsNull();
@@ -292,3 +179,5 @@
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/WebCore/inspector/JavaScriptProfile.h b/WebCore/inspector/JavaScriptProfile.h
index 4076165..28fd3e4 100644
--- a/WebCore/inspector/JavaScriptProfile.h
+++ b/WebCore/inspector/JavaScriptProfile.h
@@ -26,6 +26,8 @@
 #ifndef JavaScriptProfile_h
 #define JavaScriptProfile_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include <runtime/JSValue.h>
 
 namespace JSC {
@@ -35,8 +37,10 @@
 
 namespace WebCore {
 
-    JSC::JSValuePtr toJS(JSC::ExecState*, JSC::Profile*);
+    JSC::JSValue toJS(JSC::ExecState*, JSC::Profile*);
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif
diff --git a/WebCore/inspector/JavaScriptProfileNode.cpp b/WebCore/inspector/JavaScriptProfileNode.cpp
index 8d00783..5b5c340 100644
--- a/WebCore/inspector/JavaScriptProfileNode.cpp
+++ b/WebCore/inspector/JavaScriptProfileNode.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JavaScriptProfileNode.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JSDOMBinding.h"
 #include <profiler/ProfileNode.h>
 #include <JavaScriptCore/APICast.h>
@@ -46,7 +48,7 @@
 typedef HashMap<ProfileNode*, JSObject*> ProfileNodeMap;
 
 static ProfileNodeMap& profileNodeCache()
-{ 
+{
     DEFINE_STATIC_LOCAL(ProfileNodeMap, staticProfileNodes, ());
     return staticProfileNodes;
 }
@@ -162,7 +164,7 @@
         return JSValueMakeUndefined(ctx);
 
     JSRetainPtr<JSStringRef> pushString(Adopt, JSStringCreateWithUTF8CString("push"));
-    
+
     JSValueRef pushProperty = JSObjectGetProperty(ctx, result, pushString.get(), exception);
     if (exception && *exception)
         return JSValueMakeUndefined(ctx);
@@ -171,8 +173,9 @@
     if (exception && *exception)
         return JSValueMakeUndefined(ctx);
 
+    ExecState* exec = toJS(ctx);
     for (Vector<RefPtr<ProfileNode> >::const_iterator it = children.begin(); it != children.end(); ++it) {
-        JSValueRef arg0 = toRef(toJS(toJS(ctx), (*it).get() ));
+        JSValueRef arg0 = toRef(exec, toJS(exec, (*it).get() ));
         JSObjectCallAsFunction(ctx, pushFunction, result, 1, &arg0, exception);
         if (exception && *exception)
             return JSValueMakeUndefined(ctx);
@@ -181,6 +184,30 @@
     return result;
 }
 
+static JSValueRef getParent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(false);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    ExecState* exec = toJS(ctx);
+    return toRef(exec, toJS(exec, profileNode->parent()));
+}
+
+static JSValueRef getHead(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(false);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    ExecState* exec = toJS(ctx);
+    return toRef(exec, toJS(exec, profileNode->head()));
+}
+
 static JSValueRef getVisible(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
 {
     JSC::JSLock lock(false);
@@ -192,6 +219,17 @@
     return JSValueMakeBoolean(ctx, profileNode->visible());
 }
 
+static JSValueRef getCallUID(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(false);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->callIdentifier().hash());
+}
+
 static void finalize(JSObjectRef object)
 {
     ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(object));
@@ -211,7 +249,10 @@
         { "selfPercent", getSelfPercent, 0, kJSPropertyAttributeNone },
         { "numberOfCalls", getNumberOfCalls, 0, kJSPropertyAttributeNone },
         { "children", getChildren, 0, kJSPropertyAttributeNone },
+        { "parent", getParent, 0, kJSPropertyAttributeNone },
+        { "head", getHead, 0, kJSClassAttributeNone },
         { "visible", getVisible, 0, kJSPropertyAttributeNone },
+        { "callUID", getCallUID, 0, kJSPropertyAttributeNone },
         { 0, 0, 0, 0 }
     };
 
@@ -224,7 +265,7 @@
     return profileNodeClass;
 }
 
-JSValuePtr toJS(ExecState* exec, ProfileNode* profileNode)
+JSValue toJS(ExecState* exec, ProfileNode* profileNode)
 {
     if (!profileNode)
         return jsNull();
@@ -241,3 +282,5 @@
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/WebCore/inspector/JavaScriptProfileNode.h b/WebCore/inspector/JavaScriptProfileNode.h
index 286aac6..ad72b71 100644
--- a/WebCore/inspector/JavaScriptProfileNode.h
+++ b/WebCore/inspector/JavaScriptProfileNode.h
@@ -26,6 +26,8 @@
 #ifndef JavaScriptProfileNode_h
 #define JavaScriptProfileNode_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include <runtime/JSValue.h>
 #include <JavaScriptCore/JSBase.h>
 
@@ -37,8 +39,10 @@
 namespace WebCore {
 
     JSClassRef ProfileNodeClass();
-    JSC::JSValuePtr toJS(JSC::ExecState*, JSC::ProfileNode*);
+    JSC::JSValue toJS(JSC::ExecState*, JSC::ProfileNode*);
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif
diff --git a/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js b/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
new file mode 100644
index 0000000..89b4ddc
--- /dev/null
+++ b/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
@@ -0,0 +1,252 @@
+/*
+ * Copyright (C) 2009 280 North Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Bottom Up Profiling shows the entire callstack backwards:
+// The root node is a representation of each individual function called, and each child of that node represents
+// a reverse-callstack showing how many of those calls came from it. So, unlike top-down, the statistics in
+// each child still represent the root node. We have to be particularly careful of recursion with this mode
+// because a root node can represent itself AND an ancestor.
+
+WebInspector.BottomUpProfileDataGridTree = function(/*ProfileView*/ aProfileView, /*ProfileNode*/ aProfileNode)
+{
+    WebInspector.ProfileDataGridTree.call(this, aProfileView, aProfileNode);
+
+    // Iterate each node in pre-order.
+    var profileNodeUIDs = 0;
+    var profileNodeGroups = [[], [aProfileNode]];
+    var visitedProfileNodesForCallUID = {};
+
+    this._remainingNodeInfos = [];
+
+    for (var profileNodeGroupIndex = 0; profileNodeGroupIndex < profileNodeGroups.length; ++profileNodeGroupIndex) {
+        var parentProfileNodes = profileNodeGroups[profileNodeGroupIndex];
+        var profileNodes = profileNodeGroups[++profileNodeGroupIndex];
+        var count = profileNodes.length;
+
+        for (var index = 0; index < count; ++index) {
+            var profileNode = profileNodes[index];
+
+            if (!profileNode.UID)
+                profileNode.UID = ++profileNodeUIDs;
+
+            if (profileNode.head && profileNode !== profileNode.head) {
+                // The total time of this ancestor is accounted for if we're in any form of recursive cycle.
+                var visitedNodes = visitedProfileNodesForCallUID[profileNode.callUID];
+                var totalTimeAccountedFor = false;
+
+                if (!visitedNodes) {
+                    visitedNodes = {}
+                    visitedProfileNodesForCallUID[profileNode.callUID] = visitedNodes;
+                } else {
+                    // The total time for this node has already been accounted for iff one of it's parents has already been visited.
+                    // We can do this check in this style because we are traversing the tree in pre-order.
+                    var parentCount = parentProfileNodes.length;
+                    for (var parentIndex = 0; parentIndex < parentCount; ++parentIndex) {
+                        if (visitedNodes[parentProfileNodes[parentIndex].UID]) {
+                            totalTimeAccountedFor = true;
+                            break;
+                        }
+                    }
+                }
+
+                visitedNodes[profileNode.UID] = true;
+
+                this._remainingNodeInfos.push({ ancestor:profileNode, focusNode:profileNode, totalTimeAccountedFor:totalTimeAccountedFor });
+            }
+
+            var children = profileNode.children;
+            if (children.length) {
+                profileNodeGroups.push(parentProfileNodes.concat([profileNode]))
+                profileNodeGroups.push(children);
+            }
+        }
+    }
+
+    // Populate the top level nodes.
+    WebInspector.BottomUpProfileDataGridNode.prototype._populate.call(this);
+
+    return this;
+}
+
+WebInspector.BottomUpProfileDataGridTree.prototype = {
+    // When focusing, we keep the entire callstack up to this ancestor.
+    focus: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        if (!profileDataGridNode)
+            return;
+
+        this._save();
+
+        var currentNode = profileDataGridNode;
+        var focusNode = profileDataGridNode;
+
+        while (currentNode.parent && (currentNode instanceof WebInspector.ProfileDataGridNode)) {
+            currentNode._takePropertiesFromProfileDataGridNode(profileDataGridNode);
+
+            focusNode = currentNode;
+            currentNode = currentNode.parent;
+
+            if (currentNode instanceof WebInspector.ProfileDataGridNode)
+                currentNode._keepOnlyChild(focusNode);
+        }
+
+        this.children = [focusNode];
+        this.totalTime = profileDataGridNode.totalTime;
+    },
+
+    exclude: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        if (!profileDataGridNode)
+            return;
+
+        this._save();
+
+        var excludedCallUID = profileDataGridNode.callUID;
+        var excludedTopLevelChild = this.childrenByCallUID[excludedCallUID];
+
+        // If we have a top level node that is excluded, get rid of it completely (not keeping children),
+        // since bottom up data relies entirely on the root node.
+        if (excludedTopLevelChild)
+            this.children.remove(excludedTopLevelChild);
+
+        var children = this.children;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index)
+            children[index]._exclude(excludedCallUID);
+
+        if (this.lastComparator)
+            this.sort(this.lastComparator, true);
+    }
+}
+
+WebInspector.BottomUpProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
+
+WebInspector.BottomUpProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*BottomUpProfileDataGridTree*/ owningTree)
+{
+    // In bottom up mode, our parents are our children since we display an inverted tree.
+    // However, we don't want to show the very top parent since it is redundant.
+    var hasChildren = !!(profileNode.parent && profileNode.parent.parent);
+
+    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
+
+    this._remainingNodeInfos = [];
+}
+
+WebInspector.BottomUpProfileDataGridNode.prototype = {
+    _takePropertiesFromProfileDataGridNode: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        this._save();
+
+        this.selfTime = profileDataGridNode.selfTime;
+        this.totalTime = profileDataGridNode.totalTime;
+        this.numberOfCalls = profileDataGridNode.numberOfCalls;
+    },
+
+    // When focusing, we keep just the members of the callstack.
+    _keepOnlyChild: function(/*ProfileDataGridNode*/ child)
+    {
+        this._save();
+
+        this.removeChildren();
+        this.appendChild(child);
+    },
+
+    _exclude: function(aCallUID)
+    {
+        if (this._remainingNodeInfos)
+            this._populate();
+
+        this._save();
+
+        var children = this.children;
+        var index = this.children.length;
+
+        while (index--)
+            children[index]._exclude(aCallUID);
+
+        var child = this.childrenByCallUID[aCallUID];
+
+        if (child)
+            this._merge(child, true);
+    },
+
+    _merge: function(/*ProfileDataGridNode*/ child, /*Boolean*/ shouldAbsorb)
+    {
+        this.selfTime -= child.selfTime;
+
+        WebInspector.ProfileDataGridNode.prototype._merge.call(this, child, shouldAbsorb);
+    },
+
+    _populate: function(event)
+    {
+        var remainingNodeInfos = this._remainingNodeInfos;
+        var count = remainingNodeInfos.length;
+
+        for (var index = 0; index < count; ++index) {
+            var nodeInfo = remainingNodeInfos[index];
+            var ancestor = nodeInfo.ancestor;
+            var focusNode = nodeInfo.focusNode;
+            var child = this.findChild(ancestor);
+
+            // If we already have this child, then merge the data together.
+            if (child) {
+                var totalTimeAccountedFor = nodeInfo.totalTimeAccountedFor;
+
+                child.selfTime += focusNode.selfTime;
+                child.numberOfCalls += focusNode.numberOfCalls;
+
+                if (!totalTimeAccountedFor)
+                    child.totalTime += focusNode.totalTime;
+            } else {
+                // If not, add it as a true ancestor.
+                // In heavy mode, we take our visual identity from ancestor node...
+                var child = new WebInspector.BottomUpProfileDataGridNode(this.profileView, ancestor, this.tree);
+
+                if (ancestor !== focusNode) {
+                    // but the actual statistics from the "root" node (bottom of the callstack).
+                    child.selfTime = focusNode.selfTime;
+                    child.totalTime = focusNode.totalTime;
+                    child.numberOfCalls = focusNode.numberOfCalls;
+                }
+
+                this.appendChild(child);
+            }
+
+            var parent = ancestor.parent;
+            if (parent && parent.parent) {
+                nodeInfo.ancestor = parent;
+                child._remainingNodeInfos.push(nodeInfo);
+            }
+        }
+
+        delete this._remainingNodeInfos;
+
+        if (this.removeEventListener)
+            this.removeEventListener("populate", this._populate, this);
+    }
+}
+
+WebInspector.BottomUpProfileDataGridNode.prototype.__proto__ = WebInspector.ProfileDataGridNode.prototype;
diff --git a/WebCore/inspector/front-end/Console.js b/WebCore/inspector/front-end/Console.js
index ba879a0..65cc7d0 100644
--- a/WebCore/inspector/front-end/Console.js
+++ b/WebCore/inspector/front-end/Console.js
@@ -577,31 +577,36 @@
     this.url = url;
     this.groupLevel = groupLevel;
     this.repeatCount = repeatCount;
-
-    switch (this.level) {
-        case WebInspector.ConsoleMessage.MessageLevel.Trace:
-            var span = document.createElement("span");
-            span.addStyleClass("console-formatted-trace");
-            var stack = Array.prototype.slice.call(arguments, 6);
-            var funcNames = stack.map(function(f) {
-                return f || WebInspector.UIString("(anonymous function)");
-            });
-            span.appendChild(document.createTextNode(funcNames.join("\n")));
-            this.formattedMessage = span;
-            break;
-        case WebInspector.ConsoleMessage.MessageLevel.Object:
-            this.formattedMessage = this._format(["%O", arguments[6]]);
-            break;
-        default:
-            this.formattedMessage = this._format(Array.prototype.slice.call(arguments, 6));
-            break;
-    }
-
-    // This is used for inline message bubbles in SourceFrames, or other plain-text representations.
-    this.message = this.formattedMessage.textContent;
+    if (arguments.length > 6)
+        this.setMessageBody(Array.prototype.slice.call(arguments, 6));
 }
 
 WebInspector.ConsoleMessage.prototype = {
+    setMessageBody: function(args)
+    {
+        switch (this.level) {
+            case WebInspector.ConsoleMessage.MessageLevel.Trace:
+                var span = document.createElement("span");
+                span.addStyleClass("console-formatted-trace");
+                var stack = Array.prototype.slice.call(args);
+                var funcNames = stack.map(function(f) {
+                    return f || WebInspector.UIString("(anonymous function)");
+                });
+                span.appendChild(document.createTextNode(funcNames.join("\n")));
+                this.formattedMessage = span;
+                break;
+            case WebInspector.ConsoleMessage.MessageLevel.Object:
+                this.formattedMessage = this._format(["%O", args[0]]);
+                break;
+            default:
+                this.formattedMessage = this._format(args);
+                break;
+        }
+
+        // This is used for inline message bubbles in SourceFrames, or other plain-text representations.
+        this.message = this.formattedMessage.textContent;
+    },
+
     isErrorOrWarning: function()
     {
         return (this.level === WebInspector.ConsoleMessage.MessageLevel.Warning || this.level === WebInspector.ConsoleMessage.MessageLevel.Error);
diff --git a/WebCore/inspector/front-end/DataGrid.js b/WebCore/inspector/front-end/DataGrid.js
index 6f103ed..2fcb08c 100644
--- a/WebCore/inspector/front-end/DataGrid.js
+++ b/WebCore/inspector/front-end/DataGrid.js
@@ -169,32 +169,19 @@
     insertChild: function(child, index)
     {
         if (!child)
-            throw("Node can't be undefined or null.");
+            throw("insertChild: Node can't be undefined or null.");
         if (child.parent === this)
-            throw("Node is already a child of this node.");
+            throw("insertChild: Node is already a child of this node.");
 
         if (child.parent)
             child.parent.removeChild(child);
 
-        var previousChild = (index > 0 ? this.children[index - 1] : null);
-        if (previousChild) {
-            previousChild.nextSibling = child;
-            child.previousSibling = previousChild;
-        } else
-            child.previousSibling = null;
-
-        var nextChild = this.children[index];
-        if (nextChild) {
-            nextChild.previousSibling = child;
-            child.nextSibling = nextChild;
-        } else
-            child.nextSibling = null;
-
         this.children.splice(index, 0, child);
         this.hasChildren = true;
 
         child.parent = this;
         child.dataGrid = this.dataGrid;
+        child._recalculateSiblings(index);
 
         delete child._depth;
         delete child._revealed;
@@ -216,9 +203,9 @@
     removeChild: function(child)
     {
         if (!child)
-            throw("Node can't be undefined or null.");
+            throw("removeChild: Node can't be undefined or null.");
         if (child.parent !== this)
-            throw("Node is not a child of this node.");
+            throw("removeChild: Node is not a child of this node.");
 
         child.deselect();
 
@@ -233,6 +220,9 @@
         child.parent = null;
         child.nextSibling = null;
         child.previousSibling = null;
+
+        if (this.children.length <= 0)
+            this.hasChildren = false;
     },
 
     removeChildren: function()
@@ -249,6 +239,7 @@
         }
 
         this.children = [];
+        this.hasChildren = false;
     },
 
     removeChildrenRecursive: function()
@@ -405,7 +396,7 @@
         var gridNode = this.dataGridNodeFromEvent(event);
         if (!gridNode || !gridNode.selectable)
             return;
-    
+
         if (gridNode.isEventWithinDisclosureTriangle(event))
             return;
 
@@ -519,6 +510,34 @@
         return true;
     },
 
+    set hasChildren(x)
+    {
+        if (this._hasChildren === x)
+            return;
+
+        this._hasChildren = x;
+
+        if (!this._element)
+            return;
+
+        if (this._hasChildren)
+        {
+            this._element.addStyleClass("parent");
+            if (this.expanded)
+                this._element.addStyleClass("expanded");
+        }
+        else
+        {
+            this._element.removeStyleClass("parent");
+            this._element.removeStyleClass("expanded");
+        }
+    },
+
+    get hasChildren()
+    {
+        return this._hasChildren;
+    },
+
     set revealed(x)
     {
         if (this._revealed === x)
@@ -624,6 +643,28 @@
     removeChildren: WebInspector.DataGrid.prototype.removeChildren,
     removeChildrenRecursive: WebInspector.DataGrid.prototype.removeChildrenRecursive,
 
+    _recalculateSiblings: function(myIndex)
+    {
+        if (!this.parent)
+            return;
+
+        var previousChild = (myIndex > 0 ? this.parent.children[myIndex - 1] : null);
+
+        if (previousChild) {
+            previousChild.nextSibling = this;
+            this.previousSibling = previousChild;
+        } else
+            this.previousSibling = null;
+
+        var nextChild = this.parent.children[myIndex + 1];
+
+        if (nextChild) {
+            nextChild.previousSibling = this;
+            this.nextSibling = nextChild;
+        } else
+            this.nextSibling = null;
+    },
+
     collapse: function()
     {
         if (this._element)
diff --git a/WebCore/inspector/front-end/ElementsTreeOutline.js b/WebCore/inspector/front-end/ElementsTreeOutline.js
index 16e31b8..2da2f10 100644
--- a/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -487,7 +487,7 @@
             return;
 
         if (this.treeOutline.panel) {
-            this.treeOutline.rootDOMNode = this.parent.representedObject;
+            this.treeOutline.rootDOMNode = this.representedObject.parentNode;
             this.treeOutline.focusedDOMNode = this.representedObject;
         }
 
@@ -571,7 +571,7 @@
         parseContainerElement.innerHTML = "<span " + newText + "></span>";
         var parseElement = parseContainerElement.firstChild;
         if (!parseElement || !parseElement.hasAttributes()) {
-            editingCancelled(element, context);
+            this._editingCancelled(element, context);
             return;
         }
 
diff --git a/WebCore/inspector/front-end/Images/radioDot.png b/WebCore/inspector/front-end/Images/radioDot.png
new file mode 100644
index 0000000..609878f
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/radioDot.png
Binary files differ
diff --git a/WebCore/inspector/front-end/PanelEnablerView.js b/WebCore/inspector/front-end/PanelEnablerView.js
index 6ec565b..fab6d76 100644
--- a/WebCore/inspector/front-end/PanelEnablerView.js
+++ b/WebCore/inspector/front-end/PanelEnablerView.js
@@ -44,6 +44,23 @@
     this.headerElement.textContent = headingText;
     this.choicesForm.appendChild(this.headerElement);
 
+    var self = this;
+    function enableOption(text, checked) {
+        var label = document.createElement("label");
+        var option = document.createElement("input");
+        option.type = "radio";
+        option.name = "enable-option";
+        if (checked)
+            option.checked = true;
+        label.appendChild(option);
+        label.appendChild(document.createTextNode(text));
+        self.choicesForm.appendChild(label);
+        return option;
+    };
+
+    this.enabledForSession = enableOption(WebInspector.UIString("Only enable for this session"), true);
+    this.enabledAlways = enableOption(WebInspector.UIString("Always enable"));
+
     this.disclaimerElement = document.createElement("div");
     this.disclaimerElement.className = "panel-enabler-disclaimer";
     this.disclaimerElement.textContent = disclaimerText;
@@ -70,6 +87,10 @@
 
         if (this.element.offsetWidth < (this.choicesForm.offsetWidth + this.imageElement.offsetWidth))
             this.imageElement.addStyleClass("hidden");
+    },
+
+    get alwaysEnabled() {
+        return this.enabledAlways.checked;
     }
 }
 
diff --git a/WebCore/inspector/front-end/ProfileDataGridTree.js b/WebCore/inspector/front-end/ProfileDataGridTree.js
new file mode 100644
index 0000000..84d9923
--- /dev/null
+++ b/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -0,0 +1,398 @@
+/*
+ * Copyright (C) 2009 280 North Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ProfileDataGridNode = function(profileView, profileNode, owningTree, hasChildren)
+{
+    this.profileView = profileView;
+    this.profileNode = profileNode;
+
+    WebInspector.DataGridNode.call(this, null, hasChildren);
+
+    this.addEventListener("populate", this._populate, this);
+
+    this.tree = owningTree;
+
+    this.childrenByCallUID = {};
+    this.lastComparator = null;
+
+    this.callUID = profileNode.callUID;
+    this.selfTime = profileNode.selfTime;
+    this.totalTime = profileNode.totalTime;
+    this.functionName = profileNode.functionName;
+    this.numberOfCalls = profileNode.numberOfCalls;
+    this.url = profileNode.url;
+}
+
+WebInspector.ProfileDataGridNode.prototype = {
+    get data()
+    {
+        function formatMilliseconds(time)
+        {
+            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), true);
+        }
+
+        var data = {};
+
+        data["function"] = this.functionName;
+        data["calls"] = this.numberOfCalls;
+
+        if (this.profileView.showSelfTimeAsPercent)
+            data["self"] = WebInspector.UIString("%.2f%%", this.selfPercent);
+        else
+            data["self"] = formatMilliseconds(this.selfTime);
+
+        if (this.profileView.showTotalTimeAsPercent)
+            data["total"] = WebInspector.UIString("%.2f%%", this.totalPercent);
+        else
+            data["total"] = formatMilliseconds(this.totalTime);
+
+        if (this.profileView.showAverageTimeAsPercent)
+            data["average"] = WebInspector.UIString("%.2f%%", this.averagePercent);
+        else
+            data["average"] = formatMilliseconds(this.averageTime);
+
+        return data;
+    },
+
+    createCell: function(columnIdentifier)
+    {
+        var cell = WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
+
+        if (columnIdentifier === "self" && this._searchMatchedSelfColumn)
+            cell.addStyleClass("highlight");
+        else if (columnIdentifier === "total" && this._searchMatchedTotalColumn)
+            cell.addStyleClass("highlight");
+        else if (columnIdentifier === "average" && this._searchMatchedAverageColumn)
+            cell.addStyleClass("highlight");
+        else if (columnIdentifier === "calls" && this._searchMatchedCallsColumn)
+            cell.addStyleClass("highlight");
+
+        if (columnIdentifier !== "function")
+            return cell;
+
+        if (this.profileNode._searchMatchedFunctionColumn)
+            cell.addStyleClass("highlight");
+
+        if (this.profileNode.url) {
+            var fileName = WebInspector.displayNameForURL(this.profileNode.url);
+
+            var urlElement = document.createElement("a");
+            urlElement.className = "profile-node-file webkit-html-resource-link";
+            urlElement.href = this.profileNode.url;
+            urlElement.lineNumber = this.profileNode.lineNumber;
+
+            if (this.profileNode.lineNumber > 0)
+                urlElement.textContent = fileName + ":" + this.profileNode.lineNumber;
+            else
+                urlElement.textContent = fileName;
+
+            cell.insertBefore(urlElement, cell.firstChild);
+        }
+
+        return cell;
+    },
+
+    select: function(supressSelectedEvent)
+    {
+        WebInspector.DataGridNode.prototype.select.call(this, supressSelectedEvent);
+        this.profileView._dataGridNodeSelected(this);
+    },
+
+    deselect: function(supressDeselectedEvent)
+    {
+        WebInspector.DataGridNode.prototype.deselect.call(this, supressDeselectedEvent);
+        this.profileView._dataGridNodeDeselected(this);
+    },
+
+    expand: function()
+    {
+        if (!this.parent) {
+            var currentComparator = this.parent.lastComparator;
+
+            if (!currentComparator || (currentComparator === this.lastComparator))
+                return;
+
+            this.sort(currentComparator);
+        }
+
+        WebInspector.DataGridNode.prototype.expand.call(this);
+    },
+
+    sort: function(/*Function*/ comparator, /*Boolean*/ force)
+    {
+        var gridNodeGroups = [[this]];
+
+        for (var gridNodeGroupIndex = 0; gridNodeGroupIndex < gridNodeGroups.length; ++gridNodeGroupIndex) {
+            var gridNodes = gridNodeGroups[gridNodeGroupIndex];
+            var count = gridNodes.length;
+
+            for (var index = 0; index < count; ++index) {
+                var gridNode = gridNodes[index];
+
+                // If the grid node is collapsed, then don't sort children (save operation for later).
+                // If the grid node has the same sorting as previously, then there is no point in sorting it again.
+                if (!force && !gridNode.expanded || gridNode.lastComparator === comparator)
+                    continue;
+
+                gridNode.lastComparator = comparator;
+
+                var children = gridNode.children;
+                var childCount = children.length;
+
+                if (childCount) {
+                    children.sort(comparator);
+
+                    for (var childIndex = 0; childIndex < childCount; ++childIndex)
+                        children[childIndex]._recalculateSiblings(childIndex);
+
+                    gridNodeGroups.push(children);
+                }
+            }
+        }
+    },
+
+    insertChild: function(/*ProfileDataGridNode*/ profileDataGridNode, index)
+    {
+        WebInspector.DataGridNode.prototype.insertChild.call(this, profileDataGridNode, index);
+
+        this.childrenByCallUID[profileDataGridNode.callUID] = profileDataGridNode;
+    },
+
+    removeChild: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        WebInspector.DataGridNode.prototype.removeChild.call(this, profileDataGridNode);
+
+        delete this.childrenByCallUID[profileDataGridNode.callUID];
+    },
+
+    removeChildren: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        WebInspector.DataGridNode.prototype.removeChildren.call(this);
+
+        this.childrenByCallUID = {};
+    },
+
+    findChild: function(/*Node*/ node)
+    {
+        if (!node)
+            return null;
+        return this.childrenByCallUID[node.callUID];
+    },
+
+    get averageTime()
+    {
+        return this.selfTime / Math.max(1, this.numberOfCalls);
+    },
+
+    get averagePercent()
+    {
+        return this.averageTime / this.tree.totalTime * 100.0;
+    },
+
+    get selfPercent()
+    {
+        return this.selfTime / this.tree.totalTime * 100.0;
+    },
+
+    get totalPercent()
+    {
+        return this.totalTime / this.tree.totalTime * 100.0;
+    },
+
+    // When focusing and collapsing we modify lots of nodes in the tree.
+    // This allows us to restore them all to their original state when we revert.
+    _save: function()
+    {
+        if (this._savedChildren)
+            return;
+
+        this._savedSelfTime = this.selfTime;
+        this._savedTotalTime = this.totalTime;
+        this._savedNumberOfCalls = this.numberOfCalls;
+
+        this._savedChildren = this.children.slice();
+    },
+
+    // When focusing and collapsing we modify lots of nodes in the tree.
+    // This allows us to restore them all to their original state when we revert.
+    _restore: function()
+    {
+        if (!this._savedChildren)
+            return;
+
+        this.selfTime = this._savedSelfTime;
+        this.totalTime = this._savedTotalTime;
+        this.numberOfCalls = this._savedNumberOfCalls;
+
+        this.removeChildren();
+
+        var children = this._savedChildren;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index) {
+            children[index]._restore();
+            this.appendChild(children[index]);
+        }
+    },
+
+    _merge: function(child, shouldAbsorb)
+    {
+        this.selfTime += child.selfTime;
+
+        if (!shouldAbsorb) {
+            this.totalTime += child.totalTime;
+            this.numberOfCalls += child.numberOfCalls;
+        }
+
+        var children = this.children.slice();
+
+        this.removeChildren();
+
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index) {
+            if (!shouldAbsorb || children[index] !== child)
+                this.appendChild(children[index]);
+        }
+
+        children = child.children.slice();
+        count = children.length;
+
+        for (var index = 0; index < count; ++index) {
+            var orphanedChild = children[index],
+                existingChild = this.childrenByCallUID[orphanedChild.callUID];
+
+            if (existingChild)
+                existingChild._merge(orphanedChild, false);
+            else
+                this.appendChild(orphanedChild);
+        }
+    }
+}
+
+WebInspector.ProfileDataGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
+
+WebInspector.ProfileDataGridTree = function(profileView, profileNode)
+{
+    this.tree = this;
+    this.children = [];
+
+    this.profileView = profileView;
+
+    this.totalTime = profileNode.totalTime;
+    this.lastComparator = null;
+
+    this.childrenByCallUID = {};
+}
+
+WebInspector.ProfileDataGridTree.prototype = {
+    get expanded()
+    {
+        return true;
+    },
+
+    appendChild: function(child)
+    {
+        this.insertChild(child, this.children.length);
+    },
+
+    insertChild: function(child, index)
+    {
+        this.children.splice(index, 0, child);
+        this.childrenByCallUID[child.callUID] = child;
+    },
+
+    removeChildren: function()
+    {
+        this.children = [];
+        this.childrenByCallUID = {};
+    },
+
+    findChild: WebInspector.ProfileDataGridNode.prototype.findChild,
+    sort: WebInspector.ProfileDataGridNode.prototype.sort,
+
+    _save: function()
+    {
+        if (this._savedChildren)
+            return;
+
+        this._savedTotalTime = this.totalTime;
+        this._savedChildren = this.children.slice();
+    },
+
+    restore: function()
+    {
+        if (!this._savedChildren)
+            return;
+
+        this.children = this._savedChildren;
+        this.totalTime = this._savedTotalTime;
+
+        var children = this.children;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index)
+            children[index]._restore();
+
+        this._savedChildren = null;
+    }
+}
+
+WebInspector.ProfileDataGridTree.propertyComparators = [{}, {}];
+
+WebInspector.ProfileDataGridTree.propertyComparator = function(/*String*/ property, /*Boolean*/ isAscending)
+{
+    var comparator = this.propertyComparators[(isAscending ? 1 : 0)][property];
+
+    if (!comparator) {
+        if (isAscending) {
+            comparator = function(lhs, rhs)
+            {
+                if (lhs[property] < rhs[property])
+                    return -1;
+
+                if (lhs[property] > rhs[property])
+                    return 1;
+
+                return 0;
+            }
+        } else {
+            comparator = function(lhs, rhs)
+            {
+                if (lhs[property] > rhs[property])
+                    return -1;
+
+                if (lhs[property] < rhs[property])
+                    return 1;
+
+                return 0;
+            }
+        }
+
+        this.propertyComparators[(isAscending ? 1 : 0)][property] = comparator;
+    }
+
+    return comparator;
+}
diff --git a/WebCore/inspector/front-end/ProfileView.js b/WebCore/inspector/front-end/ProfileView.js
index 92e9726..d00733c 100644
--- a/WebCore/inspector/front-end/ProfileView.js
+++ b/WebCore/inspector/front-end/ProfileView.js
@@ -31,9 +31,11 @@
 
     this.showSelfTimeAsPercent = true;
     this.showTotalTimeAsPercent = true;
+    this.showAverageTimeAsPercent = true;
 
     var columns = { "self": { title: WebInspector.UIString("Self"), width: "72px", sort: "descending", sortable: true },
                     "total": { title: WebInspector.UIString("Total"), width: "72px", sortable: true },
+                    "average": { title: WebInspector.UIString("Average"), width: "72px", sortable: true },
                     "calls": { title: WebInspector.UIString("Calls"), width: "54px", sortable: true },
                     "function": { title: WebInspector.UIString("Function"), disclosure: true, sortable: true } };
 
@@ -75,16 +77,14 @@
     this.resetButton.className = "reset-profile-status-bar-item status-bar-item hidden";
     this.resetButton.addEventListener("click", this._resetClicked.bind(this), false);
 
-    // Default to the heavy profile.
-    profile = profile.heavyProfile;
+    this.profile = profile;
 
-    // By default the profile isn't sorted, so sort based on our default sort
-    // column and direction added to the DataGrid columns above.
-    profile.sortSelfTimeDescending();
+    this.profileDataGridTree = this.bottomUpProfileDataGridTree;
+    this.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator("selfTime", false));
+
+    this.refresh();
 
     this._updatePercentButton();
-
-    this.profile = profile;
 }
 
 WebInspector.ProfileView.prototype = {
@@ -101,9 +101,53 @@
     set profile(profile)
     {
         this._profile = profile;
+    },
+
+    get bottomUpProfileDataGridTree()
+    {
+        if (!this._bottomUpProfileDataGridTree)
+            this._bottomUpProfileDataGridTree = new WebInspector.BottomUpProfileDataGridTree(this, this.profile.head);
+        return this._bottomUpProfileDataGridTree;
+    },
+
+    get topDownProfileDataGridTree()
+    {
+        if (!this._topDownProfileDataGridTree)
+            this._topDownProfileDataGridTree = new WebInspector.TopDownProfileDataGridTree(this, this.profile.head);
+        return this._topDownProfileDataGridTree;
+    },
+
+    get currentTree()
+    {
+        return this._currentTree;
+    },
+
+    set currentTree(tree)
+    {
+        this._currentTree = tree;
         this.refresh();
     },
 
+    get topDownTree()
+    {
+        if (!this._topDownTree) {
+            this._topDownTree = WebInspector.TopDownTreeFactory.create(this.profile.head);
+            this._sortProfile(this._topDownTree);
+        }
+
+        return this._topDownTree;
+    },
+
+    get bottomUpTree()
+    {
+        if (!this._bottomUpTree) {
+            this._bottomUpTree = WebInspector.BottomUpTreeFactory.create(this.profile.head);
+            this._sortProfile(this._bottomUpTree);
+        }
+
+        return this._bottomUpTree;
+    },
+
     hide: function()
     {
         WebInspector.View.prototype.hide.call(this);
@@ -116,20 +160,18 @@
 
         this.dataGrid.removeChildren();
 
-        var children = this.profile.head.children;
-        var childrenLength = children.length;
-        for (var i = 0; i < childrenLength; ++i)
-            if (children[i].visible)
-                this.dataGrid.appendChild(new WebInspector.ProfileDataGridNode(this, children[i]));
+        var children = this.profileDataGridTree.children;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index)
+            this.dataGrid.appendChild(children[index]);
 
         if (selectedProfileNode && selectedProfileNode._dataGridNode)
             selectedProfileNode._dataGridNode.selected = true;
     },
 
-    refreshShowAsPercents: function()
+    refreshVisibleData: function()
     {
-        this._updatePercentButton();
-
         var child = this.dataGrid.children[0];
         while (child) {
             child.refresh();
@@ -137,6 +179,12 @@
         }
     },
 
+    refreshShowAsPercents: function()
+    {
+        this._updatePercentButton();
+        this.refreshVisibleData();
+    },
+
     searchCanceled: function()
     {
         if (this._searchResults) {
@@ -191,71 +239,90 @@
         if (!isNaN(queryNumber) && !(greaterThan || lessThan))
             equalTo = true;
 
-        function matchesQuery(profileNode)
+        function matchesQuery(/*ProfileDataGridNode*/ profileDataGridNode)
         {
-            delete profileNode._searchMatchedSelfColumn;
-            delete profileNode._searchMatchedTotalColumn;
-            delete profileNode._searchMatchedCallsColumn;
-            delete profileNode._searchMatchedFunctionColumn;
+            delete profileDataGridNode._searchMatchedSelfColumn;
+            delete profileDataGridNode._searchMatchedTotalColumn;
+            delete profileDataGridNode._searchMatchedAverageColumn;
+            delete profileDataGridNode._searchMatchedCallsColumn;
+            delete profileDataGridNode._searchMatchedFunctionColumn;
 
             if (percentUnits) {
                 if (lessThan) {
-                    if (profileNode.selfPercent < queryNumber)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalPercent < queryNumber)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfPercent < queryNumber)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalPercent < queryNumber)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averagePercent < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 } else if (greaterThan) {
-                    if (profileNode.selfPercent > queryNumber)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalPercent > queryNumber)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfPercent > queryNumber)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalPercent > queryNumber)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averagePercent < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
 
                 if (equalTo) {
-                    if (profileNode.selfPercent == queryNumber)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalPercent == queryNumber)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfPercent == queryNumber)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalPercent == queryNumber)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averagePercent < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
             } else if (millisecondsUnits || secondsUnits) {
                 if (lessThan) {
-                    if (profileNode.selfTime < queryNumberMilliseconds)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalTime < queryNumberMilliseconds)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfTime < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalTime < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averageTime < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 } else if (greaterThan) {
-                    if (profileNode.selfTime > queryNumberMilliseconds)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalTime > queryNumberMilliseconds)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfTime > queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalTime > queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averageTime > queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
 
                 if (equalTo) {
-                    if (profileNode.selfTime == queryNumberMilliseconds)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalTime == queryNumberMilliseconds)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfTime == queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalTime == queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averageTime == queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
             } else {
-                if (equalTo && profileNode.numberOfCalls == queryNumber)
-                    profileNode._searchMatchedCallsColumn = true;
-                if (greaterThan && profileNode.numberOfCalls > queryNumber)
-                    profileNode._searchMatchedCallsColumn = true;
-                if (lessThan && profileNode.numberOfCalls < queryNumber)
-                    profileNode._searchMatchedCallsColumn = true;
+                if (equalTo && profileDataGridNode.numberOfCalls == queryNumber)
+                    profileDataGridNode._searchMatchedCallsColumn = true;
+                if (greaterThan && profileDataGridNode.numberOfCalls > queryNumber)
+                    profileDataGridNode._searchMatchedCallsColumn = true;
+                if (lessThan && profileDataGridNode.numberOfCalls < queryNumber)
+                    profileDataGridNode._searchMatchedCallsColumn = true;
             }
 
-            if (profileNode.functionName.hasSubstring(query, true) || profileNode.url.hasSubstring(query, true))
-                profileNode._searchMatchedFunctionColumn = true;
+            if (profileDataGridNode.functionName.hasSubstring(query, true) || profileDataGridNode.url.hasSubstring(query, true))
+                profileDataGridNode._searchMatchedFunctionColumn = true;
 
-            var matched = (profileNode._searchMatchedSelfColumn || profileNode._searchMatchedTotalColumn || profileNode._searchMatchedCallsColumn || profileNode._searchMatchedFunctionColumn);
-            if (matched && profileNode._dataGridNode)
-                profileNode._dataGridNode.refresh();
+            if (profileDataGridNode._searchMatchedSelfColumn ||
+                profileDataGridNode._searchMatchedTotalColumn ||
+                profileDataGridNode._searchMatchedAverageColumn ||
+                profileDataGridNode._searchMatchedCallsColumn ||
+                profileDataGridNode._searchMatchedFunctionColumn);
+            {
+                profileDataGridNode.refresh();
+                return true;
+            }
 
-            return matched;
+            return false;
         }
 
-        var current = this.profile.head;
+        var current = this.dataGrid;
         var ancestors = [];
         var nextIndexes = [];
         var startIndex = 0;
@@ -380,12 +447,12 @@
             return;
 
         if (event.target.selectedIndex == 1 && this.view == "Heavy") {
-            this._sortProfile(this.profile.treeProfile);
-            this.profile = this.profile.treeProfile;
+            this.profileDataGridTree = this.topDownProfileDataGridTree;
+            this._sortProfile();
             this.view = "Tree";
         } else if (event.target.selectedIndex == 0 && this.view == "Tree") {
-            this._sortProfile(this.profile.heavyProfile);
-            this.profile = this.profile.heavyProfile;
+            this.profileDataGridTree = this.bottomUpProfileDataGridTree;
+            this._sortProfile();
             this.view = "Heavy";
         }
 
@@ -401,15 +468,16 @@
 
     _percentClicked: function(event)
     {
-        var currentState = this.showSelfTimeAsPercent && this.showTotalTimeAsPercent;
+        var currentState = this.showSelfTimeAsPercent && this.showTotalTimeAsPercent && this.showAverageTimeAsPercent;
         this.showSelfTimeAsPercent = !currentState;
         this.showTotalTimeAsPercent = !currentState;
+        this.showAverageTimeAsPercent = !currentState;
         this.refreshShowAsPercents();
     },
 
     _updatePercentButton: function()
     {
-        if (this.showSelfTimeAsPercent && this.showTotalTimeAsPercent) {
+        if (this.showSelfTimeAsPercent && this.showTotalTimeAsPercent && this.showAverageTimeAsPercent) {
             this.percentButton.title = WebInspector.UIString("Show absolute total and self times.");
             this.percentButton.addStyleClass("toggled-on");
         } else {
@@ -420,28 +488,36 @@
 
     _focusClicked: function(event)
     {
-        if (!this.dataGrid.selectedNode || !this.dataGrid.selectedNode.profileNode)
+        if (!this.dataGrid.selectedNode)
             return;
+
         this.resetButton.removeStyleClass("hidden");
-        this.profile.focus(this.dataGrid.selectedNode.profileNode);
+        this.profileDataGridTree.focus(this.dataGrid.selectedNode);
         this.refresh();
+        this.refreshVisibleData();
     },
 
     _excludeClicked: function(event)
     {
-        if (!this.dataGrid.selectedNode || !this.dataGrid.selectedNode.profileNode)
+        var selectedNode = this.dataGrid.selectedNode
+
+        if (!selectedNode)
             return;
+
+        selectedNode.deselect();
+
         this.resetButton.removeStyleClass("hidden");
-        this.profile.exclude(this.dataGrid.selectedNode.profileNode);
-        this.dataGrid.selectedNode.deselect();
+        this.profileDataGridTree.exclude(selectedNode);
         this.refresh();
+        this.refreshVisibleData();
     },
 
     _resetClicked: function(event)
     {
         this.resetButton.addStyleClass("hidden");
-        this.profile.restoreAll();
+        this.profileDataGridTree.restore();
         this.refresh();
+        this.refreshVisibleData();
     },
 
     _dataGridNodeSelected: function(node)
@@ -461,37 +537,21 @@
         this._sortProfile(this.profile);
     },
 
-    _sortProfile: function(profile)
+    _sortProfile: function()
     {
-        if (!profile)
-            return;
-
-        var sortOrder = this.dataGrid.sortOrder;
+        var sortAscending = this.dataGrid.sortOrder === "ascending";
         var sortColumnIdentifier = this.dataGrid.sortColumnIdentifier;
+        var sortProperty = {
+                "average": "averageTime",
+                "self": "selfTime",
+                "total": "totalTime",
+                "calls": "numberOfCalls",
+                "function": "functionName"
+            }[sortColumnIdentifier];
 
-        var sortingFunctionName = "sort";
+        this.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator(sortProperty, sortAscending));
 
-        if (sortColumnIdentifier === "self")
-            sortingFunctionName += "SelfTime";
-        else if (sortColumnIdentifier === "total")
-            sortingFunctionName += "TotalTime";
-        else if (sortColumnIdentifier === "calls")
-            sortingFunctionName += "Calls";
-        else if (sortColumnIdentifier === "function")
-            sortingFunctionName += "FunctionName";
-
-        if (sortOrder === "ascending")
-            sortingFunctionName += "Ascending";
-        else
-            sortingFunctionName += "Descending";
-
-        if (!(sortingFunctionName in this.profile))
-            return;
-
-        profile[sortingFunctionName]();
-
-        if (profile === this.profile)
-            this.refresh();
+        this.refresh();
     },
 
     _mouseDownInDataGrid: function(event)
@@ -500,13 +560,15 @@
             return;
 
         var cell = event.target.enclosingNodeOrSelfWithNodeName("td");
-        if (!cell || (!cell.hasStyleClass("total-column") && !cell.hasStyleClass("self-column")))
+        if (!cell || (!cell.hasStyleClass("total-column") && !cell.hasStyleClass("self-column") && !cell.hasStyleClass("average-column")))
             return;
 
         if (cell.hasStyleClass("total-column"))
             this.showTotalTimeAsPercent = !this.showTotalTimeAsPercent;
         else if (cell.hasStyleClass("self-column"))
             this.showSelfTimeAsPercent = !this.showSelfTimeAsPercent;
+        else if (cell.hasStyleClass("average-column"))
+            this.showAverageTimeAsPercent = !this.showAverageTimeAsPercent;
 
         this.refreshShowAsPercents();
 
@@ -516,127 +578,3 @@
 }
 
 WebInspector.ProfileView.prototype.__proto__ = WebInspector.View.prototype;
-
-WebInspector.ProfileDataGridNode = function(profileView, profileNode)
-{
-    this.profileView = profileView;
-
-    this.profileNode = profileNode;
-    profileNode._dataGridNode = this;
-
-    // Find the first child that is visible. Since we don't want to claim
-    // we have children if all the children are invisible.
-    var hasChildren = false;
-    var children = this.profileNode.children;
-    var childrenLength = children.length;
-    for (var i = 0; i < childrenLength; ++i) {
-        if (children[i].visible) {
-            hasChildren = true;
-            break;
-        }
-    }
-
-    WebInspector.DataGridNode.call(this, null, hasChildren);
-
-    this.addEventListener("populate", this._populate, this);
-
-    this.expanded = profileNode._expanded;
-}
-
-WebInspector.ProfileDataGridNode.prototype = {
-    get data()
-    {
-        function formatMilliseconds(time)
-        {
-            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), true);
-        }
-
-        var data = {};
-        data["function"] = this.profileNode.functionName;
-        data["calls"] = this.profileNode.numberOfCalls;
-
-        if (this.profileView.showSelfTimeAsPercent)
-            data["self"] = WebInspector.UIString("%.2f%%", this.profileNode.selfPercent);
-        else
-            data["self"] = formatMilliseconds(this.profileNode.selfTime);
-
-        if (this.profileView.showTotalTimeAsPercent)
-            data["total"] = WebInspector.UIString("%.2f%%", this.profileNode.totalPercent);
-        else
-            data["total"] = formatMilliseconds(this.profileNode.totalTime);
-
-        return data;
-    },
-
-    createCell: function(columnIdentifier)
-    {
-        var cell = WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
-
-        if (columnIdentifier === "self" && this.profileNode._searchMatchedSelfColumn)
-            cell.addStyleClass("highlight");
-        else if (columnIdentifier === "total" && this.profileNode._searchMatchedTotalColumn)
-            cell.addStyleClass("highlight");
-        else if (columnIdentifier === "calls" && this.profileNode._searchMatchedCallsColumn)
-            cell.addStyleClass("highlight");
-
-        if (columnIdentifier !== "function")
-            return cell;
-
-        if (this.profileNode._searchMatchedFunctionColumn)
-            cell.addStyleClass("highlight");
-
-        if (this.profileNode.url) {
-            var fileName = WebInspector.displayNameForURL(this.profileNode.url);
-
-            var urlElement = document.createElement("a");
-            urlElement.className = "profile-node-file webkit-html-resource-link";
-            urlElement.href = this.profileNode.url;
-            urlElement.lineNumber = this.profileNode.lineNumber;
-
-            if (this.profileNode.lineNumber > 0)
-                urlElement.textContent = fileName + ":" + this.profileNode.lineNumber;
-            else
-                urlElement.textContent = fileName;
-
-            cell.insertBefore(urlElement, cell.firstChild);
-        }
-
-        return cell;
-    },
-
-    select: function(supressSelectedEvent)
-    {
-        WebInspector.DataGridNode.prototype.select.call(this, supressSelectedEvent);
-        this.profileView._dataGridNodeSelected(this);
-    },
-
-    deselect: function(supressDeselectedEvent)
-    {
-        WebInspector.DataGridNode.prototype.deselect.call(this, supressDeselectedEvent);
-        this.profileView._dataGridNodeDeselected(this);
-    },
-
-    expand: function()
-    {
-        WebInspector.DataGridNode.prototype.expand.call(this);
-        this.profileNode._expanded = true;
-    },
-
-    collapse: function()
-    {
-        WebInspector.DataGridNode.prototype.collapse.call(this);
-        this.profileNode._expanded = false;
-    },
-
-    _populate: function(event)
-    {
-        var children = this.profileNode.children;
-        var childrenLength = children.length;
-        for (var i = 0; i < childrenLength; ++i)
-            if (children[i].visible)
-                this.appendChild(new WebInspector.ProfileDataGridNode(this.profileView, children[i]));
-        this.removeEventListener("populate", this._populate, this);
-    }
-}
-
-WebInspector.ProfileDataGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
diff --git a/WebCore/inspector/front-end/ProfilesPanel.js b/WebCore/inspector/front-end/ProfilesPanel.js
index ea3b85c..aafc306 100644
--- a/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/WebCore/inspector/front-end/ProfilesPanel.js
@@ -218,7 +218,7 @@
         view.show(this.profileViews);
 
         profile._profilesTreeElement.select(true);
-        profile._profilesTreeElement.reveal()
+        profile._profilesTreeElement.reveal();
 
         this.visibleView = view;
 
@@ -231,8 +231,7 @@
 
     showView: function(view)
     {
-        // Always use the treeProfile, since the heavy profile might be showing.
-        this.showProfile(view.profile.treeProfile);
+        this.showProfile(view.profile);
     },
 
     profileViewForProfile: function(profile)
@@ -295,8 +294,7 @@
 
     searchMatchFound: function(view, matches)
     {
-        // Always use the treeProfile, since the heavy profile might be showing.
-        view.profile.treeProfile._profilesTreeElement.searchMatches = matches;
+        view.profile._profilesTreeElement.searchMatches = matches;
     },
 
     searchCanceled: function(startingNewSearch)
@@ -356,15 +354,15 @@
     {
         if (InspectorController.profilerEnabled())
             return;
-        this._toggleProfiling();
+        this._toggleProfiling(this.panelEnablerView.alwaysEnabled);
     },
 
-    _toggleProfiling: function()
+    _toggleProfiling: function(optionalAlways)
     {
         if (InspectorController.profilerEnabled())
-            InspectorController.disableProfiler();
+            InspectorController.disableProfiler(true);
         else
-            InspectorController.enableProfiler();
+            InspectorController.enableProfiler(!!optionalAlways);
     },
 
     _populateProfiles: function()
diff --git a/WebCore/inspector/front-end/ResourcesPanel.js b/WebCore/inspector/front-end/ResourcesPanel.js
index e02baf3..04d998e 100644
--- a/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/WebCore/inspector/front-end/ResourcesPanel.js
@@ -126,6 +126,19 @@
 
     this.resourcesTreeElement.expand();
 
+    var panelEnablerHeading = WebInspector.UIString("You need to enable resource tracking to use the this panel.");
+    var panelEnablerDisclaimer = WebInspector.UIString("Enabling resource tracking will reload the page and make page loading slower.");
+    var panelEnablerButton = WebInspector.UIString("Enable resource tracking");
+
+    this.panelEnablerView = new WebInspector.PanelEnablerView("resources", panelEnablerHeading, panelEnablerDisclaimer, panelEnablerButton);
+    this.panelEnablerView.addEventListener("enable clicked", this._enableResourceTracking, this);
+
+    this.element.appendChild(this.panelEnablerView.element);
+
+    this.enableToggleButton = document.createElement("button");
+    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
+
     this.largerResourcesButton = document.createElement("button");
     this.largerResourcesButton.id = "resources-larger-resources-status-bar-item";
     this.largerResourcesButton.className = "status-bar-item toggled-on";
@@ -151,7 +164,7 @@
 
     get statusBarItems()
     {
-        return [this.largerResourcesButton, this.sortingSelectElement];
+        return [this.enableToggleButton, this.largerResourcesButton, this.sortingSelectElement];
     },
 
     show: function()
@@ -358,6 +371,16 @@
         this._updateSummaryGraph();
     },
 
+    resourceTrackingWasEnabled: function()
+    {
+        this.reset();
+    },
+
+    resourceTrackingWasDisabled: function()
+    {
+        this.reset();
+    },
+
     reset: function()
     {
         this.closeVisibleResource();
@@ -394,6 +417,20 @@
         this._updateGraphDividersIfNeeded(true);
 
         this._drawSummaryGraph(); // draws an empty graph
+
+        if (InspectorController.resourceTrackingEnabled()) {
+            this.enableToggleButton.title = WebInspector.UIString("Resource tracking enabled. Click to disable.");
+            this.enableToggleButton.addStyleClass("toggled-on");
+            this.largerResourcesButton.removeStyleClass("hidden");
+            this.sortingSelectElement.removeStyleClass("hidden");
+            this.panelEnablerView.visible = false;
+        } else {
+            this.enableToggleButton.title = WebInspector.UIString("Resource tracking disabled. Click to enable.");
+            this.enableToggleButton.removeStyleClass("toggled-on");
+            this.largerResourcesButton.addStyleClass("hidden");
+            this.sortingSelectElement.addStyleClass("hidden");
+            this.panelEnablerView.visible = true;
+        }
     },
 
     addResource: function(resource)
@@ -1085,6 +1122,26 @@
         var visibleView = this.visibleView;
         if (visibleView && "resize" in visibleView)
             visibleView.resize();
+    },
+
+    _enableResourceTracking: function()
+    {
+        if (InspectorController.resourceTrackingEnabled())
+            return;
+        this._toggleResourceTracking(this.panelEnablerView.alwaysEnabled);
+    },
+
+    _toggleResourceTracking: function(optionalAlways)
+    {
+        if (InspectorController.resourceTrackingEnabled()) {
+            this.largerResourcesButton.visible = false;
+            this.sortingSelectElement.visible = false;
+            InspectorController.disableResourceTracking(true);
+        } else {
+            this.largerResourcesButton.visible = true;
+            this.sortingSelectElement.visible = true;
+            InspectorController.enableResourceTracking(!!optionalAlways);
+        }
     }
 }
 
diff --git a/WebCore/inspector/front-end/ScriptsPanel.js b/WebCore/inspector/front-end/ScriptsPanel.js
index 2792834..7af9292 100644
--- a/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/WebCore/inspector/front-end/ScriptsPanel.js
@@ -205,6 +205,10 @@
                 continue;
             view.visible = false;
         }
+        if (this._attachDebuggerWhenShown) {
+            InspectorController.enableDebuggerFromFrontend(false);
+            delete this._attachDebuggerWhenShown;
+        }
     },
 
     get searchableViews()
@@ -359,6 +363,24 @@
         window.focus();
     },
 
+    debuggerResumed: function()
+    {
+        this._paused = false;
+        this._waitingToPause = false;
+        this._stepping = false;
+
+        this._clearInterface();
+    },
+
+    attachDebuggerWhenShown: function()
+    {
+        if (this.element.parentElement) {
+            InspectorController.enableDebuggerFromFrontend(false);
+        } else {
+            this._attachDebuggerWhenShown = true;
+        }
+    },
+
     debuggerWasEnabled: function()
     {
         this.reset();
@@ -573,21 +595,25 @@
         option.representedObject = (script.resource || script);
         option.text = (script.sourceURL ? WebInspector.displayNameForURL(script.sourceURL) : WebInspector.UIString("(program)"));
 
-        var insertionIndex = -1;
-        if (select.childNodes) {
-            insertionIndex = insertionIndexForObjectInListSortedByFunction(option, select.childNodes, function(a, b) {    
-                a = a.text.toLowerCase();
-                b = b.text.toLowerCase();
-                
-                if (a < b)
-                    return -1;
-                else if (a > b)
-                    return 1;
+        function optionCompare(a, b)
+        {
+            var aTitle = a.text.toLowerCase();
+            var bTitle = b.text.toLowerCase();
+            if (aTitle < bTitle)
+                return -1;
+            else if (aTitle > bTitle)
+                return 1;
 
-                return 0;
-            });
+            var aSourceID = a.representedObject.sourceID;
+            var bSourceID = b.representedObject.sourceID;
+            if (aSourceID < bSourceID)
+                return -1;
+            else if (aSourceID > bSourceID)
+                return 1;
+            return 0;
         }
 
+        var insertionIndex = insertionIndexForObjectInListSortedByFunction(option, select.childNodes, optionCompare);
         if (insertionIndex < 0)
             select.appendChild(option);
         else
@@ -758,19 +784,19 @@
     {
         if (InspectorController.debuggerEnabled())
             return;
-        this._toggleDebugging();
+        this._toggleDebugging(this.panelEnablerView.alwaysEnabled);
     },
 
-    _toggleDebugging: function()
+    _toggleDebugging: function(optionalAlways)
     {
         this._paused = false;
         this._waitingToPause = false;
         this._stepping = false;
 
         if (InspectorController.debuggerEnabled())
-            InspectorController.disableDebugger();
+            InspectorController.disableDebugger(true);
         else
-            InspectorController.enableDebugger();
+            InspectorController.enableDebuggerFromFrontend(!!optionalAlways);
     },
 
     _togglePauseOnExceptions: function()
diff --git a/WebCore/inspector/front-end/SourceFrame.js b/WebCore/inspector/front-end/SourceFrame.js
index 26c0626..18d9073 100644
--- a/WebCore/inspector/front-end/SourceFrame.js
+++ b/WebCore/inspector/front-end/SourceFrame.js
@@ -110,6 +110,11 @@
 
     revealLine: function(lineNumber)
     {
+        if (!this._isContentLoaded()) {
+            this._lineNumberToReveal = lineNumber;
+            return;
+        }
+    
         var row = this.sourceRow(lineNumber);
         if (row)
             row.scrollIntoViewIfNeeded(true);
@@ -172,6 +177,11 @@
 
     highlightLine: function(lineNumber)
     {
+        if (!this._isContentLoaded()) {
+            this._lineNumberToHighlight = lineNumber;
+            return;
+        }
+
         var sourceRow = this.sourceRow(lineNumber);
         if (!sourceRow)
             return;
@@ -233,9 +243,28 @@
         this._addExistingMessagesToSource();
         this._addExistingBreakpointsToSource();
         this._updateExecutionLine();
+        if (this._executionLine)
+            this.revealLine(this._executionLine);
 
         if (this.autoSizesToFitContentHeight)
             this.sizeToFitContentHeight();
+            
+        if (this._lineNumberToReveal) {
+            this.revealLine(this._lineNumberToReveal);
+            delete this._lineNumberToReveal;
+        }
+    
+        if (this._lineNumberToHighlight) {
+            this.highlightLine(this._lineNumberToHighlight);
+            delete this._lineNumberToHighlight;
+        }
+        
+        this.dispatchEventToListeners("content loaded");
+    },
+    
+    _isContentLoaded: function() {
+        var doc = this.element.contentDocument;
+        return doc && doc.getElementsByTagName("table")[0];
     },
 
     _windowResized: function(event)
diff --git a/WebCore/inspector/front-end/SourceView.js b/WebCore/inspector/front-end/SourceView.js
index 309027e..7510c8c 100644
--- a/WebCore/inspector/front-end/SourceView.js
+++ b/WebCore/inspector/front-end/SourceView.js
@@ -95,10 +95,15 @@
 
         this.attach();
 
-        if (!InspectorController.addResourceSourceToFrame(this.resource.identifier, this.sourceFrame.element))
-            return;
-
         delete this._frameNeedsSetup;
+        this.sourceFrame.addEventListener("content loaded", this._contentLoaded, this);
+        InspectorController.addResourceSourceToFrame(this.resource.identifier, this.sourceFrame.element);
+    },
+    
+    _contentLoaded: function()
+    {
+        delete this._frameNeedsSetup;
+        this.sourceFrame.removeEventListener("content loaded", this._contentLoaded, this);
 
         if (this.resource.type === WebInspector.Resource.Type.Script) {
             this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
@@ -274,7 +279,7 @@
         if (!foundRange)
             return;
 
-        var selection = window.getSelection();
+        var selection = this.sourceFrame.element.contentWindow.getSelection();
         selection.removeAllRanges();
         selection.addRange(foundRange);
 
diff --git a/WebCore/inspector/front-end/StylesSidebarPane.js b/WebCore/inspector/front-end/StylesSidebarPane.js
index f0a9afb..c30444b 100644
--- a/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -586,8 +586,8 @@
         this.listItemElement.appendChild(document.createTextNode(";"));
 
         if (value) {
-            // FIXME: this dosen't catch keyword based colors like black and white
-            var colors = value.match(/((rgb|hsl)a?\([^)]+\))|(#[0-9a-fA-F]{6})|(#[0-9a-fA-F]{3})/g);
+            // FIXME: this only covers W3C and CSS 16 valid color names
+            var colors = value.match(/((rgb|hsl)a?\([^)]+\))|(#[0-9a-fA-F]{6})|(#[0-9a-fA-F]{3})|aqua|black|blue|fuchsia|gray|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow/g);
             if (colors) {
                 var colorsLength = colors.length;
                 for (var i = 0; i < colorsLength; ++i) {
diff --git a/WebCore/inspector/front-end/TopDownProfileDataGridTree.js b/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
new file mode 100644
index 0000000..b9d8b94
--- /dev/null
+++ b/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2009 280 North Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TopDownProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*TopDownProfileDataGridTree*/ owningTree)
+{
+    var hasChildren = (profileNode.children && profileNode.children.length);
+
+    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
+
+    this._remainingChildren = profileNode.children;
+}
+
+WebInspector.TopDownProfileDataGridNode.prototype = {
+    _populate: function(event)
+    {
+        var children = this._remainingChildren;
+        var childrenLength = children.length;
+
+        for (var i = 0; i < childrenLength; ++i)
+            this.appendChild(new WebInspector.TopDownProfileDataGridNode(this.profileView, children[i], this.tree));
+
+        if (this.removeEventListener)
+            this.removeEventListener("populate", this._populate, this);
+
+        this._remainingChildren = null;
+    },
+
+    _exclude: function(aCallUID)
+    {
+        if (this._remainingChildren)
+            this._populate();
+
+        this._save();
+
+        var children = this.children;
+        var index = this.children.length;
+
+        while (index--)
+            children[index]._exclude(aCallUID);
+
+        var child = this.childrenByCallUID[aCallUID];
+
+        if (child)
+            this._merge(child, true);
+    }
+}
+
+WebInspector.TopDownProfileDataGridNode.prototype.__proto__ = WebInspector.ProfileDataGridNode.prototype;
+
+WebInspector.TopDownProfileDataGridTree = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode)
+{
+    WebInspector.ProfileDataGridTree.call(this, profileView, profileNode);
+
+    this._remainingChildren = profileNode.children;
+
+    WebInspector.TopDownProfileDataGridNode.prototype._populate.call(this);
+}
+
+WebInspector.TopDownProfileDataGridTree.prototype = {
+    focus: function(/*ProfileDataGridNode*/ profileDataGrideNode)
+    {
+        if (!profileDataGrideNode)
+            return;
+
+        this._save();
+
+        this.children = [profileDataGrideNode];
+        this.totalTime = profileDataGrideNode.totalTime;
+    },
+
+    exclude: function(/*ProfileDataGridNode*/ profileDataGrideNode)
+    {
+        if (!profileDataGrideNode)
+            return;
+
+        this._save();
+
+        var excludedCallUID = profileDataGrideNode.callUID;
+
+        WebInspector.TopDownProfileDataGridNode.prototype._exclude.call(this, excludedCallUID);
+
+        if (this.lastComparator)
+            this.sort(this.lastComparator, true);
+    },
+
+    _merge: WebInspector.TopDownProfileDataGridNode.prototype._merge
+}
+
+WebInspector.TopDownProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
diff --git a/WebCore/inspector/front-end/WebKit.qrc b/WebCore/inspector/front-end/WebKit.qrc
index 997d4a7..76a925b 100644
--- a/WebCore/inspector/front-end/WebKit.qrc
+++ b/WebCore/inspector/front-end/WebKit.qrc
@@ -1,6 +1,7 @@
 <!DOCTYPE RCC><RCC version="1.0">
 <qresource prefix="/webkit/inspector">
     <file>inspector.html</file>
+    <file>BottomUpProfileDataGridTree.js</file>
     <file>Breakpoint.js</file>
     <file>BreakpointsSidebarPane.js</file>
     <file>CallStackSidebarPane.js</file>
@@ -24,6 +25,7 @@
     <file>Panel.js</file>
     <file>PanelEnablerView.js</file>
     <file>Placard.js</file>
+    <file>ProfileDataGridTree.js</file>
     <file>ProfilesPanel.js</file>
     <file>ProfileView.js</file>
     <file>PropertiesSection.js</file>
@@ -42,6 +44,7 @@
     <file>SourceView.js</file>
     <file>StylesSidebarPane.js</file>
     <file>TextPrompt.js</file>
+    <file>TopDownProfileDataGridTree.js</file>
     <file>treeoutline.js</file>
     <file>utilities.js</file>
     <file>View.js</file>
@@ -96,6 +99,7 @@
     <file>Images/profilesIcon.png</file>
     <file>Images/profileSmallIcon.png</file>
     <file>Images/profilesSilhouette.png</file>
+    <file>Images/radioDot.png</file>
     <file>Images/recordButtons.png</file>
     <file>Images/reloadButtons.png</file>
     <file>Images/resourceCSSIcon.png</file>
@@ -155,6 +159,7 @@
     <file>Images/treeUpTriangleWhite.png</file>
     <file>Images/userInputIcon.png</file>
     <file>Images/userInputPreviousIcon.png</file>
+    <file>Images/userInputResultIcon.png</file>
     <file>Images/warningIcon.png</file>
     <file>Images/warningMediumIcon.png</file>
     <file>Images/warningsErrors.png</file>
diff --git a/WebCore/inspector/front-end/inspector.css b/WebCore/inspector/front-end/inspector.css
index 082955e..2653781 100644
--- a/WebCore/inspector/front-end/inspector.css
+++ b/WebCore/inspector/front-end/inspector.css
@@ -1919,6 +1919,7 @@
     font-size: 10px;
     color: rgb(110, 116, 128);
     margin-bottom: 12px;
+    margin-left: 20px;
 }
 
 .panel-enabler-disclaimer:empty {
@@ -1954,10 +1955,8 @@
     position: relative;
     display: block;
     text-align: left;
-    margin-left: 50px;
-    margin-bottom: 6px;
-    line-height: 18px;
     word-break: break-word;
+    margin: 0 0 5px 20px;
 }
 
 .panel-enabler-view button {
@@ -1986,6 +1985,30 @@
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(250, 250, 250)), to(rgb(235, 235, 235)));
 }
 
+.panel-enabler-view input {
+    height: 17px;
+    width: 17px;
+    border: 1px solid rgb(165, 165, 165);
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(252, 252, 252)), to(rgb(223, 223, 223)));
+    -webkit-border-radius: 8px;
+    -webkit-appearance: none;
+    vertical-align: middle;
+    margin: 0 5px 5px 0;
+}
+
+.panel-enabler-view input:active {
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
+}
+
+.panel-enabler-view input:checked {
+    background: url(Images/radioDot.png) center no-repeat,
+                -webkit-gradient(linear, left top, left bottom, from(rgb(252, 252, 252)), to(rgb(223, 223, 223)));
+}
+
+.panel-enabler-view.resources img {
+    content: url(Images/scriptsSilhouette.png);
+}
+
 .panel-enabler-view.scripts img {
     content: url(Images/scriptsSilhouette.png);
 }
@@ -2930,6 +2953,14 @@
     height: 100%;
 }
 
+.profile-view .data-grid th.average-column {
+    text-align: center;
+}
+
+.profile-view .data-grid td.average-column {
+    text-align: right;
+}
+
 .profile-view .data-grid th.self-column {
     text-align: center;
 }
diff --git a/WebCore/inspector/front-end/inspector.html b/WebCore/inspector/front-end/inspector.html
index 77d720b..184bb45 100644
--- a/WebCore/inspector/front-end/inspector.html
+++ b/WebCore/inspector/front-end/inspector.html
@@ -73,6 +73,9 @@
     <script type="text/javascript" src="DatabaseTableView.js"></script>
     <script type="text/javascript" src="DatabaseQueryView.js"></script>
     <script type="text/javascript" src="ScriptView.js"></script>
+    <script type="text/javascript" src="ProfileDataGridTree.js"></script>
+    <script type="text/javascript" src="BottomUpProfileDataGridTree.js"></script>
+    <script type="text/javascript" src="TopDownProfileDataGridTree.js"></script>
     <script type="text/javascript" src="ProfileView.js"></script>
 </head>
 <body class="detached">
diff --git a/WebCore/inspector/front-end/inspector.js b/WebCore/inspector/front-end/inspector.js
index 90ffa2b..9d5bac0 100644
--- a/WebCore/inspector/front-end/inspector.js
+++ b/WebCore/inspector/front-end/inspector.js
@@ -41,7 +41,7 @@
 }
 
 var WebInspector = {
-    resources: [],
+    resources: {},
     resourceURLMap: {},
     missingLocalizedStrings: {},
 
@@ -279,22 +279,24 @@
     document.body.addStyleClass("platform-" + platform);
 
     this.console = new WebInspector.Console();
-    this.panels = {
-        elements: new WebInspector.ElementsPanel(),
-        resources: new WebInspector.ResourcesPanel(),
-        scripts: new WebInspector.ScriptsPanel(),
-        profiles: new WebInspector.ProfilesPanel(),
-        databases: new WebInspector.DatabasesPanel()
-    };
 
+    this.panels = {};
     var hiddenPanels = (InspectorController.hiddenPanels() || "").split(',');
+    if (hiddenPanels.indexOf("elements") === -1)
+        this.panels.elements = new WebInspector.ElementsPanel();
+    if (hiddenPanels.indexOf("resources") === -1)
+        this.panels.resources = new WebInspector.ResourcesPanel();
+    if (hiddenPanels.indexOf("scripts") === -1)
+        this.panels.scripts = new WebInspector.ScriptsPanel();
+    if (hiddenPanels.indexOf("profiles") === -1)
+        this.panels.profiles = new WebInspector.ProfilesPanel();
+    if (hiddenPanels.indexOf("databases") === -1)
+        this.panels.databases = new WebInspector.DatabasesPanel();
 
     var toolbarElement = document.getElementById("toolbar");
     var previousToolbarItem = toolbarElement.children[0];
 
     for (var panelName in this.panels) {
-        if (hiddenPanels.indexOf(panelName) !== -1)
-            continue;
         var panel = this.panels[panelName];
         var panelToolbarItem = panel.toolbarItem;
         panelToolbarItem.addEventListener("click", this._toolbarItemClicked.bind(this));
@@ -387,6 +389,12 @@
 
 window.addEventListener("load", windowLoaded, false);
 
+WebInspector.dispatch = function() {
+    var methodName = arguments[0];
+    var parameters = Array.prototype.slice.call(arguments, 1);
+    WebInspector[methodName].apply(this, parameters);
+}
+
 WebInspector.windowUnload = function(event)
 {
     InspectorController.windowUnloading();
@@ -769,9 +777,18 @@
     this.currentPanel = this.panels.databases;
 }
 
-WebInspector.addResource = function(resource)
+WebInspector.addResource = function(identifier, payload)
 {
-    this.resources.push(resource);
+    var resource = new WebInspector.Resource(
+        payload.requestHeaders,
+        payload.requestURL,
+        payload.host,
+        payload.path,
+        payload.lastPathComponent,
+        identifier,
+        payload.isMainResource,
+        payload.cached);
+    this.resources[identifier] = resource;
     this.resourceURLMap[resource.url] = resource;
 
     if (resource.mainResource) {
@@ -783,27 +800,101 @@
         this.panels.resources.addResource(resource);
 }
 
-WebInspector.removeResource = function(resource)
+WebInspector.updateResource = function(identifier, payload)
 {
+    var resource = this.resources[identifier];
+    if (!resource)
+        return;
+
+    if (payload.didRequestChange) {
+        resource.url = payload.url;
+        resource.domain = payload.domain;
+        resource.path = payload.path;
+        resource.lastPathComponent = payload.lastPathComponent;
+        resource.requestHeaders = payload.requestHeaders;
+        resource.mainResource = payload.mainResource;
+    }
+
+    if (payload.didResponseChange) {
+        resource.mimeType = payload.mimeType;
+        resource.suggestedFilename = payload.suggestedFilename;
+        resource.expectedContentLength = payload.expectedContentLength;
+        resource.statusCode = payload.statusCode;
+        resource.suggestedFilename = payload.suggestedFilename;
+        resource.responseHeaders = payload.responseHeaders;
+    }
+
+    if (payload.didTypeChange) {
+        resource.type = payload.type;
+    }
+    
+    if (payload.didLengthChange) {
+        resource.contentLength = payload.contentLength;
+    }
+
+    if (payload.didCompletionChange) {
+        resource.failed = payload.failed;
+        resource.finished = payload.finished;
+    }
+
+    if (payload.didTimingChange) {
+        if (payload.startTime)
+            resource.startTime = payload.startTime;
+        if (payload.responseReceivedTime)
+            resource.responseReceivedTime = payload.responseReceivedTime;
+        if (payload.endTime)
+            resource.endTime = payload.endTime;
+    }
+}
+
+WebInspector.removeResource = function(identifier)
+{
+    var resource = this.resources[identifier];
+    if (!resource)
+        return;
+
     resource.category.removeResource(resource);
     delete this.resourceURLMap[resource.url];
-
-    this.resources.remove(resource, true);
+    delete this.resources[identifier];
 
     if (this.panels.resources)
         this.panels.resources.removeResource(resource);
 }
 
-WebInspector.addDatabase = function(database)
+WebInspector.addDatabase = function(payload)
 {
+    var database = new WebInspector.Database(
+        payload.database,
+        payload.domain,
+        payload.name,
+        payload.version);
     this.panels.databases.addDatabase(database);
 }
 
-WebInspector.addDOMStorage = function(domStorage)
+WebInspector.addDOMStorage = function(payload)
 {
+    var domStorage = new WebInspector.DOMStorage(
+        payload.domStorage,
+        payload.host,
+        payload.isLocalStorage);
     this.panels.databases.addDOMStorage(domStorage);
 }
 
+WebInspector.resourceTrackingWasEnabled = function()
+{
+    this.panels.resources.resourceTrackingWasEnabled();
+}
+
+WebInspector.resourceTrackingWasDisabled = function()
+{
+    this.panels.resources.resourceTrackingWasDisabled();
+}
+
+WebInspector.attachDebuggerWhenShown = function()
+{
+    this.panels.scripts.attachDebuggerWhenShown();
+}
+
 WebInspector.debuggerWasEnabled = function()
 {
     this.panels.scripts.debuggerWasEnabled();
@@ -839,6 +930,11 @@
     this.panels.scripts.debuggerPaused();
 }
 
+WebInspector.resumedScript = function()
+{
+    this.panels.scripts.debuggerResumed();
+}
+
 WebInspector.populateInterface = function()
 {
     for (var panelName in this.panels) {
@@ -859,7 +955,7 @@
     for (var category in this.resourceCategories)
         this.resourceCategories[category].removeAllResources();
 
-    this.resources = [];
+    this.resources = {};
     this.resourceURLMap = {};
     this.hoveredDOMNode = null;
 
@@ -879,9 +975,17 @@
     this.resourceURLMap[resource.url] = resource;
 }
 
-WebInspector.addMessageToConsole = function(msg)
+WebInspector.addMessageToConsole = function(payload)
 {
-    this.console.addMessage(msg);
+    var consoleMessage = new WebInspector.ConsoleMessage(
+        payload.source,
+        payload.level,
+        payload.line,
+        payload.url,
+        payload.groupLevel,
+        payload.repeatCount);
+    consoleMessage.setMessageBody(Array.prototype.slice.call(arguments, 1));
+    this.console.addMessage(consoleMessage);
 }
 
 WebInspector.addProfile = function(profile)
@@ -1256,6 +1360,7 @@
     "image/png":                   {2: true},
     "image/gif":                   {2: true},
     "image/bmp":                   {2: true},
+    "image/vnd.microsoft.icon":    {2: true},
     "image/x-icon":                {2: true},
     "image/x-xbitmap":             {2: true},
     "font/ttf":                    {3: true},
diff --git a/WebCore/inspector/front-end/utilities.js b/WebCore/inspector/front-end/utilities.js
index 7b0a20b..8fb50e2 100644
--- a/WebCore/inspector/front-end/utilities.js
+++ b/WebCore/inspector/front-end/utilities.js
@@ -962,10 +962,11 @@
         else if (c < 0)
             last = mid - 1;
         else {
-            //we return the first occurance of an item in the list.
+            // Return the first occurance of an item in the list.
             while (mid > 0 && aFunction(anObject, aList[mid - 1]) === 0)
                 mid--;
-            return mid;
+            first = mid;
+            break;
         }
     }
 
diff --git a/WebCore/loader/Cache.cpp b/WebCore/loader/Cache.cpp
index 539c5fc..6eeba77 100644
--- a/WebCore/loader/Cache.cpp
+++ b/WebCore/loader/Cache.cpp
@@ -182,6 +182,7 @@
 void Cache::revalidateResource(CachedResource* resource, DocLoader* docLoader)
 {
     ASSERT(resource);
+    ASSERT(resource->inCache());
     ASSERT(!disabled());
     if (resource->resourceToRevalidate())
         return;
@@ -211,7 +212,7 @@
     ASSERT(!m_resources.get(resource->url()));
     m_resources.set(resource->url(), resource);
     resource->setInCache(true);
-    resource->setExpirationDate(response.expirationDate());
+    resource->updateResponseAfterRevalidation(response);
     insertInLRUList(resource);
     int delta = resource->size();
     if (resource->decodedSize() && resource->hasClients())
@@ -391,15 +392,6 @@
     // The resource may have already been removed by someone other than our caller,
     // who needed a fresh copy for a reload. See <http://bugs.webkit.org/show_bug.cgi?id=12479#c6>.
     if (resource->inCache()) {
-        if (!resource->isCacheValidator()) {
-            // Notify all doc loaders that might be observing this object still that it has been
-            // extracted from the set of resources.
-            // No need to do this for cache validator resources, they are replaced automatically by using CachedResourceHandles.
-            HashSet<DocLoader*>::iterator end = m_docLoaders.end();
-            for (HashSet<DocLoader*>::iterator itr = m_docLoaders.begin(); itr != end; ++itr)
-                (*itr)->removeCachedResource(resource);
-        }
-        
         // Remove from the resource map.
         m_resources.remove(resource->url());
         resource->setInCache(false);
diff --git a/WebCore/loader/CachedCSSStyleSheet.cpp b/WebCore/loader/CachedCSSStyleSheet.cpp
index 1fb1a9180..11d1213 100644
--- a/WebCore/loader/CachedCSSStyleSheet.cpp
+++ b/WebCore/loader/CachedCSSStyleSheet.cpp
@@ -29,6 +29,7 @@
 
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
+#include "HTTPParsers.h"
 #include "TextResourceDecoder.h"
 #include "loader.h"
 #include <wtf/Vector.h>
@@ -131,8 +132,14 @@
     if (!enforceMIMEType)
         return true;
 
-    // This check exactly matches Firefox.
-    String mimeType = response().mimeType();
+    // This check exactly matches Firefox.  Note that we grab the Content-Type
+    // header directly because we want to see what the value is BEFORE content
+    // sniffing.  Firefox does this by setting a "type hint" on the channel.
+    // This implementation should be observationally equivalent.
+    //
+    // This code defaults to allowing the stylesheet for non-HTTP protocols so
+    // folks can use standards mode for local HTML documents.
+    String mimeType = extractMIMETypeFromMediaType(response().httpHeaderField("Content-Type"));
     return mimeType.isEmpty() || equalIgnoringCase(mimeType, "text/css") || equalIgnoringCase(mimeType, "application/x-unknown-content-type");
 }
  
diff --git a/WebCore/loader/CachedFont.h b/WebCore/loader/CachedFont.h
index fd19cdb..e4414c6 100644
--- a/WebCore/loader/CachedFont.h
+++ b/WebCore/loader/CachedFont.h
@@ -39,10 +39,11 @@
 
 class DocLoader;
 class Cache;
-class FontCustomPlatformData;
 class FontPlatformData;
 class SVGFontElement;
 
+struct FontCustomPlatformData;
+
 class CachedFont : public CachedResource {
 public:
     CachedFont(const String& url);
diff --git a/WebCore/loader/CachedImage.cpp b/WebCore/loader/CachedImage.cpp
index 5e06eb4..eac02dc 100644
--- a/WebCore/loader/CachedImage.cpp
+++ b/WebCore/loader/CachedImage.cpp
@@ -53,6 +53,7 @@
     : CachedResource(url, ImageResource)
     , m_image(0)
     , m_decodedDataDeletionTimer(this, &CachedImage::decodedDataDeletionTimerFired)
+    , m_httpStatusCodeErrorOccurred(false)
 {
     m_status = Unknown;
 }
@@ -61,6 +62,7 @@
     : CachedResource(String(), ImageResource)
     , m_image(image)
     , m_decodedDataDeletionTimer(this, &CachedImage::decodedDataDeletionTimerFired)
+    , m_httpStatusCodeErrorOccurred(false)
 {
     m_status = Cached;
     m_loading = false;
@@ -312,6 +314,7 @@
 {
     clear();
     m_errorOccurred = true;
+    m_data.clear();
     notifyObservers();
     m_loading = false;
     checkNotify();
diff --git a/WebCore/loader/CachedImage.h b/WebCore/loader/CachedImage.h
index 9c3442f..22a3774 100644
--- a/WebCore/loader/CachedImage.h
+++ b/WebCore/loader/CachedImage.h
@@ -67,7 +67,10 @@
 
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
     virtual void error();
-
+    
+    virtual void httpStatusCodeError() { m_httpStatusCodeErrorOccurred = true; }
+    bool httpStatusCodeErrorOccurred() const { return m_httpStatusCodeErrorOccurred; }
+    
     virtual bool schedule() const { return true; }
 
     void checkNotify();
@@ -96,6 +99,7 @@
 
     RefPtr<Image> m_image;
     Timer<CachedImage> m_decodedDataDeletionTimer;
+    bool m_httpStatusCodeErrorOccurred;
 };
 
 }
diff --git a/WebCore/loader/CachedResource.cpp b/WebCore/loader/CachedResource.cpp
index b4ee533..a2eaa2c 100644
--- a/WebCore/loader/CachedResource.cpp
+++ b/WebCore/loader/CachedResource.cpp
@@ -32,7 +32,10 @@
 #include "KURL.h"
 #include "PurgeableBuffer.h"
 #include "Request.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/MathExtras.h>
 #include <wtf/RefCountedLeakCounter.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
 using namespace WTF;
@@ -45,6 +48,7 @@
 
 CachedResource::CachedResource(const String& url, Type type)
     : m_url(url)
+    , m_responseTimestamp(currentTime())
     , m_lastDecodedAccessTime(0)
     , m_sendResourceLoadCallbacks(true)
     , m_preloadCount(0)
@@ -56,7 +60,6 @@
     , m_handleCount(0)
     , m_resourceToRevalidate(0)
     , m_isBeingRevalidated(false)
-    , m_expirationDate(0)
 {
 #ifndef NDEBUG
     cachedResourceLeakCounter.increment();
@@ -115,16 +118,50 @@
 
 bool CachedResource::isExpired() const
 {
-    if (!m_expirationDate)
+    if (m_response.isNull())
         return false;
-    time_t now = time(0);
-    return difftime(now, m_expirationDate) >= 0;
+
+    return currentAge() > freshnessLifetime();
+}
+    
+double CachedResource::currentAge() const
+{
+    // RFC2616 13.2.3
+    // No compensation for latency as that is not terribly important in practice
+    double dateValue = m_response.date();
+    double apparentAge = isfinite(dateValue) ? max(0., m_responseTimestamp - dateValue) : 0;
+    double ageValue = m_response.age();
+    double correctedReceivedAge = isfinite(ageValue) ? max(apparentAge, ageValue) : apparentAge;
+    double residentTime = currentTime() - m_responseTimestamp;
+    return correctedReceivedAge + residentTime;
+}
+    
+double CachedResource::freshnessLifetime() const
+{
+    // Cache non-http resources liberally
+    if (!m_response.url().protocolInHTTPFamily())
+        return std::numeric_limits<double>::max();
+
+    // RFC2616 13.2.4
+    double maxAgeValue = m_response.cacheControlMaxAge();
+    if (isfinite(maxAgeValue))
+        return maxAgeValue;
+    double expiresValue = m_response.expires();
+    double dateValue = m_response.date();
+    double creationTime = isfinite(dateValue) ? dateValue : m_responseTimestamp;
+    if (isfinite(expiresValue))
+        return expiresValue - creationTime;
+    double lastModifiedValue = m_response.lastModified();
+    if (isfinite(lastModifiedValue))
+        return (creationTime - lastModifiedValue) * 0.1;
+    // If no cache headers are present, the specification leaves the decision to the UA. Other browsers seem to opt for 0.
+    return 0;
 }
 
 void CachedResource::setResponse(const ResourceResponse& response)
 {
     m_response = response;
-    m_expirationDate = response.expirationDate();
+    m_responseTimestamp = currentTime();
 }
 
 void CachedResource::setRequest(Request* request)
@@ -258,7 +295,6 @@
 void CachedResource::clearResourceToRevalidate() 
 { 
     ASSERT(m_resourceToRevalidate);
-    ASSERT(m_resourceToRevalidate->m_isBeingRevalidated);
     m_resourceToRevalidate->m_isBeingRevalidated = false;
     m_resourceToRevalidate->deleteIfPossible();
     m_handlesToRevalidate.clear();
@@ -269,6 +305,7 @@
 void CachedResource::switchClientsToRevalidatedResource()
 {
     ASSERT(m_resourceToRevalidate);
+    ASSERT(m_resourceToRevalidate->inCache());
     ASSERT(!inCache());
 
     HashSet<CachedResourceHandleBase*>::iterator end = m_handlesToRevalidate.end();
@@ -299,6 +336,23 @@
         m_resourceToRevalidate->addClient(clientsToMove[n]);
 }
     
+void CachedResource::updateResponseAfterRevalidation(const ResourceResponse& validatingResponse)
+{
+    m_responseTimestamp = currentTime();
+
+    DEFINE_STATIC_LOCAL(const AtomicString, contentHeaderPrefix, ("content-"));
+    // RFC2616 10.3.5
+    // Update cached headers from the 304 response
+    const HTTPHeaderMap& newHeaders = validatingResponse.httpHeaderFields();
+    HTTPHeaderMap::const_iterator end = newHeaders.end();
+    for (HTTPHeaderMap::const_iterator it = newHeaders.begin(); it != end; ++it) {
+        // Don't allow 304 response to update content headers, these can't change but some servers send wrong values.
+        if (it->first.startsWith(contentHeaderPrefix, false))
+            continue;
+        m_response.setHTTPHeaderField(it->first, it->second);
+    }
+}
+    
 bool CachedResource::canUseCacheValidator() const
 {
     return !m_loading && (!m_response.httpHeaderField("Last-Modified").isEmpty() || !m_response.httpHeaderField("ETag").isEmpty());
@@ -309,9 +363,9 @@
     if (m_loading)
         return false;
 
-    // FIXME: Also look at max-age, min-fresh, max-stale in Cache-Control
     if (cachePolicy == CachePolicyCache)
         return m_response.cacheControlContainsNoCache() || (isExpired() && m_response.cacheControlContainsMustRevalidate());
+
     return isExpired() || m_response.cacheControlContainsNoCache();
 }
 
diff --git a/WebCore/loader/CachedResource.h b/WebCore/loader/CachedResource.h
index 63c250b..16cce26 100644
--- a/WebCore/loader/CachedResource.h
+++ b/WebCore/loader/CachedResource.h
@@ -82,6 +82,7 @@
     virtual String encoding() const { return String(); }
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived) = 0;
     virtual void error() = 0;
+    virtual void httpStatusCodeError() { error(); } // Images keep loading in spite of HTTP errors (for legacy compat with <img>, etc.).
 
     const String &url() const { return m_url; }
     Type type() const { return m_type; }
@@ -126,7 +127,8 @@
     // Called by the cache if the object has been removed from the cache
     // while still being referenced. This means the object should delete itself
     // if the number of clients observing it ever drops to 0.
-    void setInCache(bool b) { m_inCache = b; }
+    // The resource can be brought back to cache after successful revalidation.
+    void setInCache(bool b) { m_inCache = b; if (b) m_isBeingRevalidated = false; }
     bool inCache() const { return m_inCache; }
     
     void setInLiveDecodedResourcesList(bool b) { m_inLiveDecodedResourcesList = b; }
@@ -162,7 +164,7 @@
     void decreasePreloadCount() { ASSERT(m_preloadCount); --m_preloadCount; }
     
     void registerHandle(CachedResourceHandleBase* h) { ++m_handleCount; if (m_resourceToRevalidate) m_handlesToRevalidate.add(h); }
-    void unregisterHandle(CachedResourceHandleBase* h) { --m_handleCount; if (m_resourceToRevalidate) m_handlesToRevalidate.remove(h); if (!m_handleCount) deleteIfPossible(); }
+    void unregisterHandle(CachedResourceHandleBase* h) { ASSERT(m_handleCount > 0); --m_handleCount; if (m_resourceToRevalidate) m_handlesToRevalidate.remove(h); if (!m_handleCount) deleteIfPossible(); }
     
     bool canUseCacheValidator() const;
     bool mustRevalidate(CachePolicy) const;
@@ -172,12 +174,16 @@
     bool isPurgeable() const;
     bool wasPurged() const;
     
+    // This is used by the archive machinery to get at a purged resource without
+    // triggering a load. We should make it protected again if we can find a
+    // better way to handle the archive case.
+    bool makePurgeable(bool purgeable);
+
 protected:
     void setEncodedSize(unsigned);
     void setDecodedSize(unsigned);
     void didAccessDecodedData(double timeStamp);
 
-    bool makePurgeable(bool purgeable);
     bool isSafeToMakePurgeable() const;
     
     HashCountedSet<CachedResourceClient*> m_clients;
@@ -187,6 +193,8 @@
     Request* m_request;
 
     ResourceResponse m_response;
+    double m_responseTimestamp;
+
     RefPtr<SharedBuffer> m_data;
     OwnPtr<PurgeableBuffer> m_purgeableData;
 
@@ -200,7 +208,10 @@
     void setResourceToRevalidate(CachedResource*);
     void switchClientsToRevalidatedResource();
     void clearResourceToRevalidate();
-    void setExpirationDate(time_t expirationDate) { m_expirationDate = expirationDate; }
+    void updateResponseAfterRevalidation(const ResourceResponse& validatingResponse);
+
+    double currentAge() const;
+    double freshnessLifetime() const;
 
     unsigned m_encodedSize;
     unsigned m_decodedSize;
@@ -217,7 +228,6 @@
 protected:
     bool m_inCache;
     bool m_loading;
-    bool m_expireDateChanged;
 #ifndef NDEBUG
     bool m_deleted;
     unsigned m_lruIndex;
@@ -241,8 +251,6 @@
     bool m_isBeingRevalidated;
     // These handles will need to be updated to point to the m_resourceToRevalidate in case we get 304 response.
     HashSet<CachedResourceHandleBase*> m_handlesToRevalidate;
-    
-    time_t m_expirationDate;
 };
 
 }
diff --git a/WebCore/loader/DocLoader.cpp b/WebCore/loader/DocLoader.cpp
index c96348d..7b62074 100644
--- a/WebCore/loader/DocLoader.cpp
+++ b/WebCore/loader/DocLoader.cpp
@@ -37,6 +37,7 @@
 #include "CString.h"
 #include "Document.h"
 #include "DOMWindow.h"
+#include "HTMLElement.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "loader.h"
@@ -63,6 +64,9 @@
 
 DocLoader::~DocLoader()
 {
+    if (m_requestCount)
+        m_cache->loader()->cancelRequests(this);
+
     clearPreloads();
     DocumentResourceMap::iterator end = m_documentResources.end();
     for (DocumentResourceMap::iterator it = m_documentResources.begin(); it != end; ++it)
@@ -316,11 +320,16 @@
 
 CachePolicy DocLoader::cachePolicy() const
 {
-    return frame() ? frame()->loader()->cachePolicy() : CachePolicyVerify;
+    return frame() ? frame()->loader()->subresourceCachePolicy() : CachePolicyVerify;
 }
 
 void DocLoader::removeCachedResource(CachedResource* resource) const
 {
+#ifndef NDEBUG
+    DocumentResourceMap::iterator it = m_documentResources.find(resource->url());
+    if (it != m_documentResources.end())
+        ASSERT(it->second.get() == resource);
+#endif
     m_documentResources.remove(resource->url());
 }
 
@@ -389,7 +398,9 @@
         return;
     for (unsigned i = 0; i < count; ++i) {
         PendingPreload& preload = m_pendingPreloads[i];
-        requestPreload(preload.m_type, preload.m_url, preload.m_charset);
+        // Don't request preload if the resource already loaded normally (this will result in double load if the page is being reloaded with cached results ignored).
+        if (!cachedResource(m_doc->completeURL(preload.m_url)))
+            requestPreload(preload.m_type, preload.m_url, preload.m_charset);
     }
     m_pendingPreloads.clear();
 }
diff --git a/WebCore/loader/DocumentLoader.cpp b/WebCore/loader/DocumentLoader.cpp
index d0443e8..ffc61df 100644
--- a/WebCore/loader/DocumentLoader.cpp
+++ b/WebCore/loader/DocumentLoader.cpp
@@ -411,6 +411,10 @@
 
 void DocumentLoader::updateLoading()
 {
+    if (!m_frame) {
+        setLoading(false);
+        return;
+    }
     ASSERT(this == frameLoader()->activeDocumentLoader());
     setLoading(frameLoader()->isLoading());
 }
@@ -556,13 +560,20 @@
     if (!isCommitted())
         return 0;
     
-    Document* doc = m_frame->document();
-        
-    CachedResource* resource = doc->docLoader()->cachedResource(url);
-    if (!resource || resource->preloadResult() == CachedResource::PreloadReferenced)
+    CachedResource* resource = m_frame->document()->docLoader()->cachedResource(url);
+    if (!resource || !resource->isLoaded())
         return archiveResourceForURL(url);
-        
-    return ArchiveResource::create(resource->data(), url, resource->response());
+
+    // FIXME: This has the side effect of making the resource non-purgeable.
+    // It would be better if it didn't have this permanent effect.
+    if (!resource->makePurgeable(false))
+        return 0;
+
+    RefPtr<SharedBuffer> data = resource->data();
+    if (!data)
+        return 0;
+
+    return ArchiveResource::create(data.release(), url, resource->response());
 }
 
 void DocumentLoader::getSubresources(Vector<PassRefPtr<ArchiveResource> >& subresources) const
diff --git a/WebCore/loader/DocumentThreadableLoader.cpp b/WebCore/loader/DocumentThreadableLoader.cpp
index 685db8c..0de62ce 100644
--- a/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/WebCore/loader/DocumentThreadableLoader.cpp
@@ -43,7 +43,7 @@
 
 namespace WebCore {
 
-void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client)
+void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
 {
     bool sameOriginRequest = document->securityOrigin()->canRequest(request.url());
 
@@ -52,7 +52,7 @@
     ResourceResponse response;
     unsigned long identifier = std::numeric_limits<unsigned long>::max();
     if (document->frame())
-        identifier = document->frame()->loader()->loadResourceSynchronously(request, error, response, data);
+        identifier = document->frame()->loader()->loadResourceSynchronously(request, storedCredentials, error, response, data);
 
     // No exception for file:/// resources, see <rdar://problem/4962298>.
     // Also, if we have an HTTP response, then it wasn't a network error in fact.
@@ -77,21 +77,26 @@
     client.didFinishLoading(identifier);
 }
 
-PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff)
+PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, RedirectOriginCheck redirectOriginCheck)
 {
     ASSERT(document);
-    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, request, callbacksSetting, contentSniff));
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, request, callbacksSetting, contentSniff, storedCredentials, redirectOriginCheck));
     if (!loader->m_loader)
         loader = 0;
     return loader.release();
 }
 
-DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff)
+DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, RedirectOriginCheck redirectOriginCheck)
     : m_client(client)
     , m_document(document)
+    , m_allowStoredCredentials(storedCredentials == AllowStoredCredentials)
+    , m_sameOriginRequest(document->securityOrigin()->canRequest(request.url()))
+    , m_checkRedirectOrigin(redirectOriginCheck == RequireSameRedirectOrigin)
 {
     ASSERT(document);
     ASSERT(client);
+    ASSERT(storedCredentials == AllowStoredCredentials || storedCredentials == DoNotAllowStoredCredentials);
+    ASSERT(redirectOriginCheck == RequireSameRedirectOrigin || redirectOriginCheck == AllowDifferentRedirectOrigin);
     m_loader = SubresourceLoader::create(document->frame(), this, request, false, callbacksSetting == SendLoadCallbacks, contentSniff == SniffContent);
 }
 
@@ -112,52 +117,85 @@
     m_client = 0;
 }
 
-void DocumentThreadableLoader::willSendRequest(SubresourceLoader*, ResourceRequest& request, const ResourceResponse&)
+void DocumentThreadableLoader::willSendRequest(SubresourceLoader* loader, ResourceRequest& request, const ResourceResponse&)
 {
     ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
 
     // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
-    if (!m_document->securityOrigin()->canRequest(request.url())) {
+    if (m_checkRedirectOrigin && !m_document->securityOrigin()->canRequest(request.url())) {
         RefPtr<DocumentThreadableLoader> protect(this);
         m_client->didFailRedirectCheck();
-        cancel();
+        request = ResourceRequest();
     }
 }
 
-void DocumentThreadableLoader::didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+void DocumentThreadableLoader::didSendData(SubresourceLoader* loader, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
 {
     ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
     m_client->didSendData(bytesSent, totalBytesToBeSent);
 }
 
-void DocumentThreadableLoader::didReceiveResponse(SubresourceLoader*, const ResourceResponse& response)
+void DocumentThreadableLoader::didReceiveResponse(SubresourceLoader* loader, const ResourceResponse& response)
 {
     ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
     m_client->didReceiveResponse(response);
 }
 
-void DocumentThreadableLoader::didReceiveData(SubresourceLoader*, const char* data, int lengthReceived)
+void DocumentThreadableLoader::didReceiveData(SubresourceLoader* loader, const char* data, int lengthReceived)
 {
     ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
     m_client->didReceiveData(data, lengthReceived);
 }
 
 void DocumentThreadableLoader::didFinishLoading(SubresourceLoader* loader)
 {
-    ASSERT(loader);
+    ASSERT(loader == m_loader);
     ASSERT(m_client);
     m_client->didFinishLoading(loader->identifier());
 }
 
-void DocumentThreadableLoader::didFail(SubresourceLoader*, const ResourceError& error)
+void DocumentThreadableLoader::didFail(SubresourceLoader* loader, const ResourceError& error)
 {
     ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
     m_client->didFail(error);
 }
 
-void DocumentThreadableLoader::receivedCancellation(SubresourceLoader*, const AuthenticationChallenge& challenge)
+bool DocumentThreadableLoader::getShouldUseCredentialStorage(SubresourceLoader* loader, bool& shouldUseCredentialStorage)
+{
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    if (!m_allowStoredCredentials) {
+        shouldUseCredentialStorage = false;
+        return true;
+    }
+
+    return false; // Only FrameLoaderClient can ultimately permit credential use.
+}
+
+void DocumentThreadableLoader::didReceiveAuthenticationChallenge(SubresourceLoader* loader, const AuthenticationChallenge&)
+{
+    ASSERT(loader == m_loader);
+    // Users are not prompted for credentials for cross-origin requests.
+    if (!m_sameOriginRequest) {
+        RefPtr<DocumentThreadableLoader> protect(this);
+        m_client->didFail(loader->blockedError());
+        cancel();
+    }
+}
+
+void DocumentThreadableLoader::receivedCancellation(SubresourceLoader* loader, const AuthenticationChallenge& challenge)
 {
     ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
     m_client->didReceiveAuthenticationCancellation(challenge.failureResponse());
 }
 
diff --git a/WebCore/loader/DocumentThreadableLoader.h b/WebCore/loader/DocumentThreadableLoader.h
index ddf8570..079c725 100644
--- a/WebCore/loader/DocumentThreadableLoader.h
+++ b/WebCore/loader/DocumentThreadableLoader.h
@@ -44,8 +44,8 @@
 
     class DocumentThreadableLoader : public RefCounted<DocumentThreadableLoader>, public ThreadableLoader, private SubresourceLoaderClient  {
     public:
-        static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&);
-        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff);
+        static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
+        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, RedirectOriginCheck);
         virtual ~DocumentThreadableLoader();
 
         virtual void cancel();
@@ -58,7 +58,7 @@
         virtual void derefThreadableLoader() { deref(); }
 
     private:
-        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff);
+        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, RedirectOriginCheck);
         virtual void willSendRequest(SubresourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
         virtual void didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
 
@@ -67,11 +67,16 @@
         virtual void didFinishLoading(SubresourceLoader*);
         virtual void didFail(SubresourceLoader*, const ResourceError&);
 
+        virtual bool getShouldUseCredentialStorage(SubresourceLoader*, bool& shouldUseCredentialStorage);
+        virtual void didReceiveAuthenticationChallenge(SubresourceLoader*, const AuthenticationChallenge&);
         virtual void receivedCancellation(SubresourceLoader*, const AuthenticationChallenge&);
 
         RefPtr<SubresourceLoader> m_loader;
         ThreadableLoaderClient* m_client;
         Document* m_document;
+        bool m_allowStoredCredentials;
+        bool m_sameOriginRequest;
+        bool m_checkRedirectOrigin;
     };
 
 } // namespace WebCore
diff --git a/WebCore/loader/EmptyClients.h b/WebCore/loader/EmptyClients.h
index 4d75b7a..f6916ef 100644
--- a/WebCore/loader/EmptyClients.h
+++ b/WebCore/loader/EmptyClients.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Eric Seidel (eric@webkit.org)
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,12 +29,14 @@
 
 #include "ChromeClient.h"
 #include "ContextMenuClient.h"
-#include "DragClient.h"
+#include "Console.h"
 #include "DocumentLoader.h"
+#include "DragClient.h"
 #include "EditCommand.h"
 #include "EditorClient.h"
-#include "FocusDirection.h"
 #include "FloatRect.h"
+#include "FocusDirection.h"
+#include "FormState.h"
 #include "FrameLoaderClient.h"
 #include "InspectorClient.h"
 #include "ResourceError.h"
@@ -92,7 +95,7 @@
 
     virtual void setResizable(bool) { }
 
-    virtual void addMessageToConsole(const String&, unsigned, const String&) { }
+    virtual void addMessageToConsole(MessageSource, MessageLevel, const String&, unsigned, const String&) { }
 
     virtual bool canRunBeforeUnloadConfirmPanel() { return false; }
     virtual bool runBeforeUnloadConfirmPanel(const String&, Frame*) { return true; }
@@ -133,6 +136,14 @@
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) { }
 
     virtual void formStateDidChange(const Node*) { }
+
+    virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() { return 0; }
+
+    virtual bool setCursor(PlatformCursorHandle) { return false; }
+
+    virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const {}
+
+    virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) {}
 };
 
 class EmptyFrameLoaderClient : public FrameLoaderClient {
@@ -163,6 +174,7 @@
     virtual void dispatchDidFinishLoading(DocumentLoader*, unsigned long) { }
     virtual void dispatchDidFailLoading(DocumentLoader*, unsigned long, const ResourceError&) { }
     virtual bool dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int) { return false; }
+    virtual void dispatchDidLoadResourceByXMLHttpRequest(unsigned long, const ScriptString&) { }
 
     virtual void dispatchDidHandleOnloadEvents() { }
     virtual void dispatchDidReceiveServerRedirectForProvisionalLoad() { }
@@ -347,12 +359,31 @@
     virtual NSArray* pasteboardTypesForSelection(Frame*) { return 0; }
 #endif
 #endif
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    virtual void uppercaseWord() { }
+    virtual void lowercaseWord() { }
+    virtual void capitalizeWord() { }
+    virtual void showSubstitutionsPanel(bool) { }
+    virtual bool substitutionsPanelIsShowing() { return false; }
+    virtual void toggleSmartInsertDelete() { }
+    virtual bool isAutomaticQuoteSubstitutionEnabled() { return false; }
+    virtual void toggleAutomaticQuoteSubstitution() { }
+    virtual bool isAutomaticLinkDetectionEnabled() { return false; }
+    virtual void toggleAutomaticLinkDetection() { }
+    virtual bool isAutomaticDashSubstitutionEnabled() { return false; }
+    virtual void toggleAutomaticDashSubstitution() { }
+    virtual bool isAutomaticTextReplacementEnabled() { return false; }
+    virtual void toggleAutomaticTextReplacement() { }
+    virtual bool isAutomaticSpellingCorrectionEnabled() { return false; }
+    virtual void toggleAutomaticSpellingCorrection() { }
+#endif
     virtual void ignoreWordInSpellDocument(const String&) { }
     virtual void learnWord(const String&) { }
     virtual void checkSpellingOfString(const UChar*, int, int*, int*) { }
+    virtual String getAutoCorrectSuggestionForMisspelledWord(const String&) { return String(); }
     virtual void checkGrammarOfString(const UChar*, int, Vector<GrammarDetail>&, int*, int*) { }
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    virtual void checkSpellingAndGrammarOfParagraph(const UChar*, int, bool, Vector<TextCheckingResult>&)  { }
+    virtual void checkTextOfParagraph(const UChar*, int, uint64_t, Vector<TextCheckingResult>&) { };
 #endif
     virtual void updateSpellingUIWithGrammarString(const String&, const GrammarDetail&) { }
     virtual void updateSpellingUIWithMisspelledWord(const String&) { }
@@ -428,3 +459,4 @@
 }
 
 #endif // EmptyClients_h
+
diff --git a/WebCore/loader/FTPDirectoryDocument.cpp b/WebCore/loader/FTPDirectoryDocument.cpp
index 188c84c..ace4cfe 100644
--- a/WebCore/loader/FTPDirectoryDocument.cpp
+++ b/WebCore/loader/FTPDirectoryDocument.cpp
@@ -235,7 +235,11 @@
 
 #define localtime_r(x, y) localTimeQt(x, y)
 #elif PLATFORM(WIN_OS) && !defined(localtime_r)
+#if defined(_MSC_VER) && (_MSC_VER >= 1400) 
 #define localtime_r(x, y) localtime_s((y), (x))
+#else /* !_MSC_VER */ 
+#define localtime_r(x,y) (localtime(x)?(*(y)=*localtime(x),(y)):0)
+#endif
 #endif
 
 static String processFileDateString(const FTPTime& fileTime)
diff --git a/WebCore/loader/FTPDirectoryParser.cpp b/WebCore/loader/FTPDirectoryParser.cpp
index 8c76e97..6573fb6 100644
--- a/WebCore/loader/FTPDirectoryParser.cpp
+++ b/WebCore/loader/FTPDirectoryParser.cpp
@@ -50,7 +50,11 @@
 
 #define gmtime_r(x, y) gmtimeQt(x, y)
 #elif PLATFORM(WIN_OS) && !defined(gmtime_r)
+#if defined(_MSC_VER) && (_MSC_VER >= 1400) 
 #define gmtime_r(x, y) gmtime_s((y), (x))
+#else /* !_MSC_VER */ 
+#define gmtime_r(x,y) (gmtime(x)?(*(y)=*gmtime(x),(y)):0)
+#endif
 #endif
 
 FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& result)
diff --git a/WebCore/loader/FormState.cpp b/WebCore/loader/FormState.cpp
index c55b8ac..bd37086 100644
--- a/WebCore/loader/FormState.cpp
+++ b/WebCore/loader/FormState.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,16 +34,16 @@
 
 namespace WebCore {
 
-PassRefPtr<FormState> FormState::create(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame)
-{
-    return adoptRef(new FormState(form, values, sourceFrame));
-}
-
-FormState::FormState(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame)
+inline FormState::FormState(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame)
     : m_form(form)
-    , m_values(values)
     , m_sourceFrame(sourceFrame)
 {
+    m_textFieldValues.swap(textFieldValuesToAdopt);
+}
+
+PassRefPtr<FormState> FormState::create(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame)
+{
+    return adoptRef(new FormState(form, textFieldValuesToAdopt, sourceFrame));
 }
 
 }
diff --git a/WebCore/loader/FormState.h b/WebCore/loader/FormState.h
index 5370e8a..03317b1 100644
--- a/WebCore/loader/FormState.h
+++ b/WebCore/loader/FormState.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,28 +29,28 @@
 #ifndef FormState_h
 #define FormState_h
 
-#include <wtf/RefCounted.h>
-#include "StringHash.h"
-#include <wtf/HashMap.h>
+#include "PlatformString.h"
 
 namespace WebCore {
 
     class Frame;
     class HTMLFormElement;
 
+    typedef Vector<std::pair<String, String> > StringPairVector;
+
     class FormState : public RefCounted<FormState> {
     public:
-        static PassRefPtr<FormState> create(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame);
+        static PassRefPtr<FormState> create(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>);
 
         HTMLFormElement* form() const { return m_form.get(); }
-        const HashMap<String, String>& values() const { return m_values; }
+        const StringPairVector& textFieldValues() const { return m_textFieldValues; }
         Frame* sourceFrame() const { return m_sourceFrame.get(); }
 
     private:
-        FormState(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame);
+        FormState(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>);
 
         RefPtr<HTMLFormElement> m_form;
-        HashMap<String, String> m_values;
+        StringPairVector m_textFieldValues;
         RefPtr<Frame> m_sourceFrame;
     };
 
diff --git a/WebCore/loader/FrameLoader.cpp b/WebCore/loader/FrameLoader.cpp
index e5ce94a..88beb24 100644
--- a/WebCore/loader/FrameLoader.cpp
+++ b/WebCore/loader/FrameLoader.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -83,6 +83,7 @@
 #include "ResourceRequest.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
+#include "ScriptString.h"
 #include "ScriptValue.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
@@ -154,45 +155,22 @@
     return noAccessSchemes;
 }
 
-struct FormSubmission {
-    FormSubmission(const char* action, const String& url, PassRefPtr<FormData> formData,
-                   const String& target, const String& contentType, const String& boundary,
-                   PassRefPtr<Event> event, bool lockHistory, bool lockBackForwardList)
-        : action(action)
-        , url(url)
-        , formData(formData)
-        , target(target)
-        , contentType(contentType)
-        , boundary(boundary)
-        , event(event)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-    {
-    }
-
-    const char* action;
-    String url;
-    RefPtr<FormData> formData;
-    String target;
-    String contentType;
-    String boundary;
-    RefPtr<Event> event;
-    bool lockHistory;
-    bool lockBackForwardList;
-};
-
 struct ScheduledRedirection {
-    enum Type { redirection, locationChange, historyNavigation, locationChangeDuringLoad };
+    enum Type { redirection, locationChange, historyNavigation, formSubmission };
 
     const Type type;
     const double delay;
     const String url;
     const String referrer;
+    const FrameLoadRequest frameRequest;
+    const RefPtr<Event> event;
+    const RefPtr<FormState> formState;
     const int historySteps;
     const bool lockHistory;
     const bool lockBackForwardList;
     const bool wasUserGesture;
     const bool wasRefresh;
+    const bool wasDuringLoad;
 
     ScheduledRedirection(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
         : type(redirection)
@@ -203,12 +181,13 @@
         , lockBackForwardList(lockBackForwardList)
         , wasUserGesture(wasUserGesture)
         , wasRefresh(refresh)
+        , wasDuringLoad(false)
     {
         ASSERT(!url.isEmpty());
     }
 
-    ScheduledRedirection(Type locationChangeType, const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
-        : type(locationChangeType)
+    ScheduledRedirection(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh, bool duringLoad)
+        : type(locationChange)
         , delay(0)
         , url(url)
         , referrer(referrer)
@@ -217,8 +196,8 @@
         , lockBackForwardList(lockBackForwardList)
         , wasUserGesture(wasUserGesture)
         , wasRefresh(refresh)
+        , wasDuringLoad(duringLoad)
     {
-        ASSERT(locationChangeType == locationChange || locationChangeType == locationChangeDuringLoad);
         ASSERT(!url.isEmpty());
     }
 
@@ -230,10 +209,35 @@
         , lockBackForwardList(false)
         , wasUserGesture(false)
         , wasRefresh(false)
+        , wasDuringLoad(false)
     {
     }
-};
 
+    ScheduledRedirection(const FrameLoadRequest& frameRequest,
+            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState,
+            bool duringLoad)
+        : type(formSubmission)
+        , delay(0)
+        , frameRequest(frameRequest)
+        , event(event)
+        , formState(formState)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(false)
+        , wasRefresh(false)
+        , wasDuringLoad(duringLoad)
+    {
+        ASSERT(!frameRequest.isEmpty());
+        ASSERT(this->formState);
+    }
+};
+ 
+#if ENABLE(XHTMLMP)
+static const char defaultAcceptHeader[] = "application/xml,application/vnd.wap.xhtml+xml,application/xhtml+xml;profile='http://www.wapforum.org/xhtml',text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
+#else
+static const char defaultAcceptHeader[] = "application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
+#endif
 static double storedTimeOfLastCompletedLoad;
 static FrameLoader::LocalLoadPolicy localLoadPolicy = FrameLoader::AllowLocalLoadsForLocalOnly;
 
@@ -282,11 +286,11 @@
     , m_quickRedirectComing(false)
     , m_sentRedirectNotification(false)
     , m_inStopAllLoaders(false)
-    , m_navigationDuringLoad(false)
     , m_isExecutingJavaScriptFormAction(false)
     , m_isRunningScript(false)
     , m_didCallImplicitClose(false)
     , m_wasUnloadEventEmitted(false)
+    , m_unloadEventBeingDispatched(false)
     , m_isComplete(false)
     , m_isLoadingMainResource(false)
     , m_cancellingWithLoadInProgress(false)
@@ -358,7 +362,7 @@
         Frame* frame = frameLoaderForFrameLookup->frame()->tree()->find(request.frameName());
         if (frame && shouldAllowNavigation(frame)) {
             if (!request.resourceRequest().url().isEmpty())
-                frame->loader()->loadFrameRequestWithFormAndValues(request, false, false, 0, 0, HashMap<String, String>());
+                frame->loader()->loadFrameRequest(request, false, false, 0, 0);
             if (Page* page = frame->page())
                 page->chrome()->focus();
             created = false;
@@ -416,11 +420,6 @@
     return m_client->canHandleRequest(request);
 }
 
-void FrameLoader::changeLocation(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool userGesture, bool refresh)
-{
-    changeLocation(completeURL(url), referrer, lockHistory, lockBackForwardList, userGesture, refresh);
-}
-
 void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool userGesture, bool refresh)
 {
     RefPtr<Frame> protect(m_frame);
@@ -436,22 +435,12 @@
     urlSelected(request, "_self", 0, lockHistory, lockBackForwardList, userGesture);
 }
 
-void FrameLoader::urlSelected(const FrameLoadRequest& request, Event* event, bool lockHistory, bool lockBackForwardList)
-{
-    FrameLoadRequest copy = request;
-    if (copy.resourceRequest().httpReferrer().isEmpty())
-        copy.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
-    addHTTPOriginIfNeeded(copy.resourceRequest(), outgoingOrigin());
-
-    loadFrameRequestWithFormAndValues(copy, lockHistory, lockBackForwardList, event, 0, HashMap<String, String>());
-}
-    
-void FrameLoader::urlSelected(const ResourceRequest& request, const String& _target, Event* triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture)
+void FrameLoader::urlSelected(const ResourceRequest& request, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture)
 {
     if (executeIfJavaScriptURL(request.url(), userGesture, false))
         return;
 
-    String target = _target;
+    String target = passedTarget;
     if (target.isEmpty())
         target = m_frame->document()->baseTarget();
 
@@ -460,7 +449,11 @@
     frameRequest.setWasUserGesture(userGesture);
 #endif
 
-    urlSelected(frameRequest, triggeringEvent, lockHistory, lockBackForwardList);
+    if (frameRequest.resourceRequest().httpReferrer().isEmpty())
+        frameRequest.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
+    addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
+
+    loadFrameRequest(frameRequest, lockHistory, lockBackForwardList, triggeringEvent, 0);
 }
 
 bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String& urlString, const AtomicString& frameName)
@@ -468,7 +461,7 @@
     // Support for <frame src="javascript:string">
     KURL scriptURL;
     KURL url;
-    if (protocolIs(urlString, "javascript")) {
+    if (protocolIsJavaScript(urlString)) {
         scriptURL = completeURL(urlString); // completeURL() encodes the URL.
         url = blankURL();
     } else
@@ -507,8 +500,7 @@
     }
 
     bool hideReferrer = shouldHideReferrer(url, referrer);
-    RefPtr<Frame> frame = m_client->createFrame(url, name, ownerElement, hideReferrer ? String() : referrer,
-                                         allowsScrolling, marginWidth, marginHeight);
+    RefPtr<Frame> frame = m_client->createFrame(url, name, ownerElement, hideReferrer ? String() : referrer, allowsScrolling, marginWidth, marginHeight);
 
     if (!frame)  {
         checkCallImplicitClose();
@@ -538,47 +530,61 @@
     return frame.get();
 }
 
-void FrameLoader::submitFormAgain()
-{
-    if (m_isRunningScript)
-        return;
-    OwnPtr<FormSubmission> form(m_deferredFormSubmission.release());
-    if (!form)
-        return;
-    submitForm(form->action, form->url, form->formData, form->target, form->contentType, form->boundary, form->event.get(), form->lockHistory, form->lockBackForwardList);
-}
-
 void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<FormData> formData,
-    const String& target, const String& contentType, const String& boundary, Event* event, bool lockHistory, bool lockBackForwardList)
+    const String& target, const String& contentType, const String& boundary,
+    bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
 {
+    ASSERT(action);
+    ASSERT(strcmp(action, "GET") == 0 || strcmp(action, "POST") == 0);
     ASSERT(formData);
+    ASSERT(formState);
+    ASSERT(formState->sourceFrame() == m_frame);
     
     if (!m_frame->page())
         return;
     
     KURL u = completeURL(url.isNull() ? "" : url);
-    // FIXME: Do we really need to special-case an empty URL?
-    // Would it be better to just go on with the form submisson and let the I/O fail?
     if (u.isEmpty())
         return;
 
-    if (u.protocolIs("javascript")) {
+    if (protocolIsJavaScript(u)) {
         m_isExecutingJavaScriptFormAction = true;
         executeIfJavaScriptURL(u, false, false);
         m_isExecutingJavaScriptFormAction = false;
         return;
     }
 
-    if (m_isRunningScript) {
-        if (m_deferredFormSubmission)
-            return;
-        m_deferredFormSubmission.set(new FormSubmission(action, url, formData, target, contentType, boundary, event, lockHistory, lockBackForwardList));
+    FrameLoadRequest frameRequest;
+
+    String targetOrBaseTarget = target.isEmpty() ? m_frame->document()->baseTarget() : target;
+    Frame* targetFrame = findFrameForNavigation(targetOrBaseTarget);
+    if (!targetFrame) {
+        targetFrame = m_frame;
+        frameRequest.setFrameName(targetOrBaseTarget);
+    }
+    if (!targetFrame->page())
         return;
+
+    // FIXME: We'd like to remove this altogether and fix the multiple form submission issue another way.
+
+    // We do not want to submit more than one form from the same page, nor do we want to submit a single
+    // form more than once. This flag prevents these from happening; not sure how other browsers prevent this.
+    // The flag is reset in each time we start handle a new mouse or key down event, and
+    // also in setView since this part may get reused for a page from the back/forward cache.
+    // The form multi-submit logic here is only needed when we are submitting a form that affects this frame.
+
+    // FIXME: Frame targeting is only one of the ways the submission could end up doing something other
+    // than replacing this frame's content, so this check is flawed. On the other hand, the check is hardly
+    // needed any more now that we reset m_submittedFormURL on each mouse or key down event.
+
+    if (m_frame->tree()->isDescendantOf(targetFrame)) {
+        if (m_submittedFormURL == u)
+            return;
+        m_submittedFormURL = u;
     }
 
     formData->generateFiles(m_frame->page()->chrome()->client());
     
-    FrameLoadRequest frameRequest;
 #ifdef ANDROID_USER_GESTURE
     frameRequest.setWasUserGesture(userGestureHint());
 #endif
@@ -586,25 +592,11 @@
     if (!m_outgoingReferrer.isEmpty())
         frameRequest.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
 
-    frameRequest.setFrameName(target.isEmpty() ? m_frame->document()->baseTarget() : target);
-
-    // Handle mailto: forms
-    bool isMailtoForm = equalIgnoringCase(u.protocol(), "mailto");
-    if (isMailtoForm && strcmp(action, "GET") != 0) {
-        // Append body= for POST mailto, replace the whole query string for GET one.
-        String body = formData->flattenToString();
-        String query = u.query();
-        if (!query.isEmpty())
-            query.append('&');
-        u.setQuery(query + body);
-    }
-
-    if (strcmp(action, "GET") == 0) {
+    if (strcmp(action, "GET") == 0)
         u.setQuery(formData->flattenToString());
-    } else {
-        if (!isMailtoForm)
-            frameRequest.resourceRequest().setHTTPBody(formData.get());
+    else {
         frameRequest.resourceRequest().setHTTPMethod("POST");
+        frameRequest.resourceRequest().setHTTPBody(formData);
 
         // construct some user headers if necessary
         if (contentType.isNull() || contentType == "application/x-www-form-urlencoded")
@@ -616,7 +608,20 @@
     frameRequest.resourceRequest().setURL(u);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
-    submitForm(frameRequest, event, lockHistory, lockBackForwardList);
+    // Navigation of a subframe during loading of the main frame does not create a new back/forward item.
+    // Strangely, we only implement this rule for form submission; time will tell if we need it for other types of navigation.
+    // The definition of "during load" is any time before the load event has been handled.
+    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
+    if (Page* targetPage = targetFrame->page()) {
+        Frame* mainFrame = targetPage->mainFrame();
+        if (mainFrame != targetFrame) {
+            Document* document = mainFrame->document();
+            if (!mainFrame->loader()->isComplete() || (document && document->processingLoadEvent()))
+                lockBackForwardList = true;
+        }
+    }
+
+    targetFrame->loader()->scheduleFormSubmission(frameRequest, lockHistory, lockBackForwardList, event, formState);
 }
 
 void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
@@ -630,18 +635,19 @@
                 Node* currentFocusedNode = m_frame->document()->focusedNode();
                 if (currentFocusedNode)
                     currentFocusedNode->aboutToUnload();
-                m_frame->document()->dispatchWindowEvent(eventNames().unloadEvent, false, false);
+                m_unloadEventBeingDispatched = true;
+                if (m_frame->domWindow())
+                    m_frame->domWindow()->dispatchUnloadEvent();
+                m_unloadEventBeingDispatched = false;
                 if (m_frame->document())
-                    m_frame->document()->updateRendering();
+                    m_frame->document()->updateStyleIfNeeded();
                 m_wasUnloadEventEmitted = true;
-                if (m_frame->eventHandler()->pendingFrameUnloadEventCount())
-                    m_frame->eventHandler()->clearPendingFrameUnloadEventCount();
-                if (m_frame->eventHandler()->pendingFrameBeforeUnloadEventCount())
-                    m_frame->eventHandler()->clearPendingFrameBeforeUnloadEventCount();
             }
         }
+
+        // Dispatching the unload event could have made m_frame->document() null.
         if (m_frame->document() && !m_frame->document()->inPageCache())
-            m_frame->document()->removeAllEventListenersFromAllNodes();
+            m_frame->document()->removeAllEventListeners();
     }
 
     m_isComplete = true; // to avoid calling completed() in finishedParsing() (David)
@@ -714,7 +720,7 @@
         return KURL(m_frame->document()->iconURL());
 
     // Don't return a favicon iconURL unless we're http or https
-    if (!m_URL.protocolIs("http") && !m_URL.protocolIs("https"))
+    if (!m_URL.protocolInHTTPFamily())
         return KURL();
 
     KURL url;
@@ -728,10 +734,11 @@
 
 bool FrameLoader::didOpenURL(const KURL& url)
 {
-    if (m_scheduledRedirection && m_scheduledRedirection->type == ScheduledRedirection::locationChangeDuringLoad)
+    if (m_scheduledRedirection && m_scheduledRedirection->wasDuringLoad) {
         // A redirect was scheduled before the document was created.
         // This can happen when one frame changes another frame's location.
         return false;
+    }
 
     cancelRedirection();
     m_frame->editor()->clearLastEditCommand();
@@ -741,11 +748,15 @@
     m_isLoadingMainResource = true;
     m_didCallImplicitClose = false;
 
-    m_frame->setJSStatusBarText(String());
-    m_frame->setJSDefaultStatusBarText(String());
-
+    // If we are still in the process of initializing an empty document then
+    // its frame is not in a consistent state for rendering, so avoid setJSStatusBarText
+    // since it may cause clients to attempt to render the frame.
+    if (!m_creatingInitialEmptyDocument) {
+        m_frame->setJSStatusBarText(String());
+        m_frame->setJSDefaultStatusBarText(String());
+    }
     m_URL = url;
-    if ((m_URL.protocolIs("http") || m_URL.protocolIs("https")) && !m_URL.host().isEmpty() && m_URL.path().isEmpty())
+    if (m_URL.protocolInHTTPFamily() && !m_URL.host().isEmpty() && m_URL.path().isEmpty())
         m_URL.setPath("/");
     m_workingURL = m_URL;
 
@@ -773,9 +784,12 @@
 
 bool FrameLoader::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool replaceDocument)
 {
-    if (!url.protocolIs("javascript"))
+    if (!protocolIsJavaScript(url))
         return false;
 
+    if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
+        return true;
+
     String script = decodeURLEscapeSequences(url.string().substring(strlen("javascript:")));
     ScriptValue result = executeScript(script, userGesture);
 
@@ -816,8 +830,7 @@
 
     if (!wasRunningScript) {
         m_isRunningScript = false;
-        submitFormAgain();
-        Document::updateDocumentsRendering();
+        Document::updateStyleForAllDocuments();
     }
 
     return result;
@@ -896,10 +909,12 @@
     dispatchDidCommitLoad();
     dispatchWindowObjectAvailable();
     
-    String ptitle = m_documentLoader->title();
-    // If we have a title let the WebView know about it.
-    if (!ptitle.isNull())
-        m_client->dispatchDidReceiveTitle(ptitle);
+    if (m_documentLoader) {
+        String ptitle = m_documentLoader->title();
+        // If we have a title let the WebView know about it.
+        if (!ptitle.isNull())
+            m_client->dispatchDidReceiveTitle(ptitle);
+    }
 
     m_workingURL = KURL();
 
@@ -979,7 +994,7 @@
     m_frame->domWindow()->setURL(document->url());
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
-    updatePolicyBaseURL();
+    updateFirstPartyForCookies();
 
     Settings* settings = document->settings();
     document->docLoader()->setAutoLoadImages(settings && settings->loadsImagesAutomatically());
@@ -1351,12 +1366,6 @@
     return m_frame->document()->baseURL();
 }
 
-String FrameLoader::baseTarget() const
-{
-    ASSERT(m_frame->document());
-    return m_frame->document()->baseTarget();
-}
-
 KURL FrameLoader::completeURL(const String& url)
 {
     ASSERT(m_frame->document());
@@ -1401,7 +1410,7 @@
     // fragment part, we don't need to schedule the location change.
     KURL parsedURL(url);
     if (parsedURL.hasRef() && equalIgnoringRef(m_URL, parsedURL)) {
-        changeLocation(url, referrer, lockHistory, lockBackForwardList, wasUserGesture);
+        changeLocation(completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
         return;
     }
 
@@ -1409,18 +1418,23 @@
     // This may happen when a frame changes the location of another frame.
     bool duringLoad = !m_committedFirstRealDocumentLoad;
 
-    // If a redirect was scheduled during a load, then stop the current load.
-    // Otherwise when the current load transitions from a provisional to a 
-    // committed state, pending redirects may be cancelled. 
-    if (duringLoad) {
-        if (m_provisionalDocumentLoader)
-            m_provisionalDocumentLoader->stopLoading();
-        stopLoading(true);   
-    }
+    scheduleRedirection(new ScheduledRedirection(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false, duringLoad));
+}
 
-    ScheduledRedirection::Type type = duringLoad
-        ? ScheduledRedirection::locationChangeDuringLoad : ScheduledRedirection::locationChange;
-    scheduleRedirection(new ScheduledRedirection(type, url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false));
+void FrameLoader::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
+    bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+{
+    ASSERT(m_frame->page());
+    ASSERT(!frameRequest.isEmpty());
+
+    // FIXME: Do we need special handling for form submissions where the URL is the same
+    // as the current one except for the fragment part? See scheduleLocationChange above.
+
+    // Handle a location change of a page with no document as a special case.
+    // This may happen when a frame changes the location of another frame.
+    bool duringLoad = !m_committedFirstRealDocumentLoad;
+
+    scheduleRedirection(new ScheduledRedirection(frameRequest, lockHistory, lockBackForwardList, event, formState, duringLoad));
 }
 
 void FrameLoader::scheduleRefresh(bool wasUserGesture)
@@ -1431,8 +1445,7 @@
     if (m_URL.isEmpty())
         return;
 
-    ScheduledRedirection::Type type = ScheduledRedirection::locationChange;
-    scheduleRedirection(new ScheduledRedirection(type, m_URL.string(), m_outgoingReferrer, true, true, wasUserGesture, true));
+    scheduleRedirection(new ScheduledRedirection(m_URL.string(), m_outgoingReferrer, true, true, wasUserGesture, true, false));
 }
 
 bool FrameLoader::isLocationChange(const ScheduledRedirection& redirection)
@@ -1442,7 +1455,7 @@
             return false;
         case ScheduledRedirection::historyNavigation:
         case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::locationChangeDuringLoad:
+        case ScheduledRedirection::formSubmission:
             return true;
     }
     ASSERT_NOT_REACHED();
@@ -1460,18 +1473,6 @@
         return;
     }
 
-    // If the steps to navigate is not zero (which needs to force a reload), and if we think the navigation is going to be a fragment load
-    // (when the URL we're going to navigate to is the same as the current one, except for the fragment part - but not exactly the same because that's a reload),
-    // then we don't need to schedule the navigation.
-    if (steps != 0) {
-        KURL destination = historyURL(steps);
-        // FIXME: This doesn't seem like a reliable way to tell whether or not the load will be a fragment load.
-        if (equalIgnoringRef(m_URL, destination) && m_URL != destination) {
-            goBackOrForward(steps);
-            return;
-        }
-    }
-    
     scheduleRedirection(new ScheduledRedirection(steps));
 }
 
@@ -1514,8 +1515,7 @@
     switch (redirection->type) {
         case ScheduledRedirection::redirection:
         case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::locationChangeDuringLoad:
-            changeLocation(redirection->url, redirection->referrer,
+            changeLocation(KURL(redirection->url), redirection->referrer,
                 redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
             return;
         case ScheduledRedirection::historyNavigation:
@@ -1528,17 +1528,21 @@
             // in both IE and NS (but not in Mozilla). We can't easily do that.
             goBackOrForward(redirection->historySteps);
             return;
+        case ScheduledRedirection::formSubmission:
+            // The submitForm function will find a target frame before using the redirection timer.
+            // Now that the timer has fired, we need to repeat the security check which normally is done when
+            // selecting a target, in case conditions have changed. Other code paths avoid this by targeting
+            // without leaving a time window. If we fail the check just silently drop the form submission.
+            if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
+                return;
+            loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
+                redirection->event, redirection->formState);
+            return;
     }
 
     ASSERT_NOT_REACHED();
 }
 
-/*
-    In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
-    The item that was the target of the user's navigation is designated as the "targetItem".  
-    When this method is called with doClip=YES we're able to create the whole tree except for the target's children, 
-    which will be loaded in the future.  That part of the tree will be filled out as the child loads are committed.
-*/
 void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer, Frame* childFrame)
 {
     ASSERT(childFrame);
@@ -1552,14 +1556,14 @@
     // If we're moving in the back/forward list, we might want to replace the content
     // of this child frame with whatever was there at that point.
     if (parentItem && parentItem->children().size() && isBackForwardLoadType(loadType)) {
-        HistoryItem* childItem = parentItem->childItemWithName(childFrame->tree()->name());
+        HistoryItem* childItem = parentItem->childItemWithTarget(childFrame->tree()->name());
         if (childItem) {
             // Use the original URL to ensure we get all the side-effects, such as
             // onLoad handlers, of any redirects that happened. An example of where
             // this is needed is Radar 3213556.
             workingURL = KURL(childItem->originalURLString());
             childLoadType = loadType;
-            childFrame->loader()->setProvisionalHistoryItem(childItem);
+            childFrame->loader()->m_provisionalHistoryItem = childItem;
         }
     }
 
@@ -1570,11 +1574,7 @@
         childFrame->loader()->loadArchive(subframeArchive.release());
     else
 #endif
-#ifdef ANDROID_USER_GESTURE
-        childFrame->loader()->loadURL(workingURL, referer, String(), false, childLoadType, 0, 0, false);
-#else
         childFrame->loader()->loadURL(workingURL, referer, String(), false, childLoadType, 0, 0);
-#endif
 }
 
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
@@ -1654,7 +1654,7 @@
 
     // We need to update the layout before scrolling, otherwise we could
     // really mess things up if an anchor scroll comes at a bad moment.
-    m_frame->document()->updateRendering();
+    m_frame->document()->updateStyleIfNeeded();
     // Only do a layout if changes have occurred that make it necessary.
     if (m_frame->view() && m_frame->contentRenderer() && m_frame->contentRenderer()->needsLayout())
         m_frame->view()->layout();
@@ -1672,8 +1672,11 @@
 #ifdef ANDROID_SCROLL_ON_GOTO_ANCHOR
     android::WebFrame::getWebFrame(m_frame)->setUserInitiatedClick(true);
 #endif
-    if (renderer)
+    if (renderer) {
         renderer->enclosingLayer()->scrollRectToVisible(rect, true, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignTopAlways);
+        if (m_frame->view())
+            m_frame->view()->setLockedToAnchor(true);
+    }
 #ifdef ANDROID_SCROLL_ON_GOTO_ANCHOR
     android::WebFrame::getWebFrame(m_frame)->setUserInitiatedClick(false);
 #endif
@@ -1760,9 +1763,9 @@
             return false;
         }
 
-        widget = m_client->createPlugin(IntSize(renderer->contentWidth(), renderer->contentHeight()), 
+        widget = m_client->createPlugin(IntSize(renderer->contentWidth(), renderer->contentHeight()),
                                         element, url, paramNames, paramValues, mimeType,
-                                        m_frame->document()->isPluginDocument());
+                                        m_frame->document()->isPluginDocument() && !m_containsPlugIns);
         if (widget) {
             renderer->setWidget(widget);
             m_containsPlugIns = true;
@@ -1772,22 +1775,6 @@
     return widget != 0;
 }
 
-void FrameLoader::clearRecordedFormValues()
-{
-    m_formAboutToBeSubmitted = 0;
-    m_formValuesAboutToBeSubmitted.clear();
-}
-
-void FrameLoader::setFormAboutToBeSubmitted(PassRefPtr<HTMLFormElement> element)
-{
-    m_formAboutToBeSubmitted = element;
-}
-
-void FrameLoader::recordFormValue(const String& name, const String& value)
-{
-    m_formValuesAboutToBeSubmitted.set(name, value);
-}
-
 void FrameLoader::parentCompleted()
 {
     if (m_scheduledRedirection && !m_redirectionTimer.isActive())
@@ -1842,22 +1829,11 @@
 }
 
 void FrameLoader::provisionalLoadStarted()
-{
+{    
 #ifdef ANDROID_INSTRUMENT
     if (!m_frame->tree()->parent())
         android::TimeCounter::reset();
 #endif
-
-    Page* page = m_frame->page();
-    
-    // this is used to update the current history item
-    // in the event of a navigation aytime during loading
-    m_navigationDuringLoad = false;
-    if (page) {
-        Document *document = page->mainFrame()->document();
-        m_navigationDuringLoad = !page->mainFrame()->loader()->isComplete() || (document && document->processingLoadEvent());
-    }
-    
     m_firstLayoutDone = false;
     cancelRedirection(true);
     m_client->provisionalLoadStarted();
@@ -1871,12 +1847,6 @@
     return frame->script()->processingUserGesture(); // FIXME: Use pageIsProcessingUserGesture.
 }
 
-void FrameLoader::didNotOpenURL(const KURL& url)
-{
-    if (m_submittedFormURL == url)
-        m_submittedFormURL = KURL();
-}
-
 void FrameLoader::resetMultipleFormSubmissionProtection()
 {
     m_submittedFormURL = KURL();
@@ -1910,13 +1880,13 @@
         // the right NPObjects. See <rdar://problem/5197041> for more information.
         && !m_containsPlugIns
         && !m_URL.protocolIs("https")
-        && !m_frame->document()->hasWindowEventListener(eventNames().unloadEvent)
+        && (!m_frame->domWindow() || !m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
 #if ENABLE(DATABASE)
         && !m_frame->document()->hasOpenDatabases()
 #endif
         && !m_frame->document()->usingGeolocation()
         && m_currentHistoryItem
-        && !isQuickRedirectComing()
+        && !m_quickRedirectComing
         && !m_documentLoader->isLoadingInAPISense()
         && !m_documentLoader->isStopping()
         && m_frame->document()->canSuspendActiveDOMObjects()
@@ -2052,7 +2022,7 @@
             { PCLOG("   -Frame contains plugins"); cannotCache = true; }
         if (m_URL.protocolIs("https"))
             { PCLOG("   -Frame is HTTPS"); cannotCache = true; }
-        if (m_frame->document()->hasWindowEventListener(eventNames().unloadEvent))
+        if (m_frame->domWindow() && m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
             { PCLOG("   -Frame has an unload event listener"); cannotCache = true; }
 #if ENABLE(DATABASE)
         if (m_frame->document()->hasOpenDatabases())
@@ -2062,7 +2032,7 @@
             { PCLOG("   -Frame uses Geolocation"); cannotCache = true; }
         if (!m_currentHistoryItem)
             { PCLOG("   -No current history item"); cannotCache = true; }
-        if (isQuickRedirectComing())
+        if (m_quickRedirectComing)
             { PCLOG("   -Quick redirect is coming"); cannotCache = true; }
         if (m_documentLoader->isLoadingInAPISense())
             { PCLOG("   -DocumentLoader is still loading in API sense"); cannotCache = true; }
@@ -2091,19 +2061,19 @@
 }
 #endif
 
-void FrameLoader::updatePolicyBaseURL()
+void FrameLoader::updateFirstPartyForCookies()
 {
     if (m_frame->tree()->parent())
-        setPolicyBaseURL(m_frame->tree()->parent()->document()->policyBaseURL());
+        setFirstPartyForCookies(m_frame->tree()->parent()->document()->firstPartyForCookies());
     else
-        setPolicyBaseURL(m_URL);
+        setFirstPartyForCookies(m_URL);
 }
 
-void FrameLoader::setPolicyBaseURL(const KURL& url)
+void FrameLoader::setFirstPartyForCookies(const KURL& url)
 {
-    m_frame->document()->setPolicyBaseURL(url);
+    m_frame->document()->setFirstPartyForCookies(url);
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->loader()->setPolicyBaseURL(url);
+        child->loader()->setFirstPartyForCookies(url);
 }
 
 // This does the same kind of work that didOpenURL does, except it relies on the fact
@@ -2133,6 +2103,15 @@
 {
     ASSERT(m_frame->page());
 
+    // If a redirect was scheduled during a load, then stop the current load.
+    // Otherwise when the current load transitions from a provisional to a 
+    // committed state, pending redirects may be cancelled. 
+    if (redirection->wasDuringLoad) {
+        if (m_provisionalDocumentLoader)
+            m_provisionalDocumentLoader->stopLoading();
+        stopLoading(true);   
+    }
+
     stopRedirectionTimer();
     m_scheduledRedirection.set(redirection);
     if (!m_isComplete && redirection->type != ScheduledRedirection::redirection)
@@ -2150,14 +2129,17 @@
     m_redirectionTimer.startOneShot(m_scheduledRedirection->delay);
 
     switch (m_scheduledRedirection->type) {
-        case ScheduledRedirection::redirection:
         case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::locationChangeDuringLoad:
+        case ScheduledRedirection::redirection:
             clientRedirected(KURL(m_scheduledRedirection->url),
                 m_scheduledRedirection->delay,
                 currentTime() + m_redirectionTimer.nextFireInterval(),
-                m_scheduledRedirection->lockBackForwardList,
-                m_isExecutingJavaScriptFormAction);
+                m_scheduledRedirection->lockBackForwardList);
+            return;
+        case ScheduledRedirection::formSubmission:
+            // FIXME: It would make sense to report form submissions as client redirects too.
+            // But we didn't do that in the past when form submission used a separate delay
+            // mechanism, so doing it will be a behavior change.
             return;
         case ScheduledRedirection::historyNavigation:
             // Don't report history navigations.
@@ -2175,11 +2157,15 @@
 
     if (m_scheduledRedirection) {
         switch (m_scheduledRedirection->type) {
-            case ScheduledRedirection::redirection:
             case ScheduledRedirection::locationChange:
-            case ScheduledRedirection::locationChangeDuringLoad:
+            case ScheduledRedirection::redirection:
                 clientRedirectCancelledOrFinished(m_cancellingWithLoadInProgress);
                 return;
+            case ScheduledRedirection::formSubmission:
+                // FIXME: It would make sense to report form submissions as client redirects too.
+                // But we didn't do that in the past when form submission used a separate delay
+                // mechanism, so doing it will be a behavior change.
+                return;
             case ScheduledRedirection::historyNavigation:
                 // Don't report history navigations.
                 return;
@@ -2195,7 +2181,8 @@
         child->loader()->parentCompleted();
     if (Frame* parent = m_frame->tree()->parent())
         parent->loader()->checkCompleted();
-    submitFormAgain();
+    if (m_frame->view())
+        m_frame->view()->setLockedToAnchor(false);
 }
 
 void FrameLoader::started()
@@ -2229,13 +2216,24 @@
     activeDocumentLoader()->setupForReplaceByMIMEType(newMIMEType);
 }
 
-void FrameLoader::loadFrameRequestWithFormAndValues(const FrameLoadRequest& request, bool lockHistory, bool lockBackForwardList, Event* event,
-    HTMLFormElement* submitForm, const HashMap<String, String>& formValues)
+// This is a hack to allow keep navigation to http/https feeds working. To remove this
+// we need to introduce new API akin to registerURLSchemeAsLocal, that registers a
+// protocols navigation policy.
+static bool isFeedWithNestedProtocolInHTTPFamily(const KURL& url)
 {
-    RefPtr<FormState> formState;
-    if (submitForm)
-        formState = FormState::create(submitForm, formValues, m_frame);
-    
+    const String& urlString = url.string();
+    if (!urlString.startsWith("feed", false))
+        return false;
+
+    return urlString.startsWith("feed://", false) 
+        || urlString.startsWith("feed:http:", false) || urlString.startsWith("feed:https:", false)
+        || urlString.startsWith("feeds:http:", false) || urlString.startsWith("feeds:https:", false)
+        || urlString.startsWith("feedsearch:http:", false) || urlString.startsWith("feedsearch:https:", false);
+}
+
+void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHistory, bool lockBackForwardList,
+    PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+{    
     KURL url = request.resourceRequest().url();
 
     String referrer;
@@ -2246,7 +2244,7 @@
         referrer = m_outgoingReferrer;
 
     ASSERT(frame()->document());
-    if (url.protocolIs("file")) {
+    if (shouldTreatURLAsLocal(url.string()) && !isFeedWithNestedProtocolInHTTPFamily(url)) {
         if (!canLoad(url, String(), frame()->document()) && !canLoad(url, referrer)) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return;
@@ -2265,30 +2263,37 @@
         loadType = FrameLoadTypeStandard;
 
     if (request.resourceRequest().httpMethod() == "POST")
-#ifdef ANDROID_USER_GESTURE
-        loadPostRequest(request.resourceRequest(), referrer, request.frameName(), lockHistory, loadType, event, formState.release(), request.wasUserGesture());
-#else
-        loadPostRequest(request.resourceRequest(), referrer, request.frameName(), lockHistory, loadType, event, formState.release());
-#endif
+        loadPostRequest(request.resourceRequest(), referrer, request.frameName(), lockHistory, loadType, event, formState.get());
     else
-#ifdef ANDROID_USER_GESTURE
-        loadURL(request.resourceRequest().url(), referrer, request.frameName(), lockHistory, loadType, event, formState.release(), request.wasUserGesture());
-#else
-        loadURL(request.resourceRequest().url(), referrer, request.frameName(), lockHistory, loadType, event, formState.release());
-#endif
+        loadURL(request.resourceRequest().url(), referrer, request.frameName(), lockHistory, loadType, event, formState.get());
 
-    Frame* targetFrame = findFrameForNavigation(request.frameName());
-    if (targetFrame && targetFrame != m_frame)
+    // FIXME: It's possible this targetFrame will not be the same frame that was targeted by the actual
+    // load if frame names have changed.
+    Frame* sourceFrame = formState ? formState->sourceFrame() : m_frame;
+    Frame* targetFrame = sourceFrame->loader()->findFrameForNavigation(request.frameName());
+    if (targetFrame && targetFrame != sourceFrame) {
         if (Page* page = targetFrame->page())
             page->chrome()->focus();
+    }
 }
 
 #ifdef ANDROID_USER_GESTURE
+void FrameLoader::loadPostRequest(const ResourceRequest& request, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType type, PassRefPtr<Event> event, PassRefPtr<FormState> state)
+{
+    loadPostRequest(request, referrer, frameName, lockHistory, type, event, state, false);
+}
+
+void FrameLoader::loadURL(const KURL& url, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType type, PassRefPtr<Event> event, PassRefPtr<FormState> state)
+{
+    loadURL(url, referrer, frameName, lockHistory, type, event, state, false);
+}
+
 void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType newLoadType,
-    Event* event, PassRefPtr<FormState> prpFormState, bool userGesture)
+    PassRefPtr<Event> event, PassRefPtr<FormState> prpFormState,
+    bool userGesture)
 #else
 void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType newLoadType,
-    Event* event, PassRefPtr<FormState> prpFormState)
+    PassRefPtr<Event> event, PassRefPtr<FormState> prpFormState)
 #endif
 {
     RefPtr<FormState> formState = prpFormState;
@@ -2309,17 +2314,17 @@
 
     ASSERT(newLoadType != FrameLoadTypeSame);
 
+    // The search for a target frame is done earlier in the case of form submission.
+    Frame* targetFrame = isFormSubmission ? 0 : findFrameForNavigation(frameName);
+    if (targetFrame && targetFrame != m_frame) {
+        targetFrame->loader()->loadURL(newURL, referrer, String(), lockHistory, newLoadType, event, formState.release());
+        return;
+    }
+
     NavigationAction action(newURL, newLoadType, isFormSubmission, event);
 
-    if (!frameName.isEmpty()) {
-        if (Frame* targetFrame = findFrameForNavigation(frameName))
-#ifdef ANDROID_USER_GESTURE
-            targetFrame->loader()->loadURL(newURL, referrer, String(), lockHistory, newLoadType, event, formState, userGesture);
-#else
-            targetFrame->loader()->loadURL(newURL, referrer, String(), lockHistory, newLoadType, event, formState);
-#endif
-        else
-            checkNewWindowPolicy(action, request, formState, frameName);
+    if (!targetFrame && !frameName.isEmpty()) {
+        checkNewWindowPolicy(action, request, formState.release(), frameName);
         return;
     }
 
@@ -2333,12 +2338,12 @@
     if (shouldScrollToAnchor(isFormSubmission, newLoadType, newURL)) {
         oldDocumentLoader->setTriggeringAction(action);
         stopPolicyCheck();
-        checkNavigationPolicy(request, oldDocumentLoader.get(), formState,
+        checkNavigationPolicy(request, oldDocumentLoader.get(), formState.release(),
             callContinueFragmentScrollAfterNavigationPolicy, this);
     } else {
         // must grab this now, since this load may stop the previous load and clear this flag
         bool isRedirect = m_quickRedirectComing;
-        loadWithNavigationAction(request, action, lockHistory, newLoadType, formState);
+        loadWithNavigationAction(request, action, lockHistory, newLoadType, formState.release());
         if (isRedirect) {
             m_quickRedirectComing = false;
             if (m_provisionalDocumentLoader)
@@ -2457,6 +2462,8 @@
 
         stopPolicyCheck();
         setPolicyDocumentLoader(loader);
+        if (loader->triggeringAction().isEmpty())
+            loader->setTriggeringAction(NavigationAction(newURL, m_policyLoadType, isFormSubmission));
 
         checkNavigationPolicy(loader->request(), loader, formState,
             callContinueLoadAfterNavigationPolicy, this);
@@ -2465,18 +2472,22 @@
 
 bool FrameLoader::canLoad(const KURL& url, const String& referrer, const Document* doc)
 {
-    // We can always load any URL that isn't considered local (e.g. http URLs)
+    return canLoad(url, referrer, doc ? doc->securityOrigin() : 0);
+}
+
+bool FrameLoader::canLoad(const KURL& url, const String& referrer, const SecurityOrigin* securityOrigin)
+{
+    // We can always load any URL that isn't considered local (e.g. http URLs).
     if (!shouldTreatURLAsLocal(url.string()))
         return true;
 
     // If we were provided a document, we let its local file policy dictate the result,
     // otherwise we allow local loads only if the supplied referrer is also local.
-    if (doc)
-        return doc->securityOrigin()->canLoadLocalResources();
-    else if (!referrer.isEmpty())
+    if (securityOrigin)
+        return securityOrigin->canLoadLocalResources();
+    if (!referrer.isEmpty())
         return shouldTreatURLAsLocal(referrer);
-    else
-        return false;
+    return false;
 }
 
 void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
@@ -2716,6 +2727,9 @@
 
 void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
 {
+    if (m_unloadEventBeingDispatched)
+        return;
+
     // If this method is called from within this method, infinite recursion can occur (3442218). Avoid this.
     if (m_inStopAllLoaders)
         return;
@@ -3038,7 +3052,7 @@
     m_sentRedirectNotification = false;
 }
 
-void FrameLoader::clientRedirected(const KURL& url, double seconds, double fireDate, bool lockBackForwardList, bool isJavaScriptFormAction)
+void FrameLoader::clientRedirected(const KURL& url, double seconds, double fireDate, bool lockBackForwardList)
 {
     m_client->dispatchWillPerformClientRedirect(url, seconds, fireDate);
     
@@ -3046,10 +3060,11 @@
     // the next provisional load, we can send a corresponding -webView:didCancelClientRedirectForFrame:
     m_sentRedirectNotification = true;
     
-    // If a "quick" redirect comes in an, we set a special mode so we treat the next
-    // load as part of the same navigation. If we don't have a document loader, we have
+    // If a "quick" redirect comes in, we set a special mode so we treat the next
+    // load as part of the original navigation. If we don't have a document loader, we have
     // no "original" load on which to base a redirect, so we treat the redirect as a normal load.
-    m_quickRedirectComing = lockBackForwardList && m_documentLoader && !isJavaScriptFormAction;
+    // Loads triggered by JavaScript form submissions never count as quick redirects.
+    m_quickRedirectComing = lockBackForwardList && m_documentLoader && !m_isExecutingJavaScriptFormAction;
 }
 
 #if ENABLE(WML)
@@ -3120,7 +3135,7 @@
 
     KURL url = cachedFrame.url();
 
-    if ((url.protocolIs("http") || url.protocolIs("https")) && !url.host().isEmpty() && url.path().isEmpty())
+    if (url.protocolInHTTPFamily() && !url.host().isEmpty() && url.path().isEmpty())
         url.setPath("/");
     
     m_URL = url;
@@ -3154,7 +3169,7 @@
 
     m_decoder = document->decoder();
 
-    updatePolicyBaseURL();
+    updateFirstPartyForCookies();
 
     cachedFrame.restore();
 }
@@ -3250,10 +3265,20 @@
     
     ArchiveResource* mainResource = archive->mainResource();
     loader->setParsedArchiveData(mainResource->data());
-    continueLoadWithData(mainResource->data(), mainResource->mimeType(), mainResource->textEncoding(), mainResource->url());
+
+    m_responseMIMEType = mainResource->mimeType();
+    didOpenURL(mainResource->url());
+
+    String userChosenEncoding = documentLoader()->overrideEncoding();
+    bool encodingIsUserChosen = !userChosenEncoding.isNull();
+    setEncoding(encodingIsUserChosen ? userChosenEncoding : mainResource->textEncoding(), encodingIsUserChosen);
+
+    ASSERT(m_frame->document());
+
+    addData(mainResource->data()->data(), mainResource->data()->size());
 #else
     m_client->finishedLoading(loader);
-#endif
+#endif // ARCHIVE
 }
 
 bool FrameLoader::isReplacing() const
@@ -3296,20 +3321,28 @@
     return m_loadType;
 }
     
-CachePolicy FrameLoader::cachePolicy() const
+CachePolicy FrameLoader::subresourceCachePolicy() const
 {
     if (m_isComplete)
         return CachePolicyVerify;
-    
-    if (m_loadType == FrameLoadTypeReloadFromOrigin || documentLoader()->request().cachePolicy() == ReloadIgnoringCacheData)
+
+    if (m_loadType == FrameLoadTypeReloadFromOrigin)
         return CachePolicyReload;
-    
+
     if (Frame* parentFrame = m_frame->tree()->parent()) {
-        CachePolicy parentCachePolicy = parentFrame->loader()->cachePolicy();
+        CachePolicy parentCachePolicy = parentFrame->loader()->subresourceCachePolicy();
         if (parentCachePolicy != CachePolicyVerify)
             return parentCachePolicy;
     }
 
+    // FIXME: POST documents are always Reloads, but their subresources should still be Revalidate.
+    // If we bring the CachePolicy.h and ResourceRequest cache policy enums in sync with each other and
+    // remember "Revalidate" in ResourceRequests, we can remove this "POST" check and return either "Reload" 
+    // or "Revalidate" if the DocumentLoader was requested with either.
+    const ResourceRequest& request(documentLoader()->request());
+    if (request.cachePolicy() == ReloadIgnoringCacheData && !equalIgnoringCase(request.httpMethod(), "post"))
+        return CachePolicyRevalidate;
+
     if (m_loadType == FrameLoadTypeReload)
         return CachePolicyRevalidate;
 
@@ -3349,7 +3382,7 @@
                     item = m_currentHistoryItem;
                 
             bool shouldReset = true;
-            if (!pdl->isLoadingInAPISense()) {
+            if (!(pdl->isLoadingInAPISense() && !pdl->isStopping())) {
                 m_delegateIsHandlingProvisionalLoadError = true;
                 m_client->dispatchDidFailProvisionalLoad(error);
                 m_delegateIsHandlingProvisionalLoadError = false;
@@ -3381,7 +3414,7 @@
         
         case FrameStateCommittedPage: {
             DocumentLoader* dl = m_documentLoader.get();            
-            if (!dl || dl->isLoadingInAPISense())
+            if (!dl || (dl->isLoadingInAPISense() && !dl->isStopping()))
                 return;
 
             markLoadComplete();
@@ -3501,11 +3534,6 @@
     return m_firstLayoutDone;
 }
 
-bool FrameLoader::isQuickRedirectComing() const
-{
-    return m_quickRedirectComing;
-}
-
 void FrameLoader::detachChildren()
 {
     // FIXME: Is it really necessary to do this in reverse order?
@@ -3564,30 +3592,6 @@
     return count;
 }
 
-void FrameLoader::submitForm(const FrameLoadRequest& request, Event* event, bool lockHistory, bool lockBackForwardList)
-{
-    // FIXME: We'd like to remove this altogether and fix the multiple form submission issue another way.
-    // We do not want to submit more than one form from the same page,
-    // nor do we want to submit a single form more than once.
-    // This flag prevents these from happening; not sure how other browsers prevent this.
-    // The flag is reset in each time we start handle a new mouse or key down event, and
-    // also in setView since this part may get reused for a page from the back/forward cache.
-    // The form multi-submit logic here is only needed when we are submitting a form that affects this frame.
-    // FIXME: Frame targeting is only one of the ways the submission could end up doing something other
-    // than replacing this frame's content, so this check is flawed. On the other hand, the check is hardly
-    // needed any more now that we reset m_submittedFormURL on each mouse or key down event.
-    Frame* target = m_frame->tree()->find(request.frameName());
-    if (m_frame->tree()->isDescendantOf(target)) {
-        if (m_submittedFormURL == request.resourceRequest().url())
-            return;
-        m_submittedFormURL = request.resourceRequest().url();
-    }
-
-    loadFrameRequestWithFormAndValues(request, lockHistory, lockBackForwardList, event, m_formAboutToBeSubmitted.get(), m_formValuesAboutToBeSubmitted);
-
-    clearRecordedFormValues();
-}
-
 String FrameLoader::userAgent(const KURL& url) const
 {
     return m_client->userAgent(url);
@@ -3595,9 +3599,6 @@
 
 void FrameLoader::tokenizerProcessedData()
 {
-//    ASSERT(m_frame->page());
-//    ASSERT(m_frame->document());
-
     checkCompleted();
 }
 
@@ -3651,13 +3652,13 @@
 {
     // Don't set the cookie policy URL if it's already been set.
     // But make sure to set it on all requests, as it has significance beyond the cookie policy for all protocols (<rdar://problem/6616664>).
-    if (request.mainDocumentURL().isEmpty()) {
+    if (request.firstPartyForCookies().isEmpty()) {
         if (mainResource && (isLoadingMainFrame() || cookiePolicyURLFromRequest))
-            request.setMainDocumentURL(request.url());
-        else if (Page* page = m_frame->page())
-            request.setMainDocumentURL(page->mainFrame()->loader()->url());
+            request.setFirstPartyForCookies(request.url());
+        else if (Document* document = m_frame->document())
+            request.setFirstPartyForCookies(document->firstPartyForCookies());
     }
-    
+
     // The remaining modifications are only necessary for HTTP and HTTPS.
     if (!request.url().isEmpty() && !request.url().protocolInHTTPFamily())
         return;
@@ -3674,7 +3675,7 @@
     }
     
     if (mainResource)
-        request.setHTTPAccept("application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5");
+        request.setHTTPAccept(defaultAcceptHeader);
 
     // Make sure we send the Origin header.
     addHTTPOriginIfNeeded(request, String());
@@ -3721,9 +3722,9 @@
 }
 
 #ifdef ANDROID_USER_GESTURE
-void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType loadType, Event* event, PassRefPtr<FormState> prpFormState, bool userGesture)
+void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType loadType, PassRefPtr<Event> event, PassRefPtr<FormState> prpFormState, bool userGesture)
 #else
-void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType loadType, Event* event, PassRefPtr<FormState> prpFormState)
+void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType loadType, PassRefPtr<Event> event, PassRefPtr<FormState> prpFormState)
 #endif
 {
     RefPtr<FormState> formState = prpFormState;
@@ -3759,7 +3760,8 @@
     NavigationAction action(url, loadType, true, event);
 
     if (!frameName.isEmpty()) {
-        if (Frame* targetFrame = findFrameForNavigation(frameName))
+        // The search for a target frame is done earlier in the case of form submission.
+        if (Frame* targetFrame = formState ? 0 : findFrameForNavigation(frameName))
             targetFrame->loader()->loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());
         else
             checkNewWindowPolicy(action, workingResourceRequest, formState.release(), frameName);
@@ -3767,16 +3769,8 @@
         loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());    
 }
 
-void FrameLoader::loadEmptyDocumentSynchronously()
+unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials storedCredentials, ResourceError& error, ResourceResponse& response, Vector<char>& data)
 {
-    ResourceRequest request(KURL(""));
-    load(request, false);
-}
-
-unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& data)
-{
-    // Since this is a subresource, we can load any URL (we ignore the return value).
-    // But we still want to know whether we should hide the referrer or not, so we call the canLoad method.
     String referrer = m_outgoingReferrer;
     if (shouldHideReferrer(request.url(), referrer))
         referrer = String();
@@ -3794,7 +3788,7 @@
     addHTTPOriginIfNeeded(initialRequest, outgoingOrigin());
 
     if (Page* page = m_frame->page())
-        initialRequest.setMainDocumentURL(page->mainFrame()->loader()->documentLoader()->request().url());
+        initialRequest.setFirstPartyForCookies(page->mainFrame()->loader()->documentLoader()->request().url());
     initialRequest.setHTTPUserAgent(client()->userAgent(request.url()));
 
     unsigned long identifier = 0;    
@@ -3814,7 +3808,7 @@
                 error = cannotShowURLError(newRequest);
         } else {
 #endif
-            ResourceHandle::loadResourceSynchronously(newRequest, error, response, data, m_frame);
+            ResourceHandle::loadResourceSynchronously(newRequest, storedCredentials, error, response, data, m_frame);
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
             // If normal loading results in a redirect to a resource with another origin (indicative of a captive portal), or a 4xx or 5xx status code or equivalent,
@@ -3872,6 +3866,11 @@
         m_client->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
 }
 
+void FrameLoader::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
+{
+    m_client->dispatchDidLoadResourceByXMLHttpRequest(identifier, sourceString);
+}
+
 const ResourceRequest& FrameLoader::originalRequest() const
 {
     return activeDocumentLoader()->originalRequestCopy();
@@ -3893,8 +3892,8 @@
     }
     
     if (m_state == FrameStateProvisional && m_provisionalDocumentLoader) {
-        KURL failedURL = m_provisionalDocumentLoader->originalRequestCopy().url();
-        didNotOpenURL(failedURL);
+        if (m_submittedFormURL == m_provisionalDocumentLoader->originalRequestCopy().url())
+            m_submittedFormURL = KURL();
             
         // We might have made a page cache item, but now we're bailing out due to an error before we ever
         // transitioned to the new page (before WebFrameState == commit).  The goal here is to restore any state
@@ -4127,7 +4126,14 @@
     // might detach the current FrameLoader, in which case we should bail on this newly defunct load. 
     if (!m_frame->page())
         return;
-        
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (Page* page = m_frame->page()) {
+        if (page->mainFrame() == m_frame)
+            page->inspectorController()->resumeDebugger();
+    }
+#endif
+
     setProvisionalDocumentLoader(m_policyDocumentLoader.get());
     m_loadType = type;
     setState(FrameStateProvisional);
@@ -4242,6 +4248,24 @@
     request.setHTTPUserAgent(userAgent);
 }
 
+bool FrameLoader::shouldInterruptLoadForXFrameOptions(const String& content, const KURL& url)
+{
+    Frame* topFrame = m_frame->tree()->top();
+    if (m_frame == topFrame)
+        return false;
+
+    if (equalIgnoringCase(content, "deny"))
+        return true;
+
+    if (equalIgnoringCase(content, "sameorigin")) {
+        RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
+        if (!origin->isSameSchemeHostPort(topFrame->document()->securityOrigin()))
+            return true;
+    }
+
+    return false;
+}
+
 bool FrameLoader::canGoBackOrForward(int distance) const
 {
     if (Page* page = m_frame->page()) {
@@ -4262,28 +4286,6 @@
     return 0;
 }
 
-KURL FrameLoader::historyURL(int distance)
-{
-    if (Page* page = m_frame->page()) {
-        BackForwardList* list = page->backForwardList();
-        HistoryItem* item = list->itemAtIndex(distance);
-        if (!item) {
-            if (distance > 0) {
-                int forwardListCount = list->forwardListCount();
-                if (forwardListCount > 0)
-                    item = list->itemAtIndex(forwardListCount);
-            } else {
-                int backListCount = list->backListCount();
-                if (backListCount > 0)
-                    item = list->itemAtIndex(-backListCount);
-            }
-        }
-        if (item)
-            return item->url();
-    }
-    return KURL();
-}
-
 void FrameLoader::addHistoryItemForFragmentScroll()
 {
     addBackForwardItemClippedAtTarget(false);
@@ -4375,6 +4377,11 @@
 
 void FrameLoader::addBackForwardItemClippedAtTarget(bool doClip)
 {
+    // In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
+    // The item that was the target of the user's navigation is designated as the "targetItem".  
+    // When this function is called with doClip=true we're able to create the whole tree except for the target's children, 
+    // which will be loaded in the future. That part of the tree will be filled out as the child loads are committed.
+
     Page* page = m_frame->page();
     if (!page)
         return;
@@ -4424,9 +4431,9 @@
 Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
 {
     Frame* frame = m_frame->tree()->find(name);
-    if (shouldAllowNavigation(frame))
-        return frame;  
-    return 0;
+    if (!shouldAllowNavigation(frame))
+        return 0;  
+    return frame;
 }
 
 void FrameLoader::saveScrollPositionAndViewStateToItem(HistoryItem* item)
@@ -4539,13 +4546,16 @@
     // Note if we have child frames we do a real reload, since the child frames might not
     // match our current frame structure, or they might not have the right content.  We could
     // check for all that as an additional optimization.
-    // We also do not do anchor-style navigation if we're posting a form.
-    
+    // We also do not do anchor-style navigation if we're posting a form or navigating from
+    // a page that was resulted from a form post.
+    bool shouldScroll = !formData && !(m_currentHistoryItem && m_currentHistoryItem->formData()) && urlsMatchItem(item);
+
 #if ENABLE(WML)
-    if (!formData && urlsMatchItem(item) && !m_frame->document()->isWMLDocument()) {
-#else
-    if (!formData && urlsMatchItem(item)) {
+    if (m_frame->document()->isWMLDocument())
+        shouldScroll = false;
 #endif
+
+    if (shouldScroll) {
         // Must do this maintenance here, since we don't go through a real page reload
         saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
 
@@ -4756,10 +4766,10 @@
         
         int size = childItems.size();
         for (int i = 0; i < size; ++i) {
-            String childName = childItems[i]->target();
-            HistoryItem* fromChildItem = fromItem->childItemWithName(childName);
+            String childFrameName = childItems[i]->target();
+            HistoryItem* fromChildItem = fromItem->childItemWithTarget(childFrameName);
             ASSERT(fromChildItem || fromItem->isTargetItem());
-            Frame* childFrame = m_frame->tree()->child(childName);
+            Frame* childFrame = m_frame->tree()->child(childFrameName);
             ASSERT(childFrame);
             childFrame->loader()->recursiveGoToItem(childItems[i].get(), fromChildItem, type);
         }
@@ -4777,9 +4787,10 @@
         return false;
     
     unsigned size = childItems.size();
-    for (unsigned i = 0; i < size; ++i)
+    for (unsigned i = 0; i < size; ++i) {
         if (!m_frame->tree()->child(childItems[i]->target()))
             return false;
+    }
     
     // Found matches for all item targets
     return true;
@@ -4799,22 +4810,14 @@
     bool needPrivacy = !settings || settings->privateBrowsingEnabled();
     const KURL& historyURL = documentLoader()->urlForHistory();
 
-    // If the navigation occured during load and this is a subframe, update the current
-    // back/forward item rather than adding a new one and don't add the new URL to global
-    // history at all. But do add it to visited links. <rdar://problem/5333496>
-    bool frameNavigationDuringLoad = false;
-    if (m_navigationDuringLoad) {
-        HTMLFrameOwnerElement* owner = m_frame->ownerElement();
-        frameNavigationDuringLoad = owner && !owner->createdByParser();
-        m_navigationDuringLoad = false;
-    }
-
-    if (!frameNavigationDuringLoad && !documentLoader()->isClientRedirect()) {
+    if (!documentLoader()->isClientRedirect()) {
         if (!historyURL.isEmpty()) {
             addBackForwardItemClippedAtTarget(true);
             if (!needPrivacy) {
                 m_client->updateGlobalHistory();
                 m_documentLoader->setDidCreateGlobalHistoryEntry(true);
+                if (m_documentLoader->unreachableURL().isEmpty())
+                    m_client->updateGlobalHistoryRedirectLinks();
             }
             if (Page* page = m_frame->page())
                 page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
@@ -4905,6 +4908,8 @@
                 if (!needPrivacy) {
                     m_client->updateGlobalHistory();
                     m_documentLoader->setDidCreateGlobalHistoryEntry(true);
+                    if (m_documentLoader->unreachableURL().isEmpty())
+                        m_client->updateGlobalHistoryRedirectLinks();
                 }
                 if (Page* page = m_frame->page())
                     page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
@@ -4917,7 +4922,7 @@
     } else {
         Frame* parentFrame = m_frame->tree()->parent();
         if (parentFrame && parentFrame->loader()->m_currentHistoryItem)
-            parentFrame->loader()->m_currentHistoryItem->addChildItem(createHistoryItem(true));
+            parentFrame->loader()->m_currentHistoryItem->setChildItem(createHistoryItem(true));
     }
 
     if (!historyURL.isEmpty() && !needPrivacy) {
@@ -4975,8 +4980,6 @@
     }
 }
 
-// FIXME: These 3 setter/getters are here for a dwindling number of users in WebKit, WebFrame
-// being the primary one.  After they're no longer needed there, they can be removed!
 HistoryItem* FrameLoader::currentHistoryItem()
 {
     return m_currentHistoryItem.get();
@@ -4987,11 +4990,6 @@
     m_currentHistoryItem = item;
 }
 
-void FrameLoader::setProvisionalHistoryItem(PassRefPtr<HistoryItem> item)
-{
-    m_provisionalHistoryItem = item;
-}
-
 void FrameLoader::setMainDocumentError(DocumentLoader* loader, const ResourceError& error)
 {
     m_client->setMainDocumentError(loader, error);
@@ -5193,19 +5191,24 @@
         paramNames.append(it->first);
         paramValues.append(it->second);
     }
-    
+
+    if (!codeBaseURLString.isEmpty()) {
+        KURL codeBaseURL = completeURL(codeBaseURLString);
+        if (!canLoad(codeBaseURL, String(), element->document())) {
+            FrameLoader::reportLocalLoadFailed(m_frame, codeBaseURL.string());
+            return 0;
+        }
+    }
+
     if (baseURLString.isEmpty())
         baseURLString = m_frame->document()->baseURL().string();
     KURL baseURL = completeURL(baseURLString);
 
-    Widget* widget = 0;
-    KURL codeBaseURL = completeURL(codeBaseURLString);
-    if (canLoad(codeBaseURL, String(), element->document())) {
-        widget = m_client->createJavaAppletWidget(size, element, baseURL, paramNames, paramValues);
-        if (widget)
-            m_containsPlugIns = true;
-    }
+    Widget* widget = m_client->createJavaAppletWidget(size, element, baseURL, paramNames, paramValues);
+    if (!widget)
+        return 0;
 
+    m_containsPlugIns = true;
     return widget;
 }
 
@@ -5225,24 +5228,6 @@
     }
 }
 
-void FrameLoader::continueLoadWithData(SharedBuffer* buffer, const String& mimeType, const String& textEncoding, const KURL& url)
-{
-    m_responseMIMEType = mimeType;
-    didOpenURL(url);
-
-    String encoding;
-    if (m_frame)
-        encoding = documentLoader()->overrideEncoding();
-    bool userChosen = !encoding.isNull();
-    if (encoding.isNull())
-        encoding = textEncoding;
-    setEncoding(encoding, userChosen);
-
-    ASSERT(m_frame->document());
-
-    addData(buffer->data(), buffer->size());
-}
-
 void FrameLoader::registerURLSchemeAsLocal(const String& scheme)
 {
     localSchemes().add(scheme);
diff --git a/WebCore/loader/FrameLoader.h b/WebCore/loader/FrameLoader.h
index 07acff3..07e530e 100644
--- a/WebCore/loader/FrameLoader.h
+++ b/WebCore/loader/FrameLoader.h
@@ -31,9 +31,9 @@
 #define FrameLoader_h
 
 #include "CachePolicy.h"
-#include "FormState.h"
 #include "FrameLoaderTypes.h"
 #include "ResourceRequest.h"
+#include "ThreadableLoader.h"
 #include "Timer.h"
 
 namespace WebCore {
@@ -47,9 +47,9 @@
     class CachedResource;
     class Document;
     class DocumentLoader;
-    class Element;
     class Event;
     class FormData;
+    class FormState;
     class Frame;
     class FrameLoaderClient;
     class HistoryItem;
@@ -64,6 +64,7 @@
     class ResourceLoader;
     class ResourceResponse;
     class ScriptSourceCode;
+    class ScriptString;
     class ScriptValue;
     class SecurityOrigin;
     class SharedBuffer;
@@ -71,7 +72,6 @@
     class TextResourceDecoder;
     class Widget;
 
-    struct FormSubmission;
     struct FrameLoadRequest;
     struct ScheduledRedirection;
     struct WindowFeatures;
@@ -122,56 +122,40 @@
 
         Frame* frame() const { return m_frame; }
 
-        // FIXME: This is not cool, people. We should aim to consolidate these variety of loading related methods into a smaller set,
-        // and try to reuse more of the same logic by extracting common code paths.
+        // FIXME: This is not cool, people. There are too many different functions that all start loads.
+        // We should aim to consolidate these into a smaller set of functions, and try to reuse more of
+        // the logic by extracting common code paths.
+
         void prepareForLoadStart();
         void setupForReplace();
         void setupForReplaceByMIMEType(const String& newMIMEType);
 
-        void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>);         // Calls continueLoadAfterNavigationPolicy
-        void load(DocumentLoader*);                                                                 // Calls loadWithDocumentLoader   
-
-        void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,              // Calls loadWithDocumentLoader()
-            bool lockHistory, FrameLoadType, PassRefPtr<FormState>);
-
-#ifdef ANDROID_USER_GESTURE
-        void loadPostRequest(const ResourceRequest&, const String& referrer,                        // Called by loadFrameRequestWithFormAndValues(), calls loadWithNavigationAction
-            const String& frameName, bool lockHistory, FrameLoadType, Event*, PassRefPtr<FormState>, bool userGesture);
-
-        void loadURL(const KURL& newURL, const String& referrer, const String& frameName,           // Called by loadFrameRequestWithFormAndValues(), calls loadWithNavigationAction or else dispatches to navigation policy delegate    
-            bool lockHistory, FrameLoadType, Event*, PassRefPtr<FormState>, bool userGesture);
-#else
-        void loadPostRequest(const ResourceRequest&, const String& referrer,                        // Called by loadFrameRequestWithFormAndValues(), calls loadWithNavigationAction
-            const String& frameName, bool lockHistory, FrameLoadType, Event*, PassRefPtr<FormState>);
-
-        void loadURL(const KURL& newURL, const String& referrer, const String& frameName,           // Called by loadFrameRequestWithFormAndValues(), calls loadWithNavigationAction or else dispatches to navigation policy delegate    
-            bool lockHistory, FrameLoadType, Event*, PassRefPtr<FormState>);
-#endif
 
         void loadURLIntoChildFrame(const KURL&, const String& referer, Frame*);
 
-        void loadFrameRequestWithFormAndValues(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList,           // Called by submitForm, calls loadPostRequest()
-            Event*, HTMLFormElement*, const HashMap<String, String>& formValues);
+        void loadFrameRequest(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList,  // Called by submitForm, calls loadPostRequest and loadURL.
+            PassRefPtr<Event>, PassRefPtr<FormState>);
 
-        void load(const ResourceRequest&, bool lockHistory);                                                          // Called by WebFrame, calls (ResourceRequest, SubstituteData)
-        void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                                   // Called both by WebFrame and internally, calls (DocumentLoader*)
-        void load(const ResourceRequest&, const String& frameName, bool lockHistory);                                 // Called by WebPluginController
+        void load(const ResourceRequest&, bool lockHistory);                                        // Called by WebFrame, calls load(ResourceRequest, SubstituteData).
+        void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                 // Called both by WebFrame and internally, calls load(DocumentLoader*).
+        void load(const ResourceRequest&, const String& frameName, bool lockHistory);               // Called by WebPluginController.
         
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
-        void loadArchive(PassRefPtr<Archive> archive);
+        void loadArchive(PassRefPtr<Archive>);
 #endif
 
-        // Returns true for any non-local URL. If Document parameter is supplied, its local load policy dictates,
+        // Returns true for any non-local URL. If document parameter is supplied, its local load policy dictates,
         // otherwise if referrer is non-empty and represents a local file, then the local load is allowed.
-        static bool canLoad(const KURL&, const String& referrer, const Document* theDocument = 0);
+        static bool canLoad(const KURL&, const String& referrer, const Document*);
+        static bool canLoad(const KURL&, const String& referrer, const SecurityOrigin* = 0);
         static void reportLocalLoadFailed(Frame*, const String& url);
 
-        static bool shouldHideReferrer(const KURL& url, const String& referrer);
+        static bool shouldHideReferrer(const KURL&, const String& referrer);
 
         // Called by createWindow in JSDOMWindowBase.cpp, e.g. to fulfill a modal dialog creation
         Frame* createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest&, const WindowFeatures&, bool& created);
 
-        unsigned long loadResourceSynchronously(const ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>& data);
+        unsigned long loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data);
 
         bool canHandleRequest(const ResourceRequest&);
 
@@ -187,7 +171,6 @@
         String referrer() const;
         String outgoingReferrer() const;
         String outgoingOrigin() const;
-        void loadEmptyDocumentSynchronously();
 
         DocumentLoader* activeDocumentLoader() const;
         DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
@@ -206,6 +189,7 @@
         void didReceiveData(ResourceLoader*, const char*, int, int lengthReceived);
         void didFinishLoad(ResourceLoader*);
         void didFailToLoad(ResourceLoader*, const ResourceError&);
+        void didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
         const ResourceRequest& originalRequest() const;
         const ResourceRequest& initialRequest() const;
         void receivedMainResourceError(const ResourceError&, bool isComplete);
@@ -230,8 +214,6 @@
         bool representationExistsForURLScheme(const String& URLScheme);
         String generatedMIMETypeForURLScheme(const String& URLScheme);
 
-        void notifyIconChanged();
-
         void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction function, void* argument);
         void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
         void cancelContentPolicyCheck();
@@ -252,32 +234,22 @@
         void didChangeTitle(DocumentLoader*);
 
         FrameLoadType loadType() const;
-        CachePolicy cachePolicy() const;
+        CachePolicy subresourceCachePolicy() const;
 
         void didFirstLayout();
         bool firstLayoutDone() const;
 
         void didFirstVisuallyNonEmptyLayout();
 
-        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
-        void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList, bool isJavaScriptFormAction);
-        bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
 #if ENABLE(WML)
         void setForceReloadWmlDeck(bool);
 #endif
 
-        bool isQuickRedirectComing() const;
-
-        void sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
-        void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
         void loadedResourceFromMemoryCache(const CachedResource*);
         void tellClientAboutPastMemoryCacheLoads();
 
-        void recursiveCheckLoadComplete();
         void checkLoadComplete();
         void detachFromParent();
-        void detachChildren();
-        void closeAndRemoveChild(Frame*);
 
         void addExtraFieldsToSubresourceRequest(ResourceRequest&);
         void addExtraFieldsToMainResourceRequest(ResourceRequest&);
@@ -288,17 +260,13 @@
 
         void setDefersLoading(bool);
 
-        void changeLocation(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
         void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
-        void urlSelected(const ResourceRequest&, const String& target, Event*, bool lockHistory, bool lockBackForwardList, bool userGesture);
-        void urlSelected(const FrameLoadRequest&, Event*, bool lockHistory, bool lockBackForwardList);
-      
+        void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture);
         bool requestFrame(HTMLFrameOwnerElement*, const String& url, const AtomicString& frameName);
-        Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
 
-        void submitForm(const char* action, const String& url, PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary, Event*, bool lockHistory, bool lockBackForwardList);
-        void submitFormAgain();
-        void submitForm(const FrameLoadRequest&, Event*, bool lockHistory, bool lockBackForwardList);
+        void submitForm(const char* action, const String& url,
+            PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary,
+            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event>, PassRefPtr<FormState>);
 
         void stop();
         void stopLoading(bool sendUnload, DatabasePolicy = DatabasePolicyStop);
@@ -310,8 +278,6 @@
         void commitIconURLToIconDatabase(const KURL&);
 
         KURL baseURL() const;
-        String baseTarget() const;
-        KURL dataURLBaseFromRequest(const ResourceRequest& request) const;
 
         bool isScheduledLocationChangePending() const { return m_scheduledRedirection && isLocationChange(*m_scheduledRedirection); }
         void scheduleHTTPRedirection(double delay, const String& url);
@@ -322,12 +288,11 @@
         bool canGoBackOrForward(int distance) const;
         void goBackOrForward(int distance);
         int getHistoryLength();
-        KURL historyURL(int distance);
 
         void begin();
         void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
 
-        void write(const char* str, int len = -1, bool flush = false);
+        void write(const char* string, int length = -1, bool flush = false);
         void write(const String&);
         void end();
         void endIfNotLoadingMainResource();
@@ -335,15 +300,10 @@
         void setEncoding(const String& encoding, bool userChosen);
         String encoding() const;
 
-        // Returns true if url is a JavaScript URL.
-        bool executeIfJavaScriptURL(const KURL& url, bool userGesture = false, bool replaceDocument = true);
-
         ScriptValue executeScript(const ScriptSourceCode&);
         ScriptValue executeScript(const String& script, bool forceUserGesture = false);
 
         void gotoAnchor();
-        bool gotoAnchor(const String& name); // returns true if the anchor was found
-        void scrollToAnchor(const KURL&);
 
         void tokenizerProcessedData();
 
@@ -361,26 +321,18 @@
         bool openedByDOM() const;
         void setOpenedByDOM();
 
-        void provisionalLoadStarted();
-
         bool userGestureHint();
 
         void resetMultipleFormSubmissionProtection();
-        void didNotOpenURL(const KURL&);
 
         void addData(const char* bytes, int length);
 
-        bool canCachePage();
-
         void checkCallImplicitClose();
-        bool didOpenURL(const KURL&);
 
         void frameDetached();
 
         const KURL& url() const { return m_URL; }
 
-        void updateBaseURLForEmptyDocument();
-
         void setResponseMIMEType(const String&);
         const String& responseMIMEType() const;
 
@@ -389,12 +341,6 @@
         void loadDone();
         void finishedParsing();
         void checkCompleted();
-        void scheduleCheckCompleted();
-        void scheduleCheckLoadComplete();
-
-        void clearRecordedFormValues();
-        void setFormAboutToBeSubmitted(PassRefPtr<HTMLFormElement> element);
-        void recordFormValue(const String& name, const String& value);
 
         bool isComplete() const;
 
@@ -403,32 +349,22 @@
 
         KURL completeURL(const String& url);
 
-        KURL originalRequestURL() const;
-
         void cancelAndClear();
 
         void setTitle(const String&);
-        
-        bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
 
         void commitProvisionalLoad(PassRefPtr<CachedPage>);
 
         void goToItem(HistoryItem*, FrameLoadType);
         void saveDocumentAndScrollState();
-        void saveScrollPositionAndViewStateToItem(HistoryItem*);
 
-        // FIXME: These accessors are here for a dwindling number of users in WebKit, WebFrame
-        // being the primary one.  After they're no longer needed there, they can be removed!
         HistoryItem* currentHistoryItem();
         void setCurrentHistoryItem(PassRefPtr<HistoryItem>);
-        void setProvisionalHistoryItem(PassRefPtr<HistoryItem>);
-
-        void continueLoadWithData(SharedBuffer*, const String& mimeType, const String& textEncoding, const KURL&); 
 
         enum LocalLoadPolicy {
-          AllowLocalLoadsForAll,  // No restriction on local loads.
-          AllowLocalLoadsForLocalAndSubstituteData,
-          AllowLocalLoadsForLocalOnly,
+            AllowLocalLoadsForAll,  // No restriction on local loads.
+            AllowLocalLoadsForLocalAndSubstituteData,
+            AllowLocalLoadsForLocalOnly,
         };
         static void setLocalLoadPolicy(LocalLoadPolicy);
         static bool restrictAccessToLocal();
@@ -452,6 +388,8 @@
 
         void applyUserAgent(ResourceRequest& request);
 
+        bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
+
     private:
         PassRefPtr<HistoryItem> createHistoryItem(bool useOriginal);
         PassRefPtr<HistoryItem> createHistoryItemTree(Frame* targetFrame, bool clipAtTarget);
@@ -499,8 +437,8 @@
 
         void receivedFirstData();
 
-        void updatePolicyBaseURL();
-        void setPolicyBaseURL(const KURL&);
+        void updateFirstPartyForCookies();
+        void setFirstPartyForCookies(const KURL&);
         
         void addExtraFieldsToRequest(ResourceRequest&, FrameLoadType loadType, bool isMainResource, bool cookiePolicyURLFromRequest);
 
@@ -516,10 +454,8 @@
 
         void setLoadType(FrameLoadType);
 
-        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>,
-                                   NavigationPolicyDecisionFunction, void* argument);
-        void checkNewWindowPolicy(const NavigationAction&, const ResourceRequest&, 
-                                  PassRefPtr<FormState>, const String& frameName);
+        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
+        void checkNewWindowPolicy(const NavigationAction&, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName);
 
         void continueAfterNavigationPolicy(PolicyAction);
         void continueAfterNewWindowPolicy(PolicyAction);
@@ -532,13 +468,11 @@
         void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
         static void callContinueFragmentScrollAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
         void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue);
-        bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType loadType, const KURL& url);
+        bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType, const KURL&);
         void addHistoryItemForFragmentScroll();
 
         void stopPolicyCheck();
 
-        void closeDocument();
-        
         void checkLoadCompleteForThisFrame();
 
         void setDocumentLoader(DocumentLoader*);
@@ -570,6 +504,65 @@
         void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
 
         static bool isLocationChange(const ScheduledRedirection&);
+        void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList, PassRefPtr<Event>, PassRefPtr<FormState>);
+
+        void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
+        void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
+
+        void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,      // Calls loadWithDocumentLoader
+            bool lockHistory, FrameLoadType, PassRefPtr<FormState>);
+
+#ifdef ANDROID_USER_GESTURE
+// FIXME (klobag): WebKit/android/jni/WebCoreFrameBridge.cpp uses
+// loadPostRequest, figure out if we can use load(...) instead of
+// making loadPostRequest public.
+public:
+        void loadPostRequest(const ResourceRequest&, const String& referrer,                // Called by loadFrameRequest, calls loadWithNavigationAction
+            const String& frameName, bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>, bool userGesture);
+private:
+        void loadURL(const KURL&, const String& referrer, const String& frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
+            bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>, bool userGesture);
+#endif // ANDROID_USER_GESTURE
+
+        void loadPostRequest(const ResourceRequest&, const String& referrer,                // Called by loadFrameRequest, calls loadWithNavigationAction
+            const String& frameName, bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);
+        void loadURL(const KURL&, const String& referrer, const String& frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
+            bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
+
+        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
+        void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
+        bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
+
+        void sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
+        void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
+
+        void recursiveCheckLoadComplete();
+
+        void detachChildren();
+        void closeAndRemoveChild(Frame*);
+
+        Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
+
+        // Returns true if argument is a JavaScript URL.
+        bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
+
+        bool gotoAnchor(const String& name); // returns true if the anchor was found
+        void scrollToAnchor(const KURL&);
+
+        void provisionalLoadStarted();
+
+        bool canCachePage();
+
+        bool didOpenURL(const KURL&);
+
+        void scheduleCheckCompleted();
+        void scheduleCheckLoadComplete();
+
+        KURL originalRequestURL() const;
+
+        bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
+
+        void saveScrollPositionAndViewStateToItem(HistoryItem*);
 
         Frame* m_frame;
         FrameLoaderClient* m_client;
@@ -599,12 +592,9 @@
         bool m_quickRedirectComing;
         bool m_sentRedirectNotification;
         bool m_inStopAllLoaders;
-        bool m_navigationDuringLoad;
 
         String m_outgoingReferrer;
 
-        OwnPtr<FormSubmission> m_deferredFormSubmission;
-
         bool m_isExecutingJavaScriptFormAction;
         bool m_isRunningScript;
 
@@ -612,6 +602,7 @@
 
         bool m_didCallImplicitClose;
         bool m_wasUnloadEventEmitted;
+        bool m_unloadEventBeingDispatched;
         bool m_isComplete;
         bool m_isLoadingMainResource;
 
@@ -634,8 +625,6 @@
 
         bool m_containsPlugIns;
 
-        RefPtr<HTMLFormElement> m_formAboutToBeSubmitted;
-        HashMap<String, String> m_formValuesAboutToBeSubmitted;
         KURL m_submittedFormURL;
     
         Timer<FrameLoader> m_redirectionTimer;
diff --git a/WebCore/loader/FrameLoaderClient.h b/WebCore/loader/FrameLoaderClient.h
index 4f2b86e..5e5191b 100644
--- a/WebCore/loader/FrameLoaderClient.h
+++ b/WebCore/loader/FrameLoaderClient.h
@@ -64,6 +64,7 @@
     class ResourceLoader;
     struct ResourceRequest;
     class ResourceResponse;
+    class ScriptString;
     class SharedBuffer;
     class SubstituteData;
     class String;
@@ -109,6 +110,7 @@
         virtual void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier) = 0;
         virtual void dispatchDidFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError&) = 0;
         virtual bool dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int length) = 0;
+        virtual void dispatchDidLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString&) = 0;
 
         virtual void dispatchDidHandleOnloadEvents() = 0;
         virtual void dispatchDidReceiveServerRedirectForProvisionalLoad() = 0;
diff --git a/WebCore/loader/ImageDocument.cpp b/WebCore/loader/ImageDocument.cpp
index ca3f785..08f2e9a 100644
--- a/WebCore/loader/ImageDocument.cpp
+++ b/WebCore/loader/ImageDocument.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "ImageDocument.h"
 
+#include "CSSStyleDeclaration.h"
 #include "CachedImage.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -37,6 +38,7 @@
 #include "HTMLNames.h"
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "SegmentedString.h"
 #include "Settings.h"
@@ -93,7 +95,8 @@
 
 void ImageTokenizer::write(const SegmentedString&, bool)
 {
-    ASSERT_NOT_REACHED();
+    // <https://bugs.webkit.org/show_bug.cgi?id=25397>: JS code can always call document.write, we need to handle it.
+    notImplemented();
 }
 
 bool ImageTokenizer::writeRawData(const char*, int)
@@ -124,9 +127,9 @@
 
         IntSize size = cachedImage->imageSize(m_doc->frame()->pageZoomFactor());
         if (size.width()) {
-            // Compute the title, we use the filename of the resource, falling
-            // back on the hostname if there is no path.
-            String fileName = m_doc->url().lastPathComponent();
+            // Compute the title, we use the decoded filename of the resource, falling
+            // back on the (decoded) hostname if there is no path.
+            String fileName = decodeURLEscapeSequences(m_doc->url().lastPathComponent());
             if (fileName.isEmpty())
                 fileName = m_doc->url().host();
             m_doc->setTitle(imageTitle(fileName, size));
@@ -184,7 +187,8 @@
     if (shouldShrinkToFit()) {
         // Add event listeners
         RefPtr<EventListener> listener = ImageEventListener::create(this);
-        addWindowEventListener("resize", listener, false);
+        if (DOMWindow* domWindow = this->domWindow())
+            domWindow->addEventListener("resize", listener, false);
         imageElement->addEventListener("click", listener.release(), false);
     }
 
diff --git a/WebCore/loader/MainResourceLoader.cpp b/WebCore/loader/MainResourceLoader.cpp
index 5aa1cde..39e5b90 100644
--- a/WebCore/loader/MainResourceLoader.cpp
+++ b/WebCore/loader/MainResourceLoader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,12 +30,8 @@
 #include "config.h"
 #include "MainResourceLoader.h"
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-#include "ApplicationCache.h"
-#include "ApplicationCacheGroup.h"
-#include "ApplicationCacheResource.h"
-#endif
 #include "DocumentLoader.h"
+#include "FormState.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
@@ -45,6 +41,12 @@
 #include "ResourceHandle.h"
 #include "Settings.h"
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+#include "ApplicationCache.h"
+#include "ApplicationCacheGroup.h"
+#include "ApplicationCacheResource.h"
+#endif
+
 // FIXME: More that is in common with SubresourceLoader should move up into ResourceLoader.
 
 namespace WebCore {
@@ -161,7 +163,7 @@
     // Update cookie policy base URL as URL changes, except for subframes, which use the
     // URL of the main frame which doesn't change when we redirect.
     if (frameLoader()->isLoadingMainFrame())
-        newRequest.setMainDocumentURL(newRequest.url());
+        newRequest.setFirstPartyForCookies(newRequest.url());
     
     // If we're fielding a redirect in response to a POST, force a load from origin, since
     // this is a common site technique to return to a page viewing some data that the POST
@@ -179,9 +181,10 @@
     // listener. But there's no way to do that in practice. So instead we cancel later if the
     // listener tells us to. In practice that means the navigation policy needs to be decided
     // synchronously for these redirect cases.
-
-    ref(); // balanced by deref in continueAfterNavigationPolicy
-    frameLoader()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
+    if (!redirectResponse.isNull()) {
+        ref(); // balanced by deref in continueAfterNavigationPolicy
+        frameLoader()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
+    }
 }
 
 static bool shouldLoadAsEmptyDocument(const KURL& url)
@@ -291,6 +294,15 @@
     }
 #endif
 
+    HTTPHeaderMap::const_iterator it = r.httpHeaderFields().find(AtomicString("x-frame-options"));
+    if (it != r.httpHeaderFields().end()) {
+        String content = it->second;
+        if (m_frame->loader()->shouldInterruptLoadForXFrameOptions(content, r.url())) {
+            cancel();
+            return;
+        }
+    }
+
     // There is a bug in CFNetwork where callbacks can be dispatched even when loads are deferred.
     // See <rdar://problem/6304600> for more details.
 #if !PLATFORM(CF)
diff --git a/WebCore/loader/MediaDocument.cpp b/WebCore/loader/MediaDocument.cpp
index b89ac10..0b1fd59 100644
--- a/WebCore/loader/MediaDocument.cpp
+++ b/WebCore/loader/MediaDocument.cpp
@@ -38,7 +38,9 @@
 #include "HTMLEmbedElement.h"
 #include "HTMLNames.h"
 #include "HTMLVideoElement.h"
+#include "KeyboardEvent.h"
 #include "MainResourceLoader.h"
+#include "NodeList.h"
 #include "Page.h"
 #include "SegmentedString.h"
 #include "Settings.h"
@@ -133,10 +135,16 @@
     
 MediaDocument::MediaDocument(Frame* frame)
     : HTMLDocument(frame)
+    , m_replaceMediaElementTimer(this, &MediaDocument::replaceMediaElementTimerFired)
 {
     setParseMode(Compat);
 }
 
+MediaDocument::~MediaDocument()
+{
+    ASSERT(!m_replaceMediaElementTimer.isActive());
+}
+
 Tokenizer* MediaDocument::createTokenizer()
 {
     return new MediaTokenizer(this);
@@ -161,6 +169,69 @@
             }
         }
     }
+
+    if (event->type() == eventNames().keydownEvent && event->isKeyboardEvent()) {
+        HTMLVideoElement* video = 0;
+        if (targetNode) {
+            if (targetNode->hasTagName(videoTag))
+                video = static_cast<HTMLVideoElement*>(targetNode);
+            else {
+                RefPtr<NodeList> nodeList = targetNode->getElementsByTagName("video");
+                if (nodeList.get()->length() > 0)
+                    video = static_cast<HTMLVideoElement*>(nodeList.get()->item(0));
+            }
+        }
+        if (video) {
+            KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(event);
+            if (keyboardEvent->keyIdentifier() == "U+0020") { // space
+                if (video->paused()) {
+                    if (video->canPlay())
+                        video->play();
+                } else
+                    video->pause();
+                event->setDefaultHandled();
+            }
+        }
+    }
+}
+
+void MediaDocument::mediaElementSawUnsupportedTracks()
+{
+    // The HTMLMediaElement was told it has something that the underlying 
+    // MediaPlayer cannot handle so we should switch from <video> to <embed> 
+    // and let the plugin handle this. Don't do it immediately as this 
+    // function may be called directly from a media engine callback, and 
+    // replaceChild will destroy the element, media player, and media engine.
+    m_replaceMediaElementTimer.startOneShot(0);
+}
+
+void MediaDocument::replaceMediaElementTimerFired(Timer<MediaDocument>*)
+{
+    HTMLElement* htmlBody = body();
+    if (!htmlBody)
+        return;
+
+    // Set body margin width and height to 0 as that is what a PluginDocument uses.
+    htmlBody->setAttribute(marginwidthAttr, "0");
+    htmlBody->setAttribute(marginheightAttr, "0");
+
+    RefPtr<NodeList> nodeList = htmlBody->getElementsByTagName("video");
+
+    if (nodeList.get()->length() > 0) {
+        HTMLVideoElement* videoElement = static_cast<HTMLVideoElement*>(nodeList.get()->item(0));
+
+        RefPtr<Element> element = Document::createElement(embedTag, false);
+        HTMLEmbedElement* embedElement = static_cast<HTMLEmbedElement*>(element.get());
+
+        embedElement->setAttribute(widthAttr, "100%");
+        embedElement->setAttribute(heightAttr, "100%");
+        embedElement->setAttribute(nameAttr, "plugin");
+        embedElement->setSrc(url().string());
+        embedElement->setType(frame()->loader()->responseMIMEType());
+
+        ExceptionCode ec;
+        videoElement->parent()->replaceChild(embedElement, videoElement, ec);
+    }
 }
 
 }
diff --git a/WebCore/loader/MediaDocument.h b/WebCore/loader/MediaDocument.h
index e5167e4..ac286f0 100644
--- a/WebCore/loader/MediaDocument.h
+++ b/WebCore/loader/MediaDocument.h
@@ -41,11 +41,17 @@
 
     virtual void defaultEventHandler(Event*);
 
+    void mediaElementSawUnsupportedTracks();
+
 private:
     MediaDocument(Frame*);
+    virtual ~MediaDocument();
+    Timer<MediaDocument> m_replaceMediaElementTimer;
 
     virtual bool isMediaDocument() const { return true; }        
     virtual Tokenizer* createTokenizer();
+
+    void replaceMediaElementTimerFired(Timer<MediaDocument>*);
 };
     
 }
diff --git a/WebCore/loader/ProgressTracker.cpp b/WebCore/loader/ProgressTracker.cpp
index 38df80f..e682b9b 100644
--- a/WebCore/loader/ProgressTracker.cpp
+++ b/WebCore/loader/ProgressTracker.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "ProgressTracker.h"
 
+#include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
@@ -196,8 +197,11 @@
     else
         percentOfRemainingBytes = 1.0;
     
-    // Treat the first layout as the half-way point.
-    double maxProgressValue = m_originatingProgressFrame->loader()->firstLayoutDone() ? finalProgressValue : .5;
+    // For documents that use WebCore's layout system, treat first layout as the half-way point.
+    // FIXME: The hasHTMLView function is a sort of roundabout way of asking "do you use WebCore's layout system".
+    bool useClampedMaxProgress = m_originatingProgressFrame->loader()->client()->hasHTMLView()
+        && !m_originatingProgressFrame->loader()->firstLayoutDone();
+    double maxProgressValue = useClampedMaxProgress ? 0.5 : finalProgressValue;
     increment = (maxProgressValue - m_progressValue) * percentOfRemainingBytes;
     m_progressValue += increment;
     m_progressValue = min(m_progressValue, maxProgressValue);
diff --git a/WebCore/loader/SubresourceLoader.cpp b/WebCore/loader/SubresourceLoader.cpp
index 4a339ef..047cc6d 100644
--- a/WebCore/loader/SubresourceLoader.cpp
+++ b/WebCore/loader/SubresourceLoader.cpp
@@ -66,7 +66,7 @@
         return 0;
 
     FrameLoader* fl = frame->loader();
-    if (!skipCanLoadCheck && fl->state() == FrameStateProvisional)
+    if (!skipCanLoadCheck && (fl->state() == FrameStateProvisional || fl->activeDocumentLoader()->isStopping()))
         return 0;
 
     ResourceRequest newRequest = request;
@@ -222,6 +222,13 @@
     
     if (cancelled())
         return;
+    
+    // The only way the subresource loader can reach the terminal state here is if the run loop spins when calling
+    // m_client->didFail. This should in theory not happen which is why the assert is here. 
+    ASSERT(!reachedTerminalState());
+    if (reachedTerminalState())
+        return;
+    
     m_documentLoader->removeSubresourceLoader(this);
     ResourceLoader::didCancel(error);
 }
diff --git a/WebCore/loader/ThreadableLoader.cpp b/WebCore/loader/ThreadableLoader.cpp
index 1b2cc88..7b9c6c6 100644
--- a/WebCore/loader/ThreadableLoader.cpp
+++ b/WebCore/loader/ThreadableLoader.cpp
@@ -40,33 +40,33 @@
 
 namespace WebCore {
 
-PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff) 
+PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, RedirectOriginCheck redirectOriginCheck) 
 {
     ASSERT(client);
     ASSERT(context);
 
 #if ENABLE(WORKERS)
     if (context->isWorkerContext())
-        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, callbacksSetting, contentSniff);
+        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, callbacksSetting, contentSniff, storedCredentials, redirectOriginCheck);
 #endif // ENABLE(WORKERS)
 
     ASSERT(context->isDocument());
-    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, callbacksSetting, contentSniff);
+    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, callbacksSetting, contentSniff, storedCredentials, redirectOriginCheck);
 }
 
-void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context, const ResourceRequest& request, ThreadableLoaderClient& client)
+void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
 {
     ASSERT(context);
 
 #if ENABLE(WORKERS)
     if (context->isWorkerContext()) {
-        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client);
+        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client, storedCredentials, RequireSameRedirectOrigin);
         return;
     }
 #endif // ENABLE(WORKERS)
 
     ASSERT(context->isDocument());
-    DocumentThreadableLoader::loadResourceSynchronously(static_cast<Document*>(context), request, client);
+    DocumentThreadableLoader::loadResourceSynchronously(static_cast<Document*>(context), request, client, storedCredentials);
 }
 
 } // namespace WebCore
diff --git a/WebCore/loader/ThreadableLoader.h b/WebCore/loader/ThreadableLoader.h
index b051b32..0a4c4e3 100644
--- a/WebCore/loader/ThreadableLoader.h
+++ b/WebCore/loader/ThreadableLoader.h
@@ -53,12 +53,22 @@
         DoNotSniffContent
     };
 
+    enum StoredCredentials {
+        AllowStoredCredentials,
+        DoNotAllowStoredCredentials
+    };
+
+    enum RedirectOriginCheck {
+        RequireSameRedirectOrigin,
+        AllowDifferentRedirectOrigin
+    };
+
     // Useful for doing loader operations from any thread (not threadsafe, 
     // just able to run on threads other than the main thread).
     class ThreadableLoader : Noncopyable {
     public:
-        static void loadResourceSynchronously(ScriptExecutionContext*, const ResourceRequest&, ThreadableLoaderClient&);
-        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff);
+        static void loadResourceSynchronously(ScriptExecutionContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
+        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, RedirectOriginCheck);
 
         virtual void cancel() = 0;
         void ref() { refThreadableLoader(); }
diff --git a/WebCore/loader/WorkerThreadableLoader.cpp b/WebCore/loader/WorkerThreadableLoader.cpp
index 731ffcb..8153ad8 100644
--- a/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/WebCore/loader/WorkerThreadableLoader.cpp
@@ -40,7 +40,7 @@
 #include "ResourceResponse.h"
 #include "ThreadableLoader.h"
 #include "WorkerContext.h"
-#include "WorkerMessagingProxy.h"
+#include "WorkerLoaderProxy.h"
 #include "WorkerThread.h"
 #include <memory>
 #include <wtf/OwnPtr.h>
@@ -53,13 +53,11 @@
 
 static const char loadResourceSynchronouslyMode[] = "loadResourceSynchronouslyMode";
 
-// FIXME: The assumption that we can upcast worker object proxy to WorkerMessagingProxy will not be true in multi-process implementation.
 WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting,
-                                               ContentSniff contentSniff)
+                                               ContentSniff contentSniff, StoredCredentials storedCredentials, RedirectOriginCheck redirectOriginCheck)
     : m_workerContext(workerContext)
     , m_workerClientWrapper(ThreadableLoaderClientWrapper::create(client))
-    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, *(static_cast<WorkerMessagingProxy*>(m_workerContext->thread()->workerObjectProxy())), taskMode, request, callbacksSetting,
-                                      contentSniff)))
+    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, callbacksSetting, contentSniff, storedCredentials, redirectOriginCheck)))
 {
 }
 
@@ -68,7 +66,7 @@
     m_bridge.destroy();
 }
 
-void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client)
+void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials, RedirectOriginCheck redirectOriginCheck)
 {
     WorkerRunLoop& runLoop = workerContext->thread()->runLoop();
 
@@ -77,7 +75,7 @@
     mode.append(String::number(runLoop.createUniqueId()));
 
     ContentSniff contentSniff = request.url().isLocalFile() ? SniffContent : DoNotSniffContent;
-    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, DoNotSendLoadCallbacks, contentSniff);
+    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, DoNotSendLoadCallbacks, contentSniff, storedCredentials, redirectOriginCheck);
 
     MessageQueueWaitResult result = MessageQueueMessageReceived;
     while (!loader->done() && result != MessageQueueTerminated)
@@ -92,32 +90,26 @@
     m_bridge.cancel();
 }
 
-WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, WorkerMessagingProxy& messagingProxy, const String& taskMode,
-                                                           const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff)
+WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, WorkerLoaderProxy& loaderProxy, const String& taskMode,
+                                                           const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials,
+                                                           RedirectOriginCheck redirectOriginCheck)
     : m_workerClientWrapper(workerClientWrapper)
-    , m_messagingProxy(messagingProxy)
+    , m_loaderProxy(loaderProxy)
     , m_taskMode(taskMode.copy())
 {
     ASSERT(m_workerClientWrapper.get());
-    m_messagingProxy.postTaskToWorkerObject(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, callbacksSetting, contentSniff));
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, callbacksSetting, contentSniff, storedCredentials, redirectOriginCheck));
 }
 
 WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge()
 {
 }
 
-void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, LoadCallbacks callbacksSetting, ContentSniff contentSniff)
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, RedirectOriginCheck redirectOriginCheck)
 {
-    // FIXME: This assert fails for nested workers.  Removing the assert would allow it to work,
-    // but then there would be one WorkerThreadableLoader in every intermediate worker simply
-    // chaining the requests, which is not very good. Instead, the postTaskToWorkerObject should be a
-    // postTaskToDocumentContext.
     ASSERT(isMainThread());
     ASSERT(context->isDocument());
 
-    if (thisPtr->m_messagingProxy.askedToTerminate())
-        return;
-
     // FIXME: the created loader has no knowledge of the origin of the worker doing the load request.
     // Basically every setting done in SubresourceLoader::create (including the contents of addExtraFieldsToRequest)
     // needs to be examined for how it should take into account a different originator.
@@ -125,7 +117,7 @@
     // FIXME: If the a site requests a local resource, then this will return a non-zero value but the sync path
     // will return a 0 value.  Either this should return 0 or the other code path should do a callback with
     // a failure.
-    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, callbacksSetting, contentSniff);
+    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, callbacksSetting, contentSniff, storedCredentials, redirectOriginCheck);
     ASSERT(thisPtr->m_mainThreadLoader);
 }
 
@@ -142,7 +134,7 @@
     clearClientWrapper();
 
     // "delete this" and m_mainThreadLoader::deref() on the worker object's thread.
-    m_messagingProxy.postTaskToWorkerObject(createCallbackTask(&MainThreadBridge::mainThreadDestroy, this));
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadDestroy, this));
 }
 
 void WorkerThreadableLoader::MainThreadBridge::mainThreadCancel(ScriptExecutionContext* context, MainThreadBridge* thisPtr)
@@ -158,7 +150,7 @@
 
 void WorkerThreadableLoader::MainThreadBridge::cancel()
 {
-    m_messagingProxy.postTaskToWorkerObject(createCallbackTask(&MainThreadBridge::mainThreadCancel, this));
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCancel, this));
     ThreadableLoaderClientWrapper* clientWrapper = static_cast<ThreadableLoaderClientWrapper*>(m_workerClientWrapper.get());
     if (!clientWrapper->done()) {
         // If the client hasn't reached a termination state, then transition it by sending a cancellation error.
@@ -183,7 +175,7 @@
 
 void WorkerThreadableLoader::MainThreadBridge::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSendData, m_workerClientWrapper, bytesSent, totalBytesToBeSent), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSendData, m_workerClientWrapper, bytesSent, totalBytesToBeSent), m_taskMode);
 }
 
 static void workerContextDidReceiveResponse(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<CrossThreadResourceResponseData> responseData)
@@ -195,7 +187,7 @@
 
 void WorkerThreadableLoader::MainThreadBridge::didReceiveResponse(const ResourceResponse& response)
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveResponse, m_workerClientWrapper, response), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveResponse, m_workerClientWrapper, response), m_taskMode);
 }
 
 static void workerContextDidReceiveData(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<Vector<char> > vectorData)
@@ -208,7 +200,7 @@
 {
     auto_ptr<Vector<char> > vector(new Vector<char>(lengthReceived)); // needs to be an auto_ptr for usage with createCallbackTask.
     memcpy(vector->data(), data, lengthReceived);
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveData, m_workerClientWrapper, vector), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveData, m_workerClientWrapper, vector), m_taskMode);
 }
 
 static void workerContextDidFinishLoading(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, unsigned long identifier)
@@ -219,7 +211,7 @@
 
 void WorkerThreadableLoader::MainThreadBridge::didFinishLoading(unsigned long identifier)
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFinishLoading, m_workerClientWrapper, identifier), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFinishLoading, m_workerClientWrapper, identifier), m_taskMode);
 }
 
 static void workerContextDidFail(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, const ResourceError& error)
@@ -230,7 +222,7 @@
 
 void WorkerThreadableLoader::MainThreadBridge::didFail(const ResourceError& error)
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFail, m_workerClientWrapper, error), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFail, m_workerClientWrapper, error), m_taskMode);
 }
 
 static void workerContextDidFailRedirectCheck(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper)
@@ -241,7 +233,7 @@
 
 void WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck()
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFailRedirectCheck, m_workerClientWrapper), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFailRedirectCheck, m_workerClientWrapper), m_taskMode);
 }
 
 static void workerContextDidReceiveAuthenticationCancellation(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<CrossThreadResourceResponseData> responseData)
@@ -253,7 +245,7 @@
 
 void WorkerThreadableLoader::MainThreadBridge::didReceiveAuthenticationCancellation(const ResourceResponse& response)
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveAuthenticationCancellation, m_workerClientWrapper, response), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveAuthenticationCancellation, m_workerClientWrapper, response), m_taskMode);
 }
 
 } // namespace WebCore
diff --git a/WebCore/loader/WorkerThreadableLoader.h b/WebCore/loader/WorkerThreadableLoader.h
index 5462a97..a36bedf 100644
--- a/WebCore/loader/WorkerThreadableLoader.h
+++ b/WebCore/loader/WorkerThreadableLoader.h
@@ -49,16 +49,16 @@
     class ResourceError;
     struct ResourceRequest;
     class WorkerContext;
-    class WorkerMessagingProxy;
+    class WorkerLoaderProxy;
     struct CrossThreadResourceResponseData;
     struct CrossThreadResourceRequestData;
 
     class WorkerThreadableLoader : public RefCounted<WorkerThreadableLoader>, public ThreadableLoader {
     public:
-        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&);
-        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff)
+        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials, RedirectOriginCheck);
+        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, RedirectOriginCheck redirectOriginCheck)
         {
-            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, callbacksSetting, contentSniff));
+            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, callbacksSetting, contentSniff, storedCredentials, redirectOriginCheck));
         }
 
         ~WorkerThreadableLoader();
@@ -86,7 +86,7 @@
         //
         // case 1. worker.terminate is called.
         //    In this case, no more tasks are posted from the worker object's thread to the worker
-        //    context's thread -- WorkerMessagingProxy enforces this.
+        //    context's thread -- WorkerContextProxy implementation enforces this.
         //
         // case 2. xhr gets aborted and the worker context continues running.
         //    The ThreadableLoaderClientWrapper has the underlying client cleared, so no more calls
@@ -97,7 +97,7 @@
         class MainThreadBridge : ThreadableLoaderClient {
         public:
             // All executed on the worker context's thread.
-            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerMessagingProxy&, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff);
+            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, RedirectOriginCheck);
             void cancel();
             void destroy();
 
@@ -109,7 +109,7 @@
             static void mainThreadDestroy(ScriptExecutionContext*, MainThreadBridge*);
             ~MainThreadBridge();
 
-            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, LoadCallbacks, ContentSniff);
+            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, LoadCallbacks, ContentSniff, StoredCredentials, RedirectOriginCheck);
             static void mainThreadCancel(ScriptExecutionContext*, MainThreadBridge*);
             virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
             virtual void didReceiveResponse(const ResourceResponse&);
@@ -127,13 +127,13 @@
             RefPtr<ThreadSafeShared<ThreadableLoaderClientWrapper> > m_workerClientWrapper;
 
             // May be used on either thread.
-            WorkerMessagingProxy& m_messagingProxy;
+            WorkerLoaderProxy& m_loaderProxy;
 
             // For use on the main thread.
             String m_taskMode;
         };
 
-        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff);
+        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, RedirectOriginCheck);
 
         RefPtr<WorkerContext> m_workerContext;
         RefPtr<ThreadableLoaderClientWrapper> m_workerClientWrapper;
diff --git a/WebCore/loader/appcache/ApplicationCache.cpp b/WebCore/loader/appcache/ApplicationCache.cpp
index e411852..42f5b6a 100644
--- a/WebCore/loader/appcache/ApplicationCache.cpp
+++ b/WebCore/loader/appcache/ApplicationCache.cpp
@@ -111,7 +111,7 @@
 
 bool ApplicationCache::requestIsHTTPOrHTTPSGet(const ResourceRequest& request)
 {
-    if (!request.url().protocolIs("http") && !request.url().protocolIs("https"))
+    if (!request.url().protocolInHTTPFamily())
         return false;
     
     if (!equalIgnoringCase(request.httpMethod(), "GET"))
diff --git a/WebCore/loader/appcache/ApplicationCache.h b/WebCore/loader/appcache/ApplicationCache.h
index 77653f7..afdab27 100644
--- a/WebCore/loader/appcache/ApplicationCache.h
+++ b/WebCore/loader/appcache/ApplicationCache.h
@@ -41,7 +41,8 @@
 class ApplicationCacheResource;
 class DocumentLoader;
 class KURL;
-class ResourceRequest;
+
+struct ResourceRequest;
 
 typedef Vector<std::pair<KURL, KURL> > FallbackURLVector;
 
diff --git a/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 1b16b50..9f2f6a4 100644
--- a/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -47,6 +47,7 @@
 ApplicationCacheGroup::ApplicationCacheGroup(const KURL& manifestURL, bool isCopy)
     : m_manifestURL(manifestURL)
     , m_updateStatus(Idle)
+    , m_downloadingPendingMasterResourceLoadersCount(0)
     , m_frame(0)
     , m_storageID(0)
     , m_isObsolete(false)
@@ -166,6 +167,7 @@
 
     documentLoader->setCandidateApplicationCacheGroup(group);
     group->m_pendingMasterResourceLoaders.add(documentLoader);
+    group->m_downloadingPendingMasterResourceLoadersCount++;
 
     ASSERT(!group->m_cacheBeingUpdated || group->m_updateStatus != Idle);
     group->update(frame, ApplicationCacheUpdateWithBrowsingContext);
@@ -232,7 +234,7 @@
         break;
     }
 
-    m_pendingMasterResourceLoaders.remove(loader);
+    m_downloadingPendingMasterResourceLoadersCount--;
     checkIfLoadIsComplete();
 }
 
@@ -276,7 +278,7 @@
         break;
     }
 
-    m_pendingMasterResourceLoaders.remove(loader);
+    m_downloadingPendingMasterResourceLoadersCount--;
     checkIfLoadIsComplete();
 }
 
@@ -347,8 +349,6 @@
 
 void ApplicationCacheGroup::setNewestCache(PassRefPtr<ApplicationCache> newestCache)
 {
-    ASSERT(!m_caches.contains(newestCache.get()));
-
     m_newestCache = newestCache;
 
     m_caches.add(m_newestCache.get());
@@ -681,6 +681,7 @@
         m_pendingMasterResourceLoaders.remove(it);
     }
 
+    m_downloadingPendingMasterResourceLoadersCount = 0;
     m_updateStatus = Idle;    
     m_frame = 0;
     
@@ -693,7 +694,7 @@
 
 void ApplicationCacheGroup::checkIfLoadIsComplete()
 {
-    if (m_manifestHandle || !m_pendingEntries.isEmpty() || !m_pendingMasterResourceLoaders.isEmpty())
+    if (m_manifestHandle || !m_pendingEntries.isEmpty() || m_downloadingPendingMasterResourceLoadersCount)
         return;
     
     // We're done, all resources have finished downloading (successfully or not).
@@ -732,16 +733,43 @@
         RefPtr<ApplicationCache> oldNewestCache = (m_newestCache == m_cacheBeingUpdated) ? 0 : m_newestCache;
 
         setNewestCache(m_cacheBeingUpdated.release());
-        cacheStorage().storeNewestCache(this);
-
-        if (oldNewestCache)
-            cacheStorage().remove(oldNewestCache.get());
-
-        postListenerTask(isUpgradeAttempt ? &DOMApplicationCache::callUpdateReadyListener : &DOMApplicationCache::callCachedListener, m_associatedDocumentLoaders);
+        if (cacheStorage().storeNewestCache(this)) {

+            // New cache stored, now remove the old cache.

+            if (oldNewestCache)

+                cacheStorage().remove(oldNewestCache.get());

+            // Fire the success events.

+            postListenerTask(isUpgradeAttempt ? &DOMApplicationCache::callUpdateReadyListener : &DOMApplicationCache::callCachedListener, m_associatedDocumentLoaders);

+        } else {

+            // Run the "cache failure steps"

+            // Fire the error events to all pending master entries, as well any other cache hosts

+            // currently associated with a cache in this group.

+            postListenerTask(&DOMApplicationCache::callErrorListener, m_associatedDocumentLoaders);

+            // Disassociate the pending master entries from the failed new cache. Note that

+            // all other loaders in the m_associatedDocumentLoaders are still associated with

+            // some other cache in this group. They are not associated with the failed new cache.

+

+            // Need to copy loaders, because the cache group may be destroyed at the end of iteration.
+            Vector<DocumentLoader*> loaders;
+            copyToVector(m_pendingMasterResourceLoaders, loaders);
+            size_t count = loaders.size();
+            for (size_t i = 0; i != count; ++i)

+                disassociateDocumentLoader(loaders[i]); // This can delete this group.

+

+            // Reinstate the oldNewestCache, if there was one.

+            if (oldNewestCache) {

+                // This will discard the failed new cache.

+                setNewestCache(oldNewestCache.release());

+            } else {

+                // We must have been deleted by the last call to disassociateDocumentLoader().

+                return;

+            }

+        }

         break;
     }
     }
 
+    // Empty cache group's list of pending master entries.
+    m_pendingMasterResourceLoaders.clear();
     m_completionType = None;
     m_updateStatus = Idle;
     m_frame = 0;
diff --git a/WebCore/loader/appcache/ApplicationCacheGroup.h b/WebCore/loader/appcache/ApplicationCacheGroup.h
index aebf0ab..063fb3b 100644
--- a/WebCore/loader/appcache/ApplicationCacheGroup.h
+++ b/WebCore/loader/appcache/ApplicationCacheGroup.h
@@ -134,6 +134,8 @@
 
     // List of pending master entries, used during the update process to ensure that new master entries are cached.
     HashSet<DocumentLoader*> m_pendingMasterResourceLoaders;
+    // How many of the above pending master entries have not yet finished downloading.
+    int m_downloadingPendingMasterResourceLoadersCount;
     
     // These are all the document loaders that are associated with a cache in this group.
     HashSet<DocumentLoader*> m_associatedDocumentLoaders;
diff --git a/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 791df22..1c59581 100644
--- a/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -43,6 +43,44 @@
 
 namespace WebCore {
 
+class ResourceStorageIDJournal {
+public:  
+    ~ResourceStorageIDJournal()
+    {
+        size_t size = m_records.size();
+        for (size_t i = 0; i < size; ++i)
+            m_records[i].restore();
+    }
+
+    void add(ApplicationCacheResource* resource, unsigned storageID)
+    {
+        m_records.append(Record(resource, storageID));
+    }
+
+    void commit()
+    {
+        m_records.clear();
+    }
+
+private:
+    class Record {
+    public:
+        Record() : m_resource(0), m_storageID(0) { }
+        Record(ApplicationCacheResource* resource, unsigned storageID) : m_resource(resource), m_storageID(storageID) { }
+
+        void restore()
+        {
+            m_resource->setStorageID(m_storageID);
+        }
+
+    private:
+        ApplicationCacheResource* m_resource;
+        unsigned m_storageID;
+    };
+
+    Vector<Record> m_records;
+};
+
 static unsigned urlHostHash(const KURL& url)
 {
     unsigned hostStart = url.hostStart();
@@ -436,10 +474,11 @@
     return true;
 }    
 
-bool ApplicationCacheStorage::store(ApplicationCache* cache)
+bool ApplicationCacheStorage::store(ApplicationCache* cache, ResourceStorageIDJournal* storageIDJournal)
 {
     ASSERT(cache->storageID() == 0);
     ASSERT(cache->group()->storageID() != 0);
+    ASSERT(storageIDJournal);
     
     SQLiteStatement statement(m_database, "INSERT INTO Caches (cacheGroup) VALUES (?)");
     if (statement.prepare() != SQLResultOk)
@@ -456,8 +495,13 @@
     {
         ApplicationCache::ResourceMap::const_iterator end = cache->end();
         for (ApplicationCache::ResourceMap::const_iterator it = cache->begin(); it != end; ++it) {
+            unsigned oldStorageID = it->second->storageID();
             if (!store(it->second.get(), cacheStorageID))
                 return false;
+
+            // Storing the resource succeeded. Log its old storageID in case
+            // it needs to be restored later.
+            storageIDJournal->add(it->second.get(), oldStorageID);
         }
     }
     
@@ -618,8 +662,13 @@
     ASSERT(!group->isObsolete());
     ASSERT(!group->newestCache()->storageID());
     
+    // Log the storageID changes to the in-memory resource objects. The journal
+    // object will roll them back automatically in case a database operation
+    // fails and this method returns early.
+    ResourceStorageIDJournal storageIDJournal;
+
     // Store the newest cache
-    if (!store(group->newestCache()))
+    if (!store(group->newestCache(), &storageIDJournal))
         return false;
     
     // Update the newest cache in the group.
@@ -634,6 +683,7 @@
     if (!executeStatement(statement))
         return false;
     
+    storageIDJournal.commit();
     storeCacheTransaction.commit();
     return true;
 }
diff --git a/WebCore/loader/appcache/ApplicationCacheStorage.h b/WebCore/loader/appcache/ApplicationCacheStorage.h
index a0eb4ee..b13b596 100644
--- a/WebCore/loader/appcache/ApplicationCacheStorage.h
+++ b/WebCore/loader/appcache/ApplicationCacheStorage.h
@@ -40,6 +40,7 @@
 class ApplicationCacheGroup;
 class ApplicationCacheResource;
 class KURL;
+class ResourceStorageIDJournal;
     
 class ApplicationCacheStorage {
 public:
@@ -69,7 +70,7 @@
     ApplicationCacheGroup* loadCacheGroup(const KURL& manifestURL);
     
     bool store(ApplicationCacheGroup*);
-    bool store(ApplicationCache*);
+    bool store(ApplicationCache*, ResourceStorageIDJournal*);
     bool store(ApplicationCacheResource*, unsigned cacheStorageID);
 
     void loadManifestHostHashes();
diff --git a/WebCore/loader/appcache/DOMApplicationCache.idl b/WebCore/loader/appcache/DOMApplicationCache.idl
index 4cf8f3a..1156c9c 100644
--- a/WebCore/loader/appcache/DOMApplicationCache.idl
+++ b/WebCore/loader/appcache/DOMApplicationCache.idl
@@ -43,7 +43,7 @@
         void swapCache()
             raises(DOMException);
 
-#if ENABLE_APPLICATION_CAHE_DYNAMIC_ENTRIES
+#if defined(ENABLE_APPLICATION_CACHE_DYNAMIC_ENTRIES) && ENABLE_APPLICATION_CACHE_DYNAMIC_ENTRIES
         // dynamic entries
         readonly attribute DOMStringList items;
         [Custom] boolean hasItem(in DOMString url)
diff --git a/WebCore/loader/icon/IconDatabase.cpp b/WebCore/loader/icon/IconDatabase.cpp
index 7e339c1..1f49c88 100644
--- a/WebCore/loader/icon/IconDatabase.cpp
+++ b/WebCore/loader/icon/IconDatabase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Justin Haygood (jhaygood@reaktix.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,39 +28,23 @@
 #include "IconDatabase.h"
 
 #include "AutodrainedPool.h"
-#include "CString.h"
 #include "DocumentLoader.h"
 #include "FileSystem.h"
 #include "IconDatabaseClient.h"
 #include "IconRecord.h"
-#include "Image.h"
 #include "IntSize.h"
-#include "KURL.h"
 #include "Logging.h"
-#include "PageURLRecord.h"
 #include "SQLiteStatement.h"
 #include "SQLiteTransaction.h"
-#include <wtf/CurrentTime.h>
-#include <wtf/MainThread.h>
-#include <wtf/StdLibExtras.h>
-
+#include "SuddenTermination.h"
 #if USE(JSC)
 #include <runtime/InitializeThreading.h>
 #elif USE(V8)
 #include "V8InitializeThreading.h"
 #endif
-
-#if PLATFORM(WIN_OS)
-#include <windows.h>
-#include <winbase.h>
-#include <shlobj.h>
-#else
-#include <sys/stat.h>
-#endif
-
-#if PLATFORM(DARWIN)
-#include <pthread.h>
-#endif
+#include <wtf/CurrentTime.h>
+#include <wtf/MainThread.h>
+#include <wtf/StdLibExtras.h>
 
 // For methods that are meant to support API from the main thread - should not be called internally
 #define ASSERT_NOT_SYNC_THREAD() ASSERT(!m_syncThreadRunning || !IS_ICON_SYNC_THREAD())
@@ -69,7 +53,7 @@
 #define IS_ICON_SYNC_THREAD() (m_syncThread == currentThread())
 #define ASSERT_ICON_SYNC_THREAD() ASSERT(IS_ICON_SYNC_THREAD())
 
-#if PLATFORM(QT)
+#if PLATFORM(QT) || PLATFORM(GTK)
 #define CAN_THEME_URL_ICON
 #endif
 
@@ -82,12 +66,12 @@
 // Currently, a mismatched schema causes the DB to be wiped and reset.  This isn't 
 // so bad during development but in the future, we would need to write a conversion
 // function to advance older released schemas to "current"
-const int currentDatabaseVersion = 6;
+static const int currentDatabaseVersion = 6;
 
 // Icons expire once every 4 days
-const int iconExpirationTime = 60*60*24*4; 
+static const int iconExpirationTime = 60*60*24*4; 
 
-const int updateTimerDelay = 5; 
+static const int updateTimerDelay = 5; 
 
 static bool checkIntegrityOnOpen = false;
 
@@ -159,6 +143,7 @@
     // completes and m_syncThreadRunning is properly set
     m_syncLock.lock();
     m_syncThread = createThread(IconDatabase::iconDatabaseSyncThreadStart, this, "WebCore: IconDatabase");
+    m_syncThreadRunning = m_syncThread;
     m_syncLock.unlock();
     if (!m_syncThread)
         return false;
@@ -782,8 +767,8 @@
 }
 
 IconDatabase::IconDatabase()
-    : m_syncThreadRunning(false)
-    , m_defaultIconRecord(0)
+    : m_syncTimer(this, &IconDatabase::syncTimerFired)
+    , m_syncThreadRunning(false)
     , m_isEnabled(false)
     , m_privateBrowsingEnabled(false)
     , m_threadTerminationRequested(false)
@@ -794,9 +779,7 @@
     , m_imported(false)
     , m_isImportedSet(false)
 {
-#if PLATFORM(DARWIN)
-    ASSERT(pthread_main_np());
-#endif
+    ASSERT(isMainThread());
 }
 
 IconDatabase::~IconDatabase()
@@ -829,6 +812,12 @@
 
 void IconDatabase::wakeSyncThread()
 {
+    // The following is balanced by the call to enableSuddenTermination in the
+    // syncThreadMainLoop function.
+    // FIXME: It would be better to only disable sudden termination if we have
+    // something to write, not just if we have something to read.
+    disableSuddenTermination();
+
     MutexLocker locker(m_syncLock);
     m_syncCondition.signal();
 }
@@ -836,16 +825,24 @@
 void IconDatabase::scheduleOrDeferSyncTimer()
 {
     ASSERT_NOT_SYNC_THREAD();
-    if (!m_syncTimer)
-        m_syncTimer.set(new Timer<IconDatabase>(this, &IconDatabase::syncTimerFired));
 
-    m_syncTimer->startOneShot(updateTimerDelay);
+    if (!m_syncTimer.isActive()) {
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
+
+    m_syncTimer.startOneShot(updateTimerDelay);
 }
 
 void IconDatabase::syncTimerFired(Timer<IconDatabase>*)
 {
     ASSERT_NOT_SYNC_THREAD();
     wakeSyncThread();
+
+    // The following is balanced by the call to disableSuddenTermination in the
+    // scheduleOrDeferSyncTimer function.
+    enableSuddenTermination();
 }
 
 // ******************
@@ -1342,7 +1339,8 @@
 void* IconDatabase::syncThreadMainLoop()
 {
     ASSERT_ICON_SYNC_THREAD();
-    static bool prunedUnretainedIcons = false;
+
+    bool shouldReenableSuddenTermination = false;
 
     m_syncLock.lock();
 
@@ -1381,6 +1379,7 @@
             // or if private browsing is enabled
             // We also don't want to prune if the m_databaseCleanupCounter count is non-zero - that means someone
             // has asked to delay pruning
+            static bool prunedUnretainedIcons = false;
             if (didWrite && !m_privateBrowsingEnabled && !prunedUnretainedIcons && !databaseCleanupCounter) {
 #ifndef NDEBUG
                 double time = currentTime();
@@ -1413,13 +1412,32 @@
         // We handle those at the top of this main loop so continue to jump back up there
         if (shouldStopThreadActivity())
             continue;
-            
-        m_syncCondition.wait(m_syncLock); 
+
+        if (shouldReenableSuddenTermination) {
+            // The following is balanced by the call to disableSuddenTermination in the
+            // wakeSyncThread function. Any time we wait on the condition, we also have
+            // to enableSuddenTermation, after doing the next batch of work.
+            enableSuddenTermination();
+        }
+
+        m_syncCondition.wait(m_syncLock);
+
+        shouldReenableSuddenTermination = true;
     }
+
     m_syncLock.unlock();
     
     // Thread is terminating at this point
-    return cleanupSyncThread();
+    cleanupSyncThread();
+
+    if (shouldReenableSuddenTermination) {
+        // The following is balanced by the call to disableSuddenTermination in the
+        // wakeSyncThread function. Any time we wait on the condition, we also have
+        // to enableSuddenTermation, after doing the next batch of work.
+        enableSuddenTermination();
+    }
+
+    return 0;
 }
 
 bool IconDatabase::readFromDatabase()
@@ -1706,23 +1724,23 @@
 }
 
 void IconDatabase::deleteAllPreparedStatements()
-{        
+{
     ASSERT_ICON_SYNC_THREAD();
     
-    m_setIconIDForPageURLStatement.set(0);
-    m_removePageURLStatement.set(0);
-    m_getIconIDForIconURLStatement.set(0);
-    m_getImageDataForIconURLStatement.set(0);
-    m_addIconToIconInfoStatement.set(0);
-    m_addIconToIconDataStatement.set(0);
-    m_getImageDataStatement.set(0);
-    m_deletePageURLsForIconURLStatement.set(0);
-    m_deleteIconFromIconInfoStatement.set(0);
-    m_deleteIconFromIconDataStatement.set(0);
-    m_updateIconInfoStatement.set(0);
-    m_updateIconDataStatement.set(0);
-    m_setIconInfoStatement.set(0);
-    m_setIconDataStatement.set(0);
+    m_setIconIDForPageURLStatement.clear();
+    m_removePageURLStatement.clear();
+    m_getIconIDForIconURLStatement.clear();
+    m_getImageDataForIconURLStatement.clear();
+    m_addIconToIconInfoStatement.clear();
+    m_addIconToIconDataStatement.clear();
+    m_getImageDataStatement.clear();
+    m_deletePageURLsForIconURLStatement.clear();
+    m_deleteIconFromIconInfoStatement.clear();
+    m_deleteIconFromIconDataStatement.clear();
+    m_updateIconInfoStatement.clear();
+    m_updateIconDataStatement.clear();
+    m_setIconInfoStatement.clear();
+    m_setIconDataStatement.clear();
 }
 
 void* IconDatabase::cleanupSyncThread()
diff --git a/WebCore/loader/icon/IconDatabase.h b/WebCore/loader/icon/IconDatabase.h
index 4303ae1..40f641a 100644
--- a/WebCore/loader/icon/IconDatabase.h
+++ b/WebCore/loader/icon/IconDatabase.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Justin Haygood (jhaygood@reaktix.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,17 +27,15 @@
 #ifndef IconDatabase_h
 #define IconDatabase_h
 
-#if ENABLE(ICONDATABASE)
-#include "SQLiteDatabase.h"
-#endif
-
 #include "StringHash.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+
 #if ENABLE(ICONDATABASE)
+#include "SQLiteDatabase.h"
 #include <wtf/Threading.h>
 #endif
 
@@ -116,9 +114,9 @@
 
     void wakeSyncThread();
     void scheduleOrDeferSyncTimer();
-    OwnPtr<Timer<IconDatabase> > m_syncTimer;
     void syncTimerFired(Timer<IconDatabase>*);
     
+    Timer<IconDatabase> m_syncTimer;
     ThreadIdentifier m_syncThread;
     bool m_syncThreadRunning;
     
diff --git a/WebCore/loader/loader.cpp b/WebCore/loader/loader.cpp
index b8d1ab7..a5549d1 100644
--- a/WebCore/loader/loader.cpp
+++ b/WebCore/loader/loader.cpp
@@ -48,20 +48,22 @@
 
 #if REQUEST_MANAGEMENT_ENABLED
 // Match the parallel connection count used by the networking layer
-// FIXME should not hardcode something like this
-static const unsigned maxRequestsInFlightPerHost = 4;
+static unsigned maxRequestsInFlightPerHost;
 // Having a limit might still help getting more important resources first
 static const unsigned maxRequestsInFlightForNonHTTPProtocols = 20;
 #else
 static const unsigned maxRequestsInFlightPerHost = 10000;
 static const unsigned maxRequestsInFlightForNonHTTPProtocols = 10000;
 #endif
-    
-    
+
 Loader::Loader()
-    : m_nonHTTPProtocolHost(AtomicString(), maxRequestsInFlightForNonHTTPProtocols)
-    , m_requestTimer(this, &Loader::requestTimerFired)
+    : m_requestTimer(this, &Loader::requestTimerFired)
+    , m_isSuspendingPendingRequests(false)
 {
+    m_nonHTTPProtocolHost = Host::create(AtomicString(), maxRequestsInFlightForNonHTTPProtocols);
+#if REQUEST_MANAGEMENT_ENABLED
+    maxRequestsInFlightPerHost = initializeMaximumHTTPConnectionCountPerHost();
+#endif
 }
 
 Loader::~Loader()
@@ -99,25 +101,24 @@
     ASSERT(docLoader);
     Request* request = new Request(docLoader, resource, incremental, skipCanLoadCheck, sendResourceLoadCallbacks);
 
-    Host* host;
+    RefPtr<Host> host;
     KURL url(resource->url());
-    bool isHTTP = url.protocolIs("http") || url.protocolIs("https");
-    if (isHTTP) {
+    if (url.protocolInHTTPFamily()) {
         AtomicString hostName = url.host();
         host = m_hosts.get(hostName.impl());
         if (!host) {
-            host = new Host(hostName, maxRequestsInFlightPerHost);
+            host = Host::create(hostName, maxRequestsInFlightPerHost);
             m_hosts.add(hostName.impl(), host);
         }
     } else 
-        host = &m_nonHTTPProtocolHost;
+        host = m_nonHTTPProtocolHost;
     
     bool hadRequests = host->hasRequests();
     Priority priority = determinePriority(resource);
     host->addRequest(request, priority);
     docLoader->incrementRequestCount();
 
-    if (priority > Low || !isHTTP || !hadRequests) {
+    if (priority > Low || !url.protocolInHTTPFamily() || !hadRequests) {
         // Try to request important resources immediately
         host->servePendingRequests(priority);
     } else {
@@ -139,33 +140,57 @@
 
 void Loader::servePendingRequests(Priority minimumPriority)
 {
+    if (m_isSuspendingPendingRequests)
+        return;
+
     m_requestTimer.stop();
     
-    m_nonHTTPProtocolHost.servePendingRequests(minimumPriority);
+    m_nonHTTPProtocolHost->servePendingRequests(minimumPriority);
 
     Vector<Host*> hostsToServe;
-    copyValuesToVector(m_hosts, hostsToServe);
+    HostMap::iterator i = m_hosts.begin();
+    HostMap::iterator end = m_hosts.end();
+    for (;i != end; ++i)
+        hostsToServe.append(i->second.get());
+        
     for (unsigned n = 0; n < hostsToServe.size(); ++n) {
         Host* host = hostsToServe[n];
         if (host->hasRequests())
             host->servePendingRequests(minimumPriority);
         else if (!host->processingResource()){
             AtomicString name = host->name();
-            delete host;
             m_hosts.remove(name.impl());
         }
     }
 }
-    
+
+void Loader::suspendPendingRequests()
+{
+    ASSERT(!m_isSuspendingPendingRequests);
+    m_isSuspendingPendingRequests = true;
+}
+
+void Loader::resumePendingRequests()
+{
+    ASSERT(m_isSuspendingPendingRequests);
+    m_isSuspendingPendingRequests = false;
+    if (!m_hosts.isEmpty() || m_nonHTTPProtocolHost->hasRequests())
+        scheduleServePendingRequests();
+}
+
 void Loader::cancelRequests(DocLoader* docLoader)
 {
     docLoader->clearPendingPreloads();
 
-    if (m_nonHTTPProtocolHost.hasRequests())
-        m_nonHTTPProtocolHost.cancelRequests(docLoader);
+    if (m_nonHTTPProtocolHost->hasRequests())
+        m_nonHTTPProtocolHost->cancelRequests(docLoader);
     
     Vector<Host*> hostsToCancel;
-    copyValuesToVector(m_hosts, hostsToCancel);
+    HostMap::iterator i = m_hosts.begin();
+    HostMap::iterator end = m_hosts.end();
+    for (;i != end; ++i)
+        hostsToCancel.append(i->second.get());
+
     for (unsigned n = 0; n < hostsToCancel.size(); ++n) {
         Host* host = hostsToCancel[n];
         if (host->hasRequests())
@@ -176,7 +201,7 @@
     
     ASSERT(docLoader->requestCount() == (docLoader->loadInProgress() ? 1 : 0));
 }
-    
+
 Loader::Host::Host(const AtomicString& name, unsigned maxRequestsInFlight)
     : m_name(name)
     , m_maxRequestsInFlight(maxRequestsInFlight)
@@ -209,6 +234,9 @@
 
 void Loader::Host::servePendingRequests(Loader::Priority minimumPriority)
 {
+    if (cache()->loader()->isSuspendingPendingRequests())
+        return;
+
     bool serveMore = true;
     for (int priority = High; priority >= minimumPriority && serveMore; --priority)
         servePendingRequests(m_requestsPending[priority], serveMore);
@@ -238,11 +266,7 @@
         if (!request->cachedResource()->accept().isEmpty())
             resourceRequest.setHTTPAccept(request->cachedResource()->accept());
         
-        KURL referrer = docLoader->doc()->url();
-        if ((referrer.protocolIs("http") || referrer.protocolIs("https")) && referrer.path().isEmpty())
-            referrer.setPath("/");
-        resourceRequest.setHTTPReferrer(referrer.string());
-        FrameLoader::addHTTPOriginIfNeeded(resourceRequest, docLoader->doc()->securityOrigin()->toString());
+         // Do not set the referrer or HTTP origin here. That's handled by SubresourceLoader::create.
         
         if (resourceIsCacheValidator) {
             CachedResource* resourceToRevalidate = request->cachedResource()->resourceToRevalidate();
@@ -262,7 +286,7 @@
         }
 
         RefPtr<SubresourceLoader> loader = SubresourceLoader::create(docLoader->doc()->frame(),
-                                                                     this, resourceRequest, request->shouldSkipCanLoadCheck(), request->sendResourceLoadCallbacks());
+            this, resourceRequest, request->shouldSkipCanLoadCheck(), request->sendResourceLoadCallbacks());
         if (loader) {
             m_requestsLoading.add(loader.release(), request);
             request->cachedResource()->setRequestedFromNetworkingLayer();
@@ -281,12 +305,12 @@
 
 void Loader::Host::didFinishLoading(SubresourceLoader* loader)
 {
+    RefPtr<Host> myProtector(this);
+
     RequestMap::iterator i = m_requestsLoading.find(loader);
     if (i == m_requestsLoading.end())
         return;
     
-    ProcessingResource processingResource(this);
-
     Request* request = i->second;
     m_requestsLoading.remove(i);
     DocLoader* docLoader = request->docLoader();
@@ -327,13 +351,13 @@
 
 void Loader::Host::didFail(SubresourceLoader* loader, bool cancelled)
 {
+    RefPtr<Host> myProtector(this);
+
     loader->clearClient();
 
     RequestMap::iterator i = m_requestsLoading.find(loader);
     if (i == m_requestsLoading.end())
         return;
-
-    ProcessingResource processingResource(this);
     
     Request* request = i->second;
     m_requestsLoading.remove(i);
@@ -367,6 +391,8 @@
 
 void Loader::Host::didReceiveResponse(SubresourceLoader* loader, const ResourceResponse& response)
 {
+    RefPtr<Host> protector(this);
+
     Request* request = m_requestsLoading.get(loader);
     
     // FIXME: This is a workaround for <rdar://problem/5236843>
@@ -428,6 +454,8 @@
 
 void Loader::Host::didReceiveData(SubresourceLoader* loader, const char* data, int size)
 {
+    RefPtr<Host> protector(this);
+
     Request* request = m_requestsLoading.get(loader);
     if (!request)
         return;
@@ -437,12 +465,11 @@
     
     if (resource->errorOccurred())
         return;
-    
-    ProcessingResource processingResource(this);
-    
+        
     if (resource->response().httpStatusCode() / 100 == 4) {
-        // Treat a 4xx response like a network error.
-        resource->error();
+        // Treat a 4xx response like a network error for all resources but images (which will ignore the error and continue to load for 
+        // legacy compatibility).
+        resource->httpStatusCodeError();
         return;
     }
 
diff --git a/WebCore/loader/loader.h b/WebCore/loader/loader.h
index 19c3fda..c5b9416 100644
--- a/WebCore/loader/loader.h
+++ b/WebCore/loader/loader.h
@@ -49,15 +49,22 @@
         enum Priority { Low, Medium, High };
         void servePendingRequests(Priority minimumPriority = Low);
 
+        bool isSuspendingPendingRequests() { return m_isSuspendingPendingRequests; }
+        void suspendPendingRequests();
+        void resumePendingRequests();
+
     private:
         Priority determinePriority(const CachedResource*) const;
         void scheduleServePendingRequests();
         
         void requestTimerFired(Timer<Loader>*);
 
-        class Host : private SubresourceLoaderClient {
+        class Host : public RefCounted<Host>, private SubresourceLoaderClient {
         public:
-            Host(const AtomicString& name, unsigned maxRequestsInFlight);
+            static PassRefPtr<Host> create(const AtomicString& name, unsigned maxRequestsInFlight) 
+            {
+                return adoptRef(new Host(name, maxRequestsInFlight));
+            }
             ~Host();
             
             const AtomicString& name() const { return m_name; }
@@ -69,22 +76,7 @@
             bool processingResource() const { return m_numResourcesProcessing != 0; }
 
         private:
-            class ProcessingResource {
-            public:
-                ProcessingResource(Host* host)
-                    : m_host(host)
-                {
-                    m_host->m_numResourcesProcessing++;
-                }
-
-                ~ProcessingResource()
-                {
-                    m_host->m_numResourcesProcessing--;
-                }
-
-            private:
-                Host* m_host;
-            };
+            Host(const AtomicString&, unsigned);
 
             virtual void didReceiveResponse(SubresourceLoader*, const ResourceResponse&);
             virtual void didReceiveData(SubresourceLoader*, const char*, int);
@@ -103,11 +95,13 @@
             const int m_maxRequestsInFlight;
             int m_numResourcesProcessing;
         };
-        typedef HashMap<AtomicStringImpl*, Host*> HostMap;
+        typedef HashMap<AtomicStringImpl*, RefPtr<Host> > HostMap;
         HostMap m_hosts;
-        Host m_nonHTTPProtocolHost;
+        RefPtr<Host> m_nonHTTPProtocolHost;
         
         Timer<Loader> m_requestTimer;
+
+        bool m_isSuspendingPendingRequests;
     };
 
 }
diff --git a/WebCore/manual-tests/chromium/onchange-reload-popup.html b/WebCore/manual-tests/chromium/onchange-reload-popup.html
new file mode 100644
index 0000000..ce8f21e
--- /dev/null
+++ b/WebCore/manual-tests/chromium/onchange-reload-popup.html
@@ -0,0 +1,44 @@
+<html>
+<head>
+    <script type="text/javascript"> 
+
+    function addEvent(obj, evType, fn) {
+        if (obj.addEventListener){
+          obj.addEventListener(evType, fn, false);
+          return true;
+        } else if (obj.attachEvent){
+          var r = obj.attachEvent("on"+evType, fn);
+          return r;
+        } else {
+          return false;
+        }
+    }
+
+    function reloadSelect() {
+        var container = document.getElementById('container');
+        container.innerHTML = '<select id="menu"> \
+          <option value="abcd">abcd</option>\
+          <option value="defg">efgh</option>\
+        </select>';
+
+        var menu = document.getElementById('menu');
+        addEvent(menu, 'change', reloadSelect);
+    }
+
+    </script>
+</head>
+<body>
+    <p>Do the following and see if Chromium crashes.</p>
+    <ul>
+      <li>Click the select</li> 
+      <li>Press 'e' on your keyboard</li> 
+      <li>Click on the document but not the select itself.</li>
+    </ul>
+
+    <div id="container"/>
+    <script>
+        reloadSelect()
+    </script>
+    </div> 
+</body>
+</html>
diff --git a/WebCore/manual-tests/interrupted-compound-transform.html b/WebCore/manual-tests/interrupted-compound-transform.html
new file mode 100644
index 0000000..7dafb73
--- /dev/null
+++ b/WebCore/manual-tests/interrupted-compound-transform.html
@@ -0,0 +1,79 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+   "http://www.w3.org/TR/html4/loose.dtd">
+
+<html lang="en">
+<head>
+  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+  <title>Interrupted Transitions on Transform Test</title>
+  <style type="text/css" media="screen">
+    #container {
+      width: 400px;
+      height: 400px;
+      margin: 20px;
+      border: 1px solid black;
+      -webkit-perspective: 800;
+    }
+    #tester {
+      width: 300px;
+      height: 300px;
+      margin: 50px;
+      background-color: blue;
+      -webkit-transition: -webkit-transform 3s linear;
+      -webkit-transform: rotateX(65deg) translateZ(75px) rotateZ(0deg);
+      -webkit-transform-style: preserve-3d;
+    }
+    #pos1 {
+      position:absolute;
+      width: 300px;
+      height: 300px;
+      margin: 50px;
+      border: 2px solid #F00;
+      -webkit-transform: rotateX(65deg) translateZ(75px) rotateZ(118deg);
+      -webkit-transform-style: preserve-3d;
+    }
+    #pos2 {
+      position:absolute;
+      width: 300px;
+      height: 300px;
+      margin: 50px;
+      border: 2px solid #0F0;
+      -webkit-transform: rotateX(65deg) translateZ(75px) rotateZ(80deg);
+      -webkit-transform-style: preserve-3d;
+    }
+  </style>
+  <script type="text/javascript" charset="utf-8">
+    function setAngle(index)
+    {
+      var tester = document.getElementById('tester');
+      tester.style.webkitTransform = "rotateX(65deg) translateZ(75px) rotateZ(" + index + "deg)";
+    }
+    
+    function runTest()
+    {
+      window.setTimeout(function() {
+        setAngle(240);
+      }, 0);
+
+      window.setTimeout(function() {
+        setAngle(80);
+      }, 1500);
+    }
+    window.addEventListener('load', runTest, false);
+  </script>
+</head>
+<body>
+In this test you should see a blue diamond spinning in the clockwise direction. After 1.5 seconds it should stop
+close to the red outlne and then spin counterclockwise. After 3 more seconds it should stop close to the 
+position of the green outline. 
+(see: <a href="https://bugs.webkit.org/show_bug.cgi?id=26162">https://bugs.webkit.org/show_bug.cgi?id=26162)</a>
+<div id="container">
+  <div id="pos1">
+  </div>
+  <div id="pos2">
+  </div>
+  <div id="tester">
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/WebCore/manual-tests/mask-composite-missing-images.html b/WebCore/manual-tests/mask-composite-missing-images.html
new file mode 100644
index 0000000..ed0dfcd
--- /dev/null
+++ b/WebCore/manual-tests/mask-composite-missing-images.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<style>
+.test {
+    width: 200px;
+    height: 200px;
+    border:10px solid black;
+    background-color:lime;
+    -webkit-mask-image: url(url-not-found), url(url-not-found), url(url-not-found), url(url-not-found), url(url-not-found), url(url-not-found), url(url-not-found), url(url-not-found), url(url-not-found);
+    -webkit-mask-position: top left, top right, bottom left, bottom right, top center, center right, bottom center, center left, center;
+    -webkit-mask-origin: border;
+    -webkit-mask-repeat: no-repeat, no-repeat, no-repeat, no-repeat, repeat-x, repeat-y, repeat-x, repeat-y, repeat;
+    -webkit-mask-composite: copy;
+}
+</style>
+</head>
+<body>
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=26084">WebKit Bug 26084: Bug 26084: Multiple missing images in webkit-mask-image prevent rendering</a></p>
+<div class="test">This text should be visible.</div>
+<p>If the test passes, you should be able to see a lime square with a black border. Inside the border, you should see the text: This text should be visible.</p>
+</body>
+</html>
+
diff --git a/WebCore/manual-tests/optgroup-empty-and-nested.html b/WebCore/manual-tests/optgroup-empty-and-nested.html
new file mode 100644
index 0000000..062996b
--- /dev/null
+++ b/WebCore/manual-tests/optgroup-empty-and-nested.html
@@ -0,0 +1,74 @@
+<html>
+<head>
+  <title>Empty and nested optgroup elements</title>
+</head>
+
+<body>
+
+<select>
+  <!-- A div here is invalid. However, both IE and Firefox will walk into it
+       and enumerate the elements inside. -->
+  <div>
+    <option value="1">Item one</option>
+
+    <!-- this group has no children. We /should/ render it because that matches
+         IE and FireFox. -->
+    <optgroup label="Group one"></optgroup>
+
+    <!-- this group has a text node child. It should render the same as group one. -->
+    <optgroup label="Group two"> </optgroup>
+
+    <!-- for an optgroup without a label, IE will show an empty, unselectable row.
+         Firefox doesn't show it. We /do/ show it because someone might be using
+         it as a spacer. -->
+    <optgroup>
+      <option value="2">Item inside an optgroup without a label</option>
+    </optgroup>
+
+    <!-- for an optgroup with an empty label, IE will show an empty,
+         unselectable row.  Firefox doesn't show it. We /do/ show it because
+         someone might be using it as a spacer. -->
+    <optgroup label="">
+      <option value="3">Item inside an optgroup with an empty label</option>
+    </optgroup>
+
+    <div>
+      <option value="4"></option>
+      <optgroup label="Group three">
+        <option value="5">Item two</option>
+        <!-- nested groups are disallowed by the spec, but IE and Firefox will
+             flatten the tree. We should match them. -->
+        <optgroup label="Nested group 1"></optgroup>
+        <optgroup label="Nested group 2">
+          <optgroup label="Nested group 3">
+              <option value="6">Item three</option>
+          </optgroup>
+        </optgroup>
+      </optgroup>
+    </div>
+    <option value="7">Item four</option>
+  </div>
+</select>
+
+<p>Click on the select element above. When it drops down you should see the following items in the list:</p>
+
+<ul>
+  <li>Item one</li>
+  <li><b>Group one</b></li>
+  <li><b>Group two</b></li>
+  <li><i>(unselectable, empty row)</i></li>
+  <li>Item inside an optgroup without a label</li>
+  <li><i>(unselectable, empty row)</i></li>
+  <li>Item inside an optgroup with an empty label</li>
+  <li><i>(selectable, empty row)</i></li>
+  <li><b>Group three</b></li>
+  <li>Item two</li>
+  <li><b>Nested group 1</b></li>
+  <li><b>Nested group 2</b></li>
+  <li><b>Nested group 3</b></li>
+  <li>Item three</li>
+  <li>Item four</li>
+</ul>
+
+</body>
+</html>
diff --git a/WebCore/manual-tests/preload-scanner-entities.html b/WebCore/manual-tests/preload-scanner-entities.html
new file mode 100644
index 0000000..21446ae
--- /dev/null
+++ b/WebCore/manual-tests/preload-scanner-entities.html
@@ -0,0 +1,7 @@
+<script src="does_not_exist_here_just_to_trigger_preload_scanner.js" type="text/javascript"></script>
+<link href="non_existent_stylesheet1&ab-" rel="stylesheet">
+<link href="non_existent_stylesheet2&#xY" rel="stylesheet">
+<link href="non_existent_stylesheet3&#XY" rel="stylesheet">
+<p><a href="rdar://problem/6904095">rdar://problem/6904095</a> Query parameters are sometimes incorrect in URL</p>
+<p>Check with the web inspector that the page tried to load 3 stylesheet resources (and not more).</p>
+
diff --git a/WebCore/manual-tests/print-with-height-transition-in-screen-stylesheet.html b/WebCore/manual-tests/print-with-height-transition-in-screen-stylesheet.html
new file mode 100644
index 0000000..2186c18
--- /dev/null
+++ b/WebCore/manual-tests/print-with-height-transition-in-screen-stylesheet.html
@@ -0,0 +1,26 @@
+<head>
+<style media="screen">
+.outer_slide {
+    overflow: hidden;
+    height: 0;
+    -webkit-transition: height 100s ease-in-out;
+}
+</style>
+</head>
+  <body>
+<div>To run this test, Print and then push the Preview button (on Mac OS X). The symptom of the bug is a layout with overlapping text or missing sections.
+If the test passes you should be able to see eight different lines below A, A1, A2, A3, B, B1, C, and C1. If it fails you might see as few as four lines.</div>
+<div><br></div>
+<div>A: When printing you should be able to see all three paragraphs below.</div>
+<div class='outer_slide'>
+    <div>A1: This is a long paragraph which helps us see the mess you can get with long ones.<br>
+        A2: This is a long paragraph which helps us see the mess you can get with long ones.<br>
+        A3: This is a long paragraph which helps us see the mess you can get with long ones.<br>
+</div></div>
+<div>B: When printing you should be able to see one line below.</div>
+<div class='outer_slide'><div>B1: This is a long paragraph which helps us see the mess you can get with long ones.</div></div>
+<div>C: When printing you should be able to see one line below</div>
+<div class='outer_slide'><div>C1: This is a long paragraph which helps us see the mess you can get with long ones.</div></div>
+</div>
+</body>
+</html>
diff --git a/WebCore/manual-tests/qt/plugin-iframe.html b/WebCore/manual-tests/qt/plugin-iframe.html
new file mode 100644
index 0000000..ee838ba
--- /dev/null
+++ b/WebCore/manual-tests/qt/plugin-iframe.html
@@ -0,0 +1,26 @@
+<html>
+    <head>
+        <style>
+            html, body {
+                background-color: blue;
+                color: white;
+            }
+            #spacer {
+                width: 100%;
+                height: 1000px;
+                background-color: yellow;
+            }
+        </style>
+        </script>
+    </head>
+    <body>
+        <p>
+            Scroll the view, ensure that plugin scrolls in sync with the view.
+        </p>
+
+        <iframe src="plugin-sibling-frame-include.html" width="200" height="200" 
+            frameborder="0" scrolling="auto" name="myInlineFrame"></iframe>
+        <div id="spacer"><p>content</p></div>
+    </body>
+</html>
+
diff --git a/WebCore/manual-tests/qt/plugin-sibling-frame-include.html b/WebCore/manual-tests/qt/plugin-sibling-frame-include.html
new file mode 100644
index 0000000..ca509e9
--- /dev/null
+++ b/WebCore/manual-tests/qt/plugin-sibling-frame-include.html
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+<title>ClickToFlash Test File</title>
+</head>
+
+<body bgcolor="#000">
+
+    <embed src="http://www.youtube.com/v/loXfcsXRB-w&#038;hl=en&#038;fs=1" 
+            type="application/x-shockwave-flash">
+    </embed>
+    
+</body>
+
+</html>
diff --git a/WebCore/manual-tests/qt/plugin-sibling-frame.html b/WebCore/manual-tests/qt/plugin-sibling-frame.html
new file mode 100644
index 0000000..74e339a
--- /dev/null
+++ b/WebCore/manual-tests/qt/plugin-sibling-frame.html
@@ -0,0 +1,6 @@
+<html>
+<head><title>Move the frame to hide the plugin fully</title></head>
+<frameset cols="25%,50%,25%">
+  <frame src="plugin-sibling-frame-include.html">
+</frameset>
+</html>
diff --git a/WebCore/manual-tests/right-click-crash.html b/WebCore/manual-tests/right-click-crash.html
new file mode 100644
index 0000000..75e2ac2
--- /dev/null
+++ b/WebCore/manual-tests/right-click-crash.html
@@ -0,0 +1,6 @@
+<html><head><script>
+document.onmousedown = function () { alert("Dismiss this and quickly right click again."); };
+</script></head><body>This page is intended to test crashes caused by repeated right clicks.
+To try to reproduce the bug, right click and then dismiss the dialog by hitting Return.
+Do it over and over again in quick succession. The test passes if you don't see a crash.
+See <a href="https://bugs.webkit.org/show_bug.cgi?id=24049">WebKit bug 24049</a> for details.</body></html>
diff --git a/WebCore/manual-tests/select-narrow-width.html b/WebCore/manual-tests/select-narrow-width.html
new file mode 100644
index 0000000..60d2711
--- /dev/null
+++ b/WebCore/manual-tests/select-narrow-width.html
@@ -0,0 +1,48 @@
+<html>
+<head>
+Select narrow width manual test.
+</head>
+
+<body>
+See bug:<a href="https://bugs.webkit.org/show_bug.cgi?id=25904">25904</a>.
+<p>
+This test ensures that items in a select control can be selected. There
+was a bug in Mac Chromium where select controls did not initialize their
+widths properly, and while a click on the control would display the popup,
+subsequent clicks on menu items were disregarded.
+<p>
+The bug was most easily reproduced with select controls containing many
+(more than 20) items that had narrow widths.
+<br>
+
+<select id="selectId">
+  <option>a</option>
+  <option>b</option>
+  <option>c</option>
+  <option>d</option>
+  <option>e</option>
+  <option>f</option>
+  <option>g</option>
+  <option>h</option>
+  <option>i</option>
+  <option>j</option>
+  <option>k</option>
+  <option>l</option>
+  <option>m</option>
+  <option>n</option>
+  <option>o</option>
+  <option>p</option>
+  <option>q</option>
+  <option>r</option>
+  <option>s</option>
+  <option>t</option>
+  <option>u</option>
+  <option>v</option>
+  <option>w</option>
+  <option>x</option>
+  <option>y</option>
+  <option>z</option>
+</select>
+
+</body>
+</html>
diff --git a/WebCore/manual-tests/select-option-in-onload.html b/WebCore/manual-tests/select-option-in-onload.html
new file mode 100644
index 0000000..3a4d8a6
--- /dev/null
+++ b/WebCore/manual-tests/select-option-in-onload.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" /> 
+<html> 
+    <head> 
+    <title>Programmatically selected popup item not shown</title>
+    <script type="text/javascript"> 
+        function testMyPopup() {
+            var myPopup = document.getElementById('testPopup');
+            for (var i = 0; i < myPopup.options.length; i++) {
+                if (myPopup.options[i].value == "2")
+                    myPopup.options[i].selected = true;
+            }
+        }
+    </script> 
+    </head> 
+    <!--body-->
+    <body onload="testMyPopup();">
+        <p>The popup below has the item "FAIL" selected by default in the html, but a javascript function
+        triggered from the body's onload changed it to "PASS" (assuming you saw an alert telling you so).</p> 
+        <p>Problem: In old versions of WebKit the change was not visible until you click on the popup.</p>
+        <form action="get">
+            <select id="testPopup">
+                <option value="0"></option>
+                <option value="1">One</option>
+                <option value="2">PASS</option>
+                <option value="3" selected="selected">FAIL</option>
+            </select>
+        </form>
+    </body>
+</html>
diff --git a/WebCore/page/BarInfo.cpp b/WebCore/page/BarInfo.cpp
index 153aee0..f6a1210 100644
--- a/WebCore/page/BarInfo.cpp
+++ b/WebCore/page/BarInfo.cpp
@@ -41,11 +41,21 @@
 {
 }
 
+Frame* BarInfo::frame() const
+{
+    return m_frame;
+}
+
 void BarInfo::disconnectFrame()
 {
     m_frame = 0;
 }
 
+BarInfo::Type BarInfo::type() const
+{
+    return m_type;
+}
+
 bool BarInfo::visible() const
 {
     if (!m_frame)
diff --git a/WebCore/page/BarInfo.h b/WebCore/page/BarInfo.h
index 4cbbcfc..376b8fc 100644
--- a/WebCore/page/BarInfo.h
+++ b/WebCore/page/BarInfo.h
@@ -42,8 +42,11 @@
 
         static PassRefPtr<BarInfo> create(Frame* frame, Type type) { return adoptRef(new BarInfo(frame, type)); }
 
+        Frame* frame() const;
         void disconnectFrame();
 
+        Type type() const;
+
         bool visible() const;
 
     private:
diff --git a/WebCore/page/Chrome.cpp b/WebCore/page/Chrome.cpp
index b37ebc4..86de82e 100644
--- a/WebCore/page/Chrome.cpp
+++ b/WebCore/page/Chrome.cpp
@@ -35,7 +35,7 @@
 #include "HitTestResult.h"
 #include "InspectorController.h"
 #include "Page.h"
-#include "PageGroup.h"
+#include "PageGroupLoadDeferrer.h"
 #include "ResourceHandle.h"
 #include "ScriptController.h"
 #include "SecurityOrigin.h"
@@ -54,14 +54,6 @@
 using namespace HTMLNames;
 using namespace std;
 
-class PageGroupLoadDeferrer : Noncopyable {
-public:
-    PageGroupLoadDeferrer(Page*, bool deferSelf);
-    ~PageGroupLoadDeferrer();
-private:
-    Vector<RefPtr<Frame>, 16> m_deferredFrames;
-};
-
 Chrome::Chrome(Page* page, ChromeClient* client)
     : m_page(page)
     , m_client(client)
@@ -152,13 +144,14 @@
 Page* Chrome::createWindow(Frame* frame, const FrameLoadRequest& request, const WindowFeatures& features) const
 {
     Page* newPage = m_client->createWindow(frame, request, features);
+
 #if ENABLE(DOM_STORAGE)
-    
     if (newPage) {
         if (SessionStorage* oldSessionStorage = m_page->sessionStorage(false))
-                newPage->setSessionStorage(oldSessionStorage->copy(newPage));
+            newPage->setSessionStorage(oldSessionStorage->copy(newPage));
     }
 #endif
+
     return newPage;
 }
 
@@ -378,16 +371,6 @@
     m_client->print(frame);
 }
 
-void Chrome::disableSuddenTermination()
-{
-    m_client->disableSuddenTermination();
-}
-
-void Chrome::enableSuddenTermination()
-{
-    m_client->enableSuddenTermination();
-}
-
 void Chrome::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
 {
     // Defer loads in case the client method runs a new event loop that would 
@@ -402,6 +385,12 @@
 {
     m_client->runOpenPanel(frame, fileChooser);
 }
+
+bool Chrome::setCursor(PlatformCursorHandle cursor)
+{
+    return m_client->setCursor(cursor);
+}
+
 // --------
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -434,14 +423,6 @@
     return String(); 
 }
 
-void ChromeClient::disableSuddenTermination()
-{
-}
-
-void ChromeClient::enableSuddenTermination()
-{
-}
-
 bool ChromeClient::paintCustomScrollbar(GraphicsContext*, const FloatRect&, ScrollbarControlSize, 
                                         ScrollbarControlState, ScrollbarPart, bool,
                                         float, float, ScrollbarControlPartMask)
@@ -454,45 +435,5 @@
     return false;
 }
 
-// --------
-
-PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
-{
-    const HashSet<Page*>& pages = page->group().pages();
-
-    HashSet<Page*>::const_iterator end = pages.end();
-    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
-        Page* otherPage = *it;
-        if ((deferSelf || otherPage != page)) {
-            if (!otherPage->defersLoading())
-                m_deferredFrames.append(otherPage->mainFrame());
-
-#if !PLATFORM(MAC)
-            for (Frame* frame = otherPage->mainFrame(); frame; frame = frame->tree()->traverseNext())
-                frame->document()->suspendActiveDOMObjects();
-#endif
-        }
-    }
-
-    size_t count = m_deferredFrames.size();
-    for (size_t i = 0; i < count; ++i)
-        if (Page* page = m_deferredFrames[i]->page())
-            page->setDefersLoading(true);
-}
-
-PageGroupLoadDeferrer::~PageGroupLoadDeferrer()
-{
-    for (size_t i = 0; i < m_deferredFrames.size(); ++i) {
-        if (Page* page = m_deferredFrames[i]->page()) {
-            page->setDefersLoading(false);
-
-#if !PLATFORM(MAC)
-            for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
-                frame->document()->resumeActiveDOMObjects();
-#endif
-        }
-    }
-}
-
 
 } // namespace WebCore
diff --git a/WebCore/page/Chrome.h b/WebCore/page/Chrome.h
index ab0b42f..c26e450 100644
--- a/WebCore/page/Chrome.h
+++ b/WebCore/page/Chrome.h
@@ -20,6 +20,7 @@
 #ifndef Chrome_h
 #define Chrome_h
 
+#include "Cursor.h"
 #include "FileChooser.h"
 #include "FocusDirection.h"
 #include "HostWindow.h"
@@ -117,13 +118,12 @@
 
         void print(Frame*);
 
-        void enableSuddenTermination();
-        void disableSuddenTermination();
-
         void requestGeolocationPermissionForFrame(Frame*, Geolocation*);
 
         void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
 
+        bool setCursor(PlatformCursorHandle);
+
 #if PLATFORM(MAC)
         void focusNSView(NSView*);
 #endif
diff --git a/WebCore/page/ChromeClient.h b/WebCore/page/ChromeClient.h
index 7b0fa76..e155754 100644
--- a/WebCore/page/ChromeClient.h
+++ b/WebCore/page/ChromeClient.h
@@ -20,11 +20,15 @@
 #ifndef ChromeClient_h
 #define ChromeClient_h
 
-#include "GraphicsContext.h"
+#include "Console.h"
+#include "Cursor.h"
 #include "FocusDirection.h"
-#include "ScrollTypes.h"
+#include "GraphicsContext.h"
+#include "HTMLParserQuirks.h"
 #include "HostWindow.h"
+#include "ScrollTypes.h"
 #include <wtf/Forward.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 #if PLATFORM(MAC)
@@ -43,6 +47,7 @@
     class FloatRect;
     class Frame;
     class Geolocation;
+    class HTMLParserQuirks;
     class HitTestResult;
     class IntRect;
     class Node;
@@ -98,7 +103,7 @@
 
         virtual void setResizable(bool) = 0;
         
-        virtual void addMessageToConsole(const String& message, unsigned int lineNumber, const String& sourceID) = 0;
+        virtual void addMessageToConsole(MessageSource, MessageLevel, const String& message, unsigned int lineNumber, const String& sourceID) = 0;
 
         virtual bool canRunBeforeUnloadConfirmPanel() = 0;
         virtual bool runBeforeUnloadConfirmPanel(const String& message, Frame* frame) = 0;
@@ -121,7 +126,7 @@
         virtual IntRect windowToScreen(const IntRect&) const = 0;
         virtual PlatformWidget platformWindow() const = 0;
         virtual void contentsSizeChanged(Frame*, const IntSize&) const = 0;
-        virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const {} // Platforms other than Mac can implement this if it ever becomes necessary for them to do so.
+        virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const = 0; // Currently only Mac has a non empty implementation.
         // End methods used by HostWindow.
 
         virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags) = 0;
@@ -146,9 +151,6 @@
             
         virtual bool shouldReplaceWithGeneratedFileForUpload(const String& path, String& generatedFilename);
         virtual String generateReplacementFile(const String& path);
-        
-        virtual void enableSuddenTermination();
-        virtual void disableSuddenTermination();
 
         virtual bool paintCustomScrollbar(GraphicsContext*, const FloatRect&, ScrollbarControlSize, 
                                           ScrollbarControlState, ScrollbarPart pressedPart, bool vertical,
@@ -157,20 +159,27 @@
 
         // This is an asynchronous call. The ChromeClient can display UI asking the user for permission
         // to use Geolococation. The ChromeClient must call Geolocation::setShouldClearCache() appropriately.
-        virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) { }
+        virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) = 0;
             
         virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) = 0;
 
+        virtual bool setCursor(PlatformCursorHandle) = 0;
+
         // Notification that the given form element has changed. This function
         // will be called frequently, so handling should be very fast.
         virtual void formStateDidChange(const Node*) = 0;
 
+        virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() = 0;
+
 #if USE(ACCELERATED_COMPOSITING)
         // Pass 0 as the GraphicsLayer to detatch the root layer.
-        virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*) { }
+        virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*) = 0;
         // Sets a flag to specify that the next time content is drawn to the window,
         // the changes appear on the screen in synchrony with updates to GraphicsLayers.
-        virtual void setNeedsOneShotDrawingSynchronization() { }
+        virtual void setNeedsOneShotDrawingSynchronization() = 0;
+        // Sets a flag to specify that the view needs to be updated, so we need
+        // to do an eager layout before the drawing.
+        virtual void scheduleViewUpdate() = 0;
 #endif
 
 #if PLATFORM(MAC)
diff --git a/WebCore/page/Console.cpp b/WebCore/page/Console.cpp
index 33128ea..99a0fc8 100644
--- a/WebCore/page/Console.cpp
+++ b/WebCore/page/Console.cpp
@@ -39,7 +39,7 @@
 #include "PageGroup.h"
 #include "PlatformString.h"
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 #include <profiler/Profiler.h>
 #endif
 
@@ -53,6 +53,11 @@
 {
 }
 
+Frame* Console::frame() const
+{
+    return m_frame;
+}
+
 void Console::disconnectFrame()
 {
     m_frame = 0;
@@ -151,7 +156,7 @@
         return;
 
     if (source == JSMessageSource || source == WMLMessageSource)
-        page->chrome()->client()->addMessageToConsole(message, lineNumber, sourceURL);
+        page->chrome()->client()->addMessageToConsole(source, level, message, lineNumber, sourceURL);
 
     page->inspectorController()->addMessageToConsole(source, level, message, lineNumber, sourceURL);
 
@@ -176,7 +181,7 @@
 
     String message;
     if (getFirstArgumentAsString(callStack->state(), lastCaller, message))
-        page->chrome()->client()->addMessageToConsole(message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
+        page->chrome()->client()->addMessageToConsole(JSMessageSource, level, message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
 
     page->inspectorController()->addMessageToConsole(JSMessageSource, level, callStack);
 
@@ -264,7 +269,7 @@
     page->inspectorController()->count(title, lastCaller.lineNumber(), lastCaller.sourceURL().string());
 }
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 
 void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
 {
diff --git a/WebCore/page/Console.h b/WebCore/page/Console.h
index 2a24a2a..79396ea 100644
--- a/WebCore/page/Console.h
+++ b/WebCore/page/Console.h
@@ -31,7 +31,7 @@
 
 #include "PlatformString.h"
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 #include <profiler/Profile.h>
 #endif
 
@@ -40,7 +40,7 @@
 
 namespace WebCore {
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
     typedef Vector<RefPtr<JSC::Profile> > ProfilesArray;
 #endif
 
@@ -75,6 +75,7 @@
     public:
         static PassRefPtr<Console> create(Frame* frame) { return adoptRef(new Console(frame)); }
 
+        Frame* frame() const;
         void disconnectFrame();
 
         void addMessage(MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
@@ -89,7 +90,7 @@
         void trace(ScriptCallStack*);
         void assertCondition(bool condition, ScriptCallStack*);
         void count(ScriptCallStack*);
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         void profile(const JSC::UString&, ScriptCallStack*);
         void profileEnd(const JSC::UString&, ScriptCallStack*);
 #endif
@@ -101,7 +102,7 @@
         static bool shouldPrintExceptions();
         static void setShouldPrintExceptions(bool);
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         const ProfilesArray& profiles() const { return m_profiles; }
 #endif
 
@@ -112,7 +113,7 @@
         Console(Frame*);
 
         Frame* m_frame;
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         ProfilesArray m_profiles;
 #endif
     };
diff --git a/WebCore/page/Console.idl b/WebCore/page/Console.idl
index fb7688d..4803508 100644
--- a/WebCore/page/Console.idl
+++ b/WebCore/page/Console.idl
@@ -30,7 +30,7 @@
 
     interface Console {
 
-#if !defined(V8_BINDING)
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         readonly attribute [CustomGetter] Array profiles;
 #endif
     
@@ -45,7 +45,7 @@
         [CustomArgumentHandling, ImplementationFunction=assertCondition] void assert(in boolean condition);
         [CustomArgumentHandling] void count();
 
-#if !defined(V8_BINDING)
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         [CustomArgumentHandling] void profile(in [ConvertUndefinedOrNullToNullString] DOMString title);
         [CustomArgumentHandling] void profileEnd(in [ConvertUndefinedOrNullToNullString] DOMString title);
 #endif
diff --git a/WebCore/page/ContextMenuController.cpp b/WebCore/page/ContextMenuController.cpp
index 522e939..58e6519 100644
--- a/WebCore/page/ContextMenuController.cpp
+++ b/WebCore/page/ContextMenuController.cpp
@@ -37,11 +37,13 @@
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
+#include "FormState.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoadRequest.h"
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
+#include "HTMLFormElement.h"
 #include "InspectorController.h"
 #include "MouseEvent.h"
 #include "Node.h"
@@ -212,10 +214,10 @@
             m_client->lookUpInDictionary(frame);
             break;
         case ContextMenuItemTagOpenLink:
-            if (Frame* targetFrame = result.targetFrame())
-                targetFrame->loader()->loadFrameRequestWithFormAndValues(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), 
-                    frame->loader()->outgoingReferrer())), false, false, 0, 0, HashMap<String, String>());
-            else
+            if (Frame* targetFrame = result.targetFrame()) {
+                targetFrame->loader()->loadFrameRequest(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), 
+                    frame->loader()->outgoingReferrer())), false, false, 0, 0);
+            } else
                 openNewWindow(result.absoluteLinkURL(), frame);
             break;
         case ContextMenuItemTagBold:
@@ -293,6 +295,41 @@
             frame->editor()->showColorPanel();
             break;
 #endif
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+        case ContextMenuItemTagMakeUpperCase:
+            frame->editor()->uppercaseWord();
+            break;
+        case ContextMenuItemTagMakeLowerCase:
+            frame->editor()->lowercaseWord();
+            break;
+        case ContextMenuItemTagCapitalize:
+            frame->editor()->capitalizeWord();
+            break;
+        case ContextMenuItemTagShowSubstitutions:
+            frame->editor()->showSubstitutionsPanel();
+            break;
+        case ContextMenuItemTagSmartCopyPaste:
+            frame->editor()->toggleSmartInsertDelete();
+            break;
+        case ContextMenuItemTagSmartQuotes:
+            frame->editor()->toggleAutomaticQuoteSubstitution();
+            break;
+        case ContextMenuItemTagSmartDashes:
+            frame->editor()->toggleAutomaticDashSubstitution();
+            break;
+        case ContextMenuItemTagSmartLinks:
+            frame->editor()->toggleAutomaticLinkDetection();
+            break;
+        case ContextMenuItemTagTextReplacement:
+            frame->editor()->toggleAutomaticTextReplacement();
+            break;
+        case ContextMenuItemTagCorrectSpellingAutomatically:
+            frame->editor()->toggleAutomaticSpellingCorrection();
+            break;
+        case ContextMenuItemTagChangeBack:
+            frame->editor()->changeBackToReplacedString(result.replacedString());
+            break;
+#endif
         case ContextMenuItemTagInspectElement:
             if (Page* page = frame->page())
                 page->inspectorController()->inspect(result.innerNonSharedNode());
diff --git a/WebCore/page/Coordinates.h b/WebCore/page/Coordinates.h
index 743b04d..acb5dd0 100644
--- a/WebCore/page/Coordinates.h
+++ b/WebCore/page/Coordinates.h
@@ -36,7 +36,7 @@
 
 class Coordinates : public RefCounted<Coordinates> {
 public:
-    static PassRefPtr<Coordinates> create(double latitude, double longitude, double altitude, double accuracy, double altitudeAccuracy, double heading, double speed) { return adoptRef(new Coordinates(latitude, longitude, altitude, accuracy, altitudeAccuracy, heading, speed)); }
+    static PassRefPtr<Coordinates> create(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed) { return adoptRef(new Coordinates(latitude, longitude, providesAltitude, altitude, accuracy, providesAltitudeAccuracy, altitudeAccuracy, providesHeading, heading, providesSpeed, speed)); }
     
     double latitude() const { return m_latitude; }
     double longitude() const { return m_longitude; }
@@ -46,10 +46,15 @@
     double heading() const { return m_heading; }
     double speed() const { return m_speed; }
 
+    bool canProvideAltitude() const { return m_canProvideAltitude; }
+    bool canProvideAltitudeAccuracy() const { return m_canProvideAltitudeAccuracy; }
+    bool canProvideHeading() const { return m_canProvideHeading; }
+    bool canProvideSpeed() const { return m_canProvideSpeed; }
+    
     String toString() const;
 
 private:
-    Coordinates(double latitude, double longitude, double altitude, double accuracy, double altitudeAccuracy, double heading, double speed)
+    Coordinates(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed)
         : m_latitude(latitude)
         , m_longitude(longitude)
         , m_altitude(altitude)
@@ -57,6 +62,10 @@
         , m_altitudeAccuracy(altitudeAccuracy)
         , m_heading(heading)
         , m_speed(speed)
+        , m_canProvideAltitude(providesAltitude)
+        , m_canProvideAltitudeAccuracy(providesAltitudeAccuracy)
+        , m_canProvideHeading(providesHeading)
+        , m_canProvideSpeed(providesSpeed)
     {
     }
 
@@ -67,6 +76,11 @@
     double m_altitudeAccuracy;
     double m_heading;
     double m_speed;
+    
+    bool m_canProvideAltitude;
+    bool m_canProvideAltitudeAccuracy;
+    bool m_canProvideHeading;
+    bool m_canProvideSpeed;
 };
     
 } // namespace WebCore
diff --git a/WebCore/page/Coordinates.idl b/WebCore/page/Coordinates.idl
index 6318212..f6c82b5 100644
--- a/WebCore/page/Coordinates.idl
+++ b/WebCore/page/Coordinates.idl
@@ -28,13 +28,13 @@
     interface Coordinates {
         readonly attribute double latitude;
         readonly attribute double longitude;
-        readonly attribute double altitude;
+        readonly attribute [Custom] double altitude;
         readonly attribute double accuracy;
-        readonly attribute double altitudeAccuracy;
-        readonly attribute double heading;
-        readonly attribute double speed;
+        readonly attribute [Custom] double altitudeAccuracy;
+        readonly attribute [Custom] double heading;
+        readonly attribute [Custom] double speed;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
     };
diff --git a/WebCore/page/DOMSelection.cpp b/WebCore/page/DOMSelection.cpp
index 86fe911..3b54f02 100644
--- a/WebCore/page/DOMSelection.cpp
+++ b/WebCore/page/DOMSelection.cpp
@@ -95,7 +95,7 @@
 {
     if (!m_frame)
         return 0;
-    return anchorPosition(visibleSelection()).m_offset;
+    return anchorPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
 Node* DOMSelection::focusNode() const
@@ -109,7 +109,7 @@
 {
     if (!m_frame)
         return 0;
-    return focusPosition(visibleSelection()).m_offset;
+    return focusPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
 Node* DOMSelection::baseNode() const
@@ -123,7 +123,7 @@
 {
     if (!m_frame)
         return 0;
-    return basePosition(visibleSelection()).m_offset;
+    return basePosition(visibleSelection()).deprecatedEditingOffset();
 }
 
 
@@ -138,7 +138,7 @@
 {
     if (!m_frame)
         return 0;
-    return extentPosition(visibleSelection()).m_offset;
+    return extentPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
 bool DOMSelection::isCollapsed() const
diff --git a/WebCore/page/DOMSelection.idl b/WebCore/page/DOMSelection.idl
index a54f9e4..be6c2b4 100644
--- a/WebCore/page/DOMSelection.idl
+++ b/WebCore/page/DOMSelection.idl
@@ -58,7 +58,7 @@
         void removeAllRanges();
         void addRange(in Range range);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
 
diff --git a/WebCore/page/DOMWindow.cpp b/WebCore/page/DOMWindow.cpp
index f6fde05..b4f3dee 100644
--- a/WebCore/page/DOMWindow.cpp
+++ b/WebCore/page/DOMWindow.cpp
@@ -27,6 +27,7 @@
 #include "DOMWindow.h"
 
 #include "BarInfo.h"
+#include "BeforeUnloadEvent.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSRuleList.h"
 #include "CSSStyleSelector.h"
@@ -34,8 +35,10 @@
 #include "Chrome.h"
 #include "Console.h"
 #include "DOMSelection.h"
+#include "DOMTimer.h"
 #include "Document.h"
 #include "Element.h"
+#include "EventException.h"
 #include "EventListener.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
@@ -57,6 +60,7 @@
 #include "Screen.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
+#include "SuddenTermination.h"
 #include "WebKitPoint.h"
 #include <algorithm>
 #include <wtf/MathExtras.h>
@@ -104,6 +108,152 @@
     RefPtr<SecurityOrigin> m_targetOrigin;
 };
 
+typedef HashMap<DOMWindow*, RegisteredEventListenerVector*> DOMWindowRegisteredEventListenerMap;
+
+static DOMWindowRegisteredEventListenerMap& pendingUnloadEventListenerMap()
+{
+    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
+    return eventListenerMap;
+}
+
+static DOMWindowRegisteredEventListenerMap& pendingBeforeUnloadEventListenerMap()
+{
+    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
+    return eventListenerMap;
+}
+
+static bool allowsPendingBeforeUnloadListeners(DOMWindow* window)
+{
+    ASSERT_ARG(window, window);
+    Frame* frame = window->frame();
+    Page* page = frame->page();
+    return page && frame == page->mainFrame();
+}
+
+static void addPendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
+{
+    ASSERT_ARG(window, window);
+    ASSERT_ARG(listener, listener);
+
+    if (map.isEmpty())
+        disableSuddenTermination();
+
+    pair<DOMWindowRegisteredEventListenerMap::iterator, bool> result = map.add(window, 0);
+    if (result.second)
+        result.first->second = new RegisteredEventListenerVector;
+    result.first->second->append(listener);
+}
+
+static void removePendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
+{
+    ASSERT_ARG(window, window);
+    ASSERT_ARG(listener, listener);
+
+    DOMWindowRegisteredEventListenerMap::iterator it = map.find(window);
+    ASSERT(it != map.end());
+
+    RegisteredEventListenerVector* listeners = it->second;
+    size_t index = listeners->find(listener);
+    ASSERT(index != WTF::notFound);
+    listeners->remove(index);
+
+    if (!listeners->isEmpty())
+        return;
+
+    map.remove(it);
+    delete listeners;
+
+    if (map.isEmpty())
+        enableSuddenTermination();
+}
+
+static void removePendingEventListeners(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window)
+{
+    ASSERT_ARG(window, window);
+
+    RegisteredEventListenerVector* listeners = map.take(window);
+    if (!listeners)
+        return;
+
+    delete listeners;
+
+    if (map.isEmpty())
+        enableSuddenTermination();
+}
+
+bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
+{
+    DOMWindowRegisteredEventListenerMap& map = pendingBeforeUnloadEventListenerMap();
+    if (map.isEmpty())
+        return true;
+
+    static bool alreadyDispatched = false;
+    ASSERT(!alreadyDispatched);
+    if (alreadyDispatched)
+        return true;
+
+    Vector<RefPtr<DOMWindow> > windows;
+    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
+    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+        windows.append(it->first);
+
+    size_t size = windows.size();
+    for (size_t i = 0; i < size; ++i) {
+        DOMWindow* window = windows[i].get();
+        RegisteredEventListenerVector* listeners = map.get(window);
+        if (!listeners)
+            continue;
+
+        RegisteredEventListenerVector listenersCopy = *listeners;
+        Frame* frame = window->frame();
+        if (!frame->shouldClose(&listenersCopy))
+            return false;
+    }
+
+    enableSuddenTermination();
+
+    alreadyDispatched = true;
+
+    return true;
+}
+
+unsigned DOMWindow::pendingUnloadEventListeners() const
+{
+    RegisteredEventListenerVector* listeners = pendingUnloadEventListenerMap().get(const_cast<DOMWindow*>(this));
+    return listeners ? listeners->size() : 0;
+}
+
+void DOMWindow::dispatchAllPendingUnloadEvents()
+{
+    DOMWindowRegisteredEventListenerMap& map = pendingUnloadEventListenerMap();
+    if (map.isEmpty())
+        return;
+
+    static bool alreadyDispatched = false;
+    ASSERT(!alreadyDispatched);
+    if (alreadyDispatched)
+        return;
+
+    Vector<RefPtr<DOMWindow> > windows;
+    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
+    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+        windows.append(it->first);
+
+    size_t size = windows.size();
+    for (size_t i = 0; i < size; ++i) {
+        DOMWindow* window = windows[i].get();
+        RegisteredEventListenerVector* listeners = map.get(window);
+        if (!listeners)
+            continue;
+        RegisteredEventListenerVector listenersCopy = *listeners;
+        window->dispatchUnloadEvent(&listenersCopy);
+    }
+
+    enableSuddenTermination();
+
+    alreadyDispatched = true;
+}
+
 // This function:
 // 1) Validates the pending changes are not changing to NaN
 // 2) Constrains the window rect to no smaller than 100 in each dimension and no
@@ -144,6 +294,62 @@
     window.setY(max(screen.y(), min(window.y(), screen.bottom() - window.height())));
 }
 
+void DOMWindow::parseModalDialogFeatures(const String& featuresArg, HashMap<String, String>& map)
+{
+    Vector<String> features;
+    featuresArg.split(';', features);
+    Vector<String>::const_iterator end = features.end();
+    for (Vector<String>::const_iterator it = features.begin(); it != end; ++it) {
+        String s = *it;
+        int pos = s.find('=');
+        int colonPos = s.find(':');
+        if (pos >= 0 && colonPos >= 0)
+            continue; // ignore any strings that have both = and :
+        if (pos < 0)
+            pos = colonPos;
+        if (pos < 0) {
+            // null string for value means key without value
+            map.set(s.stripWhiteSpace().lower(), String());
+        } else {
+            String key = s.left(pos).stripWhiteSpace().lower();
+            String val = s.substring(pos + 1).stripWhiteSpace().lower();
+            int spacePos = val.find(' ');
+            if (spacePos != -1)
+                val = val.left(spacePos);
+            map.set(key, val);
+        }
+    }
+}
+
+bool DOMWindow::allowPopUp(Frame* activeFrame)
+{
+    ASSERT(activeFrame);
+    if (activeFrame->script()->processingUserGesture())
+        return true;
+    Settings* settings = activeFrame->settings();
+    return settings && settings->javaScriptCanOpenWindowsAutomatically();
+}
+
+bool DOMWindow::canShowModalDialog(const Frame* frame)
+{
+    if (!frame)
+        return false;
+    Page* page = frame->page();
+    if (!page)
+        return false;
+    return page->chrome()->canRunModal();
+}
+
+bool DOMWindow::canShowModalDialogNow(const Frame* frame)
+{
+    if (!frame)
+        return false;
+    Page* page = frame->page();
+    if (!page)
+        return false;
+    return page->chrome()->canRunModalNow();
+}
+
 DOMWindow::DOMWindow(Frame* frame)
     : m_frame(frame)
 {
@@ -153,6 +359,14 @@
 {
     if (m_frame)
         m_frame->clearFormerDOMWindow(this);
+
+    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
+    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
+}
+
+ScriptExecutionContext* DOMWindow::scriptExecutionContext() const
+{
+    return document();
 }
 
 void DOMWindow::disconnectFrame()
@@ -335,6 +549,9 @@
 
 Storage* DOMWindow::localStorage() const
 {
+    if (m_localStorage)
+        return m_localStorage.get();
+    
     Document* document = this->document();
     if (!document)
         return 0;
@@ -414,7 +631,8 @@
     if (messagePort)
         messagePort->attachToContext(document());
 
-    document()->dispatchWindowEvent(timer->event());
+    ExceptionCode ec = 0;
+    dispatchEvent(timer->event(), ec);
 }
 
 DOMSelection* DOMWindow::getSelection()
@@ -497,7 +715,7 @@
     if (!m_frame)
         return;
 
-    m_frame->document()->updateRendering();
+    m_frame->document()->updateStyleIfNeeded();
 
     Page* page = m_frame->page();
     if (!page)
@@ -511,7 +729,7 @@
     if (!m_frame)
         return false;
 
-    m_frame->document()->updateRendering();
+    m_frame->document()->updateStyleIfNeeded();
 
     Page* page = m_frame->page();
     if (!page)
@@ -525,7 +743,7 @@
     if (!m_frame)
         return String();
 
-    m_frame->document()->updateRendering();
+    m_frame->document()->updateStyleIfNeeded();
 
     Page* page = m_frame->page();
     if (!page)
@@ -766,9 +984,15 @@
 
 Document* DOMWindow::document() const
 {
+    // FIXME: This function shouldn't need a frame to work.
     if (!m_frame)
         return 0;
 
+    // The m_frame pointer is not zeroed out when the window is put into b/f cache, so it can hold an unrelated document/window pair.
+    // FIXME: We should always zero out the frame pointer on navigation to avoid accidentally accessing the new frame content.
+    if (m_frame->domWindow() != this)
+        return 0;
+
     ASSERT(m_frame->document());
     return m_frame->document();
 }
@@ -952,351 +1176,873 @@
     page->chrome()->setWindowRect(fr);
 }
 
-inline void DOMWindow::setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener> eventListener)
+int DOMWindow::setTimeout(ScheduledAction* action, int timeout)
 {
-    Document* document = this->document();
-    if (!document)
-        return;
-    document->setWindowInlineEventListenerForType(eventType, eventListener);
+    return DOMTimer::install(scriptExecutionContext(), action, timeout, true);
 }
 
-inline EventListener* DOMWindow::inlineEventListenerForType(const AtomicString& eventType) const
+void DOMWindow::clearTimeout(int timeoutId)
 {
-    Document* document = this->document();
-    if (!document)
-        return 0;
-    return document->windowInlineEventListenerForType(eventType);
+    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
+}
+
+int DOMWindow::setInterval(ScheduledAction* action, int timeout)
+{
+    return DOMTimer::install(scriptExecutionContext(), action, timeout, false);
+}
+
+void DOMWindow::clearInterval(int timeoutId)
+{
+    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
+}
+
+void DOMWindow::handleEvent(Event* event, bool useCapture, RegisteredEventListenerVector* alternateListeners)
+{
+    RegisteredEventListenerVector& listeners = (alternateListeners ? *alternateListeners : m_eventListeners);
+    if (listeners.isEmpty())
+        return;
+
+    // If any HTML event listeners are registered on the window, dispatch them here.
+    RegisteredEventListenerVector listenersCopy = listeners;
+    size_t size = listenersCopy.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *listenersCopy[i];
+        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
+            r.listener()->handleEvent(event, true);
+    }
+}
+
+void DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+{
+    // Remove existing identical listener set with identical arguments.
+    // The DOM 2 spec says that "duplicate instances are discarded" in this case.
+    removeEventListener(eventType, listener.get(), useCapture);
+    if (Document* document = this->document())
+        document->addListenerTypeIfNeeded(eventType);
+
+    RefPtr<RegisteredEventListener> registeredListener = RegisteredEventListener::create(eventType, listener, useCapture);
+    m_eventListeners.append(registeredListener);
+
+    if (eventType == eventNames().unloadEvent)
+        addPendingEventListener(pendingUnloadEventListenerMap(), this, registeredListener.get());
+    else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
+        addPendingEventListener(pendingBeforeUnloadEventListenerMap(), this, registeredListener.get());
+}
+
+void DOMWindow::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *m_eventListeners[i];
+        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
+            if (eventType == eventNames().unloadEvent)
+                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
+            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
+                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
+            r.setRemoved(true);
+            m_eventListeners.remove(i);
+            return;
+        }
+    }
+}
+
+bool DOMWindow::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    RefPtr<Event> event = e;
+    if (!event || event->type().isEmpty()) {
+        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
+        return true;
+    }
+
+    RefPtr<DOMWindow> protect(this);
+
+    event->setTarget(this);
+    event->setCurrentTarget(this);
+
+    handleEvent(event.get(), true);
+    handleEvent(event.get(), false);
+
+    return !event->defaultPrevented();
+}
+
+void DOMWindow::dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable)
+{
+    ASSERT(!eventDispatchForbidden());
+    ExceptionCode ec = 0;
+    dispatchEvent(Event::create(eventType, canBubble, cancelable), ec);
+}
+
+// This function accommodates the Firefox quirk of dispatching the load, unload and
+// beforeunload events on the window, but setting event.target to be the Document. 
+inline void DOMWindow::dispatchEventWithDocumentAsTarget(PassRefPtr<Event> e, RegisteredEventListenerVector* alternateEventListeners)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    RefPtr<Event> event = e;
+    RefPtr<DOMWindow> protect(this);
+    RefPtr<Document> document = this->document();
+
+    event->setTarget(document);
+    event->setCurrentTarget(this);
+
+    handleEvent(event.get(), true, alternateEventListeners);
+    handleEvent(event.get(), false, alternateEventListeners);
+}
+
+void DOMWindow::dispatchLoadEvent()
+{
+    dispatchEventWithDocumentAsTarget(Event::create(eventNames().loadEvent, false, false));
+
+    // For load events, send a separate load event to the enclosing frame only.
+    // This is a DOM extension and is independent of bubbling/capturing rules of
+    // the DOM.
+    Element* ownerElement = document()->ownerElement();
+    if (ownerElement) {
+        RefPtr<Event> ownerEvent = Event::create(eventNames().loadEvent, false, false);
+        ownerEvent->setTarget(ownerElement);
+        ownerElement->dispatchGenericEvent(ownerEvent.release());
+    }
+}
+
+void DOMWindow::dispatchUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
+{
+    dispatchEventWithDocumentAsTarget(Event::create(eventNames().unloadEvent, false, false), alternateEventListeners);
+}
+
+PassRefPtr<BeforeUnloadEvent> DOMWindow::dispatchBeforeUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
+{
+    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = BeforeUnloadEvent::create();
+    dispatchEventWithDocumentAsTarget(beforeUnloadEvent.get(), alternateEventListeners);
+    return beforeUnloadEvent.release();
+}
+
+void DOMWindow::removeAllEventListeners()
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i)
+        m_eventListeners[i]->setRemoved(true);
+    m_eventListeners.clear();
+
+    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
+    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
+}
+
+bool DOMWindow::hasEventListener(const AtomicString& eventType)
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (m_eventListeners[i]->eventType() == eventType)
+            return true;
+    }
+    return false;
+}
+
+void DOMWindow::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+{
+    clearAttributeEventListener(eventType);
+    if (listener)
+        addEventListener(eventType, listener, false);
+}
+
+void DOMWindow::clearAttributeEventListener(const AtomicString& eventType)
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *m_eventListeners[i];
+        if (r.eventType() == eventType && r.listener()->isAttribute()) {
+            if (eventType == eventNames().unloadEvent)
+                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
+            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
+                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
+            r.setRemoved(true);
+            m_eventListeners.remove(i);
+            return;
+        }
+    }
+}
+
+EventListener* DOMWindow::getAttributeEventListener(const AtomicString& eventType) const
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *m_eventListeners[i];
+        if (r.eventType() == eventType && r.listener()->isAttribute())
+            return r.listener();
+    }
+    return 0;
 }
 
 EventListener* DOMWindow::onabort() const
 {
-    return inlineEventListenerForType(eventNames().abortEvent);
+    return getAttributeEventListener(eventNames().abortEvent);
 }
 
 void DOMWindow::setOnabort(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().abortEvent, eventListener);
+    setAttributeEventListener(eventNames().abortEvent, eventListener);
 }
 
 EventListener* DOMWindow::onblur() const
 {
-    return inlineEventListenerForType(eventNames().blurEvent);
+    return getAttributeEventListener(eventNames().blurEvent);
 }
 
 void DOMWindow::setOnblur(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().blurEvent, eventListener);
+    setAttributeEventListener(eventNames().blurEvent, eventListener);
 }
 
 EventListener* DOMWindow::onchange() const
 {
-    return inlineEventListenerForType(eventNames().changeEvent);
+    return getAttributeEventListener(eventNames().changeEvent);
 }
 
 void DOMWindow::setOnchange(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().changeEvent, eventListener);
+    setAttributeEventListener(eventNames().changeEvent, eventListener);
 }
 
 EventListener* DOMWindow::onclick() const
 {
-    return inlineEventListenerForType(eventNames().clickEvent);
+    return getAttributeEventListener(eventNames().clickEvent);
 }
 
 void DOMWindow::setOnclick(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().clickEvent, eventListener);
+    setAttributeEventListener(eventNames().clickEvent, eventListener);
 }
 
 EventListener* DOMWindow::ondblclick() const
 {
-    return inlineEventListenerForType(eventNames().dblclickEvent);
+    return getAttributeEventListener(eventNames().dblclickEvent);
 }
 
 void DOMWindow::setOndblclick(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().dblclickEvent, eventListener);
+    setAttributeEventListener(eventNames().dblclickEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondrag() const
+{
+    return getAttributeEventListener(eventNames().dragEvent);
+}
+
+void DOMWindow::setOndrag(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragend() const
+{
+    return getAttributeEventListener(eventNames().dragendEvent);
+}
+
+void DOMWindow::setOndragend(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragendEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragenter() const
+{
+    return getAttributeEventListener(eventNames().dragenterEvent);
+}
+
+void DOMWindow::setOndragenter(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragenterEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragleave() const
+{
+    return getAttributeEventListener(eventNames().dragleaveEvent);
+}
+
+void DOMWindow::setOndragleave(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragover() const
+{
+    return getAttributeEventListener(eventNames().dragoverEvent);
+}
+
+void DOMWindow::setOndragover(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragoverEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragstart() const
+{
+    return getAttributeEventListener(eventNames().dragstartEvent);
+}
+
+void DOMWindow::setOndragstart(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragstartEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondrop() const
+{
+    return getAttributeEventListener(eventNames().dropEvent);
+}
+
+void DOMWindow::setOndrop(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dropEvent, eventListener);
 }
 
 EventListener* DOMWindow::onerror() const
 {
-    return inlineEventListenerForType(eventNames().errorEvent);
+    return getAttributeEventListener(eventNames().errorEvent);
 }
 
 void DOMWindow::setOnerror(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().errorEvent, eventListener);
+    setAttributeEventListener(eventNames().errorEvent, eventListener);
 }
 
 EventListener* DOMWindow::onfocus() const
 {
-    return inlineEventListenerForType(eventNames().focusEvent);
+    return getAttributeEventListener(eventNames().focusEvent);
 }
 
 void DOMWindow::setOnfocus(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().focusEvent, eventListener);
+    setAttributeEventListener(eventNames().focusEvent, eventListener);
 }
 
 EventListener* DOMWindow::onkeydown() const
 {
-    return inlineEventListenerForType(eventNames().keydownEvent);
+    return getAttributeEventListener(eventNames().keydownEvent);
 }
 
 void DOMWindow::setOnkeydown(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keydownEvent, eventListener);
+    setAttributeEventListener(eventNames().keydownEvent, eventListener);
 }
 
 EventListener* DOMWindow::onkeypress() const
 {
-    return inlineEventListenerForType(eventNames().keypressEvent);
+    return getAttributeEventListener(eventNames().keypressEvent);
 }
 
 void DOMWindow::setOnkeypress(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keypressEvent, eventListener);
+    setAttributeEventListener(eventNames().keypressEvent, eventListener);
 }
 
 EventListener* DOMWindow::onkeyup() const
 {
-    return inlineEventListenerForType(eventNames().keyupEvent);
+    return getAttributeEventListener(eventNames().keyupEvent);
 }
 
 void DOMWindow::setOnkeyup(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keyupEvent, eventListener);
+    setAttributeEventListener(eventNames().keyupEvent, eventListener);
 }
 
 EventListener* DOMWindow::onload() const
 {
-    return inlineEventListenerForType(eventNames().loadEvent);
+    return getAttributeEventListener(eventNames().loadEvent);
 }
 
 void DOMWindow::setOnload(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().loadEvent, eventListener);
+    setAttributeEventListener(eventNames().loadEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmousedown() const
 {
-    return inlineEventListenerForType(eventNames().mousedownEvent);
+    return getAttributeEventListener(eventNames().mousedownEvent);
 }
 
 void DOMWindow::setOnmousedown(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousedownEvent, eventListener);
+    setAttributeEventListener(eventNames().mousedownEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmousemove() const
 {
-    return inlineEventListenerForType(eventNames().mousemoveEvent);
+    return getAttributeEventListener(eventNames().mousemoveEvent);
 }
 
 void DOMWindow::setOnmousemove(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousemoveEvent, eventListener);
+    setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmouseout() const
 {
-    return inlineEventListenerForType(eventNames().mouseoutEvent);
+    return getAttributeEventListener(eventNames().mouseoutEvent);
 }
 
 void DOMWindow::setOnmouseout(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseoutEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmouseover() const
 {
-    return inlineEventListenerForType(eventNames().mouseoverEvent);
+    return getAttributeEventListener(eventNames().mouseoverEvent);
 }
 
 void DOMWindow::setOnmouseover(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseoverEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmouseup() const
 {
-    return inlineEventListenerForType(eventNames().mouseupEvent);
+    return getAttributeEventListener(eventNames().mouseupEvent);
 }
 
 void DOMWindow::setOnmouseup(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseupEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseupEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmousewheel() const
 {
-    return inlineEventListenerForType(eventNames().mousewheelEvent);
+    return getAttributeEventListener(eventNames().mousewheelEvent);
 }
 
 void DOMWindow::setOnmousewheel(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousewheelEvent, eventListener);
+    setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
+}
+
+EventListener* DOMWindow::onoffline() const
+{
+    return getAttributeEventListener(eventNames().offlineEvent);
+}
+
+void DOMWindow::setOnoffline(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().offlineEvent, eventListener);
+}
+
+EventListener* DOMWindow::ononline() const
+{
+    return getAttributeEventListener(eventNames().onlineEvent);
+}
+
+void DOMWindow::setOnonline(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().onlineEvent, eventListener);
 }
 
 EventListener* DOMWindow::onreset() const
 {
-    return inlineEventListenerForType(eventNames().resetEvent);
+    return getAttributeEventListener(eventNames().resetEvent);
 }
 
 void DOMWindow::setOnreset(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().resetEvent, eventListener);
+    setAttributeEventListener(eventNames().resetEvent, eventListener);
 }
 
 EventListener* DOMWindow::onresize() const
 {
-    return inlineEventListenerForType(eventNames().resizeEvent);
+    return getAttributeEventListener(eventNames().resizeEvent);
 }
 
 void DOMWindow::setOnresize(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().resizeEvent, eventListener);
+    setAttributeEventListener(eventNames().resizeEvent, eventListener);
 }
 
 EventListener* DOMWindow::onscroll() const
 {
-    return inlineEventListenerForType(eventNames().scrollEvent);
+    return getAttributeEventListener(eventNames().scrollEvent);
 }
 
 void DOMWindow::setOnscroll(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().scrollEvent, eventListener);
+    setAttributeEventListener(eventNames().scrollEvent, eventListener);
 }
 
 EventListener* DOMWindow::onsearch() const
 {
-    return inlineEventListenerForType(eventNames().searchEvent);
+    return getAttributeEventListener(eventNames().searchEvent);
 }
 
 void DOMWindow::setOnsearch(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().searchEvent, eventListener);
+    setAttributeEventListener(eventNames().searchEvent, eventListener);
 }
 
 EventListener* DOMWindow::onselect() const
 {
-    return inlineEventListenerForType(eventNames().selectEvent);
+    return getAttributeEventListener(eventNames().selectEvent);
 }
 
 void DOMWindow::setOnselect(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().selectEvent, eventListener);
+    setAttributeEventListener(eventNames().selectEvent, eventListener);
+}
+
+EventListener* DOMWindow::onstorage() const
+{
+    return getAttributeEventListener(eventNames().storageEvent);
+}
+
+void DOMWindow::setOnstorage(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().storageEvent, eventListener);
 }
 
 EventListener* DOMWindow::onsubmit() const
 {
-    return inlineEventListenerForType(eventNames().submitEvent);
+    return getAttributeEventListener(eventNames().submitEvent);
 }
 
 void DOMWindow::setOnsubmit(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().submitEvent, eventListener);
+    setAttributeEventListener(eventNames().submitEvent, eventListener);
 }
 
 EventListener* DOMWindow::onunload() const
 {
-    return inlineEventListenerForType(eventNames().unloadEvent);
+    return getAttributeEventListener(eventNames().unloadEvent);
 }
 
 void DOMWindow::setOnunload(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().unloadEvent, eventListener);
+    setAttributeEventListener(eventNames().unloadEvent, eventListener);
 }
 
 EventListener* DOMWindow::onbeforeunload() const
 {
-    return inlineEventListenerForType(eventNames().beforeunloadEvent);
+    return getAttributeEventListener(eventNames().beforeunloadEvent);
 }
 
 void DOMWindow::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().beforeunloadEvent, eventListener);
+    setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkitanimationstart() const
 {
-    return inlineEventListenerForType(eventNames().webkitAnimationStartEvent);
+    return getAttributeEventListener(eventNames().webkitAnimationStartEvent);
 }
 
 void DOMWindow::setOnwebkitanimationstart(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitAnimationStartEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitAnimationStartEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkitanimationiteration() const
 {
-    return inlineEventListenerForType(eventNames().webkitAnimationIterationEvent);
+    return getAttributeEventListener(eventNames().webkitAnimationIterationEvent);
 }
 
 void DOMWindow::setOnwebkitanimationiteration(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitAnimationIterationEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitAnimationIterationEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkitanimationend() const
 {
-    return inlineEventListenerForType(eventNames().webkitAnimationEndEvent);
+    return getAttributeEventListener(eventNames().webkitAnimationEndEvent);
 }
 
 void DOMWindow::setOnwebkitanimationend(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitAnimationEndEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitAnimationEndEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkittransitionend() const
 {
-    return inlineEventListenerForType(eventNames().webkitTransitionEndEvent);
+    return getAttributeEventListener(eventNames().webkitTransitionEndEvent);
 }
 
 void DOMWindow::setOnwebkittransitionend(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitTransitionEndEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitTransitionEndEvent, eventListener);
+}
+
+EventListener* DOMWindow::oncanplay() const
+{
+    return getAttributeEventListener(eventNames().canplayEvent);
+}
+
+void DOMWindow::setOncanplay(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().canplayEvent, eventListener);
+}
+
+EventListener* DOMWindow::oncanplaythrough() const
+{
+    return getAttributeEventListener(eventNames().canplaythroughEvent);
+}
+
+void DOMWindow::setOncanplaythrough(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().canplaythroughEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondurationchange() const
+{
+    return getAttributeEventListener(eventNames().durationchangeEvent);
+}
+
+void DOMWindow::setOndurationchange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().durationchangeEvent, eventListener);
+}
+
+EventListener* DOMWindow::onemptied() const
+{
+    return getAttributeEventListener(eventNames().emptiedEvent);
+}
+
+void DOMWindow::setOnemptied(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().emptiedEvent, eventListener);
+}
+
+EventListener* DOMWindow::onended() const
+{
+    return getAttributeEventListener(eventNames().endedEvent);
+}
+
+void DOMWindow::setOnended(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().endedEvent, eventListener);
+}
+
+EventListener* DOMWindow::onloadeddata() const
+{
+    return getAttributeEventListener(eventNames().loadeddataEvent);
+}
+
+void DOMWindow::setOnloadeddata(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().loadeddataEvent, eventListener);
+}
+
+EventListener* DOMWindow::onloadedmetadata() const
+{
+    return getAttributeEventListener(eventNames().loadedmetadataEvent);
+}
+
+void DOMWindow::setOnloadedmetadata(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().loadedmetadataEvent, eventListener);
+}
+
+EventListener* DOMWindow::onpause() const
+{
+    return getAttributeEventListener(eventNames().pauseEvent);
+}
+
+void DOMWindow::setOnpause(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().pauseEvent, eventListener);
+}
+
+EventListener* DOMWindow::onplay() const
+{
+    return getAttributeEventListener(eventNames().playEvent);
+}
+
+void DOMWindow::setOnplay(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().playEvent, eventListener);
+}
+
+EventListener* DOMWindow::onplaying() const
+{
+    return getAttributeEventListener(eventNames().playingEvent);
+}
+
+void DOMWindow::setOnplaying(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().playingEvent, eventListener);
+}
+
+EventListener* DOMWindow::onratechange() const
+{
+    return getAttributeEventListener(eventNames().ratechangeEvent);
+}
+
+void DOMWindow::setOnratechange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().ratechangeEvent, eventListener);
+}
+
+EventListener* DOMWindow::onseeked() const
+{
+    return getAttributeEventListener(eventNames().seekedEvent);
+}
+
+void DOMWindow::setOnseeked(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().seekedEvent, eventListener);
+}
+
+EventListener* DOMWindow::onseeking() const
+{
+    return getAttributeEventListener(eventNames().seekingEvent);
+}
+
+void DOMWindow::setOnseeking(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().seekingEvent, eventListener);
+}
+
+EventListener* DOMWindow::ontimeupdate() const
+{
+    return getAttributeEventListener(eventNames().timeupdateEvent);
+}
+
+void DOMWindow::setOntimeupdate(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().timeupdateEvent, eventListener);
+}
+
+EventListener* DOMWindow::onvolumechange() const
+{
+    return getAttributeEventListener(eventNames().volumechangeEvent);
+}
+
+void DOMWindow::setOnvolumechange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().volumechangeEvent, eventListener);
+}
+
+EventListener* DOMWindow::onwaiting() const
+{
+    return getAttributeEventListener(eventNames().waitingEvent);
+}
+
+void DOMWindow::setOnwaiting(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().waitingEvent, eventListener);
+}
+
+EventListener* DOMWindow::onloadstart() const
+{
+    return getAttributeEventListener(eventNames().loadstartEvent);
+}
+
+void DOMWindow::setOnloadstart(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().loadstartEvent, eventListener);
+}
+
+EventListener* DOMWindow::onprogress() const
+{
+    return getAttributeEventListener(eventNames().progressEvent);
+}
+
+void DOMWindow::setOnprogress(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().progressEvent, eventListener);
+}
+
+EventListener* DOMWindow::onstalled() const
+{
+    return getAttributeEventListener(eventNames().stalledEvent);
+}
+
+void DOMWindow::setOnstalled(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().stalledEvent, eventListener);
+}
+
+EventListener* DOMWindow::onsuspend() const
+{
+    return getAttributeEventListener(eventNames().suspendEvent);
+}
+
+void DOMWindow::setOnsuspend(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().suspendEvent, eventListener);
+}
+
+EventListener* DOMWindow::oninput() const
+{
+    return getAttributeEventListener(eventNames().inputEvent);
+}
+
+void DOMWindow::setOninput(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().inputEvent, eventListener);
+}
+
+EventListener* DOMWindow::onmessage() const
+{
+    return getAttributeEventListener(eventNames().messageEvent);
+}
+
+void DOMWindow::setOnmessage(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().messageEvent, eventListener);
+}
+
+EventListener* DOMWindow::oncontextmenu() const
+{
+    return getAttributeEventListener(eventNames().contextmenuEvent);
+}
+
+void DOMWindow::setOncontextmenu(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
+}
+
+void DOMWindow::captureEvents()
+{
+    // Not implemented.
+}
+
+void DOMWindow::releaseEvents()
+{
+    // Not implemented.
 }
 
 #if ENABLE(TOUCH_EVENTS) // Android
 EventListener* DOMWindow::ontouchstart() const
 {
-    return inlineEventListenerForType(eventNames().touchstartEvent);
+    return getAttributeEventListener(eventNames().touchstartEvent);
 }
 
 void DOMWindow::setOntouchstart(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().touchstartEvent, eventListener);
+    setAttributeEventListener(eventNames().touchstartEvent, eventListener);
 }
 
 EventListener* DOMWindow::ontouchend() const
 {
-    return inlineEventListenerForType(eventNames().touchendEvent);
+    return getAttributeEventListener(eventNames().touchendEvent);
 }
 
 void DOMWindow::setOntouchend(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().touchendEvent, eventListener);
+    setAttributeEventListener(eventNames().touchendEvent, eventListener);
 }
 
 EventListener* DOMWindow::ontouchmove() const
 {
-    return inlineEventListenerForType(eventNames().touchmoveEvent);
+    return getAttributeEventListener(eventNames().touchmoveEvent);
 }
 
 void DOMWindow::setOntouchmove(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().touchmoveEvent, eventListener);
+    setAttributeEventListener(eventNames().touchmoveEvent, eventListener);
 }
 
 EventListener* DOMWindow::ontouchcancel() const
 {
-    return inlineEventListenerForType(eventNames().touchcancelEvent);
+    return getAttributeEventListener(eventNames().touchcancelEvent);
 }
 
 void DOMWindow::setOntouchcancel(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().touchcancelEvent, eventListener);
+    setAttributeEventListener(eventNames().touchcancelEvent, eventListener);
 }
 #endif
 
diff --git a/WebCore/page/DOMWindow.h b/WebCore/page/DOMWindow.h
index b779cbd..7d97445 100644
--- a/WebCore/page/DOMWindow.h
+++ b/WebCore/page/DOMWindow.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,8 +26,10 @@
 #ifndef DOMWindow_h
 #define DOMWindow_h
 
+#include "EventTarget.h"
 #include "KURL.h"
 #include "PlatformString.h"
+#include "RegisteredEventListener.h"
 #include "SecurityOrigin.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
@@ -36,6 +38,7 @@
 namespace WebCore {
 
     class BarInfo;
+    class BeforeUnloadEvent;
     class CSSRuleList;
     class CSSStyleDeclaration;
     class Console;
@@ -43,6 +46,7 @@
     class Database;
     class Document;
     class Element;
+    class Event;
     class EventListener;
     class FloatRect;
     class Frame;
@@ -50,10 +54,11 @@
     class Location;
     class MessagePort;
     class Navigator;
+    class Node;
     class PostMessageTimer;
+    class ScheduledAction;
     class Screen;
     class WebKitPoint;
-    class Node;
 
 #if ENABLE(DOM_STORAGE)
     class SessionStorage;
@@ -66,12 +71,15 @@
 
     typedef int ExceptionCode;
 
-    class DOMWindow : public RefCounted<DOMWindow> {
+    class DOMWindow : public RefCounted<DOMWindow>, public EventTarget {
     public:
         static PassRefPtr<DOMWindow> create(Frame* frame) { return adoptRef(new DOMWindow(frame)); }
         virtual ~DOMWindow();
 
-        Frame* frame() { return m_frame; }
+        virtual DOMWindow* toDOMWindow() { return this; }
+        virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+        Frame* frame() const { return m_frame; }
         void disconnectFrame();
 
         void clear();
@@ -82,7 +90,17 @@
         void setURL(const KURL& url) { m_url = url; }
         KURL url() const { return m_url; }
 
+        unsigned pendingUnloadEventListeners() const;
+
+        static bool dispatchAllPendingBeforeUnloadEvents();
+        static void dispatchAllPendingUnloadEvents();
+
         static void adjustWindowRect(const FloatRect& screen, FloatRect& window, const FloatRect& pendingChanges);
+        static void parseModalDialogFeatures(const String& featuresArg, HashMap<String, String>& map);
+
+        static bool allowPopUp(Frame* activeFrame);
+        static bool canShowModalDialog(const Frame*);
+        static bool canShowModalDialogNow(const Frame*);
 
         // DOM Level 0
         Screen* screen() const;
@@ -198,6 +216,34 @@
         void resizeBy(float x, float y) const;
         void resizeTo(float width, float height) const;
 
+        // Timers
+        int setTimeout(ScheduledAction*, int timeout);
+        void clearTimeout(int timeoutId);
+        int setInterval(ScheduledAction*, int timeout);
+        void clearInterval(int timeoutId);
+
+        // Events
+        // EventTarget API
+        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+
+        void handleEvent(Event*, bool useCapture, RegisteredEventListenerVector* = 0);
+
+        void dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+        void dispatchLoadEvent();
+        void dispatchUnloadEvent(RegisteredEventListenerVector* = 0);
+        PassRefPtr<BeforeUnloadEvent> dispatchBeforeUnloadEvent(RegisteredEventListenerVector* = 0);
+
+        // Used for legacy "onEvent" property APIs.
+        void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+        void clearAttributeEventListener(const AtomicString& eventType);
+        EventListener* getAttributeEventListener(const AtomicString& eventType) const;
+
+        const RegisteredEventListenerVector& eventListeners() const { return m_eventListeners; }
+        bool hasEventListener(const AtomicString& eventType);
+        void removeAllEventListeners();
+
         EventListener* onabort() const;
         void setOnabort(PassRefPtr<EventListener>);
         EventListener* onblur() const;
@@ -208,6 +254,20 @@
         void setOnclick(PassRefPtr<EventListener>);
         EventListener* ondblclick() const;
         void setOndblclick(PassRefPtr<EventListener>);
+        EventListener* ondrag() const;
+        void setOndrag(PassRefPtr<EventListener>);
+        EventListener* ondragend() const;
+        void setOndragend(PassRefPtr<EventListener>);
+        EventListener* ondragenter() const;
+        void setOndragenter(PassRefPtr<EventListener>);
+        EventListener* ondragleave() const;
+        void setOndragleave(PassRefPtr<EventListener>);
+        EventListener* ondragover() const;
+        void setOndragover(PassRefPtr<EventListener>);
+        EventListener* ondragstart() const;
+        void setOndragstart(PassRefPtr<EventListener>);
+        EventListener* ondrop() const;
+        void setOndrop(PassRefPtr<EventListener>);
         EventListener* onerror() const;
         void setOnerror(PassRefPtr<EventListener>);
         EventListener* onfocus() const;
@@ -232,6 +292,10 @@
         void setOnmouseup(PassRefPtr<EventListener>);
         EventListener* onmousewheel() const;
         void setOnmousewheel(PassRefPtr<EventListener>);
+        EventListener* onoffline() const;
+        void setOnoffline(PassRefPtr<EventListener>);
+        EventListener* ononline() const;
+        void setOnonline(PassRefPtr<EventListener>);
         EventListener* onreset() const;
         void setOnreset(PassRefPtr<EventListener>);
         EventListener* onresize() const;
@@ -242,6 +306,8 @@
         void setOnsearch(PassRefPtr<EventListener>);
         EventListener* onselect() const;
         void setOnselect(PassRefPtr<EventListener>);
+        EventListener* onstorage() const;
+        void setOnstorage(PassRefPtr<EventListener>);
         EventListener* onsubmit() const;
         void setOnsubmit(PassRefPtr<EventListener>);
         EventListener* onunload() const;
@@ -267,6 +333,56 @@
         void setOntouchcancel(PassRefPtr<EventListener>);
 #endif
         
+        EventListener* oncanplay() const;
+        void setOncanplay(PassRefPtr<EventListener>);
+        EventListener* oncanplaythrough() const;
+        void setOncanplaythrough(PassRefPtr<EventListener>);
+        EventListener* ondurationchange() const;
+        void setOndurationchange(PassRefPtr<EventListener>);
+        EventListener* onemptied() const;
+        void setOnemptied(PassRefPtr<EventListener>);
+        EventListener* onended() const;
+        void setOnended(PassRefPtr<EventListener>);
+        EventListener* onloadeddata() const;
+        void setOnloadeddata(PassRefPtr<EventListener>);
+        EventListener* onloadedmetadata() const;
+        void setOnloadedmetadata(PassRefPtr<EventListener>);
+        EventListener* onpause() const;
+        void setOnpause(PassRefPtr<EventListener>);
+        EventListener* onplay() const;
+        void setOnplay(PassRefPtr<EventListener>);
+        EventListener* onplaying() const;
+        void setOnplaying(PassRefPtr<EventListener>);
+        EventListener* onratechange() const;
+        void setOnratechange(PassRefPtr<EventListener>);
+        EventListener* onseeked() const;
+        void setOnseeked(PassRefPtr<EventListener>);
+        EventListener* onseeking() const;
+        void setOnseeking(PassRefPtr<EventListener>);
+        EventListener* ontimeupdate() const;
+        void setOntimeupdate(PassRefPtr<EventListener>);
+        EventListener* onvolumechange() const;
+        void setOnvolumechange(PassRefPtr<EventListener>);
+        EventListener* onwaiting() const;
+        void setOnwaiting(PassRefPtr<EventListener>);
+        EventListener* onloadstart() const;
+        void setOnloadstart(PassRefPtr<EventListener>);
+        EventListener* onprogress() const;
+        void setOnprogress(PassRefPtr<EventListener>);
+        EventListener* onstalled() const;
+        void setOnstalled(PassRefPtr<EventListener>);
+        EventListener* onsuspend() const;
+        void setOnsuspend(PassRefPtr<EventListener>);
+        EventListener* oninput() const;
+        void setOninput(PassRefPtr<EventListener>);
+        EventListener* onmessage() const;
+        void setOnmessage(PassRefPtr<EventListener>);
+        EventListener* oncontextmenu() const;
+        void setOncontextmenu(PassRefPtr<EventListener>);
+
+        void captureEvents();
+        void releaseEvents();
+
         // These methods are used for GC marking. See JSDOMWindow::mark() in
         // JSDOMWindowCustom.cpp.
         Screen* optionalScreen() const { return m_screen.get(); }
@@ -283,17 +399,22 @@
         Location* optionalLocation() const { return m_location.get(); }
 #if ENABLE(DOM_STORAGE)
         Storage* optionalSessionStorage() const { return m_sessionStorage.get(); }
-        Storage* optionalLocalStorage() const { return m_sessionStorage.get(); }
+        Storage* optionalLocalStorage() const { return m_localStorage.get(); }
 #endif
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         DOMApplicationCache* optionalApplicationCache() const { return m_applicationCache.get(); }
 #endif
 
+        using RefCounted<DOMWindow>::ref;
+        using RefCounted<DOMWindow>::deref;
+
     private:
         DOMWindow(Frame*);
 
-        void setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener>);
-        EventListener* inlineEventListenerForType(const AtomicString& eventType) const;
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+
+        void dispatchEventWithDocumentAsTarget(PassRefPtr<Event>, RegisteredEventListenerVector* = 0);
 
         RefPtr<SecurityOrigin> m_securityOrigin;
         KURL m_url;
@@ -318,8 +439,10 @@
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         mutable RefPtr<DOMApplicationCache> m_applicationCache;
 #endif
+
+        RegisteredEventListenerVector m_eventListeners;
     };
 
 } // namespace WebCore
 
-#endif
+#endif // DOMWindow_h
diff --git a/WebCore/page/DOMWindow.idl b/WebCore/page/DOMWindow.idl
index fd0cd55..612ae42 100644
--- a/WebCore/page/DOMWindow.idl
+++ b/WebCore/page/DOMWindow.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,7 +44,7 @@
     ] DOMWindow {
         // DOM Level 0
         readonly attribute Screen screen;
-        readonly attribute [DoNotCheckDomainSecurity] History history;
+        readonly attribute [DoNotCheckDomainSecurity, JSCCustomGetter] History history;
         attribute [Replaceable] BarInfo locationbar;
         attribute [Replaceable] BarInfo menubar;
         attribute [Replaceable] BarInfo personalbar;
@@ -53,7 +53,11 @@
         attribute [Replaceable] BarInfo toolbar;
         attribute [Replaceable] Navigator navigator;
         attribute [Replaceable] Navigator clientInformation;
-        attribute [DoNotCheckDomainSecurity, CustomSetter, V8DisallowShadowing] Location location;
+        attribute [DoNotCheckDomainSecurity, JSCCustom, V8CustomSetter, V8DisallowShadowing] Location location;
+
+        attribute [Replaceable, CustomGetter] Event event;
+
+        readonly attribute [Custom] Crypto crypto;
 
         DOMSelection getSelection();
 
@@ -66,6 +70,14 @@
         void print();
         void stop();
 
+        [Custom] DOMWindow open(in DOMString url,
+                                in DOMString name,
+                                in [Optional] DOMString options);
+
+        [Custom] DOMObject showModalDialog(in DOMString url, 
+                                           in [Optional] DOMObject dialogArgs,
+                                           in [Optional] DOMString featureArgs);
+
         void alert(in DOMString message);
         boolean confirm(in DOMString message);
         [ConvertNullStringTo=Null] DOMString prompt(in DOMString message,
@@ -113,7 +125,7 @@
 
         attribute DOMString status;
         attribute DOMString defaultStatus;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // This attribute is an alias of defaultStatus and is necessary for legacy uses.
         attribute DOMString defaultstatus;
 #endif
@@ -143,14 +155,14 @@
         WebKitPoint webkitConvertPointFromPageToNode(in Node node, in WebKitPoint p);
         WebKitPoint webkitConvertPointFromNodeToPage(in Node node, in WebKitPoint p);
 
-#if ENABLE_OFFLINE_WEB_APPLICATIONS
+#if defined(ENABLE_OFFLINE_WEB_APPLICATIONS) && ENABLE_OFFLINE_WEB_APPLICATIONS
         readonly attribute DOMApplicationCache applicationCache;
 #endif    
-#if ENABLE_DATABASE
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
         Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize)
             raises(DOMException);
 #endif
-#if ENABLE_DOM_STORAGE
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         readonly attribute Storage sessionStorage;
         readonly attribute Storage localStorage;
 #endif
@@ -163,12 +175,13 @@
 
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
+        // [Custom] long setTimeout(in TimeoutHandler handler, in long timeout, arguments...);
         // [Custom] long setTimeout(in DOMString code, in long timeout);
-        [Custom] void clearTimeout(in long handle);
-
+        void clearTimeout(in long handle);
         [Custom] long setInterval(in TimeoutHandler handler, in long timeout);
+        // [Custom] long setInterval(in TimeoutHandler handler, in long timeout, arguments...);
         // [Custom] long setInterval(in DOMString code, in long timeout);
-        [Custom] void clearInterval(in long handle);
+        void clearInterval(in long handle);
 
         // Base64
         [Custom] DOMString atob(in DOMString string)
@@ -177,46 +190,91 @@
             raises(DOMException);
 
         // Events
-        attribute [ProtectedListener] EventListener onabort;
-        attribute [ProtectedListener] EventListener onblur;
-        attribute [ProtectedListener] EventListener onchange;
-        attribute [ProtectedListener] EventListener onclick;
-        attribute [ProtectedListener] EventListener ondblclick;
-        attribute [ProtectedListener] EventListener onerror;
-        attribute [ProtectedListener] EventListener onfocus;
-        attribute [ProtectedListener] EventListener onkeydown;
-        attribute [ProtectedListener] EventListener onkeypress;
-        attribute [ProtectedListener] EventListener onkeyup;
-        attribute [ProtectedListener] EventListener onload;
-        attribute [ProtectedListener] EventListener onmousedown;
-        attribute [ProtectedListener] EventListener onmousemove;
-        attribute [ProtectedListener] EventListener onmouseout;
-        attribute [ProtectedListener] EventListener onmouseover;
-        attribute [ProtectedListener] EventListener onmouseup;
-        attribute [ProtectedListener] EventListener onmousewheel;
-        attribute [ProtectedListener] EventListener onreset;
-        attribute [ProtectedListener] EventListener onresize;
-        attribute [ProtectedListener] EventListener onscroll;
-        attribute [ProtectedListener] EventListener onsearch;
-        attribute [ProtectedListener] EventListener onselect;
-        attribute [ProtectedListener] EventListener onsubmit;
-        attribute [ProtectedListener] EventListener onunload;
-        attribute [ProtectedListener] EventListener onbeforeunload;
-        attribute [ProtectedListener] EventListener onwebkitanimationstart;
-        attribute [ProtectedListener] EventListener onwebkitanimationiteration;
-        attribute [ProtectedListener] EventListener onwebkitanimationend;
-        attribute [ProtectedListener] EventListener onwebkittransitionend;
 #if ENABLE_TOUCH_EVENTS
-        attribute [ProtectedListener] EventListener ontouchstart;
-        attribute [ProtectedListener] EventListener ontouchend;
-        attribute [ProtectedListener] EventListener ontouchmove;
-        attribute [ProtectedListener] EventListener ontouchcancel;
+        attribute EventListener ontouchstart;
+        attribute EventListener ontouchend;
+        attribute EventListener ontouchmove;
+        attribute EventListener ontouchcancel;
 #endif
 
-#if defined(V8_BINDING)
-        attribute [ProtectedListener] EventListener ondragdrop;
-        attribute [ProtectedListener] EventListener onmove;
-#endif
+        attribute EventListener onabort;
+        attribute EventListener onbeforeunload;
+        attribute EventListener onblur;
+        attribute EventListener oncanplay;
+        attribute EventListener oncanplaythrough;
+        attribute EventListener onchange;
+        attribute EventListener onclick;
+        attribute EventListener oncontextmenu;
+        attribute EventListener ondblclick;
+        attribute EventListener ondrag;
+        attribute EventListener ondragend;
+        attribute EventListener ondragenter;
+        attribute EventListener ondragleave;
+        attribute EventListener ondragover;
+        attribute EventListener ondragstart;
+        attribute EventListener ondrop;
+        attribute EventListener ondurationchange;
+        attribute EventListener onemptied;
+        attribute EventListener onended;
+        attribute EventListener onerror;
+        attribute EventListener onfocus;
+        attribute EventListener oninput;
+        attribute EventListener onkeydown;
+        attribute EventListener onkeypress;
+        attribute EventListener onkeyup;
+        attribute EventListener onload;
+        attribute EventListener onloadeddata;
+        attribute EventListener onloadedmetadata;
+        attribute EventListener onloadstart;
+        attribute EventListener onmessage;
+        attribute EventListener onmousedown;
+        attribute EventListener onmousemove;
+        attribute EventListener onmouseout;
+        attribute EventListener onmouseover;
+        attribute EventListener onmouseup;
+        attribute EventListener onmousewheel;
+        attribute EventListener onoffline;
+        attribute EventListener ononline;
+        attribute EventListener onpause;
+        attribute EventListener onplay;
+        attribute EventListener onplaying;
+        attribute EventListener onprogress;
+        attribute EventListener onratechange;
+        attribute EventListener onresize;
+        attribute EventListener onscroll;
+        attribute EventListener onseeked;
+        attribute EventListener onseeking;
+        attribute EventListener onselect;
+        attribute EventListener onstalled;
+        attribute EventListener onstorage;
+        attribute EventListener onsubmit;
+        attribute EventListener onsuspend;
+        attribute EventListener ontimeupdate;
+        attribute EventListener onunload;
+        attribute EventListener onvolumechange;
+        attribute EventListener onwaiting;
+
+        // Not implemented yet.
+        // attribute EventListener onafterprint;
+        // attribute EventListener onbeforeprint;
+        // attribute EventListener ondataunavailable;
+        // attribute EventListener onformchange;
+        // attribute EventListener onforminput;
+        // attribute EventListener onhashchange;
+        // attribute EventListener oninvalid;
+        // attribute EventListener onpopstate;
+        // attribute EventListener onreadystatechange;
+        // attribute EventListener onredo;
+        // attribute EventListener onshow;
+        // attribute EventListener onundo;
+
+        // Webkit extensions
+        attribute EventListener onreset;
+        attribute EventListener onsearch;
+        attribute EventListener onwebkitanimationend;
+        attribute EventListener onwebkitanimationiteration;
+        attribute EventListener onwebkitanimationstart;
+        attribute EventListener onwebkittransitionend;
 
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type,
@@ -225,9 +283,13 @@
         [Custom] void removeEventListener(in DOMString type,
                                           in EventListener listener,
                                           in boolean useCapture);
-        // FIXME: Implement dispatchEvent
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+        [V8Custom=DOMWindowNOP] void captureEvents(/*in long eventFlags*/);
+        [V8Custom=DOMWindowNOP] void releaseEvents(/*in long eventFlags*/);
+
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Global constructors
         attribute StyleSheetConstructor StyleSheet;
         attribute CSSStyleSheetConstructor CSSStyleSheet;
@@ -347,6 +409,9 @@
 
         attribute HTMLCollectionConstructor HTMLCollection;
 
+        attribute [CustomGetter] HTMLImageElementConstructor Image; // Usable with new operator
+        attribute [CustomGetter] HTMLOptionElementConstructor Option; // Usable with new operator
+
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
         attribute TextMetricsConstructor TextMetrics;
 
@@ -370,9 +435,9 @@
         attribute WebKitCSSKeyframeRuleConstructor WebKitCSSKeyframeRule;
         attribute WebKitCSSKeyframesRuleConstructor WebKitCSSKeyframesRule;
 
-#if ENABLE_CHANNEL_MESSAGING
-        attribute MessagePortConstructor MessagePort;
-#endif
+        attribute [JSCCustomGetter] WebKitCSSMatrixConstructor WebKitCSSMatrix; // Usable with the new operator
+
+        attribute [JSCCustomGetter] WebKitPointConstructor WebKitPoint; // Usable with new the operator
 
         attribute ClipboardConstructor Clipboard;
 
@@ -390,21 +455,22 @@
         attribute DOMParserConstructor DOMParser;
         attribute XMLSerializerConstructor XMLSerializer;
 
+        attribute [JSCCustomGetter] XMLHttpRequestConstructor XMLHttpRequest; // Usable with the new operator
         attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
         attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
-#if defined(V8_BINDING)
-        // With JSC, these are added in JSDOMWindowBase.cpp.
-        attribute XMLHttpRequestConstructor XMLHttpRequest;
-        attribute MessageChannelConstructor MessageChannel;
-        attribute WebKitPointConstructor WebKitPoint;
-#if ENABLE_XSLT        
-        attribute XSLTProcessorConstructor XSLTProcessor;
+
+#if defined(ENABLE_XSLT) && ENABLE_XSLT
+        attribute [JSCCustomGetter] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
 #endif
-#if ENABLE_WORKERS
-        attribute WorkerConstructor Worker;
+
+#if defined(ENABLE_CHANNEL_MESSAGING) && ENABLE_CHANNEL_MESSAGING
+        attribute MessagePortConstructor MessagePort;
+        attribute [JSCCustomGetter] MessageChannelConstructor MessageChannel; // Usable with the new operator
 #endif
-        attribute WebKitCSSMatrixConstructor WebKitCSSMatrix;
-#endif  // V8_BINDING
+
+#if defined(ENABLE_WORKERS) && ENABLE_WORKERS
+        attribute [JSCCustomGetter] WorkerConstructor Worker; // Usable with the new operator
+#endif
 
         attribute PluginConstructor Plugin;
         attribute PluginArrayConstructor PluginArray;
@@ -415,25 +481,24 @@
         attribute ClientRectConstructor ClientRect;
         attribute ClientRectListConstructor ClientRectList;
 
-#if ENABLE_DOM_STORAGE
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         attribute StorageConstructor Storage;
         attribute StorageEventConstructor StorageEvent;
 #endif
 
-#if ENABLE_VIDEO
-        attribute HTMLAudioElementConstructor HTMLAudioElement;
-        attribute HTMLMediaElementConstructor HTMLMediaElement;
-        attribute HTMLVideoElementConstructor HTMLVideoElement;
-        attribute MediaErrorConstructor MediaError;
-#endif
+        attribute [CustomGetter,Conditional=VIDEO] HTMLAudioElementConstructor Audio; // Usable with the new operator
+        attribute [Conditional=VIDEO] HTMLAudioElementConstructor HTMLAudioElement;
+        attribute [Conditional=VIDEO] HTMLMediaElementConstructor HTMLMediaElement;
+        attribute [Conditional=VIDEO] HTMLVideoElementConstructor HTMLVideoElement;
+        attribute [Conditional=VIDEO] MediaErrorConstructor MediaError;
 
-#if ENABLE_XPATH
+#if defined(ENABLE_XPATH) && ENABLE_XPATH
         attribute XPathEvaluatorConstructor XPathEvaluator;
         attribute XPathResultConstructor XPathResult;
         attribute XPathExceptionConstructor XPathException;
 #endif
 
-#if ENABLE_SVG
+#if defined(ENABLE_SVG) && ENABLE_SVG
         attribute SVGAngleConstructor SVGAngle;
         attribute SVGColorConstructor SVGColor;
 //      attribute SVGCSSRuleConstructor SVGCSSRule;
@@ -450,9 +515,8 @@
         attribute SVGTransformConstructor SVGTransform;
         attribute SVGUnitTypesConstructor SVGUnitTypes;
 //      attribute SVGZoomAndPanConstructor SVGZoomAndPan;
-#endif
 
-#if ENABLE_SVG_FILTERS
+#if defined(ENABLE_FILTERS) && ENABLE_FILTERS
         attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
         attribute SVGFEBlendElementConstructor SVGFEBlendElement;
         attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
@@ -462,28 +526,14 @@
 //      attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
         attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
 #endif
+#endif
 
 #endif // defined(LANGUAGE_JAVASCRIPT)
 
-#if defined(V8_BINDING)
-    // These were implemented in JSCDOMWindowBase and not moved to IDL yet.
-
-    [Custom] DOMWindow open(in DOMString url,
-                            in DOMString name,
-                            in [Optional] DOMString options);
-
-    [Custom] DOMObject showModalDialog(in DOMString url, 
-                                       in [Optional] DOMObject dialogArgs,
-                                       in [Optional] DOMString featureArgs);
-
-    // These are defined on JSDOMWindowBase, but not implemented.
-    [Custom=DOMWindowNOP] void captureEvents(in long eventFlags);
-    [Custom=DOMWindowNOP] void releaseEvents(in long eventFlags);
-
-    // window.toString requires special handling
-    [V8DoNotCheckSignature, DoNotCheckDomainSecurity, Custom, DontEnum] DOMString toString();
+#if defined(V8_BINDING) && V8_BINDING
+        // window.toString() requires special handling in V8
+        [V8DoNotCheckSignature, DoNotCheckDomainSecurity, Custom, DontEnum] DOMString toString();
 #endif // defined(V8_BINDING)
-  };
+    };
+
 }
-
-
diff --git a/WebCore/page/DragController.cpp b/WebCore/page/DragController.cpp
index cba109a..e1b5ea7 100644
--- a/WebCore/page/DragController.cpp
+++ b/WebCore/page/DragController.cpp
@@ -76,13 +76,13 @@
 DragController::DragController(Page* page, DragClient* client)
     : m_page(page)
     , m_client(client)
-    , m_document(0)
+    , m_documentUnderMouse(0)
     , m_dragInitiator(0)
     , m_dragDestinationAction(DragDestinationActionNone)
     , m_dragSourceAction(DragSourceActionNone)
     , m_didInitiateDrag(false)
     , m_isHandlingDrag(false)
-    , m_dragOperation(DragOperationNone)
+    , m_sourceDragOperation(DragOperationNone)
 {
 }
     
@@ -128,9 +128,10 @@
 
 bool DragController::dragIsMove(SelectionController* selection)
 {
-    return m_document == m_dragInitiator && selection->isContentEditable() && !isCopyKeyDown();
+    return m_documentUnderMouse == m_dragInitiator && selection->isContentEditable() && !isCopyKeyDown();
 }
 
+// FIXME: This method is poorly named.  We're just clearing the selection from the document this drag is exiting.
 void DragController::cancelDrag()
 {
     m_page->dragCaretController()->clear();
@@ -154,16 +155,15 @@
     Frame* mainFrame = m_page->mainFrame();
     
     if (RefPtr<FrameView> v = mainFrame->view()) {
-        ClipboardAccessPolicy policy = mainFrame->loader()->baseURL().isLocalFile() ? ClipboardReadable : ClipboardTypesReadable;
+        ClipboardAccessPolicy policy = (!m_documentUnderMouse || m_documentUnderMouse->securityOrigin()->isLocal()) ? ClipboardReadable : ClipboardTypesReadable;
         RefPtr<Clipboard> clipboard = dragData->createClipboard(policy);
         clipboard->setSourceOperation(dragData->draggingSourceOperationMask());
         mainFrame->eventHandler()->cancelDragAndDrop(createMouseEvent(dragData), clipboard.get());
         clipboard->setAccessPolicy(ClipboardNumb);    // invalidate clipboard here for security
     }
-
-    cancelDrag();
-    m_document = 0;
+    mouseMovedIntoDocument(0);
 }
+
     
 DragOperation DragController::dragUpdated(DragData* dragData) 
 {
@@ -173,7 +173,7 @@
 bool DragController::performDrag(DragData* dragData)
 {   
     ASSERT(dragData);
-    m_document = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
+    m_documentUnderMouse = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
     if (m_isHandlingDrag) {
         ASSERT(m_dragDestinationAction & DragDestinationActionDHTML);
         m_client->willPerformDragDestinationAction(DragDestinationActionDHTML, dragData);
@@ -185,16 +185,16 @@
             mainFrame->eventHandler()->performDragAndDrop(createMouseEvent(dragData), clipboard.get());
             clipboard->setAccessPolicy(ClipboardNumb);    // invalidate clipboard here for security
         }
-        m_document = 0;
+        m_documentUnderMouse = 0;
         return true;
     } 
     
     if ((m_dragDestinationAction & DragDestinationActionEdit) && concludeEditDrag(dragData)) {
-        m_document = 0;
+        m_documentUnderMouse = 0;
         return true;
     }
     
-    m_document = 0;
+    m_documentUnderMouse = 0;
 
     if (operationForLoad(dragData) == DragOperationNone)
         return false;
@@ -203,27 +203,30 @@
     m_page->mainFrame()->loader()->load(ResourceRequest(dragData->asURL()), false);
     return true;
 }
-    
+
+void DragController::mouseMovedIntoDocument(Document* newDocument)
+{
+    if (m_documentUnderMouse == newDocument)
+        return;
+
+    // If we were over another document clear the selection
+    if (m_documentUnderMouse)
+        cancelDrag();
+    m_documentUnderMouse = newDocument;
+}
+
 DragOperation DragController::dragEnteredOrUpdated(DragData* dragData)
 {
     ASSERT(dragData);
-    IntPoint windowPoint = dragData->clientPosition();
-    
-    Document* newDraggingDoc = 0;
-    if (Frame* frame = m_page->mainFrame())
-        newDraggingDoc = frame->documentAtPoint(windowPoint);
-    if (m_document != newDraggingDoc) {
-        if (m_document)
-            cancelDrag();
-        m_document = newDraggingDoc;
-    }
-    
+    ASSERT(m_page->mainFrame()); // It is not possible in Mac WebKit to have a Page without a mainFrame()
+    mouseMovedIntoDocument(m_page->mainFrame()->documentAtPoint(dragData->clientPosition()));
+
     m_dragDestinationAction = m_client->actionMaskForDrag(dragData);
     
     DragOperation operation = DragOperationNone;
     
     if (m_dragDestinationAction == DragDestinationActionNone)
-        cancelDrag();
+        cancelDrag(); // FIXME: Why not call mouseMovedIntoDocument(0)?
     else {
         operation = tryDocumentDrag(dragData, m_dragDestinationAction);
         if (operation == DragOperationNone && (m_dragDestinationAction & DragDestinationActionLoad))
@@ -257,7 +260,7 @@
 {
     ASSERT(dragData);
     
-    if (!m_document)
+    if (!m_documentUnderMouse)
         return DragOperationNone;
     
     DragOperation operation = DragOperationNone;
@@ -265,7 +268,7 @@
         operation = tryDHTMLDrag(dragData);
     m_isHandlingDrag = operation != DragOperationNone; 
 
-    RefPtr<FrameView> frameView = m_document->view();
+    RefPtr<FrameView> frameView = m_documentUnderMouse->view();
     if (!frameView)
         return operation;
     
@@ -275,17 +278,14 @@
         
         IntPoint dragPos = dragData->clientPosition();
         IntPoint point = frameView->windowToContents(dragPos);
-        Element* element = m_document->elementFromPoint(point.x(), point.y());
+        Element* element = m_documentUnderMouse->elementFromPoint(point.x(), point.y());
         ASSERT(element);
-        Frame* innerFrame = element->document()->frame();
-        ASSERT(innerFrame);
         if (!asFileInput(element)) {
-            VisibleSelection dragCaret;
-            if (Frame* frame = m_document->frame())
-                dragCaret = frame->visiblePositionForPoint(point);
+            VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
             m_page->dragCaretController()->setSelection(dragCaret);
         }
-        
+
+        Frame* innerFrame = element->document()->frame();
         return dragIsMove(innerFrame->selection()) ? DragOperationMove : DragOperationCopy;
     } 
     
@@ -302,8 +302,7 @@
 DragOperation DragController::operationForLoad(DragData* dragData)
 {
     ASSERT(dragData);
-    Document* doc = 0;
-    doc = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
+    Document* doc = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
     if (doc && (m_didInitiateDrag || doc->isPluginDocument() || (doc->frame() && doc->frame()->editor()->clientIsEditable())))
         return DragOperationNone;
     return dragOperation(dragData);
@@ -325,11 +324,11 @@
     ASSERT(dragData);
     ASSERT(!m_isHandlingDrag);
     
-    if (!m_document)
+    if (!m_documentUnderMouse)
         return false;
     
-    IntPoint point = m_document->view()->windowToContents(dragData->clientPosition());
-    Element* element =  m_document->elementFromPoint(point.x(), point.y());
+    IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
+    Element* element =  m_documentUnderMouse->elementFromPoint(point.x(), point.y());
     ASSERT(element);
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);    
@@ -341,7 +340,7 @@
         if (!innerFrame)
             return false;
         RefPtr<Range> innerRange = innerFrame->selection()->toNormalizedRange();
-        RefPtr<CSSStyleDeclaration> style = m_document->createCSSStyleDeclaration();
+        RefPtr<CSSStyleDeclaration> style = m_documentUnderMouse->createCSSStyleDeclaration();
         ExceptionCode ec;
         style->setProperty("color", color.name(), ec);
         if (!innerFrame->editor()->shouldApplyStyle(style.get(), innerRange.get()))
@@ -357,8 +356,7 @@
     }
     
     if (HTMLInputElement* fileInput = asFileInput(element)) {
-        
-        if (!fileInput->isEnabled())
+        if (!fileInput->isEnabledFormControl())
             return false;
         
         if (!dragData->containsFiles())
@@ -407,7 +405,7 @@
             applyCommand(MoveSelectionCommand::create(fragment, dragCaret.base(), smartMove));
         } else {
             if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-                applyCommand(ReplaceSelectionCommand::create(m_document, fragment, true, dragData->canSmartReplace(), chosePlainText)); 
+                applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, fragment, true, dragData->canSmartReplace(), chosePlainText)); 
         }    
     } else {
         String text = dragData->asPlainText();
@@ -418,7 +416,7 @@
         
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
         if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-            applyCommand(ReplaceSelectionCommand::create(m_document, createFragmentFromText(range.get(), text), true, false, true)); 
+            applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, createFragmentFromText(range.get(), text), true, false, true)); 
     }
     loader->setAllowStaleResources(false);
 
@@ -449,7 +447,7 @@
     if (!result.innerNonSharedNode()->isContentEditable())
         return false;
         
-    if (m_didInitiateDrag && m_document == m_dragInitiator && result.isSelected())
+    if (m_didInitiateDrag && m_documentUnderMouse == m_dragInitiator && result.isSelected())
         return false;
 
     return true;
@@ -458,20 +456,20 @@
 DragOperation DragController::tryDHTMLDrag(DragData* dragData)
 {   
     ASSERT(dragData);
-    ASSERT(m_document);
+    ASSERT(m_documentUnderMouse);
     DragOperation op = DragOperationNone;
-    RefPtr<Frame> frame = m_page->mainFrame();
-    RefPtr<FrameView> viewProtector = frame->view();
+    RefPtr<Frame> mainFrame = m_page->mainFrame();
+    RefPtr<FrameView> viewProtector = mainFrame->view();
     if (!viewProtector)
         return DragOperationNone;
     
-    ClipboardAccessPolicy policy = frame->loader()->baseURL().isLocalFile() ? ClipboardReadable : ClipboardTypesReadable;
+    ClipboardAccessPolicy policy = m_documentUnderMouse->securityOrigin()->isLocal() ? ClipboardReadable : ClipboardTypesReadable;
     RefPtr<Clipboard> clipboard = dragData->createClipboard(policy);
     DragOperation srcOp = dragData->draggingSourceOperationMask();
     clipboard->setSourceOperation(srcOp);
     
     PlatformMouseEvent event = createMouseEvent(dragData);
-    if (frame->eventHandler()->updateDragAndDrop(event, clipboard.get())) {
+    if (mainFrame->eventHandler()->updateDragAndDrop(event, clipboard.get())) {
         // *op unchanged if no source op was set
         if (!clipboard->destinationOperation(op)) {
             // The element accepted but they didn't pick an operation, so we pick one for them
@@ -606,7 +604,7 @@
     IntPoint mouseDraggedPoint = src->view()->windowToContents(dragEvent.pos());
     
     m_draggingImageURL = KURL();
-    m_dragOperation = srcOp;
+    m_sourceDragOperation = srcOp;
     
     DragImageRef dragImage = 0;
     IntPoint dragLoc(0, 0);
@@ -756,17 +754,10 @@
 // Manual drag caret manipulation
 void DragController::placeDragCaret(const IntPoint& windowPoint)
 {
-    Frame* mainFrame = m_page->mainFrame();    
-    Document* newDraggingDoc = mainFrame->documentAtPoint(windowPoint);
-    if (m_document != newDraggingDoc) {
-        if (m_document)
-            cancelDrag();
-        m_document = newDraggingDoc;
-    }
-    if (!m_document)
+    mouseMovedIntoDocument(m_page->mainFrame()->documentAtPoint(windowPoint));
+    if (!m_documentUnderMouse)
         return;
-    Frame* frame = m_document->frame();
-    ASSERT(frame);
+    Frame* frame = m_documentUnderMouse->frame();
     FrameView* frameView = frame->view();
     if (!frameView)
         return;
@@ -775,4 +766,4 @@
     m_page->dragCaretController()->setSelection(dragCaret);
 }
     
-}
+} // namespace WebCore
diff --git a/WebCore/page/DragController.h b/WebCore/page/DragController.h
index 3beff5a..6fe1f7f 100644
--- a/WebCore/page/DragController.h
+++ b/WebCore/page/DragController.h
@@ -64,8 +64,7 @@
         bool didInitiateDrag() const { return m_didInitiateDrag; }
         void setIsHandlingDrag(bool handling) { m_isHandlingDrag = handling; }
         bool isHandlingDrag() const { return m_isHandlingDrag; }
-        void setDragOperation(DragOperation dragOp) { m_dragOperation = dragOp; }
-        DragOperation dragOperation() const { return m_dragOperation; }       
+        DragOperation sourceDragOperation() const { return m_sourceDragOperation; }
         void setDraggingImageURL(const KURL& url) { m_draggingImageURL = url; }
         const KURL& draggingImageURL() const { return m_draggingImageURL; }
         void setDragInitiator(Document* initiator) { m_dragInitiator = initiator; m_didInitiateDrag = true; }
@@ -74,7 +73,7 @@
         const IntPoint& dragOffset() const { return m_dragOffset; }
         DragSourceAction dragSourceAction() const { return m_dragSourceAction; }
 
-        Document* document() const { return m_document; }
+        Document* documentUnderMouse() const { return m_documentUnderMouse; }
         DragDestinationAction dragDestinationAction() const { return m_dragDestinationAction; }
         DragSourceAction delegateDragSourceAction(const IntPoint& pagePoint);
         
@@ -104,6 +103,8 @@
         bool dragIsMove(SelectionController*);
         bool isCopyKeyDown();
 
+        void mouseMovedIntoDocument(Document*);
+
         IntRect selectionDraggingRect(Frame*);
         bool doDrag(Frame* src, Clipboard* clipboard, DragImageRef dragImage, const KURL& linkURL, const KURL& imageURL, Node* node, IntPoint& dragLoc, IntPoint& dragImageOffset);
         void doImageDrag(Element*, const IntPoint&, const IntRect&, Clipboard*, Frame*, IntPoint&);
@@ -113,17 +114,16 @@
         Page* m_page;
         DragClient* m_client;
         
-        Document* m_document; // The document the mouse was last dragged over.
+        Document* m_documentUnderMouse; // The document the mouse was last dragged over.
         Document* m_dragInitiator; // The Document (if any) that initiated the drag.
         
         DragDestinationAction m_dragDestinationAction;
         DragSourceAction m_dragSourceAction;
         bool m_didInitiateDrag;
         bool m_isHandlingDrag;
-        DragOperation m_dragOperation;
+        DragOperation m_sourceDragOperation; // Set in startDrag when a drag starts from a mouse down within WebKit
         IntPoint m_dragOffset;
         KURL m_draggingImageURL;
-        
     };
 
 }
diff --git a/WebCore/page/EditorClient.h b/WebCore/page/EditorClient.h
index 67462c5..cdf0bd8 100644
--- a/WebCore/page/EditorClient.h
+++ b/WebCore/page/EditorClient.h
@@ -61,11 +61,22 @@
     String userDescription;
 };
 
+enum TextCheckingType {
+    TextCheckingTypeSpelling    = 1 << 1,
+    TextCheckingTypeGrammar     = 1 << 2,
+    TextCheckingTypeLink        = 1 << 5,
+    TextCheckingTypeQuote       = 1 << 6,
+    TextCheckingTypeDash        = 1 << 7,
+    TextCheckingTypeReplacement = 1 << 8,
+    TextCheckingTypeCorrection  = 1 << 9
+};
+
 struct TextCheckingResult {
-    int resultType; // 1 for spelling, 2 for grammar
+    TextCheckingType type;
     int location;
     int length;
     Vector<GrammarDetail> details;
+    String replacement;
 };
  
 class EditorClient {
@@ -133,12 +144,32 @@
 #endif
 #endif
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    virtual void uppercaseWord() = 0;
+    virtual void lowercaseWord() = 0;
+    virtual void capitalizeWord() = 0;
+    virtual void showSubstitutionsPanel(bool show) = 0;
+    virtual bool substitutionsPanelIsShowing() = 0;
+    virtual void toggleSmartInsertDelete() = 0;
+    virtual bool isAutomaticQuoteSubstitutionEnabled() = 0;
+    virtual void toggleAutomaticQuoteSubstitution() = 0;
+    virtual bool isAutomaticLinkDetectionEnabled() = 0;
+    virtual void toggleAutomaticLinkDetection() = 0;
+    virtual bool isAutomaticDashSubstitutionEnabled() = 0;
+    virtual void toggleAutomaticDashSubstitution() = 0;
+    virtual bool isAutomaticTextReplacementEnabled() = 0;
+    virtual void toggleAutomaticTextReplacement() = 0;
+    virtual bool isAutomaticSpellingCorrectionEnabled() = 0;
+    virtual void toggleAutomaticSpellingCorrection() = 0;
+#endif
+
     virtual void ignoreWordInSpellDocument(const String&) = 0;
     virtual void learnWord(const String&) = 0;
     virtual void checkSpellingOfString(const UChar*, int length, int* misspellingLocation, int* misspellingLength) = 0;
+    virtual String getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord) = 0;
     virtual void checkGrammarOfString(const UChar*, int length, Vector<GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength) = 0;
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    virtual void checkSpellingAndGrammarOfParagraph(const UChar* text, int length, bool checkGrammar, Vector<TextCheckingResult>& results) = 0;
+    virtual void checkTextOfParagraph(const UChar* text, int length, uint64_t checkingTypes, Vector<TextCheckingResult>& results) = 0;
 #endif
     virtual void updateSpellingUIWithGrammarString(const String&, const GrammarDetail& detail) = 0;
     virtual void updateSpellingUIWithMisspelledWord(const String&) = 0;
@@ -151,3 +182,4 @@
 }
 
 #endif // EditorClient_h
+
diff --git a/WebCore/page/EventHandler.cpp b/WebCore/page/EventHandler.cpp
index 7e79792..1031a3d 100644
--- a/WebCore/page/EventHandler.cpp
+++ b/WebCore/page/EventHandler.cpp
@@ -42,12 +42,12 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
-#include "HitTestRequest.h"
-#include "HitTestResult.h"
-#include "HTMLFrameSetElement.h"
 #include "HTMLFrameElementBase.h"
+#include "HTMLFrameSetElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "HitTestRequest.h"
+#include "HitTestResult.h"
 #include "Image.h"
 #include "InspectorController.h"
 #include "KeyboardEvent.h"
@@ -58,12 +58,13 @@
 #include "PlatformWheelEvent.h"
 #include "RenderFrameSet.h"
 #include "RenderTextControlSingleLine.h"
-#include "RenderWidget.h"
 #include "RenderView.h"
+#include "RenderWidget.h"
 #include "Scrollbar.h"
 #include "SelectionController.h"
 #include "Settings.h"
 #include "TextEvent.h"
+#include "htmlediting.h" // for comparePositions()
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(SVG)
@@ -122,6 +123,20 @@
         e.accept();
 }
 
+#if !PLATFORM(MAC)
+
+inline bool EventHandler::eventLoopHandleMouseUp(const MouseEventWithHitTestResults&)
+{
+    return false;
+}
+
+inline bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&)
+{
+    return false;
+}
+
+#endif
+
 EventHandler::EventHandler(Frame* frame)
     : m_frame(frame)
     , m_mousePressed(false)
@@ -144,8 +159,6 @@
     , m_capturingMouseEventsNode(0)
     , m_clickCount(0)
     , m_mouseDownTimestamp(0)
-    , m_pendingFrameUnloadEventCount(0)
-    , m_pendingFrameBeforeUnloadEventCount(0)
 #if PLATFORM(MAC)
     , m_mouseDownView(nil)
     , m_sendingEventToSubview(false)
@@ -293,10 +306,12 @@
 
     // Don't restart the selection when the mouse is pressed on an
     // existing selection so we can allow for text dragging.
-    IntPoint vPoint = m_frame->view()->windowToContents(event.event().pos());
-    if (!extendSelection && m_frame->selection()->contains(vPoint)) {
-        m_mouseDownWasSingleClickInSelection = true;
-        return false;
+    if (FrameView* view = m_frame->view()) {
+        IntPoint vPoint = view->windowToContents(event.event().pos());
+        if (!extendSelection && m_frame->selection()->contains(vPoint)) {
+            m_mouseDownWasSingleClickInSelection = true;
+            return false;
+        }
     }
 
     VisiblePosition visiblePos(innerNode->renderer()->positionForPoint(event.localPoint()));
@@ -312,8 +327,7 @@
         // was created right-to-left
         Position start = newSelection.start();
         Position end = newSelection.end();
-        short before = Range::compareBoundaryPoints(pos.node(), pos.m_offset, start.node(), start.m_offset);
-        if (before <= 0)
+        if (comparePositions(pos, start) <= 0)
             newSelection = VisibleSelection(pos, end);
         else
             newSelection = VisibleSelection(start, pos);
@@ -437,8 +451,10 @@
     // that its logic needs to stay in sync with handleMouseMoveEvent() and the way we setMouseDownMayStartDrag
     // in handleMousePressEvent
     
-    if (!m_frame->contentRenderer() || !m_frame->contentRenderer()->hasLayer()
-        || event.button() != LeftButton || event.clickCount() != 1)
+    if (!m_frame->contentRenderer() || !m_frame->contentRenderer()->hasLayer())
+        return false;
+
+    if (event.button() != LeftButton || event.clickCount() != 1)
         return false;
     
     bool DHTMLFlag;
@@ -446,9 +462,13 @@
     allowDHTMLDrag(DHTMLFlag, UAFlag);
     if (!DHTMLFlag && !UAFlag)
         return false;
-    
+
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+
     HitTestRequest request(HitTestRequest::ReadOnly);
-    HitTestResult result(m_frame->view()->windowToContents(event.pos()));
+    HitTestResult result(view->windowToContents(event.pos()));
     m_frame->contentRenderer()->layer()->hitTest(request, result);
     bool srcIsDHTML;
     return result.innerNode() && result.innerNode()->renderer()->draggableNode(DHTMLFlag, UAFlag, result.point().x(), result.point().y(), srcIsDHTML);
@@ -557,15 +577,18 @@
   
     bool handled = false;
 
-    // Clear the selection if the mouse didn't move after the last mouse press.
-    // We do this so when clicking on the selection, the selection goes away.
-    // However, if we are editing, place the caret.
+    // Clear the selection if the mouse didn't move after the last mouse
+    // press and it's not a context menu click.  We do this so when clicking
+    // on the selection, the selection goes away.  However, if we are
+    // editing, place the caret.
     if (m_mouseDownWasSingleClickInSelection && !m_beganSelectingText
             && m_dragStartPos == event.event().pos()
-            && m_frame->selection()->isRange()) {
+            && m_frame->selection()->isRange()
+            && event.event().button() != RightButton) {
         VisibleSelection newSelection;
         Node *node = event.targetNode();
-        if (node && node->isContentEditable() && node->renderer()) {
+        bool caretBrowsing = m_frame->settings()->caretBrowsingEnabled();
+        if (node && (caretBrowsing || node->isContentEditable()) && node->renderer()) {
             VisiblePosition pos = node->renderer()->positionForPoint(event.localPoint());
             newSelection = VisibleSelection(pos);
         }
@@ -593,10 +616,14 @@
 #if ENABLE(PAN_SCROLLING)
     if (m_panScrollInProgress) {
         m_panScrollStartPos = currentMousePosition();
-        m_frame->view()->addPanScrollIcon(m_panScrollStartPos);
-        // If we're not in the top frame we notify it that we are using the panScroll
-        if (m_frame != m_frame->page()->mainFrame())
-            m_frame->page()->mainFrame()->eventHandler()->setPanScrollInProgress(true);
+        if (FrameView* view = m_frame->view())
+            view->addPanScrollIcon(m_panScrollStartPos);
+        // If we're not in the top frame we notify it that we doing a panScroll.
+        if (Page* page = m_frame->page()) {
+            Frame* mainFrame = page->mainFrame();
+            if (m_frame != mainFrame)
+                mainFrame->eventHandler()->setPanScrollInProgress(true);
+        }
     }
 #endif
 
@@ -619,9 +646,11 @@
         toRenderBox(r)->autoscroll();
     } else {
         // we verify that the main frame hasn't received the order to stop the panScroll
-        if (!m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress()) {
-            stopAutoscrollTimer();
-            return;
+        if (Page* page = m_frame->page()) {
+            if (!page->mainFrame()->eventHandler()->panScrollInProgress()) {
+                stopAutoscrollTimer();
+                return;
+            }
         }
 #if ENABLE(PAN_SCROLLING)
         setPanScrollCursor();
@@ -631,8 +660,13 @@
 }
 
 #if ENABLE(PAN_SCROLLING)
+
 void EventHandler::setPanScrollCursor()
 {
+    FrameView* view = m_frame->view();
+    if (!view)
+        return;
+
     // At the original click location we draw a 4 arrowed icon. Over this icon there won't be any scroll
     // So we don't want to change the cursor over this area
     const int noScrollRadius = 9;
@@ -643,25 +677,26 @@
          
     if (north) {
         if (east)
-            m_frame->view()->setCursor(northEastPanningCursor());
+            view->setCursor(northEastPanningCursor());
         else if (west)
-            m_frame->view()->setCursor(northWestPanningCursor());
+            view->setCursor(northWestPanningCursor());
         else
-            m_frame->view()->setCursor(northPanningCursor());
+            view->setCursor(northPanningCursor());
     } else if (south) {
         if (east)
-            m_frame->view()->setCursor(southEastPanningCursor());
+            view->setCursor(southEastPanningCursor());
         else if (west)
-            m_frame->view()->setCursor(southWestPanningCursor());
+            view->setCursor(southWestPanningCursor());
         else
-            m_frame->view()->setCursor(southPanningCursor());
+            view->setCursor(southPanningCursor());
     } else if (east)
-        m_frame->view()->setCursor(eastPanningCursor());
+        view->setCursor(eastPanningCursor());
     else if (west)
-        m_frame->view()->setCursor(westPanningCursor());
+        view->setCursor(westPanningCursor());
     else
-        m_frame->view()->setCursor(middlePanningCursor());
+        view->setCursor(middlePanningCursor());
 }
+
 #endif  // ENABLE(PAN_SCROLLING)
 
 RenderObject* EventHandler::autoscrollRenderer() const
@@ -690,13 +725,21 @@
 
 void EventHandler::allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const
 {
-    if (!m_frame) {
-        flagDHTML = false;
-        flagUA = false;
+    flagDHTML = false;
+    flagUA = false;
+
+    if (!m_frame)
         return;
-    }
-    
-    unsigned mask = m_frame->page()->dragController()->delegateDragSourceAction(m_frame->view()->contentsToWindow(m_mouseDownPos));
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    FrameView* view = m_frame->view();
+    if (!view)
+        return;
+
+    unsigned mask = page->dragController()->delegateDragSourceAction(view->contentsToWindow(m_mouseDownPos));
     flagDHTML = (mask & DragSourceActionDHTML) != DragSourceActionNone;
     flagUA = ((mask & DragSourceActionImage) || (mask & DragSourceActionLink) || (mask & DragSourceActionSelection));
 }
@@ -733,11 +776,17 @@
     // If our HitTestResult is not visible, then we started hit testing too far down the frame chain. 
     // Another hit test at the main frame level should get us the correct visible result.
     Frame* resultFrame = result.innerNonSharedNode() ? result.innerNonSharedNode()->document()->frame() : 0;
-    Frame* mainFrame = m_frame->page()->mainFrame();
-    if (m_frame != mainFrame && resultFrame && resultFrame != mainFrame && !resultFrame->editor()->insideVisibleArea(result.point())) {
-        IntPoint windowPoint = resultFrame->view()->contentsToWindow(result.point());
-        IntPoint mainFramePoint = mainFrame->view()->windowToContents(windowPoint);
-        result = mainFrame->eventHandler()->hitTestResultAtPoint(mainFramePoint, allowShadowContent, ignoreClipping);
+    if (Page* page = m_frame->page()) {
+        Frame* mainFrame = page->mainFrame();
+        if (m_frame != mainFrame && resultFrame && resultFrame != mainFrame && !resultFrame->editor()->insideVisibleArea(result.point())) {
+            FrameView* resultView = resultFrame->view();
+            FrameView* mainView = mainFrame->view();
+            if (resultView && mainView) {
+                IntPoint windowPoint = resultView->contentsToWindow(result.point());
+                IntPoint mainFramePoint = mainView->windowToContents(windowPoint);
+                result = mainFrame->eventHandler()->hitTestResultAtPoint(mainFramePoint, allowShadowContent, ignoreClipping);
+            }
+        }
     }
 
     if (!allowShadowContent)
@@ -767,8 +816,10 @@
             toRenderBox(autoscrollRenderer())->stopAutoscroll();
 #if ENABLE(PAN_SCROLLING)
         if (m_panScrollInProgress) {
-            m_frame->view()->removePanScrollIcon();
-            m_frame->view()->setCursor(pointerCursor());
+            if (FrameView* view = m_frame->view()) {
+                view->removePanScrollIcon();
+                view->setCursor(pointerCursor());
+            }
         }
 #endif
 
@@ -778,9 +829,14 @@
     m_autoscrollTimer.stop();
 
     m_panScrollInProgress = false;
-    // If we're not in the top frame we notify it that we are not using the panScroll anymore
-    if (m_frame->page() && m_frame != m_frame->page()->mainFrame())
-            m_frame->page()->mainFrame()->eventHandler()->setPanScrollInProgress(false);
+
+    // If we're not in the top frame we notify it that we are not doing a panScroll any more.
+    if (Page* page = m_frame->page()) {
+        Frame* mainFrame = page->mainFrame();
+        if (m_frame != mainFrame)
+            mainFrame->eventHandler()->setPanScrollInProgress(false);
+    }
+
     m_autoscrollInProgress = false;
 }
 
@@ -920,10 +976,13 @@
             
             if ((event.isOverLink() || isSubmitImage(node)) && (!editable || editableLinkEnabled))
                 return handCursor();
-            RenderLayer* layer = renderer ? renderer->enclosingLayer() : 0;
             bool inResizer = false;
-            if (m_frame->view() && layer && layer->isPointInResizeControl(m_frame->view()->windowToContents(event.event().pos())))
-                inResizer = true;
+            if (renderer) {
+                if (RenderLayer* layer = renderer->enclosingLayer()) {
+                    if (FrameView* view = m_frame->view())
+                        inResizer = layer->isPointInResizeControl(view->windowToContents(event.event().pos()));
+                }
+            }
             if ((editable || (renderer && renderer->isText() && node->canStartSelection())) && !inResizer && !scrollbar)
                 return iBeamCursor();
             return pointerCursor();
@@ -1001,6 +1060,14 @@
     }
     return pointerCursor();
 }
+    
+static IntPoint documentPointForWindowPoint(Frame* frame, const IntPoint& windowPoint)
+{
+    FrameView* view = frame->view();
+    // FIXME: Is it really OK to use the wrong coordinates here when view is 0?
+    // Historically the code would just crash; this is clearly no worse than that.
+    return view ? view->windowToContents(windowPoint) : windowPoint;
+}
 
 bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 {
@@ -1013,11 +1080,19 @@
     m_mouseDownMayStartDrag = false;
     m_mouseDownMayStartSelect = false;
     m_mouseDownMayStartAutoscroll = false;
-    m_mouseDownPos = m_frame->view()->windowToContents(mouseEvent.pos());
+    if (FrameView* view = m_frame->view())
+        m_mouseDownPos = view->windowToContents(mouseEvent.pos());
+    else {
+        invalidateClick();
+        return false;
+    }
     m_mouseDownWasInSubframe = false;
 
     HitTestRequest request(HitTestRequest::Active);
-    MouseEventWithHitTestResults mev = prepareMouseEvent(request, mouseEvent);
+    // Save the document point we generate in case the window coordinate is invalidated by what happens 
+    // when we dispatch the event.
+    IntPoint documentPoint = documentPointForWindowPoint(m_frame, mouseEvent.pos());
+    MouseEventWithHitTestResults mev = m_frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
 
     if (!mev.targetNode()) {
         invalidateClick();
@@ -1026,11 +1101,13 @@
 
     m_mousePressNode = mev.targetNode();
 
-    InspectorController* inspector = m_frame->page()->inspectorController();
-    if (inspector && inspector->enabled() && inspector->searchingForNodeInPage()) {
-        inspector->handleMousePressOnNode(m_mousePressNode.get());
-        invalidateClick();
-        return true;
+    if (Page* page = m_frame->page()) {
+        InspectorController* inspector = page->inspectorController();
+        if (inspector && inspector->enabled() && inspector->searchingForNodeInPage()) {
+            inspector->handleMousePressOnNode(m_mousePressNode.get());
+            invalidateClick();
+            return true;
+        }
     }
 
     Frame* subframe = subframeForHitTestResult(mev);
@@ -1045,12 +1122,13 @@
     }
 
 #if ENABLE(PAN_SCROLLING)
-    if (m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
+    Page* page = m_frame->page();
+    if (page && page->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
         stopAutoscrollTimer();
         invalidateClick();
         return true;
     }
-    
+
     if (mouseEvent.button() == MiddleButton && !mev.isOverLink()) {
         RenderObject* renderer = mev.targetNode()->renderer();
 
@@ -1072,15 +1150,17 @@
 
     m_clickCount = mouseEvent.clickCount();
     m_clickNode = mev.targetNode();
-    
-    RenderLayer* layer = m_clickNode->renderer() ? m_clickNode->renderer()->enclosingLayer() : 0;
-    IntPoint p = m_frame->view()->windowToContents(mouseEvent.pos());
-    if (layer && layer->isPointInResizeControl(p)) {
-        layer->setInResizeMode(true);
-        m_resizeLayer = layer;
-        m_offsetFromResizeCorner = layer->offsetFromResizeCorner(p);
-        invalidateClick();
-        return true;
+
+    if (FrameView* view = m_frame->view()) {
+        RenderLayer* layer = m_clickNode->renderer() ? m_clickNode->renderer()->enclosingLayer() : 0;
+        IntPoint p = view->windowToContents(mouseEvent.pos());
+        if (layer && layer->isPointInResizeControl(p)) {
+            layer->setInResizeMode(true);
+            m_resizeLayer = layer;
+            m_offsetFromResizeCorner = layer->offsetFromResizeCorner(p);
+            invalidateClick();
+            return true;
+        }
     }
 
     bool swallowEvent = dispatchMouseEvent(eventNames().mousedownEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
@@ -1090,10 +1170,8 @@
     // in case the scrollbar widget was destroyed when the mouse event was handled.
     if (mev.scrollbar()) {
         const bool wasLastScrollBar = mev.scrollbar() == m_lastScrollbarUnderMouse.get();
-        HitTestRequest request(HitTestRequest::ReadOnly |
-                               HitTestRequest::Active);
-        mev = prepareMouseEvent(request, mouseEvent);
-
+        HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+        mev = m_frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
         if (wasLastScrollBar && mev.scrollbar() != m_lastScrollbarUnderMouse.get())
             m_lastScrollbarUnderMouse = 0;
     }
@@ -1108,12 +1186,12 @@
         // we'd like to EventHandler::handleMousePressEvent to pass the event to the widget and thus the
         // event target node can't still be the shadow node.
         if (mev.targetNode()->isShadowNode() && mev.targetNode()->shadowParentNode()->hasTagName(inputTag)) {
-            HitTestRequest request(HitTestRequest::ReadOnly |
-                                   HitTestRequest::Active);
-            mev = prepareMouseEvent(request, mouseEvent);
+            HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+            mev = m_frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
         }
 
-        Scrollbar* scrollbar = m_frame->view()->scrollbarUnderMouse(mouseEvent);
+        FrameView* view = m_frame->view();
+        Scrollbar* scrollbar = view ? view->scrollbarUnderMouse(mouseEvent) : 0;
         if (!scrollbar)
             scrollbar = mev.scrollbar();
         if (scrollbar && passMousePressEventToScrollbar(mev, scrollbar))
@@ -1226,8 +1304,8 @@
     if (m_resizeLayer && m_resizeLayer->inResizeMode())
         m_resizeLayer->resize(mouseEvent, m_offsetFromResizeCorner);
     else {
-        if (m_frame->view())
-            scrollbar = m_frame->view()->scrollbarUnderMouse(mouseEvent);
+        if (FrameView* view = m_frame->view())
+            scrollbar = view->scrollbarUnderMouse(mouseEvent);
 
         if (!scrollbar)
             scrollbar = mev.scrollbar();
@@ -1258,8 +1336,12 @@
     } else {
         if (scrollbar && !m_mousePressed)
             scrollbar->mouseMoved(scrollbar->transformEvent(mouseEvent)); // Handle hover effects on platforms that support visual feedback on scrollbar hovering.
-        if ((!m_resizeLayer || !m_resizeLayer->inResizeMode()) && !m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress() && m_frame->view())
-            m_frame->view()->setCursor(selectCursor(mev, scrollbar));
+        if (Page* page = m_frame->page()) {
+            if ((!m_resizeLayer || !m_resizeLayer->inResizeMode()) && !page->mainFrame()->eventHandler()->panScrollInProgress()) {
+                if (FrameView* view = m_frame->view())
+                    view->setCursor(selectCursor(mev, scrollbar));
+            }
+        }
     }
     
     m_lastMouseMoveEventSubframe = newSubframe;
@@ -1334,17 +1416,22 @@
 
 bool EventHandler::dispatchDragEvent(const AtomicString& eventType, Node* dragTarget, const PlatformMouseEvent& event, Clipboard* clipboard)
 {
-    m_frame->view()->resetDeferredRepaintDelay();
+    FrameView* view = m_frame->view();
 
-    IntPoint contentsPos = m_frame->view()->windowToContents(event.pos());
-    
+    // FIXME: We might want to dispatch a dragleave even if the view is gone.
+    if (!view)
+        return false;
+
+    view->resetDeferredRepaintDelay();
+    IntPoint contentsPos = view->windowToContents(event.pos());
+
     RefPtr<MouseEvent> me = MouseEvent::create(eventType,
         true, true, m_frame->document()->defaultView(),
         0, event.globalX(), event.globalY(), contentsPos.x(), contentsPos.y(),
         event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
         0, 0, clipboard);
 
-    ExceptionCode ec = 0;
+    ExceptionCode ec;
     dragTarget->dispatchEvent(me.get(), ec);
     return me->defaultPrevented();
 }
@@ -1445,8 +1532,7 @@
     ASSERT(m_frame);
     ASSERT(m_frame->document());
     
-    IntPoint documentPoint = m_frame->view()->windowToContents(mev.pos());
-    return m_frame->document()->prepareMouseEvent(request, documentPoint, mev);
+    return m_frame->document()->prepareMouseEvent(request, documentPointForWindowPoint(m_frame, mev.pos()), mev);
 }
 
 #if ENABLE(SVG)
@@ -1545,7 +1631,8 @@
 
 bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targetNode, bool /*cancelable*/, int clickCount, const PlatformMouseEvent& mouseEvent, bool setUnder)
 {
-    m_frame->view()->resetDeferredRepaintDelay();
+    if (FrameView* view = m_frame->view())
+        view->resetDeferredRepaintDelay();
 
     updateMouseEventTargetNode(targetNode, mouseEvent, setUnder);
 
@@ -1582,14 +1669,17 @@
             
             renderer = renderer->parent();
         }
+
         // If focus shift is blocked, we eat the event.  Note we should never clear swallowEvent
         // if the page already set it (e.g., by canceling default behavior).
-        if (node && node->isMouseFocusable()) {
-            if (!m_frame->page()->focusController()->setFocusedNode(node, m_frame))
-                swallowEvent = true;
-        } else if (!node || !node->focused()) {
-            if (!m_frame->page()->focusController()->setFocusedNode(0, m_frame))
-                swallowEvent = true;
+        if (Page* page = m_frame->page()) {
+            if (node && node->isMouseFocusable()) {
+                if (!page->focusController()->setFocusedNode(node, m_frame))
+                    swallowEvent = true;
+            } else if (!node || !node->focused()) {
+                if (!page->focusController()->setFocusedNode(0, m_frame))
+                    swallowEvent = true;
+            }
         }
     }
 
@@ -1606,7 +1696,10 @@
     
     RefPtr<FrameView> protector(m_frame->view());
 
-    IntPoint vPoint = m_frame->view()->windowToContents(e.pos());
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+    IntPoint vPoint = view->windowToContents(e.pos());
 
     HitTestRequest request(HitTestRequest::ReadOnly);
     HitTestResult result(vPoint);
@@ -1644,9 +1737,14 @@
         }
     }
 
-    if (!e.isAccepted())
-        m_frame->view()->wheelEvent(e);
-    
+    if (e.isAccepted())
+        return true;
+
+    view = m_frame->view();
+    if (!view)
+        return false;
+
+    view->wheelEvent(e);
     return e.isAccepted();
 }
 
@@ -1699,7 +1797,7 @@
             
     for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
         if (Node* node = curr->node())
-            return node->dispatchEventForType(eventNames().selectstartEvent, true, true);
+            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
     }
 
     return true;
@@ -1712,7 +1810,7 @@
             
     for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
         if (Node* node = curr->node())
-            return node->dispatchEventForType(eventNames().selectstartEvent, true, true);
+            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
     }
 
     return true;
@@ -1737,10 +1835,12 @@
     ASSERT(m_frame->document());
 
     if (RenderView* renderer = m_frame->contentRenderer()) {
-        HitTestRequest request(HitTestRequest::MouseMove);
-        HitTestResult result(m_frame->view()->windowToContents(m_currentMousePosition));
-        renderer->layer()->hitTest(request, result);
-        m_frame->document()->updateRendering();
+        if (FrameView* view = m_frame->view()) {
+            HitTestRequest request(HitTestRequest::MouseMove);
+            HitTestResult result(view->windowToContents(m_currentMousePosition));
+            renderer->layer()->hitTest(request, result);
+            m_frame->document()->updateStyleIfNeeded();
+        }
     }
 }
 
@@ -1783,14 +1883,17 @@
 bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
 {
 #if ENABLE(PAN_SCROLLING)
-    if (m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
-        String escKeyId = "U+001B";
-        // If a key is pressed while the autoscroll/panScroll is in progress then we want to stop
-        if (initialKeyEvent.keyIdentifier() == escKeyId && initialKeyEvent.type() == PlatformKeyboardEvent::KeyUp) 
-            stopAutoscrollTimer();
+    if (Page* page = m_frame->page()) {
+        if (page->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
+            static const char* const escapeKeyIdentifier = "U+001B";
 
-        // If we were in autoscroll/panscroll mode, we swallow the key event
-        return true;
+            // If a key is pressed while the autoscroll/panScroll is in progress then we want to stop
+            if (initialKeyEvent.keyIdentifier() == escapeKeyIdentifier && initialKeyEvent.type() == PlatformKeyboardEvent::KeyUp) 
+                stopAutoscrollTimer();
+
+            // If we were in autoscroll/panscroll mode, we swallow the key event
+            return true;
+        }
     }
 #endif
 
@@ -1799,8 +1902,9 @@
     RefPtr<Node> node = eventTargetNodeForDocument(m_frame->document());
     if (!node)
         return false;
-    
-    m_frame->view()->resetDeferredRepaintDelay();
+
+    if (FrameView* view = m_frame->view())
+        view->resetDeferredRepaintDelay();
 
     // FIXME: what is this doing here, in keyboard event handler?
     m_frame->loader()->resetMultipleFormSubmissionProtection();
@@ -1887,21 +1991,22 @@
     String key = event->keyIdentifier();           
     bool isShifted = event->getModifierState("Shift");
     bool isOptioned = event->getModifierState("Alt");
+    bool isCommanded = event->getModifierState("Meta");
     
     if (key == "Up") {
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::BACKWARD, LineGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::BACKWARD, (isCommanded) ? DocumentBoundary : LineGranularity, true);
         event->setDefaultHandled();
     }
     else if (key == "Down") { 
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::FORWARD, LineGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::FORWARD, (isCommanded) ? DocumentBoundary : LineGranularity, true);
         event->setDefaultHandled();
     }
     else if (key == "Left") {
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::LEFT, (isOptioned) ? WordGranularity : CharacterGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::LEFT, (isCommanded) ? LineBoundary : (isOptioned) ? WordGranularity : CharacterGranularity, true);
         event->setDefaultHandled();
     }
     else if (key == "Right") {
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::RIGHT, (isOptioned) ? WordGranularity : CharacterGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::RIGHT, (isCommanded) ? LineBoundary : (isOptioned) ? WordGranularity : CharacterGranularity, true);
         event->setDefaultHandled();
     }    
 }
@@ -1936,7 +2041,10 @@
     
 bool EventHandler::dragHysteresisExceeded(const IntPoint& dragViewportLocation) const
 {
-    IntPoint dragLocation = m_frame->view()->windowToContents(dragViewportLocation);
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+    IntPoint dragLocation = view->windowToContents(dragViewportLocation);
     IntSize delta = dragLocation - m_mouseDownPos;
     
     int threshold = GeneralDragHysteresis;
@@ -1960,7 +2068,8 @@
 {
     if (!node || node->hasChildNodes() || !m_frame->view())
         return false;
-    return m_frame->page() && m_frame->page()->dragController()->mayStartDragAtEventLocation(m_frame, point);
+    Page* page = m_frame->page();
+    return page && page->dragController()->mayStartDragAtEventLocation(m_frame, point);
 }
     
 void EventHandler::dragSourceMovedTo(const PlatformMouseEvent& event)
@@ -2049,7 +2158,8 @@
         return !mouseDownMayStartSelect() && !m_mouseDownMayStartAutoscroll;
     
     // We are starting a text/image/url drag, so the cursor should be an arrow
-    m_frame->view()->setCursor(pointerCursor());
+    if (FrameView* view = m_frame->view())
+        view->setCursor(pointerCursor());
     
     if (!dragHysteresisExceeded(event.event().pos())) 
         return true;
@@ -2099,7 +2209,8 @@
     }
     
     if (m_mouseDownMayStartDrag) {
-        DragController* dragController = m_frame->page() ? m_frame->page()->dragController() : 0;
+        Page* page = m_frame->page();
+        DragController* dragController = page ? page->dragController() : 0;
         bool startedDrag = dragController && dragController->startDrag(m_frame, dragState().m_dragClipboard.get(), srcOp, event.event(), m_mouseDownPos, dragState().m_dragSrcIsDHTML);
         if (!startedDrag && dragState().m_dragSrcMayBeDHTML) {
             // Drag was canned at the last minute - we owe m_dragSrc a DRAGEND event
@@ -2136,7 +2247,8 @@
     if (!target)
         return false;
     
-    m_frame->view()->resetDeferredRepaintDelay();
+    if (FrameView* view = m_frame->view())
+        view->resetDeferredRepaintDelay();
 
     RefPtr<TextEvent> event = TextEvent::create(m_frame->domWindow(), text);
     event->setUnderlyingEvent(underlyingEvent);
@@ -2247,33 +2359,6 @@
     }
 }
 
-unsigned EventHandler::pendingFrameUnloadEventCount()
-{
-    return m_pendingFrameUnloadEventCount;
-}
-
-void EventHandler::addPendingFrameUnloadEventCount() 
-{
-    m_pendingFrameUnloadEventCount += 1;
-    m_frame->page()->changePendingUnloadEventCount(1);
-    return; 
-}
-    
-void EventHandler::removePendingFrameUnloadEventCount() 
-{
-    ASSERT( (-1 + (int)m_pendingFrameUnloadEventCount) >= 0 );
-    m_pendingFrameUnloadEventCount -= 1;
-    m_frame->page()->changePendingUnloadEventCount(-1);
-    return; 
-}
-    
-void EventHandler::clearPendingFrameUnloadEventCount() 
-{
-    m_frame->page()->changePendingUnloadEventCount(-((int)m_pendingFrameUnloadEventCount));
-    m_pendingFrameUnloadEventCount = 0;
-    return; 
-}
-
 void EventHandler::sendResizeEvent()
 {
     m_frame->document()->dispatchWindowEvent(eventNames().resizeEvent, false, false);
@@ -2285,34 +2370,7 @@
     if (!v)
         return;
     v->setWasScrolledByUser(true);
-    m_frame->document()->dispatchEventForType(eventNames().scrollEvent, true, false);
-}
-
-unsigned EventHandler::pendingFrameBeforeUnloadEventCount()
-{
-    return m_pendingFrameBeforeUnloadEventCount;
-}
-
-void EventHandler::addPendingFrameBeforeUnloadEventCount() 
-{
-    m_pendingFrameBeforeUnloadEventCount += 1;
-    m_frame->page()->changePendingBeforeUnloadEventCount(1);
-    return; 
-}
-    
-void EventHandler::removePendingFrameBeforeUnloadEventCount() 
-{
-    ASSERT( (-1 + (int)m_pendingFrameBeforeUnloadEventCount) >= 0 );
-    m_pendingFrameBeforeUnloadEventCount -= 1;
-    m_frame->page()->changePendingBeforeUnloadEventCount(-1);
-    return; 
-}
-
-    void EventHandler::clearPendingFrameBeforeUnloadEventCount() 
-{
-    m_frame->page()->changePendingBeforeUnloadEventCount(-((int)m_pendingFrameBeforeUnloadEventCount));
-    m_pendingFrameBeforeUnloadEventCount = 0;
-    return; 
+    m_frame->document()->dispatchEvent(eventNames().scrollEvent, true, false);
 }
 
 bool EventHandler::passMousePressEventToScrollbar(MouseEventWithHitTestResults& mev, Scrollbar* scrollbar)
diff --git a/WebCore/page/EventHandler.h b/WebCore/page/EventHandler.h
index 0a59eb3..0ad70c2 100644
--- a/WebCore/page/EventHandler.h
+++ b/WebCore/page/EventHandler.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,22 +27,15 @@
 #define EventHandler_h
 
 #include "DragActions.h"
-#include "FocusDirection.h"
 #include "PlatformMouseEvent.h"
 #include "ScrollTypes.h"
 #include "Timer.h"
 #include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/Platform.h>
 #include <wtf/RefPtr.h>
 
-#if PLATFORM(MAC)
-#include "WebCoreKeyboardUIMode.h"
-#ifndef __OBJC__
-class NSEvent;
+#if PLATFORM(MAC) && !defined(__OBJC__)
 class NSView;
 #endif
-#endif
 
 namespace WebCore {
 
@@ -51,7 +44,6 @@
 class Cursor;
 class Event;
 class FloatPoint;
-class FloatRect;
 class Frame;
 class HitTestRequest;
 class HitTestResult;
@@ -68,7 +60,6 @@
 class String;
 class SVGElementInstance;
 class TextEvent;
-class VisiblePosition;
 class Widget;
 #if ENABLE(TOUCH_EVENTS) // Android
 class PlatformTouchEvent;
@@ -164,33 +155,27 @@
 
     void capsLockStateMayHaveChanged();
     
-    unsigned pendingFrameUnloadEventCount();
-    void addPendingFrameUnloadEventCount();
-    void removePendingFrameUnloadEventCount();
-    void clearPendingFrameUnloadEventCount();
-    unsigned pendingFrameBeforeUnloadEventCount();
-    void addPendingFrameBeforeUnloadEventCount();
-    void removePendingFrameBeforeUnloadEventCount();
-    void clearPendingFrameBeforeUnloadEventCount();
-
     void sendResizeEvent();
     void sendScrollEvent();
     
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && defined(__OBJC__)
     PassRefPtr<KeyboardEvent> currentKeyboardEvent() const;
 
-    void mouseDown(NSEvent*);
-    void mouseDragged(NSEvent*);
-    void mouseUp(NSEvent*);
-    void mouseMoved(NSEvent*);
-    bool keyEvent(NSEvent*);
-    bool wheelEvent(NSEvent*);
+    void mouseDown(NSEvent *);
+    void mouseDragged(NSEvent *);
+    void mouseUp(NSEvent *);
+    void mouseMoved(NSEvent *);
+    bool keyEvent(NSEvent *);
+    bool wheelEvent(NSEvent *);
 
-    void sendFakeEventsAfterWidgetTracking(NSEvent* initiatingEvent);
+    bool sendContextMenuEvent(NSEvent *);
+    bool eventMayStartDrag(NSEvent *);
+
+    void sendFakeEventsAfterWidgetTracking(NSEvent *initiatingEvent);
 
     void setActivationEventNumber(int num) { m_activationEventNumber = num; }
 
-    NSEvent *currentNSEvent();
+    static NSEvent *currentNSEvent();
 #endif
 
 private:
@@ -210,8 +195,8 @@
     PassRefPtr<Clipboard> createDraggingClipboard() const;
     
     bool eventActivatedView(const PlatformMouseEvent&) const;
-    void selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& event);
-    void selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHitTestResults& event);
+    void selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults&);
+    void selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHitTestResults&);
 
     bool handleMouseDoubleClickEvent(const PlatformMouseEvent&);
 
@@ -283,14 +268,8 @@
 
     // The following are called at the beginning of handleMouseUp and handleDrag.  
     // If they return true it indicates that they have consumed the event.
-#if PLATFORM(MAC)
     bool eventLoopHandleMouseUp(const MouseEventWithHitTestResults&);
     bool eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&);
-    NSView *mouseDownViewIfStillGood();
-#else
-    bool eventLoopHandleMouseUp(const MouseEventWithHitTestResults&) { return false; }
-    bool eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&) { return false; }
-#endif
 
     bool invertSenseOfTabsToLinks(KeyboardEvent*) const;
 
@@ -298,6 +277,12 @@
 
     bool capturesDragging() const { return m_capturesDragging; }
 
+#if PLATFORM(MAC) && defined(__OBJC__)
+    NSView *mouseDownViewIfStillGood();
+
+    PlatformMouseEvent currentPlatformMouseEvent() const;
+#endif
+
     Frame* m_frame;
 
     bool m_mousePressed;
@@ -321,6 +306,7 @@
     bool m_autoscrollInProgress;
     bool m_mouseDownMayStartAutoscroll;
     bool m_mouseDownWasInSubframe;
+
 #if ENABLE(SVG)
     bool m_svgPan;
     RefPtr<SVGElementInstance> m_instanceUnderMouse;
@@ -352,16 +338,12 @@
     IntPoint m_mouseDownPos; // in our view's coords
     double m_mouseDownTimestamp;
     PlatformMouseEvent m_mouseDown;
-    
-    unsigned m_pendingFrameUnloadEventCount;
-    unsigned m_pendingFrameBeforeUnloadEventCount;
 
 #if PLATFORM(MAC)
     NSView *m_mouseDownView;
     bool m_sendingEventToSubview;
     int m_activationEventNumber;
 #endif
-
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/FocusController.cpp b/WebCore/page/FocusController.cpp
index 9760b3c..8dad846 100644
--- a/WebCore/page/FocusController.cpp
+++ b/WebCore/page/FocusController.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nuanti Ltd.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +35,7 @@
 #include "Element.h"
 #include "Event.h"
 #include "EventHandler.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "FrameTree.h"
@@ -45,6 +47,7 @@
 #include "RenderObject.h"
 #include "RenderWidget.h"
 #include "SelectionController.h"
+#include "Settings.h"
 #include "Widget.h"
 #include <wtf/Platform.h>
 
@@ -63,13 +66,17 @@
     if (m_focusedFrame == frame)
         return;
 
-    if (m_focusedFrame && m_focusedFrame->view())
+    if (m_focusedFrame && m_focusedFrame->view()) {
         m_focusedFrame->selection()->setFocused(false);
+        m_focusedFrame->document()->dispatchWindowEvent(eventNames().blurEvent, false, false);
+    }
 
     m_focusedFrame = frame;
 
-    if (m_focusedFrame && m_focusedFrame->view())
+    if (m_focusedFrame && m_focusedFrame->view()) {
         m_focusedFrame->selection()->setFocused(true);
+        m_focusedFrame->document()->dispatchWindowEvent(eventNames().focusEvent, false, false);
+    }
 }
 
 Frame* FocusController::focusedOrMainFrame()
@@ -114,9 +121,16 @@
     ASSERT(frame);
     Document* document = frame->document();
 
+    Node* currentNode = document->focusedNode();
+    // FIXME: Not quite correct when it comes to focus transitions leaving/entering the WebView itself
+    bool caretBrowsing = focusedOrMainFrame()->settings()->caretBrowsingEnabled();
+
+    if (caretBrowsing && !currentNode)
+        currentNode = frame->selection()->start().node();
+
     Node* node = (direction == FocusDirectionForward)
-        ? document->nextFocusableNode(document->focusedNode(), event)
-        : document->previousFocusableNode(document->focusedNode(), event);
+        ? document->nextFocusableNode(currentNode, event)
+        : document->previousFocusableNode(currentNode, event);
             
     // If there's no focusable node to advance to, move up the frame tree until we find one.
     while (!node && frame) {
@@ -195,6 +209,12 @@
     if (newDocument)
         setFocusedFrame(newDocument->frame());
 
+    if (caretBrowsing) {
+        VisibleSelection newSelection(Position(node, 0), Position(node, 0), DOWNSTREAM);
+        if (frame->shouldChangeSelection(newSelection))
+            frame->selection()->setSelection(newSelection);
+    }
+
     static_cast<Element*>(node)->focus(false);
     return true;
 }
@@ -223,7 +243,11 @@
     SelectionController* s = oldFocusedFrame->selection();
     if (s->isNone())
         return;
-    
+
+    bool caretBrowsing = oldFocusedFrame->settings()->caretBrowsingEnabled();
+    if (caretBrowsing)
+        return;
+
     Node* selectionStartNode = s->selection().start().node();
     if (selectionStartNode == newFocusedNode || selectionStartNode->isDescendantOf(newFocusedNode) || selectionStartNode->shadowAncestorNode() == newFocusedNode)
         return;
@@ -248,7 +272,8 @@
     Node* oldFocusedNode = oldDocument ? oldDocument->focusedNode() : 0;
     if (oldFocusedNode == node)
         return true;
-        
+
+    // FIXME: Might want to disable this check for caretBrowsing
     if (oldFocusedNode && oldFocusedNode->rootEditableElement() == oldFocusedNode && !relinquishesEditingFocus(oldFocusedNode))
         return false;
         
@@ -296,6 +321,9 @@
     }
 
     focusedOrMainFrame()->selection()->pageActivationChanged();
+    
+    if (m_focusedFrame)
+        m_focusedFrame->document()->dispatchWindowEvent(active ? eventNames().focusEvent : eventNames().blurEvent, false, false);
 }
 
 } // namespace WebCore
diff --git a/WebCore/page/Frame.cpp b/WebCore/page/Frame.cpp
index 1caae9a..eedf09b 100644
--- a/WebCore/page/Frame.cpp
+++ b/WebCore/page/Frame.cpp
@@ -31,6 +31,7 @@
 #include "ApplyStyleCommand.h"
 #include "BeforeUnloadEvent.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CachedCSSStyleSheet.h"
@@ -70,6 +71,7 @@
 #include "TextResourceDecoder.h"
 #include "XMLNames.h"
 #include "ScriptController.h"
+#include "htmlediting.h"
 #include "npruntime_impl.h"
 #include "visible_units.h"
 #include <wtf/RefCountedLeakCounter.h>
@@ -176,7 +178,6 @@
 Frame::~Frame()
 {
     setView(0);
-    loader()->clearRecordedFormValues();
     loader()->cancelAndClear();
     
     // FIXME: We should not be doing all this work inside the destructor
@@ -187,9 +188,6 @@
     frameCounter.decrement();
 #endif
 
-    if (m_script.haveWindowShell())
-        m_script.windowShell()->disconnectFrame();
-
     disconnectOwnerElement();
     
     if (m_domWindow)
@@ -226,7 +224,7 @@
     return m_view.get();
 }
 
-void Frame::setView(FrameView* view)
+void Frame::setView(PassRefPtr<FrameView> view)
 {
     // Detach the document now, so any onUnload handlers get run - if
     // we wait until the view is destroyed, then things won't be
@@ -573,9 +571,18 @@
 
 void Frame::setFocusedNodeIfNeeded()
 {
-    if (selection()->isNone() || !selection()->isFocusedAndActive())
+    if (selection()->isNone() || !selection()->isFocused())
         return;
 
+    bool caretBrowsing = settings() && settings()->caretBrowsingEnabled();
+    if (caretBrowsing) {
+        Node* anchor = enclosingAnchorElement(selection()->base());
+        if (anchor) {
+            page()->focusController()->setFocusedNode(anchor, this);
+            return;
+        }
+    }
+
     Node* target = selection()->rootEditableElement();
     if (target) {
         RenderObject* renderer = target->renderer();
@@ -596,6 +603,9 @@
         }
         document()->setFocusedNode(0);
     }
+
+    if (caretBrowsing)
+        page()->focusController()->setFocusedNode(0, this);
 }
 
 void Frame::selectionLayoutChanged()
@@ -603,8 +613,9 @@
     bool caretRectChanged = selection()->recomputeCaretRect();
 
 #if ENABLE(TEXT_CARET)
+    bool caretBrowsing = settings() && settings()->caretBrowsingEnabled();
     bool shouldBlink = m_caretVisible
-        && selection()->isCaret() && selection()->isContentEditable();
+        && selection()->isCaret() && (selection()->isContentEditable() || caretBrowsing);
 
     // If the caret moved, stop the blink timer so we can restart with a
     // black caret in the new location.
@@ -652,7 +663,7 @@
         if (startPos.isNotNull() && endPos.isNotNull() && selection.visibleStart() != selection.visibleEnd()) {
             RenderObject *startRenderer = startPos.node()->renderer();
             RenderObject *endRenderer = endPos.node()->renderer();
-            view->setSelection(startRenderer, startPos.m_offset, endRenderer, endPos.m_offset);
+            view->setSelection(startRenderer, startPos.deprecatedEditingOffset(), endRenderer, endPos.deprecatedEditingOffset());
         }
     }
 }
@@ -764,6 +775,7 @@
 
 void Frame::setJSStatusBarText(const String& text)
 {
+    ASSERT(m_doc); // Client calls shouldn't be made when the frame is in inconsistent state.
     m_kjsStatusBarText = text;
     if (m_page)
         m_page->chrome()->setStatusbarText(this, m_kjsStatusBarText);
@@ -771,6 +783,7 @@
 
 void Frame::setJSDefaultStatusBarText(const String& text)
 {
+    ASSERT(m_doc); // Client calls shouldn't be made when the frame is in inconsistent state.
     m_kjsDefaultStatusBarText = text;
     if (m_page)
         m_page->chrome()->setStatusbarText(this, m_kjsDefaultStatusBarText);
@@ -1193,7 +1206,7 @@
     RefPtr<Range> selectedRange = selection()->toNormalizedRange();
 
     Vector<IntRect> intRects;
-    selectedRange->addLineBoxRects(intRects, true);
+    selectedRange->textRects(intRects, true);
 
     unsigned size = intRects.size();
     FloatRect visibleContentRect = m_view->visibleContentRect();
@@ -1289,8 +1302,6 @@
     if (view) {
         view->unscheduleRelayout();
         if (view->frame()) {
-            if (document && document->renderer() && document->renderer()->hasLayer())
-                document->renderView()->layer()->suspendMarquees();
             view->frame()->animation()->suspendAnimations(document);
             view->frame()->eventHandler()->stopAutoscrollTimer();
         }
@@ -1341,7 +1352,8 @@
     // Put a caret inside the body if the entire frame is editable (either the 
     // entire WebView is editable or designMode is on for this document).
     Document *doc = document();
-    if (!selection()->isNone() || !isContentEditable())
+    bool caretBrowsing = settings() && settings()->caretBrowsingEnabled();
+    if (!selection()->isNone() || !(isContentEditable() || caretBrowsing))
         return;
         
     Node* node = doc->documentElement();
@@ -1567,13 +1579,7 @@
     if (page() && page()->focusController()->focusedFrame() == this)
         page()->focusController()->setFocusedFrame(0);
 
-#if USE(JSC)
     script()->clearWindowShell();
-#endif
-
-    // This will stop any JS timers
-    if (script()->haveWindowShell())
-        script()->windowShell()->disconnectFrame();
 
     script()->clearScriptObjects();
     script()->updatePlatformScriptObjects();
@@ -1623,20 +1629,21 @@
         page()->chrome()->unfocus();
 }
 
-bool Frame::shouldClose()
+bool Frame::shouldClose(RegisteredEventListenerVector* alternateEventListeners)
 {
     Chrome* chrome = page() ? page()->chrome() : 0;
     if (!chrome || !chrome->canRunBeforeUnloadConfirmPanel())
         return true;
 
+    if (!m_domWindow)
+        return true;
+
     RefPtr<Document> doc = document();
     HTMLElement* body = doc->body();
     if (!body)
         return true;
 
-    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = BeforeUnloadEvent::create();
-    beforeUnloadEvent->setTarget(doc);
-    doc->handleWindowEvent(beforeUnloadEvent.get(), false);
+    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = m_domWindow->dispatchBeforeUnloadEvent(alternateEventListeners);
 
     if (!beforeUnloadEvent->defaultPrevented())
         doc->defaultEventHandler(beforeUnloadEvent.get());
@@ -1665,7 +1672,8 @@
     if (isContinuousSpellCheckingEnabled) {
         VisibleSelection newAdjacentWords;
         VisibleSelection newSelectedSentence;
-        if (selection()->selection().isContentEditable()) {
+        bool caretBrowsing = settings() && settings()->caretBrowsingEnabled();
+        if (selection()->selection().isContentEditable() || caretBrowsing) {
             VisiblePosition newStart(selection()->selection().visibleStart());
             newAdjacentWords = VisibleSelection(startOfWord(newStart, LeftWordIfOnBoundary), endOfWord(newStart, RightWordIfOnBoundary));
             if (isContinuousGrammarCheckingEnabled)
@@ -1748,20 +1756,18 @@
 
     setView(0);
 
-    FrameView* frameView;
+    RefPtr<FrameView> frameView;
     if (isMainFrame) {
-        frameView = new FrameView(this, viewportSize);
+        frameView = FrameView::create(this, viewportSize);
         frameView->setFixedLayoutSize(fixedLayoutSize);
         frameView->setUseFixedLayout(useFixedLayout);
     } else
-        frameView = new FrameView(this);
+        frameView = FrameView::create(this);
 
     frameView->setScrollbarModes(horizontalScrollbarMode, verticalScrollbarMode);
     frameView->updateDefaultScrollbarState();
 
     setView(frameView);
-    // FrameViews are created with a ref count of 1. Release this ref since we've assigned it to frame.
-    frameView->deref();
 
     if (backgroundColor.isValid())
         frameView->updateBackgroundRecursively(backgroundColor, transparent);
@@ -1770,7 +1776,7 @@
         frameView->setParentVisible(true);
 
     if (ownerRenderer())
-        ownerRenderer()->setWidget(frameView);
+        ownerRenderer()->setWidget(frameView.get());
 
     if (HTMLFrameOwnerElement* owner = ownerElement())
         view()->setCanHaveScrollbars(owner->scrollingMode() != ScrollbarAlwaysOff);
diff --git a/WebCore/page/Frame.h b/WebCore/page/Frame.h
index 5d46acd..acd91e5 100644
--- a/WebCore/page/Frame.h
+++ b/WebCore/page/Frame.h
@@ -5,7 +5,7 @@
  *                     2000-2001 Simon Hausmann <hausmann@kde.org>
  *                     2000-2001 Dirk Mueller <mueller@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  *
@@ -91,7 +91,7 @@
     {
         return adoptRef(new Frame(page, ownerElement, client));
     }
-    void setView(FrameView*);
+    void setView(PassRefPtr<FrameView>);
     ~Frame();
 
     void init();
@@ -193,7 +193,7 @@
 public:
     void focusWindow();
     void unfocusWindow();
-    bool shouldClose();
+    bool shouldClose(RegisteredEventListenerVector* alternateEventListeners = 0);
     void scheduleClose();
 
     void setJSStatusBarText(const String&);
diff --git a/WebCore/page/FrameTree.cpp b/WebCore/page/FrameTree.cpp
index adb5c90..24f125d 100644
--- a/WebCore/page/FrameTree.cpp
+++ b/WebCore/page/FrameTree.cpp
@@ -21,6 +21,7 @@
 #include "FrameTree.h"
 
 #include "Frame.h"
+#include "FrameView.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include <stdarg.h>
diff --git a/WebCore/page/FrameView.cpp b/WebCore/page/FrameView.cpp
index 5f1ee65..f753447 100644
--- a/WebCore/page/FrameView.cpp
+++ b/WebCore/page/FrameView.cpp
@@ -94,8 +94,7 @@
 };
 
 FrameView::FrameView(Frame* frame)
-    : m_refCount(1)
-    , m_frame(frame)
+    : m_frame(frame)
     , m_vmode(ScrollbarAuto)
     , m_hmode(ScrollbarAuto)
     , m_slowRepaintObjectCount(0)
@@ -113,35 +112,26 @@
     , m_inProgrammaticScroll(false)
     , m_deferredRepaintTimer(this, &FrameView::deferredRepaintTimerFired)
     , m_shouldUpdateWhileOffscreen(true)
+    , m_deferSetNeedsLayouts(0)
+    , m_setNeedsLayoutWasDeferred(false)
+    , m_lockedToAnchor(false)
 {
     init();
-    show();
 }
 
-FrameView::FrameView(Frame* frame, const IntSize& initialSize)
-    : m_refCount(1)
-    , m_frame(frame)
-    , m_vmode(ScrollbarAuto)
-    , m_hmode(ScrollbarAuto)
-    , m_slowRepaintObjectCount(0)
-    , m_layoutTimer(this, &FrameView::layoutTimerFired)
-    , m_layoutRoot(0)
-    , m_postLayoutTasksTimer(this, &FrameView::postLayoutTimerFired)
-    , m_needToInitScrollbars(true)
-    , m_isTransparent(false)
-    , m_baseBackgroundColor(Color::white)
-    , m_mediaType("screen")
-    , m_enqueueEvents(0)
-    , m_overflowStatusDirty(true)
-    , m_viewportRenderer(0)
-    , m_wasScrolledByUser(false)
-    , m_inProgrammaticScroll(false)
-    , m_deferredRepaintTimer(this, &FrameView::deferredRepaintTimerFired)
-    , m_shouldUpdateWhileOffscreen(true)
+PassRefPtr<FrameView> FrameView::create(Frame* frame)
 {
-    init();
-    Widget::setFrameRect(IntRect(x(), y(), initialSize.width(), initialSize.height()));
-    show();
+    RefPtr<FrameView> view = adoptRef(new FrameView(frame));
+    view->show();
+    return view.release();
+}
+
+PassRefPtr<FrameView> FrameView::create(Frame* frame, const IntSize& initialSize)
+{
+    RefPtr<FrameView> view = adoptRef(new FrameView(frame));
+    view->Widget::setFrameRect(IntRect(view->pos(), initialSize));
+    view->show();
+    return view.release();
 }
 
 FrameView::~FrameView()
@@ -156,7 +146,6 @@
     setHasHorizontalScrollbar(false); // Remove native scrollbars now before we lose the connection to the HostWindow.
     setHasVerticalScrollbar(false);
     
-    ASSERT(m_refCount == 0);
     ASSERT(m_scheduledEvents.isEmpty());
     ASSERT(!m_enqueueEvents);
 
@@ -171,6 +160,8 @@
 void FrameView::reset()
 {
     m_useSlowRepaints = false;
+    m_isOverlapped = false;
+    m_contentIsOpaque = false;
     m_borderX = 30;
     m_borderY = 30;
     m_layoutTimer.stop();
@@ -197,6 +188,7 @@
     m_isPainting = false;
     m_isVisuallyNonEmpty = false;
     m_firstVisuallyNonEmptyLayoutCallbackPending = true;
+    m_lockedToAnchor = false;
 }
 
 bool FrameView::isFrameView() const 
@@ -319,12 +311,12 @@
     Document* doc = m_frame->document();
 
     // Try the <body> element first as a scrollbar source.
-    Element* body = doc->body();
+    Element* body = doc ? doc->body() : 0;
     if (body && body->renderer() && body->renderer()->style()->hasPseudoStyle(SCROLLBAR))
         return RenderScrollbar::createCustomScrollbar(this, orientation, body->renderBox());
     
     // If the <body> didn't have a custom style, then the root element might.
-    Element* docElement = doc->documentElement();
+    Element* docElement = doc ? doc->documentElement() : 0;
     if (docElement && docElement->renderer() && docElement->renderer()->style()->hasPseudoStyle(SCROLLBAR))
         return RenderScrollbar::createCustomScrollbar(this, orientation, docElement->renderBox());
         
@@ -339,6 +331,8 @@
 
 void FrameView::setContentsSize(const IntSize& size)
 {
+    m_deferSetNeedsLayouts++;
+
     ScrollView::setContentsSize(size);
 
     Page* page = frame() ? frame()->page() : 0;
@@ -346,6 +340,11 @@
         return;
 
     page->chrome()->contentsSizeChanged(frame(), size); //notify only
+    
+    m_deferSetNeedsLayouts--;
+    
+    if (!m_deferSetNeedsLayouts)
+        m_setNeedsLayoutWasDeferred = false; // FIXME: Find a way to make the deferred layout actually happen.
 }
 
 void FrameView::adjustViewSize()
@@ -443,6 +442,7 @@
 
     m_layoutTimer.stop();
     m_delayedLayout = false;
+    m_setNeedsLayoutWasDeferred = false;
 
     // Protect the view from being deleted during layout (in recalcStyle)
     RefPtr<FrameView> protector(this);
@@ -491,7 +491,7 @@
     // the layout beats any sort of style recalc update that needs to occur.
     if (m_frame->needsReapplyStyles())
         m_frame->reapplyStyles();
-    else if (document->hasChangedChild())
+    else if (document->childNeedsStyleRecalc())
         document->recalcStyle();
     
     bool subtree = m_layoutRoot;
@@ -614,7 +614,7 @@
 
 #if PLATFORM(MAC)
     if (AXObjectCache::accessibilityEnabled())
-        root->document()->axObjectCache()->postNotificationToElement(root, "AXLayoutComplete");
+        root->document()->axObjectCache()->postNotification(root, "AXLayoutComplete", true);
 #endif
 #if ENABLE(DASHBOARD_SUPPORT)
     updateDashboardRegions();
@@ -649,6 +649,9 @@
         ASSERT(m_enqueueEvents);
     }
 
+    if (lockedToAnchor())
+        m_frame->loader()->gotoAnchor();
+
     m_nestedLayoutCount--;
 }
 
@@ -684,7 +687,7 @@
 
 bool FrameView::useSlowRepaints() const
 {
-    return m_useSlowRepaints || m_slowRepaintObjectCount > 0;
+    return m_useSlowRepaints || m_slowRepaintObjectCount > 0 || m_isOverlapped || !m_contentIsOpaque;
 }
 
 void FrameView::setUseSlowRepaints()
@@ -705,7 +708,25 @@
     ASSERT(m_slowRepaintObjectCount > 0);
     m_slowRepaintObjectCount--;
     if (!m_slowRepaintObjectCount)
-        setCanBlitOnScroll(!m_useSlowRepaints);
+        setCanBlitOnScroll(!useSlowRepaints());
+}
+
+void FrameView::setIsOverlapped(bool isOverlapped)
+{
+    if (isOverlapped == m_isOverlapped)
+        return;
+
+    m_isOverlapped = isOverlapped;
+    setCanBlitOnScroll(!useSlowRepaints());
+}
+
+void FrameView::setContentIsOpaque(bool contentIsOpaque)
+{
+    if (contentIsOpaque == m_contentIsOpaque)
+        return;
+
+    m_contentIsOpaque = contentIsOpaque;
+    setCanBlitOnScroll(!useSlowRepaints());
 }
 
 void FrameView::restoreScrollbar()
@@ -717,6 +738,7 @@
 {
     bool wasInProgrammaticScroll = m_inProgrammaticScroll;
     m_inProgrammaticScroll = true;
+    setLockedToAnchor(false);
     ScrollView::scrollRectIntoViewRecursively(r);
     m_inProgrammaticScroll = wasInProgrammaticScroll;
 }
@@ -725,6 +747,7 @@
 {
     bool wasInProgrammaticScroll = m_inProgrammaticScroll;
     m_inProgrammaticScroll = true;
+    setLockedToAnchor(false);
     ScrollView::setScrollPosition(scrollPoint);
     m_inProgrammaticScroll = wasInProgrammaticScroll;
 }
@@ -857,8 +880,11 @@
 void FrameView::resetDeferredRepaintDelay()
 {
     m_deferredRepaintDelay = 0;
-    if (m_deferredRepaintTimer.isActive())
-        m_deferredRepaintTimer.startOneShot(0);
+    if (m_deferredRepaintTimer.isActive()) {
+        m_deferredRepaintTimer.stop();
+        if (!m_deferringRepaints)
+            doDeferredRepaints();
+    }
 }
 
 double FrameView::adjustedDeferredRepaintDelay() const
@@ -990,12 +1016,17 @@
     return layoutPending()
         || (root && root->needsLayout())
         || m_layoutRoot
-        || document->hasChangedChild() // can occur when using WebKit ObjC interface
-        || m_frame->needsReapplyStyles();
+        || (document && document->childNeedsStyleRecalc()) // can occur when using WebKit ObjC interface
+        || m_frame->needsReapplyStyles()
+        || (m_deferSetNeedsLayouts && m_setNeedsLayoutWasDeferred);
 }
 
 void FrameView::setNeedsLayout()
 {
+    if (m_deferSetNeedsLayouts) {
+        m_setNeedsLayoutWasDeferred = true;
+        return;
+    }
     RenderView* root = m_frame->contentRenderer();
     if (root)
         root->setNeedsLayout(true);
@@ -1320,6 +1351,7 @@
 {
     if (m_inProgrammaticScroll)
         return;
+    setLockedToAnchor(false);
     m_wasScrolledByUser = wasScrolledByUser;
 }
 
@@ -1360,6 +1392,9 @@
     }
 
     ASSERT(!needsLayout());
+    if (needsLayout())
+        return;
+
     ASSERT(!m_isPainting);
         
     m_isPainting = true;
@@ -1417,6 +1452,13 @@
     for (HashSet<Widget*>::const_iterator current = viewChildren->begin(); current != end; ++current)
         if ((*current)->isFrameView())
             static_cast<FrameView*>(*current)->layoutIfNeededRecursive();
+
+    // layoutIfNeededRecursive is called when we need to make sure layout is up-to-date before
+    // painting, so we need to flush out any deferred repaints too.
+    if (m_deferredRepaintTimer.isActive()) {
+        m_deferredRepaintTimer.stop();
+        doDeferredRepaints();
+    }
 }
 
 void FrameView::forceLayout(bool allowSubtree)
@@ -1466,7 +1508,7 @@
         // Use a context with painting disabled.
         GraphicsContext context((PlatformGraphicsContext*)0);
         root->setTruncatedAt((int)floorf(oldBottom));
-        IntRect dirtyRect(0, (int)floorf(oldTop), root->docWidth(), (int)ceilf(oldBottom - oldTop));
+        IntRect dirtyRect(0, (int)floorf(oldTop), root->overflowWidth(), (int)ceilf(oldBottom - oldTop));
         root->layer()->paint(&context, dirtyRect);
         *newBottom = root->bestTruncatedAt();
         if (*newBottom == 0)
diff --git a/WebCore/page/FrameView.h b/WebCore/page/FrameView.h
index 07295d3..16eadc5 100644
--- a/WebCore/page/FrameView.h
+++ b/WebCore/page/FrameView.h
@@ -48,12 +48,12 @@
 
 template <typename T> class Timer;
 
-class FrameView : public ScrollView {
+class FrameView : public ScrollView, public RefCounted<FrameView> {
 public:
     friend class RenderView;
 
-    FrameView(Frame*);
-    FrameView(Frame*, const IntSize& initialSize);
+    static PassRefPtr<FrameView> create(Frame*);
+    static PassRefPtr<FrameView> create(Frame*, const IntSize& initialSize);
 
     virtual ~FrameView();
 
@@ -64,10 +64,6 @@
     Frame* frame() const { return m_frame.get(); }
     void clearFrame();
 
-    void ref() { ++m_refCount; }
-    void deref() { if (!--m_refCount) delete this; }
-    bool hasOneRef() { return m_refCount == 1; }
-
     int marginWidth() const { return m_margins.width(); } // -1 means default
     int marginHeight() const { return m_margins.height(); } // -1 means default
     void setMarginWidth(int);
@@ -143,6 +139,8 @@
     void setMediaType(const String&);
 
     void setUseSlowRepaints();
+    void setIsOverlapped(bool);
+    void setContentIsOpaque(bool);
 
     void addSlowRepaintObject();
     void removeSlowRepaintObject();
@@ -186,13 +184,19 @@
 
     void adjustPageHeight(float* newBottom, float oldTop, float oldBottom, float bottomLimit);
 
+    bool lockedToAnchor() { return m_lockedToAnchor; }
+    void setLockedToAnchor(bool lockedToAnchor) { m_lockedToAnchor = lockedToAnchor; }
+
 
 private:
+    FrameView(Frame*);
+
     void reset();
     void init();
 
     virtual bool isFrameView() const;
 
+    friend class RenderWidget;
     bool useSlowRepaints() const;
 
     void applyOverflowToViewport(RenderObject*, ScrollbarMode& hMode, ScrollbarMode& vMode);
@@ -204,8 +208,12 @@
 
     virtual void repaintContentRectangle(const IntRect&, bool immediate);
     virtual void contentsResized() { setNeedsLayout(); }
-    virtual void visibleContentsResized() { layout(); }
-    
+    virtual void visibleContentsResized()
+    {
+        if (needsLayout())
+            layout();
+    }
+
     void deferredRepaintTimerFired(Timer<FrameView>*);
     void doDeferredRepaints();
     void updateDeferredRepaintDelay();
@@ -215,7 +223,6 @@
     
     static double sCurrentPaintTimeStamp; // used for detecting decoded resource thrash in the cache
 
-    unsigned m_refCount;
     IntSize m_size;
     IntSize m_margins;
     OwnPtr<HashSet<RenderPartObject*> > m_widgetUpdateSet;
@@ -226,6 +233,8 @@
     ScrollbarMode m_vmode;
     ScrollbarMode m_hmode;
     bool m_useSlowRepaints;
+    bool m_isOverlapped;
+    bool m_contentIsOpaque;
     unsigned m_slowRepaintObjectCount;
 
     int m_borderX, m_borderY;
@@ -270,12 +279,17 @@
 
     bool m_shouldUpdateWhileOffscreen;
 
+    unsigned m_deferSetNeedsLayouts;
+    bool m_setNeedsLayoutWasDeferred;
+
     RefPtr<Node> m_nodeToDraw;
     PaintRestriction m_paintRestriction;
     bool m_isPainting;
 
     bool m_isVisuallyNonEmpty;
     bool m_firstVisuallyNonEmptyLayoutCallbackPending;
+
+    bool m_lockedToAnchor;
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/Geolocation.cpp b/WebCore/page/Geolocation.cpp
index e2f31a1..8abe8a6 100644
--- a/WebCore/page/Geolocation.cpp
+++ b/WebCore/page/Geolocation.cpp
@@ -34,13 +34,18 @@
 
 namespace WebCore {
 
-Geolocation::GeoNotifier::GeoNotifier(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PositionOptions* options)
+Geolocation::GeoNotifier::GeoNotifier(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
     : m_successCallback(successCallback)
     , m_errorCallback(errorCallback)
+    , m_options(options)
     , m_timer(this, &Geolocation::GeoNotifier::timerFired)
 {
-    if (m_errorCallback && options)
-        m_timer.startOneShot(options->timeout() / 1000.0);
+}
+
+void Geolocation::GeoNotifier::startTimer()
+{
+    if (m_errorCallback && m_options)
+        m_timer.startOneShot(m_options->timeout() / 1000.0);
 }
 
 void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
@@ -71,11 +76,11 @@
     m_frame = 0;
 }
 
-void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PositionOptions* options)
+void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
     RefPtr<GeoNotifier> notifier = GeoNotifier::create(successCallback, errorCallback, options);
 
-    if (!m_service->startUpdating(options)) {
+    if (!m_service->startUpdating(notifier->m_options.get())) {
         if (notifier->m_errorCallback) {
             RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
             notifier->m_errorCallback->handleEvent(error.get());
@@ -86,11 +91,11 @@
     m_oneShots.add(notifier);
 }
 
-int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PositionOptions* options)
+int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
     RefPtr<GeoNotifier> notifier = GeoNotifier::create(successCallback, errorCallback, options);
 
-    if (!m_service->startUpdating(options)) {
+    if (!m_service->startUpdating(notifier->m_options.get())) {
         if (notifier->m_errorCallback) {
             RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
             notifier->m_errorCallback->handleEvent(error.get());
@@ -129,9 +134,10 @@
 {
     m_allowGeolocation = allowed ? Yes : No;
     
-    if (isAllowed())
+    if (isAllowed()) {
+        startTimers();
         geolocationServicePositionChanged(m_service.get());
-    else {
+    } else {
         WTF::RefPtr<WebCore::PositionError> error = WebCore::PositionError::create(PositionError::PERMISSION_DENIED, "User disallowed GeoLocation");
         handleError(error.get());
     }
@@ -205,6 +211,37 @@
     }
 }
 
+void Geolocation::startTimer(Vector<RefPtr<GeoNotifier> >& notifiers)
+{
+    Vector<RefPtr<GeoNotifier> >::const_iterator end = notifiers.end();
+    for (Vector<RefPtr<GeoNotifier> >::const_iterator it = notifiers.begin(); it != end; ++it) {
+        RefPtr<GeoNotifier> notifier = *it;
+        notifier->startTimer();
+    }
+}
+
+void Geolocation::startTimersForOneShots()
+{
+    Vector<RefPtr<GeoNotifier> > copy;
+    copyToVector(m_oneShots, copy);
+    
+    startTimer(copy);
+}
+
+void Geolocation::startTimersForWatchers()
+{
+    Vector<RefPtr<GeoNotifier> > copy;
+    copyValuesToVector(m_watchers, copy);
+    
+    startTimer(copy);
+}
+
+void Geolocation::startTimers()
+{
+    startTimersForOneShots();
+    startTimersForWatchers();
+}
+
 void Geolocation::handleError(PositionError* error)
 {
     ASSERT(error);
diff --git a/WebCore/page/Geolocation.h b/WebCore/page/Geolocation.h
index a14fc4b..ae24bdd 100644
--- a/WebCore/page/Geolocation.h
+++ b/WebCore/page/Geolocation.h
@@ -38,6 +38,7 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
@@ -54,8 +55,8 @@
     
     Geoposition* lastPosition() const { return m_service->lastPosition(); }
 
-    void getCurrentPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PositionOptions*);
-    int watchPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PositionOptions*);
+    void getCurrentPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
+    int watchPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
     void clearWatch(int watchId);
 
     void suspend();
@@ -72,16 +73,18 @@
 
     class GeoNotifier : public RefCounted<GeoNotifier> {
     public:
-        static PassRefPtr<GeoNotifier> create(PassRefPtr<PositionCallback> positionCallback, PassRefPtr<PositionErrorCallback> positionErrorCallback, PositionOptions* options) { return adoptRef(new GeoNotifier(positionCallback, positionErrorCallback, options)); }
+        static PassRefPtr<GeoNotifier> create(PassRefPtr<PositionCallback> positionCallback, PassRefPtr<PositionErrorCallback> positionErrorCallback, PassRefPtr<PositionOptions> options) { return adoptRef(new GeoNotifier(positionCallback, positionErrorCallback, options)); }
         
+        void startTimer();
         void timerFired(Timer<GeoNotifier>*);
         
         RefPtr<PositionCallback> m_successCallback;
         RefPtr<PositionErrorCallback> m_errorCallback;
+        RefPtr<PositionOptions> m_options;
         Timer<GeoNotifier> m_timer;
 
     private:
-        GeoNotifier(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PositionOptions*);
+        GeoNotifier(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
     };
 
     bool hasListeners() const { return !m_oneShots.isEmpty() || !m_watchers.isEmpty(); }
@@ -91,6 +94,11 @@
     void sendPositionToOneShots(Geoposition*);
     void sendPositionToWatchers(Geoposition*);
     
+    static void startTimer(Vector<RefPtr<GeoNotifier> >&);
+    void startTimersForOneShots();
+    void startTimersForWatchers();
+    void startTimers();
+    
     void handleError(PositionError*);
 
     void requestPermission();
diff --git a/WebCore/page/Geoposition.idl b/WebCore/page/Geoposition.idl
index 2bcd40d..de508fe 100644
--- a/WebCore/page/Geoposition.idl
+++ b/WebCore/page/Geoposition.idl
@@ -29,7 +29,7 @@
         readonly attribute Coordinates coords;
         readonly attribute DOMTimeStamp timestamp;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
     };
diff --git a/WebCore/page/History.idl b/WebCore/page/History.idl
index c8cddae..fa308fb 100644
--- a/WebCore/page/History.idl
+++ b/WebCore/page/History.idl
@@ -26,7 +26,7 @@
 module window {
 
     interface [
-#if defined(V8_BINDING)
+#if defined(V8_BINDING) && V8_BINDING
         CheckDomainSecurity,
 #endif
         CustomGetOwnPropertySlot,
diff --git a/WebCore/page/Location.cpp b/WebCore/page/Location.cpp
index ba28086..c8780eb 100644
--- a/WebCore/page/Location.cpp
+++ b/WebCore/page/Location.cpp
@@ -49,7 +49,12 @@
 inline const KURL& Location::url() const
 {
     ASSERT(m_frame);
-    return m_frame->loader()->url();
+
+    const KURL& url = m_frame->loader()->url();
+    if (!url.isValid())
+        return blankURL();  // Use "about:blank" while the page is still loading (before we have a frame).
+
+    return url;
 }
 
 String Location::href() const
diff --git a/WebCore/page/Location.idl b/WebCore/page/Location.idl
index 20f8bbd..e7fa31a 100644
--- a/WebCore/page/Location.idl
+++ b/WebCore/page/Location.idl
@@ -29,13 +29,16 @@
 module window {
 
     interface [
-#if defined(V8_BINDING)
+#if defined(V8_BINDING) && V8_BINDING
         CheckDomainSecurity,
 #endif
         CustomGetOwnPropertySlot,
         CustomPutFunction,
         CustomDeleteProperty,
-        CustomGetPropertyNames
+        CustomGetPropertyNames,
+        CustomDefineGetter,
+        CustomPrototypePutFunction,
+        CustomPrototypeDefineGetter
     ] Location {
                  attribute [DoNotCheckDomainSecurityOnSet, CustomSetter, V8DisallowShadowing] DOMString href;
 
@@ -52,10 +55,10 @@
                  attribute [CustomSetter] DOMString search;
                  attribute [CustomSetter] DOMString hash;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum, Custom, V8OnInstance, V8ReadOnly] DOMString toString();
 #endif
-#if defined(V8_BINDING)
+#if defined(V8_BINDING) && V8_BINDING
         [DontEnum, Custom, V8OnInstance, V8ReadOnly] DOMObject valueOf();
 #endif
     };
diff --git a/WebCore/page/Navigator.cpp b/WebCore/page/Navigator.cpp
index dd4d27d..3603b86 100644
--- a/WebCore/page/Navigator.cpp
+++ b/WebCore/page/Navigator.cpp
@@ -75,7 +75,7 @@
     const String* sourceURL = frame->script()->sourceURL();
     if (!sourceURL)
         return false;
-    if (!(sourceURL->endsWith("/dqm_script.js") || sourceURL->endsWith("/dqm_loader.js")))
+    if (!(sourceURL->endsWith("/dqm_script.js") || sourceURL->endsWith("/dqm_loader.js") || sourceURL->endsWith("/tdqm_loader.js")))
         return false;
     Settings* settings = frame->settings();
     if (!settings)
diff --git a/WebCore/page/Navigator.idl b/WebCore/page/Navigator.idl
index 905159c..8048ff3 100644
--- a/WebCore/page/Navigator.idl
+++ b/WebCore/page/Navigator.idl
@@ -24,7 +24,7 @@
     ] Navigator {
         readonly attribute DOMString appCodeName;
         readonly attribute DOMString appName;
-        readonly attribute [CustomGetter] DOMString appVersion;
+        readonly attribute DOMString appVersion;
         readonly attribute DOMString language;
         readonly attribute DOMString userAgent;
         readonly attribute DOMString platform;
@@ -38,7 +38,8 @@
         boolean javaEnabled();
         
         readonly attribute boolean onLine;
-#if ENABLE_GEOLOCATION
+
+#if defined(ENABLE_GEOLOCATION) && ENABLE_GEOLOCATION
         readonly attribute Geolocation geolocation;
 #endif
     };
diff --git a/WebCore/page/Page.cpp b/WebCore/page/Page.cpp
index 6456bf0..70b4459 100644
--- a/WebCore/page/Page.cpp
+++ b/WebCore/page/Page.cpp
@@ -21,14 +21,14 @@
 #include "config.h"
 #include "Page.h"
 
+#include "CSSStyleSelector.h"
 #include "Chrome.h"
 #include "ChromeClient.h"
 #include "ContextMenuClient.h"
 #include "ContextMenuController.h"
-#include "CSSStyleSelector.h"
-#include "EditorClient.h"
 #include "DOMWindow.h"
 #include "DragController.h"
+#include "EditorClient.h"
 #include "EventNames.h"
 #include "FileSystem.h"
 #include "FocusController.h"
@@ -36,21 +36,22 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "HTMLElement.h"
 #include "HistoryItem.h"
 #include "InspectorController.h"
 #include "Logging.h"
-#include "NetworkStateNotifier.h"
 #include "Navigator.h"
+#include "NetworkStateNotifier.h"
 #include "PageGroup.h"
 #include "PluginData.h"
 #include "ProgressTracker.h"
 #include "RenderWidget.h"
+#include "ScriptController.h"
 #include "SelectionController.h"
 #include "Settings.h"
 #include "StringHash.h"
 #include "TextResourceDecoder.h"
 #include "Widget.h"
-#include "ScriptController.h"
 #include <wtf/HashMap.h>
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/StdLibExtras.h>
@@ -89,17 +90,8 @@
     }
 
     AtomicString eventName = networkStateNotifier().onLine() ? eventNames().onlineEvent : eventNames().offlineEvent;
-    
-    for (unsigned i = 0; i < frames.size(); i++) {
-        Document* document = frames[i]->document();
-        
-        // If the document does not have a body the event should be dispatched to the document
-        Node* eventTarget = document->body();
-        if (!eventTarget)
-            eventTarget = document;
-        
-        eventTarget->dispatchEventForType(eventName, false, false);
-    }
+    for (unsigned i = 0; i < frames.size(); i++)
+        frames[i]->document()->dispatchWindowEvent(eventName, false, false);
 }
 
 Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient)
@@ -120,13 +112,12 @@
     , m_cookieEnabled(true)
     , m_areMemoryCacheClientCallsEnabled(true)
     , m_mediaVolume(1)
+    , m_javaScriptURLsAreAllowed(true)
     , m_parentInspectorController(0)
     , m_didLoadUserStyleSheet(false)
     , m_userStyleSheetModificationTime(0)
     , m_group(0)
     , m_debugger(0)
-    , m_pendingUnloadEventCount(0)
-    , m_pendingBeforeUnloadEventCount(0)
     , m_customHTMLTokenizerTimeDelay(-1)
     , m_customHTMLTokenizerChunkSize(-1)
 {
@@ -211,8 +202,8 @@
 {
     // Abort any current load if we're going to a history item
 
-	// Define what to do with any open database connections. By default we stop them and terminate the database thread.
-	DatabasePolicy databasePolicy = DatabasePolicyStop;
+    // Define what to do with any open database connections. By default we stop them and terminate the database thread.
+    DatabasePolicy databasePolicy = DatabasePolicyStop;
 
 #if ENABLE(DATABASE)
     // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
@@ -571,46 +562,6 @@
     m_sessionStorage = newStorage;
 }
 #endif
-    
-unsigned Page::pendingUnloadEventCount()
-{
-    return m_pendingUnloadEventCount;
-}
-    
-void Page::changePendingUnloadEventCount(int delta) 
-{
-    if (!delta)
-        return;
-    ASSERT( (delta + (int)m_pendingUnloadEventCount) >= 0 );
-    
-    if (m_pendingUnloadEventCount == 0)
-        m_chrome->disableSuddenTermination();
-    else if ((m_pendingUnloadEventCount + delta) == 0)
-        m_chrome->enableSuddenTermination();
-    
-    m_pendingUnloadEventCount += delta;
-    return; 
-}
-    
-unsigned Page::pendingBeforeUnloadEventCount()
-{
-    return m_pendingBeforeUnloadEventCount;
-}
-    
-void Page::changePendingBeforeUnloadEventCount(int delta) 
-{
-    if (!delta)
-        return;
-    ASSERT( (delta + (int)m_pendingBeforeUnloadEventCount) >= 0 );
-    
-    if (m_pendingBeforeUnloadEventCount == 0)
-        m_chrome->disableSuddenTermination();
-    else if ((m_pendingBeforeUnloadEventCount + delta) == 0)
-        m_chrome->enableSuddenTermination();
-    
-    m_pendingBeforeUnloadEventCount += delta;
-    return; 
-}
 
 #if ENABLE(WML)
 WMLPageState* Page::wmlPageState()
@@ -652,4 +603,14 @@
         frame->loader()->tellClientAboutPastMemoryCacheLoads();
 }
 
+void Page::setJavaScriptURLsAreAllowed(bool areAllowed)
+{
+    m_javaScriptURLsAreAllowed = areAllowed;
+}
+
+bool Page::javaScriptURLsAreAllowed() const
+{
+    return m_javaScriptURLsAreAllowed;
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/Page.h b/WebCore/page/Page.h
index f140783..eedd24c 100644
--- a/WebCore/page/Page.h
+++ b/WebCore/page/Page.h
@@ -159,11 +159,6 @@
 
         void userStyleSheetLocationChanged();
         const String& userStyleSheet() const;
-        
-        void changePendingUnloadEventCount(int delta);
-        unsigned pendingUnloadEventCount();
-        void changePendingBeforeUnloadEventCount(int delta);
-        unsigned pendingBeforeUnloadEventCount();
 
         static void setDebuggerForAllPages(JSC::Debugger*);
         void setDebugger(JSC::Debugger*);
@@ -200,6 +195,9 @@
         void setMemoryCacheClientCallsEnabled(bool);
         bool areMemoryCacheClientCallsEnabled() const { return m_areMemoryCacheClientCallsEnabled; }
 
+        void setJavaScriptURLsAreAllowed(bool);
+        bool javaScriptURLsAreAllowed() const;
+
     private:
         void initGroup();
 
@@ -231,7 +229,9 @@
         bool m_cookieEnabled;
         bool m_areMemoryCacheClientCallsEnabled;
         float m_mediaVolume;
-    
+
+        bool m_javaScriptURLsAreAllowed;
+
         InspectorController* m_parentInspectorController;
 
         String m_userStyleSheetPath;
@@ -243,9 +243,6 @@
         PageGroup* m_group;
 
         JSC::Debugger* m_debugger;
-        
-        unsigned m_pendingUnloadEventCount;
-        unsigned m_pendingBeforeUnloadEventCount;
 
         double m_customHTMLTokenizerTimeDelay;
         int m_customHTMLTokenizerChunkSize;
diff --git a/WebCore/page/PageGroupLoadDeferrer.cpp b/WebCore/page/PageGroupLoadDeferrer.cpp
new file mode 100644
index 0000000..f274de3
--- /dev/null
+++ b/WebCore/page/PageGroupLoadDeferrer.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "PageGroupLoadDeferrer.h"
+
+#include "Frame.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include <wtf/HashSet.h>
+
+namespace WebCore {
+
+using namespace std;
+
+PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
+{
+    const HashSet<Page*>& pages = page->group().pages();
+
+    HashSet<Page*>::const_iterator end = pages.end();
+    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+        Page* otherPage = *it;
+        if ((deferSelf || otherPage != page)) {
+            if (!otherPage->defersLoading())
+                m_deferredFrames.append(otherPage->mainFrame());
+
+#if !PLATFORM(MAC)
+            for (Frame* frame = otherPage->mainFrame(); frame; frame = frame->tree()->traverseNext())
+                frame->document()->suspendActiveDOMObjects();
+#endif
+        }
+    }
+
+    size_t count = m_deferredFrames.size();
+    for (size_t i = 0; i < count; ++i)
+        if (Page* page = m_deferredFrames[i]->page())
+            page->setDefersLoading(true);
+}
+
+PageGroupLoadDeferrer::~PageGroupLoadDeferrer()
+{
+    for (size_t i = 0; i < m_deferredFrames.size(); ++i) {
+        if (Page* page = m_deferredFrames[i]->page()) {
+            page->setDefersLoading(false);
+
+#if !PLATFORM(MAC)
+            for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
+                frame->document()->resumeActiveDOMObjects();
+#endif
+        }
+    }
+}
+
+
+} // namespace WebCore
diff --git a/WebCore/rendering/ListMarkerBox.h b/WebCore/page/PageGroupLoadDeferrer.h
similarity index 62%
rename from WebCore/rendering/ListMarkerBox.h
rename to WebCore/page/PageGroupLoadDeferrer.h
index 47ae256..1bdb45c 100644
--- a/WebCore/rendering/ListMarkerBox.h
+++ b/WebCore/page/PageGroupLoadDeferrer.h
@@ -1,9 +1,5 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,23 +15,27 @@
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
- *
  */
 
-#ifndef ListMarkerBox_h
-#define ListMarkerBox_h
+#ifndef PageGroupLoadDeferrer_h
+#define PageGroupLoadDeferrer_h
 
-#include "InlineBox.h"
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
-class ListMarkerBox : public InlineBox {
-public:
-    ListMarkerBox(RenderObject*);
+    class Frame;
+    class Page;
 
-    virtual bool isText() const;
-};
+    class PageGroupLoadDeferrer : Noncopyable {
+    public:
+        PageGroupLoadDeferrer(Page*, bool deferSelf);
+        ~PageGroupLoadDeferrer();
 
-} // namespace WebCore
+    private:
+        Vector<RefPtr<Frame>, 16> m_deferredFrames;
+    };
+}
 
-#endif // ListMarkerBox_h
+#endif // PageGroupLoadDeferrer_h
diff --git a/WebCore/page/PrintContext.cpp b/WebCore/page/PrintContext.cpp
index b83d714..2202559 100644
--- a/WebCore/page/PrintContext.cpp
+++ b/WebCore/page/PrintContext.cpp
@@ -67,7 +67,7 @@
 
     float ratio = printRect.height() / printRect.width();
 
-    float pageWidth  = (float)root->docWidth();
+    float pageWidth  = (float)root->overflowWidth();
     float pageHeight = pageWidth * ratio;
     outPageHeight = pageHeight;   // this is the height of the page adjusted by margins
     pageHeight -= headerHeight + footerHeight;
diff --git a/WebCore/page/Screen.cpp b/WebCore/page/Screen.cpp
index 396a6f4..d2bb60f 100644
--- a/WebCore/page/Screen.cpp
+++ b/WebCore/page/Screen.cpp
@@ -43,6 +43,11 @@
 {
 }
 
+Frame* Screen::frame() const
+{
+    return m_frame;
+}
+
 void Screen::disconnectFrame()
 {
     m_frame = 0;
diff --git a/WebCore/page/Screen.h b/WebCore/page/Screen.h
index a740ccb..6f34195 100644
--- a/WebCore/page/Screen.h
+++ b/WebCore/page/Screen.h
@@ -40,6 +40,8 @@
     class Screen : public RefCounted<Screen> {
     public:
         static PassRefPtr<Screen> create(Frame *frame) { return adoptRef(new Screen(frame)); }
+
+        Frame* frame() const;
         void disconnectFrame();
 
         unsigned height() const;
diff --git a/WebCore/page/SecurityOrigin.cpp b/WebCore/page/SecurityOrigin.cpp
index a1863c9..187ec31 100644
--- a/WebCore/page/SecurityOrigin.cpp
+++ b/WebCore/page/SecurityOrigin.cpp
@@ -246,12 +246,13 @@
         return create(KURL());
         
     // Make sure there's a second separator
-    int separator2 = databaseIdentifier.find(SeparatorCharacter, separator1 + 1);
+    int separator2 = databaseIdentifier.reverseFind(SeparatorCharacter);
     if (separator2 == -1)
         return create(KURL());
         
-    // Make sure there's not a third separator
-    if (databaseIdentifier.reverseFind(SeparatorCharacter) != separator2)
+    // Ensure there were at least 2 seperator characters. Some hostnames on intranets have
+    // underscores in them, so we'll assume that any additional underscores are part of the host.
+    if (separator1 != separator2)
         return create(KURL());
         
     // Make sure the port section is a valid port number or doesn't exist
@@ -277,6 +278,9 @@
 
 bool SecurityOrigin::equal(const SecurityOrigin* other) const 
 {
+    if (other == this)
+        return true;
+    
     if (!isSameSchemeHostPort(other))
         return false;
 
diff --git a/WebCore/page/Settings.cpp b/WebCore/page/Settings.cpp
index f55ac42..b67cf44 100644
--- a/WebCore/page/Settings.cpp
+++ b/WebCore/page/Settings.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,6 +33,8 @@
 #include "PageCache.h"
 #include <limits>
 
+using namespace std;
+
 namespace WebCore {
 
 static void setNeedsReapplyStylesInAllFrames(Page* page)
@@ -65,9 +67,11 @@
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
     , m_blockNetworkImage(false)
 #endif
+    , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
     , m_privateBrowsingEnabled(false)
+    , m_caretBrowsingEnabled(false)
     , m_arePluginsEnabled(false)
     , m_databasesEnabled(false)
     , m_localStorageEnabled(false)
@@ -100,8 +104,17 @@
     , m_zoomsTextOnly(false)
     , m_enforceCSSMIMETypeInStrictMode(true)
     , m_usesEncodingDetector(false)
-    , m_maximumDecodedImageSize(std::numeric_limits<size_t>::max())
     , m_allowScriptsToCloseWindows(false)
+    , m_editingBehavior(
+#if PLATFORM(MAC)
+        EditingMacBehavior
+#else
+        EditingWindowsBehavior
+#endif
+        )
+    // FIXME: This should really be disabled by default as it makes platforms that don't support the feature download files
+    // they can't use by. Leaving enabled for now to not change existing behavior.
+    , m_downloadableBinaryFontsEnabled(true)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -546,4 +559,14 @@
     m_allowScriptsToCloseWindows = allowScriptsToCloseWindows;
 }
 
+void Settings::setCaretBrowsingEnabled(bool caretBrowsingEnabled)
+{
+    m_caretBrowsingEnabled = caretBrowsingEnabled;
+}
+
+void Settings::setDownloadableBinaryFontsEnabled(bool downloadableBinaryFontsEnabled)
+{
+    m_downloadableBinaryFontsEnabled = downloadableBinaryFontsEnabled;
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/Settings.h b/WebCore/page/Settings.h
index 5a9ee3a..f2f4279 100644
--- a/WebCore/page/Settings.h
+++ b/WebCore/page/Settings.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,7 +28,7 @@
 #define Settings_h
 
 #include "AtomicString.h"
-#include "FontDescription.h"
+#include "FontRenderingMode.h"
 #include "KURL.h"
 
 namespace WebCore {
@@ -36,7 +36,7 @@
     class Page;
 
     enum EditableLinkBehavior {
-        EditableLinkDefaultBehavior = 0,
+        EditableLinkDefaultBehavior,
         EditableLinkAlwaysLive,
         EditableLinkOnlyLiveWithShiftKey,
         EditableLinkLiveWhenNotFocused,
@@ -49,6 +49,21 @@
         TextDirectionSubmenuAlwaysIncluded
     };
 
+    // There are multiple editing details that are different on Windows than Macintosh.
+    // We use a single switch for all of them. Some examples:
+    //
+    //    1) Clicking below the last line of an editable area puts the caret at the end
+    //       of the last line on Mac, but in the middle of the last line on Windows.
+    //    2) Pushing the down arrow key on the last line puts the caret at the end of the
+    //       last line on Mac, but does nothing on Windows. A similar case exists on the
+    //       top line.
+    //
+    // This setting is intended to control these sorts of behaviors. There are some other
+    // behaviors with individual function calls on EditorClient (smart copy and paste and
+    // selecting the space after a double click) that could be combined with this if
+    // if possible in the future.
+    enum EditingBehavior { EditingMacBehavior, EditingWindowsBehavior };
+
     class Settings {
     public:
         Settings(Page*);
@@ -119,7 +134,7 @@
         bool allowUniversalAccessFromFileURLs() const { return m_allowUniversalAccessFromFileURLs; }
 
         void setJavaScriptCanOpenWindowsAutomatically(bool);
-        bool JavaScriptCanOpenWindowsAutomatically() const { return m_javaScriptCanOpenWindowsAutomatically; }
+        bool javaScriptCanOpenWindowsAutomatically() const { return m_javaScriptCanOpenWindowsAutomatically; }
 
         void setJavaEnabled(bool);
         bool isJavaEnabled() const { return m_isJavaEnabled; }
@@ -135,7 +150,10 @@
 
         void setPrivateBrowsingEnabled(bool);
         bool privateBrowsingEnabled() const { return m_privateBrowsingEnabled; }
-        
+
+        void setCaretBrowsingEnabled(bool);
+        bool caretBrowsingEnabled() const { return m_caretBrowsingEnabled; }
+
         void setDefaultTextEncodingName(const String&);
         const String& defaultTextEncodingName() const { return m_defaultTextEncodingName; }
         
@@ -255,6 +273,12 @@
         void setAllowScriptsToCloseWindows(bool);
         bool allowScriptsToCloseWindows() const { return m_allowScriptsToCloseWindows; }
 
+        void setEditingBehavior(EditingBehavior behavior) { m_editingBehavior = behavior; }
+        EditingBehavior editingBehavior() const { return static_cast<EditingBehavior>(m_editingBehavior); }
+        
+        void setDownloadableBinaryFontsEnabled(bool);
+        bool downloadableBinaryFontsEnabled() const { return m_downloadableBinaryFontsEnabled; }
+
     private:
         Page* m_page;
         
@@ -308,9 +332,11 @@
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
         bool m_blockNetworkImage : 1;
 #endif
+        size_t m_maximumDecodedImageSize;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
         bool m_privateBrowsingEnabled : 1;
+        bool m_caretBrowsingEnabled : 1;
         bool m_arePluginsEnabled : 1;
         bool m_databasesEnabled : 1;
         bool m_localStorageEnabled : 1;
@@ -343,8 +369,9 @@
         bool m_zoomsTextOnly : 1;
         bool m_enforceCSSMIMETypeInStrictMode : 1;
         bool m_usesEncodingDetector : 1;
-        size_t m_maximumDecodedImageSize;
         bool m_allowScriptsToCloseWindows : 1;
+        unsigned m_editingBehavior : 1;
+        bool m_downloadableBinaryFontsEnabled : 1;
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/WebCore/page/android/InspectorControllerAndroid.cpp b/WebCore/page/android/InspectorControllerAndroid.cpp
index c480e94..922c743 100644
--- a/WebCore/page/android/InspectorControllerAndroid.cpp
+++ b/WebCore/page/android/InspectorControllerAndroid.cpp
@@ -27,6 +27,7 @@
 #include "InspectorController.h"
 
 #include "InspectorClient.h"
+#include "InspectorFrontend.h"
 
 #include "Frame.h"
 #include "Node.h"
@@ -65,7 +66,6 @@
 };
 
 InspectorController::InspectorController(Page*, InspectorClient* client)
-    : m_startProfiling(this, 0)
 {
     m_client = client;
 }
@@ -90,16 +90,8 @@
 bool InspectorController::enabled() const { return false; }
 void InspectorController::inspect(Node*) {}
 bool InspectorController::windowVisible() { return false; }
-#if USE(JSC)
-void InspectorController::addProfile(PassRefPtr<JSC::Profile>, unsigned int, const JSC::UString&) {}
-void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const JSC::UString& sourceString) {}
-void InspectorController::failedToParseSource(JSC::ExecState* exec, const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage) {}    
-void InspectorController::didParseSource(JSC::ExecState* exec, const JSC::SourceCode& source) {}
-void InspectorController::scriptImported(unsigned long identifier, const JSC::UString& sourceString) {}
-#elif USE(V8)
-void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const String& sourceString) {}
+void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString) {}
 void InspectorController::scriptImported(unsigned long identifier, const String& sourceString) {}
-#endif
 void InspectorController::inspectedPageDestroyed() {}
 
 void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame) {}
@@ -116,5 +108,4 @@
 void InspectorController::didPause() {}
 #endif
 
-void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>*) {}
 }  // namespace WebCore
diff --git a/WebCore/page/animation/AnimationBase.cpp b/WebCore/page/animation/AnimationBase.cpp
index e500fe4..7b8a189 100644
--- a/WebCore/page/animation/AnimationBase.cpp
+++ b/WebCore/page/animation/AnimationBase.cpp
@@ -101,6 +101,12 @@
     return to.blend(from, progress);
 }
 
+static inline LengthSize blendFunc(const AnimationBase* anim, const LengthSize& from, const LengthSize& to, double progress)
+{  
+    return LengthSize(blendFunc(anim, from.width(), to.width(), progress),
+                      blendFunc(anim, from.height(), to.height(), progress));
+}
+
 static inline IntSize blendFunc(const AnimationBase* anim, const IntSize& from, const IntSize& to, double progress)
 {  
     return IntSize(blendFunc(anim, from.width(), to.width(), progress),
@@ -413,7 +419,16 @@
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyPaddingTop, &RenderStyle::paddingTop, &RenderStyle::setPaddingTop));
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyPaddingBottom, &RenderStyle::paddingBottom, &RenderStyle::setPaddingBottom));
         gPropertyWrappers->append(new PropertyWrapper<const Color&>(CSSPropertyColor, &RenderStyle::color, &RenderStyle::setColor));
+
         gPropertyWrappers->append(new PropertyWrapper<const Color&>(CSSPropertyBackgroundColor, &RenderStyle::backgroundColor, &RenderStyle::setBackgroundColor));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyBackgroundPositionX, &RenderStyle::backgroundXPosition, &RenderStyle::setBackgroundXPosition));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyBackgroundPositionY, &RenderStyle::backgroundYPosition, &RenderStyle::setBackgroundYPosition));
+        gPropertyWrappers->append(new PropertyWrapper<LengthSize>(CSSPropertyWebkitBackgroundSize, &RenderStyle::backgroundSize, &RenderStyle::setBackgroundSize));
+
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitMaskPositionX, &RenderStyle::maskXPosition, &RenderStyle::setMaskXPosition));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitMaskPositionY, &RenderStyle::maskYPosition, &RenderStyle::setMaskYPosition));
+        gPropertyWrappers->append(new PropertyWrapper<LengthSize>(CSSPropertyWebkitMaskSize, &RenderStyle::maskSize, &RenderStyle::setMaskSize));
+
         gPropertyWrappers->append(new PropertyWrapper<int>(CSSPropertyFontSize, &RenderStyle::fontSize, &RenderStyle::setBlendedFontSize));
         gPropertyWrappers->append(new PropertyWrapper<unsigned short>(CSSPropertyWebkitColumnRuleWidth, &RenderStyle::columnRuleWidth, &RenderStyle::setColumnRuleWidth));
         gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyWebkitColumnGap, &RenderStyle::columnGap, &RenderStyle::setColumnGap));
@@ -469,20 +484,13 @@
 
         // TODO:
         // 
-        //  CSSPropertyBackground, CSSPropertyBackgroundPosition
         //  CSSPropertyMinWidth, CSSPropertyMaxWidth, CSSPropertyMinHeight, CSSPropertyMaxHeight
         //  CSSPropertyTextIndent
         //  CSSPropertyVerticalAlign
-        //  CSSPropertyWebkitBackgroundOrigin
-        //  CSSPropertyWebkitBackgroundSize
-        //  CSSPropertyWebkitMaskPosition
-        //  CSSPropertyWebkitMaskOrigin
-        //  CSSPropertyWebkitMaskSize
         // 
         // Compound properties that have components that should be animatable:
         // 
         //  CSSPropertyWebkitColumns
-        //  CSSPropertyWebkitMask
         //  CSSPropertyWebkitBoxReflect
 
         // Make sure unused slots have a value
@@ -516,7 +524,10 @@
 static void addShorthandProperties()
 {
     static const int animatableShorthandProperties[] = {
-        CSSPropertyBackground,      // for background-color
+        CSSPropertyBackground,      // for background-color, background-position
+        CSSPropertyBackgroundPosition,
+        CSSPropertyWebkitMask,      // for mask-position
+        CSSPropertyWebkitMaskPosition,
         CSSPropertyBorderTop, CSSPropertyBorderRight, CSSPropertyBorderBottom, CSSPropertyBorderLeft,
         CSSPropertyBorderColor, 
         CSSPropertyBorderWidth,
@@ -581,8 +592,8 @@
 
 AnimationBase::~AnimationBase()
 {
-    m_compAnim->removeFromStyleAvailableWaitList(this);
-    m_compAnim->removeFromStartTimeResponseWaitList(this);
+    m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
+    m_compAnim->animationController()->removeFromStartTimeResponseWaitList(this);
 }
 
 bool AnimationBase::propertiesEqual(int prop, const RenderStyle* a, const RenderStyle* b)
@@ -649,11 +660,11 @@
 }
 #endif
 
-void AnimationBase::setChanged(Node* node)
+void AnimationBase::setNeedsStyleRecalc(Node* node)
 {
     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
     if (node)
-        node->setChanged(AnimationStyleChange);
+        node->setNeedsStyleRecalc(AnimationStyleChange);
 }
 
 double AnimationBase::duration() const
@@ -676,7 +687,7 @@
     // If we get AnimationStateInputRestartAnimation then we force a new animation, regardless of state.
     if (input == AnimationStateInputMakeNew) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->removeFromStyleAvailableWaitList(this);
+            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
         m_animState = AnimationStateNew;
         m_startTime = 0;
         m_pauseTime = -1;
@@ -688,7 +699,7 @@
 
     if (input == AnimationStateInputRestartAnimation) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->removeFromStyleAvailableWaitList(this);
+            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
         m_animState = AnimationStateNew;
         m_startTime = 0;
         m_pauseTime = -1;
@@ -703,7 +714,7 @@
 
     if (input == AnimationStateInputEndAnimation) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->removeFromStyleAvailableWaitList(this);
+            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
         m_animState = AnimationStateDone;
         endAnimation(true);
         return;
@@ -743,11 +754,11 @@
                 ASSERT(param >= 0);
                 // Start timer has fired, tell the animation to start and wait for it to respond with start time
                 m_animState = AnimationStateStartWaitStyleAvailable;
-                m_compAnim->addToStyleAvailableWaitList(this);
+                m_compAnim->animationController()->addToStyleAvailableWaitList(this);
 
                 // Trigger a render so we can start the animation
                 if (m_object)
-                    m_compAnim->animationControllerPriv()->addNodeChangeToDispatch(m_object->node());
+                    m_compAnim->animationController()->addNodeChangeToDispatch(m_object->node());
             } else {
                 ASSERT(!paused());
                 // We're waiting for the start timer to fire and we got a pause. Cancel the timer, pause and wait
@@ -776,7 +787,7 @@
             }
             else {
                 bool started = startAnimation(0);
-                m_compAnim->addToStartTimeResponseWaitList(this, started);
+                m_compAnim->animationController()->addToStartTimeResponseWaitList(this, started);
                 m_fallbackAnimating = !started;
             }
             break;
@@ -792,9 +803,9 @@
                 // Decide whether to go into looping or ending state
                 goIntoEndingOrLoopingState();
 
-                // Dispatch updateRendering so we can start the animation
+                // Dispatch updateStyleIfNeeded so we can start the animation
                 if (m_object)
-                    m_compAnim->animationControllerPriv()->addNodeChangeToDispatch(m_object->node());
+                    m_compAnim->animationController()->addNodeChangeToDispatch(m_object->node());
             } else {
                 // We are pausing while waiting for a start response. Cancel the animation and wait. When 
                 // we unpause, we will act as though the start timer just fired
@@ -834,7 +845,7 @@
                     resumeOverriddenAnimations();
 
                     // Fire off another style change so we can set the final value
-                    m_compAnim->animationControllerPriv()->addNodeChangeToDispatch(m_object->node());
+                    m_compAnim->animationController()->addNodeChangeToDispatch(m_object->node());
                 }
             } else {
                 // We are pausing while running. Cancel the animation and wait
@@ -891,8 +902,8 @@
                 updateStateMachine(AnimationStateInputStartTimeSet, beginAnimationUpdateTime());
                 m_fallbackAnimating = true;
             } else {
-                bool started = startAnimation(0);
-                m_compAnim->addToStartTimeResponseWaitList(this, started);
+                bool started = startAnimation(m_startTime);
+                m_compAnim->animationController()->addToStartTimeResponseWaitList(this, started);
                 m_fallbackAnimating = !started;
             }
             break;
@@ -958,7 +969,7 @@
         updateStateMachine(run ? AnimationStateInputPlayStateRunnning : AnimationStateInputPlayStatePaused, -1);
 }
 
-double AnimationBase::willNeedService()
+double AnimationBase::timeToNextService()
 {
     // Returns the time at which next service is required. -1 means no service is required. 0 means 
     // service is required now, and > 0 means service is required that many seconds in the future.
@@ -1062,7 +1073,7 @@
 
 double AnimationBase::beginAnimationUpdateTime() const
 {
-    return m_compAnim->animationControllerPriv()->beginAnimationUpdateTime();
+    return m_compAnim->animationController()->beginAnimationUpdateTime();
 }
 
 double AnimationBase::getElapsedTime() const
diff --git a/WebCore/page/animation/AnimationBase.h b/WebCore/page/animation/AnimationBase.h
index da4341b..8f55a8e 100644
--- a/WebCore/page/animation/AnimationBase.h
+++ b/WebCore/page/animation/AnimationBase.h
@@ -45,7 +45,7 @@
 class TimingFunction;
 
 class AnimationBase : public RefCounted<AnimationBase> {
-    friend class CompositeAnimationPrivate;
+    friend class CompositeAnimation;
 
 public:
     AnimationBase(const Animation* transition, RenderObject* renderer, CompositeAnimation* compAnim);
@@ -120,7 +120,7 @@
     // "animating" means that something is running that requires a timer to keep firing
     // (e.g. a software animation)
     void setAnimating(bool inAnimating = true) { m_isAnimating = inAnimating; }
-    virtual double willNeedService();
+    virtual double timeToNextService();
 
     double progress(double scale, double offset, const TimingFunction*) const;
 
@@ -186,7 +186,7 @@
     virtual void onAnimationIteration(double /*elapsedTime*/) { }
     virtual void onAnimationEnd(double /*elapsedTime*/) { }
     virtual bool startAnimation(double /*beginTime*/) { return false; }
-    virtual void endAnimation(bool /*reset*/, double /*forcePauseTime*/ = -1) { }
+    virtual void endAnimation(bool /*reset*/) { }
 
     void goIntoEndingOrLoopingState();
 
@@ -199,7 +199,7 @@
     // Return true if we need to start software animation timers
     static bool blendProperties(const AnimationBase* anim, int prop, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress);
 
-    static void setChanged(Node*);
+    static void setNeedsStyleRecalc(Node*);
     
     void getTimeToNextEvent(double& time, bool& isLooping) const;
 
diff --git a/WebCore/page/animation/AnimationController.cpp b/WebCore/page/animation/AnimationController.cpp
index f9c9a47..58a1f5b 100644
--- a/WebCore/page/animation/AnimationController.cpp
+++ b/WebCore/page/animation/AnimationController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +35,7 @@
 #include "CompositeAnimation.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "RenderObject.h"
+#include "RenderView.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/UnusedParam.h>
 
@@ -46,7 +46,7 @@
 
 AnimationControllerPrivate::AnimationControllerPrivate(Frame* frame)
     : m_animationTimer(this, &AnimationControllerPrivate::animationTimerFired)
-    , m_updateRenderingDispatcher(this, &AnimationControllerPrivate::updateRenderingDispatcherFired)
+    , m_updateStyleIfNeededDispatcher(this, &AnimationControllerPrivate::updateStyleIfNeededDispatcherFired)
     , m_frame(frame)
     , m_beginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet)
     , m_styleAvailableWaiters(0)
@@ -74,7 +74,7 @@
 bool AnimationControllerPrivate::clear(RenderObject* renderer)
 {
     // Return false if we didn't do anything OR we are suspended (so we don't try to
-    // do a setChanged() when suspended).
+    // do a setNeedsStyleRecalc() when suspended).
     PassRefPtr<CompositeAnimation> animation = m_compositeAnimations.take(renderer);
     if (!animation)
         return false;
@@ -89,16 +89,16 @@
 
     RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
     for (RenderObjectAnimationMap::const_iterator it = m_compositeAnimations.begin(); it != animationsEnd; ++it) {
-        RefPtr<CompositeAnimation> compAnim = it->second;
+        CompositeAnimation* compAnim = it->second.get();
         if (!compAnim->isSuspended() && compAnim->hasAnimations()) {
-            double t = compAnim->willNeedService();
+            double t = compAnim->timeToNextService();
             if (t != -1 && (t < needsService || needsService == -1))
                 needsService = t;
             if (needsService == 0) {
                 if (callSetChanged) {
                     Node* node = it->first->node();
                     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
-                    node->setChanged(AnimationStyleChange);
+                    node->setNeedsStyleRecalc(AnimationStyleChange);
                     calledSetChanged = true;
                 }
                 else
@@ -108,7 +108,7 @@
     }
     
     if (calledSetChanged)
-        m_frame->document()->updateRendering();
+        m_frame->document()->updateStyleIfNeeded();
     
     // If we want service immediately, we start a repeating timer to reduce the overhead of starting
     if (needsService == 0) {
@@ -130,7 +130,7 @@
     m_animationTimer.startOneShot(needsService);
 }
 
-void AnimationControllerPrivate::updateRenderingDispatcherFired(Timer<AnimationControllerPrivate>*)
+void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<AnimationControllerPrivate>*)
 {
     // fire all the events
     Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = m_eventsToDispatch.end();
@@ -146,18 +146,32 @@
     // call setChanged on all the elements
     Vector<RefPtr<Node> >::const_iterator nodeChangesToDispatchEnd = m_nodeChangesToDispatch.end();
     for (Vector<RefPtr<Node> >::const_iterator it = m_nodeChangesToDispatch.begin(); it != nodeChangesToDispatchEnd; ++it)
-        (*it)->setChanged(AnimationStyleChange);
+        (*it)->setNeedsStyleRecalc(AnimationStyleChange);
     
     m_nodeChangesToDispatch.clear();
     
     if (m_frame)
-        m_frame->document()->updateRendering();
+        m_frame->document()->updateStyleIfNeeded();
+
+    // We can now safely remove any animations or transitions that are finished.
+    // We can't remove them any earlier because we might get a false restart of
+    // a transition. This can happen because we have not yet set the final property
+    // value until we call the rendering dispatcher. So this can make the current
+    // style slightly different from the desired final style (because our last 
+    // animation step was, say 0.9999 or something). And we need to remove them
+    // here because if there are no more animations running we'll never get back
+    // into the animation code to clean them up.
+    RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
+    for (RenderObjectAnimationMap::const_iterator it = m_compositeAnimations.begin(); it != animationsEnd; ++it) {
+        CompositeAnimation* compAnim = it->second.get();
+        compAnim->cleanupFinishedAnimations(); // will not modify m_compositeAnimations, so OK to call while iterating
+    }
 }
 
-void AnimationControllerPrivate::startUpdateRenderingDispatcher()
+void AnimationControllerPrivate::startUpdateStyleIfNeededDispatcher()
 {
-    if (!m_updateRenderingDispatcher.isActive())
-        m_updateRenderingDispatcher.startOneShot(0);
+    if (!m_updateStyleIfNeededDispatcher.isActive())
+        m_updateStyleIfNeededDispatcher.startOneShot(0);
 }
 
 void AnimationControllerPrivate::addEventToDispatch(PassRefPtr<Element> element, const AtomicString& eventType, const String& name, double elapsedTime)
@@ -169,7 +183,7 @@
     event.name = name;
     event.elapsedTime = elapsedTime;
     
-    startUpdateRenderingDispatcher();
+    startUpdateStyleIfNeededDispatcher();
 }
 
 void AnimationControllerPrivate::addNodeChangeToDispatch(PassRefPtr<Node> node)
@@ -179,7 +193,7 @@
         return;
 
     m_nodeChangesToDispatch.append(node);
-    startUpdateRenderingDispatcher();
+    startUpdateStyleIfNeededDispatcher();
 }
 
 void AnimationControllerPrivate::animationTimerFired(Timer<AnimationControllerPrivate>*)
@@ -189,7 +203,7 @@
     setBeginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet);
 
     // When the timer fires, all we do is call setChanged on all DOM nodes with running animations and then do an immediate
-    // updateRendering.  It will then call back to us with new information.
+    // updateStyleIfNeeded.  It will then call back to us with new information.
     updateAnimationTimer(true);
 }
 
@@ -204,12 +218,15 @@
 
 void AnimationControllerPrivate::suspendAnimations(Document* document)
 {
+    setBeginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet);
+    
     RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
     for (RenderObjectAnimationMap::const_iterator it = m_compositeAnimations.begin(); it != animationsEnd; ++it) {
         RenderObject* renderer = it->first;
-        RefPtr<CompositeAnimation> compAnim = it->second;
-        if (renderer->document() == document)
+        if (renderer->document() == document) {
+            CompositeAnimation* compAnim = it->second.get();
             compAnim->suspendAnimations();
+        }
     }
     
     updateAnimationTimer();
@@ -217,12 +234,15 @@
 
 void AnimationControllerPrivate::resumeAnimations(Document* document)
 {
+    setBeginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet);
+    
     RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
     for (RenderObjectAnimationMap::const_iterator it = m_compositeAnimations.begin(); it != animationsEnd; ++it) {
         RenderObject* renderer = it->first;
-        RefPtr<CompositeAnimation> compAnim = it->second;
-        if (renderer->document() == document)
+        if (renderer->document() == document) {
+            CompositeAnimation* compAnim = it->second.get();
             compAnim->resumeAnimations();
+        }
     }
     
     updateAnimationTimer();
@@ -238,8 +258,8 @@
         return false;
 
     if (compAnim->pauseAnimationAtTime(name, t)) {
-        renderer->node()->setChanged(AnimationStyleChange);
-        startUpdateRenderingDispatcher();
+        renderer->node()->setNeedsStyleRecalc(AnimationStyleChange);
+        startUpdateStyleIfNeededDispatcher();
         return true;
     }
 
@@ -256,8 +276,8 @@
         return false;
 
     if (compAnim->pauseTransitionAtTime(cssPropertyID(property), t)) {
-        renderer->node()->setChanged(AnimationStyleChange);
-        startUpdateRenderingDispatcher();
+        renderer->node()->setNeedsStyleRecalc(AnimationStyleChange);
+        startUpdateStyleIfNeededDispatcher();
         return true;
     }
 
@@ -365,7 +385,7 @@
     // In the second case, we just pass in the beginAnimationUpdateTime().
     //
     // This will synchronize all software and accelerated animations started in the same 
-    // updateRendering cycle.
+    // updateStyleIfNeeded cycle.
     //
     ASSERT(!animation->next());
     
@@ -432,7 +452,7 @@
     if (m_data->clear(renderer)) {
         Node* node = renderer->node();
         ASSERT(!node || (node->document() && !node->document()->inPageCache()));
-        node->setChanged(AnimationStyleChange);
+        node->setNeedsStyleRecalc(AnimationStyleChange);
     }
 }
 
@@ -447,6 +467,10 @@
     if ((!oldStyle || (!oldStyle->animations() && !oldStyle->transitions())) && (!newStyle->animations() && !newStyle->transitions()))
         return newStyle;
 
+    // Don't run transitions when printing.
+    if (renderer->view()->printing())
+        return newStyle;
+
     // Fetch our current set of implicit animations from a hashtable.  We then compare them
     // against the animations in the style and make sure we're in sync.  If destination values
     // have changed, we reset the animation.  We then do a blend to get new values and we return
diff --git a/WebCore/page/animation/AnimationControllerPrivate.h b/WebCore/page/animation/AnimationControllerPrivate.h
index f9a3405..359b9b5 100644
--- a/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/WebCore/page/animation/AnimationControllerPrivate.h
@@ -60,8 +60,8 @@
     void animationTimerFired(Timer<AnimationControllerPrivate>*);
     void updateAnimationTimer(bool callSetChanged = false);
 
-    void updateRenderingDispatcherFired(Timer<AnimationControllerPrivate>*);
-    void startUpdateRenderingDispatcher();
+    void updateStyleIfNeededDispatcherFired(Timer<AnimationControllerPrivate>*);
+    void startUpdateStyleIfNeededDispatcher();
     void addEventToDispatch(PassRefPtr<Element> element, const AtomicString& eventType, const String& name, double elapsedTime);
     void addNodeChangeToDispatch(PassRefPtr<Node>);
 
@@ -107,7 +107,7 @@
 
     RenderObjectAnimationMap m_compositeAnimations;
     Timer<AnimationControllerPrivate> m_animationTimer;
-    Timer<AnimationControllerPrivate> m_updateRenderingDispatcher;
+    Timer<AnimationControllerPrivate> m_updateStyleIfNeededDispatcher;
     Frame* m_frame;
     
     class EventToDispatch {
diff --git a/WebCore/page/animation/CompositeAnimation.cpp b/WebCore/page/animation/CompositeAnimation.cpp
index d386f1b..d60455a 100644
--- a/WebCore/page/animation/CompositeAnimation.cpp
+++ b/WebCore/page/animation/CompositeAnimation.cpp
@@ -38,78 +38,14 @@
 
 namespace WebCore {
 
-class CompositeAnimationPrivate {
-public:
-    CompositeAnimationPrivate(AnimationControllerPrivate* animationController, CompositeAnimation* compositeAnimation)
-        : m_isSuspended(false)
-        , m_animationController(animationController)
-        , m_compositeAnimation(compositeAnimation)
-        , m_numStyleAvailableWaiters(0)
-    {
-    }
-    
-    ~CompositeAnimationPrivate();
-
-    void clearRenderer();
-
-    PassRefPtr<RenderStyle> animate(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
-    PassRefPtr<RenderStyle> getAnimatedStyle();
-
-    AnimationControllerPrivate* animationControllerPriv() const { return m_animationController; }
-
-    void setAnimating(bool);
-    double willNeedService() const;
-    
-    PassRefPtr<KeyframeAnimation> getAnimationForProperty(int property);
-
-    void cleanupFinishedAnimations(RenderObject*);
-
-    void suspendAnimations();
-    void resumeAnimations();
-    bool isSuspended() const { return m_isSuspended; }
-
-    void overrideImplicitAnimations(int property);
-    void resumeOverriddenImplicitAnimations(int property);
-
-    bool hasAnimations() const  { return !m_transitions.isEmpty() || !m_keyframeAnimations.isEmpty(); }
-
-    bool isAnimatingProperty(int property, bool isRunningNow) const;
-
-    void addToStyleAvailableWaitList(AnimationBase*);
-    void removeFromStyleAvailableWaitList(AnimationBase*);
-
-    void addToStartTimeResponseWaitList(AnimationBase*, bool willGetResponse);
-    void removeFromStartTimeResponseWaitList(AnimationBase*);
-
-    bool pauseAnimationAtTime(const AtomicString& name, double t);
-    bool pauseTransitionAtTime(int property, double t);
-    unsigned numberOfActiveAnimations() const;
-
-protected:
-    void updateTransitions(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
-    void updateKeyframeAnimations(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
-
-private:
-    typedef HashMap<int, RefPtr<ImplicitAnimation> > CSSPropertyTransitionsMap;
-    typedef HashMap<AtomicStringImpl*, RefPtr<KeyframeAnimation> >  AnimationNameMap;
-
-    CSSPropertyTransitionsMap m_transitions;
-    AnimationNameMap m_keyframeAnimations;
-    Vector<AtomicStringImpl*> m_keyframeAnimationOrderMap;
-    bool m_isSuspended;
-    AnimationControllerPrivate* m_animationController;
-    CompositeAnimation* m_compositeAnimation;
-    unsigned m_numStyleAvailableWaiters;
-};
-
-CompositeAnimationPrivate::~CompositeAnimationPrivate()
+CompositeAnimation::~CompositeAnimation()
 {
     // Toss the refs to all animations
     m_transitions.clear();
     m_keyframeAnimations.clear();
 }
 
-void CompositeAnimationPrivate::clearRenderer()
+void CompositeAnimation::clearRenderer()
 {
     if (!m_transitions.isEmpty()) {
         // Clear the renderers from all running animations, in case we are in the middle of
@@ -129,7 +65,7 @@
     }
 }
 
-void CompositeAnimationPrivate::updateTransitions(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
+void CompositeAnimation::updateTransitions(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
 {
     RefPtr<RenderStyle> modifiedCurrentStyle;
     
@@ -174,7 +110,11 @@
             bool equal = true;
 
             if (implAnim) {
-                // This implAnim might not be an already running transition. It might be
+                // This might be a transition that is just finishing. That would be the case
+                // if it were postActive. But we still need to check for equality because
+                // it could be just finishing AND changing to a new goal state.
+                //
+                // This implAnim might also not be an already running transition. It might be
                 // newly added to the list in a previous iteration. This would happen if
                 // you have both an explicit transition-property and 'all' in the same
                 // list. In this case, the latter one overrides the earlier one, so we
@@ -198,9 +138,13 @@
                 equal = !isActiveTransition || AnimationBase::propertiesEqual(prop, fromStyle, targetStyle);
             }
 
-            if (!equal) {
+            // We can be in this loop with an inactive transition (!isActiveTransition). We need
+            // to do that to check to see if we are canceling a transition. But we don't want to
+            // start one of the inactive transitions. So short circuit that here. (See
+            // <https://bugs.webkit.org/show_bug.cgi?id=24787>
+            if (!equal && isActiveTransition) {
                 // Add the new transition
-                m_transitions.set(prop, ImplicitAnimation::create(const_cast<Animation*>(anim), prop, renderer, m_compositeAnimation, modifiedCurrentStyle ? modifiedCurrentStyle.get() : fromStyle));
+                m_transitions.set(prop, ImplicitAnimation::create(const_cast<Animation*>(anim), prop, renderer, this, modifiedCurrentStyle ? modifiedCurrentStyle.get() : fromStyle));
             }
             
             // We only need one pass for the single prop case
@@ -210,7 +154,7 @@
     }
 }
 
-void CompositeAnimationPrivate::updateKeyframeAnimations(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
+void CompositeAnimation::updateKeyframeAnimations(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
 {
     // Nothing to do if we don't have any animations, and didn't have any before
     if (m_keyframeAnimations.isEmpty() && !targetStyle->hasAnimations())
@@ -251,7 +195,7 @@
                 keyframeAnim->setAnimation(anim);
                 keyframeAnim->setIndex(i);
             } else if ((anim->duration() || anim->delay()) && anim->iterationCount()) {
-                keyframeAnim = KeyframeAnimation::create(const_cast<Animation*>(anim), renderer, i, m_compositeAnimation, currentStyle ? currentStyle : targetStyle);
+                keyframeAnim = KeyframeAnimation::create(const_cast<Animation*>(anim), renderer, i, this, currentStyle ? currentStyle : targetStyle);
                 m_keyframeAnimations.set(keyframeAnim->name().impl(), keyframeAnim);
             }
             
@@ -275,7 +219,7 @@
         m_keyframeAnimations.remove(animsToBeRemoved[j]);
 }
 
-PassRefPtr<RenderStyle> CompositeAnimationPrivate::animate(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
+PassRefPtr<RenderStyle> CompositeAnimation::animate(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
 {
     RefPtr<RenderStyle> resultStyle;
 
@@ -292,7 +236,7 @@
             CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
             for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
                 if (ImplicitAnimation* anim = it->second.get())
-                    anim->animate(m_compositeAnimation, renderer, currentStyle, targetStyle, resultStyle);
+                    anim->animate(this, renderer, currentStyle, targetStyle, resultStyle);
             }
         }
     }
@@ -302,15 +246,15 @@
     for (Vector<AtomicStringImpl*>::const_iterator it = m_keyframeAnimationOrderMap.begin(); it != m_keyframeAnimationOrderMap.end(); ++it) {
         RefPtr<KeyframeAnimation> keyframeAnim = m_keyframeAnimations.get(*it);
         if (keyframeAnim)
-            keyframeAnim->animate(m_compositeAnimation, renderer, currentStyle, targetStyle, resultStyle);
+            keyframeAnim->animate(this, renderer, currentStyle, targetStyle, resultStyle);
     }
 
-    cleanupFinishedAnimations(renderer);
+    cleanupFinishedAnimations();
 
     return resultStyle ? resultStyle.release() : targetStyle;
 }
 
-PassRefPtr<RenderStyle> CompositeAnimationPrivate::getAnimatedStyle()
+PassRefPtr<RenderStyle> CompositeAnimation::getAnimatedStyle() const
 {
     RefPtr<RenderStyle> resultStyle;
     CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
@@ -329,7 +273,7 @@
 }
 
 // "animating" means that something is running that requires the timer to keep firing
-void CompositeAnimationPrivate::setAnimating(bool animating)
+void CompositeAnimation::setAnimating(bool animating)
 {
     if (!m_transitions.isEmpty()) {
         CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
@@ -347,7 +291,7 @@
     }
 }
 
-double CompositeAnimationPrivate::willNeedService() const
+double CompositeAnimation::timeToNextService() const
 {
     // Returns the time at which next service is required. -1 means no service is required. 0 means 
     // service is required now, and > 0 means service is required that many seconds in the future.
@@ -357,7 +301,7 @@
         CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
         for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
             ImplicitAnimation* transition = it->second.get();
-            double t = transition ? transition->willNeedService() : -1;
+            double t = transition ? transition->timeToNextService() : -1;
             if (t < minT || minT == -1)
                 minT = t;
             if (minT == 0)
@@ -368,7 +312,7 @@
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             KeyframeAnimation* animation = it->second.get();
-            double t = animation ? animation->willNeedService() : -1;
+            double t = animation ? animation->timeToNextService() : -1;
             if (t < minT || minT == -1)
                 minT = t;
             if (minT == 0)
@@ -379,7 +323,7 @@
     return minT;
 }
 
-PassRefPtr<KeyframeAnimation> CompositeAnimationPrivate::getAnimationForProperty(int property)
+PassRefPtr<KeyframeAnimation> CompositeAnimation::getAnimationForProperty(int property) const
 {
     RefPtr<KeyframeAnimation> retval;
     
@@ -397,7 +341,7 @@
     return retval;
 }
 
-void CompositeAnimationPrivate::cleanupFinishedAnimations(RenderObject*)
+void CompositeAnimation::cleanupFinishedAnimations()
 {
     if (isSuspended())
         return;
@@ -441,7 +385,7 @@
     }
 }
 
-void CompositeAnimationPrivate::suspendAnimations()
+void CompositeAnimation::suspendAnimations()
 {
     if (m_isSuspended)
         return;
@@ -465,7 +409,7 @@
     }
 }
 
-void CompositeAnimationPrivate::resumeAnimations()
+void CompositeAnimation::resumeAnimations()
 {
     if (!m_isSuspended)
         return;
@@ -491,7 +435,7 @@
     }
 }
 
-void CompositeAnimationPrivate::overrideImplicitAnimations(int property)
+void CompositeAnimation::overrideImplicitAnimations(int property)
 {
     CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
     if (!m_transitions.isEmpty()) {
@@ -503,7 +447,7 @@
     }
 }
 
-void CompositeAnimationPrivate::resumeOverriddenImplicitAnimations(int property)
+void CompositeAnimation::resumeOverriddenImplicitAnimations(int property)
 {
     if (!m_transitions.isEmpty()) {
         CSSPropertyTransitionsMap::const_iterator end = m_transitions.end();
@@ -515,7 +459,7 @@
     }
 }
 
-bool CompositeAnimationPrivate::isAnimatingProperty(int property, bool isRunningNow) const
+bool CompositeAnimation::isAnimatingProperty(int property, bool isRunningNow) const
 {
     if (!m_keyframeAnimations.isEmpty()) {
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
@@ -537,27 +481,7 @@
     return false;
 }
 
-void CompositeAnimationPrivate::addToStyleAvailableWaitList(AnimationBase* animation)
-{
-    m_animationController->addToStyleAvailableWaitList(animation);
-}
-
-void CompositeAnimationPrivate::removeFromStyleAvailableWaitList(AnimationBase* animation)
-{
-    m_animationController->removeFromStyleAvailableWaitList(animation);
-}
-
-void CompositeAnimationPrivate::addToStartTimeResponseWaitList(AnimationBase* animation, bool willGetResponse)
-{
-    m_animationController->addToStartTimeResponseWaitList(animation, willGetResponse);
-}
-
-void CompositeAnimationPrivate::removeFromStartTimeResponseWaitList(AnimationBase* animation)
-{
-    m_animationController->removeFromStartTimeResponseWaitList(animation);
-}
-
-bool CompositeAnimationPrivate::pauseAnimationAtTime(const AtomicString& name, double t)
+bool CompositeAnimation::pauseAnimationAtTime(const AtomicString& name, double t)
 {
     if (!name)
         return false;
@@ -575,7 +499,7 @@
     return false;
 }
 
-bool CompositeAnimationPrivate::pauseTransitionAtTime(int property, double t)
+bool CompositeAnimation::pauseTransitionAtTime(int property, double t)
 {
     if ((property < firstCSSProperty) || (property >= firstCSSProperty + numCSSProperties))
         return false;
@@ -592,7 +516,7 @@
     return false;
 }
 
-unsigned CompositeAnimationPrivate::numberOfActiveAnimations() const
+unsigned CompositeAnimation::numberOfActiveAnimations() const
 {
     unsigned count = 0;
     
@@ -617,119 +541,4 @@
     return count;
 }
 
-CompositeAnimation::CompositeAnimation(AnimationControllerPrivate* animationController)
-    : m_data(new CompositeAnimationPrivate(animationController, this))
-{
-}
-
-CompositeAnimation::~CompositeAnimation()
-{
-    delete m_data;
-}
-
-AnimationControllerPrivate* CompositeAnimation::animationControllerPriv() const
-{
-    return m_data->animationControllerPriv(); 
-}
-
-void CompositeAnimation::clearRenderer()
-{
-    m_data->clearRenderer();
-}
-
-PassRefPtr<RenderStyle> CompositeAnimation::animate(RenderObject* renderer, RenderStyle* currentStyle, RenderStyle* targetStyle)
-{
-    return m_data->animate(renderer, currentStyle, targetStyle);
-}
-
-PassRefPtr<RenderStyle> CompositeAnimation::getAnimatedStyle()
-{
-    return m_data->getAnimatedStyle();
-}
-
-double CompositeAnimation::willNeedService() const
-{
-    return m_data->willNeedService();
-}
-
-void CompositeAnimation::addToStyleAvailableWaitList(AnimationBase* animation)
-{
-    m_data->addToStyleAvailableWaitList(animation);
-}
-
-void CompositeAnimation::removeFromStyleAvailableWaitList(AnimationBase* animation)
-{
-    m_data->removeFromStyleAvailableWaitList(animation);
-}
-
-void CompositeAnimation::addToStartTimeResponseWaitList(AnimationBase* animation, bool willGetResponse)
-{
-    m_data->addToStartTimeResponseWaitList(animation, willGetResponse);
-}
-
-void CompositeAnimation::removeFromStartTimeResponseWaitList(AnimationBase* animation)
-{
-    m_data->removeFromStartTimeResponseWaitList(animation);
-}
-
-void CompositeAnimation::suspendAnimations()
-{
-    m_data->suspendAnimations();
-}
-
-void CompositeAnimation::resumeAnimations()
-{
-    m_data->resumeAnimations();
-}
-
-bool CompositeAnimation::isSuspended() const
-{
-    return m_data->isSuspended();
-}
-
-bool CompositeAnimation::hasAnimations() const
-{
-    return m_data->hasAnimations();
-}
-
-void CompositeAnimation::setAnimating(bool b)
-{
-    m_data->setAnimating(b);
-}
-
-bool CompositeAnimation::isAnimatingProperty(int property, bool isRunningNow) const
-{
-    return m_data->isAnimatingProperty(property, isRunningNow);
-}
-
-PassRefPtr<KeyframeAnimation> CompositeAnimation::getAnimationForProperty(int property)
-{
-    return m_data->getAnimationForProperty(property);
-}
-
-void CompositeAnimation::overrideImplicitAnimations(int property)
-{
-    m_data->overrideImplicitAnimations(property);
-}
-
-void CompositeAnimation::resumeOverriddenImplicitAnimations(int property)
-{
-    m_data->resumeOverriddenImplicitAnimations(property);
-}
-
-bool CompositeAnimation::pauseAnimationAtTime(const AtomicString& name, double t)
-{
-    return m_data->pauseAnimationAtTime(name, t);
-}
-
-bool CompositeAnimation::pauseTransitionAtTime(int property, double t)
-{
-    return m_data->pauseTransitionAtTime(property, t);
-}
-
-unsigned CompositeAnimation::numberOfActiveAnimations() const
-{
-    return m_data->numberOfActiveAnimations();
-}
-
 } // namespace WebCore
diff --git a/WebCore/page/animation/CompositeAnimation.h b/WebCore/page/animation/CompositeAnimation.h
index b5857aa..739cfdc 100644
--- a/WebCore/page/animation/CompositeAnimation.h
+++ b/WebCore/page/animation/CompositeAnimation.h
@@ -31,16 +31,15 @@
 
 #include "AtomicString.h"
 
+#include "ImplicitAnimation.h"
+#include "KeyframeAnimation.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
 class AnimationControllerPrivate;
-class CompositeAnimationPrivate;
-class AnimationBase;
 class AnimationController;
-class KeyframeAnimation;
 class RenderObject;
 class RenderStyle;
 
@@ -58,28 +57,24 @@
     void clearRenderer();
 
     PassRefPtr<RenderStyle> animate(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
-    PassRefPtr<RenderStyle> getAnimatedStyle();
+    PassRefPtr<RenderStyle> getAnimatedStyle() const;
 
-    double willNeedService() const;
+    double timeToNextService() const;
     
-    AnimationControllerPrivate* animationControllerPriv() const;
-
-    void addToStyleAvailableWaitList(AnimationBase*);
-    void removeFromStyleAvailableWaitList(AnimationBase*);
-
-    void addToStartTimeResponseWaitList(AnimationBase*, bool willGetResponse);
-    void removeFromStartTimeResponseWaitList(AnimationBase*);
+    AnimationControllerPrivate* animationController() const { return m_animationController; }
 
     void suspendAnimations();
     void resumeAnimations();
-    bool isSuspended() const;
+    bool isSuspended() const { return m_isSuspended; }
     
-    bool hasAnimations() const;
+    bool hasAnimations() const  { return !m_transitions.isEmpty() || !m_keyframeAnimations.isEmpty(); }
 
     void setAnimating(bool);
     bool isAnimatingProperty(int property, bool isRunningNow) const;
     
-    PassRefPtr<KeyframeAnimation> getAnimationForProperty(int property);
+    PassRefPtr<KeyframeAnimation> getAnimationForProperty(int property) const;
+
+    void cleanupFinishedAnimations();
 
     void overrideImplicitAnimations(int property);
     void resumeOverriddenImplicitAnimations(int property);
@@ -89,9 +84,25 @@
     unsigned numberOfActiveAnimations() const;
 
 private:
-    CompositeAnimation(AnimationControllerPrivate* animationController);
+    CompositeAnimation(AnimationControllerPrivate* animationController)
+        : m_animationController(animationController)
+        , m_numStyleAvailableWaiters(0)
+        , m_isSuspended(false)
+    {
+    }
+
+    void updateTransitions(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
+    void updateKeyframeAnimations(RenderObject*, RenderStyle* currentStyle, RenderStyle* targetStyle);
     
-    CompositeAnimationPrivate* m_data;
+    typedef HashMap<int, RefPtr<ImplicitAnimation> > CSSPropertyTransitionsMap;
+    typedef HashMap<AtomicStringImpl*, RefPtr<KeyframeAnimation> >  AnimationNameMap;
+
+    AnimationControllerPrivate* m_animationController;
+    CSSPropertyTransitionsMap m_transitions;
+    AnimationNameMap m_keyframeAnimations;
+    Vector<AtomicStringImpl*> m_keyframeAnimationOrderMap;
+    unsigned m_numStyleAvailableWaiters;
+    bool m_isSuspended;
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/animation/ImplicitAnimation.cpp b/WebCore/page/animation/ImplicitAnimation.cpp
index 8ec0be0..e93fee4 100644
--- a/WebCore/page/animation/ImplicitAnimation.cpp
+++ b/WebCore/page/animation/ImplicitAnimation.cpp
@@ -52,9 +52,9 @@
 
 ImplicitAnimation::~ImplicitAnimation()
 {
-    // Do the cleanup here instead of in the base class so the specialized methods get called
+    // // Make sure to tell the renderer that we are ending. This will make sure any accelerated animations are removed.
     if (!postActive())
-        updateStateMachine(AnimationStateInputEndAnimation, -1);
+        endAnimation(true);
 }
 
 bool ImplicitAnimation::shouldSendEventForListener(Document::ListenerType inListenerType) const
@@ -167,11 +167,11 @@
                 return false;
 
             // Schedule event handling
-            m_compAnim->animationControllerPriv()->addEventToDispatch(element, eventType, propertyName, elapsedTime);
+            m_compAnim->animationController()->addEventToDispatch(element, eventType, propertyName, elapsedTime);
 
             // Restore the original (unanimated) style
             if (eventType == eventNames().webkitTransitionEndEvent && element->renderer())
-                setChanged(element.get());
+                setNeedsStyleRecalc(element.get());
 
             return true; // Did dispatch an event
         }
@@ -216,6 +216,12 @@
 
 void ImplicitAnimation::blendPropertyValueInStyle(int prop, RenderStyle* currentStyle)
 {
+    // We should never add a transition with a 0 duration and delay. But if we ever did
+    // it would have a null toStyle. So just in case, let's check that here. (See
+    // <https://bugs.webkit.org/show_bug.cgi?id=24787>
+    if (!m_toStyle)
+        return;
+        
     blendProperties(this, prop, currentStyle, m_fromStyle.get(), m_toStyle.get(), progress(1, 0, 0));
 }
 
@@ -255,9 +261,9 @@
     m_transformFunctionListValid = true;
 }
 
-double ImplicitAnimation::willNeedService()
+double ImplicitAnimation::timeToNextService()
 {
-    double t = AnimationBase::willNeedService();
+    double t = AnimationBase::timeToNextService();
 #if USE(ACCELERATED_COMPOSITING)
     if (t != 0 || preActive())
         return t;
diff --git a/WebCore/page/animation/ImplicitAnimation.h b/WebCore/page/animation/ImplicitAnimation.h
index 221c45e..33fe4e4 100644
--- a/WebCore/page/animation/ImplicitAnimation.h
+++ b/WebCore/page/animation/ImplicitAnimation.h
@@ -65,7 +65,7 @@
 
     void blendPropertyValueInStyle(int, RenderStyle* currentStyle);
 
-    virtual double willNeedService();
+    virtual double timeToNextService();
 
 protected:
     bool shouldSendEventForListener(Document::ListenerType) const;    
diff --git a/WebCore/page/animation/KeyframeAnimation.cpp b/WebCore/page/animation/KeyframeAnimation.cpp
index 88a5f6a..3f84de1 100644
--- a/WebCore/page/animation/KeyframeAnimation.cpp
+++ b/WebCore/page/animation/KeyframeAnimation.cpp
@@ -56,9 +56,9 @@
 
 KeyframeAnimation::~KeyframeAnimation()
 {
-    // Do the cleanup here instead of in the base class so the specialized methods get called
+    // Make sure to tell the renderer that we are ending. This will make sure any accelerated animations are removed.
     if (!postActive())
-        updateStateMachine(AnimationStateInputEndAnimation, -1);
+        endAnimation(true);
 }
 
 void KeyframeAnimation::getKeyframeAnimationInterval(const RenderStyle*& fromStyle, const RenderStyle*& toStyle, double& prog) const
@@ -216,7 +216,8 @@
         UNUSED_PARAM(reset);
 #endif
         // Restore the original (unanimated) style
-        setChanged(m_object->node());
+        if (!paused())
+            setNeedsStyleRecalc(m_object->node());
     }
 }
 
@@ -266,11 +267,11 @@
             return false;
 
         // Schedule event handling
-        m_compAnim->animationControllerPriv()->addEventToDispatch(element, eventType, m_keyframes.animationName(), elapsedTime);
+        m_compAnim->animationController()->addEventToDispatch(element, eventType, m_keyframes.animationName(), elapsedTime);
 
         // Restore the original (unanimated) style
         if (eventType == eventNames().webkitAnimationEndEvent && element->renderer())
-            setChanged(element.get());
+            setNeedsStyleRecalc(element.get());
 
         return true; // Did dispatch an event
     }
@@ -352,9 +353,9 @@
     m_transformFunctionListValid = true;
 }
 
-double KeyframeAnimation::willNeedService()
+double KeyframeAnimation::timeToNextService()
 {
-    double t = AnimationBase::willNeedService();
+    double t = AnimationBase::timeToNextService();
 #if USE(ACCELERATED_COMPOSITING)
     if (t != 0 || preActive())
         return t;
diff --git a/WebCore/page/animation/KeyframeAnimation.h b/WebCore/page/animation/KeyframeAnimation.h
index 1090e5b..4905fc3 100644
--- a/WebCore/page/animation/KeyframeAnimation.h
+++ b/WebCore/page/animation/KeyframeAnimation.h
@@ -57,7 +57,7 @@
     void setUnanimatedStyle(PassRefPtr<RenderStyle> style) { m_unanimatedStyle = style; }
     RenderStyle* unanimatedStyle() const { return m_unanimatedStyle.get(); }
 
-    virtual double willNeedService();
+    virtual double timeToNextService();
 
 protected:
     virtual void onAnimationStart(double elapsedTime);
diff --git a/WebCore/page/chromium/ChromeClientChromium.h b/WebCore/page/chromium/ChromeClientChromium.h
index 5821dff..f6689d3 100644
--- a/WebCore/page/chromium/ChromeClientChromium.h
+++ b/WebCore/page/chromium/ChromeClientChromium.h
@@ -35,8 +35,8 @@
 #include <wtf/Forward.h>
 
 namespace WebCore {
-    class FramelessScrollView;
     class IntRect;
+    class PopupContainer;
 
     // Contains Chromium-specific extensions to the ChromeClient.  Only put
     // things here that don't make sense for other ports.
@@ -44,7 +44,10 @@
     public:
         // Notifies the client of a new popup widget.  The client should place
         // and size the widget with the given bounds, relative to the screen.
-        virtual void popupOpened(FramelessScrollView* popupView, const IntRect& bounds, bool focusOnShow) = 0;
+        // If handleExternal is true, then drawing and input handling for the
+        // popup will be handled by the external embedder.
+        virtual void popupOpened(PopupContainer* popupContainer, const IntRect& bounds,
+                                 bool focusOnShow, bool handleExternal) = 0;
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/chromium/FrameChromium.cpp b/WebCore/page/chromium/FrameChromium.cpp
index d85fbcc..5253bbc 100644
--- a/WebCore/page/chromium/FrameChromium.cpp
+++ b/WebCore/page/chromium/FrameChromium.cpp
@@ -60,7 +60,7 @@
     
     float ratio = static_cast<float>(printRect.height()) / static_cast<float>(printRect.width());
  
-    float pageWidth  = static_cast<float>(root->docWidth());
+    float pageWidth  = static_cast<float>(root->overflowWidth());
     float pageHeight = pageWidth * ratio;
     outPageHeight = static_cast<int>(pageHeight);   // this is the height of the page adjusted by margins
     pageHeight -= (headerHeight + footerHeight);
diff --git a/WebCore/page/gtk/AccessibilityObjectWrapperAtk.cpp b/WebCore/page/gtk/AccessibilityObjectWrapperAtk.cpp
deleted file mode 100644
index 84f3d34..0000000
--- a/WebCore/page/gtk/AccessibilityObjectWrapperAtk.cpp
+++ /dev/null
@@ -1,680 +0,0 @@
-/*
- * Copyright (C) 2008 Nuanti Ltd.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "AccessibilityObjectWrapperAtk.h"
-
-#if HAVE(ACCESSIBILITY)
-
-#include "AXObjectCache.h"
-#include "AccessibilityListBox.h"
-#include "AccessibilityRenderObject.h"
-#include "AtomicString.h"
-#include "CString.h"
-#include "Document.h"
-#include "Editor.h"
-#include "Frame.h"
-#include "FrameView.h"
-#include "IntRect.h"
-#include "NotImplemented.h"
-
-#include <atk/atk.h>
-
-using namespace WebCore;
-
-// Used to provide const char* returns.
-static const char* returnString(const String& str)
-{
-    static CString returnedString;
-    returnedString = str.utf8();
-    return returnedString.data();
-}
-
-static AccessibilityObject* core(WebKitAccessible* accessible)
-{
-    if (!accessible)
-        return 0;
-
-    return accessible->m_object;
-}
-
-static AccessibilityObject* core(AtkObject* object)
-{
-    if (!WEBKIT_IS_ACCESSIBLE(object))
-        return 0;
-
-    return core(WEBKIT_ACCESSIBLE(object));
-}
-
-static AccessibilityObject* core(AtkAction* action)
-{
-    return core(ATK_OBJECT(action));
-}
-
-static AccessibilityObject* core(AtkStreamableContent* streamable)
-{
-    return core(ATK_OBJECT(streamable));
-}
-
-static AccessibilityObject* core(AtkText* text)
-{
-    return core(ATK_OBJECT(text));
-}
-
-static AccessibilityObject* core(AtkEditableText* text)
-{
-    return core(ATK_OBJECT(text));
-}
-
-extern "C" {
-
-static gpointer parent_class = NULL;
-
-static void webkit_accessible_init(AtkObject* object, gpointer data)
-{
-    g_return_if_fail(WEBKIT_IS_ACCESSIBLE(object));
-    g_return_if_fail(data);
-
-    if (ATK_OBJECT_CLASS(parent_class)->initialize)
-        ATK_OBJECT_CLASS(parent_class)->initialize(object, data);
-
-    WEBKIT_ACCESSIBLE(object)->m_object = reinterpret_cast<AccessibilityObject*>(data);
-}
-
-static void webkit_accessible_finalize(GObject* object)
-{
-    // This is a good time to clear the return buffer.
-    returnString(String());
-
-    if (G_OBJECT_CLASS(parent_class)->finalize)
-        G_OBJECT_CLASS(parent_class)->finalize(object);
-}
-
-static const gchar* webkit_accessible_get_name(AtkObject* object)
-{
-    // TODO: Deal with later changes.
-    if (!object->name)
-        atk_object_set_name(object, core(object)->stringValue().utf8().data());
-    return object->name;
-}
-
-static const gchar* webkit_accessible_get_description(AtkObject* object)
-{
-    // TODO: the Mozilla MSAA implementation prepends "Description: "
-    // Should we do this too?
-
-    // TODO: Deal with later changes.
-    if (!object->description)
-        atk_object_set_description(object, core(object)->accessibilityDescription().utf8().data());
-    return object->description;
-}
-
-static AtkObject* webkit_accessible_get_parent(AtkObject* object)
-{
-    AccessibilityObject* coreParent = core(object)->parentObject();
-
-    if (!coreParent)
-        return NULL;
-
-    return coreParent->wrapper();
-}
-
-static gint webkit_accessible_get_n_children(AtkObject* object)
-{
-    return core(object)->children().size();
-}
-
-static AtkObject* webkit_accessible_ref_child(AtkObject* object, gint index)
-{
-    AccessibilityObject* coreObject = core(object);
-
-    g_return_val_if_fail(index >= 0, NULL);
-    g_return_val_if_fail(static_cast<size_t>(index) < coreObject->children().size(), NULL);
-
-    AccessibilityObject* coreChild = coreObject->children().at(index).get();
-
-    if (!coreChild)
-        return NULL;
-
-    AtkObject* child = coreChild->wrapper();
-    // TODO: Should we call atk_object_set_parent() here?
-    //atk_object_set_parent(child, object);
-    g_object_ref(child);
-
-    return child;
-}
-
-static gint webkit_accessible_get_index_in_parent(AtkObject* object)
-{
-    // FIXME: This needs to be implemented.
-    notImplemented();
-    return 0;
-}
-
-static AtkRole atkRole(AccessibilityRole role)
-{
-    switch (role) {
-    case WebCore::ButtonRole:
-        return ATK_ROLE_PUSH_BUTTON;
-    case WebCore::RadioButtonRole:
-        return ATK_ROLE_RADIO_BUTTON;
-    case WebCore::CheckBoxRole:
-        return ATK_ROLE_CHECK_BOX;
-    case WebCore::SliderRole:
-        return ATK_ROLE_SLIDER;
-    case WebCore::TabGroupRole:
-        return ATK_ROLE_PAGE_TAB_LIST;
-    case WebCore::TextFieldRole:
-    case WebCore::TextAreaRole:
-    case WebCore::ListMarkerRole:
-        return ATK_ROLE_ENTRY;
-    case WebCore::StaticTextRole:
-        return ATK_ROLE_TEXT; //?
-    case WebCore::OutlineRole:
-        return ATK_ROLE_TREE;
-    case WebCore::ColumnRole:
-        return ATK_ROLE_UNKNOWN; //?
-    case WebCore::RowRole:
-        return ATK_ROLE_LIST_ITEM;
-    case WebCore::GroupRole:
-        return ATK_ROLE_UNKNOWN; //?
-    case WebCore::ListRole:
-        return ATK_ROLE_LIST;
-    case WebCore::TableRole:
-        return ATK_ROLE_TABLE;
-    case WebCore::LinkRole:
-    case WebCore::WebCoreLinkRole:
-        return ATK_ROLE_LINK;
-    case WebCore::ImageMapRole:
-    case WebCore::ImageRole:
-        return ATK_ROLE_IMAGE;
-    default:
-        return ATK_ROLE_UNKNOWN;
-    }
-}
-
-static AtkRole webkit_accessible_get_role(AtkObject* object)
-{
-    return atkRole(core(object)->roleValue());
-}
-
-static void webkit_accessible_class_init(AtkObjectClass* klass)
-{
-    GObjectClass* gobject_class = G_OBJECT_CLASS(klass);
-
-    parent_class = g_type_class_peek_parent(klass);
-
-    klass->initialize = webkit_accessible_init;
-
-    gobject_class->finalize = webkit_accessible_finalize;
-
-    klass->get_name = webkit_accessible_get_name;
-    klass->get_description = webkit_accessible_get_description;
-    klass->get_parent = webkit_accessible_get_parent;
-    klass->get_n_children = webkit_accessible_get_n_children;
-    klass->ref_child = webkit_accessible_ref_child;
-    //klass->get_index_in_parent = webkit_accessible_get_index_in_parent;
-    klass->get_role = webkit_accessible_get_role;
-    //klass->get_attributes = webkit_accessible_get_attributes;
-    //klass->ref_state_set = webkit_accessible_ref_state_set;
-    //klass->ref_relation_set = webkit_accessible_ref_relation_set;
-}
-
-static gboolean webkit_accessible_action_do_action(AtkAction* action, gint i)
-{
-    g_return_val_if_fail(i == 0, FALSE);
-    return core(action)->performDefaultAction();
-}
-
-static gint webkit_accessible_action_get_n_actions(AtkAction* action)
-{
-    return 1;
-}
-
-static const gchar* webkit_accessible_action_get_description(AtkAction* action, gint i)
-{
-    g_return_val_if_fail(i == 0, NULL);
-    // TODO: Need a way to provide/localize action descriptions.
-    notImplemented();
-    return "";
-}
-
-static const gchar* webkit_accessible_action_get_keybinding(AtkAction* action, gint i)
-{
-    g_return_val_if_fail(i == 0, NULL);
-    // FIXME: Construct a proper keybinding string.
-    return returnString(core(action)->accessKey().string());
-}
-
-static const gchar* webkit_accessible_action_get_name(AtkAction* action, gint i)
-{
-    g_return_val_if_fail(i == 0, NULL);
-    return returnString(core(action)->actionVerb());
-}
-
-static void atk_action_interface_init(AtkActionIface* iface)
-{
-    g_return_if_fail(iface);
-
-    iface->do_action = webkit_accessible_action_do_action;
-    iface->get_n_actions = webkit_accessible_action_get_n_actions;
-    iface->get_description = webkit_accessible_action_get_description;
-    iface->get_keybinding = webkit_accessible_action_get_keybinding;
-    iface->get_name = webkit_accessible_action_get_name;
-}
-
-// Text
-
-static gchar* webkit_accessible_text_get_text(AtkText* text, gint start_offset, gint end_offset)
-{
-    String ret = core(text)->doAXStringForRange(PlainTextRange(start_offset, end_offset - start_offset));
-    // TODO: Intentionally copied?
-    return g_strdup(ret.utf8().data());
-}
-
-static gchar* webkit_accessible_text_get_text_after_offset(AtkText* text, gint offset, AtkTextBoundary boundary_type, gint* start_offset, gint* end_offset)
-{
-    notImplemented();
-    return NULL;
-}
-
-static gchar* webkit_accessible_text_get_text_at_offset(AtkText* text, gint offset, AtkTextBoundary boundary_type, gint* start_offset, gint* end_offset)
-{
-    notImplemented();
-    return NULL;
-}
-
-static gunichar webkit_accessible_text_get_character_at_offset(AtkText* text, gint offset)
-{
-    notImplemented();
-    return 0;
-}
-
-static gchar* webkit_accessible_text_get_text_before_offset(AtkText* text, gint offset, AtkTextBoundary boundary_type, gint* start_offset, gint* end_offset)
-{
-    notImplemented();
-    return NULL;
-}
-
-static gint webkit_accessible_text_get_caret_offset(AtkText* text)
-{
-    // TODO: Verify this, especially for RTL text.
-    return core(text)->selectionStart();
-}
-
-static AtkAttributeSet* webkit_accessible_text_get_run_attributes(AtkText* text, gint offset, gint* start_offset, gint* end_offset)
-{
-    notImplemented();
-    return NULL;
-}
-
-static AtkAttributeSet* webkit_accessible_text_get_default_attributes(AtkText* text)
-{
-    notImplemented();
-    return NULL;
-}
-
-static void webkit_accessible_text_get_character_extents(AtkText* text, gint offset, gint* x, gint* y, gint* width, gint* height, AtkCoordType coords)
-{
-    IntRect extents = core(text)->doAXBoundsForRange(PlainTextRange(offset, 1));
-    // FIXME: Use the AtkCoordType
-    // Requires WebCore::ScrollView::contentsToScreen() to be implemented
-
-#if 0
-    switch(coords) {
-    case ATK_XY_SCREEN:
-        extents = core(text)->document()->view()->contentsToScreen(extents);
-        break;
-    case ATK_XY_WINDOW:
-        // No-op
-        break;
-    }
-#endif
-
-    *x = extents.x();
-    *y = extents.y();
-    *width = extents.width();
-    *height = extents.height();
-}
-
-static gint webkit_accessible_text_get_character_count(AtkText* text)
-{
-    return core(text)->textLength();
-}
-
-static gint webkit_accessible_text_get_offset_at_point(AtkText* text, gint x, gint y, AtkCoordType coords)
-{
-    // FIXME: Use the AtkCoordType
-    // TODO: Is it correct to ignore range.length?
-    IntPoint pos(x, y);
-    PlainTextRange range = core(text)->doAXRangeForPosition(pos);
-    return range.start;
-}
-
-static gint webkit_accessible_text_get_n_selections(AtkText* text)
-{
-    notImplemented();
-    return 0;
-}
-
-static gchar* webkit_accessible_text_get_selection(AtkText* text, gint selection_num, gint* start_offset, gint* end_offset)
-{
-    notImplemented();
-    return NULL;
-}
-
-static gboolean webkit_accessible_text_add_selection(AtkText* text, gint start_offset, gint end_offset)
-{
-    notImplemented();
-    return FALSE;
-}
-
-static gboolean webkit_accessible_text_remove_selection(AtkText* text, gint selection_num)
-{
-    notImplemented();
-    return FALSE;
-}
-
-static gboolean webkit_accessible_text_set_selection(AtkText* text, gint selection_num, gint start_offset, gint end_offset)
-{
-    notImplemented();
-    return FALSE;
-}
-
-static gboolean webkit_accessible_text_set_caret_offset(AtkText* text, gint offset)
-{
-    // TODO: Verify
-    //core(text)->setSelectedTextRange(PlainTextRange(offset, 0));
-    AccessibilityObject* coreObject = core(text);
-    coreObject->setSelectedVisiblePositionRange(coreObject->visiblePositionRangeForRange(PlainTextRange(offset, 0)));
-    return TRUE;
-}
-
-#if 0
-// Signal handlers
-static void webkit_accessible_text_text_changed(AtkText* text, gint position, gint length)
-{
-}
-
-static void webkit_accessible_text_text_caret_moved(AtkText* text, gint location)
-{
-}
-
-static void webkit_accessible_text_text_selection_changed(AtkText* text)
-{
-}
-
-static void webkit_accessible_text_text_attributes_changed(AtkText* text)
-{
-}
-
-static void webkit_accessible_text_get_range_extents(AtkText* text, gint start_offset, gint end_offset, AtkCoordType coord_type, AtkTextRectangle* rect)
-{
-}
-
-static AtkTextRange** webkit_accessible_text_get_bounded_ranges(AtkText* text, AtkTextRectangle* rect, AtkCoordType coord_type, AtkTextClipType x_clip_type, AtkTextClipType y_clip_type)
-{
-}
-#endif
-
-static void atk_text_interface_init(AtkTextIface* iface)
-{
-    g_return_if_fail(iface);
-
-    iface->get_text = webkit_accessible_text_get_text;
-    iface->get_text_after_offset = webkit_accessible_text_get_text_after_offset;
-    iface->get_text_at_offset = webkit_accessible_text_get_text_at_offset;
-    iface->get_character_at_offset = webkit_accessible_text_get_character_at_offset;
-    iface->get_text_before_offset = webkit_accessible_text_get_text_before_offset;
-    iface->get_caret_offset = webkit_accessible_text_get_caret_offset;
-    iface->get_run_attributes = webkit_accessible_text_get_run_attributes;
-    iface->get_default_attributes = webkit_accessible_text_get_default_attributes;
-    iface->get_character_extents = webkit_accessible_text_get_character_extents;
-    //iface->get_range_extents = ;
-    iface->get_character_count = webkit_accessible_text_get_character_count;
-    iface->get_offset_at_point = webkit_accessible_text_get_offset_at_point;
-    iface->get_n_selections = webkit_accessible_text_get_n_selections;
-    iface->get_selection = webkit_accessible_text_get_selection;
-
-    // set methods
-    iface->add_selection = webkit_accessible_text_add_selection;
-    iface->remove_selection = webkit_accessible_text_remove_selection;
-    iface->set_selection = webkit_accessible_text_set_selection;
-    iface->set_caret_offset = webkit_accessible_text_set_caret_offset;
-}
-
-// EditableText
-
-static gboolean webkit_accessible_editable_text_set_run_attributes(AtkEditableText* text, AtkAttributeSet* attrib_set, gint start_offset, gint end_offset)
-{
-    notImplemented();
-    return FALSE;
-}
-
-static void webkit_accessible_editable_text_set_text_contents(AtkEditableText* text, const gchar* string)
-{
-    // FIXME: string nullcheck?
-    core(text)->setValue(String::fromUTF8(string));
-}
-
-static void webkit_accessible_editable_text_insert_text(AtkEditableText* text, const gchar* string, gint length, gint* position)
-{
-    // FIXME: string nullcheck?
-
-    AccessibilityObject* coreObject = core(text);
-    // FIXME: Not implemented in WebCore
-    //coreObject->setSelectedTextRange(PlainTextRange(*position, 0));
-    //coreObject->setSelectedText(String::fromUTF8(string));
-
-    if (!coreObject->document() || !coreObject->document()->frame())
-        return;
-    coreObject->setSelectedVisiblePositionRange(coreObject->visiblePositionRangeForRange(PlainTextRange(*position, 0)));
-    coreObject->setFocused(true);
-    // FIXME: We should set position to the actual inserted text length, which may be less than that requested.
-    if (coreObject->document()->frame()->editor()->insertTextWithoutSendingTextEvent(String::fromUTF8(string), false, 0))
-        *position += length;
-}
-
-static void webkit_accessible_editable_text_copy_text(AtkEditableText* text, gint start_pos, gint end_pos)
-{
-    notImplemented();
-}
-
-static void webkit_accessible_editable_text_cut_text(AtkEditableText* text, gint start_pos, gint end_pos)
-{
-    notImplemented();
-}
-
-static void webkit_accessible_editable_text_delete_text(AtkEditableText* text, gint start_pos, gint end_pos)
-{
-    AccessibilityObject* coreObject = core(text);
-    // FIXME: Not implemented in WebCore
-    //coreObject->setSelectedTextRange(PlainTextRange(start_pos, end_pos - start_pos));
-    //coreObject->setSelectedText(String());
-
-    if (!coreObject->document() || !coreObject->document()->frame())
-        return;
-    coreObject->setSelectedVisiblePositionRange(coreObject->visiblePositionRangeForRange(PlainTextRange(start_pos, end_pos - start_pos)));
-    coreObject->setFocused(true);
-    coreObject->document()->frame()->editor()->performDelete();
-}
-
-static void webkit_accessible_editable_text_paste_text(AtkEditableText* text, gint position)
-{
-    notImplemented();
-}
-
-static void atk_editable_text_interface_init(AtkEditableTextIface* iface)
-{
-    g_return_if_fail(iface);
-
-    iface->set_run_attributes = webkit_accessible_editable_text_set_run_attributes;
-    iface->set_text_contents = webkit_accessible_editable_text_set_text_contents;
-    iface->insert_text = webkit_accessible_editable_text_insert_text;
-    iface->copy_text = webkit_accessible_editable_text_copy_text;
-    iface->cut_text = webkit_accessible_editable_text_cut_text;
-    iface->delete_text = webkit_accessible_editable_text_delete_text;
-    iface->paste_text = webkit_accessible_editable_text_paste_text;
-}
-
-// StreamableContent
-
-static gint webkit_accessible_streamable_content_get_n_mime_types(AtkStreamableContent* streamable)
-{
-    notImplemented();
-    return 0;
-}
-
-static G_CONST_RETURN gchar* webkit_accessible_streamable_content_get_mime_type(AtkStreamableContent* streamable, gint i)
-{
-    notImplemented();
-    return "";
-}
-
-static GIOChannel* webkit_accessible_streamable_content_get_stream(AtkStreamableContent* streamable, const gchar* mime_type)
-{
-    notImplemented();
-    return NULL;
-}
-
-static G_CONST_RETURN gchar* webkit_accessible_streamable_content_get_uri(AtkStreamableContent* streamable, const gchar* mime_type)
-{
-    notImplemented();
-    return NULL;
-}
-
-static void atk_streamable_content_interface_init(AtkStreamableContentIface* iface)
-{
-    g_return_if_fail(iface);
-
-    iface->get_n_mime_types = webkit_accessible_streamable_content_get_n_mime_types;
-    iface->get_mime_type = webkit_accessible_streamable_content_get_mime_type;
-    iface->get_stream = webkit_accessible_streamable_content_get_stream;
-    iface->get_uri = webkit_accessible_streamable_content_get_uri;
-}
-
-GType webkit_accessible_get_type()
-{
-    static GType type = 0;
-
-    if (!type) {
-        static const GTypeInfo tinfo = {
-            sizeof(WebKitAccessibleClass),
-            (GBaseInitFunc)NULL,
-            (GBaseFinalizeFunc)NULL,
-            (GClassInitFunc)webkit_accessible_class_init,
-            (GClassFinalizeFunc)NULL,
-            NULL, /* class data */
-            sizeof(WebKitAccessible), /* instance size */
-            0, /* nb preallocs */
-            (GInstanceInitFunc)NULL,
-            NULL /* value table */
-        };
-
-        type = g_type_register_static(ATK_TYPE_OBJECT, "WebKitAccessible", &tinfo, static_cast<GTypeFlags>(0));
-
-        // TODO: Only implement interfaces when necessary, not for all objects.
-        static const GInterfaceInfo atk_action_info =
-        {
-            (GInterfaceInitFunc) atk_action_interface_init,
-            (GInterfaceFinalizeFunc) NULL,
-            NULL
-        };
-        g_type_add_interface_static(type, ATK_TYPE_ACTION, &atk_action_info);
-
-        static const GInterfaceInfo atk_text_info =
-        {
-            (GInterfaceInitFunc) atk_text_interface_init,
-            (GInterfaceFinalizeFunc) NULL,
-            NULL
-        };
-        g_type_add_interface_static(type, ATK_TYPE_TEXT, &atk_text_info);
-
-        static const GInterfaceInfo atk_editable_text_info =
-        {
-            (GInterfaceInitFunc) atk_editable_text_interface_init,
-            (GInterfaceFinalizeFunc) NULL,
-            NULL
-        };
-        g_type_add_interface_static(type, ATK_TYPE_EDITABLE_TEXT, &atk_editable_text_info);
-
-        static const GInterfaceInfo atk_streamable_content_info =
-        {
-            (GInterfaceInitFunc) atk_streamable_content_interface_init,
-            (GInterfaceFinalizeFunc) NULL,
-            NULL
-        };
-        g_type_add_interface_static(type, ATK_TYPE_STREAMABLE_CONTENT, &atk_streamable_content_info);
-    }
-    return type;
-}
-
-WebKitAccessible* webkit_accessible_new(AccessibilityObject* coreObject)
-{
-    GType type = WEBKIT_TYPE_ACCESSIBLE;
-    AtkObject* object = static_cast<AtkObject*>(g_object_new(type, NULL));
-    atk_object_initialize(object, coreObject);
-    return WEBKIT_ACCESSIBLE(object);
-}
-
-AccessibilityObject* webkit_accessible_get_accessibility_object(WebKitAccessible* accessible)
-{
-    return accessible->m_object;
-}
-
-// FIXME: Remove this static initialization.
-static AXObjectCache* fallbackCache = new AXObjectCache();
-
-void webkit_accessible_detach(WebKitAccessible* accessible)
-{
-    ASSERT(accessible->m_object);
-
-    // We replace the WebCore AccessibilityObject with a fallback object that
-    // provides default implementations to avoid repetitive null-checking after
-    // detachment.
-
-    // FIXME: Using fallbackCache->get(ListBoxOptionRole) is a hack.
-    accessible->m_object = fallbackCache->getOrCreate(ListBoxOptionRole);
-}
-
-}
-
-namespace WebCore {
-
-// AccessibilityObject implementations
-
-AccessibilityObjectWrapper* AccessibilityObject::wrapper() const
-{
-    return m_wrapper;
-}
-
-void AccessibilityObject::setWrapper(AccessibilityObjectWrapper* wrapper)
-{
-    if (m_wrapper)
-        g_object_unref(m_wrapper);
-
-    m_wrapper = wrapper;
-
-    if (m_wrapper)
-        g_object_ref(m_wrapper);
-}
-
-} // namespace WebCore
-
-#endif // HAVE(ACCESSIBILITY)
diff --git a/WebCore/page/mac/DragControllerMac.mm b/WebCore/page/mac/DragControllerMac.mm
index 86d8f66..c476df7 100644
--- a/WebCore/page/mac/DragControllerMac.mm
+++ b/WebCore/page/mac/DragControllerMac.mm
@@ -51,11 +51,11 @@
     ASSERT(dragData);
     if ([NSApp modalWindow] || !dragData->containsURL())
         return DragOperationNone;
-    
-    if (!m_document || ![[m_page->mainFrame()->view()->getOuterView() window] attachedSheet] 
+
+    if (!m_documentUnderMouse || ![[m_page->mainFrame()->view()->getOuterView() window] attachedSheet] 
         && [dragData->platformData() draggingSource] != m_page->mainFrame()->view()->getOuterView())
         return DragOperationCopy;
-        
+
     return DragOperationNone;
 } 
 
diff --git a/WebCore/page/mac/EventHandlerMac.mm b/WebCore/page/mac/EventHandlerMac.mm
index 33d1c5f..d69aff4 100644
--- a/WebCore/page/mac/EventHandlerMac.mm
+++ b/WebCore/page/mac/EventHandlerMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,7 @@
 #include "BlockExceptions.h"
 #include "ChromeClient.h"
 #include "ClipboardMac.h"
+#include "DragController.h"
 #include "EventNames.h"
 #include "FocusController.h"
 #include "FrameLoader.h"
@@ -41,15 +42,26 @@
 #include "PlatformKeyboardEvent.h"
 #include "PlatformWheelEvent.h"
 #include "RenderWidget.h"
+#include "RuntimeApplicationChecks.h"
 #include "Scrollbar.h"
 #include "Settings.h"
+#include <objc/objc-runtime.h>
 #include <wtf/StdLibExtras.h>
 
+#if !(defined(OBJC_API_VERSION) && OBJC_API_VERSION > 0)
+static inline IMP method_setImplementation(Method m, IMP i)
+{
+    IMP oi = m->method_imp;
+    m->method_imp = i;
+    return oi;
+}
+#endif
+
 namespace WebCore {
 
 const double EventHandler::TextDragDelay = 0.15;
 
-static RetainPtr<NSEvent>& currentEvent()
+static RetainPtr<NSEvent>& currentNSEventSlot()
 {
     DEFINE_STATIC_LOCAL(RetainPtr<NSEvent>, event, ());
     return event;
@@ -57,20 +69,47 @@
 
 NSEvent *EventHandler::currentNSEvent()
 {
-    return currentEvent().get();
+    return currentNSEventSlot().get();
+}
+
+class CurrentEventScope : Noncopyable {
+public:
+    CurrentEventScope(NSEvent *);
+    ~CurrentEventScope();
+
+private:
+    RetainPtr<NSEvent> m_savedCurrentEvent;
+#ifndef NDEBUG
+    RetainPtr<NSEvent> m_event;
+#endif
+};
+
+inline CurrentEventScope::CurrentEventScope(NSEvent *event)
+    : m_savedCurrentEvent(currentNSEventSlot())
+#ifndef NDEBUG
+    , m_event(event)
+#endif
+{
+    currentNSEventSlot() = event;
+}
+
+inline CurrentEventScope::~CurrentEventScope()
+{
+    ASSERT(currentNSEventSlot() == m_event);
+    currentNSEventSlot() = m_savedCurrentEvent;
 }
 
 bool EventHandler::wheelEvent(NSEvent *event)
 {
-    RetainPtr<NSEvent> oldCurrentEvent = currentEvent();
-    currentEvent() = event;
+    Page* page = m_frame->page();
+    if (!page)
+        return false;
 
-    PlatformWheelEvent wheelEvent(event);
+    CurrentEventScope scope(event);
+
+    PlatformWheelEvent wheelEvent(event, page->chrome()->platformWindow());
     handleWheelEvent(wheelEvent);
 
-    ASSERT(currentEvent() == event);
-    currentEvent() = oldCurrentEvent;
-
     return wheelEvent.isAccepted();
 }
 
@@ -131,18 +170,10 @@
 
 bool EventHandler::needsKeyboardEventDisambiguationQuirks() const
 {
-    static BOOL checkedSafari = NO;
-    static BOOL isSafari = NO;
-
-    if (!checkedSafari) {
-        isSafari = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.apple.Safari"];
-        checkedSafari = YES;
-    }
-    
     Document* document = m_frame->document();
 
     // RSS view needs arrow key keypress events.
-    if (isSafari && document->url().protocolIs("feed") || document->url().protocolIs("feeds"))
+    if (applicationIsSafari() && document->url().protocolIs("feed") || document->url().protocolIs("feeds"))
         return true;
     Settings* settings = m_frame->settings();
     if (!settings)
@@ -161,20 +192,12 @@
 
 bool EventHandler::keyEvent(NSEvent *event)
 {
-    bool result;
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
     ASSERT([event type] == NSKeyDown || [event type] == NSKeyUp);
 
-    RetainPtr<NSEvent> oldCurrentEvent = currentEvent();
-    currentEvent() = event;
-
-    result = keyEvent(PlatformKeyboardEvent(event));
-    
-    ASSERT(currentEvent() == event);
-    currentEvent() = oldCurrentEvent;
-
-    return result;
+    CurrentEventScope scope(event);
+    return keyEvent(PlatformKeyboardEvent(event));
 
     END_BLOCK_OBJC_EXCEPTIONS;
 
@@ -216,17 +239,17 @@
 
 static bool lastEventIsMouseUp()
 {
-    // Many AK widgets run their own event loops and consume events while the mouse is down.
-    // When they finish, currentEvent is the mouseUp that they exited on.  We need to update
-    // the khtml state with this mouseUp, which khtml never saw.  This method lets us detect
-    // that state.
+    // Many AppKit widgets run their own event loops and consume events while the mouse is down.
+    // When they finish, currentEvent is the mouseUp that they exited on. We need to update
+    // the WebCore state with this mouseUp, which we never saw. This method lets us detect
+    // that state. Handling this was critical when we used AppKit widgets for form elements.
+    // It's not clear in what cases this is helpful now -- it's possible it can be removed. 
 
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
     NSEvent *currentEventAfterHandlingMouseDown = [NSApp currentEvent];
-    if (currentEvent() != currentEventAfterHandlingMouseDown &&
-        [currentEventAfterHandlingMouseDown type] == NSLeftMouseUp &&
-        [currentEventAfterHandlingMouseDown timestamp] >= [currentEvent().get() timestamp])
-            return true;
+    return EventHandler::currentNSEvent() != currentEventAfterHandlingMouseDown
+        && [currentEventAfterHandlingMouseDown type] == NSLeftMouseUp
+        && [currentEventAfterHandlingMouseDown timestamp] >= [EventHandler::currentNSEvent() timestamp];
     END_BLOCK_OBJC_EXCEPTIONS;
 
     return false;
@@ -234,7 +257,8 @@
 
 bool EventHandler::passMouseDownEventToWidget(Widget* widget)
 {
-    // FIXME: this method always returns true
+    // FIXME: This function always returns true. It should be changed either to return
+    // false in some cases or the return value should be removed.
 
     if (!widget) {
         LOG_ERROR("hit a RenderWidget without a corresponding Widget, means a frame is half-constructed");
@@ -246,7 +270,7 @@
     NSView *nodeView = widget->platformWidget();
     ASSERT(nodeView);
     ASSERT([nodeView superview]);
-    NSView *view = [nodeView hitTest:[[nodeView superview] convertPoint:[currentEvent().get() locationInWindow] fromView:nil]];
+    NSView *view = [nodeView hitTest:[[nodeView superview] convertPoint:[currentNSEvent() locationInWindow] fromView:nil]];
     if (!view) {
         // We probably hit the border of a RenderWidget
         return true;
@@ -259,7 +283,7 @@
     if (page->chrome()->client()->firstResponder() != view) {
         // Normally [NSWindow sendEvent:] handles setting the first responder.
         // But in our case, the event was sent to the view representing the entire web page.
-        if ([currentEvent().get() clickCount] <= 1 && [view acceptsFirstResponder] && [view needsPanelToBecomeKey])
+        if ([currentNSEvent() clickCount] <= 1 && [view acceptsFirstResponder] && [view needsPanelToBecomeKey])
             page->chrome()->client()->makeFirstResponder(view);
     }
 
@@ -276,7 +300,7 @@
 
     ASSERT(!m_sendingEventToSubview);
     m_sendingEventToSubview = true;
-    [view mouseDown:currentEvent().get()];
+    [view mouseDown:currentNSEvent()];
     m_sendingEventToSubview = false;
     
     if (!wasDeferringLoading)
@@ -348,9 +372,10 @@
         return false;
     
     if (!m_mouseDownWasInSubframe) {
+        ASSERT(!m_sendingEventToSubview);
         m_sendingEventToSubview = true;
         BEGIN_BLOCK_OBJC_EXCEPTIONS;
-        [view mouseDragged:currentEvent().get()];
+        [view mouseDragged:currentNSEvent()];
         END_BLOCK_OBJC_EXCEPTIONS;
         m_sendingEventToSubview = false;
     }
@@ -374,9 +399,10 @@
         return false;
     
     if (!m_mouseDownWasInSubframe) {
+        ASSERT(!m_sendingEventToSubview);
         m_sendingEventToSubview = true;
         BEGIN_BLOCK_OBJC_EXCEPTIONS;
-        [view mouseUp:currentEvent().get()];
+        [view mouseUp:currentNSEvent()];
         END_BLOCK_OBJC_EXCEPTIONS;
         m_sendingEventToSubview = false;
     }
@@ -388,12 +414,24 @@
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
-    switch ([currentEvent().get() type]) {
+    switch ([currentNSEvent() type]) {
+        case NSLeftMouseDragged:
+        case NSOtherMouseDragged:
+        case NSRightMouseDragged:
+            // This check is bogus and results in <rdar://6813830>, but removing it breaks a number of
+            // layout tests.
+            if (!m_mouseDownWasInSubframe)
+                return false;
+            if (subframe->page()->dragController()->didInitiateDrag())
+                return false;
         case NSMouseMoved:
-            // Since we're passing in currentEvent() here, we can call
+            // Since we're passing in currentNSEvent() here, we can call
             // handleMouseMoveEvent() directly, since the save/restore of
-            // currentEvent() that mouseMoved() does would have no effect.
-            subframe->eventHandler()->handleMouseMoveEvent(currentEvent().get(), hoveredNode);
+            // currentNSEvent() that mouseMoved() does would have no effect.
+            ASSERT(!m_sendingEventToSubview);
+            m_sendingEventToSubview = true;
+            subframe->eventHandler()->handleMouseMoveEvent(currentPlatformMouseEvent(), hoveredNode);
+            m_sendingEventToSubview = false;
             return true;
         
         case NSLeftMouseDown: {
@@ -414,24 +452,9 @@
         case NSLeftMouseUp: {
             if (!m_mouseDownWasInSubframe)
                 return false;
-            NSView *view = mouseDownViewIfStillGood();
-            if (!view)
-                return false;
             ASSERT(!m_sendingEventToSubview);
             m_sendingEventToSubview = true;
-            [view mouseUp:currentEvent().get()];
-            m_sendingEventToSubview = false;
-            return true;
-        }
-        case NSLeftMouseDragged: {
-            if (!m_mouseDownWasInSubframe)
-                return false;
-            NSView *view = mouseDownViewIfStillGood();
-            if (!view)
-                return false;
-            ASSERT(!m_sendingEventToSubview);
-            m_sendingEventToSubview = true;
-            [view mouseDragged:currentEvent().get()];
+            subframe->eventHandler()->handleMouseReleaseEvent(currentPlatformMouseEvent());
             m_sendingEventToSubview = false;
             return true;
         }
@@ -443,23 +466,63 @@
     return false;
 }
 
+static IMP originalNSScrollViewScrollWheel;
+static bool _nsScrollViewScrollWheelShouldRetainSelf;
+static void selfRetainingNSScrollViewScrollWheel(NSScrollView *, SEL, NSEvent *);
+
+static bool nsScrollViewScrollWheelShouldRetainSelf()
+{
+    ASSERT(isMainThread());
+
+    return _nsScrollViewScrollWheelShouldRetainSelf;
+}
+
+static void setNSScrollViewScrollWheelShouldRetainSelf(bool shouldRetain)
+{
+    ASSERT(isMainThread());
+
+    if (!originalNSScrollViewScrollWheel) {
+        Method method = class_getInstanceMethod(objc_getRequiredClass("NSScrollView"), @selector(scrollWheel:));
+        originalNSScrollViewScrollWheel = method_setImplementation(method, reinterpret_cast<IMP>(selfRetainingNSScrollViewScrollWheel));
+    }
+
+    _nsScrollViewScrollWheelShouldRetainSelf = shouldRetain;
+}
+
+static void selfRetainingNSScrollViewScrollWheel(NSScrollView *self, SEL selector, NSEvent *event)
+{
+    bool shouldRetainSelf = isMainThread() && nsScrollViewScrollWheelShouldRetainSelf();
+
+    if (shouldRetainSelf)
+        [self retain];
+    originalNSScrollViewScrollWheel(self, selector, event);
+    if (shouldRetainSelf)
+        [self release];
+}
+
 bool EventHandler::passWheelEventToWidget(PlatformWheelEvent&, Widget* widget)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
         
-    if ([currentEvent().get() type] != NSScrollWheel || m_sendingEventToSubview || !widget) 
+    if ([currentNSEvent() type] != NSScrollWheel || m_sendingEventToSubview || !widget) 
         return false;
 
     NSView* nodeView = widget->platformWidget();
     ASSERT(nodeView);
     ASSERT([nodeView superview]);
-    NSView *view = [nodeView hitTest:[[nodeView superview] convertPoint:[currentEvent().get() locationInWindow] fromView:nil]];
+    NSView *view = [nodeView hitTest:[[nodeView superview] convertPoint:[currentNSEvent() locationInWindow] fromView:nil]];
     if (!view)
         // We probably hit the border of a RenderWidget
         return false;
 
+    ASSERT(!m_sendingEventToSubview);
     m_sendingEventToSubview = true;
-    [view scrollWheel:currentEvent().get()];
+    // Work around <rdar://problem/6806810> which can cause -[NSScrollView scrollWheel:] to
+    // crash if the NSScrollView is released during timer or network callback dispatch
+    // in the nested tracking runloop that -[NSScrollView scrollWheel:] runs.
+    setNSScrollViewScrollWheelShouldRetainSelf(true);
+    [view scrollWheel:currentNSEvent()];
+    setNSScrollViewScrollWheelShouldRetainSelf(false);
     m_sendingEventToSubview = false;
     return true;
             
@@ -479,14 +542,9 @@
 
     m_mouseDownView = nil;
     
-    RetainPtr<NSEvent> oldCurrentEvent = currentEvent();
-    currentEvent() = event;
-    m_mouseDown = PlatformMouseEvent(event);
-    
-    handleMousePressEvent(event);
-    
-    ASSERT(currentEvent() == event);
-    currentEvent() = oldCurrentEvent;
+    CurrentEventScope scope(event);
+    m_mouseDown = currentPlatformMouseEvent();
+    handleMousePressEvent(m_mouseDown);
 
     END_BLOCK_OBJC_EXCEPTIONS;
 }
@@ -499,13 +557,8 @@
 
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
-    RetainPtr<NSEvent> oldCurrentEvent = currentEvent();
-    currentEvent() = event;
-
-    handleMouseMoveEvent(event);
-    
-    ASSERT(currentEvent() == event);
-    currentEvent() = oldCurrentEvent;
+    CurrentEventScope scope(event);
+    handleMouseMoveEvent(currentPlatformMouseEvent());
 
     END_BLOCK_OBJC_EXCEPTIONS;
 }
@@ -518,8 +571,7 @@
 
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
-    RetainPtr<NSEvent> oldCurrentEvent = currentEvent();
-    currentEvent() = event;
+    CurrentEventScope scope(event);
 
     // Our behavior here is a little different that Qt. Qt always sends
     // a mouse release event, even for a double click. To correct problems
@@ -530,12 +582,9 @@
     // treated as another double click. Hence the "% 2" below.
     int clickCount = [event clickCount];
     if (clickCount > 0 && clickCount % 2 == 0)
-        handleMouseDoubleClickEvent(event);
+        handleMouseDoubleClickEvent(currentPlatformMouseEvent());
     else
-        handleMouseReleaseEvent(event);
-    
-    ASSERT(currentEvent() == event);
-    currentEvent() = oldCurrentEvent;
+        handleMouseReleaseEvent(currentPlatformMouseEvent());
     
     m_mouseDownView = nil;
 
@@ -614,15 +663,8 @@
         return;
     
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
-
-    RetainPtr<NSEvent> oldCurrentEvent = currentEvent();
-    currentEvent() = event;
-    
-    mouseMoved(PlatformMouseEvent(event));
-    
-    ASSERT(currentEvent() == event);
-    currentEvent() = oldCurrentEvent;
-
+    CurrentEventScope scope(event);
+    mouseMoved(currentPlatformMouseEvent());
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
@@ -652,4 +694,28 @@
     return PlatformKeyboardEvent::CtrlKey | PlatformKeyboardEvent::AltKey;
 }
 
+PlatformMouseEvent EventHandler::currentPlatformMouseEvent() const
+{
+    NSView *windowView = nil;
+    if (Page* page = m_frame->page())
+        windowView = page->chrome()->platformWindow();
+    return PlatformMouseEvent(currentNSEvent(), windowView);
+}
+
+bool EventHandler::sendContextMenuEvent(NSEvent *event)
+{
+    Page* page = m_frame->page();
+    if (!page)
+        return false;
+    return sendContextMenuEvent(PlatformMouseEvent(event, page->chrome()->platformWindow()));
+}
+
+bool EventHandler::eventMayStartDrag(NSEvent *event)
+{
+    Page* page = m_frame->page();
+    if (!page)
+        return false;
+    return eventMayStartDrag(PlatformMouseEvent(event, page->chrome()->platformWindow()));
+}
+
 }
diff --git a/WebCore/page/mac/FrameMac.mm b/WebCore/page/mac/FrameMac.mm
index f360511..decbcad 100644
--- a/WebCore/page/mac/FrameMac.mm
+++ b/WebCore/page/mac/FrameMac.mm
@@ -28,6 +28,7 @@
 #import "config.h"
 #import "Frame.h"
 
+#import "Base64.h"
 #import "BlockExceptions.h"
 #import "ColorMac.h"
 #import "Cursor.h"
@@ -57,7 +58,6 @@
 #import "visible_units.h"
 
 #import <Carbon/Carbon.h>
-#import <runtime/JSLock.h>
 #import <wtf/StdLibExtras.h>
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -70,8 +70,6 @@
  
 using namespace std;
 
-using JSC::JSLock;
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -535,6 +533,22 @@
 {
     delete m_userStyleSheetLoader;
     m_userStyleSheetLoader = 0;
+
+    // Data URLs with base64-encoded UTF-8 style sheets are common. We can process them
+    // synchronously and avoid using a loader. 
+    if (url.protocolIs("data") && url.string().startsWith("data:text/css;charset=utf-8;base64,")) {
+        const unsigned prefixLength = 35;
+        Vector<char> encodedData(url.string().length() - prefixLength);
+        for (unsigned i = prefixLength; i < url.string().length(); ++i)
+            encodedData[i - prefixLength] = static_cast<char>(url.string()[i]);
+
+        Vector<char> styleSheetAsUTF8;
+        if (base64Decode(encodedData, styleSheetAsUTF8)) {
+            m_doc->setUserStyleSheet(String::fromUTF8(styleSheetAsUTF8.data()));
+            return;
+        }
+    }
+
     if (m_doc->docLoader())
         m_userStyleSheetLoader = new UserStyleSheetLoader(m_doc, url.string());
 }
diff --git a/WebCore/page/mac/WebCoreViewFactory.h b/WebCore/page/mac/WebCoreViewFactory.h
index 883d586..c18f4d4 100644
--- a/WebCore/page/mac/WebCoreViewFactory.h
+++ b/WebCore/page/mac/WebCoreViewFactory.h
@@ -83,6 +83,19 @@
 - (NSString *)contextMenuItemTagDefaultDirection;
 - (NSString *)contextMenuItemTagLeftToRight;
 - (NSString *)contextMenuItemTagRightToLeft;
+- (NSString *)contextMenuItemTagCorrectSpellingAutomatically;
+- (NSString *)contextMenuItemTagSubstitutionsMenu;
+- (NSString *)contextMenuItemTagShowSubstitutions:(bool)show;
+- (NSString *)contextMenuItemTagSmartCopyPaste;
+- (NSString *)contextMenuItemTagSmartQuotes;
+- (NSString *)contextMenuItemTagSmartDashes;
+- (NSString *)contextMenuItemTagSmartLinks;
+- (NSString *)contextMenuItemTagTextReplacement;
+- (NSString *)contextMenuItemTagTransformationsMenu;
+- (NSString *)contextMenuItemTagMakeUpperCase;
+- (NSString *)contextMenuItemTagMakeLowerCase;
+- (NSString *)contextMenuItemTagCapitalize;
+- (NSString *)contextMenuItemTagChangeBack:(NSString *)replacedString;
 - (NSString *)contextMenuItemTagInspectElement;
 
 - (NSString *)searchMenuNoRecentSearchesText;
diff --git a/WebCore/page/win/FrameWin.cpp b/WebCore/page/win/FrameWin.cpp
index db55d30..0c1c5b1 100644
--- a/WebCore/page/win/FrameWin.cpp
+++ b/WebCore/page/win/FrameWin.cpp
@@ -61,7 +61,7 @@
     
     float ratio = static_cast<float>(printRect.height()) / static_cast<float>(printRect.width());
  
-    float pageWidth  = static_cast<float>(root->docWidth());
+    float pageWidth  = static_cast<float>(root->overflowWidth());
     float pageHeight = pageWidth * ratio;
     outPageHeight = static_cast<int>(pageHeight);   // this is the height of the page adjusted by margins
     pageHeight -= (headerHeight + footerHeight);
diff --git a/WebCore/platform/ContextMenu.cpp b/WebCore/platform/ContextMenu.cpp
index f66a891..362e334 100644
--- a/WebCore/platform/ContextMenu.cpp
+++ b/WebCore/platform/ContextMenu.cpp
@@ -112,11 +112,21 @@
         contextMenuItemTagCheckSpellingWhileTyping());
     ContextMenuItem grammarWithSpelling(CheckableActionType, ContextMenuItemTagCheckGrammarWithSpelling, 
         contextMenuItemTagCheckGrammarWithSpelling());
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    ContextMenuItem correctSpelling(CheckableActionType, ContextMenuItemTagCorrectSpellingAutomatically, 
+        contextMenuItemTagCorrectSpellingAutomatically());
+#endif
 
     spellingAndGrammarMenu.appendItem(showSpellingPanel);
     spellingAndGrammarMenu.appendItem(checkSpelling);
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    spellingAndGrammarMenu.appendItem(*separatorItem());
+#endif
     spellingAndGrammarMenu.appendItem(checkAsYouType);
     spellingAndGrammarMenu.appendItem(grammarWithSpelling);
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    spellingAndGrammarMenu.appendItem(correctSpelling);
+#endif
 
     spellingAndGrammarMenuItem.setSubMenu(&spellingAndGrammarMenu);
 }
@@ -189,6 +199,45 @@
 }
 #endif
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+static void createAndAppendSubstitutionsSubMenu(const HitTestResult& result, ContextMenuItem& substitutionsMenuItem)
+{
+    ContextMenu substitutionsMenu(result);
+
+    ContextMenuItem showSubstitutions(ActionType, ContextMenuItemTagShowSubstitutions, contextMenuItemTagShowSubstitutions(true));
+    ContextMenuItem smartCopyPaste(CheckableActionType, ContextMenuItemTagSmartCopyPaste, contextMenuItemTagSmartCopyPaste());
+    ContextMenuItem smartQuotes(CheckableActionType, ContextMenuItemTagSmartQuotes, contextMenuItemTagSmartQuotes());
+    ContextMenuItem smartDashes(CheckableActionType, ContextMenuItemTagSmartDashes, contextMenuItemTagSmartDashes());
+    ContextMenuItem smartLinks(CheckableActionType, ContextMenuItemTagSmartLinks, contextMenuItemTagSmartLinks());
+    ContextMenuItem textReplacement(CheckableActionType, ContextMenuItemTagTextReplacement, contextMenuItemTagTextReplacement());
+
+    substitutionsMenu.appendItem(showSubstitutions);
+    substitutionsMenu.appendItem(*separatorItem());
+    substitutionsMenu.appendItem(smartCopyPaste);
+    substitutionsMenu.appendItem(smartQuotes);
+    substitutionsMenu.appendItem(smartDashes);
+    substitutionsMenu.appendItem(smartLinks);
+    substitutionsMenu.appendItem(textReplacement);
+
+    substitutionsMenuItem.setSubMenu(&substitutionsMenu);
+}
+
+static void createAndAppendTransformationsSubMenu(const HitTestResult& result, ContextMenuItem& transformationsMenuItem)
+{
+    ContextMenu transformationsMenu(result);
+
+    ContextMenuItem makeUpperCase(ActionType, ContextMenuItemTagMakeUpperCase, contextMenuItemTagMakeUpperCase());
+    ContextMenuItem makeLowerCase(ActionType, ContextMenuItemTagMakeLowerCase, contextMenuItemTagMakeLowerCase());
+    ContextMenuItem capitalize(ActionType, ContextMenuItemTagCapitalize, contextMenuItemTagCapitalize());
+
+    transformationsMenu.appendItem(makeUpperCase);
+    transformationsMenu.appendItem(makeLowerCase);
+    transformationsMenu.appendItem(capitalize);
+
+    transformationsMenuItem.setSubMenu(&transformationsMenu);
+}
+#endif
+
 static bool selectionContainsPossibleWord(Frame* frame)
 {
     // Current algorithm: look for a character that's not just a separator.
@@ -357,6 +406,16 @@
                 } else
                     appendItem(IgnoreGrammarItem);
                 appendItem(*separatorItem());
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            } else {
+                // If the string was autocorrected, generate a contextual menu item allowing it to be changed back.
+                String replacedString = result.replacedString();
+                if (!replacedString.isEmpty()) {
+                    ContextMenuItem item(ActionType, ContextMenuItemTagChangeBack, contextMenuItemTagChangeBack(replacedString));
+                    appendItem(item);
+                    appendItem(*separatorItem());
+                }
+#endif
             }
         }
 
@@ -407,6 +466,16 @@
             createAndAppendSpellingSubMenu(m_hitTestResult, SpellingMenuItem);
             appendItem(SpellingMenuItem);
 #endif
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            ContextMenuItem substitutionsMenuItem(SubmenuType, ContextMenuItemTagSubstitutionsMenu, 
+                contextMenuItemTagSubstitutionsMenu());
+            createAndAppendSubstitutionsSubMenu(m_hitTestResult, substitutionsMenuItem);
+            appendItem(substitutionsMenuItem);
+            ContextMenuItem transformationsMenuItem(SubmenuType, ContextMenuItemTagTransformationsMenu, 
+                contextMenuItemTagTransformationsMenu());
+            createAndAppendTransformationsSubMenu(m_hitTestResult, transformationsMenuItem);
+            appendItem(transformationsMenuItem);
+#endif
             ContextMenuItem  FontMenuItem(SubmenuType, ContextMenuItemTagFontMenu, 
                 contextMenuItemTagFontMenu());
             createAndAppendFontSubMenu(m_hitTestResult, FontMenuItem);
@@ -584,6 +653,56 @@
         case ContextMenuItemTagCheckSpellingWhileTyping:
             shouldCheck = frame->editor()->isContinuousSpellCheckingEnabled();
             break;
+#if PLATFORM(MAC)
+        case ContextMenuItemTagSubstitutionsMenu:
+        case ContextMenuItemTagTransformationsMenu:
+            break;
+        case ContextMenuItemTagShowSubstitutions:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            if (frame->editor()->substitutionsPanelIsShowing())
+                item.setTitle(contextMenuItemTagShowSubstitutions(false));
+            else
+                item.setTitle(contextMenuItemTagShowSubstitutions(true));
+            shouldEnable = frame->editor()->canEdit();
+#endif
+            break;
+        case ContextMenuItemTagMakeUpperCase:
+        case ContextMenuItemTagMakeLowerCase:
+        case ContextMenuItemTagCapitalize:
+        case ContextMenuItemTagChangeBack:
+            shouldEnable = frame->editor()->canEdit();
+            break;
+        case ContextMenuItemTagCorrectSpellingAutomatically:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->isAutomaticSpellingCorrectionEnabled();
+#endif
+            break;
+        case ContextMenuItemTagSmartCopyPaste:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->smartInsertDeleteEnabled();
+#endif
+            break;
+        case ContextMenuItemTagSmartQuotes:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->isAutomaticQuoteSubstitutionEnabled();
+#endif
+            break;
+        case ContextMenuItemTagSmartDashes:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->isAutomaticDashSubstitutionEnabled();
+#endif
+            break;
+        case ContextMenuItemTagSmartLinks:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->isAutomaticLinkDetectionEnabled();
+#endif
+            break;
+        case ContextMenuItemTagTextReplacement:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            shouldCheck = frame->editor()->isAutomaticTextReplacementEnabled();
+#endif
+            break;
+#endif
 #if PLATFORM(GTK)
         case ContextMenuItemTagGoBack:
             shouldEnable = frame->loader()->canGoBackOrForward(-1);
diff --git a/WebCore/platform/ContextMenu.h b/WebCore/platform/ContextMenu.h
index 9418ff5..75899ba 100644
--- a/WebCore/platform/ContextMenu.h
+++ b/WebCore/platform/ContextMenu.h
@@ -39,7 +39,6 @@
 #endif
 
 namespace WebCore {
-class MenuEventProxy;
 
     class ContextMenuController;
 
diff --git a/WebCore/platform/ContextMenuItem.h b/WebCore/platform/ContextMenuItem.h
index 52c4d1b..3a4cdfa 100644
--- a/WebCore/platform/ContextMenuItem.h
+++ b/WebCore/platform/ContextMenuItem.h
@@ -124,6 +124,21 @@
         ContextMenuItemTagTextDirectionDefault,
         ContextMenuItemTagTextDirectionLeftToRight,
         ContextMenuItemTagTextDirectionRightToLeft,
+#if PLATFORM(MAC)
+        ContextMenuItemTagCorrectSpellingAutomatically,
+        ContextMenuItemTagSubstitutionsMenu,
+        ContextMenuItemTagShowSubstitutions,
+        ContextMenuItemTagSmartCopyPaste,
+        ContextMenuItemTagSmartQuotes,
+        ContextMenuItemTagSmartDashes,
+        ContextMenuItemTagSmartLinks,
+        ContextMenuItemTagTextReplacement,
+        ContextMenuItemTagTransformationsMenu,
+        ContextMenuItemTagMakeUpperCase,
+        ContextMenuItemTagMakeLowerCase,
+        ContextMenuItemTagCapitalize,
+        ContextMenuItemTagChangeBack,
+#endif
         ContextMenuItemBaseApplicationTag = 10000
     };
 
diff --git a/WebCore/platform/CookieJar.h b/WebCore/platform/CookieJar.h
index 178ee79..6159386 100644
--- a/WebCore/platform/CookieJar.h
+++ b/WebCore/platform/CookieJar.h
@@ -33,7 +33,7 @@
     class Document;
 
     String cookies(const Document*, const KURL&);
-    void setCookies(Document*, const KURL&, const KURL& policyBaseURL, const String&);
+    void setCookies(Document*, const KURL&, const String&);
     bool cookiesEnabled(const Document*);
 
 }
diff --git a/WebCore/platform/Cursor.h b/WebCore/platform/Cursor.h
index 3ab694c..ea75191 100644
--- a/WebCore/platform/Cursor.h
+++ b/WebCore/platform/Cursor.h
@@ -70,18 +70,25 @@
         HCURSOR m_nativeCursor;
     };
     typedef RefPtr<SharedCursor> PlatformCursor;
+    typedef HCURSOR PlatformCursorHandle;
 #elif PLATFORM(MAC)
     typedef NSCursor* PlatformCursor;
+    typedef NSCursor* PlatformCursorHandle;
 #elif PLATFORM(GTK)
     typedef GdkCursor* PlatformCursor;
+    typedef GdkCursor* PlatformCursorHandle;
 #elif PLATFORM(QT) && !defined(QT_NO_CURSOR)
     typedef QCursor PlatformCursor;
+    typedef QCursor* PlatformCursorHandle;
 #elif PLATFORM(WX)
     typedef wxCursor* PlatformCursor;
+    typedef wxCursor* PlatformCursorHandle;
 #elif PLATFORM(CHROMIUM)
     // See PlatformCursor.h
+    typedef void* PlatformCursorHandle;
 #else
     typedef void* PlatformCursor;
+    typedef void* PlatformCursorHandle;
 #endif
 
     class Cursor {
diff --git a/WebCore/platform/FileSystem.h b/WebCore/platform/FileSystem.h
index 8ccefab..16afe8f 100644
--- a/WebCore/platform/FileSystem.h
+++ b/WebCore/platform/FileSystem.h
@@ -39,11 +39,10 @@
 #if defined(Q_OS_WIN32)
 #include <windows.h>
 #endif
-#endif
-
-#if PLATFORM(DARWIN)
+#if defined(Q_WS_MAC)
 #include <CoreFoundation/CFBundle.h>
 #endif
+#endif
 
 #include <time.h>
 
diff --git a/WebCore/platform/HostWindow.h b/WebCore/platform/HostWindow.h
index 7007ac5..3e982e1 100644
--- a/WebCore/platform/HostWindow.h
+++ b/WebCore/platform/HostWindow.h
@@ -27,18 +27,13 @@
 #define HostWindow_h
 
 #include <wtf/Noncopyable.h>
-#include "IntRect.h"
 #include "Widget.h"
 
 namespace WebCore {
 
-class IntPoint;
-class IntRect;
-
 class HostWindow : Noncopyable {
 public:
-    HostWindow() {}
-    virtual ~HostWindow() {}
+    virtual ~HostWindow() { }
 
     // The repaint method asks the host window to repaint a rect in the window's coordinate space.  The
     // contentChanged boolean indicates whether or not the Web page content actually changed (or if a repaint
diff --git a/WebCore/platform/KURL.cpp b/WebCore/platform/KURL.cpp
index 6901782..4b75046 100644
--- a/WebCore/platform/KURL.cpp
+++ b/WebCore/platform/KURL.cpp
@@ -310,8 +310,6 @@
 
 KURL::KURL(const String& url)
 {
-    checkEncodedString(url);
-
     parse(url);
     ASSERT(url == m_string);
 }
@@ -343,7 +341,7 @@
     // For compatibility with Win IE, treat backslashes as if they were slashes,
     // as long as we're not dealing with javascript: or data: URLs.
     String rel = relative;
-    if (rel.contains('\\') && !(protocolIs(rel, "javascript") || protocolIs(rel, "data")))
+    if (rel.contains('\\') && !(protocolIsJavaScript(rel) || protocolIs(rel, "data")))
         rel = substituteBackslashes(rel);
 
     String* originalString = &rel;
@@ -631,10 +629,16 @@
 
 bool KURL::protocolIs(const char* protocol) const
 {
-    // Do the comparison without making a new string object.
     assertProtocolIsGood(protocol);
+
+    // JavaScript URLs are "valid" and should be executed even if KURL decides they are invalid.
+    // The free function protocolIsJavaScript() should be used instead. 
+    ASSERT(strcmp(protocol, "javascript") != 0);
+
     if (!m_isValid)
         return false;
+
+    // Do the comparison without making a new string object.
     for (int i = 0; i < m_schemeEnd; ++i) {
         if (!protocol[i] || toASCIILower(m_string[i]) != protocol[i])
             return false;
@@ -1549,7 +1553,7 @@
     TextEncoding pathEncoding(UTF8Encoding()); // Path is always encoded as UTF-8; other parts may depend on the scheme.
 
     int pathEnd = -1;
-    if (encoding != pathEncoding && encoding.isValid() && !protocolIs(rel, "mailto") && !protocolIs(rel, "data") && !protocolIs(rel, "javascript")) {
+    if (encoding != pathEncoding && encoding.isValid() && !protocolIs(rel, "mailto") && !protocolIs(rel, "data") && !protocolIsJavaScript(rel)) {
         // Find the first instance of either # or ?, keep pathEnd at -1 otherwise.
         pathEnd = findFirstOf(s.data(), s.size(), 0, "#?");
     }
@@ -1615,6 +1619,11 @@
     }
 }
 
+bool protocolIsJavaScript(const String& url)
+{
+    return protocolIs(url, "javascript");
+}
+
 String mimeTypeFromDataURL(const String& url)
 {
     ASSERT(protocolIs(url, "data"));
diff --git a/WebCore/platform/KURL.h b/WebCore/platform/KURL.h
index 46b72c7..e419d16 100644
--- a/WebCore/platform/KURL.h
+++ b/WebCore/platform/KURL.h
@@ -251,8 +251,11 @@
 
 // Functions to do URL operations on strings.
 // These are operations that aren't faster on a parsed URL.
+// These are also different from the KURL functions in that they don't require the string to be a valid and parsable URL.
+// This is especially important because valid javascript URLs are not necessarily considered valid by KURL.
 
 bool protocolIs(const String& url, const char* protocol);
+bool protocolIsJavaScript(const String& url);
 
 String mimeTypeFromDataURL(const String& url);
 
diff --git a/WebCore/platform/KURLGoogle.cpp b/WebCore/platform/KURLGoogle.cpp
index c2e8272..d8b87e5 100644
--- a/WebCore/platform/KURLGoogle.cpp
+++ b/WebCore/platform/KURLGoogle.cpp
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2004, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
@@ -235,6 +236,7 @@
                                           charsetConverter,
                                           &output, &m_parsed);
 
+
     if (m_isValid || output.length()) {
         if (m_parsed.ref.is_nonempty())
             setUtf8(CString(output.data(), output.length()));
@@ -521,6 +523,12 @@
     return m_url.m_parsed.ref.len >= 0;
 }
 
+String KURL::baseAsString() const
+{
+    // FIXME: There is probably a more efficient way to do this?
+    return string().left(pathAfterLastSlash());
+}
+
 String KURL::query() const
 {
     if (m_url.m_parsed.query.len >= 0)
@@ -685,6 +693,11 @@
     return m_url.string();
 }
 
+bool protocolIsJavaScript(const String& url)
+{
+    return protocolIs(url, "javascript");
+}
+
 // We copied the KURL version here on Sept 12, 2008 while doing a WebKit
 // merge.
 // 
@@ -800,6 +813,11 @@
 bool KURL::protocolIs(const char* protocol) const
 {
     assertProtocolIsGood(protocol);
+
+    // JavaScript URLs are "valid" and should be executed even if KURL decides they are invalid.
+    // The free function protocolIsJavaScript() should be used instead.
+    // FIXME: Chromium code needs to be fixed for this assert to be enabled. ASSERT(strcmp(protocol, "javascript"));
+
     if (m_url.m_parsed.scheme.len <= 0)
         return !protocol;
     return lowerCaseEqualsASCII(
diff --git a/WebCore/platform/qt/KeyboardCodes.h b/WebCore/platform/KeyboardCodes.h
similarity index 98%
rename from WebCore/platform/qt/KeyboardCodes.h
rename to WebCore/platform/KeyboardCodes.h
index 61bc9fe..c2c3b54 100644
--- a/WebCore/platform/qt/KeyboardCodes.h
+++ b/WebCore/platform/KeyboardCodes.h
@@ -30,6 +30,17 @@
 
 #include <wtf/Platform.h>
 
+// FIXME: We should get rid of these Chromium-related ifdefs.
+#if PLATFORM(CHROMIUM)
+
+#if PLATFORM(WIN_OS)
+#include "KeyboardCodesWin.h"
+#else
+#include "KeyboardCodesPosix.h"
+#endif
+
+#else
+
 namespace WebCore {
 
 #if !PLATFORM(WIN_OS)
@@ -558,4 +569,6 @@
 
 }
 
+#endif // PLATFORM(CHROMIUM)
+
 #endif
diff --git a/WebCore/platform/LinkHash.cpp b/WebCore/platform/LinkHash.cpp
index 793a65d..878933a 100644
--- a/WebCore/platform/LinkHash.cpp
+++ b/WebCore/platform/LinkHash.cpp
@@ -152,12 +152,12 @@
   return AlreadyHashed::avoidDeletedValue(StringImpl::computeHash(url, length));
 }
 
-LinkHash visitedLinkHash(const KURL& base, const AtomicString& attributeURL)
+void visitedURL(const KURL& base, const AtomicString& attributeURL, Vector<UChar, 512>& buffer)
 {
     const UChar* characters = attributeURL.characters();
     unsigned length = attributeURL.length();
     if (!length)
-        return 0;
+        return;
 
     // This is a poor man's completeURL. Faster with less memory allocation.
     // FIXME: It's missing a lot of what completeURL does and a lot of what KURL does.
@@ -172,17 +172,18 @@
 
     bool hasColonSlashSlash = containsColonSlashSlash(characters, length);
 
-    if (hasColonSlashSlash && !needsTrailingSlash(characters, length))
-        return visitedLinkHash(attributeURL.characters(), attributeURL.length());
+    if (hasColonSlashSlash && !needsTrailingSlash(characters, length)) {
+        buffer.append(attributeURL.characters(), attributeURL.length());
+        return;
+    }
 
-    Vector<UChar, 512> buffer;
 
     if (hasColonSlashSlash) {
         // FIXME: This is incorrect for URLs that have a query or anchor; the "/" needs to go at the
         // end of the path, *before* the query or anchor.
         buffer.append(characters, length);
         buffer.append('/');
-        return visitedLinkHash(buffer.data(), buffer.size());
+        return;
     }
 
     switch (characters[0]) {
@@ -204,7 +205,17 @@
         buffer.append('/');
     }
 
-    return visitedLinkHash(buffer.data(), buffer.size());
+    return;
+}
+
+LinkHash visitedLinkHash(const KURL& base, const AtomicString& attributeURL)
+{
+    Vector<UChar, 512> url;
+    visitedURL(base, attributeURL, url);
+    if (url.isEmpty())
+        return 0;
+
+    return visitedLinkHash(url.data(), url.size());
 }
 
 }  // namespace WebCore
diff --git a/WebCore/platform/LinkHash.h b/WebCore/platform/LinkHash.h
index 1ec1e16..2756654 100644
--- a/WebCore/platform/LinkHash.h
+++ b/WebCore/platform/LinkHash.h
@@ -62,6 +62,12 @@
 // look like a relative URL.
 LinkHash visitedLinkHash(const KURL& base, const AtomicString& attributeURL);
 
+// Resolves the potentially relative URL "attributeURL" relative to the given
+// base URL, and returns the hash of the string that will be used for visited.
+// It will return an empty Vector in case of errors.
+void visitedURL(const KURL& base, const AtomicString& attributeURL, Vector<UChar, 512>&);
+
+
 }  // namespace WebCore
 
 #endif  // LinkHash_h
diff --git a/WebCore/platform/LocalizedStrings.h b/WebCore/platform/LocalizedStrings.h
index 085c6e1..b6ec878 100644
--- a/WebCore/platform/LocalizedStrings.h
+++ b/WebCore/platform/LocalizedStrings.h
@@ -88,6 +88,19 @@
     String contextMenuItemTagSpeechMenu();
     String contextMenuItemTagStartSpeaking();
     String contextMenuItemTagStopSpeaking();
+    String contextMenuItemTagCorrectSpellingAutomatically();
+    String contextMenuItemTagSubstitutionsMenu();
+    String contextMenuItemTagShowSubstitutions(bool show);
+    String contextMenuItemTagSmartCopyPaste();
+    String contextMenuItemTagSmartQuotes();
+    String contextMenuItemTagSmartDashes();
+    String contextMenuItemTagSmartLinks();
+    String contextMenuItemTagTextReplacement();
+    String contextMenuItemTagTransformationsMenu();
+    String contextMenuItemTagMakeUpperCase();
+    String contextMenuItemTagMakeLowerCase();
+    String contextMenuItemTagCapitalize();
+    String contextMenuItemTagChangeBack(const String& replacedString);
 #endif
     String contextMenuItemTagInspectElement();
 
diff --git a/WebCore/platform/Logging.cpp b/WebCore/platform/Logging.cpp
index a1aa3d6..9c3f324 100644
--- a/WebCore/platform/Logging.cpp
+++ b/WebCore/platform/Logging.cpp
@@ -25,6 +25,7 @@
 
 #include "config.h"
 #include "Logging.h"
+#include "PlatformString.h"
 
 namespace WebCore {
 
@@ -59,4 +60,33 @@
 WTFLogChannel LogPlugin =            { 0x02000000, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogArchives =          { 0x04000000, "WebCoreLogLevel", WTFLogChannelOff };
 
+WTFLogChannel* getChannelFromName(const String& channelName)
+{
+    if (!(channelName.length() >= 2))
+        return 0;
+
+    if (channelName == String("BackForward")) return &LogBackForward;
+    if (channelName == String("Editing")) return &LogEditing;
+    if (channelName == String("Events")) return &LogEvents;
+    if (channelName == String("Frames")) return &LogFrames;
+    if (channelName == String("FTP")) return &LogFTP;
+    if (channelName == String("History")) return &LogHistory;
+    if (channelName == String("IconDatabase")) return &LogIconDatabase;
+    if (channelName == String("Loading")) return &LogLoading;
+    if (channelName == String("Media")) return &LogMedia;
+    if (channelName == String("Network")) return &LogNetwork;
+    if (channelName == String("NotYetImplemented")) return &LogNotYetImplemented;
+    if (channelName == String("PageCache")) return &LogPageCache;
+    if (channelName == String("PlatformLeaks")) return &LogPlatformLeaks;
+    if (channelName == String("Plugin")) return &LogPlugin;
+    if (channelName == String("PopupBlocking")) return &LogPopupBlocking;
+    if (channelName == String("SpellingAndGrammar")) return &LogSpellingAndGrammar;
+    if (channelName == String("SQLDatabase")) return &LogSQLDatabase;
+    if (channelName == String("StorageAPI")) return &LogStorageAPI;
+    if (channelName == String("TextConversion")) return &LogTextConversion;
+    if (channelName == String("Threading")) return &LogThreading;
+
+    return 0;
+}
+
 }
diff --git a/WebCore/platform/Logging.h b/WebCore/platform/Logging.h
index 844ac3a..c1461e7 100644
--- a/WebCore/platform/Logging.h
+++ b/WebCore/platform/Logging.h
@@ -34,6 +34,8 @@
 
 namespace WebCore {
 
+    class String;
+
     extern WTFLogChannel LogNotYetImplemented;
     extern WTFLogChannel LogFrames;
     extern WTFLogChannel LogLoading;
@@ -57,6 +59,7 @@
     extern WTFLogChannel LogArchives;
 
     void InitializeLoggingChannelsIfNecessary();
+    WTFLogChannel* getChannelFromName(const String& channelName);
 }
 
 #endif // Logging_h
diff --git a/WebCore/platform/MIMETypeRegistry.cpp b/WebCore/platform/MIMETypeRegistry.cpp
index 14becb5..1819e1d 100644
--- a/WebCore/platform/MIMETypeRegistry.cpp
+++ b/WebCore/platform/MIMETypeRegistry.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc.  All rights reserved.
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2006, 2008, 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +34,7 @@
 #include "StringHash.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/StdLibExtras.h>
 
 #if PLATFORM(CG)
 #include "ImageSourceCG.h"
@@ -53,6 +54,7 @@
 static HashSet<String>* supportedJavaScriptMIMETypes;
 static HashSet<String>* supportedNonImageMIMETypes;
 static HashSet<String>* supportedMediaMIMETypes;
+static HashMap<String, String, CaseFoldingHash>* mediaMIMETypeForExtensionMap;
 
 static void initializeSupportedImageMIMETypes()
 {
@@ -73,7 +75,9 @@
     supportedImageResourceMIMETypes->add("image/bmp");
 
     // Favicons don't have a MIME type in the registry either.
+    supportedImageMIMETypes->add("image/vnd.microsoft.icon");
     supportedImageMIMETypes->add("image/x-icon");
+    supportedImageResourceMIMETypes->add("image/vnd.microsoft.icon");
     supportedImageResourceMIMETypes->add("image/x-icon");
 
     //  We only get one MIME type per UTI, hence our need to add these manually
@@ -102,6 +106,9 @@
         supportedImageMIMETypes->add(mimeType);
         supportedImageResourceMIMETypes->add(mimeType);
     }
+
+    supportedImageMIMETypes->remove("application/octet-stream");
+    supportedImageResourceMIMETypes->remove("application/octet-stream");
 #elif PLATFORM(ANDROID)
     static const char* types[] = {
         "image/jpeg",
@@ -132,6 +139,7 @@
         "image/png",
         "image/gif",
         "image/bmp",
+        "image/vnd.microsoft.icon",    // ico
         "image/x-icon",    // ico
         "image/x-xbitmap"  // xbm
     };
@@ -169,6 +177,8 @@
         String mimeType = MIMETypeRegistry::getMIMETypeForExtension(formats.at(i).constData());
         supportedImageMIMETypesForEncoding->add(mimeType);
     }
+
+    supportedImageMIMETypesForEncoding->remove("application/octet-stream");
 #elif PLATFORM(CAIRO)
     supportedImageMIMETypesForEncoding->add("image/png");
 #endif
@@ -214,6 +224,9 @@
         "text/",
         "application/xml",
         "application/xhtml+xml",
+#if ENABLE(XHTMLMP)
+        "application/vnd.wap.xhtml+xml",
+#endif
         "application/rss+xml",
         "application/atom+xml",
 #if ENABLE(SVG)
@@ -232,6 +245,103 @@
 #endif
 }
 
+static void initializeMediaTypeMaps()
+{
+    struct TypeExtensionPair {
+        const char* type;
+        const char* extension;
+    };
+
+    // A table of common media MIME types and file extenstions used when a platform's
+    // specific MIME type lookup doens't have a match for a media file extension. While some
+    // file extensions are claimed by multiple MIME types, this table only includes one 
+    // for each because it is currently only used by getMediaMIMETypeForExtension. If we
+    // ever add a MIME type -> file extension mapping, the alternate MIME types will need
+    // to be added.
+    static const TypeExtensionPair pairs[] = {
+    
+        // Ogg
+        { "application/ogg", "ogg" },
+        { "application/ogg", "ogx" },
+        { "audio/ogg", "oga" },
+        { "video/ogg", "ogv" },
+
+        // Annodex
+        { "application/annodex", "anx" },
+        { "audio/annodex", "axa" },
+        { "video/annodex", "axv" },
+        { "audio/speex", "spx" },
+
+        // MPEG
+        { "audio/mpeg", "m1a" },
+        { "audio/mpeg", "m2a" },
+        { "audio/mpeg", "m1s" },
+        { "audio/mpeg", "mpa" },
+        { "video/mpeg", "mpg" },
+        { "video/mpeg", "m15" },
+        { "video/mpeg", "m1s" },
+        { "video/mpeg", "m1v" },
+        { "video/mpeg", "m75" },
+        { "video/mpeg", "mpa" },
+        { "video/mpeg", "mpeg" },
+        { "video/mpeg", "mpm" },
+        { "video/mpeg", "mpv" },
+
+        // MPEG playlist
+        { "audio/x-mpegurl", "m3url" },
+        { "application/x-mpegurl", "m3u8" },
+
+        // MPEG-4
+        { "video/x-m4v", "m4v" },
+        { "audio/x-m4a", "m4a" },
+        { "audio/x-m4b", "m4b" },
+        { "audio/x-m4p", "m4p" },
+ 
+        // MP3
+        { "audio/mp3", "mp3" },
+
+        // MPEG-2
+        { "video/x-mpeg2", "mp2" },
+        { "video/mpeg2", "vob" },
+        { "video/mpeg2", "mod" },
+        { "video/m2ts", "m2ts" },
+        { "video/x-m2ts", "m2t" },
+        { "video/x-m2ts", "ts" },
+
+        // 3GP/3GP2
+        { "audio/3gpp", "3gpp" }, 
+        { "audio/3gpp2", "3g2" }, 
+        { "application/x-mpeg", "amc" },
+
+        // AAC
+        { "audio/aac", "aac" },
+        { "audio/aac", "adts" },
+        { "audio/x-aac", "m4r" },
+
+        // CoreAudio File
+        { "audio/x-caf", "caf" },
+        { "audio/x-gsm", "gsm" }
+    };
+
+    mediaMIMETypeForExtensionMap = new HashMap<String, String, CaseFoldingHash>;
+    const unsigned numPairs = sizeof(pairs) / sizeof(pairs[0]);
+    for (unsigned ndx = 0; ndx < numPairs; ++ndx)
+        mediaMIMETypeForExtensionMap->set(pairs[ndx].extension, pairs[ndx].type);
+}
+
+String MIMETypeRegistry::getMediaMIMETypeForExtension(const String& ext)
+{
+    // Check with system specific implementation first.
+    String mimeType = getMIMETypeForExtension(ext);
+    if (!mimeType.isEmpty())
+        return mimeType;
+
+    // No match, look in the static mapping.
+    if (!mediaMIMETypeForExtensionMap)
+        initializeMediaTypeMaps();
+    return mediaMIMETypeForExtensionMap->get(ext);
+}
+
 static void initializeSupportedMediaMIMETypes()
 {
     supportedMediaMIMETypes = new HashSet<String>;
@@ -365,4 +475,10 @@
     return *supportedMediaMIMETypes;
 }
 
+const String& defaultMIMEType()
+{
+    DEFINE_STATIC_LOCAL(const String, defaultMIMEType, ("application/octet-stream"));
+    return defaultMIMEType;
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/MIMETypeRegistry.h b/WebCore/platform/MIMETypeRegistry.h
index fca467f..8801ac1 100644
--- a/WebCore/platform/MIMETypeRegistry.h
+++ b/WebCore/platform/MIMETypeRegistry.h
@@ -38,6 +38,7 @@
     static String getMIMETypeForExtension(const String& ext);
     static Vector<String> getExtensionsForMIMEType(const String& type);
     static String getPreferredExtensionForMIMEType(const String& type);
+    static String getMediaMIMETypeForExtension(const String& ext);
 
     static String getMIMETypeForPath(const String& path);
 
@@ -73,6 +74,8 @@
     static HashSet<String>& getSupportedMediaMIMETypes();
 };
 
+const String& defaultMIMEType();
+
 } // namespace WebCore
 
 #endif // MIMETypeRegistry_h
diff --git a/WebCore/platform/PlatformMouseEvent.h b/WebCore/platform/PlatformMouseEvent.h
index 9f6bea9..2543d40 100644
--- a/WebCore/platform/PlatformMouseEvent.h
+++ b/WebCore/platform/PlatformMouseEvent.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,26 +27,6 @@
 #define PlatformMouseEvent_h
 
 #include "IntPoint.h"
-#include <wtf/Platform.h>
-
-#if PLATFORM(MAC)
-#ifdef __OBJC__
-@class NSEvent;
-@class NSScreen;
-@class NSWindow;
-#else
-class NSEvent;
-class NSScreen;
-class NSWindow;
-#endif
-#endif
-
-#if PLATFORM(WIN)
-typedef struct HWND__* HWND;
-typedef unsigned UINT;
-typedef unsigned WPARAM;
-typedef long LPARAM;
-#endif
 
 #if PLATFORM(GTK)
 typedef struct _GdkEventButton GdkEventButton;
@@ -59,6 +39,13 @@
 QT_END_NAMESPACE
 #endif
 
+#if PLATFORM(WIN)
+typedef struct HWND__* HWND;
+typedef unsigned UINT;
+typedef unsigned WPARAM;
+typedef long LPARAM;
+#endif
+
 #if PLATFORM(WX)
 class wxMouseEvent;
 #endif
@@ -84,9 +71,11 @@
         {
         }
 
-        PlatformMouseEvent(const IntPoint& pos, const IntPoint& globalPos, MouseButton button, MouseEventType eventType,
+        PlatformMouseEvent(const IntPoint& position, const IntPoint& globalPosition, MouseButton button, MouseEventType eventType,
                            int clickCount, bool shift, bool ctrl, bool alt, bool meta, double timestamp)
-            : m_position(pos), m_globalPosition(globalPos), m_button(button)
+            : m_position(position)
+            , m_globalPosition(globalPosition)
+            , m_button(button)
             , m_eventType(eventType)
             , m_clickCount(clickCount)
             , m_shiftKey(shift)
@@ -112,29 +101,32 @@
         bool metaKey() const { return m_metaKey; }
         unsigned modifierFlags() const { return m_modifierFlags; }
         
-        //time in seconds
+        // Time in seconds.
         double timestamp() const { return m_timestamp; }
 
-#if PLATFORM(MAC)
-        PlatformMouseEvent(NSEvent*);
+#if PLATFORM(GTK) 
+        PlatformMouseEvent(GdkEventButton*);
+        PlatformMouseEvent(GdkEventMotion*);
+#endif
+
+#if PLATFORM(MAC) && defined(__OBJC__)
+        PlatformMouseEvent(NSEvent *, NSView *windowView);
         int eventNumber() const { return m_eventNumber; }
 #endif
+
+#if PLATFORM(QT)
+        PlatformMouseEvent(QInputEvent*, int clickCount);
+#endif
+
 #if PLATFORM(WIN)
         PlatformMouseEvent(HWND, UINT, WPARAM, LPARAM, bool activatedWebView = false);
         void setClickCount(int count) { m_clickCount = count; }
         bool activatedWebView() const { return m_activatedWebView; }
 #endif
-#if PLATFORM(GTK) 
-        PlatformMouseEvent(GdkEventButton*);
-        PlatformMouseEvent(GdkEventMotion*);
-#endif
-#if PLATFORM(QT)
-        PlatformMouseEvent(QInputEvent*, int clickCount);
-#endif
-#if PLATFORM(WX)
-        PlatformMouseEvent(const wxMouseEvent&, const wxPoint& globalPoint);
-#endif
 
+#if PLATFORM(WX)
+        PlatformMouseEvent(const wxMouseEvent&, const wxPoint& globalPoint, int clickCount);
+#endif
 
     protected:
         IntPoint m_position;
@@ -148,18 +140,20 @@
         bool m_metaKey;
         double m_timestamp; // unit: seconds
         unsigned m_modifierFlags;
+
 #if PLATFORM(MAC)
         int m_eventNumber;
 #endif
+
 #if PLATFORM(WIN)
         bool m_activatedWebView;
 #endif
     };
 
-#if PLATFORM(MAC)
-    IntPoint globalPoint(const NSPoint& windowPoint, NSWindow *window);
-    IntPoint pointForEvent(NSEvent *event);
-    IntPoint globalPointForEvent(NSEvent *event);
+#if PLATFORM(MAC) && defined(__OBJC__)
+    IntPoint globalPoint(const NSPoint& windowPoint, NSWindow *);
+    IntPoint pointForEvent(NSEvent *, NSView *windowView);
+    IntPoint globalPointForEvent(NSEvent *);
 #endif
 
 } // namespace WebCore
diff --git a/WebCore/platform/PlatformWheelEvent.h b/WebCore/platform/PlatformWheelEvent.h
index 9395e93..037c4b7 100644
--- a/WebCore/platform/PlatformWheelEvent.h
+++ b/WebCore/platform/PlatformWheelEvent.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,20 +28,6 @@
 
 #include "IntPoint.h"
 
-#if PLATFORM(MAC)
-#ifdef __OBJC__
-@class NSEvent;
-#else
-class NSEvent;
-#endif
-#endif
-
-#if PLATFORM(WIN)
-typedef struct HWND__* HWND;
-typedef unsigned WPARAM;
-typedef long LPARAM;
-#endif
-
 #if PLATFORM(GTK)
 typedef struct _GdkEventScroll GdkEventScroll;
 #endif
@@ -52,6 +38,12 @@
 QT_END_NAMESPACE
 #endif
 
+#if PLATFORM(WIN)
+typedef struct HWND__* HWND;
+typedef unsigned WPARAM;
+typedef long LPARAM;
+#endif
+
 #if PLATFORM(WX)
 class wxMouseEvent;
 class wxPoint;
@@ -93,18 +85,22 @@
         void accept() { m_isAccepted = true; }
         void ignore() { m_isAccepted = false; }
 
-#if PLATFORM(MAC)
-        PlatformWheelEvent(NSEvent*);
-#endif
-#if PLATFORM(WIN)
-        PlatformWheelEvent(HWND, WPARAM, LPARAM, bool isMouseHWheel);
-#endif
 #if PLATFORM(GTK)
         PlatformWheelEvent(GdkEventScroll*);
 #endif
+
+#if PLATFORM(MAC) && defined(__OBJC__)
+        PlatformWheelEvent(NSEvent *, NSView *windowView);
+#endif
+
 #if PLATFORM(QT)
         PlatformWheelEvent(QWheelEvent*);
 #endif
+
+#if PLATFORM(WIN)
+        PlatformWheelEvent(HWND, WPARAM, LPARAM, bool isMouseHWheel);
+#endif
+
 #if PLATFORM(WX)
         PlatformWheelEvent(const wxMouseEvent&, const wxPoint&);
 #endif
diff --git a/WebCore/platform/ScrollView.cpp b/WebCore/platform/ScrollView.cpp
index 5a12304..f0db95a 100644
--- a/WebCore/platform/ScrollView.cpp
+++ b/WebCore/platform/ScrollView.cpp
@@ -47,6 +47,7 @@
     , m_scrollbarsAvoidingResizer(0)
     , m_scrollbarsSuppressed(false)
     , m_inUpdateScrollbars(false)
+    , m_updateScrollbarsPass(0)
     , m_drawPanScrollIcon(false)
     , m_useFixedLayout(false)
 {
@@ -78,7 +79,7 @@
 
 void ScrollView::setHasHorizontalScrollbar(bool hasBar)
 {
-    if (hasBar && !m_horizontalScrollbar && !platformHasHorizontalAdjustment()) {
+    if (hasBar && !m_horizontalScrollbar) {
         m_horizontalScrollbar = createScrollbar(HorizontalScrollbar);
         addChild(m_horizontalScrollbar.get());
     } else if (!hasBar && m_horizontalScrollbar) {
@@ -89,7 +90,7 @@
 
 void ScrollView::setHasVerticalScrollbar(bool hasBar)
 {
-    if (hasBar && !m_verticalScrollbar && !platformHasVerticalAdjustment()) {
+    if (hasBar && !m_verticalScrollbar) {
         m_verticalScrollbar = createScrollbar(VerticalScrollbar);
         addChild(m_verticalScrollbar.get());
     } else if (!hasBar && m_verticalScrollbar) {
@@ -98,10 +99,12 @@
     }
 }
 
+#if !PLATFORM(GTK)
 PassRefPtr<Scrollbar> ScrollView::createScrollbar(ScrollbarOrientation orientation)
 {
     return Scrollbar::createNativeScrollbar(this, orientation, RegularScrollbar);
 }
+#endif
 
 void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode verticalMode)
 {
@@ -238,9 +241,9 @@
     // Figure out if we really moved.
     IntSize newOffset = m_scrollOffset;
     if (scrollbar) {
-        if (scrollbar == m_horizontalScrollbar)
+        if (scrollbar->orientation() == HorizontalScrollbar)
             newOffset.setWidth(scrollbar->value());
-        else if (scrollbar == m_verticalScrollbar)
+        else if (scrollbar->orientation() == VerticalScrollbar)
             newOffset.setHeight(scrollbar->value());
     }
 
@@ -318,62 +321,99 @@
     return false;
 }
 
+static const unsigned cMaxUpdateScrollbarsPass = 2;
+
 void ScrollView::updateScrollbars(const IntSize& desiredOffset)
 {
-    // Don't allow re-entrancy into this function.
     if (m_inUpdateScrollbars || prohibitsScrolling() || platformWidget())
         return;
 
-    m_inUpdateScrollbars = true;
-
-    bool hasVerticalScrollbar = m_verticalScrollbar;
     bool hasHorizontalScrollbar = m_horizontalScrollbar;
-    bool oldHasVertical = hasVerticalScrollbar;
-    bool oldHasHorizontal = hasHorizontalScrollbar;
+    bool hasVerticalScrollbar = m_verticalScrollbar;
+    
+    bool newHasHorizontalScrollbar = hasHorizontalScrollbar;
+    bool newHasVerticalScrollbar = hasVerticalScrollbar;
+   
     ScrollbarMode hScroll = m_horizontalScrollbarMode;
     ScrollbarMode vScroll = m_verticalScrollbarMode;
 
-    const int scrollbarThickness = ScrollbarTheme::nativeTheme()->scrollbarThickness();
+    if (hScroll != ScrollbarAuto)
+        newHasHorizontalScrollbar = (hScroll == ScrollbarAlwaysOn);
+    if (vScroll != ScrollbarAuto)
+        newHasVerticalScrollbar = (vScroll == ScrollbarAlwaysOn);
 
-    for (int pass = 0; pass < 2; pass++) {
-        bool scrollsVertically;
-        bool scrollsHorizontally;
+    if (m_scrollbarsSuppressed || (hScroll != ScrollbarAuto && vScroll != ScrollbarAuto)) {
+        if (hasHorizontalScrollbar != newHasHorizontalScrollbar)
+            setHasHorizontalScrollbar(newHasHorizontalScrollbar);
+        if (hasVerticalScrollbar != newHasVerticalScrollbar)
+            setHasVerticalScrollbar(newHasVerticalScrollbar);
+    } else {
+        // If we came in here with the view already needing a layout, then go ahead and do that
+        // first.  (This will be the common case, e.g., when the page changes due to window resizing for example).
+        // This layout will not re-enter updateScrollers and does not count towards our max layout pass total.
+        m_inUpdateScrollbars = true;
+        visibleContentsResized();
+        m_inUpdateScrollbars = false;
 
-        if (!m_scrollbarsSuppressed && (hScroll == ScrollbarAuto || vScroll == ScrollbarAuto)) {
-            // Do a layout if pending before checking if scrollbars are needed.
-            if (hasVerticalScrollbar != oldHasVertical || hasHorizontalScrollbar != oldHasHorizontal)
-                visibleContentsResized();
-
-            scrollsVertically = (vScroll == ScrollbarAlwaysOn) || (vScroll == ScrollbarAuto && contentsHeight() > height());
-            if (scrollsVertically)
-                scrollsHorizontally = (hScroll == ScrollbarAlwaysOn) || (hScroll == ScrollbarAuto && contentsWidth() + scrollbarThickness > width());
-            else {
-                scrollsHorizontally = (hScroll == ScrollbarAlwaysOn) || (hScroll == ScrollbarAuto && contentsWidth() > width());
-                if (scrollsHorizontally)
-                    scrollsVertically = (vScroll == ScrollbarAlwaysOn) || (vScroll == ScrollbarAuto && contentsHeight() + scrollbarThickness > height());
-            }
-        } else {
-            scrollsHorizontally = (hScroll == ScrollbarAuto) ? hasHorizontalScrollbar : (hScroll == ScrollbarAlwaysOn);
-            scrollsVertically = (vScroll == ScrollbarAuto) ? hasVerticalScrollbar : (vScroll == ScrollbarAlwaysOn);
-        }
+        bool sendContentResizedNotification = false;
         
-        if (hasVerticalScrollbar != scrollsVertically) {
-            setHasVerticalScrollbar(scrollsVertically);
-            hasVerticalScrollbar = scrollsVertically;
+        IntSize docSize = contentsSize();
+        IntSize frameSize = frameRect().size();
+
+        if (hScroll == ScrollbarAuto) {
+            newHasHorizontalScrollbar = docSize.width() > visibleWidth();
+            if (newHasHorizontalScrollbar && !m_updateScrollbarsPass && docSize.width() <= frameSize.width() && docSize.height() <= frameSize.height())
+                newHasHorizontalScrollbar = false;
+        }
+        if (vScroll == ScrollbarAuto) {
+            newHasVerticalScrollbar = docSize.height() > visibleHeight();
+            if (newHasVerticalScrollbar && !m_updateScrollbarsPass && docSize.width() <= frameSize.width() && docSize.height() <= frameSize.height())
+                newHasVerticalScrollbar = false;
         }
 
-        if (hasHorizontalScrollbar != scrollsHorizontally) {
-            setHasHorizontalScrollbar(scrollsHorizontally);
-            hasHorizontalScrollbar = scrollsHorizontally;
+        // If we ever turn one scrollbar off, always turn the other one off too.  Never ever
+        // try to both gain/lose a scrollbar in the same pass.
+        if (!newHasHorizontalScrollbar && hasHorizontalScrollbar && vScroll != ScrollbarAlwaysOn)
+            newHasVerticalScrollbar = false;
+        if (!newHasVerticalScrollbar && hasVerticalScrollbar && hScroll != ScrollbarAlwaysOn)
+            newHasHorizontalScrollbar = false;
+
+        if (hasHorizontalScrollbar != newHasHorizontalScrollbar) {
+            setHasHorizontalScrollbar(newHasHorizontalScrollbar);
+            sendContentResizedNotification = true;
+        }
+
+        if (hasVerticalScrollbar != newHasVerticalScrollbar) {
+            setHasVerticalScrollbar(newHasVerticalScrollbar);
+            sendContentResizedNotification = true;
+        }
+
+        if (sendContentResizedNotification && m_updateScrollbarsPass < cMaxUpdateScrollbarsPass) {
+            m_updateScrollbarsPass++;
+            contentsResized();
+            visibleContentsResized();
+            IntSize newDocSize = contentsSize();
+            if (newDocSize == docSize) {
+                // The layout with the new scroll state had no impact on
+                // the document's overall size, so updateScrollbars didn't get called.
+                // Recur manually.
+                updateScrollbars(desiredOffset);
+            }
+            m_updateScrollbarsPass--;
         }
     }
     
-    // Set up the range (and page step/line step).
+    // Set up the range (and page step/line step), but only do this if we're not in a nested call (to avoid
+    // doing it multiple times).
+    if (m_updateScrollbarsPass)
+        return;
+
+    m_inUpdateScrollbars = true;
     IntSize maxScrollPosition(contentsWidth() - visibleWidth(), contentsHeight() - visibleHeight());
     IntSize scroll = desiredOffset.shrunkTo(maxScrollPosition);
     scroll.clampNegativeToZero();
  
-    if (!platformHandleHorizontalAdjustment(scroll) && m_horizontalScrollbar) {
+    if (m_horizontalScrollbar) {
         int clientWidth = visibleWidth();
         m_horizontalScrollbar->setEnabled(contentsWidth() > clientWidth);
         int pageStep = (clientWidth - cAmountToKeepWhenPaging);
@@ -397,7 +437,7 @@
             m_horizontalScrollbar->setSuppressInvalidation(false); 
     } 
 
-    if (!platformHandleVerticalAdjustment(scroll) && m_verticalScrollbar) {
+    if (m_verticalScrollbar) {
         int clientHeight = visibleHeight();
         m_verticalScrollbar->setEnabled(contentsHeight() > clientHeight);
         int pageStep = (clientHeight - cAmountToKeepWhenPaging);
@@ -421,7 +461,7 @@
             m_verticalScrollbar->setSuppressInvalidation(false);
     }
 
-    if (oldHasVertical != (m_verticalScrollbar != 0) || oldHasHorizontal != (m_horizontalScrollbar != 0))
+    if (hasHorizontalScrollbar != (m_horizontalScrollbar != 0) || hasVerticalScrollbar != (m_verticalScrollbar != 0))
         frameRectsChanged();
 
     // See if our offset has changed in a situation where we might not have scrollbars.
@@ -467,7 +507,7 @@
        hostWindow()->scroll(-scrollDelta, scrollViewRect, clipRect);
     } else { 
        // We need to go ahead and repaint the entire backing store.  Do it now before moving the
-       // plugins.
+       // windowed plugins.
        hostWindow()->repaint(updateRect, true, false, true); // Invalidate the backing store and repaint it synchronously
     }
 
@@ -548,8 +588,16 @@
     if (m_scrollbarsAvoidingResizer && parent())
         parent()->adjustScrollbarsAvoidingResizerCount(-m_scrollbarsAvoidingResizer);
 
+#if PLATFORM(QT)
+    if (m_widgetsPreventingBlitting && parent())
+        parent()->adjustWidgetsPreventingBlittingCount(-m_widgetsPreventingBlitting);
+
+    if (m_widgetsPreventingBlitting && parentView)
+        parentView->adjustWidgetsPreventingBlittingCount(m_widgetsPreventingBlitting);
+#endif
+
     Widget::setParent(parentView);
-    
+
     if (m_scrollbarsAvoidingResizer && parent())
         parent()->adjustScrollbarsAvoidingResizerCount(m_scrollbarsAvoidingResizer);
 }
@@ -606,8 +654,13 @@
 void ScrollView::wheelEvent(PlatformWheelEvent& e)
 {
     // We don't allow mouse wheeling to happen in a ScrollView that has had its scrollbars explicitly disabled.
-    if (!canHaveScrollbars() || platformWidget())
+#if PLATFORM(WX)
+    if (!canHaveScrollbars()) {
+#else
+    if (!canHaveScrollbars() || platformWidget()) {
+#endif
         return;
+    }
 
     // Determine how much we want to scroll.  If we can move at all, we will accept the event.
     IntSize maxScrollDelta = maximumScrollPosition() - scrollPosition();
@@ -817,6 +870,7 @@
 }
 
 #if !PLATFORM(WX) && !PLATFORM(GTK) && !PLATFORM(QT)
+
 void ScrollView::platformInit()
 {
 }
@@ -824,9 +878,11 @@
 void ScrollView::platformDestroy()
 {
 }
+
 #endif
 
 #if !PLATFORM(WX) && !PLATFORM(GTK) && !PLATFORM(QT) && !PLATFORM(MAC)
+
 void ScrollView::platformAddChild(Widget*)
 {
 }
@@ -834,15 +890,19 @@
 void ScrollView::platformRemoveChild(Widget*)
 {
 }
+
 #endif
 
 #if !PLATFORM(MAC)
+
 void ScrollView::platformSetScrollbarsSuppressed(bool repaintOnUnsuppress)
 {
 }
+
 #endif
 
 #if !PLATFORM(MAC) && !PLATFORM(WX)
+
 void ScrollView::platformSetScrollbarModes()
 {
 }
@@ -850,6 +910,8 @@
 #if !PLATFORM(ANDROID)
 void ScrollView::platformScrollbarModes(ScrollbarMode& horizontal, ScrollbarMode& vertical) const
 {
+    horizontal = ScrollbarAuto;
+    vertical = ScrollbarAuto;
 }
 #endif
 
@@ -917,28 +979,6 @@
 {
     return false;
 }
-#endif
-
-#if !PLATFORM(GTK)
-bool ScrollView::platformHandleHorizontalAdjustment(const IntSize&)
-{
-    return false;
-}
-
-bool ScrollView::platformHandleVerticalAdjustment(const IntSize&)
-{
-    return false;
-}
-
-bool ScrollView::platformHasHorizontalAdjustment() const
-{
-    return false;
-}
-
-bool ScrollView::platformHasVerticalAdjustment() const
-{
-    return false;
-}
 
 #endif
 
diff --git a/WebCore/platform/ScrollView.h b/WebCore/platform/ScrollView.h
index f7bfbe8..9847350 100644
--- a/WebCore/platform/ScrollView.h
+++ b/WebCore/platform/ScrollView.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Holger Hans Peter Freyther
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,9 +47,6 @@
 class wxScrollWinEvent;
 #endif
 
-// DANGER WILL ROBINSON! THIS FILE IS UNDERGOING HEAVY REFACTORING.
-// Everything is changing!
-// Port authors should wait until this refactoring is complete before attempting to implement this interface.
 namespace WebCore {
 
 class HostWindow;
@@ -125,7 +123,7 @@
     
     // Methods for getting/setting the size of the document contained inside the ScrollView (as an IntSize or as individual width and height
     // values).
-    IntSize contentsSize() const;
+    IntSize contentsSize() const; // Always at least as big as the visibleWidth()/visibleHeight().
     int contentsWidth() const { return contentsSize().width(); }
     int contentsHeight() const { return contentsSize().height(); }
     virtual void setContentsSize(const IntSize&);
@@ -254,6 +252,7 @@
     bool m_scrollbarsSuppressed;
 
     bool m_inUpdateScrollbars;
+    unsigned m_updateScrollbarsPass;
 
     IntPoint m_panScrollIconPoint;
     bool m_drawPanScrollIcon;
@@ -283,10 +282,6 @@
     void platformSetScrollbarsSuppressed(bool repaintOnUnsuppress);
     void platformRepaintContentRectangle(const IntRect&, bool now);
     bool platformIsOffscreen() const;
-    bool platformHandleHorizontalAdjustment(const IntSize&);
-    bool platformHandleVerticalAdjustment(const IntSize&);
-    bool platformHasHorizontalAdjustment() const;
-    bool platformHasVerticalAdjustment() const;
 
 #if PLATFORM(MAC) && defined __OBJC__
 public:
@@ -297,9 +292,11 @@
 #endif
 
 #if PLATFORM(QT)
+public:
+    void adjustWidgetsPreventingBlittingCount(int delta);
 private:
-    bool rootPreventsBlitting() const { return root()->m_widgetsThatPreventBlitting > 0; }
-    unsigned m_widgetsThatPreventBlitting;
+    bool rootPreventsBlitting() const { return root()->m_widgetsPreventingBlitting > 0; }
+    unsigned m_widgetsPreventingBlitting;
 #else
     bool rootPreventsBlitting() const { return false; }
 #endif
diff --git a/WebCore/platform/Scrollbar.cpp b/WebCore/platform/Scrollbar.cpp
index 13bb0c9..babf3d4 100644
--- a/WebCore/platform/Scrollbar.cpp
+++ b/WebCore/platform/Scrollbar.cpp
@@ -57,6 +57,7 @@
     , m_visibleSize(0)
     , m_totalSize(0)
     , m_currentPos(0)
+    , m_dragOrigin(0)
     , m_lineStep(0)
     , m_pageStep(0)
     , m_pixelStep(1)
@@ -92,13 +93,7 @@
     v = max(min(v, m_totalSize - m_visibleSize), 0);
     if (value() == v)
         return false; // Our value stayed the same.
-    m_currentPos = v;
-
-    updateThumbPosition();
-
-    if (client())
-        client()->valueChanged(this);
-    
+    setCurrentPos(v);
     return true;
 }
 
@@ -139,20 +134,7 @@
         
     float newPos = m_currentPos + step * multiplier;
     float maxPos = m_totalSize - m_visibleSize;
-    newPos = max(min(newPos, maxPos), 0.0f);
-
-    if (newPos == m_currentPos)
-        return false;
-    
-    int oldValue = value();
-    m_currentPos = newPos;
-    updateThumbPosition();
-    
-    if (value() != oldValue && client())
-        client()->valueChanged(this);
-    
-    // return true even if the integer value did not change so that scroll event gets eaten
-    return true;
+    return setCurrentPos(max(min(newPos, maxPos), 0.0f));
 }
 
 void Scrollbar::updateThumbPosition()
@@ -269,15 +251,30 @@
     int thumbLen = theme()->thumbLength(this);
     int trackLen = theme()->trackLength(this);
     int maxPos = trackLen - thumbLen;
-    int delta = pos - pressedPos();
+    int delta = pos - m_pressedPos;
     if (delta > 0)
         delta = min(maxPos - thumbPos, delta);
     else if (delta < 0)
         delta = max(-thumbPos, delta);
-    if (delta) {
-        setValue(static_cast<int>(static_cast<float>(thumbPos + delta) * maximum() / (trackLen - thumbLen)));
-        setPressedPos(pressedPos() + theme()->thumbPosition(this) - thumbPos);
-    }
+    if (delta)
+        setCurrentPos(static_cast<float>(thumbPos + delta) * maximum() / (trackLen - thumbLen));
+}
+
+bool Scrollbar::setCurrentPos(float pos)
+{
+    if (pos == m_currentPos)
+        return false;
+
+    int oldValue = value();
+    int oldThumbPos = theme()->thumbPosition(this);
+    m_currentPos = pos;
+    updateThumbPosition();
+    if (m_pressedPart == ThumbPart)
+        setPressedPos(m_pressedPos + theme()->thumbPosition(this) - oldThumbPos);
+
+    if (value() != oldValue && client())
+        client()->valueChanged(this);
+    return true;
 }
 
 void Scrollbar::setHoveredPart(ScrollbarPart part)
@@ -287,7 +284,7 @@
 
     if ((m_hoveredPart == NoPart || part == NoPart) && theme()->invalidateOnMouseEnterExit())
         invalidate();  // Just invalidate the whole scrollbar, since the buttons at either end change anyway.
-    else if (m_pressedPart == NoPart) {
+    else if (m_pressedPart == NoPart) {  // When there's a pressed part, we don't draw a hovered state, so there's no reason to invalidate.
         theme()->invalidatePart(this, part);
         theme()->invalidatePart(this, m_hoveredPart);
     }
@@ -301,14 +298,20 @@
     m_pressedPart = part;
     if (m_pressedPart != NoPart)
         theme()->invalidatePart(this, m_pressedPart);
+    else if (m_hoveredPart != NoPart)  // When we no longer have a pressed part, we can start drawing a hovered state on the hovered part.
+        theme()->invalidatePart(this, m_hoveredPart);
 }
 
 bool Scrollbar::mouseMoved(const PlatformMouseEvent& evt)
 {
     if (m_pressedPart == ThumbPart) {
-        moveThumb(m_orientation == HorizontalScrollbar ? 
-                  convertFromContainingWindow(evt.pos()).x() :
-                  convertFromContainingWindow(evt.pos()).y());
+        if (theme()->shouldSnapBackToDragOrigin(this, evt))
+            setCurrentPos(m_dragOrigin);
+        else {
+            moveThumb(m_orientation == HorizontalScrollbar ? 
+                      convertFromContainingWindow(evt.pos()).x() :
+                      convertFromContainingWindow(evt.pos()).y());
+        }
         return true;
     }
 
@@ -364,9 +367,10 @@
     setPressedPart(theme()->hitTest(this, evt));
     int pressedPos = (orientation() == HorizontalScrollbar ? convertFromContainingWindow(evt.pos()).x() : convertFromContainingWindow(evt.pos()).y());
     
-    if ((pressedPart() == BackTrackPart || pressedPart() == ForwardTrackPart) && theme()->shouldCenterOnThumb(this, evt)) {
+    if ((m_pressedPart == BackTrackPart || m_pressedPart == ForwardTrackPart) && theme()->shouldCenterOnThumb(this, evt)) {
         setHoveredPart(ThumbPart);
         setPressedPart(ThumbPart);
+        m_dragOrigin = m_currentPos;
         int thumbLen = theme()->thumbLength(this);
         int desiredPos = pressedPos;
         // Set the pressed position to the middle of the thumb so that when we do the move, the delta
@@ -374,7 +378,8 @@
         m_pressedPos = theme()->trackPosition(this) + theme()->thumbPosition(this) + thumbLen / 2;
         moveThumb(desiredPos);
         return true;
-    }
+    } else if (m_pressedPart == ThumbPart)
+        m_dragOrigin = m_currentPos;
     
     m_pressedPos = pressedPos;
 
diff --git a/WebCore/platform/Scrollbar.h b/WebCore/platform/Scrollbar.h
index 2c5b274..19d95d7 100644
--- a/WebCore/platform/Scrollbar.h
+++ b/WebCore/platform/Scrollbar.h
@@ -125,6 +125,9 @@
 
     virtual void styleChanged() { }
 
+private:
+    virtual bool isScrollbar() const { return true; }
+
 protected:
     virtual void updateThumbPosition();
     virtual void updateThumbProportion();
@@ -137,6 +140,7 @@
     ScrollGranularity pressedPartScrollGranularity();
     
     void moveThumb(int pos);
+    bool setCurrentPos(float pos);
 
     ScrollbarClient* m_client;
     ScrollbarOrientation m_orientation;
@@ -146,6 +150,7 @@
     int m_visibleSize;
     int m_totalSize;
     float m_currentPos;
+    float m_dragOrigin;
     int m_lineStep;
     int m_pageStep;
     float m_pixelStep;
diff --git a/WebCore/platform/ScrollbarTheme.h b/WebCore/platform/ScrollbarTheme.h
index e2aebc6..9327dc6 100644
--- a/WebCore/platform/ScrollbarTheme.h
+++ b/WebCore/platform/ScrollbarTheme.h
@@ -76,6 +76,7 @@
     virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white); }
 
     virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&) { return false; }
+    virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&) { return false; }
     virtual int thumbPosition(Scrollbar*) { return 0; } // The position of the thumb relative to the track.
     virtual int thumbLength(Scrollbar*) { return 0; } // The length of the thumb along the axis of the scrollbar.
     virtual int trackPosition(Scrollbar*) { return 0; } // The position of the track relative to the scrollbar.
diff --git a/WebCore/platform/SharedBuffer.h b/WebCore/platform/SharedBuffer.h
index 3675a3b..3404a0c 100644
--- a/WebCore/platform/SharedBuffer.h
+++ b/WebCore/platform/SharedBuffer.h
@@ -70,6 +70,7 @@
 #endif
 #if PLATFORM(CF)
     CFDataRef createCFData();
+    static PassRefPtr<SharedBuffer> wrapCFData(CFDataRef);
 #endif
 
     const char* data() const;
diff --git a/WebCore/platform/network/cf/ResourceResponseCFNet.h b/WebCore/platform/SuddenTermination.h
similarity index 65%
copy from WebCore/platform/network/cf/ResourceResponseCFNet.h
copy to WebCore/platform/SuddenTermination.h
index 27144c6..7171102 100644
--- a/WebCore/platform/network/cf/ResourceResponseCFNet.h
+++ b/WebCore/platform/SuddenTermination.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,30 +10,34 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ResourceResponseCFNet_h
-#define ResourceResponseCFNet_h
+#ifndef SuddenTermination_h
+#define SuddenTermination_h
 
-typedef struct _CFURLResponse* CFURLResponseRef;
+#include <wtf/Platform.h>
 
 namespace WebCore {
 
-    class ResourceResponse;
+    void disableSuddenTermination();
+    void enableSuddenTermination();
 
-    void getResourceResponse(ResourceResponse& response, CFURLResponseRef cfResponse);
+#if (!PLATFORM(MAC) || defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)) && !PLATFORM(CHROMIUM)
+    inline void disableSuddenTermination() { }
+    inline void enableSuddenTermination() { }
+#endif
 
-}
+} // namespace WebCore
 
-#endif // ResourceResponseCFNet_h
+#endif // SuddenTermination_h
diff --git a/WebCore/platform/ThreadGlobalData.cpp b/WebCore/platform/ThreadGlobalData.cpp
index 903af66..a43e9bd 100644
--- a/WebCore/platform/ThreadGlobalData.cpp
+++ b/WebCore/platform/ThreadGlobalData.cpp
@@ -32,7 +32,7 @@
 #include "ThreadTimers.h"
 #include <wtf/UnusedParam.h>
 
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
 #include "TextCodecICU.h"
 #endif
 
@@ -72,7 +72,10 @@
     , m_atomicStringTable(new HashSet<StringImpl*>)
     , m_eventNames(new EventNames)
     , m_threadTimers(new ThreadTimers)
-#if USE(ICU_UNICODE)
+#ifndef NDEBUG
+    , m_isMainThread(isMainThread())
+#endif
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
     , m_cachedConverterICU(new ICUConverterWrapper)
 #endif
 #if PLATFORM(MAC)
@@ -86,7 +89,7 @@
 #if PLATFORM(MAC)
     delete m_cachedConverterTEC;
 #endif
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
     delete m_cachedConverterICU;
 #endif
 
@@ -94,7 +97,12 @@
     delete m_atomicStringTable;
     delete m_threadTimers;
 
-    ASSERT(isMainThread() || m_emptyString->hasOneRef()); // We intentionally don't clean up static data on application quit, so there will be many strings remaining on the main thread.
+    // Using member variable m_isMainThread instead of calling WTF::isMainThread() directly
+    // to avoid issues described in https://bugs.webkit.org/show_bug.cgi?id=25973.
+    // In short, some pthread-based platforms and ports can not use WTF::CurrentThread() and WTF::isMainThread()
+    // in destructors of thread-specific data.
+    ASSERT(m_isMainThread || m_emptyString->hasOneRef()); // We intentionally don't clean up static data on application quit, so there will be many strings remaining on the main thread.
+
     delete m_emptyString;
 }
 
diff --git a/WebCore/platform/ThreadGlobalData.h b/WebCore/platform/ThreadGlobalData.h
index 7faca36..e0aa092 100644
--- a/WebCore/platform/ThreadGlobalData.h
+++ b/WebCore/platform/ThreadGlobalData.h
@@ -48,7 +48,7 @@
         HashSet<StringImpl*>& atomicStringTable() { return *m_atomicStringTable; }
         ThreadTimers& threadTimers() { return *m_threadTimers; }
 
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
         ICUConverterWrapper& cachedConverterICU() { return *m_cachedConverterICU; }
 #endif
 
@@ -62,7 +62,11 @@
         EventNames* m_eventNames;
         ThreadTimers* m_threadTimers;
 
-#if USE(ICU_UNICODE)
+#ifndef NDEBUG
+        bool m_isMainThread;
+#endif
+
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
         ICUConverterWrapper* m_cachedConverterICU;
 #endif
 
diff --git a/WebCore/platform/Timer.cpp b/WebCore/platform/Timer.cpp
index 353a2a7..d4235d9 100644
--- a/WebCore/platform/Timer.cpp
+++ b/WebCore/platform/Timer.cpp
@@ -169,6 +169,9 @@
     : m_nextFireTime(0)
     , m_repeatInterval(0)
     , m_heapIndex(-1)
+#ifndef NDEBUG
+    , m_thread(currentThread())
+#endif
 {
 }
 
@@ -180,12 +183,16 @@
 
 void TimerBase::start(double nextFireInterval, double repeatInterval)
 {
+    ASSERT(m_thread == currentThread());
+
     m_repeatInterval = repeatInterval;
     setNextFireTime(currentTime() + nextFireInterval);
 }
 
 void TimerBase::stop()
 {
+    ASSERT(m_thread == currentThread());
+
     m_repeatInterval = 0;
     setNextFireTime(0);
 
@@ -196,6 +203,8 @@
 
 bool TimerBase::isActive() const
 {
+    ASSERT(m_thread == currentThread());
+
     return m_nextFireTime || timersReadyToFire().contains(this);
 }
 
@@ -284,6 +293,8 @@
 
 void TimerBase::setNextFireTime(double newTime)
 {
+    ASSERT(m_thread == currentThread());
+
     // Keep heap valid while changing the next-fire time.
 
     timersReadyToFire().remove(this);
diff --git a/WebCore/platform/Timer.h b/WebCore/platform/Timer.h
index aab52c2..8723515 100644
--- a/WebCore/platform/Timer.h
+++ b/WebCore/platform/Timer.h
@@ -27,6 +27,7 @@
 #define Timer_h
 
 #include <wtf/Noncopyable.h>
+#include <wtf/Threading.h>
 
 namespace WebCore {
 
@@ -77,6 +78,10 @@
     int m_heapIndex; // -1 if not in heap
     unsigned m_heapInsertionOrder; // Used to keep order among equal-fire-time timers
 
+#ifndef NDEBUG
+    ThreadIdentifier m_thread;
+#endif
+
     friend class TimerHeapElement;
     friend class ThreadTimers;
     friend bool operator<(const TimerHeapElement&, const TimerHeapElement&);
diff --git a/WebCore/platform/Widget.h b/WebCore/platform/Widget.h
index 459d615..50d17b2 100644
--- a/WebCore/platform/Widget.h
+++ b/WebCore/platform/Widget.h
@@ -155,6 +155,7 @@
 
     virtual bool isFrameView() const { return false; }
     virtual bool isPluginView() const { return false; }
+    virtual bool isScrollbar() const { return false; }
 
     void removeFromParent();
     virtual void setParent(ScrollView* view);
diff --git a/WebCore/platform/android/RenderThemeAndroid.cpp b/WebCore/platform/android/RenderThemeAndroid.cpp
index a1e8bf6..3910b7a 100644
--- a/WebCore/platform/android/RenderThemeAndroid.cpp
+++ b/WebCore/platform/android/RenderThemeAndroid.cpp
@@ -27,7 +27,6 @@
 #include "RenderThemeAndroid.h"
 
 #include "Color.h"
-#include "FormControlElement.h"
 #include "GraphicsContext.h"
 #include "PlatformGraphicsContext.h"
 #include "RenderSkinAndroid.h"
@@ -181,8 +180,8 @@
 {
     // If it is a disabled button, simply paint it to the master picture.
     Node* node = obj->node();
-    FormControlElement* formControlElement = toFormControlElement(static_cast<Element*>(node));
-    if (formControlElement && !formControlElement->isEnabled())
+    if (node && node->isElementNode() &&
+        static_cast<Element*>(node)->isEnabledFormControl())
         RenderSkinButton::Draw(getCanvasFromInfo(info), rect, RenderSkinAndroid::kDisabled);
     else
         // Store all the important information in the platform context.
@@ -255,10 +254,7 @@
     style->setPaddingRight(Length(RenderSkinCombo::extraWidth(), Fixed));
     // Code copied from RenderThemeMac.mm
     // Makes sure that the text shows up on our treatment
-    bool isEnabled = true;
-    if (FormControlElement* formControlElement = toFormControlElement(e))
-        isEnabled = formControlElement->isEnabled();
-    style->setColor(isEnabled ? Color::black : Color::darkGray);
+    style->setColor(e->isEnabledFormControl() ? Color::black : Color::darkGray);
 }
 
 void RenderThemeAndroid::adjustMenuListStyle(CSSStyleSelector*, RenderStyle* style, Element* e) const
diff --git a/WebCore/platform/android/TemporaryLinkStubs.cpp b/WebCore/platform/android/TemporaryLinkStubs.cpp
index 446b078..395d18b 100644
--- a/WebCore/platform/android/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/android/TemporaryLinkStubs.cpp
@@ -59,6 +59,7 @@
 #include "Icon.h"
 #include "IconDatabase.h"
 #include "IconLoader.h"
+#include "InspectorFrontend.h"
 #include "IntPoint.h"
 
 #if USE(JSC)
@@ -470,7 +471,7 @@
 #if USE(JSC)
 namespace JSC { namespace Bindings {
 bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, 
-        jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValuePtr& exceptionDescription)
+        jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription)
 {
     notImplemented();
     return false;
@@ -555,6 +556,11 @@
     notImplemented();
 }
 
+InspectorFrontend::~InspectorFrontend()
+{
+    notImplemented();
+}
+
 #if USE(JSC)
 using namespace JSC;
 
@@ -571,15 +577,9 @@
 
 // as we don't use inspector/*.cpp, add stub here.
 
+/*
 namespace WebCore {
-
-JSValuePtr toJS(ExecState*, Profile*)
-{
-    notImplemented();
-    return jsNull();
-}
-
-JSValuePtr JavaScriptCallFrame::evaluate(const UString& script, JSValuePtr& exception) const
+JSValue JavaScriptCallFrame::evaluate(const UString& script, JSValue& exception) const
 {
     notImplemented();
     return jsNull();
@@ -679,4 +679,5 @@
 {
     notImplemented();
 }
+*/
 #endif
diff --git a/WebCore/platform/cf/BinaryPropertyList.cpp b/WebCore/platform/cf/BinaryPropertyList.cpp
new file mode 100644
index 0000000..c0fda3d
--- /dev/null
+++ b/WebCore/platform/cf/BinaryPropertyList.cpp
@@ -0,0 +1,831 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "BinaryPropertyList.h"
+
+#include "StringHash.h"
+#include <wtf/HashSet.h>
+#include <limits>
+
+using namespace std;
+
+namespace WebCore {
+
+static const size_t headerSize = 8;
+static const size_t trailerSize = 32;
+
+static const UInt8 booleanTrueMarkerByte = 0x09;
+static const UInt8 oneByteIntegerMarkerByte = 0x10;
+static const UInt8 twoByteIntegerMarkerByte = 0x11;
+static const UInt8 fourByteIntegerMarkerByte = 0x12;
+static const UInt8 eightByteIntegerMarkerByte = 0x13;
+static const UInt8 asciiStringMarkerByte = 0x50;
+static const UInt8 asciiStringWithSeparateLengthMarkerByte = 0x5F;
+static const UInt8 unicodeStringMarkerByte = 0x60;
+static const UInt8 unicodeStringWithSeparateLengthMarkerByte = 0x6F;
+static const UInt8 arrayMarkerByte = 0xA0;
+static const UInt8 arrayWithSeparateLengthMarkerByte = 0xAF;
+static const UInt8 dictionaryMarkerByte = 0xD0;
+static const UInt8 dictionaryWithSeparateLengthMarkerByte = 0xDF;
+static const size_t maxLengthInMarkerByte = 0xE;
+
+class IntegerArray {
+public:
+    IntegerArray() : m_integers(0), m_size(0) { }
+    IntegerArray(const int* integers, size_t size) : m_integers(integers), m_size(size) { ASSERT(integers); ASSERT(size); }
+
+    void markDeleted() { m_integers = 0; m_size = deletedValueSize(); }
+    bool isDeletedValue() const { return m_size == deletedValueSize(); }
+
+    const int* integers() const { ASSERT(!isDeletedValue()); return m_integers; }
+    size_t size() const { ASSERT(!isDeletedValue()); return m_size; }
+
+private:
+    static size_t deletedValueSize() { return numeric_limits<size_t>::max(); }
+
+    friend bool operator==(const IntegerArray&, const IntegerArray&);
+
+    const int* m_integers;
+    size_t m_size;
+};
+
+inline bool operator==(const IntegerArray& a, const IntegerArray& b)
+{
+    return a.m_integers == b.m_integers &&  a.m_size == b.m_size;
+}
+
+struct IntegerArrayHashTraits : WTF::GenericHashTraits<IntegerArray> {
+    static const bool needsDestruction = false;
+    static void constructDeletedValue(IntegerArray& slot) { slot.markDeleted(); }
+    static bool isDeletedValue(const IntegerArray& array) { return array.isDeletedValue(); }
+};
+
+struct IntegerArrayHash {
+    static unsigned hash(const IntegerArray&);
+    static bool equal(const IntegerArray&, const IntegerArray&);
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+unsigned IntegerArrayHash::hash(const IntegerArray& array)
+{
+    return StringImpl::computeHash(reinterpret_cast<const UChar*>(array.integers()), array.size() / (sizeof(int) / sizeof(UChar)));
+}
+
+bool IntegerArrayHash::equal(const IntegerArray& a, const IntegerArray& b)
+{
+    if (a.isDeletedValue() || b.isDeletedValue())
+        return a.isDeletedValue() == b.isDeletedValue();
+    if (a.size() != b.size())
+        return false;
+    for (size_t i = 0; i < a.size(); ++i) {
+        if (a.integers()[i] != b.integers()[i])
+            return false;
+    }
+    return true;
+}
+
+typedef size_t ObjectReference;
+
+class BinaryPropertyListPlan : private BinaryPropertyListObjectStream {
+public:
+    BinaryPropertyListPlan(BinaryPropertyListWriter&);
+
+    ObjectReference booleanTrueObjectReference() const;
+    ObjectReference integerObjectReference(int) const;
+    ObjectReference stringObjectReference(const String&) const;
+    ObjectReference integerArrayObjectReference(const int*, size_t) const;
+
+    ObjectReference objectCount() const { return m_currentObjectReference; }
+
+    ObjectReference byteCount() const { return m_byteCount; }
+    ObjectReference objectReferenceCount() const { return m_objectReferenceCount; }
+
+private:
+    virtual void writeBooleanTrue();
+    virtual void writeInteger(int);
+    virtual void writeString(const String&);
+    virtual void writeIntegerArray(const int*, size_t);
+    virtual void writeUniqueString(const String&);
+    virtual void writeUniqueString(const char*);
+    virtual size_t writeArrayStart();
+    virtual void writeArrayEnd(size_t);
+    virtual size_t writeDictionaryStart();
+    virtual void writeDictionaryEnd(size_t);
+
+    void writeArrayObject(size_t);
+    void writeDictionaryObject(size_t);
+    void writeStringObject(const String&);
+    void writeStringObject(const char*);
+
+    static ObjectReference invalidObjectReference() { return numeric_limits<ObjectReference>::max(); }
+
+    typedef HashMap<IntegerArray, ObjectReference, IntegerArrayHash, IntegerArrayHashTraits> IntegerArrayMap;
+
+    ObjectReference m_booleanTrueObjectReference;
+    ObjectReference m_integerZeroObjectReference;
+    HashMap<int, ObjectReference> m_integers;
+    HashMap<String, ObjectReference> m_strings;
+    IntegerArrayMap m_integerArrays;
+
+    ObjectReference m_currentObjectReference;
+
+    size_t m_currentAggregateSize;
+
+    size_t m_byteCount;
+    size_t m_objectReferenceCount;
+};
+
+BinaryPropertyListPlan::BinaryPropertyListPlan(BinaryPropertyListWriter& client)
+    : m_booleanTrueObjectReference(invalidObjectReference())
+    , m_integerZeroObjectReference(invalidObjectReference())
+    , m_currentObjectReference(0)
+    , m_currentAggregateSize(0)
+    , m_byteCount(0)
+    , m_objectReferenceCount(0)
+{
+    client.writeObjects(*this);
+    ASSERT(m_currentAggregateSize == 1);
+}
+
+void BinaryPropertyListPlan::writeBooleanTrue()
+{
+    ++m_currentAggregateSize;
+    if (m_booleanTrueObjectReference != invalidObjectReference())
+        return;
+    m_booleanTrueObjectReference = m_currentObjectReference++;
+    ++m_byteCount;
+}
+
+static inline int integerByteCount(size_t integer)
+{
+    if (integer <= 0xFF)
+        return 2;
+    if (integer <= 0xFFFF)
+        return 3;
+#ifdef __LP64__
+    if (integer <= 0xFFFFFFFFULL)
+        return 5;
+    return 9;
+#else
+    return 5;
+#endif
+}
+
+void BinaryPropertyListPlan::writeInteger(int integer)
+{
+    ASSERT(integer >= 0);
+    ++m_currentAggregateSize;
+    if (!integer) {
+        if (m_integerZeroObjectReference != invalidObjectReference())
+            return;
+        m_integerZeroObjectReference = m_currentObjectReference;
+    } else {
+        if (!m_integers.add(integer, m_currentObjectReference).second)
+            return;
+    }
+    ++m_currentObjectReference;
+    m_byteCount += integerByteCount(integer);
+}
+
+void BinaryPropertyListPlan::writeString(const String& string)
+{
+    ++m_currentAggregateSize;
+    if (!m_strings.add(string, m_currentObjectReference).second)
+        return;
+    ++m_currentObjectReference;
+    writeStringObject(string);
+}
+
+void BinaryPropertyListPlan::writeIntegerArray(const int* integers, size_t size)
+{
+    size_t savedAggregateSize = ++m_currentAggregateSize;
+    ASSERT(size);
+    pair<IntegerArrayMap::iterator, bool> addResult = m_integerArrays.add(IntegerArray(integers, size), 0);
+    if (!addResult.second)
+        return;
+    for (size_t i = 0; i < size; ++i)
+        writeInteger(integers[i]);
+    addResult.first->second = m_currentObjectReference++;
+    writeArrayObject(size);
+    m_currentAggregateSize = savedAggregateSize;
+}
+
+void BinaryPropertyListPlan::writeUniqueString(const String& string)
+{
+    ++m_currentAggregateSize;
+    ++m_currentObjectReference;
+    writeStringObject(string);
+}
+
+void BinaryPropertyListPlan::writeUniqueString(const char* string)
+{
+    ++m_currentAggregateSize;
+    ++m_currentObjectReference;
+    writeStringObject(string);
+}
+
+size_t BinaryPropertyListPlan::writeArrayStart()
+{
+    size_t savedAggregateSize = m_currentAggregateSize;
+    m_currentAggregateSize = 0;
+    return savedAggregateSize;
+}
+
+void BinaryPropertyListPlan::writeArrayEnd(size_t savedAggregateSize)
+{
+    ++m_currentObjectReference;
+    writeArrayObject(m_currentAggregateSize);
+    m_currentAggregateSize = savedAggregateSize + 1;
+}
+
+size_t BinaryPropertyListPlan::writeDictionaryStart()
+{
+    size_t savedAggregateSize = m_currentAggregateSize;
+    m_currentAggregateSize = 0;
+    return savedAggregateSize;
+}
+
+void BinaryPropertyListPlan::writeDictionaryEnd(size_t savedAggregateSize)
+{
+    ++m_currentObjectReference;
+    writeDictionaryObject(m_currentAggregateSize);
+    m_currentAggregateSize = savedAggregateSize + 1;
+}
+
+static size_t markerPlusLengthByteCount(size_t length)
+{
+    if (length <= maxLengthInMarkerByte)
+        return 1;
+    return 1 + integerByteCount(length);
+}
+
+void BinaryPropertyListPlan::writeStringObject(const String& string)
+{
+    const UChar* characters = string.characters();
+    unsigned length = string.length();
+    m_byteCount += markerPlusLengthByteCount(length) + length;
+    if (!charactersAreAllASCII(characters, length))
+        m_byteCount += length;
+}
+
+void BinaryPropertyListPlan::writeStringObject(const char* string)
+{
+    unsigned length = strlen(string);
+    m_byteCount += markerPlusLengthByteCount(length) + length;
+}
+
+void BinaryPropertyListPlan::writeArrayObject(size_t size)
+{
+    ASSERT(size);
+    m_byteCount += markerPlusLengthByteCount(size);
+    m_objectReferenceCount += size;
+}
+
+void BinaryPropertyListPlan::writeDictionaryObject(size_t size)
+{
+    ASSERT(size);
+    ASSERT(!(size & 1));
+    m_byteCount += markerPlusLengthByteCount(size / 2);
+    m_objectReferenceCount += size;
+}
+
+ObjectReference BinaryPropertyListPlan::booleanTrueObjectReference() const
+{
+    ASSERT(m_booleanTrueObjectReference != invalidObjectReference());
+    return m_booleanTrueObjectReference;
+}
+
+ObjectReference BinaryPropertyListPlan::integerObjectReference(int integer) const
+{
+    ASSERT(integer >= 0);
+    if (!integer) {
+        ASSERT(m_integerZeroObjectReference != invalidObjectReference());
+        return m_integerZeroObjectReference;
+    }
+    ASSERT(m_integers.contains(integer));
+    return m_integers.get(integer);
+}
+
+ObjectReference BinaryPropertyListPlan::stringObjectReference(const String& string) const
+{
+    ASSERT(m_strings.contains(string));
+    return m_strings.get(string);
+}
+
+ObjectReference BinaryPropertyListPlan::integerArrayObjectReference(const int* integers, size_t size) const
+{
+    ASSERT(m_integerArrays.contains(IntegerArray(integers, size)));
+    return m_integerArrays.get(IntegerArray(integers, size));
+}
+
+class BinaryPropertyListSerializer : private BinaryPropertyListObjectStream {
+public:
+    BinaryPropertyListSerializer(BinaryPropertyListWriter&);
+
+private:
+    virtual void writeBooleanTrue();
+    virtual void writeInteger(int);
+    virtual void writeString(const String&);
+    virtual void writeIntegerArray(const int*, size_t);
+    virtual void writeUniqueString(const String&);
+    virtual void writeUniqueString(const char*);
+    virtual size_t writeArrayStart();
+    virtual void writeArrayEnd(size_t);
+    virtual size_t writeDictionaryStart();
+    virtual void writeDictionaryEnd(size_t);
+
+    ObjectReference writeIntegerWithoutAddingAggregateObjectReference(int);
+
+    void appendIntegerObject(int);
+    void appendStringObject(const String&);
+    void appendStringObject(const char*);
+    void appendIntegerArrayObject(const int*, size_t);
+
+    void appendByte(unsigned char);
+    void appendByte(unsigned);
+    void appendByte(unsigned long);
+    void appendByte(int);
+
+    void appendInteger(size_t);
+
+    void appendObjectReference(ObjectReference);
+
+    void addAggregateObjectReference(ObjectReference);
+
+    void startObject();
+
+    const BinaryPropertyListPlan m_plan;
+    const int m_objectReferenceSize;
+    const size_t m_offsetTableStart;
+    const int m_offsetSize;
+    const size_t m_bufferSize;
+    UInt8* const m_buffer;
+
+    UInt8* m_currentByte;
+    ObjectReference m_currentObjectReference;
+    UInt8* m_currentAggregateBufferByte;
+};
+
+inline void BinaryPropertyListSerializer::appendByte(unsigned char byte)
+{
+    *m_currentByte++ = byte;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+}
+
+inline void BinaryPropertyListSerializer::appendByte(unsigned byte)
+{
+    *m_currentByte++ = byte;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+}
+
+inline void BinaryPropertyListSerializer::appendByte(unsigned long byte)
+{
+    *m_currentByte++ = byte;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+}
+
+inline void BinaryPropertyListSerializer::appendByte(int byte)
+{
+    *m_currentByte++ = byte;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+}
+
+static int bytesNeeded(size_t count)
+{
+    ASSERT(count);
+    int bytesNeeded = 1;
+    for (size_t mask = numeric_limits<size_t>::max() << 8; count & mask; mask <<= 8)
+        ++bytesNeeded;
+    return bytesNeeded;
+}
+
+static inline void storeLength(UInt8* destination, size_t length)
+{
+#ifdef __LP64__
+    destination[0] = length >> 56;
+    destination[1] = length >> 48;
+    destination[2] = length >> 40;
+    destination[3] = length >> 32;
+#else
+    destination[0] = 0;
+    destination[1] = 0;
+    destination[2] = 0;
+    destination[3] = 0;
+#endif
+    destination[4] = length >> 24;
+    destination[5] = length >> 16;
+    destination[6] = length >> 8;
+    destination[7] = length;
+}
+
+// Like memmove, but reverses the bytes.
+static void moveAndReverseBytes(UInt8* destination, const UInt8* source, size_t length)
+{
+    ASSERT(length);
+    memmove(destination, source, length);
+    UInt8* start = destination;
+    UInt8* end = destination + length;
+    while (end - start > 1)
+        std::swap(*start++, *--end);
+}
+
+// The serializer uses a single buffer for the property list.
+// The buffer contains:
+//
+//    8-byte header
+//    object data
+//    offset table
+//    32-byte trailer
+//
+// While serializing object, the offset table entry for each object is written just before
+// the object data for that object is written. Aggregates, arrays and dictionaries, are a
+// special case. The objects that go into an aggregate are written before the aggregate is.
+// As each object is written, the object reference is put in the aggregate buffer. Then,
+// when the aggregate is written, the aggregate buffer is copied into place in the object
+// data. Finally, the header and trailer are written.
+//
+// The aggregate buffer shares space with the object data, like this:
+//
+//    8-byte header
+//    object data
+//    >>> aggregate buffer <<<
+//    offset table
+//    32-byte trailer
+//
+// To make it easy to build it incrementally, the buffer starts at the end of the object
+// data space, and grows backwards. We're guaranteed the aggregate buffer will never collide
+// with the object data pointer because we know that the object data is correctly sized
+// based on our plan, and all the data in the aggregate buffer will be used to create the
+// actual aggregate objects; in the worst case the aggregate buffer will already be in
+// exactly the right place, but backwards.
+
+BinaryPropertyListSerializer::BinaryPropertyListSerializer(BinaryPropertyListWriter& client)
+    : m_plan(client)
+    , m_objectReferenceSize(bytesNeeded(m_plan.objectCount()))
+    , m_offsetTableStart(headerSize + m_plan.byteCount() + m_plan.objectReferenceCount() * m_objectReferenceSize)
+    , m_offsetSize(bytesNeeded(m_offsetTableStart))
+    , m_bufferSize(m_offsetTableStart + m_plan.objectCount() * m_offsetSize + trailerSize)
+    , m_buffer(client.buffer(m_bufferSize))
+    , m_currentObjectReference(0)
+{
+    ASSERT(m_objectReferenceSize > 0);
+    ASSERT(m_offsetSize > 0);
+
+#ifdef __LP64__
+    ASSERT(m_objectReferenceSize <= 8);
+    ASSERT(m_offsetSize <= 8);
+#else
+    ASSERT(m_objectReferenceSize <= 4);
+    ASSERT(m_offsetSize <= 4);
+#endif
+
+    if (!m_buffer)
+        return;
+
+    // Write objects and offset table.
+    m_currentByte = m_buffer + headerSize;
+    m_currentAggregateBufferByte = m_buffer + m_offsetTableStart;
+    client.writeObjects(*this);
+    ASSERT(m_currentObjectReference == m_plan.objectCount());
+    ASSERT(m_currentAggregateBufferByte == m_buffer + m_offsetTableStart);
+    ASSERT(m_currentByte == m_buffer + m_offsetTableStart);
+
+    // Write header.
+    memcpy(m_buffer, "bplist00", headerSize);
+
+    // Write trailer.
+    UInt8* trailer = m_buffer + m_bufferSize - trailerSize;
+    memset(trailer, 0, 6);
+    trailer[6] = m_offsetSize;
+    trailer[7] = m_objectReferenceSize;
+    storeLength(trailer + 8, m_plan.objectCount());
+    storeLength(trailer + 16, m_plan.objectCount() - 1);
+    storeLength(trailer + 24, m_offsetTableStart);
+}
+
+void BinaryPropertyListSerializer::writeBooleanTrue()
+{
+    ObjectReference reference = m_plan.booleanTrueObjectReference();
+    if (m_currentObjectReference != reference)
+        ASSERT(reference < m_currentObjectReference);
+    else {
+        startObject();
+        appendByte(booleanTrueMarkerByte);
+    }
+    addAggregateObjectReference(reference);
+}
+
+inline ObjectReference BinaryPropertyListSerializer::writeIntegerWithoutAddingAggregateObjectReference(int integer)
+{
+    ObjectReference reference = m_plan.integerObjectReference(integer);
+    if (m_currentObjectReference != reference)
+        ASSERT(reference < m_currentObjectReference);
+    else
+        appendIntegerObject(integer);
+    return reference;
+}
+
+void BinaryPropertyListSerializer::writeInteger(int integer)
+{
+    addAggregateObjectReference(writeIntegerWithoutAddingAggregateObjectReference(integer));
+}
+
+void BinaryPropertyListSerializer::writeString(const String& string)
+{
+    ObjectReference reference = m_plan.stringObjectReference(string);
+    if (m_currentObjectReference != reference)
+        ASSERT(reference < m_currentObjectReference);
+    else
+        appendStringObject(string);
+    addAggregateObjectReference(reference);
+}
+
+void BinaryPropertyListSerializer::writeIntegerArray(const int* integers, size_t size)
+{
+    ObjectReference reference = m_plan.integerArrayObjectReference(integers, size);
+    for (size_t i = 0; i < size; ++i)
+        writeIntegerWithoutAddingAggregateObjectReference(integers[i]);
+    if (m_currentObjectReference != reference)
+        ASSERT(reference < m_currentObjectReference);
+    else
+        appendIntegerArrayObject(integers, size);
+    addAggregateObjectReference(reference);
+}
+
+void BinaryPropertyListSerializer::writeUniqueString(const char* string)
+{
+    addAggregateObjectReference(m_currentObjectReference);
+    appendStringObject(string);
+}
+
+void BinaryPropertyListSerializer::writeUniqueString(const String& string)
+{
+    addAggregateObjectReference(m_currentObjectReference);
+    appendStringObject(string);
+}
+
+size_t BinaryPropertyListSerializer::writeArrayStart()
+{
+    return m_currentAggregateBufferByte - m_buffer;
+}
+
+void BinaryPropertyListSerializer::writeArrayEnd(size_t savedAggregateBufferOffset)
+{
+    ObjectReference reference = m_currentObjectReference;
+    startObject();
+    size_t aggregateBufferByteCount = savedAggregateBufferOffset - (m_currentAggregateBufferByte - m_buffer);
+    ASSERT(aggregateBufferByteCount);
+    ASSERT(!(aggregateBufferByteCount % m_objectReferenceSize));
+    size_t size = aggregateBufferByteCount / m_objectReferenceSize;
+    if (size <= maxLengthInMarkerByte)
+        appendByte(arrayMarkerByte | size);
+    else {
+        appendByte(arrayWithSeparateLengthMarkerByte);
+        appendInteger(size);
+    }
+    m_currentAggregateBufferByte = m_buffer + savedAggregateBufferOffset;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+    moveAndReverseBytes(m_currentByte, m_currentAggregateBufferByte - aggregateBufferByteCount, aggregateBufferByteCount);
+    m_currentByte += aggregateBufferByteCount;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+    if (m_currentObjectReference < m_plan.objectCount())
+        addAggregateObjectReference(reference);
+    else
+        ASSERT(m_currentObjectReference == m_plan.objectCount());
+}
+
+size_t BinaryPropertyListSerializer::writeDictionaryStart()
+{
+    return m_currentAggregateBufferByte - m_buffer;
+}
+
+void BinaryPropertyListSerializer::writeDictionaryEnd(size_t savedAggregateBufferOffset)
+{
+    ObjectReference reference = m_currentObjectReference;
+    startObject();
+    size_t aggregateBufferByteCount = savedAggregateBufferOffset - (m_currentAggregateBufferByte - m_buffer);
+    ASSERT(aggregateBufferByteCount);
+    ASSERT(!(aggregateBufferByteCount % (m_objectReferenceSize * 2)));
+    size_t size = aggregateBufferByteCount / (m_objectReferenceSize * 2);
+    if (size <= maxLengthInMarkerByte)
+        appendByte(dictionaryMarkerByte | size);
+    else {
+        appendByte(dictionaryWithSeparateLengthMarkerByte);
+        appendInteger(size);
+    }
+    m_currentAggregateBufferByte = m_buffer + savedAggregateBufferOffset;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+    moveAndReverseBytes(m_currentByte, m_currentAggregateBufferByte - aggregateBufferByteCount, aggregateBufferByteCount);
+    m_currentByte += aggregateBufferByteCount;
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+    if (m_currentObjectReference != m_plan.objectCount())
+        addAggregateObjectReference(reference);
+    else
+        ASSERT(m_currentObjectReference == m_plan.objectCount());
+}
+
+void BinaryPropertyListSerializer::appendIntegerObject(int integer)
+{
+    startObject();
+    ASSERT(integer >= 0);
+    appendInteger(integer);
+}
+
+void BinaryPropertyListSerializer::appendInteger(size_t integer)
+{
+    if (integer <= 0xFF) {
+        appendByte(oneByteIntegerMarkerByte);
+        appendByte(integer);
+        return;
+    }
+    if (integer <= 0xFFFF) {
+        appendByte(twoByteIntegerMarkerByte);
+        appendByte(integer >> 8);
+        appendByte(integer);
+        return;
+    }
+#ifdef __LP64__
+    if (integer <= 0xFFFFFFFFULL) {
+#endif
+        appendByte(fourByteIntegerMarkerByte);
+        appendByte(integer >> 24);
+        appendByte(integer >> 16);
+        appendByte(integer >> 8);
+        appendByte(integer);
+#ifdef __LP64__
+        return;
+    }
+    appendByte(eightByteIntegerMarkerByte);
+    appendByte(integer >> 56);
+    appendByte(integer >> 48);
+    appendByte(integer >> 40);
+    appendByte(integer >> 32);
+    appendByte(integer >> 24);
+    appendByte(integer >> 16);
+    appendByte(integer >> 8);
+    appendByte(integer);
+#endif
+}
+
+void BinaryPropertyListSerializer::appendStringObject(const String& string)
+{
+    startObject();
+    const UChar* characters = string.characters();
+    unsigned length = string.length();
+    if (charactersAreAllASCII(characters, length)) {
+        if (length <= maxLengthInMarkerByte)
+            appendByte(asciiStringMarkerByte | length);
+        else {
+            appendByte(asciiStringWithSeparateLengthMarkerByte);
+            appendInteger(length);
+        }
+        for (unsigned i = 0; i < length; ++i)
+            appendByte(characters[i]);
+    } else {
+        if (length <= maxLengthInMarkerByte)
+            appendByte(unicodeStringMarkerByte | length);
+        else {
+            appendByte(unicodeStringWithSeparateLengthMarkerByte);
+            appendInteger(length);
+        }
+        for (unsigned i = 0; i < length; ++i) {
+            appendByte(characters[i] >> 8);
+            appendByte(characters[i]);
+        }
+    }
+}
+
+void BinaryPropertyListSerializer::appendStringObject(const char* string)
+{
+    startObject();
+    unsigned length = strlen(string);
+    if (length <= maxLengthInMarkerByte)
+        appendByte(asciiStringMarkerByte | length);
+    else {
+        appendByte(asciiStringWithSeparateLengthMarkerByte);
+        appendInteger(length);
+    }
+    for (unsigned i = 0; i < length; ++i)
+        appendByte(string[i]);
+}
+
+void BinaryPropertyListSerializer::appendIntegerArrayObject(const int* integers, size_t size)
+{
+    startObject();
+    if (size <= maxLengthInMarkerByte)
+        appendByte(arrayMarkerByte | size);
+    else {
+        appendByte(arrayWithSeparateLengthMarkerByte);
+        appendInteger(size);
+    }
+    for (unsigned i = 0; i < size; ++i)
+        appendObjectReference(m_plan.integerObjectReference(integers[i]));
+}
+
+void BinaryPropertyListSerializer::appendObjectReference(ObjectReference reference)
+{
+    switch (m_objectReferenceSize) {
+#ifdef __LP64__
+        case 8:
+            appendByte(reference >> 56);
+        case 7:
+            appendByte(reference >> 48);
+        case 6:
+            appendByte(reference >> 40);
+        case 5:
+            appendByte(reference >> 32);
+#endif
+        case 4:
+            appendByte(reference >> 24);
+        case 3:
+            appendByte(reference >> 16);
+        case 2:
+            appendByte(reference >> 8);
+        case 1:
+            appendByte(reference);
+    }
+}
+
+void BinaryPropertyListSerializer::startObject()
+{
+    ObjectReference reference = m_currentObjectReference++;
+
+    size_t offset = m_currentByte - m_buffer;
+
+    UInt8* offsetTableEntry = m_buffer + m_offsetTableStart + reference * m_offsetSize + m_offsetSize;
+    switch (m_offsetSize) {
+#ifdef __LP64__
+        case 8:
+            offsetTableEntry[-8] = offset >> 56;
+        case 7:
+            offsetTableEntry[-7] = offset >> 48;
+        case 6:
+            offsetTableEntry[-6] = offset >> 40;
+        case 5:
+            offsetTableEntry[-5] = offset >> 32;
+#endif
+        case 4:
+            offsetTableEntry[-4] = offset >> 24;
+        case 3:
+            offsetTableEntry[-3] = offset >> 16;
+        case 2:
+            offsetTableEntry[-2] = offset >> 8;
+        case 1:
+            offsetTableEntry[-1] = offset;
+    }
+}
+
+void BinaryPropertyListSerializer::addAggregateObjectReference(ObjectReference reference)
+{
+    switch (m_objectReferenceSize) {
+#ifdef __LP64__
+        case 8:
+            *--m_currentAggregateBufferByte = reference >> 56;
+        case 7:
+            *--m_currentAggregateBufferByte = reference >> 48;
+        case 6:
+            *--m_currentAggregateBufferByte = reference >> 40;
+        case 5:
+            *--m_currentAggregateBufferByte = reference >> 32;
+#endif
+        case 4:
+            *--m_currentAggregateBufferByte = reference >> 24;
+        case 3:
+            *--m_currentAggregateBufferByte = reference >> 16;
+        case 2:
+            *--m_currentAggregateBufferByte = reference >> 8;
+        case 1:
+            *--m_currentAggregateBufferByte = reference;
+    }
+    ASSERT(m_currentByte <= m_currentAggregateBufferByte);
+}
+
+void BinaryPropertyListWriter::writePropertyList()
+{
+    BinaryPropertyListSerializer(*this);
+}
+
+}
diff --git a/WebCore/platform/cf/BinaryPropertyList.h b/WebCore/platform/cf/BinaryPropertyList.h
new file mode 100644
index 0000000..598aaa7
--- /dev/null
+++ b/WebCore/platform/cf/BinaryPropertyList.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef BinaryPropertyList_h
+#define BinaryPropertyList_h
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class String;
+
+// Writes a limited subset of binary property lists.
+// Covers only what's needed for writing browser history as of this writing.
+class BinaryPropertyListObjectStream {
+public:
+    // Call writeBooleanTrue to write the boolean true value.
+    // A single shared object will be used in the serialized list.
+    virtual void writeBooleanTrue() = 0;
+
+    // Call writeInteger to write an integer value.
+    // A single shared object will be used for each integer in the serialized list.
+    virtual void writeInteger(int) = 0;
+
+    // Call writeString to write a string value.
+    // A single shared object will be used for each string in the serialized list.
+    virtual void writeString(const String&) = 0;
+
+    // Call writeUniqueString instead of writeString when it's unlikely the
+    // string will be written twice in the same property list; this saves hash
+    // table overhead for such strings. A separate object will be used for each
+    // of these strings in the serialized list.
+    virtual void writeUniqueString(const String&) = 0;
+    virtual void writeUniqueString(const char*) = 0;
+
+    // Call writeIntegerArray instead of writeArrayStart/writeArrayEnd for
+    // arrays entirely composed of integers. A single shared object will be used
+    // for each identical array in the serialized list. Warning: The integer
+    // pointer must remain valid until the writeBinaryPropertyList function
+    // returns, because these lists are put into a hash table without copying
+    // them -- that's OK if the client already has a Vector<int>.
+    virtual void writeIntegerArray(const int*, size_t) = 0;
+
+    // After calling writeArrayStart, write array elements.
+    // Then call writeArrayEnd, passing in the result from writeArrayStart.
+    // A separate object will be used for each of these arrays in the serialized list.
+    virtual size_t writeArrayStart() = 0;
+    virtual void writeArrayEnd(size_t resultFromWriteArrayStart) = 0;
+
+    // After calling writeDictionaryStart, write all keys, then all values.
+    // Then call writeDictionaryEnd, passing in the result from writeDictionaryStart.
+    // A separate object will be used for each dictionary in the serialized list.
+    virtual size_t writeDictionaryStart() = 0;
+    virtual void writeDictionaryEnd(size_t resultFromWriteDictionaryStart) = 0;
+
+protected:
+    virtual ~BinaryPropertyListObjectStream() { }
+};
+
+class BinaryPropertyListWriter {
+public:
+    // Calls writeObjects once to prepare for writing and determine how big a
+    // buffer is required. Then calls buffer to get the appropriately-sized
+    // buffer, then calls writeObjects a second time and writes the property list.
+    void writePropertyList();
+
+protected:
+    virtual ~BinaryPropertyListWriter() { }
+
+private:
+    // Called by writePropertyList.
+    // Must call the object stream functions for the objects to be written
+    // into the property list.
+    virtual void writeObjects(BinaryPropertyListObjectStream&) = 0;
+
+    // Called by writePropertyList.
+    // Returns the buffer that the writer should write into.
+    virtual UInt8* buffer(size_t) = 0;
+
+    friend class BinaryPropertyListPlan;
+    friend class BinaryPropertyListSerializer;
+};
+
+}
+
+#endif
diff --git a/WebCore/platform/cf/SharedBufferCF.cpp b/WebCore/platform/cf/SharedBufferCF.cpp
index 7213c7e..26fc07f 100644
--- a/WebCore/platform/cf/SharedBufferCF.cpp
+++ b/WebCore/platform/cf/SharedBufferCF.cpp
@@ -51,6 +51,11 @@
 }
 #endif
 
+PassRefPtr<SharedBuffer> SharedBuffer::wrapCFData(CFDataRef data)
+{
+    return adoptRef(new SharedBuffer(data));
+}
+
 bool SharedBuffer::hasPlatformData() const
 {
     return m_cfData;
diff --git a/WebCore/platform/chromium/ChromiumBridge.h b/WebCore/platform/chromium/ChromiumBridge.h
index 3e5c404..75e9103 100644
--- a/WebCore/platform/chromium/ChromiumBridge.h
+++ b/WebCore/platform/chromium/ChromiumBridge.h
@@ -76,8 +76,8 @@
         static void clipboardWriteImage(const NativeImageSkia*, const KURL&, const String&);
 
         // Cookies ------------------------------------------------------------
-        static void setCookies(const KURL& url, const KURL& policyURL, const String& value);
-        static String cookies(const KURL& url, const KURL& policyURL);
+        static void setCookies(const KURL& url, const KURL& firstPartyForCookies, const String& value);
+        static String cookies(const KURL& url, const KURL& firstPartyForCookies);
 
         // DNS ----------------------------------------------------------------
         static void prefetchDNS(const String& hostname);
@@ -135,6 +135,9 @@
         static void decrementStatsCounter(const char* name);
         static void incrementStatsCounter(const char* name);
 
+        // Sudden Termination
+        static void suddenTerminationChanged(bool enabled);
+
         // SystemTime ---------------------------------------------------------
         static double currentTime();
 
diff --git a/WebCore/platform/chromium/ClipboardChromium.cpp b/WebCore/platform/chromium/ClipboardChromium.cpp
index b28503d..8f9ac7f 100644
--- a/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -35,8 +35,10 @@
 #include "Element.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "NamedAttrMap.h"
 #include "MIMETypeRegistry.h"
 #include "markup.h"
+#include "NamedNodeMap.h"
 #include "PlatformString.h"
 #include "Range.h"
 #include "RenderImage.h"
@@ -216,7 +218,7 @@
     markup.append("\"");
     // Copy over attributes.  If we are dragging an image, we expect things like
     // the id to be copied as well.
-    NamedAttrMap* attrs = element->attributes();
+    NamedNodeMap* attrs = element->attributes();
     unsigned length = attrs->length();
     for (unsigned i = 0; i < length; ++i) {
         Attribute* attr = attrs->attributeItem(i);
diff --git a/WebCore/platform/chromium/ClipboardChromium.h b/WebCore/platform/chromium/ClipboardChromium.h
index 53699da..0a83fd4 100644
--- a/WebCore/platform/chromium/ClipboardChromium.h
+++ b/WebCore/platform/chromium/ClipboardChromium.h
@@ -82,7 +82,6 @@
         void resetFromClipboard();
         void setDragImage(CachedImage*, Node*, const IntPoint&);
         RefPtr<ChromiumDataObject> m_dataObject;
-        Frame* m_frame;
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/KeyCodeConversionGtk.cpp b/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
index a3efe44..4fc7f32 100644
--- a/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
+++ b/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
@@ -150,9 +150,10 @@
     case GDK_Help:
         return VKEY_HELP; // (2F) HELP key
     case GDK_0:
-    case GDK_parenleft:
+    case GDK_parenright:
         return VKEY_0;    //  (30) 0) key
     case GDK_1:
+    case GDK_exclam:
         return VKEY_1; //  (31) 1 ! key
     case GDK_2:
     case GDK_at:
@@ -176,7 +177,7 @@
     case GDK_asterisk:
         return VKEY_8; //  (38) 8 key  '*'
     case GDK_9:
-    case GDK_parenright:
+    case GDK_parenleft:
         return VKEY_9; //  (39) 9 key '('
     case GDK_a:
     case GDK_A:
diff --git a/WebCore/platform/chromium/MimeTypeRegistryChromium.cpp b/WebCore/platform/chromium/MimeTypeRegistryChromium.cpp
index 1aac5ec..0f371b1 100644
--- a/WebCore/platform/chromium/MimeTypeRegistryChromium.cpp
+++ b/WebCore/platform/chromium/MimeTypeRegistryChromium.cpp
@@ -127,6 +127,11 @@
         || mimeType.startsWith("application/x-java-vm", false);
 }
 
+String MIMETypeRegistry::getMediaMIMETypeForExtension(const String&)
+{
+    return String();
+}
+
 static HashSet<String>& dummyHashSet()
 {
     ASSERT_NOT_REACHED();
diff --git a/WebCore/platform/chromium/PopupMenuChromium.cpp b/WebCore/platform/chromium/PopupMenuChromium.cpp
index 53f565a..1be075d 100644
--- a/WebCore/platform/chromium/PopupMenuChromium.cpp
+++ b/WebCore/platform/chromium/PopupMenuChromium.cpp
@@ -136,32 +136,26 @@
     // Returns whether the popup wants to process events for the passed key.
     bool isInterestedInEventForKey(int keyCode);
 
+    // Gets the height of a row.
+    int getRowHeight(int index);
+
+    // Returns true if the selection can be changed to index.
+    // Disabled items, or labels cannot be selected.
+    bool isSelectableItem(int index);
+
+    const Vector<PopupItem*>& items() const { return m_items; }
+
 private:
     friend class PopupContainer;
     friend class RefCounted<PopupListBox>;
 
-    // A type of List Item
-    enum ListItemType {
-        TypeOption,
-        TypeGroup,
-        TypeSeparator
-    };
-
-    // A item (represented by <option> or <optgroup>) in the <select> widget. 
-    struct ListItem {
-        ListItem(const String& label, ListItemType type)
-            : label(label.copy()), type(type), y(0) {}
-        String label;
-        ListItemType type;
-        int y;  // y offset of this item, relative to the top of the popup.
-    };
-
     PopupListBox(PopupMenuClient* client, const PopupContainerSettings& settings)
         : m_settings(settings)
         , m_originalIndex(0)
         , m_selectedIndex(0)
-        , m_willAcceptOnAbandon(false)
+        , m_acceptedIndexOnAbandon(-1)
         , m_visibleRows(0)
+        , m_baseWidth(0)
         , m_popupClient(client)
         , m_repeatingChar(0)
         , m_lastCharTime(0)
@@ -184,10 +178,6 @@
     // the web page, and closes the popup.
     void acceptIndex(int index);
 
-    // Returns true if the selection can be changed to index.
-    // Disabled items, or labels cannot be selected.
-    bool isSelectableItem(int index);
-
     // Clears the selection (so no row appears selected).
     void clearSelection();
 
@@ -198,8 +188,6 @@
     // Invalidates the row at the given index. 
     void invalidateRow(int index);
 
-    // Gets the height of a row.
-    int getRowHeight(int index);
     // Get the bounds of a row. 
     IntRect getRowBounds(int index);
 
@@ -235,11 +223,11 @@
     // enter yet however.
     int m_selectedIndex;
 
-    // True if we should accept the selectedIndex as chosen, even if the popup
-    // is "abandoned".  This is used for keyboard navigation, where we want the
+    // If >= 0, this is the index we should accept if the popup is "abandoned".
+    // This is used for keyboard navigation, where we want the
     // selection to change immediately, and is only used if the settings
     // acceptOnAbandon field is true.
-    bool m_willAcceptOnAbandon;
+    int m_acceptedIndexOnAbandon;
 
     // This is the number of rows visible in the popup. The maximum number visible at a time is
     // defined as being kMaxVisibleRows. For a scrolled popup, this can be thought of as the
@@ -250,7 +238,7 @@
     int m_baseWidth;
 
     // A list of the options contained within the <select>
-    Vector<ListItem*> m_items;
+    Vector<PopupItem*> m_items;
 
     // The <select> PopupMenuClient that opened us.
     PopupMenuClient* m_popupClient;
@@ -310,7 +298,8 @@
     return adoptRef(new PopupContainer(client, settings));
 }
 
-PopupContainer::PopupContainer(PopupMenuClient* client, const PopupContainerSettings& settings)
+PopupContainer::PopupContainer(PopupMenuClient* client,
+                               const PopupContainerSettings& settings)
     : m_listBox(PopupListBox::create(client, settings))
     , m_settings(settings)
 {
@@ -319,7 +308,7 @@
 
 PopupContainer::~PopupContainer()
 {
-    if (m_listBox)
+    if (m_listBox && m_listBox->parent())
         removeChild(m_listBox.get());
 }
 
@@ -342,7 +331,7 @@
         if (widgetRect.bottom() > static_cast<int>(screen.bottom()))
             widgetRect.move(0, -(widgetRect.height() + selectHeight));
 
-        chromeClient->popupOpened(this, widgetRect, m_settings.focusOnShow);
+        chromeClient->popupOpened(this, widgetRect, m_settings.focusOnShow, false);
     }
 
     if (!m_listBox->parent())
@@ -357,6 +346,29 @@
     invalidate();
 }
 
+void PopupContainer::showExternal(const IntRect& rect, FrameView* v, int index)
+{
+    if (!listBox())
+        return;
+
+    listBox()->setBaseWidth(rect.width());
+    listBox()->updateFromElement();
+
+    if (listBox()->numItems() < 1) {
+        hidePopup();
+        return;
+    }
+
+    // Adjust the popup position to account for scrolling.
+    IntPoint location = v->contentsToWindow(rect.location());
+    IntRect popupRect(location, rect.size());
+
+    // Get the ChromeClient and pass it the popup menu's listbox data.
+    ChromeClientChromium* client = static_cast<ChromeClientChromium*>(
+         v->frame()->page()->chrome()->client());
+    client->popupOpened(this, popupRect, true, true);
+}
+
 void PopupContainer::hidePopup()
 {
     if (client())
@@ -485,6 +497,16 @@
     return m_listBox->selectedIndex();
 }
 
+int PopupContainer::menuItemHeight() const
+{
+    return m_listBox->getRowHeight(0);
+}
+
+const WTF::Vector<PopupItem*>& PopupContainer:: popupData() const
+{
+    return m_listBox->items();
+}
+
 ///////////////////////////////////////////////////////////////////////////////
 // PopupListBox implementation
 
@@ -628,7 +650,7 @@
         // IE).  We change the original index so we revert to that when the
         // popup is closed.
         if (m_settings.acceptOnAbandon)
-            m_willAcceptOnAbandon = true;
+            m_acceptedIndexOnAbandon = m_selectedIndex;
 
         setOriginalIndex(m_selectedIndex);
         if (m_settings.setTextOnIndexChange)
@@ -797,7 +819,7 @@
 
 Font PopupListBox::getRowFont(int rowIndex)
 {
-    Font itemFont = m_popupClient->itemStyle(rowIndex).font();
+    Font itemFont = m_popupClient->menuStyle().font();
     if (m_popupClient->itemIsLabel(rowIndex)) {
         // Bold-ify labels (ie, an <optgroup> heading).
         FontDescription d = itemFont.fontDescription();
@@ -818,8 +840,10 @@
 
     m_popupClient->hidePopup();
 
-    if (m_willAcceptOnAbandon)
-        m_popupClient->valueChanged(m_selectedIndex);
+    if (m_acceptedIndexOnAbandon >= 0) {
+        m_popupClient->valueChanged(m_acceptedIndexOnAbandon);
+        m_acceptedIndexOnAbandon = -1;
+    }
 }
 
 int PopupListBox::pointToRowIndex(const IntPoint& point)
@@ -828,7 +852,7 @@
 
     // FIXME: binary search if perf matters.
     for (int i = 0; i < numItems(); ++i) {
-        if (y < m_items[i]->y)
+        if (y < m_items[i]->yOffset)
             return i-1;
     }
 
@@ -890,7 +914,7 @@
     if (index < 0)
         return IntRect(0, 0, visibleWidth(), getRowHeight(index));
 
-    return IntRect(0, m_items[index]->y, visibleWidth(), getRowHeight(index));
+    return IntRect(0, m_items[index]->yOffset, visibleWidth(), getRowHeight(index));
 }
 
 void PopupListBox::invalidateRow(int index)
@@ -921,7 +945,7 @@
 
 bool PopupListBox::isSelectableItem(int index)
 {
-    return m_items[index]->type == TypeOption && m_popupClient->itemIsEnabled(index);
+    return m_items[index]->type == PopupItem::TypeOption && m_popupClient->itemIsEnabled(index);
 }
 
 void PopupListBox::clearSelection()
@@ -998,26 +1022,19 @@
 
 void PopupListBox::updateFromElement()
 {
-    // It happens when pressing a key to jump to an item, then use tab or
-    // mouse to get away from the select box. In that case, updateFromElement
-    // is called before abandon, which causes discarding of the select result.    
-    if (m_willAcceptOnAbandon) {
-        m_popupClient->valueChanged(m_selectedIndex);
-        m_willAcceptOnAbandon = false;
-    }
-
     clear();
 
     int size = m_popupClient->listSize();
     for (int i = 0; i < size; ++i) {
-        ListItemType type;
+        PopupItem::Type type;
         if (m_popupClient->itemIsSeparator(i))
-            type = PopupListBox::TypeSeparator;
+            type = PopupItem::TypeSeparator;
         else if (m_popupClient->itemIsLabel(i))
-            type = PopupListBox::TypeGroup;
+            type = PopupItem::TypeGroup;
         else
-            type = PopupListBox::TypeOption;
-        m_items.append(new ListItem(m_popupClient->itemText(i), type));
+            type = PopupItem::TypeOption;
+        m_items.append(new PopupItem(m_popupClient->itemText(i), type));
+        m_items[i]->enabled = isSelectableItem(i);
     }
 
     m_selectedIndex = m_popupClient->selectedIndex();
@@ -1036,7 +1053,7 @@
         Font itemFont = getRowFont(i);
 
         // Place the item vertically.
-        m_items[i]->y = y;
+        m_items[i]->yOffset = y;
         y += itemFont.height();
 
         // Ensure the popup is wide enough to fit this item.
@@ -1051,13 +1068,26 @@
     }
 
     int windowHeight = 0;
+
+#if PLATFORM(DARWIN)
+    // Set the popup's window to contain all available items on Mac only, which
+    // uses native controls that manage their own scrolling. This allows hit
+    // testing to work when selecting items in popups that have more menu entries
+    // than the maximum window size.
+    m_visibleRows = numItems();
+#else
     m_visibleRows = min(numItems(), kMaxVisibleRows);
+#endif
+
     for (int i = 0; i < m_visibleRows; ++i) {
         int rowHeight = getRowHeight(i);
+#if !PLATFORM(DARWIN)
+        // Only clip the window height for non-Mac platforms.
         if (windowHeight + rowHeight > kMaxHeight) {
             m_visibleRows = i;
             break;
         }
+#endif
 
         windowHeight += rowHeight;
     }
@@ -1088,7 +1118,7 @@
 
 void PopupListBox::clear()
 {
-    for (Vector<ListItem*>::iterator it = m_items.begin(); it != m_items.end(); ++it)
+    for (Vector<PopupItem*>::iterator it = m_items.begin(); it != m_items.end(); ++it)
         delete *it;
     m_items.clear();
 }
@@ -1115,11 +1145,19 @@
     hide();
 }
 
-void PopupMenu::show(const IntRect& r, FrameView* v, int index) 
+// The Mac Chromium implementation relies on external control (a Cocoa control)
+// to display, handle the input tracking and menu item selection for the popup.
+// Windows and Linux Chromium let our WebKit port handle the display, while
+// another process manages the popup window and input handling.
+void PopupMenu::show(const IntRect& r, FrameView* v, int index)
 {
     if (!p.popup)
         p.popup = PopupContainer::create(client(), dropDownSettings);
+#if PLATFORM(DARWIN)
+    p.popup->showExternal(r, v, index);
+#else
     p.popup->show(r, v, index);
+#endif
 }
 
 void PopupMenu::hide()
diff --git a/WebCore/platform/chromium/PopupMenuChromium.h b/WebCore/platform/chromium/PopupMenuChromium.h
index cd13c22..23003b1 100644
--- a/WebCore/platform/chromium/PopupMenuChromium.h
+++ b/WebCore/platform/chromium/PopupMenuChromium.h
@@ -42,6 +42,23 @@
     class FrameView;
     class PopupListBox;
 
+    // A container for the data for each menu item (e.g. represented by <option>
+    // or <optgroup> in a <select> widget) and is used by PopupListBox.
+    struct PopupItem {
+        enum Type {
+            TypeOption,
+            TypeGroup,
+            TypeSeparator
+        };
+
+        PopupItem(const String& label, Type type)
+            : label(label), type(type), yOffset(0) { }
+        String label;
+        Type type;
+        int yOffset;  // y offset of this item, relative to the top of the popup.
+        bool enabled;
+    };
+
     // FIXME: Our FramelessScrollView classes should probably implement HostWindow!
 
     // The PopupContainer class holds a PopupListBox (see cpp file).  Its sole purpose is to be
@@ -94,9 +111,14 @@
         // Show the popup
         void showPopup(FrameView*);
 
+        // Used on Mac Chromium for HTML select popup menus.
+        void showExternal(const IntRect&, FrameView*, int index);
+
         // Show the popup in the specified rect for the specified frame.
         // Note: this code was somehow arbitrarily factored-out of the Popup class
-        // so WebViewImpl can create a PopupContainer.
+        // so WebViewImpl can create a PopupContainer. This method is used for
+        // displaying auto complete popup menus on Mac Chromium, and for all
+        // popups on other platforms.
         void show(const IntRect&, FrameView*, int index);
 
         // Hide the popup.  Do not call this directly: use client->hidePopup().
@@ -114,6 +136,12 @@
         // Refresh the popup values from the PopupMenuClient.
         void refresh();
 
+        // The menu per-item data.
+        const WTF::Vector<PopupItem*>& popupData() const;
+
+        // The height of a row in the menu.
+        int menuItemHeight() const;
+
     private:
         friend class WTF::RefCounted<PopupContainer>;
 
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromium.cpp b/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
index 426a078..78fc088 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
@@ -40,24 +40,6 @@
 
 namespace WebCore {
 
-ScrollbarTheme* ScrollbarTheme::nativeTheme()
-{
-    static ScrollbarThemeChromium theme;
-    return &theme;
-}
-
-ScrollbarThemeChromium::ScrollbarThemeChromium()
-{
-}
-
-ScrollbarThemeChromium::~ScrollbarThemeChromium()
-{
-}
-
-void ScrollbarThemeChromium::themeChanged()
-{
-}
-
 bool ScrollbarThemeChromium::hasThumb(Scrollbar* scrollbar)
 {
     // This method is just called as a paint-time optimization to see if
@@ -93,20 +75,6 @@
     return IntRect(x, y, size.width(), size.height());
 }
 
-IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
-{
-    IntSize bs = buttonSize(scrollbar);
-    int thickness = scrollbarThickness(scrollbar->controlSize());
-    if (scrollbar->orientation() == HorizontalScrollbar) {
-        if (scrollbar->width() < 2 * thickness)
-            return IntRect();
-        return IntRect(scrollbar->x() + bs.width(), scrollbar->y(), scrollbar->width() - 2 * bs.width(), thickness);
-    }
-    if (scrollbar->height() < 2 * thickness)
-        return IntRect();
-    return IntRect(scrollbar->x(), scrollbar->y() + bs.height(), thickness, scrollbar->height() - 2 * bs.height());
-}
-
 void ScrollbarThemeChromium::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
 {
     // Just assume a forward track part.  We only paint the track as a single piece when there is no thumb.
@@ -165,36 +133,4 @@
     return evt.shiftKey() && evt.button() == LeftButton;
 }
 
-IntSize ScrollbarThemeChromium::buttonSize(Scrollbar* scrollbar)
-{
-#if defined(__linux__)
-    // On Linux, we don't use buttons
-    return IntSize(0, 0);
-#endif
-
-    // Our desired rect is essentially thickness by thickness.
-
-    // Our actual rect will shrink to half the available space when we have < 2
-    // times thickness pixels left.  This allows the scrollbar to scale down
-    // and function even at tiny sizes.
-
-    int thickness = scrollbarThickness(scrollbar->controlSize());
-
-    // In layout test mode, we force the button "girth" (i.e., the length of
-    // the button along the axis of the scrollbar) to be a fixed size.
-    // FIXME: This is retarded!  scrollbarThickness is already fixed in layout
-    // test mode so that should be enough to result in repeatable results, but
-    // preserving this hack avoids having to rebaseline pixel tests.
-    const int kLayoutTestModeGirth = 17;
-    int girth = ChromiumBridge::layoutTestMode() ? kLayoutTestModeGirth : thickness;
-
-    if (scrollbar->orientation() == HorizontalScrollbar) {
-        int width = scrollbar->width() < 2 * girth ? scrollbar->width() / 2 : girth;
-        return IntSize(width, thickness);
-    }
-
-    int height = scrollbar->height() < 2 * girth ? scrollbar->height() / 2 : girth;
-    return IntSize(thickness, height);
-}
-
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromium.h b/WebCore/platform/chromium/ScrollbarThemeChromium.h
index 87ffd44..71d4817 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromium.h
+++ b/WebCore/platform/chromium/ScrollbarThemeChromium.h
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -37,22 +37,9 @@
 
     class PlatformMouseEvent;
 
-    // This class contains the Chromium scrollbar implementations for Windows
-    // and Linux. All of the symbols here in must be defined somewhere in the
-    // code and we manage the platform specific parts by linking in different,
-    // platform specific, files. Methods that we shared across platforms are
-    // implemented in ScrollbarThemeChromium.cpp
+    // This class contains the scrollbar code which is shared between Chromium
+    // Windows and Linux.
     class ScrollbarThemeChromium : public ScrollbarThemeComposite {
-    public:
-        ScrollbarThemeChromium();
-        virtual ~ScrollbarThemeChromium();
-
-        virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
-
-        virtual void themeChanged();
-        
-        virtual bool invalidateOnMouseEnterExit();
-
     protected:
         virtual bool hasButtons(Scrollbar*) { return true; }
         virtual bool hasThumb(Scrollbar*);
@@ -65,19 +52,10 @@
         virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
 
         virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-        virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-        virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-        virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
         virtual void paintTickmarks(GraphicsContext*, Scrollbar*, const IntRect&);
 
-    private:
-        IntSize buttonSize(Scrollbar*);
-
-        int getThemeState(Scrollbar*, ScrollbarPart) const;
-        int getThemeArrowState(Scrollbar*, ScrollbarPart) const;
-        int getClassicThemeState(Scrollbar*, ScrollbarPart) const;
+        virtual IntSize buttonSize(Scrollbar*) = 0;
     };
-
 } // namespace WebCore
 
 #endif
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
index a99d778..6893dea 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
@@ -29,9 +29,8 @@
  */
 
 #include "config.h"
-#include "ScrollbarThemeChromium.h"
+#include "ScrollbarThemeChromiumLinux.h"
 
-#include "NotImplemented.h"
 #include "PlatformContextSkia.h"
 #include "PlatformMouseEvent.h"
 #include "Scrollbar.h"
@@ -39,14 +38,15 @@
 
 namespace WebCore {
 
-int ScrollbarThemeChromium::scrollbarThickness(ScrollbarControlSize controlSize)
+ScrollbarTheme* ScrollbarTheme::nativeTheme()
 {
-    return 15;
+    static ScrollbarThemeChromiumLinux theme;
+    return &theme;
 }
 
-bool ScrollbarThemeChromium::invalidateOnMouseEnterExit()
+int ScrollbarThemeChromiumLinux::scrollbarThickness(ScrollbarControlSize controlSize)
 {
-    return false;
+    return 15;
 }
 
 static void drawVertLine(SkCanvas* canvas, int x, int y1, int y2, const SkPaint& paint)
@@ -73,8 +73,16 @@
     drawVertLine(canvas, rect.x(), rect.y(), bottom, paint);
 }
 
-void ScrollbarThemeChromium::paintTrackPiece(GraphicsContext* gc, Scrollbar* scrollbar,
-                                             const IntRect& rect, ScrollbarPart partType)
+IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
+{
+    IntSize bs = buttonSize(scrollbar);
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        return IntRect(scrollbar->x() + bs.width(), scrollbar->y(), scrollbar->width(), thickness);
+    return IntRect(scrollbar->x(), scrollbar->y() + bs.height(), thickness, scrollbar->height());
+}
+
+void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart partType)
 {
     SkCanvas* const canvas = gc->platformContext()->canvas();
     SkPaint paint;
@@ -88,13 +96,12 @@
     drawBox(canvas, rect, paint);
 }
 
-void ScrollbarThemeChromium::paintButton(GraphicsContext* gc, Scrollbar* scrollbar,
-                                         const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeChromiumLinux::paintButton(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     // We don't use buttons
 }
 
-void ScrollbarThemeChromium::paintThumb(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect)
 {
     const bool hovered = scrollbar->hoveredPart() == ThumbPart;
     const int midx = rect.x() + rect.width() / 2;
@@ -139,4 +146,16 @@
     }
 }
 
+IntSize ScrollbarThemeChromiumLinux::buttonSize(Scrollbar* scrollbar)
+{
+    // On Linux, we don't use buttons
+    return IntSize(0, 0);
+}
+
+int ScrollbarThemeChromiumLinux::minimumThumbLength(Scrollbar* scrollbar)
+{
+    // This matches Firefox on Linux.
+    return 2 * scrollbarThickness(scrollbar->controlSize());
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.h
similarity index 67%
rename from WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
rename to WebCore/platform/chromium/ScrollbarThemeChromiumLinux.h
index 5a55974..4e08b07 100644
--- a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (c) 2009, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,18 +28,24 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8XMLHttpRequestUtilities_h
-#define V8XMLHttpRequestUtilities_h
+#ifndef ScrollbarThemeChromiumLinux_h
+#define ScrollbarThemeChromiumLinux_h
 
-#include <v8.h>
+#include "ScrollbarThemeChromium.h"
 
 namespace WebCore {
+    class ScrollbarThemeChromiumLinux : public ScrollbarThemeChromium {
+    public:
+        virtual int scrollbarThickness(ScrollbarControlSize);
 
-// Use an array to hold dependents. It works like a ref-counted scheme.
-// A value can be added more than once to the xmlHttpRequest object.
-void createHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
-void removeHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
+    protected:
+        virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
+        virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
+        virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
 
+        virtual IntSize buttonSize(Scrollbar*);
+        virtual int minimumThumbLength(Scrollbar*);
+    };
 } // namespace WebCore
 
-#endif // V8XMLHttpRequestUtilities_h
+#endif
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp b/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
index 0337f63..334b767 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
@@ -25,7 +25,7 @@
  */
 
 #include "config.h"
-#include "ScrollbarThemeChromium.h"
+#include "ScrollbarThemeChromiumWin.h"
 
 #include <windows.h>
 #include <vsstyle.h>
@@ -39,12 +39,43 @@
 
 namespace WebCore {
 
+ScrollbarTheme* ScrollbarTheme::nativeTheme()
+{
+    static ScrollbarThemeChromiumWin theme;
+    return &theme;
+}
+
 // The scrollbar size in DumpRenderTree on the Mac - so we can match their
 // layout results.  Entries are for regular, small, and mini scrollbars.
 // Metrics obtained using [NSScroller scrollerWidthForControlSize:]
 static const int kMacScrollbarSize[3] = { 15, 11, 15 };
 
-int ScrollbarThemeChromium::scrollbarThickness(ScrollbarControlSize controlSize)
+// Constants used to figure the drag rect outside which we should snap the
+// scrollbar thumb back to its origin.  These calculations are based on
+// observing the behavior of the MSVC8 main window scrollbar + some
+// guessing/extrapolation.
+static const int kOffEndMultiplier = 3;
+static const int kOffSideMultiplier = 8;
+
+IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
+{
+    IntSize bs = buttonSize(scrollbar);
+    // The buttons at the top and bottom of the scrollbar are square, so the
+    // thickness of the scrollbar is also their height.
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        // Once the scrollbar becomes smaller than the natural size of the
+        // two buttons, the track disappears.
+        if (scrollbar->width() < 2 * thickness)
+            return IntRect();
+        return IntRect(scrollbar->x() + bs.width(), scrollbar->y(), scrollbar->width() - 2 * bs.width(), thickness);
+    }
+    if (scrollbar->height() < 2 * thickness)
+        return IntRect();
+    return IntRect(scrollbar->x(), scrollbar->y() + bs.height(), thickness, scrollbar->height() - 2 * bs.height());
+}
+
+int ScrollbarThemeChromiumWin::scrollbarThickness(ScrollbarControlSize controlSize)
 {
     static int thickness;
     if (!thickness) {
@@ -55,12 +86,30 @@
     return thickness;
 }
 
-bool ScrollbarThemeChromium::invalidateOnMouseEnterExit()
+bool ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit()
 {
     return isVistaOrNewer();
 }
 
-void ScrollbarThemeChromium::paintTrackPiece(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart partType)
+bool ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
+{
+    // Find the rect within which we shouldn't snap, by expanding the track rect
+    // in both dimensions.
+    IntRect rect = trackRect(scrollbar);
+    const bool horz = scrollbar->orientation() == HorizontalScrollbar;
+    const int thickness = scrollbarThickness(scrollbar->controlSize());
+    rect.inflateX((horz ? kOffEndMultiplier : kOffSideMultiplier) * thickness);
+    rect.inflateY((horz ? kOffSideMultiplier : kOffEndMultiplier) * thickness);
+
+    // Convert the event to local coordinates.
+    IntPoint mousePosition = scrollbar->convertFromContainingWindow(evt.pos());
+    mousePosition.move(scrollbar->x(), scrollbar->y());
+
+    // We should snap iff the event is outside our calculated rect.
+    return !rect.contains(mousePosition);
+}
+
+void ScrollbarThemeChromiumWin::paintTrackPiece(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart partType)
 {
     bool horz = scrollbar->orientation() == HorizontalScrollbar;
 
@@ -82,7 +131,7 @@
         alignRect);
 }
 
-void ScrollbarThemeChromium::paintButton(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeChromiumWin::paintButton(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     bool horz = scrollbar->orientation() == HorizontalScrollbar;
 
@@ -100,7 +149,7 @@
         rect);
 }
 
-void ScrollbarThemeChromium::paintThumb(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeChromiumWin::paintThumb(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect)
 {
     bool horz = scrollbar->orientation() == HorizontalScrollbar;
 
@@ -121,7 +170,7 @@
         rect);
 }
 
-int ScrollbarThemeChromium::getThemeState(Scrollbar* scrollbar, ScrollbarPart part) const
+int ScrollbarThemeChromiumWin::getThemeState(Scrollbar* scrollbar, ScrollbarPart part) const
 {
     // When dragging the thumb, draw thumb pressed and other segments normal
     // regardless of where the cursor actually is.  See also four places in
@@ -140,7 +189,7 @@
     return (scrollbar->pressedPart() == part) ? SCRBS_PRESSED : SCRBS_NORMAL;
 }
 
-int ScrollbarThemeChromium::getThemeArrowState(Scrollbar* scrollbar, ScrollbarPart part) const
+int ScrollbarThemeChromiumWin::getThemeArrowState(Scrollbar* scrollbar, ScrollbarPart part) const
 {
     // We could take advantage of knowing the values in the state enum to write
     // some simpler code, but treating the state enum as a black box seems
@@ -190,7 +239,7 @@
     return (scrollbar->pressedPart() == part) ? ABS_DOWNPRESSED : ABS_DOWNNORMAL;
 }
 
-int ScrollbarThemeChromium::getClassicThemeState(Scrollbar* scrollbar, ScrollbarPart part) const
+int ScrollbarThemeChromiumWin::getClassicThemeState(Scrollbar* scrollbar, ScrollbarPart part) const
 {
     // When dragging the thumb, draw the buttons normal even when hovered.
     if (scrollbar->pressedPart() == ThumbPart)
@@ -204,4 +253,32 @@
     return (scrollbar->pressedPart() == part) ? (DFCS_PUSHED | DFCS_FLAT) : 0;
 }
 
+IntSize ScrollbarThemeChromiumWin::buttonSize(Scrollbar* scrollbar)
+{
+    // Our desired rect is essentially thickness by thickness.
+
+    // Our actual rect will shrink to half the available space when we have < 2
+    // times thickness pixels left.  This allows the scrollbar to scale down
+    // and function even at tiny sizes.
+
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+
+    // In layout test mode, we force the button "girth" (i.e., the length of
+    // the button along the axis of the scrollbar) to be a fixed size.
+    // FIXME: This is retarded!  scrollbarThickness is already fixed in layout
+    // test mode so that should be enough to result in repeatable results, but
+    // preserving this hack avoids having to rebaseline pixel tests.
+    const int kLayoutTestModeGirth = 17;
+    int girth = ChromiumBridge::layoutTestMode() ? kLayoutTestModeGirth : thickness;
+
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        int width = scrollbar->width() < 2 * girth ? scrollbar->width() / 2 : girth;
+        return IntSize(width, thickness);
+    }
+
+    int height = scrollbar->height() < 2 * girth ? scrollbar->height() / 2 : girth;
+    return IntSize(thickness, height);
+}
+
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h b/WebCore/platform/chromium/ScrollbarThemeChromiumWin.h
similarity index 60%
copy from WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
copy to WebCore/platform/chromium/ScrollbarThemeChromiumWin.h
index 5a55974..5b4d0ea 100644
--- a/WebCore/bindings/v8/V8XMLHttpRequestUtilities.h
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumWin.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (c) 2009, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,18 +28,29 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8XMLHttpRequestUtilities_h
-#define V8XMLHttpRequestUtilities_h
+#ifndef ScrollbarThemeChromiumWin_h
+#define ScrollbarThemeChromiumWin_h
 
-#include <v8.h>
+#include "ScrollbarThemeChromium.h"
 
 namespace WebCore {
+    class ScrollbarThemeChromiumWin : public ScrollbarThemeChromium {
+    public:
+        virtual int scrollbarThickness(ScrollbarControlSize);
+        virtual bool invalidateOnMouseEnterExit();
+        virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&);
 
-// Use an array to hold dependents. It works like a ref-counted scheme.
-// A value can be added more than once to the xmlHttpRequest object.
-void createHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
-void removeHiddenXHRDependency(v8::Local<v8::Object> xmlHttpRequest, v8::Local<v8::Value>);
+    protected:
+        virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
+        virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
+        virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
+        virtual IntSize buttonSize(Scrollbar*);
 
+    private:
+        int getThemeState(Scrollbar*, ScrollbarPart) const;
+        int getThemeArrowState(Scrollbar*, ScrollbarPart) const;
+        int getClassicThemeState(Scrollbar*, ScrollbarPart) const;
+    };
 } // namespace WebCore
 
-#endif // V8XMLHttpRequestUtilities_h
+#endif
diff --git a/WebCore/css/themeChromiumWin.css b/WebCore/platform/chromium/SuddenTerminationChromium.cpp
similarity index 81%
rename from WebCore/css/themeChromiumWin.css
rename to WebCore/platform/chromium/SuddenTerminationChromium.cpp
index e829373..54b8304 100644
--- a/WebCore/css/themeChromiumWin.css
+++ b/WebCore/platform/chromium/SuddenTerminationChromium.cpp
@@ -1,39 +1,48 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* These styles override the default styling for HTML elements as defined in
-   WebCore/css/themeWin.css. */
-#include "themeWin.css"
-
-input[type="search"]::-webkit-search-cancel-button,
-input[type="search"]::-webkit-search-results-decoration,
-input[type="search"]::-webkit-search-results-button {
-    margin: 0 0 0 0;
-}
+/*

+ * Copyright (C) 2009 Google Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions are

+ * met:

+ *

+ *     * Redistributions of source code must retain the above copyright

+ * notice, this list of conditions and the following disclaimer.

+ *     * Redistributions in binary form must reproduce the above

+ * copyright notice, this list of conditions and the following disclaimer

+ * in the documentation and/or other materials provided with the

+ * distribution.

+ *     * Neither the name of Google Inc. nor the names of its

+ * contributors may be used to endorse or promote products derived from

+ * this software without specific prior written permission.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "config.h"

+#include "SuddenTermination.h"

+

+#include "ChromiumBridge.h"

+

+namespace WebCore {

+

+void disableSuddenTermination()

+{

+    ChromiumBridge::suddenTerminationChanged(false);

+}

+

+void enableSuddenTermination()

+{

+    ChromiumBridge::suddenTerminationChanged(true);

+}

+

+} // namespace WebCore

diff --git a/WebCore/platform/graphics/BitmapImage.cpp b/WebCore/platform/graphics/BitmapImage.cpp
index 1d97632..2f9412d 100644
--- a/WebCore/platform/graphics/BitmapImage.cpp
+++ b/WebCore/platform/graphics/BitmapImage.cpp
@@ -95,7 +95,7 @@
     // Animated images >5MB are considered large enough that we'll only hang on
     // to one frame at a time.
     static const unsigned cLargeAnimationCutoff = 5242880;
-    if (frameCount() * frameBytes(m_size) > cLargeAnimationCutoff)
+    if (m_frames.size() * frameBytes(m_size) > cLargeAnimationCutoff)
         destroyDecodedData(destroyAll);
 }
 
diff --git a/WebCore/platform/graphics/BitmapImage.h b/WebCore/platform/graphics/BitmapImage.h
index db05d1c..a2de5d7 100644
--- a/WebCore/platform/graphics/BitmapImage.h
+++ b/WebCore/platform/graphics/BitmapImage.h
@@ -44,11 +44,6 @@
 typedef struct HBITMAP__ *HBITMAP;
 #endif
 
-#if PLATFORM(SGL)
-class SkBitmap;
-class SkBitmapRef;
-#endif
-
 namespace WebCore {
     struct FrameData;
 }
@@ -146,10 +141,13 @@
 #endif
 
 #if PLATFORM(SGL)
-//    virtual SkBitmapRef* getBitmap();
     virtual void setURL(const String& str);
 #endif
 
+#if PLATFORM(GTK)
+    virtual GdkPixbuf* getGdkPixbuf();
+#endif
+
     virtual NativeImagePtr nativeImageForCurrentFrame() { return frameAtIndex(currentFrame()); }
 
 protected:
diff --git a/WebCore/platform/graphics/Color.cpp b/WebCore/platform/graphics/Color.cpp
index e85ac00..d98b202 100644
--- a/WebCore/platform/graphics/Color.cpp
+++ b/WebCore/platform/graphics/Color.cpp
@@ -321,6 +321,41 @@
     a = alpha() / 255.0;
 }
 
+void Color::getHSL(double& hue, double& saturation, double& lightness) const
+{
+    // http://en.wikipedia.org/wiki/HSL_color_space. This is a direct copy of
+    // the algorithm therein, although it's 360^o based and we end up wanting
+    // [0...1) based. It's clearer if we stick to 360^o until the end.
+    double r = static_cast<double>(red()) / 255.0;
+    double g = static_cast<double>(green()) / 255.0;
+    double b = static_cast<double>(blue()) / 255.0;
+    double max = std::max(std::max(r, g), b);
+    double min = std::min(std::min(r, g), b);
+
+    if (max == min)
+        hue = 0.0;
+    else if (max == r)
+        hue = (60.0 * ((g - b) / (max - min))) + 360.0;
+    else if (max == g)
+        hue = (60.0 * ((b - r) / (max - min))) + 120.0;
+    else
+        hue = (60.0 * ((r - g) / (max - min))) + 240.0;
+
+    if (hue >= 360.0)
+        hue -= 360.0;
+
+    // makeRGBAFromHSLA assumes that hue is in [0...1).
+    hue /= 360.0;
+
+    lightness = 0.5 * (max + min);
+    if (max == min)
+        saturation = 0.0;
+    else if (lightness <= 0.5)
+        saturation = ((max - min) / (max + min));
+    else
+        saturation = ((max - min) / (2.0 - (max + min)));
+}
+
 Color colorFromPremultipliedARGB(unsigned pixelColor)
 {
     RGBA32 rgba;
diff --git a/WebCore/platform/graphics/Color.h b/WebCore/platform/graphics/Color.h
index 3c889f9..3b815d2 100644
--- a/WebCore/platform/graphics/Color.h
+++ b/WebCore/platform/graphics/Color.h
@@ -94,6 +94,7 @@
     void setRGB(RGBA32 rgb) { m_color = rgb; m_valid = true; }
     void getRGBA(float& r, float& g, float& b, float& a) const;
     void getRGBA(double& r, double& g, double& b, double& a) const;
+    void getHSL(double& h, double& s, double& l) const;
 
     Color light() const;
     Color dark() const;
diff --git a/WebCore/platform/graphics/FloatQuad.cpp b/WebCore/platform/graphics/FloatQuad.cpp
index a32d8ab..427230d 100644
--- a/WebCore/platform/graphics/FloatQuad.cpp
+++ b/WebCore/platform/graphics/FloatQuad.cpp
@@ -46,6 +46,34 @@
     return max(max(a, b), max(c, d));
 }
 
+inline float dot(const FloatSize& a, const FloatSize& b)
+{
+    return a.width() * b.width() + a.height() * b.height();
+}
+
+inline bool isPointInTriangle(const FloatPoint& p, const FloatPoint& t1, const FloatPoint& t2, const FloatPoint& t3)
+{
+    // Compute vectors        
+    FloatSize v0 = t3 - t1;
+    FloatSize v1 = t2 - t1;
+    FloatSize v2 = p - t1;
+    
+    // Compute dot products
+    float dot00 = dot(v0, v0);
+    float dot01 = dot(v0, v1);
+    float dot02 = dot(v0, v2);
+    float dot11 = dot(v1, v1);
+    float dot12 = dot(v1, v2);
+
+    // Compute barycentric coordinates
+    float invDenom = 1.0f / (dot00 * dot11 - dot01 * dot01);
+    float u = (dot11 * dot02 - dot01 * dot12) * invDenom;
+    float v = (dot00 * dot12 - dot01 * dot02) * invDenom;
+
+    // Check if point is in triangle
+    return (u >= 0) && (v >= 0) && (u + v <= 1);
+}
+
 FloatRect FloatQuad::boundingBox() const
 {
     float left   = min4(m_p1.x(), m_p2.x(), m_p3.x(), m_p4.x());
@@ -57,4 +85,15 @@
     return FloatRect(left, top, right - left, bottom - top);
 }
 
+bool FloatQuad::containsPoint(const FloatPoint& p) const
+{
+    return isPointInTriangle(p, m_p1, m_p2, m_p3) || isPointInTriangle(p, m_p1, m_p3, m_p4);
+} 
+
+// Note that we only handle convex quads here.
+bool FloatQuad::containsQuad(const FloatQuad& other) const
+{
+    return containsPoint(other.p1()) && containsPoint(other.p2()) && containsPoint(other.p3()) && containsPoint(other.p4());
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/FloatQuad.h b/WebCore/platform/graphics/FloatQuad.h
index e05b27d..5982967 100644
--- a/WebCore/platform/graphics/FloatQuad.h
+++ b/WebCore/platform/graphics/FloatQuad.h
@@ -74,6 +74,14 @@
     // "slanted" empty quads.
     bool isEmpty() const { return boundingBox().isEmpty(); }
 
+    // Tests whether the given point is inside, or on an edge or corner of this quad.
+    bool containsPoint(const FloatPoint&) const;
+
+    // Tests whether the four corners of other are inside, or coincident with the sides of this quad.
+    // Note that this only works for convex quads, but that includes all quads that originate
+    // from transformed rects.
+    bool containsQuad(const FloatQuad&) const;
+
     FloatRect boundingBox() const;
     IntRect enclosingBoundingBox() const
     {
diff --git a/WebCore/platform/graphics/Font.cpp b/WebCore/platform/graphics/Font.cpp
index f8bec82..85fe882 100644
--- a/WebCore/platform/graphics/Font.cpp
+++ b/WebCore/platform/graphics/Font.cpp
@@ -32,6 +32,7 @@
 #include "GlyphBuffer.h"
 #include "WidthIterator.h"
 #include <wtf/MathExtras.h>
+#include <wtf/UnusedParam.h>
 
 using namespace WTF;
 using namespace Unicode;
@@ -198,7 +199,7 @@
     return drawComplexText(context, run, point, from, to);
 }
 
-float Font::floatWidth(const TextRun& run) const
+float Font::floatWidth(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
 #if ENABLE(SVG_FONTS)
     if (primaryFont()->isSVGFont())
@@ -206,16 +207,22 @@
 #endif
 
 #if USE(FONT_FAST_PATH)
-    if (canUseGlyphCache(run))
-        return floatWidthForSimpleText(run, 0);
+    if (canUseGlyphCache(run)) {
+        // If the complex text implementation cannot return fallback fonts, avoid
+        // returning them for simple text as well.
+        static bool returnFallbackFonts = canReturnFallbackFontsForComplexText();
+        return floatWidthForSimpleText(run, 0, returnFallbackFonts ? fallbackFonts : 0);
+    }
 #endif
 
-    return floatWidthForComplexText(run);
+    return floatWidthForComplexText(run, fallbackFonts);
 }
 
 float Font::floatWidth(const TextRun& run, int extraCharsAvailable, int& charsConsumed, String& glyphName) const
 {
-#if ENABLE(SVG_FONTS)
+#if !ENABLE(SVG_FONTS)
+    UNUSED_PARAM(extraCharsAvailable);
+#else
     if (primaryFont()->isSVGFont())
         return floatWidthUsingSVGFont(run, extraCharsAvailable, charsConsumed, glyphName);
 #endif
@@ -275,4 +282,17 @@
     return m_fontList ? m_fontList->fontSelector() : 0;
 }
 
+static bool shouldUseFontSmoothing = true;
+
+void Font::setShouldUseSmoothing(bool shouldUseSmoothing)
+{
+    ASSERT(isMainThread());
+    shouldUseFontSmoothing = shouldUseSmoothing;
+}
+
+bool Font::shouldUseSmoothing()
+{
+    return shouldUseFontSmoothing;
+}
+
 }
diff --git a/WebCore/platform/graphics/Font.h b/WebCore/platform/graphics/Font.h
index 1bfee8f..8d85d8b 100644
--- a/WebCore/platform/graphics/Font.h
+++ b/WebCore/platform/graphics/Font.h
@@ -78,8 +78,8 @@
 
     void drawText(GraphicsContext*, const TextRun&, const FloatPoint&, int from = 0, int to = -1) const;
 
-    int width(const TextRun& run) const { return lroundf(floatWidth(run)); }
-    float floatWidth(const TextRun&) const;
+    int width(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts = 0) const { return lroundf(floatWidth(run, fallbackFonts)); }
+    float floatWidth(const TextRun&, HashSet<const SimpleFontData*>* fallbackFonts = 0) const;
     float floatWidth(const TextRun& run, int extraCharsAvailable, int& charsConsumed, String& glyphName) const;
 
     int offsetForPosition(const TextRun&, int position, bool includePartialGlyphs) const;
@@ -112,17 +112,19 @@
     int lineGap() const { return primaryFont()->lineGap(); }
     float xHeight() const { return primaryFont()->xHeight(); }
     unsigned unitsPerEm() const { return primaryFont()->unitsPerEm(); }
-    int spaceWidth() const { return (int)ceilf(primaryFont()->m_adjustedSpaceWidth + m_letterSpacing); }
+    int spaceWidth() const { return (int)ceilf(primaryFont()->adjustedSpaceWidth() + m_letterSpacing); }
     int tabWidth() const { return 8 * spaceWidth(); }
 
-    const SimpleFontData* primaryFont() const {
+    const SimpleFontData* primaryFont() const
+    {
+        ASSERT(isMainThread());
         if (!m_cachedPrimaryFont)
             cachePrimaryFont();
         return m_cachedPrimaryFont;
     }
 
     const FontData* fontDataAt(unsigned) const;
-    const GlyphData& glyphDataForCharacter(UChar32, bool mirror, bool forceSmallCaps = false) const;
+    GlyphData glyphDataForCharacter(UChar32, bool mirror, bool forceSmallCaps = false) const;
     // Used for complex text, and does not utilize the glyph map cache.
     const FontData* fontDataForCharacters(const UChar*, int length) const;
 
@@ -130,6 +132,9 @@
     QFont font() const;
 #endif
 
+    static void setShouldUseSmoothing(bool);
+    static bool shouldUseSmoothing();
+
 private:
 #if ENABLE(SVG_FONTS)
     void drawTextUsingSVGFont(GraphicsContext*, const TextRun&, const FloatPoint&, int from, int to) const;
@@ -144,13 +149,15 @@
     void drawSimpleText(GraphicsContext*, const TextRun&, const FloatPoint&, int from, int to) const;
     void drawGlyphs(GraphicsContext*, const SimpleFontData*, const GlyphBuffer&, int from, int to, const FloatPoint&) const;
     void drawGlyphBuffer(GraphicsContext*, const GlyphBuffer&, const TextRun&, const FloatPoint&) const;
-    float floatWidthForSimpleText(const TextRun&, GlyphBuffer*) const;
+    float floatWidthForSimpleText(const TextRun&, GlyphBuffer*, HashSet<const SimpleFontData*>* fallbackFonts = 0) const;
     int offsetForPositionForSimpleText(const TextRun&, int position, bool includePartialGlyphs) const;
     FloatRect selectionRectForSimpleText(const TextRun&, const IntPoint&, int h, int from, int to) const;
+
+    static bool canReturnFallbackFontsForComplexText();
 #endif
 
     void drawComplexText(GraphicsContext*, const TextRun&, const FloatPoint&, int from, int to) const;
-    float floatWidthForComplexText(const TextRun&) const;
+    float floatWidthForComplexText(const TextRun&, HashSet<const SimpleFontData*>* fallbackFonts = 0) const;
     int offsetForPositionForComplexText(const TextRun&, int position, bool includePartialGlyphs) const;
     FloatRect selectionRectForComplexText(const TextRun&, const IntPoint&, int h, int from, int to) const;
     void cachePrimaryFont() const;
diff --git a/WebCore/platform/graphics/FontCache.cpp b/WebCore/platform/graphics/FontCache.cpp
index 130313d..d9b4b28 100644
--- a/WebCore/platform/graphics/FontCache.cpp
+++ b/WebCore/platform/graphics/FontCache.cpp
@@ -307,12 +307,13 @@
 
     isPurging = true;
 
+    Vector<const SimpleFontData*, 20> fontDataToDelete;
     ListHashSet<const SimpleFontData*>::iterator end = gInactiveFontData->end();
     ListHashSet<const SimpleFontData*>::iterator it = gInactiveFontData->begin();
     for (int i = 0; i < count && it != end; ++it, ++i) {
         const SimpleFontData* fontData = *it.get();
         gFontDataCache->remove(fontData->platformData());
-        delete fontData;
+        fontDataToDelete.append(fontData);
     }
 
     if (it == end) {
@@ -323,6 +324,10 @@
             gInactiveFontData->remove(gInactiveFontData->begin());
     }
 
+    size_t fontDataToDeleteCount = fontDataToDelete.size();
+    for (size_t i = 0; i < fontDataToDeleteCount; ++i)
+        delete fontDataToDelete[i];
+
     Vector<FontPlatformDataCacheKey> keysToRemove;
     keysToRemove.reserveInitialCapacity(gFontPlatformDataCache->size());
     FontPlatformDataCache::iterator platformDataEnd = gFontPlatformDataCache->end();
diff --git a/WebCore/platform/graphics/FontCache.h b/WebCore/platform/graphics/FontCache.h
index 8820045..3c0f2d9 100644
--- a/WebCore/platform/graphics/FontCache.h
+++ b/WebCore/platform/graphics/FontCache.h
@@ -85,6 +85,7 @@
 
 private:
     FontCache();
+    ~FontCache();
 
     // These methods are implemented by each platform.
     FontPlatformData* getSimilarFontPlatformData(const Font&);
diff --git a/WebCore/platform/graphics/FontDescription.h b/WebCore/platform/graphics/FontDescription.h
index d13e86a..c893b8a 100644
--- a/WebCore/platform/graphics/FontDescription.h
+++ b/WebCore/platform/graphics/FontDescription.h
@@ -81,7 +81,7 @@
     GenericFamilyType genericFamily() const { return static_cast<GenericFamilyType>(m_genericFamily); }
     bool usePrinterFont() const { return m_usePrinterFont; }
     FontRenderingMode renderingMode() const { return static_cast<FontRenderingMode>(m_renderingMode); }
-    int keywordSize() const { return m_keywordSize; }
+    unsigned keywordSize() const { return m_keywordSize; }
 
     FontTraitsMask traitsMask() const;
 
@@ -95,7 +95,7 @@
     void setGenericFamily(GenericFamilyType genericFamily) { m_genericFamily = genericFamily; }
     void setUsePrinterFont(bool p) { m_usePrinterFont = p; }
     void setRenderingMode(FontRenderingMode mode) { m_renderingMode = mode; }
-    void setKeywordSize(int s) { m_keywordSize = s; }
+    void setKeywordSize(unsigned s) { m_keywordSize = s; }
 
 private:
     FontFamily m_familyList; // The list of font families to be used.
@@ -114,7 +114,7 @@
 
     unsigned m_renderingMode : 1;  // Used to switch between CG and GDI text on Windows.
 
-    int m_keywordSize : 4; // We cache whether or not a font is currently represented by a CSS keyword (e.g., medium).  If so,
+    unsigned m_keywordSize : 4; // We cache whether or not a font is currently represented by a CSS keyword (e.g., medium).  If so,
                            // then we can accurately translate across different generic families to adjust for different preference settings
                            // (e.g., 13px monospace vs. 16px everything else).  Sizes are 1-8 (like the HTML size values for <font>).
 };
diff --git a/WebCore/platform/graphics/FontFallbackList.cpp b/WebCore/platform/graphics/FontFallbackList.cpp
index 06d52d7..decacc5 100644
--- a/WebCore/platform/graphics/FontFallbackList.cpp
+++ b/WebCore/platform/graphics/FontFallbackList.cpp
@@ -36,10 +36,10 @@
 namespace WebCore {
 
 FontFallbackList::FontFallbackList()
-    : m_familyIndex(0)
+    : m_fontSelector(0)
+    , m_familyIndex(0)
     , m_pitch(UnknownPitch)
     , m_loadingCustomFonts(false)
-    , m_fontSelector(0)
     , m_generation(fontCache()->generation())
 {
 }
diff --git a/WebCore/platform/graphics/FontFallbackList.h b/WebCore/platform/graphics/FontFallbackList.h
index a23b32c..07938ae 100644
--- a/WebCore/platform/graphics/FontFallbackList.h
+++ b/WebCore/platform/graphics/FontFallbackList.h
@@ -66,10 +66,10 @@
     void releaseFontData();
 
     mutable Vector<pair<const FontData*, bool>, 1> m_fontList;
+    RefPtr<FontSelector> m_fontSelector;
     mutable int m_familyIndex;
     mutable Pitch m_pitch;
     mutable bool m_loadingCustomFonts;
-    RefPtr<FontSelector> m_fontSelector;
     unsigned m_generation;
 
     friend class Font;
diff --git a/WebCore/platform/graphics/FontFastPath.cpp b/WebCore/platform/graphics/FontFastPath.cpp
index 635aba9..deac1b6 100644
--- a/WebCore/platform/graphics/FontFastPath.cpp
+++ b/WebCore/platform/graphics/FontFastPath.cpp
@@ -39,11 +39,13 @@
 
 namespace WebCore {
 
-const GlyphData& Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceSmallCaps) const
+GlyphData Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceSmallCaps) const
 {
+    ASSERT(isMainThread());
+
     bool useSmallCapsFont = forceSmallCaps;
     if (m_fontDescription.smallCaps()) {
-        UChar32 upperC = Unicode::toUpper(c);
+        UChar32 upperC = toUpper(c);
         if (upperC != c) {
             c = upperC;
             useSmallCapsFont = true;
@@ -70,7 +72,7 @@
         while (true) {
             page = node->page();
             if (page) {
-                const GlyphData& data = page->glyphDataForCharacter(c);
+                GlyphData data = page->glyphDataForCharacter(c);
                 if (data.fontData)
                     return data;
                 if (node->isSystemFallback())
@@ -88,7 +90,7 @@
         while (true) {
             page = node->page();
             if (page) {
-                const GlyphData& data = page->glyphDataForCharacter(c);
+                GlyphData data = page->glyphDataForCharacter(c);
                 if (data.fontData) {
                     // The smallCapsFontData function should not normally return 0.
                     // But if it does, we will just render the capital letter big.
@@ -99,7 +101,7 @@
                     GlyphPageTreeNode* smallCapsNode = GlyphPageTreeNode::getRootChild(smallCapsFontData, pageNumber);
                     const GlyphPage* smallCapsPage = smallCapsNode->page();
                     if (smallCapsPage) {
-                        const GlyphData& data = smallCapsPage->glyphDataForCharacter(c);
+                        GlyphData data = smallCapsPage->glyphDataForCharacter(c);
                         if (data.fontData)
                             return data;
                     }
@@ -150,7 +152,7 @@
     if (characterFontData) {
         // Got the fallback glyph and font.
         GlyphPage* fallbackPage = GlyphPageTreeNode::getRootChild(characterFontData, pageNumber)->page();
-        const GlyphData& data = fallbackPage && fallbackPage->glyphDataForCharacter(c).fontData ? fallbackPage->glyphDataForCharacter(c) : characterFontData->missingGlyphData();
+        GlyphData data = fallbackPage && fallbackPage->fontDataForCharacter(c) ? fallbackPage->glyphDataForCharacter(c) : characterFontData->missingGlyphData();
         // Cache it so we don't have to do system fallback again next time.
         if (!useSmallCapsFont)
             page->setGlyphDataForCharacter(c, data.glyph, data.fontData);
@@ -159,7 +161,7 @@
 
     // Even system fallback can fail; use the missing glyph in that case.
     // FIXME: It would be nicer to use the missing glyph from the last resort font instead.
-    const GlyphData& data = primaryFont()->missingGlyphData();
+    GlyphData data = primaryFont()->missingGlyphData();
     if (!useSmallCapsFont)
         page->setGlyphDataForCharacter(c, data.glyph, data.fontData);
     return data;
@@ -296,9 +298,9 @@
     drawGlyphs(context, fontData, glyphBuffer, lastFrom, nextGlyph - lastFrom, startPoint);
 }
 
-float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer) const
+float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
-    WidthIterator it(this, run);
+    WidthIterator it(this, run, fallbackFonts);
     it.advance(run.length(), glyphBuffer);
     return it.m_runWidthSoFar;
 }
diff --git a/WebCore/platform/graphics/GeneratedImage.cpp b/WebCore/platform/graphics/GeneratedImage.cpp
index 15e27d7..c40a40a 100644
--- a/WebCore/platform/graphics/GeneratedImage.cpp
+++ b/WebCore/platform/graphics/GeneratedImage.cpp
@@ -51,7 +51,7 @@
                                  const FloatPoint& phase, CompositeOperator compositeOp, const FloatRect& destRect)
 {
     // Create a BitmapImage and call drawPattern on it.
-    auto_ptr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size, false);
+    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size, false);
     ASSERT(imageBuffer.get());
     
     // Fill with the gradient.
diff --git a/WebCore/platform/graphics/GlyphPageTreeNode.cpp b/WebCore/platform/graphics/GlyphPageTreeNode.cpp
index bd838de..a34a192 100644
--- a/WebCore/platform/graphics/GlyphPageTreeNode.cpp
+++ b/WebCore/platform/graphics/GlyphPageTreeNode.cpp
@@ -220,8 +220,8 @@
                         if (scratchPage) {
                             ASSERT(to <=  static_cast<int>(GlyphPage::size));
                             for (int j = from; j < to; j++) {
-                                if (!m_page->m_glyphs[j].glyph && pageToFill->m_glyphs[j].glyph)
-                                    m_page->m_glyphs[j] = pageToFill->m_glyphs[j];
+                                if (!m_page->glyphAt(j) && pageToFill->glyphAt(j))
+                                    m_page->setGlyphDataForIndex(j, pageToFill->glyphDataForIndex(j));
                             }
                         }
                     }
@@ -265,15 +265,13 @@
                 // has added anything.
                 bool newGlyphs = false;
                 for (unsigned i = 0; i < GlyphPage::size; i++) {
-                    if (parentPage->m_glyphs[i].glyph)
-                        m_page->m_glyphs[i] = parentPage->m_glyphs[i];
-                    else  if (fallbackPage->m_glyphs[i].glyph) {
-                        m_page->m_glyphs[i] = fallbackPage->m_glyphs[i];
+                    if (parentPage->glyphAt(i))
+                        m_page->setGlyphDataForIndex(i, parentPage->glyphDataForIndex(i));
+                    else  if (fallbackPage->glyphAt(i)) {
+                        m_page->setGlyphDataForIndex(i, fallbackPage->glyphDataForIndex(i));
                         newGlyphs = true;
-                    } else {
-                        const GlyphData data = { 0, 0 };
-                        m_page->m_glyphs[i] = data;
-                    }
+                    } else
+                        m_page->setGlyphDataForIndex(i, 0, 0);
                 }
 
                 if (!newGlyphs)
@@ -288,12 +286,9 @@
         // ever finds it needs a glyph out of the system fallback page, it will
         // ask the system for the best font to use and fill that glyph in for us.
         if (parentPage)
-            memcpy(m_page->m_glyphs, parentPage->m_glyphs, GlyphPage::size * sizeof(m_page->m_glyphs[0]));
-        else {
-            const GlyphData data = { 0, 0 };
-            for (unsigned i = 0; i < GlyphPage::size; i++)
-                m_page->m_glyphs[i] = data;
-        }
+            m_page->copyFrom(*parentPage);
+        else
+            m_page->clear();
     }
 }
 
diff --git a/WebCore/platform/graphics/GlyphPageTreeNode.h b/WebCore/platform/graphics/GlyphPageTreeNode.h
index 240b492..80e87aa 100644
--- a/WebCore/platform/graphics/GlyphPageTreeNode.h
+++ b/WebCore/platform/graphics/GlyphPageTreeNode.h
@@ -29,6 +29,7 @@
 #ifndef GlyphPageTreeNode_h
 #define GlyphPageTreeNode_h
 
+#include <string.h>
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -45,6 +46,11 @@
 // Holds the glyph index and the corresponding SimpleFontData information for a given
 // character.
 struct GlyphData {
+    GlyphData(Glyph g = 0, const SimpleFontData* f = 0)
+        : glyph(g)
+        , fontData(f)
+    {
+    }
     Glyph glyph;
     const SimpleFontData* fontData;
 };
@@ -54,30 +60,69 @@
 // starting from 0 and incrementing for each 256 glyphs.
 //
 // One page may actually include glyphs from other fonts if the characters are
-// missing in the parimary font. It is owned by exactly one GlyphPageTreeNode,
+// missing in the primary font. It is owned by exactly one GlyphPageTreeNode,
 // although multiple nodes may reference it as their "page" if they are supposed
 // to be overriding the parent's node, but provide no additional information.
-struct GlyphPage : public RefCounted<GlyphPage> {
+class GlyphPage : public RefCounted<GlyphPage> {
+public:
     static PassRefPtr<GlyphPage> create(GlyphPageTreeNode* owner)
     {
         return adoptRef(new GlyphPage(owner));
     }
 
     static const size_t size = 256; // Covers Latin-1 in a single page.
-    GlyphData m_glyphs[size];
-    GlyphPageTreeNode* m_owner;
 
-    const GlyphData& glyphDataForCharacter(UChar32 c) const { return m_glyphs[c % size]; }
+    unsigned indexForCharacter(UChar32 c) const { return c % size; }
+    GlyphData glyphDataForCharacter(UChar32 c) const
+    {
+        unsigned index = indexForCharacter(c);
+        return GlyphData(m_glyphs[index], m_glyphFontData[index]);
+    }
+
+    GlyphData glyphDataForIndex(unsigned index) const
+    {
+        ASSERT(index < size);
+        return GlyphData(m_glyphs[index], m_glyphFontData[index]);
+    }
+
+    Glyph glyphAt(unsigned index) const
+    {
+        ASSERT(index < size);
+        return m_glyphs[index];
+    }
+
+    const SimpleFontData* fontDataForCharacter(UChar32 c) const
+    {
+        return m_glyphFontData[indexForCharacter(c)];
+    }
+
     void setGlyphDataForCharacter(UChar32 c, Glyph g, const SimpleFontData* f)
     {
-        setGlyphDataForIndex(c % size, g, f);
+        setGlyphDataForIndex(indexForCharacter(c), g, f);
     }
     void setGlyphDataForIndex(unsigned index, Glyph g, const SimpleFontData* f)
     {
         ASSERT(index < size);
-        m_glyphs[index].glyph = g;
-        m_glyphs[index].fontData = f;
+        m_glyphs[index] = g;
+        m_glyphFontData[index] = f;
     }
+    void setGlyphDataForIndex(unsigned index, const GlyphData& glyphData)
+    {
+        setGlyphDataForIndex(index, glyphData.glyph, glyphData.fontData);
+    }
+    
+    void copyFrom(const GlyphPage& other)
+    {
+        memcpy(m_glyphs, other.m_glyphs, sizeof(m_glyphs));
+        memcpy(m_glyphFontData, other.m_glyphFontData, sizeof(m_glyphFontData));
+    }
+
+    void clear()
+    {
+        memset(m_glyphs, 0, sizeof(m_glyphs));
+        memset(m_glyphFontData, 0, sizeof(m_glyphFontData));
+    }
+    
     GlyphPageTreeNode* owner() const { return m_owner; }
 
     // Implemented by the platform.
@@ -88,6 +133,12 @@
         : m_owner(owner)
     {
     }
+
+    // Separate arrays, rather than array of GlyphData, to save space.
+    Glyph m_glyphs[size];
+    const SimpleFontData* m_glyphFontData[size];
+
+    GlyphPageTreeNode* m_owner;
 };
 
 // The glyph page tree is a data structure that maps (FontData, glyph page number)
diff --git a/WebCore/platform/graphics/Gradient.cpp b/WebCore/platform/graphics/Gradient.cpp
index 24e8bbf..51c7162 100644
--- a/WebCore/platform/graphics/Gradient.cpp
+++ b/WebCore/platform/graphics/Gradient.cpp
@@ -52,6 +52,7 @@
     , m_r1(r1)
     , m_stopsSorted(false)
     , m_lastStop(0)
+    , m_spreadMethod(SpreadMethodPad)
 {
     platformInit();
 }
diff --git a/WebCore/platform/graphics/GraphicsContext.cpp b/WebCore/platform/graphics/GraphicsContext.cpp
index 8cad794..4dae3d2 100644
--- a/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/WebCore/platform/graphics/GraphicsContext.cpp
@@ -30,7 +30,6 @@
 #include "Generator.h"
 #include "GraphicsContextPrivate.h"
 #include "Font.h"
-#include "NotImplemented.h"
 
 using namespace std;
 
@@ -337,7 +336,7 @@
     BidiResolver<TextRunIterator, BidiCharacterRun> bidiResolver;
     WTF::Unicode::Direction paragraphDirection = run.ltr() ? WTF::Unicode::LeftToRight : WTF::Unicode::RightToLeft;
 
-    bidiResolver.setStatus(BidiStatus(paragraphDirection, paragraphDirection, paragraphDirection, new BidiContext(run.ltr() ? 0 : 1, paragraphDirection, run.directionalOverride())));
+    bidiResolver.setStatus(BidiStatus(paragraphDirection, paragraphDirection, paragraphDirection, BidiContext::create(run.ltr() ? 0 : 1, paragraphDirection, run.directionalOverride())));
 
     bidiResolver.setPosition(TextRunIterator(&run, 0));
     bidiResolver.createBidiRunsForLine(TextRunIterator(&run, run.length()));
diff --git a/WebCore/platform/graphics/GraphicsContext.h b/WebCore/platform/graphics/GraphicsContext.h
index 7c1c4b0..3fdafad 100644
--- a/WebCore/platform/graphics/GraphicsContext.h
+++ b/WebCore/platform/graphics/GraphicsContext.h
@@ -374,6 +374,7 @@
 #if PLATFORM(QT) && defined(Q_WS_WIN)
         HDC getWindowsContext(const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
         void releaseWindowsContext(HDC, const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
+        bool shouldIncludeChildWindows() const { return false; }
 #endif
 
 #if PLATFORM(QT)
diff --git a/WebCore/platform/graphics/GraphicsLayer.h b/WebCore/platform/graphics/GraphicsLayer.h
index f928ce8..ae51951 100644
--- a/WebCore/platform/graphics/GraphicsLayer.h
+++ b/WebCore/platform/graphics/GraphicsLayer.h
@@ -288,8 +288,10 @@
     int incrementRepaintCount() { return ++m_repaintCount; }
 #endif
 
-    // Platform behaviors
-    static bool graphicsContextsFlipped();
+    // Report whether the underlying compositing system uses a top-down
+    // or a bottom-up coordinate system.
+    enum CompositingCoordinatesOrientation { CompositingCoordinatesTopDown, CompositingCoordinatesBottomUp };
+    static CompositingCoordinatesOrientation compositingCoordinatesOrientation();
 
 #ifndef NDEBUG
     static bool showDebugBorders();
diff --git a/WebCore/platform/graphics/Image.h b/WebCore/platform/graphics/Image.h
index 70f6d49..cff8b22 100644
--- a/WebCore/platform/graphics/Image.h
+++ b/WebCore/platform/graphics/Image.h
@@ -61,8 +61,8 @@
 #include <QPixmap>
 #endif
 
-#if PLATFORM(SGL)
-class SkBitmapRef;
+#if PLATFORM(GTK)
+typedef struct _GdkPixbuf GdkPixbuf;
 #endif
 
 namespace WebCore {
@@ -147,10 +147,13 @@
 #endif
 
 #if PLATFORM(SGL)
-    virtual SkBitmapRef* getBitmap() { return 0; }
     virtual void setURL(const String& str) {}
 #endif
 
+#if PLATFORM(GTK)
+    virtual GdkPixbuf* getGdkPixbuf() { return 0; }
+#endif
+
 protected:
     Image(ImageObserver* = 0);
 
diff --git a/WebCore/platform/graphics/ImageBuffer.h b/WebCore/platform/graphics/ImageBuffer.h
index 14f7461..573e274 100644
--- a/WebCore/platform/graphics/ImageBuffer.h
+++ b/WebCore/platform/graphics/ImageBuffer.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,8 +32,8 @@
 #include "IntSize.h"
 #include "ImageBufferData.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
-#include <memory>
 
 namespace WebCore {
 
@@ -46,13 +46,13 @@
     class ImageBuffer : Noncopyable {
     public:
         // Will return a null pointer on allocation failure.
-        static std::auto_ptr<ImageBuffer> create(const IntSize& size, bool grayScale)
+        static PassOwnPtr<ImageBuffer> create(const IntSize& size, bool grayScale)
         {
             bool success = false;
-            std::auto_ptr<ImageBuffer> buf(new ImageBuffer(size, grayScale, success));
+            OwnPtr<ImageBuffer> buf(new ImageBuffer(size, grayScale, success));
             if (success)
-                return buf;
-            return std::auto_ptr<ImageBuffer>();
+                return buf.release();
+            return 0;
         }
 
         ~ImageBuffer();
@@ -80,7 +80,7 @@
         OwnPtr<GraphicsContext> m_context;
         mutable RefPtr<Image> m_image;
 
-        // This constructor will place its succes into the given out-variable
+        // This constructor will place its success into the given out-variable
         // so that create() knows when it should return failure.
         ImageBuffer(const IntSize&, bool grayScale, bool& success);
     };
diff --git a/WebCore/platform/graphics/ImageSource.h b/WebCore/platform/graphics/ImageSource.h
index 07cc2c2..d4a1658 100644
--- a/WebCore/platform/graphics/ImageSource.h
+++ b/WebCore/platform/graphics/ImageSource.h
@@ -31,6 +31,7 @@
 
 #if PLATFORM(WX)
 class wxBitmap;
+class wxGraphicsBitmap;
 #elif PLATFORM(CG)
 typedef struct CGImageSource* CGImageSourceRef;
 typedef struct CGImage* CGImageRef;
@@ -61,7 +62,11 @@
 class ImageDecoder;
 typedef ImageDecoder* NativeImageSourcePtr;
 typedef const Vector<char>* NativeBytePtr;
+#if USE(WXGC)
+typedef wxGraphicsBitmap* NativeImagePtr;
+#else
 typedef wxBitmap* NativeImagePtr;
+#endif
 #elif PLATFORM(CG)
 typedef CGImageSourceRef NativeImageSourcePtr;
 typedef CGImageRef NativeImagePtr;
diff --git a/WebCore/platform/graphics/IntPoint.h b/WebCore/platform/graphics/IntPoint.h
index a05b1f0..1bfeeaa 100644
--- a/WebCore/platform/graphics/IntPoint.h
+++ b/WebCore/platform/graphics/IntPoint.h
@@ -70,6 +70,7 @@
 public:
     IntPoint() : m_x(0), m_y(0) { }
     IntPoint(int x, int y) : m_x(x), m_y(y) { }
+    explicit IntPoint(const IntSize& size) : m_x(size.width()), m_y(size.height()) { }
 
     int x() const { return m_x; }
     int y() const { return m_y; }
diff --git a/WebCore/platform/graphics/IntSize.h b/WebCore/platform/graphics/IntSize.h
index 4d36545..cac0bd1 100644
--- a/WebCore/platform/graphics/IntSize.h
+++ b/WebCore/platform/graphics/IntSize.h
@@ -73,6 +73,12 @@
         m_height += height;
     }
     
+    void scale(float scale)
+    {
+        m_width = static_cast<int>(static_cast<float>(m_width) * scale);
+        m_height = static_cast<int>(static_cast<float>(m_height) * scale);
+    }
+    
     IntSize expandedTo(const IntSize& other) const
     {
         return IntSize(m_width > other.m_width ? m_width : other.m_width,
diff --git a/WebCore/platform/graphics/MediaPlayer.cpp b/WebCore/platform/graphics/MediaPlayer.cpp
index 99d6aa4..b580474 100644
--- a/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/WebCore/platform/graphics/MediaPlayer.cpp
@@ -183,6 +183,7 @@
     , m_visible(false)
     , m_rate(1.0f)
     , m_volume(1.0f)
+    , m_autobuffer(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_playerProxy(0)
 #endif
@@ -206,11 +207,20 @@
     String type = contentType.type();
     String codecs = contentType.parameter("codecs");
 
-    // if we don't know the MIME type, see if the path can help
-    if (type.isEmpty()) 
-        type = MIMETypeRegistry::getMIMETypeForPath(url);
+    // if we don't know the MIME type, see if the extension can help
+    if (type.isEmpty() || type == "application/octet-stream" || type == "text/plain") {
+        int pos = url.reverseFind('.');
+        if (pos >= 0) {
+            String extension = url.substring(pos + 1);
+            String mediaType = MIMETypeRegistry::getMediaMIMETypeForExtension(extension);
+            if (!mediaType.isEmpty())
+                type = mediaType;
+        }
+    }
 
-    MediaPlayerFactory* engine = chooseBestEngineForTypeAndCodecs(type, codecs);
+    MediaPlayerFactory* engine = 0;
+    if (!type.isEmpty())
+        engine = chooseBestEngineForTypeAndCodecs(type, codecs);
 
     // if we didn't find an engine that claims the MIME type, just use the first engine
     if (!engine)
@@ -260,6 +270,11 @@
     return m_private->duration();
 }
 
+float MediaPlayer::startTime() const
+{
+    return m_private->startTime();
+}
+
 float MediaPlayer::currentTime() const
 {
     return m_private->currentTime();
@@ -382,6 +397,19 @@
     m_private->setVisible(b);
 }
 
+bool MediaPlayer::autobuffer() const
+{
+    return m_autobuffer;
+}
+
+void MediaPlayer::setAutobuffer(bool b)
+{
+    if (m_autobuffer != b) {
+        m_autobuffer = b;
+        m_private->setAutobuffer(b);
+    }
+}
+
 void MediaPlayer::paint(GraphicsContext* p, const IntRect& r)
 {
     m_private->paint(p, r);
diff --git a/WebCore/platform/graphics/MediaPlayer.h b/WebCore/platform/graphics/MediaPlayer.h
index 7d90e44..9b2f685 100644
--- a/WebCore/platform/graphics/MediaPlayer.h
+++ b/WebCore/platform/graphics/MediaPlayer.h
@@ -76,6 +76,11 @@
 
     // the movie size has changed
     virtual void mediaPlayerSizeChanged(MediaPlayer*) { }
+
+    // The MediaPlayer has found potentially problematic media content.
+    // This is used internally to trigger swapping from a <video>
+    // element to an <embed> in standalone documents
+    virtual void mediaPlayerSawUnsupportedTracks(MediaPlayer*) { }
 };
 
 class MediaPlayer : Noncopyable {
@@ -88,7 +93,7 @@
     static MediaPlayer::SupportsType supportsType(ContentType contentType);
     static void getSupportedTypes(HashSet<String>&);
     static bool isAvailable();
-    
+
     IntSize naturalSize();
     bool hasVideo();
     
@@ -114,6 +119,8 @@
     float duration() const;
     float currentTime() const;
     void seek(float time);
+
+    float startTime() const;
     
     void setEndTime(float time);
     
@@ -131,7 +138,10 @@
     void setVolume(float);
     
     int dataRate() const;
-    
+
+    bool autobuffer() const;    
+    void setAutobuffer(bool);
+
     void paint(GraphicsContext*, const IntRect&);
     
     enum NetworkState { Empty, Idle, Loading, Loaded, FormatError, NetworkError, DecodeError };
@@ -169,6 +179,7 @@
     bool m_visible;
     float m_rate;
     float m_volume;
+    bool m_autobuffer;
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     WebMediaPlayerProxy* m_playerProxy;    // not owned or used, passed to m_private
 #endif
diff --git a/WebCore/platform/graphics/MediaPlayerPrivate.h b/WebCore/platform/graphics/MediaPlayerPrivate.h
index 2e73e7e..e17259c 100644
--- a/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -58,7 +58,9 @@
     virtual void seek(float time) = 0;
     virtual bool seeking() const = 0;
 
-    virtual void setEndTime(float time) = 0;
+    virtual float startTime() const { return 0; }
+
+    virtual void setEndTime(float) = 0;
 
     virtual void setRate(float) = 0;
     virtual bool paused() const = 0;
@@ -81,6 +83,8 @@
 
     virtual void paint(GraphicsContext*, const IntRect&) = 0 ;
 
+    virtual void setAutobuffer(bool) { };
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     virtual void setPoster(const String& url) = 0;
     virtual void deliverNotification(MediaPlayerProxyNotificationType) = 0;
diff --git a/WebCore/platform/graphics/Path.cpp b/WebCore/platform/graphics/Path.cpp
index f3450be..e30703c 100644
--- a/WebCore/platform/graphics/Path.cpp
+++ b/WebCore/platform/graphics/Path.cpp
@@ -35,7 +35,7 @@
 #include <math.h>
 #include <wtf/MathExtras.h>
 
-const float QUARTER = 0.552f; // approximation of control point positions on a bezier
+static const float QUARTER = 0.552f; // approximation of control point positions on a bezier
                               // to simulate a quarter of a circle.
 namespace WebCore {
 
diff --git a/WebCore/platform/graphics/SimpleFontData.cpp b/WebCore/platform/graphics/SimpleFontData.cpp
index 9f51037..bab7d99 100644
--- a/WebCore/platform/graphics/SimpleFontData.cpp
+++ b/WebCore/platform/graphics/SimpleFontData.cpp
@@ -32,18 +32,24 @@
 
 #include "Font.h"
 #include "FontCache.h"
+
 #if ENABLE(SVG_FONTS)
 #include "SVGFontData.h"
+#include "SVGFontElement.h"
 #include "SVGFontFaceElement.h"
+#include "SVGGlyphElement.h"
 #endif
 
 #include <wtf/MathExtras.h>
+#include <wtf/UnusedParam.h>
+
+using namespace std;
 
 namespace WebCore {
 
 SimpleFontData::SimpleFontData(const FontPlatformData& f, bool customFont, bool loading, SVGFontData* svgFontData)
     : m_unitsPerEm(defaultUnitsPerEm)
-    , m_font(f)
+    , m_platformData(f)
     , m_treatAsFixedPitch(false)
 #if ENABLE(SVG_FONTS)
     , m_svgFontData(svgFontData)
@@ -52,24 +58,40 @@
     , m_isLoading(loading)
     , m_smallCapsFontData(0)
 {
-#if ENABLE(SVG_FONTS)
+#if !ENABLE(SVG_FONTS)
+    UNUSED_PARAM(svgFontData);
+#else
     if (SVGFontFaceElement* svgFontFaceElement = svgFontData ? svgFontData->svgFontFaceElement() : 0) {
-       m_unitsPerEm = svgFontFaceElement->unitsPerEm();
+        m_unitsPerEm = svgFontFaceElement->unitsPerEm();
 
-       double scale = f.size();
-       if (m_unitsPerEm)
-           scale /= m_unitsPerEm;
+        double scale = f.size();
+        if (m_unitsPerEm)
+            scale /= m_unitsPerEm;
 
         m_ascent = static_cast<int>(svgFontFaceElement->ascent() * scale);
         m_descent = static_cast<int>(svgFontFaceElement->descent() * scale);
         m_xHeight = static_cast<int>(svgFontFaceElement->xHeight() * scale);
         m_lineGap = 0.1f * f.size();
         m_lineSpacing = m_ascent + m_descent + m_lineGap;
-    
+
+        SVGFontElement* associatedFontElement = svgFontFaceElement->associatedFontElement();
+
+        Vector<SVGGlyphIdentifier> spaceGlyphs;
+        associatedFontElement->getGlyphIdentifiersForString(String(" ", 1), spaceGlyphs);
+        m_spaceWidth = spaceGlyphs.isEmpty() ? m_xHeight : static_cast<float>(spaceGlyphs.first().horizontalAdvanceX * scale);
+
+        Vector<SVGGlyphIdentifier> numeralZeroGlyphs;
+        associatedFontElement->getGlyphIdentifiersForString(String("0", 1), numeralZeroGlyphs);
+        m_avgCharWidth = numeralZeroGlyphs.isEmpty() ? m_spaceWidth : static_cast<float>(numeralZeroGlyphs.first().horizontalAdvanceX * scale);
+
+        Vector<SVGGlyphIdentifier> letterWGlyphs;
+        associatedFontElement->getGlyphIdentifiersForString(String("W", 1), letterWGlyphs);
+        m_maxCharWidth = letterWGlyphs.isEmpty() ? m_ascent : static_cast<float>(letterWGlyphs.first().horizontalAdvanceX * scale);
+
+        // FIXME: is there a way we can get the space glyph from the SVGGlyphIdentifier above?
         m_spaceGlyph = 0;
-        m_spaceWidth = 0;
-        m_adjustedSpaceWidth = 0;
         determinePitch();
+        m_adjustedSpaceWidth = roundf(m_spaceWidth);
         m_missingGlyphData.fontData = this;
         m_missingGlyphData.glyph = 0;
         return;
@@ -78,9 +100,31 @@
 
     platformInit();
     platformGlyphInit();
+    platformCharWidthInit();
 }
 
 #if !PLATFORM(QT)
+// Estimates of avgCharWidth and maxCharWidth for platforms that don't support accessing these values from the font.
+void SimpleFontData::initCharWidths()
+{
+    GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
+
+    // Treat the width of a '0' as the avgCharWidth.
+    if (m_avgCharWidth <= 0.f && glyphPageZero) {
+        static const UChar32 digitZeroChar = '0';
+        Glyph digitZeroGlyph = glyphPageZero->glyphDataForCharacter(digitZeroChar).glyph;
+        if (digitZeroGlyph)
+            m_avgCharWidth = widthForGlyph(digitZeroGlyph);
+    }
+
+    // If we can't retrieve the width of a '0', fall back to the x height.
+    if (m_avgCharWidth <= 0.f)
+        m_avgCharWidth = m_xHeight;
+
+    if (m_maxCharWidth <= 0.f)
+        m_maxCharWidth = max<float>(m_avgCharWidth, m_ascent);
+}
+
 void SimpleFontData::platformGlyphInit()
 {
     GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
diff --git a/WebCore/platform/graphics/SimpleFontData.h b/WebCore/platform/graphics/SimpleFontData.h
index d2dd0b9..aab6429 100644
--- a/WebCore/platform/graphics/SimpleFontData.h
+++ b/WebCore/platform/graphics/SimpleFontData.h
@@ -61,7 +61,7 @@
     virtual ~SimpleFontData();
 
 public:
-    const FontPlatformData& platformData() const { return m_font; }
+    const FontPlatformData& platformData() const { return m_platformData; }
     SimpleFontData* smallCapsFontData(const FontDescription& fontDescription) const;
 
     // vertical metrics
@@ -69,12 +69,23 @@
     int descent() const { return m_descent; }
     int lineSpacing() const { return m_lineSpacing; }
     int lineGap() const { return m_lineGap; }
+    float maxCharWidth() const { return m_maxCharWidth; }
+    float avgCharWidth() const { return m_avgCharWidth; }
     float xHeight() const { return m_xHeight; }
     unsigned unitsPerEm() const { return m_unitsPerEm; }
 
     float widthForGlyph(Glyph) const;
     float platformWidthForGlyph(Glyph) const;
 
+    float spaceWidth() const { return m_spaceWidth; }
+    float adjustedSpaceWidth() const { return m_adjustedSpaceWidth; }
+
+#if PLATFORM(CG) || PLATFORM(CAIRO)
+    float syntheticBoldOffset() const { return m_syntheticBoldOffset; }
+#endif
+
+    Glyph spaceGlyph() const { return m_spaceGlyph; }
+
     virtual const SimpleFontData* fontDataForCharacter(UChar32) const;
     virtual bool containsCharacters(const UChar*, int length) const;
 
@@ -95,7 +106,7 @@
     const GlyphData& missingGlyphData() const { return m_missingGlyphData; }
 
 #if PLATFORM(MAC)
-    NSFont* getNSFont() const { return m_font.font(); }
+    NSFont* getNSFont() const { return m_platformData.font(); }
 #endif
 
 #if USE(CORE_TEXT)
@@ -114,7 +125,7 @@
 #endif
 
 #if PLATFORM(QT)
-    QFont getQtFont() const { return m_font.font(); }
+    QFont getQtFont() const { return m_platformData.font(); }
 #endif
 
 #if PLATFORM(WIN)
@@ -131,14 +142,17 @@
 #endif
 
 #if PLATFORM(WX)
-    wxFont* getWxFont() const { return m_font.font(); }
+    wxFont* getWxFont() const { return m_platformData.font(); }
 #endif
 
 private:
     void platformInit();
     void platformGlyphInit();
+    void platformCharWidthInit();
     void platformDestroy();
     
+    void initCharWidths();
+
     void commonInit();
 
 #if PLATFORM(WIN)
@@ -147,15 +161,16 @@
     float widthForGDIGlyph(Glyph glyph) const;
 #endif
 
-public:
     int m_ascent;
     int m_descent;
     int m_lineSpacing;
     int m_lineGap;
+    float m_maxCharWidth;
+    float m_avgCharWidth;
     float m_xHeight;
     unsigned m_unitsPerEm;
 
-    FontPlatformData m_font;
+    FontPlatformData m_platformData;
 
     mutable GlyphWidthMap m_glyphToWidthMap;
 
@@ -176,22 +191,26 @@
 
     mutable SimpleFontData* m_smallCapsFontData;
 
-#if PLATFORM(CG) || PLATFORM(WIN)
+#if PLATFORM(CG) || PLATFORM(CAIRO)
     float m_syntheticBoldOffset;
 #endif
 
-#if PLATFORM(MAC)
 #ifdef BUILDING_ON_TIGER
+public:
     void* m_styleGroup;
-#endif
+
+private:
 #endif
 
 #if USE(ATSUI)
+public:
     mutable ATSUStyle m_ATSUStyle;
     mutable bool m_ATSUStyleInitialized;
     mutable bool m_ATSUMirrors;
     mutable bool m_checkedShapesArabic;
     mutable bool m_shapesArabic;
+
+private:
 #endif
 
 #if USE(CORE_TEXT)
diff --git a/WebCore/platform/graphics/WidthIterator.cpp b/WebCore/platform/graphics/WidthIterator.cpp
index a16d739..9157310 100644
--- a/WebCore/platform/graphics/WidthIterator.cpp
+++ b/WebCore/platform/graphics/WidthIterator.cpp
@@ -39,13 +39,14 @@
 // According to http://www.unicode.org/Public/UNIDATA/UCD.html#Canonical_Combining_Class_Values
 static const uint8_t hiraganaKatakanaVoicingMarksCombiningClass = 8;
 
-WidthIterator::WidthIterator(const Font* font, const TextRun& run)
+WidthIterator::WidthIterator(const Font* font, const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts)
     : m_font(font)
     , m_run(run)
     , m_end(run.length())
     , m_currentCharacter(0)
     , m_runWidthSoFar(0)
     , m_finalRoundingWidth(0)
+    , m_fallbackFonts(fallbackFonts)
 {
     // If the padding is non-zero, count the number of spaces in the run
     // and divide that by the padding for per space addition.
@@ -78,7 +79,10 @@
 
     float runWidthSoFar = m_runWidthSoFar;
     float lastRoundingWidth = m_finalRoundingWidth;
-    
+
+    const SimpleFontData* primaryFont = m_font->primaryFont();
+    const SimpleFontData* lastFontData = primaryFont;
+
     while (currentCharacter < offset) {
         UChar32 c = *cp;
         unsigned clusterLength = 1;
@@ -126,16 +130,29 @@
             // First, we round spaces to an adjusted width in all fonts.
             // Second, in fixed-pitch fonts we ensure that all characters that
             // match the width of the space character have the same width as the space character.
-            if (width == fontData->m_spaceWidth && (fontData->m_treatAsFixedPitch || glyph == fontData->m_spaceGlyph) && m_run.applyWordRounding()) {
-                width = fontData->m_adjustedSpaceWidth;
+            if (width == fontData->spaceWidth() && (fontData->pitch() == FixedPitch || glyph == fontData->spaceGlyph()) && m_run.applyWordRounding())
+                width = fontData->adjustedSpaceWidth();
+        }
+
+        if (fontData != lastFontData && width) {
+            lastFontData = fontData;
+            if (m_fallbackFonts && fontData != primaryFont) {
+                // FIXME: This does a little extra work that could be avoided if
+                // glyphDataForCharacter() returned whether it chose to use a small caps font.
+                if (!m_font->isSmallCaps() || c == toUpper(c))
+                    m_fallbackFonts->add(fontData);
+                else {
+                    const GlyphData& uppercaseGlyphData = m_font->glyphDataForCharacter(toUpper(c), rtl);
+                    if (uppercaseGlyphData.fontData != primaryFont)
+                        m_fallbackFonts->add(uppercaseGlyphData.fontData);
+                }
             }
         }
 
         if (hasExtraSpacing) {
             // Account for letter-spacing.
-            if (width && m_font->letterSpacing()) {
+            if (width && m_font->letterSpacing())
                 width += m_font->letterSpacing();
-            }
 
             if (Font::treatAsSpace(c)) {
                 // Account for padding. WebCore uses space padding to justify text.
@@ -153,9 +170,8 @@
 
                 // Account for word spacing.
                 // We apply additional space between "words" by adding width to the space character.
-                if (currentCharacter != 0 && !Font::treatAsSpace(cp[-1]) && m_font->wordSpacing()) {
+                if (currentCharacter != 0 && !Font::treatAsSpace(cp[-1]) && m_font->wordSpacing())
                     width += m_font->wordSpacing();
-                }
             }
         }
 
@@ -172,9 +188,8 @@
 
         // Force characters that are used to determine word boundaries for the rounding hack
         // to be integer width, so following words will start on an integer boundary.
-        if (m_run.applyWordRounding() && Font::isRoundingHackCharacter(c)) {
+        if (m_run.applyWordRounding() && Font::isRoundingHackCharacter(c))
             width = ceilf(width);
-        }
 
         // Check to see if the next character is a "rounding hack character", if so, adjust
         // width so that the total run width will be on an integer boundary.
diff --git a/WebCore/platform/graphics/WidthIterator.h b/WebCore/platform/graphics/WidthIterator.h
index 5706d1e..7ca4198 100644
--- a/WebCore/platform/graphics/WidthIterator.h
+++ b/WebCore/platform/graphics/WidthIterator.h
@@ -22,16 +22,18 @@
 #ifndef WidthIterator_h
 #define WidthIterator_h
 
+#include <wtf/HashSet.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
 
 class Font;
 class GlyphBuffer;
+class SimpleFontData;
 class TextRun;
 
 struct WidthIterator {
-    WidthIterator(const Font*, const TextRun&);
+    WidthIterator(const Font*, const TextRun&, HashSet<const SimpleFontData*>* fallbackFonts = 0);
 
     void advance(int to, GlyphBuffer* = 0);
     bool advanceOneCharacter(float& width, GlyphBuffer* = 0);
@@ -49,6 +51,7 @@
 
 private:
     UChar32 normalizeVoicingMarks(int currentCharacter);
+    HashSet<const SimpleFontData*>* m_fallbackFonts;
 };
 
 }
diff --git a/WebCore/platform/graphics/android/FontAndroid.cpp b/WebCore/platform/graphics/android/FontAndroid.cpp
index ca2fca1..a430b07 100644
--- a/WebCore/platform/graphics/android/FontAndroid.cpp
+++ b/WebCore/platform/graphics/android/FontAndroid.cpp
@@ -107,6 +107,11 @@
     return true;
 }
 
+bool Font::canReturnFallbackFontsForComplexText()
+{
+    return false;
+}
+
 void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
                       const GlyphBuffer& glyphBuffer,  int from, int numGlyphs,
                       const FloatPoint& point) const
@@ -206,7 +211,7 @@
                      paint);
 }
 
-float Font::floatWidthForComplexText(const TextRun& run) const
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>*) const
 {
     SkPaint paint;
 
diff --git a/WebCore/platform/graphics/android/FontDataAndroid.cpp b/WebCore/platform/graphics/android/FontDataAndroid.cpp
index 3d31eaf..2bb53e4 100644
--- a/WebCore/platform/graphics/android/FontDataAndroid.cpp
+++ b/WebCore/platform/graphics/android/FontDataAndroid.cpp
@@ -48,7 +48,7 @@
     SkPaint  paint;
     SkPaint::FontMetrics metrics;
     
-    m_font.setupPaint(&paint);
+    m_platformData.setupPaint(&paint);
     (void)paint.getFontMetrics(&metrics);
 
     // use ceil instead of round to favor descent, given a lot of accidental
@@ -64,6 +64,13 @@
     m_lineGap = SkScalarRound(metrics.fLeading);
 }
 
+void SimpleFontData::platformCharWidthInit()
+{
+    m_avgCharWidth = 0.f;
+    m_maxCharWidth = 0.f;
+    initCharWidths();
+}
+
 void SimpleFontData::platformDestroy()
 {
     delete m_smallCapsFontData;
@@ -72,7 +79,7 @@
 SimpleFontData* SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
 {
     if (!m_smallCapsFontData) {
-        m_smallCapsFontData = new SimpleFontData(FontPlatformData(m_font, fontDescription.computedSize() * 0.7f));
+        m_smallCapsFontData = new SimpleFontData(FontPlatformData(m_platformData, fontDescription.computedSize() * 0.7f));
     }
     return m_smallCapsFontData;
 }
@@ -84,7 +91,7 @@
     SkPaint     paint;
     uint16_t    glyphs[kMaxBufferCount];
 
-    m_font.setupPaint(&paint);
+    m_platformData.setupPaint(&paint);
     paint.setTextEncoding(SkPaint::kUTF16_TextEncoding);
 
     while (length > 0) {
@@ -114,7 +121,7 @@
 
     SkPaint  paint;
 
-    m_font.setupPaint(&paint);
+    m_platformData.setupPaint(&paint);
 
     if (EmojiFont::IsEmojiGlyph(glyph))
         return EmojiFont::GetAdvanceWidth(glyph, paint);
diff --git a/WebCore/platform/graphics/cairo/FontCairo.cpp b/WebCore/platform/graphics/cairo/FontCairo.cpp
index b23182d..0f7ae79 100644
--- a/WebCore/platform/graphics/cairo/FontCairo.cpp
+++ b/WebCore/platform/graphics/cairo/FontCairo.cpp
@@ -36,6 +36,8 @@
 #include "SimpleFontData.h"
 #include "TransformationMatrix.h"
 
+#define SYNTHETIC_OBLIQUE_ANGLE 14
+
 namespace WebCore {
 
 void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, const GlyphBuffer& glyphBuffer,
@@ -48,15 +50,23 @@
 
     GlyphBufferGlyph* glyphs = (GlyphBufferGlyph*)glyphBuffer.glyphs(from);
 
-    float offset = point.x();
+    float offset = 0.0f;
     for (int i = 0; i < numGlyphs; i++) {
         glyphs[i].x = offset;
-        glyphs[i].y = point.y();
+        glyphs[i].y = 0.0f;
         offset += glyphBuffer.advanceAt(from + i);
     }
 
     Color fillColor = context->fillColor();
 
+    // Synthetic Oblique
+    if(font->platformData().syntheticOblique()) {
+        cairo_matrix_t mat = {1, 0, -tanf(SYNTHETIC_OBLIQUE_ANGLE * acosf(0) / 90), 1, point.x(), point.y()};
+        cairo_transform(cr, &mat);
+    } else {
+        cairo_translate(cr, point.x(), point.y());
+    }
+
     // Text shadow, inspired by FontMac
     IntSize shadowSize;
     int shadowBlur = 0;
@@ -77,6 +87,12 @@
 
         cairo_translate(cr, shadowSize.width(), shadowSize.height());
         cairo_show_glyphs(cr, glyphs, numGlyphs);
+        if (font->syntheticBoldOffset()) {
+            cairo_save(cr);
+            cairo_translate(cr, font->syntheticBoldOffset(), 0);
+            cairo_show_glyphs(cr, glyphs, numGlyphs);
+            cairo_restore(cr);
+        }
 
         cairo_restore(cr);
     }
@@ -103,6 +119,12 @@
             cairo_set_source_rgba(cr, red, green, blue, alpha * context->getAlpha());
         }
         cairo_show_glyphs(cr, glyphs, numGlyphs);
+        if (font->syntheticBoldOffset()) {
+            cairo_save(cr);
+            cairo_translate(cr, font->syntheticBoldOffset(), 0);
+            cairo_show_glyphs(cr, glyphs, numGlyphs);
+            cairo_restore(cr);
+        }
     }
 
     if (context->textDrawingMode() & cTextStroke) {
diff --git a/WebCore/platform/graphics/cairo/GradientCairo.cpp b/WebCore/platform/graphics/cairo/GradientCairo.cpp
index 72fb0c5..0aada55 100644
--- a/WebCore/platform/graphics/cairo/GradientCairo.cpp
+++ b/WebCore/platform/graphics/cairo/GradientCairo.cpp
@@ -80,11 +80,11 @@
 {
     cairo_t* cr = context->platformContext();
 
-    cairo_save(cr);
+    context->save();
     cairo_set_source(cr, platformGradient());
     cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
     cairo_fill(cr);
-    cairo_restore(cr);
+    context->restore();
 }
 
 } //namespace
diff --git a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index 35ebd3c..23f30f3 100644
--- a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -92,6 +92,7 @@
     , m_data(new GraphicsContextPlatformPrivate)
 {
     m_data->cr = cairo_reference(cr);
+    m_data->syncContext(cr);
     setPaintingDisabled(!cr);
 }
 
diff --git a/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h b/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
index 55b2e25..531ebf4 100644
--- a/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
+++ b/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
@@ -73,6 +73,7 @@
     void concatCTM(const TransformationMatrix&);
     void beginTransparencyLayer() { m_transparencyCount++; }
     void endTransparencyLayer() { m_transparencyCount--; }
+    void syncContext(PlatformGraphicsContext* cr);
 #else
     // On everything else, we do nothing.
     void save() {}
@@ -85,6 +86,7 @@
     void concatCTM(const TransformationMatrix&) {}
     void beginTransparencyLayer() {}
     void endTransparencyLayer() {}
+    void syncContext(PlatformGraphicsContext* cr) {}
 #endif
 
     cairo_t* cr;
diff --git a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index dff39b7..d2652d6 100644
--- a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -34,7 +34,6 @@
 #include "GraphicsContext.h"
 #include "ImageData.h"
 #include "MIMETypeRegistry.h"
-#include "NotImplemented.h"
 #include "Pattern.h"
 #include "PlatformString.h"
 
diff --git a/WebCore/platform/graphics/cairo/ImageCairo.cpp b/WebCore/platform/graphics/cairo/ImageCairo.cpp
index 224154e..7c34e6f 100644
--- a/WebCore/platform/graphics/cairo/ImageCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ImageCairo.cpp
@@ -33,10 +33,12 @@
 #include "Color.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
+#include "ImageBuffer.h"
 #include "ImageObserver.h"
 #include "TransformationMatrix.h"
 #include <cairo.h>
 #include <math.h>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
@@ -89,15 +91,19 @@
 
 void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const FloatRect& src, CompositeOperator op)
 {
+    FloatRect srcRect(src);
+    FloatRect dstRect(dst);
+
+    if (dstRect.width() == 0.0f || dstRect.height() == 0.0f ||
+        srcRect.width() == 0.0f || srcRect.height() == 0.0f)
+        return;
+
     startAnimation();
 
     cairo_surface_t* image = frameAtIndex(m_currentFrame);
     if (!image) // If it's too early we won't have an image yet.
         return;
 
-    FloatRect srcRect(src);
-    FloatRect dstRect(dst);
-
     if (mayFillWithSolidColor()) {
         fillWithSolidColor(context, dstRect, solidColor(), op);
         return;
@@ -106,7 +112,7 @@
     IntSize selfSize = size();
 
     cairo_t* cr = context->platformContext();
-    cairo_save(cr);
+    context->save();
 
     // Set the compositing operation.
     if (op == CompositeSourceOver && !frameHasAlphaAtIndex(m_currentFrame))
@@ -138,7 +144,7 @@
     cairo_clip(cr);
     cairo_paint_with_alpha(cr, context->getAlpha());
 
-    cairo_restore(cr);
+    context->restore();
 
     if (imageObserver())
         imageObserver()->didDraw(this);
@@ -154,7 +160,18 @@
     cairo_t* cr = context->platformContext();
     context->save();
 
-    // TODO: Make use of tileRect.
+    IntRect imageSize = enclosingIntRect(tileRect);
+    OwnPtr<ImageBuffer> imageSurface = ImageBuffer::create(imageSize.size(), false);
+
+    if (!imageSurface)
+        return;
+
+    if (tileRect.size() != size()) {
+        cairo_t* clippedImageContext = imageSurface->context()->platformContext();
+        cairo_set_source_surface(clippedImageContext, image, -tileRect.x(), -tileRect.y());
+        cairo_paint(clippedImageContext);
+        image = imageSurface->image()->nativeImageForCurrentFrame();
+    }
 
     cairo_pattern_t* pattern = cairo_pattern_create_for_surface(image);
     cairo_pattern_set_extend(pattern, CAIRO_EXTEND_REPEAT);
@@ -163,7 +180,7 @@
     cairo_pattern_set_filter(pattern, CAIRO_FILTER_NEAREST);
 
     cairo_matrix_t pattern_matrix = cairo_matrix_t(patternTransform);
-    cairo_matrix_t phase_matrix = {1, 0, 0, 1, phase.x(), phase.y()};
+    cairo_matrix_t phase_matrix = {1, 0, 0, 1, phase.x() + tileRect.x() * patternTransform.a(), phase.y() + tileRect.y() * patternTransform.d()};
     cairo_matrix_t combined;
     cairo_matrix_multiply(&combined, &pattern_matrix, &phase_matrix);
     cairo_matrix_invert(&combined);
diff --git a/WebCore/platform/graphics/cairo/ImageSourceCairo.cpp b/WebCore/platform/graphics/cairo/ImageSourceCairo.cpp
index c6d54f2..b51caf6 100644
--- a/WebCore/platform/graphics/cairo/ImageSourceCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ImageSourceCairo.cpp
@@ -190,13 +190,13 @@
 
     // Cairo does not like zero height images.
     // If we have a zero height image, just pretend we don't have enough data yet.
-    if (!buffer->height())
+    if (!size().height())
         return 0;
 
     return cairo_image_surface_create_for_data((unsigned char*)buffer->bytes().data(),
                                                CAIRO_FORMAT_ARGB32,
                                                size().width(),
-                                               buffer->height(),
+                                               size().height(),
                                                size().width()*4);
 }
 
diff --git a/WebCore/platform/graphics/cairo/PathCairo.cpp b/WebCore/platform/graphics/cairo/PathCairo.cpp
index 24354d2..13ca1e2 100644
--- a/WebCore/platform/graphics/cairo/PathCairo.cpp
+++ b/WebCore/platform/graphics/cairo/PathCairo.cpp
@@ -29,7 +29,6 @@
 #include "CairoPath.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
-#include "NotImplemented.h"
 #include "PlatformString.h"
 #include "StrokeStyleApplier.h"
 
diff --git a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index 4b8a555..ab8eb3c 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -116,10 +116,9 @@
 
     CGContextRef context = platformContext();
 
-    if (fillColor().alpha())
-        CGContextFillRect(context, rect);
+    CGContextFillRect(context, rect);
 
-    if (strokeStyle() != NoStroke && strokeColor().alpha()) {
+    if (strokeStyle() != NoStroke) {
         // We do a fill of four rects to simulate the stroke of a border.
         Color oldFillColor = fillColor();
         if (oldFillColor != strokeColor())
@@ -142,7 +141,7 @@
     if (paintingDisabled())
         return;
 
-    if (strokeStyle() == NoStroke || !strokeColor().alpha())
+    if (strokeStyle() == NoStroke)
         return;
 
     float width = strokeThickness();
@@ -277,7 +276,7 @@
 
 void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSpan)
 { 
-    if (paintingDisabled() || strokeStyle() == NoStroke || strokeThickness() <= 0.0f || !strokeColor().alpha())
+    if (paintingDisabled() || strokeStyle() == NoStroke || strokeThickness() <= 0.0f)
         return;
     
     CGContextRef context = platformContext();
@@ -366,7 +365,7 @@
 
 void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points, bool antialiased)
 {
-    if (paintingDisabled() || !fillColor().alpha() && (strokeThickness() <= 0 || strokeStyle() == NoStroke))
+    if (paintingDisabled())
         return;
 
     if (npoints <= 1)
@@ -491,8 +490,7 @@
     CGContextRef context = platformContext();
     switch (m_common->state.fillColorSpace) {
     case SolidColorSpace:
-        if (fillColor().alpha())
-            fillPathWithFillRule(context, fillRule());
+        fillPathWithFillRule(context, fillRule());
         break;
     case PatternColorSpace:
         applyFillPattern();
@@ -519,8 +517,7 @@
     CGContextRef context = platformContext();
     switch (m_common->state.strokeColorSpace) {
     case SolidColorSpace:
-        if (strokeColor().alpha())
-            CGContextStrokePath(context);
+        CGContextStrokePath(context);
         break;
     case PatternColorSpace:
         applyStrokePattern();
@@ -544,8 +541,7 @@
     CGContextRef context = platformContext();
     switch (m_common->state.fillColorSpace) {
     case SolidColorSpace:
-        if (fillColor().alpha())
-            CGContextFillRect(context, rect);
+        CGContextFillRect(context, rect);
         break;
     case PatternColorSpace:
         applyFillPattern();
@@ -565,20 +561,18 @@
 {
     if (paintingDisabled())
         return;
-    if (color.alpha()) {
-        CGContextRef context = platformContext();
-        Color oldFillColor = fillColor();
-        if (oldFillColor != color)
-            setCGFillColor(context, color);
-        CGContextFillRect(context, rect);
-        if (oldFillColor != color)
-            setCGFillColor(context, oldFillColor);
-    }
+    CGContextRef context = platformContext();
+    Color oldFillColor = fillColor();
+    if (oldFillColor != color)
+      setCGFillColor(context, color);
+    CGContextFillRect(context, rect);
+    if (oldFillColor != color)
+      setCGFillColor(context, oldFillColor);
 }
 
 void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
 {
-    if (paintingDisabled() || !color.alpha())
+    if (paintingDisabled())
         return;
 
     CGContextRef context = platformContext();
@@ -782,8 +776,7 @@
     CGContextRef context = platformContext();
     switch (m_common->state.strokeColorSpace) {
     case SolidColorSpace:
-        if (strokeColor().alpha())
-            CGContextStrokeRectWithWidth(context, r, lineWidth);
+        CGContextStrokeRectWithWidth(context, r, lineWidth);
         break;
     case PatternColorSpace:
         applyStrokePattern();
@@ -1199,4 +1192,3 @@
 #endif
 
 }
-
diff --git a/WebCore/platform/graphics/cg/ImageSourceCG.cpp b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
index c059985..7cb8799 100644
--- a/WebCore/platform/graphics/cg/ImageSourceCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
@@ -33,10 +33,12 @@
 #include "MIMETypeRegistry.h"
 #include "SharedBuffer.h"
 #include <ApplicationServices/ApplicationServices.h>
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
 static const CFStringRef kCGImageSourceShouldPreferRGB32 = CFSTR("kCGImageSourceShouldPreferRGB32");
+static const CFStringRef kCGImageSourceDoNotCacheImageBlocks = CFSTR("kCGImageSourceDoNotCacheImageBlocks");
 
 ImageSource::ImageSource()
     : m_decoder(0)
@@ -48,11 +50,24 @@
     clear(true);
 }
 
-void ImageSource::clear(bool, size_t, SharedBuffer* data, bool allDataReceived)
+void ImageSource::clear(bool destroyAllFrames, size_t, SharedBuffer* data, bool allDataReceived)
 {
-    // We always destroy the decoder, because there is no API to get it to
-    // selectively release some of the frames it's holding, and if we don't
-    // release any of them, we use too much memory on large images.
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    // Recent versions of ImageIO discard previously decoded image frames if the client
+    // application no longer holds references to them, so there's no need to throw away
+    // the decoder unless we're explicitly asked to destroy all of the frames.
+
+    if (!destroyAllFrames)
+        return;
+#else
+    // Older versions of ImageIO hold references to previously decoded image frames.
+    // There is no API to selectively release some of the frames it is holding, and
+    // if we don't release the frames we use too much memory on large images.
+    // Destroying the decoder is the only way to release previous frames.
+
+    UNUSED_PARAM(destroyAllFrames);
+#endif
+
     if (m_decoder) {
         CFRelease(m_decoder);
         m_decoder = 0;
@@ -66,9 +81,9 @@
     static CFDictionaryRef options;
     
     if (!options) {
-        const void* keys[2] = { kCGImageSourceShouldCache, kCGImageSourceShouldPreferRGB32 };
-        const void* values[2] = { kCFBooleanTrue, kCFBooleanTrue };
-        options = CFDictionaryCreate(NULL, keys, values, 2, 
+        const void* keys[3] = { kCGImageSourceShouldCache, kCGImageSourceShouldPreferRGB32, kCGImageSourceDoNotCacheImageBlocks };
+        const void* values[3] = { kCFBooleanTrue, kCFBooleanTrue, kCFBooleanTrue };
+        options = CFDictionaryCreate(NULL, keys, values, 3, 
             &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
     }
     return options;
@@ -227,9 +242,17 @@
 
 bool ImageSource::frameHasAlphaAtIndex(size_t)
 {
-    // Might be interesting to do this optimization on Mac some day, but for now we're just using this
-    // for the Cairo source, since it uses our decoders, and our decoders can answer this question.
-    // FIXME: Could return false for JPEG and other non-transparent image formats.
+    if (!m_decoder)
+        return false;
+
+    CFStringRef imageType = CGImageSourceGetType(m_decoder);
+
+    // Return false if there is no image type or the image type is JPEG, because
+    // JPEG does not support alpha transparency.
+    if (!imageType || CFEqual(imageType, CFSTR("public.jpeg")))
+        return false;
+
+    // FIXME: Could return false for other non-transparent image formats.
     // FIXME: Could maybe return false for a GIF Frame if we have enough info in the GIF properties dictionary
     // to determine whether or not a transparent color was defined.
     return true;
diff --git a/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp b/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
index 129776e..bf1cd2e 100644
--- a/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
@@ -414,14 +414,6 @@
 FontPlatformData* FontCache::getLastResortFallbackFont(const FontDescription& description)
 {
     FontDescription::GenericFamilyType generic = description.genericFamily();
-    // FIXME: Mapping webkit generic to GenericFamilyType needs to
-    // be more intelligent. 
-    // This spot rarely gets reached. GetFontDataForCharacters() gets hit a lot
-    // more often (see FIXME comment there). 
-    const wchar_t* family = getFontFamilyForScript(description.dominantScript(), generic);
-
-    if (family)
-        return getCachedFontPlatformData(description, AtomicString(family, wcslen(family)));
 
     // FIXME: Would be even better to somehow get the user's default font here.
     // For now we'll pick the default that the user would get without changing
@@ -455,13 +447,6 @@
     return gdiFontWeights[fontWeight];
 }
 
-// FIXME: This may not be the best place to put this function
-AtomicString FontCache::getGenericFontForScript(UScriptCode script, const FontDescription& description)
-{
-    const wchar_t* scriptFont = getFontFamilyForScript( script, description.genericFamily());
-    return scriptFont ? AtomicString(scriptFont, wcslen(scriptFont)) : emptyAtom;
-}
-
 static void FillLogFont(const FontDescription& fontDescription, LOGFONT* winfont)
 {
     // The size here looks unusual.  The negative number is intentional.
diff --git a/WebCore/platform/graphics/chromium/FontCacheLinux.cpp b/WebCore/platform/graphics/chromium/FontCacheLinux.cpp
index 89433e1..797825e 100644
--- a/WebCore/platform/graphics/chromium/FontCacheLinux.cpp
+++ b/WebCore/platform/graphics/chromium/FontCacheLinux.cpp
@@ -46,6 +46,8 @@
 #include "SkTypeface.h"
 #include "SkUtils.h"
 
+#include <wtf/Assertions.h>
+
 namespace WebCore {
 
 void FontCache::platformInit()
@@ -79,9 +81,8 @@
     if (match) {
         FcChar8* family;
         if (FcPatternGetString(match, FC_FAMILY, 0, &family) == FcResultMatch) {
-            FontPlatformData* fpd =
-                createFontPlatformData(font.fontDescription(), AtomicString((char*) family));
-            ret = new SimpleFontData(*fpd);
+            AtomicString fontFamily(reinterpret_cast<char*>(family));
+            ret = getCachedFontData(getCachedFontPlatformData(font.fontDescription(), fontFamily, false));
         }
         FcPatternDestroy(match);
     }
@@ -98,8 +99,26 @@
 
 FontPlatformData* FontCache::getLastResortFallbackFont(const FontDescription& description)
 {
-    static AtomicString arialStr("Arial");
-    return getCachedFontPlatformData(description, arialStr);
+    static const AtomicString sansStr("Sans");
+    static const AtomicString serifStr("Serif");
+    static const AtomicString monospaceStr("Monospace");
+
+    FontPlatformData* fontPlatformData = 0;
+    switch (description.genericFamily()) {
+    case FontDescription::SerifFamily:
+        fontPlatformData = getCachedFontPlatformData(description, serifStr);
+        break;
+    case FontDescription::MonospaceFamily:
+        fontPlatformData = getCachedFontPlatformData(description, monospaceStr);
+        break;
+    case FontDescription::SansSerifFamily:
+    default:
+        fontPlatformData = getCachedFontPlatformData(description, sansStr);
+        break;
+    }
+
+    ASSERT(fontPlatformData);
+    return fontPlatformData;
 }
 
 void FontCache::getTraitsInFamily(const AtomicString& familyName,
@@ -146,7 +165,13 @@
     if (fontDescription.italic())
         style |= SkTypeface::kItalic;
 
+    // FIXME:  This #ifdef can go away once we're firmly using the new Skia.
+    // During the transition, this makes the code compatible with both versions.
+#ifdef SK_USE_OLD_255_TO_256
+    SkTypeface* tf = SkTypeface::CreateFromName(name, static_cast<SkTypeface::Style>(style));
+#else
     SkTypeface* tf = SkTypeface::Create(name, static_cast<SkTypeface::Style>(style));
+#endif
     if (!tf)
         return 0;
 
@@ -159,11 +184,4 @@
     return result;
 }
 
-AtomicString FontCache::getGenericFontForScript(UScriptCode script,
-                                                const FontDescription& descript)
-{
-    notImplemented();
-    return AtomicString();
-}
-
 }  // namespace WebCore
diff --git a/WebCore/platform/graphics/chromium/FontChromiumWin.cpp b/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
index 1b71946..4710245 100644
--- a/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
@@ -249,10 +249,28 @@
     // to subtract off the font ascent to get it.
     int x = lroundf(m_point.x() + startAdvance);
     int y = lroundf(m_point.y() - m_font->ascent());
+
+    // If there is a non-blur shadow and both the fill color and shadow color 
+    // are opaque, handle without skia. 
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (m_graphicsContext->getShadow(shadowSize, shadowBlur, shadowColor)) {
+        // If there is a shadow and this code is reached, windowsCanHandleDrawTextShadow()
+        // will have already returned true during the ctor initiatization of m_useGDI
+        ASSERT(shadowColor.alpha() == 255);
+        ASSERT(m_graphicsContext->fillColor().alpha() == 255);
+        ASSERT(shadowBlur == 0);
+        COLORREF textColor = skia::SkColorToCOLORREF(SkColorSetARGB(255, shadowColor.red(), shadowColor.green(), shadowColor.blue()));
+        COLORREF savedTextColor = GetTextColor(m_hdc);
+        SetTextColor(m_hdc, textColor);
+        ExtTextOut(m_hdc, x + shadowSize.width(), y + shadowSize.height(), ETO_GLYPH_INDEX, 0, reinterpret_cast<const wchar_t*>(&glyphs[0]), numGlyphs, &advances[0]);
+        SetTextColor(m_hdc, savedTextColor); 
+    }
+    
     return !!ExtTextOut(m_hdc, x, y, ETO_GLYPH_INDEX, 0, reinterpret_cast<const wchar_t*>(&glyphs[0]), numGlyphs, &advances[0]);
 }
 
-
 class TransparencyAwareUniscribePainter : public TransparencyAwareFontPainter {
  public:
     TransparencyAwareUniscribePainter(GraphicsContext*,
@@ -305,6 +323,10 @@
     UniscribeHelperTextRun state(m_run, *m_font);
     int left = lroundf(m_point.x()) + state.characterToX(m_from);
     int right = lroundf(m_point.x()) + state.characterToX(m_to);
+    
+    // Adjust for RTL script since we just want to know the text bounds.
+    if (left > right)
+        std::swap(left, right);
 
     // This algorithm for estimating how much extra space we need (the text may
     // go outside the selection rect) is based roughly on
@@ -317,6 +339,11 @@
 
 }  // namespace
 
+bool Font::canReturnFallbackFontsForComplexText()
+{
+    return false;
+}
+
 void Font::drawGlyphs(GraphicsContext* graphicsContext,
                       const SimpleFontData* font,
                       const GlyphBuffer& glyphBuffer,
@@ -416,6 +443,20 @@
     SetTextColor(hdc, skia::SkColorToCOLORREF(color));
     SetBkMode(hdc, TRANSPARENT);
 
+    // If there is a non-blur shadow and both the fill color and shadow color 
+    // are opaque, handle without skia. 
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (graphicsContext->getShadow(shadowSize, shadowBlur, shadowColor) && windowsCanHandleDrawTextShadow(graphicsContext)) {
+        COLORREF textColor = skia::SkColorToCOLORREF(SkColorSetARGB(255, shadowColor.red(), shadowColor.green(), shadowColor.blue()));
+        COLORREF savedTextColor = GetTextColor(hdc);
+        SetTextColor(hdc, textColor);
+        state.draw(graphicsContext, hdc, static_cast<int>(point.x()) + shadowSize.width(),
+                   static_cast<int>(point.y() - ascent()) + shadowSize.height(), from, to);
+        SetTextColor(hdc, savedTextColor); 
+    }
+
     // Uniscribe counts the coordinates from the upper left, while WebKit uses
     // the baseline, so we have to subtract off the ascent.
     state.draw(graphicsContext, hdc, static_cast<int>(point.x()),
@@ -424,7 +465,7 @@
     context->canvas()->endPlatformPaint();
 }
 
-float Font::floatWidthForComplexText(const TextRun& run) const
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* /* fallbackFonts */) const
 {
     UniscribeHelperTextRun state(run, *this);
     return static_cast<float>(state.width());
diff --git a/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp b/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp
index 1e923ac..e99c12a 100644
--- a/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp
@@ -116,7 +116,7 @@
 // Streams the concatenation of a header and font data.
 class EOTStream {
 public:
-    EOTStream(const Vector<uint8_t, 512>& eotHeader, const SharedBuffer* fontData, size_t overlayDst, size_t overlaySrc, size_t overlayLength)
+    EOTStream(const EOTHeader& eotHeader, const SharedBuffer* fontData, size_t overlayDst, size_t overlaySrc, size_t overlayLength)
         : m_eotHeader(eotHeader)
         , m_fontData(fontData)
         , m_overlayDst(overlayDst)
@@ -130,7 +130,7 @@
     size_t read(void* buffer, size_t count);
 
 private:
-    const Vector<uint8_t, 512>& m_eotHeader;
+    const EOTHeader& m_eotHeader;
     const SharedBuffer* m_fontData;
     size_t m_overlayDst;
     size_t m_overlaySrc;
@@ -200,7 +200,7 @@
 
     // TTLoadEmbeddedFont works only with Embedded OpenType (.eot) data,
     // so we need to create an EOT header and prepend it to the font data.
-    Vector<uint8_t, 512> eotHeader;
+    EOTHeader eotHeader;
     size_t overlayDst;
     size_t overlaySrc;
     size_t overlayLength;
diff --git a/WebCore/platform/graphics/chromium/FontLinux.cpp b/WebCore/platform/graphics/chromium/FontLinux.cpp
index 2b7c562..a952685 100644
--- a/WebCore/platform/graphics/chromium/FontLinux.cpp
+++ b/WebCore/platform/graphics/chromium/FontLinux.cpp
@@ -46,6 +46,11 @@
 
 namespace WebCore {
 
+bool Font::canReturnFallbackFontsForComplexText()
+{
+    return false;
+}
+
 void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
                       const GlyphBuffer& glyphBuffer,  int from, int numGlyphs,
                       const FloatPoint& point) const {
@@ -111,7 +116,7 @@
     notImplemented();
 }
 
-float Font::floatWidthForComplexText(const TextRun& run) const
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* /* fallbackFonts */) const
 {
     notImplemented();
     return 0;
diff --git a/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp b/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
index 7b7d197..e6a61f6 100644
--- a/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
+++ b/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
@@ -95,6 +95,11 @@
     paint->setTextEncoding(SkPaint::kUTF16_TextEncoding);
 }
 
+SkFontID FontPlatformData::uniqueID() const
+{
+    return m_typeface->uniqueID();
+}
+
 bool FontPlatformData::operator==(const FontPlatformData& a) const
 {
     // If either of the typeface pointers are invalid (either NULL or the
diff --git a/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h b/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
index ec7d837..c63a860 100644
--- a/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
+++ b/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
@@ -36,6 +36,7 @@
 
 class SkPaint;
 class SkTypeface;
+typedef uint32_t SkFontID;
 
 namespace WebCore {
 
@@ -90,6 +91,12 @@
     // -------------------------------------------------------------------------
     void setupPaint(SkPaint*) const;
 
+    // -------------------------------------------------------------------------
+    // Return Skia's unique id for this font. This encodes both the style and
+    // the font's file name so refers to a single face.
+    // -------------------------------------------------------------------------
+    SkFontID uniqueID() const;
+
     unsigned hash() const;
     float size() const { return m_textSize; }
 
diff --git a/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp b/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
index ed326c8..9596a4c 100644
--- a/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
@@ -120,6 +120,52 @@
         scriptFontMap[USCRIPT_HAN] = localeFamily;
 }
 
+// There are a lot of characters in USCRIPT_COMMON that can be covered
+// by fonts for scripts closely related to them. See
+// http://unicode.org/cldr/utility/list-unicodeset.jsp?a=[:Script=Common:]
+// FIXME: make this more efficient with a wider coverage
+UScriptCode getScriptBasedOnUnicodeBlock(int ucs4)
+{
+    UBlockCode block = ublock_getCode(ucs4);
+    switch (block) {
+    case UBLOCK_CJK_SYMBOLS_AND_PUNCTUATION:
+        return USCRIPT_HAN;
+    case UBLOCK_HIRAGANA:
+    case UBLOCK_KATAKANA:
+        return USCRIPT_HIRAGANA;
+    case UBLOCK_ARABIC:
+        return USCRIPT_ARABIC;
+    case UBLOCK_THAI:
+        return USCRIPT_THAI;
+    case UBLOCK_GREEK:
+        return USCRIPT_GREEK;
+    case UBLOCK_DEVANAGARI:
+        // For Danda and Double Danda (U+0964, U+0965), use a Devanagari
+        // font for now although they're used by other scripts as well.
+        // Without a context, we can't do any better.
+        return USCRIPT_DEVANAGARI;
+    case UBLOCK_ARMENIAN:
+        return USCRIPT_ARMENIAN;
+    case UBLOCK_GEORGIAN:
+        return USCRIPT_GEORGIAN;
+    case UBLOCK_KANNADA:
+        return USCRIPT_KANNADA;
+    default:
+        return USCRIPT_COMMON;
+    }
+}
+
+UScriptCode getScript(int ucs4)
+{
+    UErrorCode err = U_ZERO_ERROR;
+    UScriptCode script = uscript_getScript(ucs4, &err);
+    // If script is invalid, common or inherited or there's an error,
+    // infer a script based on the unicode block of a character.
+    if (script <= USCRIPT_INHERITED || U_FAILURE(err))
+        script = getScriptBasedOnUnicodeBlock(ucs4);
+    return script;
+}
+
 const int kUndefinedAscent = std::numeric_limits<int>::min();
 
 // Given an HFONT, return the ascent. If GetTextMetrics fails,
@@ -209,11 +255,9 @@
     // to get a font required to render the string.
     int i = 0;
     UChar32 ucs4 = 0;
-    while (i < length && script == USCRIPT_COMMON || script == USCRIPT_INVALID_CODE) {
+    while (i < length && script == USCRIPT_COMMON) {
         U16_NEXT(characters, i, length, ucs4);
-        UErrorCode err = U_ZERO_ERROR;
-        script = uscript_getScript(ucs4, &err);
-        // silently ignore the error
+        script = getScript(ucs4);
     }
 
     // For the full-width ASCII characters (U+FF00 - U+FF5E), use the font for
@@ -223,46 +267,8 @@
     if (0xFF00 < ucs4 && ucs4 < 0xFF5F)
         script = USCRIPT_HAN;
 
-    // There are a lot of characters in USCRIPT_COMMON that can be covered
-    // by fonts for scripts closely related to them. See
-    // http://unicode.org/cldr/utility/list-unicodeset.jsp?a=[:Script=Common:]
-    // FIXME: make this more efficient with a wider coverage
-    if (script == USCRIPT_COMMON || script == USCRIPT_INHERITED) {
-        UBlockCode block = ublock_getCode(ucs4);
-        switch (block) {
-        case UBLOCK_BASIC_LATIN:
-            script = USCRIPT_LATIN;
-            break;
-        case UBLOCK_CJK_SYMBOLS_AND_PUNCTUATION:
-            script = USCRIPT_HAN;
-            break;
-        case UBLOCK_HIRAGANA:
-        case UBLOCK_KATAKANA:
-            script = USCRIPT_HIRAGANA;
-            break;
-        case UBLOCK_ARABIC:
-            script = USCRIPT_ARABIC;
-            break;
-        case UBLOCK_GREEK:
-            script = USCRIPT_GREEK;
-            break;
-        case UBLOCK_DEVANAGARI:
-            // For Danda and Double Danda (U+0964, U+0965), use a Devanagari
-            // font for now although they're used by other scripts as well.
-            // Without a context, we can't do any better.
-            script = USCRIPT_DEVANAGARI;
-            break;
-        case UBLOCK_ARMENIAN:
-            script = USCRIPT_ARMENIAN;
-            break;
-        case UBLOCK_GEORGIAN:
-            script = USCRIPT_GEORGIAN;
-            break;
-        case UBLOCK_KANNADA:
-            script = USCRIPT_KANNADA;
-            break;
-        }
-    }
+    if (script == USCRIPT_COMMON)
+        script = getScriptBasedOnUnicodeBlock(ucs4);
 
     // Another lame work-around to cover non-BMP characters.
     const UChar* family = getFontFamilyForScript(script, generic);
diff --git a/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp b/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp
index 31c5256..2cb1cc5 100644
--- a/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp
@@ -72,7 +72,7 @@
                           bool recurse)
 {
     HDC dc = GetDC((HWND)0);
-    HGDIOBJ oldFont = SelectObject(dc, fontData->m_font.hfont());
+    HGDIOBJ oldFont = SelectObject(dc, fontData->platformData().hfont());
 
     TEXTMETRIC tm = {0};
     if (!GetTextMetrics(dc, &tm)) {
@@ -80,7 +80,7 @@
         ReleaseDC(0, dc);
 
         if (recurse) {
-            if (ChromiumBridge::ensureFontLoaded(fontData->m_font.hfont()))
+            if (ChromiumBridge::ensureFontLoaded(fontData->platformData().hfont()))
                 return fillBMPGlyphs(offset, length, buffer, page, fontData, false);
             else {
                 fillEmptyGlyphs(page);
@@ -191,9 +191,9 @@
     bool haveGlyphs = false;
 
     UniscribeHelperTextRun state(buffer, length * 2, false,
-                                 fontData->m_font.hfont(),
-                                 fontData->m_font.scriptCache(),
-                                 fontData->m_font.scriptFontProperties());
+                                 fontData->platformData().hfont(),
+                                 fontData->platformData().scriptCache(),
+                                 fontData->platformData().scriptFontProperties());
     state.setInhibitLigate(true);
     state.setDisableFontFallback(true);
     state.init();
diff --git a/WebCore/platform/graphics/chromium/MediaPlayerPrivateChromium.h b/WebCore/platform/graphics/chromium/MediaPlayerPrivateChromium.h
index e8ba0ad..534244d 100644
--- a/WebCore/platform/graphics/chromium/MediaPlayerPrivateChromium.h
+++ b/WebCore/platform/graphics/chromium/MediaPlayerPrivateChromium.h
@@ -37,67 +37,12 @@
 
 namespace WebCore {
 
-class MediaPlayerPrivate : public MediaPlayerPrivateInterface {
+class MediaPlayerPrivate {
 public:
     static void registerMediaEngine(MediaEngineRegistrar);
-    ~MediaPlayerPrivate();
-
-    IntSize naturalSize() const;
-    bool hasVideo() const;
-
-    void load(const String& url);
-    void cancelLoad();
-
-    void play();
-    void pause();    
-
-    bool paused() const;
-    bool seeking() const;
-
-    float duration() const;
-    float currentTime() const;
-    void seek(float time);
-    void setEndTime(float);
-
-    void setRate(float);
-    void setVolume(float);
-
-    int dataRate() const;
-
-    MediaPlayer::NetworkState networkState() const;
-    MediaPlayer::ReadyState readyState() const;
-
-    float maxTimeBuffered() const;
-    float maxTimeSeekable() const;
-    unsigned bytesLoaded() const;
-    bool totalBytesKnown() const;
-    unsigned totalBytes() const;
-
-    void setVisible(bool);
-    void setSize(const IntSize&);
-
-    void paint(GraphicsContext*, const IntRect&);
-
-    // Public methods to be called by WebMediaPlayer
-    FrameView* frameView();
-    void networkStateChanged();
-    void readyStateChanged();
-    void timeChanged();
-    void volumeChanged();
-    void repaint();
-
-private:
-    MediaPlayerPrivate(MediaPlayer*);
-    static MediaPlayerPrivateInterface* create(MediaPlayer* player);
-    static void getSupportedTypes(HashSet<String>&);
-    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
-    static bool isAvailable();
-
-    MediaPlayer* m_player;
-    void* m_data;
 };
 
-}  // namespace WebCore
+} // namespace WebCore
 
 #endif
 
diff --git a/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp b/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
index 06e997f..6f5ce90 100644
--- a/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
@@ -54,11 +54,11 @@
 void SimpleFontData::platformInit()
 {
     HDC dc = GetDC(0);
-    HGDIOBJ oldFont = SelectObject(dc, m_font.hfont());
+    HGDIOBJ oldFont = SelectObject(dc, m_platformData.hfont());
 
     TEXTMETRIC textMetric = {0};
     if (!GetTextMetrics(dc, &textMetric)) {
-        if (ChromiumBridge::ensureFontLoaded(m_font.hfont())) {
+        if (ChromiumBridge::ensureFontLoaded(m_platformData.hfont())) {
             // Retry GetTextMetrics.
             // FIXME: Handle gracefully the error if this call also fails.
             // See http://crbug.com/6401.
@@ -91,6 +91,11 @@
     ReleaseDC(0, dc);
 }
 
+void SimpleFontData::platformCharWidthInit()
+{
+    // charwidths are set in platformInit.
+}
+
 void SimpleFontData::platformDestroy()
 {
     // We don't hash this on Win32, so it's effectively owned by us.
@@ -102,7 +107,7 @@
 {
     if (!m_smallCapsFontData) {
         LOGFONT winFont;
-        GetObject(m_font.hfont(), sizeof(LOGFONT), &winFont);
+        GetObject(m_platformData.hfont(), sizeof(LOGFONT), &winFont);
         float smallCapsSize = 0.70f * fontDescription.computedSize();
         // Unlike WebKit trunk, we don't multiply the size by 32.  That seems
         // to be some kind of artifact of their CG backend, or something.
@@ -125,13 +130,13 @@
 {
     // TEXTMETRICS have this.  Set m_treatAsFixedPitch based off that.
     HDC dc = GetDC(0);
-    HGDIOBJ oldFont = SelectObject(dc, m_font.hfont());
+    HGDIOBJ oldFont = SelectObject(dc, m_platformData.hfont());
 
     // Yes, this looks backwards, but the fixed pitch bit is actually set if the font
     // is *not* fixed pitch.  Unbelievable but true.
     TEXTMETRIC textMetric = {0};
     if (!GetTextMetrics(dc, &textMetric)) {
-        if (ChromiumBridge::ensureFontLoaded(m_font.hfont())) {
+        if (ChromiumBridge::ensureFontLoaded(m_platformData.hfont())) {
             // Retry GetTextMetrics.
             // FIXME: Handle gracefully the error if this call also fails.
             // See http://crbug.com/6401.
@@ -149,12 +154,12 @@
 float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
 {
     HDC dc = GetDC(0);
-    HGDIOBJ oldFont = SelectObject(dc, m_font.hfont());
+    HGDIOBJ oldFont = SelectObject(dc, m_platformData.hfont());
 
     int width = 0;
     if (!GetCharWidthI(dc, glyph, 1, 0, &width)) {
         // Ask the browser to preload the font and retry.
-        if (ChromiumBridge::ensureFontLoaded(m_font.hfont())) {
+        if (ChromiumBridge::ensureFontLoaded(m_platformData.hfont())) {
             // FIXME: Handle gracefully the error if this call also fails.
             // See http://crbug.com/6401.
             if (!GetCharWidthI(dc, glyph, 1, 0, &width))
diff --git a/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp b/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
index 8200175..3bff83f 100644
--- a/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
+++ b/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
@@ -36,33 +36,54 @@
 #include "FloatRect.h"
 #include "FontDescription.h"
 #include "Logging.h"
-#include "NotImplemented.h"
+#include "VDMXParser.h"
 
+#include "SkFontHost.h"
 #include "SkPaint.h"
-#include "SkTypeface.h"
 #include "SkTime.h"
+#include "SkTypeface.h"
+#include "SkTypes.h"
 
 namespace WebCore {
 
 // Smallcaps versions of fonts are 70% the size of the normal font.
 static const float smallCapsFraction = 0.7f;
+// This is the largest VDMX table which we'll try to load and parse.
+static const size_t maxVDMXTableSize = 1024 * 1024;  // 1 MB
 
 void SimpleFontData::platformInit()
 {
     SkPaint paint;
     SkPaint::FontMetrics metrics;
 
-    m_font.setupPaint(&paint);
+    m_platformData.setupPaint(&paint);
     paint.getFontMetrics(&metrics);
+    const SkFontID fontID = m_platformData.uniqueID();
+
+    static const uint32_t vdmxTag = SkSetFourByteTag('V', 'D', 'M', 'X');
+    int pixelSize = m_platformData.size() + 0.5;
+    int vdmxAscent, vdmxDescent;
+    bool isVDMXValid = false;
+
+    size_t vdmxSize = SkFontHost::GetTableSize(fontID, vdmxTag);
+    if (vdmxSize && vdmxSize < maxVDMXTableSize) {
+        uint8_t* vdmxTable = (uint8_t*) fastMalloc(vdmxSize);
+        if (vdmxTable
+            && SkFontHost::GetTableData(fontID, vdmxTag, 0, vdmxSize, vdmxTable) == vdmxSize
+            && parseVDMX(&vdmxAscent, &vdmxDescent, vdmxTable, vdmxSize, pixelSize))
+            isVDMXValid = true;
+        fastFree(vdmxTable);
+    }
 
     // Beware those who step here: This code is designed to match Win32 font
     // metrics *exactly*.
-    if (metrics.fVDMXMetricsValid) {
-        m_ascent = metrics.fVDMXAscent;
-        m_descent = metrics.fVDMXDescent;
+    if (isVDMXValid) {
+        m_ascent = vdmxAscent;
+        m_descent = -vdmxDescent;
     } else {
+        SkScalar height = -metrics.fAscent + metrics.fDescent + metrics.fLeading;
         m_ascent = SkScalarRound(-metrics.fAscent);
-        m_descent = SkScalarRound(metrics.fHeight) - m_ascent;
+        m_descent = SkScalarRound(height) - m_ascent;
     }
 
     if (metrics.fXHeight)
@@ -79,7 +100,8 @@
     // calculated for us, but we need to calculate m_maxCharWidth and
     // m_avgCharWidth in order for text entry widgets to be sized correctly.
 
-    m_maxCharWidth = SkScalarRound(metrics.fXRange * SkScalarRound(m_font.size()));
+    SkScalar xRange = metrics.fXMax - metrics.fXMin;
+    m_maxCharWidth = SkScalarRound(xRange * SkScalarRound(m_platformData.size()));
 
     if (metrics.fAvgCharWidth)
         m_avgCharWidth = SkScalarRound(metrics.fAvgCharWidth);
@@ -98,6 +120,11 @@
     }
 }
 
+void SimpleFontData::platformCharWidthInit()
+{
+    // charwidths are set in platformInit.
+}
+
 void SimpleFontData::platformDestroy()
 {
     delete m_smallCapsFontData;
@@ -108,7 +135,7 @@
 {
     if (!m_smallCapsFontData) {
         const float smallCapsSize = lroundf(fontDescription.computedSize() * smallCapsFraction);
-        m_smallCapsFontData = new SimpleFontData(FontPlatformData(m_font, smallCapsSize));
+        m_smallCapsFontData = new SimpleFontData(FontPlatformData(m_platformData, smallCapsSize));
     }
 
     return m_smallCapsFontData;
@@ -120,7 +147,7 @@
     static const unsigned maxBufferCount = 64;
     uint16_t glyphs[maxBufferCount];
 
-    m_font.setupPaint(&paint);
+    m_platformData.setupPaint(&paint);
     paint.setTextEncoding(SkPaint::kUTF16_TextEncoding);
 
     while (length > 0) {
@@ -151,11 +178,11 @@
 
     SkPaint paint;
 
-    m_font.setupPaint(&paint);
+    m_platformData.setupPaint(&paint);
 
     paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
     SkScalar width = paint.measureText(&glyph, 2);
-    
+
     return SkScalarToFloat(width);
 }
 
diff --git a/WebCore/platform/graphics/chromium/TransparencyWin.cpp b/WebCore/platform/graphics/chromium/TransparencyWin.cpp
index 8c790af..d3ced81 100644
--- a/WebCore/platform/graphics/chromium/TransparencyWin.cpp
+++ b/WebCore/platform/graphics/chromium/TransparencyWin.cpp
@@ -109,7 +109,7 @@
 public:
     OwnedBuffers(const IntSize& size, bool needReferenceBuffer)
     {
-        m_destBitmap.adopt(ImageBuffer::create(size, false));
+        m_destBitmap = ImageBuffer::create(size, false);
 
         if (needReferenceBuffer) {
             m_referenceBitmap.setConfig(SkBitmap::kARGB_8888_Config, size.width(), size.height());
diff --git a/WebCore/platform/graphics/chromium/VDMXParser.cpp b/WebCore/platform/graphics/chromium/VDMXParser.cpp
new file mode 100644
index 0000000..3347226
--- /dev/null
+++ b/WebCore/platform/graphics/chromium/VDMXParser.cpp
@@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+
+// For htons/ntohs
+#include <arpa/inet.h>
+
+// Buffer helper class
+//
+// This class perform some trival buffer operations while checking for
+// out-of-bounds errors. As a family they return false if anything is amiss,
+// updating the current offset otherwise.
+class Buffer {
+public:
+    Buffer(const uint8_t* buffer, size_t length)
+        : m_buffer(buffer)
+        , m_length(length)
+        , m_offset(0) { }
+
+    bool skip(size_t numBytes)
+    {
+        if (m_offset + numBytes > m_length)
+            return false;
+        m_offset += numBytes;
+        return true;
+    }
+
+    bool readU8(uint8_t* value)
+    {
+        if (m_offset + sizeof(uint8_t) > m_length)
+            return false;
+        *value = m_buffer[m_offset];
+        m_offset += sizeof(uint8_t);
+        return true;
+    }
+
+    bool readU16(uint16_t* value)
+    {
+        if (m_offset + sizeof(uint16_t) > m_length)
+            return false;
+        memcpy(value, m_buffer + m_offset, sizeof(uint16_t));
+        *value = ntohs(*value);
+        m_offset += sizeof(uint16_t);
+        return true;
+    }
+
+    bool readS16(int16_t* value)
+    {
+        return readU16(reinterpret_cast<uint16_t*>(value));
+    }
+
+    size_t offset() const
+    {
+        return m_offset;
+    }
+
+    void setOffset(size_t newoffset)
+    {
+        m_offset = newoffset;
+    }
+
+private:
+    const uint8_t *const m_buffer;
+    const size_t m_length;
+    size_t m_offset;
+};
+
+// VDMX parsing code.
+//
+// VDMX tables are found in some TrueType/OpenType fonts and contain
+// ascender/descender overrides for certain (usually small) sizes. This is
+// needed in order to match font metrics on Windows.
+//
+// Freetype does not parse these tables so we do so here.
+
+namespace WebCore {
+
+// Parse a TrueType VDMX table.
+//   yMax: (output) the ascender value from the table
+//   yMin: (output) the descender value from the table (negative!)
+//   vdmx: the table bytes
+//   vdmxLength: length of @vdmx, in bytes
+//   targetPixelSize: the pixel size of the font (e.g. 16)
+//
+// Returns true iff a suitable match are found. Otherwise, *yMax and *yMin are
+// untouched. size_t must be 32-bits to avoid overflow.
+//
+// See http://www.microsoft.com/opentype/otspec/vdmx.htm
+bool parseVDMX(int* yMax, int* yMin,
+               const uint8_t* vdmx, size_t vdmxLength,
+               unsigned targetPixelSize)
+{
+    Buffer buf(vdmx, vdmxLength);
+
+    // We ignore the version. Future tables should be backwards compatible with
+    // this layout.
+    uint16_t numRatios;
+    if (!buf.skip(4) || !buf.readU16(&numRatios))
+        return false;
+
+    // Now we have two tables. Firstly we have @numRatios Ratio records, then a
+    // matching array of @numRatios offsets. We save the offset of the beginning
+    // of this second table.
+    //
+    // Range 6 <= x <= 262146
+    unsigned long offsetTableOffset =
+        buf.offset() + 4 /* sizeof struct ratio */ * numRatios;
+
+    unsigned desiredRatio = 0xffffffff;
+    // We read 4 bytes per record, so the offset range is
+    //   6 <= x <= 524286
+    for (unsigned i = 0; i < numRatios; ++i) {
+        uint8_t xRatio, yRatio1, yRatio2;
+
+        if (!buf.skip(1)
+            || !buf.readU8(&xRatio)
+            || !buf.readU8(&yRatio1)
+            || !buf.readU8(&yRatio2))
+            return false;
+
+        // This either covers 1:1, or this is the default entry (0, 0, 0)
+        if ((xRatio == 1 && yRatio1 <= 1 && yRatio2 >= 1)
+            || (xRatio == 0 && yRatio1 == 0 && yRatio2 == 0)) {
+            desiredRatio = i;
+            break;
+        }
+    }
+
+    if (desiredRatio == 0xffffffff) // no ratio found
+        return false;
+
+    // Range 10 <= x <= 393216
+    buf.setOffset(offsetTableOffset + sizeof(uint16_t) * desiredRatio);
+
+    // Now we read from the offset table to get the offset of another array
+    uint16_t groupOffset;
+    if (!buf.readU16(&groupOffset))
+        return false;
+    // Range 0 <= x <= 65535
+    buf.setOffset(groupOffset);
+
+    uint16_t numRecords;
+    if (!buf.readU16(&numRecords) || !buf.skip(sizeof(uint16_t)))
+        return false;
+
+    // We read 6 bytes per record, so the offset range is
+    //   4 <= x <= 458749
+    for (unsigned i = 0; i < numRecords; ++i) {
+        uint16_t pixelSize;
+        if (!buf.readU16(&pixelSize))
+            return false;
+        // the entries are sorted, so we can abort early if need be
+        if (pixelSize > targetPixelSize)
+            return false;
+
+        if (pixelSize == targetPixelSize) {
+            int16_t tempYMax, tempYMin;
+            if (!buf.readS16(&tempYMax)
+                || !buf.readS16(&tempYMin))
+                return false;
+            *yMin = tempYMin;
+            *yMax = tempYMax;
+            return true;
+        }
+        if (!buf.skip(2 * sizeof(int16_t)))
+            return false;
+    }
+
+    return false;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/chromium/KeyboardCodes.h b/WebCore/platform/graphics/chromium/VDMXParser.h
similarity index 82%
copy from WebCore/platform/chromium/KeyboardCodes.h
copy to WebCore/platform/graphics/chromium/VDMXParser.h
index 10eb0cd..ef625b7 100644
--- a/WebCore/platform/chromium/KeyboardCodes.h
+++ b/WebCore/platform/graphics/chromium/VDMXParser.h
@@ -1,10 +1,10 @@
 /*
- * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
- * 
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,13 +28,13 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef KeyboardCodes_h
-#define KeyboardCodes_h
+#ifndef VDMXParser_h
+#define VDMXParser_h
 
-#if PLATFORM(WIN_OS)
-#include "KeyboardCodesWin.h"
-#else
-#include "KeyboardCodesPosix.h"
-#endif
+namespace WebCore {
+    bool parseVDMX(int* ymax, int* ymin,
+                   const uint8_t* vdmx, size_t vdmxLength,
+                   unsigned targetPixelSize);
+}  // namespace WebCore
 
 #endif
diff --git a/WebCore/platform/graphics/filters/FEBlend.cpp b/WebCore/platform/graphics/filters/FEBlend.cpp
index 7210367..86b702f 100644
--- a/WebCore/platform/graphics/filters/FEBlend.cpp
+++ b/WebCore/platform/graphics/filters/FEBlend.cpp
@@ -21,9 +21,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FEBlend.h"
 
+#include "Filter.h"
+
 namespace WebCore {
 
 FEBlend::FEBlend(FilterEffect* in, FilterEffect* in2, BlendModeType mode)
@@ -59,7 +61,7 @@
     m_mode = mode;
 }
 
-void FEBlend::apply()
+void FEBlend::apply(Filter*)
 {
 }
 
@@ -69,4 +71,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
diff --git a/WebCore/platform/graphics/filters/FEBlend.h b/WebCore/platform/graphics/filters/FEBlend.h
index b2835e8..dec04ac 100644
--- a/WebCore/platform/graphics/filters/FEBlend.h
+++ b/WebCore/platform/graphics/filters/FEBlend.h
@@ -22,9 +22,11 @@
 #ifndef SVGFEBlend_h
 #define SVGFEBlend_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
 
+#include "Filter.h"
+
 namespace WebCore {
 
     enum BlendModeType {
@@ -46,8 +48,8 @@
         BlendModeType blendMode() const;
         void setBlendMode(BlendModeType);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
 
     private:
         FEBlend(FilterEffect*, FilterEffect*, BlendModeType);
@@ -59,6 +61,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
 
 #endif // SVGFEBlend_h
diff --git a/WebCore/platform/graphics/filters/FEColorMatrix.cpp b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
index f783106..8704e64 100644
--- a/WebCore/platform/graphics/filters/FEColorMatrix.cpp
+++ b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
@@ -21,9 +21,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FEColorMatrix.h"
 
+#include "Filter.h"
+
 namespace WebCore {
 
 FEColorMatrix::FEColorMatrix(FilterEffect* in, ColorMatrixType type, const Vector<float>& values)
@@ -59,7 +61,7 @@
     m_values = values;
 }
 
-void FEColorMatrix::apply()
+void FEColorMatrix::apply(Filter*)
 {
 }
 
@@ -69,4 +71,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
diff --git a/WebCore/platform/graphics/filters/FEColorMatrix.h b/WebCore/platform/graphics/filters/FEColorMatrix.h
index d8193ed..eeb3557 100644
--- a/WebCore/platform/graphics/filters/FEColorMatrix.h
+++ b/WebCore/platform/graphics/filters/FEColorMatrix.h
@@ -22,8 +22,10 @@
 #ifndef SVGFEColorMatrix_h
 #define SVGFEColorMatrix_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
+
+#include "Filter.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -46,8 +48,8 @@
         const Vector<float>& values() const;
         void setValues(const Vector<float>&);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
 
     private:
         FEColorMatrix(FilterEffect*, ColorMatrixType, const Vector<float>&);
@@ -59,6 +61,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
 
 #endif // SVGFEColorMatrix_h
diff --git a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
index 708ea3e..54ac123 100644
--- a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
@@ -21,9 +21,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FEComponentTransfer.h"
 
+#include "Filter.h"
+
 namespace WebCore {
 
 FEComponentTransfer::FEComponentTransfer(FilterEffect* in, const ComponentTransferFunction& redFunc, 
@@ -83,7 +85,7 @@
     m_alphaFunc = func;
 }
 
-void FEComponentTransfer::apply()
+void FEComponentTransfer::apply(Filter*)
 {
 }
 
@@ -93,4 +95,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
diff --git a/WebCore/platform/graphics/filters/FEComponentTransfer.h b/WebCore/platform/graphics/filters/FEComponentTransfer.h
index 20d70c0..cc1d1f8 100644
--- a/WebCore/platform/graphics/filters/FEComponentTransfer.h
+++ b/WebCore/platform/graphics/filters/FEComponentTransfer.h
@@ -22,10 +22,11 @@
 #ifndef SVGFEComponentTransfer_h
 #define SVGFEComponentTransfer_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
-#include "SVGFEDisplacementMap.h"
 
+#include "SVGFEDisplacementMap.h"
+#include "Filter.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -78,8 +79,8 @@
         ComponentTransferFunction alphaFunction() const;
         void setAlphaFunction(const ComponentTransferFunction&);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
 
     private:
         FEComponentTransfer(FilterEffect*,const ComponentTransferFunction&, const ComponentTransferFunction&,
@@ -94,6 +95,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
 
 #endif // SVGFEComponentTransfer_h
diff --git a/WebCore/platform/graphics/filters/FEComposite.cpp b/WebCore/platform/graphics/filters/FEComposite.cpp
index 0b5ce94..0706358 100644
--- a/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -21,9 +21,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FEComposite.h"
 
+#include "Filter.h"
+
 namespace WebCore {
 
 FEComposite::FEComposite(FilterEffect* in, FilterEffect* in2, const CompositeOperationType& type,
@@ -95,7 +97,7 @@
     m_k4 = k4;
 }
 
-void FEComposite::apply()
+void FEComposite::apply(Filter*)
 {
 }
 
@@ -105,4 +107,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
diff --git a/WebCore/platform/graphics/filters/FEComposite.h b/WebCore/platform/graphics/filters/FEComposite.h
index d205395..b623cce 100644
--- a/WebCore/platform/graphics/filters/FEComposite.h
+++ b/WebCore/platform/graphics/filters/FEComposite.h
@@ -22,9 +22,11 @@
 #ifndef SVGFEComposite_h
 #define SVGFEComposite_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
+
 #include "PlatformString.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -58,8 +60,8 @@
         float k4() const;
         void setK4(float);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
 
     private:
         FEComposite(FilterEffect*, FilterEffect*, const CompositeOperationType&,
@@ -76,6 +78,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
 
 #endif // SVGFEComposite_h
diff --git a/WebCore/platform/graphics/filters/Filter.h b/WebCore/platform/graphics/filters/Filter.h
new file mode 100644
index 0000000..84909da
--- /dev/null
+++ b/WebCore/platform/graphics/filters/Filter.h
@@ -0,0 +1,52 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef Filter_h
+#define Filter_h
+
+#if ENABLE(FILTERS)
+#include "Image.h"
+#include "StringHash.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class FilterEffect;
+
+    class Filter : public RefCounted<Filter> {
+    public:
+        virtual ~Filter() { }
+
+        void setSourceImage(PassRefPtr<Image> image) { m_image = image; }
+        Image* sourceImage() { return m_image.get(); }
+
+        virtual void calculateEffectSubRegion(FilterEffect*) = 0;
+
+    private:
+        RefPtr<Image> m_image;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
+
+#endif // Filter_h
diff --git a/WebCore/svg/FilterEffect.cpp b/WebCore/platform/graphics/filters/FilterEffect.cpp
similarity index 87%
rename from WebCore/svg/FilterEffect.cpp
rename to WebCore/platform/graphics/filters/FilterEffect.cpp
index 24c187c..cd74992 100644
--- a/WebCore/svg/FilterEffect.cpp
+++ b/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -19,12 +19,16 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
 
 namespace WebCore {
 
 FilterEffect::FilterEffect()
+    : m_xBBoxMode(false)
+    , m_yBBoxMode(false)
+    , m_widthBBoxMode(false)
+    , m_heightBBoxMode(false)
 {
 }
 
@@ -39,4 +43,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(FILTERS)
diff --git a/WebCore/platform/graphics/filters/FilterEffect.h b/WebCore/platform/graphics/filters/FilterEffect.h
new file mode 100644
index 0000000..e2a058d
--- /dev/null
+++ b/WebCore/platform/graphics/filters/FilterEffect.h
@@ -0,0 +1,81 @@
+/*
+    Copyright (C) 2008 Alex Mathews <possessedpenguinbob@gmail.com>
+                  2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef FilterEffect_h
+#define FilterEffect_h
+
+#if ENABLE(FILTERS)
+#include "Filter.h"
+#include "FloatRect.h"
+#include "ImageBuffer.h"
+#include "TextStream.h"
+
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class FilterEffect : public RefCounted<FilterEffect> {
+    public:
+        virtual ~FilterEffect();
+
+        bool xBoundingBoxMode() const { return m_xBBoxMode; }
+        void setXBoundingBoxMode(bool bboxMode) { m_xBBoxMode = bboxMode; }
+
+        bool yBoundingBoxMode() const { return m_yBBoxMode; }
+        void setYBoundingBoxMode(bool bboxMode) { m_yBBoxMode = bboxMode; }
+
+        bool widthBoundingBoxMode() const { return m_widthBBoxMode; }
+        void setWidthBoundingBoxMode(bool bboxMode) { m_widthBBoxMode = bboxMode; }
+
+        bool heightBoundingBoxMode() const { return m_heightBBoxMode; }
+        void setHeightBoundingBoxMode(bool bboxMode) { m_heightBBoxMode = bboxMode; }
+
+        FloatRect subRegion() const { return m_subRegion; }
+        void setSubRegion(const FloatRect& subRegion) { m_subRegion = subRegion; }
+
+        // The result is bounded by the size of the filter primitive to save resources
+        ImageBuffer* resultImage() { return m_effectBuffer.get(); }
+        void setEffectBuffer(ImageBuffer* effectBuffer) { m_effectBuffer.set(effectBuffer); }
+
+        virtual void apply(Filter*) = 0;
+        virtual void dump() = 0;
+
+        virtual TextStream& externalRepresentation(TextStream&) const;
+    protected:
+        FilterEffect();
+
+    private:
+
+        bool m_xBBoxMode : 1;
+        bool m_yBBoxMode : 1;
+        bool m_widthBBoxMode : 1;
+        bool m_heightBBoxMode : 1;
+
+        FloatRect m_subRegion;
+
+        mutable OwnPtr<ImageBuffer> m_effectBuffer;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
+
+#endif // FilterEffect_h
diff --git a/WebCore/platform/graphics/filters/SourceAlpha.cpp b/WebCore/platform/graphics/filters/SourceAlpha.cpp
new file mode 100644
index 0000000..646a57b
--- /dev/null
+++ b/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -0,0 +1,54 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "SourceAlpha.h"
+
+#include "GraphicsContext.h"
+#include "PlatformString.h"
+#include "Filter.h"
+
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+PassRefPtr<SourceAlpha> SourceAlpha::create()
+{
+    return adoptRef(new SourceAlpha);
+}
+
+const AtomicString& SourceAlpha::effectName()
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, s_effectName, ("SourceAlpha"));
+    return s_effectName;
+}
+
+void SourceAlpha::apply(Filter*)
+{
+}
+
+void SourceAlpha::dump()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/WebCore/svg/FilterEffect.cpp b/WebCore/platform/graphics/filters/SourceAlpha.h
similarity index 61%
copy from WebCore/svg/FilterEffect.cpp
copy to WebCore/platform/graphics/filters/SourceAlpha.h
index 24c187c..21497aa 100644
--- a/WebCore/svg/FilterEffect.cpp
+++ b/WebCore/platform/graphics/filters/SourceAlpha.h
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) Alex Mathews <possessedpenguinbob@gmail.com>
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -17,26 +17,31 @@
     Boston, MA 02110-1301, USA.
 */
 
-#include "config.h"
+#ifndef SourceAlpha_h
+#define SourceAlpha_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
 
+#include "PlatformString.h"
+#include "Filter.h"
+
 namespace WebCore {
 
-FilterEffect::FilterEffect()
-{
-}
+    class SourceAlpha : public FilterEffect {
+    public:        
+        static PassRefPtr<SourceAlpha> create();
 
-FilterEffect::~FilterEffect()
-{
-}
+        static const AtomicString& effectName();
 
-TextStream& FilterEffect::externalRepresentation(TextStream& ts) const
-{
-    return ts;
-}
+        void apply(Filter*);
+        void dump();
+    
+    private:
+        SourceAlpha() { }
+    };
+} //namespace WebCore
 
-} // namespace WebCore
+#endif // ENABLE(FILTERS)
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // SourceAlpha_h
diff --git a/WebCore/platform/graphics/filters/SourceGraphic.cpp b/WebCore/platform/graphics/filters/SourceGraphic.cpp
new file mode 100644
index 0000000..39d4810
--- /dev/null
+++ b/WebCore/platform/graphics/filters/SourceGraphic.cpp
@@ -0,0 +1,54 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "SourceGraphic.h"
+
+#include "GraphicsContext.h"
+#include "PlatformString.h"
+#include "Filter.h"
+
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+PassRefPtr<SourceGraphic> SourceGraphic::create()
+{
+    return adoptRef(new SourceGraphic);
+}
+
+const AtomicString& SourceGraphic::effectName()
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, s_effectName, ("SourceGraphic"));
+    return s_effectName;
+}
+
+void SourceGraphic::apply(Filter*)
+{
+}
+
+void SourceGraphic::dump()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/WebCore/svg/Filter.h b/WebCore/platform/graphics/filters/SourceGraphic.h
similarity index 61%
rename from WebCore/svg/Filter.h
rename to WebCore/platform/graphics/filters/SourceGraphic.h
index f3a110e..363fb97 100644
--- a/WebCore/svg/Filter.h
+++ b/WebCore/platform/graphics/filters/SourceGraphic.h
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 2008 Alex Mathews <possessedpenguinbob@gmail.com>
-    
+                  2009 Dirk Schulze <krit@webkit.org>
+
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -12,35 +13,36 @@
     Library General Public License for more details.
 
     You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
+    aint with this library; see the file COPYING.LIB.  If not, write to
     the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef Filter_h
-#define Filter_h
+#ifndef SourceGraphic_h
+#define SourceGrahpic_h
 
-#include "config.h"
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
 
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefPtr.h>
+#include "PlatformString.h"
+#include "Filter.h"
 
 namespace WebCore {
 
-    class Filter : public RefCounted<Filter> {
-    public:    
-        static PassRefPtr<Filter> create(FilterEffect*);
-        
+    class SourceGraphic : public FilterEffect {
+    public:        
+        static PassRefPtr<SourceGraphic> create();
+
+        static const AtomicString& effectName();
+
+        void apply(Filter*);
+        void dump();
+    
     private:
-        Filter(FilterEffect* effect);
-    
-        RefPtr<FilterEffect> m_effect;
+        SourceGraphic() { }
     };
-    
 } //namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#endif
+#endif // ENABLE(FILTERS)
+
+#endif // SourceGraphic_h
diff --git a/WebCore/platform/graphics/gtk/FontCacheGtk.cpp b/WebCore/platform/graphics/gtk/FontCacheGtk.cpp
index d2b43cc..e0b88da 100644
--- a/WebCore/platform/graphics/gtk/FontCacheGtk.cpp
+++ b/WebCore/platform/graphics/gtk/FontCacheGtk.cpp
@@ -37,7 +37,7 @@
 {
 #if defined(USE_FREETYPE)
     FcResult fresult;
-    FontPlatformData* prim = const_cast<FontPlatformData*>(&font.primaryFont()->m_font);
+    FontPlatformData* prim = const_cast<FontPlatformData*>(&font.primaryFont()->platformData());
 
     if (!prim->m_fallbacks)
         prim->m_fallbacks = FcFontSort(NULL, prim->m_pattern, FcTrue, NULL, &fresult);
diff --git a/WebCore/platform/graphics/gtk/FontGtk.cpp b/WebCore/platform/graphics/gtk/FontGtk.cpp
index 288ba91..6561f02 100644
--- a/WebCore/platform/graphics/gtk/FontGtk.cpp
+++ b/WebCore/platform/graphics/gtk/FontGtk.cpp
@@ -34,7 +34,6 @@
 #include "Font.h"
 
 #include "GraphicsContext.h"
-#include "NotImplemented.h"
 #include "SimpleFontData.h"
 
 #include <cairo.h>
@@ -145,14 +144,14 @@
 static void setPangoAttributes(const Font* font, const TextRun& run, PangoLayout* layout)
 {
 #if defined(USE_FREETYPE)
-    if (font->primaryFont()->m_font.m_pattern) {
-        PangoFontDescription* desc = pango_fc_font_description_from_pattern(font->primaryFont()->m_font.m_pattern, FALSE);
+    if (font->primaryFont()->platformData().m_pattern) {
+        PangoFontDescription* desc = pango_fc_font_description_from_pattern(font->primaryFont()->platformData().m_pattern, FALSE);
         pango_layout_set_font_description(layout, desc);
         pango_font_description_free(desc);
     }
 #elif defined(USE_PANGO)
-    if (font->primaryFont()->m_font.m_font) {
-        PangoFontDescription* desc = pango_font_describe(font->primaryFont()->m_font.m_font);
+    if (font->primaryFont()->platformData().m_font) {
+        PangoFontDescription* desc = pango_font_describe(font->primaryFont()->platformData().m_font);
         pango_layout_set_font_description(layout, desc);
         pango_font_description_free(desc);
     }
@@ -183,6 +182,11 @@
     pango_attr_list_unref(list);
 }
 
+bool Font::canReturnFallbackFontsForComplexText()
+{
+    return false;
+}
+
 void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const FloatPoint& point, int from, int to) const
 {
     cairo_t* cr = context->platformContext();
@@ -290,7 +294,7 @@
     return layout;
 }
 
-float Font::floatWidthForComplexText(const TextRun& run) const
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* /* fallbackFonts */) const
 {
     if (run.length() == 0)
         return 0.0f;
diff --git a/WebCore/platform/graphics/gtk/FontPlatformData.h b/WebCore/platform/graphics/gtk/FontPlatformData.h
index 20c52e5..ae1f134 100644
--- a/WebCore/platform/graphics/gtk/FontPlatformData.h
+++ b/WebCore/platform/graphics/gtk/FontPlatformData.h
@@ -82,6 +82,8 @@
 
     bool isFixedPitch();
     float size() const { return m_size; }
+    bool syntheticBold() const { return m_syntheticBold; }
+    bool syntheticOblique() const { return m_syntheticOblique; }
 
     void setFont(cairo_t*) const;
 
diff --git a/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp b/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp
index 68685e9..f0f0dd5 100644
--- a/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp
+++ b/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp
@@ -109,10 +109,9 @@
     cairo_matrix_init_scale(&fontMatrix, fontDescription.computedPixelSize(), fontDescription.computedPixelSize());
     cairo_matrix_init_identity(&ctm);
 
-#if GTK_CHECK_VERSION(2,10,0)
     if (GdkScreen* screen = gdk_screen_get_default())
         options = gdk_screen_get_font_options(screen);
-#endif
+
     // gdk_screen_get_font_options() returns NULL if no default options are
     // set, so we always have to check.
     if (!options)
@@ -150,10 +149,9 @@
     static const cairo_font_options_t* defaultOptions = cairo_font_options_create();
     const cairo_font_options_t* options = NULL;
 
-#if GTK_CHECK_VERSION(2,10,0)
     if (GdkScreen* screen = gdk_screen_get_default())
         options = gdk_screen_get_font_options(screen);
-#endif
+
     // gdk_screen_get_font_options() returns NULL if no default options are
     // set, so we always have to check.
     if (!options)
diff --git a/WebCore/platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp b/WebCore/platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp
index 24ad864..7c9ffe6 100644
--- a/WebCore/platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp
+++ b/WebCore/platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp
@@ -42,7 +42,7 @@
     if (bufferLength > GlyphPage::size)
         return false;
 
-    FT_Face face = cairo_ft_scaled_font_lock_face(fontData->m_font.m_scaledFont);
+    FT_Face face = cairo_ft_scaled_font_lock_face(fontData->platformData().m_scaledFont);
     if (!face)
         return false;
 
@@ -57,7 +57,7 @@
         }
     }
 
-    cairo_ft_scaled_font_unlock_face(fontData->m_font.m_scaledFont);
+    cairo_ft_scaled_font_unlock_face(fontData->platformData().m_scaledFont);
 
     return haveGlyphs;
 }
diff --git a/WebCore/platform/graphics/gtk/GlyphPageTreeNodePango.cpp b/WebCore/platform/graphics/gtk/GlyphPageTreeNodePango.cpp
index 8fada5c..8d0baa6 100644
--- a/WebCore/platform/graphics/gtk/GlyphPageTreeNodePango.cpp
+++ b/WebCore/platform/graphics/gtk/GlyphPageTreeNodePango.cpp
@@ -78,12 +78,12 @@
     if (bufferLength > GlyphPage::size)
         return false;
 
-    if (!fontData->m_font.m_font || fontData->m_font.m_font == reinterpret_cast<PangoFont*>(-1))
+    if (!fontData->platformData().m_font || fontData->platformData().m_font == reinterpret_cast<PangoFont*>(-1))
         return false;
 
     bool haveGlyphs = false;
     for (unsigned i = 0; i < length; i++) {
-        Glyph glyph = pango_font_get_glyph(fontData->m_font.m_font, fontData->m_font.m_context, buffer[i]);
+        Glyph glyph = pango_font_get_glyph(fontData->platformData().m_font, fontData->platformData().m_context, buffer[i]);
         if (!glyph)
             setGlyphDataForIndex(offset + i, 0, 0);
         else {
diff --git a/WebCore/platform/graphics/gtk/IconGtk.cpp b/WebCore/platform/graphics/gtk/IconGtk.cpp
index d8b38a0..e08c1ab 100644
--- a/WebCore/platform/graphics/gtk/IconGtk.cpp
+++ b/WebCore/platform/graphics/gtk/IconGtk.cpp
@@ -33,7 +33,6 @@
 #include "CString.h"
 #include "GraphicsContext.h"
 #include "MIMETypeRegistry.h"
-#include "NotImplemented.h"
 #include "PassRefPtr.h"
 
 #include <gtk/gtk.h>
diff --git a/WebCore/platform/graphics/gtk/ImageGtk.cpp b/WebCore/platform/graphics/gtk/ImageGtk.cpp
index b745209..0e92d6c 100644
--- a/WebCore/platform/graphics/gtk/ImageGtk.cpp
+++ b/WebCore/platform/graphics/gtk/ImageGtk.cpp
@@ -26,12 +26,52 @@
 #include "config.h"
 
 #include "BitmapImage.h"
+#include "CString.h"
+#include "GOwnPtr.h"
 
-// This function loads resources from WebKit
-Vector<char> loadResourceIntoArray(const char*);
+#include <cairo.h>
+#include <gtk/gtk.h>
+
+namespace WTF {
+
+template <> void freeOwnedGPtr<GtkIconInfo>(GtkIconInfo* info)
+{
+    if (info)
+        gtk_icon_info_free(info);
+}
+
+}
 
 namespace WebCore {
 
+static CString getIconFileNameOrFallback(const char* name, const char* fallback)
+{
+    GOwnPtr<GtkIconInfo> info(gtk_icon_theme_lookup_icon(gtk_icon_theme_get_default(),
+                                                         name, 16, GTK_ICON_LOOKUP_NO_SVG));
+    if (!info)
+        return String::format("%s/webkit-1.0/images/%s.png", DATA_DIR, fallback).utf8();
+
+    return CString(gtk_icon_info_get_filename(info.get()));
+}
+
+static PassRefPtr<SharedBuffer> loadResourceSharedBuffer(const char* name)
+{
+    CString fileName;
+
+    // Find the path for the image
+    if (strcmp("missingImage", name) == 0)
+        fileName = getIconFileNameOrFallback(GTK_STOCK_MISSING_IMAGE, "missingImage");
+    else
+        fileName = String::format("%s/webkit-1.0/images/%s.png", DATA_DIR, name).utf8();
+
+    GOwnPtr<gchar> content;
+    gsize length;
+    if (!g_file_get_contents(fileName.data(), &content.outPtr(), &length, 0))
+        return SharedBuffer::create();
+
+    return SharedBuffer::create(content.get(), length);
+}
+
 void BitmapImage::initPlatformData()
 {
 }
@@ -40,13 +80,34 @@
 {
 }
 
-PassRefPtr<Image> Image::loadPlatformResource(const char *name)
+PassRefPtr<Image> Image::loadPlatformResource(const char* name)
 {
-    Vector<char> arr = loadResourceIntoArray(name);
     RefPtr<BitmapImage> img = BitmapImage::create();
-    RefPtr<SharedBuffer> buffer = SharedBuffer::create(arr.data(), arr.size());
-    img->setData(buffer, true);
+    RefPtr<SharedBuffer> buffer = loadResourceSharedBuffer(name);
+    img->setData(buffer.release(), true);
     return img.release();
 }
 
+GdkPixbuf* BitmapImage::getGdkPixbuf()
+{
+    int width = cairo_image_surface_get_width(frameAtIndex(currentFrame()));
+    int height = cairo_image_surface_get_height(frameAtIndex(currentFrame()));
+
+    int bestDepth = gdk_visual_get_best_depth();
+    GdkColormap* cmap = gdk_colormap_new(gdk_visual_get_best_with_depth(bestDepth), true);
+
+    GdkPixmap* pixmap = gdk_pixmap_new(0, width, height, bestDepth);
+    gdk_drawable_set_colormap(GDK_DRAWABLE(pixmap), cmap);
+    cairo_t* cr = gdk_cairo_create(GDK_DRAWABLE(pixmap));
+    cairo_set_source_surface(cr, frameAtIndex(currentFrame()), 0, 0);
+    cairo_paint(cr);
+    cairo_destroy(cr);
+
+    GdkPixbuf* pixbuf = gdk_pixbuf_get_from_drawable(0, GDK_DRAWABLE(pixmap), 0, 0, 0, 0, 0, width, height);
+    g_object_unref(pixmap);
+    g_object_unref(cmap);
+
+    return pixbuf;
+}
+
 }
diff --git a/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp b/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
index 4203a3c..6684108 100644
--- a/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
+++ b/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
@@ -49,7 +49,7 @@
 {
     cairo_font_extents_t font_extents;
     cairo_text_extents_t text_extents;
-    cairo_scaled_font_extents(m_font.m_scaledFont, &font_extents);
+    cairo_scaled_font_extents(m_platformData.m_scaledFont, &font_extents);
     m_ascent = static_cast<int>(font_extents.ascent);
     m_descent = static_cast<int>(font_extents.descent);
     m_lineSpacing = static_cast<int>(font_extents.height);
@@ -60,11 +60,19 @@
     // while we figure out what's going on.
     if (m_lineSpacing < m_ascent + m_descent)
         m_lineSpacing = m_ascent + m_descent;
-    cairo_scaled_font_text_extents(m_font.m_scaledFont, "x", &text_extents);
+    cairo_scaled_font_text_extents(m_platformData.m_scaledFont, "x", &text_extents);
     m_xHeight = text_extents.height;
-    cairo_scaled_font_text_extents(m_font.m_scaledFont, " ", &text_extents);
+    cairo_scaled_font_text_extents(m_platformData.m_scaledFont, " ", &text_extents);
     m_spaceWidth =  static_cast<int>(text_extents.x_advance);
     m_lineGap = m_lineSpacing - m_ascent - m_descent;
+    m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
+}
+
+void SimpleFontData::platformCharWidthInit()
+{
+    m_avgCharWidth = 0.f;
+    m_maxCharWidth = 0.f;
+    initCharWidths();
 }
 
 void SimpleFontData::platformDestroy()
@@ -86,38 +94,38 @@
 
 bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
 {
-    FT_Face face = cairo_ft_scaled_font_lock_face(m_font.m_scaledFont);
+    FT_Face face = cairo_ft_scaled_font_lock_face(m_platformData.m_scaledFont);
 
     if (!face)
         return false;
 
     for (unsigned i = 0; i < length; i++) {
         if (FcFreeTypeCharIndex(face, characters[i]) == 0) {
-            cairo_ft_scaled_font_unlock_face(m_font.m_scaledFont);
+            cairo_ft_scaled_font_unlock_face(m_platformData.m_scaledFont);
             return false;
         }
     }
 
-    cairo_ft_scaled_font_unlock_face(m_font.m_scaledFont);
+    cairo_ft_scaled_font_unlock_face(m_platformData.m_scaledFont);
 
     return true;
 }
 
 void SimpleFontData::determinePitch()
 {
-    m_treatAsFixedPitch = m_font.isFixedPitch();
+    m_treatAsFixedPitch = m_platformData.isFixedPitch();
 }
 
 float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
 {
-    ASSERT(m_font.m_scaledFont);
+    ASSERT(m_platformData.m_scaledFont);
 
     cairo_glyph_t cglyph = { glyph, 0, 0 };
     cairo_text_extents_t extents;
-    cairo_scaled_font_glyph_extents(m_font.m_scaledFont, &cglyph, 1, &extents);
+    cairo_scaled_font_glyph_extents(m_platformData.m_scaledFont, &cglyph, 1, &extents);
 
     float w = (float)m_spaceWidth;
-    if (cairo_scaled_font_status(m_font.m_scaledFont) == CAIRO_STATUS_SUCCESS && extents.x_advance != 0)
+    if (cairo_scaled_font_status(m_platformData.m_scaledFont) == CAIRO_STATUS_SUCCESS && extents.x_advance != 0)
         w = (float)extents.x_advance;
     return w;
 }
@@ -125,7 +133,7 @@
 void SimpleFontData::setFont(cairo_t* cr) const
 {
     ASSERT(cr);
-    m_font.setFont(cr);
+    m_platformData.setFont(cr);
 }
 
 }
diff --git a/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp b/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp
index e345a8c..e57d9e6 100644
--- a/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp
+++ b/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp
@@ -48,7 +48,7 @@
 {
     cairo_font_extents_t font_extents;
     cairo_text_extents_t text_extents;
-    cairo_scaled_font_extents(m_font.m_scaledFont, &font_extents);
+    cairo_scaled_font_extents(m_platformData.m_scaledFont, &font_extents);
     m_ascent = static_cast<int>(font_extents.ascent);
     m_descent = static_cast<int>(font_extents.descent);
     m_lineSpacing = static_cast<int>(font_extents.height);
@@ -59,11 +59,19 @@
     // while we figure out what's going on.
     if (m_lineSpacing < m_ascent + m_descent)
         m_lineSpacing = m_ascent + m_descent;
-    cairo_scaled_font_text_extents(m_font.m_scaledFont, "x", &text_extents);
+    cairo_scaled_font_text_extents(m_platformData.m_scaledFont, "x", &text_extents);
     m_xHeight = text_extents.height;
-    cairo_scaled_font_text_extents(m_font.m_scaledFont, " ", &text_extents);
+    cairo_scaled_font_text_extents(m_platformData.m_scaledFont, " ", &text_extents);
     m_spaceWidth =  static_cast<int>(text_extents.x_advance);
     m_lineGap = m_lineSpacing - m_ascent - m_descent;
+    m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
+}
+
+void SimpleFontData::platformCharWidthInit()
+{
+    m_avgCharWidth = 0.f;
+    m_maxCharWidth = 0.f;
+    initCharWidths();
 }
 
 void SimpleFontData::platformDestroy()
@@ -87,7 +95,7 @@
 {
     bool result = true;
 
-    PangoCoverage* coverage = pango_font_get_coverage(m_font.m_font, pango_language_get_default());
+    PangoCoverage* coverage = pango_font_get_coverage(m_platformData.m_font, pango_language_get_default());
 
     for (int i = 0; i < length; i++) {
         if (PANGO_COVERAGE_NONE == pango_coverage_get(coverage, characters[i])) {
@@ -108,19 +116,19 @@
         return;
     }
 
-    m_treatAsFixedPitch = m_font.isFixedPitch();
+    m_treatAsFixedPitch = m_platformData.isFixedPitch();
 }
 
 float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
 {
-    ASSERT(m_font.m_scaledFont);
+    ASSERT(m_platformData.m_scaledFont);
 
     cairo_glyph_t cglyph = { glyph, 0, 0 };
     cairo_text_extents_t extents;
-    cairo_scaled_font_glyph_extents(m_font.m_scaledFont, &cglyph, 1, &extents);
+    cairo_scaled_font_glyph_extents(m_platformData.m_scaledFont, &cglyph, 1, &extents);
 
     float w = (float)m_spaceWidth;
-    if (cairo_scaled_font_status(m_font.m_scaledFont) == CAIRO_STATUS_SUCCESS && extents.x_advance != 0)
+    if (cairo_scaled_font_status(m_platformData.m_scaledFont) == CAIRO_STATUS_SUCCESS && extents.x_advance != 0)
         w = (float)extents.x_advance;
     return w;
 }
@@ -128,7 +136,7 @@
 void SimpleFontData::setFont(cairo_t* cr) const
 {
     ASSERT(cr);
-    m_font.setFont(cr);
+    m_platformData.setFont(cr);
 }
 
 }
diff --git a/WebCore/platform/graphics/mac/ColorMac.h b/WebCore/platform/graphics/mac/ColorMac.h
index 830e9d9..8a5ce31 100644
--- a/WebCore/platform/graphics/mac/ColorMac.h
+++ b/WebCore/platform/graphics/mac/ColorMac.h
@@ -41,7 +41,7 @@
     
     // These functions assume NSColors are in DeviceRGB colorspace
     Color colorFromNSColor(NSColor *);
-    NSColor* nsColor(const Color&);
+    NSColor *nsColor(const Color&);
 
     bool usesTestModeFocusRingColor();
     void setUsesTestModeFocusRingColor(bool);
diff --git a/WebCore/platform/graphics/mac/ColorMac.mm b/WebCore/platform/graphics/mac/ColorMac.mm
index 1c4350c..05dd78d 100644
--- a/WebCore/platform/graphics/mac/ColorMac.mm
+++ b/WebCore/platform/graphics/mac/ColorMac.mm
@@ -24,13 +24,10 @@
  */
 
 #import "config.h"
-#import "Color.h"
 #import "ColorMac.h"
 
-#import <AppKit/AppKit.h>
-#import <wtf/Assertions.h>
-#import <wtf/StdLibExtras.h>
 #import <wtf/RetainPtr.h>
+#import <wtf/StdLibExtras.h>
 
 @interface WebCoreControlTintObserver : NSObject
 + (void)controlTintDidChange;
@@ -47,7 +44,13 @@
 
 static RGBA32 makeRGBAFromNSColor(NSColor *c)
 {
-    return makeRGBA((int)(255 * [c redComponent]), (int)(255 * [c greenComponent]), (int)(255 * [c blueComponent]), (int)(255 * [c alphaComponent]));
+    CGFloat redComponent;
+    CGFloat greenComponent;
+    CGFloat blueComponent;
+    CGFloat alpha;
+    [c getRed:&redComponent green:&greenComponent blue:&blueComponent alpha:&alpha];
+
+    return makeRGBA(255 * redComponent, 255 * greenComponent, 255 * blueComponent, 255 * alpha);
 }
 
 Color colorFromNSColor(NSColor *c)
@@ -55,21 +58,21 @@
     return Color(makeRGBAFromNSColor(c));
 }
 
-NSColor* nsColor(const Color& color)
+NSColor *nsColor(const Color& color)
 {
-    unsigned c = color.rgb();
+    RGBA32 c = color.rgb();
     switch (c) {
         case 0: {
             // Need this to avoid returning nil because cachedRGBAValues will default to 0.
-            DEFINE_STATIC_LOCAL(RetainPtr<NSColor>, clearColor, ([NSColor colorWithDeviceRed:0.0f green:0.0f blue:0.0f alpha:0.0f]));
+            DEFINE_STATIC_LOCAL(RetainPtr<NSColor>, clearColor, ([NSColor colorWithDeviceRed:0 green:0 blue:0 alpha:0]));
             return clearColor.get();
         }
         case Color::black: {
-            DEFINE_STATIC_LOCAL(RetainPtr<NSColor>, blackColor, ([NSColor colorWithDeviceRed:0.0f green:0.0f blue:0.0f alpha:1.0f]));
+            DEFINE_STATIC_LOCAL(RetainPtr<NSColor>, blackColor, ([NSColor colorWithDeviceRed:0 green:0 blue:0 alpha:1]));
             return blackColor.get();
         }
         case Color::white: {
-            DEFINE_STATIC_LOCAL(RetainPtr<NSColor>, whiteColor, ([NSColor colorWithDeviceRed:1.0f green:1.0f blue:1.0f alpha:1.0f]));
+            DEFINE_STATIC_LOCAL(RetainPtr<NSColor>, whiteColor, ([NSColor colorWithDeviceRed:1 green:1 blue:1 alpha:1]));
             return whiteColor.get();
         }
         default: {
@@ -81,10 +84,10 @@
                 if (cachedRGBAValues[i] == c)
                     return cachedColors[i].get();
 
-            NSColor* result = [NSColor colorWithDeviceRed:color.red() / 255.0f
-                                                    green:color.green() / 255.0f
-                                                     blue:color.blue() / 255.0f
-                                                    alpha:color.alpha() /255.0f];
+            NSColor *result = [NSColor colorWithDeviceRed:static_cast<CGFloat>(color.red()) / 255
+                                                    green:static_cast<CGFloat>(color.green()) / 255
+                                                     blue:static_cast<CGFloat>(color.blue()) / 255
+                                                    alpha:static_cast<CGFloat>(color.alpha()) /255];
 
             static int cursor;
             cachedRGBAValues[cursor] = c;
@@ -96,16 +99,13 @@
     }
 }
 
-static CGColorRef CGColorFromNSColor(NSColor* color)
+static CGColorRef CGColorFromNSColor(NSColor *color)
 {
     // This needs to always use device colorspace so it can de-calibrate the color for
     // CGColor to possibly recalibrate it.
-    NSColor* deviceColor = [color colorUsingColorSpaceName:NSDeviceRGBColorSpace];
-    CGFloat red = [deviceColor redComponent];
-    CGFloat green = [deviceColor greenComponent];
-    CGFloat blue = [deviceColor blueComponent];
-    CGFloat alpha = [deviceColor alphaComponent];
-    const CGFloat components[4] = { red, green, blue, alpha };
+    CGFloat components[4];
+    NSColor *deviceColor = [color colorUsingColorSpaceName:NSDeviceRGBColorSpace];
+    [deviceColor getRed:&components[0] green:&components[1] blue:&components[2] alpha:&components[3]];
     static CGColorSpaceRef deviceRGBColorSpace = CGColorSpaceCreateDeviceRGB();
     CGColorRef cgColor = CGColorCreate(deviceRGBColorSpace, components);
     return cgColor;
@@ -130,10 +130,10 @@
         [WebCoreControlTintObserver controlTintDidChange];
         tintIsKnown = true;
     }
-    
+
     if (usesTestModeFocusRingColor())
         return oldAquaFocusRingColor;
-    
+
     return systemFocusRingColor;
 }
 
@@ -153,7 +153,7 @@
 
 + (void)controlTintDidChange
 {
-    NSColor* color = [[NSColor keyboardFocusIndicatorColor] colorUsingColorSpaceName:NSDeviceRGBColorSpace];
+    NSColor *color = [[NSColor keyboardFocusIndicatorColor] colorUsingColorSpaceName:NSDeviceRGBColorSpace];
     WebCore::systemFocusRingColor = WebCore::makeRGBAFromNSColor(color);
 }
 
diff --git a/WebCore/platform/graphics/mac/CoreTextController.cpp b/WebCore/platform/graphics/mac/CoreTextController.cpp
index 49e83c4..05f29b5 100644
--- a/WebCore/platform/graphics/mac/CoreTextController.cpp
+++ b/WebCore/platform/graphics/mac/CoreTextController.cpp
@@ -100,7 +100,7 @@
     m_indices = reinterpret_cast<const CFIndex*>(CFDataGetBytePtr(m_indicesData.get()));
 }
 
-CoreTextController::CoreTextController(const Font* font, const TextRun& run, bool mayUseNaturalWritingDirection)
+CoreTextController::CoreTextController(const Font* font, const TextRun& run, bool mayUseNaturalWritingDirection, HashSet<const SimpleFontData*>* fallbackFonts)
     : m_font(*font)
     , m_run(run)
     , m_mayUseNaturalWritingDirection(mayUseNaturalWritingDirection)
@@ -112,6 +112,7 @@
     , m_currentRun(0)
     , m_glyphInCurrentRun(0)
     , m_finalRoundingWidth(0)
+    , m_fallbackFonts(fallbackFonts)
     , m_lastRoundingGlyph(0)
 {
     m_padding = m_run.padding();
@@ -156,12 +157,12 @@
             if (x <= adjustedAdvance) {
                 CFIndex hitIndex = coreTextRun.indexAt(j);
                 int stringLength = coreTextRun.stringLength();
-                TextBreakIterator* characterIterator = characterBreakIterator(coreTextRun.characters(), stringLength);
+                TextBreakIterator* cursorPositionIterator = cursorMovementIterator(coreTextRun.characters(), stringLength);
                 int clusterStart;
-                if (isTextBreak(characterIterator, hitIndex))
+                if (isTextBreak(cursorPositionIterator, hitIndex))
                     clusterStart = hitIndex;
                 else {
-                    clusterStart = textBreakPreceding(characterIterator, hitIndex);
+                    clusterStart = textBreakPreceding(cursorPositionIterator, hitIndex);
                     if (clusterStart == TextBreakDone)
                         clusterStart = 0;
                 }
@@ -169,7 +170,7 @@
                 if (!includePartialGlyphs)
                     return coreTextRun.stringLocation() + clusterStart;
 
-                int clusterEnd = textBreakFollowing(characterIterator, hitIndex);
+                int clusterEnd = textBreakFollowing(cursorPositionIterator, hitIndex);
                 if (clusterEnd == TextBreakDone)
                     clusterEnd = stringLength;
 
@@ -179,7 +180,7 @@
                 // reordering and on font fallback should occur within a CTLine.
                 if (clusterEnd - clusterStart > 1) {
                     int firstGlyphBeforeCluster = j - 1;
-                    while (firstGlyphBeforeCluster && coreTextRun.indexAt(firstGlyphBeforeCluster) >= clusterStart && coreTextRun.indexAt(firstGlyphBeforeCluster) < clusterEnd) {
+                    while (firstGlyphBeforeCluster >= 0 && coreTextRun.indexAt(firstGlyphBeforeCluster) >= clusterStart && coreTextRun.indexAt(firstGlyphBeforeCluster) < clusterEnd) {
                         CGFloat width = m_adjustedAdvances[offsetIntoAdjustedGlyphs + firstGlyphBeforeCluster].width;
                         clusterWidth += width;
                         x += width;
@@ -359,6 +360,9 @@
         return;
     }
 
+    if (m_fallbackFonts && fontData != m_font.primaryFont())
+        m_fallbackFonts->add(fontData);
+
     RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(NULL, cp, length, kCFAllocatorNull));
 
     RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(NULL, string.get(), fontData->getCFStringAttributes()));
@@ -426,7 +430,7 @@
 
         bool lastRun = r + 1 == runCount;
         const UChar* cp = coreTextRun.characters();
-        CGFloat roundedSpaceWidth = roundCGFloat(fontData->m_spaceWidth);
+        CGFloat roundedSpaceWidth = roundCGFloat(fontData->spaceWidth());
         bool roundsAdvances = !m_font.isPrinterFont() && fontData->platformData().roundsGlyphAdvances();
         bool hasExtraSpacing = (m_font.letterSpacing() || m_font.wordSpacing() || m_padding) && !m_run.spacingDisabled();
 
@@ -444,29 +448,29 @@
                 nextCh = *(m_coreTextRuns[r + 1].characters() + m_coreTextRuns[r + 1].indexAt(0));
 
             bool treatAsSpace = Font::treatAsSpace(ch);
-            CGGlyph glyph = treatAsSpace ? fontData->m_spaceGlyph : glyphs[i];
-            CGSize advance = treatAsSpace ? CGSizeMake(fontData->m_spaceWidth, advances[i].height) : advances[i];
+            CGGlyph glyph = treatAsSpace ? fontData->spaceGlyph() : glyphs[i];
+            CGSize advance = treatAsSpace ? CGSizeMake(fontData->spaceWidth(), advances[i].height) : advances[i];
 
             if (ch == '\t' && m_run.allowTabs()) {
                 float tabWidth = m_font.tabWidth();
                 advance.width = tabWidth - fmodf(m_run.xPos() + m_totalWidth, tabWidth);
             } else if (ch == zeroWidthSpace || Font::treatAsZeroWidthSpace(ch) && !treatAsSpace) {
                 advance.width = 0;
-                glyph = fontData->m_spaceGlyph;
+                glyph = fontData->spaceGlyph();
             }
 
             float roundedAdvanceWidth = roundf(advance.width);
             if (roundsAdvances)
                 advance.width = roundedAdvanceWidth;
 
-            advance.width += fontData->m_syntheticBoldOffset;
+            advance.width += fontData->syntheticBoldOffset();
 
             // We special case spaces in two ways when applying word rounding.
             // First, we round spaces to an adjusted width in all fonts.
             // Second, in fixed-pitch fonts we ensure that all glyphs that
             // match the width of the space glyph have the same width as the space glyph.
-            if (roundedAdvanceWidth == roundedSpaceWidth && (fontData->m_treatAsFixedPitch || glyph == fontData->m_spaceGlyph) && m_run.applyWordRounding())
-                advance.width = fontData->m_adjustedSpaceWidth;
+            if (roundedAdvanceWidth == roundedSpaceWidth && (fontData->pitch() == FixedPitch || glyph == fontData->spaceGlyph()) && m_run.applyWordRounding())
+                advance.width = fontData->adjustedSpaceWidth();
 
             if (hasExtraSpacing) {
                 // If we're a glyph with an advance, go ahead and add in letter-spacing.
@@ -475,7 +479,7 @@
                     advance.width += m_font.letterSpacing();
 
                 // Handle justification and word-spacing.
-                if (glyph == fontData->m_spaceGlyph) {
+                if (glyph == fontData->spaceGlyph()) {
                     // Account for padding. WebCore uses space padding to justify text.
                     // We distribute the specified padding over the available spaces in the run.
                     if (m_padding) {
diff --git a/WebCore/platform/graphics/mac/CoreTextController.h b/WebCore/platform/graphics/mac/CoreTextController.h
index 8dbb7fb..4dd6f93 100644
--- a/WebCore/platform/graphics/mac/CoreTextController.h
+++ b/WebCore/platform/graphics/mac/CoreTextController.h
@@ -37,7 +37,7 @@
 
 class CoreTextController {
 public:
-    CoreTextController(const Font*, const TextRun&, bool mayUseNaturalWritingDirection = false);
+    CoreTextController(const Font*, const TextRun&, bool mayUseNaturalWritingDirection = false, HashSet<const SimpleFontData*>* fallbackFonts = 0);
 
     // Advance and emit glyphs up to the specified character.
     void advance(unsigned to, GlyphBuffer* = 0);
@@ -106,6 +106,8 @@
     float m_padding;
     float m_padPerSpace;
 
+    HashSet<const SimpleFontData*>* m_fallbackFonts;
+
     unsigned m_lastRoundingGlyph;
 };
 
diff --git a/WebCore/platform/graphics/mac/FontCacheMac.mm b/WebCore/platform/graphics/mac/FontCacheMac.mm
index 2202459..2730d5a 100644
--- a/WebCore/platform/graphics/mac/FontCacheMac.mm
+++ b/WebCore/platform/graphics/mac/FontCacheMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -44,16 +44,30 @@
 
 namespace WebCore {
 
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+static void fontCacheRegisteredFontsChangedNotificationCallback(CFNotificationCenterRef, void* observer, CFStringRef name, const void *, CFDictionaryRef)
+{
+    ASSERT_UNUSED(observer, observer == fontCache());
+    ASSERT_UNUSED(name, CFEqual(name, kCTFontManagerRegisteredFontsChangedNotification));
+    fontCache()->invalidate();
+}
+#else
 static void fontCacheATSNotificationCallback(ATSFontNotificationInfoRef, void*)
 {
     fontCache()->invalidate();
 }
+#endif
 
 void FontCache::platformInit()
 {
     wkSetUpFontCache();
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    CFNotificationCenterAddObserver(CFNotificationCenterGetLocalCenter(), this, fontCacheRegisteredFontsChangedNotificationCallback, kCTFontManagerRegisteredFontsChangedNotification, 0, CFNotificationSuspensionBehaviorDeliverImmediately);
+#else
+    // kCTFontManagerRegisteredFontsChangedNotification does not exist on Leopard and earlier.
     // FIXME: Passing kATSFontNotifyOptionReceiveWhileSuspended may be an overkill and does not seem to work anyway.
     ATSFontNotificationSubscribe(fontCacheATSNotificationCallback, kATSFontNotifyOptionReceiveWhileSuspended, 0, 0);
+#endif
 }
 
 static int toAppKitFontWeight(FontWeight fontWeight)
diff --git a/WebCore/platform/graphics/mac/FontMac.mm b/WebCore/platform/graphics/mac/FontMac.mm
index dc86c4b..df9494a 100644
--- a/WebCore/platform/graphics/mac/FontMac.mm
+++ b/WebCore/platform/graphics/mac/FontMac.mm
@@ -28,7 +28,6 @@
 #import "Logging.h"
 #import "SimpleFontData.h"
 #import "WebCoreSystemInterface.h"
-#import "WebCoreTextRenderer.h"
 #import <AppKit/AppKit.h>
 
 #define SYNTHETIC_OBLIQUE_ANGLE 14
@@ -43,12 +42,17 @@
 
 namespace WebCore {
 
+bool Font::canReturnFallbackFontsForComplexText()
+{
+    return true;
+}
+
 void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, const GlyphBuffer& glyphBuffer, int from, int numGlyphs, const FloatPoint& point) const
 {
     CGContextRef cgContext = context->platformContext();
 
     bool originalShouldUseFontSmoothing = wkCGContextGetShouldSmoothFonts(cgContext);
-    bool newShouldUseFontSmoothing = WebCoreShouldUseFontSmoothing();
+    bool newShouldUseFontSmoothing = shouldUseSmoothing();
     
     if (originalShouldUseFontSmoothing != newShouldUseFontSmoothing)
         CGContextSetShouldSmoothFonts(cgContext, newShouldUseFontSmoothing);
@@ -99,8 +103,8 @@
         context->setFillColor(shadowFillColor);
         CGContextSetTextPosition(cgContext, point.x() + shadowSize.width(), point.y() + shadowSize.height());
         CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-        if (font->m_syntheticBoldOffset) {
-            CGContextSetTextPosition(cgContext, point.x() + shadowSize.width() + font->m_syntheticBoldOffset, point.y() + shadowSize.height());
+        if (font->syntheticBoldOffset()) {
+            CGContextSetTextPosition(cgContext, point.x() + shadowSize.width() + font->syntheticBoldOffset(), point.y() + shadowSize.height());
             CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         }
         context->setFillColor(fillColor);
@@ -108,8 +112,8 @@
 
     CGContextSetTextPosition(cgContext, point.x(), point.y());
     CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-    if (font->m_syntheticBoldOffset) {
-        CGContextSetTextPosition(cgContext, point.x() + font->m_syntheticBoldOffset, point.y());
+    if (font->syntheticBoldOffset()) {
+        CGContextSetTextPosition(cgContext, point.x() + font->syntheticBoldOffset(), point.y());
         CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
     }
 
diff --git a/WebCore/platform/graphics/mac/FontMacATSUI.mm b/WebCore/platform/graphics/mac/FontMacATSUI.mm
index 3794149..051abb7 100644
--- a/WebCore/platform/graphics/mac/FontMacATSUI.mm
+++ b/WebCore/platform/graphics/mac/FontMacATSUI.mm
@@ -47,13 +47,15 @@
 
 struct ATSULayoutParameters : Noncopyable
 {
-    ATSULayoutParameters(const TextRun& run)
+    ATSULayoutParameters(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts = 0)
         : m_run(run)
         , m_font(0)
         , m_hasSyntheticBold(false)
         , m_syntheticBoldPass(false)
         , m_padPerSpace(0)
-    {}
+        , m_fallbackFonts(fallbackFonts)
+    {
+    }
 
     ~ATSULayoutParameters()
     {
@@ -73,6 +75,7 @@
     bool m_hasSyntheticBold;
     bool m_syntheticBoldPass;
     float m_padPerSpace;
+    HashSet<const SimpleFontData*>* m_fallbackFonts;
 };
 
 static TextRun copyRunForDirectionalOverrideIfNecessary(const TextRun& run, OwnArrayPtr<UChar>& charactersWithOverride)
@@ -124,7 +127,7 @@
 
     ATSUFontID fontID = fontData->platformData().m_atsuFontID;
     if (!fontID) {
-        LOG_ERROR("unable to get ATSUFontID for %@", fontData->m_font.font());
+        LOG_ERROR("unable to get ATSUFontID for %@", fontData->platformData().font());
         return;
     }
 
@@ -134,7 +137,7 @@
         LOG_ERROR("ATSUCreateStyle failed (%d)", status);
 
     CGAffineTransform transform = CGAffineTransformMakeScale(1, -1);
-    if (fontData->m_font.m_syntheticOblique)
+    if (fontData->platformData().m_syntheticOblique)
         transform = CGAffineTransformConcat(transform, CGAffineTransformMake(1, 0, -tanf(SYNTHETIC_OBLIQUE_ANGLE * acosf(0) / 90), 1, 0, 0));
     Fixed fontSize = FloatToFixed(fontData->platformData().m_size);
     ByteCount styleSizes[4] = { sizeof(Fixed), sizeof(ATSUFontID), sizeof(CGAffineTransform), sizeof(Fract) };
@@ -180,7 +183,6 @@
         bool shouldRound = false;
         bool syntheticBoldPass = params->m_syntheticBoldPass;
         Fixed syntheticBoldOffset = 0;
-        ATSGlyphRef spaceGlyph = 0;
         bool hasExtraSpacing = (params->m_font->letterSpacing() || params->m_font->wordSpacing() || params->m_run.padding()) && !params->m_run.spacingDisabled();
         float padding = params->m_run.padding();
         // In the CoreGraphics code path, the rounding hack is applied in logical order.
@@ -190,27 +192,28 @@
         for (i = 1; i < count; i++) {
             bool isLastChar = i == count - 1;
             renderer = renderers[offset / 2];
-            if (renderer != lastRenderer) {
-                lastRenderer = renderer;
-                spaceGlyph = renderer->m_spaceGlyph;
-                // The CoreGraphics interpretation of NSFontAntialiasedIntegerAdvancementsRenderingMode seems
-                // to be "round each glyph's width to the nearest integer". This is not the same as ATSUI
-                // does in any of its device-metrics modes.
-                shouldRound = renderer->platformData().roundsGlyphAdvances();
-                if (syntheticBoldPass)
-                    syntheticBoldOffset = FloatToFixed(renderer->m_syntheticBoldOffset);
-            }
             float width;
             if (nextCh == zeroWidthSpace || Font::treatAsZeroWidthSpace(nextCh) && !Font::treatAsSpace(nextCh)) {
                 width = 0;
-                layoutRecords[i-1].glyphID = spaceGlyph;
+                layoutRecords[i-1].glyphID = renderer->spaceGlyph();
             } else {
                 width = FixedToFloat(layoutRecords[i].realPos - lastNativePos);
+                if (renderer != lastRenderer && width) {
+                    lastRenderer = renderer;
+                    // The CoreGraphics interpretation of NSFontAntialiasedIntegerAdvancementsRenderingMode seems
+                    // to be "round each glyph's width to the nearest integer". This is not the same as ATSUI
+                    // does in any of its device-metrics modes.
+                    shouldRound = renderer->platformData().roundsGlyphAdvances();
+                    if (syntheticBoldPass)
+                        syntheticBoldOffset = FloatToFixed(renderer->syntheticBoldOffset());
+                    if (params->m_fallbackFonts && renderer != params->m_font->primaryFont())
+                        params->m_fallbackFonts->add(renderer);
+                }
                 if (shouldRound)
                     width = roundf(width);
-                width += renderer->m_syntheticBoldOffset;
-                if (renderer->m_treatAsFixedPitch ? width == renderer->m_spaceWidth : (layoutRecords[i-1].flags & kATSGlyphInfoIsWhiteSpace))
-                    width = renderer->m_adjustedSpaceWidth;
+                width += renderer->syntheticBoldOffset();
+                if (renderer->pitch() == FixedPitch ? width == renderer->spaceWidth() : (layoutRecords[i-1].flags & kATSGlyphInfoIsWhiteSpace))
+                    width = renderer->adjustedSpaceWidth();
             }
             lastNativePos = layoutRecords[i].realPos;
 
@@ -258,7 +261,7 @@
                 if (syntheticBoldOffset)
                     layoutRecords[i-1].realPos += syntheticBoldOffset;
                 else
-                    layoutRecords[i-1].glyphID = spaceGlyph;
+                    layoutRecords[i-1].glyphID = renderer->spaceGlyph();
             }
             layoutRecords[i].realPos = FloatToFixed(lastAdjustedPos);
         }
@@ -460,7 +463,7 @@
                 }
             } else
                 m_fonts[i] = r;
-            if (m_fonts[i]->m_syntheticBoldOffset)
+            if (m_fonts[i]->syntheticBoldOffset())
                 m_hasSyntheticBold = true;
         }
         substituteOffset += substituteLength;
@@ -570,12 +573,12 @@
         graphicsContext->setShadow(shadowSize, shadowBlur, shadowColor);
 }
 
-float Font::floatWidthForComplexText(const TextRun& run) const
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
     if (run.length() == 0)
         return 0;
 
-    ATSULayoutParameters params(run);
+    ATSULayoutParameters params(run, fallbackFonts);
     params.initialize(this);
     
     OSStatus status;
diff --git a/WebCore/platform/graphics/mac/FontMacCoreText.cpp b/WebCore/platform/graphics/mac/FontMacCoreText.cpp
index 5fb9d5d..9dffc7a 100644
--- a/WebCore/platform/graphics/mac/FontMacCoreText.cpp
+++ b/WebCore/platform/graphics/mac/FontMacCoreText.cpp
@@ -86,9 +86,9 @@
     drawGlyphBuffer(context, glyphBuffer, run, startPoint);
 }
 
-float Font::floatWidthForComplexText(const TextRun& run) const
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
-    CoreTextController controller(this, run, true);
+    CoreTextController controller(this, run, true, fallbackFonts);
     return controller.totalWidth();
 }
 
diff --git a/WebCore/platform/graphics/mac/FontPlatformData.h b/WebCore/platform/graphics/mac/FontPlatformData.h
index e911867..1b7b884 100644
--- a/WebCore/platform/graphics/mac/FontPlatformData.h
+++ b/WebCore/platform/graphics/mac/FontPlatformData.h
@@ -82,6 +82,8 @@
     bool isHashTableDeletedValue() const { return m_font == hashTableDeletedFontValue(); }
 
     float size() const { return m_size; }
+    bool syntheticBold() const { return m_syntheticBold; }
+    bool syntheticOblique() const { return m_syntheticOblique; }
 
     bool m_syntheticBold;
     bool m_syntheticOblique;
diff --git a/WebCore/platform/graphics/mac/GraphicsContextMac.mm b/WebCore/platform/graphics/mac/GraphicsContextMac.mm
index 4e11602..2404319 100644
--- a/WebCore/platform/graphics/mac/GraphicsContextMac.mm
+++ b/WebCore/platform/graphics/mac/GraphicsContextMac.mm
@@ -96,27 +96,28 @@
         color = defaultColor;
     return color;
 }
-    
+
+// WebKit on Mac is a standard platform component, so it must use the standard platform artwork for underline.
 void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint& point, int width, bool grammar)
 {
     if (paintingDisabled())
         return;
         
-    // These are the same for misspelling or bad grammar
+    // These are the same for misspelling or bad grammar.
     int patternHeight = cMisspellingLineThickness;
     int patternWidth = cMisspellingLinePatternWidth;
  
     bool usingDot;
     NSColor *patternColor;
     if (grammar) {
-        // Constants for grammar pattern color
+        // Constants for grammar pattern color.
         static bool usingDotForGrammar = false;
         DEFINE_STATIC_LOCAL(RetainPtr<NSColor>, grammarPatternColor, (createPatternColor(@"GrammarDot", [NSColor greenColor], usingDotForGrammar)));
         
         usingDot = usingDotForGrammar;
         patternColor = grammarPatternColor.get();
     } else {
-        // Constants for spelling pattern color
+        // Constants for spelling pattern color.
         static bool usingDotForSpelling = false;
         DEFINE_STATIC_LOCAL(RetainPtr<NSColor>, spellingPatternColor, (createPatternColor(@"SpellingDot", [NSColor redColor], usingDotForSpelling)));
         
@@ -141,7 +142,7 @@
     // FIXME: This code should not be using wkSetPatternPhaseInUserSpace, as this approach is wrong
     // for transforms.
 
-    // Draw underline
+    // Draw underline.
     NSGraphicsContext *currentContext = [NSGraphicsContext currentContext];
     CGContextRef context = (CGContextRef)[currentContext graphicsPort];
     CGContextSaveGState(context);
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.h b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
index 3a692d3..50138d5 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.h
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
@@ -117,9 +117,8 @@
     bool requiresTiledLayer(const FloatSize&) const;
     void swapFromOrToTiledLayer(bool useTiledLayer);
 
-    void setHasContentsLayer(bool);
     void setContentsLayer(WebLayer*);
-    void setContentsLayerFlipped(bool);
+    WebLayer* contentsLayer() const { return m_contentsLayer.get(); }
     
     RetainPtr<WebLayer> m_layer;
     RetainPtr<WebLayer> m_transformLayer;
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
index f3f2d7f..f361437 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
@@ -271,9 +271,9 @@
     return forceSoftwareAnimation;
 }
 
-bool GraphicsLayer::graphicsContextsFlipped()
+GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayer::compositingCoordinatesOrientation()
 {
-    return true;
+    return CompositingCoordinatesBottomUp;
 }
 
 #ifndef NDEBUG
@@ -746,8 +746,10 @@
             swapFromOrToTiledLayer(needTiledLayer);
 
         BEGIN_BLOCK_OBJC_EXCEPTIONS
-        // Clobber any existing content. If necessary, CA will create backing store on the next display.
-        [m_layer.get() setContents:nil];
+        if (m_drawsContent)
+            [m_layer.get() setNeedsDisplay];
+        else
+            [m_layer.get() setContents:nil];
         
 #ifndef NDEBUG
         updateDebugIndicators();
@@ -761,7 +763,14 @@
     GraphicsLayer::setBackgroundColor(color, transition, beginTime);
 
     BEGIN_BLOCK_OBJC_EXCEPTIONS
-    setHasContentsLayer(true);
+    
+    if (!m_contentsLayer.get()) {
+        WebLayer* colorLayer = [WebLayer layer];
+#ifndef NDEBUG
+        [colorLayer setName:@"Color Layer"];
+#endif
+        setContentsLayer(colorLayer);
+    }
     
     if (transition && !transition->isEmptyOrZeroDuration()) {
         CALayer* presLayer = [m_contentsLayer.get() presentationLayer];
@@ -777,7 +786,6 @@
         CGColorRelease(bgColor);
     } else {
         removeAllAnimationsForProperty(AnimatedPropertyBackgroundColor);    
-        setHasContentsLayer(true);
         setLayerBackgroundColor(m_contentsLayer.get(), m_backgroundColor);
     }
 
@@ -787,7 +795,7 @@
 void GraphicsLayerCA::clearBackgroundColor()
 {
     if (!m_contentLayerForImageOrVideo)
-        setHasContentsLayer(false);
+        setContentsLayer(0);
     else
         clearLayerBackgroundColor(m_contentsLayer.get());
 }
@@ -1082,35 +1090,27 @@
 void GraphicsLayerCA::setContentsToImage(Image* image)
 {
     if (image) {
-        setHasContentsLayer(true);
-
-        // FIXME: is image flipping really a property of the graphics context?
-        bool needToFlip = GraphicsLayer::graphicsContextsFlipped();
-        CGPoint anchorPoint = needToFlip ? CGPointMake(0.0f, 1.0f) : CGPointZero;
-
         BEGIN_BLOCK_OBJC_EXCEPTIONS
         {
-            CGImageRef theImage = image->nativeImageForCurrentFrame();
-            // FIXME: maybe only do trilinear if the image is being scaled down,
-            // but then what if the layer size changes?
-#if HAVE_MODERN_QUARTZCORE
-            [m_contentsLayer.get() setMinificationFilter:kCAFilterTrilinear];
+            if (!m_contentsLayer.get()) {
+                WebLayer* imageLayer = [WebLayer layer];
+#ifndef NDEBUG
+                [imageLayer setName:@"Image Layer"];
 #endif
-            if (needToFlip) {
-                CATransform3D flipper = {
-                    1.0f, 0.0f, 0.0f, 0.0f,
-                    0.0f, -1.0f, 0.0f, 0.0f,
-                    0.0f, 0.0f, 1.0f, 0.0f,
-                    0.0f, 0.0f, 0.0f, 1.0f};
-                [m_contentsLayer.get() setTransform:flipper];
+                setContentsLayer(imageLayer);
             }
 
-            [m_contentsLayer.get() setAnchorPoint:anchorPoint];
+            // FIXME: maybe only do trilinear if the image is being scaled down,
+            // but then what if the layer size changes?
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            [m_contentsLayer.get() setMinificationFilter:kCAFilterTrilinear];
+#endif
+            CGImageRef theImage = image->nativeImageForCurrentFrame();
             [m_contentsLayer.get() setContents:(id)theImage];
         }
         END_BLOCK_OBJC_EXCEPTIONS
     } else
-        setHasContentsLayer(false);
+        setContentsLayer(0);
 
     m_contentLayerForImageOrVideo = (image != 0);
 }
@@ -1124,7 +1124,7 @@
 void GraphicsLayerCA::clearContents()
 {
     if (m_contentLayerForImageOrVideo) {
-        setHasContentsLayer(false);
+        setContentsLayer(0);
         m_contentLayerForImageOrVideo = false;
     }
 }
@@ -1431,7 +1431,7 @@
         [tiledLayer setLevelsOfDetail:1];
         [tiledLayer setLevelsOfDetailBias:0];
 
-        if (GraphicsLayer::graphicsContextsFlipped())
+        if (GraphicsLayer::compositingCoordinatesOrientation() == GraphicsLayer::CompositingCoordinatesBottomUp)
             [tiledLayer setContentsGravity:@"bottomLeft"];
         else
             [tiledLayer setContentsGravity:@"topLeft"];
@@ -1476,24 +1476,6 @@
 #endif
 }
 
-void GraphicsLayerCA::setHasContentsLayer(bool hasLayer)
-{
-    BEGIN_BLOCK_OBJC_EXCEPTIONS
-
-    if (hasLayer && !m_contentsLayer) {
-        // create the inner layer
-        WebLayer* contentsLayer = [WebLayer layer];
-#ifndef NDEBUG
-        [contentsLayer setName:@"Contents Layer"];
-#endif
-        setContentsLayer(contentsLayer);
-
-    } else if (!hasLayer && m_contentsLayer)
-        setContentsLayer(0);
-
-    END_BLOCK_OBJC_EXCEPTIONS
-}
-
 void GraphicsLayerCA::setContentsLayer(WebLayer* contentsLayer)
 {
     if (contentsLayer == m_contentsLayer)
@@ -1511,15 +1493,27 @@
         [contentsLayer setStyle:[NSDictionary dictionaryWithObject:nullActionsDictionary() forKey:@"actions"]];
 
         m_contentsLayer.adoptNS([contentsLayer retain]);
-        [m_contentsLayer.get() setAnchorPoint:CGPointZero];
-        [m_layer.get() addSublayer:m_contentsLayer.get()];
+
+        bool needToFlip = GraphicsLayer::compositingCoordinatesOrientation() == GraphicsLayer::CompositingCoordinatesBottomUp;
+        CGPoint anchorPoint = needToFlip ? CGPointMake(0.0f, 1.0f) : CGPointZero;
+
+        // If the layer world is flipped, we need to un-flip the contents layer
+        if (needToFlip) {
+            CATransform3D flipper = {
+                1.0f, 0.0f, 0.0f, 0.0f,
+                0.0f, -1.0f, 0.0f, 0.0f,
+                0.0f, 0.0f, 1.0f, 0.0f,
+                0.0f, 0.0f, 0.0f, 1.0f};
+            [m_contentsLayer.get() setTransform:flipper];
+        }
+        [m_contentsLayer.get() setAnchorPoint:anchorPoint];
+
+        // Insert the content layer first. Video elements require this, because they have
+        // shadow content that must display in front of the video.
+        [m_layer.get() insertSublayer:m_contentsLayer.get() atIndex:0];
 
         updateContentsRect();
 
-        // Set contents to nil if the layer does not draw its own content.
-        if (m_client && !drawsContent())
-            [m_layer.get() setContents:nil];
-
 #ifndef NDEBUG
         if (showDebugBorders()) {
             setLayerBorderColor(m_contentsLayer.get(), Color(0, 0, 128, 180));
diff --git a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
index 677c31a..f90f258 100644
--- a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
+++ b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
@@ -30,6 +30,7 @@
 
 #include "MediaPlayerPrivate.h"
 #include "Timer.h"
+#include "FloatSize.h"
 #include <wtf/RetainPtr.h>
 
 #ifdef __OBJC__
@@ -127,6 +128,8 @@
     float maxTimeLoaded() const;
     void disableUnsupportedTracks();
     
+    void sawUnsupportedTracks();
+    void cacheMovieScale();
     bool metaDataAvailable() const { return m_qtMovie && m_readyState >= MediaPlayer::HaveMetadata; }
 
     MediaPlayer* m_player;
@@ -142,7 +145,10 @@
     bool m_isStreaming;
     bool m_visible;
     IntRect m_rect;
+    FloatSize m_scaleFactor;
     unsigned m_enabledTrackCount;
+    unsigned m_totalTrackCount;
+    bool m_hasUnsupportedTracks;
     float m_duration;
 #if DRAW_FRAME_RATE
     int  m_frameCountWhilePlaying;
diff --git a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
index 74a9ff9..dd41ed3 100644
--- a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
+++ b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
@@ -37,6 +37,7 @@
 #import "FrameView.h"
 #import "GraphicsContext.h"
 #import "KURL.h"
+#import "MIMETypeRegistry.h"
 #import "SoftLinking.h"
 #import "WebCoreSystemInterface.h"
 #import <QTKit/QTKit.h>
@@ -67,6 +68,7 @@
 SOFT_LINK_CLASS(QTKit, QTMovie)
 SOFT_LINK_CLASS(QTKit, QTMovieView)
 
+SOFT_LINK_POINTER(QTKit, QTTrackMediaTypeAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMediaTypeAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMediaTypeBase, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMediaTypeMPEG, NSString *)
@@ -81,6 +83,7 @@
 SOFT_LINK_POINTER(QTKit, QTMovieLoadStateAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieLoadStateDidChangeNotification, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieNaturalSizeAttribute, NSString *)
+SOFT_LINK_POINTER(QTKit, QTMovieCurrentSizeAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMoviePreventExternalURLLinksAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieRateDidChangeNotification, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieSizeDidChangeNotification, NSString *)
@@ -90,10 +93,15 @@
 SOFT_LINK_POINTER(QTKit, QTMovieVolumeDidChangeNotification, NSString *)
 SOFT_LINK_POINTER(QTKit, QTSecurityPolicyNoCrossSiteAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTVideoRendererWebKitOnlyNewImageAvailableNotification, NSString *)
+#ifndef BUILDING_ON_TIGER
+SOFT_LINK_POINTER(QTKit, QTMovieApertureModeClean, NSString *)
+SOFT_LINK_POINTER(QTKit, QTMovieApertureModeAttribute, NSString *)
+#endif
 
 #define QTMovie getQTMovieClass()
 #define QTMovieView getQTMovieViewClass()
 
+#define QTTrackMediaTypeAttribute getQTTrackMediaTypeAttribute()
 #define QTMediaTypeAttribute getQTMediaTypeAttribute()
 #define QTMediaTypeBase getQTMediaTypeBase()
 #define QTMediaTypeMPEG getQTMediaTypeMPEG()
@@ -108,6 +116,7 @@
 #define QTMovieLoadStateAttribute getQTMovieLoadStateAttribute()
 #define QTMovieLoadStateDidChangeNotification getQTMovieLoadStateDidChangeNotification()
 #define QTMovieNaturalSizeAttribute getQTMovieNaturalSizeAttribute()
+#define QTMovieCurrentSizeAttribute getQTMovieCurrentSizeAttribute()
 #define QTMoviePreventExternalURLLinksAttribute getQTMoviePreventExternalURLLinksAttribute()
 #define QTMovieRateDidChangeNotification getQTMovieRateDidChangeNotification()
 #define QTMovieSizeDidChangeNotification getQTMovieSizeDidChangeNotification()
@@ -117,6 +126,10 @@
 #define QTMovieVolumeDidChangeNotification getQTMovieVolumeDidChangeNotification()
 #define QTSecurityPolicyNoCrossSiteAttribute getQTSecurityPolicyNoCrossSiteAttribute()
 #define QTVideoRendererWebKitOnlyNewImageAvailableNotification getQTVideoRendererWebKitOnlyNewImageAvailableNotification()
+#ifndef BUILDING_ON_TIGER
+#define QTMovieApertureModeClean getQTMovieApertureModeClean()
+#define QTMovieApertureModeAttribute getQTMovieApertureModeAttribute()
+#endif
 
 // Older versions of the QTKit header don't have these constants.
 #if !defined QTKIT_VERSION_MAX_ALLOWED || QTKIT_VERSION_MAX_ALLOWED <= QTKIT_VERSION_7_0
@@ -184,7 +197,10 @@
     , m_isStreaming(false)
     , m_visible(false)
     , m_rect()
+    , m_scaleFactor(1, 1)
     , m_enabledTrackCount(0)
+    , m_totalTrackCount(0)
+    , m_hasUnsupportedTracks(false)
     , m_duration(-1.0f)
 #if DRAW_FRAME_RATE
     , m_frameCountWhilePlaying(0)
@@ -221,10 +237,15 @@
                                      [NSNumber numberWithBool:YES], QTMoviePreventExternalURLLinksAttribute,
                                      [NSNumber numberWithBool:YES], QTSecurityPolicyNoCrossSiteAttribute,
                                      [NSNumber numberWithBool:NO], QTMovieAskUnresolvedDataRefsAttribute,
-                                     [NSNumber numberWithBool:YES], @"QTMovieOpenForPlaybackAttribute",     // FIXME: Use defined attribute when required version of QT supports this attribute
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+                                     [NSNumber numberWithBool:YES], @"QTMovieOpenForPlaybackAttribute",
+#endif
+#ifndef BUILDING_ON_TIGER
+                                     QTMovieApertureModeClean, QTMovieApertureModeAttribute,
+#endif
                                      nil];
     
-    NSError* error = nil;
+    NSError *error = nil;
     m_qtMovie.adoptNS([[QTMovie alloc] initWithAttributes:movieAttributes error:&error]);
     
     // FIXME: Find a proper way to detect streaming content.
@@ -239,6 +260,17 @@
                                              selector:@selector(loadStateChanged:) 
                                                  name:QTMovieLoadStateDidChangeNotification 
                                                object:m_qtMovie.get()];
+
+    // In updateState(), we track when maxTimeLoaded() == duration().
+    // In newer version of QuickTime, a notification is emitted when maxTimeLoaded changes.
+    // In older version of QuickTime, QTMovieLoadStateDidChangeNotification be fired.
+    if (NSString *maxTimeLoadedChangeNotification = wkQTMovieMaxTimeLoadedChangeNotification()) {
+        [[NSNotificationCenter defaultCenter] addObserver:m_objcObserver.get()
+                                                 selector:@selector(loadStateChanged:) 
+                                                     name:maxTimeLoadedChangeNotification
+                                                   object:m_qtMovie.get()];        
+    }
+
     [[NSNotificationCenter defaultCenter] addObserver:m_objcObserver.get()
                                              selector:@selector(rateChanged:) 
                                                  name:QTMovieRateDidChangeNotification 
@@ -545,7 +577,16 @@
 {
     if (!metaDataAvailable())
         return IntSize();
-    return IntSize([[m_qtMovie.get() attributeForKey:QTMovieNaturalSizeAttribute] sizeValue]);
+
+    // In spite of the name of this method, return QTMovieNaturalSizeAttribute transformed by the 
+    // initial movie scale because the spec says intrinsic size is:
+    //
+    //    ... the dimensions of the resource in CSS pixels after taking into account the resource's 
+    //    dimensions, aspect ratio, clean aperture, resolution, and so forth, as defined for the 
+    //    format used by the resource
+    
+    NSSize naturalSize = [[m_qtMovie.get() attributeForKey:QTMovieNaturalSizeAttribute] sizeValue];
+    return IntSize(naturalSize.width * m_scaleFactor.width(), naturalSize.height * m_scaleFactor.height());
 }
 
 bool MediaPlayerPrivate::hasVideo() const
@@ -586,8 +627,14 @@
 
 float MediaPlayerPrivate::maxTimeSeekable() const
 {
+    if (!metaDataAvailable())
+        return 0;
+
     // infinite duration means live stream
-    return isinf(duration()) ? 0 : maxTimeLoaded();
+    if (isinf(duration()))
+        return 0;
+
+    return wkQTMovieMaxTimeSeekable(m_qtMovie.get());
 }
 
 float MediaPlayerPrivate::maxTimeLoaded() const
@@ -629,6 +676,31 @@
     updateStates();
 }
 
+void MediaPlayerPrivate::cacheMovieScale()
+{
+    NSSize initialSize = NSZeroSize;
+    NSSize naturalSize = [[m_qtMovie.get() attributeForKey:QTMovieNaturalSizeAttribute] sizeValue];
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    // QTMovieCurrentSizeAttribute is not allowed with instances of QTMovie that have been 
+    // opened with QTMovieOpenForPlaybackAttribute, so ask for the display transform attribute instead.
+    NSAffineTransform *displayTransform = [m_qtMovie.get() attributeForKey:@"QTMoviePreferredTransformAttribute"];
+    if (displayTransform)
+        initialSize = [displayTransform transformSize:naturalSize];
+    else {
+        initialSize.width = naturalSize.width;
+        initialSize.height = naturalSize.height;
+    }
+#else
+    initialSize = [[m_qtMovie.get() attributeForKey:QTMovieCurrentSizeAttribute] sizeValue];
+#endif
+
+    if (naturalSize.width)
+        m_scaleFactor.setWidth(initialSize.width / naturalSize.width);
+    if (naturalSize.height)
+        m_scaleFactor.setHeight(initialSize.height / naturalSize.height);
+}
+
 void MediaPlayerPrivate::updateStates()
 {
     MediaPlayer::NetworkState oldNetworkState = m_networkState;
@@ -636,18 +708,37 @@
     
     long loadState = m_qtMovie ? [[m_qtMovie.get() attributeForKey:QTMovieLoadStateAttribute] longValue] : static_cast<long>(QTMovieLoadStateError);
 
-    if (loadState >= QTMovieLoadStateLoaded && m_readyState < MediaPlayer::HaveMetadata && !m_player->inMediaDocument()) {
+    if (loadState >= QTMovieLoadStateLoaded && m_readyState < MediaPlayer::HaveMetadata) {
         disableUnsupportedTracks();
-        if (!m_enabledTrackCount)
+        if (m_player->inMediaDocument()) {
+            if (!m_enabledTrackCount || m_enabledTrackCount != m_totalTrackCount) {
+                // This is a type of media that we do not handle directly with a <video> 
+                // element, likely streamed media or QuickTime VR. Tell the MediaPlayerClient
+                // that we noticed.
+                sawUnsupportedTracks();
+                return;
+            }
+        } else if (!m_enabledTrackCount) {
             loadState = QTMovieLoadStateError;
+        }
+        
+        if (loadState != QTMovieLoadStateError)
+            cacheMovieScale();
     }
 
-    if (loadState >= QTMovieLoadStateComplete && !m_isStreaming) {
+    BOOL completelyLoaded = !m_isStreaming && (loadState >= QTMovieLoadStateComplete);
+
+    // Note: QT indicates that we are fully loaded with QTMovieLoadStateComplete.
+    // However newer versions of QT do not, so we check maxTimeLoaded against duration.
+    if (!completelyLoaded && !m_isStreaming && metaDataAvailable())
+        completelyLoaded = maxTimeLoaded() == duration();
+
+    if (completelyLoaded) {
         // "Loaded" is reserved for fully buffered movies, never the case when streaming
         m_networkState = MediaPlayer::Loaded;
         m_readyState = MediaPlayer::HaveEnoughData;
     } else if (loadState >= QTMovieLoadStatePlaythroughOK) {
-        m_readyState = MediaPlayer::HaveFutureData;
+        m_readyState = MediaPlayer::HaveEnoughData;
         m_networkState = MediaPlayer::Loading;
     } else if (loadState >= QTMovieLoadStatePlayable) {
         // FIXME: This might not work correctly in streaming case, <rdar://problem/5693967>
@@ -657,11 +748,17 @@
         m_readyState = MediaPlayer::HaveMetadata;
         m_networkState = MediaPlayer::Loading;
     } else if (loadState > QTMovieLoadStateError) {
-        m_readyState = MediaPlayer::HaveNothing;        
+        m_readyState = MediaPlayer::HaveNothing;
         m_networkState = MediaPlayer::Loading;
     } else {
-        float loaded = maxTimeLoaded();
+        if (m_player->inMediaDocument()) {
+            // Something went wrong in the loading of media within a standalone file. 
+            // This can occur with chained refmovies pointing to streamed media.
+            sawUnsupportedTracks();
+            return;
+        }
 
+        float loaded = maxTimeLoaded();
         if (!loaded)
             m_readyState = MediaPlayer::HaveNothing;
 
@@ -684,7 +781,7 @@
     if (m_readyState != oldReadyState)
         m_player->readyStateChanged();
 
-    if (loadState >= QTMovieLoadStateLoaded && oldReadyState < MediaPlayer::HaveMetadata && m_player->visible())
+    if (loadState >= QTMovieLoadStateLoaded && (!m_qtMovieView && !m_qtVideoRenderer) && m_player->visible())
         setUpVideoRendering();
 
     if (loadState >= QTMovieLoadStateLoaded) {
@@ -699,28 +796,39 @@
 
 void MediaPlayerPrivate::loadStateChanged()
 {
-    updateStates();
+    if (!m_hasUnsupportedTracks)
+        updateStates();
 }
 
 void MediaPlayerPrivate::rateChanged()
 {
+    if (m_hasUnsupportedTracks)
+        return;
+
     updateStates();
     m_player->rateChanged();
 }
 
 void MediaPlayerPrivate::sizeChanged()
 {
-    m_player->sizeChanged();
+    if (!m_hasUnsupportedTracks)
+        m_player->sizeChanged();
 }
 
 void MediaPlayerPrivate::timeChanged()
 {
+    if (m_hasUnsupportedTracks)
+        return;
+
     updateStates();
     m_player->timeChanged();
 }
 
 void MediaPlayerPrivate::didEnd()
 {
+    if (m_hasUnsupportedTracks)
+        return;
+
     m_startedPlaying = false;
 #if DRAW_FRAME_RATE
     m_timeStoppedPlaying = [NSDate timeIntervalSinceReferenceDate];
@@ -729,22 +837,15 @@
     m_player->timeChanged();
 }
 
-void MediaPlayerPrivate::setSize(const IntSize& size) 
+void MediaPlayerPrivate::setSize(const IntSize&) 
 { 
-    if (!m_qtMovieView) 
-        return;
-
-    m_rect.setSize(size);
-    if (m_player->inMediaDocument())
-        // We need the QTMovieView to be placed in the proper location for document mode.
-        [m_qtMovieView.get() setFrame:m_rect];
-    else {
-        // We don't really need the QTMovieView in any specific location so let's just get it out of the way
-        // where it won't intercept events or try to bring up the context menu.
-        IntRect farAwayButCorrectSize(m_rect);
-        farAwayButCorrectSize.move(-1000000, -1000000);
-        [m_qtMovieView.get() setFrame:farAwayButCorrectSize];
-    }   
+    // Don't resize the view now because [view setFrame] also resizes the movie itself, and because
+    // the renderer calls this function immediately when we report a size change (QTMovieSizeDidChangeNotification)
+    // we can get into a feedback loop observing the size change and resetting the size, and this can cause
+    // QuickTime to miss resetting a movie's size when the media size changes (as happens with an rtsp movie
+    // once the rtsp server sends the track sizes). Instead we remember the size passed to paint() and resize
+    // the view when it changes.
+    // <rdar://problem/6336092> REGRESSION: rtsp movie does not resize correctly
 }
 
 void MediaPlayerPrivate::setVisible(bool b)
@@ -761,6 +862,9 @@
 
 void MediaPlayerPrivate::repaint()
 {
+    if (m_hasUnsupportedTracks)
+        return;
+
 #if DRAW_FRAME_RATE
     if (m_startedPlaying) {
         m_frameCountWhilePlaying++;
@@ -775,7 +879,7 @@
 
 void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& r)
 {
-    if (context->paintingDisabled())
+    if (context->paintingDisabled() || m_hasUnsupportedTracks)
         return;
     NSView *view = m_qtMovieView.get();
     id qtVideoRenderer = m_qtVideoRenderer.get();
@@ -802,12 +906,28 @@
         [(id<WebKitVideoRenderingDetails>)qtVideoRenderer drawInRect:paintRect];
         [NSGraphicsContext restoreGraphicsState];
     } else {
-        if (m_player->inMediaDocument() && r != m_rect) {
-            // the QTMovieView needs to be placed in the proper location for document mode
-            m_rect = r;
-            [view setFrame:m_rect];
+        if (m_rect != r) {
+             m_rect = r;
+            if (m_player->inMediaDocument()) {
+                // the QTMovieView needs to be placed in the proper location for document mode
+                [view setFrame:m_rect];
+            }
+            else {
+                // We don't really need the QTMovieView in any specific location so let's just get it out of the way
+                // where it won't intercept events or try to bring up the context menu.
+                IntRect farAwayButCorrectSize(m_rect);
+                farAwayButCorrectSize.move(-1000000, -1000000);
+                [view setFrame:farAwayButCorrectSize];
+            }
         }
-        [view displayRectIgnoringOpacity:paintRect inContext:newContext];
+
+        if (m_player->inMediaDocument()) {
+            // If we're using a QTMovieView in a media document, the view may get layer-backed. AppKit won't update
+            // the layer hosting correctly if we call displayRectIgnoringOpacity:inContext:, so use displayRectIgnoringOpacity:
+            // in this case. See <rdar://problem/6702882>.
+            [view displayRectIgnoringOpacity:paintRect];
+        } else
+            [view displayRectIgnoringOpacity:paintRect inContext:newContext];
     }
 
 #if DRAW_FRAME_RATE
@@ -839,25 +959,57 @@
     [m_objcObserver.get() setDelayCallbacks:NO];
 }
 
-static HashSet<String> mimeTypeCache()
+static void addFileTypesToCache(NSArray * fileTypes, HashSet<String> &cache)
+{
+    int count = [fileTypes count];
+    for (int n = 0; n < count; n++) {
+        CFStringRef ext = reinterpret_cast<CFStringRef>([fileTypes objectAtIndex:n]);
+        RetainPtr<CFStringRef> uti(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassFilenameExtension, ext, NULL));
+        if (!uti)
+            continue;
+        RetainPtr<CFStringRef> mime(AdoptCF, UTTypeCopyPreferredTagWithClass(uti.get(), kUTTagClassMIMEType));
+
+        // UTI types are missing many media related MIME types supported by QTKit, see rdar://6434168,
+        // and not all third party movie importers register their types, so if we didn't find a type for
+        // this extension look it up in the hard coded table in the MIME type regsitry.
+        if (!mime) {
+            // -movieFileTypes: returns both file extensions and OSTypes. The later are surrounded by single
+            // quotes, eg. 'MooV', so don't bother looking at those.
+            if (CFStringGetCharacterAtIndex(ext, 0) != '\'') {
+                String mediaType = MIMETypeRegistry::getMediaMIMETypeForExtension(String(ext));
+                if (!mediaType.isEmpty())
+                    mime.adoptCF(mediaType.createCFString());
+            }
+        }
+        if (!mime)
+            continue;
+        cache.add(mime.get());
+    }    
+}
+
+static HashSet<String> mimeCommonTypesCache()
 {
     DEFINE_STATIC_LOCAL(HashSet<String>, cache, ());
     static bool typeListInitialized = false;
 
     if (!typeListInitialized) {
-        NSArray* fileTypes = [QTMovie movieFileTypes:QTIncludeCommonTypes];
-        int count = [fileTypes count];
-        for (int n = 0; n < count; n++) {
-            CFStringRef ext = reinterpret_cast<CFStringRef>([fileTypes objectAtIndex:n]);
-            RetainPtr<CFStringRef> uti(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassFilenameExtension, ext, NULL));
-            if (!uti)
-                continue;
-            RetainPtr<CFStringRef> mime(AdoptCF, UTTypeCopyPreferredTagWithClass(uti.get(), kUTTagClassMIMEType));
-            if (!mime)
-                continue;
-            cache.add(mime.get());
-        }
         typeListInitialized = true;
+        NSArray* fileTypes = [QTMovie movieFileTypes:QTIncludeCommonTypes];
+        addFileTypesToCache(fileTypes, cache);
+    }
+    
+    return cache;
+} 
+
+static HashSet<String> mimeModernTypesCache()
+{
+    DEFINE_STATIC_LOCAL(HashSet<String>, cache, ());
+    static bool typeListInitialized = false;
+    
+    if (!typeListInitialized) {
+        typeListInitialized = true;
+        NSArray* fileTypes = [QTMovie movieFileTypes:(QTMovieFileTypeOptions)wkQTIncludeOnlyModernMediaFileTypes()];
+        addFileTypesToCache(fileTypes, cache);
     }
     
     return cache;
@@ -865,14 +1017,21 @@
 
 void MediaPlayerPrivate::getSupportedTypes(HashSet<String>& types)
 {
-    types = mimeTypeCache();
+    // Note: this method starts QTKitServer if it isn't already running when in 64-bit because it has to return the list 
+    // of every MIME type supported by QTKit.
+    types = mimeCommonTypesCache();
 } 
 
 MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
 {
-    // only return "IsSupported" if there is no codecs parameter for now as there is no way to ask QT if it supports an
-    //  extended MIME type yet
-    return mimeTypeCache().contains(type) ? (codecs && !codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported) : MediaPlayer::IsNotSupported;
+    // Only return "IsSupported" if there is no codecs parameter for now as there is no way to ask QT if it supports an
+    // extended MIME type yet.
+
+    // We check the "modern" type cache first, as it doesn't require QTKitServer to start.
+    if (mimeModernTypesCache().contains(type) || mimeCommonTypesCache().contains(type))
+        return (codecs && !codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported);
+
+    return MediaPlayer::IsNotSupported;
 }
 
 bool MediaPlayerPrivate::isAvailable()
@@ -900,6 +1059,7 @@
 {
     if (!m_qtMovie) {
         m_enabledTrackCount = 0;
+        m_totalTrackCount = 0;
         return;
     }
     
@@ -911,15 +1071,19 @@
         allowedTrackTypes->add(QTMediaTypeText);
         allowedTrackTypes->add(QTMediaTypeBase);
         allowedTrackTypes->add(QTMediaTypeMPEG);
-        allowedTrackTypes->add("clcp");
-        allowedTrackTypes->add("sbtl");
+        allowedTrackTypes->add("clcp"); // Closed caption
+        allowedTrackTypes->add("sbtl"); // Subtitle
+        allowedTrackTypes->add("odsm"); // MPEG-4 object descriptor stream
+        allowedTrackTypes->add("sdsm"); // MPEG-4 scene description stream
+        allowedTrackTypes->add("tmcd"); // timecode
+        allowedTrackTypes->add("tc64"); // timcode-64
     }
     
     NSArray *tracks = [m_qtMovie.get() tracks];
     
-    unsigned trackCount = [tracks count];
-    m_enabledTrackCount = trackCount;
-    for (unsigned trackIndex = 0; trackIndex < trackCount; trackIndex++) {
+    m_totalTrackCount = [tracks count];
+    m_enabledTrackCount = m_totalTrackCount;
+    for (unsigned trackIndex = 0; trackIndex < m_totalTrackCount; trackIndex++) {
         // Grab the track at the current index. If there isn't one there, then
         // we can move onto the next one.
         QTTrack *track = [tracks objectAtIndex:trackIndex];
@@ -931,24 +1095,18 @@
         if (![track isEnabled])
             continue;
         
-        // Grab the track's media. We're going to check to see if we need to
-        // disable the tracks. They could be unsupported.
-        QTMedia *trackMedia = [track media];
-        if (!trackMedia)
-            continue;
-        
-        // Grab the media type for this track.
-        NSString *mediaType = [trackMedia attributeForKey:QTMediaTypeAttribute];
+        // Get the track's media type.
+        NSString *mediaType = [track attributeForKey:QTTrackMediaTypeAttribute];
         if (!mediaType)
             continue;
-        
+
         // Test whether the media type is in our white list.
         if (!allowedTrackTypes->contains(mediaType)) {
             // If this track type is not allowed, then we need to disable it.
             [track setEnabled:NO];
             --m_enabledTrackCount;
         }
-        
+
         // Disable chapter tracks. These are most likely to lead to trouble, as
         // they will be composited under the video tracks, forcing QT to do extra
         // work.
@@ -982,6 +1140,12 @@
     }
 }
 
+void MediaPlayerPrivate::sawUnsupportedTracks()
+{
+    m_hasUnsupportedTracks = true;
+    m_player->mediaPlayerClient()->mediaPlayerSawUnsupportedTracks(m_player);
+}
+
 }
 
 @implementation WebCoreMovieObserver
diff --git a/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index a3c10fa..cdde7cf 100644
--- a/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -58,7 +58,7 @@
 
 static bool initFontData(SimpleFontData* fontData)
 {
-    if (!fontData->m_font.cgFont())
+    if (!fontData->platformData().cgFont())
         return false;
 
 #ifdef BUILDING_ON_TIGER
@@ -66,7 +66,7 @@
     if (ATSUCreateStyle(&fontStyle) != noErr)
         return false;
 
-    ATSUFontID fontId = fontData->m_font.m_atsuFontID;
+    ATSUFontID fontId = fontData->platformData().m_atsuFontID;
     if (!fontId) {
         ATSUDisposeStyle(fontStyle);
         return false;
@@ -153,7 +153,7 @@
     m_shapesArabic = false;
 #endif
 
-    m_syntheticBoldOffset = m_font.m_syntheticBold ? 1.0f : 0.f;
+    m_syntheticBoldOffset = m_platformData.m_syntheticBold ? 1.0f : 0.f;
 
     bool failedSetup = false;
     if (!initFontData(this)) {
@@ -165,7 +165,7 @@
         // It overrides the normal "Times" family font.
         // It also appears to have a corrupt regular variant.
         NSString *fallbackFontFamily;
-        if ([[m_font.font() familyName] isEqual:@"Times"])
+        if ([[m_platformData.font() familyName] isEqual:@"Times"])
             fallbackFontFamily = @"Times New Roman";
         else
             fallbackFontFamily = webFallbackFontFamily();
@@ -173,12 +173,12 @@
         // Try setting up the alternate font.
         // This is a last ditch effort to use a substitute font when something has gone wrong.
 #if !ERROR_DISABLED
-        RetainPtr<NSFont> initialFont = m_font.font();
+        RetainPtr<NSFont> initialFont = m_platformData.font();
 #endif
-        if (m_font.font())
-            m_font.setFont([[NSFontManager sharedFontManager] convertFont:m_font.font() toFamily:fallbackFontFamily]);
+        if (m_platformData.font())
+            m_platformData.setFont([[NSFontManager sharedFontManager] convertFont:m_platformData.font() toFamily:fallbackFontFamily]);
         else
-            m_font.setFont([NSFont fontWithName:fallbackFontFamily size:m_font.size()]);
+            m_platformData.setFont([NSFont fontWithName:fallbackFontFamily size:m_platformData.size()]);
 #if !ERROR_DISABLED
         NSString *filePath = pathFromFont(initialFont.get());
         if (!filePath)
@@ -188,7 +188,7 @@
             if ([fallbackFontFamily isEqual:@"Times New Roman"]) {
                 // OK, couldn't setup Times New Roman as an alternate to Times, fallback
                 // on the system font.  If this fails we have no alternative left.
-                m_font.setFont([[NSFontManager sharedFontManager] convertFont:m_font.font() toFamily:webFallbackFontFamily()]);
+                m_platformData.setFont([[NSFontManager sharedFontManager] convertFont:m_platformData.font() toFamily:webFallbackFontFamily()]);
                 if (!initFontData(this)) {
                     // We tried, Times, Times New Roman, and the system font. No joy. We have to give up.
                     LOG_ERROR("unable to initialize with font %@ at %@", initialFont.get(), filePath);
@@ -203,14 +203,14 @@
 
         // Report the problem.
         LOG_ERROR("Corrupt font detected, using %@ in place of %@ located at \"%@\".",
-            [m_font.font() familyName], [initialFont.get() familyName], filePath);
+            [m_platformData.font() familyName], [initialFont.get() familyName], filePath);
     }
 
     // If all else fails, try to set up using the system font.
     // This is probably because Times and Times New Roman are both unavailable.
     if (failedSetup) {
-        m_font.setFont([NSFont systemFontOfSize:[m_font.font() pointSize]]);
-        LOG_ERROR("failed to set up font, using system font %s", m_font.font());
+        m_platformData.setFont([NSFont systemFontOfSize:[m_platformData.font() pointSize]]);
+        LOG_ERROR("failed to set up font, using system font %s", m_platformData.font());
         initFontData(this);
     }
     
@@ -218,15 +218,15 @@
     int iDescent;
     int iLineGap;
 #ifdef BUILDING_ON_TIGER
-    wkGetFontMetrics(m_font.cgFont(), &iAscent, &iDescent, &iLineGap, &m_unitsPerEm);
+    wkGetFontMetrics(m_platformData.cgFont(), &iAscent, &iDescent, &iLineGap, &m_unitsPerEm);
 #else
-    iAscent = CGFontGetAscent(m_font.cgFont());
-    iDescent = CGFontGetDescent(m_font.cgFont());
-    iLineGap = CGFontGetLeading(m_font.cgFont());
-    m_unitsPerEm = CGFontGetUnitsPerEm(m_font.cgFont());
+    iAscent = CGFontGetAscent(m_platformData.cgFont());
+    iDescent = CGFontGetDescent(m_platformData.cgFont());
+    iLineGap = CGFontGetLeading(m_platformData.cgFont());
+    m_unitsPerEm = CGFontGetUnitsPerEm(m_platformData.cgFont());
 #endif
 
-    float pointSize = m_font.m_size;
+    float pointSize = m_platformData.m_size;
     float fAscent = scaleEmToUnits(iAscent, m_unitsPerEm) * pointSize;
     float fDescent = -scaleEmToUnits(iDescent, m_unitsPerEm) * pointSize;
     float fLineGap = scaleEmToUnits(iLineGap, m_unitsPerEm) * pointSize;
@@ -236,7 +236,7 @@
     // web standard. The AppKit adjustment of 20% is too big and is
     // incorrectly added to line spacing, so we use a 15% adjustment instead
     // and add it to the ascent.
-    NSString *familyName = [m_font.font() familyName];
+    NSString *familyName = [m_platformData.font() familyName];
     if ([familyName isEqualToString:@"Times"] || [familyName isEqualToString:@"Helvetica"] || [familyName isEqualToString:@"Courier"])
         fAscent += floorf(((fAscent + fDescent) * 0.15f) + 0.5f);
     else if ([familyName isEqualToString:@"Geeza Pro"]) {
@@ -264,14 +264,49 @@
     GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
     NSGlyph xGlyph = glyphPageZero ? glyphPageZero->glyphDataForCharacter('x').glyph : 0;
     if (xGlyph) {
-        NSRect xBox = [m_font.font() boundingRectForGlyph:xGlyph];
+        NSRect xBox = [m_platformData.font() boundingRectForGlyph:xGlyph];
         // Use the maximum of either width or height because "x" is nearly square
         // and web pages that foolishly use this metric for width will be laid out
         // poorly if we return an accurate height. Classic case is Times 13 point,
         // which has an "x" that is 7x6 pixels.
         m_xHeight = MAX(NSMaxX(xBox), NSMaxY(xBox));
     } else
-        m_xHeight = [m_font.font() xHeight];
+        m_xHeight = [m_platformData.font() xHeight];
+}
+
+void SimpleFontData::platformCharWidthInit()
+{
+    m_avgCharWidth = 0.f;
+
+    // Calculate avgCharWidth according to http://developer.apple.com/textfonts/TTRefMan/RM06/Chap6OS2.html
+    // We can try grabbing it out of the OS/2 table or via ATSFontGetHorizontalMetrics, but
+    // ATSFontGetHorizontalMetrics never seems to return a non-zero value and the OS/2 table
+    // contains zero for a large number of fonts.
+    GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
+    if (glyphPageZero) {
+        static int weights[] = { 64, 14, 27, 35, 100, 20, 14, 42, 63, 3, 6, 35, 20, 56, 56, 17, 4, 49, 56, 71, 31, 10, 18, 3, 18, 2, 166 };
+        int numGlyphs = 27;
+        ASSERT(numGlyphs == sizeof(weights) / sizeof(int));
+        // Compute the weighted sum of the space character and the lowercase letters in the Latin alphabet.
+        float sum = 0.f;
+        int totalWeight = 0;
+        for (int i = 0; i < numGlyphs; i++) {
+            Glyph glyph = glyphPageZero->glyphDataForCharacter((i < 26 ? i + 'a' : ' ')).glyph;
+            if (glyph) {
+                totalWeight += weights[i];
+                sum += widthForGlyph(glyph) * weights[i];
+            }
+        }
+        if (sum > 0.f && totalWeight > 0)
+            m_avgCharWidth = sum / totalWeight;
+    }
+
+    m_maxCharWidth = 0.f;
+    if (m_platformData.font())
+        m_maxCharWidth = [m_platformData.font() maximumAdvancement].width;
+
+    // Fallback to a cross-platform estimate, which will populate these values if they are non-positive.
+    initCharWidths();
 }
 
 void SimpleFontData::platformDestroy()
@@ -290,13 +325,13 @@
 {
     if (!m_smallCapsFontData) {
         if (isCustomFont()) {
-            FontPlatformData smallCapsFontData(m_font);
+            FontPlatformData smallCapsFontData(m_platformData);
             smallCapsFontData.m_size = smallCapsFontData.m_size * smallCapsFontSizeMultiplier;
             m_smallCapsFontData = new SimpleFontData(smallCapsFontData, true, false);
         } else {
             BEGIN_BLOCK_OBJC_EXCEPTIONS;
-            float size = [m_font.font() pointSize] * smallCapsFontSizeMultiplier;
-            FontPlatformData smallCapsFont([[NSFontManager sharedFontManager] convertFont:m_font.font() toSize:size]);
+            float size = [m_platformData.font() pointSize] * smallCapsFontSizeMultiplier;
+            FontPlatformData smallCapsFont([[NSFontManager sharedFontManager] convertFont:m_platformData.font() toSize:size]);
             
             // AppKit resets the type information (screen/printer) when you convert a font to a different size.
             // We have to fix up the font that we're handed back.
@@ -304,11 +339,11 @@
 
             if (smallCapsFont.font()) {
                 NSFontManager *fontManager = [NSFontManager sharedFontManager];
-                NSFontTraitMask fontTraits = [fontManager traitsOfFont:m_font.font()];
+                NSFontTraitMask fontTraits = [fontManager traitsOfFont:m_platformData.font()];
 
-                if (m_font.m_syntheticBold)
+                if (m_platformData.m_syntheticBold)
                     fontTraits |= NSBoldFontMask;
-                if (m_font.m_syntheticOblique)
+                if (m_platformData.m_syntheticOblique)
                     fontTraits |= NSItalicFontMask;
 
                 NSFontTraitMask smallCapsFontTraits = [fontManager traitsOfFont:smallCapsFont.font()];
@@ -326,7 +361,7 @@
 bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
 {
     NSString *string = [[NSString alloc] initWithCharactersNoCopy:const_cast<unichar*>(characters) length:length freeWhenDone:NO];
-    NSCharacterSet *set = [[m_font.font() coveredCharacterSet] invertedSet];
+    NSCharacterSet *set = [[m_platformData.font() coveredCharacterSet] invertedSet];
     bool result = set && [string rangeOfCharacterFromSet:set].location == NSNotFound;
     [string release];
     return result;
@@ -334,7 +369,7 @@
 
 void SimpleFontData::determinePitch()
 {
-    NSFont* f = m_font.font();
+    NSFont* f = m_platformData.font();
     // Special case Osaka-Mono.
     // According to <rdar://problem/3999467>, we should treat Osaka-Mono as fixed pitch.
     // Note that the AppKit does not report Osaka-Mono as fixed pitch.
@@ -356,11 +391,11 @@
 
 float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
 {
-    NSFont* font = m_font.font();
-    float pointSize = m_font.m_size;
+    NSFont* font = m_platformData.font();
+    float pointSize = m_platformData.m_size;
     CGAffineTransform m = CGAffineTransformMakeScale(pointSize, pointSize);
     CGSize advance;
-    if (!wkGetGlyphTransformedAdvances(m_font.cgFont(), font, &m, &glyph, &advance)) {
+    if (!wkGetGlyphTransformedAdvances(m_platformData.cgFont(), font, &m, &glyph, &advance)) {
         LOG_ERROR("Unable to cache glyph widths for %@ %f", [font displayName], pointSize);
         advance.width = 0;
     }
@@ -374,9 +409,9 @@
 
     m_checkedShapesArabic = true;
     
-    ATSUFontID fontID = m_font.m_atsuFontID;
+    ATSUFontID fontID = m_platformData.m_atsuFontID;
     if (!fontID) {
-        LOG_ERROR("unable to get ATSUFontID for %@", m_font.font());
+        LOG_ERROR("unable to get ATSUFontID for %@", m_platformData.font());
         return;
     }
 
@@ -404,7 +439,7 @@
     if (getNSFont())
         return toCTFontRef(getNSFont());
     if (!m_CTFont)
-        m_CTFont.adoptCF(CTFontCreateWithGraphicsFont(m_font.cgFont(), m_font.size(), NULL, NULL));
+        m_CTFont.adoptCF(CTFontCreateWithGraphicsFont(m_platformData.cgFont(), m_platformData.size(), NULL, NULL));
     return m_CTFont.get();
 }
 
diff --git a/WebCore/platform/graphics/mac/WebLayer.mm b/WebCore/platform/graphics/mac/WebLayer.mm
index 267b5bc..fad3916 100644
--- a/WebCore/platform/graphics/mac/WebLayer.mm
+++ b/WebCore/platform/graphics/mac/WebLayer.mm
@@ -32,7 +32,6 @@
 #import "GraphicsContext.h"
 #import "GraphicsLayer.h"
 #import <QuartzCore/QuartzCore.h>
-#import "WebCoreTextRenderer.h"
 #import <wtf/UnusedParam.h>
 
 using namespace WebCore;
diff --git a/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp b/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
index 16c3c00..895887f 100644
--- a/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
+++ b/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -161,11 +161,21 @@
 
 #pragma pack()
 
-static void appendBigEndianStringToEOTHeader(Vector<uint8_t, 512>& eotHeader, const BigEndianUShort* string, unsigned short length)
+EOTHeader::EOTHeader()
 {
-    size_t size = eotHeader.size();
-    eotHeader.resize(size + length + 2 * sizeof(unsigned short));
-    UChar* dst = reinterpret_cast<UChar*>(eotHeader.data() + size);
+    m_buffer.resize(sizeof(EOTPrefix));
+}
+
+void EOTHeader::updateEOTSize(size_t fontDataSize)
+{
+    prefix()->eotSize = m_buffer.size() + fontDataSize;
+}
+
+void EOTHeader::appendBigEndianString(const BigEndianUShort* string, unsigned short length)
+{
+    size_t oldSize = m_buffer.size();
+    m_buffer.resize(oldSize + length + 2 * sizeof(unsigned short));
+    UChar* dst = reinterpret_cast<UChar*>(m_buffer.data() + oldSize);
     unsigned i = 0;
     dst[i++] = length;
     unsigned numCharacters = length / 2;
@@ -174,7 +184,13 @@
     dst[i] = 0;
 }
 
-bool getEOTHeader(SharedBuffer* fontData, Vector<uint8_t, 512>& eotHeader, size_t& overlayDst, size_t& overlaySrc, size_t& overlayLength)
+void EOTHeader::appendPaddingShort()
+{
+    unsigned short padding = 0;
+    m_buffer.append(reinterpret_cast<uint8_t*>(&padding), sizeof(padding));
+}
+
+bool getEOTHeader(SharedBuffer* fontData, EOTHeader& eotHeader, size_t& overlayDst, size_t& overlaySrc, size_t& overlayLength)
 {
     overlayDst = 0;
     overlaySrc = 0;
@@ -183,8 +199,7 @@
     size_t dataLength = fontData->size();
     const char* data = fontData->data();
 
-    eotHeader.resize(sizeof(EOTPrefix));
-    EOTPrefix* prefix = reinterpret_cast<EOTPrefix*>(eotHeader.data());
+    EOTPrefix* prefix = eotHeader.prefix();
 
     prefix->fontDataSize = dataLength;
     prefix->version = 0x00020001;
@@ -306,9 +321,9 @@
     prefix->reserved[3] = 0;
     prefix->padding1 = 0;
 
-    appendBigEndianStringToEOTHeader(eotHeader, familyName, familyNameLength);
-    appendBigEndianStringToEOTHeader(eotHeader, subfamilyName, subfamilyNameLength);
-    appendBigEndianStringToEOTHeader(eotHeader, versionString, versionStringLength);
+    eotHeader.appendBigEndianString(familyName, familyNameLength);
+    eotHeader.appendBigEndianString(subfamilyName, subfamilyNameLength);
+    eotHeader.appendBigEndianString(versionString, versionStringLength);
 
     // If possible, ensure that the family name is a prefix of the full name.
     if (fullNameLength >= familyNameLength && memcmp(familyName, fullName, familyNameLength)) {
@@ -316,13 +331,10 @@
         overlayDst = reinterpret_cast<const char*>(familyName) - data;
         overlayLength = familyNameLength;
     }
+    eotHeader.appendBigEndianString(fullName, fullNameLength);
 
-    appendBigEndianStringToEOTHeader(eotHeader, fullName, fullNameLength);
-
-    unsigned short padding = 0;
-    eotHeader.append(reinterpret_cast<uint8_t*>(&padding), sizeof(padding));
-
-    prefix->eotSize = eotHeader.size() + fontData->size();
+    eotHeader.appendPaddingShort();
+    eotHeader.updateEOTSize(fontData->size());
 
     return true;
 }
diff --git a/WebCore/platform/graphics/opentype/OpenTypeUtilities.h b/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
index a67ffc7..13dad6f 100644
--- a/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
+++ b/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,9 +31,26 @@
 
 namespace WebCore {
 
+struct BigEndianUShort;
+struct EOTPrefix;
 class SharedBuffer;
 
-bool getEOTHeader(SharedBuffer* fontData, Vector<uint8_t, 512>& eotHeader, size_t& overlayDst, size_t& overlaySrc, size_t& overlayLength);
+struct EOTHeader {
+    EOTHeader();
+
+    size_t size() const { return m_buffer.size(); }
+    const uint8_t* data() const { return m_buffer.data(); }
+
+    EOTPrefix* prefix() { return reinterpret_cast<EOTPrefix*>(m_buffer.data()); }
+    void updateEOTSize(size_t);
+    void appendBigEndianString(const BigEndianUShort*, unsigned short length);
+    void appendPaddingShort();
+
+private:
+    Vector<uint8_t, 512> m_buffer;
+};
+
+bool getEOTHeader(SharedBuffer* fontData, EOTHeader& eotHeader, size_t& overlayDst, size_t& overlaySrc, size_t& overlayLength);
 HANDLE renameAndActivateFont(SharedBuffer*, const String&);
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/qt/FontCacheQt.cpp b/WebCore/platform/graphics/qt/FontCacheQt.cpp
index 114f073..668912e 100644
--- a/WebCore/platform/graphics/qt/FontCacheQt.cpp
+++ b/WebCore/platform/graphics/qt/FontCacheQt.cpp
@@ -26,8 +26,11 @@
 #include "FontDescription.h"
 #include "FontPlatformData.h"
 #include "Font.h"
+#include "StringHash.h"
 #include <wtf/StdLibExtras.h>
 
+#include <QHash>
+
 namespace WebCore {
 
 FontCache* fontCache()
@@ -44,9 +47,31 @@
 {
 }
 
+typedef QHash<FontDescription, FontPlatformData*> FontPlatformDataCache;
+
+// using Q_GLOBAL_STATIC leads to crash. TODO investigate the way to fix this.
+static FontPlatformDataCache* gFontPlatformDataCache;
+
+uint qHash(const FontDescription& key)
+{
+    uint value = CaseFoldingHash::hash(key.family().family());
+    value ^= key.computedPixelSize();
+    value ^= static_cast<int>(key.weight());
+    return value;
+}
+
 FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& description, const AtomicString& family, bool checkingAlternateName)
 {
-    return new FontPlatformData(description);
+    if (!gFontPlatformDataCache)
+        gFontPlatformDataCache = new FontPlatformDataCache;
+
+    FontPlatformData* fontData = gFontPlatformDataCache->value(description, 0);
+    if (!fontData) {
+        fontData =  new FontPlatformData(description);
+        gFontPlatformDataCache->insert(description, fontData);
+    }
+
+    return fontData;
 }
 
 SimpleFontData* FontCache::getCachedFontData(const FontPlatformData*)
@@ -71,4 +96,12 @@
 {
 }
 
+void FontCache::invalidate()
+{
+    if (!gFontPlatformDataCache)
+        return;
+
+    gFontPlatformDataCache->clear();
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/qt/FontFallbackListQt.cpp b/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
index 22ae205..50627b7 100644
--- a/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
+++ b/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
@@ -42,8 +42,6 @@
 
 void FontFallbackList::invalidate(WTF::PassRefPtr<WebCore::FontSelector> fontSelector)
 {
-    releaseFontData();
-    m_fontList.clear();
     m_familyIndex = 0;
     m_pitch = UnknownPitch;
     m_loadingCustomFonts = false;
@@ -53,6 +51,9 @@
 
 void FontFallbackList::releaseFontData()
 {
+    if (m_fontList.size())
+        delete m_fontList[0].first;
+    m_fontList.clear();
 }
 
 void FontFallbackList::determinePitch(const WebCore::Font* font) const
@@ -90,7 +91,12 @@
         family = family->next();
     }
 
-    return new SimpleFontData(FontPlatformData(description), _font->wordSpacing(), _font->letterSpacing());
+    if (m_fontList.size())
+        return m_fontList[0].first;
+
+    const FontData* result = new SimpleFontData(FontPlatformData(description), _font->wordSpacing(), _font->letterSpacing());
+    m_fontList.append(pair<const FontData*, bool>(result, result->isCustomFont()));
+    return result;
 }
 
 const FontData* FontFallbackList::fontDataForCharacters(const WebCore::Font* font, const UChar*, int) const
diff --git a/WebCore/platform/graphics/qt/FontQt.cpp b/WebCore/platform/graphics/qt/FontQt.cpp
index 9ed5915..5a4b7b2 100644
--- a/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/WebCore/platform/graphics/qt/FontQt.cpp
@@ -183,7 +183,7 @@
         p->drawText(pt, string, flags, run.padding());
 }
 
-float Font::floatWidthForComplexText(const TextRun& run) const
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>*) const
 {
     if (!run.length())
         return 0;
diff --git a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index ccf4b06..ed7ac47 100644
--- a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -99,7 +99,7 @@
         case CompositeHighlight:
             return QPainter::CompositionMode_SourceOver;
         case CompositePlusLighter:
-            return QPainter::CompositionMode_SourceOver;
+            return QPainter::CompositionMode_Plus;
     }
 
     return QPainter::CompositionMode_SourceOver;
@@ -153,6 +153,18 @@
     return Qt::NoPen;
 }
 
+static inline Qt::FillRule toQtFillRule(WindRule rule)
+{
+    switch(rule) {
+    case RULE_EVENODD:
+        return Qt::OddEvenFill;
+    case RULE_NONZERO:
+        return Qt::WindingFill;
+    }
+    qDebug("Qt: unrecognized wind rule!");
+    return Qt::OddEvenFill;
+}
+
 struct TransparencyLayer
 {
     TransparencyLayer(const QPainter* p, const QRect &rect)
@@ -563,7 +575,7 @@
 
     QPainter *p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
-    p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
+    p->setRenderHint(QPainter::Antialiasing, true);
 
     p->drawArc(rect, startAngle * 16, angleSpan * 16);
 
@@ -606,6 +618,7 @@
 
     QPainter *p = m_data->p();
     QPainterPath path = m_data->currentPath;
+    path.setFillRule(toQtFillRule(fillRule()));
 
     switch (m_common->state.fillColorSpace) {
     case SolidColorSpace:
@@ -634,6 +647,7 @@
     QPainter *p = m_data->p();
     QPen pen = p->pen();
     QPainterPath path = m_data->currentPath;
+    path.setFillRule(toQtFillRule(fillRule()));
 
     switch (m_common->state.strokeColorSpace) {
     case SolidColorSpace:
@@ -1097,7 +1111,13 @@
                            rect.width() - (thickness * 2), rect.height() - (thickness * 2)));
 
     path.setFillRule(Qt::OddEvenFill);
-    m_data->p()->setClipPath(path, Qt::IntersectClip);
+
+    QPainter *p = m_data->p();
+
+    const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
+    p->setRenderHint(QPainter::Antialiasing, true);
+    p->setClipPath(path, Qt::IntersectClip);
+    p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
 
 void GraphicsContext::concatCTM(const TransformationMatrix& transform)
diff --git a/WebCore/platform/graphics/qt/IconQt.cpp b/WebCore/platform/graphics/qt/IconQt.cpp
index b04668c..c9f3ced 100644
--- a/WebCore/platform/graphics/qt/IconQt.cpp
+++ b/WebCore/platform/graphics/qt/IconQt.cpp
@@ -24,7 +24,6 @@
 #include "GraphicsContext.h"
 #include "PlatformString.h"
 #include "IntRect.h"
-#include "NotImplemented.h"
 
 #include <qpainter.h>
 #include <qpixmap.h>
diff --git a/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index d748305..506a8ea 100644
--- a/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -47,7 +47,24 @@
     : m_pixmap(size)
 {
     m_pixmap.fill(QColor(Qt::transparent));
-    m_painter.set(new QPainter(&m_pixmap));
+
+    QPainter* painter = new QPainter(&m_pixmap);
+    m_painter.set(painter);
+
+    // Since ImageBuffer is used mainly for Canvas, explicitly initialize
+    // its painter's pen and brush with the corresponding canvas defaults
+    // NOTE: keep in sync with CanvasRenderingContext2D::State
+    QPen pen = painter->pen();
+    pen.setColor(Qt::black);
+    pen.setWidth(1);
+    pen.setCapStyle(Qt::FlatCap);
+    pen.setJoinStyle(Qt::MiterJoin);
+    pen.setMiterLimit(10);
+    painter->setPen(pen);
+    QBrush brush = painter->brush();
+    brush.setColor(Qt::black);
+    painter->setBrush(brush);
+    painter->setCompositionMode(QPainter::CompositionMode_SourceOver);
 }
 
 ImageBuffer::ImageBuffer(const IntSize& size, bool grayScale, bool& success)
diff --git a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 394c7a7..cd32428 100644
--- a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -197,7 +197,8 @@
 }
 
 ImageDecoderQt::ImageDecoderQt(const QString &imageFormat)
-    : m_imageFormat(imageFormat)
+    : m_hasAlphaChannel(false)
+    , m_imageFormat(imageFormat)
 {
 }
 
@@ -212,6 +213,7 @@
 
 void ImageDecoderQt::reset()
 {
+    m_hasAlphaChannel = false;
     m_failed = false;
     m_imageList.clear();
     m_pixmapCache.clear();
@@ -230,6 +232,9 @@
 
     const  ReadContext::ReadResult readResult =  readContext.read(allDataReceived);
 
+    if (hasFirstImageHeader())
+        m_hasAlphaChannel = m_imageList[0].m_image.hasAlphaChannel();
+
     if (debugImageDecoderQt)
         qDebug()  << " read returns " << readResult;
 
@@ -280,7 +285,7 @@
 
 bool ImageDecoderQt::supportsAlpha() const
 {
-    return hasFirstImageHeader() && m_imageList[0].m_image.hasAlphaChannel();
+    return m_hasAlphaChannel;
 }
 
 int ImageDecoderQt::duration(size_t index) const
@@ -314,6 +319,10 @@
     if (!m_pixmapCache.contains(index)) {
         m_pixmapCache.insert(index,
                              QPixmap::fromImage(m_imageList[index].m_image));
+
+        // store null image since the converted pixmap is already in pixmap cache
+        Q_ASSERT(m_imageList[index].m_imageState == ImageComplete);
+        m_imageList[index].m_image = QImage();
     }
     return  &m_pixmapCache[index];
 }
diff --git a/WebCore/platform/graphics/qt/ImageDecoderQt.h b/WebCore/platform/graphics/qt/ImageDecoderQt.h
index a2eb6aa..b8c3edd 100644
--- a/WebCore/platform/graphics/qt/ImageDecoderQt.h
+++ b/WebCore/platform/graphics/qt/ImageDecoderQt.h
@@ -81,8 +81,9 @@
         int m_duration;
     };
 
+    bool m_hasAlphaChannel;
     typedef QList<ImageData> ImageList;
-    ImageList m_imageList;
+    mutable ImageList m_imageList;
     mutable QHash<int, QPixmap> m_pixmapCache;
     int m_loopCount;
     QString m_imageFormat;
diff --git a/WebCore/platform/graphics/qt/ImageQt.cpp b/WebCore/platform/graphics/qt/ImageQt.cpp
index 3bc67ae..a2e96f3 100644
--- a/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -31,12 +31,12 @@
 #include "config.h"
 #include "Image.h"
 
+#include "ImageObserver.h"
 #include "BitmapImage.h"
 #include "FloatRect.h"
 #include "PlatformString.h"
 #include "GraphicsContext.h"
 #include "TransformationMatrix.h"
-#include "NotImplemented.h"
 #include "StillImageQt.h"
 #include "qwebsettings.h"
 
@@ -117,6 +117,9 @@
     p->setBrushOrigin(phase);
     p->fillRect(destRect, b);
     ctxt->restore();
+
+    if (imageObserver())
+        imageObserver()->didDraw(this);
 }
 
 void BitmapImage::initPlatformData()
@@ -159,6 +162,9 @@
     painter->drawPixmap(dst, *image, src);
 
     ctxt->restore();
+
+    if (imageObserver())
+        imageObserver()->didDraw(this);
 }
 
 void BitmapImage::checkForSolidColor()
diff --git a/WebCore/platform/graphics/qt/ImageSourceQt.cpp b/WebCore/platform/graphics/qt/ImageSourceQt.cpp
index 84de443..621728e 100644
--- a/WebCore/platform/graphics/qt/ImageSourceQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageSourceQt.cpp
@@ -29,7 +29,6 @@
 #include "config.h"
 #include "ImageSource.h"
 #include "ImageDecoderQt.h"
-#include "NotImplemented.h"
 #include "SharedBuffer.h"
 
 #include <QBuffer>
diff --git a/WebCore/platform/graphics/qt/PathQt.cpp b/WebCore/platform/graphics/qt/PathQt.cpp
index a8a3ea2..7569031 100644
--- a/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/WebCore/platform/graphics/qt/PathQt.cpp
@@ -39,6 +39,7 @@
 #include <QPainterPath>
 #include <QTransform>
 #include <QString>
+#include <wtf/OwnPtr.h>
 
 #define _USE_MATH_DEFINES
 #include <math.h>
@@ -91,7 +92,7 @@
 
     // FIXME: We should try to use a 'shared Context' instead of creating a new ImageBuffer
     // on each call.
-    std::auto_ptr<ImageBuffer> scratchImage = ImageBuffer::create(IntSize(1, 1), false);
+    OwnPtr<ImageBuffer> scratchImage = ImageBuffer::create(IntSize(1, 1), false);
     GraphicsContext* gc = scratchImage->context();
     QPainterPathStroker stroke;
     applier->strokeStyle(gc);
@@ -123,7 +124,7 @@
 {
     // FIXME: We should try to use a 'shared Context' instead of creating a new ImageBuffer
     // on each call.
-    std::auto_ptr<ImageBuffer> scratchImage = ImageBuffer::create(IntSize(1, 1), false);
+    OwnPtr<ImageBuffer> scratchImage = ImageBuffer::create(IntSize(1, 1), false);
     GraphicsContext* gc = scratchImage->context();
     QPainterPathStroker stroke;
     if (applier) {
diff --git a/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp b/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
index 6cf4e55..f823f84 100644
--- a/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
+++ b/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
@@ -30,7 +30,7 @@
 
 void SimpleFontData::determinePitch()
 {
-    m_treatAsFixedPitch = m_font.font().fixedPitch();
+    m_treatAsFixedPitch = m_platformData.font().fixedPitch();
 }
 
 bool SimpleFontData::containsCharacters(const UChar*, int length) const
@@ -40,7 +40,7 @@
 
 void SimpleFontData::platformInit()
 {
-    QFontMetrics fm(m_font.font());
+    QFontMetrics fm(m_platformData.font());
 
     m_ascent = fm.ascent();
     m_descent = fm.descent();
@@ -59,6 +59,13 @@
     m_missingGlyphData.glyph = 0;
 }
 
+void SimpleFontData::platformCharWidthInit()
+{
+    QFontMetrics fm(m_platformData.font());
+    m_avgCharWidth = fm.averageCharWidth();
+    m_maxCharWidth = fm.maxWidth();
+}
+
 void SimpleFontData::platformDestroy()
 {
 }
diff --git a/WebCore/platform/graphics/skia/GradientSkia.cpp b/WebCore/platform/graphics/skia/GradientSkia.cpp
index 2d2000c..ac7366c 100644
--- a/WebCore/platform/graphics/skia/GradientSkia.cpp
+++ b/WebCore/platform/graphics/skia/GradientSkia.cpp
@@ -60,12 +60,14 @@
 // ends as necessary.
 static size_t totalStopsNeeded(const Gradient::ColorStop* stopData, size_t count)
 {
+    // N.B.:  The tests in this function should kept in sync with the ones in
+    // fillStops(), or badness happens.
     const Gradient::ColorStop* stop = stopData;
     size_t countUsed = count;
     if (count < 1 || stop->stop > 0.0)
         countUsed++;
     stop += count - 1;
-    if (count < 2 || stop->stop < 1.0)
+    if (count < 1 || stop->stop < 1.0)
         countUsed++;
     return countUsed;
 }
diff --git a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index 376fa4b..33ca23a 100644
--- a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -449,10 +449,8 @@
         return;
 
     SkPaint paint;
-    if (fillColor().alpha() > 0) {
-        platformContext()->setupPaintForFilling(&paint);
-        platformContext()->canvas()->drawPath(path, paint);
-    }
+    platformContext()->setupPaintForFilling(&paint);
+    platformContext()->canvas()->drawPath(path, paint);
 
     if (strokeStyle() != NoStroke) {
         paint.reset();
@@ -472,10 +470,8 @@
         return;
 
     SkPaint paint;
-    if (fillColor().alpha() > 0) {
-        platformContext()->setupPaintForFilling(&paint);
-        platformContext()->canvas()->drawOval(rect, paint);
-    }
+    platformContext()->setupPaintForFilling(&paint);
+    platformContext()->canvas()->drawOval(rect, paint);
 
     if (strokeStyle() != NoStroke) {
         paint.reset();
@@ -685,9 +681,6 @@
     const GraphicsContextState& state = m_common->state;
     ColorSpace colorSpace = state.fillColorSpace;
 
-    if (colorSpace == SolidColorSpace && !fillColor().alpha())
-        return;
-
     path.setFillType(state.fillRule == RULE_EVENODD ?
         SkPath::kEvenOdd_FillType : SkPath::kWinding_FillType);
 
@@ -718,9 +711,6 @@
     const GraphicsContextState& state = m_common->state;
     ColorSpace colorSpace = state.fillColorSpace;
 
-    if (colorSpace == SolidColorSpace && !fillColor().alpha())
-        return;
-
     SkPaint paint;
     platformContext()->setupPaintForFilling(&paint);
 
@@ -739,9 +729,6 @@
     if (paintingDisabled())
         return;
 
-    if (!color.alpha())
-        return;
-
     SkRect r = rect;
     if (!isRectSkiaSafe(getCTM(), r)) {
         // Special case when the rectangle overflows fixed point. This is a
@@ -907,8 +894,13 @@
     // FIXME: This is lifted directly off SkiaSupport, lines 49-74
     // so it is not guaranteed to work correctly.
     size_t dashLength = dashes.size();
-    if (!dashLength)
+    if (!dashLength) {
+        // If no dash is set, revert to solid stroke
+        // FIXME: do we need to set NoStroke in some cases?
+        platformContext()->setStrokeStyle(SolidStroke);
+        platformContext()->setDashPathEffect(0);
         return;
+    }
 
     size_t count = (dashLength % 2) == 0 ? dashLength : dashLength * 2;
     SkScalar* intervals = new SkScalar[count];
@@ -962,6 +954,12 @@
     if (paintingDisabled())
         return;
 
+    // Detect when there's no effective shadow and clear the looper.
+    if (size.width() == 0 && size.height() == 0 && blurInt == 0) {
+        platformContext()->setDrawLooper(NULL);
+        return;
+    }
+
     double width = size.width();
     double height = size.height();
     double blur = blurInt;
@@ -1076,9 +1074,6 @@
     const GraphicsContextState& state = m_common->state;
     ColorSpace colorSpace = state.strokeColorSpace;
 
-    if (colorSpace == SolidColorSpace && !strokeColor().alpha())
-        return;
-
     SkPaint paint;
     platformContext()->setupPaintForStroking(&paint, 0, 0);
 
@@ -1103,9 +1098,6 @@
     const GraphicsContextState& state = m_common->state;
     ColorSpace colorSpace = state.strokeColorSpace;
 
-    if (colorSpace == SolidColorSpace && !strokeColor().alpha())
-        return;
-
     SkPaint paint;
     platformContext()->setupPaintForStroking(&paint, 0, 0);
     paint.setStrokeWidth(WebCoreFloatToSkScalar(lineWidth));
diff --git a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index 5e90491..600882d 100644
--- a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -36,7 +36,6 @@
 #include "BitmapImageSingleFrameSkia.h"
 #include "GraphicsContext.h"
 #include "ImageData.h"
-#include "NotImplemented.h"
 #include "PlatformContextSkia.h"
 #include "PNGImageEncoder.h"
 #include "SkiaUtils.h"
diff --git a/WebCore/platform/graphics/skia/ImageSkia.cpp b/WebCore/platform/graphics/skia/ImageSkia.cpp
index d7f2830..cb089bb 100644
--- a/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -38,7 +38,6 @@
 #include "GraphicsContext.h"
 #include "Logging.h"
 #include "NativeImageSkia.h"
-#include "NotImplemented.h"
 #include "PlatformContextSkia.h"
 #include "PlatformString.h"
 #include "SkiaUtils.h"
@@ -226,6 +225,12 @@
     SkPaint paint;
     paint.setPorterDuffXfermode(compOp);
     paint.setFilterBitmap(true);
+    int alpha = roundf(platformContext->getAlpha() * 256);
+    if (alpha > 255)
+        alpha = 255;
+    else if (alpha < 0)
+        alpha = 0;
+    paint.setAlpha(alpha);
 
     skia::PlatformCanvas* canvas = platformContext->canvas();
 
@@ -305,7 +310,8 @@
                         CompositeOperator compositeOp,
                         const FloatRect& destRect)
 {
-    if (destRect.isEmpty() || floatSrcRect.isEmpty())
+    FloatRect normSrcRect = normalizeRect(floatSrcRect);
+    if (destRect.isEmpty() || normSrcRect.isEmpty())
         return;  // nothing to draw
 
     NativeImageSkia* bitmap = nativeImageForCurrentFrame();
@@ -316,7 +322,7 @@
     // it will internally reference the old bitmap's pixels, adjusting the row
     // stride so the extra pixels appear as padding to the subsetted bitmap.
     SkBitmap srcSubset;
-    SkIRect srcRect = enclosingIntRect(floatSrcRect);
+    SkIRect srcRect = enclosingIntRect(normSrcRect);
     bitmap->extractSubset(&srcSubset, srcRect);
 
     SkBitmap resampled;
@@ -363,9 +369,9 @@
     // origin of the destination rect, which is what WebKit expects. Skia uses
     // the coordinate system origin as the base for the patter. If WebKit wants
     // a shifted image, it will shift it from there using the patternTransform.
-    float adjustedX = phase.x() + floatSrcRect.x() *
+    float adjustedX = phase.x() + normSrcRect.x() *
                       narrowPrecisionToFloat(patternTransform.a());
-    float adjustedY = phase.y() + floatSrcRect.y() *
+    float adjustedY = phase.y() + normSrcRect.y() *
                       narrowPrecisionToFloat(patternTransform.d());
     matrix.postTranslate(SkFloatToScalar(adjustedX),
                          SkFloatToScalar(adjustedY));
diff --git a/WebCore/platform/graphics/skia/PathSkia.cpp b/WebCore/platform/graphics/skia/PathSkia.cpp
index 2700da8..9d9df52 100644
--- a/WebCore/platform/graphics/skia/PathSkia.cpp
+++ b/WebCore/platform/graphics/skia/PathSkia.cpp
@@ -81,9 +81,15 @@
 
 FloatRect Path::boundingRect() const
 {
+    // FIXME:  This #ifdef can go away once we're firmly using the new Skia.
+    // During the transition, this makes the code compatible with both versions.
+#ifdef SK_USE_OLD_255_TO_256
+    return m_path->getBounds();
+#else
     SkRect rect;
     m_path->computeBounds(&rect, SkPath::kExact_BoundsType);
     return rect;
+#endif
 }
 
 void Path::moveTo(const FloatPoint& point)
@@ -275,9 +281,15 @@
     context->platformContext()->setupPaintForStroking(&paint, 0, 0);
     SkPath boundingPath;
     paint.getFillPath(context->platformContext()->currentPathInLocalCoordinates(), &boundingPath);
+    // FIXME:  This #ifdef can go away once we're firmly using the new Skia.
+    // During the transition, this makes the code compatible with both versions.
+#ifdef SK_USE_OLD_255_TO_256
+    return boundingPath.getBounds();
+#else
     SkRect r;
     boundingPath.computeBounds(&r, SkPath::kExact_BoundsType);
     return r;
+#endif
 }
 
 FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
diff --git a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index 6c633f2..74b2bfe 100644
--- a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -277,13 +277,13 @@
         if (oldFillColor != m_state->m_strokeColor)
             setFillColor(m_state->m_strokeColor);
         setupPaintForFilling(&paint);
-        SkRect topBorder = { rect.fLeft, rect.fTop, rect.width(), 1 };
+        SkRect topBorder = { rect.fLeft, rect.fTop, rect.fRight, rect.fTop + 1 };
         canvas()->drawRect(topBorder, paint);
-        SkRect bottomBorder = { rect.fLeft, rect.fBottom - 1, rect.width(), 1 };
+        SkRect bottomBorder = { rect.fLeft, rect.fBottom - 1, rect.fRight, rect.fBottom };
         canvas()->drawRect(bottomBorder, paint);
-        SkRect leftBorder = { rect.fLeft, rect.fTop + 1, 1, rect.height() - 2 };
+        SkRect leftBorder = { rect.fLeft, rect.fTop + 1, rect.fLeft + 1, rect.fBottom - 1 };
         canvas()->drawRect(leftBorder, paint);
-        SkRect rightBorder = { rect.fRight - 1, rect.fTop + 1, 1, rect.height() - 2 };
+        SkRect rightBorder = { rect.fRight - 1, rect.fTop + 1, rect.fRight, rect.fBottom - 1 };
         canvas()->drawRect(rightBorder, paint);
         if (oldFillColor != m_state->m_strokeColor)
             setFillColor(oldFillColor);
@@ -428,6 +428,11 @@
     return m_state->m_textDrawingMode;
 }
 
+float PlatformContextSkia::getAlpha() const
+{
+    return m_state->m_alpha;
+}
+
 void PlatformContextSkia::setTextDrawingMode(int mode)
 {
   // cTextClip is never used, so we assert that it isn't set:
diff --git a/WebCore/platform/graphics/skia/PlatformContextSkia.h b/WebCore/platform/graphics/skia/PlatformContextSkia.h
index 8850a6a..25495aa 100644
--- a/WebCore/platform/graphics/skia/PlatformContextSkia.h
+++ b/WebCore/platform/graphics/skia/PlatformContextSkia.h
@@ -130,6 +130,7 @@
     WebCore::StrokeStyle getStrokeStyle() const;
     float getStrokeThickness() const;
     int getTextDrawingMode() const;
+    float getAlpha() const;
 
     void beginPath();
     void addPath(const SkPath&);
diff --git a/WebCore/platform/graphics/skia/SkiaFontWin.cpp b/WebCore/platform/graphics/skia/SkiaFontWin.cpp
index d0cd4c5..7f12508 100644
--- a/WebCore/platform/graphics/skia/SkiaFontWin.cpp
+++ b/WebCore/platform/graphics/skia/SkiaFontWin.cpp
@@ -220,6 +220,16 @@
         deleteOutline(outlineCache.find(*i));
 }
 
+bool windowsCanHandleDrawTextShadow(WebCore::GraphicsContext *context)
+{
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+
+    bool hasShadow = context->getShadow(shadowSize, shadowBlur, shadowColor);
+    return (hasShadow && (shadowBlur == 0) && (shadowColor.alpha() == 255) && (context->fillColor().alpha() == 255));
+}
+
 bool windowsCanHandleTextDrawing(GraphicsContext* context)
 {
     // Check for non-translation transforms. Sometimes zooms will look better in
@@ -244,7 +254,7 @@
         return false;
 
     // Check for shadow effects.
-    if (context->platformContext()->getDrawLooper())
+    if (context->platformContext()->getDrawLooper() && (!windowsCanHandleDrawTextShadow(context)))
         return false;
 
     return true;
diff --git a/WebCore/platform/graphics/skia/SkiaFontWin.h b/WebCore/platform/graphics/skia/SkiaFontWin.h
index 0e0c953..0bad30f 100644
--- a/WebCore/platform/graphics/skia/SkiaFontWin.h
+++ b/WebCore/platform/graphics/skia/SkiaFontWin.h
@@ -68,8 +68,12 @@
 // Remember that Skia's text drawing origin is the baseline, like WebKit, not
 // the top, like Windows.
 
+// Returns true if the fillColor and shadowColor are opaque and the text-shadow
+// is not blurred.
+bool windowsCanHandleDrawTextShadow(GraphicsContext*);
+
 // Returns true if advanced font rendering is recommended.
-bool windowsCanHandleTextDrawing(GraphicsContext* context);
+bool windowsCanHandleTextDrawing(GraphicsContext*);
 
 // Note that the offsets parameter is optional.  If not NULL it represents a
 // per glyph offset (such as returned by ScriptPlace Windows API function).
diff --git a/WebCore/platform/graphics/skia/SkiaUtils.cpp b/WebCore/platform/graphics/skia/SkiaUtils.cpp
index 55cba37..4242e7d 100644
--- a/WebCore/platform/graphics/skia/SkiaUtils.cpp
+++ b/WebCore/platform/graphics/skia/SkiaUtils.cpp
@@ -47,7 +47,7 @@
     uint8_t mPorterDuffMode;
 } gMapCompositOpsToPorterDuffModes[] = {
     { CompositeClear,           SkPorterDuff::kClear_Mode },
-    { CompositeCopy,            SkPorterDuff::kSrcOver_Mode },  // TODO
+    { CompositeCopy,            SkPorterDuff::kSrc_Mode },
     { CompositeSourceOver,      SkPorterDuff::kSrcOver_Mode },
     { CompositeSourceIn,        SkPorterDuff::kSrcIn_Mode },
     { CompositeSourceOut,       SkPorterDuff::kSrcOut_Mode },
@@ -59,7 +59,7 @@
     { CompositeXOR,             SkPorterDuff::kXor_Mode },
     { CompositePlusDarker,      SkPorterDuff::kDarken_Mode },
     { CompositeHighlight,       SkPorterDuff::kSrcOver_Mode },  // TODO
-    { CompositePlusLighter,     SkPorterDuff::kLighten_Mode }
+    { CompositePlusLighter,     SkPorterDuff::kAdd_Mode }
 };
 
 SkPorterDuff::Mode WebCoreCompositeToSkiaComposite(CompositeOperator op)
@@ -135,12 +135,7 @@
     int scale = 1;
 
     SkRect bounds;
-#if PLATFORM(SGL)
-    // this is the API from skia/trunk
     bounds = originalPath->getBounds();
-#else
-    originalPath->computeBounds(&bounds, SkPath::kFast_BoundsType);
-#endif
 
     // We can immediately return false if the point is outside the bounding rect
     if (!bounds.contains(SkFloatToScalar(point.x()), SkFloatToScalar(point.y())))
diff --git a/WebCore/platform/graphics/transforms/TransformationMatrix.cpp b/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
index 63a7b8e..a358aaf 100644
--- a/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
+++ b/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
@@ -31,6 +31,7 @@
 #include "FloatQuad.h"
 #include "IntRect.h"
 
+#include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
@@ -556,6 +557,9 @@
 
 FloatPoint TransformationMatrix::mapPoint(const FloatPoint& p) const
 {
+    if (isIdentityOrTranslation())
+        return FloatPoint(p.x() + static_cast<float>(m_matrix[3][0]), p.y() + static_cast<float>(m_matrix[3][1]));
+
     double x, y;
     multVecMatrix(p.x(), p.y(), x, y);
     return FloatPoint(static_cast<float>(x), static_cast<float>(y));
@@ -563,20 +567,16 @@
 
 FloatPoint3D TransformationMatrix::mapPoint(const FloatPoint3D& p) const
 {
+    if (isIdentityOrTranslation())
+        return FloatPoint3D(p.x() + static_cast<float>(m_matrix[3][0]),
+                            p.y() + static_cast<float>(m_matrix[3][1]),
+                            p.z() + static_cast<float>(m_matrix[3][2]));
+
     double x, y, z;
     multVecMatrix(p.x(), p.y(), p.z(), x, y, z);
     return FloatPoint3D(static_cast<float>(x), static_cast<float>(y), static_cast<float>(z));
 }
 
-IntPoint TransformationMatrix::mapPoint(const IntPoint& point) const
-{
-    double x, y;
-    multVecMatrix(point.x(), point.y(), x, y);
-
-    // Round the point.
-    return IntPoint(lround(x), lround(y));
-}
-
 IntRect TransformationMatrix::mapRect(const IntRect &rect) const
 {
     return enclosingIntRect(mapRect(FloatRect(rect)));
@@ -584,12 +584,24 @@
 
 FloatRect TransformationMatrix::mapRect(const FloatRect& r) const
 {
+    if (isIdentityOrTranslation()) {
+        FloatRect mappedRect(r);
+        mappedRect.move(static_cast<float>(m_matrix[3][0]), static_cast<float>(m_matrix[3][1]));
+        return mappedRect;
+    }
+
     FloatQuad resultQuad = mapQuad(FloatQuad(r));
     return resultQuad.boundingBox();
 }
 
 FloatQuad TransformationMatrix::mapQuad(const FloatQuad& q) const
 {
+    if (isIdentityOrTranslation()) {
+        FloatQuad mappedQuad(q);
+        mappedQuad.move(static_cast<float>(m_matrix[3][0]), static_cast<float>(m_matrix[3][1]));
+        return mappedQuad;
+    }
+
     FloatQuad result;
     result.setP1(mapPoint(q.p1()));
     result.setP2(mapPoint(q.p2()));
@@ -781,38 +793,19 @@
 
 TransformationMatrix& TransformationMatrix::translate(double tx, double ty)
 {
-#ifdef ANDROID_FASTER_MATRIX
     m_matrix[3][0] += tx * m_matrix[0][0] + ty * m_matrix[1][0];
     m_matrix[3][1] += tx * m_matrix[0][1] + ty * m_matrix[1][1];
     m_matrix[3][2] += tx * m_matrix[0][2] + ty * m_matrix[1][2];
     m_matrix[3][3] += tx * m_matrix[0][3] + ty * m_matrix[1][3];
-#else
-    // FIXME: optimize to avoid matrix copy
-    TransformationMatrix mat;
-    mat.m_matrix[3][0] = tx;
-    mat.m_matrix[3][1] = ty;
-
-    multLeft(mat);
-#endif
     return *this;
 }
 
 TransformationMatrix& TransformationMatrix::translate3d(double tx, double ty, double tz)
 {
-#ifdef ANDROID_FASTER_MATRIX
     m_matrix[3][0] += tx * m_matrix[0][0] + ty * m_matrix[1][0] + tz * m_matrix[2][0];
     m_matrix[3][1] += tx * m_matrix[0][1] + ty * m_matrix[1][1] + tz * m_matrix[2][1];
     m_matrix[3][2] += tx * m_matrix[0][2] + ty * m_matrix[1][2] + tz * m_matrix[2][2];
     m_matrix[3][3] += tx * m_matrix[0][3] + ty * m_matrix[1][3] + tz * m_matrix[2][3];
-#else
-    // FIXME: optimize to avoid matrix copy
-    TransformationMatrix mat;
-    mat.m_matrix[3][0] = tx;
-    mat.m_matrix[3][1] = ty;
-    mat.m_matrix[3][2] = tz;
-
-    multLeft(mat);
-#endif
     return *this;
 }
 
@@ -945,6 +938,9 @@
 
 bool TransformationMatrix::isInvertible() const
 {
+    if (isIdentityOrTranslation())
+        return true;
+
     double det = WebCore::determinant4x4(m_matrix);
 
     if (fabs(det) < SMALL_NUMBER)
@@ -955,8 +951,19 @@
 
 TransformationMatrix TransformationMatrix::inverse() const 
 {
-    TransformationMatrix invMat;
+    if (isIdentityOrTranslation()) {
+        // identity matrix
+        if (m_matrix[3][0] == 0 && m_matrix[3][1] == 0 && m_matrix[3][2] == 0)
+            return TransformationMatrix();
+        
+        // translation
+        return TransformationMatrix(1, 0, 0, 0,
+                                    0, 1, 0, 0,
+                                    0, 0, 1, 0,
+                                    -m_matrix[3][0], -m_matrix[3][1], -m_matrix[3][2], 1);
+    }
     
+    TransformationMatrix invMat;
     bool inverted = WebCore::inverse(m_matrix, invMat.m_matrix);
     if (!inverted)
         return TransformationMatrix();
diff --git a/WebCore/platform/graphics/transforms/TransformationMatrix.h b/WebCore/platform/graphics/transforms/TransformationMatrix.h
index 62e4eb8..7b93e04 100644
--- a/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -26,6 +26,10 @@
 #ifndef TransformationMatrix_h
 #define TransformationMatrix_h
 
+#include "FloatPoint.h"
+#include "IntPoint.h"
+#include <string.h> //for memcpy
+
 #if PLATFORM(CG)
 #include <CoreGraphics/CGAffineTransform.h>
 #elif PLATFORM(CAIRO)
@@ -38,13 +42,9 @@
 #include <wx/graphics.h>
 #endif
 
-#include <string.h> //for memcpy
-
 namespace WebCore {
 
-class IntPoint;
 class IntRect;
-class FloatPoint;
 class FloatPoint3D;
 class FloatRect;
 class FloatQuad;
@@ -114,7 +114,10 @@
     FloatPoint mapPoint(const FloatPoint&) const;
 
     // Like the version above, except that it rounds the mapped point to the nearest integer value.
-    IntPoint mapPoint(const IntPoint&) const;
+    IntPoint mapPoint(const IntPoint& p) const
+    {
+        return roundedIntPoint(mapPoint(FloatPoint(p)));
+    }
 
     // If the matrix has 3D components, the z component of the result is
     // dropped, effectively projecting the rect into the z=0 plane
@@ -313,6 +316,14 @@
             memcpy(m_matrix, m, sizeof(Matrix4));
     }
     
+    bool isIdentityOrTranslation() const
+    {
+        return m_matrix[0][0] == 1 && m_matrix[0][1] == 0 && m_matrix[0][2] == 0 && m_matrix[0][3] == 0 &&
+               m_matrix[1][0] == 0 && m_matrix[1][1] == 1 && m_matrix[1][2] == 0 && m_matrix[1][3] == 0 &&
+               m_matrix[2][0] == 0 && m_matrix[2][1] == 0 && m_matrix[2][2] == 1 && m_matrix[2][3] == 0 &&
+               m_matrix[3][3] == 1;
+    }
+    
     Matrix4 m_matrix;
 };
 
diff --git a/WebCore/platform/graphics/win/ColorSafari.cpp b/WebCore/platform/graphics/win/ColorSafari.cpp
index a04fd81..25b6b89 100644
--- a/WebCore/platform/graphics/win/ColorSafari.cpp
+++ b/WebCore/platform/graphics/win/ColorSafari.cpp
@@ -29,7 +29,6 @@
 #include "config.h"
 #include "Color.h"
 
-#include "NotImplemented.h"
 #include <CoreGraphics/CGColor.h>
 #include <SafariTheme/SafariTheme.h>
 #include <wtf/Assertions.h>
diff --git a/WebCore/platform/graphics/win/FontCGWin.cpp b/WebCore/platform/graphics/win/FontCGWin.cpp
index feeb2ae..803f5db 100644
--- a/WebCore/platform/graphics/win/FontCGWin.cpp
+++ b/WebCore/platform/graphics/win/FontCGWin.cpp
@@ -181,7 +181,7 @@
         SetWorldTransform(hdc, &xform);
     }
 
-    SelectObject(hdc, font->m_font.hfont());
+    SelectObject(hdc, font->platformData().hfont());
 
     // Set the correct color.
     if (drawIntoBitmap)
@@ -215,9 +215,9 @@
         xform.eDy = point.y();
         ModifyWorldTransform(hdc, &xform, MWT_LEFTMULTIPLY);
         ExtTextOut(hdc, 0, 0, ETO_GLYPH_INDEX, 0, reinterpret_cast<const WCHAR*>(glyphBuffer.glyphs(from)), numGlyphs, gdiAdvances.data());
-        if (font->m_syntheticBoldOffset) {
+        if (font->syntheticBoldOffset()) {
             xform.eM21 = 0;
-            xform.eDx = font->m_syntheticBoldOffset;
+            xform.eDx = font->syntheticBoldOffset();
             xform.eDy = 0;
             ModifyWorldTransform(hdc, &xform, MWT_LEFTMULTIPLY);
             ExtTextOut(hdc, 0, 0, ETO_GLYPH_INDEX, 0, reinterpret_cast<const WCHAR*>(glyphBuffer.glyphs(from)), numGlyphs, gdiAdvances.data());
@@ -250,21 +250,21 @@
             if (drawingMode & cTextFill) {
                 CGContextAddPath(cgContext, glyphPath.get());
                 CGContextFillPath(cgContext);
-                if (font->m_syntheticBoldOffset) {
-                    CGContextTranslateCTM(cgContext, font->m_syntheticBoldOffset, 0);
+                if (font->syntheticBoldOffset()) {
+                    CGContextTranslateCTM(cgContext, font->syntheticBoldOffset(), 0);
                     CGContextAddPath(cgContext, glyphPath.get());
                     CGContextFillPath(cgContext);
-                    CGContextTranslateCTM(cgContext, -font->m_syntheticBoldOffset, 0);
+                    CGContextTranslateCTM(cgContext, -font->syntheticBoldOffset(), 0);
                 }
             }
             if (drawingMode & cTextStroke) {
                 CGContextAddPath(cgContext, glyphPath.get());
                 CGContextStrokePath(cgContext);
-                if (font->m_syntheticBoldOffset) {
-                    CGContextTranslateCTM(cgContext, font->m_syntheticBoldOffset, 0);
+                if (font->syntheticBoldOffset()) {
+                    CGContextTranslateCTM(cgContext, font->syntheticBoldOffset(), 0);
                     CGContextAddPath(cgContext, glyphPath.get());
                     CGContextStrokePath(cgContext);
-                    CGContextTranslateCTM(cgContext, -font->m_syntheticBoldOffset, 0);
+                    CGContextTranslateCTM(cgContext, -font->syntheticBoldOffset(), 0);
                 }
             }
 
@@ -341,8 +341,8 @@
         graphicsContext->setFillColor(shadowFillColor);
         CGContextSetTextPosition(cgContext, point.x() + translation.width() + shadowSize.width(), point.y() + translation.height() + shadowSize.height());
         CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-        if (font->m_syntheticBoldOffset) {
-            CGContextSetTextPosition(cgContext, point.x() + translation.width() + shadowSize.width() + font->m_syntheticBoldOffset, point.y() + translation.height() + shadowSize.height());
+        if (font->syntheticBoldOffset()) {
+            CGContextSetTextPosition(cgContext, point.x() + translation.width() + shadowSize.width() + font->syntheticBoldOffset(), point.y() + translation.height() + shadowSize.height());
             CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         }
         graphicsContext->setFillColor(fillColor);
@@ -350,8 +350,8 @@
 
     CGContextSetTextPosition(cgContext, point.x() + translation.width(), point.y() + translation.height());
     CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-    if (font->m_syntheticBoldOffset) {
-        CGContextSetTextPosition(cgContext, point.x() + translation.width() + font->m_syntheticBoldOffset, point.y() + translation.height());
+    if (font->syntheticBoldOffset()) {
+        CGContextSetTextPosition(cgContext, point.x() + translation.width() + font->syntheticBoldOffset(), point.y() + translation.height());
         CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
     }
 
diff --git a/WebCore/platform/graphics/win/FontCustomPlatformData.cpp b/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
index 1ac3359..24db173 100644
--- a/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
@@ -116,7 +116,7 @@
 // Streams the concatenation of a header and font data.
 class EOTStream {
 public:
-    EOTStream(const Vector<uint8_t, 512>& eotHeader, const SharedBuffer* fontData, size_t overlayDst, size_t overlaySrc, size_t overlayLength)
+    EOTStream(const EOTHeader& eotHeader, const SharedBuffer* fontData, size_t overlayDst, size_t overlaySrc, size_t overlayLength)
         : m_eotHeader(eotHeader)
         , m_fontData(fontData)
         , m_overlayDst(overlayDst)
@@ -130,7 +130,7 @@
     size_t read(void* buffer, size_t count);
 
 private:
-    const Vector<uint8_t, 512>& m_eotHeader;
+    const EOTHeader& m_eotHeader;
     const SharedBuffer* m_fontData;
     size_t m_overlayDst;
     size_t m_overlaySrc;
@@ -206,7 +206,7 @@
 
     // TTLoadEmbeddedFont works only with Embedded OpenType (.eot) data, so we need to create an EOT header
     // and prepend it to the font data.
-    Vector<uint8_t, 512> eotHeader;
+    EOTHeader eotHeader;
     size_t overlayDst;
     size_t overlaySrc;
     size_t overlayLength;
diff --git a/WebCore/platform/graphics/win/FontWin.cpp b/WebCore/platform/graphics/win/FontWin.cpp
index 5e423e0..27d8dee 100644
--- a/WebCore/platform/graphics/win/FontWin.cpp
+++ b/WebCore/platform/graphics/win/FontWin.cpp
@@ -30,13 +30,17 @@
 #include "GlyphBuffer.h"
 #include "GraphicsContext.h"
 #include "IntRect.h"
-#include "NotImplemented.h"
 #include "SimpleFontData.h"
 #include "UniscribeController.h"
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
 
+bool Font::canReturnFallbackFontsForComplexText()
+{
+    return true;
+}
+
 FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint& point, int h,
                                             int from, int to) const
 {
@@ -85,9 +89,9 @@
     drawGlyphBuffer(context, glyphBuffer, run, startPoint);
 }
 
-float Font::floatWidthForComplexText(const TextRun& run) const
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
-    UniscribeController controller(this, run);
+    UniscribeController controller(this, run, fallbackFonts);
     controller.advance(run.length());
     return controller.runWidthSoFar();
 }
diff --git a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
index da5b503..917631b 100644
--- a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
+++ b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
@@ -27,7 +27,6 @@
 #include "GraphicsContext.h"
 
 #include "TransformationMatrix.h"
-#include "NotImplemented.h"
 #include "Path.h"
 
 #include <CoreGraphics/CGBitmapContext.h>
diff --git a/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp b/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
index 1980d18..ca3cb5d 100644
--- a/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
+++ b/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
@@ -27,7 +27,6 @@
 #include "GraphicsContext.h"
 
 #include "TransformationMatrix.h"
-#include "NotImplemented.h"
 #include "Path.h"
 
 #include <cairo-win32.h>
@@ -37,13 +36,61 @@
 
 namespace WebCore {
 
+static cairo_t* createCairoContextWithHDC(HDC hdc, bool hasAlpha)
+{
+    // Put the HDC In advanced mode so it will honor affine transforms.
+    SetGraphicsMode(hdc, GM_ADVANCED);
+    
+    HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
+
+    BITMAP info;
+    GetObject(bitmap, sizeof(info), &info);
+    ASSERT(info.bmBitsPixel == 32);
+
+    cairo_surface_t* image = cairo_image_surface_create_for_data((unsigned char*)info.bmBits,
+                                               CAIRO_FORMAT_ARGB32,
+                                               info.bmWidth,
+                                               info.bmHeight,
+                                               info.bmWidthBytes);
+
+    cairo_t* context = cairo_create(image);
+    cairo_surface_destroy(image);
+
+    return context;
+}
+
+static BITMAPINFO bitmapInfoForSize(const IntSize& size)
+{
+    BITMAPINFO bitmapInfo;
+    bitmapInfo.bmiHeader.biSize          = sizeof(BITMAPINFOHEADER);
+    bitmapInfo.bmiHeader.biWidth         = size.width(); 
+    bitmapInfo.bmiHeader.biHeight        = size.height();
+    bitmapInfo.bmiHeader.biPlanes        = 1;
+    bitmapInfo.bmiHeader.biBitCount      = 32;
+    bitmapInfo.bmiHeader.biCompression   = BI_RGB;
+    bitmapInfo.bmiHeader.biSizeImage     = 0;
+    bitmapInfo.bmiHeader.biXPelsPerMeter = 0;
+    bitmapInfo.bmiHeader.biYPelsPerMeter = 0;
+    bitmapInfo.bmiHeader.biClrUsed       = 0;
+    bitmapInfo.bmiHeader.biClrImportant  = 0;
+
+    return bitmapInfo;
+}
+
+static void fillWithClearColor(HBITMAP bitmap)
+{
+    BITMAP bmpInfo;
+    GetObject(bitmap, sizeof(bmpInfo), &bmpInfo);
+    int bufferSize = bmpInfo.bmWidthBytes * bmpInfo.bmHeight;
+    memset(bmpInfo.bmBits, 0, bufferSize);
+}
+
 GraphicsContext::GraphicsContext(HDC dc, bool hasAlpha)
     : m_common(createGraphicsContextPrivate())
     , m_data(new GraphicsContextPlatformPrivate)
 {
     if (dc) {
-        cairo_surface_t* surface = cairo_win32_surface_create(dc);
-        m_data->cr = cairo_create(surface);
+        m_data->cr = createCairoContextWithHDC(dc, hasAlpha);
         m_data->m_hdc = dc;
     } else {
         setPaintingDisabled(true);
@@ -60,52 +107,95 @@
 
 HDC GraphicsContext::getWindowsContext(const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
 {
-    // FIXME:  We aren't really doing anything with the 'mayCreateBitmap' flag.  This needs
-    // to be addressed.
-    if (dstRect.isEmpty())
-       return 0;
+    // FIXME: Should a bitmap be created also when a shadow is set?
+    if (mayCreateBitmap && inTransparencyLayer()) {
+        if (dstRect.isEmpty())
+            return 0;
 
-    // This is probably wrong, and definitely out of date.  Pulled from old SVN
-    cairo_surface_t* surface = cairo_get_target(platformContext());
-    HDC hdc = cairo_win32_surface_get_dc(surface);   
-    SaveDC(hdc);
+        // Create a bitmap DC in which to draw.
+        BITMAPINFO bitmapInfo = bitmapInfoForSize(dstRect.size());
 
-    // FIXME: We need to make sure a clip is really set on the HDC.
-    // Call SetWorldTransform to honor the current Cairo transform.
-    SetGraphicsMode(hdc, GM_ADVANCED); // We need this call for themes to honor world transforms.
-    cairo_matrix_t mat;
-    cairo_get_matrix(platformContext(), &mat);
-    XFORM xform;
-    xform.eM11 = mat.xx;
-    xform.eM12 = mat.xy;
-    xform.eM21 = mat.yx;
-    xform.eM22 = mat.yy;
-    xform.eDx = mat.x0;
-    xform.eDy = mat.y0;
-    ::SetWorldTransform(hdc, &xform);
+        void* pixels = 0;
+        HBITMAP bitmap = ::CreateDIBSection(NULL, &bitmapInfo, DIB_RGB_COLORS, &pixels, 0, 0);
+        if (!bitmap)
+            return 0;
 
-    return hdc;
+        HDC bitmapDC = ::CreateCompatibleDC(m_data->m_hdc);
+        ::SelectObject(bitmapDC, bitmap);
+
+        // Fill our buffer with clear if we're going to alpha blend.
+        if (supportAlphaBlend)
+           fillWithClearColor(bitmap);
+
+        // Make sure we can do world transforms.
+        SetGraphicsMode(bitmapDC, GM_ADVANCED);
+
+        // Apply a translation to our context so that the drawing done will be at (0,0) of the bitmap.
+        XFORM xform;
+        xform.eM11 = 1.0f;
+        xform.eM12 = 0.0f;
+        xform.eM21 = 0.0f;
+        xform.eM22 = 1.0f;
+        xform.eDx = -dstRect.x();
+        xform.eDy = -dstRect.y();
+        ::SetWorldTransform(bitmapDC, &xform);
+
+        return bitmapDC;
+    }
+
+    cairo_surface_t* surface = cairo_win32_surface_create(m_data->m_hdc);
+    cairo_surface_flush(surface);
+    cairo_surface_destroy(surface);
+
+    m_data->save();
+
+    return m_data->m_hdc;
 }
 
 void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
 {
-    // FIXME:  We aren't really doing anything with the 'mayCreateBitmap' flag.  This needs
-    // to be addressed.
-    if (dstRect.isEmpty())
-       return;
+    if (!mayCreateBitmap || !hdc || !inTransparencyLayer()) {
+        m_data->restore();
+        return;
+    }
 
-    cairo_surface_t* surface = cairo_get_target(platformContext());
-    HDC hdc2 = cairo_win32_surface_get_dc(surface);
-    RestoreDC(hdc2, -1);
-    cairo_surface_mark_dirty(surface);
+    if (dstRect.isEmpty())
+        return;
+
+    HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
+
+    BITMAP info;
+    GetObject(bitmap, sizeof(info), &info);
+    ASSERT(info.bmBitsPixel == 32);
+
+    // Need to make a cairo_surface_t out of the bitmap's pixel buffer and then draw
+    // it into our context.
+    cairo_surface_t* image = cairo_image_surface_create_for_data((unsigned char*)info.bmBits,
+                                            CAIRO_FORMAT_ARGB32,
+                                            info.bmWidth,
+                                            info.bmHeight,
+                                            info.bmWidthBytes);
+
+    // Scale the target surface to the new image size, and flip it
+    // so that when we set the srcImage as the surface it will draw
+    // right-side-up.
+    cairo_translate(m_data->cr, 0, dstRect.height());
+    cairo_scale(m_data->cr, dstRect.width(), -dstRect.height());
+    cairo_set_source_surface (m_data->cr, image, dstRect.x(), dstRect.y());
+
+    if (m_data->layers.size())
+        cairo_paint_with_alpha(m_data->cr, m_data->layers.last());
+    else
+        cairo_paint(m_data->cr);
+     
+    // Delete all our junk.
+    cairo_surface_destroy(image);
+    ::DeleteDC(hdc);
+    ::DeleteObject(bitmap);
 }
 
 void GraphicsContextPlatformPrivate::concatCTM(const TransformationMatrix& transform)
 {
-    cairo_surface_t* surface = cairo_get_target(cr);
-    HDC hdc = cairo_win32_surface_get_dc(surface);   
-    SaveDC(hdc);
-
     const cairo_matrix_t* matrix = reinterpret_cast<const cairo_matrix_t*>(&transform);
 
     XFORM xform;
@@ -116,7 +206,15 @@
     xform.eDx = matrix->x0;
     xform.eDy = matrix->y0;
 
-    ModifyWorldTransform(hdc, &xform, MWT_LEFTMULTIPLY);
+    ModifyWorldTransform(m_hdc, &xform, MWT_LEFTMULTIPLY);
+}
+
+void GraphicsContextPlatformPrivate::syncContext(PlatformGraphicsContext* cr)
+{
+    cairo_surface_t* surface = cairo_get_target(cr);
+    m_hdc = cairo_win32_surface_get_dc(surface);   
+
+    SetGraphicsMode(m_hdc, GM_ADVANCED); // We need this call for themes to honor world transforms.
 }
 
 }
diff --git a/WebCore/platform/graphics/win/ImageCairoWin.cpp b/WebCore/platform/graphics/win/ImageCairoWin.cpp
index 95bb7bc..06428b8 100644
--- a/WebCore/platform/graphics/win/ImageCairoWin.cpp
+++ b/WebCore/platform/graphics/win/ImageCairoWin.cpp
@@ -47,13 +47,17 @@
         memset(bmpInfo.bmBits, 255, bufferSize);
     }
 
-    HDC tempDC = CreateCompatibleDC(0);
-    if (!tempDC) {
-        LOG_ERROR("Failed to create in-memory DC for Image::blit()");
-        return false;
-    }
-    SelectObject(tempDC, bmp);
-    GraphicsContext gc(tempDC);
+    cairo_surface_t* image = cairo_image_surface_create_for_data((unsigned char*)bmpInfo.bmBits,
+                                               CAIRO_FORMAT_ARGB32,
+                                               bmpInfo.bmWidth,
+                                               bmpInfo.bmHeight,
+                                               bmpInfo.bmWidthBytes);
+
+
+    cairo_t* targetRef = cairo_create(image);
+    cairo_surface_destroy(image);
+
+    GraphicsContext gc(targetRef);
 
     IntSize imageSize = BitmapImage::size();
     if (size)
@@ -62,7 +66,7 @@
         draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), CompositeCopy);
 
     // Do cleanup
-    DeleteDC(tempDC);
+    cairo_destroy(targetRef);
 
     return true;
 }
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
index c293f49..35ea786 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
@@ -70,6 +70,8 @@
     , m_networkState(MediaPlayer::Empty)
     , m_readyState(MediaPlayer::HaveNothing)
     , m_enabledTrackCount(0)
+    , m_totalTrackCount(0)
+    , m_hasUnsupportedTracks(false)
     , m_startedPlaying(false)
     , m_isStreaming(false)
 #if DRAW_FRAME_RATE
@@ -320,9 +322,17 @@
   
     long loadState = m_qtMovie ? m_qtMovie->loadState() : QTMovieLoadStateError;
 
-    if (loadState >= QTMovieLoadStateLoaded && m_readyState < MediaPlayer::HaveMetadata && !m_player->inMediaDocument()) {
-        m_qtMovie->disableUnsupportedTracks(m_enabledTrackCount);
-        if (!m_enabledTrackCount)
+    if (loadState >= QTMovieLoadStateLoaded && m_readyState < MediaPlayer::HaveMetadata) {
+        m_qtMovie->disableUnsupportedTracks(m_enabledTrackCount, m_totalTrackCount);
+        if (m_player->inMediaDocument()) {
+            if (!m_enabledTrackCount || m_enabledTrackCount != m_totalTrackCount) {
+                // This is a type of media that we do not handle directly with a <video> 
+                // element, eg. QuickTime VR, a movie with a sprite track, etc. Tell the 
+                // MediaPlayerClient that we won't support it.
+                sawUnsupportedTracks();
+                return;
+            }
+        } else if (!m_enabledTrackCount)
             loadState = QTMovieLoadStateError;
     }
 
@@ -341,6 +351,14 @@
         m_networkState = MediaPlayer::Loading;
         m_readyState = MediaPlayer::HaveNothing;        
     } else {
+        if (m_player->inMediaDocument()) {
+            // Something went wrong in the loading of media within a standalone file. 
+            // This can occur with chained ref movies that eventually resolve to a
+            // file we don't support.
+            sawUnsupportedTracks();
+            return;
+        }
+
         float loaded = maxTimeLoaded();
         if (!loaded)
             m_readyState = MediaPlayer::HaveNothing;
@@ -365,9 +383,18 @@
         m_player->readyStateChanged();
 }
 
+void MediaPlayerPrivate::sawUnsupportedTracks()
+{
+    m_qtMovie->setDisabled(true);
+    m_hasUnsupportedTracks = true;
+    m_player->mediaPlayerClient()->mediaPlayerSawUnsupportedTracks(m_player);
+}
 
 void MediaPlayerPrivate::didEnd()
 {
+    if (m_hasUnsupportedTracks)
+        return;
+
     m_startedPlaying = false;
 #if DRAW_FRAME_RATE
     m_timeStoppedPlaying = GetTickCount();
@@ -378,20 +405,21 @@
 
 void MediaPlayerPrivate::setSize(const IntSize& size) 
 { 
-    if (m_qtMovie)
-        m_qtMovie->setSize(size.width(), size.height());
+    if (m_hasUnsupportedTracks || !m_qtMovie)
+        return;
+    m_qtMovie->setSize(size.width(), size.height());
 }
 
 void MediaPlayerPrivate::setVisible(bool b)
 {
-    if (!m_qtMovie)
+    if (m_hasUnsupportedTracks || !m_qtMovie)
         return;
     m_qtMovie->setVisible(b);
 }
 
 void MediaPlayerPrivate::paint(GraphicsContext* p, const IntRect& r)
 {
-    if (p->paintingDisabled() || !m_qtMovie)
+    if (p->paintingDisabled() || !m_qtMovie || m_hasUnsupportedTracks)
         return;
     HDC hdc = p->getWindowsContext(r);
     m_qtMovie->paint(hdc, r.x(), r.y());
@@ -463,18 +491,27 @@
 
 void MediaPlayerPrivate::movieEnded(QTMovieWin* movie)
 {
+    if (m_hasUnsupportedTracks)
+        return;
+
     ASSERT(m_qtMovie.get() == movie);
     didEnd();
 }
 
 void MediaPlayerPrivate::movieLoadStateChanged(QTMovieWin* movie)
 {
+    if (m_hasUnsupportedTracks)
+        return;
+
     ASSERT(m_qtMovie.get() == movie);
     updateStates();
 }
 
 void MediaPlayerPrivate::movieTimeChanged(QTMovieWin* movie)
 {
+    if (m_hasUnsupportedTracks)
+        return;
+
     ASSERT(m_qtMovie.get() == movie);
     updateStates();
     m_player->timeChanged();
@@ -482,6 +519,9 @@
 
 void MediaPlayerPrivate::movieNewImageAvailable(QTMovieWin* movie)
 {
+    if (m_hasUnsupportedTracks)
+        return;
+
     ASSERT(m_qtMovie.get() == movie);
 #if DRAW_FRAME_RATE
     if (m_startedPlaying) {
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
index 63aa62b..3207867 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
@@ -98,6 +98,7 @@
     void cancelSeek();
     void seekTimerFired(Timer<MediaPlayerPrivate>*);
     float maxTimeLoaded() const;
+    void sawUnsupportedTracks();
 
     virtual void movieEnded(QTMovieWin*);
     virtual void movieLoadStateChanged(QTMovieWin*);
@@ -118,6 +119,8 @@
     MediaPlayer::NetworkState m_networkState;
     MediaPlayer::ReadyState m_readyState;
     unsigned m_enabledTrackCount;
+    unsigned m_totalTrackCount;
+    bool m_hasUnsupportedTracks;
     bool m_startedPlaying;
     bool m_isStreaming;
 #if DRAW_FRAME_RATE
diff --git a/WebCore/platform/graphics/win/QTMovieWin.cpp b/WebCore/platform/graphics/win/QTMovieWin.cpp
index 3f23698..1d10006 100644
--- a/WebCore/platform/graphics/win/QTMovieWin.cpp
+++ b/WebCore/platform/graphics/win/QTMovieWin.cpp
@@ -91,6 +91,7 @@
     void createGWorld();
     void deleteGWorld();
     void clearGWorld();
+    void cacheMovieScale();
 
     void setSize(int, int);
 
@@ -112,6 +113,11 @@
     int m_gWorldHeight;
     GWorldPtr m_savedGWorld;
     long m_loadError;
+    float m_widthScaleFactor;
+    float m_heightScaleFactor;
+#if !ASSERT_DISABLED
+    bool m_scaleCached;
+#endif
 };
 
 QTMovieWinPrivate::QTMovieWinPrivate()
@@ -133,6 +139,11 @@
     , m_gWorldHeight(0)
     , m_savedGWorld(0)
     , m_loadError(0)
+    , m_widthScaleFactor(1)
+    , m_heightScaleFactor(1)
+#if !ASSERT_DISABLED
+    , m_scaleCached(false)
+#endif
 {
 }
 
@@ -179,6 +190,26 @@
     updateTaskTimer();
 }
 
+void QTMovieWinPrivate::cacheMovieScale()
+{
+    Rect naturalRect;
+    Rect initialRect;
+
+    GetMovieNaturalBoundsRect(m_movie, &naturalRect);
+    GetMovieBox(m_movie, &initialRect);
+
+    int naturalWidth = naturalRect.right - naturalRect.left;
+    int naturalHeight = naturalRect.bottom - naturalRect.top;
+
+    if (naturalWidth)
+        m_widthScaleFactor = (initialRect.right - initialRect.left) / naturalWidth;
+    if (naturalHeight)
+        m_heightScaleFactor = (initialRect.bottom - initialRect.top) / naturalHeight;
+#if !ASSERT_DISABLED
+    m_scaleCached = true;;
+#endif
+}
+
 void QTMovieWinPrivate::task() 
 {
     ASSERT(m_tasking);
@@ -192,20 +223,27 @@
 
     // GetMovieLoadState documentation says that you should not call it more often than every quarter of a second.
     if (systemTime() >= m_lastLoadStateCheckTime + 0.25 || m_loadError) { 
-        // If load fails QT's load state is kMovieLoadStateComplete.
+        // If load fails QT's load state is QTMovieLoadStateComplete.
         // This is different from QTKit API and seems strange.
-        long loadState = m_loadError ? kMovieLoadStateError : GetMovieLoadState(m_movie);
+        long loadState = m_loadError ? QTMovieLoadStateError : GetMovieLoadState(m_movie);
         if (loadState != m_loadState) {
 
             // we only need to erase the movie gworld when the load state changes to loaded while it
             //  is visible as the gworld is destroyed/created when visibility changes
-            if (loadState >= QTMovieLoadStateLoaded && m_loadState < QTMovieLoadStateLoaded && m_visible)
-                clearGWorld();
+            if (loadState >= QTMovieLoadStateLoaded && m_loadState < QTMovieLoadStateLoaded) {
+                if (m_visible)
+                    clearGWorld();
+                cacheMovieScale();
+            }
 
             m_loadState = loadState;
-            if (!m_movieController && m_loadState >= kMovieLoadStateLoaded)
+            if (!m_movieController && m_loadState >= QTMovieLoadStateLoaded)
                 createMovieController();
             m_client->movieLoadStateChanged(m_movieWin);
+            if (m_movieWin->m_disabled) {
+                endTask();
+                return;
+            }
         }
         m_lastLoadStateCheckTime = systemTime();
     }
@@ -259,7 +297,7 @@
 
 void QTMovieWinPrivate::drawingComplete()
 {
-    if (!m_gWorld || m_loadState < kMovieLoadStateLoaded)
+    if (!m_gWorld || m_movieWin->m_disabled || m_loadState < QTMovieLoadStateLoaded)
         return;
     m_client->movieNewImageAvailable(m_movieWin);
 }
@@ -284,7 +322,7 @@
 void QTMovieWinPrivate::createGWorld()
 {
     ASSERT(!m_gWorld);
-    if (!m_movie)
+    if (!m_movie || m_loadState < QTMovieLoadStateLoaded)
         return;
 
     m_gWorldWidth = max(cGWorldMinWidth, m_width);
@@ -334,8 +372,17 @@
         return;
     m_width = width;
     m_height = height;
-    if (!m_movie)
+
+    // Do not change movie box before reaching load state loaded as we grab
+    // the initial size when task() sees that state for the first time, and
+    // we need the initial size to be able to scale movie properly. 
+    if (!m_movie || m_loadState < QTMovieLoadStateLoaded)
         return;
+
+#if !ASSERT_DISABLED
+    ASSERT(m_scaleCached);
+#endif
+
     Rect bounds; 
     bounds.top = 0;
     bounds.left = 0; 
@@ -364,6 +411,7 @@
 
 QTMovieWin::QTMovieWin(QTMovieWinClient* client)
     : m_private(new QTMovieWinPrivate())
+    , m_disabled(false)
 {
     m_private->m_movieWin = this;
     m_private->m_client = client;
@@ -478,8 +526,8 @@
 
     if (m_private->m_movie)
         GetMovieNaturalBoundsRect(m_private->m_movie, &rect);
-    width = rect.right;
-    height = rect.bottom;
+    width = (rect.right - rect.left) * m_private->m_widthScaleFactor;
+    height = (rect.bottom - rect.top) * m_private->m_heightScaleFactor;
 }
 
 void QTMovieWin::setSize(int width, int height)
@@ -593,6 +641,7 @@
     movieProps[moviePropCount].propStatus = 0; 
     moviePropCount++; 
 
+    ASSERT(moviePropCount <= sizeof(movieProps)/sizeof(movieProps[0]));
     m_private->m_loadError = NewMovieFromProperties(moviePropCount, movieProps, 0, NULL, &m_private->m_movie);
 
     CFRelease(urlRef);
@@ -601,15 +650,24 @@
     // get the load fail callback quickly 
     if (m_private->m_loadError)
         updateTaskTimer(0);
-    else
+    else {
+        OSType mode = kQTApertureMode_CleanAperture;
+
+        // Set the aperture mode property on a movie to signal that we want aspect ratio
+        // and clean aperture dimensions. Don't worry about errors, we can't do anything if
+        // the installed version of QT doesn't support it and it isn't serious enough to 
+        // warrant failing.
+        QTSetMovieProperty(m_private->m_movie, kQTPropertyClass_Visual, kQTVisualPropertyID_ApertureMode, sizeof(mode), &mode);
         m_private->registerDrawingCallback();
+    }
 
     CFRelease(urlStringRef);
 }
 
-void QTMovieWin::disableUnsupportedTracks(unsigned& enabledTrackCount)
+void QTMovieWin::disableUnsupportedTracks(unsigned& enabledTrackCount, unsigned& totalTrackCount)
 {
     if (!m_private->m_movie) {
+        totalTrackCount = 0;
         enabledTrackCount = 0;
         return;
     }
@@ -623,11 +681,16 @@
         allowedTrackTypes->add(BaseMediaType);
         allowedTrackTypes->add('clcp'); // Closed caption
         allowedTrackTypes->add('sbtl'); // Subtitle
+        allowedTrackTypes->add('odsm'); // MPEG-4 object descriptor stream
+        allowedTrackTypes->add('sdsm'); // MPEG-4 scene description stream
+        allowedTrackTypes->add(TimeCodeMediaType);
+        allowedTrackTypes->add(TimeCode64MediaType);
     }
 
     long trackCount = GetMovieTrackCount(m_private->m_movie);
     enabledTrackCount = trackCount;
-    
+    totalTrackCount = trackCount;
+
     // Track indexes are 1-based. yuck. These things must descend from old-
     // school mac resources or something.
     for (long trackIndex = 1; trackIndex <= trackCount; trackIndex++) {
@@ -716,6 +779,11 @@
     }
 }
 
+void QTMovieWin::setDisabled(bool b)
+{
+    m_disabled = b;
+}
+
 
 bool QTMovieWin::hasVideo() const
 {
diff --git a/WebCore/platform/graphics/win/QTMovieWin.h b/WebCore/platform/graphics/win/QTMovieWin.h
index 2186974..70cbef5 100644
--- a/WebCore/platform/graphics/win/QTMovieWin.h
+++ b/WebCore/platform/graphics/win/QTMovieWin.h
@@ -84,7 +84,8 @@
     void setVisible(bool);
     void paint(HDC, int x, int y);
 
-    void disableUnsupportedTracks(unsigned& enabledTrackCount);
+    void disableUnsupportedTracks(unsigned& enabledTrackCount, unsigned& totalTrackCount);
+    void setDisabled(bool);
 
     bool hasVideo() const;
 
@@ -93,6 +94,7 @@
 
 private:
     QTMovieWinPrivate* m_private;
+    bool m_disabled;
     friend class QTMovieWinPrivate;
 };
 
diff --git a/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp b/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
index 8b5ab87..aaa089a 100644
--- a/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
+++ b/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
@@ -52,27 +52,27 @@
 
 void SimpleFontData::platformInit()
 {
-    m_syntheticBoldOffset = m_font.syntheticBold() ? 1.0f : 0.f;
+    m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
     m_scriptCache = 0;
     m_scriptFontProperties = 0;
     m_isSystemFont = false;
 
-    if (m_font.useGDI())
+    if (m_platformData.useGDI())
        return initGDIFont();
 
-    CGFontRef font = m_font.cgFont();
+    CGFontRef font = m_platformData.cgFont();
     int iAscent = CGFontGetAscent(font);
     int iDescent = CGFontGetDescent(font);
     int iLineGap = CGFontGetLeading(font);
     m_unitsPerEm = CGFontGetUnitsPerEm(font);
-    float pointSize = m_font.size();
+    float pointSize = m_platformData.size();
     float fAscent = scaleEmToUnits(iAscent, m_unitsPerEm) * pointSize;
     float fDescent = -scaleEmToUnits(iDescent, m_unitsPerEm) * pointSize;
     float fLineGap = scaleEmToUnits(iLineGap, m_unitsPerEm) * pointSize;
 
     if (!isCustomFont()) {
         HDC dc = GetDC(0);
-        HGDIOBJ oldFont = SelectObject(dc, m_font.hfont());
+        HGDIOBJ oldFont = SelectObject(dc, m_platformData.hfont());
         int faceLength = GetTextFace(dc, 0, 0);
         Vector<TCHAR> faceName(faceLength);
         GetTextFace(dc, faceLength, faceName.data());
@@ -116,6 +116,16 @@
     }
 }
 
+void SimpleFontData::platformCharWidthInit()
+{
+    // GDI Fonts init charwidths in initGDIFont.
+    if (!m_platformData.useGDI()) {
+        m_avgCharWidth = 0.f;
+        m_maxCharWidth = 0.f;
+        initCharWidths();
+    }
+}
+
 void SimpleFontData::platformDestroy()
 {
     platformCommonDestroy();
@@ -123,11 +133,11 @@
 
 float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
 {
-    if (m_font.useGDI())
+    if (m_platformData.useGDI())
        return widthForGDIGlyph(glyph);
 
-    CGFontRef font = m_font.cgFont();
-    float pointSize = m_font.size();
+    CGFontRef font = m_platformData.cgFont();
+    float pointSize = m_platformData.size();
     CGSize advance;
     CGAffineTransform m = CGAffineTransformMakeScale(pointSize, pointSize);
  
diff --git a/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp b/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
index 07d5305..2e51621 100644
--- a/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
+++ b/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
@@ -35,7 +35,6 @@
 #include "FontCache.h"
 #include "FontDescription.h"
 #include "MathExtras.h"
-#include "NotImplemented.h"
 #include <cairo.h>
 #include <cairo-win32.h>
 #include <mlang.h>
@@ -50,14 +49,16 @@
     m_isSystemFont = false;
     m_syntheticBoldOffset = 0;
 
-    if (m_font.useGDI())
+    m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
+
+    if (m_platformData.useGDI())
        return initGDIFont();
 
     HDC hdc = GetDC(0);
     SaveDC(hdc);
 
-    cairo_scaled_font_t* scaledFont = m_font.scaledFont();
-    const double metricsMultiplier = cairo_win32_scaled_font_get_metrics_factor(scaledFont) * m_font.size();
+    cairo_scaled_font_t* scaledFont = m_platformData.scaledFont();
+    const double metricsMultiplier = cairo_win32_scaled_font_get_metrics_factor(scaledFont) * m_platformData.size();
 
     cairo_win32_scaled_font_select_font(scaledFont, hdc);
 
@@ -68,6 +69,8 @@
     m_xHeight = m_ascent * 0.56f; // Best guess for xHeight for non-Truetype fonts.
     m_lineGap = lroundf(textMetrics.tmExternalLeading * metricsMultiplier);
     m_lineSpacing = m_ascent + m_descent + m_lineGap;
+    m_avgCharWidth = lroundf(textMetrics.tmAveCharWidth * metricsMultiplier);
+    m_maxCharWidth = lroundf(textMetrics.tmMaxCharWidth * metricsMultiplier);
 
     OUTLINETEXTMETRIC metrics;
     if (GetOutlineTextMetrics(hdc, sizeof(metrics), &metrics) > 0) {
@@ -89,25 +92,30 @@
     ReleaseDC(0, hdc);
 }
 
+void SimpleFontData::platformCharWidthInit()
+{
+    // charwidths are set in platformInit.
+}
+
 void SimpleFontData::platformDestroy()
 {
-    cairo_font_face_destroy(m_font.fontFace());
-    cairo_scaled_font_destroy(m_font.scaledFont());
+    cairo_font_face_destroy(m_platformData.fontFace());
+    cairo_scaled_font_destroy(m_platformData.scaledFont());
 
-    DeleteObject(m_font.hfont());
+    DeleteObject(m_platformData.hfont());
 
     platformCommonDestroy();
 }
 
 float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
 {
-    if (m_font.useGDI())
+    if (m_platformData.useGDI())
        return widthForGDIGlyph(glyph);
 
     HDC hdc = GetDC(0);
     SaveDC(hdc);
 
-    cairo_scaled_font_t* scaledFont = m_font.scaledFont();
+    cairo_scaled_font_t* scaledFont = m_platformData.scaledFont();
     cairo_win32_scaled_font_select_font(scaledFont, hdc);
 
     int width;
@@ -118,14 +126,14 @@
     RestoreDC(hdc, -1);
     ReleaseDC(0, hdc);
 
-    const double metricsMultiplier = cairo_win32_scaled_font_get_metrics_factor(scaledFont) * m_font.size();
+    const double metricsMultiplier = cairo_win32_scaled_font_get_metrics_factor(scaledFont) * m_platformData.size();
     return width * metricsMultiplier;
 }
 
 void SimpleFontData::setFont(cairo_t* cr) const
 {
     ASSERT(cr);
-    m_font.setFont(cr);
+    m_platformData.setFont(cr);
 }
 
 }
diff --git a/WebCore/platform/graphics/win/SimpleFontDataWin.cpp b/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
index 9d5c3b9..9835e9f 100644
--- a/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
+++ b/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
@@ -63,7 +63,7 @@
 void SimpleFontData::initGDIFont()
 {
      HDC hdc = GetDC(0);
-     HGDIOBJ oldFont = SelectObject(hdc, m_font.hfont());
+     HGDIOBJ oldFont = SelectObject(hdc, m_platformData.hfont());
      OUTLINETEXTMETRIC metrics;
      GetOutlineTextMetrics(hdc, sizeof(metrics), &metrics);
      TEXTMETRIC& textMetrics = metrics.otmTextMetrics;
@@ -71,6 +71,8 @@
      m_descent = textMetrics.tmDescent;
      m_lineGap = textMetrics.tmExternalLeading;
      m_lineSpacing = m_ascent + m_descent + m_lineGap;
+     m_avgCharWidth = textMetrics.tmAveCharWidth;
+     m_maxCharWidth = textMetrics.tmMaxCharWidth;
      m_xHeight = m_ascent * 0.56f; // Best guess for xHeight if no x glyph is present.
 
      GLYPHMETRICS gm;
@@ -100,17 +102,17 @@
 SimpleFontData* SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
 {
     if (!m_smallCapsFontData) {
-        float smallCapsHeight = cSmallCapsFontSizeMultiplier * m_font.size();
+        float smallCapsHeight = cSmallCapsFontSizeMultiplier * m_platformData.size();
         if (isCustomFont()) {
-            FontPlatformData smallCapsFontData(m_font);
+            FontPlatformData smallCapsFontData(m_platformData);
             smallCapsFontData.setSize(smallCapsHeight);
             m_smallCapsFontData = new SimpleFontData(smallCapsFontData, true, false);
         } else {
             LOGFONT winfont;
-            GetObject(m_font.hfont(), sizeof(LOGFONT), &winfont);
-            winfont.lfHeight = -lroundf(smallCapsHeight * (m_font.useGDI() ? 1 : 32));
+            GetObject(m_platformData.hfont(), sizeof(LOGFONT), &winfont);
+            winfont.lfHeight = -lroundf(smallCapsHeight * (m_platformData.useGDI() ? 1 : 32));
             HFONT hfont = CreateFontIndirect(&winfont);
-            m_smallCapsFontData = new SimpleFontData(FontPlatformData(hfont, smallCapsHeight, m_font.syntheticBold(), m_font.syntheticOblique(), m_font.useGDI()));
+            m_smallCapsFontData = new SimpleFontData(FontPlatformData(hfont, smallCapsHeight, m_platformData.syntheticBold(), m_platformData.syntheticOblique(), m_platformData.useGDI()));
         }
     }
     return m_smallCapsFontData;
@@ -135,7 +137,7 @@
     langFontLink->CodePageToCodePages(CP_ACP, &acpCodePages);
 
     DWORD fontCodePages;
-    langFontLink->GetFontCodePages(dc, m_font.hfont(), &fontCodePages);
+    langFontLink->GetFontCodePages(dc, m_platformData.hfont(), &fontCodePages);
 
     DWORD actualCodePages;
     long numCharactersProcessed;
@@ -162,7 +164,7 @@
     // TEXTMETRICS have this.  Set m_treatAsFixedPitch based off that.
     HDC dc = GetDC(0);
     SaveDC(dc);
-    SelectObject(dc, m_font.hfont());
+    SelectObject(dc, m_platformData.hfont());
 
     // Yes, this looks backwards, but the fixed pitch bit is actually set if the font
     // is *not* fixed pitch.  Unbelievable but true.
@@ -178,7 +180,7 @@
 {
     HDC hdc = GetDC(0);
     SetGraphicsMode(hdc, GM_ADVANCED);
-    HGDIOBJ oldFont = SelectObject(hdc, m_font.hfont());
+    HGDIOBJ oldFont = SelectObject(hdc, m_platformData.hfont());
     int width;
     GetCharWidthI(hdc, glyph, 1, 0, &width);
     SelectObject(hdc, oldFont);
@@ -196,7 +198,7 @@
         if (result == E_PENDING) {
             HDC dc = GetDC(0);
             SaveDC(dc);
-            SelectObject(dc, m_font.hfont());
+            SelectObject(dc, m_platformData.hfont());
             ScriptGetFontProperties(dc, scriptCache(), m_scriptFontProperties);
             RestoreDC(dc, -1);
             ReleaseDC(0, dc);
diff --git a/WebCore/platform/graphics/win/UniscribeController.cpp b/WebCore/platform/graphics/win/UniscribeController.cpp
index 371bc51..f382857 100644
--- a/WebCore/platform/graphics/win/UniscribeController.cpp
+++ b/WebCore/platform/graphics/win/UniscribeController.cpp
@@ -38,9 +38,10 @@
 // that does stuff in that method instead of doing everything in the constructor.  Have advance()
 // take the GlyphBuffer as an arg so that we don't have to populate the glyph buffer when
 // measuring.
-UniscribeController::UniscribeController(const Font* font, const TextRun& run)
+UniscribeController::UniscribeController(const Font* font, const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts)
 : m_font(*font)
 , m_run(run)
+, m_fallbackFonts(fallbackFonts)
 , m_end(run.length())
 , m_currentCharacter(0)
 , m_runWidthSoFar(0)
@@ -147,6 +148,9 @@
                 smallCapsBuffer[index] = forceSmallCaps ? c : newC;
         }
 
+        if (m_fallbackFonts && nextFontData != fontData && fontData != m_font.primaryFont())
+            m_fallbackFonts->add(fontData);
+
         if (nextFontData != fontData || nextIsSmallCaps != isSmallCaps) {
             int itemStart = m_run.rtl() ? index + 1 : indexOfFontTransition;
             int itemLength = m_run.rtl() ? indexOfFontTransition - index : index - indexOfFontTransition;
@@ -158,6 +162,9 @@
     
     int itemLength = m_run.rtl() ? indexOfFontTransition + 1 : length - indexOfFontTransition;
     if (itemLength) {
+        if (m_fallbackFonts && nextFontData != m_font.primaryFont())
+            m_fallbackFonts->add(nextFontData);
+
         int itemStart = m_run.rtl() ? 0 : indexOfFontTransition;
         m_currentCharacter = baseCharacter + itemStart;
         itemizeShapeAndPlace((nextIsSmallCaps ? smallCapsBuffer.data() : cp) + itemStart, itemLength, nextFontData, glyphBuffer);
@@ -258,16 +265,16 @@
     Vector<int> roundingHackWordBoundaries(glyphs.size());
     roundingHackWordBoundaries.fill(-1);
 
-    const float cLogicalScale = fontData->m_font.useGDI() ? 1.0f : 32.0f;
-    unsigned logicalSpaceWidth = fontData->m_spaceWidth * cLogicalScale;
-    float roundedSpaceWidth = roundf(fontData->m_spaceWidth);
+    const float cLogicalScale = fontData->platformData().useGDI() ? 1.0f : 32.0f;
+    unsigned logicalSpaceWidth = fontData->spaceWidth() * cLogicalScale;
+    float roundedSpaceWidth = roundf(fontData->spaceWidth());
 
     for (int k = 0; k < len; k++) {
         UChar ch = *(str + k);
         if (Font::treatAsSpace(ch)) {
             // Substitute in the space glyph at the appropriate place in the glyphs
             // array.
-            glyphs[clusters[k]] = fontData->m_spaceGlyph;
+            glyphs[clusters[k]] = fontData->spaceGlyph();
             advances[clusters[k]] = logicalSpaceWidth;
             spaceCharacters[clusters[k]] = m_currentCharacter + k + item.iCharPos;
         }
@@ -300,15 +307,15 @@
             offsetY = roundf(offsetY);
         }
 
-        advance += fontData->m_syntheticBoldOffset;
+        advance += fontData->syntheticBoldOffset();
 
         // We special case spaces in two ways when applying word rounding.
         // First, we round spaces to an adjusted width in all fonts.
         // Second, in fixed-pitch fonts we ensure that all glyphs that
         // match the width of the space glyph have the same width as the space glyph.
-        if (roundedAdvance == roundedSpaceWidth && (fontData->m_treatAsFixedPitch || glyph == fontData->m_spaceGlyph) &&
+        if (roundedAdvance == roundedSpaceWidth && (fontData->pitch() == FixedPitch || glyph == fontData->spaceGlyph()) &&
             m_run.applyWordRounding())
-            advance = fontData->m_adjustedSpaceWidth;
+            advance = fontData->adjustedSpaceWidth();
 
         if (hasExtraSpacing) {
             // If we're a glyph with an advance, go ahead and add in letter-spacing.
@@ -317,7 +324,7 @@
                 advance += m_font.letterSpacing();
 
             // Handle justification and word-spacing.
-            if (glyph == fontData->m_spaceGlyph) {
+            if (glyph == fontData->spaceGlyph()) {
                 // Account for padding. WebCore uses space padding to justify text.
                 // We distribute the specified padding over the available spaces in the run.
                 if (m_padding) {
diff --git a/WebCore/platform/graphics/win/UniscribeController.h b/WebCore/platform/graphics/win/UniscribeController.h
index 6ea45e1..23b8108 100644
--- a/WebCore/platform/graphics/win/UniscribeController.h
+++ b/WebCore/platform/graphics/win/UniscribeController.h
@@ -38,7 +38,7 @@
 
 class UniscribeController {
 public:
-    UniscribeController(const Font*, const TextRun&);
+    UniscribeController(const Font*, const TextRun&, HashSet<const SimpleFontData*>* fallbackFonts = 0);
 
     // Advance and measure/place up to the specified character.
     void advance(unsigned to, GlyphBuffer* = 0);
@@ -60,6 +60,7 @@
 
     const Font& m_font;
     const TextRun& m_run;
+    HashSet<const SimpleFontData*>* m_fallbackFonts;
 
     SCRIPT_CONTROL m_control;
     SCRIPT_STATE m_state;
diff --git a/WebCore/platform/graphics/wx/FontWx.cpp b/WebCore/platform/graphics/wx/FontWx.cpp
index 07223e9..04b2ec4 100644
--- a/WebCore/platform/graphics/wx/FontWx.cpp
+++ b/WebCore/platform/graphics/wx/FontWx.cpp
@@ -39,6 +39,11 @@
 
 namespace WebCore {
 
+bool Font::canReturnFallbackFontsForComplexText()
+{
+    return false;
+}
+
 void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* font, const GlyphBuffer& glyphBuffer, 
                       int from, int numGlyphs, const FloatPoint& point) const
 {
@@ -63,7 +68,7 @@
     notImplemented();
 }
 
-float Font::floatWidthForComplexText(const TextRun& run) const
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* /* fallbackFonts */) const
 {
     notImplemented();
     return 0;
diff --git a/WebCore/platform/graphics/wx/ImageSourceWx.cpp b/WebCore/platform/graphics/wx/ImageSourceWx.cpp
index fc8ce71..2f71d62 100644
--- a/WebCore/platform/graphics/wx/ImageSourceWx.cpp
+++ b/WebCore/platform/graphics/wx/ImageSourceWx.cpp
@@ -37,6 +37,9 @@
 
 #include <wx/defs.h>
 #include <wx/bitmap.h>
+#if USE(WXGC)
+#include <wx/graphics.h>
+#endif
 #include <wx/image.h>
 #include <wx/rawbmp.h>
 
@@ -224,7 +227,14 @@
     bmp->UseAlpha();
 #endif
     ASSERT(bmp->IsOk());
+
+#if USE(WXGC)
+    wxGraphicsBitmap* bitmap =  new wxGraphicsBitmap(wxGraphicsRenderer::GetDefaultRenderer()->CreateBitmap(*bmp));
+    delete bmp;
+    return bitmap;
+#else
     return bmp;
+#endif
 }
 
 float ImageSource::frameDurationAtIndex(size_t index)
diff --git a/WebCore/platform/graphics/wx/ImageWx.cpp b/WebCore/platform/graphics/wx/ImageWx.cpp
index e1d435e..b0a993e 100644
--- a/WebCore/platform/graphics/wx/ImageWx.cpp
+++ b/WebCore/platform/graphics/wx/ImageWx.cpp
@@ -26,11 +26,12 @@
 #include "config.h"
 #include "Image.h"
 
-#include "TransformationMatrix.h"
 #include "BitmapImage.h"
+#include "FloatConversion.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
-#include "NotImplemented.h"
+#include "ImageObserver.h"
+#include "TransformationMatrix.h"
 
 #include <math.h>
 #include <stdio.h>
@@ -98,13 +99,13 @@
 #if USE(WXGC)
     wxGCDC* context = (wxGCDC*)ctxt->platformContext();
     wxGraphicsContext* gc = context->GetGraphicsContext();
+    wxGraphicsBitmap* bitmap = frameAtIndex(m_currentFrame);
 #else
     wxWindowDC* context = ctxt->platformContext();
+    wxBitmap* bitmap = frameAtIndex(m_currentFrame);
 #endif
 
     startAnimation();
-
-    wxBitmap* bitmap = frameAtIndex(m_currentFrame);
     if (!bitmap) // If it's too early we won't have an image yet.
         return;
     
@@ -129,17 +130,15 @@
         adjustedDestRect.setLocation(FloatPoint(dst.x() - src.x() / scaleX, dst.y() - src.y() / scaleY));
         adjustedDestRect.setSize(FloatSize(selfSize.width() / scaleX, selfSize.height() / scaleY));
     }
-    
-    // If the image is only partially loaded, then shrink the destination rect that we're drawing into accordingly.
-    int currHeight = bitmap->GetHeight(); 
-    if (currHeight < selfSize.height())
-        adjustedDestRect.setHeight(adjustedDestRect.height() * currHeight / selfSize.height());
 
-    gc->PushState();
     gc->Clip(dst.x(), dst.y(), dst.width(), dst.height());
+#if wxCHECK_VERSION(2,9,0)
     gc->DrawBitmap(*bitmap, adjustedDestRect.x(), adjustedDestRect.y(), adjustedDestRect.width(), adjustedDestRect.height());
-    gc->PopState();
 #else
+    gc->DrawGraphicsBitmap(*bitmap, adjustedDestRect.x(), adjustedDestRect.y(), adjustedDestRect.width(), adjustedDestRect.height());
+#endif
+
+#else // USE(WXGC)
     IntRect srcIntRect(src);
     IntRect dstIntRect(dst);
     bool rescaling = false;
@@ -172,6 +171,9 @@
 #endif
 
     ctxt->restore();
+
+    if (ImageObserver* observer = imageObserver())
+        observer->didDraw(this);
 }
 
 void BitmapImage::drawPattern(GraphicsContext* ctxt, const FloatRect& srcRect, const TransformationMatrix& patternTransform, const FloatPoint& phase, CompositeOperator, const FloatRect& dstRect)
@@ -181,21 +183,29 @@
 
 #if USE(WXGC)
     wxGCDC* context = (wxGCDC*)ctxt->platformContext();
+    wxGraphicsBitmap* bitmap = frameAtIndex(m_currentFrame);
 #else
     wxWindowDC* context = ctxt->platformContext();
+    wxBitmap* bitmap = frameAtIndex(m_currentFrame);
 #endif
 
+    if (!bitmap) // If it's too early we won't have an image yet.
+        return;
+
     ctxt->save();
     ctxt->clip(IntRect(dstRect.x(), dstRect.y(), dstRect.width(), dstRect.height()));
-    wxBitmap* bitmap = frameAtIndex(m_currentFrame);
-    if (!bitmap) // If it's too early we won't have an image yet.
-        return;
     
     float currentW = 0;
     float currentH = 0;
     
 #if USE(WXGC)
     wxGraphicsContext* gc = context->GetGraphicsContext();
+
+    float adjustedX = phase.x() + srcRect.x() *
+                      narrowPrecisionToFloat(patternTransform.a());
+    float adjustedY = phase.y() + srcRect.y() *
+                      narrowPrecisionToFloat(patternTransform.d());
+                      
     gc->ConcatTransform(patternTransform);
 #else
     wxMemoryDC mydc;
@@ -208,7 +218,11 @@
     while ( currentW < dstRect.width()  && currentW < clientSize.x - origin.x ) {
         while ( currentH < dstRect.height() && currentH < clientSize.y - origin.y) {
 #if USE(WXGC)
-            gc->DrawBitmap(*bitmap, (wxDouble)dstRect.x() + currentW, (wxDouble)dstRect.y() + currentH, (wxDouble)srcRect.width(), (wxDouble)srcRect.height());
+#if wxCHECK_VERSION(2,9,0)
+            gc->DrawBitmap(*bitmap, adjustedX + currentW, adjustedY + currentH, (wxDouble)srcRect.width(), (wxDouble)srcRect.height());
+#else
+            gc->DrawGraphicsBitmap(*bitmap, adjustedX + currentW, adjustedY + currentH, (wxDouble)srcRect.width(), (wxDouble)srcRect.height());
+#endif
 #else
             context->Blit((wxCoord)dstRect.x() + currentW, (wxCoord)dstRect.y() + currentH,  
                             (wxCoord)srcRect.width(), (wxCoord)srcRect.height(), &mydc, 
@@ -233,6 +247,8 @@
 
     startAnimation();
 
+    if (ImageObserver* observer = imageObserver())
+        observer->didDraw(this);
 }
 
 void BitmapImage::checkForSolidColor()
diff --git a/WebCore/platform/graphics/wx/PathWx.cpp b/WebCore/platform/graphics/wx/PathWx.cpp
index 60c71d5..04a952d 100644
--- a/WebCore/platform/graphics/wx/PathWx.cpp
+++ b/WebCore/platform/graphics/wx/PathWx.cpp
@@ -66,11 +66,12 @@
 
 Path::~Path()
 {
+    clear();
 }
 
 Path::Path(const Path& path)
 { 
-    m_path = (PlatformPath*)&path.m_path;
+    m_path = new wxGraphicsPath(*path.m_path);
 }
 
 bool Path::contains(const FloatPoint& point, const WindRule rule) const
@@ -89,7 +90,7 @@
 
 void Path::translate(const FloatSize&)
 { 
-    notImplemented(); 
+    notImplemented();
 }
 
 FloatRect Path::boundingRect() const 
diff --git a/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp b/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp
index ab50518..2368f83 100644
--- a/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp
+++ b/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp
@@ -45,7 +45,7 @@
 
 void SimpleFontData::platformInit()
 {    
-    wxFont *font = m_font.font();
+    wxFont *font = m_platformData.font();
     if (font && font->IsOk()) {
         wxFontProperties props = wxFontProperties(font);
         m_ascent = props.GetAscent();
@@ -57,6 +57,13 @@
     }
 }
 
+void SimpleFontData::platformCharWidthInit()
+{
+    m_avgCharWidth = 0.f;
+    m_maxCharWidth = 0.f;
+    initCharWidths();
+}
+
 void SimpleFontData::platformDestroy()
 {
     delete m_smallCapsFontData;
@@ -81,8 +88,8 @@
 
 void SimpleFontData::determinePitch()
 {
-    if (m_font.font() && m_font.font()->Ok())
-        m_treatAsFixedPitch = m_font.font()->IsFixedWidth();
+    if (m_platformData.font() && m_platformData.font()->Ok())
+        m_treatAsFixedPitch = m_platformData.font()->IsFixedWidth();
     else
         m_treatAsFixedPitch = false;
 }
@@ -91,7 +98,7 @@
 {
     // TODO: fix this! Make GetTextExtents a method of wxFont in 2.9
     int width = 10;
-    GetTextExtent(*m_font.font(), (wxChar)glyph, &width, NULL);
+    GetTextExtent(*m_platformData.font(), (wxChar)glyph, &width, NULL);
     return width;
 }
 
diff --git a/WebCore/platform/graphics/wx/TransformationMatrixWx.cpp b/WebCore/platform/graphics/wx/TransformationMatrixWx.cpp
index f21dc17..9684a3c 100644
--- a/WebCore/platform/graphics/wx/TransformationMatrixWx.cpp
+++ b/WebCore/platform/graphics/wx/TransformationMatrixWx.cpp
@@ -26,9 +26,9 @@
 #include "config.h"
 #include "TransformationMatrix.h"
 
+#include "Assertions.h"
 #include "FloatRect.h"
 #include "IntRect.h"
-#include "NotImplemented.h"
 
 #include <stdio.h>
 #include <wx/defs.h>
diff --git a/WebCore/platform/gtk/ContextMenuItemGtk.cpp b/WebCore/platform/gtk/ContextMenuItemGtk.cpp
index cf34640..aaec206 100644
--- a/WebCore/platform/gtk/ContextMenuItemGtk.cpp
+++ b/WebCore/platform/gtk/ContextMenuItemGtk.cpp
@@ -56,10 +56,8 @@
         return GTK_STOCK_PASTE;
     case ContextMenuItemTagDelete:
         return GTK_STOCK_DELETE;
-#if GTK_CHECK_VERSION(2, 10, 0)
     case ContextMenuItemTagSelectAll:
         return GTK_STOCK_SELECT_ALL;
-#endif
     case ContextMenuItemTagSpellingGuess:
         return GTK_STOCK_INFO;
     case ContextMenuItemTagIgnoreSpelling:
diff --git a/WebCore/platform/gtk/CursorGtk.cpp b/WebCore/platform/gtk/CursorGtk.cpp
index 76f6d00..115760e 100644
--- a/WebCore/platform/gtk/CursorGtk.cpp
+++ b/WebCore/platform/gtk/CursorGtk.cpp
@@ -28,7 +28,6 @@
 #include "config.h"
 #include "CursorGtk.h"
 
-#include "NotImplemented.h"
 #include <wtf/Assertions.h>
 
 #include <gdk/gdk.h>
@@ -63,7 +62,13 @@
 
 Cursor::Cursor(Image*, const IntPoint&)
 {
-    notImplemented();
+    // FIXME: We don't support images for cursors yet.
+    // This is just a placeholder to avoid crashes.
+    Cursor other(crossCursor());
+    m_impl = other.m_impl;
+
+    if (m_impl)
+        gdk_cursor_ref(m_impl);
 }
 
 Cursor::~Cursor()
@@ -204,13 +209,13 @@
 
 const Cursor& columnResizeCursor()
 {
-    static Cursor c = gdk_cursor_new(GDK_DOUBLE_ARROW);
+    static Cursor c = gdk_cursor_new(GDK_SB_H_DOUBLE_ARROW);
     return c;
 }
 
 const Cursor& rowResizeCursor()
 {
-    static Cursor c = gdk_cursor_new(GDK_DOUBLE_ARROW);
+    static Cursor c = gdk_cursor_new(GDK_SB_V_DOUBLE_ARROW);
     return c;
 }
     
@@ -268,8 +273,8 @@
 
 const Cursor& cellCursor()
 {
-    notImplemented();
-    return pointerCursor();
+    static Cursor c = gdk_cursor_new(GDK_PLUS);
+    return c;
 }
 
 const Cursor& contextMenuCursor()
@@ -280,8 +285,8 @@
 
 const Cursor& noDropCursor()
 {
-    notImplemented();
-    return pointerCursor();
+    static Cursor c = customCursorNew(CustomCursorNoDrop);
+    return c;
 }
 
 const Cursor& copyCursor()
@@ -292,8 +297,8 @@
 
 const Cursor& progressCursor()
 {
-    notImplemented();
-    return pointerCursor();
+    static Cursor c = customCursorNew(CustomCursorProgress);
+    return c;
 }
 
 const Cursor& aliasCursor()
@@ -304,14 +309,13 @@
 
 const Cursor& noneCursor()
 {
-    notImplemented();
-    return pointerCursor();
+    static Cursor c = customCursorNew(CustomCursorNone);
+    return c;
 }
 
 const Cursor& notAllowedCursor()
 {
-    notImplemented();
-    return pointerCursor();
+    return noDropCursor();
 }
 
 const Cursor& zoomInCursor()
@@ -328,14 +332,14 @@
 
 const Cursor& grabCursor()
 {
-    notImplemented();
-    return pointerCursor();
+    static Cursor c = customCursorNew(CustomCursorGrab);
+    return c;
 }
 
 const Cursor& grabbingCursor()
 {
-    notImplemented();
-    return pointerCursor();
+    static Cursor c = customCursorNew(CustomCursorGrabbing);
+    return c;
 }
 
 }
diff --git a/WebCore/platform/gtk/CursorGtk.h b/WebCore/platform/gtk/CursorGtk.h
index 73f05a9..85aaefa 100644
--- a/WebCore/platform/gtk/CursorGtk.h
+++ b/WebCore/platform/gtk/CursorGtk.h
@@ -1,23 +1,40 @@
-/*
- * Copyright (C) 2001 Tim Copperfield <timecop@network.email.ne.jp>
- * Copyright (C) 2007 Christian Dywan <christian@twotoasts.de>
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
  *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
  *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
+ * The Original Code is mozilla.org code.
  *
- */
+ * The Initial Developer of the Original Code is
+ * Tim Copperfield.
+ * Portions created by the Initial Developer are Copyright (C) 2001
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Tim Copperfield <timecop@network.email.ne.jp>
+ *   Christian Dywan <christian@twotoasts.de>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
 
 #ifndef CursorGtk_h
 #define CursorGtk_h
@@ -191,31 +208,176 @@
   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 
+/* MOZ_CURSOR_NOT_ALLOWED */
+static const char moz_not_allowed_bits[] = {
+  0x00, 0x00, 0x00, 0x00, 0x80, 0x1f, 0x00, 0x00, 0xe0, 0x7f, 0x00, 0x00,
+  0xf0, 0xf0, 0x00, 0x00, 0x38, 0xc0, 0x01, 0x00, 0x7c, 0x80, 0x03, 0x00,
+  0xec, 0x00, 0x03, 0x00, 0xce, 0x01, 0x07, 0x00, 0x86, 0x03, 0x06, 0x00,
+  0x06, 0x07, 0x06, 0x00, 0x06, 0x0e, 0x06, 0x00, 0x06, 0x1c, 0x06, 0x00,
+  0x0e, 0x38, 0x07, 0x00, 0x0c, 0x70, 0x03, 0x00, 0x1c, 0xe0, 0x03, 0x00,
+  0x38, 0xc0, 0x01, 0x00, 0xf0, 0xf0, 0x00, 0x00, 0xe0, 0x7f, 0x00, 0x00,
+  0x80, 0x1f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+static const char moz_not_allowed_mask_bits[] = {
+  0x80, 0x1f, 0x00, 0x00, 0xe0, 0x7f, 0x00, 0x00, 0xf0, 0xff, 0x00, 0x00,
+  0xf8, 0xff, 0x01, 0x00, 0xfc, 0xf0, 0x03, 0x00, 0xfe, 0xc0, 0x07, 0x00,
+  0xfe, 0x81, 0x07, 0x00, 0xff, 0x83, 0x0f, 0x00, 0xcf, 0x07, 0x0f, 0x00,
+  0x8f, 0x0f, 0x0f, 0x00, 0x0f, 0x1f, 0x0f, 0x00, 0x0f, 0x3e, 0x0f, 0x00,
+  0x1f, 0xfc, 0x0f, 0x00, 0x1e, 0xf8, 0x07, 0x00, 0x3e, 0xf0, 0x07, 0x00,
+  0xfc, 0xf0, 0x03, 0x00, 0xf8, 0xff, 0x01, 0x00, 0xf0, 0xff, 0x00, 0x00,
+  0xe0, 0x7f, 0x00, 0x00, 0x80, 0x1f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+/* MOZ_CURSOR_SPINNING */
+static const char moz_spinning_bits[] = {
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
+  0x0c, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x00,
+  0x7c, 0x00, 0x00, 0x00, 0xfc, 0x00, 0x00, 0x00, 0xfc, 0x01, 0x00, 0x00,
+  0xfc, 0x3b, 0x00, 0x00, 0x7c, 0x38, 0x00, 0x00, 0x6c, 0x54, 0x00, 0x00,
+  0xc4, 0xdc, 0x00, 0x00, 0xc0, 0x44, 0x00, 0x00, 0x80, 0x39, 0x00, 0x00,
+  0x80, 0x39, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+static const char moz_spinning_mask_bits[] = {
+  0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00,
+  0x1e, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x00, 0x7e, 0x00, 0x00, 0x00,
+  0xfe, 0x00, 0x00, 0x00, 0xfe, 0x01, 0x00, 0x00, 0xfe, 0x3b, 0x00, 0x00,
+  0xfe, 0x7f, 0x00, 0x00, 0xfe, 0x7f, 0x00, 0x00, 0xfe, 0xfe, 0x00, 0x00,
+  0xee, 0xff, 0x01, 0x00, 0xe4, 0xff, 0x00, 0x00, 0xc0, 0x7f, 0x00, 0x00,
+  0xc0, 0x7f, 0x00, 0x00, 0x80, 0x39, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+/* MOZ_CURSOR_NONE */
+static const char moz_none_bits[] = {
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+static const char moz_none_mask_bits[] = {
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+/* MOZ_CURSOR_HAND_GRAB */
+static const char moz_hand_grab_bits[] = {
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00,
+  0x60, 0x39, 0x00, 0x00, 0x90, 0x49, 0x00, 0x00, 0x90, 0x49, 0x01, 0x00,
+  0x20, 0xc9, 0x02, 0x00, 0x20, 0x49, 0x02, 0x00, 0x58, 0x40, 0x02, 0x00,
+  0x64, 0x00, 0x02, 0x00, 0x44, 0x00, 0x01, 0x00, 0x08, 0x00, 0x01, 0x00,
+  0x10, 0x00, 0x01, 0x00, 0x10, 0x80, 0x00, 0x00, 0x20, 0x80, 0x00, 0x00,
+  0x40, 0x40, 0x00, 0x00, 0x80, 0x40, 0x00, 0x00, 0x80, 0x40, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+static const char moz_hand_grab_mask_bits[] = {
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x60, 0x3f, 0x00, 0x00,
+  0xf0, 0x7f, 0x00, 0x00, 0xf8, 0xff, 0x01, 0x00, 0xf8, 0xff, 0x03, 0x00,
+  0xf0, 0xff, 0x07, 0x00, 0xf8, 0xff, 0x07, 0x00, 0xfc, 0xff, 0x07, 0x00,
+  0xfe, 0xff, 0x07, 0x00, 0xfe, 0xff, 0x03, 0x00, 0xfc, 0xff, 0x03, 0x00,
+  0xf8, 0xff, 0x03, 0x00, 0xf8, 0xff, 0x01, 0x00, 0xf0, 0xff, 0x01, 0x00,
+  0xe0, 0xff, 0x00, 0x00, 0xc0, 0xff, 0x00, 0x00, 0xc0, 0xff, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+/* MOZ_CURSOR_HAND_GRABBING */
+static const char moz_hand_grabbing_bits[] = {
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0xc0, 0x36, 0x00, 0x00, 0x20, 0xc9, 0x00, 0x00, 0x20, 0x40, 0x01, 0x00,
+  0x40, 0x00, 0x01, 0x00, 0x60, 0x00, 0x01, 0x00, 0x10, 0x00, 0x01, 0x00,
+  0x10, 0x00, 0x01, 0x00, 0x10, 0x80, 0x00, 0x00, 0x20, 0x80, 0x00, 0x00,
+  0x40, 0x40, 0x00, 0x00, 0x80, 0x40, 0x00, 0x00, 0x80, 0x40, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+static const  char moz_hand_grabbing_mask_bits[] = {
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x36, 0x00, 0x00,
+  0xe0, 0xff, 0x00, 0x00, 0xf0, 0xff, 0x01, 0x00, 0xf0, 0xff, 0x03, 0x00,
+  0xe0, 0xff, 0x03, 0x00, 0xf0, 0xff, 0x03, 0x00, 0xf8, 0xff, 0x03, 0x00,
+  0xf8, 0xff, 0x03, 0x00, 0xf8, 0xff, 0x01, 0x00, 0xf0, 0xff, 0x01, 0x00,
+  0xe0, 0xff, 0x00, 0x00, 0xc0, 0xff, 0x00, 0x00, 0xc0, 0x7f, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
 enum CustomCursorType {
-  CustomCursorCopy = 0,
-  CustomCursorAlias,
-  CustomCursorContextMenu,
-  CustomCursorZoomIn,
-  CustomCursorZoomOut,
-  CustomCursorVerticalText
-} ;
+    CustomCursorCopy = 0,
+    CustomCursorAlias,
+    CustomCursorContextMenu,
+    CustomCursorZoomIn,
+    CustomCursorZoomOut,
+    CustomCursorVerticalText,
+    CustomCursorNoDrop,
+    CustomCursorProgress,
+    CustomCursorNone,
+    CustomCursorGrab,
+    CustomCursorGrabbing,
+};
 
 typedef struct {
-  const char* name;
-  const char* bits;
-  const char* mask_bits;
-  int hot_x;
-  int hot_y;
+    const char* name;
+    const char* bits;
+    const char* mask_bits;
+    int hot_x;
+    int hot_y;
 } CustomCursor;
 
 // create custom pixmap cursor from cursors in nsGTKCursorData.h
 static const CustomCursor CustomCursors[] = {
-  { "copy", moz_copy_bits, moz_copy_mask_bits, 2, 2 },
-  { "alias", moz_alias_bits, moz_alias_mask_bits, 2, 2 },
-  { "context-menu", moz_menu_bits, moz_menu_mask_bits, 2, 2 },
-  { "zoom-in", moz_zoom_in_bits, moz_zoom_in_mask_bits, 6, 6 },
-  { "zoom-out", moz_zoom_out_bits, moz_zoom_out_mask_bits, 6, 6 },
-  { "vertical-text", moz_vertical_text_bits, moz_vertical_text_mask_bits, 8, 4 },
+    { "copy", moz_copy_bits, moz_copy_mask_bits, 2, 2 },
+    { "alias", moz_alias_bits, moz_alias_mask_bits, 2, 2 },
+    { "context-menu", moz_menu_bits, moz_menu_mask_bits, 2, 2 },
+    { "zoom-in", moz_zoom_in_bits, moz_zoom_in_mask_bits, 6, 6 },
+    { "zoom-out", moz_zoom_out_bits, moz_zoom_out_mask_bits, 6, 6 },
+    { "vertical-text", moz_vertical_text_bits, moz_vertical_text_mask_bits, 8, 4 },
+    { "dnd-no-drop", moz_not_allowed_bits, moz_not_allowed_mask_bits, 9,  9 },
+    { "progress", moz_spinning_bits, moz_spinning_mask_bits, 2,  2},
+    { "none", moz_none_bits, moz_none_mask_bits, 0, 0 },
+    { "grab", moz_hand_grab_bits, moz_hand_grab_mask_bits, 10, 10 },
+    { "grabbing", moz_hand_grabbing_bits, moz_hand_grabbing_mask_bits, 10, 10 }
 };
 
 #endif // CursorGtk_h
diff --git a/WebCore/platform/gtk/FileChooserGtk.cpp b/WebCore/platform/gtk/FileChooserGtk.cpp
index e984718..a25d88b 100644
--- a/WebCore/platform/gtk/FileChooserGtk.cpp
+++ b/WebCore/platform/gtk/FileChooserGtk.cpp
@@ -34,7 +34,6 @@
 #include "StringTruncator.h"
 
 #include <glib.h>
-#include <glib/gi18n.h>
 #include <gtk/gtk.h>
 
 namespace WebCore {
diff --git a/WebCore/platform/gtk/FileSystemGtk.cpp b/WebCore/platform/gtk/FileSystemGtk.cpp
index 94e06db..fcdc863 100644
--- a/WebCore/platform/gtk/FileSystemGtk.cpp
+++ b/WebCore/platform/gtk/FileSystemGtk.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Holger Hans Peter Freyther
+ * Copyright (C) 2007, 2009 Holger Hans Peter Freyther
  * Copyright (C) 2008 Collabora, Ltd.
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
@@ -22,8 +22,7 @@
 #include "config.h"
 #include "FileSystem.h"
 
-#include "guriescape.h"
-#include "NotImplemented.h"
+#include "GOwnPtr.h"
 #include "PlatformString.h"
 #include "CString.h"
 
@@ -180,6 +179,9 @@
 
 String pathGetFileName(const String& pathName)
 {
+    if (pathName.isEmpty())
+        return pathName;
+
     char* tmpFilename = filenameFromString(pathName);
     char* baseName = g_path_get_basename(tmpFilename);
     String fileName = String::fromUTF8(baseName);
@@ -191,8 +193,10 @@
 
 String directoryName(const String& path)
 {
-    notImplemented();
-    return String();
+    /* No null checking needed */
+    GOwnPtr<char> tmpFilename(filenameFromString(path));
+    GOwnPtr<char> dirname(g_path_get_dirname(tmpFilename.get()));
+    return String::fromUTF8(dirname.get());
 }
 
 Vector<String> listDirectory(const String& path, const String& filter)
diff --git a/WebCore/platform/gtk/GeolocationServiceGtk.cpp b/WebCore/platform/gtk/GeolocationServiceGtk.cpp
index cc69d44..fc15833 100644
--- a/WebCore/platform/gtk/GeolocationServiceGtk.cpp
+++ b/WebCore/platform/gtk/GeolocationServiceGtk.cpp
@@ -181,8 +181,8 @@
     m_lastError = 0;
 
     RefPtr<Coordinates> coordinates = Coordinates::create(m_latitude, m_longitude,
-                                                          m_altitude, m_accuracy,
-                                                          m_altitudeAccuracy, 0.0, 0.0);
+                                                          true, m_altitude, m_accuracy,
+                                                          true, m_altitudeAccuracy, false, 0.0, false, 0.0);
     m_lastPosition = Geoposition::create(coordinates.release(), m_timestamp * 1000.0);
     positionChanged();
 }
diff --git a/WebCore/platform/gtk/GtkPluginWidget.cpp b/WebCore/platform/gtk/GtkPluginWidget.cpp
new file mode 100644
index 0000000..bc2dd92
--- /dev/null
+++ b/WebCore/platform/gtk/GtkPluginWidget.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2009 Holger Hans Peter Freyther
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GtkPluginWidget.h"
+
+#include "GraphicsContext.h"
+#include "ScrollView.h"
+
+#include <gtk/gtk.h>
+
+namespace WebCore {
+
+GtkPluginWidget::GtkPluginWidget(GtkWidget* widget)
+    : Widget(widget)
+{
+    gtk_widget_hide(widget);
+}
+
+void GtkPluginWidget::invalidateRect(const IntRect& _rect)
+{
+    /* no need to */
+    if (GTK_WIDGET_NO_WINDOW(platformWidget()))
+        return;
+
+    GdkWindow* window = platformWidget()->window;
+    if (!window)
+        return;
+
+    GdkRectangle rect = _rect;
+    gdk_window_invalidate_rect(window, &rect, FALSE);
+}
+
+void GtkPluginWidget::frameRectsChanged()
+{
+    IntRect rect = frameRect();
+    IntPoint loc = parent()->contentsToWindow(rect.location());
+    GtkAllocation allocation = { loc.x(), loc.y(), rect.width(), rect.height() };
+
+    gtk_widget_set_size_request(platformWidget(), rect.width(), rect.height());
+    gtk_widget_size_allocate(platformWidget(), &allocation);
+    gtk_widget_show(platformWidget());
+}
+
+void GtkPluginWidget::paint(GraphicsContext* context, const IntRect& rect)
+{
+    if (!context->gdkExposeEvent())
+        return;
+
+    /* only paint widgets with NO_WINDOW this way */
+    if (!GTK_WIDGET_NO_WINDOW(platformWidget()))
+        return;
+
+    GtkWidget* widget = platformWidget();
+    ASSERT(GTK_WIDGET_NO_WINDOW(widget));
+
+    GdkEvent* event = gdk_event_new(GDK_EXPOSE);
+    event->expose = *context->gdkExposeEvent();
+    event->expose.area = static_cast<GdkRectangle>(rect);
+
+    IntPoint loc = parent()->contentsToWindow(rect.location());
+
+    event->expose.area.x = loc.x();
+    event->expose.area.y = loc.y();
+
+    event->expose.region = gdk_region_rectangle(&event->expose.area);
+
+    /*
+     * This will be unref'ed by gdk_event_free.
+     */
+    g_object_ref(event->expose.window);
+
+    /*
+     * If we are going to paint do the translation and GtkAllocation manipulation.
+     */
+    if (!gdk_region_empty(event->expose.region))
+        gtk_widget_send_expose(widget, event);
+
+    gdk_event_free(event);
+}
+
+}
diff --git a/WebCore/platform/network/cf/ResourceResponseCFNet.h b/WebCore/platform/gtk/GtkPluginWidget.h
similarity index 76%
rename from WebCore/platform/network/cf/ResourceResponseCFNet.h
rename to WebCore/platform/gtk/GtkPluginWidget.h
index 27144c6..cad3462 100644
--- a/WebCore/platform/network/cf/ResourceResponseCFNet.h
+++ b/WebCore/platform/gtk/GtkPluginWidget.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Holger Hans Peter Freyther
+ * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,20 +21,22 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ResourceResponseCFNet_h
-#define ResourceResponseCFNet_h
+#ifndef GtkPluginWidget_h
+#define GtkPluginWidget_h
 
-typedef struct _CFURLResponse* CFURLResponseRef;
+#include "Widget.h"
 
 namespace WebCore {
-
-    class ResourceResponse;
-
-    void getResourceResponse(ResourceResponse& response, CFURLResponseRef cfResponse);
-
+    class GtkPluginWidget : public Widget {
+    public:
+        GtkPluginWidget(GtkWidget*);
+        void invalidateRect(const IntRect&);
+        void frameRectsChanged();
+        void paint(GraphicsContext*, const IntRect&);
+    };
 }
 
-#endif // ResourceResponseCFNet_h
+#endif
diff --git a/WebCore/platform/gtk/KeyEventGtk.cpp b/WebCore/platform/gtk/KeyEventGtk.cpp
index e0742f4..5875547 100644
--- a/WebCore/platform/gtk/KeyEventGtk.cpp
+++ b/WebCore/platform/gtk/KeyEventGtk.cpp
@@ -37,9 +37,6 @@
 #include <gdk/gdk.h>
 #include <gdk/gdkkeysyms.h>
 
-// GTK_CHECK_VERSION is defined in gtk/gtkversion.h
-#include <gtk/gtk.h>
-
 namespace WebCore {
 
 // FIXME: This is incomplete.  We should change this to mirror
@@ -260,9 +257,10 @@
         case GDK_Help:
             return VK_HELP; // (2F) HELP key
         case GDK_0:
-        case GDK_parenleft:
+        case GDK_parenright:
             return VK_0;    //  (30) 0) key
         case GDK_1:
+        case GDK_exclam:
             return VK_1; //  (31) 1 ! key
         case GDK_2:
         case GDK_at:
@@ -286,7 +284,7 @@
         case GDK_asterisk:
             return VK_8; //  (38) 8 key  '*'
         case GDK_9:
-        case GDK_parenright:
+        case GDK_parenleft:
             return VK_9; //  (39) 9 key '('
         case GDK_a:
         case GDK_A:
@@ -536,12 +534,7 @@
     , m_shiftKey((event->state & GDK_SHIFT_MASK) || (event->keyval == GDK_3270_BackTab))
     , m_ctrlKey(event->state & GDK_CONTROL_MASK)
     , m_altKey(event->state & GDK_MOD1_MASK)
-#if GTK_CHECK_VERSION(2,10,0)
     , m_metaKey(event->state & GDK_META_MASK)
-#else
-    // GDK_MOD2_MASK doesn't always mean meta so we can't use it
-    , m_metaKey(false)
-#endif
     , m_gdkEventKey(event)
 {
 }
diff --git a/WebCore/platform/gtk/KeyboardCodes.h b/WebCore/platform/gtk/KeyboardCodes.h
deleted file mode 100644
index 3ad1243..0000000
--- a/WebCore/platform/gtk/KeyboardCodes.h
+++ /dev/null
@@ -1,543 +0,0 @@
-/*
- * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef KeyboardCodes_h
-#define KeyboardCodes_h
-
-namespace WebCore {
-
-// VK_LBUTTON (01) Left mouse button
-// VK_RBUTTON (02) Right mouse button
-// VK_CANCEL (03) Control-break processing
-// VK_MBUTTON (04) Middle mouse button (three-button mouse)
-// VK_XBUTTON1 (05)
-// VK_XBUTTON2 (06)
-
-// VK_BACK (08) BACKSPACE key
-const int VK_BACK = 0x08;
-
-// VK_TAB (09) TAB key
-const int VK_TAB = 0x09;
-
-// VK_CLEAR (0C) CLEAR key
-const int VK_CLEAR = 0x0C;
-
-// VK_RETURN (0D)
-const int VK_RETURN = 0x0D;
-
-// VK_SHIFT (10) SHIFT key
-const int VK_SHIFT = 0x10;
-
-// VK_CONTROL (11) CTRL key
-const int VK_CONTROL = 0x11;
-
-// VK_MENU (12) ALT key
-const int VK_MENU = 0x12;
-
-// VK_PAUSE (13) PAUSE key
-const int VK_PAUSE = 0x13;
-
-// VK_CAPITAL (14) CAPS LOCK key
-const int VK_CAPITAL = 0x14;
-
-// VK_KANA (15) Input Method Editor (IME) Kana mode
-const int VK_KANA = 0x15;
-
-// VK_HANGUEL (15) IME Hanguel mode (maintained for compatibility; use VK_HANGUL)
-// VK_HANGUL (15) IME Hangul mode
-const int VK_HANGUL = 0x15;
-
-// VK_JUNJA (17) IME Junja mode
-const int VK_JUNJA = 0x17;
-
-// VK_FINAL (18) IME final mode
-const int VK_FINAL = 0x18;
-
-// VK_HANJA (19) IME Hanja mode
-const int VK_HANJA = 0x19;
-
-// VK_KANJI (19) IME Kanji mode
-const int VK_KANJI = 0x19;
-
-// VK_ESCAPE (1B) ESC key
-const int VK_ESCAPE = 0x1B;
-
-// VK_CONVERT (1C) IME convert
-const int VK_CONVERT = 0x1C;
-
-// VK_NONCONVERT (1D) IME nonconvert
-const int VK_NONCONVERT = 0x1D;
-
-// VK_ACCEPT (1E) IME accept
-const int VK_ACCEPT = 0x1E;
-
-// VK_MODECHANGE (1F) IME mode change request
-const int VK_MODECHANGE = 0x1F;
-
-// VK_SPACE (20) SPACEBAR
-const int VK_SPACE = 0x20;
-
-// VK_PRIOR (21) PAGE UP key
-const int VK_PRIOR = 0x21;
-
-// VK_NEXT (22) PAGE DOWN key
-const int VK_NEXT = 0x22;
-
-// VK_END (23) END key
-const int VK_END = 0x23;
-
-// VK_HOME (24) HOME key
-const int VK_HOME = 0x24;
-
-// VK_LEFT (25) LEFT ARROW key
-const int VK_LEFT = 0x25;
-
-// VK_UP (26) UP ARROW key
-const int VK_UP = 0x26;
-
-// VK_RIGHT (27) RIGHT ARROW key
-const int VK_RIGHT = 0x27;
-
-// VK_DOWN (28) DOWN ARROW key
-const int VK_DOWN = 0x28;
-
-// VK_SELECT (29) SELECT key
-const int VK_SELECT = 0x29;
-
-// VK_PRINT (2A) PRINT key
-const int VK_PRINT = 0x2A;
-
-// VK_EXECUTE (2B) EXECUTE key
-const int VK_EXECUTE = 0x2B;
-
-// VK_SNAPSHOT (2C) PRINT SCREEN key
-const int VK_SNAPSHOT = 0x2C;
-
-// VK_INSERT (2D) INS key
-const int VK_INSERT = 0x2D;
-
-// VK_DELETE (2E) DEL key
-const int VK_DELETE = 0x2E;
-
-// VK_HELP (2F) HELP key
-const int VK_HELP = 0x2F;
-
-// (30) 0 key
-const int VK_0 = 0x30;
-
-// (31) 1 key
-const int VK_1 = 0x31;
-
-// (32) 2 key
-const int VK_2 = 0x32;
-
-// (33) 3 key
-const int VK_3 = 0x33;
-
-// (34) 4 key
-const int VK_4 = 0x34;
-
-// (35) 5 key;
-
-const int VK_5 = 0x35;
-
-// (36) 6 key
-const int VK_6 = 0x36;
-
-// (37) 7 key
-const int VK_7 = 0x37;
-
-// (38) 8 key
-const int VK_8 = 0x38;
-
-// (39) 9 key
-const int VK_9 = 0x39;
-
-// (41) A key
-const int VK_A = 0x41;
-
-// (42) B key
-const int VK_B = 0x42;
-
-// (43) C key
-const int VK_C = 0x43;
-
-// (44) D key
-const int VK_D = 0x44;
-
-// (45) E key
-const int VK_E = 0x45;
-
-// (46) F key
-const int VK_F = 0x46;
-
-// (47) G key
-const int VK_G = 0x47;
-
-// (48) H key
-const int VK_H = 0x48;
-
-// (49) I key
-const int VK_I = 0x49;
-
-// (4A) J key
-const int VK_J = 0x4A;
-
-// (4B) K key
-const int VK_K = 0x4B;
-
-// (4C) L key
-const int VK_L = 0x4C;
-
-// (4D) M key
-const int VK_M = 0x4D;
-
-// (4E) N key
-const int VK_N = 0x4E;
-
-// (4F) O key
-const int VK_O = 0x4F;
-
-// (50) P key
-const int VK_P = 0x50;
-
-// (51) Q key
-const int VK_Q = 0x51;
-
-// (52) R key
-const int VK_R = 0x52;
-
-// (53) S key
-const int VK_S = 0x53;
-
-// (54) T key
-const int VK_T = 0x54;
-
-// (55) U key
-const int VK_U = 0x55;
-
-// (56) V key
-const int VK_V = 0x56;
-
-// (57) W key
-const int VK_W = 0x57;
-
-// (58) X key
-const int VK_X = 0x58;
-
-// (59) Y key
-const int VK_Y = 0x59;
-
-// (5A) Z key
-const int VK_Z = 0x5A;
-
-// VK_LWIN (5B) Left Windows key (Microsoft Natural keyboard)
-const int VK_LWIN = 0x5B;
-
-// VK_RWIN (5C) Right Windows key (Natural keyboard)
-const int VK_RWIN = 0x5C;
-
-// VK_APPS (5D) Applications key (Natural keyboard)
-const int VK_APPS = 0x5D;
-
-// VK_SLEEP (5F) Computer Sleep key
-const int VK_SLEEP = 0x5F;
-
-// VK_NUMPAD0 (60) Numeric keypad 0 key
-const int VK_NUMPAD0 = 0x60;
-
-// VK_NUMPAD1 (61) Numeric keypad 1 key
-const int VK_NUMPAD1 = 0x61;
-
-// VK_NUMPAD2 (62) Numeric keypad 2 key
-const int VK_NUMPAD2 = 0x62;
-
-// VK_NUMPAD3 (63) Numeric keypad 3 key
-const int VK_NUMPAD3 = 0x63;
-
-// VK_NUMPAD4 (64) Numeric keypad 4 key
-const int VK_NUMPAD4 = 0x64;
-
-// VK_NUMPAD5 (65) Numeric keypad 5 key
-const int VK_NUMPAD5 = 0x65;
-
-// VK_NUMPAD6 (66) Numeric keypad 6 key
-const int VK_NUMPAD6 = 0x66;
-
-// VK_NUMPAD7 (67) Numeric keypad 7 key
-const int VK_NUMPAD7 = 0x67;
-
-// VK_NUMPAD8 (68) Numeric keypad 8 key
-const int VK_NUMPAD8 = 0x68;
-
-// VK_NUMPAD9 (69) Numeric keypad 9 key
-const int VK_NUMPAD9 = 0x69;
-
-// VK_MULTIPLY (6A) Multiply key
-const int VK_MULTIPLY = 0x6A;
-
-// VK_ADD (6B) Add key
-const int VK_ADD = 0x6B;
-
-// VK_SEPARATOR (6C) Separator key
-const int VK_SEPARATOR = 0x6C;
-
-// VK_SUBTRACT (6D) Subtract key
-const int VK_SUBTRACT = 0x6D;
-
-// VK_DECIMAL (6E) Decimal key
-const int VK_DECIMAL = 0x6E;
-
-// VK_DIVIDE (6F) Divide key
-const int VK_DIVIDE = 0x6F;
-
-// VK_F1 (70) F1 key
-const int VK_F1 = 0x70;
-
-// VK_F2 (71) F2 key
-const int VK_F2 = 0x71;
-
-// VK_F3 (72) F3 key
-const int VK_F3 = 0x72;
-
-// VK_F4 (73) F4 key
-const int VK_F4 = 0x73;
-
-// VK_F5 (74) F5 key
-const int VK_F5 = 0x74;
-
-// VK_F6 (75) F6 key
-const int VK_F6 = 0x75;
-
-// VK_F7 (76) F7 key
-const int VK_F7 = 0x76;
-
-// VK_F8 (77) F8 key
-const int VK_F8 = 0x77;
-
-// VK_F9 (78) F9 key
-const int VK_F9 = 0x78;
-
-// VK_F10 (79) F10 key
-const int VK_F10 = 0x79;
-
-// VK_F11 (7A) F11 key
-const int VK_F11 = 0x7A;
-
-// VK_F12 (7B) F12 key
-const int VK_F12 = 0x7B;
-
-// VK_F13 (7C) F13 key
-const int VK_F13 = 0x7C;
-
-// VK_F14 (7D) F14 key
-const int VK_F14 = 0x7D;
-
-// VK_F15 (7E) F15 key
-const int VK_F15 = 0x7E;
-
-// VK_F16 (7F) F16 key
-const int VK_F16 = 0x7F;
-
-// VK_F17 (80H) F17 key
-const int VK_F17 = 0x80;
-
-// VK_F18 (81H) F18 key
-const int VK_F18 = 0x81;
-
-// VK_F19 (82H) F19 key
-const int VK_F19 = 0x82;
-
-// VK_F20 (83H) F20 key
-const int VK_F20 = 0x83;
-
-// VK_F21 (84H) F21 key
-const int VK_F21 = 0x84;
-
-// VK_F22 (85H) F22 key
-const int VK_F22 = 0x85;
-
-// VK_F23 (86H) F23 key
-const int VK_F23 = 0x86;
-
-// VK_F24 (87H) F24 key
-const int VK_F24 = 0x87;
-
-// VK_NUMLOCK (90) NUM LOCK key
-const int VK_NUMLOCK = 0x90;
-
-// VK_SCROLL (91) SCROLL LOCK key
-const int VK_SCROLL = 0x91;
-
-// VK_LSHIFT (A0) Left SHIFT key
-const int VK_LSHIFT = 0xA0;
-
-// VK_RSHIFT (A1) Right SHIFT key
-const int VK_RSHIFT = 0xA1;
-
-// VK_LCONTROL (A2) Left CONTROL key
-const int VK_LCONTROL = 0xA2;
-
-// VK_RCONTROL (A3) Right CONTROL key
-const int VK_RCONTROL = 0xA3;
-
-// VK_LMENU (A4) Left MENU key
-const int VK_LMENU = 0xA4;
-
-// VK_RMENU (A5) Right MENU key
-const int VK_RMENU = 0xA5;
-
-// VK_BROWSER_BACK (A6) Windows 2000/XP: Browser Back key
-const int VK_BROWSER_BACK = 0xA6;
-
-// VK_BROWSER_FORWARD (A7) Windows 2000/XP: Browser Forward key
-const int VK_BROWSER_FORWARD = 0xA7;
-
-// VK_BROWSER_REFRESH (A8) Windows 2000/XP: Browser Refresh key
-const int VK_BROWSER_REFRESH = 0xA8;
-
-// VK_BROWSER_STOP (A9) Windows 2000/XP: Browser Stop key
-const int VK_BROWSER_STOP = 0xA9;
-
-// VK_BROWSER_SEARCH (AA) Windows 2000/XP: Browser Search key
-const int VK_BROWSER_SEARCH = 0xAA;
-
-// VK_BROWSER_FAVORITES (AB) Windows 2000/XP: Browser Favorites key
-const int VK_BROWSER_FAVORITES = 0xAB;
-
-// VK_BROWSER_HOME (AC) Windows 2000/XP: Browser Start and Home key
-const int VK_BROWSER_HOME = 0xAC;
-
-// VK_VOLUME_MUTE (AD) Windows 2000/XP: Volume Mute key
-const int VK_VOLUME_MUTE = 0xAD;
-
-// VK_VOLUME_DOWN (AE) Windows 2000/XP: Volume Down key
-const int VK_VOLUME_DOWN = 0xAE;
-
-// VK_VOLUME_UP (AF) Windows 2000/XP: Volume Up key
-const int VK_VOLUME_UP = 0xAF;
-
-// VK_MEDIA_NEXT_TRACK (B0) Windows 2000/XP: Next Track key
-const int VK_MEDIA_NEXT_TRACK = 0xB0;
-
-// VK_MEDIA_PREV_TRACK (B1) Windows 2000/XP: Previous Track key
-const int VK_MEDIA_PREV_TRACK = 0xB1;
-
-// VK_MEDIA_STOP (B2) Windows 2000/XP: Stop Media key
-const int VK_MEDIA_STOP = 0xB2;
-
-// VK_MEDIA_PLAY_PAUSE (B3) Windows 2000/XP: Play/Pause Media key
-const int VK_MEDIA_PLAY_PAUSE = 0xB3;
-
-// VK_LAUNCH_MAIL (B4) Windows 2000/XP: Start Mail key
-const int VK_MEDIA_LAUNCH_MAIL = 0xB4;
-
-// VK_LAUNCH_MEDIA_SELECT (B5) Windows 2000/XP: Select Media key
-const int VK_MEDIA_LAUNCH_MEDIA_SELECT = 0xB5;
-
-// VK_LAUNCH_APP1 (B6) Windows 2000/XP: Start Application 1 key
-const int VK_MEDIA_LAUNCH_APP1 = 0xB6;
-
-// VK_LAUNCH_APP2 (B7) Windows 2000/XP: Start Application 2 key
-const int VK_MEDIA_LAUNCH_APP2 = 0xB7;
-
-// VK_OEM_1 (BA) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ';:' key
-const int VK_OEM_1 = 0xBA;
-
-// VK_OEM_PLUS (BB) Windows 2000/XP: For any country/region, the '+' key
-const int VK_OEM_PLUS = 0xBB;
-
-// VK_OEM_COMMA (BC) Windows 2000/XP: For any country/region, the ',' key
-const int VK_OEM_COMMA = 0xBC;
-
-// VK_OEM_MINUS (BD) Windows 2000/XP: For any country/region, the '-' key
-const int VK_OEM_MINUS = 0xBD;
-
-// VK_OEM_PERIOD (BE) Windows 2000/XP: For any country/region, the '.' key
-const int VK_OEM_PERIOD = 0xBE;
-
-// VK_OEM_2 (BF) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '/?' key
-const int VK_OEM_2 = 0xBF;
-
-// VK_OEM_3 (C0) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '`~' key
-const int VK_OEM_3 = 0xC0;
-
-// VK_OEM_4 (DB) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '[{' key
-const int VK_OEM_4 = 0xDB;
-
-// VK_OEM_5 (DC) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '\|' key
-const int VK_OEM_5 = 0xDC;
-
-// VK_OEM_6 (DD) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ']}' key
-const int VK_OEM_6 = 0xDD;
-
-// VK_OEM_7 (DE) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the 'single-quote/double-quote' key
-const int VK_OEM_7 = 0xDE;
-
-// VK_OEM_8 (DF) Used for miscellaneous characters; it can vary by keyboard.
-const int VK_OEM_8 = 0xDF;
-
-// VK_OEM_102 (E2) Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard
-const int VK_OEM_102 = 0xE2;
-
-// VK_PROCESSKEY (E5) Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key
-const int VK_PROCESSKEY = 0xE5;
-
-// VK_PACKET (E7) Windows 2000/XP: Used to pass Unicode characters as if they were keystrokes. The VK_PACKET key is the low word of a 32-bit Virtual Key value used for non-keyboard input methods. For more information, see Remark in KEYBDINPUT,SendInput, WM_KEYDOWN, and WM_KEYUP
-const int VK_PACKET = 0xE7;
-
-// VK_ATTN (F6) Attn key
-const int VK_ATTN = 0xF6;
-
-// VK_CRSEL (F7) CrSel key
-const int VK_CRSEL = 0xF7;
-
-// VK_EXSEL (F8) ExSel key
-const int VK_EXSEL = 0xF8;
-
-// VK_EREOF (F9) Erase EOF key
-const int VK_EREOF = 0xF9;
-
-// VK_PLAY (FA) Play key
-const int VK_PLAY = 0xFA;
-
-// VK_ZOOM (FB) Zoom key
-const int VK_ZOOM = 0xFB;
-
-// VK_NONAME (FC) Reserved for future use
-const int VK_NONAME = 0xFC;
-
-// VK_PA1 (FD) PA1 key
-const int VK_PA1 = 0xFD;
-
-// VK_OEM_CLEAR (FE) Clear key
-const int VK_OEM_CLEAR = 0xFE;
-
-const int VK_UNKNOWN = 0;
-
-}
-
-#endif
diff --git a/WebCore/platform/gtk/LocalizedStringsGtk.cpp b/WebCore/platform/gtk/LocalizedStringsGtk.cpp
index 52d4f5f..70e3aff 100644
--- a/WebCore/platform/gtk/LocalizedStringsGtk.cpp
+++ b/WebCore/platform/gtk/LocalizedStringsGtk.cpp
@@ -30,11 +30,14 @@
 #include "config.h"
 
 #include "LocalizedStrings.h"
+#include "CString.h"
+#include "GOwnPtr.h"
+#include "IntSize.h"
 #include "NotImplemented.h"
 #include "PlatformString.h"
 
+#include <glib/gi18n-lib.h>
 #include <gtk/gtk.h>
-#include <glib/gi18n.h>
 
 namespace WebCore {
 
@@ -125,11 +128,7 @@
 
 String contextMenuItemTagSelectAll()
 {
-#if GTK_CHECK_VERSION(2,10,0)
     static String stockLabel = String::fromUTF8(gtkStockLabel(GTK_STOCK_SELECT_ALL));
-#else
-    static String stockLabel = String::fromUTF8(_("Select _All"));
-#endif
     return stockLabel;
 }
 
@@ -339,8 +338,11 @@
 
 String imageTitle(const String& filename, const IntSize& size)
 {
-    notImplemented();
-    return String();
+    GOwnPtr<gchar> string(g_strdup_printf(C_("Title string for images", "%s  (%dx%d pixels)"),
+                                          filename.utf8().data(),
+                                          size.width(), size.height()));
+
+    return String::fromUTF8(string.get());
 }
 
 }
diff --git a/WebCore/platform/gtk/MouseEventGtk.cpp b/WebCore/platform/gtk/MouseEventGtk.cpp
index 2400ebf..69f938f 100644
--- a/WebCore/platform/gtk/MouseEventGtk.cpp
+++ b/WebCore/platform/gtk/MouseEventGtk.cpp
@@ -31,9 +31,6 @@
 
 #include <gdk/gdk.h>
 
-// GTK_CHECK_VERSION is defined in gtk/gtkversion.h
-#include <gtk/gtk.h>
-
 namespace WebCore {
 
 // FIXME: Would be even better to figure out which modifier is Alt instead of always using GDK_MOD1_MASK.
@@ -47,12 +44,7 @@
     m_shiftKey = event->state & GDK_SHIFT_MASK;
     m_ctrlKey = event->state & GDK_CONTROL_MASK;
     m_altKey = event->state & GDK_MOD1_MASK;
-#if GTK_CHECK_VERSION(2,10,0)
     m_metaKey = event->state & GDK_META_MASK;
-#else
-    // GDK_MOD2_MASK doesn't always mean meta so we can't use it
-    m_metaKey = false;
-#endif
 
     switch (event->type) {
     case GDK_BUTTON_PRESS:
diff --git a/WebCore/platform/gtk/PasteboardGtk.cpp b/WebCore/platform/gtk/PasteboardGtk.cpp
index 15a7e64..062ecb8 100644
--- a/WebCore/platform/gtk/PasteboardGtk.cpp
+++ b/WebCore/platform/gtk/PasteboardGtk.cpp
@@ -103,7 +103,6 @@
 void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
     GtkClipboard* clipboard = m_helper->getClipboard(frame);
-#if GTK_CHECK_VERSION(2,10,0)
     gchar* text = g_strdup(frame->selectedText().utf8().data());
     gchar* markup = g_strdup(createMarkup(selectedRange, 0, AnnotateForInterchange).utf8().data());
     PasteboardSelectionData* data = new PasteboardSelectionData(text, markup);
@@ -113,9 +112,6 @@
     gtk_clipboard_set_with_data(clipboard, targets, n_targets,
                                 clipboard_get_contents_cb, clipboard_clear_contents_cb, data);
     gtk_target_table_free(targets, n_targets);
-#else
-    gtk_clipboard_set_text(clipboard, frame->selectedText().utf8().data(), frame->selectedText().utf8().length());
-#endif
 }
 
 void Pasteboard::writeURL(const KURL& url, const String&, Frame* frame)
@@ -124,14 +120,13 @@
         return;
 
     GtkClipboard* clipboard = m_helper->getClipboard(frame);
+    GtkClipboard* primary = m_helper->getPrimary(frame);
     gtk_clipboard_set_text(clipboard, url.string().utf8().data(), url.string().utf8().length());
+    gtk_clipboard_set_text(primary, url.string().utf8().data(), url.string().utf8().length());
 }
 
 void Pasteboard::writeImage(Node* node, const KURL&, const String&)
 {
-    // TODO: Enable this when Image gets GdkPixbuf support
-
-    /*
     GtkClipboard* clipboard = gtk_clipboard_get_for_display(gdk_display_get_default(), GDK_SELECTION_CLIPBOARD);
 
     ASSERT(node && node->renderer() && node->renderer()->isImage());
@@ -141,10 +136,9 @@
     Image* image = cachedImage->image();
     ASSERT(image);
 
-    gtk_clipboard_set_image(clipboard, image->pixbuf());
-    */
-
-    notImplemented();
+    GdkPixbuf* pixbuf = image->getGdkPixbuf();
+    gtk_clipboard_set_image(clipboard, pixbuf);
+    g_object_unref(pixbuf);
 }
 
 void Pasteboard::clear()
@@ -163,12 +157,8 @@
 PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefPtr<Range> context,
                                                           bool allowPlainText, bool& chosePlainText)
 {
-#if GTK_CHECK_VERSION(2,10,0)
     GdkAtom textHtml = gdk_atom_intern_static_string("text/html");
-#else
-    GdkAtom textHtml = gdk_atom_intern("text/html", false);
-#endif
-    GtkClipboard* clipboard = m_helper->getClipboard(frame);
+    GtkClipboard* clipboard = m_helper->getCurrentTarget(frame);
     chosePlainText = false;
 
     if (GtkSelectionData* data = gtk_clipboard_wait_for_contents(clipboard, textHtml)) {
@@ -201,7 +191,7 @@
 
 String Pasteboard::plainText(Frame* frame)
 {
-    GtkClipboard* clipboard = m_helper->getClipboard(frame);
+    GtkClipboard* clipboard = m_helper->getCurrentTarget(frame);
 
     gchar* utf8 = gtk_clipboard_wait_for_text(clipboard);
 
diff --git a/WebCore/platform/gtk/PasteboardHelper.h b/WebCore/platform/gtk/PasteboardHelper.h
index 6bdc05e..9943a2d 100644
--- a/WebCore/platform/gtk/PasteboardHelper.h
+++ b/WebCore/platform/gtk/PasteboardHelper.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007 Luca Bruno <lethalman88@gmail.com>
+ * Copyright (C) 2009 Holger Hans Peter Freyther
  * All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -37,7 +38,9 @@
 public:
     virtual ~PasteboardHelper() {};
 
+    virtual GtkClipboard* getCurrentTarget(Frame*) const = 0;
     virtual GtkClipboard* getClipboard(Frame*) const = 0;
+    virtual GtkClipboard* getPrimary(Frame*) const = 0;
     virtual GtkTargetList* getCopyTargetList(Frame*) const = 0;
     virtual GtkTargetList* getPasteTargetList(Frame*) const = 0;
 };
diff --git a/WebCore/platform/gtk/PlatformScreenGtk.cpp b/WebCore/platform/gtk/PlatformScreenGtk.cpp
index 3512be1..27985ef 100644
--- a/WebCore/platform/gtk/PlatformScreenGtk.cpp
+++ b/WebCore/platform/gtk/PlatformScreenGtk.cpp
@@ -31,7 +31,6 @@
 #include "PlatformScreen.h"
 
 #include "HostWindow.h"
-#include "NotImplemented.h"
 #include "ScrollView.h"
 #include "Widget.h"
 
diff --git a/WebCore/platform/gtk/PopupMenuGtk.cpp b/WebCore/platform/gtk/PopupMenuGtk.cpp
index 54b41ab..121d7b0 100644
--- a/WebCore/platform/gtk/PopupMenuGtk.cpp
+++ b/WebCore/platform/gtk/PopupMenuGtk.cpp
@@ -28,7 +28,6 @@
 #include "CString.h"
 #include "FrameView.h"
 #include "HostWindow.h"
-#include "NotImplemented.h"
 #include "PlatformString.h"
 #include <gtk/gtk.h>
 
@@ -42,8 +41,11 @@
 
 PopupMenu::~PopupMenu()
 {
-    if (m_popup)
+    if (m_popup) {
+        g_signal_handlers_disconnect_matched(m_popup, G_SIGNAL_MATCH_DATA, 0, 0, 0, 0, this);
+        hide();
         g_object_unref(m_popup);
+    }
 }
 
 void PopupMenu::show(const IntRect& rect, FrameView* view, int index)
diff --git a/WebCore/platform/gtk/RenderThemeGtk.cpp b/WebCore/platform/gtk/RenderThemeGtk.cpp
index ee462e0..a95f557 100644
--- a/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -54,6 +54,14 @@
     }
 }
 
+RenderThemeGtk::~RenderThemeGtk()
+{
+    if (mozGtkInitialized) {
+        moz_gtk_shutdown();
+        mozGtkInitialized = false;
+    }
+}
+
 static bool supportsFocus(ControlPart appearance)
 {
     switch (appearance) {
diff --git a/WebCore/platform/gtk/RenderThemeGtk.h b/WebCore/platform/gtk/RenderThemeGtk.h
index 76f7a0a..82a87cb 100644
--- a/WebCore/platform/gtk/RenderThemeGtk.h
+++ b/WebCore/platform/gtk/RenderThemeGtk.h
@@ -36,6 +36,7 @@
 class RenderThemeGtk : public RenderTheme {
 public:
     RenderThemeGtk();
+    virtual ~RenderThemeGtk();
 
     // A method asking if the theme's controls actually care about redrawing when hovered.
     virtual bool supportsHover(const RenderStyle* style) const { return true; }
diff --git a/WebCore/platform/gtk/ScrollViewGtk.cpp b/WebCore/platform/gtk/ScrollViewGtk.cpp
index b3b6dd9..0f066fc 100644
--- a/WebCore/platform/gtk/ScrollViewGtk.cpp
+++ b/WebCore/platform/gtk/ScrollViewGtk.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Computer, Inc. All rights reserved.
  * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
- * Copyright (C) 2007 Holger Hans Peter Freyther
+ * Copyright (C) 2007, 2009 Holger Hans Peter Freyther
  * Copyright (C) 2008 Collabora Ltd.
  *
  * All rights reserved.
@@ -35,7 +35,6 @@
 #include "GraphicsContext.h"
 #include "HostWindow.h"
 #include "IntRect.h"
-#include "NotImplemented.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformWheelEvent.h"
 #include "ScrollbarGtk.h"
@@ -47,28 +46,6 @@
 
 namespace WebCore {
 
-static void adjustmentChanged(GtkAdjustment* adjustment, gpointer _that)
-{
-    ScrollView* that = reinterpret_cast<ScrollView*>(_that);
-
-    // Figure out if we really moved.
-    IntSize newOffset = that->scrollOffset();
-    if (adjustment == that->m_horizontalAdjustment)
-        newOffset.setWidth(static_cast<int>(gtk_adjustment_get_value(adjustment)));
-    else if (adjustment == that->m_verticalAdjustment)
-        newOffset.setHeight(static_cast<int>(gtk_adjustment_get_value(adjustment)));
-
-    IntSize scrollDelta = newOffset - that->scrollOffset();
-    if (scrollDelta == IntSize())
-        return;
-    that->setScrollOffset(newOffset);
-
-    if (that->scrollbarsSuppressed())
-        return;
-
-    that->scrollContents(scrollDelta);
-}
-
 void ScrollView::platformInit()
 {
     m_horizontalAdjustment = 0;
@@ -77,15 +54,18 @@
 
 void ScrollView::platformDestroy()
 {
-    if (m_horizontalAdjustment) {
-        g_signal_handlers_disconnect_by_func(G_OBJECT(m_horizontalAdjustment), (gpointer)adjustmentChanged, this);
-        g_object_unref(m_horizontalAdjustment);
-    }
+    m_horizontalAdjustment = 0;
+    m_verticalAdjustment = 0;
+}
 
-    if (m_verticalAdjustment) {
-        g_signal_handlers_disconnect_by_func(G_OBJECT(m_verticalAdjustment), (gpointer)adjustmentChanged, this);
-        g_object_unref(m_verticalAdjustment);
-    }
+PassRefPtr<Scrollbar> ScrollView::createScrollbar(ScrollbarOrientation orientation)
+{
+    if (orientation == HorizontalScrollbar && m_horizontalAdjustment)
+        return ScrollbarGtk::createScrollbar(this, orientation, m_horizontalAdjustment);
+    else if (orientation == VerticalScrollbar && m_verticalAdjustment)
+        return ScrollbarGtk::createScrollbar(this, orientation, m_verticalAdjustment);
+    else
+        return Scrollbar::createNativeScrollbar(this, orientation, RegularScrollbar);
 }
 
 /*
@@ -96,30 +76,27 @@
 {
     ASSERT(!hadj == !vadj);
 
-    if (m_horizontalAdjustment) {
-        g_signal_handlers_disconnect_by_func(G_OBJECT(m_horizontalAdjustment), (gpointer)adjustmentChanged, this);
-        g_signal_handlers_disconnect_by_func(G_OBJECT(m_verticalAdjustment), (gpointer)adjustmentChanged, this);
-        g_object_unref(m_horizontalAdjustment);
-        g_object_unref(m_verticalAdjustment);
-    }
-
     m_horizontalAdjustment = hadj;
     m_verticalAdjustment = vadj;
 
+    // Reset the adjustments to a sane default
     if (m_horizontalAdjustment) {
-        g_signal_connect(m_horizontalAdjustment, "value-changed", G_CALLBACK(adjustmentChanged), this);
-        g_signal_connect(m_verticalAdjustment, "value-changed", G_CALLBACK(adjustmentChanged), this);
+        m_horizontalAdjustment->lower = 0;
+        m_horizontalAdjustment->upper = 0;
+        m_horizontalAdjustment->value = 0;
+        gtk_adjustment_changed(m_horizontalAdjustment);
+        gtk_adjustment_value_changed(m_horizontalAdjustment);
 
-        /*
-         * disable the scrollbars (if we have any) as the GtkAdjustment over
-         */
-        setHasVerticalScrollbar(false);
-        setHasHorizontalScrollbar(false);
-
-        g_object_ref(m_horizontalAdjustment);
-        g_object_ref(m_verticalAdjustment);
+        m_verticalAdjustment->lower = 0;
+        m_verticalAdjustment->upper = 0;
+        m_verticalAdjustment->value = 0;
+        gtk_adjustment_changed(m_verticalAdjustment);
+        gtk_adjustment_value_changed(m_verticalAdjustment);
     }
 
+    /* reconsider having a scrollbar */
+    setHasVerticalScrollbar(false);
+    setHasHorizontalScrollbar(false);
     updateScrollbars(m_scrollOffset);
 }
 
@@ -144,52 +121,4 @@
         gtk_container_remove(GTK_CONTAINER(parent), child->platformWidget());
 }
 
-bool ScrollView::platformHandleHorizontalAdjustment(const IntSize& scroll)
-{
-    if (m_horizontalAdjustment) {
-        m_horizontalAdjustment->page_size = visibleWidth();
-        m_horizontalAdjustment->step_increment = visibleWidth() / 10.0;
-        m_horizontalAdjustment->page_increment = visibleWidth() * 0.9;
-        m_horizontalAdjustment->lower = 0;
-        m_horizontalAdjustment->upper = contentsWidth();
-        gtk_adjustment_changed(m_horizontalAdjustment);
-
-        if (m_horizontalAdjustment->value != scroll.width()) {
-            m_horizontalAdjustment->value = scroll.width();
-            gtk_adjustment_value_changed(m_horizontalAdjustment);
-        }
-        return true;
-    }
-    return false;
-}
-
-bool ScrollView::platformHandleVerticalAdjustment(const IntSize& scroll)
-{
-    if (m_verticalAdjustment) {
-        m_verticalAdjustment->page_size = visibleHeight();
-        m_verticalAdjustment->step_increment = visibleHeight() / 10.0;
-        m_verticalAdjustment->page_increment = visibleHeight() * 0.9;
-        m_verticalAdjustment->lower = 0;
-        m_verticalAdjustment->upper = contentsHeight();
-        gtk_adjustment_changed(m_verticalAdjustment);
-
-        if (m_verticalAdjustment->value != scroll.height()) {
-            m_verticalAdjustment->value = scroll.height();
-            gtk_adjustment_value_changed(m_verticalAdjustment);
-        }
-        return true;
-    } 
-    return false;
-}
-
-bool ScrollView::platformHasHorizontalAdjustment() const
-{
-    return m_horizontalAdjustment != 0;
-}
-
-bool ScrollView::platformHasVerticalAdjustment() const
-{
-    return m_verticalAdjustment != 0;
-}
-
 }
diff --git a/WebCore/platform/gtk/ScrollbarGtk.cpp b/WebCore/platform/gtk/ScrollbarGtk.cpp
index 7543e23..d7f6d26 100644
--- a/WebCore/platform/gtk/ScrollbarGtk.cpp
+++ b/WebCore/platform/gtk/ScrollbarGtk.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2007 Holger Hans Peter Freyther zecke@selfish.org
+ *  Copyright (C) 2007, 2009 Holger Hans Peter Freyther zecke@selfish.org
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -22,7 +22,6 @@
 #include "IntRect.h"
 #include "GraphicsContext.h"
 #include "FrameView.h"
-#include "NotImplemented.h"
 #include "ScrollbarTheme.h"
 #include "gtkdrawing.h"
 
@@ -35,6 +34,11 @@
     return adoptRef(new ScrollbarGtk(client, orientation, size));
 }
 
+PassRefPtr<ScrollbarGtk> ScrollbarGtk::createScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, GtkAdjustment* adj)
+{
+    return adoptRef(new ScrollbarGtk(client, orientation, adj));
+}
+
 static gboolean gtkScrollEventCallback(GtkWidget* widget, GdkEventScroll* event, ScrollbarGtk*)
 {
     /* Scroll only if our parent rejects the scroll event. The rationale for
@@ -52,7 +56,8 @@
                            gtk_hscrollbar_new(m_adjustment):
                            gtk_vscrollbar_new(m_adjustment);
     gtk_widget_show(scrollBar);
-    g_signal_connect(scrollBar, "value-changed", G_CALLBACK(ScrollbarGtk::gtkValueChanged), this);
+    g_object_ref(m_adjustment);
+    g_signal_connect(m_adjustment, "value-changed", G_CALLBACK(ScrollbarGtk::gtkValueChanged), this);
     g_signal_connect(scrollBar, "scroll-event", G_CALLBACK(gtkScrollEventCallback), this);
 
     setPlatformWidget(scrollBar);
@@ -65,6 +70,37 @@
            ScrollbarTheme::nativeTheme()->scrollbarThickness());
 }
 
+// Create a ScrollbarGtk on top of an existing GtkAdjustment but do not create a
+// GtkScrollbar on top of this adjustment. The goal is to have a WebCore::Scrollbar
+// that will manipulate the GtkAdjustment properties, will react to the changed
+// value but will not consume any space on the screen and will not be painted
+// at all. It is achieved by not calling setPlatformWidget.
+ScrollbarGtk::ScrollbarGtk(ScrollbarClient* client, ScrollbarOrientation orientation, GtkAdjustment* adjustment)
+    : Scrollbar(client, orientation, RegularScrollbar)
+    , m_adjustment(adjustment)
+{
+    g_object_ref(m_adjustment);
+    g_signal_connect(m_adjustment, "value-changed", G_CALLBACK(ScrollbarGtk::gtkValueChanged), this);
+
+    // We have nothing to show as we are solely operating on the GtkAdjustment
+    resize(0, 0);
+}
+
+ScrollbarGtk::~ScrollbarGtk()
+{
+    g_signal_handlers_disconnect_by_func(G_OBJECT(m_adjustment), (gpointer)ScrollbarGtk::gtkValueChanged, this);
+
+    // For the case where we only operate on the GtkAdjustment it is best to
+    // reset the values so that the surrounding scrollbar gets updated, or
+    // e.g. for a GtkScrolledWindow the scrollbar gets hidden.
+    m_adjustment->lower = 0;
+    m_adjustment->upper = 0;
+    m_adjustment->value = 0;
+    gtk_adjustment_changed(m_adjustment);
+    gtk_adjustment_value_changed(m_adjustment);
+    g_object_unref(m_adjustment);
+}
+
 IntPoint ScrollbarGtk::getLocationInParentWindow(const IntRect& rect)
 {
     IntPoint loc;
@@ -79,7 +115,7 @@
 
 void ScrollbarGtk::frameRectsChanged()
 {
-    if (!parent())
+    if (!parent() || !platformWidget())
         return;
 
     IntPoint loc = getLocationInParentWindow(frameRect());
diff --git a/WebCore/platform/gtk/ScrollbarGtk.h b/WebCore/platform/gtk/ScrollbarGtk.h
index 1ef4c49..b4b5989 100644
--- a/WebCore/platform/gtk/ScrollbarGtk.h
+++ b/WebCore/platform/gtk/ScrollbarGtk.h
@@ -36,6 +36,8 @@
 class ScrollbarGtk : public Scrollbar {
 public:
     friend class Scrollbar;
+    friend class ScrollView;
+    ~ScrollbarGtk();
 
     virtual void setFrameRect(const IntRect&);
     virtual void paint(GraphicsContext*, const IntRect&);
@@ -50,7 +52,10 @@
     virtual void frameRectsChanged();
 
 protected:
+    static PassRefPtr<ScrollbarGtk> createScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, GtkAdjustment*);
+
     ScrollbarGtk(ScrollbarClient*, ScrollbarOrientation, ScrollbarControlSize);
+    ScrollbarGtk(ScrollbarClient*, ScrollbarOrientation, GtkAdjustment*);
 
     virtual void updateThumbPosition();
     virtual void updateThumbProportion();
diff --git a/WebCore/platform/gtk/TemporaryLinkStubs.cpp b/WebCore/platform/gtk/TemporaryLinkStubs.cpp
index edabd10..8c12fcb 100644
--- a/WebCore/platform/gtk/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/gtk/TemporaryLinkStubs.cpp
@@ -38,26 +38,10 @@
 
 using namespace WebCore;
 
-// This function loads resources from WebKit
-// This does not belong here and I'm not sure where
-// it should go
-// I don't know what the plans or design is
-// for none code resources
-Vector<char> loadResourceIntoArray(const char* resourceName)
-{
-    Vector<char> resource;
-    //if (strcmp(resourceName,"missingImage") == 0) {
-    //}
-    return resource;
-}
-
-
 /********************************************************/
 /* Completely empty stubs (mostly to allow DRT to run): */
 /********************************************************/
 
-void PluginView::invalidateRegion(NPRegion) { notImplemented(); }
-
 namespace WebCore {
 void getSupportedKeySizes(Vector<String>&) { notImplemented(); }
 String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String &challengeString, const KURL &url) { return String(); }
diff --git a/WebCore/platform/gtk/WheelEventGtk.cpp b/WebCore/platform/gtk/WheelEventGtk.cpp
index 075bed2..404bf29 100644
--- a/WebCore/platform/gtk/WheelEventGtk.cpp
+++ b/WebCore/platform/gtk/WheelEventGtk.cpp
@@ -31,9 +31,6 @@
 
 #include <gdk/gdk.h>
 
-// GTK_CHECK_VERSION is defined in gtk/gtkversion.h
-#include <gtk/gtk.h>
-
 namespace WebCore {
 
 // Keep this in sync with the other platform event constructors
@@ -69,12 +66,7 @@
     m_shiftKey = event->state & GDK_SHIFT_MASK;
     m_ctrlKey = event->state & GDK_CONTROL_MASK;
     m_altKey = event->state & GDK_MOD1_MASK;
-#if GTK_CHECK_VERSION(2,10,0)
     m_metaKey = event->state & GDK_META_MASK;
-#else
-    // GDK_MOD2_MASK doesn't always mean meta so we can't use it
-    m_metaKey = false;
-#endif
 
     // FIXME: retrieve the user setting for the number of lines to scroll on each wheel event
     m_deltaX *= static_cast<float>(cScrollbarPixelsPerLineStep);
diff --git a/WebCore/platform/gtk/WidgetGtk.cpp b/WebCore/platform/gtk/WidgetGtk.cpp
index 4f09e77..007f2ee 100644
--- a/WebCore/platform/gtk/WidgetGtk.cpp
+++ b/WebCore/platform/gtk/WidgetGtk.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
- * Copyright (C) 2007 Holger Hans Peter Freyther
+ * Copyright (C) 2007, 2009 Holger Hans Peter Freyther
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -33,7 +33,6 @@
 #include "GraphicsContext.h"
 #include "HostWindow.h"
 #include "IntRect.h"
-#include "NotImplemented.h"
 #include "RenderObject.h"
 
 #include <gdk/gdk.h>
@@ -99,9 +98,19 @@
 {
 }
 
-void Widget::setIsSelected(bool)
+void Widget::setIsSelected(bool isSelected)
 {
-    notImplemented();
+    if (!platformWidget())
+        return;
+
+    // See if the platformWidget has a webkit-widget-is-selected property
+    // and set it afterwards.
+    GParamSpec* spec = g_object_class_find_property(G_OBJECT_GET_CLASS(platformWidget()),
+                                                    "webkit-widget-is-selected");
+    if (!spec)
+        return;
+
+    g_object_set(platformWidget(), "webkit-widget-is-selected", isSelected, NULL);
 }
 
 IntRect Widget::frameRect() const
diff --git a/WebCore/platform/gtk/gtk2drawing.c b/WebCore/platform/gtk/gtk2drawing.c
index dd46e74..1f62c96 100644
--- a/WebCore/platform/gtk/gtk2drawing.c
+++ b/WebCore/platform/gtk/gtk2drawing.c
@@ -49,6 +49,8 @@
 #include <string.h>
 #include "gtkdrawing.h"
 
+#include "Assertions.h"
+
 #include <math.h>
 
 #define XTHICKNESS(style) (style->xthickness)
@@ -56,6 +58,7 @@
 #define WINDOW_IS_MAPPED(window) ((window) && GDK_IS_WINDOW(window) && gdk_window_is_visible(window))
 
 static GtkWidget* gProtoWindow;
+static GtkWidget* gProtoLayout;
 static GtkWidget* gButtonWidget;
 static GtkWidget* gToggleButtonWidget;
 static GtkWidget* gButtonArrowWidget;
@@ -101,7 +104,6 @@
 
 static style_prop_t style_prop_func;
 static gboolean have_arrow_scaling;
-static gboolean have_2_10;
 static gboolean is_initialized;
 
 /* Because we have such an unconventional way of drawing widgets, signal to the GTK theme engine
@@ -134,14 +136,13 @@
 static gint
 setup_widget_prototype(GtkWidget* widget)
 {
-    static GtkWidget* protoLayout;
     ensure_window_widget();
-    if (!protoLayout) {
-        protoLayout = gtk_fixed_new();
-        gtk_container_add(GTK_CONTAINER(gProtoWindow), protoLayout);
+    if (!gProtoLayout) {
+        gProtoLayout = gtk_fixed_new();
+        gtk_container_add(GTK_CONTAINER(gProtoWindow), gProtoLayout);
     }
 
-    gtk_container_add(GTK_CONTAINER(protoLayout), widget);
+    gtk_container_add(GTK_CONTAINER(gProtoLayout), widget);
     gtk_widget_realize(widget);
     g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
     return MOZ_GTK_SUCCESS;
@@ -409,8 +410,7 @@
         g_object_add_weak_pointer(G_OBJECT(widget),
                                   (gpointer) &gComboBoxEntryArrowWidget);
         gtk_widget_realize(widget);
-        g_object_set_data(G_OBJECT(widget), "transparent-bg-hint",
-                          GINT_TO_POINTER(TRUE));
+        g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
     }
 }
 
@@ -502,8 +502,7 @@
         gToolbarWidget = gtk_toolbar_new();
         gtk_container_add(GTK_CONTAINER(gHandleBoxWidget), gToolbarWidget);
         gtk_widget_realize(gToolbarWidget);
-        g_object_set_data(G_OBJECT(gToolbarWidget), "transparent-bg-hint",
-                          GINT_TO_POINTER(TRUE));
+        g_object_set_data(G_OBJECT(gToolbarWidget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
     }
     return MOZ_GTK_SUCCESS;
 }
@@ -710,17 +709,17 @@
         gtk_tree_view_append_column(GTK_TREE_VIEW(gTreeViewWidget), firstTreeViewColumn);
 
         gMiddleTreeViewColumn = gtk_tree_view_column_new();
-        gtk_tree_view_column_set_title(GTK_TREE_VIEW_COLUMN(gMiddleTreeViewColumn), "M");
+        gtk_tree_view_column_set_title(gMiddleTreeViewColumn, "M");
         gtk_tree_view_append_column(GTK_TREE_VIEW(gTreeViewWidget),
-                                    GTK_TREE_VIEW_COLUMN(gMiddleTreeViewColumn));
+                                    gMiddleTreeViewColumn);
 
         lastTreeViewColumn = gtk_tree_view_column_new();
         gtk_tree_view_column_set_title(lastTreeViewColumn, "M");
         gtk_tree_view_append_column(GTK_TREE_VIEW(gTreeViewWidget), lastTreeViewColumn);
 
         /* Use the middle column's header for our button */
-        gTreeHeaderCellWidget = GTK_TREE_VIEW_COLUMN(gMiddleTreeViewColumn)->button;
-        gTreeHeaderSortArrowWidget = GTK_TREE_VIEW_COLUMN(gMiddleTreeViewColumn)->arrow;
+        gTreeHeaderCellWidget = gMiddleTreeViewColumn->button;
+        gTreeHeaderSortArrowWidget = gMiddleTreeViewColumn->arrow;
         g_object_set_data(G_OBJECT(gTreeHeaderCellWidget),
                           "transparent-bg-hint", GINT_TO_POINTER(TRUE));
         g_object_set_data(G_OBJECT(gTreeHeaderSortArrowWidget),
@@ -880,9 +879,6 @@
     have_arrow_scaling = (gtk_major_version > 2 ||
                           (gtk_major_version == 2 && gtk_minor_version >= 12));
 
-    have_2_10 = (gtk_major_version > 2 ||
-                 (gtk_major_version == 2 && gtk_minor_version >= 10));
-
     /* Add style property to GtkEntry.
      * Adding the style property to the normal GtkEntry class means that it
      * will work without issues inside GtkComboBox and for Spinbuttons. */
@@ -953,10 +949,9 @@
 moz_gtk_button_get_inner_border(GtkWidget* widget, GtkBorder* inner_border)
 {
     static const GtkBorder default_inner_border = { 1, 1, 1, 1 };
-    GtkBorder *tmp_border = NULL;
+    GtkBorder *tmp_border;
 
-    if (have_2_10)
-        gtk_widget_style_get (widget, "inner-border", &tmp_border, NULL);
+    gtk_widget_style_get (widget, "inner-border", &tmp_border, NULL);
 
     if (tmp_border) {
         *inner_border = *tmp_border;
@@ -971,8 +966,8 @@
 static gint
 moz_gtk_toggle_paint(GdkDrawable* drawable, GdkRectangle* rect,
                      GdkRectangle* cliprect, GtkWidgetState* state,
-                     gboolean selected, gboolean isradio,
-                     GtkTextDirection direction)
+                     gboolean selected, gboolean inconsistent,
+                     gboolean isradio, GtkTextDirection direction)
 {
     GtkStateType state_type = ConvertGtkState(state);
     GtkShadowType shadow_type = (selected)?GTK_SHADOW_IN:GTK_SHADOW_OUT;
@@ -990,6 +985,12 @@
         w = gCheckboxWidget;
     }
 
+    // "GetMinimumWidgetSize was ignored"
+    // FIXME: This assert causes a build failure in WebKitGTK+ debug
+    // builds, because it uses 'false' in its definition. We may want
+    // to force this file to be built with g++, by renaming it.
+    // ASSERT(rect->width == indicator_size);
+
     /*
      * vertically center in the box, since XUL sometimes ignores our
      * GetMinimumWidgetSize in the vertical dimension
@@ -1022,6 +1023,17 @@
         }
     }
     else {
+       /*
+        * 'indeterminate' type on checkboxes. In GTK, the shadow type
+        * must also be changed for the state to be drawn.
+        */
+        if (inconsistent) {
+            gtk_toggle_button_set_inconsistent(GTK_TOGGLE_BUTTON(gCheckboxWidget), TRUE);
+            shadow_type = GTK_SHADOW_ETCHED_IN;
+        } else {
+            gtk_toggle_button_set_inconsistent(GTK_TOGGLE_BUTTON(gCheckboxWidget), FALSE);
+        }
+
         gtk_paint_check(style, drawable, state_type, shadow_type, cliprect, 
                         gCheckboxWidget, "checkbutton", x, y, width, height);
         if (state->focused) {
@@ -1490,9 +1502,15 @@
 moz_gtk_caret_paint(GdkDrawable* drawable, GdkRectangle* rect,
                     GdkRectangle* cliprect, GtkTextDirection direction)
 {
+    GdkRectangle location = *rect;
+    if (direction == GTK_TEXT_DIR_RTL) {
+        /* gtk_draw_insertion_cursor ignores location.width */
+        location.x = rect->x + rect->width;
+    }
+
     ensure_entry_widget();
     gtk_draw_insertion_cursor(gEntryWidget, drawable, cliprect,
-                              rect, TRUE, direction, FALSE);
+                              &location, TRUE, direction, FALSE);
 
     return MOZ_GTK_SUCCESS;
 }
@@ -1538,8 +1556,7 @@
      * If the theme is able to cope with transparency, then we can skip pre-filling
      * and notify the theme it will paint directly on the canvas. */
     if (theme_honors_transparency) {
-        g_object_set_data(G_OBJECT(widget), "transparent-bg-hint",
-                          GINT_TO_POINTER(TRUE));
+        g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
     } else {
         gdk_draw_rectangle(drawable, style->base_gc[bg_state], TRUE,
                            cliprect->x, cliprect->y, cliprect->width, cliprect->height);
@@ -1650,7 +1667,7 @@
                                GdkRectangle* cliprect, GtkWidgetState* state,
                                gboolean isSorted, GtkTextDirection direction)
 {
-    gtk_tree_view_column_set_sort_indicator(GTK_TREE_VIEW_COLUMN(gMiddleTreeViewColumn),
+    gtk_tree_view_column_set_sort_indicator(gMiddleTreeViewColumn,
                                             isSorted);
 
     moz_gtk_button_paint(drawable, rect, cliprect, state, GTK_RELIEF_NORMAL,
@@ -1742,8 +1759,8 @@
                         gboolean ishtml, GtkTextDirection direction)
 {
     GdkRectangle arrow_rect, real_arrow_rect;
-    gint arrow_size, separator_width = 0;
-    gboolean wide_separators = FALSE;
+    gint arrow_size, separator_width;
+    gboolean wide_separators;
     GtkStateType state_type = ConvertGtkState(state);
     GtkShadowType shadow_type = state->active ? GTK_SHADOW_IN : GTK_SHADOW_OUT;
     GtkStyle* style;
@@ -1786,11 +1803,10 @@
     style = gComboBoxSeparatorWidget->style;
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
-    if (have_2_10)
-        gtk_widget_style_get(gComboBoxSeparatorWidget,
-                             "wide-separators", &wide_separators,
-                             "separator-width", &separator_width,
-                             NULL);
+    gtk_widget_style_get(gComboBoxSeparatorWidget,
+                         "wide-separators", &wide_separators,
+                         "separator-width", &separator_width,
+                         NULL);
 
     if (wide_separators) {
         if (direction == GTK_TEXT_DIR_LTR)
@@ -2015,9 +2031,9 @@
                                 GtkTextDirection direction)
 {
     GtkStyle* style;
-    gint     separator_width = 0;
+    gint     separator_width;
     gint     paint_width;
-    gboolean wide_separators = FALSE;
+    gboolean wide_separators;
     
     /* Defined as constants in GTK+ 2.10.14 */
     const double start_fraction = 0.2;
@@ -2028,11 +2044,10 @@
 
     style = gToolbarSeparatorWidget->style;
 
-    if (have_2_10)
-        gtk_widget_style_get(gToolbarWidget,
-                             "wide-separators", &wide_separators,
-                             "separator-width", &separator_width,
-                             NULL);
+    gtk_widget_style_get(gToolbarWidget,
+                         "wide-separators", &wide_separators,
+                         "separator-width", &separator_width,
+                         NULL);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
@@ -2423,9 +2438,9 @@
                              GdkRectangle* cliprect, GtkTextDirection direction)
 {
     GtkStyle* style;
-    gboolean wide_separators = FALSE;
-    gint separator_height = 0;
-    guint horizontal_padding = 0;
+    gboolean wide_separators;
+    gint separator_height;
+    guint horizontal_padding;
     gint paint_height;
 
     ensure_menu_separator_widget();
@@ -2433,13 +2448,9 @@
 
     style = gMenuSeparatorWidget->style;
 
-    if (have_2_10)
-        gtk_widget_style_get(gMenuSeparatorWidget,
-                             "wide-separators",    &wide_separators,
-                             "separator-height",   &separator_height,
-                             NULL);
-
     gtk_widget_style_get(gMenuSeparatorWidget,
+                         "wide-separators",    &wide_separators,
+                         "separator-height",   &separator_height,
                          "horizontal-padding", &horizontal_padding,
                          NULL);
 
@@ -2687,7 +2698,7 @@
             /* We need to account for the arrow on the dropdown, so text
              * doesn't come too close to the arrow, or in some cases spill
              * into the arrow. */
-            gboolean ignored_interior_focus, wide_separators = FALSE;
+            gboolean ignored_interior_focus, wide_separators;
             gint focus_width, focus_pad, separator_width;
             GtkRequisition arrow_req;
 
@@ -2710,11 +2721,10 @@
             /* If there is no separator, don't try to count its width. */
             separator_width = 0;
             if (gComboBoxSeparatorWidget) {
-                if (have_2_10)
-                    gtk_widget_style_get(gComboBoxSeparatorWidget,
-                                         "wide-separators", &wide_separators,
-                                         "separator-width", &separator_width,
-                                         NULL);
+                gtk_widget_style_get(gComboBoxSeparatorWidget,
+                                     "wide-separators", &wide_separators,
+                                     "separator-width", &separator_width,
+                                     NULL);
 
                 if (!wide_separators)
                     separator_width =
@@ -2895,13 +2905,12 @@
 gint
 moz_gtk_get_tab_scroll_arrow_size(gint* width, gint* height)
 {
-    gint arrow_size = 16;
+    gint arrow_size;
 
     ensure_tab_widget();
-    if (have_2_10)
-        gtk_widget_style_get(gTabWidget,
-                             "scroll-arrow-hlength", &arrow_size,
-                             NULL);
+    gtk_widget_style_get(gTabWidget,
+                         "scroll-arrow-hlength", &arrow_size,
+                         NULL);
 
     *height = *width = arrow_size;
 
@@ -2924,22 +2933,18 @@
 gint
 moz_gtk_get_toolbar_separator_width(gint* size)
 {
-    gboolean wide_separators = FALSE;
-    gint separator_width = 0;
+    gboolean wide_separators;
+    gint separator_width;
     GtkStyle* style;
 
     ensure_toolbar_widget();
 
     style = gToolbarWidget->style;
 
-    if (have_2_10)
-        gtk_widget_style_get(gToolbarWidget,
-                             "wide-separators",  &wide_separators,
-                             "separator-width", &separator_width,
-                             NULL);
-
     gtk_widget_style_get(gToolbarWidget,
                          "space-size", size,
+                         "wide-separators",  &wide_separators,
+                         "separator-width", &separator_width,
                          NULL);
 
     /* Just in case... */
@@ -2973,16 +2978,15 @@
 gint
 moz_gtk_get_menu_separator_height(gint *size)
 {
-    gboolean wide_separators = FALSE;
-    gint     separator_height = 0;
+    gboolean wide_separators;
+    gint     separator_height;
 
     ensure_menu_separator_widget();
 
-    if (have_2_10)
-        gtk_widget_style_get(gMenuSeparatorWidget,
-                              "wide-separators",  &wide_separators,
-                              "separator-height", &separator_height,
-                              NULL);
+    gtk_widget_style_get(gMenuSeparatorWidget,
+                          "wide-separators",  &wide_separators,
+                          "separator-height", &separator_height,
+                          NULL);
 
     if (wide_separators)
         *size = separator_height + gMenuSeparatorWidget->style->ythickness;
@@ -3061,7 +3065,8 @@
     case MOZ_GTK_CHECKBUTTON:
     case MOZ_GTK_RADIOBUTTON:
         return moz_gtk_toggle_paint(drawable, rect, cliprect, state,
-                                    (gboolean) flags,
+                                    !!(flags & MOZ_GTK_WIDGET_CHECKED),
+                                    !!(flags & MOZ_GTK_WIDGET_INCONSISTENT),
                                     (widget == MOZ_GTK_RADIOBUTTON),
                                     direction);
         break;
@@ -3262,6 +3267,7 @@
         gtk_widget_destroy(gProtoWindow);
 
     gProtoWindow = NULL;
+    gProtoLayout = NULL;
     gButtonWidget = NULL;
     gToggleButtonWidget = NULL;
     gButtonArrowWidget = NULL;
diff --git a/WebCore/platform/gtk/gtkdrawing.h b/WebCore/platform/gtk/gtkdrawing.h
index eb6995a..1a33bfb 100644
--- a/WebCore/platform/gtk/gtkdrawing.h
+++ b/WebCore/platform/gtk/gtkdrawing.h
@@ -110,6 +110,10 @@
 #define MOZ_GTK_UNKNOWN_WIDGET -1
 #define MOZ_GTK_UNSAFE_THEME -2
 
+/*** checkbox/radio flags ***/
+#define MOZ_GTK_WIDGET_CHECKED 1
+#define MOZ_GTK_WIDGET_INCONSISTENT (1 << 1)
+
 /*** widget type constants ***/
 typedef enum {
   /* Paints a GtkButton. flags is a GtkReliefStyle. */
diff --git a/WebCore/platform/gtk/guriescape.c b/WebCore/platform/gtk/guriescape.c
deleted file mode 100644
index 0792587..0000000
--- a/WebCore/platform/gtk/guriescape.c
+++ /dev/null
@@ -1,219 +0,0 @@
-/*
- * Copyright (C) 2008 Collabora, Ltd.
- * Copyright (C) 1995-1997 Peter Mattis, Spencer Kimball and Josh MacDonald
- * Copyright (C) 1997-2000 The GLib Team
- * Copyright (C) 2006-2007 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "guriescape.h"
-
-#include <string.h>
-
-#if !PLATFORM(WIN_OS) && !GLIB_CHECK_VERSION(2,16,0)
-
-/* is_valid, gunichar_ok and g_string_append_uri_escaped were copied for glib/gstring.c
- * in the glib package.
- *
- * Original copyright:
- *   Copyright (C) 1995-1997  Peter Mattis, Spencer Kimball and Josh MacDonald
- *
- *   Modified by the GLib Team and others 1997-2000.  See the AUTHORS
- *   file for a list of people on the GLib Team.  See the ChangeLog
- *   files for a list of changes.  These files are distributed with
- *   GLib at ftp://ftp.gtk.org/pub/gtk/. 
- *
- * Please don't change the indentation so it's easier to update these functions
- * if they are changed in glib.
- */
-static gboolean
-is_valid (char c, const char *reserved_chars_allowed)
-{
-  if (g_ascii_isalnum (c) ||
-      c == '-' ||
-      c == '.' ||
-      c == '_' ||
-      c == '~')
-    return TRUE;
-
-  if (reserved_chars_allowed &&
-      strchr (reserved_chars_allowed, c) != NULL)
-    return TRUE;
-  
-  return FALSE;
-}
-
-static gboolean 
-gunichar_ok (gunichar c)
-{
-  return
-    (c != (gunichar) -2) &&
-    (c != (gunichar) -1);
-}
-
-static GString *
-_webcore_g_string_append_uri_escaped (GString *string,
-                             const char *unescaped,
-                             const char *reserved_chars_allowed,
-                             gboolean allow_utf8)
-{
-  unsigned char c;
-  const char *end;
-  static const gchar hex[16] = "0123456789ABCDEF";
-
-  g_return_val_if_fail (string != NULL, NULL);
-  g_return_val_if_fail (unescaped != NULL, NULL);
-
-  end = unescaped + strlen (unescaped);
-  
-  while ((c = *unescaped) != 0)
-    {
-      if (c >= 0x80 && allow_utf8 &&
-          gunichar_ok (g_utf8_get_char_validated (unescaped, end - unescaped)))
-        {
-          int len = g_utf8_skip [c];
-          g_string_append_len (string, unescaped, len);
-          unescaped += len;
-        }
-      else if (is_valid (c, reserved_chars_allowed))
-        {
-          g_string_append_c (string, c);
-          unescaped++;
-        }
-      else
-        {
-          g_string_append_c (string, '%');
-          g_string_append_c (string, hex[((guchar)c) >> 4]);
-          g_string_append_c (string, hex[((guchar)c) & 0xf]);
-          unescaped++;
-        }
-    }
-
-  return string;
-}
-
-/* g_uri_escape_string, unescape_character, g_uri_unescape_segment and
- * g_uri_unescape_string were copied for glib/gurifuncs.c in the glib package
- * and prefixed with _webcore (if necessary) to avoid exporting a symbol with
- * the "g_" prefix.
- *
- * Original copyright:
- *   Copyright (C) 2006-2007 Red Hat, Inc.
- *   Author: Alexander Larsson <alexl@redhat.com>
- *
- * Please don't change the indentation so it's easier to update this function
- * if it's changed in glib.
- */
-char *
-_webcore_g_uri_escape_string (const char *unescaped,
-                     const char  *reserved_chars_allowed,
-                     gboolean     allow_utf8)
-{
-  GString *s;
-
-  g_return_val_if_fail (unescaped != NULL, NULL);
-
-  s = g_string_sized_new (strlen (unescaped) + 10);
-  
-  _webcore_g_string_append_uri_escaped (s, unescaped, reserved_chars_allowed, allow_utf8);
-  
-  return g_string_free (s, FALSE);
-}
-
-static int
-unescape_character (const char *scanner)
-{
-  int first_digit;
-  int second_digit;
-  
-  first_digit = g_ascii_xdigit_value (*scanner++);
-  if (first_digit < 0)
-    return -1;
-
-  second_digit = g_ascii_xdigit_value (*scanner++);
-  if (second_digit < 0)
-    return -1;
-
-  return (first_digit << 4) | second_digit;
-}
-
-
-
-static char *
-_webcore_g_uri_unescape_segment (const char *escaped_string,
-      const char *escaped_string_end,
-      const char *illegal_characters)
-{
-  const char *in;
-  char *out, *result;
-  gint character;
-  
-  if (escaped_string == NULL)
-    return NULL;
-  
-  if (escaped_string_end == NULL)
-    escaped_string_end = escaped_string + strlen (escaped_string);
-  
-  result = g_malloc (escaped_string_end - escaped_string + 1);
-  
-  out = result;
-  for (in = escaped_string; in < escaped_string_end; in++)
-    {
-      character = *in;
-      
-      if (*in == '%')
-  {
-    in++;
-    
-    if (escaped_string_end - in < 2)
-      {
-        /* Invalid escaped char (to short) */
-        g_free (result);
-        return NULL;
-      }
-    
-    character = unescape_character (in);
-    
-    /* Check for an illegal character. We consider '\0' illegal here. */
-    if (character <= 0 ||
-        (illegal_characters != NULL &&
-         strchr (illegal_characters, (char)character) != NULL))
-      {
-        g_free (result);
-        return NULL;
-      }
-    
-    in++; /* The other char will be eaten in the loop header */
-  }
-      *out++ = (char)character;
-    }
-  
-  *out = '\0';
-  
-  return result;
-}
-
-
-char *
-_webcore_g_uri_unescape_string (const char *escaped_string,
-           const char *illegal_characters)
-{
-  return _webcore_g_uri_unescape_segment (escaped_string, NULL, illegal_characters);
-}
-
-#endif /* #if !PLATFORM(WIN_OS) && !GLIB_CHECK_VERSION(2,16,0) */
diff --git a/WebCore/platform/gtk/guriescape.h b/WebCore/platform/gtk/guriescape.h
deleted file mode 100644
index 8c6662a..0000000
--- a/WebCore/platform/gtk/guriescape.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright (C) 2008 Collabora, Ltd.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef guriescape_h
-#define guriescape_h
-
-#include <glib.h>
-#include <wtf/Platform.h>
-
-G_BEGIN_DECLS
-
-#if !PLATFORM(WIN_OS) && !GLIB_CHECK_VERSION(2,16,0)
-
-#define g_uri_escape_string _webcore_g_uri_escape_string
-#define g_uri_unescape_string _webcore_g_uri_unescape_string
-
-char    *_webcore_g_uri_escape_string   (const char *unescaped,
-                                         const char *reserved_chars_allowed,
-                                         gboolean    allow_utf8);
-
-char    *_webcore_g_uri_unescape_string (const char *escaped_string,
-                                         const char *illegal_characters);
-
-#endif
-
-G_END_DECLS
-
-#endif /* guriescape_h */
diff --git a/WebCore/platform/image-decoders/ImageDecoder.h b/WebCore/platform/image-decoders/ImageDecoder.h
index 17756ac..ca27b37 100644
--- a/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/WebCore/platform/image-decoders/ImageDecoder.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef IMAGE_DECODER_H_
-#define IMAGE_DECODER_H_
+#ifndef ImageDecoder_h
+#define ImageDecoder_h
 
 #include "IntRect.h"
 #include "ImageSource.h"
@@ -34,136 +34,145 @@
 
 namespace WebCore {
 
-typedef Vector<unsigned> RGBA32Array;
+    typedef Vector<unsigned> RGBA32Array;
 
-// The RGBA32Buffer object represents the decoded image data in RGBA32 format.  This buffer is what all
-// decoders write a single frame into.  Frames are then instantiated for drawing by being handed this buffer.
-class RGBA32Buffer
-{
-public:
-    enum FrameStatus { FrameEmpty, FramePartial, FrameComplete };
-    enum FrameDisposalMethod {
-        // If you change the numeric values of these, make sure you audit all
-        // users, as some users may cast raw values to/from these constants.
-        DisposeNotSpecified = 0,       // Leave frame in framebuffer
-        DisposeKeep = 1,               // Leave frame in framebuffer
-        DisposeOverwriteBgcolor = 2,   // Clear frame to transparent
-        DisposeOverwritePrevious = 3,  // Clear frame to previous framebuffer contents
+    // The RGBA32Buffer object represents the decoded image data in RGBA32 format.  This buffer is what all
+    // decoders write a single frame into.  Frames are then instantiated for drawing by being handed this buffer.
+    class RGBA32Buffer {
+    public:
+        enum FrameStatus { FrameEmpty, FramePartial, FrameComplete };
+
+        enum FrameDisposalMethod {
+            // If you change the numeric values of these, make sure you audit all
+            // users, as some users may cast raw values to/from these constants.
+            DisposeNotSpecified,       // Leave frame in framebuffer
+            DisposeKeep,               // Leave frame in framebuffer
+            DisposeOverwriteBgcolor,   // Clear frame to transparent
+            DisposeOverwritePrevious,  // Clear frame to previous framebuffer contents
+        };
+
+        RGBA32Buffer()
+            : m_height(0)
+            , m_status(FrameEmpty)
+            , m_duration(0)
+            , m_disposalMethod(DisposeNotSpecified)
+            , m_hasAlpha(false)
+        {
+        } 
+
+        void clear() {
+          m_bytes.clear();
+          m_status = FrameEmpty;
+          // NOTE: Do not reset other members here; clearFrameBufferCache() calls
+          // this to free the bitmap data, but other functions like
+          // initFrameBuffer() and frameComplete() may still need to read other
+          // metadata out of this frame later.
+        }
+
+        const RGBA32Array& bytes() const { return m_bytes; }
+        RGBA32Array& bytes() { return m_bytes; }
+        const IntRect& rect() const { return m_rect; }
+        unsigned height() const { return m_height; }
+        FrameStatus status() const { return m_status; }
+        unsigned duration() const { return m_duration; }
+        FrameDisposalMethod disposalMethod() const { return m_disposalMethod; }
+        bool hasAlpha() const { return m_hasAlpha; }
+
+        void setRect(const IntRect& r) { m_rect = r; }
+        void ensureHeight(unsigned rowIndex) { if (rowIndex > m_height) m_height = rowIndex; }
+        void setStatus(FrameStatus s) { m_status = s; }
+        void setDuration(unsigned duration) { m_duration = duration; }
+        void setDisposalMethod(FrameDisposalMethod method) { m_disposalMethod = method; }
+        void setHasAlpha(bool alpha) { m_hasAlpha = alpha; }
+
+        static void setRGBA(unsigned& pos, unsigned r, unsigned g, unsigned b, unsigned a)
+        {
+            // We store this data pre-multiplied.
+            if (a == 0)
+                pos = 0;
+            else {
+                if (a < 255) {
+                    float alphaPercent = a / 255.0f;
+                    r = static_cast<unsigned>(r * alphaPercent);
+                    g = static_cast<unsigned>(g * alphaPercent);
+                    b = static_cast<unsigned>(b * alphaPercent);
+                }
+                pos = (a << 24 | r << 16 | g << 8 | b);
+            }
+        }
+
+    private:
+        RGBA32Array m_bytes;
+        IntRect m_rect;    // The rect of the original specified frame within the overall buffer.
+                           // This will always just be the entire buffer except for GIF frames
+                           // whose original rect was smaller than the overall image size.
+        unsigned m_height; // The height (the number of rows we've fully decoded).
+        FrameStatus m_status; // Whether or not this frame is completely finished decoding.
+        unsigned m_duration; // The animation delay.
+        FrameDisposalMethod m_disposalMethod; // What to do with this frame's data when initializing the next frame.
+        bool m_hasAlpha; // Whether or not any of the pixels in the buffer have transparency.
     };
 
-    RGBA32Buffer() : m_height(0), m_status(FrameEmpty), m_duration(0),
-                     m_disposalMethod(DisposeNotSpecified), m_hasAlpha(false)
-    {} 
-
-    void clear() {
-      m_bytes.clear();
-      m_status = FrameEmpty;
-      // NOTE: Do not reset other members here; clearFrameBufferCache() calls
-      // this to free the bitmap data, but other functions like
-      // initFrameBuffer() and frameComplete() may still need to read other
-      // metadata out of this frame later.
-    }
-
-    const RGBA32Array& bytes() const { return m_bytes; }
-    RGBA32Array& bytes() { return m_bytes; }
-    const IntRect& rect() const { return m_rect; }
-    unsigned height() const { return m_height; }
-    FrameStatus status() const { return m_status; }
-    unsigned duration() const { return m_duration; }
-    FrameDisposalMethod disposalMethod() const { return m_disposalMethod; }
-    bool hasAlpha() const { return m_hasAlpha; }
-
-    void setRect(const IntRect& r) { m_rect = r; }
-    void ensureHeight(unsigned rowIndex) { if (rowIndex > m_height) m_height = rowIndex; }
-    void setStatus(FrameStatus s) { m_status = s; }
-    void setDuration(unsigned duration) { m_duration = duration; }
-    void setDisposalMethod(FrameDisposalMethod method) { m_disposalMethod = method; }
-    void setHasAlpha(bool alpha) { m_hasAlpha = alpha; }
-
-    static void setRGBA(unsigned& pos, unsigned r, unsigned g, unsigned b, unsigned a)
-    {
-        // We store this data pre-multiplied.
-        if (a == 0)
-            pos = 0;
-        else {
-            if (a < 255) {
-                float alphaPercent = a / 255.0f;
-                r = static_cast<unsigned>(r * alphaPercent);
-                g = static_cast<unsigned>(g * alphaPercent);
-                b = static_cast<unsigned>(b * alphaPercent);
-            }
-            pos = (a << 24 | r << 16 | g << 8 | b);
+    // The ImageDecoder class represents a base class for specific image format decoders
+    // (e.g., GIF, JPG, PNG, ICO) to derive from.  All decoders decode into RGBA32 format
+    // and the base class manages the RGBA32 frame cache.
+    class ImageDecoder {
+    public:
+        ImageDecoder()
+            : m_sizeAvailable(false)
+            , m_failed(false)
+        {
         }
-    }
+        
+        virtual ~ImageDecoder() {}
 
-private:
-    RGBA32Array m_bytes;
-    IntRect m_rect;    // The rect of the original specified frame within the overall buffer.
-                       // This will always just be the entire buffer except for GIF frames
-                       // whose original rect was smaller than the overall image size.
-    unsigned m_height; // The height (the number of rows we've fully decoded).
-    FrameStatus m_status; // Whether or not this frame is completely finished decoding.
-    unsigned m_duration; // The animation delay.
-    FrameDisposalMethod m_disposalMethod; // What to do with this frame's data when initializing the next frame.
-    bool m_hasAlpha; // Whether or not any of the pixels in the buffer have transparency.
-};
+        // The the filename extension usually associated with an undecoded image of this type.
+        virtual String filenameExtension() const = 0;
 
-// The ImageDecoder class represents a base class for specific image format decoders
-// (e.g., GIF, JPG, PNG, ICO) to derive from.  All decoders decode into RGBA32 format
-// and the base class manages the RGBA32 frame cache.
-class ImageDecoder
-{
-public:
-    ImageDecoder() :m_sizeAvailable(false), m_failed(false) {}
-    virtual ~ImageDecoder() {}
+        // All specific decoder plugins must do something with the data they are given.
+        virtual void setData(SharedBuffer* data, bool allDataReceived) { m_data = data; }
 
-    // The the filename extension usually associated with an undecoded image of this type.
-    virtual String filenameExtension() const = 0;
+        // Whether or not the size information has been decoded yet.
+        virtual bool isSizeAvailable() const = 0;
 
-    // All specific decoder plugins must do something with the data they are given.
-    virtual void setData(SharedBuffer* data, bool allDataReceived) { m_data = data; }
+        // Requests the size.
+        virtual IntSize size() const { return m_size; }
 
-    // Whether or not the size information has been decoded yet.
-    virtual bool isSizeAvailable() const = 0;
+        // The total number of frames for the image.  Classes that support multiple frames
+        // will scan the image data for the answer if they need to (without necessarily
+        // decoding all of the individual frames).
+        virtual int frameCount() { return 1; }
 
-    // Requests the size.
-    virtual IntSize size() const { return m_size; }
+        // The number of repetitions to perform for an animation loop.
+        virtual int repetitionCount() const { return cAnimationNone; }
 
-    // The total number of frames for the image.  Classes that support multiple frames
-    // will scan the image data for the answer if they need to (without necessarily
-    // decoding all of the individual frames).
-    virtual int frameCount() { return 1; }
+        // Called to obtain the RGBA32Buffer full of decoded data for rendering.  The
+        // decoder plugin will decode as much of the frame as it can before handing
+        // back the buffer.
+        virtual RGBA32Buffer* frameBufferAtIndex(size_t index) = 0;
 
-    // The number of repetitions to perform for an animation loop.
-    virtual int repetitionCount() const { return cAnimationNone; }
+        // Whether or not the underlying image format even supports alpha transparency.
+        virtual bool supportsAlpha() const { return true; }
 
-    // Called to obtain the RGBA32Buffer full of decoded data for rendering.  The
-    // decoder plugin will decode as much of the frame as it can before handing
-    // back the buffer.
-    virtual RGBA32Buffer* frameBufferAtIndex(size_t index) = 0;
+        bool failed() const { return m_failed; }
+        void setFailed() { m_failed = true; }
 
-    // Whether or not the underlying image format even supports alpha transparency.
-    virtual bool supportsAlpha() const { return true; }
+        // Wipe out frames in the frame buffer cache before |clearBeforeFrame|,
+        // assuming this can be done without breaking decoding.  Different decoders
+        // place different restrictions on what frames are safe to destroy, so this
+        // is left to them to implement.
+        // For convenience's sake, we provide a default (empty) implementation,
+        // since in practice only GIFs will ever use this.
+        virtual void clearFrameBufferCache(size_t clearBeforeFrame) { }
 
-    bool failed() const { return m_failed; }
-    void setFailed() { m_failed = true; }
+    protected:
+        RefPtr<SharedBuffer> m_data; // The encoded data.
+        Vector<RGBA32Buffer> m_frameBufferCache;
+        bool m_sizeAvailable;
+        mutable bool m_failed;
+        IntSize m_size;
+    };
 
-    // Wipe out frames in the frame buffer cache before |clearBeforeFrame|,
-    // assuming this can be done without breaking decoding.  Different decoders
-    // place different restrictions on what frames are safe to destroy, so this
-    // is left to them to implement.
-    // For convenience's sake, we provide a default (empty) implementation,
-    // since in practice only GIFs will ever use this.
-    virtual void clearFrameBufferCache(size_t clearBeforeFrame) { }
-
-protected:
-    RefPtr<SharedBuffer> m_data; // The encoded data.
-    Vector<RGBA32Buffer> m_frameBufferCache;
-    bool m_sizeAvailable;
-    mutable bool m_failed;
-    IntSize m_size;
-};
-
-}
+} // namespace WebCore
 
 #endif
diff --git a/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp b/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp
index cfc141c..3b90bdc 100644
--- a/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp
@@ -26,8 +26,6 @@
 #include "config.h"
 #include "BMPImageDecoder.h"
 
-#if PLATFORM(CAIRO) || PLATFORM(QT) || PLATFORM(WX)
-
 namespace WebCore
 {
 
@@ -41,6 +39,4 @@
     return 0;
 }
 
-}
-
-#endif // PLATFORM(CAIRO)
+} // namespace WebCore
diff --git a/WebCore/platform/image-decoders/bmp/BMPImageDecoder.h b/WebCore/platform/image-decoders/bmp/BMPImageDecoder.h
index d850cc7..a2d4b25 100644
--- a/WebCore/platform/image-decoders/bmp/BMPImageDecoder.h
+++ b/WebCore/platform/image-decoders/bmp/BMPImageDecoder.h
@@ -23,27 +23,26 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef BMP_DECODER_H_
-#define BMP_DECODER_H_
+#ifndef BMPImageDecoder_h
+#define BMPImageDecoder_h
 
 #include "ImageDecoder.h"
 
 namespace WebCore {
 
-class BMPImageReader;
+    class BMPImageReader;
 
-// This class decodes the BMP image format.
-class BMPImageDecoder : public ImageDecoder
-{
-public:
-    virtual String filenameExtension() const { return "bmp"; }
+    // This class decodes the BMP image format.
+    class BMPImageDecoder : public ImageDecoder {
+    public:
+        virtual String filenameExtension() const { return "bmp"; }
 
-    // Whether or not the size information has been decoded yet.
-    virtual bool isSizeAvailable() const;
+        // Whether or not the size information has been decoded yet.
+        virtual bool isSizeAvailable() const;
 
-    virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
-};
+        virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
+    };
 
-}
+} // namespace WebCore
 
 #endif
diff --git a/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp b/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
index 5b4b675..62d8b5b 100644
--- a/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
@@ -27,17 +27,14 @@
 #include "GIFImageDecoder.h"
 #include "GIFImageReader.h"
 
-#if PLATFORM(CAIRO) || PLATFORM(QT) || PLATFORM(WX)
-
 namespace WebCore {
 
-class GIFImageDecoderPrivate
-{
+class GIFImageDecoderPrivate {
 public:
     GIFImageDecoderPrivate(GIFImageDecoder* decoder = 0)
         : m_reader(decoder)
+        , m_readOffset(0)
     {
-        m_readOffset = 0;
     }
 
     ~GIFImageDecoderPrivate()
@@ -45,11 +42,11 @@
         m_reader.close();
     }
 
-    bool decode(const Vector<char>& data, 
+    bool decode(SharedBuffer* data, 
                 GIFImageDecoder::GIFQuery query = GIFImageDecoder::GIFFullQuery,
                 unsigned int haltFrame = -1)
     {
-        return m_reader.read((const unsigned char*)data.data() + m_readOffset, data.size() - m_readOffset, 
+        return m_reader.read((const unsigned char*)data->data() + m_readOffset, data->size() - m_readOffset, 
                              query,
                              haltFrame);
     }
@@ -61,7 +58,8 @@
 
     bool isTransparent() const { return m_reader.frame_reader->is_transparent; }
 
-    void getColorMap(unsigned char*& map, unsigned& size) const {
+    void getColorMap(unsigned char*& map, unsigned& size) const
+    {
         if (m_reader.frame_reader->is_local_colormap_defined) {
             map = m_reader.frame_reader->local_colormap;
             size = (unsigned)m_reader.frame_reader->local_colormap_size;
@@ -86,8 +84,11 @@
 };
 
 GIFImageDecoder::GIFImageDecoder()
-: m_frameCountValid(true), m_repetitionCount(cAnimationLoopOnce), m_reader(0)
-{}
+    : m_frameCountValid(true)
+    , m_repetitionCount(cAnimationLoopOnce)
+    , m_reader(0)
+{
+}
 
 GIFImageDecoder::~GIFImageDecoder()
 {
@@ -139,7 +140,10 @@
         // state, but for now we just crawl all the data.  Note that this is no worse than what
         // ImageIO does on Mac right now (it also crawls all the data again).
         GIFImageDecoderPrivate reader;
-        reader.decode(m_data->buffer(), GIFFrameCountQuery);
+        // This function may fail, but we want to keep any partial data it may
+        // have decoded, so don't mark it is invalid. If there is an overflow
+        // or some serious error, m_failed will have gotten set for us.
+        reader.decode(m_data.get(), GIFFrameCountQuery);
         m_frameCountValid = true;
         m_frameBufferCache.resize(reader.frameCount());
     }
@@ -173,13 +177,12 @@
 
 RGBA32Buffer* GIFImageDecoder::frameBufferAtIndex(size_t index)
 {
-    if (index >= frameCount())
+    if (index >= static_cast<size_t>(frameCount()))
         return 0;
 
     RGBA32Buffer& frame = m_frameBufferCache[index];
     if (frame.status() != RGBA32Buffer::FrameComplete && m_reader)
-        // Decode this frame.
-        decode(GIFFullQuery, index+1);
+        decode(GIFFullQuery, index + 1); // Decode this frame.
     return &frame;
 }
 
@@ -239,7 +242,7 @@
     if (m_failed)
         return;
 
-    m_failed = !m_reader->decode(m_data->buffer(), query, haltAtFrame);
+    m_failed = !m_reader->decode(m_data.get(), query, haltAtFrame);
     
     if (m_failed) {
         delete m_reader;
@@ -266,10 +269,10 @@
                       m_reader->frameWidth(), m_reader->frameHeight());
 
     // Make sure the frameRect doesn't extend past the bottom-right of the buffer.
-    if (frameRect.right() > m_size.width())
-        frameRect.setWidth(m_size.width() - m_reader->frameXOffset());
-    if (frameRect.bottom() > m_size.height())
-        frameRect.setHeight(m_size.height() - m_reader->frameYOffset());
+    if (frameRect.right() > size().width())
+        frameRect.setWidth(size().width() - m_reader->frameXOffset());
+    if (frameRect.bottom() > size().height())
+        frameRect.setHeight(size().height() - m_reader->frameYOffset());
 
     RGBA32Buffer* const buffer = &m_frameBufferCache[frameIndex];
     buffer->setRect(frameRect);
@@ -287,14 +290,14 @@
         // first frame specifies this method, it will get treated like
         // DisposeOverwriteBgcolor below and reset to a completely empty image.)
         const RGBA32Buffer* prevBuffer = &m_frameBufferCache[--frameIndex];
-        ASSERT(prevBuffer->status() == RGBA32Buffer::FrameComplete);
         RGBA32Buffer::FrameDisposalMethod prevMethod =
             prevBuffer->disposalMethod();
-        while ((frameIndex > 0) &&
-                (prevMethod == RGBA32Buffer::DisposeOverwritePrevious)) {
+        while ((frameIndex > 0)
+               && (prevMethod == RGBA32Buffer::DisposeOverwritePrevious)) {
             prevBuffer = &m_frameBufferCache[--frameIndex];
             prevMethod = prevBuffer->disposalMethod();
         }
+        ASSERT(prevBuffer->status() == RGBA32Buffer::FrameComplete);
 
         if ((prevMethod == RGBA32Buffer::DisposeNotSpecified) ||
                 (prevMethod == RGBA32Buffer::DisposeKeep)) {
@@ -305,8 +308,8 @@
             // We want to clear the previous frame to transparent, without
             // affecting pixels in the image outside of the frame.
             const IntRect& prevRect = prevBuffer->rect();
-            if ((frameIndex == 0) ||
-                    prevRect.contains(IntRect(IntPoint(0, 0), m_size))) {
+            if ((frameIndex == 0)
+                || prevRect.contains(IntRect(IntPoint(0, 0), size()))) {
                 // Clearing the first frame, or a frame the size of the whole
                 // image, results in a completely empty image.
                 prepEmptyFrameBuffer(buffer);
@@ -321,7 +324,7 @@
                       buffer->setRGBA(*(currentRow + x), 0, 0, 0, 0);
               }
               if ((prevRect.width() > 0) && (prevRect.height() > 0))
-                buffer->setHasAlpha(true);
+                  buffer->setHasAlpha(true);
             }
         }
     }
@@ -335,7 +338,7 @@
 
 void GIFImageDecoder::prepEmptyFrameBuffer(RGBA32Buffer* buffer) const
 {
-    buffer->bytes().resize(m_size.width() * m_size.height());
+    buffer->bytes().resize(size().width() * size().height());
     buffer->bytes().fill(0);
     buffer->setHasAlpha(true);
 }
@@ -353,8 +356,8 @@
         initFrameBuffer(frameIndex);
 
     // Do nothing for bogus data.
-    if (rowBuffer == 0 || static_cast<int>(m_reader->frameYOffset() + rowNumber) >= m_size.height())
-      return;
+    if (rowBuffer == 0 || static_cast<int>(m_reader->frameYOffset() + rowNumber) >= size().height())
+        return;
 
     unsigned colorMapSize;
     unsigned char* colorMap;
@@ -369,12 +372,12 @@
     // within the overall image.  The rows we are decoding are within this
     // sub-rectangle.  This means that if the GIF frame's sub-rectangle is (x,y,w,h) then row 0 is really row
     // y, and each row goes from x to x+w.
-    unsigned dstPos = (m_reader->frameYOffset() + rowNumber) * m_size.width() + m_reader->frameXOffset();
+    unsigned dstPos = (m_reader->frameYOffset() + rowNumber) * size().width() + m_reader->frameXOffset();
     unsigned* dst = buffer.bytes().data() + dstPos;
-    unsigned* dstEnd = dst + m_size.width() - m_reader->frameXOffset();
+    unsigned* dstEnd = dst + size().width() - m_reader->frameXOffset();
     unsigned* currDst = dst;
     unsigned char* currentRowByte = rowBuffer;
-    
+
     while (currentRowByte != rowEnd && currDst < dstEnd) {
         if ((!m_reader->isTransparent() || *currentRowByte != m_reader->transparentPixel()) && *currentRowByte < colorMapSize) {
             unsigned colorIndex = *currentRowByte * 3;
@@ -401,14 +404,14 @@
     if (repeatCount > 1) {
         // Copy the row |repeatCount|-1 times.
         unsigned num = currDst - dst;
-        unsigned size = num * sizeof(unsigned);
-        unsigned width = m_size.width();
-        unsigned* end = buffer.bytes().data() + width * m_size.height();
+        unsigned data_size = num * sizeof(unsigned);
+        unsigned width = size().width();
+        unsigned* end = buffer.bytes().data() + width * size().height();
         currDst = dst + width;
         for (unsigned i = 1; i < repeatCount; i++) {
             if (currDst + num > end) // Protect against a buffer overrun from a bogus repeatCount.
                 break;
-            memcpy(currDst, dst, size);
+            memcpy(currDst, dst, data_size);
             currDst += width;
         }
     }
@@ -434,9 +437,9 @@
     if (!m_currentBufferSawAlpha) {
         // The whole frame was non-transparent, so it's possible that the entire
         // resulting buffer was non-transparent, and we can setHasAlpha(false).
-        if (buffer.rect().contains(IntRect(IntPoint(0, 0), m_size))) {
+        if (buffer.rect().contains(IntRect(IntPoint(0, 0), size())))
             buffer.setHasAlpha(false);
-        } else if (frameIndex > 0) {
+        else if (frameIndex > 0) {
             // Tricky case.  This frame does not have alpha only if everywhere
             // outside its rect doesn't have alpha.  To know whether this is
             // true, we check the start state of the frame -- if it doesn't have
@@ -446,9 +449,8 @@
             // don't affect the start state of this frame) the same way we do in
             // initFrameBuffer().
             const RGBA32Buffer* prevBuffer = &m_frameBufferCache[--frameIndex];
-            while ((frameIndex > 0) &&
-                    (prevBuffer->disposalMethod() ==
-                        RGBA32Buffer::DisposeOverwritePrevious))
+            while ((frameIndex > 0)
+                   && (prevBuffer->disposalMethod() == RGBA32Buffer::DisposeOverwritePrevious))
                 prevBuffer = &m_frameBufferCache[--frameIndex];
 
             // Now, if we're at a DisposeNotSpecified or DisposeKeep frame, then
@@ -459,10 +461,8 @@
             // The only remaining case is a DisposeOverwriteBgcolor frame.  If
             // it had no alpha, and its rect is contained in the current frame's
             // rect, we know the current frame has no alpha.
-            if ((prevBuffer->disposalMethod() ==
-                    RGBA32Buffer::DisposeOverwriteBgcolor) &&
-                    !prevBuffer->hasAlpha() &&
-                    buffer.rect().contains(prevBuffer->rect()))
+            if ((prevBuffer->disposalMethod() == RGBA32Buffer::DisposeOverwriteBgcolor)
+                && !prevBuffer->hasAlpha() && buffer.rect().contains(prevBuffer->rect()))
                 buffer.setHasAlpha(false);
         }
     }
@@ -476,6 +476,4 @@
     m_reader = 0;
 }
 
-}
-
-#endif // PLATFORM(CAIRO)
+} // namespace WebCore
diff --git a/WebCore/platform/image-decoders/gif/GIFImageDecoder.h b/WebCore/platform/image-decoders/gif/GIFImageDecoder.h
index 02b43a2..abb55a4 100644
--- a/WebCore/platform/image-decoders/gif/GIFImageDecoder.h
+++ b/WebCore/platform/image-decoders/gif/GIFImageDecoder.h
@@ -23,70 +23,69 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef GIF_DECODER_H_
-#define GIF_DECODER_H_
+#ifndef GIFImageDecoder_h
+#define GIFImageDecoder_h
 
 #include "ImageDecoder.h"
 
 namespace WebCore {
 
-class GIFImageDecoderPrivate;
+    class GIFImageDecoderPrivate;
 
-// This class decodes the GIF image format.
-class GIFImageDecoder : public ImageDecoder
-{
-public:
-    GIFImageDecoder();
-    ~GIFImageDecoder();
+    // This class decodes the GIF image format.
+    class GIFImageDecoder : public ImageDecoder {
+    public:
+        GIFImageDecoder();
+        ~GIFImageDecoder();
 
-    virtual String filenameExtension() const { return "gif"; }
+        virtual String filenameExtension() const { return "gif"; }
 
-    // Take the data and store it.
-    virtual void setData(SharedBuffer* data, bool allDataReceived);
+        // Take the data and store it.
+        virtual void setData(SharedBuffer* data, bool allDataReceived);
 
-    // Whether or not the size information has been decoded yet.
-    virtual bool isSizeAvailable() const;
+        // Whether or not the size information has been decoded yet.
+        virtual bool isSizeAvailable() const;
 
-    // The total number of frames for the image.  Will scan the image data for the answer
-    // (without necessarily decoding all of the individual frames).
-    virtual int frameCount();
+        // The total number of frames for the image.  Will scan the image data for the answer
+        // (without necessarily decoding all of the individual frames).
+        virtual int frameCount();
 
-    // The number of repetitions to perform for an animation loop.
-    virtual int repetitionCount() const;
+        // The number of repetitions to perform for an animation loop.
+        virtual int repetitionCount() const;
 
-    virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
+        virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
 
-    virtual void clearFrameBufferCache(size_t clearBeforeFrame);
+        virtual void clearFrameBufferCache(size_t clearBeforeFrame);
 
-    virtual unsigned frameDurationAtIndex(size_t index) { return 0; }
+        virtual unsigned frameDurationAtIndex(size_t index) { return 0; }
 
-    enum GIFQuery { GIFFullQuery, GIFSizeQuery, GIFFrameCountQuery };
+        enum GIFQuery { GIFFullQuery, GIFSizeQuery, GIFFrameCountQuery };
 
-    void decode(GIFQuery query, unsigned haltAtFrame) const;
+        void decode(GIFQuery, unsigned haltAtFrame) const;
 
-    // Callbacks from the GIF reader.
-    void sizeNowAvailable(unsigned width, unsigned height);
-    void decodingHalted(unsigned bytesLeft);
-    void haveDecodedRow(unsigned frameIndex, unsigned char* rowBuffer, unsigned char* rowEnd, unsigned rowNumber, 
-                        unsigned repeatCount, bool writeTransparentPixels);
-    void frameComplete(unsigned frameIndex, unsigned frameDuration, RGBA32Buffer::FrameDisposalMethod disposalMethod);
-    void gifComplete();
+        // Callbacks from the GIF reader.
+        void sizeNowAvailable(unsigned width, unsigned height);
+        void decodingHalted(unsigned bytesLeft);
+        void haveDecodedRow(unsigned frameIndex, unsigned char* rowBuffer, unsigned char* rowEnd, unsigned rowNumber, 
+                            unsigned repeatCount, bool writeTransparentPixels);
+        void frameComplete(unsigned frameIndex, unsigned frameDuration, RGBA32Buffer::FrameDisposalMethod disposalMethod);
+        void gifComplete();
 
-private:
-    // Called to initialize the frame buffer with the given index, based on the
-    // previous frame's disposal method.
-    void initFrameBuffer(unsigned frameIndex);
+    private:
+        // Called to initialize the frame buffer with the given index, based on the
+        // previous frame's disposal method.
+        void initFrameBuffer(unsigned frameIndex);
 
-    // A helper for initFrameBuffer(), this sets the size of the buffer, and
-    // fills it with transparent pixels.
-    void prepEmptyFrameBuffer(RGBA32Buffer* buffer) const;
+        // A helper for initFrameBuffer(), this sets the size of the buffer, and
+        // fills it with transparent pixels.
+        void prepEmptyFrameBuffer(RGBA32Buffer*) const;
 
-    bool m_frameCountValid;
-    bool m_currentBufferSawAlpha;
-    mutable int m_repetitionCount;
-    mutable GIFImageDecoderPrivate* m_reader;
-};
+        bool m_frameCountValid;
+        bool m_currentBufferSawAlpha;
+        mutable int m_repetitionCount;
+        mutable GIFImageDecoderPrivate* m_reader;
+    };
 
-}
+} // namespace WebCore
 
 #endif
diff --git a/WebCore/platform/image-decoders/gif/GIFImageReader.cpp b/WebCore/platform/image-decoders/gif/GIFImageReader.cpp
index 04347af..95ab40d 100644
--- a/WebCore/platform/image-decoders/gif/GIFImageReader.cpp
+++ b/WebCore/platform/image-decoders/gif/GIFImageReader.cpp
@@ -78,8 +78,6 @@
 #include <string.h>
 #include "GIFImageDecoder.h"
 
-#if PLATFORM(CAIRO) || PLATFORM(QT) || PLATFORM(WX)
-
 using WebCore::GIFImageDecoder;
 
 // Define the Mozilla macro setup so that we can leave the macros alone.
@@ -939,5 +937,3 @@
     clientptr->decodingHalted(0);
   return true;
 }
-
-#endif // PLATFORM(CAIRO)
diff --git a/WebCore/platform/image-decoders/gif/GIFImageReader.h b/WebCore/platform/image-decoders/gif/GIFImageReader.h
index 855e6be..f0d127f 100644
--- a/WebCore/platform/image-decoders/gif/GIFImageReader.h
+++ b/WebCore/platform/image-decoders/gif/GIFImageReader.h
@@ -35,8 +35,8 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-#ifndef _GIF_H_
-#define _GIF_H_
+#ifndef GIFImageReader_h
+#define GIFImageReader_h
 
 // Define ourselves as the clientPtr.  Mozilla just hacked their C++ callback class into this old C decoder,
 // so we will too.
@@ -168,7 +168,7 @@
     unsigned screen_width;       /* Logical screen width & height */
     unsigned screen_height;
     int global_colormap_size;   /* Size of global colormap array. */
-    int images_decoded;         /* Counts completed frames for animated GIFs */
+    unsigned images_decoded;    /* Counts completed frames for animated GIFs */
     int images_count;           /* Counted all frames seen so far (including incomplete frames) */
     int loop_count;             /* Netscape specific extension block to control
                                    the number of animation loops a GIF renders. */
@@ -213,4 +213,3 @@
 };
 
 #endif
-
diff --git a/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp b/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
index 019340d..5b1a88f 100644
--- a/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
@@ -26,8 +26,6 @@
 #include "config.h"
 #include "ICOImageDecoder.h"
 
-#if PLATFORM(CAIRO) || PLATFORM(QT) || PLATFORM(WX)
-
 namespace WebCore
 {
 
@@ -41,6 +39,4 @@
     return 0;
 }
 
-}
-
-#endif // PLATFORM(CAIRO)
+} // namespace WebCore
diff --git a/WebCore/platform/image-decoders/ico/ICOImageDecoder.h b/WebCore/platform/image-decoders/ico/ICOImageDecoder.h
index a4f3dbd..56a74c3 100644
--- a/WebCore/platform/image-decoders/ico/ICOImageDecoder.h
+++ b/WebCore/platform/image-decoders/ico/ICOImageDecoder.h
@@ -23,27 +23,26 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef ICO_DECODER_H_
-#define ICO_DECODER_H_
+#ifndef ICOImageDecoder_h
+#define ICOImageDecoder_h
 
 #include "ImageDecoder.h"
 
 namespace WebCore {
 
-class ICOImageReader;
+    class ICOImageReader;
 
-// This class decodes the ICO and CUR image formats.
-class ICOImageDecoder : public ImageDecoder
-{
-public:
-    virtual String filenameExtension() const { return "ico"; }
+    // This class decodes the ICO and CUR image formats.
+    class ICOImageDecoder : public ImageDecoder {
+    public:
+        virtual String filenameExtension() const { return "ico"; }
 
-    // Whether or not the size information has been decoded yet.
-    virtual bool isSizeAvailable() const;
+        // Whether or not the size information has been decoded yet.
+        virtual bool isSizeAvailable() const;
 
-    virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
-};
+        virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
+    };
 
-}
+} // namespace WebCore
 
 #endif
diff --git a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index 44e0e4c..38d90bd 100644
--- a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -40,30 +40,13 @@
 #include <assert.h>
 #include <stdio.h>
 
-#if PLATFORM(CAIRO) || PLATFORM(QT) || PLATFORM(WX)
-
-#if COMPILER(MSVC)
-// Remove warnings from warning level 4.
-#pragma warning(disable : 4611) // warning C4611: interaction between '_setjmp' and C++ object destruction is non-portable
-
-// if ADDRESS_TAG_BIT is dfined, INT32 has been declared as a typedef in the PlatformSDK (BaseTsd.h),
-// so we need to stop jpeglib.h from trying to #define it 
-// see here for more info: http://www.cygwin.com/ml/cygwin/2004-07/msg01051.html
-# if defined(ADDRESS_TAG_BIT) && !defined(XMD_H)
-#  define XMD_H
-#  define VTK_JPEG_XMD_H
-# endif
-#endif // COMPILER(MSVC)
-
 extern "C" {
 #include "jpeglib.h"
 }
 
 #if COMPILER(MSVC)
-# if defined(VTK_JPEG_XMD_H)
-#  undef VTK_JPEG_XMD_H
-#  undef XMD_H
-# endif
+// Remove warnings from warning level 4.
+#pragma warning(disable : 4611) // warning C4611: interaction between '_setjmp' and C++ object destruction is non-portable
 #endif // COMPILER(MSVC)
 
 #include <setjmp.h>
@@ -482,7 +465,7 @@
     if (buffer.status() == RGBA32Buffer::FrameEmpty) {
         // Let's resize our buffer now to the correct width/height.
         RGBA32Array& bytes = buffer.bytes();
-        bytes.resize(m_size.width() * m_size.height());
+        bytes.resize(size().width() * size().height());
 
         // Update our status to be partially complete.
         buffer.setStatus(RGBA32Buffer::FramePartial);
@@ -503,7 +486,7 @@
         if (jpeg_read_scanlines(info, samples, 1) != 1)
             return false;
         JSAMPLE *j1 = samples[0];
-        for (unsigned i = 0; i < info->output_width; ++i) {
+        for (unsigned x = 0; x < info->output_width; ++x) {
             unsigned r = *j1++;
             unsigned g = *j1++;
             unsigned b = *j1++;
@@ -527,5 +510,3 @@
 }
 
 }
-
-#endif // PLATFORM(CAIRO)
diff --git a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
index b4d7b2a..c01bb5e 100644
--- a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
+++ b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
@@ -23,52 +23,51 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JPEG_DECODER_H_
-#define JPEG_DECODER_H_
+#ifndef JPEGImageDecoder_h
+#define JPEGImageDecoder_h
 
 #include "ImageDecoder.h"
 
 namespace WebCore {
 
-class JPEGImageReader;
+    class JPEGImageReader;
 
-// This class decodes the JPEG image format.
-class JPEGImageDecoder : public ImageDecoder
-{
-public:
-    JPEGImageDecoder();
-    ~JPEGImageDecoder();
+    // This class decodes the JPEG image format.
+    class JPEGImageDecoder : public ImageDecoder {
+    public:
+        JPEGImageDecoder();
+        ~JPEGImageDecoder();
 
-    virtual String filenameExtension() const { return "jpg"; }
+        virtual String filenameExtension() const { return "jpg"; }
 
-    // Take the data and store it.
-    virtual void setData(SharedBuffer* data, bool allDataReceived);
+        // Take the data and store it.
+        virtual void setData(SharedBuffer* data, bool allDataReceived);
 
-    // Whether or not the size information has been decoded yet.
-    virtual bool isSizeAvailable() const;
+        // Whether or not the size information has been decoded yet.
+        virtual bool isSizeAvailable() const;
 
-    virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
-    
-    virtual bool supportsAlpha() const { return false; }
+        virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
+        
+        virtual bool supportsAlpha() const { return false; }
 
-    void decode(bool sizeOnly = false) const;
+        void decode(bool sizeOnly = false) const;
 
-    JPEGImageReader* reader() { return m_reader; }
+        JPEGImageReader* reader() { return m_reader; }
 
-    void setSize(int width, int height) {
-        if (!m_sizeAvailable) {
-            m_sizeAvailable = true;
-            m_size = IntSize(width, height);
+        void setSize(int width, int height) {
+            if (!m_sizeAvailable) {
+                m_sizeAvailable = true;
+                m_size = IntSize(width, height);
+            }
         }
-    }
 
-    bool outputScanlines();
-    void jpegComplete();
+        bool outputScanlines();
+        void jpegComplete();
 
-private:
-    mutable JPEGImageReader* m_reader;
-};
+    private:
+        mutable JPEGImageReader* m_reader;
+    };
 
-}
+} // namespace WebCore
 
 #endif
diff --git a/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp b/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
index 17143b1..dead8ca 100644
--- a/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
@@ -40,12 +40,10 @@
 #include "png.h"
 #include "assert.h"
 
-#if PLATFORM(CAIRO) || PLATFORM(QT) || PLATFORM(WX)
-
 #if COMPILER(MSVC)
 // Remove warnings from warning level 4.
 #pragma warning(disable : 4611) // warning C4611: interaction between '_setjmp' and C++ object destruction is non-portable
-#endif
+#endif // COMPILER(MSVC)
 
 namespace WebCore {
 
@@ -55,7 +53,7 @@
 const double cInverseGamma = 0.45455;
 
 // Protect against large PNGs. See Mozilla's bug #251381 for more info.
-const long cMaxPNGSize = 1000000L;
+const unsigned long cMaxPNGSize = 1000000UL;
 
 // Called if the decoding of the image fails.
 static void PNGAPI decodingFailed(png_structp png_ptr, png_const_charp error_msg);
@@ -78,9 +76,12 @@
 {
 public:
     PNGImageReader(PNGImageDecoder* decoder)
-    : m_readOffset(0), m_decodingSizeOnly(false), m_interlaceBuffer(0), m_hasAlpha(0)
+        : m_readOffset(0)
+        , m_decodingSizeOnly(false)
+        , m_interlaceBuffer(0)
+        , m_hasAlpha(0)
     {
-        m_png = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, decodingFailed, decodingWarning);
+        m_png = png_create_read_struct(PNG_LIBPNG_VER_STRING, 0, decodingFailed, decodingWarning);
         m_info = png_create_info_struct(m_png);
         png_set_progressive_read_fn(m_png, decoder, headerAvailable, rowAvailable, pngComplete);
     }
@@ -92,8 +93,9 @@
 
     void close() {
         if (m_png && m_info)
-            png_destroy_read_struct(&m_png, &m_info, 0);
+            png_destroy_read_struct(&m_png, &m_info, 0);  // Will zero the pointers.
         delete []m_interlaceBuffer;
+        m_interlaceBuffer = 0;
         m_readOffset = 0;
     }
 
@@ -139,7 +141,7 @@
 };
 
 PNGImageDecoder::PNGImageDecoder()
-: m_reader(0)
+    : m_reader(0)
 {
     m_frameBufferCache.resize(1);
 }
@@ -224,6 +226,10 @@
     static_cast<PNGImageDecoder*>(png_get_progressive_ptr(png))->headerAvailable();
 }
 
+void PNGImageDecoder::decodingFailed() {
+    m_failed = true;
+}
+
 void PNGImageDecoder::headerAvailable()
 {
     png_structp png = reader()->pngPtr();
@@ -312,16 +318,16 @@
     if (buffer.status() == RGBA32Buffer::FrameEmpty) {
         // Let's resize our buffer now to the correct width/height.
         RGBA32Array& bytes = buffer.bytes();
-        bytes.resize(m_size.width() * m_size.height());
+        bytes.resize(size().width() * size().height());
 
         // Update our status to be partially complete.
         buffer.setStatus(RGBA32Buffer::FramePartial);
 
         // For PNGs, the frame always fills the entire image.
-        buffer.setRect(IntRect(0, 0, m_size.width(), m_size.height()));
+        buffer.setRect(IntRect(0, 0, size().width(), size().height()));
 
         if (reader()->pngPtr()->interlaced)
-            reader()->createInterlaceBuffer((reader()->hasAlpha() ? 4 : 3) * m_size.width() * m_size.height());
+            reader()->createInterlaceBuffer((reader()->hasAlpha() ? 4 : 3) * size().width() * size().height());
     }
 
     if (rowBuffer == 0)
@@ -361,17 +367,17 @@
     png_bytep row;
     png_bytep interlaceBuffer = reader()->interlaceBuffer();
     if (interlaceBuffer) {
-        row = interlaceBuffer + (rowIndex * colorChannels * m_size.width());
+        row = interlaceBuffer + (rowIndex * colorChannels * size().width());
         png_progressive_combine_row(png, row, rowBuffer);
     }
     else
         row = rowBuffer;
 
     // Copy the data into our buffer.
-    int width = m_size.width();
+    int width = size().width();
     unsigned* dst = buffer.bytes().data() + rowIndex * width;
     bool sawAlpha = false;
-    for (int i = 0; i < width; i++) {
+    for (int x = 0; x < width; x++) {
         unsigned red = *row++;
         unsigned green = *row++;
         unsigned blue = *row++;
@@ -398,6 +404,4 @@
     buffer.setStatus(RGBA32Buffer::FrameComplete);
 }
 
-}
-
-#endif // PLATFORM(CAIRO)
+} // namespace WebCore
diff --git a/WebCore/platform/image-decoders/png/PNGImageDecoder.h b/WebCore/platform/image-decoders/png/PNGImageDecoder.h
index 8c73785..c5264fd 100644
--- a/WebCore/platform/image-decoders/png/PNGImageDecoder.h
+++ b/WebCore/platform/image-decoders/png/PNGImageDecoder.h
@@ -23,46 +23,45 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef PNG_DECODER_H_
-#define PNG_DECODER_H_
+#ifndef PNGImageDecoder_h
+#define PNGImageDecoder_h
 
 #include "ImageDecoder.h"
 
 namespace WebCore {
 
-class PNGImageReader;
+    class PNGImageReader;
 
-// This class decodes the PNG image format.
-class PNGImageDecoder : public ImageDecoder
-{
-public:
-    PNGImageDecoder();
-    ~PNGImageDecoder();
+    // This class decodes the PNG image format.
+    class PNGImageDecoder : public ImageDecoder {
+    public:
+        PNGImageDecoder();
+        ~PNGImageDecoder();
 
-    virtual String filenameExtension() const { return "png"; }
+        virtual String filenameExtension() const { return "png"; }
 
-    // Take the data and store it.
-    virtual void setData(SharedBuffer* data, bool allDataReceived);
+        // Take the data and store it.
+        virtual void setData(SharedBuffer* data, bool allDataReceived);
 
-    // Whether or not the size information has been decoded yet.
-    virtual bool isSizeAvailable() const;
+        // Whether or not the size information has been decoded yet.
+        virtual bool isSizeAvailable() const;
 
-    virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
+        virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
 
-    void decode(bool sizeOnly = false) const;
+        void decode(bool sizeOnly = false) const;
 
-    PNGImageReader* reader() { return m_reader; }
+        PNGImageReader* reader() { return m_reader; }
 
-    // Callbacks from libpng
-    void decodingFailed() { m_failed = true; }
-    void headerAvailable();
-    void rowAvailable(unsigned char* rowBuffer, unsigned rowIndex, int interlacePass);
-    void pngComplete();
+        // Callbacks from libpng
+        void decodingFailed();
+        void headerAvailable();
+        void rowAvailable(unsigned char* rowBuffer, unsigned rowIndex, int interlacePass);
+        void pngComplete();
 
-private:
-    mutable PNGImageReader* m_reader;
-};
+    private:
+        mutable PNGImageReader* m_reader;
+    };
 
-}
+} // namespace WebCore
 
 #endif
diff --git a/WebCore/platform/image-decoders/skia/GIFImageDecoder.cpp b/WebCore/platform/image-decoders/skia/GIFImageDecoder.cpp
index 2d77943..c03452a 100644
--- a/WebCore/platform/image-decoders/skia/GIFImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/skia/GIFImageDecoder.cpp
@@ -126,7 +126,7 @@
         decode(GIFSizeQuery, 0);
     }
 
-    return !m_failed && ImageDecoder::isSizeAvailable();
+    return ImageDecoder::isSizeAvailable();
 }
 
 // The total number of frames for the image.  Will scan the image data for the answer
@@ -183,7 +183,7 @@
 
     RGBA32Buffer& frame = m_frameBufferCache[index];
     if (frame.status() != RGBA32Buffer::FrameComplete && m_reader)
-        decode(GIFFullQuery, index+1); // Decode this frame.
+        decode(GIFFullQuery, index + 1); // Decode this frame.
     return &frame;
 }
 
diff --git a/WebCore/platform/image-decoders/skia/GIFImageReader.h b/WebCore/platform/image-decoders/skia/GIFImageReader.h
index aa3d717..f0d127f 100644
--- a/WebCore/platform/image-decoders/skia/GIFImageReader.h
+++ b/WebCore/platform/image-decoders/skia/GIFImageReader.h
@@ -167,11 +167,11 @@
     int version;                /* Either 89 for GIF89 or 87 for GIF87 */
     unsigned screen_width;       /* Logical screen width & height */
     unsigned screen_height;
-    int global_colormap_size;    /* Size of global colormap array. */
-    unsigned int images_decoded; /* Counts completed frames for animated GIFs */
-    int images_count;            /* Counted all frames seen so far (including incomplete frames) */
-    int loop_count;              /* Netscape specific extension block to control
-                                    the number of animation loops a GIF renders. */
+    int global_colormap_size;   /* Size of global colormap array. */
+    unsigned images_decoded;    /* Counts completed frames for animated GIFs */
+    int images_count;           /* Counted all frames seen so far (including incomplete frames) */
+    int loop_count;             /* Netscape specific extension block to control
+                                   the number of animation loops a GIF renders. */
     
     // Not really global, but convenient to locate here.
     int count;                  /* Remaining # bytes in sub-block */
diff --git a/WebCore/platform/image-decoders/skia/ImageDecoder.h b/WebCore/platform/image-decoders/skia/ImageDecoder.h
index cddb69b..c198420 100644
--- a/WebCore/platform/image-decoders/skia/ImageDecoder.h
+++ b/WebCore/platform/image-decoders/skia/ImageDecoder.h
@@ -33,8 +33,6 @@
 #include "PlatformString.h"
 #include "SharedBuffer.h"
 #include <wtf/Assertions.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
@@ -45,37 +43,8 @@
 
 namespace WebCore {
 
-    class RefCountedNativeImageSkia : public RefCounted<RefCountedNativeImageSkia> {
-    public:
-        static PassRefPtr<RefCountedNativeImageSkia> create()
-        {
-            return adoptRef(new RefCountedNativeImageSkia);
-        }
-
-        const NativeImageSkia& bitmap() const { return m_bitmap; }
-        NativeImageSkia& bitmap() { return m_bitmap; }
-
-    private:
-        RefCountedNativeImageSkia() {}
-        NativeImageSkia m_bitmap;
-    };
-
-    // The RGBA32Buffer object represents the decoded image data in RGBA32 format.
-    // This buffer is what all decoders write a single frame into.  Frames are then
-    // instantiated for drawing by being handed this buffer.
-    //
-    // The image data of an RGBA32Buffer is kept in an SkBitmapRef, a refcounting
-    // container for an SkBitmap.  In all normal cases, the refcount should be
-    // exactly one.  The exception happens when resizing the vector<RGBA32Buffer> in
-    // ImageDecoder::m_frameBufferCache, which copies all the buffers to the new
-    // vector, thus transiently incrementing the refcount to two.
-    //
-    // The choice to use an SkBitmapRef instead of an SkBitmap is not because of
-    // performance concerns -- SkBitmap refcounts its internal data anyway.  Rather,
-    // we need the aforementioned vector resize to preserve the exact underlying
-    // SkBitmap object, since we may have already given its address to
-    // BitmapImage::m_frames.  Using an SkBitmap would mean that after ImageDecoder
-    // resizes its vector, BitmapImage would be holding a pointer to garbage.
+    // The RGBA32Buffer object represents the decoded image data in RGBA32 format.  This buffer is what all
+    // decoders write a single frame into.  Frames are then instantiated for drawing by being handed this buffer.
     class RGBA32Buffer {
     public:
         enum FrameStatus { FrameEmpty, FramePartial, FrameComplete };
@@ -94,14 +63,12 @@
             , m_duration(0)
             , m_disposalMethod(DisposeNotSpecified)
         {
-            m_bitmapRef = RefCountedNativeImageSkia::create();
         }
 
         // This constructor doesn't create a new copy of the image data, it only
         // increases the ref count of the existing bitmap.
         RGBA32Buffer(const RGBA32Buffer& other)
         {
-            m_bitmapRef = RefCountedNativeImageSkia::create();
             operator=(other);
         }
 
@@ -120,18 +87,20 @@
             if (this == &other)
                 return *this;
 
-            m_bitmapRef = other.m_bitmapRef;
+            m_bitmap = other.m_bitmap;
+            // Keep the pixels locked since we will be writing directly into the
+            // bitmap throughout this object's lifetime.
+            m_bitmap.lockPixels();
             setRect(other.rect());
             setStatus(other.status());
             setDuration(other.duration());
             setDisposalMethod(other.disposalMethod());
-            setHasAlpha(other.hasAlpha());
             return *this;
         }
 
         void clear()
         {
-            m_bitmapRef = RefCountedNativeImageSkia::create();
+            m_bitmap.reset();
             m_status = FrameEmpty;
             // NOTE: Do not reset other members here; clearFrameBufferCache()
             // calls this to free the bitmap data, but other functions like
@@ -146,21 +115,13 @@
             if (this == &other)
                 return;
 
-            m_bitmapRef = RefCountedNativeImageSkia::create();
-            SkBitmap& bmp = bitmap();
-            const SkBitmap& otherBmp = other.bitmap();
-            bmp.setConfig(SkBitmap::kARGB_8888_Config, other.width(),
-                          other.height(), otherBmp.rowBytes());
-            bmp.allocPixels();
-            if (width() > 0 && height() > 0) {
-                memcpy(bmp.getAddr32(0, 0),
-                       otherBmp.getAddr32(0, 0),
-                       otherBmp.rowBytes() * height());
-            }
+            m_bitmap.reset();
+            const NativeImageSkia& otherBitmap = other.bitmap();
+            otherBitmap.copyTo(&m_bitmap, otherBitmap.config());
         }
 
-        NativeImageSkia& bitmap() { return m_bitmapRef->bitmap(); }
-        const NativeImageSkia& bitmap() const { return m_bitmapRef->bitmap(); }
+        NativeImageSkia& bitmap() { return m_bitmap; }
+        const NativeImageSkia& bitmap() const { return m_bitmap; }
 
         // Must be called before any pixels are written. Will return true on
         // success, false if the memory allocation fails.
@@ -168,37 +129,36 @@
         {
             // This function should only be called once, it will leak memory
             // otherwise.
-            SkBitmap& bmp = bitmap();
-            ASSERT(bmp.width() == 0 && bmp.height() == 0);
-            bmp.setConfig(SkBitmap::kARGB_8888_Config, width, height);
-            if (!bmp.allocPixels())
+            ASSERT(m_bitmap.width() == 0 && m_bitmap.height() == 0);
+            m_bitmap.setConfig(SkBitmap::kARGB_8888_Config, width, height);
+            if (!m_bitmap.allocPixels())
                 return false;  // Allocation failure, maybe the bitmap was too big.
                 
             // Clear the image.
-            bmp.eraseARGB(0, 0, 0, 0);
+            m_bitmap.eraseARGB(0, 0, 0, 0);
 
             return true;
         }
 
-        int width() const { return bitmap().width(); }
-        int height() const { return bitmap().height(); }
+        int width() const { return m_bitmap.width(); }
+        int height() const { return m_bitmap.height(); }
 
         const IntRect& rect() const { return m_rect; }
         FrameStatus status() const { return m_status; }
         unsigned duration() const { return m_duration; }
         FrameDisposalMethod disposalMethod() const { return m_disposalMethod; }
-        bool hasAlpha() const { return !bitmap().isOpaque(); }
+        bool hasAlpha() const { return !m_bitmap.isOpaque(); }
 
         void setRect(const IntRect& r) { m_rect = r; }
         void setStatus(FrameStatus s)
         {
             if (s == FrameComplete)
-                m_bitmapRef->bitmap().setDataComplete();  // Tell the bitmap it's done.
+                m_bitmap.setDataComplete();  // Tell the bitmap it's done.
             m_status = s;
         }
         void setDuration(unsigned duration) { m_duration = duration; }
         void setDisposalMethod(FrameDisposalMethod method) { m_disposalMethod = method; }
-        void setHasAlpha(bool alpha) { bitmap().setIsOpaque(!alpha); }
+        void setHasAlpha(bool alpha) { m_bitmap.setIsOpaque(!alpha); }
 
         static void setRGBA(uint32_t* dest, uint8_t r, uint8_t g, uint8_t b, uint8_t a)
         {
@@ -223,11 +183,11 @@
 
         void setRGBA(int x, int y, uint8_t r, uint8_t g, uint8_t b, uint8_t a)
         {
-            setRGBA(bitmap().getAddr32(x, y), r, g, b, a);
+            setRGBA(m_bitmap.getAddr32(x, y), r, g, b, a);
         }
 
     private:
-        RefPtr<RefCountedNativeImageSkia> m_bitmapRef;
+        NativeImageSkia m_bitmap;
         IntRect m_rect;    // The rect of the original specified frame within the overall buffer.
                            // This will always just be the entire buffer except for GIF frames
                            // whose original rect was smaller than the overall image size.
@@ -241,7 +201,12 @@
     // and the base class manages the RGBA32 frame cache.
     class ImageDecoder {
     public:
-        ImageDecoder() : m_failed(false), m_sizeAvailable(false)  {}
+        ImageDecoder()
+            : m_failed(false)
+            , m_sizeAvailable(false)
+        {
+        }
+
         virtual ~ImageDecoder() {}
 
         // The the filename extension usually associated with an undecoded image of this type.
diff --git a/WebCore/platform/image-decoders/skia/JPEGImageDecoder.cpp b/WebCore/platform/image-decoders/skia/JPEGImageDecoder.cpp
index 98f622e..ab74012 100644
--- a/WebCore/platform/image-decoders/skia/JPEGImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/skia/JPEGImageDecoder.cpp
@@ -99,7 +99,7 @@
         /* Allocate and initialize JPEG decompression object */
         jpeg_create_decompress(&m_info);
   
-        decoder_source_mgr* src = NULL;
+        decoder_source_mgr* src = 0;
         if (!m_info.src) {
             src = (decoder_source_mgr*)fastCalloc(sizeof(decoder_source_mgr), 1);
             if (!src) {
@@ -421,7 +421,7 @@
         decode(true);
     }
 
-    return !m_failed && ImageDecoder::isSizeAvailable();
+    return ImageDecoder::isSizeAvailable();
 }
 
 RGBA32Buffer* JPEGImageDecoder::frameBufferAtIndex(size_t index)
diff --git a/WebCore/platform/image-decoders/skia/PNGImageDecoder.cpp b/WebCore/platform/image-decoders/skia/PNGImageDecoder.cpp
index ec1ebbe..ad12b86 100644
--- a/WebCore/platform/image-decoders/skia/PNGImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/skia/PNGImageDecoder.cpp
@@ -72,9 +72,12 @@
 {
 public:
     PNGImageReader(PNGImageDecoder* decoder)
-    : m_readOffset(0), m_decodingSizeOnly(false), m_interlaceBuffer(0), m_hasAlpha(0)
+        : m_readOffset(0)
+        , m_decodingSizeOnly(false)
+        , m_interlaceBuffer(0)
+        , m_hasAlpha(0)
     {
-        m_png = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, decodingFailed, decodingWarning);
+        m_png = png_create_read_struct(PNG_LIBPNG_VER_STRING, 0, decodingFailed, decodingWarning);
         m_info = png_create_info_struct(m_png);
         png_set_progressive_read_fn(m_png, decoder, headerAvailable, rowAvailable, pngComplete);
     }
@@ -134,8 +137,9 @@
 };
 
 PNGImageDecoder::PNGImageDecoder()
-: m_reader(0)
-{}
+    : m_reader(0)
+{
+}
 
 PNGImageDecoder::~PNGImageDecoder()
 {
@@ -169,7 +173,7 @@
         decode(true);
     }
 
-    return !m_failed && ImageDecoder::isSizeAvailable();
+    return ImageDecoder::isSizeAvailable();
 }
 
 RGBA32Buffer* PNGImageDecoder::frameBufferAtIndex(size_t index)
@@ -305,8 +309,7 @@
 void rowAvailable(png_structp png, png_bytep rowBuffer,
                   png_uint_32 rowIndex, int interlacePass)
 {
-    static_cast<PNGImageDecoder*>(png_get_progressive_ptr(png))->rowAvailable(
-        rowBuffer, rowIndex, interlacePass);
+    static_cast<PNGImageDecoder*>(png_get_progressive_ptr(png))->rowAvailable(rowBuffer, rowIndex, interlacePass);
 }
 
 void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex, int interlacePass)
diff --git a/WebCore/platform/image-decoders/skia/XBMImageDecoder.h b/WebCore/platform/image-decoders/skia/XBMImageDecoder.h
index 44c6be2..cdcf8e6 100644
--- a/WebCore/platform/image-decoders/skia/XBMImageDecoder.h
+++ b/WebCore/platform/image-decoders/skia/XBMImageDecoder.h
@@ -31,7 +31,6 @@
 #ifndef XBMImageDecoder_h
 #define XBMImageDecoder_h
 
-#include "config.h"
 #include <string>
 #include "ImageDecoder.h"
 
diff --git a/WebCore/platform/image-decoders/xbm/XBMImageDecoder.cpp b/WebCore/platform/image-decoders/xbm/XBMImageDecoder.cpp
index 30c5589..3e8ae57 100644
--- a/WebCore/platform/image-decoders/xbm/XBMImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/xbm/XBMImageDecoder.cpp
@@ -26,8 +26,6 @@
 #include "config.h"
 #include "XBMImageDecoder.h"
  
-#if PLATFORM(CAIRO) || PLATFORM(QT) || PLATFORM(WX)
-
 namespace WebCore
 {
 
@@ -41,6 +39,4 @@
     return 0;
 }
 
-}
-
-#endif // PLATFORM(CAIRO)
+} // namespace WebCore
diff --git a/WebCore/platform/image-decoders/xbm/XBMImageDecoder.h b/WebCore/platform/image-decoders/xbm/XBMImageDecoder.h
index dc6d8d4..80cfb3f 100644
--- a/WebCore/platform/image-decoders/xbm/XBMImageDecoder.h
+++ b/WebCore/platform/image-decoders/xbm/XBMImageDecoder.h
@@ -23,27 +23,26 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef XBM_DECODER_H_
-#define XBM_DECODER_H_
+#ifndef XBMImageDecoder_h
+#define XBMImageDecoder_h
 
 #include "ImageDecoder.h"
 
 namespace WebCore {
 
-class XBMImageReader;
+    class XBMImageReader;
 
-// This class decodes the XBM image format.
-class XBMImageDecoder : public ImageDecoder
-{
-public:
-    virtual String filenameExtension() const { return "xbm"; }
+    // This class decodes the XBM image format.
+    class XBMImageDecoder : public ImageDecoder {
+    public:
+        virtual String filenameExtension() const { return "xbm"; }
 
-    // Whether or not the size information has been decoded yet.
-    virtual bool isSizeAvailable() const;
+        // Whether or not the size information has been decoded yet.
+        virtual bool isSizeAvailable() const;
 
-    virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
-};
+        virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
+    };
 
-}
+} // namespace WebCore
 
 #endif
diff --git a/WebCore/platform/mac/ClipboardMac.mm b/WebCore/platform/mac/ClipboardMac.mm
index cfa334b..d1b66a7 100644
--- a/WebCore/platform/mac/ClipboardMac.mm
+++ b/WebCore/platform/mac/ClipboardMac.mm
@@ -39,6 +39,10 @@
 #import "SecurityOrigin.h"
 #import "WebCoreSystemInterface.h"
 
+#ifdef BUILDING_ON_TIGER
+typedef unsigned NSUInteger;
+#endif
+
 namespace WebCore {
 
 ClipboardMac::ClipboardMac(bool forDragging, NSPasteboard *pasteboard, ClipboardAccessPolicy policy, Frame *frame)
@@ -121,9 +125,8 @@
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
     NSString *cocoaType = cocoaTypeFromMIMEType(type);
-    if (cocoaType) {
+    if (cocoaType)
         [m_pasteboard.get() setString:@"" forType:cocoaType];
-    }
 }
 
 void ClipboardMac::clearAllData()
@@ -136,57 +139,71 @@
     [m_pasteboard.get() declareTypes:[NSArray array] owner:nil];
 }
 
+static NSArray *absoluteURLsFromPasteboardFilenames(NSPasteboard* pasteboard, bool onlyFirstURL)
+{
+    NSArray *fileList = [pasteboard propertyListForType:NSFilenamesPboardType];
+
+    // FIXME: Why does this code need to guard against bad values on the pasteboard?
+    ASSERT(!fileList || [fileList isKindOfClass:[NSArray class]]);
+    if (!fileList || ![fileList isKindOfClass:[NSArray class]] || ![fileList count])
+        return nil;
+
+    NSUInteger count = onlyFirstURL ? 1 : [fileList count];
+    NSMutableArray *urls = [NSMutableArray array];
+    for (NSUInteger i = 0; i < count; i++) {
+        NSString *string = [fileList objectAtIndex:i];
+
+        ASSERT([string isKindOfClass:[NSString class]]);  // Added to understand why this if code is here
+        if (![string isKindOfClass:[NSString class]])
+            return nil; // Non-string object in the list, bail out!  FIXME: When can this happen?
+
+        NSURL *url = [NSURL fileURLWithPath:string];
+        [urls addObject:[url absoluteString]];
+    }
+    return urls;
+}
+
+static NSArray *absoluteURLsFromPasteboard(NSPasteboard* pasteboard, bool onlyFirstURL)
+{
+    // NOTE: We must always check [availableTypes containsObject:] before accessing pasteboard data
+    // or CoreFoundation will printf when there is not data of the corresponding type.
+    NSArray *availableTypes = [pasteboard types];
+
+    // Try NSFilenamesPboardType because it contains a list
+    if ([availableTypes containsObject:NSFilenamesPboardType]) {
+        if (NSArray* absoluteURLs = absoluteURLsFromPasteboardFilenames(pasteboard, onlyFirstURL))
+            return absoluteURLs;
+    }
+
+    // Fallback to NSURLPboardType (which is a single URL)
+    if ([availableTypes containsObject:NSURLPboardType]) {
+        if (NSURL *url = [NSURL URLFromPasteboard:pasteboard])
+            return [NSArray arrayWithObject:[url absoluteString]];
+    }
+
+    // No file paths on the pasteboard, return nil
+    return nil;
+}
+
 String ClipboardMac::getData(const String& type, bool& success) const
 {
     success = false;
     if (policy() != ClipboardReadable)
         return String();
-    
+
     NSString *cocoaType = cocoaTypeFromMIMEType(type);
     NSString *cocoaValue = nil;
-    NSArray *availableTypes = [m_pasteboard.get() types];
 
-    // Fetch the data in different ways for the different Cocoa types
-
+    // Grab the value off the pasteboard corresponding to the cocoaType
     if ([cocoaType isEqualToString:NSURLPboardType]) {
-        // When both URL and filenames are present, filenames is superior since it can contain a list.
-        // must check this or we get a printf from CF when there's no data of this type
-        if ([availableTypes containsObject:NSFilenamesPboardType]) {
-            NSArray *fileList = [m_pasteboard.get() propertyListForType:NSFilenamesPboardType];
-            if (fileList && [fileList isKindOfClass:[NSArray class]]) {
-                unsigned count = [fileList count];
-                if (count > 0) {
-                    if (type != "text/uri-list")
-                        count = 1;
-                    NSMutableString *urls = [NSMutableString string];
-                    unsigned i;
-                    for (i = 0; i < count; i++) {
-                        if (i > 0) {
-                            [urls appendString:@"\n"];
-                        }
-                        NSString *string = [fileList objectAtIndex:i];
-                        if (![string isKindOfClass:[NSString class]])
-                            break;
-                        NSURL *url = [NSURL fileURLWithPath:string];
-                        [urls appendString:[url absoluteString]];
-                    }
-                    if (i == count)
-                        cocoaValue = urls;
-                }
-            }
-        }
-        if (!cocoaValue) {
-            // must check this or we get a printf from CF when there's no data of this type
-            if ([availableTypes containsObject:NSURLPboardType]) {
-                NSURL *url = [NSURL URLFromPasteboard:m_pasteboard.get()];
-                if (url) {
-                    cocoaValue = [url absoluteString];
-                }
-            }
-        }
-    } else if (cocoaType) {        
+        // "URL" and "text/url-list" both map to NSURLPboardType in cocoaTypeFromMIMEType(), "URL" only wants the first URL
+        bool onlyFirstURL = (type == "URL");
+        NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get(), onlyFirstURL);
+        cocoaValue = [absoluteURLs componentsJoinedByString:@"\n"];
+    } else if ([cocoaType isEqualToString:NSStringPboardType]) {
+        cocoaValue = [[m_pasteboard.get() stringForType:cocoaType] precomposedStringWithCanonicalMapping];
+    } else if (cocoaType)
         cocoaValue = [m_pasteboard.get() stringForType:cocoaType];
-    }
 
     // Enforce changeCount ourselves for security.  We check after reading instead of before to be
     // sure it doesn't change between our testing the change count and accessing the data.
@@ -244,18 +261,15 @@
         return HashSet<String>();
 
     HashSet<String> result;
-    if (types) {
-        unsigned count = [types count];
-        unsigned i;
-        for (i = 0; i < count; i++) {
-            NSString *pbType = [types objectAtIndex:i];
-            if ([pbType isEqualToString:@"NeXT plain ascii pasteboard type"])
-                continue;   // skip this ancient type that gets auto-supplied by some system conversion
+    NSUInteger count = [types count];
+    for (NSUInteger i = 0; i < count; i++) {
+        NSString *pbType = [types objectAtIndex:i];
+        if ([pbType isEqualToString:@"NeXT plain ascii pasteboard type"])
+            continue;   // skip this ancient type that gets auto-supplied by some system conversion
 
-            String str = MIMETypeFromCocoaType(pbType);
-            if (!result.contains(str))
-                result.add(str);
-        }
+        String str = MIMETypeFromCocoaType(pbType);
+        if (!result.contains(str))
+            result.add(str);
     }
     return result;
 }
@@ -324,7 +338,7 @@
 {
     ASSERT(frame);
     if (Page* page = frame->page())
-        page->dragController()->client()->declareAndWriteDragImage(m_pasteboard.get(), [DOMElement _wrapElement:element], url, title, frame);
+        page->dragController()->client()->declareAndWriteDragImage(m_pasteboard.get(), kit(element), url, title, frame);
 }
     
 DragImageRef ClipboardMac::createDragImage(IntPoint& loc) const
diff --git a/WebCore/platform/mac/CookieJar.mm b/WebCore/platform/mac/CookieJar.mm
index 94b7d77..d8df601 100644
--- a/WebCore/platform/mac/CookieJar.mm
+++ b/WebCore/platform/mac/CookieJar.mm
@@ -27,6 +27,7 @@
 #import "CookieJar.h"
 
 #import "BlockExceptions.h"
+#import "Document.h"
 #import "KURL.h"
 #import <wtf/RetainPtr.h>
 
@@ -84,7 +85,7 @@
     return String();
 }
 
-void setCookies(Document*, const KURL& url, const KURL& policyBaseURL, const String& cookieStr)
+void setCookies(Document* document, const KURL& url, const String& cookieStr)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
@@ -99,7 +100,7 @@
 
     NSURL *cookieURL = url;    
     NSArray *cookies = [NSHTTPCookie cookiesWithResponseHeaderFields:[NSDictionary dictionaryWithObject:cookieString forKey:@"Set-Cookie"] forURL:cookieURL];
-    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookies:filterCookies(cookies).get() forURL:cookieURL mainDocumentURL:policyBaseURL];
+    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookies:filterCookies(cookies).get() forURL:cookieURL mainDocumentURL:document->firstPartyForCookies()];
 
     END_BLOCK_OBJC_EXCEPTIONS;
 }
diff --git a/WebCore/platform/mac/DragDataMac.mm b/WebCore/platform/mac/DragDataMac.mm
index 5cf2e14..a7b751c 100644
--- a/WebCore/platform/mac/DragDataMac.mm
+++ b/WebCore/platform/mac/DragDataMac.mm
@@ -124,7 +124,7 @@
 
 PassRefPtr<DocumentFragment> DragData::asFragment(Document*) const
 {
-    return [m_pasteboardHelper->fragmentFromPasteboard([m_platformDragData draggingPasteboard]) _documentFragment];
+    return core(m_pasteboardHelper->fragmentFromPasteboard([m_platformDragData draggingPasteboard]));
 }
     
 }
diff --git a/WebCore/platform/mac/GeolocationServiceMac.mm b/WebCore/platform/mac/GeolocationServiceMac.mm
index c21b02c..01eca4a 100644
--- a/WebCore/platform/mac/GeolocationServiceMac.mm
+++ b/WebCore/platform/mac/GeolocationServiceMac.mm
@@ -153,26 +153,36 @@
     UNUSED_PARAM(oldLocation);
 
     // Normalize
+    bool canProvideAltitude = true;
+    bool canProvideAltitudeAccuracy = true;
     double altitude = newLocation.altitude;
     double altitudeAccuracy = newLocation.verticalAccuracy;
     if (altitudeAccuracy < 0.0) {
-        altitudeAccuracy = 0.0;
-        altitude = 0.0;
+        canProvideAltitude = false;
+        canProvideAltitudeAccuracy = false;
     }
+    
+    bool canProvideSpeed = true;
     double speed = newLocation.speed;
     if (speed < 0.0)
-        speed = 0.0;
+        canProvideSpeed = false;
+
+    bool canProvideHeading = true;
     double heading = newLocation.course;
     if (heading < 0.0)
-        heading = 0.0;
+        canProvideHeading = false;
     
     WTF::RefPtr<WebCore::Coordinates> newCoordinates = WebCore::Coordinates::create(
                             newLocation.coordinate.latitude,
                             newLocation.coordinate.longitude,
+                            canProvideAltitude,
                             altitude,
                             newLocation.horizontalAccuracy,
+                            canProvideAltitudeAccuracy,
                             altitudeAccuracy,
+                            canProvideHeading,
                             heading,
+                            canProvideSpeed,
                             speed);
     WTF::RefPtr<WebCore::Geoposition> newPosition = WebCore::Geoposition::create(
                              newCoordinates.release(),
diff --git a/WebCore/platform/mac/LocalizedStringsMac.mm b/WebCore/platform/mac/LocalizedStringsMac.mm
index d465758..ebb6d93 100644
--- a/WebCore/platform/mac/LocalizedStringsMac.mm
+++ b/WebCore/platform/mac/LocalizedStringsMac.mm
@@ -433,6 +433,110 @@
     return String();
 }
 
+String contextMenuItemTagCorrectSpellingAutomatically()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagCorrectSpellingAutomatically];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagSubstitutionsMenu()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagSubstitutionsMenu];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagShowSubstitutions(bool show)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagShowSubstitutions:show];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagSmartCopyPaste()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagSmartCopyPaste];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagSmartQuotes()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagSmartQuotes];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagSmartDashes()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagSmartDashes];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagSmartLinks()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagSmartLinks];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagTextReplacement()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagTextReplacement];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagTransformationsMenu()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagTransformationsMenu];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagMakeUpperCase()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagMakeUpperCase];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagMakeLowerCase()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagMakeLowerCase];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagCapitalize()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagCapitalize];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String contextMenuItemTagChangeBack(const String& replacedString)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] contextMenuItemTagChangeBack:replacedString];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return replacedString;
+}
+    
 String contextMenuItemTagInspectElement()
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
diff --git a/WebCore/platform/mac/PasteboardMac.mm b/WebCore/platform/mac/PasteboardMac.mm
index 36b00f6..c0e43b3 100644
--- a/WebCore/platform/mac/PasteboardMac.mm
+++ b/WebCore/platform/mac/PasteboardMac.mm
@@ -139,7 +139,7 @@
         Pasteboard::generalPasteboard(); //Initialises pasteboard types
     ASSERT(selectedRange);
     
-    NSAttributedString *attributedString = [[[NSAttributedString alloc] _initWithDOMRange:[DOMRange _wrapRange:selectedRange]] autorelease];
+    NSAttributedString *attributedString = [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease];
 #ifdef BUILDING_ON_TIGER
     // 4930197: Mail overrides [WebHTMLView pasteboardTypesForSelection] in order to add another type to the pasteboard
     // after WebKit does.  On Tiger we must call this function so that Mail code will be executed, meaning that 
@@ -368,7 +368,7 @@
     
     if (allowPlainText && [types containsObject:NSStringPboardType]) {
         chosePlainText = true;
-        RefPtr<DocumentFragment> fragment = createFragmentFromText(context.get(), [m_pasteboard.get() stringForType:NSStringPboardType]);
+        RefPtr<DocumentFragment> fragment = createFragmentFromText(context.get(), [[m_pasteboard.get() stringForType:NSStringPboardType] precomposedStringWithCanonicalMapping]);
         if (fragment)
             return fragment.release();
     }
diff --git a/WebCore/platform/mac/PlatformMouseEventMac.mm b/WebCore/platform/mac/PlatformMouseEventMac.mm
index 8979124..74f694e 100644
--- a/WebCore/platform/mac/PlatformMouseEventMac.mm
+++ b/WebCore/platform/mac/PlatformMouseEventMac.mm
@@ -68,12 +68,12 @@
     }
 }
 
-IntPoint globalPoint(const NSPoint& windowPoint, NSWindow* window)
+IntPoint globalPoint(const NSPoint& windowPoint, NSWindow *window)
 {
     return IntPoint(flipScreenPoint([window convertBaseToScreen:windowPoint], screenForWindow(window)));
 }
 
-IntPoint pointForEvent(NSEvent *event)
+IntPoint pointForEvent(NSEvent *event, NSView *windowView)
 {
     switch ([event type]) {
         case NSLeftMouseDown:
@@ -86,11 +86,14 @@
         case NSOtherMouseUp:
         case NSOtherMouseDragged:
         case NSMouseMoved:
-        case NSScrollWheel:
-            // Note: This has its origin at the bottom left of the window.
-            // The Y coordinate gets flipped by ScrollView::viewportToContents.
-            // We should probably change both this and that to not use "bottom left origin" coordinates at all.
-            return IntPoint([event locationInWindow]);
+        case NSScrollWheel: {
+            // Note: This will have its origin at the bottom left of the window unless windowView is flipped.
+            // In those cases, the Y coordinate gets flipped by Widget::convertFromContainingWindow.
+            NSPoint location = [event locationInWindow];
+            if (windowView)
+                location = [windowView convertPoint:location fromView:nil];
+            return IntPoint(location);
+        }
         default:
             return IntPoint();
     }
@@ -139,8 +142,8 @@
     }
 }
 
-PlatformMouseEvent::PlatformMouseEvent(NSEvent* event)
-    : m_position(pointForEvent(event))
+PlatformMouseEvent::PlatformMouseEvent(NSEvent* event, NSView *windowView)
+    : m_position(pointForEvent(event, windowView))
     , m_globalPosition(globalPointForEvent(event))
     , m_button(mouseButtonForEvent(event))
     , m_eventType(mouseEventForNSEvent(event))
diff --git a/WebCore/platform/mac/RuntimeApplicationChecks.h b/WebCore/platform/mac/RuntimeApplicationChecks.h
new file mode 100644
index 0000000..44eedfa
--- /dev/null
+++ b/WebCore/platform/mac/RuntimeApplicationChecks.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RuntimeApplicationChecks_h
+#define RuntimeApplicationChecks_h
+
+namespace WebCore {
+
+bool applicationIsAppleMail();
+bool applicationIsSafari();
+
+} // namespace WebCore
+
+#endif // RuntimeApplicationChecks_h
diff --git a/WebCore/platform/mac/RuntimeApplicationChecks.mm b/WebCore/platform/mac/RuntimeApplicationChecks.mm
new file mode 100644
index 0000000..1670185
--- /dev/null
+++ b/WebCore/platform/mac/RuntimeApplicationChecks.mm
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "RuntimeApplicationChecks.h"
+
+
+namespace WebCore {
+
+bool applicationIsAppleMail()
+{
+    static const bool isAppleMail = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.apple.mail"];
+    return isAppleMail;
+}
+
+bool applicationIsSafari()
+{
+    static const bool isSafari = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.apple.Safari"];
+    return isSafari;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/mac/ScrollbarThemeMac.mm b/WebCore/platform/mac/ScrollbarThemeMac.mm
index 22bfe46..759a6e1 100644
--- a/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -26,14 +26,9 @@
 #include "config.h"
 #include "ScrollbarThemeMac.h"
 
-#include "GraphicsContext.h"
 #include "ImageBuffer.h"
-#include "IntRect.h"
-#include "Page.h"
 #include "PlatformMouseEvent.h"
-#include "Scrollbar.h"
-#include "ScrollbarClient.h"
-#include "Settings.h"
+#include "ScrollView.h"
 #include <Carbon/Carbon.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/UnusedParam.h>
@@ -371,9 +366,12 @@
     trackInfo.attributes = 0;
     if (scrollbar->orientation() == HorizontalScrollbar)
         trackInfo.attributes |= kThemeTrackHorizontal;
-    trackInfo.enableState = scrollbar->client()->isActive() ? kThemeTrackActive : kThemeTrackInactive;
+
     if (!scrollbar->enabled())
         trackInfo.enableState = kThemeTrackDisabled;
+    else
+        trackInfo.enableState = scrollbar->client()->isActive() ? kThemeTrackActive : kThemeTrackInactive;
+
     if (hasThumb(scrollbar))
         trackInfo.attributes |= kThemeTrackShowThumb;
     else if (!hasButtons(scrollbar))
@@ -393,8 +391,8 @@
         bufferRect.intersect(damageRect);
         bufferRect.move(-scrollbar->frameRect().x(), -scrollbar->frameRect().y());
         
-        auto_ptr<ImageBuffer> imageBuffer = ImageBuffer::create(bufferRect.size(), false);
-        if (!imageBuffer.get())
+        OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(bufferRect.size(), false);
+        if (!imageBuffer)
             return true;
         
         HIThemeDrawTrack(&trackInfo, 0, imageBuffer->context()->platformContext(), kHIThemeOrientationNormal);
diff --git a/WebCore/platform/network/cf/ResourceResponseCFNet.h b/WebCore/platform/mac/SuddenTermination.mm
similarity index 69%
copy from WebCore/platform/network/cf/ResourceResponseCFNet.h
copy to WebCore/platform/mac/SuddenTermination.mm
index 27144c6..513d01b 100644
--- a/WebCore/platform/network/cf/ResourceResponseCFNet.h
+++ b/WebCore/platform/mac/SuddenTermination.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,30 +10,36 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ResourceResponseCFNet_h
-#define ResourceResponseCFNet_h
+#import "config.h"
+#import "SuddenTermination.h"
 
-typedef struct _CFURLResponse* CFURLResponseRef;
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 
 namespace WebCore {
 
-    class ResourceResponse;
-
-    void getResourceResponse(ResourceResponse& response, CFURLResponseRef cfResponse);
-
+void disableSuddenTermination()
+{
+    [[NSProcessInfo processInfo] disableSuddenTermination];
 }
 
-#endif // ResourceResponseCFNet_h
+void enableSuddenTermination()
+{
+    [[NSProcessInfo processInfo] enableSuddenTermination];
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/platform/mac/WebCoreSystemInterface.h b/WebCore/platform/mac/WebCoreSystemInterface.h
index 3feed69..cbe4aea 100644
--- a/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -117,8 +117,11 @@
 extern BOOL (*wkHitTestMediaUIPart)(int part, int themeStyle, CGRect bounds, CGPoint point);
 extern void (*wkMeasureMediaUIPart)(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
 extern void (*wkPopupMenu)(NSMenu*, NSPoint location, float width, NSView*, int selectedItem, NSFont*);
+extern unsigned (*wkQTIncludeOnlyModernMediaFileTypes)(void);
 extern int (*wkQTMovieDataRate)(QTMovie*);
 extern float (*wkQTMovieMaxTimeLoaded)(QTMovie*);
+extern NSString *(*wkQTMovieMaxTimeLoadedChangeNotification)(void);
+extern float (*wkQTMovieMaxTimeSeekable)(QTMovie*);
 extern void (*wkQTMovieViewSetDrawSynchronously)(QTMovieView*, BOOL);
 extern void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
 extern void (*wkSetDragImage)(NSImage*, NSPoint offset);
@@ -130,6 +133,7 @@
 extern void (*wkSignalCFReadStreamEnd)(CFReadStreamRef stream);
 extern void (*wkSignalCFReadStreamError)(CFReadStreamRef stream, CFStreamError *error);
 extern void (*wkSignalCFReadStreamHasBytes)(CFReadStreamRef stream);
+extern unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
 
 #ifndef BUILDING_ON_TIGER
 extern void (*wkGetGlyphsForCharacters)(CGFontRef, const UniChar[], CGGlyph[], size_t);
diff --git a/WebCore/platform/mac/WebCoreSystemInterface.mm b/WebCore/platform/mac/WebCoreSystemInterface.mm
index edd9d50..05d1da6 100644
--- a/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -51,8 +51,11 @@
 BOOL (*wkGetNSURLResponseMustRevalidate)(NSURLResponse *response);
 void (*wkGetWheelEventDeltas)(NSEvent*, float* deltaX, float* deltaY, BOOL* continuous);
 void (*wkPopupMenu)(NSMenu*, NSPoint location, float width, NSView*, int selectedItem, NSFont*);
+unsigned (*wkQTIncludeOnlyModernMediaFileTypes)(void);
 int (*wkQTMovieDataRate)(QTMovie*);
 float (*wkQTMovieMaxTimeLoaded)(QTMovie*);
+NSString *(*wkQTMovieMaxTimeLoadedChangeNotification)(void);
+float (*wkQTMovieMaxTimeSeekable)(QTMovie*);
 void (*wkQTMovieViewSetDrawSynchronously)(QTMovieView*, BOOL);
 void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
 void (*wkSetDragImage)(NSImage*, NSPoint offset);
@@ -74,6 +77,7 @@
 void (*wkSetNSURLConnectionDefersCallbacks)(NSURLConnection *, BOOL);
 void (*wkSetNSURLRequestShouldContentSniff)(NSMutableURLRequest *, BOOL);
 id (*wkCreateNSURLConnectionDelegateProxy)(void);
+unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
 
 #ifndef BUILDING_ON_TIGER
 void (*wkGetGlyphsForCharacters)(CGFontRef, const UniChar[], CGGlyph[], size_t);
diff --git a/WebCore/platform/mac/WebCoreTextRenderer.h b/WebCore/platform/mac/WebCoreTextRenderer.h
deleted file mode 100644
index 73753bc..0000000
--- a/WebCore/platform/mac/WebCoreTextRenderer.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#import <AppKit/NSFontManager.h>
-#import <CoreFoundation/CFString.h>
-
-#ifdef __OBJC__
-@class NSColor;
-@class NSFont;
-@class NSString;
-#endif
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-extern void WebCoreDrawTextAtPoint(const UniChar*, unsigned length, NSPoint, NSFont*, NSColor*);
-extern float WebCoreTextFloatWidth(const UniChar*, unsigned length, NSFont*);
-extern void WebCoreSetShouldUseFontSmoothing(bool);
-extern bool WebCoreShouldUseFontSmoothing();
-extern void WebCoreSetAlwaysUsesComplexTextCodePath(bool);
-extern bool WebCoreAlwaysUsesComplexTextCodePath();
-extern NSFont* WebCoreFindFont(NSString* familyName, NSFontTraitMask, int weight, int size);
-
-#ifdef __cplusplus
-}
-#endif
diff --git a/WebCore/platform/mac/WebCoreTextRenderer.mm b/WebCore/platform/mac/WebCoreTextRenderer.mm
deleted file mode 100644
index ab053ef..0000000
--- a/WebCore/platform/mac/WebCoreTextRenderer.mm
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#import "config.h"
-#import "WebCoreTextRenderer.h"
-
-#import "Font.h"
-#import "SimpleFontData.h"
-#import "GraphicsContext.h"
-#import "IntPoint.h"
-#import "WebFontCache.h"
-#import <AppKit/AppKit.h>
-
-using namespace WebCore;
-
-void WebCoreDrawTextAtPoint(const UniChar* buffer, unsigned length, NSPoint point, NSFont* font, NSColor* textColor)
-{
-    NSGraphicsContext *nsContext = [NSGraphicsContext currentContext];
-    CGContextRef cgContext = (CGContextRef)[nsContext graphicsPort];
-    GraphicsContext graphicsContext(cgContext);    
-    // Safari doesn't flip the NSGraphicsContext before calling WebKit, yet WebCore requires a flipped graphics context.
-    BOOL flipped = [nsContext isFlipped];
-    if (!flipped)
-        CGContextScaleCTM(cgContext, 1.0f, -1.0f);
-    
-    FontPlatformData f(font);
-    Font renderer(f, ![[NSGraphicsContext currentContext] isDrawingToScreen]);
-    TextRun run(buffer, length);
-    run.disableRoundingHacks();
-    CGFloat red, green, blue, alpha;
-    [[textColor colorUsingColorSpaceName:NSDeviceRGBColorSpace] getRed:&red green:&green blue:&blue alpha:&alpha];
-    graphicsContext.setFillColor(makeRGBA((int)(red * 255), (int)(green * 255), (int)(blue * 255), (int)(alpha * 255)));
-    renderer.drawText(&graphicsContext, run, FloatPoint(point.x, (flipped ? point.y : (-1.0f * point.y))));
-    if (!flipped)
-        CGContextScaleCTM(cgContext, 1.0f, -1.0f);
-}
-
-float WebCoreTextFloatWidth(const UniChar* buffer, unsigned length , NSFont* font)
-{
-    FontPlatformData f(font);
-    Font renderer(f, ![[NSGraphicsContext currentContext] isDrawingToScreen]);
-    TextRun run(buffer, length);
-    run.disableRoundingHacks();
-    return renderer.floatWidth(run);
-}
-
-static bool gShouldUseFontSmoothing = true;
-
-void WebCoreSetShouldUseFontSmoothing(bool smooth)
-{
-    gShouldUseFontSmoothing = smooth;
-}
-
-bool WebCoreShouldUseFontSmoothing()
-{
-    return gShouldUseFontSmoothing;
-}
-
-void WebCoreSetAlwaysUsesComplexTextCodePath(bool complex)
-{
-    Font::setCodePath(complex ? Font::Complex : Font::Auto);
-}
-
-bool WebCoreAlwaysUsesComplexTextCodePath()
-{
-    return Font::codePath() == Font::Complex;
-}
-
-NSFont* WebCoreFindFont(NSString* familyName, NSFontTraitMask traits, int weight, int size)
-{
-    return [WebFontCache fontWithFamily:familyName traits:traits weight:weight size:size];
-}
diff --git a/WebCore/platform/mac/WebFontCache.h b/WebCore/platform/mac/WebFontCache.h
index 8d3e4dd..380f271 100644
--- a/WebCore/platform/mac/WebFontCache.h
+++ b/WebCore/platform/mac/WebFontCache.h
@@ -32,4 +32,6 @@
 + (NSFont *)fontWithFamily:(NSString *)desiredFamily traits:(NSFontTraitMask)desiredTraits weight:(int)desiredWeight size:(float)size;
 + (void)getTraits:(Vector<unsigned>&)traitsMasks inFamily:(NSString *)desiredFamily;
 
+// This older version of the interface is relied upon by some clients. WebCore doesn't use it.
++ (NSFont *)fontWithFamily:(NSString *)desiredFamily traits:(NSFontTraitMask)desiredTraits size:(float)size;
 @end
diff --git a/WebCore/platform/mac/WebFontCache.mm b/WebCore/platform/mac/WebFontCache.mm
index ac70f06..22e6291 100644
--- a/WebCore/platform/mac/WebFontCache.mm
+++ b/WebCore/platform/mac/WebFontCache.mm
@@ -34,6 +34,7 @@
 #import <AppKit/AppKit.h>
 #import <Foundation/Foundation.h>
 #import <math.h>
+#import <wtf/UnusedParam.h>
 
 using namespace WebCore;
 
@@ -106,8 +107,13 @@
 // Workaround for <rdar://problem/5781372>.
 static inline void fixUpWeight(NSInteger& weight, NSString *fontName)
 {
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    UNUSED_PARAM(weight);
+    UNUSED_PARAM(fontName);
+#else
     if (weight == 3 && [fontName rangeOfString:@"ultralight" options:NSCaseInsensitiveSearch | NSBackwardsSearch | NSLiteralSearch].location != NSNotFound)
         weight = 2;
+#endif
 }
 
 static inline FontTraitsMask toTraitsMask(NSFontTraitMask appKitTraits, NSInteger appKitWeight)
@@ -300,4 +306,10 @@
     return [self internalFontWithFamily:desiredFamily traits:desiredTraits weight:desiredWeight size:size];
 }
 
++ (NSFont *)fontWithFamily:(NSString *)desiredFamily traits:(NSFontTraitMask)desiredTraits size:(float)size
+{
+    int desiredWeight = (desiredTraits & NSBoldFontMask) ? 9 : 5;
+    return [self fontWithFamily:desiredFamily traits:desiredTraits weight:desiredWeight size:size];
+}
+
 @end
diff --git a/WebCore/platform/mac/WheelEventMac.mm b/WebCore/platform/mac/WheelEventMac.mm
index 5821139..f380e3e 100644
--- a/WebCore/platform/mac/WheelEventMac.mm
+++ b/WebCore/platform/mac/WheelEventMac.mm
@@ -32,8 +32,8 @@
 
 namespace WebCore {
 
-PlatformWheelEvent::PlatformWheelEvent(NSEvent* event)
-    : m_position(pointForEvent(event))
+PlatformWheelEvent::PlatformWheelEvent(NSEvent* event, NSView *windowView)
+    : m_position(pointForEvent(event, windowView))
     , m_globalPosition(globalPointForEvent(event))
     , m_granularity(ScrollByPixelWheelEvent)
     , m_isAccepted(false)
diff --git a/WebCore/platform/mac/WidgetMac.mm b/WebCore/platform/mac/WidgetMac.mm
index ecd4f30..1aaf4b2 100644
--- a/WebCore/platform/mac/WidgetMac.mm
+++ b/WebCore/platform/mac/WidgetMac.mm
@@ -285,7 +285,9 @@
 
 IntPoint Widget::convertFromContainingWindow(const IntPoint& point) const
 {
-    if (!platformWidget() && parent()) {
+    if (!platformWidget()) {
+        if (!parent())
+            return point;
         IntPoint result = parent()->convertFromContainingWindow(point);
         result.move(parent()->scrollX() - x(), parent()->scrollY() - y());
         return result;
@@ -300,7 +302,9 @@
 
 IntRect Widget::convertFromContainingWindow(const IntRect& rect) const
 {
-    if (!platformWidget() && parent()) {
+    if (!platformWidget()) {
+        if (!parent())
+            return rect;
         IntRect result = parent()->convertFromContainingWindow(rect);
         result.move(parent()->scrollX() - x(), parent()->scrollY() - y());
         return result;
diff --git a/WebCore/platform/network/HTTPParsers.cpp b/WebCore/platform/network/HTTPParsers.cpp
index f36e9fb..e57401e 100644
--- a/WebCore/platform/network/HTTPParsers.cpp
+++ b/WebCore/platform/network/HTTPParsers.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
  *
  * Redistribution and use in source and binary forms, with or without
@@ -31,7 +31,11 @@
 #include "config.h"
 #include "HTTPParsers.h"
 
+#include "CString.h"
 #include "PlatformString.h"
+#include <wtf/DateMath.h>
+
+using namespace WTF;
 
 namespace WebCore {
 
@@ -40,12 +44,13 @@
 {
     int len = str.length();
 
-    if (fromHttpEquivMeta)
+    if (fromHttpEquivMeta) {
         while (pos != len && str[pos] <= ' ')
             ++pos;
-    else
+    } else {
         while (pos != len && (str[pos] == '\t' || str[pos] == ' '))
             ++pos;
+    }
 
     return pos != len;
 }
@@ -102,6 +107,11 @@
     }
 }
 
+double parseDate(const String& value)
+{
+    return parseDateFromNullTerminatedCharacters(value.utf8().data());
+}
+
 String filenameFromHTTPContentDisposition(const String& value)
 {
     Vector<String> keyValuePairs;
@@ -135,14 +145,33 @@
     Vector<UChar, 64> mimeType;
     unsigned length = mediaType.length();
     mimeType.reserveCapacity(length);
-    for (unsigned offset = 0; offset < length; offset++) {
-        UChar c = mediaType[offset];
+    for (unsigned i = 0; i < length; i++) {
+        UChar c = mediaType[i];
+
         if (c == ';')
             break;
-        else if (isSpaceOrNewline(c)) // FIXME: This seems wrong, " " is an invalid MIME type character according to RFC 2045.  bug 8644
+
+        // While RFC 2616 does not allow it, other browsers allow multiple values in the HTTP media
+        // type header field, Content-Type. In such cases, the media type string passed here may contain
+        // the multiple values separated by commas. For now, this code ignores text after the first comma,
+        // which prevents it from simply failing to parse such types altogether. Later for better
+        // compatibility we could consider using the first or last valid MIME type instead.
+        // See https://bugs.webkit.org/show_bug.cgi?id=25352 for more discussion.
+        if (c == ',')
+            break;
+
+        // FIXME: The following is not correct. RFC 2616 allows linear white space before and
+        // after the MIME type, but not within the MIME type itself. And linear white space
+        // includes only a few specific ASCII characters; a small subset of isSpaceOrNewline.
+        // See https://bugs.webkit.org/show_bug.cgi?id=8644 for a bug tracking part of this.
+        if (isSpaceOrNewline(c))
             continue;
+
         mimeType.append(c);
     }
+
+    if (mimeType.size() == length)
+        return mediaType;
     return String(mimeType.data(), mimeType.size());
 }
 
diff --git a/WebCore/platform/network/HTTPParsers.h b/WebCore/platform/network/HTTPParsers.h
index 28a9ce9..0648aee 100644
--- a/WebCore/platform/network/HTTPParsers.h
+++ b/WebCore/platform/network/HTTPParsers.h
@@ -34,6 +34,7 @@
     class String;
 
     bool parseHTTPRefresh(const String& refresh, bool fromHttpEquivMeta, double& delay, String& url);
+    double parseDate(const String&);
     String filenameFromHTTPContentDisposition(const String&); 
     String extractMIMETypeFromMediaType(const String&);
     String extractCharsetFromMediaType(const String&); 
diff --git a/WebCore/platform/network/ResourceHandle.cpp b/WebCore/platform/network/ResourceHandle.cpp
index 149411e..5a40b21 100644
--- a/WebCore/platform/network/ResourceHandle.cpp
+++ b/WebCore/platform/network/ResourceHandle.cpp
@@ -34,6 +34,8 @@
 
 namespace WebCore {
 
+static bool shouldForceContentSniffing;
+
 static bool portAllowed(const ResourceRequest&);
 
 ResourceHandle::ResourceHandle(const ResourceRequest& request, ResourceHandleClient* client, bool defersLoading,
@@ -45,6 +47,9 @@
 PassRefPtr<ResourceHandle> ResourceHandle::create(const ResourceRequest& request, ResourceHandleClient* client,
     Frame* frame, bool defersLoading, bool shouldContentSniff, bool mightDownloadFromHandle)
 {
+    if (shouldContentSniff)
+        shouldContentSniff = shouldContentSniffURL(request.url());
+
     RefPtr<ResourceHandle> newHandle(adoptRef(new ResourceHandle(request, client, defersLoading, shouldContentSniff, mightDownloadFromHandle)));
 
     if (!request.url().isValid()) {
@@ -178,6 +183,7 @@
         993,  // IMAP+SSL
         995,  // POP3+SSL
         2049, // NFS
+        3659, // apple-sasl / PasswordServer [Apple addition]
         4045, // lockd
         6000, // X11
     };
@@ -199,4 +205,24 @@
     return false;
 }
   
+bool ResourceHandle::shouldContentSniff() const
+{
+    return d->m_shouldContentSniff;
+}
+
+bool ResourceHandle::shouldContentSniffURL(const KURL& url)
+{
+#if PLATFORM(MAC)
+    if (shouldForceContentSniffing)
+        return true;
+#endif
+    // We shouldn't content sniff file URLs as their MIME type should be established via their extension.
+    return !url.protocolIs("file");
+}
+
+void ResourceHandle::forceContentSniffing()
+{
+    shouldForceContentSniffing = true;
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/network/ResourceHandle.h b/WebCore/platform/network/ResourceHandle.h
index e3038ca..3b27b00 100644
--- a/WebCore/platform/network/ResourceHandle.h
+++ b/WebCore/platform/network/ResourceHandle.h
@@ -28,6 +28,7 @@
 
 #include "AuthenticationChallenge.h"
 #include "HTTPHeaderMap.h"
+#include "ThreadableLoader.h"
 #include <wtf/OwnPtr.h>
 
 #if USE(SOUP)
@@ -103,7 +104,7 @@
     // FIXME: should not need the Frame
     static PassRefPtr<ResourceHandle> create(const ResourceRequest&, ResourceHandleClient*, Frame*, bool defersLoading, bool shouldContentSniff, bool mightDownloadFromHandle = false);
 
-    static void loadResourceSynchronously(const ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>& data, Frame* frame);
+    static void loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data, Frame* frame);
     static bool willLoadFromCache(ResourceRequest&);
 #if PLATFORM(MAC)
     static bool didSendBodyDataDelegateExists();
@@ -112,6 +113,7 @@
     ~ResourceHandle();
 
 #if PLATFORM(MAC) || USE(CFNETWORK)
+    void willSendRequest(ResourceRequest&, const ResourceResponse& redirectResponse);
     bool shouldUseCredentialStorage();
 #endif
 #if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL)
@@ -148,6 +150,11 @@
     PassRefPtr<SharedBuffer> bufferedData();
     static bool supportsBufferedData();
 
+    bool shouldContentSniff() const;
+    static bool shouldContentSniffURL(const KURL&);
+
+    static void forceContentSniffing();
+
 #if USE(WININET)
     void setHasReceivedResponse(bool = true);
     bool hasReceivedResponse() const;
diff --git a/WebCore/platform/network/ResourceHandleClient.h b/WebCore/platform/network/ResourceHandleClient.h
index 54c27d2..c99be54 100644
--- a/WebCore/platform/network/ResourceHandleClient.h
+++ b/WebCore/platform/network/ResourceHandleClient.h
@@ -79,8 +79,6 @@
         virtual bool shouldUseCredentialStorage(ResourceHandle*) { return false; }
         virtual void didReceiveAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge&) { }
         virtual void didCancelAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge&) { }
-        virtual void receivedCredential(ResourceHandle*, const AuthenticationChallenge&, const Credential&) { }
-        virtual void receivedRequestToContinueWithoutCredential(ResourceHandle*, const AuthenticationChallenge&) { }
         virtual void receivedCancellation(ResourceHandle*, const AuthenticationChallenge&) { }
 
 #if PLATFORM(MAC)        
diff --git a/WebCore/platform/network/ResourceHandleInternal.h b/WebCore/platform/network/ResourceHandleInternal.h
index c592a1a..b10c658 100644
--- a/WebCore/platform/network/ResourceHandleInternal.h
+++ b/WebCore/platform/network/ResourceHandleInternal.h
@@ -133,6 +133,7 @@
 #endif
 #if PLATFORM(MAC)
             , m_startWhenScheduled(false)
+            , m_needsSiteSpecificQuirks(false)
             , m_currentMacChallenge(nil)
 #elif USE(CFNETWORK)
             , m_currentCFChallenge(0)
@@ -142,6 +143,10 @@
 #endif
             , m_failureTimer(loader, &ResourceHandle::fireFailure)
         {
+            const KURL& url = m_request.url();
+            m_user = url.user();
+            m_pass = url.pass();
+            m_request.removeCredentials();
         }
         
         ~ResourceHandleInternal();
@@ -150,6 +155,10 @@
         ResourceHandleClient* m_client;
         
         ResourceRequest m_request;
+
+        // Suggested credentials for the current redirection step.
+        String m_user;
+        String m_pass;
         
         int status;
 
@@ -163,6 +172,7 @@
         RetainPtr<WebCoreResourceHandleAsDelegate> m_delegate;
         RetainPtr<id> m_proxy;
         bool m_startWhenScheduled;
+        bool m_needsSiteSpecificQuirks;
 #endif
 #if USE(WININET)
         HANDLE m_fileHandle;
@@ -210,6 +220,8 @@
 #endif
         QWebFrame* m_frame;
 #endif
+
+        // FIXME: The platform challenge is almost identical to the one stored in m_currentWebChallenge, but it has a different sender. We only need to store a sender reference here.
 #if PLATFORM(MAC)
         NSURLAuthenticationChallenge *m_currentMacChallenge;
 #endif
diff --git a/WebCore/platform/network/ResourceRequestBase.cpp b/WebCore/platform/network/ResourceRequestBase.cpp
index fd27718..bfa3dc6 100644
--- a/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/WebCore/platform/network/ResourceRequestBase.cpp
@@ -42,7 +42,7 @@
     request->setURL(data->m_url);
     request->setCachePolicy(data->m_cachePolicy);
     request->setTimeoutInterval(data->m_timeoutInterval);
-    request->setMainDocumentURL(data->m_mainDocumentURL);
+    request->setFirstPartyForCookies(data->m_firstPartyForCookies);
     request->setHTTPMethod(data->m_httpMethod);
 
     request->updateResourceRequest();
@@ -72,7 +72,7 @@
     data->m_url = url().copy();
     data->m_cachePolicy = cachePolicy();
     data->m_timeoutInterval = timeoutInterval();
-    data->m_mainDocumentURL = mainDocumentURL().copy();
+    data->m_firstPartyForCookies = firstPartyForCookies().copy();
     data->m_httpMethod = httpMethod().copy();
     data->m_httpHeaders.adopt(httpHeaderFields().copyData());
 
@@ -117,6 +117,16 @@
     m_platformRequestUpdated = false;
 }
 
+void ResourceRequestBase::removeCredentials()
+{
+    updateResourceRequest(); 
+
+    m_url.setUser(String());
+    m_url.setPass(String());
+
+    m_platformRequestUpdated = false;
+}
+
 ResourceRequestCachePolicy ResourceRequestBase::cachePolicy() const
 {
     updateResourceRequest(); 
@@ -151,18 +161,18 @@
         m_platformRequestUpdated = false;
 }
 
-const KURL& ResourceRequestBase::mainDocumentURL() const
+const KURL& ResourceRequestBase::firstPartyForCookies() const
 {
     updateResourceRequest(); 
     
-    return m_mainDocumentURL; 
+    return m_firstPartyForCookies;
 }
 
-void ResourceRequestBase::setMainDocumentURL(const KURL& mainDocumentURL)
+void ResourceRequestBase::setFirstPartyForCookies(const KURL& firstPartyForCookies)
 { 
     updateResourceRequest(); 
     
-    m_mainDocumentURL = mainDocumentURL; 
+    m_firstPartyForCookies = firstPartyForCookies;
     
     m_platformRequestUpdated = false;
 }
@@ -284,7 +294,7 @@
     if (a.timeoutInterval() != b.timeoutInterval())
         return false;
     
-    if (a.mainDocumentURL() != b.mainDocumentURL())
+    if (a.firstPartyForCookies() != b.firstPartyForCookies())
         return false;
     
     if (a.httpMethod() != b.httpMethod())
@@ -345,4 +355,13 @@
     m_resourceRequestUpdated = true;
 }
 
+#if !PLATFORM(MAC) && !USE(CFNETWORK)
+unsigned initializeMaximumHTTPConnectionCountPerHost()
+{
+    // This is used by the loader to control the number of issued parallel load requests. 
+    // Four seems to be a common default in HTTP frameworks.
+    return 4;
+}
+#endif
+
 }
diff --git a/WebCore/platform/network/ResourceRequestBase.h b/WebCore/platform/network/ResourceRequestBase.h
index 4fd57e1..2d87d6e 100644
--- a/WebCore/platform/network/ResourceRequestBase.h
+++ b/WebCore/platform/network/ResourceRequestBase.h
@@ -63,14 +63,16 @@
         const KURL& url() const;
         void setURL(const KURL& url);
 
+        void removeCredentials();
+
         ResourceRequestCachePolicy cachePolicy() const;
         void setCachePolicy(ResourceRequestCachePolicy cachePolicy);
         
         double timeoutInterval() const;
         void setTimeoutInterval(double timeoutInterval);
         
-        const KURL& mainDocumentURL() const;
-        void setMainDocumentURL(const KURL& mainDocumentURL);
+        const KURL& firstPartyForCookies() const;
+        void setFirstPartyForCookies(const KURL& firstPartyForCookies);
         
         const String& httpMethod() const;
         void setHTTPMethod(const String& httpMethod);
@@ -141,7 +143,7 @@
 
         ResourceRequestCachePolicy m_cachePolicy;
         double m_timeoutInterval;
-        KURL m_mainDocumentURL;
+        KURL m_firstPartyForCookies;
         String m_httpMethod;
         HTTPHeaderMap m_httpHeaderFields;
         Vector<String> m_responseContentDispositionEncodingFallbackArray;
@@ -165,7 +167,7 @@
 
         ResourceRequestCachePolicy m_cachePolicy;
         double m_timeoutInterval;
-        KURL m_mainDocumentURL;
+        KURL m_firstPartyForCookies;
 
         String m_httpMethod;
         OwnPtr<CrossThreadHTTPHeaderMapData> m_httpHeaders;
@@ -173,6 +175,8 @@
         RefPtr<FormData> m_httpBody;
         bool m_allowHTTPCookies;
     };
+    
+    unsigned initializeMaximumHTTPConnectionCountPerHost();
 
 } // namespace WebCore
 
diff --git a/WebCore/platform/network/ResourceResponseBase.cpp b/WebCore/platform/network/ResourceResponseBase.cpp
index 60c0097..965759e 100644
--- a/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/WebCore/platform/network/ResourceResponseBase.cpp
@@ -27,14 +27,45 @@
 #include "config.h"
 #include "ResourceResponseBase.h"
 
+#include "HTTPParsers.h"
 #include "ResourceResponse.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/MathExtras.h>
+#include <wtf/StdLibExtras.h>
 
 using namespace std;
 
 namespace WebCore {
 
 static void parseCacheHeader(const String& header, Vector<pair<String, String> >& result);
-static void parseCacheControlDirectiveValues(const String& directives, Vector<String>& result);
+
+ResourceResponseBase::ResourceResponseBase()  
+    : m_expectedContentLength(0)
+    , m_httpStatusCode(0)
+    , m_isNull(true)
+    , m_haveParsedCacheControlHeader(false)
+    , m_haveParsedAgeHeader(false)
+    , m_haveParsedDateHeader(false)
+    , m_haveParsedExpiresHeader(false)
+    , m_haveParsedLastModifiedHeader(false)
+{
+}
+
+ResourceResponseBase::ResourceResponseBase(const KURL& url, const String& mimeType, long long expectedLength, const String& textEncodingName, const String& filename)
+    : m_url(url)
+    , m_mimeType(mimeType)
+    , m_expectedContentLength(expectedLength)
+    , m_textEncodingName(textEncodingName)
+    , m_suggestedFilename(filename)
+    , m_httpStatusCode(0)
+    , m_isNull(false)
+    , m_haveParsedCacheControlHeader(false)
+    , m_haveParsedAgeHeader(false)
+    , m_haveParsedDateHeader(false)
+    , m_haveParsedExpiresHeader(false)
+    , m_haveParsedLastModifiedHeader(false)
+{
+}
 
 auto_ptr<ResourceResponse> ResourceResponseBase::adopt(auto_ptr<CrossThreadResourceResponseData> data)
 {
@@ -50,12 +81,8 @@
 
     response->lazyInit();
     response->m_httpHeaderFields.adopt(std::auto_ptr<CrossThreadHTTPHeaderMapData>(data->m_httpHeaders.release()));
-
-    response->setExpirationDate(data->m_expirationDate);
     response->setLastModifiedDate(data->m_lastModifiedDate);
-    response->m_haveParsedCacheControl = data->m_haveParsedCacheControl;
-    response->m_cacheControlContainsMustRevalidate = data->m_cacheControlContainsMustRevalidate;
-    response->m_cacheControlContainsNoCache = data->m_cacheControlContainsNoCache;
+
     return response;
 }
 
@@ -70,11 +97,7 @@
     data->m_httpStatusCode = httpStatusCode();
     data->m_httpStatusText = httpStatusText().copy();
     data->m_httpHeaders.adopt(httpHeaderFields().copyData());
-    data->m_expirationDate = expirationDate();
     data->m_lastModifiedDate = lastModifiedDate();
-    data->m_haveParsedCacheControl = m_haveParsedCacheControl;
-    data->m_cacheControlContainsMustRevalidate = m_cacheControlContainsMustRevalidate;
-    data->m_cacheControlContainsNoCache = m_cacheControlContainsNoCache;
     return data;
 }
 
@@ -201,9 +224,24 @@
 void ResourceResponseBase::setHTTPHeaderField(const AtomicString& name, const String& value)
 {
     lazyInit();
+    
+    DEFINE_STATIC_LOCAL(const AtomicString, ageHeader, ("age"));
+    DEFINE_STATIC_LOCAL(const AtomicString, cacheControlHeader, ("cache-control"));
+    DEFINE_STATIC_LOCAL(const AtomicString, dateHeader, ("date"));
+    DEFINE_STATIC_LOCAL(const AtomicString, expiresHeader, ("expires"));
+    DEFINE_STATIC_LOCAL(const AtomicString, lastModifiedHeader, ("last-modified"));
+    DEFINE_STATIC_LOCAL(const AtomicString, pragmaHeader, ("pragma"));
+    if (equalIgnoringCase(name, ageHeader))
+        m_haveParsedAgeHeader = false;
+    else if (equalIgnoringCase(name, cacheControlHeader) || equalIgnoringCase(name, pragmaHeader))
+        m_haveParsedCacheControlHeader = false;
+    else if (equalIgnoringCase(name, dateHeader))
+        m_haveParsedDateHeader = false;
+    else if (equalIgnoringCase(name, expiresHeader))
+        m_haveParsedExpiresHeader = false;
+    else if (equalIgnoringCase(name, lastModifiedHeader))
+        m_haveParsedLastModifiedHeader = false;
 
-    if (equalIgnoringCase(name, "cache-control"))
-        m_haveParsedCacheControl = false;
     m_httpHeaderFields.set(name, value);
 }
 
@@ -216,66 +254,156 @@
 
 void ResourceResponseBase::parseCacheControlDirectives() const
 {
-    ASSERT(!m_haveParsedCacheControl);
+    ASSERT(!m_haveParsedCacheControlHeader);
 
     lazyInit();
 
-    m_haveParsedCacheControl = true;
+    m_haveParsedCacheControlHeader = true;
+
     m_cacheControlContainsMustRevalidate = false;
     m_cacheControlContainsNoCache = false;
+    m_cacheControlMaxAge = numeric_limits<double>::quiet_NaN();
 
-    String cacheControlValue = httpHeaderField("cache-control");
-    if (cacheControlValue.isEmpty())
-        return;
+    DEFINE_STATIC_LOCAL(const AtomicString, cacheControlString, ("cache-control"));
+    DEFINE_STATIC_LOCAL(const AtomicString, noCacheDirective, ("no-cache"));
+    DEFINE_STATIC_LOCAL(const AtomicString, mustRevalidateDirective, ("must-revalidate"));
+    DEFINE_STATIC_LOCAL(const AtomicString, maxAgeDirective, ("max-age"));
 
-    // FIXME: It would probably be much more efficient to parse this without creating all these data structures.
+    String cacheControlValue = m_httpHeaderFields.get(cacheControlString);
+    if (!cacheControlValue.isEmpty()) {
+        Vector<pair<String, String> > directives;
+        parseCacheHeader(cacheControlValue, directives);
 
-    Vector<pair<String, String> > directives;
-    parseCacheHeader(cacheControlValue, directives);
-
-    size_t directivesSize = directives.size();
-    for (size_t i = 0; i < directivesSize; ++i) {
-        Vector<String> directiveValues;
-        if ((equalIgnoringCase(directives[i].first, "private") || equalIgnoringCase(directives[i].first, "no-cache")) && !directives[i].second.isEmpty())
-            parseCacheControlDirectiveValues(directives[i].second, directiveValues);
-        else
-            directiveValues.append(directives[i].first);
-        for (size_t i = 0; i < directiveValues.size(); ++i) {
-            if (equalIgnoringCase(directiveValues[i], "no-cache"))
+        size_t directivesSize = directives.size();
+        for (size_t i = 0; i < directivesSize; ++i) {
+            // RFC2616 14.9.1: A no-cache directive with a value is only meaningful for proxy caches.
+            // It should be ignored by a browser level cache.
+            if (equalIgnoringCase(directives[i].first, noCacheDirective) && directives[i].second.isEmpty())
                 m_cacheControlContainsNoCache = true;
-            else if (equalIgnoringCase(directiveValues[i], "must-revalidate"))
+            else if (equalIgnoringCase(directives[i].first, mustRevalidateDirective))
                 m_cacheControlContainsMustRevalidate = true;
+            else if (equalIgnoringCase(directives[i].first, maxAgeDirective)) {
+                bool ok;
+                double maxAge = directives[i].second.toDouble(&ok);
+                if (ok)
+                    m_cacheControlMaxAge = maxAge;
+            }
         }
     }
+        
+    if (!m_cacheControlContainsNoCache) {
+        // Handle Pragma: no-cache
+        // This is deprecated and equivalent to Cache-control: no-cache
+        // Don't bother tokenizing the value, it is not important
+        DEFINE_STATIC_LOCAL(const AtomicString, pragmaHeader, ("pragma"));
+        String pragmaValue = m_httpHeaderFields.get(pragmaHeader);
+        m_cacheControlContainsNoCache = pragmaValue.lower().contains(noCacheDirective);
+    }
+}
+    
+bool ResourceResponseBase::cacheControlContainsNoCache() const
+{
+    if (!m_haveParsedCacheControlHeader)
+        parseCacheControlDirectives();
+    return m_cacheControlContainsNoCache;
+}
+
+bool ResourceResponseBase::cacheControlContainsMustRevalidate() const
+{
+    if (!m_haveParsedCacheControlHeader)
+        parseCacheControlDirectives();
+    return m_cacheControlContainsMustRevalidate;
+}
+
+double ResourceResponseBase::cacheControlMaxAge() const
+{
+    if (!m_haveParsedCacheControlHeader)
+        parseCacheControlDirectives();
+    return m_cacheControlMaxAge;
+}
+
+static double parseDateValueInHeader(const HTTPHeaderMap& headers, const AtomicString& headerName)
+{
+    String headerValue = headers.get(headerName);
+    if (headerValue.isEmpty())
+        return std::numeric_limits<double>::quiet_NaN(); 
+    // This handles all date formats required by RFC2616:
+    // Sun, 06 Nov 1994 08:49:37 GMT  ; RFC 822, updated by RFC 1123
+    // Sunday, 06-Nov-94 08:49:37 GMT ; RFC 850, obsoleted by RFC 1036
+    // Sun Nov  6 08:49:37 1994       ; ANSI C's asctime() format
+    double dateInMilliseconds = parseDate(headerValue);
+    if (!isfinite(dateInMilliseconds))
+        return std::numeric_limits<double>::quiet_NaN();
+    return dateInMilliseconds / 1000;
+}
+
+double ResourceResponseBase::date() const
+{
+    lazyInit();
+
+    if (!m_haveParsedDateHeader) {
+        DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("date"));
+        m_date = parseDateValueInHeader(m_httpHeaderFields, headerName);
+        m_haveParsedDateHeader = true;
+    }
+    return m_date;
+}
+
+double ResourceResponseBase::age() const
+{
+    lazyInit();
+    
+    if (!m_haveParsedAgeHeader) {
+        DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("age"));
+        String headerValue = m_httpHeaderFields.get(headerName);
+        bool ok;
+        m_age = headerValue.toDouble(&ok);
+        if (!ok)
+            m_age = std::numeric_limits<double>::quiet_NaN();
+        m_haveParsedAgeHeader = true;
+    }
+    return m_age;
+}
+
+double ResourceResponseBase::expires() const
+{
+    lazyInit();
+
+    if (!m_haveParsedExpiresHeader) {
+        DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("expires"));
+        m_expires = parseDateValueInHeader(m_httpHeaderFields, headerName);
+        m_haveParsedExpiresHeader = true;
+    }
+    return m_expires;
+}
+
+double ResourceResponseBase::lastModified() const
+{
+    lazyInit();
+    
+    if (!m_haveParsedLastModifiedHeader) {
+        DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("last-modified"));
+        m_lastModified = parseDateValueInHeader(m_httpHeaderFields, headerName);
+        m_haveParsedLastModifiedHeader = true;
+    }
+    return m_lastModified;
 }
 
 bool ResourceResponseBase::isAttachment() const
 {
     lazyInit();
 
-    String value = m_httpHeaderFields.get("Content-Disposition");
+    DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("content-disposition"));
+    String value = m_httpHeaderFields.get(headerName);
     int loc = value.find(';');
     if (loc != -1)
         value = value.left(loc);
     value = value.stripWhiteSpace();
-    return equalIgnoringCase(value, "attachment");
+    DEFINE_STATIC_LOCAL(const AtomicString, attachmentString, ("attachment"));
+    return equalIgnoringCase(value, attachmentString);
 }
-
-void ResourceResponseBase::setExpirationDate(time_t expirationDate)
-{
-    lazyInit();
-
-    m_expirationDate = expirationDate;
-}
-
-time_t ResourceResponseBase::expirationDate() const
-{
-    lazyInit();
-
-    return m_expirationDate; 
-}
-
-void ResourceResponseBase::setLastModifiedDate(time_t lastModifiedDate) 
+  
+void ResourceResponseBase::setLastModifiedDate(time_t lastModifiedDate)
 {
     lazyInit();
 
@@ -314,8 +442,6 @@
         return false;
     if (a.httpHeaderFields() != b.httpHeaderFields())
         return false;
-    if (a.expirationDate() != b.expirationDate())
-        return false;
     return ResourceResponse::platformCompare(a, b);
 }
 
@@ -414,12 +540,4 @@
     }
 }
 
-static void parseCacheControlDirectiveValues(const String& directives, Vector<String>& result)
-{
-    directives.split(',', false, result);
-    unsigned max = result.size();
-    for (unsigned i = 0; i < max; ++i)
-        result[i] = result[i].stripWhiteSpace();
-}
-
 }
diff --git a/WebCore/platform/network/ResourceResponseBase.h b/WebCore/platform/network/ResourceResponseBase.h
index ff34a26..7138908 100644
--- a/WebCore/platform/network/ResourceResponseBase.h
+++ b/WebCore/platform/network/ResourceResponseBase.h
@@ -77,25 +77,21 @@
     bool isMultipart() const { return mimeType() == "multipart/x-mixed-replace"; }
 
     bool isAttachment() const;
-
-    void setExpirationDate(time_t);
-    time_t expirationDate() const;
-
+    
+    // FIXME: These are used by PluginStream on some platforms. Calculations may differ from just returning plain Last-odified header.
+    // Leaving it for now but this should go away in favor of generic solution.
     void setLastModifiedDate(time_t);
-    time_t lastModifiedDate() const;
+    time_t lastModifiedDate() const; 
 
-    bool cacheControlContainsNoCache() const
-    {
-        if (!m_haveParsedCacheControl)
-            parseCacheControlDirectives();
-        return m_cacheControlContainsNoCache;
-    }
-    bool cacheControlContainsMustRevalidate() const
-    {
-        if (!m_haveParsedCacheControl)
-            parseCacheControlDirectives();
-        return m_cacheControlContainsMustRevalidate;
-    }
+    // These functions return parsed values of the corresponding response headers.
+    // NaN means that the header was not present or had invalid value.
+    bool cacheControlContainsNoCache() const;
+    bool cacheControlContainsMustRevalidate() const;
+    double cacheControlMaxAge() const;
+    double date() const;
+    double age() const;
+    double expires() const;
+    double lastModified() const;
 
     // The ResourceResponse subclass may "shadow" this method to provide platform-specific memory usage information
     unsigned memoryUsage() const
@@ -107,29 +103,8 @@
     static bool compare(const ResourceResponse& a, const ResourceResponse& b);
 
 protected:
-    ResourceResponseBase()  
-        : m_expectedContentLength(0)
-        , m_httpStatusCode(0)
-        , m_expirationDate(0)
-        , m_lastModifiedDate(0)
-        , m_isNull(true)
-        , m_haveParsedCacheControl(false)
-    {
-    }
-
-    ResourceResponseBase(const KURL& url, const String& mimeType, long long expectedLength, const String& textEncodingName, const String& filename)
-        : m_url(url)
-        , m_mimeType(mimeType)
-        , m_expectedContentLength(expectedLength)
-        , m_textEncodingName(textEncodingName)
-        , m_suggestedFilename(filename)
-        , m_httpStatusCode(0)
-        , m_expirationDate(0)
-        , m_lastModifiedDate(0)
-        , m_isNull(false)
-        , m_haveParsedCacheControl(false)
-    {
-    }
+    ResourceResponseBase();
+    ResourceResponseBase(const KURL& url, const String& mimeType, long long expectedLength, const String& textEncodingName, const String& filename);
 
     void lazyInit() const;
 
@@ -147,16 +122,27 @@
     int m_httpStatusCode;
     String m_httpStatusText;
     HTTPHeaderMap m_httpHeaderFields;
-    time_t m_expirationDate;
     time_t m_lastModifiedDate;
-    bool m_isNull : 1;
 
+    bool m_isNull : 1;
+    
 private:
     void parseCacheControlDirectives() const;
 
-    mutable bool m_haveParsedCacheControl : 1;
-    mutable bool m_cacheControlContainsMustRevalidate : 1;
+    mutable bool m_haveParsedCacheControlHeader : 1;
+    mutable bool m_haveParsedAgeHeader : 1;
+    mutable bool m_haveParsedDateHeader : 1;
+    mutable bool m_haveParsedExpiresHeader : 1;
+    mutable bool m_haveParsedLastModifiedHeader : 1;
+
     mutable bool m_cacheControlContainsNoCache : 1;
+    mutable bool m_cacheControlContainsMustRevalidate : 1;
+    mutable double m_cacheControlMaxAge;
+
+    mutable double m_age;
+    mutable double m_date;
+    mutable double m_expires;
+    mutable double m_lastModified;
 };
 
 inline bool operator==(const ResourceResponse& a, const ResourceResponse& b) { return ResourceResponseBase::compare(a, b); }
@@ -171,11 +157,7 @@
     int m_httpStatusCode;
     String m_httpStatusText;
     OwnPtr<CrossThreadHTTPHeaderMapData> m_httpHeaders;
-    time_t m_expirationDate;
     time_t m_lastModifiedDate;
-    bool m_haveParsedCacheControl : 1;
-    bool m_cacheControlContainsMustRevalidate : 1;
-    bool m_cacheControlContainsNoCache : 1;
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/android/Cookie.cpp b/WebCore/platform/network/android/Cookie.cpp
index 0b7aa45..c461e83 100644
--- a/WebCore/platform/network/android/Cookie.cpp
+++ b/WebCore/platform/network/android/Cookie.cpp
@@ -34,10 +34,10 @@
 
     class Document;
 
-    void setCookies(Document* , const KURL& url, const KURL& policyBaseURL, const String& value)
+    void setCookies(Document*, const KURL& url, const String& value)
     {
         if (JavaSharedClient::GetCookieClient())
-            JavaSharedClient::GetCookieClient()->setCookies(url, policyBaseURL, value);
+            JavaSharedClient::GetCookieClient()->setCookies(url, value);
     }
 
     String cookies(const Document* , const KURL& url)
diff --git a/WebCore/platform/network/android/CookieClient.h b/WebCore/platform/network/android/CookieClient.h
index 4b6ffef..7cb28a0 100644
--- a/WebCore/platform/network/android/CookieClient.h
+++ b/WebCore/platform/network/android/CookieClient.h
@@ -37,7 +37,7 @@
     {
     public:
         virtual ~CookieClient() {}
-        virtual void setCookies(const KURL& url, const KURL& docURL, const String& value) = 0;
+        virtual void setCookies(const KURL& url, const String& value) = 0;
         virtual String cookies(const KURL& url) = 0;
         virtual bool cookiesEnabled() = 0;
     };
diff --git a/WebCore/platform/network/android/ResourceHandleAndroid.cpp b/WebCore/platform/network/android/ResourceHandleAndroid.cpp
index 59084ab..7fe8ecf 100644
--- a/WebCore/platform/network/android/ResourceHandleAndroid.cpp
+++ b/WebCore/platform/network/android/ResourceHandleAndroid.cpp
@@ -143,7 +143,8 @@
     WTF::Vector<char>*     m_data;
 };
 
-void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, 
+void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request,
+        StoredCredentials /*storedCredentials*/,
         ResourceError& error, ResourceResponse& response, WTF::Vector<char>& data,
         Frame* frame) 
 {
diff --git a/WebCore/platform/network/cf/AuthenticationCF.cpp b/WebCore/platform/network/cf/AuthenticationCF.cpp
index bb05a39..51d60a4 100644
--- a/WebCore/platform/network/cf/AuthenticationCF.cpp
+++ b/WebCore/platform/network/cf/AuthenticationCF.cpp
@@ -37,6 +37,8 @@
 
 namespace WebCore {
 
+CFMutableDictionaryRef WebCoreCredentialStorage::m_storage;
+
 AuthenticationChallenge::AuthenticationChallenge(const ProtectionSpace& protectionSpace,
                                                  const Credential& proposedCredential,
                                                  unsigned previousFailureCount,
diff --git a/WebCore/platform/network/cf/AuthenticationCF.h b/WebCore/platform/network/cf/AuthenticationCF.h
index 681e71f..d3fc014 100644
--- a/WebCore/platform/network/cf/AuthenticationCF.h
+++ b/WebCore/platform/network/cf/AuthenticationCF.h
@@ -43,6 +43,25 @@
 Credential core(CFURLCredentialRef);
 ProtectionSpace core(CFURLProtectionSpaceRef);
 
+class WebCoreCredentialStorage {
+public:
+    static void set(CFURLProtectionSpaceRef protectionSpace, CFURLCredentialRef credential)
+    {
+        if (!m_storage)
+            m_storage = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+        CFDictionarySetValue(m_storage, protectionSpace, credential);
+    }
+
+    static CFURLCredentialRef get(CFURLProtectionSpaceRef protectionSpace)
+    {
+        if (!m_storage)
+            return 0;
+        return (CFURLCredentialRef)CFDictionaryGetValue(m_storage, protectionSpace);
+    }
+
+private:
+    static CFMutableDictionaryRef m_storage;
+};
 
 }
 
diff --git a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
index 2dcbbed..1d5bf9f 100644
--- a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
+++ b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
@@ -37,7 +37,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "Logging.h"
-#include "NotImplemented.h"
+#include "MIMETypeRegistry.h"
 #include "ResourceError.h"
 #include "ResourceResponse.h"
 
@@ -53,6 +53,38 @@
 
 namespace WebCore {
 
+static CFStringRef WebCoreSynchronousLoaderRunLoopMode = CFSTR("WebCoreSynchronousLoaderRunLoopMode");
+
+class WebCoreSynchronousLoader {
+public:
+    static RetainPtr<CFDataRef> load(const ResourceRequest&, StoredCredentials, ResourceResponse&, ResourceError&);
+
+private:
+    WebCoreSynchronousLoader(ResourceResponse& response, ResourceError& error)
+        : m_isDone(false)
+        , m_response(response)
+        , m_error(error)
+    {
+    }
+
+    static CFURLRequestRef willSendRequest(CFURLConnectionRef, CFURLRequestRef, CFURLResponseRef, const void* clientInfo);
+    static void didReceiveResponse(CFURLConnectionRef, CFURLResponseRef, const void* clientInfo);
+    static void didReceiveData(CFURLConnectionRef, CFDataRef, CFIndex, const void* clientInfo);
+    static void didFinishLoading(CFURLConnectionRef, const void* clientInfo);
+    static void didFail(CFURLConnectionRef, CFErrorRef, const void* clientInfo);
+    static void didReceiveChallenge(CFURLConnectionRef, CFURLAuthChallengeRef, const void* clientInfo);
+    static Boolean shouldUseCredentialStorage(CFURLConnectionRef, const void* clientInfo);
+
+    bool m_isDone;
+    RetainPtr<CFURLRef> m_url;
+    RetainPtr<CFStringRef> m_user;
+    RetainPtr<CFStringRef> m_pass;
+    bool m_allowStoredCredentials;
+    ResourceResponse& m_response;
+    RetainPtr<CFMutableDataRef> m_data;
+    ResourceError& m_error;
+};
+
 static HashSet<String>& allowsAnyHTTPSCertificateHosts()
 {
     static HashSet<String> hosts;
@@ -66,9 +98,16 @@
     return certs;
 }
 
+static void setDefaultMIMEType(CFURLResponseRef response)
+{
+    static CFStringRef defaultMIMETypeString = defaultMIMEType().createCFString();
+    
+    CFURLResponseSetMIMEType(response, defaultMIMETypeString);
+}
+
 CFURLRequestRef willSendRequest(CFURLConnectionRef conn, CFURLRequestRef cfRequest, CFURLResponseRef cfRedirectResponse, const void* clientInfo)
 {
-    ResourceHandle* handle = (ResourceHandle*)clientInfo;
+    ResourceHandle* handle = static_cast<ResourceHandle*>(const_cast<void*>(clientInfo));
 
     if (!cfRedirectResponse) {
         CFRetain(cfRequest);
@@ -78,8 +117,7 @@
     LOG(Network, "CFNet - willSendRequest(conn=%p, handle=%p) (%s)", conn, handle, handle->request().url().string().utf8().data());
 
     ResourceRequest request(cfRequest);
-    if (handle->client())
-        handle->client()->willSendRequest(handle, request, cfRedirectResponse);
+    handle->willSendRequest(request, cfRedirectResponse);
 
     cfRequest = request.cfURLRequest();
 
@@ -89,17 +127,25 @@
 
 void didReceiveResponse(CFURLConnectionRef conn, CFURLResponseRef cfResponse, const void* clientInfo) 
 {
-    ResourceHandle* handle = (ResourceHandle*)clientInfo;
+    ResourceHandle* handle = static_cast<ResourceHandle*>(const_cast<void*>(clientInfo));
 
     LOG(Network, "CFNet - didReceiveResponse(conn=%p, handle=%p) (%s)", conn, handle, handle->request().url().string().utf8().data());
 
-    if (handle->client())
-        handle->client()->didReceiveResponse(handle, cfResponse);
+    if (!handle->client())
+        return;
+
+    if (!CFURLResponseGetMIMEType(cfResponse)) {
+        // We should never be applying the default MIMEType if we told the networking layer to do content sniffing for handle.
+        ASSERT(!handle->shouldContentSniff());
+        setDefaultMIMEType(cfResponse);
+    }
+    
+    handle->client()->didReceiveResponse(handle, cfResponse);
 }
 
 void didReceiveData(CFURLConnectionRef conn, CFDataRef data, CFIndex originalLength, const void* clientInfo) 
 {
-    ResourceHandle* handle = (ResourceHandle*)clientInfo;
+    ResourceHandle* handle = static_cast<ResourceHandle*>(const_cast<void*>(clientInfo));
     const UInt8* bytes = CFDataGetBytePtr(data);
     CFIndex length = CFDataGetLength(data);
 
@@ -111,7 +157,7 @@
 
 static void didSendBodyData(CFURLConnectionRef conn, CFIndex bytesWritten, CFIndex totalBytesWritten, CFIndex totalBytesExpectedToWrite, const void *clientInfo)
 {
-    ResourceHandle* handle = (ResourceHandle*)clientInfo;
+    ResourceHandle* handle = static_cast<ResourceHandle*>(const_cast<void*>(clientInfo));
     if (!handle || !handle->client())
         return;
     handle->client()->didSendData(handle, totalBytesWritten, totalBytesExpectedToWrite);
@@ -131,7 +177,7 @@
 
 void didFinishLoading(CFURLConnectionRef conn, const void* clientInfo) 
 {
-    ResourceHandle* handle = (ResourceHandle*)clientInfo;
+    ResourceHandle* handle = static_cast<ResourceHandle*>(const_cast<void*>(clientInfo));
 
     LOG(Network, "CFNet - didFinishLoading(conn=%p, handle=%p) (%s)", conn, handle, handle->request().url().string().utf8().data());
 
@@ -141,7 +187,7 @@
 
 void didFail(CFURLConnectionRef conn, CFErrorRef error, const void* clientInfo) 
 {
-    ResourceHandle* handle = (ResourceHandle*)clientInfo;
+    ResourceHandle* handle = static_cast<ResourceHandle*>(const_cast<void*>(clientInfo));
 
     LOG(Network, "CFNet - didFail(conn=%p, handle=%p, error = %p) (%s)", conn, handle, error, handle->request().url().string().utf8().data());
 
@@ -151,7 +197,7 @@
 
 CFCachedURLResponseRef willCacheResponse(CFURLConnectionRef conn, CFCachedURLResponseRef cachedResponse, const void* clientInfo) 
 {
-    ResourceHandle* handle = (ResourceHandle*)clientInfo;
+    ResourceHandle* handle = static_cast<ResourceHandle*>(const_cast<void*>(clientInfo));
 
     if (handle->client() && !handle->client()->shouldCacheResponse(handle, cachedResponse))
         return 0;
@@ -174,7 +220,7 @@
 
 void didReceiveChallenge(CFURLConnectionRef conn, CFURLAuthChallengeRef challenge, const void* clientInfo)
 {
-    ResourceHandle* handle = (ResourceHandle*)clientInfo;
+    ResourceHandle* handle = static_cast<ResourceHandle*>(const_cast<void*>(clientInfo));
     ASSERT(handle);
     LOG(Network, "CFNet - didReceiveChallenge(conn=%p, handle=%p (%s)", conn, handle, handle->request().url().string().utf8().data());
 
@@ -273,6 +319,8 @@
         sslProps.adoptCF(CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
         CFDictionaryAddValue(sslProps.get(), kCFStreamSSLAllowsAnyRoot, kCFBooleanTrue);
         CFDictionaryAddValue(sslProps.get(), kCFStreamSSLAllowsExpiredRoots, kCFBooleanTrue);
+        CFDictionaryAddValue(sslProps.get(), kCFStreamSSLAllowsExpiredCertificates, kCFBooleanTrue);
+        CFDictionaryAddValue(sslProps.get(), kCFStreamSSLValidatesCertificateChain, kCFBooleanFalse);
     }
 
     HashMap<String, RetainPtr<CFDataRef> >::iterator clientCert = clientCerts().find(request.url().host().lower());
@@ -300,9 +348,17 @@
     if (!frame->page())
         return false;
 
+    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty()) && !d->m_request.url().protocolInHTTPFamily()) {
+        // Credentials for ftp can only be passed in URL, the didReceiveAuthenticationChallenge delegate call won't be made.
+        KURL urlWithCredentials(d->m_request.url());
+        urlWithCredentials.setUser(d->m_user);
+        urlWithCredentials.setPass(d->m_pass);
+        d->m_request.setURL(urlWithCredentials);
+    }
+
     RetainPtr<CFURLRequestRef> request(AdoptCF, makeFinalRequest(d->m_request, d->m_shouldContentSniff));
 
-    CFURLConnectionClient_V3 client = { 3, this, 0, 0, 0, willSendRequest, didReceiveResponse, didReceiveData, NULL, didFinishLoading, didFail, willCacheResponse, didReceiveChallenge, didSendBodyData, shouldUseCredentialStorageCallback, 0};
+    CFURLConnectionClient_V3 client = { 3, this, 0, 0, 0, WebCore::willSendRequest, didReceiveResponse, didReceiveData, NULL, didFinishLoading, didFail, willCacheResponse, didReceiveChallenge, didSendBodyData, shouldUseCredentialStorageCallback, 0};
 
     d->m_connection.adoptCF(CFURLConnectionCreate(0, request.get(), reinterpret_cast<CFURLConnectionClient*>(&client)));
 
@@ -334,6 +390,16 @@
     return false;
 }
 
+void ResourceHandle::willSendRequest(ResourceRequest& request, const ResourceResponse& redirectResponse)
+{
+    const KURL& url = request.url();
+    d->m_user = url.user();
+    d->m_pass = url.pass();
+    request.removeCredentials();
+
+    client()->willSendRequest(this, request, redirectResponse);
+}
+
 bool ResourceHandle::shouldUseCredentialStorage()
 {
     LOG(Network, "CFNet - shouldUseCredentialStorage()");
@@ -351,7 +417,29 @@
     // Since CFURLConnection networking relies on keeping a reference to the original CFURLAuthChallengeRef,
     // we make sure that is actually present
     ASSERT(challenge.cfURLAuthChallengeRef());
-        
+
+    if (!d->m_user.isNull() && !d->m_pass.isNull()) {
+        RetainPtr<CFStringRef> user(AdoptCF, d->m_user.createCFString());
+        RetainPtr<CFStringRef> pass(AdoptCF, d->m_pass.createCFString());
+        RetainPtr<CFURLCredentialRef> credential(AdoptCF,
+            CFURLCredentialCreate(kCFAllocatorDefault, user.get(), pass.get(), 0, kCFURLCredentialPersistenceNone));
+        WebCoreCredentialStorage::set(CFURLAuthChallengeGetProtectionSpace(challenge.cfURLAuthChallengeRef()), credential.get());
+        CFURLConnectionUseCredential(d->m_connection.get(), credential.get(), challenge.cfURLAuthChallengeRef());
+        d->m_user = String();
+        d->m_pass = String();
+        // FIXME: Per the specification, the user shouldn't be asked for credentials if there were incorrect ones provided explicitly.
+        return;
+    }
+
+    if (!challenge.previousFailureCount() && (!client() || client()->shouldUseCredentialStorage(this))) {
+        CFURLCredentialRef credential = WebCoreCredentialStorage::get(CFURLAuthChallengeGetProtectionSpace(challenge.cfURLAuthChallengeRef()));
+        if (credential) {
+            ASSERT(CFURLCredentialGetPersistence(credential) == kCFURLCredentialPersistenceNone);
+            CFURLConnectionUseCredential(d->m_connection.get(), credential, challenge.cfURLAuthChallengeRef());
+            return;
+        }
+    }
+
     d->m_currentCFChallenge = challenge.cfURLAuthChallengeRef();
     d->m_currentWebChallenge = AuthenticationChallenge(d->m_currentCFChallenge, this);
     
@@ -367,9 +455,17 @@
     if (challenge != d->m_currentWebChallenge)
         return;
 
-    CFURLCredentialRef cfCredential = createCF(credential);
-    CFURLConnectionUseCredential(d->m_connection.get(), cfCredential, challenge.cfURLAuthChallengeRef());
-    CFRelease(cfCredential);
+    if (credential.persistence() == CredentialPersistenceForSession) {
+        // Manage per-session credentials internally, because once NSURLCredentialPersistencePerSession is used, there is no way
+        // to ignore it for a particular request (short of removing it altogether).
+        Credential webCredential(credential.user(), credential.password(), CredentialPersistenceNone);
+        RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(webCredential));
+        WebCoreCredentialStorage::set(CFURLAuthChallengeGetProtectionSpace(challenge.cfURLAuthChallengeRef()), cfCredential.get());
+        CFURLConnectionUseCredential(d->m_connection.get(), cfCredential.get(), challenge.cfURLAuthChallengeRef());
+    } else {
+        RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(credential));
+        CFURLConnectionUseCredential(d->m_connection.get(), cfCredential.get(), challenge.cfURLAuthChallengeRef());
+    }
 
     clearAuthentication();
 }
@@ -408,31 +504,27 @@
     return d->m_connection.releaseRef();
 }
 
-void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& vector, Frame*)
+void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials storedCredentials, ResourceError& error, ResourceResponse& response, Vector<char>& vector, Frame*)
 {
     ASSERT(!request.isEmpty());
-    CFURLResponseRef cfResponse = 0;
-    CFErrorRef cfError = 0;
-    RetainPtr<CFURLRequestRef> cfRequest(AdoptCF, makeFinalRequest(request, true));
 
-    CFDataRef data = CFURLConnectionSendSynchronousRequest(cfRequest.get(), &cfResponse, &cfError, request.timeoutInterval());
+    RetainPtr<CFDataRef> data = WebCoreSynchronousLoader::load(request, storedCredentials, response, error);
 
-    if (cfError) {
-        error = cfError;
-        CFRelease(cfError);
-
+    if (!error.isNull()) {
         response = ResourceResponse(request.url(), String(), 0, String(), String());
-        response.setHTTPStatusCode(404);
-    } else {
-        response = cfResponse;
-        if (cfResponse)
-            CFRelease(cfResponse);
+
+        CFErrorRef cfError = error;
+        CFStringRef domain = CFErrorGetDomain(cfError);
+        // FIXME: Return the actual response for failed authentication.
+        if (domain == kCFErrorDomainCFNetwork)
+            response.setHTTPStatusCode(CFErrorGetCode(cfError));
+        else
+            response.setHTTPStatusCode(404);
     }
 
     if (data) {
         ASSERT(vector.isEmpty());
-        vector.append(CFDataGetBytePtr(data), CFDataGetLength(data));
-        CFRelease(data);
+        vector.append(CFDataGetBytePtr(data.get()), CFDataGetLength(data.get()));
     }
 }
 
@@ -480,4 +572,142 @@
     return cached;
 }
 
+CFURLRequestRef WebCoreSynchronousLoader::willSendRequest(CFURLConnectionRef, CFURLRequestRef cfRequest, CFURLResponseRef cfRedirectResponse, const void* clientInfo)
+{
+    WebCoreSynchronousLoader* loader = static_cast<WebCoreSynchronousLoader*>(const_cast<void*>(clientInfo));
+
+    // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
+    if (loader->m_url && !protocolHostAndPortAreEqual(loader->m_url.get(), CFURLRequestGetURL(cfRequest))) {
+        RetainPtr<CFErrorRef> cfError(AdoptCF, CFErrorCreate(kCFAllocatorDefault, kCFErrorDomainCFNetwork, kCFURLErrorBadServerResponse, 0));
+        loader->m_error = cfError.get();
+        loader->m_isDone = true;
+        return 0;
+    }
+
+    loader->m_url = CFURLRequestGetURL(cfRequest);
+
+    if (cfRedirectResponse) {
+        // Take user/pass out of the URL.
+        loader->m_user.adoptCF(CFURLCopyUserName(loader->m_url.get()));
+        loader->m_pass.adoptCF(CFURLCopyPassword(loader->m_url.get()));
+        if (loader->m_user || loader->m_pass) {
+            ResourceRequest requestWithoutCredentials = cfRequest;
+            requestWithoutCredentials.removeCredentials();
+            cfRequest = requestWithoutCredentials.cfURLRequest();
+        }
+    }
+
+    CFRetain(cfRequest);
+    return cfRequest;
+}
+
+void WebCoreSynchronousLoader::didReceiveResponse(CFURLConnectionRef, CFURLResponseRef cfResponse, const void* clientInfo) 
+{
+    WebCoreSynchronousLoader* loader = static_cast<WebCoreSynchronousLoader*>(const_cast<void*>(clientInfo));
+
+    loader->m_response = cfResponse;
+}
+
+void WebCoreSynchronousLoader::didReceiveData(CFURLConnectionRef, CFDataRef data, CFIndex originalLength, const void* clientInfo)
+{
+    WebCoreSynchronousLoader* loader = static_cast<WebCoreSynchronousLoader*>(const_cast<void*>(clientInfo));
+
+    if (!loader->m_data)
+        loader->m_data.adoptCF(CFDataCreateMutable(kCFAllocatorDefault, 0));
+
+    const UInt8* bytes = CFDataGetBytePtr(data);
+    CFIndex length = CFDataGetLength(data);
+
+    CFDataAppendBytes(loader->m_data.get(), bytes, length);
+}
+
+void WebCoreSynchronousLoader::didFinishLoading(CFURLConnectionRef, const void* clientInfo)
+{
+    WebCoreSynchronousLoader* loader = static_cast<WebCoreSynchronousLoader*>(const_cast<void*>(clientInfo));
+
+    loader->m_isDone = true;
+}
+
+void WebCoreSynchronousLoader::didFail(CFURLConnectionRef, CFErrorRef error, const void* clientInfo)
+{
+    WebCoreSynchronousLoader* loader = static_cast<WebCoreSynchronousLoader*>(const_cast<void*>(clientInfo));
+
+    loader->m_error = error;
+    loader->m_isDone = true;
+}
+
+void WebCoreSynchronousLoader::didReceiveChallenge(CFURLConnectionRef conn, CFURLAuthChallengeRef challenge, const void* clientInfo)
+{
+    WebCoreSynchronousLoader* loader = static_cast<WebCoreSynchronousLoader*>(const_cast<void*>(clientInfo));
+
+    if (loader->m_user && loader->m_pass) {
+        RetainPtr<CFURLCredentialRef> credential(AdoptCF,
+            CFURLCredentialCreate(kCFAllocatorDefault, loader->m_user.get(), loader->m_pass.get(), 0, kCFURLCredentialPersistenceNone));
+        WebCoreCredentialStorage::set(CFURLAuthChallengeGetProtectionSpace(challenge), credential.get());
+        CFURLConnectionUseCredential(conn, credential.get(), challenge);
+        loader->m_user = 0;
+        loader->m_pass = 0;
+        return;
+    }
+    if (!CFURLAuthChallengeGetPreviousFailureCount(challenge) && loader->m_allowStoredCredentials) {
+        CFURLCredentialRef credential = WebCoreCredentialStorage::get(CFURLAuthChallengeGetProtectionSpace(challenge));
+        if (credential) {
+            ASSERT(CFURLCredentialGetPersistence(credential) == kCFURLCredentialPersistenceNone);
+            CFURLConnectionUseCredential(conn, credential, challenge);
+            return;
+        }
+    }
+    // FIXME: The user should be asked for credentials, as in async case.
+    CFURLConnectionUseCredential(conn, 0, challenge);
+}
+
+Boolean WebCoreSynchronousLoader::shouldUseCredentialStorage(CFURLConnectionRef, const void* clientInfo)
+{
+    WebCoreSynchronousLoader* loader = static_cast<WebCoreSynchronousLoader*>(const_cast<void*>(clientInfo));
+
+    // FIXME: We should ask FrameLoaderClient whether using credential storage is globally forbidden.
+    return loader->m_allowStoredCredentials;
+}
+
+RetainPtr<CFDataRef> WebCoreSynchronousLoader::load(const ResourceRequest& request, StoredCredentials storedCredentials, ResourceResponse& response, ResourceError& error)
+{
+    ASSERT(response.isNull());
+    ASSERT(error.isNull());
+
+    WebCoreSynchronousLoader loader(response, error);
+
+    KURL url = request.url();
+
+    loader.m_user.adoptCF(url.user().createCFString());
+    loader.m_pass.adoptCF(url.pass().createCFString());
+    loader.m_allowStoredCredentials = (storedCredentials == AllowStoredCredentials);
+
+    // Take user/pass out of the URL.
+    // Credentials for ftp can only be passed in URL, the didReceiveAuthenticationChallenge delegate call won't be made.
+    RetainPtr<CFURLRequestRef> cfRequest;
+    if ((loader.m_user || loader.m_pass) && url.protocolInHTTPFamily()) {
+        ResourceRequest requestWithoutCredentials(request);
+        requestWithoutCredentials.removeCredentials();
+        cfRequest.adoptCF(makeFinalRequest(requestWithoutCredentials, ResourceHandle::shouldContentSniffURL(requestWithoutCredentials.url())));
+    } else
+        cfRequest.adoptCF(makeFinalRequest(request, ResourceHandle::shouldContentSniffURL(request.url())));
+
+    CFURLConnectionClient_V3 client = { 3, &loader, 0, 0, 0, willSendRequest, didReceiveResponse, didReceiveData, 0, didFinishLoading, didFail, 0, didReceiveChallenge, 0, shouldUseCredentialStorage, 0 };
+    RetainPtr<CFURLConnectionRef> connection(AdoptCF, CFURLConnectionCreate(kCFAllocatorDefault, cfRequest.get(), reinterpret_cast<CFURLConnectionClient*>(&client)));
+
+    CFURLConnectionScheduleWithRunLoop(connection.get(), CFRunLoopGetCurrent(), WebCoreSynchronousLoaderRunLoopMode);
+    CFURLConnectionScheduleDownloadWithRunLoop(connection.get(), CFRunLoopGetCurrent(), WebCoreSynchronousLoaderRunLoopMode);
+    CFURLConnectionStart(connection.get());
+
+    while (!loader.m_isDone)
+        CFRunLoopRunInMode(WebCoreSynchronousLoaderRunLoopMode, UINT_MAX, true);
+
+    CFURLConnectionCancel(connection.get());
+    
+    if (error.isNull() && loader.m_response.mimeType().isNull())
+        setDefaultMIMEType(loader.m_response.cfURLResponse());
+
+    return loader.m_data;
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/network/cf/ResourceRequestCFNet.cpp b/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
index df6bbf9..7355401 100644
--- a/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
+++ b/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
@@ -30,6 +30,7 @@
 #include "ResourceRequest.h"
 
 #include <CFNetwork/CFURLRequestPriv.h>
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
 
 namespace WebCore {
 
@@ -95,13 +96,15 @@
     CFMutableURLRequestRef cfRequest;
 
     RetainPtr<CFURLRef> url(AdoptCF, ResourceRequest::url().createCFURL());
-    RetainPtr<CFURLRef> mainDocumentURL(AdoptCF, ResourceRequest::mainDocumentURL().createCFURL());
+    RetainPtr<CFURLRef> firstPartyForCookies(AdoptCF, ResourceRequest::firstPartyForCookies().createCFURL());
     if (m_cfRequest) {
         cfRequest = CFURLRequestCreateMutableCopy(0, m_cfRequest.get());
         CFURLRequestSetURL(cfRequest, url.get());
-        CFURLRequestSetMainDocumentURL(cfRequest, mainDocumentURL.get());
+        CFURLRequestSetMainDocumentURL(cfRequest, firstPartyForCookies.get());
+        CFURLRequestSetCachePolicy(cfRequest, (CFURLRequestCachePolicy)cachePolicy());
+        CFURLRequestSetTimeoutInterval(cfRequest, timeoutInterval());
     } else {
-        cfRequest = CFURLRequestCreateMutable(0, url.get(), (CFURLRequestCachePolicy)cachePolicy(), timeoutInterval(), mainDocumentURL.get());
+        cfRequest = CFURLRequestCreateMutable(0, url.get(), (CFURLRequestCachePolicy)cachePolicy(), timeoutInterval(), firstPartyForCookies.get());
     }
 
     RetainPtr<CFStringRef> requestMethod(AdoptCF, httpMethod().createCFString());
@@ -138,7 +141,7 @@
 
     m_cachePolicy = (ResourceRequestCachePolicy)CFURLRequestGetCachePolicy(m_cfRequest.get());
     m_timeoutInterval = CFURLRequestGetTimeoutInterval(m_cfRequest.get());
-    m_mainDocumentURL = CFURLRequestGetMainDocumentURL(m_cfRequest.get());
+    m_firstPartyForCookies = CFURLRequestGetMainDocumentURL(m_cfRequest.get());
     if (CFStringRef method = CFURLRequestCopyHTTPRequestMethod(m_cfRequest.get())) {
         m_httpMethod = method;
         CFRelease(method);
@@ -162,11 +165,17 @@
         for (CFIndex i = 0; i < count; ++i) {
             CFStringEncoding encoding = reinterpret_cast<CFIndex>(CFArrayGetValueAtIndex(encodingFallbacks.get(), i));
             if (encoding != kCFStringEncodingInvalidId)
-                m_responseContentDispositionEncodingFallbackArray.append(CFStringGetNameOfEncoding(encoding));
+                m_responseContentDispositionEncodingFallbackArray.append(CFStringConvertEncodingToIANACharSetName(encoding));
         }
     }
 
     m_httpBody = httpBodyFromRequest(m_cfRequest.get());
 }
 
+unsigned initializeMaximumHTTPConnectionCountPerHost()
+{
+    static const unsigned preferredConnectionCount = 6;
+    return wkInitializeMaximumHTTPConnectionCountPerHost(preferredConnectionCount);
+}
+
 }
diff --git a/WebCore/platform/network/cf/ResourceResponseCFNet.cpp b/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
index 79efe89..95e9aff 100644
--- a/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
+++ b/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
@@ -24,11 +24,10 @@
  */
 
 #include "config.h"
-#include "ResourceResponseCFNet.h"
+#include "ResourceResponse.h"
 
 #include "HTTPParsers.h"
 #include "MIMETypeRegistry.h"
-#include "ResourceResponse.h"
 #include <CFNetwork/CFURLResponsePriv.h>
 #include <wtf/RetainPtr.h>
 
@@ -80,7 +79,6 @@
     m_expectedContentLength = CFURLResponseGetExpectedContentLength(m_cfResponse.get());
     m_textEncodingName = CFURLResponseGetTextEncodingName(m_cfResponse.get());
 
-    m_expirationDate = toTimeT(CFURLResponseGetExpirationTime(m_cfResponse.get()));
     m_lastModifiedDate = toTimeT(CFURLResponseGetLastModifiedDate(m_cfResponse.get()));
 
     RetainPtr<CFStringRef> suggestedFilename(AdoptCF, CFURLResponseCopySuggestedFilename(m_cfResponse.get()));
@@ -92,9 +90,11 @@
 
         RetainPtr<CFStringRef> statusLine(AdoptCF, CFHTTPMessageCopyResponseStatusLine(httpResponse));
         String statusText(statusLine.get());
-        int spacePos = statusText.find(" ");
-        if (spacePos != -1)
-            statusText = statusText.substring(spacePos + 1);
+        int spacePos = statusText.find(' ');
+        // Remove the status code from the status text.
+        spacePos = statusText.find(' ', spacePos + 1);
+        statusText = statusText.substring(spacePos + 1);      
+
         m_httpStatusText = statusText;
 
         RetainPtr<CFDictionaryRef> headers(AdoptCF, CFHTTPMessageCopyAllHeaderFields(httpResponse));
diff --git a/WebCore/platform/network/chromium/CookieJarChromium.cpp b/WebCore/platform/network/chromium/CookieJarChromium.cpp
index 50cab3b..65be451 100644
--- a/WebCore/platform/network/chromium/CookieJarChromium.cpp
+++ b/WebCore/platform/network/chromium/CookieJarChromium.cpp
@@ -36,16 +36,14 @@
 
 namespace WebCore {
 
-void setCookies(Document* document, const KURL& url, const KURL& policyURL, const String& value)
+void setCookies(Document* document, const KURL& url, const String& value)
 {
-    // We ignore the policyURL and compute it directly ourselves to ensure
-    // consistency with the cookies() method below.
-    ChromiumBridge::setCookies(url, document->policyBaseURL(), value);
+    ChromiumBridge::setCookies(url, document->firstPartyForCookies(), value);
 }
 
 String cookies(const Document* document, const KURL& url)
 {
-    return ChromiumBridge::cookies(url, document->policyBaseURL());
+    return ChromiumBridge::cookies(url, document->firstPartyForCookies());
 }
 
 bool cookiesEnabled(const Document*)
diff --git a/WebCore/platform/network/chromium/ResourceRequest.h b/WebCore/platform/network/chromium/ResourceRequest.h
index b14dba6..aa76de4 100644
--- a/WebCore/platform/network/chromium/ResourceRequest.h
+++ b/WebCore/platform/network/chromium/ResourceRequest.h
@@ -49,6 +49,7 @@
             : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
+            , m_appCacheContextID(0)
             , m_targetType(TargetIsSubResource)
         {
         }
@@ -57,6 +58,7 @@
             : ResourceRequestBase(url, UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
+            , m_appCacheContextID(0)
             , m_targetType(TargetIsSubResource)
             , m_securityInfo(securityInfo)
         {
@@ -66,6 +68,7 @@
             : ResourceRequestBase(url, UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
+            , m_appCacheContextID(0)
             , m_targetType(TargetIsSubResource)
         {
         }
@@ -74,6 +77,7 @@
             : ResourceRequestBase(url, policy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
+            , m_appCacheContextID(0)
             , m_targetType(TargetIsSubResource)
         {
             setHTTPReferrer(referrer);
@@ -83,6 +87,7 @@
             : ResourceRequestBase(KURL(), UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
+            , m_appCacheContextID(0)
             , m_targetType(TargetIsSubResource)
         {
         }
@@ -95,10 +100,6 @@
         TargetType targetType() const { return m_targetType; }
         void setTargetType(TargetType type) { m_targetType = type; }
 
-        // The document's policy base url.
-        KURL policyURL() const { return m_policyURL; }
-        void setPolicyURL(const KURL& policyURL) { m_policyURL = policyURL; }
-
         // The process id of the process from which this request originated. In
         // the case of out-of-process plugins, this allows to link back the
         // request to the plugin process (as it is processed through a render
@@ -106,6 +107,10 @@
         int requestorProcessID() const { return m_requestorProcessID; }
         void setRequestorProcessID(int requestorProcessID) { m_requestorProcessID = requestorProcessID; }
 
+        // Allows the request to be matched up with its app cache context.
+        int appCacheContextID() const { return m_appCacheContextID; }
+        void setAppCacheContextID(int id) { m_appCacheContextID = id; }
+
         // Opaque buffer that describes the security state (including SSL
         // connection state) for the resource that should be reported when the
         // resource has been loaded.  This is used to simulate secure
@@ -123,9 +128,9 @@
 
         int m_requestorID;
         int m_requestorProcessID;
+        int m_appCacheContextID;
         TargetType m_targetType;
         CString m_securityInfo;
-        KURL m_policyURL;
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/chromium/ResourceResponse.h b/WebCore/platform/network/chromium/ResourceResponse.h
index 256df74..6c928c0 100644
--- a/WebCore/platform/network/chromium/ResourceResponse.h
+++ b/WebCore/platform/network/chromium/ResourceResponse.h
@@ -37,12 +37,14 @@
     public:
         ResourceResponse()
             : m_isContentFiltered(false)
+            , m_appCacheID(0)
         {
         }
 
         ResourceResponse(const KURL& url, const String& mimeType, long long expectedLength, const String& textEncodingName, const String& filename)
-            : ResourceResponseBase(url, mimeType, expectedLength, textEncodingName, filename),
-              m_isContentFiltered(false)
+            : ResourceResponseBase(url, mimeType, expectedLength, textEncodingName, filename)
+            , m_isContentFiltered(false)
+            , m_appCacheID(0)
         {
         }
 
@@ -58,6 +60,12 @@
             m_isContentFiltered = isContentFiltered;
         }
 
+        long long getAppCacheID() const { return m_appCacheID; }
+        void setAppCacheID(long long id)
+        {
+            m_appCacheID = id;
+        }
+
     private:
         friend class ResourceResponseBase;
 
@@ -74,6 +82,10 @@
         // Whether the contents for this response has been altered/blocked (usually
         // for security reasons.
         bool m_isContentFiltered;
+
+        // The id of the appcache this response was retrieved from, or zero if
+        // the response was not retrieved from an appcache.
+        long long m_appCacheID;
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/curl/CookieJarCurl.cpp b/WebCore/platform/network/curl/CookieJarCurl.cpp
index 2f76ebc..5ac0f9c 100644
--- a/WebCore/platform/network/curl/CookieJarCurl.cpp
+++ b/WebCore/platform/network/curl/CookieJarCurl.cpp
@@ -17,6 +17,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Document.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "StringHash.h"
@@ -27,7 +28,7 @@
 
 static HashMap<String, String> cookieJar;
 
-void setCookies(Document* /*document*/, const KURL& url, const KURL& /*policyURL*/, const String& value)
+void setCookies(Document* /*document*/, const KURL& url, const String& value)
 {
     cookieJar.set(url.string(), value);
 }
diff --git a/WebCore/platform/network/curl/ResourceHandleCurl.cpp b/WebCore/platform/network/curl/ResourceHandleCurl.cpp
index ca24ec5..a2e692c 100644
--- a/WebCore/platform/network/curl/ResourceHandleCurl.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleCurl.cpp
@@ -191,7 +191,7 @@
     return false;
 }
 
-void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& data, Frame*)
+void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials storedCredentials, ResourceError& error, ResourceResponse& response, Vector<char>& data, Frame*)
 {
     WebCoreSynchronousLoader syncLoader;
     ResourceHandle handle(request, &syncLoader, true, false, true);
diff --git a/WebCore/platform/network/curl/ResourceHandleManager.cpp b/WebCore/platform/network/curl/ResourceHandleManager.cpp
index 6f009db..c61ad4f 100644
--- a/WebCore/platform/network/curl/ResourceHandleManager.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleManager.cpp
@@ -46,12 +46,6 @@
 #include <stdio.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(GTK)
-    #if GLIB_CHECK_VERSION(2,12,0)
-        #define USE_GLIB_BASE64
-    #endif
-#endif
-
 namespace WebCore {
 
 const int selectTimeoutMS = 5;
@@ -320,13 +314,13 @@
             if (d->client())
                 d->client()->didFinishLoading(job);
         } else {
-#ifndef NDEBUG
             char* url = 0;
             curl_easy_getinfo(d->m_handle, CURLINFO_EFFECTIVE_URL, &url);
+#ifndef NDEBUG
             fprintf(stderr, "Curl ERROR for url='%s', error: '%s'\n", url, curl_easy_strerror(msg->data.result));
 #endif
             if (d->client())
-                d->client()->didFail(job, ResourceError());
+                d->client()->didFail(job, ResourceError(String(), msg->data.result, String(url), String(curl_easy_strerror(msg->data.result))));
         }
 
         removeFromCurl(job);
@@ -512,20 +506,10 @@
         response.setTextEncodingName(charset);
         client->didReceiveResponse(handle, response);
 
-        // Use the GLib Base64 if available, since WebCore's decoder isn't
-        // general-purpose and fails on Acid3 test 97 (whitespace).
-#ifdef USE_GLIB_BASE64
-        size_t outLength = 0;
-        char* outData = 0;
-        outData = reinterpret_cast<char*>(g_base64_decode(data.utf8().data(), &outLength));
-        if (outData && outLength > 0)
-            client->didReceiveData(handle, outData, outLength, 0);
-        g_free(outData);
-#else
+        // WebCore's decoder fails on Acid3 test 97 (whitespace).
         Vector<char> out;
         if (base64Decode(data.latin1().data(), data.latin1().length(), out) && out.size() > 0)
             client->didReceiveData(handle, out.data(), out.size(), 0);
-#endif
     } else {
         // We have to convert to UTF-16 early due to limitations in KURL
         data = decodeURLEscapeSequences(data, TextEncoding(charset));
@@ -606,8 +590,11 @@
     if (kurl.isLocalFile()) {
         String query = kurl.query();
         // Remove any query part sent to a local file.
-        if (!query.isEmpty())
-            url = url.left(url.find(query));
+        if (!query.isEmpty()) {
+            int queryIndex = url.find(query);
+            if (queryIndex != -1)
+                url = url.left(queryIndex - 1);
+        }
         // Determine the MIME type based on the path.
         d->m_response.setMimeType(MIMETypeRegistry::getMIMETypeForPath(url));
     }
diff --git a/WebCore/platform/network/mac/AuthenticationMac.h b/WebCore/platform/network/mac/AuthenticationMac.h
index f55ac24..7fb6bee 100644
--- a/WebCore/platform/network/mac/AuthenticationMac.h
+++ b/WebCore/platform/network/mac/AuthenticationMac.h
@@ -45,6 +45,24 @@
 ProtectionSpace core(NSURLProtectionSpace *);
 Credential core(NSURLCredential *);
 
+class WebCoreCredentialStorage {
+public:
+    static void set(NSURLCredential *credential, NSURLProtectionSpace *protectionSpace)
+    {
+        if (!m_storage)
+            m_storage = [[NSMutableDictionary alloc] init];
+        [m_storage setObject:credential forKey:protectionSpace];
+    }
+
+    static NSURLCredential *get(NSURLProtectionSpace *protectionSpace)
+    {
+        return static_cast<NSURLCredential *>([m_storage objectForKey:protectionSpace]);
+    }
+
+private:
+    static NSMutableDictionary* m_storage;
+};
+
 }
 #endif
 
diff --git a/WebCore/platform/network/mac/AuthenticationMac.mm b/WebCore/platform/network/mac/AuthenticationMac.mm
index 54e7681..961a79d 100644
--- a/WebCore/platform/network/mac/AuthenticationMac.mm
+++ b/WebCore/platform/network/mac/AuthenticationMac.mm
@@ -37,6 +37,8 @@
 namespace WebCore {
 
 
+NSMutableDictionary* WebCoreCredentialStorage::m_storage;
+
 AuthenticationChallenge::AuthenticationChallenge(const ProtectionSpace& protectionSpace,
                                                  const Credential& proposedCredential,
                                                  unsigned previousFailureCount,
diff --git a/WebCore/platform/network/mac/ResourceHandleMac.mm b/WebCore/platform/network/mac/ResourceHandleMac.mm
index 9bc322d..3af1b97 100644
--- a/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -33,15 +33,23 @@
 #import "FormDataStreamMac.h"
 #import "Frame.h"
 #import "FrameLoader.h"
+#import "Logging.h"
+#import "MIMETypeRegistry.h"
 #import "Page.h"
 #import "ResourceError.h"
 #import "ResourceResponse.h"
 #import "SchedulePair.h"
+#import "Settings.h"
 #import "SharedBuffer.h"
 #import "SubresourceLoader.h"
 #import "WebCoreSystemInterface.h"
+#import "WebCoreURLResponse.h"
 #import <wtf/UnusedParam.h>
 
+#ifndef BUILDING_ON_TIGER
+#import <objc/objc-class.h>
+#endif
+
 #ifdef BUILDING_ON_TIGER
 typedef int NSInteger;
 #endif
@@ -51,9 +59,6 @@
 @interface WebCoreResourceHandleAsDelegate : NSObject <NSURLAuthenticationChallengeSender>
 {
     ResourceHandle* m_handle;
-#ifndef BUILDING_ON_TIGER
-    NSURL *m_url;
-#endif
 }
 - (id)initWithHandle:(ResourceHandle*)handle;
 - (void)detachHandle;
@@ -63,20 +68,34 @@
 - (NSData *)_bufferedData;
 @end
 
+@interface NSURLResponse (Details)
+- (void)_setMIMEType:(NSString *)type;
+@end
+
+@interface NSURLRequest (Details)
+- (id)_propertyForKey:(NSString *)key;
+@end
+
 #ifndef BUILDING_ON_TIGER
 
 @interface WebCoreSynchronousLoader : NSObject {
     NSURL *m_url;
+    NSString *m_user;
+    NSString *m_pass;
+    BOOL m_allowStoredCredentials;
     NSURLResponse *m_response;
     NSMutableData *m_data;
     NSError *m_error;
     BOOL m_isDone;
 }
-+ (NSData *)loadRequest:(NSURLRequest *)request returningResponse:(NSURLResponse **)response error:(NSError **)error;
++ (NSData *)loadRequest:(NSURLRequest *)request allowStoredCredentials:(BOOL)allowStoredCredentials returningResponse:(NSURLResponse **)response error:(NSError **)error;
 @end
 
 static NSString *WebCoreSynchronousLoaderRunLoopMode = @"WebCoreSynchronousLoaderRunLoopMode";
 
+static IMP oldNSURLResponseMIMETypeIMP = 0;
+static NSString *webNSURLResponseMIMEType(id, SEL);
+
 #endif
 
 namespace WebCore {
@@ -113,6 +132,8 @@
 ResourceHandle::~ResourceHandle()
 {
     releaseDelegate();
+
+    LOG(Network, "Handle %p destroyed", this);
 }
 
 static const double MaxFoundationVersionWithoutdidSendBodyDataDelegate = 677.21;
@@ -150,9 +171,19 @@
     } else 
         delegate = ResourceHandle::delegate();
 
+    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty()) && !d->m_request.url().protocolInHTTPFamily()) {
+        // Credentials for ftp can only be passed in URL, the connection:didReceiveAuthenticationChallenge: delegate call won't be made.
+        KURL urlWithCredentials(d->m_request.url());
+        urlWithCredentials.setUser(d->m_user);
+        urlWithCredentials.setPass(d->m_pass);
+        d->m_request.setURL(urlWithCredentials);
+    }
+
     if (!ResourceHandle::didSendBodyDataDelegateExists())
         associateStreamWithResourceHandle([d->m_request.nsURLRequest() HTTPBodyStream], this);
 
+    d->m_needsSiteSpecificQuirks = frame->settings() && frame->settings()->needsSiteSpecificQuirks();
+
     NSURLConnection *connection;
     
     if (d->m_shouldContentSniff) 
@@ -195,6 +226,8 @@
 #ifndef NDEBUG
     isInitializingConnection = NO;
 #endif
+
+    LOG(Network, "Handle %p starting connection %p for %@", this, connection, d->m_request.nsURLRequest());
     
     d->m_connection = connection;
 
@@ -214,6 +247,8 @@
 
 void ResourceHandle::cancel()
 {
+    LOG(Network, "Handle %p cancel connection %p", this, d->m_connection.get());
+
     if (!ResourceHandle::didSendBodyDataDelegateExists())
         disassociateStreamWithResourceHandle([d->m_request.nsURLRequest() HTTPBodyStream]);
     [d->m_connection.get() cancel];
@@ -221,6 +256,8 @@
 
 void ResourceHandle::setDefersLoading(bool defers)
 {
+    LOG(Network, "Handle %p setDefersLoading(%s)", this, defers ? "true" : "false");
+
     d->m_defersLoading = defers;
     if (d->m_connection)
         wkSetNSURLConnectionDefersCallbacks(d->m_connection.get(), defers);
@@ -313,6 +350,7 @@
 
 bool ResourceHandle::willLoadFromCache(ResourceRequest& request)
 {
+#ifndef BUILDING_ON_TIGER
     request.setCachePolicy(ReturnCacheDataDontLoad);
     NSURLResponse *nsURLResponse = nil;
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -322,9 +360,14 @@
     END_BLOCK_OBJC_EXCEPTIONS;
     
     return nsURLResponse;
+#else
+    // <rdar://problem/6803217> - Re-enable after <rdar://problem/6786454> is resolved.
+    UNUSED_PARAM(request);
+    return false;
+#endif
 }
 
-void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& data, Frame*)
+void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials storedCredentials, ResourceError& error, ResourceResponse& response, Vector<char>& data, Frame*)
 {
     NSError *nsError = nil;
     
@@ -333,12 +376,21 @@
 
     ASSERT(!request.isEmpty());
     
+    NSURLRequest *nsRequest;
+    if (!shouldContentSniffURL(request.url())) {
+        NSMutableURLRequest *mutableRequest = [[request.nsURLRequest() mutableCopy] autorelease];
+        wkSetNSURLRequestShouldContentSniff(mutableRequest, NO);
+        nsRequest = mutableRequest;
+    } else
+        nsRequest = request.nsURLRequest();
+            
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
     
 #ifndef BUILDING_ON_TIGER
-    result = [WebCoreSynchronousLoader loadRequest:request.nsURLRequest() returningResponse:&nsURLResponse error:&nsError];
+    result = [WebCoreSynchronousLoader loadRequest:nsRequest allowStoredCredentials:(storedCredentials == AllowStoredCredentials) returningResponse:&nsURLResponse error:&nsError];
 #else
-    result = [NSURLConnection sendSynchronousRequest:request.nsURLRequest() returningResponse:&nsURLResponse error:&nsError];
+    UNUSED_PARAM(storedCredentials);
+    result = [NSURLConnection sendSynchronousRequest:nsRequest returningResponse:&nsURLResponse error:&nsError];
 #endif
     END_BLOCK_OBJC_EXCEPTIONS;
 
@@ -365,6 +417,16 @@
     error = nsError;
 }
 
+void ResourceHandle::willSendRequest(ResourceRequest& request, const ResourceResponse& redirectResponse)
+{
+    const KURL& url = request.url();
+    d->m_user = url.user();
+    d->m_pass = url.pass();
+    request.removeCredentials();
+
+    client()->willSendRequest(this, request, redirectResponse);
+}
+
 bool ResourceHandle::shouldUseCredentialStorage()
 {
     if (client())
@@ -380,7 +442,29 @@
     // Since NSURLConnection networking relies on keeping a reference to the original NSURLAuthenticationChallenge,
     // we make sure that is actually present
     ASSERT(challenge.nsURLAuthenticationChallenge());
-        
+
+    if (!d->m_user.isNull() && !d->m_pass.isNull()) {
+        NSURLCredential *credential = [[NSURLCredential alloc] initWithUser:d->m_user
+                                                                   password:d->m_pass
+                                                                persistence:NSURLCredentialPersistenceNone];
+        d->m_currentMacChallenge = challenge.nsURLAuthenticationChallenge();
+        d->m_currentWebChallenge = challenge;
+        receivedCredential(challenge, core(credential));
+        [credential release];
+        // FIXME: Per the specification, the user shouldn't be asked for credentials if there were incorrect ones provided explicitly.
+        d->m_user = String();
+        d->m_pass = String();
+        return;
+    }
+
+    if (!challenge.previousFailureCount() && (!client() || client()->shouldUseCredentialStorage(this))) {
+        NSURLCredential *credential = WebCoreCredentialStorage::get([mac(challenge) protectionSpace]);
+        if (credential) {
+            [challenge.sender() useCredential:credential forAuthenticationChallenge:mac(challenge)];
+            return;
+        }
+    }
+
     d->m_currentMacChallenge = challenge.nsURLAuthenticationChallenge();
     NSURLAuthenticationChallenge *webChallenge = [[NSURLAuthenticationChallenge alloc] initWithAuthenticationChallenge:d->m_currentMacChallenge 
                                                                                        sender:(id<NSURLAuthenticationChallengeSender>)delegate()];
@@ -407,7 +491,24 @@
     if (challenge != d->m_currentWebChallenge)
         return;
 
-    [[d->m_currentMacChallenge sender] useCredential:mac(credential) forAuthenticationChallenge:d->m_currentMacChallenge];
+#ifdef BUILDING_ON_TIGER
+    if (credential.persistence() == CredentialPersistenceNone) {
+        // NSURLCredentialPersistenceNone doesn't work on Tiger, so we have to use session persistence.
+        Credential webCredential(credential.user(), credential.password(), CredentialPersistenceForSession);
+        WebCoreCredentialStorage::set(mac(webCredential), [d->m_currentMacChallenge protectionSpace]);
+        [[d->m_currentMacChallenge sender] useCredential:mac(webCredential) forAuthenticationChallenge:d->m_currentMacChallenge];
+    } else
+#else
+    if (credential.persistence() == CredentialPersistenceForSession && (!d->m_needsSiteSpecificQuirks || ![[[mac(challenge) protectionSpace] host] isEqualToString:@"gallery.me.com"])) {
+        // Manage per-session credentials internally, because once NSURLCredentialPersistenceForSession is used, there is no way
+        // to ignore it for a particular request (short of removing it altogether).
+        // <rdar://problem/6867598> gallery.me.com is temporarily whitelisted, so that QuickTime plug-in could see the credentials.
+        Credential webCredential(credential.user(), credential.password(), CredentialPersistenceNone);
+        WebCoreCredentialStorage::set(mac(webCredential), [d->m_currentMacChallenge protectionSpace]);
+        [[d->m_currentMacChallenge sender] useCredential:mac(webCredential) forAuthenticationChallenge:d->m_currentMacChallenge];
+    } else
+#endif
+        [[d->m_currentMacChallenge sender] useCredential:mac(credential) forAuthenticationChallenge:d->m_currentMacChallenge];
 
     clearAuthentication();
 }
@@ -445,22 +546,14 @@
     return self;
 }
 
-#ifndef BUILDING_ON_TIGER
-- (void)dealloc
-{
-    [m_url release];
-    [super dealloc];
-}
-#endif
-
 - (void)detachHandle
 {
     m_handle = 0;
 }
 
-- (NSURLRequest *)connection:(NSURLConnection *)unusedConnection willSendRequest:(NSURLRequest *)newRequest redirectResponse:(NSURLResponse *)redirectResponse
+- (NSURLRequest *)connection:(NSURLConnection *)connection willSendRequest:(NSURLRequest *)newRequest redirectResponse:(NSURLResponse *)redirectResponse
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
 
     // the willSendRequest call may cancel this load, in which case self could be deallocated
     RetainPtr<WebCoreResourceHandleAsDelegate> protect(self);
@@ -472,14 +565,11 @@
     if (!redirectResponse)
         return newRequest;
     
+    LOG(Network, "Handle %p delegate connection:%p willSendRequest:%@ redirectResponse:%p", m_handle, connection, [newRequest description], redirectResponse);
+
     CallbackGuard guard;
     ResourceRequest request = newRequest;
-    m_handle->client()->willSendRequest(m_handle, request, redirectResponse);
-#ifndef BUILDING_ON_TIGER
-    NSURL *copy = [[request.nsURLRequest() URL] copy];
-    [m_url release];
-    m_url = copy;
-#endif
+    m_handle->willSendRequest(request, redirectResponse);
 
     if (!ResourceHandle::didSendBodyDataDelegateExists()) {
         // The client may change the request's body stream, in which case we have to re-associate
@@ -495,9 +585,11 @@
     return request.nsURLRequest();
 }
 
-- (BOOL)connectionShouldUseCredentialStorage:(NSURLConnection *)unusedConnection
+- (BOOL)connectionShouldUseCredentialStorage:(NSURLConnection *)connection
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "Handle %p delegate connectionShouldUseCredentialStorage:%p", m_handle, connection);
 
     if (!m_handle)
         return NO;
@@ -506,35 +598,23 @@
     return m_handle->shouldUseCredentialStorage();
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
+- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
 
-#ifndef BUILDING_ON_TIGER
-    if ([challenge previousFailureCount] == 0) {
-        NSString *user = [m_url user];
-        NSString *password = [m_url password];
+    LOG(Network, "Handle %p delegate connection:%p didReceiveAuthenticationChallenge:%p", m_handle, connection, challenge);
 
-        if (user && password) {
-            NSURLCredential *credential = [[NSURLCredential alloc] initWithUser:user
-                                                                     password:password
-                                                                  persistence:NSURLCredentialPersistenceForSession];
-            [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
-            [credential release];
-            return;
-        }
-    }
-#endif
-    
     if (!m_handle)
         return;
     CallbackGuard guard;
     m_handle->didReceiveAuthenticationChallenge(core(challenge));
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didCancelAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
+- (void)connection:(NSURLConnection *)connection didCancelAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "Handle %p delegate connection:%p didCancelAuthenticationChallenge:%p", m_handle, connection, challenge);
 
     if (!m_handle)
         return;
@@ -542,19 +622,51 @@
     m_handle->didCancelAuthenticationChallenge(core(challenge));
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didReceiveResponse:(NSURLResponse *)r
+- (void)connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse *)r
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "Handle %p delegate connection:%p didReceiveResponse:%p (HTTP status %d)", m_handle, connection, r, [r respondsToSelector:@selector(statusCode)] ? [(id)r statusCode] : 0);
 
     if (!m_handle || !m_handle->client())
         return;
     CallbackGuard guard;
+
+#ifndef BUILDING_ON_TIGER
+    if (!oldNSURLResponseMIMETypeIMP) {
+        Method nsURLResponseMIMETypeMethod = class_getInstanceMethod(objc_getClass("NSURLResponse"), @selector(MIMEType));
+        ASSERT(nsURLResponseMIMETypeMethod);
+        oldNSURLResponseMIMETypeIMP = method_setImplementation(nsURLResponseMIMETypeMethod, (IMP)webNSURLResponseMIMEType);
+    }
+#endif
+
+    if ([m_handle->request().nsURLRequest() _propertyForKey:@"ForceHTMLMIMEType"])
+        [r _setMIMEType:@"text/html"];
+
+#if ENABLE(WML)
+    const KURL& url = [r URL];
+    if (url.isLocalFile()) {
+        // FIXME: Workaround for <rdar://problem/6917571>: The WML file extension ".wml" is not mapped to
+        // the right MIME type, work around that CFNetwork problem, to unbreak WML support for local files.
+        const String& path = url.path();
+  
+        DEFINE_STATIC_LOCAL(const String, wmlExt, (".wml"));
+        if (path.endsWith(wmlExt, false)) {
+            static NSString* defaultMIMETypeString = [(NSString*) defaultMIMEType() retain];
+            if ([[r _webcore_MIMEType] isEqualToString:defaultMIMETypeString])
+                [r _setMIMEType:@"text/vnd.wap.wml"];
+        }
+    }
+#endif
+
     m_handle->client()->didReceiveResponse(m_handle, r);
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didReceiveData:(NSData *)data lengthReceived:(long long)lengthReceived
+- (void)connection:(NSURLConnection *)connection didReceiveData:(NSData *)data lengthReceived:(long long)lengthReceived
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "Handle %p delegate connection:%p didReceiveData:%p lengthReceived:%lld", m_handle, connection, data, lengthReceived);
 
     if (!m_handle || !m_handle->client())
         return;
@@ -565,9 +677,11 @@
     m_handle->client()->didReceiveData(m_handle, (const char*)[data bytes], [data length], static_cast<int>(lengthReceived));
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection willStopBufferingData:(NSData *)data
+- (void)connection:(NSURLConnection *)connection willStopBufferingData:(NSData *)data
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "Handle %p delegate connection:%p willStopBufferingData:%p", m_handle, connection, data);
 
     if (!m_handle || !m_handle->client())
         return;
@@ -578,10 +692,12 @@
     m_handle->client()->willStopBufferingData(m_handle, (const char*)[data bytes], static_cast<int>([data length]));
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didSendBodyData:(NSInteger)unusedBytesWritten totalBytesWritten:(NSInteger)totalBytesWritten totalBytesExpectedToWrite:(NSInteger)totalBytesExpectedToWrite
+- (void)connection:(NSURLConnection *)connection didSendBodyData:(NSInteger)bytesWritten totalBytesWritten:(NSInteger)totalBytesWritten totalBytesExpectedToWrite:(NSInteger)totalBytesExpectedToWrite
 {
-    UNUSED_PARAM(unusedConnection);
-    UNUSED_PARAM(unusedBytesWritten);
+    UNUSED_PARAM(connection);
+    UNUSED_PARAM(bytesWritten);
+
+    LOG(Network, "Handle %p delegate connection:%p didSendBodyData:%d totalBytesWritten:%d totalBytesExpectedToWrite:%d", m_handle, connection, bytesWritten, totalBytesWritten, totalBytesExpectedToWrite);
 
     if (!m_handle || !m_handle->client())
         return;
@@ -589,9 +705,11 @@
     m_handle->client()->didSendData(m_handle, totalBytesWritten, totalBytesExpectedToWrite);
 }
 
-- (void)connectionDidFinishLoading:(NSURLConnection *)unusedConnection
+- (void)connectionDidFinishLoading:(NSURLConnection *)connection
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "Handle %p delegate connectionDidFinishLoading:%p", m_handle, connection);
 
     if (!m_handle || !m_handle->client())
         return;
@@ -603,9 +721,11 @@
     m_handle->client()->didFinishLoading(m_handle);
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didFailWithError:(NSError *)error
+- (void)connection:(NSURLConnection *)connection didFailWithError:(NSError *)error
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "Handle %p delegate connection:%p didFailWithError:%@", m_handle, connection, error);
 
     if (!m_handle || !m_handle->client())
         return;
@@ -630,6 +750,8 @@
 
 - (NSCachedURLResponse *)connection:(NSURLConnection *)connection willCacheResponse:(NSCachedURLResponse *)cachedResponse
 {
+    LOG(Network, "Handle %p delegate connection:%p willCacheResponse:%p", m_handle, connection, cachedResponse);
+
 #ifdef BUILDING_ON_TIGER
     // On Tiger CFURLConnection can sometimes call the connection:willCacheResponse: delegate method on
     // a secondary thread instead of the main thread. If this happens perform the work on the main thread.
@@ -717,6 +839,8 @@
 - (void)dealloc
 {
     [m_url release];
+    [m_user release];
+    [m_pass release];
     [m_response release];
     [m_data release];
     [m_error release];
@@ -724,36 +848,71 @@
     [super dealloc];
 }
 
-- (NSURLRequest *)connection:(NSURLConnection *)unusedConnection willSendRequest:(NSURLRequest *)newRequest redirectResponse:(NSURLResponse *)unusedRedirectResponse
+- (NSURLRequest *)connection:(NSURLConnection *)unusedConnection willSendRequest:(NSURLRequest *)newRequest redirectResponse:(NSURLResponse *)redirectResponse
 {
     UNUSED_PARAM(unusedConnection);
-    UNUSED_PARAM(unusedRedirectResponse);
+
+    // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
+    if (m_url && !protocolHostAndPortAreEqual(m_url, [newRequest URL])) {
+        m_error = [[NSError alloc] initWithDomain:NSURLErrorDomain code:NSURLErrorBadServerResponse userInfo:nil];
+        m_isDone = YES;
+        return nil;
+    }
 
     NSURL *copy = [[newRequest URL] copy];
     [m_url release];
     m_url = copy;
 
+    if (redirectResponse) {
+        // Take user/pass out of the URL.
+        [m_user release];
+        [m_pass release];
+        m_user = [[m_url user] copy];
+        m_pass = [[m_url password] copy];
+        if (m_user || m_pass) {
+            ResourceRequest requestWithoutCredentials = newRequest;
+            requestWithoutCredentials.removeCredentials();
+            return requestWithoutCredentials.nsURLRequest();
+        }
+    }
+
     return newRequest;
 }
 
+- (BOOL)connectionShouldUseCredentialStorage:(NSURLConnection *)unusedConnection
+{
+    UNUSED_PARAM(unusedConnection);
+
+    // FIXME: We should ask FrameLoaderClient whether using credential storage is globally forbidden.
+    return m_allowStoredCredentials;
+}
+
 - (void)connection:(NSURLConnection *)unusedConnection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
 {
     UNUSED_PARAM(unusedConnection);
 
-    if ([challenge previousFailureCount] == 0) {
-        NSString *user = [m_url user];
-        NSString *password = [m_url password];
-        
-        if (user && password) {
-            NSURLCredential *credential = [[NSURLCredential alloc] initWithUser:user
-                                                                     password:password
-                                                                  persistence:NSURLCredentialPersistenceForSession];
+    if (m_user && m_pass) {
+        NSURLCredential *credential = [[NSURLCredential alloc] initWithUser:m_user
+                                                                   password:m_pass
+                                                                persistence:NSURLCredentialPersistenceNone];
+        WebCoreCredentialStorage::set(credential, [challenge protectionSpace]);
+        [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
+        [credential release];
+        [m_user release];
+        [m_pass release];
+        m_user = 0;
+        m_pass = 0;
+        return;
+    }
+    if ([challenge previousFailureCount] == 0 && m_allowStoredCredentials) {
+        NSURLCredential *credential = WebCoreCredentialStorage::get([challenge protectionSpace]);
+        ASSERT([credential persistence] == NSURLCredentialPersistenceNone);
+        if (credential) {
             [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
-            [credential release];
             return;
         }
     }
-    
+    // FIXME: The user should be asked for credentials, as in async case.
     [[challenge sender] continueWithoutCredentialForAuthenticationChallenge:challenge];
 }
 
@@ -809,11 +968,26 @@
     return [[m_error retain] autorelease];
 }
 
-+ (NSData *)loadRequest:(NSURLRequest *)request returningResponse:(NSURLResponse **)response error:(NSError **)error
++ (NSData *)loadRequest:(NSURLRequest *)request allowStoredCredentials:(BOOL)allowStoredCredentials returningResponse:(NSURLResponse **)response error:(NSError **)error
 {
     WebCoreSynchronousLoader *delegate = [[WebCoreSynchronousLoader alloc] init];
-    
-    NSURLConnection *connection = [[NSURLConnection alloc] initWithRequest:request delegate:delegate startImmediately:NO];
+
+    NSURL *url = [request URL];
+    delegate->m_user = [[url user] copy];
+    delegate->m_pass = [[url password] copy];
+    delegate->m_allowStoredCredentials = allowStoredCredentials;
+
+    NSURLConnection *connection;
+
+    // Take user/pass out of the URL.
+    // Credentials for ftp can only be passed in URL, the connection:didReceiveAuthenticationChallenge: delegate call won't be made.
+    if ((delegate->m_user || delegate->m_pass) && KURL(url).protocolInHTTPFamily()) {
+        ResourceRequest requestWithoutCredentials = request;
+        requestWithoutCredentials.removeCredentials();
+        connection = [[NSURLConnection alloc] initWithRequest:requestWithoutCredentials.nsURLRequest() delegate:delegate startImmediately:NO];
+    } else
+        connection = [[NSURLConnection alloc] initWithRequest:request delegate:delegate startImmediately:NO];
+
     [connection scheduleInRunLoop:[NSRunLoop currentRunLoop] forMode:WebCoreSynchronousLoaderRunLoopMode];
     [connection start];
     
@@ -834,4 +1008,14 @@
 
 @end
 
+static NSString *webNSURLResponseMIMEType(id self, SEL _cmd)
+{
+    ASSERT(oldNSURLResponseMIMETypeIMP);
+    if (NSString *result = oldNSURLResponseMIMETypeIMP(self, _cmd))
+        return result;
+
+    static NSString *defaultMIMETypeString = [(NSString *)defaultMIMEType() retain];
+    return defaultMIMETypeString;
+}
+
 #endif
diff --git a/WebCore/platform/network/mac/ResourceRequestMac.mm b/WebCore/platform/network/mac/ResourceRequestMac.mm
index 92c37ee..6bb36a0 100644
--- a/WebCore/platform/network/mac/ResourceRequestMac.mm
+++ b/WebCore/platform/network/mac/ResourceRequestMac.mm
@@ -57,7 +57,7 @@
     m_url = [m_nsRequest.get() URL];
     m_cachePolicy = (ResourceRequestCachePolicy)[m_nsRequest.get() cachePolicy];
     m_timeoutInterval = [m_nsRequest.get() timeoutInterval];
-    m_mainDocumentURL = [m_nsRequest.get() mainDocumentURL];
+    m_firstPartyForCookies = [m_nsRequest.get() mainDocumentURL];
     
     if (NSString* method = [m_nsRequest.get() HTTPMethod])
         m_httpMethod = method;
@@ -78,7 +78,7 @@
         for (NSUInteger i = 0; i < count; ++i) {
             CFStringEncoding encoding = CFStringConvertNSStringEncodingToEncoding([(NSNumber *)[encodingFallbacks objectAtIndex:i] unsignedLongValue]);
             if (encoding != kCFStringEncodingInvalidId)
-                m_responseContentDispositionEncodingFallbackArray.append(CFStringGetNameOfEncoding(encoding));
+                m_responseContentDispositionEncodingFallbackArray.append(CFStringConvertEncodingToIANACharSetName(encoding));
         }
     }
 
@@ -110,7 +110,7 @@
     [nsRequest setCachePolicy:(NSURLRequestCachePolicy)cachePolicy()];
     if (timeoutInterval() != unspecifiedTimeoutInterval)
         [nsRequest setTimeoutInterval:timeoutInterval()];
-    [nsRequest setMainDocumentURL:mainDocumentURL()];
+    [nsRequest setMainDocumentURL:firstPartyForCookies()];
     if (!httpMethod().isEmpty())
         [nsRequest setHTTPMethod:httpMethod()];
     [nsRequest setHTTPShouldHandleCookies:allowHTTPCookies()];
@@ -146,5 +146,11 @@
     // Hack because Mail checks for this property to detect data / archive loads
     [NSURLProtocol setProperty:@"" forKey:@"WebDataRequest" inRequest:(NSMutableURLRequest *)nsURLRequest()];
 }
+    
+unsigned initializeMaximumHTTPConnectionCountPerHost()
+{
+    static const unsigned preferredConnectionCount = 6;
+    return wkInitializeMaximumHTTPConnectionCountPerHost(preferredConnectionCount);
+}
 
 }
diff --git a/WebCore/platform/network/mac/ResourceResponseMac.mm b/WebCore/platform/network/mac/ResourceResponseMac.mm
index d501b31..60a4dc6 100644
--- a/WebCore/platform/network/mac/ResourceResponseMac.mm
+++ b/WebCore/platform/network/mac/ResourceResponseMac.mm
@@ -74,12 +74,6 @@
     m_textEncodingName = [m_nsResponse.get() textEncodingName];
     m_suggestedFilename = [m_nsResponse.get() suggestedFilename];
     
-    const time_t maxTime = std::numeric_limits<time_t>::max();
-    
-    NSTimeInterval expiration = [m_nsResponse.get() _calculatedExpiration];
-    expiration += kCFAbsoluteTimeIntervalSince1970;
-    m_expirationDate = expiration > maxTime ? maxTime : static_cast<time_t>(expiration);
-    
     if ([m_nsResponse.get() isKindOfClass:[NSHTTPURLResponse class]]) {
         NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)m_nsResponse.get();
         
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 2c730a6..06b60bf 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -136,7 +136,6 @@
     , m_redirected(false)
     , m_responseSent(false)
     , m_loadMode(loadMode)
-    , m_startTime(0)
     , m_shouldStart(true)
     , m_shouldFinish(false)
     , m_shouldSendResponse(false)
@@ -174,6 +173,7 @@
     if (m_reply) {
         QNetworkReply* reply = release();
         reply->abort();
+        reply->deleteLater();
         deleteLater();
     }
 }
@@ -291,7 +291,7 @@
     }
 
     if (isLocalFileReply)
-        response.setExpirationDate(m_startTime);
+        response.setHTTPHeaderField(QString::fromAscii("Cache-Control"), QString::fromAscii("no-cache"));
 
     QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (redirection.isValid()) {
@@ -354,8 +354,6 @@
         && (!url.toLocalFile().isEmpty() || url.scheme() == QLatin1String("data")))
         m_method = QNetworkAccessManager::GetOperation;
 
-    m_startTime = QDateTime::currentDateTime().toTime_t();
-
     switch (m_method) {
         case QNetworkAccessManager::GetOperation:
             m_reply = manager->get(m_request);
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.h b/WebCore/platform/network/qt/QNetworkReplyHandler.h
index 98be28d..3de6d88 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -72,7 +72,6 @@
     LoadMode m_loadMode;
     QNetworkAccessManager::Operation m_method;
     QNetworkRequest m_request;
-    uint   m_startTime;
 
     // defer state holding
     bool m_shouldStart;
diff --git a/WebCore/platform/network/qt/ResourceHandleQt.cpp b/WebCore/platform/network/qt/ResourceHandleQt.cpp
index 7af5895..c5816a4 100644
--- a/WebCore/platform/network/qt/ResourceHandleQt.cpp
+++ b/WebCore/platform/network/qt/ResourceHandleQt.cpp
@@ -171,7 +171,7 @@
     return 0;
 }
 
-void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& data, Frame* frame)
+void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials /*storedCredentials*/, ResourceError& error, ResourceResponse& response, Vector<char>& data, Frame* frame)
 {
     WebCoreSynchronousLoader syncLoader;
     ResourceHandle handle(request, &syncLoader, true, false, true);
diff --git a/WebCore/platform/network/qt/ResourceRequestQt.cpp b/WebCore/platform/network/qt/ResourceRequestQt.cpp
index 9308878..c8f6ad5 100644
--- a/WebCore/platform/network/qt/ResourceRequestQt.cpp
+++ b/WebCore/platform/network/qt/ResourceRequestQt.cpp
@@ -41,6 +41,22 @@
         request.setRawHeader(name, value);
     }
 
+    switch (cachePolicy()) {
+    case ReloadIgnoringCacheData:
+        request.setAttribute(QNetworkRequest::CacheLoadControlAttribute, QNetworkRequest::AlwaysNetwork);
+        break;
+    case ReturnCacheDataElseLoad:
+        request.setAttribute(QNetworkRequest::CacheLoadControlAttribute, QNetworkRequest::PreferCache);
+        break;
+    case ReturnCacheDataDontLoad:
+        request.setAttribute(QNetworkRequest::CacheLoadControlAttribute, QNetworkRequest::AlwaysCache);
+        break;
+    case UseProtocolCachePolicy:
+        // QNetworkRequest::PreferNetwork
+    default:
+        break;
+    }
+
     return request;
 }
 
diff --git a/WebCore/platform/network/soup/CookieJarSoup.cpp b/WebCore/platform/network/soup/CookieJarSoup.cpp
index e3064e1..705fdf2 100644
--- a/WebCore/platform/network/soup/CookieJarSoup.cpp
+++ b/WebCore/platform/network/soup/CookieJarSoup.cpp
@@ -22,6 +22,7 @@
 #include "CookieJarSoup.h"
 
 #include "CString.h"
+#include "Document.h"
 #include "KURL.h"
 
 namespace WebCore {
@@ -52,7 +53,7 @@
         g_object_ref(cookieJar);
 }
 
-void setCookies(Document* /*document*/, const KURL& url, const KURL& /*policyURL*/, const String& value)
+void setCookies(Document* /*document*/, const KURL& url, const String& value)
 {
     SoupCookieJar* jar = defaultCookieJar();
     if (!jar)
diff --git a/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 1b91e32..6be13e2 100644
--- a/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -53,10 +53,6 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
-#if PLATFORM(GTK)
-#define USE_GLIB_BASE64
-#endif
-
 namespace WebCore {
 
 class WebCoreSynchronousLoader : public ResourceHandleClient, Noncopyable {
@@ -121,14 +117,6 @@
         g_main_loop_run(m_mainLoop);
 }
 
-enum
-{
-    ERROR_TRANSPORT,
-    ERROR_UNKNOWN_PROTOCOL,
-    ERROR_BAD_NON_HTTP_METHOD,
-    ERROR_UNABLE_TO_OPEN_FILE,
-};
-
 static void cleanupGioOperation(ResourceHandleInternal* handle);
 
 ResourceHandleInternal::~ResourceHandleInternal()
@@ -148,6 +136,9 @@
 
 ResourceHandle::~ResourceHandle()
 {
+    if (d->m_msg)
+        g_signal_handlers_disconnect_matched(d->m_msg, G_SIGNAL_MATCH_DATA,
+                                             0, 0, 0, 0, this);
 }
 
 static void fillResponseFromMessage(SoupMessage* msg, ResourceResponse* response)
@@ -171,17 +162,24 @@
     contentType = contentTypes[0];
 
     if (contentTypeParameters) {
+        GString* parametersString = g_string_new(0);
         GHashTableIter hashTableIter;
-        gpointer hashKey;
-        gpointer hashValue;
+        const char* hashKey;
+        const char* hashValue;
 
         g_hash_table_iter_init(&hashTableIter, contentTypeParameters);
-        while (g_hash_table_iter_next(&hashTableIter, &hashKey, &hashValue)) {
-            contentType += String("; ");
-            contentType += String(static_cast<char*>(hashKey));
-            contentType += String("=");
-            contentType += String(static_cast<char*>(hashValue));
+        while (g_hash_table_iter_next(&hashTableIter, reinterpret_cast<void**>(const_cast<char**>(&hashKey)), reinterpret_cast<void**>(const_cast<char**>(&hashValue)))) {
+            // Work-around bug in soup which causes a crash;
+            // See http://bugzilla.gnome.org/show_bug.cgi?id=577728
+            if (!hashValue)
+                hashValue = "";
+
+            g_string_append(parametersString, "; ");
+            soup_header_g_string_append_param(parametersString, hashKey, hashValue);
         }
+        contentType += String(parametersString->str);
+
+        g_string_free(parametersString, true);
         g_hash_table_destroy(contentTypeParameters);
     }
 
@@ -228,8 +226,6 @@
     fillResponseFromMessage(msg, &response);
     if (d->client())
         d->client()->willSendRequest(handle, request, response);
-
-    d->m_request.setURL(newURL);
 }
 
 static void gotHeadersCallback(SoupMessage* msg, gpointer data)
@@ -258,11 +254,12 @@
     // sniffing the contents of the file, and then report that we got
     // headers; we will not do content sniffing for 304 responses,
     // though, since they do not have a body.
+    const char* contentType = soup_message_headers_get_content_type(msg->response_headers, NULL);
     if ((msg->status_code != SOUP_STATUS_NOT_MODIFIED)
-        && !soup_message_headers_get_content_type(msg->response_headers, NULL))
+        && (!contentType || !g_ascii_strcasecmp(contentType, "text/plain")))
         return;
 
-    ResourceHandle* handle = static_cast<ResourceHandle*>(data);
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
     if (!handle)
         return;
     ResourceHandleInternal* d = handle->getInternal();
@@ -273,8 +270,8 @@
         return;
 
     fillResponseFromMessage(msg, &d->m_response);
-    client->didReceiveResponse(handle, d->m_response);
     d->m_reportedHeaders = true;
+    client->didReceiveResponse(handle.get(), d->m_response);
 }
 
 static void gotChunkCallback(SoupMessage* msg, SoupBuffer* chunk, gpointer data)
@@ -284,7 +281,7 @@
         || (msg->status_code == SOUP_STATUS_UNAUTHORIZED))
         return;
 
-    ResourceHandle* handle = static_cast<ResourceHandle*>(data);
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
     if (!handle)
         return;
     ResourceHandleInternal* d = handle->getInternal();
@@ -301,11 +298,15 @@
         g_free(contentType);
 
         fillResponseFromMessage(msg, &d->m_response);
-        client->didReceiveResponse(handle, d->m_response);
+        client->didReceiveResponse(handle.get(), d->m_response);
         d->m_reportedHeaders = true;
+
+        // the didReceiveResponse call above may have cancelled the request
+        if (d->m_cancelled)
+            return;
     }
 
-    client->didReceiveData(handle, chunk->data, chunk->length, false);
+    client->didReceiveData(handle.get(), chunk->data, chunk->length, false);
 }
 
 // Called at the end of the message, with all the necessary about the last informations.
@@ -327,9 +328,10 @@
         return;
 
     if (SOUP_STATUS_IS_TRANSPORT_ERROR(msg->status_code)) {
-        char* uri = soup_uri_to_string(soup_message_get_uri(msg), false);
-        ResourceError error("webkit-network-error", ERROR_TRANSPORT, uri, String::fromUTF8(msg->reason_phrase));
-        g_free(uri);
+        ResourceError error(g_quark_to_string(SOUP_HTTP_ERROR),
+                            msg->status_code,
+                            soup_uri_to_string(soup_message_get_uri(msg), false),
+                            String::fromUTF8(msg->reason_phrase));
         client->didFail(handle.get(), error);
         return;
     }
@@ -354,8 +356,11 @@
 {
     ResourceHandle* handle = static_cast<ResourceHandle*>(callback_data);
     ResourceHandleClient* client = handle->client();
+    ResourceHandleInternal* d = handle->getInternal();
+    if (d->m_cancelled)
+        return false;
 
-    handle->getInternal()->m_idleHandler = 0;
+    d->m_idleHandler = 0;
 
     ASSERT(client);
     if (!client)
@@ -391,27 +396,31 @@
         response.setTextEncodingName(charset);
         client->didReceiveResponse(handle, response);
 
-        // Use the GLib Base64 if available, since WebCore's decoder isn't
+        if (d->m_cancelled)
+            return false;
+
+        // Use the GLib Base64, since WebCore's decoder isn't
         // general-purpose and fails on Acid3 test 97 (whitespace).
-#ifdef USE_GLIB_BASE64
         size_t outLength = 0;
         char* outData = 0;
         outData = reinterpret_cast<char*>(g_base64_decode(data.utf8().data(), &outLength));
         if (outData && outLength > 0)
             client->didReceiveData(handle, outData, outLength, 0);
         g_free(outData);
-#else
-        Vector<char> out;
-        if (base64Decode(data.latin1().data(), data.latin1().length(), out) && out.size() > 0)
-            client->didReceiveData(handle, out.data(), out.size(), 0);
-#endif
     } else {
         // We have to convert to UTF-16 early due to limitations in KURL
         data = decodeURLEscapeSequences(data, TextEncoding(charset));
         response.setTextEncodingName("UTF-16");
         client->didReceiveResponse(handle, response);
+
+        if (d->m_cancelled)
+            return false;
+
         if (data.length() > 0)
             client->didReceiveData(handle, reinterpret_cast<const char*>(data.characters()), data.length() * sizeof(UChar), 0);
+
+        if (d->m_cancelled)
+            return false;
     }
 
     client->didFinishLoading(handle);
@@ -459,20 +468,12 @@
     SoupSession* session = defaultSession();
     ensureSessionIsInitialized(session);
 
-    SoupMessage* msg;
-    msg = soup_message_new(request().httpMethod().utf8().data(), urlString.utf8().data());
-    g_signal_connect(msg, "restarted", G_CALLBACK(restartedCallback), this);
-    g_signal_connect(msg, "got-headers", G_CALLBACK(gotHeadersCallback), this);
-    g_signal_connect(msg, "got-chunk", G_CALLBACK(gotChunkCallback), this);
+    d->m_msg = request().toSoupMessage();
+    g_signal_connect(d->m_msg, "restarted", G_CALLBACK(restartedCallback), this);
+    g_signal_connect(d->m_msg, "got-headers", G_CALLBACK(gotHeadersCallback), this);
+    g_signal_connect(d->m_msg, "got-chunk", G_CALLBACK(gotChunkCallback), this);
 
-    g_object_set_data(G_OBJECT(msg), "resourceHandle", reinterpret_cast<void*>(this));
-
-    HTTPHeaderMap customHeaders = d->m_request.httpHeaderFields();
-    if (!customHeaders.isEmpty()) {
-        HTTPHeaderMap::const_iterator end = customHeaders.end();
-        for (HTTPHeaderMap::const_iterator it = customHeaders.begin(); it != end; ++it)
-            soup_message_headers_append(msg->request_headers, it->first.string().utf8().data(), it->second.utf8().data());
-    }
+    g_object_set_data(G_OBJECT(d->m_msg), "resourceHandle", reinterpret_cast<void*>(this));
 
     FormData* httpBody = d->m_request.httpBody();
     if (httpBody && !httpBody->isEmpty()) {
@@ -482,7 +483,7 @@
         if (numElements < 2) {
             Vector<char> body;
             httpBody->flatten(body);
-            soup_message_set_request(msg, d->m_request.httpContentType().utf8().data(),
+            soup_message_set_request(d->m_msg, d->m_request.httpContentType().utf8().data(),
                                      SOUP_MEMORY_COPY, body.data(), body.size());
         } else {
             /*
@@ -491,12 +492,12 @@
              * copying into memory; TODO: support upload of non-local
              * (think sftp://) files by using GIO?
              */
-            soup_message_body_set_accumulate(msg->request_body, FALSE);
+            soup_message_body_set_accumulate(d->m_msg->request_body, FALSE);
             for (size_t i = 0; i < numElements; i++) {
                 const FormDataElement& element = httpBody->elements()[i];
 
                 if (element.m_type == FormDataElement::data)
-                    soup_message_body_append(msg->request_body, SOUP_MEMORY_TEMPORARY, element.m_data.data(), element.m_data.size());
+                    soup_message_body_append(d->m_msg->request_body, SOUP_MEMORY_TEMPORARY, element.m_data.data(), element.m_data.size());
                 else {
                     /*
                      * mapping for uploaded files code inspired by technique used in
@@ -509,53 +510,50 @@
                     g_free(fileName);
 
                     if (error) {
-                        ResourceError resourceError("webkit-network-error", ERROR_UNABLE_TO_OPEN_FILE, urlString, error->message);
+                        ResourceError resourceError(g_quark_to_string(SOUP_HTTP_ERROR),
+                                                    d->m_msg->status_code,
+                                                    urlString,
+                                                    String::fromUTF8(error->message));
                         g_error_free(error);
 
                         d->client()->didFail(this, resourceError);
 
-                        g_object_unref(msg);
+                        g_signal_handlers_disconnect_matched(d->m_msg, G_SIGNAL_MATCH_DATA,
+                                                             0, 0, 0, 0, this);
+                        g_object_unref(d->m_msg);
+                        d->m_msg = 0;
+
                         return false;
                     }
 
                     SoupBuffer* soupBuffer = soup_buffer_new_with_owner(g_mapped_file_get_contents(fileMapping),
                                                                         g_mapped_file_get_length(fileMapping),
                                                                         fileMapping, reinterpret_cast<GDestroyNotify>(g_mapped_file_free));
-                    soup_message_body_append_buffer(msg->request_body, soupBuffer);
+                    soup_message_body_append_buffer(d->m_msg->request_body, soupBuffer);
                     soup_buffer_free(soupBuffer);
                 }
             }
         }
     }
 
-    d->m_msg = static_cast<SoupMessage*>(g_object_ref(msg));
     // balanced by a deref() in finishedCallback, which should always run
     ref();
 
+    // FIXME: For now, we cannot accept content encoded in anything
+    // other than identity, so force servers to do it our way. When
+    // libsoup gets proper Content-Encoding support we will want to
+    // use it here instead.
+    soup_message_headers_replace(d->m_msg->request_headers, "Accept-Encoding", "identity");
+
+    // Balanced in ResourceHandleInternal's destructor; we need to
+    // keep our own ref, because after queueing the message, the
+    // session owns the initial reference.
+    g_object_ref(d->m_msg);
     soup_session_queue_message(session, d->m_msg, finishedCallback, this);
 
     return true;
 }
 
-static gboolean reportUnknownProtocolError(gpointer callback_data)
-{
-    ResourceHandle* handle = static_cast<ResourceHandle*>(callback_data);
-    ResourceHandleInternal* d = handle->getInternal();
-    ResourceHandleClient* client = handle->client();
-
-    if (d->m_cancelled || !client) {
-        handle->deref();
-        return false;
-    }
-
-    KURL url = handle->request().url();
-    ResourceError error("webkit-network-error", ERROR_UNKNOWN_PROTOCOL, url.string(), url.protocol());
-    client->didFail(handle, error);
-
-    handle->deref();
-    return false;
-}
-
 bool ResourceHandle::start(Frame* frame)
 {
     ASSERT(!d->m_msg);
@@ -585,11 +583,9 @@
         // FIXME: should we be doing any other protocols here?
         return startGio(url);
 
-    // Error must not be reported immediately, but through an idle function.
-    // Despite error, we should return true so a proper handle is created,
-    // to which this failure can be reported.
-    ref();
-    d->m_idleHandler = g_idle_add(reportUnknownProtocolError, this);
+    // Error must not be reported immediately
+    this->scheduleFailure(InvalidURLFailure);
+
     return true;
 }
 
@@ -632,7 +628,7 @@
     return false;
 }
 
-void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& data, Frame* frame)
+void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials /*storedCredentials*/, ResourceError& error, ResourceResponse& response, Vector<char>& data, Frame* frame)
 {
     WebCoreSynchronousLoader syncLoader(error, response, data);
     ResourceHandle handle(request, &syncLoader, true, false, true);
@@ -643,15 +639,6 @@
 
 // GIO-based loader
 
-static inline ResourceError networkErrorForFile(GFile* file, GError* error)
-{
-    // FIXME: Map gio errors to a more detailed error code when we have it in WebKit.
-    gchar* uri = g_file_get_uri(file);
-    ResourceError resourceError("webkit-network-error", ERROR_TRANSPORT, uri, error ? String::fromUTF8(error->message) : String());
-    g_free(uri);
-    return resourceError;
-}
-
 static void cleanupGioOperation(ResourceHandleInternal* d)
 {
     if (d->m_gfile) {
@@ -710,7 +697,10 @@
 
     gssize bytesRead = g_input_stream_read_finish(d->m_inputStream, res, &error);
     if (error) {
-        ResourceError resourceError = networkErrorForFile(d->m_gfile, error);
+        ResourceError resourceError(g_quark_to_string(G_IO_ERROR),
+                                    error->code,
+                                    g_file_get_uri(d->m_gfile),
+                                    error ? String::fromUTF8(error->message) : String());
         g_error_free(error);
         cleanupGioOperation(d);
         client->didFail(handle.get(), resourceError);
@@ -753,7 +743,11 @@
     GError *error = 0;
     GFileInputStream* in = g_file_read_finish(G_FILE(source), res, &error);
     if (error) {
-        ResourceError resourceError = networkErrorForFile(d->m_gfile, error);
+        ResourceError resourceError(g_quark_to_string(G_IO_ERROR),
+                                    error->code,
+                                    g_file_get_uri(d->m_gfile),
+                                    error ? String::fromUTF8(error->message) : String());
+
         g_error_free(error);
         cleanupGioOperation(d);
         client->didFail(handle, resourceError);
@@ -800,8 +794,10 @@
         // server (and then keep track of the fact that we mounted it,
         // and set a timeout to unmount it later after it's been idle
         // for a while).
-
-        ResourceError resourceError = networkErrorForFile(d->m_gfile, error);
+        ResourceError resourceError(g_quark_to_string(G_IO_ERROR),
+                                    error->code,
+                                    g_file_get_uri(d->m_gfile),
+                                    error ? String::fromUTF8(error->message) : String());
         g_error_free(error);
         cleanupGioOperation(d);
         client->didFail(handle, resourceError);
@@ -811,8 +807,10 @@
     if (g_file_info_get_file_type(info) != G_FILE_TYPE_REGULAR) {
         // FIXME: what if the URI points to a directory? Should we
         // generate a listing? How? What do other backends do here?
-
-        ResourceError resourceError = networkErrorForFile(d->m_gfile, 0);
+        ResourceError resourceError(g_quark_to_string(G_IO_ERROR),
+                                    G_IO_ERROR_FAILED,
+                                    g_file_get_uri(d->m_gfile),
+                                    String());
         cleanupGioOperation(d);
         client->didFail(handle, resourceError);
         return;
@@ -834,7 +832,9 @@
 bool ResourceHandle::startGio(KURL url)
 {
     if (request().httpMethod() != "GET" && request().httpMethod() != "POST") {
-        ResourceError error("webkit-network-error", ERROR_BAD_NON_HTTP_METHOD, url.string(), request().httpMethod());
+        ResourceError error(g_quark_to_string(SOUP_HTTP_ERROR),
+                            SOUP_STATUS_METHOD_NOT_ALLOWED,
+                            url.string(), request().httpMethod());
         d->client()->didFail(this, error);
         return false;
     }
@@ -846,12 +846,14 @@
     url.setQuery(String());
     url.setPort(0);
 
+#if !PLATFORM(WIN_OS)
     // we avoid the escaping for local files, because
     // g_filename_from_uri (used internally by GFile) has problems
     // decoding strings with arbitrary percent signs
     if (url.isLocalFile())
         d->m_gfile = g_file_new_for_path(url.prettyURL().utf8().data() + sizeof("file://") - 1);
     else
+#endif
         d->m_gfile = g_file_new_for_uri(url.string().utf8().data());
     g_object_set_data(G_OBJECT(d->m_gfile), "webkit-resource", this);
     d->m_cancellable = g_cancellable_new();
diff --git a/WebCore/platform/network/soup/ResourceRequest.h b/WebCore/platform/network/soup/ResourceRequest.h
index efb1240..82b4eb9 100644
--- a/WebCore/platform/network/soup/ResourceRequest.h
+++ b/WebCore/platform/network/soup/ResourceRequest.h
@@ -29,6 +29,8 @@
 
 #include "ResourceRequestBase.h"
 
+#include <libsoup/soup.h>
+
 namespace WebCore {
 
     struct ResourceRequest : ResourceRequestBase {
@@ -54,11 +56,20 @@
         {
         }
 
-    private:
-        friend class ResourceRequestBase;
+        ResourceRequest(SoupMessage* soupMessage)
+            : ResourceRequestBase(KURL(), UseProtocolCachePolicy)
+        {
+            updateFromSoupMessage(soupMessage);
+        }
 
-        void doUpdatePlatformRequest() {}
-        void doUpdateResourceRequest() {}
+        SoupMessage* toSoupMessage() const;
+        void updateFromSoupMessage(SoupMessage* soupMessage);
+
+    private:
+        friend struct ResourceRequestBase;
+
+        void doUpdatePlatformRequest() {};
+        void doUpdateResourceRequest() {};
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/soup/ResourceRequestSoup.cpp b/WebCore/platform/network/soup/ResourceRequestSoup.cpp
new file mode 100644
index 0000000..f2011bb
--- /dev/null
+++ b/WebCore/platform/network/soup/ResourceRequestSoup.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009 Gustavo Noronha Silva
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "ResourceRequest.h"
+
+#include "CString.h"
+#include "GOwnPtr.h"
+#include "PlatformString.h"
+
+#include <libsoup/soup.h>
+
+using namespace std;
+
+namespace WebCore {
+
+SoupMessage* ResourceRequest::toSoupMessage() const
+{
+    SoupMessage* soupMessage = soup_message_new(httpMethod().utf8().data(), url().string().utf8().data());
+    if (!soupMessage)
+        return 0;
+
+    HTTPHeaderMap headers = httpHeaderFields();
+    SoupMessageHeaders* soupHeaders = soupMessage->request_headers;
+    if (!headers.isEmpty()) {
+        HTTPHeaderMap::const_iterator end = headers.end();
+        for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it)
+            soup_message_headers_append(soupHeaders, it->first.string().utf8().data(), it->second.utf8().data());
+    }
+
+    // Body data is only handled at ResourceHandleSoup::startHttp for
+    // now; this is because this may not be a good place to go
+    // openning and mmapping files. We should maybe revisit this.
+    return soupMessage;
+}
+
+void ResourceRequest::updateFromSoupMessage(SoupMessage* soupMessage)
+{
+    SoupURI* soupURI = soup_message_get_uri(soupMessage);
+    GOwnPtr<gchar> uri(soup_uri_to_string(soupURI, FALSE));
+    m_url = KURL(KURL(), String::fromUTF8(uri.get()));
+
+    m_httpMethod = String::fromUTF8(soupMessage->method);
+
+    SoupMessageHeadersIter headersIter;
+    const char* headerName;
+    const char* headerValue;
+
+    soup_message_headers_iter_init(&headersIter, soupMessage->request_headers);
+    while (soup_message_headers_iter_next(&headersIter, &headerName, &headerValue))
+        m_httpHeaderFields.set(String::fromUTF8(headerName), String::fromUTF8(headerValue));
+
+    m_httpBody = FormData::create(soupMessage->request_body->data, soupMessage->request_body->length);
+
+    // FIXME: m_allowHTTPCookies and m_firstPartyForCookies should
+    // probably be handled here and on doUpdatePlatformRequest
+    // somehow.
+}
+
+}
diff --git a/WebCore/platform/network/win/CookieJarCFNetWin.cpp b/WebCore/platform/network/win/CookieJarCFNetWin.cpp
index 7e64813..af9e3f3 100644
--- a/WebCore/platform/network/win/CookieJarCFNetWin.cpp
+++ b/WebCore/platform/network/win/CookieJarCFNetWin.cpp
@@ -63,7 +63,7 @@
     return filteredCookies;
 }
 
-void setCookies(Document* /*document*/, const KURL& url, const KURL& policyURL, const String& value)
+void setCookies(Document* document, const KURL& url, const String& value)
 {
     // <rdar://problem/5632883> CFHTTPCookieStorage stores an empty cookie, which would be sent as "Cookie: =".
     if (value.isEmpty())
@@ -74,7 +74,7 @@
         return;
 
     RetainPtr<CFURLRef> urlCF(AdoptCF, url.createCFURL());
-    RetainPtr<CFURLRef> policyURLCF(AdoptCF, policyURL.createCFURL());
+    RetainPtr<CFURLRef> firstPartyForCookiesCF(AdoptCF, document->firstPartyForCookies().createCFURL());
 
     // <http://bugs.webkit.org/show_bug.cgi?id=6531>, <rdar://4409034>
     // cookiesWithResponseHeaderFields doesn't parse cookies without a value
@@ -88,7 +88,7 @@
     RetainPtr<CFArrayRef> cookiesCF(AdoptCF, CFHTTPCookieCreateWithResponseHeaderFields(kCFAllocatorDefault,
         headerFieldsCF.get(), urlCF.get()));
 
-    CFHTTPCookieStorageSetCookies(cookieStorage, filterCookies(cookiesCF.get()).get(), urlCF.get(), policyURLCF.get());
+    CFHTTPCookieStorageSetCookies(cookieStorage, filterCookies(cookiesCF.get()).get(), urlCF.get(), firstPartyForCookiesCF.get());
 }
 
 String cookies(const Document* /*document*/, const KURL& url)
diff --git a/WebCore/platform/network/win/CookieJarWin.cpp b/WebCore/platform/network/win/CookieJarWin.cpp
index cdafb1b..41d12d9 100644
--- a/WebCore/platform/network/win/CookieJarWin.cpp
+++ b/WebCore/platform/network/win/CookieJarWin.cpp
@@ -36,9 +36,9 @@
 namespace WebCore {
 
 
-void setCookies(Document* /*document*/, const KURL& url, const KURL& policyURL, const String& value)
+void setCookies(Document* /*document*/, const KURL& url, const String& value)
 {
-    // FIXME: Deal with the policy URL.
+    // FIXME: Deal with document->firstPartyForCookies().
     String str = url.string();
     String val = value;
     InternetSetCookie(str.charactersWithNullTermination(), 0, val.charactersWithNullTermination());
diff --git a/WebCore/platform/posix/FileSystemPOSIX.cpp b/WebCore/platform/posix/FileSystemPOSIX.cpp
index c1bef60..e55b8a4 100644
--- a/WebCore/platform/posix/FileSystemPOSIX.cpp
+++ b/WebCore/platform/posix/FileSystemPOSIX.cpp
@@ -30,7 +30,6 @@
 #include "FileSystem.h"
 
 #include "CString.h"
-#include "NotImplemented.h"
 #include "PlatformString.h"
 
 #include <sys/stat.h>
diff --git a/WebCore/platform/qt/ContextMenuQt.cpp b/WebCore/platform/qt/ContextMenuQt.cpp
index 3e093b1..063a46b 100644
--- a/WebCore/platform/qt/ContextMenuQt.cpp
+++ b/WebCore/platform/qt/ContextMenuQt.cpp
@@ -26,7 +26,6 @@
 
 #include "config.h"
 #include "ContextMenu.h"
-#include "MenuEventProxy.h"
 
 #include <wtf/Assertions.h>
 
diff --git a/WebCore/platform/qt/CookieJarQt.cpp b/WebCore/platform/qt/CookieJarQt.cpp
index 4077407..40d9309 100644
--- a/WebCore/platform/qt/CookieJarQt.cpp
+++ b/WebCore/platform/qt/CookieJarQt.cpp
@@ -28,11 +28,11 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Document.h"
 #include "KURL.h"
 #include "PlatformString.h"
 
 #if QT_VERSION >= 0x040400
-#include "Document.h"
 #include "qwebpage.h"
 #include "qwebframe.h"
 #include "FrameLoaderClientQt.h"
@@ -61,10 +61,10 @@
 }
 #endif
 
-void setCookies(Document* document, const KURL& url, const KURL& policyURL, const String& value)
+void setCookies(Document* document, const KURL& url, const String& value)
 {
     QUrl u(url);
-    QUrl p(policyURL);
+    QUrl p(document->firstPartyForCookies());
 #if QT_VERSION >= 0x040400
     QNetworkCookieJar* jar = cookieJar(document);
     if (!jar)
diff --git a/WebCore/platform/qt/DragDataQt.cpp b/WebCore/platform/qt/DragDataQt.cpp
index 9d95373..bc5cce1 100644
--- a/WebCore/platform/qt/DragDataQt.cpp
+++ b/WebCore/platform/qt/DragDataQt.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,7 +30,6 @@
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "markup.h"
-#include "NotImplemented.h"
 
 #include <QList>
 #include <QMimeData>
@@ -126,6 +125,10 @@
     if (!m_platformDragData)
         return String();
     QList<QUrl> urls = m_platformDragData->urls();
+
+    if (urls.isEmpty())
+        return String();
+
     return urls.first().toString();
 }
     
diff --git a/WebCore/platform/qt/FileSystemQt.cpp b/WebCore/platform/qt/FileSystemQt.cpp
index 8a272c1..a17f3ab 100644
--- a/WebCore/platform/qt/FileSystemQt.cpp
+++ b/WebCore/platform/qt/FileSystemQt.cpp
@@ -33,7 +33,6 @@
 #include "FileSystem.h"
 
 #include "CString.h"
-#include "NotImplemented.h"
 #include "PlatformString.h"
 
 #include <QDateTime>
diff --git a/WebCore/platform/qt/Localizations.cpp b/WebCore/platform/qt/Localizations.cpp
index cb805f9..a6c7513 100644
--- a/WebCore/platform/qt/Localizations.cpp
+++ b/WebCore/platform/qt/Localizations.cpp
@@ -30,7 +30,6 @@
 
 #include "IntSize.h"
 #include "LocalizedStrings.h"
-#include "NotImplemented.h"
 #include "PlatformString.h"
 
 #include <QCoreApplication>
@@ -245,12 +244,12 @@
 
 String contextMenuItemTagLeftToRight()
 {
-    return QCoreApplication::translate("QWebPage", "LTR", "Left to Right context menu item");
+    return QCoreApplication::translate("QWebPage", "Left to Right", "Left to Right context menu item");
 }
 
 String contextMenuItemTagRightToLeft()
 {
-    return QCoreApplication::translate("QWebPage", "RTL", "Right to Left context menu item");
+    return QCoreApplication::translate("QWebPage", "Right to Left", "Right to Left context menu item");
 }
 
 String contextMenuItemTagInspectElement()
diff --git a/WebCore/platform/qt/MenuEventProxy.h b/WebCore/platform/qt/MenuEventProxy.h
deleted file mode 100644
index 658d1ee..0000000
--- a/WebCore/platform/qt/MenuEventProxy.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2007 Staikos Computing Services Inc. <info@staikos.net>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-
-#ifndef MENUEVENTPROXY_H
-#define MENUEVENTPROXY_H
-
-#include "Platform.h"
-#include <qobject.h>
-#include <qmap.h>
-#include "ContextMenu.h"
-#include "ContextMenuItem.h"
-#include "ContextMenuController.h"
-
-namespace WebCore {
-class MenuEventProxy : public QObject {
-    Q_OBJECT
-    public:
-        MenuEventProxy(WebCore::ContextMenu *m) : m_m(m) {}
-        ~MenuEventProxy() {}
-
-        void map(QAction* action, unsigned actionTag) { _map[action] = actionTag; }
-
-    public slots:
-        void trigger(QAction *action) {
-            WebCore::ContextMenuItem item(WebCore::ActionType, static_cast<WebCore::ContextMenuAction>(_map[action]), WebCore::String()); 
-            m_m->controller()->contextMenuItemSelected(&item);
-        }
-
-    private:
-        WebCore::ContextMenu *m_m;
-        QMap<QAction*, unsigned> _map;
-};
-
-}
-
-#endif
-// vim: ts=4 sw=4 et
diff --git a/WebCore/platform/qt/PopupMenuQt.cpp b/WebCore/platform/qt/PopupMenuQt.cpp
index 76728fa..a7d6643 100644
--- a/WebCore/platform/qt/PopupMenuQt.cpp
+++ b/WebCore/platform/qt/PopupMenuQt.cpp
@@ -30,7 +30,6 @@
 #include "FrameView.h"
 #include "HostWindow.h"
 #include "PopupMenuClient.h"
-#include "NotImplemented.h"
 #include "QWebPopup.h"
 
 #include <QAction>
diff --git a/WebCore/platform/qt/QWebPopup.cpp b/WebCore/platform/qt/QWebPopup.cpp
index 4d57c9b..f437c27 100644
--- a/WebCore/platform/qt/QWebPopup.cpp
+++ b/WebCore/platform/qt/QWebPopup.cpp
@@ -82,4 +82,6 @@
     m_client->valueChanged(index);
 }
 
-}
+} // namespace WebCore
+
+#include "moc_QWebPopup.cpp"
diff --git a/WebCore/platform/qt/RenderThemeQt.cpp b/WebCore/platform/qt/RenderThemeQt.cpp
index 942e95b..b16cbc4 100644
--- a/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/WebCore/platform/qt/RenderThemeQt.cpp
@@ -41,6 +41,7 @@
 #include <QWidget>
 #include <QPainter>
 #include <QPushButton>
+#include <QLineEdit>
 #include <QStyleFactory>
 #include <QStyleOptionButton>
 #include <QStyleOptionFrameV2>
@@ -124,6 +125,12 @@
 #endif
 
     m_fallbackStyle = 0;
+
+    // this will need to be regenerated when the style changes
+    QLineEdit lineEdit;
+    QStyleOptionFrameV2 opt;
+    m_frameLineWidth = QApplication::style()->pixelMetric(QStyle::PM_DefaultFrameWidth,
+                                                          &opt, &lineEdit);
 }
 
 RenderThemeQt::~RenderThemeQt()
@@ -272,7 +279,7 @@
     return 7 * fm.width(QLatin1Char('x'));
 }
 
-static void computeSizeBasedOnStyle(RenderStyle* renderStyle)
+void RenderThemeQt::computeSizeBasedOnStyle(RenderStyle* renderStyle) const
 {
     // If the width and height are both specified, then we have nothing to do.
     if (!renderStyle->width().isIntrinsicOrAuto() && !renderStyle->height().isAuto())
@@ -339,13 +346,15 @@
         int h = qMax(fm.lineSpacing(), 14) + 2*verticalMargin;
         int w = fm.width(QLatin1Char('x')) * 17 + 2*horizontalMargin;
         QStyleOptionFrameV2 opt;
-        opt.lineWidth = applicationStyle->pixelMetric(QStyle::PM_DefaultFrameWidth,
-                                                           &opt, 0);
+        opt.lineWidth = m_frameLineWidth;
         QSize sz = applicationStyle->sizeFromContents(QStyle::CT_LineEdit,
-                                                           &opt,
-                                                           QSize(w, h).expandedTo(QApplication::globalStrut()),
-                                                           0);
+                                                      &opt,
+                                                      QSize(w, h).expandedTo(QApplication::globalStrut()),
+                                                      0);
         size.setHeight(sz.height());
+
+        renderStyle->setPaddingLeft(Length(opt.lineWidth, Fixed));
+        renderStyle->setPaddingRight(Length(opt.lineWidth, Fixed));
         break;
     }
     default:
@@ -486,6 +495,9 @@
 {
     style->setBackgroundColor(Color::transparent);
     style->setColor(QApplication::palette().text().color());
+    style->resetBorder();
+    style->resetPadding();
+    computeSizeBasedOnStyle(style);
 }
 
 bool RenderThemeQt::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
@@ -499,7 +511,7 @@
         panel.initFrom(p.widget);
 
     panel.rect = r;
-    panel.lineWidth = p.style->pixelMetric(QStyle::PM_DefaultFrameWidth, &panel, p.widget);
+    panel.lineWidth = m_frameLineWidth;
     panel.state |= QStyle::State_Sunken;
     panel.features = QStyleOptionFrameV2::None;
 
@@ -729,6 +741,10 @@
     if (isHovered(o))
         option.state |= QStyle::State_MouseOver;
 
+    option.direction = Qt::LeftToRight;
+    if (o->style() && o->style()->direction() == WebCore::RTL)
+        option.direction = Qt::RightToLeft;
+
     ControlPart result = o->style()->appearance();
 
     switch (result) {
diff --git a/WebCore/platform/qt/RenderThemeQt.h b/WebCore/platform/qt/RenderThemeQt.h
index b4a5064..5c78a72 100644
--- a/WebCore/platform/qt/RenderThemeQt.h
+++ b/WebCore/platform/qt/RenderThemeQt.h
@@ -128,6 +128,7 @@
     void paintMediaBackground(QPainter* painter, const IntRect& r) const;
     QColor getMediaControlForegroundColor(RenderObject* o = 0) const;
 #endif
+    void computeSizeBasedOnStyle(RenderStyle* renderStyle) const;
 
 private:
     bool supportsFocus(ControlPart) const;
@@ -144,6 +145,8 @@
 
     QStyle* m_fallbackStyle;
     QStyle* fallbackStyle();
+
+    int m_frameLineWidth;
 };
 
 class StylePainter
diff --git a/WebCore/platform/qt/ScrollViewQt.cpp b/WebCore/platform/qt/ScrollViewQt.cpp
index 76d9f01..48885d3 100644
--- a/WebCore/platform/qt/ScrollViewQt.cpp
+++ b/WebCore/platform/qt/ScrollViewQt.cpp
@@ -36,27 +36,33 @@
 
 void ScrollView::platformInit()
 {
-    m_widgetsThatPreventBlitting = 0;
+    m_widgetsPreventingBlitting = 0;
 }
 
 void ScrollView::platformDestroy()
 {
 }
 
+// Windowed plugins are using native windows and are thus preventing
+// us from doing any kind of scrolling optimization.
+
+void ScrollView::adjustWidgetsPreventingBlittingCount(int delta)
+{
+    m_widgetsPreventingBlitting += delta;
+    if (parent())
+        parent()->adjustWidgetsPreventingBlittingCount(delta);
+}
+
 void ScrollView::platformAddChild(Widget* child)
 {
-    root()->m_widgetsThatPreventBlitting++;
-    if (parent())
-        parent()->platformAddChild(child);
+    adjustWidgetsPreventingBlittingCount(1);
 }
 
 void ScrollView::platformRemoveChild(Widget* child)
 {
-    ASSERT(root()->m_widgetsThatPreventBlitting);
-    root()->m_widgetsThatPreventBlitting--;
     child->hide();
+    adjustWidgetsPreventingBlittingCount(-1);
 }
 
 }
-
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/qt/TemporaryLinkStubs.cpp b/WebCore/platform/qt/TemporaryLinkStubs.cpp
index ff0b27d..f76eb43 100644
--- a/WebCore/platform/qt/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/qt/TemporaryLinkStubs.cpp
@@ -74,39 +74,6 @@
 
 using namespace WebCore;
 
-#if (!defined(Q_WS_X11) && !defined(Q_WS_WIN) && !defined(Q_WS_MAC32)) || defined(Q_OS_WINCE)
-
-bool PluginPackage::fetchInfo() { notImplemented(); return false; }
-unsigned PluginPackage::hash() const { notImplemented(); return 0; }
-bool PluginPackage::equal(const PluginPackage&, const PluginPackage&) { notImplemented(); return false; }
-int PluginPackage::compareFileVersion(const PlatformModuleVersion&) const { notImplemented(); return -1; }
-
-void PluginView::setNPWindowRect(const IntRect&) { notImplemented(); }
-const char* PluginView::userAgent() { notImplemented(); return 0; }
-#if ENABLE(NETSCAPE_PLUGIN_API)
-const char* PluginView::userAgentStatic() { notImplemented(); return 0; }
-#endif
-void PluginView::invalidateRect(NPRect*) { notImplemented(); }
-void PluginView::invalidateRect(const IntRect&) { notImplemented(); }
-void PluginView::invalidateRegion(NPRegion) { notImplemented(); }
-void PluginView::forceRedraw() { notImplemented(); }
-void PluginView::setFocus() { Widget::setFocus(); }
-void PluginView::show() { Widget::show(); }
-void PluginView::hide() { Widget::hide(); }
-void PluginView::paint(GraphicsContext*, const IntRect&) { notImplemented(); }
-void PluginView::setParent(ScrollView* view) { Widget::setParent(view); }
-void PluginView::setParentVisible(bool) { notImplemented(); }
-void PluginView::updatePluginWidget() { notImplemented(); }
-void PluginView::handleKeyboardEvent(KeyboardEvent*) { notImplemented(); }
-void PluginView::handleMouseEvent(MouseEvent*) { notImplemented(); }
-NPError PluginView::handlePostReadFile(Vector<char>&, uint32, const char*) { notImplemented(); return NPERR_GENERIC_ERROR; }
-NPError PluginView::getValue(NPNVariable, void*) { notImplemented(); return NPERR_GENERIC_ERROR; }
-#if ENABLE(NETSCAPE_PLUGIN_API)
-NPError PluginView::getValueStatic(NPNVariable, void*) { return NPERR_GENERIC_ERROR; }
-#endif
-PluginView::~PluginView() {}
-#endif
-
 #if defined(Q_OS_WINCE)
 Vector<String> PluginDatabase::defaultPluginDirectories() { notImplemented(); return Vector<String>(); }
 void PluginDatabase::getPluginPathsInDirectories(HashSet<String>& paths) const { notImplemented(); }
diff --git a/WebCore/platform/text/AtomicString.cpp b/WebCore/platform/text/AtomicString.cpp
index d85f5ee..409439e 100644
--- a/WebCore/platform/text/AtomicString.cpp
+++ b/WebCore/platform/text/AtomicString.cpp
@@ -206,7 +206,7 @@
 
 PassRefPtr<StringImpl> AtomicString::add(StringImpl* r)
 {
-    if (!r || r->m_inTable)
+    if (!r || r->inTable())
         return r;
 
     if (r->length() == 0)
@@ -214,7 +214,7 @@
     
     StringImpl* result = *stringTable().add(r).first;
     if (result == r)
-        r->m_inTable = true;
+        r->setInTable();
     return result;
 }
 
diff --git a/WebCore/platform/text/AtomicString.h b/WebCore/platform/text/AtomicString.h
index f4efab9..3307a2d 100644
--- a/WebCore/platform/text/AtomicString.h
+++ b/WebCore/platform/text/AtomicString.h
@@ -67,17 +67,21 @@
     UChar operator[](unsigned int i) const { return m_string[i]; }
     
     bool contains(UChar c) const { return m_string.contains(c); }
-    bool contains(const AtomicString& s, bool caseSensitive = true) const
-        { return m_string.contains(s.string(), caseSensitive); }
+    bool contains(const char* s, bool caseSensitive = true) const
+        { return m_string.contains(s, caseSensitive); }
+    bool contains(const String& s, bool caseSensitive = true) const
+        { return m_string.contains(s, caseSensitive); }
 
     int find(UChar c, int start = 0) const { return m_string.find(c, start); }
-    int find(const AtomicString& s, int start = 0, bool caseSentitive = true) const
-        { return m_string.find(s.string(), start, caseSentitive); }
+    int find(const char* s, int start = 0, bool caseSentitive = true) const
+        { return m_string.find(s, start, caseSentitive); }
+    int find(const String& s, int start = 0, bool caseSentitive = true) const
+        { return m_string.find(s, start, caseSentitive); }
     
-    bool startsWith(const AtomicString& s, bool caseSensitive = true) const
-        { return m_string.startsWith(s.string(), caseSensitive); }
-    bool endsWith(const AtomicString& s, bool caseSensitive = true) const
-        { return m_string.endsWith(s.string(), caseSensitive); }
+    bool startsWith(const String& s, bool caseSensitive = true) const
+        { return m_string.startsWith(s, caseSensitive); }
+    bool endsWith(const String& s, bool caseSensitive = true) const
+        { return m_string.endsWith(s, caseSensitive); }
     
     int toInt(bool* ok = 0) const { return m_string.toInt(ok); }
     double toDouble(bool* ok = 0) const { return m_string.toDouble(ok); }
diff --git a/WebCore/platform/text/BidiContext.cpp b/WebCore/platform/text/BidiContext.cpp
index ef3c225..546571e 100644
--- a/WebCore/platform/text/BidiContext.cpp
+++ b/WebCore/platform/text/BidiContext.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2003, 2004, 2006, 2007 Apple Inc.  All right reserved.
+ * Copyright (C) 2003, 2004, 2006, 2007, 2009 Apple Inc. All right reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,8 +22,37 @@
 #include "config.h"
 #include "BidiContext.h"
 
+#include <wtf/StdLibExtras.h>
+
 namespace WebCore {
 
+using namespace WTF::Unicode;
+
+PassRefPtr<BidiContext> BidiContext::create(unsigned char level, Direction direction, bool override, BidiContext* parent)
+{
+    ASSERT(direction == level % 2 ? RightToLeft : LeftToRight);
+
+    if (parent)
+        return adoptRef(new BidiContext(level, direction, override, parent));
+
+    ASSERT(level <= 1);
+    if (!level) {
+        DEFINE_STATIC_LOCAL(BidiContext, ltrContext, (0, LeftToRight, false, 0));
+        if (!override)
+            return &ltrContext;
+
+        DEFINE_STATIC_LOCAL(BidiContext, ltrOverrideContext, (0, LeftToRight, true, 0));
+        return &ltrOverrideContext;
+    }
+
+    DEFINE_STATIC_LOCAL(BidiContext, rtlContext, (1, RightToLeft, false, 0));
+    if (!override)
+        return &rtlContext;
+
+    DEFINE_STATIC_LOCAL(BidiContext, rtlOverrideContext, (1, RightToLeft, true, 0));
+    return &rtlOverrideContext;
+}
+
 bool operator==(const BidiContext& c1, const BidiContext& c2)
 {
     if (&c1 == &c2)
diff --git a/WebCore/platform/text/BidiContext.h b/WebCore/platform/text/BidiContext.h
index 89123c8..8791605 100644
--- a/WebCore/platform/text/BidiContext.h
+++ b/WebCore/platform/text/BidiContext.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2003, 2004, 2006, 2007 Apple Inc.  All right reserved.
+ * Copyright (C) 2003, 2004, 2006, 2007, 2009 Apple Inc. All right reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,31 +23,17 @@
 #define BidiContext_h
 
 #include <wtf/Assertions.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
 
 // Used to keep track of explicit embeddings.
-class BidiContext {
+class BidiContext : public RefCounted<BidiContext> {
 public:
-    BidiContext(unsigned char level, WTF::Unicode::Direction direction, bool override = false, BidiContext* parent = 0)
-        : m_level(level)
-        , m_direction(direction)
-        , m_override(override)
-        , m_parent(parent)
-        , m_refCount(0)
-    {
-        ASSERT(direction == WTF::Unicode::LeftToRight || direction == WTF::Unicode::RightToLeft);
-    }
-
-    void ref() const { m_refCount++; }
-    void deref() const
-    {
-        m_refCount--;
-        if (m_refCount <= 0)
-            delete this;
-    }
+    static PassRefPtr<BidiContext> create(unsigned char level, WTF::Unicode::Direction direction, bool override = false, BidiContext* parent = 0);
 
     BidiContext* parent() const { return m_parent.get(); }
     unsigned char level() const { return m_level; }
@@ -55,11 +41,18 @@
     bool override() const { return m_override; }
 
 private:
+    BidiContext(unsigned char level, WTF::Unicode::Direction direction, bool override, BidiContext* parent)
+        : m_level(level)
+        , m_direction(direction)
+        , m_override(override)
+        , m_parent(parent)
+    {
+    }
+
     unsigned char m_level;
     unsigned m_direction : 5; // Direction
     bool m_override : 1;
     RefPtr<BidiContext> m_parent;
-    mutable int m_refCount;
 };
 
 bool operator==(const BidiContext&, const BidiContext&);
diff --git a/WebCore/platform/text/BidiResolver.h b/WebCore/platform/text/BidiResolver.h
index 8288be4..b6c2e88 100644
--- a/WebCore/platform/text/BidiResolver.h
+++ b/WebCore/platform/text/BidiResolver.h
@@ -402,7 +402,7 @@
                 level &= ~1;
             }
             if (level < 61)
-                toContext = new BidiContext(level, direction, override, toContext.get());
+                toContext = BidiContext::create(level, direction, override, toContext.get());
         }
     }
 
diff --git a/WebCore/platform/text/CharacterNames.h b/WebCore/platform/text/CharacterNames.h
index f589a6c..5b1a337 100644
--- a/WebCore/platform/text/CharacterNames.h
+++ b/WebCore/platform/text/CharacterNames.h
@@ -37,6 +37,7 @@
 
     const UChar blackSquare = 0x25A0;
     const UChar bullet = 0x2022;
+    const UChar hebrewPunctuationGershayim = 0x05F4;
     const UChar horizontalEllipsis = 0x2026;
     const UChar ideographicSpace = 0x3000;
     const UChar ideographicComma = 0x3001;
@@ -49,6 +50,7 @@
     const UChar objectReplacementCharacter = 0xFFFC;
     const UChar popDirectionalFormatting = 0x202C;
     const UChar replacementCharacter = 0xFFFD;
+    const UChar rightSingleQuotationMark = 0x2019;
     const UChar rightToLeftMark = 0x200F;
     const UChar rightToLeftEmbed = 0x202B;
     const UChar rightToLeftOverride = 0x202E;
diff --git a/WebCore/platform/text/PlatformString.h b/WebCore/platform/text/PlatformString.h
index a1541d2..1cc60b2 100644
--- a/WebCore/platform/text/PlatformString.h
+++ b/WebCore/platform/text/PlatformString.h
@@ -162,6 +162,11 @@
     
     static String format(const char *, ...) WTF_ATTRIBUTE_PRINTF(1, 2);
 
+    // Returns an uninitialized string. The characters needs to be written
+    // into the buffer returned in data before the returned string is used.
+    // Failure to do this will have unpredictable results.
+    static String createUninitialized(unsigned length, UChar*& data) { return StringImpl::createUninitialized(length, data); }
+
     void split(const String& separator, Vector<String>& result) const;
     void split(const String& separator, bool allowEmptyEntries, Vector<String>& result) const;
     void split(UChar separator, Vector<String>& result) const;
diff --git a/WebCore/platform/text/String.cpp b/WebCore/platform/text/String.cpp
index 733b661..cd87e2c 100644
--- a/WebCore/platform/text/String.cpp
+++ b/WebCore/platform/text/String.cpp
@@ -85,10 +85,12 @@
     // call to fastMalloc every single time.
     if (str.m_impl) {
         if (m_impl) {
-            StringBuffer buffer(m_impl->length() + str.length());
-            memcpy(buffer.characters(), m_impl->characters(), m_impl->length() * sizeof(UChar));
-            memcpy(buffer.characters() + m_impl->length(), str.characters(), str.length() * sizeof(UChar));
-            m_impl = StringImpl::adopt(buffer);
+            UChar* data;
+            RefPtr<StringImpl> newImpl =
+                StringImpl::createUninitialized(m_impl->length() + str.length(), data);
+            memcpy(data, m_impl->characters(), m_impl->length() * sizeof(UChar));
+            memcpy(data + m_impl->length(), str.characters(), str.length() * sizeof(UChar));
+            m_impl = newImpl.release();
         } else
             m_impl = str.m_impl;
     }
@@ -101,10 +103,12 @@
     // one String is pointing at this StringImpl, but even then it's going to require a
     // call to fastMalloc every single time.
     if (m_impl) {
-        StringBuffer buffer(m_impl->length() + 1);
-        memcpy(buffer.characters(), m_impl->characters(), m_impl->length() * sizeof(UChar));
-        buffer[m_impl->length()] = c;
-        m_impl = StringImpl::adopt(buffer);
+        UChar* data;
+        RefPtr<StringImpl> newImpl =
+            StringImpl::createUninitialized(m_impl->length() + 1, data);
+        memcpy(data, m_impl->characters(), m_impl->length() * sizeof(UChar));
+        data[m_impl->length()] = c;
+        m_impl = newImpl.release();
     } else
         m_impl = StringImpl::create(&c, 1);
 }
@@ -116,10 +120,12 @@
     // one String is pointing at this StringImpl, but even then it's going to require a
     // call to fastMalloc every single time.
     if (m_impl) {
-        StringBuffer buffer(m_impl->length() + 1);
-        memcpy(buffer.characters(), m_impl->characters(), m_impl->length() * sizeof(UChar));
-        buffer[m_impl->length()] = c;
-        m_impl = StringImpl::adopt(buffer);
+        UChar* data;
+        RefPtr<StringImpl> newImpl =
+            StringImpl::createUninitialized(m_impl->length() + 1, data);
+        memcpy(data, m_impl->characters(), m_impl->length() * sizeof(UChar));
+        data[m_impl->length()] = c;
+        m_impl = newImpl.release();
     } else
         m_impl = StringImpl::create(&c, 1);
 }
@@ -170,10 +176,12 @@
         return;
 
     ASSERT(charactersToAppend);
-    StringBuffer buffer(length() + lengthToAppend);
-    memcpy(buffer.characters(), characters(), length() * sizeof(UChar));
-    memcpy(buffer.characters() + length(), charactersToAppend, lengthToAppend * sizeof(UChar));
-    m_impl = StringImpl::adopt(buffer);
+    UChar* data;
+    RefPtr<StringImpl> newImpl =
+        StringImpl::createUninitialized(length() + lengthToAppend, data);
+    memcpy(data, characters(), length() * sizeof(UChar));
+    memcpy(data + length(), charactersToAppend, lengthToAppend * sizeof(UChar));
+    m_impl = newImpl.release();
 }
 
 void String::insert(const UChar* charactersToInsert, unsigned lengthToInsert, unsigned position)
@@ -189,11 +197,13 @@
         return;
 
     ASSERT(charactersToInsert);
-    StringBuffer buffer(length() + lengthToInsert);
-    memcpy(buffer.characters(), characters(), position * sizeof(UChar));
-    memcpy(buffer.characters() + position, charactersToInsert, lengthToInsert * sizeof(UChar));
-    memcpy(buffer.characters() + position + lengthToInsert, characters() + position, (length() - position) * sizeof(UChar));
-    m_impl = StringImpl::adopt(buffer);
+    UChar* data;
+    RefPtr<StringImpl> newImpl =
+      StringImpl::createUninitialized(length() + lengthToInsert, data);
+    memcpy(data, characters(), position * sizeof(UChar));
+    memcpy(data + position, charactersToInsert, lengthToInsert * sizeof(UChar));
+    memcpy(data + position + lengthToInsert, characters() + position, (length() - position) * sizeof(UChar));
+    m_impl = newImpl.release();
 }
 
 UChar String::operator[](unsigned i) const
@@ -221,9 +231,10 @@
 {
     if (position >= length())
         return;
-    StringBuffer buffer(position);
-    memcpy(buffer.characters(), characters(), position * sizeof(UChar));
-    m_impl = StringImpl::adopt(buffer);
+    UChar* data;
+    RefPtr<StringImpl> newImpl = StringImpl::createUninitialized(position, data);
+    memcpy(data, characters(), position * sizeof(UChar));
+    m_impl = newImpl.release();
 }
 
 void String::remove(unsigned position, int lengthToRemove)
@@ -234,11 +245,13 @@
         return;
     if (static_cast<unsigned>(lengthToRemove) > length() - position)
         lengthToRemove = length() - position;
-    StringBuffer buffer(length() - lengthToRemove);
-    memcpy(buffer.characters(), characters(), position * sizeof(UChar));
-    memcpy(buffer.characters() + position, characters() + position + lengthToRemove,
+    UChar* data;
+    RefPtr<StringImpl> newImpl =
+        StringImpl::createUninitialized(length() - lengthToRemove, data);
+    memcpy(data, characters(), position * sizeof(UChar));
+    memcpy(data + position, characters() + position + lengthToRemove,
         (length() - lengthToRemove - position) * sizeof(UChar));
-    m_impl = StringImpl::adopt(buffer);
+    m_impl = newImpl.release();
 }
 
 String String::substring(unsigned pos, unsigned len) const
@@ -637,21 +650,21 @@
 {
     if (str.isNull())
         return;
-    m_impl = StringImpl::create(str.data(), str.size());
+    m_impl = StringImpl::create(str.ustring());
 }
 
 String::String(const UString& str)
 {
     if (str.isNull())
         return;
-    m_impl = StringImpl::create(str.data(), str.size());
+    m_impl = StringImpl::create(str);
 }
 
 String::operator UString() const
 {
     if (!m_impl)
         return UString();
-    return UString(m_impl->characters(), m_impl->length());
+    return m_impl->ustring();
 }
 #endif
 
diff --git a/WebCore/platform/text/StringBuilder.cpp b/WebCore/platform/text/StringBuilder.cpp
index 0e9555c..c21e366 100644
--- a/WebCore/platform/text/StringBuilder.cpp
+++ b/WebCore/platform/text/StringBuilder.cpp
@@ -79,9 +79,10 @@
     if (count == 1)
         return m_strings[0];
 
-    StringBuffer buffer(m_totalLength);
+    UChar* buffer;
+    String result = String::createUninitialized(m_totalLength, buffer);
 
-    UChar* p = buffer.characters();
+    UChar* p = buffer;
     for (unsigned i = 0; i < count; ++i) {
         StringImpl* string = m_strings[i].impl();
         unsigned length = string->length(); 
@@ -89,9 +90,9 @@
         p += length;
     }
 
-    ASSERT(p == m_totalLength + buffer.characters());
+    ASSERT(p == m_totalLength + buffer);
 
-    return String::adopt(buffer);
+    return result;
 }
 
 }
diff --git a/WebCore/platform/text/StringImpl.cpp b/WebCore/platform/text/StringImpl.cpp
index 6bba990..8bc4dde 100644
--- a/WebCore/platform/text/StringImpl.cpp
+++ b/WebCore/platform/text/StringImpl.cpp
@@ -44,6 +44,8 @@
 
 namespace WebCore {
 
+static const unsigned minLengthToShare = 20;
+
 static inline UChar* newUCharVector(unsigned n)
 {
     return static_cast<UChar*>(fastMalloc(sizeof(UChar) * n));
@@ -80,8 +82,6 @@
     : m_length(0)
     , m_data(0)
     , m_hash(0)
-    , m_inTable(false)
-    , m_hasTerminatingNullCharacter(false)
     , m_bufferIsInternal(false)
 {
     // Ensure that the hash is computed so that AtomicStringHash can call existingHash()
@@ -96,8 +96,6 @@
 inline StringImpl::StringImpl(const UChar* characters, unsigned length)
     : m_length(length)
     , m_hash(0)
-    , m_inTable(false)
-    , m_hasTerminatingNullCharacter(false)
     , m_bufferIsInternal(false)
 {
     UChar* data = newUCharVector(length);
@@ -108,10 +106,9 @@
 inline StringImpl::StringImpl(const StringImpl& str, WithTerminatingNullCharacter)
     : m_length(str.m_length)
     , m_hash(str.m_hash)
-    , m_inTable(false)
-    , m_hasTerminatingNullCharacter(true)
     , m_bufferIsInternal(false)
 {
+    m_sharedBufferAndFlags.setFlag(HasTerminatingNullCharacter);
     UChar* data = newUCharVector(str.m_length + 1);
     memcpy(data, str.m_data, str.m_length * sizeof(UChar));
     data[str.m_length] = 0;
@@ -121,8 +118,6 @@
 inline StringImpl::StringImpl(const char* characters, unsigned length)
     : m_length(length)
     , m_hash(0)
-    , m_inTable(false)
-    , m_hasTerminatingNullCharacter(false)
     , m_bufferIsInternal(false)
 {
     ASSERT(characters);
@@ -140,8 +135,6 @@
     : m_length(length)
     , m_data(characters)
     , m_hash(0)
-    , m_inTable(false)
-    , m_hasTerminatingNullCharacter(false)
     , m_bufferIsInternal(false)
 {
     ASSERT(characters);
@@ -152,14 +145,13 @@
 StringImpl::StringImpl(const UChar* characters, unsigned length, unsigned hash)
     : m_length(length)
     , m_hash(hash)
-    , m_inTable(true)
-    , m_hasTerminatingNullCharacter(false)
     , m_bufferIsInternal(false)
 {
     ASSERT(hash);
     ASSERT(characters);
     ASSERT(length);
 
+    setInTable();
     UChar* data = newUCharVector(length);
     memcpy(data, characters, length * sizeof(UChar));
     m_data = data;
@@ -169,14 +161,13 @@
 StringImpl::StringImpl(const char* characters, unsigned length, unsigned hash)
     : m_length(length)
     , m_hash(hash)
-    , m_inTable(true)
-    , m_hasTerminatingNullCharacter(false)
     , m_bufferIsInternal(false)
 {
     ASSERT(hash);
     ASSERT(characters);
     ASSERT(length);
 
+    setInTable();
     UChar* data = newUCharVector(length);
     for (unsigned i = 0; i != length; ++i) {
         unsigned char c = characters[i];
@@ -187,10 +178,15 @@
 
 StringImpl::~StringImpl()
 {
-    if (m_inTable)
+    if (inTable())
         AtomicString::remove(this);
-    if (!m_bufferIsInternal)
-        deleteUCharVector(m_data);
+    if (!m_bufferIsInternal) {
+        SharedUChar* sharedBuffer = m_sharedBufferAndFlags.get();
+        if (sharedBuffer)
+            sharedBuffer->deref();
+        else
+            deleteUCharVector(m_data);
+    }
 }
 
 StringImpl* StringImpl::empty()
@@ -264,7 +260,8 @@
 
 PassRefPtr<StringImpl> StringImpl::lower()
 {
-    StringBuffer data(m_length);
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
 
     // Do a faster loop for the case where all the characters are ASCII.
@@ -275,23 +272,24 @@
         data[i] = toASCIILower(c);
     }
     if (!(ored & ~0x7F))
-        return adopt(data);
+        return newImpl;
 
     // Do a slower implementation for cases that include non-ASCII characters.
     bool error;
-    int32_t realLength = Unicode::toLower(data.characters(), length, m_data, m_length, &error);
+    int32_t realLength = Unicode::toLower(data, length, m_data, m_length, &error);
     if (!error && realLength == length)
-        return adopt(data);
-    data.resize(realLength);
-    Unicode::toLower(data.characters(), realLength, m_data, m_length, &error);
+        return newImpl;
+    newImpl = createUninitialized(realLength, data);
+    Unicode::toLower(data, realLength, m_data, m_length, &error);
     if (error)
         return this;
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::upper()
 {
-    StringBuffer data(m_length);
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
 
     // Do a faster loop for the case where all the characters are ASCII.
@@ -302,32 +300,34 @@
         data[i] = toASCIIUpper(c);
     }
     if (!(ored & ~0x7F))
-        return adopt(data);
+        return newImpl;
 
     // Do a slower implementation for cases that include non-ASCII characters.
     bool error;
-    int32_t realLength = Unicode::toUpper(data.characters(), length, m_data, m_length, &error);
+    int32_t realLength = Unicode::toUpper(data, length, m_data, m_length, &error);
     if (!error && realLength == length)
-        return adopt(data);
-    data.resize(realLength);
-    Unicode::toUpper(data.characters(), realLength, m_data, m_length, &error);
+        return newImpl;
+    newImpl = createUninitialized(realLength, data);
+    Unicode::toUpper(data, realLength, m_data, m_length, &error);
     if (error)
         return this;
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::secure(UChar aChar)
 {
-    int length = m_length;
-    StringBuffer data(length);
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
+    int32_t length = m_length;
     for (int i = 0; i < length; ++i)
         data[i] = aChar;
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::foldCase()
 {
-    StringBuffer data(m_length);
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
 
     // Do a faster loop for the case where all the characters are ASCII.
@@ -338,18 +338,18 @@
         data[i] = toASCIILower(c);
     }
     if (!(ored & ~0x7F))
-        return adopt(data);
+        return newImpl;
 
     // Do a slower implementation for cases that include non-ASCII characters.
     bool error;
-    int32_t realLength = Unicode::foldCase(data.characters(), length, m_data, m_length, &error);
+    int32_t realLength = Unicode::foldCase(data, length, m_data, m_length, &error);
     if (!error && realLength == length)
-        return adopt(data);
-    data.resize(realLength);
-    Unicode::foldCase(data.characters(), realLength, m_data, m_length, &error);
+        return newImpl;
+    newImpl = createUninitialized(realLength, data);
+    Unicode::foldCase(data, realLength, m_data, m_length, &error);
     if (error)
         return this;
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::stripWhiteSpace()
@@ -727,14 +727,16 @@
     if (i == m_length)
         return this;
 
-    StringBuffer data(m_length);
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
+
     for (i = 0; i != m_length; ++i) {
         UChar ch = m_data[i];
         if (ch == oldC)
             ch = newC;
         data[i] = ch;
     }
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::replace(unsigned position, unsigned lengthToReplace, StringImpl* str)
@@ -744,13 +746,15 @@
     unsigned lengthToInsert = str ? str->length() : 0;
     if (!lengthToReplace && !lengthToInsert)
         return this;
-    StringBuffer buffer(length() - lengthToReplace + lengthToInsert);
-    memcpy(buffer.characters(), characters(), position * sizeof(UChar));
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl =
+        createUninitialized(length() - lengthToReplace + lengthToInsert, data);
+    memcpy(data, characters(), position * sizeof(UChar));
     if (str)
-        memcpy(buffer.characters() + position, str->characters(), lengthToInsert * sizeof(UChar));
-    memcpy(buffer.characters() + position + lengthToInsert, characters() + position + lengthToReplace,
+        memcpy(data + position, str->characters(), lengthToInsert * sizeof(UChar));
+    memcpy(data + position + lengthToInsert, characters() + position + lengthToReplace,
         (length() - position - lengthToReplace) * sizeof(UChar));
-    return adopt(buffer);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::replace(UChar pattern, StringImpl* replacement)
@@ -772,8 +776,10 @@
     if (!matchCount)
         return this;
     
-    StringBuffer data(m_length - matchCount + (matchCount * repStrLength));
-    
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl =
+        createUninitialized(m_length - matchCount + (matchCount * repStrLength), data);
+
     // Construct the new data
     int srcSegmentEnd;
     int srcSegmentLength;
@@ -782,19 +788,19 @@
     
     while ((srcSegmentEnd = find(pattern, srcSegmentStart)) >= 0) {
         srcSegmentLength = srcSegmentEnd - srcSegmentStart;
-        memcpy(data.characters() + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+        memcpy(data + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
         dstOffset += srcSegmentLength;
-        memcpy(data.characters() + dstOffset, replacement->m_data, repStrLength * sizeof(UChar));
+        memcpy(data + dstOffset, replacement->m_data, repStrLength * sizeof(UChar));
         dstOffset += repStrLength;
         srcSegmentStart = srcSegmentEnd + 1;
     }
 
     srcSegmentLength = m_length - srcSegmentStart;
-    memcpy(data.characters() + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+    memcpy(data + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
 
-    ASSERT(dstOffset + srcSegmentLength == static_cast<int>(data.length()));
+    ASSERT(dstOffset + srcSegmentLength == static_cast<int>(newImpl->length()));
 
-    return adopt(data);
+    return newImpl;
 }
 
 PassRefPtr<StringImpl> StringImpl::replace(StringImpl* pattern, StringImpl* replacement)
@@ -820,7 +826,9 @@
     if (!matchCount)
         return this;
     
-    StringBuffer data(m_length + matchCount * (repStrLength - patternLength));
+    UChar* data;
+    PassRefPtr<StringImpl> newImpl =
+        createUninitialized(m_length + matchCount * (repStrLength - patternLength), data);
     
     // Construct the new data
     int srcSegmentEnd;
@@ -830,19 +838,19 @@
     
     while ((srcSegmentEnd = find(pattern, srcSegmentStart)) >= 0) {
         srcSegmentLength = srcSegmentEnd - srcSegmentStart;
-        memcpy(data.characters() + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+        memcpy(data + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
         dstOffset += srcSegmentLength;
-        memcpy(data.characters() + dstOffset, replacement->m_data, repStrLength * sizeof(UChar));
+        memcpy(data + dstOffset, replacement->m_data, repStrLength * sizeof(UChar));
         dstOffset += repStrLength;
         srcSegmentStart = srcSegmentEnd + patternLength;
     }
 
     srcSegmentLength = m_length - srcSegmentStart;
-    memcpy(data.characters() + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+    memcpy(data + dstOffset, m_data + srcSegmentStart, srcSegmentLength * sizeof(UChar));
 
-    ASSERT(dstOffset + srcSegmentLength == static_cast<int>(data.length()));
+    ASSERT(dstOffset + srcSegmentLength == static_cast<int>(newImpl->length()));
 
-    return adopt(data);
+    return newImpl;
 }
 
 bool equal(StringImpl* a, StringImpl* b)
@@ -965,41 +973,47 @@
     return adoptRef(new StringImpl(vector.releaseBuffer(), size, AdoptBuffer()));
 }
 
-PassRefPtr<StringImpl> StringImpl::create(const UChar* characters, unsigned length)
+PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*& data)
 {
-    if (!characters || !length)
+    if (!length) {
+        data = 0;
         return empty();
+    }
 
     // Allocate a single buffer large enough to contain the StringImpl
     // struct as well as the data which it contains. This removes one 
     // heap allocation from this call.
     size_t size = sizeof(StringImpl) + length * sizeof(UChar);
     char* buffer = static_cast<char*>(fastMalloc(size));
-    UChar* data = reinterpret_cast<UChar*>(buffer + sizeof(StringImpl));
-    memcpy(data, characters, length * sizeof(UChar));
+    data = reinterpret_cast<UChar*>(buffer + sizeof(StringImpl));
     StringImpl* string = new (buffer) StringImpl(data, length, AdoptBuffer());
     string->m_bufferIsInternal = true;
     return adoptRef(string);
 }
 
+PassRefPtr<StringImpl> StringImpl::create(const UChar* characters, unsigned length)
+{
+    if (!characters || !length)
+        return empty();
+
+    UChar* data;
+    PassRefPtr<StringImpl> string = createUninitialized(length, data);
+    memcpy(data, characters, length * sizeof(UChar));
+    return string;
+}
+
 PassRefPtr<StringImpl> StringImpl::create(const char* characters, unsigned length)
 {
     if (!characters || !length)
         return empty();
 
-    // Allocate a single buffer large enough to contain the StringImpl
-    // struct as well as the data which it contains. This removes one 
-    // heap allocation from this call.
-    size_t size = sizeof(StringImpl) + length * sizeof(UChar);
-    char* buffer = static_cast<char*>(fastMalloc(size));
-    UChar* data = reinterpret_cast<UChar*>(buffer + sizeof(StringImpl));
+    UChar* data;
+    PassRefPtr<StringImpl> string = createUninitialized(length, data);
     for (unsigned i = 0; i != length; ++i) {
         unsigned char c = characters[i];
         data[i] = c;
     }
-    StringImpl* string = new (buffer) StringImpl(data, length, AdoptBuffer());
-    string->m_bufferIsInternal = true;
-    return adoptRef(string);
+    return string;
 }
 
 PassRefPtr<StringImpl> StringImpl::create(const char* string)
@@ -1009,6 +1023,29 @@
     return create(string, strlen(string));
 }
 
+#if USE(JSC)
+PassRefPtr<StringImpl> StringImpl::create(const JSC::UString& str)
+{
+    SharedUChar* sharedBuffer = const_cast<JSC::UString*>(&str)->rep()->baseString()->sharedBuffer();
+    if (sharedBuffer) {
+        PassRefPtr<StringImpl> impl = adoptRef(new StringImpl(const_cast<UChar*>(str.data()), str.size(), AdoptBuffer()));
+        sharedBuffer->ref();
+        impl->m_sharedBufferAndFlags.set(sharedBuffer);
+        return impl;
+    }
+    return StringImpl::create(str.data(), str.size());
+}
+
+JSC::UString StringImpl::ustring()
+{
+    SharedUChar* sharedBuffer = StringImpl::sharedBuffer();
+    if (sharedBuffer)
+        return JSC::UString::Rep::create(const_cast<UChar*>(m_data), m_length, sharedBuffer);
+
+    return JSC::UString(m_data, m_length);
+}
+#endif
+
 PassRefPtr<StringImpl> StringImpl::createWithTerminatingNullCharacter(const StringImpl& string)
 {
     return adoptRef(new StringImpl(string, WithTerminatingNullCharacter()));
@@ -1019,4 +1056,15 @@
     return create(m_data, m_length);
 }
 
+StringImpl::SharedUChar* StringImpl::sharedBuffer()
+{
+    if (m_length < minLengthToShare || m_bufferIsInternal)
+        return 0;
+
+    if (!m_sharedBufferAndFlags.get())
+        m_sharedBufferAndFlags.set(SharedUChar::create(new OwnFastMallocPtr<UChar>(const_cast<UChar*>(m_data))).releaseRef());
+    return m_sharedBufferAndFlags.get();
+}
+
+
 } // namespace WebCore
diff --git a/WebCore/platform/text/StringImpl.h b/WebCore/platform/text/StringImpl.h
index 1242f27..f591800 100644
--- a/WebCore/platform/text/StringImpl.h
+++ b/WebCore/platform/text/StringImpl.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,11 +25,18 @@
 
 #include <limits.h>
 #include <wtf/ASCIICType.h>
+#include <wtf/CrossThreadRefCounted.h>
+#include <wtf/OwnFastMallocPtr.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/PtrAndFlags.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
 
+#if USE(JSC)
+#include <runtime/UString.h>
+#endif
+
 #if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
 typedef const struct __CFString * CFStringRef;
 #endif
@@ -72,23 +80,34 @@
     StringImpl(const UChar*, unsigned length, unsigned hash);
     StringImpl(const char*, unsigned length, unsigned hash);
 
+    typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
+
 public:
     ~StringImpl();
 
     static PassRefPtr<StringImpl> create(const UChar*, unsigned length);
     static PassRefPtr<StringImpl> create(const char*, unsigned length);
     static PassRefPtr<StringImpl> create(const char*);
+    static PassRefPtr<StringImpl> createUninitialized(unsigned length, UChar*& data);
 
     static PassRefPtr<StringImpl> createWithTerminatingNullCharacter(const StringImpl&);
 
     static PassRefPtr<StringImpl> createStrippingNullCharacters(const UChar*, unsigned length);
     static PassRefPtr<StringImpl> adopt(StringBuffer&);
     static PassRefPtr<StringImpl> adopt(Vector<UChar>&);
+#if USE(JSC)
+    static PassRefPtr<StringImpl> create(const JSC::UString&);
+    JSC::UString ustring();
+#endif
 
+    SharedUChar* sharedBuffer();
     const UChar* characters() { return m_data; }
     unsigned length() { return m_length; }
 
-    bool hasTerminatingNullCharacter() { return m_hasTerminatingNullCharacter; }
+    bool hasTerminatingNullCharacter() const { return m_sharedBufferAndFlags.isFlagSet(HasTerminatingNullCharacter); }
+
+    bool inTable() const { return m_sharedBufferAndFlags.isFlagSet(InTable); }
+    void setInTable() { return m_sharedBufferAndFlags.setFlag(InTable); }
 
     unsigned hash() { if (m_hash == 0) m_hash = computeHash(m_data, m_length); return m_hash; }
     unsigned existingHash() const { ASSERT(m_hash); return m_hash; }
@@ -176,11 +195,16 @@
 
     static PassRefPtr<StringImpl> createStrippingNullCharactersSlowCase(const UChar*, unsigned length);
 
+    enum StringImplFlags {
+        HasTerminatingNullCharacter,
+        InTable,
+    };
+
     unsigned m_length;
     const UChar* m_data;
     mutable unsigned m_hash;
-    bool m_inTable;
-    bool m_hasTerminatingNullCharacter;
+    PtrAndFlags<SharedUChar, StringImplFlags> m_sharedBufferAndFlags;
+
     // In some cases, we allocate the StringImpl struct and its data
     // within a single heap buffer. In this case, the m_data pointer
     // is an "internal buffer", and does not need to be deallocated.
diff --git a/WebCore/platform/text/TextBoundaries.h b/WebCore/platform/text/TextBoundaries.h
index 118dd1a..7eb9cab 100644
--- a/WebCore/platform/text/TextBoundaries.h
+++ b/WebCore/platform/text/TextBoundaries.h
@@ -30,6 +30,11 @@
 
 namespace WebCore {
 
+    inline bool requiresContextForWordBoundary(UChar32 ch)
+    {
+        return WTF::Unicode::hasLineBreakingPropertyComplexContext(ch);
+    }
+
     void findWordBoundary(const UChar*, int len, int position, int* start, int* end);
     int findNextWordFromIndex(const UChar*, int len, int position, bool forward);
 
diff --git a/WebCore/platform/text/TextBoundariesICU.cpp b/WebCore/platform/text/TextBoundariesICU.cpp
index d226048..b1e8ee2 100644
--- a/WebCore/platform/text/TextBoundariesICU.cpp
+++ b/WebCore/platform/text/TextBoundariesICU.cpp
@@ -27,6 +27,7 @@
 #include "TextBoundaries.h"
 
 #include <unicode/ubrk.h>
+#include <unicode/uchar.h>
 
 #include "StringImpl.h"
 #include "TextBreakIterator.h"
diff --git a/WebCore/platform/text/TextCodec.h b/WebCore/platform/text/TextCodec.h
index 0a56262..df42582 100644
--- a/WebCore/platform/text/TextCodec.h
+++ b/WebCore/platform/text/TextCodec.h
@@ -29,6 +29,7 @@
 
 #include <memory>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
 
@@ -76,7 +77,7 @@
 
     typedef void (*EncodingNameRegistrar)(const char* alias, const char* name);
 
-    typedef std::auto_ptr<TextCodec> (*NewTextCodecFunction)(const TextEncoding&, const void* additionalData);
+    typedef PassOwnPtr<TextCodec> (*NewTextCodecFunction)(const TextEncoding&, const void* additionalData);
     typedef void (*TextCodecRegistrar)(const char* name, NewTextCodecFunction, const void* additionalData);
 
 } // namespace WebCore
diff --git a/WebCore/platform/text/TextCodecICU.cpp b/WebCore/platform/text/TextCodecICU.cpp
index 72054fa..b8e40a9 100644
--- a/WebCore/platform/text/TextCodecICU.cpp
+++ b/WebCore/platform/text/TextCodecICU.cpp
@@ -34,10 +34,10 @@
 #include <unicode/ucnv.h>
 #include <unicode/ucnv_cb.h>
 #include <wtf/Assertions.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 
-using std::auto_ptr;
 using std::min;
 
 namespace WebCore {
@@ -55,9 +55,9 @@
     return threadGlobalData().cachedConverterICU().converter;
 }
 
-static auto_ptr<TextCodec> newTextCodecICU(const TextEncoding& encoding, const void*)
+static PassOwnPtr<TextCodec> newTextCodecICU(const TextEncoding& encoding, const void*)
 {
-    return auto_ptr<TextCodec>(new TextCodecICU(encoding));
+    return new TextCodecICU(encoding);
 }
 
 void TextCodecICU::registerBaseEncodingNames(EncodingNameRegistrar registrar)
diff --git a/WebCore/platform/text/TextCodecICU.h b/WebCore/platform/text/TextCodecICU.h
index f07758f..bf517f7 100644
--- a/WebCore/platform/text/TextCodecICU.h
+++ b/WebCore/platform/text/TextCodecICU.h
@@ -30,6 +30,8 @@
 #include "TextCodec.h"
 #include "TextEncoding.h"
 
+#include <unicode/utypes.h>
+
 typedef struct UConverter UConverter;
 
 namespace WebCore {
diff --git a/WebCore/platform/text/TextCodecLatin1.cpp b/WebCore/platform/text/TextCodecLatin1.cpp
index 50f9f97..cfdc5b9 100644
--- a/WebCore/platform/text/TextCodecLatin1.cpp
+++ b/WebCore/platform/text/TextCodecLatin1.cpp
@@ -30,8 +30,7 @@
 #include "PlatformString.h"
 #include "StringBuffer.h"
 #include <stdio.h>
-
-using std::auto_ptr;
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -104,9 +103,9 @@
     registrar("x-ansi", "US-ASCII");
 }
 
-static auto_ptr<TextCodec> newStreamingTextDecoderWindowsLatin1(const TextEncoding&, const void*)
+static PassOwnPtr<TextCodec> newStreamingTextDecoderWindowsLatin1(const TextEncoding&, const void*)
 {
-    return auto_ptr<TextCodec>(new TextCodecLatin1);
+    return new TextCodecLatin1;
 }
 
 void TextCodecLatin1::registerCodecs(TextCodecRegistrar registrar)
@@ -120,7 +119,8 @@
 
 String TextCodecLatin1::decode(const char* bytes, size_t length, bool, bool, bool&)
 {
-    StringBuffer characters(length);
+    UChar* characters;
+    String result = String::createUninitialized(length, characters);
 
     // Convert the string a fast way and simultaneously do an efficient check to see if it's all ASCII.
     unsigned char ored = 0;
@@ -131,7 +131,7 @@
     }
 
     if (!(ored & 0x80))
-        return String::adopt(characters);
+        return result;
 
     // Convert the slightly slower way when there are non-ASCII characters.
     for (size_t i = 0; i < length; ++i) {
@@ -139,7 +139,7 @@
         characters[i] = table[c];
     }
 
-    return String::adopt(characters);
+    return result;
 }
 
 static CString encodeComplexWindowsLatin1(const UChar* characters, size_t length, UnencodableHandling handling)
diff --git a/WebCore/platform/text/TextCodecUTF16.cpp b/WebCore/platform/text/TextCodecUTF16.cpp
index a4d0d28..db77000 100644
--- a/WebCore/platform/text/TextCodecUTF16.cpp
+++ b/WebCore/platform/text/TextCodecUTF16.cpp
@@ -29,8 +29,7 @@
 #include "CString.h"
 #include "PlatformString.h"
 #include "StringBuffer.h"
-
-using std::auto_ptr;
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -49,14 +48,14 @@
     registrar("unicodeFFFE", "UTF-16BE");
 }
 
-static auto_ptr<TextCodec> newStreamingTextDecoderUTF16LE(const TextEncoding&, const void*)
+static PassOwnPtr<TextCodec> newStreamingTextDecoderUTF16LE(const TextEncoding&, const void*)
 {
-    return auto_ptr<TextCodec>(new TextCodecUTF16(true));
+    return new TextCodecUTF16(true);
 }
 
-static auto_ptr<TextCodec> newStreamingTextDecoderUTF16BE(const TextEncoding&, const void*)
+static PassOwnPtr<TextCodec> newStreamingTextDecoderUTF16BE(const TextEncoding&, const void*)
 {
-    return auto_ptr<TextCodec>(new TextCodecUTF16(false));
+    return new TextCodecUTF16(false);
 }
 
 void TextCodecUTF16::registerCodecs(TextCodecRegistrar registrar)
diff --git a/WebCore/platform/text/TextCodecUserDefined.cpp b/WebCore/platform/text/TextCodecUserDefined.cpp
index 2dae0f3..b7c8896 100644
--- a/WebCore/platform/text/TextCodecUserDefined.cpp
+++ b/WebCore/platform/text/TextCodecUserDefined.cpp
@@ -30,8 +30,7 @@
 #include "PlatformString.h"
 #include "StringBuffer.h"
 #include <stdio.h>
-
-using std::auto_ptr;
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -40,9 +39,9 @@
     registrar("x-user-defined", "x-user-defined");
 }
 
-static auto_ptr<TextCodec> newStreamingTextDecoderUserDefined(const TextEncoding&, const void*)
+static PassOwnPtr<TextCodec> newStreamingTextDecoderUserDefined(const TextEncoding&, const void*)
 {
-    return auto_ptr<TextCodec>(new TextCodecUserDefined);
+    return new TextCodecUserDefined;
 }
 
 void TextCodecUserDefined::registerCodecs(TextCodecRegistrar registrar)
@@ -52,14 +51,15 @@
 
 String TextCodecUserDefined::decode(const char* bytes, size_t length, bool, bool, bool&)
 {
-    StringBuffer buffer(length);
+    UChar* buffer;
+    String result = String::createUninitialized(length, buffer);
 
     for (size_t i = 0; i < length; ++i) {
         signed char c = bytes[i];
         buffer[i] = c & 0xF7FF;
     }
 
-    return String::adopt(buffer);
+    return result;
 }
 
 static CString encodeComplexUserDefined(const UChar* characters, size_t length, UnencodableHandling handling)
diff --git a/WebCore/platform/text/TextEncoding.cpp b/WebCore/platform/text/TextEncoding.cpp
index ed58412..5fa927b 100644
--- a/WebCore/platform/text/TextEncoding.cpp
+++ b/WebCore/platform/text/TextEncoding.cpp
@@ -31,7 +31,7 @@
 #include "PlatformString.h"
 #include "TextCodec.h"
 #include "TextEncodingRegistry.h"
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
 #include <unicode/unorm.h>
 #elif USE(QT4_UNICODE)
 #include <QString>
@@ -83,7 +83,7 @@
     if (!length)
         return "";
 
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
     // FIXME: What's the right place to do normalization?
     // It's a little strange to do it inside the encode function.
     // Perhaps normalization should be an explicit step done before calling encode.
@@ -116,6 +116,24 @@
 #endif
 }
 
+const char* TextEncoding::domName() const
+{
+    if (noExtendedTextEncodingNameUsed())
+        return m_name;
+
+    // We treat EUC-KR as windows-949 (its superset), but need to expose 
+    // the name 'EUC-KR' because the name 'windows-949' is not recognized by
+    // most Korean web servers even though they do use the encoding
+    // 'windows-949' with the name 'EUC-KR'. 
+    // FIXME: This is not thread-safe. At the moment, this function is
+    // only accessed in a single thread, but eventually has to be made
+    // thread-safe along with usesVisualOrdering().
+    static const char* const a = atomicCanonicalTextEncodingName("windows-949");
+    if (m_name == a)
+        return "EUC-KR";
+    return m_name;
+}
+
 bool TextEncoding::usesVisualOrdering() const
 {
     if (noExtendedTextEncodingNameUsed())
diff --git a/WebCore/platform/text/TextEncoding.h b/WebCore/platform/text/TextEncoding.h
index b3909f7..a99bfc8 100644
--- a/WebCore/platform/text/TextEncoding.h
+++ b/WebCore/platform/text/TextEncoding.h
@@ -42,6 +42,7 @@
 
         bool isValid() const { return m_name; }
         const char* name() const { return m_name; }
+        const char* domName() const; // name exposed via DOM
         bool usesVisualOrdering() const;
         bool isJapanese() const;
         
diff --git a/WebCore/platform/text/TextEncodingDetectorICU.cpp b/WebCore/platform/text/TextEncodingDetectorICU.cpp
index 26c997e..fcb2aa9 100644
--- a/WebCore/platform/text/TextEncodingDetectorICU.cpp
+++ b/WebCore/platform/text/TextEncodingDetectorICU.cpp
@@ -32,7 +32,7 @@
 #include "TextEncodingDetector.h"
 
 #include "TextEncoding.h"
-#include "UnusedParam.h"
+#include <wtf/UnusedParam.h>
 
 #ifndef BUILDING_ON_TIGER
 #include "unicode/ucnv.h"
diff --git a/WebCore/platform/text/TextEncodingDetectorNone.cpp b/WebCore/platform/text/TextEncodingDetectorNone.cpp
index 2655f08..3b62bc5 100644
--- a/WebCore/platform/text/TextEncodingDetectorNone.cpp
+++ b/WebCore/platform/text/TextEncodingDetectorNone.cpp
@@ -32,18 +32,11 @@
 #include "TextEncodingDetector.h"
 
 #include "TextEncoding.h"
-#include "UnusedParam.h"
 
 namespace WebCore {
 
-bool detectTextEncoding(const char* data, size_t len,
-                        const char* hintEncodingName,
-                        TextEncoding* detectedEncoding)
+bool detectTextEncoding(const char*, size_t, const char*, TextEncoding* detectedEncoding)
 {
-    UNUSED_PARAM(data)
-    UNUSED_PARAM(len)
-    UNUSED_PARAM(hintEncodingName)
-
     *detectedEncoding = TextEncoding();
     return false;
 }
diff --git a/WebCore/platform/text/TextEncodingRegistry.cpp b/WebCore/platform/text/TextEncodingRegistry.cpp
index 2d89fac..3c9d65f 100644
--- a/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -38,7 +38,7 @@
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
 #include "TextCodecICU.h"
 #endif
 #if PLATFORM(MAC)
@@ -185,7 +185,7 @@
     TextCodecUserDefined::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecUserDefined::registerCodecs(addToTextCodecMap);
 
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
     TextCodecICU::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecICU::registerBaseCodecs(addToTextCodecMap);
 #endif
@@ -193,7 +193,7 @@
 
 static void extendTextCodecMaps()
 {
-#if USE(ICU_UNICODE)
+#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
     TextCodecICU::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecICU::registerExtendedCodecs(addToTextCodecMap);
 #endif
@@ -209,7 +209,7 @@
 #endif
 }
 
-std::auto_ptr<TextCodec> newTextCodec(const TextEncoding& encoding)
+PassOwnPtr<TextCodec> newTextCodec(const TextEncoding& encoding)
 {
     MutexLocker lock(encodingRegistryMutex());
 
diff --git a/WebCore/platform/text/TextEncodingRegistry.h b/WebCore/platform/text/TextEncodingRegistry.h
index d204734..e6950cf 100644
--- a/WebCore/platform/text/TextEncodingRegistry.h
+++ b/WebCore/platform/text/TextEncodingRegistry.h
@@ -27,6 +27,7 @@
 #define TextEncodingRegistry_h
 
 #include <memory>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
@@ -36,7 +37,7 @@
 
     // Use TextResourceDecoder::decode to decode resources, since it handles BOMs.
     // Use TextEncoding::encode to encode, since it takes care of normalization.
-    std::auto_ptr<TextCodec> newTextCodec(const TextEncoding&);
+    PassOwnPtr<TextCodec> newTextCodec(const TextEncoding&);
 
     // Only TextEncoding should use this function directly.
     const char* atomicCanonicalTextEncodingName(const char* alias);
diff --git a/WebCore/platform/text/mac/TextBoundaries.mm b/WebCore/platform/text/mac/TextBoundaries.mm
index ff1dfd2..bd7ddf8 100644
--- a/WebCore/platform/text/mac/TextBoundaries.mm
+++ b/WebCore/platform/text/mac/TextBoundaries.mm
@@ -26,6 +26,8 @@
 #import "config.h"
 #import "TextBoundaries.h"
 
+using namespace WTF::Unicode;
+
 namespace WebCore {
 
 void findWordBoundary(const UChar* chars, int len, int position, int* start, int* end)
diff --git a/WebCore/platform/text/mac/TextCodecMac.cpp b/WebCore/platform/text/mac/TextCodecMac.cpp
index 3baf21f..93b9da2 100644
--- a/WebCore/platform/text/mac/TextCodecMac.cpp
+++ b/WebCore/platform/text/mac/TextCodecMac.cpp
@@ -33,9 +33,9 @@
 #include "PlatformString.h"
 #include "ThreadGlobalData.h"
 #include <wtf/Assertions.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Threading.h>
 
-using std::auto_ptr;
 using std::min;
 
 namespace WebCore {
@@ -64,9 +64,9 @@
     }
 }
 
-static auto_ptr<TextCodec> newTextCodecMac(const TextEncoding&, const void* additionalData)
+static PassOwnPtr<TextCodec> newTextCodecMac(const TextEncoding&, const void* additionalData)
 {
-    return auto_ptr<TextCodec>(new TextCodecMac(*static_cast<const TECTextEncodingID*>(additionalData)));
+    return new TextCodecMac(*static_cast<const TECTextEncodingID*>(additionalData));
 }
 
 void TextCodecMac::registerCodecs(TextCodecRegistrar registrar)
diff --git a/WebCore/platform/text/qt/TextBreakIteratorQt.cpp b/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
index 4dc23ee..06e8f37 100644
--- a/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
+++ b/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
@@ -20,6 +20,7 @@
  *
  */
 
+#include "config.h"
 #include "TextBreakIterator.h"
 
 #if QT_VERSION >= 0x040400
diff --git a/WebCore/platform/text/qt/TextCodecQt.cpp b/WebCore/platform/text/qt/TextCodecQt.cpp
index 0f385dd..c6c02cf 100644
--- a/WebCore/platform/text/qt/TextCodecQt.cpp
+++ b/WebCore/platform/text/qt/TextCodecQt.cpp
@@ -63,9 +63,9 @@
     }
 }
 
-static std::auto_ptr<TextCodec> newTextCodecQt(const TextEncoding& encoding, const void*)
+static PassOwnPtr<TextCodec> newTextCodecQt(const TextEncoding& encoding, const void*)
 {
-    return std::auto_ptr<TextCodec>(new TextCodecQt(encoding));
+    return new TextCodecQt(encoding);
 }
 
 void TextCodecQt::registerCodecs(TextCodecRegistrar registrar)
diff --git a/WebCore/platform/text/win/TextBreakIteratorInternalICUWin.cpp b/WebCore/platform/text/win/TextBreakIteratorInternalICUWin.cpp
index 14cf130..ce436df 100644
--- a/WebCore/platform/text/win/TextBreakIteratorInternalICUWin.cpp
+++ b/WebCore/platform/text/win/TextBreakIteratorInternalICUWin.cpp
@@ -25,7 +25,11 @@
 
 const char* currentTextBreakLocaleID()
 {
-    return "en_us";
+    // Using en_US_POSIX now so word selection in address field works as expected as before (double-clicking
+    // in a URL selects a word delimited by periods rather than selecting the entire URL).
+    // However, this is not entirely correct - we should honor the system locale in the normal case.
+    // FIXME: <rdar://problem/6786703> Should use system locale for text breaking
+    return "en_US_POSIX";
 }
 
 }
diff --git a/WebCore/platform/win/ClipboardUtilitiesWin.cpp b/WebCore/platform/win/ClipboardUtilitiesWin.cpp
index 3762a1a..0358b7a 100644
--- a/WebCore/platform/win/ClipboardUtilitiesWin.cpp
+++ b/WebCore/platform/win/ClipboardUtilitiesWin.cpp
@@ -291,7 +291,12 @@
     if (!cfURL)
         return false;
 
-    url = String(CFURLGetString(cfURL.get()));
+    url = CFURLGetString(cfURL.get());
+
+    // Work around <rdar://problem/6708300>, where CFURLCreateWithFileSystemPath makes URLs with "localhost".
+    if (url.startsWith("file://localhost/"))
+        url.remove(7, 9);
+
     return true;
 }
 
diff --git a/WebCore/platform/win/EditorWin.cpp b/WebCore/platform/win/EditorWin.cpp
index 813eb78..09abdbd 100644
--- a/WebCore/platform/win/EditorWin.cpp
+++ b/WebCore/platform/win/EditorWin.cpp
@@ -31,7 +31,6 @@
 #include "Document.h"
 #include "Element.h"
 #include "htmlediting.h"
-#include "NotImplemented.h"
 #include "TextIterator.h"
 #include "visible_units.h"
 
diff --git a/WebCore/platform/win/Language.cpp b/WebCore/platform/win/Language.cpp
index 787c5a3..588c5df 100644
--- a/WebCore/platform/win/Language.cpp
+++ b/WebCore/platform/win/Language.cpp
@@ -37,11 +37,11 @@
     int localeChars = GetLocaleInfo(langID, localeType, 0, 0);
     if (!localeChars)
         return fallback;
-    Vector<WCHAR> localeNameBuf(localeChars);
-    localeChars = GetLocaleInfo(langID, localeType, localeNameBuf.data(), localeChars);
+    UChar* localeNameBuf;
+    String localeName = String::createUninitialized(localeChars, localeNameBuf);
+    localeChars = GetLocaleInfo(langID, localeType, localeNameBuf, localeChars);
     if (!localeChars)
         return fallback;
-    String localeName = String::adopt(localeNameBuf);
     if (localeName.isEmpty())
         return fallback;
 
diff --git a/WebCore/platform/win/PasteboardWin.cpp b/WebCore/platform/win/PasteboardWin.cpp
index 506cc7b..8cf9bf2 100644
--- a/WebCore/platform/win/PasteboardWin.cpp
+++ b/WebCore/platform/win/PasteboardWin.cpp
@@ -35,7 +35,6 @@
 #include "HitTestResult.h"
 #include "Image.h"
 #include "KURL.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "Range.h"
 #include "RenderImage.h"
diff --git a/WebCore/platform/win/PopupMenuWin.cpp b/WebCore/platform/win/PopupMenuWin.cpp
index 52f2eb9..2b4749a 100644
--- a/WebCore/platform/win/PopupMenuWin.cpp
+++ b/WebCore/platform/win/PopupMenuWin.cpp
@@ -123,9 +123,7 @@
     // Determine whether we should animate our popups
     // Note: Must use 'BOOL' and 'FALSE' instead of 'bool' and 'false' to avoid stack corruption with SystemParametersInfo
     BOOL shouldAnimate = FALSE;
-#ifdef CAN_ANIMATE_TRANSPARENT_WINDOWS_SMOOTHLY
     ::SystemParametersInfo(SPI_GETCOMBOBOXANIMATION, 0, &shouldAnimate, 0);
-#endif
 
     if (shouldAnimate) {
         RECT viewRect = {0};
@@ -598,7 +596,7 @@
 
     wcex.cbSize = sizeof(WNDCLASSEX);
 
-    wcex.style          = 0;
+    wcex.style          = CS_DROPSHADOW;
     wcex.lpfnWndProc    = PopupWndProc;
     wcex.cbClsExtra     = 0;
     wcex.cbWndExtra     = sizeof(PopupMenu*); // For the PopupMenu pointer
diff --git a/WebCore/platform/win/ScrollbarThemeWin.cpp b/WebCore/platform/win/ScrollbarThemeWin.cpp
index e13d893..2ee3512 100644
--- a/WebCore/platform/win/ScrollbarThemeWin.cpp
+++ b/WebCore/platform/win/ScrollbarThemeWin.cpp
@@ -30,6 +30,7 @@
 #include "PlatformMouseEvent.h"
 #include "Scrollbar.h"
 #include "SoftLinking.h"
+#include "SystemInfo.h"
 
 // Generic state constants
 #define TS_NORMAL    1
@@ -61,7 +62,6 @@
 namespace WebCore {
 
 static HANDLE scrollbarTheme;
-static bool haveTheme;
 static bool runningVista;
 
 // FIXME:  Refactor the soft-linking code so that it can be shared with RenderThemeWin
@@ -72,27 +72,17 @@
 SOFT_LINK(uxtheme, IsThemeActive, BOOL, WINAPI, (), ())
 SOFT_LINK(uxtheme, IsThemeBackgroundPartiallyTransparent, BOOL, WINAPI, (HANDLE hTheme, int iPartId, int iStateId), (hTheme, iPartId, iStateId))
 
-static bool isRunningOnVistaOrLater()
-{
-    static bool os = false;
-    static bool initialized = false;
-    if (!initialized) {
-        OSVERSIONINFOEX vi = {sizeof(vi), 0};
-        GetVersionEx((OSVERSIONINFO*)&vi);
-
-        // NOTE: This does not work under a debugger - Vista shims Visual Studio, 
-        // making it believe it is xpsp2, which is inherited by debugged applications
-        os = vi.dwMajorVersion >= 6;
-        initialized = true;
-    }
-    return os;
-}
+// Constants used to figure the drag rect outside which we should snap the
+// scrollbar thumb back to its origin.  These calculations are based on
+// observing the behavior of the MSVC8 main window scrollbar + some
+// guessing/extrapolation.
+static const int kOffEndMultiplier = 3;
+static const int kOffSideMultiplier = 8;
 
 static void checkAndInitScrollbarTheme()
 {
-    if (uxthemeLibrary() && !scrollbarTheme)
+    if (uxthemeLibrary() && !scrollbarTheme && IsThemeActive())
         scrollbarTheme = OpenThemeData(0, L"Scrollbar");
-    haveTheme = scrollbarTheme && IsThemeActive();
 }
 
 #if !USE(SAFARI_THEME)
@@ -127,8 +117,11 @@
 
 void ScrollbarThemeWin::themeChanged()
 {
-    if (haveTheme)
-        CloseThemeData(scrollbarTheme);
+    if (!scrollbarTheme)
+        return;
+
+    CloseThemeData(scrollbarTheme);
+    scrollbarTheme = 0;
 }
 
 bool ScrollbarThemeWin::invalidateOnMouseEnterExit()
@@ -194,6 +187,29 @@
     return IntRect(scrollbar->x(), scrollbar->y() + thickness, thickness, scrollbar->height() - 2 * thickness);
 }
 
+bool ScrollbarThemeWin::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+{
+    return evt.shiftKey() && evt.button() == LeftButton;
+}
+
+bool ScrollbarThemeWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
+{
+    // Find the rect within which we shouldn't snap, by expanding the track rect
+    // in both dimensions.
+    IntRect rect = trackRect(scrollbar);
+    const bool horz = scrollbar->orientation() == HorizontalScrollbar;
+    const int thickness = scrollbarThickness(scrollbar->controlSize());
+    rect.inflateX((horz ? kOffEndMultiplier : kOffSideMultiplier) * thickness);
+    rect.inflateY((horz ? kOffSideMultiplier : kOffEndMultiplier) * thickness);
+
+    // Convert the event to local coordinates.
+    IntPoint mousePosition = scrollbar->convertFromContainingWindow(evt.pos());
+    mousePosition.move(scrollbar->x(), scrollbar->y());
+
+    // We should snap iff the event is outside our calculated rect.
+    return !rect.contains(mousePosition);
+}
+
 void ScrollbarThemeWin::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
 {
     // Just assume a forward track part.  We only paint the track as a single piece when there is no thumb.
@@ -354,10 +370,5 @@
     context->releaseWindowsContext(hdc, rect, alphaBlend);
 }
 
-bool ScrollbarThemeWin::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
-{
-    return evt.shiftKey() && evt.button() == LeftButton;
-}
-
 }
 
diff --git a/WebCore/platform/win/ScrollbarThemeWin.h b/WebCore/platform/win/ScrollbarThemeWin.h
index 92e2523..cd2f176 100644
--- a/WebCore/platform/win/ScrollbarThemeWin.h
+++ b/WebCore/platform/win/ScrollbarThemeWin.h
@@ -50,6 +50,7 @@
     virtual IntRect trackRect(Scrollbar*, bool painting = false);
 
     virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
+    virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&);
 
     virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
     virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
diff --git a/WebCore/page/chromium/AXObjectCacheChromium.cpp b/WebCore/platform/win/SystemInfo.cpp
similarity index 65%
copy from WebCore/page/chromium/AXObjectCacheChromium.cpp
copy to WebCore/platform/win/SystemInfo.cpp
index bbaf21d..ba20ddd 100644
--- a/WebCore/page/chromium/AXObjectCacheChromium.cpp
+++ b/WebCore/platform/win/SystemInfo.cpp
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- * Copyright (C) 2008 Google Inc.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -21,38 +20,31 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
-#include "AXObjectCache.h"
-
-#include "AccessibilityObject.h"
+#include "SystemInfo.h"
 
 namespace WebCore {
 
-void AXObjectCache::detachWrapper(AccessibilityObject* obj)
+bool isRunningOnVistaOrLater()
 {
-    // In Chromium, AccessibilityObjects are wrapped lazily.
-    if (AccessibilityObjectWrapper* wrapper = obj->wrapper())
-        wrapper->detach();
-}
+    static bool isVistaOrLater;
+    static bool initialized;
 
-void AXObjectCache::attachWrapper(AccessibilityObject*)
-{
-    // In Chromium, AccessibilityObjects are wrapped lazily.
-}
+    if (initialized)
+        return isVistaOrLater;
 
-void AXObjectCache::postNotification(RenderObject*, const String&)
-{
-}
+    initialized = true;
 
-void AXObjectCache::postNotificationToElement(RenderObject*, const String&)
-{
-}
+    OSVERSIONINFOEX vi = {0};
+    vi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
+    GetVersionEx(reinterpret_cast<OSVERSIONINFO*>(&vi));
 
-void AXObjectCache::handleFocusedUIElementChanged()
-{
+    isVistaOrLater = vi.dwMajorVersion >= 6;
+
+    return isVistaOrLater;
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/cf/ResourceResponseCFNet.h b/WebCore/platform/win/SystemInfo.h
similarity index 70%
copy from WebCore/platform/network/cf/ResourceResponseCFNet.h
copy to WebCore/platform/win/SystemInfo.h
index 27144c6..9f2c2a0 100644
--- a/WebCore/platform/network/cf/ResourceResponseCFNet.h
+++ b/WebCore/platform/win/SystemInfo.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,30 +10,26 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ResourceResponseCFNet_h
-#define ResourceResponseCFNet_h
-
-typedef struct _CFURLResponse* CFURLResponseRef;
+#ifndef SystemInfo_h
+#define SystemInfo_h
 
 namespace WebCore {
 
-    class ResourceResponse;
+bool isRunningOnVistaOrLater();
 
-    void getResourceResponse(ResourceResponse& response, CFURLResponseRef cfResponse);
+} // namespace WebCore
 
-}
-
-#endif // ResourceResponseCFNet_h
+#endif // SystemInfo_h
diff --git a/WebCore/platform/win/WidgetWin.cpp b/WebCore/platform/win/WidgetWin.cpp
index 93dbf42..2272027 100644
--- a/WebCore/platform/win/WidgetWin.cpp
+++ b/WebCore/platform/win/WidgetWin.cpp
@@ -29,10 +29,12 @@
 #include "Cursor.h"
 #include "Document.h"
 #include "Element.h"
-#include "GraphicsContext.h"
-#include "FrameWin.h"
-#include "IntRect.h"
 #include "FrameView.h"
+#include "FrameWin.h"
+#include "GraphicsContext.h"
+#include "IntRect.h"
+#include "Page.h"
+
 #include <winsock2.h>
 #include <windows.h>
 
@@ -61,17 +63,37 @@
 
 void Widget::setCursor(const Cursor& cursor)
 {
-    // This is set by PluginViewWin so it can ignore set setCursor call made by
+    // This is set by PluginViewWin so it can ignore the setCursor call made by
     // EventHandler.cpp.
     if (ignoreNextSetCursor) {
         ignoreNextSetCursor = false;
         return;
     }
 
-    if (HCURSOR c = cursor.impl()->nativeCursor()) {
-        lastSetCursor = c;
-        SetCursor(c);
+    if (!cursor.impl()->nativeCursor())
+        return;
+
+    lastSetCursor = cursor.impl()->nativeCursor();
+
+    ScrollView* view = root();
+    if (!view || !view->isFrameView()) {
+        SetCursor(lastSetCursor);
+        return;
     }
+
+    Frame* frame = static_cast<FrameView*>(view)->frame();
+    if (!frame) {
+        SetCursor(lastSetCursor);
+        return;
+    }
+
+    Page* page = frame->page();
+    if (!page) {
+        SetCursor(lastSetCursor);
+        return;
+    }
+
+    page->chrome()->setCursor(lastSetCursor);
 }
 
 void Widget::paint(GraphicsContext*, const IntRect&)
diff --git a/WebCore/platform/wx/KeyboardEventWx.cpp b/WebCore/platform/wx/KeyboardEventWx.cpp
index 8be87ac..7f57073 100644
--- a/WebCore/platform/wx/KeyboardEventWx.cpp
+++ b/WebCore/platform/wx/KeyboardEventWx.cpp
@@ -27,7 +27,6 @@
 #include "PlatformKeyboardEvent.h"
 
 #include "KeyboardCodes.h"
-#include "NotImplemented.h"
 
 #include <wx/defs.h>
 #include <wx/event.h>
@@ -163,14 +162,17 @@
             return VK_DECIMAL; // (6E) Decimal key
         case WXK_DIVIDE:
             return VK_DIVIDE; // (6F) Divide key
-
+        case WXK_NUMPAD_SEPARATOR:
+            return VK_SEPARATOR;
         
         case WXK_BACK:
             return VK_BACK; // (08) BACKSPACE key
         case WXK_TAB:
+        case WXK_NUMPAD_TAB:
             return VK_TAB; // (09) TAB key
         case WXK_CLEAR:
             return VK_CLEAR; // (0C) CLEAR key
+        case WXK_NUMPAD_ENTER:
         case WXK_RETURN:
             return VK_RETURN; //(0D) Return key
         case WXK_SHIFT:
@@ -204,22 +206,31 @@
             // VK_NONCONVERT (1D) IME nonconvert
             // VK_ACCEPT (1E) IME accept
             // VK_MODECHANGE (1F) IME mode change request
+        case WXK_NUMPAD_SPACE:
         case WXK_SPACE:
             return VK_SPACE; // (20) SPACEBAR
+        case WXK_NUMPAD_PAGEUP:
         case WXK_PAGEUP:
             return VK_PRIOR; // (21) PAGE UP key
+        case WXK_NUMPAD_PAGEDOWN:
         case WXK_PAGEDOWN:
             return VK_NEXT; // (22) PAGE DOWN key
+        case WXK_NUMPAD_END:
         case WXK_END:
             return VK_END; // (23) END key
+        case WXK_NUMPAD_HOME:
         case WXK_HOME:
             return VK_HOME; // (24) HOME key
+        case WXK_NUMPAD_LEFT:
         case WXK_LEFT:
             return VK_LEFT; // (25) LEFT ARROW key
+        case WXK_NUMPAD_UP:
         case WXK_UP:
             return VK_UP; // (26) UP ARROW key
+        case WXK_NUMPAD_RIGHT:
         case WXK_RIGHT:
             return VK_RIGHT; // (27) RIGHT ARROW key
+        case WXK_NUMPAD_DOWN:
         case WXK_DOWN:
             return VK_DOWN; // (28) DOWN ARROW key
         case WXK_SELECT:
@@ -228,11 +239,12 @@
             return VK_PRINT; // (2A) PRINT key
         case WXK_EXECUTE:
             return VK_EXECUTE;// (2B) EXECUTE key
-            //dunno on this
-            //case WXK_PrintScreen:
-            //      return VK_SNAPSHOT; // (2C) PRINT SCREEN key
+        case WXK_SNAPSHOT:
+             return VK_SNAPSHOT; // (2C) PRINT SCREEN key
+        case WXK_NUMPAD_INSERT:
         case WXK_INSERT:
             return VK_INSERT; // (2D) INS key
+        case WXK_NUMPAD_DELETE:
         case WXK_DELETE:
             return VK_DELETE; // (2E) DEL key
         case WXK_HELP:
@@ -336,7 +348,15 @@
     if (m_type != Char)
         m_keyIdentifier = keyIdentifierForWxKeyCode(event.GetKeyCode());
     else {
-        m_text = wxString(event.GetUnicodeKey());
+        //ENTER is an editing command processed as a char (only Enter and Tab are)
+        //unfortunately the unicode key for numpad_enter (370) is NOT what we want here (13)
+        //The unicode values for normal enter and tab are the same as the ASCII values, thus ok
+        //Note that I think this a wx bug, as the Character Code is actually 13 when
+        //numpad_enter is a CHAR event.
+        if (event.GetKeyCode() == 13 && event.GetUnicodeKey() == wxChar(370))
+            m_text = "\r";
+        else
+            m_text = wxString(event.GetUnicodeKey());
         m_unmodifiedText = m_text;
     }
     m_autoRepeat = false; // FIXME: not correct.
diff --git a/WebCore/platform/wx/LoggingWx.cpp b/WebCore/platform/wx/LoggingWx.cpp
index 006712c..4d8a437 100644
--- a/WebCore/platform/wx/LoggingWx.cpp
+++ b/WebCore/platform/wx/LoggingWx.cpp
@@ -26,11 +26,39 @@
 #include "config.h"
 #include "Logging.h"
 
+#include "CString.h"
+#include "PlatformString.h"
+#include <wtf/Vector.h>
+
+#include <wx/defs.h>
+#include <wx/utils.h>
+
 namespace WebCore {
 
 void InitializeLoggingChannelsIfNecessary()
 {
-    LogNotYetImplemented.state = WTFLogChannelOn;
+    static bool haveInitializedLoggingChannels = false;
+    if (haveInitializedLoggingChannels)
+        return;
+
+    haveInitializedLoggingChannels = true;
+
+    wxString loggingEnv;
+    wxGetEnv(wxT("WX_WEBKIT_LOG"), &loggingEnv);
+    if (loggingEnv == wxEmptyString)
+        return;
+
+    String wkLoggingEnv = loggingEnv;
+    Vector<String> logs;
+    
+    wkLoggingEnv.split(",", logs);
+    
+    for (size_t i = 0; i < logs.size(); ++i) {
+        WTFLogChannel* channel = getChannelFromName(logs[i]);
+        
+        if (channel)
+            channel->state = WTFLogChannelOn;
+    }
 }
 
 }
diff --git a/WebCore/platform/wx/MouseEventWx.cpp b/WebCore/platform/wx/MouseEventWx.cpp
index a02d7ba..4f39598 100644
--- a/WebCore/platform/wx/MouseEventWx.cpp
+++ b/WebCore/platform/wx/MouseEventWx.cpp
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-PlatformMouseEvent::PlatformMouseEvent(const wxMouseEvent& event, const wxPoint& globalPoint)
+PlatformMouseEvent::PlatformMouseEvent(const wxMouseEvent& event, const wxPoint& globalPoint, int clickCount)
     : m_position(event.GetPosition())
     , m_globalPosition(globalPoint)
     , m_shiftKey(event.ShiftDown())
@@ -67,7 +67,7 @@
     if (m_eventType == MouseEventMoved)
         m_clickCount = 0;
     else
-        m_clickCount = event.ButtonDClick() ? 2 : 1;
+        m_clickCount = clickCount;
 
     m_timestamp = WTF::currentTime();
 }
diff --git a/WebCore/platform/wx/PopupMenuWx.cpp b/WebCore/platform/wx/PopupMenuWx.cpp
index 4563b77..660282c 100644
--- a/WebCore/platform/wx/PopupMenuWx.cpp
+++ b/WebCore/platform/wx/PopupMenuWx.cpp
@@ -25,7 +25,6 @@
 
 #include "Frame.h"
 #include "FrameView.h"
-#include "NotImplemented.h"
 #include "PopupMenuClient.h"
 #include "PlatformString.h"
 
diff --git a/WebCore/platform/wx/RenderThemeWx.cpp b/WebCore/platform/wx/RenderThemeWx.cpp
index 9b6dea5..a26416f 100644
--- a/WebCore/platform/wx/RenderThemeWx.cpp
+++ b/WebCore/platform/wx/RenderThemeWx.cpp
@@ -32,10 +32,10 @@
 #include "NotImplemented.h"
 #include "RenderView.h"
 
-#include "WebKit/wx/WebView.h"
-
-#include <wx/dcgraph.h>
 #include <wx/defs.h>
+
+#include <wx/dc.h>
+#include <wx/dcgraph.h>
 #include <wx/renderer.h>
 #include <wx/dcclient.h>
 #include <wx/scrolwin.h>
diff --git a/WebCore/platform/wx/ScrollViewWx.cpp b/WebCore/platform/wx/ScrollViewWx.cpp
index 254ac9f..f556894 100644
--- a/WebCore/platform/wx/ScrollViewWx.cpp
+++ b/WebCore/platform/wx/ScrollViewWx.cpp
@@ -191,12 +191,12 @@
     if (newScrollOffset.x < 0)
         newScrollOffset.x = 0;
     else if (newScrollOffset.x + cRect.width > vRect.width)
-        newScrollOffset.x = max(0, vRect.width - cRect.width - 1);
+        newScrollOffset.x = max(0, vRect.width - cRect.width);
 
     if (newScrollOffset.y < 0)
         newScrollOffset.y = 0;
     else if (newScrollOffset.y + cRect.height > vRect.height)
-        newScrollOffset.y = max(0, vRect.height - cRect.height - 1);
+        newScrollOffset.y = max(0, vRect.height - cRect.height);
 
     if (newScrollOffset == scrollOffset)
         return;
@@ -291,8 +291,8 @@
         needsAdjust = true;
     }
 
-    if (m_data->vScrollbarMode != horizontalScrollbarMode() ) {
-        m_data->vScrollbarMode = horizontalScrollbarMode();
+    if (m_data->vScrollbarMode != verticalScrollbarMode() ) {
+        m_data->vScrollbarMode = verticalScrollbarMode();
         needsAdjust = true;
     }
 
diff --git a/WebCore/platform/wx/SharedTimerWx.cpp b/WebCore/platform/wx/SharedTimerWx.cpp
index d95457b..b2b22e4 100644
--- a/WebCore/platform/wx/SharedTimerWx.cpp
+++ b/WebCore/platform/wx/SharedTimerWx.cpp
@@ -26,7 +26,6 @@
 #include "config.h"
 
 #include "SharedTimer.h"
-#include "NotImplemented.h"
 #include "Widget.h"
 
 #include <wtf/Assertions.h>
@@ -79,28 +78,10 @@
         wkTimer = new WebKitTimer();
         
     unsigned int intervalInMS = interval * 1000;
-    if (interval < 0) {
-#ifndef NDEBUG
-        // TODO: We may eventually want to assert here, to track 
-        // what calls are leading to this condition. It seems to happen
-        // mostly with repeating timers.
-        fprintf(stderr, "WARNING: setSharedTimerFireTime: fire time is < 0 ms\n");
-#endif
-        intervalInMS = 0;
-    }
 
-    // FIXME: We should mimic the Windows port's behavior and add the timer fired
-    // event to the event queue directly rather than making an artifical delay.
-    // However, wx won't allow us to assign a simple callback function - we'd have
-    // to create a fake wxEvtHandler-derived class with a timer event handler
-    // function. Until there's a better way, this way is at least far less
-    // hacky.
-    if (intervalInMS < 10)
-#if __WXMSW__
-        intervalInMS = 10;
-#else
+    // sanity check
+    if (intervalInMS < 1)
         intervalInMS = 1;
-#endif
 
     wkTimer->Start(intervalInMS, wxTIMER_ONE_SHOT);
 }
diff --git a/WebCore/platform/wx/TemporaryLinkStubs.cpp b/WebCore/platform/wx/TemporaryLinkStubs.cpp
index d8c6046..dfd2ad5 100644
--- a/WebCore/platform/wx/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/wx/TemporaryLinkStubs.cpp
@@ -97,11 +97,6 @@
 
 void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness) { notImplemented(); }
 
-// cookies (we'll need a place to store these
-void WebCore::setCookies(Document* document, const KURL& url, const KURL& policyURL, const String& value) { notImplemented(); }
-String WebCore::cookies(const Document* document, const KURL& url) { notImplemented(); return String(); }
-bool WebCore::cookiesEnabled(const Document* document) { notImplemented(); return false; }
-
 /********************************************************/
 /* Completely empty stubs (mostly to allow DRT to run): */
 /********************************************************/
diff --git a/WebCore/platform/wx/WidgetWx.cpp b/WebCore/platform/wx/WidgetWx.cpp
index 37097fe..bb4fd2a 100644
--- a/WebCore/platform/wx/WidgetWx.cpp
+++ b/WebCore/platform/wx/WidgetWx.cpp
@@ -45,8 +45,8 @@
 
 void Widget::setFocus()
 {
-    if (platformWidget())
-        platformWidget()->SetFocus();
+    if (PlatformWidget widget = platformWidget())
+        widget->SetFocus();
 }
 
 void Widget::setCursor(const Cursor& cursor)
@@ -57,38 +57,43 @@
 
 void Widget::show()
 {
-    if (platformWidget())
-        platformWidget()->Show();
+    if (PlatformWidget widget = platformWidget())
+        widget->Show();
 }
 
 void Widget::hide()
 {
-    if (platformWidget())
-        platformWidget()->Hide();
+    if (PlatformWidget widget = platformWidget())
+        widget->Hide();
 }
 
 IntRect Widget::frameRect() const
 {
-    if (platformWidget())
-        return platformWidget()->GetRect();
+    if (PlatformWidget widget = platformWidget())
+        return widget->GetRect();
+    
     return m_frame;
 }
 
 void Widget::setFrameRect(const IntRect& rect)
 {
-    if (platformWidget())
-        platformWidget()->SetSize(rect);
+    if (PlatformWidget widget = platformWidget())
+        widget->SetSize(rect);
+    
     m_frame = rect;
 }
 
 void Widget::invalidateRect(const IntRect& r)
 {
-    if (platformWidget())
-        platformWidget()->RefreshRect(r);
+    if (PlatformWidget widget = platformWidget())
+        widget->RefreshRect(r);
 }
 
 void Widget::paint(GraphicsContext*,const IntRect& r)
 {
+    invalidateRect(r);
+    if (PlatformWidget widget = platformWidget())
+        widget->Update();
 }
 
 }
diff --git a/WebCore/platform/wx/wxcode/mac/carbon/fontprops.cpp b/WebCore/platform/wx/wxcode/mac/carbon/fontprops.cpp
index 447a3d0..653f142 100644
--- a/WebCore/platform/wx/wxcode/mac/carbon/fontprops.cpp
+++ b/WebCore/platform/wx/wxcode/mac/carbon/fontprops.cpp
@@ -23,11 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
+#include "fontprops.h"
+
 #include <ApplicationServices/ApplicationServices.h>
 
 #include <wx/defs.h>
 #include <wx/gdicmn.h>
-#include "fontprops.h"
+
+#ifdef BUILDING_ON_TIGER
+void (*wkGetFontMetrics)(CGFontRef, int* ascent, int* descent, int* lineGap, unsigned* unitsPerEm);
+#endif
 
 const float smallCapsFontSizeMultiplier = 0.7f;
 const float contextDPI = 72.0f;
@@ -39,7 +45,7 @@
     CGFontRef cgFont;
 
 #ifdef wxOSX_USE_CORE_TEXT && wxOSX_USE_CORE_TEXT
-    cgFont = CTFontCopyGraphicsFont((CTFontRef)font->MacGetCTFont(), NULL);
+    cgFont = CTFontCopyGraphicsFont((CTFontRef)font->OSXGetCTFont(), NULL);
 #else
     ATSFontRef fontRef;
     
@@ -53,7 +59,7 @@
         int iAscent;
         int iDescent;
         int iLineGap;
-        float unitsPerEm;
+        unsigned unitsPerEm;
 #ifdef BUILDING_ON_TIGER
         wkGetFontMetrics(cgFont, &iAscent, &iDescent, &iLineGap, &unitsPerEm);
 #else
@@ -76,6 +82,9 @@
         m_lineSpacing = m_ascent + m_descent + m_lineGap;
 
     }
+    
+    if (cgFont)
+        CGFontRelease(cgFont);
 
 }
 
diff --git a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
index 6eaa765..e5c60d6 100644
--- a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
+++ b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
@@ -24,44 +24,95 @@
  */
 
 #include "config.h"
+#include "FloatSize.h"
 #include "GlyphBuffer.h"
 #include "GraphicsContext.h"
 #include "SimpleFontData.h"
+#include <wtf/Vector.h>
+
+#include <ApplicationServices/ApplicationServices.h>
+
+#include <dlfcn.h>
 
 #include <wx/defs.h>
 #include <wx/dcclient.h>
 #include <wx/dcgraph.h>
 #include <wx/gdicmn.h>
-#include <vector>
+
+
+// Unfortunately we need access to a private function to get the character -> glyph conversion needed to
+// allow us to use CGContextShowGlyphsWithAdvances
+// Note that on < 10.5, the function is called CGFontGetGlyphsForUnicodes, so we need to detect and deal
+// with this.
+typedef void (*CGFontGetGlyphsForUnicharsPtr)(CGFontRef, const UniChar[], const CGGlyph[], size_t);
+static CGFontGetGlyphsForUnicharsPtr CGFontGetGlyphsForUnichars = (CGFontGetGlyphsForUnicharsPtr)dlsym(RTLD_DEFAULT, "CGFontGetGlyphsForUnichars");
 
 namespace WebCore {
 
 void drawTextWithSpacing(GraphicsContext* graphicsContext, const SimpleFontData* font, const wxColour& color, const GlyphBuffer& glyphBuffer, int from, int numGlyphs, const FloatPoint& point)
 {
-#if USE(WXGC)
+    graphicsContext->save();
+    
     wxGCDC* dc = static_cast<wxGCDC*>(graphicsContext->platformContext());
-#else
-    wxDC* dc = graphicsContext->platformContext();
-#endif
 
     wxFont* wxfont = font->getWxFont();
-    if (wxfont->IsOk())
-        dc->SetFont(*wxfont);
-    dc->SetTextForeground(color);
+    graphicsContext->setFillColor(graphicsContext->fillColor());
 
-    // convert glyphs to wxString
-    GlyphBufferGlyph* glyphs = const_cast<GlyphBufferGlyph*>(glyphBuffer.glyphs(from));
-    int offset = point.x();
-    wxString text = wxEmptyString;
-    for (unsigned i = 0; i < numGlyphs; i++) {
-        text = text.Append((wxChar)glyphs[i]);
-        offset += glyphBuffer.advanceAt(from + i);
+    CGContextRef cgContext = static_cast<CGContextRef>(dc->GetGraphicsContext()->GetNativeContext());
+
+    CGFontRef cgFont;
+
+#ifdef wxOSX_USE_CORE_TEXT && wxOSX_USE_CORE_TEXT
+    cgFont = CTFontCopyGraphicsFont((CTFontRef)font->OSXGetCTFont(), NULL);
+#else
+    ATSFontRef fontRef;
+    
+    fontRef = FMGetATSFontRefFromFont(wxfont->MacGetATSUFontID());
+    
+    if (fontRef)
+        cgFont = CGFontCreateWithPlatformFont((void*)&fontRef);
+#endif
+    
+    CGContextSetFont(cgContext, cgFont);
+
+    CGContextSetFontSize(cgContext, wxfont->GetPointSize());
+
+    CGFloat red, green, blue, alpha;
+    graphicsContext->fillColor().getRGBA(red, green, blue, alpha);
+    CGContextSetRGBFillColor(cgContext, red, green, blue, alpha);
+
+    CGAffineTransform matrix = CGAffineTransformIdentity;
+    matrix.b = -matrix.b;
+    matrix.d = -matrix.d;
+    
+    CGContextSetTextMatrix(cgContext, matrix);
+
+    CGContextSetTextPosition(cgContext, point.x(), point.y());
+    
+    const FloatSize* advanceSizes = static_cast<const FloatSize*>(glyphBuffer.advances(from));
+    int size = glyphBuffer.size() - from;
+    CGSize sizes[size];
+    CGGlyph glyphs[numGlyphs];
+    
+    // if the function doesn't exist, we're probably on tiger and need to grab the
+    // function under its old name, CGFontGetGlyphsForUnicodes
+    if (!CGFontGetGlyphsForUnichars)
+        CGFontGetGlyphsForUnichars = (CGFontGetGlyphsForUnicharsPtr)dlsym(RTLD_DEFAULT, "CGFontGetGlyphsForUnicodes");
+    
+    // Let's make sure we got the function under one name or another!
+    ASSERT(CGFontGetGlyphsForUnichars);
+    CGFontGetGlyphsForUnichars(cgFont, glyphBuffer.glyphs(from), glyphs, numGlyphs);
+    
+    for (int i = 0; i < size; i++) {
+        FloatSize fsize = advanceSizes[i];
+        sizes[i] = CGSizeMake(fsize.width(), fsize.height());
     }
     
-    // NOTE: The wx API actually adds the ascent to the y value internally,
-    // so we have to subtract it from the y point here so that the ascent
-    // isn't added twice. 
-    dc->DrawText(text, (wxCoord)point.x(), int(point.y() - font->ascent()));
+    CGContextShowGlyphsWithAdvances(cgContext, glyphs, sizes, numGlyphs);
+    
+    if (cgFont)
+        CGFontRelease(cgFont);
+    graphicsContext->restore();
 }
 
 }
diff --git a/WebCore/platform/wx/wxcode/win/fontprops.cpp b/WebCore/platform/wx/wxcode/win/fontprops.cpp
index 1314691..531db08 100644
--- a/WebCore/platform/wx/wxcode/win/fontprops.cpp
+++ b/WebCore/platform/wx/wxcode/win/fontprops.cpp
@@ -91,7 +91,7 @@
     // accounts for under/overhang of the first/last character while we want
     // just the bounding rect for this string so adjust the width as needed
     // (using API not available in 2002 SDKs of WinCE)
-    if ( len > 0 )
+    if ( len > 1 )
     {
         ABC width;
         const wxChar chFirst = *str.begin();
diff --git a/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp b/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp
index 7d1e924..d2513d7 100644
--- a/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp
+++ b/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp
@@ -30,6 +30,7 @@
 
 #include <wx/defs.h>
 #include <wx/dcclient.h>
+#include <wx/dcgraph.h>
 #include <wx/gdicmn.h>
 #include <vector>
 
diff --git a/WebCore/plugins/PluginPackage.cpp b/WebCore/plugins/PluginPackage.cpp
index 747d937..8cdda24 100644
--- a/WebCore/plugins/PluginPackage.cpp
+++ b/WebCore/plugins/PluginPackage.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Collabora Ltd.  All rights reserved.
+ * Copyright (C) 2009 Holger Hans Peter Freyther
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -249,4 +250,86 @@
 }
 #endif
 
+#if ENABLE(NETSCAPE_PLUGIN_API)
+void PluginPackage::initializeBrowserFuncs()
+{
+    memset(&m_browserFuncs, 0, sizeof(m_browserFuncs));
+    m_browserFuncs.size = sizeof (m_browserFuncs);
+    m_browserFuncs.version = NP_VERSION_MINOR;
+
+    m_browserFuncs.geturl = NPN_GetURL;
+    m_browserFuncs.posturl = NPN_PostURL;
+    m_browserFuncs.requestread = NPN_RequestRead;
+    m_browserFuncs.newstream = NPN_NewStream;
+    m_browserFuncs.write = NPN_Write;
+    m_browserFuncs.destroystream = NPN_DestroyStream;
+    m_browserFuncs.status = NPN_Status;
+    m_browserFuncs.uagent = NPN_UserAgent;
+    m_browserFuncs.memalloc = NPN_MemAlloc;
+    m_browserFuncs.memfree = NPN_MemFree;
+    m_browserFuncs.memflush = NPN_MemFlush;
+    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
+    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
+    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
+    m_browserFuncs.getvalue = NPN_GetValue;
+    m_browserFuncs.setvalue = NPN_SetValue;
+    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
+    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
+    m_browserFuncs.forceredraw = NPN_ForceRedraw;
+    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
+    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
+    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
+    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
+    m_browserFuncs.pluginthreadasynccall = NPN_PluginThreadAsyncCall;
+
+    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
+    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
+    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
+    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
+    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
+    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
+    m_browserFuncs.intfromidentifier = _NPN_IntFromIdentifier;
+    m_browserFuncs.createobject = _NPN_CreateObject;
+    m_browserFuncs.retainobject = _NPN_RetainObject;
+    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
+    m_browserFuncs.invoke = _NPN_Invoke;
+    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
+    m_browserFuncs.evaluate = _NPN_Evaluate;
+    m_browserFuncs.getproperty = _NPN_GetProperty;
+    m_browserFuncs.setproperty = _NPN_SetProperty;
+    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
+    m_browserFuncs.hasproperty = _NPN_HasProperty;
+    m_browserFuncs.hasmethod = _NPN_HasMethod;
+    m_browserFuncs.setexception = _NPN_SetException;
+    m_browserFuncs.enumerate = _NPN_Enumerate;
+    m_browserFuncs.construct = _NPN_Construct;
+}
+#endif
+
+#if ENABLE(PLUGIN_PACKAGE_SIMPLE_HASH)
+unsigned PluginPackage::hash() const
+{
+    unsigned hashCodes[] = {
+        m_path.impl()->hash(),
+        m_lastModified
+    };
+
+    return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));
+}
+
+bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
+{
+    return a.m_description == b.m_description;
+}
+
+int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersion) const
+{
+    // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
+    // the passed version
+    if (m_moduleVersion != compareVersion)
+        return m_moduleVersion > compareVersion ? 1 : -1;
+    return 0;
+}
+#endif
+
 }
diff --git a/WebCore/plugins/PluginPackage.h b/WebCore/plugins/PluginPackage.h
index 480f563..905e85b 100644
--- a/WebCore/plugins/PluginPackage.h
+++ b/WebCore/plugins/PluginPackage.h
@@ -78,6 +78,7 @@
         void determineQuirks(const String& mimeType);
 
         void determineModuleVersionFromDescription();
+        void initializeBrowserFuncs();
 
         bool m_isLoaded;
         int m_loadCount;
diff --git a/WebCore/plugins/PluginStream.cpp b/WebCore/plugins/PluginStream.cpp
index 393174c..d2d5d3c 100644
--- a/WebCore/plugins/PluginStream.cpp
+++ b/WebCore/plugins/PluginStream.cpp
@@ -34,6 +34,7 @@
 #include "PluginDebug.h"
 #include "SharedBuffer.h"
 #include "SubresourceLoader.h"
+#include <StringExtras.h>
 
 // We use -2 here because some plugins like to return -1 to indicate error
 // and this way we won't clash with them.
@@ -129,20 +130,20 @@
 
     // Some plugins (Flash) expect that javascript URLs are passed back decoded as this is the
     // format used when requesting the URL.
-    if (responseURL.protocolIs("javascript"))
+    if (protocolIsJavaScript(responseURL))
         m_stream.url = strdup(decodeURLEscapeSequences(responseURL.string()).utf8().data());
     else
         m_stream.url = strdup(responseURL.string().utf8().data());
-    
+
     CString mimeTypeStr = m_resourceResponse.mimeType().utf8();
-    
+
     long long expectedContentLength = m_resourceResponse.expectedContentLength();
 
     if (m_resourceResponse.isHTTP()) {
         Vector<UChar> stringBuilder;
         String separator(": ");
 
-        String statusLine = String::format("HTTP %lu OK\n", m_resourceResponse.httpStatusCode());
+        String statusLine = String::format("HTTP %d OK\n", m_resourceResponse.httpStatusCode());
 
         stringBuilder.append(statusLine.characters(), statusLine.length());
 
diff --git a/WebCore/plugins/PluginView.cpp b/WebCore/plugins/PluginView.cpp
index cdb8ca9..f102c2c 100644
--- a/WebCore/plugins/PluginView.cpp
+++ b/WebCore/plugins/PluginView.cpp
@@ -76,7 +76,7 @@
 using JSC::ExecState;
 using JSC::JSLock;
 using JSC::JSObject;
-using JSC::JSValuePtr;
+using JSC::JSValue;
 using JSC::UString;
 #endif
 
@@ -92,7 +92,7 @@
 
 static String scriptStringIfJavaScriptURL(const KURL& url)
 {
-    if (!url.protocolIs("javascript"))
+    if (!protocolIsJavaScript(url))
         return String();
 
     // This returns an unescaped string
@@ -221,7 +221,7 @@
 }
 
 #if USE(JSC)
-static bool getString(ScriptController* proxy, JSValuePtr result, String& string)
+static bool getString(ScriptController* proxy, JSValue result, String& string)
 {
     if (!proxy || !result || result.isUndefined())
         return false;
@@ -280,7 +280,7 @@
 #if USE(JSC)
     // Executing a script can cause the plugin view to be destroyed, so we keep a reference to the parent frame.
     RefPtr<Frame> parentFrame = m_parentFrame;
-    JSValuePtr result = m_parentFrame->loader()->executeScript(jsString, request->shouldAllowPopups()).jsValue();
+    JSValue result = m_parentFrame->loader()->executeScript(jsString, request->shouldAllowPopups()).jsValue();
 
     if (targetFrameName.isNull()) {
         String resultString;
@@ -654,6 +654,14 @@
     resize(size);
 }
 
+void PluginView::focusPluginElement()
+{
+    // Focus the plugin
+    if (Page* page = m_parentFrame->page())
+        page->focusController()->setFocusedFrame(m_parentFrame);
+    m_parentFrame->document()->setFocusedNode(m_element);
+}
+
 void PluginView::didReceiveResponse(const ResourceResponse& response)
 {
     if (m_status != PluginStatusLoadedSuccessfully)
diff --git a/WebCore/plugins/PluginView.h b/WebCore/plugins/PluginView.h
index d007d64..9853eb7 100644
--- a/WebCore/plugins/PluginView.h
+++ b/WebCore/plugins/PluginView.h
@@ -193,6 +193,10 @@
 
         virtual bool isPluginView() const { return true; }
 
+        Frame* parentFrame() const { return m_parentFrame; }
+
+        void focusPluginElement();
+
 #if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
         static LRESULT CALLBACK PluginViewWndProc(HWND, UINT, WPARAM, LPARAM);
         LRESULT wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
@@ -273,7 +277,7 @@
 
         CString m_mimeType;
         CString m_userAgent;
-        
+
         NPP m_instance;
         NPP_t m_instanceStruct;
         NPWindow m_npWindow;
@@ -321,7 +325,9 @@
 
 private:
 
-#if defined(XP_MACOSX)
+#if PLATFORM(GTK) || defined(Q_WS_X11)
+        void setNPWindowIfNeeded();
+#elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
         OwnPtr<Timer<PluginView> > m_nullEventTimer;
 
@@ -329,8 +335,9 @@
         void nullEventTimerFired(Timer<PluginView>*);
         Point globalMousePosForPlugin() const;
 #endif
-#if PLATFORM(GTK) || defined(Q_WS_X11)
-        void setNPWindowIfNeeded();
+
+#if defined(Q_WS_X11)
+        bool m_hasPendingGeometryChange;
 #endif
 
         IntRect m_clipRect; // The clip rect to apply to a windowed plug-in
@@ -346,4 +353,4 @@
 
 } // namespace WebCore
 
-#endif 
+#endif
diff --git a/WebCore/plugins/PluginViewNone.cpp b/WebCore/plugins/PluginViewNone.cpp
index 2766a6b..a3b6a17 100644
--- a/WebCore/plugins/PluginViewNone.cpp
+++ b/WebCore/plugins/PluginViewNone.cpp
@@ -84,6 +84,14 @@
     return 0;
 }
 
+#if ENABLE(NETSCAPE_PLUGIN_API)
+const char* PluginView::userAgentStatic()
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
 NPError PluginView::handlePostReadFile(Vector<char>&, uint32, const char*)
 {
     notImplemented();
@@ -97,6 +105,14 @@
     return 0;
 }
 
+#if ENABLE(NETSCAPE_PLUGIN_API)
+NPError PluginView::getValueStatic(NPNVariable variable, void* value)
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
 void PluginView::invalidateRect(NPRect*)
 {
     notImplemented();
diff --git a/WebCore/plugins/android/PluginPackageAndroid.cpp b/WebCore/plugins/android/PluginPackageAndroid.cpp
index aac687c..870226c 100644
--- a/WebCore/plugins/android/PluginPackageAndroid.cpp
+++ b/WebCore/plugins/android/PluginPackageAndroid.cpp
@@ -357,7 +357,7 @@
     // Provide the plugin with our browser function table and grab its
     // plugin table. Provide the Java environment and the Plugin which
     // can be used to override the defaults if the plugin wants.
-    initializeBrowserFuncs(&m_browserFuncs);
+    initializeBrowserFuncs();
     memset(&m_pluginFuncs, 0, sizeof(m_pluginFuncs));
     m_pluginFuncs.size = sizeof(m_pluginFuncs);
     if(NP_Initialize(&m_browserFuncs,
diff --git a/WebCore/plugins/chromium/PluginDataChromium.cpp b/WebCore/plugins/chromium/PluginDataChromium.cpp
index 16525de..3df81af 100644
--- a/WebCore/plugins/chromium/PluginDataChromium.cpp
+++ b/WebCore/plugins/chromium/PluginDataChromium.cpp
@@ -95,6 +95,7 @@
 void PluginData::refresh()
 {
     pluginCache.reset(true);
+    pluginCache.plugins();  // Force the plugins to be reloaded now.
 }
 
 String getPluginMimeTypeFromExtension(const String& extension)
diff --git a/WebCore/plugins/gtk/PluginPackageGtk.cpp b/WebCore/plugins/gtk/PluginPackageGtk.cpp
index 1337c31..31c4ed3 100644
--- a/WebCore/plugins/gtk/PluginPackageGtk.cpp
+++ b/WebCore/plugins/gtk/PluginPackageGtk.cpp
@@ -171,56 +171,7 @@
     memset(&m_pluginFuncs, 0, sizeof(m_pluginFuncs));
     m_pluginFuncs.size = sizeof(m_pluginFuncs);
 
-    memset(&m_browserFuncs, 0, sizeof(m_browserFuncs));
-    m_browserFuncs.size = sizeof (m_browserFuncs);
-    m_browserFuncs.version = NP_VERSION_MINOR;
-
-    m_browserFuncs.geturl = NPN_GetURL;
-    m_browserFuncs.posturl = NPN_PostURL;
-    m_browserFuncs.requestread = NPN_RequestRead;
-    m_browserFuncs.newstream = NPN_NewStream;
-    m_browserFuncs.write = NPN_Write;
-    m_browserFuncs.destroystream = NPN_DestroyStream;
-    m_browserFuncs.status = NPN_Status;
-    m_browserFuncs.uagent = NPN_UserAgent;
-    m_browserFuncs.memalloc = NPN_MemAlloc;
-    m_browserFuncs.memfree = NPN_MemFree;
-    m_browserFuncs.memflush = NPN_MemFlush;
-    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
-    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
-    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
-    m_browserFuncs.getvalue = NPN_GetValue;
-    m_browserFuncs.setvalue = NPN_SetValue;
-    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
-    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
-    m_browserFuncs.forceredraw = NPN_ForceRedraw;
-    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
-    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
-    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
-    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
-    m_browserFuncs.pluginthreadasynccall = NPN_PluginThreadAsyncCall;
-
-    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
-    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
-    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
-    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
-    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
-    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
-    m_browserFuncs.intfromidentifier = _NPN_IntFromIdentifier;
-    m_browserFuncs.createobject = _NPN_CreateObject;
-    m_browserFuncs.retainobject = _NPN_RetainObject;
-    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
-    m_browserFuncs.invoke = _NPN_Invoke;
-    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
-    m_browserFuncs.evaluate = _NPN_Evaluate;
-    m_browserFuncs.getproperty = _NPN_GetProperty;
-    m_browserFuncs.setproperty = _NPN_SetProperty;
-    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
-    m_browserFuncs.hasproperty = _NPN_HasMethod;
-    m_browserFuncs.hasmethod = _NPN_HasProperty;
-    m_browserFuncs.setexception = _NPN_SetException;
-    m_browserFuncs.enumerate = _NPN_Enumerate;
-    m_browserFuncs.construct = _NPN_Construct;
+    initializeBrowserFuncs();
 
 #if defined(XP_UNIX)
     npErr = NP_Initialize(&m_browserFuncs, &m_pluginFuncs);
@@ -238,28 +189,4 @@
     return false;
 }
 
-unsigned PluginPackage::hash() const
-{ 
-    unsigned hashCodes[2] = {
-        m_path.impl()->hash(),
-        m_lastModified
-    };
-
-    return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), 2 * sizeof(unsigned) / sizeof(UChar));
-}
-
-bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
-{
-    return a.m_description == b.m_description;
-}
-
-int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersion) const
-{
-    // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
-    // the passed version
-    if (m_moduleVersion != compareVersion)
-        return m_moduleVersion > compareVersion ? 1 : -1;
-    return 0;
-}
-
 }
diff --git a/WebCore/plugins/gtk/PluginViewGtk.cpp b/WebCore/plugins/gtk/PluginViewGtk.cpp
index 30be6b0..9fde10d 100644
--- a/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -41,10 +41,10 @@
 #include "HTMLPlugInElement.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "PlatformMouseEvent.h"
 #include "PluginDebug.h"
+#include "PluginMainThreadScheduler.h"
 #include "PluginPackage.h"
 #include "RenderLayer.h"
 #include "Settings.h"
@@ -289,6 +289,8 @@
         PluginView::setCurrentPluginView(0);
     }
 
+    PluginMainThreadScheduler::scheduler().unregisterPlugin(m_instance);
+
 #ifdef XP_UNIX
     if (m_isWindowed && m_npWindow.ws_info)
            delete (NPSetWindowCallbackStruct *)m_npWindow.ws_info;
@@ -482,6 +484,12 @@
     invalidateRect(r);
 }
 
+void PluginView::invalidateRegion(NPRegion)
+{
+    // TODO: optimize
+    invalidate();
+}
+
 void PluginView::forceRedraw()
 {
     if (m_isWindowed)
diff --git a/WebCore/plugins/mac/PluginPackageMac.cpp b/WebCore/plugins/mac/PluginPackageMac.cpp
index 0af94b0..aed3516 100644
--- a/WebCore/plugins/mac/PluginPackageMac.cpp
+++ b/WebCore/plugins/mac/PluginPackageMac.cpp
@@ -33,7 +33,6 @@
 #include <wtf/RetainPtr.h>
 #include "CString.h"
 #include "MIMETypeRegistry.h"
-#include "NotImplemented.h"
 #include "npruntime_impl.h"
 #include "PluginDatabase.h"
 #include "PluginDebug.h"
@@ -285,51 +284,7 @@
     memset(&m_pluginFuncs, 0, sizeof(m_pluginFuncs));
     m_pluginFuncs.size = sizeof(m_pluginFuncs);
 
-    m_browserFuncs.size = sizeof(m_browserFuncs);
-    m_browserFuncs.version = NP_VERSION_MINOR;
-    m_browserFuncs.geturl = NPN_GetURL;
-    m_browserFuncs.posturl = NPN_PostURL;
-    m_browserFuncs.requestread = NPN_RequestRead;
-    m_browserFuncs.newstream = NPN_NewStream;
-    m_browserFuncs.write = NPN_Write;
-    m_browserFuncs.destroystream = NPN_DestroyStream;
-    m_browserFuncs.status = NPN_Status;
-    m_browserFuncs.uagent = NPN_UserAgent;
-    m_browserFuncs.memalloc = NPN_MemAlloc;
-    m_browserFuncs.memfree = NPN_MemFree;
-    m_browserFuncs.memflush = NPN_MemFlush;
-    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
-    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
-    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
-    m_browserFuncs.getvalue = NPN_GetValue;
-    m_browserFuncs.setvalue = NPN_SetValue;
-    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
-    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
-    m_browserFuncs.forceredraw = NPN_ForceRedraw;
-    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
-    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
-    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
-    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
-
-    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
-    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
-    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
-    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
-    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
-    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
-    m_browserFuncs.createobject = _NPN_CreateObject;
-    m_browserFuncs.retainobject = _NPN_RetainObject;
-    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
-    m_browserFuncs.invoke = _NPN_Invoke;
-    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
-    m_browserFuncs.evaluate = _NPN_Evaluate;
-    m_browserFuncs.getproperty = _NPN_GetProperty;
-    m_browserFuncs.setproperty = _NPN_SetProperty;
-    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
-    m_browserFuncs.hasproperty = _NPN_HasMethod;
-    m_browserFuncs.hasmethod = _NPN_HasProperty;
-    m_browserFuncs.setexception = _NPN_SetException;
-    m_browserFuncs.enumerate = _NPN_Enumerate;
+    initializeBrowserFuncs();
 
     npErr = NP_Initialize(&m_browserFuncs);
     LOG_NPERROR(npErr);
@@ -349,30 +304,6 @@
     return false;
 }
 
-unsigned PluginPackage::hash() const
-{
-    unsigned hashCodes[2] = {
-        m_path.impl()->hash(),
-        m_lastModified
-    };
-
-    return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), 2 * sizeof(unsigned) / sizeof(UChar));
-}
-
-bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
-{
-    return a.m_description == b.m_description;
-}
-
-int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersion) const
-{
-    // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
-    // the passed version
-    if (m_moduleVersion != compareVersion)
-        return m_moduleVersion > compareVersion ? 1 : -1;
-    return 0;
-}
-
 } // namespace WebCore
 
 #endif // !__LP64__
diff --git a/WebCore/plugins/mac/PluginViewMac.cpp b/WebCore/plugins/mac/PluginViewMac.cpp
index a46aca6..72aafbc 100644
--- a/WebCore/plugins/mac/PluginViewMac.cpp
+++ b/WebCore/plugins/mac/PluginViewMac.cpp
@@ -76,7 +76,11 @@
 #include <QWidget>
 #include <QKeyEvent>
 QT_BEGIN_NAMESPACE
-extern Q_GUI_EXPORT OSWindowRef qt_mac_window_for(const QWidget *w);
+#if QT_VERSION < 0x040500
+extern Q_GUI_EXPORT WindowPtr qt_mac_window_for(const QWidget* w);
+#else
+extern Q_GUI_EXPORT OSWindowRef qt_mac_window_for(const QWidget* w);
+#endif
 QT_END_NAMESPACE
 #endif
 
@@ -299,9 +303,6 @@
 
     setSelfVisible(true);
 
-    if (isParentVisible() && platformPluginWidget())
-        platformPluginWidget()->setVisible(true);
-
     Widget::show();
 }
 
@@ -311,9 +312,6 @@
 
     setSelfVisible(false);
 
-    if (isParentVisible() && platformPluginWidget())
-        platformPluginWidget()->setVisible(false);
-
     Widget::hide();
 }
 
@@ -345,9 +343,6 @@
         return;
 
     Widget::setParentVisible(visible);
-
-    if (isSelfVisible() && platformPluginWidget())
-        platformPluginWidget()->setVisible(visible);
 }
 
 void PluginView::setNPWindowRect(const IntRect&)
diff --git a/WebCore/plugins/npfunctions.h b/WebCore/plugins/npfunctions.h
index beaa1fb..9f1b470 100644
--- a/WebCore/plugins/npfunctions.h
+++ b/WebCore/plugins/npfunctions.h
@@ -66,13 +66,14 @@
 typedef void  (*NPN_PushPopupsEnabledStateProcPtr)(NPP instance, NPBool enabled);
 typedef void  (*NPN_PopPopupsEnabledStateProcPtr)(NPP instance);
 typedef void (*NPN_PluginThreadAsyncCallProcPtr)(NPP npp, void (*func)(void *), void *userData);
-typedef NPError (*NPN_GetValueForURLProcPtr)(NPP npp, NPNURLVariable variable, const char* url, char** value, uint32_t* len);
-typedef NPError (*NPN_SetValueForURLProcPtr)(NPP npp, NPNURLVariable variable, const char* url, const char* value, uint32_t* len);
-typedef NPError (*NPN_GetAuthenticationInfoPtr)(NPP npp, const char* protocol, const char* host, int32_t port, const char* scheme, const char *realm, char** username, uint32_t* ulen, char** password, uint32_t* plen);
+typedef NPError (*NPN_GetValueForURLProcPtr)(NPP npp, NPNURLVariable variable, const char* url, char** value, uint32* len);
+typedef NPError (*NPN_SetValueForURLProcPtr)(NPP npp, NPNURLVariable variable, const char* url, const char* value, uint32 len);
+typedef NPError (*NPN_GetAuthenticationInfoProcPtr)(NPP npp, const char* protocol, const char* host, int32 port, const char* scheme, const char *realm, char** username, uint32* ulen, char** password, uint32* plen);
 
 typedef uint32 (*NPN_ScheduleTimerProcPtr)(NPP npp, uint32 interval, NPBool repeat, void (*timerFunc)(NPP npp, uint32 timerID));
 typedef void (*NPN_UnscheduleTimerProcPtr)(NPP npp, uint32 timerID);
 typedef NPError (*NPN_PopUpContextMenuProcPtr)(NPP instance, NPMenu* menu);
+typedef NPBool (*NPN_ConvertPointProcPtr)(NPP npp, double sourceX, double sourceY, NPCoordinateSpace sourceSpace, double *destX, double *destY, NPCoordinateSpace destSpace);
 
 typedef void (*NPN_ReleaseVariantValueProcPtr) (NPVariant *variant);
 
@@ -167,10 +168,11 @@
     NPN_ConstructProcPtr construct;
     NPN_GetValueForURLProcPtr getvalueforurl;
     NPN_SetValueForURLProcPtr setvalueforurl;
-    NPN_GetAuthenticationInfoPtr getauthenticationinfo;
+    NPN_GetAuthenticationInfoProcPtr getauthenticationinfo;
     NPN_ScheduleTimerProcPtr scheduletimer;
     NPN_UnscheduleTimerProcPtr unscheduletimer;
     NPN_PopUpContextMenuProcPtr popupcontextmenu;
+    NPN_ConvertPointProcPtr convertpoint;
 } NPNetscapeFuncs;
 
 typedef struct _NPPluginFuncs {
diff --git a/WebCore/plugins/qt/PluginContainerQt.cpp b/WebCore/plugins/qt/PluginContainerQt.cpp
new file mode 100644
index 0000000..59ab5bc
--- /dev/null
+++ b/WebCore/plugins/qt/PluginContainerQt.cpp
@@ -0,0 +1,149 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "PluginContainerQt.h"
+
+#include "FocusController.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "Page.h"
+#include "PlatformKeyboardEvent.h"
+#include "PlatformWheelEvent.h"
+#include "PluginView.h"
+#include <QApplication>
+#include <QX11Info>
+
+using namespace WebCore;
+
+PluginClientWrapper::PluginClientWrapper(QWidget* parent, WId client)
+    : QWidget(0, Qt::Popup)
+{
+    // create a QWidget that adopts the plugin window id, do not give it
+    // a parent so that we don't end up handling events supposed to be
+    // handled by the QX11EmbedContainer.
+
+    // without the parent this will be considered a toplevel widget,
+    // and thus make Qt not quit the event loop after the last window
+    // has been closed. In order to work around this, we set the window
+    // type to Qt::Popup.
+
+    create(client, false, true);
+    m_parent = parent;
+}
+
+PluginClientWrapper::~PluginClientWrapper()
+{
+    destroy(false, false);
+}
+
+bool PluginClientWrapper::x11Event(XEvent* event)
+{
+    // modify the event window id and insert it into the Qt event system.
+    event->xany.window = m_parent->parentWidget()->winId();
+    static_cast<QApplication*>(QApplication::instance())->x11ProcessEvent(event);
+    return true;
+}
+
+PluginContainerQt::PluginContainerQt(PluginView* view, QWidget* parent)
+    : QX11EmbedContainer(parent)
+    , m_pluginView(view)
+    , m_clientWrapper(0)
+{
+    connect(this, SIGNAL(clientClosed()), this, SLOT(on_clientClosed()));
+    connect(this, SIGNAL(clientIsEmbedded()), this, SLOT(on_clientIsEmbedded()));
+}
+
+PluginContainerQt::~PluginContainerQt()
+{
+    delete m_clientWrapper;
+}
+
+void PluginContainerQt::on_clientClosed()
+{
+    delete m_clientWrapper;
+    m_clientWrapper = 0;
+}
+
+void PluginContainerQt::on_clientIsEmbedded()
+{
+    delete m_clientWrapper;
+    m_clientWrapper = 0;
+
+    // Only create a QWidget wrapper for the plugin in the case it isn't in the
+    // Qt window mapper, and thus receiving events from the Qt event system.
+    // This way the PluginClientWrapper receives the scroll events and passes
+    // them to the parent. NOTICE: Native Qt based plugins running in process,
+    // will already be in the window mapper, and thus creating a wrapper, stops
+    // them from getting events from Qt, as they are redirected to the wrapper.
+    if (!QWidget::find(clientWinId()))
+        m_clientWrapper = new PluginClientWrapper(this, clientWinId());
+}
+
+void PluginContainerQt::redirectWheelEventsToParent(bool enable)
+{
+    // steal wheel events from the plugin as we want to handle it. When doing this
+    // all button 4, 5, 6, and 7, ButtonPress and ButtonRelease events are passed
+    // to the x11Event handler of the PluginClientWrapper, which then changes the
+    // window id of the event to the parent of PluginContainer and puts the event
+    // back into the Qt event loop, so that we will actually scroll the parent
+    // frame.
+    for (int buttonNo = 4; buttonNo < 8; buttonNo++) {
+        if (enable)
+            XGrabButton(x11Info().display(), buttonNo, AnyModifier, clientWinId(),
+                false, ButtonPressMask, GrabModeAsync, GrabModeAsync, 0L, 0L);
+        else
+            XUngrabButton(x11Info().display(), buttonNo, AnyModifier, clientWinId());
+    }
+}
+
+bool PluginContainerQt::x11Event(XEvent* event)
+{
+    switch (event->type) {
+    case EnterNotify:
+        // if the plugin window doesn't have focus we do not want to send wheel
+        // events to it, but to the parent frame, so let's redirect here.
+        redirectWheelEventsToParent(!hasFocus());
+        break;
+    case LeaveNotify:
+        // it is always safe to ungrab wheel events when the mouse leaves the
+        // plugin window.
+        redirectWheelEventsToParent(false);
+        break;
+    }
+
+    return QX11EmbedContainer::x11Event(event);
+}
+
+void PluginContainerQt::focusInEvent(QFocusEvent* event)
+{
+    // we got focus, stop redirecting the wheel events
+    redirectWheelEventsToParent(false);
+
+    if (Page* page = m_pluginView->parentFrame()->page())
+        page->focusController()->setActive(true);
+
+    m_pluginView->focusPluginElement();
+}
+
+void PluginContainerQt::focusOutEvent(QFocusEvent*)
+{
+    if (Page* page = m_pluginView->parentFrame()->page())
+        page->focusController()->setActive(false);
+}
diff --git a/WebCore/plugins/qt/PluginContainerQt.h b/WebCore/plugins/qt/PluginContainerQt.h
new file mode 100644
index 0000000..624654c
--- /dev/null
+++ b/WebCore/plugins/qt/PluginContainerQt.h
@@ -0,0 +1,63 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#ifndef PluginContainerQt_H
+#define PluginContainerQt_H
+
+#include <QX11EmbedContainer>
+
+namespace WebCore {
+
+    class PluginView;
+
+    class PluginContainerQt : public QX11EmbedContainer
+    {
+        Q_OBJECT
+    public:
+        PluginContainerQt(PluginView*, QWidget* parent);
+        ~PluginContainerQt();
+
+        void redirectWheelEventsToParent(bool enable = true);
+
+    protected:
+        virtual bool x11Event(XEvent*);
+        virtual void focusInEvent(QFocusEvent*);
+        virtual void focusOutEvent(QFocusEvent*);
+
+    public slots:
+        void on_clientClosed();
+        void on_clientIsEmbedded();
+
+    private:
+        PluginView* m_pluginView;
+        QWidget* m_clientWrapper;
+    };
+
+    class PluginClientWrapper : public QWidget
+    {
+    public:
+        PluginClientWrapper(QWidget* parent, WId client);
+        ~PluginClientWrapper();
+        bool x11Event(XEvent*);
+
+    private:
+        QWidget* m_parent;
+    };
+}
+
+#endif // PluginContainerQt_H
diff --git a/WebCore/plugins/qt/PluginPackageQt.cpp b/WebCore/plugins/qt/PluginPackageQt.cpp
index 4387813..d9e3765 100644
--- a/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -29,7 +29,6 @@
 
 #include "CString.h"
 #include "MIMETypeRegistry.h"
-#include "NotImplemented.h"
 #include "npruntime_impl.h"
 #include "PluginDatabase.h"
 #include "PluginDebug.h"
@@ -110,52 +109,7 @@
     memset(&m_pluginFuncs, 0, sizeof(m_pluginFuncs));
     m_pluginFuncs.size = sizeof(m_pluginFuncs);
 
-    m_browserFuncs.size = sizeof (m_browserFuncs);
-    m_browserFuncs.version = NP_VERSION_MINOR;
-    m_browserFuncs.geturl = NPN_GetURL;
-    m_browserFuncs.posturl = NPN_PostURL;
-    m_browserFuncs.requestread = NPN_RequestRead;
-    m_browserFuncs.newstream = NPN_NewStream;
-    m_browserFuncs.write = NPN_Write;
-    m_browserFuncs.destroystream = NPN_DestroyStream;
-    m_browserFuncs.status = NPN_Status;
-    m_browserFuncs.uagent = NPN_UserAgent;
-    m_browserFuncs.memalloc = NPN_MemAlloc;
-    m_browserFuncs.memfree = NPN_MemFree;
-    m_browserFuncs.memflush = NPN_MemFlush;
-    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
-    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
-    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
-    m_browserFuncs.getvalue = NPN_GetValue;
-    m_browserFuncs.setvalue = NPN_SetValue;
-    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
-    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
-    m_browserFuncs.forceredraw = NPN_ForceRedraw;
-    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
-    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
-    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
-    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
-
-    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
-    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
-    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
-    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
-    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
-    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
-    m_browserFuncs.createobject = _NPN_CreateObject;
-    m_browserFuncs.retainobject = _NPN_RetainObject;
-    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
-    m_browserFuncs.invoke = _NPN_Invoke;
-    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
-    m_browserFuncs.evaluate = _NPN_Evaluate;
-    m_browserFuncs.getproperty = _NPN_GetProperty;
-    m_browserFuncs.setproperty = _NPN_SetProperty;
-    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
-    m_browserFuncs.hasproperty = _NPN_HasMethod;
-    m_browserFuncs.hasmethod = _NPN_HasProperty;
-    m_browserFuncs.setexception = _NPN_SetException;
-    m_browserFuncs.enumerate = _NPN_Enumerate;
-    m_browserFuncs.construct = _NPN_Construct;
+    initializeBrowserFuncs();
 
 #if defined(XP_UNIX)
     npErr = NP_Initialize(&m_browserFuncs, &m_pluginFuncs);
@@ -173,28 +127,4 @@
     return false;
 }
 
-unsigned PluginPackage::hash() const
-{ 
-    unsigned hashCodes[2] = {
-        m_path.impl()->hash(),
-        m_lastModified
-    };
-
-    return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), 2 * sizeof(unsigned) / sizeof(UChar));
-}
-
-bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
-{
-    return a.m_description == b.m_description;
-}
-
-int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersion) const
-{
-    // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
-    // the passed version
-    if (m_moduleVersion != compareVersion)
-        return m_moduleVersion > compareVersion ? 1 : -1;
-    return 0;
-}
-
 }
diff --git a/WebCore/plugins/qt/PluginViewQt.cpp b/WebCore/plugins/qt/PluginViewQt.cpp
index c8dd0e5..25d61f9 100644
--- a/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/WebCore/plugins/qt/PluginViewQt.cpp
@@ -27,39 +27,38 @@
 #include "config.h"
 #include "PluginView.h"
 
-#include <QWidget>
-#include <QX11EmbedContainer>
-#include <QX11Info>
-
-#include "NotImplemented.h"
-#include "PluginDebug.h"
-#include "PluginPackage.h"
-#include "npruntime_impl.h"
-#include "runtime.h"
-#include "runtime_root.h"
-#include <runtime/JSLock.h>
-#include <runtime/JSValue.h>
-#include "JSDOMBinding.h"
-#include "ScriptController.h"
-
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
-#include "FrameLoader.h"
-#include "FrameLoadRequest.h"
-#include "FrameTree.h"
 #include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "FrameLoader.h"
+#include "FrameTree.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
-#include "Image.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
+#include "Image.h"
+#include "JSDOMBinding.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "PlatformMouseEvent.h"
+#include "PluginContainerQt.h"
+#include "PluginDebug.h"
+#include "PluginPackage.h"
+#include "PluginMainThreadScheduler.h"
 #include "RenderLayer.h"
+#include "ScriptController.h"
 #include "Settings.h"
+#include "npruntime_impl.h"
+#include "runtime.h"
+#include "runtime_root.h"
+#include <QWidget>
+#include <QX11Info>
+#include <runtime/JSLock.h>
+#include <runtime/JSValue.h>
 
 using JSC::ExecState;
 using JSC::Interpreter;
@@ -77,7 +76,7 @@
 
 void PluginView::updatePluginWidget()
 {
-    if (!parent() || !m_isWindowed)
+    if (!parent() || !m_isWindowed || !platformPluginWidget())
         return;
 
     ASSERT(parent()->isFrameView());
@@ -90,11 +89,19 @@
     m_clipRect = windowClipRect();
     m_clipRect.move(-m_windowRect.x(), -m_windowRect.y());
 
-    if (platformPluginWidget()) {
-        platformPluginWidget()->move(m_windowRect.x(), m_windowRect.y());
-        platformPluginWidget()->resize(m_windowRect.width(), m_windowRect.height());
-        platformPluginWidget()->setMask(QRegion(m_clipRect.x(), m_clipRect.y(), m_clipRect.width(), m_clipRect.height()));
-    }
+    if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
+        return;
+
+    // do not call setNPWindowIfNeeded immediately, will be called on paint()
+    m_hasPendingGeometryChange = true;
+
+    // in order to move/resize the plugin window at the same time as the
+    // rest of frame during e.g. scrolling, we set the window geometry
+    // in the paint() function, but as paint() isn't called when the
+    // plugin window is outside the frame which can be caused by a
+    // scroll, we need to move/resize immediately.
+    if (!m_windowRect.intersects(frameView->frameRect()))
+        setNPWindowIfNeeded();
 }
 
 void PluginView::setFocus()
@@ -112,7 +119,9 @@
     if (isParentVisible() && platformPluginWidget())
         platformPluginWidget()->setVisible(true);
 
-    Widget::show();
+    // do not call parent impl. here as it will set the platformWidget
+    // (same as platformPluginWidget in the Qt port) to visible, even
+    // when parent isn't visible.
 }
 
 void PluginView::hide()
@@ -122,7 +131,9 @@
     if (isParentVisible() && platformPluginWidget())
         platformPluginWidget()->setVisible(false);
 
-    Widget::hide();
+    // do not call parent impl. here as it will set the platformWidget
+    // (same as platformPluginWidget in the Qt port) to invisible, even
+    // when parent isn't visible.
 }
 
 void PluginView::paint(GraphicsContext* context, const IntRect& rect)
@@ -132,10 +143,11 @@
         return;
     }
 
-    if (m_isWindowed || context->paintingDisabled())
+    if (context->paintingDisabled())
         return;
 
-    notImplemented();
+    if (m_isWindowed && platformPluginWidget())
+        setNPWindowIfNeeded();
 }
 
 void PluginView::handleKeyboardEvent(KeyboardEvent* event)
@@ -154,46 +166,54 @@
 
     if (parent)
         init();
-    else {
-        if (!platformPluginWidget())
-            return;
-    }
 }
 
-void PluginView::setNPWindowRect(const IntRect& rect)
+void PluginView::setNPWindowRect(const IntRect&)
 {
-    if (!m_isStarted || !parent())
+    // Ignored as we don't want to move immediately.
+}
+
+void PluginView::setNPWindowIfNeeded()
+{
+    if (!m_isStarted || !parent() || !m_plugin->pluginFuncs()->setwindow)
         return;
 
-    IntPoint p = static_cast<FrameView*>(parent())->contentsToWindow(rect.location());
-    m_npWindow.x = p.x();
-    m_npWindow.y = p.y();
-
-    m_npWindow.width = rect.width();
-    m_npWindow.height = rect.height();
-
-    m_npWindow.clipRect.left = 0;
-    m_npWindow.clipRect.top = 0;
-    m_npWindow.clipRect.right = rect.width();
-    m_npWindow.clipRect.bottom = rect.height();
-
-    if (m_npWindow.x < 0 || m_npWindow.y < 0 ||
-        m_npWindow.width <= 0 || m_npWindow.height <= 0)
+    // On Unix, only call plugin if it's full-page or windowed
+    if (m_mode != NP_FULL && m_mode != NP_EMBED)
         return;
 
-    if (m_plugin->pluginFuncs()->setwindow) {
-        PluginView::setCurrentPluginView(this);
-        JSC::JSLock::DropAllLocks dropAllLocks(false);
-        setCallingPlugin(true);
-        m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
-        setCallingPlugin(false);
-        PluginView::setCurrentPluginView(0);
+    if (!m_hasPendingGeometryChange)
+        return;
+    m_hasPendingGeometryChange = false;
 
-        if (!m_isWindowed)
-            return;
+    ASSERT(platformPluginWidget());
+    platformPluginWidget()->setGeometry(m_windowRect);
+    // if setMask is set with an empty QRegion, no clipping will
+    // be performed, so in that case we hide the plugin view
+    platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
+    platformPluginWidget()->setMask(QRegion(m_clipRect));
 
-        ASSERT(platformPluginWidget());
+    // FLASH WORKAROUND: Only set initially. Multiple calls to
+    // setNPWindow() cause the plugin to crash.
+    if (m_npWindow.width == -1 || m_npWindow.height == -1) {
+        m_npWindow.width = m_windowRect.width();
+        m_npWindow.height = m_windowRect.height();
     }
+
+    m_npWindow.x = m_windowRect.x();
+    m_npWindow.y = m_windowRect.y();
+
+    m_npWindow.clipRect.left = m_clipRect.x();
+    m_npWindow.clipRect.top = m_clipRect.y();
+    m_npWindow.clipRect.right = m_clipRect.width();
+    m_npWindow.clipRect.bottom = m_clipRect.height();
+
+    PluginView::setCurrentPluginView(this);
+    JSC::JSLock::DropAllLocks dropAllLocks(false);
+    setCallingPlugin(true);
+    m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
+    setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
 }
 
 void PluginView::setParentVisible(bool visible)
@@ -225,6 +245,8 @@
 
     JSC::JSLock::DropAllLocks dropAllLocks(false);
 
+    PluginMainThreadScheduler::scheduler().unregisterPlugin(m_instance);
+
     // Clear the window
     m_npWindow.window = 0;
     if (m_plugin->pluginFuncs()->setwindow && !m_plugin->quirks().contains(PluginQuirkDontSetNullWindowHandleOnDestroy)) {
@@ -281,7 +303,7 @@
 
     //FIXME - read the file data into buffer
     FILE* fileHandle = fopen((filename.utf8()).data(), "r");
-    
+
     if (fileHandle == 0)
         return NPERR_FILE_NOT_FOUND;
 
@@ -325,7 +347,7 @@
             *(void **)value = platformPluginWidget()->x11Info().display();
         else
             *(void **)value = m_parentFrame->view()->hostWindow()->platformWindow()->x11Info().display();
-        return NPERR_NO_ERROR;                
+        return NPERR_NO_ERROR;
 
     case NPNVxtAppContext:
         return NPERR_GENERIC_ERROR;
@@ -343,7 +365,7 @@
 
         void** v = (void**)value;
         *v = windowScriptObject;
-            
+
         return NPERR_NO_ERROR;
     }
 
@@ -390,10 +412,10 @@
         platformWidget()->update(rect);
         return;
     }
-    
+
     invalidateWindowlessPluginRect(rect);
 }
-    
+
 void PluginView::invalidateRect(NPRect* rect)
 {
     notImplemented();
@@ -432,6 +454,8 @@
         return;
     m_haveInitialized = true;
 
+    m_hasPendingGeometryChange = false;
+
     if (!m_plugin) {
         ASSERT(m_status == PluginStatusCanNotFindPlugin);
         return;
@@ -458,7 +482,7 @@
     }
 
     if (m_needsXEmbed) {
-        setPlatformWidget(new QX11EmbedContainer(m_parentFrame->view()->hostWindow()->platformWindow()));
+        setPlatformWidget(new PluginContainerQt(this, m_parentFrame->view()->hostWindow()->platformWindow()));
     } else {
         notImplemented();
         m_status = PluginStatusCanNotLoadPlugin;
@@ -478,9 +502,13 @@
 
     m_npWindow.type = NPWindowTypeWindow;
     m_npWindow.window = (void*)platformPluginWidget()->winId();
+    m_npWindow.width = -1;
+    m_npWindow.height = -1;
 
-    if (!(m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall)))
-        setNPWindowRect(frameRect());
+    if (!(m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall))) {
+        updatePluginWidget();
+        setNPWindowIfNeeded();
+    }
 
     m_status = PluginStatusLoadedSuccessfully;
 }
diff --git a/WebCore/plugins/win/PluginPackageWin.cpp b/WebCore/plugins/win/PluginPackageWin.cpp
index 0edcef3..b52553e 100644
--- a/WebCore/plugins/win/PluginPackageWin.cpp
+++ b/WebCore/plugins/win/PluginPackageWin.cpp
@@ -119,7 +119,7 @@
         m_quirks.add(PluginQuirkHasModalMessageLoop);
     }
 
-    if (name() == "VLC Multimedia Plugin") {
+    if (name() == "VLC Multimedia Plugin" || name() == "VLC Multimedia Plug-in") {
         // VLC hangs on NPP_Destroy if we call NPP_SetWindow with a null window handle
         m_quirks.add(PluginQuirkDontSetNullWindowHandleOnDestroy);
 
@@ -281,56 +281,7 @@
     if (npErr != NPERR_NO_ERROR)
         goto abort;
 
-    memset(&m_browserFuncs, 0, sizeof(m_browserFuncs));
-    m_browserFuncs.size = sizeof (m_browserFuncs);
-    m_browserFuncs.version = NP_VERSION_MINOR;
-
-    m_browserFuncs.geturl = NPN_GetURL;
-    m_browserFuncs.posturl = NPN_PostURL;
-    m_browserFuncs.requestread = NPN_RequestRead;
-    m_browserFuncs.newstream = NPN_NewStream;
-    m_browserFuncs.write = NPN_Write;
-    m_browserFuncs.destroystream = NPN_DestroyStream;
-    m_browserFuncs.status = NPN_Status;
-    m_browserFuncs.uagent = NPN_UserAgent;
-    m_browserFuncs.memalloc = NPN_MemAlloc;
-    m_browserFuncs.memfree = NPN_MemFree;
-    m_browserFuncs.memflush = NPN_MemFlush;
-    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
-    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
-    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
-    m_browserFuncs.getvalue = NPN_GetValue;
-    m_browserFuncs.setvalue = NPN_SetValue;
-    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
-    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
-    m_browserFuncs.forceredraw = NPN_ForceRedraw;
-    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
-    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
-    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
-    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
-    m_browserFuncs.pluginthreadasynccall = NPN_PluginThreadAsyncCall;
-
-    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
-    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
-    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
-    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
-    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
-    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
-    m_browserFuncs.intfromidentifier = _NPN_IntFromIdentifier;
-    m_browserFuncs.createobject = _NPN_CreateObject;
-    m_browserFuncs.retainobject = _NPN_RetainObject;
-    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
-    m_browserFuncs.invoke = _NPN_Invoke;
-    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
-    m_browserFuncs.evaluate = _NPN_Evaluate;
-    m_browserFuncs.getproperty = _NPN_GetProperty;
-    m_browserFuncs.setproperty = _NPN_SetProperty;
-    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
-    m_browserFuncs.hasproperty = _NPN_HasProperty;
-    m_browserFuncs.hasmethod = _NPN_HasMethod;
-    m_browserFuncs.setexception = _NPN_SetException;
-    m_browserFuncs.enumerate = _NPN_Enumerate;
-    m_browserFuncs.construct = _NPN_Construct;
+    initializeBrowserFuncs();
 
     npErr = NP_Initialize(&m_browserFuncs);
     LOG_NPERROR(npErr);
diff --git a/WebCore/plugins/win/PluginViewWin.cpp b/WebCore/plugins/win/PluginViewWin.cpp
index 895338e..7e80aa4 100644
--- a/WebCore/plugins/win/PluginViewWin.cpp
+++ b/WebCore/plugins/win/PluginViewWin.cpp
@@ -45,7 +45,6 @@
 #include "KeyboardEvent.h"
 #include "MIMETypeRegistry.h"
 #include "MouseEvent.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "FocusController.h"
 #include "PlatformMouseEvent.h"
@@ -552,10 +551,7 @@
             }
     }
     else if (event->type() == eventNames().mousedownEvent) {
-        // Focus the plugin
-        if (Page* page = m_parentFrame->page())
-            page->focusController()->setFocusedFrame(m_parentFrame);
-        m_parentFrame->document()->setFocusedNode(m_element);
+        focusPluginElement();
         switch (event->button()) {
             case 0:
                 npEvent.event = WM_LBUTTONDOWN;
@@ -582,8 +578,6 @@
     } else
         return;
 
-    HCURSOR currentCursor = ::GetCursor();
-
     JSC::JSLock::DropAllLocks dropAllLocks(false);
     if (!dispatchNPEvent(npEvent))
         event->setDefaultHandled();
@@ -591,7 +585,7 @@
 #if !PLATFORM(QT)
     // Currently, Widget::setCursor is always called after this function in EventHandler.cpp
     // and since we don't want that we set ignoreNextSetCursor to true here to prevent that.
-    ignoreNextSetCursor = true;     
+    ignoreNextSetCursor = true;
     lastSetCursor = ::GetCursor();
 #endif
 }
diff --git a/WebCore/rendering/FixedTableLayout.cpp b/WebCore/rendering/FixedTableLayout.cpp
index d7c1293..f995fbf 100644
--- a/WebCore/rendering/FixedTableLayout.cpp
+++ b/WebCore/rendering/FixedTableLayout.cpp
@@ -85,16 +85,15 @@
 
     // iterate over all <col> elements
     RenderObject* child = m_table->firstChild();
-    int cCol = 0;
     int nEffCols = m_table->numEffCols();
     m_width.resize(nEffCols);
     m_width.fill(Length(Auto));
 
+    int currentEffectiveColumn = 0;
     Length grpWidth;
     while (child) {
         if (child->isTableCol()) {
-            RenderTableCol *col = static_cast<RenderTableCol *>(child);
-            int span = col->span();
+            RenderTableCol* col = static_cast<RenderTableCol*>(child);
             if (col->firstChild())
                 grpWidth = col->style()->width();
             else {
@@ -104,30 +103,35 @@
                 int effWidth = 0;
                 if (w.isFixed() && w.value() > 0)
                     effWidth = w.value();
-                
-                int usedSpan = 0;
-                int i = 0;
-                while (usedSpan < span) {
-                    if(cCol + i >= nEffCols) {
-                        m_table->appendColumn(span - usedSpan);
+
+                int span = col->span();
+                while (span) {
+                    int spanInCurrentEffectiveColumn;
+                    if (currentEffectiveColumn >= nEffCols) {
+                        m_table->appendColumn(span);
                         nEffCols++;
-                        m_width.resize(nEffCols);
-                        m_width[nEffCols-1] = Length();
+                        m_width.append(Length());
+                        spanInCurrentEffectiveColumn = span;
+                    } else {
+                        if (span < m_table->spanOfEffCol(currentEffectiveColumn)) {
+                            m_table->splitColumn(currentEffectiveColumn, span);
+                            nEffCols++;
+                            m_width.append(Length());
+                        }
+                        spanInCurrentEffectiveColumn = m_table->spanOfEffCol(currentEffectiveColumn);
                     }
-                    int eSpan = m_table->spanOfEffCol(cCol+i);
                     if ((w.isFixed() || w.isPercent()) && w.isPositive()) {
-                        m_width[cCol + i].setRawValue(w.type(), w.rawValue() * eSpan);
-                        usedWidth += effWidth * eSpan;
+                        m_width[currentEffectiveColumn].setRawValue(w.type(), w.rawValue() * spanInCurrentEffectiveColumn);
+                        usedWidth += effWidth * spanInCurrentEffectiveColumn;
                     }
-                    usedSpan += eSpan;
-                    i++;
+                    span -= spanInCurrentEffectiveColumn;
+                    currentEffectiveColumn++;
                 }
-                cCol += i;
             }
         } else
             break;
 
-        RenderObject *next = child->firstChild();
+        RenderObject* next = child->firstChild();
         if (!next)
             next = child->nextSibling();
         if (!next && child->parent()->isTableCol()) {
@@ -146,7 +150,7 @@
     if (section && !section->numRows())
         section = m_table->sectionBelow(section, true);
     if (section) {
-        cCol = 0;
+        int cCol = 0;
         RenderObject* firstRow = section->firstChild();
         child = firstRow->firstChild();
         while (child) {
diff --git a/WebCore/rendering/HitTestResult.cpp b/WebCore/rendering/HitTestResult.cpp
index 8126fc7..f2ed7db 100644
--- a/WebCore/rendering/HitTestResult.cpp
+++ b/WebCore/rendering/HitTestResult.cpp
@@ -159,6 +159,20 @@
     return marker->description;
 }
 
+String HitTestResult::replacedString() const
+{
+    // Return the replaced string associated with this point, if any. This marker is created when a string is autocorrected, 
+    // and is used for generating a contextual menu item that allows it to easily be changed back if desired.
+    if (!m_innerNonSharedNode)
+        return String();
+    
+    DocumentMarker* marker = m_innerNonSharedNode->document()->markerContainingPoint(m_point, DocumentMarker::Replacement);
+    if (!marker)
+        return String();
+    
+    return marker->description;
+}    
+    
 String HitTestResult::title() const
 {
     // Find the title in the nearest enclosing DOM node.
diff --git a/WebCore/rendering/HitTestResult.h b/WebCore/rendering/HitTestResult.h
index 5ed9b34..4f0383f 100644
--- a/WebCore/rendering/HitTestResult.h
+++ b/WebCore/rendering/HitTestResult.h
@@ -65,6 +65,7 @@
     IntRect boundingBox() const;
     bool isSelected() const;
     String spellingToolTip() const;
+    String replacedString() const;
     String title() const;
     String altDisplayString() const;
     String titleDisplayString() const;
diff --git a/WebCore/rendering/InlineBox.cpp b/WebCore/rendering/InlineBox.cpp
index 89cd4b8..2d956a8 100644
--- a/WebCore/rendering/InlineBox.cpp
+++ b/WebCore/rendering/InlineBox.cpp
@@ -87,7 +87,30 @@
 
 int InlineBox::height() const
 {
-    return toRenderBox(m_renderer)->height();
+#if ENABLE(SVG)
+    if (isSVG())
+        return svgBoxHeight();
+#endif
+
+    if (renderer()->isText())
+        return m_isText ? renderer()->style(m_firstLine)->font().height() : 0;
+    if (renderer()->isBox() && parent())
+        return toRenderBox(m_renderer)->height();
+
+    ASSERT(isInlineFlowBox());
+    const InlineFlowBox* flowBox = static_cast<const InlineFlowBox*>(this);
+    RenderBoxModelObject* flowObject = boxModelObject();
+    const Font& font = renderer()->style(m_firstLine)->font();
+    int result = font.height();
+    bool strictMode = renderer()->document()->inStrictMode();
+    if (parent())
+        result += flowObject->borderTop() + flowObject->paddingTop() + flowObject->borderBottom() + flowObject->paddingBottom();
+    if (strictMode || flowBox->hasTextChildren() || flowObject->hasHorizontalBordersOrPadding())
+        return result;
+    int bottom = root()->bottomOverflow();
+    if (y() + result > bottom)
+        result = bottom - y();
+    return result;
 }
 
 int InlineBox::caretMinOffset() const 
@@ -257,7 +280,7 @@
     return !(boxRect.intersects(ellipsisRect));
 }
 
-int InlineBox::placeEllipsisBox(bool, int, int, bool&)
+int InlineBox::placeEllipsisBox(bool, int, int, int, bool&)
 {
     // Use -1 to mean "we didn't set the position."
     return -1;
diff --git a/WebCore/rendering/InlineBox.h b/WebCore/rendering/InlineBox.h
index e66574a..9585278 100644
--- a/WebCore/rendering/InlineBox.h
+++ b/WebCore/rendering/InlineBox.h
@@ -36,23 +36,26 @@
 class InlineBox {
 public:
     InlineBox(RenderObject* obj)
-        : m_renderer(obj)
+        : m_next(0)
+        , m_prev(0)
+        , m_parent(0)
+        , m_renderer(obj)
         , m_x(0)
         , m_y(0)
         , m_width(0)
-        , m_next(0)
-        , m_prev(0)
-        , m_parent(0)
         , m_firstLine(false)
         , m_constructed(false)
         , m_bidiEmbeddingLevel(0)
         , m_dirty(false)
         , m_extracted(false)
+#if ENABLE(SVG)
+        , m_isSVG(false)
+#endif
         , m_endsWithBreak(false)
         , m_hasSelectedChildren(false)
         , m_hasEllipsisBox(false)
         , m_dirOverride(false)
-        , m_treatAsText(true)
+        , m_isText(false)
         , m_determinedIfNextOnLineExists(false)
         , m_determinedIfPrevOnLineExists(false)
         , m_nextOnLineExists(false)
@@ -66,23 +69,26 @@
 
     InlineBox(RenderObject* obj, int x, int y, int width, bool firstLine, bool constructed,
               bool dirty, bool extracted, InlineBox* next, InlineBox* prev, InlineFlowBox* parent)
-        : m_renderer(obj)
+        : m_next(next)
+        , m_prev(prev)
+        , m_parent(parent)
+        , m_renderer(obj)
         , m_x(x)
         , m_y(y)
         , m_width(width)
-        , m_next(next)
-        , m_prev(prev)
-        , m_parent(parent)
         , m_firstLine(firstLine)
         , m_constructed(constructed)
         , m_bidiEmbeddingLevel(0)
         , m_dirty(dirty)
         , m_extracted(extracted)
+#if ENABLE(SVG)
+        , m_isSVG(false)
+#endif
         , m_endsWithBreak(false)
         , m_hasSelectedChildren(false)   
         , m_hasEllipsisBox(false)
         , m_dirOverride(false)
-        , m_treatAsText(true)
+        , m_isText(false)
         , m_determinedIfNextOnLineExists(false)
         , m_determinedIfPrevOnLineExists(false)
         , m_nextOnLineExists(false)
@@ -129,8 +135,11 @@
     virtual bool isRootInlineBox() const { return false; }
 #if ENABLE(SVG) 
     virtual bool isSVGRootInlineBox() { return false; }
+    bool isSVG() const { return m_isSVG; }
+    void setIsSVG(bool b) { m_isSVG = b; }
 #endif
-    virtual bool isText() const { return false; }
+    bool isText() const { return m_isText; }
+    void setIsText(bool b) { m_isText = b; }
 
     bool isConstructed() { return m_constructed; }
     virtual void setConstructed()
@@ -182,13 +191,15 @@
     void setWidth(int w) { m_width = w; }
     int width() const { return m_width; }
 
+    // x() is the left side of the box in the parent's coordinate system.
     void setX(int x) { m_x = x; }
     int x() const { return m_x; }
 
+    // y() is the top of the box in the parent's coordinate system.
     void setY(int y) { m_y = y; }
     int y() const { return m_y; }
 
-    virtual int height() const;
+    int height() const;
 
     virtual int topOverflow() const { return y(); }
     virtual int bottomOverflow() const { return y() + height(); }
@@ -215,7 +226,8 @@
     virtual RenderObject::SelectionState selectionState();
 
     virtual bool canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth);
-    virtual int placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool&);
+    // visibleLeftEdge, visibleRightEdge are in the parent's coordinate system.
+    virtual int placeEllipsisBox(bool ltr, int visibleLeftEdge, int visibleRightEdge, int ellipsisWidth, bool&);
 
     void setHasBadParent();
 
@@ -231,18 +243,23 @@
         return 0;
     }
 
-public:
-    RenderObject* m_renderer;
-
-    int m_x;
-    int m_y;
-    int m_width;
+protected:
+#if ENABLE(SVG)
+    virtual int svgBoxHeight() const { return 0; }
+#endif
 
 private:
     InlineBox* m_next; // The next element on the same line as us.
     InlineBox* m_prev; // The previous element on the same line as us.
 
     InlineFlowBox* m_parent; // The box that contains us.
+
+public:
+    RenderObject* m_renderer;
+
+    int m_x;
+    int m_y;
+    int m_width;
     
     // Some of these bits are actually for subclasses and moved here to compact the structures.
 
@@ -256,6 +273,10 @@
     bool m_dirty : 1;
     bool m_extracted : 1;
 
+#if ENABLE(SVG)
+    bool m_isSVG : 1;
+#endif
+
     // for RootInlineBox
     bool m_endsWithBreak : 1;  // Whether the line ends with a <br>.
     bool m_hasSelectedChildren : 1; // Whether we have any children selected (this bit will also be set if the <br> that terminates our line is selected).
@@ -264,13 +285,13 @@
     // for InlineTextBox
 public:
     bool m_dirOverride : 1;
-    bool m_treatAsText : 1; // Whether or not to treat a <br> as text for the purposes of line height.
+    bool m_isText : 1; // Whether or not this object represents text with a non-zero height. Includes non-image list markers, text boxes.
 protected:
     mutable bool m_determinedIfNextOnLineExists : 1;
     mutable bool m_determinedIfPrevOnLineExists : 1;
     mutable bool m_nextOnLineExists : 1;
     mutable bool m_prevOnLineExists : 1;
-    int m_toAdd : 13; // for justified text
+    int m_toAdd : 12; // for justified text
 
 #ifndef NDEBUG
 private:
diff --git a/WebCore/rendering/InlineFlowBox.cpp b/WebCore/rendering/InlineFlowBox.cpp
index 2e23bb6..0432a4c 100644
--- a/WebCore/rendering/InlineFlowBox.cpp
+++ b/WebCore/rendering/InlineFlowBox.cpp
@@ -51,21 +51,6 @@
 
 #endif
 
-int InlineFlowBox::height() const
-{
-    const Font& font = renderer()->style(m_firstLine)->font();
-    int result = font.height();
-    bool strictMode = renderer()->document()->inStrictMode();
-    RenderBoxModelObject* box = boxModelObject();
-    result += box->borderTop() + box->paddingTop() + box->borderBottom() + box->paddingBottom();
-    if (!strictMode && !hasTextChildren() && !box->hasHorizontalBordersOrPadding()) {
-        int bottomOverflow = root()->bottomOverflow();
-        if (y() + result > bottomOverflow)
-            result = bottomOverflow - y();
-    }
-    return result;
-}
-
 int InlineFlowBox::getFlowSpacingWidth()
 {
     int totWidth = marginBorderPaddingLeft() + marginBorderPaddingRight();
@@ -430,25 +415,59 @@
                 maxDescent = descent;
         }
     }
-    
+
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->renderer()->isPositioned())
             continue; // Positioned placeholders don't affect calculations.
         
         bool isInlineFlow = curr->isInlineFlowBox();
 
-        int lineHeight = curr->renderer()->lineHeight(m_firstLine);
-        int baseline = curr->renderer()->baselinePosition(m_firstLine);
+        int lineHeight;
+        int baseline;
+        Vector<const SimpleFontData*> usedFonts;
+        if (curr->isInlineTextBox())
+            static_cast<InlineTextBox*>(curr)->takeFallbackFonts(usedFonts);
+
+        if (!usedFonts.isEmpty()) {
+            usedFonts.append(curr->renderer()->style(m_firstLine)->font().primaryFont());
+            Length parentLineHeight = curr->renderer()->parent()->style()->lineHeight();
+            if (parentLineHeight.isNegative()) {
+                int baselineToBottom = 0;
+                baseline = 0;
+                for (size_t i = 0; i < usedFonts.size(); ++i) {
+                    int halfLeading = (usedFonts[i]->lineSpacing() - usedFonts[i]->ascent() - usedFonts[i]->descent()) / 2;
+                    baseline = max(baseline, halfLeading + usedFonts[i]->ascent());
+                    baselineToBottom = max(baselineToBottom, usedFonts[i]->lineSpacing() - usedFonts[i]->ascent() - usedFonts[i]->descent() - halfLeading);
+                }
+                lineHeight = baseline + baselineToBottom;
+            } else if (parentLineHeight.isPercent()) {
+                lineHeight = parentLineHeight.calcMinValue(curr->renderer()->style()->fontSize());
+                baseline = 0;
+                for (size_t i = 0; i < usedFonts.size(); ++i) {
+                    int halfLeading = (lineHeight - usedFonts[i]->ascent() - usedFonts[i]->descent()) / 2;
+                    baseline = max(baseline, halfLeading + usedFonts[i]->ascent());
+                }
+            } else {
+                lineHeight = parentLineHeight.value();
+                baseline = 0;
+                for (size_t i = 0; i < usedFonts.size(); ++i) {
+                    int halfLeading = (lineHeight - usedFonts[i]->ascent() - usedFonts[i]->descent()) / 2;
+                    baseline = max(baseline, halfLeading + usedFonts[i]->ascent());
+                }
+            }
+        } else {
+            lineHeight = curr->renderer()->lineHeight(m_firstLine);
+            baseline = curr->renderer()->baselinePosition(m_firstLine);
+        }
+
         curr->setY(verticalPositionForBox(curr, m_firstLine));
         if (curr->y() == PositionTop) {
             if (maxPositionTop < lineHeight)
                 maxPositionTop = lineHeight;
-        }
-        else if (curr->y() == PositionBottom) {
+        } else if (curr->y() == PositionBottom) {
             if (maxPositionBottom < lineHeight)
                 maxPositionBottom = lineHeight;
-        }
-        else if ((!isInlineFlow || static_cast<InlineFlowBox*>(curr)->hasTextChildren()) || curr->boxModelObject()->hasHorizontalBordersOrPadding() || strictMode) {
+        } else if ((!isInlineFlow || static_cast<InlineFlowBox*>(curr)->hasTextChildren()) || curr->boxModelObject()->hasHorizontalBordersOrPadding() || strictMode) {
             int ascent = baseline - curr->y();
             int descent = lineHeight - ascent;
             if (maxAscent < ascent)
@@ -492,6 +511,11 @@
             curr->setY(curr->y() + yPos + posAdjust);
         }
         
+        // FIXME: By only considering overflow as part of the root line box, we can't get an accurate picture regarding what the line
+        // actually needs to paint.  A line box that is part of a self-painting layer technically shouldn't contribute to the overflow
+        // of the line, but in order to not do this and paint accurately, we have to track the overflow somewhere else (either by storing overflow
+        // in each InlineFlowBox up the chain or in the layer itself).  Relative positioned objects on a line will cause scrollbars
+        // to appear when they shouldn't until we fix this issue.
         int newY = curr->y();
         int overflowTop = 0;
         int overflowBottom = 0;
@@ -531,10 +555,11 @@
         curr->setY(newY);
 
         if (childAffectsTopBottomPos) {
+            int boxHeight = curr->height();
             selectionTop = min(selectionTop, newY);
-            selectionBottom = max(selectionBottom, newY + curr->height());
+            selectionBottom = max(selectionBottom, newY + boxHeight);
             topPosition = min(topPosition, newY + overflowTop);
-            bottomPosition = max(bottomPosition, newY + curr->height() + overflowBottom);
+            bottomPosition = max(bottomPosition, newY + boxHeight + overflowBottom);
         }
     }
 
@@ -744,7 +769,7 @@
                 for (InlineRunBox* curr = this; curr; curr = curr->nextLineBox())
                     totalWidth += curr->width();
                 context->save();
-                context->clip(IntRect(tx, ty, width(), height()));
+                context->clip(IntRect(tx, ty, w, h));
                 boxModelObject()->paintBorder(context, startX, ty, totalWidth, h, renderer()->style());
                 context->restore();
             }
@@ -807,7 +832,7 @@
         for (InlineRunBox* curr = this; curr; curr = curr->nextLineBox())
             totalWidth += curr->width();
         paintInfo.context->save();
-        paintInfo.context->clip(IntRect(tx, ty, width(), height()));
+        paintInfo.context->clip(IntRect(tx, ty, w, h));
         boxModelObject()->paintNinePieceImage(paintInfo.context, startX, ty, totalWidth, h, renderer()->style(), maskNinePieceImage, compositeOp);
         paintInfo.context->restore();
     }
@@ -860,18 +885,37 @@
         int w = m_width - (borderLeft() + paddingLeft() + borderRight() + paddingRight());
         RootInlineBox* rootLine = root();
         if (rootLine->ellipsisBox()) {
-            int ellipsisX = rootLine->ellipsisBox()->x();
+            int ellipsisX = m_x + rootLine->ellipsisBox()->x();
             int ellipsisWidth = rootLine->ellipsisBox()->width();
-            
-            // FIXME: Will need to work with RTL
+            bool ltr = renderer()->style()->direction() == LTR;
             if (rootLine == this) {
-                if (x + w >= ellipsisX + ellipsisWidth)
-                    w -= (x + w - ellipsisX - ellipsisWidth);
+                // Trim w and x so that the underline isn't drawn underneath the ellipsis.
+                // ltr: is our right edge farther right than the right edge of the ellipsis.
+                // rtl: is the left edge of our box farther left than the left edge of the ellipsis.
+                bool ltrTruncation = ltr && (x + w >= ellipsisX + ellipsisWidth);
+                bool rtlTruncation = !ltr && (x <= ellipsisX + ellipsisWidth);
+                if (ltrTruncation)
+                    w -= (x + w) - (ellipsisX + ellipsisWidth);
+                else if (rtlTruncation) {
+                    int dx = m_x - ((ellipsisX - m_x) + ellipsisWidth);
+                    tx -= dx;
+                    w += dx;
+                }
             } else {
-                if (x >= ellipsisX)
+                bool ltrPastEllipsis = ltr && x >= ellipsisX;
+                bool rtlPastEllipsis = !ltr && (x + w) <= (ellipsisX + ellipsisWidth);
+                if (ltrPastEllipsis || rtlPastEllipsis)
                     return;
-                if (x + w >= ellipsisX)
+
+                bool ltrTruncation = ltr && x + w >= ellipsisX;
+                bool rtlTruncation = !ltr && x <= ellipsisX;
+                if (ltrTruncation)
                     w -= (x + w - ellipsisX);
+                else if (rtlTruncation) {
+                    int dx = m_x - ((ellipsisX - m_x) + ellipsisWidth);
+                    tx -= dx;
+                    w += dx;
+                }
             }
         }
 
@@ -997,13 +1041,32 @@
     return true;
 }
 
-int InlineFlowBox::placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool& foundBox)
+int InlineFlowBox::placeEllipsisBox(bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth, bool& foundBox)
 {
     int result = -1;
-    for (InlineBox *box = firstChild(); box; box = box->nextOnLine()) {
-        int currResult = box->placeEllipsisBox(ltr, blockEdge, ellipsisWidth, foundBox);
+    // We iterate over all children, the foundBox variable tells us when we've found the
+    // box containing the ellipsis.  All boxes after that one in the flow are hidden.
+    // If our flow is ltr then iterate over the boxes from left to right, otherwise iterate
+    // from right to left. Varying the order allows us to correctly hide the boxes following the ellipsis.
+    InlineBox *box = ltr ? firstChild() : lastChild();
+
+    // NOTE: these will cross after foundBox = true.
+    int visibleLeftEdge = blockLeftEdge;
+    int visibleRightEdge = blockRightEdge;
+
+    while(box) {
+        int currResult = box->placeEllipsisBox(ltr, visibleLeftEdge, visibleRightEdge, ellipsisWidth, foundBox);
         if (currResult != -1 && result == -1)
             result = currResult;
+
+        if (ltr) {
+            visibleLeftEdge += box->width();
+            box = box->nextOnLine();
+        }
+        else {
+            visibleRightEdge -= box->width();
+            box = box->prevOnLine();
+        }
     }
     return result;
 }
diff --git a/WebCore/rendering/InlineFlowBox.h b/WebCore/rendering/InlineFlowBox.h
index df75d06..2462eba 100644
--- a/WebCore/rendering/InlineFlowBox.h
+++ b/WebCore/rendering/InlineFlowBox.h
@@ -55,8 +55,6 @@
     virtual ~InlineFlowBox();
 #endif
 
-    virtual int height() const;
-
     InlineFlowBox* prevFlowBox() const { return static_cast<InlineFlowBox*>(m_prevLine); }
     InlineFlowBox* nextFlowBox() const { return static_cast<InlineFlowBox*>(m_nextLine); }
 
@@ -143,7 +141,7 @@
     virtual RenderObject::SelectionState selectionState();
 
     virtual bool canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth);
-    virtual int placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool&);
+    virtual int placeEllipsisBox(bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth, bool&);
 
     bool hasTextChildren() const { return m_hasTextChildren; }
 
diff --git a/WebCore/rendering/InlineTextBox.cpp b/WebCore/rendering/InlineTextBox.cpp
index 809c071..418be15 100644
--- a/WebCore/rendering/InlineTextBox.cpp
+++ b/WebCore/rendering/InlineTextBox.cpp
@@ -41,11 +41,6 @@
 
 namespace WebCore {
 
-int InlineTextBox::height() const
-{
-    return m_treatAsText ? renderer()->style(m_firstLine)->font().height() : 0;
-}
-
 int InlineTextBox::selectionTop()
 {
     return root()->selectionTop();
@@ -133,20 +128,21 @@
     toRenderText(renderer())->attachTextBox(this);
 }
 
-int InlineTextBox::placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool& foundBox)
+int InlineTextBox::placeEllipsisBox(bool flowIsLTR, int visibleLeftEdge, int visibleRightEdge, int ellipsisWidth, bool& foundBox)
 {
     if (foundBox) {
         m_truncation = cFullTruncation;
         return -1;
     }
 
-    int ellipsisX = ltr ? blockEdge - ellipsisWidth : blockEdge + ellipsisWidth;
+    // For LTR this is the left edge of the box, for RTL, the right edge in parent coordinates.
+    int ellipsisX = flowIsLTR ? visibleRightEdge - ellipsisWidth : visibleLeftEdge + ellipsisWidth;
     
     // Criteria for full truncation:
     // LTR: the left edge of the ellipsis is to the left of our text run.
     // RTL: the right edge of the ellipsis is to the right of our text run.
-    bool ltrFullTruncation = ltr && ellipsisX <= m_x;
-    bool rtlFullTruncation = !ltr && ellipsisX >= (m_x + m_width);
+    bool ltrFullTruncation = flowIsLTR && ellipsisX <= m_x;
+    bool rtlFullTruncation = !flowIsLTR && ellipsisX >= (m_x + m_width);
     if (ltrFullTruncation || rtlFullTruncation) {
         // Too far.  Just set full truncation, but return -1 and let the ellipsis just be placed at the edge of the box.
         m_truncation = cFullTruncation;
@@ -154,14 +150,21 @@
         return -1;
     }
 
-    bool ltrEllipsisWithinBox = ltr && (ellipsisX < m_x + m_width);
-    bool rtlEllipsisWithinBox = !ltr && (ellipsisX > m_x);
+    bool ltrEllipsisWithinBox = flowIsLTR && (ellipsisX < m_x + m_width);
+    bool rtlEllipsisWithinBox = !flowIsLTR && (ellipsisX > m_x);
     if (ltrEllipsisWithinBox || rtlEllipsisWithinBox) {
-        if ((ltr && direction() == RTL) || (!ltr && direction() == LTR))
-            return -1; // FIXME: Support cases in which the last run's directionality differs from the context.
-
         foundBox = true;
 
+        // The inline box may have different directionality than it's parent.  Since truncation
+        // behavior depends both on both the parent and the inline block's directionality, we
+        // must keep track of these separately.
+        bool ltr = direction() == LTR;
+        if (ltr != flowIsLTR) {
+          // Width in pixels of the visible portion of the box, excluding the ellipsis.
+          int visibleBoxWidth = visibleRightEdge - visibleLeftEdge  - ellipsisWidth;
+          ellipsisX = ltr ? m_x + visibleBoxWidth : m_x + m_width - visibleBoxWidth;
+        }
+
         int offset = offsetForPosition(ellipsisX, false);
         if (offset == 0) {
             // No characters should be rendered.  Set ourselves to full truncation and place the ellipsis at the min of our start
@@ -170,12 +173,22 @@
             return min(ellipsisX, m_x);
         }
 
-        // Set the truncation index on the text run.  The ellipsis needs to be placed just after the last visible character.
+        // Set the truncation index on the text run.
         m_truncation = offset;
-        if (ltr)
-            return m_x + toRenderText(renderer())->width(m_start, offset, textPos(), m_firstLine);
+
+        // If we got here that means that we were only partially truncated and we need to return the pixel offset at which
+        // to place the ellipsis.
+        int widthOfVisibleText = toRenderText(renderer())->width(m_start, offset, textPos(), m_firstLine);
+
+        // The ellipsis needs to be placed just after the last visible character.
+        // Where "after" is defined by the flow directionality, not the inline
+        // box directionality.
+        // e.g. In the case of an LTR inline box truncated in an RTL flow then we can
+        // have a situation such as |Hello| -> |...He|
+        if (flowIsLTR)
+            return m_x + widthOfVisibleText;
         else
-            return m_x + (m_width - toRenderText(renderer())->width(m_start, offset, textPos(), m_firstLine)) - ellipsisWidth;
+            return (m_x + m_width) - widthOfVisibleText - ellipsisWidth;
     }
     return -1;
 }
@@ -290,7 +303,7 @@
     if (isLineBreak() || !renderer()->shouldPaintWithinRoot(paintInfo) || renderer()->style()->visibility() != VISIBLE ||
         m_truncation == cFullTruncation || paintInfo.phase == PaintPhaseOutline)
         return;
-    
+
     ASSERT(paintInfo.phase != PaintPhaseSelfOutline && paintInfo.phase != PaintPhaseChildOutlines);
 
     int xPos = tx + m_x - parent()->maxHorizontalVisualOverflow();
@@ -306,6 +319,24 @@
         // When only painting the selection, don't bother to paint if there is none.
         return;
 
+    if (m_truncation != cNoTruncation) {
+        TextDirection flowDirection = renderer()->containingBlock()->style()->direction();
+        if (flowDirection != direction()) {
+            // Make the visible fragment of text hug the edge closest to the rest of the run by moving the origin
+            // at which we start drawing text.
+            // e.g. In the case of LTR text truncated in an RTL Context, the correct behavior is:
+            // |Hello|CBA| -> |...He|CBA|
+            // In order to draw the fragment "He" aligned to the right edge of it's box, we need to start drawing
+            // farther to the right.
+            // NOTE: WebKit's behavior differs from that of IE which appears to just overlay the ellipsis on top of the
+            // truncated string i.e.  |Hello|CBA| -> |...lo|CBA|
+            int widthOfVisibleText = toRenderText(renderer())->width(m_start, m_truncation, textPos(), m_firstLine);
+            int widthOfHiddenText = m_width - widthOfVisibleText;
+            // FIXME: The hit testing logic also needs to take this translation int account.
+            tx += direction() == LTR ? widthOfHiddenText : -widthOfHiddenText;
+        }
+    }
+
     GraphicsContext* context = paintInfo.context;
 
     // Determine whether or not we have composition underlines to draw.
@@ -738,7 +769,9 @@
      
     // Optionally highlight the text
     if (renderer()->document()->frame()->markedTextMatchesAreHighlighted()) {
-        Color color = theme()->platformTextSearchHighlightColor();
+        Color color = marker.activeMatch ?
+            theme()->platformActiveTextSearchHighlightColor() :
+            theme()->platformInactiveTextSearchHighlightColor();
         pt->save();
         updateGraphicsContext(pt, color, color, 0);  // Don't draw text at all!
         pt->clip(IntRect(tx + m_x, ty + y, m_width, h));
@@ -747,6 +780,22 @@
     }
 }
 
+void InlineTextBox::computeRectForReplacementMarker(int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font)
+{
+    // Replacement markers are not actually drawn, but their rects need to be computed for hit testing.
+    int y = selectionTop();
+    int h = selectionHeight();
+    
+    int sPos = max(marker.startOffset - m_start, (unsigned)0);
+    int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
+    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
+    IntPoint startPoint = IntPoint(m_x + tx, y + ty);
+    
+    // Compute and store the rect associated with this marker.
+    IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, h, sPos, ePos));
+    renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
+}
+    
 void InlineTextBox::paintDocumentMarkers(GraphicsContext* pt, int tx, int ty, RenderStyle* style, const Font& font, bool background)
 {
     if (!renderer()->node())
@@ -764,6 +813,7 @@
         switch (marker.type) {
             case DocumentMarker::Grammar:
             case DocumentMarker::Spelling:
+            case DocumentMarker::Replacement:
                 if (background)
                     continue;
                 break;
@@ -797,6 +847,9 @@
             case DocumentMarker::TextMatch:
                 paintTextMatchMarker(pt, tx, ty, marker, style, font);
                 break;
+            case DocumentMarker::Replacement:
+                computeRectForReplacementMarker(tx, ty, marker, style, font);
+                break;
             default:
                 ASSERT_NOT_REACHED();
         }
@@ -931,4 +984,30 @@
     return true;
 }
 
+typedef HashMap<InlineTextBox*, Vector<const SimpleFontData*> > FallbackFontsMap;
+static FallbackFontsMap* gFallbackFontsMap;
+
+void InlineTextBox::setFallbackFonts(const HashSet<const SimpleFontData*>& fallbackFonts)
+{
+    if (!gFallbackFontsMap)
+        gFallbackFontsMap = new FallbackFontsMap;
+
+    FallbackFontsMap::iterator it = gFallbackFontsMap->set(this, Vector<const SimpleFontData*>()).first;
+    ASSERT(it->second.isEmpty());
+    copyToVector(fallbackFonts, it->second);
+}
+
+void InlineTextBox::takeFallbackFonts(Vector<const SimpleFontData*>& fallbackFonts)
+{
+    if (!gFallbackFontsMap)
+        return;
+
+    FallbackFontsMap::iterator it = gFallbackFontsMap->find(this);
+    if (it == gFallbackFontsMap->end())
+        return;
+
+    fallbackFonts.swap(it->second);
+    gFallbackFontsMap->remove(it);
+}
+
 } // namespace WebCore
diff --git a/WebCore/rendering/InlineTextBox.h b/WebCore/rendering/InlineTextBox.h
index 222e973..3bbb453 100644
--- a/WebCore/rendering/InlineTextBox.h
+++ b/WebCore/rendering/InlineTextBox.h
@@ -50,8 +50,6 @@
     InlineTextBox* nextTextBox() const { return static_cast<InlineTextBox*>(nextLineBox()); }
     InlineTextBox* prevTextBox() const { return static_cast<InlineTextBox*>(prevLineBox()); }
 
-    virtual int height() const;
-
     unsigned start() const { return m_start; }
     unsigned end() const { return m_len ? m_start + m_len - 1 : m_start; }
     unsigned len() const { return m_len; }
@@ -61,6 +59,9 @@
 
     void offsetRun(int d) { m_start += d; }
 
+    void setFallbackFonts(const HashSet<const SimpleFontData*>&);
+    void takeFallbackFonts(Vector<const SimpleFontData*>&);
+
 private:
     virtual int selectionTop();
     virtual int selectionHeight();
@@ -87,7 +88,7 @@
 
 private:
     virtual void clearTruncation() { m_truncation = cNoTruncation; }
-    virtual int placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool& foundBox);
+    virtual int placeEllipsisBox(bool flowIsLTR, int visibleLeftEdge, int visibleRightEdge, int ellipsisWidth, bool& foundBox);
 
 public:
     virtual bool isLineBreak() const;
@@ -98,9 +99,6 @@
     virtual bool isInlineTextBox() { return true; }    
 
 public:
-    virtual bool isText() const { return m_treatAsText; }
-    void setIsText(bool b) { m_treatAsText = b; }
-
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
 
@@ -135,6 +133,7 @@
     void paintSelection(GraphicsContext*, int tx, int ty, RenderStyle*, const Font&);
     void paintSpellingOrGrammarMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font&, bool grammar);
     void paintTextMatchMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font&);
+    void computeRectForReplacementMarker(int tx, int ty, DocumentMarker, RenderStyle*, const Font&);
 };
 
 inline RenderText* InlineTextBox::textRenderer() const
diff --git a/WebCore/rendering/ListMarkerBox.cpp b/WebCore/rendering/ListMarkerBox.cpp
deleted file mode 100644
index 6089ebd..0000000
--- a/WebCore/rendering/ListMarkerBox.cpp
+++ /dev/null
@@ -1,45 +0,0 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
- * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "ListMarkerBox.h"
-
-#include "InlineFlowBox.h"
-#include "RenderArena.h"
-#include "RenderListMarker.h"
-
-namespace WebCore {
-
-ListMarkerBox::ListMarkerBox(RenderObject* obj)
-    : InlineBox(obj)
-{
-}
-
-bool ListMarkerBox::isText() const
-{
-    return static_cast<RenderListMarker*>(renderer())->isText();
-}
-
-} // namespace WebCore
diff --git a/WebCore/rendering/MediaControlElements.cpp b/WebCore/rendering/MediaControlElements.cpp
index d84e9ad..5cd9363 100644
--- a/WebCore/rendering/MediaControlElements.cpp
+++ b/WebCore/rendering/MediaControlElements.cpp
@@ -32,9 +32,7 @@
 
 #include "MediaControlElements.h"
 
-#include "Event.h"
 #include "EventNames.h"
-#include "EventHandler.h"
 #include "FloatConversion.h"
 #include "Frame.h"
 #include "HTMLNames.h"
@@ -61,7 +59,6 @@
     rootStyle->setDisplay(BLOCK);
     rootStyle->setPosition(RelativePosition);
     RenderMediaControlShadowRoot* renderer = new (mediaElement->renderer()->renderArena()) RenderMediaControlShadowRoot(this);
-    renderer->setParent(mediaElement->renderer());
     renderer->setStyle(rootStyle.release());
     setRenderer(renderer);
     setAttached();
@@ -121,10 +118,11 @@
 
 // ----------------------------
 
-MediaControlInputElement::MediaControlInputElement(Document* doc, PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement) 
+MediaControlInputElement::MediaControlInputElement(Document* doc, PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement, MediaControlElementType displayType) 
     : HTMLInputElement(inputTag, doc)
     , m_mediaElement(mediaElement)
     , m_pseudoStyleId(pseudo)
+    , m_displayType(displayType)
 {
     setInputType(type);
     RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
@@ -145,6 +143,7 @@
 
 void MediaControlInputElement::update()
 {
+    updateDisplayType();
     if (renderer())
         renderer()->updateFromElement();
 }
@@ -165,10 +164,20 @@
     return false;
 }
 
+void MediaControlInputElement::setDisplayType(MediaControlElementType displayType)
+{
+    if (displayType == m_displayType)
+        return;
+
+    m_displayType = displayType;
+    if (RenderObject* o = renderer())
+        o->repaint();
+}
+
 // ----------------------------
 
 MediaControlMuteButtonElement::MediaControlMuteButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_MUTE_BUTTON, "button", element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_MUTE_BUTTON, "button", element, element->muted() ? MediaUnMuteButton : MediaMuteButton)
 {
 }
 
@@ -181,10 +190,15 @@
     HTMLInputElement::defaultEventHandler(event);
 }
 
+void MediaControlMuteButtonElement::updateDisplayType()
+{
+    setDisplayType(m_mediaElement->muted() ? MediaUnMuteButton : MediaMuteButton);
+}
+
 // ----------------------------
 
 MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_PLAY_BUTTON, "button", element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_PLAY_BUTTON, "button", element, element->canPlay() ? MediaPlayButton : MediaPauseButton)
 {
 }
 
@@ -197,10 +211,16 @@
     HTMLInputElement::defaultEventHandler(event);
 }
 
+void MediaControlPlayButtonElement::updateDisplayType()
+{
+    setDisplayType(m_mediaElement->canPlay() ? MediaPlayButton : MediaPauseButton);
+}
+
 // ----------------------------
 
 MediaControlSeekButtonElement::MediaControlSeekButtonElement(Document* doc, HTMLMediaElement* element, bool forward)
-    : MediaControlInputElement(doc, forward ? MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : MEDIA_CONTROLS_SEEK_BACK_BUTTON, "button", element)
+    : MediaControlInputElement(doc, forward ? MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : MEDIA_CONTROLS_SEEK_BACK_BUTTON,
+                               "button", element, forward ? MediaSeekForwardButton : MediaSeekBackButton)
     , m_forward(forward)
     , m_seeking(false)
     , m_capturing(false)
@@ -248,10 +268,9 @@
 
 // ----------------------------
 
-MediaControlTimelineElement::MediaControlTimelineElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_TIMELINE, "range", element)
+MediaControlTimelineElement::MediaControlTimelineElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element, MediaTimelineContainer)
 { 
-    setAttribute(precisionAttr, "float");
 }
 
 void MediaControlTimelineElement::defaultEventHandler(Event* event)
@@ -291,7 +310,7 @@
 // ----------------------------
 
 MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element, MediaFullscreenButton)
 {
 }
 
diff --git a/WebCore/rendering/MediaControlElements.h b/WebCore/rendering/MediaControlElements.h
index fa0fb30..d52d4bc 100644
--- a/WebCore/rendering/MediaControlElements.h
+++ b/WebCore/rendering/MediaControlElements.h
@@ -43,7 +43,7 @@
 class Event;
 class Frame;
 
-enum MediaControlElements {
+enum MediaControlElementType {
     MediaFullscreenButton, MediaMuteButton, MediaPlayButton,
     MediaSeekBackButton, MediaSeekForwardButton, MediaSlider, MediaSliderThumb,
     MediaUnMuteButton, MediaPauseButton, MediaTimelineContainer, MediaCurrentTimeDisplay, 
@@ -88,14 +88,19 @@
 
 class MediaControlInputElement : public HTMLInputElement {
 public:
-    MediaControlInputElement(Document*, PseudoId, const String& type, HTMLMediaElement*);
+    MediaControlInputElement(Document*, PseudoId, const String& type, HTMLMediaElement*, MediaControlElementType);
     void attachToParent(Element*);
     void update();
     void updateStyle();
     bool hitTest(const IntPoint& absPoint);
+
 protected:
+    virtual void updateDisplayType() { }
+    void setDisplayType(MediaControlElementType);
+
     HTMLMediaElement* m_mediaElement;   
     PseudoId m_pseudoStyleId;
+    MediaControlElementType m_displayType;  // some elements can show multiple types (e.g. play/pause)
 };
 
 // ----------------------------
@@ -104,6 +109,7 @@
 public:
     MediaControlMuteButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
+    virtual void updateDisplayType();
 };
 
 // ----------------------------
@@ -112,6 +118,7 @@
 public:
     MediaControlPlayButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
+    virtual void updateDisplayType();
 };
 
 // ----------------------------
diff --git a/WebCore/platform/network/cf/ResourceResponseCFNet.h b/WebCore/rendering/OverlapTestRequestClient.h
similarity index 70%
copy from WebCore/platform/network/cf/ResourceResponseCFNet.h
copy to WebCore/rendering/OverlapTestRequestClient.h
index 27144c6..71400ab 100644
--- a/WebCore/platform/network/cf/ResourceResponseCFNet.h
+++ b/WebCore/rendering/OverlapTestRequestClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,10 +10,10 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef ResourceResponseCFNet_h
-#define ResourceResponseCFNet_h
-
-typedef struct _CFURLResponse* CFURLResponseRef;
+#ifndef OverlapTestRequestClient_h
+#define OverlapTestRequestClient_h
 
 namespace WebCore {
+    
+class OverlapTestRequestClient {
+public:
+    virtual ~OverlapTestRequestClient() { }
+    virtual void setOverlapTestResult(bool) = 0;
+};
 
-    class ResourceResponse;
+} // namespace WebCore
 
-    void getResourceResponse(ResourceResponse& response, CFURLResponseRef cfResponse);
-
-}
-
-#endif // ResourceResponseCFNet_h
+#endif // OverlapTestRequestClient_h
diff --git a/WebCore/rendering/RenderApplet.cpp b/WebCore/rendering/RenderApplet.cpp
index 8a5088a..a989d6f 100644
--- a/WebCore/rendering/RenderApplet.cpp
+++ b/WebCore/rendering/RenderApplet.cpp
@@ -1,8 +1,6 @@
-/**
- * This file is part of the HTML widget for KDE.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2003, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,13 +22,10 @@
 #include "config.h"
 #include "RenderApplet.h"
 
-#include "Document.h"
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "HTMLAppletElement.h"
 #include "HTMLNames.h"
 #include "HTMLParamElement.h"
-#include "Widget.h"
 
 namespace WebCore {
 
@@ -43,23 +38,19 @@
     setInline(true);
 }
 
-RenderApplet::~RenderApplet()
-{
-}
-
 IntSize RenderApplet::intrinsicSize() const
 {
     // FIXME: This doesn't make sense. We can't just start returning
     // a different size once we've created the widget and expect
     // layout and sizing to be correct. We should remove this and
     // pass the appropriate intrinsic size in the constructor.
-    return m_widget ? IntSize(50, 50) : IntSize(150, 150);
+    return widget() ? IntSize(50, 50) : IntSize(150, 150);
 }
 
 void RenderApplet::createWidgetIfNecessary()
 {
     HTMLAppletElement* element = static_cast<HTMLAppletElement*>(node());
-    if (m_widget || !element->isFinishedParsingChildren())
+    if (widget() || !element->isFinishedParsingChildren())
         return;
 
     // FIXME: Java applets can't be resized (this is a bug in Apple's Java implementation).
diff --git a/WebCore/rendering/RenderApplet.h b/WebCore/rendering/RenderApplet.h
index 6746c22..b481d87 100644
--- a/WebCore/rendering/RenderApplet.h
+++ b/WebCore/rendering/RenderApplet.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,8 +32,10 @@
     class RenderApplet : public RenderWidget {
     public:
         RenderApplet(HTMLAppletElement*, const HashMap<String, String>& args);
-        virtual ~RenderApplet();
 
+        void createWidgetIfNecessary();
+
+    private:
         virtual const char* renderName() const { return "RenderApplet"; }
 
         virtual bool isApplet() const { return true; }
@@ -41,9 +43,6 @@
         virtual void layout();
         virtual IntSize intrinsicSize() const;
 
-        void createWidgetIfNecessary();
-
-    private:
         HashMap<String, String> m_args;
     };
 
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index 5b45501..ded093f 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -29,6 +29,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "InlineTextBox.h"
@@ -41,6 +42,7 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "SelectionController.h"
+#include "Settings.h"
 #include <wtf/StdLibExtras.h>
 
 #ifdef ANDROID_LAYOUT
@@ -55,7 +57,7 @@
 
 // Number of pixels to allow as a fudge factor when clicking above or below a line.
 // clicking up to verticalLineClickFudgeFactor pixels above a line will correspond to the closest point on the line.   
-const int verticalLineClickFudgeFactor= 3;
+static const int verticalLineClickFudgeFactor = 3;
 
 using namespace HTMLNames;
 
@@ -753,7 +755,7 @@
 
     m_overflowHeight = 0;
 
-    // We use four values, maxTopPos, maxPosNeg, maxBottomPos, and maxBottomNeg, to track
+    // We use four values, maxTopPos, maxTopNeg, maxBottomPos, and maxBottomNeg, to track
     // our current maximal positive and negative margins.  These values are used when we
     // are collapsed with adjacent blocks, so for example, if you have block A and B
     // collapsing together, then you'd take the maximal positive margin from both A and B
@@ -887,7 +889,7 @@
         if (!repaintRect.isEmpty()) {
             repaintRectangle(repaintRect); // We need to do a partial repaint of our content.
             if (hasReflection())
-                layer()->reflection()->repaintRectangle(repaintRect);
+                repaintRectangle(reflectedRect(repaintRect));
         }
     }
     setNeedsLayout(false);
@@ -948,94 +950,87 @@
     setHeight(height() - marginOffset);
 }
 
-RenderBox* RenderBlock::handleSpecialChild(RenderBox* child, const MarginInfo& marginInfo, bool& handled)
+bool RenderBlock::handleSpecialChild(RenderBox* child, const MarginInfo& marginInfo)
 {
-    // Handle positioned children first.
-    RenderBox* next = handlePositionedChild(child, marginInfo, handled);
-    if (handled) return next;
-    
-    // Handle floating children next.
-    next = handleFloatingChild(child, marginInfo, handled);
-    if (handled) return next;
-
-    // Finally, see if we have a run-in element.
-    return handleRunInChild(child, handled);
+    // Handle in the given order
+    return handlePositionedChild(child, marginInfo)
+        || handleFloatingChild(child, marginInfo)
+        || handleRunInChild(child);
 }
 
 
-RenderBox* RenderBlock::handlePositionedChild(RenderBox* child, const MarginInfo& marginInfo, bool& handled)
+bool RenderBlock::handlePositionedChild(RenderBox* child, const MarginInfo& marginInfo)
 {
     if (child->isPositioned()) {
-        handled = true;
         child->containingBlock()->insertPositionedObject(child);
         adjustPositionedBlock(child, marginInfo);
-        return child->nextSiblingBox();
+        return true;
     }
-
-    return 0;
+    return false;
 }
 
-RenderBox* RenderBlock::handleFloatingChild(RenderBox* child, const MarginInfo& marginInfo, bool& handled)
+bool RenderBlock::handleFloatingChild(RenderBox* child, const MarginInfo& marginInfo)
 {
     if (child->isFloating()) {
-        handled = true;
         insertFloatingObject(child);
         adjustFloatingBlock(marginInfo);
-        return child->nextSiblingBox();
+        return true;
     }
-    
-    return 0;
+    return false;
 }
 
-RenderBox* RenderBlock::handleRunInChild(RenderBox* child, bool& handled)
+bool RenderBlock::handleRunInChild(RenderBox* child)
 {
     // See if we have a run-in element with inline children.  If the
     // children aren't inline, then just treat the run-in as a normal
     // block.
-    if (child->isRunIn() && (child->childrenInline() || child->isReplaced())) {
-        RenderBlock* blockRunIn = toRenderBlock(child);
-        // Get the next non-positioned/non-floating RenderBlock.
-        RenderObject* curr = blockRunIn->nextSibling();
-        while (curr && curr->isFloatingOrPositioned())
-            curr = curr->nextSibling();
-        if (curr && (curr->isRenderBlock() && curr->childrenInline() && !curr->isRunIn())) {
-            RenderBlock* currBlock = toRenderBlock(curr);
-        
-            // The block acts like an inline, so just null out its
-            // position.
-            handled = true;
-            
-            // Remove the old child.
-            RenderBox* next = blockRunIn->nextSiblingBox();
-            children()->removeChildNode(this, blockRunIn);
+    if (!child->isRunIn() || !child->childrenInline() && !child->isReplaced())
+        return false;
 
-            // Create an inline.
-            RenderInline* inlineRunIn = new (renderArena()) RenderInline(blockRunIn->node());
-            inlineRunIn->setStyle(blockRunIn->style());
+    RenderBlock* blockRunIn = toRenderBlock(child);
+    // Get the next non-positioned/non-floating RenderBlock.
+    RenderObject* curr = blockRunIn->nextSibling();
+    while (curr && curr->isFloatingOrPositioned())
+        curr = curr->nextSibling();
 
-            // Move the nodes from the old child to the new child, but skip any :before/:after content.  It has already
-            // been regenerated by the new inline.
-            for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild; runInChild = runInChild->nextSibling()) {
-                if (runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER) {
-                    blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false);
-                    inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
-                }
-            }
+    if (!curr || !curr->isRenderBlock() || !curr->childrenInline() || curr->isRunIn())
+        return false;
 
-            // Now insert the new child under |currBlock|.
-            currBlock->children()->insertChildNode(currBlock, inlineRunIn, currBlock->firstChild());
-            
-            // If the run-in had an element, we need to set the new renderer.
-            if (blockRunIn->node())
-                blockRunIn->node()->setRenderer(inlineRunIn);
-            
-            // Destroy the block run-in.
-            blockRunIn->destroy();
+    RenderBlock* currBlock = toRenderBlock(curr);
 
-            return next;
+    // Remove the old child.
+    children()->removeChildNode(this, blockRunIn);
+
+    // Create an inline.
+    Node* runInNode = blockRunIn->node();
+    RenderInline* inlineRunIn = new (renderArena()) RenderInline(runInNode ? runInNode : document());
+    inlineRunIn->setStyle(blockRunIn->style());
+
+    bool runInIsGenerated = child->style()->styleType() == BEFORE || child->style()->styleType() == AFTER;
+
+    // Move the nodes from the old child to the new child, but skip any :before/:after content.  It has already
+    // been regenerated by the new inline.
+    for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild; runInChild = runInChild->nextSibling()) {
+        if (runInIsGenerated || runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER) {
+            blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false);
+            inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
         }
     }
-    return 0;
+
+    // Now insert the new child under |currBlock|.
+    currBlock->children()->insertChildNode(currBlock, inlineRunIn, currBlock->firstChild());
+    
+    // If the run-in had an element, we need to set the new renderer.
+    if (runInNode)
+        runInNode->setRenderer(inlineRunIn);
+
+    // Destroy the block run-in.
+    blockRunIn->destroy();
+
+    // The block acts like an inline, so just null out its
+    // position.
+    
+    return true;
 }
 
 int RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
@@ -1320,12 +1315,14 @@
     int previousFloatBottom = 0;
     maxFloatBottom = 0;
 
-    RenderBox* child = firstChildBox();
-    while (child) {
-        if (legend == child) {
-            child = child->nextSiblingBox();
+    RenderBox* next = firstChildBox();
+
+    while (next) {
+        RenderBox* child = next;
+        next = child->nextSiblingBox();
+
+        if (legend == child)
             continue; // Skip the legend, since it has already been positioned up in the fieldset's border.
-        }
 
         int oldTopPosMargin = maxTopPosMargin();
         int oldTopNegMargin = maxTopNegMargin();
@@ -1342,12 +1339,8 @@
 
         // Handle the four types of special elements first.  These include positioned content, floating content, compacts and
         // run-ins.  When we encounter these four types of objects, we don't actually lay them out as normal flow blocks.
-        bool handled = false;
-        RenderBox* next = handleSpecialChild(child, marginInfo, handled);
-        if (handled) {
-            child = next;
+        if (handleSpecialChild(child, marginInfo))
             continue;
-        }
 
         // The child is a normal flow object.  Compute its vertical margins now.
         child->calcVerticalMargins();
@@ -1439,11 +1432,14 @@
         if (child->isBlockFlow() && toRenderBlock(child)->containsFloats())
             maxFloatBottom = max(maxFloatBottom, addOverhangingFloats(toRenderBlock(child), -child->x(), -child->y(), !childNeededLayout));
 
-        // Update our overflow in case the child spills out the block.
-        m_overflowTop = min(m_overflowTop, child->y() + child->overflowTop(false));
-        m_overflowHeight = max(m_overflowHeight, height() + child->overflowHeight(false) - child->height());
-        m_overflowWidth = max(child->x() + child->overflowWidth(false), m_overflowWidth);
-        m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
+        // Update our visual overflow in case the child spills out the block, but only if we were going to paint
+        // the child block ourselves.
+        if (!child->hasSelfPaintingLayer()) {
+            m_overflowTop = min(m_overflowTop, child->y() + child->overflowTop(false));
+            m_overflowHeight = max(m_overflowHeight, height() + child->overflowHeight(false) - child->height());
+            m_overflowWidth = max(child->x() + child->overflowWidth(false), m_overflowWidth);
+            m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
+        }
 
         IntSize childOffset(child->x() - oldRect.x(), child->y() - oldRect.y());
         if (childOffset.width() || childOffset.height()) {
@@ -1460,7 +1456,6 @@
             child->repaint();
 
         ASSERT(oldLayoutDelta == view()->layoutDelta());
-        child = child->nextSiblingBox();
     }
 
     // Now do the handling of the bottom of the block, adding in our bottom border/padding and
@@ -1736,9 +1731,10 @@
 {
     SelectionController* selection = type == CursorCaret ? document()->frame()->selection() : document()->frame()->dragCaretController();
 
-    // Ask the SelectionController if the caret should be painted by this block
+    // Paint the caret if the SelectionController says so or if caret browsing is enabled
+    bool caretBrowsing = document()->frame()->settings() && document()->frame()->settings()->caretBrowsingEnabled();
     RenderObject* caretPainter = selection->caretRenderer();
-    if (caretPainter == this && selection->isContentEditable()) {
+    if (caretPainter == this && (selection->isContentEditable() || caretBrowsing)) {
         // Convert the painting offset into the local coordinate system of this renderer,
         // to match the localCaretRect computed by the SelectionController
         offsetForContents(tx, ty);
@@ -2008,6 +2004,7 @@
     }
 }
 
+#ifndef BUILDING_ON_TIGER
 static void clipOutPositionedObjects(const RenderObject::PaintInfo* paintInfo, int tx, int ty, ListHashSet<RenderBox*>* positionedObjects)
 {
     if (!positionedObjects)
@@ -2019,10 +2016,12 @@
         paintInfo->context->clipOut(IntRect(tx + r->x(), ty + r->y(), r->width(), r->height()));
     }
 }
+#endif
 
 GapRects RenderBlock::fillSelectionGaps(RenderBlock* rootBlock, int blockX, int blockY, int tx, int ty,
                                         int& lastTop, int& lastLeft, int& lastRight, const PaintInfo* paintInfo)
 {
+#ifndef BUILDING_ON_TIGER
     // IMPORTANT: Callers of this method that intend for painting to happen need to do a save/restore.
     // Clip out floating and positioned objects when painting selection gaps.
     if (paintInfo) {
@@ -2040,6 +2039,7 @@
             }
         }
     }
+#endif
 
     // FIXME: overflow: auto/scroll regions need more math here, since painting in the border box is different from painting in the padding box (one is scrolled, the other is
     // fixed).
@@ -2690,6 +2690,8 @@
         // For now, we have to descend into all the children, since we may have a huge abs div inside
         // a tiny rel div buried somewhere deep in our child tree.  In this case we have to get to
         // the abs div.
+        // See the last test case in https://bugs.webkit.org/show_bug.cgi?id=9314 for why this is a problem.
+        // For inline children, we miss relative positioned boxes that might be buried inside <span>s.
         for (RenderObject* c = firstChild(); c; c = c->nextSibling()) {
             if (!c->isFloatingOrPositioned() && c->isBox()) {
                 RenderBox* childBox = toRenderBox(c);
@@ -2746,11 +2748,11 @@
     }
 
     if (!includeSelf) {
-        bottom = max(bottom, borderTop() + paddingTop() + paddingBottom());
+        bottom = max(bottom, borderTop() + paddingTop() + paddingBottom() + relativeOffset);
         if (childrenInline()) {
             if (lastLineBox()) {
                 int childBottomEdge = lastLineBox()->y() + lastLineBox()->height();
-                bottom = max(bottom, childBottomEdge + paddingBottom());
+                bottom = max(bottom, childBottomEdge + paddingBottom() + relativeOffset);
             }
         } else {
             // Find the last normal flow child.
@@ -2759,7 +2761,7 @@
                 currBox = currBox->previousSiblingBox();
             if (currBox) {
                 int childBottomEdge = currBox->y() + currBox->height() + currBox->collapsedMarginBottom();
-                bottom = max(bottom, childBottomEdge + paddingBottom());
+                bottom = max(bottom, childBottomEdge + paddingBottom() + relativeOffset);
             }
         }
     }
@@ -2836,7 +2838,7 @@
     }
 
     if (!includeSelf) {
-        right = max(right, borderLeft() + paddingLeft() + paddingRight());
+        right = max(right, borderLeft() + paddingLeft() + paddingRight() + relativeOffset);
         if (childrenInline()) {
             for (InlineRunBox* currBox = firstLineBox(); currBox; currBox = currBox->nextLineBox()) {
                 int childRightEdge = currBox->x() + currBox->width();
@@ -2845,7 +2847,7 @@
                 // FIXME: Need to find another way to do this, since scrollbars could show when we don't want them to.
                 if (node() && node()->isContentEditable() && node() == node()->rootEditableElement() && style()->direction() == LTR && !paddingRight())
                     childRightEdge += 1;
-                right = max(right, childRightEdge + paddingRight());
+                right = max(right, childRightEdge + paddingRight() + relativeOffset);
             }
         } else {
             // Walk all normal flow children.
@@ -2853,7 +2855,7 @@
                 if (currBox->isFloatingOrPositioned())
                     continue;
                 int childRightEdge = currBox->x() + currBox->width() + currBox->marginRight();
-                right = max(right, childRightEdge + paddingRight());
+                right = max(right, childRightEdge + paddingRight() + relativeOffset);
             }
         }
     }
@@ -2930,7 +2932,7 @@
 
     if (!includeSelf && firstLineBox()) {
         for (InlineRunBox* currBox = firstLineBox(); currBox; currBox = currBox->nextLineBox())
-            left = min(left, (int)currBox->x());
+            left = min(left, (int)currBox->x() + relativeOffset);
     }
     
     return left;
@@ -3439,17 +3441,16 @@
 }
 
 // FIXME: This function should go on RenderObject as an instance method. Then
-// all cases in which positionForCoordinates recurs could call this instead to
+// all cases in which positionForPoint recurs could call this instead to
 // prevent crossing editable boundaries. This would require many tests.
-static VisiblePosition positionForPointRespectingEditingBoundaries(RenderBox* parent, RenderBox* child, const IntPoint& parentCoords)
+static VisiblePosition positionForPointRespectingEditingBoundaries(RenderBox* parent, RenderBox* child, const IntPoint& pointInParentCoordinates)
 {
-    int xInChildCoords = parentCoords.x() - child->x();
-    int yInChildCoords = parentCoords.y() - child->y();
+    IntPoint pointInChildCoordinates(pointInParentCoordinates - child->location());
 
     // If this is an anonymous renderer, we just recur normally
     Node* childNode = child->node();
     if (!childNode)
-        return child->positionForCoordinates(xInChildCoords, yInChildCoords);
+        return child->positionForPoint(pointInChildCoordinates);
 
     // Otherwise, first make sure that the editability of the parent and child agree.
     // If they don't agree, then we return a visible position just before or after the child
@@ -3459,54 +3460,84 @@
 
     // If we can't find an ancestor to check editability on, or editability is unchanged, we recur like normal
     if (!ancestor || ancestor->node()->isContentEditable() == childNode->isContentEditable())
-        return child->positionForCoordinates(xInChildCoords, yInChildCoords);
+        return child->positionForPoint(pointInChildCoordinates);
 
     // Otherwise return before or after the child, depending on if the click was left or right of the child
     int childMidX = child->width() / 2;
-    if (xInChildCoords < childMidX)
+    if (pointInChildCoordinates.x() < childMidX)
         return ancestor->createVisiblePosition(childNode->nodeIndex(), DOWNSTREAM);
     return ancestor->createVisiblePosition(childNode->nodeIndex() + 1, UPSTREAM);
 }
 
-static VisiblePosition positionForPointWithInlineChildren(RenderBlock* block, const IntPoint& pointInContents)
+VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint& pointInContents)
 {
-    ASSERT(block->childrenInline());
+    ASSERT(childrenInline());
 
-    if (!block->firstRootBox())
-        return block->createVisiblePosition(0, DOWNSTREAM);
+    if (!firstRootBox())
+        return createVisiblePosition(0, DOWNSTREAM);
 
-    InlineBox* closestBox = 0;
     // look for the closest line box in the root box which is at the passed-in y coordinate
-    for (RootInlineBox* root = block->firstRootBox(); root; root = root->nextRootBox()) {
-        int bottom;
+    InlineBox* closestBox = 0;
+    RootInlineBox* firstRootBoxWithChildren = 0;
+    RootInlineBox* lastRootBoxWithChildren = 0;
+    for (RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox()) {
+        if (!root->firstChild())
+            continue;
+        if (!firstRootBoxWithChildren)
+            firstRootBoxWithChildren = root;
+        lastRootBoxWithChildren = root;
+
         // set the bottom based on whether there is a next root box
-        if (root->nextRootBox())
-            // FIXME: make the break point halfway between the bottom of the previous root box and the top of the next root box
+        // FIXME: This will consider nextRootBox even if it has no children, and maybe it shouldn't.
+        int bottom;
+        if (root->nextRootBox()) {
+            // FIXME: We would prefer to make the break point halfway between the bottom
+            // of the previous root box and the top of the next root box.
             bottom = root->nextRootBox()->topOverflow();
-        else
+        } else
             bottom = root->bottomOverflow() + verticalLineClickFudgeFactor;
+
         // check if this root line box is located at this y coordinate
-        if (pointInContents.y() < bottom && root->firstChild()) {
+        if (pointInContents.y() < bottom) {
             closestBox = root->closestLeafChildForXPos(pointInContents.x());
             if (closestBox)
-                // pass the box a y position that is inside it
                 break;
         }
     }
 
-    // y coordinate is below last root line box, pretend we hit it
-    if (!closestBox)
-        closestBox = block->lastRootBox()->closestLeafChildForXPos(pointInContents.x());
+    Settings* settings = document()->settings();
+    bool useWindowsBehavior = settings && settings->editingBehavior() == EditingWindowsBehavior;
 
-    if (closestBox) {
-        // pass the box a y position that is inside it
-        return closestBox->renderer()->positionForCoordinates(pointInContents.x(), closestBox->m_y);
+    if (useWindowsBehavior && !closestBox && lastRootBoxWithChildren) {
+        // y coordinate is below last root line box, pretend we hit it
+        closestBox = lastRootBoxWithChildren->closestLeafChildForXPos(pointInContents.x());
     }
 
-    // Can't reach this.  We have a root line box, but it has no kids.
+    if (closestBox) {
+        if (!useWindowsBehavior && pointInContents.y() < firstRootBoxWithChildren->topOverflow() - verticalLineClickFudgeFactor) {
+            // y coordinate is above first root line box, so return the start of the first
+            return VisiblePosition(positionForBox(firstRootBoxWithChildren->firstLeafChild(), true), DOWNSTREAM);
+        }
+
+        // pass the box a y position that is inside it
+        return closestBox->renderer()->positionForPoint(IntPoint(pointInContents.x(), closestBox->m_y));
+    }
+
+    if (lastRootBoxWithChildren) {
+        // We hit this case for Mac behavior when the Y coordinate is below the last box.
+        ASSERT(!useWindowsBehavior);
+        return VisiblePosition(positionForBox(lastRootBoxWithChildren->lastLeafChild(), false), DOWNSTREAM);
+    }
+
+    // Can't reach this. We have a root line box, but it has no kids.
     // FIXME: This should ASSERT_NOT_REACHED(), but clicking on placeholder text
-    // seems to hit this codepath.
-    return block->createVisiblePosition(0, DOWNSTREAM);
+    // seems to hit this code path.
+    return createVisiblePosition(0, DOWNSTREAM);
+}
+
+static inline bool isChildHitTestCandidate(RenderBox* box)
+{
+    return box->height() && box->style()->visibility() == VISIBLE && !box->isFloatingOrPositioned();
 }
 
 VisiblePosition RenderBlock::positionForPoint(const IntPoint& point)
@@ -3514,11 +3545,6 @@
     if (isTable())
         return RenderBox::positionForPoint(point);
 
-    int contentsX = point.x();
-    int contentsY = point.y();
-    offsetForContents(contentsX, contentsY);
-    IntPoint pointInContents(contentsX, contentsY);
-
     if (isReplaced()) {
         if (point.y() < 0 || (point.y() < height() && point.x() < 0))
             return createVisiblePosition(caretMinOffset(), DOWNSTREAM);
@@ -3526,27 +3552,28 @@
             return createVisiblePosition(caretMaxOffset(), DOWNSTREAM);
     } 
 
-    if (childrenInline()) {
-        return positionForPointWithInlineChildren(this, pointInContents);
+    int contentsX = point.x();
+    int contentsY = point.y();
+    offsetForContents(contentsX, contentsY);
+    IntPoint pointInContents(contentsX, contentsY);
+
+    if (childrenInline())
+        return positionForPointWithInlineChildren(pointInContents);
+
+    if (lastChildBox() && contentsY > lastChildBox()->y()) {
+        for (RenderBox* childBox = lastChildBox(); childBox; childBox = childBox->previousSiblingBox()) {
+            if (isChildHitTestCandidate(childBox))
+                return positionForPointRespectingEditingBoundaries(this, childBox, pointInContents);
+        }
+    } else {
+        for (RenderBox* childBox = firstChildBox(); childBox; childBox = childBox->nextSiblingBox()) {
+            // We hit child if our click is above the bottom of its padding box (like IE6/7 and FF3).
+            if (isChildHitTestCandidate(childBox) && contentsY < childBox->frameRect().bottom())
+                return positionForPointRespectingEditingBoundaries(this, childBox, pointInContents);
+        }
     }
 
-    // Check top/bottom child-margin/parent-padding for clicks and place them in the first/last child
-    // FIXME: This will not correctly handle first or last children being positioned or non-visible
-    if (firstChildBox() && contentsY < firstChildBox()->y())
-        return positionForPointRespectingEditingBoundaries(this, firstChildBox(), pointInContents);
-    if (lastChildBox() && contentsY > lastChildBox()->y())
-        return positionForPointRespectingEditingBoundaries(this, lastChildBox(), pointInContents);
-
-    for (RenderBox* childBox = firstChildBox(); childBox; childBox = childBox->nextSiblingBox()) {
-        if (childBox->height() == 0 || childBox->style()->visibility() != VISIBLE || childBox->isFloatingOrPositioned())
-            continue;
-        // We hit this child if our click was above the bottom of its padding box (like IE6/7 and FF3)
-        if (contentsY < childBox->y() + childBox->height())
-            return positionForPointRespectingEditingBoundaries(this, childBox, pointInContents);
-    }
-
-    // We only get here if there are no, or only floated/positioned, or only
-    // non-visible block children below the click.
+    // We only get here if there are no hit test candidate children below the click.
     return RenderBox::positionForPoint(point);
 }
 
@@ -4834,31 +4861,31 @@
     m_maxMargin->m_bottomNeg = neg;
 }
 
-void RenderBlock::absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel)
+void RenderBlock::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 {
     // For blocks inside inlines, we go ahead and include margins so that we run right up to the
     // inline boxes above and below us (thus getting merged with them to form a single irregular
     // shape).
-    if (topLevel && inlineContinuation()) {
+    if (inlineContinuation()) {
         rects.append(IntRect(tx, ty - collapsedMarginTop(),
                              width(), height() + collapsedMarginTop() + collapsedMarginBottom()));
         inlineContinuation()->absoluteRects(rects,
                                             tx - x() + inlineContinuation()->containingBlock()->x(),
-                                            ty - y() + inlineContinuation()->containingBlock()->y(), topLevel);
+                                            ty - y() + inlineContinuation()->containingBlock()->y());
     } else
         rects.append(IntRect(tx, ty, width(), height()));
 }
 
-void RenderBlock::absoluteQuads(Vector<FloatQuad>& quads, bool topLevel)
+void RenderBlock::absoluteQuads(Vector<FloatQuad>& quads)
 {
     // For blocks inside inlines, we go ahead and include margins so that we run right up to the
     // inline boxes above and below us (thus getting merged with them to form a single irregular
     // shape).
-    if (topLevel && inlineContinuation()) {
+    if (inlineContinuation()) {
         FloatRect localRect(0, -collapsedMarginTop(),
                             width(), height() + collapsedMarginTop() + collapsedMarginBottom());
         quads.append(localToAbsoluteQuad(localRect));
-        inlineContinuation()->absoluteQuads(quads, topLevel);
+        inlineContinuation()->absoluteQuads(quads);
     } else
         quads.append(RenderBox::localToAbsoluteQuad(FloatRect(0, 0, width(), height())));
 }
@@ -4966,7 +4993,7 @@
             x = (x + w - (borderRight() + paddingRight())) / 2;
             break;
         case alignRight:
-            x = w - (borderRight() + paddingRight());
+            x = w - (borderRight() + paddingRight()) - caretWidth;
             break;
     }
 
diff --git a/WebCore/rendering/RenderBlock.h b/WebCore/rendering/RenderBlock.h
index d7a26ef..f313b3d 100644
--- a/WebCore/rendering/RenderBlock.h
+++ b/WebCore/rendering/RenderBlock.h
@@ -35,11 +35,12 @@
 namespace WebCore {
 
 class InlineIterator;
-class BidiRun;
 class Position;
 class RenderInline;
 class RootInlineBox;
 
+struct BidiRun;
+
 template <class Iterator, class Run> class BidiResolver;
 typedef BidiResolver<InlineIterator, BidiRun> InlineBidiResolver;
 
@@ -293,8 +294,8 @@
     int leftSelectionOffset(RenderBlock* rootBlock, int y);
     int rightSelectionOffset(RenderBlock* rootBlock, int y);
 
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
 
     // Helper methods for computing line counts and heights for line counts.
     RootInlineBox* lineAtIndex(int);
@@ -343,6 +344,7 @@
 private:
     Position positionForBox(InlineBox*, bool start = true) const;
     Position positionForRenderer(RenderObject*, bool start = true) const;
+    VisiblePosition positionForPointWithInlineChildren(const IntPoint&);
 
     // Adjust tx and ty from painting offsets to the local coords of this renderer
     void offsetForContents(int& tx, int& ty) const;
@@ -451,10 +453,10 @@
 
     void adjustPositionedBlock(RenderBox* child, const MarginInfo&);
     void adjustFloatingBlock(const MarginInfo&);
-    RenderBox* handleSpecialChild(RenderBox* child, const MarginInfo&, bool& handled);
-    RenderBox* handleFloatingChild(RenderBox* child, const MarginInfo&, bool& handled);
-    RenderBox* handlePositionedChild(RenderBox* child, const MarginInfo&, bool& handled);
-    RenderBox* handleRunInChild(RenderBox* child, bool& handled);
+    bool handleSpecialChild(RenderBox* child, const MarginInfo&);
+    bool handleFloatingChild(RenderBox* child, const MarginInfo&);
+    bool handlePositionedChild(RenderBox* child, const MarginInfo&);
+    bool handleRunInChild(RenderBox* child);
     int collapseMargins(RenderBox* child, MarginInfo&);
     int clearFloatsIfNeeded(RenderBox* child, MarginInfo&, int oldTopPosMargin, int oldTopNegMargin, int yPos);
     int estimateVerticalPosition(RenderBox* child, const MarginInfo&);
diff --git a/WebCore/rendering/RenderBox.cpp b/WebCore/rendering/RenderBox.cpp
index 5827f00..9eb5898 100644
--- a/WebCore/rendering/RenderBox.cpp
+++ b/WebCore/rendering/RenderBox.cpp
@@ -138,44 +138,15 @@
         if (diff >= StyleDifferenceRepaint && node() &&
                 (node()->hasTagName(htmlTag) || node()->hasTagName(bodyTag)))
             view()->repaint();
-        else if (parent() && !isText()) {
-            // Do a repaint with the old style first, e.g., for example if we go from
-            // having an outline to not having an outline.
-            if (diff == StyleDifferenceRepaintLayer) {
-                layer()->repaintIncludingDescendants();
-                if (!(style()->clip() == newStyle->clip()))
-                    layer()->clearClipRectsIncludingDescendants();
-            } else if (diff == StyleDifferenceRepaint || newStyle->outlineSize() < style()->outlineSize())
-                repaint();
-        }
-
-        if (diff == StyleDifferenceLayout) {
-            // When a layout hint happens, we go ahead and do a repaint of the layer, since the layer could
-            // end up being destroyed.
-            if (hasLayer()) {
-                if (style()->position() != newStyle->position() ||
-                    style()->zIndex() != newStyle->zIndex() ||
-                    style()->hasAutoZIndex() != newStyle->hasAutoZIndex() ||
-                    !(style()->clip() == newStyle->clip()) ||
-                    style()->hasClip() != newStyle->hasClip() ||
-                    style()->opacity() != newStyle->opacity() ||
-                    style()->transform() != newStyle->transform())
-                layer()->repaintIncludingDescendants();
-            } else if (newStyle->hasTransform() || newStyle->opacity() < 1) {
-                // If we don't have a layer yet, but we are going to get one because of transform or opacity,
-                //  then we need to repaint the old position of the object.
-                repaint();
-            }
         
-            // When a layout hint happens and an object's position style changes, we have to do a layout
-            // to dirty the render tree using the old position value now.
-            if (parent() && style()->position() != newStyle->position()) {
-                markContainingBlocksForLayout();
-                if (style()->position() == StaticPosition)
-                    repaint();
-                if (isFloating() && !isPositioned() && (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition))
-                    removeFloatingOrPositionedChildFromBlockLists();
-            }
+        // When a layout hint happens and an object's position style changes, we have to do a layout
+        // to dirty the render tree using the old position value now.
+        if (diff == StyleDifferenceLayout && parent() && style()->position() != newStyle->position()) {
+            markContainingBlocksForLayout();
+            if (style()->position() == StaticPosition)
+                repaint();
+            if (isFloating() && !isPositioned() && (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition))
+                removeFloatingOrPositionedChildFromBlockLists();
         }
     }
 
@@ -323,12 +294,12 @@
         layer()->scrollToYOffset(newTop);
 }
 
-void RenderBox::absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool)
+void RenderBox::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 {
     rects.append(IntRect(tx, ty, width(), height()));
 }
 
-void RenderBox::absoluteQuads(Vector<FloatQuad>& quads, bool)
+void RenderBox::absoluteQuads(Vector<FloatQuad>& quads)
 {
     quads.append(localToAbsoluteQuad(FloatRect(0, 0, width(), height())));
 }
@@ -347,14 +318,13 @@
     return localToAbsoluteQuad(FloatRect(rect));
 }
 
-
-IntRect RenderBox::outlineBoundsForRepaint(RenderBoxModelObject* /*repaintContainer*/) const
+IntRect RenderBox::outlineBoundsForRepaint(RenderBoxModelObject* repaintContainer) const
 {
     IntRect box = borderBoundingBox();
     adjustRectForOutlineAndShadow(box);
 
-    FloatQuad absOutlineQuad = localToAbsoluteQuad(FloatRect(box));
-    box = absOutlineQuad.enclosingBoundingBox();
+    FloatQuad containerRelativeQuad = localToContainerQuad(FloatRect(box), repaintContainer);
+    box = containerRelativeQuad.enclosingBoundingBox();
 
     // FIXME: layoutDelta needs to be applied in parts before/after transforms and
     // repaint containers. https://bugs.webkit.org/show_bug.cgi?id=23308
@@ -699,13 +669,24 @@
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
     StyleImage* maskBoxImage = style()->maskBoxImage().image();
-    if ((maskBoxImage && style()->maskLayers()->hasImage()) || style()->maskLayers()->next())
+    if (maskBoxImage && style()->maskLayers()->hasImage()) {
+        pushTransparencyLayer = true;
+    } else {
         // We have to use an extra image buffer to hold the mask. Multiple mask images need
         // to composite together using source-over so that they can then combine into a single unified mask that
         // can be composited with the content using destination-in.  SVG images need to be able to set compositing modes
         // as they draw images contained inside their sub-document, so we paint all our images into a separate buffer
         // and composite that buffer as the mask.
-        pushTransparencyLayer = true;
+        // We have to check that the mask images to be rendered contain at least one image that can be actually used in rendering
+        // before pushing the transparency layer.
+        for (const FillLayer* fillLayer = style()->maskLayers()->next(); fillLayer; fillLayer = fillLayer->next()) {
+            if (fillLayer->hasImage() && fillLayer->image()->canRender(style()->effectiveZoom())) {
+                pushTransparencyLayer = true;
+                // We found one image that can be used in rendering, exit the loop
+                break;
+            }
+        }
+    }
     
     CompositeOperator compositeOp = CompositeDestinationIn;
     if (pushTransparencyLayer) {
@@ -863,13 +844,15 @@
     }
     IntRect clipRect(isControlClip ? controlClipRect(tx, ty) : overflowClipRect(tx, ty));
     paintInfo.context->save();
-    if (style()->hasBorderRadius())
-        paintInfo.context->addRoundedRectClip(clipRect, style()->borderTopLeftRadius(),
-                                              style()->borderTopRightRadius(), 
-                                              style()->borderBottomLeftRadius(),
-                                              style()->borderBottomRightRadius());
-    else
-        paintInfo.context->clip(clipRect);
+    if (style()->hasBorderRadius()) {
+        IntSize topLeft, topRight, bottomLeft, bottomRight;
+        IntRect borderRect = IntRect(tx, ty, width(), height());
+        style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+
+        paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+    }
+    
+    paintInfo.context->clip(clipRect);
     return true;
 }
 
@@ -950,7 +933,7 @@
         return;
 
     if (RenderView* v = view()) {
-        if (v->layoutStateEnabled()) {
+        if (v->layoutStateEnabled() && !repaintContainer) {
             LayoutState* layoutState = v->layoutState();
             IntSize offset = layoutState->m_offset;
             offset.expand(x(), y());
@@ -975,10 +958,12 @@
     IntSize containerOffset = offsetFromContainer(o);
 
     bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
-    if (useTransforms && hasTransform)
-        transformState.applyTransform(transformFromContainer(o, containerOffset), preserve3D);
-    else
-        transformState.move(containerOffset.width(), containerOffset.height(), preserve3D);
+    if (useTransforms && shouldUseTransformFromContainer(o)) {
+        TransformationMatrix t;
+        getTransformFromContainer(o, containerOffset, t);
+        transformState.applyTransform(t, preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+    } else
+        transformState.move(containerOffset.width(), containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
 
     o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
 }
@@ -1004,10 +989,12 @@
     IntSize containerOffset = offsetFromContainer(o);
 
     bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
-    if (useTransforms && hasTransform)
-        transformState.applyTransform(transformFromContainer(o, containerOffset), preserve3D);
-    else
-        transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D);
+    if (useTransforms && shouldUseTransformFromContainer(o)) {
+        TransformationMatrix t;
+        getTransformFromContainer(o, containerOffset, t);
+        transformState.applyTransform(t, preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+    } else
+        transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
 }
 
 IntSize RenderBox::offsetFromContainer(RenderObject* o) const
@@ -1129,6 +1116,10 @@
         // LayoutState is only valid for root-relative repainting
         if (v->layoutStateEnabled() && !repaintContainer) {
             LayoutState* layoutState = v->layoutState();
+
+            if (layer() && layer()->transform())
+                rect = layer()->transform()->mapRect(rect);
+
             if (style()->position() == RelativePosition && layer())
                 rect.move(layer()->relativePositionOffset());
 
@@ -1444,6 +1435,7 @@
     if (isTableCell() || (isInline() && !isReplaced()))
         return;
 
+    Length h;
     if (isPositioned())
         calcAbsoluteVertical();
     else {
@@ -1453,7 +1445,6 @@
         if (isTable())
             return;
 
-        Length h;
         bool inHorizontalBox = parent()->isFlexibleBox() && parent()->style()->boxOrient() == HORIZONTAL;
         bool stretching = parent()->style()->boxAlign() == BSTRETCH;
         bool treatAsReplaced = shouldCalculateSizeAsReplaced() && (!inHorizontalBox || !stretching);
@@ -1496,21 +1487,26 @@
                 maxH = heightResult;
             heightResult = min(maxH, heightResult);
             heightResult = max(minH, heightResult);
-        } else
+        } else {
             // The only times we don't check min/max height are when a fixed length has
             // been given as an override.  Just use that.  The value has already been adjusted
             // for box-sizing.
             heightResult = h.value() + borderTop() + borderBottom() + paddingTop() + paddingBottom();
-
-            setHeight(heightResult);
         }
 
+        setHeight(heightResult);
+    }
+
     // WinIE quirk: The <html> block always fills the entire canvas in quirks mode.  The <body> always fills the
     // <html> block in quirks mode.  Only apply this quirk if the block is normal flow and no height
-    // is specified.
-    if (stretchesToViewHeight() && !document()->printing()) {
+    // is specified. When we're printing, we also need this quirk if the body or root has a percentage 
+    // height since we don't set a height in RenderView when we're printing. So without this quirk, the 
+    // height has nothing to be a percentage of, and it ends up being 0. That is bad.
+    bool printingNeedsBaseHeight = document()->printing() && h.isPercent()
+        && (isRoot() || isBody() && document()->documentElement()->renderer()->style()->height().isPercent());
+    if (stretchesToViewHeight() || printingNeedsBaseHeight) {
         int margins = collapsedMarginTop() + collapsedMarginBottom();
-        int visHeight = view()->viewHeight();
+        int visHeight = document()->printing() ? view()->frameView()->visibleHeight() : view()->viewHeight();
         if (isRoot())
             setHeight(max(height(), visHeight - margins));
         else {
diff --git a/WebCore/rendering/RenderBox.h b/WebCore/rendering/RenderBox.h
index 182d4e3..ba96f01 100644
--- a/WebCore/rendering/RenderBox.h
+++ b/WebCore/rendering/RenderBox.h
@@ -135,8 +135,8 @@
     virtual int maxTopMargin(bool positive) const { return positive ? std::max(0, marginTop()) : -std::min(0, marginTop()); }
     virtual int maxBottomMargin(bool positive) const { return positive ? std::max(0, marginBottom()) : -std::min(0, marginBottom()); }
 
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
     
     IntRect reflectionBox() const;
     int reflectionOffset() const;
diff --git a/WebCore/rendering/RenderBoxModelObject.cpp b/WebCore/rendering/RenderBoxModelObject.cpp
index c79da7b..7ad1a5e 100644
--- a/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/WebCore/rendering/RenderBoxModelObject.cpp
@@ -41,6 +41,8 @@
 using namespace HTMLNames;
 
 bool RenderBoxModelObject::s_wasFloating = false;
+bool RenderBoxModelObject::s_hadLayer = false;
+bool RenderBoxModelObject::s_layerWasSelfPainting = false;
 
 RenderBoxModelObject::RenderBoxModelObject(Node* node)
     : RenderObject(node)
@@ -57,11 +59,10 @@
 
 void RenderBoxModelObject::destroyLayer()
 {
-    ASSERT(hasLayer());
+    ASSERT(!hasLayer()); // Callers should have already called setHasLayer(false)
     ASSERT(m_layer);
     m_layer->destroy(renderArena());
     m_layer = 0;
-    setHasLayer(false);
 }
 
 void RenderBoxModelObject::destroy()
@@ -82,10 +83,43 @@
 void RenderBoxModelObject::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
     s_wasFloating = isFloating();
+    s_hadLayer = hasLayer();
+    if (s_hadLayer)
+        s_layerWasSelfPainting = layer()->isSelfPaintingLayer();
 
     // If our z-index changes value or our visibility changes,
     // we need to dirty our stacking context's z-order list.
     if (style() && newStyle) {
+        if (parent()) {
+            // Do a repaint with the old style first, e.g., for example if we go from
+            // having an outline to not having an outline.
+            if (diff == StyleDifferenceRepaintLayer) {
+                layer()->repaintIncludingDescendants();
+                if (!(style()->clip() == newStyle->clip()))
+                    layer()->clearClipRectsIncludingDescendants();
+            } else if (diff == StyleDifferenceRepaint || newStyle->outlineSize() < style()->outlineSize())
+                repaint();
+        }
+        
+        if (diff == StyleDifferenceLayout) {
+            // When a layout hint happens, we go ahead and do a repaint of the layer, since the layer could
+            // end up being destroyed.
+            if (hasLayer()) {
+                if (style()->position() != newStyle->position() ||
+                    style()->zIndex() != newStyle->zIndex() ||
+                    style()->hasAutoZIndex() != newStyle->hasAutoZIndex() ||
+                    !(style()->clip() == newStyle->clip()) ||
+                    style()->hasClip() != newStyle->hasClip() ||
+                    style()->opacity() != newStyle->opacity() ||
+                    style()->transform() != newStyle->transform())
+                layer()->repaintIncludingDescendants();
+            } else if (newStyle->hasTransform() || newStyle->opacity() < 1) {
+                // If we don't have a layer yet, but we are going to get one because of transform or opacity,
+                //  then we need to repaint the old position of the object.
+                repaint();
+            }
+        }
+
         if (hasLayer() && (style()->hasAutoZIndex() != newStyle->hasAutoZIndex() ||
                            style()->zIndex() != newStyle->zIndex() ||
                            style()->visibility() != newStyle->visibility())) {
@@ -121,8 +155,11 @@
             setChildNeedsLayout(true);
     }
 
-    if (m_layer)
-        m_layer->styleChanged(diff, oldStyle);
+    if (layer()) {
+        layer()->styleChanged(diff, oldStyle);
+        if (s_hadLayer && layer()->isSelfPaintingLayer() != s_layerWasSelfPainting)
+            setChildNeedsLayout(true);
+    }
 }
 
 void RenderBoxModelObject::updateBoxModelInfoFromStyle()
@@ -274,11 +311,15 @@
     bool clippedToBorderRadius = false;
     if (style()->hasBorderRadius() && (includeLeftEdge || includeRightEdge)) {
         context->save();
-        context->addRoundedRectClip(IntRect(tx, ty, w, h),
-            includeLeftEdge ? style()->borderTopLeftRadius() : IntSize(),
-            includeRightEdge ? style()->borderTopRightRadius() : IntSize(),
-            includeLeftEdge ? style()->borderBottomLeftRadius() : IntSize(),
-            includeRightEdge ? style()->borderBottomRightRadius() : IntSize());
+
+        IntSize topLeft, topRight, bottomLeft, bottomRight;
+        IntRect borderRect(tx, ty, w, h);
+        style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+
+        context->addRoundedRectClip(borderRect, includeLeftEdge ? topLeft : IntSize(),
+                                                includeRightEdge ? topRight : IntSize(),
+                                                includeLeftEdge ? bottomLeft : IntSize(),
+                                                includeRightEdge ? bottomRight : IntSize());
         clippedToBorderRadius = true;
     }
 
@@ -299,8 +340,8 @@
         maskRect.intersect(paintInfo.rect);
         
         // Now create the mask.
-        auto_ptr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
-        if (!maskImage.get())
+        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
+        if (!maskImage)
             return;
         
         GraphicsContext* maskImageContext = maskImage->context();
@@ -311,9 +352,12 @@
         PaintInfo info(maskImageContext, maskRect, PaintPhaseTextClip, true, 0, 0);
         if (box)
             box->paint(info, tx - box->x(), ty - box->y());
-        else
-            paint(info, tx, ty);
-            
+        else {
+            int x = isBox() ? toRenderBox(this)->x() : 0;
+            int y = isBox() ? toRenderBox(this)->y() : 0;
+            paint(info, tx - x, ty - y);
+        }
+        
         // The mask has been created.  Now we just need to clip to it.
         context->save();
         context->clipToImageBuffer(maskRect, maskImage.get());
@@ -338,33 +382,38 @@
         }
     }
 
+    bool isRoot = this->isRoot();
+
     // Only fill with a base color (e.g., white) if we're the root document, since iframes/frames with
     // no background in the child document should show the parent's background.
-    bool isTransparent = false;
-    if (!bgLayer->next() && isRoot() && !(bgColor.isValid() && bgColor.alpha() > 0) && view()->frameView()) {
-        Node* elt = document()->ownerElement();
-        if (elt) {
-            if (!elt->hasTagName(frameTag)) {
-                // Locate the <body> element using the DOM.  This is easier than trying
-                // to crawl around a render tree with potential :before/:after content and
-                // anonymous blocks created by inline <body> tags etc.  We can locate the <body>
-                // render object very easily via the DOM.
-                HTMLElement* body = document()->body();
-                isTransparent = !body || !body->hasLocalName(framesetTag); // Can't scroll a frameset document anyway.
-            }
-        } else
-            isTransparent = view()->frameView()->isTransparent();
-
-        // FIXME: This needs to be dynamic.  We should be able to go back to blitting if we ever stop being transparent.
-        if (isTransparent)
-            view()->frameView()->setUseSlowRepaints(); // The parent must show behind the child.
+    bool isOpaqueRoot = false;
+    if (isRoot) {
+        isOpaqueRoot = true;
+        if (!bgLayer->next() && !(bgColor.isValid() && bgColor.alpha() == 255) && view()->frameView()) {
+            Element* ownerElement = document()->ownerElement();
+            if (ownerElement) {
+                if (!ownerElement->hasTagName(frameTag)) {
+                    // Locate the <body> element using the DOM.  This is easier than trying
+                    // to crawl around a render tree with potential :before/:after content and
+                    // anonymous blocks created by inline <body> tags etc.  We can locate the <body>
+                    // render object very easily via the DOM.
+                    HTMLElement* body = document()->body();
+                    if (body) {
+                        // Can't scroll a frameset document anyway.
+                        isOpaqueRoot = body->hasLocalName(framesetTag);
+                    }
+                }
+            } else
+                isOpaqueRoot = !view()->frameView()->isTransparent();
+        }
+        view()->frameView()->setContentIsOpaque(isOpaqueRoot);
     }
 
     // Paint the color first underneath all images.
     if (!bgLayer->next()) {
         IntRect rect(tx, clipY, w, clipH);
         // If we have an alpha and we are painting the root element, go ahead and blend with the base background color.
-        if (isRoot() && (!bgColor.isValid() || bgColor.alpha() < 0xFF) && !isTransparent) {
+        if (isOpaqueRoot) {
             Color baseColor = view()->frameView()->baseBackgroundColor();
             if (baseColor.alpha() > 0) {
                 context->save();
@@ -395,7 +444,21 @@
         if (!destRect.isEmpty()) {
             phase += destRect.location() - destOrigin;
             CompositeOperator compositeOp = op == CompositeSourceOver ? bgLayer->composite() : op;
-            context->drawTiledImage(bg->image(this, tileSize), destRect, phase, tileSize, compositeOp);
+            RenderObject* clientForBackgroundImage = this;
+            // Check if this is the root element painting a background layer propagated from <body>,
+            // and pass the body's renderer as the client in that case.
+            if (isRoot && !style()->hasBackground()) {
+                ASSERT(node()->hasTagName(htmlTag));
+                HTMLElement* body = document()->body();
+                ASSERT(body);
+                ASSERT(body->hasLocalName(bodyTag));
+                ASSERT(body->renderer());
+                if (body) {
+                    if (RenderObject* bodyRenderer = body->renderer())
+                        clientForBackgroundImage = bodyRenderer;
+                }
+            }
+            context->drawTiledImage(bg->image(clientForBackgroundImage, tileSize), destRect, phase, tileSize, compositeOp);
         }
     }
 
@@ -718,63 +781,66 @@
     if (paintNinePieceImage(graphicsContext, tx, ty, w, h, style, style->borderImage()))
         return;
 
-    const Color& tc = style->borderTopColor();
-    const Color& bc = style->borderBottomColor();
-    const Color& lc = style->borderLeftColor();
-    const Color& rc = style->borderRightColor();
+    const Color& topColor = style->borderTopColor();
+    const Color& bottomColor = style->borderBottomColor();
+    const Color& leftColor = style->borderLeftColor();
+    const Color& rightColor = style->borderRightColor();
 
-    bool tt = style->borderTopIsTransparent();
-    bool bt = style->borderBottomIsTransparent();
-    bool rt = style->borderRightIsTransparent();
-    bool lt = style->borderLeftIsTransparent();
+    bool topTransparent = style->borderTopIsTransparent();
+    bool bottomTransparent = style->borderBottomIsTransparent();
+    bool rightTransparent = style->borderRightIsTransparent();
+    bool leftTransparent = style->borderLeftIsTransparent();
 
-    EBorderStyle ts = style->borderTopStyle();
-    EBorderStyle bs = style->borderBottomStyle();
-    EBorderStyle ls = style->borderLeftStyle();
-    EBorderStyle rs = style->borderRightStyle();
+    EBorderStyle topStyle = style->borderTopStyle();
+    EBorderStyle bottomStyle = style->borderBottomStyle();
+    EBorderStyle leftStyle = style->borderLeftStyle();
+    EBorderStyle rightStyle = style->borderRightStyle();
 
-    bool renderTop = ts > BHIDDEN && !tt;
-    bool renderLeft = ls > BHIDDEN && begin && !lt;
-    bool renderRight = rs > BHIDDEN && end && !rt;
-    bool renderBottom = bs > BHIDDEN && !bt;
+    bool renderTop = topStyle > BHIDDEN && !topTransparent;
+    bool renderLeft = leftStyle > BHIDDEN && begin && !leftTransparent;
+    bool renderRight = rightStyle > BHIDDEN && end && !rightTransparent;
+    bool renderBottom = bottomStyle > BHIDDEN && !bottomTransparent;
 
-    // Need sufficient width and height to contain border radius curves.  Sanity check our border radii
-    // and our width/height values to make sure the curves can all fit. If not, then we won't paint
-    // any border radii.
     bool renderRadii = false;
-    IntSize topLeft = style->borderTopLeftRadius();
-    IntSize topRight = style->borderTopRightRadius();
-    IntSize bottomLeft = style->borderBottomLeftRadius();
-    IntSize bottomRight = style->borderBottomRightRadius();
+    IntSize topLeft, topRight, bottomLeft, bottomRight;
 
-    if (style->hasBorderRadius() &&
-        static_cast<unsigned>(w) >= static_cast<unsigned>(topLeft.width()) + static_cast<unsigned>(topRight.width()) &&
-        static_cast<unsigned>(w) >= static_cast<unsigned>(bottomLeft.width()) + static_cast<unsigned>(bottomRight.width()) &&
-        static_cast<unsigned>(h) >= static_cast<unsigned>(topLeft.height()) + static_cast<unsigned>(bottomLeft.height()) &&
-        static_cast<unsigned>(h) >= static_cast<unsigned>(topRight.height()) + static_cast<unsigned>(bottomRight.height()))
+    if (style->hasBorderRadius()) {
+        IntRect borderRect = IntRect(tx, ty, w, h);
+
+        IntSize topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius;
+        style->getBorderRadiiForRect(borderRect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+        if (begin) {
+            topLeft = topLeftRadius;
+            bottomLeft = bottomLeftRadius;
+        }
+        if (end) {
+            topRight = topRightRadius;
+            bottomRight = bottomRightRadius;
+        }
+
         renderRadii = true;
 
-    // Clip to the rounded rectangle.
-    if (renderRadii) {
+        // Clip to the rounded rectangle.
         graphicsContext->save();
-        graphicsContext->addRoundedRectClip(IntRect(tx, ty, w, h), topLeft, topRight, bottomLeft, bottomRight);
+        graphicsContext->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
     }
 
     int firstAngleStart, secondAngleStart, firstAngleSpan, secondAngleSpan;
     float thickness;
-    bool upperLeftBorderStylesMatch = renderLeft && (ts == ls) && (tc == lc);
-    bool upperRightBorderStylesMatch = renderRight && (ts == rs) && (tc == rc) && (ts != OUTSET) && (ts != RIDGE) && (ts != INSET) && (ts != GROOVE);
-    bool lowerLeftBorderStylesMatch = renderLeft && (bs == ls) && (bc == lc) && (bs != OUTSET) && (bs != RIDGE) && (bs != INSET) && (bs != GROOVE);
-    bool lowerRightBorderStylesMatch = renderRight && (bs == rs) && (bc == rc);
+    bool upperLeftBorderStylesMatch = renderLeft && (topStyle == leftStyle) && (topColor == leftColor);
+    bool upperRightBorderStylesMatch = renderRight && (topStyle == rightStyle) && (topColor == rightColor) && (topStyle != OUTSET) && (topStyle != RIDGE) && (topStyle != INSET) && (topStyle != GROOVE);
+    bool lowerLeftBorderStylesMatch = renderLeft && (bottomStyle == leftStyle) && (bottomColor == leftColor) && (bottomStyle != OUTSET) && (bottomStyle != RIDGE) && (bottomStyle != INSET) && (bottomStyle != GROOVE);
+    bool lowerRightBorderStylesMatch = renderRight && (bottomStyle == rightStyle) && (bottomColor == rightColor);
 
     if (renderTop) {
         bool ignore_left = (renderRadii && topLeft.width() > 0) ||
-            (tc == lc && tt == lt && ts >= OUTSET &&
-             (ls == DOTTED || ls == DASHED || ls == SOLID || ls == OUTSET));
+            (topColor == leftColor && topTransparent == leftTransparent && topStyle >= OUTSET &&
+             (leftStyle == DOTTED || leftStyle == DASHED || leftStyle == SOLID || leftStyle == OUTSET));
 
         bool ignore_right = (renderRadii && topRight.width() > 0) ||
-            (tc == rc && tt == rt && ts >= OUTSET &&
-             (rs == DOTTED || rs == DASHED || rs == SOLID || rs == INSET));
+            (topColor == rightColor && topTransparent == rightTransparent && topStyle >= OUTSET &&
+             (rightStyle == DOTTED || rightStyle == DASHED || rightStyle == SOLID || rightStyle == INSET));
 
         int x = tx;
         int x2 = tx + w;
@@ -783,7 +849,7 @@
             x2 -= topRight.width();
         }
 
-        drawLineForBoxSide(graphicsContext, x, ty, x2, ty + style->borderTopWidth(), BSTop, tc, style->color(), ts,
+        drawLineForBoxSide(graphicsContext, x, ty, x2, ty + style->borderTopWidth(), BSTop, topColor, style->color(), topStyle,
                    ignore_left ? 0 : style->borderLeftWidth(), ignore_right ? 0 : style->borderRightWidth());
 
         if (renderRadii) {
@@ -799,7 +865,7 @@
                 // The inner clip clips inside the arc. This is especially important for 1px borders.
                 bool applyLeftInnerClip = (style->borderLeftWidth() < topLeft.width())
                     && (style->borderTopWidth() < topLeft.height())
-                    && (ts != DOUBLE || style->borderTopWidth() > 6);
+                    && (topStyle != DOUBLE || style->borderTopWidth() > 6);
                 if (applyLeftInnerClip) {
                     graphicsContext->save();
                     graphicsContext->addInnerRoundedRectClip(IntRect(leftX, leftY, topLeft.width() * 2, topLeft.height() * 2),
@@ -811,7 +877,7 @@
 
                 // Draw upper left arc
                 drawArcForBoxSide(graphicsContext, leftX, leftY, thickness, topLeft, firstAngleStart, firstAngleSpan,
-                              BSTop, tc, style->color(), ts, true);
+                              BSTop, topColor, style->color(), topStyle, true);
                 if (applyLeftInnerClip)
                     graphicsContext->restore();
             }
@@ -820,7 +886,7 @@
                 int rightX = tx + w - topRight.width() * 2;
                 bool applyRightInnerClip = (style->borderRightWidth() < topRight.width())
                     && (style->borderTopWidth() < topRight.height())
-                    && (ts != DOUBLE || style->borderTopWidth() > 6);
+                    && (topStyle != DOUBLE || style->borderTopWidth() > 6);
                 if (applyRightInnerClip) {
                     graphicsContext->save();
                     graphicsContext->addInnerRoundedRectClip(IntRect(rightX, leftY, topRight.width() * 2, topRight.height() * 2),
@@ -837,7 +903,7 @@
 
                 // Draw upper right arc
                 drawArcForBoxSide(graphicsContext, rightX, leftY, thickness, topRight, secondAngleStart, secondAngleSpan,
-                              BSTop, tc, style->color(), ts, false);
+                              BSTop, topColor, style->color(), topStyle, false);
                 if (applyRightInnerClip)
                     graphicsContext->restore();
             }
@@ -846,12 +912,12 @@
 
     if (renderBottom) {
         bool ignore_left = (renderRadii && bottomLeft.width() > 0) ||
-            (bc == lc && bt == lt && bs >= OUTSET &&
-             (ls == DOTTED || ls == DASHED || ls == SOLID || ls == OUTSET));
+            (bottomColor == leftColor && bottomTransparent == leftTransparent && bottomStyle >= OUTSET &&
+             (leftStyle == DOTTED || leftStyle == DASHED || leftStyle == SOLID || leftStyle == OUTSET));
 
         bool ignore_right = (renderRadii && bottomRight.width() > 0) ||
-            (bc == rc && bt == rt && bs >= OUTSET &&
-             (rs == DOTTED || rs == DASHED || rs == SOLID || rs == INSET));
+            (bottomColor == rightColor && bottomTransparent == rightTransparent && bottomStyle >= OUTSET &&
+             (rightStyle == DOTTED || rightStyle == DASHED || rightStyle == SOLID || rightStyle == INSET));
 
         int x = tx;
         int x2 = tx + w;
@@ -860,7 +926,7 @@
             x2 -= bottomRight.width();
         }
 
-        drawLineForBoxSide(graphicsContext, x, ty + h - style->borderBottomWidth(), x2, ty + h, BSBottom, bc, style->color(), bs,
+        drawLineForBoxSide(graphicsContext, x, ty + h - style->borderBottomWidth(), x2, ty + h, BSBottom, bottomColor, style->color(), bottomStyle,
                    ignore_left ? 0 : style->borderLeftWidth(), ignore_right ? 0 : style->borderRightWidth());
 
         if (renderRadii) {
@@ -871,7 +937,7 @@
                 int leftY = ty + h - bottomLeft.height() * 2;
                 bool applyLeftInnerClip = (style->borderLeftWidth() < bottomLeft.width())
                     && (style->borderBottomWidth() < bottomLeft.height())
-                    && (bs != DOUBLE || style->borderBottomWidth() > 6);
+                    && (bottomStyle != DOUBLE || style->borderBottomWidth() > 6);
                 if (applyLeftInnerClip) {
                     graphicsContext->save();
                     graphicsContext->addInnerRoundedRectClip(IntRect(leftX, leftY, bottomLeft.width() * 2, bottomLeft.height() * 2),
@@ -888,7 +954,7 @@
 
                 // Draw lower left arc
                 drawArcForBoxSide(graphicsContext, leftX, leftY, thickness, bottomLeft, firstAngleStart, firstAngleSpan,
-                              BSBottom, bc, style->color(), bs, true);
+                              BSBottom, bottomColor, style->color(), bottomStyle, true);
                 if (applyLeftInnerClip)
                     graphicsContext->restore();
             }
@@ -898,7 +964,7 @@
                 int rightX = tx + w - bottomRight.width() * 2;
                 bool applyRightInnerClip = (style->borderRightWidth() < bottomRight.width())
                     && (style->borderBottomWidth() < bottomRight.height())
-                    && (bs != DOUBLE || style->borderBottomWidth() > 6);
+                    && (bottomStyle != DOUBLE || style->borderBottomWidth() > 6);
                 if (applyRightInnerClip) {
                     graphicsContext->save();
                     graphicsContext->addInnerRoundedRectClip(IntRect(rightX, rightY, bottomRight.width() * 2, bottomRight.height() * 2),
@@ -910,7 +976,7 @@
 
                 // Draw lower right arc
                 drawArcForBoxSide(graphicsContext, rightX, rightY, thickness, bottomRight, secondAngleStart, secondAngleSpan,
-                              BSBottom, bc, style->color(), bs, false);
+                              BSBottom, bottomColor, style->color(), bottomStyle, false);
                 if (applyRightInnerClip)
                     graphicsContext->restore();
             }
@@ -919,12 +985,12 @@
 
     if (renderLeft) {
         bool ignore_top = (renderRadii && topLeft.height() > 0) ||
-            (tc == lc && tt == lt && ls >= OUTSET &&
-             (ts == DOTTED || ts == DASHED || ts == SOLID || ts == OUTSET));
+            (topColor == leftColor && topTransparent == leftTransparent && leftStyle >= OUTSET &&
+             (topStyle == DOTTED || topStyle == DASHED || topStyle == SOLID || topStyle == OUTSET));
 
         bool ignore_bottom = (renderRadii && bottomLeft.height() > 0) ||
-            (bc == lc && bt == lt && ls >= OUTSET &&
-             (bs == DOTTED || bs == DASHED || bs == SOLID || bs == INSET));
+            (bottomColor == leftColor && bottomTransparent == leftTransparent && leftStyle >= OUTSET &&
+             (bottomStyle == DOTTED || bottomStyle == DASHED || bottomStyle == SOLID || bottomStyle == INSET));
 
         int y = ty;
         int y2 = ty + h;
@@ -933,7 +999,7 @@
             y2 -= bottomLeft.height();
         }
 
-        drawLineForBoxSide(graphicsContext, tx, y, tx + style->borderLeftWidth(), y2, BSLeft, lc, style->color(), ls,
+        drawLineForBoxSide(graphicsContext, tx, y, tx + style->borderLeftWidth(), y2, BSLeft, leftColor, style->color(), leftStyle,
                    ignore_top ? 0 : style->borderTopWidth(), ignore_bottom ? 0 : style->borderBottomWidth());
 
         if (renderRadii && (!upperLeftBorderStylesMatch || !lowerLeftBorderStylesMatch)) {
@@ -944,7 +1010,7 @@
                 int topY = ty;
                 bool applyTopInnerClip = (style->borderLeftWidth() < topLeft.width())
                     && (style->borderTopWidth() < topLeft.height())
-                    && (ls != DOUBLE || style->borderLeftWidth() > 6);
+                    && (leftStyle != DOUBLE || style->borderLeftWidth() > 6);
                 if (applyTopInnerClip) {
                     graphicsContext->save();
                     graphicsContext->addInnerRoundedRectClip(IntRect(topX, topY, topLeft.width() * 2, topLeft.height() * 2),
@@ -956,7 +1022,7 @@
 
                 // Draw top left arc
                 drawArcForBoxSide(graphicsContext, topX, topY, thickness, topLeft, firstAngleStart, firstAngleSpan,
-                              BSLeft, lc, style->color(), ls, true);
+                              BSLeft, leftColor, style->color(), leftStyle, true);
                 if (applyTopInnerClip)
                     graphicsContext->restore();
             }
@@ -965,7 +1031,7 @@
                 int bottomY = ty + h - bottomLeft.height() * 2;
                 bool applyBottomInnerClip = (style->borderLeftWidth() < bottomLeft.width())
                     && (style->borderBottomWidth() < bottomLeft.height())
-                    && (ls != DOUBLE || style->borderLeftWidth() > 6);
+                    && (leftStyle != DOUBLE || style->borderLeftWidth() > 6);
                 if (applyBottomInnerClip) {
                     graphicsContext->save();
                     graphicsContext->addInnerRoundedRectClip(IntRect(topX, bottomY, bottomLeft.width() * 2, bottomLeft.height() * 2),
@@ -977,7 +1043,7 @@
 
                 // Draw bottom left arc
                 drawArcForBoxSide(graphicsContext, topX, bottomY, thickness, bottomLeft, secondAngleStart, secondAngleSpan,
-                              BSLeft, lc, style->color(), ls, false);
+                              BSLeft, leftColor, style->color(), leftStyle, false);
                 if (applyBottomInnerClip)
                     graphicsContext->restore();
             }
@@ -986,14 +1052,14 @@
 
     if (renderRight) {
         bool ignore_top = (renderRadii && topRight.height() > 0) ||
-            ((tc == rc) && (tt == rt) &&
-            (rs >= DOTTED || rs == INSET) &&
-            (ts == DOTTED || ts == DASHED || ts == SOLID || ts == OUTSET));
+            ((topColor == rightColor) && (topTransparent == rightTransparent) &&
+            (rightStyle >= DOTTED || rightStyle == INSET) &&
+            (topStyle == DOTTED || topStyle == DASHED || topStyle == SOLID || topStyle == OUTSET));
 
         bool ignore_bottom = (renderRadii && bottomRight.height() > 0) ||
-            ((bc == rc) && (bt == rt) &&
-            (rs >= DOTTED || rs == INSET) &&
-            (bs == DOTTED || bs == DASHED || bs == SOLID || bs == INSET));
+            ((bottomColor == rightColor) && (bottomTransparent == rightTransparent) &&
+            (rightStyle >= DOTTED || rightStyle == INSET) &&
+            (bottomStyle == DOTTED || bottomStyle == DASHED || bottomStyle == SOLID || bottomStyle == INSET));
 
         int y = ty;
         int y2 = ty + h;
@@ -1002,7 +1068,7 @@
             y2 -= bottomRight.height();
         }
 
-        drawLineForBoxSide(graphicsContext, tx + w - style->borderRightWidth(), y, tx + w, y2, BSRight, rc, style->color(), rs,
+        drawLineForBoxSide(graphicsContext, tx + w - style->borderRightWidth(), y, tx + w, y2, BSRight, rightColor, style->color(), rightStyle,
                    ignore_top ? 0 : style->borderTopWidth(), ignore_bottom ? 0 : style->borderBottomWidth());
 
         if (renderRadii && (!upperRightBorderStylesMatch || !lowerRightBorderStylesMatch)) {
@@ -1013,7 +1079,7 @@
                 int topY = ty;
                 bool applyTopInnerClip = (style->borderRightWidth() < topRight.width())
                     && (style->borderTopWidth() < topRight.height())
-                    && (rs != DOUBLE || style->borderRightWidth() > 6);
+                    && (rightStyle != DOUBLE || style->borderRightWidth() > 6);
                 if (applyTopInnerClip) {
                     graphicsContext->save();
                     graphicsContext->addInnerRoundedRectClip(IntRect(topX, topY, topRight.width() * 2, topRight.height() * 2),
@@ -1025,7 +1091,7 @@
 
                 // Draw top right arc
                 drawArcForBoxSide(graphicsContext, topX, topY, thickness, topRight, firstAngleStart, firstAngleSpan,
-                              BSRight, rc, style->color(), rs, true);
+                              BSRight, rightColor, style->color(), rightStyle, true);
                 if (applyTopInnerClip)
                     graphicsContext->restore();
             }
@@ -1035,7 +1101,7 @@
                 int bottomY = ty + h - bottomRight.height() * 2;
                 bool applyBottomInnerClip = (style->borderRightWidth() < bottomRight.width())
                     && (style->borderBottomWidth() < bottomRight.height())
-                    && (rs != DOUBLE || style->borderRightWidth() > 6);
+                    && (rightStyle != DOUBLE || style->borderRightWidth() > 6);
                 if (applyBottomInnerClip) {
                     graphicsContext->save();
                     graphicsContext->addInnerRoundedRectClip(IntRect(bottomX, bottomY, bottomRight.width() * 2, bottomRight.height() * 2),
@@ -1047,7 +1113,7 @@
 
                 // Draw bottom right arc
                 drawArcForBoxSide(graphicsContext, bottomX, bottomY, thickness, bottomRight, secondAngleStart, secondAngleSpan,
-                              BSRight, rc, style->color(), rs, false);
+                              BSRight, rightColor, style->color(), rightStyle, false);
                 if (applyBottomInnerClip)
                     graphicsContext->restore();
             }
@@ -1087,10 +1153,14 @@
 
         context->setShadow(shadowOffset, shadowBlur, shadow->color);
         if (hasBorderRadius) {
-            IntSize topLeft = begin ? s->borderTopLeftRadius() : IntSize();
-            IntSize topRight = end ? s->borderTopRightRadius() : IntSize();
-            IntSize bottomLeft = begin ? s->borderBottomLeftRadius() : IntSize();
-            IntSize bottomRight = end ? s->borderBottomRightRadius() : IntSize();
+            IntSize topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius;
+            s->getBorderRadiiForRect(rect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+            IntSize topLeft = begin ? topLeftRadius : IntSize();
+            IntSize topRight = end ? topRightRadius : IntSize();
+            IntSize bottomLeft = begin ? bottomLeftRadius : IntSize();
+            IntSize bottomRight = end ? bottomRightRadius : IntSize();
+
             if (!hasOpaqueBackground)
                 context->clipOutRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
             context->fillRoundedRect(fillRect, topLeft, topRight, bottomLeft, bottomRight, Color::black);
diff --git a/WebCore/rendering/RenderBoxModelObject.h b/WebCore/rendering/RenderBoxModelObject.h
index 161e5d2..f2c6326 100644
--- a/WebCore/rendering/RenderBoxModelObject.h
+++ b/WebCore/rendering/RenderBoxModelObject.h
@@ -111,6 +111,8 @@
     
     // Used to store state between styleWillChange and styleDidChange
     static bool s_wasFloating;
+    static bool s_hadLayer;
+    static bool s_layerWasSelfPainting;
 };
 
 inline RenderBoxModelObject* toRenderBoxModelObject(RenderObject* o)
diff --git a/WebCore/rendering/RenderButton.cpp b/WebCore/rendering/RenderButton.cpp
index d64d7c3..b266f42 100644
--- a/WebCore/rendering/RenderButton.cpp
+++ b/WebCore/rendering/RenderButton.cpp
@@ -180,6 +180,13 @@
 
 void RenderButton::timerFired(Timer<RenderButton>*)
 {
+    // FIXME Bug 25110: Ideally we would stop our timer when our Document
+    // enters the page cache. But we currently have no way of being notified
+    // when that happens, so we'll just ignore the timer firing as long as
+    // we're in the cache.
+    if (document()->inPageCache())
+        return;
+
     repaint();
 }
 
diff --git a/WebCore/rendering/RenderFileUploadControl.cpp b/WebCore/rendering/RenderFileUploadControl.cpp
index 33ffd98..9b5579c 100644
--- a/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/WebCore/rendering/RenderFileUploadControl.cpp
@@ -85,12 +85,12 @@
 
 void RenderFileUploadControl::valueChanged()
 {
-    // onChange may destroy this renderer
+    // dispatchFormControlChangeEvent may destroy this renderer
     RefPtr<FileChooser> fileChooser = m_fileChooser;
 
     HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(node());
     inputElement->setFileListFromRenderer(fileChooser->filenames());
-    inputElement->onChange();
+    inputElement->dispatchFormControlChangeEvent();
  
     // only repaint if it doesn't seem we have been destroyed
     if (!fileChooser->disconnected())
diff --git a/WebCore/rendering/RenderFlexibleBox.cpp b/WebCore/rendering/RenderFlexibleBox.cpp
index ff9dad4..d4eaaf4 100644
--- a/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/WebCore/rendering/RenderFlexibleBox.cpp
@@ -788,15 +788,19 @@
                     continue;
                 if (destBlock->style()->direction() != LTR)
                     continue;
+                int ltr = true;
 
-                int blockEdge = destBlock->rightOffset(lastVisibleLine->y(), false);
-                if (!lastVisibleLine->canAccommodateEllipsis(true, blockEdge, 
+                int blockRightEdge = destBlock->rightOffset(lastVisibleLine->y(), false);
+                int blockLeftEdge = destBlock->leftOffset(lastVisibleLine->y(), false);
+
+                int blockEdge = ltr ? blockRightEdge : blockLeftEdge;
+                if (!lastVisibleLine->canAccommodateEllipsis(ltr, blockEdge,
                                                              lastVisibleLine->x() + lastVisibleLine->width(),
                                                              totalWidth))
                     continue;
 
                 // Let the truncation code kick in.
-                lastVisibleLine->placeEllipsis(ellipsisAndSpaceStr, true, blockEdge, totalWidth, anchorBox);
+                lastVisibleLine->placeEllipsis(ellipsisAndSpaceStr, ltr, blockLeftEdge, blockRightEdge, totalWidth, anchorBox);
                 destBlock->setHasMarkupTruncation(true);
             }
         }
diff --git a/WebCore/rendering/RenderForeignObject.cpp b/WebCore/rendering/RenderForeignObject.cpp
index 0584c1c..b15d55c 100644
--- a/WebCore/rendering/RenderForeignObject.cpp
+++ b/WebCore/rendering/RenderForeignObject.cpp
@@ -1,7 +1,6 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2009 Google, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,6 +28,7 @@
 #include "RenderView.h"
 #include "SVGForeignObjectElement.h"
 #include "SVGLength.h"
+#include "SVGRenderSupport.h"
 #include "SVGTransformList.h"
 
 namespace WebCore {
@@ -38,82 +38,84 @@
 {
 }
 
-TransformationMatrix RenderForeignObject::translationForAttributes()
+TransformationMatrix RenderForeignObject::translationForAttributes() const
 {
     SVGForeignObjectElement* foreign = static_cast<SVGForeignObjectElement*>(node());
     return TransformationMatrix().translate(foreign->x().value(foreign), foreign->y().value(foreign));
 }
 
-void RenderForeignObject::paint(PaintInfo& paintInfo, int parentX, int parentY)
+void RenderForeignObject::paint(PaintInfo& paintInfo, int, int)
 {
     if (paintInfo.context->paintingDisabled())
         return;
 
-    paintInfo.context->save();
-    paintInfo.context->concatCTM(TransformationMatrix().translate(parentX, parentY));
-    paintInfo.context->concatCTM(localTransform());
-    paintInfo.context->concatCTM(translationForAttributes());
-    paintInfo.context->clip(clipRect(parentX, parentY));
+    // Copy the paint info so that modifications to the damage rect do not affect callers
+    PaintInfo childPaintInfo = paintInfo;
+    childPaintInfo.context->save();
+    applyTransformToPaintInfo(childPaintInfo, localToParentTransform());
+    childPaintInfo.context->clip(clipRect(0, 0));
 
     float opacity = style()->opacity();
     if (opacity < 1.0f)
-        // FIXME: Possible optimization by clipping to bbox here, once relativeBBox is implemented & clip, mask and filter support added.
-        paintInfo.context->beginTransparencyLayer(opacity);
+        childPaintInfo.context->beginTransparencyLayer(opacity);
 
-    PaintInfo pi(paintInfo);
-    pi.rect = absoluteTransform().inverse().mapRect(paintInfo.rect);
-    RenderBlock::paint(pi, 0, 0);
+    RenderBlock::paint(childPaintInfo, 0, 0);
 
     if (opacity < 1.0f)
-        paintInfo.context->endTransparencyLayer();
+        childPaintInfo.context->endTransparencyLayer();
 
-    paintInfo.context->restore();
+    childPaintInfo.context->restore();
+}
+
+FloatRect RenderForeignObject::objectBoundingBox() const
+{
+    return borderBoxRect();
+}
+
+FloatRect RenderForeignObject::repaintRectInLocalCoordinates() const
+{
+    // HACK: to maintain historical LayoutTest results for now.
+    // RenderForeignObject is a RenderBlock (not a RenderSVGModelObject) so this
+    // should not affect repaint correctness.  But it should really be:
+    // return borderBoxRect();
+    return FloatRect();
 }
 
 void RenderForeignObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& rect, bool fixed)
 {
-    TransformationMatrix transform = translationForAttributes() * localTransform();
-    rect = transform.mapRect(rect);
-
+    rect = localToParentTransform().mapRect(rect);
     RenderBlock::computeRectForRepaint(repaintContainer, rect, fixed);
 }
 
-bool RenderForeignObject::calculateLocalTransform()
+TransformationMatrix RenderForeignObject::localToParentTransform() const
 {
-    TransformationMatrix oldTransform = m_localTransform;
-    m_localTransform = static_cast<SVGForeignObjectElement*>(node())->animatedLocalTransform();
-    return (oldTransform != m_localTransform);
+    return localTransform() * translationForAttributes();
 }
 
 void RenderForeignObject::layout()
 {
     ASSERT(needsLayout());
+    ASSERT(!view()->layoutStateEnabled()); // RenderSVGRoot disables layoutState for the SVG rendering tree.
 
-    // Arbitrary affine transforms are incompatible with LayoutState.
-    view()->disableLayoutState();
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
+    m_localTransform = static_cast<SVGForeignObjectElement*>(node())->animatedLocalTransform();
 
-    // FIXME: using m_absoluteBounds breaks if containerForRepaint() is not the root
-    LayoutRepainter repainter(*this, checkForRepaintDuringLayout(), &m_absoluteBounds);
-    
-    calculateLocalTransform();
-    
     RenderBlock::layout();
-
-    m_absoluteBounds = absoluteClippedOverflowRect();
-
     repainter.repaintAfterLayout();
 
-    view()->enableLayoutState();
     setNeedsLayout(false);
 }
 
-bool RenderForeignObject::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
+bool RenderForeignObject::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
-    TransformationMatrix totalTransform = absoluteTransform();
-    totalTransform *= translationForAttributes();
-    double localX, localY;
-    totalTransform.inverse().map(x, y, localX, localY);
-    return RenderBlock::nodeAtPoint(request, result, static_cast<int>(localX), static_cast<int>(localY), tx, ty, hitTestAction);
+    FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
+    return RenderBlock::nodeAtPoint(request, result, static_cast<int>(localPoint.x()), static_cast<int>(localPoint.y()), 0, 0, hitTestAction);
+}
+
+bool RenderForeignObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
+{
+    ASSERT_NOT_REACHED();
+    return false;
 }
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderForeignObject.h b/WebCore/rendering/RenderForeignObject.h
index ab96785..8fdb816 100644
--- a/WebCore/rendering/RenderForeignObject.h
+++ b/WebCore/rendering/RenderForeignObject.h
@@ -1,7 +1,6 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2009 Google, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -39,20 +38,24 @@
 
     virtual void paint(PaintInfo&, int parentX, int parentY);
 
-    virtual TransformationMatrix localTransform() const { return m_localTransform; }
-    virtual bool calculateLocalTransform();
+    virtual TransformationMatrix localToParentTransform() const;
 
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
     virtual bool requiresLayer() const { return false; }
     virtual void layout();
 
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect repaintRectInLocalCoordinates() const;
+
+    virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
  private:
-    TransformationMatrix translationForAttributes();
+    TransformationMatrix translationForAttributes() const;
+
+    virtual TransformationMatrix localTransform() const { return m_localTransform; }
 
     TransformationMatrix m_localTransform;
-    IntRect m_absoluteBounds;
 };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderFrame.cpp b/WebCore/rendering/RenderFrame.cpp
index 9e1d92b..54a73c7 100644
--- a/WebCore/rendering/RenderFrame.cpp
+++ b/WebCore/rendering/RenderFrame.cpp
@@ -1,10 +1,8 @@
-/**
- * This file is part of the KDE project.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,10 +23,9 @@
 
 #include "config.h"
 #include "RenderFrame.h"
-#include "RenderFrameSet.h"
+
 #include "FrameView.h"
-#include "HTMLFrameSetElement.h"
-#include "HTMLNames.h"
+#include "HTMLFrameElement.h"
 
 #ifdef FLATTEN_FRAMESET
 #include "Frame.h"
@@ -38,8 +35,6 @@
 
 namespace WebCore {
 
-using namespace HTMLNames;
-
 RenderFrame::RenderFrame(HTMLFrameElement* frame)
     : RenderPart(frame)
 {
@@ -48,31 +43,36 @@
 
 FrameEdgeInfo RenderFrame::edgeInfo() const
 {
-    return FrameEdgeInfo(element()->noResize(), element()->hasFrameBorder());
+    HTMLFrameElement* element = static_cast<HTMLFrameElement*>(node());
+    return FrameEdgeInfo(element->noResize(), element->hasFrameBorder());
 }
 
 void RenderFrame::viewCleared()
 {
-    if (element() && m_widget && m_widget->isFrameView()) {
-        FrameView* view = static_cast<FrameView*>(m_widget);
-        int marginw = element()->getMarginWidth();
-        int marginh = element()->getMarginHeight();
+    HTMLFrameElement* element = static_cast<HTMLFrameElement*>(node());
+    if (!element || !widget() || !widget()->isFrameView())
+        return;
 
-        if (marginw != -1)
-            view->setMarginWidth(marginw);
-        if (marginh != -1)
-            view->setMarginHeight(marginh);
-    }
+    FrameView* view = static_cast<FrameView*>(widget());
+
+    int marginw = element->getMarginWidth();
+    int marginh = element->getMarginHeight();
+
+    if (marginw != -1)
+        view->setMarginWidth(marginw);
+    if (marginh != -1)
+        view->setMarginHeight(marginh);
 }
 
 #ifdef FLATTEN_FRAMESET
 void RenderFrame::layout()
 {
-    if (m_widget && m_widget->isFrameView()) {
-        FrameView* view = static_cast<FrameView*>(m_widget);
+    if (widget() && widget()->isFrameView()) {
+        FrameView* view = static_cast<FrameView*>(widget());
         RenderView* root = NULL;
         if (view->frame() && view->frame()->document() && 
-            view->frame()->document()->renderer() && view->frame()->document()->renderer()->isRenderView())
+            view->frame()->document()->renderer() &&
+            view->frame()->document()->renderer()->isRenderView())
             root = static_cast<RenderView*>(view->frame()->document()->renderer());
         if (root) {
             // Resize the widget so that the RenderView will layout according to those dimensions.
diff --git a/WebCore/rendering/RenderFrame.h b/WebCore/rendering/RenderFrame.h
index 9050077..47dad32 100644
--- a/WebCore/rendering/RenderFrame.h
+++ b/WebCore/rendering/RenderFrame.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the KDE project.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,26 +23,26 @@
 #ifndef RenderFrame_h
 #define RenderFrame_h
 
-#include "HTMLFrameElement.h"
 #include "RenderPart.h"
 #include "RenderFrameSet.h"
 
 namespace WebCore {
 
+class HTMLFrameElement;
+
 class RenderFrame : public RenderPart {
 public:
     RenderFrame(HTMLFrameElement*);
 
+    FrameEdgeInfo edgeInfo() const;
+
+private:
     virtual const char* renderName() const { return "RenderFrame"; }
     virtual bool isFrame() const { return true; }
 
 #ifdef FLATTEN_FRAMESET
     virtual void layout();
 #endif
-    HTMLFrameElement* element() const { return static_cast<HTMLFrameElement*>(RenderPart::node()); }
-
-    FrameEdgeInfo edgeInfo() const;
-
     virtual void viewCleared();
 };
 
diff --git a/WebCore/rendering/RenderInline.cpp b/WebCore/rendering/RenderInline.cpp
index 8f98427..3965d94 100644
--- a/WebCore/rendering/RenderInline.cpp
+++ b/WebCore/rendering/RenderInline.cpp
@@ -421,7 +421,7 @@
     m_lineBoxes.paint(this, paintInfo, tx, ty);
 }
 
-void RenderInline::absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel)
+void RenderInline::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 {
     if (InlineRunBox* curr = firstLineBox()) {
         for (; curr; curr = curr->nextLineBox())
@@ -429,19 +429,18 @@
     } else
         rects.append(IntRect(tx, ty, 0, 0));
 
-    if (continuation() && topLevel) {
+    if (continuation()) {
         if (continuation()->isBox()) {
             RenderBox* box = toRenderBox(continuation());
             continuation()->absoluteRects(rects, 
                                           tx - containingBlock()->x() + box->x(),
-                                          ty - containingBlock()->y() + box->y(),
-                                          topLevel);
+                                          ty - containingBlock()->y() + box->y());
         } else
-            continuation()->absoluteRects(rects, tx - containingBlock()->x(), ty - containingBlock()->y(), topLevel);
+            continuation()->absoluteRects(rects, tx - containingBlock()->x(), ty - containingBlock()->y());
     }
 }
 
-void RenderInline::absoluteQuads(Vector<FloatQuad>& quads, bool topLevel)
+void RenderInline::absoluteQuads(Vector<FloatQuad>& quads)
 {
     if (InlineRunBox* curr = firstLineBox()) {
         for (; curr; curr = curr->nextLineBox()) {
@@ -451,8 +450,8 @@
     } else
         quads.append(localToAbsoluteQuad(FloatRect()));
 
-    if (continuation() && topLevel)
-        continuation()->absoluteQuads(quads, topLevel);
+    if (continuation())
+        continuation()->absoluteQuads(quads);
 }
 
 int RenderInline::offsetLeft() const
diff --git a/WebCore/rendering/RenderInline.h b/WebCore/rendering/RenderInline.h
index f3be72a..cf6b84b 100644
--- a/WebCore/rendering/RenderInline.h
+++ b/WebCore/rendering/RenderInline.h
@@ -76,8 +76,8 @@
     virtual int marginLeft() const;
     virtual int marginRight() const;
     
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
 
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
     virtual IntRect rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth);
diff --git a/WebCore/rendering/RenderLayer.cpp b/WebCore/rendering/RenderLayer.cpp
index 78fe7d8..80c7155 100644
--- a/WebCore/rendering/RenderLayer.cpp
+++ b/WebCore/rendering/RenderLayer.cpp
@@ -46,6 +46,7 @@
 
 #include "CString.h"
 #include "CSSPropertyNames.h"
+#include "CSSStyleDeclaration.h"
 #include "CSSStyleSelector.h"
 #include "Document.h"
 #include "EventHandler.h"
@@ -62,6 +63,7 @@
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
 #include "OverflowEvent.h"
+#include "OverlapTestRequestClient.h"
 #include "Page.h"
 #include "PlatformMouseEvent.h"
 #include "RenderArena.h"
@@ -224,12 +226,12 @@
     ASSERT(renderer()->view());
     return renderer()->view()->compositor();
 }
-    
+
 void RenderLayer::rendererContentChanged()
 {
     if (m_backing)
         m_backing->rendererContentChanged();
-}    
+}
 #endif // USE(ACCELERATED_COMPOSITING)
 
 void RenderLayer::setStaticY(int staticY)
@@ -485,6 +487,8 @@
             for (unsigned i = 0; i < m_negZOrderList->size(); ++i)
                 m_has3DTransformedDescendant |= m_negZOrderList->at(i)->update3DTransformedDescendantStatus();
         }
+        
+        m_3DTransformedDescendantStatusDirty = false;
     }
     
     // If we live in a 3d hierarchy, then the layer at the root of that hierarchy needs
@@ -857,7 +861,11 @@
 {
     if (!m_parent)
         return;
-    
+
+    // Mark that we are about to lose our layer. This makes render tree
+    // walks ignore this layer while we're removing it.
+    m_renderer->setHasLayer(false);
+
 #if USE(ACCELERATED_COMPOSITING)
     compositor()->layerWillBeRemoved(m_parent, this);
 #endif
@@ -879,7 +887,7 @@
         RenderLayer* next = current->nextSibling();
         removeChild(current);
         parent->addChild(current, nextSib);
-        current->updateLayerPositions();
+        current->updateLayerPositions(); // Depends on hasLayer() already being false for proper layout.
         current = next;
     }
 
@@ -1883,10 +1891,13 @@
     return (didHorizontalScroll || didVerticalScroll);
 }
 
-void
-RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintRestriction paintRestriction, RenderObject *paintingRoot)
+void RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintRestriction paintRestriction, RenderObject *paintingRoot)
 {
-    paintLayer(this, p, damageRect, false, paintRestriction, paintingRoot);
+    RenderObject::OverlapTestRequestMap overlapTestRequests;
+    paintLayer(this, p, damageRect, false, paintRestriction, paintingRoot, &overlapTestRequests);
+    RenderObject::OverlapTestRequestMap::iterator end = overlapTestRequests.end();
+    for (RenderObject::OverlapTestRequestMap::iterator it = overlapTestRequests.begin(); it != end; ++it)
+        it->first->setOverlapTestResult(false);
 }
 
 static void setClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
@@ -1904,10 +1915,25 @@
     p->restore();
 }
 
-void
-RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
+static void performOverlapTests(RenderObject::OverlapTestRequestMap& overlapTestRequests, const IntRect& layerBounds)
+{
+    Vector<OverlapTestRequestClient*> overlappedRequestClients;
+    RenderObject::OverlapTestRequestMap::iterator end = overlapTestRequests.end();
+    for (RenderObject::OverlapTestRequestMap::iterator it = overlapTestRequests.begin(); it != end; ++it) {
+        if (!layerBounds.intersects(it->second))
+            continue;
+
+        it->first->setOverlapTestResult(true);
+        overlappedRequestClients.append(it->first);
+    }
+    for (size_t i = 0; i < overlappedRequestClients.size(); ++i)
+        overlapTestRequests.remove(overlappedRequestClients[i]);
+}
+
+void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
                         const IntRect& paintDirtyRect, bool haveTransparency, PaintRestriction paintRestriction,
-                        RenderObject* paintingRoot, bool appliedTransform, bool temporaryClipRects)
+                        RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* overlapTestRequests,
+                        bool appliedTransform, bool temporaryClipRects)
 {
 #if USE(ACCELERATED_COMPOSITING)
     // Composited RenderLayers are painted via the backing's paintIntoLayer().
@@ -1970,7 +1996,7 @@
         p->concatCTM(transform);
 
         // Now do a paint with the root layer shifted to be us.
-        paintLayer(this, p, transform.inverse().mapRect(paintDirtyRect), haveTransparency, paintRestriction, paintingRoot, true, temporaryClipRects);
+        paintLayer(this, p, transform.inverse().mapRect(paintDirtyRect), haveTransparency, paintRestriction, paintingRoot, overlapTestRequests, true, temporaryClipRects);
 
         p->restore();
         
@@ -1984,7 +2010,7 @@
     if (m_reflection && !m_paintingInsideReflection && (!m_transform || appliedTransform)) {
         // Mark that we are now inside replica painting.
         m_paintingInsideReflection = true;
-        reflectionLayer()->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, false, temporaryClipRects);
+        reflectionLayer()->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, overlapTestRequests, false, temporaryClipRects);
         m_paintingInsideReflection = false;
     }
 
@@ -2010,8 +2036,11 @@
     if (paintingRoot && !renderer()->isDescendantOf(paintingRoot))
         paintingRootForRenderer = paintingRoot;
 
+    if (overlapTestRequests)
+        performOverlapTests(*overlapTestRequests, layerBounds);
+
     // We want to paint our layer, but only if we intersect the damage rect.
-    bool shouldPaint = intersectsDamageRect(layerBounds, damageRect, rootLayer) && m_hasVisibleContent;
+    bool shouldPaint = intersectsDamageRect(layerBounds, damageRect, rootLayer) && m_hasVisibleContent && isSelfPaintingLayer();
     if (shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
@@ -2032,7 +2061,7 @@
     // Now walk the sorted list of children with negative z-indices.
     if (m_negZOrderList)
         for (Vector<RenderLayer*>::iterator it = m_negZOrderList->begin(); it != m_negZOrderList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, false, temporaryClipRects);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, overlapTestRequests, false, temporaryClipRects);
     
     // Now establish the appropriate clip and paint our child RenderObjects.
     if (shouldPaint && !clipRectToApply.isEmpty()) {
@@ -2050,6 +2079,7 @@
             paintInfo.phase = PaintPhaseFloat;
             renderer()->paint(paintInfo, tx, ty);
             paintInfo.phase = PaintPhaseForeground;
+            paintInfo.overlapTestRequests = overlapTestRequests;
             renderer()->paint(paintInfo, tx, ty);
             paintInfo.phase = PaintPhaseChildOutlines;
             renderer()->paint(paintInfo, tx, ty);
@@ -2059,7 +2089,7 @@
         restoreClip(p, paintDirtyRect, clipRectToApply);
     }
     
-    if (!outlineRect.isEmpty()) {
+    if (!outlineRect.isEmpty() && isSelfPaintingLayer()) {
         // Paint our own outline
         RenderObject::PaintInfo paintInfo(p, outlineRect, PaintPhaseSelfOutline, false, paintingRootForRenderer, 0);
         setClip(p, paintDirtyRect, outlineRect);
@@ -2069,15 +2099,13 @@
     
     // Paint any child layers that have overflow.
     if (m_normalFlowList)
-        for (Vector<RenderLayer*>::iterator it = m_normalFlowList->begin(); it != m_normalFlowList->end(); ++it) {
-            if (it[0]->isSelfPaintingLayer())
-                it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, false, temporaryClipRects);
-        }
+        for (Vector<RenderLayer*>::iterator it = m_normalFlowList->begin(); it != m_normalFlowList->end(); ++it)
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, overlapTestRequests, false, temporaryClipRects);
 
     // Now walk the sorted list of children with positive z-indices.
     if (m_posZOrderList)
         for (Vector<RenderLayer*>::iterator it = m_posZOrderList->begin(); it != m_posZOrderList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, false, temporaryClipRects);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot, overlapTestRequests, false, temporaryClipRects);
     
     if (renderer()->hasMask() && shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
         setClip(p, paintDirtyRect, damageRect);
@@ -2189,8 +2217,15 @@
         convertToLayerCoords(rootLayer, offsetX, offsetY);
     }
     
-    TransformationMatrix containerTransform = renderer()->transformFromContainer(containerLayer ? containerLayer->renderer() : 0, IntSize(offsetX, offsetY));
-    transformState->applyTransform(containerTransform, true);
+    RenderObject* containerRenderer = containerLayer ? containerLayer->renderer() : 0;
+    if (renderer()->shouldUseTransformFromContainer(containerRenderer)) {
+        TransformationMatrix containerTransform;
+        renderer()->getTransformFromContainer(containerRenderer, IntSize(offsetX, offsetY), containerTransform);
+        transformState->applyTransform(containerTransform, HitTestingTransformState::AccumulateTransform);
+    } else {
+        transformState->translate(offsetX, offsetY, HitTestingTransformState::AccumulateTransform);
+    }
+    
     return transformState;
 }
 
@@ -2359,9 +2394,6 @@
     if (m_normalFlowList) {
         for (int i = m_normalFlowList->size() - 1; i >= 0; --i) {
             RenderLayer* currLayer = m_normalFlowList->at(i);
-            if (!currLayer->isSelfPaintingLayer())
-                continue;
-
             HitTestResult tempResult(result.point());
             RenderLayer* hitLayer = currLayer->hitTestLayer(rootLayer, this, request, tempResult, hitTestRect, hitTestPoint, false, localTransformState.get(), zOffsetForDescendantsPtr);
             if (isHitCandidate(hitLayer, depthSortDescendants, zOffset, unflattenedTransformState.get())) {
@@ -2375,7 +2407,7 @@
     }
 
     // Next we want to see if the mouse pos is inside the child RenderObjects of the layer.
-    if (fgRect.contains(hitTestPoint)) {
+    if (fgRect.contains(hitTestPoint) && isSelfPaintingLayer()) {
         // Hit test with a temporary HitTestResult, because we onlyl want to commit to 'result' if we know we're frontmost.
         HitTestResult tempResult(result.point());
         if (hitTestContents(request, tempResult, layerBounds, hitTestPoint, HitTestDescendants) &&
@@ -2407,7 +2439,7 @@
     if (candidateLayer)
         return candidateLayer;
 
-    if (bgRect.contains(hitTestPoint)) {
+    if (bgRect.contains(hitTestPoint) && isSelfPaintingLayer()) {
         HitTestResult tempResult(result.point());
         if (hitTestContents(request, tempResult, layerBounds, hitTestPoint, HitTestSelf) &&
             isHitCandidate(this, false, zOffsetForContentsPtr, unflattenedTransformState.get())) {
@@ -3004,6 +3036,17 @@
     } else
         backing()->setContentsNeedDisplayInRect(r);
 }
+
+// Since we're only painting non-composited layers, we know that they all share the same repaintContainer.
+void RenderLayer::repaintIncludingNonCompositingDescendants(RenderBoxModelObject* repaintContainer)
+{
+    renderer()->repaintUsingContainer(repaintContainer, renderer()->clippedOverflowRectForRepaint(repaintContainer));
+
+    for (RenderLayer* curr = firstChild(); curr; curr = curr->nextSibling()) {
+        if (!curr->isComposited())
+            curr->repaintIncludingNonCompositingDescendants(repaintContainer);
+    }
+}
 #endif
 
 bool RenderLayer::shouldBeNormalFlowOnly() const
@@ -3062,8 +3105,13 @@
 #if USE(ACCELERATED_COMPOSITING)
     updateTransform();
 
-    if (compositor()->updateLayerCompositingState(this, diff))
+    if (compositor()->updateLayerCompositingState(this))
         compositor()->setCompositingLayersNeedUpdate();
+    else if (m_backing)
+        m_backing->updateGraphicsLayerGeometry();
+
+    if (m_backing && diff >= StyleDifferenceRepaint)
+        m_backing->setContentsNeedDisplay();
 #else
     UNUSED_PARAM(diff);
 #endif
@@ -3150,13 +3198,4 @@
     m_reflection->setStyle(newStyle.release());
 }
 
-void RenderLayer::suspendMarquees()
-{
-    if (m_marquee)
-        m_marquee->suspend();
-    
-    for (RenderLayer* curr = firstChild(); curr; curr = curr->nextSibling())
-        curr->suspendMarquees();
-}
-
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderLayer.h b/WebCore/rendering/RenderLayer.h
index 6e70a4b..9c8de5e 100644
--- a/WebCore/rendering/RenderLayer.h
+++ b/WebCore/rendering/RenderLayer.h
@@ -188,12 +188,12 @@
     // if layer compositing is being used,
     void setBackingNeedsRepaint();
     void setBackingNeedsRepaintInRect(const IntRect& r); // r is in the coordinate space of the layer's render object
+    void repaintIncludingNonCompositingDescendants(RenderBoxModelObject* repaintContainer);
 #endif
 
     void styleChanged(StyleDifference, const RenderStyle*);
 
     RenderMarquee* marquee() const { return m_marquee; }
-    void suspendMarquees();
 
     bool isNormalFlowOnly() const { return m_isNormalFlowOnly; }
     bool isSelfPaintingLayer() const;
@@ -441,6 +441,7 @@
     
     void paintLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect,
                     bool haveTransparency, PaintRestriction, RenderObject* paintingRoot,
+                    RenderObject::OverlapTestRequestMap* = 0,
                     bool appliedTransform = false, bool temporaryClipRects = false);
 
     RenderLayer* hitTestLayer(RenderLayer* rootLayer, RenderLayer* containerLayer, const HitTestRequest& request, HitTestResult& result,
diff --git a/WebCore/rendering/RenderLayerBacking.cpp b/WebCore/rendering/RenderLayerBacking.cpp
index 40805b5..e16ecf7 100644
--- a/WebCore/rendering/RenderLayerBacking.cpp
+++ b/WebCore/rendering/RenderLayerBacking.cpp
@@ -33,6 +33,7 @@
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "RenderBox.h"
 #include "RenderImage.h"
@@ -46,14 +47,17 @@
 
 namespace WebCore {
 
+static bool hasBorderOutlineOrShadow(const RenderStyle*);
+static bool hasBoxDecorations(const RenderStyle*);
+static bool hasBoxDecorationsWithBackgroundImage(const RenderStyle*);
+
 RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
     : m_owningLayer(layer)
     , m_ancestorClippingLayer(0)
     , m_graphicsLayer(0)
     , m_contentsLayer(0)
     , m_clippingLayer(0)
-    , m_isSimpleContainerCompositingLayer(false)
-    , m_simpleCompositingLayerStatusDirty(true)
+    , m_hasDirectlyCompositedContent(false)
     , m_compositingContentOffsetDirty(true)
 {
     createGraphicsLayer();
@@ -122,46 +126,36 @@
 
 void RenderLayerBacking::updateAfterLayout()
 {
-    invalidateDrawingOptimizations();
-    detectDrawingOptimizations();
-
-    updateGraphicsLayerGeometry();
+    // Only need to update geometry if there isn't a layer update pending.
+    if (!compositor()->compositingLayersNeedUpdate())
+        updateGraphicsLayerGeometry();
 }
 
-bool RenderLayerBacking::updateGraphicsLayers(bool needsContentsLayer, bool needsUpperClippingLayer, bool needsLowerClippingLayer, bool needsRepaint)
+bool RenderLayerBacking::updateGraphicsLayerConfiguration()
 {
+    RenderLayerCompositor* compositor = this->compositor();
+
     bool layerConfigChanged = false;
-    if (updateContentsLayer(needsContentsLayer))
+    if (updateContentsLayer(compositor->needsContentsCompositingLayer(m_owningLayer)))
         layerConfigChanged = true;
     
-    if (updateClippingLayers(needsUpperClippingLayer, needsLowerClippingLayer))
+    if (updateClippingLayers(compositor->clippedByAncestor(m_owningLayer), compositor->clipsCompositingDescendants(m_owningLayer)))
         layerConfigChanged = true;
 
-    // See if we can now use any drawing optimizations.
-    bool didDrawContent = graphicsLayer()->drawsContent();
-    invalidateDrawingOptimizations();
-    detectDrawingOptimizations();
-    if (!didDrawContent && graphicsLayer()->drawsContent())
-        needsRepaint = true;
+    m_hasDirectlyCompositedContent = false;
+    if (canUseDirectCompositing()) {
+        if (renderer()->isImage()) {
+            updateImageContents();
+            m_hasDirectlyCompositedContent = true;
+            m_graphicsLayer->setDrawsContent(false);
+        }
 
-    // Set opacity, if it is not animating.
-    if (!renderer()->animation()->isAnimatingPropertyOnRenderer(renderer(), CSSPropertyOpacity))
-        updateLayerOpacity();
-    
-    RenderStyle* style = renderer()->style();
-    m_graphicsLayer->setPreserves3D(style->transformStyle3D() == TransformStyle3DPreserve3D);
-    m_graphicsLayer->setBackfaceVisibility(style->backfaceVisibility() == BackfaceVisibilityVisible);
-
-    updateGraphicsLayerGeometry();
-    
-    m_graphicsLayer->updateContentsRect();
-    
-    if (needsRepaint) {
-        m_graphicsLayer->setNeedsDisplay();
-        if (m_contentsLayer)
-            m_contentsLayer->setNeedsDisplay();
+        if (rendererHasBackground())
+            m_graphicsLayer->setBackgroundColor(rendererBackgroundColor());
+        else
+            m_graphicsLayer->clearBackgroundColor();
     }
-    
+
     return layerConfigChanged;
 }
 
@@ -176,6 +170,14 @@
     if (!renderer()->animation()->isAnimatingPropertyOnRenderer(renderer(), CSSPropertyWebkitTransform))
         updateLayerTransform();
 
+    // Set opacity, if it is not animating.
+    if (!renderer()->animation()->isAnimatingPropertyOnRenderer(renderer(), CSSPropertyOpacity))
+        updateLayerOpacity();
+    
+    RenderStyle* style = renderer()->style();
+    m_graphicsLayer->setPreserves3D(style->transformStyle3D() == TransformStyle3DPreserve3D);
+    m_graphicsLayer->setBackfaceVisibility(style->backfaceVisibility() == BackfaceVisibilityVisible);
+
     m_compositingContentOffsetDirty = true;
     
     RenderLayer* compAncestor = m_owningLayer->ancestorCompositingLayer();
@@ -243,11 +245,8 @@
     if (m_owningLayer->hasTransform()) {
         const IntRect borderBox = toRenderBox(renderer())->borderBoxRect();
 
-        IntRect layerBounds = IntRect(m_owningLayer->x(), m_owningLayer->y(), borderBox.width(), borderBox.height());
-        // Convert to absolute coords to match bbox.
-        int x = 0, y = 0;
-        m_owningLayer->convertToLayerCoords(compAncestor, x, y);
-        layerBounds.move(x - m_owningLayer->x(), y - m_owningLayer->y());
+        // Get layout bounds in the coords of compAncestor to match relativeCompositingBounds.
+        IntRect layerBounds = IntRect(deltaX, deltaY, borderBox.width(), borderBox.height());
 
         // Update properties that depend on layer dimensions
         FloatPoint3D transformOrigin = computeTransformOrigin(borderBox);
@@ -285,6 +284,8 @@
     }
 
     m_graphicsLayer->updateContentsRect();
+    if (!m_hasDirectlyCompositedContent)
+        m_graphicsLayer->setDrawsContent(!isSimpleContainerCompositingLayer() && !paintingGoesToWindow());
 }
 
 void RenderLayerBacking::updateInternalHierarchy()
@@ -446,7 +447,10 @@
     return renderer()->style()->backgroundColor();
 }
 
-bool RenderLayerBacking::canBeSimpleContainerCompositingLayer() const
+// A "simple container layer" is a RenderLayer which has no visible content to render.
+// It may have no children, or all its children may be themselves composited.
+// This is a useful optimization, because it allows us to avoid allocating backing store.
+bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
 {
     RenderObject* renderObject = renderer();
     if (renderObject->isReplaced() ||       // replaced objects are not containers
@@ -574,54 +578,6 @@
     return !hasBoxDecorationsWithBackgroundImage(renderObject->style());
 }
     
-// A "simple container layer" is a RenderLayer which has no visible content to render.
-// It may have no children, or all its children may be themselves composited.
-// This is a useful optimization, because it allows us to avoid allocating backing store.
-bool RenderLayerBacking::isSimpleContainerCompositingLayer()
-{
-    if (m_simpleCompositingLayerStatusDirty) {
-        m_isSimpleContainerCompositingLayer = canBeSimpleContainerCompositingLayer();
-        m_simpleCompositingLayerStatusDirty = false;
-    }
-
-    return m_isSimpleContainerCompositingLayer;
-}
-
-void RenderLayerBacking::detectDrawingOptimizations()
-{
-    bool drawsContent = true;
-
-    // Check if a replaced layer can be further simplified.
-    if (canUseDirectCompositing()) {
-        if (renderer()->isImage()) {
-            updateImageContents();
-            drawsContent = false;
-        }
-        
-        if (rendererHasBackground())
-            m_graphicsLayer->setBackgroundColor(rendererBackgroundColor());
-        else
-            m_graphicsLayer->clearBackgroundColor();
-
-    } else {
-        m_graphicsLayer->clearBackgroundColor();
-        m_graphicsLayer->clearContents();
-        
-        if (isSimpleContainerCompositingLayer())
-            drawsContent = false;
-    }
-    
-    if (paintingGoesToWindow())
-        drawsContent = false;
-    
-    m_graphicsLayer->setDrawsContent(drawsContent);
-}
-
-void RenderLayerBacking::invalidateDrawingOptimizations()
-{
-    m_simpleCompositingLayerStatusDirty = true;
-}
-
 void RenderLayerBacking::rendererContentChanged()
 {
     if (canUseDirectCompositing() && renderer()->isImage())
diff --git a/WebCore/rendering/RenderLayerBacking.h b/WebCore/rendering/RenderLayerBacking.h
index 46b81ad..a6a6c1f 100644
--- a/WebCore/rendering/RenderLayerBacking.h
+++ b/WebCore/rendering/RenderLayerBacking.h
@@ -56,7 +56,7 @@
     void updateAfterLayout();
     
     // Returns true if layer configuration changed.
-    bool updateGraphicsLayers(bool needsContentsLayer, bool needsUpperClippingLayer, bool needsLowerClippingLayer, bool needsRepaint);
+    bool updateGraphicsLayerConfiguration();
     void updateGraphicsLayerGeometry();
     void updateInternalHierarchy();
     
@@ -103,9 +103,6 @@
     FloatPoint graphicsLayerToContentsCoordinates(const GraphicsLayer*, const FloatPoint&);
     FloatPoint contentsToGraphicsLayerCoordinates(const GraphicsLayer*, const FloatPoint&);
 
-    void detectDrawingOptimizations();
-    void invalidateDrawingOptimizations();
-
     // GraphicsLayerClient interface
     virtual void notifyAnimationStarted(const GraphicsLayer*, double startTime);
 
@@ -137,7 +134,7 @@
     
     // Returns true if this RenderLayer only has content that can be rendered directly
     // by the compositing layer, without drawing (e.g. solid background color).
-    bool isSimpleContainerCompositingLayer();
+    bool isSimpleContainerCompositingLayer() const;
     // Returns true if we can optimize the RenderLayer to draw the replaced content
     // directly into a compositing buffer
     bool canUseDirectCompositing() const;
@@ -146,7 +143,6 @@
     bool rendererHasBackground() const;
     const Color& rendererBackgroundColor() const;
 
-    bool canBeSimpleContainerCompositingLayer() const;
     bool hasNonCompositingContent() const;
     
     void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect,
@@ -165,9 +161,7 @@
 
     IntSize m_compositingContentOffset;
 
-    bool m_isSimpleContainerCompositingLayer : 1;  // is this compositing layer able to be simplified
-    bool m_simpleCompositingLayerStatusDirty : 1; // set if the test for simple layers needs to be redone
-
+    bool m_hasDirectlyCompositedContent: 1;
     bool m_compositingContentOffsetDirty: 1;
 };
 
diff --git a/WebCore/rendering/RenderLayerCompositor.cpp b/WebCore/rendering/RenderLayerCompositor.cpp
index cbb3df7..fec3b1d 100644
--- a/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/WebCore/rendering/RenderLayerCompositor.cpp
@@ -113,8 +113,22 @@
 
 void RenderLayerCompositor::setCompositingLayersNeedUpdate(bool needUpdate)
 {
-    if (inCompositingMode())
+    if (inCompositingMode()) {
+        if (!m_compositingLayersNeedUpdate && needUpdate)
+            scheduleViewUpdate();
+
         m_compositingLayersNeedUpdate = needUpdate;
+    }
+}
+
+void RenderLayerCompositor::scheduleViewUpdate()
+{
+    Frame* frame = m_renderView->frameView()->frame();
+    Page* page = frame ? frame->page() : 0;
+    if (!page)
+        return;
+
+    page->chrome()->client()->scheduleViewUpdate();
 }
 
 void RenderLayerCompositor::updateCompositingLayers(RenderLayer* updateRoot)
@@ -153,27 +167,25 @@
     
 #if PROFILE_LAYER_REBUILD
     double endTime = WTF::currentTime();
-    if (!updateRoot)
-        fprintf(stderr, "Update %d: computeCompositingRequirements for the world took %fms\n"
+    if (updateRoot == rootRenderLayer())
+        fprintf(stderr, "Update %d: computeCompositingRequirements for the world took %fms\n",
                     m_rootLayerUpdateCount, 1000.0 * (endTime - startTime));
 #endif
     ASSERT(updateRoot || !m_compositingLayersNeedUpdate);
 }
 
-bool RenderLayerCompositor::updateLayerCompositingState(RenderLayer* layer, StyleDifference diff)
+bool RenderLayerCompositor::updateLayerCompositingState(RenderLayer* layer, CompositingChangeRepaint shouldRepaint)
 {
     bool needsLayer = needsToBeComposited(layer);
     bool layerChanged = false;
 
-    RenderBoxModelObject* repaintContainer = 0;
-    IntRect repaintRect;
-
     if (needsLayer) {
         enableCompositingMode();
         if (!layer->backing()) {
-            // Get the repaint container before we make backing for this layer
-            repaintContainer = layer->renderer()->containerForRepaint();
-            repaintRect = calculateCompositedBounds(layer, repaintContainer ? repaintContainer->layer() : layer->root());
+
+            // If we need to repaint, do so before making backing
+            if (shouldRepaint == CompositingChangeRepaintNow)
+                repaintOnCompositingChange(layer);
 
             layer->ensureBacking();
             layerChanged = true;
@@ -181,37 +193,37 @@
     } else {
         if (layer->backing()) {
             layer->clearBacking();
-            // Get the repaint container now that we've cleared the backing
-            repaintContainer = layer->renderer()->containerForRepaint();
-            repaintRect = calculateCompositedBounds(layer, repaintContainer ? repaintContainer->layer() : layer->root());
             layerChanged = true;
+
+            // If we need to repaint, do so now that we've removed the backing
+            if (shouldRepaint == CompositingChangeRepaintNow)
+                repaintOnCompositingChange(layer);
         }
     }
     
-    if (layerChanged) {
-        // Invalidate the destination into which this layer used to render.
-        layer->renderer()->repaintUsingContainer(repaintContainer, repaintRect);
-
-        if (!repaintContainer || repaintContainer == m_renderView) {
-            // The contents of this layer may be moving between the window
-            // and a GraphicsLayer, so we need to make sure the window system
-            // synchronizes those changes on the screen.
-            m_renderView->frameView()->setNeedsOneShotDrawingSynchronization();
-        }
-    }
-
-    if (!needsLayer)
-        return layerChanged;
-
-    if (layer->backing()->updateGraphicsLayers(needsContentsCompositingLayer(layer),
-                                               clippedByAncestor(layer),
-                                               clipsCompositingDescendants(layer),
-                                               diff >= StyleDifferenceRepaint))
+    // See if we need content or clipping layers. Methods called here should assume
+    // that the compositing state of descendant layers has not been updated yet.
+    if (layer->backing() && layer->backing()->updateGraphicsLayerConfiguration())
         layerChanged = true;
 
     return layerChanged;
 }
 
+void RenderLayerCompositor::repaintOnCompositingChange(RenderLayer* layer)
+{
+    RenderBoxModelObject* repaintContainer = layer->renderer()->containerForRepaint();
+    if (!repaintContainer)
+        repaintContainer = m_renderView;
+
+    layer->repaintIncludingNonCompositingDescendants(repaintContainer);
+    if (repaintContainer == m_renderView) {
+        // The contents of this layer may be moving between the window
+        // and a GraphicsLayer, so we need to make sure the window system
+        // synchronizes those changes on the screen.
+        m_renderView->frameView()->setNeedsOneShotDrawingSynchronization();
+    }
+}
+
 // The bounds of the GraphicsLayer created for a compositing layer is the union of the bounds of all the descendant
 // RenderLayers that are rendered by the composited RenderLayer.
 IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* layer, const RenderLayer* ancestorLayer, IntRect* layerBoundingBox)
@@ -254,7 +266,7 @@
         }
     }
 
-    if (!layer->isComposited() && layer->transform()) {
+    if (layer->paintsWithTransform()) {
         TransformationMatrix* affineTrans = layer->transform();
         boundingBoxRect = affineTrans->mapRect(boundingBoxRect);
         unionBounds = affineTrans->mapRect(unionBounds);
@@ -330,11 +342,15 @@
     layer->setHasCompositingDescendant(false);
     layer->setMustOverlayCompositedLayers(ioCompState.m_subtreeIsCompositing);
     
-    const bool isCompositingLayer = needsToBeComposited(layer);
-    ioCompState.m_subtreeIsCompositing = isCompositingLayer;
+    const bool willBeComposited = needsToBeComposited(layer);
+    // If we are going to become composited, repaint the old rendering destination
+    if (!layer->isComposited() && willBeComposited)
+        repaintOnCompositingChange(layer);
+
+    ioCompState.m_subtreeIsCompositing = willBeComposited;
 
     CompositingState childState = ioCompState;
-    if (isCompositingLayer)
+    if (willBeComposited)
         childState.m_compositingAncestor = layer;
 
     // The children of this stacking context don't need to composite, unless there is
@@ -412,12 +428,6 @@
         hostingLayer->addChild(hostedLayer);
     } else
         childLayer->backing()->childForSuperlayers()->removeFromParent();
-    
-    // FIXME: setCompositingParent() is only called at present by rebuildCompositingLayerTree(),
-    // which calls updateGraphicsLayerGeometry via updateLayerCompositingState(), so this should
-    // be optimized.
-    if (parentLayer)
-        childLayer->backing()->updateGraphicsLayerGeometry();
 }
 
 void RenderLayerCompositor::removeCompositedChildren(RenderLayer* layer)
@@ -443,7 +453,12 @@
 
 void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState& ioCompState)
 {
-    updateLayerCompositingState(layer, StyleDifferenceEqual);
+    bool wasComposited = layer->isComposited();
+
+    // Make the layer compositing if necessary, and set up clipping and content layers.
+    // Note that we can only do work here that is independent of whether the descendant layers
+    // have been processed. computeCompositingRequirements() will already have done the repaint if necessary.
+    updateLayerCompositingState(layer, CompositingChangeWillRepaintLater);
 
     // host the document layer in the RenderView's root layer
     if (layer->isRootLayer())
@@ -460,7 +475,7 @@
     RenderLayerBacking* layerBacking = layer->backing();
     
     // FIXME: make this more incremental
-    if (layer->isComposited()) {
+    if (layerBacking) {
         layerBacking->parentForSublayers()->removeAllChildren();
         layerBacking->updateInternalHierarchy();
     }
@@ -513,6 +528,15 @@
             }
         }
     }
+    
+    if (layerBacking) {
+        // Do work here that requires that we've processed all of the descendant layers
+        layerBacking->updateGraphicsLayerGeometry();
+    } else if (wasComposited) {
+        // We stopped being a compositing layer. Now that our descendants have been udated, we can
+        // repaint our new rendering destination.
+        repaintOnCompositingChange(layer);
+    }
 }
 
 void RenderLayerCompositor::repaintCompositedLayersAbsoluteRect(const IntRect& absRect)
@@ -747,7 +771,7 @@
     m_rootPlatformLayer->setSize(FloatSize(m_renderView->docWidth(), m_renderView->docHeight()));
     m_rootPlatformLayer->setPosition(FloatPoint(0, 0));
 
-    if (GraphicsLayer::graphicsContextsFlipped())
+    if (GraphicsLayer::compositingCoordinatesOrientation() == GraphicsLayer::CompositingCoordinatesBottomUp)
         m_rootPlatformLayer->setChildrenTransform(flipTransform());
 
     // Need to clip to prevent transformed content showing outside this frame
diff --git a/WebCore/rendering/RenderLayerCompositor.h b/WebCore/rendering/RenderLayerCompositor.h
index dfceb1f..76cb35f 100644
--- a/WebCore/rendering/RenderLayerCompositor.h
+++ b/WebCore/rendering/RenderLayerCompositor.h
@@ -57,15 +57,28 @@
     void setCompositingLayersNeedUpdate(bool needUpdate = true);
     bool compositingLayersNeedUpdate() const { return m_compositingLayersNeedUpdate; }
 
+    void scheduleViewUpdate();
+    
     // Rebuild the tree of compositing layers
     void updateCompositingLayers(RenderLayer* updateRoot = 0);
 
-    // Update the compositing state of the given layer. Returns true if that state changed
-    bool updateLayerCompositingState(RenderLayer*, StyleDifference);
+    // Update the compositing state of the given layer. Returns true if that state changed.
+    enum CompositingChangeRepaint { CompositingChangeRepaintNow, CompositingChangeWillRepaintLater };
+    bool updateLayerCompositingState(RenderLayer*, CompositingChangeRepaint = CompositingChangeRepaintNow);
 
+    // Whether layer's backing needs a graphics layer to do clipping by an ancestor (non-stacking-context parent with overflow).
+    bool clippedByAncestor(RenderLayer*) const;
+    // Whether layer's backing needs a graphics layer to clip z-order children of the given layer.
+    bool clipsCompositingDescendants(const RenderLayer*) const;
+
+    // Whether the given layer needs an extra 'contents' layer.
+    bool needsContentsCompositingLayer(const RenderLayer*) const;
     // Return the bounding box required for compositing layer and its childern, relative to ancestorLayer.
     // If layerBoundingBox is not 0, on return it contains the bounding box of this layer only.
     IntRect calculateCompositedBounds(const RenderLayer* layer, const RenderLayer* ancestorLayer, IntRect* layerBoundingBox = 0);
+
+    // Repaint the appropriate layers when the given RenderLayer starts or stops being composited.
+    void repaintOnCompositingChange(RenderLayer*);
     
     // Notify us that a layer has been added or removed
     void layerWasAdded(RenderLayer* parent, RenderLayer* child);
@@ -95,14 +108,6 @@
     // Whether the layer has an intrinsic need for compositing layer.
     bool requiresCompositingLayer(const RenderLayer*) const;
 
-    // Whether we need a graphics layer to do clipping by an ancestor (non-stacking-context parent with overflow).
-    bool clippedByAncestor(RenderLayer*) const;
-    // Whether we need a graphics layer to clip z-order children of the given layer.
-    bool clipsCompositingDescendants(const RenderLayer*) const;
-
-    // Whether the given layer needs an extra 'contents' layer.
-    bool needsContentsCompositingLayer(const RenderLayer*) const;
-
     // Repaint the given rect (which is layer's coords), and regions of child layers that intersect that rect.
     void recursiveRepaintLayerRect(RenderLayer* layer, const IntRect& rect);
 
diff --git a/WebCore/rendering/RenderListBox.cpp b/WebCore/rendering/RenderListBox.cpp
index 50b406b..83c569e 100644
--- a/WebCore/rendering/RenderListBox.cpp
+++ b/WebCore/rendering/RenderListBox.cpp
@@ -42,7 +42,6 @@
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
-#include "HTMLSelectElement.h"
 #include "HitTestResult.h"
 #include "OptionGroupElement.h"
 #include "OptionElement.h"
@@ -51,6 +50,7 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Scrollbar.h"
+#include "SelectElement.h"
 #include "SelectionController.h"
 #include "NodeRenderStyle.h"
 #include <math.h>
@@ -72,7 +72,7 @@
 // widget, but I'm not sure this is right for the new control.
 const int baselineAdjustment = 7;
 
-RenderListBox::RenderListBox(HTMLSelectElement* element)
+RenderListBox::RenderListBox(Element* element)
     : RenderBlock(element)
     , m_optionsChanged(true)
     , m_scrollToRevealSelectionAfterLayout(false)
@@ -96,12 +96,12 @@
 void RenderListBox::updateFromElement()
 {
     if (m_optionsChanged) {
-        const Vector<HTMLElement*>& listItems = static_cast<HTMLSelectElement*>(node())->listItems();
+        const Vector<Element*>& listItems = toSelectElement(static_cast<Element*>(node()))->listItems();
         int size = numItems();
         
         float width = 0;
         for (int i = 0; i < size; ++i) {
-            HTMLElement* element = listItems[i];
+            Element* element = listItems[i];
             String text;
             Font itemFont = style()->font();
             if (OptionElement* optionElement = toOptionElement(element))
@@ -151,7 +151,7 @@
 
 void RenderListBox::scrollToRevealSelection()
 {    
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
 
     m_scrollToRevealSelectionAfterLayout = false;
 
@@ -197,7 +197,7 @@
 
 int RenderListBox::size() const
 {
-    int specifiedSize = static_cast<HTMLSelectElement*>(node())->size();
+    int specifiedSize = toSelectElement(static_cast<Element*>(node()))->size();
     if (specifiedSize > 1)
         return max(minSize, specifiedSize);
     return min(max(minSize, numItems()), maxDefaultSize);
@@ -211,7 +211,7 @@
 
 int RenderListBox::numItems() const
 {
-    return static_cast<HTMLSelectElement*>(node())->listItems().size();
+    return toSelectElement(static_cast<Element*>(node()))->listItems().size();
 }
 
 int RenderListBox::listHeight() const
@@ -293,9 +293,9 @@
 
 void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, int listIndex)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    const Vector<HTMLElement*>& listItems = select->listItems();
-    HTMLElement* element = listItems[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    const Vector<Element*>& listItems = select->listItems();
+    Element* element = listItems[listIndex];
     OptionElement* optionElement = toOptionElement(element);
 
     String itemText;
@@ -324,7 +324,7 @@
     paintInfo.context->setFillColor(textColor);
 
     Font itemFont = style()->font();
-    if (element->hasTagName(optgroupTag)) {
+    if (isOptionGroupElement(element)) {
         FontDescription d = itemFont.fontDescription();
         d.setWeight(d.bolderWeight());
         itemFont = Font(d, itemFont.letterSpacing(), itemFont.wordSpacing());
@@ -342,9 +342,9 @@
 
 void RenderListBox::paintItemBackground(PaintInfo& paintInfo, int tx, int ty, int listIndex)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    const Vector<HTMLElement*>& listItems = select->listItems();
-    HTMLElement* element = listItems[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    const Vector<Element*>& listItems = select->listItems();
+    Element* element = listItems[listIndex];
     OptionElement* optionElement = toOptionElement(element);
 
     Color backColor;
@@ -438,7 +438,7 @@
         return;
 
     m_inAutoscroll = true;
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     select->updateListBoxSelection(!select->multiple());
     m_inAutoscroll = false;
 }
@@ -468,7 +468,7 @@
 
     int endIndex = scrollToward(pos);
     if (endIndex >= 0) {
-        HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+        SelectElement* select = toSelectElement(static_cast<Element*>(node()));
         m_inAutoscroll = true;
 
         if (!select->multiple())
@@ -482,7 +482,7 @@
 
 void RenderListBox::stopAutoscroll()
 {
-    static_cast<HTMLSelectElement*>(node())->listBoxOnChange();
+    toSelectElement(static_cast<Element*>(node()))->listBoxOnChange();
 }
 
 bool RenderListBox::scrollToRevealElementAtListIndex(int index)
@@ -515,9 +515,10 @@
 
 void RenderListBox::valueChanged(unsigned listIndex)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    Element* element = static_cast<Element*>(node());
+    SelectElement* select = toSelectElement(element);
     select->setSelectedIndex(select->listToOptionIndex(listIndex));
-    select->onChange();
+    element->dispatchFormControlChangeEvent();
 }
 
 void RenderListBox::valueChanged(Scrollbar*)
@@ -527,7 +528,7 @@
         m_indexOffset = newOffset;
         repaint();
         // Fire the scroll DOM event.
-        node()->dispatchEventForType(eventNames().scrollEvent, false, false);
+        node()->dispatchEvent(eventNames().scrollEvent, false, false);
     }
 }
 
@@ -583,13 +584,13 @@
 {
     if (!RenderBlock::nodeAtPoint(request, result, x, y, tx, ty, hitTestAction))
         return false;
-    const Vector<HTMLElement*>& listItems = static_cast<HTMLSelectElement*>(node())->listItems();
+    const Vector<Element*>& listItems = toSelectElement(static_cast<Element*>(node()))->listItems();
     int size = numItems();
     tx += this->x();
     ty += this->y();
     for (int i = 0; i < size; ++i) {
         if (itemBoundingBoxRect(tx, ty, i).contains(x, y)) {
-            if (HTMLElement* node = listItems[i]) {
+            if (Element* node = listItems[i]) {
                 result.setInnerNode(node);
                 if (!result.innerNonSharedNode())
                     result.setInnerNonSharedNode(node);
diff --git a/WebCore/rendering/RenderListBox.h b/WebCore/rendering/RenderListBox.h
index acc313f..b8c0540 100644
--- a/WebCore/rendering/RenderListBox.h
+++ b/WebCore/rendering/RenderListBox.h
@@ -36,11 +36,9 @@
 
 namespace WebCore {
 
-class HTMLSelectElement;
-
 class RenderListBox : public RenderBlock, private ScrollbarClient {
 public:
-    RenderListBox(HTMLSelectElement*);
+    RenderListBox(Element*);
     ~RenderListBox();
 
     virtual const char* renderName() const { return "RenderListBox"; }
diff --git a/WebCore/rendering/RenderListMarker.cpp b/WebCore/rendering/RenderListMarker.cpp
index 32b5999..9627711 100644
--- a/WebCore/rendering/RenderListMarker.cpp
+++ b/WebCore/rendering/RenderListMarker.cpp
@@ -28,7 +28,6 @@
 #include "CharacterNames.h"
 #include "Document.h"
 #include "GraphicsContext.h"
-#include "ListMarkerBox.h"
 #include "RenderLayer.h"
 #include "RenderListItem.h"
 #include "RenderView.h"
@@ -508,9 +507,9 @@
 
 InlineBox* RenderListMarker::createInlineBox()
 {
-    ListMarkerBox* box = new (renderArena()) ListMarkerBox(this);
-    m_inlineBoxWrapper = box;
-    return box;
+    InlineBox* result = RenderBox::createInlineBox();
+    result->setIsText(isText());
+    return result;
 }
 
 bool RenderListMarker::isImage() const
diff --git a/WebCore/rendering/RenderMedia.cpp b/WebCore/rendering/RenderMedia.cpp
index 42cd709..2ffa2f6 100644
--- a/WebCore/rendering/RenderMedia.cpp
+++ b/WebCore/rendering/RenderMedia.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,17 +28,11 @@
 #if ENABLE(VIDEO)
 #include "RenderMedia.h"
 
-#include "CSSStyleSelector.h"
-#include "Event.h"
 #include "EventNames.h"
 #include "FloatConversion.h"
-#include "FrameView.h"
-#include "GraphicsContext.h"
-#include "HTMLMediaElement.h"
 #include "HTMLNames.h"
 #include "MediaControlElements.h"
 #include "MouseEvent.h"
-#include "MediaPlayer.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 
@@ -46,6 +40,8 @@
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 static const double cTimeUpdateRepeatDelay = 0.2;
 static const double cOpacityAnimationRepeatDelay = 0.05;
 // FIXME get this from style
@@ -145,28 +141,11 @@
     }
 }
 
-const RenderObjectChildList* RenderMedia::children() const
-{
-    return m_controlsShadowRoot ? m_controlsShadowRoot->renderer()->virtualChildren() : 0; 
-}
-
-RenderObjectChildList* RenderMedia::children()
-{
-    return m_controlsShadowRoot ? m_controlsShadowRoot->renderer()->virtualChildren() : 0; 
-}
-   
-void RenderMedia::removeChild(RenderObject* child)
-{
-    ASSERT(m_controlsShadowRoot);
-    ASSERT(child == m_controlsShadowRoot->renderer());
-    child->removeLayers(enclosingLayer());
-    static_cast<RenderMediaControlShadowRoot*>(child)->setParent(0);
-}
-    
 void RenderMedia::createControlsShadowRoot()
 {
     ASSERT(!m_controlsShadowRoot);
     m_controlsShadowRoot = new MediaControlShadowRootElement(document(), mediaElement());
+    addChild(m_controlsShadowRoot->renderer());
 }
 
 void RenderMedia::createPanel()
@@ -233,6 +212,7 @@
 {
     ASSERT(!m_timeline);
     m_timeline = new MediaControlTimelineElement(document(), mediaElement());
+    m_timeline->setAttribute(precisionAttr, "float");
     m_timeline->attachToParent(m_timelineContainer.get());
 }
   
diff --git a/WebCore/rendering/RenderMedia.h b/WebCore/rendering/RenderMedia.h
index 0e56dab..6013d7b 100644
--- a/WebCore/rendering/RenderMedia.h
+++ b/WebCore/rendering/RenderMedia.h
@@ -51,10 +51,9 @@
     
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
-    const RenderObjectChildList* children() const;
-    RenderObjectChildList* children();
+    const RenderObjectChildList* children() const { return &m_children; }
+    RenderObjectChildList* children() { return &m_children; }
 
-    virtual void removeChild(RenderObject*);
     virtual void destroy();
     
     virtual void layout();
@@ -111,6 +110,7 @@
     RefPtr<HTMLElement> m_timelineContainer;
     RefPtr<MediaTimeDisplayElement> m_currentTimeDisplay;
     RefPtr<MediaTimeDisplayElement> m_timeRemainingDisplay;
+    RenderObjectChildList m_children;
     Node* m_lastUnderNode;
     Node* m_nodeUnderMouse;
     
diff --git a/WebCore/rendering/RenderMediaControls.cpp b/WebCore/rendering/RenderMediaControls.cpp
new file mode 100644
index 0000000..f1ff55f
--- /dev/null
+++ b/WebCore/rendering/RenderMediaControls.cpp
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RenderMediaControls.h"
+
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#include "RenderThemeSafari.h"
+#include "SoftLinking.h"
+#include <CoreGraphics/CoreGraphics.h>
+ 
+using namespace std;
+ 
+namespace WebCore {
+
+#if !defined(NDEBUG) && defined(USE_DEBUG_SAFARI_THEME)
+SOFT_LINK_DEBUG_LIBRARY(SafariTheme)
+#else
+SOFT_LINK_LIBRARY(SafariTheme)
+#endif
+
+SOFT_LINK(SafariTheme, paintThemePart, void, __stdcall, (ThemePart part, CGContextRef context, const CGRect& rect, NSControlSize size, ThemeControlState state), (part, context, rect, size, state))
+SOFT_LINK(SafariTheme, STPaintProgressIndicator, void, APIENTRY, (ProgressIndicatorType type, CGContextRef context, const CGRect& rect, NSControlSize size, ThemeControlState state, float value), (type, context, rect, size, state, value))
+
+#if ENABLE(VIDEO)
+
+static ThemeControlState determineState(RenderObject* o)
+{
+    ThemeControlState result = 0;
+    if (theme()->isActive(o))
+        result |= SafariTheme::ActiveState;
+    if (theme()->isEnabled(o) && !theme()->isReadOnlyControl(o))
+        result |= SafariTheme::EnabledState;
+    if (theme()->isPressed(o))
+        result |= SafariTheme::PressedState;
+    if (theme()->isChecked(o))
+        result |= SafariTheme::CheckedState;
+    if (theme()->isIndeterminate(o))
+        result |= SafariTheme::IndeterminateCheckedState;
+    if (theme()->isFocused(o))
+        result |= SafariTheme::FocusedState;
+    if (theme()->isDefault(o))
+        result |= SafariTheme::DefaultState;
+    return result;
+}
+
+static const int mediaSliderThumbWidth = 13;
+static const int mediaSliderThumbHeight = 14;
+
+void RenderMediaControls::adjustMediaSliderThumbSize(RenderObject* o)
+{
+    if (o->style()->appearance() != MediaSliderThumbPart)
+        return;
+
+    float zoomLevel = o->style()->effectiveZoom();
+    o->style()->setWidth(Length(static_cast<int>(mediaSliderThumbWidth * zoomLevel), Fixed));
+    o->style()->setHeight(Length(static_cast<int>(mediaSliderThumbHeight * zoomLevel), Fixed));
+}
+
+static HTMLMediaElement* parentMediaElement(RenderObject* o)
+{
+    Node* node = o->node();
+    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
+        return 0;
+
+    return static_cast<HTMLMediaElement*>(mediaNode);
+}
+
+bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    ASSERT(SafariThemeLibrary());
+
+    switch (part) {
+        case MediaFullscreenButton:
+            paintThemePart(SafariTheme::MediaFullscreenButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaMuteButton:
+        case MediaUnMuteButton:
+            if (HTMLMediaElement* mediaElement = parentMediaElement(o))
+                paintThemePart(mediaElement->muted() ? SafariTheme::MediaUnMuteButtonPart : SafariTheme::MediaMuteButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaPauseButton:
+        case MediaPlayButton:
+            if (HTMLMediaElement* mediaElement = parentMediaElement(o))
+                paintThemePart(mediaElement->canPlay() ? SafariTheme::MediaPlayButtonPart : SafariTheme::MediaPauseButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaSeekBackButton:
+            paintThemePart(SafariTheme::MediaSeekBackButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaSeekForwardButton:
+            paintThemePart(SafariTheme::MediaSeekForwardButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaSlider: {
+            HTMLMediaElement* mediaElement = parentMediaElement(o);
+            if (!mediaElement)
+                break;
+
+            MediaPlayer* player = mediaElement->player();
+            float duration = player ? player->duration() : 0;
+            float percentLoaded = duration ? player->maxTimeBuffered() /duration : 0;
+
+            STPaintProgressIndicator(SafariTheme::MediaType, paintInfo.context->platformContext(), r, NSRegularControlSize, 0, percentLoaded);
+            break;
+        }
+        case MediaSliderThumb:
+            paintThemePart(SafariTheme::MediaSliderThumbPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            break;
+        case MediaTimelineContainer:
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaCurrentTimeDisplay:
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaTimeRemainingDisplay:
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaControlsPanel:
+            ASSERT_NOT_REACHED();
+            break;
+    }
+    return false;
+}
+
+#endif  // #if ENABLE(VIDEO)
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/network/cf/ResourceResponseCFNet.h b/WebCore/rendering/RenderMediaControls.h
similarity index 65%
copy from WebCore/platform/network/cf/ResourceResponseCFNet.h
copy to WebCore/rendering/RenderMediaControls.h
index 27144c6..529dbac 100644
--- a/WebCore/platform/network/cf/ResourceResponseCFNet.h
+++ b/WebCore/rendering/RenderMediaControls.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,10 +10,10 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -23,17 +23,21 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef ResourceResponseCFNet_h
-#define ResourceResponseCFNet_h
+#ifndef RenderMediaControls_h
+#define RenderMediaControls_h
 
-typedef struct _CFURLResponse* CFURLResponseRef;
+#include "RenderObject.h"
+#include "MediaControlElements.h"
 
 namespace WebCore {
 
-    class ResourceResponse;
+class HTMLMediaElement;
+class RenderMediaControls {
+public:
+    static bool paintMediaControlsPart(MediaControlElementType, RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    static void adjustMediaSliderThumbSize(RenderObject*);
+};
 
-    void getResourceResponse(ResourceResponse& response, CFURLResponseRef cfResponse);
+} // namespace WebCore
 
-}
-
-#endif // ResourceResponseCFNet_h
+#endif // RenderMediaControls_h
diff --git a/WebCore/rendering/RenderMenuList.cpp b/WebCore/rendering/RenderMenuList.cpp
index d61c16b..95de7a2 100644
--- a/WebCore/rendering/RenderMenuList.cpp
+++ b/WebCore/rendering/RenderMenuList.cpp
@@ -27,7 +27,6 @@
 #include "CSSStyleSelector.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
-#include "HTMLSelectElement.h"
 #include "NodeRenderStyle.h"
 #include "OptionElement.h"
 #include "OptionGroupElement.h"
@@ -35,6 +34,7 @@
 #include "RenderBR.h"
 #include "RenderScrollbar.h"
 #include "RenderTheme.h"
+#include "SelectElement.h"
 #include <math.h>
 
 using namespace std;
@@ -43,7 +43,7 @@
 
 using namespace HTMLNames;
 
-RenderMenuList::RenderMenuList(HTMLSelectElement* element)
+RenderMenuList::RenderMenuList(Element* element)
     : RenderFlexibleBox(element)
     , m_buttonText(0)
     , m_innerBlock(0)
@@ -61,12 +61,6 @@
     m_popup = 0;
 }
 
-// this static cast is safe because RenderMenuLists are only created for HTMLSelectElements
-HTMLSelectElement* RenderMenuList::selectElement()
-{
-    return static_cast<HTMLSelectElement*>(node());
-}
-
 void RenderMenuList::createInnerBlock()
 {
     if (m_innerBlock) {
@@ -134,10 +128,10 @@
 void RenderMenuList::updateOptionsWidth()
 {
     float maxOptionWidth = 0;
-    const Vector<HTMLElement*>& listItems = static_cast<HTMLSelectElement*>(node())->listItems();
+    const Vector<Element*>& listItems = toSelectElement(static_cast<Element*>(node()))->listItems();
     int size = listItems.size();    
     for (int i = 0; i < size; ++i) {
-        HTMLElement* element = listItems[i];
+        Element* element = listItems[i];
         OptionElement* optionElement = toOptionElement(element);
         if (!optionElement)
             continue;
@@ -160,7 +154,8 @@
         return;
 
     m_optionsWidth = width;
-    setNeedsLayoutAndPrefWidthsRecalc();
+    if (parent())
+        setNeedsLayoutAndPrefWidthsRecalc();
 }
 
 void RenderMenuList::updateFromElement()
@@ -173,13 +168,13 @@
     if (m_popupIsVisible)
         m_popup->updateFromElement();
     else
-        setTextFromOption(static_cast<HTMLSelectElement*>(node())->selectedIndex());
+        setTextFromOption(toSelectElement(static_cast<Element*>(node()))->selectedIndex());
 }
 
 void RenderMenuList::setTextFromOption(int optionIndex)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    const Vector<HTMLElement*>& listItems = select->listItems();
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    const Vector<Element*>& listItems = select->listItems();
     int size = listItems.size();
 
     int i = select->optionToListIndex(optionIndex);
@@ -280,7 +275,7 @@
     createInnerBlock();
     if (!m_popup)
         m_popup = PopupMenu::create(this);
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     m_popupIsVisible = true;
 
     // Compute the top left taking transforms into account, but use
@@ -301,14 +296,14 @@
 
 void RenderMenuList::valueChanged(unsigned listIndex, bool fireOnChange)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     select->setSelectedIndex(select->listToOptionIndex(listIndex), true, fireOnChange);
 }
 
 String RenderMenuList::itemText(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
     if (OptionGroupElement* optionGroupElement = toOptionGroupElement(element))
         return optionGroupElement->groupLabelText();
     else if (OptionElement* optionElement = toOptionElement(element))
@@ -318,26 +313,26 @@
 
 bool RenderMenuList::itemIsEnabled(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
-    if (!element->hasTagName(optionTag))
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
+    if (!isOptionElement(element))
         return false;
-    bool groupEnabled = true;
-    if (element->parentNode() && element->parentNode()->hasTagName(optgroupTag)) {
-        FormControlElement* formControlElement = toFormControlElement(static_cast<Element*>(element->parentNode()));
-        groupEnabled = formControlElement->isEnabled();
-    }
 
+    bool groupEnabled = true;
+    if (Element* parentElement = element->parentElement()) {
+        if (isOptionGroupElement(parentElement))
+            groupEnabled = parentElement->isEnabledFormControl();
+    }
     if (!groupEnabled)
         return false;
 
-    return toFormControlElement(element)->isEnabled();
+    return element->isEnabledFormControl();
 }
 
 PopupMenuStyle RenderMenuList::itemStyle(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
     
     RenderStyle* style = element->renderStyle() ? element->renderStyle() : element->computedStyle();
     return style ? PopupMenuStyle(style->color(), itemBackgroundColor(listIndex), style->font(), style->visibility() == VISIBLE, style->textIndent(), style->direction()) : menuStyle();
@@ -345,8 +340,8 @@
 
 Color RenderMenuList::itemBackgroundColor(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
 
     Color backgroundColor;
     if (element->renderStyle())
@@ -409,34 +404,34 @@
 
 int RenderMenuList::listSize() const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     return select->listItems().size();
 }
 
 int RenderMenuList::selectedIndex() const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     return select->optionToListIndex(select->selectedIndex());
 }
 
 bool RenderMenuList::itemIsSeparator(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
     return element->hasTagName(hrTag);
 }
 
 bool RenderMenuList::itemIsLabel(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
-    return element->hasTagName(optgroupTag);
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
+    return isOptionGroupElement(element);
 }
 
 bool RenderMenuList::itemIsSelected(unsigned listIndex) const
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
-    HTMLElement* element = select->listItems()[listIndex];
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
     if (OptionElement* optionElement = toOptionElement(element))
         return optionElement->selected();
     return false;
@@ -444,7 +439,7 @@
 
 void RenderMenuList::setTextFromItem(unsigned listIndex)
 {
-    HTMLSelectElement* select = static_cast<HTMLSelectElement*>(node());
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
     setTextFromOption(select->listToOptionIndex(listIndex));
 }
 
diff --git a/WebCore/rendering/RenderMenuList.h b/WebCore/rendering/RenderMenuList.h
index f16525e..7966eff 100644
--- a/WebCore/rendering/RenderMenuList.h
+++ b/WebCore/rendering/RenderMenuList.h
@@ -34,16 +34,13 @@
 
 namespace WebCore {
 
-class HTMLSelectElement;
 class PopupMenu;
 class RenderText;
 
 class RenderMenuList : public RenderFlexibleBox, private PopupMenuClient {
 public:
-    RenderMenuList(HTMLSelectElement*);
+    RenderMenuList(Element*);
     ~RenderMenuList();
-    
-    HTMLSelectElement* selectElement();
 
 private:
     virtual bool isMenuList() const { return true; }
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index a9f6693..2aba22a 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -464,6 +464,7 @@
 
     if (hasLayer()) {
         RenderLayer* layer = toRenderBoxModelObject(this)->layer();
+        ASSERT(oldParent == layer->parent());
         if (oldParent)
             oldParent->removeChild(layer);
         newParent->addChild(layer);
@@ -1024,41 +1025,6 @@
                BSBottom, Color(oc), style->color(), os, ow, ow);
 }
 
-
-void RenderObject::absoluteRectsForRange(Vector<IntRect>& rects, unsigned start, unsigned end, bool)
-{
-    if (!firstChild()) {
-        if ((isInline() || isAnonymousBlock())) {
-            FloatPoint absPos = localToAbsolute(FloatPoint());
-            absoluteRects(rects, absPos.x(), absPos.y());
-        }
-        return;
-    }
-
-    unsigned offset = start;
-    for (RenderObject* child = childAt(start); child && offset < end; child = child->nextSibling(), ++offset) {
-        if (child->isText() || child->isInline() || child->isAnonymousBlock()) {
-            FloatPoint absPos = child->localToAbsolute(FloatPoint());
-            child->absoluteRects(rects, absPos.x(), absPos.y());
-        }
-    }
-}
-
-void RenderObject::absoluteQuadsForRange(Vector<FloatQuad>& quads, unsigned start, unsigned end, bool)
-{
-    if (!firstChild()) {
-        if (isInline() || isAnonymousBlock())
-            absoluteQuads(quads);
-        return;
-    }
-
-    unsigned offset = start;
-    for (RenderObject* child = childAt(start); child && offset < end; child = child->nextSibling(), ++offset) {
-        if (child->isText() || child->isInline() || child->isAnonymousBlock())
-            child->absoluteQuads(quads);
-    }
-}
-
 IntRect RenderObject::absoluteBoundingBoxRect(bool useTransforms)
 {
     if (useTransforms) {
@@ -1460,7 +1426,7 @@
 {
 #if USE(ACCELERATED_COMPOSITING)
     // If transform changed, and we are not composited, need to do a layout.
-    if (contextSensitiveProperties & ContextSensitivePropertyTransform)
+    if (contextSensitiveProperties & ContextSensitivePropertyTransform) {
         // Text nodes share style with their parents but transforms don't apply to them,
         // hence the !isText() check.
         // FIXME: when transforms are taken into account for overflow, we will need to do a layout.
@@ -1468,14 +1434,16 @@
             diff = StyleDifferenceLayout;
         else if (diff < StyleDifferenceRecompositeLayer)
             diff = StyleDifferenceRecompositeLayer;
+    }
 
     // If opacity changed, and we are not composited, need to repaint (also
     // ignoring text nodes)
-    if (contextSensitiveProperties & ContextSensitivePropertyOpacity)
+    if (contextSensitiveProperties & ContextSensitivePropertyOpacity) {
         if (!isText() && (!hasLayer() || !toRenderBoxModelObject(this)->layer()->isComposited()))
             diff = StyleDifferenceRepaintLayer;
         else if (diff < StyleDifferenceRecompositeLayer)
             diff = StyleDifferenceRecompositeLayer;
+    }
 #else
     UNUSED_PARAM(contextSensitiveProperties);
 #endif
@@ -1549,12 +1517,15 @@
         // If our z-index changes value or our visibility changes,
         // we need to dirty our stacking context's z-order list.
         if (newStyle) {
+            bool visibilityChanged = m_style->visibility() != newStyle->visibility() 
+                || m_style->zIndex() != newStyle->zIndex() 
+                || m_style->hasAutoZIndex() != newStyle->hasAutoZIndex();
 #if ENABLE(DASHBOARD_SUPPORT)
-            if (m_style->visibility() != newStyle->visibility() ||
-                    m_style->zIndex() != newStyle->zIndex() ||
-                    m_style->hasAutoZIndex() != newStyle->hasAutoZIndex())
+            if (visibilityChanged)
                 document()->setDashboardRegionsDirty(true);
 #endif
+            if (visibilityChanged && AXObjectCache::accessibilityEnabled())
+                document()->axObjectCache()->childrenChanged(this);
 
             // Keep layer hierarchy visibility bits up to date if visibility changes.
             if (m_style->visibility() != newStyle->visibility()) {
@@ -1700,25 +1671,26 @@
     }
 }
 
-TransformationMatrix RenderObject::transformFromContainer(const RenderObject* containerObject, const IntSize& offsetInContainer) const
+bool RenderObject::shouldUseTransformFromContainer(const RenderObject* containerObject) const
 {
-    TransformationMatrix containerTransform;
-#ifdef ANDROID_FASTER_MATRIX
-    RenderLayer* layer;
-    const double tx = offsetInContainer.width();
-    const double ty = offsetInContainer.height();
-    if (hasLayer() && (layer = toRenderBox(this)->layer()) && layer->transform()) {
-        containerTransform = layer->currentTransform();
-        containerTransform.translateRight(tx, ty);
-    } else
-        containerTransform.translate(tx, ty);
+#if ENABLE(3D_RENDERING)
+    // hasTransform() indicates whether the object has transform, transform-style or perspective. We just care about transform,
+    // so check the layer's transform directly.
+    return (hasLayer() && toRenderBoxModelObject(this)->layer()->transform()) || (containerObject && containerObject->style()->hasPerspective());
 #else
-    containerTransform.translate(offsetInContainer.width(), offsetInContainer.height());
-    RenderLayer* layer;
-    if (hasLayer() && (layer = toRenderBox(this)->layer()) && layer->transform())
-        containerTransform.multLeft(layer->currentTransform());
+    UNUSED_PARAM(containerObject);
+    return hasTransform();
 #endif
+}
 
+void RenderObject::getTransformFromContainer(const RenderObject* containerObject, const IntSize& offsetInContainer, TransformationMatrix& transform) const
+{
+    transform.makeIdentity();
+    transform.translate(offsetInContainer.width(), offsetInContainer.height());
+    RenderLayer* layer;
+    if (hasLayer() && (layer = toRenderBoxModelObject(this)->layer()) && layer->transform())
+        transform.multLeft(layer->currentTransform());
+    
 #if ENABLE(3D_RENDERING)
     if (containerObject && containerObject->style()->hasPerspective()) {
         // Perpsective on the container affects us, so we have to factor it in here.
@@ -1728,15 +1700,13 @@
         TransformationMatrix perspectiveMatrix;
         perspectiveMatrix.applyPerspective(containerObject->style()->perspective());
         
-        containerTransform.translateRight3d(-perspectiveOrigin.x(), -perspectiveOrigin.y(), 0);
-        containerTransform.multiply(perspectiveMatrix);
-        containerTransform.translateRight3d(perspectiveOrigin.x(), perspectiveOrigin.y(), 0);
+        transform.translateRight3d(-perspectiveOrigin.x(), -perspectiveOrigin.y(), 0);
+        transform.multiply(perspectiveMatrix);
+        transform.translateRight3d(perspectiveOrigin.x(), perspectiveOrigin.y(), 0);
     }
 #else
     UNUSED_PARAM(containerObject);
 #endif
-
-    return containerTransform;
 }
 
 FloatQuad RenderObject::localToContainerQuad(const FloatQuad& localQuad, RenderBoxModelObject* repaintContainer, bool fixed) const
@@ -1865,8 +1835,10 @@
 
     // FIXME: Would like to do this in RenderBoxModelObject, but the timing is so complicated that this can't easily
     // be moved into RenderBoxModelObject::destroy.
-    if (hasLayer())
+    if (hasLayer()) {
+        setHasLayer(false);
         toRenderBoxModelObject(this)->destroyLayer();
+    }
     arenaDelete(renderArena(), this);
 }
 
@@ -1918,7 +1890,7 @@
     bool valueChanged = (dragOn != m_isDragging);
     m_isDragging = dragOn;
     if (valueChanged && style()->affectedByDragRules())
-        node()->setChanged();
+        node()->setNeedsStyleRecalc();
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling())
         curr->updateDragState(dragOn);
 }
@@ -2315,7 +2287,7 @@
 
 VisiblePosition RenderObject::createVisiblePosition(int offset, EAffinity affinity)
 {
-    // If is is a non-anonymous renderer, then it's simple.
+    // If this is a non-anonymous renderer, then it's simple.
     if (Node* node = this->node())
         return VisiblePosition(node, offset, affinity);
 
@@ -2340,7 +2312,7 @@
             if (renderer == parent)
                 break;
             if (Node* node = renderer->node())
-                return VisiblePosition(node, numeric_limits<int>::max(), DOWNSTREAM);
+                return VisiblePosition(lastDeepEditingPositionForNode(node), DOWNSTREAM);
         }
 
         // Use the parent itself unless it too is anonymous.
@@ -2366,8 +2338,17 @@
 
 #if ENABLE(SVG)
 
-FloatRect RenderObject::relativeBBox(bool) const
+FloatRect RenderObject::objectBoundingBox() const
 {
+    ASSERT_NOT_REACHED();
+    return FloatRect();
+}
+
+// Returns the smallest rectangle enclosing all of the painted content
+// respecting clipping, masking, filters, opacity, stroke-width and markers
+FloatRect RenderObject::repaintRectInLocalCoordinates() const
+{
+    ASSERT_NOT_REACHED();
     return FloatRect();
 }
 
@@ -2376,13 +2357,28 @@
     return TransformationMatrix();
 }
 
+TransformationMatrix RenderObject::localToParentTransform() const
+{
+    // FIXME: This double virtual call indirection is temporary until I can land the
+    // rest of the of the localToParentTransform() support for SVG.
+    return localTransform();
+}
+
 TransformationMatrix RenderObject::absoluteTransform() const
 {
+    // FIXME: This should use localToParentTransform(), but much of the SVG code
+    // depends on RenderBox::absoluteTransform() being the sum of the localTransform()s of all parent renderers.
     if (parent())
         return localTransform() * parent()->absoluteTransform();
     return localTransform();
 }
 
+bool RenderObject::nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint&, HitTestAction)
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 #endif // ENABLE(SVG)
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderObject.h b/WebCore/rendering/RenderObject.h
index a601962..0901bff 100644
--- a/WebCore/rendering/RenderObject.h
+++ b/WebCore/rendering/RenderObject.h
@@ -26,8 +26,9 @@
 #define RenderObject_h
 
 #include "CachedResourceClient.h"
-#include "FloatQuad.h"
 #include "Document.h"
+#include "Element.h"
+#include "FloatQuad.h"
 #include "RenderObjectChildList.h"
 #include "RenderStyle.h"
 #include "TextAffinity.h"
@@ -40,6 +41,7 @@
 class HitTestResult;
 class InlineBox;
 class InlineFlowBox;
+class OverlapTestRequestClient;
 class Position;
 class RenderBoxModelObject;
 class RenderInline;
@@ -287,16 +289,45 @@
     void setCellWidthChanged(bool b = true) { m_cellWidthChanged = b; }
 
 #if ENABLE(SVG)
+    // FIXME: Until all SVG renders can be subclasses of RenderSVGModelObject we have
+    // to add SVG renderer methods to RenderObject with an ASSERT_NOT_REACHED() default implementation.
     virtual bool isSVGRoot() const { return false; }
     virtual bool isSVGContainer() const { return false; }
     virtual bool isSVGHiddenContainer() const { return false; }
     virtual bool isRenderPath() const { return false; }
     virtual bool isSVGText() const { return false; }
+    virtual bool isSVGImage() const { return false; }
 
-    virtual FloatRect relativeBBox(bool includeStroke = true) const;
+    // Per SVG 1.1 objectBoundingBox ignores clipping, masking, filter effects, opacity and stroke-width.
+    // This is used for all computation of objectBoundingBox relative units and by SVGLocateable::getBBox().
+    // NOTE: Markers are not specifically ignored here by SVG 1.1 spec, but we ignore them
+    // since stroke-width is ignored (and marker size can depend on stroke-width).
+    // objectBoundingBox is returned local coordinates.
+    // The name objectBoundingBox is taken from the SVG 1.1 spec.
+    virtual FloatRect objectBoundingBox() const;
 
+    // Returns the smallest rectangle enclosing all of the painted content
+    // respecting clipping, masking, filters, opacity, stroke-width and markers
+    virtual FloatRect repaintRectInLocalCoordinates() const;
+
+    // FIXME: This accessor is deprecated and mostly around for SVGRenderTreeAsText.
+    // This only returns the transform="" value from the element
+    // most callsites want localToParentTransform() instead.
     virtual TransformationMatrix localTransform() const;
+
+    // Returns the full transform mapping from local coordinates to local coords for the parent SVG renderer
+    // This includes any viewport transforms and x/y offsets as well as the transform="" value off the element.
+    virtual TransformationMatrix localToParentTransform() const;
+
+    // Walks up the parent chain to create a transform which maps from local to document coords
+    // NOTE: This method is deprecated!  It doesn't respect scroll offsets or repaint containers.
+    // FIXME: This is only virtual so that RenderSVGHiddenContainer can override it to match old LayoutTest results.
     virtual TransformationMatrix absoluteTransform() const;
+
+    // SVG uses FloatPoint precise hit testing, and passes the point in parent
+    // coordinates instead of in repaint container coordinates.  Eventually the
+    // rest of the rendering tree will move to a similar model.
+    virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
 #endif
 
     bool isAnonymous() const { return m_isAnonymous; }
@@ -410,19 +441,23 @@
     // the offset of baseline from the top of the object.
     virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
 
+    typedef HashMap<OverlapTestRequestClient*, IntRect> OverlapTestRequestMap;
+
     /*
      * Paint the object and its children, clipped by (x|y|w|h).
      * (tx|ty) is the calculated position of the parent
      */
     struct PaintInfo {
         PaintInfo(GraphicsContext* newContext, const IntRect& newRect, PaintPhase newPhase, bool newForceBlackText,
-                  RenderObject* newPaintingRoot, ListHashSet<RenderInline*>* newOutlineObjects)
+                  RenderObject* newPaintingRoot, ListHashSet<RenderInline*>* newOutlineObjects,
+                  OverlapTestRequestMap* overlapTestRequests = 0)
             : context(newContext)
             , rect(newRect)
             , phase(newPhase)
             , forceBlackText(newForceBlackText)
             , paintingRoot(newPaintingRoot)
             , outlineObjects(newOutlineObjects)
+            , overlapTestRequests(overlapTestRequests)
         {
         }
 
@@ -432,6 +467,7 @@
         bool forceBlackText;
         RenderObject* paintingRoot; // used to draw just one element and its visual kids
         ListHashSet<RenderInline*>* outlineObjects; // used to list outlines that should be painted by a block with inline children
+        OverlapTestRequestMap* overlapTestRequests;
     };
 
     virtual void paint(PaintInfo&, int tx, int ty);
@@ -496,16 +532,13 @@
 
     // Return the offset from the container() renderer (excluding transforms)
     virtual IntSize offsetFromContainer(RenderObject*) const;
-
-    virtual void absoluteRectsForRange(Vector<IntRect>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
     
-    virtual void absoluteRects(Vector<IntRect>&, int, int, bool = true) { }
+    virtual void absoluteRects(Vector<IntRect>&, int, int) { }
     // FIXME: useTransforms should go away eventually
     IntRect absoluteBoundingBoxRect(bool useTransforms = false);
 
     // Build an array of quads in absolute coords for line boxes
-    virtual void absoluteQuadsForRange(Vector<FloatQuad>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool /*topLevel*/ = true) { }
+    virtual void absoluteQuads(Vector<FloatQuad>&) { }
 
     // the rect that will be painted if this object is passed as the paintingRoot
     IntRect paintingRootRect(IntRect& topLevelRect);
@@ -683,7 +716,8 @@
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
     virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
 
-    TransformationMatrix transformFromContainer(const RenderObject* container, const IntSize& offsetInContainer) const;
+    bool shouldUseTransformFromContainer(const RenderObject* container) const;
+    void getTransformFromContainer(const RenderObject* container, const IntSize& offsetInContainer, TransformationMatrix&) const;
     
     virtual void addFocusRingRects(GraphicsContext*, int /*tx*/, int /*ty*/) { };
 
diff --git a/WebCore/rendering/RenderPart.cpp b/WebCore/rendering/RenderPart.cpp
index 71e5f4e..bcf9ef9 100644
--- a/WebCore/rendering/RenderPart.cpp
+++ b/WebCore/rendering/RenderPart.cpp
@@ -1,10 +1,8 @@
-/**
- * This file is part of the KDE project.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,21 +20,15 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "RenderPart.h"
 
-#include "Document.h"
 #include "Frame.h"
-#include "FrameTree.h"
 #include "FrameView.h"
-#include "HTMLFrameOwnerElement.h"
-#include "HTMLNames.h"
-#include "Page.h"
 
 namespace WebCore {
 
-using namespace HTMLNames;
-
 RenderPart::RenderPart(Element* node)
     : RenderWidget(node)
 {
@@ -46,39 +38,37 @@
 
 RenderPart::~RenderPart()
 {
-    // Since deref ends up calling setWidget back on us, need to make sure
-    // that widget is already 0 so it won't do any work.
-    Widget* widget = m_widget;
-    m_widget = 0;
-    if (widget && widget->isFrameView())
-        static_cast<FrameView*>(widget)->deref();
-    else
-        delete widget;
+    clearWidget();
 }
 
 void RenderPart::setWidget(Widget* widget)
 {
-    if (widget != m_widget) {
-        if (widget && widget->isFrameView())
-            static_cast<FrameView*>(widget)->ref();
-        RenderWidget::setWidget(widget);
+    if (widget == this->widget())
+        return;
 
-        // make sure the scrollbars are set correctly for restore
-        // ### find better fix
-        viewCleared();
-    }
+    if (widget && widget->isFrameView())
+        static_cast<FrameView*>(widget)->ref();
+    RenderWidget::setWidget(widget);
+
+    // make sure the scrollbars are set correctly for restore
+    // ### find better fix
+    viewCleared();
 }
 
 void RenderPart::viewCleared()
 {
 }
 
-void RenderPart::deleteWidget()
+void RenderPart::deleteWidget(Widget* widget)
 {
-    if (m_widget && m_widget->isFrameView())
-        static_cast<FrameView*>(m_widget)->deref();
+    // Since deref ends up calling setWidget back on us, need to make sure
+    // that widget is already 0 so it won't do any work.
+    ASSERT(!this->widget());
+
+    if (widget && widget->isFrameView())
+        static_cast<FrameView*>(widget)->deref();
     else
-        delete m_widget;
+        delete widget;
 }
 
 }
diff --git a/WebCore/rendering/RenderPart.h b/WebCore/rendering/RenderPart.h
index 5a7ba26..e47ead0 100644
--- a/WebCore/rendering/RenderPart.h
+++ b/WebCore/rendering/RenderPart.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the KDE project.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,28 +27,24 @@
 
 namespace WebCore {
 
-class Frame;
-class HTMLFrameOwnerElement;
-
 class RenderPart : public RenderWidget {
 public:
     RenderPart(Element*);
     virtual ~RenderPart();
     
-    virtual bool isRenderPart() const { return true; }
-    virtual const char* renderName() const { return "RenderPart"; }
-
-    virtual void setWidget(Widget*);
-
     bool hasFallbackContent() const { return m_hasFallbackContent; }
 
+    virtual void setWidget(Widget*);
     virtual void viewCleared();
 
 protected:
     bool m_hasFallbackContent;
 
 private:
-    virtual void deleteWidget();
+    virtual bool isRenderPart() const { return true; }
+    virtual const char* renderName() const { return "RenderPart"; }
+
+    virtual void deleteWidget(Widget*);
 };
 
 }
diff --git a/WebCore/rendering/RenderPartObject.cpp b/WebCore/rendering/RenderPartObject.cpp
index 47a5954..2964e39 100644
--- a/WebCore/rendering/RenderPartObject.cpp
+++ b/WebCore/rendering/RenderPartObject.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,25 +25,22 @@
 #include "RenderPartObject.h"
 
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "FrameLoaderClient.h"
-#include "FrameTree.h"
-#include "FrameView.h"
 #include "HTMLEmbedElement.h"
 #include "HTMLIFrameElement.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
 #include "HTMLParamElement.h"
-#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-#include "HTMLMediaElement.h"
-#include "HTMLVideoElement.h"
-#endif
 #include "MIMETypeRegistry.h"
 #include "Page.h"
 #include "PluginData.h"
 #include "RenderView.h"
 #include "Text.h"
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#include "HTMLVideoElement.h"
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -61,8 +58,8 @@
 
 RenderPartObject::~RenderPartObject()
 {
-    if (m_view)
-        m_view->removeWidgetToUpdate(this);
+    if (frameView())
+        frameView()->removeWidgetToUpdate(this);
 }
 
 static bool isURLAllowed(Document* doc, const String& url)
@@ -151,7 +148,7 @@
     String serviceType;
     Vector<String> paramNames;
     Vector<String> paramValues;
-    Frame* frame = m_view->frame();
+    Frame* frame = frameView()->frame();
 
     if (node()->hasTagName(objectTag)) {
         HTMLObjectElement* o = static_cast<HTMLObjectElement*>(node());
@@ -229,7 +226,7 @@
         }
         
         // Turn the attributes of either the EMBED tag or OBJECT tag into arrays, but don't override PARAM values.
-        NamedAttrMap* attributes = embedOrObject->attributes();
+        NamedNodeMap* attributes = embedOrObject->attributes();
         if (attributes) {
             for (unsigned i = 0; i < attributes->length(); ++i) {
                 Attribute* it = attributes->attributeItem(i);
@@ -280,7 +277,7 @@
             return;
 
         // add all attributes set on the embed object
-        NamedAttrMap* a = o->attributes();
+        NamedNodeMap* a = o->attributes();
         if (a) {
             for (unsigned i = 0; i < a->length(); ++i) {
                 Attribute* it = a->attributeItem(i);
@@ -338,9 +335,9 @@
     // hidden. If that is the case, don't try to expand.
     int w = width();
     int h = height();
-    if (m_widget && m_widget->isFrameView() &&
+    if (widget() && widget()->isFrameView() &&
             w > 1 && h > 1) {
-        FrameView* view = static_cast<FrameView*>(m_widget);
+        FrameView* view = static_cast<FrameView*>(widget());
         RenderView* root = NULL;
         if (view->frame() && view->frame()->document() &&
             view->frame()->document()->renderer() && view->frame()->document()->renderer()->isRenderView())
@@ -386,8 +383,8 @@
 
     RenderPart::layout();
 
-    if (!m_widget && m_view)
-        m_view->addWidgetToUpdate(this);
+    if (!widget() && frameView())
+        frameView()->addWidgetToUpdate(this);
 
     setNeedsLayout(false);
 }
@@ -395,9 +392,9 @@
 #ifdef FLATTEN_IFRAME
 void RenderPartObject::calcWidth() {
     RenderPart::calcWidth();
-    if (!m_widget || !m_widget->isFrameView())
+    if (!widget() || !widget()->isFrameView())
         return;
-    FrameView* view = static_cast<FrameView*>(m_widget);
+    FrameView* view = static_cast<FrameView*>(widget());
     RenderView* root = static_cast<RenderView*>(view->frame()->contentRenderer());
     if (!root)
         return;
@@ -424,9 +421,9 @@
 
 void RenderPartObject::calcHeight() {
     RenderPart::calcHeight();
-    if (!m_widget || !m_widget->isFrameView())
+    if (!widget() || !widget()->isFrameView())
         return;
-    FrameView* view = static_cast<FrameView*>(m_widget);
+    FrameView* view = static_cast<FrameView*>(widget());
     RenderView* root = static_cast<RenderView*>(view->frame()->contentRenderer());
     if (!root)
         return;
@@ -450,8 +447,8 @@
 
 void RenderPartObject::viewCleared()
 {
-    if (node() && m_widget && m_widget->isFrameView()) {
-        FrameView* view = static_cast<FrameView*>(m_widget);
+    if (node() && widget() && widget()->isFrameView()) {
+        FrameView* view = static_cast<FrameView*>(widget());
         int marginw = -1;
         int marginh = -1;
         if (node()->hasTagName(iframeTag)) {
diff --git a/WebCore/rendering/RenderPartObject.h b/WebCore/rendering/RenderPartObject.h
index 9eb9f21..0370c9f 100644
--- a/WebCore/rendering/RenderPartObject.h
+++ b/WebCore/rendering/RenderPartObject.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the KDE project.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,6 +32,9 @@
     RenderPartObject(Element*);
     virtual ~RenderPartObject();
 
+    void updateWidget(bool onlyCreateNonNetscapePlugins);
+
+private:
     virtual const char* renderName() const { return "RenderPartObject"; }
 
 #ifdef FLATTEN_IFRAME
@@ -41,7 +42,6 @@
     virtual void calcHeight();
 #endif
     virtual void layout();
-    void updateWidget(bool onlyCreateNonNetscapePlugins);
 
     virtual void viewCleared();
 };
diff --git a/WebCore/rendering/RenderPath.cpp b/WebCore/rendering/RenderPath.cpp
index 1340694..4a7662f 100644
--- a/WebCore/rendering/RenderPath.cpp
+++ b/WebCore/rendering/RenderPath.cpp
@@ -2,8 +2,7 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
                   2005, 2007 Eric Seidel <eric@webkit.org>
-
-    This file is part of the KDE project
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -64,27 +63,21 @@
     RenderStyle* m_style;
 };
 
-// RenderPath
 RenderPath::RenderPath(SVGStyledTransformableElement* node)
-    : RenderObject(node)
+    : RenderSVGModelObject(node)
 {
 }
 
+TransformationMatrix RenderPath::localToParentTransform() const
+{
+    return m_localTransform;
+}
+
 TransformationMatrix RenderPath::localTransform() const
 {
     return m_localTransform;
 }
 
-FloatPoint RenderPath::mapAbsolutePointToLocal(const FloatPoint& point) const
-{
-    // FIXME: does it make sense to map incoming points with the inverse of the
-    // absolute transform? 
-    double localX;
-    double localY;
-    absoluteTransform().inverse().map(point.x(), point.y(), localX, localY);
-    return FloatPoint::narrowPrecision(localX, localY);
-}
-
 bool RenderPath::fillContains(const FloatPoint& point, bool requiresFill) const
 {
     if (m_path.isEmpty())
@@ -108,38 +101,45 @@
     return m_path.strokeContains(&strokeStyle, point);
 }
 
-FloatRect RenderPath::relativeBBox(bool includeStroke) const
+FloatRect RenderPath::objectBoundingBox() const
 {
     if (m_path.isEmpty())
         return FloatRect();
 
-    if (includeStroke) {
-        if (m_strokeBbox.isEmpty()) {
-            if (style()->svgStyle()->hasStroke()) {
-                BoundingRectStrokeStyleApplier strokeStyle(this, style());
-                m_strokeBbox = m_path.strokeBoundingRect(&strokeStyle);
-            } else {
-                if (m_fillBBox.isEmpty())
-                    m_fillBBox = m_path.boundingRect();
+    if (m_cachedLocalFillBBox.isEmpty())
+        m_cachedLocalFillBBox = m_path.boundingRect();
 
-                m_strokeBbox = m_fillBBox;
-            }
-        }
+    return m_cachedLocalFillBBox;
+}
 
-        return m_strokeBbox;
+FloatRect RenderPath::repaintRectInLocalCoordinates() const
+{
+    if (m_path.isEmpty())
+        return FloatRect();
+
+    // If we already have a cached repaint rect, return that
+    if (!m_cachedLocalRepaintRect.isEmpty())
+        return m_cachedLocalRepaintRect;
+
+    if (!style()->svgStyle()->hasStroke())
+        m_cachedLocalRepaintRect = objectBoundingBox();
+    else {
+        BoundingRectStrokeStyleApplier strokeStyle(this, style());
+        m_cachedLocalRepaintRect = m_path.strokeBoundingRect(&strokeStyle);
     }
 
-    if (m_fillBBox.isEmpty())
-        m_fillBBox = m_path.boundingRect();
+    // Markers and filters can paint outside of the stroke path
+    m_cachedLocalRepaintRect.unite(m_markerBounds);
+    m_cachedLocalRepaintRect.unite(filterBoundingBoxForRenderer(this));
 
-    return m_fillBBox;
+    return m_cachedLocalRepaintRect;
 }
 
 void RenderPath::setPath(const Path& newPath)
 {
     m_path = newPath;
-    m_strokeBbox = FloatRect();
-    m_fillBBox = FloatRect();
+    m_cachedLocalRepaintRect = FloatRect();
+    m_cachedLocalFillBBox = FloatRect();
 }
 
 const Path& RenderPath::path() const
@@ -147,60 +147,18 @@
     return m_path;
 }
 
-bool RenderPath::calculateLocalTransform()
-{
-    TransformationMatrix oldTransform = m_localTransform;
-    m_localTransform = static_cast<SVGStyledTransformableElement*>(node())->animatedLocalTransform();
-    return (m_localTransform != oldTransform);
-}
-
 void RenderPath::layout()
 {
-    // FIXME: using m_absoluteBounds breaks if containerForRepaint() is not the root
-    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && selfNeedsLayout(), &m_absoluteBounds);
-    
-    calculateLocalTransform();
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && selfNeedsLayout());
 
-    setPath(static_cast<SVGStyledTransformableElement*>(node())->toPathData());
-
-    m_absoluteBounds = absoluteClippedOverflowRect();
+    SVGStyledTransformableElement* element = static_cast<SVGStyledTransformableElement*>(node());
+    m_localTransform = element->animatedLocalTransform();
+    setPath(element->toPathData());
 
     repainter.repaintAfterLayout();
-
     setNeedsLayout(false);
 }
 
-IntRect RenderPath::clippedOverflowRectForRepaint(RenderBoxModelObject* /*repaintContainer*/)
-{
-    // FIXME: handle non-root repaintContainer
-    FloatRect repaintRect = absoluteTransform().mapRect(relativeBBox(true));
-
-    // Markers can expand the bounding box
-    repaintRect.unite(m_markerBounds);
-
-#if ENABLE(SVG_FILTERS)
-    // Filters can expand the bounding box
-    SVGResourceFilter* filter = getFilterById(document(), style()->svgStyle()->filter());
-    if (filter)
-        repaintRect.unite(filter->filterBBoxForItemBBox(repaintRect));
-#endif
-
-    if (!repaintRect.isEmpty())
-        repaintRect.inflate(1); // inflate 1 pixel for antialiasing
-
-    return enclosingIntRect(repaintRect);
-}
-
-int RenderPath::lineHeight(bool, bool) const
-{
-    return relativeBBox(true).height();
-}
-
-int RenderPath::baselinePosition(bool, bool) const
-{
-    return relativeBBox(true).height();
-}
-
 static inline void fillAndStrokePath(const Path& path, GraphicsContext* context, RenderStyle* style, RenderPath* object)
 {
     context->beginPath();
@@ -224,11 +182,11 @@
         return;
             
     paintInfo.context->save();
-    paintInfo.context->concatCTM(localTransform());
+    paintInfo.context->concatCTM(localToParentTransform());
 
     SVGResourceFilter* filter = 0;
 
-    FloatRect boundingBox = relativeBBox(true);
+    FloatRect boundingBox = repaintRectInLocalCoordinates();
     if (paintInfo.phase == PaintPhaseForeground) {
         PaintInfo savedInfo(paintInfo);
 
@@ -240,7 +198,7 @@
         if (static_cast<SVGStyledElement*>(node())->supportsMarkers())
             m_markerBounds = drawMarkersIfNeeded(paintInfo.context, paintInfo.rect, m_path);
 
-        finishRenderSVGContent(this, paintInfo, boundingBox, filter, savedInfo.context);
+        finishRenderSVGContent(this, paintInfo, filter, savedInfo.context);
     }
 
     if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth())
@@ -250,37 +208,28 @@
     paintInfo.context->restore();
 }
 
+// This method is called from inside paintOutline() since we call paintOutline()
+// while transformed to our coord system, return local coords
 void RenderPath::addFocusRingRects(GraphicsContext* graphicsContext, int, int) 
 {
-    graphicsContext->addFocusRingRect(enclosingIntRect(relativeBBox(true)));
+    graphicsContext->addFocusRingRect(enclosingIntRect(repaintRectInLocalCoordinates()));
 }
 
-void RenderPath::absoluteRects(Vector<IntRect>& rects, int, int, bool)
-{
-    rects.append(absoluteClippedOverflowRect());
-}
-
-void RenderPath::absoluteQuads(Vector<FloatQuad>& quads, bool)
-{
-    quads.append(absoluteClippedOverflowRect());
-}
-
-bool RenderPath::nodeAtPoint(const HitTestRequest&, HitTestResult& result, int _x, int _y, int, int, HitTestAction hitTestAction)
+bool RenderPath::nodeAtFloatPoint(const HitTestRequest&, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
     // We only draw in the forground phase, so we only hit-test then.
     if (hitTestAction != HitTestForeground)
         return false;
-    
-    IntPoint absolutePoint(_x, _y);
+
+    FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
 
     PointerEventsHitRules hitRules(PointerEventsHitRules::SVG_PATH_HITTESTING, style()->pointerEvents());
 
     bool isVisible = (style()->visibility() == VISIBLE);
     if (isVisible || !hitRules.requireVisible) {
-        FloatPoint hitPoint = mapAbsolutePointToLocal(absolutePoint);
-        if ((hitRules.canHitStroke && (style()->svgStyle()->hasStroke() || !hitRules.requireStroke) && strokeContains(hitPoint, hitRules.requireStroke))
-            || (hitRules.canHitFill && (style()->svgStyle()->hasFill() || !hitRules.requireFill) && fillContains(hitPoint, hitRules.requireFill))) {
-            updateHitTestResult(result, absolutePoint);
+        if ((hitRules.canHitStroke && (style()->svgStyle()->hasStroke() || !hitRules.requireStroke) && strokeContains(localPoint, hitRules.requireStroke))
+            || (hitRules.canHitFill && (style()->svgStyle()->hasFill() || !hitRules.requireFill) && fillContains(localPoint, hitRules.requireFill))) {
+            updateHitTestResult(result, roundedIntPoint(localPoint));
             return true;
         }
     }
@@ -470,14 +419,6 @@
     return bounds;
 }
 
-IntRect RenderPath::outlineBoundsForRepaint(RenderBoxModelObject* /*repaintContainer*/) const
-{
-    // FIXME: handle non-root repaintContainer
-    IntRect result = m_absoluteBounds;
-    adjustRectForOutlineAndShadow(result);
-    return result;
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/rendering/RenderPath.h b/WebCore/rendering/RenderPath.h
index 6157171..a4aefed 100644
--- a/WebCore/rendering/RenderPath.h
+++ b/WebCore/rendering/RenderPath.h
@@ -3,8 +3,7 @@
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
                   2006 Apple Computer, Inc
-
-    This file is part of the KDE project
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -27,10 +26,9 @@
 
 #if ENABLE(SVG)
 
-#include "TransformationMatrix.h"
 #include "FloatRect.h"
-
-#include "RenderObject.h"
+#include "RenderSVGModelObject.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
@@ -38,7 +36,7 @@
 class RenderSVGContainer;
 class SVGStyledTransformableElement;
 
-class RenderPath : public RenderObject {
+class RenderPath : public RenderSVGModelObject {
 public:
     RenderPath(SVGStyledTransformableElement*);
 
@@ -46,43 +44,33 @@
     bool fillContains(const FloatPoint&, bool requiresFill = true) const;
     bool strokeContains(const FloatPoint&, bool requiresStroke = true) const;
 
-    // Returns an unscaled bounding box (not even including localTransform()) for this vector path
-    virtual FloatRect relativeBBox(bool includeStroke = true) const;
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect repaintRectInLocalCoordinates() const;
+
+    virtual TransformationMatrix localToParentTransform() const;
 
     const Path& path() const;
-    void setPath(const Path& newPath);
+    void setPath(const Path&);
 
     virtual bool isRenderPath() const { return true; }
     virtual const char* renderName() const { return "RenderPath"; }
-    
-    bool calculateLocalTransform();
-    virtual TransformationMatrix localTransform() const;
-    
-    virtual void layout();
-    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
-    virtual bool requiresLayer() const { return false; }
-    virtual int lineHeight(bool b, bool isRootLineBox = false) const;
-    virtual int baselinePosition(bool b, bool isRootLineBox = false) const;
-    virtual void paint(PaintInfo&, int parentX, int parentY);
 
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+    virtual void layout();
+    virtual void paint(PaintInfo&, int parentX, int parentY);
     virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
 
     FloatRect drawMarkersIfNeeded(GraphicsContext*, const FloatRect&, const Path&) const;
-    
+
 private:
-    FloatPoint mapAbsolutePointToLocal(const FloatPoint&) const;
-    virtual IntRect outlineBoundsForRepaint(RenderBoxModelObject* repaintContainer) const;
+    virtual TransformationMatrix localTransform() const;
 
     mutable Path m_path;
-    mutable FloatRect m_fillBBox;
-    mutable FloatRect m_strokeBbox;
+    mutable FloatRect m_cachedLocalFillBBox;
+    mutable FloatRect m_cachedLocalRepaintRect;
     FloatRect m_markerBounds;
     TransformationMatrix m_localTransform;
-    IntRect m_absoluteBounds;
 };
 
 }
diff --git a/WebCore/rendering/RenderReplaced.cpp b/WebCore/rendering/RenderReplaced.cpp
index 783fc26..e61ac8e 100644
--- a/WebCore/rendering/RenderReplaced.cpp
+++ b/WebCore/rendering/RenderReplaced.cpp
@@ -131,11 +131,12 @@
     if (clipToBorderRadius) {
         // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
         paintInfo.context->save();
-        paintInfo.context->addRoundedRectClip(IntRect(tx, ty, width(), height()),
-                                              style()->borderTopLeftRadius(),
-                                              style()->borderTopRightRadius(), 
-                                              style()->borderBottomLeftRadius(),
-                                              style()->borderBottomRightRadius());
+        
+        IntSize topLeft, topRight, bottomLeft, bottomRight;
+        IntRect borderRect = IntRect(tx, ty, width(), height());
+        style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+
+        paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
     }
 
     paintReplaced(paintInfo, tx, ty);
diff --git a/WebCore/rendering/RenderReplica.cpp b/WebCore/rendering/RenderReplica.cpp
index 0eb9f8f..e805298 100644
--- a/WebCore/rendering/RenderReplica.cpp
+++ b/WebCore/rendering/RenderReplica.cpp
@@ -72,7 +72,7 @@
         // computing using the wrong rootLayer
         layer()->parent()->paintLayer(layer()->transform() ? layer()->parent() : layer()->enclosingTransformedAncestor(),
                                       paintInfo.context, paintInfo.rect,
-                                      true, PaintRestrictionNone, 0,
+                                      true, PaintRestrictionNone, 0, 0,
                                       true,     // appliedTransform
                                       true);    // temporaryClipRects
     else if (paintInfo.phase == PaintPhaseMask)
diff --git a/WebCore/rendering/RenderSVGBlock.h b/WebCore/rendering/RenderSVGBlock.h
index d545fd0..f8afd0f 100644
--- a/WebCore/rendering/RenderSVGBlock.h
+++ b/WebCore/rendering/RenderSVGBlock.h
@@ -25,12 +25,13 @@
 #if ENABLE(SVG)
 
 #include "RenderBlock.h"
+#include "SVGRenderSupport.h"
 
 namespace WebCore {
 
 class SVGElement;
 
-class RenderSVGBlock : public RenderBlock {
+class RenderSVGBlock : public RenderBlock, protected SVGRenderBase {
 public:
     RenderSVGBlock(SVGElement*);
     virtual void setStyle(PassRefPtr<RenderStyle>);
diff --git a/WebCore/rendering/RenderSVGContainer.cpp b/WebCore/rendering/RenderSVGContainer.cpp
index 28c5672..8a77d2e 100644
--- a/WebCore/rendering/RenderSVGContainer.cpp
+++ b/WebCore/rendering/RenderSVGContainer.cpp
@@ -2,8 +2,7 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007, 2008 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Google, Inc.  All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -38,9 +37,7 @@
 namespace WebCore {
 
 RenderSVGContainer::RenderSVGContainer(SVGStyledElement* node)
-    : RenderObject(node)
-    , m_width(0)
-    , m_height(0)
+    : RenderSVGModelObject(node)
     , m_drawsContents(true)
 {
 }
@@ -59,38 +56,15 @@
     m_drawsContents = drawsContents;
 }
 
-TransformationMatrix RenderSVGContainer::localTransform() const
-{
-    return m_localTransform;
-}
-
-int RenderSVGContainer::lineHeight(bool, bool) const
-{
-    return height();
-}
-
-int RenderSVGContainer::baselinePosition(bool, bool) const
-{
-    return height();
-}
-
-bool RenderSVGContainer::calculateLocalTransform()
-{
-    // subclasses can override this to add transform support
-    return false;
-}
-
 void RenderSVGContainer::layout()
 {
     ASSERT(needsLayout());
+    ASSERT(!view()->layoutStateEnabled()); // RenderSVGRoot disables layoutState for the SVG rendering tree.
 
-    // Arbitrary affine transforms are incompatible with LayoutState.
-    view()->disableLayoutState();
+    calcViewport(); // Allow RenderSVGViewportContainer to update its viewport
 
-    // FIXME: using m_absoluteBounds breaks if containerForRepaint() is not the root
-    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && selfWillPaint(), &m_absoluteBounds);
-    
-    calculateLocalTransform();
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() || selfWillPaint());
+    calculateLocalTransform(); // Allow RenderSVGTransformableContainer to update its transform
 
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         // Only force our kids to layout if we're being asked to relayout as a result of a parent changing
@@ -103,66 +77,14 @@
         child->layoutIfNeeded();
         ASSERT(!child->needsLayout());
     }
-
-    calcBounds();
-
     repainter.repaintAfterLayout();
 
-    view()->enableLayoutState();
     setNeedsLayout(false);
 }
 
-int RenderSVGContainer::calcReplacedWidth() const
-{
-    switch (style()->width().type()) {
-    case Fixed:
-        return max(0, style()->width().value());
-    case Percent:
-    {
-        const int cw = containingBlock()->availableWidth();
-        return cw > 0 ? max(0, style()->width().calcMinValue(cw)) : 0;
-    }
-    default:
-        return 0;
-    }
-}
-
-int RenderSVGContainer::calcReplacedHeight() const
-{
-    switch (style()->height().type()) {
-    case Fixed:
-        return max(0, style()->height().value());
-    case Percent:
-    {
-        RenderBlock* cb = containingBlock();
-        return style()->height().calcValue(cb->availableHeight());
-    }
-    default:
-        return 0;
-    }
-}
-
-void RenderSVGContainer::applyContentTransforms(PaintInfo& paintInfo)
-{
-    if (!localTransform().isIdentity())
-        paintInfo.context->concatCTM(localTransform());
-}
-
-void RenderSVGContainer::applyAdditionalTransforms(PaintInfo&)
-{
-    // no-op
-}
-
-void RenderSVGContainer::calcBounds()
-{
-    m_width = calcReplacedWidth();
-    m_height = calcReplacedHeight();
-    m_absoluteBounds = absoluteClippedOverflowRect();
-}
-
 bool RenderSVGContainer::selfWillPaint() const
 {
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
     const SVGRenderStyle* svgStyle = style()->svgStyle();
     SVGResourceFilter* filter = getFilterById(document(), svgStyle->filter());
     if (filter)
@@ -179,98 +101,75 @@
      // Spec: groups w/o children still may render filter content.
     if (!firstChild() && !selfWillPaint())
         return;
-    
-    paintInfo.context->save();
-    applyContentTransforms(paintInfo);
+
+    PaintInfo childPaintInfo(paintInfo);
+
+    childPaintInfo.context->save();
+
+    // Let the RenderSVGViewportContainer subclass clip if necessary
+    applyViewportClip(childPaintInfo);
+
+    applyTransformToPaintInfo(childPaintInfo, localToParentTransform());
 
     SVGResourceFilter* filter = 0;
-    PaintInfo savedInfo(paintInfo);
+    FloatRect boundingBox = repaintRectInLocalCoordinates();
+    if (childPaintInfo.phase == PaintPhaseForeground)
+        prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter);
 
-    FloatRect boundingBox = relativeBBox(true);
-    if (paintInfo.phase == PaintPhaseForeground)
-        prepareToRenderSVGContent(this, paintInfo, boundingBox, filter); 
-
-    applyAdditionalTransforms(paintInfo);
-
-    // default implementation. Just pass paint through to the children
-    PaintInfo childInfo(paintInfo);
-    childInfo.paintingRoot = paintingRootForChildren(paintInfo);
+    childPaintInfo.paintingRoot = paintingRootForChildren(childPaintInfo);
     for (RenderObject* child = firstChild(); child; child = child->nextSibling())
-        child->paint(childInfo, 0, 0);
+        child->paint(childPaintInfo, 0, 0);
 
     if (paintInfo.phase == PaintPhaseForeground)
-        finishRenderSVGContent(this, paintInfo, boundingBox, filter, savedInfo.context);
+        finishRenderSVGContent(this, childPaintInfo, filter, paintInfo.context);
 
-    paintInfo.context->restore();
-    
+    childPaintInfo.context->restore();
+
+    // FIXME: This really should be drawn from local coordinates, but currently we hack it
+    // to avoid our clip killing our outline rect.  Thus we translate our
+    // outline rect into parent coords before drawing.
+    // FIXME: This means our focus ring won't share our rotation like it should.
+    // We should instead disable our clip during PaintPhaseOutline
+    IntRect paintRectInParent = enclosingIntRect(localToParentTransform().mapRect(repaintRectInLocalCoordinates()));
     if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth() && style()->visibility() == VISIBLE)
-        paintOutline(paintInfo.context, m_absoluteBounds.x(), m_absoluteBounds.y(), m_absoluteBounds.width(), m_absoluteBounds.height(), style());
+        paintOutline(paintInfo.context, paintRectInParent.x(), paintRectInParent.y(), paintRectInParent.width(), paintRectInParent.height(), style());
 }
 
-TransformationMatrix RenderSVGContainer::viewportTransform() const
-{
-     return TransformationMatrix();
-}
-
-IntRect RenderSVGContainer::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
-{
-    FloatRect repaintRect;
-
-    for (RenderObject* current = firstChild(); current != 0; current = current->nextSibling())
-        repaintRect.unite(current->clippedOverflowRectForRepaint(repaintContainer));
-
-#if ENABLE(SVG_FILTERS)
-    // Filters can expand the bounding box
-    SVGResourceFilter* filter = getFilterById(document(), style()->svgStyle()->filter());
-    if (filter)
-        repaintRect.unite(filter->filterBBoxForItemBBox(repaintRect));
-#endif
-
-    if (!repaintRect.isEmpty())
-        repaintRect.inflate(1); // inflate 1 pixel for antialiasing
-
-    return enclosingIntRect(repaintRect);
-}
-
+// addFocusRingRects is called from paintOutline and needs to be in the same coordinates as the paintOuline call
 void RenderSVGContainer::addFocusRingRects(GraphicsContext* graphicsContext, int, int)
 {
-    graphicsContext->addFocusRingRect(m_absoluteBounds);
+    IntRect paintRectInParent = enclosingIntRect(localToParentTransform().mapRect(repaintRectInLocalCoordinates()));
+    graphicsContext->addFocusRingRect(paintRectInParent);
 }
 
-void RenderSVGContainer::absoluteRects(Vector<IntRect>& rects, int, int, bool)
+FloatRect RenderSVGContainer::objectBoundingBox() const
 {
-    rects.append(absoluteClippedOverflowRect());
+    return computeContainerBoundingBox(this, false);
 }
 
-void RenderSVGContainer::absoluteQuads(Vector<FloatQuad>& quads, bool)
+// RenderSVGContainer is used for <g> elements which do not themselves have a
+// width or height, so we union all of our child rects as our repaint rect.
+FloatRect RenderSVGContainer::repaintRectInLocalCoordinates() const
 {
-    quads.append(absoluteClippedOverflowRect());
+    FloatRect repaintRect = computeContainerBoundingBox(this, true);
+
+    // A filter on this container can paint outside of the union of the child repaint rects
+    repaintRect.unite(filterBoundingBoxForRenderer(this));
+
+    return repaintRect;
 }
 
-FloatRect RenderSVGContainer::relativeBBox(bool includeStroke) const
+bool RenderSVGContainer::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
-    FloatRect rect;
-    
-    RenderObject* current = firstChild();
-    for (; current != 0; current = current->nextSibling()) {
-        FloatRect childBBox = current->relativeBBox(includeStroke);
-        FloatRect mappedBBox = current->localTransform().mapRect(childBBox);
+    // Give RenderSVGViewportContainer a chance to apply its viewport clip
+    if (!pointIsInsideViewportClip(pointInParent))
+        return false;
 
-        // <svg> can have a viewBox contributing to the bbox
-        if (current->isSVGContainer())
-            mappedBBox = static_cast<RenderSVGContainer*>(current)->viewportTransform().mapRect(mappedBBox);
+    FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
 
-        rect.unite(mappedBBox);
-    }
-
-    return rect;
-}
-
-bool RenderSVGContainer::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int _x, int _y, int _tx, int _ty, HitTestAction hitTestAction)
-{
     for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
-        if (child->nodeAtPoint(request, result, _x, _y, _tx, _ty, hitTestAction)) {
-            updateHitTestResult(result, IntPoint(_x - _tx, _y - _ty));
+        if (child->nodeAtFloatPoint(request, result, localPoint, hitTestAction)) {
+            updateHitTestResult(result, roundedIntPoint(localPoint));
             return true;
         }
     }
@@ -280,14 +179,6 @@
     return false;
 }
 
-IntRect RenderSVGContainer::outlineBoundsForRepaint(RenderBoxModelObject* /*repaintContainer*/) const
-{
-    // FIXME: handle non-root repaintContainer
-    IntRect result = m_absoluteBounds;
-    adjustRectForOutlineAndShadow(result);
-    return result;
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/rendering/RenderSVGContainer.h b/WebCore/rendering/RenderSVGContainer.h
index 2c1be65..4bb7e44 100644
--- a/WebCore/rendering/RenderSVGContainer.h
+++ b/WebCore/rendering/RenderSVGContainer.h
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Google, Inc.  All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -25,14 +24,13 @@
 
 #if ENABLE(SVG)
 
-#include "RenderPath.h"
-#include "SVGPreserveAspectRatio.h"
+#include "RenderSVGModelObject.h"
 
 namespace WebCore {
 
 class SVGElement;
 
-class RenderSVGContainer : public RenderObject {
+class RenderSVGContainer : public RenderSVGModelObject {
 public:
     RenderSVGContainer(SVGStyledElement*);
     ~RenderSVGContainer();
@@ -42,62 +40,36 @@
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
-    int width() const { return m_width; }
-    int height() const { return m_height; }
-
-    // Some containers do not want it's children
-    // to be drawn, because they may be 'referenced'
-    // Example: <marker> children in SVG
+    // <marker> uses these methods to only allow drawing children during a special marker draw time
     void setDrawsContents(bool);
     bool drawsContents() const;
 
     virtual bool isSVGContainer() const { return true; }
     virtual const char* renderName() const { return "RenderSVGContainer"; }
 
-    virtual bool requiresLayer() const { return false; }
-    virtual int lineHeight(bool b, bool isRootLineBox = false) const;
-    virtual int baselinePosition(bool b, bool isRootLineBox = false) const;
-
     virtual void layout();
     virtual void paint(PaintInfo&, int parentX, int parentY);
-
-    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
-    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
     virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
-    FloatRect relativeBBox(bool includeStroke = true) const;
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect repaintRectInLocalCoordinates() const;
 
-    virtual bool calculateLocalTransform();
-    virtual TransformationMatrix localTransform() const;
-    virtual TransformationMatrix viewportTransform() const;
-
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
 
 protected:
-    virtual void applyContentTransforms(PaintInfo&);
-    virtual void applyAdditionalTransforms(PaintInfo&);
+    // Allow RenderSVGTransformableContainer to hook in at the right time in layout()
+    virtual void calculateLocalTransform() { }
 
-    void calcBounds();
-
-    virtual IntRect outlineBoundsForRepaint(RenderBoxModelObject* /*repaintContainer*/) const;
+    // Allow RenderSVGViewportContainer to hook in at the right times in layout(), paint() and nodeAtFloatPoint()
+    virtual void calcViewport() { }
+    virtual void applyViewportClip(PaintInfo&) { }
+    virtual bool pointIsInsideViewportClip(const FloatPoint& /*pointInParent*/) { return true; }
 
 private:
-    int calcReplacedWidth() const;
-    int calcReplacedHeight() const;
-
-    RenderObjectChildList m_children;
-
-    int m_width;
-    int m_height;
-    
     bool selfWillPaint() const;
 
+    RenderObjectChildList m_children;
     bool m_drawsContents : 1;
-    
-protected:    
-    IntRect m_absoluteBounds;
-    TransformationMatrix m_localTransform;
 };
   
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderSVGGradientStop.h b/WebCore/rendering/RenderSVGGradientStop.h
index 7b7df5c..1d0858d 100644
--- a/WebCore/rendering/RenderSVGGradientStop.h
+++ b/WebCore/rendering/RenderSVGGradientStop.h
@@ -1,7 +1,6 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Google, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -41,11 +40,13 @@
 
         virtual void layout();
 
-        // This override is needed to prevent an assert on <svg><stop /></svg>
-        // RenderObject's default impl asserts.
+        // This overrides are needed to prevent ASSERTs on <svg><stop /></svg>
+        // RenderObject's default implementations ASSERT_NOT_REACHED()
         // https://bugs.webkit.org/show_bug.cgi?id=20400
         virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject*) { return IntRect(); }
-    
+        virtual FloatRect objectBoundingBox() const { return FloatRect(); }
+        virtual FloatRect repaintRectInLocalCoordinates() const { return FloatRect(); }
+
     protected:
         virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
diff --git a/WebCore/rendering/RenderSVGHiddenContainer.cpp b/WebCore/rendering/RenderSVGHiddenContainer.cpp
index dd76946..f08c008 100644
--- a/WebCore/rendering/RenderSVGHiddenContainer.cpp
+++ b/WebCore/rendering/RenderSVGHiddenContainer.cpp
@@ -39,16 +39,6 @@
 {
 }
 
-int RenderSVGHiddenContainer::lineHeight(bool, bool) const
-{
-    return 0;
-}
-
-int RenderSVGHiddenContainer::baselinePosition(bool, bool) const
-{
-    return 0;
-}
-
 void RenderSVGHiddenContainer::layout()
 {
     ASSERT(needsLayout());
@@ -76,32 +66,27 @@
     return IntRect();
 }
 
-void RenderSVGHiddenContainer::absoluteRects(Vector<IntRect>&, int, int, bool)
+void RenderSVGHiddenContainer::absoluteRects(Vector<IntRect>&, int, int)
 {
     // This subtree does not take up space or paint
 }
 
-void RenderSVGHiddenContainer::absoluteQuads(Vector<FloatQuad>&, bool)
+void RenderSVGHiddenContainer::absoluteQuads(Vector<FloatQuad>&)
 {
     // This subtree does not take up space or paint
 }
 
-TransformationMatrix RenderSVGHiddenContainer::absoluteTransform() const
-{
-    return TransformationMatrix();
-}
-
-TransformationMatrix RenderSVGHiddenContainer::localTransform() const
-{
-    return TransformationMatrix();
-}
-
-bool RenderSVGHiddenContainer::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
+bool RenderSVGHiddenContainer::nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint&, HitTestAction)
 {
     return false;
 }
 
-FloatRect RenderSVGHiddenContainer::relativeBBox(bool) const
+FloatRect RenderSVGHiddenContainer::objectBoundingBox() const
+{
+    return FloatRect();
+}
+
+FloatRect RenderSVGHiddenContainer::repaintRectInLocalCoordinates() const
 {
     return FloatRect();
 }
diff --git a/WebCore/rendering/RenderSVGHiddenContainer.h b/WebCore/rendering/RenderSVGHiddenContainer.h
index 6568f3f..5a208d0 100644
--- a/WebCore/rendering/RenderSVGHiddenContainer.h
+++ b/WebCore/rendering/RenderSVGHiddenContainer.h
@@ -37,29 +37,28 @@
     public:
         RenderSVGHiddenContainer(SVGStyledElement*);
         virtual ~RenderSVGHiddenContainer();
-        
+
         virtual bool isSVGContainer() const { return true; }
         virtual bool isSVGHiddenContainer() const { return true; }
 
         virtual const char* renderName() const { return "RenderSVGHiddenContainer"; }
-        
+
         virtual bool requiresLayer() const { return false; }
-        
-        virtual int lineHeight(bool b, bool isRootLineBox = false) const;
-        virtual int baselinePosition(bool b, bool isRootLineBox = false) const;
-        
+
         virtual void layout();
         virtual void paint(PaintInfo&, int parentX, int parentY);
         
         virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
-        virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel = true);
-        virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
-        
-        virtual TransformationMatrix absoluteTransform() const;
-        virtual TransformationMatrix localTransform() const;
+        virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
+        virtual void absoluteQuads(Vector<FloatQuad>&);
 
-        virtual FloatRect relativeBBox(bool includeStroke = true) const;
-        virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+        // FIXME: This override only exists to match existing LayoutTest results.
+        virtual TransformationMatrix absoluteTransform() const { return TransformationMatrix(); }
+
+        virtual FloatRect objectBoundingBox() const;
+        virtual FloatRect repaintRectInLocalCoordinates() const;
+
+        virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
     };
 }
 
diff --git a/WebCore/rendering/RenderSVGImage.cpp b/WebCore/rendering/RenderSVGImage.cpp
index a13ee03..b38352e 100644
--- a/WebCore/rendering/RenderSVGImage.cpp
+++ b/WebCore/rendering/RenderSVGImage.cpp
@@ -3,8 +3,7 @@
     Copyright (C) 2006 Apple Computer, Inc.
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
     Copyright (C) 2007, 2008 Rob Buis <buis@kde.org>
-
-    This file is part of the WebKit project
+    Copyright (C) 2009, Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -32,6 +31,7 @@
 #include "FloatQuad.h"
 #include "GraphicsContext.h"
 #include "PointerEventsHitRules.h"
+#include "RenderLayer.h"
 #include "SVGImageElement.h"
 #include "SVGLength.h"
 #include "SVGPreserveAspectRatio.h"
@@ -126,20 +126,14 @@
     }
 }
 
-bool RenderSVGImage::calculateLocalTransform()
-{
-    TransformationMatrix oldTransform = m_localTransform;
-    m_localTransform = static_cast<SVGStyledTransformableElement*>(node())->animatedLocalTransform();
-    return (m_localTransform != oldTransform);
-}
-
 void RenderSVGImage::layout()
 {
     ASSERT(needsLayout());
-    
+
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
-    
-    calculateLocalTransform();
+
+    SVGImageElement* image = static_cast<SVGImageElement*>(node());
+    m_localTransform = image->animatedLocalTransform();
     
     // minimum height
     setHeight(errorOccurred() ? intrinsicSize().height() : 0);
@@ -147,11 +141,8 @@
     calcWidth();
     calcHeight();
 
-    SVGImageElement* image = static_cast<SVGImageElement*>(node());
     m_localBounds = FloatRect(image->x().value(image), image->y().value(image), image->width().value(image), image->height().value(image));
 
-    calculateAbsoluteBounds();
-
     repainter.repaintAfterLayout();
     
     setNeedsLayout(false);
@@ -163,7 +154,7 @@
         return;
 
     paintInfo.context->save();
-    paintInfo.context->concatCTM(localTransform());
+    paintInfo.context->concatCTM(localToParentTransform());
 
     if (paintInfo.phase == PaintPhaseForeground) {
         SVGResourceFilter* filter = 0;
@@ -180,14 +171,16 @@
             adjustRectsForAspectRatio(destRect, srcRect, imageElt->preserveAspectRatio());
 
         paintInfo.context->drawImage(image(), destRect, srcRect);
-
-        finishRenderSVGContent(this, paintInfo, m_localBounds, filter, savedInfo.context);
+        finishRenderSVGContent(this, paintInfo, filter, savedInfo.context);
     }
-    
+
+    if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth())
+        paintOutline(paintInfo.context, 0, 0, width(), height(), style());
+
     paintInfo.context->restore();
 }
 
-bool RenderSVGImage::nodeAtPoint(const HitTestRequest&, HitTestResult& result, int _x, int _y, int, int, HitTestAction hitTestAction)
+bool RenderSVGImage::nodeAtFloatPoint(const HitTestRequest&, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
     // We only draw in the forground phase, so we only hit-test then.
     if (hitTestAction != HitTestForeground)
@@ -197,12 +190,11 @@
     
     bool isVisible = (style()->visibility() == VISIBLE);
     if (isVisible || !hitRules.requireVisible) {
-        double localX, localY;
-        absoluteTransform().inverse().map(_x, _y, localX, localY);
+        FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
 
         if (hitRules.canHitFill) {
-            if (m_localBounds.contains(narrowPrecisionToFloat(localX), narrowPrecisionToFloat(localY))) {
-                updateHitTestResult(result, IntPoint(_x, _y));
+            if (m_localBounds.contains(localPoint)) {
+                updateHitTestResult(result, roundedIntPoint(localPoint));
                 return true;
             }
         }
@@ -211,11 +203,27 @@
     return false;
 }
 
-FloatRect RenderSVGImage::relativeBBox(bool) const
+bool RenderSVGImage::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+FloatRect RenderSVGImage::objectBoundingBox() const
 {
     return m_localBounds;
 }
 
+FloatRect RenderSVGImage::repaintRectInLocalCoordinates() const
+{
+    FloatRect repaintRect = m_localBounds;
+
+    // Filters can paint outside the image content
+    repaintRect.unite(filterBoundingBoxForRenderer(this));
+
+    return repaintRect;
+}
+
 void RenderSVGImage::imageChanged(WrappedImagePtr image, const IntRect* rect)
 {
     RenderImage::imageChanged(image, rect);
@@ -224,43 +232,34 @@
     repaintRectangle(absoluteClippedOverflowRect());    // FIXME: Isn't this just repaint()?
 }
 
-void RenderSVGImage::calculateAbsoluteBounds()
+IntRect RenderSVGImage::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
-    // FIXME: broken with CSS transforms
-    FloatRect absoluteRect = absoluteTransform().mapRect(relativeBBox(true));
-
-#if ENABLE(SVG_FILTERS)
-    // Filters can expand the bounding box
-    SVGResourceFilter* filter = getFilterById(document(), style()->svgStyle()->filter());
-    if (filter)
-        absoluteRect.unite(filter->filterBBoxForItemBBox(absoluteRect));
-#endif
-
-    if (!absoluteRect.isEmpty())
-        absoluteRect.inflate(1); // inflate 1 pixel for antialiasing
-
-    m_absoluteBounds = enclosingIntRect(absoluteRect);
+    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
 }
 
-IntRect RenderSVGImage::clippedOverflowRectForRepaint(RenderBoxModelObject* /*repaintContainer*/)
+void RenderSVGImage::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
-    // FIXME: handle non-root repaintContainer
-    return m_absoluteBounds;
+    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
+}
+
+void RenderSVGImage::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState) const
+{
+    SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
 }
 
 void RenderSVGImage::addFocusRingRects(GraphicsContext* graphicsContext, int, int)
 {
     // this is called from paint() after the localTransform has already been applied
-    IntRect contentRect = enclosingIntRect(relativeBBox());
+    IntRect contentRect = enclosingIntRect(repaintRectInLocalCoordinates());
     graphicsContext->addFocusRingRect(contentRect);
 }
 
-void RenderSVGImage::absoluteRects(Vector<IntRect>& rects, int, int, bool)
+void RenderSVGImage::absoluteRects(Vector<IntRect>& rects, int, int)
 {
     rects.append(absoluteClippedOverflowRect());
 }
 
-void RenderSVGImage::absoluteQuads(Vector<FloatQuad>& quads, bool)
+void RenderSVGImage::absoluteQuads(Vector<FloatQuad>& quads)
 {
     quads.append(FloatRect(absoluteClippedOverflowRect()));
 }
diff --git a/WebCore/rendering/RenderSVGImage.h b/WebCore/rendering/RenderSVGImage.h
index 4aedfef..01b8b65 100644
--- a/WebCore/rendering/RenderSVGImage.h
+++ b/WebCore/rendering/RenderSVGImage.h
@@ -2,8 +2,7 @@
     Copyright (C) 2006 Alexander Kellett <lypanov@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.
     Copyright (C) 2007 Rob Buis <buis@kde.org>
-
-    This file is part of the WebKit project.
+    Copyright (C) 2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -29,23 +28,33 @@
 #include "TransformationMatrix.h"
 #include "FloatRect.h"
 #include "RenderImage.h"
+#include "SVGRenderSupport.h"
 
 namespace WebCore {
 
     class SVGImageElement;
     class SVGPreserveAspectRatio;
 
-    class RenderSVGImage : public RenderImage {
+    class RenderSVGImage : public RenderImage, SVGRenderBase {
     public:
         RenderSVGImage(SVGImageElement*);
         virtual ~RenderSVGImage();
-        
-        virtual TransformationMatrix localTransform() const { return m_localTransform; }
-        
-        virtual FloatRect relativeBBox(bool includeStroke = true) const;
+
+        virtual const char* renderName() const { return "RenderSVGImage"; }
+        virtual bool isSVGImage() const { return true; }
+
+        virtual TransformationMatrix localToParentTransform() const { return m_localTransform; }
+
+        virtual FloatRect objectBoundingBox() const;
+        virtual FloatRect repaintRectInLocalCoordinates() const;
+
         virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
-        virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-        virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+        virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
+
+        virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+
+        virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+        virtual void absoluteQuads(Vector<FloatQuad>&);
         virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
         virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
@@ -56,15 +65,14 @@
 
         bool requiresLayer() const { return false; }
 
+        virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
         virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int _x, int _y, int _tx, int _ty, HitTestAction);
 
-        bool calculateLocalTransform();
-
     private:
-        void calculateAbsoluteBounds();
+        virtual TransformationMatrix localTransform() const { return m_localTransform; }
+
         TransformationMatrix m_localTransform;
         FloatRect m_localBounds;
-        IntRect m_absoluteBounds;
     };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderSVGInline.cpp b/WebCore/rendering/RenderSVGInline.cpp
index a4016a1..3c44dd8 100644
--- a/WebCore/rendering/RenderSVGInline.cpp
+++ b/WebCore/rendering/RenderSVGInline.cpp
@@ -26,8 +26,11 @@
 #if ENABLE(SVG)
 #include "RenderSVGInline.h"
 
+#include "FloatQuad.h"
+#include "RenderBlock.h"
 #include "SVGInlineFlowBox.h"
-#include <wtf/UnusedParam.h>
+#include "SVGInlineTextBox.h"
+#include "SVGRootInlineBox.h"
 
 namespace WebCore {
     
@@ -38,7 +41,47 @@
 
 InlineFlowBox* RenderSVGInline::createFlowBox()
 {
-    return new (renderArena()) SVGInlineFlowBox(this);
+    InlineFlowBox* box = new (renderArena()) SVGInlineFlowBox(this);
+    box->setIsSVG(true);
+    return box;
+}
+
+void RenderSVGInline::absoluteRects(Vector<IntRect>& rects, int, int)
+{
+    InlineRunBox* firstBox = firstLineBox();
+
+    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
+    RenderBox* object = rootBox ? rootBox->block() : 0;
+
+    if (!object)
+        return;
+
+    int xRef = object->x();
+    int yRef = object->y();
+
+    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
+        FloatRect rect(xRef + curr->x(), yRef + curr->y(), curr->width(), curr->height());
+        rects.append(enclosingIntRect(localToAbsoluteQuad(rect).boundingBox()));
+    }
+}
+
+void RenderSVGInline::absoluteQuads(Vector<FloatQuad>& quads)
+{
+    InlineRunBox* firstBox = firstLineBox();
+
+    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
+    RenderBox* object = rootBox ? rootBox->block() : 0;
+
+    if (!object)
+        return;
+
+    int xRef = object->x();
+    int yRef = object->y();
+
+    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
+        FloatRect rect(xRef + curr->x(), yRef + curr->y(), curr->width(), curr->height());
+        quads.append(localToAbsoluteQuad(rect));
+    }
 }
 
 }
diff --git a/WebCore/rendering/RenderSVGInline.h b/WebCore/rendering/RenderSVGInline.h
index cb8bf95..1ff8d02 100644
--- a/WebCore/rendering/RenderSVGInline.h
+++ b/WebCore/rendering/RenderSVGInline.h
@@ -34,6 +34,10 @@
     RenderSVGInline(Node*);
     virtual const char* renderName() const { return "RenderSVGInline"; }
     virtual bool requiresLayer() const { return false; }
+
+    // These are shared between RenderSVGTSpan and RenderSVGTextPath
+    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
     
 private:
     virtual InlineFlowBox* createFlowBox();
diff --git a/WebCore/rendering/RenderSVGInlineText.cpp b/WebCore/rendering/RenderSVGInlineText.cpp
index b98eba0..b1a21d7 100644
--- a/WebCore/rendering/RenderSVGInlineText.cpp
+++ b/WebCore/rendering/RenderSVGInlineText.cpp
@@ -58,22 +58,22 @@
 
 void RenderSVGInlineText::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
-    // Skip RenderText's work.
+    // Skip RenderText's possible layout scheduling on style change
     RenderObject::styleDidChange(diff, oldStyle);
     
-    // SVG text is apparently always transformed.
+    // FIXME: SVG text is apparently always transformed?
     if (RefPtr<StringImpl> textToTransform = originalText())
         setText(textToTransform.release(), true);
 }
 
-void RenderSVGInlineText::absoluteRects(Vector<IntRect>& rects, int, int, bool)
+void RenderSVGInlineText::absoluteRects(Vector<IntRect>& rects, int, int)
 {
     rects.append(computeRepaintRectForRange(0, 0, textLength()));
 }
 
-void RenderSVGInlineText::absoluteQuads(Vector<FloatQuad>& quads, bool)
+void RenderSVGInlineText::absoluteQuads(Vector<FloatQuad>& quads)
 {
-    quads.append(FloatRect(computeRepaintRectForRange(0, 0, textLength())));
+    quads.append(computeRepaintQuadForRange(0, 0, textLength()));
 }
 
 IntRect RenderSVGInlineText::selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool /*clipToVisibleContent*/)
@@ -108,36 +108,34 @@
     return computeRepaintRectForRange(repaintContainer, startPos, endPos);
 }
 
-IntRect RenderSVGInlineText::computeRepaintRectForRange(RenderBoxModelObject* /*repaintContainer*/, int startPos, int endPos)
+IntRect RenderSVGInlineText::computeRepaintRectForRange(RenderBoxModelObject* repaintContainer, int startPos, int endPos)
+{
+    FloatQuad repaintQuad = computeRepaintQuadForRange(repaintContainer, startPos, endPos);
+    return enclosingIntRect(repaintQuad.boundingBox());
+}
+
+FloatQuad RenderSVGInlineText::computeRepaintQuadForRange(RenderBoxModelObject* repaintContainer, int startPos, int endPos)
 {
     RenderBlock* cb = containingBlock();
     if (!cb || !cb->container())
-        return IntRect();
+        return FloatQuad();
 
     RenderSVGRoot* root = findSVGRootObject(parent());
     if (!root)
-        return IntRect();
+        return FloatQuad();
 
     IntRect rect;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
         rect.unite(box->selectionRect(0, 0, startPos, endPos));
 
-    // Mimic RenderBox::computeAbsoluteRepaintRect() functionality. But only the subset needed for SVG and respecting SVG transformations.
-    FloatPoint absPos = cb->container()->localToAbsolute();
-
-    // Remove HTML parent translation offsets here! These need to be retrieved from the RenderSVGRoot object.
-    // But do take the containingBlocks's container position into account, ie. SVG text in scrollable <div>.
-    TransformationMatrix htmlParentCtm = root->RenderBox::absoluteTransform();
-
-    FloatRect fixedRect(narrowPrecisionToFloat(rect.x() + absPos.x() - htmlParentCtm.e()),
-                        narrowPrecisionToFloat(rect.y() + absPos.y() - htmlParentCtm.f()), rect.width(), rect.height());
-    // FIXME: broken with CSS transforms, and non-zero repaintContainer
-    return enclosingIntRect(absoluteTransform().mapRect(fixedRect));
+    return localToContainerQuad(FloatQuad(rect), repaintContainer);
 }
 
 InlineTextBox* RenderSVGInlineText::createTextBox()
 {
-    return new (renderArena()) SVGInlineTextBox(this);
+    InlineTextBox* box = new (renderArena()) SVGInlineTextBox(this);
+    box->setIsSVG(true);
+    return box;
 }
 
 IntRect RenderSVGInlineText::localCaretRect(InlineBox*, int, int*)
diff --git a/WebCore/rendering/RenderSVGInlineText.h b/WebCore/rendering/RenderSVGInlineText.h
index e7f776a..c4a096d 100644
--- a/WebCore/rendering/RenderSVGInlineText.h
+++ b/WebCore/rendering/RenderSVGInlineText.h
@@ -37,8 +37,8 @@
         
     virtual void styleDidChange(StyleDifference, const RenderStyle*);
 
-    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
 
     virtual bool requiresLayer() const { return false; }
     virtual IntRect selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent = true);
@@ -52,6 +52,7 @@
 private:
     virtual InlineTextBox* createTextBox();
     IntRect computeRepaintRectForRange(RenderBoxModelObject* repaintContainer, int startPos, int endPos);
+    FloatQuad computeRepaintQuadForRange(RenderBoxModelObject* repaintContainer, int startPos, int endPos);
 };
 
 }
diff --git a/WebCore/rendering/RenderSVGModelObject.cpp b/WebCore/rendering/RenderSVGModelObject.cpp
new file mode 100644
index 0000000..3fab5a6
--- /dev/null
+++ b/WebCore/rendering/RenderSVGModelObject.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "RenderSVGModelObject.h"
+
+#include "GraphicsContext.h"
+#include "RenderLayer.h"
+#include "RenderView.h"
+#include "SVGStyledElement.h"
+
+#if ENABLE(FILTERS)
+#include "SVGResourceFilter.h"
+#endif
+
+namespace WebCore {
+
+RenderSVGModelObject::RenderSVGModelObject(SVGStyledElement* node)
+    : RenderObject(node)
+{
+}
+
+IntRect RenderSVGModelObject::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
+{
+    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
+}
+
+void RenderSVGModelObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
+{
+    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
+}
+
+void RenderSVGModelObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState) const
+{
+    SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
+}
+
+// Copied from RenderBox, this method likely requires further refactoring to work easily for both SVG and CSS Box Model content.
+// FIXME: This may also need to move into SVGRenderBase as the RenderBox version depends
+// on borderBoundingBox() which SVG RenderBox subclases (like SVGRenderBlock) do not implement.
+IntRect RenderSVGModelObject::outlineBoundsForRepaint(RenderBoxModelObject* repaintContainer) const
+{
+    IntRect box = enclosingIntRect(repaintRectInLocalCoordinates());
+    adjustRectForOutlineAndShadow(box);
+
+    FloatQuad containerRelativeQuad = localToContainerQuad(FloatRect(box), repaintContainer);
+    return containerRelativeQuad.enclosingBoundingBox();
+}
+
+void RenderSVGModelObject::absoluteRects(Vector<IntRect>& rects, int, int)
+{
+    rects.append(absoluteClippedOverflowRect());
+}
+
+void RenderSVGModelObject::absoluteQuads(Vector<FloatQuad>& quads)
+{
+    quads.append(absoluteClippedOverflowRect());
+}
+
+bool RenderSVGModelObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/RenderSVGModelObject.h b/WebCore/rendering/RenderSVGModelObject.h
new file mode 100644
index 0000000..0aa13ad
--- /dev/null
+++ b/WebCore/rendering/RenderSVGModelObject.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderSVGModelObject_h
+#define RenderSVGModelObject_h
+
+#if ENABLE(SVG)
+
+#include "RenderObject.h"
+#include "SVGRenderSupport.h"
+
+namespace WebCore {
+
+// Most renderers in the SVG rendering tree will inherit from this class
+// but not all. (e.g. RenderSVGForeignObject, RenderSVGBlock, RenderSVGImage) thus methods
+// required by SVG renders need to be declared on RenderObject, but shared
+// logic can go in this class or in SVGRenderBase.
+
+class SVGStyledElement;
+
+class RenderSVGModelObject : public RenderObject, protected SVGRenderBase {
+public:
+    RenderSVGModelObject(SVGStyledElement*);
+
+    virtual bool requiresLayer() const { return false; }
+
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
+    virtual IntRect outlineBoundsForRepaint(RenderBoxModelObject* repaintContainer) const;
+
+    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
+
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+
+private:
+    // This method should never be called, SVG uses a different nodeAtPoint method
+    bool nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int xInContainer, int yInContainer, int dxParentToContainer, int dyParentToContainer, HitTestAction hitTestAction);
+};
+
+}
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/WebCore/rendering/RenderSVGRoot.cpp b/WebCore/rendering/RenderSVGRoot.cpp
index 658b92d..80c29dd 100644
--- a/WebCore/rendering/RenderSVGRoot.cpp
+++ b/WebCore/rendering/RenderSVGRoot.cpp
@@ -2,8 +2,7 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007, 2008, 2009 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
-
-    This file is part of the KDE project
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -33,8 +32,9 @@
 #include "SVGRenderSupport.h"
 #include "SVGSVGElement.h"
 #include "SVGStyledElement.h"
+#include "TransformState.h"
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
 #include "SVGResourceFilter.h"
 #endif
 
@@ -85,21 +85,19 @@
 {
     ASSERT(needsLayout());
 
-    calcViewport();
-
     // Arbitrary affine transforms are incompatible with LayoutState.
     view()->disableLayoutState();
 
-    // FIXME: using m_absoluteBounds breaks if containerForRepaint() is not the root
-    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && selfNeedsLayout(), &m_absoluteBounds);
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && selfNeedsLayout());
 
     calcWidth();
     calcHeight();
 
-    m_absoluteBounds = absoluteClippedOverflowRect();
     SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
     setWidth(static_cast<int>(width() * svg->currentScale()));
     setHeight(static_cast<int>(height() * svg->currentScale()));
+
+    calcViewport();
     
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (selfNeedsLayout()) // either bounds or transform changed, force kids to relayout
@@ -115,35 +113,15 @@
     setNeedsLayout(false);
 }
 
-void RenderSVGRoot::applyContentTransforms(PaintInfo& paintInfo, int parentX, int parentY)
+bool RenderSVGRoot::selfWillPaint() const
 {
-    // Translate from parent offsets (html renderers) to a relative transform (svg renderers)
-    IntPoint origin;
-    origin.move(parentX, parentY);
-    origin.move(x(), y());
-    origin.move(borderLeft(), borderTop());
-    origin.move(paddingLeft(), paddingTop());
-
-    if (origin.x() || origin.y()) {
-        paintInfo.context->concatCTM(TransformationMatrix().translate(origin.x(), origin.y()));
-        paintInfo.rect.move(-origin.x(), -origin.y());
-    }
-
-    // Respect scroll offset caused by html parents
-    TransformationMatrix ctm = RenderBox::absoluteTransform();
-    paintInfo.rect.move(static_cast<int>(ctm.e()), static_cast<int>(ctm.f()));
-
-    SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
-    paintInfo.context->concatCTM(TransformationMatrix().scale(svg->currentScale()));
-
-    if (!viewport().isEmpty()) {
-        if (style()->overflowX() != OVISIBLE)
-            paintInfo.context->clip(enclosingIntRect(viewport())); // FIXME: Eventually we'll want float-precision clipping
-        
-        paintInfo.context->concatCTM(TransformationMatrix().translate(viewport().x(), viewport().y()));
-    }
-
-    paintInfo.context->concatCTM(TransformationMatrix().translate(svg->currentTranslate().x(), svg->currentTranslate().y()));
+#if ENABLE(FILTERS)
+    const SVGRenderStyle* svgStyle = style()->svgStyle();
+    SVGResourceFilter* filter = getFilterById(document(), svgStyle->filter());
+    if (filter)
+        return true;
+#endif
+    return false;
 }
 
 void RenderSVGRoot::paint(PaintInfo& paintInfo, int parentX, int parentY)
@@ -151,53 +129,51 @@
     if (paintInfo.context->paintingDisabled())
         return;
 
-    calcViewport();
+    IntPoint parentOriginInContainer(parentX, parentY);
+    IntPoint borderBoxOriginInContainer = parentOriginInContainer + IntSize(x(), y());
 
-    // A value of zero disables rendering of the element. 
-    if (viewport().width() <= 0. || viewport().height() <= 0.)
+    if (hasBoxDecorations() && (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection)) 
+        paintBoxDecorations(paintInfo, borderBoxOriginInContainer.x(), borderBoxOriginInContainer.y());
+
+    // An empty viewport disables rendering.  FIXME: Should we still render filters?
+    if (viewportSize().isEmpty())
         return;
 
-    // This should only exist for <svg> renderers
-    if (hasBoxDecorations() && (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection)) 
-        paintBoxDecorations(paintInfo, x() + parentX, y() + parentY);
+    // Don't paint if we don't have kids, except if we have filters we should paint those.
+    if (!firstChild() && !selfWillPaint())
+        return;
 
-    if (!firstChild()) {
-#if ENABLE(SVG_FILTERS)
-        // Spec: groups w/o children still may render filter content.
-        const SVGRenderStyle* svgStyle = style()->svgStyle();
-        SVGResourceFilter* filter = getFilterById(document(), svgStyle->filter());
-        if (!filter)
-#endif
-            return;
-    }
-
+    // Make a copy of the PaintInfo because applyTransformToPaintInfo will modify the damage rect.
     RenderObject::PaintInfo childPaintInfo(paintInfo);
     childPaintInfo.context->save();
- 
-    applyContentTransforms(childPaintInfo, parentX, parentY);
+
+    // SVG does not support independent x/y clipping
+    if (style()->overflowX() != OVISIBLE)
+        childPaintInfo.context->clip(overflowClipRect(borderBoxOriginInContainer.x(), borderBoxOriginInContainer.y()));
+
+    // Convert from container offsets (html renderers) to a relative transform (svg renderers).
+    // Transform from our paint container's coordinate system to our local coords.
+    applyTransformToPaintInfo(childPaintInfo, localToRepaintContainerTransform(parentOriginInContainer));
 
     SVGResourceFilter* filter = 0;
-
-    FloatRect boundingBox = relativeBBox(true);
+    FloatRect boundingBox = repaintRectInLocalCoordinates();
     if (childPaintInfo.phase == PaintPhaseForeground)
         prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter);
 
-    SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
-    childPaintInfo.context->concatCTM(svg->viewBoxToViewTransform(width(), height()));
     RenderBox::paint(childPaintInfo, 0, 0);
 
     if (childPaintInfo.phase == PaintPhaseForeground)
-        finishRenderSVGContent(this, childPaintInfo, boundingBox, filter, paintInfo.context);
+        finishRenderSVGContent(this, childPaintInfo, filter, paintInfo.context);
 
     childPaintInfo.context->restore();
 
-    if ((childPaintInfo.phase == PaintPhaseOutline || childPaintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth() && style()->visibility() == VISIBLE)
-        paintOutline(childPaintInfo.context, m_absoluteBounds.x(), m_absoluteBounds.y(), m_absoluteBounds.width(), m_absoluteBounds.height(), style());
+    if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth() && style()->visibility() == VISIBLE)
+        paintOutline(paintInfo.context, borderBoxOriginInContainer.x(), borderBoxOriginInContainer.y(), width(), height(), style());
 }
 
-FloatRect RenderSVGRoot::viewport() const
+const FloatSize& RenderSVGRoot::viewportSize() const
 {
-    return m_viewport;
+    return m_viewportSize;
 }
 
 void RenderSVGRoot::calcViewport()
@@ -207,78 +183,77 @@
     if (!selfNeedsLayout() && !svg->hasRelativeValues())
         return;
 
-    SVGLength width = svg->width();
-    SVGLength height = svg->height();
     if (!svg->hasSetContainerSize()) {
-        m_viewport = FloatRect(0, 0, width.value(svg), height.value(svg));
-        return;
+        // In the normal case of <svg> being stand-alone or in a CSSBoxModel object we use
+        // RenderBox::width()/height() (which pulls data from RenderStyle)
+        m_viewportSize = FloatSize(width(), height());
+    } else {
+        // In the SVGImage case grab the SVGLength values off of SVGSVGElement and use
+        // the special relativeWidthValue accessors which respect the specified containerSize
+        SVGLength width = svg->width();
+        SVGLength height = svg->height();
+        float viewportWidth = (width.unitType() == LengthTypePercentage) ? svg->relativeWidthValue() : width.value(svg);
+        float viewportHeight = (height.unitType() == LengthTypePercentage) ? svg->relativeHeightValue() : height.value(svg);
+        m_viewportSize = FloatSize(viewportWidth, viewportHeight);
     }
-    m_viewport = FloatRect(0, 0, (width.unitType() == LengthTypePercentage) ?
-                                 svg->relativeWidthValue() : width.value(svg),
-                                 (height.unitType() == LengthTypePercentage) ?
-                                 svg->relativeHeightValue() : height.value(svg));
 }
 
-IntRect RenderSVGRoot::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
+// RenderBox methods will expect coordinates w/o any transforms in coordinates
+// relative to our borderBox origin.  This method gives us exactly that.
+TransformationMatrix RenderSVGRoot::localToBorderBoxTransform() const
 {
-    IntRect repaintRect;
-
-    for (RenderObject* current = firstChild(); current != 0; current = current->nextSibling())
-        repaintRect.unite(current->clippedOverflowRectForRepaint(repaintContainer));
-
-#if ENABLE(SVG_FILTERS)
-    // Filters can expand the bounding box
-    SVGResourceFilter* filter = getFilterById(document(), style()->svgStyle()->filter());
-    if (filter)
-        repaintRect.unite(enclosingIntRect(filter->filterBBoxForItemBBox(repaintRect)));
-#endif
-
-    return repaintRect;
-}
-
-void RenderSVGRoot::addFocusRingRects(GraphicsContext* graphicsContext, int, int)
-{
-    graphicsContext->addFocusRingRect(m_absoluteBounds);
-}
-
-void RenderSVGRoot::absoluteRects(Vector<IntRect>& rects, int, int)
-{
-    for (RenderObject* current = firstChild(); current != 0; current = current->nextSibling())
-        current->absoluteRects(rects, 0, 0);
-}
-
-void RenderSVGRoot::absoluteQuads(Vector<FloatQuad>& quads, bool)
-{
-    for (RenderObject* current = firstChild(); current != 0; current = current->nextSibling())
-        current->absoluteQuads(quads);
-}
-
-TransformationMatrix RenderSVGRoot::absoluteTransform() const
-{
-    TransformationMatrix ctm = RenderBox::absoluteTransform();
-    ctm.translate(x(), y());
+    TransformationMatrix ctm;
+    IntSize borderAndPadding = borderOriginToContentBox();
+    ctm.translate(borderAndPadding.width(), borderAndPadding.height());
     SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
     ctm.scale(svg->currentScale());
     ctm.translate(svg->currentTranslate().x(), svg->currentTranslate().y());
-    ctm.translate(viewport().x(), viewport().y());
     return svg->viewBoxToViewTransform(width(), height()) * ctm;
 }
 
-FloatRect RenderSVGRoot::relativeBBox(bool includeStroke) const
+IntSize RenderSVGRoot::parentOriginToBorderBox() const
 {
-    FloatRect rect;
-    
-    RenderObject* current = firstChild();
-    for (; current != 0; current = current->nextSibling()) {
-        FloatRect childBBox = current->relativeBBox(includeStroke);
-        FloatRect mappedBBox = current->localTransform().mapRect(childBBox);
-        // <svg> can have a viewBox contributing to the bbox
-        if (current->isSVGContainer())
-            mappedBBox = static_cast<RenderSVGContainer*>(current)->viewportTransform().mapRect(mappedBBox);
-        rect.unite(mappedBBox);
-    }
+    return IntSize(x(), y());
+}
 
-    return rect;
+IntSize RenderSVGRoot::borderOriginToContentBox() const
+{
+    return IntSize(borderLeft() + paddingLeft(), borderTop() + paddingTop());
+}
+
+TransformationMatrix RenderSVGRoot::localToRepaintContainerTransform(const IntPoint& parentOriginInContainer) const
+{
+    TransformationMatrix parentToContainer;
+    parentToContainer.translate(parentOriginInContainer.x(), parentOriginInContainer.y());
+    return localToParentTransform() * parentToContainer;
+}
+
+TransformationMatrix RenderSVGRoot::localToParentTransform() const
+{
+    IntSize parentToBorderBoxOffset = parentOriginToBorderBox();
+
+    TransformationMatrix borderBoxOriginToParentOrigin;
+    borderBoxOriginToParentOrigin.translate(parentToBorderBoxOffset.width(), parentToBorderBoxOffset.height());
+
+    return localToBorderBoxTransform() * borderBoxOriginToParentOrigin;
+}
+
+// FIXME: This method should be removed as soon as callers to RenderBox::absoluteTransform() can be removed.
+TransformationMatrix RenderSVGRoot::absoluteTransform() const
+{
+    // This would apply localTransform() twice if localTransform() were not the identity.
+    return localToParentTransform() * RenderBox::absoluteTransform();
+}
+
+FloatRect RenderSVGRoot::objectBoundingBox() const
+{
+    return computeContainerBoundingBox(this, false);
+}
+
+FloatRect RenderSVGRoot::repaintRectInLocalCoordinates() const
+{
+    // FIXME: This does not include the border but it should!
+    return computeContainerBoundingBox(this, true);
 }
 
 TransformationMatrix RenderSVGRoot::localTransform() const
@@ -286,37 +261,52 @@
     return TransformationMatrix();
 }
 
+void RenderSVGRoot::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
+{
+    // Apply our local transforms (except for x/y translation) and call RenderBox's method to handle all the normal CSS Box model bits
+    repaintRect = localToBorderBoxTransform().mapRect(repaintRect);
+    RenderBox::computeRectForRepaint(repaintContainer, repaintRect, fixed);
+}
+
+void RenderSVGRoot::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState) const
+{
+    ASSERT(!fixed); // We should have no fixed content in the SVG rendering tree.
+    ASSERT(useTransforms); // mapping a point through SVG w/o respecting trasnforms is useless.
+
+    // Transform to our border box and let RenderBox transform the rest of the way.
+    transformState.applyTransform(localToBorderBoxTransform());
+    RenderBox::mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
+}
+
 bool RenderSVGRoot::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int _x, int _y, int _tx, int _ty, HitTestAction hitTestAction)
 {
-    TransformationMatrix ctm = RenderBox::absoluteTransform();
+    IntPoint pointInContainer(_x, _y);
+    IntSize containerToParentOffset(_tx, _ty);
 
-    int sx = (_tx - static_cast<int>(ctm.e())); // scroll offset
-    int sy = (_ty - static_cast<int>(ctm.f())); // scroll offset
- 
-    if (!viewport().isEmpty()
-        && style()->overflowX() == OHIDDEN
-        && style()->overflowY() == OHIDDEN) {
-        int tx = x() - _tx + sx;
-        int ty = y() - _ty + sy;
+    IntPoint pointInParent = pointInContainer - containerToParentOffset;
+    IntPoint pointInBorderBox = pointInParent - parentOriginToBorderBox();
 
-        // Check if we need to do anything at all.
-        IntRect overflowBox = overflowRect(false);
-        overflowBox.move(tx, ty);
-        ctm.translate(viewport().x(), viewport().y());
-        double localX, localY;
-        ctm.inverse().map(_x - _tx, _y - _ty, localX, localY);
-        if (!overflowBox.contains((int)localX, (int)localY))
+    // Note: For now, we're ignoring hits to border and padding for <svg>
+
+    if (style()->overflowX() == OHIDDEN) {
+        // SVG doesn't support independent x/y overflow
+        ASSERT(style()->overflowY() == OHIDDEN);
+        IntPoint pointInContentBox = pointInBorderBox - borderOriginToContentBox();
+        if (!contentBoxRect().contains(pointInContentBox))
             return false;
     }
 
+    IntPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
+
     for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
-        if (child->nodeAtPoint(request, result, _x - sx, _y - sy, 0, 0, hitTestAction)) {
-            updateHitTestResult(result, IntPoint(_x - _tx, _y - _ty));
+        if (child->nodeAtFloatPoint(request, result, localPoint, hitTestAction)) {
+            // FIXME: CSS/HTML assumes the local point is relative to the border box, right?
+            updateHitTestResult(result, pointInBorderBox);
             return true;
         }
     }
-    
-    // Spec: Only graphical elements can be targeted by the mouse, period.
+
+    // Spec: Only graphical elements can be targeted by the mouse, so we don't check self here.
     // 16.4: "If there are no graphics elements whose relevant graphics content is under the pointer (i.e., there is no target element), the event is not dispatched."
     return false;
 }
diff --git a/WebCore/rendering/RenderSVGRoot.h b/WebCore/rendering/RenderSVGRoot.h
index 3d0a141..50866d2 100644
--- a/WebCore/rendering/RenderSVGRoot.h
+++ b/WebCore/rendering/RenderSVGRoot.h
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Google, Inc.  All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,13 +25,14 @@
 #if ENABLE(SVG)
 #include "RenderBox.h"
 #include "FloatRect.h"
+#include "SVGRenderSupport.h"
 
 namespace WebCore {
 
 class SVGStyledElement;
 class TransformationMatrix;
 
-class RenderSVGRoot : public RenderBox {
+class RenderSVGRoot : public RenderBox, SVGRenderBase {
 public:
     RenderSVGRoot(SVGStyledElement*);
     ~RenderSVGRoot();
@@ -48,34 +48,41 @@
     virtual int lineHeight(bool b, bool isRootLineBox = false) const;
     virtual int baselinePosition(bool b, bool isRootLineBox = false) const;
     virtual void calcPrefWidths();
-    
+
     virtual void layout();
     virtual void paint(PaintInfo&, int parentX, int parentY);
-    
-    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
-    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
-    virtual TransformationMatrix absoluteTransform() const;
+    virtual TransformationMatrix localToParentTransform() const;
 
     bool fillContains(const FloatPoint&) const;
     bool strokeContains(const FloatPoint&) const;
-    FloatRect relativeBBox(bool includeStroke = true) const;
-    
+
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect repaintRectInLocalCoordinates() const;
+
+    // FIXME: Both of these overrides should be removed.
     virtual TransformationMatrix localTransform() const;
-   
-    FloatRect viewport() const;
+    virtual TransformationMatrix absoluteTransform() const;
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
-    
+
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed);
+
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+
 private:
-    void calcViewport(); 
-    void applyContentTransforms(PaintInfo&, int parentX, int parentY);
+    void calcViewport();
+    const FloatSize& viewportSize() const;
+
+    bool selfWillPaint() const;
+
+    IntSize parentOriginToBorderBox() const;
+    IntSize borderOriginToContentBox() const;
+    TransformationMatrix localToRepaintContainerTransform(const IntPoint& parentOriginInContainer) const;
+    TransformationMatrix localToBorderBoxTransform() const;
 
     RenderObjectChildList m_children;
-    FloatRect m_viewport;
-    IntRect m_absoluteBounds;
+    FloatSize m_viewportSize;
 };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderSVGTSpan.cpp b/WebCore/rendering/RenderSVGTSpan.cpp
index d493c45..90ff36c 100644
--- a/WebCore/rendering/RenderSVGTSpan.cpp
+++ b/WebCore/rendering/RenderSVGTSpan.cpp
@@ -26,11 +26,6 @@
 #if ENABLE(SVG)
 #include "RenderSVGTSpan.h"
 
-#include "FloatQuad.h"
-#include "RenderBlock.h"
-#include "SVGInlineTextBox.h"
-#include "SVGRootInlineBox.h"
-
 namespace WebCore {
 
 RenderSVGTSpan::RenderSVGTSpan(Node* n)
@@ -38,46 +33,6 @@
 {
 }
 
-void RenderSVGTSpan::absoluteRects(Vector<IntRect>& rects, int, int, bool)
-{
-    InlineRunBox* firstBox = firstLineBox();
-
-    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
-    RenderBox* object = rootBox ? rootBox->block() : 0;
-
-    if (!object)
-        return;
-
-    int xRef = object->x();
-    int yRef = object->y();
- 
-    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
-        FloatRect rect(xRef + curr->x(), yRef + curr->y(), curr->width(), curr->height());
-        // FIXME: broken with CSS transforms
-        rects.append(enclosingIntRect(absoluteTransform().mapRect(rect)));
-    }
-}
-
-void RenderSVGTSpan::absoluteQuads(Vector<FloatQuad>& quads, bool)
-{
-    InlineRunBox* firstBox = firstLineBox();
-
-    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
-    RenderBox* object = rootBox ? rootBox->block() : 0;
-
-    if (!object)
-        return;
-
-    int xRef = object->x();
-    int yRef = object->y();
- 
-    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
-        FloatRect rect(xRef + curr->x(), yRef + curr->y(), curr->width(), curr->height());
-        // FIXME: broken with CSS transforms
-        quads.append(absoluteTransform().mapRect(rect));
-    }
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/rendering/RenderSVGTSpan.h b/WebCore/rendering/RenderSVGTSpan.h
index d34cd2f..652c5e3 100644
--- a/WebCore/rendering/RenderSVGTSpan.h
+++ b/WebCore/rendering/RenderSVGTSpan.h
@@ -1,8 +1,7 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
  *           (C) 2006 Apple Computer Inc.
+ *           (C) 2009 Google Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,8 +31,12 @@
 public:
     RenderSVGTSpan(Node*);
     virtual const char* renderName() const { return "RenderSVGTSpan"; }
-    virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+
+    // FIXME: These are incorrect, but have always behaved this way.
+    // These empty implementations prevent us from hitting RenderObject ASSERTS.
+    // tspan.getBBox() will be wrong, and repainting for tspans may not work correctly!
+    virtual FloatRect objectBoundingBox() const { return FloatRect(); }
+    virtual FloatRect repaintRectInLocalCoordinates() const { return FloatRect(); }
 };
 }
 
diff --git a/WebCore/rendering/RenderSVGText.cpp b/WebCore/rendering/RenderSVGText.cpp
index 8fef1f3..9e9809d 100644
--- a/WebCore/rendering/RenderSVGText.cpp
+++ b/WebCore/rendering/RenderSVGText.cpp
@@ -33,8 +33,10 @@
 #include "FloatQuad.h"
 #include "GraphicsContext.h"
 #include "PointerEventsHitRules.h"
+#include "RenderLayer.h"
 #include "RenderSVGRoot.h"
 #include "SVGLengthList.h"
+#include "SVGRenderSupport.h"
 #include "SVGResourceFilter.h"
 #include "SVGRootInlineBox.h"
 #include "SVGTextElement.h"
@@ -49,92 +51,79 @@
 {
 }
 
-IntRect RenderSVGText::clippedOverflowRectForRepaint(RenderBoxModelObject* /*repaintContainer*/)
+IntRect RenderSVGText::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
-    // FIXME: handle non-root repaintContainer
-    FloatRect repaintRect = absoluteTransform().mapRect(relativeBBox(true));
-
-#if ENABLE(SVG_FILTERS)
-    // Filters can expand the bounding box
-    SVGResourceFilter* filter = getFilterById(document(), style()->svgStyle()->filter());
-    if (filter)
-        repaintRect.unite(filter->filterBBoxForItemBBox(repaintRect));
-#endif
-
-    if (!repaintRect.isEmpty())
-        repaintRect.inflate(1); // inflate 1 pixel for antialiasing
-
-    return enclosingIntRect(repaintRect);
+    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
 }
 
-bool RenderSVGText::calculateLocalTransform()
+void RenderSVGText::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
-    TransformationMatrix oldTransform = m_localTransform;
-    m_localTransform = static_cast<SVGTextElement*>(node())->animatedLocalTransform();
-    return (oldTransform != m_localTransform);
+    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
+}
+
+void RenderSVGText::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState) const
+{
+    SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
 }
 
 void RenderSVGText::layout()
 {
     ASSERT(needsLayout());
-    
+
     // FIXME: This is a hack to avoid the RenderBlock::layout() partial repainting code which is not (yet) SVG aware
     setNeedsLayout(true);
 
-    // FIXME: using m_absoluteBounds breaks if containerForRepaint() is not the root
-    LayoutRepainter repainter(*this, checkForRepaintDuringLayout(), &m_absoluteBounds);
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
 
     // Best guess for a relative starting point
     SVGTextElement* text = static_cast<SVGTextElement*>(node());
     int xOffset = (int)(text->x()->getFirst().value(text));
     int yOffset = (int)(text->y()->getFirst().value(text));
     setLocation(xOffset, yOffset);
-    
-    calculateLocalTransform();
+
+    m_localTransform = text->animatedLocalTransform();
 
     RenderBlock::layout();
 
-    m_absoluteBounds = absoluteClippedOverflowRect();
-
     repainter.repaintAfterLayout();
-        
     setNeedsLayout(false);
 }
 
 RootInlineBox* RenderSVGText::createRootBox()
 {
-    return new (renderArena()) SVGRootInlineBox(this);
+    RootInlineBox* box = new (renderArena()) SVGRootInlineBox(this);
+    box->setIsSVG(true);
+    return box;
 }
 
-bool RenderSVGText::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int _x, int _y, int _tx, int _ty, HitTestAction hitTestAction)
+bool RenderSVGText::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
     PointerEventsHitRules hitRules(PointerEventsHitRules::SVG_TEXT_HITTESTING, style()->pointerEvents());
     bool isVisible = (style()->visibility() == VISIBLE);
     if (isVisible || !hitRules.requireVisible) {
         if ((hitRules.canHitStroke && (style()->svgStyle()->hasStroke() || !hitRules.requireStroke))
             || (hitRules.canHitFill && (style()->svgStyle()->hasFill() || !hitRules.requireFill))) {
-            TransformationMatrix totalTransform = absoluteTransform();
-            double localX, localY;
-            totalTransform.inverse().map(_x, _y, localX, localY);
-            FloatPoint hitPoint(_x, _y);
-            return RenderBlock::nodeAtPoint(request, result, (int)localX, (int)localY, _tx, _ty, hitTestAction);
+            FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
+            return RenderBlock::nodeAtPoint(request, result, (int)localPoint.x(), (int)localPoint.y(), 0, 0, hitTestAction);
         }
     }
 
     return false;
 }
 
-void RenderSVGText::absoluteRects(Vector<IntRect>& rects, int, int, bool)
+bool RenderSVGText::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int, HitTestAction)
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+void RenderSVGText::absoluteRects(Vector<IntRect>& rects, int, int)
 {
     RenderSVGRoot* root = findSVGRootObject(parent());
     if (!root)
         return;
-
-    FloatPoint absPos = localToAbsolute();
-
-    TransformationMatrix htmlParentCtm = root->RenderBox::absoluteTransform();
  
-    // Don't use relativeBBox here, as it's unites the selection rects. Makes it hard
+    // Don't use objectBoundingBox here, as it's unites the selection rects. Makes it hard
     // to spot errors, if there are any using WebInspector. Individually feed them into 'rects'.
     for (InlineRunBox* runBox = firstLineBox(); runBox; runBox = runBox->nextLineBox()) {
         ASSERT(runBox->isInlineFlowBox());
@@ -142,24 +131,20 @@
         InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(runBox);
         for (InlineBox* box = flowBox->firstChild(); box; box = box->nextOnLine()) {
             FloatRect boxRect(box->x(), box->y(), box->width(), box->height());
-            boxRect.move(narrowPrecisionToFloat(absPos.x() - htmlParentCtm.e()), narrowPrecisionToFloat(absPos.y() - htmlParentCtm.f()));
-            // FIXME: broken with CSS transforms
-            rects.append(enclosingIntRect(absoluteTransform().mapRect(boxRect)));
+            // FIXME: crawling up the parent chain to map each rect is very inefficient
+            // we should compute the absoluteTransform outside this loop first.
+            rects.append(enclosingIntRect(localToAbsoluteQuad(boxRect).boundingBox()));
         }
     }
 }
 
-void RenderSVGText::absoluteQuads(Vector<FloatQuad>& quads, bool)
+void RenderSVGText::absoluteQuads(Vector<FloatQuad>& quads)
 {
     RenderSVGRoot* root = findSVGRootObject(parent());
     if (!root)
         return;
-
-    FloatPoint absPos = localToAbsolute();
-
-    TransformationMatrix htmlParentCtm = root->RenderBox::absoluteTransform();
  
-    // Don't use relativeBBox here, as it's unites the selection rects. Makes it hard
+    // Don't use objectBoundingBox here, as it's unites the selection rects. Makes it hard
     // to spot errors, if there are any using WebInspector. Individually feed them into 'rects'.
     for (InlineRunBox* runBox = firstLineBox(); runBox; runBox = runBox->nextLineBox()) {
         ASSERT(runBox->isInlineFlowBox());
@@ -167,34 +152,44 @@
         InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(runBox);
         for (InlineBox* box = flowBox->firstChild(); box; box = box->nextOnLine()) {
             FloatRect boxRect(box->x(), box->y(), box->width(), box->height());
-            boxRect.move(narrowPrecisionToFloat(absPos.x() - htmlParentCtm.e()), narrowPrecisionToFloat(absPos.y() - htmlParentCtm.f()));
-            // FIXME: broken with CSS transforms
-            quads.append(absoluteTransform().mapRect(boxRect));
+            // FIXME: crawling up the parent chain to map each quad is very inefficient
+            // we should compute the absoluteTransform outside this loop first.
+            quads.append(localToAbsoluteQuad(boxRect));
         }
     }
 }
 
 void RenderSVGText::paint(PaintInfo& paintInfo, int, int)
 {   
-    RenderObject::PaintInfo pi(paintInfo);
-    pi.rect = absoluteTransform().inverse().mapRect(pi.rect);
+    PaintInfo pi(paintInfo);
+    pi.context->save();
+    applyTransformToPaintInfo(pi, localToParentTransform());
     RenderBlock::paint(pi, 0, 0);
+    pi.context->restore();
 }
 
-FloatRect RenderSVGText::relativeBBox(bool includeStroke) const
+FloatRect RenderSVGText::objectBoundingBox() const
 {
-    FloatRect repaintRect;
+    FloatRect boundingBox;
 
     for (InlineRunBox* runBox = firstLineBox(); runBox; runBox = runBox->nextLineBox()) {
         ASSERT(runBox->isInlineFlowBox());
 
         InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(runBox);
         for (InlineBox* box = flowBox->firstChild(); box; box = box->nextOnLine())
-            repaintRect.unite(FloatRect(box->x(), box->y(), box->width(), box->height()));
+            boundingBox.unite(FloatRect(box->x(), box->y(), box->width(), box->height()));
     }
 
+    boundingBox.move(x(), y());
+    return boundingBox;
+}
+
+FloatRect RenderSVGText::repaintRectInLocalCoordinates() const
+{
+    FloatRect repaintRect = objectBoundingBox();
+
     // SVG needs to include the strokeWidth(), not the textStrokeWidth().
-    if (includeStroke && style()->svgStyle()->hasStroke()) {
+    if (style()->svgStyle()->hasStroke()) {
         float strokeWidth = SVGRenderStyle::cssPrimitiveToLength(this, style()->svgStyle()->strokeWidth(), 0.0f);
 
 #if ENABLE(SVG_FONTS)
@@ -210,7 +205,8 @@
         repaintRect.inflate(strokeWidth);
     }
 
-    repaintRect.move(x(), y());
+    repaintRect.unite(filterBoundingBoxForRenderer(this));
+
     return repaintRect;
 }
 
diff --git a/WebCore/rendering/RenderSVGText.h b/WebCore/rendering/RenderSVGText.h
index 2cd71fa..c1f1430 100644
--- a/WebCore/rendering/RenderSVGText.h
+++ b/WebCore/rendering/RenderSVGText.h
@@ -38,29 +38,36 @@
     RenderSVGText(SVGTextElement* node);
 
     virtual const char* renderName() const { return "RenderSVGText"; }
-    
+
     virtual bool isSVGText() const { return true; }
-    
-    bool calculateLocalTransform();
-    virtual TransformationMatrix localTransform() const { return m_localTransform; }
-    
+
+    virtual TransformationMatrix localToParentTransform() const { return m_localTransform; }
+
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
-    
+    virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
+
     virtual bool requiresLayer() const { return false; }
     virtual void layout();
-    
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
 
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
-    virtual FloatRect relativeBBox(bool includeStroke = true) const;
-    
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
+
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+
+    virtual FloatRect objectBoundingBox() const;
+    virtual FloatRect repaintRectInLocalCoordinates() const;
+
 private:
+    // FIXME: This can be removed when localTransform() is removed from RenderObject
+    virtual TransformationMatrix localTransform() const { return m_localTransform; }
+
     virtual RootInlineBox* createRootBox();
 
     TransformationMatrix m_localTransform;
-    IntRect m_absoluteBounds;
 };
 
 }
diff --git a/WebCore/rendering/RenderSVGTextPath.cpp b/WebCore/rendering/RenderSVGTextPath.cpp
index 4ae29bf..5d977f9 100644
--- a/WebCore/rendering/RenderSVGTextPath.cpp
+++ b/WebCore/rendering/RenderSVGTextPath.cpp
@@ -78,46 +78,6 @@
     return static_cast<SVGTextPathElement*>(node())->method() == SVG_TEXTPATH_METHODTYPE_STRETCH;
 }
 
-void RenderSVGTextPath::absoluteRects(Vector<IntRect>& rects, int, int)
-{
-    InlineRunBox* firstBox = firstLineBox();
-
-    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
-    RenderBlock* object = rootBox ? rootBox->block() : 0;
-
-    if (!object)
-        return;
-
-    int xRef = object->x();
-    int yRef = object->y();
-
-    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
-        FloatRect rect(xRef + curr->x(), yRef + curr->y(), curr->width(), curr->height());
-        // FIXME: broken with CSS transforms
-        rects.append(enclosingIntRect(absoluteTransform().mapRect(rect)));
-    }
-}
-
-void RenderSVGTextPath::absoluteQuads(Vector<FloatQuad>& quads, bool)
-{
-    InlineRunBox* firstBox = firstLineBox();
-
-    SVGRootInlineBox* rootBox = firstBox ? static_cast<SVGInlineTextBox*>(firstBox)->svgRootInlineBox() : 0;
-    RenderBlock* object = rootBox ? rootBox->block() : 0;
-
-    if (!object)
-        return;
-
-    int xRef = object->x();
-    int yRef = object->y();
-
-    for (InlineRunBox* curr = firstBox; curr; curr = curr->nextLineBox()) {
-        FloatRect rect(xRef + curr->x(), yRef + curr->y(), curr->width(), curr->height());
-        // FIXME: broken with CSS transforms
-        quads.append(absoluteTransform().mapRect(rect));
-    }
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/rendering/RenderSVGTextPath.h b/WebCore/rendering/RenderSVGTextPath.h
index 4fd4cc3..efab659 100644
--- a/WebCore/rendering/RenderSVGTextPath.h
+++ b/WebCore/rendering/RenderSVGTextPath.h
@@ -38,8 +38,6 @@
         bool stretchMethod() const;
 
         virtual const char* renderName() const { return "RenderSVGTextPath"; }
-        virtual void absoluteRects(Vector<IntRect>& rects, int tx, int ty);
-        virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
 
     private:
         float m_startOffset;
diff --git a/WebCore/rendering/RenderSVGTransformableContainer.cpp b/WebCore/rendering/RenderSVGTransformableContainer.cpp
index 6d65b55..2324eee 100644
--- a/WebCore/rendering/RenderSVGTransformableContainer.cpp
+++ b/WebCore/rendering/RenderSVGTransformableContainer.cpp
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
-    2004, 2005, 2006 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+                  2004, 2005, 2006 Rob Buis <buis@kde.org>
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -35,11 +34,19 @@
 {
 }
 
-bool RenderSVGTransformableContainer::calculateLocalTransform()
+TransformationMatrix RenderSVGTransformableContainer::localToParentTransform() const
 {
-    TransformationMatrix oldTransform = m_localTransform;
+    return m_localTransform;
+}
+
+TransformationMatrix RenderSVGTransformableContainer::localTransform() const
+{
+    return m_localTransform;
+}
+
+void RenderSVGTransformableContainer::calculateLocalTransform()
+{
     m_localTransform = static_cast<SVGStyledTransformableElement*>(node())->animatedLocalTransform();
-    return (m_localTransform != oldTransform);
 }
 
 }
diff --git a/WebCore/rendering/RenderSVGTransformableContainer.h b/WebCore/rendering/RenderSVGTransformableContainer.h
index 897cc63..c929761 100644
--- a/WebCore/rendering/RenderSVGTransformableContainer.h
+++ b/WebCore/rendering/RenderSVGTransformableContainer.h
@@ -1,5 +1,6 @@
 /*
-    Copyright (C) 2007 Eric Seidel <eric@webkit.org
+    Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+                  2009 Google, Inc.
       
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -17,7 +18,6 @@
     Boston, MA 02110-1301, USA.
  */
 
-
 #ifndef RenderSVGTransformableContainer_h
 #define RenderSVGTransformableContainer_h
 
@@ -30,8 +30,15 @@
     class RenderSVGTransformableContainer : public RenderSVGContainer {
     public:
         RenderSVGTransformableContainer(SVGStyledTransformableElement*);
-        
-        virtual bool calculateLocalTransform();
+
+        virtual TransformationMatrix localToParentTransform() const;
+
+    private:
+        virtual void calculateLocalTransform();
+        // FIXME: This can be made non-virtual once SVGRenderTreeAsText stops using localTransform()
+        virtual TransformationMatrix localTransform() const;
+
+        TransformationMatrix m_localTransform;
     };
 }
 
diff --git a/WebCore/rendering/RenderSVGViewportContainer.cpp b/WebCore/rendering/RenderSVGViewportContainer.cpp
index 7885c4c..d208621 100644
--- a/WebCore/rendering/RenderSVGViewportContainer.cpp
+++ b/WebCore/rendering/RenderSVGViewportContainer.cpp
@@ -2,8 +2,7 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
-
-    This file is part of the KDE project
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -43,34 +42,6 @@
 {
 }
 
-void RenderSVGViewportContainer::layout()
-{
-    ASSERT(needsLayout());
-    
-    calcViewport();
-    
-    // Arbitrary affine transforms are incompatible with LayoutState.
-    view()->disableLayoutState();
-    
-    // FIXME: using m_absoluteBounds breaks if containerForRepaint() is not the root
-    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && selfNeedsLayout(), &m_absoluteBounds);
-    
-    calcBounds();    
-    
-    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-        if (selfNeedsLayout())
-            child->setNeedsLayout(true);
-        
-        child->layoutIfNeeded();
-        ASSERT(!child->needsLayout());
-    }
-    
-    repainter.repaintAfterLayout();
-    
-    view()->enableLayoutState();
-    setNeedsLayout(false);
-}
-
 void RenderSVGViewportContainer::paint(PaintInfo& paintInfo, int parentX, int parentY)
 {
     // A value of zero disables rendering of the element. 
@@ -80,22 +51,10 @@
     RenderSVGContainer::paint(paintInfo, parentX, parentY);
 }
 
-void RenderSVGViewportContainer::applyContentTransforms(PaintInfo& paintInfo)
+void RenderSVGViewportContainer::applyViewportClip(PaintInfo& paintInfo)
 {
-    if (!viewport().isEmpty()) {
-        if (style()->overflowX() != OVISIBLE)
-            paintInfo.context->clip(enclosingIntRect(viewport())); // FIXME: Eventually we'll want float-precision clipping
-        
-        paintInfo.context->concatCTM(TransformationMatrix().translate(viewport().x(), viewport().y()));
-    }
-
-    RenderSVGContainer::applyContentTransforms(paintInfo);
-}
-
-void RenderSVGViewportContainer::applyAdditionalTransforms(PaintInfo& paintInfo)
-{
-    paintInfo.context->concatCTM(viewportTransform());
-    RenderSVGContainer::applyAdditionalTransforms(paintInfo);
+    if (style()->overflowX() != OVISIBLE)
+        paintInfo.context->clip(enclosingIntRect(viewport())); // FIXME: Eventually we'll want float-precision clipping
 }
 
 FloatRect RenderSVGViewportContainer::viewport() const
@@ -137,53 +96,35 @@
         SVGMarkerElement* marker = static_cast<SVGMarkerElement*>(node());
         return marker->viewBoxToViewTransform(viewport().width(), viewport().height());
     }
- 
-     return TransformationMatrix();
+
+    return TransformationMatrix();
 }
 
+TransformationMatrix RenderSVGViewportContainer::localToParentTransform() const
+{
+    TransformationMatrix viewportTranslation;
+    viewportTranslation.translate(viewport().x(), viewport().y());
+    return viewportTransform() * viewportTranslation;
+    // If this class were ever given a localTransform(), then the above would read:
+    // return viewportTransform() * localTransform() * viewportTranslation;
+}
+
+// FIXME: This method should be removed as soon as callers to RenderBox::absoluteTransform() can be removed.
 TransformationMatrix RenderSVGViewportContainer::absoluteTransform() const
 {
-    TransformationMatrix ctm = RenderObject::absoluteTransform();
-    ctm.translate(viewport().x(), viewport().y());
-    return viewportTransform() * ctm;
+    // This would apply localTransform() twice if localTransform() were not the identity.
+    return localToParentTransform() * RenderSVGContainer::absoluteTransform();
 }
 
-bool RenderSVGViewportContainer::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int _x, int _y, int _tx, int _ty, HitTestAction hitTestAction)
+bool RenderSVGViewportContainer::pointIsInsideViewportClip(const FloatPoint& pointInParent)
 {
-    if (!viewport().isEmpty()
-        && style()->overflowX() == OHIDDEN
-        && style()->overflowY() == OHIDDEN) {
-        // Check if we need to do anything at all.
-        IntRect overflowBox = IntRect(0, 0, width(), height());
-        overflowBox.move(_tx, _ty);
-        TransformationMatrix ctm = RenderObject::absoluteTransform();
-        ctm.translate(viewport().x(), viewport().y());
-        double localX, localY;
-        ctm.inverse().map(_x - _tx, _y - _ty, localX, localY);
-        if (!overflowBox.contains((int)localX, (int)localY))
+    // Respect the viewport clip (which is in parent coords).  SVG does not support separate x/y overflow rules.
+    if (style()->overflowX() == OHIDDEN) {
+        ASSERT(style()->overflowY() == OHIDDEN);
+        if (!viewport().contains(pointInParent))
             return false;
     }
-
-    int sx = 0;
-    int sy = 0;
-
-    // Respect parent translation offset for non-outermost <svg> elements.
-    // Outermost <svg> element is handled by RenderSVGRoot.
-    if (node()->hasTagName(SVGNames::svgTag)) {
-        sx = _tx;
-        sy = _ty;
-    }
-
-    for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
-        if (child->nodeAtPoint(request, result, _x - sx, _y - sy, _tx, _ty, hitTestAction)) {
-            updateHitTestResult(result, IntPoint(_x - _tx, _y - _ty));
-            return true;
-        }
-    }
-
-    // Spec: Only graphical elements can be targeted by the mouse, period.
-    // 16.4: "If there are no graphics elements whose relevant graphics content is under the pointer (i.e., there is no target element), the event is not dispatched."
-    return false;
+    return true;
 }
 
 }
diff --git a/WebCore/rendering/RenderSVGViewportContainer.h b/WebCore/rendering/RenderSVGViewportContainer.h
index 2e4a49c..8657af4 100644
--- a/WebCore/rendering/RenderSVGViewportContainer.h
+++ b/WebCore/rendering/RenderSVGViewportContainer.h
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+                  2009 Google, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -29,6 +28,8 @@
 
 namespace WebCore {
 
+// This is used for non-root <svg> elements and <marker> elements, neither of which are SVGTransformable
+// thus we inherit from RenderSVGContainer instead of RenderSVGTransformableContainer
 class RenderSVGViewportContainer : public RenderSVGContainer {
 public:
     RenderSVGViewportContainer(SVGStyledElement*);
@@ -37,22 +38,24 @@
     virtual bool isSVGContainer() const { return true; }
     virtual const char* renderName() const { return "RenderSVGViewportContainer"; }
 
-    virtual void layout();
     virtual void paint(PaintInfo&, int parentX, int parentY);
 
-    virtual TransformationMatrix absoluteTransform() const;
-    virtual TransformationMatrix viewportTransform() const;
+    virtual TransformationMatrix localToParentTransform() const;
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    // FIXME: This override should be removed once callers of RenderBox::absoluteTransform() can be removed.
+    virtual TransformationMatrix absoluteTransform() const;
 
     FloatRect viewport() const;
 
-private:
-    void calcViewport(); 
+    // FIXME: This is only public for SVGResourceMarker::draw, likely the callsite should be changed.
+    TransformationMatrix viewportTransform() const;
 
-    virtual void applyContentTransforms(PaintInfo&);
-    virtual void applyAdditionalTransforms(PaintInfo&);
-    
+private:
+    virtual void calcViewport();
+
+    virtual void applyViewportClip(PaintInfo&);
+    virtual bool pointIsInsideViewportClip(const FloatPoint& pointInParent);
+
     FloatRect m_viewport;
 };
   
diff --git a/WebCore/rendering/RenderSlider.cpp b/WebCore/rendering/RenderSlider.cpp
index 08ebadf..f1e35e5 100644
--- a/WebCore/rendering/RenderSlider.cpp
+++ b/WebCore/rendering/RenderSlider.cpp
@@ -412,7 +412,7 @@
 
         // FIXME: It seems like this could send extra change events if the same value is set
         // multiple times with no layout in between.
-        element->onChange();
+        element->dispatchFormControlChangeEvent();
     }
 }
 
diff --git a/WebCore/rendering/RenderTable.cpp b/WebCore/rendering/RenderTable.cpp
index f4b1033..ed1be3e 100644
--- a/WebCore/rendering/RenderTable.cpp
+++ b/WebCore/rendering/RenderTable.cpp
@@ -115,7 +115,6 @@
         beforeChild = lastChild();
 
     bool wrapInAnonymousSection = !child->isPositioned();
-    bool isTableElement = node() && node()->hasTagName(tableTag);
 
     if (child->isRenderBlock() && child->style()->display() == TABLE_CAPTION) {
         // First caption wins.
@@ -135,44 +134,37 @@
     } else if (child->isTableSection()) {
         switch (child->style()->display()) {
             case TABLE_HEADER_GROUP:
-                if (child->isTableSection()) {
-                    resetSectionPointerIfNotBefore(m_head, beforeChild);
-                    if (!m_head) {
-                        m_head = static_cast<RenderTableSection*>(child);
-                    } else {
-                        resetSectionPointerIfNotBefore(m_firstBody, beforeChild);
-                        if (!m_firstBody) 
-                            m_firstBody = static_cast<RenderTableSection*>(child);
-                    }
+                resetSectionPointerIfNotBefore(m_head, beforeChild);
+                if (!m_head) {
+                    m_head = static_cast<RenderTableSection*>(child);
+                } else {
+                    resetSectionPointerIfNotBefore(m_firstBody, beforeChild);
+                    if (!m_firstBody) 
+                        m_firstBody = static_cast<RenderTableSection*>(child);
                 }
                 wrapInAnonymousSection = false;
                 break;
             case TABLE_FOOTER_GROUP:
-                if (child->isTableSection()) {
-                    resetSectionPointerIfNotBefore(m_foot, beforeChild);
-                    if (!m_foot) {
-                        m_foot = static_cast<RenderTableSection*>(child);
-                        wrapInAnonymousSection = false;
-                        break;
-                    }
+                resetSectionPointerIfNotBefore(m_foot, beforeChild);
+                if (!m_foot) {
+                    m_foot = static_cast<RenderTableSection*>(child);
+                    wrapInAnonymousSection = false;
+                    break;
                 }
                 // Fall through.
             case TABLE_ROW_GROUP:
-                if (child->isTableSection()) {
-                    resetSectionPointerIfNotBefore(m_firstBody, beforeChild);
-                    if (!m_firstBody)
-                        m_firstBody = static_cast<RenderTableSection*>(child);
-                }
+                resetSectionPointerIfNotBefore(m_firstBody, beforeChild);
+                if (!m_firstBody)
+                    m_firstBody = static_cast<RenderTableSection*>(child);
                 wrapInAnonymousSection = false;
                 break;
             default:
                 ASSERT_NOT_REACHED();
         }
-    } else if (child->isTableCell() || child->isTableRow()) {
+    } else if (child->isTableCell() || child->isTableRow())
         wrapInAnonymousSection = true;
-    } else
-        // Allow a form to just sit at the top level.
-        wrapInAnonymousSection = !isTableElement || !child->node() || !(child->node()->hasTagName(formTag) && document()->isHTMLDocument());
+    else
+        wrapInAnonymousSection = true;
 
     if (!wrapInAnonymousSection) {
         // If the next renderer is actually wrapped in an anonymous table section, we need to go up and find that.
diff --git a/WebCore/rendering/RenderTableRow.cpp b/WebCore/rendering/RenderTableRow.cpp
index c0603a2..33b2c39 100644
--- a/WebCore/rendering/RenderTableRow.cpp
+++ b/WebCore/rendering/RenderTableRow.cpp
@@ -33,10 +33,6 @@
 #include "RenderTableCell.h"
 #include "RenderView.h"
 
-#if ENABLE(WML)
-#include "WMLNames.h"
-#endif
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -74,19 +70,7 @@
     if (!beforeChild && isAfterContent(lastChild()))
         beforeChild = lastChild();
 
-    bool isTableRow = node() && node()->hasTagName(trTag);
-
-#if ENABLE(WML)
-    if (!isTableRow && node() && node()->isWMLElement())
-        isTableRow = node()->hasTagName(WMLNames::trTag);
-#endif
-
     if (!child->isTableCell()) {
-        if (isTableRow && child->node() && child->node()->hasTagName(formTag) && document()->isHTMLDocument()) {
-            RenderBox::addChild(child, beforeChild);
-            return;
-        }
-
         RenderObject* last = beforeChild;
         if (!last)
             last = lastChild();
@@ -121,7 +105,7 @@
     if (parent())
         section()->addCell(cell, this);
 
-    ASSERT(!beforeChild || beforeChild->isTableCell() || isTableRow && beforeChild->node() && beforeChild->node()->hasTagName(formTag) && document()->isHTMLDocument());
+    ASSERT(!beforeChild || beforeChild->isTableCell());
     RenderBox::addChild(cell, beforeChild);
 
     if (beforeChild || nextSibling())
diff --git a/WebCore/rendering/RenderTableSection.cpp b/WebCore/rendering/RenderTableSection.cpp
index 59fb324..efa8850 100644
--- a/WebCore/rendering/RenderTableSection.cpp
+++ b/WebCore/rendering/RenderTableSection.cpp
@@ -51,7 +51,6 @@
     , m_gridRows(0)
     , m_cCol(0)
     , m_cRow(-1)
-    , m_needsCellRecalc(false)
     , m_outerBorderLeft(0)
     , m_outerBorderRight(0)
     , m_outerBorderTop(0)
@@ -60,6 +59,7 @@
     , m_overflowWidth(0)
     , m_overflowTop(0)
     , m_overflowHeight(0)
+    , m_needsCellRecalc(false)
     , m_hasOverflowingCell(false)
 {
     // init RenderObject attributes
@@ -89,14 +89,7 @@
     if (!beforeChild && isAfterContent(lastChild()))
         beforeChild = lastChild();
 
-    bool isTableSection = node() && (node()->hasTagName(theadTag) || node()->hasTagName(tbodyTag) || node()->hasTagName(tfootTag));
-
     if (!child->isTableRow()) {
-        if (isTableSection && child->node() && child->node()->hasTagName(formTag) && document()->isHTMLDocument()) {
-            RenderBox::addChild(child, beforeChild);
-            return;
-        }
-
         RenderObject* last = beforeChild;
         if (!last)
             last = lastChild();
@@ -115,7 +108,7 @@
             return;
         }
 
-        RenderObject* row = new (renderArena()) RenderTableRow(document() /* anonymous table */);
+        RenderObject* row = new (renderArena()) RenderTableRow(document() /* anonymous table row */);
         RefPtr<RenderStyle> newStyle = RenderStyle::create();
         newStyle->inheritFrom(style());
         newStyle->setDisplay(TABLE_ROW);
@@ -147,7 +140,7 @@
     while (beforeChild && beforeChild->parent() != this)
         beforeChild = beforeChild->parent();
 
-    ASSERT(!beforeChild || beforeChild->isTableRow() || isTableSection && beforeChild->node() && beforeChild->node()->hasTagName(formTag) && document()->isHTMLDocument());
+    ASSERT(!beforeChild || beforeChild->isTableRow());
     RenderBox::addChild(child, beforeChild);
 }
 
diff --git a/WebCore/rendering/RenderTableSection.h b/WebCore/rendering/RenderTableSection.h
index 5c57714..30614f0 100644
--- a/WebCore/rendering/RenderTableSection.h
+++ b/WebCore/rendering/RenderTableSection.h
@@ -140,13 +140,13 @@
     RenderObjectChildList m_children;
 
     Vector<RowStruct> m_grid;
-    int m_gridRows;
     Vector<int> m_rowPos;
 
+    int m_gridRows;
+
     // the current insertion position
     int m_cCol;
     int m_cRow;
-    bool m_needsCellRecalc;
 
     int m_outerBorderLeft;
     int m_outerBorderRight;
@@ -156,6 +156,8 @@
     int m_overflowWidth;
     int m_overflowTop;
     int m_overflowHeight;
+
+    bool m_needsCellRecalc;
     bool m_hasOverflowingCell;
 };
 
diff --git a/WebCore/rendering/RenderText.cpp b/WebCore/rendering/RenderText.cpp
index 2dfdb27..ada3961 100644
--- a/WebCore/rendering/RenderText.cpp
+++ b/WebCore/rendering/RenderText.cpp
@@ -54,10 +54,10 @@
 
 RenderText::RenderText(Node* node, PassRefPtr<StringImpl> str)
      : RenderObject(node)
-     , m_text(str)
+     , m_minWidth(-1)
+     , m_text(document()->displayStringModifiedByEncoding(str))
      , m_firstTextBox(0)
      , m_lastTextBox(0)
-     , m_minWidth(-1)
      , m_maxWidth(-1)
      , m_beginMinWidth(0)
      , m_endMinWidth(0)
@@ -65,11 +65,15 @@
      , m_linesDirty(false)
      , m_containsReversedText(false)
      , m_isAllASCII(charactersAreAllASCII(m_text.get()))
+     , m_knownNotToUseFallbackFonts(false)
 {
     ASSERT(m_text);
-    setIsText();
-    m_text = document()->displayStringModifiedByEncoding(PassRefPtr<StringImpl>(m_text));
 
+    setIsText();
+
+    // FIXME: It would be better to call this only if !m_text->containsOnlyWhitespace().
+    // But that might slow things down, and maybe should only be done if visuallyNonEmpty
+    // is still false. Not making any change for now, but should consider in the future.
     view()->frameView()->setIsVisuallyNonEmpty();
 }
 
@@ -104,8 +108,10 @@
     // we already did this for the parent of the text run.
     // We do have to schedule layouts, though, since a style change can force us to
     // need to relayout.
-    if (diff == StyleDifferenceLayout)
+    if (diff == StyleDifferenceLayout) {
         setNeedsLayoutAndPrefWidthsRecalc();
+        m_knownNotToUseFallbackFonts = false;
+    }
 
     ETextTransform oldTransform = oldStyle ? oldStyle->textTransform() : TTNONE;
     ETextSecurity oldSecurity = oldStyle ? oldStyle->textSecurity() : TSNONE;
@@ -204,7 +210,7 @@
     return e ? static_cast<Text*>(e)->string() : 0;
 }
 
-void RenderText::absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool)
+void RenderText::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 {
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
         rects.append(IntRect(tx + box->x(), ty + box->y(), box->width(), box->height()));
@@ -249,7 +255,7 @@
     }
 }
 
-void RenderText::absoluteQuads(Vector<FloatQuad>& quads, bool)
+void RenderText::absoluteQuads(Vector<FloatQuad>& quads)
 {
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
         quads.append(localToAbsoluteQuad(FloatRect(box->x(), box->y(), box->width(), box->height())));
@@ -386,7 +392,13 @@
 
     int left = box->positionForOffset(caretOffset);
 
+    // Distribute the caret's width to either side of the offset.
+    int caretWidthLeftOfOffset = caretWidth / 2;
+    left -= caretWidthLeftOfOffset;
+    int caretWidthRightOfOffset = caretWidth - caretWidthLeftOfOffset;
+
     int rootLeft = box->root()->x();
+    int rootRight = rootLeft + box->root()->width();
     // FIXME: should we use the width of the root inline box or the
     // width of the containing block for this?
     if (extraWidthToEndOfLine)
@@ -396,15 +408,26 @@
     if (style()->autoWrap()) {
         int availableWidth = cb->lineWidth(top, false);
         if (box->direction() == LTR)
-            left = min(left, rootLeft + availableWidth - 1);
+            left = min(left, rootLeft + availableWidth - caretWidthRightOfOffset);
         else
+            left = max(left, cb->x());
+    } else {
+        // If there is no wrapping, the caret can leave its containing block, but not its root line box.
+        if (cb->style()->direction() == LTR) {
+            int rightEdge = max(cb->width(), rootRight);
+            left = min(left, rightEdge - caretWidthRightOfOffset);
             left = max(left, rootLeft);
+        } else {
+            int leftEdge = min(cb->x(), rootLeft);
+            left = max(left, leftEdge);
+            left = min(left, rootRight - caretWidth);
+        }
     }
 
     return IntRect(left, top, caretWidth, height);
 }
 
-ALWAYS_INLINE int RenderText::widthFromCache(const Font& f, int start, int len, int xPos) const
+ALWAYS_INLINE int RenderText::widthFromCache(const Font& f, int start, int len, int xPos, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
     if (f.isFixedPitch() && !f.isSmallCaps() && m_isAllASCII) {
         int monospaceCharacterWidth = f.spaceWidth();
@@ -434,7 +457,7 @@
         return w;
     }
 
-    return f.width(TextRun(text()->characters() + start, len, allowTabs(), xPos));
+    return f.width(TextRun(text()->characters() + start, len, allowTabs(), xPos), fallbackFonts);
 }
 
 void RenderText::trimmedPrefWidths(int leadWidth,
@@ -503,7 +526,7 @@
                 linelen++;
 
             if (linelen) {
-                endMaxW = widthFromCache(f, i, linelen, leadWidth + endMaxW);
+                endMaxW = widthFromCache(f, i, linelen, leadWidth + endMaxW, 0);
                 if (firstLine) {
                     firstLine = false;
                     leadWidth = 0;
@@ -547,7 +570,15 @@
 
 void RenderText::calcPrefWidths(int leadWidth)
 {
-    ASSERT(m_hasTab || prefWidthsDirty());
+    HashSet<const SimpleFontData*> fallbackFonts;
+    calcPrefWidths(leadWidth, fallbackFonts);
+    if (fallbackFonts.isEmpty())
+        m_knownNotToUseFallbackFonts = true;
+}
+
+void RenderText::calcPrefWidths(int leadWidth, HashSet<const SimpleFontData*>& fallbackFonts)
+{
+    ASSERT(m_hasTab || prefWidthsDirty() || !m_knownNotToUseFallbackFonts);
 
     m_minWidth = 0;
     m_beginMinWidth = 0;
@@ -619,7 +650,7 @@
             lastWordBoundary++;
             continue;
         } else if (c == softHyphen) {
-            currMaxWidth += widthFromCache(f, lastWordBoundary, i - lastWordBoundary, leadWidth + currMaxWidth);
+            currMaxWidth += widthFromCache(f, lastWordBoundary, i - lastWordBoundary, leadWidth + currMaxWidth, &fallbackFonts);
             lastWordBoundary = i + 1;
             continue;
         }
@@ -642,13 +673,13 @@
 
         int wordLen = j - i;
         if (wordLen) {
-            int w = widthFromCache(f, i, wordLen, leadWidth + currMaxWidth);
+            int w = widthFromCache(f, i, wordLen, leadWidth + currMaxWidth, &fallbackFonts);
             currMinWidth += w;
             if (betweenWords) {
                 if (lastWordBoundary == i)
                     currMaxWidth += w;
                 else
-                    currMaxWidth += widthFromCache(f, lastWordBoundary, j - lastWordBoundary, leadWidth + currMaxWidth);
+                    currMaxWidth += widthFromCache(f, lastWordBoundary, j - lastWordBoundary, leadWidth + currMaxWidth, &fallbackFonts);
                 lastWordBoundary = j;
             }
 
@@ -735,6 +766,11 @@
     return currPos >= (from + len);
 }
 
+IntPoint RenderText::firstRunOrigin() const
+{
+    return IntPoint(firstRunX(), firstRunY());
+}
+
 int RenderText::firstRunX() const
 {
     return m_firstTextBox ? m_firstTextBox->m_x : 0;
@@ -835,6 +871,11 @@
         RootInlineBox* prev = firstRootBox->prevRootBox();
         if (prev)
             firstRootBox = prev;
+    } else if (lastTextBox()) {
+        ASSERT(!lastRootBox);
+        firstRootBox = lastTextBox()->root();
+        firstRootBox->markDirty();
+        dirtiedLines = true;
     }
     for (RootInlineBox* curr = firstRootBox; curr && curr != lastRootBox; curr = curr->nextRootBox()) {
         if (curr->lineBreakObj() == this && curr->lineBreakPos() > end)
@@ -879,10 +920,10 @@
 
 void RenderText::setTextInternal(PassRefPtr<StringImpl> text)
 {
-    m_text = text;
+    ASSERT(text);
+    m_text = document()->displayStringModifiedByEncoding(text);
     ASSERT(m_text);
 
-    m_text = document()->displayStringModifiedByEncoding(PassRefPtr<StringImpl>(m_text));
 #if ENABLE(SVG)
     if (isSVGText()) {
         if (style() && style()->whiteSpace() == PRE) {
@@ -959,6 +1000,7 @@
 
     setTextInternal(text);
     setNeedsLayoutAndPrefWidthsRecalc();
+    m_knownNotToUseFallbackFonts = false;
 }
 
 int RenderText::lineHeight(bool firstLine, bool) const
@@ -993,6 +1035,7 @@
         textBox->setPreviousLineBox(m_lastTextBox);
         m_lastTextBox = textBox;
     }
+    textBox->setIsText(true);
     return textBox;
 }
 
@@ -1012,7 +1055,7 @@
     m_containsReversedText |= s->direction() == RTL;
 }
 
-unsigned RenderText::width(unsigned from, unsigned len, int xPos, bool firstLine) const
+unsigned RenderText::width(unsigned from, unsigned len, int xPos, bool firstLine, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
     if (from >= textLength())
         return 0;
@@ -1020,10 +1063,10 @@
     if (from + len > textLength())
         len = textLength() - from;
 
-    return width(from, len, style(firstLine)->font(), xPos);
+    return width(from, len, style(firstLine)->font(), xPos, fallbackFonts);
 }
 
-unsigned RenderText::width(unsigned from, unsigned len, const Font& f, int xPos) const
+unsigned RenderText::width(unsigned from, unsigned len, const Font& f, int xPos, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
     ASSERT(from + len <= textLength());
     if (!characters())
@@ -1031,12 +1074,20 @@
 
     int w;
     if (&f == &style()->font()) {
-        if (!style()->preserveNewline() && !from && len == textLength())
-            w = maxPrefWidth();
-        else
-            w = widthFromCache(f, from, len, xPos);
+        if (!style()->preserveNewline() && !from && len == textLength()) {
+            if (fallbackFonts) {
+                if (prefWidthsDirty() || !m_knownNotToUseFallbackFonts) {
+                    const_cast<RenderText*>(this)->calcPrefWidths(0, *fallbackFonts);
+                    if (fallbackFonts->isEmpty())
+                        m_knownNotToUseFallbackFonts = true;
+                }
+                w = m_maxWidth;
+            } else
+                w = maxPrefWidth();
+        } else
+            w = widthFromCache(f, from, len, xPos, fallbackFonts);
     } else
-        w = f.width(TextRun(text()->characters() + from, len, allowTabs(), xPos));
+        w = f.width(TextRun(text()->characters() + from, len, allowTabs(), xPos), fallbackFonts);
 
     return w;
 }
diff --git a/WebCore/rendering/RenderText.h b/WebCore/rendering/RenderText.h
index 649f155..2e04a9e 100644
--- a/WebCore/rendering/RenderText.h
+++ b/WebCore/rendering/RenderText.h
@@ -55,11 +55,11 @@
     InlineTextBox* createInlineTextBox();
     void dirtyLineBoxes(bool fullLayout);
 
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void absoluteRectsForRange(Vector<IntRect>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    void absoluteRectsForRange(Vector<IntRect>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
 
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
-    virtual void absoluteQuadsForRange(Vector<FloatQuad>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
+    void absoluteQuadsForRange(Vector<FloatQuad>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false);
 
     virtual VisiblePosition positionForPoint(const IntPoint&);
 
@@ -67,8 +67,8 @@
     unsigned textLength() const { return m_text->length(); } // non virtual implementation of length()
     void positionLineBox(InlineBox*);
 
-    virtual unsigned width(unsigned from, unsigned len, const Font&, int xPos) const;
-    virtual unsigned width(unsigned from, unsigned len, int xPos, bool firstLine = false) const;
+    virtual unsigned width(unsigned from, unsigned len, const Font&, int xPos, HashSet<const SimpleFontData*>* fallbackFonts = 0) const;
+    virtual unsigned width(unsigned from, unsigned len, int xPos, bool firstLine = false, HashSet<const SimpleFontData*>* fallbackFonts = 0) const;
 
     virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
 
@@ -84,6 +84,7 @@
 
     IntRect linesBoundingBox() const;
 
+    IntPoint firstRunOrigin() const;
     int firstRunX() const;
     int firstRunY() const;
 
@@ -131,6 +132,8 @@
     virtual InlineTextBox* createTextBox(); // Subclassed by SVG.
 
 private:
+    void calcPrefWidths(int leadWidth, HashSet<const SimpleFontData*>& fallbackFonts);
+
     // Make length() private so that callers that have a RenderText*
     // will use the more efficient textLength() instead, while
     // callers with a RenderObject* can continue to use length().
@@ -142,15 +145,16 @@
 
     void deleteTextBoxes();
     bool containsOnlyWhitespace(unsigned from, unsigned len) const;
-    int widthFromCache(const Font&, int start, int len, int xPos) const;
+    int widthFromCache(const Font&, int start, int len, int xPos, HashSet<const SimpleFontData*>* fallbackFonts) const;
     bool isAllASCII() const { return m_isAllASCII; }
 
+    int m_minWidth; // here to minimize padding in 64-bit.
+
     RefPtr<StringImpl> m_text;
 
     InlineTextBox* m_firstTextBox;
     InlineTextBox* m_lastTextBox;
 
-    int m_minWidth;
     int m_maxWidth;
     int m_beginMinWidth;
     int m_endMinWidth;
@@ -166,6 +170,7 @@
                            // or removed).
     bool m_containsReversedText : 1;
     bool m_isAllASCII : 1;
+    mutable bool m_knownNotToUseFallbackFonts : 1;
 };
 
 inline RenderText* toRenderText(RenderObject* o)
diff --git a/WebCore/rendering/RenderTextControl.cpp b/WebCore/rendering/RenderTextControl.cpp
index 38d689b..752ad7b 100644
--- a/WebCore/rendering/RenderTextControl.cpp
+++ b/WebCore/rendering/RenderTextControl.cpp
@@ -22,13 +22,13 @@
 #include "config.h"
 #include "RenderTextControl.h"
 
+#include "AXObjectCache.h"
 #include "CharacterNames.h"
 #include "Editor.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
 #include "HTMLBRElement.h"
-#include "HTMLFormControlElement.h"
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "RenderLayer.h"
@@ -108,11 +108,9 @@
     bool isReadOnlyControl = false;
 
     if (node->isElementNode()) {
-        FormControlElement* formControlElement = toFormControlElement(static_cast<Element*>(node));
-        ASSERT(formControlElement);
-
-        isEnabled = formControlElement->isEnabled();
-        isReadOnlyControl = formControlElement->isReadOnlyControl();
+        Element* element = static_cast<Element*>(node);
+        isEnabled = element->isEnabledFormControl();
+        isReadOnlyControl = element->isReadOnlyFormControl();
     }
 
     style->setUserModify((isReadOnlyControl || !isEnabled) ? READ_ONLY : READ_WRITE_PLAINTEXT_ONLY);
@@ -171,8 +169,12 @@
 
     if (value != text() || !m_innerText->hasChildNodes()) {
         if (value != text()) {
-            if (Frame* frame = document()->frame())
+            if (Frame* frame = document()->frame()) {
                 frame->editor()->clearUndoRedoOperations();
+                
+                if (AXObjectCache::accessibilityEnabled())
+                    document()->axObjectCache()->postNotification(this, "AXValueChanged", false);
+            }
         }
 
         ExceptionCode ec = 0;
@@ -188,7 +190,7 @@
         m_userEdited = false;
     }
 
-    formControlElement()->setValueMatchesRenderer();
+    static_cast<Element*>(node())->setFormControlValueMatchesRenderer(true);
 }
 
 void RenderTextControl::setUserEdited(bool isUserEdited)
@@ -292,7 +294,7 @@
     RefPtr<Range> range = Range::create(document());
     range->setStart(m_innerText.get(), 0, ec);
     ASSERT(!ec);
-    range->setEnd(indexPosition.node(), indexPosition.m_offset, ec);
+    range->setEnd(indexPosition.node(), indexPosition.deprecatedEditingOffset(), ec);
     ASSERT(!ec);
     return TextIterator::rangeLength(range.get());
 }
@@ -364,6 +366,7 @@
         }
     }
     breakNode = 0;
+    breakOffset = 0;
 }
 
 String RenderTextControl::textWithHardLineBreaks()
@@ -485,10 +488,8 @@
     if (style()->width().isFixed() && style()->width().value() > 0)
         m_minPrefWidth = m_maxPrefWidth = calcContentBoxWidth(style()->width().value());
     else {
-        // Figure out how big a text control needs to be for a given number of characters
-        // (using "0" as the nominal character).
-        const UChar ch = '0';
-        float charWidth = style()->font().floatWidth(TextRun(&ch, 1, false, 0, 0, false, false, false));
+        // Use average character width. Matches IE.
+        float charWidth = style()->font().primaryFont()->avgCharWidth();
         m_maxPrefWidth = preferredContentWidth(charWidth) + m_innerText->renderBox()->paddingLeft() + m_innerText->renderBox()->paddingRight();
     }
 
@@ -531,7 +532,7 @@
 
     if (Frame* frame = document()->frame()) {
         if (frame->selection()->isRange() && userTriggered)
-            node()->dispatchEventForType(eventNames().selectEvent, true, false);
+            node()->dispatchEvent(eventNames().selectEvent, true, false);
     }
 }
 
@@ -545,9 +546,4 @@
     return m_innerText.get();
 }
 
-FormControlElement* RenderTextControl::formControlElement() const
-{
-    return toFormControlElement(static_cast<Element*>(node()));
-}
-
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderTextControl.h b/WebCore/rendering/RenderTextControl.h
index e4f7747..bce9619 100644
--- a/WebCore/rendering/RenderTextControl.h
+++ b/WebCore/rendering/RenderTextControl.h
@@ -26,7 +26,6 @@
 
 namespace WebCore {
 
-class FormControlElement;
 class VisibleSelection;
 class TextControlInnerElement;
 class TextControlInnerTextElement;
@@ -96,8 +95,6 @@
     friend class TextIterator;
     HTMLElement* innerTextElement() const;
 
-    FormControlElement* formControlElement() const;
-
 private:
     String finishText(Vector<UChar>&) const;
 
diff --git a/WebCore/rendering/RenderTextControlMultiLine.cpp b/WebCore/rendering/RenderTextControlMultiLine.cpp
index 271fb12..516d812 100644
--- a/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -46,7 +46,7 @@
 void RenderTextControlMultiLine::subtreeHasChanged()
 {
     RenderTextControl::subtreeHasChanged();
-    formControlElement()->setValueMatchesRenderer(false);
+    static_cast<Element*>(node())->setFormControlValueMatchesRenderer(false);
 
     if (!node()->focused())
         return;
@@ -121,10 +121,6 @@
 
     textBlockStyle->setDisplay(BLOCK);
 
-    // We're adding three extra pixels of padding to line textareas up with text fields.
-    textBlockStyle->setPaddingLeft(Length(3, Fixed));
-    textBlockStyle->setPaddingRight(Length(3, Fixed));
-
     return textBlockStyle.release();
 }
 
diff --git a/WebCore/rendering/RenderTextControlSingleLine.cpp b/WebCore/rendering/RenderTextControlSingleLine.cpp
index dd06501..0d0a5fe 100644
--- a/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -39,6 +39,7 @@
 #include "SearchPopupMenu.h"
 #include "SelectionController.h"
 #include "Settings.h"
+#include "SimpleFontData.h"
 #include "TextControlInnerElements.h"
 
 using namespace std;
@@ -415,6 +416,9 @@
 
     int result = static_cast<int>(ceilf(charWidth * factor));
 
+    // For text inputs, IE adds some extra width.
+    result += style()->font().primaryFont()->maxCharWidth() - charWidth;
+
     if (RenderBox* resultsRenderer = m_resultsButton ? m_resultsButton->renderBox() : 0)
         result += resultsRenderer->borderLeft() + resultsRenderer->borderRight() +
                   resultsRenderer->paddingLeft() + resultsRenderer->paddingRight();
@@ -491,9 +495,9 @@
 
     if (m_placeholderVisible) {
         ExceptionCode ec = 0;
-        innerTextElement()->setInnerText(inputElement()->placeholderValue(), ec);
+        innerTextElement()->setInnerText(inputElement()->placeholder(), ec);
         ASSERT(!ec);
-    } else if (!formControlElement()->valueMatchesRenderer() || placeholderVisibilityShouldChange)
+    } else if (!static_cast<Element*>(node())->formControlValueMatchesRenderer() || placeholderVisibilityShouldChange)
         setInnerTextValue(inputElement()->value());
 
     if (m_searchPopupIsVisible)
@@ -509,9 +513,10 @@
 {
     RefPtr<RenderStyle> textBlockStyle;
     if (placeholderShouldBeVisible()) {
-        RenderStyle* pseudoStyle = getCachedPseudoStyle(INPUT_PLACEHOLDER);
-        textBlockStyle = RenderStyle::clone(pseudoStyle);
-    } else {
+        if (RenderStyle* pseudoStyle = getCachedPseudoStyle(INPUT_PLACEHOLDER))
+            textBlockStyle = RenderStyle::clone(pseudoStyle);
+    } 
+    if (!textBlockStyle) {
         textBlockStyle = RenderStyle::create();   
         textBlockStyle->inheritFrom(startStyle);
     }
diff --git a/WebCore/rendering/RenderTheme.cpp b/WebCore/rendering/RenderTheme.cpp
index f82f48c..4aaf9be 100644
--- a/WebCore/rendering/RenderTheme.cpp
+++ b/WebCore/rendering/RenderTheme.cpp
@@ -622,14 +622,10 @@
 
 bool RenderTheme::isEnabled(const RenderObject* o) const
 {
-    if (!o->node() || !o->node()->isElementNode())
+    Node* node = o->node();
+    if (!node || !node->isElementNode())
         return true;
-
-    FormControlElement* formControlElement = toFormControlElement(static_cast<Element*>(o->node()));
-    if (!formControlElement)
-        return true;
-
-    return formControlElement->isEnabled();
+    return static_cast<Element*>(node)->isEnabledFormControl();
 }
 
 bool RenderTheme::isFocused(const RenderObject* o) const
@@ -651,14 +647,10 @@
 
 bool RenderTheme::isReadOnlyControl(const RenderObject* o) const
 {
-    if (!o->node() || !o->node()->isElementNode())
+    Node* node = o->node();
+    if (!node || !node->isElementNode())
         return false;
-
-    FormControlElement* formControlElement = toFormControlElement(static_cast<Element*>(o->node()));
-    if (!formControlElement)
-        return false;
-
-    return formControlElement->isReadOnlyControl();
+    return static_cast<Element*>(node)->isReadOnlyFormControl();
 }
 
 bool RenderTheme::isHovered(const RenderObject* o) const
@@ -851,9 +843,14 @@
     return Color();
 }
 
-Color RenderTheme::platformTextSearchHighlightColor() const
+Color RenderTheme::platformActiveTextSearchHighlightColor() const
 {
-    return Color(255, 255, 0);
+    return Color(255, 150, 50); // Orange.
+}
+
+Color RenderTheme::platformInactiveTextSearchHighlightColor() const
+{
+    return Color(255, 255, 0); // Yellow.
 }
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderTheme.h b/WebCore/rendering/RenderTheme.h
index 15a81fa..450e2f6 100644
--- a/WebCore/rendering/RenderTheme.h
+++ b/WebCore/rendering/RenderTheme.h
@@ -117,7 +117,9 @@
     Color inactiveListBoxSelectionBackgroundColor() const;
     Color inactiveListBoxSelectionForegroundColor() const;
 
-    virtual Color platformTextSearchHighlightColor() const;
+    // Highlighting colors for TextMatches.
+    virtual Color platformActiveTextSearchHighlightColor() const;
+    virtual Color platformInactiveTextSearchHighlightColor() const;
 
     virtual void platformColorsDidChange();
 
diff --git a/WebCore/rendering/RenderThemeChromiumLinux.cpp b/WebCore/rendering/RenderThemeChromiumLinux.cpp
index 8c6874d..8049403 100644
--- a/WebCore/rendering/RenderThemeChromiumLinux.cpp
+++ b/WebCore/rendering/RenderThemeChromiumLinux.cpp
@@ -27,9 +27,12 @@
 #include "ChromiumBridge.h"
 #include "CSSValueKeywords.h"
 #include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
 #include "Image.h"
-#include "NotImplemented.h"
+#include "MediaControlElements.h"
 #include "PlatformContextSkia.h"
+#include "RenderBox.h"
 #include "RenderObject.h"
 #include "ScrollbarTheme.h"
 #include "TransformationMatrix.h"
@@ -52,7 +55,21 @@
 // The default variable-width font size.  We use this as the default font
 // size for the "system font", and as a base size (which we then shrink) for
 // form control fonts.
-static const float DefaultFontSize = 16.0;
+static const float defaultFontSize = 16.0;
+
+// The background for the media player controls should be a 60% opaque black rectangle. This
+// matches the UI mockups for the default UI theme.
+static const float defaultMediaControlOpacity = 0.6f;
+
+// These values all match Safari/Win.
+static const float defaultControlFontPixelSize = 13;
+static const float defaultCancelButtonSize = 9;
+static const float minCancelButtonSize = 5;
+static const float maxCancelButtonSize = 21;
+static const float defaultSearchFieldResultsDecorationSize = 13;
+static const float minSearchFieldResultsDecorationSize = 9;
+static const float maxSearchFieldResultsDecorationSize = 30;
+static const float defaultSearchFieldResultsButtonWidth = 18;
 
 static bool supportsFocus(ControlPart appearance)
 {
@@ -77,11 +94,25 @@
 // FIXME: The only case where we know we don't match IE is for ANSI encodings.
 // IE uses MS Shell Dlg there, which we render incorrectly at certain pixel
 // sizes (e.g. 15px). So, for now we just use Arial.
-static const char* defaultGUIFont(Document* document)
+static const char* defaultGUIFont()
 {
     return "Arial";
 }
 
+#if ENABLE(VIDEO)
+// Attempt to retrieve a HTMLMediaElement from a Node. Returns NULL if one cannot be found.
+static HTMLMediaElement* mediaElementParent(Node* node)
+{
+    if (!node)
+        return 0;
+    Node* mediaNode = node->shadowAncestorNode();
+    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
+        return 0;
+
+    return static_cast<HTMLMediaElement*>(mediaNode);
+}
+#endif
+
 RenderTheme* theme()
 {
     static RenderThemeChromiumLinux theme;
@@ -92,10 +123,20 @@
 {
 }
 
+Color RenderThemeChromiumLinux::systemColor(int cssValueId) const
+{
+    static const Color linuxButtonGrayColor(0xffdddddd);
+
+    if (cssValueId == CSSValueButtonface)
+        return linuxButtonGrayColor;
+    return RenderTheme::systemColor(cssValueId);
+}
+
 // Use the Windows style sheets to match their metrics.
 String RenderThemeChromiumLinux::extraDefaultStyleSheet()
 {
-    return String(themeChromiumWinUserAgentStyleSheet, sizeof(themeChromiumWinUserAgentStyleSheet));
+    return String(themeWinUserAgentStyleSheet, sizeof(themeWinUserAgentStyleSheet)) +
+           String(themeChromiumLinuxUserAgentStyleSheet, sizeof(themeChromiumLinuxUserAgentStyleSheet));
 }
 
 String RenderThemeChromiumLinux::extraQuirksStyleSheet()
@@ -103,6 +144,13 @@
     return String(themeWinQuirksUserAgentStyleSheet, sizeof(themeWinQuirksUserAgentStyleSheet));
 }
 
+#if ENABLE(VIDEO)
+String RenderThemeChromiumLinux::extraMediaControlsStyleSheet()
+{
+    return String(mediaControlsChromiumUserAgentStyleSheet, sizeof(mediaControlsChromiumUserAgentStyleSheet));
+}
+#endif
+
 bool RenderThemeChromiumLinux::supportsFocusRing(const RenderStyle* style) const
 {
     return supportsFocus(style->appearance());
@@ -120,7 +168,7 @@
 
 Color RenderThemeChromiumLinux::platformActiveSelectionForegroundColor() const
 {
-    return Color(0, 0, 0);
+    return Color::black;
 }
 
 Color RenderThemeChromiumLinux::platformInactiveSelectionForegroundColor() const
@@ -144,9 +192,9 @@
     return 0.5;
 }
 
-void RenderThemeChromiumLinux::systemFont(int propId, Document* document, FontDescription& fontDescription) const
+void RenderThemeChromiumLinux::systemFont(int propId, FontDescription& fontDescription) const
 {
-    float fontSize = DefaultFontSize;
+    float fontSize = defaultFontSize;
 
     switch (propId) {
     case CSSValueWebkitMiniControl:
@@ -161,7 +209,7 @@
         break;
     }
 
-    fontDescription.firstFamily().setFamily(defaultGUIFont(NULL));
+    fontDescription.firstFamily().setFamily(defaultGUIFont());
     fontDescription.setSpecifiedSize(fontSize);
     fontDescription.setIsAbsoluteSize(true);
     fontDescription.setGenericFamily(FontDescription::NoFamily);
@@ -215,16 +263,36 @@
     setCheckboxSize(style);
 }
 
-static void paintButtonLike(RenderTheme* theme, RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect) {
+static SkColor brightenColor(double h, double s, double l, float brightenAmount)
+{
+    l += brightenAmount;
+    if (l > 1.0)
+        l = 1.0;
+    if (l < 0.0)
+        l = 0.0;
+
+    return makeRGBAFromHSLA(h, s, l, 1.0);
+}
+
+static void paintButtonLike(RenderTheme* theme, RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
     SkCanvas* const canvas = i.context->platformContext()->canvas();
     SkPaint paint;
     SkRect skrect;
     const int right = rect.x() + rect.width();
     const int bottom = rect.y() + rect.height();
+    SkColor baseColor = SkColorSetARGB(0xff, 0xdd, 0xdd, 0xdd);
+    if (o->style()->hasBackground())
+        baseColor = o->style()->backgroundColor().rgb();
+    double h, s, l;
+    Color(baseColor).getHSL(h, s, l);
+    // Our standard gradient is from 0xdd to 0xf8. This is the amount of
+    // increased luminance between those values.
+    SkColor lightColor(brightenColor(h, s, l, 0.105));
 
     // If the button is too small, fallback to drawing a single, solid color
     if (rect.width() < 5 || rect.height() < 5) {
-        paint.setARGB(0xff, 0xe9, 0xe9, 0xe9);
+        paint.setColor(baseColor);
         skrect.set(rect.x(), rect.y(), right, bottom);
         canvas->drawRect(skrect, paint);
         return;
@@ -244,20 +312,20 @@
     p[lightEnd].set(SkIntToScalar(rect.x()), SkIntToScalar(rect.y()));
     p[darkEnd].set(SkIntToScalar(rect.x()), SkIntToScalar(bottom - 1));
     SkColor colors[2];
-    colors[0] = SkColorSetARGB(0xff, 0xf8, 0xf8, 0xf8);
-    colors[1] = SkColorSetARGB(0xff, 0xdd, 0xdd, 0xdd);
+    colors[0] = lightColor;
+    colors[1] = baseColor;
 
-    SkShader* s = SkGradientShader::CreateLinear(
+    SkShader* shader = SkGradientShader::CreateLinear(
         p, colors, NULL, 2, SkShader::kClamp_TileMode, NULL);
     paint.setStyle(SkPaint::kFill_Style);
-    paint.setShader(s);
-    s->unref();
+    paint.setShader(shader);
+    shader->unref();
 
     skrect.set(rect.x() + 1, rect.y() + 1, right - 1, bottom - 1);
     canvas->drawRect(skrect, paint);
 
     paint.setShader(NULL);
-    paint.setARGB(0xff, 0xce, 0xce, 0xce);
+    paint.setColor(brightenColor(h, s, l, -0.0588));
     canvas->drawPoint(rect.x() + 1, rect.y() + 1, paint);
     canvas->drawPoint(right - 2, rect.y() + 1, paint);
     canvas->drawPoint(rect.x() + 1, bottom - 2, paint);
@@ -275,24 +343,172 @@
     return true;
 }
 
-bool RenderThemeChromiumLinux::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+void RenderThemeChromiumLinux::adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
-    return true;
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int cancelButtonSize = lroundf(std::min(std::max(minCancelButtonSize, defaultCancelButtonSize * fontScale), maxCancelButtonSize));
+    style->setWidth(Length(cancelButtonSize, Fixed));
+    style->setHeight(Length(cancelButtonSize, Fixed));
 }
 
-bool RenderThemeChromiumLinux::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeChromiumLinux::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
-    return true;
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled button stays square and will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
+    bounds.setWidth(bounds.height());
+
+    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* cancelImage = Image::loadPlatformResource("searchCancel").releaseRef();
+    static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").releaseRef();
+    i.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, bounds);
+    return false;
 }
 
-bool RenderThemeChromiumLinux::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+void RenderThemeChromiumLinux::adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
-    return true;
+    IntSize emptySize(1, 11);
+    style->setWidth(Length(emptySize.width(), Fixed));
+    style->setHeight(Length(emptySize.height(), Fixed));
 }
 
-bool RenderThemeChromiumLinux::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+void RenderThemeChromiumLinux::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
-    return true;
+    // Scale the decoration size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int magnifierSize = lroundf(std::min(std::max(minSearchFieldResultsDecorationSize, defaultSearchFieldResultsDecorationSize * fontScale), 
+                                         maxSearchFieldResultsDecorationSize));
+    style->setWidth(Length(magnifierSize, Fixed));
+    style->setHeight(Length(magnifierSize, Fixed));
+}
+
+bool RenderThemeChromiumLinux::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled decoration stays square and will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
+    bounds.setWidth(bounds.height());
+
+    // Center the decoration vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+    
+    static Image* magnifierImage = Image::loadPlatformResource("searchMagnifier").releaseRef();
+    i.context->drawImage(magnifierImage, bounds);
+    return false;
+}
+
+void RenderThemeChromiumLinux::adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int magnifierHeight = lroundf(std::min(std::max(minSearchFieldResultsDecorationSize, defaultSearchFieldResultsDecorationSize * fontScale), 
+                                           maxSearchFieldResultsDecorationSize));
+    int magnifierWidth = lroundf(magnifierHeight * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize);
+    style->setWidth(Length(magnifierWidth, Fixed));
+    style->setHeight(Length(magnifierHeight, Fixed));
+}
+
+bool RenderThemeChromiumLinux::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent())
+        return false;
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled decoration will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.height(), bounds.height()));
+    bounds.setWidth(std::min(parentBox.width(), static_cast<int>(bounds.height() * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize)));
+
+    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* magnifierImage = Image::loadPlatformResource("searchMagnifierResults").releaseRef();
+    i.context->drawImage(magnifierImage, bounds);
+    return false;
+}
+
+bool RenderThemeChromiumLinux::paintMediaButtonInternal(GraphicsContext* context, const IntRect& rect, Image* image)
+{
+    context->beginTransparencyLayer(defaultMediaControlOpacity);
+
+    // Draw background.
+    Color oldFill = context->fillColor();
+    Color oldStroke = context->strokeColor();
+
+    context->setFillColor(Color::black);
+    context->setStrokeColor(Color::black);
+    context->drawRect(rect);
+
+    context->setFillColor(oldFill);
+    context->setStrokeColor(oldStroke);
+
+    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
+    IntRect imageRect = image->rect();
+    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
+    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
+
+    context->drawImage(image, imageRect, CompositeSourceAtop);
+    context->endTransparencyLayer();
+
+    return false;
+}
+
+bool RenderThemeChromiumLinux::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
+    static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
+
+    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+#else
+    return false;
+#endif
+}
+
+bool RenderThemeChromiumLinux::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
+    if (!mediaElement)
+        return false;
+
+    static Image* soundFull = Image::loadPlatformResource("mediaSoundFull").releaseRef();
+    static Image* soundNone = Image::loadPlatformResource("mediaSoundNone").releaseRef();
+
+    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+#else
+    return false;
+#endif
 }
 
 void RenderThemeChromiumLinux::adjustMenuListStyle(CSSStyleSelector* selector, RenderStyle* style, WebCore::Element* e) const
@@ -387,7 +603,7 @@
 
 Color RenderThemeChromiumLinux::activeListBoxSelectionForegroundColor() const
 {
-    return Color(0, 0, 0);
+    return Color::black;
 }
 
 Color RenderThemeChromiumLinux::inactiveListBoxSelectionBackgroundColor() const
diff --git a/WebCore/rendering/RenderThemeChromiumLinux.h b/WebCore/rendering/RenderThemeChromiumLinux.h
index dbe8dcc..11239d9 100644
--- a/WebCore/rendering/RenderThemeChromiumLinux.h
+++ b/WebCore/rendering/RenderThemeChromiumLinux.h
@@ -39,6 +39,9 @@
 
         virtual String extraDefaultStyleSheet();
         virtual String extraQuirksStyleSheet();
+#if ENABLE(VIDEO)
+        virtual String extraMediaControlsStyleSheet();
+#endif
 
         // A method asking if the theme's controls actually care about redrawing when hovered.
         virtual bool supportsHover(const RenderStyle*) const { return true; }
@@ -56,7 +59,8 @@
         virtual double caretBlinkInterval() const;
 
         // System fonts.
-        virtual void systemFont(int propId, Document*, FontDescription&) const;
+        virtual void systemFont(int propId, FontDescription&) const;
+        virtual Color systemColor(int cssValidId) const;
 
         virtual int minimumMenuListSize(RenderStyle*) const;
 
@@ -72,12 +76,22 @@
 
         virtual bool paintTextArea(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r) { return paintTextField(o, i, r); }
 
-        virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r) { return paintTextField(o, i, r); }
 
-        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
         virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
+        virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
+        virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
         // MenuList refers to an unstyled menulist (meaning a menulist without
         // background-color or border set) and MenuListButton refers to a styled
         // menulist (a menulist with background-color or border set). They have
@@ -117,6 +131,7 @@
 
     private:
         int menuListInternalPadding(RenderStyle*, int paddingType) const;
+        bool paintMediaButtonInternal(GraphicsContext*, const IntRect&, Image*);
     };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeChromiumMac.h b/WebCore/rendering/RenderThemeChromiumMac.h
index 29286d8..f072000 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/WebCore/rendering/RenderThemeChromiumMac.h
@@ -67,7 +67,7 @@
         virtual void platformColorsDidChange();
 
         // System fonts.
-        virtual void systemFont(int cssValueId, Document*, FontDescription&) const;
+        virtual void systemFont(int cssValueId, FontDescription&) const;
 
         virtual int minimumMenuListSize(RenderStyle*) const;
 
@@ -85,6 +85,8 @@
         virtual Color systemColor(int cssValueId) const;
 
     protected:
+        virtual bool supportsSelectionForegroundColors() const { return false; }
+
         // Methods for each appearance value.
         virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
         virtual void setCheckboxSize(RenderStyle*) const;
diff --git a/WebCore/rendering/RenderThemeChromiumMac.mm b/WebCore/rendering/RenderThemeChromiumMac.mm
index 1eef0cb..f6081a5 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -33,7 +33,6 @@
 #import "BitmapImage.h"
 #import "CSSStyleSelector.h"
 #import "CSSValueKeywords.h"
-#import "Document.h"
 #import "Element.h"
 #import "FoundationExtras.h"
 #import "FrameView.h"
@@ -192,7 +191,7 @@
     return fontWeights[appKitFontWeight - 1];
 }
 
-void RenderThemeChromiumMac::systemFont(int cssValueId, Document* document, FontDescription& fontDescription) const
+void RenderThemeChromiumMac::systemFont(int cssValueId, FontDescription& fontDescription) const
 {
     static FontDescription systemFont;
     static FontDescription smallSystemFont;
@@ -685,6 +684,8 @@
 // FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
 bool RenderThemeChromiumMac::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
     // Determine the width and height needed for the control and prepare the cell for painting.
     setCheckboxCellState(o, r);
 
@@ -764,6 +765,8 @@
 // FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
 bool RenderThemeChromiumMac::paintRadio(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
     // Determine the width and height needed for the control and prepare the cell for painting.
     setRadioCellState(o, r);
 
@@ -1080,6 +1083,8 @@
 
 bool RenderThemeChromiumMac::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
     setPopupButtonCellState(o, r);
 
     NSPopUpButtonCell* popupButton = this->popupButton();
@@ -1316,11 +1321,7 @@
 
     // Set the foreground color to black or gray when we have the aqua look.
     // Cast to RGB32 is to work around a compiler bug.
-    bool isEnabled = true;
-    if (FormControlElement* formControlElement = toFormControlElement(e))
-        isEnabled = formControlElement->isEnabled();
-
-    style->setColor(isEnabled ? static_cast<RGBA32>(Color::black) : Color::darkGray);
+    style->setColor(e && e->isEnabledFormControl() ? static_cast<RGBA32>(Color::black) : Color::darkGray);
 
     // Set the button's vertical size.
     setSizeFromFont(style, menuListButtonSizes());
@@ -1639,6 +1640,8 @@
 
 bool RenderThemeChromiumMac::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
     Node* input = o->node()->shadowAncestorNode();
     setSearchCellState(input->renderer(), r);
 
@@ -1712,6 +1715,8 @@
 
 bool RenderThemeChromiumMac::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
     Node* input = o->node()->shadowAncestorNode();
     setSearchCellState(input->renderer(), r);
 
@@ -1737,6 +1742,8 @@
 
 bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+
     Node* input = o->node()->shadowAncestorNode();
     setSearchCellState(input->renderer(), r);
 
@@ -1768,15 +1775,23 @@
     return false;
 }
 
+#if ENABLE(VIDEO)
+// FIXME: This enum is lifted from RenderThemeMac.mm  We need to decide which theme to use for the default controls, or decide to avoid wkDrawMediaUIPart and render our own.
+typedef enum {
+    MediaControllerThemeClassic   = 1,
+    MediaControllerThemeQT        = 2
+} MediaControllerThemeStyle;
+#endif
+
 bool RenderThemeChromiumMac::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
 #if ENABLE(VIDEO)
-    Node* node = o->element();
+    Node* node = o->node();
     if (!node)
         return false;
 
     LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaFullscreenButton, paintInfo.context->platformContext(), r, node->active());
+    wkDrawMediaUIPart(MediaFullscreenButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
 #endif
     return false;
 }
@@ -1784,7 +1799,7 @@
 bool RenderThemeChromiumMac::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
 #if ENABLE(VIDEO)
-    Node* node = o->element();
+    Node* node = o->node();
     Node* mediaNode = node ? node->shadowAncestorNode() : 0;
     if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
         return false;
@@ -1794,7 +1809,7 @@
         return false;
     
     LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(mediaElement->muted() ? MediaUnMuteButton : MediaMuteButton, paintInfo.context->platformContext(), r, node->active());
+    wkDrawMediaUIPart(mediaElement->muted() ? MediaUnMuteButton : MediaMuteButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
 #endif
     return false;
 }
@@ -1802,7 +1817,7 @@
 bool RenderThemeChromiumMac::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
 #if ENABLE(VIDEO)
-    Node* node = o->element();
+    Node* node = o->node();
     Node* mediaNode = node ? node->shadowAncestorNode() : 0;
     if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
         return false;
@@ -1812,7 +1827,7 @@
         return false;
 
     LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(mediaElement->canPlay() ? MediaPlayButton : MediaPauseButton, paintInfo.context->platformContext(), r, node->active());
+    wkDrawMediaUIPart(mediaElement->canPlay() ? MediaPlayButton : MediaPauseButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
 #endif
     return false;
 }
@@ -1820,12 +1835,12 @@
 bool RenderThemeChromiumMac::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
 #if ENABLE(VIDEO)
-    Node* node = o->element();
+    Node* node = o->node();
     if (!node)
         return false;
 
     LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaSeekBackButton, paintInfo.context->platformContext(), r, node->active());
+    wkDrawMediaUIPart(MediaSeekBackButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
 #endif
     return false;
 }
@@ -1833,12 +1848,12 @@
 bool RenderThemeChromiumMac::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
 #if ENABLE(VIDEO)
-    Node* node = o->element();
+    Node* node = o->node();
     if (!node)
         return false;
 
     LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaSeekForwardButton, paintInfo.context->platformContext(), r, node->active());
+    wkDrawMediaUIPart(MediaSeekForwardButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
 #endif
     return false;
 }
@@ -1846,7 +1861,7 @@
 bool RenderThemeChromiumMac::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
 #if ENABLE(VIDEO)
-    Node* node = o->element();
+    Node* node = o->node();
     Node* mediaNode = node ? node->shadowAncestorNode() : 0;
     if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
         return false;
@@ -1864,7 +1879,7 @@
         currentTime = player->currentTime();
     }
 
-    wkDrawMediaSliderTrack(paintInfo.context->platformContext(), r, timeLoaded, currentTime, duration);
+    wkDrawMediaSliderTrack(MediaControllerThemeClassic, paintInfo.context->platformContext(), r, timeLoaded, currentTime, duration);
 #endif
     return false;
 }
@@ -1872,12 +1887,12 @@
 bool RenderThemeChromiumMac::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
 #if ENABLE(VIDEO)
-    Node* node = o->element();
+    Node* node = o->node();
     if (!node)
         return false;
 
     LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaSliderThumb, paintInfo.context->platformContext(), r, node->active());
+    wkDrawMediaUIPart(MediaSliderThumb, MediaControllerThemeClassic, paintInfo.context->platformContext(), r, node->active());
 #endif
     return false;
 }
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.cpp b/WebCore/rendering/RenderThemeChromiumSkia.cpp
new file mode 100644
index 0000000..bf217c8
--- /dev/null
+++ b/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -0,0 +1,2 @@
+// FIXME: This is a placeholder to avoid some issues with webkit.gyp in the chromium tree. Having this placeholder until we can factor out
+// RenderThemeChromiumSkia from RenderThemeChromiumLinux will keep the HEAD of both trees compatible.
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.h b/WebCore/rendering/RenderThemeChromiumSkia.h
new file mode 100644
index 0000000..bf217c8
--- /dev/null
+++ b/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -0,0 +1,2 @@
+// FIXME: This is a placeholder to avoid some issues with webkit.gyp in the chromium tree. Having this placeholder until we can factor out
+// RenderThemeChromiumSkia from RenderThemeChromiumLinux will keep the HEAD of both trees compatible.
diff --git a/WebCore/rendering/RenderThemeChromiumWin.cpp b/WebCore/rendering/RenderThemeChromiumWin.cpp
index 30f421b..5288191 100644
--- a/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -31,10 +31,12 @@
 #include "ChromiumBridge.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
-#include "Document.h"
 #include "FontSelector.h"
 #include "FontUtilsChromiumWin.h"
 #include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#include "MediaControlElements.h"
 #include "RenderBox.h"
 #include "RenderSlider.h"
 #include "ScrollbarTheme.h"
@@ -56,6 +58,20 @@
 
 namespace {
 
+// The background for the media player controls should be a 60% opaque black rectangle. This
+// matches the UI mockups for the default UI theme.
+static const float defaultMediaControlOpacity = 0.6f;
+
+// These values all match Safari/Win.
+static const float defaultControlFontPixelSize = 13;
+static const float defaultCancelButtonSize = 9;
+static const float minCancelButtonSize = 5;
+static const float maxCancelButtonSize = 21;
+static const float defaultSearchFieldResultsDecorationSize = 13;
+static const float minSearchFieldResultsDecorationSize = 9;
+static const float maxSearchFieldResultsDecorationSize = 30;
+static const float defaultSearchFieldResultsButtonWidth = 18;
+
 bool canvasHasMultipleLayers(const SkCanvas* canvas)
 {
     SkCanvas::LayerIter iter(const_cast<SkCanvas*>(canvas), false);
@@ -126,8 +142,6 @@
 static FontDescription menuFont;
 static FontDescription labelFont;
 
-bool RenderThemeChromiumWin::m_findInPageMode = false;
-
 // Internal static helper functions.  We don't put them in an anonymous
 // namespace so they have easier access to the WebCore namespace.
 
@@ -196,23 +210,8 @@
 // FIXME: The only case where we know we don't match IE is for ANSI encodings.
 // IE uses MS Shell Dlg there, which we render incorrectly at certain pixel
 // sizes (e.g. 15px). So, for now we just use Arial.
-static wchar_t* defaultGUIFont(Document* document)
+static wchar_t* defaultGUIFont()
 {
-    UScriptCode dominantScript = document->dominantScript();
-    const wchar_t* family = NULL;
-
-    // FIXME: Special-casing of Latin/Greeek/Cyrillic should go away once
-    // GetFontFamilyForScript is enhanced to support GenericFamilyType for
-    // real. For now, we make sure that we use Arial to match IE for those
-    // scripts.
-    if (dominantScript != USCRIPT_LATIN &&
-        dominantScript != USCRIPT_CYRILLIC &&
-        dominantScript != USCRIPT_GREEK &&
-        dominantScript != USCRIPT_INVALID_CODE) {
-        family = getFontFamilyForScript(dominantScript, FontDescription::NoFamily);
-        if (family)
-            return const_cast<wchar_t*>(family);
-    }
     return L"Arial";
 }
 
@@ -252,6 +251,20 @@
     return blinkTime / 1000.0;
 }
 
+#if ENABLE(VIDEO)
+// Attempt to retrieve a HTMLMediaElement from a Node. Returns NULL if one cannot be found.
+static HTMLMediaElement* mediaElementParent(Node* node)
+{
+    if (!node)
+        return 0;
+    Node* mediaNode = node->shadowAncestorNode();
+    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
+        return 0;
+
+    return static_cast<HTMLMediaElement*>(mediaNode);
+}
+#endif
+
 // Implement WebCore::theme() for getting the global RenderTheme.
 RenderTheme* theme()
 {
@@ -261,7 +274,7 @@
 
 String RenderThemeChromiumWin::extraDefaultStyleSheet()
 {
-    return String(themeChromiumWinUserAgentStyleSheet, sizeof(themeChromiumWinUserAgentStyleSheet));
+    return String(themeWinUserAgentStyleSheet, sizeof(themeWinUserAgentStyleSheet));
 }
 
 String RenderThemeChromiumWin::extraQuirksStyleSheet()
@@ -269,6 +282,13 @@
     return String(themeWinQuirksUserAgentStyleSheet, sizeof(themeWinQuirksUserAgentStyleSheet));
 }
 
+#if ENABLE(VIDEO)
+String RenderThemeChromiumWin::extraMediaControlsStyleSheet()
+{
+    return String(mediaControlsChromiumUserAgentStyleSheet, sizeof(mediaControlsChromiumUserAgentStyleSheet));
+}
+#endif
+
 bool RenderThemeChromiumWin::supportsFocusRing(const RenderStyle* style) const
 {
    // Let webkit draw one of its halo rings around any focused element,
@@ -281,29 +301,25 @@
 Color RenderThemeChromiumWin::platformActiveSelectionBackgroundColor() const
 {
     if (ChromiumBridge::layoutTestMode())
-        return Color("#0000FF");  // Royal blue.
-    if (m_findInPageMode)
-        return Color(255, 150, 50, 200);  // Orange.
+        return Color(0x00, 0x00, 0xff);  // Royal blue.
     COLORREF color = GetSysColor(COLOR_HIGHLIGHT);
-    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 255);
+    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 0xff);
 }
 
 Color RenderThemeChromiumWin::platformInactiveSelectionBackgroundColor() const
 {
     if (ChromiumBridge::layoutTestMode())
-        return Color("#999999");  // Medium gray.
-    if (m_findInPageMode)
-        return Color(255, 150, 50, 200);  // Orange.
+        return Color(0x99, 0x99, 0x99);  // Medium gray.
     COLORREF color = GetSysColor(COLOR_GRAYTEXT);
-    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 255);
+    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 0xff);
 }
 
 Color RenderThemeChromiumWin::platformActiveSelectionForegroundColor() const
 {
     if (ChromiumBridge::layoutTestMode())
-        return Color("#FFFFCC");  // Pale yellow.
+        return Color(0xff, 0xff, 0xcc);  // Pale yellow.
     COLORREF color = GetSysColor(COLOR_HIGHLIGHTTEXT);
-    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 255);
+    return Color(GetRValue(color), GetGValue(color), GetBValue(color), 0xff);
 }
 
 Color RenderThemeChromiumWin::platformInactiveSelectionForegroundColor() const
@@ -311,9 +327,14 @@
     return Color::white;
 }
 
-Color RenderThemeChromiumWin::platformTextSearchHighlightColor() const
+Color RenderThemeChromiumWin::platformActiveTextSearchHighlightColor() const
 {
-    return Color(255, 255, 150);
+    return Color(0xff, 0x96, 0x32);  // Orange.
+}
+
+Color RenderThemeChromiumWin::platformInactiveTextSearchHighlightColor() const
+{
+    return Color(0xff, 0xff, 0x96); // Yellow.
 }
 
 double RenderThemeChromiumWin::caretBlinkInterval() const
@@ -328,7 +349,7 @@
     return blinkInterval;
 }
 
-void RenderThemeChromiumWin::systemFont(int propId, Document* document, FontDescription& fontDescription) const
+void RenderThemeChromiumWin::systemFont(int propId, FontDescription& fontDescription) const
 {
     // This logic owes much to RenderThemeSafari.cpp.
     FontDescription* cachedDesc = NULL;
@@ -365,12 +386,12 @@
     case CSSValueWebkitMiniControl:
     case CSSValueWebkitSmallControl:
     case CSSValueWebkitControl:
-        faceName = defaultGUIFont(document);
+        faceName = defaultGUIFont();
         // Why 2 points smaller?  Because that's what Gecko does.
         fontSize = defaultFontSize - pointsToPixels(2);
         break;
     default:
-        faceName = defaultGUIFont(document);
+        faceName = defaultGUIFont();
         fontSize = defaultFontSize;
         break;
     }
@@ -462,9 +483,172 @@
     return false;
 }
 
-bool RenderThemeChromiumWin::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+void RenderThemeChromiumWin::adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
-    return paintTextField(o, i, r);
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int cancelButtonSize = lroundf(std::min(std::max(minCancelButtonSize, defaultCancelButtonSize * fontScale), maxCancelButtonSize));
+    style->setWidth(Length(cancelButtonSize, Fixed));
+    style->setHeight(Length(cancelButtonSize, Fixed));
+}
+
+bool RenderThemeChromiumWin::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled button stays square and will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
+    bounds.setWidth(bounds.height());
+
+    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* cancelImage = Image::loadPlatformResource("searchCancel").releaseRef();
+    static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").releaseRef();
+    i.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, bounds);
+    return false;
+}
+
+void RenderThemeChromiumWin::adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    IntSize emptySize(1, 11);
+    style->setWidth(Length(emptySize.width(), Fixed));
+    style->setHeight(Length(emptySize.height(), Fixed));
+}
+
+void RenderThemeChromiumWin::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // Scale the decoration size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int magnifierSize = lroundf(std::min(std::max(minSearchFieldResultsDecorationSize, defaultSearchFieldResultsDecorationSize * fontScale), 
+                                         maxSearchFieldResultsDecorationSize));
+    style->setWidth(Length(magnifierSize, Fixed));
+    style->setHeight(Length(magnifierSize, Fixed));
+}
+
+bool RenderThemeChromiumWin::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled decoration stays square and will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
+    bounds.setWidth(bounds.height());
+
+    // Center the decoration vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+    
+    static Image* magnifierImage = Image::loadPlatformResource("searchMagnifier").releaseRef();
+    i.context->drawImage(magnifierImage, bounds);
+    return false;
+}
+
+void RenderThemeChromiumWin::adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int magnifierHeight = lroundf(std::min(std::max(minSearchFieldResultsDecorationSize, defaultSearchFieldResultsDecorationSize * fontScale), 
+                                           maxSearchFieldResultsDecorationSize));
+    int magnifierWidth = lroundf(magnifierHeight * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize);
+    style->setWidth(Length(magnifierWidth, Fixed));
+    style->setHeight(Length(magnifierHeight, Fixed));
+}
+
+bool RenderThemeChromiumWin::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+{
+    IntRect bounds = r;
+    ASSERT(o->parent());
+    if (!o->parent())
+        return false;
+    if (!o->parent() || !o->parent()->isBox())
+        return false;
+    
+    RenderBox* parentRenderBox = toRenderBox(o->parent());
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    
+    // Make sure the scaled decoration will fit in its parent's box
+    bounds.setHeight(std::min(parentBox.height(), bounds.height()));
+    bounds.setWidth(std::min(parentBox.width(), static_cast<int>(bounds.height() * defaultSearchFieldResultsButtonWidth / defaultSearchFieldResultsDecorationSize)));
+
+    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* magnifierImage = Image::loadPlatformResource("searchMagnifierResults").releaseRef();
+    i.context->drawImage(magnifierImage, bounds);
+    return false;
+}
+
+bool RenderThemeChromiumWin::paintMediaButtonInternal(GraphicsContext* context, const IntRect& rect, Image* image)
+{
+    context->beginTransparencyLayer(defaultMediaControlOpacity);
+
+    // Draw background.
+    Color oldFill = context->fillColor();
+    Color oldStroke = context->strokeColor();
+
+    context->setFillColor(Color::black);
+    context->setStrokeColor(Color::black);
+    context->drawRect(rect);
+
+    context->setFillColor(oldFill);
+    context->setStrokeColor(oldStroke);
+
+    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
+    IntRect imageRect = image->rect();
+    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
+    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
+
+    context->drawImage(image, imageRect, CompositeSourceAtop);
+    context->endTransparencyLayer();
+
+    return false;
+}
+
+bool RenderThemeChromiumWin::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
+    static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
+
+    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+#else
+    return false;
+#endif
+}
+
+bool RenderThemeChromiumWin::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
+    if (!mediaElement)
+        return false;
+
+    static Image* soundFull = Image::loadPlatformResource("mediaSoundFull").releaseRef();
+    static Image* soundNone = Image::loadPlatformResource("mediaSoundNone").releaseRef();
+
+    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+#else
+    return false;
+#endif
 }
 
 void RenderThemeChromiumWin::adjustMenuListStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
@@ -577,7 +761,8 @@
 }
 
 // static
-void RenderThemeChromiumWin::setDefaultFontSize(int fontSize) {
+void RenderThemeChromiumWin::setDefaultFontSize(int fontSize)
+{
     defaultFontSize = static_cast<float>(fontSize);
 
     // Reset cached fonts.
@@ -697,14 +882,29 @@
 
     const ThemeData& themeData = getThemeData(o);
 
+    // Fallback to white if the specified color object is invalid.
+    Color backgroundColor(Color::white);
+    if (o->style()->backgroundColor().isValid()) {
+        backgroundColor = o->style()->backgroundColor();
+    }
+
+    // If we have background-image, don't fill the content area to expose the
+    // parent's background. Also, we shouldn't fill the content area if the
+    // alpha of the color is 0. The API of Windows GDI ignores the alpha.
+    //
+    // Note that we should paint the content area white if we have neither the
+    // background color nor background image explicitly specified to keep the
+    // appearance of select element consistent with other browsers.
+    bool fillContentArea = !o->style()->hasBackgroundImage() && backgroundColor.alpha() != 0;
+
     WebCore::ThemePainter painter(i.context, r);
     ChromiumBridge::paintTextField(painter.context(),
                                    themeData.m_part,
                                    themeData.m_state,
                                    themeData.m_classicState,
                                    painter.drawRect(),
-                                   o->style()->backgroundColor(),
-                                   true,
+                                   backgroundColor,
+                                   fillContentArea,
                                    drawEdges);
     return false;
 }
@@ -727,13 +927,4 @@
     return padding;
 }
 
-// static
-void RenderThemeChromiumWin::setFindInPageMode(bool enable) {
-  if (m_findInPageMode == enable)
-      return;
-
-  m_findInPageMode = enable;
-  theme()->platformColorsDidChange();
-}
-
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeChromiumWin.h b/WebCore/rendering/RenderThemeChromiumWin.h
index f1ef306..6ba6595 100644
--- a/WebCore/rendering/RenderThemeChromiumWin.h
+++ b/WebCore/rendering/RenderThemeChromiumWin.h
@@ -49,6 +49,9 @@
 
         virtual String extraDefaultStyleSheet();
         virtual String extraQuirksStyleSheet();
+#if ENABLE(VIDEO)
+        virtual String extraMediaControlsStyleSheet();
+#endif
 
         // A method asking if the theme's controls actually care about redrawing when hovered.
         virtual bool supportsHover(const RenderStyle*) const { return true; }
@@ -61,12 +64,13 @@
         virtual Color platformInactiveSelectionBackgroundColor() const;
         virtual Color platformActiveSelectionForegroundColor() const;
         virtual Color platformInactiveSelectionForegroundColor() const;
-        virtual Color platformTextSearchHighlightColor() const;
+        virtual Color platformActiveTextSearchHighlightColor() const;
+        virtual Color platformInactiveTextSearchHighlightColor() const;
 
         virtual double caretBlinkInterval() const;
 
         // System fonts.
-        virtual void systemFont(int propId, Document*, FontDescription&) const;
+        virtual void systemFont(int propId, FontDescription&) const;
 
         virtual int minimumMenuListSize(RenderStyle*) const;
 
@@ -88,7 +92,21 @@
 
         virtual bool paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r) { return paintSliderTrack(o, i, r); }
 
-        virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r) { return paintTextField(o, i, r); }
+
+        virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+
+        virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+        virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
         // MenuList refers to an unstyled menulist (meaning a menulist without
         // background-color or border set) and MenuListButton refers to a styled
@@ -122,10 +140,6 @@
         // object.
         static void setDefaultFontSize(int);
 
-        // Enables/Disables FindInPage mode, which (if enabled) overrides the
-        // selection rect color to be orange.
-        static void setFindInPageMode(bool);
-
     private:
         unsigned determineState(RenderObject*);
         unsigned determineSliderThumbState(RenderObject*);
@@ -134,11 +148,9 @@
         ThemeData getThemeData(RenderObject*);
 
         bool paintTextFieldInternal(RenderObject*, const RenderObject::PaintInfo&, const IntRect&, bool);
+        bool paintMediaButtonInternal(GraphicsContext*, const IntRect&, Image*);
 
         int menuListInternalPadding(RenderStyle*, int paddingType) const;
-
-        // A flag specifying whether we are in Find-in-page mode or not.
-        static bool m_findInPageMode;
     };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeMac.mm b/WebCore/rendering/RenderThemeMac.mm
index 7d1a60e..c3ec91a 100644
--- a/WebCore/rendering/RenderThemeMac.mm
+++ b/WebCore/rendering/RenderThemeMac.mm
@@ -951,11 +951,7 @@
 
     // Set the foreground color to black or gray when we have the aqua look.
     // Cast to RGB32 is to work around a compiler bug.
-    bool isEnabled = true;
-    if (FormControlElement* formControlElement = toFormControlElement(e))
-        isEnabled = formControlElement->isEnabled();
-
-    style->setColor(isEnabled ? static_cast<RGBA32>(Color::black) : Color::darkGray);
+    style->setColor(e && e->isEnabledFormControl() ? static_cast<RGBA32>(Color::black) : Color::darkGray);
 
     // Set the button's vertical size.
     setSizeFromFont(style, menuListButtonSizes());
diff --git a/WebCore/rendering/RenderThemeSafari.cpp b/WebCore/rendering/RenderThemeSafari.cpp
index cf73fdb..3affd1f 100644
--- a/WebCore/rendering/RenderThemeSafari.cpp
+++ b/WebCore/rendering/RenderThemeSafari.cpp
@@ -31,10 +31,10 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
-#include "FormControlElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
+#include "RenderMediaControls.h"
 #include "RenderSlider.h"
 #include "RenderView.h"
 #include "RetainPtr.h"
@@ -835,7 +835,7 @@
 
     // Set the foreground color to black or gray when we have the aqua look.
     // Cast to RGB32 is to work around a compiler bug.
-    style->setColor(e->isFormControlElement() && toFormControlElement(e)->isEnabled() ? static_cast<RGBA32>(Color::black) : Color::darkGray);
+    style->setColor(e && e->isEnabledFormControl() ? static_cast<RGBA32>(Color::black) : Color::darkGray);
 
     // Set the button's vertical size.
     setButtonSize(style);
@@ -916,8 +916,7 @@
 {
     IntRect bounds = r;
 
-    if (o->style()->appearance() ==  SliderHorizontalPart || 
-        o->style()->appearance() == MediaSliderPart) {
+    if (o->style()->appearance() ==  SliderHorizontalPart) {
         bounds.setHeight(trackWidth);
         bounds.setY(r.y() + r.height() / 2 - trackWidth / 2);
     } else if (o->style()->appearance() == SliderVerticalPart) {
@@ -974,19 +973,17 @@
 
 const int sliderThumbWidth = 15;
 const int sliderThumbHeight = 15;
-const int mediaSliderThumbWidth = 13;
-const int mediaSliderThumbHeight = 14;
 
 void RenderThemeSafari::adjustSliderThumbSize(RenderObject* o) const
 {
     if (o->style()->appearance() == SliderThumbHorizontalPart || o->style()->appearance() == SliderThumbVerticalPart) {
         o->style()->setWidth(Length(sliderThumbWidth, Fixed));
         o->style()->setHeight(Length(sliderThumbHeight, Fixed));
-    } else if (o->style()->appearance() == MediaSliderThumbPart) {
-        o->style()->setWidth(Length(mediaSliderThumbWidth, Fixed));
-        o->style()->setHeight(Length(mediaSliderThumbHeight, Fixed));
-    }
-
+    } 
+#if ENABLE(VIDEO)
+    else if (o->style()->appearance() == MediaSliderThumbPart) 
+        RenderMediaControls::adjustMediaSliderThumbSize(o);
+#endif
 }
 
 bool RenderThemeSafari::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
@@ -1136,104 +1133,37 @@
 #if ENABLE(VIDEO)
 bool RenderThemeSafari::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    paintThemePart(SafariTheme::MediaFullscreenButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaFullscreenButton, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    paintThemePart(mediaElement->muted() ? SafariTheme::MediaUnMuteButtonPart : SafariTheme::MediaMuteButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaMuteButton, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    paintThemePart(mediaElement->canPlay() ? SafariTheme::MediaPlayButtonPart : SafariTheme::MediaPauseButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaPlayButton, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    paintThemePart(SafariTheme::MediaSeekBackButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaSeekBackButton, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    paintThemePart(SafariTheme::MediaSeekForwardButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaSeekForwardButton, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-
-    float percentLoaded = 0;
-    if (MediaPlayer* player = mediaElement->player())
-        if (player->duration())
-            percentLoaded = player->maxTimeBuffered() / player->duration();
-
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    ASSERT(SafariThemeLibrary());
-    STPaintProgressIndicator(SafariTheme::MediaType, paintInfo.context->platformContext(), r, NSRegularControlSize, 0, percentLoaded);
-#endif
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaSlider, o, paintInfo, r);
 }
 
 bool RenderThemeSafari::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    ASSERT(SafariThemeLibrary());
-
-#if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
-    paintThemePart(SafariTheme::MediaSliderThumbPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
-#endif
-
-    return false;
+    return RenderMediaControls::paintMediaControlsPart(MediaSliderThumb, o, paintInfo, r);
 }
 #endif
 
diff --git a/WebCore/rendering/RenderThemeWin.cpp b/WebCore/rendering/RenderThemeWin.cpp
index 0518ef0..1fa5162 100644
--- a/WebCore/rendering/RenderThemeWin.cpp
+++ b/WebCore/rendering/RenderThemeWin.cpp
@@ -21,17 +21,20 @@
 #include "config.h"
 #include "RenderThemeWin.h"
 
-#include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
-#include "Document.h"
+#include "Element.h"
+#include "Frame.h"
 #include "GraphicsContext.h"
-#include "HTMLElement.h"
-#include "HTMLSelectElement.h"
-#include "Icon.h"
 #include "RenderSlider.h"
+#include "Settings.h"
 #include "SoftLinking.h"
+#include "SystemInfo.h"
 #include "UserAgentStyleSheets.h"
 
+#if ENABLE(VIDEO)
+#include "RenderMediaControls.h"
+#endif
+
 #include <tchar.h>
 
 /* 
@@ -54,10 +57,14 @@
 
 // Textfield constants
 #define TFP_TEXTFIELD 1
+#define EP_EDITBORDER_NOSCROLL 6
 #define TFS_READONLY  6
 
-// ComboBox constants (from tmschema.h)
+// ComboBox constants (from vsstyle.h)
 #define CP_DROPDOWNBUTTON 1
+#define CP_BORDER 4
+#define CP_READONLY 5
+#define CP_DROPDOWNBUTTONRIGHT 6
 
 // TrackBar (slider) parts
 #define TKP_TRACK       1
@@ -92,6 +99,8 @@
 
 static bool haveTheme;
 
+static const unsigned vistaMenuListButtonOutset = 1;
+
 using namespace std;
 
 namespace WebCore {
@@ -114,6 +123,12 @@
 
 static bool gWebKitIsBeingUnloaded;
 
+static bool documentIsInApplicationChromeMode(const Document* document)
+{
+    Settings* settings = document->settings();
+    return settings && settings->inApplicationChromeMode();
+}
+
 void RenderThemeWin::setWebKitIsBeingUnloaded()
 {
     gWebKitIsBeingUnloaded = true;
@@ -493,8 +508,13 @@
             break;
         case MenulistPart:
         case MenulistButtonPart:
-            result.m_part = CP_DROPDOWNBUTTON;
-            result.m_state = determineState(o);
+            result.m_part = isRunningOnVistaOrLater() ? CP_DROPDOWNBUTTONRIGHT : CP_DROPDOWNBUTTON;
+            if (isRunningOnVistaOrLater() && documentIsInApplicationChromeMode(o->document())) {
+                // The "readonly" look we use in application chrome mode
+                // only uses a "normal" look for the drop down button.
+                result.m_state = TS_NORMAL;
+            } else
+                result.m_state = determineState(o);
             break;
         case RadioPart:
             result.m_part = BP_RADIO;
@@ -503,7 +523,7 @@
         case SearchFieldPart:
         case TextFieldPart:
         case TextAreaPart:
-            result.m_part = TFP_TEXTFIELD;
+            result.m_part = isRunningOnVistaOrLater() ? EP_EDITBORDER_NOSCROLL : TFP_TEXTFIELD;
             result.m_state = determineState(o);
             break;
         case SliderHorizontalPart:
@@ -615,8 +635,20 @@
 
 bool RenderThemeWin::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
-    // The outer box of a menu list is just a text field.  Paint it first.
-    drawControl(i.context,  o, textFieldTheme(), ThemeData(TFP_TEXTFIELD, determineState(o)), r);
+    HANDLE theme;
+    int part;
+    if (haveTheme && isRunningOnVistaOrLater()) {
+        theme = menuListTheme();
+        if (documentIsInApplicationChromeMode(o->document()))
+            part = CP_READONLY;
+        else
+            part = CP_BORDER;
+    } else {
+        theme = textFieldTheme();
+        part = TFP_TEXTFIELD;
+    }
+
+    drawControl(i.context,  o, theme, ThemeData(part, determineState(o)), r);
     
     return paintMenuListButton(o, i, r);
 }
@@ -669,6 +701,13 @@
         buttonRect.setX(buttonRect.right() - dropDownButtonWidth);
     buttonRect.setWidth(dropDownButtonWidth);
 
+    if (isRunningOnVistaOrLater()) {
+        // Outset the top, right, and bottom borders of the button so that they coincide with the <select>'s border.
+        buttonRect.setY(buttonRect.y() - vistaMenuListButtonOutset);
+        buttonRect.setHeight(buttonRect.height() + 2 * vistaMenuListButtonOutset);
+        buttonRect.setWidth(buttonRect.width() + vistaMenuListButtonOutset);
+    }
+
     drawControl(i.context, o, menuListTheme(), getThemeData(o), buttonRect);
 
     return false;
@@ -710,6 +749,10 @@
         o->style()->setWidth(Length(sliderThumbWidth, Fixed));
         o->style()->setHeight(Length(sliderThumbHeight, Fixed));
     }
+#if ENABLE(VIDEO)
+    else if (o->style()->appearance() == MediaSliderThumbPart) 
+        RenderMediaControls::adjustMediaSliderThumbSize(o);
+#endif
 }
 
 int RenderThemeWin::buttonInternalPaddingLeft() const
@@ -737,6 +780,18 @@
     return paintTextField(o, i, r);
 }
 
+void RenderThemeWin::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    // Override paddingSize to match AppKit text positioning.
+    const int padding = 1;
+    style->setPaddingLeft(Length(padding, Fixed));
+    style->setPaddingRight(Length(padding, Fixed));
+    style->setPaddingTop(Length(padding, Fixed));
+    style->setPaddingBottom(Length(padding, Fixed));
+    if (e && e->focused() && e->document()->frame()->selection()->isFocusedAndActive())
+        style->setOutlineOffset(-2);
+}
+
 bool RenderThemeWin::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     IntRect bounds = r;
@@ -893,4 +948,41 @@
     return Color(GetRValue(color), GetGValue(color), GetBValue(color));
 }
 
+#if ENABLE(VIDEO)
+bool RenderThemeWin::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaFullscreenButton, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaMuteButton, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaPlayButton, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaSeekBackButton, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaSeekForwardButton, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaSlider, o, paintInfo, r);
+}
+
+bool RenderThemeWin::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaSliderThumb, o, paintInfo, r);
+}
+#endif
+
 }
diff --git a/WebCore/rendering/RenderThemeWin.h b/WebCore/rendering/RenderThemeWin.h
index 664094f..25473a1 100644
--- a/WebCore/rendering/RenderThemeWin.h
+++ b/WebCore/rendering/RenderThemeWin.h
@@ -99,6 +99,7 @@
     virtual int buttonInternalPaddingTop() const;
     virtual int buttonInternalPaddingBottom() const;
 
+    virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
     virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
@@ -123,6 +124,16 @@
 
     virtual bool supportsFocusRing(const RenderStyle*) const;
 
+#if ENABLE(VIDEO)
+    virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+#endif
+
 private:
     void addIntrinsicMargins(RenderStyle*) const;
     void close();
diff --git a/WebCore/rendering/RenderTreeAsText.cpp b/WebCore/rendering/RenderTreeAsText.cpp
index 2350491..79d1724 100644
--- a/WebCore/rendering/RenderTreeAsText.cpp
+++ b/WebCore/rendering/RenderTreeAsText.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "RenderTreeAsText.h"
 
+#include "CSSMutableStyleDeclaration.h"
 #include "CharacterNames.h"
 #include "Document.h"
 #include "Frame.h"
@@ -44,9 +45,11 @@
 #include <wtf/Vector.h>
 
 #if ENABLE(SVG)
-#include "RenderSVGRoot.h"
+#include "RenderPath.h"
 #include "RenderSVGContainer.h"
+#include "RenderSVGImage.h"
 #include "RenderSVGInlineText.h"
+#include "RenderSVGRoot.h"
 #include "RenderSVGText.h"
 #include "SVGRenderTreeAsText.h"
 #endif
@@ -374,6 +377,10 @@
             write(ts, static_cast<const RenderSVGInlineText&>(o), indent);
         return;
     }
+    if (o.isSVGImage()) {
+        write(ts, static_cast<const RenderSVGImage&>(o), indent);
+        return;
+    }
 #endif
 
     writeIndent(ts, indent);
@@ -518,13 +525,13 @@
 
     VisibleSelection selection = frame->selection()->selection();
     if (selection.isCaret()) {
-        ts << "caret: position " << selection.start().m_offset << " of " << nodePosition(selection.start().node());
+        ts << "caret: position " << selection.start().deprecatedEditingOffset() << " of " << nodePosition(selection.start().node());
         if (selection.affinity() == UPSTREAM)
             ts << " (upstream affinity)";
         ts << "\n";
     } else if (selection.isRange())
-        ts << "selection start: position " << selection.start().m_offset << " of " << nodePosition(selection.start().node()) << "\n"
-           << "selection end:   position " << selection.end().m_offset << " of " << nodePosition(selection.end().node()) << "\n";
+        ts << "selection start: position " << selection.start().deprecatedEditingOffset() << " of " << nodePosition(selection.start().node()) << "\n"
+           << "selection end:   position " << selection.end().deprecatedEditingOffset() << " of " << nodePosition(selection.end().node()) << "\n";
 }
 
 String externalRepresentation(RenderObject* o)
diff --git a/WebCore/rendering/RenderVideo.cpp b/WebCore/rendering/RenderVideo.cpp
index d6e98e7..d47e2f3 100644
--- a/WebCore/rendering/RenderVideo.cpp
+++ b/WebCore/rendering/RenderVideo.cpp
@@ -41,9 +41,24 @@
 
 using namespace HTMLNames;
 
+static const int cDefaultWidth = 300;
+static const int cDefaultHeight = 150;
+
 RenderVideo::RenderVideo(HTMLMediaElement* video)
-    : RenderMedia(video, video->player() ? video->player()->naturalSize() : IntSize(300, 150))
+    : RenderMedia(video)
 {
+    if (video->player())
+        setIntrinsicSize(video->player()->naturalSize());
+    else {
+        // Video in standalone media documents should not use the default 300x150
+        // size since they also have audio thrown at them. By setting the intrinsic
+        // size to 300x1 the video will resize itself in these cases, and audio will
+        // have the correct height (it needs to be > 0 for controls to render properly).
+        if (video->ownerDocument() && video->ownerDocument()->isMediaDocument())
+            setIntrinsicSize(IntSize(cDefaultWidth, 1));
+        else
+            setIntrinsicSize(IntSize(cDefaultWidth, cDefaultHeight));
+    }
 }
 
 RenderVideo::~RenderVideo()
diff --git a/WebCore/rendering/RenderView.cpp b/WebCore/rendering/RenderView.cpp
index ab2f085..e110d80 100644
--- a/WebCore/rendering/RenderView.cpp
+++ b/WebCore/rendering/RenderView.cpp
@@ -133,10 +133,10 @@
     if (needsLayout())
         RenderBlock::layout();
 
-    // Ensure that docWidth() >= width() and docHeight() >= height().
+    // Reset overflowWidth and overflowHeight, since they act as a lower bound for docWidth() and docHeight().
     setOverflowWidth(width());
     setOverflowHeight(height());
-
+    
     setOverflowWidth(docWidth());
     setOverflowHeight(docHeight());
 
@@ -290,12 +290,12 @@
         rect = m_layer->transform()->mapRect(rect);
 }
 
-void RenderView::absoluteRects(Vector<IntRect>& rects, int tx, int ty, bool)
+void RenderView::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 {
     rects.append(IntRect(tx, ty, m_layer->width(), m_layer->height()));
 }
 
-void RenderView::absoluteQuads(Vector<FloatQuad>& quads, bool)
+void RenderView::absoluteQuads(Vector<FloatQuad>& quads)
 {
     quads.append(FloatRect(0, 0, m_layer->width(), m_layer->height()));
 }
@@ -311,7 +311,7 @@
 
 IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
 {
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
 
     typedef HashMap<RenderObject*, RenderSelectionInfo*> SelectionMap;
     SelectionMap selectedObjects;
@@ -361,7 +361,7 @@
 }
 #endif
 
-void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* end, int endPos)
+void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* end, int endPos, SelectionRepaintMode blockRepaintMode)
 {
     // Make sure both our start and end objects are defined.
     // Check www.msnbc.com and try clicking around to find the case where this happened.
@@ -439,6 +439,8 @@
         o = o->nextInPreOrder();
     }
 
+    m_cachedSelectionBounds = IntRect();
+
     // Now that the selection state has been updated for the new objects, walk them again and
     // put them in the new objects list.
     o = start;
@@ -450,7 +452,9 @@
                 RenderBlockSelectionInfo* blockInfo = newSelectedBlocks.get(cb);
                 if (blockInfo)
                     break;
-                newSelectedBlocks.set(cb, new RenderBlockSelectionInfo(cb));
+                blockInfo = new RenderBlockSelectionInfo(cb);
+                newSelectedBlocks.set(cb, blockInfo);
+                m_cachedSelectionBounds.unite(blockInfo->rects());
                 cb = cb->containingBlock();
             }
         }
@@ -501,7 +505,8 @@
         RenderBlockSelectionInfo* newInfo = newSelectedBlocks.get(block);
         RenderBlockSelectionInfo* oldInfo = i->second;
         if (!newInfo || oldInfo->rects() != newInfo->rects() || oldInfo->state() != newInfo->state()) {
-            oldInfo->repaint();
+            if (blockRepaintMode == RepaintNewXOROld)
+                oldInfo->repaint();
             if (newInfo) {
                 newInfo->repaint();
                 newSelectedBlocks.remove(block);
@@ -522,7 +527,8 @@
 
 void RenderView::clearSelection()
 {
-    setSelection(0, -1, 0, -1);
+    repaintViewRectangle(m_cachedSelectionBounds);
+    setSelection(0, -1, 0, -1, RepaintNewMinusOld);
 }
 
 void RenderView::selectionStartEnd(int& startPos, int& endPos) const
@@ -564,10 +570,7 @@
 
 int RenderView::docHeight() const
 {
-    int h = height();
-    int lowestPos = lowestPosition();
-    if (lowestPos > h)
-        h = lowestPos;
+    int h = lowestPosition();
 
     // FIXME: This doesn't do any margin collapsing.
     // Instead of this dh computation we should keep the result
@@ -584,11 +587,8 @@
 
 int RenderView::docWidth() const
 {
-    int w = width();
-    int rightmostPos = rightmostPosition();
-    if (rightmostPos > w)
-        w = rightmostPos;
-    
+    int w = rightmostPosition();
+
     for (RenderBox* c = firstChildBox(); c; c = c->nextSiblingBox()) {
         int dw = c->width() + c->marginLeft() + c->marginRight();
         if (dw > w)
diff --git a/WebCore/rendering/RenderView.h b/WebCore/rendering/RenderView.h
index 1c6925c..bcade1a 100644
--- a/WebCore/rendering/RenderView.h
+++ b/WebCore/rendering/RenderView.h
@@ -50,14 +50,11 @@
     virtual void calcWidth();
     virtual void calcHeight();
     virtual void calcPrefWidths();
-    
-    int docHeight() const;
-    int docWidth() const;
 
     // The same as the FrameView's layoutHeight/layoutWidth but with null check guards.
     int viewHeight() const;
     int viewWidth() const;
-    
+
     float zoomFactor() const;
 
     FrameView* frameView() const { return m_frameView; }
@@ -71,7 +68,8 @@
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
 
-    void setSelection(RenderObject* start, int startPos, RenderObject* end, int endPos);
+    enum SelectionRepaintMode { RepaintNewXOROld, RepaintNewMinusOld };
+    void setSelection(RenderObject* start, int startPos, RenderObject* end, int endPos, SelectionRepaintMode = RepaintNewXOROld);
     void clearSelection();
     virtual RenderObject* selectionStart() const { return m_selectionStart; }
     virtual RenderObject* selectionEnd() const { return m_selectionEnd; }
@@ -85,8 +83,8 @@
 
     int truncatedAt() const { return m_truncatedAt; }
 
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty, bool topLevel = true);
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool topLevel = true);
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
 
     IntRect selectionBounds(bool clipToVisibleContent = true) const;
 
@@ -172,6 +170,12 @@
 private:
     bool shouldRepaint(const IntRect& r) const;
 
+#ifdef FLATTEN_FRAMESET
+public: // used by layout function
+#endif
+    int docHeight() const;
+    int docWidth() const;
+
 protected:
     FrameView* m_frameView;
 
@@ -192,6 +196,8 @@
     RenderWidgetSet m_widgets;
 
 private:
+    IntRect m_cachedSelectionBounds;
+
     int m_bestTruncatedAt;
     int m_truncatorWidth;
     bool m_forcedPageBreak;
diff --git a/WebCore/rendering/RenderWidget.cpp b/WebCore/rendering/RenderWidget.cpp
index 2f30c59..ec2ee6a 100644
--- a/WebCore/rendering/RenderWidget.cpp
+++ b/WebCore/rendering/RenderWidget.cpp
@@ -1,9 +1,7 @@
-/**
- * This file is part of the HTML widget for KDE.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,13 +25,8 @@
 
 #include "AnimationController.h"
 #include "AXObjectCache.h"
-#include "Document.h"
-#include "Element.h"
-#include "Event.h"
-#include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
-#include "RenderLayer.h"
 #include "RenderView.h"
 
 using namespace std;
@@ -47,14 +40,11 @@
 }
 
 RenderWidget::RenderWidget(Node* node)
-      : RenderReplaced(node)
-      , m_widget(0)
-      , m_refCount(0)
+    : RenderReplaced(node)
+    , m_widget(0)
+    , m_frameView(node->document()->view())
+    , m_refCount(0)
 {
-    // a replaced element doesn't support being anonymous
-    ASSERT(node);
-    m_view = node->document()->view();
-
     view()->addWidget(this);
 
     // Reference counting is used to prevent the widget from being
@@ -82,8 +72,8 @@
     remove();
 
     if (m_widget) {
-        if (m_view)
-            m_view->removeChild(m_widget);
+        if (m_frameView)
+            m_frameView->removeChild(m_widget);
         widgetRendererMap().remove(m_widget);
     }
     
@@ -96,6 +86,7 @@
 
     if (hasLayer()) {
         layer()->clearClipRects();
+        setHasLayer(false);
         destroyLayer();
     }
 
@@ -109,7 +100,7 @@
 RenderWidget::~RenderWidget()
 {
     ASSERT(m_refCount <= 0);
-    deleteWidget();
+    clearWidget();
 }
 
 void RenderWidget::setWidgetGeometry(const IntRect& frame)
@@ -128,7 +119,7 @@
         if (m_widget) {
             m_widget->removeFromParent();
             widgetRendererMap().remove(m_widget);
-            deleteWidget();
+            clearWidget();
         }
         m_widget = widget;
         if (m_widget) {
@@ -144,7 +135,7 @@
                 else
                     m_widget->show();
             }
-            m_view->addChild(m_widget);
+            m_frameView->addChild(m_widget);
         }
     }
 }
@@ -183,7 +174,7 @@
         return;
     }
 
-    if (!m_view || paintInfo.phase != PaintPhaseForeground || style()->visibility() != VISIBLE)
+    if (!m_frameView || paintInfo.phase != PaintPhaseForeground || style()->visibility() != VISIBLE)
         return;
 
 #if PLATFORM(MAC)
@@ -195,11 +186,12 @@
     if (clipToBorderRadius) {
         // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
         paintInfo.context->save();
-        paintInfo.context->addRoundedRectClip(IntRect(tx, ty, width(), height()),
-                                              style()->borderTopLeftRadius(),
-                                              style()->borderTopRightRadius(), 
-                                              style()->borderBottomLeftRadius(),
-                                              style()->borderBottomRightRadius());
+        
+        IntSize topLeft, topRight, bottomLeft, bottomRight;
+        IntRect borderRect = IntRect(tx, ty, width(), height());
+        style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+
+        paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
     }
 
     if (m_widget) {
@@ -211,6 +203,11 @@
         // Tell the widget to paint now.  This is the only time the widget is allowed
         // to paint itself.  That way it will composite properly with z-indexed layers.
         m_widget->paint(paintInfo.context, paintInfo.rect);
+
+        if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget)->useSlowRepaints()) {
+            ASSERT(!paintInfo.overlapTestRequests->contains(this));
+            paintInfo.overlapTestRequests->set(this, m_widget->frameRect());
+        }
     }
 
     if (clipToBorderRadius)
@@ -223,6 +220,13 @@
     }
 }
 
+void RenderWidget::setOverlapTestResult(bool isOverlapped)
+{
+    ASSERT(m_widget);
+    ASSERT(m_widget->isFrameView());
+    static_cast<FrameView*>(m_widget)->setIsOverlapped(isOverlapped);
+}
+
 void RenderWidget::deref(RenderArena *arena)
 {
     if (--m_refCount <= 0)
@@ -270,9 +274,17 @@
     }
 }
 
-void RenderWidget::deleteWidget()
+void RenderWidget::clearWidget()
 {
-    delete m_widget;
+    Widget* widget = m_widget;
+    m_widget = 0;
+    if (widget)
+        deleteWidget(widget);
+}
+
+void RenderWidget::deleteWidget(Widget* widget)
+{
+    delete widget;
 }
 
 RenderWidget* RenderWidget::find(const Widget* widget)
diff --git a/WebCore/rendering/RenderWidget.h b/WebCore/rendering/RenderWidget.h
index cca2165..d23dbb3 100644
--- a/WebCore/rendering/RenderWidget.h
+++ b/WebCore/rendering/RenderWidget.h
@@ -1,8 +1,6 @@
 /*
- * This file is part of the HTML widget for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,51 +22,51 @@
 #ifndef RenderWidget_h
 #define RenderWidget_h
 
+#include "OverlapTestRequestClient.h"
 #include "RenderReplaced.h"
 
 namespace WebCore {
 
 class Widget;
 
-class RenderWidget : public RenderReplaced {
+class RenderWidget : public RenderReplaced, private OverlapTestRequestClient {
 public:
-    RenderWidget(Node*);
     virtual ~RenderWidget();
 
-    virtual bool isWidget() const { return true; }
+    Widget* widget() const { return m_widget; }
+    virtual void setWidget(Widget*);
 
-    virtual void paint(PaintInfo&, int tx, int ty);
+    static RenderWidget* find(const Widget*);
 
-    virtual void destroy();
+    void updateWidgetPosition();
+
+protected:
+    RenderWidget(Node*);
+
+    FrameView* frameView() const { return m_frameView; }
+
+    void clearWidget();
+
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
     virtual void layout();
 
-    Widget* widget() const { return m_widget; }
-    static RenderWidget* find(const Widget*);
+private:
+    virtual bool isWidget() const { return true; }
+
+    virtual void paint(PaintInfo&, int x, int y);
+    virtual void destroy();
+    virtual void setSelectionState(SelectionState);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    virtual void deleteWidget(Widget*);
+    virtual void setOverlapTestResult(bool);
+
+    void setWidgetGeometry(const IntRect&);
 
     RenderArena* ref() { ++m_refCount; return renderArena(); }
     void deref(RenderArena*);
 
-    virtual void setSelectionState(SelectionState);
-
-    void updateWidgetPosition();
-
-    virtual void setWidget(Widget*);
-
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
-
-protected:
-    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
-
-private:
-    void setWidgetGeometry(const IntRect&);
-
-    virtual void deleteWidget();
-
-protected:
     Widget* m_widget;
-    FrameView* m_view;
-
-private:
+    FrameView* m_frameView;
     int m_refCount;
 };
 
diff --git a/WebCore/rendering/RootInlineBox.cpp b/WebCore/rendering/RootInlineBox.cpp
index e582e5e..ed125ee 100644
--- a/WebCore/rendering/RootInlineBox.cpp
+++ b/WebCore/rendering/RootInlineBox.cpp
@@ -74,19 +74,6 @@
     }
 }
 
-int RootInlineBox::height() const
-{
-    const Font& font = renderer()->style(m_firstLine)->font();
-    int result = font.height();
-    bool strictMode = renderer()->document()->inStrictMode();
-    if (!strictMode && !hasTextChildren() && !boxModelObject()->hasHorizontalBordersOrPadding()) {
-        int bottom = bottomOverflow();
-        if (y() + result > bottom)
-            result = bottom - y();
-    }
-    return result;
-}
-
 RenderLineBoxList* RootInlineBox::rendererLineBoxes() const
 {
     return block()->lineBoxes();
@@ -112,7 +99,7 @@
     return InlineFlowBox::canAccommodateEllipsis(ltr, blockEdge, ellipsisWidth);
 }
 
-void RootInlineBox::placeEllipsis(const AtomicString& ellipsisStr,  bool ltr, int blockEdge, int ellipsisWidth,
+void RootInlineBox::placeEllipsis(const AtomicString& ellipsisStr,  bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth,
                                   InlineBox* markupBox)
 {
     // Create an ellipsis box.
@@ -126,7 +113,8 @@
     gEllipsisBoxMap->add(this, ellipsisBox);
     m_hasEllipsisBox = true;
 
-    if (ltr && (x() + width() + ellipsisWidth) <= blockEdge) {
+    // FIXME: Do we need an RTL version of this?
+    if (ltr && (x() + width() + ellipsisWidth) <= blockRightEdge) {
         ellipsisBox->m_x = x() + width();
         return;
     }
@@ -135,14 +123,14 @@
     // of that glyph.  Mark all of the objects that intersect the ellipsis box as not painting (as being
     // truncated).
     bool foundBox = false;
-    ellipsisBox->m_x = placeEllipsisBox(ltr, blockEdge, ellipsisWidth, foundBox);
+    ellipsisBox->m_x = placeEllipsisBox(ltr, blockLeftEdge, blockRightEdge, ellipsisWidth, foundBox);
 }
 
-int RootInlineBox::placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool& foundBox)
+int RootInlineBox::placeEllipsisBox(bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth, bool& foundBox)
 {
-    int result = InlineFlowBox::placeEllipsisBox(ltr, blockEdge, ellipsisWidth, foundBox);
+    int result = InlineFlowBox::placeEllipsisBox(ltr, blockLeftEdge, blockRightEdge, ellipsisWidth, foundBox);
     if (result == -1)
-        result = ltr ? blockEdge - ellipsisWidth : blockEdge;
+        result = ltr ? blockRightEdge - ellipsisWidth : blockLeftEdge;
     return result;
 }
 
diff --git a/WebCore/rendering/RootInlineBox.h b/WebCore/rendering/RootInlineBox.h
index e190a48..171be9d 100644
--- a/WebCore/rendering/RootInlineBox.h
+++ b/WebCore/rendering/RootInlineBox.h
@@ -28,9 +28,10 @@
 
 namespace WebCore {
 
-class BidiStatus;
 class EllipsisBox;
 class HitTestResult;
+
+struct BidiStatus;
 struct GapRects;
 
 class RootInlineBox : public InlineFlowBox {
@@ -45,8 +46,6 @@
 
     virtual bool isRootInlineBox() const { return true; }
 
-    virtual int height() const;
-
     virtual void destroy(RenderArena*);
     void detachEllipsisBox(RenderArena*);
 
@@ -87,8 +86,8 @@
     void childRemoved(InlineBox* box);
 
     bool canAccommodateEllipsis(bool ltr, int blockEdge, int lineBoxEdge, int ellipsisWidth);
-    void placeEllipsis(const AtomicString& ellipsisStr, bool ltr, int blockEdge, int ellipsisWidth, InlineBox* markupBox = 0);
-    virtual int placeEllipsisBox(bool ltr, int blockEdge, int ellipsisWidth, bool& foundBox);
+    void placeEllipsis(const AtomicString& ellipsisStr, bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth, InlineBox* markupBox = 0);
+    virtual int placeEllipsisBox(bool ltr, int blockLeftEdge, int blockRightEdge, int ellipsisWidth, bool& foundBox);
 
     EllipsisBox* ellipsisBox() const;
 
diff --git a/WebCore/rendering/SVGInlineFlowBox.h b/WebCore/rendering/SVGInlineFlowBox.h
index 2742ca0..1aa2637 100644
--- a/WebCore/rendering/SVGInlineFlowBox.h
+++ b/WebCore/rendering/SVGInlineFlowBox.h
@@ -37,7 +37,7 @@
     {
     }
 
-    virtual int height() const { return m_height; }
+    virtual int svgBoxHeight() const { return m_height; }
     void setHeight(int h) { m_height = h; }
 
     virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
diff --git a/WebCore/rendering/SVGInlineTextBox.cpp b/WebCore/rendering/SVGInlineTextBox.cpp
index f424ef2..d0fa9ae 100644
--- a/WebCore/rendering/SVGInlineTextBox.cpp
+++ b/WebCore/rendering/SVGInlineTextBox.cpp
@@ -38,8 +38,6 @@
 
 #include <float.h>
 
-using std::max;
-
 namespace WebCore {
 
 SVGInlineTextBox::SVGInlineTextBox(RenderObject* obj)
diff --git a/WebCore/rendering/SVGInlineTextBox.h b/WebCore/rendering/SVGInlineTextBox.h
index 6287c81..410218d 100644
--- a/WebCore/rendering/SVGInlineTextBox.h
+++ b/WebCore/rendering/SVGInlineTextBox.h
@@ -29,15 +29,16 @@
 
 namespace WebCore {
 
-    class SVGChar;
     class SVGRootInlineBox;
-    class SVGTextDecorationInfo;
+
+    struct SVGChar;
+    struct SVGTextDecorationInfo;
 
     class SVGInlineTextBox : public InlineTextBox {
     public:
         SVGInlineTextBox(RenderObject* obj);
 
-        virtual int height() const { return m_height; }
+        virtual int svgBoxHeight() const { return m_height; }
         void setHeight(int h) { m_height = h; }
 
         virtual int selectionTop();
diff --git a/WebCore/rendering/SVGRenderSupport.cpp b/WebCore/rendering/SVGRenderSupport.cpp
index dd154c7..c2c8e0b 100644
--- a/WebCore/rendering/SVGRenderSupport.cpp
+++ b/WebCore/rendering/SVGRenderSupport.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 2007, 2008 Rob Buis <buis@kde.org>
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *           (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Google, Inc.  All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,7 +26,6 @@
 #if ENABLE(SVG)
 #include "SVGRenderSupport.h"
 
-#include "TransformationMatrix.h"
 #include "ImageBuffer.h"
 #include "RenderObject.h"
 #include "RenderSVGContainer.h"
@@ -35,13 +35,43 @@
 #include "SVGResourceMasker.h"
 #include "SVGStyledElement.h"
 #include "SVGURIReference.h"
+#include "TransformState.h"
+#include "TransformationMatrix.h"
 #include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
-void prepareToRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, const FloatRect& boundingBox, SVGResourceFilter*& filter, SVGResourceFilter* rootFilter)
+IntRect SVGRenderBase::clippedOverflowRectForRepaint(RenderObject* object, RenderBoxModelObject* repaintContainer)
 {
-#if !ENABLE(SVG_FILTERS)
+    // Return early for any cases where we don't actually paint
+    if (object->style()->visibility() != VISIBLE && !object->enclosingLayer()->hasVisibleContent())
+        return IntRect();
+
+    // Pass our local paint rect to computeRectForRepaint() which will
+    // map to parent coords and recurse up the parent chain.
+    IntRect repaintRect = enclosingIntRect(object->repaintRectInLocalCoordinates());
+    object->computeRectForRepaint(repaintContainer, repaintRect);
+    return repaintRect;
+}
+
+void SVGRenderBase::computeRectForRepaint(RenderObject* object, RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
+{
+    // Translate to coords in our parent renderer, and then call computeRectForRepaint on our parent
+    repaintRect = object->localToParentTransform().mapRect(repaintRect);
+    object->parent()->computeRectForRepaint(repaintContainer, repaintRect, fixed);
+}
+
+void SVGRenderBase::mapLocalToContainer(const RenderObject* object, RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState)
+{
+    ASSERT(!fixed); // We should have no fixed content in the SVG rendering tree.
+    ASSERT(useTransforms); // mapping a point through SVG w/o respecting trasnforms is useless.
+    transformState.applyTransform(object->localToParentTransform());
+    object->parent()->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
+}
+
+void SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, const FloatRect& boundingBox, SVGResourceFilter*& filter, SVGResourceFilter* rootFilter)
+{
+#if !ENABLE(FILTERS)
     UNUSED_PARAM(filter);
     UNUSED_PARAM(rootFilter);
 #endif
@@ -64,7 +94,7 @@
         paintInfo.context->beginTransparencyLayer(opacity);
     }
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
     AtomicString filterId(svgStyle->filter());
 #endif
 
@@ -73,7 +103,7 @@
 
     Document* document = object->document();
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
     SVGResourceFilter* newFilter = getFilterById(document, filterId);
     if (newFilter == rootFilter) {
         // Catch <text filter="url(#foo)">Test<tspan filter="url(#foo)">123</tspan></text>.
@@ -87,10 +117,10 @@
     SVGResourceClipper* clipper = getClipperById(document, clipperId);
     SVGResourceMasker* masker = getMaskerById(document, maskerId);
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
     if (filter) {
         filter->addClient(styledElement);
-        filter->prepareFilter(paintInfo.context, boundingBox);
+        filter->prepareFilter(paintInfo.context, object->objectBoundingBox());
     } else if (!filterId.isEmpty())
         svgElement->document()->accessSVGExtensions()->addPendingResource(filterId, styledElement);
 #endif
@@ -108,10 +138,9 @@
         svgElement->document()->accessSVGExtensions()->addPendingResource(maskerId, styledElement);
 }
 
-void finishRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, const FloatRect& boundingBox, SVGResourceFilter*& filter, GraphicsContext* savedContext)
+void SVGRenderBase::finishRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, SVGResourceFilter*& filter, GraphicsContext* savedContext)
 {
-#if !ENABLE(SVG_FILTERS)
-    UNUSED_PARAM(boundingBox);
+#if !ENABLE(FILTERS)
     UNUSED_PARAM(filter);
     UNUSED_PARAM(savedContext);
 #endif
@@ -121,9 +150,9 @@
     const RenderStyle* style = object->style();
     ASSERT(style);
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(FILTERS)
     if (filter) {
-        filter->applyFilter(paintInfo.context, boundingBox);
+        filter->applyFilter(paintInfo.context, object->objectBoundingBox());
         paintInfo.context = savedContext;
     }
 #endif
@@ -155,17 +184,13 @@
         svgContainer->setDrawsContents(false);
 }
 
-void clampImageBufferSizeToViewport(RenderObject* object, IntSize& size)
+void clampImageBufferSizeToViewport(FrameView* frameView, IntSize& size)
 {
-    if (!object || !object->isRenderView())
+    if (!frameView)
         return;
 
-    RenderView* view = toRenderView(object);
-    if (!view->frameView())
-        return;
-
-    int viewWidth = view->frameView()->visibleWidth();
-    int viewHeight = view->frameView()->visibleHeight();
+    int viewWidth = frameView->visibleWidth();
+    int viewHeight = frameView->visibleHeight();
 
     if (size.width() > viewWidth)
         size.setWidth(viewWidth);
@@ -174,6 +199,41 @@
         size.setHeight(viewHeight);
 }
 
+FloatRect SVGRenderBase::computeContainerBoundingBox(const RenderObject* container, bool includeAllPaintedContent)
+{
+    FloatRect boundingBox;
+
+    RenderObject* current = container->firstChild();
+    for (; current != 0; current = current->nextSibling()) {
+        FloatRect childBBox = includeAllPaintedContent ? current->repaintRectInLocalCoordinates() : current->objectBoundingBox();
+        FloatRect childBBoxInLocalCoords = current->localToParentTransform().mapRect(childBBox);
+        boundingBox.unite(childBBoxInLocalCoords);
+    }
+
+    return boundingBox;
+}
+
+FloatRect SVGRenderBase::filterBoundingBoxForRenderer(const RenderObject* object)
+{
+#if ENABLE(FILTERS)
+    SVGResourceFilter* filter = getFilterById(object->document(), object->style()->svgStyle()->filter());
+    if (filter)
+        return filter->filterBBoxForItemBBox(object->objectBoundingBox());
+#else
+    UNUSED_PARAM(object);
+#endif
+    return FloatRect();
+}
+
+void applyTransformToPaintInfo(RenderObject::PaintInfo& paintInfo, const TransformationMatrix& localToAncestorTransform)
+{
+    if (localToAncestorTransform.isIdentity())
+        return;
+
+    paintInfo.context->concatCTM(localToAncestorTransform);
+    paintInfo.rect = localToAncestorTransform.inverse().mapRect(paintInfo.rect);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/rendering/SVGRenderSupport.h b/WebCore/rendering/SVGRenderSupport.h
index 7fdfcf8..da2bf59 100644
--- a/WebCore/rendering/SVGRenderSupport.h
+++ b/WebCore/rendering/SVGRenderSupport.h
@@ -1,9 +1,8 @@
 /**
- * This file is part of the DOM implementation for WebKit.
- *
  * Copyright (C) 2007 Rob Buis <buis@kde.org>
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *           (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Google, Inc.  All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,21 +21,53 @@
  *
  */
 
+#ifndef SVGRenderBase_h
+#define SVGRenderBase_h
+
 #if ENABLE(SVG)
 #include "RenderObject.h"
 
 namespace WebCore {
 
-class SVGResourceFilter;
-void prepareToRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, const FloatRect& boundingBox, SVGResourceFilter*&, SVGResourceFilter* rootFilter = 0);
-void finishRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, const FloatRect& boundingBox, SVGResourceFilter*&, GraphicsContext* savedContext);
+    class SVGResourceFilter;
+    class ImageBuffer;
 
-// This offers a way to render parts of a WebKit rendering tree into a ImageBuffer.
-class ImageBuffer;
-void renderSubtreeToImage(ImageBuffer*, RenderObject*);
+    // SVGRendererBase is an abstract base class which all SVG renderers inherit
+    // from in order to share SVG renderer code.
+    // FIXME: This code can all move into RenderSVGModelObject once
+    // all SVG renderers inherit from RenderSVGModelObject.
+    class SVGRenderBase {
+    public:
+        // FIXME: These are only public for SVGRootInlineBox.
+        // It's unclear if these should be exposed or not.  SVGRootInlineBox may
+        // pass the wrong RenderObject* and boundingBox to these functions.
+        static void prepareToRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, const FloatRect& boundingBox, SVGResourceFilter*&, SVGResourceFilter* rootFilter = 0);
+        static void finishRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, SVGResourceFilter*&, GraphicsContext* savedContext);
 
-void clampImageBufferSizeToViewport(RenderObject*, IntSize&);
+    protected:
+        static IntRect clippedOverflowRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer);
+        static void computeRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer, IntRect&, bool fixed);
 
-}
+        static void mapLocalToContainer(const RenderObject*, RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&);
 
-#endif
+        // Used to share the "walk all the children" logic between objectBoundingBox
+        // and repaintRectInLocalCoordinates in RenderSVGRoot and RenderSVGContainer
+        static FloatRect computeContainerBoundingBox(const RenderObject* container, bool includeAllPaintedContent);
+
+        // returns the filter bounding box (or the empty rect if no filter) in local coordinates
+        static FloatRect filterBoundingBoxForRenderer(const RenderObject*);
+    };
+
+    // FIXME: This should move to RenderObject or PaintInfo
+    // Used for transforming the GraphicsContext and damage rect before passing PaintInfo to child renderers.
+    void applyTransformToPaintInfo(RenderObject::PaintInfo&, const TransformationMatrix& localToChildTransform);
+
+    // This offers a way to render parts of a WebKit rendering tree into a ImageBuffer.
+    void renderSubtreeToImage(ImageBuffer*, RenderObject*);
+
+    void clampImageBufferSizeToViewport(FrameView*, IntSize& imageBufferSize);
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+
+#endif // SVGRenderBase_h
diff --git a/WebCore/rendering/SVGRenderTreeAsText.cpp b/WebCore/rendering/SVGRenderTreeAsText.cpp
index 1f97c47..33baeba 100644
--- a/WebCore/rendering/SVGRenderTreeAsText.cpp
+++ b/WebCore/rendering/SVGRenderTreeAsText.cpp
@@ -33,7 +33,9 @@
 #include "GraphicsTypes.h"
 #include "InlineTextBox.h"
 #include "HTMLNames.h"
+#include "RenderPath.h"
 #include "RenderSVGContainer.h"
+#include "RenderSVGImage.h"
 #include "RenderSVGInlineText.h"
 #include "RenderSVGText.h"
 #include "RenderSVGRoot.h"
@@ -78,6 +80,31 @@
     return ts;
 }
 
+template<typename ValueType>
+static void writeNameValuePair(TextStream& ts, const char* name, ValueType value)
+{
+    ts << " [" << name << "=" << value << "]";
+}
+
+template<typename ValueType>
+static void writeNameAndQuotedValue(TextStream& ts, const char* name, ValueType value)
+{
+    ts << " [" << name << "=\"" << value << "\"]";
+}
+
+static void writeIfNotEmpty(TextStream& ts, const char* name, const String& value)
+{
+    if (!value.isEmpty())
+        writeNameValuePair(ts, name, value);
+}
+
+template<typename ValueType>
+static void writeIfNotDefault(TextStream& ts, const char* name, ValueType value, ValueType defaultValue)
+{
+    if (value != defaultValue)
+        writeNameValuePair(ts, name, value);
+}
+
 TextStream& operator<<(TextStream& ts, const IntPoint& p)
 {
     return ts << "(" << p.x() << "," << p.y() << ")";
@@ -232,13 +259,9 @@
     const SVGRenderStyle* svgStyle = style->svgStyle();
 
     if (!object.localTransform().isIdentity())
-        ts << " [transform=" << object.localTransform() << "]";
-    if (svgStyle->imageRendering() != SVGRenderStyle::initialImageRendering()) {
-        unsigned imageRenderingAsInteger = svgStyle->imageRendering();
-        ts << " [image rendering=" << imageRenderingAsInteger << "]";
-    }
-    if (style->opacity() != RenderStyle::initialOpacity())
-        ts << " [opacity=" << style->opacity() << "]";
+        writeNameValuePair(ts, "transform", object.localTransform());
+    writeIfNotDefault(ts, "image rendering", svgStyle->imageRendering(), SVGRenderStyle::initialImageRendering());
+    writeIfNotDefault(ts, "opacity", style->opacity(), RenderStyle::initialOpacity());
     if (object.isRenderPath()) {
         const RenderPath& path = static_cast<const RenderPath&>(object);
         SVGPaintServer* strokePaintServer = SVGPaintServer::strokePaintServer(style, &path);
@@ -252,20 +275,15 @@
             const DashArray& dashArray = dashArrayFromRenderingStyle(style);
             double strokeWidth = SVGRenderStyle::cssPrimitiveToLength(&path, svgStyle->strokeWidth(), 1.0f);
 
-            if (svgStyle->strokeOpacity() != 1.0f)
-                ts << s << "[opacity=" << svgStyle->strokeOpacity() << "]";
-            if (strokeWidth != 1.0f)
-                ts << s << "[stroke width=" << strokeWidth << "]";
-            if (svgStyle->strokeMiterLimit() != 4)
-                ts << s << "[miter limit=" << svgStyle->strokeMiterLimit() << "]";
-            if (svgStyle->capStyle() != 0)
-                ts << s << "[line cap=" << svgStyle->capStyle() << "]";
-            if (svgStyle->joinStyle() != 0)
-                ts << s << "[line join=" << svgStyle->joinStyle() << "]";
-            if (dashOffset != 0.0f)
-                ts << s << "[dash offset=" << dashOffset << "]";
+            writeIfNotDefault(ts, "opacity", svgStyle->strokeOpacity(), 1.0f);
+            writeIfNotDefault(ts, "stroke width", strokeWidth, 1.0);
+            writeIfNotDefault(ts, "miter limit", svgStyle->strokeMiterLimit(), 4.0f);
+            writeIfNotDefault(ts, "line cap", svgStyle->capStyle(), ButtCap);
+            writeIfNotDefault(ts, "line join", svgStyle->joinStyle(), MiterJoin);
+            writeIfNotDefault(ts, "dash offset", dashOffset, 0.0);
             if (!dashArray.isEmpty())
-                ts << s << "[dash array=" << dashArray << "]";
+                writeNameValuePair(ts, "dash array", dashArray);
+
             ts << "}]";
         }
         SVGPaintServer* fillPaintServer = SVGPaintServer::fillPaintServer(style, &path);
@@ -275,52 +293,47 @@
             if (fillPaintServer)
                 ts << s << *fillPaintServer;
 
-            if (style->svgStyle()->fillOpacity() != 1.0f)
-                ts << s << "[opacity=" << style->svgStyle()->fillOpacity() << "]";
-            if (style->svgStyle()->fillRule() != RULE_NONZERO)
-                ts << s << "[fill rule=" << style->svgStyle()->fillRule() << "]";
+            writeIfNotDefault(ts, "opacity", svgStyle->fillOpacity(), 1.0f);
+            writeIfNotDefault(ts, "fill rule", svgStyle->fillRule(), RULE_NONZERO);
             ts << "}]";
         }
     }
+
     if (!svgStyle->clipPath().isEmpty())
-        ts << " [clip path=\"" << svgStyle->clipPath() << "\"]";
-    if (!svgStyle->startMarker().isEmpty())
-        ts << " [start marker=" << svgStyle->startMarker() << "]";
-    if (!svgStyle->midMarker().isEmpty())
-        ts << " [middle marker=" << svgStyle->midMarker() << "]";
-    if (!svgStyle->endMarker().isEmpty())
-        ts << " [end marker=" << svgStyle->endMarker() << "]";
-    if (!svgStyle->filter().isEmpty())
-        ts << " [filter=" << svgStyle->filter() << "]";
+        writeNameAndQuotedValue(ts, "clip path", svgStyle->clipPath());
+    writeIfNotEmpty(ts, "start marker", svgStyle->startMarker());
+    writeIfNotEmpty(ts, "middle marker", svgStyle->midMarker());
+    writeIfNotEmpty(ts, "end marker", svgStyle->endMarker());
+    writeIfNotEmpty(ts, "filter", svgStyle->filter());
+}
+
+static TextStream& writePositionAndStyle(TextStream& ts, const RenderObject& object)
+{
+    ts << " " << object.absoluteTransform().mapRect(object.repaintRectInLocalCoordinates());
+    writeStyle(ts, object);
+    return ts;
 }
 
 static TextStream& operator<<(TextStream& ts, const RenderPath& path)
 {
-    ts << " " << path.absoluteTransform().mapRect(path.relativeBBox());
-
-    writeStyle(ts, path);
-
-    ts << " [data=\"" << path.path().debugString() << "\"]";
-
+    writePositionAndStyle(ts, path);
+    writeNameAndQuotedValue(ts, "data", path.path().debugString());
     return ts;
 }
 
 static TextStream& operator<<(TextStream& ts, const RenderSVGContainer& container)
 {
-    ts << " " << container.absoluteTransform().mapRect(container.relativeBBox());
-
-    writeStyle(ts, container);
-
-    return ts;
+    return writePositionAndStyle(ts, container);
 }
 
 static TextStream& operator<<(TextStream& ts, const RenderSVGRoot& root)
 {
-    ts << " " << root.absoluteTransform().mapRect(root.relativeBBox());
+    return writePositionAndStyle(ts, root);
+}
 
-    writeStyle(ts, root);
-
-    return ts;
+static TextStream& operator<<(TextStream& ts, const RenderSVGImage& root)
+{
+    return writePositionAndStyle(ts, root);
 }
 
 static TextStream& operator<<(TextStream& ts, const RenderSVGText& text)
@@ -334,7 +347,7 @@
     ts << " at (" << text.x() << "," << text.y() << ") size " << box->width() << "x" << box->height() << " contains " << chunks.size() << " chunk(s)";
 
     if (text.parent() && (text.parent()->style()->color() != text.style()->color()))
-        ts << " [color=" << text.style()->color().name() << "]";
+        writeNameValuePair(ts, "color", text.style()->color().name());
 
     return ts;
 }
@@ -447,95 +460,63 @@
         writeSVGInlineTextBox(ts, static_cast<SVGInlineTextBox*>(box), indent);
 }
 
-static String getTagName(SVGStyledElement* elem)
+static void writeStandardPrefix(TextStream& ts, const RenderObject& object, int indent)
 {
-    if (elem)
-        return elem->nodeName();
-    return "";
+    writeIndent(ts, indent);
+    ts << object.renderName();
+
+    if (object.node())
+        ts << " {" << object.node()->nodeName() << "}";
+}
+
+static void writeChildren(TextStream& ts, const RenderObject& object, int indent)
+{
+    for (RenderObject* child = object.firstChild(); child; child = child->nextSibling())
+        write(ts, *child, indent + 1);
 }
 
 void write(TextStream& ts, const RenderSVGContainer& container, int indent)
 {
-    writeIndent(ts, indent);
-    ts << container.renderName();
-
-    if (container.node()) {
-        String tagName = getTagName(static_cast<SVGStyledElement*>(container.node()));
-        if (!tagName.isEmpty())
-            ts << " {" << tagName << "}";
-    }
-
+    writeStandardPrefix(ts, container, indent);
     ts << container << "\n";
-
-    for (RenderObject* child = container.firstChild(); child; child = child->nextSibling())
-        write(ts, *child, indent + 1);
+    writeChildren(ts, container, indent);
 }
 
 void write(TextStream& ts, const RenderSVGRoot& root, int indent)
 {
-    writeIndent(ts, indent);
-    ts << root.renderName();
-
-    if (root.node()) {
-        String tagName = getTagName(static_cast<SVGStyledElement*>(root.node()));
-        if (!tagName.isEmpty())
-            ts << " {" << tagName << "}";
-    }
-
+    writeStandardPrefix(ts, root, indent);
     ts << root << "\n";
-
-    for (RenderObject* child = root.firstChild(); child; child = child->nextSibling())
-        write(ts, *child, indent + 1);
+    writeChildren(ts, root, indent);
 }
 
 void write(TextStream& ts, const RenderSVGText& text, int indent)
 {
-    writeIndent(ts, indent);
-    ts << text.renderName();
-
-    if (text.node()) {
-        String tagName = getTagName(static_cast<SVGStyledElement*>(text.node()));
-        if (!tagName.isEmpty())
-            ts << " {" << tagName << "}";
-    }
-
+    writeStandardPrefix(ts, text, indent);
     ts << text << "\n";
-
-    for (RenderObject* child = text.firstChild(); child; child = child->nextSibling())
-        write(ts, *child, indent + 1);
+    writeChildren(ts, text, indent);
 }
 
 void write(TextStream& ts, const RenderSVGInlineText& text, int indent)
 {
-    writeIndent(ts, indent);
-    ts << text.renderName();
+    writeStandardPrefix(ts, text, indent);
 
-    if (text.node()) {
-        String tagName = getTagName(static_cast<SVGStyledElement*>(text.node()));
-        if (!tagName.isEmpty())
-            ts << " {" << tagName << "}";
-    }
-
-    IntRect linesBox = text.linesBoundingBox();
-
-    ts << " at (" << text.firstRunX() << "," << text.firstRunY() << ") size " << linesBox.width() << "x" << linesBox.height() << "\n";
+    // Why not just linesBoundingBox()?
+    ts << " " << FloatRect(text.firstRunOrigin(), text.linesBoundingBox().size()) << "\n";
     writeSVGInlineText(ts, text, indent);
 }
 
 void write(TextStream& ts, const RenderPath& path, int indent)
 {
-    writeIndent(ts, indent);
-    ts << path.renderName();
-
-    if (path.node()) {
-        String tagName = getTagName(static_cast<SVGStyledElement*>(path.node()));
-        if (!tagName.isEmpty())
-            ts << " {" << tagName << "}";
-    }
-
+    writeStandardPrefix(ts, path, indent);
     ts << path << "\n";
 }
 
+void write(TextStream& ts, const RenderSVGImage& image, int indent)
+{
+    writeStandardPrefix(ts, image, indent);
+    ts << image << "\n";
+}
+
 void writeRenderResources(TextStream& ts, Node* parent)
 {
     ASSERT(parent);
@@ -553,6 +534,7 @@
             continue;
 
         String elementId = svgElement->getAttribute(HTMLNames::idAttr);
+        // FIXME: These names are lies!
         if (resource->isPaintServer()) {
             RefPtr<SVGPaintServer> paintServer = WTF::static_pointer_cast<SVGPaintServer>(resource);
             ts << "KRenderingPaintServer {id=\"" << elementId << "\" " << *paintServer << "}" << "\n";
diff --git a/WebCore/rendering/SVGRenderTreeAsText.h b/WebCore/rendering/SVGRenderTreeAsText.h
index c4d832d..35c3d5c 100644
--- a/WebCore/rendering/SVGRenderTreeAsText.h
+++ b/WebCore/rendering/SVGRenderTreeAsText.h
@@ -45,13 +45,15 @@
     class RenderSVGInlineText;
     class RenderSVGRoot;
     class RenderSVGText; 
+    class RenderSVGImage;
 
 // functions used by the main RenderTreeAsText code
 void write(TextStream&, const RenderPath&, int indent = 0);
 void write(TextStream&, const RenderSVGContainer&, int indent = 0);
-void write(TextStream&, const RenderSVGInlineText&, int ident = 0);
+void write(TextStream&, const RenderSVGInlineText&, int indent = 0);
 void write(TextStream&, const RenderSVGRoot&, int indent = 0);
-void write(TextStream&, const RenderSVGText&, int ident = 0);
+void write(TextStream&, const RenderSVGText&, int indent = 0);
+void write(TextStream&, const RenderSVGImage&, int indent = 0);
 
 void writeRenderResources(TextStream&, Node* parent);
 
diff --git a/WebCore/rendering/SVGRootInlineBox.cpp b/WebCore/rendering/SVGRootInlineBox.cpp
index 88c7542..d92f54c 100644
--- a/WebCore/rendering/SVGRootInlineBox.cpp
+++ b/WebCore/rendering/SVGRootInlineBox.cpp
@@ -402,15 +402,9 @@
         m_savedInfo = m_paintInfo;
         m_paintInfo.context->save();
 
+        // FIXME: Why is this done here instead of in RenderSVGText?
         if (!flowBox->isRootInlineBox())
-            m_paintInfo.context->concatCTM(m_rootBox->renderer()->localTransform());
-
-        m_paintInfo.context->concatCTM(object->localTransform());
-
-        if (!flowBox->isRootInlineBox()) {
-            prepareToRenderSVGContent(object, m_paintInfo, m_boundingBox, m_filter, m_rootFilter);
-            m_paintInfo.rect = object->localTransform().inverse().mapRect(m_paintInfo.rect);
-        }
+            SVGRenderBase::prepareToRenderSVGContent(object, m_paintInfo, m_boundingBox, m_filter, m_rootFilter);
     }
 
     void chunkEndCallback(InlineBox* box)
@@ -429,7 +423,7 @@
 
         // Finalize text rendering 
         if (!flowBox->isRootInlineBox()) {
-            finishRenderSVGContent(object, m_paintInfo, m_boundingBox, m_filter, m_savedInfo.context);
+            SVGRenderBase::finishRenderSVGContent(object, m_paintInfo, m_filter, m_savedInfo.context);
             m_filter = 0;
         }
 
@@ -584,9 +578,7 @@
     FloatRect boundingBox(tx + x(), ty + y(), width(), height());
 
     // Initialize text rendering
-    paintInfo.context->concatCTM(renderer()->localTransform());
-    prepareToRenderSVGContent(renderer(), paintInfo, boundingBox, filter);
-    paintInfo.context->concatCTM(renderer()->localTransform().inverse());
+    SVGRenderBase::prepareToRenderSVGContent(renderer(), paintInfo, boundingBox, filter);
  
     // Render text, chunk-by-chunk
     SVGRootInlineBoxPaintWalker walkerCallback(this, filter, paintInfo, tx, ty);
@@ -600,7 +592,7 @@
     walkTextChunks(&walker);
 
     // Finalize text rendering 
-    finishRenderSVGContent(renderer(), paintInfo, boundingBox, filter, savedInfo.context);
+    SVGRenderBase::finishRenderSVGContent(renderer(), paintInfo, filter, savedInfo.context);
     paintInfo.context->restore();
 }
 
diff --git a/WebCore/rendering/SVGRootInlineBox.h b/WebCore/rendering/SVGRootInlineBox.h
index 10c43ea..735f755 100644
--- a/WebCore/rendering/SVGRootInlineBox.h
+++ b/WebCore/rendering/SVGRootInlineBox.h
@@ -53,7 +53,7 @@
 
     virtual bool isSVGRootInlineBox() { return true; }
 
-    virtual int height() const { return m_height; }
+    virtual int svgBoxHeight() const { return m_height; }
     void setHeight(int h) { m_height = h; }
     
     virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
diff --git a/WebCore/rendering/TransformState.cpp b/WebCore/rendering/TransformState.cpp
index 5021d1f..a9e68f4 100644
--- a/WebCore/rendering/TransformState.cpp
+++ b/WebCore/rendering/TransformState.cpp
@@ -28,7 +28,7 @@
 
 namespace WebCore {
 
-void TransformState::move(int x, int y, bool accumulateTransform)
+void TransformState::move(int x, int y, TransformAccumulation accumulate)
 {
     if (m_accumulatingTransform && m_accumulatedTransform) {
         // If we're accumulating into an existing transform, apply the translation.
@@ -38,7 +38,7 @@
             m_accumulatedTransform->translate(-x, -y);  // We're unapplying, so negate
         
         // Then flatten if necessary.
-        if (!accumulateTransform)
+        if (accumulate == FlattenTransform)
             flatten();
     } else {
         // Just move the point and, optionally, the quad.
@@ -46,10 +46,10 @@
         if (m_mapQuad)
             m_lastPlanarQuad.move(x, y);
     }
-    m_accumulatingTransform = accumulateTransform;
+    m_accumulatingTransform = accumulate == AccumulateTransform;
 }
 
-void TransformState::applyTransform(const TransformationMatrix& transformFromContainer, bool accumulateTransform)
+void TransformState::applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation accumulate)
 {
     // If we have an accumulated transform from last time, multiply in this transform
     if (m_accumulatedTransform) {
@@ -57,16 +57,16 @@
             m_accumulatedTransform->multiply(transformFromContainer);
         else
             m_accumulatedTransform->multLeft(transformFromContainer);
-    } else if (accumulateTransform) {
+    } else if (accumulate == AccumulateTransform) {
         // Make one if we started to accumulate
         m_accumulatedTransform.set(new TransformationMatrix(transformFromContainer));
     }
     
-    if (!accumulateTransform) {
+    if (accumulate == FlattenTransform) {
         const TransformationMatrix* finalTransform = m_accumulatedTransform ? m_accumulatedTransform.get() : &transformFromContainer;
         flattenWithTransform(*finalTransform);
     }
-    m_accumulatingTransform = accumulateTransform;
+    m_accumulatingTransform = accumulate == AccumulateTransform;
 }
 
 void TransformState::flatten()
@@ -123,28 +123,35 @@
 }
 
 // HitTestingTransformState methods
-void HitTestingTransformState::move(int x, int y)
+void HitTestingTransformState::translate(int x, int y, TransformAccumulation accumulate)
 {
-    if (m_accumulatingTransform)
-        flatten();
+    m_accumulatedTransform.translate(x, y);    
+    if (accumulate == FlattenTransform)
+        flattenWithTransform(m_accumulatedTransform);
 
-    m_lastPlanarPoint.move(x, y);
-    m_lastPlanarQuad.move(x, y);
+    m_accumulatingTransform = accumulate == AccumulateTransform;
 }
 
-void HitTestingTransformState::applyTransform(const TransformationMatrix& transformFromContainer, bool accumulateTransform)
+void HitTestingTransformState::applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation accumulate)
 {
     m_accumulatedTransform.multLeft(transformFromContainer);    
-    if (!accumulateTransform)
-        flatten();
+    if (accumulate == FlattenTransform)
+        flattenWithTransform(m_accumulatedTransform);
 
-    m_accumulatingTransform = accumulateTransform;
+    m_accumulatingTransform = accumulate == AccumulateTransform;
 }
 
 void HitTestingTransformState::flatten()
 {
-    m_lastPlanarPoint = mappedPoint();
-    m_lastPlanarQuad = mappedQuad();
+    flattenWithTransform(m_accumulatedTransform);
+}
+
+void HitTestingTransformState::flattenWithTransform(const TransformationMatrix& t)
+{
+    TransformationMatrix inverseTransform = t.inverse();
+    m_lastPlanarPoint = inverseTransform.projectPoint(m_lastPlanarPoint);
+    m_lastPlanarQuad = inverseTransform.projectQuad(m_lastPlanarQuad);
+
     m_accumulatedTransform.makeIdentity();
     m_accumulatingTransform = false;
 }
diff --git a/WebCore/rendering/TransformState.h b/WebCore/rendering/TransformState.h
index 5190118..92275f9 100644
--- a/WebCore/rendering/TransformState.h
+++ b/WebCore/rendering/TransformState.h
@@ -40,6 +40,8 @@
 class TransformState : Noncopyable {
 public:
     enum TransformDirection { ApplyTransformDirection, UnapplyInverseTransformDirection };
+    enum TransformAccumulation { FlattenTransform, AccumulateTransform };
+
     // If quad is non-null, it will be mapped
     TransformState(TransformDirection mappingDirection, const FloatPoint& p, const FloatQuad* quad = 0)
         : m_lastPlanarPoint(p)
@@ -51,13 +53,13 @@
             m_lastPlanarQuad = *quad;
     }
     
-    void move(const IntSize& s, bool accumulateTransform = false)
+    void move(const IntSize& s, TransformAccumulation accumulate = FlattenTransform)
     {
-        move(s.width(), s.height(), accumulateTransform);
+        move(s.width(), s.height(), accumulate);
     }
     
-    void move(int x, int y, bool accumulateTransform = false);
-    void applyTransform(const TransformationMatrix& transformFromContainer, bool accumulateTransform = false);
+    void move(int x, int y, TransformAccumulation = FlattenTransform);
+    void applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation = FlattenTransform);
     void flatten();
 
     // Return the coords of the point or quad in the last flattened layer
@@ -92,14 +94,11 @@
     {
         return adoptRef(new HitTestingTransformState(other));
     }
-    
-    void move(const IntSize& s)
-    {
-        move(s.width(), s.height());
-    }
-    
-    void move(int x, int y);
-    void applyTransform(const TransformationMatrix& transformFromContainer, bool accumulateTransform);
+
+    enum TransformAccumulation { FlattenTransform, AccumulateTransform };
+    void translate(int x, int y, TransformAccumulation);
+    void applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation);
+
     FloatPoint mappedPoint() const;
     FloatQuad mappedQuad() const;
     void flatten();
@@ -125,6 +124,8 @@
         , m_accumulatingTransform(other.m_accumulatingTransform)
     {
     }
+    
+    void flattenWithTransform(const TransformationMatrix&);
 };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/bidi.cpp b/WebCore/rendering/bidi.cpp
index bfb5291..1a47e78 100644
--- a/WebCore/rendering/bidi.cpp
+++ b/WebCore/rendering/bidi.cpp
@@ -560,26 +560,28 @@
         InlineBox* box = createInlineBoxForRenderer(r->m_object, false, isOnlyRun);
         r->m_box = box;
 
-        if (box) {
-            // If we have no parent box yet, or if the run is not simply a sibling,
-            // then we need to construct inline boxes as necessary to properly enclose the
-            // run's inline box.
-            if (!parentBox || parentBox->renderer() != r->m_object->parent())
-                // Create new inline boxes all the way back to the appropriate insertion point.
-                parentBox = createLineBoxes(r->m_object->parent(), firstLine);
+        ASSERT(box);
+        if (!box)
+            continue;
 
-            // Append the inline box to this line.
-            parentBox->addToLine(box);
+        // If we have no parent box yet, or if the run is not simply a sibling,
+        // then we need to construct inline boxes as necessary to properly enclose the
+        // run's inline box.
+        if (!parentBox || parentBox->renderer() != r->m_object->parent())
+            // Create new inline boxes all the way back to the appropriate insertion point.
+            parentBox = createLineBoxes(r->m_object->parent(), firstLine);
 
-            bool visuallyOrdered = r->m_object->style()->visuallyOrdered();
-            box->setBidiLevel(visuallyOrdered ? 0 : r->level());
+        // Append the inline box to this line.
+        parentBox->addToLine(box);
 
-            if (box->isInlineTextBox()) {
-                InlineTextBox* text = static_cast<InlineTextBox*>(box);
-                text->setStart(r->m_start);
-                text->setLen(r->m_stop - r->m_start);
-                text->m_dirOverride = r->dirOverride(visuallyOrdered);
-            }
+        bool visuallyOrdered = r->m_object->style()->visuallyOrdered();
+        box->setBidiLevel(visuallyOrdered ? 0 : r->level());
+
+        if (box->isInlineTextBox()) {
+            InlineTextBox* text = static_cast<InlineTextBox*>(box);
+            text->setStart(r->m_start);
+            text->setLen(r->m_stop - r->m_start);
+            text->m_dirOverride = r->dirOverride(visuallyOrdered);
         }
     }
 
@@ -631,7 +633,16 @@
                     totWidth += rt->style(firstLine)->font().wordSpacing();
                 needsWordSpacing = !isSpaceOrNewline(rt->characters()[r->m_stop - 1]) && r->m_stop == length;          
             }
-            r->m_box->setWidth(rt->width(r->m_start, r->m_stop - r->m_start, totWidth, firstLine));
+            HashSet<const SimpleFontData*> fallbackFonts;
+            r->m_box->setWidth(rt->width(r->m_start, r->m_stop - r->m_start, totWidth, firstLine, &fallbackFonts));
+            if (!fallbackFonts.isEmpty()
+#if ENABLE(SVG)
+                    && !isSVGText()
+#endif
+            ) {
+                ASSERT(r->m_box->isText());
+                static_cast<InlineTextBox*>(r->m_box)->setFallbackFonts(fallbackFonts);
+            }
         } else if (!r->m_object->isRenderInline()) {
             RenderBox* renderBox = toRenderBox(r->m_object);
             renderBox->calcWidth();
@@ -654,7 +665,7 @@
             // particular with RTL blocks, wide lines should still spill out to the left.
             if (style()->direction() == LTR) {
                 if (totWidth > availableWidth && trailingSpaceRun)
-                    trailingSpaceRun->m_box->setWidth(trailingSpaceRun->m_box->width() - totWidth + availableWidth);
+                    trailingSpaceRun->m_box->setWidth(max(0, trailingSpaceRun->m_box->width() - totWidth + availableWidth));
             } else {
                 if (trailingSpaceRun)
                     trailingSpaceRun->m_box->setWidth(0);
@@ -676,7 +687,7 @@
             // for right to left fall through to right aligned
             if (style()->direction() == LTR) {
                 if (totWidth > availableWidth && trailingSpaceRun)
-                    trailingSpaceRun->m_box->setWidth(trailingSpaceRun->m_box->width() - totWidth + availableWidth);
+                    trailingSpaceRun->m_box->setWidth(max(0, trailingSpaceRun->m_box->width() - totWidth + availableWidth));
                 break;
             }
         case RIGHT:
@@ -693,7 +704,7 @@
                     x += availableWidth - totWidth;
             } else {
                 if (totWidth > availableWidth && trailingSpaceRun) {
-                    trailingSpaceRun->m_box->setWidth(trailingSpaceRun->m_box->width() - totWidth + availableWidth);
+                    trailingSpaceRun->m_box->setWidth(max(0, trailingSpaceRun->m_box->width() - totWidth + availableWidth));
                     totWidth -= trailingSpaceRun->m_box->width();
                 } else
                     x += availableWidth - totWidth;
@@ -705,7 +716,7 @@
             if (trailingSpaceRun) {
                 totWidth -= trailingSpaceRun->m_box->width();
                 trailingSpaceWidth = min(trailingSpaceRun->m_box->width(), (availableWidth - totWidth + 1) / 2);
-                trailingSpaceRun->m_box->setWidth(trailingSpaceWidth);
+                trailingSpaceRun->m_box->setWidth(max(0, trailingSpaceWidth));
             }
             if (style()->direction() == LTR)
                 x += max((availableWidth - totWidth) / 2, 0);
@@ -765,6 +776,7 @@
 
     // Now make sure we place replaced render objects correctly.
     for (BidiRun* r = firstRun; r; r = r->next()) {
+        ASSERT(r->m_box);
         if (!r->m_box)
             continue; // Skip runs with no line boxes.
 
@@ -1040,7 +1052,8 @@
                 ASSERT(resolver.position() == end);
 
                 BidiRun* trailingSpaceRun = 0;
-                if (!previousLineBrokeCleanly && resolver.runCount() && resolver.logicallyLastRun()->m_object->style()->breakOnlyAfterWhiteSpace()) {
+                if (!previousLineBrokeCleanly && resolver.runCount() && resolver.logicallyLastRun()->m_object->style()->breakOnlyAfterWhiteSpace()
+                        && resolver.logicallyLastRun()->m_object->style()->autoWrap()) {
                     trailingSpaceRun = resolver.logicallyLastRun();
                     RenderObject* lastObject = trailingSpaceRun->m_object;
                     if (lastObject->isText()) {
@@ -1338,12 +1351,12 @@
     #endif
             ;
 
-        BidiContext* context = new BidiContext(ltr ? 0 : 1, ltr ? LeftToRight : RightToLeft, style()->unicodeBidi() == Override);
+        Direction direction = ltr ? LeftToRight : RightToLeft;
+        resolver.setLastStrongDir(direction);
+        resolver.setLastDir(direction);
+        resolver.setEorDir(direction);
+        resolver.setContext(BidiContext::create(ltr ? 0 : 1, direction, style()->unicodeBidi() == Override));
 
-        resolver.setLastStrongDir(context->dir());
-        resolver.setLastDir(context->dir());
-        resolver.setEorDir(context->dir());
-        resolver.setContext(context);
         startObj = bidiFirst(this, &resolver);
     }
 
@@ -2295,16 +2308,18 @@
     // Include the scrollbar for overflow blocks, which means we want to use "contentWidth()"
     bool ltr = style()->direction() == LTR;
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
-        int blockEdge = ltr ? rightOffset(curr->y(), curr == firstRootBox()) : leftOffset(curr->y(), curr == firstRootBox());
+        int blockRightEdge = rightOffset(curr->y(), curr == firstRootBox());
+        int blockLeftEdge = leftOffset(curr->y(), curr == firstRootBox());
         int lineBoxEdge = ltr ? curr->x() + curr->width() : curr->x();
-        if ((ltr && lineBoxEdge > blockEdge) || (!ltr && lineBoxEdge < blockEdge)) {
+        if ((ltr && lineBoxEdge > blockRightEdge) || (!ltr && lineBoxEdge < blockLeftEdge)) {
             // This line spills out of our box in the appropriate direction.  Now we need to see if the line
             // can be truncated.  In order for truncation to be possible, the line must have sufficient space to
             // accommodate our truncation string, and no replaced elements (images, tables) can overlap the ellipsis
             // space.
             int width = curr == firstRootBox() ? firstLineEllipsisWidth : ellipsisWidth;
+            int blockEdge = ltr ? blockRightEdge : blockLeftEdge;
             if (curr->canAccommodateEllipsis(ltr, blockEdge, lineBoxEdge, width))
-                curr->placeEllipsis(ellipsisStr, ltr, blockEdge, width);
+                curr->placeEllipsis(ellipsisStr, ltr, blockLeftEdge, blockRightEdge, width);
         }
     }
 }
diff --git a/WebCore/rendering/break_lines.cpp b/WebCore/rendering/break_lines.cpp
index 87029b9..0e81caa 100644
--- a/WebCore/rendering/break_lines.cpp
+++ b/WebCore/rendering/break_lines.cpp
@@ -72,7 +72,7 @@
     return ch > 0x7F && ch != noBreakSpace;
 }
 
-#ifdef BUILDING_ON_TIGER
+#if PLATFORM(MAC) && defined(BUILDING_ON_TIGER)
 static inline TextBreakLocatorRef lineBreakLocator()
 {
     TextBreakLocatorRef locator = 0;
@@ -83,7 +83,7 @@
 
 int nextBreakablePosition(const UChar* str, int pos, int len, bool treatNoBreakSpaceAsBreak)
 {
-#ifndef BUILDING_ON_TIGER
+#if !PLATFORM(MAC) || !defined(BUILDING_ON_TIGER)
     TextBreakIterator* breakIterator = 0;
 #endif
     int nextBreak = -1;
@@ -97,7 +97,7 @@
 
         if (needsLineBreakIterator(ch) || needsLineBreakIterator(lastCh)) {
             if (nextBreak < i && i) {
-#ifndef BUILDING_ON_TIGER
+#if !PLATFORM(MAC) || !defined(BUILDING_ON_TIGER)
                 if (!breakIterator)
                     breakIterator = lineBreakIterator(str, len);
                 if (breakIterator)
diff --git a/WebCore/rendering/style/RenderStyle.cpp b/WebCore/rendering/style/RenderStyle.cpp
index fe53d30..f3a2cd9 100644
--- a/WebCore/rendering/style/RenderStyle.cpp
+++ b/WebCore/rendering/style/RenderStyle.cpp
@@ -32,6 +32,8 @@
 #include <wtf/StdLibExtras.h>
 #include <algorithm>
 
+using namespace std;
+
 namespace WebCore {
 
 inline RenderStyle* defaultStyle()
@@ -56,14 +58,7 @@
 }
 
 RenderStyle::RenderStyle()
-    : box(defaultStyle()->box)
-    , visual(defaultStyle()->visual)
-    , background(defaultStyle()->background)
-    , surround(defaultStyle()->surround)
-    , rareNonInheritedData(defaultStyle()->rareNonInheritedData)
-    , rareInheritedData(defaultStyle()->rareInheritedData)
-    , inherited(defaultStyle()->inherited)
-    , m_pseudoState(PseudoUnknown)
+    : m_pseudoState(PseudoUnknown)
     , m_affectedByAttributeSelectors(false)
     , m_unique(false)
     , m_affectedByEmpty(false)
@@ -76,6 +71,13 @@
     , m_firstChildState(false)
     , m_lastChildState(false)
     , m_childIndex(0)
+    , box(defaultStyle()->box)
+    , visual(defaultStyle()->visual)
+    , background(defaultStyle()->background)
+    , surround(defaultStyle()->surround)
+    , rareNonInheritedData(defaultStyle()->rareNonInheritedData)
+    , rareInheritedData(defaultStyle()->rareInheritedData)
+    , inherited(defaultStyle()->inherited)
 #if ENABLE(SVG)
     , m_svgStyle(defaultStyle()->m_svgStyle)
 #endif
@@ -119,15 +121,6 @@
 
 RenderStyle::RenderStyle(const RenderStyle& o)
     : RefCounted<RenderStyle>()
-    , inherited_flags(o.inherited_flags)
-    , noninherited_flags(o.noninherited_flags)
-    , box(o.box)
-    , visual(o.visual)
-    , background(o.background)
-    , surround(o.surround)
-    , rareNonInheritedData(o.rareNonInheritedData)
-    , rareInheritedData(o.rareInheritedData)
-    , inherited(o.inherited)
     , m_pseudoState(o.m_pseudoState)
     , m_affectedByAttributeSelectors(false)
     , m_unique(false)
@@ -141,9 +134,18 @@
     , m_firstChildState(false)
     , m_lastChildState(false)
     , m_childIndex(0)
+    , box(o.box)
+    , visual(o.visual)
+    , background(o.background)
+    , surround(o.surround)
+    , rareNonInheritedData(o.rareNonInheritedData)
+    , rareInheritedData(o.rareInheritedData)
+    , inherited(o.inherited)
 #if ENABLE(SVG)
     , m_svgStyle(o.m_svgStyle)
 #endif
+    , inherited_flags(o.inherited_flags)
+    , noninherited_flags(o.noninherited_flags)
 {
 }
 
@@ -709,6 +711,58 @@
     rareData->m_boxShadow.set(shadowData);
 }
 
+void RenderStyle::getBorderRadiiForRect(const IntRect& r, IntSize& topLeft, IntSize& topRight, IntSize& bottomLeft, IntSize& bottomRight) const
+{
+    topLeft = surround->border.topLeft;
+    topRight = surround->border.topRight;
+    
+    bottomLeft = surround->border.bottomLeft;
+    bottomRight = surround->border.bottomRight;
+
+    // Constrain corner radii using CSS3 rules:
+    // http://www.w3.org/TR/css3-background/#the-border-radius
+    
+    float factor = 1;
+    unsigned radiiSum;
+
+    // top
+    radiiSum = static_cast<unsigned>(topLeft.width()) + static_cast<unsigned>(topRight.width()); // Casts to avoid integer overflow.
+    if (radiiSum > static_cast<unsigned>(r.width()))
+        factor = min(static_cast<float>(r.width()) / radiiSum, factor);
+
+    // bottom
+    radiiSum = static_cast<unsigned>(bottomLeft.width()) + static_cast<unsigned>(bottomRight.width());
+    if (radiiSum > static_cast<unsigned>(r.width()))
+        factor = min(static_cast<float>(r.width()) / radiiSum, factor);
+    
+    // left
+    radiiSum = static_cast<unsigned>(topLeft.height()) + static_cast<unsigned>(bottomLeft.height());
+    if (radiiSum > static_cast<unsigned>(r.height()))
+        factor = min(static_cast<float>(r.height()) / radiiSum, factor);
+    
+    // right
+    radiiSum = static_cast<unsigned>(topRight.height()) + static_cast<unsigned>(bottomRight.height());
+    if (radiiSum > static_cast<unsigned>(r.height()))
+        factor = min(static_cast<float>(r.height()) / radiiSum, factor);
+    
+    // Scale all radii by f if necessary.
+    if (factor < 1) {
+        // If either radius on a corner becomes zero, reset both radii on that corner.
+        topLeft.scale(factor);
+        if (!topLeft.width() || !topLeft.height())
+            topLeft = IntSize();
+        topRight.scale(factor);
+        if (!topRight.width() || !topRight.height())
+            topRight = IntSize();
+        bottomLeft.scale(factor);
+        if (!bottomLeft.width() || !bottomLeft.height())
+            bottomLeft = IntSize();
+        bottomRight.scale(factor);
+        if (!bottomRight.width() || !bottomRight.height())
+            bottomRight = IntSize();
+    }
+}
+
 const CounterDirectiveMap* RenderStyle::counterDirectives() const
 {
     return rareNonInheritedData->m_counterDirectives.get();
diff --git a/WebCore/rendering/style/RenderStyle.h b/WebCore/rendering/style/RenderStyle.h
index 32c0cf4..5062596 100644
--- a/WebCore/rendering/style/RenderStyle.h
+++ b/WebCore/rendering/style/RenderStyle.h
@@ -108,6 +108,45 @@
     friend class CSSStyleSelector;
 protected:
 
+    // The following bitfield is 32-bits long, which optimizes padding with the
+    // int refCount in the base class. Beware when adding more bits.
+    unsigned m_pseudoState : 3; // PseudoState
+    bool m_affectedByAttributeSelectors : 1;
+    bool m_unique : 1;
+
+    // Bits for dynamic child matching.
+    bool m_affectedByEmpty : 1;
+    bool m_emptyState : 1;
+
+    // We optimize for :first-child and :last-child.  The other positional child selectors like nth-child or
+    // *-child-of-type, we will just give up and re-evaluate whenever children change at all.
+    bool m_childrenAffectedByFirstChildRules : 1;
+    bool m_childrenAffectedByLastChildRules : 1;
+    bool m_childrenAffectedByDirectAdjacentRules : 1;
+    bool m_childrenAffectedByForwardPositionalRules : 1;
+    bool m_childrenAffectedByBackwardPositionalRules : 1;
+    bool m_firstChildState : 1;
+    bool m_lastChildState : 1;
+    unsigned m_childIndex : 18; // Plenty of bits to cache an index.
+
+    // non-inherited attributes
+    DataRef<StyleBoxData> box;
+    DataRef<StyleVisualData> visual;
+    DataRef<StyleBackgroundData> background;
+    DataRef<StyleSurroundData> surround;
+    DataRef<StyleRareNonInheritedData> rareNonInheritedData;
+
+    // inherited attributes
+    DataRef<StyleRareInheritedData> rareInheritedData;
+    DataRef<StyleInheritedData> inherited;
+
+    // list of associated pseudo styles
+    RefPtr<RenderStyle> m_cachedPseudoStyle;
+
+#if ENABLE(SVG)
+    DataRef<SVGRenderStyle> m_svgStyle;
+#endif
+
 // !START SYNC!: Keep this in sync with the copy constructor in RenderStyle.cpp
 
     // inherit
@@ -149,12 +188,14 @@
         bool _border_collapse : 1 ;
         unsigned _white_space : 3; // EWhiteSpace
         unsigned _box_direction : 1; // EBoxDirection (CSS3 box_direction property, flexible box layout module)
-
+        // 32 bits
+        
         // non CSS2 inherited
         bool _visuallyOrdered : 1;
-        bool _htmlHacks :1;
+        bool _htmlHacks : 1;
         bool _force_backgrounds_to_white : 1;
         unsigned _pointerEvents : 4; // EPointerEvents
+        // 39 bits
     } inherited_flags;
 
 // don't inherit
@@ -201,45 +242,9 @@
         bool _affectedByDrag : 1;
         unsigned _pseudoBits : 7;
         unsigned _unicodeBidi : 2; // EUnicodeBidi
+        // 48 bits
     } noninherited_flags;
 
-    // non-inherited attributes
-    DataRef<StyleBoxData> box;
-    DataRef<StyleVisualData> visual;
-    DataRef<StyleBackgroundData> background;
-    DataRef<StyleSurroundData> surround;
-    DataRef<StyleRareNonInheritedData> rareNonInheritedData;
-
-    // inherited attributes
-    DataRef<StyleRareInheritedData> rareInheritedData;
-    DataRef<StyleInheritedData> inherited;
-
-    // list of associated pseudo styles
-    RefPtr<RenderStyle> m_cachedPseudoStyle;
-
-    unsigned m_pseudoState : 3; // PseudoState
-    bool m_affectedByAttributeSelectors : 1;
-    bool m_unique : 1;
-
-    // Bits for dynamic child matching.
-    bool m_affectedByEmpty : 1;
-    bool m_emptyState : 1;
-
-    // We optimize for :first-child and :last-child.  The other positional child selectors like nth-child or
-    // *-child-of-type, we will just give up and re-evaluate whenever children change at all.
-    bool m_childrenAffectedByFirstChildRules : 1;
-    bool m_childrenAffectedByLastChildRules : 1;
-    bool m_childrenAffectedByDirectAdjacentRules : 1;
-    bool m_childrenAffectedByForwardPositionalRules : 1;
-    bool m_childrenAffectedByBackwardPositionalRules : 1;
-    bool m_firstChildState : 1;
-    bool m_lastChildState : 1;
-    unsigned m_childIndex : 18; // Plenty of bits to cache an index.
-
-#if ENABLE(SVG)
-    DataRef<SVGRenderStyle> m_svgStyle;
-#endif
-
 // !END SYNC!
 
 protected:
@@ -740,6 +745,10 @@
 
     void setBackgroundColor(const Color& v) { SET_VAR(background, m_color, v) }
 
+    void setBackgroundXPosition(Length l) { SET_VAR(background, m_background.m_xPosition, l) }
+    void setBackgroundYPosition(Length l) { SET_VAR(background, m_background.m_yPosition, l) }
+    void setBackgroundSize(LengthSize l) { SET_VAR(background, m_background.m_size, l) }
+    
     void setBorderImage(const NinePieceImage& b) { SET_VAR(surround, border.image, b) }
 
     void setBorderTopLeftRadius(const IntSize& s) { SET_VAR(surround, border.topLeft, s) }
@@ -754,6 +763,8 @@
         setBorderBottomLeftRadius(s);
         setBorderBottomRightRadius(s);
     }
+    
+    void getBorderRadiiForRect(const IntRect&, IntSize& topLeft, IntSize& topRight, IntSize& bottomLeft, IntSize& bottomRight) const;
 
     void setBorderLeftWidth(unsigned short v) { SET_VAR(surround, border.left.width, v) }
     void setBorderLeftStyle(EBorderStyle v) { SET_VAR(surround, border.left.m_style, v) }
@@ -847,6 +858,9 @@
     }
 
     void setMaskBoxImage(const NinePieceImage& b) { SET_VAR(rareNonInheritedData, m_maskBoxImage, b) }
+    void setMaskXPosition(Length l) { SET_VAR(rareNonInheritedData, m_mask.m_xPosition, l) }
+    void setMaskYPosition(Length l) { SET_VAR(rareNonInheritedData, m_mask.m_yPosition, l) }
+    void setMaskSize(LengthSize l) { SET_VAR(rareNonInheritedData, m_mask.m_size, l) }
 
     void setBorderCollapse(bool collapse) { inherited_flags._border_collapse = collapse; }
     void setHorizontalBorderSpacing(short v) { SET_VAR(inherited, horizontal_border_spacing, v) }
diff --git a/WebCore/rendering/style/StyleGeneratedImage.cpp b/WebCore/rendering/style/StyleGeneratedImage.cpp
index fa361e8..610e73d 100644
--- a/WebCore/rendering/style/StyleGeneratedImage.cpp
+++ b/WebCore/rendering/style/StyleGeneratedImage.cpp
@@ -34,11 +34,26 @@
     return m_generator;
 }
 
-IntSize StyleGeneratedImage::imageSize(const RenderObject* renderer, float /* multiplier */) const
+IntSize StyleGeneratedImage::imageSize(const RenderObject* renderer, float multiplier) const
 {
-    // We can ignore the multiplier, since we always store a raw zoomed size.
-    if (m_fixedSize)
-        return m_generator->fixedSize(renderer);
+    if (m_fixedSize) {
+        IntSize fixedSize = m_generator->fixedSize(renderer);
+        if (multiplier == 1.0f)
+            return fixedSize;
+
+        int width = fixedSize.width() * multiplier;
+        int height = fixedSize.height() * multiplier;
+
+        // Don't let images that have a width/height >= 1 shrink below 1 when zoomed.
+        if (fixedSize.width() > 0)
+            width = max(1, width);
+
+        if (fixedSize.height() > 0)
+            height = max(1, height);
+
+        return IntSize(width, height);
+    }
+    
     return m_containerSize;
 }
 
diff --git a/WebCore/storage/Database.cpp b/WebCore/storage/Database.cpp
index e59ddaf..53bccbe 100644
--- a/WebCore/storage/Database.cpp
+++ b/WebCore/storage/Database.cpp
@@ -367,6 +367,12 @@
     m_databaseAuthorizer->enable();
 }
 
+void Database::setAuthorizerReadOnly()
+{
+    ASSERT(m_databaseAuthorizer);
+    m_databaseAuthorizer->setReadOnly();
+}
+
 static int guidForOriginAndName(const String& origin, const String& name)
 {
     String stringID;
@@ -431,18 +437,23 @@
         }
     }
 
-
     String currentVersion;
     {
         MutexLocker locker(guidMutex());
-        currentVersion = guidToVersionMap().get(m_guid);
 
-        if (currentVersion.isNull())
-            LOG(StorageAPI, "Current cached version for guid %i is null", m_guid);
-        else
+        // Note: It is not safe to put an empty string into the guidToVersionMap() map.
+        // That's because the map is cross-thread, but empty strings are per-thread.
+        // The copy() function makes a version of the string you can use on the current
+        // thread, but we need a string we can keep in a cross-thread data structure.
+        // FIXME: This is a quite-awkward restriction to have to program with.
+
+        GuidVersionMap::iterator entry = guidToVersionMap().find(m_guid);
+        if (entry != guidToVersionMap().end()) {
+            // Map null string to empty string (see comment above).
+            currentVersion = entry->second.isNull() ? String("") : entry->second;
             LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
-
-        if (currentVersion.isNull()) {
+        } else {
+            LOG(StorageAPI, "No cached version for guid %i", m_guid);
             if (!getVersionFromDatabase(currentVersion)) {
                 LOG_ERROR("Failed to get current version from database %s", databaseDebugName().ascii().data());
                 e = INVALID_STATE_ERR;
@@ -457,11 +468,11 @@
                     e = INVALID_STATE_ERR;
                     return false;
                 }
-
                 currentVersion = m_expectedVersion;
             }
 
-            guidToVersionMap().set(m_guid, currentVersion.copy());
+            // Map empty string to null string (see comment above).
+            guidToVersionMap().set(m_guid, currentVersion.isEmpty() ? String() : currentVersion.copy());
         }
     }
 
diff --git a/WebCore/storage/Database.h b/WebCore/storage/Database.h
index 3eb303c..385485a 100644
--- a/WebCore/storage/Database.h
+++ b/WebCore/storage/Database.h
@@ -83,6 +83,7 @@
 
     void disableAuthorizer();
     void enableAuthorizer();
+    void setAuthorizerReadOnly();
 
     Vector<String> tableNames();
 
diff --git a/WebCore/storage/DatabaseAuthorizer.cpp b/WebCore/storage/DatabaseAuthorizer.cpp
index ca0a7f2..2d182ce 100644
--- a/WebCore/storage/DatabaseAuthorizer.cpp
+++ b/WebCore/storage/DatabaseAuthorizer.cpp
@@ -44,10 +44,14 @@
 {
     m_lastActionWasInsert = false;
     m_lastActionChangedDatabase = false;
+    m_readOnly = false;
 }
 
 int DatabaseAuthorizer::createTable(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -59,6 +63,9 @@
 
 int DatabaseAuthorizer::dropTable(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -69,12 +76,18 @@
 
 int DatabaseAuthorizer::allowAlterTable(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
 
 int DatabaseAuthorizer::createIndex(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -86,6 +99,9 @@
 
 int DatabaseAuthorizer::dropIndex(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -96,6 +112,9 @@
 
 int DatabaseAuthorizer::createTrigger(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -107,6 +126,9 @@
 
 int DatabaseAuthorizer::dropTrigger(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -117,22 +139,34 @@
 
 int DatabaseAuthorizer::createVTable(const String&, const String&)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
 }
 
 int DatabaseAuthorizer::dropVTable(const String&, const String&)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
 }
 
 int DatabaseAuthorizer::allowDelete(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
 int DatabaseAuthorizer::allowInsert(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     m_lastActionWasInsert = true;
     return denyBasedOnTableName(tableName);
@@ -140,6 +174,9 @@
 
 int DatabaseAuthorizer::allowUpdate(const String& tableName, const String&)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -192,6 +229,11 @@
     m_securityEnabled = true;
 }
 
+void DatabaseAuthorizer::setReadOnly()
+{
+    m_readOnly = true;
+}
+
 int DatabaseAuthorizer::denyBasedOnTableName(const String& tableName)
 {
     if (!m_securityEnabled)
diff --git a/WebCore/storage/DatabaseAuthorizer.h b/WebCore/storage/DatabaseAuthorizer.h
index 685bb97..e53ea50 100644
--- a/WebCore/storage/DatabaseAuthorizer.h
+++ b/WebCore/storage/DatabaseAuthorizer.h
@@ -85,6 +85,7 @@
 
     void disable();
     void enable();
+    void setReadOnly();
 
     void reset();
 
@@ -95,9 +96,10 @@
     DatabaseAuthorizer();
     int denyBasedOnTableName(const String&);
 
-    bool m_securityEnabled;
-    bool m_lastActionWasInsert;
-    bool m_lastActionChangedDatabase;
+    bool m_securityEnabled : 1;
+    bool m_lastActionWasInsert : 1;
+    bool m_lastActionChangedDatabase : 1;
+    bool m_readOnly : 1;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/LocalStorageArea.cpp b/WebCore/storage/LocalStorageArea.cpp
index e0900e6..bec0233 100644
--- a/WebCore/storage/LocalStorageArea.cpp
+++ b/WebCore/storage/LocalStorageArea.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,17 +27,16 @@
 #include "LocalStorageArea.h"
 
 #include "CString.h"
+#include "DOMWindow.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "FrameTree.h"
+#include "HTMLElement.h"
 #include "LocalStorage.h"
-#include "LocalStorageTask.h"
-#include "LocalStorageThread.h"
 #include "Page.h"
 #include "PageGroup.h"
-#include "PlatformString.h"
-#include "SecurityOrigin.h"
 #include "SQLiteStatement.h"
+#include "StorageEvent.h"
+#include "SuddenTermination.h"
 
 namespace WebCore {
 
@@ -68,7 +67,13 @@
 
 void LocalStorageArea::scheduleFinalSync()
 {
-    m_syncTimer.stop();
+    if (m_syncTimer.isActive())
+        m_syncTimer.stop();
+    else {
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
     syncTimerFired(&m_syncTimer);
     m_finalSyncScheduled = true;
 }
@@ -224,10 +229,8 @@
         }
     }
 
-    for (unsigned i = 0; i < frames.size(); ++i) {
-        if (HTMLElement* body = frames[i]->document()->body())
-            body->dispatchStorageEvent(eventNames().storageEvent, key, oldValue, newValue, sourceFrame);        
-    }
+    for (unsigned i = 0; i < frames.size(); ++i)
+        frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
 }
 
 void LocalStorageArea::scheduleItemForSync(const String& key, const String& value)
@@ -236,8 +239,13 @@
     ASSERT(!m_finalSyncScheduled);
 
     m_changedItems.set(key, value);
-    if (!m_syncTimer.isActive())
+    if (!m_syncTimer.isActive()) {
         m_syncTimer.startOneShot(LocalStorageSyncInterval);
+
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
 }
 
 void LocalStorageArea::scheduleClear()
@@ -247,8 +255,13 @@
 
     m_changedItems.clear();
     m_itemsCleared = true;
-    if (!m_syncTimer.isActive())
+    if (!m_syncTimer.isActive()) {
         m_syncTimer.startOneShot(LocalStorageSyncInterval);
+
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
 }
 
 void LocalStorageArea::syncTimerFired(Timer<LocalStorageArea>*)
@@ -272,10 +285,19 @@
 
         if (!m_syncScheduled) {
             m_syncScheduled = true;
+
+            // The following is balanced by the call to enableSuddenTermination in the
+            // performSync function.
+            disableSuddenTermination();
+
             m_localStorage->scheduleSync(this);
         }
     }
 
+    // The following is balanced by the calls to disableSuddenTermination in the
+    // scheduleItemForSync, scheduleClear, and scheduleFinalSync functions.
+    enableSuddenTermination();
+
     m_changedItems.clear();
 }
 
@@ -346,25 +368,15 @@
     m_importCondition.signal();
 }
 
-void LocalStorageArea::performSync()
+void LocalStorageArea::sync(bool clearItems, const HashMap<String, String>& items)
 {
     ASSERT(!isMainThread());
 
     if (!m_database.isOpen())
         return;
 
-    HashMap<String, String> items;
-    bool clearFirst = false;
-    {
-        MutexLocker locker(m_syncLock);
-        m_itemsPendingSync.swap(items);
-        clearFirst = m_clearItemsWhileSyncing;
-        m_clearItemsWhileSyncing = false;
-        m_syncScheduled = false;
-    }
-
-    // If the clear flag is marked, then we clear all items out before we write any new ones in
-    if (clearFirst) {
+    // If the clear flag is set, then we clear all items out before we write any new ones in.
+    if (clearItems) {
         SQLiteStatement clear(m_database, "DELETE FROM ItemTable");
         if (clear.prepare() != SQLResultOk) {
             LOG_ERROR("Failed to prepare clear statement - cannot write to local storage database");
@@ -390,10 +402,10 @@
         return;
     }
 
-    HashMap<String, String>::iterator end = items.end();
+    HashMap<String, String>::const_iterator end = items.end();
 
-    for (HashMap<String, String>::iterator it = items.begin(); it != end; ++it) {
-        // Based on the null-ness of the second argument, decide whether this is an insert or a delete
+    for (HashMap<String, String>::const_iterator it = items.begin(); it != end; ++it) {
+        // Based on the null-ness of the second argument, decide whether this is an insert or a delete.
         SQLiteStatement& query = it->second.isNull() ? remove : insert;        
 
         query.bindText(1, it->first);
@@ -412,4 +424,29 @@
     }
 }
 
+void LocalStorageArea::performSync()
+{
+    ASSERT(!isMainThread());
+
+    bool clearItems;
+    HashMap<String, String> items;
+    {
+        MutexLocker locker(m_syncLock);
+
+        ASSERT(m_syncScheduled);
+
+        clearItems = m_clearItemsWhileSyncing;
+        m_itemsPendingSync.swap(items);
+
+        m_clearItemsWhileSyncing = false;
+        m_syncScheduled = false;
+    }
+
+    sync(clearItems, items);
+
+    // The following is balanced by the call to disableSuddenTermination in the
+    // syncTimerFired function.
+    enableSuddenTermination();
+}
+
 } // namespace WebCore
diff --git a/WebCore/storage/LocalStorageArea.h b/WebCore/storage/LocalStorageArea.h
index c6e7015..f3c6dce 100644
--- a/WebCore/storage/LocalStorageArea.h
+++ b/WebCore/storage/LocalStorageArea.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,17 +26,11 @@
 #ifndef LocalStorageArea_h
 #define LocalStorageArea_h
 
-#include "LocalStorageTask.h"
-#include "LocalStorageThread.h"
-
 #include "SQLiteDatabase.h"
 #include "StorageArea.h"
 #include "StringHash.h"
 #include "Timer.h"
-
 #include <wtf/HashMap.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/Threading.h>
 
 namespace WebCore {
     
@@ -88,6 +82,7 @@
 
     private:
         void syncTimerFired(Timer<LocalStorageArea>*);
+        void sync(bool clearItems, const HashMap<String, String>& items);
 
         Mutex m_syncLock;
         HashMap<String, String> m_itemsPendingSync;
diff --git a/WebCore/storage/SQLStatement.cpp b/WebCore/storage/SQLStatement.cpp
index 9160c4e..38ca75d 100644
--- a/WebCore/storage/SQLStatement.cpp
+++ b/WebCore/storage/SQLStatement.cpp
@@ -44,16 +44,17 @@
 
 namespace WebCore {
 
-PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback)
+PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly)
 {
-    return adoptRef(new SQLStatement(statement, arguments, callback, errorCallback));
+    return adoptRef(new SQLStatement(statement, arguments, callback, errorCallback, readOnly));
 }
 
-SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback)
+SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly)
     : m_statement(statement.copy())
     , m_arguments(arguments)
     , m_statementCallback(callback)
     , m_statementErrorCallback(errorCallback)
+    , m_readOnly(readOnly)
 {
 }
    
@@ -69,6 +70,9 @@
     if (m_error)
         return false;
         
+    if (m_readOnly)
+        db->setAuthorizerReadOnly();
+    
     SQLiteDatabase* database = &db->m_sqliteDatabase;
     
     SQLiteStatement statement(*database, m_statement);
diff --git a/WebCore/storage/SQLStatement.h b/WebCore/storage/SQLStatement.h
index c299156..831aecc 100644
--- a/WebCore/storage/SQLStatement.h
+++ b/WebCore/storage/SQLStatement.h
@@ -51,7 +51,7 @@
 
 class SQLStatement : public ThreadSafeShared<SQLStatement> {
 public:
-    static PassRefPtr<SQLStatement> create(const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>);
+    static PassRefPtr<SQLStatement> create(const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, bool readOnly);
     
     bool execute(Database*);
     bool lastExecutionFailedDueToQuota() const;
@@ -66,7 +66,7 @@
     
     SQLError* sqlError() const { return m_error.get(); }
 private:
-    SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback);
+    SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly);
 
     void setFailureDueToQuota();
     void clearFailureDueToQuota();
@@ -78,6 +78,8 @@
     
     RefPtr<SQLError> m_error;
     RefPtr<SQLResultSet> m_resultSet;
+    
+    bool m_readOnly;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/SQLTransaction.cpp b/WebCore/storage/SQLTransaction.cpp
index aa22d11..3331e6e 100644
--- a/WebCore/storage/SQLTransaction.cpp
+++ b/WebCore/storage/SQLTransaction.cpp
@@ -43,6 +43,7 @@
 #include "Page.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
+#include "Settings.h"
 #include "SQLError.h"
 #include "SQLiteTransaction.h"
 #include "SQLResultSet.h"
@@ -74,7 +75,6 @@
     , m_successCallback(successCallback)
     , m_errorCallback(errorCallback)
     , m_shouldRetryCurrentStatement(false)
-    , m_shouldCommitAfterErrorCallback(true)
     , m_modifiedDatabase(false)
 {
     ASSERT(m_database);
@@ -90,15 +90,20 @@
         e = INVALID_STATE_ERR;
         return;
     }
+
+    bool readOnlyMode = false;
+    Page* page = m_database->document()->page();
+    if (!page || page->settings()->privateBrowsingEnabled())
+        readOnlyMode = true;
     
-    RefPtr<SQLStatement> statement = SQLStatement::create(sqlStatement.copy(), arguments, callback, callbackError);
+    RefPtr<SQLStatement> statement = SQLStatement::create(sqlStatement, arguments, callback, callbackError, readOnlyMode);
 
     if (m_database->deleted())
         statement->setDatabaseDeletedError();
 
     if (!m_database->versionMatchesExpected())
         statement->setVersionMismatchedError();
-        
+
     enqueueStatement(statement);
 }
 
@@ -424,7 +429,6 @@
 
     // If the commit failed, the transaction will still be marked as "in progress"
     if (m_sqliteTransaction->inProgress()) {
-        m_shouldCommitAfterErrorCallback = false;
         m_transactionError = SQLError::create(0, "failed to commit the transaction");
         handleTransactionError(false);
         return;
@@ -485,8 +489,8 @@
         return;
     }
     
-    // Transaction Step 12 - If the callback couldn't be called, then rollback the transaction.
-    m_shouldCommitAfterErrorCallback = false;
+    // No error callback, so fast-forward to:
+    // Transaction Step 12 - Rollback the transaction.
     if (inCallback) {
         m_nextStep = &SQLTransaction::cleanupAfterTransactionErrorCallback;
         LOG(StorageAPI, "Scheduling cleanupAfterTransactionErrorCallback for transaction %p\n", this);
@@ -500,10 +504,10 @@
 {
     ASSERT(m_transactionError);
     
-    // Transaction Step 12 - If the callback didn't return false, then rollback the transaction.
-    // This includes the callback not existing, returning true, or throwing an exception
-    if (!m_errorCallback || m_errorCallback->handleEvent(m_transactionError.get()))
-        m_shouldCommitAfterErrorCallback = false;
+    // Transaction Step 12 - If exists, invoke error callback with the last
+    // error to have occurred in this transaction.
+    if (m_errorCallback)
+        m_errorCallback->handleEvent(m_transactionError.get());
 
     m_nextStep = &SQLTransaction::cleanupAfterTransactionErrorCallback;
     LOG(StorageAPI, "Scheduling cleanupAfterTransactionErrorCallback for transaction %p\n", this);
@@ -514,19 +518,8 @@
 {
     m_database->m_databaseAuthorizer->disable();
     if (m_sqliteTransaction) {
-        // Transaction Step 12 -If the error callback returned false, and the last error wasn't itself a 
-        // failure when committing the transaction, then try to commit the transaction
-        if (m_shouldCommitAfterErrorCallback)
-            m_sqliteTransaction->commit();
-        
-        if (m_sqliteTransaction->inProgress()) {
-            // Transaction Step 12 - If that fails, or if the callback couldn't be called 
-            // or if it didn't return false, then rollback the transaction.
-            m_sqliteTransaction->rollback();
-        } else if (m_modifiedDatabase) {
-            // But if the commit was successful, notify the delegates if the transaction modified this database
-            DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(m_database->m_securityOrigin.get(), m_database->m_name);
-        }
+        // Transaction Step 12 - Rollback the transaction.
+        m_sqliteTransaction->rollback();
         
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
         m_sqliteTransaction.clear();
diff --git a/WebCore/storage/SQLTransaction.h b/WebCore/storage/SQLTransaction.h
index e269495..e77c183 100644
--- a/WebCore/storage/SQLTransaction.h
+++ b/WebCore/storage/SQLTransaction.h
@@ -119,7 +119,6 @@
     RefPtr<SQLTransactionErrorCallback> m_errorCallback;
     RefPtr<SQLError> m_transactionError;
     bool m_shouldRetryCurrentStatement;
-    bool m_shouldCommitAfterErrorCallback;
     bool m_modifiedDatabase;
     
     Mutex m_statementMutex;
diff --git a/WebCore/storage/SQLTransactionErrorCallback.h b/WebCore/storage/SQLTransactionErrorCallback.h
index b44255f..9dd3fd3 100644
--- a/WebCore/storage/SQLTransactionErrorCallback.h
+++ b/WebCore/storage/SQLTransactionErrorCallback.h
@@ -40,7 +40,7 @@
     class SQLTransactionErrorCallback : public ThreadSafeShared<SQLTransactionErrorCallback> {
     public:
         virtual ~SQLTransactionErrorCallback() { }
-        virtual bool handleEvent(SQLError*) = 0;
+        virtual void handleEvent(SQLError*) = 0;
     };
     
 }
diff --git a/WebCore/storage/SessionStorageArea.cpp b/WebCore/storage/SessionStorageArea.cpp
index 285922e..60c9501 100644
--- a/WebCore/storage/SessionStorageArea.cpp
+++ b/WebCore/storage/SessionStorageArea.cpp
@@ -26,12 +26,15 @@
 #include "config.h"
 #include "SessionStorageArea.h"
 
+#include "DOMWindow.h"
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameTree.h"
+#include "HTMLElement.h"
 #include "Page.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
+#include "StorageEvent.h"
 #include "StorageMap.h"
 
 namespace WebCore {
@@ -78,11 +81,9 @@
         if (frame->document()->securityOrigin()->equal(securityOrigin()))
             frames.append(frame);
     }
-        
-    for (unsigned i = 0; i < frames.size(); ++i) {
-        if (HTMLElement* body = frames[i]->document()->body())
-            body->dispatchStorageEvent(eventNames().storageEvent, key, oldValue, newValue, sourceFrame);        
-    }
+
+    for (unsigned i = 0; i < frames.size(); ++i)
+        frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
 }
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageArea.cpp b/WebCore/storage/StorageArea.cpp
index 78b25c1..27f9612 100644
--- a/WebCore/storage/StorageArea.cpp
+++ b/WebCore/storage/StorageArea.cpp
@@ -28,7 +28,10 @@
 
 #include "CString.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
+#include "Page.h"
 #include "SecurityOrigin.h"
+#include "Settings.h"
 #include "StorageMap.h"
 
 namespace WebCore {
@@ -71,14 +74,19 @@
     return m_storageMap->getItem(key);
 }
 
-void StorageArea::internalSetItem(const String& key, const String& value, ExceptionCode&, Frame* frame)
+void StorageArea::internalSetItem(const String& key, const String& value, ExceptionCode& ec, Frame* frame)
 {
     ASSERT(!value.isNull());
     
+    if (frame->page()->settings()->privateBrowsingEnabled()) {
+        ec = QUOTA_EXCEEDED_ERR;
+        return;
+    }
+
     // FIXME: For LocalStorage where a disk quota will be enforced, here is where we need to do quota checking.
     //        If we decide to enforce a memory quota for SessionStorage, this is where we'd do that, also.
     // if (<over quota>) {
-    //     ec = INVALID_ACCESS_ERR;
+    //     ec = QUOTA_EXCEEDED_ERR;
     //     return;
     // }
     
@@ -94,7 +102,10 @@
 }
 
 void StorageArea::internalRemoveItem(const String& key, Frame* frame)
-{   
+{
+    if (frame->page()->settings()->privateBrowsingEnabled())
+        return;
+
     String oldValue;
     RefPtr<StorageMap> newMap = m_storageMap->removeItem(key, oldValue);
     if (newMap)
@@ -107,6 +118,9 @@
 
 void StorageArea::internalClear(Frame* frame)
 {
+    if (frame->page()->settings()->privateBrowsingEnabled())
+        return;
+    
     m_storageMap = StorageMap::create();
     
     areaCleared(frame);
diff --git a/WebCore/storage/StorageEvent.cpp b/WebCore/storage/StorageEvent.cpp
index 54fd9ad..851abb1 100644
--- a/WebCore/storage/StorageEvent.cpp
+++ b/WebCore/storage/StorageEvent.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,20 +27,22 @@
 #include "StorageEvent.h"
 
 #include "DOMWindow.h"
+#include "Storage.h"
 
 namespace WebCore {
 
-StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source)
+StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
     : Event(type, false, true)
     , m_key(key)
     , m_oldValue(oldValue)
     , m_newValue(newValue)
     , m_uri(uri)
     , m_source(source)
+    , m_storageArea(storageArea)
 {
 }
 
-void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source)
+void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
 {
     if (dispatched())
         return;
@@ -52,6 +54,7 @@
     m_newValue = newValue;
     m_uri = uri;
     m_source = source;
+    m_storageArea = storageArea;
 }
 
-}
+} // namespace WebCore
diff --git a/WebCore/storage/StorageEvent.h b/WebCore/storage/StorageEvent.h
index 1cd87c6..3795518 100644
--- a/WebCore/storage/StorageEvent.h
+++ b/WebCore/storage/StorageEvent.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,7 @@
 #define StorageEvent_h
 
 #include "Event.h"
+#include "Storage.h"
 
 namespace WebCore {
 
@@ -38,9 +39,9 @@
         {
             return adoptRef(new StorageEvent);
         }
-        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source)
+        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
         {
-            return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, source));
+            return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, source, storageArea));
         }
 
         const String& key() const { return m_key; }
@@ -48,23 +49,25 @@
         const String& newValue() const { return m_newValue; }
         const String& uri() const { return m_uri; }
         DOMWindow* source() const { return m_source.get(); }
-        
-        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source);
-        
+        Storage* storageArea() const { return m_storageArea.get(); }
+
+        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg,  Storage storageAreaArg);
 
         virtual bool isStorageEvent() const { return true; }
-        
+
     private:    
         StorageEvent() { }
-        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source);
+        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
         
         String m_key;
         String m_oldValue;
         String m_newValue;
         String m_uri;
         RefPtr<DOMWindow> m_source;
+        RefPtr<Storage> m_storageArea;        
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageEvent.idl b/WebCore/storage/StorageEvent.idl
index 47ef67d..fe82cf8 100644
--- a/WebCore/storage/StorageEvent.idl
+++ b/WebCore/storage/StorageEvent.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,10 +33,11 @@
         readonly attribute [ConvertNullStringTo=Null] DOMString newValue;
         readonly attribute DOMString uri;
         readonly attribute DOMWindow source;
-        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg);
+        readonly attribute Storage storageArea;
+        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
 
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
     };
 
 }
diff --git a/WebCore/svg/Filter.cpp b/WebCore/svg/Filter.cpp
deleted file mode 100644
index 24a9fb8..0000000
--- a/WebCore/svg/Filter.cpp
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
-    Copyright (C) 2008 Alex Mathews <possessedpenguinbob@gmail.com>
-    
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "Filter.h"
-
-namespace WebCore {
-
-Filter::Filter(FilterEffect* effect)
-    : m_effect(effect)
-{
-}
-
-PassRefPtr<Filter> Filter::create(FilterEffect* effect)
-{ 
-    return adoptRef(new Filter(effect));
-}
-
-} //namespace WebCore
-
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
diff --git a/WebCore/svg/FilterEffect.h b/WebCore/svg/FilterEffect.h
deleted file mode 100644
index 8f53ae1..0000000
--- a/WebCore/svg/FilterEffect.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
-    Copyright (C) 2008 Alex Mathews <possessedpenguinbob@gmail.com>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef FilterEffect_h
-#define FilterEffect_h
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "TextStream.h"
-
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
-
-namespace WebCore {
-
-    class FilterEffect : public RefCounted<FilterEffect> {
-    public:
-        virtual ~FilterEffect();
-        
-        virtual void apply() = 0;
-        virtual void dump() = 0;
-        
-        virtual TextStream& externalRepresentation(TextStream&) const;
-    protected:
-        FilterEffect();
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#endif // FilterEffect_h
diff --git a/WebCore/svg/SVGAElement.cpp b/WebCore/svg/SVGAElement.cpp
index c7e055c..6fd0274 100644
--- a/WebCore/svg/SVGAElement.cpp
+++ b/WebCore/svg/SVGAElement.cpp
@@ -34,13 +34,14 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "PlatformMouseEvent.h"
-#include "RenderSVGTransformableContainer.h"
 #include "RenderSVGInline.h"
+#include "RenderSVGTransformableContainer.h"
 #include "ResourceRequest.h"
-#include "SVGSMILElement.h"
 #include "SVGNames.h"
+#include "SVGSMILElement.h"
 #include "XLinkNames.h"
 
 namespace WebCore {
@@ -92,7 +93,7 @@
         setIsLink(!href().isNull());
 
         if (wasLink != isLink())
-            setChanged();
+            setNeedsStyleRecalc();
     }
 }
 
diff --git a/WebCore/svg/SVGAnimateMotionElement.cpp b/WebCore/svg/SVGAnimateMotionElement.cpp
index 861f353..44bf5fb 100644
--- a/WebCore/svg/SVGAnimateMotionElement.cpp
+++ b/WebCore/svg/SVGAnimateMotionElement.cpp
@@ -22,9 +22,11 @@
 */
 
 #include "config.h"
+
 #if ENABLE(SVG) && ENABLE(SVG_ANIMATION)
 #include "SVGAnimateMotionElement.h"
 
+#include "MappedAttribute.h"
 #include "RenderObject.h"
 #include "SVGElementInstance.h"
 #include "SVGMPathElement.h"
diff --git a/WebCore/svg/SVGAnimateTransformElement.cpp b/WebCore/svg/SVGAnimateTransformElement.cpp
index 99e4c42..3ebba06 100644
--- a/WebCore/svg/SVGAnimateTransformElement.cpp
+++ b/WebCore/svg/SVGAnimateTransformElement.cpp
@@ -23,10 +23,11 @@
 */
 
 #include "config.h"
+
 #if ENABLE(SVG) && ENABLE(SVG_ANIMATION)
 #include "SVGAnimateTransformElement.h"
 
-#include "TransformationMatrix.h"
+#include "MappedAttribute.h"
 #include "RenderObject.h"
 #include "SVGAngle.h"
 #include "SVGElementInstance.h"
@@ -37,7 +38,7 @@
 #include "SVGTransform.h"
 #include "SVGTransformList.h"
 #include "SVGUseElement.h"
-
+#include "TransformationMatrix.h"
 #include <math.h>
 #include <wtf/MathExtras.h>
 
diff --git a/WebCore/svg/SVGAnimatedProperty.h b/WebCore/svg/SVGAnimatedProperty.h
index e7439a4..725711d 100644
--- a/WebCore/svg/SVGAnimatedProperty.h
+++ b/WebCore/svg/SVGAnimatedProperty.h
@@ -430,7 +430,7 @@
     {
         AtomicString value(SVGAnimatedTypeValue<DecoratedType>::toString(baseValue));
 
-        NamedAttrMap* namedAttrMap = ownerElement->attributes(false); 
+        NamedNodeMap* namedAttrMap = ownerElement->attributes(false); 
         Attribute* old = namedAttrMap->getAttributeItem(attributeName);
         if (old && value.isNull()) 
             namedAttrMap->removeAttribute(old->name()); 
diff --git a/WebCore/svg/SVGAnimationElement.cpp b/WebCore/svg/SVGAnimationElement.cpp
index 649b74d..b817ad8 100644
--- a/WebCore/svg/SVGAnimationElement.cpp
+++ b/WebCore/svg/SVGAnimationElement.cpp
@@ -23,6 +23,7 @@
 */
 
 #include "config.h"
+
 #if ENABLE(SVG_ANIMATION)
 #include "SVGAnimationElement.h"
 
@@ -34,6 +35,7 @@
 #include "EventListener.h"
 #include "FloatConversion.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "SVGElementInstance.h"
 #include "SVGNames.h"
 #include "SVGURIReference.h"
@@ -321,7 +323,7 @@
             shadowTreeElement->style()->setProperty(attributeName, value, "", ec);
         else
             shadowTreeElement->setAttribute(attributeName, value, ec);
-        (*it)->correspondingUseElement()->setChanged();
+        (*it)->correspondingUseElement()->setNeedsStyleRecalc();
     }
 }
     
diff --git a/WebCore/svg/SVGCircleElement.cpp b/WebCore/svg/SVGCircleElement.cpp
index 8817506..0c48f51 100644
--- a/WebCore/svg/SVGCircleElement.cpp
+++ b/WebCore/svg/SVGCircleElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGCircleElement.h"
 
 #include "FloatPoint.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
diff --git a/WebCore/svg/SVGClipPathElement.cpp b/WebCore/svg/SVGClipPathElement.cpp
index a41bb45..691e4d5 100644
--- a/WebCore/svg/SVGClipPathElement.cpp
+++ b/WebCore/svg/SVGClipPathElement.cpp
@@ -27,6 +27,7 @@
 
 #include "CSSStyleSelector.h"
 #include "Document.h"
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 #include "SVGTransformList.h"
 #include "SVGUnitTypes.h"
diff --git a/WebCore/svg/SVGComponentTransferFunctionElement.cpp b/WebCore/svg/SVGComponentTransferFunctionElement.cpp
index f2be038..e479fae 100644
--- a/WebCore/svg/SVGComponentTransferFunctionElement.cpp
+++ b/WebCore/svg/SVGComponentTransferFunctionElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGComponentTransferFunctionElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGFEComponentTransferElement.h"
 #include "SVGNames.h"
 #include "SVGNumberList.h"
diff --git a/WebCore/svg/SVGComponentTransferFunctionElement.h b/WebCore/svg/SVGComponentTransferFunctionElement.h
index 5e20e37f..82d57b4 100644
--- a/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGComponentTransferFunctionElement_h
 #define SVGComponentTransferFunctionElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
 #include "SVGNumberList.h"
 #include "FEComponentTransfer.h"
@@ -53,5 +53,5 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 #endif
diff --git a/WebCore/svg/SVGComponentTransferFunctionElement.idl b/WebCore/svg/SVGComponentTransferFunctionElement.idl
index a479aa2..0868175 100644
--- a/WebCore/svg/SVGComponentTransferFunctionElement.idl
+++ b/WebCore/svg/SVGComponentTransferFunctionElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGComponentTransferFunctionElement : SVGElement {
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGComponentTransferFunctionElement : SVGElement {
         // Component Transfer Types
         const unsigned short SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN  = 0;
         const unsigned short SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY = 1;
diff --git a/WebCore/svg/SVGCursorElement.cpp b/WebCore/svg/SVGCursorElement.cpp
index 8ff9735..12e9e5d 100644
--- a/WebCore/svg/SVGCursorElement.cpp
+++ b/WebCore/svg/SVGCursorElement.cpp
@@ -27,8 +27,9 @@
 
 #include "Attr.h"
 #include "Document.h"
-#include "SVGNames.h"
+#include "MappedAttribute.h"
 #include "SVGLength.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
@@ -91,7 +92,7 @@
         HashSet<SVGElement*>::const_iterator end = m_clients.end();
 
         for (; it != end; ++it)
-            (*it)->setChanged();
+            (*it)->setNeedsStyleRecalc();
     }
 }
 
diff --git a/WebCore/svg/SVGElement.cpp b/WebCore/svg/SVGElement.cpp
index 7f54dd0..3a7d3d4 100644
--- a/WebCore/svg/SVGElement.cpp
+++ b/WebCore/svg/SVGElement.cpp
@@ -33,7 +33,7 @@
 #include "EventNames.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
-#include "PlatformString.h"
+#include "MappedAttribute.h"
 #include "RegisteredEventListener.h"
 #include "RenderObject.h"
 #include "SVGCursorElement.h"
@@ -44,6 +44,7 @@
 #include "SVGSVGElement.h"
 #include "SVGURIReference.h"
 #include "SVGUseElement.h"
+#include "ScriptEventListener.h"
 #include "XMLNames.h"
 
 namespace WebCore {
@@ -150,25 +151,25 @@
 {
     // standard events
     if (attr->name() == onloadAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onclickAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().clickEvent, attr);
+        setAttributeEventListener(eventNames().clickEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onmousedownAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousedownEvent, attr);
+        setAttributeEventListener(eventNames().mousedownEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onmousemoveAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousemoveEvent, attr);
+        setAttributeEventListener(eventNames().mousemoveEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onmouseoutAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseoutEvent, attr);
+        setAttributeEventListener(eventNames().mouseoutEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onmouseoverAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseoverEvent, attr);
+        setAttributeEventListener(eventNames().mouseoverEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onmouseupAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseupEvent, attr);
+        setAttributeEventListener(eventNames().mouseupEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == SVGNames::onfocusinAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().DOMFocusInEvent, attr);
+        setAttributeEventListener(eventNames().DOMFocusInEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == SVGNames::onfocusoutAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().DOMFocusOutEvent, attr);
+        setAttributeEventListener(eventNames().DOMFocusOutEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == SVGNames::onactivateAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().DOMActivateEvent, attr);
+        setAttributeEventListener(eventNames().DOMActivateEvent, createAttributeEventListener(this, attr));
     else
         StyledElement::parseMappedAttribute(attr);
 }
diff --git a/WebCore/svg/SVGElementInstance.cpp b/WebCore/svg/SVGElementInstance.cpp
index b5fa984..7cc1798 100644
--- a/WebCore/svg/SVGElementInstance.cpp
+++ b/WebCore/svg/SVGElementInstance.cpp
@@ -130,7 +130,7 @@
     m_needsUpdate = value;
 
     if (m_needsUpdate)
-        correspondingUseElement()->setChanged();
+        correspondingUseElement()->setNeedsStyleRecalc();
 }
 
 ScriptExecutionContext* SVGElementInstance::scriptExecutionContext() const
@@ -174,402 +174,402 @@
 
 EventListener* SVGElementInstance::onabort() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().abortEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().abortEvent);
 }
 
 void SVGElementInstance::setOnabort(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().abortEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().abortEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onblur() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().blurEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().blurEvent);
 }
 
 void SVGElementInstance::setOnblur(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().blurEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().blurEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onchange() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().changeEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().changeEvent);
 }
 
 void SVGElementInstance::setOnchange(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().changeEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().changeEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onclick() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().clickEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().clickEvent);
 }
 
 void SVGElementInstance::setOnclick(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().clickEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().clickEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::oncontextmenu() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().contextmenuEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().contextmenuEvent);
 }
 
 void SVGElementInstance::setOncontextmenu(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().contextmenuEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondblclick() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dblclickEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dblclickEvent);
 }
 
 void SVGElementInstance::setOndblclick(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dblclickEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dblclickEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onerror() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().errorEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().errorEvent);
 }
 
 void SVGElementInstance::setOnerror(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().errorEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().errorEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onfocus() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().focusEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().focusEvent);
 }
 
 void SVGElementInstance::setOnfocus(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().focusEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().focusEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::oninput() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().inputEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().inputEvent);
 }
 
 void SVGElementInstance::setOninput(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().inputEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().inputEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onkeydown() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().keydownEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().keydownEvent);
 }
 
 void SVGElementInstance::setOnkeydown(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().keydownEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().keydownEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onkeypress() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().keypressEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().keypressEvent);
 }
 
 void SVGElementInstance::setOnkeypress(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().keypressEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().keypressEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onkeyup() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().keyupEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().keyupEvent);
 }
 
 void SVGElementInstance::setOnkeyup(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().keyupEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().keyupEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onload() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().loadEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().loadEvent);
 }
 
 void SVGElementInstance::setOnload(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().loadEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().loadEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmousedown() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mousedownEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mousedownEvent);
 }
 
 void SVGElementInstance::setOnmousedown(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mousedownEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mousedownEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmousemove() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mousemoveEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mousemoveEvent);
 }
 
 void SVGElementInstance::setOnmousemove(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mousemoveEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmouseout() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mouseoutEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mouseoutEvent);
 }
 
 void SVGElementInstance::setOnmouseout(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mouseoutEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmouseover() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mouseoverEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mouseoverEvent);
 }
 
 void SVGElementInstance::setOnmouseover(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mouseoverEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmouseup() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mouseupEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mouseupEvent);
 }
 
 void SVGElementInstance::setOnmouseup(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mouseupEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mouseupEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onmousewheel() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().mousewheelEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().mousewheelEvent);
 }
 
 void SVGElementInstance::setOnmousewheel(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().mousewheelEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onbeforecut() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().beforecutEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().beforecutEvent);
 }
 
 void SVGElementInstance::setOnbeforecut(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().beforecutEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().beforecutEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::oncut() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().cutEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().cutEvent);
 }
 
 void SVGElementInstance::setOncut(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().cutEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().cutEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onbeforecopy() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().beforecopyEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().beforecopyEvent);
 }
 
 void SVGElementInstance::setOnbeforecopy(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().beforecopyEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().beforecopyEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::oncopy() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().copyEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().copyEvent);
 }
 
 void SVGElementInstance::setOncopy(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().copyEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().copyEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onbeforepaste() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().beforepasteEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().beforepasteEvent);
 }
 
 void SVGElementInstance::setOnbeforepaste(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().beforepasteEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().beforepasteEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onpaste() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().pasteEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().pasteEvent);
 }
 
 void SVGElementInstance::setOnpaste(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().pasteEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().pasteEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondragenter() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragenterEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragenterEvent);
 }
 
 void SVGElementInstance::setOndragenter(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragenterEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragenterEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondragover() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragoverEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragoverEvent);
 }
 
 void SVGElementInstance::setOndragover(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragoverEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragoverEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondragleave() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragleaveEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragleaveEvent);
 }
 
 void SVGElementInstance::setOndragleave(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragleaveEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondrop() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dropEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dropEvent);
 }
 
 void SVGElementInstance::setOndrop(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dropEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dropEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondragstart() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragstartEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragstartEvent);
 }
 
 void SVGElementInstance::setOndragstart(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragstartEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragstartEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondrag() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragEvent);
 }
 
 void SVGElementInstance::setOndrag(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::ondragend() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().dragendEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().dragendEvent);
 }
 
 void SVGElementInstance::setOndragend(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().dragendEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().dragendEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onreset() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().resetEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().resetEvent);
 }
 
 void SVGElementInstance::setOnreset(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().resetEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().resetEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onresize() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().resizeEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().resizeEvent);
 }
 
 void SVGElementInstance::setOnresize(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().resizeEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onscroll() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().scrollEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().scrollEvent);
 }
 
 void SVGElementInstance::setOnscroll(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().scrollEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().scrollEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onsearch() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().searchEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().searchEvent);
 }
 
 void SVGElementInstance::setOnsearch(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().searchEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().searchEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onselect() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().selectEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().selectEvent);
 }
 
 void SVGElementInstance::setOnselect(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().selectEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().selectEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onselectstart() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().selectstartEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().selectstartEvent);
 }
 
 void SVGElementInstance::setOnselectstart(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().selectstartEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().selectstartEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onsubmit() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().submitEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().submitEvent);
 }
 
 void SVGElementInstance::setOnsubmit(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().submitEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().submitEvent, eventListener);
 }
 
 EventListener* SVGElementInstance::onunload() const
 {
-    return correspondingElement()->inlineEventListenerForType(eventNames().unloadEvent);
+    return correspondingElement()->getAttributeEventListener(eventNames().unloadEvent);
 }
 
 void SVGElementInstance::setOnunload(PassRefPtr<EventListener> eventListener)
 {
-    correspondingElement()->setInlineEventListenerForType(eventNames().unloadEvent, eventListener);
+    correspondingElement()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
 }
 
 }
diff --git a/WebCore/svg/SVGElementInstance.h b/WebCore/svg/SVGElementInstance.h
index f5c6ca9..7c56792 100644
--- a/WebCore/svg/SVGElementInstance.h
+++ b/WebCore/svg/SVGElementInstance.h
@@ -61,6 +61,7 @@
         virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
         virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
         virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+        const RegisteredEventListenerVector& eventListeners() const { return correspondingElement()->eventListeners(); }
 
         SVGElement* correspondingElement() const { return m_element.get(); }
         SVGUseElement* correspondingUseElement() const { return m_useElement; }
diff --git a/WebCore/svg/SVGElementInstance.idl b/WebCore/svg/SVGElementInstance.idl
index 92da5a6..3d88178 100644
--- a/WebCore/svg/SVGElementInstance.idl
+++ b/WebCore/svg/SVGElementInstance.idl
@@ -28,13 +28,13 @@
 
     interface [
         Conditional=SVG,
-        ObjCCustomInternalImpl,
         CustomListeners,
+        CustomMarkFunction,
         CustomPushEventHandlerScope,
         GenerateToJS,
         GenerateNativeConverter
     ] SVGElementInstance
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         : Object, EventTarget
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
     {
@@ -48,47 +48,47 @@
         readonly attribute SVGElementInstance nextSibling;
 
         // EventTarget
-#if !defined(LANGUAGE_OBJECTIVE_C)
-        attribute [DontEnum, ProtectedListener] EventListener onabort;
-        attribute [DontEnum, ProtectedListener] EventListener onblur;
-        attribute [DontEnum, ProtectedListener] EventListener onchange;
-        attribute [DontEnum, ProtectedListener] EventListener onclick;
-        attribute [DontEnum, ProtectedListener] EventListener oncontextmenu;
-        attribute [DontEnum, ProtectedListener] EventListener ondblclick;
-        attribute [DontEnum, ProtectedListener] EventListener onerror;
-        attribute [DontEnum, ProtectedListener] EventListener onfocus;
-        attribute [DontEnum, ProtectedListener] EventListener oninput;
-        attribute [DontEnum, ProtectedListener] EventListener onkeydown;
-        attribute [DontEnum, ProtectedListener] EventListener onkeypress;
-        attribute [DontEnum, ProtectedListener] EventListener onkeyup;
-        attribute [DontEnum, ProtectedListener] EventListener onload;
-        attribute [DontEnum, ProtectedListener] EventListener onmousedown;
-        attribute [DontEnum, ProtectedListener] EventListener onmousemove;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseout;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseover;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseup;
-        attribute [DontEnum, ProtectedListener] EventListener onmousewheel;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforecut;
-        attribute [DontEnum, ProtectedListener] EventListener oncut;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforecopy;
-        attribute [DontEnum, ProtectedListener] EventListener oncopy;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforepaste;
-        attribute [DontEnum, ProtectedListener] EventListener onpaste;
-        attribute [DontEnum, ProtectedListener] EventListener ondragenter;
-        attribute [DontEnum, ProtectedListener] EventListener ondragover;
-        attribute [DontEnum, ProtectedListener] EventListener ondragleave;
-        attribute [DontEnum, ProtectedListener] EventListener ondrop;
-        attribute [DontEnum, ProtectedListener] EventListener ondragstart;
-        attribute [DontEnum, ProtectedListener] EventListener ondrag;
-        attribute [DontEnum, ProtectedListener] EventListener ondragend;
-        attribute [DontEnum, ProtectedListener] EventListener onreset;
-        attribute [DontEnum, ProtectedListener] EventListener onresize;
-        attribute [DontEnum, ProtectedListener] EventListener onscroll;
-        attribute [DontEnum, ProtectedListener] EventListener onsearch;
-        attribute [DontEnum, ProtectedListener] EventListener onselect;
-        attribute [DontEnum, ProtectedListener] EventListener onselectstart;
-        attribute [DontEnum, ProtectedListener] EventListener onsubmit;
-        attribute [DontEnum, ProtectedListener] EventListener onunload;
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+        attribute [DontEnum] EventListener onabort;
+        attribute [DontEnum] EventListener onblur;
+        attribute [DontEnum] EventListener onchange;
+        attribute [DontEnum] EventListener onclick;
+        attribute [DontEnum] EventListener oncontextmenu;
+        attribute [DontEnum] EventListener ondblclick;
+        attribute [DontEnum] EventListener onerror;
+        attribute [DontEnum] EventListener onfocus;
+        attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener onkeydown;
+        attribute [DontEnum] EventListener onkeypress;
+        attribute [DontEnum] EventListener onkeyup;
+        attribute [DontEnum] EventListener onload;
+        attribute [DontEnum] EventListener onmousedown;
+        attribute [DontEnum] EventListener onmousemove;
+        attribute [DontEnum] EventListener onmouseout;
+        attribute [DontEnum] EventListener onmouseover;
+        attribute [DontEnum] EventListener onmouseup;
+        attribute [DontEnum] EventListener onmousewheel;
+        attribute [DontEnum] EventListener onbeforecut;
+        attribute [DontEnum] EventListener oncut;
+        attribute [DontEnum] EventListener onbeforecopy;
+        attribute [DontEnum] EventListener oncopy;
+        attribute [DontEnum] EventListener onbeforepaste;
+        attribute [DontEnum] EventListener onpaste;
+        attribute [DontEnum] EventListener ondragenter;
+        attribute [DontEnum] EventListener ondragover;
+        attribute [DontEnum] EventListener ondragleave;
+        attribute [DontEnum] EventListener ondrop;
+        attribute [DontEnum] EventListener ondragstart;
+        attribute [DontEnum] EventListener ondrag;
+        attribute [DontEnum] EventListener ondragend;
+        attribute [DontEnum] EventListener onreset;
+        attribute [DontEnum] EventListener onresize;
+        attribute [DontEnum] EventListener onscroll;
+        attribute [DontEnum] EventListener onsearch;
+        attribute [DontEnum] EventListener onselect;
+        attribute [DontEnum] EventListener onselectstart;
+        attribute [DontEnum] EventListener onsubmit;
+        attribute [DontEnum] EventListener onunload;
 
         [Custom] void addEventListener(in DOMString type, 
                                        in EventListener listener, 
diff --git a/WebCore/svg/SVGEllipseElement.cpp b/WebCore/svg/SVGEllipseElement.cpp
index a07a9a7..6d56ff8 100644
--- a/WebCore/svg/SVGEllipseElement.cpp
+++ b/WebCore/svg/SVGEllipseElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGEllipseElement.h"
 
 #include "FloatPoint.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
diff --git a/WebCore/svg/SVGException.idl b/WebCore/svg/SVGException.idl
index b7e97c7..233f653 100644
--- a/WebCore/svg/SVGException.idl
+++ b/WebCore/svg/SVGException.idl
@@ -29,7 +29,7 @@
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
diff --git a/WebCore/svg/SVGExternalResourcesRequired.cpp b/WebCore/svg/SVGExternalResourcesRequired.cpp
index d087f64..640f92e 100644
--- a/WebCore/svg/SVGExternalResourcesRequired.cpp
+++ b/WebCore/svg/SVGExternalResourcesRequired.cpp
@@ -26,8 +26,9 @@
 #include "SVGExternalResourcesRequired.h"
 
 #include "Attr.h"
-#include "SVGNames.h"
+#include "MappedAttribute.h"
 #include "SVGElement.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGFEBlendElement.cpp b/WebCore/svg/SVGFEBlendElement.cpp
index 3c8557e..f78412c 100644
--- a/WebCore/svg/SVGFEBlendElement.cpp
+++ b/WebCore/svg/SVGFEBlendElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEBlendElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGResourceFilter.h"
 
 namespace WebCore {
@@ -34,7 +35,6 @@
     , m_in1(this, SVGNames::inAttr)
     , m_in2(this, SVGNames::in2Attr)
     , m_mode(this, SVGNames::modeAttr, FEBLEND_MODE_NORMAL)
-    , m_filterEffect(0)
 {
 }
 
@@ -64,21 +64,16 @@
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEBlendElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEBlendElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED(); 
-    return 0;
-}
-
-bool SVGFEBlendElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
-    FilterEffect* input2 = builder->getEffectById(in2());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
+    FilterEffect* input2 = filterResource->builder()->getEffectById(in2());
 
     if(!input1 || !input2)
         return false;
 
-    builder->add(result(), FEBlend::create(input1, input2, static_cast<BlendModeType> (mode())));
+    RefPtr<FilterEffect> effect = FEBlend::create(input1, input2, static_cast<BlendModeType>(mode()));
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/WebCore/svg/SVGFEBlendElement.h b/WebCore/svg/SVGFEBlendElement.h
index a85d174..70e5e06 100644
--- a/WebCore/svg/SVGFEBlendElement.h
+++ b/WebCore/svg/SVGFEBlendElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEBlendElement_h
 #define SVGFEBlendElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FEBlend.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -36,15 +36,12 @@
         virtual ~SVGFEBlendElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEBlendElement, SVGNames::feBlendTagString, SVGNames::inAttrString, String, In1, in1)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEBlendElement, SVGNames::feBlendTagString, SVGNames::in2AttrString, String, In2, in2)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEBlendElement, SVGNames::feBlendTagString, SVGNames::modeAttrString, int, Mode, mode)
-
-        mutable RefPtr<FEBlend> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEBlendElement.idl b/WebCore/svg/SVGFEBlendElement.idl
index b45b57f..4c1a18b 100644
--- a/WebCore/svg/SVGFEBlendElement.idl
+++ b/WebCore/svg/SVGFEBlendElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGFEBlendElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEBlendElement : SVGElement,
                                                     SVGFilterPrimitiveStandardAttributes {
         // Blend Mode Types
         const unsigned short SVG_FEBLEND_MODE_UNKNOWN  = 0;
diff --git a/WebCore/svg/SVGFEColorMatrixElement.cpp b/WebCore/svg/SVGFEColorMatrixElement.cpp
index c3a8f01..660f000 100644
--- a/WebCore/svg/SVGFEColorMatrixElement.cpp
+++ b/WebCore/svg/SVGFEColorMatrixElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEColorMatrixElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 #include "SVGNumberList.h"
 #include "SVGResourceFilter.h"
@@ -36,7 +37,6 @@
     , m_in1(this, SVGNames::inAttr)
     , m_type(this, SVGNames::typeAttr, FECOLORMATRIX_TYPE_UNKNOWN)
     , m_values(this, SVGNames::valuesAttr, SVGNumberList::create(SVGNames::valuesAttr))
-    , m_filterEffect(0)
 {
 }
 
@@ -65,15 +65,9 @@
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEColorMatrixElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEColorMatrixElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEColorMatrixElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
 
     if(!input1)
         return false;
@@ -86,7 +80,8 @@
     for (unsigned int i = 0;i < nr;i++)
         _values.append(numbers->getItem(i, ec));
 
-    builder->add(result(), FEColorMatrix::create(input1, static_cast<ColorMatrixType> (type()), _values));
+    RefPtr<FilterEffect> effect = FEColorMatrix::create(input1, static_cast<ColorMatrixType>(type()), _values);
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/WebCore/svg/SVGFEColorMatrixElement.h b/WebCore/svg/SVGFEColorMatrixElement.h
index f39db86..5b7a9ae 100644
--- a/WebCore/svg/SVGFEColorMatrixElement.h
+++ b/WebCore/svg/SVGFEColorMatrixElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEColorMatrixElement_h
 #define SVGFEColorMatrixElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FEColorMatrix.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGNumberList.h"
@@ -36,15 +36,12 @@
         virtual ~SVGFEColorMatrixElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEColorMatrixElement, SVGNames::feColorMatrixTagString, SVGNames::inAttrString, String, In1, in1)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEColorMatrixElement, SVGNames::feColorMatrixTagString, SVGNames::typeAttrString, int, Type, type)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEColorMatrixElement, SVGNames::feColorMatrixTagString, SVGNames::valuesAttrString, SVGNumberList, Values, values)
-
-        mutable RefPtr<FEColorMatrix> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEColorMatrixElement.idl b/WebCore/svg/SVGFEColorMatrixElement.idl
index ae0e293..c116fe7 100644
--- a/WebCore/svg/SVGFEColorMatrixElement.idl
+++ b/WebCore/svg/SVGFEColorMatrixElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGFEColorMatrixElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEColorMatrixElement : SVGElement,
                                                           SVGFilterPrimitiveStandardAttributes {
         // Color Matrix Types
         const unsigned short SVG_FECOLORMATRIX_TYPE_UNKNOWN          = 0;
diff --git a/WebCore/svg/SVGFEComponentTransferElement.cpp b/WebCore/svg/SVGFEComponentTransferElement.cpp
index e1be6ae..cad60dc 100644
--- a/WebCore/svg/SVGFEComponentTransferElement.cpp
+++ b/WebCore/svg/SVGFEComponentTransferElement.cpp
@@ -22,16 +22,17 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEComponentTransferElement.h"
 
 #include "Attr.h"
+#include "MappedAttribute.h"
+#include "SVGFEFuncAElement.h"
+#include "SVGFEFuncBElement.h"
+#include "SVGFEFuncGElement.h"
+#include "SVGFEFuncRElement.h"
 #include "SVGNames.h"
 #include "SVGRenderStyle.h"
-#include "SVGFEFuncRElement.h"
-#include "SVGFEFuncGElement.h"
-#include "SVGFEFuncBElement.h"
-#include "SVGFEFuncAElement.h"
 #include "SVGResourceFilter.h"
 
 namespace WebCore {
@@ -39,7 +40,6 @@
 SVGFEComponentTransferElement::SVGFEComponentTransferElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
     , m_in1(this, SVGNames::inAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -56,15 +56,9 @@
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEComponentTransferElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEComponentTransferElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEComponentTransferElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
     
     if(!input1)
         return false;
@@ -85,7 +79,8 @@
             alpha = static_cast<SVGFEFuncAElement*>(n)->transferFunction();
     }
     
-    builder->add(result(), FEComponentTransfer::create(input1, red, green, blue, alpha));
+    RefPtr<FilterEffect> effect = FEComponentTransfer::create(input1, red, green, blue, alpha);
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/WebCore/svg/SVGFEComponentTransferElement.h b/WebCore/svg/SVGFEComponentTransferElement.h
index e80ea94..21c95d2 100644
--- a/WebCore/svg/SVGFEComponentTransferElement.h
+++ b/WebCore/svg/SVGFEComponentTransferElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEComponentTransferElement_h
 #define SVGFEComponentTransferElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "FEComponentTransfer.h"
 
@@ -35,13 +35,10 @@
         virtual ~SVGFEComponentTransferElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEComponentTransferElement, SVGNames::feComponentTransferTagString, SVGNames::inAttrString, String, In1, in1)
-
-        mutable RefPtr<FEComponentTransfer> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEComponentTransferElement.idl b/WebCore/svg/SVGFEComponentTransferElement.idl
index 783c9b7..7ec0741 100644
--- a/WebCore/svg/SVGFEComponentTransferElement.idl
+++ b/WebCore/svg/SVGFEComponentTransferElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEComponentTransferElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEComponentTransferElement : SVGElement,
                                                                 SVGFilterPrimitiveStandardAttributes {
         readonly attribute SVGAnimatedString in1;
     };
diff --git a/WebCore/svg/SVGFECompositeElement.cpp b/WebCore/svg/SVGFECompositeElement.cpp
index f2fc4dc..2205243 100644
--- a/WebCore/svg/SVGFECompositeElement.cpp
+++ b/WebCore/svg/SVGFECompositeElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFECompositeElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 #include "SVGResourceFilter.h"
 
@@ -39,7 +40,6 @@
     , m_k2(this, SVGNames::k2Attr)
     , m_k3(this, SVGNames::k3Attr)
     , m_k4(this, SVGNames::k4Attr)
-    , m_filterEffect(0)
 {
 }
 
@@ -80,23 +80,17 @@
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFECompositeElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFECompositeElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFECompositeElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
-    FilterEffect* input2 = builder->getEffectById(in2());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
+    FilterEffect* input2 = filterResource->builder()->getEffectById(in2());
     
     if(!input1 || !input2)
         return false;
     
-    RefPtr<FilterEffect> addedEffect = FEComposite::create(input1, input2, static_cast<CompositeOperationType> (_operator()),
+    RefPtr<FilterEffect> effect = FEComposite::create(input1, input2, static_cast<CompositeOperationType>(_operator()),
                                         k1(), k2(), k3(), k4());
-    builder->add(result(), addedEffect.release());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/WebCore/svg/SVGFECompositeElement.h b/WebCore/svg/SVGFECompositeElement.h
index 89ad7df..fc97169 100644
--- a/WebCore/svg/SVGFECompositeElement.h
+++ b/WebCore/svg/SVGFECompositeElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFECompositeElement_h
 #define SVGFECompositeElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FEComposite.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -35,8 +35,7 @@
         virtual ~SVGFECompositeElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::inAttrString, String, In1, in1)
@@ -46,8 +45,6 @@
         ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::k2AttrString, float, K2, k2)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::k3AttrString, float, K3, k3)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFECompositeElement, SVGNames::feCompositeTagString, SVGNames::k4AttrString, float, K4, k4)
-
-        mutable RefPtr<FEComposite> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFECompositeElement.idl b/WebCore/svg/SVGFECompositeElement.idl
index 01821e8..97a13fc 100644
--- a/WebCore/svg/SVGFECompositeElement.idl
+++ b/WebCore/svg/SVGFECompositeElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGFECompositeElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFECompositeElement : SVGElement,
                                                         SVGFilterPrimitiveStandardAttributes {
         // Composite Operators
         const unsigned short SVG_FECOMPOSITE_OPERATOR_UNKNOWN    = 0;
diff --git a/WebCore/svg/SVGFEDiffuseLightingElement.cpp b/WebCore/svg/SVGFEDiffuseLightingElement.cpp
index 87fa33a..00ff55a 100644
--- a/WebCore/svg/SVGFEDiffuseLightingElement.cpp
+++ b/WebCore/svg/SVGFEDiffuseLightingElement.cpp
@@ -19,17 +19,18 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDiffuseLightingElement.h"
 
 #include "Attr.h"
+#include "MappedAttribute.h"
 #include "RenderObject.h"
 #include "SVGColor.h"
+#include "SVGFEDiffuseLighting.h"
 #include "SVGFELightElement.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGRenderStyle.h"
-#include "SVGFEDiffuseLighting.h"
 #include "SVGResourceFilter.h"
 
 namespace WebCore {
@@ -44,7 +45,6 @@
     , m_surfaceScale(this, SVGNames::surfaceScaleAttr, 1.0f)
     , m_kernelUnitLengthX(this, SVGNames::kernelUnitLengthAttr)
     , m_kernelUnitLengthY(this, SVGNames::kernelUnitLengthAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -71,15 +71,9 @@
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEDiffuseLightingElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEDiffuseLightingElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEDiffuseLightingElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
     
     if(!input1)
         return false;
@@ -87,9 +81,9 @@
     RefPtr<RenderStyle> filterStyle = styleForRenderer();
     Color color = filterStyle->svgStyle()->lightingColor();
     
-    RefPtr<FilterEffect> addedEffect = FEDiffuseLighting::create(input1, color, surfaceScale(), diffuseConstant(), 
+    RefPtr<FilterEffect> effect = FEDiffuseLighting::create(input1, color, surfaceScale(), diffuseConstant(), 
                                             kernelUnitLengthX(), kernelUnitLengthY(), findLights());
-    builder->add(result(), addedEffect.release());
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/WebCore/svg/SVGFEDiffuseLightingElement.h b/WebCore/svg/SVGFEDiffuseLightingElement.h
index 70c6777..fcb5eee 100644
--- a/WebCore/svg/SVGFEDiffuseLightingElement.h
+++ b/WebCore/svg/SVGFEDiffuseLightingElement.h
@@ -22,7 +22,7 @@
 #ifndef SVGFEDiffuseLightingElement_h
 #define SVGFEDiffuseLightingElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFELightElement.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -40,8 +40,7 @@
         virtual ~SVGFEDiffuseLightingElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGNames::inAttrString, String, In1, in1)
@@ -51,8 +50,6 @@
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
 
         LightSource* findLights() const;
-        
-        mutable RefPtr<FEDiffuseLighting> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEDiffuseLightingElement.idl b/WebCore/svg/SVGFEDiffuseLightingElement.idl
index ca54f8b..c48a4f1 100644
--- a/WebCore/svg/SVGFEDiffuseLightingElement.idl
+++ b/WebCore/svg/SVGFEDiffuseLightingElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEDiffuseLightingElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEDiffuseLightingElement : SVGElement,
                                                               SVGFilterPrimitiveStandardAttributes {
         readonly attribute SVGAnimatedString in1;
         readonly attribute SVGAnimatedNumber surfaceScale;
diff --git a/WebCore/svg/SVGFEDisplacementMapElement.cpp b/WebCore/svg/SVGFEDisplacementMapElement.cpp
index 3b6dfbf..8ac668c 100644
--- a/WebCore/svg/SVGFEDisplacementMapElement.cpp
+++ b/WebCore/svg/SVGFEDisplacementMapElement.cpp
@@ -17,12 +17,12 @@
  Boston, MA 02110-1301, USA.
  */
 
-
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDisplacementMapElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGResourceFilter.h"
 
 namespace WebCore {
@@ -34,7 +34,6 @@
     , m_xChannelSelector(this, SVGNames::xChannelSelectorAttr, CHANNEL_A)
     , m_yChannelSelector(this, SVGNames::yChannelSelectorAttr, CHANNEL_A)
     , m_scale(this, SVGNames::scaleAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -73,24 +72,18 @@
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEDisplacementMapElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEDisplacementMapElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEDisplacementMapElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
-    FilterEffect* input2 = builder->getEffectById(in2());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
+    FilterEffect* input2 = filterResource->builder()->getEffectById(in2());
     
     if(!input1 || !input2)
         return false;
         
     
-    RefPtr<FilterEffect> addedEffect = FEDisplacementMap::create(input1, input2, static_cast<ChannelSelectorType> (xChannelSelector()), 
-                                        static_cast<ChannelSelectorType> (yChannelSelector()), scale());
-    builder->add(result(), addedEffect.release());
+    RefPtr<FilterEffect> effect = FEDisplacementMap::create(input1, input2, static_cast<ChannelSelectorType>(xChannelSelector()), 
+                                        static_cast<ChannelSelectorType>(yChannelSelector()), scale());
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/WebCore/svg/SVGFEDisplacementMapElement.h b/WebCore/svg/SVGFEDisplacementMapElement.h
index 21b93f4..48e6930 100644
--- a/WebCore/svg/SVGFEDisplacementMapElement.h
+++ b/WebCore/svg/SVGFEDisplacementMapElement.h
@@ -20,7 +20,7 @@
 #ifndef SVGFEDisplacementMapElement_h
 #define SVGFEDisplacementMapElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDisplacementMap.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -34,8 +34,7 @@
         static ChannelSelectorType stringToChannel(const String&);
         
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
         
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::inAttrString, String, In1, in1)
@@ -43,8 +42,6 @@
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::xChannelSelectorAttrString, int, XChannelSelector, xChannelSelector)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::yChannelSelectorAttrString, int, YChannelSelector, yChannelSelector)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDisplacementMapElement, SVGNames::feDisplacementMapTagString, SVGNames::scaleAttrString, float, Scale, scale)
-
-        mutable RefPtr<FEDisplacementMap> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEDisplacementMapElement.idl b/WebCore/svg/SVGFEDisplacementMapElement.idl
index d819794..4fde219 100644
--- a/WebCore/svg/SVGFEDisplacementMapElement.idl
+++ b/WebCore/svg/SVGFEDisplacementMapElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGFEDisplacementMapElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEDisplacementMapElement : SVGElement,
                                                               SVGFilterPrimitiveStandardAttributes {    
         // Channel Selectors
         const unsigned short SVG_CHANNEL_UNKNOWN = 0;
diff --git a/WebCore/svg/SVGFEDistantLightElement.cpp b/WebCore/svg/SVGFEDistantLightElement.cpp
index e9ec48d..35c487b 100644
--- a/WebCore/svg/SVGFEDistantLightElement.cpp
+++ b/WebCore/svg/SVGFEDistantLightElement.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDistantLightElement.h"
 #include "SVGDistantLightSource.h"
 
diff --git a/WebCore/svg/SVGFEDistantLightElement.h b/WebCore/svg/SVGFEDistantLightElement.h
index e43282f..e340549 100644
--- a/WebCore/svg/SVGFEDistantLightElement.h
+++ b/WebCore/svg/SVGFEDistantLightElement.h
@@ -20,7 +20,7 @@
 #ifndef SVGFEDistantLightElement_h
 #define SVGFEDistantLightElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFELightElement.h"
 
 namespace WebCore
diff --git a/WebCore/svg/SVGFEDistantLightElement.idl b/WebCore/svg/SVGFEDistantLightElement.idl
index 8bd6067..16e7467 100644
--- a/WebCore/svg/SVGFEDistantLightElement.idl
+++ b/WebCore/svg/SVGFEDistantLightElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEDistantLightElement : SVGElement {
+    interface [Conditional=SVG&FILTERS] SVGFEDistantLightElement : SVGElement {
         readonly attribute SVGAnimatedNumber azimuth;
         readonly attribute SVGAnimatedNumber elevation;
     };
diff --git a/WebCore/svg/SVGFEFloodElement.cpp b/WebCore/svg/SVGFEFloodElement.cpp
index 98e7d6f..e12b4e1 100644
--- a/WebCore/svg/SVGFEFloodElement.cpp
+++ b/WebCore/svg/SVGFEFloodElement.cpp
@@ -22,13 +22,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFloodElement.h"
 
-#include "Attr.h"
-#include "Document.h"
+#include "MappedAttribute.h"
 #include "RenderStyle.h"
-#include "SVGNames.h"
 #include "SVGRenderStyle.h"
 #include "SVGResourceFilter.h"
 
@@ -36,7 +34,7 @@
 
 SVGFEFloodElement::SVGFEFloodElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_filterEffect(0)
+    , m_in1(this, SVGNames::inAttr)
 {
 }
 
@@ -46,23 +44,27 @@
 
 void SVGFEFloodElement::parseMappedAttribute(MappedAttribute* attr)
 {
-    SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
+    const String& value = attr->value();
+    if (attr->name() == SVGNames::inAttr)
+        setIn1BaseValue(value);
+    else
+        SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEFloodElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEFloodElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
+    FilterEffect* input = filterResource->builder()->getEffectById(in1());
 
-bool SVGFEFloodElement::build(FilterBuilder* builder)
-{
+    if(!input)
+        return false;
+
     RefPtr<RenderStyle> filterStyle = styleForRenderer();
 
     Color color = filterStyle->svgStyle()->floodColor();
     float opacity = filterStyle->svgStyle()->floodOpacity();
 
-    builder->add(result(), FEFlood::create(color, opacity));
+    RefPtr<FilterEffect> effect = FEFlood::create(input, color, opacity);
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/WebCore/svg/SVGFEFloodElement.h b/WebCore/svg/SVGFEFloodElement.h
index 046f418..4a4cffc 100644
--- a/WebCore/svg/SVGFEFloodElement.h
+++ b/WebCore/svg/SVGFEFloodElement.h
@@ -23,9 +23,9 @@
 #ifndef SVGFEFloodElement_h
 #define SVGFEFloodElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "SVGFilterPrimitiveStandardAttributes.h"
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFlood.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
 
 namespace WebCore
 {
@@ -36,11 +36,10 @@
         virtual ~SVGFEFloodElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
-        mutable RefPtr<FEFlood> m_filterEffect;
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEFloodElement, SVGNames::feFloodTagString, SVGNames::inAttrString, String, In1, in1)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEFloodElement.idl b/WebCore/svg/SVGFEFloodElement.idl
index d2356bf..814bbdf 100644
--- a/WebCore/svg/SVGFEFloodElement.idl
+++ b/WebCore/svg/SVGFEFloodElement.idl
@@ -25,8 +25,10 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEFloodElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEFloodElement : SVGElement,
                                                     SVGFilterPrimitiveStandardAttributes {
-    };
 
+        readonly attribute SVGAnimatedString      in1;
+
+    };
 }
diff --git a/WebCore/svg/SVGFEFuncAElement.cpp b/WebCore/svg/SVGFEFuncAElement.cpp
index 595e2e6..41118fe 100644
--- a/WebCore/svg/SVGFEFuncAElement.cpp
+++ b/WebCore/svg/SVGFEFuncAElement.cpp
@@ -22,7 +22,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFuncAElement.h"
 
 namespace WebCore {
diff --git a/WebCore/svg/SVGFEFuncAElement.h b/WebCore/svg/SVGFEFuncAElement.h
index 3fd6816..2c24039 100644
--- a/WebCore/svg/SVGFEFuncAElement.h
+++ b/WebCore/svg/SVGFEFuncAElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEFuncAElement_h
 #define SVGFEFuncAElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGComponentTransferFunctionElement.h"
 
 namespace WebCore
diff --git a/WebCore/svg/SVGFEFuncAElement.idl b/WebCore/svg/SVGFEFuncAElement.idl
index 7675f7d..8901551 100644
--- a/WebCore/svg/SVGFEFuncAElement.idl
+++ b/WebCore/svg/SVGFEFuncAElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEFuncAElement : SVGComponentTransferFunctionElement {
+    interface [Conditional=SVG&FILTERS] SVGFEFuncAElement : SVGComponentTransferFunctionElement {
     };
 
 }
diff --git a/WebCore/svg/SVGFEFuncBElement.cpp b/WebCore/svg/SVGFEFuncBElement.cpp
index de6cb88..190b23a 100644
--- a/WebCore/svg/SVGFEFuncBElement.cpp
+++ b/WebCore/svg/SVGFEFuncBElement.cpp
@@ -22,7 +22,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFuncBElement.h"
 
 namespace WebCore {
diff --git a/WebCore/svg/SVGFEFuncBElement.h b/WebCore/svg/SVGFEFuncBElement.h
index 2dd9615..1eb0889 100644
--- a/WebCore/svg/SVGFEFuncBElement.h
+++ b/WebCore/svg/SVGFEFuncBElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEFuncBElement_h
 #define SVGFEFuncBElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGComponentTransferFunctionElement.h"
 
 namespace WebCore
diff --git a/WebCore/svg/SVGFEFuncBElement.idl b/WebCore/svg/SVGFEFuncBElement.idl
index 7717f6a..fada028 100644
--- a/WebCore/svg/SVGFEFuncBElement.idl
+++ b/WebCore/svg/SVGFEFuncBElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEFuncBElement : SVGComponentTransferFunctionElement {
+    interface [Conditional=SVG&FILTERS] SVGFEFuncBElement : SVGComponentTransferFunctionElement {
     };
 
 }
diff --git a/WebCore/svg/SVGFEFuncGElement.cpp b/WebCore/svg/SVGFEFuncGElement.cpp
index 958f547..d5e5625 100644
--- a/WebCore/svg/SVGFEFuncGElement.cpp
+++ b/WebCore/svg/SVGFEFuncGElement.cpp
@@ -22,7 +22,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFuncGElement.h"
 
 namespace WebCore {
diff --git a/WebCore/svg/SVGFEFuncGElement.h b/WebCore/svg/SVGFEFuncGElement.h
index 8f1c368..973360e 100644
--- a/WebCore/svg/SVGFEFuncGElement.h
+++ b/WebCore/svg/SVGFEFuncGElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEFuncGElement_h
 #define SVGFEFuncGElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGComponentTransferFunctionElement.h"
 
 namespace WebCore
diff --git a/WebCore/svg/SVGFEFuncGElement.idl b/WebCore/svg/SVGFEFuncGElement.idl
index 1ec24fa..33fc9a0 100644
--- a/WebCore/svg/SVGFEFuncGElement.idl
+++ b/WebCore/svg/SVGFEFuncGElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEFuncGElement : SVGComponentTransferFunctionElement {
+    interface [Conditional=SVG&FILTERS] SVGFEFuncGElement : SVGComponentTransferFunctionElement {
     };
 
 }
diff --git a/WebCore/svg/SVGFEFuncRElement.cpp b/WebCore/svg/SVGFEFuncRElement.cpp
index e376781..e3d7ee4 100644
--- a/WebCore/svg/SVGFEFuncRElement.cpp
+++ b/WebCore/svg/SVGFEFuncRElement.cpp
@@ -22,7 +22,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFuncRElement.h"
 
 namespace WebCore {
diff --git a/WebCore/svg/SVGFEFuncRElement.h b/WebCore/svg/SVGFEFuncRElement.h
index 4921488..3553954 100644
--- a/WebCore/svg/SVGFEFuncRElement.h
+++ b/WebCore/svg/SVGFEFuncRElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEFuncRElement_h
 #define SVGFEFuncRElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGComponentTransferFunctionElement.h"
 
 namespace WebCore
diff --git a/WebCore/svg/SVGFEFuncRElement.idl b/WebCore/svg/SVGFEFuncRElement.idl
index 0a6ac30..e9b8e26 100644
--- a/WebCore/svg/SVGFEFuncRElement.idl
+++ b/WebCore/svg/SVGFEFuncRElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEFuncRElement : SVGComponentTransferFunctionElement {
+    interface [Conditional=SVG&FILTERS] SVGFEFuncRElement : SVGComponentTransferFunctionElement {
     };
 
 }
diff --git a/WebCore/svg/SVGFEGaussianBlurElement.cpp b/WebCore/svg/SVGFEGaussianBlurElement.cpp
index 4fbabe3..be3554f 100644
--- a/WebCore/svg/SVGFEGaussianBlurElement.cpp
+++ b/WebCore/svg/SVGFEGaussianBlurElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEGaussianBlurElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGResourceFilter.h"
@@ -39,7 +40,6 @@
     , m_in1(this, SVGNames::inAttr)
     , m_stdDeviationX(this, SVGNames::stdDeviationAttr)
     , m_stdDeviationY(this, SVGNames::stdDeviationAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -47,8 +47,9 @@
 {
 }
 
-void SVGFEGaussianBlurElement::setStdDeviation(float stdDeviationX, float stdDeviationY)
+void SVGFEGaussianBlurElement::setStdDeviation(float, float)
 {
+    // FIXME: Needs an implementation.
 }
 
 void SVGFEGaussianBlurElement::parseMappedAttribute(MappedAttribute* attr)
@@ -66,20 +67,15 @@
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEGaussianBlurElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEGaussianBlurElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEGaussianBlurElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
 
     if(!input1)
         return false;
 
-    builder->add(result(), FEGaussianBlur::create(input1, stdDeviationX(), stdDeviationY()));
+    RefPtr<FilterEffect> effect = FEGaussianBlur::create(input1, stdDeviationX(), stdDeviationY());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/WebCore/svg/SVGFEGaussianBlurElement.h b/WebCore/svg/SVGFEGaussianBlurElement.h
index 9e1c15c..187c212 100644
--- a/WebCore/svg/SVGFEGaussianBlurElement.h
+++ b/WebCore/svg/SVGFEGaussianBlurElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEGaussianBlurElement_h
 #define SVGFEGaussianBlurElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEGaussianBlur.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -40,15 +40,12 @@
         void setStdDeviation(float stdDeviationX, float stdDeviationY);
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEGaussianBlurElement, SVGNames::feGaussianBlurTagString, SVGNames::inAttrString, String, In1, in1)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEGaussianBlurElement, SVGNames::feGaussianBlurTagString, SVGStdDeviationXAttrIdentifier, float, StdDeviationX, stdDeviationX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEGaussianBlurElement, SVGNames::feGaussianBlurTagString, SVGStdDeviationYAttrIdentifier, float, StdDeviationY, stdDeviationY)
-
-        mutable RefPtr<FEGaussianBlur> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEGaussianBlurElement.idl b/WebCore/svg/SVGFEGaussianBlurElement.idl
index 7dc7526..efa09b8 100644
--- a/WebCore/svg/SVGFEGaussianBlurElement.idl
+++ b/WebCore/svg/SVGFEGaussianBlurElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEGaussianBlurElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEGaussianBlurElement : SVGElement,
                                                            SVGFilterPrimitiveStandardAttributes { 
         readonly attribute SVGAnimatedString in1;
         readonly attribute SVGAnimatedNumber stdDeviationX;
diff --git a/WebCore/svg/SVGFEImageElement.cpp b/WebCore/svg/SVGFEImageElement.cpp
index 3ceb560..ae69e0d 100644
--- a/WebCore/svg/SVGFEImageElement.cpp
+++ b/WebCore/svg/SVGFEImageElement.cpp
@@ -22,13 +22,14 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEImageElement.h"
 
 #include "Attr.h"
 #include "CachedImage.h"
 #include "DocLoader.h"
 #include "Document.h"
+#include "MappedAttribute.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
 #include "SVGPreserveAspectRatio.h"
@@ -42,8 +43,6 @@
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
-    , m_cachedImage(0)
-    , m_filterEffect(0)
 {
 }
 
@@ -81,24 +80,17 @@
     }
 }
 
-void SVGFEImageElement::notifyFinished(CachedResource* finishedObj)
+void SVGFEImageElement::notifyFinished(CachedResource*)
 {
-    if (finishedObj == m_cachedImage && m_filterEffect)
-        m_filterEffect->setCachedImage(m_cachedImage.get());
 }
 
-SVGFilterEffect* SVGFEImageElement::filterEffect(SVGResourceFilter* filter) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEImageElement::build(FilterBuilder* builder)
+bool SVGFEImageElement::build(SVGResourceFilter* filterResource)
 {
     if(!m_cachedImage)
         return false;
 
-    builder->add(result(), FEImage::create(m_cachedImage.get()));
+    RefPtr<FilterEffect> effect = FEImage::create(m_cachedImage.get());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/WebCore/svg/SVGFEImageElement.h b/WebCore/svg/SVGFEImageElement.h
index 98d5941..67f3bd5 100644
--- a/WebCore/svg/SVGFEImageElement.h
+++ b/WebCore/svg/SVGFEImageElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEImageElement_h
 #define SVGFEImageElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "CachedResourceHandle.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGURIReference.h"
@@ -47,17 +47,15 @@
         virtual void notifyFinished(CachedResource*);
 
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     protected:
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
         virtual const SVGElement* contextElement() const { return this; }
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGNames::feImageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
         CachedResourceHandle<CachedImage> m_cachedImage;
-        mutable RefPtr<FEImage> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEImageElement.idl b/WebCore/svg/SVGFEImageElement.idl
index c9ee669..23b9c86 100644
--- a/WebCore/svg/SVGFEImageElement.idl
+++ b/WebCore/svg/SVGFEImageElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEImageElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEImageElement : SVGElement,
                                                     SVGURIReference,
                                                     SVGLangSpace,
                                                     SVGExternalResourcesRequired,
diff --git a/WebCore/svg/SVGFELightElement.cpp b/WebCore/svg/SVGFELightElement.cpp
index 73c088f..bb954eb 100644
--- a/WebCore/svg/SVGFELightElement.cpp
+++ b/WebCore/svg/SVGFELightElement.cpp
@@ -21,8 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFELightElement.h"
+
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 
 namespace WebCore {
diff --git a/WebCore/svg/SVGFELightElement.h b/WebCore/svg/SVGFELightElement.h
index 5c4a785..a66ccf5 100644
--- a/WebCore/svg/SVGFELightElement.h
+++ b/WebCore/svg/SVGFELightElement.h
@@ -22,7 +22,7 @@
 #ifndef SVGFELightElement_h
 #define SVGFELightElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
 #include "SVGLightSource.h"
 
@@ -56,5 +56,5 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 #endif
diff --git a/WebCore/svg/SVGFEMergeElement.cpp b/WebCore/svg/SVGFEMergeElement.cpp
index 5ccf403..0640066 100644
--- a/WebCore/svg/SVGFEMergeElement.cpp
+++ b/WebCore/svg/SVGFEMergeElement.cpp
@@ -22,7 +22,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMergeElement.h"
 
 #include "SVGFEMergeNodeElement.h"
@@ -32,7 +32,6 @@
 
 SVGFEMergeElement::SVGFEMergeElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_filterEffect(0)
 {
 }
 
@@ -40,18 +39,12 @@
 {
 }
 
-SVGFilterEffect* SVGFEMergeElement::filterEffect(SVGResourceFilter* filter) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEMergeElement::build(FilterBuilder* builder)
+bool SVGFEMergeElement::build(SVGResourceFilter* filterResource)
 {
     Vector<FilterEffect*> mergeInputs;
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feMergeNodeTag)) {
-            FilterEffect* mergeEffect = builder->getEffectById(static_cast<SVGFEMergeNodeElement*>(n)->in1());
+            FilterEffect* mergeEffect = filterResource->builder()->getEffectById(static_cast<SVGFEMergeNodeElement*>(n)->in1());
             mergeInputs.append(mergeEffect);
         }
     }
@@ -59,7 +52,8 @@
     if(mergeInputs.isEmpty())
         return false;
 
-    builder->add(result(), FEMerge::create(mergeInputs));
+    RefPtr<FilterEffect> effect = FEMerge::create(mergeInputs);
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/WebCore/svg/SVGFEMergeElement.h b/WebCore/svg/SVGFEMergeElement.h
index 6449286..e63ed04 100644
--- a/WebCore/svg/SVGFEMergeElement.h
+++ b/WebCore/svg/SVGFEMergeElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEMergeElement_h
 #define SVGFEMergeElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMerge.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -34,11 +34,7 @@
         SVGFEMergeElement(const QualifiedName&, Document*);
         virtual ~SVGFEMergeElement();
 
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
-
-    private:
-        mutable RefPtr<FEMerge> m_filterEffect;
+        virtual bool build(SVGResourceFilter*);
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEMergeElement.idl b/WebCore/svg/SVGFEMergeElement.idl
index 6cec2fc..0b03845 100644
--- a/WebCore/svg/SVGFEMergeElement.idl
+++ b/WebCore/svg/SVGFEMergeElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEMergeElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEMergeElement : SVGElement,
                                                     SVGFilterPrimitiveStandardAttributes {
     };
 
diff --git a/WebCore/svg/SVGFEMergeNodeElement.cpp b/WebCore/svg/SVGFEMergeNodeElement.cpp
index e68f4d7..ae08706 100644
--- a/WebCore/svg/SVGFEMergeNodeElement.cpp
+++ b/WebCore/svg/SVGFEMergeNodeElement.cpp
@@ -22,9 +22,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMergeNodeElement.h"
 
+#include "MappedAttribute.h"
+
 namespace WebCore {
 
 SVGFEMergeNodeElement::SVGFEMergeNodeElement(const QualifiedName& tagName, Document* doc)
diff --git a/WebCore/svg/SVGFEMergeNodeElement.h b/WebCore/svg/SVGFEMergeNodeElement.h
index c1abd2f..e2af642 100644
--- a/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/WebCore/svg/SVGFEMergeNodeElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEMergeNodeElement_h
 #define SVGFEMergeNodeElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
 
 namespace WebCore {
diff --git a/WebCore/svg/SVGFEMergeNodeElement.idl b/WebCore/svg/SVGFEMergeNodeElement.idl
index f385755..4bddcb2 100644
--- a/WebCore/svg/SVGFEMergeNodeElement.idl
+++ b/WebCore/svg/SVGFEMergeNodeElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEMergeNodeElement : SVGElement {
+    interface [Conditional=SVG&FILTERS] SVGFEMergeNodeElement : SVGElement {
         readonly attribute SVGAnimatedString in1;
     };
 
diff --git a/WebCore/svg/SVGFEOffsetElement.cpp b/WebCore/svg/SVGFEOffsetElement.cpp
index 4fa572f..c7e4e77 100644
--- a/WebCore/svg/SVGFEOffsetElement.cpp
+++ b/WebCore/svg/SVGFEOffsetElement.cpp
@@ -22,10 +22,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEOffsetElement.h"
 
 #include "Attr.h"
+#include "MappedAttribute.h"
 #include "SVGResourceFilter.h"
 
 namespace WebCore {
@@ -35,7 +36,6 @@
     , m_in1(this, SVGNames::inAttr)
     , m_dx(this, SVGNames::dxAttr)
     , m_dy(this, SVGNames::dyAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -56,20 +56,15 @@
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFEOffsetElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFEOffsetElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFEOffsetElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
 
     if(!input1)
         return false;
 
-    builder->add(result(), FEOffset::create(input1, dx(), dy()));
+    RefPtr<FilterEffect> effect = FEOffset::create(input1, dx(), dy());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/WebCore/svg/SVGFEOffsetElement.h b/WebCore/svg/SVGFEOffsetElement.h
index 2d1b0ba..1471abe 100644
--- a/WebCore/svg/SVGFEOffsetElement.h
+++ b/WebCore/svg/SVGFEOffsetElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFEOffsetElement_h
 #define SVGFEOffsetElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGFEOffset.h"
 
@@ -35,15 +35,12 @@
         virtual ~SVGFEOffsetElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEOffsetElement, SVGNames::feOffsetTagString, SVGNames::inAttrString, String, In1, in1)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEOffsetElement, SVGNames::feOffsetTagString, SVGNames::dxAttrString, float, Dx, dx)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEOffsetElement, SVGNames::feOffsetTagString, SVGNames::dyAttrString, float, Dy, dy)
-
-        mutable RefPtr<FEOffset> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEOffsetElement.idl b/WebCore/svg/SVGFEOffsetElement.idl
index a62d8da..ba3ee4e 100644
--- a/WebCore/svg/SVGFEOffsetElement.idl
+++ b/WebCore/svg/SVGFEOffsetElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEOffsetElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFEOffsetElement : SVGElement,
                                                      SVGFilterPrimitiveStandardAttributes {
         readonly attribute SVGAnimatedString in1;
         readonly attribute SVGAnimatedNumber dx;
diff --git a/WebCore/svg/SVGFEPointLightElement.cpp b/WebCore/svg/SVGFEPointLightElement.cpp
index f30f6db..088f878 100644
--- a/WebCore/svg/SVGFEPointLightElement.cpp
+++ b/WebCore/svg/SVGFEPointLightElement.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEPointLightElement.h"
 #include "SVGPointLightSource.h"
 
diff --git a/WebCore/svg/SVGFEPointLightElement.h b/WebCore/svg/SVGFEPointLightElement.h
index 5b72e09..edb9f9d 100644
--- a/WebCore/svg/SVGFEPointLightElement.h
+++ b/WebCore/svg/SVGFEPointLightElement.h
@@ -20,7 +20,7 @@
 #ifndef SVGFEPointLightElement_h
 #define SVGFEPointLightElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFELightElement.h"
 
 namespace WebCore
diff --git a/WebCore/svg/SVGFEPointLightElement.idl b/WebCore/svg/SVGFEPointLightElement.idl
index 12dbe2f..f5ad94c 100644
--- a/WebCore/svg/SVGFEPointLightElement.idl
+++ b/WebCore/svg/SVGFEPointLightElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFEPointLightElement : SVGElement {
+    interface [Conditional=SVG&FILTERS] SVGFEPointLightElement : SVGElement {
         readonly attribute SVGAnimatedNumber x;
         readonly attribute SVGAnimatedNumber y;
         readonly attribute SVGAnimatedNumber z;
diff --git a/WebCore/svg/SVGFESpecularLightingElement.cpp b/WebCore/svg/SVGFESpecularLightingElement.cpp
index c7b7410..36dd453 100644
--- a/WebCore/svg/SVGFESpecularLightingElement.cpp
+++ b/WebCore/svg/SVGFESpecularLightingElement.cpp
@@ -21,13 +21,14 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFESpecularLightingElement.h"
 
+#include "MappedAttribute.h"
 #include "RenderObject.h"
 #include "SVGColor.h"
-#include "SVGNames.h"
 #include "SVGFELightElement.h"
+#include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGResourceFilter.h"
 
@@ -41,7 +42,6 @@
     , m_surfaceScale(this, SVGNames::surfaceScaleAttr, 1.0f)
     , m_kernelUnitLengthX(this, SVGNames::kernelUnitLengthAttr)
     , m_kernelUnitLengthY(this, SVGNames::kernelUnitLengthAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -70,12 +70,6 @@
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFESpecularLightingElement::filterEffect(SVGResourceFilter* filter) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
 LightSource* SVGFESpecularLightingElement::findLights() const
 {
     LightSource* light = 0;
@@ -92,9 +86,9 @@
     return light;
 }
 
-bool SVGFESpecularLightingElement::build(FilterBuilder* builder)
+bool SVGFESpecularLightingElement::build(SVGResourceFilter* filterResource)
 {
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
     
     if(!input1)
         return false;
@@ -103,9 +97,9 @@
     
     Color color = filterStyle->svgStyle()->lightingColor();
     
-    RefPtr<FilterEffect> addedEffect = FESpecularLighting::create(input1, color, surfaceScale(), specularConstant(), 
+    RefPtr<FilterEffect> effect = FESpecularLighting::create(input1, color, surfaceScale(), specularConstant(), 
                                         specularExponent(), kernelUnitLengthX(), kernelUnitLengthY(), findLights());
-    builder->add(result(), addedEffect.release());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/WebCore/svg/SVGFESpecularLightingElement.h b/WebCore/svg/SVGFESpecularLightingElement.h
index d76cb43..8ef490a 100644
--- a/WebCore/svg/SVGFESpecularLightingElement.h
+++ b/WebCore/svg/SVGFESpecularLightingElement.h
@@ -22,7 +22,7 @@
 #ifndef SVGFESpecularLightingElement_h
 #define SVGFESpecularLightingElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFESpecularLighting.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -39,8 +39,7 @@
         virtual ~SVGFESpecularLightingElement();
         
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGNames::inAttrString, String, In1, in1)
@@ -49,8 +48,6 @@
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGNames::surfaceScaleAttrString, float, SurfaceScale, surfaceScale)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGKernelUnitLengthXIdentifier, float, KernelUnitLengthX, kernelUnitLengthX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
-
-        mutable RefPtr<FESpecularLighting> m_filterEffect;
         
         LightSource* findLights() const;
     };
diff --git a/WebCore/svg/SVGFESpecularLightingElement.idl b/WebCore/svg/SVGFESpecularLightingElement.idl
index d79a70e..5fce7fa 100644
--- a/WebCore/svg/SVGFESpecularLightingElement.idl
+++ b/WebCore/svg/SVGFESpecularLightingElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFESpecularLightingElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFESpecularLightingElement : SVGElement,
                                                                SVGFilterPrimitiveStandardAttributes {
         readonly attribute SVGAnimatedString in1;
         readonly attribute SVGAnimatedNumber surfaceScale;
diff --git a/WebCore/svg/SVGFESpotLightElement.cpp b/WebCore/svg/SVGFESpotLightElement.cpp
index 5add579..980a3bb 100644
--- a/WebCore/svg/SVGFESpotLightElement.cpp
+++ b/WebCore/svg/SVGFESpotLightElement.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFESpotLightElement.h"
 #include "SVGSpotLightSource.h"
 
diff --git a/WebCore/svg/SVGFESpotLightElement.h b/WebCore/svg/SVGFESpotLightElement.h
index 2989b14..629e51a 100644
--- a/WebCore/svg/SVGFESpotLightElement.h
+++ b/WebCore/svg/SVGFESpotLightElement.h
@@ -20,7 +20,7 @@
 #ifndef SVGFESpotLightElement_h
 #define SVGFESpotLightElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFELightElement.h"
 
 namespace WebCore
diff --git a/WebCore/svg/SVGFESpotLightElement.idl b/WebCore/svg/SVGFESpotLightElement.idl
index 339d545..5a41202 100644
--- a/WebCore/svg/SVGFESpotLightElement.idl
+++ b/WebCore/svg/SVGFESpotLightElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFESpotLightElement : SVGElement {
+    interface [Conditional=SVG&FILTERS] SVGFESpotLightElement : SVGElement {
         readonly attribute SVGAnimatedNumber x;
         readonly attribute SVGAnimatedNumber y;
         readonly attribute SVGAnimatedNumber z;
diff --git a/WebCore/svg/SVGFETileElement.cpp b/WebCore/svg/SVGFETileElement.cpp
index bf90c33..d5828eb 100644
--- a/WebCore/svg/SVGFETileElement.cpp
+++ b/WebCore/svg/SVGFETileElement.cpp
@@ -22,10 +22,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFETileElement.h"
 
 #include "Attr.h"
+#include "MappedAttribute.h"
 #include "SVGRenderStyle.h"
 #include "SVGResourceFilter.h"
 
@@ -34,7 +35,6 @@
 SVGFETileElement::SVGFETileElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
     , m_in1(this, SVGNames::inAttr)
-    , m_filterEffect(0)
 {
 }
 
@@ -51,20 +51,15 @@
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFETileElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFETileElement::build(SVGResourceFilter* filterResource)
 {
-   ASSERT_NOT_REACHED();
-   return 0;
-}
-
-bool SVGFETileElement::build(FilterBuilder* builder)
-{
-    FilterEffect* input1 = builder->getEffectById(in1());
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
 
     if(!input1)
         return false;
 
-    builder->add(result(), FETile::create(input1));
+    RefPtr<FilterEffect> effect = FETile::create(input1);
+    filterResource->addFilterEffect(this, effect.release());
     
     return true;
 }
diff --git a/WebCore/svg/SVGFETileElement.h b/WebCore/svg/SVGFETileElement.h
index ba68115..b4fc0c5 100644
--- a/WebCore/svg/SVGFETileElement.h
+++ b/WebCore/svg/SVGFETileElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFETileElement_h
 #define SVGFETileElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGFETile.h"
 
@@ -35,13 +35,10 @@
         virtual ~SVGFETileElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFETileElement, SVGNames::feTileTagString, SVGNames::inAttrString, String, In1, in1)
-
-        mutable RefPtr<FETile> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFETileElement.idl b/WebCore/svg/SVGFETileElement.idl
index 68bfcc5..4a59a05 100644
--- a/WebCore/svg/SVGFETileElement.idl
+++ b/WebCore/svg/SVGFETileElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFETileElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFETileElement : SVGElement,
                                                    SVGFilterPrimitiveStandardAttributes {
         readonly attribute SVGAnimatedString in1;
     };
diff --git a/WebCore/svg/SVGFETurbulenceElement.cpp b/WebCore/svg/SVGFETurbulenceElement.cpp
index f51d835..b296e00 100644
--- a/WebCore/svg/SVGFETurbulenceElement.cpp
+++ b/WebCore/svg/SVGFETurbulenceElement.cpp
@@ -22,9 +22,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFETurbulenceElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGParserUtilities.h"
 #include "SVGResourceFilter.h"
 
@@ -41,7 +42,6 @@
     , m_seed(this, SVGNames::seedAttr)
     , m_stitchTiles(this, SVGNames::stitchTilesAttr, SVG_STITCHTYPE_NOSTITCH)
     , m_type(this, SVGNames::typeAttr, FETURBULENCE_TYPE_TURBULENCE)
-    , m_filterEffect(0)
 {
 }
 
@@ -76,17 +76,11 @@
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-SVGFilterEffect* SVGFETurbulenceElement::filterEffect(SVGResourceFilter* filter) const
+bool SVGFETurbulenceElement::build(SVGResourceFilter* filterResource)
 {
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-bool SVGFETurbulenceElement::build(FilterBuilder* builder)
-{
-    RefPtr<FilterEffect> addedEffect = FETurbulence::create(static_cast<TurbulanceType> (type()), baseFrequencyX(), 
+    RefPtr<FilterEffect> effect = FETurbulence::create(static_cast<TurbulanceType>(type()), baseFrequencyX(), 
                                         baseFrequencyY(), numOctaves(), seed(), stitchTiles() == SVG_STITCHTYPE_STITCH);
-    builder->add(result(), addedEffect.release());
+    filterResource->addFilterEffect(this, effect.release());
 
     return true;
 }
diff --git a/WebCore/svg/SVGFETurbulenceElement.h b/WebCore/svg/SVGFETurbulenceElement.h
index bae2d9b..3c95da8 100644
--- a/WebCore/svg/SVGFETurbulenceElement.h
+++ b/WebCore/svg/SVGFETurbulenceElement.h
@@ -23,7 +23,7 @@
 #ifndef SVGFETurbulenceElement_h
 #define SVGFETurbulenceElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFETurbulence.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
@@ -44,8 +44,7 @@
         virtual ~SVGFETurbulenceElement();
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const;
-        bool build(FilterBuilder*);
+        virtual bool build(SVGResourceFilter*);
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGBaseFrequencyXIdentifier, float, BaseFrequencyX, baseFrequencyX)
@@ -54,8 +53,6 @@
         ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGNames::seedAttrString, float, Seed, seed)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGNames::stitchTilesAttrString, int, StitchTiles, stitchTiles)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFETurbulenceElement, SVGNames::feTurbulenceTagString, SVGNames::typeAttrString, int, Type, type)
-
-        mutable RefPtr<FETurbulence> m_filterEffect;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFETurbulenceElement.idl b/WebCore/svg/SVGFETurbulenceElement.idl
index 79fc63f..9cec66c 100644
--- a/WebCore/svg/SVGFETurbulenceElement.idl
+++ b/WebCore/svg/SVGFETurbulenceElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS, GenerateConstructor] SVGFETurbulenceElement : SVGElement,
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFETurbulenceElement : SVGElement,
                                                          SVGFilterPrimitiveStandardAttributes { 
         // Turbulence Types
         const unsigned short SVG_TURBULENCE_TYPE_UNKNOWN      = 0;
diff --git a/WebCore/svg/SVGFilterElement.cpp b/WebCore/svg/SVGFilterElement.cpp
index 774232f..7703b6f 100644
--- a/WebCore/svg/SVGFilterElement.cpp
+++ b/WebCore/svg/SVGFilterElement.cpp
@@ -23,14 +23,17 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterElement.h"
 
 #include "Attr.h"
-#include "SVGResourceFilter.h"
+#include "SVGFilterBuilder.h"
+#include "MappedAttribute.h"
+#include "PlatformString.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
+#include "SVGResourceFilter.h"
 #include "SVGUnitTypes.h"
 
 namespace WebCore {
@@ -130,19 +133,18 @@
     bool primitiveBBoxMode = primitiveUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
     m_filter->setEffectBoundingBoxMode(primitiveBBoxMode);
 
-    // TODO : use switch/case instead?
-    m_filter->clearEffects();
+    m_filter->builder()->clearEffects();
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         SVGElement* element = 0;
-        if (n->isSVGElement())
+        if (n->isSVGElement()) {
             element = static_cast<SVGElement*>(n);
-        if (element && element->isFilterEffect()) {
-            SVGFilterPrimitiveStandardAttributes* filterAttributes = static_cast<SVGFilterPrimitiveStandardAttributes*>(element);
-            SVGFilterEffect* filterEffect = filterAttributes->filterEffect(m_filter.get());
-            if (!filterEffect)
-                continue;
-
-            m_filter->addFilterEffect(filterEffect);
+            if (element->isFilterEffect()) {
+                SVGFilterPrimitiveStandardAttributes* effectElement = static_cast<SVGFilterPrimitiveStandardAttributes*>(element);
+                if (!effectElement->build(m_filter.get())) {
+                    m_filter->builder()->clearEffects();
+                    break;
+                }
+            }
         }
     }
 
diff --git a/WebCore/svg/SVGFilterElement.h b/WebCore/svg/SVGFilterElement.h
index c907b9c..541ec14 100644
--- a/WebCore/svg/SVGFilterElement.h
+++ b/WebCore/svg/SVGFilterElement.h
@@ -24,7 +24,7 @@
 #ifndef SVGFilterElement_h
 #define SVGFilterElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGResourceFilter.h"
 #include "SVGExternalResourcesRequired.h"
 #include "SVGLangSpace.h"
diff --git a/WebCore/svg/SVGFilterElement.idl b/WebCore/svg/SVGFilterElement.idl
index 9d1e15a..10b4f5e 100644
--- a/WebCore/svg/SVGFilterElement.idl
+++ b/WebCore/svg/SVGFilterElement.idl
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_FILTERS] SVGFilterElement : SVGElement,
+    interface [Conditional=SVG&FILTERS] SVGFilterElement : SVGElement,
                                                    SVGURIReference,
                                                    SVGLangSpace,
                                                    SVGExternalResourcesRequired,
diff --git a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
index eab7bdd..13116a5 100644
--- a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
+++ b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
@@ -22,11 +22,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
-#include "SVGFilterElement.h"
-#include "SVGFilterEffect.h"
+#include "FilterEffect.h"
+#include "MappedAttribute.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
 #include "SVGStyledElement.h"
@@ -69,17 +69,17 @@
         return SVGStyledElement::parseMappedAttribute(attr);
 }
 
-void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGFilterEffect* filterEffect) const
+void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilter* resourceFilter, FilterEffect* filterEffect) const
 {
     ASSERT(filterEffect);
     if (!filterEffect)
         return;
 
-    ASSERT(filterEffect->filter());
+    ASSERT(resourceFilter);
 
     float _x, _y, _width, _height;
 
-    if (filterEffect->filter()->effectBoundingBoxMode()) {
+    if (resourceFilter->effectBoundingBoxMode()) {
         _x = x().valueAsPercentage();
         _y = y().valueAsPercentage();
         _width = width().valueAsPercentage();
@@ -120,7 +120,6 @@
     }
 
     filterEffect->setSubRegion(FloatRect(_x, _y, _width, _height));
-    filterEffect->setResult(result());
 }
 
 }
diff --git a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index bbdeb00..fa82f6a 100644
--- a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -23,15 +23,15 @@
 #ifndef SVGFilterPrimitiveStandardAttributes_h
 #define SVGFilterPrimitiveStandardAttributes_h
 
-#if ENABLE(SVG)
-#include "FilterBuilder.h"
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFilterBuilder.h"
+#include "SVGResourceFilter.h"
 #include "SVGStyledElement.h"
 
 namespace WebCore {
 
     extern char SVGFilterPrimitiveStandardAttributesIdentifier[];
 
-    class SVGFilterEffect;
     class SVGResourceFilter;
 
     class SVGFilterPrimitiveStandardAttributes : public SVGStyledElement {
@@ -42,13 +42,14 @@
         virtual bool isFilterEffect() const { return true; }
 
         virtual void parseMappedAttribute(MappedAttribute*);
-        virtual SVGFilterEffect* filterEffect(SVGResourceFilter*) const = 0;
+        virtual bool build(SVGResourceFilter*) = 0;
 
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
     protected:
+        friend class SVGResourceFilter;
+        void setStandardAttributes(SVGResourceFilter*, FilterEffect*) const;
         virtual const SVGElement* contextElement() const { return this; }
-        void setStandardAttributes(SVGFilterEffect*) const;
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterPrimitiveStandardAttributes, SVGFilterPrimitiveStandardAttributesIdentifier, SVGNames::xAttrString, SVGLength, X, x)
diff --git a/WebCore/svg/SVGFitToViewBox.cpp b/WebCore/svg/SVGFitToViewBox.cpp
index 13e4c03..847038c 100644
--- a/WebCore/svg/SVGFitToViewBox.cpp
+++ b/WebCore/svg/SVGFitToViewBox.cpp
@@ -25,13 +25,14 @@
 #if ENABLE(SVG)
 #include "SVGFitToViewBox.h"
 
-#include "TransformationMatrix.h"
 #include "Document.h"
 #include "FloatRect.h"
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGPreserveAspectRatio.h"
 #include "StringImpl.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGFont.cpp b/WebCore/svg/SVGFont.cpp
index 9b36f87..7e3cec0 100644
--- a/WebCore/svg/SVGFont.cpp
+++ b/WebCore/svg/SVGFont.cpp
@@ -533,6 +533,9 @@
                     context->beginPath();
                     context->addPath(identifier.pathData);
 
+                    // FIXME: setup() tries to get objectBoundingBox() from run.referencingRenderObject()
+                    // which is wrong.  We need to change setup() to take a bounding box instead, or pass
+                    // a RenderObject which would return the bounding box for identifier.pathData
                     if (activePaintServer->setup(context, run.referencingRenderObject(), targetType)) {
                         // Spec: Any properties specified on a text elements which represents a length, such as the
                         // 'stroke-width' property, might produce surprising results since the length value will be
diff --git a/WebCore/svg/SVGFontFaceElement.cpp b/WebCore/svg/SVGFontFaceElement.cpp
index 973e890..1e5a0fe 100644
--- a/WebCore/svg/SVGFontFaceElement.cpp
+++ b/WebCore/svg/SVGFontFaceElement.cpp
@@ -23,6 +23,7 @@
 
 #if ENABLE(SVG_FONTS)
 #include "SVGFontFaceElement.h"
+
 #include "CString.h"
 #include "CSSFontFaceRule.h"
 #include "CSSFontFaceSrcValue.h"
@@ -35,12 +36,12 @@
 #include "CSSValueList.h"
 #include "Document.h"
 #include "Font.h"
+#include "MappedAttribute.h"
 #include "SVGDefinitionSrcElement.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceSrcElement.h"
 #include "SVGGlyphElement.h"
 #include "SVGNames.h"
-
 #include <math.h>
 
 namespace WebCore {
diff --git a/WebCore/svg/SVGFontFaceUriElement.cpp b/WebCore/svg/SVGFontFaceUriElement.cpp
index 3509691..096f0c2 100644
--- a/WebCore/svg/SVGFontFaceUriElement.cpp
+++ b/WebCore/svg/SVGFontFaceUriElement.cpp
@@ -27,6 +27,7 @@
 #include "CachedFont.h"
 #include "DocLoader.h"
 #include "Document.h"
+#include "MappedAttribute.h"
 #include "SVGFontFaceElement.h"
 #include "SVGNames.h"
 #include "XLinkNames.h"
diff --git a/WebCore/svg/SVGForeignObjectElement.cpp b/WebCore/svg/SVGForeignObjectElement.cpp
index 342a6f0..5cfca8a 100644
--- a/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/WebCore/svg/SVGForeignObjectElement.cpp
@@ -26,10 +26,10 @@
 #include "SVGForeignObjectElement.h"
 
 #include "CSSPropertyNames.h"
+#include "MappedAttribute.h"
 #include "RenderForeignObject.h"
-#include "SVGNames.h"
 #include "SVGLength.h"
-
+#include "SVGNames.h"
 #include <wtf/Assertions.h>
 
 namespace WebCore {
@@ -113,7 +113,7 @@
         attrs->declRemoved();
     }
 
-    element->setChanged();
+    element->setNeedsStyleRecalc();
     element->addCSSProperty(mappedAttr, cssProperty, value);
 
     if (CSSMappedAttributeDeclaration* decl = mappedAttr->decl()) {
diff --git a/WebCore/svg/SVGGlyphElement.cpp b/WebCore/svg/SVGGlyphElement.cpp
index ebf5dd0..7be0181 100644
--- a/WebCore/svg/SVGGlyphElement.cpp
+++ b/WebCore/svg/SVGGlyphElement.cpp
@@ -24,9 +24,10 @@
 #if ENABLE(SVG_FONTS)
 #include "SVGGlyphElement.h"
 
+#include "MappedAttribute.h"
+#include "SVGFontData.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceElement.h"
-#include "SVGFontData.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SimpleFontData.h"
diff --git a/WebCore/svg/SVGGlyphElement.h b/WebCore/svg/SVGGlyphElement.h
index 62ae263..0662097 100644
--- a/WebCore/svg/SVGGlyphElement.h
+++ b/WebCore/svg/SVGGlyphElement.h
@@ -31,7 +31,7 @@
 namespace WebCore {
 
     class AtomicString;
-    struct SVGFontData;
+    class SVGFontData;
 
     // Describe a SVG <glyph> element
     struct SVGGlyphIdentifier {
diff --git a/WebCore/svg/SVGGradientElement.cpp b/WebCore/svg/SVGGradientElement.cpp
index e4e3213..8034286 100644
--- a/WebCore/svg/SVGGradientElement.cpp
+++ b/WebCore/svg/SVGGradientElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGGradientElement.h"
 
 #include "CSSStyleSelector.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "RenderSVGHiddenContainer.h"
 #include "SVGNames.h"
diff --git a/WebCore/svg/SVGHKernElement.h b/WebCore/svg/SVGHKernElement.h
index 6fda779..32772bd 100644
--- a/WebCore/svg/SVGHKernElement.h
+++ b/WebCore/svg/SVGHKernElement.h
@@ -31,7 +31,7 @@
 namespace WebCore {
 
     class AtomicString;
-    struct SVGFontData;
+    class SVGFontData;
 
     // Describe an SVG <hkern> element
     struct SVGHorizontalKerningPair {
diff --git a/WebCore/svg/SVGImageElement.cpp b/WebCore/svg/SVGImageElement.cpp
index c827c89..9aff93d 100644
--- a/WebCore/svg/SVGImageElement.cpp
+++ b/WebCore/svg/SVGImageElement.cpp
@@ -27,6 +27,7 @@
 #include "SVGImageElement.h"
 
 #include "CSSPropertyNames.h"
+#include "MappedAttribute.h"
 #include "RenderSVGImage.h"
 #include "SVGDocument.h"
 #include "SVGLength.h"
diff --git a/WebCore/svg/SVGImageLoader.cpp b/WebCore/svg/SVGImageLoader.cpp
index 4b15acb..9333f75 100644
--- a/WebCore/svg/SVGImageLoader.cpp
+++ b/WebCore/svg/SVGImageLoader.cpp
@@ -43,7 +43,7 @@
 void SVGImageLoader::dispatchLoadEvent()
 {
     if (image()->errorOccurred())
-        element()->dispatchEventForType(eventNames().errorEvent, false, false);
+        element()->dispatchEvent(eventNames().errorEvent, false, false);
     else {
         SVGImageElement* imageElement = static_cast<SVGImageElement*>(element());
         if (imageElement->externalResourcesRequiredBaseValue())
diff --git a/WebCore/svg/SVGLangSpace.cpp b/WebCore/svg/SVGLangSpace.cpp
index 099934d..d49e09a 100644
--- a/WebCore/svg/SVGLangSpace.cpp
+++ b/WebCore/svg/SVGLangSpace.cpp
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "SVGLangSpace.h"
 
+#include "MappedAttribute.h"
 #include "SVGElement.h"
 #include "XMLNames.h"
 #include <wtf/StdLibExtras.h>
diff --git a/WebCore/svg/SVGLineElement.cpp b/WebCore/svg/SVGLineElement.cpp
index 12f54e3..17c110c 100644
--- a/WebCore/svg/SVGLineElement.cpp
+++ b/WebCore/svg/SVGLineElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGLineElement.h"
 
 #include "FloatPoint.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
diff --git a/WebCore/svg/SVGLinearGradientElement.cpp b/WebCore/svg/SVGLinearGradientElement.cpp
index d2d1798..9927a50 100644
--- a/WebCore/svg/SVGLinearGradientElement.cpp
+++ b/WebCore/svg/SVGLinearGradientElement.cpp
@@ -28,6 +28,7 @@
 #include "Document.h"
 #include "FloatPoint.h"
 #include "LinearGradientAttributes.h"
+#include "MappedAttribute.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
 #include "SVGPaintServerLinearGradient.h"
diff --git a/WebCore/svg/SVGList.h b/WebCore/svg/SVGList.h
index d4f7641..5381598 100644
--- a/WebCore/svg/SVGList.h
+++ b/WebCore/svg/SVGList.h
@@ -96,7 +96,11 @@
 
         Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode&)
         {
-            m_vector.insert(index, newItem);
+            if (index < m_vector.size()) {
+                m_vector.insert(index, newItem);
+            } else {
+                m_vector.append(newItem);
+            }
             return newItem;
         }
 
diff --git a/WebCore/svg/SVGLocatable.cpp b/WebCore/svg/SVGLocatable.cpp
index 002bf28..00acc2a 100644
--- a/WebCore/svg/SVGLocatable.cpp
+++ b/WebCore/svg/SVGLocatable.cpp
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Google, Inc.  All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -40,69 +39,52 @@
 {
 }
 
-SVGElement* SVGLocatable::nearestViewportElement(const SVGElement* e)
+static bool isViewportElement(Node* node)
 {
-    Node* n = e->parentNode();
-    while (n && !n->isDocumentNode()) {
-        if (n->hasTagName(SVGNames::svgTag) || n->hasTagName(SVGNames::symbolTag) ||
-            n->hasTagName(SVGNames::imageTag))
-            return static_cast<SVGElement*>(n);
+    return (node->hasTagName(SVGNames::svgTag)
+        || node->hasTagName(SVGNames::symbolTag)
 #if ENABLE(SVG_FOREIGN_OBJECT)
-        if (n->hasTagName(SVGNames::foreignObjectTag))
-            return static_cast<SVGElement*>(n);
+        || node->hasTagName(SVGNames::foreignObjectTag)
 #endif
+        || node->hasTagName(SVGNames::imageTag));
+}
 
-        n = n->parentNode();
+SVGElement* SVGLocatable::nearestViewportElement(const SVGElement* element)
+{
+    ASSERT(element);
+    for (Node* n = element->parentNode(); n && !n->isDocumentNode(); n = n->parentNode()) {
+        if (isViewportElement(n))
+            return static_cast<SVGElement*>(n);
     }
 
     return 0;
 }
 
-SVGElement* SVGLocatable::farthestViewportElement(const SVGElement* e)
+SVGElement* SVGLocatable::farthestViewportElement(const SVGElement* element)
 {
-    // FIXME : likely this will be always the <svg> farthest away.
-    // If we have a different implementation of documentElement(), one
-    // that give the documentElement() of the svg fragment, it could be
-    // used instead. This depends on cdf demands though(Rob.)
+    ASSERT(element);
     SVGElement* farthest = 0;
-    Node* n = e->parentNode();
-    while (n && !n->isDocumentNode()) {
-        if (n->hasTagName(SVGNames::svgTag) || n->hasTagName(SVGNames::symbolTag) ||
-            n->hasTagName(SVGNames::imageTag))
+    for (Node* n = element->parentNode(); n && !n->isDocumentNode(); n = n->parentNode()) {
+        if (isViewportElement(n))
             farthest = static_cast<SVGElement*>(n);
-#if ENABLE(SVG_FOREIGN_OBJECT)
-        if (n->hasTagName(SVGNames::foreignObjectTag))
-            farthest = static_cast<SVGElement*>(n);
-#endif
-
-        n = n->parentNode();
     }
-
     return farthest;
 }
 
-// Spec:
-// http://www.w3.org/TR/2005/WD-SVGMobile12-20050413/svgudom.html#svg::SVGLocatable
-FloatRect SVGLocatable::getBBox(const SVGElement* e)
+FloatRect SVGLocatable::getBBox(const SVGElement* element)
 {
-    FloatRect bboxRect;
+    element->document()->updateLayoutIgnorePendingStylesheets();
 
-    e->document()->updateLayoutIgnorePendingStylesheets();
+    // FIXME: Eventually we should support getBBox for detached elements.
+    if (!element->renderer())
+        return FloatRect();
 
-    if (e && e->renderer()) {
-        // Need this to make sure we have render object dimensions.
-        // See bug 11686.
-        bboxRect = e->renderer()->relativeBBox(false);
-    }
-
-    return bboxRect;
+    return element->renderer()->objectBoundingBox();
 }
 
 TransformationMatrix SVGLocatable::getCTM(const SVGElement* element)
 {
-    if (!element)
-        return TransformationMatrix();
-
+    ASSERT(element);
     TransformationMatrix ctm;
 
     Node* parent = element->parentNode();
@@ -119,9 +101,7 @@
 
 TransformationMatrix SVGLocatable::getScreenCTM(const SVGElement* element)
 {
-    if (!element)
-        return TransformationMatrix();
-
+    ASSERT(element);
     TransformationMatrix ctm;
 
     Node* parent = element->parentNode();
diff --git a/WebCore/svg/SVGMarkerElement.cpp b/WebCore/svg/SVGMarkerElement.cpp
index a89c478..5580993 100644
--- a/WebCore/svg/SVGMarkerElement.cpp
+++ b/WebCore/svg/SVGMarkerElement.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGMarkerElement.h"
 
+#include "MappedAttribute.h"
 #include "PlatformString.h"
 #include "RenderSVGViewportContainer.h"
 #include "SVGAngle.h"
diff --git a/WebCore/svg/SVGMaskElement.cpp b/WebCore/svg/SVGMaskElement.cpp
index 9f9ae34..59a5e01 100644
--- a/WebCore/svg/SVGMaskElement.cpp
+++ b/WebCore/svg/SVGMaskElement.cpp
@@ -29,6 +29,7 @@
 #include "CSSStyleSelector.h"
 #include "GraphicsContext.h"
 #include "ImageBuffer.h"
+#include "MappedAttribute.h"
 #include "RenderSVGContainer.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
@@ -124,7 +125,7 @@
     m_masker->invalidate();
 }
 
-auto_ptr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targetRect, FloatRect& maskDestRect) const
+PassOwnPtr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targetRect, FloatRect& maskDestRect) const
 {    
     // Determine specified mask size
     float xValue;
@@ -145,7 +146,7 @@
     } 
 
     IntSize imageSize(lroundf(widthValue), lroundf(heightValue));
-    clampImageBufferSizeToViewport(document()->renderer(), imageSize);
+    clampImageBufferSizeToViewport(document()->view(), imageSize);
 
     if (imageSize.width() < static_cast<int>(widthValue))
         widthValue = imageSize.width();
@@ -153,9 +154,9 @@
     if (imageSize.height() < static_cast<int>(heightValue))
         heightValue = imageSize.height();
 
-    auto_ptr<ImageBuffer> maskImage = ImageBuffer::create(imageSize, false);
-    if (!maskImage.get())
-        return maskImage;
+    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(imageSize, false);
+    if (!maskImage)
+        return 0;
 
     maskDestRect = FloatRect(xValue, yValue, widthValue, heightValue);
     if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
@@ -192,7 +193,7 @@
         maskImageContext->restore();
 
     maskImageContext->restore();
-    return maskImage;
+    return maskImage.release();
 }
  
 RenderObject* SVGMaskElement::createRenderer(RenderArena* arena, RenderStyle*)
diff --git a/WebCore/svg/SVGMaskElement.h b/WebCore/svg/SVGMaskElement.h
index 4bcf82f..f2b7ae5 100644
--- a/WebCore/svg/SVGMaskElement.h
+++ b/WebCore/svg/SVGMaskElement.h
@@ -29,6 +29,7 @@
 #include "SVGStyledLocatableElement.h"
 #include "SVGTests.h"
 #include "SVGURIReference.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -51,7 +52,7 @@
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         virtual SVGResource* canvasResource();
 
-        std::auto_ptr<ImageBuffer> drawMaskerContent(const FloatRect& targetRect, FloatRect& maskRect) const;
+        PassOwnPtr<ImageBuffer> drawMaskerContent(const FloatRect& targetRect, FloatRect& maskRect) const;
 
     protected:
         virtual const SVGElement* contextElement() const { return this; }
diff --git a/WebCore/svg/SVGPathElement.cpp b/WebCore/svg/SVGPathElement.cpp
index bdd60e5..172cac1 100644
--- a/WebCore/svg/SVGPathElement.cpp
+++ b/WebCore/svg/SVGPathElement.cpp
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "SVGPathElement.h"
 
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
diff --git a/WebCore/svg/SVGPathSeg.idl b/WebCore/svg/SVGPathSeg.idl
index 3076750..597b01d 100644
--- a/WebCore/svg/SVGPathSeg.idl
+++ b/WebCore/svg/SVGPathSeg.idl
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,7 +26,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, GenerateConstructor, ObjCCustomInternalImpl] SVGPathSeg {
+    interface [Conditional=SVG, GenerateConstructor, Polymorphic] SVGPathSeg {
         // Path Segment Types
         const unsigned short PATHSEG_UNKNOWN                      = 0;
         const unsigned short PATHSEG_CLOSEPATH                    = 1;
diff --git a/WebCore/svg/SVGPatternElement.cpp b/WebCore/svg/SVGPatternElement.cpp
index 5d21b94..cfae425 100644
--- a/WebCore/svg/SVGPatternElement.cpp
+++ b/WebCore/svg/SVGPatternElement.cpp
@@ -25,26 +25,26 @@
 #if ENABLE(SVG)
 #include "SVGPatternElement.h"
 
-#include "TransformationMatrix.h"
 #include "Document.h"
 #include "FloatConversion.h"
 #include "GraphicsContext.h"
 #include "ImageBuffer.h"
+#include "MappedAttribute.h"
 #include "PatternAttributes.h"
 #include "RenderSVGContainer.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
 #include "SVGPaintServerPattern.h"
 #include "SVGRenderSupport.h"
-#include "SVGStyledTransformableElement.h"
 #include "SVGSVGElement.h"
+#include "SVGStyledTransformableElement.h"
 #include "SVGTransformList.h"
 #include "SVGTransformable.h"
 #include "SVGUnitTypes.h"
-
+#include "TransformationMatrix.h"
 #include <math.h>
-#include <wtf/OwnPtr.h>
 #include <wtf/MathExtras.h>
+#include <wtf/OwnPtr.h>
 
 using namespace std;
 
@@ -177,7 +177,7 @@
         patternBoundaries.setHeight(targetRect.height());
 
     IntSize patternSize(patternBoundaries.width(), patternBoundaries.height());
-    clampImageBufferSizeToViewport(document()->renderer(), patternSize);
+    clampImageBufferSizeToViewport(document()->view(), patternSize);
 
     if (patternSize.width() < static_cast<int>(patternBoundaries.width()))
         patternBoundaries.setWidth(patternSize.width());
@@ -191,7 +191,7 @@
         for (Node* n = attributes.patternContentElement()->firstChild(); n; n = n->nextSibling()) {
             if (!n->isSVGElement() || !static_cast<SVGElement*>(n)->isStyledTransformable() || !n->renderer())
                 continue;
-            patternContentBoundaries.unite(n->renderer()->relativeBBox(true));
+            patternContentBoundaries.unite(n->renderer()->repaintRectInLocalCoordinates());
         }
     }
 
@@ -212,11 +212,11 @@
     }
 
     IntSize imageSize(lroundf(patternBoundariesIncludingOverflow.width()), lroundf(patternBoundariesIncludingOverflow.height()));
-    clampImageBufferSizeToViewport(document()->renderer(), imageSize);
+    clampImageBufferSizeToViewport(document()->view(), imageSize);
 
-    auto_ptr<ImageBuffer> patternImage = ImageBuffer::create(imageSize, false);
+    OwnPtr<ImageBuffer> patternImage = ImageBuffer::create(imageSize, false);
 
-    if (!patternImage.get())
+    if (!patternImage)
         return;
 
     GraphicsContext* context = patternImage->context();
@@ -251,7 +251,7 @@
 
     m_resource->setPatternTransform(attributes.patternTransform());
     m_resource->setPatternBoundaries(patternBoundaries); 
-    m_resource->setTile(patternImage);
+    m_resource->setTile(patternImage.release());
 }
 
 RenderObject* SVGPatternElement::createRenderer(RenderArena* arena, RenderStyle*)
diff --git a/WebCore/svg/SVGPolyElement.cpp b/WebCore/svg/SVGPolyElement.cpp
index 3d15a43..db39c52 100644
--- a/WebCore/svg/SVGPolyElement.cpp
+++ b/WebCore/svg/SVGPolyElement.cpp
@@ -27,6 +27,7 @@
 
 #include "Document.h"
 #include "FloatPoint.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGAnimatedProperty.h"
 #include "SVGNames.h"
diff --git a/WebCore/svg/SVGRadialGradientElement.cpp b/WebCore/svg/SVGRadialGradientElement.cpp
index abc11fb..23a8579 100644
--- a/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/WebCore/svg/SVGRadialGradientElement.cpp
@@ -27,6 +27,7 @@
 
 #include "FloatConversion.h"
 #include "FloatPoint.h"
+#include "MappedAttribute.h"
 #include "RadialGradientAttributes.h"
 #include "RenderObject.h"
 #include "SVGLength.h"
diff --git a/WebCore/svg/SVGRectElement.cpp b/WebCore/svg/SVGRectElement.cpp
index 367e12e..bfb6205 100644
--- a/WebCore/svg/SVGRectElement.cpp
+++ b/WebCore/svg/SVGRectElement.cpp
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "SVGRectElement.h"
 
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
diff --git a/WebCore/svg/SVGSVGElement.cpp b/WebCore/svg/SVGSVGElement.cpp
index e66a16e..fcecd8c 100644
--- a/WebCore/svg/SVGSVGElement.cpp
+++ b/WebCore/svg/SVGSVGElement.cpp
@@ -24,7 +24,6 @@
 #if ENABLE(SVG)
 #include "SVGSVGElement.h"
 
-#include "TransformationMatrix.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "Document.h"
@@ -34,8 +33,10 @@
 #include "FloatRect.h"
 #include "Frame.h"
 #include "HTMLNames.h"
-#include "RenderSVGViewportContainer.h"
+#include "MappedAttribute.h"
 #include "RenderSVGRoot.h"
+#include "RenderSVGViewportContainer.h"
+#include "SMILTimeContainer.h"
 #include "SVGAngle.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
@@ -45,8 +46,9 @@
 #include "SVGViewElement.h"
 #include "SVGViewSpec.h"
 #include "SVGZoomEvent.h"
+#include "ScriptEventListener.h"
 #include "SelectionController.h"
-#include "SMILTimeContainer.h"
+#include "TransformationMatrix.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -220,13 +222,13 @@
 
         // Only handle events if we're the outermost <svg> element
         if (attr->name() == onunloadAttr)
-            document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().unloadEvent, attr);
+            document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
         else if (attr->name() == onresizeAttr)
-            document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().resizeEvent, attr);
+            document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attr));
         else if (attr->name() == onscrollAttr)
-            document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().scrollEvent, attr);
+            document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attr));
         else if (attr->name() == SVGNames::onzoomAttr)
-            document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().zoomEvent, attr);
+            document()->setWindowAttributeEventListener(eventNames().zoomEvent, createAttributeEventListener(document()->frame(), attr));
         else
             setListener = false;
  
@@ -235,9 +237,9 @@
     }
 
     if (attr->name() == onabortAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().abortEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onerrorAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().errorEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == SVGNames::xAttr)
         setXBaseValue(SVGLength(LengthModeWidth, attr->value()));
     else if (attr->name() == SVGNames::yAttr)
@@ -268,15 +270,34 @@
     }
 }
 
+// This hack will not handle the case where we're setting a width/height
+// on a root <svg> via svg.width.baseValue = when it has none.
+static void updateCSSForAttribute(SVGSVGElement* element, const QualifiedName& attrName, CSSPropertyID property, const SVGLength& value)
+{
+    Attribute* attribute = element->attributes(false)->getAttributeItem(attrName);
+    if (!attribute || !attribute->isMappedAttribute())
+        return;
+    element->addCSSProperty(static_cast<MappedAttribute*>(attribute), property, value.valueAsString());
+}
+
 void SVGSVGElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledElement::svgAttributeChanged(attrName);
 
+    // FIXME: Ugly, ugly hack to around that parseMappedAttribute is not called
+    // when svg.width.baseValue = 100 is evaluated.
+    // Thus the CSS length value for width is not updated, and width() calcWidth()
+    // calculations on RenderSVGRoot will be wrong.
+    // https://bugs.webkit.org/show_bug.cgi?id=25387
+    if (attrName == SVGNames::widthAttr)
+        updateCSSForAttribute(this, attrName, CSSPropertyWidth, widthBaseValue());
+    else if (attrName == SVGNames::heightAttr)
+        updateCSSForAttribute(this, attrName, CSSPropertyHeight, heightBaseValue());
+
     if (!renderer())
         return;
 
     if (attrName == SVGNames::xAttr || attrName == SVGNames::yAttr ||
-        attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr ||
         SVGTests::isKnownAttribute(attrName) ||
         SVGLangSpace::isKnownAttribute(attrName) ||
         SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
@@ -398,14 +419,14 @@
 TransformationMatrix SVGSVGElement::getScreenCTM() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    FloatPoint rootLocation;    
+    FloatPoint rootLocation;
 
     if (RenderObject* renderer = this->renderer()) {
         if (isOutermostSVG()) {
             // FIXME: This doesn't work correctly with CSS transforms.
             FloatPoint point;
             if (renderer->parent())
-                point = renderer->localToAbsolute(point, true);
+                point = renderer->localToAbsolute(point, false, true);
             rootLocation.move(point.x(), point.y());
         } else
             rootLocation.move(x().value(this), y().value(this));
@@ -477,6 +498,10 @@
 
 bool SVGSVGElement::isOutermostSVG() const
 {
+    // Element may not be in the document, pretend we're outermost for viewport(), getCTM(), etc.
+    if (!parentNode())
+        return true;
+
     // This is true whenever this is the outermost SVG, even if there are HTML elements outside it
     return !parentNode()->isSVGElement();
 }
diff --git a/WebCore/svg/SVGScriptElement.cpp b/WebCore/svg/SVGScriptElement.cpp
index 1b7f4d9..2ecf912 100644
--- a/WebCore/svg/SVGScriptElement.cpp
+++ b/WebCore/svg/SVGScriptElement.cpp
@@ -27,6 +27,7 @@
 
 #include "Document.h"
 #include "EventNames.h"
+#include "MappedAttribute.h"
 #include "SVGNames.h"
 
 namespace WebCore {
@@ -173,6 +174,11 @@
     return String();
 }
 
+String SVGScriptElement::forAttributeValue() const
+{
+    return String();
+}
+
 void SVGScriptElement::dispatchLoadEvent()
 {
     bool externalResourcesRequired = externalResourcesRequiredBaseValue();
@@ -203,7 +209,7 @@
 
 void SVGScriptElement::dispatchErrorEvent()
 {
-    dispatchEventForType(eventNames().errorEvent, true, false);
+    dispatchEvent(eventNames().errorEvent, true, false);
 }
 
 }
diff --git a/WebCore/svg/SVGScriptElement.h b/WebCore/svg/SVGScriptElement.h
index 090cd2d..f2efc8e 100644
--- a/WebCore/svg/SVGScriptElement.h
+++ b/WebCore/svg/SVGScriptElement.h
@@ -57,6 +57,8 @@
 
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
+        virtual bool shouldExecuteAsJavaScript() const { return false; }
+
     protected:
         virtual const SVGElement* contextElement() const { return this; }
         virtual bool haveLoadedRequiredResources();
@@ -65,6 +67,7 @@
         virtual String charsetAttributeValue() const;
         virtual String typeAttributeValue() const;
         virtual String languageAttributeValue() const;
+        virtual String forAttributeValue() const;
 
         virtual void dispatchLoadEvent();
         virtual void dispatchErrorEvent();
diff --git a/WebCore/svg/SVGStopElement.cpp b/WebCore/svg/SVGStopElement.cpp
index 4747824..51582d7 100644
--- a/WebCore/svg/SVGStopElement.cpp
+++ b/WebCore/svg/SVGStopElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGStopElement.h"
 
 #include "Document.h"
+#include "MappedAttribute.h"
 #include "RenderSVGGradientStop.h"
 #include "SVGGradientElement.h"
 #include "SVGNames.h"
@@ -51,7 +52,7 @@
         else
             setOffsetBaseValue(value.toFloat());
 
-        setChanged();
+        setNeedsStyleRecalc();
     } else
         SVGStyledElement::parseMappedAttribute(attr);
 }
diff --git a/WebCore/svg/SVGStyleElement.cpp b/WebCore/svg/SVGStyleElement.cpp
index 2f59680..72f70e6 100644
--- a/WebCore/svg/SVGStyleElement.cpp
+++ b/WebCore/svg/SVGStyleElement.cpp
@@ -22,6 +22,7 @@
 */
 
 #include "config.h"
+
 #if ENABLE(SVG)
 #include "SVGStyleElement.h"
 
@@ -29,6 +30,7 @@
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "XMLNames.h"
 #include <wtf/StdLibExtras.h>
 
diff --git a/WebCore/svg/SVGStyledElement.cpp b/WebCore/svg/SVGStyledElement.cpp
index 76303a9..98b6459 100644
--- a/WebCore/svg/SVGStyledElement.cpp
+++ b/WebCore/svg/SVGStyledElement.cpp
@@ -19,6 +19,7 @@
 */
 
 #include "config.h"
+
 #if ENABLE(SVG)
 #include "SVGStyledElement.h"
 
@@ -28,11 +29,12 @@
 #include "CString.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "PlatformString.h"
+#include "RenderObject.h"
 #include "SVGElement.h"
 #include "SVGElementInstance.h"
 #include "SVGNames.h"
-#include "RenderObject.h"
 #include "SVGRenderStyle.h"
 #include "SVGResource.h"
 #include "SVGSVGElement.h"
@@ -165,7 +167,7 @@
     int propId = SVGStyledElement::cssPropertyIdForSVGAttributeName(attrName);
     if (propId > 0) {
         addCSSProperty(attr, propId, attr->value());
-        setChanged();
+        setNeedsStyleRecalc();
         return;
     }
     
@@ -240,6 +242,9 @@
 
 PassRefPtr<CSSValue> SVGStyledElement::getPresentationAttribute(const String& name)
 {
+    if (!mappedAttributes())
+        return 0;
+
     Attribute* attr = mappedAttributes()->getAttributeItem(QualifiedName(nullAtom, name, nullAtom));
     if (!attr || !attr->isMappedAttribute() || !attr->style())
         return 0;
diff --git a/WebCore/svg/SVGStyledTransformableElement.cpp b/WebCore/svg/SVGStyledTransformableElement.cpp
index 901ab0f..b7cf979 100644
--- a/WebCore/svg/SVGStyledTransformableElement.cpp
+++ b/WebCore/svg/SVGStyledTransformableElement.cpp
@@ -26,11 +26,12 @@
 #include "SVGStyledTransformableElement.h"
 
 #include "Attr.h"
+#include "MappedAttribute.h"
 #include "RenderPath.h"
 #include "SVGDocument.h"
-#include "TransformationMatrix.h"
 #include "SVGStyledElement.h"
 #include "SVGTransformList.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGTests.cpp b/WebCore/svg/SVGTests.cpp
index 06a81f2..258c12c 100644
--- a/WebCore/svg/SVGTests.cpp
+++ b/WebCore/svg/SVGTests.cpp
@@ -25,6 +25,7 @@
 
 #include "DOMImplementation.h"
 #include "Language.h"
+#include "MappedAttribute.h"
 #include "SVGElement.h"
 #include "SVGNames.h"
 #include "SVGStringList.h"
diff --git a/WebCore/svg/SVGTextContentElement.cpp b/WebCore/svg/SVGTextContentElement.cpp
index 8b34c2c..067f35f 100644
--- a/WebCore/svg/SVGTextContentElement.cpp
+++ b/WebCore/svg/SVGTextContentElement.cpp
@@ -29,14 +29,15 @@
 #include "FloatPoint.h"
 #include "FloatRect.h"
 #include "Frame.h"
+#include "MappedAttribute.h"
 #include "Position.h"
 #include "RenderSVGText.h"
-#include "SelectionController.h"
 #include "SVGCharacterLayoutInfo.h"
-#include "SVGRootInlineBox.h"
-#include "SVGLength.h"
 #include "SVGInlineTextBox.h"
+#include "SVGLength.h"
 #include "SVGNames.h"
+#include "SVGRootInlineBox.h"
+#include "SelectionController.h"
 #include "XMLNames.h"
 #include <wtf/StdLibExtras.h>
 
@@ -370,7 +371,7 @@
     return walkerCallback;
 }
 
-long SVGTextContentElement::getNumberOfChars() const
+unsigned SVGTextContentElement::getNumberOfChars() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
@@ -384,12 +385,12 @@
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::TextLength).floatResult();
 }
 
-float SVGTextContentElement::getSubStringLength(long charnum, long nchars, ExceptionCode& ec) const
+float SVGTextContentElement::getSubStringLength(unsigned charnum, unsigned nchars, ExceptionCode& ec) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    long numberOfChars = getNumberOfChars();
-    if (charnum < 0 || nchars < 0 || charnum >= numberOfChars) {
+    unsigned numberOfChars = getNumberOfChars();
+    if (charnum >= numberOfChars) {
         ec = INDEX_SIZE_ERR;
         return 0.0f;
     }
@@ -397,11 +398,11 @@
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::SubStringLength, charnum, nchars).floatResult();
 }
 
-FloatPoint SVGTextContentElement::getStartPositionOfChar(long charnum, ExceptionCode& ec) const
+FloatPoint SVGTextContentElement::getStartPositionOfChar(unsigned charnum, ExceptionCode& ec) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (charnum < 0 || charnum > getNumberOfChars()) {
+    if (charnum > getNumberOfChars()) {
         ec = INDEX_SIZE_ERR;
         return FloatPoint();
     }
@@ -409,11 +410,11 @@
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::StartPosition, charnum).pointResult();
 }
 
-FloatPoint SVGTextContentElement::getEndPositionOfChar(long charnum, ExceptionCode& ec) const
+FloatPoint SVGTextContentElement::getEndPositionOfChar(unsigned charnum, ExceptionCode& ec) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (charnum < 0 || charnum > getNumberOfChars()) {
+    if (charnum > getNumberOfChars()) {
         ec = INDEX_SIZE_ERR;
         return FloatPoint();
     }
@@ -421,11 +422,11 @@
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::EndPosition, charnum).pointResult();
 }
 
-FloatRect SVGTextContentElement::getExtentOfChar(long charnum, ExceptionCode& ec) const
+FloatRect SVGTextContentElement::getExtentOfChar(unsigned charnum, ExceptionCode& ec) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (charnum < 0 || charnum > getNumberOfChars()) {
+    if (charnum > getNumberOfChars()) {
         ec = INDEX_SIZE_ERR;
         return FloatRect();
     }
@@ -433,11 +434,11 @@
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::Extent, charnum).rectResult();
 }
 
-float SVGTextContentElement::getRotationOfChar(long charnum, ExceptionCode& ec) const
+float SVGTextContentElement::getRotationOfChar(unsigned charnum, ExceptionCode& ec) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (charnum < 0 || charnum > getNumberOfChars()) {
+    if (charnum > getNumberOfChars()) {
         ec = INDEX_SIZE_ERR;
         return 0.0f;
     }
@@ -445,17 +446,17 @@
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::Rotation, charnum).floatResult();
 }
 
-long SVGTextContentElement::getCharNumAtPosition(const FloatPoint& point) const
+int SVGTextContentElement::getCharNumAtPosition(const FloatPoint& point) const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
     return executeTextQuery(this, SVGInlineTextBoxQueryWalker::CharacterNumberAtPosition, 0.0f, 0.0f, point).longResult();
 }
 
-void SVGTextContentElement::selectSubString(long charnum, long nchars, ExceptionCode& ec) const
+void SVGTextContentElement::selectSubString(unsigned charnum, unsigned nchars, ExceptionCode& ec) const
 {
-    long numberOfChars = getNumberOfChars();
-    if (charnum < 0 || nchars < 0 || charnum >= numberOfChars) {
+    unsigned numberOfChars = getNumberOfChars();
+    if (charnum >= numberOfChars) {
         ec = INDEX_SIZE_ERR;
         return;
     }
@@ -472,12 +473,12 @@
 
     // Find selection start
     VisiblePosition start(const_cast<SVGTextContentElement*>(this), 0, SEL_DEFAULT_AFFINITY);
-    for (long i = 0; i < charnum; ++i)
+    for (unsigned i = 0; i < charnum; ++i)
         start = start.next();
 
     // Find selection end
     VisiblePosition end(start);
-    for (long i = 0; i < nchars; ++i)
+    for (unsigned i = 0; i < nchars; ++i)
         end = end.next();
 
     controller->setSelection(VisibleSelection(start, end));
diff --git a/WebCore/svg/SVGTextContentElement.h b/WebCore/svg/SVGTextContentElement.h
index d6b9d93..9933b2c 100644
--- a/WebCore/svg/SVGTextContentElement.h
+++ b/WebCore/svg/SVGTextContentElement.h
@@ -52,15 +52,15 @@
         virtual bool isValid() const { return SVGTests::isValid(); }
         virtual bool isTextContent() const { return true; }
 
-        long getNumberOfChars() const;
+        unsigned getNumberOfChars() const;
         float getComputedTextLength() const;
-        float getSubStringLength(long charnum, long nchars, ExceptionCode&) const;
-        FloatPoint getStartPositionOfChar(long charnum, ExceptionCode&) const;
-        FloatPoint getEndPositionOfChar(long charnum, ExceptionCode&) const;
-        FloatRect getExtentOfChar(long charnum, ExceptionCode&) const;
-        float getRotationOfChar(long charnum, ExceptionCode&) const;
-        long getCharNumAtPosition(const FloatPoint&) const;
-        void selectSubString(long charnum, long nchars, ExceptionCode&) const;
+        float getSubStringLength(unsigned charnum, unsigned nchars, ExceptionCode&) const;
+        FloatPoint getStartPositionOfChar(unsigned charnum, ExceptionCode&) const;
+        FloatPoint getEndPositionOfChar(unsigned charnum, ExceptionCode&) const;
+        FloatRect getExtentOfChar(unsigned charnum, ExceptionCode&) const;
+        float getRotationOfChar(unsigned charnum, ExceptionCode&) const;
+        int getCharNumAtPosition(const FloatPoint&) const;
+        void selectSubString(unsigned charnum, unsigned nchars, ExceptionCode&) const;
 
         virtual void parseMappedAttribute(MappedAttribute*);
 
diff --git a/WebCore/svg/SVGTextContentElement.idl b/WebCore/svg/SVGTextContentElement.idl
index e4e0163..394b398 100644
--- a/WebCore/svg/SVGTextContentElement.idl
+++ b/WebCore/svg/SVGTextContentElement.idl
@@ -40,20 +40,20 @@
 
         long getNumberOfChars();
         float getComputedTextLength();
-        float getSubStringLength(in unsigned long offset, 
-                                 in unsigned long length)
+        float getSubStringLength(in [IsIndex] unsigned long offset, 
+                                 in [IsIndex] unsigned long length)
             raises(DOMException);
-        SVGPoint getStartPositionOfChar(in unsigned long offset)
+        SVGPoint getStartPositionOfChar(in [IsIndex] unsigned long offset)
             raises(DOMException);
-        SVGPoint getEndPositionOfChar(in unsigned long offset)
+        SVGPoint getEndPositionOfChar(in [IsIndex] unsigned long offset)
             raises(DOMException);
-        SVGRect getExtentOfChar(in unsigned long offset)
+        SVGRect getExtentOfChar(in [IsIndex] unsigned long offset)
             raises(DOMException);
-        float getRotationOfChar(in unsigned long offset)
+        float getRotationOfChar(in [IsIndex] unsigned long offset)
             raises(DOMException);
         long getCharNumAtPosition(in SVGPoint point);
-        void selectSubString(in unsigned long offset, 
-                             in unsigned long length)
+        void selectSubString(in [IsIndex] unsigned long offset, 
+                             in [IsIndex] unsigned long length)
             raises(DOMException);
     };
 
diff --git a/WebCore/svg/SVGTextElement.cpp b/WebCore/svg/SVGTextElement.cpp
index b2ee798..b8c7331 100644
--- a/WebCore/svg/SVGTextElement.cpp
+++ b/WebCore/svg/SVGTextElement.cpp
@@ -25,13 +25,14 @@
 #if ENABLE(SVG)
 #include "SVGTextElement.h"
 
-#include "TransformationMatrix.h"
 #include "FloatRect.h"
+#include "MappedAttribute.h"
 #include "RenderSVGText.h"
 #include "SVGLengthList.h"
 #include "SVGRenderStyle.h"
 #include "SVGTSpanElement.h"
 #include "SVGTransformList.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGTextPathElement.cpp b/WebCore/svg/SVGTextPathElement.cpp
index f7f974b..0d8560a 100644
--- a/WebCore/svg/SVGTextPathElement.cpp
+++ b/WebCore/svg/SVGTextPathElement.cpp
@@ -24,14 +24,14 @@
 #if ENABLE(SVG)
 #include "SVGTextPathElement.h"
 
-#include "TransformationMatrix.h"
 #include "FloatRect.h"
+#include "MappedAttribute.h"
 #include "RenderSVGTextPath.h"
 #include "SVGLengthList.h"
 #include "SVGPathElement.h"
 #include "SVGRenderStyle.h"
-#include "SVGTextPathElement.h"
 #include "SVGTransformList.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGTextPositioningElement.cpp b/WebCore/svg/SVGTextPositioningElement.cpp
index e9ceaa1..32d9dc0 100644
--- a/WebCore/svg/SVGTextPositioningElement.cpp
+++ b/WebCore/svg/SVGTextPositioningElement.cpp
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "SVGTextPositioningElement.h"
 
+#include "MappedAttribute.h"
 #include "SVGLengthList.h"
 #include "SVGNames.h"
 #include "SVGNumberList.h"
diff --git a/WebCore/svg/SVGURIReference.cpp b/WebCore/svg/SVGURIReference.cpp
index d18e49a..8871229 100644
--- a/WebCore/svg/SVGURIReference.cpp
+++ b/WebCore/svg/SVGURIReference.cpp
@@ -23,6 +23,8 @@
 #if ENABLE(SVG)
 #include "SVGURIReference.h"
 
+#include "MappedAttribute.h"
+
 namespace WebCore {
 
 char SVGURIReferenceIdentifier[] = "SVGURIReference";
diff --git a/WebCore/svg/SVGUseElement.cpp b/WebCore/svg/SVGUseElement.cpp
index 4ae0f5c..b73a692 100644
--- a/WebCore/svg/SVGUseElement.cpp
+++ b/WebCore/svg/SVGUseElement.cpp
@@ -22,12 +22,6 @@
 
 #include "config.h"
 
-// Dump SVGElementInstance object tree - useful to debug instanceRoot problems
-// #define DUMP_INSTANCE_TREE
-
-// Dump the deep-expanded shadow tree (where the renderes are built from)
-// #define DUMP_SHADOW_TREE
-
 #if ENABLE(SVG)
 #include "SVGUseElement.h"
 
@@ -37,6 +31,7 @@
 #include "Event.h"
 #include "EventListener.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "NodeRenderStyle.h"
 #include "RegisteredEventListener.h"
 #include "RenderSVGTransformableContainer.h"
@@ -51,6 +46,12 @@
 #include "XLinkNames.h"
 #include "XMLSerializer.h"
 
+// Dump SVGElementInstance object tree - useful to debug instanceRoot problems
+// #define DUMP_INSTANCE_TREE
+
+// Dump the deep-expanded shadow tree (where the renderers are built from)
+// #define DUMP_SHADOW_TREE
+
 namespace WebCore {
 
 SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* doc)
@@ -138,7 +139,7 @@
         buildPendingResource();
 
         if (m_shadowTreeRootElement)
-            m_shadowTreeRootElement->setChanged();
+            m_shadowTreeRootElement->setNeedsStyleRecalc();
     }
 }
 
@@ -152,7 +153,7 @@
     buildPendingResource();
 
     if (m_shadowTreeRootElement)
-        m_shadowTreeRootElement->setChanged();
+        m_shadowTreeRootElement->setNeedsStyleRecalc();
 }
  
 static bool shadowTreeContainsChangedNodes(SVGElementInstance* target)
@@ -169,11 +170,11 @@
 
 void SVGUseElement::recalcStyle(StyleChange change)
 {
-    if (attached() && changed() && shadowTreeContainsChangedNodes(m_targetElementInstance.get())) {
+    if (attached() && needsStyleRecalc() && shadowTreeContainsChangedNodes(m_targetElementInstance.get())) {
         buildPendingResource();
 
         if (m_shadowTreeRootElement)
-            m_shadowTreeRootElement->setChanged();
+            m_shadowTreeRootElement->setNeedsStyleRecalc();
     }
 
     SVGStyledElement::recalcStyle(change);
@@ -186,7 +187,7 @@
     // Mimic Element::recalcStyle(). The main difference is that we don't call attach() on the
     // shadow tree root element, but call attachShadowTree() here. Calling attach() will crash
     // as the shadow tree root element has no (direct) parent node. Yes, shadow trees are tricky.
-    if (change >= Inherit || m_shadowTreeRootElement->changed()) {
+    if (change >= Inherit || m_shadowTreeRootElement->needsStyleRecalc()) {
         RefPtr<RenderStyle> newStyle = document()->styleSelector()->styleForElement(m_shadowTreeRootElement.get());
         StyleChange ch = Node::diff(m_shadowTreeRootElement->renderStyle(), newStyle.get());
         if (ch == Detach) {
@@ -195,8 +196,8 @@
             attachShadowTree();
 
             // attach recalulates the style for all children. No need to do it twice.
-            m_shadowTreeRootElement->setChanged(NoStyleChange);
-            m_shadowTreeRootElement->setHasChangedChild(false);
+            m_shadowTreeRootElement->setNeedsStyleRecalc(NoStyleChange);
+            m_shadowTreeRootElement->setChildNeedsStyleRecalc(false);
             return;
         }
     }
@@ -835,7 +836,11 @@
 {
     ASSERT(element);
     ASSERT(instance);
-    ASSERT(instance->shadowTreeElement());
+
+    // We're dispatching a mutation event during shadow tree construction
+    // this instance hasn't yet been associated to a shadowTree element.
+    if (!instance->shadowTreeElement())
+        return 0;
 
     if (element == instance->shadowTreeElement())
         return instance;
diff --git a/WebCore/svg/SVGViewElement.cpp b/WebCore/svg/SVGViewElement.cpp
index cb16b62..61cb397 100644
--- a/WebCore/svg/SVGViewElement.cpp
+++ b/WebCore/svg/SVGViewElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGViewElement.h"
 
 #include "Attr.h"
+#include "MappedAttribute.h"
 #include "PlatformString.h"
 #include "SVGFitToViewBox.h"
 #include "SVGNames.h"
diff --git a/WebCore/svg/SVGViewSpec.idl b/WebCore/svg/SVGViewSpec.idl
index 46d4c8e..24d18f8 100644
--- a/WebCore/svg/SVGViewSpec.idl
+++ b/WebCore/svg/SVGViewSpec.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG, ObjCCustomInternalImpl] SVGViewSpec : SVGZoomAndPan, SVGFitToViewBox
+    interface [Conditional=SVG] SVGViewSpec : SVGZoomAndPan, SVGFitToViewBox
     {
           readonly attribute SVGTransformList transform;
           readonly attribute SVGElement       viewTarget;
diff --git a/WebCore/svg/animation/SMILTime.h b/WebCore/svg/animation/SMILTime.h
index 5196030..ebbd765 100644
--- a/WebCore/svg/animation/SMILTime.h
+++ b/WebCore/svg/animation/SMILTime.h
@@ -62,8 +62,6 @@
     inline bool operator>=(const SMILTime& a, const SMILTime& b) { return a.value() > b.value() || operator==(a, b); }
     inline bool operator<=(const SMILTime& a, const SMILTime& b) { return a.value() < b.value() || operator==(a, b); }
 
-    inline SMILTime max(const SMILTime& a, const SMILTime& b) { return std::max(a.value(), b.value()); }
-    inline SMILTime min(const SMILTime& a, const SMILTime& b) { return std::min(a.value(), b.value()); }
     SMILTime operator+(const SMILTime&, const SMILTime&);
     SMILTime operator-(const SMILTime&, const SMILTime&);
     // So multiplying times does not make too much sense but SMIL defines it for duration * repeatCount
diff --git a/WebCore/svg/animation/SMILTimeContainer.cpp b/WebCore/svg/animation/SMILTimeContainer.cpp
index 48a2706..a37e481 100644
--- a/WebCore/svg/animation/SMILTimeContainer.cpp
+++ b/WebCore/svg/animation/SMILTimeContainer.cpp
@@ -276,7 +276,7 @@
 
     startTimer(earliersFireTime, animationFrameDelay);
     
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
 
 #endif
diff --git a/WebCore/svg/animation/SVGSMILElement.cpp b/WebCore/svg/animation/SVGSMILElement.cpp
index a2e2b0e..63a0d82 100644
--- a/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/WebCore/svg/animation/SVGSMILElement.cpp
@@ -24,6 +24,7 @@
  */
 
 #include "config.h"
+
 #if ENABLE(SVG_ANIMATION)
 #include "SVGSMILElement.h"
 
@@ -34,11 +35,12 @@
 #include "FloatConversion.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "SMILTimeContainer.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGSVGElement.h"
 #include "SVGURIReference.h"
-#include "SMILTimeContainer.h"
 #include "XLinkNames.h"
 #include <math.h>
 #include <wtf/MathExtras.h>
diff --git a/WebCore/svg/graphics/SVGImage.cpp b/WebCore/svg/graphics/SVGImage.cpp
index 067f645..2157144 100644
--- a/WebCore/svg/graphics/SVGImage.cpp
+++ b/WebCore/svg/graphics/SVGImage.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Eric Seidel (eric@webkit.org)
- * Copyright (C) 2008 Apple, Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,8 +35,9 @@
 #include "FrameLoader.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "HTMLFormElement.h"
+#include "ImageBuffer.h"
 #include "ImageObserver.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "RenderView.h"
 #include "ResourceError.h"
@@ -46,6 +47,9 @@
 #include "SVGSVGElement.h"
 #include "Settings.h"
 
+// Moving this #include above FrameLoader.h causes the Windows build to fail due to warnings about
+// alignment in Timer<FrameLoader>. It seems that the definition of EmptyFrameLoaderClient is what
+// causes this (removing that definition fixes the warnings), but it isn't clear why.
 #include "EmptyClients.h"
 
 namespace WebCore {
@@ -76,36 +80,33 @@
 
 SVGImage::SVGImage(ImageObserver* observer)
     : Image(observer)
-    , m_document(0)
-    , m_chromeClient(0)
-    , m_page(0)
-    , m_frame(0)
-    , m_frameView(0)
 {
 }
 
 SVGImage::~SVGImage()
 {
-    if (m_frame)
-        m_frame->loader()->frameDetached(); // Break both the loader and view references to the frame
+    if (m_page) {
+        m_page->mainFrame()->loader()->frameDetached(); // Break both the loader and view references to the frame
 
-    // Clear these manually so we can safely delete the ChromeClient afterwards
-    m_frameView.clear();
-    m_frame.clear();
-    m_page.clear();
-    
+        // Clear explicitly because we want to delete the page before the ChromeClient.
+        // FIXME: I believe that's already guaranteed by C++ object destruction rules,
+        // so this may matter only for the assertion below.
+        m_page.clear();
+    }
+
     // Verify that page teardown destroyed the Chrome
     ASSERT(!m_chromeClient->image());
 }
 
 void SVGImage::setContainerSize(const IntSize& containerSize)
 {
-    if (containerSize.width() <= 0 || containerSize.height() <= 0)
+    if (containerSize.isEmpty())
         return;
 
-    if (!m_frame)
+    if (!m_page)
         return;
-    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+    Frame* frame = m_page->mainFrame();
+    SVGSVGElement* rootElement = static_cast<SVGDocument*>(frame->document())->rootElement();
     if (!rootElement)
         return;
 
@@ -114,9 +115,10 @@
 
 bool SVGImage::usesContainerSize() const
 {
-    if (!m_frame)
+    if (!m_page)
         return false;
-    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+    Frame* frame = m_page->mainFrame();
+    SVGSVGElement* rootElement = static_cast<SVGDocument*>(frame->document())->rootElement();
     if (!rootElement)
         return false;
 
@@ -125,10 +127,10 @@
 
 IntSize SVGImage::size() const
 {
-    if (!m_frame)
+    if (!m_page)
         return IntSize();
-    
-    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+    Frame* frame = m_page->mainFrame();
+    SVGSVGElement* rootElement = static_cast<SVGDocument*>(frame->document())->rootElement();
     if (!rootElement)
         return IntSize();
     
@@ -151,9 +153,9 @@
 
 bool SVGImage::hasRelativeWidth() const
 {
-    if (!m_frame)
+    if (!m_page)
         return false;
-    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_page->mainFrame()->document())->rootElement();
     if (!rootElement)
         return false;
 
@@ -162,9 +164,9 @@
 
 bool SVGImage::hasRelativeHeight() const
 {
-    if (!m_frame)
+    if (!m_page)
         return false;
-    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+    SVGSVGElement* rootElement = static_cast<SVGDocument*>(m_page->mainFrame()->document())->rootElement();
     if (!rootElement)
         return false;
 
@@ -173,22 +175,24 @@
 
 void SVGImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator compositeOp)
 {
-    if (!m_frame)
+    if (!m_page)
         return;
-    
+
+    FrameView* view = m_page->mainFrame()->view();
+
     context->save();
     context->setCompositeOperation(compositeOp);
     context->clip(enclosingIntRect(dstRect));
     if (compositeOp != CompositeSourceOver)
-        context->beginTransparencyLayer(1.0f);
+        context->beginTransparencyLayer(1);
     context->translate(dstRect.location().x(), dstRect.location().y());
-    context->scale(FloatSize(dstRect.width()/srcRect.width(), dstRect.height()/srcRect.height()));
+    context->scale(FloatSize(dstRect.width() / srcRect.width(), dstRect.height() / srcRect.height()));
 
-    m_frame->view()->resize(size());
+    view->resize(size());
 
-    if (m_frame->view()->needsLayout())
-        m_frame->view()->layout();
-    m_frame->view()->paint(context, enclosingIntRect(srcRect));
+    if (view->needsLayout())
+        view->layout();
+    view->paint(context, enclosingIntRect(srcRect));
 
     if (compositeOp != CompositeSourceOver)
         context->endTransparencyLayer();
@@ -205,20 +209,22 @@
     // frame cache, or better yet, not use a cache for tiled drawing at all, instead
     // having a tiled drawing callback (hopefully non-virtual).
     if (!m_frameCache) {
-        m_frameCache.set(ImageBuffer::create(size(), false).release());
+        if (!m_page)
+            return 0;
+        m_frameCache = ImageBuffer::create(size(), false);
         if (!m_frameCache) // failed to allocate image
             return 0;
-        renderSubtreeToImage(m_frameCache.get(), m_frame->contentRenderer());
+        renderSubtreeToImage(m_frameCache.get(), m_page->mainFrame()->contentRenderer());
     }
     return m_frameCache->image()->nativeImageForCurrentFrame();
 }
 
 bool SVGImage::dataChanged(bool allDataReceived)
 {
-    int length = m_data->size();
-    if (!length) // if this was an empty image
+    // Don't do anything if is an empty image.
+    if (!m_data->size())
         return true;
-    
+
     if (allDataReceived) {
         static FrameLoaderClient* dummyFrameLoaderClient =  new EmptyFrameLoaderClient;
         static EditorClient* dummyEditorClient = new EmptyEditorClient;
@@ -228,28 +234,29 @@
 
         m_chromeClient.set(new SVGImageChromeClient(this));
         
-        // FIXME: If this SVG ends up loading itself, we'll leak this Frame (and associated DOM & render trees).
-        // The Cache code does not know about CachedImages holding Frames and won't know to break the cycle.
+        // FIXME: If this SVG ends up loading itself, we might leak the world.
+        // THe comment said that the Cache code does not know about CachedImages
+        // holding Frames and won't know to break the cycle. But 
         m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient));
         m_page->settings()->setJavaScriptEnabled(false);
         m_page->settings()->setPluginsEnabled(false);
 
-        m_frame = Frame::create(m_page.get(), 0, dummyFrameLoaderClient);
-        m_frameView = new FrameView(m_frame.get());
-        m_frameView->deref(); // FIXME: FrameView starts with a refcount of 1
-        m_frame->setView(m_frameView.get());
-        m_frame->init();
+        RefPtr<Frame> frame = Frame::create(m_page.get(), 0, dummyFrameLoaderClient);
+        frame->setView(FrameView::create(frame.get()));
+        frame->init();
         ResourceRequest fakeRequest(KURL(""));
-        m_frame->loader()->load(fakeRequest, false); // Make sure the DocumentLoader is created
-        m_frame->loader()->cancelContentPolicyCheck(); // cancel any policy checks
-        m_frame->loader()->commitProvisionalLoad(0);
-        m_frame->loader()->setResponseMIMEType("image/svg+xml");
-        m_frame->loader()->begin(KURL()); // create the empty document
-        m_frame->loader()->write(m_data->data(), m_data->size());
-        m_frame->loader()->end();
-        m_frameView->setTransparent(true); // SVG Images are transparent.
+        FrameLoader* loader = frame->loader();
+        loader->load(fakeRequest, false); // Make sure the DocumentLoader is created
+        loader->cancelContentPolicyCheck(); // cancel any policy checks
+        loader->commitProvisionalLoad(0);
+        loader->setResponseMIMEType("image/svg+xml");
+        loader->begin(KURL()); // create the empty document
+        loader->write(m_data->data(), m_data->size());
+        loader->end();
+        frame->view()->setTransparent(true); // SVG Images are transparent.
     }
-    return m_frameView;
+
+    return m_page;
 }
 
 }
diff --git a/WebCore/svg/graphics/SVGImage.h b/WebCore/svg/graphics/SVGImage.h
index 062c0a2..2cea91a 100644
--- a/WebCore/svg/graphics/SVGImage.h
+++ b/WebCore/svg/graphics/SVGImage.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Eric Seidel (eric@webkit.org)
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,15 +30,10 @@
 #if ENABLE(SVG)
 
 #include "Image.h"
-#include "ImageBuffer.h"
-#include "IntSize.h"
-#include <wtf/OwnPtr.h>
 
 namespace WebCore {
-    
-    class SVGDocument;
-    class Frame;
-    class FrameView;
+
+    class ImageBuffer;
     class Page;
     class SVGImageChromeClient;
     
@@ -72,12 +68,8 @@
         
         virtual NativeImagePtr nativeImageForCurrentFrame();
         
-        SVGDocument* m_document;
         OwnPtr<SVGImageChromeClient> m_chromeClient;
         OwnPtr<Page> m_page;
-        RefPtr<Frame> m_frame;
-        RefPtr<FrameView> m_frameView;
-        IntSize m_minSize;
         OwnPtr<ImageBuffer> m_frameCache;
     };
 }
diff --git a/WebCore/svg/graphics/SVGPaintServerGradient.cpp b/WebCore/svg/graphics/SVGPaintServerGradient.cpp
index eb0d80b..9ba224e 100644
--- a/WebCore/svg/graphics/SVGPaintServerGradient.cpp
+++ b/WebCore/svg/graphics/SVGPaintServerGradient.cpp
@@ -34,6 +34,7 @@
 #include "GraphicsContext.h"
 #include "ImageBuffer.h"
 #include "RenderObject.h"
+#include "RenderView.h"
 #include "SVGGradientElement.h"
 #include "SVGPaintServerLinearGradient.h"
 #include "SVGPaintServerRadialGradient.h"
@@ -130,15 +131,15 @@
     GraphicsContext*& context, GraphicsContext*& savedContext,
     OwnPtr<ImageBuffer>& imageBuffer, const RenderObject* object)
 {
-    FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->relativeBBox(false);
+    FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->objectBoundingBox();
     IntRect maskRect = enclosingIntRect(object->absoluteTransform().mapRect(maskBBox));
 
     IntSize maskSize(maskRect.width(), maskRect.height());
-    clampImageBufferSizeToViewport(object->document()->renderer(), maskSize);
+    clampImageBufferSizeToViewport(object->view()->frameView(), maskSize);
 
-    auto_ptr<ImageBuffer> maskImage = ImageBuffer::create(maskSize, false);
+    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskSize, false);
 
-    if (!maskImage.get())
+    if (!maskImage)
         return false;
 
     GraphicsContext* maskImageContext = maskImage->context();
@@ -159,14 +160,14 @@
     OwnPtr<ImageBuffer>& imageBuffer, const RenderObject* object,
     const SVGPaintServerGradient* gradientServer)
 {
-    FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->relativeBBox(false);
+    FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->objectBoundingBox();
 
     // Fixup transformations to be able to clip to mask
     TransformationMatrix transform = object->absoluteTransform();
     FloatRect textBoundary = transform.mapRect(maskBBox);
 
     IntSize maskSize(lroundf(textBoundary.width()), lroundf(textBoundary.height()));
-    clampImageBufferSizeToViewport(object->document()->renderer(), maskSize);
+    clampImageBufferSizeToViewport(object->view()->frameView(), maskSize);
     textBoundary.setSize(textBoundary.size().shrunkTo(maskSize));
 
     // Clip current context to mask image (gradient)
@@ -227,7 +228,7 @@
 #else
     if (boundingBoxMode()) {
 #endif
-        FloatRect bbox = object->relativeBBox(false);
+        FloatRect bbox = object->objectBoundingBox();
         // Don't use gradients for 1d objects like horizontal/vertical 
         // lines or rectangles without width or height.
         if (bbox.width() == 0 || bbox.height() == 0) {
@@ -258,7 +259,7 @@
         m_gradient->setGradientSpaceTransform(matrix);
         context->setFillGradient(m_gradient);
 
-        FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->relativeBBox(false);
+        FloatRect maskBBox = const_cast<RenderObject*>(findTextRootObject(object))->objectBoundingBox();
 
         context->fillRect(maskBBox);
 
diff --git a/WebCore/svg/graphics/SVGPaintServerPattern.cpp b/WebCore/svg/graphics/SVGPaintServerPattern.cpp
index a2ac5df..74ea27a 100644
--- a/WebCore/svg/graphics/SVGPaintServerPattern.cpp
+++ b/WebCore/svg/graphics/SVGPaintServerPattern.cpp
@@ -68,9 +68,9 @@
     return m_tile.get();
 }
 
-void SVGPaintServerPattern::setTile(auto_ptr<ImageBuffer> tile)
+void SVGPaintServerPattern::setTile(PassOwnPtr<ImageBuffer> tile)
 {
-    m_tile.set(tile.release());
+    m_tile = tile;
 }
 
 TransformationMatrix SVGPaintServerPattern::patternTransform() const
@@ -97,12 +97,7 @@
 
 bool SVGPaintServerPattern::setup(GraphicsContext*& context, const RenderObject* object, SVGPaintTargetType type, bool isPaintingText) const
 {
-    FloatRect targetRect;
-    if (isPaintingText) {
-        IntRect textBoundary = const_cast<RenderObject*>(object)->absoluteBoundingBoxRect();
-        targetRect = object->absoluteTransform().inverse().mapRect(textBoundary);
-    } else
-        targetRect = object->relativeBBox(false);
+    FloatRect targetRect = object->objectBoundingBox();
 
     const SVGRenderStyle* style = object->style()->svgStyle();
     bool isFilled = (type & ApplyToFillTargetType) && style->hasFill();
@@ -123,7 +118,7 @@
         // Draw the first cell of the pattern manually to support overflow="visible" on all platforms.
         int tileWidth = static_cast<int>(patternBoundaries().width() + 0.5f);
         int tileHeight = static_cast<int>(patternBoundaries().height() + 0.5f);
-        std::auto_ptr<ImageBuffer> tileImage = ImageBuffer::create(IntSize(tileWidth, tileHeight), false);
+        OwnPtr<ImageBuffer> tileImage = ImageBuffer::create(IntSize(tileWidth, tileHeight), false);
   
         GraphicsContext* tileImageContext = tileImage->context();
 
diff --git a/WebCore/svg/graphics/SVGPaintServerPattern.h b/WebCore/svg/graphics/SVGPaintServerPattern.h
index 48acd51..253e012 100644
--- a/WebCore/svg/graphics/SVGPaintServerPattern.h
+++ b/WebCore/svg/graphics/SVGPaintServerPattern.h
@@ -36,6 +36,7 @@
 #include <memory>
 
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -56,7 +57,7 @@
         FloatRect patternBoundaries() const;
 
         ImageBuffer* tile() const;
-        void setTile(std::auto_ptr<ImageBuffer>);
+        void setTile(PassOwnPtr<ImageBuffer>);
 
         TransformationMatrix patternTransform() const;
         void setPatternTransform(const TransformationMatrix&);
diff --git a/WebCore/svg/graphics/SVGResourceFilter.cpp b/WebCore/svg/graphics/SVGResourceFilter.cpp
index 8fb2dfa..6c1dccb 100644
--- a/WebCore/svg/graphics/SVGResourceFilter.cpp
+++ b/WebCore/svg/graphics/SVGResourceFilter.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -21,66 +22,99 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGResourceFilter.h"
 
+#include "FilterEffect.h"
+#include "GraphicsContext.h"
+#include "ImageBuffer.h"
+#include "PlatformString.h"
+#include "SVGFilter.h"
+#include "SVGFilterBuilder.h"
 #include "SVGRenderTreeAsText.h"
-#include "SVGFilterEffect.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
 
 namespace WebCore {
 
 SVGResourceFilter::SVGResourceFilter()
-    : m_platformData(createPlatformData())
-    , m_filterBBoxMode(false)
+    : m_filterBBoxMode(false)
     , m_effectBBoxMode(false)
     , m_xBBoxMode(false)
     , m_yBBoxMode(false)
+    , m_savedContext(0)
+    , m_sourceGraphicBuffer(0)
 {
+    m_filterBuilder.set(new SVGFilterBuilder());
 }
 
-void SVGResourceFilter::clearEffects()
+void SVGResourceFilter::addFilterEffect(SVGFilterPrimitiveStandardAttributes* effectAttributes, PassRefPtr<FilterEffect> effect)
 {
-    m_effects.clear();
-}
-
-void SVGResourceFilter::addFilterEffect(SVGFilterEffect* effect)
-{
-    ASSERT(effect);
-
-    if (effect) {
-        ASSERT(effect->filter() == this);
-        m_effects.append(effect);
-    }
+    effectAttributes->setStandardAttributes(this, effect.get());
+    builder()->add(effectAttributes->result(), effect);
 }
 
 FloatRect SVGResourceFilter::filterBBoxForItemBBox(const FloatRect& itemBBox) const
 {
     FloatRect filterBBox = filterRect();
 
-    float xOffset = 0.0f;
-    float yOffset = 0.0f;
-
-    if (!effectBoundingBoxMode()) {
-        xOffset = itemBBox.x();
-        yOffset = itemBBox.y();
-    }
-
-    if (filterBoundingBoxMode()) {
-        filterBBox = FloatRect(xOffset + filterBBox.x() * itemBBox.width(),
-                               yOffset + filterBBox.y() * itemBBox.height(),
+    if (filterBoundingBoxMode())
+        filterBBox = FloatRect(itemBBox.x() + filterBBox.x() * itemBBox.width(),
+                               itemBBox.y() + filterBBox.y() * itemBBox.height(),
                                filterBBox.width() * itemBBox.width(),
                                filterBBox.height() * itemBBox.height());
-    } else {
-        if (xBoundingBoxMode())
-            filterBBox.setX(xOffset + filterBBox.x());
-
-        if (yBoundingBoxMode())
-            filterBBox.setY(yOffset + filterBBox.y());
-    }
 
     return filterBBox;
 }
 
+void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const FloatRect& itemRect)
+{
+    // Draw the content of the current element and it's childs to a imageBuffer to get the SourceGraphic.
+    // The size of the SourceGraphic must match the size of the element, the filter is aplied to.
+    IntSize bufferSize = IntSize(itemRect.width(), itemRect.height());
+    OwnPtr<ImageBuffer> sourceGraphic(ImageBuffer::create(bufferSize, false));
+    
+    if (!sourceGraphic.get())
+        return;
+
+    GraphicsContext* sourceGraphicContext = sourceGraphic->context();
+    sourceGraphicContext->translate(-itemRect.x(), -itemRect.y());
+    sourceGraphicContext->clearRect(FloatRect(0, 0, itemRect.width(), itemRect.height()));
+    m_sourceGraphicBuffer.set(sourceGraphic.release());
+    m_savedContext = context;
+
+    context = sourceGraphicContext;
+}
+
+void SVGResourceFilter::applyFilter(GraphicsContext*& context, const FloatRect& itemRect)
+{
+    if (!m_savedContext)
+        return;
+
+    FloatRect filterRect = filterBBoxForItemBBox(itemRect);
+
+    setFilterBoundingBox(filterRect);
+    setItemBoundingBox(itemRect);
+
+    context = m_savedContext;
+    m_savedContext = 0;
+
+    FilterEffect* lastEffect = m_filterBuilder->lastEffect();
+
+    if (lastEffect && !filterRect.isEmpty()) {
+        RefPtr<Filter> filter = SVGFilter::create(m_itemBBox, m_filterBBox, m_effectBBoxMode, m_filterBBoxMode);
+        filter->setSourceImage(m_sourceGraphicBuffer->image());
+        lastEffect->apply(filter.get());
+
+        context->clip(filterRect);
+
+        if (lastEffect->resultImage())
+            context->drawImage(lastEffect->resultImage()->image(), 
+                            lastEffect->subRegion());
+    }
+
+    m_sourceGraphicBuffer.clear();
+}
+
 TextStream& SVGResourceFilter::externalRepresentation(TextStream& ts) const
 {
     ts << "[type=FILTER] ";
@@ -102,8 +136,6 @@
         ts << " [bounding box mode=" << filterBoundingBoxMode() << "]";
     if (effectBoundingBoxMode()) // default is false
         ts << " [effect bounding box mode=" << effectBoundingBoxMode() << "]";
-    if (m_effects.size() > 0)
-        ts << " [effects=" << m_effects << "]";
 
     return ts;
 }
diff --git a/WebCore/svg/graphics/SVGResourceFilter.h b/WebCore/svg/graphics/SVGResourceFilter.h
index 646c732..d081b6b 100644
--- a/WebCore/svg/graphics/SVGResourceFilter.h
+++ b/WebCore/svg/graphics/SVGResourceFilter.h
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -22,23 +23,25 @@
 #ifndef SVGResourceFilter_h
 #define SVGResourceFilter_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGResource.h"
-#include "SVGFilterEffect.h"
 
+#include "Image.h"
+#include "ImageBuffer.h"
 #include "FloatRect.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
 
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
+class Filter;
+class FilterEffect;
 class GraphicsContext;
-class SVGFilterEffect;
-    
-class SVGResourceFilterPlatformData {
-public:
-    virtual ~SVGResourceFilterPlatformData() {}
-};
+class SVGFilterBuilder;
+class SVGFilterPrimitiveStandardAttributes;
 
 class SVGResourceFilter : public SVGResource {
 public:
@@ -61,24 +64,24 @@
     FloatRect filterRect() const { return m_filterRect; }
     void setFilterRect(const FloatRect& rect) { m_filterRect = rect; }
 
-    FloatRect filterBBoxForItemBBox(const FloatRect& itemBBox) const;
+    FloatRect filterBoundingBox() { return m_filterBBox; }
+    void setFilterBoundingBox(const FloatRect& rect) { m_filterBBox = rect; }
 
-    void clearEffects();
-    void addFilterEffect(SVGFilterEffect*);
+    FloatRect itemBoundingBox() { return m_itemBBox; }
+    void setItemBoundingBox(const FloatRect& rect) { m_itemBBox = rect; }
+
+    FloatRect filterBBoxForItemBBox(const FloatRect& itemBBox) const;
 
     virtual TextStream& externalRepresentation(TextStream&) const;
 
-    // To be implemented in platform specific code.
-    void prepareFilter(GraphicsContext*&, const FloatRect& bbox);
-    void applyFilter(GraphicsContext*&, const FloatRect& bbox);
-    
-    SVGResourceFilterPlatformData* platformData() { return m_platformData.get(); }
-    const Vector<SVGFilterEffect*>& effects() { return m_effects; }
+    void prepareFilter(GraphicsContext*&, const FloatRect&);
+    void applyFilter(GraphicsContext*&, const FloatRect&);
+
+    void addFilterEffect(SVGFilterPrimitiveStandardAttributes*, PassRefPtr<FilterEffect>);
+
+    SVGFilterBuilder* builder() { return m_filterBuilder.get(); }
     
 private:
-    SVGResourceFilterPlatformData* createPlatformData();
-    
-    OwnPtr<SVGResourceFilterPlatformData> m_platformData;
 
     bool m_filterBBoxMode : 1;
     bool m_effectBBoxMode : 1;
@@ -87,7 +90,13 @@
     bool m_yBBoxMode : 1;
 
     FloatRect m_filterRect;
-    Vector<SVGFilterEffect*> m_effects;
+
+    FloatRect m_filterBBox;
+    FloatRect m_itemBBox;
+
+    OwnPtr<SVGFilterBuilder> m_filterBuilder;
+    GraphicsContext* m_savedContext;
+    OwnPtr<ImageBuffer> m_sourceGraphicBuffer;
 };
 
 SVGResourceFilter* getFilterById(Document*, const AtomicString&);
diff --git a/WebCore/svg/graphics/SVGResourceMasker.cpp b/WebCore/svg/graphics/SVGResourceMasker.cpp
index 8642e1e..3c21350 100644
--- a/WebCore/svg/graphics/SVGResourceMasker.cpp
+++ b/WebCore/svg/graphics/SVGResourceMasker.cpp
@@ -63,7 +63,7 @@
 void SVGResourceMasker::applyMask(GraphicsContext* context, const FloatRect& boundingBox)
 {
     if (!m_mask)
-        m_mask.set(m_ownerElement->drawMaskerContent(boundingBox, m_maskRect).release());
+        m_mask = m_ownerElement->drawMaskerContent(boundingBox, m_maskRect);
 
     if (!m_mask)
         return;
@@ -72,8 +72,8 @@
     IntRect intImageRect(0, 0, imageSize.width(), imageSize.height());
 
     // Create new ImageBuffer to apply luminance
-    auto_ptr<ImageBuffer> luminancedImage(ImageBuffer::create(imageSize, false));
-    if (!luminancedImage.get())
+    OwnPtr<ImageBuffer> luminancedImage = ImageBuffer::create(imageSize, false);
+    if (!luminancedImage)
         return;
 
     PassRefPtr<CanvasPixelArray> srcPixelArray(m_mask->getImageData(intImageRect)->data());
diff --git a/WebCore/svg/graphics/filters/SVGDistantLightSource.h b/WebCore/svg/graphics/filters/SVGDistantLightSource.h
index 25c2045..07ac16c 100644
--- a/WebCore/svg/graphics/filters/SVGDistantLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGDistantLightSource.h
@@ -23,7 +23,7 @@
 #ifndef SVGDistantLightSource_h
 #define SVGDistantLightSource_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGLightSource.h"
 
 namespace WebCore {
@@ -48,6 +48,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGDistantLightSource_h
diff --git a/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp b/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
index 4b82e5a..5197215 100644
--- a/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
@@ -21,8 +21,9 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEConvolveMatrix.h"
+#include "Filter.h"
 #include "SVGRenderTreeAsText.h"
 
 namespace WebCore {
@@ -133,7 +134,7 @@
     m_preserveAlpha = preserveAlpha; 
 }
 
-void FEConvolveMatrix::apply()
+void FEConvolveMatrix::apply(Filter*)
 {
 }
 
@@ -174,4 +175,4 @@
 
 }; // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h b/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h
index c3eea2b..9b3b33f 100644
--- a/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h
+++ b/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h
@@ -22,11 +22,11 @@
 #ifndef SVGFEConvolveMatrix_h
 #define SVGFEConvolveMatrix_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
 #include "FloatPoint.h"
 #include "FloatSize.h"
-
+#include "Filter.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -68,8 +68,8 @@
         bool preserveAlpha() const;
         void setPreserveAlpha(bool);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -90,6 +90,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEConvolveMatrix_h
diff --git a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
index 6399c5e..c536478 100644
--- a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
@@ -21,10 +21,11 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGLightSource.h"
 #include "SVGFEDiffuseLighting.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -112,7 +113,7 @@
     m_lightSource = lightSource;
 }
 
-void FEDiffuseLighting::apply()
+void FEDiffuseLighting::apply(Filter*)
 {
 }
 
@@ -132,4 +133,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
index a817ce2..f4b4dad 100644
--- a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
+++ b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
@@ -22,9 +22,10 @@
 #ifndef SVGFEDiffuseLighting_h
 #define SVGFEDiffuseLighting_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "Color.h"
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -54,8 +55,8 @@
         const LightSource* lightSource() const;
         void setLightSource(LightSource*);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
         
     private:
@@ -73,6 +74,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEDiffuseLighting_h
diff --git a/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp b/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
index f7996e3..abb57ee 100644
--- a/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDisplacementMap.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -74,7 +75,7 @@
     m_scale = scale;
 }
 
-void FEDisplacementMap::apply()
+void FEDisplacementMap::apply(Filter*)
 {
 }
 
@@ -113,4 +114,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFEDisplacementMap.h b/WebCore/svg/graphics/filters/SVGFEDisplacementMap.h
index 0218d57..1fd6db9 100644
--- a/WebCore/svg/graphics/filters/SVGFEDisplacementMap.h
+++ b/WebCore/svg/graphics/filters/SVGFEDisplacementMap.h
@@ -22,9 +22,10 @@
 #ifndef SVGFEDisplacementMap_h
 #define SVGFEDisplacementMap_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "PlatformString.h"
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -50,8 +51,8 @@
         float scale() const;
         void setScale(float scale);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -67,6 +68,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEDisplacementMap_h
diff --git a/WebCore/svg/graphics/filters/SVGFEFlood.cpp b/WebCore/svg/graphics/filters/SVGFEFlood.cpp
index 3d52f63..9bdb8ca 100644
--- a/WebCore/svg/graphics/filters/SVGFEFlood.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEFlood.cpp
@@ -21,22 +21,24 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEFlood.h"
+#include "Filter.h"
 #include "SVGRenderTreeAsText.h"
 
 namespace WebCore {
 
-FEFlood::FEFlood(const Color& floodColor, const float& floodOpacity)
+FEFlood::FEFlood(FilterEffect* in, const Color& floodColor, const float& floodOpacity)
     : FilterEffect()
+    , m_in(in)
     , m_floodColor(floodColor)
     , m_floodOpacity(floodOpacity)
 {
 }
 
-PassRefPtr<FEFlood> FEFlood::create(const Color& floodColor, const float& floodOpacity)
+PassRefPtr<FEFlood> FEFlood::create(FilterEffect* in, const Color& floodColor, const float& floodOpacity)
 {
-    return adoptRef(new FEFlood(floodColor, floodOpacity));
+    return adoptRef(new FEFlood(in, floodColor, floodOpacity));
 }
 
 Color FEFlood::floodColor() const
@@ -59,7 +61,7 @@
     m_floodOpacity = floodOpacity;
 }
 
-void FEFlood::apply()
+void FEFlood::apply(Filter*)
 {
 }
 
@@ -78,4 +80,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFEFlood.h b/WebCore/svg/graphics/filters/SVGFEFlood.h
index 0558774..21985db 100644
--- a/WebCore/svg/graphics/filters/SVGFEFlood.h
+++ b/WebCore/svg/graphics/filters/SVGFEFlood.h
@@ -22,15 +22,16 @@
 #ifndef SVGFEFlood_h
 #define SVGFEFlood_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "Color.h"
+#include "Filter.h"
 #include "FilterEffect.h"
 
 namespace WebCore {
 
     class FEFlood : public FilterEffect {
     public:
-        static PassRefPtr<FEFlood> create(const Color&, const float&);
+        static PassRefPtr<FEFlood> create(FilterEffect*, const Color&, const float&);
 
         Color floodColor() const;
         void setFloodColor(const Color &);
@@ -38,19 +39,20 @@
         float floodOpacity() const;
         void setFloodOpacity(float);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
-        FEFlood(const Color&, const float&);
+        FEFlood(FilterEffect*, const Color&, const float&);
 
+        RefPtr<FilterEffect> m_in;
         Color m_floodColor;
         float m_floodOpacity;
     };
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEFlood_h
diff --git a/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp b/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
index 4e64c58..601c39e 100644
--- a/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEGaussianBlur.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -60,7 +61,7 @@
     m_y = y;
 }
 
-void FEGaussianBlur::apply()
+void FEGaussianBlur::apply(Filter*)
 {
 }
 
@@ -78,4 +79,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h b/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h
index 33ad0c7..a377f89 100644
--- a/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h
+++ b/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h
@@ -22,8 +22,9 @@
 #ifndef SVGFEGaussianBlur_h
 #define SVGFEGaussianBlur_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -37,8 +38,8 @@
         float stdDeviationY() const;
         void setStdDeviationY(float);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -51,6 +52,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEGaussianBlur_h
diff --git a/WebCore/svg/graphics/filters/SVGFEImage.cpp b/WebCore/svg/graphics/filters/SVGFEImage.cpp
index 2bf83be..a01ad3b 100644
--- a/WebCore/svg/graphics/filters/SVGFEImage.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEImage.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEImage.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -63,7 +64,7 @@
         m_cachedImage->addClient(this);
 }
 
-void FEImage::apply()
+void FEImage::apply(Filter*)
 {
 }
 
@@ -81,4 +82,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFEImage.h b/WebCore/svg/graphics/filters/SVGFEImage.h
index fcf413f..3fdc26a 100644
--- a/WebCore/svg/graphics/filters/SVGFEImage.h
+++ b/WebCore/svg/graphics/filters/SVGFEImage.h
@@ -22,11 +22,12 @@
 #ifndef SVGFEImage_h
 #define SVGFEImage_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "CachedImage.h"
 #include "CachedResourceClient.h"
 #include "CachedResourceHandle.h"
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -41,8 +42,8 @@
         CachedImage* cachedImage() const;
         void setCachedImage(CachedImage*);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
         
     private:
@@ -53,6 +54,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEImage_h
diff --git a/WebCore/svg/graphics/filters/SVGFEMerge.cpp b/WebCore/svg/graphics/filters/SVGFEMerge.cpp
index 8ce15a7..7f12c4c 100644
--- a/WebCore/svg/graphics/filters/SVGFEMerge.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEMerge.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMerge.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -48,7 +49,7 @@
     m_mergeInputs = mergeInputs;
 }
 
-void FEMerge::apply()
+void FEMerge::apply(Filter*)
 {
 }
 
@@ -75,4 +76,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFEMerge.h b/WebCore/svg/graphics/filters/SVGFEMerge.h
index 6415c9f..e41e554 100644
--- a/WebCore/svg/graphics/filters/SVGFEMerge.h
+++ b/WebCore/svg/graphics/filters/SVGFEMerge.h
@@ -22,9 +22,9 @@
 #ifndef SVGFEMerge_h
 #define SVGFEMerge_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
-
+#include "Filter.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -36,8 +36,8 @@
         const Vector<FilterEffect*>& mergeInputs() const;
         void setMergeInputs(const Vector<FilterEffect*>& mergeInputs);
         
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -48,6 +48,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEMerge_h
diff --git a/WebCore/svg/graphics/filters/SVGFEMorphology.cpp b/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
index 7838a8c..3767734 100644
--- a/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMorphology.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -71,7 +72,7 @@
     m_radiusY = radiusY;
 }
 
-void FEMorphology::apply()
+void FEMorphology::apply(Filter*)
 {
 }
 
@@ -104,4 +105,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFEMorphology.h b/WebCore/svg/graphics/filters/SVGFEMorphology.h
index 98ab633..1db8bc4 100644
--- a/WebCore/svg/graphics/filters/SVGFEMorphology.h
+++ b/WebCore/svg/graphics/filters/SVGFEMorphology.h
@@ -22,8 +22,9 @@
 #ifndef SVGFEMorphology_h
 #define SVGFEMorphology_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -45,8 +46,8 @@
         float radiusY() const;
         void setRadiusY(float);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -60,6 +61,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEMorphology_h
diff --git a/WebCore/svg/graphics/filters/SVGFEOffset.cpp b/WebCore/svg/graphics/filters/SVGFEOffset.cpp
index c2a0fc9..63775fb 100644
--- a/WebCore/svg/graphics/filters/SVGFEOffset.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEOffset.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEOffset.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -60,7 +61,7 @@
     m_dy = dy;
 }
 
-void FEOffset::apply()
+void FEOffset::apply(Filter*)
 {
 }
 
@@ -78,4 +79,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFEOffset.h b/WebCore/svg/graphics/filters/SVGFEOffset.h
index 86128da..93bdde9 100644
--- a/WebCore/svg/graphics/filters/SVGFEOffset.h
+++ b/WebCore/svg/graphics/filters/SVGFEOffset.h
@@ -22,8 +22,9 @@
 #ifndef SVGFEOffset_h
 #define SVGFEOffset_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -37,8 +38,8 @@
         float dy() const;
         void setDy(float);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -51,6 +52,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFEOffset_h
diff --git a/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp b/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
index e3446ed..eb0c280 100644
--- a/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
+++ b/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFESpecularLighting.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -124,7 +125,7 @@
     m_lightSource = lightSource;
 }
 
-void FESpecularLighting::apply()
+void FESpecularLighting::apply(Filter*)
 {
 }
 
@@ -144,4 +145,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFESpecularLighting.h b/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
index e1c1930..4efff93 100644
--- a/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
+++ b/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
@@ -22,10 +22,11 @@
 #ifndef SVGFESpecularLighting_h
 #define SVGFESpecularLighting_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "Color.h"
-#include "SVGLightSource.h"
 #include "FilterEffect.h"
+#include "SVGLightSource.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -56,8 +57,8 @@
         const LightSource* lightSource() const;
         void setLightSource(LightSource*);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -76,6 +77,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFESpecularLighting_h
diff --git a/WebCore/svg/graphics/filters/SVGFETile.cpp b/WebCore/svg/graphics/filters/SVGFETile.cpp
index 773a5cd..fecd105 100644
--- a/WebCore/svg/graphics/filters/SVGFETile.cpp
+++ b/WebCore/svg/graphics/filters/SVGFETile.cpp
@@ -19,9 +19,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFETile.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -36,7 +37,7 @@
     return adoptRef(new FETile(in));
 }
 
-void FETile::apply()
+void FETile::apply(Filter*)
 {
 }
 
@@ -53,5 +54,5 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
diff --git a/WebCore/svg/graphics/filters/SVGFETile.h b/WebCore/svg/graphics/filters/SVGFETile.h
index 986f6fd..f1e8d1a 100644
--- a/WebCore/svg/graphics/filters/SVGFETile.h
+++ b/WebCore/svg/graphics/filters/SVGFETile.h
@@ -22,8 +22,9 @@
 #ifndef SVGFETile_h
 #define SVGFETile_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
     
@@ -31,8 +32,8 @@
     public:
         static PassRefPtr<FETile> create(FilterEffect*);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
         
     private:
@@ -43,6 +44,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFETile_h
diff --git a/WebCore/svg/graphics/filters/SVGFETurbulence.cpp b/WebCore/svg/graphics/filters/SVGFETurbulence.cpp
index 9731c49..542c576 100644
--- a/WebCore/svg/graphics/filters/SVGFETurbulence.cpp
+++ b/WebCore/svg/graphics/filters/SVGFETurbulence.cpp
@@ -21,9 +21,10 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFETurbulence.h"
 #include "SVGRenderTreeAsText.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -105,7 +106,7 @@
     m_stitchTiles = stitch;
 }
 
-void FETurbulence::apply()
+void FETurbulence::apply(Filter*)
 {
 }
 
@@ -142,4 +143,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFETurbulence.h b/WebCore/svg/graphics/filters/SVGFETurbulence.h
index 6977460..e7f40f6 100644
--- a/WebCore/svg/graphics/filters/SVGFETurbulence.h
+++ b/WebCore/svg/graphics/filters/SVGFETurbulence.h
@@ -22,8 +22,9 @@
 #ifndef SVGFETurbulence_h
 #define SVGFETurbulence_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
+#include "Filter.h"
 
 namespace WebCore {
 
@@ -56,8 +57,8 @@
         bool stitchTiles() const;
         void setStitchTiles(bool);
 
-        virtual void apply();
-        virtual void dump();
+        void apply(Filter*);
+        void dump();
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
@@ -74,6 +75,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGFETurbulence_h
diff --git a/WebCore/svg/graphics/filters/SVGFilter.cpp b/WebCore/svg/graphics/filters/SVGFilter.cpp
new file mode 100644
index 0000000..71c00eb
--- /dev/null
+++ b/WebCore/svg/graphics/filters/SVGFilter.cpp
@@ -0,0 +1,47 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFilter.h"
+
+namespace WebCore {
+
+SVGFilter::SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode, bool filterBBoxMode)
+    : Filter()
+    , m_itemBox(itemBox)
+    , m_filterRect(filterRect)
+    , m_effectBBoxMode(effectBBoxMode)
+    , m_filterBBoxMode(filterBBoxMode)
+{
+}
+
+void SVGFilter::calculateEffectSubRegion(FilterEffect*)
+{
+}
+
+PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode, bool filterBBoxMode)
+{
+    return adoptRef(new SVGFilter(itemBox, filterRect, effectBBoxMode, filterBBoxMode));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFilter.h b/WebCore/svg/graphics/filters/SVGFilter.h
new file mode 100644
index 0000000..95b3414
--- /dev/null
+++ b/WebCore/svg/graphics/filters/SVGFilter.h
@@ -0,0 +1,53 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SVGFilter_h
+#define SVGFilter_h
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "Filter.h"
+#include "FilterEffect.h"
+#include "FloatRect.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class SVGFilter : public Filter {
+    public:
+        static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool, bool);
+
+        void calculateEffectSubRegion(FilterEffect*);
+
+    private:
+        SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool itemBBoxMode, bool filterBBoxMode);
+
+        FloatRect m_itemBox;
+        FloatRect m_filterRect;
+        bool m_effectBBoxMode;
+        bool m_filterBBoxMode;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
+
+#endif // SVGFilter_h
diff --git a/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp b/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
new file mode 100644
index 0000000..67668d6
--- /dev/null
+++ b/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
@@ -0,0 +1,79 @@
+
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFilterBuilder.h"
+
+#include "FilterEffect.h"
+#include "PlatformString.h"
+#include "SourceAlpha.h"
+#include "SourceGraphic.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+SVGFilterBuilder::SVGFilterBuilder()
+{
+    m_builtinEffects.add(SourceGraphic::effectName(), SourceGraphic::create());
+    m_builtinEffects.add(SourceAlpha::effectName(), SourceAlpha::create());
+}
+
+void SVGFilterBuilder::add(const AtomicString& id, RefPtr<FilterEffect> effect)
+{
+    if (id.isEmpty()) {
+        m_lastEffect = effect.get();
+        return;
+    }
+
+    if (m_builtinEffects.contains(id))
+        return;
+
+    m_lastEffect = effect.get();
+    m_namedEffects.set(id, m_lastEffect);
+}
+
+FilterEffect* SVGFilterBuilder::getEffectById(const AtomicString& id) const
+{
+    if (id.isEmpty()) {
+        if (m_lastEffect)
+            return m_lastEffect.get();
+
+        return m_builtinEffects.get(SourceGraphic::effectName()).get();
+    }
+
+    if (m_builtinEffects.contains(id))
+        return m_builtinEffects.get(id).get();
+
+    return m_namedEffects.get(id).get();
+}
+
+void SVGFilterBuilder::clearEffects()
+{
+    m_lastEffect = 0;
+    m_namedEffects.clear();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/FilterBuilder.h b/WebCore/svg/graphics/filters/SVGFilterBuilder.h
similarity index 61%
rename from WebCore/svg/FilterBuilder.h
rename to WebCore/svg/graphics/filters/SVGFilterBuilder.h
index 630537c..55844c9 100644
--- a/WebCore/svg/FilterBuilder.h
+++ b/WebCore/svg/graphics/filters/SVGFilterBuilder.h
@@ -17,35 +17,40 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef FilterBuilder_h
-#define FilterBuilder_h
+#ifndef SVGFilterBuilder_h
+#define SVGFilterBuilder_h
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "PlatformString.h"
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "AtomicStringHash.h"
 #include "FilterEffect.h"
-#include "Filter.h"
+#include "PlatformString.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
     
-    class FilterBuilder : public RefCounted<FilterBuilder> {
+    class SVGFilterBuilder : public RefCounted<SVGFilterBuilder> {
     public:
-        void add(const String& id, PassRefPtr<FilterEffect> effect) { m_namedEffects.set(id.impl(), effect); }
-        FilterEffect* getEffectById(const String& id) const { return m_namedEffects.get(id.impl()).get(); }
-        
-        PassRefPtr<Filter> filter() const { return m_filter; }
-        
+        SVGFilterBuilder();
+
+        void add(const AtomicString& id, RefPtr<FilterEffect> effect);
+
+        FilterEffect* getEffectById(const AtomicString& id) const;
+        FilterEffect* lastEffect() const { return m_lastEffect.get(); }
+
+        void clearEffects();
+
     private:
-        HashMap<StringImpl*, RefPtr<FilterEffect> > m_namedEffects;
-        
-        RefPtr<Filter> m_filter;
+        HashMap<AtomicString, RefPtr<FilterEffect> > m_builtinEffects;
+        HashMap<AtomicString, RefPtr<FilterEffect> > m_namedEffects;
+
+        RefPtr<FilterEffect> m_lastEffect;
     };
     
 } //namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 #endif
diff --git a/WebCore/svg/graphics/filters/SVGFilterEffect.cpp b/WebCore/svg/graphics/filters/SVGFilterEffect.cpp
deleted file mode 100644
index f8e246f..0000000
--- a/WebCore/svg/graphics/filters/SVGFilterEffect.cpp
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
-    Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
-                  2004, 2005 Rob Buis <buis@kde.org>
-                  2005 Eric Seidel <eric@webkit.org>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "SVGFilterEffect.h"
-
-#include "SVGRenderTreeAsText.h"
-#include "SVGResourceFilter.h"
-
-namespace WebCore {
-
-SVGFilterEffect::SVGFilterEffect(SVGResourceFilter* filter)
-    : m_filter(filter)
-    , m_xBBoxMode(false)
-    , m_yBBoxMode(false)
-    , m_widthBBoxMode(false)
-    , m_heightBBoxMode(false)
-{
-}
-
-FloatRect SVGFilterEffect::primitiveBBoxForFilterBBox(const FloatRect& filterBBox, const FloatRect& itemBBox) const
-{
-    FloatRect subRegionBBox = subRegion();
-    FloatRect useBBox = filterBBox;
-
-    ASSERT(m_filter);
-    if (!m_filter)
-        return FloatRect();
-
-    if (m_filter->effectBoundingBoxMode()) {
-        if (!m_filter->filterBoundingBoxMode())
-            useBBox = itemBBox;
-
-        subRegionBBox = FloatRect(useBBox.x() + subRegionBBox.x() * useBBox.width(),
-                                  useBBox.y() + subRegionBBox.y() * useBBox.height(),
-                                  subRegionBBox.width() * useBBox.width(),
-                                  subRegionBBox.height() * useBBox.height());
-    } else {
-        if (xBoundingBoxMode())
-            subRegionBBox.setX(useBBox.x() + subRegionBBox.x() * useBBox.width());
-
-        if (yBoundingBoxMode())
-            subRegionBBox.setY(useBBox.y() + subRegionBBox.y() * useBBox.height());
-
-        if (widthBoundingBoxMode())
-            subRegionBBox.setWidth(subRegionBBox.width() * useBBox.width());
-
-        if (heightBoundingBoxMode())
-            subRegionBBox.setHeight(subRegionBBox.height() * useBBox.height());
-    }
-
-    return subRegionBBox;
-}
-
-FloatRect SVGFilterEffect::subRegion() const
-{
-    return m_subRegion;
-}
-
-void SVGFilterEffect::setSubRegion(const FloatRect& subRegion)
-{
-    m_subRegion = subRegion;
-}
-
-String SVGFilterEffect::in() const
-{
-    return m_in;
-}
-
-void SVGFilterEffect::setIn(const String& in)
-{
-    m_in = in;
-}
-
-String SVGFilterEffect::result() const
-{
-    return m_result;
-}
-
-void SVGFilterEffect::setResult(const String& result)
-{
-    m_result = result;
-}
-
-SVGResourceFilter* SVGFilterEffect::filter() const
-{
-    return m_filter;
-}
-
-void SVGFilterEffect::setFilter(SVGResourceFilter* filter)
-{
-    m_filter = filter;
-}
-
-TextStream& SVGFilterEffect::externalRepresentation(TextStream& ts) const
-{
-    if (!in().isEmpty())
-        ts << "[in=\"" << in() << "\"]";
-    if (!result().isEmpty())
-        ts << " [result=\"" << result() << "\"]";
-    if (!subRegion().isEmpty())
-        ts << " [subregion=\"" << subRegion() << "\"]";
-    return ts;
-}
-
-TextStream& operator<<(TextStream& ts, const SVGFilterEffect& e)
-{
-    return e.externalRepresentation(ts);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFilterEffect.h b/WebCore/svg/graphics/filters/SVGFilterEffect.h
deleted file mode 100644
index d497f8b..0000000
--- a/WebCore/svg/graphics/filters/SVGFilterEffect.h
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
-    Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
-                  2004, 2005 Rob Buis <buis@kde.org>
-                  2005 Eric Seidel <eric@webkit.org>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef SVGFilterEffect_h
-#define SVGFilterEffect_h
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-#include "FloatRect.h"
-#include "PlatformString.h"
-
-#if PLATFORM(CI)
-#ifdef __OBJC__
-@class CIFilter;
-#else
-class CIFilter;
-#endif
-#endif
-
-namespace WebCore {
-
-class SVGResourceFilter;
-class TextStream;
-
-class SVGFilterEffect : public RefCounted<SVGFilterEffect> {
-public:
-    SVGFilterEffect(SVGResourceFilter*);
-    virtual ~SVGFilterEffect() { }
-
-    bool xBoundingBoxMode() const { return m_xBBoxMode; }
-    void setXBoundingBoxMode(bool bboxMode) { m_xBBoxMode = bboxMode; }
-
-    bool yBoundingBoxMode() const { return m_yBBoxMode; }
-    void setYBoundingBoxMode(bool bboxMode) { m_yBBoxMode = bboxMode; }
-
-    bool widthBoundingBoxMode() const { return m_widthBBoxMode; }
-    void setWidthBoundingBoxMode(bool bboxMode) { m_widthBBoxMode = bboxMode; }
-
-    bool heightBoundingBoxMode() const { return m_heightBBoxMode; }
-    void setHeightBoundingBoxMode(bool bboxMode) { m_heightBBoxMode = bboxMode; }
-
-    FloatRect primitiveBBoxForFilterBBox(const FloatRect& filterBBox, const FloatRect& itemBBox) const;
-
-    FloatRect subRegion() const;
-    void setSubRegion(const FloatRect&);
-
-    String in() const;
-    void setIn(const String&);
-
-    String result() const;
-    void setResult(const String&);
-
-    SVGResourceFilter* filter() const;
-    void setFilter(SVGResourceFilter*);
-
-    virtual TextStream& externalRepresentation(TextStream&) const;
-
-#if PLATFORM(CI)
-    virtual CIFilter* getCIFilter(const FloatRect& bbox) const;
-#endif
-
-private:
-    SVGResourceFilter* m_filter;
-
-    bool m_xBBoxMode : 1;
-    bool m_yBBoxMode : 1;
-    bool m_widthBBoxMode : 1;
-    bool m_heightBBoxMode : 1;
-
-    FloatRect m_subRegion;
- 
-    String m_in;
-    String m_result;
-};
-
-TextStream& operator<<(TextStream&, const SVGFilterEffect&);
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#endif // SVGFilterEffect_h
diff --git a/WebCore/svg/graphics/filters/SVGLightSource.cpp b/WebCore/svg/graphics/filters/SVGLightSource.cpp
index 77611ca..9176b4c 100644
--- a/WebCore/svg/graphics/filters/SVGLightSource.cpp
+++ b/WebCore/svg/graphics/filters/SVGLightSource.cpp
@@ -21,7 +21,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGPointLightSource.h"
 #include "SVGRenderTreeAsText.h"
 #include "SVGSpotLightSource.h"
@@ -62,4 +62,4 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGLightSource.h b/WebCore/svg/graphics/filters/SVGLightSource.h
index 779e147..22b43c8 100644
--- a/WebCore/svg/graphics/filters/SVGLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGLightSource.h
@@ -23,7 +23,7 @@
 #ifndef SVGLightSource_h
 #define SVGLightSource_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
@@ -53,6 +53,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGLightSource_h
diff --git a/WebCore/svg/graphics/filters/SVGPointLightSource.h b/WebCore/svg/graphics/filters/SVGPointLightSource.h
index 099a165..772e278 100644
--- a/WebCore/svg/graphics/filters/SVGPointLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGPointLightSource.h
@@ -23,7 +23,7 @@
 #ifndef SVGPointLightSource_h
 #define SVGPointLightSource_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FloatPoint3D.h"
 #include "SVGLightSource.h"
 
@@ -46,6 +46,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGPointLightSource_h
diff --git a/WebCore/svg/graphics/filters/SVGSpotLightSource.h b/WebCore/svg/graphics/filters/SVGSpotLightSource.h
index a4aa1fb..9a787fb 100644
--- a/WebCore/svg/graphics/filters/SVGSpotLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGSpotLightSource.h
@@ -23,7 +23,7 @@
 #ifndef SVGSpotLightSource_h
 #define SVGSpotLightSource_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FloatPoint3D.h"
 #include "SVGLightSource.h"
 
@@ -57,6 +57,6 @@
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif // SVGSpotLightSource_h
diff --git a/WebCore/svg/svgtags.in b/WebCore/svg/svgtags.in
index fe19f3d..6ac430d 100644
--- a/WebCore/svg/svgtags.in
+++ b/WebCore/svg/svgtags.in
@@ -30,7 +30,7 @@
 defs
 desc
 ellipse
-#if ENABLE_SVG_FILTERS
+#if ENABLE_FILTERS
 feBlend
 feColorMatrix
 feComponentTransfer
diff --git a/WebCore/webcore-base.bkl b/WebCore/webcore-base.bkl
index f6095e5..840c91c 100644
--- a/WebCore/webcore-base.bkl
+++ b/WebCore/webcore-base.bkl
@@ -34,6 +34,7 @@
     <include file="WebCoreSources.bkl" />
 
     <set var="WEBCORE_BASE_SOURCES">
+        $(WEBCORE_SOURCES_ACCESSIBILITY)
         $(WEBCORE_SOURCES_BMP)
         $(WEBCORE_SOURCES_BRIDGE)
         $(WEBCORE_SOURCES_CSS)
@@ -62,6 +63,7 @@
 
     <template id="webcore_base" template="xml2,iconv,xslt,icu,jscore,curl,sqlite3">
         <include>$(SRCDIR)</include>
+        <include>$(SRCDIR)/accessibility</include>
         <include>$(SRCDIR)/bindings/js</include>
         <include>$(SRCDIR)/bridge</include>
         <include>$(SRCDIR)/bridge/c</include>
diff --git a/WebCore/webcore-wx.bkl b/WebCore/webcore-wx.bkl
index 09431ce..bf3a1ae 100644
--- a/WebCore/webcore-wx.bkl
+++ b/WebCore/webcore-wx.bkl
@@ -42,6 +42,7 @@
         <include>$(SRCDIR)/platform/wx</include>
         <include>$(SRCDIR)/platform/wx/wxcode</include>
         <include>$(SRCDIR)/page/wx</include>
+        <include>$(WK_ROOT)/WebKitLibraries</include>
         
         <sources>
             bindings/js/ScriptControllerWx.cpp
@@ -94,6 +95,7 @@
             platform/wx/ContextMenuItemWx.cpp
            
             <!-- files from other ports we currently rely on -->
+            platform/network/curl/CookieJarCurl.cpp
             platform/network/curl/FormDataStreamCurl.cpp
             platform/network/curl/ResourceHandleCurl.cpp
             platform/network/curl/ResourceHandleManager.cpp
@@ -128,7 +130,7 @@
         <sources>
             $(EXT_SOURCES)
         </sources>
-
+        
     </template>
 
     <lib id="wx-webcore-static" template="webcore-wx,wx-lib">
diff --git a/WebCore/wml/WMLAElement.cpp b/WebCore/wml/WMLAElement.cpp
index 758be78..5fbeac6 100644
--- a/WebCore/wml/WMLAElement.cpp
+++ b/WebCore/wml/WMLAElement.cpp
@@ -37,6 +37,7 @@
 #include "FrameLoader.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "RenderBox.h"
 #include "WMLNames.h"
@@ -56,7 +57,7 @@
         bool wasLink = isLink();
         setIsLink(!attr->isNull());
         if (wasLink != isLink())
-            setChanged();
+            setNeedsStyleRecalc();
         if (isLink() && document()->isDNSPrefetchEnabled()) {
             String value = attr->value();
             if (protocolIs(value, "http") || protocolIs(value, "https") || value.startsWith("//"))
diff --git a/WebCore/wml/WMLAccessElement.cpp b/WebCore/wml/WMLAccessElement.cpp
index 7668c74..db0ab67 100644
--- a/WebCore/wml/WMLAccessElement.cpp
+++ b/WebCore/wml/WMLAccessElement.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(WML)
 #include "WMLAccessElement.h"
 
+#include "MappedAttribute.h"
 #include "WMLDocument.h"
 #include "WMLNames.h"
 #include "WMLVariables.h"
diff --git a/WebCore/wml/WMLBRElement.cpp b/WebCore/wml/WMLBRElement.cpp
index 7bd6360..035619f 100644
--- a/WebCore/wml/WMLBRElement.cpp
+++ b/WebCore/wml/WMLBRElement.cpp
@@ -30,6 +30,7 @@
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderBR.h"
 
 namespace WebCore {
diff --git a/WebCore/wml/WMLCardElement.cpp b/WebCore/wml/WMLCardElement.cpp
index b969612..c8e92af 100644
--- a/WebCore/wml/WMLCardElement.cpp
+++ b/WebCore/wml/WMLCardElement.cpp
@@ -26,10 +26,12 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "NodeList.h"
 #include "RenderStyle.h"
 #include "WMLDocument.h"
 #include "WMLDoElement.h"
+#include "WMLInputElement.h"
 #include "WMLIntrinsicEventHandler.h"
 #include "WMLNames.h"
 #include "WMLTemplateElement.h"
@@ -48,6 +50,7 @@
     , m_eventTimer(0)
     , m_template(0)
 {
+    ASSERT(hasTagName(cardTag));
 }
 
 WMLCardElement::~WMLCardElement()
@@ -162,16 +165,18 @@
     if (m_eventTimer)
         m_eventTimer->start();
 
-    // FIXME: Initialize input/select  elements in this card
-    /*
-    Node* node = this;
-    while (node = node->traverseNextNode()) {
+    // FIXME: Initialize select elements in this card
+    for (Node* node = traverseNextNode(); node != 0; node = node->traverseNextNode()) {
+        if (!node->isElementNode())
+            continue;
+
         if (node->hasTagName(inputTag))
-            static_cast<WMLInputElement*>(node)->init();
+            static_cast<WMLInputElement*>(node)->initialize();
+        /*
         else if (node->hasTagName(selectTag))
             static_cast<WMLSelectElement*>(node)->selectInitialOptions();
+        */
     }
-    */
 }
 
 void WMLCardElement::handleDeckLevelTaskOverridesIfNeeded()
diff --git a/WebCore/wml/WMLDoElement.cpp b/WebCore/wml/WMLDoElement.cpp
index 8d7952b..916bc6e 100644
--- a/WebCore/wml/WMLDoElement.cpp
+++ b/WebCore/wml/WMLDoElement.cpp
@@ -27,6 +27,7 @@
 #include "EventNames.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderButton.h"
 #include "WMLCardElement.h"
diff --git a/WebCore/wml/WMLDocument.cpp b/WebCore/wml/WMLDocument.cpp
index 36c436f..7f73848 100644
--- a/WebCore/wml/WMLDocument.cpp
+++ b/WebCore/wml/WMLDocument.cpp
@@ -61,6 +61,12 @@
     // Remember that we'e successfully entered the deck
     wmlPageState->setNeedCheckDeckAccess(false);
 
+    initialize();
+    Document::finishedParsing();
+}
+
+void WMLDocument::initialize()
+{
     // Notify the existance of templates to all cards of the current deck
     WMLTemplateElement::registerTemplatesInDocument(this);
 
@@ -77,8 +83,6 @@
 
     // Handle card-level intrinsic event
     card->handleIntrinsicEventIfNeeded();
-
-    Document::finishedParsing();
 }
 
 WMLPageState* wmlPageStateForDocument(Document* doc)
diff --git a/WebCore/wml/WMLDocument.h b/WebCore/wml/WMLDocument.h
index d7eb8b2..9189085 100644
--- a/WebCore/wml/WMLDocument.h
+++ b/WebCore/wml/WMLDocument.h
@@ -40,6 +40,8 @@
     virtual bool isWMLDocument() const { return true; }
     virtual void finishedParsing();
 
+    void initialize();
+
 private:
     WMLDocument(Frame*);
 };
diff --git a/WebCore/wml/WMLElement.cpp b/WebCore/wml/WMLElement.cpp
index c88c5d3..e818f9d 100644
--- a/WebCore/wml/WMLElement.cpp
+++ b/WebCore/wml/WMLElement.cpp
@@ -25,6 +25,7 @@
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderObject.h"
 #include "WMLErrorHandling.h"
 #include "WMLNames.h"
diff --git a/WebCore/wml/WMLFieldSetElement.cpp b/WebCore/wml/WMLFieldSetElement.cpp
index d32f9b1..8146375 100644
--- a/WebCore/wml/WMLFieldSetElement.cpp
+++ b/WebCore/wml/WMLFieldSetElement.cpp
@@ -24,6 +24,7 @@
 #include "WMLFieldSetElement.h"
 
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderFieldset.h"
 #include "Text.h"
 #include "WMLElementFactory.h"
diff --git a/WebCore/wml/WMLFormControlElement.cpp b/WebCore/wml/WMLFormControlElement.cpp
index 4e76cb8..f849ac8 100644
--- a/WebCore/wml/WMLFormControlElement.cpp
+++ b/WebCore/wml/WMLFormControlElement.cpp
@@ -29,7 +29,6 @@
 
 namespace WebCore {
 
-// WMLFormControlElement
 WMLFormControlElement::WMLFormControlElement(const QualifiedName& tagName, Document* document)
     : WMLElement(tagName, document)
     , m_valueMatchesRenderer(false)
@@ -56,14 +55,24 @@
     return true;
 }
 
-// WMLFormControlElementWithState
-WMLFormControlElementWithState::WMLFormControlElementWithState(const QualifiedName& tagName, Document* document)
-    : WMLFormControlElement(tagName, document)
+void WMLFormControlElement::attach()
 {
+    ASSERT(!attached());
+    WMLElement::attach();
+
+    // The call to updateFromElement() needs to go after the call through
+    // to the base class's attach() because that can sometimes do a close
+    // on the renderer.
+    if (renderer())
+        renderer()->updateFromElement();
 }
 
-WMLFormControlElementWithState::~WMLFormControlElementWithState()
+void WMLFormControlElement::recalcStyle(StyleChange change)
 {
+    WMLElement::recalcStyle(change);
+
+    if (renderer())
+        renderer()->updateFromElement();
 }
 
 }
diff --git a/WebCore/wml/WMLFormControlElement.h b/WebCore/wml/WMLFormControlElement.h
index 449e512..dde86ed 100644
--- a/WebCore/wml/WMLFormControlElement.h
+++ b/WebCore/wml/WMLFormControlElement.h
@@ -22,42 +22,31 @@
 #define WMLFormControlElement_h
 
 #if ENABLE(WML)
-#include "FormControlElementWithState.h"
-#include "FormControlElement.h"
 #include "WMLElement.h"
 
 namespace WebCore {
 
-class WMLFormControlElement : public WMLElement, public FormControlElement {
+class WMLFormControlElement : public WMLElement {
 public:
-    WMLFormControlElement(const QualifiedName& tagName, Document* document);
+    WMLFormControlElement(const QualifiedName&, Document*);
     virtual ~WMLFormControlElement();
 
-    virtual bool isEnabled() const { return true; }
     virtual bool isFormControlElement() const { return true; }
-    virtual bool isReadOnlyControl() const { return false; }
-    virtual bool isTextControl() const { return false; }
+    virtual bool isReadOnlyFormControl() const { return false; }
+    virtual bool isTextFormControl() const { return false; }
 
-    virtual bool valueMatchesRenderer() const { return m_valueMatchesRenderer; }
-    virtual void setValueMatchesRenderer(bool b = true) { m_valueMatchesRenderer = b; }
-
-    virtual const AtomicString& name() const { return emptyAtom; }
+    virtual bool formControlValueMatchesRenderer() const { return m_valueMatchesRenderer; }
+    virtual void setFormControlValueMatchesRenderer(bool b = true) { m_valueMatchesRenderer = b; }
 
     virtual bool isFocusable() const;
 
+    virtual void attach();
+    virtual void recalcStyle(StyleChange);
+
 private:
     bool m_valueMatchesRenderer;
 };
 
-class WMLFormControlElementWithState : public WMLFormControlElement, public FormControlElementWithState {
-public:
-    WMLFormControlElementWithState(const QualifiedName& tagName, Document*);
-    virtual ~WMLFormControlElementWithState();
-
-    virtual bool isFormControlElementWithState() const { return true; }
-    virtual FormControlElement* toFormControlElement() { return this; }
-};
-
 }
 
 #endif
diff --git a/WebCore/wml/WMLGoElement.cpp b/WebCore/wml/WMLGoElement.cpp
index 603a71d..7293e66 100644
--- a/WebCore/wml/WMLGoElement.cpp
+++ b/WebCore/wml/WMLGoElement.cpp
@@ -28,6 +28,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "ResourceRequest.h"
 #include "TextEncoding.h"
 #include "WMLCardElement.h"
diff --git a/WebCore/wml/WMLImageElement.cpp b/WebCore/wml/WMLImageElement.cpp
index 39d103d..d47868a 100644
--- a/WebCore/wml/WMLImageElement.cpp
+++ b/WebCore/wml/WMLImageElement.cpp
@@ -27,6 +27,7 @@
 #include "CSSValueKeywords.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
 #include "WMLNames.h"
 #include "WMLVariables.h"
diff --git a/WebCore/wml/WMLInputElement.cpp b/WebCore/wml/WMLInputElement.cpp
index 9a44013..cb824d1 100644
--- a/WebCore/wml/WMLInputElement.cpp
+++ b/WebCore/wml/WMLInputElement.cpp
@@ -28,6 +28,7 @@
 #include "Frame.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "RenderTextControlSingleLine.h"
 #include "TextEvent.h"
 #include "WMLDocument.h"
@@ -37,8 +38,7 @@
 namespace WebCore {
 
 WMLInputElement::WMLInputElement(const QualifiedName& tagName, Document* doc)
-    : WMLFormControlElementWithState(tagName, doc)
-    , m_data(this, this)
+    : WMLFormControlElement(tagName, doc)
     , m_isPasswordField(false)
     , m_isEmptyOk(false)
     , m_numOfCharsAllowedByMask(0)
@@ -59,17 +59,17 @@
 
 bool WMLInputElement::isKeyboardFocusable(KeyboardEvent*) const
 {
-    return WMLFormControlElementWithState::isFocusable();
+    return WMLFormControlElement::isFocusable();
 }
 
 bool WMLInputElement::isMouseFocusable() const
 {
-    return WMLFormControlElementWithState::isFocusable();
+    return WMLFormControlElement::isFocusable();
 }
 
 void WMLInputElement::dispatchFocusEvent()
 {
-    InputElement::dispatchFocusEvent(m_data, document());
+    InputElement::dispatchFocusEvent(m_data, this, this);
     WMLElement::dispatchFocusEvent();
 }
 
@@ -83,22 +83,22 @@
     }
 
     // update the name variable of WML input elmenet
-    String nameVariable = name();
+    String nameVariable = formControlName();
     if (!nameVariable.isEmpty())
         wmlPageStateForDocument(document())->storeVariable(nameVariable, val); 
 
-    InputElement::dispatchBlurEvent(m_data, document());
+    InputElement::dispatchBlurEvent(m_data, this, this);
     WMLElement::dispatchBlurEvent();
 }
 
 void WMLInputElement::updateFocusAppearance(bool restorePreviousSelection)
 {
-    InputElement::updateFocusAppearance(m_data, document(), restorePreviousSelection);
+    InputElement::updateFocusAppearance(m_data, this, this, restorePreviousSelection);
 }
 
 void WMLInputElement::aboutToUnload()
 {
-    InputElement::aboutToUnload(m_data, document());
+    InputElement::aboutToUnload(this, this);
 }
 
 int WMLInputElement::size() const
@@ -106,7 +106,7 @@
     return m_data.size();
 }
 
-const AtomicString& WMLInputElement::type() const
+const AtomicString& WMLInputElement::formControlType() const
 {
     // needs to be lowercase according to DOM spec
     if (m_isPasswordField) {
@@ -118,7 +118,7 @@
     return text;
 }
 
-const AtomicString& WMLInputElement::name() const
+const AtomicString& WMLInputElement::formControlName() const
 {
     return m_data.name();
 }
@@ -134,30 +134,30 @@
 
 void WMLInputElement::setValue(const String& value)
 {
-    InputElement::updatePlaceholderVisibility(m_data, document());
-    setValueMatchesRenderer(false);
+    InputElement::updatePlaceholderVisibility(m_data, this, this);
+    setFormControlValueMatchesRenderer(false);
     m_data.setValue(constrainValue(value));
     if (inDocument())
-        document()->updateRendering();
+        document()->updateStyleIfNeeded();
     if (renderer())
         renderer()->updateFromElement();
-    setChanged();
+    setNeedsStyleRecalc();
 
     unsigned max = m_data.value().length();
     if (document()->focusedNode() == this)
-        InputElement::updateSelectionRange(m_data, max, max);
+        InputElement::updateSelectionRange(this, this, max, max);
     else
         cacheSelection(max, max);
 
-    InputElement::notifyFormStateChanged(m_data, document());
+    InputElement::notifyFormStateChanged(this);
 }
 
 void WMLInputElement::setValueFromRenderer(const String& value)
 {
-    InputElement::setValueFromRenderer(m_data, document(), value);
+    InputElement::setValueFromRenderer(m_data, this, this, value);
 }
 
-bool WMLInputElement::saveState(String& result) const
+bool WMLInputElement::saveFormControlState(String& result) const
 {
     if (m_isPasswordField)
         return false;
@@ -166,7 +166,7 @@
     return true;
 }
 
-void WMLInputElement::restoreState(const String& state)
+void WMLInputElement::restoreFormControlState(const String& state)
 {
     ASSERT(!m_isPasswordField); // should never save/restore password fields
     setValue(state);
@@ -194,12 +194,12 @@
     } else if (attr->name() == HTMLNames::valueAttr) {
         // We only need to setChanged if the form is looking at the default value right now.
         if (m_data.value().isNull())
-            setChanged();
-        setValueMatchesRenderer(false);
+            setNeedsStyleRecalc();
+        setFormControlValueMatchesRenderer(false);
     } else if (attr->name() == HTMLNames::maxlengthAttr)
-        InputElement::parseMaxLengthAttribute(m_data, attr);
+        InputElement::parseMaxLengthAttribute(m_data, this, this, attr);
     else if (attr->name() == HTMLNames::sizeAttr)
-        InputElement::parseSizeAttribute(m_data, attr);
+        InputElement::parseSizeAttribute(m_data, this, attr);
     else if (attr->name() == WMLNames::formatAttr)
         m_formatMask = validateInputMask(parseValueForbiddingVariableReferences(attr->value()));
     else if (attr->name() == WMLNames::emptyokAttr)
@@ -224,37 +224,18 @@
     return new (arena) RenderTextControlSingleLine(this);
 }
 
-void WMLInputElement::attach()
-{
-    ASSERT(!attached());
-    WMLElement::attach();
-
-    // The call to updateFromElement() needs to go after the call through
-    // to the base class's attach() because that can sometimes do a close
-    // on the renderer.
-    if (renderer())
-        renderer()->updateFromElement();
-
-    // FIXME: maybe this is not a good place to do this since it is possible 
-    // to cause unexpected several times initialise of <input> if we force the
-    // node to be reattached. But placing it here can ensure the run-webkit-tests
-    // get expected result,i.e. multiple-times initialise is expected when making
-    // layout test for WMLInputElement 
-    init();
-}  
-
 void WMLInputElement::detach()
 {
     WMLElement::detach();
-    setValueMatchesRenderer(false);
+    setFormControlValueMatchesRenderer(false);
 }
     
 bool WMLInputElement::appendFormData(FormDataList& encoding, bool)
 {
-    if (name().isEmpty())
+    if (formControlName().isEmpty())
         return false;
 
-    encoding.appendData(name(), value());
+    encoding.appendData(formControlName(), value());
     return true;
 }
 
@@ -300,13 +281,13 @@
     if (clickDefaultFormButton) {
         // Fire onChange for text fields.
         RenderObject* r = renderer();
-        if (r && r->isEdited()) {
-            dispatchEventForType(eventNames().changeEvent, true, false);
+        if (r && toRenderTextControl(r)->isEdited()) {
+            dispatchEvent(eventNames().changeEvent, true, false);
             
             // Refetch the renderer since arbitrary JS code run during onchange can do anything, including destroying it.
             r = renderer();
             if (r)
-                r->setEdited(false);
+                toRenderTextControl(r)->setEdited(false);
         }
 
         evt->setDefaultHandled();
@@ -314,7 +295,7 @@
     }
 
     if (evt->isBeforeTextInsertedEvent())
-        InputElement::handleBeforeTextInsertedEvent(m_data, document(), evt);
+        InputElement::handleBeforeTextInsertedEvent(m_data, this, document(), evt);
 
     if (renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent() || evt->type() == eventNames().blurEvent || evt->type() == eventNames().focusEvent))
         static_cast<RenderTextControlSingleLine*>(renderer())->forwardEvent(evt);
@@ -328,7 +309,7 @@
 
 String WMLInputElement::constrainValue(const String& proposedValue) const
 {
-    return InputElement::constrainValue(m_data, proposedValue, m_data.maxLength());
+    return InputElement::constrainValue(this, proposedValue, m_data.maxLength());
 }
 
 void WMLInputElement::documentDidBecomeActive()
@@ -359,9 +340,9 @@
     WMLElement::didMoveToNewOwnerDocument();
 }
 
-void WMLInputElement::init()
+void WMLInputElement::initialize()
 {
-    String nameVariable = name();
+    String nameVariable = formControlName();
     String variableValue;
     WMLPageState* pageSate = wmlPageStateForDocument(document()); 
     ASSERT(pageSate);
diff --git a/WebCore/wml/WMLInputElement.h b/WebCore/wml/WMLInputElement.h
index a2c904f..7529968 100644
--- a/WebCore/wml/WMLInputElement.h
+++ b/WebCore/wml/WMLInputElement.h
@@ -29,7 +29,7 @@
 
 class FormDataList;
 
-class WMLInputElement : public WMLFormControlElementWithState, public InputElement {
+class WMLInputElement : public WMLFormControlElement, public InputElement {
 public:
     WMLInputElement(const QualifiedName& tagName, Document*);
     virtual ~WMLInputElement();
@@ -45,7 +45,7 @@
     virtual bool isChecked() const { return false; }
     virtual bool isAutofilled() const { return false; }
     virtual bool isIndeterminate() const { return false; }
-    virtual bool isTextControl() const { return true; }
+    virtual bool isTextFormControl() const { return true; }
     virtual bool isRadioButton() const { return false; }
     virtual bool isTextField() const { return true; }
     virtual bool isSearchField() const { return false; }
@@ -54,15 +54,16 @@
     virtual bool searchEventsShouldBeDispatched() const { return false; }
 
     virtual int size() const;
-    virtual const AtomicString& type() const;
-    virtual const AtomicString& name() const;
+    virtual const AtomicString& formControlType() const;
+    virtual const AtomicString& formControlName() const;
     virtual String value() const;
     virtual void setValue(const String&);
-    virtual String placeholderValue() const { return String(); }
+    virtual String placeholder() const { return String(); }
+    virtual void setPlaceholder(const String&) { }
     virtual void setValueFromRenderer(const String&);
 
-    virtual bool saveState(String& value) const;
-    virtual void restoreState(const String&);
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
 
     virtual void select();
     virtual void accessKeyAction(bool sendToAnyElement);
@@ -71,7 +72,6 @@
     virtual void copyNonAttributeProperties(const Element* source);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual void attach();
     virtual void detach();
     virtual bool appendFormData(FormDataList&, bool);
     virtual void reset();
@@ -91,7 +91,9 @@
     bool isConformedToInputMask(UChar, unsigned, bool isUserInput = true);
 
 private:
-    void init();
+    friend class WMLCardElement;
+    void initialize();
+
     String validateInputMask(const String&);
     unsigned cursorPositionToMaskIndex(unsigned);
 
diff --git a/WebCore/wml/WMLMetaElement.cpp b/WebCore/wml/WMLMetaElement.cpp
index 71bbf51..81109ae 100644
--- a/WebCore/wml/WMLMetaElement.cpp
+++ b/WebCore/wml/WMLMetaElement.cpp
@@ -25,6 +25,7 @@
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/WebCore/wml/WMLNoopElement.cpp b/WebCore/wml/WMLNoopElement.cpp
index 0460d9f..1ba1c18 100644
--- a/WebCore/wml/WMLNoopElement.cpp
+++ b/WebCore/wml/WMLNoopElement.cpp
@@ -53,7 +53,7 @@
     if (parent->hasTagName(doTag)) {
         WMLDoElement* doElement = static_cast<WMLDoElement*>(parent);
         doElement->setNoop(true);
-        doElement->setChanged();
+        doElement->setNeedsStyleRecalc();
     } else if (parent->hasTagName(anchorTag))
         reportWMLError(document(), WMLErrorForbiddenTaskInAnchorElement);
 }
diff --git a/WebCore/wml/WMLOnEventElement.cpp b/WebCore/wml/WMLOnEventElement.cpp
index 2b808c8..a8d35a0 100644
--- a/WebCore/wml/WMLOnEventElement.cpp
+++ b/WebCore/wml/WMLOnEventElement.cpp
@@ -24,6 +24,7 @@
 #include "WMLOnEventElement.h"
 
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "WMLErrorHandling.h"
 #include "WMLEventHandlingElement.h"
 #include "WMLIntrinsicEventHandler.h"
diff --git a/WebCore/wml/WMLOptGroupElement.cpp b/WebCore/wml/WMLOptGroupElement.cpp
index 3658cf6..d70731c 100644
--- a/WebCore/wml/WMLOptGroupElement.cpp
+++ b/WebCore/wml/WMLOptGroupElement.cpp
@@ -24,10 +24,12 @@
 #include "WMLOptGroupElement.h"
 
 #include "Document.h"
+#include "MappedAttribute.h"
 #include "HTMLNames.h"
 #include "NodeRenderStyle.h"
 #include "RenderStyle.h"
 #include "WMLNames.h"
+#include "WMLSelectElement.h"
 
 namespace WebCore {
 
@@ -42,7 +44,7 @@
 {
 }
 
-const AtomicString& WMLOptGroupElement::type() const
+const AtomicString& WMLOptGroupElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, optgroup, ("optgroup"));
     return optgroup;
@@ -50,7 +52,7 @@
 
 bool WMLOptGroupElement::insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
-    bool result = WMLElement::insertBefore(newChild, refChild, ec, shouldLazyAttach);
+    bool result = WMLFormControlElement::insertBefore(newChild, refChild, ec, shouldLazyAttach);
     if (result)
         recalcSelectOptions();
     return result;
@@ -58,7 +60,7 @@
 
 bool WMLOptGroupElement::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
-    bool result = WMLElement::replaceChild(newChild, oldChild, ec, shouldLazyAttach);
+    bool result = WMLFormControlElement::replaceChild(newChild, oldChild, ec, shouldLazyAttach);
     if (result)
         recalcSelectOptions();
     return result;
@@ -66,7 +68,7 @@
 
 bool WMLOptGroupElement::removeChild(Node* oldChild, ExceptionCode& ec)
 {
-    bool result = WMLElement::removeChild(oldChild, ec);
+    bool result = WMLFormControlElement::removeChild(oldChild, ec);
     if (result)
         recalcSelectOptions();
     return result;
@@ -74,7 +76,7 @@
 
 bool WMLOptGroupElement::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
-    bool result = WMLElement::appendChild(newChild, ec, shouldLazyAttach);
+    bool result = WMLFormControlElement::appendChild(newChild, ec, shouldLazyAttach);
     if (result)
         recalcSelectOptions();
     return result;
@@ -82,17 +84,15 @@
 
 bool WMLOptGroupElement::removeChildren()
 {
-    bool result = WMLElement::removeChildren();
+    bool result = WMLFormControlElement::removeChildren();
     if (result)
         recalcSelectOptions();
     return result;
 }
 
-// FIXME: Activate once WMLSelectElement is available 
-#if 0
-static inline WMLElement* ownerSelectElement()
+static inline WMLSelectElement* ownerSelectElement(Element* element)
 {
-    Node* select = parentNode();
+    Node* select = element->parentNode();
     while (select && !select->hasTagName(selectTag))
         select = select->parentNode();
 
@@ -101,25 +101,21 @@
 
     return static_cast<WMLSelectElement*>(select);
 }
-#endif
 
 void WMLOptGroupElement::accessKeyAction(bool)
 {
-    // FIXME: Activate once WMLSelectElement is available 
-#if 0
-    WMLSelectElement* select = ownerSelectElement();
+    WMLSelectElement* select = ownerSelectElement(this);
     if (!select || select->focused())
         return;
 
     // send to the parent to bring focus to the list box
     select->accessKeyAction(false);
-#endif
 }
 
 void WMLOptGroupElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     recalcSelectOptions();
-    WMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    WMLFormControlElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
 void WMLOptGroupElement::parseMappedAttribute(MappedAttribute* attr)
@@ -129,7 +125,7 @@
         return;
     }
 
-    WMLElement::parseMappedAttribute(attr);
+    WMLFormControlElement::parseMappedAttribute(attr);
     recalcSelectOptions();
 }
 
@@ -137,13 +133,13 @@
 {
     if (parentNode()->renderStyle())
         setRenderStyle(styleForRenderer());
-    WMLElement::attach();
+    WMLFormControlElement::attach();
 }
 
 void WMLOptGroupElement::detach()
 {
     m_style.clear();
-    WMLElement::detach();
+    WMLFormControlElement::detach();
 }
 
 void WMLOptGroupElement::setRenderStyle(PassRefPtr<RenderStyle> style)
@@ -170,11 +166,8 @@
 
 void WMLOptGroupElement::recalcSelectOptions()
 {
-    // FIXME: Activate once WMLSelectElement is available 
-#if 0
-    if (WMLSelectElement* select = ownerSelectElement())
+    if (WMLSelectElement* select = ownerSelectElement(this))
         select->setRecalcListItems();
-#endif
 }
 
 }
diff --git a/WebCore/wml/WMLOptGroupElement.h b/WebCore/wml/WMLOptGroupElement.h
index 45e5412..1ba5ac1 100644
--- a/WebCore/wml/WMLOptGroupElement.h
+++ b/WebCore/wml/WMLOptGroupElement.h
@@ -34,7 +34,7 @@
 
     String title() const { return m_title; }
 
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
 
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
diff --git a/WebCore/wml/WMLOptionElement.cpp b/WebCore/wml/WMLOptionElement.cpp
index dd1466f..1087134 100644
--- a/WebCore/wml/WMLOptionElement.cpp
+++ b/WebCore/wml/WMLOptionElement.cpp
@@ -24,9 +24,11 @@
 #include "WMLOptionElement.h"
 
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "NodeRenderStyle.h"
 #include "RenderStyle.h"
 #include "WMLNames.h"
+#include "WMLSelectElement.h"
 
 namespace WebCore {
 
@@ -34,7 +36,6 @@
 
 WMLOptionElement::WMLOptionElement(const QualifiedName& tagName, Document* doc)
     : WMLFormControlElement(tagName, doc)
-    , m_data(this)
 {
 }
 
@@ -42,17 +43,15 @@
 {
 }
 
-const AtomicString& WMLOptionElement::type() const
+const AtomicString& WMLOptionElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, option, ("option"));
     return option;
 }
 
-// FIXME: Activate once WMLSelectElement is available 
-#if 0
-static inline WMLElement* ownerSelectElement()
+static inline WMLSelectElement* ownerSelectElement(Element* element)
 {
-    Node* select = parentNode();
+    Node* select = element->parentNode();
     while (select && !select->hasTagName(selectTag))
         select = select->parentNode();
 
@@ -61,26 +60,19 @@
 
     return static_cast<WMLSelectElement*>(select);
 }
-#endif
 
 void WMLOptionElement::accessKeyAction(bool)
 {
-    // FIXME: Activate once WMLSelectElement is available 
-#if 0
-    if (WMLSelectElement* select = ownerSelectElement())
-        select->accessKeySetSelectedIndex(index());
-#endif
+    if (WMLSelectElement* select = ownerSelectElement(this))
+        select->accessKeySetSelectedIndex(OptionElement::optionIndex(select, this));
 }
 
 void WMLOptionElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    // FIXME: Activate once WMLSelectElement is available 
-#if 0
-    if (WMLSelectElement* select = ownerSelectElement())
+    if (WMLSelectElement* select = ownerSelectElement(this))
         select->childrenChanged(changedByParser);
-#endif
 
-    WMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    WMLFormControlElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
 void WMLOptionElement::parseMappedAttribute(MappedAttribute* attr)
@@ -96,20 +88,20 @@
         createEventHandlerIfNeeded();
         eventHandler()->registerIntrinsicEvent(WMLIntrinsicEventOnPick, event);
     } else
-        WMLElement::parseMappedAttribute(attr);
+        WMLFormControlElement::parseMappedAttribute(attr);
 }
 
 void WMLOptionElement::attach()
 {
     if (parentNode()->renderStyle())
         setRenderStyle(styleForRenderer());
-    WMLElement::attach();
+    WMLFormControlElement::attach();
 }
 
 void WMLOptionElement::detach()
 {
     m_style.clear();
-    WMLElement::detach();
+    WMLFormControlElement::detach();
 }
 
 void WMLOptionElement::setRenderStyle(PassRefPtr<RenderStyle> style)
@@ -119,14 +111,11 @@
 
 void WMLOptionElement::insertedIntoDocument()
 {
-    // FIXME: Activate once WMLSelectElement is available 
-#if 0
     WMLSelectElement* select;
-    if (selected() && (select = ownerSelectElement()))
+    if (selected() && (select = ownerSelectElement(this)))
         select->scrollToSelection();
-#endif
 
-    WMLElement::insertedIntoDocument();
+    WMLFormControlElement::insertedIntoDocument();
 }
 
 bool WMLOptionElement::selected() const
@@ -136,17 +125,22 @@
 
 void WMLOptionElement::setSelectedState(bool selected)
 {
-    OptionElement::setSelectedState(m_data, selected);
+    OptionElement::setSelectedState(m_data, this, selected);
 }
 
 String WMLOptionElement::value() const
 {
-    return OptionElement::collectOptionValue(m_data, document());
+    return OptionElement::collectOptionValue(m_data, this);
+}
+
+String WMLOptionElement::text() const
+{
+    return OptionElement::collectOptionText(m_data, this);
 }
 
 String WMLOptionElement::textIndentedToRespectGroupLabel() const
 {
-    return OptionElement::collectOptionTextRespectingGroupLabel(m_data, document());
+    return OptionElement::collectOptionTextRespectingGroupLabel(m_data, this);
 }
 
 RenderStyle* WMLOptionElement::nonRendererRenderStyle() const
diff --git a/WebCore/wml/WMLOptionElement.h b/WebCore/wml/WMLOptionElement.h
index e1d2e80..c34f319 100644
--- a/WebCore/wml/WMLOptionElement.h
+++ b/WebCore/wml/WMLOptionElement.h
@@ -33,7 +33,7 @@
     WMLOptionElement(const QualifiedName& tagName, Document*);
     virtual ~WMLOptionElement();
 
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
 
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
@@ -50,6 +50,7 @@
     virtual bool selected() const;
     virtual void setSelectedState(bool);
 
+    virtual String text() const;
     virtual String textIndentedToRespectGroupLabel() const;
     virtual String value() const;
 
diff --git a/WebCore/wml/WMLPElement.cpp b/WebCore/wml/WMLPElement.cpp
index 3655b2e..0cec653 100644
--- a/WebCore/wml/WMLPElement.cpp
+++ b/WebCore/wml/WMLPElement.cpp
@@ -30,6 +30,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "NodeList.h"
 #include "WMLNames.h"
 
diff --git a/WebCore/wml/WMLPostfieldElement.cpp b/WebCore/wml/WMLPostfieldElement.cpp
index 0cc7d42..69f61f5 100644
--- a/WebCore/wml/WMLPostfieldElement.cpp
+++ b/WebCore/wml/WMLPostfieldElement.cpp
@@ -26,6 +26,7 @@
 #include "CString.h"
 #include "TextEncoding.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "WMLDocument.h"
 #include "WMLGoElement.h"
 #include "WMLNames.h"
diff --git a/WebCore/wml/WMLSelectElement.cpp b/WebCore/wml/WMLSelectElement.cpp
new file mode 100644
index 0000000..5b5aed1
--- /dev/null
+++ b/WebCore/wml/WMLSelectElement.cpp
@@ -0,0 +1,224 @@
+/**
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(WML)
+#include "WMLSelectElement.h"
+
+#include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "RenderListBox.h"
+#include "RenderMenuList.h"
+
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+WMLSelectElement::WMLSelectElement(const QualifiedName& tagName, Document* document)
+    : WMLFormControlElement(tagName, document)
+{
+}
+
+WMLSelectElement::~WMLSelectElement()
+{
+}
+
+const AtomicString& WMLSelectElement::formControlType() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, selectMultiple, ("select-multiple"));
+    DEFINE_STATIC_LOCAL(const AtomicString, selectOne, ("select-one"));
+    return m_data.multiple() ? selectMultiple : selectOne;
+}
+
+bool WMLSelectElement::isKeyboardFocusable(KeyboardEvent* event) const
+{
+    if (renderer())
+        return isFocusable();
+
+    return WMLFormControlElement::isKeyboardFocusable(event);
+}
+
+bool WMLSelectElement::isMouseFocusable() const
+{
+    if (renderer())
+        return isFocusable();
+
+    return WMLFormControlElement::isMouseFocusable();
+}
+
+void WMLSelectElement::selectAll()
+{
+    SelectElement::selectAll(m_data, this);
+}
+
+void WMLSelectElement::recalcStyle(StyleChange change)
+{
+    SelectElement::recalcStyle(m_data, this);
+    WMLFormControlElement::recalcStyle(change);
+}
+
+void WMLSelectElement::dispatchFocusEvent()
+{
+    SelectElement::dispatchFocusEvent(m_data, this);
+    WMLFormControlElement::dispatchFocusEvent();
+}
+
+void WMLSelectElement::dispatchBlurEvent()
+{
+    SelectElement::dispatchBlurEvent(m_data, this);
+    WMLFormControlElement::dispatchBlurEvent();
+}
+
+int WMLSelectElement::selectedIndex() const
+{
+    return SelectElement::selectedIndex(m_data, this);
+}
+    
+void WMLSelectElement::setSelectedIndex(int index, bool deselect, bool fireOnChange)
+{
+    SelectElement::setSelectedIndex(m_data, this, index, deselect, fireOnChange);
+}
+
+bool WMLSelectElement::saveFormControlState(String& value) const
+{
+    return SelectElement::saveFormControlState(m_data, this, value);
+}
+
+void WMLSelectElement::restoreFormControlState(const String& state)
+{
+    SelectElement::restoreFormControlState(m_data, this, state);
+}
+
+void WMLSelectElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+    SelectElement::setRecalcListItems(m_data, this);
+    WMLFormControlElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+}
+
+void WMLSelectElement::parseMappedAttribute(MappedAttribute* attr) 
+{
+    if (attr->name() == HTMLNames::multipleAttr)
+        SelectElement::parseMultipleAttribute(m_data, this, attr);
+    else
+        WMLFormControlElement::parseMappedAttribute(attr);
+}
+
+RenderObject* WMLSelectElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    if (m_data.usesMenuList())
+        return new (arena) RenderMenuList(this);
+    return new (arena) RenderListBox(this);
+}
+
+bool WMLSelectElement::appendFormData(FormDataList& list, bool)
+{
+    return SelectElement::appendFormData(m_data, this, list);
+}
+
+int WMLSelectElement::optionToListIndex(int optionIndex) const
+{
+    return SelectElement::optionToListIndex(m_data, this, optionIndex);
+}
+
+int WMLSelectElement::listToOptionIndex(int listIndex) const
+{
+    return SelectElement::listToOptionIndex(m_data, this, listIndex);
+}
+
+void WMLSelectElement::reset()
+{
+    SelectElement::reset(m_data, this);
+}
+
+void WMLSelectElement::defaultEventHandler(Event* event)
+{
+    SelectElement::defaultEventHandler(m_data, this, event);
+}
+
+void WMLSelectElement::accessKeyAction(bool sendToAnyElement)
+{
+    focus();
+    dispatchSimulatedClick(0, sendToAnyElement);
+}
+
+void WMLSelectElement::setActiveSelectionAnchorIndex(int index)
+{
+    SelectElement::setActiveSelectionAnchorIndex(m_data, this, index);
+}
+    
+void WMLSelectElement::setActiveSelectionEndIndex(int index)
+{
+    SelectElement::setActiveSelectionEndIndex(m_data, index);
+}
+
+void WMLSelectElement::updateListBoxSelection(bool deselectOtherOptions)
+{
+    SelectElement::updateListBoxSelection(m_data, this, deselectOtherOptions);
+}
+
+void WMLSelectElement::listBoxOnChange()
+{
+    SelectElement::listBoxOnChange(m_data, this);
+}
+
+void WMLSelectElement::menuListOnChange()
+{
+    SelectElement::menuListOnChange(m_data, this);
+}
+
+int WMLSelectElement::activeSelectionStartListIndex() const
+{
+    if (m_data.activeSelectionAnchorIndex() >= 0)
+        return m_data.activeSelectionAnchorIndex();
+    return optionToListIndex(selectedIndex());
+}
+
+int WMLSelectElement::activeSelectionEndListIndex() const
+{
+    if (m_data.activeSelectionEndIndex() >= 0)
+        return m_data.activeSelectionEndIndex();
+    return SelectElement::lastSelectedListIndex(m_data, this);
+}
+
+void WMLSelectElement::accessKeySetSelectedIndex(int index)
+{
+    SelectElement::accessKeySetSelectedIndex(m_data, this, index);
+}
+
+void WMLSelectElement::setRecalcListItems()
+{
+    SelectElement::setRecalcListItems(m_data, this);
+}
+
+void WMLSelectElement::scrollToSelection()
+{
+    SelectElement::scrollToSelection(m_data, this);
+}
+
+void WMLSelectElement::insertedIntoTree(bool deep)
+{
+    SelectElement::insertedIntoTree(m_data, this);
+    WMLFormControlElement::insertedIntoTree(deep);
+}
+
+}
+
+#endif
diff --git a/WebCore/wml/WMLSelectElement.h b/WebCore/wml/WMLSelectElement.h
new file mode 100644
index 0000000..8d3e0f9
--- /dev/null
+++ b/WebCore/wml/WMLSelectElement.h
@@ -0,0 +1,94 @@
+/**
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef WMLSelectElement_h
+#define WMLSelectElement_h
+
+#if ENABLE(WML)
+#include "WMLFormControlElement.h"
+#include "SelectElement.h"
+
+namespace WebCore {
+
+class WMLSelectElement : public WMLFormControlElement, public SelectElement {
+public:
+    WMLSelectElement(const QualifiedName&, Document*);
+    virtual ~WMLSelectElement();
+
+    virtual const AtomicString& formControlType() const;
+ 
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
+    virtual bool isMouseFocusable() const;
+    virtual bool canSelectAll() const { return !m_data.usesMenuList(); }
+    virtual void selectAll();
+
+    virtual void recalcStyle(StyleChange);
+
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
+
+    virtual bool canStartSelection() const { return false; }
+
+    virtual int selectedIndex() const;
+    virtual void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false);
+
+    virtual int size() const { return m_data.size(); }
+    virtual bool multiple() const { return m_data.multiple(); }
+
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
+
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool appendFormData(FormDataList&, bool);
+    virtual int optionToListIndex(int optionIndex) const;
+    virtual int listToOptionIndex(int listIndex) const;
+
+    virtual const Vector<Element*>& listItems() const { return m_data.listItems(this); }
+    virtual void reset();
+
+    virtual void defaultEventHandler(Event*);
+    virtual void accessKeyAction(bool sendToAnyElement);
+    virtual void setActiveSelectionAnchorIndex(int index);
+    virtual void setActiveSelectionEndIndex(int index);
+    virtual void updateListBoxSelection(bool deselectOtherOptions);
+    virtual void listBoxOnChange();
+    virtual void menuListOnChange();
+
+    virtual int activeSelectionStartListIndex() const;
+    virtual int activeSelectionEndListIndex() const;
+
+    void accessKeySetSelectedIndex(int);
+    void setRecalcListItems();
+    void scrollToSelection();
+
+private:
+    virtual void insertedIntoTree(bool);
+
+    SelectElementData m_data;
+};
+
+}
+
+#endif
+#endif
diff --git a/WebCore/wml/WMLSetvarElement.cpp b/WebCore/wml/WMLSetvarElement.cpp
index 9bce944..da9a1f4 100644
--- a/WebCore/wml/WMLSetvarElement.cpp
+++ b/WebCore/wml/WMLSetvarElement.cpp
@@ -24,6 +24,7 @@
 #include "WMLSetvarElement.h"
 
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "WMLErrorHandling.h"
 #include "WMLTaskElement.h"
 #include "WMLVariables.h"
diff --git a/WebCore/wml/WMLTableElement.cpp b/WebCore/wml/WMLTableElement.cpp
index a305f97..92c7580 100644
--- a/WebCore/wml/WMLTableElement.cpp
+++ b/WebCore/wml/WMLTableElement.cpp
@@ -28,6 +28,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "NodeList.h"
 #include "RenderObject.h"
 #include "Text.h"
diff --git a/WebCore/wml/WMLTagNames.in b/WebCore/wml/WMLTagNames.in
index cabb1a5..fd7c762 100644
--- a/WebCore/wml/WMLTagNames.in
+++ b/WebCore/wml/WMLTagNames.in
@@ -13,7 +13,9 @@
 head interfaceName=WMLElement
 img interfaceName=WMLImageElement
 input
+#if 0
 # Note: 'insertedLegend' is not an official WML element - internal purpose only!
+#endif
 insertedLegend interfaceName=WMLInsertedLegendElement
 meta
 noop
@@ -24,14 +26,10 @@
 postfield
 prev
 refresh
+select
 setvar
 table
 td interfaceName=WMLElement
 template
 timer
 tr interfaceName=WMLElement
-
-#if 0
-# These elements have a corresponding HTML*Element class, that we want to share code with.
-# select
-#endif
diff --git a/WebCore/wml/WMLTemplateElement.cpp b/WebCore/wml/WMLTemplateElement.cpp
index 73e9c06..2575c9a 100644
--- a/WebCore/wml/WMLTemplateElement.cpp
+++ b/WebCore/wml/WMLTemplateElement.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(WML)
 #include "WMLTemplateElement.h"
 
+#include "MappedAttribute.h"
 #include "NodeList.h"
 #include "WMLCardElement.h"
 #include "WMLDocument.h"
diff --git a/WebCore/wml/WMLTimerElement.cpp b/WebCore/wml/WMLTimerElement.cpp
index 7cd2e50..00c7036 100644
--- a/WebCore/wml/WMLTimerElement.cpp
+++ b/WebCore/wml/WMLTimerElement.cpp
@@ -24,6 +24,7 @@
 #include "WMLTimerElement.h"
 
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "WMLCardElement.h"
 #include "WMLDocument.h"
 #include "WMLNames.h"
diff --git a/WebCore/workers/WorkerContext.cpp b/WebCore/workers/WorkerContext.cpp
index 69ef472..0b8778a 100644
--- a/WebCore/workers/WorkerContext.cpp
+++ b/WebCore/workers/WorkerContext.cpp
@@ -42,12 +42,12 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "SecurityOrigin.h"
-#include "ThreadableLoader.h"
 #include "WorkerImportScriptsClient.h"
 #include "WorkerLocation.h"
 #include "WorkerNavigator.h"
 #include "WorkerObjectProxy.h"
 #include "WorkerThread.h"
+#include "WorkerThreadableLoader.h"
 #include "XMLHttpRequestException.h"
 #include <wtf/RefPtr.h>
 
@@ -56,9 +56,9 @@
 WorkerContext::WorkerContext(const KURL& url, const String& userAgent, WorkerThread* thread)
     : m_url(url)
     , m_userAgent(userAgent)
-    , m_location(WorkerLocation::create(url))
     , m_script(new WorkerScriptController(this))
     , m_thread(thread)
+    , m_closing(false)
 {
     setSecurityOrigin(SecurityOrigin::create(url));
 }
@@ -67,7 +67,7 @@
 {
     ASSERT(currentThread() == m_thread->threadID());
 
-    m_thread->workerObjectProxy()->workerContextDestroyed();
+    m_thread->workerObjectProxy().workerContextDestroyed();
 }
 
 ScriptExecutionContext* WorkerContext::scriptExecutionContext() const
@@ -92,7 +92,7 @@
     if (url.isNull())
         return KURL();
     // Always use UTF-8 in Workers.
-    return KURL(m_location->url(), url);
+    return KURL(m_url, url);
 }
 
 String WorkerContext::userAgent(const KURL&) const
@@ -100,6 +100,22 @@
     return m_userAgent;
 }
 
+WorkerLocation* WorkerContext::location() const
+{
+    if (!m_location)
+        m_location = WorkerLocation::create(m_url);
+    return m_location.get();
+}
+
+void WorkerContext::close()
+{
+    if (m_closing)
+        return;
+
+    m_closing = true;
+    m_thread->stop();
+}
+
 WorkerNavigator* WorkerContext::navigator() const
 {
     if (!m_navigator)
@@ -120,12 +136,12 @@
 
 void WorkerContext::reportException(const String& errorMessage, int lineNumber, const String& sourceURL)
 {
-    m_thread->workerObjectProxy()->postExceptionToWorkerObject(errorMessage, lineNumber, sourceURL);
+    m_thread->workerObjectProxy().postExceptionToWorkerObject(errorMessage, lineNumber, sourceURL);
 }
 
 void WorkerContext::addMessage(MessageDestination destination, MessageSource source, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
 {
-    m_thread->workerObjectProxy()->postConsoleMessageToWorkerObject(destination, source, level, message, lineNumber, sourceURL);
+    m_thread->workerObjectProxy().postConsoleMessageToWorkerObject(destination, source, level, message, lineNumber, sourceURL);
 }
 
 void WorkerContext::resourceRetrievedByXMLHttpRequest(unsigned long, const ScriptString&)
@@ -142,7 +158,10 @@
 
 void WorkerContext::postMessage(const String& message)
 {
-    m_thread->workerObjectProxy()->postMessageToWorkerObject(message);
+    if (m_closing)
+        return;
+
+    m_thread->workerObjectProxy().postMessageToWorkerObject(message);
 }
 
 void WorkerContext::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
@@ -201,18 +220,30 @@
     thread()->runLoop().postTask(task);
 }
 
-int WorkerContext::installTimeout(ScheduledAction* action, int timeout, bool singleShot)
+int WorkerContext::setTimeout(ScheduledAction* action, int timeout)
 {
-    return DOMTimer::install(scriptExecutionContext(), action, timeout, singleShot);
+    return DOMTimer::install(scriptExecutionContext(), action, timeout, true);
 }
 
-void WorkerContext::removeTimeout(int timeoutId)
+void WorkerContext::clearTimeout(int timeoutId)
+{
+    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
+}
+
+int WorkerContext::setInterval(ScheduledAction* action, int timeout)
+{
+    return DOMTimer::install(scriptExecutionContext(), action, timeout, false);
+}
+
+void WorkerContext::clearInterval(int timeoutId)
 {
     DOMTimer::removeById(scriptExecutionContext(), timeoutId);
 }
 
 void WorkerContext::dispatchMessage(const String& message)
 {
+    // Since close() stops the thread event loop, this should not ever get called while closing.
+    ASSERT(!m_closing);
     RefPtr<Event> evt = MessageEvent::create(message, "", "", 0, 0);
 
     if (m_onmessageListener.get()) {
@@ -247,7 +278,7 @@
         request.setHTTPMethod("GET");
         request.setHTTPOrigin(securityOrigin);
         WorkerImportScriptsClient client(scriptExecutionContext(), *it, callerURL, callerLine);
-        ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, client);
+        WorkerThreadableLoader::loadResourceSynchronously(this, request, client, AllowStoredCredentials, AllowDifferentRedirectOrigin);
         
         // If the fetching attempt failed, throw a NETWORK_ERR exception and abort all these steps.
         if (client.failed()) {
diff --git a/WebCore/workers/WorkerContext.h b/WebCore/workers/WorkerContext.h
index 39a5b9b..ce782f8 100644
--- a/WebCore/workers/WorkerContext.h
+++ b/WebCore/workers/WorkerContext.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -57,6 +57,8 @@
 
         virtual bool isWorkerContext() const { return true; }
 
+        virtual WorkerContext* toWorkerContext() { return this; }
+
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
         const KURL& url() const { return m_url; }
@@ -64,11 +66,9 @@
 
         virtual String userAgent(const KURL&) const;
 
-        WorkerLocation* location() const { return m_location.get(); }
-        WorkerNavigator* navigator() const;
-
         WorkerScriptController* script() { return m_script.get(); }
         void clearScript() { return m_script.clear(); }
+
         WorkerThread* thread() { return m_thread; }
 
         bool hasPendingActivity() const;
@@ -78,46 +78,64 @@
         virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
         virtual void scriptImported(unsigned long identifier, const String& sourceString);
 
-        virtual WorkerContext* toWorkerContext() { return this; }
-
-        void postMessage(const String& message);
         virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
 
-        int installTimeout(ScheduledAction*, int timeout, bool singleShot);
-        void removeTimeout(int timeoutId);
 
-        void dispatchMessage(const String&);
+        // WorkerGlobalScope
+        WorkerContext* self() { return this; }
+        WorkerLocation* location() const;
+        void close();
 
+        // WorkerUtils
+        void importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode&);
+        WorkerNavigator* navigator() const;
+
+
+        // DedicatedWorkerGlobalScope
+        void postMessage(const String& message);
+        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onmessageListener = eventListener; }
+        EventListener* onmessage() const { return m_onmessageListener.get(); }
+
+        // Timers
+        int setTimeout(ScheduledAction*, int timeout);
+        void clearTimeout(int timeoutId);
+        int setInterval(ScheduledAction*, int timeout);
+        void clearInterval(int timeoutId);
+
+        // EventTarget
         virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
         virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
         virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
 
-        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onmessageListener = eventListener; }
-        EventListener* onmessage() const { return m_onmessageListener.get(); }
-
         typedef Vector<RefPtr<EventListener> > ListenerVector;
         typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
         EventListenersMap& eventListeners() { return m_eventListeners; }
 
-        void importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode&);
-        
+        void dispatchMessage(const String&);
+
+        // These methods are used for GC marking. See JSWorkerContext::mark() in
+        // JSWorkerContextCustom.cpp.
+        WorkerNavigator* optionalNavigator() const { return m_navigator.get(); }
+        WorkerLocation* optionalLocation() const { return m_location.get(); }
+
         using RefCounted<WorkerContext>::ref;
         using RefCounted<WorkerContext>::deref;
 
     private:
+        WorkerContext(const KURL&, const String&, WorkerThread*);
+
         virtual void refScriptExecutionContext() { ref(); }
         virtual void derefScriptExecutionContext() { deref(); }
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
 
-        WorkerContext(const KURL&, const String&, WorkerThread*);
-
         virtual const KURL& virtualURL() const;
         virtual KURL virtualCompleteURL(const String&) const;
 
         KURL m_url;
         String m_userAgent;
-        RefPtr<WorkerLocation> m_location;
+
+        mutable RefPtr<WorkerLocation> m_location;
         mutable RefPtr<WorkerNavigator> m_navigator;
 
         OwnPtr<WorkerScriptController> m_script;
@@ -125,6 +143,8 @@
 
         RefPtr<EventListener> m_onmessageListener;
         EventListenersMap m_eventListeners;
+
+        bool m_closing;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/WorkerContext.idl b/WebCore/workers/WorkerContext.idl
index bbfca63..60568fb 100644
--- a/WebCore/workers/WorkerContext.idl
+++ b/WebCore/workers/WorkerContext.idl
@@ -34,28 +34,36 @@
         LegacyParent=JSWorkerContextBase,
         NoStaticTables
     ] WorkerContext {
-#if defined(LANGUAGE_JAVASCRIPT)
-        attribute [Custom] WorkerContext self;
+
+        // WorkerGlobalScope
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+                 attribute [Replaceable] WorkerContext self;
 #endif
+                 attribute [Replaceable] WorkerLocation location;
+        void close();
+        //         attribute EventListener onclose;
+        //         attribute EventListener onerror;
 
-        attribute EventListener onmessage;
+        // WorkerUtils
+        [Custom] void importScripts(/*[Variadic] in DOMString urls */);
+                 attribute [Replaceable] WorkerNavigator navigator;
+        // Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize);
+        // DatabaseSync openDatabaseSync(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize);
+
+
+        // DedicatedWorkerGlobalScope
         void postMessage(in DOMString message);
-        [Custom] void importScripts(/* urls */);
+                 attribute EventListener onmessage;
 
-        attribute [Replaceable] WorkerLocation location;
-        attribute [Replaceable] WorkerNavigator navigator;
-        
-        attribute MessageEventConstructor MessageEvent;
-        attribute WorkerLocationConstructor WorkerLocation;
 
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
         // [Custom] long setTimeout(in DOMString code, in long timeout);
-        [Custom] void clearTimeout(in long handle);
-
+        void clearTimeout(in long handle);
         [Custom] long setInterval(in TimeoutHandler handler, in long timeout);
         // [Custom] long setInterval(in DOMString code, in long timeout);
-        [Custom] void clearInterval(in long handle);
+        void clearInterval(in long handle);
+
 
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type, 
@@ -66,6 +74,13 @@
                                           in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
+
+
+        // Constructors
+        attribute MessageEventConstructor MessageEvent;
+        attribute WorkerLocationConstructor WorkerLocation;
+
+        attribute [JSCCustomGetter] XMLHttpRequestConstructor XMLHttpRequest;
     };
 
 }
diff --git a/WebCore/workers/WorkerLoaderProxy.h b/WebCore/workers/WorkerLoaderProxy.h
new file mode 100644
index 0000000..b51f480
--- /dev/null
+++ b/WebCore/workers/WorkerLoaderProxy.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerLoaderProxy_h
+#define WorkerLoaderProxy_h
+
+#if ENABLE(WORKERS)
+
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class ScriptExecutionContext::Task;
+    class String;
+
+    // A proxy to talk to the loader context. Normally, the document on the main thread
+    // provides loading services for the subordinate workers. This interface provides 2-way
+    // communications to the Document context and back to the worker.
+    // Note that in multi-process browsers, the Worker object context and the Document
+    // context can be distinct.
+    class WorkerLoaderProxy {
+    public:
+        virtual ~WorkerLoaderProxy() { }
+
+        // Posts a task to the thread which runs the loading code (normally, the main thread).
+        virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>) = 0;
+
+        // Posts callbacks from loading code to the WorkerContext. The 'mode' is used to differentiate
+        // specific synchronous loading requests so they can be 'nested', per spec.
+        virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String& mode) = 0;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
+
+#endif // WorkerLoaderProxy_h
diff --git a/WebCore/workers/WorkerMessagingProxy.cpp b/WebCore/workers/WorkerMessagingProxy.cpp
index 4b34658..a6d0d5d 100644
--- a/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/WebCore/workers/WorkerMessagingProxy.cpp
@@ -62,7 +62,7 @@
 
         context->dispatchMessage(m_message);
 
-        context->thread()->workerObjectProxy()->confirmMessageFromWorkerObject(context->hasPendingActivity());
+        context->thread()->workerObjectProxy().confirmMessageFromWorkerObject(context->hasPendingActivity());
     }
 
 private:
@@ -200,7 +200,7 @@
 
 void WorkerMessagingProxy::startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
 {
-    RefPtr<WorkerThread> thread = WorkerThread::create(scriptURL, userAgent, sourceCode, this);
+    RefPtr<WorkerThread> thread = WorkerThread::create(scriptURL, userAgent, sourceCode, *this, *this);
     workerThreadCreated(thread);
     thread->start();
 }
@@ -222,11 +222,6 @@
         m_queuedEarlyTasks.append(MessageWorkerContextTask::create(message));
 }
 
-void WorkerMessagingProxy::postTaskToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task)
-{
-    postTaskForModeToWorkerContext(task, WorkerRunLoop::defaultMode());
-}
-
 void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     if (m_askedToTerminate)
@@ -236,8 +231,10 @@
     m_workerThread->runLoop().postTaskForMode(task, mode);
 }
 
-void WorkerMessagingProxy::postTaskToWorkerObject(PassRefPtr<ScriptExecutionContext::Task> task)
+void WorkerMessagingProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task> task)
 {
+    // FIXME: In case of nested workers, this should go directly to the root Document context.
+    ASSERT(m_scriptExecutionContext->isDocument());
     m_scriptExecutionContext->postTask(task);
 }
 
@@ -296,6 +293,7 @@
 {
     // WorkerContextDestroyedTask is always the last to be performed, so the proxy is not needed for communication
     // in either side any more. However, the Worker object may still exist, and it assumes that the proxy exists, too.
+    m_askedToTerminate = true;
     m_workerThread = 0;
     if (!m_workerObject)
         delete this;
diff --git a/WebCore/workers/WorkerMessagingProxy.h b/WebCore/workers/WorkerMessagingProxy.h
index 8d81deb..7fc9797 100644
--- a/WebCore/workers/WorkerMessagingProxy.h
+++ b/WebCore/workers/WorkerMessagingProxy.h
@@ -31,6 +31,7 @@
 
 #include "ScriptExecutionContext.h"
 #include "WorkerContextProxy.h"
+#include "WorkerLoaderProxy.h"
 #include "WorkerObjectProxy.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/PassRefPtr.h>
@@ -44,7 +45,7 @@
     class Worker;
     class WorkerThread;
 
-    class WorkerMessagingProxy : public WorkerContextProxy, public WorkerObjectProxy, Noncopyable {
+    class WorkerMessagingProxy : public WorkerContextProxy, public WorkerObjectProxy, public WorkerLoaderProxy, Noncopyable {
     public:
         WorkerMessagingProxy(Worker*);
 
@@ -65,9 +66,11 @@
         virtual void reportPendingActivity(bool hasPendingActivity);
         virtual void workerContextDestroyed();
 
-        void postTaskToWorkerObject(PassRefPtr<ScriptExecutionContext::Task>);
-        void postTaskToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>);
-        void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String& mode);
+        // Implementation of WorkerLoaderProxy.
+        // These methods are called on different threads to schedule loading
+        // requests and to send callbacks back to WorkerContext.
+        virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>);
+        virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String& mode);
 
         void workerThreadCreated(PassRefPtr<WorkerThread>);
 
diff --git a/WebCore/workers/WorkerThread.cpp b/WebCore/workers/WorkerThread.cpp
index d1026b1..0745226 100644
--- a/WebCore/workers/WorkerThread.cpp
+++ b/WebCore/workers/WorkerThread.cpp
@@ -62,13 +62,14 @@
 {
 }
 
-PassRefPtr<WorkerThread> WorkerThread::create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerObjectProxy* workerObjectProxy)
+PassRefPtr<WorkerThread> WorkerThread::create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy)
 {
-    return adoptRef(new WorkerThread(scriptURL, userAgent, sourceCode, workerObjectProxy));
+    return adoptRef(new WorkerThread(scriptURL, userAgent, sourceCode, workerLoaderProxy, workerObjectProxy));
 }
 
-WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerObjectProxy* workerObjectProxy)
+WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy)
     : m_threadID(0)
+    , m_workerLoaderProxy(workerLoaderProxy)
     , m_workerObjectProxy(workerObjectProxy)
     , m_startupData(WorkerThreadStartupData::create(scriptURL, userAgent, sourceCode))
 {
@@ -115,7 +116,7 @@
     // WorkerThread::~WorkerThread happens on a different thread where it was created.
     m_startupData.clear();
 
-    m_workerObjectProxy->reportPendingActivity(m_workerContext->hasPendingActivity());
+    m_workerObjectProxy.reportPendingActivity(m_workerContext->hasPendingActivity());
 
     // Blocks until terminated.
     m_runLoop.run(m_workerContext.get());
diff --git a/WebCore/workers/WorkerThread.h b/WebCore/workers/WorkerThread.h
index f1a8a52..8a1ce6c 100644
--- a/WebCore/workers/WorkerThread.h
+++ b/WebCore/workers/WorkerThread.h
@@ -39,12 +39,13 @@
     class KURL;
     class String;
     class WorkerContext;
+    class WorkerLoaderProxy;
     class WorkerObjectProxy;
     struct WorkerThreadStartupData;
 
     class WorkerThread : public RefCounted<WorkerThread> {
     public:
-        static PassRefPtr<WorkerThread> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerObjectProxy*);
+        static PassRefPtr<WorkerThread> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&);
         ~WorkerThread();
 
         bool start();
@@ -52,17 +53,19 @@
 
         ThreadIdentifier threadID() const { return m_threadID; }
         WorkerRunLoop& runLoop() { return m_runLoop; }
-        WorkerObjectProxy* workerObjectProxy() const { return m_workerObjectProxy; }
+        WorkerLoaderProxy& workerLoaderProxy() const { return m_workerLoaderProxy; }
+        WorkerObjectProxy& workerObjectProxy() const { return m_workerObjectProxy; }
 
     private:
-        WorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerObjectProxy*);
+        WorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&);
 
         static void* workerThreadStart(void*);
         void* workerThread();
 
         ThreadIdentifier m_threadID;
         WorkerRunLoop m_runLoop;
-        WorkerObjectProxy* m_workerObjectProxy;
+        WorkerLoaderProxy& m_workerLoaderProxy;
+        WorkerObjectProxy& m_workerObjectProxy;
 
         RefPtr<WorkerContext> m_workerContext;
         Mutex m_threadCreationMutex;
diff --git a/WebCore/xml/XMLHttpRequest.cpp b/WebCore/xml/XMLHttpRequest.cpp
index dd3f361..76ee048 100644
--- a/WebCore/xml/XMLHttpRequest.cpp
+++ b/WebCore/xml/XMLHttpRequest.cpp
@@ -66,7 +66,6 @@
     m_forbiddenRequestHeaders.add("accept-encoding");
     m_forbiddenRequestHeaders.add("access-control-request-headers");
     m_forbiddenRequestHeaders.add("access-control-request-method");
-    m_forbiddenRequestHeaders.add("authorization");
     m_forbiddenRequestHeaders.add("connection");
     m_forbiddenRequestHeaders.add("content-length");
     m_forbiddenRequestHeaders.add("content-transfer-encoding");
@@ -284,10 +283,20 @@
 
     dispatchReadyStateChangeEvent();
 
-    if (m_state == DONE)
+    if (m_state == DONE && !m_error)
         dispatchLoadEvent();
 }
 
+void XMLHttpRequest::setWithCredentials(bool value, ExceptionCode& ec)
+{
+    if (m_state != OPENED || m_loader) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    m_includeCredentials = value;
+}
+
 void XMLHttpRequest::open(const String& method, const KURL& url, bool async, ExceptionCode& ec)
 {
     internalAbort();
@@ -381,7 +390,7 @@
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && (m_url.protocolIs("http") || m_url.protocolIs("https"))) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
         String contentType = getRequestHeader("Content-Type");
         if (contentType.isEmpty()) {
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -412,7 +421,7 @@
     if (!initSend(ec))
         return;
 
-    if (!body.isNull() && m_method != "GET" && m_method != "HEAD" && (m_url.protocolIs("http") || m_url.protocolIs("https"))) {
+    if (!body.isNull() && m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
         String contentType = getRequestHeader("Content-Type");
         if (contentType.isEmpty()) {
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -436,7 +445,7 @@
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && (m_url.protocolIs("http") || m_url.protocolIs("https"))) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
         // FIXME: Should we set a Content-Type if one is not set.
         // FIXME: add support for uploading bundles.
         m_requestEntityBody = FormData::create();
@@ -509,10 +518,17 @@
 {
     ASSERT(isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders));
 
+    // Cross-origin requests are only defined for HTTP. We would catch this when checking response headers later, but there is no reason to send a request that's guaranteed to be denied.
+    if (!m_url.protocolInHTTPFamily()) {
+        ec = XMLHttpRequestException::NETWORK_ERR;
+        networkError();
+        return;
+    }
+
     KURL url = m_url;
     url.setUser(String());
     url.setPass(String());
- 
+
     ResourceRequest request(url);
     request.setHTTPMethod(m_method);
     request.setAllowHTTPCookies(m_includeCredentials);
@@ -636,7 +652,9 @@
 
     m_loader = 0;
     m_exceptionCode = 0;
-    ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this);
+    StoredCredentials storedCredentials = (m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials;
+
+    ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this, storedCredentials);
     if (!m_exceptionCode && m_error)
         m_exceptionCode = XMLHttpRequestException::NETWORK_ERR;
     ec = m_exceptionCode;
@@ -650,15 +668,13 @@
     // This is true while running onunload handlers.
     // FIXME: We need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
     // FIXME: Maybe create can return null for other reasons too?
-    // We need to keep content sniffing enabled for local files due to CFNetwork not providing a MIME type
-    // for local files otherwise, <rdar://problem/5671813>.
     LoadCallbacks callbacks = m_inPreflight ? DoNotSendLoadCallbacks : SendLoadCallbacks;
-    ContentSniff contentSniff = request.url().isLocalFile() ? SniffContent : DoNotSniffContent;
+    StoredCredentials storedCredentials = (m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials;
 
     if (m_upload)
         request.setReportUploadProgress(true);
 
-    m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, callbacks, contentSniff);
+    m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, callbacks, DoNotSniffContent, storedCredentials, RequireSameRedirectOrigin);
 
     if (m_loader) {
         // Neither this object nor the JavaScript wrapper should be deleted while
@@ -682,7 +698,7 @@
     
     if ((m_state <= OPENED && !sendFlag) || m_state == DONE)
         m_state = UNSENT;
-     else {
+    else {
         ASSERT(!m_loader);
         changeState(DONE);
         m_state = UNSENT;
@@ -736,8 +752,7 @@
     clearRequest();
     m_error = true;
 
-    // The spec says we should "Synchronously switch the state to DONE." and then "Synchronously dispatch a readystatechange event on the object"
-    // but this does not match Firefox.
+    changeState(DONE);
 }
 
 void XMLHttpRequest::networkError()
diff --git a/WebCore/xml/XMLHttpRequest.h b/WebCore/xml/XMLHttpRequest.h
index 544866a..6955c11 100644
--- a/WebCore/xml/XMLHttpRequest.h
+++ b/WebCore/xml/XMLHttpRequest.h
@@ -63,6 +63,8 @@
     String statusText(ExceptionCode&) const;
     int status(ExceptionCode&) const;
     State readyState() const;
+    bool withCredentials() const { return m_includeCredentials; }
+    void setWithCredentials(bool, ExceptionCode&);
     void open(const String& method, const KURL&, bool async, ExceptionCode&);
     void open(const String& method, const KURL&, bool async, const String& user, ExceptionCode&);
     void open(const String& method, const KURL&, bool async, const String& user, const String& password, ExceptionCode&);
@@ -195,7 +197,7 @@
     RefPtr<FormData> m_requestEntityBody;
     String m_mimeTypeOverride;
     bool m_async;
-    bool m_includeCredentials; // FIXME: Currently, setting this flag is not implemented, so it is always false.
+    bool m_includeCredentials;
 
     RefPtr<ThreadableLoader> m_loader;
     State m_state;
diff --git a/WebCore/xml/XMLHttpRequest.idl b/WebCore/xml/XMLHttpRequest.idl
index 3187160..79005e2 100644
--- a/WebCore/xml/XMLHttpRequest.idl
+++ b/WebCore/xml/XMLHttpRequest.idl
@@ -53,6 +53,8 @@
         readonly attribute unsigned short readyState;
 
         // request
+        attribute boolean withCredentials
+            setter raises(DOMException);
         // void open(in DOMString method, in DOMString url);
         // void open(in DOMString method, in DOMString url, in boolean async);
         // void open(in DOMString method, in DOMString url, in boolean async, in DOMString user);
diff --git a/WebCore/xml/XMLHttpRequestException.idl b/WebCore/xml/XMLHttpRequestException.idl
index 706beb2..380e426 100644
--- a/WebCore/xml/XMLHttpRequestException.idl
+++ b/WebCore/xml/XMLHttpRequestException.idl
@@ -37,7 +37,7 @@
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
diff --git a/WebCore/xml/XPathException.idl b/WebCore/xml/XPathException.idl
index 6e25514..c3c95e3 100644
--- a/WebCore/xml/XPathException.idl
+++ b/WebCore/xml/XPathException.idl
@@ -37,7 +37,7 @@
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
diff --git a/WebCore/xml/XPathExpression.cpp b/WebCore/xml/XPathExpression.cpp
index ecec79e..6188426 100644
--- a/WebCore/xml/XPathExpression.cpp
+++ b/WebCore/xml/XPathExpression.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,9 +30,8 @@
 #if ENABLE(XPATH)
 
 #include "Document.h"
-#include "ExceptionCode.h"
-#include "Node.h"
 #include "PlatformString.h"
+#include "XPathException.h"
 #include "XPathExpressionNode.h"
 #include "XPathNSResolver.h"
 #include "XPathParser.h"
@@ -67,15 +66,21 @@
         return 0;
     }
 
-    Node* eventTarget = contextNode->ownerDocument() ? contextNode->ownerDocument() : contextNode;
-
     EvaluationContext& evaluationContext = Expression::evaluationContext();
     evaluationContext.node = contextNode;
     evaluationContext.size = 1;
     evaluationContext.position = 1;
-    RefPtr<XPathResult> result = XPathResult::create(eventTarget, m_topExpression->evaluate());
+    evaluationContext.hadTypeConversionError = false;
+    RefPtr<XPathResult> result = XPathResult::create(contextNode->document(), m_topExpression->evaluate());
     evaluationContext.node = 0; // Do not hold a reference to the context node, as this may prevent the whole document from being destroyed in time.
 
+    if (evaluationContext.hadTypeConversionError) {
+        // It is not specified what to do if type conversion fails while evaluating an expression, and INVALID_EXPRESSION_ERR is not exactly right
+        // when the failure happens in an otherwise valid expression because of a variable. But XPathEvaluator does not support variables, so it's close enough.
+        ec = XPathException::INVALID_EXPRESSION_ERR;
+        return 0;
+    }
+
     if (type != XPathResult::ANY_TYPE) {
         ec = 0;
         result->convertTo(type, ec);
diff --git a/WebCore/xml/XPathExpressionNode.cpp b/WebCore/xml/XPathExpressionNode.cpp
index 647c6af..4656f8d 100644
--- a/WebCore/xml/XPathExpressionNode.cpp
+++ b/WebCore/xml/XPathExpressionNode.cpp
@@ -30,7 +30,6 @@
 #if ENABLE(XPATH)
 
 #include "Node.h"
-#include "XPathValue.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -43,6 +42,9 @@
 }
 
 Expression::Expression()
+    : m_isContextNodeSensitive(false)
+    , m_isContextPositionSensitive(false)
+    , m_isContextSizeSensitive(false)
 {
 }
 
diff --git a/WebCore/xml/XPathExpressionNode.h b/WebCore/xml/XPathExpressionNode.h
index 9c5f79b..d12b451 100644
--- a/WebCore/xml/XPathExpressionNode.h
+++ b/WebCore/xml/XPathExpressionNode.h
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,23 +31,21 @@
 
 #include "StringHash.h"
 #include "Node.h"
+#include "XPathValue.h"
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
     namespace XPath {
-
-        class Value;
         
         struct EvaluationContext {
-            EvaluationContext() : node(0), size(0), position(0) { }
-
             RefPtr<Node> node;
             unsigned long size;
             unsigned long position;
             HashMap<String, String> variableBindings;
 
+            bool hadTypeConversionError;
         };
 
         class ParseNode {
@@ -64,7 +62,22 @@
 
             virtual Value evaluate() const = 0;
 
-            void addSubExpression(Expression* expr) { m_subExpressions.append(expr); }
+            void addSubExpression(Expression* expr)
+            {
+                m_subExpressions.append(expr);
+                m_isContextNodeSensitive |= expr->m_isContextNodeSensitive;
+                m_isContextPositionSensitive |= expr->m_isContextPositionSensitive;
+                m_isContextSizeSensitive |= expr->m_isContextSizeSensitive;
+            }
+
+            bool isContextNodeSensitive() const { return m_isContextNodeSensitive; }
+            bool isContextPositionSensitive() const { return m_isContextPositionSensitive; }
+            bool isContextSizeSensitive() const { return m_isContextSizeSensitive; }
+            void setIsContextNodeSensitive(bool value) { m_isContextNodeSensitive = value; }
+            void setIsContextPositionSensitive(bool value) { m_isContextPositionSensitive = value; }
+            void setIsContextSizeSensitive(bool value) { m_isContextSizeSensitive = value; }
+
+            virtual Value::Type resultType() const = 0;
 
         protected:
             unsigned subExprCount() const { return m_subExpressions.size(); }
@@ -73,6 +86,11 @@
 
         private:
             Vector<Expression*> m_subExpressions;
+
+            // Evaluation details that can be used for optimization.
+            bool m_isContextNodeSensitive;
+            bool m_isContextPositionSensitive;
+            bool m_isContextSizeSensitive;
         };
 
     }
diff --git a/WebCore/xml/XPathFunctions.cpp b/WebCore/xml/XPathFunctions.cpp
index 3abd603..da39443 100644
--- a/WebCore/xml/XPathFunctions.cpp
+++ b/WebCore/xml/XPathFunctions.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -32,7 +32,8 @@
 
 #include "Document.h"
 #include "Element.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
+#include "ProcessingInstruction.h"
 #include "XMLNames.h"
 #include "XPathUtil.h"
 #include "XPathValue.h"
@@ -74,110 +75,157 @@
 
 class FunLast : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
+public:
+    FunLast() { setIsContextSizeSensitive(true); }
 };
 
 class FunPosition : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
+public:
+    FunPosition() { setIsContextPositionSensitive(true); }
 };
 
 class FunCount : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
 };
 
 class FunId : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NodeSetValue; }
 };
 
 class FunLocalName : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
+public:
+    FunLocalName() { setIsContextNodeSensitive(true); } // local-name() with no arguments uses context node. 
 };
 
 class FunNamespaceURI : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
+public:
+    FunNamespaceURI() { setIsContextNodeSensitive(true); } // namespace-uri() with no arguments uses context node. 
 };
 
 class FunName : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
+public:
+    FunName() { setIsContextNodeSensitive(true); } // name() with no arguments uses context node. 
 };
 
 class FunString : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
+public:
+    FunString() { setIsContextNodeSensitive(true); } // string() with no arguments uses context node. 
 };
 
 class FunConcat : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
 };
 
 class FunStartsWith : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunContains : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunSubstringBefore : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
 };
 
 class FunSubstringAfter : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
 };
 
 class FunSubstring : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
 };
 
 class FunStringLength : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
+public:
+    FunStringLength() { setIsContextNodeSensitive(true); } // string-length() with no arguments uses context node. 
 };
 
 class FunNormalizeSpace : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
+public:
+    FunNormalizeSpace() { setIsContextNodeSensitive(true); } // normalize-space() with no arguments uses context node. 
 };
 
 class FunTranslate : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::StringValue; }
 };
 
 class FunBoolean : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunNot : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunTrue : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunFalse : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
 };
 
 class FunLang : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::BooleanValue; }
+public:
+    FunLang() { setIsContextNodeSensitive(true); } // lang() always works on context node. 
 };
 
 class FunNumber : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
+public:
+    FunNumber() { setIsContextNodeSensitive(true); } // number() with no arguments uses context node. 
 };
 
 class FunSum : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
 };
 
 class FunFloor : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
 };
 
 class FunCeiling : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
 };
 
 class FunRound : public Function {
     virtual Value evaluate() const;
+    virtual Value::Type resultType() const { return Value::NumberValue; }
 public:
     static double round(double);
 };
@@ -246,8 +294,13 @@
 
 void Function::setArguments(const Vector<Expression*>& args)
 {
-    Vector<Expression*>::const_iterator end = args.end();
+    ASSERT(!subExprCount());
 
+    // Some functions use context node as implicit argument, so when explicit arguments are added, they may no longer be context node sensitive.
+    if (m_name != "lang" && !args.isEmpty())
+        setIsContextNodeSensitive(false);
+
+    Vector<Expression*>::const_iterator end = args.end();
     for (Vector<Expression*>::const_iterator it = args.begin(); it != end; it++)
         addSubExpression(*it);
 }
@@ -310,71 +363,67 @@
     return Value(result, Value::adopt);
 }
 
+static inline String expandedNameLocalPart(Node* node)
+{
+    // The local part of an XPath expanded-name matches DOM local name for most node types, except for namespace nodes and processing instruction nodes.
+    ASSERT(node->nodeType() != Node::XPATH_NAMESPACE_NODE); // Not supported yet.
+    if (node->nodeType() == Node::PROCESSING_INSTRUCTION_NODE)
+        return static_cast<ProcessingInstruction*>(node)->target();
+    return node->localName().string();
+}
+
+static inline String expandedName(Node* node)
+{
+    const AtomicString& prefix = node->prefix();
+    return prefix.isEmpty() ? expandedNameLocalPart(node) : prefix + ":" + expandedNameLocalPart(node);
+}
+
 Value FunLocalName::evaluate() const
 {
-    Node* node = 0;
     if (argCount() > 0) {
         Value a = arg(0)->evaluate();
         if (!a.isNodeSet())
             return "";
 
-        node = a.toNodeSet().firstNode();
-        if (!node)
-            return "";
+        Node* node = a.toNodeSet().firstNode();
+        return node ? expandedNameLocalPart(node) : "";
     }
 
-    if (!node)
-        node = evaluationContext().node.get();
-
-    return node->localName().string();
+    return expandedNameLocalPart(evaluationContext().node.get());
 }
 
 Value FunNamespaceURI::evaluate() const
 {
-    Node* node = 0;
     if (argCount() > 0) {
         Value a = arg(0)->evaluate();
         if (!a.isNodeSet())
             return "";
 
-        node = a.toNodeSet().firstNode();
-        if (!node)
-            return "";
+        Node* node = a.toNodeSet().firstNode();
+        return node ? node->namespaceURI().string() : "";
     }
 
-    if (!node)
-        node = evaluationContext().node.get();
-
-    return node->namespaceURI().string();
+    return evaluationContext().node->namespaceURI().string();
 }
 
 Value FunName::evaluate() const
 {
-    Node* node = 0;
     if (argCount() > 0) {
         Value a = arg(0)->evaluate();
         if (!a.isNodeSet())
             return "";
 
-        node = a.toNodeSet().firstNode();
-        if (!node)
-            return "";
+        Node* node = a.toNodeSet().firstNode();
+        return node ? expandedName(node) : "";
     }
 
-    if (!node)
-        node = evaluationContext().node.get();
-
-    const AtomicString& prefix = node->prefix();
-    return prefix.isEmpty() ? node->localName().string() : prefix + ":" + node->localName();
+    return expandedName(evaluationContext().node.get());
 }
 
 Value FunCount::evaluate() const
 {
     Value a = arg(0)->evaluate();
     
-    if (!a.isNodeSet())
-        return 0.0;
-    
     return double(a.toNodeSet().size());
 }
 
@@ -537,7 +586,7 @@
     Attribute* languageAttribute = 0;
     Node* node = evaluationContext().node.get();
     while (node) {
-        NamedAttrMap* attrs = node->attributes();
+        NamedNodeMap* attrs = node->attributes();
         if (attrs)
             languageAttribute = attrs->getAttributeItem(XMLNames::langAttr);
         if (languageAttribute)
diff --git a/WebCore/xml/XPathFunctions.h b/WebCore/xml/XPathFunctions.h
index f22d3ef..62d687f 100644
--- a/WebCore/xml/XPathFunctions.h
+++ b/WebCore/xml/XPathFunctions.h
@@ -1,6 +1,6 @@
 /*
- * functions.h - Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -39,7 +39,6 @@
         public:
             void setArguments(const Vector<Expression*>&);
             void setName(const String& name) { m_name = name; }
-
         protected:
             Expression* arg(int pos) { return subExpr(pos); }
             const Expression* arg(int pos) const { return subExpr(pos); }
@@ -52,11 +51,10 @@
 
         Function* createFunction(const String& name, const Vector<Expression*>& args = Vector<Expression*>());
 
-    }
+    } // namespace XPath
 
-}
+} // namespace WebCore
 
 #endif // ENABLE(XPATH)
 
-#endif // XPath_Functions_H
-
+#endif // XPathFunctions_h
diff --git a/WebCore/xml/XPathNodeSet.h b/WebCore/xml/XPathNodeSet.h
index 2ab6f1f..1130488 100644
--- a/WebCore/xml/XPathNodeSet.h
+++ b/WebCore/xml/XPathNodeSet.h
@@ -39,17 +39,14 @@
 
         class NodeSet {
         public:
-        
-            NodeSet() : m_isSorted(true) {}
-            NodeSet(const NodeSet& other) : m_isSorted(other.m_isSorted), m_nodes(other.m_nodes) {}
-            NodeSet& operator=(const NodeSet& other) { m_isSorted = other.m_isSorted; m_nodes = other.m_nodes; return *this; }
+            NodeSet() : m_isSorted(true), m_subtreesAreDisjoint(false) { }
             
             size_t size() const { return m_nodes.size(); }
             bool isEmpty() const { return !m_nodes.size(); }
             Node* operator[](unsigned i) const { return m_nodes.at(i).get(); }
             void reserveCapacity(size_t newCapacity) { m_nodes.reserveCapacity(newCapacity); }
             void clear() { m_nodes.clear(); }
-            void swap(NodeSet& other) { std::swap(m_isSorted, other.m_isSorted); m_nodes.swap(other.m_nodes); }
+            void swap(NodeSet& other) { std::swap(m_isSorted, other.m_isSorted); std::swap(m_subtreesAreDisjoint, other.m_subtreesAreDisjoint); m_nodes.swap(other.m_nodes); }
 
             // NodeSet itself does not verify that nodes in it are unique.
             void append(Node* node) { m_nodes.append(node); }
@@ -62,16 +59,21 @@
             // Returns 0 if the set is empty.
             Node* anyNode() const;
 
-            // NodeSet itself doesn't check if it is contains sorted data - the caller should tell it if it does not.
+            // NodeSet itself doesn't check if it contains nodes in document order - the caller should tell it if it does not.
             void markSorted(bool isSorted) { m_isSorted = isSorted; }
-            bool isSorted() const { return m_isSorted; }
+            bool isSorted() const { return m_isSorted || m_nodes.size() < 2; }
 
             void sort() const;
 
+            // No node in the set is ancestor of another. Unlike m_isSorted, this is assumed to be false, unless the caller sets it to true.
+            void markSubtreesDisjoint(bool disjoint) { m_subtreesAreDisjoint = disjoint; }
+            bool subtreesAreDisjoint() const { return m_subtreesAreDisjoint || m_nodes.size() < 2; }
+
             void reverse();
         
         private:
             bool m_isSorted;
+            bool m_subtreesAreDisjoint;
             Vector<RefPtr<Node> > m_nodes;
         };
 
diff --git a/WebCore/xml/XPathPath.cpp b/WebCore/xml/XPathPath.cpp
index bc7b153..1a7ed3f 100644
--- a/WebCore/xml/XPathPath.cpp
+++ b/WebCore/xml/XPathPath.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -41,6 +41,9 @@
 Filter::Filter(Expression* expr, const Vector<Predicate*>& predicates)
     : m_expr(expr), m_predicates(predicates)
 {
+    setIsContextNodeSensitive(m_expr->isContextNodeSensitive());
+    setIsContextPositionSensitive(m_expr->isContextPositionSensitive());
+    setIsContextSizeSensitive(m_expr->isContextSizeSensitive());
 }
 
 Filter::~Filter()
@@ -53,9 +56,6 @@
 {
     Value v = m_expr->evaluate();
     
-    if (!v.isNodeSet()) 
-        return v;
-
     NodeSet& nodes = v.modifiableNodeSet();
     nodes.sort();
 
@@ -83,6 +83,7 @@
 LocationPath::LocationPath()
     : m_absolute(false)
 {
+    setIsContextNodeSensitive(true);
 }
 
 LocationPath::~LocationPath()
@@ -94,9 +95,8 @@
 {
     EvaluationContext& evaluationContext = Expression::evaluationContext();
     EvaluationContext backupContext = evaluationContext;
-    /* For absolute location paths, the context node is ignored - the
-     * document's root node is used instead.
-     */
+    // For absolute location paths, the context node is ignored - the
+    // document's root node is used instead.
     Node* context = evaluationContext.node.get();
     if (m_absolute && context->nodeType() != Node::DOCUMENT_NODE) 
         context = context->ownerDocument();
@@ -111,18 +111,33 @@
 
 void LocationPath::evaluate(NodeSet& nodes) const
 {
+    bool resultIsSorted = nodes.isSorted();
+
     for (unsigned i = 0; i < m_steps.size(); i++) {
         Step* step = m_steps[i];
         NodeSet newNodes;
         HashSet<Node*> newNodesSet;
 
+        bool needToCheckForDuplicateNodes = !nodes.subtreesAreDisjoint() || (step->axis() != Step::ChildAxis && step->axis() != Step::SelfAxis
+            && step->axis() != Step::DescendantAxis && step->axis() != Step::DescendantOrSelfAxis && step->axis() != Step::AttributeAxis);
+
+        if (needToCheckForDuplicateNodes)
+            resultIsSorted = false;
+
+        // This is a simplified check that can be improved to handle more cases.
+        if (nodes.subtreesAreDisjoint() && (step->axis() == Step::ChildAxis || step->axis() == Step::SelfAxis))
+            newNodes.markSubtreesDisjoint(true);
+
         for (unsigned j = 0; j < nodes.size(); j++) {
             NodeSet matches;
             step->evaluate(nodes[j], matches);
-            
+
+            if (!matches.isSorted())
+                resultIsSorted = false;
+
             for (size_t nodeIndex = 0; nodeIndex < matches.size(); ++nodeIndex) {
                 Node* node = matches[nodeIndex];
-                if (newNodesSet.add(node).second)
+                if (!needToCheckForDuplicateNodes || newNodesSet.add(node).second)
                     newNodes.append(node);
             }
         }
@@ -130,53 +145,46 @@
         nodes.swap(newNodes);
     }
 
-    nodes.markSorted(false);
-}
-
-void LocationPath::optimizeStepPair(unsigned index)
-{
-    Step* first = m_steps[index];
-    
-    if (first->axis() == Step::DescendantOrSelfAxis
-        && first->nodeTest().kind() == Step::NodeTest::AnyNodeTest
-        && first->predicates().size() == 0) {
-
-        Step* second = m_steps[index + 1];
-        if (second->axis() == Step::ChildAxis
-            && second->nodeTest().namespaceURI().isEmpty()
-            && second->nodeTest().kind() == Step::NodeTest::NameTest
-            && second->nodeTest().data() == "*") {
-
-            // Optimize the common case of "//*" AKA descendant-or-self::node()/child::*.
-            first->setAxis(Step::DescendantAxis);
-            second->setAxis(Step::SelfAxis);
-            second->setNodeTest(Step::NodeTest::ElementNodeTest);
-            ASSERT(second->nodeTest().data().isEmpty());
-        }
-    }
+    nodes.markSorted(resultIsSorted);
 }
 
 void LocationPath::appendStep(Step* step)
 {
-    m_steps.append(step);
-    
     unsigned stepCount = m_steps.size();
-    if (stepCount > 1)
-        optimizeStepPair(stepCount - 2);
+    if (stepCount) {
+        bool dropSecondStep;
+        optimizeStepPair(m_steps[stepCount - 1], step, dropSecondStep);
+        if (dropSecondStep) {
+            delete step;
+            return;
+        }
+    }
+    step->optimize();
+    m_steps.append(step);
 }
 
 void LocationPath::insertFirstStep(Step* step)
 {
+    if (m_steps.size()) {
+        bool dropSecondStep;
+        optimizeStepPair(step, m_steps[0], dropSecondStep);
+        if (dropSecondStep) {
+            delete m_steps[0];
+            m_steps[0] = step;
+            return;
+        }
+    }
+    step->optimize();
     m_steps.insert(0, step);
-
-    if (m_steps.size() > 1)
-        optimizeStepPair(0);
 }
 
 Path::Path(Filter* filter, LocationPath* path)
-    : m_filter(filter),
-    m_path(path)
+    : m_filter(filter)
+    , m_path(path)
 {
+    setIsContextNodeSensitive(filter->isContextNodeSensitive());
+    setIsContextPositionSensitive(filter->isContextPositionSensitive());
+    setIsContextSizeSensitive(filter->isContextSizeSensitive());
 }
 
 Path::~Path()
diff --git a/WebCore/xml/XPathPath.h b/WebCore/xml/XPathPath.h
index 46e57ff..dc77971 100644
--- a/WebCore/xml/XPathPath.h
+++ b/WebCore/xml/XPathPath.h
@@ -1,6 +1,6 @@
 /*
- * path.h - Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,6 +47,8 @@
             virtual Value evaluate() const;
 
         private:
+            virtual Value::Type resultType() const { return Value::NodeSetValue; }
+
             Expression* m_expr;
             Vector<Predicate*> m_predicates;
         };
@@ -55,7 +57,7 @@
         public:
             LocationPath();
             virtual ~LocationPath();
-            void setAbsolute(bool value) { m_absolute = value; }
+            void setAbsolute(bool value) { m_absolute = value; setIsContextNodeSensitive(!m_absolute); }
 
             virtual Value evaluate() const;
             void evaluate(NodeSet& nodes) const; // nodes is an input/output parameter
@@ -64,7 +66,7 @@
             void insertFirstStep(Step* step);
 
         private:
-            void optimizeStepPair(unsigned index);
+            virtual Value::Type resultType() const { return Value::NodeSetValue; }
 
             Vector<Step*> m_steps;
             bool m_absolute;
@@ -79,6 +81,8 @@
             virtual Value evaluate() const;
 
         private:
+            virtual Value::Type resultType() const { return Value::NodeSetValue; }
+
             Filter* m_filter;
             LocationPath* m_path;
         };
diff --git a/WebCore/xml/XPathPredicate.cpp b/WebCore/xml/XPathPredicate.cpp
index 7b3e4d8..2a6482f 100644
--- a/WebCore/xml/XPathPredicate.cpp
+++ b/WebCore/xml/XPathPredicate.cpp
@@ -233,8 +233,6 @@
 {
     Value lhsResult = subExpr(0)->evaluate();
     Value rhs = subExpr(1)->evaluate();
-    if (!lhsResult.isNodeSet() || !rhs.isNodeSet())
-        return NodeSet();
     
     NodeSet& resultSet = lhsResult.modifiableNodeSet();
     const NodeSet& rhsNodes = rhs.toNodeSet();
diff --git a/WebCore/xml/XPathPredicate.h b/WebCore/xml/XPathPredicate.h
index 8d1b0d8..6c9d413 100644
--- a/WebCore/xml/XPathPredicate.h
+++ b/WebCore/xml/XPathPredicate.h
@@ -41,6 +41,8 @@
             Number(double);
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { return Value::NumberValue; }
+
             Value m_value;
         };
 
@@ -49,12 +51,15 @@
             StringExpression(const String&);
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { return Value::StringValue; }
+
             Value m_value;
         };
 
         class Negative : public Expression {
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { return Value::NumberValue; }
         };
 
         class NumericOp : public Expression {
@@ -65,6 +70,8 @@
             NumericOp(Opcode, Expression* lhs, Expression* rhs);
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { return Value::NumberValue; }
+
             Opcode m_opcode;
         };
 
@@ -74,7 +81,9 @@
             EqTestOp(Opcode, Expression* lhs, Expression* rhs);
             virtual Value evaluate() const;
         private:
+            virtual Value::Type resultType() const { return Value::BooleanValue; }
             bool compare(const Value&, const Value&) const;
+
             Opcode m_opcode;
         };
 
@@ -83,14 +92,17 @@
             enum Opcode { OP_And, OP_Or };
             LogicalOp(Opcode, Expression* lhs, Expression* rhs);
         private:
+            virtual Value::Type resultType() const { return Value::BooleanValue; }
             bool shortCircuitOn() const;
             virtual Value evaluate() const;
+
             Opcode m_opcode;
         };
 
         class Union : public Expression {
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { return Value::NodeSetValue; }
         };
 
         class Predicate : Noncopyable {
@@ -98,6 +110,10 @@
             Predicate(Expression*);
             ~Predicate();
             bool evaluate() const;
+
+            bool isContextPositionSensitive() const { return m_expr->isContextPositionSensitive() || m_expr->resultType() == Value::NumberValue; }
+            bool isContextSizeSensitive() const { return m_expr->isContextSizeSensitive(); }
+
         private:
             Expression* m_expr;
         };
diff --git a/WebCore/xml/XPathResult.cpp b/WebCore/xml/XPathResult.cpp
index a1c8a08..b608280 100644
--- a/WebCore/xml/XPathResult.cpp
+++ b/WebCore/xml/XPathResult.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,8 +29,7 @@
 
 #if ENABLE(XPATH)
 
-#include "EventListener.h"
-#include "EventNames.h"
+#include "Document.h"
 #include "Node.h"
 #include "ExceptionCode.h"
 #include "XPathEvaluator.h"
@@ -40,22 +39,9 @@
 
 using namespace XPath;
 
-class InvalidatingEventListener : public EventListener {
-public:
-    static PassRefPtr<InvalidatingEventListener> create(XPathResult* result) { return adoptRef(new InvalidatingEventListener(result)); }
-    virtual void handleEvent(Event*, bool) { m_result->invalidateIteratorState(); }
-
-private:
-    InvalidatingEventListener(XPathResult* result) : m_result(result) { }
-    XPathResult* m_result;
-};
-
-XPathResult::XPathResult(Node* eventTarget, const Value& value)
+XPathResult::XPathResult(Document* document, const Value& value)
     : m_value(value)
-    , m_eventTarget(eventTarget)
 {
-    m_eventListener = InvalidatingEventListener::create(this);
-    m_eventTarget->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener, false);
     switch (m_value.type()) {
         case Value::BooleanValue:
             m_resultType = BOOLEAN_TYPE;
@@ -70,7 +56,8 @@
             m_resultType = UNORDERED_NODE_ITERATOR_TYPE;
             m_nodeSetPosition = 0;
             m_nodeSet = m_value.toNodeSet();
-            m_invalidIteratorState = false;
+            m_document = document;
+            m_domTreeVersion = document->domTreeVersion();
             return;
     }
     ASSERT_NOT_REACHED();
@@ -78,8 +65,6 @@
 
 XPathResult::~XPathResult()
 {
-    if (m_eventTarget)
-        m_eventTarget->removeEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
 }
 
 void XPathResult::convertTo(unsigned short type, ExceptionCode& ec)
@@ -174,24 +159,13 @@
         return nodes.anyNode();
 }
 
-void XPathResult::invalidateIteratorState()
-{ 
-    m_invalidIteratorState = true;
-    
-    ASSERT(m_eventTarget);
-    ASSERT(m_eventListener);
-    
-    m_eventTarget->removeEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
-    
-    m_eventTarget = 0;
-}
-
 bool XPathResult::invalidIteratorState() const
 {
     if (resultType() != UNORDERED_NODE_ITERATOR_TYPE && resultType() != ORDERED_NODE_ITERATOR_TYPE)
         return false;
-    
-    return m_invalidIteratorState;
+
+    ASSERT(m_document);
+    return m_document->domTreeVersion() != m_domTreeVersion;
 }
 
 unsigned long XPathResult::snapshotLength(ExceptionCode& ec) const
@@ -211,7 +185,7 @@
         return 0;
     }
     
-    if (m_invalidIteratorState) {
+    if (invalidIteratorState()) {
         ec = INVALID_STATE_ERR;
         return 0;
     }
diff --git a/WebCore/xml/XPathResult.h b/WebCore/xml/XPathResult.h
index 03accc6..3b91d66 100644
--- a/WebCore/xml/XPathResult.h
+++ b/WebCore/xml/XPathResult.h
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,15 +29,14 @@
 
 #if ENABLE(XPATH)
 
-#include <wtf/RefCounted.h>
 #include "XPathValue.h"
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
     typedef int ExceptionCode;
 
-    class EventListener;
-    class Node;
+    class Document;
     class Node;
     class String;
 
@@ -56,7 +55,7 @@
             FIRST_ORDERED_NODE_TYPE = 9
         };
         
-        static PassRefPtr<XPathResult> create(Node* eventTarget, const XPath::Value& value) { return adoptRef(new XPathResult(eventTarget, value)); }
+        static PassRefPtr<XPathResult> create(Document* document, const XPath::Value& value) { return adoptRef(new XPathResult(document, value)); }
         ~XPathResult();
         
         void convertTo(unsigned short type, ExceptionCode&);
@@ -73,21 +72,18 @@
         Node* iterateNext(ExceptionCode&);
         Node* snapshotItem(unsigned long index, ExceptionCode&);
 
-        void invalidateIteratorState();
-
     private:
-        XPathResult(Node*, const XPath::Value&);
+        XPathResult(Document*, const XPath::Value&);
         
         XPath::Value m_value;
         unsigned m_nodeSetPosition;
         XPath::NodeSet m_nodeSet; // FIXME: why duplicate the node set stored in m_value?
         unsigned short m_resultType;
-        bool m_invalidIteratorState;
-        RefPtr<Node> m_eventTarget;
-        RefPtr<EventListener> m_eventListener;
+        RefPtr<Document> m_document;
+        unsigned m_domTreeVersion;
     };
 
-}
+} // namespace WebCore
 
 #endif // ENABLE(XPATH)
 
diff --git a/WebCore/xml/XPathStep.cpp b/WebCore/xml/XPathStep.cpp
index ae8d9c4..411b616 100644
--- a/WebCore/xml/XPathStep.cpp
+++ b/WebCore/xml/XPathStep.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,10 +30,10 @@
 
 #if ENABLE(XPATH)
 
+#include "Attr.h"
 #include "Document.h"
 #include "Element.h"
-#include "NamedAttrMap.h"
-#include "XPathNSResolver.h"
+#include "NamedNodeMap.h"
 #include "XPathParser.h"
 #include "XPathUtil.h"
 
@@ -50,14 +50,74 @@
 Step::~Step()
 {
     deleteAllValues(m_predicates);
+    deleteAllValues(m_nodeTest.mergedPredicates());
+}
+
+void Step::optimize()
+{
+    // Evaluate predicates as part of node test if possible to avoid building unnecessary NodeSets.
+    // E.g., there is no need to build a set of all "foo" nodes to evaluate "foo[@bar]", we can check the predicate while enumerating.
+    // This optimization can be applied to predicates that are not context node list sensitive, or to first predicate that is only context position sensitive, e.g. foo[position() mod 2 = 0].
+    Vector<Predicate*> remainingPredicates;
+    for (size_t i = 0; i < m_predicates.size(); ++i) {
+        Predicate* predicate = m_predicates[i];
+        if ((!predicate->isContextPositionSensitive() || m_nodeTest.mergedPredicates().isEmpty()) && !predicate->isContextSizeSensitive() && remainingPredicates.isEmpty()) {
+            m_nodeTest.mergedPredicates().append(predicate);
+        } else
+            remainingPredicates.append(predicate);
+    }
+    swap(remainingPredicates, m_predicates);
+}
+
+void optimizeStepPair(Step* first, Step* second, bool& dropSecondStep)
+{
+    dropSecondStep = false;
+
+    if (first->m_axis == Step::DescendantOrSelfAxis
+        && first->m_nodeTest.kind() == Step::NodeTest::AnyNodeTest
+        && !first->m_predicates.size()
+        && !first->m_nodeTest.mergedPredicates().size()) {
+
+        ASSERT(first->m_nodeTest.data().isEmpty());
+        ASSERT(first->m_nodeTest.namespaceURI().isEmpty());
+
+        // Optimize the common case of "//" AKA /descendant-or-self::node()/child::NodeTest to /descendant::NodeTest.
+        if (second->m_axis == Step::ChildAxis && second->predicatesAreContextListInsensitive()) {
+            first->m_axis = Step::DescendantAxis;
+            first->m_nodeTest = Step::NodeTest(second->m_nodeTest.kind(), second->m_nodeTest.data(), second->m_nodeTest.namespaceURI());
+            swap(second->m_nodeTest.mergedPredicates(), first->m_nodeTest.mergedPredicates());
+            swap(second->m_predicates, first->m_predicates);
+            first->optimize();
+            dropSecondStep = true;
+        }
+    }
+}
+
+bool Step::predicatesAreContextListInsensitive() const
+{
+    for (size_t i = 0; i < m_predicates.size(); ++i) {
+        Predicate* predicate = m_predicates[i];
+        if (predicate->isContextPositionSensitive() || predicate->isContextSizeSensitive())
+            return false;
+    }
+
+    for (size_t i = 0; i < m_nodeTest.mergedPredicates().size(); ++i) {
+        Predicate* predicate = m_nodeTest.mergedPredicates()[i];
+        if (predicate->isContextPositionSensitive() || predicate->isContextSizeSensitive())
+            return false;
+    }
+
+    return true;
 }
 
 void Step::evaluate(Node* context, NodeSet& nodes) const
 {
-    nodesInAxis(context, nodes);
-    
     EvaluationContext& evaluationContext = Expression::evaluationContext();
-    
+    evaluationContext.position = 0;
+
+    nodesInAxis(context, nodes);
+
+    // Check predicates that couldn't be merged into node test.
     for (unsigned i = 0; i < m_predicates.size(); i++) {
         Predicate* predicate = m_predicates[i];
 
@@ -68,7 +128,7 @@
         for (unsigned j = 0; j < nodes.size(); j++) {
             Node* node = nodes[j];
 
-            Expression::evaluationContext().node = node;
+            evaluationContext.node = node;
             evaluationContext.size = nodes.size();
             evaluationContext.position = j + 1;
             if (predicate->evaluate())
@@ -79,6 +139,95 @@
     }
 }
 
+static inline Node::NodeType primaryNodeType(Step::Axis axis)
+{
+    switch (axis) {
+        case Step::AttributeAxis:
+            return Node::ATTRIBUTE_NODE;
+        case Step::NamespaceAxis:
+            return Node::XPATH_NAMESPACE_NODE;
+        default:
+            return Node::ELEMENT_NODE;
+    }
+}
+
+// Evaluate NodeTest without considering merged predicates.
+static inline bool nodeMatchesBasicTest(Node* node, Step::Axis axis, const Step::NodeTest& nodeTest)
+{
+    switch (nodeTest.kind()) {
+        case Step::NodeTest::TextNodeTest:
+            return node->nodeType() == Node::TEXT_NODE || node->nodeType() == Node::CDATA_SECTION_NODE;
+        case Step::NodeTest::CommentNodeTest:
+            return node->nodeType() == Node::COMMENT_NODE;
+        case Step::NodeTest::ProcessingInstructionNodeTest: {
+            const AtomicString& name = nodeTest.data();
+            return node->nodeType() == Node::PROCESSING_INSTRUCTION_NODE && (name.isEmpty() || node->nodeName() == name);
+        }
+        case Step::NodeTest::AnyNodeTest:
+            return true;
+        case Step::NodeTest::NameTest: {
+            const AtomicString& name = nodeTest.data();
+            const AtomicString& namespaceURI = nodeTest.namespaceURI();
+
+            if (axis == Step::AttributeAxis) {
+                ASSERT(node->isAttributeNode());
+
+                // In XPath land, namespace nodes are not accessible on the attribute axis.
+                if (node->namespaceURI() == "http://www.w3.org/2000/xmlns/")
+                    return false;
+
+                if (name == starAtom)
+                    return namespaceURI.isEmpty() || node->namespaceURI() == namespaceURI;
+
+                return node->localName() == name && node->namespaceURI() == namespaceURI;
+            }
+
+            // Node test on the namespace axis is not implemented yet, the caller has a check for it.
+            ASSERT(axis != Step::NamespaceAxis);
+
+            // For other axes, the principal node type is element.
+            ASSERT(primaryNodeType(axis) == Node::ELEMENT_NODE);
+            if (node->nodeType() != Node::ELEMENT_NODE)
+                return false;
+
+            if (name == starAtom)
+                return namespaceURI.isEmpty() || namespaceURI == node->namespaceURI();
+
+            if (node->isHTMLElement() && node->document()->isHTMLDocument()) {
+                // Paths without namespaces should match HTML elements in HTML documents despite those having an XHTML namespace. Names are compared case-insensitively.
+                return equalIgnoringCase(static_cast<Element*>(node)->localName(), name) && (namespaceURI.isNull() || namespaceURI == node->namespaceURI());
+            }
+            return static_cast<Element*>(node)->hasLocalName(name) && namespaceURI == node->namespaceURI();
+        }
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+static inline bool nodeMatches(Node* node, Step::Axis axis, const Step::NodeTest& nodeTest)
+{
+    if (!nodeMatchesBasicTest(node, axis, nodeTest))
+        return false;
+
+    EvaluationContext& evaluationContext = Expression::evaluationContext();
+
+    // Only the first merged predicate may depend on position.
+    ++evaluationContext.position;
+
+    const Vector<Predicate*>& mergedPredicates = nodeTest.mergedPredicates();
+    for (unsigned i = 0; i < mergedPredicates.size(); i++) {
+        Predicate* predicate = mergedPredicates[i];
+
+        evaluationContext.node = node;
+        // No need to set context size - we only get here when evaluating predicates that do not depend on it.
+        if (!predicate->evaluate())
+            return false;
+    }
+
+    return true;
+}
+
+// Result nodes are ordered in axis order. Node test (including merged predicates) is applied.
 void Step::nodesInAxis(Node* context, NodeSet& nodes) const
 {
     ASSERT(nodes.isEmpty());
@@ -88,7 +237,7 @@
                 return;
 
             for (Node* n = context->firstChild(); n; n = n->nextSibling())
-                if (nodeMatches(n))
+                if (nodeMatches(n, ChildAxis, m_nodeTest))
                     nodes.append(n);
             return;
         case DescendantAxis:
@@ -96,17 +245,17 @@
                 return;
 
             for (Node* n = context->firstChild(); n; n = n->traverseNextNode(context))
-                if (nodeMatches(n))
+                if (nodeMatches(n, DescendantAxis, m_nodeTest))
                     nodes.append(n);
             return;
         case ParentAxis:
             if (context->isAttributeNode()) {
                 Node* n = static_cast<Attr*>(context)->ownerElement();
-                if (nodeMatches(n))
+                if (nodeMatches(n, ParentAxis, m_nodeTest))
                     nodes.append(n);
             } else {
                 Node* n = context->parentNode();
-                if (n && nodeMatches(n))
+                if (n && nodeMatches(n, ParentAxis, m_nodeTest))
                     nodes.append(n);
             }
             return;
@@ -114,11 +263,11 @@
             Node* n = context;
             if (context->isAttributeNode()) {
                 n = static_cast<Attr*>(context)->ownerElement();
-                if (nodeMatches(n))
+                if (nodeMatches(n, AncestorAxis, m_nodeTest))
                     nodes.append(n);
             }
             for (n = n->parentNode(); n; n = n->parentNode())
-                if (nodeMatches(n))
+                if (nodeMatches(n, AncestorAxis, m_nodeTest))
                     nodes.append(n);
             nodes.markSorted(false);
             return;
@@ -129,7 +278,7 @@
                 return;
             
             for (Node* n = context->nextSibling(); n; n = n->nextSibling())
-                if (nodeMatches(n))
+                if (nodeMatches(n, FollowingSiblingAxis, m_nodeTest))
                     nodes.append(n);
             return;
         case PrecedingSiblingAxis:
@@ -138,7 +287,7 @@
                 return;
             
             for (Node* n = context->previousSibling(); n; n = n->previousSibling())
-                if (nodeMatches(n))
+                if (nodeMatches(n, PrecedingSiblingAxis, m_nodeTest))
                     nodes.append(n);
 
             nodes.markSorted(false);
@@ -147,15 +296,15 @@
             if (context->isAttributeNode()) {
                 Node* p = static_cast<Attr*>(context)->ownerElement();
                 while ((p = p->traverseNextNode()))
-                    if (nodeMatches(p))
+                    if (nodeMatches(p, FollowingAxis, m_nodeTest))
                         nodes.append(p);
             } else {
                 for (Node* p = context; !isRootDomNode(p); p = p->parentNode()) {
                     for (Node* n = p->nextSibling(); n; n = n->nextSibling()) {
-                        if (nodeMatches(n))
+                        if (nodeMatches(n, FollowingAxis, m_nodeTest))
                             nodes.append(n);
                         for (Node* c = n->firstChild(); c; c = c->traverseNextNode(n))
-                            if (nodeMatches(c))
+                            if (nodeMatches(c, FollowingAxis, m_nodeTest))
                                 nodes.append(c);
                     }
                 }
@@ -168,7 +317,7 @@
             Node* n = context;
             while (Node* parent = n->parent()) {
                 for (n = n->traversePreviousNode(); n != parent; n = n->traversePreviousNode())
-                    if (nodeMatches(n))
+                    if (nodeMatches(n, PrecedingAxis, m_nodeTest))
                         nodes.append(n);
                 n = parent;
             }
@@ -180,20 +329,22 @@
                 return;
 
             // Avoid lazily creating attribute nodes for attributes that we do not need anyway.
-            if (m_nodeTest.kind() == NodeTest::NameTest && m_nodeTest.data() != "*") {
+            if (m_nodeTest.kind() == NodeTest::NameTest && m_nodeTest.data() != starAtom) {
                 RefPtr<Node> n = static_cast<Element*>(context)->getAttributeNodeNS(m_nodeTest.namespaceURI(), m_nodeTest.data());
-                if (n && n->namespaceURI() != "http://www.w3.org/2000/xmlns/") // In XPath land, namespace nodes are not accessible on the attribute axis.
-                    nodes.append(n.release());
+                if (n && n->namespaceURI() != "http://www.w3.org/2000/xmlns/") { // In XPath land, namespace nodes are not accessible on the attribute axis.
+                    if (nodeMatches(n.get(), AttributeAxis, m_nodeTest)) // Still need to check merged predicates.
+                        nodes.append(n.release());
+                }
                 return;
             }
             
-            NamedAttrMap* attrs = context->attributes();
+            NamedNodeMap* attrs = context->attributes();
             if (!attrs)
                 return;
 
             for (unsigned i = 0; i < attrs->length(); ++i) {
                 RefPtr<Attr> attr = attrs->attributeItem(i)->createAttrIfNeeded(static_cast<Element*>(context));
-                if (nodeMatches(attr.get()))
+                if (nodeMatches(attr.get(), AttributeAxis, m_nodeTest))
                     nodes.append(attr.release());
             }
             return;
@@ -202,30 +353,30 @@
             // XPath namespace nodes are not implemented yet.
             return;
         case SelfAxis:
-            if (nodeMatches(context))
+            if (nodeMatches(context, SelfAxis, m_nodeTest))
                 nodes.append(context);
             return;
         case DescendantOrSelfAxis:
-            if (nodeMatches(context))
+            if (nodeMatches(context, DescendantOrSelfAxis, m_nodeTest))
                 nodes.append(context);
             if (context->isAttributeNode()) // In XPath model, attribute nodes do not have children.
                 return;
 
             for (Node* n = context->firstChild(); n; n = n->traverseNextNode(context))
-            if (nodeMatches(n))
+            if (nodeMatches(n, DescendantOrSelfAxis, m_nodeTest))
                 nodes.append(n);
             return;
         case AncestorOrSelfAxis: {
-            if (nodeMatches(context))
+            if (nodeMatches(context, AncestorOrSelfAxis, m_nodeTest))
                 nodes.append(context);
             Node* n = context;
             if (context->isAttributeNode()) {
                 n = static_cast<Attr*>(context)->ownerElement();
-                if (nodeMatches(n))
+                if (nodeMatches(n, AncestorOrSelfAxis, m_nodeTest))
                     nodes.append(n);
             }
             for (n = n->parentNode(); n; n = n->parentNode())
-                if (nodeMatches(n))
+                if (nodeMatches(n, AncestorOrSelfAxis, m_nodeTest))
                     nodes.append(n);
 
             nodes.markSorted(false);
@@ -236,70 +387,6 @@
 }
 
 
-bool Step::nodeMatches(Node* node) const
-{
-    switch (m_nodeTest.kind()) {
-        case NodeTest::TextNodeTest:
-            return node->nodeType() == Node::TEXT_NODE || node->nodeType() == Node::CDATA_SECTION_NODE;
-        case NodeTest::CommentNodeTest:
-            return node->nodeType() == Node::COMMENT_NODE;
-        case NodeTest::ProcessingInstructionNodeTest: {
-            const String& name = m_nodeTest.data();
-            return node->nodeType() == Node::PROCESSING_INSTRUCTION_NODE && (name.isEmpty() || node->nodeName() == name);
-        }
-        case NodeTest::ElementNodeTest:
-            return node->isElementNode();
-        case NodeTest::AnyNodeTest:
-            return true;
-        case NodeTest::NameTest: {
-            const String& name = m_nodeTest.data();
-            const String& namespaceURI = m_nodeTest.namespaceURI();
-
-            if (m_axis == AttributeAxis) {
-                ASSERT(node->isAttributeNode());
-
-                // In XPath land, namespace nodes are not accessible on the attribute axis.
-                if (node->namespaceURI() == "http://www.w3.org/2000/xmlns/")
-                    return false;
-
-                if (name == "*")
-                    return namespaceURI.isEmpty() || node->namespaceURI() == namespaceURI;
-
-                return node->localName() == name && node->namespaceURI() == namespaceURI;
-            }
-
-            if (m_axis == NamespaceAxis) {
-                // Node test on the namespace axis is not implemented yet
-                return false;
-            }
-            
-            if (name == "*")
-                return node->nodeType() == primaryNodeType(m_axis) && (namespaceURI.isEmpty() || namespaceURI == node->namespaceURI());
-
-            // We use tagQName here because we don't want the element name in uppercase 
-            // like we get with HTML elements.
-            // Paths without namespaces should match HTML elements in HTML documents despite those having an XHTML namespace.
-            return node->nodeType() == Node::ELEMENT_NODE
-                    && static_cast<Element*>(node)->tagQName().localName() == name
-                    && ((node->isHTMLElement() && node->document()->isHTMLDocument() && namespaceURI.isNull()) || namespaceURI == node->namespaceURI());
-        }
-    }
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-Node::NodeType Step::primaryNodeType(Axis axis) const
-{
-    switch (axis) {
-        case AttributeAxis:
-            return Node::ATTRIBUTE_NODE;
-        case NamespaceAxis:
-            return Node::XPATH_NAMESPACE_NODE;
-        default:
-            return Node::ELEMENT_NODE;
-    }
-}
-
 }
 }
 
diff --git a/WebCore/xml/XPathStep.h b/WebCore/xml/XPathStep.h
index f1420d0..1c26327 100644
--- a/WebCore/xml/XPathStep.h
+++ b/WebCore/xml/XPathStep.h
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,8 +52,7 @@
             class NodeTest {
             public:
                 enum Kind {
-                    TextNodeTest, CommentNodeTest, ProcessingInstructionNodeTest, AnyNodeTest, NameTest,
-                    ElementNodeTest // XPath 2.0
+                    TextNodeTest, CommentNodeTest, ProcessingInstructionNodeTest, AnyNodeTest, NameTest
                 };
                 
                 NodeTest(Kind kind) : m_kind(kind) {}
@@ -61,44 +60,48 @@
                 NodeTest(Kind kind, const String& data, const String& namespaceURI) : m_kind(kind), m_data(data), m_namespaceURI(namespaceURI) {}
                 
                 Kind kind() const { return m_kind; }
-                const String data() const { return m_data; }
-                const String namespaceURI() const { return m_namespaceURI; }
+                const AtomicString& data() const { return m_data; }
+                const AtomicString& namespaceURI() const { return m_namespaceURI; }
+                Vector<Predicate*>& mergedPredicates() { return m_mergedPredicates; }
+                const Vector<Predicate*>& mergedPredicates() const { return m_mergedPredicates; }
                 
             private:
                 Kind m_kind;
-                String m_data;
-                String m_namespaceURI;
+                AtomicString m_data;
+                AtomicString m_namespaceURI;
+
+                // When possible, we merge some or all predicates with node test for better performance.
+                Vector<Predicate*> m_mergedPredicates;
             };
 
             Step(Axis, const NodeTest& nodeTest, const Vector<Predicate*>& predicates = Vector<Predicate*>());
             ~Step();
 
+            void optimize();
+
             void evaluate(Node* context, NodeSet&) const;
-            
+
             Axis axis() const { return m_axis; }
-            NodeTest nodeTest() const { return m_nodeTest; }
-            const Vector<Predicate*>& predicates() const { return m_predicates; }
-            
-            void setAxis(Axis axis) { m_axis = axis; }
-            void setNodeTest(NodeTest nodeTest) { m_nodeTest = nodeTest; }
-            void setPredicates(const Vector<Predicate*>& predicates) { m_predicates = predicates; }
-            
+            const NodeTest& nodeTest() const { return m_nodeTest; }
+
         private:
+            friend void optimizeStepPair(Step*, Step*, bool&);
+            bool predicatesAreContextListInsensitive() const;
+
             void parseNodeTest(const String&);
             void nodesInAxis(Node* context, NodeSet&) const;
-            bool nodeMatches(Node*) const;
             String namespaceFromNodetest(const String& nodeTest) const;
-            Node::NodeType primaryNodeType(Axis) const;
 
             Axis m_axis;
             NodeTest m_nodeTest;
             Vector<Predicate*> m_predicates;
         };
 
+        void optimizeStepPair(Step*, Step*, bool& dropSecondStep);
     }
 
 }
 
 #endif // ENABLE(XPATH)
 
-#endif // XPath_Step_H
+#endif // XPathStep_h
diff --git a/WebCore/xml/XPathUtil.cpp b/WebCore/xml/XPathUtil.cpp
index ab4b1d4..0100bea 100644
--- a/WebCore/xml/XPathUtil.cpp
+++ b/WebCore/xml/XPathUtil.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2005 Frerich Raabe <raabe@kde.org>
+ * Copyright (C) 2006, 2009 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -51,13 +51,17 @@
             return node->nodeValue();
         default:
             if (isRootDomNode(node) || node->nodeType() == Node::ELEMENT_NODE) {
-                String str;
-                
-                for (Node* n = node->firstChild(); n; n = n->traverseNextNode(node))
-                    if (n->isTextNode())
-                        str += n->nodeValue();
+                Vector<UChar> result;
+                result.reserveCapacity(1024);
 
-                return str;
+                for (Node* n = node->firstChild(); n; n = n->traverseNextNode(node)) {
+                    if (n->isTextNode()) {
+                        const String& nodeValue = n->nodeValue();
+                        result.append(nodeValue.characters(), nodeValue.length());
+                    }
+                }
+
+                return String::adopt(result);
             }
     }
     
diff --git a/WebCore/xml/XPathValue.cpp b/WebCore/xml/XPathValue.cpp
index bac0e13..29e211e 100644
--- a/WebCore/xml/XPathValue.cpp
+++ b/WebCore/xml/XPathValue.cpp
@@ -30,11 +30,11 @@
 #if ENABLE(XPATH)
 
 #include "Node.h"
+#include "XPathExpressionNode.h"
 #include "XPathUtil.h"
-
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
-#include <limits>
 
 using std::numeric_limits;
 
@@ -45,6 +45,9 @@
 
 const NodeSet& Value::toNodeSet() const
 {
+    if (!isNodeSet())
+        Expression::evaluationContext().hadTypeConversionError = true;
+
     if (!m_data) {
         DEFINE_STATIC_LOCAL(NodeSet, emptyNodeSet, ());
         return emptyNodeSet;
@@ -55,6 +58,9 @@
 
 NodeSet& Value::modifiableNodeSet()
 {
+    if (!isNodeSet())
+        Expression::evaluationContext().hadTypeConversionError = true;
+
     if (!m_data)
         m_data = ValueData::create();
     
@@ -86,8 +92,18 @@
         case NumberValue:
             return m_number;
         case StringValue: {
+            const String& str = m_data->m_string.simplifyWhiteSpace();
+
+            // String::toDouble() supports exponential notation, which is not allowed in XPath.
+            unsigned len = str.length();
+            for (unsigned i = 0; i < len; ++i) {
+                UChar c = str[i];
+                if (!isASCIIDigit(c) && c != '.'  && c != '-')
+                    return numeric_limits<double>::quiet_NaN();
+            }
+
             bool canConvert;
-            double value = m_data->m_string.simplifyWhiteSpace().toDouble(&canConvert);
+            double value = str.toDouble(&canConvert);
             if (canConvert)
                 return value;
             return numeric_limits<double>::quiet_NaN();
diff --git a/WebCore/xml/XPathVariableReference.h b/WebCore/xml/XPathVariableReference.h
index 811176d..5e5a59a 100644
--- a/WebCore/xml/XPathVariableReference.h
+++ b/WebCore/xml/XPathVariableReference.h
@@ -33,12 +33,14 @@
 namespace WebCore {
 
     namespace XPath {
-    
+
+        // Variable references are not used with XPathEvaluator.
         class VariableReference : public Expression {
         public:
             VariableReference(const String& name);
         private:
             virtual Value evaluate() const;
+            virtual Value::Type resultType() const { ASSERT_NOT_REACHED(); return Value::NumberValue; }
             String m_name;
         };
 
diff --git a/WebCore/xml/XSLStyleSheet.cpp b/WebCore/xml/XSLStyleSheet.cpp
index 0d112a5..b7d52f8 100644
--- a/WebCore/xml/XSLStyleSheet.cpp
+++ b/WebCore/xml/XSLStyleSheet.cpp
@@ -30,11 +30,12 @@
 #include "DocLoader.h"
 #include "Document.h"
 #include "Frame.h"
-#include "loader.h"
 #include "Node.h"
 #include "XMLTokenizer.h"
+#include "XMLTokenizerScope.h"
 #include "XSLImportRule.h"
 #include "XSLTProcessor.h"
+#include "loader.h"
 
 #include <libxml/uri.h>
 #include <libxslt/xsltutils.h>
@@ -138,7 +139,6 @@
     // Parse in a single chunk into an xmlDocPtr
     const UChar BOM = 0xFEFF;
     const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
-    setLoaderForLibXMLCallbacks(docLoader());
     if (!m_stylesheetDocTaken)
         xmlFreeDoc(m_stylesheetDoc);
     m_stylesheetDocTaken = false;
@@ -146,8 +146,8 @@
     Console* console = 0;
     if (Frame* frame = ownerDocument()->frame())
         console = frame->domWindow()->console();
-    xmlSetStructuredErrorFunc(console, XSLTProcessor::parseErrorFunc);
-    xmlSetGenericErrorFunc(console, XSLTProcessor::genericErrorFunc);
+
+    XMLTokenizerScope scope(docLoader(), XSLTProcessor::genericErrorFunc, XSLTProcessor::parseErrorFunc, console);
 
     const char* buffer = reinterpret_cast<const char*>(string.characters());
     int size = string.length() * sizeof(UChar);
@@ -171,13 +171,9 @@
         BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE", 
         XML_PARSE_NOENT | XML_PARSE_DTDATTR | XML_PARSE_NOWARNING | XML_PARSE_NOCDATA);
     xmlFreeParserCtxt(ctxt);
-    
+
     loadChildSheets();
 
-    xmlSetStructuredErrorFunc(0, 0);
-    xmlSetGenericErrorFunc(0, 0);
-
-    setLoaderForLibXMLCallbacks(0);
     return m_stylesheetDoc;
 }
 
diff --git a/WebCore/xml/XSLTProcessor.cpp b/WebCore/xml/XSLTProcessor.cpp
index 198c90c..3865124 100644
--- a/WebCore/xml/XSLTProcessor.cpp
+++ b/WebCore/xml/XSLTProcessor.cpp
@@ -55,11 +55,10 @@
 #include <wtf/Assertions.h>
 #include <wtf/Platform.h>
 #include <wtf/Vector.h>
-#if PLATFORM(MAC)
-#include "SoftLinking.h"
-#endif
 
 #if PLATFORM(MAC)
+#include "SoftLinking.h"
+
 SOFT_LINK_LIBRARY(libxslt);
 SOFT_LINK(libxslt, xsltFreeStylesheet, void, (xsltStylesheetPtr sheet), (sheet))
 SOFT_LINK(libxslt, xsltFreeTransformContext, void, (xsltTransformContextPtr ctxt), (ctxt))
@@ -128,7 +127,7 @@
 
             bool requestAllowed = globalDocLoader->frame() && globalDocLoader->doc()->securityOrigin()->canRequest(url);
             if (requestAllowed) {
-                globalDocLoader->frame()->loader()->loadResourceSynchronously(url, error, response, data);
+                globalDocLoader->frame()->loader()->loadResourceSynchronously(url, AllowStoredCredentials, error, response, data);
                 requestAllowed = globalDocLoader->doc()->securityOrigin()->canRequest(response.url());
             }
             if (!requestAllowed) {
diff --git a/WebKit/android/RenderSkinCombo.cpp b/WebKit/android/RenderSkinCombo.cpp
index a336257..870c13e 100644
--- a/WebKit/android/RenderSkinCombo.cpp
+++ b/WebKit/android/RenderSkinCombo.cpp
@@ -27,7 +27,7 @@
 #include "RenderSkinCombo.h"
 
 #include "Document.h"
-#include "FormControlElement.h"
+#include "Element.h"
 #include "Node.h"
 #include "SkCanvas.h"
 #include "SkNinePatch.h"
@@ -59,12 +59,8 @@
 {
     if (!s_decoded)
         return true;
-    bool enabled = false;
-    if (FormControlElement* controlElement = toFormControlElement(static_cast<Element*>(element))) {
-        enabled = controlElement->isEnabled();
-    }
 
-    State state = enabled ? kNormal : kDisabled;
+    State state = (element->isElementNode() && static_cast<Element*>(element)->isEnabledFormControl()) ? kNormal : kDisabled;
     if (height < (s_margin<<1) + 1) {
         height = (s_margin<<1) + 1;
     }
diff --git a/WebKit/android/RenderSkinRadio.cpp b/WebKit/android/RenderSkinRadio.cpp
index 831403a..ff5e908 100644
--- a/WebKit/android/RenderSkinRadio.cpp
+++ b/WebKit/android/RenderSkinRadio.cpp
@@ -28,7 +28,7 @@
 
 #include "android_graphics.h"
 #include "Document.h"
-#include "FormControlElement.h"
+#include "Element.h"
 #include "InputElement.h"
 #include "IntRect.h"
 #include "Node.h"
@@ -66,12 +66,8 @@
     int saveLayerCount = 0;
     int saveScaleCount = 0;
 
-    bool enabled = false;
-    if (FormControlElement* control = toFormControlElement(static_cast<Element*>(element))) {
-        enabled = control->isEnabled();
-    }
-
-    if (!enabled) {
+    if (!element->isElementNode() ||
+        !static_cast<Element*>(element)->isEnabledFormControl()) {
         saveLayerCount = canvas->saveLayerAlpha(&r, 0x80);
     }
     SkScalar width = r.width();
diff --git a/WebKit/android/WebCoreSupport/ChromeClientAndroid.cpp b/WebKit/android/WebCoreSupport/ChromeClientAndroid.cpp
index 6e97ae5..39bc004 100644
--- a/WebKit/android/WebCoreSupport/ChromeClientAndroid.cpp
+++ b/WebKit/android/WebCoreSupport/ChromeClientAndroid.cpp
@@ -145,7 +145,7 @@
 // This function is called by the JavaScript bindings to print usually an error to
 // a message console. Pass the message to the java side so that the client can
 // handle it as it sees fit.
-void ChromeClientAndroid::addMessageToConsole(const String& message, unsigned int lineNumber, const String& sourceID) {
+void ChromeClientAndroid::addMessageToConsole(MessageSource, MessageLevel, const String& message, unsigned int lineNumber, const String& sourceID) {
     android::WebViewCore::getWebViewCore(m_webFrame->page()->mainFrame()->view())->addMessageToConsole(message, lineNumber, sourceID);
 }
 
@@ -168,7 +168,7 @@
     mainFrame->loader()->stopAllLoaders();
     // Remove all event listeners so that no javascript can execute as a result
     // of mouse/keyboard events.
-    mainFrame->document()->removeAllEventListenersFromAllNodes();
+    mainFrame->document()->removeAllEventListeners();
     // Close the window.
     m_webFrame->closeWindow(android::WebViewCore::getWebViewCore(mainFrame->view()));
 }
@@ -249,13 +249,16 @@
     return viewBridge;
 }
 
-// new to webkit4 (Feb 27, 2009)
 void ChromeClientAndroid::contentsSizeChanged(Frame*, const IntSize&) const
 {
     notImplemented();
 }
 
-// new to webkit4 (Feb 27, 2009)
+void ChromeClientAndroid::scrollRectIntoView(const IntRect&, const ScrollView*) const
+{
+    notImplemented();
+}
+
 void ChromeClientAndroid::formStateDidChange(const Node*)
 {
     notImplemented();
@@ -309,8 +312,13 @@
 }
 #endif
 
-// new to change 38068 (Nov 6, 2008)
+void ChromeClientAndroid::requestGeolocationPermissionForFrame(Frame*, Geolocation*) { notImplemented(); }
 void ChromeClientAndroid::runOpenPanel(Frame*, PassRefPtr<FileChooser>) { notImplemented(); }
+bool ChromeClientAndroid::setCursor(PlatformCursorHandle)
+{
+    notImplemented(); 
+    return false;
+}
 
 void ChromeClientAndroid::wakeUpMainThreadWithNewQuota(long newQuota) {
     MutexLocker locker(m_quotaThreadLock);
diff --git a/WebKit/android/WebCoreSupport/ChromeClientAndroid.h b/WebKit/android/WebCoreSupport/ChromeClientAndroid.h
index 00c45b9..966d5c7 100644
--- a/WebKit/android/WebCoreSupport/ChromeClientAndroid.h
+++ b/WebKit/android/WebCoreSupport/ChromeClientAndroid.h
@@ -77,7 +77,7 @@
         
         virtual void setResizable(bool);
         
-        virtual void addMessageToConsole(const String& message, unsigned int lineNumber, const String& sourceID);
+        virtual void addMessageToConsole(MessageSource, MessageLevel, const String& message, unsigned int lineNumber, const String& sourceID);
         
         virtual bool canRunBeforeUnloadConfirmPanel();
         virtual bool runBeforeUnloadConfirmPanel(const String& message, Frame* frame);
@@ -100,6 +100,7 @@
         virtual IntRect windowToScreen(const IntRect&) const;
         virtual PlatformWidget platformWindow() const;
         virtual void contentsSizeChanged(Frame*, const IntSize&) const;
+        virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const;
         // End methods used by HostWindow.
 
         virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned int);
@@ -110,12 +111,16 @@
 #if ENABLE(DATABASE)
         virtual void exceededDatabaseQuota(Frame*, const String&);
 #endif
+        virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*);
         virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
+        virtual bool setCursor(PlatformCursorHandle);
 
         // Notification that the given form element has changed. This function
         // will be called frequently, so handling should be very fast.
         virtual void formStateDidChange(const Node*);
 
+        virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() { return 0; }
+
         // Android-specific
         void setWebFrame(android::WebFrame* webframe);
         void wakeUpMainThreadWithNewQuota(long newQuota);
diff --git a/WebKit/android/WebCoreSupport/EditorClientAndroid.cpp b/WebKit/android/WebCoreSupport/EditorClientAndroid.cpp
index 8629731..4918ee9 100644
--- a/WebKit/android/WebCoreSupport/EditorClientAndroid.cpp
+++ b/WebKit/android/WebCoreSupport/EditorClientAndroid.cpp
@@ -219,6 +219,7 @@
 bool EditorClientAndroid::spellingUIIsShowing() { return false; }
 void EditorClientAndroid::checkGrammarOfString(unsigned short const*, int, WTF::Vector<GrammarDetail>&, int*, int*) {}
 void EditorClientAndroid::checkSpellingOfString(unsigned short const*, int, int*, int*) {}
+String EditorClientAndroid::getAutoCorrectSuggestionForMisspelledWord(const String&) { return String(); }
 void EditorClientAndroid::textFieldDidEndEditing(Element*) {}
 void EditorClientAndroid::textDidChangeInTextArea(Element*) {}
 void EditorClientAndroid::textDidChangeInTextField(Element*) {}
diff --git a/WebKit/android/WebCoreSupport/EditorClientAndroid.h b/WebKit/android/WebCoreSupport/EditorClientAndroid.h
index 763b097..9697d66 100644
--- a/WebKit/android/WebCoreSupport/EditorClientAndroid.h
+++ b/WebKit/android/WebCoreSupport/EditorClientAndroid.h
@@ -94,6 +94,7 @@
     virtual void ignoreWordInSpellDocument(const String&);
     virtual void learnWord(const String&);
     virtual void checkSpellingOfString(const UChar*, int length, int* misspellingLocation, int* misspellingLength);
+    virtual String getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWorld);
     virtual void checkGrammarOfString(const UChar*, int length, WTF::Vector<GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength);
     virtual void updateSpellingUIWithGrammarString(const String&, const GrammarDetail& detail);
     virtual void updateSpellingUIWithMisspelledWord(const String&);
diff --git a/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.cpp b/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.cpp
index 274280e..0f0509d 100644
--- a/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.cpp
+++ b/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.cpp
@@ -191,6 +191,10 @@
     return false;
 }
 
+void FrameLoaderClientAndroid::dispatchDidLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString&) {
+    return;
+}
+
 void FrameLoaderClientAndroid::dispatchDidHandleOnloadEvents() {
 }
 
@@ -226,10 +230,12 @@
     WebCore::Image* icon = WebCore::iconDatabase()->iconForPageURL(
             url, WebCore::IntSize(16, 16));
     // If the request fails, try the original request url.
-    if (!icon)
+    if (!icon) {
+        DocumentLoader* docLoader = m_frame->loader()->activeDocumentLoader();
+        KURL originalURL = docLoader->originalRequest().url();
         icon = WebCore::iconDatabase()->iconForPageURL(
-                m_frame->loader()->originalRequestURL().string(),
-                WebCore::IntSize(16, 16));
+                   originalURL, WebCore::IntSize(16, 16));
+    }
     // There is a bug in webkit where cancelling an icon load is treated as a
     // failure. When this is fixed, we can ASSERT again that we have an icon.
     if (icon) {
@@ -746,8 +752,7 @@
 }
 
 void FrameLoaderClientAndroid::prepareForDataSourceReplacement() {
-    ASSERT(m_frame);
-    m_frame->loader()->detachChildren();
+    verifiedOk();
 }
 
 PassRefPtr<DocumentLoader> FrameLoaderClientAndroid::createDocumentLoader(
@@ -790,19 +795,16 @@
     m_frame->setView(NULL);
 
     // Create a new FrameView and associate it with the saved webFrameView
-    FrameView* view = new FrameView(m_frame);
-    webFrameView->setView(view);
+    RefPtr<FrameView> view = FrameView::create(m_frame);
+    webFrameView->setView(view.get());
 
     Release(webFrameView);
 
     // Give the new FrameView to the Frame
     m_frame->setView(view);
 
-    // Deref since FrameViews are created with a ref of 1
-    view->deref();
-
     if (m_frame->ownerRenderer())
-        m_frame->ownerRenderer()->setWidget(view);
+        m_frame->ownerRenderer()->setWidget(view.get());
 
     m_frame->view()->initScrollbars();
 
@@ -834,15 +836,13 @@
     parent->tree()->appendChild(newFrame);
     newFrame->tree()->setName(name);
     // Create a new FrameView and WebFrameView for the child frame to draw into.
-    FrameView* frameView = new WebCore::FrameView(newFrame);
-    WebFrameView* webFrameView = new WebFrameView(frameView, 
+    RefPtr<FrameView> frameView = FrameView::create(newFrame);
+    WebFrameView* webFrameView = new WebFrameView(frameView.get(), 
             WebViewCore::getWebViewCore(parent->view()));
     // frameView Retains webFrameView, so call Release for webFrameView
     Release(webFrameView);
     // Attach the frameView to the newFrame.
     newFrame->setView(frameView);
-    // setView() refs the frameView so call deref on the frameView
-    frameView->deref();
     newFrame->init();
     newFrame->selection()->setFocused(true);
     LOGV("::WebCore:: createSubFrame returning %p", newFrame);
diff --git a/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.h b/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.h
index 2816c78..d491750 100644
--- a/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.h
+++ b/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.h
@@ -71,6 +71,7 @@
         virtual void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
         virtual void dispatchDidFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError&);
         virtual bool dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int length);
+        virtual void dispatchDidLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString&);
 
         virtual void dispatchDidHandleOnloadEvents();
         virtual void dispatchDidReceiveServerRedirectForProvisionalLoad();
diff --git a/WebKit/android/jni/JavaBridge.cpp b/WebKit/android/jni/JavaBridge.cpp
index 6cb2167..98d7c43 100644
--- a/WebKit/android/jni/JavaBridge.cpp
+++ b/WebKit/android/jni/JavaBridge.cpp
@@ -70,7 +70,7 @@
     virtual void setSharedTimer(long long timemillis);
     virtual void stopSharedTimer();
 
-    virtual void setCookies(WebCore::KURL const& url, WebCore::KURL const& docURL, WebCore::String const& value);
+    virtual void setCookies(WebCore::KURL const& url, WebCore::String const& value);
     virtual WebCore::String cookies(WebCore::KURL const& url);
     virtual bool cookiesEnabled();
 
@@ -114,7 +114,7 @@
 
     mSetSharedTimer = env->GetMethodID(clazz, "setSharedTimer", "(J)V");
     mStopSharedTimer = env->GetMethodID(clazz, "stopSharedTimer", "()V");
-    mSetCookies = env->GetMethodID(clazz, "setCookies", "(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V");
+    mSetCookies = env->GetMethodID(clazz, "setCookies", "(Ljava/lang/String;Ljava/lang/String;)V");
     mCookies = env->GetMethodID(clazz, "cookies", "(Ljava/lang/String;)Ljava/lang/String;");
     mCookiesEnabled = env->GetMethodID(clazz, "cookiesEnabled", "()Z");
     mGetPluginDirectories = env->GetMethodID(clazz, "getPluginDirectories", "()[Ljava/lang/String;");
@@ -160,19 +160,16 @@
 }
 
 void
-JavaBridge::setCookies(WebCore::KURL const& url, WebCore::KURL const& docUrl, WebCore::String const& value)
+JavaBridge::setCookies(WebCore::KURL const& url, WebCore::String const& value)
 {
     JNIEnv* env = JSC::Bindings::getJNIEnv();
     const WebCore::String& urlStr = url.string();
     jstring jUrlStr = env->NewString(urlStr.characters(), urlStr.length());
-    const WebCore::String& docUrlStr = docUrl.string();
-    jstring jDocUrlStr = env->NewString(docUrlStr.characters(), docUrlStr.length());
     jstring jValueStr = env->NewString(value.characters(), value.length());
 
     AutoJObject obj = getRealObject(env, mJavaObject);
-    env->CallVoidMethod(obj.get(), mSetCookies, jUrlStr, jDocUrlStr, jValueStr);
+    env->CallVoidMethod(obj.get(), mSetCookies, jUrlStr, jValueStr);
     env->DeleteLocalRef(jUrlStr);
-    env->DeleteLocalRef(jDocUrlStr);
     env->DeleteLocalRef(jValueStr);
 }
 
diff --git a/WebKit/android/jni/WebCoreFrameBridge.cpp b/WebKit/android/jni/WebCoreFrameBridge.cpp
index 8c3f69e..7860b8c 100644
--- a/WebKit/android/jni/WebCoreFrameBridge.cpp
+++ b/WebKit/android/jni/WebCoreFrameBridge.cpp
@@ -41,6 +41,7 @@
 #include "EditorClientAndroid.h"
 #include "Element.h"
 #include "Font.h"
+#include "FormState.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClientAndroid.h"
@@ -48,6 +49,7 @@
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HistoryItem.h"
+#include "HTMLCollection.h"
 #include "HTMLElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLInputElement.h"
@@ -739,17 +741,15 @@
     WebViewCore* webViewCore = new WebViewCore(env, javaview, frame);
 
     // Create a FrameView
-    WebCore::FrameView* frameView = new WebCore::FrameView(frame);
+    RefPtr<WebCore::FrameView> frameView = WebCore::FrameView::create(frame);
     // Create a WebFrameView
-    WebFrameView* webFrameView = new WebFrameView(frameView, webViewCore);
+    WebFrameView* webFrameView = new WebFrameView(frameView.get(), webViewCore);
     // As webFrameView Retains webViewCore, release our ownership
     Release(webViewCore);
     // As frameView Retains webFrameView, release our ownership
     Release(webFrameView);
     // Attach the frameView to the frame and release our ownership
     frame->setView(frameView);
-    frameView->deref();
-
     // Set the frame to active to turn on keyboard focus.
     frame->init();
     frame->selection()->setFocused(true);
@@ -831,6 +831,9 @@
     }
 
     LOGV("PostUrl %s", kurl.string().latin1().data());
+    // FIXME klobag, WebCore changed FrameLoader::loadPostRequest to private,
+    // I temporarily made it public in FrameLoader.h, please figure out
+    // if we can use FrameLoader::load(...) to send POST request.
     pFrame->loader()->loadPostRequest(request, String(), String(), false,
             WebCore::FrameLoadTypeStandard, 0, 0, true);
 }
diff --git a/WebKit/android/jni/WebCoreResourceLoader.cpp b/WebKit/android/jni/WebCoreResourceLoader.cpp
index d4eda81..8e8d44d 100644
--- a/WebKit/android/jni/WebCoreResourceLoader.cpp
+++ b/WebKit/android/jni/WebCoreResourceLoader.cpp
@@ -160,10 +160,11 @@
         response->setHTTPStatusText(status);
         LOGV("Response setStatusText: %s", status.latin1().data());
     }
-    // FIXME: This assumes that time_t is a long and that long is the same size as int.
-    if ((unsigned long)expireTime > INT_MAX)
-        expireTime = INT_MAX;
-    response->setExpirationDate((time_t)expireTime);
+    // FIXME klobag, WebCore::ResourceResponse changed the way of setting
+    // expiration date. Now it has to set the HTTP header as,
+    // 'expires':<date format string>.
+    // Temporarily disable the code.
+    // response->setHTTPHeaderField("expires", expireTime); 
     return (int)response;
 }
    
diff --git a/WebKit/android/jni/WebHistory.cpp b/WebKit/android/jni/WebHistory.cpp
index 01fd543..aa80bf0 100644
--- a/WebKit/android/jni/WebHistory.cpp
+++ b/WebKit/android/jni/WebHistory.cpp
@@ -120,7 +120,7 @@
         while (child) {
             // Use the old history item since the current one may have a
             // deleted parent.
-            WebCore::HistoryItem* item = parent->childItemWithName(child->tree()->name());
+            WebCore::HistoryItem* item = parent->childItemWithTarget(child->tree()->name());
             child->loader()->setCurrentHistoryItem(item);
             // Append the first child to the queue if it exists.
             if (WebCore::Frame* f = child->tree()->firstChild())
diff --git a/WebKit/android/jni/WebViewCore.cpp b/WebKit/android/jni/WebViewCore.cpp
index 685b41f..0d5a3dd 100644
--- a/WebKit/android/jni/WebViewCore.cpp
+++ b/WebKit/android/jni/WebViewCore.cpp
@@ -1522,9 +1522,11 @@
         if (!m_select || !CacheBuilder::validNode(m_viewImpl->m_mainFrame,
                 m_frame, m_select))
             return;
+        // FIXME: scroggo, listToOptionIndex was made private in HTMLSelectElement.
         int optionIndex = m_select->listToOptionIndex(index);
         m_select->setSelectedIndex(optionIndex, true, false);
-        m_select->onChange();
+        // FIXME: scroggo, onChange is removed from HTMLSelectElement.
+        // m_select->onChange();
         m_viewImpl->contentInvalidate(m_select->getRect());
     }
 
@@ -1541,7 +1543,7 @@
         // If count is 1 or 0, use replyInt.
         SkASSERT(count > 1);
 
-        const WTF::Vector<HTMLElement*>& items = m_select->listItems();
+        const WTF::Vector<Element*>& items = m_select->listItems();
         int totalItems = static_cast<int>(items.size());
         // Keep track of the position of the value we are comparing against.
         int arrayIndex = 0;
@@ -1563,7 +1565,8 @@
                     option->setSelectedState(false);
             }
         }
-        m_select->onChange();
+        // FIXME scroggo, onChange is removed from HTMLSelectElement
+        // m_select->onChange();
         m_viewImpl->contentInvalidate(m_select->getRect());
     }
 private:
@@ -1747,7 +1750,7 @@
         WebCore::RenderObject* renderer = nodePtr->renderer();
         if (renderer && renderer->isMenuList()) {
             WebCore::HTMLSelectElement* select = static_cast<WebCore::HTMLSelectElement*>(nodePtr);
-            const WTF::Vector<WebCore::HTMLElement*>& listItems = select->listItems();
+            const WTF::Vector<WebCore::Element*>& listItems = select->listItems();
             SkTDArray<const uint16_t*> names;
             SkTDArray<int> enabledArray;
             SkTDArray<int> selectedArray;
diff --git a/WebKit/android/stl/algorithm b/WebKit/android/stl/algorithm
index 4453ea3..131fe0d 100644
--- a/WebKit/android/stl/algorithm
+++ b/WebKit/android/stl/algorithm
@@ -71,6 +71,24 @@
       __b = __tmp;
     }
 
+  template<typename _Tp>
+    inline void
+    reverse(_Tp* __first, _Tp* __last)
+    {
+      while(true)
+      {
+        if (__first == __last || __first == --__last)
+          return;
+        else
+        {
+          _Tp __tmp = *__first;
+          *__first = *__last;
+          *__last = __tmp;
+        }
+        ++__first;
+      }
+    }
+
   #undef min
   #undef max